commit 028ef9c96e96197026887c0f092424679298aae8 Author: Linus Torvalds Date: Sun Apr 12 13:48:06 2026 -0700 Linux 7.0 commit 10d97b74e2eef787d823f9bc05cb044b47d25c41 Merge: 35bdc192d82916 51520e03e70d6c Author: Linus Torvalds Date: Sun Apr 12 11:56:07 2026 -0700 Merge tag 'edac_urgent_for_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Fix the error path ordering when the driver-private descriptor allocation fails * tag 'edac_urgent_for_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/mc: Fix error path ordering in edac_mc_alloc() commit 35bdc192d829164a6e47184d06401918fe3d7f1f Merge: ab3dee26406be0 703ccb63ae9f74 Author: Linus Torvalds Date: Sun Apr 12 10:42:40 2026 -0700 Merge tag 'wq-for-7.0-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: "This is a fix for a stall which triggers on ordered workqueues when there are multiple inactive work items during workqueue property changes through sysfs, which doesn't happen that frequently. While really late, the fix is very low risk as it just repeats an operation which is already being performed: - Fix incomplete activation of multiple inactive works when unplugging a pool_workqueue, where the pending_pwqs list wasn't being updated for subsequent works" * tag 'wq-for-7.0-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works commit ab3dee26406be0ed0a26af70311dcdc760db3996 Merge: 02640d8886a13a d6e152d905bdb1 Author: Linus Torvalds Date: Sun Apr 12 10:01:55 2026 -0700 Merge tag 'timers-urgent-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: "Two fixes for the time/timers subsystem: - Invert the inverted fastpath decision in check_tick_dependency(), which prevents NOHZ full to stop the tick. That's a regression introduced in the 7.0 merge window. - Prevent a unpriviledged DoS in the clockevents code, where user space can starve the timer interrupt by arming a timerfd or posix interval timer in a tight loop with an absolute expiry time in the past. The fix turned out to be incomplete and was was amended yesterday to make it work on some 20 years old AMD machines as well. All issues with it have been confirmed to be resolved by various reporters" * tag 'timers-urgent-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clockevents: Prevent timer interrupt starvation tick/nohz: Fix inverted return value in check_tick_dependency() fast path commit 02640d8886a13a78d20a834d94d3eda9269a0606 Merge: d71358127c6277 14a857056466be Author: Linus Torvalds Date: Sun Apr 12 08:30:20 2026 -0700 Merge tag 'sched-urgent-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix DL server related slowdown to deferred fair tasks" * tag 'sched-urgent-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Use revised wakeup rule for dl_server commit d71358127c6277521e2c31566b95b2fd20a38be9 Merge: c919577eeed096 0422b07bc4c296 Author: Linus Torvalds Date: Sun Apr 12 08:27:09 2026 -0700 Merge tag 'ras-urgent-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 MCE fix from Ingo Molnar: "Fix incorrect hardware errors reported on Zen3 CPUs, such as bogus L3 cache deferred errors (Yazen Ghannam)" * tag 'ras-urgent-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce/amd: Filter bogus hardware errors on Zen3 clients commit c919577eeed096bd80d6147a386701221df10484 Merge: 8648ac819d4bc0 16bcbe6738bea7 Author: Linus Torvalds Date: Sun Apr 12 08:17:52 2026 -0700 Merge tag 'perf-urgent-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Four Intel uncore PMU driver fixes by Zide Chen" * tag 'perf-urgent-2026-04-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/uncore: Remove extra double quote mark perf/x86/intel/uncore: Fix die ID init and look up bugs perf/x86/intel/uncore: Skip discovery table for offline dies perf/x86/intel/uncore: Fix iounmap() leak on global_init failure commit 8648ac819d4bc08f7d2a1e0bc9ec2d83de31f19d Merge: f5459048c38a00 3d14bd48e3a770 Author: Linus Torvalds Date: Sun Apr 12 08:11:02 2026 -0700 Merge tag 'v7.0-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Enforce rx socket buffer limit in af_alg - Fix array overflow in af_alg_pull_tsgl - Fix out-of-bounds access when parsing extensions in X.509 - Fix minimum rx size check in algif_aead * tag 'v7.0-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: algif_aead - Fix minimum RX size check for decryption X.509: Fix out-of-bounds access when parsing extensions crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl crypto: af_alg - limit RX SG extraction by receive buffer budget commit 3d14bd48e3a77091cbce637a12c2ae31b4a1687c Author: Herbert Xu Date: Sun Apr 12 13:32:21 2026 +0800 crypto: algif_aead - Fix minimum RX size check for decryption The check for the minimum receive buffer size did not take the tag size into account during decryption. Fix this by adding the required extra length. Reported-by: syzbot+aa11561819dc42ebbc7c@syzkaller.appspotmail.com Reported-by: Daniel Pouzzner Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management") Signed-off-by: Herbert Xu commit d702c3408213bb12bd570bb97204d8340d141c51 Author: Lukas Wunner Date: Tue Apr 7 12:58:18 2026 +0200 X.509: Fix out-of-bounds access when parsing extensions Leo reports an out-of-bounds access when parsing a certificate with empty Basic Constraints or Key Usage extension because the first byte of the extension is read before checking its length. Fix it. The bug can be triggered by an unprivileged user by submitting a specially crafted certificate to the kernel through the keyrings(7) API. Leo has demonstrated this with a proof-of-concept program responsibly disclosed off-list. Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA") Fixes: 567671281a75 ("KEYS: X.509: Parse Key Usage") Reported-by: Leo Lin # off-list Signed-off-by: Lukas Wunner Reviewed-by: Ignat Korchagin Cc: stable@vger.kernel.org # v6.4+ Signed-off-by: Herbert Xu commit 31d00156e50ecad37f2cb6cbf04aaa9a260505ef Author: Herbert Xu Date: Sat Apr 4 08:29:58 2026 +0800 crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more page than necessary. Add the check to the reassignment so that this does not happen. Also update the comment which still refers to the obsolete offset argument. Reported-by: syzbot+d23888375c2737c17ba5@syzkaller.appspotmail.com Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management") Signed-off-by: Herbert Xu commit f5459048c38a00fc583658d6dcd0f894aff6df8f Merge: e753c16cb3dd1e 0637a3086b4fc4 Author: Linus Torvalds Date: Sat Apr 11 17:06:05 2026 -0700 Merge tag 'i2c-for-7.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: - imx: set dma_slave_config to 0 and avoid uninitialized fields * tag 'i2c-for-7.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: imx: zero-initialize dma_slave_config for eDMA commit e753c16cb3dd1e8feee6977c330d21fbe0e2db0b Merge: e8ab3110525dfc 705355a82b8ea8 Author: Linus Torvalds Date: Sat Apr 11 12:49:21 2026 -0700 Merge tag 'spi-fix-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of changes here, one update to MAINTAINERS for the AMD controller and a chnage from Pei Xiao which in spite of the changelog is actually a fix - previously the zynq-qspi driver leaked a clock enable for every flash operation it did which isn't good, these extra enables were removed when doing the enable cleanup which are probably a good idea anyway" * tag 'spi-fix-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: MAINTAINERS: Update AMD SPI driver maintainers spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() commit e8ab3110525dfceba34c1bb777a92f156095c6da Merge: 086aca1030cff9 b1baaff4e5231f Author: Linus Torvalds Date: Sat Apr 11 12:35:16 2026 -0700 Merge tag 'regulator-fix-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One last fix for v7.0, the BD72720 incorrectly described which DCDC is tied to the LDO for its LDON-HEAD mode which automates using the DCDC to more efficiently drop a supply for delivery via the LDO" * tag 'regulator-fix-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: bd71828-regulator.c: Fix LDON-HEAD mode commit 086aca1030cff9e4729785bcfafaf4b8c489a892 Merge: 558b9206d59c31 1fe7294dfb7d26 Author: Linus Torvalds Date: Sat Apr 11 11:45:20 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "s390: - vsie: Fix races with partial gmap invalidations x86: - Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: s390: vsie: Fix races with partial gmap invalidations KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs commit 558b9206d59c317186786ec21c1b616ab6a6f0a4 Merge: 6b5199f4cf8d87 4346be6577aaa0 Author: Linus Torvalds Date: Sat Apr 11 11:33:08 2026 -0700 Merge tag 'probes-fixes-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing probe fix from Masami Hiramatsu: "Reject non-closed empty immediate strings Fix a buffer index underflow bug that occurred when passing an non-closed empty immediate string to the probe event" * tag 'probes-fixes-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/probe: reject non-closed empty immediate strings commit 6b5199f4cf8d87e0952043c814cc3c6d45ae9ef6 Merge: 778322a06e217e 5a1140404cbf7b Author: Linus Torvalds Date: Sat Apr 11 11:30:18 2026 -0700 Merge tag 'usb-7.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fix from Greg KH: "Here is a single USB fix for a reported regression in a recent USB typec patch for 7.0-final. Sorry for the late submission, but it does fix a problem that people have been seeing with 7.0-rc7 and the stable kernels (due to a backported fix from there.) This has been in linux-next this week with no reported issues, and the reporter (Takashi), has said it resolves the problem they were seeing" * tag 'usb-7.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: typec: ucsi: skip connector validation before init commit 778322a06e217e768ba3dc550a6f599f73ed781d Merge: e774d5f1bc27a8 ff14dafde15c11 Author: Linus Torvalds Date: Sat Apr 11 11:12:38 2026 -0700 Merge tag 'input-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: "Two fixes for force feedback handling in uinput driver: - fix circular locking dependency in uinput - fix potential corruption of uinput event queue" * tag 'input-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: uinput - take event lock when submitting FF request "event" Input: uinput - fix circular locking dependency with ff-core commit 1fe7294dfb7d26f70bc8f6d7aff26bf76ed32214 Merge: 0e9b0e012459af 3ffe5eb4a5f248 Author: Paolo Bonzini Date: Sat Apr 11 14:11:23 2026 +0200 Merge tag 'kvm-s390-master-7.0-4' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: One very last second fix Fix one more gmap-rewrite issue: races with partial gmap invalidations. commit 0e9b0e012459af5a1644473ec242e80015ceab76 Merge: 591cd656a1bf5e 2619da73bb2f10 Author: Paolo Bonzini Date: Sat Apr 11 14:10:44 2026 +0200 Merge tag 'kvm-x86-fixes-7.1' of https://github.com/kvm-x86/linux into HEAD KVM x86 fixes for 7.1 Declare flexible arrays in uAPI structures using __DECLARE_FLEX_ARRAY() so that KVM's uAPI headers can be included in C++ projects. commit e774d5f1bc27a85f858bce7688509e866f8e8a4e Merge: c43adb3613a8b1 08ee1559052be3 Author: Linus Torvalds Date: Fri Apr 10 17:27:08 2026 -0700 Merge tag 'riscv-for-linus-v7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: "Before v7.0 is released, fix a few issues with the CFI patchset, merged earlier in v7.0-rc, that primarily affect interfaces to non-kernel code: - Improve the prctl() interface for per-task indirect branch landing pad control to expand abbreviations and to resemble the speculation control prctl() interface - Expand the "LP" and "SS" abbreviations in the ptrace uapi header file to "branch landing pad" and "shadow stack", to improve readability - Fix a typo in a CFI-related macro name in the ptrace uapi header file - Ensure that the indirect branch tracking state and shadow stack state are unlocked immediately after an exec() on the new task so that libc subsequently can control it - While working in this area, clean up the kernel-internal, cross-architecture prctl() function names by expanding the abbreviations mentioned above" * tag 'riscv-for-linus-v7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: prctl: cfi: change the branch landing pad prctl()s to be more descriptive riscv: ptrace: cfi: expand "SS" references to "shadow stack" in uapi headers prctl: rename branch landing pad implementation functions to be more explicit riscv: ptrace: expand "LP" references to "branch landing pads" in uapi headers riscv: cfi: clear CFI lock status in start_thread() riscv: ptrace: cfi: fix "PRACE" typo in uapi header commit c43adb3613a8b1be0396d0a38a8ab6be633d48d8 Merge: 7c6c4ed80b874f b3be33f2c18f7e Author: Linus Torvalds Date: Fri Apr 10 17:18:20 2026 -0700 Merge tag 'drm-fixes-2026-04-11' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Last set of fixes, a few vc4, and i915, one xe and one ethosu Kconfig fix. xe: - Fix HW engine idleness unit conversion i915: - Drop check for changed VM in EXECBUF - Fix refcount underflow race in intel_engine_park_heartbeat - Do not use pipe_src as borders for SU area in PSR vc4: - runtime pm reference fix - memory leak fixes - locking fix ethosu: - make ARM only" * tag 'drm-fixes-2026-04-11' of https://gitlab.freedesktop.org/drm/kernel: drm/i915/gem: Drop check for changed VM in EXECBUF drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat drm/xe: Fix bug in idledly unit conversion drm/i915/psr: Do not use pipe_src as borders for SU area accel: ethosu: Add hardware dependency hint drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock drm/vc4: Fix a memory leak in hang state error path drm/vc4: Fix memory leak of BO array in hang state drm/vc4: Release runtime PM reference after binding V3D commit b3be33f2c18f7e3663d103a92cdd00b4771b4aa7 Merge: 93be8c74b614a8 a13edf9b92fc47 Author: Dave Airlie Date: Sat Apr 11 07:35:21 2026 +1000 Merge tag 'drm-intel-fixes-2026-04-09' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Drop check for changed VM in EXECBUF - Fix refcount underflow race in intel_engine_park_heartbeat - Do not use pipe_src as borders for SU area in PSR Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/add6fPHRC7Bc8Uri@jlahtine-mobl commit d6e152d905bdb1f32f9d99775e2f453350399a6a Author: Thomas Gleixner Date: Tue Apr 7 10:54:17 2026 +0200 clockevents: Prevent timer interrupt starvation Calvin reported an odd NMI watchdog lockup which claims that the CPU locked up in user space. He provided a reproducer, which sets up a timerfd based timer and then rearms it in a loop with an absolute expiry time of 1ns. As the expiry time is in the past, the timer ends up as the first expiring timer in the per CPU hrtimer base and the clockevent device is programmed with the minimum delta value. If the machine is fast enough, this ends up in a endless loop of programming the delta value to the minimum value defined by the clock event device, before the timer interrupt can fire, which starves the interrupt and consequently triggers the lockup detector because the hrtimer callback of the lockup mechanism is never invoked. As a first step to prevent this, avoid reprogramming the clock event device when: - a forced minimum delta event is pending - the new expiry delta is less then or equal to the minimum delta Thanks to Calvin for providing the reproducer and to Borislav for testing and providing data from his Zen5 machine. The problem is not limited to Zen5, but depending on the underlying clock event device (e.g. TSC deadline timer on Intel) and the CPU speed not necessarily observable. This change serves only as the last resort and further changes will be made to prevent this scenario earlier in the call chain as far as possible. [ tglx: Updated to restore the old behaviour vs. !force and delta <= 0 and fixed up the tick-broadcast handlers as pointed out by Borislav ] Fixes: d316c57ff6bf ("[PATCH] clockevents: add core functionality") Reported-by: Calvin Owens Signed-off-by: Thomas Gleixner Tested-by: Calvin Owens Tested-by: Borislav Petkov Link: https://lore.kernel.org/lkml/acMe-QZUel-bBYUh@mozart.vkv.me/ Link: https://patch.msgid.link/20260407083247.562657657@kernel.org commit 7c6c4ed80b874f721bc7c2c937e098c56e37d2f0 Merge: 96463e4e0268dd cb76a81c7cec37 Author: Linus Torvalds Date: Fri Apr 10 08:40:49 2026 -0700 Merge tag 'vfs-7.0-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "The kernfs rbtree is keyed by (hash, ns, name) where the hash is seeded with the raw namespace pointer via init_name_hash(ns). The resulting hash values are exposed to userspace through readdir seek positions, and the pointer-based ordering in kernfs_name_compare() is observable through entry order. Switch from raw pointers to ns_common::ns_id for both hashing and comparison. A preparatory commit first replaces all const void * namespace parameters with const struct ns_common * throughout kernfs, sysfs, and kobject so the code can access ns->ns_id. Also compare the ns_id when hashes match in the rbtree to handle crafted collisions. Also fix eventpoll RCU grace period issue and a cachefiles refcount problem" * tag 'vfs-7.0-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: kernfs: make directory seek namespace-aware kernfs: use namespace id instead of pointer for hashing and comparison kernfs: pass struct ns_common instead of const void * for namespace tags eventpoll: defer struct eventpoll free to RCU grace period cachefiles: fix incorrect dentry refcount in cachefiles_cull() commit 96463e4e0268dddbdb60fd1b96800736aa2bade9 Merge: 017102b40c34b5 ba893caead5474 Author: Linus Torvalds Date: Fri Apr 10 08:36:32 2026 -0700 Merge tag 'turbostat-fixes-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat fixes from Len Brown: - Fix a memory allocation issue that could corrupt output values or SEGV - Fix a perf initilization issue that could exit on some HW + kernels - Minor fixes * tag 'turbostat-fixes-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: Allow execution to continue after perf_l2_init() failure tools/power turbostat: Fix delimiter bug in print functions tools/power turbostat: Fix --show/--hide for individual cpuidle counters tools/power turbostat: Fix incorrect format variable tools/power turbostat: Consistently use print_float_value() tools/power/turbostat: Fix microcode patch level output for AMD/Hygon tools/power turbostat: Eliminate unnecessary data structure allocation tools/power turbostat: Fix swidle header vs data display tools/power turbostat: Fix illegal memory access when SMT is present and disabled commit 017102b40c34b5a67de46230bdfb06096dd11716 Merge: 77c3c619d2af25 57df6923ca53b5 Author: Linus Torvalds Date: Fri Apr 10 08:32:30 2026 -0700 Merge tag 'gpio-fixes-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - gracefully handle missing regmap in gpio-bd72720 - fix IRQ resource release in gpio-tegra - return -ENOMEM on devm_kzalloc() failure instead of -ENODEV in gpio-tegra * tag 'gpio-fixes-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: tegra: return -ENOMEM on allocation failure in probe gpio: tegra: fix irq_release_resources calling enable instead of disable gpio: bd72720: handle missing regmap commit 77c3c619d2af2540b15e63dca768c0d86be746c9 Merge: 9a9c8ce300cd38 db5b8cecbdf479 Author: Linus Torvalds Date: Fri Apr 10 08:26:40 2026 -0700 Merge tag 'pinctrl-v7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Some late pin control fixes. I'm not happy to have bugs so late in the kernel cycle, but they are all driver specifics so I guess it's how it is. - Three fixes for the Intel pin control driver fixing the feature set for the new silicon - One fix for an IRQ storm in the MCP23S08 pin controller/GPIO expander" * tag 'pinctrl-v7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: mcp23s08: Disable all pin interrupts during probe pinctrl: intel: Enable 3-bit PAD_OWN feature pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) pinctrl: intel: Improve capability support commit ba893caead54745595e29953f0531cf3651610aa Author: David Arcari Date: Thu Mar 19 10:03:07 2026 -0400 tools/power turbostat: Allow execution to continue after perf_l2_init() failure Currently, if perf_l2_init() fails turbostat exits after issuing the following error (which was encountered on AlderLake): turbostat: perf_l2_init(cpu0, 0x0, 0xff24) REFS: Invalid argument This occurs because perf_l2_init() calls err(). However, the code has been written in such a manner that it is able to perform cleanup and continue. Therefore, this issue can be addressed by changing the appropriate calls to err() to warnx(). Additionally, correct the PMU type arguments passed to the warning strings in the ecore and lcore blocks so the logs accurately reflect the failing counter type. Signed-off-by: David Arcari Signed-off-by: Len Brown commit 57df6923ca53b524d06d2347b896d9de74b3bc86 Author: Samasth Norway Ananda Date: Thu Apr 9 11:58:53 2026 -0700 gpio: tegra: return -ENOMEM on allocation failure in probe devm_kzalloc() failure in tegra_gpio_probe() returns -ENODEV, which indicates "no such device". The correct error code for a memory allocation failure is -ENOMEM. Signed-off-by: Samasth Norway Ananda Link: https://patch.msgid.link/20260409185853.2163034-1-samasth.norway.ananda@oracle.com Signed-off-by: Bartosz Golaszewski commit 93be8c74b614a86a745b6ef1da0402a6c50e97de Merge: 03f6973665e45b 857fa8f2a5b184 Author: Dave Airlie Date: Fri Apr 10 14:25:48 2026 +1000 Merge tag 'drm-misc-fixes-2026-04-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Several fixes for v3d about memory leak, runtime PM, and locking, and a Kconfig improvement for ethosu. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260409-omniscient-tomato-coucal-edbadc@penduick commit 9a9c8ce300cd3859cc87b408ef552cd697cc2ab7 Merge: b42ed3bb884e6b deb4605671cfae Author: Linus Torvalds Date: Thu Apr 9 16:48:44 2026 -0700 Merge tag 'kbuild-fixes-7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Make modules-cpio-pkg respect INSTALL_MOD_PATH so that it can be used with distribution initramfs files that have a merged /usr, such as Fedora - Silence an instance of -Wunused-but-set-global, a strengthening of -Wunused-but-set-variable in tip of tree Clang, in modpost, as the variable for extra warnings is currently unused * tag 'kbuild-fixes-7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: modpost: Declare extra_warn with unused attribute kbuild: modules-cpio-pkg: Respect INSTALL_MOD_PATH commit b42ed3bb884e6b399b46d19df3f5cf015a79c804 Merge: bb2ea74eeb6735 5241c2ca33bb18 Author: Linus Torvalds Date: Thu Apr 9 11:21:21 2026 -0700 Merge tag 'efi-fixes-for-v7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fix from Ard Biesheuvel: "Fix an incorrect preprocessor conditional that may result in duplicate instances of sysfb_primary_display on x86" * tag 'efi-fixes-for-v7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: firmware: efi: Never declare sysfb_primary_display on x86 commit bb2ea74eeb6735eed29bd74695f90f0e5af09f5c Merge: 4e1538b1f166e0 00afb1811fa638 Author: Linus Torvalds Date: Thu Apr 9 11:17:16 2026 -0700 Merge tag 'sound-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Still a bit higher amount than wished, but nothing looks really scary, and all changes are about nice and smooth device-specific fixes. - HD-audio quirks, one revert for a regression and another oneliner - AMD ACP quirks - Fixes for SDCA interrupt handling - A few Intel SOF, avs and NVL fixes - Fixes for TAS2552 DT, NAU8325, and STM32" * tag 'sound-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms ASoC: SDCA: Unregister IRQ handlers on module remove ASoC: SDCA: mask Function_Status value ASoC: SDCA: Fix overwritten var within for loop ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J ASoC: SOF: Intel: hda: modify period size constraints for ACE4 ALSA: hda/intel: enforce stricter period-size alignment for Intel NVL ASoC: nau8325: Add software reset during probe Revert "ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone" ASoC: Intel: avs: Fix memory leak in avs_register_i2s_test_boards() ASoC: SOF: Intel: fix iteration in is_endpoint_present() ASoC: SOF: Intel: Fix endpoint index if endpoints are missing ASoC: SDCA: Fix errors in IRQ cleanup ASoC: amd: acp: add Lenovo P16s G5 AMD quirk for legacy SDW machine ASoC: dt-bindings: ti,tas2552: Add sound-dai-cells ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 commit 4e1538b1f166e08e28740ec74fb79f05b8965525 Merge: d58305b2dbe343 8f4d20a710225e Author: Linus Torvalds Date: Thu Apr 9 11:13:15 2026 -0700 Merge tag 'mmc-v7.0-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - vub300: Fix use-after-free and NULL-deref on disconnect * tag 'mmc-v7.0-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: vub300: fix use-after-free on disconnect mmc: vub300: fix NULL-deref on disconnect commit d58305b2dbe3434c9b21ede210329b97c44ee9e8 Merge: 3ffcd57823c4fe c2812c0cb90921 Author: Linus Torvalds Date: Thu Apr 9 11:09:12 2026 -0700 Merge tag 'pmdomain-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - imx: Prevent hang at power down for imx8mp-blk-ctrl - thead: Fix buffer overflow for TH1520 AON driver - Change Ulf Hansson's email * tag 'pmdomain-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: MAINTAINERS, mailmap: Change Ulf Hansson's email pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled firmware: thead: Fix buffer overflow and use standard endian macros commit 3ffcd57823c4feb829efe46dd5135cd5fbf28e36 Merge: a55f7f5f29b32c 3d48c9fd78dd0b Author: Linus Torvalds Date: Thu Apr 9 11:02:35 2026 -0700 Merge tag 'dma-mapping-7.0-2026-04-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fix from Marek Szyprowski: "A fix for DMA-mapping subsystem, which hides annoying, false-positive warnings from DMA-API debug on coherent platforms like x86_64 (Mikhail Gavrilov)" * tag 'dma-mapping-7.0-2026-04-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement commit a55f7f5f29b32c2c53cc291899cf9b0c25a07f7c Merge: 8b02520ec5f7b0 b4afe3fa76a88e Author: Linus Torvalds Date: Thu Apr 9 08:39:25 2026 -0700 Merge tag 'net-7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter, IPsec and wireless. This is again considerably bigger than the old average. No known outstanding regressions. Current release - regressions: - net: increase IP_TUNNEL_RECURSION_LIMIT to 5 - eth: ice: fix PTP timestamping broken by SyncE code on E825C Current release - new code bugs: - eth: stmmac: dwmac-motorcomm: fix eFUSE MAC address read failure Previous releases - regressions: - core: fix cross-cache free of KFENCE-allocated skb head - sched: act_csum: validate nested VLAN headers - rxrpc: fix call removal to use RCU safe deletion - xfrm: - wait for RCU readers during policy netns exit - fix refcount leak in xfrm_migrate_policy_find - wifi: rt2x00usb: fix devres lifetime - mptcp: fix slab-use-after-free in __inet_lookup_established - ipvs: fix NULL deref in ip_vs_add_service error path - eth: - airoha: fix memory leak in airoha_qdma_rx_process() - lan966x: fix use-after-free and leak in lan966x_fdma_reload() Previous releases - always broken: - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump - bridge: guard local VLAN-0 FDB helpers against NULL vlan group - xsk: tailroom reservation and MTU validation - rxrpc: - fix to request an ack if window is limited - fix RESPONSE authenticator parser OOB read - netfilter: nft_ct: fix use-after-free in timeout object destroy - batman-adv: hold claim backbone gateways by reference - eth: - stmmac: fix PTP ref clock for Tegra234 - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling - ipa: fix GENERIC_CMD register field masks for IPA v5.0+" * tag 'net-7.0-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (104 commits) net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() net: lan966x: fix page pool leak in error paths net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() nfc: pn533: allocate rx skb before consuming bytes l2tp: Drop large packets with UDP encap net: ipa: fix event ring index not programmed for IPA v5.0+ net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ MAINTAINERS: Add Prashanth as additional maintainer for amd-xgbe driver devlink: Fix incorrect skb socket family dumping af_unix: read UNIX_DIAG_VFS data under unix_state_lock Revert "mptcp: add needs_id for netlink appending addr" mptcp: fix slab-use-after-free in __inet_lookup_established net: txgbe: leave space for null terminators on property_entry net: ioam6: fix OOB and missing lock rxrpc: proc: size address buffers for %pISpc output rxrpc: only handle RESPONSE during service challenge rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() rxrpc: Fix leak of rxgk context in rxgk_verify_response() rxrpc: Fix integer overflow in rxgk_verify_response() rxrpc: Fix missing error checks for rxkad encryption/decryption failure ... commit 8b02520ec5f7b0d976e8bbc072242275acd472d0 Merge: acfa7a35442571 7e0548525abd2b Author: Linus Torvalds Date: Thu Apr 9 08:36:31 2026 -0700 Merge tag 'iommu-fixes-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull IOMMU fix from Will Deacon: - Fix regression introduced by the empty MMU gather fix in -rc7, where the ->iotlb_sync() callback can be elided incorrectly, resulting in boot failures (hangs), crashes and potential memory corruption. * tag 'iommu-fixes-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu: Ensure .iotlb_sync is called correctly commit acfa7a35442571e316e1b3f391f481e2f92ac076 Merge: 7f87a5ea75f011 5d486669b3db11 Author: Linus Torvalds Date: Thu Apr 9 08:34:08 2026 -0700 Merge tag 'platform-drivers-x86-v7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers fixes from Ilpo Järvinen: - amd/pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - asus-armoury: Add support for FA607NU, GU605MU, and GV302XU. - intel-uncore-freq: Handle autonomous UFS status bit - ISST: Handle cases with less than max buckets correctly - intel-uncore-freq & ISST: Mark minor version 3 supported (no additional driver changes required) * tag 'platform-drivers-x86-v7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: asus-armoury: add support for GU605MU platform/x86: asus-armoury: add support for FA607NU platform/x86: asus-armoury: add support for GV302XU platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug platform/x86/intel-uncore-freq: Increase minor version platform/x86: ISST: Increase minor version platform/x86/intel-uncore-freq: Handle autonomous UFS status bit platform/x86: ISST: Reset core count to 0 commit b4afe3fa76a88ee7d3d8802b43fde89aa02f8e0d Merge: c71ba669b570c7 59c3d55a946cac Author: Paolo Abeni Date: Thu Apr 9 15:17:25 2026 +0200 Merge branch 'net-lan966x-fix-page_pool-error-handling-and-error-paths' David Carlier says: ==================== net: lan966x: fix page_pool error handling and error paths This series fixes error handling around the lan966x page pool: 1/3 adds the missing IS_ERR check after page_pool_create(), preventing a kernel oops when the error pointer flows into xdp_rxq_info_reg_mem_model(). 2/3 plugs page pool leaks in the lan966x_fdma_rx_alloc() and lan966x_fdma_init() error paths, now reachable after 1/3. 3/3 fixes a use-after-free and page pool leak in the lan966x_fdma_reload() restore path, where the hardware could resume DMA into pages already returned to the page pool. ==================== Link: https://patch.msgid.link/20260405055241.35767-1-devnexen@gmail.com Signed-off-by: Paolo Abeni commit 59c3d55a946cacdb4181600723c20ac4f4c20c84 Author: David Carlier Date: Sun Apr 5 06:52:41 2026 +0100 net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() When lan966x_fdma_reload() fails to allocate new RX buffers, the restore path restarts DMA using old descriptors whose pages were already freed via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can release pages back to the buddy allocator, the hardware may DMA into memory now owned by other kernel subsystems. Additionally, on the restore path, the newly created page pool (if allocation partially succeeded) is overwritten without being destroyed, leaking it. Fix both issues by deferring the release of old pages until after the new allocation succeeds. Save the old page array before the allocation so old pages can be freed on the success path. On the failure path, the old descriptors, pages and page pool are all still valid, making the restore safe. Also ensure the restore path re-enables NAPI and wakes the netdev, matching the success path. Fixes: 89ba464fcf54 ("net: lan966x: refactor buffer reload function") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Link: https://patch.msgid.link/20260405055241.35767-4-devnexen@gmail.com Signed-off-by: Paolo Abeni commit 076344a6ad9d1308faaed1402fdcfdda68b604ab Author: David Carlier Date: Sun Apr 5 06:52:40 2026 +0100 net: lan966x: fix page pool leak in error paths lan966x_fdma_rx_alloc() creates a page pool but does not destroy it if the subsequent fdma_alloc_coherent() call fails, leaking the pool. Similarly, lan966x_fdma_init() frees the coherent DMA memory when lan966x_fdma_tx_alloc() fails but does not destroy the page pool that was successfully created by lan966x_fdma_rx_alloc(), leaking it. Add the missing page_pool_destroy() calls in both error paths. Fixes: 11871aba1974 ("net: lan96x: Use page_pool API") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Link: https://patch.msgid.link/20260405055241.35767-3-devnexen@gmail.com Signed-off-by: Paolo Abeni commit 3fd0da4fd8851a7e62d009b7db6c4a05b092bc19 Author: David Carlier Date: Sun Apr 5 06:52:39 2026 +0100 net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() page_pool_create() can return an ERR_PTR on failure. The return value is used unconditionally in the loop that follows, passing the error pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(), which dereferences it, causing a kernel oops. Add an IS_ERR check after page_pool_create() to return early on failure. Fixes: 11871aba1974 ("net: lan96x: Use page_pool API") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Link: https://patch.msgid.link/20260405055241.35767-2-devnexen@gmail.com Signed-off-by: Paolo Abeni commit cb76a81c7cec37bdf525164561b02665cd763421 Author: Christian Brauner Date: Thu Apr 2 09:12:11 2026 +0200 kernfs: make directory seek namespace-aware The rbtree backing kernfs directories is ordered by (hash, ns_id, name) but kernfs_dir_pos() only searches by hash when seeking to a position during readdir. When two nodes from different namespaces share the same hash value, the binary search can land on a node in the wrong namespace. The subsequent skip-forward loop walks rb_next() and may overshoot the correct node, silently dropping an entry from the readdir results. With the recent switch from raw namespace pointers to public namespace ids as hash seeds, computing hash collisions became an offline operation. An unprivileged user could unshare into a new network namespace, create a single interface whose name-hash collides with a target entry in init_net, and cause a victim's seekdir/readdir on /sys/class/net to miss that entry. Fix this by extending the rbtree search in kernfs_dir_pos() to also compare namespace ids when hashes match. Since the rbtree is already ordered by (hash, ns_id, name), this makes the seek land directly in the correct namespace's range, eliminating the wrong-namespace overshoot. Signed-off-by: Christian Brauner commit 1fe989e1c42a315c7e7918e7b812377137085036 Author: Christian Brauner Date: Wed Apr 1 12:21:16 2026 +0200 kernfs: use namespace id instead of pointer for hashing and comparison kernfs uses the namespace tag as both a hash seed (via init_name_hash()) and a comparison key in the rbtree. The resulting hash values are exposed to userspace through directory seek positions (ctx->pos), and the raw pointer comparisons in kernfs_name_compare() encode kernel pointer ordering into the rbtree layout. This constitutes a KASLR information leak since the hash and ordering derived from kernel pointers can be observed from userspace. Fix this by using the 64-bit namespace id (ns_common::ns_id) instead of the raw pointer value for both hashing and comparison. The namespace id is a stable, non-secret identifier that is already exposed to userspace through other interfaces (e.g., /proc/pid/ns/, ioctl NS_GET_NSID). Introduce kernfs_ns_id() as a helper that extracts the namespace id from a potentially-NULL ns_common pointer, returning 0 for the no-namespace case. All namespace equality checks in the directory iteration and dentry revalidation paths are also switched from pointer comparison to ns_id comparison for consistency. Signed-off-by: Christian Brauner commit e3b2cf6e5dba416a03152f299d99982dfe1e861d Author: Christian Brauner Date: Wed Apr 1 12:15:58 2026 +0200 kernfs: pass struct ns_common instead of const void * for namespace tags kernfs has historically used const void * to pass around namespace tags used for directory-level namespace filtering. The only current user of this is sysfs network namespace tagging where struct net pointers are cast to void *. Replace all const void * namespace parameters with const struct ns_common * throughout the kernfs, sysfs, and kobject namespace layers. This includes the kobj_ns_type_operations callbacks, kobject_namespace(), and all sysfs/kernfs APIs that accept or return namespace tags. Passing struct ns_common is needed because various codepaths require access to the underlying namespace. A struct ns_common can always be converted back to the concrete namespace type (e.g., struct net) via container_of() or to_ns_common() in the reverse direction. This is a preparatory change for switching to ns_id-based directory iteration to prevent a KASLR pointer leak through the current use of raw namespace pointers as hash seeds and comparison keys. Signed-off-by: Christian Brauner commit 7e0548525abd2bff9694e016b6a469ccd2d5a053 Author: Robin Murphy Date: Wed Apr 8 15:40:57 2026 +0100 iommu: Ensure .iotlb_sync is called correctly Many drivers have no reason to use the iotlb_gather mechanism, but do still depend on .iotlb_sync being called to properly complete an unmap. Since the core code is now relying on the gather to detect when there is legitimately something to sync, it should also take care of encoding a successful unmap when the driver does not touch the gather itself. Fixes: 90c5def10bea ("iommu: Do not call drivers for empty gathers") Reported-by: Jon Hunter Closes: https://lore.kernel.org/r/8800a38b-8515-4bbe-af15-0dae81274bf7@nvidia.com Signed-off-by: Robin Murphy Tested-by: Jon Hunter Reviewed-by: Jason Gunthorpe Tested-by: Russell King (Oracle) Signed-off-by: Will Deacon commit c71ba669b570c7b3f86ec875be222ea11dacb352 Author: Pengpeng Hou Date: Sun Apr 5 08:40:00 2026 +0800 nfc: pn533: allocate rx skb before consuming bytes pn532_receive_buf() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already hand a complete frame to pn533_recv_frame() before allocating a fresh receive buffer. If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8(). Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted. Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver") Cc: stable@vger.kernel.org Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260405094003.3-pn533-v2-pengpeng@iscas.ac.cn Signed-off-by: Paolo Abeni commit a13edf9b92fc4700b3020d7ea547a3d64dd33b63 Author: Joonas Lahtinen Date: Thu Apr 9 08:31:11 2026 +0300 drm/i915/gem: Drop check for changed VM in EXECBUF Since the introduction of d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") it has not been possible for VM to change after context creation so the check will never fail. Sima's analysis: This check was added in f7ce8639f6ff ("drm/i915/gem: Split the context's obj:vma lut into its own mutex") but without any hint in the commit message as to why. In another hunk of that commit there's a hint though in __eb_add_lut: /* user racing with ctx set-vm */ This would mean that this bug was introduced in e0695db7298e ("drm/i915: Create/destroy VM (ppGTT) for use with contexts"), which allowed to change the gem_ctx->vm at runtime, opening up the race that was partially fixed in the earlier referenced commit about a year later. But it cannot be exploited anymore in anything remotely recent because with the introduction of proto-contexts we've made gem_ctx->vm invariant again, exactly to preemptively close all these potential issues. Specifically d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") is the vm specific part of the proto-context work. v3: - Include Sima's analysis and WARN_ON_ONCE v4: - Focus only on latest mainline codebase References: https://lore.kernel.org/all/20260324151741.29338-1-sosohero200@gmail.com/ Reported-by: Ville Syrjälä Cc: Linus Torvalds Cc: Simona Vetter Cc: Tvrtko Ursulin Cc: Andi Shyti Signed-off-by: Joonas Lahtinen Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20260409053111.8914-1-joonas.lahtinen@linux.intel.com (cherry picked from commit f6d4afc9ec6a0bc326151b35a7a3369369180079) Signed-off-by: Joonas Lahtinen commit 1561d96f5f55c1bca9ff047ace5813f4f244eea6 Author: Samasth Norway Ananda Date: Tue Apr 7 14:02:47 2026 -0700 gpio: tegra: fix irq_release_resources calling enable instead of disable tegra_gpio_irq_release_resources() erroneously calls tegra_gpio_enable() instead of tegra_gpio_disable(). When IRQ resources are released, the GPIO configuration bit (CNF) should be cleared to deconfigure the pin as a GPIO. Leaving it enabled wastes power and can cause unexpected behavior if the pin is later reused for an alternate function via pinctrl. Fixes: 66fecef5bde0 ("gpio: tegra: Convert to gpio_irq_chip") Signed-off-by: Samasth Norway Ananda Link: https://patch.msgid.link/20260407210247.1737938-1-samasth.norway.ananda@oracle.com Signed-off-by: Bartosz Golaszewski commit ebe560ea5f54134279356703e73b7f867c89db13 Author: Alice Mikityanska Date: Fri Apr 3 20:49:49 2026 +0300 l2tp: Drop large packets with UDP encap syzbot reported a WARN on my patch series [1]. The actual issue is an overflow of 16-bit UDP length field, and it exists in the upstream code. My series added a debug WARN with an overflow check that exposed the issue, that's why syzbot tripped on my patches, rather than on upstream code. syzbot's repro: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="ee", 0x34000}], 0x1) It basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP encapsulation, and l2tp_xmit_core doesn't check for overflows when it assigns the UDP length field. The value gets trimmed to 16 bites. Add an overflow check that drops oversized packets and avoids sending packets with trimmed UDP length to the wire. syzbot's stack trace (with my patch applied): len >= 65536u WARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957 WARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957 WARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1: syz.0.17/5957 Modules linked in: CPU: 1 UID: 0 PID: 5957 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:udp_set_len_short include/linux/udp.h:38 [inline] RIP: 0010:l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline] RIP: 0010:l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327 Code: 0f 0b 90 e9 21 f9 ff ff e8 e9 05 ec f6 90 0f 0b 90 e9 8d f9 ff ff e8 db 05 ec f6 90 0f 0b 90 e9 cc f9 ff ff e8 cd 05 ec f6 90 <0f> 0b 90 e9 de fa ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 4f RSP: 0018:ffffc90003d67878 EFLAGS: 00010293 RAX: ffffffff8ad985e3 RBX: ffff8881a6400090 RCX: ffff8881697f0000 RDX: 0000000000000000 RSI: 0000000000034010 RDI: 000000000000ffff RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520007acf00 R12: ffff8881baf20900 R13: 0000000000034010 R14: ffff8881a640008e R15: ffff8881760f7000 FS: 000055557e81f500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000033000 CR3: 00000001612f4000 CR4: 00000000000006f0 Call Trace: pppol2tp_sendmsg+0x40a/0x5f0 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] sock_write_iter+0x503/0x550 net/socket.c:1195 do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1 vfs_writev+0x33c/0x990 fs/read_write.c:1059 do_writev+0x154/0x2e0 fs/read_write.c:1105 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f636479c629 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffffd4241c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f6364a15fa0 RCX: 00007f636479c629 RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003 RBP: 00007f6364832b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6364a15fac R14: 00007f6364a15fa0 R15: 00007f6364a15fa0 [1]: https://lore.kernel.org/all/20260226201600.222044-1-alice.kernel@fastmail.im/ Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core") Reported-by: syzbot+ci3edea60a44225dec@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69a1dfba.050a0220.3a55be.0026.GAE@google.com/ Signed-off-by: Alice Mikityanska Link: https://patch.msgid.link/20260403174949.843941-1-alice.kernel@fastmail.im Signed-off-by: Paolo Abeni commit 56007972c0b1e783ca714d6f1f4d6e66e531d21f Author: Alexander Koskovich Date: Fri Apr 3 18:43:48 2026 +0200 net: ipa: fix event ring index not programmed for IPA v5.0+ For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDEX. Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion(). At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional. Fixes: faf0678ec8a0 ("net: ipa: add IPA v5.0 GSI register definitions") Signed-off-by: Alexander Koskovich Signed-off-by: Luca Weiss Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260403-milos-ipa-v1-2-01e9e4e03d3e@fairphone.com Signed-off-by: Paolo Abeni commit 9709b56d908acc120fe8b4ae250b3c9d749ea832 Author: Alexander Koskovich Date: Fri Apr 3 18:43:47 2026 +0200 net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Fix the field masks to match the hardware layout documented in downstream GSI (GSI_V3_0_EE_n_GSI_EE_GENERIC_CMD_*). Notably this fixes a WARN I was seeing when I tried to send "stop" to the MPSS remoteproc while IPA was up. Fixes: faf0678ec8a0 ("net: ipa: add IPA v5.0 GSI register definitions") Signed-off-by: Alexander Koskovich Signed-off-by: Luca Weiss Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260403-milos-ipa-v1-1-01e9e4e03d3e@fairphone.com Signed-off-by: Paolo Abeni commit 00afb1811fa638dacf125dd1c343b7a181624dfd Merge: 082c192c0dd03f 6b6f7263d62688 Author: Takashi Iwai Date: Thu Apr 9 07:00:53 2026 +0200 Merge tag 'asoc-fix-v7.0-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.0 A somewhat larger set of fixes than I'd like unfortunatey, not from any one place but rather spread out over different drivers. We've got a bunch more fixes for the SDCA interrupt support, several relatively minor SOF fixes, a few more driver specific fixes and a couple more AMD quirks. commit 03f6973665e45b64019d2ef066d62a4314d480cc Merge: 591cd656a1bf5e 7596459f3c93d8 Author: Dave Airlie Date: Thu Apr 9 14:38:01 2026 +1000 Merge tag 'drm-xe-fixes-2026-04-08' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Fix HW engine idleness unit conversion (Vinay) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/ada0IQSyELI2V0Og@intel.com commit 2607c0907d6d2737727ff0740015dde82a3fc103 Merge: 30f3b767aed45f d3baa34a470771 Author: Jakub Kicinski Date: Wed Apr 8 20:05:10 2026 -0700 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-04-06 (idpf, ice, ixgbe, ixgbevf, igb, e1000) Emil converts to use spinlock_t for virtchnl transactions to make consistent use of the xn_bm_lock when accessing the free_xn_bm bitmap, while also avoiding nested raw/bh spinlock issue on PREEMPT_RT kernels. He also sets payload size before calling the async handler, to make sure it doesn't error out prematurely due to invalid size check for idpf. Kohei Enju changes WARN_ON for missing PTP control PF to a dev_info() on ice as there are cases where this is expected and acceptable. Petr Oros fixes conditions in which error paths failed to call ice_ptp_port_phy_restart() breaking PTP functionality on ice. Alex significantly reduces reporting of driver information, and time under RTNL locl, on ixgbe e610 devices by reducing reads of flash info only on events that could change it. Michal Schmidt adds missing Hyper-V op on ixgbevf. Alex Dvoretsky removes call to napi_synchronize() in igb_down() to resolve a deadlock. Agalakov Daniil adds error check on e1000 for failed EEPROM read. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: e1000: check return value of e1000_read_eeprom igb: remove napi_synchronize() in igb_down() ixgbevf: add missing negotiate_features op to Hyper-V ops table ixgbe: stop re-reading flash on every get_drvinfo for e610 ice: fix PTP timestamping broken by SyncE code on E825C ice: ptp: don't WARN when controlling PF is unavailable idpf: set the payload size before calling the async handler idpf: improve locking around idpf_vc_xn_push_free() idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling ==================== Link: https://patch.msgid.link/20260406213038.444732-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 30f3b767aed45fdaf8f887e66e1f19bd0cbd4483 Author: Raju Rangoju Date: Mon Apr 6 13:08:16 2026 +0530 MAINTAINERS: Add Prashanth as additional maintainer for amd-xgbe driver Add Prashanth as an additional maintainer for the amd-xgbe Ethernet driver to help with ongoing development and maintenance. Cc: Prashanth Kumar K R Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260406073816.3218387-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 0006c6f1091bbeea88b8a88a6548b9fb2f803c74 Author: Li RongQing Date: Mon Apr 6 22:27:30 2026 -0400 devlink: Fix incorrect skb socket family dumping The devlink_fmsg_dump_skb function was incorrectly using the socket type (sk->sk_type) instead of the socket family (sk->sk_family) when filling the "family" field in the fast message dump. This patch fixes this to properly display the socket family. Fixes: 3dbfde7f6bc7b8 ("devlink: add devlink_fmsg_dump_skb() function") Signed-off-by: Li RongQing Link: https://patch.msgid.link/20260407022730.2393-1-lirongqing@baidu.com Signed-off-by: Jakub Kicinski commit 39897df386376912d561d4946499379effa1e7ef Author: Jiexun Wang Date: Tue Apr 7 16:00:14 2026 +0800 af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking. Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock. This keeps the VFS data stable while the reply is being built. Fixes: 5f7b0569460b ("unix_diag: Unix inode info NLA") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Jiexun Wang Signed-off-by: Ren Wei Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260407080015.1744197-1-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski commit 8e2760eaab778494fc1fa257031e0e1799647f46 Author: Matthieu Baerts (NGI0) Date: Tue Apr 7 10:41:41 2026 +0200 Revert "mptcp: add needs_id for netlink appending addr" This commit was originally adding the ability to add MPTCP endpoints with ID 0 by accident. The in-kernel PM, handling MPTCP endpoints at the net namespace level, is not supposed to handle endpoints with such ID, because this ID 0 is reserved to the initial subflow, as mentioned in the MPTCPv1 protocol [1], a per-connection setting. Note that 'ip mptcp endpoint add id 0' stops early with an error, but other tools might still request the in-kernel PM to create MPTCP endpoints with this restricted ID 0. In other words, it was wrong to call the mptcp_pm_has_addr_attr_id helper to check whether the address ID attribute is set: if it was set to 0, a new MPTCP endpoint would be created with ID 0, which is not expected, and might cause various issues later. Fixes: 584f38942626 ("mptcp: add needs_id for netlink appending addr") Cc: stable@vger.kernel.org Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.2-9 [1] Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260407-net-mptcp-revert-pm-needs-id-v2-1-7a25cbc324f8@kernel.org Signed-off-by: Jakub Kicinski commit 9b55b253907e7431210483519c5ad711a37dafa1 Author: Jiayuan Chen Date: Mon Apr 6 11:15:10 2026 +0800 mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side critical sections. Both tcp_prot and tcpv6_prot have their slab caches created with this flag via proto_register(). However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override during inet_init() (fs_initcall, level 5), before inet6_init() (module_init/device_initcall, level 6) has called proto_register(&tcpv6_prot). At that point, tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab remains NULL permanently. This causes MPTCP v6 subflow child sockets to be allocated via kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so when these sockets are freed without SOCK_RCU_FREE (which is cleared for child sockets by design), the memory can be immediately reused. Concurrent ehash lookups under rcu_read_lock can then access freed memory, triggering a slab-use-after-free in __inet_lookup_established. Fix this by splitting the IPv6-specific initialization out of mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called from mptcp_proto_v6_init() before protocol registration. This ensures tcpv6_prot_override.slab correctly inherits the SLAB_TYPESAFE_BY_RCU slab cache. Fixes: b19bc2945b40 ("mptcp: implement delegated actions") Cc: stable@vger.kernel.org Signed-off-by: Jiayuan Chen Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260406031512.189159-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 5a37d228799b0ec2c277459c83c814a59d310bc3 Author: Fabio Baltieri Date: Sun Apr 5 23:20:13 2026 +0100 net: txgbe: leave space for null terminators on property_entry Lists of struct property_entry are supposed to be terminated with an empty property, this driver currently seems to be allocating exactly the amount of entry used. Change the struct definition to leave an extra element for all property_entry. Fixes: c3e382ad6d15 ("net: txgbe: Add software nodes to support phylink") Signed-off-by: Fabio Baltieri Tested-by: Jiawen Wu Link: https://patch.msgid.link/20260405222013.5347-1-fabio.baltieri@gmail.com Signed-off-by: Jakub Kicinski commit b30b1675aa2bcf0491fd3830b051df4e08a7c8ca Author: Justin Iurman Date: Sat Apr 4 15:41:37 2026 +0200 net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here. Fixes: b63c5478e9cb ("ipv6: ioam: Support for Queue depth data field") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20260403214418.2233266-2-kuba@kernel.org/ Signed-off-by: Justin Iurman Link: https://patch.msgid.link/20260404134137.24553-1-justin.iurman@gmail.com Signed-off-by: Jakub Kicinski commit d65b175cfac64ee65506eea7fa573d291a9694ca Merge: 84ac9a922d8d2b ea245d78dec594 Author: Jakub Kicinski Date: Wed Apr 8 18:56:17 2026 -0700 Merge tag 'wireless-2026-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== A few last-minute fixes: - rfkill: prevent boundless event list - rt2x00: fix USB resource management - brcmfmac: validate firmware IDs - brcmsmac: fix DMA free size * tag 'wireless-2026-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: net: rfkill: prevent unlimited numbers of rfkill events from being created wifi: rt2x00usb: fix devres lifetime wifi: brcmfmac: validate bsscfg indices in IF events wifi: brcmsmac: Fix dma_free_coherent() size ==================== Link: https://patch.msgid.link/20260408081802.111623-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 84ac9a922d8d2b1a93848cf0f219ae844765dea9 Merge: d614e0186bf37b 426c355742f02c Author: Jakub Kicinski Date: Wed Apr 8 18:54:31 2026 -0700 Merge tag 'ipsec-2026-04-08' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-04-08 1) Clear trailing padding in build_polexpire() to prevent leaking unititialized memory. From Yasuaki Torimaru. 2) Fix aevent size calculation when XFRMA_IF_ID is used. From Keenan Dong. 3) Wait for RCU readers during policy netns exit before freeing the policy hash tables. 4) Fix dome too eaerly dropped references on the netdev when uding transport mode. From Qi Tang. 5) Fix refcount leak in xfrm_migrate_policy_find(). From Kotlyarov Mihail. 6) Fix two fix info leaks in build_report() and in build_mapping(). From Greg Kroah-Hartman. 7) Zero aligned sockaddr tail in PF_KEY exports. From Zhengchuan Liang. * tag 'ipsec-2026-04-08' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: net: af_key: zero aligned sockaddr tail in PF_KEY exports xfrm_user: fix info leak in build_report() xfrm_user: fix info leak in build_mapping() xfrm: fix refcount leak in xfrm_migrate_policy_find xfrm: hold dev ref until after transport_finish NF_HOOK xfrm: Wait for RCU readers during policy netns exit xfrm: account XFRMA_IF_ID in aevent size calculation xfrm: clear trailing padding in build_polexpire() ==================== Link: https://patch.msgid.link/20260408095925.253681-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit d614e0186bf37bb46a76d92e474c11f6a5cbc547 Merge: 1ee3b19a267ff2 82d8701b2c930d Author: Jakub Kicinski Date: Wed Apr 8 18:50:27 2026 -0700 Merge tag 'batadv-net-pullrequest-20260408' of https://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here are two batman-adv bugfixes: - reject oversized global TT response buffers, by Ruide Cao - hold claim backbone gateways by reference, by Haoze Xie * tag 'batadv-net-pullrequest-20260408' of https://git.open-mesh.org/linux-merge: batman-adv: hold claim backbone gateways by reference batman-adv: reject oversized global TT response buffers ==================== Link: https://patch.msgid.link/20260408110255.976389-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit 1ee3b19a267ff2f54d340378d91a9627e540ab97 Merge: cade36eed7173e dde1a6084c5ca9 Author: Jakub Kicinski Date: Wed Apr 8 18:48:44 2026 -0700 Merge tag 'nf-26-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter updates for net I only included crash fixes, as we're closer to a release, rest will be handled via -next. 1) Fix a NULL pointer dereference in ip_vs_add_service error path, from Weiming Shi, bug added in 6.2 development cycle. 2) Don't leak kernel data bytes from allocator to userspace: nfnetlink_log needs to init the trailing NLMSG_DONE terminator. From Xiang Mei. 3) xt_multiport match lacks range validation, bogus userspace request will cause out-of-bounds read. From Ren Wei. 4) ip6t_eui64 match must reject packets with invalid mac header before calling eth_hdr. Make existing check unconditional. From Zhengchuan Liang. 5) nft_ct timeout policies are free'd via kfree() while they may still be reachable by other cpus that process a conntrack object that uses such a timeout policy. Existing reaping of entries is not sufficient because it doesn't wait for a grace period. Use kfree_rcu(). From Tuan Do. 6/7) Make nfnetlink_queue hash table per queue. As-is we can hit a page fault in case underlying page of removed element was free'd. Per-queue hash prevents parallel lookups. This comes with a test case that demonstrates the bug, from Fernando Fernandez Mancera. * tag 'nf-26-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: nft_queue.sh: add a parallel stress test netfilter: nfnetlink_queue: make hash table per queue netfilter: nft_ct: fix use-after-free in timeout object destroy netfilter: ip6t_eui64: reject invalid MAC header for all packets netfilter: xt_multiport: validate range encoding in checkentry netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator ipvs: fix NULL deref in ip_vs_add_service error path ==================== Link: https://patch.msgid.link/20260408163512.30537-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit cade36eed7173e5d341ea31b59c61435fe08a8ff Merge: c09ea768bdb975 a44ce6aa2efb61 Author: Jakub Kicinski Date: Wed Apr 8 18:44:37 2026 -0700 Merge branch 'rxrpc-miscellaneous-fixes' David Howells says: ==================== rxrpc: Miscellaneous fixes Here are some fixes for rxrpc: (1) Fix key quota calculation. (2) Fix a memory leak. (3) Fix rxrpc_new_client_call_for_sendmsg() to substitute NULL for an empty key. Might want to remove this substitution entirely or handle it in rxrpc_init_client_call_security() instead. (4) Fix deletion of call->link to be RCU safe. (5) Fix missing bounds checks when parsing RxGK tickets. (6) Fix use of wrong skbuff to get challenge serial number. Also actually substitute the newer response skbuff and release the older one. (7) Fix unexpected RACK timer warning to report old mode. (8) Fix call key refcount leak. (9) Fix the interaction of jumbograms with Tx window space, setting the request-ack flag when the window space is getting low, typically because each jumbogram take a big bite out of the window and fewer UDP packets get traded. (10) Don't call rxrpc_put_call() with a NULL pointer. (11) Reject undecryptable rxkad response tickets by checking result of decryption. (12) Fix buffer bounds calculation in the RESPONSE authenticator parser. (13) Fix oversized response length check. (14) Fix refcount leak on multiple setting of server keyring. (15) Fix checks made by RXRPC_SECURITY_KEY and RXRPC_SECURITY_KEYRING (both should be allowed). (16) Fix lack of result checking on calls to crypto_skcipher_en/decrypt(). (17) Fix token_len limit check in rxgk_verify_response(). (18) Fix rxgk context leak in rxgk_verify_response(). (19) Fix read beyond end of buffer in rxgk_do_verify_authenticator(). (20) Fix parsing of RESPONSE packet on a connection that has already been set from a prior response. (21) Fix size of buffers used for rendering addresses into for procfiles. ==================== Link: https://patch.msgid.link/20260408121252.2249051-1-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit a44ce6aa2efb61fe44f2cfab72bb01544bbca272 Author: Pengpeng Hou Date: Wed Apr 8 13:12:49 2026 +0100 rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc". That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example Fixes: 75b54cb57ca3 ("rxrpc: Add IPv6 support") Signed-off-by: Pengpeng Hou Signed-off-by: David Howells cc: Marc Dionne cc: Anderson Nascimento cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-22-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit c43ffdcfdbb5567b1f143556df8a04b4eeea041c Author: Wang Jie Date: Wed Apr 8 13:12:48 2026 +0100 rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before running response verification and security initialization, then use a local secured flag to decide whether to queue the secured-connection work after the state transition. This keeps duplicate or late RESPONSE packets from re-running the setup path and removes the unlocked post-transition state test. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Jie Wang Signed-off-by: Yang Yang Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-21-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit f564af387c8c28238f8ebc13314c589d7ba8475d Author: David Howells Date: Wed Apr 8 13:12:47 2026 +0100 rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() Fix rxgk_do_verify_authenticator() to check the buffer size before checking the nonce. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Closes: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-20-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 7e1876caa8363056f58a21d3b31b82c2daf7e608 Author: David Howells Date: Wed Apr 8 13:12:46 2026 +0100 rxrpc: Fix leak of rxgk context in rxgk_verify_response() Fix rxgk_verify_response() to clean up the rxgk context it creates. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Closes: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-19-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 699e52180f4231c257821c037ed5c99d5eb0edb8 Author: David Howells Date: Wed Apr 8 13:12:45 2026 +0100 rxrpc: Fix integer overflow in rxgk_verify_response() In rxgk_verify_response(), there's a potential integer overflow due to rounding up token_len before checking it, thereby allowing the length check to be bypassed. Fix this by checking the unrounded value against len too (len is limited as the response must fit in a single UDP packet). Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Closes: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-18-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit f93af41b9f5f798823d0d0fb8765c2a936d76270 Author: David Howells Date: Wed Apr 8 13:12:44 2026 +0100 rxrpc: Fix missing error checks for rxkad encryption/decryption failure Add error checking for failure of crypto_skcipher_en/decrypt() to various rxkad function as the crypto functions can fail with ENOMEM at least. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Closes: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-17-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 2afd86ccbb2082a3c4258aea8c07e5bb6267bc2f Author: David Howells Date: Wed Apr 8 13:12:43 2026 +0100 rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) An AF_RXRPC socket can be both client and server at the same time. When sending new calls (ie. it's acting as a client), it uses rx->key to set the security, and when accepting incoming calls (ie. it's acting as a server), it uses rx->securities. setsockopt(RXRPC_SECURITY_KEY) sets rx->key to point to an rxrpc-type key and setsockopt(RXRPC_SECURITY_KEYRING) sets rx->securities to point to a keyring of rxrpc_s-type keys. Now, it should be possible to use both rx->key and rx->securities on the same socket - but for userspace AF_RXRPC sockets rxrpc_setsockopt() prevents that. Fix this by: (1) Remove the incorrect check rxrpc_setsockopt(RXRPC_SECURITY_KEYRING) makes on rx->key. (2) Move the check that rxrpc_setsockopt(RXRPC_SECURITY_KEY) makes on rx->key down into rxrpc_request_key(). (3) Remove rxrpc_request_key()'s check on rx->securities. This (in combination with a previous patch) pushes the checks down into the functions that set those pointers and removes the cross-checks that prevent both key and keyring being set. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Closes: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Anderson Nascimento cc: Luxiao Xu cc: Yuan Tan cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-16-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit f125846ee79fcae537a964ce66494e96fa54a6de Author: Luxiao Xu Date: Wed Apr 8 13:12:42 2026 +0100 rxrpc: fix reference count leak in rxrpc_server_keyring() This patch fixes a reference count leak in rxrpc_server_keyring() by checking if rx->securities is already set. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei Signed-off-by: David Howells cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-15-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit a2567217ade970ecc458144b6be469bc015b23e5 Author: Keenan Dong Date: Wed Apr 8 13:12:41 2026 +0100 rxrpc: fix oversized RESPONSE authenticator length check rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len). Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Reject authenticator lengths that exceed the remaining packet payload. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Signed-off-by: Keenan Dong Signed-off-by: David Howells cc: Marc Dionne cc: Simon Horman cc: Willy Tarreau cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-14-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 3e3138007887504ee9206d0bfb5acb062c600025 Author: Keenan Dong Date: Wed Apr 8 13:12:40 2026 +0100 rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the parser end pointer by a factor of four and lets malformed RESPONSE authenticators read past the kmalloc() buffer. Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: BUG: KASAN: slab-out-of-bounds in rxgk_verify_response() Call Trace: dump_stack_lvl() [lib/dump_stack.c:123] print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482] kasan_report() [mm/kasan/report.c:597] rxgk_verify_response() [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Allocated by task 54: rxgk_verify_response() [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155 net/rxrpc/rxgk.c:1274] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] Convert the byte count to __be32 units before constructing the parser limit. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Signed-off-by: Keenan Dong Signed-off-by: David Howells cc: Marc Dionne cc: Simon Horman cc: Willy Tarreau cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-13-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit fe4447cd95623b1cfacc15f280aab73a6d7340b2 Author: Yuqi Xu Date: Wed Apr 8 13:12:39 2026 +0100 rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded. A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes. Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Yuqi Xu Signed-off-by: Ren Wei Signed-off-by: David Howells cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-12-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 6331f1b24a3e85465f6454e003a3e6c22005a5c5 Author: Douya Le Date: Wed Apr 8 13:12:38 2026 +0100 rxrpc: Only put the call ref if one was acquired rxrpc_input_packet_on_conn() can process a to-client packet after the current client call on the channel has already been torn down. In that case chan->call is NULL, rxrpc_try_get_call() returns NULL and there is no reference to drop. The client-side implicit-end error path does not account for that and unconditionally calls rxrpc_put_call(). This turns a protocol error path into a kernel crash instead of rejecting the packet. Only drop the call reference if one was actually acquired. Keep the existing protocol error handling unchanged. Fixes: 5e6ef4f1017c ("rxrpc: Make the I/O thread take over the call and local processor work") Reported-by: Yifan Wu Reported-by: Juefei Pu Signed-off-by: Douya Le Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Ao Zhou Signed-off-by: David Howells cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-11-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 0cd3e3f3f2ec1a45aa559e2c0f3d57fac5eb3c25 Author: Marc Dionne Date: Wed Apr 8 13:12:37 2026 +0100 rxrpc: Fix to request an ack if window is limited Peers may only send immediate acks for every 2 UDP packets received. When sending a jumbogram, it is important to check that there is sufficient window space to send another same sized jumbogram following the current one, and request an ack if there isn't. Failure to do so may cause the call to stall waiting for an ack until the resend timer fires. Where jumbograms are in use this causes a very significant drop in performance. Fixes: fe24a5494390 ("rxrpc: Send jumbo DATA packets") Signed-off-by: Marc Dionne Signed-off-by: David Howells cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-10-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit d666540d217e8d420544ebdfbadeedd623562733 Author: Anderson Nascimento Date: Wed Apr 8 13:12:36 2026 +0100 rxrpc: Fix key reference count leak from call->key When creating a client call in rxrpc_alloc_client_call(), the code obtains a reference to the key. This is never cleaned up and gets leaked when the call is destroyed. Fix this by freeing call->key in rxrpc_destroy_call(). Before the patch, it shows the key reference counter elevated: $ cat /proc/keys | grep afs@54321 1bffe9cd I--Q--i 8053480 4169w 3b010000 1000 1000 rxrpc afs@54321: ka $ After the patch, the invalidated key is removed when the code exits: $ cat /proc/keys | grep afs@54321 $ Fixes: f3441d4125fc ("rxrpc: Copy client call parameters into rxrpc_call earlier") Signed-off-by: Anderson Nascimento Co-developed-by: David Howells Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-9-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 65b3ffe0972ed023acc3981a0f7e1ae5d0208bd3 Author: Alok Tiwari Date: Wed Apr 8 13:12:35 2026 +0100 rxrpc: Fix rack timer warning to report unexpected mode rxrpc_rack_timer_expired() clears call->rack_timer_mode to OFF before the switch. The default case warning therefore always prints OFF and doesn't identify the unexpected timer mode. Log the saved mode value instead so the warning reports the actual unexpected rack timer mode. Fixes: 7c482665931b ("rxrpc: Implement RACK/TLP to deal with transmission stalls [RFC8985]") Signed-off-by: Alok Tiwari Signed-off-by: David Howells Reviewed-by: Simon Horman Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-8-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit b33f5741bb187db8ff32e8f5b96def77cc94dfca Author: Alok Tiwari Date: Wed Apr 8 13:12:34 2026 +0100 rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial In rxrpc_post_response(), the code should be comparing the challenge serial number from the cached response before deciding to switch to a newer response, but looks at the newer packet private data instead, rendering the comparison always false. Fix this by switching to look at the older packet. Fix further[1] to substitute the new packet in place of the old one if newer and also to release whichever we don't use. Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") Signed-off-by: Alok Tiwari Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com [1] Link: https://patch.msgid.link/20260408121252.2249051-7-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit d179a868dd755b0cfcf7582e00943d702b9943b8 Author: Oleh Konko Date: Wed Apr 8 13:12:33 2026 +0100 rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length from the XDR token as u32 values and passes each through round_up(x, 4) before using the rounded value for validation and allocation. When the raw length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and kzalloc both use 0 while the subsequent memcpy still copies the original ~4 GiB value, producing a heap buffer overflow reachable from an unprivileged add_key() call. Fix this by: (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX. (2) Sizing the flexible-array allocation from the validated raw key length via struct_size_t() instead of the rounded value. (3) Caching the raw lengths so that the later field assignments and memcpy calls do not re-read from the token, eliminating a class of TOCTOU re-parse. The control path (valid token with lengths within bounds) is unaffected. Fixes: 0ca100ff4df6 ("rxrpc: Add YFS RxGK (GSSAPI) security class") Signed-off-by: Oleh Konko Signed-off-by: David Howells Reviewed-by: Jeffrey Altman cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-6-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 146d4ab94cf129ee06cd467cb5c71368a6b5bad6 Author: David Howells Date: Wed Apr 8 13:12:32 2026 +0100 rxrpc: Fix call removal to use RCU safe deletion Fix rxrpc call removal from the rxnet->calls list to use list_del_rcu() rather than list_del_init() to prevent stuffing up reading /proc/net/rxrpc/calls from potentially getting into an infinite loop. This, however, means that list_empty() no longer works on an entry that's been deleted from the list, making it harder to detect prior deletion. Fix this by: Firstly, make rxrpc_destroy_all_calls() only dump the first ten calls that are unexpectedly still on the list. Limiting the number of steps means there's no need to call cond_resched() or to remove calls from the list here, thereby eliminating the need for rxrpc_put_call() to check for that. rxrpc_put_call() can then be fixed to unconditionally delete the call from the list as it is the only place that the deletion occurs. Fixes: 2baec2c3f854 ("rxrpc: Support network namespacing") Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Linus Torvalds cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-5-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 6a59d84b4fc2f27f7b40e348506cc686712e260b Author: David Howells Date: Wed Apr 8 13:12:31 2026 +0100 rxrpc: Fix anonymous key handling In rxrpc_new_client_call_for_sendmsg(), a key with no payload is meant to be substituted for a NULL key pointer, but the variable this is done with is subsequently not used. Fix this by using "key" rather than "rx->key" when filling in the connection parameters. Note that this only affects direct use of AF_RXRPC; the kAFS filesystem doesn't use sendmsg() directly and so bypasses the issue. Further, AF_RXRPC passes a NULL key in if no key is set, so using an anonymous key in that manner works. Since this hasn't been noticed to this point, it might be better just to remove the "key" variable and the code that sets it - and, arguably, rxrpc_init_client_call_security() would be a better place to handle it. Fixes: 19ffa01c9c45 ("rxrpc: Use structs to hold connection params and protocol info") Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-4-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit b555912b9b21075e8298015f888ffe3ff60b1a97 Author: David Howells Date: Wed Apr 8 13:12:30 2026 +0100 rxrpc: Fix key parsing memleak In rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token->rxgk can be leaked in a few error paths after it's allocated. Fix this by freeing it in the "reject_token:" case. Fixes: 0ca100ff4df6 ("rxrpc: Add YFS RxGK (GSSAPI) security class") Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-3-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit bdbfead6d38979475df0c2f4bad2b19394fe9bdc Author: David Howells Date: Wed Apr 8 13:12:29 2026 +0100 rxrpc: Fix key quota calculation for multitoken keys In the rxrpc key preparsing, every token extracted sets the proposed quota value, but for multitoken keys, this will overwrite the previous proposed quota, losing it. Fix this by adding to the proposed quota instead. Fixes: 8a7a3eb4ddbe ("KEYS: RxRPC: Use key preparsing") Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit c09ea768bdb975e828f8e17293c397c3d14ad85d Author: Felix Gu Date: Sun Apr 5 14:51:52 2026 +0800 net: mdio: realtek-rtl9300: use scoped device_for_each_child_node loop Switch to device_for_each_child_node_scoped() to auto-release fwnode references on early exit. Fixes: 24e31e474769 ("net: mdio: Add RTL9300 MDIO driver") Signed-off-by: Felix Gu Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260405-rtl9300-v1-1-08e4499cf944@gmail.com Signed-off-by: Jakub Kicinski commit 7f87a5ea75f011d2c9bc8ac0167e5e2d1adb1594 Merge: 52f657e34d7b21 45065a5095c777 Author: Linus Torvalds Date: Wed Apr 8 13:38:30 2026 -0700 Merge tag 'hid-for-linus-2026040801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - handling of new keycodes for contextual AI usages (Akshai Murari) - fix for UAF in hid-roccat (Benoît Sevens) - deduplication of error logging in amd_sfh (Maximilian Pezzullo) - various device-specific quirks and device ID additions (Even Xu, Lode Willems, Leo Vriska) * tag 'hid-for-linus-2026040801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: Input: add keycodes for contextual AI usages (HUTRR119) HID: Kysona: Add support for VXE Dragonfly R1 Pro HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 HID: roccat: fix use-after-free in roccat_report_event HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs HID: Intel-thc-hid: Intel-quicki2c: Add NVL Device IDs commit 52f657e34d7b21b47434d9d8b26fa7f6778b63a0 Author: Linus Torvalds Date: Wed Apr 8 13:18:57 2026 -0700 x86: shadow stacks: proper error handling for mmap lock 김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also shows that we haven't marked those functions with "__must_check", which would have immediately caught it. So let's fix both issues. Reported-by: 김영민 Acked-by: Oleg Nesterov Acked-by: Dave Hansen Acked-by: Rick Edgecombe Signed-off-by: Linus Torvalds commit ff14dafde15c11403fac61367a34fea08926e9ee Author: Dmitry Torokhov Date: Tue Apr 7 22:16:27 2026 -0700 Input: uinput - take event lock when submitting FF request "event" To avoid racing with FF playback events and corrupting device's event queue take event_lock spinlock when calling uinput_dev_event() when submitting a FF upload or erase "event". Tested-by: Mikhail Gavrilov Link: https://patch.msgid.link/adXkf6MWzlB8LA_s@google.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 6b6f7263d626886a96fce6352f94dfab7a24c339 Author: Syed Saba Kareem Date: Wed Apr 8 19:00:06 2026 +0530 ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms Replace DMI_EXACT_MATCH with DMI_MATCH for Lenovo SKU entries (21YW, 21YX) so the quirk applies to all variants of these models, not just exact SKU matches. Add ASOC_SDW_ACP_DMIC flag alongside ASOC_SDW_CODEC_SPKR in driver_data for these Lenovo platform entries, as these platforms use ACP PDM DMIC instead of SoundWire DMIC for digital microphone support. Fixes: 3acf517e1ae0 ("ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models") Tested-by: Mark Pearson Reviewed-by: Mark Pearson Signed-off-by: Syed Saba Kareem Reviewed-by: Vijendar Mukunda Link: https://patch.msgid.link/20260408133029.1368317-1-syed.sabakareem@amd.com Signed-off-by: Mark Brown commit 0b8757b220f94421bd4ff50cce03886387c4e71c Author: Richard Fitzgerald Date: Wed Apr 8 10:38:34 2026 +0100 ASoC: SDCA: Unregister IRQ handlers on module remove Ensure that all interrupt handlers are unregistered before the parent regmap_irq is unregistered. sdca_irq_cleanup() was only called from the component_remove(). If the module was loaded and removed without ever being component probed the FDL interrupts would not be unregistered and this would hit a WARN when devm called regmap_del_irq_chip() during the removal of the parent IRQ. Fixes: 4e53116437e9 ("ASoC: SDCA: Fix errors in IRQ cleanup") Signed-off-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260408093835.2881486-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 58dec4fac4c46b42b8264f2d8aa6972ff951c18b Author: Maciej Strozek Date: Wed Apr 8 10:38:32 2026 +0100 ASoC: SDCA: mask Function_Status value According to the SDCA specification [1], when writing Function_Status during handling this control, the value should mask off bit 7. [1] MIPI Specification for SoundWire Device Class for Audio, version 1.1, section 7.14.1.3 (Host Software Handling of Function_Status) Signed-off-by: Maciej Strozek Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260408093835.2881486-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 23e0cbe55736de222ed975863cf06baf29bee5fe Author: Maciej Strozek Date: Wed Apr 8 10:38:31 2026 +0100 ASoC: SDCA: Fix overwritten var within for loop mask variable should not be overwritten within the for loop or it will skip certain bits. Change to using BIT() macro. Fixes: b9ab3b618241 ("ASoC: SDCA: Add some initial IRQ handlers") Signed-off-by: Maciej Strozek Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260408093835.2881486-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 5241c2ca33bb181bf7abb7cb4bba1cc67d1b6278 Author: Thomas Zimmermann Date: Thu Apr 2 11:09:16 2026 +0200 firmware: efi: Never declare sysfb_primary_display on x86 The x86 architecture comes with its own instance of the global state variable sysfb_primary_display. Never declare it in the EFI subsystem. Fix the test for CONFIG_FIRMWARE_EDID accordingly. Signed-off-by: Thomas Zimmermann Fixes: e65ca1646311 ("efi: export sysfb_primary_display for EDID") Signed-off-by: Ard Biesheuvel commit 0669631dbccd41cf3ca7aa70213fcd8bb41c4b38 Author: Tomasz Merta Date: Wed Apr 8 10:40:56 2026 +0200 ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J The STM32 SAI driver do not set the clock strobing bit (CKSTR) for DSP_A, DSP_B and LEFT_J formats, causing data to be sampled on the wrong BCLK edge when SND_SOC_DAIFMT_NB_NF is used. Per ALSA convention, NB_NF requires sampling on the rising BCLK edge. The STM32MP25 SAI reference manual states that CKSTR=1 is required for signals received by the SAI to be sampled on the SCK rising edge. Without setting CKSTR=1, the SAI samples on the falling edge, violating the NB_NF convention. For comparison, the NXP FSL SAI driver correctly sets FSL_SAI_CR2_BCP for DSP_A, DSP_B and LEFT_J, consistent with its I2S handling. This patch adds SAI_XCR1_CKSTR for DSP_A, DSP_B and LEFT_J in stm32_sai_set_dai_fmt which was verified empirically with a cs47l35 codec. RIGHT_J (LSB) is not investigated and addressed by this patch. Note: the STM32 I2S driver (stm32_i2s_set_dai_fmt) may have the same issue for DSP_A mode, as I2S_CGFR_CKPOL is not set. This has not been verified and is left for a separate investigation. Signed-off-by: Tomasz Merta Link: https://patch.msgid.link/20260408084056.20588-1-tommerta@gmail.com Signed-off-by: Mark Brown commit 0f71866057262d669ed6a21246eaac0ad6d04d4e Author: Kai Vehmanen Date: Wed Apr 8 11:45:14 2026 +0300 ASoC: SOF: Intel: hda: modify period size constraints for ACE4 Intel ACE4 based products set more strict constraints on HDA BDLE start address and length alignment. Add a constraint to align period size to 128 bytes. The commit removes the "minimum as per HDA spec" comment. This comment was misleading as spec actually does allow a 2 byte BDLE length, and more importantly, period size also directly impacts how the BDLE start addresses are aligned, so it is not sufficient just to consider allowed buffer length. Fixes: d3df422f66e8 ("ASoC: SOF: Intel: add initial support for NVL-S") Cc: stable@vger.kernel.org Reported-by: Peter Ujfalusi Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Link: https://patch.msgid.link/20260408084514.24325-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 082c192c0dd03f685514c9ce2eb0a80fd28e2175 Author: Kai Vehmanen Date: Wed Apr 8 11:45:13 2026 +0300 ALSA: hda/intel: enforce stricter period-size alignment for Intel NVL Intel ACE4 based products set more strict constraints on HDA BDLE start address and length alignment. Modify capability flags to drop AZX_DCAPS_NO_ALIGN_BUFSIZE for Intel Nova Lake platforms. Fixes: 7f428282fde3 ("ALSA: hda: controllers: intel: add support for Nova Lake") Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Cc: Link: https://patch.msgid.link/20260408084514.24325-2-peter.ujfalusi@linux.intel.com Signed-off-by: Takashi Iwai commit f4c90fb761f696ebbcf1e8fb7f83d83cbb30cb0c Author: Neo Chang Date: Wed Apr 8 13:26:39 2026 +0800 ASoC: nau8325: Add software reset during probe Currently, the driver only performs a hardware reset during the I2C probe sequence. To ensure all internal states of the codec are properly cleared without affecting the configuration registers, a software reset is also required. According to the hardware specification, writing to the Software Reset register (R01) twice will reset all internal states safely. This patch adds the nau8325_software_reset() function, executes it right after the hardware reset in the probe function, and marks the R01 register as writeable in the regmap configuration. Signed-off-by: Neo Chang Reviewed-by: Cezary Rojewski Link: https://patch.msgid.link/20260408052639.187149-1-YLCHANG2@nuvoton.com Signed-off-by: Mark Brown commit dde1a6084c5ca9d143a562540d5453454d79ea15 Author: Fernando Fernandez Mancera Date: Mon Apr 6 23:18:31 2026 +0200 selftests: nft_queue.sh: add a parallel stress test Introduce a new stress test to check for race conditions in the nfnetlink_queue subsystem, where an entry is freed while another CPU is concurrently walking the global rhashtable. To trigger this, `nf_queue.c` is extended with two new flags: * -O (out-of-order): Buffers packet IDs and flushes them in reverse. * -b (bogus verdicts): Floods the kernel with non-existent packet IDs. The bogus verdict loop forces the kernel's lookup function to perform full rhashtable bucket traversals (-ENOENT). Combined with reverse-order flushing and heavy parallel UDP/ping flooding across 8 queues, this puts the nfnetlink_queue code under pressure. Joint work with Florian Westphal. Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit 936206e3f6ff411581e615e930263d6f8b78df9d Author: Florian Westphal Date: Tue Apr 7 17:00:01 2026 +0200 netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among all queues is tempting, but it can cause crash: BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] [..] nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] nfnetlink_rcv_msg+0x46a/0x930 kmem_cache_alloc_node_noprof+0x11e/0x450 struct nf_queue_entry is freed via kfree, but parallel cpu can still encounter such an nf_queue_entry when walking the list. Alternative fix is to free the nf_queue_entry via kfree_rcu() instead, but as we have to alloc/free for each skb this will cause more mem pressure. Cc: Scott Mitchell Fixes: e19079adcd26 ("netfilter: nfnetlink_queue: optimize verdict lookup with hash table") Signed-off-by: Florian Westphal commit f8dca15a1b190787bbd03285304b569631160eda Author: Tuan Do Date: Fri Apr 3 00:33:17 2026 -0700 netfilter: nft_ct: fix use-after-free in timeout object destroy nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data(). Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c. KASAN report: BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80 Call Trace: nf_conntrack_tcp_packet+0x1381/0x29d0 nf_conntrack_in+0x612/0x8b0 nf_hook_slow+0x70/0x100 __ip_local_out+0x1b2/0x210 tcp_sendmsg_locked+0x722/0x1580 __sys_sendto+0x2d8/0x320 Allocated by task 75: nft_ct_timeout_obj_init+0xf6/0x290 nft_obj_init+0x107/0x1b0 nf_tables_newobj+0x680/0x9c0 nfnetlink_rcv_batch+0xc29/0xe00 Freed by task 26: nft_obj_destroy+0x3f/0xa0 nf_tables_trans_destroy_work+0x51c/0x5c0 process_one_work+0x2c4/0x5a0 Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") Cc: stable@vger.kernel.org Signed-off-by: Tuan Do Signed-off-by: Florian Westphal commit fdce0b3590f724540795b874b4c8850c90e6b0a8 Author: Zhengchuan Liang Date: Sat Apr 4 17:39:47 2026 +0800 netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 source address. The existing guard only rejects an invalid MAC header when `par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()` can still reach `eth_hdr(skb)` even when the MAC header is not valid. Fix this by removing the `par->fragoff != 0` condition so that packets with an invalid MAC header are rejected before accessing `eth_hdr(skb)`. Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Signed-off-by: Florian Westphal commit ff64c5bfef12461df8450e0f50bb693b5269c720 Author: Ren Wei Date: Fri Apr 3 23:52:52 2026 +0800 netfilter: xt_multiport: validate range encoding in checkentry ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end. The checkentry path currently validates protocol, flags and count, but it does not validate the range encoding itself. As a result, malformed rules can mark the last slot as a range start or place two range starts back to back, leaving ports_match_v1() to step past the last valid ports[] element while interpreting the rule. Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start. Fixes: a89ecb6a2ef7 ("[NETFILTER]: x_tables: unify IPv4/IPv6 multiport match") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Yuhang Zheng Signed-off-by: Ren Wei Signed-off-by: Florian Westphal commit 1f3083aec8836213da441270cdb1ab612dd82cf4 Author: Xiang Mei Date: Wed Apr 1 14:20:57 2026 -0700 netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send() appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put() helper only zeroes alignment padding after the payload, not the payload itself, so four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body. Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes the nfgenmsg payload via nfnl_fill_hdr(), consistent with how __build_packet_message() already constructs NFULNL_MSG_PACKET headers. Fixes: 29c5d4afba51 ("[NETFILTER]: nfnetlink_log: fix sending of multipart messages") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Signed-off-by: Florian Westphal commit 9a91797e61d286805ae10a92cc48959c30800556 Author: Weiming Shi Date: Wed Apr 1 15:58:01 2026 +0800 ipvs: fix NULL deref in ip_vs_add_service error path When ip_vs_bind_scheduler() succeeds in ip_vs_add_service(), the local variable sched is set to NULL. If ip_vs_start_estimator() subsequently fails, the out_err cleanup calls ip_vs_unbind_scheduler(svc, sched) with sched == NULL. ip_vs_unbind_scheduler() passes the cur_sched NULL check (because svc->scheduler was set by the successful bind) but then dereferences the NULL sched parameter at sched->done_service, causing a kernel panic at offset 0x30 from NULL. Oops: general protection fault, [..] [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] RIP: 0010:ip_vs_unbind_scheduler (net/netfilter/ipvs/ip_vs_sched.c:69) Call Trace: ip_vs_add_service.isra.0 (net/netfilter/ipvs/ip_vs_ctl.c:1500) do_ip_vs_set_ctl (net/netfilter/ipvs/ip_vs_ctl.c:2809) nf_setsockopt (net/netfilter/nf_sockopt.c:102) [..] Fix by simply not clearing the local sched variable after a successful bind. ip_vs_unbind_scheduler() already detects whether a scheduler is installed via svc->scheduler, and keeping sched non-NULL ensures the error path passes the correct pointer to both ip_vs_unbind_scheduler() and ip_vs_scheduler_put(). While the bug is older, the problem popups in more recent kernels (6.2), when the new error path is taken after the ip_vs_start_estimator() call. Fixes: 705dd3444081 ("ipvs: use kthreads for stats estimation") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Acked-by: Simon Horman Acked-by: Julian Anastasov Signed-off-by: Florian Westphal commit 4c71fd099513bfa8acab529b626e1f0097b76061 Author: Sebastian Brzezinka Date: Wed Apr 1 12:10:07 2026 +0200 drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat A use-after-free / refcount underflow is possible when the heartbeat worker and intel_engine_park_heartbeat() race to release the same engine->heartbeat.systole request. The heartbeat worker reads engine->heartbeat.systole and calls i915_request_put() on it when the request is complete, but clears the pointer in a separate, non-atomic step. Concurrently, a request retirement on another CPU can drop the engine wakeref to zero, triggering __engine_park() -> intel_engine_park_heartbeat(). If the heartbeat timer is pending at that point, cancel_delayed_work() returns true and intel_engine_park_heartbeat() reads the stale non-NULL systole pointer and calls i915_request_put() on it again, causing a refcount underflow: ``` <4> [487.221889] Workqueue: i915-unordered engine_retire [i915] <4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0 ... <4> [487.222707] Call Trace: <4> [487.222711] <4> [487.222716] intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915] <4> [487.223115] intel_engine_park_heartbeat+0x25/0x40 [i915] <4> [487.223566] __engine_park+0xb9/0x650 [i915] <4> [487.223973] ____intel_wakeref_put_last+0x2e/0xb0 [i915] <4> [487.224408] __intel_wakeref_put_last+0x72/0x90 [i915] <4> [487.224797] intel_context_exit_engine+0x7c/0x80 [i915] <4> [487.225238] intel_context_exit+0xf1/0x1b0 [i915] <4> [487.225695] i915_request_retire.part.0+0x1b9/0x530 [i915] <4> [487.226178] i915_request_retire+0x1c/0x40 [i915] <4> [487.226625] engine_retire+0x122/0x180 [i915] <4> [487.227037] process_one_work+0x239/0x760 <4> [487.227060] worker_thread+0x200/0x3f0 <4> [487.227068] ? __pfx_worker_thread+0x10/0x10 <4> [487.227075] kthread+0x10d/0x150 <4> [487.227083] ? __pfx_kthread+0x10/0x10 <4> [487.227092] ret_from_fork+0x3d4/0x480 <4> [487.227099] ? __pfx_kthread+0x10/0x10 <4> [487.227107] ret_from_fork_asm+0x1a/0x30 <4> [487.227141] ``` Fix this by replacing the non-atomic pointer read + separate clear with xchg() in both racing paths. xchg() is a single indivisible hardware instruction that atomically reads the old pointer and writes NULL. This guarantees only one of the two concurrent callers obtains the non-NULL pointer and performs the put, the other gets NULL and skips it. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/15880 Fixes: 058179e72e09 ("drm/i915/gt: Replace hangcheck by heartbeats") Cc: # v5.5+ Signed-off-by: Sebastian Brzezinka Reviewed-by: Krzysztof Karas Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/d4c1c14255688dd07cc8044973c4f032a8d1559e.1775038106.git.sebastian.brzezinka@intel.com (cherry picked from commit 13238dc0ee4f9ab8dafa2cca7295736191ae2f42) Signed-off-by: Joonas Lahtinen commit 14a857056466be9d3d907a94e92a704ac1be149b Author: Peter Zijlstra Date: Sat Apr 4 12:22:44 2026 +0200 sched/deadline: Use revised wakeup rule for dl_server John noted that commit 115135422562 ("sched/deadline: Fix 'stuck' dl_server") unfixed the issue from commit a3a70caf7906 ("sched/deadline: Fix dl_server behaviour"). The issue in commit 115135422562 was for wakeups of the server after the deadline; in which case you *have* to start a new period. The case for a3a70caf7906 is wakeups before the deadline. Now, because the server is effectively running a least-laxity policy, it means that any wakeup during the runnable phase means dl_entity_overflow() will be true. This means we need to adjust the runtime to allow it to still run until the existing deadline expires. Use the revised wakeup rule for dl_defer entities. Fixes: 115135422562 ("sched/deadline: Fix 'stuck' dl_server") Reported-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juri Lelli Tested-by: John Stultz Link: https://patch.msgid.link/20260404102244.GB22575@noisy.programming.kicks-ass.net commit 828ec7f803f41588a120e6d804297e74a482ab9d Author: Matti Vaittinen Date: Tue Apr 7 15:41:48 2026 +0300 gpio: bd72720: handle missing regmap Currently the probe does not check whether getting the regmap succeeded. This can cause crash when regmap is used, if it wasn't successfully obtained. Failing to get the regmap is unlikely, especially since this driver is expected to be kicked by the MFD driver only after registering the regmap - but it is still better to handle this gracefully. Signed-off-by: Matti Vaittinen Fixes: e7eef0bd4075 ("regulator: bd71828-regulator.c: Fix LDON-HEAD mode") Link: https://patch.msgid.link/5bfffee380863bcf24f3062e48094c8eb7b1342f.1775565381.git.mazziesaccount@gmail.com Signed-off-by: Bartosz Golaszewski commit 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2 Author: Mikhail Gavrilov Date: Tue Apr 7 12:50:31 2026 +0500 Input: uinput - fix circular locking dependency with ff-core A lockdep circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput (for example, playing ELDEN RING under Wine with a Flydigi Vader 5 controller): ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex The cycle is caused by four lock acquisition paths: 1. ff upload: input_ff_upload() holds ff->mutex and calls uinput_dev_upload_effect() -> uinput_request_submit() -> uinput_request_send(), which acquires udev->mutex. 2. device create: uinput_ioctl_handler() holds udev->mutex and calls uinput_create_device() -> input_register_device(), which acquires input_mutex. 3. device register: input_register_device() holds input_mutex and calls kbd_connect() -> input_register_handle(), which acquires dev->mutex. 4. evdev release: evdev_release() calls input_flush_device() under dev->mutex, which calls input_ff_flush() acquiring ff->mutex. Fix this by introducing a new state_lock spinlock to protect udev->state and udev->dev access in uinput_request_send() instead of acquiring udev->mutex. The function only needs to atomically check device state and queue an input event into the ring buffer via uinput_dev_event() -- both operations are safe under a spinlock (ktime_get_ts64() and wake_up_interruptible() do not sleep). This breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in the lock ordering and cannot form cycles with mutexes. To keep state transitions visible to uinput_request_send(), protect writes to udev->state in uinput_create_device() and uinput_destroy_device() with the same state_lock spinlock. Additionally, move init_completion(&request->done) from uinput_request_send() to uinput_request_submit() before uinput_request_reserve_slot(). Once the slot is allocated, uinput_flush_requests() may call complete() on it at any time from the destroy path, so the completion must be initialised before the request becomes visible. Lock ordering after the fix: ff->mutex -> state_lock (spinlock, leaf) udev->mutex -> state_lock (spinlock, leaf) udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge) Fixes: ff462551235d ("Input: uinput - switch to the new FF interface") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/CABXGCsMoxag+kEwHhb7KqhuyxfmGGd0P=tHZyb1uKE0pLr8Hkg@mail.gmail.com/ Signed-off-by: Mikhail Gavrilov Link: https://patch.msgid.link/20260407075031.38351-1-mikhail.v.gavrilov@gmail.com Signed-off-by: Dmitry Torokhov commit f821664dde29302e8450aa0597bf1e4c7c5b0a22 Merge: efaa71faf21232 32dfd742f06a68 Author: Jakub Kicinski Date: Tue Apr 7 20:20:59 2026 -0700 Merge branch 'seg6-fix-dst_cache-sharing-in-seg6-lwtunnel' Andrea Mayer says: ==================== seg6: fix dst_cache sharing in seg6 lwtunnel The seg6 lwtunnel encap uses a single per-route dst_cache shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup. Patch 1 fixes this by splitting the cache into cache_input and cache_output. Patch 2 adds a selftest that validates the isolation. ==================== Link: https://patch.msgid.link/20260404004405.4057-1-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski commit 32dfd742f06a68fac6499a58f52025990c854031 Author: Andrea Mayer Date: Sat Apr 4 02:44:05 2026 +0200 selftests: seg6: add test for dst_cache isolation in seg6 lwtunnel Add a selftest that verifies the dst_cache in seg6 lwtunnel is not shared between the input (forwarding) and output (locally generated) paths. The test creates three namespaces (ns_src, ns_router, ns_dst) connected in a line. An SRv6 encap route on ns_router encapsulates traffic destined to cafe::1 with SID fc00::100. The SID is reachable only for forwarded traffic (from ns_src) via an ip rule matching the ingress interface (iif veth-r0 lookup 100), and blackholed in the main table. The test verifies that: 1. A packet generated locally on ns_router does not reach ns_dst with an empty cache, since the SID is blackholed; 2. A forwarded packet from ns_src populates the input cache from table 100 and reaches ns_dst; 3. A packet generated locally on ns_router still does not reach ns_dst after the input cache is populated, confirming the output path does not reuse the input cache entry. Both the forwarded and local packets are pinned to the same CPU with taskset, since dst_cache is per-cpu. Cc: Shuah Khan Signed-off-by: Andrea Mayer Reviewed-by: Nicolas Dichtel Reviewed-by: Justin Iurman Link: https://patch.msgid.link/20260404004405.4057-3-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski commit c3812651b522fe8437ebb7063b75ddb95b571643 Author: Andrea Mayer Date: Sat Apr 4 02:44:04 2026 +0200 seg6: separate dst_cache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup. Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently. Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels") Cc: stable@vger.kernel.org Signed-off-by: Andrea Mayer Reviewed-by: Nicolas Dichtel Reviewed-by: Justin Iurman Link: https://patch.msgid.link/20260404004405.4057-2-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski commit efaa71faf212324ecbf6d5339e9717fe53254f58 Author: Daniel Golle Date: Sun Apr 5 22:29:19 2026 +0100 selftests: net: bridge_vlan_mcast: wait for h1 before querier check The querier-interval test adds h1 (currently a slave of the VRF created by simple_if_init) to a temporary bridge br1 acting as an outside IGMP querier. The kernel VRF driver (drivers/net/vrf.c) calls cycle_netdev() on every slave add and remove, toggling the interface admin-down then up. Phylink takes the PHY down during the admin-down half of that cycle. Since h1 and swp1 are cable-connected, swp1 also loses its link may need several seconds to re-negotiate. Use setup_wait_dev $h1 0 which waits for h1 to return to UP state, so the test can rely on the link being back up at this point. Fixes: 4d8610ee8bd77 ("selftests: net: bridge: add vlan mcast_querier_interval tests") Signed-off-by: Daniel Golle Reviewed-by: Alexander Sverdlin Link: https://patch.msgid.link/c830f130860fd2efae08bfb9e5b25fd028e58ce5.1775424423.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 944b3b734cfbbe9502274c092bc3b8220764cc92 Author: Jakub Kicinski Date: Fri Apr 3 17:19:38 2026 -0700 net: avoid nul-deref trying to bind mp to incapable device Sashiko points out that we use qops in __net_mp_open_rxq() but never validate they are null. This was introduced when check was moved from netdev_rx_queue_restart(). Look at ops directly instead of the locking config. qops imply netdev_need_ops_lock(). We used netdev_need_ops_lock() initially to signify that the real_num_rx_queues check below is safe without rtnl_lock, but I'm not sure if this is actually clear to most people, anyway. Fixes: da7772a2b4ad ("net: move mp->rx_page_size validation to __net_mp_open_rxq()") Acked-by: Daniel Borkmann Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20260404001938.2425670-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f2777d5cb5c094e20f2323d953b1740baee5f8e8 Author: Johan Alvarado Date: Mon Apr 6 07:44:25 2026 +0000 net: stmmac: dwmac-motorcomm: fix eFUSE MAC address read failure This patch fixes an issue where reading the MAC address from the eFUSE fails due to a race condition. The root cause was identified by comparing the driver's behavior with a custom U-Boot port. In U-Boot, the MAC address was read successfully every time because the driver was loaded later in the boot process, giving the hardware ample time to initialize. In Linux, reading the eFUSE immediately returns all zeros, resulting in a fallback to a random MAC address. Hardware cold-boot testing revealed that the eFUSE controller requires a short settling time to load its internal data. Adding a 2000-5000us delay after the reset ensures the hardware is fully ready, allowing the native MAC address to be read consistently. Fixes: 02ff155ea281 ("net: stmmac: Add glue driver for Motorcomm YT6801 ethernet controller") Reported-by: Georg Gottleuber Closes: https://lore.kernel.org/24cfefff-1233-4745-8c47-812b502d5d19@tuxedocomputers.com Signed-off-by: Johan Alvarado Reviewed-by: Yao Zi Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/fc5992a4-9532-49c3-8ec1-c2f8c5b84ca1@smtp-relay.sendinblue.com Signed-off-by: Jakub Kicinski commit 95aca8602ef70ffd3d971675751c81826e124f90 Author: John Pavlick Date: Mon Apr 6 13:23:33 2026 +0000 net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules Several GPON ONT SFP sticks based on Realtek RTL960x report 1000BASE-LX at 1300MBd in their EEPROM but can operate at 2500base-X. On hosts capable of 2500base-X (e.g. Banana Pi R3 / MT7986), the kernel negotiates only 1G because it trusts the incorrect EEPROM data. Add quirks for: - Hisense-Leox LXT-010S-H - Hisense ZNID-GPON-2311NA - HSGQ HSGQ-XPON-Stick Each quirk advertises 2500base-X and ignores TX_FAULT during the module's ~40s Linux boot time. Tested on Banana Pi R3 (MT7986) with OpenWrt 25.12.1, confirmed 2.5Gbps link and full throughput with flow offloading. Reviewed-by: Russell King (Oracle) Suggested-by: Marcin Nita Signed-off-by: John Pavlick Link: https://patch.msgid.link/20260406132321.72563-1-jspavlick@posteo.net Signed-off-by: Jakub Kicinski commit 7596459f3c93d8d45a1bf12d4d7526b50c15baa2 Author: Vinay Belgaumkar Date: Tue Mar 31 18:27:10 2026 -0700 drm/xe: Fix bug in idledly unit conversion We only need to convert to picosecond units before writing to RING_IDLEDLY. Fixes: 7c53ff050ba8 ("drm/xe: Apply Wa_16023105232") Cc: Tangudu Tilak Tirumalesh Acked-by: Tangudu Tilak Tirumalesh Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260401012710.4165547-1-vinay.belgaumkar@intel.com (cherry picked from commit 13743bd628bc9d9a0e2fe53488b2891aedf7cc74) Signed-off-by: Rodrigo Vivi commit 3036cd0d3328220a1858b1ab390be8b562774e8a Merge: 86782c16a81f82 105c42566a550e Author: Linus Torvalds Date: Tue Apr 7 10:33:49 2026 -0700 Merge tag 'ata-7.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Niklas Cassel: - Add a quirk for JMicron JMB582/JMB585 AHCI controllers such that they only use 32-bit DMA addresses. While these controllers do report that they support 64-bit DMA addresses, a user reports that using 64-bit DMA addresses cause silent corruption even on modern x86 systems (Arthur) * tag 'ata-7.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 commit 86782c16a81f8232c13c1509fd3295bd97d185b0 Merge: 66d64899eae85d 16cbec24897624 Author: Linus Torvalds Date: Tue Apr 7 10:29:54 2026 -0700 Merge tag 'hyperv-fixes-signed-20260406' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V fixes from Wei Liu: - Two fixes for Hyper-V PCI driver (Long Li, Sahil Chandna) - Fix an infinite loop issue in MSHV driver (Stanislav Kinsburskii) * tag 'hyperv-fixes-signed-20260406' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv: Fix infinite fault loop on permission-denied GPA intercepts PCI: hv: Fix double ida_free in hv_pci_probe error path PCI: hv: Set default NUMA node to 0 for devices without affinity info commit 66d64899eae85dc9b96c5433933787cdcd9b21e4 Merge: bfe62a454542cf 7bc5da4842bed3 Author: Linus Torvalds Date: Tue Apr 7 10:24:44 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-04-06-15-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Eight hotfixes. All are cc:stable and seven are for MM. All are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-04-06-15-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline mm/damon/stat: deallocate damon_call() failure leaking damon_ctx mm/vma: fix memory leak in __mmap_region() mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails mm: reinstate unconditional writeback start in balance_dirty_pages() liveupdate: propagate file deserialization failures mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() commit 705355a82b8ea86e0afe44560e970eedc74c05d3 Author: Raju Rangoju Date: Mon Apr 6 14:40:42 2026 +0530 MAINTAINERS: Update AMD SPI driver maintainers Due to additional responsibilities, Raju Rangoju will no longer be supporting AMD SPI driver. Maintenance will be handled by Krishnamoorthi going forward. Cc: Krishnamoorthi M Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260406091042.4065767-1-Raju.Rangoju@amd.com Signed-off-by: Mark Brown commit 3ffe5eb4a5f248c0d4b849f050af973396656f85 Author: Claudio Imbrenda Date: Tue Apr 7 18:17:21 2026 +0200 KVM: s390: vsie: Fix races with partial gmap invalidations Introduce a new boolean flag, used for shadow gmaps, to keep track of whether the gmap has been invalidated, either partially or totally. Use the new flag to check whether shadow gmap invalidations happened during shadowing. In such cases, abort whatever was going on, return -EAGAIN and let the caller try again. Fixes: 19d6c5b80443 ("KVM: s390: vsie: Fix unshadowing while shadowing") Signed-off-by: Claudio Imbrenda Message-ID: <20260407161721.247044-1-imbrenda@linux.ibm.com> commit b1baaff4e5231f0d7db209f72a43112cd2d29257 Author: Matti Vaittinen Date: Tue Apr 7 16:27:19 2026 +0300 regulator: bd71828-regulator.c: Fix LDON-HEAD mode The ROHM BD72720 supports so called LDON-HEAD -mode, in which the buck10 is expected to be supplying power for an LDO. In this mode, the buck10 voltage will follow what is set for the LDO, on order to lower the power-loss in the LDO. This hardware configuration can be adverticed via the device-tree. When this is done, the Linux driver should omit registering the voltage control operations for the buck10, because the voltage control is now done by the hardware. This is done by modifying the buck10 regulator descriptor, before passing it to the regulator registration functions. There is an off-by-one error when the regulator descriptor array is indexed, and wrong descriptor is modified causing the LDO1 operations to be modified instead of the BUCK10 operations. Fix this by correcting the indexing. Signed-off-by: Matti Vaittinen Fixes: f16a9d76a71d ("regulator: bd71828: Support ROHM BD72720") Link: https://patch.msgid.link/e7eef0bd407522ae5d9b7d0c4ec43f40b1dba833.1775565148.git.mazziesaccount@gmail.com Signed-off-by: Mark Brown commit 82b915051d32a68ea3bbe261c93f5620699ff047 Author: Josh Snyder Date: Thu Apr 2 16:23:38 2026 -0700 tick/nohz: Fix inverted return value in check_tick_dependency() fast path Commit 56534673cea7f ("tick/nohz: Optimize check_tick_dependency() with early return") added a fast path that returns !val when the tick_stop tracepoint is disabled. This is inverted: the slow path returns true when a dependency IS found (val != 0), but !val returns true when val is zero (no dependency). The result is that can_stop_full_tick() sees "dependency found" when there are none, and the tick never stops on nohz_full CPUs. Fix this by returning !!val instead of !val, matching the slow-path semantics. Fixes: 56534673cea7f ("tick/nohz: Optimize check_tick_dependency() with early return") Signed-off-by: Josh Snyder Signed-off-by: Thomas Gleixner Assisted-by: Claude:claude-opus-4-6 Link: https://patch.msgid.link/20260402-fix-idle-tick2-v1-1-eecb589649d3@code406.com commit a9b8b18364fffce4c451e6f6fd218fa4ab646705 Author: Muhammad Alifa Ramdhan Date: Fri Apr 3 09:36:17 2026 +0800 net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling in tls_do_encryption(), introduced by commit 859054147318 ("net: tls: handle backlogging of crypto requests"), has a use-after-free due to double cleanup of encrypt_pending and the scatterlist entry. When crypto_aead_encrypt() returns -EBUSY, the request is enqueued to the cryptd backlog and the async callback tls_encrypt_done() will be invoked upon completion. That callback unconditionally restores the scatterlist entry (sge->offset, sge->length) and decrements ctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an error, the synchronous error path in tls_do_encryption() performs the same cleanup again, double-decrementing encrypt_pending and double-restoring the scatterlist. The double-decrement corrupts the encrypt_pending sentinel (initialized to 1), making tls_encrypt_async_wait() permanently skip the wait for pending async callbacks. A subsequent sendmsg can then free the tls_rec via bpf_exec_tx_verdict() while a cryptd callback is still pending, resulting in a use-after-free when the callback fires on the freed record. Fix this by skipping the synchronous cleanup when the -EBUSY async wait returns an error, since the callback has already handled encrypt_pending and sge restoration. Fixes: 859054147318 ("net: tls: handle backlogging of crypto requests") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Alifa Ramdhan Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260403013617.2838875-1-ramdhan@starlabs.sg Signed-off-by: Paolo Abeni commit 8508e9118649f13f7b857e9e10147b241db615d7 Author: Takashi Iwai Date: Tue Apr 7 14:33:17 2026 +0200 Revert "ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone" This reverts commit 56fbbe096a89ff4b52af78a21a4afd9d94bdcc80. It caused regressions on other Gigabyte models, and looking at the bugzilla entry again, the suggested change appears rather dubious, as incorrectly setting the front mic pin as the headphone. Fixes: 56fbbe096a89 ("ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone") Cc: Reported-by: Marcin Krycki Reported-by: Theodoros Orfanidis Closes: https://lore.kernel.org/CAEfRphPU_ABuVFzaHhspxgp2WAqi7kKNGo4yOOt0zeVFPSj8+Q@mail.gmail.com Link: https://patch.msgid.link/20260407123333.171130-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit c2812c0cb909211a1d2e7cec862406e32833b9de Author: Ulf Hansson Date: Tue Apr 7 14:14:53 2026 +0200 MAINTAINERS, mailmap: Change Ulf Hansson's email Change my email in MAINTAINERS and add a few entries in mailmap to start using ulfh@kernel.org. Signed-off-by: Ulf Hansson commit c5408d818316061d6063c11a4f47f1ba25a3a708 Author: Cezary Rojewski Date: Tue Apr 7 10:54:58 2026 +0200 ASoC: Intel: avs: Fix memory leak in avs_register_i2s_test_boards() Caller is responsible for freeing array allocated with parse_int_array(). Found out by Coverity. Fixes: 7d859189de13 ("ASoC: Intel: avs: Allow to specify custom configurations with i2s_test") Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20260407085459.400628-1-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 1f8fd9490e3184e9a2394df2e682901a1d57ce71 Author: Pei Xiao Date: Tue Apr 7 17:55:08 2026 +0800 spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for both "pclk" and "ref_clk". This removes the need for explicit clock enable and disable calls, as the managed API automatically disables the clocks on device removal or probe failure. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error paths and the remove callback. Simplify error handling by jumping directly to the remove_ctlr label. Signed-off-by: Pei Xiao Acked-by: Michal Simek Link: https://patch.msgid.link/24043625f89376da36feca2408f990a85be7ab36.1775555500.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 5a1140404cbf7ba40137dfb1fb96893aa9a67d68 Author: Nathan Rebello Date: Tue Apr 7 02:39:58 2026 -0400 usb: typec: ucsi: skip connector validation before init Notifications can arrive before ucsi_init() has populated ucsi->cap.num_connectors via GET_CAPABILITY. At that point num_connectors is still 0, causing all valid connector numbers to be incorrectly rejected as bogus. Skip the bounds check when num_connectors is 0 (not yet initialized). Pre-init notifications are already handled safely by the early-event guard in ucsi_connector_change(). Reported-by: Takashi Iwai Fixes: d2d8c17ac01a ("usb: typec: ucsi: validate connector number in ucsi_notify_common()") Cc: stable@vger.kernel.org Signed-off-by: Nathan Rebello Tested-by: Takashi Iwai Link: https://patch.msgid.link/20260407063958.863-1-nathan.c.rebello@gmail.com Signed-off-by: Greg Kroah-Hartman commit ea245d78dec594372e27d8c79616baf49e98a4a1 Author: Greg Kroah-Hartman Date: Mon Mar 30 11:14:13 2026 +0200 net: rfkill: prevent unlimited numbers of rfkill events from being created Userspace can create an unlimited number of rfkill events if the system is so configured, while not consuming them from the rfkill file descriptor, causing a potential out of memory situation. Prevent this from bounding the number of pending rfkill events at a "large" number (i.e. 1000) to prevent abuses like this. Cc: Johannes Berg Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Cc: stable Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026033013-disfigure-scroll-e25e@gregkh Signed-off-by: Johannes Berg commit 25369b22223d1c56e42a0cd4ac9137349d5a898e Author: Johan Hovold Date: Fri Mar 27 12:32:19 2026 +0100 wifi: rt2x00usb: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the USB anchor lifetime so that it is released on driver unbind. Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB") Cc: stable@vger.kernel.org # 4.7 Cc: Vishal Thanki Signed-off-by: Johan Hovold Acked-by: Stanislaw Gruszka Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260327113219.1313748-1-johan@kernel.org Signed-off-by: Johannes Berg commit 304950a467d83678bd0b0f46331882e2ac23b12d Author: Pengpeng Hou Date: Mon Mar 23 15:45:51 2026 +0800 wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check. Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array. Signed-off-by: Pengpeng Hou Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260323074551.93530-1-pengpeng@iscas.ac.cn [add missing wifi prefix] Signed-off-by: Johannes Berg commit 12cd7632757a54ce586e36040210b1a738a0fc53 Author: Thomas Fourier Date: Wed Feb 18 14:07:37 2026 +0100 wifi: brcmsmac: Fix dma_free_coherent() size dma_alloc_consistent() may change the size to align it. The new size is saved in alloced. Change the free size to match the allocation size. Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers") Cc: Signed-off-by: Thomas Fourier Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260218130741.46566-3-fourier.thomas@gmail.com Signed-off-by: Johannes Berg commit db5b8cecbdf479ad13156af750377e5b43853fab Author: Francesco Lavra Date: Mon Mar 30 18:19:14 2026 +0200 pinctrl: mcp23s08: Disable all pin interrupts during probe A chip being probed may have the interrupt-on-change feature enabled on some of its pins, for example after a reboot. This can cause the chip to generate interrupts for pins that don't have a registered nested handler, which leads to a kernel crash such as below: [ 7.928897] Unable to handle kernel read from unreadable memory at virtual address 00000000000000ac [ 7.932314] Mem abort info: [ 7.935081] ESR = 0x0000000096000004 [ 7.938808] EC = 0x25: DABT (current EL), IL = 32 bits [ 7.944094] SET = 0, FnV = 0 [ 7.947127] EA = 0, S1PTW = 0 [ 7.950247] FSC = 0x04: level 0 translation fault [ 7.955101] Data abort info: [ 7.957961] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 7.963421] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 7.968447] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 7.973734] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000089b7000 [ 7.980148] [00000000000000ac] pgd=0000000000000000, p4d=0000000000000000 [ 7.986913] Internal error: Oops: 0000000096000004 [#1] SMP [ 7.992545] Modules linked in: [ 8.073678] CPU: 0 UID: 0 PID: 81 Comm: irq/18-4-0025 Not tainted 7.0.0-rc6-gd2b5a1f931c8-dirty #199 [ 8.073689] Hardware name: Khadas VIM3 (DT) [ 8.073692] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 8.094639] pc : _raw_spin_lock_irq+0x40/0x80 [ 8.098970] lr : handle_nested_irq+0x2c/0x168 [ 8.098979] sp : ffff800082b2bd20 [ 8.106599] x29: ffff800082b2bd20 x28: ffff800080107920 x27: ffff800080104d88 [ 8.106611] x26: ffff000003298080 x25: 0000000000000001 x24: 000000000000ff00 [ 8.113707] x23: 0000000000000001 x22: 0000000000000000 x21: 000000000000000e [ 8.120850] x20: 0000000000000000 x19: 00000000000000ac x18: 0000000000000000 [ 8.135046] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 8.135062] x14: ffff800081567ea8 x13: ffffffffffffffff x12: 0000000000000000 [ 8.135070] x11: 00000000000000c0 x10: 0000000000000b60 x9 : ffff800080109e0c [ 8.135078] x8 : 1fffe0000069dbc1 x7 : 0000000000000001 x6 : ffff0000034ede00 [ 8.135086] x5 : 0000000000000000 x4 : ffff0000034ede08 x3 : 0000000000000001 [ 8.163460] x2 : 0000000000000000 x1 : 0000000000000001 x0 : 00000000000000ac [ 8.170560] Call trace: [ 8.180094] _raw_spin_lock_irq+0x40/0x80 (P) [ 8.184443] mcp23s08_irq+0x248/0x358 [ 8.184462] irq_thread_fn+0x34/0xb8 [ 8.184470] irq_thread+0x1a4/0x310 [ 8.195093] kthread+0x13c/0x150 [ 8.198309] ret_from_fork+0x10/0x20 [ 8.201850] Code: d65f03c0 d2800002 52800023 f9800011 (885ffc01) [ 8.207931] ---[ end trace 0000000000000000 ]--- This issue has always been present, but has been latent until commit "f9f4fda15e72" ("pinctrl: mcp23s08: init reg_defaults from HW at probe and switch cache type"), which correctly removed reg_defaults from the regmap and as a side effect changed the behavior of the interrupt handler so that the real value of the MCP_GPINTEN register is now being read from the chip instead of using a bogus 0 default value; a non-zero value for this register can trigger the invocation of a nested handler which may not exist (yet). Fix this issue by disabling all pin interrupts during initialization. Fixes: f9f4fda15e72 ("pinctrl: mcp23s08: init reg_defaults from HW at probe and switch cache type") Signed-off-by: Francesco Lavra Signed-off-by: Linus Walleij commit 426c355742f02cf743b347d9d7dbdc1bfbfa31ef Author: Zhengchuan Liang Date: Sun Mar 22 11:46:08 2026 -0700 net: af_key: zero aligned sockaddr tail in PF_KEY exports PF_KEY export paths use `pfkey_sockaddr_size()` when reserving sockaddr payload space, so IPv6 addresses occupy 32 bytes on the wire. However, `pfkey_sockaddr_fill()` initializes only the first 28 bytes of `struct sockaddr_in6`, leaving the final 4 aligned bytes uninitialized. Not every PF_KEY message is affected. The state and policy dump builders already zero the whole message buffer before filling the sockaddr payloads. Keep the fix to the export paths that still append aligned sockaddr payloads with plain `skb_put()`: - `SADB_ACQUIRE` - `SADB_X_NAT_T_NEW_MAPPING` - `SADB_X_MIGRATE` Fix those paths by clearing only the aligned sockaddr tail after `pfkey_sockaddr_fill()`. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 08de61beab8a ("[PFKEYV2]: Extension for dynamic update of endpoint address(es)") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Xiao Liu Signed-off-by: Zhengchuan Liang Signed-off-by: Steffen Klassert commit d10119968d0e1f2b669604baf2a8b5fdb72fa6b4 Author: Greg Kroah-Hartman Date: Mon Apr 6 17:34:22 2026 +0200 xfrm_user: fix info leak in build_report() struct xfrm_user_report is a __u8 proto field followed by a struct xfrm_selector which means there is three "empty" bytes of padding, but the padding is never zeroed before copying to userspace. Fix that up by zeroing the structure before setting individual member variables. Cc: stable Cc: Steffen Klassert Cc: Herbert Xu Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Steffen Klassert commit 1beb76b2053b68c491b78370794b8ff63c8f8c02 Author: Greg Kroah-Hartman Date: Mon Apr 6 17:33:03 2026 +0200 xfrm_user: fix info leak in build_mapping() struct xfrm_usersa_id has a one-byte padding hole after the proto field, which ends up never getting set to zero before copying out to userspace. Fix that up by zeroing out the whole structure before setting individual variables. Fixes: 3a2dfbe8acb1 ("xfrm: Notify changes in UDP encapsulation via netlink") Cc: Steffen Klassert Cc: Herbert Xu Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Steffen Klassert commit 83317cce60a032c49480dcdabe146435bd689d03 Author: Kotlyarov Mihail Date: Sat Apr 4 12:05:20 2026 +0300 xfrm: fix refcount leak in xfrm_migrate_policy_find syzkaller reported a memory leak in xfrm_policy_alloc: BUG: memory leak unreferenced object 0xffff888114d79000 (size 1024): comm "syz.1.17", pid 931 ... xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432 The root cause is a double call to xfrm_pol_hold_rcu() in xfrm_migrate_policy_find(). The lookup function already returns a policy with held reference, making the second call redundant. Remove the redundant xfrm_pol_hold_rcu() call to fix the refcount imbalance and prevent the memory leak. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 563d5ca93e88 ("xfrm: switch migrate to xfrm_policy_lookup_bytype") Signed-off-by: Kotlyarov Mihail Reviewed-by: Florian Westphal Signed-off-by: Steffen Klassert commit 1c428b03840094410c5fb6a5db30640486bbbfcb Author: Qi Tang Date: Thu Apr 2 19:44:01 2026 +0800 xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown. Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn. For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set. Suggested-by: Florian Westphal Fixes: acf568ee859f ("xfrm: Reinject transport-mode packets through tasklet") Cc: stable@vger.kernel.org Signed-off-by: Qi Tang Signed-off-by: Steffen Klassert commit 069daad4f2ae9c5c108131995529d5f02392c446 Author: Steffen Klassert Date: Thu Apr 2 13:31:04 2026 +0200 xfrm: Wait for RCU readers during policy netns exit xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait for concurrent RCU readers to leave their read-side critical sections first. The policy_bydst tables are published via rcu_assign_pointer() and are looked up through rcu_dereference_check(), so netns teardown must also wait for an RCU grace period before freeing the table memory. Fix this by adding synchronize_rcu() before freeing the policy hash tables. Fixes: e1e551bc5630 ("xfrm: policy: prepare policy_bydst hash for rcu lookups") Signed-off-by: Steffen Klassert Reviewed-by: Florian Westphal commit 75519f5df2a9b23f7bf305e12dc9a6e3e65c24b7 Author: Jouni Högander Date: Fri Mar 27 13:45:53 2026 +0200 drm/i915/psr: Do not use pipe_src as borders for SU area This far using crtc_state->pipe_src as borders for Selective Update area haven't caused visible problems as drm_rect_width(crtc_state->pipe_src) == crtc_state->hw.adjusted_mode.crtc_hdisplay and drm_rect_height(crtc_state->pipe_src) == crtc_state->hw.adjusted_mode.crtc_vdisplay when pipe scaling is not used. On the other hand using pipe scaling is forcing full frame updates and all the Selective Update area calculations are skipped. Now this improper usage of crtc_state->pipe_src is causing following warnings: <4> [7771.978166] xe 0000:00:02.0: [drm] drm_WARN_ON_ONCE(su_lines % vdsc_cfg->slice_height) after WARN_ON_ONCE was added by commit: "drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters" These warnings are seen when DSC and pipe scaling are enabled simultaneously. This is because on full frame update SU area is improperly set as pipe_src which is not aligned with DSC slice height. Fix these by creating local rectangle using crtc_state->hw.adjusted_mode.crtc_hdisplay and crtc_state->hw.adjusted_mode.crtc_vdisplay. Use this local rectangle as borders for SU area. Fixes: d6774b8c3c58 ("drm/i915: Ensure damage clip area is within pipe area") Cc: # v6.0+ Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://patch.msgid.link/20260327114553.195285-1-jouni.hogander@intel.com (cherry picked from commit da0cdc1c329dd2ff09c41fbbe9fbd9c92c5d2c6e) Signed-off-by: Joonas Lahtinen commit 105c42566a550e2d05fc14f763216a8765ee5d0e Author: Arthur Husband Date: Mon Apr 6 15:23:35 2026 -0700 ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 The JMicron JMB585 (and JMB582) SATA controllers advertise 64-bit DMA support via the S64A bit in the AHCI CAP register, but their 64-bit DMA implementation is defective. Under sustained I/O, DMA transfers targeting addresses above 4GB silently corrupt data -- writes land at incorrect memory addresses with no errors logged. The failure pattern is similar to the ASMedia ASM1061 (commit 20730e9b2778 ("ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers")), which also falsely advertised full 64-bit DMA support. However, the JMB585 requires a stricter 32-bit DMA mask rather than 43-bit, as corruption occurs with any address above 4GB. On the Minisforum N5 Pro specifically, the combination of the JMB585's broken 64-bit DMA with the AMD Family 1Ah (Strix Point) IOMMU causes silent data corruption that is only detectable via checksumming filesystems (BTRFS/ZFS scrub). The corruption occurs when 32-bit IOVA space is exhausted and the kernel transparently switches to 64-bit DMA addresses. Add device-specific PCI ID entries for the JMB582 (0x0582) and JMB585 (0x0585) before the generic JMicron class match, using a new board type that combines AHCI_HFLAG_IGN_IRQ_IF_ERR (preserving existing behavior) with AHCI_HFLAG_32BIT_ONLY to force 32-bit DMA masks. Signed-off-by: Arthur Husband Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 16bcbe6738bea7b4aee0a29324ce12c21c4b0ea0 Author: Zide Chen Date: Fri Mar 13 10:40:50 2026 -0700 perf/x86/intel/uncore: Remove extra double quote mark The third argument in INTEL_UNCORE_FR_EVENT_DESC() is subject to __stringify(), and the extra double quote marks can result in the expansion "3.814697266e-6" in the sysfs knobs, instead of 3.814697266e-6. This is incorrect, though it may still work for perf, e.g. perf stat -e uncore_iio_free_running_0/bw_in_port0/ Fixes: d8987048f665 ("perf/x86/intel/uncore: Support IIO free-running counters on DMR") Closes: https://lore.kernel.org/all/20251231224233.113839-1-zide.chen@intel.com/ Reported-by: Chun-Tse Shao Signed-off-by: Zide Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chun-Tse Shao Reviewed-by: Dapeng Mi Link: https://patch.msgid.link/20260313174050.171704-5-zide.chen@intel.com commit a16d1ec4dd0cdcf689f324adde6067083bce9099 Author: Zide Chen Date: Fri Mar 13 10:40:49 2026 -0700 perf/x86/intel/uncore: Fix die ID init and look up bugs In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path, uncore_device_to_die() may return -1 when all CPUs associated with the UBOX device are offline. Remove the WARN_ON_ONCE(die_id == -1) check for two reasons: - The current code breaks out of the loop. This is incorrect because pci_get_device() does not guarantee iteration in domain or bus order, so additional UBOX devices may be skipped during the scan. - Returning -EINVAL is incorrect, since marking offline buses with die_id == -1 is expected and should not be treated as an error. Separately, when NUMA is disabled on a NUMA-capable platform, pcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die() to return -1 for all PCI devices. As a result, spr_update_device_location(), used on Intel SPR and EMR, ignores the corresponding PMON units and does not add them to the RB tree. Fix this by using uncore_pcibus_to_dieid(), which retrieves topology from the UBOX GIDNIDMAP register and works regardless of whether NUMA is enabled in Linux. This requires snbep_pci2phy_map_init() to be added in spr_uncore_pci_init(). Keep uncore_device_to_die() only for the nr_node_ids > 8 case, where NUMA is expected to be enabled. Fixes: 9a7832ce3d92 ("perf/x86/intel/uncore: With > 8 nodes, get pci bus die id from NUMA info") Fixes: 65248a9a9ee1 ("perf/x86/uncore: Add a quirk for UPI on SPR") Signed-off-by: Zide Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Tested-by: Steve Wahl Link: https://patch.msgid.link/20260313174050.171704-4-zide.chen@intel.com commit 7b568e9eba2fad89a696f22f0413d44cf4a1f892 Author: Zide Chen Date: Fri Mar 13 10:40:48 2026 -0700 perf/x86/intel/uncore: Skip discovery table for offline dies This warning can be triggered if NUMA is disabled and the system boots with fewer CPUs than the number of CPUs in die 0. WARNING: CPU: 9 PID: 7257 at uncore.c:1157 uncore_pci_pmu_register+0x136/0x160 [intel_uncore] Currently, the discovery table continues to be parsed even if all CPUs in the associated die are offline. This can lead to an array overflow at "pmu->boxes[die] = box" in uncore_pci_pmu_register(), which may trigger the warning above or cause other issues. Fixes: edae1f06c2cd ("perf/x86/intel/uncore: Parse uncore discovery tables") Reported-by: Steve Wahl Signed-off-by: Zide Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Tested-by: Steve Wahl Link: https://patch.msgid.link/20260313174050.171704-3-zide.chen@intel.com commit e2a39d1a88f00ed83ebc7a19b7673d4ffd50b173 Author: Zide Chen Date: Fri Mar 13 10:40:47 2026 -0700 perf/x86/intel/uncore: Fix iounmap() leak on global_init failure Kernel test robot reported: Unverified Error/Warning (likely false positive, kindly check if interested): arch/x86/events/intel/uncore_discovery.c:293:2-8: ERROR: missing iounmap; ioremap on line 288 and execution via conditional on line 292 If domain->global_init() fails in __parse_discovery_table(), the ioremap'ed MMIO region is not released before returning, resulting in an MMIO mapping leak. Fixes: b575fc0e3357 ("perf/x86/intel/uncore: Add domain global init callback") Reported-by: kernel test robot Signed-off-by: Zide Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Link: https://patch.msgid.link/20260313174050.171704-2-zide.chen@intel.com commit 01c3ec507a33f30cf0992f86282d90ce9b7715c9 Merge: 7aaa8047eafd0b 1ca468e78ea97c Author: Linus Walleij Date: Tue Apr 7 08:52:53 2026 +0200 Merge tag 'intel-pinctrl-v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into fixes intel-pinctrl for v7.0-2 * Fix 1kOhm, debounce, and PWM capability support * Add support for new PAD_OWN layout Signed-off-by: Linus Walleij commit a9d4f4f6e65e0bf9bbddedecc84d67249991979c Author: Michael Guralnik Date: Fri Apr 3 12:17:56 2026 +0300 net/mlx5: Update the list of the PCI supported devices Add the upcoming ConnectX-10 NVLink-C2C device ID to the table of supported PCI device IDs. Cc: stable@vger.kernel.org Signed-off-by: Michael Guralnik Reviewed-by: Patrisious Haddad Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260403091756.139583-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 0f42e3f4fe2a58394e37241d02d9ca6ab7b7d516 Author: Jiayuan Chen Date: Fri Apr 3 09:45:12 2026 +0800 net: skb: fix cross-cache free of KFENCE-allocated skb head SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2 value (e.g. 704 on x86_64) to avoid collisions with generic kmalloc bucket sizes. This ensures that skb_kfree_head() can reliably use skb_end_offset to distinguish skb heads allocated from skb_small_head_cache vs. generic kmalloc caches. However, when KFENCE is enabled, kfence_ksize() returns the exact requested allocation size instead of the slab bucket size. If a caller (e.g. bpf_test_init) allocates skb head data via kzalloc() and the requested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then slab_build_skb() -> ksize() returns that exact value. After subtracting skb_shared_info overhead, skb_end_offset ends up matching SKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free the object to skb_small_head_cache instead of back to the original kmalloc cache, resulting in a slab cross-cache free: kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected skbuff_small_head but got kmalloc-1k Fix this by always calling kfree(head) in skb_kfree_head(). This keeps the free path generic and avoids allocator-specific misclassification for KFENCE objects. Fixes: bf9f1baa279f ("net: add dedicated kmem_cache for typical/small skb->head") Reported-by: Antonius Closes: https://lore.kernel.org/netdev/CAK8a0jxC5L5N7hq-DT2_NhUyjBxrPocoiDazzsBk4TGgT1r4-A@mail.gmail.com/ Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260403014517.142550-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 24ad7ff668896325591fa0b570f2cca6c55f136f Author: Stefano Garzarella Date: Fri Apr 3 11:32:51 2026 +0200 vsock/test: fix send_buf()/recv_buf() EINTR handling When send() or recv() returns -1 with errno == EINTR, the code skips the break but still adds the return value to nwritten/nread, making it decrease by 1. This leads to wrong buffer offsets and wrong bytes count. Fix it by explicitly continuing the loop on EINTR, so the return value is only added when it is positive. Fixes: a8ed71a27ef5 ("vsock/test: add recv_buf() utility function") Fixes: 12329bd51fdc ("vsock/test: add send_buf() utility function") Signed-off-by: Stefano Garzarella Reviewed-by: Luigi Leonardi Link: https://patch.msgid.link/20260403093251.30662-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit 270c0637b906d23b59cb119dabce350d44d2471b Merge: 1caa871bb0615e 62838e363e4f07 Author: Jakub Kicinski Date: Mon Apr 6 18:43:54 2026 -0700 Merge branch 'xsk-tailroom-reservation-and-mtu-validation' Maciej Fijalkowski says: ==================== xsk: tailroom reservation and MTU validation here we fix a long-standing issue regarding multi-buffer scenario in ZC mode - we have not been providing space at the end of the buffer where multi-buffer XDP works on skb_shared_info. This has been brought to our attention via [0]. Unaligned mode does not get any specific treatment, it is user's responsibility to properly handle XSK addresses in queues. With adjustments included here in this set against xskxceiver I have been able to pass the full test suite on ice. [0]: https://community.intel.com/t5/Ethernet-Products/X710-XDP-Packet-Corruption-Issue-DRV-MODE-Zero-Copy-Multi-Buffer/m-p/1724208 ==================== Link: https://patch.msgid.link/20260402154958.562179-1-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 62838e363e4f0753d43b2b78e9d3f6ad3c9102ec Author: Maciej Fijalkowski Date: Thu Apr 2 17:49:58 2026 +0200 selftests: bpf: adjust rx_dropped xskxceiver's test to respect tailroom Since we have changed how big user defined headroom in umem can be, change the logic in testapp_stats_rx_dropped() so we pass updated headroom validation in xdp_umem_reg() and still drop half of frames. Test works on non-mbuf setup so __xsk_pool_get_rx_frame_size() that is called on xsk_rcv_check() will not account skb_shared_info size. Taking the tailroom size into account in test being fixed is needed as xdp_umem_reg() defaults to respect it. Reviewed-by: Björn Töpel Signed-off-by: Maciej Fijalkowski Link: https://patch.msgid.link/20260402154958.562179-9-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 16546954e117e65661109e788682891b15d4e3ce Author: Maciej Fijalkowski Date: Thu Apr 2 17:49:57 2026 +0200 selftests: bpf: have a separate variable for drop test Currently two different XDP programs share a static variable for different purposes (picking where to redirect on shared umem test & whether to drop a packet). This can be a problem when running full test suite - idx can be written by shared umem test and this value can cause a false behavior within XDP drop half test. Introduce a dedicated variable for drop half test so that these two don't step on each other toes. There is no real need for using __sync_fetch_and_add here as XSK tests are executed on single CPU. Reviewed-by: Björn Töpel Signed-off-by: Maciej Fijalkowski Link: https://patch.msgid.link/20260402154958.562179-8-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 3197c51ce2fa00410f86f4829e4f9223553632f6 Author: Maciej Fijalkowski Date: Thu Apr 2 17:49:56 2026 +0200 selftests: bpf: fix pkt grow tests Skip tail adjust tests in xskxceiver for SKB mode as it is not very friendly for it. multi-buffer case does not work as xdp_rxq_info that is registered for generic XDP does not report ::frag_size. The non-mbuf path copies packet via skb_pp_cow_data() which only accounts for headroom, leaving us with no tailroom and causing underlying XDP prog to drop packets therefore. For multi-buffer test on other modes, change the amount of bytes we use for growth, assume worst-case scenario and take care of headroom and tailroom. Reviewed-by: Björn Töpel Signed-off-by: Maciej Fijalkowski Link: https://patch.msgid.link/20260402154958.562179-7-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit c5866a6be47207b05c6eead6292c8551c8a91669 Author: Maciej Fijalkowski Date: Thu Apr 2 17:49:55 2026 +0200 selftests: bpf: introduce a common routine for reading procfs Parametrize current way of getting MAX_SKB_FRAGS value from {sys,proc}fs so that it can be re-used to get cache line size of system's CPU. All that just to mimic and compute size of kernel's struct skb_shared_info which for xsk and test suite interpret as tailroom. Introduce two variables to ifobject struct that will carry count of skb frags and tailroom size. Do the reading and computing once, at the beginning of test suite execution in xskxceiver, but for test_progs such way is not possible as in this environment each test setups and torns down ifobject structs. Reviewed-by: Björn Töpel Signed-off-by: Maciej Fijalkowski Link: https://patch.msgid.link/20260402154958.562179-6-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 36ee60b569ba0dfb6f961333b90d19ab5b323fa9 Author: Maciej Fijalkowski Date: Thu Apr 2 17:49:54 2026 +0200 xsk: validate MTU against usable frame size on bind AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk. This becomes a problem since we started to respect tailroom which is subtracted from chunk_size (among with headroom). 2k chunk size might not provide enough space for standard 1500 MTU, so let us catch such settings at bind time. Furthermore, validate whether underlying HW will be able to satisfy configured MTU wrt XSK's frame size multiplied by supported Rx buffer chain length (that is exposed via net_device::xdp_zc_max_segs). Fixes: 24ea50127ecf ("xsk: support mbuf on ZC RX") Reviewed-by: Björn Töpel Signed-off-by: Maciej Fijalkowski Link: https://patch.msgid.link/20260402154958.562179-5-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 93e84fe45b752d17a5a46b306ed78f0133bbc719 Author: Maciej Fijalkowski Date: Thu Apr 2 17:49:53 2026 +0200 xsk: fix XDP_UMEM_SG_FLAG issues Currently xp_assign_dev_shared() is missing XDP_USE_SG being propagated to flags so set it in order to preserve mtu check that is supposed to be done only when no multi-buffer setup is in picture. Also, this flag has the same value as XDP_UMEM_TX_SW_CSUM so we could get unexpected SG setups for software Tx checksums. Since csum flag is UAPI, modify value of XDP_UMEM_SG_FLAG. Fixes: d609f3d228a8 ("xsk: add multi-buffer support for sockets sharing umem") Reviewed-by: Björn Töpel Signed-off-by: Maciej Fijalkowski Link: https://patch.msgid.link/20260402154958.562179-4-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 1ee1605138fc94cc8f8f273321dd2471c64977f9 Author: Maciej Fijalkowski Date: Thu Apr 2 17:49:52 2026 +0200 xsk: respect tailroom for ZC setups Multi-buffer XDP stores information about frags in skb_shared_info that sits at the tailroom of a packet. The storage space is reserved via xdp_data_hard_end(): ((xdp)->data_hard_start + (xdp)->frame_sz - \ SKB_DATA_ALIGN(sizeof(struct skb_shared_info))) and then we refer to it via macro below: static inline struct skb_shared_info * xdp_get_shared_info_from_buff(const struct xdp_buff *xdp) { return (struct skb_shared_info *)xdp_data_hard_end(xdp); } Currently we do not respect this tailroom space in multi-buffer AF_XDP ZC scenario. To address this, introduce xsk_pool_get_tailroom() and use it within xsk_pool_get_rx_frame_size() which is used in ZC drivers to configure length of HW Rx buffer. Typically drivers on Rx Hw buffers side work on 128 byte alignment so let us align the value returned by xsk_pool_get_rx_frame_size() in order to avoid addressing this on driver's side. This addresses the fact that idpf uses mentioned function *before* pool->dev being set so we were at risk that after subtracting tailroom we would not provide 128-byte aligned value to HW. Since xsk_pool_get_rx_frame_size() is actively used in xsk_rcv_check() and __xsk_rcv(), add a variant of this routine that will not include 128 byte alignment and therefore old behavior is preserved. Reviewed-by: Björn Töpel Acked-by: Stanislav Fomichev Fixes: 24ea50127ecf ("xsk: support mbuf on ZC RX") Signed-off-by: Maciej Fijalkowski Link: https://patch.msgid.link/20260402154958.562179-3-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit a315e022a72d95ef5f1d4e58e903cb492b0ad931 Author: Maciej Fijalkowski Date: Thu Apr 2 17:49:51 2026 +0200 xsk: tighten UMEM headroom validation to account for tailroom and min frame The current headroom validation in xdp_umem_reg() could leave us with insufficient space dedicated to even receive minimum-sized ethernet frame. Furthermore if multi-buffer would come to play then skb_shared_info stored at the end of XSK frame would be corrupted. HW typically works with 128-aligned sizes so let us provide this value as bare minimum. Multi-buffer setting is known later in the configuration process so besides accounting for 128 bytes, let us also take care of tailroom space upfront. Reviewed-by: Björn Töpel Acked-by: Stanislav Fomichev Fixes: 99e3a236dd43 ("xsk: Add missing check on user supplied headroom size") Signed-off-by: Maciej Fijalkowski Link: https://patch.msgid.link/20260402154958.562179-2-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit d3baa34a470771399c1495bc04b1e26ac15d598e Author: Agalakov Daniil Date: Wed Mar 18 15:05:05 2026 +0300 e1000: check return value of e1000_read_eeprom [Why] e1000_set_eeprom() performs a read-modify-write operation when the write range is not word-aligned. This requires reading the first and last words of the range from the EEPROM to preserve the unmodified bytes. However, the code does not check the return value of e1000_read_eeprom(). If the read fails, the operation continues using uninitialized data from eeprom_buff. This results in corrupted data being written back to the EEPROM for the boundary words. Add the missing error checks and abort the operation if reading fails. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Iskhakov Daniil Signed-off-by: Iskhakov Daniil Signed-off-by: Agalakov Daniil Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit b1e067240379f950a0022208e0685f3465c211cb Author: Alex Dvoretsky Date: Thu Mar 12 14:52:55 2026 +0100 igb: remove napi_synchronize() in igb_down() When an AF_XDP zero-copy application terminates abruptly (e.g., kill -9), the XSK buffer pool is destroyed but NAPI polling continues. igb_clean_rx_irq_zc() repeatedly returns the full budget, preventing napi_complete_done() from clearing NAPI_STATE_SCHED. igb_down() calls napi_synchronize() before napi_disable() for each queue vector. napi_synchronize() spins waiting for NAPI_STATE_SCHED to clear, which never happens. igb_down() blocks indefinitely, the TX watchdog fires, and the TX queue remains permanently stalled. napi_disable() already handles this correctly: it sets NAPI_STATE_DISABLE. After a full-budget poll, __napi_poll() checks napi_disable_pending(). If set, it forces completion and clears NAPI_STATE_SCHED, breaking the loop that napi_synchronize() cannot. napi_synchronize() was added in commit 41f149a285da ("igb: Fix possible panic caused by Rx traffic arrival while interface is down"). napi_disable() provides stronger guarantees: it prevents further scheduling and waits for any active poll to exit. Other Intel drivers (ixgbe, ice, i40e) use napi_disable() without a preceding napi_synchronize() in their down paths. Remove redundant napi_synchronize() call and reorder napi_disable() before igb_set_queue_napi() so the queue-to-NAPI mapping is only cleared after polling has fully stopped. Fixes: 2c6196013f84 ("igb: Add AF_XDP zero-copy Rx support") Cc: stable@vger.kernel.org Suggested-by: Maciej Fijalkowski Reviewed-by: Aleksandr Loktionov Signed-off-by: Alex Dvoretsky Reviewed-by: Maciej Fijalkowski Tested-by: Patryk Holda Signed-off-by: Tony Nguyen commit 4821d563cd7f251ae728be1a6d04af82a294a5b9 Author: Michal Schmidt Date: Fri Mar 13 09:22:29 2026 +0100 ixgbevf: add missing negotiate_features op to Hyper-V ops table Commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by negotiating supported features") added the .negotiate_features callback to ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but forgot to add it to ixgbevf_hv_mac_ops. This leaves the function pointer NULL on Hyper-V VMs. During probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(), which unconditionally dereferences hw->mac.ops.negotiate_features(). On Hyper-V this results in a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...] Workqueue: events work_for_cpu_fn RIP: 0010:0x0 [...] Call Trace: ixgbevf_negotiate_api+0x66/0x160 [ixgbevf] ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf] ixgbevf_probe+0x20f/0x4a0 [ixgbevf] local_pci_probe+0x50/0xa0 work_for_cpu_fn+0x1a/0x30 [...] Add ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and wire it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPP gracefully. Fixes: a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by negotiating supported features") Reported-by: Xiaoqiang Xiong Closes: https://issues.redhat.com/browse/RHEL-155455 Assisted-by: Claude:claude-4.6-opus-high Cursor Tested-by: Xiaoqiang Xiong Signed-off-by: Michal Schmidt Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit d8ae40dc20cbd7bb6e6b36a928e2db2296060ad2 Author: Aleksandr Loktionov Date: Wed Mar 4 09:42:32 2026 +0100 ixgbe: stop re-reading flash on every get_drvinfo for e610 ixgbe_get_drvinfo() calls ixgbe_refresh_fw_version() on every ethtool query for e610 adapters. That ends up in ixgbe_discover_flash_size(), which bisects the full 16 MB NVM space issuing one ACI command per step (~20 ms each, ~24 steps total = ~500 ms). Profiling on an idle E610-XAT2 system with telegraf scraping ethtool stats every 10 seconds: kretprobe:ixgbe_get_drvinfo took 527603 us kretprobe:ixgbe_get_drvinfo took 523978 us kretprobe:ixgbe_get_drvinfo took 552975 us kretprobe:ice_get_drvinfo took 3 us kretprobe:igb_get_drvinfo took 2 us kretprobe:i40e_get_drvinfo took 5 us The half-second stall happens under the RTNL lock, causing visible latency on ip-link and friends. The FW version can only change after an EMPR reset. All flash data is already populated at probe time and the cached adapter->eeprom_id is what get_drvinfo should be returning. The only place that needs to trigger a re-read is ixgbe_devlink_reload_empr_finish(), right after the EMPR completes and new firmware is running. Additionally, refresh the FW version in ixgbe_reinit_locked() so that any PF that undergoes a reinit after an EMPR (e.g. triggered by another PF's devlink reload) also picks up the new version in adapter->eeprom_id. ixgbe_devlink_info_get() keeps its refresh call for explicit "devlink dev info" queries, which is fine given those are user-initiated. Fixes: c9e563cae19e ("ixgbe: add support for devlink reload") Co-developed-by: Jedrzej Jagielski Signed-off-by: Jedrzej Jagielski Signed-off-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit bf6dbadb72b997721e9b67348652926c076878d1 Author: Petr Oros Date: Fri Mar 27 08:46:58 2026 +0100 ice: fix PTP timestamping broken by SyncE code on E825C The E825C SyncE support added in commit ad1df4f2d591 ("ice: dpll: Support E825-C SyncE and dynamic pin discovery") introduced a SyncE reconfiguration block in ice_ptp_link_change() that prevents ice_ptp_port_phy_restart() from being called in several error paths. Without the PHY restart, PTP timestamps stop working after any link change event. There are three ways the PHY restart gets blocked: 1. When DPLL initialization fails (e.g. missing ACPI firmware node properties), ICE_FLAG_DPLL is not set and the function returns early before reaching the PHY restart. 2. When ice_tspll_bypass_mux_active_e825c() fails to read the CGU register, WARN_ON_ONCE fires and the function returns early. 3. When ice_tspll_cfg_synce_ethdiv_e825c() fails to configure the clock divider for an active pin, same early return. SyncE and PTP are independent features. SyncE reconfiguration failures must not prevent the PTP PHY restart that is essential for timestamp recovery after link changes. Fix by making the entire SyncE block conditional on ICE_FLAG_DPLL without an early return, and replacing the WARN_ON_ONCE + return error handling inside the loop with dev_err_once + break. The function always proceeds to ice_ptp_port_phy_restart() regardless of SyncE errors. Fixes: ad1df4f2d591 ("ice: dpll: Support E825-C SyncE and dynamic pin discovery") Signed-off-by: Petr Oros Reviewed-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit bb3f21edc7056cdf44a7f7bd7ba65af40741838c Author: Kohei Enju Date: Sun Feb 1 14:14:00 2026 +0000 ice: ptp: don't WARN when controlling PF is unavailable In VFIO passthrough setups, it is possible to pass through only a PF which doesn't own the source timer. In that case the PTP controlling PF (adapter->ctrl_pf) is never initialized in the VM, so ice_get_ctrl_ptp() returns NULL and triggers WARN_ON() in ice_ptp_setup_pf(). Since this is an expected behavior in that configuration, replace WARN_ON() with an informational message and return -EOPNOTSUPP. Fixes: e800654e85b5 ("ice: Use ice_adapter for PTP shared data instead of auxdev") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 8e2a2420e267a515f6db56a6e9570b5cacd92919 Author: Emil Tantilov Date: Thu Mar 19 14:13:35 2026 -0700 idpf: set the payload size before calling the async handler Set the payload size before forwarding the reply to the async handler. Without this, xn->reply_sz will be 0 and idpf_mac_filter_async_handler() will never get past the size check. Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager") Cc: stable@vger.kernel.org Signed-off-by: Emil Tantilov Reviewed-by: Aleksandr Loktionov Reviewed-by: Li Li Acked-by: Sebastian Andrzej Siewior Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit d086fae65006368618104ba4c57779440eab2217 Author: Emil Tantilov Date: Thu Mar 19 14:13:34 2026 -0700 idpf: improve locking around idpf_vc_xn_push_free() Protect the set_bit() operation for the free_xn bitmask in idpf_vc_xn_push_free(), to make the locking consistent with rest of the code and avoid potential races in that logic. Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager") Cc: stable@vger.kernel.org Reported-by: Ray Zhang Signed-off-by: Emil Tantilov Reviewed-by: Aleksandr Loktionov Acked-by: Sebastian Andrzej Siewior Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 591478118293c1bd628de330a99eb1eb2ef8d76b Author: Emil Tantilov Date: Thu Mar 19 14:13:33 2026 -0700 idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling Switch from using the completion's raw spinlock to a local lock in the idpf_vc_xn struct. The conversion is safe because complete/_all() are called outside the lock and there is no reason to share the completion lock in the current logic. This avoids invalid wait context reported by the kernel due to the async handler taking BH spinlock: [ 805.726977] ============================= [ 805.726991] [ BUG: Invalid wait context ] [ 805.727006] 7.0.0-rc2-net-devq-031026+ #28 Tainted: G S OE [ 805.727026] ----------------------------- [ 805.727038] kworker/u261:0/572 is trying to lock: [ 805.727051] ff190da6a8dbb6a0 (&vport_config->mac_filter_list_lock){+...}-{3:3}, at: idpf_mac_filter_async_handler+0xe9/0x260 [idpf] [ 805.727099] other info that might help us debug this: [ 805.727111] context-{5:5} [ 805.727119] 3 locks held by kworker/u261:0/572: [ 805.727132] #0: ff190da6db3e6148 ((wq_completion)idpf-0000:83:00.0-mbx){+.+.}-{0:0}, at: process_one_work+0x4b5/0x730 [ 805.727163] #1: ff3c6f0a6131fe50 ((work_completion)(&(&adapter->mbx_task)->work)){+.+.}-{0:0}, at: process_one_work+0x1e5/0x730 [ 805.727191] #2: ff190da765190020 (&x->wait#34){+.+.}-{2:2}, at: idpf_recv_mb_msg+0xc8/0x710 [idpf] [ 805.727218] stack backtrace: ... [ 805.727238] Workqueue: idpf-0000:83:00.0-mbx idpf_mbx_task [idpf] [ 805.727247] Call Trace: [ 805.727249] [ 805.727251] dump_stack_lvl+0x77/0xb0 [ 805.727259] __lock_acquire+0xb3b/0x2290 [ 805.727268] ? __irq_work_queue_local+0x59/0x130 [ 805.727275] lock_acquire+0xc6/0x2f0 [ 805.727277] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf] [ 805.727284] ? _printk+0x5b/0x80 [ 805.727290] _raw_spin_lock_bh+0x38/0x50 [ 805.727298] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf] [ 805.727303] idpf_mac_filter_async_handler+0xe9/0x260 [idpf] [ 805.727310] idpf_recv_mb_msg+0x1c8/0x710 [idpf] [ 805.727317] process_one_work+0x226/0x730 [ 805.727322] worker_thread+0x19e/0x340 [ 805.727325] ? __pfx_worker_thread+0x10/0x10 [ 805.727328] kthread+0xf4/0x130 [ 805.727333] ? __pfx_kthread+0x10/0x10 [ 805.727336] ret_from_fork+0x32c/0x410 [ 805.727345] ? __pfx_kthread+0x10/0x10 [ 805.727347] ret_from_fork_asm+0x1a/0x30 [ 805.727354] Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager") Cc: stable@vger.kernel.org Suggested-by: Sebastian Andrzej Siewior Reported-by: Ray Zhang Signed-off-by: Emil Tantilov Reviewed-by: Aleksandr Loktionov Acked-by: Sebastian Andrzej Siewior Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 7bc5da4842bed3252d26e742213741a4d0ac1b14 Author: Joseph Qi Date: Fri Apr 3 14:38:30 2026 +0800 ocfs2: fix out-of-bounds write in ocfs2_write_end_inline KASAN reports a use-after-free write of 4086 bytes in ocfs2_write_end_inline, called from ocfs2_write_end_nolock during a copy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on a loop device. The actual bug is an out-of-bounds write past the inode block buffer, not a true use-after-free. The write overflows into an adjacent freed page, which KASAN reports as UAF. The root cause is that ocfs2_try_to_write_inline_data trusts the on-disk id_count field to determine whether a write fits in inline data. On a corrupted filesystem, id_count can exceed the physical maximum inline data capacity, causing writes to overflow the inode block buffer. Call trace (crash path): vfs_copy_file_range (fs/read_write.c:1634) do_splice_direct splice_direct_to_actor iter_file_splice_write ocfs2_file_write_iter generic_perform_write ocfs2_write_end ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949) ocfs2_write_end_inline (fs/ocfs2/aops.c:1915) memcpy_from_folio <-- KASAN: write OOB So add id_count upper bound check in ocfs2_validate_inode_block() to alongside the existing i_size check to fix it. Link: https://lkml.kernel.org/r/20260403063830.3662739-1-joseph.qi@linux.alibaba.com Signed-off-by: Joseph Qi Reported-by: syzbot+62c1793956716ea8b28a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=62c1793956716ea8b28a Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Cc: Signed-off-by: Andrew Morton commit 4c04c6b47c361612b1d70cec8f7a60b1482d1400 Author: SeongJae Park Date: Thu Apr 2 06:44:17 2026 -0700 mm/damon/stat: deallocate damon_call() failure leaking damon_ctx damon_stat_start() always allocates the module's damon_ctx object (damon_stat_context). Meanwhile, if damon_call() in the function fails, the damon_ctx object is not deallocated. Hence, if the damon_call() is failed, and the user writes Y to “enabled” again, the previously allocated damon_ctx object is leaked. This cannot simply be fixed by deallocating the damon_ctx object when damon_call() fails. That's because damon_call() failure doesn't guarantee the kdamond main function, which accesses the damon_ctx object, is completely finished. In other words, if damon_stat_start() deallocates the damon_ctx object after damon_call() failure, the not-yet-terminated kdamond could access the freed memory (use-after-free). Fix the leak while avoiding the use-after-free by keeping returning damon_stat_start() without deallocating the damon_ctx object after damon_call() failure, but deallocating it when the function is invoked again and the kdamond is completely terminated. If the kdamond is not yet terminated, simply return -EAGAIN, as the kdamond will soon be terminated. The issue was discovered [1] by sashiko. Link: https://lkml.kernel.org/r/20260402134418.74121-1-sj@kernel.org Link: https://lore.kernel.org/20260401012428.86694-1-sj@kernel.org [1] Fixes: 405f61996d9d ("mm/damon/stat: use damon_call() repeat mode instead of damon_callback") Signed-off-by: SeongJae Park Cc: # 6.17.x Signed-off-by: Andrew Morton commit 894f99eb535edc4514f756818f3c4f688ba53a59 Author: Sechang Lim Date: Tue Mar 31 18:08:11 2026 +0000 mm/vma: fix memory leak in __mmap_region() commit 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare swaps the file") handled the success path by skipping get_file() via file_doesnt_need_get, but missed the error path. When /dev/zero is mmap'd with MAP_SHARED, mmap_zero_prepare() calls shmem_zero_setup_desc() which allocates a new shmem file to back the mapping. If __mmap_new_vma() subsequently fails, this replacement file is never fput()'d - the original is released by ksys_mmap_pgoff(), but nobody releases the new one. Add fput() for the swapped file in the error path. Reproducible with fault injection. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0x164/0x1f0 should_fail_ex+0x525/0x650 should_failslab+0xdf/0x140 kmem_cache_alloc_noprof+0x78/0x630 vm_area_alloc+0x24/0x160 __mmap_region+0xf6b/0x2660 mmap_region+0x2eb/0x3a0 do_mmap+0xc79/0x1240 vm_mmap_pgoff+0x252/0x4c0 ksys_mmap_pgoff+0xf8/0x120 __x64_sys_mmap+0x12a/0x190 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x76/0x7e kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) BUG: memory leak unreferenced object 0xffff8881118aca80 (size 360): comm "syz.7.14", pid 366, jiffies 4294913255 hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff .........(M..... backtrace (crc db0f53bc): kmem_cache_alloc_noprof+0x3ab/0x630 alloc_empty_file+0x5a/0x1e0 alloc_file_pseudo+0x135/0x220 __shmem_file_setup+0x274/0x420 shmem_zero_setup_desc+0x9c/0x170 mmap_zero_prepare+0x123/0x140 __mmap_region+0xdda/0x2660 mmap_region+0x2eb/0x3a0 do_mmap+0xc79/0x1240 vm_mmap_pgoff+0x252/0x4c0 ksys_mmap_pgoff+0xf8/0x120 __x64_sys_mmap+0x12a/0x190 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x76/0x7e Found by syzkaller. Link: https://lkml.kernel.org/r/20260331180811.1333348-1-rhkrqnwk98@gmail.com Fixes: 605f6586ecf7 ("mm/vma: do not leak memory when .mmap_prepare swaps the file") Signed-off-by: Sechang Lim Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Vlastimil Babka (SUSE) Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Pedro Falcato Cc: Signed-off-by: Andrew Morton commit 2ecbe06abf9bfb2261cd6464a6bc3a3615625402 Author: Hao Li Date: Mon Mar 30 11:57:49 2026 +0800 mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug N_NORMAL_MEMORY is initialized from zone population at boot, but memory hotplug currently only updates N_MEMORY. As a result, a node that gains normal memory via hotplug can remain invisible to users iterating over N_NORMAL_MEMORY, while a node that loses its last normal memory can stay incorrectly marked as such. The most visible effect is that /sys/devices/system/node/has_normal_memory does not report a node even after that node has gained normal memory via hotplug. Also, list_lru-based shrinkers can undercount objects on such a node and may skip reclaim on that node entirely, which can lead to a higher memory footprint than expected. Restore N_NORMAL_MEMORY maintenance directly in online_pages() and offline_pages(). Set the bit when a node that currently lacks normal memory onlines pages into a zone <= ZONE_NORMAL, and clear it when offlining removes the last present pages from zones <= ZONE_NORMAL. This restores the intended semantics without bringing back the old status_change_nid_normal notifier plumbing which was removed in 8d2882a8edb8. Current users that benefit include list_lru, zswap, nfsd filecache, hugetlb_cgroup, and has_normal_memory sysfs reporting. Link: https://lkml.kernel.org/r/20260330035941.518186-1-hao.li@linux.dev Fixes: 8d2882a8edb8 ("mm,memory_hotplug: remove status_change_nid_normal and update documentation") Signed-off-by: Hao Li Reviewed-by: Harry Yoo (Oracle) Acked-by: Vlastimil Babka (SUSE) Reviewed-by: Joshua Hahn Acked-by: David Hildenbrand (Arm) Cc: Oscar Salvador Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 0199390a6b92fc21860e1b858abf525c7e73b956 Author: SeongJae Park Date: Thu Mar 26 17:32:22 2026 -0700 mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails damon_call() for repeat_call_control of DAMON_SYSFS could fail if somehow the kdamond is stopped before the damon_call(). It could happen, for example, when te damon context was made for monitroing of a virtual address processes, and the process is terminated immediately, before the damon_call() invocation. In the case, the dyanmically allocated repeat_call_control is not deallocated and leaked. Fix the leak by deallocating the repeat_call_control under the damon_call() failure. This issue is discovered by sashiko [1]. Link: https://lkml.kernel.org/r/20260327003224.55752-1-sj@kernel.org Link: https://lore.kernel.org/20260320020630.962-1-sj@kernel.org [1] Fixes: 04a06b139ec0 ("mm/damon/sysfs: use dynamically allocated repeat mode damon_call_control") Signed-off-by: SeongJae Park Cc: [6.17+] Signed-off-by: Andrew Morton commit cece9dc61daab6006d3ac9d36a0df2dd58fef18d Author: Joanne Koong Date: Thu Mar 26 14:51:27 2026 -0700 mm: reinstate unconditional writeback start in balance_dirty_pages() Commit 64dd89ae01f2 ("mm/block/fs: remove laptop_mode") removed this unconditional writeback start from balance_dirty_pages(): if (unlikely(!writeback_in_progress(wb))) wb_start_background_writeback(wb); This logic needs to be reinstated to prevent performance regressions for strictlimited BDIs and memcg setups. The problem occurs because: a) For strictlimited BDIs, throttling is calculated using per-wb thresholds. The per-wb threshold can be exceeded even when the global dirty threshold was not exceeded (nr_dirty < gdtc->bg_thresh) b) For memcg-based throttling, memcg uses its own dirty count / thresholds and can trigger throttling even when the global threshold isn't exceeded Without the unconditional writeback start, IO is throttled as it waits for dirty pages to be written back but there is no writeback running. This leads to severe stalls. On fuse, buffered write performance dropped from 1400 MiB/s to 2000 KiB/s. Reinstate the unconditional writeback start so that writeback is guaranteed to be running whenever IO needs to be throttled. Link: https://lkml.kernel.org/r/20260326215127.3857682-2-joannelkoong@gmail.com Fixes: 64dd89ae01f2 ("mm/block/fs: remove laptop_mode") Signed-off-by: Joanne Koong Reviewed-by: Christoph Hellwig Reviewed-by: Jan Kara Acked-by: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit 307e0c5859b0aecc34180468b1aa76684adcf539 Author: Leo Timmins Date: Wed Mar 25 12:46:07 2026 +0800 liveupdate: propagate file deserialization failures luo_session_deserialize() ignored the return value from luo_file_deserialize(). As a result, a session could be left partially restored even though the /dev/liveupdate open path treats deserialization failures as fatal. Propagate the error so a failed file deserialization aborts session deserialization instead of silently continuing. Link: https://lkml.kernel.org/r/20260325044608.8407-1-leotimmins1974@gmail.com Link: https://lkml.kernel.org/r/20260325044608.8407-2-leotimmins1974@gmail.com Fixes: 16cec0d26521 ("liveupdate: luo_session: add ioctls for file preservation") Signed-off-by: Leo Timmins Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Cc: Mike Rapoport Cc: Signed-off-by: Andrew Morton commit f58df566524ebcdfa394329c64f47e3c9257516e Author: Baolin Wang Date: Tue Mar 17 17:29:55 2026 +0800 mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state": " [ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb [ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb [ 734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff) [ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000 [ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000 [ 734.496442] page dumped because: nonzero mapcount " After analyzing this page’s state, it is hard to understand why the mapcount is not 0 while the refcount is 0, since this page is not where the issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can reproduce the crash as well and captured the first warning where the issue appears: " [ 734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0 [ 734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 734.469315] memcg:ffff000807a8ec00 [ 734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):"stress-ng-mmaptorture-9397-0-2736200540" [ 734.469335] flags: 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff) ...... [ 734.469364] page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1), const struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *: (struct folio *)_compound_head(page + nr_pages - 1))) != folio) [ 734.469390] ------------[ cut here ]------------ [ 734.469393] WARNING: ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468, CPU#90: stress-ng-mlock/9430 [ 734.469551] folio_add_file_rmap_ptes+0x3b8/0x468 (P) [ 734.469555] set_pte_range+0xd8/0x2f8 [ 734.469566] filemap_map_folio_range+0x190/0x400 [ 734.469579] filemap_map_pages+0x348/0x638 [ 734.469583] do_fault_around+0x140/0x198 ...... [ 734.469640] el0t_64_sync+0x184/0x188 " The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size. By adding more debug information, I found that 'nr_pages' had overflowed in filemap_map_pages(), causing set_pte_range() to establish mappings for a range exceeding the folio size, potentially corrupting fields of pages that do not belong to this folio (e.g., page->_mapcount). After above analysis, I think the possible race is as follows: CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio() ....... //shrink the inode->i_size i_size_write(inode, attr->ia_size); //calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end); ...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1; ...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size); To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid 'nr_pages' calculation overflow. After this patch, the crash issue is gone. Link: https://lkml.kernel.org/r/1cf1ac59018fc647a87b0dad605d4056a71c14e4.1773739704.git.baolin.wang@linux.alibaba.com Fixes: 743a2753a02e ("filemap: cap PTE range to be created to allowed zero fill in folio_map_range()") Signed-off-by: Baolin Wang Reported-by: Yuanhe Shu Tested-by: Yuanhe Shu Acked-by: Kiryl Shutsemau (Meta) Acked-by: David Hildenbrand (Arm) Cc: Christian Brauner Cc: Daniel Gomez Cc: "Darrick J. Wong" Cc: Dave Chinner Cc: David Howells Cc: Hannes Reinecke Cc: Lorenzo Stoakes (Oracle) Cc: Luis Chamberalin Cc: Matthew Wilcox (Oracle) Cc: Pankaj Raghav Cc: Signed-off-by: Andrew Morton commit bfe62a454542cfad3379f6ef5680b125f41e20f4 Merge: 591cd656a1bf5e eaad992e3fa808 Author: Linus Torvalds Date: Mon Apr 6 09:03:19 2026 -0700 Merge tag 'soc-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The largest part here are devicetree fixes for Qualcomm, and NXP i.MX, addressing a few regressions and incorrect settings in board and SoC pecific dts files. The largest single commits are a revert of a cleanup patch for i.MX that caused regressions for the NAND flash controller and a fixup for an incomplete cleanup of the PCIe controller on Qualcomm platforms that broke because the state was left incompatible with both the old and new behavior. On the Rockchips, Hisilicon, Renesas, Allwinner and AT91 platforms, only a single simple dts bugfix each was added since the last round of fixes. On the SoC specific device drivers, everything is relatively harmless: three reset controller driver fixes, a compatibility for fix ASpeed soc ID, and error handling fixes for Qualcomm and Microchip. One regression fix on Qualcomm addresses a problem with a previous fix for DisplayPort alt mode" * tag 'soc-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (32 commits) arm64: dts: qcom: hamoa: Fix incomplete Root Port property migration dt-bindings: display/msm: qcm2290-mdss: Fix missing ranges in example firmware: microchip: fail auto-update probe if no flash found arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM arm64: dts: qcom: agatti: Fix IOMMU DT properties dt-bindings: media: venus: Fix iommus property dt-bindings: display: msm: qcm2290-mdss: Fix iommus property arm64: dts: allwinner: sun55i: Fix r-spi DMA reset: spacemit: k3: Decouple composite reset lines reset: gpio: fix double free in reset_add_gpio_aux_device() error path ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity reset: rzg2l-usbphy-ctrl: Fix malformed MODULE_AUTHOR string soc: microchip: mpfs-mss-top-sysreg: Fix resource leak on driver unbind soc: microchip: mpfs-control-scb: Fix resource leak on driver unbind soc: qcom: pmic_glink_altmode: Fix TBT->SAFE->!TBT transition arm64: dts: qcom: monaco: Reserve full Gunyah metadata region arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" ... commit 82d8701b2c930d0e96b0dbc9115a218d791cb0d2 Author: Haoze Xie Date: Mon Apr 6 21:17:28 2026 +0800 batman-adv: hold claim backbone gateways by reference batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer. The netlink claim dump path dereferences claim->backbone_gw->orig and takes claim->backbone_gw->crc_lock without pinning the underlying backbone gateway. batadv_bla_check_claim() still has the same naked pointer access pattern. Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate on a stable gateway reference until the read-side work is complete. This keeps the dump and claim-check paths aligned with the lifetime rules introduced for the other BLA claim readers. Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code") Fixes: 04f3f5bf1883 ("batman-adv: add B.A.T.M.A.N. Dump BLA claims via netlink") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Haoze Xie Signed-off-by: Ao Zhou Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit b33b340e22abaac0cba50f5efadf96ee65913e9d Merge: 4e53116437e919 1de6ddcddc954a Author: Mark Brown Date: Mon Apr 6 13:23:33 2026 +0100 ASoC: SOF: Intel: Fixes for find_acpi_adr_device() when some endpoints are missing Bard Liao says: To make sure find_acpi_adr_device can work well when some of the endpoints are missing and do not map 1:1 to codec_info_list. commit 1de6ddcddc954a69f96b1c23205e03ddd603e3c8 Author: Maciej Strozek Date: Thu Apr 2 14:45:31 2026 +0800 ASoC: SOF: Intel: fix iteration in is_endpoint_present() is_endpoint_present() iterates over sdca_data.num_functions, but checks the dai_type according to codec info list, which will cause problems if not all endpoints from the codec info list are present. Make sure the type of actually present functions is compared against target dai_type. Fixes: 5226d19d4cae ("ASoC: SOF: Intel: use sof_sdw as default SDW machine driver") Signed-off-by: Maciej Strozek Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260402064531.2287261-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 86facd80a2a37536937f06de637abf9e8cabdb4b Author: Maciej Strozek Date: Thu Apr 2 14:45:30 2026 +0800 ASoC: SOF: Intel: Fix endpoint index if endpoints are missing In case of missing endpoints, the sequential numbering will cause wrong mapping. Instead, assign the original DAI index from codec_info_list. Fixes: 5226d19d4cae ("ASoC: SOF: Intel: use sof_sdw as default SDW machine driver") Signed-off-by: Maciej Strozek Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260402064531.2287261-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9 Author: Charles Keepax Date: Mon Mar 16 14:14:49 2026 +0000 ASoC: SDCA: Fix errors in IRQ cleanup IRQs are enabled through sdca_irq_populate() from component probe using devm_request_threaded_irq(), this however means the IRQs can persist if the sound card is torn down. Some of the IRQ handlers store references to the card and the kcontrols which can then fail. Some detail of the crash was explained in [1]. Generally it is not advised to use devm outside of bus probe, so the code is updated to not use devm. The IRQ requests are not moved to bus probe time as it makes passing the snd_soc_component into the IRQs very awkward and would the require a second step once the component is available, so it is simpler to just register the IRQs at this point, even though that necessitates some manual cleanup. Link: https://lore.kernel.org/linux-sound/20260310183829.2907805-1-gaggery.tsai@intel.com/ [1] Fixes: b126394d9ec6 ("ASoC: SDCA: Generic interrupt support") Reported-by: Gaggery Tsai Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260316141449.2950215-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 80a7916ca2d902b329a40e529c4c4131ae6ff273 Author: Mark Pearson Date: Thu Apr 2 21:03:25 2026 -0400 ASoC: amd: acp: add Lenovo P16s G5 AMD quirk for legacy SDW machine Add a DMI quirk entry for Lenovo P16s G5 AMD to use ASOC_SDW_ACP_DMIC. Needed to allow the microphone to work on this platform Signed-off-by: Mark Pearson Reviewed-by: Vijendar Mukunda Link: https://patch.msgid.link/20260403010336.1223078-1-mpearson-lenovo@squebb.ca Signed-off-by: Mark Brown commit 5075d08e72af38b829fb71800c2a5be61d0b2e2c Author: Marek Vasut Date: Mon Apr 6 01:44:35 2026 +0200 ASoC: dt-bindings: ti,tas2552: Add sound-dai-cells Add missing sound-sai-cells for this codec into schema. At the same time, drop trailing spaces from description. Fixes: 506e0825a4c9 ("ASoC: dt-bindings: Convert ti,tas2552 to DT schema") Signed-off-by: Marek Vasut Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260405234502.154227-1-marex@nabladev.com Signed-off-by: Mark Brown commit f0541edb2e7333f320642c7b491a67912c1f65db Author: songxiebing Date: Sun Apr 5 09:26:51 2026 +0800 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 The bass speakers are not working, and add the following entry in /etc/modprobe.d/snd.conf: options snd-sof-intel-hda-generic hda_model=alc287-yoga9-bass-spk-pin Fixes the bass speakers. So add the quick ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN here. Reported-by: Fernando Garcia Corona Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221317 Signed-off-by: songxiebing Link: https://patch.msgid.link/20260405012651.133838-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai commit 4346be6577aaa04586167402ae87bbdbe32484a4 Author: Pengpeng Hou Date: Thu Apr 2 00:03:15 2026 +0800 tracing/probe: reject non-closed empty immediate strings parse_probe_arg() accepts quoted immediate strings and passes the body after the opening quote to __parse_imm_string(). That helper currently computes strlen(str) and immediately dereferences str[len - 1], which underflows when the body is empty and not closed with double-quotation. Reject empty non-closed immediate strings before checking for the closing quote. Link: https://lore.kernel.org/all/20260401160315.88518-1-pengpeng@iscas.ac.cn/ Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support") Signed-off-by: Pengpeng Hou Reviewed-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit 591cd656a1bf5ea94a222af5ef2ee76df029c1d2 Author: Linus Torvalds Date: Sun Apr 5 15:26:23 2026 -0700 Linux 7.0-rc7 commit 85fb6da43ac58dc7d1a6242e7b2102fd1d4954bc Merge: 10b76a429a8716 9156585280f161 Author: Linus Torvalds Date: Sun Apr 5 14:43:47 2026 -0700 Merge tag 'riscv-for-linus-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Fix a CONFIG_SPARSEMEM crash on RV32 by avoiding early phys_to_page() - Prevent runtime const infrastructure from being used by modules, similar to what was done for x86 - Avoid problems when shutting down ACPI systems with IOMMUs by adding a device dependency between IOMMU and devices that use it - Fix a bug where the CPU pointer masking state isn't properly reset when tagged addresses aren't enabled for a task - Fix some incorrect register assignments, and add some missing ones, in kgdb support code - Fix compilation of non-kernel code that uses the ptrace uapi header by replacing BIT() with _BITUL() - Fix compilation of the validate_v_ptrace kselftest by working around kselftest macro expansion issues * tag 'riscv-for-linus-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: ACPI: RIMT: Add dependency between iommu and devices selftests: riscv: Add braces around EXPECT_EQ() riscv: use _BITUL macro rather than BIT() in ptrace uapi and kselftests riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set riscv: make runtime const not usable by modules riscv: patch: Avoid early phys_to_page() riscv: kgdb: fix several debug register assignment bugs commit 10b76a429a8716545cd6dcaf4578594e74dcd21b Merge: 2ab99ad7faef1f b981e9e94c687b Author: Linus Torvalds Date: Sun Apr 5 13:53:07 2026 -0700 Merge tag 'x86-urgent-2026-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix kexec crash on KCOV-instrumented kernels (Aleksandr Nogikh) - Fix Geode platform driver on-stack property data use-after-return bug (Dmitry Torokhov) * tag 'x86-urgent-2026-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/platform/geode: Fix on-stack property data use-after-return bug x86/kexec: Disable KCOV instrumentation after load_segments() commit 2ab99ad7faef1f0a4529e8bae92009fa56242bd4 Merge: 7bba6c86225cc3 e08d007f9d8136 Author: Linus Torvalds Date: Sun Apr 5 13:45:37 2026 -0700 Merge tag 'sched-urgent-2026-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix zero_vruntime tracking again (Peter Zijlstra) - Fix avg_vruntime() usage in sched_debug (Peter Zijlstra) * tag 'sched-urgent-2026-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/debug: Fix avg_vruntime() usage sched/fair: Fix zero_vruntime tracking fix commit 7bba6c86225cc3fb54876b50ee74773538079e2c Merge: 1391af03649278 dbde07f0622643 Author: Linus Torvalds Date: Sun Apr 5 13:43:26 2026 -0700 Merge tag 'perf-urgent-2026-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Ingo Molnar: - Fix potential bad container_of() in intel_pmu_hw_config() (Ian Rogers) * tag 'perf-urgent-2026-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86: Fix potential bad container_of in intel_pmu_hw_config commit 1391af03649278921a3b62cec4497fa23a587229 Merge: 5401b9adebc9e5 af416cd9b3fb9d Author: Linus Torvalds Date: Sun Apr 5 13:40:58 2026 -0700 Merge tag 'irq-urgent-2026-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Ingo Molnar: - Fix RISC-V APLIC irqchip driver setup errors on ACPI systems (Jessica Liu) * tag 'irq-urgent-2026-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/riscv-aplic: Restrict genpd notifier to device tree only commit 5401b9adebc9e5f68df58226f51493ef0e6ceb4d Author: Linus Torvalds Date: Sun Apr 5 12:42:25 2026 -0700 i915: don't use a vma that didn't match the context VM In eb_lookup_vma(), the code checks that the context vm matches before incrementing the i915 vma usage count, but for the non-matching case it didn't clear the non-matching vma pointer, so it would then mistakenly be returned, causing potential UaF and refcount issues. Reported-by: Yassine Mounir Suggested-by: Ville Syrjälä Signed-off-by: Linus Torvalds commit eb3765aa711ff93664cd5ffcf0c2df02da2d9c26 Merge: 1791c390149f56 01cc50ea5167bb Author: Linus Torvalds Date: Sun Apr 5 11:29:07 2026 -0700 Merge tag 'mips-fixes_7.0_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - Fix TLB uniquification for systems with TLB not initialised by firmware - Fix allocation in TLB uniquification - Fix SiByte cache initialisation - Check uart parameters from firmware on Loongson64 systems - Fix clock id mismatch for Ralink SoCs - Fix GCC version check for __mutli3 workaround * tag 'mips-fixes_7.0_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: mips: mm: Allocate tlb_vpn array atomically MIPS: mm: Rewrite TLB uniquification for the hidden bit feature MIPS: mm: Suppress TLB uniquification on EHINV hardware MIPS: Always record SEGBITS in cpu_data.vmbits MIPS: Fix the GCC version check for `__multi3' workaround MIPS: SiByte: Bring back cache initialisation mips: ralink: update CPU clock index MIPS: Loongson64: env: Check UARTs passed by LEFI cautiously commit 1791c390149f56313c425e8add1fd15baf40afb8 Merge: 7a60c79bd0547a f387e2e2b9d302 Author: Linus Torvalds Date: Sun Apr 5 10:09:33 2026 -0700 Merge tag 'char-misc-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/iio driver fixes from Greg KH: "Here are a relativly large number of small char/misc/iio and other driver fixes for 7.0-rc7. There's a bunch, but overall they are all small fixes for issues that people have been having that I finally caught up with getting merged due to delays on my end. The "largest" change overall is just some documentation updates to the security-bugs.rst file to hopefully tell the AI tools (and any users that actually read the documentation), how to send us better security bug reports as the quantity of reports these past few weeks has increased dramatically due to tools getting better at "finding" things. Included in here are: - lots of small IIO driver fixes for issues reported in 7.0-rc - gpib driver fixes - comedi driver fixes - interconnect driver fix - nvmem driver fixes - mei driver fix - counter driver fix - binder rust driver fixes - some other small misc driver fixes All of these have been in linux-next this week with no reported issues" * tag 'char-misc-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (63 commits) Documentation: fix two typos in latest update to the security report howto Documentation: clarify the mandatory and desirable info for security reports Documentation: explain how to find maintainers addresses for security reports Documentation: minor updates to the security contacts .get_maintainer.ignore: add myself nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy nvmem: imx: assign nvmem_cell_info::raw_len misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe misc: fastrpc: possible double-free of cctx->remote_heap comedi: dt2815: add hardware detection to prevent crash comedi: runflags cannot determine whether to reclaim chanlist comedi: Reinit dev->spinlock between attachments to low-level drivers comedi: me_daq: Fix potential overrun of firmware buffer comedi: me4000: Fix potential overrun of firmware buffer comedi: ni_atmio16d: Fix invalid clean-up after failed attach gpib: fix use-after-free in IO ioctl handlers gpib: lpvo_usb: fix memory leak on disconnect gpib: Fix fluke driver s390 compile issue lis3lv02d: Omit IRQF_ONESHOT if no threaded handler is provided lis3lv02d: fix kernel-doc warnings ... commit 7a60c79bd0547adba3cefde40ced4a1f376305be Merge: aea7c84f28f111 3ddbea7542ae52 Author: Linus Torvalds Date: Sun Apr 5 10:04:28 2026 -0700 Merge tag 'tty-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty fixes from Greg KH: "Here are two small tty vt fixes for 7.0-rc7 to resolve some reported issues with the resize ability of the alt screen buffer. Both of these have been in linux-next all week with no reported issues" * tag 'tty-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: vt: resize saved unicode buffer on alt screen exit after resize vt: discard stale unicode buffer on alt screen exit after resize commit aea7c84f28f1117653f7443806905d7aeef13ba8 Merge: 3aae9383f42f68 bf3781a35c2797 Author: Linus Torvalds Date: Sun Apr 5 10:00:26 2026 -0700 Merge tag 'usb-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt fixes from Greg KH: "Here are a bunch of USB and Thunderbolt fixes (most all are USB) for 7.0-rc7. More than I normally like this late in the release cycle, partly due to my recent travels, and partly due to people banging away on the USB gadget interfaces and apis more than normal (big shoutout to Android for getting the vendors to actually work upstream on this, that's a huge win overall for everyone here) Included in here are: - Small thunderbolt fix - new USB serial driver ids added - typec driver fixes - gadget driver fixes for some disconnect issues - other usb gadget driver fixes for reported problems with binding and unbinding devices as happens when a gadget device connects / disconnects from a system it is plugged into (or it switches device mode at a user's request, these things are complex little beasts...) - usb offload fixes (where USB audio tunnels through the controller while the main CPU is asleep) for when EMP spikes hit the system causing disconnects to happen (as often happens with static electricity in the winter months). This has been much reported by at least one vendor, and resolves the issues they have been seeing with this codepath. Can't wait for the "formal methods are the answer!" people to try to model that one properly... - Other small usb driver fixes for issues reported. All of these have been in linux-next this week, and before, with no reported issues, and I've personally been stressing these harder than normal on my systems here with no problems" * tag 'usb-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (39 commits) usb: gadget: f_hid: move list and spinlock inits from bind to alloc usb: host: xhci-sideband: delegate offload_usage tracking to class drivers usb: core: use dedicated spinlock for offload state usb: cdns3: gadget: fix state inconsistency on gadget init failure usb: dwc3: imx8mp: fix memory leak on probe failure path usb: gadget: f_uac1_legacy: validate control request size usb: ulpi: fix double free in ulpi_register_interface() error path usb: misc: usbio: Fix URB memory leak on submit failure USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam usb: cdns3: gadget: fix NULL pointer dereference in ep_queue usb: core: phy: avoid double use of 'usb3-phy' USB: serial: option: add MeiG Smart SRM825WN usb: gadget: f_rndis: Fix net_device lifecycle with device_move usb: gadget: f_subset: Fix net_device lifecycle with device_move usb: gadget: f_eem: Fix net_device lifecycle with device_move usb: gadget: f_ecm: Fix net_device lifecycle with device_move usb: gadget: u_ncm: Add kernel-doc comments for struct f_ncm_opts usb: gadget: f_rndis: Protect RNDIS options with mutex usb: gadget: f_subset: Fix unbalanced refcnt in geth_free dt-bindings: connector: add pd-disable dependency ... commit 51520e03e70d6c73e33ee7cbe0319767d05764fe Author: Borislav Petkov (AMD) Date: Tue Mar 31 14:16:23 2026 +0200 EDAC/mc: Fix error path ordering in edac_mc_alloc() When the mci->pvt_info allocation in edac_mc_alloc() fails, the error path will call put_device() which will end up calling the device's release function. However, the init ordering is wrong such that device_initialize() happens *after* the failed allocation and thus the device itself and the release function pointer are not initialized yet when they're called: MCE: In-kernel MCE decoding enabled. ------------[ cut here ]------------ kobject: '(null)': is not initialized, yet kobject_put() is being called. WARNING: lib/kobject.c:734 at kobject_put, CPU#22: systemd-udevd CPU: 22 UID: 0 PID: 538 Comm: systemd-udevd Not tainted 7.0.0-rc1+ #2 PREEMPT(full) RIP: 0010:kobject_put Call Trace: edac_mc_alloc+0xbe/0xe0 [edac_core] amd64_edac_init+0x7a4/0xff0 [amd64_edac] ? __pfx_amd64_edac_init+0x10/0x10 [amd64_edac] do_one_initcall ... Reorder the calling sequence so that the device is initialized and thus the release function pointer is properly set before it can be used. This was found by Claude while reviewing another EDAC patch. Fixes: 0bbb265f7089 ("EDAC/mc: Get rid of silly one-shot struct allocation in edac_mc_alloc()") Reported-by: Claude Code:claude-opus-4.5 Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Cc: stable@kernel.org Link: https://patch.msgid.link/20260331121623.4871-1-bp@kernel.org commit 0422b07bc4c296b736e240d95d21fbfebbfaa2ca Author: Yazen Ghannam Date: Sat Feb 28 09:08:14 2026 -0500 x86/mce/amd: Filter bogus hardware errors on Zen3 clients Users have been observing multiple L3 cache deferred errors after recent kernel rework of deferred error handling.¹ ⁴ The errors are bogus due to inconsistent status values. Also, user verified that bogus MCA_DESTAT values are present on the system even with an older kernel.² The errors seem to be garbage values present in the MCA_DESTAT of some L3 cache banks. These were implicitly ignored before the recent kernel rework because these do not generate a deferred error interrupt. A later revision of the rework patch was merged for v6.19. This naturally filtered out most of the bogus error logs. However, a few signatures still remain.³ Minimize the scope of the filter to the reported CPU family/model/stepping and only for errors which don't have the Enabled bit in the MCi status MSR. ¹ https://lore.kernel.org/20250915010010.3547-1-spasswolf@web.de ² https://lore.kernel.org/6e1eda7dd55f6fa30405edf7b0f75695cf55b237.camel@web.de ³ https://lore.kernel.org/21ba47fa8893b33b94370c2a42e5084cf0d2e975.camel@web.de ⁴ https://lore.kernel.org/r/CAKFB093B2k3sKsGJ_QNX1jVQsaXVFyy=wNwpzCGLOXa_vSDwXw@mail.gmail.com [ bp: Generalize the condition according to which errors are bogus. ] Fixes: 7cb735d7c0cb ("x86/mce: Unify AMD DFR handler with MCA Polling") Closes: https://lore.kernel.org/20250915010010.3547-1-spasswolf@web.de Reported-by: Bert Karwatzki Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Mario Limonciello Tested-By: Bert Karwatzki Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250915010010.3547-1-spasswolf@web.de commit 08ee1559052be302f1d3752f48360b89517d9f8d Author: Paul Walmsley Date: Sat Apr 4 18:40:58 2026 -0600 prctl: cfi: change the branch landing pad prctl()s to be more descriptive Per Linus' comments requesting the replacement of "INDIR_BR_LP" in the indirect branch tracking prctl()s with something more readable, and suggesting the use of the speculation control prctl()s as an exemplar, reimplement the prctl()s and related constants that control per-task forward-edge control flow integrity. This primarily involves two changes. First, the prctls are restructured to resemble the style of the speculative execution workaround control prctls PR_{GET,SET}_SPECULATION_CTRL, to make them easier to extend in the future. Second, the "indir_br_lp" abbrevation is expanded to "branch_landing_pads" to be less telegraphic. The kselftest and documentation is adjusted accordingly. Link: https://lore.kernel.org/linux-riscv/CAHk-=whhSLGZAx3N5jJpb4GLFDqH_QvS07D+6BnkPWmCEzTAgw@mail.gmail.com/ Cc: Deepak Gupta Cc: Linus Torvalds Cc: Mark Brown Signed-off-by: Paul Walmsley commit e5342fe2c1bb5b4fab6ed531a0122c6417e57ecf Author: Paul Walmsley Date: Sat Apr 4 18:40:58 2026 -0600 riscv: ptrace: cfi: expand "SS" references to "shadow stack" in uapi headers Similar to the recent change to expand "LP" to "branch landing pad", let's expand "SS" in the ptrace uapi macros to "shadow stack" as well. This aligns with the existing prctl() arguments, which use the expanded "shadow stack" names, rather than just the abbreviation. Link: https://lore.kernel.org/linux-riscv/CAHk-=whhSLGZAx3N5jJpb4GLFDqH_QvS07D+6BnkPWmCEzTAgw@mail.gmail.com/ Cc: Deepak Gupta Signed-off-by: Paul Walmsley commit adfc80dd0d7831335b5105fb3d8747094bf42878 Author: Paul Walmsley Date: Sat Apr 4 18:40:58 2026 -0600 prctl: rename branch landing pad implementation functions to be more explicit Per Linus' comments about the unreadability of abbreviations such as "indir_br_lp", rename the three prctl() implementation functions to be more explicit. This involves renaming "indir_br_lp_status" in the function names to "branch_landing_pad_state". While here, add _prctl_ into the function names, following the speculation control prctl implementation functions. Link: https://lore.kernel.org/linux-riscv/CAHk-=whhSLGZAx3N5jJpb4GLFDqH_QvS07D+6BnkPWmCEzTAgw@mail.gmail.com/ Cc: Deepak Gupta Cc: Linus Torvalds Cc: Mark Brown Signed-off-by: Paul Walmsley commit ac4e61c730d778f8d8b8455da052952dbf8e0317 Author: Paul Walmsley Date: Sat Apr 4 18:40:58 2026 -0600 riscv: ptrace: expand "LP" references to "branch landing pads" in uapi headers Per Linus' comments about the unreadability of abbreviations such as "LP", rename the RISC-V ptrace landing pad CFI macro names to be more explicit. This primarily involves expanding "LP" in the names to some variant of "branch landing pad." Link: https://lore.kernel.org/linux-riscv/CAHk-=whhSLGZAx3N5jJpb4GLFDqH_QvS07D+6BnkPWmCEzTAgw@mail.gmail.com/ Cc: Deepak Gupta Signed-off-by: Paul Walmsley commit a6ede084c4b7cd6ecd0d31d5292336e556901bd7 Author: Zong Li Date: Sat Apr 4 18:40:58 2026 -0600 riscv: cfi: clear CFI lock status in start_thread() When libc locks the CFI status through the following prctl: - PR_LOCK_SHADOW_STACK_STATUS - PR_LOCK_INDIR_BR_LP_STATUS A newly execd address space will inherit the lock status if it does not clear the lock bits. Since the lock bits remain set, libc will later fail to enable the landing pad and shadow stack. Signed-off-by: Zong Li Link: https://patch.msgid.link/20260323065640.4045713-1-zong.li@sifive.com [pjw@kernel.org: ensure we unlock before changing state; cleaned up subject line] Signed-off-by: Paul Walmsley commit a621d9cdc8d08bd2fe8dfe6fa6897d256de8248f Author: Paul Walmsley Date: Sat Apr 4 18:40:57 2026 -0600 riscv: ptrace: cfi: fix "PRACE" typo in uapi header A CFI-related macro defined in arch/riscv/uapi/asm/ptrace.h misspells "PTRACE" as "PRACE"; fix this. Fixes: 2af7c9cf021c ("riscv/ptrace: expose riscv CFI status and state via ptrace and in core files") Cc: Deepak Gupta Signed-off-by: Paul Walmsley commit 9156585280f161fc1c3552cf1860559edb2bb7e3 Author: Sunil V L Date: Tue Mar 3 11:46:05 2026 +0530 ACPI: RIMT: Add dependency between iommu and devices EPROBE_DEFER ensures IOMMU devices are probed before the devices that depend on them. During shutdown, however, the IOMMU may be removed first, leading to issues. To avoid this, a device link is added which enforces the correct removal order. Fixes: 8f7729552582 ("ACPI: RISC-V: Add support for RIMT") Signed-off-by: Sunil V L Link: https://patch.msgid.link/20260303061605.722949-1-sunilvl@oss.qualcomm.com Signed-off-by: Paul Walmsley commit 511361fe7a8856e2f415010942808c237a1b8061 Author: Charlie Jenkins Date: Mon Mar 9 18:52:11 2026 -0700 selftests: riscv: Add braces around EXPECT_EQ() EXPECT_EQ() expands to multiple lines, breaking up one-line if statements. This issue was not present in the patch on the mailing list but was instead introduced by the maintainer when attempting to fix up checkpatch warnings. Add braces around EXPECT_EQ() to avoid the error even though checkpatch suggests them to be removed: validate_v_ptrace.c:626:17: error: ‘else’ without a previous ‘if’ Fixes: 3789d5eecd5a ("selftests: riscv: verify syscalls discard vector context") Fixes: 30eb191c895b ("selftests: riscv: verify ptrace rejects invalid vector csr inputs") Fixes: 849f05ae1ea6 ("selftests: riscv: verify ptrace accepts valid vector csr values") Signed-off-by: Charlie Jenkins Reviewed-and-tested-by: Sergey Matyukevich Link: https://patch.msgid.link/20260309-fix_selftests-v2-2-9d5a553a531e@gmail.com Signed-off-by: Paul Walmsley commit 87ad7cc9aa7f0a202189640c5015aa985e7e8f3b Author: Paul Walmsley Date: Thu Apr 2 17:18:03 2026 -0600 riscv: use _BITUL macro rather than BIT() in ptrace uapi and kselftests Fix the build of non-kernel code that includes the RISC-V ptrace uapi header, and the RISC-V validate_v_ptrace.c kselftest, by using the _BITUL() macro rather than BIT(). BIT() is not available outside the kernel. Based on patches and comments from Charlie Jenkins, Michael Neuling, and Andreas Schwab. Fixes: 30eb191c895b ("selftests: riscv: verify ptrace rejects invalid vector csr inputs") Fixes: 2af7c9cf021c ("riscv/ptrace: expose riscv CFI status and state via ptrace and in core files") Cc: Andreas Schwab Cc: Michael Neuling Cc: Charlie Jenkins Link: https://patch.msgid.link/20260330024248.449292-1-mikey@neuling.org Link: https://lore.kernel.org/linux-riscv/20260309-fix_selftests-v2-1-9d5a553a531e@gmail.com/ Link: https://lore.kernel.org/linux-riscv/20260309-fix_selftests-v2-3-9d5a553a531e@gmail.com/ Signed-off-by: Paul Walmsley commit 3033b2b1e3949274f33a140e2a97571b5a307298 Author: Zishun Yi Date: Mon Mar 23 00:00:22 2026 +0800 riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set In set_tagged_addr_ctrl(), when PR_TAGGED_ADDR_ENABLE is not set, pmlen is correctly set to 0, but it forgets to reset pmm. This results in the CPU pmm state not corresponding to the software pmlen state. Fix this by resetting pmm along with pmlen. Fixes: 2e1743085887 ("riscv: Add support for the tagged address ABI") Signed-off-by: Zishun Yi Reviewed-by: Samuel Holland Link: https://patch.msgid.link/20260322160022.21908-1-vulab@iscas.ac.cn Signed-off-by: Paul Walmsley commit 57f0253bc1538446ee46a4550fe85d91235fb678 Author: Jisheng Zhang Date: Sat Feb 21 10:37:31 2026 +0800 riscv: make runtime const not usable by modules Similar as commit 284922f4c563 ("x86: uaccess: don't use runtime-const rewriting in modules") does, make riscv's runtime const not usable by modules too, to "make sure this doesn't get forgotten the next time somebody wants to do runtime constant optimizations". The reason is well explained in the above commit: "The runtime-const infrastructure was never designed to handle the modular case, because the constant fixup is only done at boot time for core kernel code." Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20260221023731.3476-1-jszhang@kernel.org Signed-off-by: Paul Walmsley commit 6b60a128c2f43180664a614830f3c529497e0394 Author: Vivian Wang Date: Mon Mar 23 17:43:47 2026 -0600 riscv: patch: Avoid early phys_to_page() Similarly to commit 8d09e2d569f6 ("arm64: patching: avoid early page_to_phys()"), avoid using phys_to_page() for the kernel address case in patch_map(). Since this is called from apply_boot_alternatives() in setup_arch(), and commit 4267739cabb8 ("arch, mm: consolidate initialization of SPARSE memory model") has moved sparse_init() to after setup_arch(), phys_to_page() is not available there yet, and it panics on boot with SPARSEMEM on RV32, which does not use SPARSEMEM_VMEMMAP. Reported-by: Thomas Weißschuh Closes: https://lore.kernel.org/r/20260223144108-dcace0b9-02e8-4b67-a7ce-f263bed36f26@linutronix.de/ Fixes: 4267739cabb8 ("arch, mm: consolidate initialization of SPARSE memory model") Suggested-by: Mike Rapoport Signed-off-by: Vivian Wang Acked-by: Mike Rapoport (Microsoft) Tested-by: Thomas Weißschuh Link: https://patch.msgid.link/20260310-riscv-sparsemem-alternatives-fix-v1-1-659d5dd257e2@iscas.ac.cn [pjw@kernel.org: fix the subject line to align with the patch description] Signed-off-by: Paul Walmsley commit 834911eb8eef2501485d819b4eabebadc25c3497 Author: Paul Walmsley Date: Mon Mar 23 17:43:47 2026 -0600 riscv: kgdb: fix several debug register assignment bugs Fix several bugs in the RISC-V kgdb implementation: - The element of dbg_reg_def[] that is supposed to pertain to the S1 register embeds instead the struct pt_regs offset of the A1 register. Fix this to use the S1 register offset in struct pt_regs. - The sleeping_thread_to_gdb_regs() function copies the value of the S10 register into the gdb_regs[] array element meant for the S9 register, and copies the value of the S11 register into the array element meant for the S10 register. It also neglects to copy the value of the S11 register. Fix all of these issues. Fixes: fe89bd2be8667 ("riscv: Add KGDB support") Cc: Vincent Chen Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org Signed-off-by: Paul Walmsley commit 3aae9383f42f687221c011d7ee87529398e826b3 Merge: 7ca6d1cfec80eb 0d9363a764d9d6 Author: Linus Torvalds Date: Sat Apr 4 08:24:32 2026 -0700 Merge tag 'input-for-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - new IDs for BETOP BTP-KP50B/C and Razer Wolverine V3 Pro added to xpad controller driver - another quirk for new TUXEDO InfinityBook added to i8042 - a small fixup for Synaptics RMI4 driver to properly unlock mutex when encountering an error in F54 - an update to bcm5974 touch controller driver to reliably switch into wellspring mode * tag 'input-for-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Input: xpad - add support for Razer Wolverine V3 Pro Input: synaptics-rmi4 - fix a locking bug in an error path Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Input: bcm5974 - recover from failed mode switch commit eaad992e3fa8086db47f2cf05498af518ca5edda Merge: b986e98ccd0d09 907150bbe566e2 Author: Krzysztof Kozlowski Date: Sat Apr 4 17:22:39 2026 +0200 Merge tag 'at91-fixes-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes Microchip AT91 fixes for v7.0 This update includes: - fix gpio-lines for SAM9X7 PIOB GPIO controller * tag 'at91-fixes-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB Signed-off-by: Krzysztof Kozlowski commit 0637a3086b4fc4165460b21c12b845be6be71be7 Merge: 7aaa8047eafd0b 39ed7d89b97332 Author: Wolfram Sang Date: Sat Apr 4 12:02:20 2026 +0200 Merge tag 'i2c-host-fixes-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-fixes for v7.0-rc7 imx: set dma_slave_config to 0 and avoid uninitialized fields commit f387e2e2b9d302688dbdceebe9aade221c90f09e Author: Willy Tarreau Date: Sat Apr 4 10:20:33 2026 +0200 Documentation: fix two typos in latest update to the security report howto In previous patch "Documentation: clarify the mandatory and desirable info for security reports" I left two typos that I didn't detect in local checks. One is "get_maintainers.pl" (no 's' in the script name), and the other one is a missing closing quote after "Reported-by", which didn't have effect here but I don't know if it can break rendering elsewhere (e.g. on the public HTML page). Better fix it before it gets merged. Signed-off-by: Willy Tarreau Link: https://patch.msgid.link/20260404082033.5160-1-w@1wt.eu Signed-off-by: Greg Kroah-Hartman commit 0d9363a764d9d601a05591f9695cea8b429e9be3 Author: Shengyu Qu Date: Fri Apr 3 22:07:28 2026 -0700 Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode BETOP's BTP-KP50B and BTP-KP50C controller's wireless dongles are both working as standard Xbox 360 controllers. Add USB device IDs for them to xpad driver. Signed-off-by: Shengyu Qu Link: https://patch.msgid.link/TY4PR01MB14432B4B298EA186E5F86C46B9855A@TY4PR01MB14432.jpnprd01.prod.outlook.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit e2b0ae529db4766584e77647cefe3ec15c3d842e Author: Zoltan Illes Date: Fri Apr 3 22:03:42 2026 -0700 Input: xpad - add support for Razer Wolverine V3 Pro Add device IDs for the Razer Wolverine V3 Pro controller in both wired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes. The controller uses the Xbox 360 protocol (vendor-specific class, subclass 93, protocol 1) on interface 0 with an identical 20-byte input report layout, so no additional processing is needed. Signed-off-by: Zoltan Illes Link: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 16cbec24897624051b324aa3a85859c38ca65fde Author: Stanislav Kinsburskii Date: Tue Mar 24 23:57:40 2026 +0000 mshv: Fix infinite fault loop on permission-denied GPA intercepts Prevent infinite fault loops when guests access memory regions without proper permissions. Currently, mshv_handle_gpa_intercept() attempts to remap pages for all faults on movable memory regions, regardless of whether the access type is permitted. When a guest writes to a read-only region, the remap succeeds but the region remains read-only, causing immediate re-fault and spinning the vCPU indefinitely. Validate intercept access type against region permissions before attempting remaps. Reject writes to non-writable regions and executes to non-executable regions early, returning false to let the VMM handle the intercept appropriately. This also closes a potential DoS vector where malicious guests could intentionally trigger these fault loops to consume host resources. Fixes: b9a66cd5ccbb ("mshv: Add support for movable memory regions") Signed-off-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit b6422dff0e518245019233432b6bccfc30b73e2f Author: Sahil Chandna Date: Fri Apr 3 05:09:29 2026 -0700 PCI: hv: Fix double ida_free in hv_pci_probe error path If hv_pci_probe() fails after storing the domain number in hbus->bridge->domain_nr, there is a call to free this domain_nr via pci_bus_release_emul_domain_nr(), however, during cleanup, the bridge release callback pci_release_host_bridge_dev() also frees the domain_nr causing ida_free to be called on same ID twice and triggering following warning: ida_free called for id=28971 which is not allocated. WARNING: lib/idr.c:594 at ida_free+0xdf/0x160, CPU#0: kworker/0:2/198 Call Trace: pci_bus_release_emul_domain_nr+0x17/0x20 pci_release_host_bridge_dev+0x4b/0x60 device_release+0x3b/0xa0 kobject_put+0x8e/0x220 devm_pci_alloc_host_bridge_release+0xe/0x20 devres_release_all+0x9a/0xd0 device_unbind_cleanup+0x12/0xa0 really_probe+0x1c5/0x3f0 vmbus_add_channel_work+0x135/0x1a0 Fix this by letting pci core handle the free domain_nr and remove the explicit free called in pci-hyperv driver. Fixes: bcce8c74f1ce ("PCI: Enable host bridge emulation for PCI_DOMAINS_GENERIC platforms") Signed-off-by: Sahil Chandna Reviewed-by: Manivannan Sadhasivam Reviewed-by: Saurabh Sengar Signed-off-by: Wei Liu commit 7ca6d1cfec80ebe46cc063f3284c5896c344d9a1 Merge: 3719114091cea0 328335a79487ec Author: Linus Torvalds Date: Fri Apr 3 20:08:25 2026 -0700 Merge tag 'powerpc-7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Madhavan Srinivasan: - fix iommu incorrectly bypassing DMA APIs Thanks to Dan Horak, Gaurav Batra, and Ritesh Harjani (IBM). * tag 'powerpc-7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs commit 3719114091cea0d3a896581e4fe5bed4eba4604b Merge: 1523e4d567f119 c8d46f17c2fc7d Author: Linus Torvalds Date: Fri Apr 3 17:50:24 2026 -0700 Merge tag 's390-7.0-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix a memory leak in the zcrypt driver where the AP message buffer for clear key RSA requests was allocated twice, once by the caller and again locally, causing the first allocation to never be freed - Fix the cpum_sf perf sampling rate overflow adjustment to clamp the recalculated rate to the hardware maximum, preventing exceptions on heavily loaded systems running with HZ=1000 * tag 's390-7.0-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Fix memory leak with CCA cards used as accelerator s390/cpum_sf: Cap sampling rate to prevent lsctl exception commit 1523e4d567f119ad859783b314b5d1312ebf8281 Merge: 631919fb12fe7b cffff6df669a43 Author: Linus Torvalds Date: Fri Apr 3 17:13:59 2026 -0700 Merge tag 'hwmon-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Fix temperature sensor for PRIME X670E-PRO WIFI - occ: Add missing newline, and fix potential division by zero - pmbus: - Fix device ID comparison and printing in tps53676_identify() - Add missing MODULE_IMPORT_NS("PMBUS") for ltc4286 - Check return value of page-select write in pxe1610 probe - Fix array access with zero-length block tps53679 read * tag 'hwmon-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI hwmon: (occ) Fix missing newline in occ_show_extended() hwmon: (occ) Fix division by zero in occ_show_power_1() hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") hwmon: (pxe1610) Check return value of page-select write in probe hwmon: (tps53679) Fix array access with zero-length block read commit 1caa871bb0615e2b68aa11bb7b453eeac770ea1d Merge: 5c14a19d5b1645 fb22b1fc5bca3c Author: Jakub Kicinski Date: Fri Apr 3 16:02:31 2026 -0700 Merge branch 'net-stmmac-fix-tegra234-mgbe-clock' Jon Hunter says: ==================== net: stmmac: Fix Tegra234 MGBE clock The name of the PTP ref clock for the Tegra234 MGBE ethernet controller does not match the generic name in the stmmac platform driver. Despite this basic ethernet is functional on the Tegra234 platforms that use this driver and as far as I know, we have not tested PTP support with this driver. Hence, the risk of breaking any functionality is low. The previous attempt to fix this in the stmmac platform driver, by supporting the Tegra234 PTP clock name, was rejected [0]. The preference from the netdev maintainers is to fix this in the DT binding for Tegra234. This series fixes this by correcting the device-tree binding to align with the generic name for the PTP clock. I understand that this is breaking the ABI for this device, which we should never do, but this is a last resort for getting this fixed. I am open to any better ideas to fix this. Please note that we still maintain backward compatibility in the driver to allow older device-trees to work, but we don't advertise this via the binding, because I did not see any value in doing so. ==================== Link: https://patch.msgid.link/20260401102941.17466-1-jonathanh@nvidia.com Signed-off-by: Jakub Kicinski commit fb22b1fc5bca3c0aad95388933497ceb30f1fb26 Author: Jon Hunter Date: Wed Apr 1 11:29:40 2026 +0100 dt-bindings: net: Fix Tegra234 MGBE PTP clock The PTP clock for the Tegra234 MGBE device is incorrectly named 'ptp-ref' and should be 'ptp_ref'. This is causing the following warning to be observed on Tegra234 platforms that use this device: ERR KERN tegra-mgbe 6800000.ethernet eth0: Invalid PTP clock rate WARNING KERN tegra-mgbe 6800000.ethernet eth0: PTP init failed Although this constitutes an ABI breakage in the binding for this device, PTP support has clearly never worked and so fix this now so we can correct the device-tree for this device. Note that the MGBE driver still supports the legacy 'ptp-ref' clock name and so older/existing device-trees will still work, but given that this is not the correct name, there is no point to advertise this in the binding. Fixes: 189c2e5c7669 ("dt-bindings: net: Add Tegra234 MGBE") Signed-off-by: Jon Hunter Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260401102941.17466-3-jonathanh@nvidia.com Signed-off-by: Jakub Kicinski commit 1345e9f4e3f3bc7d8a0a2138ae29e205a857a555 Author: Jon Hunter Date: Wed Apr 1 11:29:39 2026 +0100 net: stmmac: Fix PTP ref clock for Tegra234 Since commit 030ce919e114 ("net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping") was added the following error is observed on Tegra234: ERR KERN tegra-mgbe 6800000.ethernet eth0: Invalid PTP clock rate WARNING KERN tegra-mgbe 6800000.ethernet eth0: PTP init failed It turns out that the Tegra234 device-tree binding defines the PTP ref clock name as 'ptp-ref' and not 'ptp_ref' and the above commit now exposes this and that the PTP clock is not configured correctly. In order to update device-tree to use the correct 'ptp_ref' name, update the Tegra MGBE driver to use 'ptp_ref' by default and fallback to using 'ptp-ref' if this clock name is present. Fixes: d8ca113724e7 ("net: stmmac: tegra: Add MGBE support") Signed-off-by: Jon Hunter Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260401102941.17466-2-jonathanh@nvidia.com Signed-off-by: Jakub Kicinski commit 5c14a19d5b1645cce1cb1252833d70b23635b632 Author: Pengpeng Hou Date: Thu Apr 2 12:21:48 2026 +0800 nfc: s3fwrn5: allocate rx skb before consuming bytes s3fwrn82_uart_read() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may already deliver a complete frame before allocating a fresh receive buffer. If that alloc_skb() fails, the callback returns 0 even though it has already consumed bytes, and it leaves recv_skb as NULL for the next receive callback. That breaks the receive_buf() accounting contract and can also lead to a NULL dereference on the next skb_put_u8(). Allocate the receive skb lazily before consuming the next byte instead. If allocation fails, return the number of bytes already accepted. Fixes: 3f52c2cb7e3a ("nfc: s3fwrn5: Support a UART interface") Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260402042148.65236-1-pengpeng@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 77facb35227c421467cdb49268de433168c2dcef Author: Chris J Arges Date: Thu Apr 2 17:23:16 2026 -0500 net: increase IP_TUNNEL_RECURSION_LIMIT to 5 In configurations with multiple tunnel layers and MPLS lwtunnel routing, a single tunnel hop can increment the counter beyond this limit. This causes packets to be dropped with the "Dead loop on virtual device" message even when a routing loop doesn't exist. Increase IP_TUNNEL_RECURSION_LIMIT from 4 to 5 to handle this use-case. Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions") Link: https://lore.kernel.org/netdev/88deb91b-ef1b-403c-8eeb-0f971f27e34f@redhat.com/ Signed-off-by: Chris J Arges Link: https://patch.msgid.link/20260402222401.3408368-1-carges@cloudflare.com Signed-off-by: Jakub Kicinski commit fde29fd9349327acc50d19a0b5f3d5a6c964dfd8 Author: Yiqi Sun Date: Thu Apr 2 15:04:19 2026 +0800 ipv4: icmp: fix null-ptr-deref in icmp_build_probe() ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing this error pointer to dev_hold() will cause a kernel crash with null-ptr-deref. Instead, silently discard the request. RFC 8335 does not appear to define a specific response for the case where an IPv6 interface identifier is syntactically valid but the implementation cannot perform the lookup at runtime, and silently dropping the request may safer than misreporting "No Such Interface". Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages") Signed-off-by: Yiqi Sun Link: https://patch.msgid.link/20260402070419.2291578-1-sunyiqixm@gmail.com Signed-off-by: Jakub Kicinski commit 14cf0cd35361f4e94824bf8a42f72713d7702a73 Author: Fernando Fernandez Mancera Date: Thu Apr 2 09:26:13 2026 +0200 ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently allocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for single nexthops and small Equal-Cost Multi-Path groups, this fixed allocation fails for large nexthop groups like 512 nexthops. This results in the following warning splat: WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608 [...] RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395) [...] Call Trace: rtnetlink_rcv_msg (net/core/rtnetlink.c:6989) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585) ___sys_sendmsg (net/socket.c:2641) __sys_sendmsg (net/socket.c:2671) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Fix this by allocating the size dynamically using nh_nlmsg_size() and using nlmsg_new(), this is consistent with nexthop_notify() behavior. In addition, adjust nh_nlmsg_size_grp() so it calculates the size needed based on flags passed. While at it, also add the size of NHA_FDB for nexthop group size calculation as it was missing too. This cannot be reproduced via iproute2 as the group size is currently limited and the command fails as follows: addattr_l ERROR: message exceeded bound of 1048 Fixes: 430a049190de ("nexthop: Add support for nexthop groups") Reported-by: Yiming Qian Closes: https://lore.kernel.org/netdev/CAL_bE8Li2h4KO+AQFXW4S6Yb_u5X4oSKnkywW+LPFjuErhqELA@mail.gmail.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Eric Dumazet Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260402072613.25262-2-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 06aaf04ca815f7a1f17762fd847b7bc14b8833fb Author: Fernando Fernandez Mancera Date: Thu Apr 2 09:26:12 2026 +0200 ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump Currently NHA_HW_STATS_ENABLE is included twice everytime a dump of nexthop group is performed with NHA_OP_FLAG_DUMP_STATS. As all the stats querying were moved to nla_put_nh_group_stats(), leave only that instance of the attribute querying. Fixes: 5072ae00aea4 ("net: nexthop: Expose nexthop group HW stats to user space") Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Eric Dumazet Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260402072613.25262-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit b76254c55dc8f23edc089027dd3f8792554c69fb Author: Pengpeng Hou Date: Thu Apr 2 15:12:07 2026 +0800 net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure qca_tty_receive() consumes each input byte before checking whether a completed frame needs a fresh receive skb. When the current byte completes a frame, the driver delivers that frame and then allocates a new skb for the next one. If that allocation fails, the current code returns i even though data[i] has already been consumed and may already have completed the delivered frame. Since serdev interprets the return value as the number of accepted bytes, this under-reports progress by one byte and can replay the final byte of the completed frame into a fresh parser state on the next call. Return i + 1 in that failure path so the accepted-byte count matches the actual receive-state progress. Fixes: dfc768fbe618 ("net: qualcomm: add QCA7000 UART driver") Cc: stable@vger.kernel.org Signed-off-by: Pengpeng Hou Reviewed-by: Stefan Wahren Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260402071207.4036-1-pengpeng@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 48a5fe38772b6f039522469ee6131a67838221a8 Author: Oleh Konko Date: Thu Apr 2 09:48:57 2026 +0000 tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path. Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast") Cc: stable@vger.kernel.org Signed-off-by: Oleh Konko Reviewed-by: Tung Nguyen Reviewed-by: Simon Horman Link: https://patch.msgid.link/41a4833f368641218e444fdcff822039.security@1seal.org Signed-off-by: Jakub Kicinski commit 7b735ef81286007794a227ce2539419479c02a5f Author: Nikolaos Gkarlis Date: Thu Apr 2 20:14:32 2026 +0200 rtnetlink: add missing netlink_ns_capable() check for peer netns rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net. Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed. Fixes: 81adee47dfb6 ("net: Support specifying the network namespace upon device creation.") Signed-off-by: Nikolaos Gkarlis Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260402181432.4126920-1-nickgarlis@gmail.com Signed-off-by: Jakub Kicinski commit 1979645e1842cb7017525a61a0e0e0beb924d02a Author: Zijing Yin Date: Thu Apr 2 07:01:53 2026 -0700 bridge: guard local VLAN-0 FDB helpers against NULL vlan group When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and nbp_vlan_group() return NULL (br_private.h stub definitions). The BR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and reaches br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer is dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist). The observed crash is in the delete path, triggered when creating a bridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0 via RTM_NEWLINK. The insert helper has the same bug pattern. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7] RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310 Call Trace: br_fdb_toggle_local_vlan_0+0x452/0x4c0 br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276 br_boolopt_toggle net/bridge/br.c:313 br_boolopt_multi_toggle net/bridge/br.c:364 br_changelink net/bridge/br_netlink.c:1542 br_dev_newlink net/bridge/br_netlink.c:1575 Add NULL checks for the vlan group pointer in both helpers, returning early when there are no VLANs to iterate. This matches the existing pattern used by other bridge FDB functions such as br_fdb_add() and br_fdb_delete(). Fixes: 21446c06b441 ("net: bridge: Introduce UAPI for BR_BOOLOPT_FDB_LOCAL_VLAN_0") Signed-off-by: Zijing Yin Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260402140153.3925663-1-yzjaurora@gmail.com Signed-off-by: Jakub Kicinski commit 4e65a8b8daa18d63255ec58964dd192c7fdd9f8b Author: Eric Dumazet Date: Thu Apr 2 10:17:32 2026 +0000 ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() We need to check __in6_dev_get() for possible NULL value, as suggested by Yiming Qian. Also add skb_dst_dev_rcu() instead of skb_dst_dev(), and two missing READ_ONCE(). Note that @dev can't be NULL. Fixes: 9ee11f0fff20 ("ipv6: ioam: Data plane support for Pre-allocated Trace") Reported-by: Yiming Qian Signed-off-by: Eric Dumazet Reviewed-by: Justin Iurman Link: https://patch.msgid.link/20260402101732.1188059-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 285fa6b1e03cff78ead0383e1b259c44b95faf90 Author: Lorenzo Bianconi Date: Thu Apr 2 14:57:10 2026 +0200 net: airoha: Fix memory leak in airoha_qdma_rx_process() If an error occurs on the subsequents buffers belonging to the non-linear part of the skb (e.g. due to an error in the payload length reported by the NIC or if we consumed all the available fragments for the skb), the page_pool fragment will not be linked to the skb so it will not return to the pool in the airoha_qdma_rx_process() error path. Fix the memory leak partially reverting commit 'd6d2b0e1538d ("net: airoha: Fix page recycling in airoha_qdma_rx_process()")' and always running page_pool_put_full_page routine in the airoha_qdma_rx_process() error path. Fixes: d6d2b0e1538d ("net: airoha: Fix page recycling in airoha_qdma_rx_process()") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260402-airoha_qdma_rx_process-mem-leak-fix-v1-1-b5706f402d3c@kernel.org Signed-off-by: Jakub Kicinski commit b120e4432f9f56c7103133d6a11245e617695adb Author: Eric Dumazet Date: Thu Apr 2 10:35:19 2026 +0000 net: lapbether: handle NETDEV_PRE_TYPE_CHANGE lapbeth_data_transmit() expects the underlying device type to be ARPHRD_ETHER. Returning NOTIFY_BAD from lapbeth_device_event() makes sure bonding driver can not break this expectation. Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER") Reported-by: syzbot+d8c285748fa7292580a9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69cd22a1.050a0220.70c3a.0002.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Martin Schiller Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260402103519.1201565-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e16a0d36777b572196de4944aaa196adf828eb8e Author: Arnd Bergmann Date: Thu Apr 2 16:10:40 2026 +0200 net: fec: make FIXED_PHY dependency unconditional When CONFIG_FIXED_PHY is in a loadable module, the fec driver cannot be built-in any more: x86_64-linux-ld: vmlinux.o: in function `fec_enet_mii_probe': fec_main.c:(.text+0xc4f367): undefined reference to `fixed_phy_unregister' x86_64-linux-ld: vmlinux.o: in function `fec_enet_close': fec_main.c:(.text+0xc59591): undefined reference to `fixed_phy_unregister' x86_64-linux-ld: vmlinux.o: in function `fec_enet_mii_probe.cold': Select the fixed phy support on all targets to make this build correctly, not just on coldfire. Notat that Essentially the stub helpers in include/linux/phy_fixed.h cannot be used correctly because of this build time dependency, and we could just remove them to hit the build failure more often when a driver uses them without the 'select FIXED_PHY'. Fixes: dc86b621e1b4 ("net: fec: register a fixed phy using fixed_phy_register_100fd if needed") Signed-off-by: Arnd Bergmann Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260402141048.2713445-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit c842743d073bdd683606cb414eb0ca84465dd834 Author: Ruide Cao Date: Thu Apr 2 22:46:20 2026 +0800 net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants. Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path. Fixes: 2ecba2d1e45b ("net: sched: act_csum: Fix csum calc for tagged packets") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Ruide Cao Signed-off-by: Ren Wei Reviewed-by: Simon Horman Link: https://patch.msgid.link/22df2fcb49f410203eafa5d97963dd36089f4ecf.1774892775.git.caoruide123@gmail.com Signed-off-by: Jakub Kicinski commit 631919fb12fe7b1f0453fe1035e62ce704bc3923 Merge: e41255ce7acc4a 7e0ffb72de8aa3 Author: Linus Torvalds Date: Fri Apr 3 12:05:06 2026 -0700 Merge tag 'sched_ext-for-7.0-rc6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: "These are late but both fix subtle yet critical problems and the blast radius is limited strictly to sched_ext. - Fix stale direct dispatch state in ddsp_dsq_id which can cause spurious warnings in mark_direct_dispatch() on task wakeup - Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU configs which can lead to incorrectly dispatching migration- disabled tasks to remote CPUs" * tag 'sched_ext-for-7.0-rc6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Fix stale direct dispatch state in ddsp_dsq_id sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU commit e41255ce7acc4a3412ecdaa74b32deee980d27f7 Merge: c514f73377d6e3 aa35dd6bdd033d Author: Linus Torvalds Date: Fri Apr 3 11:58:04 2026 -0700 Merge tag 'io_uring-7.0-20260403' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - A previous fix in this release covered the case of the rings being RCU protected during resize, but it missed a few spots. This covers the rest - Fix the cBPF filters when COW'ed, introduced in this merge window - Fix for an attempt to import a zero sized buffer - Fix for a missing clamp in importing bundle buffers * tag 'io_uring-7.0-20260403' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/bpf_filters: retain COW'ed settings on parse failures io_uring: protect remaining lockless ctx->rings accesses with RCU io_uring/rsrc: reject zero-length fixed buffer import io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() commit c514f73377d6e3c2d4bab6db89b5a0e4b8807fa1 Merge: 1270605fd2d8c3 59e1be1278f064 Author: Linus Torvalds Date: Fri Apr 3 10:19:52 2026 -0700 Merge tag 'spi-fix-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of fixes, mostly probe/remove issues that are the result of Felix Gu going and auditing those areas, plus one error handling fix for the Cadence QSPI driver" * tag 'spi-fix-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: cadence-qspi: Fix exec_mem_op error handling spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback spi: stm32-ospi: Fix DMA channel leak on stm32_ospi_dma_setup() failure spi: stm32-ospi: Fix reset control leak on probe error spi: stm32-ospi: Fix resource leak in remove() callback commit 7e0ffb72de8aa3b25989c2d980e81b829c577010 Author: Andrea Righi Date: Fri Apr 3 08:57:20 2026 +0200 sched_ext: Fix stale direct dispatch state in ddsp_dsq_id @p->scx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a spurious warning in mark_direct_dispatch() when the next wakeup's ops.select_cpu() calls scx_bpf_dsq_insert(), such as: WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140 The root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(), which is not reached in all paths that consume or cancel a direct dispatch verdict. Fix it by clearing it at the right places: - direct_dispatch(): cache the direct dispatch state in local variables and clear it before dispatch_enqueue() on the synchronous path. For the deferred path, the direct dispatch state must remain set until process_ddsp_deferred_locals() consumes them. - process_ddsp_deferred_locals(): cache the dispatch state in local variables and clear it before calling dispatch_to_local_dsq(), which may migrate the task to another rq. - do_enqueue_task(): clear the dispatch state on the enqueue path (local/global/bypass fallbacks), where the direct dispatch verdict is ignored. - dequeue_task_scx(): clear the dispatch state after dispatch_dequeue() to handle both the deferred dispatch cancellation and the holding_cpu race, covering all cases where a pending direct dispatch is cancelled. - scx_disable_task(): clear the direct dispatch state when transitioning a task out of the current scheduler. Waking tasks may have had the direct dispatch state set by the outgoing scheduler's ops.select_cpu() and then been queued on a wake_list via ttwu_queue_wakelist(), when SCX_OPS_ALLOW_QUEUED_WAKEUP is set. Such tasks are not on the runqueue and are not iterated by scx_bypass(), so their direct dispatch state won't be cleared. Without this clear, any subsequent SCX scheduler that tries to direct dispatch the task will trigger the WARN_ON_ONCE() in mark_direct_dispatch(). Fixes: 5b26f7b920f7 ("sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches") Cc: stable@vger.kernel.org # v6.12+ Cc: Daniel Hodges Cc: Patrick Somaru Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 1270605fd2d8c3d2f0a050f5078e56cbc9b755e5 Merge: 576db0f37549a0 744d5721d2d7ab Author: Linus Torvalds Date: Fri Apr 3 09:56:32 2026 -0700 Merge tag 'pm-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix a potential NULL pointer dereference in the energy model netlink interface and a potential double free in an error path in the common cpufreq governor management code: - Fix a NULL pointer dereference in the energy model netlink interface that may occur if a given perf domain ID is not recognized (Changwoo Min) - Avoid double free in the cpufreq_dbs_governor_init() error path when kobject_init_and_add() fails (Guangshuo Li)" * tag 'pm-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path PM: EM: Fix NULL pointer dereference when perf domain ID is not found commit 576db0f37549a05d7b1d9b5d6ad9fcce9ad7bfd6 Merge: 116a3308e1eb0e 9e07e3b81807ed Author: Linus Torvalds Date: Fri Apr 3 09:49:06 2026 -0700 Merge tag 'thermal-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "Address potential races between thermal zone removal and system resume that may lead to a use-after-free (in two different ways) and a potential use-after-free in the thermal zone unregistration path (Rafael Wysocki)" * tag 'thermal-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: core: Fix thermal zone device registration error path thermal: core: Address thermal zone removal races with resume commit 116a3308e1eb0ea59aa248e22ac29d65eb7cd250 Merge: 441c63ff42c4e6 6b5ef8c88854b3 Author: Linus Torvalds Date: Fri Apr 3 09:33:38 2026 -0700 Merge tag 'gpio-fixes-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix kerneldocs for gpio-timberdale and gpio-nomadik - clear the "requested" flag in error path in gpiod_request_commit() - call of_xlate() if provided when setting up shared GPIOs - handle pins shared by child firmware nodes of consumer devices - fix return value check in gpio-qixis-fpga - fix suspend on gpio-mxc - fix gpio-microchip DT bindings * tag 'gpio-fixes-for-v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: dt-bindings: gpio: fix microchip #interrupt-cells gpio: shared: shorten the critical section in gpiochip_setup_shared() gpio: mxc: map Both Edge pad wakeup to Rising Edge gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio() gpio: shared: handle pins shared by child nodes of devices gpio: shared: call gpio_chip::of_xlate() if set gpiolib: clear requested flag if line is invalid gpio: nomadik: repair some kernel-doc comments gpio: timberdale: repair kernel-doc comments gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() commit 441c63ff42c4e666304cdd32d23b5fc6bc1ea3cc Merge: 60d9212c693237 54ac9ff8f1196a Author: Linus Torvalds Date: Fri Apr 3 08:47:13 2026 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Will Deacon: - Implement a basic static call trampoline to fix CFI failures with the generic implementation * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Use static call trampolines when kCFI is enabled commit 60d9212c6932376a337507b20fc45b2c2785b5ac Merge: d8a9a4b11a1379 75f53c4b2dbca8 Author: Linus Torvalds Date: Fri Apr 3 08:23:51 2026 -0700 Merge tag 'drm-fixes-2026-04-03' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Hopefully no Easter eggs in this bunch of fixes. Usual stuff across the amd/intel with some misc bits. Thanks to Thorsten and Alex for making sure a regression fix that was hanging around in process land finally made it in, that is probably the biggest change in here. core: - revert unplug/framebuffer fix as it caused problems - compat ioctl speculation fix bridge: - refcounting fix sysfb: - error handling fix amdgpu: - fix renoir audio regression - UserQ fixes - PASID handling fix - S4 fix for smu11 chips - Misc small fixes amdkfd: - Non-4K page fixes i915: - Fix for #12045: Huawei Matebook E (DRR-WXX): Persistent Black Screen on Boot with i915 and Gen11: Modesetting and Backlight Control Malfunction - Fix for #15826: i915: Raptor Lake-P [UHD Graphics] display flicker/corruption on eDP panel - Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP xe: - uapi: Accept canonical GPU addresses in xe_vm_madvise_ioctl - Disallow writes to read-only VMAs - PXP fixes - Disable garbage collector work item on SVM close - void memory allocations in xe_device_declare_wedged qaic: - hang fix ast: - initialisation fix" * tag 'drm-fixes-2026-04-03' of https://gitlab.freedesktop.org/drm/kernel: (28 commits) drm/amd/display: Wire up dcn10_dio_construct() for all pre-DCN401 generations drm/ioc32: stop speculation on the drm_compat_ioctl path drm/sysfb: Fix efidrm error handling and memory type mismatch drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP drm/i915/cdclk: Do the full CDCLK dance for min_voltage_level changes drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size drm/amdgpu: Fix wait after reset sequence in S4 drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB drm/amdgpu/userq: fix memory leak in MQD creation error paths drm/amd: Fix MQD and control stack alignment for non-4K drm/amdkfd: Align expected_queue_size to PAGE_SIZE drm/amdgpu: fix the idr allocation flags drm/amdgpu: validate doorbell_offset in user queue creation drm/amdgpu/pm: drop SMU driver if version not matched messages drm/xe: Avoid memory allocations in xe_device_declare_wedged() drm/xe: Disable garbage collector work item on SVM close drm/xe/pxp: Don't allow PXP on older PTL GSC FWs drm/xe/pxp: Clear restart flag in pxp_start after jumping back drm/xe/pxp: Remove incorrect handling of impossible state during suspend ... commit 744d5721d2d7abc84e5131c16002039c53465c89 Merge: 6dcf9d0064ce2f 9badc2a84e688b Author: Rafael J. Wysocki Date: Fri Apr 3 14:15:06 2026 +0200 Merge branch 'pm-em' Fix a NULL pointer dereference in the energy model netlink interface that may occur if a given perf domain ID is not recognized (Changwoo Min). * pm-em: PM: EM: Fix NULL pointer dereference when perf domain ID is not found commit 496fa1befba1e8ff149af5120cd9c9616bb05120 Author: Willy Tarreau Date: Fri Apr 3 08:20:18 2026 +0200 Documentation: clarify the mandatory and desirable info for security reports A significant part of the effort of the security team consists in begging reporters for patch proposals, or asking them to provide them in regular format, and most of the time they're willing to provide this, they just didn't know that it would help. So let's add a section detailing the required and desirable contents in a security report to help reporters write more actionable reports which do not require round trips. Cc: Eric Dumazet Cc: Greg KH Signed-off-by: Willy Tarreau Link: https://patch.msgid.link/20260403062018.31080-4-w@1wt.eu Signed-off-by: Greg Kroah-Hartman commit a72b832a482372001a158c8014d116b053089b5d Author: Willy Tarreau Date: Fri Apr 3 08:20:17 2026 +0200 Documentation: explain how to find maintainers addresses for security reports These days, 80% of the work done by the security team consists in locating the affected subsystem in a report, running get_maintainers on it, forwarding the report to these persons and responding to the reporter with them in Cc. This is a huge and unneeded overhead that we must try to lower for a better overall efficiency. This patch adds a complete section explaining how to figure the list of recipients to send the report to. Cc: Eric Dumazet Cc: Greg KH Signed-off-by: Willy Tarreau Link: https://patch.msgid.link/20260403062018.31080-3-w@1wt.eu Signed-off-by: Greg Kroah-Hartman commit f2b1cbef153636fa498324b47e822e8b4d1774aa Author: Willy Tarreau Date: Fri Apr 3 08:20:16 2026 +0200 Documentation: minor updates to the security contacts This clarifies the fact that the bug reporters must use a valid e-mail address to send their report, and that the security team assists developers working on a fix but doesn't always produce fixes on its own. Cc: Eric Dumazet Cc: Greg KH Signed-off-by: Willy Tarreau Link: https://patch.msgid.link/20260403062018.31080-2-w@1wt.eu Signed-off-by: Greg Kroah-Hartman commit 75f53c4b2dbca831bf91e9befe06c9ad58f29352 Merge: 293fa6ebd46fff f8995c2df519f3 Author: Dave Airlie Date: Fri Apr 3 19:05:46 2026 +1000 Merge tag 'drm-misc-fixes-2026-04-02' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A refcounting fix for bridges, revert a previous framebuffer use-after-free fix that turned out to be causing more problems, a hang fix for qaic, an initialization fix for ast, a error handling fix for sysfb, and a speculation fix for drm_compat_ioctl. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260402-vivid-perfect-caiman-ca055e@houat commit 293fa6ebd46fffc2722b6c960f40f1eb74b08dba Merge: 82f5e5b443ae32 a4983968fa5b31 Author: Dave Airlie Date: Fri Apr 3 18:41:48 2026 +1000 Merge tag 'amd-drm-fixes-7.0-2026-04-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-04-02: amdgpu: - Fix audio regression on renoir Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260402194409.914769-1-alexander.deucher@amd.com commit 82f5e5b443ae32fe28a068f58abf53b89feea5f2 Merge: 9b454a3412764b 56b7432b7e8e6a Author: Dave Airlie Date: Fri Apr 3 18:36:51 2026 +1000 Merge tag 'drm-xe-fixes-2026-04-02' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes uAPI Fix: - Accept canonical GPU addresses in xe_vm_madvise_ioctl (Arvind) Driver Fixes: - Disallow writes to read-only VMAs (Jonathan) - PXP fixes (Daniele) - Disable garbage collector work item on SVM clos (Brost) - void memory allocations in xe_device_declare_wedged (Brost) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/ac5mDHs-McR5cJSV@intel.com commit 9b454a3412764b2a64b1a00d1f4c4da1e6b1cf2b Merge: 2aa5a6d933f4e4 9c9a57e4e337f9 Author: Dave Airlie Date: Fri Apr 3 18:31:22 2026 +1000 Merge tag 'drm-intel-fixes-2026-04-02' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix for #12045: Huawei Matebook E (DRR-WXX): Persistent Black Screen on Boot with i915 and Gen11: Modesetting and Backlight Control Malfunction - Fix for #15826: i915: Raptor Lake-P [UHD Graphics] display flicker/corruption on eDP panel - Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/ac5DM1IpBkuaT58e@jlahtine-mobl commit d8a9a4b11a137909e306e50346148fc5c3b63f9d Merge: 7b9e74c5a49e13 78ec5bf2f589ec Author: Linus Torvalds Date: Thu Apr 2 21:04:28 2026 -0700 Merge tag 'v7.0-rc6-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fix from Steve French: - Fix potential out of bounds read in mount * tag 'v7.0-rc6-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath commit 7b9e74c5a49e1331e03c8ae5f981067da4f33328 Merge: 5a9617dde77d07 e1b5687a862a43 Author: Linus Torvalds Date: Thu Apr 2 18:59:56 2026 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix register equivalence for pointers to packet (Alexei Starovoitov) - Fix incorrect pruning due to atomic fetch precision tracking (Daniel Borkmann) - Fix grace period wait for bpf_link-ed tracepoints (Kumar Kartikeya Dwivedi) - Fix use-after-free of sockmap's sk->sk_socket (Kuniyuki Iwashima) - Reject direct access to nullable PTR_TO_BUF pointers (Qi Tang) - Reject sleepable kprobe_multi programs at attach time (Varun R Mallya) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add more precision tracking tests for atomics bpf: Fix incorrect pruning due to atomic fetch precision tracking bpf: Reject sleepable kprobe_multi programs at attach time bpf: reject direct access to nullable PTR_TO_BUF pointers bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). bpf: Fix grace period wait for tracepoint bpf_link bpf: Fix regsafe() for pointers to packet commit 51f4e090b9f87b40c21b6daadb5c06e6c0a07b67 Author: Tyllis Xu Date: Tue Mar 31 23:47:07 2026 -0500 net: stmmac: fix integer underflow in chain mode The jumbo_frm() chain-mode implementation unconditionally computes len = nopaged_len - bmax; where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including page fragments): is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc); When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx). This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs (the typical deployment for stmmac), this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware. Fix this by introducing a buf_len local variable clamped to min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe: it is zero when the linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally, and the fragment loop in stmmac_xmit() handles page fragments afterward. Fixes: 286a83721720 ("stmmac: add CHAINED descriptor mode support (V4)") Cc: stable@vger.kernel.org Signed-off-by: Tyllis Xu Link: https://patch.msgid.link/20260401044708.1386919-1-LivelyCarpet87@gmail.com Signed-off-by: Jakub Kicinski commit 6dede3967619b5944003227a5d09fdc21ed57d10 Author: David Carlier Date: Wed Apr 1 22:12:18 2026 +0100 net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() When dma_map_single() fails in tse_start_xmit(), the function returns NETDEV_TX_OK without freeing the skb. Since NETDEV_TX_OK tells the stack the packet was consumed, the skb is never freed, leaking memory on every DMA mapping failure. Add dev_kfree_skb_any() before returning to properly free the skb. Fixes: bbd2190ce96d ("Altera TSE: Add main and header file for Altera Ethernet Driver") Cc: stable@vger.kernel.org Signed-off-by: David Carlier Link: https://patch.msgid.link/20260401211218.279185-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski commit e9c9f084cd78a58e2331fbf83c3d5625fb86e33a Author: Allison Henderson Date: Wed Apr 1 17:58:33 2026 -0700 MAINTAINERS: Update email for Allison Henderson Switch active email address to kernel.org alias Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260402005833.38376-1-achender@kernel.org Signed-off-by: Jakub Kicinski commit 2fd68c7ea2ae741a4446d54c8a461255022e2dc7 Author: Qingfang Deng Date: Wed Apr 1 10:28:39 2026 +0800 MAINTAINERS: orphan PPP over Ethernet driver We haven't seen activities from Michal Ostrowski for quite a long time. The last commit from him is fb64bb560e18 ("PPPoE: Fix flush/close races."), which was in 2009. Email to mostrows@earthlink.net also bounces. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260401022842.15082-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit 8eceab19eba9dcbfd2a0daec72e1bf48aa100170 Author: Douya Le Date: Thu Apr 2 23:34:55 2026 +0800 crypto: af_alg - limit RX SG extraction by receive buffer budget Make af_alg_get_rsgl() limit each RX scatterlist extraction to the remaining receive buffer budget. af_alg_get_rsgl() currently uses af_alg_readable() only as a gate before extracting data into the RX scatterlist. Limit each extraction to the remaining af_alg_rcvbuf(sk) budget so that receive-side accounting matches the amount of data attached to the request. If skcipher cannot obtain enough RX space for at least one chunk while more data remains to be processed, reject the recvmsg call instead of rounding the request length down to zero. Fixes: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a ("crypto: algif_skcipher - overhaul memory management") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Douya Le Signed-off-by: Ren Wei Signed-off-by: Herbert Xu commit 5a9617dde77d0777b53f0af7dee58109650bda41 Merge: 19abf08d5e6671 e02494114ebf7c Author: Linus Torvalds Date: Thu Apr 2 17:29:48 2026 -0700 Merge tag 'v7.0-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Add missing async markers to tegra - Fix long hmac key DMA handling in caam - Fix spurious ENOSPC errors in deflate - Fix SG chaining in af_alg - Do not use in-place process in algif_aead - Fix out-of-place destination overflow in authencesn * tag 'v7.0-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption crypto: algif_aead - Revert to operating out-of-place crypto: af-alg - fix NULL pointer dereference in scatterwalk crypto: deflate - fix spurious -ENOSPC crypto: caam - fix overflow on long hmac keys crypto: caam - fix DMA corruption on long hmac keys crypto: tegra - Add missing CRYPTO_ALG_ASYNC commit 857fa8f2a5b184c206c703a3d9ce05cea683cfed Author: Jean Delvare Date: Wed Apr 1 12:23:23 2026 +0200 accel: ethosu: Add hardware dependency hint The Ethos-U NPU is only available on ARM systems, so add a hardware dependency hint to prevent this driver from being needlessly included in kernels built for other architectures. Signed-off-by: Jean Delvare Link: https://patch.msgid.link/20260401122323.6127a77c@endymion Signed-off-by: Rob Herring (Arm) commit 07712db80857d5d09ae08f3df85a708ecfc3b61f Author: Nicholas Carlini Date: Tue Mar 31 15:25:32 2026 +0200 eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree() to an RCU callback to prevent UAF. Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion") Signed-off-by: Nicholas Carlini Signed-off-by: Christian Brauner commit 0c4a59df370bea245695c00aaae6ae75747139bd Author: Changwoo Min Date: Thu Apr 2 11:31:50 2026 +0900 sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU Since commit 8e4f0b1ebcf2 ("bpf: use rcu_read_lock_dont_migrate() for trampoline.c"), the BPF prolog (__bpf_prog_enter) calls migrate_disable() only when CONFIG_PREEMPT_RCU is enabled, via rcu_read_lock_dont_migrate(). Without CONFIG_PREEMPT_RCU, the prolog never touches migration_disabled, so migration_disabled == 1 always means the task is truly migration-disabled regardless of whether it is the current task. The old unconditional p == current check was a false negative in this case, potentially allowing a migration-disabled task to be dispatched to a remote CPU and triggering scx_error in task_can_run_on_remote_rq(). Only apply the p == current disambiguation when CONFIG_PREEMPT_RCU is enabled, where the ambiguity with the BPF prolog still exists. Fixes: 8e4f0b1ebcf2 ("bpf: use rcu_read_lock_dont_migrate() for trampoline.c") Cc: stable@vger.kernel.org # v6.18+ Link: https://lore.kernel.org/lkml/20250821090609.42508-8-dongml2@chinatelecom.cn/ Signed-off-by: Changwoo Min Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit a4983968fa5b3179ab090407d325a71cdc96874e Author: Ionut Nechita Date: Mon Mar 23 23:13:43 2026 +0200 drm/amd/display: Wire up dcn10_dio_construct() for all pre-DCN401 generations Description: - Commit b82f0759346617b2 ("drm/amd/display: Migrate DIO registers access from hwseq to dio component") moved DIO_MEM_PWR_CTRL register access behind the new dio abstraction layer but only created the dio object for DCN 4.01. On all other generations (DCN 10/20/21/201/30/301/302/303/ 31/314/315/316/32/321/35/351/36), the dio pointer is NULL, causing the register write to be silently skipped. This results in AFMT HDMI memory not being powered on during init_hw, which can cause HDMI audio failures and display issues on affected hardware including Renoir/Cezanne (DCN 2.1) APUs that use dcn10_init_hw. Call dcn10_dio_construct() in each older DCN generation's resource.c to create the dio object, following the same pattern as DCN 4.01. This ensures the dio pointer is non-NULL and the mem_pwr_ctrl callback works through the dio abstraction for all DCN generations. Fixes: b82f07593466 ("drm/amd/display: Migrate DIO registers access from hwseq to dio component.") Reviewed-by: Ivan Lipski Signed-off-by: Ionut Nechita Signed-off-by: Alex Deucher commit 19abf08d5e66713e7e02a3e160f51647512c1302 Merge: 5619b098e2fbf3 fda9522ed6afae Author: Linus Torvalds Date: Thu Apr 2 12:03:15 2026 -0700 Merge tag 'v7.0-rc6-ksmbd-server-fix' of git://git.samba.org/ksmbd Pull smb server fix from Steve French: - Fix out of bound write * tag 'v7.0-rc6-ksmbd-server-fix' of git://git.samba.org/ksmbd: ksmbd: fix OOB write in QUERY_INFO for compound requests commit 5619b098e2fbf3a23bf13d91897056a1fe238c6d Merge: f8f5627a8aeab1 316fb1b3169efb Author: Linus Torvalds Date: Thu Apr 2 10:31:30 2026 -0700 Merge tag 'for-7.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "One more fix for a potential extent tree corruption due to an unexpected error value. When the search for an extent item failed, it under some circumstances was reported as a success to the caller" * tag 'for-7.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() commit e1b5687a862a43429f1d9f69065b3bbc7780a97a Author: Daniel Borkmann Date: Wed Apr 1 00:20:20 2026 +0200 selftests/bpf: Add more precision tracking tests for atomics Add verifier precision tracking tests for BPF atomic fetch operations. Validate that backtrack_insn correctly propagates precision from the fetch dst_reg to the stack slot for {fetch_add,xchg,cmpxchg} atomics. For the first two src_reg gets the old memory value, and for the last one r0. The fetched register is used for pointer arithmetic to trigger backtracking. Also add coverage for fetch_{or,and,xor} flavors which exercises the bitwise atomic fetch variants going through the same insn->imm & BPF_FETCH check but with different imm values. Add dual-precision regression tests for fetch_add and cmpxchg where both the fetched value and a reread of the same stack slot are tracked for precision. After the atomic operation, the stack slot is STACK_MISC, so the ldx does not set INSN_F_STACK_ACCESS. These tests verify that stack precision propagates solely through the atomic fetch's load side. Add map-based tests for fetch_add and cmpxchg which validate that non- stack atomic fetch completes precision tracking without falling back to mark_all_scalars_precise. Lastly, add 32-bit variants for {fetch_add, cmpxchg} on map values to cover the second valid atomic operand size. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_precision [...] + /etc/rcS.d/S50-startup ./test_progs -t verifier_precision [ 1.697105] bpf_testmod: loading out-of-tree module taints kernel. [ 1.700220] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel [ 1.777043] tsc: Refined TSC clocksource calibration: 3407.986 MHz [ 1.777619] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x311fc6d7268, max_idle_ns: 440795260133 ns [ 1.778658] clocksource: Switched to clocksource tsc #633/1 verifier_precision/bpf_neg:OK #633/2 verifier_precision/bpf_end_to_le:OK #633/3 verifier_precision/bpf_end_to_be:OK #633/4 verifier_precision/bpf_end_bswap:OK #633/5 verifier_precision/bpf_load_acquire:OK #633/6 verifier_precision/bpf_store_release:OK #633/7 verifier_precision/state_loop_first_last_equal:OK #633/8 verifier_precision/bpf_cond_op_r10:OK #633/9 verifier_precision/bpf_cond_op_not_r10:OK #633/10 verifier_precision/bpf_atomic_fetch_add_precision:OK #633/11 verifier_precision/bpf_atomic_xchg_precision:OK #633/12 verifier_precision/bpf_atomic_fetch_or_precision:OK #633/13 verifier_precision/bpf_atomic_fetch_and_precision:OK #633/14 verifier_precision/bpf_atomic_fetch_xor_precision:OK #633/15 verifier_precision/bpf_atomic_cmpxchg_precision:OK #633/16 verifier_precision/bpf_atomic_fetch_add_dual_precision:OK #633/17 verifier_precision/bpf_atomic_cmpxchg_dual_precision:OK #633/18 verifier_precision/bpf_atomic_fetch_add_map_precision:OK #633/19 verifier_precision/bpf_atomic_cmpxchg_map_precision:OK #633/20 verifier_precision/bpf_atomic_fetch_add_32bit_precision:OK #633/21 verifier_precision/bpf_atomic_cmpxchg_32bit_precision:OK #633/22 verifier_precision/bpf_neg_2:OK #633/23 verifier_precision/bpf_neg_3:OK #633/24 verifier_precision/bpf_neg_4:OK #633/25 verifier_precision/bpf_neg_5:OK #633 verifier_precision:OK Summary: 1/25 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260331222020.401848-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 179ee84a89114b854ac2dd1d293633a7f6c8dac1 Author: Daniel Borkmann Date: Wed Apr 1 00:20:19 2026 +0200 bpf: Fix incorrect pruning due to atomic fetch precision tracking When backtrack_insn encounters a BPF_STX instruction with BPF_ATOMIC and BPF_FETCH, the src register (or r0 for BPF_CMPXCHG) also acts as a destination, thus receiving the old value from the memory location. The current backtracking logic does not account for this. It treats atomic fetch operations the same as regular stores where the src register is only an input. This leads the backtrack_insn to fail to propagate precision to the stack location, which is then not marked as precise! Later, the verifier's path pruning can incorrectly consider two states equivalent when they differ in terms of stack state. Meaning, two branches can be treated as equivalent and thus get pruned when they should not be seen as such. Fix it as follows: Extend the BPF_LDX handling in backtrack_insn to also cover atomic fetch operations via is_atomic_fetch_insn() helper. When the fetch dst register is being tracked for precision, clear it, and propagate precision over to the stack slot. For non-stack memory, the precision walk stops at the atomic instruction, same as regular BPF_LDX. This covers all fetch variants. Before: 0: (b7) r1 = 8 ; R1=8 1: (7b) *(u64 *)(r10 -8) = r1 ; R1=8 R10=fp0 fp-8=8 2: (b7) r2 = 0 ; R2=0 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2) ; R2=8 R10=fp0 fp-8=mmmmmmmm 4: (bf) r3 = r10 ; R3=fp0 R10=fp0 5: (0f) r3 += r2 mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r2 stack= before 4: (bf) r3 = r10 mark_precise: frame0: regs=r2 stack= before 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2) mark_precise: frame0: regs=r2 stack= before 2: (b7) r2 = 0 6: R2=8 R3=fp8 6: (b7) r0 = 0 ; R0=0 7: (95) exit After: 0: (b7) r1 = 8 ; R1=8 1: (7b) *(u64 *)(r10 -8) = r1 ; R1=8 R10=fp0 fp-8=8 2: (b7) r2 = 0 ; R2=0 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2) ; R2=8 R10=fp0 fp-8=mmmmmmmm 4: (bf) r3 = r10 ; R3=fp0 R10=fp0 5: (0f) r3 += r2 mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r2 stack= before 4: (bf) r3 = r10 mark_precise: frame0: regs=r2 stack= before 3: (db) r2 = atomic64_fetch_add((u64 *)(r10 -8), r2) mark_precise: frame0: regs= stack=-8 before 2: (b7) r2 = 0 mark_precise: frame0: regs= stack=-8 before 1: (7b) *(u64 *)(r10 -8) = r1 mark_precise: frame0: regs=r1 stack= before 0: (b7) r1 = 8 6: R2=8 R3=fp8 6: (b7) r0 = 0 ; R0=0 7: (95) exit Fixes: 5ffa25502b5a ("bpf: Add instructions for atomic_[cmp]xchg") Fixes: 5ca419f2864a ("bpf: Add BPF_FETCH field / create atomic_fetch_add instruction") Reported-by: STAR Labs SG Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260331222020.401848-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit f8f5627a8aeab15183eef8930bf75ba88a51622f Merge: 4c2c526b5adfb5 ec7067e6611934 Author: Linus Torvalds Date: Thu Apr 2 09:57:06 2026 -0700 Merge tag 'net-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "With fixes from wireless, bluetooth and netfilter included we're back to each PR carrying 30%+ more fixes than in previous era. The good news is that so far none of the "extra" fixes are themselves causing real regressions. Not sure how much comfort that is. Current release - fix to a fix: - netdevsim: fix build if SKB_EXTENSIONS=n - eth: stmmac: skip VLAN restore when VLAN hash ops are missing Previous releases - regressions: - wifi: iwlwifi: mvm: don't send a 6E related command when not supported Previous releases - always broken: - some info leak fixes - add missing clearing of skb->cb[] on ICMP paths from tunnels - ipv6: - flowlabel: defer exclusive option free until RCU teardown - avoid overflows in ip6_datagram_send_ctl() - mpls: add seqcount to protect platform_labels from OOB access - bridge: improve safety of parsing ND options - bluetooth: fix leaks, overflows and races in hci_sync - netfilter: add more input validation, some to address bugs directly some to prevent exploits from cooking up broken configurations - wifi: - ath: avoid poor performance due to stopping the wrong aggregation session - virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - eth: - fec: fix the PTP periodic output sysfs interface - enetc: safely reinitialize TX BD ring when it has unsent frames" * tag 'net-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (95 commits) eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64 ipv6: avoid overflows in ip6_datagram_send_ctl() net: hsr: fix VLAN add unwind on slave errors net: hsr: serialize seq_blocks merge across nodes vsock: initialize child_ns_mode_locked in vsock_net_init() selftests/tc-testing: add tests for cls_fw and cls_flow on shared blocks net/sched: cls_flow: fix NULL pointer dereference on shared blocks net/sched: cls_fw: fix NULL pointer dereference on shared blocks net/x25: Fix overflow when accumulating packets net/x25: Fix potential double free of skb bnxt_en: Restore default stat ctxs for ULP when resource is available bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() bnxt_en: Refactor some basic ring setup and adjustment logic net/mlx5: Fix switchdev mode rollback in case of failure net/mlx5: Avoid "No data available" when FW version queries fail net/mlx5: lag: Check for LAG device before creating debugfs net: macb: properly unregister fixed rate clocks net: macb: fix clk handling on PCI glue driver removal virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN net/sched: sch_netem: fix out-of-bounds access in packet corruption ... commit 4c2c526b5adfb580bd95316bf179327d5ee26da8 Merge: 2ec9074b28a09a 8b72aa5704c773 Author: Linus Torvalds Date: Thu Apr 2 09:53:16 2026 -0700 Merge tag 'iommu-fixes-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - IOMMU-PT related compile breakage in for AMD driver - IOTLB flushing behavior when unmapped region is larger than requested due to page-sizes - Fix IOTLB flush behavior with empty gathers * tag 'iommu-fixes-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommupt/amdv1: mark amdv1pt_install_leaf_entry as __always_inline iommupt: Fix short gather if the unmap goes into a large mapping iommu: Do not call drivers for empty gathers commit eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8 Author: Varun R Mallya Date: Thu Apr 2 00:41:25 2026 +0530 bpf: Reject sleepable kprobe_multi programs at attach time kprobe.multi programs run in atomic/RCU context and cannot sleep. However, bpf_kprobe_multi_link_attach() did not validate whether the program being attached had the sleepable flag set, allowing sleepable helpers such as bpf_copy_from_user() to be invoked from a non-sleepable context. This causes a "sleeping function called from invalid context" splat: BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo preempt_count: 1, expected: 0 RCU nest depth: 2, expected: 0 Fix this by rejecting sleepable programs early in bpf_kprobe_multi_link_attach(), before any further processing. Fixes: 0dcac2725406 ("bpf: Add multi kprobe link") Signed-off-by: Varun R Mallya Acked-by: Kumar Kartikeya Dwivedi Acked-by: Leon Hwang Acked-by: Jiri Olsa Link: https://lore.kernel.org/r/20260401191126.440683-1-varunrmallya@gmail.com Signed-off-by: Alexei Starovoitov commit b0db1accbc7395657c2b79db59fa9fae0d6656f3 Author: Qi Tang Date: Thu Apr 2 17:29:22 2026 +0800 bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check. Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL. On stop callbacks these are NULL, causing a kernel NULL dereference. Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the existing PTR_TO_BTF_ID pattern. Fixes: 20b2aff4bc15 ("bpf: Introduce MEM_RDONLY flag") Signed-off-by: Qi Tang Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260402092923.38357-2-tpluszz77@gmail.com Signed-off-by: Alexei Starovoitov commit 2ec9074b28a09a2cc4871371675bafc575a114c5 Merge: 2064d7784e7925 b477ab8893c3e6 Author: Linus Torvalds Date: Thu Apr 2 09:41:21 2026 -0700 Merge tag 'sound-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "People have been so busy for hunting and we're still getting more changes than wished for, but it doesn't look too scary; almost all changes are device-specific small fixes. I guess it's rather a casual bump, and no more Easter eggs are left for 7.0 (hopefully)... - Fixes for the recent regression on ctxfi driver - Fix missing INIT_LIST_HEAD() for ASoC card_aux_list - Usual HD- and USB-audio, and ASoC AMD quirk updates - ASoC fixes for AMD and Intel" * tag 'sound-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits) ASoC: amd: ps: Fix missing leading zeros in subsystem_device SSID log ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP ALSA: hda/realtek: add quirk for Acer Swift SFG14-73 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9 ASoC: Intel: boards: fix unmet dependency on PINCTRL ASoC: Intel: ehl_rt5660: Use the correct rtd->dev device in hw_params ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10 ALSA: hda/realtek: add quirk for HP Laptop 15-fc0xxx ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED) ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 16X OLED M7601RM ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15 ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP ALSA: caiaq: fix stack out-of-bounds read in init_card ALSA: ctxfi: Check the error for index mapping ALSA: ctxfi: Fix missing SPDIFI1 index handling ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx ... commit 2064d7784e79258094c7dbf2695cb536b3c55010 Merge: 9147566d801602 7f138de156b20d Author: Linus Torvalds Date: Thu Apr 2 09:34:22 2026 -0700 Merge tag 'auxdisplay-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay Pull auxdisplay fixes from Andy Shevchenko: - Fix NULL dereference in linedisp_release() - Fix ht16k33 DT bindings to avoid warnings - Handle errors in I²C transfers in lcd2s driver * tag 'auxdisplay-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay: auxdisplay: line-display: fix NULL dereference in linedisp_release auxdisplay: lcd2s: add error handling for i2c transfers dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning commit ec7067e661193403a7a00980bda8612db5954142 Author: Dimitri Daskalakis Date: Wed Apr 1 09:28:48 2026 -0700 eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64 On systems with 64K pages, RX queues will be wedged if users set the descriptor count to the current minimum (16). Fbnic fragments large pages into 4K chunks, and scales down the ring size accordingly. With 64K pages and 16 descriptors, the ring size mask is 0 and will never be filled. 32 descriptors is another special case that wedges the RX rings. Internally, the rings track pages for the head/tail pointers, not page fragments. So with 32 descriptors, there's only 1 usable page as one ring slot is kept empty to disambiguate between an empty/full ring. As a result, the head pointer never advances and the HW stalls after consuming 16 page fragments. Fixes: 0cb4c0a13723 ("eth: fbnic: Implement Rx queue alloc/start/stop/free") Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260401162848.2335350-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit 3a359bf5c61d52e7f09754108309d637532164a6 Author: Ruide Cao Date: Thu Apr 2 23:12:31 2026 +0800 batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc(). The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs. Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field. Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Ruide Cao Signed-off-by: Ren Wei Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 4e453375561fc60820e6b9d8ebeb6b3ee177d42e Author: Eric Dumazet Date: Wed Apr 1 15:47:21 2026 +0000 ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headroom decisions. (lines 1448-1466, especially 1463-1465) - `net/ipv6/ip6_output.c:__ip6_make_skb()`: - Calls `ipv6_push_frag_opts()` if `opt->opt_flen` is non-zero. (lines 1930-1934) - `net/ipv6/exthdrs.c:ipv6_push_frag_opts()` / `ipv6_push_exthdr()`: - Push size comes from `ipv6_optlen(opt->dst1opt)` (based on the pointed-to header). (lines 1179-1185 and 1206-1211) 1. `opt_flen` is a 16-bit accumulator: - `include/net/ipv6.h:298` defines `__u16 opt_flen; /* after fragment hdr */`. 2. `ip6_datagram_send_ctl()` accepts *repeated* `IPV6_DSTOPTS` cmsgs and increments `opt_flen` each time: - In `net/ipv6/datagram.c:909-933`, for `IPV6_DSTOPTS`: - It computes `len = ((hdr->hdrlen + 1) << 3);` - It checks `CAP_NET_RAW` using `ns_capable(net->user_ns, CAP_NET_RAW)`. (line 922) - Then it does: - `opt->opt_flen += len;` (line 927) - `opt->dst1opt = hdr;` (line 928) There is no duplicate rejection here (unlike the legacy `IPV6_2292DSTOPTS` path which rejects duplicates at `net/ipv6/datagram.c:901-904`). If enough large `IPV6_DSTOPTS` cmsgs are provided, `opt_flen` wraps while `dst1opt` still points to a large (2048-byte) destination-options header. In the attached PoC (`poc.c`): - 32 cmsgs with `hdrlen=255` => `len = (255+1)*8 = 2048` - 1 cmsg with `hdrlen=0` => `len = 8` - Total increment: `32*2048 + 8 = 65544`, so `(__u16)opt_flen == 8` - The last cmsg is 2048 bytes, so `dst1opt` points to a 2048-byte header. 3. The transmit path sizes headers using the wrapped `opt_flen`: - In `net/ipv6/ip6_output.c:1463-1465`: - `headersize = sizeof(struct ipv6hdr) + (opt ? opt->opt_flen + opt->opt_nflen : 0) + ...;` With wrapped `opt_flen`, `headersize`/headroom decisions underestimate what will be pushed later. 4. When building the final skb, the actual push length comes from `dst1opt` and is not limited by wrapped `opt_flen`: - In `net/ipv6/ip6_output.c:1930-1934`: - `if (opt->opt_flen) proto = ipv6_push_frag_opts(skb, opt, proto);` - In `net/ipv6/exthdrs.c:1206-1211`, `ipv6_push_frag_opts()` pushes `dst1opt` via `ipv6_push_exthdr()`. - In `net/ipv6/exthdrs.c:1179-1184`, `ipv6_push_exthdr()` does: - `skb_push(skb, ipv6_optlen(opt));` - `memcpy(h, opt, ipv6_optlen(opt));` With insufficient headroom, `skb_push()` underflows and triggers `skb_under_panic()` -> `BUG()`: - `net/core/skbuff.c:2669-2675` (`skb_push()` calls `skb_under_panic()`) - `net/core/skbuff.c:207-214` (`skb_panic()` ends in `BUG()`) - The `IPV6_DSTOPTS` cmsg path requires `CAP_NET_RAW` in the target netns user namespace (`ns_capable(net->user_ns, CAP_NET_RAW)`). - Root (or any task with `CAP_NET_RAW`) can trigger this without user namespaces. - An unprivileged `uid=1000` user can trigger this if unprivileged user namespaces are enabled and it can create a userns+netns to obtain namespaced `CAP_NET_RAW` (the attached PoC does this). - Local denial of service: kernel BUG/panic (system crash). - Reproducible with a small userspace PoC. This patch does not reject duplicated options, as this might break some user applications. Instead, it makes sure to adjust opt_flen and opt_nflen to correctly reflect the size of the current option headers, preventing the overflows and the potential for panics. This applies to IPV6_DSTOPTS, IPV6_HOPOPTS, and IPV6_RTHDR. Specifically: When a new IPV6_DSTOPTS is processed, the length of the old opt->dst1opt is subtracted from opt->opt_flen before adding the new length. When a new IPV6_HOPOPTS is processed, the length of the old opt->dst0opt is subtracted from opt->opt_nflen. When a new Routing Header (IPV6_RTHDR or IPV6_2292RTHDR) is processed, the length of the old opt->srcrt is subtracted from opt->opt_nflen. In the special case within IPV6_2292RTHDR handling where dst1opt is moved to dst0opt, the length of the old opt->dst0opt is subtracted from opt->opt_nflen before the new one is added. Fixes: 333fad5364d6 ("[IPV6]: Support several new sockopt / ancillary data in Advanced API (RFC3542).") Reported-by: Yiming Qian Closes: https://lore.kernel.org/netdev/CAL_bE8JNzawgr5OX5m+3jnQDHry2XxhQT5=jThW1zDPtUikRYA@mail.gmail.com/ Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260401154721.3740056-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit be193568bef72c21dc7608ef7bf6232bcf091439 Merge: b18c833888742c 2e3514e63bfb0e Author: Jakub Kicinski Date: Thu Apr 2 08:23:55 2026 -0700 Merge branch 'net-hsr-fixes-for-prp-duplication-and-vlan-unwind' Luka Gejak says: ==================== net: hsr: fixes for PRP duplication and VLAN unwind This series addresses two logic bugs in the HSR/PRP implementation identified during a protocol audit. These are targeted for the 'net' tree as they fix potential memory corruption and state inconsistency. The primary change resolves a race condition in the node merging path by implementing address-based lock ordering. This ensures that concurrent mutations of sequence blocks do not lead to state corruption or deadlocks. An additional fix corrects asymmetric VLAN error unwinding by implementing a centralized unwind path on slave errors. ==================== Link: https://patch.msgid.link/20260401092243.52121-1-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski commit 2e3514e63bfb0e972b1f19668547a455d0129e88 Author: Luka Gejak Date: Wed Apr 1 11:22:43 2026 +0200 net: hsr: fix VLAN add unwind on slave errors When vlan_vid_add() fails for a secondary slave, the error path calls vlan_vid_del() on the failing port instead of the peer slave that had already succeeded. This results in asymmetric VLAN state across the HSR pair. Fix this by switching to a centralized unwind path that removes the VID from any slave device that was already programmed. Fixes: 1a8a63a5305e ("net: hsr: Add VLAN CTAG filter support") Signed-off-by: Luka Gejak Link: https://patch.msgid.link/20260401092243.52121-3-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski commit f5df2990c364d1ac596d24b3118dbc56503f7cd4 Author: Luka Gejak Date: Wed Apr 1 11:22:42 2026 +0200 net: hsr: serialize seq_blocks merge across nodes During node merging, hsr_handle_sup_frame() walks node_curr->seq_blocks to update node_real without holding node_curr->seq_out_lock. This allows concurrent mutations from duplicate registration paths, risking inconsistent state or XArray/bitmap corruption. Fix this by locking both nodes' seq_out_lock during the merge. To prevent ABBA deadlocks, locks are acquired in order of memory address. Reviewed-by: Felix Maurer Fixes: 415e6367512b ("hsr: Implement more robust duplicate discard for PRP") Signed-off-by: Luka Gejak Link: https://patch.msgid.link/20260401092243.52121-2-luka.gejak@linux.dev Signed-off-by: Jakub Kicinski commit b18c833888742ca9de80c250f9d40d0e97caa9f6 Author: Stefano Garzarella Date: Wed Apr 1 11:21:53 2026 +0200 vsock: initialize child_ns_mode_locked in vsock_net_init() The `child_ns_mode_locked` field lives in `struct net`, which persists across vsock module reloads. When the module is unloaded and reloaded, `vsock_net_init()` resets `mode` and `child_ns_mode` back to their default values, but does not reset `child_ns_mode_locked`. The stale lock from the previous module load causes subsequent writes to `child_ns_mode` to silently fail: `vsock_net_set_child_mode()` sees the old lock, skips updating the actual value, and returns success when the requested mode matches the stale lock. The sysctl handler reports no error, but `child_ns_mode` remains unchanged. Steps to reproduce: $ modprobe vsock $ echo local > /proc/sys/net/vsock/child_ns_mode $ cat /proc/sys/net/vsock/child_ns_mode local $ modprobe -r vsock $ modprobe vsock $ echo local > /proc/sys/net/vsock/child_ns_mode $ cat /proc/sys/net/vsock/child_ns_mode global <--- expected "local" Fix this by initializing `child_ns_mode_locked` to 0 (unlocked) in `vsock_net_init()`, so the write-once mechanism works correctly after module reload. Fixes: 102eab95f025 ("vsock: lock down child_ns_mode as write-once") Reported-by: Jin Liu Signed-off-by: Stefano Garzarella Reviewed-by: Bobby Eshleman Link: https://patch.msgid.link/20260401092153.28462-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit d78ceee1e6205ffcd84ff581ccb40a008d39136f Author: Askar Safin Date: Tue Mar 24 08:29:28 2026 +0000 .get_maintainer.ignore: add myself I don't want get_maintainer.pl to automatically print my email. Signed-off-by: Askar Safin Link: https://patch.msgid.link/20260324082928.3473789-1-safinaskar@gmail.com Signed-off-by: Greg Kroah-Hartman commit f9b88613ff402aa6fe8fd020573cb95867ae947e Author: Ivan Vera Date: Fri Mar 27 13:16:45 2026 +0000 nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Buffer size used in dma allocation and memcpy is wrong. It can lead to undersized DMA buffer access and possible memory corruption. use correct buffer size in dma_alloc_coherent and memcpy. Fixes: 737c0c8d07b5 ("nvmem: zynqmp_nvmem: Add support to access efuse") Cc: stable@vger.kernel.org Signed-off-by: Ivan Vera Signed-off-by: Harish Ediga Signed-off-by: Harsh Jain Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131645.3025781-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 48b5163c957548f5854f14c90bfdedc33afbea3c Author: Christian Eggers Date: Fri Mar 27 13:16:44 2026 +0000 nvmem: imx: assign nvmem_cell_info::raw_len Avoid getting error messages at startup like the following on i.MX6ULL: nvmem imx-ocotp0: cell mac-addr raw len 6 unaligned to nvmem word size 4 nvmem imx-ocotp0: cell mac-addr raw len 6 unaligned to nvmem word size 4 This shouldn't cause any functional change as this alignment would otherwise be done in nvmem_cell_info_to_nvmem_cell_entry_nodup(). Cc: stable@vger.kernel.org Fixes: 13bcd440f2ff ("nvmem: core: verify cell's raw_len") Signed-off-by: Christian Eggers Signed-off-by: Fabio Estevam Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260327131645.3025781-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 70f73562d278d9f88e7095e327f2a50082a82c65 Author: Xiang Mei Date: Mon Mar 30 22:02:17 2026 -0700 selftests/tc-testing: add tests for cls_fw and cls_flow on shared blocks Regression tests for the shared-block NULL derefs fixed in the previous two patches: - fw: attempt to attach an empty fw filter to a shared block and verify the configuration is rejected with EINVAL. - flow: create a flow filter on a shared block without a baseclass and verify the configuration is rejected with EINVAL. Signed-off-by: Xiang Mei Acked-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Link: https://patch.msgid.link/20260331050217.504278-3-xmei5@asu.edu Signed-off-by: Paolo Abeni commit 1a280dd4bd1d616a01d6ffe0de284c907b555504 Author: Xiang Mei Date: Mon Mar 30 22:02:16 2026 -0700 net/sched: cls_flow: fix NULL pointer dereference on shared blocks flow_change() calls tcf_block_q() and dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NULL, causing a NULL deref when a flow filter without a fully qualified baseclass is created on a shared block. Check tcf_block_shared() before accessing block->q and return -EINVAL for shared blocks. This avoids the null-deref shown below: ======================================================================= KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:flow_change (net/sched/cls_flow.c:508) Call Trace: tc_new_tfilter (net/sched/cls_api.c:2432) rtnetlink_rcv_msg (net/core/rtnetlink.c:6980) [...] ======================================================================= Fixes: 1abf272022cf ("net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260331050217.504278-2-xmei5@asu.edu Signed-off-by: Paolo Abeni commit faeea8bbf6e958bf3c00cb08263109661975987c Author: Xiang Mei Date: Mon Mar 30 22:02:15 2026 -0700 net/sched: cls_fw: fix NULL pointer dereference on shared blocks The old-method path in fw_classify() calls tcf_block_q() and dereferences q->handle. Shared blocks leave block->q NULL, causing a NULL deref when an empty cls_fw filter is attached to a shared block and a packet with a nonzero major skb mark is classified. Reject the configuration in fw_change() when the old method (no TCA_OPTIONS) is used on a shared block, since fw_classify()'s old-method path needs block->q which is NULL for shared blocks. The fixed null-ptr-deref calling stack: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:fw_classify (net/sched/cls_fw.c:81) Call Trace: tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860) tc_run (net/core/dev.c:4401) __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790) Fixes: 1abf272022cf ("net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260331050217.504278-1-xmei5@asu.edu Signed-off-by: Paolo Abeni commit 6a502776f4a4f80fb839b22f12aeaf0267fca344 Author: Xingjing Deng Date: Sat Jan 31 14:55:39 2026 +0800 misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe In the SDSP probe path, qcom_scm_assign_mem() is used to assign the reserved memory to the configured VMIDs, but its return value was not checked. Fail the probe if the SCM call fails to avoid continuing with an unexpected/incorrect memory permission configuration. This issue was found by an in-house analysis workflow that extracts AST-based information and runs static checks, with LLM assistance for triage, and was confirmed by manual code review. No hardware testing was performed. Fixes: c3c0363bc72d4 ("misc: fastrpc: support complete DMA pool access to the DSP") Cc: stable@vger.kernel.org # 6.11-rc1 Signed-off-by: Xingjing Deng Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260131065539.2124047-1-xjdeng@buaa.edu.cn Signed-off-by: Greg Kroah-Hartman commit ba2c83167b215da30fa2aae56b140198cf8d8408 Author: Xingjing Deng Date: Fri Jan 30 07:41:40 2026 +0800 misc: fastrpc: possible double-free of cctx->remote_heap fastrpc_init_create_static_process() may free cctx->remote_heap on the err_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove() frees cctx->remote_heap again if it is non-NULL, which can lead to a double-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg device is subsequently removed/unbound. Clear cctx->remote_heap after freeing it in the error path to prevent the later cleanup from freeing it again. This issue was found by an in-house analysis workflow that extracts AST-based information and runs static checks, with LLM assistance for triage, and was confirmed by manual code review. No hardware testing was performed. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@vger.kernel.org # 6.2+ Signed-off-by: Xingjing Deng Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260129234140.410983-1-xjdeng@buaa.edu.cn Signed-off-by: Greg Kroah-Hartman commit 93853512f565e625df2397f0d8050d6aafd7c3ad Author: Deepanshu Kartikey Date: Mon Mar 9 16:18:59 2026 +0530 comedi: dt2815: add hardware detection to prevent crash The dt2815 driver crashes when attached to I/O ports without actual hardware present. This occurs because syzkaller or users can attach the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl. When no hardware exists at the specified port, inb() operations return 0xff (floating bus), but outb() operations can trigger page faults due to undefined behavior, especially under race conditions: BUG: unable to handle page fault for address: 000000007fffff90 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:dt2815_attach+0x6e0/0x1110 Add hardware detection by reading the status register before attempting any write operations. If the read returns 0xff, assume no hardware is present and fail the attach with -ENODEV. This prevents crashes from outb() operations on non-existent hardware. Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com Cc: stable Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc Tested-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com Reviewed-by: Ian Abbott Signed-off-by: Deepanshu Kartikey Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/] Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/ Link: https://patch.msgid.link/20260309104859.503529-1-kartikey406@gmail.com Signed-off-by: Greg Kroah-Hartman commit 29f644f14b89e6c4965e3c89251929e451190a66 Author: Edward Adam Davis Date: Tue Mar 10 11:11:04 2026 +0000 comedi: runflags cannot determine whether to reclaim chanlist syzbot reported a memory leak [1], because commit 4e1da516debb ("comedi: Add reference counting for Comedi command handling") did not consider the exceptional exit case in do_cmd_ioctl() where runflags is not set. This caused chanlist not to be properly freed by do_become_nonbusy(), as it only frees chanlist when runflags is correctly set. Added a check in do_become_nonbusy() for the case where runflags is not set, to properly free the chanlist memory. [1] BUG: memory leak backtrace (crc 844a0efa): __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline] do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890 do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline] Fixes: 4e1da516debb ("comedi: Add reference counting for Comedi command handling") Reported-by: syzbot+f238baf6ded841b5a82e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f238baf6ded841b5a82e Signed-off-by: Edward Adam Davis Reviewed-by: Ian Abbott Cc: stable # 6.19 Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260310111104.70959-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 4b9a9a6d71e3e252032f959fb3895a33acb5865c Author: Ian Abbott Date: Wed Feb 25 13:24:27 2026 +0000 comedi: Reinit dev->spinlock between attachments to low-level drivers `struct comedi_device` is the main controlling structure for a COMEDI device created by the COMEDI subsystem. It contains a member `spinlock` containing a spin-lock that is initialized by the COMEDI subsystem, but is reserved for use by a low-level driver attached to the COMEDI device (at least since commit 25436dc9d84f ("Staging: comedi: remove RT code")). Some COMEDI devices (those created on initialization of the COMEDI subsystem when the "comedi.comedi_num_legacy_minors" parameter is non-zero) can be attached to different low-level drivers over their lifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in inconsistent lock states being reported when there is a mismatch in the spin-lock locking levels used by each low-level driver to which the COMEDI device has been attached. Fix it by reinitializing `dev->spinlock` before calling the low-level driver's `attach` function pointer if `CONFIG_LOCKDEP` is enabled. Reported-by: syzbot+cc9f7f4a7df09f53c4a4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cc9f7f4a7df09f53c4a4 Fixes: ed9eccbe8970 ("Staging: add comedi core") Cc: stable Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260225132427.86578-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit cc797d4821c754c701d9714b58bea947e31dbbe0 Author: Ian Abbott Date: Thu Feb 5 14:01:30 2026 +0000 comedi: me_daq: Fix potential overrun of firmware buffer `me2600_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards. Although it checks that the supplied firmware is at least 16 bytes long, it does not check that it is long enough to contain the data stream. Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`. Fixes: 85acac61096f9 ("Staging: comedi: add me_daq driver") Cc: stable Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260205140130.76697-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7 Author: Ian Abbott Date: Thu Feb 5 13:39:49 2026 +0000 comedi: me4000: Fix potential overrun of firmware buffer `me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards. Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`. Note: The firmware loading was totally broken before commit ac584af59945 ("staging: comedi: me4000: fix firmware downloading"), but that is the most sensible target for this fix. Fixes: ac584af59945 ("staging: comedi: me4000: fix firmware downloading") Cc: stable Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260205133949.71722-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 101ab946b79ad83b36d5cfd47de587492a80acf0 Author: Ian Abbott Date: Wed Jan 28 15:00:10 2026 +0000 comedi: ni_atmio16d: Fix invalid clean-up after failed attach If the driver's COMEDI "attach" handler function (`atmio16d_attach()`) returns an error, the COMEDI core will call the driver's "detach" handler function (`atmio16d_detach()`) to clean up. This calls `reset_atmio16d()` unconditionally, but depending on where the error occurred in the attach handler, the device may not have been sufficiently initialized to call `reset_atmio16d()`. It uses `dev->iobase` as the I/O port base address and `dev->private` as the pointer to the COMEDI device's private data structure. `dev->iobase` may still be set to its initial value of 0, which would result in undesired writes to low I/O port addresses. `dev->private` may still be `NULL`, which would result in null pointer dereferences. Fix `atmio16d_detach()` by checking that `dev->private` is valid (non-null) before calling `reset_atmio16d()`. This implies that `dev->iobase` was set correctly since that is set up before `dev->private`. Fixes: 2323b276308a ("Staging: comedi: add ni_at_atmio16d driver") Cc: stable Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260128150011.5006-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit d1857f8296dceb75d00ab857fc3c61bc00c7f5c6 Author: Adam Crosser Date: Tue Mar 17 19:25:28 2026 +0700 gpib: fix use-after-free in IO ioctl handlers The IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers use a gpib_descriptor pointer after board->big_gpib_mutex has been released. A concurrent IBCLOSEDEV ioctl can free the descriptor via close_dev_ioctl() during this window, causing a use-after-free. The IO handlers (read_ioctl, write_ioctl, command_ioctl) explicitly release big_gpib_mutex before calling their handler. wait_ioctl() is called with big_gpib_mutex held, but ibwait() releases it internally when wait_mask is non-zero. In all four cases, the descriptor pointer obtained from handle_to_descriptor() becomes unprotected. Fix this by introducing a kernel-only descriptor_busy reference count in struct gpib_descriptor. Each handler atomically increments descriptor_busy under file_priv->descriptors_mutex before releasing the lock, and decrements it when done. close_dev_ioctl() checks descriptor_busy under the same lock and rejects the close with -EBUSY if the count is non-zero. A reference count rather than a simple flag is necessary because multiple handlers can operate on the same descriptor concurrently (e.g. IBRD and IBWAIT on the same handle from different threads). A separate counter is needed because io_in_progress can be cleared from unprivileged userspace via the IBWAIT ioctl (through general_ibstatus() with set_mask containing CMPL), which would allow an attacker to bypass a check based solely on io_in_progress. The new descriptor_busy counter is only modified by the kernel IO paths. The lock ordering is consistent (big_gpib_mutex -> descriptors_mutex) and the handlers only hold descriptors_mutex briefly during the lookup, so there is no deadlock risk and no impact on IO throughput. Signed-off-by: Adam Crosser Cc: stable Reviewed-by: Dave Penkler Tested-by: Dave Penkler Signed-off-by: Greg Kroah-Hartman commit 5cefb52c1af6f69ea719e42788f6ec6a087eb74c Author: Johan Hovold Date: Tue Mar 10 11:51:27 2026 +0100 gpib: lpvo_usb: fix memory leak on disconnect The driver iterates over the registered USB interfaces during GPIB attach and takes a reference to their USB devices until a match is found. These references are never released which leads to a memory leak when devices are disconnected. Fix the leak by dropping the unnecessary references. Fixes: fce79512a96a ("staging: gpib: Add LPVO DIY USB GPIB driver") Cc: stable # 6.13 Cc: Dave Penkler Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260310105127.17538-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 579af7204d762587f9cce0d6236a710a771f1f6f Author: Dave Penkler Date: Mon Feb 2 10:47:55 2026 +0100 gpib: Fix fluke driver s390 compile issue The following errors were reported for a s390 randconfig build of the fluke gpib driver: >> drivers/gpib/eastwood/fluke_gpib.c:1002:23: error: call to undeclared function 'ioremap'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1002 | nec_priv->mmiobase = ioremap(e_priv->gpib_iomem_res->start, | ^ >> drivers/gpib/eastwood/fluke_gpib.c:1002:21: error: incompatible integer to pointer conversion assigning to 'void *' from 'int' [-Wint-conversion] 1002 | nec_priv->mmiobase = ioremap(e_priv->gpib_iomem_res->start, | ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1003 | resource_size(e_priv->gpib_iomem_res)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpib/eastwood/fluke_gpib.c:1036:33: error: incompatible integer to pointer conversion assigning to 'void *' from 'int' [-Wint-conversion] 1036 | e_priv->write_transfer_counter = ioremap(e_priv->write_transfer_counter_res->start, | ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1037 | resource_size(e_priv->write_transfer_counter_res)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Add HAS_IOMEM dependency to Kconfig for fluke driver option Suggested-by: Arnd Bergmann Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601221748.AFAqHieJ-lkp@intel.com/ Fixes: baf8855c9160 ("staging: gpib: fix address space mixup") Cc: stable Signed-off-by: Dave Penkler Link: https://patch.msgid.link/20260202094755.4259-1-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit dbde07f06226438cd2cf1179745fa1bec5d8914a Author: Ian Rogers Date: Thu Mar 12 12:43:05 2026 -0700 perf/x86: Fix potential bad container_of in intel_pmu_hw_config Auto counter reload may have a group of events with software events present within it. The software event PMU isn't the x86_hybrid_pmu and a container_of operation in intel_pmu_set_acr_caused_constr (via the hybrid helper) could cause out of bound memory reads. Avoid this by guarding the call to intel_pmu_set_acr_caused_constr with an is_x86_event check. Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload") Signed-off-by: Ian Rogers Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Thomas Falcon Link: https://patch.msgid.link/20260312194305.1834035-1-irogers@google.com commit e08d007f9d813616ce7093600bc4fdb9c9d81d89 Author: Peter Zijlstra Date: Wed Apr 1 15:20:21 2026 +0200 sched/debug: Fix avg_vruntime() usage John reported that stress-ng-yield could make his machine unhappy and managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking"). The commit in question changes avg_vruntime() from a function that is a pure reader, to a function that updates variables. This turns an unlocked sched/debug usage of this function from a minor mistake into a data corruptor. Fixes: af4cf40470c2 ("sched/fair: Add cfs_rq::avg_vruntime") Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking") Reported-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Tested-by: K Prateek Nayak Tested-by: John Stultz Link: https://patch.msgid.link/20260401132355.196370805@infradead.org commit 1319ea57529e131822bab56bf417c8edc2db9ae8 Author: Peter Zijlstra Date: Wed Apr 1 15:20:20 2026 +0200 sched/fair: Fix zero_vruntime tracking fix John reported that stress-ng-yield could make his machine unhappy and managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking"). The combination of yield and that commit was specific enough to hypothesize the following scenario: Suppose we have 2 runnable tasks, both doing yield. Then one will be eligible and one will not be, because the average position must be in between these two entities. Therefore, the runnable task will be eligible, and be promoted a full slice (all the tasks do is yield after all). This causes it to jump over the other task and now the other task is eligible and current is no longer. So we schedule. Since we are runnable, there is no {de,en}queue. All we have is the __{en,de}queue_entity() from {put_prev,set_next}_task(). But per the fingered commit, those two no longer move zero_vruntime. All that moves zero_vruntime are tick and full {de,en}queue. This means, that if the two tasks playing leapfrog can reach the critical speed to reach the overflow point inside one tick's worth of time, we're up a creek. Additionally, when multiple cgroups are involved, there is no guarantee the tick will in fact hit every cgroup in a timely manner. Statistically speaking it will, but that same statistics does not rule out the possibility of one cgroup not getting a tick for a significant amount of time -- however unlikely. Therefore, just like with the yield() case, force an update at the end of every slice. This ensures the update is never more than a single slice behind and the whole thing is within 2 lag bounds as per the comment on entity_key(). Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking") Reported-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Tested-by: K Prateek Nayak Tested-by: John Stultz Link: https://patch.msgid.link/20260401132355.081530332@infradead.org commit a80a014f83bded5a2f498c22b4a06a7a31256f98 Merge: 9351edf65cb6ba a1822cb524e89b Author: Paolo Abeni Date: Thu Apr 2 13:36:10 2026 +0200 Merge branch 'net-x25-fix-overflow-and-double-free' Martin Schiller says: ==================== net/x25: Fix overflow and double free This patch set includes 2 fixes: The first removes a potential double free of received skb The second fixes an overflow when accumulating packets with the more-bit set. Signed-off-by: Martin Schiller ==================== Link: https://patch.msgid.link/20260331-x25_fraglen-v4-0-3e69f18464b4@dev.tdt.de Signed-off-by: Paolo Abeni commit a1822cb524e89b4cd2cf0b82e484a2335496a6d9 Author: Martin Schiller Date: Tue Mar 31 09:43:18 2026 +0200 net/x25: Fix overflow when accumulating packets Add a check to ensure that `x25_sock.fraglen` does not overflow. The `fraglen` also needs to be resetted when purging `fragment_queue` in `x25_clear_queues()`. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Yiming Qian Signed-off-by: Martin Schiller Link: https://patch.msgid.link/20260331-x25_fraglen-v4-2-3e69f18464b4@dev.tdt.de Signed-off-by: Paolo Abeni commit d10a26aa4d072320530e6968ef945c8c575edf61 Author: Martin Schiller Date: Tue Mar 31 09:43:17 2026 +0200 net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error). This error propagates back through the call chain: x25_queue_rx_frame returns 1 | v x25_state3_machine receives the return value 1 and takes the else branch at line 278, setting queued=0 and returning 0 | v x25_process_rx_frame returns queued=0 | v x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb) again This would free the same skb twice. Looking at x25_backlog_rcv: net/x25/x25_in.c:x25_backlog_rcv() { ... queued = x25_process_rx_frame(sk, skb); ... if (!queued) kfree_skb(skb); } Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Martin Schiller Link: https://patch.msgid.link/20260331-x25_fraglen-v4-1-3e69f18464b4@dev.tdt.de Signed-off-by: Paolo Abeni commit bf3781a35c27978341c31f59f1460dcaabf2e726 Merge: 4e0a88254ad59f e8d0ed37bd51da Author: Greg Kroah-Hartman Date: Thu Apr 2 13:28:22 2026 +0200 Merge tag 'usb-serial-7.0-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial device ids for 7.0-rc7 Here are some new modem and io_edgeport device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-7.0-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add MeiG Smart SRM825WN USB: serial: io_edgeport: add support for Blackbox IC135A USB: serial: option: add support for Rolling Wireless RW135R-GL commit 338c56050d8e892604da97f67bfa8cc4015a955f Author: Maíra Canal Date: Mon Mar 30 14:51:46 2026 -0300 drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock The mmap callback reads bo->madv without holding madv_lock, racing with concurrent DRM_IOCTL_VC4_GEM_MADVISE calls that modify the field under the same lock. Add the missing locking to prevent the data race. Fixes: b9f19259b84d ("drm/vc4: Add the DRM_IOCTL_VC4_GEM_MADVISE ioctl") Reviewed-by: Melissa Wen Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-4-92defc940a29@igalia.com Signed-off-by: Maíra Canal commit 9525d169e5fd481538cf8c663cc5839e54f2e481 Author: Maíra Canal Date: Mon Mar 30 14:51:45 2026 -0300 drm/vc4: Fix a memory leak in hang state error path When vc4_save_hang_state() encounters an early return condition, it returns without freeing the previously allocated `kernel_state`, leaking memory. Add the missing kfree() calls by consolidating the early return paths into a single place. Fixes: 214613656b51 ("drm/vc4: Add an interface for capturing the GPU state after a hang.") Reviewed-by: Melissa Wen Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-3-92defc940a29@igalia.com Signed-off-by: Maíra Canal commit f4dfd6847b3e5d24e336bca6057485116d17aea4 Author: Maíra Canal Date: Mon Mar 30 14:51:44 2026 -0300 drm/vc4: Fix memory leak of BO array in hang state The hang state's BO array is allocated separately with kzalloc() in vc4_save_hang_state() but never freed in vc4_free_hang_state(). Add the missing kfree() for the BO array before freeing the hang state struct. Fixes: 214613656b51 ("drm/vc4: Add an interface for capturing the GPU state after a hang.") Reviewed-by: Melissa Wen Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-2-92defc940a29@igalia.com Signed-off-by: Maíra Canal commit aaefbdde9abdc43699e110679c0e10972a5e1c59 Author: Maíra Canal Date: Mon Mar 30 14:51:43 2026 -0300 drm/vc4: Release runtime PM reference after binding V3D The vc4_v3d_bind() function acquires a runtime PM reference via pm_runtime_resume_and_get() to access V3D registers during setup. However, this reference is never released after a successful bind. This prevents the device from ever runtime suspending, since the reference count never reaches zero. Release the runtime PM reference by adding pm_runtime_put_autosuspend() after autosuspend is configured, allowing the device to runtime suspend after the delay. Fixes: 266cff37d7fc ("drm/vc4: v3d: Rework the runtime_pm setup") Reviewed-by: Melissa Wen Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-1-92defc940a29@igalia.com Signed-off-by: Maíra Canal commit 9e07e3b81807edd356e1f794cffa00a428eff443 Author: Rafael J. Wysocki Date: Wed Apr 1 16:33:53 2026 +0200 thermal: core: Fix thermal zone device registration error path If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it needs to wait for the tz->removal completion like thermal_zone_device_unregister(), in case user space has managed to take a reference to the thermal zone device's kobject, in which case thermal_release() may not be called by the error path itself and tz may be freed prematurely. Add the missing wait_for_completion() call to the thermal zone device registration error path. Fixes: 04e6ccfc93c5 ("thermal: core: Fix NULL pointer dereference in zone registration error path") Signed-off-by: Rafael J. Wysocki Cc: All applicable Reviewed-by: Lukasz Luba Tested-by: Lukasz Luba Link: https://patch.msgid.link/2849815.mvXUDI8C0e@rafael.j.wysocki commit 4e0a88254ad59f6c53a34bf5fa241884ec09e8b2 Author: Michael Zimmermann Date: Tue Mar 31 20:48:44 2026 +0200 usb: gadget: f_hid: move list and spinlock inits from bind to alloc There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in EPOLL_CTL_ADD - unbind the UDC - bind the UDC - use the fd in EPOLL_CTL_DEL When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported within remove_wait_queue (via ep_remove_wait_queue). After some debugging I found out that the queues, which f_hid registers via poll_wait were the problem. These were initialized using init_waitqueue_head inside hidg_bind. So effectively, the bind function re-initialized the queues while there were still items in them. The solution is to move the initialization from hidg_bind to hidg_alloc to extend their lifetimes to the lifetime of the function instance. Additionally, I found many other possibly problematic init calls in the bind function, which I moved as well. Signed-off-by: Michael Zimmermann Cc: stable Link: https://patch.msgid.link/20260331184844.2388761-1-sigmaepsilon92@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5abbe6ecc6203355c770bf232ade88e29c960049 Author: Guan-Yu Lin Date: Wed Apr 1 12:32:18 2026 +0000 usb: host: xhci-sideband: delegate offload_usage tracking to class drivers Remove usb_offload_get() and usb_offload_put() from the xHCI sideband interrupter creation and removal paths. The responsibility of manipulating offload_usage now lies entirely with the USB class drivers. They have the precise context of when an offload data stream actually starts and stops, ensuring a much more accurate representation of offload activity for power management. Cc: stable Fixes: ef82a4803aab ("xhci: sideband: add api to trace sideband usage") Signed-off-by: Guan-Yu Lin Tested-by: Hailong Liu Tested-by: hailong.liu@oppo.com Acked-by: Mathias Nyman Link: https://patch.msgid.link/20260401123238.3790062-3-guanyulin@google.com Signed-off-by: Greg Kroah-Hartman commit bd3d245b0fef571f93504904df62b8865b1c0d34 Author: Guan-Yu Lin Date: Wed Apr 1 12:32:17 2026 +0000 usb: core: use dedicated spinlock for offload state Replace the coarse USB device lock with a dedicated offload_lock spinlock to reduce contention during offload operations. Use offload_pm_locked to synchronize with PM transitions and replace the legacy offload_at_suspend flag. Optimize usb_offload_get/put by switching from auto-resume/suspend to pm_runtime_get_if_active(). This ensures offload state is only modified when the device is already active, avoiding unnecessary power transitions. Cc: stable Fixes: ef82a4803aab ("xhci: sideband: add api to trace sideband usage") Signed-off-by: Guan-Yu Lin Tested-by: Hailong Liu Acked-by: Mathias Nyman Link: https://patch.msgid.link/20260401123238.3790062-2-guanyulin@google.com Signed-off-by: Greg Kroah-Hartman commit c32f8748d70c8fc77676ad92ed76cede17bf2c48 Author: Yongchao Wu Date: Wed Apr 1 08:10:00 2026 +0800 usb: cdns3: gadget: fix state inconsistency on gadget init failure When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode while software state remains INACTIVE, creating hardware/software state inconsistency. When switching to host mode via sysfs: echo host > /sys/class/usb_role/13180000.usb-role-switch/role The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, so cdns_role_stop() skips cleanup because state is still INACTIVE. This violates the DRD controller design specification (Figure22), which requires returning to idle state before switching roles. This leads to a synchronous external abort in xhci_gen_setup() when setting up the host controller: [ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 [ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget [ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed ... [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP [ 1301.382485] pc : xhci_gen_setup+0xa4/0x408 [ 1301.393391] backtrace: ... xhci_gen_setup+0xa4/0x408 <-- CRASH xhci_plat_setup+0x44/0x58 usb_add_hcd+0x284/0x678 ... cdns_role_set+0x9c/0xbc <-- Role switch Fix by calling cdns_drd_gadget_off() in the error path to properly clean up the DRD gadget state. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: stable Signed-off-by: Yongchao Wu Acked-by: Peter Chen Link: https://patch.msgid.link/20260401001000.5761-1-yongchao.wu@autochips.com Signed-off-by: Greg Kroah-Hartman commit 541288339b8cb8bb62be5ec0eab6c65e9dfc6055 Author: Xiaolei Wang Date: Wed Apr 1 21:49:38 2026 +0800 usb: dwc3: imx8mp: fix memory leak on probe failure path When platform_get_drvdata() returns NULL and probe defers, the error path jumps to the 'depopulate' label, skipping put_device() for the reference acquired by of_find_device_by_node(). This extra reference prevents the child platform device from being freed when of_platform_depopulate() is called, resulting in memory leaks reported by kmemleak: unreferenced object 0xffff0000c92c1480 (size 64): comm "kworker/u16:2", pid 50, jiffies 4294895789 backtrace (crc 49d507d0): kmemleak_alloc+0x34/0x40 __kmalloc_noprof+0x430/0x670 of_device_alloc+0xec/0x26c of_platform_device_create_pdata+0x60/0x1f0 of_platform_bus_create+0x290/0x610 of_platform_populate+0x74/0x118 dwc3_imx8mp_probe+0x228/0x734 Fixes: 86767625f525 ("usb: dwc3: imx8mp: disable auto suspend for host role") Signed-off-by: Xiaolei Wang Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260401134938.686748-1-xiaolei.wang@windriver.com Signed-off-by: Greg Kroah-Hartman commit 6e0e34d85cd46ceb37d16054e97a373a32770f6c Author: Taegu Ha Date: Thu Apr 2 04:13:11 2026 +0900 usb: gadget: f_uac1_legacy: validate control request size f_audio_complete() copies req->length bytes into a 4-byte stack variable: u32 data = 0; memcpy(&data, req->buf, req->length); req->length is derived from the host-controlled USB request path, which can lead to a stack out-of-bounds write. Validate req->actual against the expected payload size for the supported control selectors and decode only the expected amount of data. This avoids copying a host-influenced length into a fixed-size stack object. Signed-off-by: Taegu Ha Cc: stable Link: https://patch.msgid.link/20260401191311.3604898-1-hataegu0826@gmail.com Signed-off-by: Greg Kroah-Hartman commit 01af542392b5d41fd659d487015a71f627accce3 Author: Guangshuo Li Date: Wed Apr 1 10:51:42 2026 +0800 usb: ulpi: fix double free in ulpi_register_interface() error path When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable Signed-off-by: Guangshuo Li Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman commit 33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21 Author: Felix Gu Date: Tue Mar 31 20:05:08 2026 +0800 usb: misc: usbio: Fix URB memory leak on submit failure When usb_submit_urb() fails in usbio_probe(), the previously allocated URB is never freed, causing a memory leak. Fix this by jumping to err_free_urb label to properly release the URB on the error path. Fixes: 121a0f839dbb ("usb: misc: Add Intel USBIO bridge driver") Cc: stable Signed-off-by: Felix Gu Reviewed-by: Oliver Neukum Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260331-usbio-v2-1-d8c48dad9463@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8b7a42ecdcdeb55580d9345412f7f8fc5aca3f6c Author: JP Hein Date: Mon Mar 30 17:38:04 2026 -0700 USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam The Razer Kiyo Pro (1532:0e05) is a USB 3.0 UVC webcam whose firmware does not handle USB Link Power Management transitions reliably. When LPM is active, the device can enter a state where it fails to respond to control transfers, producing EPIPE (-32) errors on UVC probe control SET_CUR requests. In the worst case, the stalled endpoint triggers an xHCI stop-endpoint command that times out, causing the host controller to be declared dead and every USB device on the bus to be disconnected. This has been reported as Ubuntu Launchpad Bug #2061177. The failure mode is: 1. UVC probe control SET_CUR returns -32 (EPIPE) 2. xHCI host not responding to stop endpoint command 3. xHCI host controller not responding, assume dead 4. All USB devices on the affected xHCI controller disconnect Disabling LPM prevents the firmware from entering the problematic low- power states that precede the stall. This is the same approach used for other webcams with similar firmware issues (e.g., Logitech HD Webcam C270). Cc: stable Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2061177 Signed-off-by: JP Hein Link: https://patch.msgid.link/20260331003806.212565-2-jp@jphein.com Signed-off-by: Greg Kroah-Hartman commit 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 Author: Yongchao Wu Date: Tue Mar 31 08:04:07 2026 +0800 usb: cdns3: gadget: fix NULL pointer dereference in ep_queue When the gadget endpoint is disabled or not yet configured, the ep->desc pointer can be NULL. This leads to a NULL pointer dereference when __cdns3_gadget_ep_queue() is called, causing a kernel crash. Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the standard return code for unconfigured endpoints. This prevents potential crashes when ep_queue is called on endpoints that are not ready. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: stable Signed-off-by: Yongchao Wu Acked-by: Peter Chen Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com Signed-off-by: Greg Kroah-Hartman commit 0179c6da0793ae03607002c284b53b6d584172d0 Author: Gabor Juhos Date: Mon Mar 30 17:02:42 2026 +0200 usb: core: phy: avoid double use of 'usb3-phy' Commit 53a2d95df836 ("usb: core: add phy notify connect and disconnect") causes double use of the 'usb3-phy' in certain cases. Since that commit, if a generic PHY named 'usb3-phy' is specified in the device tree, that is getting added to the 'phy_roothub' list of the secondary HCD by the usb_phy_roothub_alloc_usb3_phy() function. However, that PHY is getting added also to the primary HCD's 'phy_roothub' list by usb_phy_roothub_alloc() if there is no generic PHY specified with 'usb2-phy' name. This causes that the usb_add_hcd() function executes each phy operations twice on the 'usb3-phy'. Once when the primary HCD is added, then once again when the secondary HCD is added. The issue affects the Marvell Armada 3700 platform at least, where a custom name is used for the USB2 PHY: $ git grep 'phy-names.*usb3' arch/arm64/boot/dts/marvell/armada-37xx.dtsi | tr '\t' ' ' arch/arm64/boot/dts/marvell/armada-37xx.dtsi: phy-names = "usb3-phy", "usb2-utmi-otg-phy"; Extend the usb_phy_roothub_alloc_usb3_phy() function to skip adding the 'usb3-phy' to the 'phy_roothub' list of the secondary HCD when 'usb2-phy' is not specified in the device tree to avoid the double use. Fixes: 53a2d95df836 ("usb: core: add phy notify connect and disconnect") Cc: stable Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20260330-usb-avoid-usb3-phy-double-use-v1-1-d2113aecb535@gmail.com Signed-off-by: Greg Kroah-Hartman commit b477ab8893c3e6b4be3074358db830687de7bfff Merge: a0dafdbd1049a8 e74c38ef6f1701 Author: Takashi Iwai Date: Thu Apr 2 09:08:03 2026 +0200 Merge tag 'asoc-fix-v7.0-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.0 Another smallish batch of fixes and quirks, these days it's AMD that is getting all the DMI entries added. We've got one core fix for a missing list initialisation with auxiliary devices, otherwise it's all fairly small things. commit f8995c2df519f382525ca4bc90553ad2ec611067 Author: Greg Kroah-Hartman Date: Tue Mar 24 17:42:51 2026 +0100 drm/ioc32: stop speculation on the drm_compat_ioctl path The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list. Fixes: 505b5240329b ("drm/ioctl: Fix Spectre v1 vulnerabilities") Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Simona Vetter Cc: stable Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Acked-by: Thomas Zimmermann Acked-by: Maxime Ripard Reviewed-by: Simona Vetter Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/2026032451-playing-rummage-8fa2@gregkh commit 9351edf65cb6ba10564f9c81e3c52cf97f4b2a81 Merge: a59dc0f871f203 071dbfa304e85a Author: Jakub Kicinski Date: Wed Apr 1 20:13:00 2026 -0700 Merge branch 'bnxt_en-bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes The first patch is a refactor patch needed by the second patch to fix XDP ring initialization during FW reset. The third patch fixes an issue related to stats context reservation for RoCE. ==================== Link: https://patch.msgid.link/20260331065138.948205-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 071dbfa304e85a6b04a593e950d18fa170997288 Author: Pavan Chebbi Date: Mon Mar 30 23:51:38 2026 -0700 bnxt_en: Restore default stat ctxs for ULP when resource is available During resource reservation, if the L2 driver does not have enough MSIX vectors to provide to the RoCE driver, it sets the stat ctxs for ULP also to 0 so that we don't have to reserve it unnecessarily. However, subsequently the user may reduce L2 rings thereby freeing up some resources that the L2 driver can now earmark for RoCE. In this case, the driver should restore the default ULP stat ctxs to make sure that all RoCE resources are ready for use. The RoCE driver may fail to initialize in this scenario without this fix. Fixes: d630624ebd70 ("bnxt_en: Utilize ulp client resources if RoCE is not registered") Reviewed-by: Kalesh AP Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20260331065138.948205-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit e4bf81dcad0a6fff2bbe5331d2c7fb30d45a788c Author: Michael Chan Date: Mon Mar 30 23:51:37 2026 -0700 bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() The original code made the assumption that when we set up the initial default ring mode, we must be just loading the driver and XDP cannot be enabled yet. This is not true when the FW goes through a resource or capability change. Resource reservations will be cancelled and reinitialized with XDP already enabled. devlink reload with XDP enabled will also have the same issue. This scenario will cause the ring arithmetic to be all wrong in the bnxt_init_dflt_ring_mode() path causing failure: bnxt_en 0000:a1:00.0 ens2f0np0: bnxt_setup_int_mode err: ffffffea bnxt_en 0000:a1:00.0 ens2f0np0: bnxt_request_irq err: ffffffea bnxt_en 0000:a1:00.0 ens2f0np0: nic open fail (rc: ffffffea) Fix it by properly accounting for XDP in the bnxt_init_dflt_ring_mode() path by using the refactored helper functions in the previous patch. Reviewed-by: Andy Gospodarek Reviewed-by: Pavan Chebbi Reviewed-by: Kalesh AP Fixes: ec5d31e3c15d ("bnxt_en: Handle firmware reset status during IF_UP.") Fixes: 228ea8c187d8 ("bnxt_en: implement devlink dev reload driver_reinit") Signed-off-by: Michael Chan Link: https://patch.msgid.link/20260331065138.948205-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit ceee35e5674aa84cf9e504c2a9dae4587511556c Author: Michael Chan Date: Mon Mar 30 23:51:36 2026 -0700 bnxt_en: Refactor some basic ring setup and adjustment logic Refactor out the basic code that trims the default rings, sets up and adjusts XDP TX rings and CP rings. There is no change in behavior. This is to prepare for the next bug fix patch. Reviewed-by: Kalesh AP Reviewed-by: Pavan Chebbi Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan Link: https://patch.msgid.link/20260331065138.948205-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit a59dc0f871f203f979744b2c414cbc32faed6f48 Merge: f0f367a4f459cc 403186400a1a61 Author: Jakub Kicinski Date: Wed Apr 1 20:10:46 2026 -0700 Merge branch 'mlx5-misc-fixes-2026-03-30' Tariq Toukan says: ==================== mlx5 misc fixes 2026-03-30 This patchset provides misc bug fixes from the team to the mlx5 core driver. ==================== Link: https://patch.msgid.link/20260330194015.53585-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 403186400a1a6166efe7031edc549c15fee4723f Author: Saeed Mahameed Date: Mon Mar 30 22:40:15 2026 +0300 net/mlx5: Fix switchdev mode rollback in case of failure If for some internal reason switchdev mode fails, we rollback to legacy mode, before this patch, rollback will unregister the uplink netdev and leave it unregistered causing the below kernel bug. To fix this, we need to avoid netdev unregister by setting the proper rollback flag 'MLX5_PRIV_FLAGS_SWITCH_LEGACY' to indicate legacy mode. devlink (431) used greatest stack depth: 11048 bytes left mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), \ necvfs(0), active vports(0) mlx5_core 0000:00:03.0: E-Switch: Supported tc chains and prios offload mlx5_core 0000:00:03.0: Loading uplink representor for vport 65535 mlx5_core 0000:00:03.0: mlx5_cmd_out_err:816:(pid 456): \ QUERY_HCA_CAP(0x100) op_mod(0x0) failed, \ status bad parameter(0x3), syndrome (0x3a3846), err(-22) mlx5_core 0000:00:03.0 enp0s3np0 (unregistered): Unloading uplink \ representor for vport 65535 ------------[ cut here ]------------ kernel BUG at net/core/dev.c:12070! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 456 Comm: devlink Not tainted 6.16.0-rc3+ \ #9 PREEMPT(voluntary) RIP: 0010:unregister_netdevice_many_notify+0x123/0xae0 ... Call Trace: [ 90.923094] unregister_netdevice_queue+0xad/0xf0 [ 90.923323] unregister_netdev+0x1c/0x40 [ 90.923522] mlx5e_vport_rep_unload+0x61/0xc6 [ 90.923736] esw_offloads_enable+0x8e6/0x920 [ 90.923947] mlx5_eswitch_enable_locked+0x349/0x430 [ 90.924182] ? is_mp_supported+0x57/0xb0 [ 90.924376] mlx5_devlink_eswitch_mode_set+0x167/0x350 [ 90.924628] devlink_nl_eswitch_set_doit+0x6f/0xf0 [ 90.924862] genl_family_rcv_msg_doit+0xe8/0x140 [ 90.925088] genl_rcv_msg+0x18b/0x290 [ 90.925269] ? __pfx_devlink_nl_pre_doit+0x10/0x10 [ 90.925506] ? __pfx_devlink_nl_eswitch_set_doit+0x10/0x10 [ 90.925766] ? __pfx_devlink_nl_post_doit+0x10/0x10 [ 90.926001] ? __pfx_genl_rcv_msg+0x10/0x10 [ 90.926206] netlink_rcv_skb+0x52/0x100 [ 90.926393] genl_rcv+0x28/0x40 [ 90.926557] netlink_unicast+0x27d/0x3d0 [ 90.926749] netlink_sendmsg+0x1f7/0x430 [ 90.926942] __sys_sendto+0x213/0x220 [ 90.927127] ? __sys_recvmsg+0x6a/0xd0 [ 90.927312] __x64_sys_sendto+0x24/0x30 [ 90.927504] do_syscall_64+0x50/0x1c0 [ 90.927687] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 90.927929] RIP: 0033:0x7f7d0363e047 Fixes: 2a4f56fbcc47 ("net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only") Signed-off-by: Saeed Mahameed Reviewed-by: Jianbo Liu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260330194015.53585-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 10dc35f6a443d488f219d1a1e3fb8f8dac422070 Author: Saeed Mahameed Date: Mon Mar 30 22:40:14 2026 +0300 net/mlx5: Avoid "No data available" when FW version queries fail Avoid printing the misleading "kernel answers: No data available" devlink output when querying firmware or pending firmware version fails (e.g. MLX5 fw state errors / flash failures). FW can fail on loading the pending flash image and get its version due to various reasons, examples: mlxfw: Firmware flash failed: key not applicable, err (7) mlx5_fw_image_pending: can't read pending fw version while fw state is 1 and the resulting: $ devlink dev info kernel answers: No data available Instead, just report 0 or 0xfff.. versions in case of failure to indicate a problem, and let other information be shown. after the fix: $ devlink dev info pci/0000:00:06.0: driver mlx5_core serial_number xxx... board.serial_number MT2225300179 versions: fixed: fw.psid MT_0000000436 running: fw.version 22.41.0188 fw 22.41.0188 stored: fw.version 255.255.65535 fw 255.255.65535 Fixes: 9c86b07e3069 ("net/mlx5: Added fw version query command") Signed-off-by: Saeed Mahameed Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260330194015.53585-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit bf16bca6653679d8a514d6c1c5a2c67065033f14 Author: Shay Drory Date: Mon Mar 30 22:40:13 2026 +0300 net/mlx5: lag: Check for LAG device before creating debugfs __mlx5_lag_dev_add_mdev() may return 0 (success) even when an error occurs that is handled gracefully. Consequently, the initialization flow proceeds to call mlx5_ldev_add_debugfs() even when there is no valid LAG context. mlx5_ldev_add_debugfs() blindly created the debugfs directory and attributes. This exposed interfaces (like the members file) that rely on a valid ldev pointer, leading to potential NULL pointer dereferences if accessed when ldev is NULL. Add a check to verify that mlx5_lag_dev(dev) returns a valid pointer before attempting to create the debugfs entries. Fixes: 7f46a0b7327a ("net/mlx5: Lag, add debugfs to query hardware lag state") Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260330194015.53585-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit f0f367a4f459cc8118aadc43c6bba53c60d93f8d Author: Fedor Pchelkin Date: Mon Mar 30 21:45:41 2026 +0300 net: macb: properly unregister fixed rate clocks The additional resources allocated with clk_register_fixed_rate() need to be released with clk_unregister_fixed_rate(), otherwise they are lost. Fixes: 83a77e9ec415 ("net: macb: Added PCI wrapper for Platform Driver.") Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20260330184542.626619-2-pchelkin@ispras.ru Signed-off-by: Jakub Kicinski commit ce8fe5287b87e24e225c342f3b0ec04f0b3680fe Author: Fedor Pchelkin Date: Mon Mar 30 21:45:40 2026 +0300 net: macb: fix clk handling on PCI glue driver removal platform_device_unregister() may still want to use the registered clks during runtime resume callback. Note that there is a commit d82d5303c4c5 ("net: macb: fix use after free on rmmod") that addressed the similar problem of clk vs platform device unregistration but just moved the bug to another place. Save the pointers to clks into local variables for reuse after platform device is unregistered. BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597 CPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x8d/0xba print_report+0x17f/0x496 kasan_report+0xd9/0x180 clk_prepare+0x5a/0x60 macb_runtime_resume+0x13d/0x410 [macb] pm_generic_runtime_resume+0x97/0xd0 __rpm_callback+0xc8/0x4d0 rpm_callback+0xf6/0x230 rpm_resume+0xeeb/0x1a70 __pm_runtime_resume+0xb4/0x170 bus_remove_device+0x2e3/0x4b0 device_del+0x5b3/0xdc0 platform_device_del+0x4e/0x280 platform_device_unregister+0x11/0x50 pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Allocated by task 519: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x8e/0x90 __clk_register+0x458/0x2890 clk_hw_register+0x1a/0x60 __clk_hw_register_fixed_rate+0x255/0x410 clk_register_fixed_rate+0x3c/0xa0 macb_probe+0x1d8/0x42e [macb_pci] local_pci_probe+0xd7/0x190 pci_device_probe+0x252/0x600 really_probe+0x255/0x7f0 __driver_probe_device+0x1ee/0x330 driver_probe_device+0x4c/0x1f0 __driver_attach+0x1df/0x4e0 bus_for_each_dev+0x15d/0x1f0 bus_add_driver+0x486/0x5e0 driver_register+0x23a/0x3d0 do_one_initcall+0xfd/0x4d0 do_init_module+0x18b/0x5a0 load_module+0x5663/0x7950 __do_sys_finit_module+0x101/0x180 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 597: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0x106/0x180 __kmem_cache_free+0xbc/0x320 clk_unregister+0x6de/0x8d0 macb_remove+0x73/0xc0 [macb_pci] pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Fixes: d82d5303c4c5 ("net: macb: fix use after free on rmmod") Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20260330184542.626619-1-pchelkin@ispras.ru Signed-off-by: Jakub Kicinski commit b4e5f04c58a29c499faa85d12952ca9a4faf1cb9 Author: Srujana Challa Date: Thu Mar 26 19:53:44 2026 +0530 virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN rss_max_key_size in the virtio spec is the maximum key size supported by the device, not a mandatory size the driver must use. Also the value 40 is a spec minimum, not a spec maximum. The current code rejects RSS and can fail probe when the device reports a larger rss_max_key_size than the driver buffer limit. Instead, clamp the effective key length to min(device rss_max_key_size, NETDEV_RSS_KEY_LEN) and keep RSS enabled. This keeps probe working on devices that advertise larger maximum key sizes while respecting the netdev RSS key buffer size limit. Fixes: 3f7d9c1964fc ("virtio_net: Add hash_key_length check") Cc: stable@vger.kernel.org Signed-off-by: Srujana Challa Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260326142344.1171317-1-schalla@marvell.com Signed-off-by: Jakub Kicinski commit d64cb81dcbd54927515a7f65e5e24affdc73c14b Author: Yucheng Lu Date: Tue Mar 31 16:00:21 2026 +0800 net/sched: sch_netem: fix out-of-bounds access in packet corruption In netem_enqueue(), the packet corruption logic uses get_random_u32_below(skb_headlen(skb)) to select an index for modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0. Passing 0 to get_random_u32_below() takes the variable-ceil slow path which returns an unconstrained 32-bit random integer. Using this unconstrained value as an offset into skb->data results in an out-of-bounds memory access. Fix this by verifying skb_headlen(skb) is non-zero before attempting to corrupt the linear data area. Fully non-linear packets will silently bypass the corruption logic. Fixes: c865e5d99e25 ("[PKT_SCHED] netem: packet corruption option") Reported-by: Yifan Wu Reported-by: Juefei Pu Signed-off-by: Yuan Tan Signed-off-by: Xin Liu Signed-off-by: Yuhang Zheng Signed-off-by: Yucheng Lu Reviewed-by: Stephen Hemminger Link: https://patch.msgid.link/45435c0935df877853a81e6d06205ac738ec65fa.1774941614.git.kanolyc@gmail.com Signed-off-by: Jakub Kicinski commit aba53ccf05607d1116839a85415df9c07118bf4c Merge: 6d6be7070e9046 da107398cbd4bb Author: Jakub Kicinski Date: Wed Apr 1 19:19:35 2026 -0700 Merge tag 'nf-26-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net. Note that most of the bugs fixed here are >5 years old. The large PR is not due to an increase in regressions. 1) Flowtable hardware offload support in IPv6 can lead to out-of-bounds when populating the rule action array when combined with double-tagged vlan. Bump the maximum number of actions from 16 to 24 and check that such limit is never reached, otherwise bail out. This bugs stems from the original flowtable hardware offload support. 2) nfnetlink_log does not include the netlink header size of the trailing NLMSG_DONE message when calculating the skb size. From Florian Westphal. 3) Reject names in xt_cgroup and xt_rateest extensions which are not nul-terminated. Also from Florian. 4) Use nla_strcmp in ipset lookup by set name, since IPSET_ATTR_NAME and IPSET_ATTR_NAMEREF are of NLA_STRING type. From Florian Westphal. 5) When unregistering conntrack helpers, pass the helper that is going away so the expectation cleanup is done accordingly, otherwise UaF is possible when accessing expectation that refer to the helper that is gone. From Qi Tang. 6) Zero expectation NAT fields to address leaking kernel memory through the expectation netlink dump when unset. Also from Qi Tang. 7) Use the master conntrack helper when creating expectations via ctnetlink, ignore the suggested helper through CTA_EXPECT_HELP_NAME. This allows to address a possible read of kernel memory off the expectation object boundary. 8) Fix incorrect release of the hash bucket logic in ipset when the bucket is empty, leading to shrinking the hash bucket to size 0 which deals to out-of-bound write in next element additions. From Yifan Wu. 9) Allow the use of x_tables extensions that explicitly declare NFPROTO_ARP support only. This is to avoid an incorrect hook number validation due to non-overlapping arp and inet hook number definitions. 10) Reject immediate NF_QUEUE verdict in nf_tables. The userspace nft tool always uses the nft_queue expression for queueing. This ensures this verdict cannot be used for the arp family, which does supported this. * tag 'nf-26-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: reject immediate NF_QUEUE verdict netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP netfilter: ipset: drop logically empty buckets in mtype_del netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent netfilter: nf_conntrack_helper: pass helper to expect cleanup netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr netfilter: x_tables: ensure names are nul-terminated netfilter: nfnetlink_log: account for netlink header size netfilter: flowtable: strictly check for maximum number of actions ==================== Link: https://patch.msgid.link/20260401103646.1015423-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 6d6be7070e90465db098b75a755f0f191d1655c7 Merge: a54ecccfae62c5 bc39a094730ce0 Author: Jakub Kicinski Date: Wed Apr 1 19:12:23 2026 -0700 Merge tag 'for-net-2026-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: Fix UAF in le_read_features_complete - hci_sync: call destroy in hci_cmd_sync_run if immediate - hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists - hci_sync: fix leaks when hci_cmd_sync_queue_once fails - hci_sync: fix stack buffer overflow in hci_le_big_create_sync - hci_conn: fix potential UAF in set_cig_params_sync - hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt - hci_event: move wake reason storage into validated event handlers - SMP: force responder MITM requirements before building the pairing response - SMP: derive legacy responder STK authentication from MITM state - MGMT: validate LTK enc_size on load - MGMT: validate mesh send advertising payload length - SCO: fix race conditions in sco_sock_connect() - hci_h4: Fix race during initialization * tag 'for-net-2026-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync Bluetooth: SMP: derive legacy responder STK authentication from MITM state Bluetooth: SMP: force responder MITM requirements before building the pairing response Bluetooth: MGMT: validate mesh send advertising payload length Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync Bluetooth: MGMT: validate LTK enc_size on load Bluetooth: hci_h4: Fix race during initialization Bluetooth: hci_sync: Fix UAF in le_read_features_complete Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists Bluetooth: hci_event: move wake reason storage into validated event handlers Bluetooth: SCO: fix race conditions in sco_sock_connect() Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate ==================== Link: https://patch.msgid.link/20260401205834.2189162-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit ad8391d37f334ee73ba91926f8b4e4cf6d31ea04 Author: Kuniyuki Iwashima Date: Wed Apr 1 00:54:15 2026 +0000 bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). syzbot reported use-after-free of AF_UNIX socket's sk->sk_socket in sk_psock_verdict_data_ready(). [0] In unix_stream_sendmsg(), the peer socket's ->sk_data_ready() is called after dropping its unix_state_lock(). Although the sender socket holds the peer's refcount, it does not prevent the peer's sock_orphan(), and the peer's sk_socket might be freed after one RCU grace period. Let's fetch the peer's sk->sk_socket and sk->sk_socket->ops under RCU in sk_psock_verdict_data_ready(). [0]: BUG: KASAN: slab-use-after-free in sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278 Read of size 8 at addr ffff8880594da860 by task syz.4.1842/11013 CPU: 1 UID: 0 PID: 11013 Comm: syz.4.1842 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278 unix_stream_sendmsg+0x8a3/0xe80 net/unix/af_unix.c:2482 sock_sendmsg_nosec net/socket.c:721 [inline] __sock_sendmsg net/socket.c:736 [inline] ____sys_sendmsg+0x972/0x9f0 net/socket.c:2585 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2639 __sys_sendmsg net/socket.c:2671 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7facf899c819 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007facf9827028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007facf8c15fa0 RCX: 00007facf899c819 RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000004 RBP: 00007facf8a32c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007facf8c16038 R14: 00007facf8c15fa0 R15: 00007ffd41b01c78 Allocated by task 11013: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4538 [inline] slab_alloc_node mm/slub.c:4866 [inline] kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4885 sock_alloc_inode+0x28/0xc0 net/socket.c:316 alloc_inode+0x6a/0x1b0 fs/inode.c:347 new_inode_pseudo include/linux/fs.h:3003 [inline] sock_alloc net/socket.c:631 [inline] __sock_create+0x12d/0x9d0 net/socket.c:1562 sock_create net/socket.c:1656 [inline] __sys_socketpair+0x1c4/0x560 net/socket.c:1803 __do_sys_socketpair net/socket.c:1856 [inline] __se_sys_socketpair net/socket.c:1853 [inline] __x64_sys_socketpair+0x9b/0xb0 net/socket.c:1853 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 15: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2685 [inline] slab_free mm/slub.c:6165 [inline] kmem_cache_free+0x187/0x630 mm/slub.c:6295 rcu_do_batch kernel/rcu/tree.c:2617 [inline] rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869 handle_softirqs+0x22a/0x870 kernel/softirq.c:622 run_ksoftirqd+0x36/0x60 kernel/softirq.c:1063 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Fixes: c63829182c37 ("af_unix: Implement ->psock_update_sk_prot()") Closes: https://lore.kernel.org/bpf/69cc6b9f.a70a0220.128fd0.004b.GAE@google.com/ Reported-by: syzbot+2184232f07e3677fbaef@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260401005418.2452999-1-kuniyu@google.com commit a54ecccfae62c5c85259ae5ea5d9c20009519049 Author: Weiming Shi Date: Tue Mar 31 00:32:38 2026 +0800 rds: ib: reject FRMR registration before IB connection is established rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with i_cm_id = NULL because the connection worker has not yet called rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses the control message before any connection establishment, allowing rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the kernel. The existing guard in rds_ib_reg_frmr() only checks for !ic (added in commit 9e630bcb7701), which does not catch this case since ic is allocated early and is always non-NULL once the connection object exists. KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920 Call Trace: rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167) rds_ib_map_frmr (net/rds/ib_frmr.c:252) rds_ib_reg_frmr (net/rds/ib_frmr.c:430) rds_ib_get_mr (net/rds/ib_rdma.c:615) __rds_rdma_map (net/rds/rdma.c:295) rds_cmsg_rdma_map (net/rds/rdma.c:860) rds_sendmsg (net/rds/send.c:1363) ____sys_sendmsg do_syscall_64 Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all non-NULL before proceeding with FRMR registration, mirroring the guard already present in rds_ib_post_inv(). Return -ENODEV when the connection is not ready, which the existing error handling in rds_cmsg_send() converts to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to start the connection worker. Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20260330163237.2752440-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit ffb5a4843c5bde702ed17cbcdbda98b37f7a6dad Author: Hangbin Liu Date: Tue Mar 31 12:17:18 2026 +0800 ipv6: fix data race in fib6_metric_set() using cmpxchg fib6_metric_set() may be called concurrently from softirq context without holding the FIB table lock. A typical path is: ndisc_router_discovery() spin_unlock_bh(&table->tb6_lock) <- lock released fib6_metric_set(rt, RTAX_HOPLIMIT, ...) <- lockless call When two CPUs process Router Advertisement packets for the same router simultaneously, they can both arrive at fib6_metric_set() with the same fib6_info pointer whose fib6_metrics still points to dst_default_metrics. if (f6i->fib6_metrics == &dst_default_metrics) { /* both CPUs: true */ struct dst_metrics *p = kzalloc_obj(*p, GFP_ATOMIC); refcount_set(&p->refcnt, 1); f6i->fib6_metrics = p; /* CPU1 overwrites CPU0's p -> p0 leaked */ } The dst_metrics allocated by the losing CPU has refcnt=1 but no pointer to it anywhere in memory, producing a kmemleak report: unreferenced object 0xff1100025aca1400 (size 96): comm "softirq", pid 0, jiffies 4299271239 backtrace: kmalloc_trace+0x28a/0x380 fib6_metric_set+0xcd/0x180 ndisc_router_discovery+0x12dc/0x24b0 icmpv6_rcv+0xc16/0x1360 Fix this by: - Set val for p->metrics before published via cmpxchg() so the metrics value is ready before the pointer becomes visible to other CPUs. - Replace the plain pointer store with cmpxchg() and free the allocation safely when competition failed. - Add READ_ONCE()/WRITE_ONCE() for metrics[] setting in the non-default metrics path to prevent compiler-based data races. Fixes: d4ead6b34b67 ("net/ipv6: move metrics from dst to rt6_info") Reported-by: Fei Liu Reviewed-by: Jiayuan Chen Signed-off-by: Hangbin Liu Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260331-b4-fib6_metric_set-kmemleak-v3-1-88d27f4d8825@gmail.com Signed-off-by: Jakub Kicinski commit 2aa5a6d933f4e458db1825c7b25a7ec268a167ee Merge: 7aaa8047eafd0b 78746a474e92fc Author: Dave Airlie Date: Thu Apr 2 10:05:57 2026 +1000 Merge tag 'amd-drm-fixes-7.0-2026-04-01' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-04-01: amdgpu: - UserQ fixes - PASID handling fix - S4 fix for smu11 chips - Misc small fixes amdkfd: - Non-4K page fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260401174731.3576021-1-alexander.deucher@amd.com commit 39ed7d89b973329cc5c764b65ba6302b17b1907e Author: Anthony Pighin Date: Tue Mar 31 14:26:32 2026 -0400 i2c: imx: zero-initialize dma_slave_config for eDMA commit 66d88e16f204 ("dmaengine: fsl-edma: read/write multiple registers in cyclic transactions") causes fsl_edma_fill_tcd() to read dst_port_window_size and src_port_window_size when building transfer control descriptors. Initialize the structure so unset fields are explicitly zero. Fixes: 66d88e16f204 ("dmaengine: fsl-edma: read/write multiple registers in cyclic transactions") Signed-off-by: Anthony Pighin Cc: # v6.14+ Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260331182632.888110-1-anthony.pighin@nokia.com commit b986e98ccd0d09538a841b832faef44c49f4d655 Merge: 14edf33d1b21cc 11b72b1ca9891c Author: Arnd Bergmann Date: Wed Apr 1 23:36:28 2026 +0200 Merge tag 'qcom-arm64-fixes-for-7.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes More Qualcomm Arm64 DeviceTree fixes for v7.0 The shuffling of reset and wake GPIO properties across various Hamoa devices left things in an incomplete state, fix this. Add the missing "ranges" property to the QCM2290 MDSS DeviceTree binding example, to fix the validation warning that was introduced by the previous fix. * tag 'qcom-arm64-fixes-for-7.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: hamoa: Fix incomplete Root Port property migration dt-bindings: display/msm: qcm2290-mdss: Fix missing ranges in example arm64: dts: qcom: agatti: Fix IOMMU DT properties dt-bindings: media: venus: Fix iommus property dt-bindings: display: msm: qcm2290-mdss: Fix iommus property arm64: dts: qcom: monaco: Reserve full Gunyah metadata region arm64: dts: qcom: monaco: Fix UART10 pinconf arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity arm64: dts: qcom: hamoa/x1: fix idle exit latency Signed-off-by: Arnd Bergmann commit 14edf33d1b21ccba526deab72c32a4ab448d6a62 Merge: b09719b9b06757 6896ca5a9d0527 Author: Arnd Bergmann Date: Wed Apr 1 23:35:36 2026 +0200 Merge tag 'sunxi-fixes-for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Allwinner fixes for 7.0 Just one fix to make the r-spi SPI controller use the mcu-dma DMA controller for DMA instead of the main DMA controller. * tag 'sunxi-fixes-for-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: sun55i: Fix r-spi DMA Signed-off-by: Arnd Bergmann commit b09719b9b06757f768768495436786aeb4b9e526 Merge: abc52cf58e5098 ed8444006df986 Author: Arnd Bergmann Date: Wed Apr 1 23:34:12 2026 +0200 Merge tag 'renesas-fixes-for-v7.0-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas fixes for v7.0 (take two) - Fix TFA BL31 memory corruption on Sparrow Hawk. * tag 'renesas-fixes-for-v7.0-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM Signed-off-by: Arnd Bergmann commit bc39a094730ce062fa034a529c93147c096cb488 Author: hkbinbin Date: Tue Mar 31 05:39:16 2026 +0000 Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17) BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31, the memcpy that copies conn->bis into cp->bis writes up to 14 bytes past the stack buffer, corrupting adjacent stack memory. This is trivially reproducible: binding an ISO socket with bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will eventually trigger hci_le_big_create_sync() from the HCI command sync worker, causing a KASAN-detectable stack-out-of-bounds write: BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0 Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71 Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that conn->bis can actually carry. Fixes: 42ecf1947135 ("Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending") Cc: stable@vger.kernel.org Signed-off-by: hkbinbin Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 20756fec2f0108cb88e815941f1ffff88dc286fe Author: Oleh Konko Date: Tue Mar 31 11:52:13 2026 +0000 Bluetooth: SMP: derive legacy responder STK authentication from MITM state The legacy responder path in smp_random() currently labels the stored STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH. That reflects what the local service requested, not what the pairing flow actually achieved. For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear and the resulting STK should remain unauthenticated even if the local side requested HIGH security. Use the established MITM state when storing the responder STK so the key metadata matches the pairing result. This also keeps the legacy path aligned with the Secure Connections code, which already treats JUST_WORKS/JUST_CFM as unauthenticated. Fixes: fff3490f4781 ("Bluetooth: Fix setting correct authentication information for SMP STK") Cc: stable@vger.kernel.org Signed-off-by: Oleh Konko Signed-off-by: Luiz Augusto von Dentz commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 Author: Oleh Konko Date: Tue Mar 31 11:52:12 2026 +0000 Bluetooth: SMP: force responder MITM requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned. Fixes: 2b64d153a0cc ("Bluetooth: Add MITM mechanism to LE-SMP") Cc: stable@vger.kernel.org Suggested-by: Luiz Augusto von Dentz Signed-off-by: Oleh Konko Signed-off-by: Luiz Augusto von Dentz commit bda93eec78cdbfe5cda00785cefebd443e56b88b Author: Keenan Dong Date: Wed Apr 1 22:25:26 2026 +0800 Bluetooth: MGMT: validate mesh send advertising payload length mesh_send() currently bounds MGMT_OP_MESH_SEND by total command length, but it never verifies that the bytes supplied for the flexible adv_data[] array actually match the embedded adv_data_len field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a truncated command can still pass the existing 20..50 byte range check and later drive the async mesh send path past the end of the queued command buffer. Keep rejecting zero-length and oversized advertising payloads, but validate adv_data_len explicitly and require the command length to exactly match the flexible array size before queueing the request. Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Reported-by: Keenan Dong Signed-off-by: Keenan Dong Signed-off-by: Luiz Augusto von Dentz commit b255531b27da336571411248c2a72a350662bd09 Author: Pauli Virtanen Date: Sun Mar 29 16:43:02 2026 +0300 Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage. Fixes: 95118dd4edfec ("Bluetooth: hci_event: Use of a function table to handle LE subevents") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit a2639a7f0f5bf7d73f337f8f077c19415c62ed2c Author: Pauli Virtanen Date: Sun Mar 29 16:43:01 2026 +0300 Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration. Fixes: a091289218202 ("Bluetooth: hci_conn: Fix hci_le_set_cig_params") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 Author: Keenan Dong Date: Sat Mar 28 16:46:47 2026 +0800 Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer. Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state. Fixes: 346af67b8d11 ("Bluetooth: Add MGMT handlers for dealing with SMP LTK's") Reported-by: Keenan Dong Signed-off-by: Keenan Dong Signed-off-by: Luiz Augusto von Dentz commit 0ffac654e95c1bdfe2d4edf28fb18d6ba1f103e6 Author: Jonathan Rissanen Date: Fri Mar 27 11:47:21 2026 +0100 Bluetooth: hci_h4: Fix race during initialization Commit 5df5dafc171b ("Bluetooth: hci_uart: Fix another race during initialization") fixed a race for hci commands sent during initialization. However, there is still a race that happens if an hci event from one of these commands is received before HCI_UART_REGISTERED has been set at the end of hci_uart_register_dev(). The event will be ignored which causes the command to fail with a timeout in the log: "Bluetooth: hci0: command 0x1003 tx timeout" This is because the hci event receive path (hci_uart_tty_receive -> h4_recv) requires HCI_UART_REGISTERED to be set in h4_recv(), while the hci command transmit path (hci_uart_send_frame -> h4_enqueue) only requires HCI_UART_PROTO_INIT to be set in hci_uart_send_frame(). The check for HCI_UART_REGISTERED was originally added in commit c2578202919a ("Bluetooth: Fix H4 crash from incoming UART packets") to fix a crash caused by hu->hdev being null dereferenced. That can no longer happen: once HCI_UART_PROTO_INIT is set in hci_uart_register_dev() all pointers (hu, hu->priv and hu->hdev) are valid, and hci_uart_tty_receive() already calls h4_recv() on HCI_UART_PROTO_INIT or HCI_UART_PROTO_READY. Remove the check for HCI_UART_REGISTERED in h4_recv() to fix the race condition. Fixes: 5df5dafc171b ("Bluetooth: hci_uart: Fix another race during initialization") Signed-off-by: Jonathan Rissanen Signed-off-by: Luiz Augusto von Dentz commit 035c25007c9e698bef3826070ee34bb6d778020c Author: Luiz Augusto von Dentz Date: Wed Mar 25 11:11:46 2026 -0400 Bluetooth: hci_sync: Fix UAF in le_read_features_complete This fixes the following backtrace caused by hci_conn being freed before le_read_features_complete but after hci_le_read_remote_features_sync so hci_conn_del -> hci_cmd_sync_dequeue is not able to prevent it: ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline] BUG: KASAN: slab-use-after-free in hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline] BUG: KASAN: slab-use-after-free in le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344 Write of size 4 at addr ffff8880796b0010 by task kworker/u9:0/52 CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: hci0 hci_cmd_sync_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:194 [inline] kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:200 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline] hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline] le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344 hci_cmd_sync_work+0x1ff/0x430 net/bluetooth/hci_sync.c:334 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Allocated by task 5932: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:417 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] __hci_conn_add+0xf8/0x1c70 net/bluetooth/hci_conn.c:963 hci_conn_add_unset+0x76/0x100 net/bluetooth/hci_conn.c:1084 le_conn_complete_evt+0x639/0x1f20 net/bluetooth/hci_event.c:5714 hci_le_enh_conn_complete_evt+0x23d/0x380 net/bluetooth/hci_event.c:5861 hci_le_meta_evt+0x357/0x5e0 net/bluetooth/hci_event.c:7408 hci_event_func net/bluetooth/hci_event.c:7716 [inline] hci_event_packet+0x685/0x11c0 net/bluetooth/hci_event.c:7773 hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Freed by task 5932: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 __kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free mm/slub.c:6663 [inline] kfree+0x2f8/0x6e0 mm/slub.c:6871 device_release+0xa4/0x240 drivers/base/core.c:2565 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1e7/0x590 lib/kobject.c:737 put_device drivers/base/core.c:3797 [inline] device_unregister+0x2f/0xc0 drivers/base/core.c:3920 hci_conn_del_sysfs+0xb4/0x180 net/bluetooth/hci_sysfs.c:79 hci_conn_cleanup net/bluetooth/hci_conn.c:173 [inline] hci_conn_del+0x657/0x1180 net/bluetooth/hci_conn.c:1234 hci_disconn_complete_evt+0x410/0xa00 net/bluetooth/hci_event.c:3451 hci_event_func net/bluetooth/hci_event.c:7719 [inline] hci_event_packet+0xa10/0x11c0 net/bluetooth/hci_event.c:7773 hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 The buggy address belongs to the object at ffff8880796b0000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 16 bytes inside of freed 8192-byte region [ffff8880796b0000, ffff8880796b2000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x796b0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88813ff27280 0000000000000000 0000000000000001 raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88813ff27280 0000000000000000 0000000000000001 head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 00fff00000000003 ffffea0001e5ac01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5657, tgid 5657 (dhcpcd-run-hook), ts 79819636908, free_ts 79814310558 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1845 prep_new_page mm/page_alloc.c:1853 [inline] get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3879 __alloc_frozen_pages_noprof+0x25f/0x2440 mm/page_alloc.c:5183 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416 alloc_slab_page mm/slub.c:3075 [inline] allocate_slab mm/slub.c:3248 [inline] new_slab+0x2c3/0x430 mm/slub.c:3302 ___slab_alloc+0xe18/0x1c90 mm/slub.c:4651 __slab_alloc.constprop.0+0x63/0x110 mm/slub.c:4774 __slab_alloc_node mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:5246 [inline] __kmalloc_cache_noprof+0x477/0x800 mm/slub.c:5766 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] tomoyo_print_bprm security/tomoyo/audit.c:26 [inline] tomoyo_init_log+0xc8a/0x2140 security/tomoyo/audit.c:264 tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline] tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63 tomoyo_environ security/tomoyo/domain.c:672 [inline] tomoyo_find_next_domain+0xec1/0x20b0 security/tomoyo/domain.c:888 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline] tomoyo_bprm_check_security+0x12d/0x1d0 security/tomoyo/tomoyo.c:92 security_bprm_check+0x1b9/0x1e0 security/security.c:794 search_binary_handler fs/exec.c:1659 [inline] exec_binprm fs/exec.c:1701 [inline] bprm_execve fs/exec.c:1753 [inline] bprm_execve+0x81e/0x1620 fs/exec.c:1729 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1859 page last free pid 5657 tgid 5657 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1394 [inline] __free_frozen_pages+0x7df/0x1160 mm/page_alloc.c:2901 discard_slab mm/slub.c:3346 [inline] __put_partials+0x130/0x170 mm/slub.c:3886 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4c/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:352 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4948 [inline] slab_alloc_node mm/slub.c:5258 [inline] __kmalloc_cache_noprof+0x274/0x800 mm/slub.c:5766 kmalloc_noprof include/linux/slab.h:957 [inline] tomoyo_print_header security/tomoyo/audit.c:156 [inline] tomoyo_init_log+0x197/0x2140 security/tomoyo/audit.c:255 tomoyo_supervisor+0x302/0x13b0 security/tomoyo/common.c:2198 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline] tomoyo_env_perm+0x191/0x200 security/tomoyo/environ.c:63 tomoyo_environ security/tomoyo/domain.c:672 [inline] tomoyo_find_next_domain+0xec1/0x20b0 security/tomoyo/domain.c:888 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline] tomoyo_bprm_check_security+0x12d/0x1d0 security/tomoyo/tomoyo.c:92 security_bprm_check+0x1b9/0x1e0 security/security.c:794 search_binary_handler fs/exec.c:1659 [inline] exec_binprm fs/exec.c:1701 [inline] bprm_execve fs/exec.c:1753 [inline] bprm_execve+0x81e/0x1620 fs/exec.c:1729 do_execveat_common.isra.0+0x4a5/0x610 fs/exec.c:1859 do_execve fs/exec.c:1933 [inline] __do_sys_execve fs/exec.c:2009 [inline] __se_sys_execve fs/exec.c:2004 [inline] __x64_sys_execve+0x8e/0xb0 fs/exec.c:2004 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 Memory state around the buggy address: ffff8880796aff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880796aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880796b0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880796b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880796b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: a106e50be74b ("Bluetooth: HCI: Add support for LL Extended Feature Set") Reported-by: syzbot+87badbb9094e008e0685@syzkaller.appspotmail.com Tested-by: syzbot+87badbb9094e008e0685@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=87badbb9094e008e0685 Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Pauli Virtanen commit aca377208e7f7322bf4e107cdec6e7d7e8aa7a88 Author: Pauli Virtanen Date: Wed Mar 25 21:07:44 2026 +0200 Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails When hci_cmd_sync_queue_once() returns with error, the destroy callback will not be called. Fix leaking references / memory on these failures. Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 2969554bcfccb5c609f6b6cd4a014933f3a66dd0 Author: Pauli Virtanen Date: Wed Mar 25 21:07:43 2026 +0200 Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources. Change the function to return -EEXIST if queue item already exists. Modify all callsites to handle that. Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 2b2bf47cd75518c36fa2d41380e4a40641cc89cd Author: Oleh Konko Date: Thu Mar 26 17:31:24 2026 +0000 Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt(). Fixes: 2f20216c1d6f ("Bluetooth: Emit controller suspend and resume events") Cc: stable@vger.kernel.org Signed-off-by: Oleh Konko Signed-off-by: Luiz Augusto von Dentz commit 8a5b0135d4a5d9683203a3d9a12a711ccec5936b Author: Cen Zhang Date: Thu Mar 26 23:16:45 2026 +0800 Bluetooth: SCO: fix race conditions in sco_sock_connect() sco_sock_connect() checks sk_state and sk_type without holding the socket lock. Two concurrent connect() syscalls on the same socket can both pass the check and enter sco_connect(), leading to use-after-free. The buggy scenario involves three participants and was confirmed with additional logging instrumentation: Thread A (connect): HCI disconnect: Thread B (connect): sco_sock_connect(sk) sco_sock_connect(sk) sk_state==BT_OPEN sk_state==BT_OPEN (pass, no lock) (pass, no lock) sco_connect(sk): sco_connect(sk): hci_dev_lock hci_dev_lock hci_connect_sco <- blocked -> hcon1 sco_conn_add->conn1 lock_sock(sk) sco_chan_add: conn1->sk = sk sk->conn = conn1 sk_state=BT_CONNECT release_sock hci_dev_unlock hci_dev_lock sco_conn_del: lock_sock(sk) sco_chan_del: sk->conn=NULL conn1->sk=NULL sk_state= BT_CLOSED SOCK_ZAPPED release_sock hci_dev_unlock (unblocked) hci_connect_sco -> hcon2 sco_conn_add -> conn2 lock_sock(sk) sco_chan_add: sk->conn=conn2 sk_state= BT_CONNECT // zombie sk! release_sock hci_dev_unlock Thread B revives a BT_CLOSED + SOCK_ZAPPED socket back to BT_CONNECT. Subsequent cleanup triggers double sock_put() and use-after-free. Meanwhile conn1 is leaked as it was orphaned when sco_conn_del() cleared the association. Fix this by: - Moving lock_sock() before the sk_state/sk_type checks in sco_sock_connect() to serialize concurrent connect attempts - Fixing the sk_type != SOCK_SEQPACKET check to actually return the error instead of just assigning it - Adding a state re-check in sco_connect() after lock_sock() to catch state changes during the window between the locks - Adding sco_pi(sk)->conn check in sco_chan_add() to prevent double-attach of a socket to multiple connections - Adding hci_conn_drop() on sco_chan_add failure to prevent HCI connection leaks Fixes: 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm") Signed-off-by: Cen Zhang Signed-off-by: Luiz Augusto von Dentz commit a834a0b66ec6fb743377201a0f4229bb2503f4ce Author: Pauli Virtanen Date: Wed Mar 25 21:07:46 2026 +0200 Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate hci_cmd_sync_run() may run the work immediately if called from existing sync work (otherwise it queues a new sync work). In this case it fails to call the destroy() function. On immediate run, make it behave same way as if item was queued successfully: call destroy, and return 0. The only callsite is hci_abort_conn() via hci_cmd_sync_run_once(), and this changes its return value. However, its return value is not used except as the return value for hci_disconnect(), and nothing uses the return value of hci_disconnect(). Hence there should be no behavior change anywhere. Fixes: c898f6d7b093b ("Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 01cc50ea5167bb14117257ec084637abe9e5f691 Author: Stefan Wiehler Date: Tue Mar 10 11:40:24 2026 +0100 mips: mm: Allocate tlb_vpn array atomically Found by DEBUG_ATOMIC_SLEEP: BUG: sleeping function called from invalid context at /include/linux/sched/mm.h:306 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 no locks held by swapper/1/0. irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [] copy_process+0x75c/0x1b68 softirqs last enabled at (0): [] copy_process+0x75c/0x1b68 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.119-d79e757675ec-fct #1 Stack : 800000000290bad8 0000000000000000 0000000000000008 800000000290bae8 800000000290bae8 800000000290bc78 0000000000000000 0000000000000000 ffffffff80c80000 0000000000000001 ffffffff80d8dee8 ffffffff810d09c0 784bb2a7ec10647d 0000000000000010 ffffffff80a6fd60 8000000001d8a9c0 0000000000000000 0000000000000000 ffffffff80d90000 0000000000000000 ffffffff80c9e0e8 0000000007ffffff 0000000000000cc0 0000000000000400 ffffffffffffffff 0000000000000001 0000000000000002 ffffffffc0149ed8 fffffffffffffffe 8000000002908000 800000000290bae0 ffffffff80a81b74 ffffffff80129fb0 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff80129fd0 0000000000000000 ... Call Trace: [] show_stack+0x60/0x158 [] dump_stack_lvl+0x88/0xbc [] __might_resched+0x268/0x288 [] __kmem_cache_alloc_node+0x2e0/0x330 [] __kmalloc+0x58/0xd0 [] r4k_tlb_uniquify+0x7c/0x428 [] tlb_init+0x7c/0x110 [] per_cpu_trap_init+0x16c/0x1d0 [] start_secondary+0x28/0x128 Fixes: 231ac951faba ("MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow") Signed-off-by: Stefan Wiehler Cc: stable@vger.kernel.org Signed-off-by: Thomas Bogendoerfer commit 703ccb63ae9f7444d6ff876d024e17f628103c69 Author: Matthew Brost Date: Tue Mar 31 18:07:39 2026 -0700 workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works In unplug_oldest_pwq(), the first inactive work item on the pool_workqueue is activated correctly. However, if multiple inactive works exist on the same pool_workqueue, subsequent works fail to activate because wq_node_nr_active.pending_pwqs is empty — the list insertion is skipped when the pool_workqueue is plugged. Fix this by checking for additional inactive works in unplug_oldest_pwq() and updating wq_node_nr_active.pending_pwqs accordingly. Fixes: 4c065dbce1e8 ("workqueue: Enable unbound cpumask update on ordered workqueues") Cc: stable@vger.kernel.org Cc: Carlos Santa Cc: Ryan Neph Cc: Lai Jiangshan Cc: Waiman Long Cc: linux-kernel@vger.kernel.org Signed-off-by: Matthew Brost Signed-off-by: Tejun Heo Acked-by: Waiman Long commit 540760b77b8fc49d39d1b2b76196e5ec57711a32 Author: Maciej W. Rozycki Date: Fri Mar 27 18:57:30 2026 +0000 MIPS: mm: Rewrite TLB uniquification for the hidden bit feature Before the introduction of the EHINV feature, which lets software mark TLB entries invalid, certain older implementations of the MIPS ISA were equipped with an analogous bit, as a vendor extension, which however is hidden from software and only ever set at reset, and then any software write clears it, making the intended TLB entry valid. This feature makes it unsafe to read a TLB entry with TLBR, modify the page mask, and write the entry back with TLBWI, because this operation will implicitly clear the hidden bit and this may create a duplicate entry, as with the presence of the hidden bit there is no guarantee all the entries across the TLB are unique each. Usually the firmware has already uniquified TLB entries before handing control over, in which case we only need to guarantee at bootstrap no clash will happen with the VPN2 values chosen in local_flush_tlb_all(). However with systems such as Mikrotik RB532 we get handed the TLB as at reset, with the hidden bit set across the entries and possibly duplicate entries present. This then causes a machine check exception when page sizes are reset in r4k_tlb_uniquify() and prevents the system from booting. Rewrite the algorithm used in r4k_tlb_uniquify() then such as to avoid the reuse of ASID/VPN values across the TLB. Get rid of global entries first as they may be blocking the entire address space, e.g. 16 256MiB pages will exhaust the whole address space of a 32-bit CPU and a single big page can exhaust the 32-bit compatibility space on a 64-bit CPU. Details of the algorithm chosen are given across the code itself. Fixes: 9f048fa48740 ("MIPS: mm: Prevent a TLB shutdown on initial uniquification") Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # v6.18+ Signed-off-by: Thomas Bogendoerfer commit 74283cfe216392c7b776ebf6045b5b15ed9dffcd Author: Maciej W. Rozycki Date: Fri Mar 27 18:57:23 2026 +0000 MIPS: mm: Suppress TLB uniquification on EHINV hardware Hardware that supports the EHINV feature, mandatory for R6 ISA and FTLB implementation, lets software mark TLB entries invalid, which eliminates the need to ensure no duplicate matching entries are ever created. This feature is already used by local_flush_tlb_all(), via the UNIQUE_ENTRYHI macro, making the preceding call to r4k_tlb_uniquify() superfluous. The next change will also modify uniquification code such that it'll become incompatible with the FTLB and MMID features, as well as MIPSr6 CPUs that do not implement 4KiB pages. Therefore prevent r4k_tlb_uniquify() from being used on EHINV hardware, as denoted by `cpu_has_tlbinv'. Signed-off-by: Maciej W. Rozycki Signed-off-by: Thomas Bogendoerfer commit 8374c2cb83b95b3c92f129fd56527225c20a058c Author: Maciej W. Rozycki Date: Fri Mar 27 18:57:18 2026 +0000 MIPS: Always record SEGBITS in cpu_data.vmbits With a 32-bit kernel running on 64-bit MIPS hardware the hardcoded value of `cpu_vmbits' only records the size of compatibility useg and does not reflect the size of native xuseg or the complete range of values allowed in the VPN2 field of TLB entries. An upcoming change will need the actual VPN2 value range permitted even in 32-bit kernel configurations, so always include the `vmbits' member in `struct cpuinfo_mips' and probe for SEGBITS when running on 64-bit hardware and resorting to the currently hardcoded value of 31 on 32-bit processors. No functional change for users of `cpu_vmbits'. Signed-off-by: Maciej W. Rozycki Signed-off-by: Thomas Bogendoerfer commit ec8bf18814915460d9c617b556bf024efef26613 Author: Maciej W. Rozycki Date: Mon Mar 30 02:54:09 2026 +0100 MIPS: Fix the GCC version check for `__multi3' workaround It was only GCC 10 that fixed a MIPS64r6 code generation issue with a `__multi3' libcall inefficiently produced to perform 64-bit widening multiplication while suitable machine instructions exist to do such a calculation. The fix went in with GCC commit 48b2123f6336 ("re PR target/82981 (unnecessary __multi3 call for mips64r6 linux kernel)"). Adjust our code accordingly, removing build failures such as: mips64-linux-ld: lib/math/div64.o: in function `mul_u64_add_u64_div_u64': div64.c:(.text+0x84): undefined reference to `__multi3' with the GCC versions affected. Fixes: ebabcf17bcd7 ("MIPS: Implement __multi3 for GCC7 MIPS64r6 builds") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601140146.hMLODc6v-lkp@intel.com/ Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # v4.15+ Reviewed-by: David Laight commit d62cf1511743526f530a4c169424e50c757f5a5e Author: Maciej W. Rozycki Date: Fri Mar 27 11:38:06 2026 +0000 MIPS: SiByte: Bring back cache initialisation Bring back cache initialisation for Broadcom SiByte SB1 cores, which has been removed causing the kernel to hang at bootstrap right after: Dentry cache hash table entries: 524288 (order: 8, 4194304 bytes, linear) Inode-cache hash table entries: 262144 (order: 7, 2097152 bytes, linear) The cause of the problem is R4k cache handlers are also used by Broadcom SiByte SB1 cores, however with a different cache error exception handler and therefore not using CPU_R4K_CACHE_TLB: obj-$(CONFIG_CPU_R4K_CACHE_TLB) += c-r4k.o cex-gen.o tlb-r4k.o obj-$(CONFIG_CPU_SB1) += c-r4k.o cerr-sb1.o cex-sb1.o tlb-r4k.o (from arch/mips/mm/Makefile). Fixes: bbe4f634f48c ("mips: fix r3k_cache_init build regression") Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Thomas Bogendoerfer commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 Author: Shiji Yang Date: Tue Feb 24 10:22:50 2026 +0800 mips: ralink: update CPU clock index Update CPU clock index to match the clock driver changes. Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs") Signed-off-by: Mieczyslaw Nalewaj Signed-off-by: Shiji Yang Reviewed-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 35d8945bf9b0c4d9586c7fa9fadeecf2cfc26c23 Author: Rong Zhang Date: Mon Mar 16 01:28:22 2026 +0800 MIPS: Loongson64: env: Check UARTs passed by LEFI cautiously Some firmware does not set nr_uarts properly and passes empty items. Iterate at most min(system->nr_uarts, MAX_UARTS) items to prevent out-of-bounds access, and ignore UARTs with addr 0 silently. Meanwhile, our DT only works with UPIO_MEM but theoretically firmware may pass other IO types, so explicitly check against that. Tested on Loongson-LS3A4000-7A1000-NUC-SE. Fixes: 3989ed418483 ("MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI") Cc: stable@vger.kernel.org Reviewed-by: Yao Zi Signed-off-by: Rong Zhang Reviewed-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit 328335a79487ec38d6b0e1aa807785b0f75e594d Author: Gaurav Batra Date: Tue Mar 31 17:30:22 2026 -0500 powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs In a PowerNV environment, for devices that supports DMA mask less than 64 bit but larger than 32 bits, iommu is incorrectly bypassing DMA APIs while allocating and mapping buffers for DMA operations. Devices are failing with ENOMEN during probe with the following messages amdgpu 0000:01:00.0: [drm] Detected VRAM RAM=4096M, BAR=4096M amdgpu 0000:01:00.0: [drm] RAM width 128bits GDDR5 amdgpu 0000:01:00.0: iommu: 64-bit OK but direct DMA is limited by 0 amdgpu 0000:01:00.0: dma_iommu_get_required_mask: returning bypass mask 0xfffffffffffffff amdgpu 0000:01:00.0: 4096M of VRAM memory ready amdgpu 0000:01:00.0: 32570M of GTT memory ready. amdgpu 0000:01:00.0: (-12) failed to allocate kernel bo amdgpu 0000:01:00.0: [drm] Debug VRAM access will use slowpath MM access amdgpu 0000:01:00.0: [drm] GART: num cpu pages 4096, num gpu pages 65536 amdgpu 0000:01:00.0: [drm] PCIE GART of 256M enabled (table at 0x000000F4FFF80000). amdgpu 0000:01:00.0: (-12) failed to allocate kernel bo amdgpu 0000:01:00.0: (-12) create WB bo failed amdgpu 0000:01:00.0: amdgpu_device_wb_init failed -12 amdgpu 0000:01:00.0: amdgpu_device_ip_init failed amdgpu 0000:01:00.0: Fatal error during GPU init amdgpu 0000:01:00.0: finishing device. amdgpu 0000:01:00.0: probe with driver amdgpu failed with error -12 amdgpu 0000:01:00.0: ttm finalized Fixes: 1471c517cf7d ("powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory") Suggested-by: Ritesh Harjani (IBM) Reviewed-by: Ritesh Harjani (IBM) Reported-by: Dan Horák Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5039 Tested-by: Dan Horak Closes: https://lore.kernel.org/linuxppc-dev/20260313142351.609bc4c3efe1184f64ca5f44@danny.cz/ Signed-off-by: Gaurav Batra Closes: https://lore.kernel.org/linuxppc-dev/20260313142351.609bc4c3efe1184f64ca5f44@danny.cz/ [Maddy: Fixed tags] Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260331223022.47488-1-gbatra@linux.ibm.com commit cffff6df669a438ecac506dadd49a53d4475a796 Author: Corey Hickey Date: Tue Mar 31 14:49:06 2026 -0700 hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI On the Asus PRIME X670E-PRO WIFI, the driver reports a constant value of zero for T_Sensor. On this board, the register for T_Sensor is at a different address, as found by experimentation and confirmed by comparison to an independent temperature reading. * sensor disconnected: -62.0°C * ambient temperature: +22.0°C * held between fingers: +30.0°C Introduce SENSOR_TEMP_T_SENSOR_ALT1 to support the PRIME X670E-PRO WIFI without causing a regression for other 600-series boards Fixes: e0444758dd1b ("hwmon: (asus-ec-sensors) add PRIME X670E-PRO WIFI") Signed-off-by: Corey Hickey Link: https://lore.kernel.org/r/20260331215414.368785-1-bugfood-ml@fatooh.org [groeck: Fixed typo, updated Fixes: reference] Signed-off-by: Guenter Roeck commit aa35dd6bdd033dea8aa3e20cbbbe10e06b2d044f Author: Jens Axboe Date: Tue Mar 31 08:16:58 2026 -0600 io_uring/bpf_filters: retain COW'ed settings on parse failures If io_parse_restrictions() fails, it ends up clearing any restrictions currently set. The intent is only to clear whatever it already applied, but it ends up clearing everything, including whatever settings may have been applied in a copy-on-write fashion already. Ensure that those are retained. Link: https://lore.kernel.org/io-uring/CAK8a0jzF-zaO5ZmdOrmfuxrhXuKg5m5+RDuO7tNvtj=kUYbW7Q@mail.gmail.com/ Reported-by: antonius Fixes: ed82f35b926b ("io_uring: allow registration of per-task restrictions") Signed-off-by: Jens Axboe commit 61a11cf4812726aceaee17c96432e1c08f6ed6cb Author: Jens Axboe Date: Tue Mar 31 07:07:47 2026 -0600 io_uring: protect remaining lockless ctx->rings accesses with RCU Commit 96189080265e addressed one case of ctx->rings being potentially accessed while a resize is happening on the ring, but there are still a few others that need handling. Add a helper for retrieving the rings associated with an io_uring context, and add some sanity checking to that to catch bad uses. ->rings_rcu is always valid, as long as it's used within RCU read lock. Any use of ->rings_rcu or ->rings inside either ->uring_lock or ->completion_lock is sane as well. Do the minimum fix for the current kernel, but set it up such that this basic infra can be extended for later kernels to make this harder to mess up in the future. Thanks to Junxi Qian for finding and debugging this issue. Cc: stable@vger.kernel.org Fixes: 79cfe9e59c2a ("io_uring/register: add IORING_REGISTER_RESIZE_RINGS") Reviewed-by: Junxi Qian Tested-by: Junxi Qian Link: https://lore.kernel.org/io-uring/20260330172348.89416-1-qjx1298677004@gmail.com/ Signed-off-by: Jens Axboe commit 54ac9ff8f1196afc49d644a1625e0af1c9fcf7f5 Author: Ard Biesheuvel Date: Tue Mar 31 13:04:23 2026 +0200 arm64: Use static call trampolines when kCFI is enabled Implement arm64 support for the 'unoptimized' static call variety, which routes all calls through a trampoline that performs a tail call to the chosen function, and wire it up for use when kCFI is enabled. This works around an issue with kCFI and generic static calls, where the prototypes of default handlers such as __static_call_nop() and __static_call_ret0() don't match the expected prototype of the call site, resulting in kCFI false positives [0]. Since static call targets may be located in modules loaded out of direct branching range, this needs an ADRP/LDR pair to load the branch target into R16 and a branch-to-register (BR) instruction to perform an indirect call. Unlike on x86, there is no pressing need on arm64 to avoid indirect calls at all cost, but hiding it from the compiler as is done here does have some benefits: - the literal is located in .rodata, which gives us the same robustness advantage that code patching does; - no D-cache pollution from fetching hash values from .text sections. From an execution speed PoV, this is unlikely to make any difference at all. Cc: Sami Tolvanen Cc: Sean Christopherson Cc: Kees Cook Cc: Peter Zijlstra Cc: Will McVicker Reported-by: Carlos Llamas Closes: https://lore.kernel.org/all/20260311225822.1565895-1-cmllamas@google.com/ [0] Signed-off-by: Ard Biesheuvel Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas commit 6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e Author: Guangshuo Li Date: Wed Apr 1 10:45:35 2026 +0800 cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The kobject release callback cpufreq_dbs_data_release() calls gov->exit(dbs_data) and kfree(dbs_data), but the current error path then calls gov->exit(dbs_data) and kfree(dbs_data) again, causing a double free. Keep the direct kfree(dbs_data) for the gov->init() failure path, but after kobject_init_and_add() has been called, let kobject_put() handle the cleanup through cpufreq_dbs_data_release(). Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak") Signed-off-by: Guangshuo Li Reviewed-by: Zhongqiu Han Acked-by: Viresh Kumar Cc: All applicable Link: https://patch.msgid.link/20260401024535.1395801-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki commit 3e68690a2ac51fc3448a907aef5deda98c770f15 Merge: f40b1401b6ad0f 2932095c114b98 Author: Greg Kroah-Hartman Date: Wed Apr 1 15:45:54 2026 +0200 Merge tag 'counter-fixes-for-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: Counter fixes for 7.0 Two fixes for rz-mut3-cnt: synchronize runtime PM usage count to toggle state of the counter, and set counter->parent during probe to ensure the current dev pointer is accessed during driver operation. * tag 'counter-fixes-for-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member counter: rz-mtu3-cnt: prevent counter from being toggled multiple times commit e74c38ef6f170179c0029b5744d6a14dfd543108 Author: Simon Trimmer Date: Tue Mar 31 13:19:16 2026 +0000 ASoC: amd: ps: Fix missing leading zeros in subsystem_device SSID log Ensure that subsystem_device is printed with leading zeros when combined with subsystem_vendor to form the SSID. Without this, devices with upper bits unset may appear to have an incorrect SSID in the debug output. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20260331131916.145546-1-simont@opensource.cirrus.com Signed-off-by: Mark Brown commit abc52cf58e5098c8159dad8b249188bcd270dd7d Merge: 36b35ad87976e8 1af997cad473d5 Author: Krzysztof Kozlowski Date: Wed Apr 1 13:51:16 2026 +0200 Merge tag 'hisi-dts-fixes-for-7.0' of https://github.com/hisilicon/linux-hisi into arm/fixes HiSilicon dts fixes for v7.0 - Correct the PCIe reset GPIO polarity for hi3798cv200-poplar - Add the missing dma-ranges for hi3798cv200 * tag 'hisi-dts-fixes-for-7.0' of https://github.com/hisilicon/linux-hisi: arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity Signed-off-by: Krzysztof Kozlowski commit 36b35ad87976e8420e7b503020e40f669a8cd884 Merge: 7962fd9375fddc a343fb1e03cfc9 Author: Krzysztof Kozlowski Date: Wed Apr 1 13:47:03 2026 +0200 Merge tag 'qcom-drivers-fixes-for-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm driver fixes for v7.0 Fix the length of the PD restart reason string in pd-mapper to avoid QMI decoding errors, resulting in the notification being dropped. Fix the newly introduce handling of TBT/USB4 notifications in pmic_glink altmode driver, as it broke the handling of non-TBT/USB4 DisplayPort unplug events. * tag 'qcom-drivers-fixes-for-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: pmic_glink_altmode: Fix TBT->SAFE->!TBT transition soc: qcom: pmic_glink_altmode: Fix SVID=DP && unconnected edge case soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei Signed-off-by: Krzysztof Kozlowski commit 7962fd9375fddc920d354d9496d745bef00059f6 Merge: 4b2b3f034a051f c7596f9001e2b8 Author: Krzysztof Kozlowski Date: Wed Apr 1 13:42:51 2026 +0200 Merge tag 'riscv-soc-fixes-for-v7.0-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V soc fixes for v7.0-rc6 Microchip: More resource leak fixes for unlikely scenarios, and a change to the auto-update "firmware" driver to prevent it probing on systems with engineering silicon where it cannot be used. Signed-off-by: Conor Dooley * tag 'riscv-soc-fixes-for-v7.0-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux: firmware: microchip: fail auto-update probe if no flash found soc: microchip: mpfs-mss-top-sysreg: Fix resource leak on driver unbind soc: microchip: mpfs-control-scb: Fix resource leak on driver unbind Signed-off-by: Krzysztof Kozlowski commit 4b2b3f034a051f2f46ba468a8faae4c6a65d4029 Merge: 14a891256d62d9 7ec1bd3d9be671 Author: Krzysztof Kozlowski Date: Wed Apr 1 13:29:57 2026 +0200 Merge tag 'aspeed-7.0-fixes-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes aspeed: first batch of fixes for v7.0 * tag 'aspeed-7.0-fixes-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux: soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Signed-off-by: Krzysztof Kozlowski commit 14a891256d62d9924bd26b28fea9c70584256120 Merge: 55372ab135a8e8 a0e0c2f8c5f32b Author: Krzysztof Kozlowski Date: Wed Apr 1 13:25:50 2026 +0200 Merge tag 'reset-fixes-for-v7.0-2' of https://git.pengutronix.de/git/pza/linux into arm/fixes Reset controller fixes for v7.0, part 2 * Decouple spacemit K3 reset lines that were incorrectly coupled together as one, but are in fact separate resets in hardware. * Fix a double free in the reset_add_gpio_aux_device() error path. This has already been fixed on reset/next by commit a9b95ce36de4 ("reset: gpio: add a devlink between reset-gpio and its consumer"). * Fix the MODULE_AUTHOR string in the rzg2l-usbphy-ctrl driver. * tag 'reset-fixes-for-v7.0-2' of https://git.pengutronix.de/git/pza/linux: reset: spacemit: k3: Decouple composite reset lines reset: gpio: fix double free in reset_add_gpio_aux_device() error path reset: rzg2l-usbphy-ctrl: Fix malformed MODULE_AUTHOR string Signed-off-by: Krzysztof Kozlowski commit e91d5f94acf68618ea3ad9c92ac28614e791ae7d Author: Jacky Bai Date: Fri Mar 20 16:43:46 2026 +0800 pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled Keep the NOC_HDCP clock always enabled to fix the potential hang caused by the NoC ADB400 port power down handshake. Fixes: 77b0ddb42add ("soc: imx: add i.MX8MP HDMI blk ctrl HDCP/HRV_MWR") Signed-off-by: Jacky Bai Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 88c4bd90725557796c15878b7cb70066e9e6b5ab Author: Michal Wilczynski Date: Thu Apr 3 15:10:51 2025 +0200 firmware: thead: Fix buffer overflow and use standard endian macros Addresses two issues in the TH1520 AON firmware protocol driver: 1. Fix a potential buffer overflow where the code used unsafe pointer arithmetic to access the 'mode' field through the 'resource' pointer with an offset. This was flagged by Smatch static checker as: "buffer overflow 'data' 2 <= 3" 2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard kernel endianness conversion macros (cpu_to_be16, etc.) for better portability and maintainability. The functionality was re-tested with the GPU power-up sequence, confirming the GPU powers up correctly and the driver probes successfully. [ 12.702370] powervr ffef400000.gpu: [drm] loaded firmware powervr/rogue_36.52.104.182_v1.fw [ 12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build 6645434 OS) [ 12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on minor 0 Fixes: e4b3cbd840e5 ("firmware: thead: Add AON firmware protocol driver") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/17a0ccce-060b-4b9d-a3c4-8d5d5823b1c9@stanley.mountain/ Signed-off-by: Michal Wilczynski Reviewed-by: Dan Carpenter Acked-by: Drew Fustini Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit da107398cbd4bbdb6bffecb2ce86d5c9384f4cec Author: Pablo Neira Ayuso Date: Tue Mar 31 23:08:02 2026 +0200 netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict. Immediately emitting an NF_QUEUE verdict is never used by the userspace nft tools, so reject immediate NF_QUEUE verdicts. The arp family does not provide queue support, but such an immediate verdict is still reachable. Globally reject NF_QUEUE immediate verdicts to address this issue. Fixes: f342de4e2f33 ("netfilter: nf_tables: reject QUEUE/DROP verdict parameters") Signed-off-by: Pablo Neira Ayuso commit 3d5d488f11776738deab9da336038add95d342d1 Author: Pablo Neira Ayuso Date: Tue Mar 31 16:41:25 2026 +0200 netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Weiming Shi says: xt_match and xt_target structs registered with NFPROTO_UNSPEC can be loaded by any protocol family through nft_compat. When such a match/target sets .hooks to restrict which hooks it may run on, the bitmask uses NF_INET_* constants. This is only correct for families whose hook layout matches NF_INET_*: IPv4, IPv6, INET, and bridge all share the same five hooks (PRE_ROUTING ... POST_ROUTING). ARP only has three hooks (IN=0, OUT=1, FORWARD=2) with different semantics. Because NF_ARP_OUT == 1 == NF_INET_LOCAL_IN, the .hooks validation silently passes for the wrong reasons, allowing matches to run on ARP chains where the hook assumptions (e.g. state->in being set on input hooks) do not hold. This leads to NULL pointer dereferences; xt_devgroup is one concrete example: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227] RIP: 0010:devgroup_mt+0xff/0x350 Call Trace: nft_match_eval (net/netfilter/nft_compat.c:407) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_arp (net/netfilter/nft_chain_filter.c:61) nf_hook_slow (net/netfilter/core.c:623) arp_xmit (net/ipv4/arp.c:666) Kernel panic - not syncing: Fatal exception in interrupt Fix it by restricting arptables to NFPROTO_ARP extensions only. Note that arptables-legacy only supports: - arpt_CLASSIFY - arpt_mangle - arpt_MARK that provide explicit NFPROTO_ARP match/target declarations. Fixes: 9291747f118d ("netfilter: xtables: add device group match") Reported-by: Xiang Mei Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9862ef9ab0a116c6dca98842aab7de13a252ae02 Author: Yifan Wu Date: Mon Mar 30 14:39:24 2026 -0700 netfilter: ipset: drop logically empty buckets in mtype_del mtype_del() counts empty slots below n->pos in k, but it only drops the bucket when both n->pos and k are zero. This misses buckets whose live entries have all been removed while n->pos still points past deleted slots. Treat a bucket as empty when all positions below n->pos are unused and release it directly instead of shrinking it further. Fixes: 8af1c6fbd923 ("netfilter: ipset: Fix forceadd evaluation path") Cc: stable@vger.kernel.org Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Yifan Wu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Reviewed-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 917b61fa2042f11e2af4c428e43f08199586633a Author: Pablo Neira Ayuso Date: Mon Mar 30 11:26:22 2026 +0200 netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master conntrack helper, anything else is not really supported and it just makes validation more complicated, so just ignore what helper userspace suggests for this expectation. This was uncovered when validating CTA_EXPECT_CLASS via different helper provided by userspace than the existing master conntrack helper: BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0 Read of size 4 at addr ffff8880043fe408 by task poc/102 Call Trace: nf_ct_expect_related_report+0x2479/0x27c0 ctnetlink_create_expect+0x22b/0x3b0 ctnetlink_new_expect+0x4bd/0x5c0 nfnetlink_rcv_msg+0x67a/0x950 netlink_rcv_skb+0x120/0x350 Allowing to read kernel memory bytes off the expectation boundary. CTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace via netlink dump. Fixes: bd0779370588 ("netfilter: nfnetlink_queue: allow to attach expectations to conntracks") Reported-by: Qi Tang Signed-off-by: Pablo Neira Ayuso commit 35177c6877134a21315f37d57a5577846225623e Author: Qi Tang Date: Tue Mar 31 14:17:12 2026 +0800 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ctnetlink_alloc_expect() allocates expectations from a non-zeroing slab cache via nf_ct_expect_alloc(). When CTA_EXPECT_NAT is not present in the netlink message, saved_addr and saved_proto are never initialized. Stale data from a previous slab occupant can then be dumped to userspace by ctnetlink_exp_dump_expect(), which checks these fields to decide whether to emit CTA_EXPECT_NAT. The safe sibling nf_ct_expect_init(), used by the packet path, explicitly zeroes these fields. Zero saved_addr, saved_proto and dir in the else branch, guarded by IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when NAT is enabled. Confirmed by priming the expect slab with NAT-bearing expectations, freeing them, creating a new expectation without CTA_EXPECT_NAT, and observing that the ctnetlink dump emits a spurious CTA_EXPECT_NAT containing stale data from the prior allocation. Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations") Reported-by: kernel test robot Signed-off-by: Qi Tang Signed-off-by: Pablo Neira Ayuso commit a242a9ae58aa46ff7dae51ce64150a93957abe65 Author: Qi Tang Date: Mon Mar 30 00:50:36 2026 +0800 netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregistered. However, it passes NULL instead of the helper pointer as the data argument, so expect_iter_me() never matches any expectation and all of them survive the cleanup. After unregister returns, nfnl_cthelper_del() frees the helper object immediately. Subsequent expectation dumps or packet-driven init_conntrack() calls then dereference the freed exp->helper, causing a use-after-free. Pass the actual helper pointer so expectations referencing it are properly destroyed before the helper object is freed. BUG: KASAN: slab-use-after-free in string+0x38f/0x430 Read of size 1 at addr ffff888003b14d20 by task poc/103 Call Trace: string+0x38f/0x430 vsnprintf+0x3cc/0x1170 seq_printf+0x17a/0x240 exp_seq_show+0x2e5/0x560 seq_read_iter+0x419/0x1280 proc_reg_read+0x1ac/0x270 vfs_read+0x179/0x930 ksys_read+0xef/0x1c0 Freed by task 103: The buggy address is located 32 bytes inside of freed 192-byte region [ffff888003b14d00, ffff888003b14dc0) Fixes: ac7b84839003 ("netfilter: expect: add and use nf_ct_expect_iterate helpers") Signed-off-by: Qi Tang Reviewed-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit b7e8590987aa94c9dc51518fad0e58cb887b1db5 Author: Florian Westphal Date: Mon Mar 30 14:16:34 2026 +0200 netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr IPSET_ATTR_NAME and IPSET_ATTR_NAMEREF are of NLA_STRING type, they cannot be treated like a c-string. They either have to be switched to NLA_NUL_STRING, or the compare operations need to use the nla functions. Fixes: f830837f0eed ("netfilter: ipset: list:set set type support") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit a958a4f90ddd7de0800b33ca9d7b886b7d40f74e Author: Florian Westphal Date: Tue Mar 31 23:13:36 2026 +0200 netfilter: x_tables: ensure names are nul-terminated Reject names that lack a \0 character before feeding them to functions that expect c-strings. Fixes tag is the most recent commit that needs this change. Fixes: c38c4597e4bf ("netfilter: implement xt_cgroup cgroup2 path match") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 6d52a4a0520a6696bdde51caa11f2d6821cd0c01 Author: Florian Westphal Date: Thu Mar 26 16:17:24 2026 +0100 netfilter: nfnetlink_log: account for netlink header size This is a followup to an old bug fix: NLMSG_DONE needs to account for the netlink header size, not just the attribute size. This can result in a WARN splat + drop of the netlink message, but other than this there are no ill effects. Fixes: 9dfa1dfe4d5e ("netfilter: nf_log: account for size of NLMSG_DONE attribute") Reported-by: Yiming Qian Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 76522fcdbc3a02b568f5d957f7e66fc194abb893 Author: Pablo Neira Ayuso Date: Thu Mar 26 00:17:09 2026 +0100 netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethernet address) * SNAT (4 payload actions) * DNAT (4 payload actions) * Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing) for QinQ. * Redirect (1 action) Which makes 17, while the maximum is 16. But act_ct supports for tunnels actions too. Note that payload action operates at 32-bit word level, so mangling an IPv6 address takes 4 payload actions. Update flow_action_entry_next() calls to check for the maximum number of supported actions. While at it, rise the maximum number of actions per flow from 16 to 24 so this works fine with IPv6 setups. Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") Reported-by: Hyunwoo Kim Signed-off-by: Pablo Neira Ayuso commit e8d0ed37bd51da52da6225d278e330c2f18a6198 Author: Ernestas Kulik Date: Tue Mar 24 13:07:16 2026 +0200 USB: serial: option: add MeiG Smart SRM825WN Add support for the SDX62-based MeiG Smart SRM825WN module. If#= 0: RNDIS If#= 1: RNDIS If#= 2: Diag If#= 3: AT If#= 4: AT If#= 5: NMEA T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 19 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2dee ProdID=4d38 Rev= 5.04 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=da47a175 C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Ernestas Kulik Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit f40b1401b6ad0f4dadfca4e7a69744352a2e4f8f Author: Ard Biesheuvel Date: Thu Mar 26 19:04:36 2026 +0100 lis3lv02d: Omit IRQF_ONESHOT if no threaded handler is provided The lis3lv02d started triggering a WARN in the IRQ code because it passes IRQF_ONESHOT to request_threaded_irq() even when thread_fn is NULL, which is an invalid combination. So set the flag only if thread_fn is non-NULL. Cc: Eric Piel Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Signed-off-by: Ard Biesheuvel Link: https://patch.msgid.link/20260326180436.14968-2-ardb@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8c0ef7b56d6bbbc53f2d43d99c195144f01b0775 Author: Randy Dunlap Date: Wed Mar 11 22:14:00 2026 -0700 lis3lv02d: fix kernel-doc warnings Use the correct kernel-doc format to avoid kernel-doc warnings: Warning: include/linux/lis3lv02d.h:125 struct member 'st_min_limits' not described in 'lis3lv02d_platform_data' Warning: include/linux/lis3lv02d.h:125 struct member 'st_max_limits' not described in 'lis3lv02d_platform_data' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260312051400.682991-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit a0dafdbd1049a8ea661a1a471be1b840bd8aed13 Author: Geoffrey D. Bennett Date: Wed Apr 1 16:01:27 2026 +1030 ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP Same issue as the other 1st Gen Scarletts: QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted audio on this revision of the Scarlett 2i2 1st Gen (1235:8016). Fixes: 38c322068a26 ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP") Reported-by: lukas-reineke [https://github.com/geoffreybennett/linux-fcp/issues/54] Signed-off-by: Geoffrey D. Bennett Link: https://patch.msgid.link/acytr8aEUba4VXmZ@m.b4.vu Signed-off-by: Takashi Iwai commit 48b3cd69265f346f64b93064723492da46206e9b Author: Michal Piekos Date: Sat Mar 28 09:55:51 2026 +0100 net: stmmac: skip VLAN restore when VLAN hash ops are missing stmmac_vlan_restore() unconditionally calls stmmac_vlan_update() when NETIF_F_VLAN_FEATURES is set. On platforms where priv->hw->vlan (or ->update_vlan_hash) is not provided, stmmac_update_vlan_hash() returns -EINVAL via stmmac_do_void_callback(), resulting in a spurious "Failed to restore VLANs" error even when no VLAN filtering is in use. Remove not needed comment. Remove not used return value from stmmac_vlan_restore(). Tested on Orange Pi Zero 3. Fixes: bd7ad51253a7 ("net: stmmac: Fix VLAN HW state restore") Signed-off-by: Michal Piekos Link: https://patch.msgid.link/20260328-vlan-restore-error-v4-1-f88624c530dc@mmpsystems.pl Signed-off-by: Jakub Kicinski commit c0fd0fe745f5e8c568d898cd1513d0083e46204a Author: Yufan Chen Date: Sun Mar 29 00:32:57 2026 +0800 net: ftgmac100: fix ring allocation unwind on open failure ftgmac100_alloc_rings() allocates rx_skbs, tx_skbs, rxdes, txdes, and rx_scratch in stages. On intermediate failures it returned -ENOMEM directly, leaking resources allocated earlier in the function. Rework the failure path to use staged local unwind labels and free allocated resources in reverse order before returning -ENOMEM. This matches common netdev allocation cleanup style. Fixes: d72e01a0430f ("ftgmac100: Use a scratch buffer for failed RX allocations") Cc: stable@vger.kernel.org Signed-off-by: Yufan Chen Link: https://patch.msgid.link/20260328163257.60836-1-yufan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 5dd8025a49c268ab6b94d978532af3ad341132a7 Author: Li Xiasong Date: Mon Mar 30 20:03:35 2026 +0800 mptcp: fix soft lockup in mptcp_recvmsg() syzbot reported a soft lockup in mptcp_recvmsg() [0]. When receiving data with MSG_PEEK | MSG_WAITALL flags, the skb is not removed from the sk_receive_queue. This causes sk_wait_data() to always find available data and never perform actual waiting, leading to a soft lockup. Fix this by adding a 'last' parameter to track the last peeked skb. This allows sk_wait_data() to make informed waiting decisions and prevent infinite loops when MSG_PEEK is used. [0]: watchdog: BUG: soft lockup - CPU#2 stuck for 156s! [server:1963] Modules linked in: CPU: 2 UID: 0 PID: 1963 Comm: server Not tainted 6.19.0-rc8 #61 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_wait_data+0x15/0x190 Code: 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 49 89 f4 55 48 89 d5 53 48 89 fb <48> 83 ec 30 65 48 8b 05 17 a4 6b 01 48 89 44 24 28 31 c0 65 48 8b RSP: 0018:ffffc90000603ca0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888102bf0800 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffc90000603d18 RDI: ffff888102bf0800 RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000101 R10: 0000000000000000 R11: 0000000000000075 R12: ffffc90000603d18 R13: ffff888102bf0800 R14: ffff888102bf0800 R15: 0000000000000000 FS: 00007f6e38b8c4c0(0000) GS:ffff8881b877e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aa7bff1680 CR3: 0000000105cbe000 CR4: 00000000000006f0 Call Trace: mptcp_recvmsg+0x547/0x8c0 net/mptcp/protocol.c:2329 inet_recvmsg+0x11f/0x130 net/ipv4/af_inet.c:891 sock_recvmsg+0x94/0xc0 net/socket.c:1100 __sys_recvfrom+0xb2/0x130 net/socket.c:2256 __x64_sys_recvfrom+0x1f/0x30 net/socket.c:2267 do_syscall_64+0x59/0x2d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:131 RIP: 0033:0x7f6e386a4a1d Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 f1 de 2c 00 41 89 ca 8b 00 85 c0 75 20 45 31 c9 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6b f3 c3 66 0f 1f 84 00 00 00 00 00 41 56 41 RSP: 002b:00007ffc3c4bb078 EFLAGS: 00000246 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 000000000000861e RCX: 00007f6e386a4a1d RDX: 00000000000003ff RSI: 00007ffc3c4bb150 RDI: 0000000000000004 RBP: 00007ffc3c4bb570 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000103 R11: 0000000000000246 R12: 00005605dbc00be0 R13: 00007ffc3c4bb650 R14: 0000000000000000 R15: 0000000000000000 Fixes: 8e04ce45a8db ("mptcp: fix MSG_PEEK stream corruption") Signed-off-by: Li Xiasong Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260330120335.659027-1-lixiasong1@huawei.com Signed-off-by: Jakub Kicinski commit 78ec5bf2f589ec7fd8f169394bfeca541b077317 Author: Fredric Cover Date: Mon Mar 30 13:11:27 2026 -0700 fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read. This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL. The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs. Signed-off-by: Fredric Cover Reviewed-by: Henrique Carvalho <[2]henrique.carvalho@suse.com> Signed-off-by: Steve French commit e2d072d6a3d1369d289667f51cf771eefa3c0b26 Merge: a8502a79e832b8 c76fef7dcd9372 Author: Alexei Starovoitov Date: Tue Mar 31 16:01:13 2026 -0700 Merge branch 'fix-bpf_link-grace-period-wait-for-tracepoints' Kumar Kartikeya Dwivedi says: ==================== Fix bpf_link grace period wait for tracepoints A recent change to non-faultable tracepoints switched from preempt-disabled critical sections to SRCU-fast, which breaks assumptions in the bpf_link_free() path. Use call_srcu() to fix the breakage. Changelog: ---------- v3 -> v4 v3: https://lore.kernel.org/bpf/20260331005215.2813492-1-memxor@gmail.com * Introduce call_tracepoint_unregister_{atomic,syscall} instead. (Alexei, Steven) v2 -> v3 v2: https://lore.kernel.org/bpf/20260330143102.1265391-1-memxor@gmail.com * Introduce and switch to call_tracepoint_unregister_non_faultable(). (Steven) * Address Andrii's comment and add Acked-by. (Andrii) * Drop rcu_trace_implies_rcu_gp() conversion. (Alexei) v1 -> v2 v1: https://lore.kernel.org/bpf/20260330032124.3141001-1-memxor@gmail.com * Add Reviewed-by tags. (Paul, Puranjay) * Adjust commit descriptions and comments to clarify intent. (Puranjay) ==================== Link: https://patch.msgid.link/20260331211021.1632902-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit c76fef7dcd9372e3476d4df5e0a72ed5919a814b Author: Kumar Kartikeya Dwivedi Date: Tue Mar 31 23:10:20 2026 +0200 bpf: Fix grace period wait for tracepoint bpf_link Recently, tracepoints were switched from using disabled preemption (which acts as RCU read section) to SRCU-fast when they are not faultable. This means that to do a proper grace period wait for programs running in such tracepoints, we must use SRCU's grace period wait. This is only for non-faultable tracepoints, faultable ones continue using RCU Tasks Trace. However, bpf_link_free() currently does call_rcu() for all cases when the link is non-sleepable (hence, for tracepoints, non-faultable). Fix this by doing a call_srcu() grace period wait. As far RCU Tasks Trace gp -> RCU gp chaining is concerned, it is deemed unnecessary for tracepoint programs. The link and program are either accessed under RCU Tasks Trace protection, or SRCU-fast protection now. The earlier logic of chaining both RCU Tasks Trace and RCU gp waits was to generalize the logic, even if it conceded an extra RCU gp wait, however that is unnecessary for tracepoints even before this change. In practice no cost was paid since rcu_trace_implies_rcu_gp() was always true. Hence we need not chaining any RCU gp after the SRCU gp. For instance, in the non-faultable raw tracepoint, the RCU read section of the program in __bpf_trace_run() is enclosed in the SRCU gp, likewise for faultable raw tracepoint, the program is under the RCU Tasks Trace protection. Hence, the outermost scope can be waited upon to ensure correctness. Also, sleepable programs cannot be attached to non-faultable tracepoints, so whenever program or link is sleepable, only RCU Tasks Trace protection is being used for the link and prog. Fixes: a46023d5616e ("tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast") Reviewed-by: Sun Jian Reviewed-by: Puranjay Mohan Acked-by: Andrii Nakryiko Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20260331211021.1632902-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 9ca562bb8e66978b53028fa32b1a190708e6a091 Author: Zhengchuan Liang Date: Mon Mar 30 16:46:24 2026 +0800 net: ipv6: flowlabel: defer exclusive option free until RCU teardown `ip6fl_seq_show()` walks the global flowlabel hash under the seq-file RCU read-side lock and prints `fl->opt->opt_nflen` when an option block is present. Exclusive flowlabels currently free `fl->opt` as soon as `fl->users` drops to zero in `fl_release()`. However, the surrounding `struct ip6_flowlabel` remains visible in the global hash table until later garbage collection removes it and `fl_free_rcu()` finally tears it down. A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that early `kfree()` and dereference freed option state, triggering a crash in `ip6fl_seq_show()`. Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches the lifetime already required for the enclosing flowlabel while readers can still reach it under RCU. Fixes: d3aedd5ebd4b ("ipv6 flowlabel: Convert hash list to RCU.") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/07351f0ec47bcee289576f39f9354f4a64add6e4.1774855883.git.zcliangcn@gmail.com Signed-off-by: Jakub Kicinski commit a8502a79e832b861e99218cbd2d8f4312d62e225 Author: Alexei Starovoitov Date: Tue Mar 31 13:42:28 2026 -0700 bpf: Fix regsafe() for pointers to packet In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N regsafe() may return true which may lead to current state with valid packet range not being explored. Fix the bug. Fixes: 6d94e741a8ff ("bpf: Support for pointers beyond pkt_end.") Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Reviewed-by: Daniel Borkmann Reviewed-by: Amery Hung Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20260331204228.26726-1-alexei.starovoitov@gmail.com commit 9147566d801602c9e7fc7f85e989735735bf38ba Merge: 0958d657b4bc28 090d34f0f02851 Author: Linus Torvalds Date: Tue Mar 31 14:23:12 2026 -0700 Merge tag 'sched_ext-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix SCX_KICK_WAIT deadlock where multiple CPUs waiting for each other in hardirq context form a cycle. Move the wait to a balance callback which can drop the rq lock and process IPIs. - Fix inconsistent NUMA node lookup in scx_select_cpu_dfl() where the waker_node used cpu_to_node() while prev_cpu used scx_cpu_node_if_enabled(), leading to undefined behavior when per-node idle tracking is disabled. * tag 'sched_ext-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: selftests/sched_ext: Add cyclic SCX_KICK_WAIT stress test sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl() commit 0958d657b4bc28c5cdc313b9953cbcc0667c864f Merge: 53d85a20564403 e398978ddf18fe Author: Linus Torvalds Date: Tue Mar 31 14:20:39 2026 -0700 Merge tag 'wq-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: - Fix false positive stall reports on weakly ordered architectures where the lockless worklist/timestamp check in the watchdog can observe stale values due to memory reordering. Recheck under pool->lock to confirm. * tag 'wq-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Better describe stall check workqueue: Fix false positive stall reports commit 53d85a205644036d914a1408a3a301f7068f320b Merge: dbf00d8d23b43a 089f3fcd690c71 Author: Linus Torvalds Date: Tue Mar 31 13:59:51 2026 -0700 Merge tag 'cgroup-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Fix cgroup rmdir racing with dying tasks. Deferred task cgroup unlink introduced a window where cgroup.procs is empty but the cgroup is still populated, causing rmdir to fail with -EBUSY and selftest failures. Make rmdir wait for dying tasks to fully leave and fix selftests to not depend on synchronous populated updates. - Fix cpuset v1 task migration failure from empty cpusets under strict security policies. When CPU hotplug removes the last CPU from a v1 cpuset, tasks must be migrated to an ancestor without a security_task_setscheduler() check that would block the migration. * tag 'cgroup-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: Skip security check for hotplug induced v1 task migration cgroup/cpuset: Simplify setsched decision check in task iteration loop of cpuset_can_attach() cgroup: Fix cgroup_drain_dying() testing the wrong condition selftests/cgroup: Don't require synchronous populated update on task exit cgroup: Wait for dying tasks to leave on rmdir commit 089f3fcd690c71cb3d8ca09f34027764e28920a0 Author: Waiman Long Date: Tue Mar 31 11:11:08 2026 -0400 cgroup/cpuset: Skip security check for hotplug induced v1 task migration When a CPU hot removal causes a v1 cpuset to lose all its CPUs, the cpuset hotplug handler will schedule a work function to migrate tasks in that cpuset with no CPU to its ancestor to enable those tasks to continue running. If a strict security policy is in place, however, the task migration may fail when security_task_setscheduler() call in cpuset_can_attach() returns a -EACCES error. That will mean that those tasks will have no CPU to run on. The system administrators will have to explicitly intervene to either add CPUs to that cpuset or move the tasks elsewhere if they are aware of it. This problem was found by a reported test failure in the LTP's cpuset_hotplug_test.sh. Fix this problem by treating this special case as an exception to skip the setsched security check in cpuset_can_attach() when a v1 cpuset with tasks have no CPU left. With that patch applied, the cpuset_hotplug_test.sh test can be run successfully without failure. Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit bbe5ab8191a33572c11be8628c55b79246307125 Author: Waiman Long Date: Tue Mar 31 11:11:07 2026 -0400 cgroup/cpuset: Simplify setsched decision check in task iteration loop of cpuset_can_attach() Centralize the check required to run security_task_setscheduler() in the task iteration loop of cpuset_can_attach() outside of the loop as it has no dependency on the characteristics of the tasks themselves. There is no functional change. Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit dbf00d8d23b43a7a1d717e704c50651731d01d71 Merge: d0c3bcd5b89761 102e57d56f81fa Author: Linus Torvalds Date: Tue Mar 31 10:28:08 2026 -0700 Merge tag 'fs_for_v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull udf fix from Jan Kara: "Fix for a race in UDF that can lead to memory corruption" * tag 'fs_for_v7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix race between file type conversion and writeback mpage: Provide variant of mpage_writepages() with own optional folio handler commit 5d486669b3db11ccc2d1b9f4e42c11c2766f35ba Author: Denis Benato Date: Sun Mar 29 14:46:59 2026 +0200 platform/x86: asus-armoury: add support for GU605MU Add TDP data for laptop model GU605MU. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260329124659.3967495-4-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b4f04a6038fa97f7ceea33e99456b9838c79dde7 Author: Denis Benato Date: Sun Mar 29 14:46:58 2026 +0200 platform/x86: asus-armoury: add support for FA607NU Add TDP data for laptop model FA607NU. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260329124659.3967495-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 82cbae59263e3941a8bb79f0b25e0b0f085132d4 Author: Denis Benato Date: Sun Mar 29 14:46:57 2026 +0200 platform/x86: asus-armoury: add support for GV302XU Add TDP data for laptop model GV302XU. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260329124659.3967495-2-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dd9b99b822684f421f9b7e1e5a69d791ffc1d48f Author: Zhang Heng Date: Tue Mar 31 17:46:14 2026 +0800 ALSA: hda/realtek: add quirk for Acer Swift SFG14-73 fix mute/micmute LEDs and headset microphone for Acer Swift SFG14-73. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220279 Cc: stable@vger.kernel.org Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260331094614.186063-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 217d5bc9f96272316ac5a3215c7cc32a5127bbf3 Author: Alexander Savenko Date: Tue Mar 31 11:29:28 2026 +0300 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9 The Lenovo Yoga Pro 7 14IMH9 (DMI: 83E2) shares PCI SSID 17aa:3847 with the Legion 7 16ACHG6, but has a different codec subsystem ID (17aa:38cf). The existing SND_PCI_QUIRK for 17aa:3847 applies ALC287_FIXUP_LEGION_16ACHG6, which attempts to initialize an external I2C amplifier (CLSA0100) that is not present on the Yoga Pro 7 14IMH9. As a result, pin 0x17 (bass speakers) is connected to DAC 0x06 which has no volume control, making hardware volume adjustment completely non-functional. Audio is either silent or at maximum volume regardless of the slider position. Add a HDA_CODEC_QUIRK entry using the codec subsystem ID (17aa:38cf) to correctly identify the Yoga Pro 7 14IMH9 and apply ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN, which redirects pin 0x17 to DAC 0x02 and restores proper volume control. The existing Legion entry is preserved unchanged. This follows the same pattern used for 17aa:386e, where Legion Y9000X and Yoga Pro 7 14ARP8 share a PCI SSID but are distinguished via HDA_CODEC_QUIRK. Link: https://github.com/nomad4tech/lenovo-yoga-pro-7-linux Tested-by: Alexander Savenko Signed-off-by: Alexander Savenko Link: https://patch.msgid.link/20260331082929.44890-1-alex.sav4387@gmail.com Signed-off-by: Takashi Iwai commit fa6e24963342de4370e3a3c9af41e38277b74cf3 Author: Xiang Mei Date: Fri Mar 27 23:30:00 2026 -0700 bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes. Fixes: 20f6a05ef635 ("bridge: mrp: Rework the MRP netlink interface") Fixes: 7ab1748e4ce6 ("bridge: mrp: Extend MRP netlink interface for configuring MRP interconnect") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Acked-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260328063000.1845376-1-xmei5@asu.edu Signed-off-by: Paolo Abeni commit e920c36f2073d533bdf19ba6ab690432c8173b63 Author: Julian Braha Date: Wed Mar 25 00:15:21 2026 +0000 ASoC: Intel: boards: fix unmet dependency on PINCTRL This reverts commit c073f0757663 ("ASoC: Intel: sof_sdw: select PINCTRL_CS42L43 and SPI_CS42L43") Currently, SND_SOC_INTEL_SOUNDWIRE_SOF_MACH selects PINCTRL_CS42L43 without also selecting or depending on PINCTRL, despite PINCTRL_CS42L43 depending on PINCTRL. See the following Kbuild warning: WARNING: unmet direct dependencies detected for PINCTRL_CS42L43 Depends on [n]: PINCTRL [=n] && MFD_CS42L43 [=m] Selected by [m]: - SND_SOC_INTEL_SOUNDWIRE_SOF_MACH [=m] && SOUND [=y] && SND [=m] && SND_SOC [=m] && SND_SOC_INTEL_MACH [=y] && (SND_SOC_SOF_INTEL_COMMON [=m] || !SND_SOC_SOF_INTEL_COMMON [=m]) && SND_SOC_SOF_INTEL_SOUNDWIRE [=m] && I2C [=y] && SPI_MASTER [=y] && ACPI [=y] && (MFD_INTEL_LPSS [=n] || COMPILE_TEST [=y]) && (SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES [=n] || COMPILE_TEST [=y]) && SOUNDWIRE [=m] In response to v1 of this patch [1], Arnd pointed out that there is no compile-time dependency sof_sdw and the PINCTRL_CS42L43 driver. After testing, I can confirm that the kernel compiled with SND_SOC_INTEL_SOUNDWIRE_SOF_MACH enabled and PINCTRL_CS42L43 disabled. This unmet dependency was detected by kconfirm, a static analysis tool for Kconfig. Link: https://lore.kernel.org/all/b8aecc71-1fed-4f52-9f6c-263fbe56d493@app.fastmail.com/ [1] Fixes: c073f0757663 ("ASoC: Intel: sof_sdw: select PINCTRL_CS42L43 and SPI_CS42L43") Signed-off-by: Julian Braha Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20260325001522.1727678-1-julianbraha@gmail.com Signed-off-by: Mark Brown commit 69335152910b775e7835939d5c863c580c605275 Author: Geert Uytterhoeven Date: Tue Jan 27 20:11:05 2026 +0100 misc/mei: INTEL_MEI should depend on X86 or DRM_XE The Intel Management Engine Interface is only present on x86 platforms and Intel Xe graphics cards. Hence add a dependency on X86 or DRM_XE, to prevent asking the user about this driver when configuring a kernel for a non-x86 architecture and without Xe graphics support. Fixes: 25f9b0d35155 ("misc/mei: Allow building Intel ME interface on non-x86") Cc: stable Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/8e2646fb71b148b3d38beb13f19b14e3634a1e1a.1769541024.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 8c27b1bce059a11a8d3c8682984e13866f0714af Author: Alexander Usyskin Date: Mon Mar 30 11:38:30 2026 +0300 mei: me: reduce the scope on unexpected reset After commit 2cedb296988c ("mei: me: trigger link reset if hw ready is unexpected") some devices started to show long resume times (5-7 seconds). This happens as mei falsely detects unready hardware, starts parallel link reset flow and triggers link reset timeouts in the resume callback. Address it by performing detection of unready hardware only when driver is in the MEI_DEV_ENABLED state instead of blacklisting states as done in the original patch. This eliminates active waitqueue check as in MEI_DEV_ENABLED state there will be no active waitqueue. Reviewed-by: Rafael J. Wysocki (Intel) Reported-by: Todd Brandt Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221023 Tested-by: Todd Brandt Fixes: 2cedb296988c ("mei: me: trigger link reset if hw ready is unexpected") Cc: stable Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260330083830.536056-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit ec327abae5edd1d5b60ea9f920212970133171d2 Author: Alice Ryhl Date: Sat Mar 14 11:19:51 2026 +0000 rust_binder: use AssertSync for BINDER_VM_OPS When declaring an immutable global variable in Rust, the compiler checks that it looks thread safe, because it is generally safe to access said global variable. When using C bindings types for these globals, we don't really want this check, because it is conservative and assumes pointers are not thread safe. In the case of BINDER_VM_OPS, this is a challenge when combined with the patch 'userfaultfd: introduce vm_uffd_ops' [1], which introduces a pointer field to vm_operations_struct. It previously only held function pointers, which are considered thread safe. Rust Binder should not be assuming that vm_operations_struct contains no pointer fields, so to fix this, use AssertSync (which Rust Binder has already declared for another similar global of type struct file_operations with the same problem). This ensures that even if another commit adds a pointer field to vm_operations_struct, this does not cause problems. Fixes: 8ef2c15aeae0 ("rust_binder: check ownership before using vma") Cc: stable Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603121235.tpnRxFKO-lkp@intel.com/ Link: https://lore.kernel.org/r/20260306171815.3160826-8-rppt@kernel.org [1] Signed-off-by: Alice Ryhl Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260314111951.4139029-1-aliceryhl@google.com Signed-off-by: Greg Kroah-Hartman commit 45b859b0728267a6199ee5002d62e6c6f3e8c89d Author: Rafael J. Wysocki Date: Fri Mar 27 10:49:52 2026 +0100 thermal: core: Address thermal zone removal races with resume Since thermal_zone_pm_complete() and thermal_zone_device_resume() re-initialize the poll_queue delayed work for the given thermal zone, the cancel_delayed_work_sync() in thermal_zone_device_unregister() may miss some already running work items and the thermal zone may be freed prematurely [1]. There are two failing scenarios that both start with running thermal_pm_notify_complete() right before invoking thermal_zone_device_unregister() for one of the thermal zones. In the first scenario, there is a work item already running for the given thermal zone when thermal_pm_notify_complete() calls thermal_zone_pm_complete() for that thermal zone and it continues to run when thermal_zone_device_unregister() starts. Since the poll_queue delayed work has been re-initialized by thermal_pm_notify_complete(), the running work item will be missed by the cancel_delayed_work_sync() in thermal_zone_device_unregister() and if it continues to run past the freeing of the thermal zone object, a use-after-free will occur. In the second scenario, thermal_zone_device_resume() queued up by thermal_pm_notify_complete() runs right after the thermal_zone_exit() called by thermal_zone_device_unregister() has returned. The poll_queue delayed work is re-initialized by it before cancel_delayed_work_sync() is called by thermal_zone_device_unregister(), so it may continue to run after the freeing of the thermal zone object, which also leads to a use-after-free. Address the first failing scenario by ensuring that no thermal work items will be running when thermal_pm_notify_complete() is called. For this purpose, first move the cancel_delayed_work() call from thermal_zone_pm_complete() to thermal_zone_pm_prepare() to prevent new work from entering the workqueue going forward. Next, switch over to using a dedicated workqueue for thermal events and update the code in thermal_pm_notify() to flush that workqueue after thermal_pm_notify_prepare() has returned which will take care of all leftover thermal work already on the workqueue (that leftover work would do nothing useful anyway because all of the thermal zones have been flagged as suspended). The second failing scenario is addressed by adding a tz->state check to thermal_zone_device_resume() to prevent it from re-initializing the poll_queue delayed work if the thermal zone is going away. Note that the above changes will also facilitate relocating the suspend and resume of thermal zones closer to the suspend and resume of devices, respectively. Fixes: 5a5efdaffda5 ("thermal: core: Resume thermal zones asynchronously") Reported-by: syzbot+3b3852c6031d0f30dfaf@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=3b3852c6031d0f30dfaf Reported-by: Mauricio Faria de Oliveira Closes: https://lore.kernel.org/linux-pm/20260324-thermal-core-uaf-init_delayed_work-v1-1-6611ae76a8a1@igalia.com/ [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Mauricio Faria de Oliveira Tested-by: Mauricio Faria de Oliveira Reviewed-by: Lukasz Luba Cc: All applicable Link: https://patch.msgid.link/6267615.lOV4Wx5bFT@rafael.j.wysocki commit 51e3eb3d074a8c7c306d447612011cf8568c8d6f Author: Sachin Mokashi Date: Fri Mar 27 09:14:39 2026 -0400 ASoC: Intel: ehl_rt5660: Use the correct rtd->dev device in hw_params In rt5660_hw_params(), the error path for snd_soc_dai_set_sysclk() correctly uses rtd->dev as the logging device, but the error path for snd_soc_dai_set_pll() uses codec_dai->dev instead. These two devices are distinct: - rtd->dev is the platform device of the PCM runtime (the Intel HDA/SSP controller, e.g. 0000:00:1f.3), which owns the machine driver callback. - codec_dai->dev is the I2C device of the rt5660 codec itself (i2c-10EC5660:00). Since hw_params is a machine driver operation and both calls are made within the same function from the machine driver's context, all error messages should be attributed to rtd->dev. Using codec_dai->dev for one of them would suggest the error originates inside the codec driver, which is misleading. Align the PLL error log with the sysclk one to use rtd->dev, matching the convention used by all other Intel board drivers in this directory. Signed-off-by: Sachin Mokashi Link: https://patch.msgid.link/20260327131439.1330373-1-sachin.mokashi@intel.com Signed-off-by: Mark Brown commit 8f4d20a710225ec7a565f6a0459862d3b1f32330 Author: Johan Hovold Date: Fri Mar 27 11:52:06 2026 +0100 mmc: vub300: fix use-after-free on disconnect The vub300 driver maintains an explicit reference count for the controller and its driver data and the last reference can in theory be dropped after the driver has been unbound. This specifically means that the controller allocation must not be device managed as that can lead to use-after-free. Note that the lifetime is currently also incorrectly tied the parent USB device rather than interface, which can lead to memory leaks if the driver is unbound without its device being physically disconnected (e.g. on probe deferral). Fix both issues by reverting to non-managed allocation of the controller. Fixes: dcfdd698dc52 ("mmc: vub300: Use devm_mmc_alloc_host() helper") Cc: stable@vger.kernel.org # 6.17+ Cc: Binbin Zhou Signed-off-by: Johan Hovold Signed-off-by: Ulf Hansson commit dff34ef879c5e73298443956a8b391311ba78d57 Author: Johan Hovold Date: Fri Mar 27 11:52:05 2026 +0100 mmc: vub300: fix NULL-deref on disconnect Make sure to deregister the controller before dropping the reference to the driver data on disconnect to avoid NULL-pointer dereferences or use-after-free. Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") Cc: stable@vger.kernel.org # 3.0+ Signed-off-by: Johan Hovold Signed-off-by: Ulf Hansson commit 5e77923a3eb39cce91bf08ed7670f816bf86d4af Author: Chen Ni Date: Wed Mar 11 14:46:52 2026 +0800 drm/sysfb: Fix efidrm error handling and memory type mismatch Fix incorrect error checking and memory type confusion in efidrm_device_create(). devm_memremap() returns error pointers, not NULL, and returns system memory while devm_ioremap() returns I/O memory. The code incorrectly passes system memory to iosys_map_set_vaddr_iomem(). Restructure to handle each memory type separately. Use devm_ioremap*() with ERR_PTR(-ENXIO) for WC/UC, and devm_memremap() with ERR_CAST() for WT/WB. Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays") Signed-off-by: Chen Ni Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260311064652.2903449-1-nichen@iscas.ac.cn commit 47ab2c12c87a3a3cd232a7999d364353e6c908bd Merge: 30fe3f5f6494f8 d1978d03e86785 Author: Paolo Abeni Date: Tue Mar 31 12:09:26 2026 +0200 Merge branch 'correct-bd-length-masks-and-bql-accounting-for-multi-bd-tx-packets' Suraj Gupta says: ==================== Correct BD length masks and BQL accounting for multi-BD TX packets This patch series fixes two issues in the Xilinx AXI Ethernet driver: 1. Corrects the BD length masks to match the AXIDMA IP spec. 2. Fixes BQL accounting for multi-BD TX packets. ==================== Link: https://patch.msgid.link/20260327073238.134948-1-suraj.gupta2@amd.com Signed-off-by: Paolo Abeni commit d1978d03e86785872871bff9c2623174b10740de Author: Suraj Gupta Date: Fri Mar 27 13:02:38 2026 +0530 net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets When a TX packet spans multiple buffer descriptors (scatter-gather), axienet_free_tx_chain sums the per-BD actual length from descriptor status into a caller-provided accumulator. That sum is reset on each NAPI poll. If the BDs for a single packet complete across different polls, the earlier bytes are lost and never credited to BQL. This causes BQL to think bytes are permanently in-flight, eventually stalling the TX queue. The SKB pointer is stored only on the last BD of a packet. When that BD completes, use skb->len for the byte count instead of summing per-BD status lengths. This matches netdev_sent_queue(), which debits skb->len, and naturally survives across polls because no partial packet contributes to the accumulator. Fixes: c900e49d58eb ("net: xilinx: axienet: Implement BQL") Signed-off-by: Suraj Gupta Reviewed-by: Sean Anderson Link: https://patch.msgid.link/20260327073238.134948-3-suraj.gupta2@amd.com Signed-off-by: Paolo Abeni commit 393e0b4f178ec7fce1141dacc3304e3607a92ee9 Author: Suraj Gupta Date: Fri Mar 27 13:02:37 2026 +0530 net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec The XAXIDMA_BD_CTRL_LENGTH_MASK and XAXIDMA_BD_STS_ACTUAL_LEN_MASK macros were defined as 0x007FFFFF (23 bits), but the AXI DMA IP product guide (PG021) specifies the buffer length field as bits 25:0 (26 bits). Update both masks to match the IP documentation. In practice this had no functional impact, since Ethernet frames are far smaller than 2^23 bytes and the extra bits were always zero, but the masks should still reflect the hardware specification. Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") Signed-off-by: Suraj Gupta Reviewed-by: Sean Anderson Link: https://patch.msgid.link/20260327073238.134948-2-suraj.gupta2@amd.com Signed-off-by: Paolo Abeni commit 1635c2acdde86c4f555b627aec873c8677c421ed Author: NeilBrown Date: Fri Mar 27 09:18:21 2026 +1100 cachefiles: fix incorrect dentry refcount in cachefiles_cull() The patch mentioned below changed cachefiles_bury_object() to expect 2 references to the 'rep' dentry. Three of the callers were changed to use start_removing_dentry() which takes an extra reference so in those cases the call gets the expected references. However there is another call to cachefiles_bury_object() in cachefiles_cull() which did not need to be changed to use start_removing_dentry() and so was not properly considered. It still passed the dentry with just one reference so the net result is that a reference is lost. To meet the expectations of cachefiles_bury_object(), cachefiles_cull() must take an extra reference before the call. It will be dropped by cachefiles_bury_object(). Reported-by: Marc Dionne Fixes: 7bb1eb45e43c ("VFS: introduce start_removing_dentry()") Signed-off-by: NeilBrown Link: https://patch.msgid.link/177456350181.1851489.16359967086642190170@noble.neil.brown.name Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Christian Brauner commit 30fe3f5f6494f827d812ff179f295a8e532709d6 Author: Pengpeng Hou Date: Thu Mar 26 22:20:33 2026 +0800 NFC: pn533: bound the UART receive buffer pn532_receive_buf() appends every incoming byte to dev->recv_skb and only resets the buffer after pn532_uart_rx_is_frame() recognizes a complete frame. A continuous stream of bytes without a valid PN532 frame header therefore keeps growing the skb until skb_put_u8() hits the tail limit. Drop the accumulated partial frame once the fixed receive buffer is full so malformed UART traffic cannot grow the skb past PN532_UART_SKB_BUFF_LEN. Fixes: c656aa4c27b1 ("nfc: pn533: add UART phy driver") Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260326142033.82297-1-pengpeng@iscas.ac.cn Signed-off-by: Paolo Abeni commit 2884bf72fb8f03409e423397319205de48adca16 Author: Xiang Mei Date: Thu Mar 26 00:55:53 2026 -0700 net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: 4e5bd03ae346 ("net: bonding: fix bond_xmit_broadcast return value error bug") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Link: https://patch.msgid.link/20260326075553.3960562-1-xmei5@asu.edu Signed-off-by: Paolo Abeni commit 75dc1980cf48826287e43dc7a49e310c6691f97e Author: Takashi Iwai Date: Tue Mar 31 10:12:17 2026 +0200 ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization The recent refactoring of xfi driver changed the assignment of atc->daios[] at atc_get_resources(); now it loops over all enum DAIOTYP entries while it looped formerly only a part of them. The problem is that the last entry, SPDIF1, is a special type that is used only for hw20k1 CTSB073X model (as a replacement of SPDIFIO), and there is no corresponding definition for hw20k2. Due to the lack of the info, it caused a kernel crash on hw20k2, which was already worked around by the commit b045ab3dff97 ("ALSA: ctxfi: Fix missing SPDIFI1 index handling"). This patch addresses the root cause of the regression above properly, simply by skipping the incorrect SPDIF1 type in the parser loop. For making the change clearer, the code is slightly arranged, too. Fixes: a2dbaeb5c61e ("ALSA: ctxfi: Refactor resource alloc for sparse mappings") Cc: Link: https://bugzilla.suse.com/show_bug.cgi?id=1259925 Link: https://patch.msgid.link/20260331081227.216134-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit e02494114ebf7c8b42777c6cd6982f113bfdbec7 Author: Herbert Xu Date: Fri Mar 27 15:04:17 2026 +0900 crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption When decrypting data that is not in-place (src != dst), there is no need to save the high-order sequence bits in dst as it could simply be re-copied from the source. However, the data to be hashed need to be rearranged accordingly. Reported-by: Taeyang Lee <0wn@theori.io> Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD interface") Signed-off-by: Herbert Xu Thanks, Signed-off-by: Herbert Xu commit a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 Author: Herbert Xu Date: Thu Mar 26 15:30:20 2026 +0900 crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. Fixes: 72548b093ee3 ("crypto: algif_aead - copy AAD from src to dst") Reported-by: Taeyang Lee <0wn@theori.io> Signed-off-by: Herbert Xu commit af416cd9b3fb9d17ac7f4cfa12d1ea83dfd0e4be Author: Jessica Liu Date: Tue Mar 31 09:30:29 2026 +0800 irqchip/riscv-aplic: Restrict genpd notifier to device tree only On ACPI systems, the aplic's pm_domain is set to acpi_general_pm_domain, which provides its own power management callbacks (e.g., runtime_suspend via acpi_subsys_runtime_suspend). aplic_pm_add() unconditionally calls dev_pm_genpd_add_notifier() when dev->pm_domain is non‑NULL, leading to a comparison between runtime_suspend and genpd_runtime_suspend. This results in the following errors when ACPI is enabled: riscv-aplic RSCV0002:00: failed to create APLIC context riscv-aplic RSCV0002:00: error -ENODEV: failed to setup APLIC in MSI mode Fix this by checking for dev->of_node before adding or removing the genpd notifier, ensuring it is only used for device tree based systems. Fixes: 95a8ddde3660 ("irqchip/riscv-aplic: Preserve APLIC states across suspend/resume") Signed-off-by: Jessica Liu Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260331093029749vRpdH-0qoEqjS0Wnn9M4x@zte.com.cn commit b981e9e94c687b7b19ae8820963f005b842cb2f2 Author: Dmitry Torokhov Date: Sun Mar 29 19:27:48 2026 -0700 x86/platform/geode: Fix on-stack property data use-after-return bug The PROPERTY_ENTRY_GPIO macro (and by extension PROPERTY_ENTRY_REF) creates a temporary software_node_ref_args structure on the stack when used in a runtime assignment. This results in the property pointing to data that is invalid once the function returns. Fix this by ensuring the GPIO reference data is not stored on stack and using PROPERTY_ENTRY_REF_ARRAY_LEN() to point directly to the persistent reference data. Fixes: 298c9babadb8 ("x86/platform/geode: switch GPIO buttons and LEDs to software properties") Signed-off-by: Dmitry Torokhov Signed-off-by: Ingo Molnar Cc: Rafael J. Wysocki Cc: Andy Shevchenko Cc: Daniel Scally Cc: Danilo Krummrich Cc: Hans de Goede Cc: Heikki Krogerus Cc: Sakari Ailus Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260329-property-gpio-fix-v2-1-3cca5ba136d8@gmail.com commit e6c888202297eca21860b669edb74fc600e679d9 Author: songxiebing Date: Tue Mar 31 11:36:50 2026 +0800 ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10 The Pin Complex 0x17 (bass/woofer speakers) is incorrectly reported as unconnected in the BIOS (pin default 0x411111f0 = N/A). This causes the kernel to configure speaker_outs=0, meaning only the tweeters (pin 0x14) are used. The result is very low, tinny audio with no bass. The existing quirk ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN (already present in patch_realtek.c for SSID 0x17aa3801) fixes the issue completely. Reported-by: Garcicasti Link: https://bugzilla.kernel.org/show_bug.cgi?id=221298 Signed-off-by: songxiebing Link: https://patch.msgid.link/20260331033650.285601-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai commit 720460722310c7ab35421aa81a3153ff96b6c82b Author: Zhang Heng Date: Tue Mar 31 09:35:36 2026 +0800 ALSA: hda/realtek: add quirk for HP Laptop 15-fc0xxx For the HP Laptop 15-fc0xxx with ALC236, the built-in mic 0x12 was not set up, making it unusable; after adding it, it now works properly. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221233 Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260331013536.13778-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 9c9a57e4e337f94e23ddf69263fd0685c91155fb Author: Ville Syrjälä Date: Wed Mar 25 15:58:45 2026 +0200 drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Looks like I missed the drm_dp_enhanced_frame_cap() in the ivb/hsw CPU eDP code when I introduced crtc_state->enhanced_framing. Fix it up so that the state we program to the hardware is guaranteed to match what we computed earlier. Cc: stable@vger.kernel.org Fixes: 3072a24c778a ("drm/i915: Introduce crtc_state->enhanced_framing") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260325135849.12603-3-ville.syrjala@linux.intel.com Reviewed-by: Michał Grzelak (cherry picked from commit 799fe8dc2af52f35c78c4ac97f8e34994dfd8760) Signed-off-by: Joonas Lahtinen commit e08e0754e690e4909cab83ac43fd2c93c6200514 Author: Ville Syrjälä Date: Wed Mar 25 15:58:44 2026 +0200 drm/i915/cdclk: Do the full CDCLK dance for min_voltage_level changes Apparently I forgot about the pipe min_voltage_level when I decoupled the CDCLK calculations from modesets. Even if the CDCLK frequency doesn't need changing we may still need to bump the voltage level to accommodate an increase in the port clock frequency. Currently, even if there is a full modeset, we won't notice the need to go through the full CDCLK calculations/programming, unless the set of enabled/active pipes changes, or the pipe/dbuf min CDCLK changes. Duplicate the same logic we use the pipe's min CDCLK frequency to also deal with its min voltage level. Note that the 'allow_voltage_level_decrease' stuff isn't really useful here since the min voltage level can only change during a full modeset. But I think sticking to the same approach in the three similar parts (pipe min cdclk, pipe min voltage level, dbuf min cdclk) is a good idea. Cc: stable@vger.kernel.org Tested-by: Mikhail Rudenko Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15826 Fixes: ba91b9eecb47 ("drm/i915/cdclk: Decouple cdclk from state->modeset") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260325135849.12603-2-ville.syrjala@linux.intel.com Reviewed-by: Michał Grzelak (cherry picked from commit 0f21a14987ebae3c05ad1184ea872e7b7a7b8695) Signed-off-by: Joonas Lahtinen commit 316fb1b3169efb081d2db910cbbfef445afa03b9 Author: robbieko Date: Wed Mar 25 18:18:15 2026 +0800 btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() After commit 1618aa3c2e01 ("btrfs: simplify return variables in lookup_extent_data_ref()"), the err and ret variables were merged into a single ret variable. However, when btrfs_next_leaf() returns 0 (success), ret is overwritten from -ENOENT to 0. If the first key in the next leaf does not match (different objectid or type), the function returns 0 instead of -ENOENT, making the caller believe the lookup succeeded when it did not. This can lead to operations on the wrong extent tree item, potentially causing extent tree corruption. Fix this by returning -ENOENT directly when the key does not match, instead of relying on the ret variable. Fixes: 1618aa3c2e01 ("btrfs: simplify return variables in lookup_extent_data_ref()") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Filipe Manana Signed-off-by: robbieko Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4ee937107d52f9e5c350e4b5e629760e328b3d9f Author: Pengpeng Hou Date: Sun Mar 29 07:43:56 2026 +0800 bnxt_en: set backing store type from query type bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the firmware response in ctxm->type and later uses that value to index fixed backing-store metadata arrays such as ctx_arr[] and bnxt_bstore_to_trace[]. ctxm->type is fixed by the current backing-store query type and matches the array index of ctx->ctx_arr. Set ctxm->type from the current loop variable instead of depending on resp->type. Also update the loop to advance type from next_valid_type in the for statement, which keeps the control flow simpler for non-valid and unchanged entries. Fixes: 6a4d0774f02d ("bnxt_en: Add support for new backing store query firmware API") Signed-off-by: Pengpeng Hou Reviewed-by: Michael Chan Tested-by: Michael Chan Link: https://patch.msgid.link/20260328234357.43669-1-pengpeng@iscas.ac.cn Signed-off-by: Jakub Kicinski commit cedc1bf327de62ec30af9743bd1f601c2de30553 Author: Lorenzo Bianconi Date: Sun Mar 29 12:32:27 2026 +0200 net: airoha: Delay offloading until all net_devices are fully registered Netfilter flowtable can theoretically try to offload flower rules as soon as a net_device is registered while all the other ones are not registered or initialized, triggering a possible NULL pointer dereferencing of qdma pointer in airoha_ppe_set_cpu_port routine. Moreover, if register_netdev() fails for a particular net_device, there is a small race if Netfilter tries to offload flowtable rules before all the net_devices are properly unregistered in airoha_probe() error patch, triggering a NULL pointer dereferencing in airoha_ppe_set_cpu_port routine. In order to avoid any possible race, delay offloading until all net_devices are registered in the networking subsystem. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260329-airoha-regiser-race-fix-v2-1-f4ebb139277b@kernel.org Signed-off-by: Jakub Kicinski commit e6e3eb5ee89ac4c163d46429391c889a1bb5e404 Author: Yochai Eisenrich Date: Sun Mar 29 00:14:36 2026 +0300 net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak When building netlink messages, tc_chain_fill_node() never initializes the tcm_info field of struct tcmsg. Since the allocation is not zeroed, kernel heap memory is leaked to userspace through this 4-byte field. The fix simply zeroes tcm_info alongside the other fields that are already initialized. Fixes: 32a4f5ecd738 ("net: sched: introduce chain object to uapi") Signed-off-by: Yochai Eisenrich Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260328211436.1010152-1-echelonh@gmail.com Signed-off-by: Jakub Kicinski commit ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0 Author: Guoyu Su Date: Fri Mar 27 23:35:07 2026 +0800 net: use skb_header_pointer() for TCPv4 GSO frag_off check Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1]. gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths. Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying. [1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407 Link: https://lore.kernel.org/netdev/willemdebruijn.kernel.1a9f35039caab@gmail.com/ Fixes: cbc53e08a793 ("GSO: Add GSO type for fixed IPv4 ID") Reported-by: syzbot+1543a7d954d9c6d00407@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407 Tested-by: syzbot+1543a7d954d9c6d00407@syzkaller.appspotmail.com Signed-off-by: Guoyu Su Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260327153507.39742-1-yss2813483011xxl@gmail.com Signed-off-by: Jakub Kicinski commit 514aac3599879a7ed48b7dc19e31145beb6958ac Author: Lorenzo Bianconi Date: Fri Mar 27 10:48:21 2026 +0100 net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue() In order to properly cleanup hw rx QDMA queues and bring the device to the initial state, reset rx DMA queue head/tail index. Moreover, reset queued DMA descriptor fields. Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") Tested-by: Madhur Agrawal Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260327-airoha_qdma_cleanup_rx_queue-fix-v1-1-369d6ab1511a@kernel.org Signed-off-by: Jakub Kicinski commit fd63f185979b047fb22a0dfc6bd94d0cab6a6a70 Author: Paolo Abeni Date: Fri Mar 27 10:52:57 2026 +0100 ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 after its possible deletion. Reorder the statement to avoid the possible UaF; while at it, place the warning outside the idev->lock as it needs no protection. Reported-by: Jakub Kicinski Closes: https://sashiko.dev/#/patchset/8c8bfe2e1a324e501f0e15fef404a77443fd8caf.1774365668.git.pabeni%40redhat.com Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional") Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/ef973c3a8cb4f8f1787ed469f3e5391b9fe95aa0.1774601542.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit d0c3bcd5b8976159d835a897254048e078f447e6 Merge: f1b24d8bdd64ec e5046823f8fa36 Author: Linus Torvalds Date: Mon Mar 30 13:40:48 2026 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fix from Eric Biggers: "Fix missing zeroization of the ChaCha state" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: chacha: Zeroize permuted_state before it leaves scope commit 59e1be1278f064d7172b00473b7e0c453cb1ec52 Author: Emanuele Ghidoli Date: Fri Mar 13 14:52:31 2026 +0100 spi: cadence-qspi: Fix exec_mem_op error handling cqspi_exec_mem_op() increments the runtime PM usage counter before all refcount checks are performed. If one of these checks fails, the function returns without dropping the PM reference. Move the pm_runtime_resume_and_get() call after the refcount checks so that runtime PM is only acquired when the operation can proceed and drop the inflight_ops refcount if the PM resume fails. Cc: stable@vger.kernel.org Fixes: 7446284023e8 ("spi: cadence-quadspi: Implement refcount to handle unbind during busy") Signed-off-by: Emanuele Ghidoli Link: https://patch.msgid.link/20260313135236.46642-1-ghidoliemanuele@gmail.com Signed-off-by: Mark Brown commit 78746a474e92fc7aaed12219bec7c78ae1bd6156 Author: Donet Tom Date: Mon Mar 23 09:58:39 2026 +0530 drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size The control stack size is calculated based on the number of CUs and waves, and is then aligned to PAGE_SIZE. When the resulting control stack size is aligned to 64 KB, GPU hangs and queue preemption failures are observed while running RCCL unit tests on systems with more than two GPUs. amdgpu 0048:0f:00.0: amdgpu: Queue preemption failed for queue with doorbell_id: 80030008 amdgpu 0048:0f:00.0: amdgpu: Failed to evict process queues amdgpu 0048:0f:00.0: amdgpu: GPU reset begin!. Source: 4 amdgpu 0048:0f:00.0: amdgpu: Queue preemption failed for queue with doorbell_id: 80030008 amdgpu 0048:0f:00.0: amdgpu: Failed to evict process queues amdgpu 0048:0f:00.0: amdgpu: Failed to restore process queues This issue is observed on both 4 KB and 64 KB system page-size configurations. This patch fixes the issue by aligning the control stack size to AMDGPU_GPU_PAGE_SIZE instead of PAGE_SIZE, so the control stack size will not be 64 KB on systems with a 64 KB page size and queue preemption works correctly. Additionally, In the current code, wg_data_size is aligned to PAGE_SIZE, which can waste memory if the system page size is large. In this patch, wg_data_size is aligned to AMDGPU_GPU_PAGE_SIZE. The cwsr_size, calculated from wg_data_size and the control stack size, is aligned to PAGE_SIZE. Reviewed-by: Felix Kuehling Signed-off-by: Donet Tom Signed-off-by: Alex Deucher (cherry picked from commit a3e14436304392fbada359edd0f1d1659850c9b7) commit 09773978879ecf71a7990fe9a28ce4eb92bce645 Author: Sanman Pradhan Date: Thu Mar 26 22:45:29 2026 +0000 hwmon: (occ) Fix missing newline in occ_show_extended() In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag is set, the sysfs_emit format string "%u" is missing the trailing newline that the sysfs ABI expects. The else branch correctly uses "%4phN\n", and all other show functions in this file include the trailing newline. Add the missing "\n" for consistency and correct sysfs output. Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions") Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit daf470b8882b6f7f53cbfe9ec2b93a1b21528cdc Author: Lijo Lazar Date: Fri Mar 27 14:29:17 2026 +0530 drm/amdgpu: Fix wait after reset sequence in S4 For a mode-1 reset done at the end of S4 on PSPv11 dGPUs, only check if TOS is unloaded. Fixes: 32f73741d6ee ("drm/amdgpu: Wait for bootloader after PSPv11 reset") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4853 Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 2fb4883b884a437d760bd7bdf7695a7e5a60bba3) Cc: stable@vger.kernel.org commit 39e2a5bf970402a8530a319cf06122e216ba57b8 Author: Sanman Pradhan Date: Thu Mar 26 22:45:23 2026 +0000 hwmon: (occ) Fix division by zero in occ_show_power_1() In occ_show_power_1() case 1, the accumulator is divided by update_tag without checking for zero. If no samples have been collected yet (e.g. during early boot when the sensor block is included but hasn't been updated), update_tag is zero, causing a kernel divide-by-zero crash. The 2019 fix in commit 211186cae14d ("hwmon: (occ) Fix division by zero issue") only addressed occ_get_powr_avg() used by occ_show_power_2() and occ_show_power_a0(). This separate code path in occ_show_power_1() was missed. Fix this by reusing the existing occ_get_powr_avg() helper, which already handles the zero-sample case and uses mul_u64_u32_div() to multiply before dividing for better precision. Move the helper above occ_show_power_1() so it is visible at the call site. Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260326224510.294619-2-sanman.pradhan@hpe.com [groeck: Fix alignment problems reported by checkpatch] Signed-off-by: Guenter Roeck commit e927b36ae18b66b49219eaa9f46edc7b4fdbb25e Author: Srinivasan Shanmugam Date: Sat Mar 21 17:25:14 2026 +0530 drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() dcn401_init_hw() assumes that update_bw_bounding_box() is valid when entering the update path. However, the existing condition: ((!fams2_enable && update_bw_bounding_box) || freq_changed) does not guarantee this, as the freq_changed branch can evaluate to true independently of the callback pointer. This can result in calling update_bw_bounding_box() when it is NULL. Fix this by separating the update condition from the pointer checks and ensuring the callback, dc->clk_mgr, and bw_params are validated before use. Fixes the below: ../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed 'dc->res_pool->funcs->update_bw_bounding_box' could be null (see line 362) Fixes: ca0fb243c3bb ("drm/amd/display: Underflow Seen on DCN401 eGPU") Cc: Daniel Sa Cc: Alvin Lee Cc: Roman Li Cc: Alex Hung Cc: Tom Chung Cc: Dan Carpenter Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477) Cc: stable@vger.kernel.org commit 4487571ef17a30d274600b3bd6965f497a881299 Author: Donet Tom Date: Thu Mar 26 17:51:28 2026 +0530 drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB Currently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while KFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with 4K pages, both values match (8KB), so allocation and reserved space are consistent. However, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB, while the reserved trap area remains 8KB. This mismatch causes the kernel to crash when running rocminfo or rccl unit tests. Kernel attempted to read user page (2) - exploit attempt? (uid: 1001) BUG: Kernel NULL pointer dereference on read at 0x00000002 Faulting instruction address: 0xc0000000002c8a64 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries CPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E 6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY Tainted: [E]=UNSIGNED_MODULE Hardware name: IBM,9105-42A POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries NIP: c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730 REGS: c0000001e0957580 TRAP: 0300 Tainted: G E MSR: 8000000000009033 CR: 24008268 XER: 00000036 CFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000 IRQMASK: 1 GPR00: c00000000125d908 c0000001e0957820 c0000000016e8100 c00000013d814540 GPR04: 0000000000000002 c00000013d814550 0000000000000045 0000000000000000 GPR08: c00000013444d000 c00000013d814538 c00000013d814538 0000000084002268 GPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff 0000000000020000 GPR16: 0000000000000000 0000000000000002 c00000015f653000 0000000000000000 GPR20: c000000138662400 c00000013d814540 0000000000000000 c00000013d814500 GPR24: 0000000000000000 0000000000000002 c0000001e0957888 c0000001e0957878 GPR28: c00000013d814548 0000000000000000 c00000013d814540 c0000001e0957888 NIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0 LR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00 Call Trace: 0xc0000001e0957890 (unreliable) __mutex_lock.constprop.0+0x58/0xd00 amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu] kfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu] kfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu] kfd_process_device_init_vm+0xd8/0x2e0 [amdgpu] kfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu] kfd_ioctl+0x514/0x670 [amdgpu] sys_ioctl+0x134/0x180 system_call_exception+0x114/0x300 system_call_vectored_common+0x15c/0x2ec This patch changes AMDGPU_VA_RESERVED_TRAP_SIZE to 64 KB and KFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size. This means we reserve 64 KB for the trap in the address space, but only allocate 8 KB within it. With this approach, the allocation size never exceeds the reserved area. Fixes: 34a1de0f7935 ("drm/amdkfd: Relocate TBA/TMA to opposite side of VM hole") Reviewed-by: Christian König Suggested-by: Felix Kuehling Suggested-by: Christian König Signed-off-by: Donet Tom Signed-off-by: Alex Deucher (cherry picked from commit 31b8de5e55666f26ea7ece5f412b83eab3f56dbb) Cc: stable@vger.kernel.org commit ced5c30e47d1cd52d6ae40f809223a6286854086 Author: Junrui Luo Date: Sat Mar 14 23:33:53 2026 +0800 drm/amdgpu/userq: fix memory leak in MQD creation error paths In mes_userq_mqd_create(), the memdup_user() allocations for IP-specific MQD structs are not freed when subsequent VA validation fails. The goto free_mqd label only cleans up the MQD BO object and userq_props. Fix by adding kfree() before each goto free_mqd on VA validation failure in the COMPUTE, GFX, and SDMA branches. Fixes: 9e46b8bb0539 ("drm/amdgpu: validate userq buffer virtual address and size") Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Reviewed-by: Prike Liang Signed-off-by: Alex Deucher (cherry picked from commit 27f5ff9e4a4150d7cf8b4085aedd3b77ddcc5d08) Cc: stable@vger.kernel.org commit 6caeace0d1471b33bb43b58893940cc90baca5b9 Author: Donet Tom Date: Mon Mar 23 09:58:38 2026 +0530 drm/amd: Fix MQD and control stack alignment for non-4K For gfxV9, due to a hardware bug ("based on the comments in the code here [1]"), the control stack of a user-mode compute queue must be allocated immediately after the page boundary of its regular MQD buffer. To handle this, we allocate an enlarged MQD buffer where the first page is used as the MQD and the remaining pages store the control stack. Although these regions share the same BO, they require different memory types: the MQD must be UC (uncached), while the control stack must be NC (non-coherent), matching the behavior when the control stack is allocated in user space. This logic works correctly on systems where the CPU page size matches the GPU page size (4K). However, the current implementation aligns both the MQD and the control stack to the CPU PAGE_SIZE. On systems with a larger CPU page size, the entire first CPU page is marked UC—even though that page may contain multiple GPU pages. The GPU treats the second 4K GPU page inside that CPU page as part of the control stack, but it is incorrectly mapped as UC. This patch fixes the issue by aligning both the MQD and control stack sizes to the GPU page size (4K). The first 4K page is correctly marked as UC for the MQD, and the remaining GPU pages are marked NC for the control stack. This ensures proper memory type assignment on systems with larger CPU page sizes. [1]: https://elixir.bootlin.com/linux/v6.18/source/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c#L118 Acked-by: Felix Kuehling Signed-off-by: Donet Tom Signed-off-by: Alex Deucher (cherry picked from commit 998d6781410de1c4b787fdbf6c56e851ea7fa553) commit f1b24d8bdd64ecd5400dff79677f8a290ca70d73 Merge: 7aaa8047eafd0b 2e8b1a1d12ae33 Author: Linus Torvalds Date: Mon Mar 30 13:12:00 2026 -0700 Merge tag 'trace-rtla-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull rtla build fix from Steven Rostedt: - Fix build failure when libbpf does not exist RTLA supports building without BPF libraries, but a recent change added a libbpf.h include outside of the BPF protection which caused build failures when libbpf was not installed. * tag 'trace-rtla-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla: Fix build without libbpf header commit 68484a648ade555842e0c75a392f3572b3d51998 Author: Donet Tom Date: Mon Mar 23 09:58:35 2026 +0530 drm/amdkfd: Align expected_queue_size to PAGE_SIZE The AQL queue size can be 4K, but the minimum buffer object (BO) allocation size is PAGE_SIZE. On systems with a page size larger than 4K, the expected queue size does not match the allocated BO size, causing queue creation to fail. Align the expected queue size to PAGE_SIZE so that it matches the allocated BO size and allows queue creation to succeed. Reviewed-by: Felix Kuehling Signed-off-by: Donet Tom Signed-off-by: Alex Deucher (cherry picked from commit b01cd158a2f5230b137396c5f8cda3fc780abbc2) commit 62f553d60a801384336f5867967c26ddf3b17038 Author: Prike Liang Date: Mon Mar 23 16:07:02 2026 +0800 drm/amdgpu: fix the idr allocation flags Fix the IDR allocation flags by using atomic GFP flags in non‑sleepable contexts to avoid the __might_sleep() complaint. 268.290239] [drm] Initialized amdgpu 3.64.0 for 0000:03:00.0 on minor 0 [ 268.294900] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:323 [ 268.295355] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1744, name: modprobe [ 268.295705] preempt_count: 1, expected: 0 [ 268.295886] RCU nest depth: 0, expected: 0 [ 268.296072] 2 locks held by modprobe/1744: [ 268.296077] #0: ffff8c3a44abd1b8 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xe4/0x210 [ 268.296100] #1: ffffffffc1a6ea78 (amdgpu_pasid_idr_lock){+.+.}-{3:3}, at: amdgpu_pasid_alloc+0x26/0xe0 [amdgpu] [ 268.296494] CPU: 12 UID: 0 PID: 1744 Comm: modprobe Tainted: G U OE 6.19.0-custom #16 PREEMPT(voluntary) [ 268.296498] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 268.296499] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 268.296501] Call Trace: Fixes: 8f1de51f49be ("drm/amdgpu: prevent immediate PASID reuse case") Tested-by: Borislav Petkov (AMD) Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit ea56aa2625708eaf96f310032391ff37746310ef) Cc: stable@vger.kernel.org commit a018d1819f158991b7308e4f74609c6c029b670c Author: Junrui Luo Date: Tue Mar 24 17:39:02 2026 +0800 drm/amdgpu: validate doorbell_offset in user queue creation amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds checking. An arbitrarily large doorbell_offset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space. Validate that doorbell_offset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow. Fixes: f09c1e6077ab ("drm/amdgpu: generate doorbell index for userqueue") Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo Signed-off-by: Alex Deucher (cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec) Cc: stable@vger.kernel.org commit a3ffaa5b397f4df9d6ac16b10583e9df8e6fa471 Author: Alex Deucher Date: Tue Mar 17 16:34:41 2026 -0400 drm/amdgpu/pm: drop SMU driver if version not matched messages It just leads to user confusion. Cc: Yang Wang Cc: Lijo Lazar Reviewed-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit e471627d56272a791972f25e467348b611c31713) Cc: stable@vger.kernel.org commit 9badc2a84e688be1275bb740942d5f6f51746908 Author: Changwoo Min Date: Sun Mar 29 16:36:15 2026 +0900 PM: EM: Fix NULL pointer dereference when perf domain ID is not found dev_energymodel_nl_get_perf_domains_doit() calls em_perf_domain_get_by_id() but does not check the return value before passing it to __em_nl_get_pd_size(). When a caller supplies a non-existent perf domain ID, em_perf_domain_get_by_id() returns NULL, and __em_nl_get_pd_size() immediately dereferences pd->cpus (struct offset 0x30), causing a NULL pointer dereference. The sister handler dev_energymodel_nl_get_perf_table_doit() already handles this correctly via __em_nl_get_pd_table_id(), which returns NULL and causes the caller to return -EINVAL. Add the same NULL check in the get-perf-domains do handler. Fixes: 380ff27af25e ("PM: EM: Add dump to get-perf-domains in the EM YNL spec") Reported-by: Yi Lai Closes: https://lore.kernel.org/lkml/aXiySM79UYfk+ytd@ly-workstation/ Signed-off-by: Changwoo Min Cc: 6.19+ # 6.19+ [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260329073615.649976-1-changwoo@igalia.com Signed-off-by: Rafael J. Wysocki commit 622363757b2286dd2c2984b0d80255cbb35a0495 Author: Jihed Chaibi Date: Tue Mar 24 22:09:09 2026 +0100 ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure ep93xx_i2s_enable() calls clk_prepare_enable() on three clocks in sequence (mclk, sclk, lrclk) without checking the return value of any of them. If an intermediate enable fails, the clocks that were already enabled are never rolled back, leaking them until the next disable cycle — which may never come if the stream never started cleanly. Change ep93xx_i2s_enable() from void to int. Add error checking after each clk_prepare_enable() call and unwind already-enabled clocks on failure. Propagate the error through ep93xx_i2s_startup() and ep93xx_i2s_resume(), both of which already return int. Signed-off-by: Jihed Chaibi Fixes: f4ff6b56bc8a ("ASoC: cirrus: i2s: Prepare clock before using it") Link: https://patch.msgid.link/20260324210909.45494-1-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 090d34f0f0285124452373225bcc520a31e305e4 Author: Tejun Heo Date: Sat Mar 28 14:18:56 2026 -1000 selftests/sched_ext: Add cyclic SCX_KICK_WAIT stress test Add a test that creates a 3-CPU kick_wait cycle (A->B->C->A). A BPF scheduler kicks the next CPU in the ring with SCX_KICK_WAIT on every enqueue while userspace workers generate continuous scheduling churn via sched_yield(). Without the preceding fix, this hangs the machine within seconds. Signed-off-by: Tejun Heo Reviewed-by: Christian Loehle Tested-by: Christian Loehle commit 415cb193bb9736f0e830286c72a6fa8eb2a9cc5c Author: Tejun Heo Date: Sat Mar 28 14:18:55 2026 -1000 sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback SCX_KICK_WAIT busy-waits in kick_cpus_irq_workfn() using smp_cond_load_acquire() until the target CPU's kick_sync advances. Because the irq_work runs in hardirq context, the waiting CPU cannot reschedule and its own kick_sync never advances. If multiple CPUs form a wait cycle, all CPUs deadlock. Replace the busy-wait in kick_cpus_irq_workfn() with resched_curr() to force the CPU through do_pick_task_scx(), which queues a balance callback to perform the wait. The balance callback drops the rq lock and enables IRQs following the sched_core_balance() pattern, so the CPU can process IPIs while waiting. The local CPU's kick_sync is advanced on entry to do_pick_task_scx() and continuously during the wait, ensuring any CPU that starts waiting for us sees the advancement and cannot form cyclic dependencies. Fixes: 90e55164dad4 ("sched_ext: Implement SCX_KICK_WAIT") Cc: stable@vger.kernel.org # v6.12+ Reported-by: Christian Loehle Link: https://lore.kernel.org/r/20260316100249.1651641-1-christian.loehle@arm.com Signed-off-by: Tejun Heo Tested-by: Christian Loehle commit b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f Author: Felix Gu Date: Sun Mar 22 22:28:45 2026 +0800 spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback aml_sfc_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal. Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260322-spifc-a4-v1-1-2dc5ebcbe0a9@gmail.com Signed-off-by: Mark Brown commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e Author: Sanman Pradhan Date: Mon Mar 30 15:56:40 2026 +0000 hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() tps53676_identify() uses strncmp() to compare the device ID buffer against a byte sequence containing embedded non-printable bytes (\x53\x67\x60). strncmp() is semantically wrong for binary data comparison; use memcmp() instead. Additionally, the buffer from i2c_smbus_read_block_data() is not NUL-terminated, so printing it with "%s" in the error path is undefined behavior and may read past the buffer. Use "%*ph" to hex-dump the actual bytes returned. Per the datasheet, the expected device ID is the 6-byte sequence 54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes including the trailing NUL. Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676") Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit b9eff9732cb0f86a68c9d1592a98ceab47c01e95 Author: Kuninori Morimoto Date: Fri Mar 27 02:43:54 2026 +0000 ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Component has "card_aux_list" which is added/deled in bind/unbind aux dev function (A), and used in for_each_card_auxs() loop (B). static void soc_unbind_aux_dev(...) { ... for_each_card_auxs_safe(...) { ... (A) list_del(&component->card_aux_list); } ^^^^^^^^^^^^^ } static int soc_bind_aux_dev(...) { ... for_each_card_pre_auxs(...) { ... (A) list_add(&component->card_aux_list, ...); } ^^^^^^^^^^^^^ ... } #define for_each_card_auxs(card, component) \ (B) list_for_each_entry(component, ..., card_aux_list) ^^^^^^^^^^^^^ But it has been used without calling INIT_LIST_HEAD(). > git grep card_aux_list sound/soc sound/soc/soc-core.c: list_del(&component->card_aux_list); sound/soc/soc-core.c: list_add(&component->card_aux_list, ...); call missing INIT_LIST_HEAD() for it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87341mxa8l.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2e8b1a1d12ae3338efeb1c3de3eb4e9324b87a28 Author: Tomas Glozar Date: Mon Mar 30 11:12:07 2026 +0200 rtla: Fix build without libbpf header rtla supports building without libbpf. However, BPF actions patchset [1] adds an include of bpf/libbpf.h into timerlat_bpf.h, which breaks build on systems that don't have libbpf headers installed. This is a leftover from a draft version of the patchset where timerlat_bpf_set_action() (which takes a struct bpf_program * argument) was defined in the header. timerlat_bpf.c already includes bpf/libbpf.h via timerlat.skel.h when libbpf is present. Remove the redundant include to fix build on systems without libbpf headers. [1] https://lore.kernel.org/linux-trace-kernel/20251126144205.331954-1-tglozar@redhat.com/T/ Cc: John Kacur Cc: Luis Goncalves Cc: Crystal Wood Cc: Costa Shulyupin Link: https://patch.msgid.link/20260330091207.16184-1-tglozar@redhat.com Reported-by: Steven Rostedt (Google) Closes: https://lore.kernel.org/linux-trace-kernel/20260329122202.65a8b575@robin/ Fixes: 8cd0f08ac72e ("rtla/timerlat: Support tail call from BPF program") Signed-off-by: Tomas Glozar Reviewed-by: Wander Lairson Costa Signed-off-by: Steven Rostedt (Google) commit ea31be8a2c8c99eac198f3b7f2dc770111f2b182 Author: Takashi Iwai Date: Mon Mar 30 18:22:20 2026 +0200 ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED) There is another Book2 Pro model (NP950QED) that seems equipped with the same speaker module as the non-360 model, which requires ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS quirk. Reported-by: Throw Link: https://patch.msgid.link/20260330162249.147665-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 3ddbea7542ae529c1a88ef9a8b1ce169126211f6 Author: Nicolas Pitre Date: Fri Mar 27 23:09:47 2026 -0400 vt: resize saved unicode buffer on alt screen exit after resize Instead of discarding the saved unicode buffer when the console was resized while in the alternate screen, resize it to the current dimensions using vc_uniscr_copy_area() to preserve its content. This properly restores the unicode screen on alt screen exit rather than lazily rebuilding it from a lossy reverse glyph translation. On allocation failure the stale buffer is freed and vc_uni_lines is set to NULL so it gets lazily rebuilt via vc_uniscr_check() when next needed. Fixes: 40014493cece ("vt: discard stale unicode buffer on alt screen exit after resize") Cc: stable Signed-off-by: Nicolas Pitre Link: https://patch.msgid.link/3nsr334n-079q-125n-7807-n4nq818758ns@syhkavp.arg Signed-off-by: Greg Kroah-Hartman commit 40014493cece72a0be5672cd86763e53fb3ec613 Author: Liav Mordouch Date: Fri Mar 27 20:02:04 2026 +0300 vt: discard stale unicode buffer on alt screen exit after resize When enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and sets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize() skips reallocating the unicode buffer because vc_uni_lines is NULL. However, vc_saved_uni_lines still points to the old buffer allocated for the original dimensions. When leave_alt_screen() later restores vc_saved_uni_lines, the buffer dimensions no longer match vc_rows/vc_cols. Any operation that iterates over the unicode buffer using the current dimensions (e.g. csi_J clearing the screen) will access memory out of bounds, causing a kernel oops: BUG: unable to handle page fault for address: 0x0000002000000020 RIP: 0010:csi_J+0x133/0x2d0 The faulting address 0x0000002000000020 is two adjacent u32 space characters (0x20) interpreted as a pointer, read from the row data area past the end of the 25-entry pointer array in a buffer allocated for 80x25 but accessed with 240x67 dimensions. Fix this by checking whether the console dimensions changed while in the alternate screen. If they did, free the stale saved buffer instead of restoring it. The unicode screen will be lazily rebuilt via vc_uniscr_check() when next needed. Fixes: 5eb608319bb5 ("vt: save/restore unicode screen buffer for alternate screen") Cc: stable Tested-by: Liav Mordouch Signed-off-by: Liav Mordouch Reviewed-by: Nicolas Pitre Link: https://patch.msgid.link/20260327170204.29706-1-liavmordouch@gmail.com Signed-off-by: Greg Kroah-Hartman commit e367599529dc42578545a7f85fde517b35b3cda7 Author: Kuen-Han Tsai Date: Fri Mar 20 16:54:50 2026 +0800 usb: gadget: f_rndis: Fix net_device lifecycle with device_move The net_device is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 -> /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0 ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind, calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers (e.g., multi.c), the borrowed_net flag is used to indicate whether the network device is shared and pre-registered during the legacy driver's bind phase. Fixes: f466c6353819 ("usb: gadget: f_rndis: convert to new function interface with backward compatibility") Cc: stable@vger.kernel.org Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-7-4886b578161b@google.com Signed-off-by: Greg Kroah-Hartman commit 06524cd1c9011bee141a87e43ab878641ed3652b Author: Kuen-Han Tsai Date: Fri Mar 20 16:54:49 2026 +0800 usb: gadget: f_subset: Fix net_device lifecycle with device_move The net_device is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 -> /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0 ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind, calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers (e.g., multi.c), the bound flag is used to indicate whether the network device is shared and pre-registered during the legacy driver's bind phase. Fixes: 8cedba7c73af ("usb: gadget: f_subset: convert to new function interface with backward compatibility") Cc: stable@vger.kernel.org Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-6-4886b578161b@google.com Signed-off-by: Greg Kroah-Hartman commit d9270c9a8118c1535409db926ac1e2545dc97b81 Author: Kuen-Han Tsai Date: Fri Mar 20 16:54:48 2026 +0800 usb: gadget: f_eem: Fix net_device lifecycle with device_move The net_device is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 -> /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0 ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind, calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers (e.g., multi.c), the bound flag is used to indicate whether the network device is shared and pre-registered during the legacy driver's bind phase. Fixes: b29002a15794 ("usb: gadget: f_eem: convert to new function interface with backward compatibility") Cc: stable@vger.kernel.org Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-5-4886b578161b@google.com Signed-off-by: Greg Kroah-Hartman commit b2cc4fae67a51f60d81d6af2678696accb07c656 Author: Kuen-Han Tsai Date: Fri Mar 20 16:54:47 2026 +0800 usb: gadget: f_ecm: Fix net_device lifecycle with device_move The net_device is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 -> /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0 ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind, calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers (e.g., multi.c), the bound flag is used to indicate whether the network device is shared and pre-registered during the legacy driver's bind phase. Fixes: fee562a6450b ("usb: gadget: f_ecm: convert to new function interface with backward compatibility") Cc: stable@vger.kernel.org Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-4-4886b578161b@google.com Signed-off-by: Greg Kroah-Hartman commit 57f531df3618b26df053798a96aa5ade44e00e1a Author: Kuen-Han Tsai Date: Fri Mar 20 16:54:46 2026 +0800 usb: gadget: u_ncm: Add kernel-doc comments for struct f_ncm_opts Provide kernel-doc descriptions for the fields in struct f_ncm_opts to improve code readability and maintainability. Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-3-4886b578161b@google.com Signed-off-by: Greg Kroah-Hartman commit 8d8c68b1fc06ece60cf43e1306ff0f4ac121547e Author: Kuen-Han Tsai Date: Fri Mar 20 16:54:45 2026 +0800 usb: gadget: f_rndis: Protect RNDIS options with mutex The class/subclass/protocol options are suspectible to race conditions as they can be accessed concurrently through configfs. Use existing mutex to protect these options. This issue was identified during code inspection. Fixes: 73517cf49bd4 ("usb: gadget: add RNDIS configfs options for class/subclass/protocol") Cc: stable@vger.kernel.org Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-2-4886b578161b@google.com Signed-off-by: Greg Kroah-Hartman commit caa27923aacd8a5869207842f2ab1657c6c0c7bc Author: Kuen-Han Tsai Date: Fri Mar 20 16:54:44 2026 +0800 usb: gadget: f_subset: Fix unbalanced refcnt in geth_free geth_alloc() increments the reference count, but geth_free() fails to decrement it. This prevents the configuration of attributes via configfs after unlinking the function. Decrement the reference count in geth_free() to ensure proper cleanup. Fixes: 02832e56f88a ("usb: gadget: f_subset: add configfs support") Cc: stable@vger.kernel.org Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-1-4886b578161b@google.com Signed-off-by: Greg Kroah-Hartman commit 269c26464dcf8b54b0dd9c333721c30ee44ae297 Author: Xu Yang Date: Mon Mar 30 14:35:18 2026 +0800 dt-bindings: connector: add pd-disable dependency When Power Delivery is not supported, the source is unable to obtain the current capability from the Source PDO. As a result, typec-power-opmode needs to be added to advertise such capability. Acked-by: Conor Dooley Cc: stable Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260330063518.719345-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 3b8ae9817686efb3ea789ca9d4efdff2ce9c1c04 Author: Andrei Kuchynski Date: Tue Mar 24 10:30:12 2026 +0000 usb: typec: thunderbolt: Set enter_vdo during initialization In the current implementation, if a cable's alternate mode enter operation is not supported, the tbt->plug[TYPEC_PLUG_SOP_P] pointer is cleared by the time tbt_enter_mode() is called. This prevents the driver from identifying the cable's VDO. As a result, the Thunderbolt connection falls back to the default TBT_CABLE_USB3_PASSIVE speed, even if the cable supports higher speeds. To ensure the correct VDO value is used during mode entry, calculate and store the enter_vdo earlier during the initialization phase in tbt_ready(). Cc: stable Fixes: 100e25738659 ("usb: typec: Add driver for Thunderbolt 3 Alternate Mode") Tested-by: Madhu M Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Reviewed-by: Benson Leung Link: https://patch.msgid.link/20260324103012.1417616-1-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit b65d4ca1d1059ace899170d1dfd02639ce971d2d Author: Andrei Kuchynski Date: Tue Mar 24 10:29:03 2026 +0000 usb: typec: Remove alt->adev.dev.class assignment The typec plug alternate mode is already registered as part of the bus. When both class and bus are set for a device, device_add() attempts to create the "subsystem" symlink in the device's sysfs directory twice, once for the bus and once for the class. This results in a duplicate filename error during registration, causing the alternate mode registration to fail with warnings: cannot create duplicate filename '/devices/pci0000:00/0000:00:1f.0/ PNP0C09:00/GOOG0004:00/cros-ec-dev.1.auto/cros_ec_ucsi.3.auto/typec/ port1/port1-cable/port1-plug0/port1-plug0.0/subsystem' typec port0-plug0: failed to register alternate mode (-17) cros_ec_ucsi.3.auto: failed to registers svid 0x8087 mode 1 Cc: stable Fixes: 67ab45426215 ("usb: typec: Set the bus also for the port and plug altmodes") Tested-by: Madhu M Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Reviewed-by: Benson Leung Link: https://patch.msgid.link/20260324102903.1416210-1-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit 9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a Author: Juno Choi Date: Tue Mar 24 10:49:10 2026 +0900 usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro, which expects hsotg->lock to be held since it does spin_unlock/spin_lock around the gadget driver callback invocation. However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating() without holding the lock. This leads to: - spin_unlock on a lock that is not held (undefined behavior) - The lock remaining held after dwc2_gadget_exit_clock_gating() returns, causing a deadlock when spin_lock_irqsave() is called later in the same function. Fix this by acquiring hsotg->lock before calling dwc2_gadget_exit_clock_gating() and releasing it afterwards, which satisfies the locking requirement of the call_gadget() macro. Fixes: af076a41f8a2 ("usb: dwc2: also exit clock_gating when stopping udc while suspended") Cc: stable Signed-off-by: Juno Choi Link: https://patch.msgid.link/20260324014910.2798425-1-juno.choi@lge.com Signed-off-by: Greg Kroah-Hartman commit eba2936bbe6b752a31725a9eb5c674ecbf21ee7d Author: Jimmy Hu Date: Fri Mar 20 14:54:27 2026 +0800 usb: gadget: uvc: fix NULL pointer dereference during unbind race Commit b81ac4395bbe ("usb: gadget: uvc: allow for application to cleanly shutdown") introduced two stages of synchronization waits totaling 1500ms in uvc_function_unbind() to prevent several types of kernel panics. However, this timing-based approach is insufficient during power management (PM) transitions. When the PM subsystem starts freezing user space processes, the wait_event_interruptible_timeout() is aborted early, which allows the unbind thread to proceed and nullify the gadget pointer (cdev->gadget = NULL): [ 814.123447][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind() [ 814.178583][ T3173] PM: suspend entry (deep) [ 814.192487][ T3173] Freezing user space processes [ 814.197668][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release When the PM subsystem resumes or aborts the suspend and tasks are restarted, the V4L2 release path is executed and attempts to access the already nullified gadget pointer, triggering a kernel panic: [ 814.292597][ C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake [ 814.386727][ T3173] Restarting tasks ... [ 814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 [ 814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4 [ 814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94 [ 814.404078][ T4558] Call trace: [ 814.404080][ T4558] usb_gadget_deactivate+0x14/0xf4 [ 814.404083][ T4558] usb_function_deactivate+0x54/0x94 [ 814.404087][ T4558] uvc_function_disconnect+0x1c/0x5c [ 814.404092][ T4558] uvc_v4l2_release+0x44/0xac [ 814.404095][ T4558] v4l2_release+0xcc/0x130 Address the race condition and NULL pointer dereference by: 1. State Synchronization (flag + mutex) Introduce a 'func_unbound' flag in struct uvc_device. This allows uvc_function_disconnect() to safely skip accessing the nullified cdev->gadget pointer. As suggested by Alan Stern, this flag is protected by a new mutex (uvc->lock) to ensure proper memory ordering and prevent instruction reordering or speculative loads. This mutex is also used to protect 'func_connected' for consistent state management. 2. Explicit Synchronization (completion) Use a completion to synchronize uvc_function_unbind() with the uvc_vdev_release() callback. This prevents Use-After-Free (UAF) by ensuring struct uvc_device is freed after all video device resources are released. Fixes: b81ac4395bbe ("usb: gadget: uvc: allow for application to cleanly shutdown") Cc: stable Suggested-by: Alan Stern Suggested-by: Greg Kroah-Hartman Signed-off-by: Jimmy Hu Link: https://patch.msgid.link/20260320065427.1374555-1-hhhuuu@google.com Signed-off-by: Greg Kroah-Hartman commit dd36014ec6042f424ef51b923e607772f7502ee7 Author: Miao Li Date: Thu Mar 19 13:39:27 2026 +0800 usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Another Silicon Motion flash drive also randomly work incorrectly (lsusb does not list the device) on Huawei hisi platforms during 500 reboot cycles, and the DELAY_INIT quirk fixes this issue. Signed-off-by: Miao Li Cc: stable Link: https://patch.msgid.link/20260319053927.264840-1-limiao870622@163.com Signed-off-by: Greg Kroah-Hartman commit 679b771ea05ad0f8eeae83e14a91b8f4f39510c4 Author: Justin Chen Date: Wed Mar 18 11:57:07 2026 -0700 usb: ehci-brcm: fix sleep during atomic echi_brcm_wait_for_sof() gets called after disabling interrupts in ehci_brcm_hub_control(). Use the atomic version of poll_timeout to fix the warning. Fixes: 9df231511bd6 ("usb: ehci: Add new EHCI driver for Broadcom STB SoC's") Cc: stable Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260318185707.2588431-1-justin.chen@broadcom.com Signed-off-by: Greg Kroah-Hartman commit 8ec017cf31299c4b6287ebe27afe81c986aeef88 Author: Gilson Marquato Júnior Date: Mon Mar 30 02:43:48 2026 +0100 ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx The HP Laptop 15-fc0xxx (subsystem ID 0x103c8dc9) has an internal DMIC connected to the AMD ACP6x audio coprocessor. Add a DMI quirk entry so the internal microphone is properly detected on this model. Tested on HP Laptop 15-fc0237ns with Fedora 43 (kernel 6.19.9). Signed-off-by: Gilson Marquato Júnior Link: https://patch.msgid.link/20260330-hp-15-fc0xxx-dmic-v2-v1-1-6dd6f53a1917@hotmail.com Signed-off-by: Mark Brown commit 27c299698464c515c5cd97b4fcf1a0e38600b2ac Author: Zhang Heng Date: Mon Mar 30 17:51:33 2026 +0800 ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 16X OLED M7601RM Add a DMI quirk for the ASUS Vivobook Pro 16X OLED M7601RM fixing the issue where the internal microphone was not detected. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221288 Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260330095133.81786-1-zhangheng@kylinos.cn Signed-off-by: Mark Brown commit 11b72b1ca9891c77bc876ef9fc39d6825847ffee Author: Ziyue Zhang Date: Mon Mar 30 10:09:34 2026 +0800 arm64: dts: qcom: hamoa: Fix incomplete Root Port property migration Historically, the Qualcomm PCIe controller node (Host bridge) described all Root Port properties, such as PHY, PERST#, and WAKE#. But to provide a more accurate hardware description and to support future multi-Root Port controllers, these properties were moved to the Root Port node in the devicetree bindings. Commit 960609b22be5 ("arm64: dts: qcom: hamoa: Move PHY, PERST, and Wake GPIOs to PCIe port nodes and add port Nodes for all PCIe ports") initiated this transition for the Hamoa platform by moving the PHY property to the Root Port node in hamoa.dtsi. However, it only updated some platform specific DTS files for PERST# and WAKE#, leaving others in a "mixed" binding state. While the PCIe controller driver supports both legacy and Root Port bindings, It cannot correctly handle a mix of both. In these cases, the driver parses the PHY from the Root Port node, but fails to find the PERST# property (which it then assumes is not present, as it is optional). Consequently, the controller probe succeeds, but PERST# remains uncontrolled, preventing PCIe endpoints from functioning. So, fix the incomplete migration by moving the PERST# and WAKE# properties from the controller node to the Root Port node in all remaining Hamoa platform DTS files. Fixes: 960609b22be5 ("arm64: dts: qcom: hamoa: Move PHY, PERST, and Wake GPIOs to PCIe port nodes and add port Nodes for all PCIe ports") Signed-off-by: Ziyue Zhang Reviewed-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260330020934.3501247-1-ziyue.zhang@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 56b7432b7e8e6ae1b289cb405d16db4150ef193b Author: Matthew Brost Date: Thu Mar 26 14:01:15 2026 -0700 drm/xe: Avoid memory allocations in xe_device_declare_wedged() xe_device_declare_wedged() runs in the DMA-fence signaling path, where GFP_KERNEL memory allocations are not allowed. However, registering xe_device_wedged_fini via drmm_add_action_or_reset() triggers a GFP_KERNEL allocation. Fix this by deferring the registration of xe_device_wedged_fini until late in the driver load sequence. Additionally, drop the wedged PM reference only if the device is actually wedged in xe_device_wedged_fini. Fixes: 452bca0edbd0 ("drm/xe: Don't suspend device upon wedge") Signed-off-by: Matthew Brost Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260326210116.202585-2-matthew.brost@intel.com (cherry picked from commit b08ceb443866808b881b12d4183008d214d816c1) Signed-off-by: Rodrigo Vivi commit bce7cd6db2386e7a2b49ad3c09df0beabddfa3c4 Author: Matthew Brost Date: Thu Feb 26 17:52:25 2026 -0800 drm/xe: Disable garbage collector work item on SVM close When an SVM is closed, the garbage collector work item must be stopped synchronously and any future queuing must be prevented. Replace flush_work() with disable_work_sync() to ensure both conditions are met. Fixes: 63f6e480d115 ("drm/xe: Add SVM garbage collector") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260227015225.3081787-1-matthew.brost@intel.com (cherry picked from commit 2247feb9badca5a4774df9a437bfc44fba4f22de) Signed-off-by: Rodrigo Vivi commit e3fb579872a8d9cf264c52710d5839de3afa6fc1 Author: Daniele Ceraolo Spurio Date: Tue Mar 24 08:37:23 2026 -0700 drm/xe/pxp: Don't allow PXP on older PTL GSC FWs On PTL, older GSC FWs have a bug that can cause them to crash during PXP invalidation events, which leads to a complete loss of power management on the media GT. Therefore, we can't use PXP on FWs that have this bug, which was fixed in PTL GSC build 1396. Fixes: b1dcec9bd8a1 ("drm/xe/ptl: Enable PXP for PTL") Signed-off-by: Daniele Ceraolo Spurio Cc: Julia Filipchuk Reviewed-by: Julia Filipchuk Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20260324153718.3155504-10-daniele.ceraolospurio@intel.com (cherry picked from commit 6eb04caaa972934c9b6cea0e0c29e466bf9a346f) Signed-off-by: Rodrigo Vivi commit 76903b2057c8677c2c006e87fede15f496555dc0 Author: Daniele Ceraolo Spurio Date: Tue Mar 24 08:37:22 2026 -0700 drm/xe/pxp: Clear restart flag in pxp_start after jumping back If we don't clear the flag we'll keep jumping back at the beginning of the function once we reach the end. Fixes: ccd3c6820a90 ("drm/xe/pxp: Decouple queue addition from PXP start") Signed-off-by: Daniele Ceraolo Spurio Cc: Julia Filipchuk Reviewed-by: Julia Filipchuk Link: https://patch.msgid.link/20260324153718.3155504-9-daniele.ceraolospurio@intel.com (cherry picked from commit 0850ec7bb2459602351639dccf7a68a03c9d1ee0) Signed-off-by: Rodrigo Vivi commit 4fed244954c2dc9aafa333d08f66b14345225e03 Author: Daniele Ceraolo Spurio Date: Tue Mar 24 08:37:21 2026 -0700 drm/xe/pxp: Remove incorrect handling of impossible state during suspend The default case of the PXP suspend switch is incorrectly exiting without releasing the lock. However, this case is impossible to hit because we're switching on an enum and all the valid enum values have their own cases. Therefore, we can just get rid of the default case and rely on the compiler to warn us if a new enum value is added and we forget to add it to the switch. Fixes: 51462211f4a9 ("drm/xe/pxp: add PXP PM support") Signed-off-by: Daniele Ceraolo Spurio Cc: Alan Previn Teres Alexis Cc: Julia Filipchuk Reviewed-by: Julia Filipchuk Link: https://patch.msgid.link/20260324153718.3155504-8-daniele.ceraolospurio@intel.com (cherry picked from commit f1b5a77fc9b6a90cd9a5e3db9d4c73ae1edfcfac) Signed-off-by: Rodrigo Vivi commit e2628e670bb0923fcdc00828bfcd67b26a7df020 Author: Daniele Ceraolo Spurio Date: Tue Mar 24 08:37:20 2026 -0700 drm/xe/pxp: Clean up termination status on failure If the PXP HW termination fails during PXP start, the normal completion code won't be called, so the termination will remain uncomplete. To avoid unnecessary waits, mark the termination as completed from the error path. Note that we already do this if the termination fails when handling a termination irq from the HW. Fixes: f8caa80154c4 ("drm/xe/pxp: Add PXP queue tracking and session start") Signed-off-by: Daniele Ceraolo Spurio Cc: Alan Previn Teres Alexis Cc: Julia Filipchuk Reviewed-by: Julia Filipchuk Link: https://patch.msgid.link/20260324153718.3155504-7-daniele.ceraolospurio@intel.com (cherry picked from commit 5d9e708d2a69ab1f64a17aec810cd7c70c5b9fab) Signed-off-by: Rodrigo Vivi commit 7b9a3a910e96f20b101b0df6b1f5c77b023a4097 Author: Arvind Yadav Date: Thu Mar 26 18:38:38 2026 +0530 drm/xe/madvise: Accept canonical GPU addresses in xe_vm_madvise_ioctl Userspace passes canonical (sign-extended) GPU addresses where bits 63:48 mirror bit 47. The internal GPUVM uses non-canonical form (upper bits zeroed), so passing raw canonical addresses into GPUVM lookups causes mismatches for addresses above 128TiB. Strip the sign extension with xe_device_uncanonicalize_addr() at the top of xe_vm_madvise_ioctl(). Non-canonical addresses are unaffected. Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe") Suggested-by: Matthew Brost Cc: Thomas Hellström Reviewed-by: Matthew Brost Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Arvind Yadav Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260326130843.3545241-13-arvind.yadav@intel.com (cherry picked from commit 05c8b1cdc54036465ea457a0501a8c2f9409fce7) Signed-off-by: Rodrigo Vivi commit 6d192b4f2d644d15d9a9f1d33dab05af936f6540 Author: Jonathan Cavitt Date: Tue Mar 24 15:29:37 2026 +0000 drm/xe/xe_pagefault: Disallow writes to read-only VMAs The page fault handler should reject write/atomic access to read only VMAs. Add code to handle this in xe_pagefault_service after the VMA lookup. v2: - Apply max line length (Matthew) Fixes: fb544b844508 ("drm/xe: Implement xe_pagefault_queue_work") Signed-off-by: Jonathan Cavitt Suggested-by: Matthew Brost Cc: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260324152935.72444-7-jonathan.cavitt@intel.com (cherry picked from commit 714ee6754ac5fa3dc078856a196a6b124cd797a0) Signed-off-by: Rodrigo Vivi commit 534025950c9fe4dfbe476b3938d73a26814047d1 Author: Felix Gu Date: Sun Mar 29 00:07:07 2026 +0800 spi: stm32-ospi: Fix DMA channel leak on stm32_ospi_dma_setup() failure When stm32_ospi_dma_setup() fails, the DMA channels allocated by stm32_ospi_get_resources() were never released. Add proper cleanup in the error path. Fixes: e35a7607e05d ("spi: stm32-ospi: Set DMA maxburst dynamically") Signed-off-by: Felix Gu Reviewed-by: Patrice Chotard Link: https://patch.msgid.link/20260329-stm32-ospi-v1-2-142122466412@gmail.com Signed-off-by: Mark Brown commit 5a570c8d6e55689253f6fcc4a198c56cca7e39d6 Author: Felix Gu Date: Sun Mar 29 00:07:06 2026 +0800 spi: stm32-ospi: Fix reset control leak on probe error When spi_register_controller() fails after reset_control_acquire() succeeds, the reset control is never released. This causes a resource leak in the error path. Add the missing reset_control_release() call in the error path. Fixes: cf2c3eceb757 ("spi: stm32-ospi: Make usage of reset_control_acquire/release() API") Signed-off-by: Felix Gu Reviewed-by: Patrice Chotard Link: https://patch.msgid.link/20260329-stm32-ospi-v1-1-142122466412@gmail.com Signed-off-by: Mark Brown commit 73cd1f97946ae3796544448ff12c07f399bb2881 Author: Felix Gu Date: Sun Mar 29 19:14:05 2026 +0800 spi: stm32-ospi: Fix resource leak in remove() callback The remove() callback returned early if pm_runtime_resume_and_get() failed, skipping the cleanup of spi controller and other resources. Remove the early return so cleanup completes regardless of PM resume result. Fixes: 79b8a705e26c ("spi: stm32: Add OSPI driver") Signed-off-by: Felix Gu Reviewed-by: Patrice Chotard Link: https://patch.msgid.link/20260329-ospi-v1-1-cc8cf1c82c4a@gmail.com Signed-off-by: Mark Brown commit 917e3ad3321e75ca0223d5ccf26ceda116aa51e1 Author: Aleksandr Nogikh Date: Wed Mar 25 16:48:24 2026 +0100 x86/kexec: Disable KCOV instrumentation after load_segments() The load_segments() function changes segment registers, invalidating GS base (which KCOV relies on for per-cpu data). When CONFIG_KCOV is enabled, any subsequent instrumented C code call (e.g. native_gdt_invalidate()) begins crashing the kernel in an endless loop. To reproduce the problem, it's sufficient to do kexec on a KCOV-instrumented kernel: $ kexec -l /boot/otherKernel $ kexec -e The real-world context for this problem is enabling crash dump collection in syzkaller. For this, the tool loads a panic kernel before fuzzing and then calls makedumpfile after the panic. This workflow requires both CONFIG_KEXEC and CONFIG_KCOV to be enabled simultaneously. Adding safeguards directly to the KCOV fast-path (__sanitizer_cov_trace_pc()) is also undesirable as it would introduce an extra performance overhead. Disabling instrumentation for the individual functions would be too fragile, so disable KCOV instrumentation for the entire machine_kexec_64.c and physaddr.c. If coverage-guided fuzzing ever needs these components in the future, other approaches should be considered. The problem is not relevant for 32 bit kernels as CONFIG_KCOV is not supported there. [ bp: Space out comment for better readability. ] Fixes: 0d345996e4cb ("x86/kernel: increase kcov coverage under arch/x86/kernel folder") Signed-off-by: Aleksandr Nogikh Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Dmitry Vyukov Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260325154825.551191-1-nogikh@google.com commit f1af71d568e55536d9297bfa7907ad497108cf30 Author: Zhang Heng Date: Mon Mar 30 15:53:34 2026 +0800 ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15 ASUS ROG Strix SCAR 15, like the Strix G15, requires the ALC285_FIXUP_ASUS_G533Z_PINS quirk to work properly. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221247 Cc: Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260330075334.50962-2-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 2f42c1a6161646cbd29b443459fd635d29eda634 Author: Thomas Zimmermann Date: Fri Mar 27 14:32:53 2026 +0100 drm/ast: dp501: Fix initialization of SCU2C Ast's DP501 initialization reads the register SCU2C at offset 0x1202c and tries to set it to source data from VGA. But writes the update to offset 0x0, with unknown results. Write the result to SCU instead. The bug only happens in ast_init_analog(). There's similar code in ast_init_dvo(), which works correctly. Signed-off-by: Thomas Zimmermann Fixes: 83c6620bae3f ("drm/ast: initial DP501 support (v0.2)") Reviewed-by: Jocelyn Falempe Cc: Dave Airlie Cc: Thomas Zimmermann Cc: Jocelyn Falempe Cc: dri-devel@lists.freedesktop.org Cc: # v3.16+ Link: https://patch.msgid.link/20260327133532.79696-2-tzimmermann@suse.de commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 Author: Jamie Gibbons Date: Thu Mar 26 17:02:34 2026 +0000 dt-bindings: gpio: fix microchip #interrupt-cells The GPIO controller on PolarFire SoC supports more than one type of interrupt and needs two interrupt cells. Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio") Signed-off-by: Jamie Gibbons Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud Signed-off-by: Bartosz Golaszewski commit 310a4a9cbb17037668ea440f6a3964d00705b400 Author: Bartosz Golaszewski Date: Wed Mar 25 12:06:38 2026 +0100 gpio: shared: shorten the critical section in gpiochip_setup_shared() Commit 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set") introduced a critical section around the adjustmenet of entry->offset. However this may cause a deadlock if we create the auxiliary shared proxy devices with this lock taken. We only need to protect entry->offset while it's read/written so shorten the critical section and release the lock before creating the proxy device as the field in question is no longer accessed at this point. Fixes: 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set") Reported-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260325-gpio-shared-deadlock-v1-1-e4e7a5319e95@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 3d48c9fd78dd0b1809669ec49c4d0997b8127512 Author: Mikhail Gavrilov Date: Fri Mar 27 17:41:56 2026 +0500 dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement When CONFIG_DMA_API_DEBUG is enabled, the DMA debug infrastructure tracks active mappings per cacheline and warns if two different DMA mappings share the same cacheline ("cacheline tracking EEXIST, overlapping mappings aren't supported"). On x86_64, ARCH_KMALLOC_MINALIGN defaults to 8, so small kmalloc allocations (e.g. the 8-byte hub->buffer and hub->status in the USB hub driver) frequently land in the same 64-byte cacheline. When both are DMA-mapped, this triggers a false positive warning. This has been reported repeatedly since v5.14 (when the EEXIST check was added) across various USB host controllers and devices including xhci_hcd with USB hubs, USB audio devices, and USB ethernet adapters. The cacheline overlap is only a real concern on architectures that require DMA buffer alignment to cacheline boundaries (i.e. where ARCH_DMA_MINALIGN >= L1_CACHE_BYTES). On architectures like x86_64 where dma_get_cache_alignment() returns 1, the hardware is cache-coherent and overlapping cacheline mappings are harmless. Suppress the EEXIST warning when dma_get_cache_alignment() is less than L1_CACHE_BYTES, indicating the architecture does not require cacheline-aligned DMA buffers. Verified with a kernel module reproducer that performs two kmalloc(8) allocations back-to-back and DMA-maps both: Before: allocations share a cacheline, EEXIST fires within ~50 pairs After: same cacheline pair found, but no warning emitted Fixes: 2b4bbc6231d7 ("dma-debug: report -EEXIST errors in add_dma_entry") Link: https://bugzilla.kernel.org/show_bug.cgi?id=215740 Suggested-by: Harry Yoo Tested-by: Mikhail Gavrilov Signed-off-by: Mikhail Gavrilov Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260327124156.24820-1-mikhail.v.gavrilov@gmail.com commit f025ac8c698ac7d29eb3b5025bcdaf7ad675785d Author: Dag Smedberg Date: Sun Mar 29 19:04:20 2026 +0200 ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP Same issue that the Scarlett 2i2 1st Gen had: QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted audio on the Scarlett Solo 1st Gen (1235:801c). Fixes: 38c322068a26 ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP") Reported-by: Dag Smedberg Tested-by: Dag Smedberg Signed-off-by: Dag Smedberg Link: https://patch.msgid.link/20260329170420.4122-1-dag@dsmedberg.se Signed-off-by: Takashi Iwai commit 45424e871abf2a152e247a9cff78359f18dd95c0 Author: Berk Cem Goksel Date: Sun Mar 29 16:38:25 2026 +0300 ALSA: caiaq: fix stack out-of-bounds read in init_card The loop creates a whitespace-stripped copy of the card shortname where `len < sizeof(card->id)` is used for the bounds check. Since sizeof(card->id) is 16 and the local id buffer is also 16 bytes, writing 16 non-space characters fills the entire buffer, overwriting the terminating nullbyte. When this non-null-terminated string is later passed to snd_card_set_id() -> copy_valid_id_string(), the function scans forward with `while (*nid && ...)` and reads past the end of the stack buffer, reading the contents of the stack. A USB device with a product name containing many non-ASCII, non-space characters (e.g. multibyte UTF-8) will reliably trigger this as follows: BUG: KASAN: stack-out-of-bounds in copy_valid_id_string sound/core/init.c:696 [inline] BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c sound/core/init.c:718 The off-by-one has been present since commit bafeee5b1f8d ("ALSA: snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1), which first introduced this whitespace-stripping loop. The original code never accounted for the null terminator when bounding the copy. Fix this by changing the loop bound to `sizeof(card->id) - 1`, ensuring at least one byte remains as the null terminator. Fixes: bafeee5b1f8d ("ALSA: snd_usb_caiaq: give better shortname") Cc: stable@vger.kernel.org Cc: Andrey Konovalov Reported-by: Berk Cem Goksel Signed-off-by: Berk Cem Goksel Link: https://patch.msgid.link/20260329133825.581585-1-berkcgoksel@gmail.com Signed-off-by: Takashi Iwai commit 4dfce79e098915d8e5fc2b9e1d980bc3251dd32c Author: Ville Syrjälä Date: Thu Mar 26 13:18:10 2026 +0200 drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode Stop adjusting the horizontal timing values based on the compression ratio in command mode. Bspec seems to be telling us to do this only in video mode, and this is also how the Windows driver does things. This should also fix a div-by-zero on some machines because the adjusted htotal ends up being so small that we end up with line_time_us==0 when trying to determine the vtotal value in command mode. Note that this doesn't actually make the display on the Huawei Matebook E work, but at least the kernel no longer explodes when the driver loads. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12045 Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260326111814.9800-2-ville.syrjala@linux.intel.com Fixes: 53693f02d80e ("drm/i915/dsi: account for DSC in horizontal timings") Reviewed-by: Jani Nikula (cherry picked from commit 0b475e91ecc2313207196c6d7fd5c53e1a878525) Signed-off-by: Joonas Lahtinen commit 7081d46d32312f1a31f0e0e99c6835a394037599 Author: Keenan Dong Date: Thu Mar 26 20:36:39 2026 +0800 xfrm: account XFRMA_IF_ID in aevent size calculation xfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then build_aevent() appends attributes including XFRMA_IF_ID when x->if_id is set. xfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states with if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err < 0) in xfrm_get_ae(), turning a malformed netlink interaction into a kernel panic. Account XFRMA_IF_ID in the size calculation unconditionally and replace the BUG_ON with normal error unwinding. Fixes: 7e6526404ade ("xfrm: Add a new lookup key to match xfrm interfaces.") Reported-by: Keenan Dong Signed-off-by: Keenan Dong Signed-off-by: Steffen Klassert commit 71a98248c63c535eaa4d4c22f099b68d902006d0 Author: Yasuaki Torimaru Date: Thu Mar 26 14:58:00 2026 +0900 xfrm: clear trailing padding in build_polexpire() build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogous function build_polexpire() does not do this for struct xfrm_user_polexpire. The padding bytes after the __u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners, leaking kernel heap memory contents. Add the missing memset_after() call, matching build_expire(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Yasuaki Torimaru Reviewed-by: Simon Horman Reviewed-by: Breno Leitao Signed-off-by: Steffen Klassert commit deb4605671cfae3b2803cfbbf4739e7245248398 Author: Nathan Chancellor Date: Wed Mar 25 18:20:30 2026 -0700 modpost: Declare extra_warn with unused attribute A recent strengthening of -Wunused-but-set-variable (enabled with -Wall) in clang under a new subwarning, -Wunused-but-set-global, points out an unused static global variable in scripts/mod/modpost.c: scripts/mod/modpost.c:59:13: error: variable 'extra_warn' set but not used [-Werror,-Wunused-but-set-global] 59 | static bool extra_warn; | ^ This variable has been unused since commit 6c6c1fc09de3 ("modpost: require a MODULE_DESCRIPTION()") but that is expected, as there are currently no extra warnings at W=1 right now. Declare the variable with the unused attribute to make it clear to the compiler that this variable may be unused. Cc: stable@vger.kernel.org Fixes: 6c6c1fc09de3 ("modpost: require a MODULE_DESCRIPTION()") Link: https://patch.msgid.link/20260325-modpost-extra_warn-unused-but-set-global-v1-1-2e84003b7e81@kernel.org Reviewed-by: Nicolas Schier Signed-off-by: Nathan Chancellor commit 742de64b62b690a368dbeb846499eb8ac8ceedb9 Author: Janne Grunau Date: Fri Mar 27 09:30:29 2026 +0100 kbuild: modules-cpio-pkg: Respect INSTALL_MOD_PATH The modules-cpio-pkg target added in commit 2a9c8c0b59d3 ("kbuild: add target to build a cpio containing modules") is incompatible with initramfs with merged /lib and /usr/lib directories [1]. "/lib" cannot be a link and directory at the same time. Respect a non-empty INSTALL_MOD_PATH in the modules-cpio-pkg target so that `make INSTALL_MOD_PATH=/usr modules-cpio-pkg` results in the same module install location as `make INSTALL_MOD_PATH=/usr modules_install`. Tested with Fedora distribution initramfs produced by dracut. Link: https://systemd.io/THE_CASE_FOR_THE_USR_MERGE/ [1] Fixes: 2a9c8c0b59d3 ("kbuild: add target to build a cpio containing modules") Cc: stable@vger.kernel.org Reviewed-by: Simon Glass Reviewed-by: Nathan Chancellor Reviewed-by: Thomas Weißschuh Signed-off-by: Janne Grunau Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Reviewed-by: Ahmad Fatoum Link: https://patch.msgid.link/20260327-kbuild-modules-cpio-pkg-usr-merge-v3-1-ef507dfa006c@jannau.net Signed-off-by: Nathan Chancellor commit fda9522ed6afaec45cabc198d8492270c394c7bc Author: Asim Viladi Oglu Manizada Date: Wed Mar 25 09:14:22 2026 +0900 ksmbd: fix OOB write in QUERY_INFO for compound requests When a compound request such as READ + QUERY_INFO(Security) is received, and the first command (READ) consumes most of the response buffer, ksmbd could write beyond the allocated buffer while building a security descriptor. The root cause was that smb2_get_info_sec() checked buffer space using ppntsd_size from xattr, while build_sec_desc() often synthesized a significantly larger descriptor from POSIX ACLs. This patch introduces smb_acl_sec_desc_scratch_len() to accurately compute the final descriptor size beforehand, performs proper buffer checking with smb2_calc_max_out_buf_len(), and uses exact-sized allocation + iov pinning. Cc: stable@vger.kernel.org Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound") Signed-off-by: Asim Viladi Oglu Manizada Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit a9d2fbd3ad0e6ac588386e699beeccfe7516755f Author: Sanman Pradhan Date: Sun Mar 29 17:09:53 2026 +0000 hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") ltc4286.c uses PMBus core symbols exported in the PMBUS namespace, such as pmbus_do_probe(), but does not declare MODULE_IMPORT_NS("PMBUS"). Add the missing namespace import to avoid modpost warnings. Fixes: 0c459759ca97 ("hwmon: (pmbus) Add ltc4286 driver") Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260329170925.34581-5-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb Author: Sanman Pradhan Date: Sun Mar 29 17:09:48 2026 +0000 hwmon: (pxe1610) Check return value of page-select write in probe pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check the return value. If the write fails, subsequent register reads operate on an indeterminate page, leading to silent misconfiguration. Check the return value and propagate the error using dev_err_probe(), which also handles -EPROBE_DEFER correctly without log spam. Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver") Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com [groeck: Fix "Fixes" SHA] Signed-off-by: Guenter Roeck commit 0e211f6aaa6a00fd0ee0c1eea5498f168c6725e6 Author: Sanman Pradhan Date: Sun Mar 29 17:09:40 2026 +0000 hwmon: (tps53679) Fix array access with zero-length block read i2c_smbus_read_block_data() can return 0, indicating a zero-length read. When this happens, tps53679_identify_chip() accesses buf[ret - 1] which is buf[-1], reading one byte before the buffer on the stack. Fix by changing the check from "ret < 0" to "ret <= 0", treating a zero-length read as an error (-EIO), which prevents the out-of-bounds array access. Also fix a typo in the adjacent comment: "if present" instead of duplicate "if". Fixes: 75ca1e5875fe ("hwmon: (pmbus/tps53679) Add support for TPS53685") Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260329170925.34581-2-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 7aaa8047eafd0bd628065b15757d9b48c5f9c07d Author: Linus Torvalds Date: Sun Mar 29 15:40:00 2026 -0700 Linux 7.0-rc6 commit d1384f70b2e3162786bc73b8f86c27417803bd57 Merge: fc9eae25ecb769 0e764b9d460716 Author: Linus Torvalds Date: Sun Mar 29 15:24:28 2026 -0700 Merge tag 'vfs-7.0-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix netfs_limit_iter() hitting BUG() when an ITER_KVEC iterator reaches it via core dump writes to 9P filesystems. Add ITER_KVEC handling following the same pattern as the existing ITER_BVEC code. - Fix a NULL pointer dereference in the netfs unbuffered write retry path when the filesystem (e.g., 9P) doesn't set the prepare_write operation. - Clear I_DIRTY_TIME in sync_lazytime for filesystems implementing ->sync_lazytime. Without this the flag stays set and may cause additional unnecessary calls during inode deactivation. - Increase tmpfs size in mount_setattr selftests. A recent commit bumped the ext4 image size to 2 GB but didn't adjust the tmpfs backing store, so mkfs.ext4 fails with ENOSPC writing metadata. - Fix an invalid folio access in iomap when i_blkbits matches the folio size but differs from the I/O granularity. The cur_folio pointer would not get invalidated and iomap_read_end() would still be called on it despite the IO helper owning it. - Fix hash_name() docstring. - Fix read abandonment during netfs retry where the subreq variable used for abandonment could be uninitialized on the first pass or point to a deleted subrequest on later passes. - Don't block sync for filesystems with no data integrity guarantees. Add a SB_I_NO_DATA_INTEGRITY superblock flag replacing the per-inode AS_NO_DATA_INTEGRITY mapping flag so sync kicks off writeback but doesn't wait for flusher threads. This fixes a suspend-to-RAM hang on fuse-overlayfs where the flusher thread blocks when the fuse daemon is frozen. - Fix a lockdep splat in iomap when reads fail. iomap_read_end_io() invokes fserror_report() which calls igrab() taking i_lock in hardirq context while i_lock is normally held with interrupts enabled. Kick failed read handling to a workqueue. - Remove the redundant netfs_io_stream::front member and use stream->subrequests.next instead, fixing a potential issue in the direct write code path. * tag 'vfs-7.0-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: netfs: Fix the handling of stream->front by removing it iomap: fix lockdep complaint when reads fail writeback: don't block sync for filesystems with no data integrity guarantees netfs: Fix read abandonment during retry vfs: fix docstring of hash_name() iomap: fix invalid folio access when i_blkbits differs from I/O granularity selftests/mount_setattr: increase tmpfs size for idmapped mount tests fs: clear I_DIRTY_TIME in sync_lazytime netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators commit 111a12b422a8cfa93deabaef26fec48237163214 Author: Qi Tang Date: Mon Mar 30 00:49:36 2026 +0800 io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_addr at the exact end of the registered region when len is zero, because the check uses strict greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed() then computes offset == imu->len, which causes the bvec skip logic to advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory. Return early from io_import_fixed() when len is zero. A zero-length import has no data to transfer and should not walk the bvec array at all. BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 Read of size 4 at addr ffff888002bcc254 by task poc/103 Call Trace: io_import_reg_buf+0x697/0x7f0 io_write_fixed+0xd9/0x250 __io_issue_sqe+0xad/0x710 io_issue_sqe+0x7d/0x1100 io_submit_sqes+0x86a/0x23c0 __do_sys_io_uring_enter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248) Fixes: 8622b20f23ed ("io_uring: add validate_fixed_range() for validate fixed buffer") Signed-off-by: Qi Tang Link: https://patch.msgid.link/20260329164936.240871-1-tpluszz77@gmail.com Signed-off-by: Jens Axboe commit b948f9d5d3057b01188e36664e7c7604d1c8ecb5 Author: Junxi Qian Date: Sun Mar 29 23:39:09 2026 +0800 io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() sqe->len is __u32 but gets stored into sr->len which is int. When userspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF), sr->len overflows to a negative value. This negative value propagates through the bundle recv/send path: 1. io_recv(): sel.val = sr->len (ssize_t gets -1) 2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets 0xFFFFFFFFFFFFFFFF) 3. io_ring_buffers_peek(): buf->len is not clamped because max_len is astronomically large 4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs() 5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1, causing ret to increase instead of decrease, creating an infinite loop that reads past the allocated iov[] array This results in a slab-out-of-bounds read in io_bundle_nbufs() from the kmalloc-64 slab, as nbufs increments past the allocated iovec entries. BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160 Read of size 8 at addr ffff888100ae05c8 by task exp/145 Call Trace: io_bundle_nbufs+0x128/0x160 io_recv_finish+0x117/0xe20 io_recv+0x2db/0x1160 Fix this by rejecting negative sr->len values early in both io_sendmsg_prep() and io_recvmsg_prep(). Since sqe->len is __u32, any value > INT_MAX indicates overflow and is not a valid length. Fixes: a05d1f625c7a ("io_uring/net: support bundles for send") Cc: stable@vger.kernel.org Signed-off-by: Junxi Qian Link: https://patch.msgid.link/20260329153909.279046-1-qjx1298677004@gmail.com Signed-off-by: Jens Axboe commit 45065a5095c7773fb98c35d60c20c3b513540597 Author: Akshai Murari Date: Fri Mar 27 06:54:45 2026 +0000 Input: add keycodes for contextual AI usages (HUTRR119) HUTRR119 introduces new usages for keys intended to invoke AI agents based on the current context. These are useful with the increasing number of operating systems with integrated Large Language Models Add new key definitions for KEY_ACTION_ON_SELECTION, KEY_CONTEXTUAL_INSERT and KEY_CONTEXTUAL_QUERY Signed-off-by: Akshai Murari Acked-by: Dmitry Torokhov Signed-off-by: Jiri Kosina commit fc9eae25ecb769e0c03a1383c677e2ddc1de8adf Merge: a516c618a627e3 81af9e40e2e4e1 Author: Linus Torvalds Date: Sun Mar 29 12:48:52 2026 -0700 Merge tag 'phy-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - Qualcomm PCS table fix for ufs phy - TI device node reference fix - Common prop kconfig fix - lynx CDR lock workaround for lanes disabled - usb disconnect function fix of k1 driver * tag 'phy-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4 phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() phy: k1-usb: add disconnect function support phy: lynx-28g: skip CDR lock workaround for lanes disabled in the device tree phy: make PHY_COMMON_PROPS Kconfig symbol conditionally user-selectable commit a516c618a627e30b5613fadd264d4b4498254aeb Merge: 32ee88daf78b69 a17ce4bc6f4f9a Author: Linus Torvalds Date: Sun Mar 29 12:42:31 2026 -0700 Merge tag 'dmaengine-fix-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: "A bunch of driver fixes with idxd ones being the biggest: - Xilinx regmap init error handling, dma_device directions, residue calculation, and reset related timeout fixes - Renesas CHCTRL updates and driver list fixes - DW HDMA cycle bits and MSI data programming fix - IDXD pile of fixes for memeory leak and FLR fixes" * tag 'dmaengine-fix-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (21 commits) dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA dmaengine: xilinx: xilinx_dma: Fix dma_device directions dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock dmaengine: sh: rz-dmac: Protect the driver specific lists dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() dmaengine: xilinx: xdma: Fix regmap init error handling dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. dmaengine: idxd: Fix leaking event log memory dmaengine: idxd: Fix freeing the allocated ida too late dmaengine: idxd: Fix memory leak when a wq is reset dmaengine: idxd: Fix not releasing workqueue on .release() dmaengine: idxd: Wait for submitted operations on .device_synchronize() dmaengine: idxd: Flush all pending descriptors dmaengine: idxd: Flush kernel workqueues on Function Level Reset dmaengine: idxd: Fix possible invalid memory access after FLR dmaengine: idxd: Fix crash when the event log is disabled dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config() dmaengine: dw-edma: fix MSI data programming for multi-IRQ case ... commit 32ee88daf78b69a95d21ba9ead55da8469ede1c9 Merge: ac354b5cb04d20 b0faf733fc1cf7 Author: Linus Torvalds Date: Sun Mar 29 12:27:13 2026 -0700 Merge tag 'i2c-for-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - designware: fix resume-probe race causing NULL-deref in amdisp - imx: fix timeout on repeated reads and extra clock at end - MAINTAINERS: drop outdated I2C website * tag 'i2c-for-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: MAINTAINERS: drop outdated I2C website i2c: designware: amdisp: Fix resume-probe race condition issue i2c: imx: ensure no clock is generated after last read i2c: imx: fix i2c issue when reading multiple messages commit ac354b5cb04d2077c3821a6cbfbc7981ad45f84a Merge: b8a3bc856735a5 df837460757789 Author: Linus Torvalds Date: Sun Mar 29 11:58:47 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "s390: - Lots of small and not-so-small fixes for the newly rewritten gmap, mostly affecting the handling of nested guests. x86: - Fix an issue with shadow paging, which causes KVM to install an MMIO PTE in the shadow page tables without first zapping a non-MMIO SPTE if KVM didn't see the write that modified the shadowed guest PTE. While commit a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") was right about it being impossible to miss such a write if it was coming from the guest, it failed to account for writes to guest memory that are outside the scope of KVM: if userspace modifies the guest PTE, and then the guest hits a relevant page fault, KVM will get confused" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE KVM: s390: Fix KVM_S390_VCPU_FAULT ioctl KVM: s390: vsie: Fix guest page tables protection KVM: s390: vsie: Fix unshadowing while shadowing KVM: s390: vsie: Fix refcount overflow for shadow gmaps KVM: s390: vsie: Fix nested guest memory shadowing KVM: s390: Correctly handle guest mappings without struct page KVM: s390: Fix gmap_link() KVM: s390: vsie: Fix check for pre-existing shadow mapping KVM: s390: Remove non-atomic dat_crstep_xchg() KVM: s390: vsie: Fix dat_split_ste() commit b8a3bc856735a53269270bc4c7ccd04ad2355069 Merge: f242ac4a09443c cd7e1fef5a1ca1 Author: Linus Torvalds Date: Sun Mar 29 11:51:37 2026 -0700 Merge tag 'for-linus-7.0a-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fix from Juergen Gross: "A single fix for a very rare bug introduced in rc5" * tag 'for-linus-7.0a-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/privcmd: unregister xenstore notifier on module exit commit f242ac4a09443c6e2e0ec03d7e2a21b00cbb3907 Merge: 47e3f23f0e1c64 a3e93cac25316a Author: Linus Torvalds Date: Sun Mar 29 10:04:37 2026 -0700 Merge tag 'x86-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix an early boot crash in AMD SEV-SNP guests, caused by incorrect FSGSBASE init ordering (Nikunj A Dadhania) - Remove X86_CR4_FRED from the CR4 pinned bits mask, to fix a race window during the bootup of SEV-{ES,SNP} or TDX guests, which can crash them if they trigger exceptions in that window (Borislav Petkov) - Fix early boot failures on SEV-ES/SNP guests, due to incorrect early GHCB access (Nikunj A Dadhania) - Add clarifying comment to the CRn pinning logic, to avoid future confusion & bugs (Peter Zijlstra) * tag 'x86-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Add comment clarifying CRn pinning x86/fred: Fix early boot failures on SEV-ES/SNP guests x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() commit 47e3f23f0e1c64ec44e657534532678b604ad99d Merge: f087b0bad454a9 5d16467ae56343 Author: Linus Torvalds Date: Sun Mar 29 10:02:38 2026 -0700 Merge tag 'timers-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix an argument order bug in the alarm timer forwarding logic, which may cause missed expirations or incorrect overrun accounting" * tag 'timers-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: alarmtimer: Fix argument order in alarm_timer_forward() commit f087b0bad454a91c7d1615f82954a4752843560d Merge: 21047b17b3ab29 210d36d892de51 Author: Linus Torvalds Date: Sun Mar 29 09:59:46 2026 -0700 Merge tag 'locking-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex fixes from Ingo Molnar: - Tighten up the sys_futex_requeue() ABI a bit, to disallow dissimilar futex flags and potential UaF access (Peter Zijlstra) - Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Hao-Yu Yang) - Clear stale exiting pointer in futex_lock_pi() retry path, which triggered a warning (and potential misbehavior) in stress-testing (Davidlohr Bueso) * tag 'locking-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Clear stale exiting pointer in futex_lock_pi() retry path futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() futex: Require sys_futex_requeue() to have identical flags commit 21047b17b3ab2977f8331b444249364cac3da66c Merge: a3d97d1d3fa682 897cf98926429c Author: Linus Torvalds Date: Sun Mar 29 09:53:01 2026 -0700 Merge tag 'irq-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: - Fix TX completion signaling bug in the Qualcomm MPM irqchip driver - Fix probe error handling in the Renesas RZ/V2H(P) irqchip driver * tag 'irq-urgent-2026-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common() irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment commit a3d97d1d3fa68253927a6e6c2fdfe7c039073af7 Merge: 241d4ca15de9bf 1f6ee9be92f8df Author: Linus Torvalds Date: Sun Mar 29 09:34:50 2026 -0700 Merge tag 'ovl-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs fixes from Amir Goldstein: - Fix regression in 'xino' feature detection I clumsily introduced this regression myself when working on another subsystem (fsnotify). Both the regression and the fix have almost no visible impact on users except for some kmsg prints. - Fix to performance regression in v6.12. This regression was reported by Google COS developers. It is not uncommon these days for the year-old mature LTS to get adopted by distros and get exposed to many new workloads. We made a sub-smart move of making a behavior change in v6.12 which could impact performance, without making it opt-in. Fixing this mistake retroactively, to be picked by LTS. * tag 'ovl-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: make fsync after metadata copy-up opt-in mount option ovl: fix wrong detection of 32bit inode numbers commit 241d4ca15de9bf2cc04bdec466a6a2b0bd5dbc19 Merge: b51ad67773fbe9 9ee29d20aab228 Author: Linus Torvalds Date: Sun Mar 29 09:30:06 2026 -0700 Merge tag 'ext4_for_linus-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: - Update the MAINTAINERS file to add reviewers for the ext4 file system - Add a test issue an ext4 warning (not a WARN_ON) if there are still dirty pages attached to an evicted inode. - Fix a number of Syzkaller issues - Fix memory leaks on error paths - Replace some BUG and WARN with EFSCORRUPTED reporting - Fix a potential crash when disabling discard via remount followed by an immediate unmount. (Found by Sashiko) - Fix a corner case which could lead to allocating blocks for an indirect-mapped inode block numbers > 2**32 - Fix a race when reallocating a freed inode that could result in a deadlock - Fix a user-after-free in update_super_work when racing with umount - Fix build issues when trying to build ext4's kunit tests as a module - Fix a bug where ext4_split_extent_zeroout() could fail to pass back an error from ext4_ext_dirty() - Avoid allocating blocks from a corrupted block group in ext4_mb_find_by_goal() - Fix a percpu_counters list corruption BUG triggered by an ext4 extents kunit - Fix a potetial crash caused by the fast commit flush path potentially accessing the jinode structure before it is fully initialized - Fix fsync(2) in no-journal mode to make sure the dirtied inode is write to storage - Fix a bug when in no-journal mode, when ext4 tries to avoid using recently deleted inodes, if lazy itable initialization is enabled, can lead to an unitialized inode getting skipped and triggering an e2fsck complaint - Fix journal credit calculation when setting an xattr when both the encryption and ea_inode feeatures are enabled - Fix corner cases which could result in stale xarray tags after writeback - Fix generic/475 failures caused by ENOSPC errors while creating a symlink when the system crashes resulting to a file system inconsistency when replaying the fast commit journal * tag 'ext4_for_linus-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (27 commits) ext4: always drain queued discard work in ext4_mb_release() ext4: handle wraparound when searching for blocks for indirect mapped blocks ext4: skip split extent recovery on corruption ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths ext4: fix deadlock on inode reallocation ext4: fix use-after-free in update_super_work when racing with umount ext4: fix the might_sleep() warnings in kvfree() ext4: reject mount if bigalloc with s_first_data_block != 0 ext4: fix extents-test.c is not compiled when EXT4_KUNIT_TESTS=M ext4: fix mballoc-test.c is not compiled when EXT4_KUNIT_TESTS=M ext4: introduce EXPORT_SYMBOL_FOR_EXT4_TEST() helper jbd2: gracefully abort on checkpointing state corruptions ext4: avoid infinite loops caused by residual data ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4: test if inode's all dirty pages are submitted to disk ext4: minor fix for ext4_split_extent_zeroout() ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() ext4: kunit: extents-test: lix percpu_counters list corruption ext4: publish jinode after initialization ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio ... commit 80ffc54d0479c85324d743673c1737ed61b2b05c Merge: 37276dd6b6ea6a d0b224cf9ab12e Author: Greg Kroah-Hartman Date: Sun Mar 29 15:27:12 2026 +0200 Merge tag 'iio-fixes-for-7.0c' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: IIO: 3rd set of fixes for the 7.0 cycle. Note that this pull is in addition to the 2nd set of such fixes that are waiting to be picked up. Absolutely fine to queue these for the merge window if that makes more sense. Usual mixed back of ancient issues surfacing and newer problems. adi,ad57770r - Stop eating an error in read_raw. adi,adxl313 - Check return of regmap_write() instead of ignoring it in one place. adi,adxl355 - Fix the description of the temperature channel to be unsigned rather than signed. bosch,bmi160 - Avoid use of uninitialized data. - Fix validation of small reference voltages. hid-sensor-rotation: - The timestamp location in this driver has unfortunately been broken for a long time. Given it was correct for 6 years and then broken for the next 6 years, use a one off hack to duplicate it in both locations. The issue was as a result of the unique nature of quaternion representation combined with large precision resulting in an 128 bit aligned channel. nxp,sar-adc - Avoid leaking a dma channel. rfdigital,rfd77402 - Close a race between reinit_completion() and the irq happening. ti,adc161s626 - Fix up buffer handling on big endian hosts which was broken due to casting of pointers to different sized integers. - Ensure a DMA safe buffer is used. vishay,vcnl4035 - Fix up buffer handling on big endian hosts which was broken due to casting of pointers to different sized integers. vishay,veml6070 - Fix return value mess up that occurred when doing a guard() conversion. * tag 'iio-fixes-for-7.0c' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: light: veml6070: fix veml6070_read() return value iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode iio: accel: adxl313: add missing error check in predisable iio: dac: ad5770r: fix error return in ad5770r_read_raw() iio: accel: fix ADXL355 temperature signature value iio: light: vcnl4035: fix scan buffer on big-endian iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() iio: adc: ti-adc161s626: fix buffer read on big-endian iio: dac: mcp47feb02: Fix Vref validation [1-999] case iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace iio: proximity: rfd77402: Fix completion race condition in IRQ mode commit 37276dd6b6ea6a0a032f5496cbade0d1d781004e Merge: 76dd7c74fd3935 ea7e2e43d76810 Author: Greg Kroah-Hartman Date: Sun Mar 29 14:49:21 2026 +0200 Merge tag 'iio-fixes-for-7.0b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linux Jonathan writes: IIO: 2nd set of fixes for the 7.0 cycle Usual mixed bag of fixes for recent code and much older issues that have surfaced. Biggest group are continued resolution of IRQF_ONE_SHOT being used incorrectly (which now triggers a warning) adi,ad4062 - Replace IRQF_ONESHOT (as no threaded handler) with IRQF_NO_THREAD as the caller makes use of iio_trigger_poll() which cannot run from a thread. adi,ade9000 - Move mutex_init() earlier to ensure it is available if spurious IRQ occurs. adi,adis16550 - Fix swapped gyro and accel filter functions. adi,adxl3380 - Fix some bit manipulation that was always resulting in 0. - Fix incorrect register map for calibbias on the active power channel. - Fix returning IRQF_HANDLED from a function that should return 0 or -ERRNO. aspeed,adc - Clear a reference voltage bit that might be set prior to driver load. bosch,bno055 - Off by one channel buffer sizing. Benine due to padding prior to the subsequent timestamp. hid-sensors - A more complex fix to IRQF_ONESHOT warning as this driver had a trigger that was never actually used but the ABI that exposed had to be maintained to avoid regressions. hid-sensors-rotation - An obscure buffer alignment case that applies to quaternions only was recently broken resulting in writes beyond the end of the channel buffer. Add a new core macro and apply it in this driver to make it very clear what was going on. honeywell,abp2030pa - Remove meaningless IRQF_ONESHOT from a non threaded IRQ handler. Warning fix only. invense,mpu3050 - Fix token passed to free_irq() to match the one used at setup. - Fix an irq resource leak in error path. - Reorder probe so that userspace interfaces are exposed only after everything else has finished. - Reorder remove slightly to cleanup the buffer only after irq removed ensuring reverse of probe sequence. microchip,mcp47feb02 - Fix use of mutex before it was initialized by not performing unnecessary lock that was early enough in probe that all code was serial. st,lsm6dsx - Ensure that FIFO ODR is only controllable for accel and gyro channels avoiding incorrect register accesses. - Restrict separation of buffer sampling from main sampling rate to accelerometer. It is only useful for running event detection faster than the fifo and the only events are on the accelerometer. ti,ads1018 - Fix overflow of u8 which wasn't big enough to store max data rate value. ti,ads1119: - Fix unbalanced pm in an error path. - IRQF_ONESHOT (as no threaded handler) replaced with IRQF_NO_THREAD (needed for iio_trigger_poll()). - Ensure complete reinitialized before reuse. Previously it would have completed immediate after the first time. ti,ads7950 - Fix return value of gpio_get() to be 0 or 1. - Avoid accidental overwrite of state resulting in gpio_get() only returning 0 or -ERRNO but never 1. * tag 'iio-fixes-for-7.0b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (25 commits) iio: imu: adis16550: fix swapped gyro/accel filter functions iio: adc: aspeed: clear reference voltage bits before configuring vref iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() iio: adc: ti-ads1018: fix type overflow for data rate iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() iio: adc: ti-ads7950: normalize return value of gpio_get iio: orientation: hid-sensor-rotation: fix quaternion alignment iio: add IIO_DECLARE_QUATERNION() macro iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one iio: hid-sensors: Use software trigger iio: adc: ad4062: Replace IRQF_ONESHOT with IRQF_NO_THREAD iio: gyro: mpu3050: Fix out-of-sequence free_irq() iio: gyro: mpu3050: Move iio_device_register() to correct location iio: gyro: mpu3050: Fix irq resource leak iio: gyro: mpu3050: Fix incorrect free_irq() variable iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only iio: dac: mcp47feb02: Fix mutex used before initialization iio: adc: ade9000: fix wrong return type in streaming push ... commit 76dd7c74fd3935ff54e8960f36b4423baadcd760 Merge: f338e77383789c dbbd550d7c8d90 Author: Greg Kroah-Hartman Date: Sun Mar 29 14:47:30 2026 +0200 Merge tag 'icc-7.0-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus interconnect fix for v7.0-rc This contains one driver fix for the current cycle. - interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes() Signed-off-by: Georgi Djakov * tag 'icc-7.0-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes() commit 277c6960d4ddb94d16198afd70c92c3d4593d131 Author: Takashi Iwai Date: Sun Mar 29 11:12:38 2026 +0200 ALSA: ctxfi: Check the error for index mapping The ctxfi driver blindly assumed a proper value returned from daio_device_index(), but it's not always true. Add a proper error check to deal with the error from the function. Cc: Link: https://lore.kernel.org/87cy149n6k.wl-tiwai@suse.de Link: https://patch.msgid.link/20260329091240.420194-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit b045ab3dff97edae6d538eeff900a34c098761f8 Author: Takashi Iwai Date: Sun Mar 29 11:12:37 2026 +0200 ALSA: ctxfi: Fix missing SPDIFI1 index handling SPDIF1 DAIO type isn't properly handled in daio_device_index() for hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds array access. Follow the hw20k1 pattern and return the proper index for this type, too. Reported-and-tested-by: Karsten Hohmeier Closes: https://lore.kernel.org/20260315155004.15633-1-linux@hohmatik.de Cc: Link: https://patch.msgid.link/20260329091240.420194-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b51ad67773fbe9a03945843215b2cabffafa4084 Merge: 0bcb517f0a70ae 1c37d896b12dfd Author: Linus Torvalds Date: Sat Mar 28 15:23:03 2026 -0700 Merge tag 'for-7.0-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few more fixes. There's one that stands out in size as it fixes an edge case in fsync. - fix issue on fsync where file with zero size appears as a non-zero after log replay - in zlib compression, handle a crash when data alignment causes folio reference issues - fix possible crash with enabled tracepoints on a overlayfs mount - handle device stats update error - on zoned filesystems, fix kobject leak on sub-block groups - fix super block offset in an error message in validation" * tag 'for-7.0-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix lost error when running device stats on multiple devices fs btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() btrfs: zlib: handle page aligned compressed size correctly btrfs: fix leak of kobject name for sub-group space_info btrfs: fix zero size inode with non-zero size after log replay btrfs: fix super block offset in error message in btrfs_validate_super() commit 0bcb517f0a70ae4fc59ce87bd27573043416aa94 Merge: cbfffcca2bf062 2697dd8ae721db Author: Linus Torvalds Date: Sat Mar 28 14:19:55 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-03-28-10-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "10 hotfixes. 8 are cc:stable. 9 are for MM. There's a 3-patch series of DAMON fixes from Josh Law and SeongJae Park. The rest are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-03-28-10-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/mseal: update VMA end correctly on merge bug: avoid format attribute warning for clang as well mm/pagewalk: fix race between concurrent split and refault mm/memory: fix PMD/PUD checks in follow_pfnmap_start() mm/damon/sysfs: check contexts->nr in repeat_call_fn mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure mm/swap: fix swap cache memcg accounting MAINTAINERS, mailmap: update email address for Harry Yoo mm/huge_memory: fix folio isn't locked in softleaf_to_folio() commit b0faf733fc1cf7f198c299dcc1638571d7cfd0f7 Author: Wolfram Sang Date: Fri Mar 27 16:18:24 2026 +0100 MAINTAINERS: drop outdated I2C website As stated on the website: "This wiki has been archived and the content is no longer updated." No need to reference it. Signed-off-by: Wolfram Sang commit cbfffcca2bf0622b601b7eaf477aa29035169184 Merge: e522b75c44f580 250ab25391edee Author: Linus Torvalds Date: Sat Mar 28 09:59:09 2026 -0700 Merge tag 'trace-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix potential deadlock in osnoise and hotplug The interface_lock can be called by a osnoise thread and the CPU shutdown logic of osnoise can wait for this thread to finish. But cpus_read_lock() can also be taken while holding the interface_lock. This produces a circular lock dependency and can cause a deadlock. Swap the ordering of cpus_read_lock() and the interface_lock to have interface_lock taken within the cpus_read_lock() context to prevent this circular dependency. - Fix freeing of event triggers in early boot up If the same trigger is added on the kernel command line, the second one will fail to be applied and the trigger created will be freed. This calls into the deferred logic and creates a kernel thread to do the freeing. But the command line logic is called before kernel threads can be created and this leads to a NULL pointer dereference. Delay freeing event triggers until late init. * tag 'trace-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Drain deferred trigger frees if kthread creation fails tracing: Fix potential deadlock in cpu hotplug with osnoise commit e522b75c44f580ba8a58e8d9f263643c7936ddeb Merge: be762d8b6dd7ef 0738d395aab8fa Author: Linus Torvalds Date: Sat Mar 28 09:50:11 2026 -0700 Merge tag 's390-7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Add array_index_nospec() to syscall dispatch table lookup to prevent limited speculative out-of-bounds access with user-controlled syscall number - Mark array_index_mask_nospec() __always_inline since GCC may emit an out-of-line call instead of the inline data dependency sequence the mitigation relies on - Clear r12 on kernel entry to prevent potential speculative use of user value in system_call, ext/io/mcck interrupt handlers * tag 's390-7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/entry: Scrub r12 register on kernel entry s390/syscalls: Add spectre boundary for syscall dispatch table s390/barrier: Make array_index_mask_nospec() __always_inline commit 210d36d892de5195e6766c45519dfb1e65f3eb83 Author: Davidlohr Bueso Date: Wed Mar 25 17:17:59 2026 -0700 futex: Clear stale exiting pointer in futex_lock_pi() retry path Fuzzying/stressing futexes triggered: WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524 When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY and stores a refcounted task pointer in 'exiting'. After wait_for_owner_exiting() consumes that reference, the local pointer is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a different error, the bogus pointer is passed to wait_for_owner_exiting(). CPU0 CPU1 CPU2 futex_lock_pi(uaddr) // acquires the PI futex exit() futex_cleanup_begin() futex_state = EXITING; futex_lock_pi(uaddr) futex_lock_pi_atomic() attach_to_pi_owner() // observes EXITING *exiting = owner; // takes ref return -EBUSY wait_for_owner_exiting(-EBUSY, owner) put_task_struct(); // drops ref // exiting still points to owner goto retry; futex_lock_pi_atomic() lock_pi_update_atomic() cmpxchg(uaddr) *uaddr ^= WAITERS // whatever // value changed return -EAGAIN; wait_for_owner_exiting(-EAGAIN, exiting) // stale WARN_ON_ONCE(exiting) Fix this by resetting upon retry, essentially aligning it with requeue_pi. Fixes: 3ef240eaff36 ("futex: Prevent exit livelock") Signed-off-by: Davidlohr Bueso Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260326001759.4129680-1-dave@stgolabs.net commit 250ab25391edeeab8462b68be42e4904506c409c Author: Wesley Atwell Date: Tue Mar 24 16:13:26 2026 -0600 tracing: Drain deferred trigger frees if kthread creation fails Boot-time trigger registration can fail before the trigger-data cleanup kthread exists. Deferring those frees until late init is fine, but the post-boot fallback must still drain the deferred list if kthread creation never succeeds. Otherwise, boot-deferred nodes can accumulate on trigger_data_free_list, later frees fall back to synchronously freeing only the current object, and the older queued entries are leaked forever. To trigger this, add the following to the kernel command line: trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon The second traceon trigger will fail and be freed. This triggers a NULL pointer dereference and crashes the kernel. Keep the deferred boot-time behavior, but when kthread creation fails, drain the whole queued list synchronously. Do the same in the late-init drain path so queued entries are not stranded there either. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260324221326.1395799-3-atwellwea@gmail.com Fixes: 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data") Signed-off-by: Wesley Atwell Signed-off-by: Steven Rostedt (Google) commit 1fbf85dbf02c96c318e056fb5b8fc614758fee3c Author: Sourav Nayak Date: Fri Mar 27 19:58:05 2026 +0530 ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx This adds a mute led quirck for HP Victus 15-fb0xxx (103c:8a3d) model - As it used 0x8(full bright)/0x7f(little dim) for mute led on and other values as 0ff (0x0, 0x4, ...) - So, use ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT insted for safer approach Cc: Signed-off-by: Sourav Nayak Link: https://patch.msgid.link/20260327142805.17139-1-nonameblank007@gmail.com Signed-off-by: Takashi Iwai commit 696b0a9bd2e4b4c7082369202fe9406345a6d11e Author: Stuart Hayhurst Date: Fri Mar 27 15:57:36 2026 +0000 ALSA: hda/intel: Add MSI X870E Tomahawk to denylist by DMI ID This motherboard uses USB audio instead, causing this driver to complain about "no codecs found!". Add it to the denylist to silence the warning. The first attempt only matched on the PCI device, but this caused issues for some laptops, so DMI match against the board as well. Signed-off-by: Stuart Hayhurst Link: https://patch.msgid.link/20260327155737.21818-2-stuart.a.hayhurst@gmail.com Signed-off-by: Takashi Iwai commit bac1e57adf08c9ee33e95fb09cd032f330294e70 Author: Dustin L. Howett Date: Fri Mar 27 10:54:40 2026 -0500 ALSA: hda/realtek: add quirk for Framework F111:000F Similar to commit 7b509910b3ad ("ALSA hda/realtek: Add quirk for Framework F111:000C") and previous quirks for Framework systems with Realtek codecs. 000F is another new platform with an ALC285 which needs the same quirk. Signed-off-by: Dustin L. Howett Link: https://patch.msgid.link/20260327-framework-alsa-000f-v1-1-74013aba1c00@howett.net Signed-off-by: Takashi Iwai commit bc5b4e5ae1a67700a618328217b6a3bd0f296e97 Author: Phil Willoughby Date: Sat Mar 28 08:07:34 2026 +0000 ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex The NeuralDSP Quad Cortex does not support DSD playback. We need this product-specific entry with zero quirks because otherwise it falls through to the vendor-specific entry which marks it as supporting DSD playback. Cc: Yue Wang Cc: Jaroslav Kysela Cc: Takashi Iwai Signed-off-by: Phil Willoughby Link: https://patch.msgid.link/20260328080921.3310-1-willerz@gmail.com Signed-off-by: Takashi Iwai commit dc9e9d61e301c087bcd990dbf2fa18ad3e2e1429 Merge: eeee5a710f26ce a142d139168cce Author: Jakub Kicinski Date: Fri Mar 27 20:56:49 2026 -0700 Merge branch 'net-enetc-add-more-checks-to-enetc_set_rxfh' Wei Fang says: ==================== net: enetc: add more checks to enetc_set_rxfh() ENETC only supports Toeplitz algorithm, and VFs do not support setting the RSS key, but enetc_set_rxfh() does not check these constraints and silently accepts unsupported configurations. This may mislead users or tools into believing that the requested RSS settings have been successfully applied. So add checks to reject unsupported hash functions and RSS key updates on VFs, and return "-EOPNOTSUPP" to user space. ==================== Link: https://patch.msgid.link/20260326075233.3628047-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit a142d139168cce8d5776245b5494c7f7f5d7fb7d Author: Wei Fang Date: Thu Mar 26 15:52:33 2026 +0800 net: enetc: do not allow VF to configure the RSS key VFs do not have privilege to configure the RSS key because the registers are owned by the PF. Currently, if VF attempts to configure the RSS key, enetc_set_rxfh() simply skips the configuration and does not generate a warning, which may mislead users into thinking the feature is supported. To improve this situation, add a check to reject RSS key configuration on VFs. Fixes: d382563f541b ("enetc: Add RFS and RSS support") Signed-off-by: Wei Fang Reviewed-by: Clark Wang Reviewed-by: Claudiu Manoil Link: https://patch.msgid.link/20260326075233.3628047-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit d389954a6cae7bf76b7b082ac3511d177b77ef2d Author: Wei Fang Date: Thu Mar 26 15:52:32 2026 +0800 net: enetc: check whether the RSS algorithm is Toeplitz Both ENETC v1 and v4 only provide Toeplitz RSS support. This patch adds a validation check to reject attempts to configure other RSS algorithms, avoiding misleading configuration options for users. Fixes: d382563f541b ("enetc: Add RFS and RSS support") Signed-off-by: Wei Fang Reviewed-by: Clark Wang Reviewed-by: Claudiu Manoil Link: https://patch.msgid.link/20260326075233.3628047-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit eeee5a710f26ce57807024ef330fe5a850eaecd8 Author: Marek Behún Date: Thu Mar 26 13:20:38 2026 +0100 net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta In commit 8110633db49d7de2 ("net: sfp-bus: allow SFP quirks to override Autoneg and pause bits") we moved the setting of Autoneg and pause bits before the call to SFP quirk when parsing SFP module support. Since the quirk for Ubiquiti U-Fiber Instant SFP module zeroes the support bits and sets 1000baseX_Full only, the above mentioned commit changed the overall computed support from 1000baseX_Full, Autoneg, Pause, Asym_Pause to just 1000baseX_Full. This broke the SFP module for mvneta, which requires Autoneg for 1000baseX since commit c762b7fac1b249a9 ("net: mvneta: deny disabling autoneg for 802.3z modes"). Fix this by setting back the Autoneg, Pause and Asym_Pause bits in the quirk. Fixes: 8110633db49d7de2 ("net: sfp-bus: allow SFP quirks to override Autoneg and pause bits") Signed-off-by: Marek Behún Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260326122038.2489589-1-kabel@kernel.org Signed-off-by: Jakub Kicinski commit 2697dd8ae721db4f6a53d4f4cbd438212a80f8dc Author: Lorenzo Stoakes (Oracle) Date: Fri Mar 27 17:31:04 2026 +0000 mm/mseal: update VMA end correctly on merge Previously we stored the end of the current VMA in curr_end, and then upon iterating to the next VMA updated curr_start to curr_end to advance to the next VMA. However, this doesn't take into account the fact that a VMA might be updated due to a merge by vma_modify_flags(), which can result in curr_end being stale and thus, upon setting curr_start to curr_end, ending up with an incorrect curr_start on the next iteration. Resolve the issue by setting curr_end to vma->vm_end unconditionally to ensure this value remains updated should this occur. While we're here, eliminate this entire class of bug by simply setting const curr_[start/end] to be clamped to the input range and VMAs, which also happens to simplify the logic. Link: https://lkml.kernel.org/r/20260327173104.322405-1-ljs@kernel.org Fixes: 6c2da14ae1e0 ("mm/mseal: rework mseal apply logic") Signed-off-by: Lorenzo Stoakes (Oracle) Reported-by: Antonius Closes: https://lore.kernel.org/linux-mm/CAK8a0jwWGj9-SgFk0yKFh7i8jMkwKm5b0ao9=kmXWjO54veX2g@mail.gmail.com/ Suggested-by: David Hildenbrand (ARM) Acked-by: Vlastimil Babka (SUSE) Reviewed-by: Pedro Falcato Acked-by: David Hildenbrand (Arm) Cc: Jann Horn Cc: Jeff Xu Cc: Liam Howlett Cc: Signed-off-by: Andrew Morton commit 2598ab9d63f41160c7081998857fef409182933d Author: Arnd Bergmann Date: Mon Mar 23 21:55:16 2026 +0100 bug: avoid format attribute warning for clang as well Like gcc, clang-22 now also warns about a function that it incorrectly identifies as a printf-style format: lib/bug.c:190:22: error: diagnostic behavior may be improved by adding the 'format(printf, 1, 0)' attribute to the declaration of '__warn_printf' [-Werror,-Wmissing-format-attribute] 179 | static void __warn_printf(const char *fmt, struct pt_regs *regs) | __attribute__((format(printf, 1, 0))) 180 | { 181 | if (!fmt) 182 | return; 183 | 184 | #ifdef HAVE_ARCH_BUG_FORMAT_ARGS 185 | if (regs) { 186 | struct arch_va_list _args; 187 | va_list *args = __warn_args(&_args, regs); 188 | 189 | if (args) { 190 | vprintk(fmt, *args); | ^ Revert the change that added a gcc-specific workaround, and instead add the generic annotation that avoid the warning. Link: https://lkml.kernel.org/r/20260323205534.1284284-1-arnd@kernel.org Fixes: d36067d6ea00 ("bug: Hush suggest-attribute=format for __warn_printf()") Suggested-by: Andy Shevchenko Suggested-by: Brendan Jackman Link: https://lore.kernel.org/all/20251208141618.2805983-1-andriy.shevchenko@linux.intel.com/T/#u Signed-off-by: Arnd Bergmann Reviewed-by: Brendan Jackman Reviewed-by: Andy Shevchenko Cc: Bill Wendling Cc: Ingo Molnar Cc: Justin Stitt Cc: Nathan Chancellor Cc: Peter Zijlstra Signed-off-by: Andrew Morton commit 3b89863c3fa482912911cd65a12a3aeef662c250 Author: Max Boone Date: Wed Mar 25 10:59:16 2026 +0100 mm/pagewalk: fix race between concurrent split and refault The splitting of a PUD entry in walk_pud_range() can race with a concurrent thread refaulting the PUD leaf entry causing it to try walking a PMD range that has disappeared. An example and reproduction of this is to try reading numa_maps of a process while VFIO-PCI is setting up DMA (specifically the vfio_pin_pages_remote call) on a large BAR for that process. This will trigger a kernel BUG: vfio-pci 0000:03:00.0: enabling device (0000 -> 0002) BUG: unable to handle page fault for address: ffffa23980000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI ... RIP: 0010:walk_pgd_range+0x3b5/0x7a0 Code: 8d 43 ff 48 89 44 24 28 4d 89 ce 4d 8d a7 00 00 20 00 48 8b 4c 24 28 49 81 e4 00 00 e0 ff 49 8d 44 24 ff 48 39 c8 4c 0f 43 e3 <49> f7 06 9f ff ff ff 75 3b 48 8b 44 24 20 48 8b 40 28 48 85 c0 74 RSP: 0018:ffffac23e1ecf808 EFLAGS: 00010287 RAX: 00007f44c01fffff RBX: 00007f4500000000 RCX: 00007f44ffffffff RDX: 0000000000000000 RSI: 000ffffffffff000 RDI: ffffffff93378fe0 RBP: ffffac23e1ecf918 R08: 0000000000000004 R09: ffffa23980000000 R10: 0000000000000020 R11: 0000000000000004 R12: 00007f44c0200000 R13: 00007f44c0000000 R14: ffffa23980000000 R15: 00007f44c0000000 FS: 00007fe884739580(0000) GS:ffff9b7d7a9c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa23980000000 CR3: 000000c0650e2005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: __walk_page_range+0x195/0x1b0 walk_page_vma+0x62/0xc0 show_numa_map+0x12b/0x3b0 seq_read_iter+0x297/0x440 seq_read+0x11d/0x140 vfs_read+0xc2/0x340 ksys_read+0x5f/0xe0 do_syscall_64+0x68/0x130 ? get_page_from_freelist+0x5c2/0x17e0 ? mas_store_prealloc+0x17e/0x360 ? vma_set_page_prot+0x4c/0xa0 ? __alloc_pages_noprof+0x14e/0x2d0 ? __mod_memcg_lruvec_state+0x8d/0x140 ? __lruvec_stat_mod_folio+0x76/0xb0 ? __folio_mod_stat+0x26/0x80 ? do_anonymous_page+0x705/0x900 ? __handle_mm_fault+0xa8d/0x1000 ? __count_memcg_events+0x53/0xf0 ? handle_mm_fault+0xa5/0x360 ? do_user_addr_fault+0x342/0x640 ? arch_exit_to_user_mode_prepare.constprop.0+0x16/0xa0 ? irqentry_exit_to_user_mode+0x24/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe88464f47e Code: c0 e9 b6 fe ff ff 50 48 8d 3d be 07 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28 RSP: 002b:00007ffe6cd9a9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fe88464f47e RDX: 0000000000020000 RSI: 00007fe884543000 RDI: 0000000000000003 RBP: 00007fe884543000 R08: 00007fe884542010 R09: 0000000000000000 R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 Fix this by validating the PUD entry in walk_pmd_range() using a stable snapshot (pudp_get()). If the PUD is not present or is a leaf, retry the walk via ACTION_AGAIN instead of descending further. This mirrors the retry logic in walk_pte_range(), which lets walk_pmd_range() retry if the PTE is not being got by pte_offset_map_lock(). Link: https://lkml.kernel.org/r/20260325-pagewalk-check-pmd-refault-v2-1-707bff33bc60@akamai.com Fixes: f9e54c3a2f5b ("vfio/pci: implement huge_fault support") Co-developed-by: David Hildenbrand (Arm) Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Max Boone Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit ffef67b93aa352b34e6aeba3d52c19a63885409a Author: David Hildenbrand (Arm) Date: Mon Mar 23 21:20:18 2026 +0100 mm/memory: fix PMD/PUD checks in follow_pfnmap_start() follow_pfnmap_start() suffers from two problems: (1) We are not re-fetching the pmd/pud after taking the PTL Therefore, we are not properly stabilizing what the lock actually protects. If there is concurrent zapping, we would indicate to the caller that we found an entry, however, that entry might already have been invalidated, or contain a different PFN after taking the lock. Properly use pmdp_get() / pudp_get() after taking the lock. (2) pmd_leaf() / pud_leaf() are not well defined on non-present entries pmd_leaf()/pud_leaf() could wrongly trigger on non-present entries. There is no real guarantee that pmd_leaf()/pud_leaf() returns something reasonable on non-present entries. Most architectures indeed either perform a present check or make it work by smart use of flags. However, for example loongarch checks the _PAGE_HUGE flag in pmd_leaf(), and always sets the _PAGE_HUGE flag in __swp_entry_to_pmd(). Whereby pmd_trans_huge() explicitly checks pmd_present(), pmd_leaf() does not do that. Let's check pmd_present()/pud_present() before assuming "the is a present PMD leaf" when spotting pmd_leaf()/pud_leaf(), like other page table handling code that traverses user page tables does. Given that non-present PMD entries are likely rare in VM_IO|VM_PFNMAP, (1) is likely more relevant than (2). It is questionable how often (1) would actually trigger, but let's CC stable to be sure. This was found by code inspection. Link: https://lkml.kernel.org/r/20260323-follow_pfnmap_fix-v1-1-5b0ec10872b3@kernel.org Fixes: 6da8e9634bb7 ("mm: new follow_pfnmap API") Signed-off-by: David Hildenbrand (Arm) Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Liam Howlett Cc: Michal Hocko Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 6557004a8b59c7701e695f02be03c7e20ed1cc15 Author: Josh Law Date: Sat Mar 21 10:54:26 2026 -0700 mm/damon/sysfs: check contexts->nr in repeat_call_fn damon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(), damon_sysfs_upd_schemes_stats(), and damon_sysfs_upd_schemes_effective_quotas() without checking contexts->nr. If nr_contexts is set to 0 via sysfs while DAMON is running, these functions dereference contexts_arr[0] and cause a NULL pointer dereference. Add the missing check. For example, the issue can be reproduced using DAMON sysfs interface and DAMON user-space tool (damo) [1] like below. $ sudo damo start --refresh_interval 1s $ echo 0 | sudo tee \ /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts Link: https://patch.msgid.link/20260320163559.178101-3-objecting@objecting.org Link: https://lkml.kernel.org/r/20260321175427.86000-4-sj@kernel.org Link: https://github.com/damonitor/damo [1] Fixes: d809a7c64ba8 ("mm/damon/sysfs: implement refresh_ms file internal work") Signed-off-by: Josh Law Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Cc: [6.17+] Signed-off-by: Andrew Morton commit 1bfe9fb5ed2667fb075682408b776b5273162615 Author: Josh Law Date: Sat Mar 21 10:54:25 2026 -0700 mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Multiple sysfs command paths dereference contexts_arr[0] without first verifying that kdamond->contexts->nr == 1. A user can set nr_contexts to 0 via sysfs while DAMON is running, causing NULL pointer dereferences. In more detail, the issue can be triggered by privileged users like below. First, start DAMON and make contexts directory empty (kdamond->contexts->nr == 0). # damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/nr_contexts Then, each of below commands will cause the NULL pointer dereference. # echo update_schemes_stats > state # echo update_schemes_tried_regions > state # echo update_schemes_tried_bytes > state # echo update_schemes_effective_quotas > state # echo update_tuned_intervals > state Guard all commands (except OFF) at the entry point of damon_sysfs_handle_cmd(). Link: https://lkml.kernel.org/r/20260321175427.86000-3-sj@kernel.org Fixes: 0ac32b8affb5 ("mm/damon/sysfs: support DAMOS stats") Signed-off-by: Josh Law Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Cc: [5.18+] Signed-off-by: Andrew Morton commit 7fe000eb32904758a85e62f6ea9483f89d5dabfc Author: Josh Law Date: Sat Mar 21 10:54:24 2026 -0700 mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure Patch series "mm/damon/sysfs: fix memory leak and NULL dereference issues", v4. DAMON_SYSFS can leak memory under allocation failure, and do NULL pointer dereference when a privileged user make wrong sequences of control. Fix those. This patch (of 3): When damon_sysfs_new_test_ctx() fails in damon_sysfs_commit_input(), param_ctx is leaked because the early return skips the cleanup at the out label. Destroy param_ctx before returning. Link: https://lkml.kernel.org/r/20260321175427.86000-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260321175427.86000-2-sj@kernel.org Fixes: f0c5118ebb0e ("mm/damon/sysfs: catch commit test ctx alloc failure") Signed-off-by: Josh Law Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Cc: [6.18+] Signed-off-by: Andrew Morton commit 9e0d0ddfbc0e3491da7e2db73faa08d8d4f322b2 Author: Alexandre Ghiti Date: Fri Mar 20 06:05:59 2026 +0100 mm/swap: fix swap cache memcg accounting The swap readahead path was recently refactored and while doing this, the order between the charging of the folio in the memcg and the addition of the folio in the swap cache was inverted. Since the accounting of the folio is done while adding the folio to the swap cache and the folio is not charged in the memcg yet, the accounting is then done at the node level, which is wrong. Fix this by charging the folio in the memcg before adding it to the swap cache. Link: https://lkml.kernel.org/r/20260320050601.1833108-1-alex@ghiti.fr Fixes: 2732acda82c9 ("mm, swap: use swap cache as the swap in synchronize layer") Signed-off-by: Alexandre Ghiti Acked-by: Kairui Song Acked-by: Johannes Weiner Reviewed-by: Nhat Pham Acked-by: Chris Li Cc: Alexandre Ghiti Cc: Baoquan He Cc: Barry Song Cc: Kemeng Shi Cc: Signed-off-by: Andrew Morton commit 26d3dca201f3662e51d25022cfce0f642a150a90 Author: Harry Yoo (Oracle) Date: Fri Mar 20 21:59:25 2026 +0900 MAINTAINERS, mailmap: update email address for Harry Yoo Update my email address to harry@kernel.org. Link: https://lkml.kernel.org/r/20260320125925.2259998-1-harry@kernel.org Signed-off-by: Harry Yoo (Oracle) Signed-off-by: Andrew Morton commit 4c5e7f0fcd592801c9cc18f29f80fbee84eb8669 Author: Jinjiang Tu Date: Thu Mar 19 09:25:41 2026 +0800 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held. This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang@huawei.com: update function name and comments] Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") Signed-off-by: Jinjiang Tu Acked-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Barry Song Cc: Kefeng Wang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 5d17af9eb2dd3de6846ed344c883de7812e6cc09 Author: Xiang Mei Date: Thu Mar 26 13:43:10 2026 -0700 selftests/tc-testing: add test for HFSC divide-by-zero in rtsc_min() Add a regression test for the divide-by-zero in rtsc_min() triggered when m2sm() converts a large m1 value (e.g. 32gbit) to a u64 scaled slope reaching 2^32. rtsc_min() stores the difference of two such u64 values (sm1 - sm2) in a u32 variable `dsm`, truncating 2^32 to zero and causing a divide-by-zero oops in the concave-curve intersection path. The test configures an HFSC class with m1=32gbit d=1ms m2=0bit, sends a packet to activate the class, waits for it to drain and go idle, then sends another packet to trigger reactivation through rtsc_min(). Signed-off-by: Xiang Mei Acked-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Link: https://patch.msgid.link/20260326204310.1549327-2-xmei5@asu.edu Signed-off-by: Jakub Kicinski commit 4576100b8cd03118267513cafacde164b498b322 Author: Xiang Mei Date: Thu Mar 26 13:43:09 2026 -0700 net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() m2sm() converts a u32 slope to a u64 scaled value. For large inputs (e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores the difference of two such u64 values in a u32 variable `dsm` and uses it as a divisor. When the difference is exactly 2^32 the truncation yields zero, causing a divide-by-zero oops in the concave-curve intersection path: Oops: divide error: 0000 RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601) Call Trace: init_ed (net/sched/sch_hfsc.c:629) hfsc_enqueue (net/sched/sch_hfsc.c:1569) [...] Widen `dsm` to u64 and replace do_div() with div64_u64() so the full difference is preserved. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260326204310.1549327-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski commit 9ee29d20aab228adfb02ca93f87fb53c56c2f3af Author: Theodore Ts'o Date: Fri Mar 27 02:13:15 2026 -0400 ext4: always drain queued discard work in ext4_mb_release() While reviewing recent ext4 patch[1], Sashiko raised the following concern[2]: > If the filesystem is initially mounted with the discard option, > deleting files will populate sbi->s_discard_list and queue > s_discard_work. If it is then remounted with nodiscard, the > EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is > neither cancelled nor flushed. [1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/ [2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev The concern was valid, but it had nothing to do with the patch[1]. One of the problems with Sashiko in its current (early) form is that it will detect pre-existing issues and report it as a problem with the patch that it is reviewing. In practice, it would be hard to hit deliberately (unless you are a malicious syzkaller fuzzer), since it would involve mounting the file system with -o discard, and then deleting a large number of files, remounting the file system with -o nodiscard, and then immediately unmounting the file system before the queued discard work has a change to drain on its own. Fix it because it's a real bug, and to avoid Sashiko from raising this concern when analyzing future patches to mballoc.c. Signed-off-by: Theodore Ts'o Fixes: 55cdd0af2bc5 ("ext4: get discard out of jbd2 commit kthread contex") Cc: stable@kernel.org commit bb81702370fad22c06ca12b6e1648754dbc37e0f Author: Theodore Ts'o Date: Thu Mar 26 00:58:34 2026 -0400 ext4: handle wraparound when searching for blocks for indirect mapped blocks Commit 4865c768b563 ("ext4: always allocate blocks only from groups inode can use") restricts what blocks will be allocated for indirect block based files to block numbers that fit within 32-bit block numbers. However, when using a review bot running on the latest Gemini LLM to check this commit when backporting into an LTS based kernel, it raised this concern: If ac->ac_g_ex.fe_group is >= ngroups (for instance, if the goal group was populated via stream allocation from s_mb_last_groups), then start will be >= ngroups. Does this allow allocating blocks beyond the 32-bit limit for indirect block mapped files? The commit message mentions that ext4_mb_scan_groups_linear() takes care to not select unsupported groups. However, its loop uses group = *start, and the very first iteration will call ext4_mb_scan_group() with this unsupported group because next_linear_group() is only called at the end of the iteration. After reviewing the code paths involved and considering the LLM review, I determined that this can happen when there is a file system where some files/directories are extent-mapped and others are indirect-block mapped. To address this, add a safety clamp in ext4_mb_scan_groups(). Fixes: 4865c768b563 ("ext4: always allocate blocks only from groups inode can use") Cc: Jan Kara Reviewed-by: Baokun Li Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Link: https://patch.msgid.link/20260326045834.1175822-1-tytso@mit.edu Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 3ceda17325fc2600f66fd85b526592bc8a9dfb9d Author: hongao Date: Tue Mar 24 09:58:15 2026 +0800 ext4: skip split extent recovery on corruption ext4_split_extent_at() retries after ext4_ext_insert_extent() fails by refinding the original extent and restoring its length. That recovery is only safe for transient resource failures such as -ENOSPC, -EDQUOT, and -ENOMEM. When ext4_ext_insert_extent() fails because the extent tree is already corrupted, ext4_find_extent() can return a leaf path without p_ext. ext4_split_extent_at() then dereferences path[depth].p_ext while trying to fix up the original extent length, causing a NULL pointer dereference while handling a pre-existing filesystem corruption. Do not enter the recovery path for corruption errors, and validate p_ext after refinding the extent before touching it. This keeps the recovery path limited to cases it can actually repair and turns the syzbot-triggered crash into a proper corruption report. Fixes: 716b9c23b862 ("ext4: refactor split and convert extents") Reported-by: syzbot+1ffa5d865557e51cb604@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1ffa5d865557e51cb604 Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Signed-off-by: hongao Link: https://patch.msgid.link/EF77870F23FF9C90+20260324015815.35248-1-hongao@uniontech.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit ec0a7500d8eace5b4f305fa0c594dd148f0e8d29 Author: Baokun Li Date: Mon Mar 23 14:08:36 2026 +0800 ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths During code review, Joseph found that ext4_fc_replay_inode() calls ext4_get_fc_inode_loc() to get the inode location, which holds a reference to iloc.bh that must be released via brelse(). However, several error paths jump to the 'out' label without releasing iloc.bh: - ext4_handle_dirty_metadata() failure - sync_dirty_buffer() failure - ext4_mark_inode_used() failure - ext4_iget() failure Fix this by introducing an 'out_brelse' label placed just before the existing 'out' label to ensure iloc.bh is always released. Additionally, make ext4_fc_replay_inode() propagate errors properly instead of always returning 0. Reported-by: Joseph Qi Fixes: 8016e29f4362 ("ext4: fast commit recovery path") Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260323060836.3452660-1-libaokun@linux.alibaba.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 0c90eed1b95335eba4f546e6742a8e4503d79349 Author: Jan Kara Date: Fri Mar 20 10:04:29 2026 +0100 ext4: fix deadlock on inode reallocation Currently there is a race in ext4 when reallocating freed inode resulting in a deadlock: Task1 Task2 ext4_evict_inode() handle = ext4_journal_start(); ... if (IS_SYNC(inode)) handle->h_sync = 1; ext4_free_inode() ext4_new_inode() handle = ext4_journal_start() finds the bit in inode bitmap already clear insert_inode_locked() waits for inode to be removed from the hash. ext4_journal_stop(handle) jbd2_journal_stop(handle) jbd2_log_wait_commit(journal, tid); - deadlocks waiting for transaction handle Task2 holds Fix the problem by removing inode from the hash already in ext4_clear_inode() by which time all IO for the inode is done so reuse is already fine but we are still before possibly blocking on transaction commit. Reported-by: "Lai, Yi" Link: https://lore.kernel.org/all/abNvb2PcrKj1FBeC@ly-workstation Fixes: 88ec797c4680 ("fs: make insert_inode_locked() wait for inode destruction") CC: stable@vger.kernel.org Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260320090428.24899-2-jack@suse.cz Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit d15e4b0a418537aafa56b2cb80d44add83e83697 Author: Jiayuan Chen Date: Thu Mar 19 20:03:35 2026 +0800 ext4: fix use-after-free in update_super_work when racing with umount Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups reads during unmount. However, this introduced a use-after-free because update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which accesses the kobject's kernfs_node after it has been freed by kobject_del() in ext4_unregister_sysfs(): update_super_work ext4_put_super ----------------- -------------- ext4_unregister_sysfs(sb) kobject_del(&sbi->s_kobj) __kobject_del() sysfs_remove_dir() kobj->sd = NULL sysfs_put(sd) kernfs_put() // RCU free ext4_notify_error_sysfs(sbi) sysfs_notify(&sbi->s_kobj) kn = kobj->sd // stale pointer kernfs_get(kn) // UAF on freed kernfs_node ext4_journal_destroy() flush_work(&sbi->s_sb_upd_work) Instead of reordering the teardown sequence, fix this by making ext4_notify_error_sysfs() detect that sysfs has already been torn down by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call in that case. A dedicated mutex (s_error_notify_mutex) serializes ext4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs() to prevent TOCTOU races where the kobject could be deleted between the state_in_sysfs check and the sysfs_notify() call. Fixes: b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem") Cc: Jiayuan Chen Suggested-by: Jan Kara Signed-off-by: Jiayuan Chen Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260319120336.157873-1-jiayuan.chen@linux.dev Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 1a6fdb351837da72e0521ed10d367f16d928cc1c Merge: c11c731a684e5e afa9a05e6c4971 Author: Jakub Kicinski Date: Fri Mar 27 20:37:16 2026 -0700 Merge branch 'bridge-vxlan-harden-nd-option-parsing-paths' Yang Yang says: ==================== bridge/vxlan: harden ND option parsing paths This series hardens ND option parsing in bridge and vxlan paths. Patch 1 linearizes the request skb in br_nd_send() before walking ND options. Patch 2 adds explicit ND option length validation in br_nd_send(). Patch 3 adds matching ND option length validation in vxlan_na_create(). ==================== Link: https://patch.msgid.link/20260326034441.2037420-1-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski commit afa9a05e6c4971bd5586f1b304e14d61fb3d9385 Author: Yang Yang Date: Thu Mar 26 03:44:41 2026 +0000 vxlan: validate ND option lengths in vxlan_na_create vxlan_na_create() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address. Fixes: 4b29dba9c085 ("vxlan: fix nonfunctional neigh_reduce()") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Tested-by: Ao Zhou Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Yang Yang Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260326034441.2037420-4-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski commit 850837965af15707fd3142c1cf3c5bfaf022299b Author: Yang Yang Date: Thu Mar 26 03:44:40 2026 +0000 bridge: br_nd_send: validate ND option lengths br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address. Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Tested-by: Ao Zhou Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Yang Yang Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260326034441.2037420-3-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski commit a01aee7cafc575bb82f5529e8734e7052f9b16ea Author: Yang Yang Date: Thu Mar 26 03:44:39 2026 +0000 bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header. Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports") Reported-by: Yifan Wu Reported-by: Juefei Pu Tested-by: Ao Zhou Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Yang Yang Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260326034441.2037420-2-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski commit 496bb99b7e66f48b178126626f47e9ba79e2d0fa Author: Zqiang Date: Thu Mar 19 17:45:45 2026 +0800 ext4: fix the might_sleep() warnings in kvfree() Use the kvfree() in the RCU read critical section can trigger the following warnings: EXT4-fs (vdb): unmounting filesystem cd983e5b-3c83-4f5a-a136-17b00eb9d018. WARNING: suspicious RCU usage ./include/linux/rcupdate.h:409 Illegal context switch in RCU read-side critical section! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 Call Trace: dump_stack_lvl+0xbb/0xd0 dump_stack+0x14/0x20 lockdep_rcu_suspicious+0x15a/0x1b0 __might_resched+0x375/0x4d0 ? put_object.part.0+0x2c/0x50 __might_sleep+0x108/0x160 vfree+0x58/0x910 ? ext4_group_desc_free+0x27/0x270 kvfree+0x23/0x40 ext4_group_desc_free+0x111/0x270 ext4_put_super+0x3c8/0xd40 generic_shutdown_super+0x14c/0x4a0 ? __pfx_shrinker_free+0x10/0x10 kill_block_super+0x40/0x90 ext4_kill_sb+0x6d/0xb0 deactivate_locked_super+0xb4/0x180 deactivate_super+0x7e/0xa0 cleanup_mnt+0x296/0x3e0 __cleanup_mnt+0x16/0x20 task_work_run+0x157/0x250 ? __pfx_task_work_run+0x10/0x10 ? exit_to_user_mode_loop+0x6a/0x550 exit_to_user_mode_loop+0x102/0x550 do_syscall_64+0x44a/0x500 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: sleeping function called from invalid context at mm/vmalloc.c:3441 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556, name: umount preempt_count: 1, expected: 0 CPU: 3 UID: 0 PID: 556 Comm: umount Call Trace: dump_stack_lvl+0xbb/0xd0 dump_stack+0x14/0x20 __might_resched+0x275/0x4d0 ? put_object.part.0+0x2c/0x50 __might_sleep+0x108/0x160 vfree+0x58/0x910 ? ext4_group_desc_free+0x27/0x270 kvfree+0x23/0x40 ext4_group_desc_free+0x111/0x270 ext4_put_super+0x3c8/0xd40 generic_shutdown_super+0x14c/0x4a0 ? __pfx_shrinker_free+0x10/0x10 kill_block_super+0x40/0x90 ext4_kill_sb+0x6d/0xb0 deactivate_locked_super+0xb4/0x180 deactivate_super+0x7e/0xa0 cleanup_mnt+0x296/0x3e0 __cleanup_mnt+0x16/0x20 task_work_run+0x157/0x250 ? __pfx_task_work_run+0x10/0x10 ? exit_to_user_mode_loop+0x6a/0x550 exit_to_user_mode_loop+0x102/0x550 do_syscall_64+0x44a/0x500 entry_SYSCALL_64_after_hwframe+0x77/0x7f The above scenarios occur in initialization failures and teardown paths, there are no parallel operations on the resources released by kvfree(), this commit therefore remove rcu_read_lock/unlock() and use rcu_access_pointer() instead of rcu_dereference() operations. Fixes: 7c990728b99e ("ext4: fix potential race between s_flex_groups online resizing and access") Fixes: df3da4ea5a0f ("ext4: fix potential race between s_group_info online resizing and access") Signed-off-by: Zqiang Reviewed-by: Baokun Li Link: https://patch.msgid.link/20260319094545.19291-1-qiang.zhang@linux.dev Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 3822743dc20386d9897e999dbb990befa3a5b3f8 Author: Helen Koike Date: Tue Mar 17 11:23:10 2026 -0300 ext4: reject mount if bigalloc with s_first_data_block != 0 bigalloc with s_first_data_block != 0 is not supported, reject mounting it. Signed-off-by: Helen Koike Suggested-by: Theodore Ts'o Reported-by: syzbot+b73703b873a33d8eb8f6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b73703b873a33d8eb8f6 Link: https://patch.msgid.link/20260317142325.135074-1-koike@igalia.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 9e1b14320b154094bb2c1bee6d8c6cb851fc3215 Author: Ye Bin Date: Sat Mar 14 15:52:58 2026 +0800 ext4: fix extents-test.c is not compiled when EXT4_KUNIT_TESTS=M Now, only EXT4_KUNIT_TESTS=Y testcase will be compiled in 'extents.c'. To solve this issue, the ext4 test code needs to be decoupled. The 'extents-test' module is compiled into 'ext4-test' module. Fixes: cb1e0c1d1fad ("ext4: kunit tests for extent splitting and conversion") Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260314075258.1317579-4-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit 519b76ac0b31d86b45784735d4ef964e8efdc56b Author: Ye Bin Date: Sat Mar 14 15:52:57 2026 +0800 ext4: fix mballoc-test.c is not compiled when EXT4_KUNIT_TESTS=M Now, only EXT4_KUNIT_TESTS=Y testcase will be compiled in 'mballoc.c'. To solve this issue, the ext4 test code needs to be decoupled. The ext4 test module is compiled into a separate module. Reported-by: ChenXiaoSong Closes: https://patchwork.kernel.org/project/cifs-client/patch/20260118091313.1988168-2-chenxiaosong.chenxiaosong@linux.dev/ Fixes: 7c9fa399a369 ("ext4: add first unit test for ext4_mb_new_blocks_simple in mballoc") Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260314075258.1317579-3-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit 49504a512587147dd6da3b4b08832ccc157b97dc Author: Ye Bin Date: Sat Mar 14 15:52:56 2026 +0800 ext4: introduce EXPORT_SYMBOL_FOR_EXT4_TEST() helper Introduce EXPORT_SYMBOL_FOR_EXT4_TEST() helper for kuint test. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260314075258.1317579-2-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit bac3190a8e79beff6ed221975e0c9b1b5f2a21da Author: Milos Nikic Date: Tue Mar 10 21:15:48 2026 -0700 jbd2: gracefully abort on checkpointing state corruptions This patch targets two internal state machine invariants in checkpoint.c residing inside functions that natively return integer error codes. - In jbd2_cleanup_journal_tail(): A blocknr of 0 indicates a severely corrupted journal superblock. Replaced the J_ASSERT with a WARN_ON_ONCE and a graceful journal abort, returning -EFSCORRUPTED. - In jbd2_log_do_checkpoint(): Replaced the J_ASSERT_BH checking for an unexpected buffer_jwrite state. If the warning triggers, we explicitly drop the just-taken get_bh() reference and call __flush_batch() to safely clean up any previously queued buffers in the j_chkpt_bhs array, preventing a memory leak before returning -EFSCORRUPTED. Signed-off-by: Milos Nikic Reviewed-by: Andreas Dilger Reviewed-by: Zhang Yi Reviewed-by: Baokun Li Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260311041548.159424-1-nikic.milos@gmail.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 5422fe71d26d42af6c454ca9527faaad4e677d6c Author: Edward Adam Davis Date: Fri Mar 6 09:31:58 2026 +0800 ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about "inserted" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline] Reported-by: syzbot+512459401510e2a9a39f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1659aaaaa8d9d11265d7 Tested-by: syzbot+1659aaaaa8d9d11265d7@syzkaller.appspotmail.com Reported-by: syzbot+1659aaaaa8d9d11265d7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=512459401510e2a9a39f Tested-by: syzbot+1659aaaaa8d9d11265d7@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Reviewed-by: Jan Kara Tested-by: syzbot+512459401510e2a9a39f@syzkaller.appspotmail.com Link: https://patch.msgid.link/tencent_43696283A68450B761D76866C6F360E36705@qq.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8 Author: Tejas Bharambe Date: Tue Mar 3 23:14:34 2026 -0800 ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before accessing path[k].p_idx->ei_block, there is no validation that p_idx falls within the valid range of index entries for that level. If the on-disk extent header contains a corrupted or crafted eh_entries value, p_idx can point past the end of the allocated buffer, causing a slab-out-of-bounds read. Fix this by validating path[k].p_idx against EXT_LAST_INDEX() at both access sites: before the while loop and inside it. Return -EFSCORRUPTED if the index pointer is out of range, consistent with how other bounds violations are handled in the ext4 extent tree code. Reported-by: syzbot+04c4e65cab786a2e5b7e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=04c4e65cab786a2e5b7e Signed-off-by: Tejas Bharambe Link: https://patch.msgid.link/JH0PR06MB66326016F9B6AD24097D232B897CA@JH0PR06MB6632.apcprd06.prod.outlook.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 73bf12adbea10b13647864cd1c62410d19e21086 Author: Ye Bin Date: Tue Mar 3 09:22:42 2026 +0800 ext4: test if inode's all dirty pages are submitted to disk The commit aa373cf55099 ("writeback: stop background/kupdate works from livelocking other works") introduced an issue where unmounting a filesystem in a multi-logical-partition scenario could lead to batch file data loss. This problem was not fixed until the commit d92109891f21 ("fs/writeback: bail out if there is no more inodes for IO and queued once"). It took considerable time to identify the root cause. Additionally, in actual production environments, we frequently encountered file data loss after normal system reboots. Therefore, we are adding a check in the inode release flow to verify whether all dirty pages have been flushed to disk, in order to determine whether the data loss is caused by a logic issue in the filesystem code. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260303012242.3206465-1-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit c4a48e9eeefd610ae0d26e9ff085277f751c8e53 Author: Ojaswin Mujoo Date: Mon Mar 2 20:08:11 2026 +0530 ext4: minor fix for ext4_split_extent_zeroout() We missed storing the error which triggerd smatch warning: fs/ext4/extents.c:3369 ext4_split_extent_zeroout() warn: duplicate zero check 'err' (previous on line 3363) fs/ext4/extents.c 3361 3362 err = ext4_ext_get_access(handle, inode, path + depth); 3363 if (err) 3364 return err; 3365 3366 ext4_ext_mark_initialized(ex); 3367 3368 ext4_ext_dirty(handle, inode, path + depth); --> 3369 if (err) 3370 return err; 3371 3372 return 0; 3373 } Fix it by correctly storing the err value from ext4_ext_dirty(). Link: https://lore.kernel.org/all/aYXvVgPnKltX79KE@stanley.mountain/ Reported-by: Dan Carpenter Fixes: a985e07c26455 ("ext4: refactor zeroout path and handle all cases") Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Ojaswin Mujoo Reviewed-by: Zhang Yi Reviewed-by: Baokun Li Reviewed-by: Andreas Dilger Link: https://patch.msgid.link/20260302143811.605174-1-ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 46066e3a06647c5b186cc6334409722622d05c44 Author: Ye Bin Date: Mon Mar 2 21:46:19 2026 +0800 ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() There's issue as follows: ... EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost EXT4-fs (mmcblk0p1): error count since last fsck: 1 EXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760 EXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760 ... According to the log analysis, blocks are always requested from the corrupted block group. This may happen as follows: ext4_mb_find_by_goal ext4_mb_load_buddy ext4_mb_load_buddy_gfp ext4_mb_init_cache ext4_read_block_bitmap_nowait ext4_wait_block_bitmap ext4_validate_block_bitmap if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp)) return -EFSCORRUPTED; // There's no logs. if (err) return err; // Will return error ext4_lock_group(ac->ac_sb, group); if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable goto out; After commit 9008a58e5dce ("ext4: make the bitmap read routines return real error codes") merged, Commit 163a203ddb36 ("ext4: mark block group as corrupt on block bitmap error") is no real solution for allocating blocks from corrupted block groups. This is because if 'EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)' is true, then 'ext4_mb_load_buddy()' may return an error. This means that the block allocation will fail. Therefore, check block group if corrupted when ext4_mb_load_buddy() returns error. Fixes: 163a203ddb36 ("ext4: mark block group as corrupt on block bitmap error") Fixes: 9008a58e5dce ("ext4: make the bitmap read routines return real error codes") Signed-off-by: Ye Bin Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Zhang Yi Reviewed-by: Andreas Dilger Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260302134619.3145520-1-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit afe376d2c1fa78c8a1063a357c6971bba3f6da91 Author: Ritesh Harjani (IBM) Date: Sun Mar 1 21:44:26 2026 +0530 ext4: kunit: extents-test: lix percpu_counters list corruption commit 82f80e2e3b23 ("ext4: add extent status cache support to kunit tests"), added ext4_es_register_shrinker() in extents_kunit_init() function but failed to add the unregister shrinker routine in extents_kunit_exit(). This could cause the following percpu_counters list corruption bug. ok 1 split unwrit extent to 2 extents and convert 1st half writ slab kmalloc-4k start c0000002007ff000 pointer offset 1448 size 4096 list_add corruption. next->prev should be prev (c000000004bc9e60), but was 0000000000000000. (next=c0000002007ff5a8). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:29! cpu 0x2: Vector: 700 (Program Check) at [c000000241927a30] pc: c000000000f26ed0: __list_add_valid_or_report+0x120/0x164 lr: c000000000f26ecc: __list_add_valid_or_report+0x11c/0x164 sp: c000000241927cd0 msr: 800000000282b033 current = 0xc000000241215200 paca = 0xc0000003fffff300 irqmask: 0x03 irq_happened: 0x09 pid = 258, comm = kunit_try_catch kernel BUG at lib/list_debug.c:29! enter ? for help __percpu_counter_init_many+0x148/0x184 ext4_es_register_shrinker+0x74/0x23c extents_kunit_init+0x100/0x308 kunit_try_run_case+0x78/0x1f8 kunit_generic_run_threadfn_adapter+0x40/0x70 kthread+0x190/0x1a0 start_kernel_thread+0x14/0x18 2:mon> This happens because: extents_kunit_init(test N): ext4_es_register_shrinker(sbi) percpu_counters_init() x 4; // this adds 4 list nodes to global percpu_counters list list_add(&fbc->list, &percpu_counters); shrinker_register(); extents_kunit_exit(test N): kfree(sbi); // frees sbi w/o removing those 4 list nodes. // So, those list node now becomes dangling pointers extents_kunit_init(test N+1): kzalloc_obj(ext4_sb_info) // allocator returns same page, but zeroed. ext4_es_register_shrinker(sbi) percpu_counters_init() list_add(&fbc->list, &percpu_counters); __list_add_valid(new, prev, next); next->prev != prev // list corruption bug detected, since next->prev = NULL Fixes: 82f80e2e3b23 ("ext4: add extent status cache support to kunit tests") Signed-off-by: Ritesh Harjani (IBM) Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/5bb9041471dab8ce870c191c19cbe4df57473be8.1772381213.git.ritesh.list@gmail.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 1aec30021edd410b986c156f195f3d23959a9d11 Author: Li Chen Date: Wed Feb 25 16:26:16 2026 +0800 ext4: publish jinode after initialization ext4_inode_attach_jinode() publishes ei->jinode to concurrent users. It used to set ei->jinode before jbd2_journal_init_jbd_inode(), allowing a reader to observe a non-NULL jinode with i_vfs_inode still unset. The fast commit flush path can then pass this jinode to jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and may crash. Below is the crash I observe: ``` BUG: unable to handle page fault for address: 000000010beb47f4 PGD 110e51067 P4D 110e51067 PUD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 RIP: 0010:xas_find_marked+0x3d/0x2e0 Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02 RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246 RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003 RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10 RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000 R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88 FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: filemap_get_folios_tag+0x87/0x2a0 __filemap_fdatawait_range+0x5f/0xd0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __schedule+0x3e7/0x10c0 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 ? cap_safe_nice+0x37/0x70 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 filemap_fdatawait_range_keep_errors+0x12/0x40 ext4_fc_commit+0x697/0x8b0 ? ext4_file_write_iter+0x64b/0x950 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 ? vfs_write+0x356/0x480 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ext4_sync_file+0xf7/0x370 do_fsync+0x3b/0x80 ? syscall_trace_enter+0x108/0x1d0 __x64_sys_fdatasync+0x16/0x20 do_syscall_64+0x62/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... ``` Fix this by initializing the jbd2_inode first. Use smp_wmb() and WRITE_ONCE() to publish ei->jinode after initialization. Readers use READ_ONCE() to fetch the pointer. Fixes: a361293f5fede ("jbd2: Fix oops in jbd2_journal_file_inode()") Cc: stable@vger.kernel.org Signed-off-by: Li Chen Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260225082617.147957-1-me@linux.beauty Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 356227096eb66e41b23caf7045e6304877322edf Author: Yuto Ohnuki Date: Mon Feb 23 12:33:46 2026 +0000 ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio Replace BUG_ON() with proper error handling when inline data size exceeds PAGE_SIZE. This prevents kernel panic and allows the system to continue running while properly reporting the filesystem corruption. The error is logged via ext4_error_inode(), the buffer head is released to prevent memory leak, and -EFSCORRUPTED is returned to indicate filesystem corruption. Signed-off-by: Yuto Ohnuki Link: https://patch.msgid.link/20260223123345.14838-2-ytohnuki@amazon.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 1308255bbf8452762f89f44f7447ce137ecdbcff Author: Jan Kara Date: Mon Feb 16 17:48:44 2026 +0100 ext4: fix fsync(2) for nojournal mode When inode metadata is changed, we sometimes just call ext4_mark_inode_dirty() to track modified metadata. This copies inode metadata into block buffer which is enough when we are journalling metadata. However when we are running in nojournal mode we currently fail to write the dirtied inode buffer during fsync(2) because the inode is not marked as dirty. Use explicit ext4_write_inode() call to make sure the inode table buffer is written to the disk. This is a band aid solution but proper solution requires a much larger rewrite including changes in metadata bh tracking infrastructure. Reported-by: Free Ekanayaka Link: https://lore.kernel.org/all/87il8nhxdm.fsf@x1.mail-host-address-is-not-set/ CC: stable@vger.kernel.org Signed-off-by: Jan Kara Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20260216164848.3074-4-jack@suse.cz Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit bd060afa7cc3e0ad30afa9ecc544a78638498555 Author: Jan Kara Date: Mon Feb 16 17:48:43 2026 +0100 ext4: make recently_deleted() properly work with lazy itable initialization recently_deleted() checks whether inode has been used in the near past. However this can give false positive result when inode table is not initialized yet and we are in fact comparing to random garbage (or stale itable block of a filesystem before mkfs). Ultimately this results in uninitialized inodes being skipped during inode allocation and possibly they are never initialized and thus e2fsck complains. Verify if the inode has been initialized before checking for dtime. Signed-off-by: Jan Kara Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20260216164848.3074-3-jack@suse.cz Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit c11c731a684e5e4e377e7e22f9fc2f29ce1478c7 Merge: 2edfa31769a4ad f3567dd428b264 Author: Jakub Kicinski Date: Fri Mar 27 20:30:26 2026 -0700 Merge branch 'fix-page-fragment-handling-when-page_size-4k' Dimitri Daskalakis says: ==================== Fix page fragment handling when PAGE_SIZE > 4K FBNIC operates on fixed size descriptors (4K). When the OS supports pages larger than 4K, we fragment the page across multiple descriptors. While performance testing, I found several issues with our page fragment handling, resulting in low throughput and potential RX stalls. ==================== Link: https://patch.msgid.link/20260324195123.3486219-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit b1d682f1990c19fb1d5b97d13266210457092bcd Author: Simon Weber Date: Sat Feb 7 10:53:03 2026 +0100 ext4: fix journal credit check when setting fscrypt context Fix an issue arising when ext4 features has_journal, ea_inode, and encrypt are activated simultaneously, leading to ENOSPC when creating an encrypted file. Fix by passing XATTR_CREATE flag to xattr_set_handle function if a handle is specified, i.e., when the function is called in the control flow of creating a new inode. This aligns the number of jbd2 credits set_handle checks for with the number allocated for creating a new inode. ext4_set_context must not be called with a non-null handle (fs_data) if fscrypt context xattr is not guaranteed to not exist yet. The only other usage of this function currently is when handling the ioctl FS_IOC_SET_ENCRYPTION_POLICY, which calls it with fs_data=NULL. Fixes: c1a5d5f6ab21eb7e ("ext4: improve journal credit handling in set xattr paths") Co-developed-by: Anthony Durrer Signed-off-by: Anthony Durrer Signed-off-by: Simon Weber Reviewed-by: Eric Biggers Link: https://patch.msgid.link/20260207100148.724275-4-simon.weber.39@gmail.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit f3567dd428b264b3f06f881e5e85a738c7c910df Author: Dimitri Daskalakis Date: Tue Mar 24 12:51:23 2026 -0700 eth: fbnic: Fix debugfs output for BDQ's with page frags The rings size_mask represents the number of pages, so we need to determine the number of page frags when dumping the descriptors. Fixes: df04373b0dab ("eth fbnic: Add debugfs hooks for tx/rx rings") Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260324195123.3486219-3-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit b38c55320bf85a84a4f04803c57b261fc87e9b4b Author: Dimitri Daskalakis Date: Tue Mar 24 12:51:22 2026 -0700 eth: fbnic: Account for page fragments when updating BDQ tail FBNIC supports fixed size buffers of 4K. When PAGE_SIZE > 4K, we fragment the page across multiple descriptors (FBNIC_BD_FRAG_COUNT). When refilling the BDQ, the correct number of entries are populated, but tail was only incremented by one. So on a system with 64K pages, HW would get one descriptor refilled for every 16 we populate. Additionally, we program the ring size in the HW when enabling the BDQ. This was not accounting for page fragments, so on systems with 64K pages, the HW used 1/16th of the ring. Fixes: 0cb4c0a13723 ("eth: fbnic: Implement Rx queue alloc/start/stop/free") Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260324195123.3486219-2-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 Author: Deepanshu Kartikey Date: Sat Feb 7 10:06:07 2026 +0530 ext4: convert inline data to extents when truncate exceeds inline size Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows the file size beyond the inline capacity. This prevents the filesystem from entering an inconsistent state where the inline data flag is set but the file size exceeds what can be stored inline. Without this fix, the following sequence causes a kernel BUG_ON(): 1. Mount filesystem with inode that has inline flag set and small size 2. truncate(file, 50MB) - grows size but inline flag remains set 3. sendfile() attempts to write data 4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity) The crash occurs because ext4_write_inline_data() expects inline storage to accommodate the write, but the actual inline capacity (~60 bytes for i_block + ~96 bytes for xattrs) is far smaller than the file size and write request. The fix checks if the new size from setattr exceeds the inode's actual inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to extent-based storage before proceeding with the size change. This addresses the root cause by ensuring the inline data flag and file size remain consistent during truncate operations. Reported-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7de5fe447862fc37576f Tested-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260207043607.1175976-1-kartikey406@gmail.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit f4a2b42e78914ff15630e71289adc589c3a8eb45 Author: Jan Kara Date: Thu Feb 5 10:22:24 2026 +0100 ext4: fix stale xarray tags after writeback There are cases where ext4_bio_write_page() gets called for a page which has no buffers to submit. This happens e.g. when the part of the file is actually a hole, when we cannot allocate blocks due to being called from jbd2, or in data=journal mode when checkpointing writes the buffers earlier. In these cases we just return from ext4_bio_write_page() however if the page didn't need redirtying, we will leave stale DIRTY and/or TOWRITE tags in xarray because those get cleared only in __folio_start_writeback(). As a result we can leave these tags set in mappings even after a final sync on filesystem that's getting remounted read-only or that's being frozen. Various assertions can then get upset when writeback is started on such filesystems (Gerald reported assertion in ext4_journal_check_start() firing). Fix the problem by cycling the page through writeback state even if we decide nothing needs to be written for it so that xarray tags get properly updated. This is slightly silly (we could update the xarray tags directly) but I don't think a special helper messing with xarray tags is really worth it in this relatively rare corner case. Reported-by: Gerald Yang Link: https://lore.kernel.org/all/20260128074515.2028982-1-gerald.yang@canonical.com Fixes: dff4ac75eeee ("ext4: move keep_towrite handling to ext4_bio_write_page()") Signed-off-by: Jan Kara Link: https://patch.msgid.link/20260205092223.21287-2-jack@suse.cz Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 2edfa31769a4add828a7e604b21cb82aaaa05925 Author: Eric Dumazet Date: Thu Mar 26 15:51:38 2026 +0000 ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). To fix this we clear skb2->cb[], as suggested by Oskar Kjos. Also add minimal IPv4 header validation (version == 4, ihl >= 5). Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.") Reported-by: Oskar Kjos Signed-off-by: Eric Dumazet Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260326155138.2429480-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 86ab3e55673a7a49a841838776f1ab18d23a67b5 Author: Eric Dumazet Date: Thu Mar 26 20:26:08 2026 +0000 ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway. Fixes: ca15a078bd90 ("sit: generate icmpv6 error when receiving icmpv4 error") Reported-by: Ido Schimmel Closes: https://sashiko.dev/#/patchset/20260326155138.2429480-1-edumazet%40google.com Signed-off-by: Eric Dumazet Cc: Oskar Kjos Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260326202608.2976021-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 84e21e3fb8fd99ea460eb7274584750d11cf3e9f Author: Zhang Yi Date: Sat Jan 31 17:11:56 2026 +0800 ext4: do not check fast symlink during orphan recovery Commit '5f920d5d6083 ("ext4: verify fast symlink length")' causes the generic/475 test to fail during orphan cleanup of zero-length symlinks. generic/475 84s ... _check_generic_filesystem: filesystem on /dev/vde is inconsistent The fsck reports are provided below: Deleted inode 9686 has zero dtime. Deleted inode 158230 has zero dtime. ... Inode bitmap differences: -9686 -158230 Orphan file (inode 12) block 13 is not clean. Failed to initialize orphan file. In ext4_symlink(), a newly created symlink can be added to the orphan list due to ENOSPC. Its data has not been initialized, and its size is zero. Therefore, we need to disregard the length check of the symbolic link when cleaning up orphan inodes. Instead, we should ensure that the nlink count is zero. Fixes: 5f920d5d6083 ("ext4: verify fast symlink length") Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260131091156.1733648-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 82c4f23d2757c2fc6751a5805c1feecdd4c430fb Author: Theodore Ts'o Date: Thu Feb 19 10:22:18 2026 -0500 Update MAINTAINERS file to add reviewers for ext4 Signed-off-by: Theodore Ts'o Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Ojaswin Mujoo commit be762d8b6dd7efacb61937d20f8475db8f207655 Merge: afb54c14047780 754bd2b4a084b9 Author: Linus Torvalds Date: Fri Mar 27 20:02:34 2026 -0700 Merge tag 'hwmon-for-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - PMBus driver fixes: - Add mutex protection for regulator operations - Fix reading from "write-only" attributes - Mark lowest/average/highest/rated attributes as read-only - isl68137: Add mutex protection for AVS enable sysfs attributes - ina233: Fix error handling and sign extension when reading shunt voltage - adm1177: Fix sysfs ABI violation and current unit conversion - peci: Fix off-by-one in cputemp_is_visible(), and crit_hyst returning delta instead of absolute temperature * tag 'hwmon-for-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (pmbus/core) Protect regulator operations with mutex hwmon: (pmbus) Introduce the concept of "write-only" attributes hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only hwmon: (adm1177) fix sysfs ABI violation and current unit conversion hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes hwmon: (pmbus/ina233) Fix error handling and sign extension in shunt voltage read commit afb54c14047780b97719e8b6e4ea11a0cecc2739 Merge: 26df51adf30b3d 01f784fc9d0ab2 Author: Linus Torvalds Date: Fri Mar 27 19:58:22 2026 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Driver (and enclosure) only fixes. Most are obvious. The big change is in the tcm_loop driver to add command draining to error handling (the lack of which was causing hangs with the potential for double use crashes)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: target: file: Use kzalloc_flex for aio_cmd scsi: scsi_transport_sas: Fix the maximum channel scanning issue scsi: target: tcm_loop: Drain commands in target_reset handler scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() scsi: ses: Handle positive SCSI error from ses_recv_diag() commit 26df51adf30b3d440293eed38d01f953ae0bb6f4 Merge: 335c9017e33389 5ba61d8a25ddf8 Author: Linus Torvalds Date: Fri Mar 27 17:21:37 2026 -0700 Merge tag 'drm-fixes-2026-03-28-1' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes, still a bit busy, but the usual suspects amdgpu and i915/xe have a bunch of small fixes, and otherwise it's just a few minor driver fixes. loognsoon: - update MAINTAINERS shmem: - fault handler fix syncobj: - fix GFP flags amdgpu: - DSC fix - Module parameter parsing fix - PASID reuse fix - drm_edid leak fix - SMU 13.x fixes - SMU 14.x fix - Fence fix in amdgpu_amdkfd_submit_ib() - LVDS fixes - GPU page fault fix for non-4K pages amdkfd: - Ordering fix in kfd_ioctl_create_process() i915/display: - DP tunnel error handling fix - Spurious GMBUS timeout fix - Unlink NV12 planes earlier - Order OP vs. timeout correctly in __wait_for() xe: - Fix UAF in SRIOV migration restore - Updates to HW W/a - VMBind remap fix ivpu: - poweroff fix mediatek: - fix register ordering" * tag 'drm-fixes-2026-03-28-1' of https://gitlab.freedesktop.org/drm/kernel: (25 commits) MAINTAINERS: Update GPU driver maintainer information drm/xe: always keep track of remap prev/next drm/syncobj: Fix xa_alloc allocation flags drm/amd/display: Fix DCE LVDS handling drm/amdgpu: Handle GPU page faults correctly on non-4K page systems drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v14 drm/amdkfd: Fix NULL pointer check order in kfd_ioctl_create_process drm/amd/display: check if ext_caps is valid in BL setup drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib drm/xe: Implement recent spec updates to Wa_16025250150 accel/ivpu: Add disable clock relinquish workaround for NVL-A0 drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 drm/amd/pm: Return -EOPNOTSUPP for unsupported OD_MCLK on smu_v13_0_6 drm/amd/pm: Skip redundant UCLK restore in smu_v13_0_6 drm/amd/display: Fix drm_edid leak in amdgpu_dm drm/amdgpu: prevent immediate PASID reuse case drm/amdgpu: fix strsep() corrupting lockup_timeout on multi-GPU (v3) drm/amd/display: Do not skip unrelated mode changes in DSC validation drm/xe/pf: Fix use-after-free in migration restore ... commit 0738d395aab8fae3b5a3ad3fc640630c91693c27 Author: Vasily Gorbik Date: Thu Mar 26 19:50:14 2026 +0100 s390/entry: Scrub r12 register on kernel entry Before commit f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP"), all entry handlers loaded r12 with the current task pointer (lg %r12,__LC_CURRENT) for use by the BPENTER/BPEXIT macros. That commit removed TIF_ISOLATE_BP, dropping both the branch prediction macros and the r12 load, but did not add r12 to the register clearing sequence. Add the missing xgr %r12,%r12 to make the register scrub consistent across all entry points. Fixes: f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP") Cc: stable@kernel.org Reviewed-by: Ilya Leoshkevich Signed-off-by: Vasily Gorbik commit 48b8814e25d073dd84daf990a879a820bad2bcbd Author: Greg Kroah-Hartman Date: Tue Mar 24 17:34:05 2026 +0100 s390/syscalls: Add spectre boundary for syscall dispatch table The s390 syscall number is directly controlled by userspace, but does not have an array_index_nospec() boundary to prevent access past the syscall function pointer tables. Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Cc: Arnd Bergmann Fixes: 56e62a737028 ("s390: convert to generic entry") Cc: stable@kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Reviewed-by: Vasily Gorbik Link: https://lore.kernel.org/r/2026032404-sterling-swoosh-43e6@gregkh Signed-off-by: Vasily Gorbik commit c5c0a268b38adffbb2e70e6957017537ff54c157 Author: Vasily Gorbik Date: Thu Mar 26 14:38:44 2026 +0100 s390/barrier: Make array_index_mask_nospec() __always_inline Mark array_index_mask_nospec() as __always_inline to guarantee the mitigation is emitted inline regardless of compiler inlining decisions. Fixes: e2dd833389cc ("s390: add optimized array_index_mask_nospec") Cc: stable@kernel.org Reviewed-by: Ilya Leoshkevich Signed-off-by: Vasily Gorbik commit 335c9017e333894c39853f6fc27db9f0ce44f48b Merge: cd0bbd5a664f44 b341c1176f2e00 Author: Linus Torvalds Date: Fri Mar 27 16:38:55 2026 -0700 Merge tag 'spi-fix-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "There are two core fixes here. One is from Johan dealing with an issue introduced by a devm_ API usage update causing things to be freed earlier than they had earlier when we fail to register a device, another from Danilo avoids unlocked acccess to data by converting to use a driver core API. We also have a few relatively minor driver specific fixes" * tag 'spi-fix-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-fsl-lpspi: fix teardown order issue (UAF) spi: fix use-after-free on managed registration failure spi: use generic driver_override infrastructure spi: meson-spicc: Fix double-put in remove path spi: sn-f-ospi: Use devm_mutex_init() to simplify code spi: sn-f-ospi: Fix resource leak in f_ospi_probe() commit cd0bbd5a664f44c9430cb392ce03e6b74a2fa78f Merge: 30052002e6bce7 8121353a4bf8e3 Author: Linus Torvalds Date: Fri Mar 27 16:36:23 2026 -0700 Merge tag 'regulator-fix-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A fix from Alice for the rust bindings, they didn't handle the stub implementation of the C API used when CONFIG_REGULATOR is disabled leading to undefined behaviour" * tag 'regulator-fix-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: rust: regulator: do not assume that regulator_get() returns non-null commit 30052002e6bce7fe7f316ddd8dbea4943bd82dae Merge: dd09eb443372f9 09e70e4f119ff6 Author: Linus Torvalds Date: Fri Mar 27 16:34:25 2026 -0700 Merge tag 'regmap-fix-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "A fix from Andy Shevchenko for an issue with caching of page selector registers which are located inside the page they are switching" * tag 'regmap-fix-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Synchronize cache for the page selector commit dd09eb443372f9390d36051d86ebe06e9919aeec Merge: faf44e54f6def4 c3fd16c3b98ed7 Author: Linus Torvalds Date: Fri Mar 27 16:19:51 2026 -0700 Merge tag 'tsm-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm Pull tsm fix from Dan Williams: - Fix a VMM controlled buffer length used to emit TDX attestation reports * tag 'tsm-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length commit faf44e54f6def4dd85b2ae35d6b332f81f9d7e91 Merge: 56bea424158f6b e98137f0a874ab Author: Linus Torvalds Date: Fri Mar 27 15:59:30 2026 -0700 Merge tag 'vfio-v7.0-rc6' of https://github.com/awilliam/linux-vfio Pull VFIO fix from Alex Williamson: - Fix double-free and reference count underflow if dma-buf file allocation fails (Alex Williamson) * tag 'vfio-v7.0-rc6' of https://github.com/awilliam/linux-vfio: vfio/pci: Fix double free in dma-buf feature commit 56bea424158f6b99a452ab9410092d72b03f8545 Merge: a361474ba3b3c6 217c0a5c177a3d Author: Linus Torvalds Date: Fri Mar 27 15:55:25 2026 -0700 Merge tag 'efi-fixes-for-v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fix from Ard Biesheuvel: "Fix a potential buffer overrun issue introduced by the previous fix for EFI boot services region reservations on x86" * tag 'efi-fixes-for-v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size commit a361474ba3b3c6bdca7bad72dfd2ffb4f11e8e1d Merge: 196ef74abd3abb 6bcfb7f46d667b Author: Linus Torvalds Date: Fri Mar 27 15:39:41 2026 -0700 Merge tag 'loongarch-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix missing NULL checks for kstrdup(), workaround LS2K/LS7A GPU DMA hang bug, emit GNU_EH_FRAME for vDSO correctly, and fix some KVM-related bugs" * tag 'loongarch-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access() LoongArch: KVM: Handle the case that EIOINTC's coremap is empty LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust LoongArch: vDSO: Emit GNU_EH_FRAME correctly LoongArch: Workaround LS2K/LS7A GPU DMA hang bug LoongArch: Fix missing NULL checks for kstrdup() commit 196ef74abd3abb97a97fcf416ca9d59851fd1d08 Merge: 7df48e36313029 5170efd9c344c6 Author: Linus Torvalds Date: Fri Mar 27 15:35:38 2026 -0700 Merge tag 'io_uring-7.0-20260327' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: "Just two small fixes, both fixing regressions added in the fdinfo code in 6.19 with the SQE mixed size support" * tag 'io_uring-7.0-20260327' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check io_uring/fdinfo: fix SQE_MIXED SQE displaying commit 5ba61d8a25ddf89915f71bf8b63c06d6ffdf06cc Merge: 83318d0c1f5fd3 4cfdfeb6ac0607 Author: Dave Airlie Date: Sat Mar 28 08:05:29 2026 +1000 Merge tag 'mediatek-drm-fixes-20260323' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20260323 1. dsi: Store driver data before invoking mipi_dsi_host_register Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patch.msgid.link/20260323160135.39609-1-chunkuang.hu@kernel.org commit df83746075778958954aa0460cca55f4b3fc9c02 Author: Sean Christopherson Date: Thu Mar 5 17:42:14 2026 -0800 KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE Adjust KVM's sanity check against overwriting a shadow-present SPTE with a another SPTE with a different target PFN to only apply to direct MMUs, i.e. only to MMUs without shadowed gPTEs. While it's impossible for KVM to overwrite a shadow-present SPTE in response to a guest write, writes from outside the scope of KVM, e.g. from host userspace, aren't detected by KVM's write tracking and so can break KVM's shadow paging rules. ------------[ cut here ]------------ pfn != spte_to_pfn(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:3069 at mmu_set_spte+0x1e4/0x440 [kvm], CPU#0: vmx_ept_stale_r/872 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 872 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mmu_set_spte+0x1e4/0x440 [kvm] Call Trace: ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ---[ end trace 0000000000000000 ]--- Fixes: 11d45175111d ("KVM: x86/mmu: Warn if PFN changes on shadow-present SPTE in shadow MMU") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson commit aad885e774966e97b675dfe928da164214a71605 Author: Sean Christopherson Date: Thu Mar 5 17:28:04 2026 -0800 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov Debugged-by: Alexander Bulekov Suggested-by: Fred Griffoul Fixes: a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson commit 6c6ba5489586b6458980fc988736d7fb1be44f30 Merge: 0138af2472dfde 0a28e06575b3f3 Author: Paolo Bonzini Date: Fri Mar 27 22:30:44 2026 +0100 Merge tag 'kvm-s390-master-7.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: More memory management fixes Lots of small and not-so-small fixes for the newly rewritten gmap, mostly affecting the handling of nested guests. commit e5046823f8fa3677341b541a25af2fcb99a5b1e0 Author: Eric Biggers Date: Wed Mar 25 20:29:20 2026 -0700 lib/crypto: chacha: Zeroize permuted_state before it leaves scope Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the permutation has been done. While the kernel is quite inconsistent about zeroizing secrets on the stack (and some prominent userspace crypto libraries don't bother at all since it's not guaranteed to work anyway), the kernel does try to do it as a best practice, especially in cases involving the RNG. Thus, explicitly zeroize 'permuted_state' before it goes out of scope. Fixes: c08d0e647305 ("crypto: chacha20 - Add a generic ChaCha20 stream cipher implementation") Cc: stable@vger.kernel.org Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260326032920.39408-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 7df48e36313029e4c0907b2023905dd7213fd678 Merge: 8af4fad545fa4d e37afcb56ae070 Author: Linus Torvalds Date: Fri Mar 27 13:30:04 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: - Quite a few irdma bug fixes, several user triggerable - Fix a 0 SMAC header in ionic - Tolerate FW errors for RAAS in bng_re - Don't UAF in efa when printing error events - Better handle pool exhaustion in the new bvec paths * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/irdma: Harden depth calculation functions RDMA/irdma: Return EINVAL for invalid arp index error RDMA/irdma: Fix deadlock during netdev reset with active connections RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() RDMA/irdma: Clean up unnecessary dereference of event->cm_node RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() RDMA/irdma: Update ibqp state to error if QP is already in error state RDMA/irdma: Initialize free_qp completion before using it RDMA/efa: Fix possible deadlock RDMA/rw: Fix MR pool exhaustion in bvec RDMA READ path RDMA/rw: Fall back to direct SGE on MR pool exhaustion RDMA/efa: Fix use of completion ctx after free RDMA/bng_re: Fix silent failure in HWRM version query RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() RDMA/irdma: Fix double free related to rereg_user_mr commit 8af4fad545fa4df358c8e4d12f269e460717e514 Merge: 83ce1c753f5789 05f643d6f7e699 Author: Linus Torvalds Date: Fri Mar 27 13:25:58 2026 -0700 Merge tag 'pci-v7.0-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Remove power-off from pwrctrl drivers since this is now done directly by the PCI controller drivers (Chen-Yu Tsai) - Fix pwrctrl device node leak (Felix Gu) - Document a TLP header decoder for AER log messages (Lukas Wunner) * tag 'pci-v7.0-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: Documentation: PCI: Document PCIe TLP Header decoder for AER messages PCI/pwrctrl: Fix pci_pwrctrl_is_required() device node leak PCI/pwrctrl: Do not power off on pwrctrl device removal commit 83ce1c753f5789167f52df59d3ea64f01b3f77ba Merge: f44c65111e9da0 ed4da361bf943b Author: Linus Torvalds Date: Fri Mar 27 13:16:40 2026 -0700 Merge tag 'sound-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This became slightly big partly due to my time off in the last week. But all changes are about device-specific fixes, so it should be safely applicable. ASoC: - Fix double free in sma1307 - Fix uninitialized variables in simple-card-utils/imx-card - Address clock leaks and error propagation in ADAU1372 - Add DMI quirks and ACP/SDW support for ASUS - Fix Intel CATPT DMA mask - Fix SOF topology parsing - Fix DT bindings for RK3576 SPDIF, STM32 SAI and WCD934x HD-audio: - Quirks for Lenovo, ASUS, and various HP models, as well as a speaker pop fix on Star Labs StarFighter - Revert MSI X870E Tomahawk denylist again USB-Audio: - Fix distorted audio on Focusrite Scarlett 2i2/2i4 1st Gen - Add iface reset quirk for AB17X - Update Qualcomm USB audio Kconfig dependencies and license Misc: - Fix minor compile warnings for firewire and asihpi drivers" * tag 'sound-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (35 commits) Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist" ALSA: usb-audio: Add iface reset and delay quirk for AB17X USB Audio ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx ALSA: hda/realtek - Fixed Speaker Mute LED for HP EliteBoard G1a platform ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload ASoC: adau1372: Fix clock leak on PLL lock failure ASoC: adau1372: Fix unchecked clk_prepare_enable() return value ASoC: SDCA: fix finding wrong entity ASoC: SDCA: remove the max count of initialization table ASoC: codecs: wcd934x: fix typo in dt parsing ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match ASoC: Intel: catpt: Fix the device initialization ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine ASoC: SOF: topology: reject invalid vendor array size in token parser ASoC: tas2781: Add null check for calibration data ALSA: asihpi: avoid write overflow check warning ASoC: fsl: imx-card: initialize playback_only and capture_only ASoC: simple-card-utils: Check value of is_playback_only and is_capture_only ... commit f44c65111e9da0fa378ddf832c90e93855628dc9 Merge: 0b8bf3b64eee84 7587fbf5adc23d Author: Linus Torvalds Date: Fri Mar 27 13:10:49 2026 -0700 Merge tag 'media/v7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - uvcvideo may cause OOPS when out of memory - remove a deadlock in the ccs driver * tag 'media/v7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: ccs: Avoid deadlock in ccs_init_state() media: uvcvideo: Fix bug in error path of uvc_alloc_urb_buffers commit 0b8bf3b64eee8470d27a62a7923af3058125c7ca Merge: 3577cfd738e29b f63a9df7e3f9f8 Author: Linus Torvalds Date: Fri Mar 27 13:04:34 2026 -0700 Merge tag 'sysctl-7.00-fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl fix from Joel Granados: "Fix uninitialized variable error when writing to a sysctl bitmap Removed the possibility of returning an unjustified -EINVAL when writing to a sysctl bitmap" * tag 'sysctl-7.00-fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: sysctl: fix uninitialized variable in proc_do_large_bitmap commit 3577cfd738e29b3d54cdb10c45a56730346dfe8b Merge: 34892992d0ed45 e31c53a8060e13 Author: Linus Torvalds Date: Fri Mar 27 12:22:45 2026 -0700 Merge tag 'xfs-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "This includes a few important bug fixes, and some code refactoring that was necessary for one of the fixes" * tag 'xfs-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: remove file_path tracepoint data xfs: don't irele after failing to iget in xfs_attri_recover_work xfs: remove redundant validation in xlog_recover_attri_commit_pass2 xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 xfs: close crash window in attr dabtree inactivation xfs: factor out xfs_attr3_leaf_init xfs: factor out xfs_attr3_node_entry_remove xfs: only assert new size for datafork during truncate extents xfs: annotate struct xfs_attr_list_context with __counted_by_ptr xfs: cleanup buftarg handling in XFS_IOC_VERIFY_MEDIA xfs: scrub: unlock dquot before early return in quota scrub xfs: refactor xfsaild_push loop into helper xfs: save ailp before dropping the AIL lock in push callbacks xfs: avoid dereferencing log items after push callbacks xfs: stop reclaim before pushing AIL during unmount commit 1f9885732248d22f788e4992c739a98c88ab8a55 Author: Luo Haiyang Date: Thu Mar 26 14:19:53 2026 +0800 tracing: Fix potential deadlock in cpu hotplug with osnoise The following sequence may leads deadlock in cpu hotplug: task1 task2 task3 ----- ----- ----- mutex_lock(&interface_lock) [CPU GOING OFFLINE] cpus_write_lock(); osnoise_cpu_die(); kthread_stop(task3); wait_for_completion(); osnoise_sleep(); mutex_lock(&interface_lock); cpus_read_lock(); [DEAD LOCK] Fix by swap the order of cpus_read_lock() and mutex_lock(&interface_lock). Cc: stable@vger.kernel.org Cc: Cc: Cc: Cc: Fixes: bce29ac9ce0bb ("trace: Add osnoise tracer") Link: https://patch.msgid.link/20260326141953414bVSj33dAYktqp9Oiyizq8@zte.com.cn Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Luo Haiyang Signed-off-by: Steven Rostedt (Google) commit 34892992d0ed45b4b0547f25e01887b56959fd5f Merge: 46b513250491a7 beef2634f81f1c Author: Linus Torvalds Date: Fri Mar 27 12:03:39 2026 -0700 Merge tag 'v7.0-rc5-ksmbd-srv-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix out of bounds write - Fix for better calculating max output buffers - Fix memory leaks in SMB2/SMB3 lock - Fix use after free - Multichannel fix * tag 'v7.0-rc5-ksmbd-srv-fixes' of git://git.samba.org/ksmbd: ksmbd: fix potencial OOB in get_file_all_info() for compound requests ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() ksmbd: fix memory leaks and NULL deref in smb2_lock() ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() ksmbd: do not expire session on binding failure commit 2feec5ae5df785658924ab6bd91280dc3926507c Author: Youssef Samir Date: Thu Feb 5 13:34:14 2026 +0100 accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that DBC. Since that handling is done in the qaic_manage_ioctl() context, if the user goes away before receiving and handling the deactivation, the host will be out-of-sync with the DBCs available for use, and the DBC resources will not be freed unless the device is removed. If another user loads and requests to activate a network, then the device assigns the same DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false, leading the user process to hang. As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions that are received after the user has gone away. Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Youssef Samir Reviewed-by: Lizhi Hou Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com commit 102e57d56f81fa5c5ed78f576101d1bf1b3e6fe2 Author: Jan Kara Date: Thu Mar 26 15:06:32 2026 +0100 udf: Fix race between file type conversion and writeback udf_setsize() can race with udf_writepages() as follows: udf_setsize() udf_writepages() if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) err = udf_expand_file_adinicb(inode); err = udf_extend_file(inode, newsize); udf_adinicb_writepages() memcpy_from_file_folio() - crash because inode size is too big. Fix the problem by checking the file type under folio lock in udf_handle_page_wb() handler called from __mpage_writepages() which properly serializes with udf_expand_file_adinicb(). Reported-by: Jianzhou Zhao Link: https://lore.kernel.org/all/f622c01.67ac.19cdbdd777d.Coremail.luckd0g@163.com Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260326140635.15895-4-jack@suse.cz Signed-off-by: Jan Kara commit fffca572f9ca51607f180a37d0c898404c8f9112 Author: Jan Kara Date: Thu Mar 26 15:06:31 2026 +0100 mpage: Provide variant of mpage_writepages() with own optional folio handler Some filesystems need to treat some folios specially (for example for inodes with inline data). Doing the handling in their .writepages method in a race-free manner results in duplicating some of the writeback internals. So provide generalized version of mpage_writepages() that allows filesystem to provide a handler called for each folio which can handle the folio in a special way. Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260326140635.15895-3-jack@suse.cz Signed-off-by: Jan Kara commit 73ff3916d803f7ca3a4325af649e46ff89d6c3a7 Author: Zhang Heng Date: Fri Mar 27 18:12:15 2026 +0800 ALSA: hda/realtek: change quirk for HP OmniBook 7 Laptop 16-bh0xxx HP OmniBook 7 Laptop 16-bh0xxx has the same PCI subsystem ID 0x103c8e60, and the ALC245 on it needs this quirk to control the mute LED. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221214 Cc: Tested-by: Artem S. Tashkinov Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260327101215.481108-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 4c10830fda045e255f4eaa81a362bd357e19c3ea Merge: c369299895a591 e2f1ada8e089dd Author: Wolfram Sang Date: Fri Mar 27 16:20:24 2026 +0100 Merge tag 'i2c-host-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-fixes for v7.0-rc6 designware: fix resume-probe race causing NULL-deref in amdisp imx: fix timeout on repeated reads and extra clock at end commit 1a2d30aa73140e008e62dc5898e4c2c3b59b35e4 Author: Lode Willems Date: Tue Mar 24 21:43:06 2026 +0100 HID: Kysona: Add support for VXE Dragonfly R1 Pro Apparently this same protocol is used by more mice from different brands. This patch adds support for the VXE Dragonfly R1 Pro. Tested-by: Dominykas Svetikas Signed-off-by: Lode Willems Signed-off-by: Jiri Kosina commit 743677a8cb30b09f16a7f167f497c2c927891b5a Author: Maximilian Pezzullo Date: Wed Mar 4 09:25:22 2026 +0100 HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP When sensor discovery fails on systems without AMD SFH sensors, the code already emits a warning via dev_warn() in amd_sfh_hid_client_init(). The subsequent dev_err() in sfh_init_work() for the same -EOPNOTSUPP return value is redundant and causes unnecessary alarm. Suppress the dev_err() for -EOPNOTSUPP to avoid confusing users who have no AMD SFH sensors. Fixes: 2105e8e00da4 ("HID: amd_sfh: Improve boot time when SFH is available") Reported-by: Casey Croy Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221099 Signed-off-by: Maximilian Pezzullo Acked-by: Basavaraj Natikar Signed-off-by: Jiri Kosina commit e2f1ada8e089dd5a331bcd8b88125ae2af8d188f Author: Pratap Nirujogi Date: Fri Mar 20 16:12:22 2026 -0400 i2c: designware: amdisp: Fix resume-probe race condition issue Identified resume-probe race condition in kernel v7.0 with the commit 38fa29b01a6a ("i2c: designware: Combine the init functions"),but this issue existed from the beginning though not detected. The amdisp i2c device requires ISP to be in power-on state for probe to succeed. To meet this requirement, this device is added to genpd to control ISP power using runtime PM. The pm_runtime_get_sync() called before i2c_dw_probe() triggers PM resume, which powers on ISP and also invokes the amdisp i2c runtime resume before the probe completes resulting in this race condition and a NULL dereferencing issue in v7.0 Fix this race condition by using the genpd APIs directly during probe: - Call dev_pm_genpd_resume() to Power ON ISP before probe - Call dev_pm_genpd_suspend() to Power OFF ISP after probe - Set the device to suspended state with pm_runtime_set_suspended() - Enable runtime PM only after the device is fully initialized Fixes: d6263c468a761 ("i2c: amd-isp: Add ISP i2c-designware driver") Co-developed-by: Bin Du Signed-off-by: Bin Du Signed-off-by: Pratap Nirujogi Cc: # v6.16+ Acked-by: Mika Westerberg Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260320201302.3490570-1-pratap.nirujogi@amd.com commit 13101db735bdb29c5f60e95fb578690bd178b30f Author: Stefan Eichenberger Date: Wed Feb 18 16:08:50 2026 +0100 i2c: imx: ensure no clock is generated after last read When reading from the I2DR register, right after releasing the bus by clearing MSTA and MTX, the I2C controller might still generate an additional clock cycle which can cause devices to misbehave. Ensure to only read from I2DR after the bus is not busy anymore. Because this requires polling, the read of the last byte is moved outside of the interrupt handler. An example for such a failing transfer is this: i2ctransfer -y -a 0 w1@0x00 0x02 r1 Error: Sending messages failed: Connection timed out It does not happen with every device because not all devices react to the additional clock cycle. Fixes: 5f5c2d4579ca ("i2c: imx: prevent rescheduling in non dma mode") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Stefan Eichenberger Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260218150940.131354-3-eichest@gmail.com commit f88e2e748a1fc3cb4b8d163a9be790812f578850 Author: Stefan Eichenberger Date: Wed Feb 18 16:08:49 2026 +0100 i2c: imx: fix i2c issue when reading multiple messages When reading multiple messages, meaning a repeated start is required, polling the bus busy bit must be avoided. This must only be done for the last message. Otherwise, the driver will timeout. Here an example of such a sequence that fails with an error: i2ctransfer -y -a 0 w1@0x00 0x02 r1 w1@0x00 0x02 r1 Error: Sending messages failed: Connection timed out Fixes: 5f5c2d4579ca ("i2c: imx: prevent rescheduling in non dma mode") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Stefan Eichenberger Reviewed-by: Frank Li Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260218150940.131354-2-eichest@gmail.com commit 5597dd284ff8c556c0b00f6a34473677426e3f81 Author: David Carlier Date: Wed Mar 25 12:51:30 2026 +0000 net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch emac_dispatch_skb_zc() allocates a new skb via napi_alloc_skb() but never copies the packet data from the XDP buffer into it. The skb is passed up the stack containing uninitialized heap memory instead of the actual received packet, leaking kernel heap contents to userspace. Copy the received packet data from the XDP buffer into the skb using skb_copy_to_linear_data(). Additionally, remove the skb_mark_for_recycle() call since the skb is backed by the NAPI page frag allocator, not page_pool. Marking a non-page_pool skb for recycle causes the free path to return pages to a page_pool that does not own them, corrupting page_pool state. The non-ZC path (emac_rx_packet) does not have these issues because it uses napi_build_skb() to wrap the existing page_pool page directly, requiring no copy, and correctly marks for recycle since the page comes from page_pool_dev_alloc_pages(). Fixes: 7a64bb388df3 ("net: ti: icssg-prueth: Add AF_XDP zero copy for RX") Signed-off-by: David Carlier Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit bb417456c7814d1493d98b7dd9c040bf3ce3b4ed Author: Thomas Bogendoerfer Date: Wed Mar 25 12:20:53 2026 +0100 tg3: Fix race for querying speed/duplex When driver signals carrier up via netif_carrier_on() its internal link_up state isn't updated immediately. This leads to inconsistent speed/duplex in /proc/net/bonding/bondX where the speed and duplex is shown as unknown while ethtool shows correct values. Fix this by using netif_carrier_ok() for link checking in get_ksettings function. Fixes: 84421b99cedc ("tg3: Update link_up flag for phylib devices") Signed-off-by: Thomas Bogendoerfer Reviewed-by: Pavan Chebbi Signed-off-by: David S. Miller commit 5e67ba9bb531e1ec6599a82a065dea9040b9ce50 Author: Pengpeng Hou Date: Wed Mar 25 15:41:52 2026 +0800 net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the remaining-space check. __ioam6_fill_trace_data() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, overrunning the trace buffer. Keep sclen in an unsigned int so the remaining-space check and the write cursor calculation both see the full schema length. Fixes: 8c6f6fa67726 ("ipv6: ioam: IOAM Generic Netlink API") Signed-off-by: Pengpeng Hou Reviewed-by: Justin Iurman Signed-off-by: David S. Miller commit 55372ab135a8e82c8c976b607fe7dd3386b99df5 Merge: 3d53a7a286602c 29d1f56c4f3001 Author: Krzysztof Kozlowski Date: Fri Mar 27 12:56:47 2026 +0100 Merge tag 'v7.0-rockchip-dtsfixes1-v2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Revert to fix a regression that breaks Wifi support for a large part of Pinebook Pro users (multiple Wifi chipsets). * tag 'v7.0-rockchip-dtsfixes1-v2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro" Signed-off-by: Krzysztof Kozlowski commit 3d53a7a286602c605e260ff435c3b89ca983af08 Merge: df3ef89d7ef818 511f76bf1dce5a Author: Krzysztof Kozlowski Date: Fri Mar 27 12:50:36 2026 +0100 Merge tag 'imx-fixes-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into arm/fixes i.MX fixes for 7.0: - Revert the NAND property move that broke compatibility across multiple imx6/imx7 device trees - Fix imx8mq-librem5 power management by bumping BUCK1 suspend voltage to 0.85V and reverting problematic DVS voltage changes - Correct eMMC pad configuration for imx93-tqma9352 and imx91-tqma9131 - Change usdhc tuning step for eMMC and SD on imx93-9x9-qsb - Correct gpu_ahb clock frequency for imx8mq * tag 'imx-fixes-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" Revert "ARM: dts: imx: move nand related property under nand@0" arm64: dts: imx93-tqma9352: improve eMMC pad configuration arm64: dts: imx91-tqma9131: improve eMMC pad configuration arm64: dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Signed-off-by: Krzysztof Kozlowski commit 1f6ee9be92f8df85a8c9a5a78c20fd39c0c21a95 Author: Fei Lv Date: Mon Jul 22 18:14:43 2024 +0800 ovl: make fsync after metadata copy-up opt-in mount option Commit 7d6899fb69d25 ("ovl: fsync after metadata copy-up") was done to fix durability of overlayfs copy up on an upper filesystem which does not enforce ordering on storing of metadata changes (e.g. ubifs). In an earlier revision of the regressing commit by Lei Lv, the metadata fsync behavior was opt-in via a new "fsync=strict" mount option. We were hoping that the opt-in mount option could be avoided, so the change was only made to depend on metacopy=off, in the hope of not hurting performance of metadata heavy workloads, which are more likely to be using metacopy=on. This hope was proven wrong by a performance regression report from Google COS workload after upgrade to kernel 6.12. This is an adaptation of Lei's original "fsync=strict" mount option to the existing upstream code. The new mount option is mutually exclusive with the "volatile" mount option, so the latter is now an alias to the "fsync=volatile" mount option. Reported-by: Chenglong Tang Closes: https://lore.kernel.org/linux-unionfs/CAOdxtTadAFH01Vui1FvWfcmQ8jH1O45owTzUcpYbNvBxnLeM7Q@mail.gmail.com/ Link: https://lore.kernel.org/linux-unionfs/CAOQ4uxgKC1SgjMWre=fUb00v8rxtd6sQi-S+dxR8oDzAuiGu8g@mail.gmail.com/ Fixes: 7d6899fb69d25 ("ovl: fsync after metadata copy-up") Depends: 50e638beb67e0 ("ovl: Use str_on_off() helper in ovl_show_options()") Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Fei Lv Signed-off-by: Amir Goldstein commit 1a9452c428a6b76f0b797bae21daa454fccef1a2 Author: Mario Limonciello Date: Tue Mar 24 16:16:41 2026 -0500 platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug This platform is a similar vintage of platforms that had a BIOS bug leading to a 10s delay at resume from s0i3. Add a quirk for it. Reported-by: Imrane Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221273 Tested-by: Imrane Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260324211647.357924-1-mario.limonciello@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b7f4e7babc122426e8802dffdd8ff1501db6adf4 Author: Srinivas Pandruvada Date: Wed Mar 25 12:31:58 2026 -0700 platform/x86/intel-uncore-freq: Increase minor version The current implementation doesn't require any changes to support minor version 3, hence increment it to avoid "Unsupported minor version:3" message. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260325193158.3417382-2-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ba7d46e0a384398c58eee34579986f830260d37b Author: Srinivas Pandruvada Date: Wed Mar 25 12:31:57 2026 -0700 platform/x86: ISST: Increase minor version The current implementation doesn't require any changes to support minor version 3, hence increment it to avoid "Unsupported minor version:3" message. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260325193158.3417382-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4ab604b3f3aa8dcccc7505f5d310016682a99d5f Author: Srinivas Pandruvada Date: Wed Mar 25 12:29:09 2026 -0700 platform/x86/intel-uncore-freq: Handle autonomous UFS status bit When the AUTONOMOUS_UFS_DISABLED bit is set in the header, the ELC (Efficiency Latency Control) feature is non-functional. Hence, return error for read or write to ELC attributes. Fixes: bb516dc79c4a ("platform/x86/intel-uncore-freq: Add support for efficiency latency control") Signed-off-by: Srinivas Pandruvada Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260325192909.3417322-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e1415b9418eb22b4a7a1ef4b4aec9dd0a49e3fa7 Author: Srinivas Pandruvada Date: Wed Mar 25 12:26:38 2026 -0700 platform/x86: ISST: Reset core count to 0 Based on feature revision, number of buckets can be less than the TRL_MAX_BUCKETS. In that case core counts in the remaining buckets can be set to some invalid values. Hence reset core count to 0 for all buckets before assigning correct values. Fixes: 885d1c2a30b7 ("platform/x86: ISST: Support SST-TF revision 2") Signed-off-by: Srinivas Pandruvada Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260325192638.3417281-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 532743944324a873bbaf8620fcabcd0e69e30c36 Author: leo vriska Date: Wed Mar 4 13:36:59 2026 -0500 HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 According to a mailing list report [1], this controller's predecessor has the same issue. However, it uses the xpad driver instead of HID, so this quirk wouldn't apply. [1]: https://lore.kernel.org/linux-input/unufo3$det$1@ciao.gmane.io/ Signed-off-by: leo vriska Signed-off-by: Jiri Kosina commit d802d848308b35220f21a8025352f0c0aba15c12 Author: Benoît Sevens Date: Mon Mar 23 16:11:07 2026 +0000 HID: roccat: fix use-after-free in roccat_report_event roccat_report_event() iterates over the device->readers list without holding the readers_lock. This allows a concurrent roccat_release() to remove and free a reader while it's still being accessed, leading to a use-after-free. Protect the readers list traversal with the readers_lock mutex. Signed-off-by: Benoît Sevens Reviewed-by: Silvan Jegen Signed-off-by: Jiri Kosina commit ed4da361bf943b9041fc63e5cb6af01b3c0de978 Author: Mario Limonciello Date: Thu Mar 26 14:05:38 2026 -0500 Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist" commit 30b3211aa2416 ("ALSA: hda/intel: Add MSI X870E Tomahawk to denylist") was added to silence a warning, but this effectively reintroduced commit df42ee7e22f03 ("ALSA: hda: Add ASRock X670E Taichi to denylist") which was already reported to cause problems and reverted in commit ee8f1613596ad ("Revert "ALSA: hda: Add ASRock X670E Taichi to denylist"") Revert it yet again. Cc: stable@vger.kernel.org Reported-by: Juhyun Song Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221274 Cc: Stuart Hayhurst Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260326190542.524515-1-mario.limonciello@amd.com Signed-off-by: Takashi Iwai commit ee6c551a7d84fde084e10cc02fa8c7d03e6438f9 Author: Lianqin Hu Date: Wed Mar 25 06:26:48 2026 +0000 ALSA: usb-audio: Add iface reset and delay quirk for AB17X USB Audio Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: new full-speed USB device number 2 using xhci-hcd usb 1-1: New USB device found, idVendor=001f, idProduct=0b23 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: AB17X USB Audio usb 1-1: Manufacturer: Generic usb 1-1: SerialNumber: 20241228172028 Signed-off-by: Lianqin Hu Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/PUZPR06MB6224CA59AD2B26054120B276D249A@PUZPR06MB6224.apcprd06.prod.outlook.com commit faceb5cf5d7a08f4a40335d22d833bb75f05d99e Author: Kshamendra Kumar Mishra Date: Mon Mar 23 22:07:50 2026 +0530 ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk HP Laptop 15-fd0xxx with ALC236 codec does not handle the toggling of the mute LED. This patch adds a quirk entry for subsystem ID 0x8dd7 using ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED behavior. Signed-off-by: Kshamendra Kumar Mishra Link: https://patch.msgid.link/DHAB51ISUM96.2K9SZIABIDEQ0@gmail.com Signed-off-by: Takashi Iwai commit 990a8b0732cf899d4a0f847b0a67efeb9a384c82 Author: Geoffrey D. Bennett Date: Mon Mar 23 21:59:21 2026 +1030 ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP Same issue that the Scarlett 2i2 1st Gen had: QUIRK_FLAG_SKIP_IFACE_SETUP causes distorted/flanging audio on the Scarlett 2i4 1st Gen (1235:800a). Fixes: 38c322068a26 ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP") Reported-by: dcferreira [https://github.com/geoffreybennett/linux-fcp/issues/54] Signed-off-by: Geoffrey D. Bennett Link: https://patch.msgid.link/acEkEbftzyNe8W7C@m.b4.vu Signed-off-by: Takashi Iwai commit 2f388b4e8fdd6b0f27cafd281658daacfd85807e Author: César Montoya Date: Sat Mar 21 10:36:03 2026 -0500 ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx The HP Pavilion 15-eg0xxx with subsystem ID 0x103c87cb uses a Realtek ALC287 codec with a mute LED wired to GPIO pin 4 (mask 0x10). The existing ALC287_FIXUP_HP_GPIO_LED fixup already handles this correctly, but the subsystem ID was missing from the quirk table. GPIO pin confirmed via manual hda-verb testing: hda-verb SET_GPIO_MASK 0x10 hda-verb SET_GPIO_DIRECTION 0x10 hda-verb SET_GPIO_DATA 0x10 Signed-off-by: César Montoya Link: https://patch.msgid.link/20260321153603.12771-1-sprit152009@gmail.com Signed-off-by: Takashi Iwai commit d3be95efc6a1e03230ef646b498050152efe2888 Author: Kailang Yang Date: Thu Mar 19 15:49:46 2026 +0800 ALSA: hda/realtek - Fixed Speaker Mute LED for HP EliteBoard G1a platform On the HP EliteBoard G1a platform (models without a headphone jack). the speaker mute LED failed to function. The Sysfs ctl-led info showed empty values because the standard LED registration couldn't correctly bind to the master switch. Adding this patch will fix and enable the speaker mute LED feature. Tested-by: Chris Chiu Signed-off-by: Kailang Yang Link: https://lore.kernel.org/279e929e884849df84687dbd67f20037@realtek.com Signed-off-by: Takashi Iwai commit 50c8f83c41123cab79575e8d73040a37da4612c5 Merge: 591721223be9e2 d40a198e2b7821 Author: Takashi Iwai Date: Fri Mar 27 10:16:52 2026 +0100 Merge tag 'asoc-fix-v7.0-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.0 This is two week's worth of fixes and quirks so it's a bit larger than you might expect, there's nothing too exciting individually and nothing in core code. commit 7f138de156b20d9f9da6f72f90b63c01941d97d3 Author: Guangshuo Li Date: Fri Mar 27 01:14:12 2026 +0800 auxdisplay: line-display: fix NULL dereference in linedisp_release linedisp_release() currently retrieves the enclosing struct linedisp via to_linedisp(). That lookup depends on the attachment list, but the attachment may already have been removed before put_device() invokes the release callback. This can happen in linedisp_unregister(), and can also be reached from some linedisp_register() error paths. In that case, to_linedisp() returns NULL and linedisp_release() dereferences it while freeing the display resources. The struct device released here is the embedded linedisp->dev used by linedisp_register(), so retrieve the enclosing object directly with container_of() instead. Fixes: 66c93809487e ("auxdisplay: linedisp: encapsulate container_of usage within to_linedisp") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Reviewed-by: Geert Uytterhoeven Signed-off-by: Andy Shevchenko commit 8b72aa5704c77380742346d4ac755b074b7f9eaa Author: Sherry Yang Date: Thu Mar 26 09:17:19 2026 -0700 iommupt/amdv1: mark amdv1pt_install_leaf_entry as __always_inline After enabling CONFIG_GCOV_KERNEL and CONFIG_GCOV_PROFILE_ALL, following build failure is observed under GCC 14.2.1: In function 'amdv1pt_install_leaf_entry', inlined from '__do_map_single_page' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:650:3, inlined from '__map_single_page0' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:661:1, inlined from 'pt_descend' at drivers/iommu/generic_pt/fmt/../pt_iter.h:391:9, inlined from '__do_map_single_page' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:657:10, inlined from '__map_single_page1.constprop' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:661:1: ././include/linux/compiler_types.h:706:45: error: call to '__compiletime_assert_71' declared with attribute error: FIELD_PREP: value too large for the field 706 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ...... drivers/iommu/generic_pt/fmt/amdv1.h:220:26: note: in expansion of macro 'FIELD_PREP' 220 | FIELD_PREP(AMDV1PT_FMT_OA, | ^~~~~~~~~~ In the path '__do_map_single_page()', level 0 always invokes 'pt_install_leaf_entry(&pts, map->oa, PAGE_SHIFT, …)'. At runtime that lands in the 'if (oasz_lg2 == isz_lg2)' arm of 'amdv1pt_install_leaf_entry()'; the contiguous-only 'else' block is unreachable for 4 KiB pages. With CONFIG_GCOV_KERNEL + CONFIG_GCOV_PROFILE_ALL, the extra instrumentation changes GCC's inlining so that the "dead" 'else' branch still gets instantiated. The compiler constant-folds the contiguous OA expression, runs the 'FIELD_PREP()' compile-time check, and produces: FIELD_PREP: value too large for the field gcov-enabled builds therefore fail even though the code path never executes. Fix this by marking amdv1pt_install_leaf_entry as __always_inline. Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op") Suggested-by: Jason Gunthorpe Signed-off-by: Sherry Yang Signed-off-by: Joerg Roedel commit ee6e69d032550687a3422504bfca3f834c7b5061 Author: Jason Gunthorpe Date: Mon Mar 2 18:22:53 2026 -0400 iommupt: Fix short gather if the unmap goes into a large mapping unmap has the odd behavior that it can unmap more than requested if the ending point lands within the middle of a large or contiguous IOPTE. In this case the gather should flush everything unmapped which can be larger than what was requested to be unmapped. The gather was only flushing the range requested to be unmapped, not extending to the extra range, resulting in a short invalidation if the caller hits this special condition. This was found by the new invalidation/gather test I am adding in preparation for ARMv8. Claude deduced the root cause. As far as I remember nothing relies on unmapping a large entry, so this is likely not a triggerable bug. Cc: stable@vger.kernel.org Fixes: 7c53f4238aa8 ("iommupt: Add unmap_pages op") Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Samiullah Khawaja Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel commit 90c5def10bea574b101b7a520c015ca81742183f Author: Jason Gunthorpe Date: Mon Mar 2 18:22:52 2026 -0400 iommu: Do not call drivers for empty gathers An empty gather is coded with start=U64_MAX, end=0 and several drivers go on to convert that to a size with: end - start + 1 Which gives 2 for an empty gather. This then causes Weird Stuff to happen (for example an UBSAN splat in VT-d) that is hopefully harmless, but maybe not. Prevent drivers from being called right in iommu_iotlb_sync(). Auditing shows that AMD, Intel, Mediatek and RSIC-V drivers all do things on these empty gathers. Further, there are several callers that can trigger empty gathers, especially in unusual conditions. For example iommu_map_nosync() will call a 0 size unmap on some error paths. Also in VFIO, iommupt and other places. Cc: stable@vger.kernel.org Reported-by: Janusz Krzysztofik Closes: https://lore.kernel.org/r/11145826.aFP6jjVeTY@jkrzyszt-mobl2.ger.corp.intel.com Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Samiullah Khawaja Reviewed-by: Robin Murphy Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel commit 83318d0c1f5fd3a5eae41bc4e5dc110d5be4907c Merge: aab01a88087446 bfe9e314d7574d Author: Dave Airlie Date: Fri Mar 27 17:48:40 2026 +1000 Merge tag 'drm-xe-fixes-2026-03-26' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Fix UAF in SRIOV migration restore (Winiarski) - Updates to HW W/a (Roper) - VMBind remap fix (Auld) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/acUgq2q2DrCUzFql@intel.com commit aab01a88087446e01371fd186fbb33049d62da1b Merge: 355223cb84eb71 87a70013be7d1b Author: Dave Airlie Date: Fri Mar 27 17:46:09 2026 +1000 Merge tag 'drm-misc-fixes-2026-03-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A page mapping fix for shmem fault handler, a power-off fix for ivpu, a GFP_* flag fix for syncobj, and a MAINTAINERS update. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260326-lush-cuddly-limpet-ab2aa9@houat commit 355223cb84eb71f0f591b5e122a3617351e3c431 Merge: 7261c2fcebd3d1 77fcf58df15edc Author: Dave Airlie Date: Fri Mar 27 17:19:33 2026 +1000 Merge tag 'drm-intel-fixes-2026-03-26' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - DP tunnel error handling fix - Spurious GMBUS timeout fix - Unlink NV12 planes earlier - Order OP vs. timeout correctly in __wait_for() Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/acTdjAoOGkzl3dcc@jlahtine-mobl commit 7261c2fcebd3d15b967b9de361ee650dc4bf3729 Merge: c369299895a591 90d239cc53723c Author: Dave Airlie Date: Fri Mar 27 14:07:09 2026 +1000 Merge tag 'amd-drm-fixes-7.0-2026-03-25' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-03-25: amdgpu: - DSC fix - Module parameter parsing fix - PASID reuse fix - drm_edid leak fix - SMU 13.x fixes - SMU 14.x fix - Fence fix in amdgpu_amdkfd_submit_ib() - LVDS fixes - GPU page fault fix for non-4K pages amdkfd: - Ordering fix in kfd_ioctl_create_process() Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260325155600.4184877-1-alexander.deucher@amd.com commit ae05340ccaa9d347fe85415609e075545bec589f Author: Yochai Eisenrich Date: Wed Mar 25 00:49:25 2026 +0200 net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data The fix is simple, just zeroes the padding fields. Fixes: 31910575a9de ("[IPv6]: Export userland ND options through netlink (RDNSS support)") Signed-off-by: Yochai Eisenrich Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260324224925.2437775-1-echelonh@gmail.com Signed-off-by: Jakub Kicinski commit 2428083101f6883f979cceffa76cd8440751ffe6 Author: Jiayuan Chen Date: Tue Mar 24 16:06:44 2026 +0800 net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak __radix_tree_create() allocates and links intermediate nodes into the tree one by one. If a subsequent allocation fails, the already-linked nodes remain in the tree with no corresponding leaf entry. These orphaned internal nodes are never reclaimed because radix_tree_for_each_slot() only visits slots containing leaf values. The radix_tree API is deprecated in favor of xarray. As suggested by Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead of fixing the radix_tree itself [1]. xarray properly handles cleanup of internal nodes — xa_destroy() frees all internal xarray nodes when the qrtr_node is released, preventing the leak. [1] https://lore.kernel.org/all/20260225071623.41275-1-jiayuan.chen@linux.dev/T/ Reported-by: syzbot+006987d1be3586e13555@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000bfba3a060bf4ffcf@google.com/T/ Fixes: 5fdeb0d372ab ("net: qrtr: Implement outgoing flow control") Signed-off-by: Jiayuan Chen Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260324080645.290197-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 04f272188ff293f112f914e235cb3bedf1063507 Merge: e8e44c98f789de f2df9567b12314 Author: Jakub Kicinski Date: Thu Mar 26 20:19:08 2026 -0700 Merge branch 'net-enetc-safely-reinitialize-tx-bd-ring-when-it-has-unsent-frames' Wei Fang says: ==================== net: enetc: safely reinitialize TX BD ring when it has unsent frames Currently the driver does not reset the producer index register (PIR) and consumer index register (CIR) when initializing a TX BD ring. The driver only reads the PIR and CIR and initializes the software indexes. If the TX BD ring is reinitialized when it still contains unsent frames, its PIR and CIR will not be equal after the reinitialization. However, the BDs between CIR and PIR have been freed and become invalid and this can lead to a hardware malfunction, causing the TX BD ring will not work properly. Since the PIR and CIR are sofeware-configurable on ENETC v4. Therefore, the driver must reset them if they are not equal when reinitializing the TX BD ring. However, resetting the PIR and CIR alone is insufficient, it cannot completely solve the problem. When a link-down event occurs while the TX BD ring is transmitting frames, subsequent reinitialization of the TX BD ring may cause it to malfunction. Because enetc4_pl_mac_link_down() only clears PMa_COMMAND_CONFIG[TX_EN] to disable MAC transmit data path. It doesn't set PORT[TXDIS] to 1 to flush the TX BD ring. Therefore, it is not safe to reinitialize the TX BD ring at this point. To safely reinitialize the TX BD ring after a link-down event, we checked with the NETC IP team, a proper Ethernet MAC graceful stop is necessary. Therefore, add the Ethernet MAC graceful stop to the link-down event handler enetc4_pl_mac_link_down(). Note that this patch set is not applicable to ENETC v1 (LS1028A). ==================== Link: https://patch.msgid.link/20260324062121.2745033-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit f2df9567b123145a07ee4ea7440e233f5d0232cc Author: Wei Fang Date: Tue Mar 24 14:21:21 2026 +0800 net: enetc: do not access non-existent registers on pseudo MAC The ENETC4_PM_IEVENT and ENETC4_PM_CMD_CFG registers do not exist on the ENETC pseudo MAC, so the driver should prevent from accessing them. Fixes: 5175c1e4adca ("net: enetc: add basic support for the ENETC with pseudo MAC for i.MX94") Signed-off-by: Wei Fang Tested-by: Claudiu Manoil Reviewed-by: Claudiu Manoil Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260324062121.2745033-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 2725d84efe2582c0a4b907e74a689d26b2dbd382 Author: Wei Fang Date: Tue Mar 24 14:21:20 2026 +0800 net: enetc: add graceful stop to safely reinitialize the TX Ring For ENETC v4, the PIR and CIR will be reset if they are not equal when reinitializing the TX BD ring. However, resetting the PIR and CIR alone is insufficient. When a link-down event occurs while the TX BD ring is transmitting frames, subsequent reinitialization of the TX BD ring may cause it to malfunction. For example, the below steps can reproduce the problem. 1. Unplug the cable when the TX BD ring is busy transmitting frames. 2. Disable the network interface (ifconfig eth0 down). 3. Re-enable the network interface (ifconfig eth0 up). 4. Plug in the cable, the TX BD ring may fail to transmit packets. When the link-down event occurs, enetc4_pl_mac_link_down() only clears PMa_COMMAND_CONFIG[TX_EN] to disable MAC transmit data path. It doesn't set PORT[TXDIS] to 1 to flush the TX BD ring. Therefore, reinitializing the TX BD ring at this point is unsafe. To safely reinitialize the TX BD ring after a link-down event, we checked with the NETC IP team, a proper Ethernet MAC graceful stop is necessary. Therefore, add the Ethernet MAC graceful stop to the link-down event handler enetc4_pl_mac_link_down(). Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260324062121.2745033-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 0239fd701d33475a39428daa3dc627407cd417a6 Author: Wei Fang Date: Tue Mar 24 14:21:19 2026 +0800 net: enetc: reset PIR and CIR if they are not equal when initializing TX ring Currently the driver does not reset the producer index register (PIR) and consumer index register (CIR) when initializing a TX BD ring. The driver only reads the PIR and CIR and initializes the software indexes. If the TX BD ring is reinitialized when it still contains unsent frames, its PIR and CIR will not be equal after the reinitialization. However, the BDs between CIR and PIR have been freed and become invalid and this can lead to a hardware malfunction, causing the TX BD ring will not work properly. For ENETC v4, it supports software to set the PIR and CIR, so the driver can reset these two registers if they are not equal when reinitializing the TX BD ring. Therefore, add this solution for ENETC v4. Note that this patch does not work for ENETC v1 because it does not support software to set the PIR and CIR. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260324062121.2745033-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit e8e44c98f789dee45cfd24ffb9d4936e0606d7c6 Author: Buday Csaba Date: Tue Mar 24 14:32:30 2026 +0100 net: fec: fix the PTP periodic output sysfs interface When the PPS channel configuration was implemented, the channel index for the periodic outputs was configured as the hardware channel number. The sysfs interface uses a logical channel index, and rejects numbers greater than `n_per_out` (see period_store() in ptp_sysfs.c). That property was left at 1, since the driver implements channel selection, not simultaneous operation of multiple PTP hardware timer channels. A second check in fec_ptp_enable() returns -EOPNOTSUPP when the two channel numbers disagree, making channels 1..3 unusable from sysfs. Fix by removing this redundant check in the FEC PTP driver. Fixes: 566c2d83887f ("net: fec: make PPS channel configurable") Signed-off-by: Buday Csaba Link: https://patch.msgid.link/8ec2afe88423c2231f9cf8044d212ce57846670e.1774359059.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit 57a04a13aac1f247d171c3f3aef93efc69e6979e Author: Qingfang Deng Date: Tue Mar 24 22:08:56 2026 +0800 netdevsim: fix build if SKB_EXTENSIONS=n __skb_ext_put() is not declared if SKB_EXTENSIONS is not enabled, which causes a build error: drivers/net/netdevsim/netdev.c: In function 'nsim_forward_skb': drivers/net/netdevsim/netdev.c:114:25: error: implicit declaration of function '__skb_ext_put'; did you mean 'skb_ext_put'? [-Werror=implicit-function-declaration] 114 | __skb_ext_put(psp_ext); | ^~~~~~~~~~~~~ | skb_ext_put cc1: some warnings being treated as errors Add a stub to fix the build. Fixes: 7d9351435ebb ("netdevsim: drop PSP ext ref on forward failure") Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260324140857.783-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit 5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4 Author: Nicholas Carlini Date: Fri Mar 27 02:18:23 2026 +0000 io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check __io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte SQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the second half of the SQE would be past the end of the sq_sqes array. The current check tests (++sq_head & sq_mask) == 0, but sq_head is only incremented when a 128-byte SQE is encountered, not on every iteration. The actual array index is sq_idx = (i + sq_head) & sq_mask, which can be sq_mask (the last slot) while the wrap check passes. Fix by checking sq_idx directly. Keep the sq_head increment so the loop still skips the second half of the 128-byte SQE on the next iteration. Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED") Signed-off-by: Nicholas Carlini Link: https://patch.msgid.link/20260327021823.3138396-1-nicholas@carlini.com Signed-off-by: Jens Axboe commit 976ff48c2ac6e6b25b01428c9d7997bcd0fb2949 Author: Sven Eckelmann (Plasma Cloud) Date: Tue Mar 24 09:36:01 2026 +0100 net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled If the gmac0 is disabled, the precheck for a valid ingress device will cause a NULL pointer deref and crash the system. This happens because eth->netdev[0] will be NULL but the code will directly try to access netdev_ops. Instead of just checking for the first net_device, it must be checked if any of the mtk_eth net_devices is matching the netdev_ops of the ingress device. Cc: stable@vger.kernel.org Fixes: 73cfd947dbdb ("net: ethernet: mtk_eth_soc: ppe: prevent ppe update for non-mtk devices") Signed-off-by: Sven Eckelmann (Plasma Cloud) Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260324-wed-crash-gmac0-disabled-v1-1-3bc388aee565@simonwunderlich.de Signed-off-by: Jakub Kicinski commit f73896b4197ed53cf0894657c899265ef7c86b7a Author: Dipayaan Roy Date: Tue Mar 24 11:14:28 2026 -0700 net: mana: Fix RX skb truesize accounting MANA passes rxq->alloc_size to napi_build_skb() for all RX buffers. It is correct for fragment-backed RX buffers, where alloc_size matches the actual backing allocation used for each packet buffer. However, in the non-fragment RX path mana allocates a full page, or a higher-order page, per RX buffer. In that case alloc_size only reflects the usable packet area and not the actual backing memory. This causes napi_build_skb() to underestimate the skb backing allocation in the single-buffer RX path, so skb->truesize is derived from a value smaller than the real RX buffer allocation. Fix this by updating alloc_size in the non-fragment RX path to the actual backing allocation size before it is passed to napi_build_skb(). Fixes: 730ff06d3f5c ("net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.") Signed-off-by: Dipayaan Roy Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/acLUhLpLum6qrD/N@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Jakub Kicinski commit 629ec78ef8608d955ce217880cdc3e1873af3a15 Author: Sabrina Dubroca Date: Tue Mar 24 00:25:57 2026 +0100 mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses. This patch adds a seqcount, so that we get a consistent snapshot. Note that mpls_label_ok is also susceptible to this, so the check against RTA_DST in rtm_to_route_config, done outside platform_mutex, is not sufficient. This value gets passed to mpls_label_ok once more in both mpls_route_add and mpls_route_del, so there is no issue, but that additional check must not be removed. Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Fixes: 7720c01f3f590 ("mpls: Add a sysctl to control the size of the mpls label table") Fixes: dde1b38e873c ("mpls: Convert mpls_dump_routes() to RCU.") Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/cd8fca15e3eb7e212b094064cd83652e20fd9d31.1774284088.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 45dbf8fcea4dcf28cabcf4a1778e908feadf4c90 Merge: 453a4a5f97f0c9 789b06f9f39cdc Author: Jakub Kicinski Date: Thu Mar 26 17:51:39 2026 -0700 Merge tag 'wireless-2026-03-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple more fixes: - virt_wifi: remove SET_NETDEV_DEV to avoid UAF on teardown - iwlwifi: - fix (some) devices that don't have 6 GHz (WiFi6E) - fix potential OOB read of firmware notification - set WiFi generation for firmware to avoid packet drops - fix multi-link scan timing - wilc1000: fix integer overflow - ath11k/ath12k: fix TID during A-MPDU session teardown - wl1251: don't trust firmware TX status response index * tag 'wireless-2026-03-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() wifi: wl1251: validate packet IDs before indexing tx_frames wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation wifi: ath12k: Pass the correct value of each TID during a stop AMPDU session wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session wifi: iwlwifi: mld: correctly set wifi generation data wifi: iwlwifi: mvm: don't send a 6E related command when not supported wifi: iwlwifi: mld: Fix MLO scan timing ==================== Link: https://patch.msgid.link/20260326093329.77815-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 46b513250491a7bfc97d98791dbe6a10bcc8129d Merge: d813f421930c5b 34420cb92dbb9e Author: Linus Torvalds Date: Thu Mar 26 14:01:26 2026 -0700 Merge tag 'v7.0-rc5-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fix from Steve French: - Fix rebuild of mapping table * tag 'v7.0-rc5-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6: smb/client: ensure smb2_mapping_table rebuild on cmd changes commit 88bdac5443e5269bb39c4968d5ee0becbffe3f82 Author: Krzysztof Kozlowski Date: Wed Mar 25 13:22:10 2026 +0100 dt-bindings: display/msm: qcm2290-mdss: Fix missing ranges in example Device node has children with MMIO addressing, so must have ranges: msm/qcom,qcm2290-mdss.example.dtb: display-subsystem@5e00000 (qcom,qcm2290-mdss): 'ranges' is a required property Fixes: 966a08c293cb ("dt-bindings: display: msm: qcm2290-mdss: Fix iommus property") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Sumit Garg Link: https://lore.kernel.org/r/20260325122209.147128-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d813f421930c5b01b9f61043932de02602dd6ae3 Merge: 9c2b23a275ceb5 042f99c493c2ce Author: Linus Torvalds Date: Thu Mar 26 12:42:28 2026 -0700 Merge tag 'pm-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix two cpufreq issues, one in the core and one in the conservative governor, and two issues related to system sleep: - Restore the cpufreq core behavior changed inadvertently during the 6.19 development cycle to call cpufreq_frequency_table_cpuinfo() for cpufreq policies getting re-initialized which ensures that policy->max and policy->cpuinfo_max_freq will be valid going forward (Viresh Kumar) - Adjust the cached requested frequency in the conservative cpufreq governor on policy limits changes to prevent it from becoming stale in some cases (Viresh Kumar) - Prevent pm_restore_gfp_mask() from triggering a WARN_ON() in some code paths in which it is legitimately called without invoking pm_restrict_gfp_mask() previously (Youngjun Park) - Update snapshot_write_finalize() to take trailing zero pages into account properly which prevents user space restore from failing subsequently in some cases (Alberto Garcia)" * tag 'pm-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask() PM: hibernate: Drain trailing zero pages on userspace restore cpufreq: conservative: Reset requested_freq on limits change cpufreq: Don't skip cpufreq_frequency_table_cpuinfo() commit 9c2b23a275ceb52c7a0eeab6556f56e7257b2230 Merge: 2d74bd3c58abc5 7dfe9846016b15 Author: Linus Torvalds Date: Thu Mar 26 12:27:17 2026 -0700 Merge tag 'thermal-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "This prevents the int340x thermal driver from taking the power slider offset parameter into account incorrectly in some cases (Srinivas Pandruvada)" * tag 'thermal-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel: int340x: soc_slider: Set offset only for balanced mode commit 2d74bd3c58abc557d6ebb61e366fab4c5c501b80 Merge: 25b69ebe28c8e3 f6484cadbcaf26 Author: Linus Torvalds Date: Thu Mar 26 12:06:40 2026 -0700 Merge tag 'acpi-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fix from Rafael Wysocki: "Prevent use-after-free from occurring on reduced-hardware ACPI platforms when -EPROBE_DEFER is returned by ec_install_handlers() during ACPI EC driver initialization (Weiming Shi)" * tag 'acpi-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() commit 25b69ebe28c8e3f883b071e924b87d358db56047 Merge: 453a4a5f97f0c9 a23811061a553c Author: Linus Torvalds Date: Thu Mar 26 12:03:37 2026 -0700 Merge tag 'landlock-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull Landlock fixes from Mickaël Salaün: "This mainly fixes Landlock TSYNC issues related to interrupts and unexpected task exit. Other fixes touch documentation and sample, and a new test extends coverage" * tag 'landlock-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Expand restrict flags example for ABI version 8 selftests/landlock: Test tsync interruption and cancellation paths landlock: Clean up interrupted thread logic in TSYNC landlock: Serialize TSYNC thread restriction samples/landlock: Bump ABI version to 8 landlock: Improve TSYNC types landlock: Fully release unused TSYNC work entries landlock: Fix formatting commit 042f99c493c2cef3b15de2df19c06df514d39ac7 Merge: 6a28fb8cb28b9e a8d51efb5929ae Author: Rafael J. Wysocki Date: Thu Mar 26 18:44:46 2026 +0100 Merge branch 'pm-sleep' Merge fixes related to system sleep for 7.0-rc6: - Prevent pm_restore_gfp_mask() from triggering a WARN_ON() in some code paths in which it is legitimately called without invoking pm_restrict_gfp_mask() previously (Youngjun Park) - Update snapshot_write_finalize() to take trailing zero pages into account properly which prevents user space restore from failing subsequently in some cases (Alberto Garcia) * pm-sleep: PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask() PM: hibernate: Drain trailing zero pages on userspace restore commit 453a4a5f97f0c95b7df458e6afb98d4ab057d90b Merge: 75c78a4faa7efe db472c34a74770 Author: Linus Torvalds Date: Thu Mar 26 09:53:08 2026 -0700 Merge tag 'net-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth, CAN, IPsec and Netfilter. Notably, this includes the fix for the Bluetooth regression that you were notified about. I'm not aware of any other pending regressions. Current release - regressions: - bluetooth: - fix stack-out-of-bounds read in l2cap_ecred_conn_req - fix regressions caused by reusing ident - netfilter: revisit array resize logic - eth: ice: set max queues in alloc_etherdev_mqs() Previous releases - regressions: - core: correctly handle tunneled traffic on IPV6_CSUM GSO fallback - bluetooth: - fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - fix deadlock in l2cap_conn_del() - sched: codel: fix stale state for empty flows in fq_codel - ipv6: remove permanent routes from tb6_gc_hlist when all exceptions expire. - xfrm: fix skb_put() panic on non-linear skb during reassembly - openvswitch: - avoid releasing netdev before teardown completes - validate MPLS set/set_masked payload length - eth: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() Previous releases - always broken: - bluetooth: fix null-ptr-deref on l2cap_sock_ready_cb - udp: fix wildcard bind conflict check when using hash2 - netfilter: fix use of uninitialized rtp_addr in process_sdp - tls: Purge async_hold in tls_decrypt_async_wait() - xfrm: - prevent policy_hthresh.work from racing with netns teardown - fix skb leak with espintcp and async crypto - smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - can: - add missing error handling to call can_ctrlmode_changelink() - fix OOB heap access in cgw_csum_crc8_rel() - eth: - mana: fix use-after-free in add_adev() error path - virtio-net: fix for VIRTIO_NET_F_GUEST_HDRLEN - bcmasp: fix double free of WoL irq" * tag 'net-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (90 commits) net: macb: use the current queue number for stats netfilter: ctnetlink: use netlink policy range checks netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp netfilter: nf_conntrack_expect: skip expectations in other netns via proc netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ensure safe access to master conntrack netfilter: nf_conntrack_expect: use expect->helper netfilter: nf_conntrack_expect: honor expectation helper field netfilter: nft_set_rbtree: revisit array resize logic netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD tls: Purge async_hold in tls_decrypt_async_wait() selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry Bluetooth: btusb: clamp SCO altsetting table indices Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock Bluetooth: L2CAP: Fix send LE flow credits in ACL link net: mana: fix use-after-free in add_adev() error path ... commit 75c78a4faa7efe3180d1ba4b323464e30f948a43 Merge: dabb83ecf404c7 70f8915ea4e909 Author: Linus Torvalds Date: Thu Mar 26 08:35:51 2026 -0700 Merge tag 'pinctrl-v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Implement .get_direction() in the spmi-gpio gpio_chip Recent changes makes this start to print warnings and it's not nice, let's just fix it - Clamp the return value of gpio_get() in the Renesas RZA1 driver - Add the GPIO_GENERIC dependency to the STM32 HDP driver - Modify the Mediatek driver to accept devices that do not use external interrupts (EINT) at all - Fix flag propagation in the Sunxi driver, so that we can fix an issue with uninitialized pins in a follow-up patch using said flags * tag 'pinctrl-v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: sunxi: fix gpiochip_lock_as_irq() failure when pinmux is unknown pinctrl: sunxi: pass down flags to pinctrl routines pinctrl: mediatek: common: Fix probe failure for devices without EINT pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC pinctrl: renesas: rza1: Normalize return value of gpio_get() pinctrl: qcom: spmi-gpio: implement .get_direction() pinctrl: renesas: rzt2h: Fix invalid wait context pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register() commit dabb83ecf404c74a75469e7694a0b891e71f61b7 Merge: 0138af2472dfde 2cdaff22ed26f1 Author: Linus Torvalds Date: Thu Mar 26 08:22:07 2026 -0700 Merge tag 'dma-mapping-7.0-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "A set of fixes for DMA-mapping subsystem, which resolve false- positive warnings from KMSAN and DMA-API debug (Shigeru Yoshida and Leon Romanovsky) as well as a simple build fix (Miguel Ojeda)" * tag 'dma-mapping-7.0-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: add missing `inline` for `dma_free_attrs` mm/hmm: Indicate that HMM requires DMA coherency RDMA/umem: Tell DMA mapping that UMEM requires coherency iommu/dma: add support for DMA_ATTR_REQUIRE_COHERENT attribute dma-direct: prevent SWIOTLB path when DMA_ATTR_REQUIRE_COHERENT is set dma-mapping: Introduce DMA require coherency attribute dma-mapping: Clarify valid conditions for CPU cache line overlap dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output dma-debug: Allow multiple invocations of overlapping entries dma: swiotlb: add KMSAN annotations to swiotlb_bounce() commit 190a8c48ff623c3d67cb295b4536a660db2012aa Author: Hao-Yu Yang Date: Fri Mar 13 20:47:56 2026 +0800 futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old mempolicy immediately via kmem_cache_free(). This creates a race where __futex_key_to_node() dereferences a freed mempolicy pointer, causing a use-after-free read of mpol->mode. [ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349) [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87 [ 151.415969] Call Trace: [ 151.416732] __asan_load2 (mm/kasan/generic.c:271) [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349) [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593) Fix by adding rcu to __mpol_put(). Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL") Reported-by: Hao-Yu Yang Suggested-by: Eric Dumazet Signed-off-by: Hao-Yu Yang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Eric Dumazet Acked-by: David Hildenbrand (Arm) Link: https://patch.msgid.link/20260324174418.GB1850007@noisy.programming.kicks-ass.net commit 19f94b39058681dec64a10ebeb6f23fe7fc3f77a Author: Peter Zijlstra Date: Thu Mar 26 13:35:53 2026 +0100 futex: Require sys_futex_requeue() to have identical flags Nicholas reported that his LLM found it was possible to create a UaF when sys_futex_requeue() is used with different flags. The initial motivation for allowing different flags was the variable sized futex, but since that hasn't been merged (yet), simply mandate the flags are identical, as is the case for the old style sys_futex() requeue operations. Fixes: 0f4b5f972216 ("futex: Add sys_futex_requeue()") Reported-by: Nicholas Carlini Signed-off-by: Peter Zijlstra (Intel) commit 0a28e06575b3f3b30c1e99fc08fa0907956f35a4 Author: Claudio Imbrenda Date: Thu Mar 26 14:17:19 2026 +0100 KVM: s390: Fix KVM_S390_VCPU_FAULT ioctl A previous commit changed the behaviour of the KVM_S390_VCPU_FAULT ioctl. The current (wrong) implementation will trigger a guest addressing exception if the requested address lies outside of a memslot, unless the VM is UCONTROL. Restore the previous behaviour by open coding the fault-in logic. Fixes: 3762e905ec2e ("KVM: s390: use __kvm_faultin_pfn()") Acked-by: Christian Borntraeger Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda commit a12cc7e3d6a62f26262c1940a526f0682fefa3ba Author: Claudio Imbrenda Date: Thu Mar 26 14:17:18 2026 +0100 KVM: s390: vsie: Fix guest page tables protection When shadowing, the guest page tables are write-protected, in order to trap changes and properly unshadow the shadow mapping for the nested guest. Already shadowed levels are skipped, so that only the needed levels are write protected. Currently the levels that get write protected are exactly one level too deep: the last level (nested guest memory) gets protected in the wrong way, and will be protected again correctly a few lines afterwards; most importantly, the highest non-shadowed level does *not* get write protected. Moreover, if the nested guest is running in a real address space, there are no DAT tables to shadow. Write protect the correct levels, so that all the levels that need to be protected are protected, and avoid double protecting the last level; skip attempting to shadow the DAT tables when the nested guest is running in a real address space. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Tested-by: Christian Borntraeger Reviewed-by: Janosch Frank Signed-off-by: Claudio Imbrenda commit 19d6c5b8044366c88c1b1f6e831c0661ff1ddd20 Author: Claudio Imbrenda Date: Thu Mar 26 14:17:17 2026 +0100 KVM: s390: vsie: Fix unshadowing while shadowing If shadowing causes the shadow gmap to get unshadowed, exit early to prevent an attempt to dereference the parent pointer, which at this point is NULL. Opportunistically add some more checks to prevent NULL parents. Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Fixes: e5f98a6899bd ("KVM: s390: Add some helper functions needed for vSIE") Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda commit 0ec456b8a53d78644af7363a225c182494c1dacf Author: Claudio Imbrenda Date: Thu Mar 26 14:17:16 2026 +0100 KVM: s390: vsie: Fix refcount overflow for shadow gmaps In most cases gmap_put() was not called when it should have. Add the missing gmap_put() in vsie_run(). Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank Signed-off-by: Claudio Imbrenda commit fd7bc612cf27f7c98764e86e2fba3511610fff20 Author: Claudio Imbrenda Date: Thu Mar 26 14:17:15 2026 +0100 KVM: s390: vsie: Fix nested guest memory shadowing Fix _do_shadow_pte() to use the correct pointer (guest pte instead of nested guest) to set up the new pte. Add a check to return -EOPNOTSUPP if the mapping for the nested guest is writeable but the same page in the guest is only read-only. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda commit 0f2b760a17126cb7940d410c99edfa14e928554c Author: Claudio Imbrenda Date: Thu Mar 26 14:17:14 2026 +0100 KVM: s390: Correctly handle guest mappings without struct page Introduce a new special softbit for large pages, like already presend for normal pages, and use it to mark guest mappings that do not have struct pages. Whenever a leaf DAT entry becomes dirty, check the special softbit and only call SetPageDirty() if there is an actual struct page. Move the logic to mark pages dirty inside _gmap_ptep_xchg() and _gmap_crstep_xchg_atomic(), to avoid needlessly duplicating the code. Fixes: 5a74e3d93417 ("KVM: s390: KVM-specific bitfields and helper functions") Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Reviewed-by: Christian Borntraeger Signed-off-by: Claudio Imbrenda commit 45921d0212d4a335680854c89a14efd01eae911a Author: Claudio Imbrenda Date: Thu Mar 26 14:17:13 2026 +0100 KVM: s390: Fix gmap_link() The slow path of the fault handler ultimately called gmap_link(), which assumed the fault was a major fault, and blindly called dat_link(). In case of minor faults, things were not always handled properly; in particular the prefix and vsie marker bits were ignored. Move dat_link() into gmap.c, renaming it accordingly. Once moved, the new _gmap_link() function will be able to correctly honour the prefix and vsie markers. This will cause spurious unshadows in some uncommon cases. Fixes: 94fd9b16cc67 ("KVM: s390: KVM page table management functions: lifecycle management") Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda commit 6f93d1ed6f46b7b0be288cc45250d67bceb28982 Author: Claudio Imbrenda Date: Thu Mar 26 14:17:12 2026 +0100 KVM: s390: vsie: Fix check for pre-existing shadow mapping When shadowing a nested guest, a check is performed and no shadowing is attempted if the nested guest is already shadowed. The existing check was incomplete; fix it by also checking whether the leaf DAT table entry in the existing shadow gmap has the same protection as the one specified in the guest DAT entry. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank Signed-off-by: Claudio Imbrenda commit b827ef02f409bd42c7e7fb82663b84753c0e5d14 Author: Claudio Imbrenda Date: Thu Mar 26 14:17:11 2026 +0100 KVM: s390: Remove non-atomic dat_crstep_xchg() In practice dat_crstep_xchg() is racy and hard to use correctly. Simply remove it and replace its uses with dat_crstep_xchg_atomic(). This solves some actual races that lead to system hangs / crashes. Opportunistically fix an alignment issue in _gmap_crstep_xchg_atomic(). Fixes: 589071eaaa8f ("KVM: s390: KVM page table management functions: clear and replace") Fixes: 94fd9b16cc67 ("KVM: s390: KVM page table management functions: lifecycle management") Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda commit 897cf98926429c8671a9009442883c2f62deae96 Author: Biju Das Date: Mon Mar 23 12:49:14 2026 +0000 irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common() Replace pm_runtime_put() with pm_runtime_put_sync() when irq_domain_create_hierarchy() fails to ensure the device suspends synchronously before devres cleanup disables runtime PM via pm_runtime_disable(). Fixes: 5ec8cabc3b86 ("irqchip/renesas-rzv2h: Use devm_pm_runtime_enable()") Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260323124917.41602-1-biju.das.jz@bp.renesas.com commit 0f54755343f56ac108cfd55173bc1b5c5376384d Author: Claudio Imbrenda Date: Thu Mar 26 14:17:10 2026 +0100 KVM: s390: vsie: Fix dat_split_ste() If the guest misbehaves and puts the page tables for its nested guest inside the memory of the nested guest itself, and the guest and nested guest are being mapped with large pages, the shadow mapping will lose synchronization with the actual mapping, since this will cause the large page with the vsie notification bit to be split, but the vsie notification bit will not be propagated to the resulting small pages. Fix this by propagating the vsie_notif bit from large pages to normal pages when splitting a large page. Fixes: 2db149a0a6c5 ("KVM: s390: KVM page table management functions: walks") Reviewed-by: Christoph Schlameuss Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank Signed-off-by: Claudio Imbrenda commit cfe02147e86307a17057ee4e3604f5f5919571d2 Author: Jassi Brar Date: Sun Mar 22 12:15:33 2026 -0500 irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment The mbox_client for qcom-mpm sends NULL doorbell messages via mbox_send_message() but never signals TX completion. Set knows_txdone=true and call mbox_client_txdone() after a successful send, matching the pattern used by other Qualcomm mailbox clients (smp2p, smsm, qcom_aoss etc). Fixes: a6199bb514d8a6 "irqchip: Add Qualcomm MPM controller driver" Signed-off-by: Jassi Brar Signed-off-by: Thomas Gleixner Reviewed-by: Douglas Anderson Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260322171533.608436-1-jassisinghbrar@gmail.com commit db472c34a74770f39318ddb1efa986c0a8d5d86a Merge: deec4f7b411a5a 8f15b5071b4548 Author: Paolo Abeni Date: Thu Mar 26 15:38:14 2026 +0100 Merge tag 'nf-26-03-26' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter for net This is v3, I kept back an ipset fix and another to tigthen the xtables interface to reject invalid combinations with the NFPROTO_ARP family. They need a bit more discussion. I fixed the issues reported by AI on patch 9 (add #ifdef to access ct zone, update nf_conntrack_broadcast and patch 10 (use better Fixes: tag). Thanks! The following patchset contains Netfilter fixes for *net*. Note that most bugs fixed here stem from 2.6 days, the large PR is not due to an increase in regressions. 1) Fix incorrect reject of set updates with nf_tables pipapo set avx2 backend. This comes with a regression test in patch 2. From Florian Westphal. 2) nfnetlink_log needs to zero padding to prevent infoleak to userspace, from Weiming Shi. 3) xtables ip6t_rt module never validated that addrnr length is within the allowed array boundary. Reject bogus values. From Ren Wei. 4) Fix high memory usage in rbtree set backend that was unwanted side-effect of the recently added binary search blob. From Pablo Neira Ayuso. 5) Patches 5 to 10, also from Pablo, address long-standing RCU safety bugs in conntracks handling of expectations: We can never safely defer a conntrack extension area without holding a reference. Yet expectation handling does so in multiple places. Fix this by avoiding the need to look into the master conntrack to begin with and by extending locked sections in a few places. 11) Fix use of uninitialized rtp_addr in the sip conntrack helper, also from Weiming Shi. 12) Add stricter netlink policy checks in ctnetlink, from David Carlier. This avoids undefined behaviour when userspace provides huge wscale value. netfilter pull request 26-03-26 * tag 'nf-26-03-26' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: ctnetlink: use netlink policy range checks netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp netfilter: nf_conntrack_expect: skip expectations in other netns via proc netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ensure safe access to master conntrack netfilter: nf_conntrack_expect: use expect->helper netfilter: nf_conntrack_expect: honor expectation helper field netfilter: nft_set_rbtree: revisit array resize logic netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry ==================== Link: https://patch.msgid.link/20260326125153.685915-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 0e764b9d46071668969410ec5429be0e2f38c6d3 Author: David Howells Date: Wed Mar 25 08:20:17 2026 +0000 netfs: Fix the handling of stream->front by removing it The netfs_io_stream::front member is meant to point to the subrequest currently being collected on a stream, but it isn't actually used this way by direct write (which mostly ignores it). However, there's a tracepoint which looks at it. Further, stream->front is actually redundant with stream->subrequests.next. Fix the potential problem in the direct code by just removing the member and using stream->subrequests.next instead, thereby also simplifying the code. Fixes: a0b4c7a49137 ("netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence") Reported-by: Paulo Alcantara Signed-off-by: David Howells Link: https://patch.msgid.link/4158599.1774426817@warthog.procyon.org.uk Reviewed-by: Paulo Alcantara (Red Hat) cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit deec4f7b411a5a5fc8b2f1907da5b8dd3061bb76 Merge: 72d96e4e24bbef b5e5797e3cd1fd Author: Paolo Abeni Date: Thu Mar 26 15:14:51 2026 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== For ice: Michal corrects call to alloc_etherdev_mqs() to provide maximum number of queues supported rather than currently allocated number of queues. Petr Oros fixes issues related to some ethtool operations in switchdev mode. For iavf: Kohei Enju corrects number of reported queues for ethtool statistics to absolute max as using current number could race and cause out-of-bounds issues. For idpf: Josh NULLs cdev_info pointer after freeing to prevent possible subsequent improper access. He also defers setting of refillqs value until after allocation to prevent possible NULL pointer dereference. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: idpf: only assign num refillqs if allocation was successful idpf: clear stale cdev_info ptr iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() ice: use ice_update_eth_stats() for representor stats ice: fix inverted ready check for VF representors ice: set max queues in alloc_etherdev_mqs() ==================== Link: https://patch.msgid.link/20260323205843.624704-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit e31c53a8060e134111ed095783fee0aa0c43b080 Author: Darrick J. Wong Date: Mon Mar 23 14:04:33 2026 -0700 xfs: remove file_path tracepoint data The xfile/xmbuf shmem file descriptions are no longer as detailed as they were when online fsck was first merged, because moving to static strings in commit 60382993a2e180 ("xfs: get rid of the xchk_xfile_*_descr calls") removed a memory allocation and hence a source of failure. However this makes encoding the description in the tracepoints sort of a waste of memory. David Laight also points out that file_path doesn't zero the whole buffer which causes exposure of stale trace bytes, and Steven Rostedt wonders why we're not using a dynamic array for the file path. I don't think this is worth fixing, so let's just rip it out. Cc: rostedt@goodmis.org Cc: david.laight.linux@gmail.com Link: https://lore.kernel.org/linux-xfs/20260323172204.work.979-kees@kernel.org/ Cc: stable@vger.kernel.org # v6.11 Fixes: 19ebc8f84ea12e ("xfs: fix file_path handling in tracepoints") Signed-off-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 70685c291ef82269180758130394ecdc4496b52c Author: Darrick J. Wong Date: Mon Mar 23 14:01:57 2026 -0700 xfs: don't irele after failing to iget in xfs_attri_recover_work xlog_recovery_iget* never set @ip to a valid pointer if they return an error, so this irele will walk off a dangling pointer. Fix that. Cc: stable@vger.kernel.org # v6.10 Fixes: ae673f534a3097 ("xfs: record inode generation in xattr update log intent items") Signed-off-by: Darrick J. Wong Reviewed-by: Long Li Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit b59efde9e6c122207c16169d3d0deb623956eae9 Author: Jens Axboe Date: Thu Mar 26 07:02:53 2026 -0600 io_uring/fdinfo: fix SQE_MIXED SQE displaying When displaying pending SQEs for a MIXED ring, each 128-byte SQE increments sq_head to skip the second slot, but the loop counter is not adjusted. This can cause the loop to read past sq_tail by one entry for each 128-byte SQE encountered, displaying SQEs that haven't been made consumable yet by the application. Match the kernel's own consumption logic in io_init_req() which decrements what's left when consuming the extra slot. Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED") Signed-off-by: Jens Axboe commit 45ebe43ea00d6b9f5b3e0db9c35b8ca2a96b7e70 Author: Maarten Lankhorst Date: Thu Mar 26 08:07:29 2026 +0100 Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" This reverts commit 6bee098b91417654703e17eb5c1822c6dfd0c01d. Den 2026-03-25 kl. 22:11, skrev Simona Vetter: > On Wed, Mar 25, 2026 at 10:26:40AM -0700, Guenter Roeck wrote: >> Hi, >> >> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote: >>> When trying to do a rather aggressive test of igt's "xe_module_load >>> --r reload" with a full desktop environment and game running I noticed >>> a few OOPSes when dereferencing freed pointers, related to >>> framebuffers and property blobs after the compositor exits. >>> >>> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit, >>> and immediately put the references from struct drm_file objects during >>> drm_dev_unplug(). >>> >> >> With this patch in v6.18.20, I get the warning backtraces below. >> The backtraces are gone with the patch reverted. > > Yeah, this needs to be reverted, reasoning below. Maarten, can you please > take care of that and feed the revert through the usual channels? I don't > think it's critical enough that we need to fast-track this into drm.git > directly. > > Quoting the patch here again: > >> drivers/gpu/drm/drm_file.c | 5 ++++- >> drivers/gpu/drm/drm_mode_config.c | 9 ++++++--- >> 2 files changed, 10 insertions(+), 4 deletions(-) >> >> diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c >> index ec820686b3021..f52141f842a1f 100644 >> --- a/drivers/gpu/drm/drm_file.c >> +++ b/drivers/gpu/drm/drm_file.c >> @@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file *file_priv) >> void drm_file_free(struct drm_file *file) >> { >> struct drm_device *dev; >> + int idx; >> >> if (!file) >> return; >> @@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file) >> >> drm_events_release(file); >> >> - if (drm_core_check_feature(dev, DRIVER_MODESET)) { >> + if (drm_core_check_feature(dev, DRIVER_MODESET) && >> + drm_dev_enter(dev, &idx)) { > > This is misplaced for two reasons: > > - Even if we'd want to guarantee that we hold a drm_dev_enter/exit > reference during framebuffer teardown, we'd need to do this > _consistently over all callsites. Not ad-hoc in just one place that a > testcase hits. This also means kerneldoc updates of the relevant hooks > and at least a bunch of acks from other driver people to document the > consensus. > > - More importantly, this is driver responsibilities in general unless we > have extremely good reasons to the contrary. Which means this must be > placed in xe. > >> drm_fb_release(file); >> drm_property_destroy_user_blobs(dev, file); >> + drm_dev_exit(idx); >> } >> >> if (drm_core_check_feature(dev, DRIVER_SYNCOBJ)) >> diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c >> index 84ae8a23a3678..e349418978f79 100644 >> --- a/drivers/gpu/drm/drm_mode_config.c >> +++ b/drivers/gpu/drm/drm_mode_config.c >> @@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct drm_device *dev) >> */ >> WARN_ON(!list_empty(&dev->mode_config.fb_list)); >> list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) { >> - struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]"); >> + if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) { >> + struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]"); > > This is also wrong: > > - Firstly, it's a completely independent bug, we do not smash two bugfixes > into one patch. > > - Secondly, it's again a driver bug: drm_mode_cleanup must be called when > the last drm_device reference disappears (hence the existence of > drmm_mode_config_init), not when the driver gets unbound. The fact that > this shows up in a callchain from a devres cleanup means the intel > driver gets this wrong (like almost everyone else because historically > we didn't know better). > > If we don't follow this rule, then we get races with this code here > running concurrently with drm_file fb cleanups, which just does not > work. Review pointed that out, but then shrugged it off with a confused > explanation: > > https://lore.kernel.org/all/e61e64c796ccfb17ae673331a3df4b877bf42d82.camel@linux.intel.com/ > > Yes this also means a lot of the other drm_device teardown that drivers > do happens way too early. There is a massive can of worms here of a > magnitude that most likely is much, much bigger than what you can > backport to stable kernels. Hotunplug is _hard_. Back to the drawing board, and fixing it in the intel display driver instead. Cc: Thomas Hellström Fixes: 6bee098b9141 ("drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug") Reported-by: Guenter Roeck Tested-by: Guenter Roeck Acked-by: Simona Vetter Signed-off-by: Maarten Lankhorst Link: https://patch.msgid.link/20260326082217.39941-2-dev@lankhorst.se commit 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5 Author: Paolo Valerio Date: Mon Mar 23 20:16:34 2026 +0100 net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat. ================================================================== BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027 CPU: [...] Tainted: [E]=UNSIGNED_MODULE Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 print_report+0x384/0x5e0 kasan_report+0xa0/0xf0 kasan_check_range+0xe8/0x190 __asan_memcpy+0x54/0x98 gem_get_ethtool_stats+0x54/0x78 [macb 926c13f3af83b0c6fe64badb21ec87d5e93fcf65] dev_ethtool+0x1220/0x38c0 dev_ioctl+0x4ac/0xca8 sock_do_ioctl+0x170/0x1d8 sock_ioctl+0x484/0x5d8 __arm64_sys_ioctl+0x12c/0x1b8 invoke_syscall+0xd4/0x258 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 The buggy address belongs to a 1-page vmalloc region starting at 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff00000a333000 pfn:0xa333 flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff) raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== Fix it by making sure the copied size only considers the active number of queues. Fixes: 512286bbd4b7 ("net: macb: Added some queue statistics") Signed-off-by: Paolo Valerio Reviewed-by: Nicolai Buchwitz Link: https://patch.msgid.link/20260323191634.2185840-1-pvalerio@redhat.com Signed-off-by: Paolo Abeni commit aa637b2cf303e1d133a5c4ad3ee397ad99ad3f14 Merge: 84a8335d830057 129fa608b6ad08 Author: Paolo Abeni Date: Thu Mar 26 13:46:55 2026 +0100 Merge tag 'for-net-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - L2CAP: Fix deadlock in l2cap_conn_del() - L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - L2CAP: Fix send LE flow credits in ACL link - btintel: serialize btintel_hw_error() with hci_req_sync_lock - btusb: clamp SCO altsetting table indices * tag 'for-net-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: btusb: clamp SCO altsetting table indices Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock Bluetooth: L2CAP: Fix send LE flow credits in ACL link ==================== Link: https://patch.msgid.link/20260325194358.618892-1-luiz.dentz@gmail.com Signed-off-by: Paolo Abeni commit e98137f0a874ab36d0946de4707aa48cb7137d1c Author: Alex Williamson Date: Mon Mar 23 15:56:58 2026 -0600 vfio/pci: Fix double free in dma-buf feature The error path through vfio_pci_core_feature_dma_buf() ignores its own advice to only use dma_buf_put() after dma_buf_export(), instead falling through the entire unwind chain. In the unlikely event that we encounter file descriptor exhaustion, this can result in an unbalanced refcount on the vfio device and double free of allocated objects. Avoid this by moving the "put" directly into the error path and return the errno rather than entering the unwind chain. Reported-by: Renato Marziano Fixes: 5d74781ebc86 ("vfio/pci: Add dma-buf export support for MMIO regions") Cc: stable@vger.kernel.org Acked-by: Leon Romanovsky Signed-off-by: Alex Williamson Link: https://lore.kernel.org/r/20260323215659.2108191-3-alex.williamson@nvidia.com Reviewed-by: Jason Gunthorpe Signed-off-by: Alex Williamson commit 8f15b5071b4548b0aafc03b366eb45c9c6566704 Author: David Carlier Date: Wed Mar 25 14:11:08 2026 +0100 netfilter: ctnetlink: use netlink policy range checks Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths, so that the netlink core rejects invalid values early and can generate extack errors. - CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at policy level, removing the manual >= TCP_CONNTRACK_MAX check. - CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE (14). The normal TCP option parsing path already clamps to this value, but the ctnetlink path accepted 0-255, causing undefined behavior when used as a u32 shift count. - CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with CTA_FILTER_F_ALL, removing the manual mask checks. - CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding a new mask define grouping all valid expect flags. Extracted from a broader nf-next patch by Florian Westphal, scoped to ctnetlink for the fixes tree. Fixes: c8e2078cfe41 ("[NETFILTER]: ctnetlink: add support for internal tcp connection tracking flags handling") Signed-off-by: David Carlier Co-developed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 6a2b724460cb67caed500c508c2ae5cf012e4db4 Author: Weiming Shi Date: Wed Mar 25 14:11:07 2026 +0100 netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp process_sdp() declares union nf_inet_addr rtp_addr on the stack and passes it to the nf_nat_sip sdp_session hook after walking the SDP media descriptions. However rtp_addr is only initialized inside the media loop when a recognized media type with a non-zero port is found. If the SDP body contains no m= lines, only inactive media sections (m=audio 0 ...) or only unrecognized media types, rtp_addr is never assigned. Despite that, the function still calls hooks->sdp_session() with &rtp_addr, causing nf_nat_sdp_session() to format the stale stack value as an IP address and rewrite the SDP session owner and connection lines with it. With CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this results in the session-level o= and c= addresses being rewritten to 0.0.0.0 for inactive SDP sessions. Without stack auto-init the rewritten address is whatever happened to be on the stack. Fix this by pre-initializing rtp_addr from the session-level connection address (caddr) when available, and tracking via a have_rtp_addr flag whether any valid address was established. Skip the sdp_session hook entirely when no valid address exists. Fixes: 4ab9e64e5e3c ("[NETFILTER]: nf_nat_sip: split up SDP mangling") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 3db5647984de03d9cae0dcddb509b058351f0ee4 Author: Pablo Neira Ayuso Date: Wed Mar 25 14:11:06 2026 +0100 netfilter: nf_conntrack_expect: skip expectations in other netns via proc Skip expectations that do not reside in this netns. Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's conntrack entries via proc"). Fixes: 9b03f38d0487 ("netfilter: netns nf_conntrack: per-netns expectations") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b341c1176f2e001b3adf0b47154fc31589f7410e Author: Marc Kleine-Budde Date: Thu Mar 19 19:38:12 2026 +0100 spi: spi-fsl-lpspi: fix teardown order issue (UAF) There is a teardown order issue in the driver. The SPI controller is registered using devm_spi_register_controller(), which delays unregistration of the SPI controller until after the fsl_lpspi_remove() function returns. As the fsl_lpspi_remove() function synchronously tears down the DMA channels, a running SPI transfer triggers the following NULL pointer dereference due to use after free: | fsl_lpspi 42550000.spi: I/O Error in DMA RX | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] | Call trace: | fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi] | fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi] | spi_transfer_one_message+0x49c/0x7c8 | __spi_pump_transfer_message+0x120/0x420 | __spi_sync+0x2c4/0x520 | spi_sync+0x34/0x60 | spidev_message+0x20c/0x378 [spidev] | spidev_ioctl+0x398/0x750 [spidev] [...] Switch from devm_spi_register_controller() to spi_register_controller() in fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in fsl_lpspi_remove(). Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-fixes-v1-1-b433e435b2d8@pengutronix.de Signed-off-by: Mark Brown commit 02a3231b6d82efe750da6554ebf280e4a6f78756 Author: Pablo Neira Ayuso Date: Wed Mar 25 22:39:55 2026 +0100 netfilter: nf_conntrack_expect: store netns and zone in expectation __nf_ct_expect_find() and nf_ct_expect_find_get() are called under rcu_read_lock() but they dereference the master conntrack via exp->master. Since the expectation does not hold a reference on the master conntrack, this could be dying conntrack or different recycled conntrack than the real master due to SLAB_TYPESAFE_RCU. Store the netns, the master_tuple and the zone in struct nf_conntrack_expect as a safety measure. This patch is required by the follow up fix not to dump expectations that do not belong to this netns. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 Author: Pablo Neira Ayuso Date: Wed Mar 25 14:11:04 2026 +0100 netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit f01794106042ee27e54af6fdf5b319a2fe3df94d Author: Pablo Neira Ayuso Date: Wed Mar 25 14:11:03 2026 +0100 netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb. Reported-by: Hyunwoo Kim Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9c42bc9db90a154bc61ae337a070465f3393485a Author: Pablo Neira Ayuso Date: Wed Mar 25 14:11:02 2026 +0100 netfilter: nf_conntrack_expect: honor expectation helper field The expectation helper field is mostly unused. As a result, the netfilter codebase relies on accessing the helper through exp->master. Always set on the expectation helper field so it can be used to reach the helper. nf_ct_expect_init() is called from packet path where the skb owns the ct object, therefore accessing exp->master for the newly created expectation is safe. This saves a lot of updates in all callsites to pass the ct object as parameter to nf_ct_expect_init(). This is a preparation patches for follow up fixes. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit fafdd92b9e30fe057740c5bb5cd4f92ecea9bf26 Author: Pablo Neira Ayuso Date: Wed Mar 25 14:11:01 2026 +0100 netfilter: nft_set_rbtree: revisit array resize logic Chris Arges reports high memory consumption with thousands of containers, this patch revisits the array allocation logic. For anonymous sets, start by 16 slots (which takes 256 bytes on x86_64). Expand it by x2 until threshold of 512 slots is reached, over that threshold, expand it by x1.5. For non-anonymous set, start by 1024 slots in the array (which takes 16 Kbytes initially on x86_64). Expand it by x1.5. Use set->ndeact to subtract deactivated elements when calculating the number of the slots in the array, otherwise the array size array gets increased artifically. Add special case shrink logic to deal with flush set too. The shrink logic is skipped by anonymous sets. Use check_add_overflow() to calculate the new array size. Add a WARN_ON_ONCE check to make sure elements fit into the new array size. Reported-by: Chris Arges Fixes: 7e43e0a1141d ("netfilter: nft_set_rbtree: translate rbtree to array for binary search") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9d3f027327c2fa265f7f85ead41294792c3296ed Author: Ren Wei Date: Wed Mar 25 14:11:00 2026 +0100 netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS. rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[]. Validate addrnr during rule installation so malformed rules are rejected before the match logic can use an out-of-range value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Yuhang Zheng Signed-off-by: Ren Wei Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7 Author: Weiming Shi Date: Wed Mar 25 14:10:58 2026 +0100 netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD __build_packet_message() manually constructs the NFULA_PAYLOAD netlink attribute using skb_put() and skb_copy_bits(), bypassing the standard nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes are allocated (including NLA alignment padding), only data_len bytes of actual packet data are copied. The trailing nla_padlen(data_len) bytes (1-3 when data_len is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket. Replace the manual attribute construction with nla_reserve(), which handles the tailroom check, header setup, and padding zeroing via __nla_reserve(). The subsequent skb_copy_bits() fills in the payload data on top of the properly initialized attribute. Fixes: df6fb868d611 ("[NETFILTER]: nfnetlink: convert to generic netlink attribute functions") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 7587fbf5adc23d180a5ea9aa6944292c22328703 Author: Sakari Ailus Date: Sat Mar 21 23:21:44 2026 +0200 media: ccs: Avoid deadlock in ccs_init_state() The sub-device state lock has been already acquired when ccs_init_state() is called. Do not try to acquire it again. Reported-by: David Heidelberg Fixes: a88883d1209c ("media: ccs: Rely on sub-device state locking") Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 7c39f48568e0aec9bf6988cdbf833fdf8af19901 Author: Ricardo Ribalda Date: Fri Mar 20 07:49:10 2026 +0000 media: uvcvideo: Fix bug in error path of uvc_alloc_urb_buffers Recent cleanup introduced a bug in the error path of uvc_alloc_urb_buffers(). If there is not enough memory for the allocation the following error will be triggered: [ 739.196672] UBSAN: shift-out-of-bounds in mm/page_alloc.c:1403:22 [ 739.196710] shift exponent 52 is too large for 32-bit type 'int' Resulting in: [ 740.464422] BUG: unable to handle page fault for address: fffffac1c0800000 The reason for the bug is that usb_free_noncoherent is called with an invalid size (0) instead of the actual size of the urb. This patch takes care of that. Reported-by: Marek Marczykowski-Górecki Closes: https://lore.kernel.org/linux-media/abycbXzYupZpGkvR@hyeyoo/T/#t Tested-by: Marek Marczykowski-Górecki Fixes: c824345288d1 ("media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer") Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260320-uvc-urb-free-error-v1-1-b12cc3762a19@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit d40a198e2b7821197c5c77b89d0130cc90f400f5 Author: Peter Ujfalusi Date: Thu Mar 26 09:56:18 2026 +0200 ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload It is unexpected, but allowed to have no initial payload for a bytes control and the code is prepared to handle this case, but the size check missed this corner case. Update the check for minimal size to allow the initial size to be 0. Cc: stable@vger.kernel.org Fixes: a653820700b8 ("ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls") Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Liam Girdwood Reviewed-by: Seppo Ingalsuo Reviewed-by: Kai Vehmanen Link: https://patch.msgid.link/20260326075618.1603-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit c7596f9001e2b83293e3658e4e1addde69bb335d Author: Conor Dooley Date: Tue Mar 3 11:24:06 2026 +0000 firmware: microchip: fail auto-update probe if no flash found There's no point letting the driver probe if there is no flash, as trying to do a firmware upload will fail. Move the code that attempts to get the flash from firmware upload to probe, and let it emit a message to users stating why auto-update is not supported. The code currently could have a problem if there's a flash in devicetree, but the system controller driver fails to get a pointer to it from the mtd subsystem, which will cause mpfs_sys_controller_get_flash() to return an error. Check for errors and null, instead of just null, in the new clause. CC: stable@vger.kernel.org Fixes: ec5b0f1193ad4 ("firmware: microchip: add PolarFire SoC Auto Update support") Signed-off-by: Conor Dooley commit 8d2e0cb3224c89275c5471c92850e7f74df80c20 Author: Johan Hovold Date: Wed Mar 25 15:53:19 2026 +0100 spi: fix use-after-free on managed registration failure The SPI API is asymmetric and the controller is freed as part of deregistration (unless it has been allocated using devm_spi_alloc_host/target()). A recent change converting the managed registration function to use devm_add_action_or_reset() inadvertently introduced a (mostly theoretical) regression where a non-devres managed controller could be freed as part of failed registration. This in turn would lead to use-after-free in controller driver error paths. Fix this by taking another reference before calling devm_add_action_or_reset() and not releasing it on errors for non-devres allocated controllers. An alternative would be a partial revert of the offending commit, but it is better to handle this explicitly until the API has been fixed (e.g. see 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation")). Fixes: b6376dbed8e1 ("spi: Simplify devm_spi_*_controller()") Reported-by: Felix Gu Link: https://lore.kernel.org/all/20260324145548.139952-1-ustc.gu@gmail.com/ Cc: Andy Shevchenko Signed-off-by: Johan Hovold Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260325145319.1132072-1-johan@kernel.org Signed-off-by: Mark Brown commit c6eea4ff846ed342a12cedf3af730a6204a8d97e Merge: c673efd5db2223 bfe6a264effcb6 Author: Mark Brown Date: Thu Mar 26 10:33:38 2026 +0000 ASoC: adau1372: Fix error handling in adau1372_set_power() Jihed Chaibi says: adau1372_set_power() had two related error handling issues in its enable path: clk_prepare_enable() was called but its return value discarded, and adau1372_enable_pll() was a void function that silently swallowed lock failures, leaving mclk enabled and adau1372->enabled set to true despite the device being in a broken state. Patch 1 fixes the unchecked clk_prepare_enable() by making adau1372_set_power() return int and propagating the error. Patch 2 converts adau1372_enable_pll() to return int and adds a full unwind in adau1372_set_power() if PLL lock fails, reversing the regcache, GPIO power-down, and clock state. commit bfe6a264effcb6fe99ad7ceaf9e8c7439fc9555b Author: Jihed Chaibi Date: Wed Mar 25 22:07:04 2026 +0100 ASoC: adau1372: Fix clock leak on PLL lock failure adau1372_enable_pll() was a void function that logged a dev_err() on PLL lock timeout but did not propagate the error. As a result, adau1372_set_power() would continue with adau1372->enabled set to true despite the PLL being unlocked, and the mclk left enabled with no corresponding disable on the error path. Convert adau1372_enable_pll() to return int, using -ETIMEDOUT on lock timeout and propagating regmap errors directly. In adau1372_set_power(), check the return value and unwind in reverse order: restore regcache to cache-only mode, reassert GPIO power-down, and disable the clock before returning the error. Signed-off-by: Jihed Chaibi Fixes: 6cd4c6459e47 ("ASoC: Add ADAU1372 audio CODEC support") Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20260325210704.76847-3-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 326fe8104a4020d30080d37ac8b6b43893cdebca Author: Jihed Chaibi Date: Wed Mar 25 22:07:03 2026 +0100 ASoC: adau1372: Fix unchecked clk_prepare_enable() return value adau1372_set_power() calls clk_prepare_enable() but discards the return value. If the clock enable fails, the driver proceeds to access registers on unpowered hardware, potentially causing silent corruption. Make adau1372_set_power() return int and propagate the error from clk_prepare_enable(). Update adau1372_set_bias_level() to return the error directly for the STANDBY and OFF cases. Signed-off-by: Jihed Chaibi Fixes: 6cd4c6459e47 ("ASoC: Add ADAU1372 audio CODEC support") Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20260325210704.76847-2-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit f078634c184a9b5ccaa056e8b8d6cd32f7bff1b6 Author: Liu Ying Date: Wed Mar 18 13:26:05 2026 +0800 drm/bridge: Fix refcount shown via debugfs for encoder_bridges_show() A typical bridge refcount value is 3 after a bridge chain is formed: - devm_drm_bridge_alloc() initializes the refcount value to be 1. - drm_bridge_add() gets an additional reference hence 2. - drm_bridge_attach() gets the third reference hence 3. This typical refcount value aligns with allbridges_show()'s behaviour. However, since encoder_bridges_show() uses drm_for_each_bridge_in_chain_scoped() to automatically get/put the bridge reference while iterating, a bogus reference is accidentally got when showing the wrong typical refcount value as 4 to users via debugfs. Fix this by caching the refcount value returned from kref_read() while iterating and explicitly decreasing the cached refcount value by 1 before showing it to users. Fixes: bd57048e4576 ("drm/bridge: use drm_for_each_bridge_in_chain_scoped()") Signed-off-by: Liu Ying Reviewed-by: Luca Ceresoli Tested-by: Luca Ceresoli Link: https://patch.msgid.link/20260318-drm-misc-next-2026-03-05-fix-encoder-bridges-refcount-v3-1-147fea581279@nxp.com Signed-off-by: Luca Ceresoli commit 62397b493e14107ae82d8b80938f293d95425bcb Author: Norbert Szetei Date: Wed Mar 25 18:26:13 2026 +0100 crypto: af-alg - fix NULL pointer dereference in scatterwalk The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent sendmsg() allocates a new SGL and chains it, but fails to clear the end marker on the previous SGL's last data entry. This causes the crypto scatterwalk to hit a premature end, returning NULL on sg_next() and leading to a kernel panic during dereference. Fix this by explicitly unmarking the end of the previous SGL when performing sg_chain() in af_alg_alloc_tsgl(). Fixes: 8ff590903d5f ("crypto: algif_skcipher - User-space interface for skcipher operations") Signed-off-by: Norbert Szetei Signed-off-by: Herbert Xu commit 6d89f743e57cb34e233a8217b394c7ee09abf225 Author: Mikulas Patocka Date: Wed Mar 25 16:31:38 2026 +0100 crypto: deflate - fix spurious -ENOSPC The code in deflate_decompress_one may erroneously return -ENOSPC even if it didn't run out of output space. The error happens under this condition: - Suppose that there are two input pages, the compressed data fits into the first page and the zlib checksum is placed in the second page. - The code iterates over the first page, decompresses the data and fully fills the destination buffer, zlib_inflate returns Z_OK becuse zlib hasn't seen the checksum yet. - The outer do-while loop is iterated again, acomp_walk_next_src sets the input parameters to the second page containing the checksum. - We go into the inner do-while loop, execute "dcur = acomp_walk_next_dst(&walk);". "dcur" is zero, so we break out of the loop and return -ENOSPC, despite the fact that the decompressed data fit into the destination buffer. In order to fix this bug, this commit changes the logic when to report the -ENOSPC error. We report the error if the destination buffer is empty *and* if zlib_inflate didn't make any progress consuming the input buffer. If zlib_inflate consumes the trailing checksum, we see that it made progress and we will not return -ENOSPC. Fixes: 08cabc7d3c86 ("crypto: deflate - Convert to acomp") Signed-off-by: Mikulas Patocka Signed-off-by: Herbert Xu commit 80688afb9c35b3934ce2d6be9973758915e2e0ef Author: Horia Geantă Date: Tue Mar 17 12:25:14 2026 +0200 crypto: caam - fix overflow on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be rounded to DMA cache alignment, as otherwise the hashed key may corrupt neighbouring memory. The copying is performed using kmemdup, however this leads to an overflow: reading more bytes (aligned_len - keylen) from the keylen source buffer. Fix this by replacing kmemdup with kmalloc, followed by memcpy. Fixes: 199354d7fb6e ("crypto: caam - Remove GFP_DMA and add DMA alignment padding") Signed-off-by: Horia Geantă Signed-off-by: Herbert Xu commit 5ddfdcbe10dc5f97afc4e46ca22be2be717e8caf Author: Horia Geantă Date: Tue Mar 17 12:25:13 2026 +0200 crypto: caam - fix DMA corruption on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be rounded to DMA cache alignment, as otherwise the hashed key may corrupt neighbouring memory. The rounding was performed, but never actually used for the allocation. Fix this by replacing kmemdup with kmalloc for a larger buffer, followed by memcpy. Fixes: 199354d7fb6e ("crypto: caam - Remove GFP_DMA and add DMA alignment padding") Reported-by: Paul Bunyan Signed-off-by: Horia Geantă Signed-off-by: Herbert Xu commit 4b56770d345524fc2acc143a2b85539cf7d74bc1 Author: Eric Biggers Date: Mon Mar 16 13:21:19 2026 -0700 crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This causes crashes (at least). Fix this by adding the flag like what the other drivers do. Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the registration function anyway. Reported-by: Zorro Lang Closes: https://lore.kernel.org/r/20260314080937.pghb4aa7d4je3mhh@dell-per750-06-vm-08.rhts.eng.pek2.redhat.com Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") Cc: stable@vger.kernel.org Cc: Akhil R Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 84a8335d8300576f1b377ae24abca1d9f197807f Author: Chuck Lever Date: Tue Mar 24 08:53:23 2026 -0400 tls: Purge async_hold in tls_decrypt_async_wait() The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns, every AEAD operation has completed and the engine no longer references those skbs, so they can be freed unconditionally. A subsequent patch adds batch async decryption to tls_sw_read_sock(), introducing a new call site that must drain pending AEAD operations and release held skbs. Move __skb_queue_purge(&ctx->async_hold) into tls_decrypt_async_wait() so the purge is centralized and every caller -- recvmsg's drain path, the -EBUSY fallback in tls_do_decryption(), and the new read_sock batch path -- releases held skbs on synchronization without each site managing the purge independently. This fixes a leak when tls_strp_msg_hold() fails part-way through, after having added some cloned skbs to the async_hold queue. tls_decrypt_sg() will then call tls_decrypt_async_wait() to process all pending decrypts, and drop back to synchronous mode, but tls_sw_recvmsg() only flushes the async_hold queue when one record has been processed in "fully-async" mode, which may not be the case here. Signed-off-by: Chuck Lever Reported-by: Yiming Qian Fixes: b8a6ff84abbc ("tls: wait for pending async decryptions if tls_strp_msg_hold fails") Link: https://patch.msgid.link/20260324-tls-read-sock-v5-1-5408befe5774@oracle.com [pabeni@redhat.com: added leak comment] Signed-off-by: Paolo Abeni commit c720fb57d56274213d027b3c5ab99080cf62a306 Author: Shenwei Wang Date: Tue Mar 24 14:21:29 2026 -0500 gpio: mxc: map Both Edge pad wakeup to Rising Edge Suspend may fail on i.MX8QM when Falling Edge is used as a pad wakeup trigger due to a hardware bug in the detection logic. Since the hardware does not support Both Edge wakeup, remap requests for Both Edge to Rising Edge by default to avoid hitting this issue. A warning is emitted when Falling Edge is selected on i.MX8QM. Fixes: f60c9eac54af ("gpio: mxc: enable pad wakeup on i.MX8x platforms") cc: stable@vger.kernel.org Reviewed-by: Peng Fan Signed-off-by: Shenwei Wang Link: https://patch.msgid.link/20260324192129.2797237-1-shenwei.wang@nxp.com Signed-off-by: Bartosz Golaszewski commit f63a9df7e3f9f842945d292a19d9938924f066f9 Author: Marc Buerg Date: Wed Mar 25 23:29:50 2026 +0100 sysctl: fix uninitialized variable in proc_do_large_bitmap proc_do_large_bitmap() does not initialize variable c, which is expected to be set to a trailing character by proc_get_long(). However, proc_get_long() only sets c when the input buffer contains a trailing character after the parsed value. If c is not initialized it may happen to contain a '-'. If this is the case proc_do_large_bitmap() expects to be able to parse a second part of the input buffer. If there is no second part an unjustified -EINVAL will be returned. Initialize c to 0 to prevent returning -EINVAL on valid input. Fixes: 9f977fb7ae9d ("sysctl: add proc_do_large_bitmap") Signed-off-by: Marc Buerg Reviewed-by: Joel Granados Signed-off-by: Joel Granados commit d0b224cf9ab12e86a4d1ca55c760dfaa5c19cbe7 Author: Aldo Conte Date: Wed Mar 25 12:32:16 2026 +0100 iio: light: veml6070: fix veml6070_read() return value veml6070_read() computes the sensor value in ret but returns 0 instead of the actual result. This causes veml6070_read_raw() to always report 0. Return the computed value instead of 0. Running make W=1 returns no errors. I was unable to test the patch because I do not have the hardware. Found by code inspection. Fixes: fc38525135dd ("iio: light: veml6070: use guard to handle mutex") Signed-off-by: Aldo Conte Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit cd7e1fef5a1ca1c4fcd232211962ac2395601636 Author: GuoHan Zhao Date: Wed Mar 25 20:02:46 2026 +0800 xen/privcmd: unregister xenstore notifier on module exit Commit 453b8fb68f36 ("xen/privcmd: restrict usage in unprivileged domU") added a xenstore notifier to defer setting the restriction target until Xenstore is ready. XEN_PRIVCMD can be built as a module, but privcmd_exit() leaves that notifier behind. Balance the notifier lifecycle by unregistering it on module exit. This is harmless even if xenstore was already ready at registration time and the notifier was never queued on the chain. Fixes: 453b8fb68f3641fe ("xen/privcmd: restrict usage in unprivileged domU") Signed-off-by: GuoHan Zhao Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260325120246.252899-1-zhaoguohan@kylinos.cn> commit 6bcfb7f46d667b04bd1a1169ccedf5fb699c60df Author: Bibo Mao Date: Thu Mar 26 14:29:09 2026 +0800 LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access() In function kvm_eiointc_regs_access(), the register base address is caculated from array base address plus offset, the offset is absolute value from the base address. The data type of array base address is u64, it should be converted into the "void *" type and then plus the offset. Cc: Fixes: d3e43a1f34ac ("LoongArch: KVM: Use 64-bit register definition for EIOINTC"). Reported-by: Aurelien Jarno Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431 Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit b97bd69eb0f67b5f961b304d28e9ba45e202d841 Author: Huacai Chen Date: Thu Mar 26 14:29:09 2026 +0800 LoongArch: KVM: Handle the case that EIOINTC's coremap is empty EIOINTC's coremap in eiointc_update_sw_coremap() can be empty, currently we get a cpuid with -1 in this case, but we actually need 0 because it's similar as the case that cpuid >= 4. This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[]. Cc: Fixes: 3956a52bc05bd81 ("LoongArch: KVM: Add EIOINTC read and write functions") Reported-by: Aurelien Jarno Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431 Signed-off-by: Huacai Chen commit 2db06c15d8c7a0ccb6108524e16cd9163753f354 Author: Huacai Chen Date: Thu Mar 26 14:29:09 2026 +0800 LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust kvm_get_vcpu_by_cpuid() takes a cpuid parameter whose type is int, so cpuid can be negative. Let kvm_get_vcpu_by_cpuid() return NULL for this case so as to make it more robust. This fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[]. Cc: Fixes: 73516e9da512adc ("LoongArch: KVM: Add vcpu mapping from physical cpuid") Reported-by: Aurelien Jarno Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131431 Signed-off-by: Huacai Chen commit e4878c37f6679fdea91b27a0f4e60a871f0b7bad Author: Xi Ruoyao Date: Thu Mar 26 14:29:09 2026 +0800 LoongArch: vDSO: Emit GNU_EH_FRAME correctly With -fno-asynchronous-unwind-tables and --no-eh-frame-hdr (the default of the linker), the GNU_EH_FRAME segment (specified by vdso.lds.S) is empty. This is not valid, as the current DWARF specification mandates the first byte of the EH frame to be the version number 1. It causes some unwinders to complain, for example the ClickHouse query profiler spams the log with messages: clickhouse-server[365854]: libunwind: unsupported .eh_frame_hdr version: 127 at 7ffffffb0000 Here "127" is just the byte located at the p_vaddr (0, i.e. the beginning of the vDSO) of the empty GNU_EH_FRAME segment. Cross- checking with /proc/365854/maps has also proven 7ffffffb0000 is the start of vDSO in the process VM image. In LoongArch the -fno-asynchronous-unwind-tables option seems just a MIPS legacy, and MIPS only uses this option to satisfy the MIPS-specific "genvdso" program, per the commit cfd75c2db17e ("MIPS: VDSO: Explicitly use -fno-asynchronous-unwind-tables"). IIRC it indicates some inherent limitation of the MIPS ELF ABI and has nothing to do with LoongArch. So we can simply flip it over to -fasynchronous-unwind-tables and pass --eh-frame-hdr for linking the vDSO, allowing the profilers to unwind the stack for statistics even if the sample point is taken when the PC is in the vDSO. However simply adjusting the options above would exploit an issue: when the libgcc unwinder saw the invalid GNU_EH_FRAME segment, it silently falled back to a machine-specific routine to match the code pattern of rt_sigreturn() and extract the registers saved in the sigframe if the code pattern is matched. As unwinding from signal handlers is vital for libgcc to support pthread cancellation etc., the fall-back routine had been silently keeping the LoongArch Linux systems functioning since Linux 5.19. But when we start to emit GNU_EH_FRAME with the correct format, fall-back routine will no longer be used and libgcc will fail to unwind the sigframe, and unwinding from signal handlers will no longer work, causing dozens of glibc test failures. To make it possible to unwind from signal handlers again, it's necessary to code the unwind info in __vdso_rt_sigreturn via .cfi_* directives. The offsets in the .cfi_* directives depend on the layout of struct sigframe, notably the offset of sigcontext in the sigframe. To use the offset in the assembly file, factor out struct sigframe into a header to allow asm-offsets.c to output the offset for assembly. To work around a long-term issue in the libgcc unwinder (the pc is unconditionally substracted by 1: doing so is technically incorrect for a signal frame), a nop instruction is included with the two real instructions in __vdso_rt_sigreturn in the same FDE PC range. The same hack has been used on x86 for a long time. Cc: stable@vger.kernel.org Fixes: c6b99bed6b8f ("LoongArch: Add VDSO and VSYSCALL support") Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen commit 95db0c9f526d583634cddb2e5914718570fbac87 Author: Huacai Chen Date: Thu Mar 26 14:29:09 2026 +0800 LoongArch: Workaround LS2K/LS7A GPU DMA hang bug 1. Hardware limitation: GPU, DC and VPU are typically PCI device 06.0, 06.1 and 06.2. They share some hardware resources, so when configure the PCI 06.0 device BAR1, DMA memory access cannot be performed through this BAR, otherwise it will cause hardware abnormalities. 2. In typical scenarios of reboot or S3/S4, DC access to memory through BAR is not prohibited, resulting in GPU DMA hangs. 3. Workaround method: When configuring the 06.0 device BAR1, turn off the memory access of DC, GPU and VPU (via DC's CRTC registers). Cc: stable@vger.kernel.org Signed-off-by: Qianhai Wu Signed-off-by: Huacai Chen commit 3a28daa9b7d7c2ddf2c722e9e95d7e0928bf0cd1 Author: Li Jun Date: Thu Mar 26 14:29:08 2026 +0800 LoongArch: Fix missing NULL checks for kstrdup() 1. Replace "of_find_node_by_path("/")" with "of_root" to avoid multiple calls to "of_node_put()". 2. Fix a potential kernel oops during early boot when memory allocation fails while parsing CPU model from device tree. Cc: stable@vger.kernel.org Signed-off-by: Li Jun Signed-off-by: Huacai Chen commit 0138af2472dfdef0d56fc4697416eaa0ff2589bd Merge: aba9da0905f141 2f0407ed923b7e Author: Linus Torvalds Date: Wed Mar 25 18:41:35 2026 -0700 Merge tag 'erofs-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Mark I/Os as failed when encountering short reads on file-backed mounts - Label GFP_NOIO in the BIO completion when the completion is in the process context, and directly call into the decompression to avoid deadlocks - Improve Kconfig descriptions to better highlight the overall efforts - Fix .fadvise() for page cache sharing * tag 'erofs-for-7.0-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix .fadvise() for page cache sharing erofs: update the Kconfig description erofs: add GFP_NOIO in the bio completion if needed erofs: set fileio bio failed in short read case commit aba9da0905f14106b368e0abf75220e744d27626 Merge: d2a43e7f89da55 a6fc88b22bc8d1 Author: Linus Torvalds Date: Wed Mar 25 18:14:19 2026 -0700 Merge tag 'rcu-fixes.v7.0-20260325a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU fixes from Boqun Feng: "Fix a regression introduced by commit c27cea4416a3 ("rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast"): BPF contexts can run with preemption disabled or scheduler locks held, so call_srcu() must work in all such contexts. Fix this by converting SRCU's spinlocks to raw spinlocks and avoiding scheduler lock acquisition in call_srcu() by deferring to an irq_work (similar to call_rcu_tasks_generic()), for both tree SRCU and tiny SRCU. Also fix a follow-on lockdep splat caused by srcu_node allocation under the newly introduced raw spinlock by deferring the allocation to grace-period worker context" * tag 'rcu-fixes.v7.0-20260325a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: srcu: Use irq_work to start GP in tiny SRCU rcu: Use an intermediate irq_work to start process_srcu() srcu: Push srcu_node allocation to GP when non-preemptible srcu: Use raw spinlocks so call_srcu() can be used under preempt_disable() commit 4c56a8ac6869855866de0bb368a4189739e1d24f Author: Tejun Heo Date: Wed Mar 25 07:23:48 2026 -1000 cgroup: Fix cgroup_drain_dying() testing the wrong condition cgroup_drain_dying() was using cgroup_is_populated() to test whether there are dying tasks to wait for. cgroup_is_populated() tests nr_populated_csets, nr_populated_domain_children and nr_populated_threaded_children, but cgroup_drain_dying() only needs to care about this cgroup's own tasks - whether there are children is cgroup_destroy_locked()'s concern. This caused hangs during shutdown. When systemd tried to rmdir a cgroup that had no direct tasks but had a populated child, cgroup_drain_dying() would enter its wait loop because cgroup_is_populated() was true from nr_populated_domain_children. The task iterator found nothing to wait for, yet the populated state never cleared because it was driven by live tasks in the child cgroup. Fix it by using cgroup_has_tasks() which only tests nr_populated_csets. v3: Fix cgroup_is_populated() -> cgroup_has_tasks() (Sebastian). v2: https://lore.kernel.org/r/20260323200205.1063629-1-tj@kernel.org Reported-by: Sebastian Andrzej Siewior Fixes: 1b164b876c36 ("cgroup: Wait for dying tasks to leave on rmdir") Signed-off-by: Tejun Heo Tested-by: Sebastian Andrzej Siewior commit beef2634f81f1c086208191f7228bce1d366493d Author: Namjae Jeon Date: Thu Mar 19 21:00:02 2026 +0900 ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound request consists of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) and the first command consumes nearly the entire max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16() with PATH_MAX, causing out-of-bounds write beyond the response buffer. In get_file_all_info(), there was a missing validation check for the client-provided OutputBufferLength before copying the filename into FileName field of the smb2_file_all_info structure. If the filename length exceeds the available buffer space, it could lead to potential buffer overflows or memory corruption during smbConvertToUTF16 conversion. This calculating the actual free buffer size using smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is insufficient and updating smbConvertToUTF16 to use the actual filename length (clamped by PATH_MAX) to ensure a safe copy operation. Cc: stable@vger.kernel.org Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound") Reported-by: Asim Viladi Oglu Manizada Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit d2a43e7f89da55d6f0f96aaadaa243f35557291e Merge: 51088b9d5f62cf 7a618ca9b9c476 Author: Linus Torvalds Date: Wed Mar 25 14:47:18 2026 -0700 Merge tag 'hardening-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - fix required Clang version for CC_HAS_COUNTED_BY_PTR (Nathan Chancellor) - update Coccinelle script used for kmalloc_obj * tag 'hardening-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: init/Kconfig: Require a release version of clang-22 for CC_HAS_COUNTED_BY_PTR coccinelle: kmalloc_obj: Remove default GFP_KERNEL arg commit 51088b9d5f62cf234d1a5008f65c4dd712919551 Merge: bbeb83d3182abe fbddf68d7b4e1e Author: Linus Torvalds Date: Wed Mar 25 14:43:06 2026 -0700 Merge tag 'platform-drivers-x86-v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: "Fixes and New HW Support. The trivial drop of unused gz_chain_head is not exactly fixes material but it allows other work to avoid problems so I decided to take it in along with the fixes. - amd/hsmp: Fix typo in error message - asus-armoury: Add support for G614FP, GA503QM, GZ302EAC, and GZ302EAC - asus-nb-wmi: Add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC - hp-wmi: Support for Omen 16-k0xxx, 16-wf1xxx, 16-xf0xxx - intel-hid: Disable wakeup_mode during hibernation - ISST: - Check HWP support before MSR access - Correct locked bit width - lenovo: wmi-gamezone: Drop unused gz_chain_head - olpc-xo175-ec: Fix overflow error message" * tag 'platform-drivers-x86-v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: ISST: Correct locked bit width platform/x86: intel-hid: disable wakeup_mode during hibernation platform/x86: asus-armoury: add support for GZ302EA and GZ302EAC platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC platform/x86/amd/hsmp: Fix typo in error message platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen platform/x86: lenovo: wmi-gamezone: Drop gz_chain_head platform/x86: ISST: Check HWP support before MSR access platform/x86: hp-wmi: Add support for Omen 16-k0xxx (8A4D) platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C76) platform/x86: hp-wmi: Add Omen 16-xf0xxx (8BCA) support platform/x86: asus-armoury: add support for G614FP platform/x86: asus-armoury: add support for GA503QM MAINTAINERS: change email address of Denis Benato commit 6caefcd9491c408a4d161f7b60c8bb3d956526dd Author: Florian Westphal Date: Wed Mar 25 14:10:56 2026 +0100 selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug This test will fail without the preceding commit ("netfilter: nft_set_pipapo_avx2: fix match retart if found element is expired"): reject overlapping range on add 0s [ OK ] reload with flush /dev/stdin:59:32-52: Error: Could not process rule: File exists add element inet filter test { 10.0.0.29 . 10.0.2.29 } Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d3c0037ffe1273fa1961e779ff6906234d6cf53c Author: Florian Westphal Date: Wed Mar 25 14:10:55 2026 +0100 netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -f foo. This works. Then, it reloads the set after a flush: (echo flush set t s; cat foo) | nft -f - This is expected to work, because its the same set after all and it was already loaded once. But with avx2, this fails: nft reports a clashing element. The reported clash is of following form: We successfully re-inserted a . b c . d Then we try to insert a . d avx2 finds the already existing a . d, which (due to 'flush set') is marked as invalid in the new generation. It skips the element and moves to next. Due to incorrect masking, the skip-step finds the next matching element *only considering the first field*, i.e. we return the already reinserted "a . b", even though the last field is different and the entry should not have been matched. No such error is reported for the generic c implementation (no avx2) or when the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback. Bisection points to 7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but that fix merely uncovers this bug. Before this commit, the wrong element is returned, but erronously reported as a full, identical duplicate. The root-cause is too early return in the avx2 match functions. When we process the last field, we should continue to process data until the entire input size has been consumed to make sure no stale bits remain in the map. Link: https://lore.kernel.org/netfilter-devel/20260321152506.037f68c0@elisabeth/ Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 754bd2b4a084b90b5e7b630e1f423061a9b9b761 Author: Guenter Roeck Date: Sun Mar 22 09:12:33 2026 -0700 hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h. Cc: Sanman Pradhan Fixes: ddbb4db4ced1b ("hwmon: (pmbus) Add regulator support") Reviewed-by: Sanman Pradhan Signed-off-by: Guenter Roeck commit cd658475e7694d58e1c40dabc1dacf8431ccedb2 Author: Guenter Roeck Date: Tue Mar 24 18:54:11 2026 -0700 hwmon: (pmbus) Introduce the concept of "write-only" attributes Attributes intended to clear sensor history are intended to be writeable only. Reading those attributes today results in reporting more or less random values. To avoid ABI surprises, have those attributes explicitly return 0 when reading. Fixes: 787c095edaa9d ("hwmon: (pmbus/core) Add support for rated attributes") Reviewed-by: Sanman Pradhan Signed-off-by: Guenter Roeck commit 805a5bd1c3f307d45ae4e9cf8915ef16d585a54a Author: Guenter Roeck Date: Tue Mar 24 16:41:07 2026 -0700 hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only Writing those attributes is not supported, so mark them as read-only. Prior to this change, attempts to write into these attributes returned an error. Mark boolean fields in struct pmbus_limit_attr and in struct pmbus_sensor_attr as bit fields to reduce configuration data size. The data is scanned only while probing, so performance is not a concern. Fixes: 6f183d33a02e6 ("hwmon: (pmbus) Add support for peak attributes") Reviewed-by: Sanman Pradhan Signed-off-by: Guenter Roeck commit 789b06f9f39cdc7e895bdab2c034e39c41c8f8d6 Author: Alexander Popov Date: Wed Mar 25 01:46:02 2026 +0300 wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for the virt_wifi net devices. However, unregistering a virt_wifi device in netdev_run_todo() can happen together with the device referenced by SET_NETDEV_DEV(). It can result in use-after-free during the ethtool operations performed on a virt_wifi device that is currently being unregistered. Such a net device can have the `dev.parent` field pointing to the freed memory, but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`. Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this: ================================================================== BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0 Read of size 2 at addr ffff88810cfc46f8 by task pm/606 Call Trace: dump_stack_lvl+0x4d/0x70 print_report+0x170/0x4f3 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kasan_report+0xda/0x110 ? __pm_runtime_resume+0xe2/0xf0 ? __pm_runtime_resume+0xe2/0xf0 __pm_runtime_resume+0xe2/0xf0 ethnl_ops_begin+0x49/0x270 ethnl_set_features+0x23c/0xab0 ? __pfx_ethnl_set_features+0x10/0x10 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xf/0xf0 ? local_clock+0x10/0x30 ? kasan_save_track+0x25/0x60 ? __kasan_kmalloc+0x7f/0x90 ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0 genl_family_rcv_msg_doit+0x1e7/0x2c0 ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 ? __pfx_cred_has_capability.isra.0+0x10/0x10 ? stack_trace_save+0x8e/0xc0 genl_rcv_msg+0x411/0x660 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_ethnl_set_features+0x10/0x10 netlink_rcv_skb+0x121/0x380 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_down_read+0x10/0x10 genl_rcv+0x23/0x30 netlink_unicast+0x60f/0x830 ? __pfx_netlink_unicast+0x10/0x10 ? __pfx___alloc_skb+0x10/0x10 netlink_sendmsg+0x6ea/0xbc0 ? __pfx_netlink_sendmsg+0x10/0x10 ? __futex_queue+0x10b/0x1f0 ____sys_sendmsg+0x7a2/0x950 ? copy_msghdr_from_user+0x26b/0x430 ? __pfx_____sys_sendmsg+0x10/0x10 ? __pfx_copy_msghdr_from_user+0x10/0x10 ___sys_sendmsg+0xf8/0x180 ? __pfx____sys_sendmsg+0x10/0x10 ? __pfx_futex_wait+0x10/0x10 ? fdget+0x2e4/0x4a0 __sys_sendmsg+0x11f/0x1c0 ? __pfx___sys_sendmsg+0x10/0x10 do_syscall_64+0xe2/0x570 ? exc_page_fault+0x66/0xb0 entry_SYSCALL_64_after_hwframe+0x77/0x7f This fix may be combined with another one in the ethtool subsystem: https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u Fixes: d43c65b05b848e0b ("ethtool: runtime-resume netdev parent in ethnl_ops_begin") Cc: stable@vger.kernel.org Signed-off-by: Alexander Popov Acked-by: Greg Kroah-Hartman Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260324224607.374327-1-alex.popov@linux.com Signed-off-by: Johannes Berg commit 129fa608b6ad08b8ab7178eeb2ec272c993aaccc Author: Pengpeng Hou Date: Wed Mar 25 08:42:45 2026 +0800 Bluetooth: btusb: clamp SCO altsetting table indices btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup currently indexes alts[] with data->sco_num - 1 without first constraining sco_num to the number of available table entries. While the table only defines alternate settings for up to three SCO links, data->sco_num comes from hci_conn_num() and is used directly. Cap the lookup to the last table entry before indexing it so the driver keeps selecting the highest supported alternate setting without reading past alts[]. Fixes: baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints") Signed-off-by: Pengpeng Hou Signed-off-by: Luiz Augusto von Dentz commit 25f420a0d4cfd61d3d23ec4b9c56d9f443d91377 Author: Hyunwoo Kim Date: Fri Mar 20 20:23:10 2026 +0900 Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED state to support L2CAP reconfiguration (e.g. MTU changes). However, since both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from the initial configuration, the reconfiguration path falls through to l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and retrans_list without freeing the previous allocations and sets chan->sdu to NULL without freeing the existing skb. This leaks all previously allocated ERTM resources. Additionally, l2cap_parse_conf_req() does not validate the minimum value of remote_mps derived from the RFC max_pdu_size option. A zero value propagates to l2cap_segment_sdu() where pdu_len becomes zero, causing the while loop to never terminate since len is never decremented, exhausting all available memory. Fix the double-init by skipping l2cap_ertm_init() and l2cap_chan_ready() when the channel is already in BT_CONNECTED state, while still allowing the reconfiguration parameters to be updated through l2cap_parse_conf_req(). Also add a pdu_len zero check in l2cap_segment_sdu() as a safeguard. Fixes: 96298f640104 ("Bluetooth: L2CAP: handle l2cap config request during open state") Signed-off-by: Hyunwoo Kim Signed-off-by: Luiz Augusto von Dentz commit 00fdebbbc557a2fc21321ff2eaa22fd70c078608 Author: Hyunwoo Kim Date: Fri Mar 20 20:01:26 2026 +0900 Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer and id_addr_timer while holding conn->lock. However, the work functions l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire conn->lock, creating a potential AB-BA deadlock if the work is already executing when l2cap_conn_del() takes the lock. Move the work cancellations before acquiring conn->lock and use disable_delayed_work_sync() to additionally prevent the works from being rearmed after cancellation, consistent with the pattern used in hci_conn_del(). Fixes: ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del") Signed-off-by: Hyunwoo Kim Signed-off-by: Luiz Augusto von Dentz commit 94d8e6fe5d0818e9300e514e095a200bd5ff93ae Author: Cen Zhang Date: Wed Mar 18 20:54:03 2026 +0800 Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock(). This lets it race against hci_dev_do_close() -> btintel_shutdown_combined(), which also runs __hci_cmd_sync() under the same lock. When both paths manipulate hdev->req_status/req_rsp concurrently, the close path may free the response skb first, and the still-running hw_error path hits a slab-use-after-free in kfree_skb(). Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it is serialized with every other synchronous HCI command issuer. Below is the data race report and the kasan report: BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined read of hdev->req_rsp at net/bluetooth/hci_sync.c:199 by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254 hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030 write/free by task ioctl/22580: btintel_shutdown_combined+0xd0/0x360 drivers/bluetooth/btintel.c:3648 hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246 hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526 BUG: KASAN: slab-use-after-free in sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202 Read of size 4 at addr ffff888144a738dc by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260 Fixes: 973bb97e5aee ("Bluetooth: btintel: Add generic function for handling hardware errors") Signed-off-by: Cen Zhang Signed-off-by: Luiz Augusto von Dentz commit f39f905e55f529b036321220af1ba4f4085564a5 Author: Zhang Chen Date: Thu Mar 19 17:32:11 2026 +0800 Bluetooth: L2CAP: Fix send LE flow credits in ACL link When the L2CAP channel mode is L2CAP_MODE_ERTM/L2CAP_MODE_STREAMING, l2cap_publish_rx_avail will be called and le flow credits will be sent in l2cap_chan_rx_avail, even though the link type is ACL. The logs in question as follows: > ACL Data RX: Handle 129 flags 0x02 dlen 12 L2CAP: Unknown (0x16) ident 4 len 4 40 00 ed 05 < ACL Data TX: Handle 129 flags 0x00 dlen 10 L2CAP: Command Reject (0x01) ident 4 len 2 Reason: Command not understood (0x0000) Bluetooth: Unknown BR/EDR signaling command 0x16 Bluetooth: Wrong link type (-22) Fixes: ce60b9231b66 ("Bluetooth: compute LE flow credits based on recvbuf space") Signed-off-by: Zhang Chen Signed-off-by: Luiz Augusto von Dentz commit 7b3b1e5a87b2f5e35c52b5386d7c327be869454f Author: Long Li Date: Mon Mar 16 14:07:42 2026 -0700 PCI: hv: Set default NUMA node to 0 for devices without affinity info When hv_pci_assign_numa_node() processes a device that does not have HV_PCI_DEVICE_FLAG_NUMA_AFFINITY set or has an out-of-range virtual_numa_node, the device NUMA node is left unset. On x86_64, the uninitialized default happens to be 0, but on ARM64 it is NUMA_NO_NODE (-1). Tests show that when no NUMA information is available from the Hyper-V host, devices perform best when assigned to node 0. With NUMA_NO_NODE the kernel may spread work across NUMA nodes, which degrades performance on Hyper-V, particularly for high-throughput devices like MANA. Always set the device NUMA node to 0 before the conditional NUMA affinity check, so that devices get a performant default when the host provides no NUMA information, and behavior is consistent on both x86_64 and ARM64. Fixes: 999dd956d838 ("PCI: hv: Add support for protocol 1.3 and support PCI_BUS_RELATIONS2") Signed-off-by: Long Li Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit ed8444006df9863ffa682e315352c44a49d9f4cb Author: Marek Vasut Date: Tue Mar 24 15:33:28 2026 +0100 arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM Mark the first 128 MiB of DRAM as reserved. The first 128 MiB of DRAM may optionally be used by TFA and other firmware for its own purposes, and in such case, Linux must not use this memory. On this platform, U-Boot runs in EL3 and starts TFA BL31 and Linux from a single combined fitImage. U-Boot has full access to all memory in the 0x40000000..0xbfffffff range, as well memory in the memory banks in the 64-bit address ranges, and therefore U-Boot patches this full complete view of platform memory layout into the DT that is passed to the next stage. The next stage is TFA BL31 and then the Linux kernel. The TFA BL31 does not modify the DT passed from U-Boot to TFA BL31 and then to Linux with any new reserved-memory {} node to reserve memory areas used by the TFA BL31 to prevent the next stage from using those areas, which lets Linux to use all of the available DRAM as described in the DT that was passed in by U-Boot, including the areas that are newly utilized by TFA BL31. In case of high DRAM utilization, for example in case of four instances of "memtester 3900M" running in parallel, unless the memory used by TFA BL31 is properly reserved, Linux may use and corrupt the memory used by TFA BL31, which would often lead to system becoming unresponsive. Until TFA BL31 can properly fill its own reserved-memory node into the DT, and to assure older versions of TFA BL31 do not cause problems, add explicitly reserved-memory {} node which prevents Linux from using the first 128 MiB of DRAM. Note that TFA BL31 can be adjusted to use different memory areas, this newly added reserved-memory {} node follows longer-term practice on the R-Car SoCs where the first 128 MiB of DRAM is reserved for firmware use. In case user does modify TFA BL31 to use different memory ranges, they must either use a future version of TFA BL31 which properly patches a reserved-memory {} node into the DT, or they must adjust the address ranges of this reserved-memory {} node accordingly. Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support") Cc: stable@vger.kernel.org Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260324143342.17872-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit a6fc88b22bc8d12ad52e8412c667ec0f5bf055af Author: Joel Fernandes Date: Mon Mar 23 20:14:18 2026 -0400 srcu: Use irq_work to start GP in tiny SRCU Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock. This causes a lockdep splat when call_srcu() is called with a scheduler lock held, due to: call_srcu() [holding pi_lock] srcu_gp_start_if_needed() schedule_work() -> pool->lock workqueue_init() / create_worker() [holding pool->lock] wake_up_process() -> try_to_wake_up() -> pi_lock Also add irq_work_sync() to cleanup_srcu_struct() to prevent a use-after-free if a queued irq_work fires after cleanup begins. Tested with rcutorture SRCU-T and no lockdep warnings. [ Thanks to Boqun for similar fix in patch "rcu: Use an intermediate irq_work to start process_srcu()" ] Signed-off-by: Joel Fernandes Reviewed-by: Paul E. McKenney Signed-off-by: Boqun Feng commit 7c405fb3279b39244b260b54f1bd6488689ae235 Author: Boqun Feng Date: Wed Mar 18 17:56:21 2026 -0700 rcu: Use an intermediate irq_work to start process_srcu() Since commit c27cea4416a3 ("rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast") we switched to SRCU in BPF. However as BPF instrument can happen basically everywhere (including where a scheduler lock is held), call_srcu() now needs to avoid acquiring scheduler lock because otherwise it could cause deadlock [1]. Fix this by following what the previous RCU Tasks Trace did: using an irq_work to delay the queuing of the work to start process_srcu(). [boqun: Apply Joel's feedback] [boqun: Apply Andrea's test feedback] Reported-by: Andrea Righi Closes: https://lore.kernel.org/all/abjzvz_tL_siV17s@gpd4/ Fixes: commit c27cea4416a3 ("rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast") Link: https://lore.kernel.org/rcu/3c4c5a29-24ea-492d-aeee-e0d9605b4183@nvidia.com/ [1] Suggested-by: Zqiang Tested-by: Andrea Righi Tested-by: Paul E. McKenney Tested-by: Joel Fernandes Signed-off-by: Boqun Feng commit 61bbcfb50514a8a94e035a7349697a3790ab4783 Author: Paul E. McKenney Date: Fri Mar 20 20:29:20 2026 -0700 srcu: Push srcu_node allocation to GP when non-preemptible When the srcutree.convert_to_big and srcutree.big_cpu_lim kernel boot parameters specify initialization-time allocation of the srcu_node tree for statically allocated srcu_struct structures (for example, in DEFINE_SRCU() at build time instead of init_srcu_struct() at runtime), init_srcu_struct_nodes() will attempt to dynamically allocate this tree at the first run-time update-side use of this srcu_struct structure, but while holding a raw spinlock. Because the memory allocator can acquire non-raw spinlocks, this can result in lockdep splats. This commit therefore uses the same SRCU_SIZE_ALLOC trick that is used when the first run-time update-side use of this srcu_struct structure happens before srcu_init() is called. The actual allocation then takes place from workqueue context at the ends of upcoming SRCU grace periods. [boqun: Adjust the sha1 of the Fixes tag] Fixes: 175b45ed343a ("srcu: Use raw spinlocks so call_srcu() can be used under preempt_disable()") Signed-off-by: Paul E. McKenney Signed-off-by: Boqun Feng commit 175b45ed343a9c547b5f45293d3ea08d38a7b6f4 Author: Paul E. McKenney Date: Sat Mar 14 04:12:58 2026 -0700 srcu: Use raw spinlocks so call_srcu() can be used under preempt_disable() Tree SRCU has used non-raw spinlocks for many years, motivated by a desire to avoid unnecessary real-time latency and the absence of any reason to use raw spinlocks. However, the recent use of SRCU in tracing as the underlying implementation of RCU Tasks Trace means that call_srcu() is invoked from preemption-disabled regions of code, which in turn requires that any locks acquired by call_srcu() or its callees must be raw spinlocks. This commit therefore converts SRCU's spinlocks to raw spinlocks. [boqun: Add Fixes tag] Reported-by: Kumar Kartikeya Dwivedi Fixes: c27cea4416a3 ("rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast") Signed-off-by: Paul E. McKenney Signed-off-by: Boqun Feng Cc: Sebastian Andrzej Siewior commit e398978ddf18fe5a2fc8299c77e6fe50e6c306c4 Author: Petr Mladek Date: Wed Mar 25 13:34:18 2026 +0100 workqueue: Better describe stall check Try to be more explicit why the workqueue watchdog does not take pool->lock by default. Spin locks are full memory barriers which delay anything. Obviously, they would primary delay operations on the related worker pools. Explain why it is enough to prevent the false positive by re-checking the timestamp under the pool->lock. Finally, make it clear what would be the alternative solution in __queue_work() which is a hotter path. Signed-off-by: Petr Mladek Acked-by: Song Liu Signed-off-by: Tejun Heo commit c673efd5db2223c2e8b885025bcd96bca6cdb171 Author: Shuming Fan Date: Wed Mar 25 19:04:06 2026 +0800 ASoC: SDCA: fix finding wrong entity This patch fixes an issue like: where searching for the entity 'FU 11' could incorrectly match 'FU 113' first. The driver should first perform an exact match on the full string name. If no exact match is found, it can then fall back to a partial match. Fixes: 48fa77af2f4a ("ASoC: SDCA: Add terminal type into input/output widget name") Reviewed-by: Charles Keepax Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20260325110406.3232420-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 87a70013be7d1b96e7e160aea6dad4564b459868 Author: Jianmin Lv Date: Fri Mar 20 18:10:12 2026 +0800 MAINTAINERS: Update GPU driver maintainer information I and Qianhai are GPU R&D engineers at Loongson, specializing in kernel driver development. We understand that the current Loongson GPU driver lacks dedicated maintenance resources because of some reasons. As Loongson GPU driver developers, we have both the capability and the responsibility to continuously maintain the Loongson GPU driver, ensuring minimal impact on its users. After internal discussions, our team has decided to recommend me and Qianhai to take over the maintenance responsibilities, and recommend Huacai, Mingcong and Ruoyao to help to review. And We'll continue to maintain it for current supported chips and drive future updates according to chip support plan. Signed-off-by: Jianmin Lv Acked-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260320101012.22714-1-lvjianmin@loongson.cn commit bf08749a6abb6d1959bfdc0edc32c640df407558 Author: Sanman Pradhan Date: Wed Mar 25 05:13:06 2026 +0000 hwmon: (adm1177) fix sysfs ABI violation and current unit conversion The adm1177 driver exposes the current alert threshold through hwmon_curr_max_alarm. This violates the hwmon sysfs ABI, where *_alarm attributes are read-only status flags and writable thresholds must use currN_max. The driver also stores the threshold internally in microamps, while currN_max is defined in milliamps. Convert the threshold accordingly on both the read and write paths. Widen the cached threshold and related calculations to 64 bits so that small shunt resistor values do not cause truncation or overflow. Also use 64-bit arithmetic for the mA/uA conversions, clamp writes to the range the hardware can represent, and propagate failures from adm1177_write_alert_thr() instead of silently ignoring them. Update the hwmon documentation to reflect the attribute rename and the correct units returned by the driver. Fixes: 09b08ac9e8d5 ("hwmon: (adm1177) Add ADM1177 Hot Swap Controller and Digital Power Monitor driver") Signed-off-by: Sanman Pradhan Acked-by: Nuno Sá Link: https://lore.kernel.org/r/20260325051246.28262-1-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit c991ca3238410b611a2ce59adeca9b55850aff69 Author: Shuming Fan Date: Wed Mar 25 17:20:17 2026 +0800 ASoC: SDCA: remove the max count of initialization table The number of the initialization table may exceed 2048. Therefore, this patch removes the limitation and allows the driver to allocate memory dynamically based on the size of the initialization table. Signed-off-by: Shuming Fan Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260325092017.3221640-1-shumingf@realtek.com Signed-off-by: Mark Brown commit bfe9e314d7574d1c5c851972e7aee342733819d2 Author: Matthew Auld Date: Wed Mar 18 10:02:09 2026 +0000 drm/xe: always keep track of remap prev/next During 3D workload, user is reporting hitting: [ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_queue/9925 [ 413.361944] CPU: 7 UID: 1000 PID: 9925 Comm: vkd3d_queue Kdump: loaded Not tainted 7.0.0-070000rc3-generic #202603090038 PREEMPT(lazy) [ 413.361949] RIP: 0010:vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe] [ 413.362074] RSP: 0018:ffffd4c25c3df930 EFLAGS: 00010282 [ 413.362077] RAX: 0000000000000000 RBX: ffff8f3ee817ed10 RCX: 0000000000000000 [ 413.362078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 413.362079] RBP: ffffd4c25c3df980 R08: 0000000000000000 R09: 0000000000000000 [ 413.362081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8f41fbf99380 [ 413.362082] R13: ffff8f3ee817e968 R14: 00000000ffffffef R15: ffff8f43d00bd380 [ 413.362083] FS: 00000001040ff6c0(0000) GS:ffff8f4696d89000(0000) knlGS:00000000330b0000 [ 413.362085] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 413.362086] CR2: 00007ddfc4747000 CR3: 00000002e6262005 CR4: 0000000000f72ef0 [ 413.362088] PKRU: 55555554 [ 413.362089] Call Trace: [ 413.362092] [ 413.362096] xe_vm_bind_ioctl+0xa9a/0xc60 [xe] Which seems to hint that the vma we are re-inserting for the ops unwind is either invalid or overlapping with something already inserted in the vm. It shouldn't be invalid since this is a re-insertion, so must have worked before. Leaving the likely culprit as something already placed where we want to insert the vma. Following from that, for the case where we do something like a rebind in the middle of a vma, and one or both mapped ends are already compatible, we skip doing the rebind of those vma and set next/prev to NULL. As well as then adjust the original unmap va range, to avoid unmapping the ends. However, if we trigger the unwind path, we end up with three va, with the two ends never being removed and the original va range in the middle still being the shrunken size. If this occurs, one failure mode is when another unwind op needs to interact with that range, which can happen with a vector of binds. For example, if we need to re-insert something in place of the original va. In this case the va is still the shrunken version, so when removing it and then doing a re-insert it can overlap with the ends, which were never removed, triggering a warning like above, plus leaving the vm in a bad state. With that, we need two things here: 1) Stop nuking the prev/next tracking for the skip cases. Instead relying on checking for skip prev/next, where needed. That way on the unwind path, we now correctly remove both ends. 2) Undo the unmap va shrinkage, on the unwind path. With the two ends now removed the unmap va should expand back to the original size again, before re-insertion. v2: - Update the explanation in the commit message, based on an actual IGT of triggering this issue, rather than conjecture. - Also undo the unmap shrinkage, for the skip case. With the two ends now removed, the original unmap va range should expand back to the original range. v3: - Track the old start/range separately. vma_size/start() uses the va info directly. Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7602 Fixes: 8f33b4f054fc ("drm/xe: Avoid doing rebinds") Signed-off-by: Matthew Auld Cc: Matthew Brost Cc: # v6.8+ Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260318100208.78097-2-matthew.auld@intel.com (cherry picked from commit aec6969f75afbf4e01fd5fb5850ed3e9c27043ac) Signed-off-by: Rodrigo Vivi commit 06f4297134db37fb326047b1ed8194a23cdf057d Author: Tvrtko Ursulin Date: Tue Mar 24 11:10:19 2026 +0000 drm/syncobj: Fix xa_alloc allocation flags The xarray conversion blindly and wrongly replaced idr_alloc with xa_alloc and kept the GFP_NOWAIT. It should have been GFP_KERNEL to account for idr_preload it removed. Fix it. Signed-off-by: Tvrtko Ursulin Fixes: fec2c3c01f1c ("drm/syncobj: Convert syncobj idr to xarray") Reported-by: Himanshu Girotra Cc: Matthew Brost Cc: Thomas Hellström Reviewed-by: Thomas Hellström Reviewed-by: Himanshu Girotra Reviewed-by: Matthew Brost Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260324111019.22467-1-tvrtko.ursulin@igalia.com commit 2cdaff22ed26f1e619aa2b43f27bb84f2c6ef8f8 Author: Miguel Ojeda Date: Wed Mar 25 02:55:48 2026 +0100 dma-mapping: add missing `inline` for `dma_free_attrs` Under an UML build for an upcoming series [1], I got `-Wstatic-in-inline` for `dma_free_attrs`: BINDGEN rust/bindings/bindings_generated.rs - due to target missing In file included from rust/helpers/helpers.c:59: rust/helpers/dma.c:17:2: warning: static function 'dma_free_attrs' is used in an inline function with external linkage [-Wstatic-in-inline] 17 | dma_free_attrs(dev, size, cpu_addr, dma_handle, attrs); | ^ rust/helpers/dma.c:12:1: note: use 'static' to give inline function 'rust_helper_dma_free_attrs' internal linkage 12 | __rust_helper void rust_helper_dma_free_attrs(struct device *dev, size_t size, | ^ | static The issue is that `dma_free_attrs` was not marked `inline` when it was introduced alongside the rest of the stubs. Thus mark it. Fixes: ed6ccf10f24b ("dma-mapping: properly stub out the DMA API for !CONFIG_HAS_DMA") Closes: https://lore.kernel.org/rust-for-linux/20260322194616.89847-1-ojeda@kernel.org/ [1] Signed-off-by: Miguel Ojeda Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260325015548.70912-1-ojeda@kernel.org commit c4ea7d8907cf72b259bf70bd8c2e791e1c4ff70f Author: Guangshuo Li Date: Tue Mar 24 00:57:30 2026 +0800 net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls auxiliary_device_uninit(adev). The auxiliary device has its release callback set to adev_release(), which frees the containing struct mana_adev. Since adev is embedded in struct mana_adev, the subsequent fall-through to init_fail and access to adev->id may result in a use-after-free. Fix this by saving the allocated auxiliary device id in a local variable before calling auxiliary_device_add(), and use that saved id in the cleanup path after auxiliary_device_uninit(). Fixes: a69839d4327d ("net: mana: Add support for auxiliary device") Cc: stable@vger.kernel.org Reviewed-by: Long Li Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260323165730.945365-1-lgs201920130244@gmail.com Signed-off-by: Jakub Kicinski commit 815980fe6dbb01ad4007e8b260a45617f598b76d Author: Jonas Köppeler Date: Mon Mar 23 18:49:20 2026 +0100 net_sched: codel: fix stale state for empty flows in fq_codel When codel_dequeue() finds an empty queue, it resets vars->dropping but does not reset vars->first_above_time. The reference CoDel algorithm (Nichols & Jacobson, ACM Queue 2012) resets both: dodeque_result codel_queue_t::dodeque(time_t now) { ... if (r.p == NULL) { first_above_time = 0; // <-- Linux omits this } ... } Note that codel_should_drop() does reset first_above_time when called with a NULL skb, but codel_dequeue() returns early before ever calling codel_should_drop() in the empty-queue case. The post-drop code paths do reach codel_should_drop(NULL) and correctly reset the timer, so a dropped packet breaks the cycle -- but the next delivered packet re-arms first_above_time and the cycle repeats. For sparse flows such as ICMP ping (one packet every 200ms-1s), the first packet arms first_above_time, the flow goes empty, and the second packet arrives after the interval has elapsed and gets dropped. The pattern repeats, producing sustained loss on flows that are not actually congested. Test: veth pair, fq_codel, BQL disabled, 30000 iptables rules in the consumer namespace (NAPI-64 cycle ~14ms, well above fq_codel's 5ms target), ping at 5 pps under UDP flood: Before fix: 26% ping packet loss After fix: 0% ping packet loss Fix by resetting first_above_time to zero in the empty-queue path of codel_dequeue(), matching the reference algorithm. Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM") Fixes: d068ca2ae2e6 ("codel: split into multiple files") Co-developed-by: Jesper Dangaard Brouer Signed-off-by: Jesper Dangaard Brouer Signed-off-by: Jonas Köppeler Reported-by: Chris Arges Tested-by: Jonas Köppeler Reviewed-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/all/20260318134826.1281205-7-hawk@kernel.org/ Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260323174920.253526-1-hawk@kernel.org Signed-off-by: Jakub Kicinski commit 09474055f2619be9445ba4245e4013741ed01a5e Author: Sabrina Dubroca Date: Mon Mar 23 16:19:43 2026 +0100 rtnetlink: fix leak of SRCU struct in rtnl_link_register Commit 6b57ff21a310 ("rtnetlink: Protect link_ops by mutex.") swapped the EEXIST check with the init_srcu_struct, but didn't add cleanup of the SRCU struct we just allocated in case of error. Fixes: 6b57ff21a310 ("rtnetlink: Protect link_ops by mutex.") Signed-off-by: Sabrina Dubroca Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/e77fe499f9a58c547b33b5212b3596dad417cec6.1774025341.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 71399707876b93240f236f48b8062f3423a5fe97 Author: Thangaraj Samynathan Date: Mon Mar 23 12:23:45 2026 +0530 net: lan743x: fix duplex configuration in mac_link_up The driver does not explicitly configure the MAC duplex mode when bringing the link up. As a result, the MAC may retain a stale duplex setting from a previous link state, leading to duplex mismatches with the link partner and degraded network performance. Update lan743x_phylink_mac_link_up() to set or clear the MAC_CR_DPX_ bit according to the negotiated duplex mode. This ensures the MAC configuration is consistent with the phylink resolved state. Fixes: a5f199a8d8a03 ("net: lan743x: Migrate phylib to phylink") Signed-off-by: Thangaraj Samynathan Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260323065345.144915-1-thangaraj.s@microchip.com Signed-off-by: Jakub Kicinski commit ba8bda9a0896746053aa97ac6c3e08168729172c Author: xietangxin Date: Thu Mar 12 10:54:06 2026 +0800 virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared (e.g., during the configuration of tc route filter rules). When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack expects the driver to hold the reference to skb->dst until the packet is fully transmitted and freed. In virtio_net with napi_tx=N, skbs may remain in the virtio transmit ring for an extended period. If the network namespace is destroyed while these skbs are still pending, the corresponding dst_ops structure has freed. When a subsequent packet is transmitted, free_old_xmit() is triggered to clean up old skbs. It then calls dst_release() on the skb associated with the stale dst_entry. Since the dst_ops (referenced by the dst_entry) has already been freed, a UAF kernel paging request occurs. fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release the dst reference before the skb is queued in virtio_net. Call Trace: Unable to handle kernel paging request at virtual address ffff80007e150000 CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT ... percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P) dst_release+0xe0/0x110 net/core/dst.c:177 skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177 sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255 dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469 napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527 __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net] free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net] start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net] ... Reproduction Steps: NETDEV="enp3s0" config_qdisc_route_filter() { tc qdisc del dev $NETDEV root tc qdisc add dev $NETDEV root handle 1: prio tc filter add dev $NETDEV parent 1:0 \ protocol ip prio 100 route to 100 flowid 1:1 ip route add 192.168.1.100/32 dev $NETDEV realm 100 } test_ns() { ip netns add testns ip link set $NETDEV netns testns ip netns exec testns ifconfig $NETDEV 10.0.32.46/24 ip netns exec testns ping -c 1 10.0.32.1 ip netns del testns } config_qdisc_route_filter test_ns sleep 2 test_ns Fixes: f2fc6a54585a ("[NETNS][IPV6] route6 - move ip6_dst_ops inside the network namespace") Cc: stable@vger.kernel.org Signed-off-by: xietangxin Reviewed-by: Xuan Zhuo Fixes: 0287587884b1 ("net: better IFF_XMIT_DST_RELEASE support") Link: https://patch.msgid.link/20260312025406.15641-1-xietangxin@yeah.net Signed-off-by: Jakub Kicinski commit 2f0407ed923b7eb363424033fc12fe253da139c4 Author: Gao Xiang Date: Tue Mar 24 23:54:07 2026 +0800 erofs: fix .fadvise() for page cache sharing Currently, .fadvise() doesn't work well if page cache sharing is on since shared inodes belong to a pseudo fs generated with init_pseudo(), and sb->s_bdi is the default one &noop_backing_dev_info. Then, generic_fadvise() will just behave as a no-op if sb->s_bdi is &noop_backing_dev_info, but as the bdev fs (the bdev fs changes inode_to_bdi() instead), it's actually NOT a pure memfs. Let's generate a real bdi for erofs_ishare_mnt instead. Fixes: d86d7817c042 ("erofs: implement .fadvise for page cache share") Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit bbeb83d3182abe0d245318e274e8531e5dd7a948 Merge: 24f9515de87784 775af5cbb22c1d Author: Linus Torvalds Date: Tue Mar 24 16:48:14 2026 -0700 Merge tag 'kbuild-fixes-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: "This mostly addresses some issues with the awk conversion in scripts/kconfig/merge_config.sh. - Fix typo to ensure .builtin-dtbs.S is properly cleaned - Fix '==' bashism in scripts/kconfig/merge_config.sh - Fix awk error in scripts/kconfig/merge_config.sh when base configuration is empty - Fix inconsistent indentation in scripts/kconfig/merge_config.sh" * tag 'kbuild-fixes-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: scripts: kconfig: merge_config.sh: fix indentation scripts: kconfig: merge_config.sh: pass output file as awk variable scripts: kconfig: merge_config.sh: fix unexpected operator warning kbuild: Delete .builtin-dtbs.S when running make clean commit 5d16467ae56343b9205caedf85e3a131e0914ad8 Author: Zhan Xusheng Date: Mon Mar 23 14:11:30 2026 +0800 alarmtimer: Fix argument order in alarm_timer_forward() alarm_timer_forward() passes arguments to alarm_forward() in the wrong order: alarm_forward(alarm, timr->it_interval, now); However, alarm_forward() is defined as: u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval); and uses the second argument as the current time: delta = ktime_sub(now, alarm->node.expires); Passing the interval as "now" results in incorrect delta computation, which can lead to missed expirations or incorrect overrun accounting. This issue has been present since the introduction of alarm_timer_forward(). Fix this by swapping the arguments. Fixes: e7561f1633ac ("alarmtimer: Implement forward callback") Signed-off-by: Zhan Xusheng Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260323061130.29991-1-zhanxusheng@xiaomi.com commit 6680c162b4850976ee52b57372eddc4450c1d074 Author: Tejun Heo Date: Tue Mar 24 10:21:47 2026 -1000 selftests/cgroup: Don't require synchronous populated update on task exit test_cgcore_populated (test_core) and test_cgkill_{simple,tree,forkbomb} (test_kill) check cgroup.events "populated 0" immediately after reaping child tasks with waitpid(). This used to work because cgroup_task_exit() in do_exit() unlinked tasks from css_sets before exit_notify() woke up waitpid(). d245698d727a ("cgroup: Defer task cgroup unlink until after the task is done switching out") moved the unlink to cgroup_task_dead() in finish_task_switch(), which runs after exit_notify(). The populated counter is now decremented after the parent's waitpid() can return, so there is no longer a synchronous ordering guarantee. On PREEMPT_RT, where cgroup_task_dead() is further deferred through lazy irq_work, the race window is even larger. The synchronous populated transition was never part of the cgroup interface contract - it was an implementation artifact. Use cg_read_strcmp_wait() which retries for up to 1 second, matching what these tests actually need to verify: that the cgroup eventually becomes unpopulated after all tasks exit. Fixes: d245698d727a ("cgroup: Defer task cgroup unlink until after the task is done switching out") Reported-by: Sebastian Andrzej Siewior Signed-off-by: Tejun Heo Tested-by: Sebastian Andrzej Siewior Cc: Christian Brauner Cc: cgroups@vger.kernel.org commit 1b164b876c36c3eb5561dd9b37702b04401b0166 Author: Tejun Heo Date: Tue Mar 24 10:21:25 2026 -1000 cgroup: Wait for dying tasks to leave on rmdir a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup") hid PF_EXITING tasks from cgroup.procs so that systemd doesn't see tasks that have already been reaped via waitpid(). However, the populated counter (nr_populated_csets) is only decremented when the task later passes through cgroup_task_dead() in finish_task_switch(). This means cgroup.procs can appear empty while the cgroup is still populated, causing rmdir to fail with -EBUSY. Fix this by making cgroup_rmdir() wait for dying tasks to fully leave. If the cgroup is populated but all remaining tasks have PF_EXITING set (the task iterator returns none due to the existing filter), wait for a kick from cgroup_task_dead() and retry. The wait is brief as tasks are removed from the cgroup's css_set between PF_EXITING assertion in do_exit() and cgroup_task_dead() in finish_task_switch(). v2: cgroup_is_populated() true to false transition happens under css_set_lock not cgroup_mutex, so retest under css_set_lock before sleeping to avoid missed wakeups (Sebastian). Fixes: a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202603222104.2c81684e-lkp@intel.com Reported-by: Sebastian Andrzej Siewior Signed-off-by: Tejun Heo Reviewed-by: Sebastian Andrzej Siewior Cc: Bert Karwatzki Cc: Michal Koutny Cc: cgroups@vger.kernel.org commit 24f9515de8778410e4b84c85b196c9850d2c1e18 Merge: 45f667ebb06a14 52dad81e4b3b20 Author: Linus Torvalds Date: Tue Mar 24 13:11:26 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Clear the pending exception state from a vcpu coming out of reset, as it could otherwise affect the first instruction executed in the guest - Fix pointer arithmetic in address translation emulation, so that the Hardware Access bit is set on the correct PTE instead of some other location s390: - Fix deadlock in new memory management - Properly handle kernel faults on donated memory - Fix bounds checking for irq routing, with selftest - Fix invalid machine checks and log all of them" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() KVM: s390: vsie: Avoid injecting machine check on signal KVM: s390: log machine checks more aggressively KVM: s390: selftests: Add IRQ routing address offset tests KVM: s390: Limit adapter indicator access to mapped page s390/mm: Add missing secure storage access fixups for donated memory KVM: arm64: Discard PC update state on vcpu reset KVM: s390: Fix a deadlock commit c8d46f17c2fc7d25c18e60c008928aecab26184d Author: Harald Freudenberger Date: Thu Mar 19 09:06:52 2026 +0100 s390/zcrypt: Fix memory leak with CCA cards used as accelerator Tests showed that there is a memory leak if CCA cards are used as accelerator for clear key RSA requests (ME and CRT). With the last rework for the memory allocation the AP messages are allocated by ap_init_apmsg() but for some reason on two places (ME and CRT) the older allocation was still in place. So the first allocation simple was never freed. Fixes: 57db62a130ce ("s390/ap/zcrypt: Rework AP message buffer allocation") Reported-by: Yi Zhang Closes: https://lore.kernel.org/linux-s390/CAHj4cs9H67Uz0iVaRQv447p7JFPRPy3TKAT4=Y6_e=wSHCZM5w@mail.gmail.com/ Reported-by: Nadja Hariz Cc: stable@vger.kernel.org Reviewed-by: Ingo Franzki Reviewed-by: Holger Dengler Acked-by: Heiko Carstens Signed-off-by: Harald Freudenberger Signed-off-by: Vasily Gorbik commit 57ad0d4a00f5d3e80f33ba2da8d560c73d83dc22 Author: Thomas Richter Date: Fri Mar 6 13:50:31 2026 +0100 s390/cpum_sf: Cap sampling rate to prevent lsctl exception commit fcc43a7e294f ("s390/configs: Set HZ=1000") changed the interrupt frequency of the system. On machines with heavy load and many perf event overflows, this might lead to an exception. Dmesg displays these entries: [112.242542] cpum_sf: Loading sampling controls failed: op 1 err -22 One line per CPU online. The root cause is the CPU Measurement sampling facility overflow adjustment. Whenever an overflow (too much samples per tick) occurs, the sampling rate is adjusted and increased. This was done without observing the maximum sampling rate limit. When the current sampling interval is higher than the maximum sampling rate limit, the lsctl instruction raises an exception. The error messages is the result of such an exception. Observe the upper limit when the new sampling rate is recalculated. Cc: stable@vger.kernel.org Fixes: 39d4a501a9ef ("s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits") Signed-off-by: Thomas Richter Reviewed-by: Sumanth Korikkar Reviewed-by: Hendrik Brueckner Signed-off-by: Vasily Gorbik commit a23811061a553c70c42de0e811b2ec15b2d54157 Author: Panagiotis "Ivory" Vasilopoulos Date: Wed Mar 4 19:13:04 2026 +0100 landlock: Expand restrict flags example for ABI version 8 Add LANDLOCK_RESTRICT_SELF_TSYNC to the backwards compatibility example for restrict flags. This introduces completeness, similar to that of the ruleset attributes example. However, as the new example can impact enforcement in certain cases, an appropriate warning is also included. Additionally, I modified the two comments of the example to make them more consistent with the ruleset attributes example's. Signed-off-by: Panagiotis "Ivory" Vasilopoulos Co-developed-by: Dan Cojocaru Signed-off-by: Dan Cojocaru Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260304-landlock-docs-add-tsync-example-v4-1-819a276f05c5@n0toose.net [mic: Update date, improve comments consistency, fix newline issue] Signed-off-by: Mickaël Salaün commit 45f667ebb06a141a5fbb1cae1b44a81102a23bc8 Merge: e3c33bc767b551 be5c5280cf2b20 Author: Linus Torvalds Date: Tue Mar 24 12:41:29 2026 -0700 Merge tag 'cxl-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link (CXL) fixes from Dave Jiang: - Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi - Use proper endpoint validity check upon sanitize - Avoid incorrect DVSEC fallback when HDM decoders are enabled - Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch - Fix leakage in __construct_region() - Fix use after free of parent_port in cxl_detach_ep() * tag 'cxl-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi cxl/mbox: Use proper endpoint validity check upon sanitize cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch cxl/region: Fix leakage in __construct_region() cxl/port: Fix use after free of parent_port in cxl_detach_ep() commit 7dfe9846016b15816e287a4650be1ff1b48c5ab4 Author: Srinivas Pandruvada Date: Tue Mar 24 10:23:46 2026 -0700 thermal: intel: int340x: soc_slider: Set offset only for balanced mode The slider offset can be set via debugfs for balanced mode. The offset should be only applicable in balanced mode. For other modes, it should be 0 when writing to MMIO offset, Fixes: 8306bcaba06d ("thermal: intel: int340x: Add module parameter to change slider offset") Tested-by: Erin Park Signed-off-by: Srinivas Pandruvada Cc: 6.18+ # 6.18+ [ rjw: Subject and changelog tweaks ] Link: https://patch.msgid.link/20260324172346.3317145-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 90d239cc53723c1a3f89ce08eac17bf3a9e9f2d4 Author: Alex Deucher Date: Thu Feb 26 17:12:08 2026 -0500 drm/amd/display: Fix DCE LVDS handling LVDS does not use an HPD pin so it may be invalid. Handle this case correctly in link encoder creation. Fixes: 7c8fb3b8e9ba ("drm/amd/display: Add hpd_source index check for DCE60/80/100/110/112/120 link encoders") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5012 Cc: Srinivasan Shanmugam Cc: Roman Li Reviewed-by: Roman Li Reviewed-by: Srinivasan Shanmugam Signed-off-by: Alex Deucher (cherry picked from commit 3b5620f7ee688177fcf65cf61588c5435bce1872) Cc: stable@vger.kernel.org commit 4e9597f22a3cb8600c72fc266eaac57981d834c8 Author: Donet Tom Date: Mon Mar 23 09:58:36 2026 +0530 drm/amdgpu: Handle GPU page faults correctly on non-4K page systems During a GPU page fault, the driver restores the SVM range and then maps it into the GPU page tables. The current implementation passes a GPU-page-size (4K-based) PFN to svm_range_restore_pages() to restore the range. SVM ranges are tracked using system-page-size PFNs. On systems where the system page size is larger than 4K, using GPU-page-size PFNs to restore the range causes two problems: Range lookup fails: Because the restore function receives PFNs in GPU (4K) units, the SVM range lookup does not find the existing range. This will result in a duplicate SVM range being created. VMA lookup failure: The restore function also tries to locate the VMA for the faulting address. It converts the GPU-page-size PFN into an address using the system page size, which results in an incorrect address on non-4K page-size systems. As a result, the VMA lookup fails with the message: "address 0xxxx VMA is removed". This patch passes the system-page-size PFN to svm_range_restore_pages() so that the SVM range is restored correctly on non-4K page systems. Acked-by: Christian König Signed-off-by: Donet Tom Signed-off-by: Alex Deucher (cherry picked from commit 074fe395fb13247b057f60004c7ebcca9f38ef46) commit 28922a43fdab715ed771175e8326ad7e13808be3 Author: Yang Wang Date: Thu Mar 19 03:36:50 2026 -0400 drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v14 Forcibly disable the OD_FAN_CURVE feature when temperature or PWM range is invalid, otherwise PMFW will reject this configuration on smu v14.0.2/14.0.3. example: $ sudo cat /sys/bus/pci/devices//gpu_od/fan_ctrl/fan_curve OD_FAN_CURVE: 0: 0C 0% 1: 0C 0% 2: 0C 0% 3: 0C 0% 4: 0C 0% OD_RANGE: FAN_CURVE(hotspot temp): 0C 0C FAN_CURVE(fan speed): 0% 0% $ echo "0 50 40" | sudo tee fan_curve kernel log: [ 969.761627] amdgpu 0000:03:00.0: amdgpu: Fan curve temp setting(50) must be within [0, 0]! [ 1010.897800] amdgpu 0000:03:00.0: amdgpu: Fan curve temp setting(50) must be within [0, 0]! Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit ab4905d466b60f170d85e19ca2a5d2b159aeb780) Cc: stable@vger.kernel.org commit 429aec2bc0ae1e20ce96066d57e9f91f79b660df Author: Srinivasan Shanmugam Date: Mon Mar 23 14:28:57 2026 +0530 drm/amdkfd: Fix NULL pointer check order in kfd_ioctl_create_process In kfd_ioctl_create_process(), the pointer 'p' is used before checking if it is NULL. The code accesses p->context_id before validating 'p'. This can lead to a possible NULL pointer dereference. Move the NULL check before using 'p' so that the pointer is validated before access. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_chardev.c:3177 kfd_ioctl_create_process() warn: variable dereferenced before check 'p' (see line 3174) Fixes: cc6b66d661fd ("amdkfd: introduce new ioctl AMDKFD_IOC_CREATE_PROCESS") Cc: Zhu Lingshan Cc: Felix Kuehling Cc: Christian König Cc: Alex Deucher Cc: Dan Carpenter Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 19d4149b22f57094bfc4b86b742381b3ca394ead) commit 9da4f9964abcaeb6e19797d5e3b10faad338a786 Author: Alex Deucher Date: Fri Mar 20 12:33:48 2026 -0400 drm/amd/display: check if ext_caps is valid in BL setup LVDS connectors don't have extended backlight caps so check if the pointer is valid before accessing it. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5012 Fixes: 1454642960b0 ("drm/amd: Re-introduce property to control adaptive backlight modulation") Cc: Mario Limonciello Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 3f797396d7f4eb9bb6eded184bbc6f033628a6f6) Cc: stable@vger.kernel.org commit 7150850146ebfa4ca998f653f264b8df6f7f85be Author: Srinivasan Shanmugam Date: Mon Mar 23 13:41:18 2026 +0530 drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion. Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait(). If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free. Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696) Fixes: 9ae55f030dc5 ("drm/amdgpu: Follow up change to previous drm scheduler change.") Cc: Felix Kuehling Cc: Dan Carpenter Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482) commit f6484cadbcaf26b5844b51bd7307a663dda48ef6 Author: Weiming Shi Date: Wed Mar 25 00:54:59 2026 +0800 ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware platforms, it has already started the EC and installed the address space handler with the struct acpi_ec pointer as handler context. However, acpi_ec_setup() propagates the error without any cleanup. The caller acpi_ec_add() then frees the struct acpi_ec for non-boot instances, leaving a dangling handler context in ACPICA. Any subsequent AML evaluation that accesses an EC OpRegion field dispatches into acpi_ec_space_handler() with the freed pointer, causing a use-after-free: BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289) Write of size 8 at addr ffff88800721de38 by task init/1 Call Trace: mutex_lock (kernel/locking/mutex.c:289) acpi_ec_space_handler (drivers/acpi/ec.c:1362) acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293) acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246) acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509) acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700) acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327) acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392) Allocated by task 1: acpi_ec_alloc (drivers/acpi/ec.c:1424) acpi_ec_add (drivers/acpi/ec.c:1692) Freed by task 1: kfree (mm/slub.c:6876) acpi_ec_add (drivers/acpi/ec.c:1751) The bug triggers on reduced-hardware EC platforms (ec->gpe < 0) when the GPIO IRQ provider defers probing. Once the stale handler exists, any unprivileged sysfs read that causes AML to touch an EC OpRegion (battery, thermal, backlight) exercises the dangling pointer. Fix this by calling ec_remove_handlers() in the error path of acpi_ec_setup() before clearing first_ec. ec_remove_handlers() checks each EC_FLAGS_* bit before acting, so it is safe to call regardless of how far ec_install_handlers() progressed: -ENODEV (handler not installed): only calls acpi_ec_stop() -EPROBE_DEFER (handler installed): removes handler, stops EC Fixes: 03e9a0e05739 ("ACPI: EC: Consolidate event handler installation code") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Link: https://patch.msgid.link/20260324165458.1337233-2-bestswngs@gmail.com Signed-off-by: Rafael J. Wysocki commit 52dad81e4b3b2087e38fe522da7465e6d0160ddd Merge: 12fd96587160fe 0496acc42fb51e Author: Paolo Bonzini Date: Tue Mar 24 17:32:30 2026 +0100 Merge tag 'kvmarm-fixes-7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.0, take #4 - Clear the pending exception state from a vcpu coming out of reset, as it could otherwise affect the first instruction executed in the guest. - Fix the address translation emulation icode to set the Hardware Access bit on the correct PTE instead of some other location. commit 12fd96587160fe6714dd19dfdd7b6b6184eacea4 Merge: c369299895a591 ab5119735e984f Author: Paolo Bonzini Date: Tue Mar 24 17:32:13 2026 +0100 Merge tag 'kvm-s390-master-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Fixes for 7.0 - fix deadlock in new memory management - handle kernel faults on donated memory properly - fix bounds checking for irq routing + selftest - fix invalid machine checks + logging commit e3c33bc767b5512dbfec643a02abf58ce608f3b2 Merge: 26a01984ddc1e6 84481e705ab07e Author: Linus Torvalds Date: Tue Mar 24 09:12:45 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-03-23-17-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: "6 hotfixes. 2 are cc:stable. All are for MM. All are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-03-23-17-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/damon/stat: monitor all System RAM resources mm/zswap: add missing kunmap_local() mailmap: update email address for Muhammad Usama Anjum zram: do not slot_free() written-back slots mm/damon/core: avoid use of half-online-committed context mm/rmap: clear vma->anon_vma on error commit 938c418422c4b08523ae39aebbd828428dcfefd2 Author: Gao Xiang Date: Mon Mar 23 17:48:57 2026 +0800 erofs: update the Kconfig description Refine the description to better highlight its features and use cases. In addition, add instructions for building it as a module and clarify the compression option. Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 26a01984ddc1e67025fd150e845ab61d5271d6b7 Merge: 97a48d1aab549a 493ad070cbcb0d Author: Linus Torvalds Date: Tue Mar 24 08:58:38 2026 -0700 Merge tag 'perf-tools-fixes-for-v7.0-2-2026-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix parsing 'overwrite' in command line event definitions in big-endian machines by writing correct union member - Fix finding default metric in 'perf stat' - Fix relative paths for including headers in 'perf kvm stat' - Sync header copies with the kernel sources: msr-index.h, kvm, build_bug.h * tag 'perf-tools-fixes-for-v7.0-2-2026-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: tools headers: Synchronize linux/build_bug.h with the kernel sources tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources tools headers UAPI: Sync linux/kvm.h with the kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources perf kvm stat: Fix relative paths for including headers perf parse-events: Fix big-endian 'overwrite' by writing correct union member perf metricgroup: Fix metricgroup__has_metric_or_groups() tools headers: Skip arm64 cputype.h check commit 97a48d1aab549acb9b7f4a80d484f59710643199 Merge: a0124352d5329e e8d97c270cb46a Author: Linus Torvalds Date: Tue Mar 24 08:56:36 2026 -0700 Merge tag 'media/v7.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - rkvdec: fix stack usage with clang and improve handling missing short/long term RPS - synopsys: fix a Kconfig issue and an out-of-bounds check - verisilicon: Fix kernel panic due to __initconst misuse - media core: serialize REINIT and REQBUFS with req_queue_mutex * tag 'media/v7.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: verisilicon: Fix kernel panic due to __initconst misuse media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() media: rkvdec: reduce excessive stack usage in assemble_hw_pps() media: rkvdec: Improve handling missing short/long term RPS media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex media: synopsys: csi2rx: add missing kconfig dependency media: synopsys: csi2rx: fix out-of-bounds check for formats array commit 53a7c171e9dd833f0a96b545adcb89bd57387239 Author: Amir Goldstein Date: Sun Mar 8 12:02:21 2026 +0100 ovl: fix wrong detection of 32bit inode numbers The implicit FILEID_INO32_GEN encoder was changed to be explicit, so we need to fix the detection. When mounting overlayfs with upperdir and lowerdir on different ext4 filesystems, the expected kmsg log is: overlayfs: "xino" feature enabled using 32 upper inode bits. But instead, since the regressing commit, the kmsg log was: overlayfs: "xino" feature enabled using 2 upper inode bits. Fixes: e21fc2038c1b9 ("exportfs: make ->encode_fh() a mandatory method for NFS export") Cc: stable@vger.kernel.org # v6.7+ Signed-off-by: Amir Goldstein commit 744fabc338e87b95c4d1ff7c95bc8c0f834c6d99 Author: Alexey Velichayshiy Date: Sat Feb 7 18:03:22 2026 +0300 wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() The memcpy function assumes the dynamic array notif->matches is at least as large as the number of bytes to copy. Otherwise, results->matches may contain unwanted data. To guarantee safety, extend the validation in one of the checks to ensure sufficient packet length. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: stable@vger.kernel.org Fixes: 5ac54afd4d97 ("wifi: iwlwifi: mvm: Add handling for scan offload match info notification") Signed-off-by: Alexey Velichayshiy Link: https://patch.msgid.link/20260207150335.1013646-1-a.velichayshiy@ispras.ru Signed-off-by: Johannes Berg commit cc34d77dd48708d810c12bfd6f5bf03304f6c824 Author: Danilo Krummrich Date: Tue Mar 24 01:59:15 2026 +0100 spi: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Also note that we do not enable the driver_override feature of struct bus_type, as SPI - in contrast to most other buses - passes "" to sysfs_emit() when the driver_override pointer is NULL. Thus, printing "\n" instead of "(null)\n". Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 5039563e7c25 ("spi: Add driver_override SPI device attribute") Signed-off-by: Danilo Krummrich Link: https://patch.msgid.link/20260324005919.2408620-12-dakr@kernel.org Signed-off-by: Mark Brown commit b0c9d8ae71509f25690d57f2efddebf7f4b12194 Author: Sanman Pradhan Date: Mon Mar 23 00:24:37 2026 +0000 hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() cputemp_is_visible() validates the channel index against CPUTEMP_CHANNEL_NUMS, but currently uses '>' instead of '>='. As a result, channel == CPUTEMP_CHANNEL_NUMS is not rejected even though valid indices are 0 .. CPUTEMP_CHANNEL_NUMS - 1. Fix the bounds check by using '>=' so invalid channel indices are rejected before indexing the core bitmap. Fixes: bf3608f338e9 ("hwmon: peci: Add cputemp driver") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260323002352.93417-3-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 0adc752b4f7d82af7bd14f7cad3091b3b5d702ba Author: Sanman Pradhan Date: Mon Mar 23 00:24:25 2026 +0000 hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature The hwmon sysfs ABI expects tempN_crit_hyst to report the temperature at which the critical condition clears, not the hysteresis delta from the critical limit. The peci cputemp driver currently returns tjmax - tcontrol for crit_hyst_type, which is the hysteresis margin rather than the corresponding absolute temperature. Return tcontrol directly, and update the documentation accordingly. Fixes: bf3608f338e9 ("hwmon: peci: Add cputemp driver") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260323002352.93417-2-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 3075a3951f7708da5a8ab47b0b7d068a32f69e58 Author: Sanman Pradhan Date: Thu Mar 19 17:31:29 2026 +0000 hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes The custom avs0_enable and avs1_enable sysfs attributes access PMBus registers through the exported API helpers (pmbus_read_byte_data, pmbus_read_word_data, pmbus_write_word_data, pmbus_update_byte_data) without holding the PMBus update_lock mutex. These exported helpers do not acquire the mutex internally, unlike the core's internal callers which hold the lock before invoking them. The store callback is especially vulnerable: it performs a multi-step read-modify-write sequence (read VOUT_COMMAND, write VOUT_COMMAND, then update OPERATION) where concurrent access from another thread could interleave and corrupt the register state. Add pmbus_lock_interruptible()/pmbus_unlock() around both the show and store callbacks to serialize PMBus register access with the rest of the driver. Fixes: 038a9c3d1e424 ("hwmon: (pmbus/isl68137) Add driver for Intersil ISL68137 PWM Controller") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260319173055.125271-3-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit f7e775c4694782844c66da5316fed82881835cf8 Author: Sanman Pradhan Date: Thu Mar 19 17:31:19 2026 +0000 hwmon: (pmbus/ina233) Fix error handling and sign extension in shunt voltage read ina233_read_word_data() reads MFR_READ_VSHUNT via pmbus_read_word_data() but has two issues: 1. The return value is not checked for errors before being used in arithmetic. A negative error code from a failed I2C transaction is passed directly to DIV_ROUND_CLOSEST(), producing garbage data. 2. MFR_READ_VSHUNT is a 16-bit two's complement value. Negative shunt voltages (values with bit 15 set) are treated as large positive values since pmbus_read_word_data() returns them zero-extended in an int. This leads to incorrect scaling in the VIN coefficient conversion. Fix both issues by adding an error check, casting to s16 for proper sign extension, and clamping the result to a valid non-negative range. The clamp is necessary because read_word_data callbacks must return non-negative values on success (negative values indicate errors to the pmbus core). Fixes: b64b6cb163f16 ("hwmon: Add driver for TI INA233 Current and Power Monitor") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260319173055.125271-2-sanman.pradhan@hpe.com [groeck: Fixed clamp to avoid losing the sign bit] Signed-off-by: Guenter Roeck commit 6525a549ecba71e3c48a68a5250da830cf9db2cc Merge: 249ddd5fe21fb1 4242625f272974 Author: Johannes Berg Date: Tue Mar 24 15:40:54 2026 +0100 Merge tag 'ath-current-20260324' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v7.0-rc6 For both ath11k and ath12k use the correct TID when stopping an AMPDU session. ================== Signed-off-by: Johannes Berg commit 249ddd5fe21fb1a29430a1ef0dff818689235f6a Merge: 0fd56fad9c5635 687a95d204e72e Author: Johannes Berg Date: Tue Mar 24 15:40:11 2026 +0100 Merge tag 'iwlwifi-fixes-2026-03-24' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== wifi: iwlwifi: fixes - 2026-03-24 - Fix MLO scan timing (record the scan start in FW) - don't send a 6E related command when not supported - correctly set wifi generation data ==================== Signed-off-by: Johannes Berg commit 0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0 Author: Pengpeng Hou Date: Mon Mar 23 16:08:45 2026 +0800 wifi: wl1251: validate packet IDs before indexing tx_frames wl1251_tx_packet_cb() uses the firmware completion ID directly to index the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the completion block, and the callback does not currently verify that it fits the array before dereferencing it. Reject completion IDs that fall outside wl->tx_frames[] and keep the existing NULL check in the same guard. This keeps the fix local to the trust boundary and avoids touching the rest of the completion flow. Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260323080845.40033-1-pengpeng@iscas.ac.cn Signed-off-by: Johannes Berg commit d049e56b1739101d1c4d81deedb269c52a8dbba0 Author: Yasuaki Torimaru Date: Tue Mar 24 19:06:24 2026 +0900 wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation The variable valuesize is declared as u8 but accumulates the total length of all SSIDs to scan. Each SSID contributes up to 33 bytes (IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10) SSIDs the total can reach 330, which wraps around to 74 when stored in a u8. This causes kmalloc to allocate only 75 bytes while the subsequent memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte heap buffer overflow. Widen valuesize from u8 to u32 to accommodate the full range. Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Cc: stable@vger.kernel.org Signed-off-by: Yasuaki Torimaru Link: https://patch.msgid.link/20260324100624.983458-1-yasuakitorimaru@gmail.com Signed-off-by: Johannes Berg commit 51a209ee33428ed688b1c00e0521a5b5b8ff483f Merge: 647b8a2fe47447 d849a2f7309fc0 Author: Paolo Abeni Date: Tue Mar 24 15:16:28 2026 +0100 Merge tag 'ipsec-2026-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-03-23 1) Add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi. From Sabrina Dubroca. 2) Fix the condition on x->pcpu_num in xfrm_sa_len by using the proper check. From Sabrina Dubroca. 3) Call xdo_dev_state_delete during state update to properly cleanup the xdo device state. From Sabrina Dubroca. 4) Fix a potential skb leak in espintcp when async crypto is used. From Sabrina Dubroca. 5) Validate inner IPv4 header length in IPTFS payload to avoid parsing malformed packets. From Roshan Kumar. 6) Fix skb_put() panic on non-linear skb during IPTFS reassembly. From Fernando Fernandez Mancera. 7) Silence various sparse warnings related to RCU, state, and policy handling. From Sabrina Dubroca. 8) Fix work re-schedule race after cancel in xfrm_nat_keepalive_net_fini(). From Hyunwoo Kim. 9) Prevent policy_hthresh.work from racing with netns teardown by using a proper cleanup mechanism. From Minwoo Ra. 10) Validate that the family of the source and destination addresses match in pfkey_send_migrate(). From Eric Dumazet. 11) Only publish mode_data after the clone is setup in the IPTFS receive path. This prevents leaving x->mode_data pointing at freed memory on error. From Paul Moses. Please pull or let me know if there are problems. ipsec-2026-03-23 * tag 'ipsec-2026-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: iptfs: only publish mode_data after clone setup af_key: validate families in pfkey_send_migrate() xfrm: prevent policy_hthresh.work from racing with netns teardown xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() xfrm: avoid RCU warnings around the per-netns netlink socket xfrm: add rcu_access_pointer to silence sparse warning for xfrm_input_afinfo xfrm: policy: silence sparse warning in xfrm_policy_unregister_afinfo xfrm: policy: fix sparse warnings in xfrm_policy_{init,fini} xfrm: state: silence sparse warnings during netns exit xfrm: remove rcu/state_hold from xfrm_state_lookup_spi_proto xfrm: state: add xfrm_state_deref_prot to state_by* walk under lock xfrm: state: fix sparse warnings around XFRM_STATE_INSERT xfrm: state: fix sparse warnings in xfrm_state_init xfrm: state: fix sparse warnings on xfrm_state_hold_rcu xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly xfrm: iptfs: validate inner IPv4 header length in IPTFS payload esp: fix skb leak with espintcp and async crypto xfrm: call xdo_dev_state_delete during state update xfrm: fix the condition on x->pcpu_num in xfrm_sa_len xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi ==================== Link: https://patch.msgid.link/20260323083440.2741292-1-steffen.klassert@secunet.com Signed-off-by: Paolo Abeni commit 4242625f272974dd1947f73b10d884eab3b277cd Author: Reshma Immaculate Rajkumar Date: Fri Feb 27 16:31:23 2026 +0530 wifi: ath12k: Pass the correct value of each TID during a stop AMPDU session With traffic ongoing for data TID [TID 0], an DELBA request to stop AMPDU for the BA session was received on management TID [TID 4]. The corresponding TID number was incorrectly passed to stop the BA session, resulting in the BA session for data TIDs being stopped and the BA size being reduced to 1, causing an overall dip in TCP throughput. Fix this issue by passing the correct argument from ath12k_dp_rx_ampdu_stop() to ath12k_dp_arch_peer_rx_tid_reo_update() during an AMPDU stop session. Instead of passing peer->dp_peer->rx_tid, which is the base address of the array, corresponding to TID 0, pass the value of &peer->dp_peer->rx_tid[params->tid]. With this, the different TID numbers are accounted for. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Reshma Immaculate Rajkumar Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260227110123.3726354-1-reshma.rajkumar@oss.qualcomm.com Signed-off-by: Jeff Johnson commit e225b36f83d7926c1f2035923bb0359d851fdb73 Author: Reshma Immaculate Rajkumar Date: Thu Mar 19 12:26:08 2026 +0530 wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session During ongoing traffic, a request to stop an AMPDU session for one TID could incorrectly affect other active sessions. This can happen because an incorrect TID reference would be passed when updating the BA session state, causing the wrong session to be stopped. As a result, the affected session would be reduced to a minimal BA size, leading to a noticeable throughput degradation. Fix this issue by passing the correct argument from ath11k_dp_rx_ampdu_stop() to ath11k_peer_rx_tid_reo_update() during a stop AMPDU session. Instead of passing peer->tx_tid, which is the base address of the array, corresponding to TID 0; pass the value of &peer->rx_tid[params->tid], where the different TID numbers are accounted for. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1 Fixes: d5c65159f2895 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Reshma Immaculate Rajkumar Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260319065608.2408179-1-reshma.rajkumar@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 56781a4597706cd25185b1dedc38841ec6c31496 Author: Matt Roper Date: Thu Mar 19 15:30:34 2026 -0700 drm/xe: Implement recent spec updates to Wa_16025250150 The hardware teams noticed that the originally documented workaround steps for Wa_16025250150 may not be sufficient to fully avoid a hardware issue. The workaround documentation has been augmented to suggest programming one additional register; make the corresponding change in the driver. Fixes: 7654d51f1fd8 ("drm/xe/xe2hpg: Add Wa_16025250150") Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20260319-wa_16025250150_part2-v1-1-46b1de1a31b2@intel.com Signed-off-by: Matt Roper (cherry picked from commit a31566762d4075646a8a2214586158b681e94305) Signed-off-by: Rodrigo Vivi commit cfb385a8dc88d86a805a5682eaa68f59fa5c0ec3 Author: Srinivas Kandagatla Date: Mon Mar 23 23:17:48 2026 +0000 ASoC: codecs: wcd934x: fix typo in dt parsing Looks like we ended up with a typo during device tree data parsing as part of 4f16b6351bbff ("ASoC: codecs: wcd: add common helper for wcd codecs") patch. This will result in not parsing the device tree data and results in zero mic bias values. Fix this by calling wcd_dt_parse_micbias_info instead of wcd_dt_parse_mbhc_data. Fixes: 4f16b6351bbff ("ASoC: codecs: wcd: add common helper for wcd codecs") Cc: Stable@vger.kernel.org Reported-by: Joel Selvaraj Signed-off-by: Srinivas Kandagatla Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260323231748.2217967-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 8121353a4bf8e38afee26299419a78ec108e14a6 Author: Alice Ryhl Date: Tue Mar 24 10:49:59 2026 +0000 rust: regulator: do not assume that regulator_get() returns non-null The Rust `Regulator` abstraction uses `NonNull` to wrap the underlying `struct regulator` pointer. When `CONFIG_REGULATOR` is disabled, the C stub for `regulator_get` returns `NULL`. `from_err_ptr` does not treat `NULL` as an error, so it was passed to `NonNull::new_unchecked`, causing undefined behavior. Fix this by using a raw pointer `*mut bindings::regulator` instead of `NonNull`. This allows `inner` to be `NULL` when `CONFIG_REGULATOR` is disabled, and leverages the C stubs which are designed to handle `NULL` or are no-ops. Fixes: 9b614ceada7c ("rust: regulator: add a bare minimum regulator abstraction") Reported-by: Miguel Ojeda Closes: https://lore.kernel.org/r/20260322193830.89324-1-ojeda@kernel.org Signed-off-by: Alice Ryhl Reviewed-by: Daniel Almeida Link: https://patch.msgid.link/20260324-regulator-fix-v1-1-a5244afa3c15@google.com Signed-off-by: Mark Brown commit 91049ec2e18376ec2192e73ef7be4c7110436350 Author: Jihed Chaibi Date: Sat Mar 21 02:20:11 2026 +0100 ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match The conditional block that defines clock constraints for the stm32h7-sai variant references "st,stm32mph7-sai", which does not match any compatible string in the enum. As a result, clock validation for the h7 variant is silently skipped. Correct the compatible string to "st,stm32h7-sai". Fixes: 8509bb1f11a1f ("ASoC: dt-bindings: add stm32mp25 support for sai") Signed-off-by: Jihed Chaibi Reviewed-by: Olivier Moysan Link: https://patch.msgid.link/20260321012011.125791-1-jihed.chaibi.dev@gmail.com Signed-off-by: Mark Brown commit 647b8a2fe474474704110db6bd07f7a139e621eb Author: Kevin Hao Date: Sat Mar 21 22:04:41 2026 +0800 net: macb: Use dev_consume_skb_any() to free TX SKBs The napi_consume_skb() function is not intended to be called in an IRQ disabled context. However, after commit 6bc8a5098bf4 ("net: macb: Fix tx_ptr_lock locking"), the freeing of TX SKBs is performed with IRQs disabled. To resolve the following call trace, use dev_consume_skb_any() for freeing TX SKBs: WARNING: kernel/softirq.c:430 at __local_bh_enable_ip+0x174/0x188, CPU#0: ksoftirqd/0/15 Modules linked in: CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 7.0.0-rc4-next-20260319-yocto-standard-dirty #37 PREEMPT Hardware name: ZynqMP ZCU102 Rev1.1 (DT) pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __local_bh_enable_ip+0x174/0x188 lr : local_bh_enable+0x24/0x38 sp : ffff800082b3bb10 x29: ffff800082b3bb10 x28: ffff0008031f3c00 x27: 000000000011ede0 x26: ffff000800a7ff00 x25: ffff800083937ce8 x24: 0000000000017a80 x23: ffff000803243a78 x22: 0000000000000040 x21: 0000000000000000 x20: ffff000800394c80 x19: 0000000000000200 x18: 0000000000000001 x17: 0000000000000001 x16: ffff000803240000 x15: 0000000000000000 x14: ffffffffffffffff x13: 0000000000000028 x12: ffff000800395650 x11: ffff8000821d1528 x10: ffff800081c2bc08 x9 : ffff800081c1e258 x8 : 0000000100000301 x7 : ffff8000810426ec x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000008 x1 : 0000000000000200 x0 : ffff8000810428dc Call trace: __local_bh_enable_ip+0x174/0x188 (P) local_bh_enable+0x24/0x38 skb_attempt_defer_free+0x190/0x1d8 napi_consume_skb+0x58/0x108 macb_tx_poll+0x1a4/0x558 __napi_poll+0x50/0x198 net_rx_action+0x1f4/0x3d8 handle_softirqs+0x16c/0x560 run_ksoftirqd+0x44/0x80 smpboot_thread_fn+0x1d8/0x338 kthread+0x120/0x150 ret_from_fork+0x10/0x20 irq event stamp: 29751 hardirqs last enabled at (29750): [] _raw_spin_unlock_irqrestore+0x44/0x88 hardirqs last disabled at (29751): [] _raw_spin_lock_irqsave+0x38/0x98 softirqs last enabled at (29150): [] handle_softirqs+0x504/0x560 softirqs last disabled at (29153): [] run_ksoftirqd+0x44/0x80 Fixes: 6bc8a5098bf4 ("net: macb: Fix tx_ptr_lock locking") Signed-off-by: Kevin Hao Cc: stable@vger.kernel.org Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260321-macb-tx-v1-1-b383a58dd4e6@gmail.com Signed-off-by: Paolo Abeni commit 687a95d204e72e52f2e6bc7a994cc82f76b2678f Author: Johannes Berg Date: Tue Mar 24 11:33:26 2026 +0200 wifi: iwlwifi: mld: correctly set wifi generation data In each MAC context, the firmware expects the wifi generation data, i.e. whether or not HE/EHT (and in the future UHR) is enabled on that MAC. However, this is currently handled wrong in two ways: - EHT is only enabled when the interface is also an MLD, but we currently allow (despite the spec) connecting with EHT but without MLO. - when HE or EHT are used by TDLS peers, the firmware needs to have them enabled regardless of the AP Fix this by iterating setting up the data depending on the interface type: - for AP, just set it according to the BSS configuration - for monitor, set it according to HW capabilities - otherwise, particularly for client, iterate all stations and then their links on the interface in question and set according to their capabilities, this handles the AP and TDLS peers. Re-calculate this whenever a TDLS station is marked associated or removed so that it's kept updated, for the AP it's already updated on assoc/disassoc. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260319110722.404713b22177.Ic972b5e557d011a5438f8f97c1e793cc829e2ea9@changeid Link: https://patch.msgid.link/20260324093333.2953495-1-miriam.rachel.korenblit@intel.com commit 323156c3541e23da7e582008a7ac30cd51b60acd Author: Emmanuel Grumbach Date: Tue Mar 24 11:33:25 2026 +0200 wifi: iwlwifi: mvm: don't send a 6E related command when not supported MCC_ALLOWED_AP_TYPE_CMD is related to 6E support. Do not send it if the device doesn't support 6E. Apparently, the firmware is mistakenly advertising support for this command even on AX201 which does not support 6E and then the firmware crashes. Fixes: 0d2fc8821a7d ("wifi: iwlwifi: nvm: parse the VLP/AFC bit from regulatory") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220804 Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260324113316.e171f0163f2a.I0c444d1f82d1773054e7ffc391ad49697d58f44e@changeid commit ec66ec6a5a8f53e7c70085749e8d68f4431c630f Author: Pagadala Yesu Anjaneyulu Date: Tue Mar 24 11:33:24 2026 +0200 wifi: iwlwifi: mld: Fix MLO scan timing Calculate MLO scan start time based on actual scan start notification from firmware instead of recording time when scan command is sent. Currently, MLO scan start time was captured immediately after sending the scan command to firmware. However, the actual scan start time may differ due to the FW being busy with a previous scan. In that case, the link selection code will think that the MLO scan is too old, and will warn. To fix it, Implement start scan notification handling to capture the precise moment when firmware begins the scan operation. Fixes: 9324731b9985 ("wifi: iwlwifi: mld: avoid selecting bad links") Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260324113316.4c56b8bac533.I6e656d8cc30bb82c96aabadedd62bd67f4c46bf9@changeid commit c4336a07eb6b2526dc2b62928b5104b41a7f81f5 Author: Willem de Bruijn Date: Fri Mar 20 15:01:46 2026 -0400 net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback NETIF_F_IPV6_CSUM only advertises support for checksum offload of packets without IPv6 extension headers. Packets with extension headers must fall back onto software checksumming. Since TSO depends on checksum offload, those must revert to GSO. The below commit introduces that fallback. It always checks network header length. For tunneled packets, the inner header length must be checked instead. Extend the check accordingly. A special case is tunneled packets without inner IP protocol. Such as RFC 6951 SCTP in UDP. Those are not standard IPv6 followed by transport header either, so also must revert to the software GSO path. Cc: stable@vger.kernel.org Fixes: 864e3396976e ("net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM") Reported-by: Tangxin Xie Closes: https://lore.kernel.org/netdev/0414e7e2-9a1c-4d7c-a99d-b9039cf68f40@yeah.net/ Suggested-by: Paolo Abeni Signed-off-by: Willem de Bruijn Link: https://patch.msgid.link/20260320190148.2409107-1-willemdebruijn.kernel@gmail.com Signed-off-by: Paolo Abeni commit d9c2a509c96378d77435e5845561c4afd3eaedad Merge: eb8c426c9803be cce598ffc6afd0 Author: Paolo Abeni Date: Tue Mar 24 12:22:52 2026 +0100 Merge tag 'linux-can-fixes-for-7.0-20260323' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-03-23 this is a pull request of 5 patches for net/main. The first patch is by me and adds missing error handling to the CAN netlink device configuration code. Wenyuan Li contributes a patch for the mcp251x drier to add missing error handling for power enabling in th open and resume functions. Oliver Hartkopp's patch adds missing atomic access in hot path for the CAN procfs statistics. A series by Ali Norouzi and Oliver Hartkopp fix a can-Out-of-Bounds Heap R/W in the can-gw protocol and a UAF in the CAN isotp protocol. linux-can-fixes-for-7.0-20260323 * tag 'linux-can-fixes-for-7.0-20260323' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() can: gw: fix OOB heap access in cgw_csum_crc8_rel() can: statistics: add missing atomic access in hot path can: mcp251x: add error handling for power enable in open and resume can: netlink: can_changelink(): add missing error handling to call can_ctrlmode_changelink() ==================== Link: https://patch.msgid.link/20260323103224.218099-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni commit eb8c426c9803beb171f89d15fea17505eb517714 Author: David Carlier Date: Fri Mar 20 17:44:39 2026 +0000 net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is used by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1]. This constitutes a use-after-free on every received packet that goes through the timestamp path. Defer the descriptor free until after all accesses through the psdata pointer are complete. For emac_rx_packet(), move the free into the requeue label so both early-exit and success paths free the descriptor after all accesses are done. For emac_rx_packet_zc(), move the free to the end of the loop body after emac_dispatch_skb_zc() (which calls emac_rx_timestamp()) has returned. Fixes: 46eeb90f03e0 ("net: ti: icssg-prueth: Use page_pool API for RX buffer allocation") Signed-off-by: David Carlier Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260320174439.41080-1-devnexen@gmail.com Signed-off-by: Paolo Abeni commit fbddf68d7b4e1e6da7a78dd7fbd8ec376536584a Author: Srinivas Pandruvada Date: Mon Mar 23 08:36:35 2026 -0700 platform/x86: ISST: Correct locked bit width SST-PP locked bit width is set to three bits. It should be only one bit. Use SST_PP_LOCK_WIDTH define instead of SST_PP_LEVEL_WIDTH. Fixes: ea009e4769fa ("platform/x86: ISST: Add SST-PP support via TPMI") Signed-off-by: Srinivas Pandruvada Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260323153635.3263828-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 25f5463c91fdd06577298d552d3fe262aa291f11 Merge: 673bb63d20064f 56063823b9f0e2 Author: Paolo Abeni Date: Tue Mar 24 11:26:34 2026 +0100 Merge branch 'team-fix-header_ops-type-confusion-and-add-selftest' Jiayuan Chen says: ==================== team: fix header_ops type confusion and add selftest Hi, This patch series fixes a panic reported by syzkaller in the team/bond/gre stacked non-Ethernet configuration: https://syzkaller.appspot.com/bug?extid=3d8bc31c45e11450f24c The first patch fixes the header_ops type confusion / parse recursion context issue in team. The second patch adds a selftest to reproduce the reported scenario and prevent regressions in the future. v1: https://lore.kernel.org/netdev/20260314062306.212765-1-jiayuan.chen@linux.dev/ v2: https://lore.kernel.org/netdev/20260317124606.157035-1-jiayuan.chen@linux.dev/ ==================== Link: https://patch.msgid.link/20260320072139.134249-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 56063823b9f0e2acdca4d621face5c6a7a1f4c99 Author: Jiayuan Chen Date: Fri Mar 20 15:21:27 2026 +0800 selftests: team: add non-Ethernet header_ops reproducer Add a team selftest that sets up: g0 (gre) -> b0 (bond) -> t0 (team) and triggers IPv6 traffic on t0. This reproduces the non-Ethernet header_ops confusion scenario and protects against regressions in stacked team/bond/gre configurations. Using this script, the panic reported by syzkaller can be reproduced [1]. After the fix: # ./non_ether_header_ops.sh PASS: non-Ethernet header_ops stacking did not crash [1] https://syzkaller.appspot.com/bug?extid=3d8bc31c45e11450f24c Cc: Jiayuan Chen Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260320072139.134249-3-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 425000dbf17373a4ab8be9428f5dc055ef870a56 Author: Jiayuan Chen Date: Fri Mar 20 15:21:26 2026 +0800 team: fix header_ops type confusion with non-Ethernet ports Similar to commit 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()") team has the same class of header_ops type confusion. For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops directly. When the team device later calls dev_hard_header() or dev_parse_header(), these callbacks can run with the team net_device instead of the real lower device, so netdev_priv(dev) is interpreted as the wrong private type and can crash. The syzbot report shows a crash in bond_header_create(), but the root cause is in team: the topology is gre -> bond -> team, and team calls the inherited header_ops with its own net_device instead of the lower device, so bond_header_create() receives a team device and interprets netdev_priv() as bonding private data, causing a type confusion crash. Fix this by introducing team header_ops wrappers for create/parse, selecting a team port under RCU, and calling the lower device callbacks with port->dev, so each callback always sees the correct net_device context. Also pass the selected lower device to the lower parse callback, so recursion is bounded in stacked non-Ethernet topologies and parse callbacks always run with the correct device context. Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Reported-by: syzbot+3d8bc31c45e11450f24c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69b46af7.050a0220.36eb34.000e.GAE@google.com/T/ Cc: Jiayuan Chen Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260320072139.134249-2-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 673bb63d20064f0d42d61a4ca481a8cc10ebf552 Merge: 70b439bf06f6a1 6c860dc02a8e60 Author: Paolo Abeni Date: Tue Mar 24 11:12:10 2026 +0100 Merge branch 'virtio-net-fix-for-virtio_net_f_guest_hdrlen' Xuan Zhuo says: ==================== virtio-net: fix for VIRTIO_NET_F_GUEST_HDRLEN The commit be50da3e9d4a ("net: virtio_net: implement exact header length guest feature") introduces support for the VIRTIO_NET_F_GUEST_HDRLEN feature in virtio-net. This feature requires virtio-net to set hdr_len to the actual header length of the packet when transmitting, the number of bytes from the start of the packet to the beginning of the transport-layer payload. However, in practice, hdr_len was being set using skb_headlen(skb), which is clearly incorrect. This path set fixes that issue. As discussed in [0], this version checks the VIRTIO_NET_F_GUEST_HDRLEN is negotiated. [0]: http://lore.kernel.org/all/20251029030913.20423-1-xuanzhuo@linux.alibaba.com v10: fix http://lore.kernel.org/all/202603122214.8Anoxrmq-lkp@intel.com ==================== Link: https://patch.msgid.link/20260320021818.111741-1-xuanzhuo@linux.alibaba.com Signed-off-by: Paolo Abeni commit 6c860dc02a8e60b438e26940227dfa641fcdb66a Author: Xuan Zhuo Date: Fri Mar 20 10:18:18 2026 +0800 virtio-net: correct hdr_len handling for tunnel gso The commit a2fb4bc4e2a6a03 ("net: implement virtio helpers to handle UDP GSO tunneling.") introduces support for the UDP GSO tunnel feature in virtio-net. The virtio spec says: If the \field{gso_type} has the VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV4 bit or VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV6 bit set, \field{hdr_len} accounts for all the headers up to and including the inner transport. The commit did not update the hdr_len to include the inner transport. I observed that the "hdr_len" is 116 for this packet: 17:36:18.241105 52:55:00:d1:27:0a > 2e:2c:df:46:a9:e1, ethertype IPv4 (0x0800), length 2912: (tos 0x0, ttl 64, id 45197, offset 0, flags [none], proto UDP (17), length 2898) 192.168.122.100.50613 > 192.168.122.1.4789: [bad udp cksum 0x8106 -> 0x26a0!] VXLAN, flags [I] (0x08), vni 1 fa:c3:ba:82:05:ee > ce:85:0c:31:77:e5, ethertype IPv4 (0x0800), length 2862: (tos 0x0, ttl 64, id 14678, offset 0, flags [DF], proto TCP (6), length 2848) 192.168.3.1.49880 > 192.168.3.2.9898: Flags [P.], cksum 0x9266 (incorrect -> 0xaa20), seq 515667:518463, ack 1, win 64, options [nop,nop,TS val 2990048824 ecr 2798801412], length 2796 116 = 14(mac) + 20(ip) + 8(udp) + 8(vxlan) + 14(inner mac) + 20(inner ip) + 32(innner tcp) Fixes: a2fb4bc4e2a6a03 ("net: implement virtio helpers to handle UDP GSO tunneling.") Signed-off-by: Xuan Zhuo Link: https://patch.msgid.link/20260320021818.111741-3-xuanzhuo@linux.alibaba.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 38ec410b99a5ee6566f75650ce3d4fd632940fd0 Author: Xuan Zhuo Date: Fri Mar 20 10:18:17 2026 +0800 virtio-net: correct hdr_len handling for VIRTIO_NET_F_GUEST_HDRLEN The commit be50da3e9d4a ("net: virtio_net: implement exact header length guest feature") introduces support for the VIRTIO_NET_F_GUEST_HDRLEN feature in virtio-net. This feature requires virtio-net to set hdr_len to the actual header length of the packet when transmitting, the number of bytes from the start of the packet to the beginning of the transport-layer payload. However, in practice, hdr_len was being set using skb_headlen(skb), which is clearly incorrect. This commit fixes that issue. Fixes: be50da3e9d4a ("net: virtio_net: implement exact header length guest feature") Signed-off-by: Xuan Zhuo Link: https://patch.msgid.link/20260320021818.111741-2-xuanzhuo@linux.alibaba.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit e8ab57b56402697a9bef50b71aecc613f0d61846 Author: Karol Wachowski Date: Mon Mar 23 10:50:29 2026 +0100 accel/ivpu: Add disable clock relinquish workaround for NVL-A0 Turn on disable clock relinquish workaround for Nova Lake A0. Without this workaround NPU may not power off correctly after inference, leading to unexpected system behavior. Fixes: 550f4dd2cedd ("accel/ivpu: Add support for Nova Lake's NPU") Cc: # v6.19+ Reviewed-by: Lizhi.hou Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260323095029.64613-1-karol.wachowski@linux.intel.com commit f621324dfb3d6719cc9ffe65e8ec6051664ca059 Author: Darrick J. Wong Date: Mon Mar 23 14:00:17 2026 -0700 iomap: fix lockdep complaint when reads fail Zorro Lang reported the following lockdep splat: "While running fstests xfs/556 on kernel 7.0.0-rc4+ (HEAD=04a9f1766954), a lockdep warning was triggered indicating an inconsistent lock state for sb->s_type->i_lock_key. "The deadlock might occur because iomap_read_end_io (called from a hardware interrupt completion path) invokes fserror_report, which then calls igrab. igrab attempts to acquire the i_lock spinlock. However, the i_lock is frequently acquired in process context with interrupts enabled. If an interrupt occurs while a process holds the i_lock, and that interrupt handler calls fserror_report, the system deadlocks. "I hit this warning several times by running xfs/556 (mostly) or generic/648 on xfs. More details refer to below console log." along with this dmesg, for which I've cleaned up the stacktraces: run fstests xfs/556 at 2026-03-18 20:05:30 XFS (sda3): Mounting V5 Filesystem 396e9164-c45a-4e05-be9d-b38c2c5c6477 XFS (sda3): Ending clean mount XFS (sda3): Unmounting Filesystem 396e9164-c45a-4e05-be9d-b38c2c5c6477 XFS (sda3): Mounting V5 Filesystem bf3f89c3-3c45-4650-a9c7-744f39c0191e XFS (sda3): Ending clean mount XFS (sda3): Unmounting Filesystem bf3f89c3-3c45-4650-a9c7-744f39c0191e XFS (dm-0): Mounting V5 Filesystem bf3f89c3-3c45-4650-a9c7-744f39c0191e XFS (dm-0): Ending clean mount device-mapper: table: 253:0: adding target device (start sect 209 len 1) caused an alignment inconsistency device-mapper: table: 253:0: adding target device (start sect 210 len 62914350) caused an alignment inconsistency buffer_io_error: 6 callbacks suppressed Buffer I/O error on dev dm-0, logical block 209, async page read Buffer I/O error on dev dm-0, logical block 209, async page read XFS (dm-0): Unmounting Filesystem bf3f89c3-3c45-4650-a9c7-744f39c0191e XFS (dm-0): Mounting V5 Filesystem bf3f89c3-3c45-4650-a9c7-744f39c0191e XFS (dm-0): Ending clean mount ================================ WARNING: inconsistent lock state 7.0.0-rc4+ #1 Tainted: G S W -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. od/2368602 [HC1[1]:SC0[0]:HE0:SE1] takes: ff1100069f2b4a98 (&sb->s_type->i_lock_key#31){?.+.}-{3:3}, at: igrab+0x28/0x1a0 {HARDIRQ-ON-W} state was registered at: __lock_acquire+0x40d/0xbd0 lock_acquire.part.0+0xbd/0x260 _raw_spin_lock+0x37/0x80 unlock_new_inode+0x66/0x2a0 xfs_iget+0x67b/0x7b0 [xfs] xfs_mountfs+0xde4/0x1c80 [xfs] xfs_fs_fill_super+0xe86/0x17a0 [xfs] get_tree_bdev_flags+0x312/0x590 vfs_get_tree+0x8d/0x2f0 vfs_cmd_create+0xb2/0x240 __do_sys_fsconfig+0x3d8/0x9a0 do_syscall_64+0x13a/0x1520 entry_SYSCALL_64_after_hwframe+0x76/0x7e irq event stamp: 3118 hardirqs last enabled at (3117): [] _raw_spin_unlock_irq+0x28/0x50 hardirqs last disabled at (3118): [] common_interrupt+0x19/0xe0 softirqs last enabled at (3040): [] handle_softirqs+0x6b8/0x950 softirqs last disabled at (3023): [] __irq_exit_rcu+0xfd/0x250 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&sb->s_type->i_lock_key#31); lock(&sb->s_type->i_lock_key#31); *** DEADLOCK *** 1 lock held by od/2368602: #0: ff1100069f2b4b58 (&sb->s_type->i_mutex_key#19){++++}-{4:4}, at: xfs_ilock+0x324/0x4b0 [xfs] stack backtrace: CPU: 15 UID: 0 PID: 2368602 Comm: od Kdump: loaded Tainted: G S W 7.0.0-rc4+ #1 PREEMPT(full) Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN Hardware name: Dell Inc. PowerEdge R660/0R5JJC, BIOS 2.1.5 03/14/2024 Call Trace: dump_stack_lvl+0x6f/0xb0 print_usage_bug.part.0+0x230/0x2c0 mark_lock_irq+0x3ce/0x5b0 mark_lock+0x1cb/0x3d0 mark_usage+0x109/0x120 __lock_acquire+0x40d/0xbd0 lock_acquire.part.0+0xbd/0x260 _raw_spin_lock+0x37/0x80 igrab+0x28/0x1a0 fserror_report+0x127/0x2d0 iomap_finish_folio_read+0x13c/0x280 iomap_read_end_io+0x10e/0x2c0 clone_endio+0x37e/0x780 [dm_mod] blk_update_request+0x448/0xf00 scsi_end_request+0x74/0x750 scsi_io_completion+0xe9/0x7c0 _scsih_io_done+0x6ba/0x1ca0 [mpt3sas] _base_process_reply_queue+0x249/0x15b0 [mpt3sas] _base_interrupt+0x95/0xe0 [mpt3sas] __handle_irq_event_percpu+0x1f0/0x780 handle_irq_event+0xa9/0x1c0 handle_edge_irq+0x2ef/0x8a0 __common_interrupt+0xa0/0x170 common_interrupt+0xb7/0xe0 asm_common_interrupt+0x26/0x40 RIP: 0010:_raw_spin_unlock_irq+0x2e/0x50 Code: 0f 1f 44 00 00 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 b5 73 5e fd 48 89 df e8 ed e2 5e fd e8 08 78 8f fd fb bf 01 00 00 00 8d 56 4d fd 65 8b 05 46 d5 1d 03 85 c0 74 06 5b c3 cc cc cc cc RSP: 0018:ffa0000027d07538 EFLAGS: 00000206 RAX: 0000000000000c2d RBX: ffffffffb6614bc8 RCX: 0000000000000080 RDX: 0000000000000000 RSI: ffffffffb6306a01 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffffffb75efc67 R11: 0000000000000001 R12: ff1100015ada0000 R13: 0000000000000083 R14: 0000000000000002 R15: ffffffffb6614c10 folio_wait_bit_common+0x407/0x780 filemap_update_page+0x8e7/0xbd0 filemap_get_pages+0x904/0xc50 filemap_read+0x320/0xc20 xfs_file_buffered_read+0x2aa/0x380 [xfs] xfs_file_read_iter+0x263/0x4a0 [xfs] vfs_read+0x6cb/0xb70 ksys_read+0xf9/0x1d0 do_syscall_64+0x13a/0x1520 Zorro's diagnosis makes sense, so the solution is to kick the failed read handling to a workqueue much like we added for writeback ioends in commit 294f54f849d846 ("fserror: fix lockdep complaint when igrabbing inode"). Cc: Zorro Lang Link: https://lore.kernel.org/linux-xfs/20260319194303.efw4wcu7c4idhthz@doltdoltdolt/ Fixes: a9d573ee88af98 ("iomap: report file I/O errors to the VFS") Signed-off-by: "Darrick J. Wong" Link: https://patch.msgid.link/20260323210017.GL6223@frogsfrogsfrogs Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit 77fcf58df15edcf3f5b5421f24814fb72796def9 Author: Imre Deak Date: Fri Mar 20 11:29:00 2026 +0200 drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state Clearing the DP tunnel stream BW in the atomic state involves getting the tunnel group state, which can fail. Handle the error accordingly. This fixes at least one issue where drm_dp_tunnel_atomic_set_stream_bw() failed to get the tunnel group state returning -EDEADLK, which wasn't handled. This lead to the ctx->contended warn later in modeset_lock() while taking a WW mutex for another object in the same atomic state, and thus within the same already contended WW context. Moving intel_crtc_state_alloc() later would avoid freeing saved_state on the error path; this stable patch leaves that simplification for a follow-up. Cc: Uma Shankar Cc: Ville Syrjälä Cc: # v6.9+ Fixes: a4efae87ecb2 ("drm/i915/dp: Compute DP tunnel BW during encoder state computation") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7617 Reviewed-by: Michał Grzelak Reviewed-by: Uma Shankar Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260320092900.13210-1-imre.deak@intel.com (cherry picked from commit fb69d0076e687421188bc8103ab0e8e5825b1df1) Signed-off-by: Joonas Lahtinen commit a0124352d5329e245bde2e686914b404cb40bd91 Merge: c369299895a591 1613462be621ad Author: Linus Torvalds Date: Mon Mar 23 21:30:14 2026 -0700 Merge tag 'xsa482-7.0-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Restrict the xen privcmd driver in unprivileged domU to only allow hypercalls to target domain when using secure boot" * tag 'xsa482-7.0-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/privcmd: add boot control for restricted usage in domU xen/privcmd: restrict usage in unprivileged domU commit 2c409e03fc04b5cded81b7add9ce509706c922e3 Author: Sumit Garg Date: Thu Jan 22 17:40:42 2026 +0530 arm64: dts: qcom: agatti: Fix IOMMU DT properties Fix IOMMU DT propeties for GPU, display and video peripherals via dropping SMMU stream IDs which relates to secure context bank. This problem only surfaced when the Gunyah based firmware stack is ported on Agatti replacing the legacy QHEE based firmware stack. Assigning Linux kernel (HLOS) VMID to secure context bank stream IDs is treated as a fault by Gunyah hypervisor which were previously ignored by QHEE hypervisor. The DT changes should be backwards compatible with legacy QHEE based firmware stack too. Suggested-by: Prakash Gupta Reviewed-by: Konrad Dybcio Reviewed-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Signed-off-by: Sumit Garg Link: https://lore.kernel.org/r/20260122121042.579270-4-sumit.garg@kernel.org Signed-off-by: Bjorn Andersson commit 7e59cd4ad586afd87f67491cf91fa1141292cf57 Author: Sumit Garg Date: Thu Jan 22 17:40:41 2026 +0530 dt-bindings: media: venus: Fix iommus property Fix IOMMU DT propety for venus via dropping SMMU stream IDs which relates to secure context bank. Assigning Linux kernel (HLOS) VMID to secure context bank stream IDs is incorrect. The maximum value for iommus property is updated accordingly. These DT bindings changes should be backwards compatible. Signed-off-by: Sumit Garg Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260122121042.579270-3-sumit.garg@kernel.org Signed-off-by: Bjorn Andersson commit 966a08c293cb9290d3fe932961404e87b3f81327 Author: Sumit Garg Date: Thu Jan 22 17:40:40 2026 +0530 dt-bindings: display: msm: qcm2290-mdss: Fix iommus property Fix IOMMU DT propety for display via dropping SMMU stream IDs which relates to secure context bank. Assigning Linux kernel (HLOS) VMID to secure context bank stream IDs is incorrect. The maximum value for iommus property is updated accordingly. These DT bindings changes should be backwards compatible. Signed-off-by: Sumit Garg Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260122121042.579270-2-sumit.garg@kernel.org Signed-off-by: Bjorn Andersson commit 6896ca5a9d05275fbeb38640c9bbdb95698de188 Author: Chen-Yu Tsai Date: Tue Mar 24 01:19:26 2026 +0800 arm64: dts: allwinner: sun55i: Fix r-spi DMA r-spi has DRQs for both the main and MCU DMA controllers on the A523 SoC family, however it seems it that it is mainly routed to the MCU DMA controller, with no obvious way to change it. Change the DMA channels of r-spi to the MCU so that it works properly. Fixes: 1bec3bd1f839 ("arm64: dts: allwinner: sun55i: Add SPI controllers") Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20260323171927.1256507-1-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 70b439bf06f6a12e491f827fa81a9887a11501f9 Author: Wei Fang Date: Fri Mar 20 17:42:22 2026 +0800 net: enetc: fix the output issue of 'ethtool --show-ring' Currently, enetc_get_ringparam() only provides rx_pending and tx_pending, but 'ethtool --show-ring' no longer displays these fields. Because the ringparam retrieval path has moved to the new netlink interface, where rings_fill_reply() emits the *x_pending only if the *x_max_pending values are non-zero. So rx_max_pending and tx_max_pending to are added to enetc_get_ringparam() to fix the issue. Note that the maximum tx/rx ring size of hardware is 64K, but we haven't added set_ringparam() to make the ring size configurable. To avoid users mistakenly believing that the ring size can be increased, so set the *x_max_pending to priv->*x_bd_count. Fixes: e4a1717b677c ("ethtool: provide ring sizes with RINGS_GET request") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260320094222.706339-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit e537dd15d0d4ad989d56a1021290f0c674dd8b28 Author: Martin KaFai Lau Date: Thu Mar 19 11:18:17 2026 -0700 udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. The current code switches to "hash2" when hslot->count > 10. "hash2" is keyed by local address and local port. "hash" is keyed by local port only. The issue can be shown in the following bind sequence (pseudo code): bind(fd1, "[fd00::1]:8888") bind(fd2, "[fd00::2]:8888") bind(fd3, "[fd00::3]:8888") bind(fd4, "[fd00::4]:8888") bind(fd5, "[fd00::5]:8888") bind(fd6, "[fd00::6]:8888") bind(fd7, "[fd00::7]:8888") bind(fd8, "[fd00::8]:8888") bind(fd9, "[fd00::9]:8888") bind(fd10, "[fd00::10]:8888") /* Correctly return -EADDRINUSE because "hash" is used * instead of "hash2". udp_lib_lport_inuse() detects the * conflict. */ bind(fail_fd, "[::]:8888") /* After one more socket is bound to "[fd00::11]:8888", * hslot->count exceeds 10 and "hash2" is used instead. */ bind(fd11, "[fd00::11]:8888") bind(fail_fd, "[::]:8888") /* succeeds unexpectedly */ The same issue applies to the IPv4 wildcard address "0.0.0.0" and the IPv4-mapped wildcard address "::ffff:0.0.0.0". For example, if there are existing sockets bound to "192.168.1.[1-11]:8888", then binding "0.0.0.0:8888" or "[::ffff:0.0.0.0]:8888" can also miss the conflict when hslot->count > 10. TCP inet_csk_get_port() already has the correct check in inet_use_bhash2_on_bind(). Rename it to inet_use_hash2_on_bind() and move it to inet_hashtables.h so udp.c can reuse it in this fix. Fixes: 30fff9231fad ("udp: bind() optimisation") Reported-by: Andrew Onyshchuk Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260319181817.1901357-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit 3f0f591b44b04a77ff561676ae53fcfd7532a54c Author: Arnd Bergmann Date: Fri Mar 20 16:49:19 2026 +0100 net: b44: always select CONFIG_FIXED_PHY When CONFIG_FIXED_PHY=m but CONFIG_B44=y, the kernel fails to link: ld.lld: error: undefined symbol: fixed_phy_unregister >>> referenced by b44.c >>> drivers/net/ethernet/broadcom/b44.o:(b44_remove_one) in archive vmlinux.a ld.lld: error: undefined symbol: fixed_phy_register_100fd >>> referenced by b44.c >>> drivers/net/ethernet/broadcom/b44.o:(b44_register_phy_one) in archive vmlinux.a The fixed phy support is small enough that just always enabling it for b44 is the simplest solution, and it avoids adding ugly #ifdef checks. Fixes: 10d2f15afba2 ("net: b44: register a fixed phy using fixed_phy_register_100fd if needed") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260320154927.674555-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 1065913dedfd3a8269816835bfe810b6e2c28579 Author: Qingfang Deng Date: Fri Mar 20 17:43:15 2026 +0800 net: airoha: add RCU lock around dev_fill_forward_path Since 0417adf367a0 ("ppp: fix race conditions in ppp_fill_forward_path") dev_fill_forward_path() should be called with RCU read lock held. This fix was applied to net, while the Airoha flowtable commit was applied to net-next, so it hadn't been an issue until net was merged into net-next. Fixes: a8bdd935d1dd ("net: airoha: Add wlan flowtable TX offload") Signed-off-by: Qingfang Deng Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260320094315.525126-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit 42156f93d123436f2a27c468f18c966b7e5db796 Author: Yochai Eisenrich Date: Thu Mar 19 22:06:10 2026 +0200 net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registration is not cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout array. `packet_release()` does NOT zero `po->num` in its `bind_lock` section. After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex` still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)` that already found the socket in `sklist` can re-register the hook. For fanout sockets, this re-registration calls `__fanout_link(sk, po)` which adds the socket back into `f->arr[]` and increments `f->num_members`, but does NOT increment `f->sk_ref`. The fix sets `po->num` to zero in `packet_release` while `bind_lock` is held to prevent NETDEV_UP from linking, preventing the race window. This bug was found following an additional audit with Claude Code based on CVE-2025-38617. Fixes: ce06b03e60fc ("packet: Add helpers to register/unregister ->prot_hook") Link: https://blog.calif.io/p/a-race-within-a-race-exploiting-cve Signed-off-by: Yochai Eisenrich Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260319200610.25101-1-echelonh@gmail.com Signed-off-by: Jakub Kicinski commit b1791180a2710830bf909e1eadf2c3d362e7ce63 Merge: bc0151c59e639c 3e9e84e92c9c2e Author: Jakub Kicinski Date: Mon Mar 23 16:59:36 2026 -0700 Merge branch 'ipv6-fix-two-gc-issues-with-permanent-routes' Kuniyuki Iwashima says: ==================== ipv6: Fix two GC issues with permanent routes. Patch 1 fixes the unbounded growth of tb6_gc_hlist due to permanent routes whose exception routes have all expired. Patch 2 fixes an issue where exception routes tied to permanent routes are not properly aged. Patch 3 is a selftest for the issue fixed by Patch 2. ==================== Link: https://patch.msgid.link/20260320072317.2561779-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 3e9e84e92c9c2eec396ee62a2e47b85781520c57 Author: Kuniyuki Iwashima Date: Fri Mar 20 07:23:01 2026 +0000 selftest: net: Add GC test for temporary routes with exceptions. Without the prior commit, IPv6 GC cannot track exceptions tied to permanent routes if they were originally added as temporary routes. Let's add a test case for the issue. 1. Add temporary routes 2. Create exceptions for the temporary routes 3. Promote the routes to permanent routes 4. Check if GC can find and purge the exceptions A few notes: + At step 4, unlike other test cases, we cannot wait for $GC_WAIT_TIME. While the exceptions are always iterable via netlink (since it traverses the entire fib tree instead of tb6_gc_hlist), rt6_nh_dump_exceptions() skips expired entries. If we waited for the expiration time, we would be unable to distinguish whether the exceptions were truly purged by GC or just hidden due to being expired. + For the same reason, at step 2, we use ICMPv6 redirect message instead of Packet Too Big message. This is because MTU exceptions always have RTF_EXPIRES, and rt6_age_examine_exception() does not respect the period specified by net.ipv6.route.flush=1. + We add a neighbour entry for the redirect target with NTF_ROUTER. Without this, the exceptions would be removed at step 3 when the fib6_may_remove_gc_list() is called. Without the fix, the exceptions remain even after GC is triggered by sysctl -wq net.ipv6.route.flush=1. FAIL: Expected 0 routes, got 5 TEST: ipv6 route garbage collection (promote to permanent routes) [FAIL] With the fix, GC purges the exceptions properly. TEST: ipv6 route garbage collection (promote to permanent routes) [ OK ] Signed-off-by: Kuniyuki Iwashima Reviewed-by: David Ahern Link: https://patch.msgid.link/20260320072317.2561779-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 4be7b99c253f0c85a255cc1db7127ba3232dfa30 Author: Kuniyuki Iwashima Date: Fri Mar 20 07:23:00 2026 +0000 ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. The cited commit mechanically put fib6_remove_gc_list() just after every fib6_clean_expires() call. When a temporary route is promoted to a permanent route, there may already be exception routes tied to it. If fib6_remove_gc_list() removes the route from tb6_gc_hlist, such exception routes will no longer be aged. Let's replace fib6_remove_gc_list() with a new helper fib6_may_remove_gc_list() and use fib6_age_exceptions() there. Note that net->ipv6 is only compiled when CONFIG_IPV6 is enabled, so fib6_{add,remove,may_remove}_gc_list() are guarded. Fixes: 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.") Signed-off-by: Kuniyuki Iwashima Reviewed-by: David Ahern Link: https://patch.msgid.link/20260320072317.2561779-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 6af51e9f31336632263c4680b2a3712295103e1f Author: Kuniyuki Iwashima Date: Fri Mar 20 07:22:59 2026 +0000 ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. Commit 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.") introduced a per-table GC list and changed GC to iterate over that list instead of traversing the entire route table. However, it forgot to add permanent routes to tb6_gc_hlist when exception routes are added. Commit cfe82469a00f ("ipv6: add exception routes to GC list in rt6_insert_exception") fixed that issue but introduced another one. Even after all exception routes expire, the permanent routes remain in tb6_gc_hlist, potentially negating the performance benefits intended by the initial change. Let's count gc_args->more before and after rt6_age_exceptions() and remove the permanent route when the delta is 0. Note that the next patch will reuse fib6_age_exceptions(). Fixes: cfe82469a00f ("ipv6: add exception routes to GC list in rt6_insert_exception") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Xin Long Reviewed-by: David Ahern Link: https://patch.msgid.link/20260320072317.2561779-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 05f643d6f7e699198ccc47e634de3879a8ec26a3 Author: Lukas Wunner Date: Mon Mar 23 07:52:39 2026 +0100 Documentation: PCI: Document PCIe TLP Header decoder for AER messages The prefix/header of a TLP that caused an error may be recorded in the AER Capability and emitted to the kernel log in raw hex format. Document the existence and usage of tlp-tool, which decodes the TLP Header into human-readable form. The TLP Header hints at the root cause of an error, yet is often ignored because of its seeming opaqueness. Instead, PCIe errors are frequently worked around by a change in the kernel without fully understanding the actual source of the problem. With more documentation on available tools we'll hopefully come up with better solutions. There are also wireshark dissectors for TLPs, but it seems they expect a complete TLP, not just the header, and they cannot grok the hex format emitted by the kernel directly. tlp-tool appears to be the most cut and dried solution out there. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Mika Westerberg Cc: Maciej Grochowski Link: https://patch.msgid.link/bf826c41b4c1d255c7dcb16e266b52f774d944ed.1774246067.git.lukas@wunner.de commit 70bb843794d150db8e653c9ab288c8533da00837 Author: Felix Gu Date: Mon Mar 23 19:05:22 2026 +0800 PCI/pwrctrl: Fix pci_pwrctrl_is_required() device node leak The for_each_endpoint_of_node() macro requires calling of_node_put() on the endpoint node when breaking out of the loop early. Add of_node_put(endpoint) before the early return to release the reference. Fixes: cf3287fb2c1f ("PCI/pwrctrl: Ensure that remote endpoint node parent has supply requirement") Signed-off-by: Felix Gu Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260323-pwctrl-v1-1-f5c03a2df7fb@gmail.com commit b5e5797e3cd1fd1561b212b2b94f8865d07f2890 Author: Joshua Hay Date: Fri Mar 6 18:12:47 2026 -0800 idpf: only assign num refillqs if allocation was successful As reported by AI review [1], if the refillqs allocation fails, refillqs will be NULL but num_refillqs will be non-zero. The release function will then dereference refillqs since it thinks the refillqs are present, resulting in a NULL ptr dereference. Only assign the num refillqs if the allocation was successful. This will prevent the release function from entering the loop and accessing refillqs. [1] https://lore.kernel.org/netdev/20260227035625.2632753-1-kuba@kernel.org/ Fixes: 95af467d9a4e3 ("idpf: configure resources for RX queues") Signed-off-by: Joshua Hay Reviewed-by: Madhu Chittim Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 1eb0db7e39da3d20ff6dfb8d359655329ea6f839 Author: Joshua Hay Date: Mon Mar 2 17:28:31 2026 -0800 idpf: clear stale cdev_info ptr Deinit calls idpf_idc_deinit_core_aux_device to free the cdev_info memory, but leaves the adapter->cdev_info field with a stale pointer value. This will bypass subsequent "if (!cdev_info)" checks if cdev_info is not reallocated. For example, if idc_init fails after a reset, cdev_info will already have been freed during the reset handling, but it will not have been reallocated. The next reset or rmmod will result in a crash. [ +0.000008] BUG: kernel NULL pointer dereference, address: 00000000000000d0 [ +0.000033] #PF: supervisor read access in kernel mode [ +0.000020] #PF: error_code(0x0000) - not-present page [ +0.000017] PGD 2097dfa067 P4D 0 [ +0.000017] Oops: Oops: 0000 [#1] SMP NOPTI ... [ +0.000018] RIP: 0010:device_del+0x3e/0x3d0 [ +0.000010] Call Trace: [ +0.000010] [ +0.000012] idpf_idc_deinit_core_aux_device+0x36/0x70 [idpf] [ +0.000034] idpf_vc_core_deinit+0x3e/0x180 [idpf] [ +0.000035] idpf_remove+0x40/0x1d0 [idpf] [ +0.000035] pci_device_remove+0x42/0xb0 [ +0.000020] device_release_driver_internal+0x19c/0x200 [ +0.000024] driver_detach+0x48/0x90 [ +0.000018] bus_remove_driver+0x6d/0x100 [ +0.000023] pci_unregister_driver+0x2e/0xb0 [ +0.000022] __do_sys_delete_module.isra.0+0x18c/0x2b0 [ +0.000025] ? kmem_cache_free+0x2c2/0x390 [ +0.000023] do_syscall_64+0x107/0x7d0 [ +0.000023] entry_SYSCALL_64_after_hwframe+0x76/0x7e Pass the adapter struct into idpf_idc_deinit_core_aux_device instead and clear the cdev_info ptr. Fixes: f4312e6bfa2a ("idpf: implement core RDMA auxiliary dev create, init, and destroy") Signed-off-by: Joshua Hay Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit fecacfc95f195b99c71c579a472120d0b4ed65fa Author: Kohei Enju Date: Sat Feb 14 19:14:25 2026 +0000 iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the value could change in runtime, we should use num_tx_queues instead. Moreover iavf_get_ethtool_stats() uses num_active_queues while iavf_get_sset_count() and iavf_get_stat_strings() use real_num_tx_queues, which triggers out-of-bounds writes when we do "ethtool -L" and "ethtool -S" simultaneously [1]. For example when we change channels from 1 to 8, Thread 3 could be scheduled before Thread 2, and out-of-bounds writes could be triggered in Thread 3: Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S) iavf_set_channels() ... iavf_alloc_queues() -> num_active_queues = 8 iavf_schedule_finish_config() iavf_get_sset_count() real_num_tx_queues: 1 -> buffer for 1 queue iavf_get_ethtool_stats() num_active_queues: 8 -> out-of-bounds! iavf_finish_config() -> real_num_tx_queues = 8 Use immutable num_tx_queues in all related functions to avoid the issue. [1] BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270 Write of size 8 at addr ffffc900031c9080 by task ethtool/5800 CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0x6f/0xb0 print_report+0x170/0x4f3 kasan_report+0xe1/0x180 iavf_add_one_ethtool_stat+0x200/0x270 iavf_get_ethtool_stats+0x14c/0x2e0 __dev_ethtool+0x3d0c/0x5830 dev_ethtool+0x12d/0x270 dev_ioctl+0x53c/0xe30 sock_do_ioctl+0x1a9/0x270 sock_ioctl+0x3d4/0x5e0 __x64_sys_ioctl+0x137/0x1c0 do_syscall_64+0xf3/0x690 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7da0e6e36d ... The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88813a013de0 pfn:0x13a013 flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 Fixes: 64430f70ba6f ("iavf: Fix displaying queue statistics shown by ethtool") Signed-off-by: Kohei Enju Reviewed-by: Simon Horman Reviewed-by: Przemek Kitszel Reviewed-by: Paul Menzel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 2526e440df2725e7328d59b835a164826f179b93 Author: Petr Oros Date: Thu Feb 12 08:53:11 2026 +0100 ice: use ice_update_eth_stats() for representor stats ice_repr_get_stats64() and __ice_get_ethtool_stats() call ice_update_vsi_stats() on the VF's src_vsi. This always returns early because ICE_VSI_DOWN is permanently set for VF VSIs - ice_up() is never called on them since queues are managed by iavf through virtchnl. In __ice_get_ethtool_stats() the original code called ice_update_vsi_stats() for all VSIs including representors, iterated over ice_gstrings_vsi_stats[] to populate the data, and then bailed out with an early return before the per-queue ring stats section. That early return was necessary because representor VSIs have no rings on the PF side - the rings belong to the VF driver (iavf), so accessing per-queue stats would be invalid. Move the representor handling to the top of __ice_get_ethtool_stats() and call ice_update_eth_stats() directly to read the hardware GLV_* counters. This matches ice_get_vf_stats() which already uses ice_update_eth_stats() for the same VF VSI in legacy mode. Apply the same fix to ice_repr_get_stats64(). Note that ice_gstrings_vsi_stats[] contains five software ring counters (rx_buf_failed, rx_page_failed, tx_linearize, tx_busy, tx_restart) that are always zero for representors since the PF never processes packets on VF rings. This is pre-existing behavior unchanged by this patch. Fixes: 7aae80cef7ba ("ice: add port representor ethtool ops and stats") Signed-off-by: Petr Oros Reviewed-by: Aleksandr Loktionov Tested-by: Patryk Holda Signed-off-by: Tony Nguyen commit 2d8c5098b847f37dde8351fb5b5d190f1bb5c576 Author: Chen-Yu Tsai Date: Thu Feb 26 17:22:33 2026 +0800 PCI/pwrctrl: Do not power off on pwrctrl device removal With the move to explicit pwrctrl power on/off APIs, the caller, i.e., the PCI controller driver, should manage the power state. The pwrctrl drivers should not try to clean up or power off when they are removed, as this might end up disabling an already disabled regulator, causing a big warning. This can be triggered if a PCI controller driver's .remove() callback calls pci_pwrctrl_destroy_devices() after pci_pwrctrl_power_off_devices(). Drop the devm cleanup parts that turn off regulators from the pwrctrl drivers. Fixes: b921aa3f8dec ("PCI/pwrctrl: Switch to pwrctrl create, power on/off, destroy APIs") Signed-off-by: Chen-Yu Tsai Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260226092234.3859740-1-wenst@chromium.org commit ad85de0fc09eb3236e73df5acb2bc257625103f5 Author: Petr Oros Date: Thu Feb 12 08:53:10 2026 +0100 ice: fix inverted ready check for VF representors Commit 0f00a897c9fcbd ("ice: check if SF is ready in ethtool ops") refactored the VF readiness check into a generic repr->ops.ready() callback but implemented ice_repr_ready_vf() with inverted logic: return !ice_check_vf_ready_for_cfg(repr->vf); ice_check_vf_ready_for_cfg() returns 0 on success, so the negation makes ready() return non-zero when the VF is ready. All callers treat non-zero as "not ready, skip", causing ndo_get_stats64, get_drvinfo, get_strings and get_ethtool_stats to always bail out in switchdev mode. Remove the erroneous negation. The SF variant ice_repr_ready_sf() is already correct (returns !active, i.e. non-zero when not active). Fixes: 0f00a897c9fcbd ("ice: check if SF is ready in ethtool ops") Signed-off-by: Petr Oros Reviewed-by: Aleksandr Loktionov Reviewed-by: Michal Swiatkowski Tested-by: Patryk Holda Signed-off-by: Tony Nguyen commit c7fcd269e1e07b2aa4bb37ffce7543c340796433 Author: Michal Swiatkowski Date: Mon Feb 23 13:51:57 2026 +0100 ice: set max queues in alloc_etherdev_mqs() When allocating netdevice using alloc_etherdev_mqs() the maximum supported queues number should be passed. The vsi->alloc_txq/rxq is storing current number of queues, not the maximum ones. Use the same function for getting max Tx and Rx queues which is used during ethtool -l call to set maximum number of queues during netdev allocation. Reproduction steps: $ethtool -l $pf # says current 16, max 64 $ethtool -S $pf # fine $ethtool -L $pf combined 40 # crash [491187.472594] Call Trace: [491187.472829] [491187.473067] netif_set_xps_queue+0x26/0x40 [491187.473305] ice_vsi_cfg_txq+0x265/0x3d0 [ice] [491187.473619] ice_vsi_cfg_lan_txqs+0x68/0xa0 [ice] [491187.473918] ice_vsi_cfg_lan+0x2b/0xa0 [ice] [491187.474202] ice_vsi_open+0x71/0x170 [ice] [491187.474484] ice_vsi_recfg_qs+0x17f/0x230 [ice] [491187.474759] ? dev_get_min_mp_channel_count+0xab/0xd0 [491187.474987] ice_set_channels+0x185/0x3d0 [ice] [491187.475278] ethnl_set_channels+0x26f/0x340 Fixes: ee13aa1a2c5a ("ice: use netif_get_num_default_rss_queues()") Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Reviewed-by: Paul Menzel Tested-by: Alexander Nowlin Signed-off-by: Tony Nguyen commit 1c37d896b12dfd0d4c96e310b0033c6676933917 Author: Filipe Manana Date: Wed Mar 18 16:17:59 2026 +0000 btrfs: fix lost error when running device stats on multiple devices fs Whenever we get an error updating the device stats item for a device in btrfs_run_dev_stats() we allow the loop to go to the next device, and if updating the stats item for the next device succeeds, we end up losing the error we had from the previous device. Fix this by breaking out of the loop once we get an error and make sure it's returned to the caller. Since we are in the transaction commit path (and in the critical section actually), returning the error will result in a transaction abort. Fixes: 733f4fbbc108 ("Btrfs: read device stats on mount, write modified ones during commit") Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a85b46db143fda5869e7d8df8f258ccef5fa1719 Author: Goldwyn Rodrigues Date: Fri Mar 13 14:11:39 2026 -0400 btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. Reviewed-by: Boris Burkov Signed-off-by: Goldwyn Rodrigues Signed-off-by: David Sterba commit 0dcabcb920a5c143c568f37c26c6f2b4b9206bd1 Author: Qu Wenruo Date: Fri Mar 13 18:35:26 2026 +1030 btrfs: zlib: handle page aligned compressed size correctly [BUG] Since commit 3d74a7556fba ("btrfs: zlib: introduce zlib_compress_bio() helper"), there are some reports about different crashes in zlib compression path. One of the symptoms is list corruption like the following: list_del corruption. next->prev should be fffffbb340204a08, but was ffff8d6517cb7de0. (next=fffffbb3402d62c8) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:65! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 21436 Comm: kworker/u16:7 Not tainted 7.0.0-rc2-jcg+ #1 PREEMPT Hardware name: LENOVO 10VGS02P00/3130, BIOS M1XKT57A 02/10/2022 Workqueue: btrfs-delalloc btrfs_work_helper [btrfs] RIP: 0010:__list_del_entry_valid_or_report+0xec/0xf0 Call Trace: btrfs_alloc_compr_folio+0xae/0xc0 [btrfs] zlib_compress_bio+0x39d/0x6a0 [btrfs] btrfs_compress_bio+0x2e3/0x3d0 [btrfs] compress_file_range+0x2b0/0x660 [btrfs] btrfs_work_helper+0xdb/0x3e0 [btrfs] process_one_work+0x192/0x3d0 worker_thread+0x19a/0x310 kthread+0xdf/0x120 ret_from_fork+0x22e/0x310 ret_from_fork_asm+0x1a/0x30 ---[ end trace 0000000000000000 ]--- Other symptoms include VM_BUG_ON() during folio_put() but it's rarer. David Sterba firstly reported this during his CI runs but unfortunately I'm unable to hit it. Meanwhile zstd/lzo doesn't seem to have the same problem. [CAUSE] During zlib_compress_bio() every time the output buffer is full, we queue the full folio into the compressed bio, and allocate a new folio as the output folio. After the input has finished, we loop through zlib_deflate() with Z_FINISH to flush all output. And when that is done, we still need to check if the last folio has any content, and if so we still need to queue that part into the compressed bio. The problem is in the final folio handling, if the final folio is full (for x86_64 the folio size is 4K), the length to queue is calculated by u32 cur_len = offset_in_folio(out_folio, workspace->strm.total_out); But since total_out is 4K aligned, the resulted @cur_len will be 0, then we hit the bio_add_folio(), which has a quirk that if bio_add_folio() got an length 0, it will still queue the folio into the bio, but return false. In that case we go to out: tag, which calls btrfs_free_compr_folio() to release @out_folio, which may put the out folio into the btrfs global pool list. On the other hand, that @out_folio is already added to the compressed bio, and will later be released again by cleanup_compressed_bio(), which results double release. And if this time we still need to put the folio into the btrfs global pool list, it will result a list corruption because it's already in the list. [FIX] Instead of offset_inside_folio(), directly use the difference between strm.total_out and bi_size. So that if the last folio is completely full, we can still properly queue the full folio other than queueing zero byte. Fixes: 3d74a7556fba ("btrfs: zlib: introduce zlib_compress_bio() helper") Reported-by: David Sterba Reported-by: Jean-Christophe Guillain Reported-by: syzbot+3c4d8371d65230f852a2@syzkaller.appspotmail.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=221176 Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit a4376d9a5d4c9610e69def3fc0b32c86a7ab7a41 Author: Shin'ichiro Kawasaki Date: Sun Mar 1 21:17:04 2026 +0900 btrfs: fix leak of kobject name for sub-group space_info When create_space_info_sub_group() allocates elements of space_info->sub_group[], kobject_init_and_add() is called for each element via btrfs_sysfs_add_space_info_type(). However, when check_removing_space_info() frees these elements, it does not call btrfs_sysfs_remove_space_info() on them. As a result, kobject_put() is not called and the associated kobj->name objects are leaked. This memory leak is reproduced by running the blktests test case zbd/009 on kernels built with CONFIG_DEBUG_KMEMLEAK. The kmemleak feature reports the following error: unreferenced object 0xffff888112877d40 (size 16): comm "mount", pid 1244, jiffies 4294996972 hex dump (first 16 bytes): 64 61 74 61 2d 72 65 6c 6f 63 00 c4 c6 a7 cb 7f data-reloc...... backtrace (crc 53ffde4d): __kmalloc_node_track_caller_noprof+0x619/0x870 kstrdup+0x42/0xc0 kobject_set_name_vargs+0x44/0x110 kobject_init_and_add+0xcf/0x150 btrfs_sysfs_add_space_info_type+0xfc/0x210 [btrfs] create_space_info_sub_group.constprop.0+0xfb/0x1b0 [btrfs] create_space_info+0x211/0x320 [btrfs] btrfs_init_space_info+0x15a/0x1b0 [btrfs] open_ctree+0x33c7/0x4a50 [btrfs] btrfs_get_tree.cold+0x9f/0x1ee [btrfs] vfs_get_tree+0x87/0x2f0 vfs_cmd_create+0xbd/0x280 __do_sys_fsconfig+0x3df/0x990 do_syscall_64+0x136/0x1540 entry_SYSCALL_64_after_hwframe+0x76/0x7e To avoid the leak, call btrfs_sysfs_remove_space_info() instead of kfree() for the elements. Fixes: f92ee31e031c ("btrfs: introduce btrfs_space_info sub-group") Link: https://lore.kernel.org/linux-block/b9488881-f18d-4f47-91a5-3c9bf63955a5@wdc.com/ Reviewed-by: Johannes Thumshirn Signed-off-by: Shin'ichiro Kawasaki Signed-off-by: David Sterba commit 5254d4181add9dfaa5e3519edd71cc8f752b2f85 Author: Filipe Manana Date: Tue Feb 17 14:46:50 2026 +0000 btrfs: fix zero size inode with non-zero size after log replay When logging that an inode exists, as part of logging a new name or logging new dir entries for a directory, we always set the generation of the logged inode item to 0. This is to signal during log replay (in overwrite_item()), that we should not set the i_size since we only logged that an inode exists, so the i_size of the inode in the subvolume tree must be preserved (as when we log new names or that an inode exists, we don't log extents). This works fine except when we have already logged an inode in full mode or it's the first time we are logging an inode created in a past transaction, that inode has a new i_size of 0 and then we log a new name for the inode (due to a new hardlink or a rename), in which case we log an i_size of 0 for the inode and a generation of 0, which causes the log replay code to not update the inode's i_size to 0 (in overwrite_item()). An example scenario: mkdir /mnt/dir xfs_io -f -c "pwrite 0 64K" /mnt/dir/foo sync xfs_io -c "truncate 0" -c "fsync" /mnt/dir/foo ln /mnt/dir/foo /mnt/dir/bar xfs_io -c "fsync" /mnt/dir After log replay the file remains with a size of 64K. This is because when we first log the inode, when we fsync file foo, we log its current i_size of 0, and then when we create a hard link we log again the inode in exists mode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we add to the log tree, so during log replay overwrite_item() sees that the generation is 0 and i_size is 0 so we skip updating the inode's i_size from 64K to 0. Fix this by making sure at fill_inode_item() we always log the real generation of the inode if it was logged in the current transaction with the i_size we logged before. Also if an inode created in a previous transaction is logged in exists mode only, make sure we log the i_size stored in the inode item located from the commit root, so that if we log multiple times that the inode exists we get the correct i_size. A test case for fstests will follow soon. Reported-by: Vyacheslav Kovalevsky Link: https://lore.kernel.org/linux-btrfs/af8c15fa-4e41-4bb2-885c-0bc4e97532a6@gmail.com/ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit b52fe51f724385b3ed81e37e510a4a33107e8161 Author: Mark Harmstone Date: Tue Feb 17 17:35:42 2026 +0000 btrfs: fix super block offset in error message in btrfs_validate_super() Fix the superblock offset mismatch error message in btrfs_validate_super(): we changed it so that it considers all the superblocks, but the message still assumes we're only looking at the first one. The change from %u to %llu is because we're changing from a constant to a u64. Fixes: 069ec957c35e ("btrfs: Refactor btrfs_check_super_valid") Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3e6dd28a11083e83e11a284d99fcc9eb748c321c Author: Yang Wang Date: Thu Mar 19 21:17:38 2026 -0400 drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 Forcibly disable the OD_FAN_CURVE feature when temperature or PWM range is invalid, otherwise PMFW will reject this configuration on smu v13.0.x example: $ sudo cat /sys/bus/pci/devices//gpu_od/fan_ctrl/fan_curve OD_FAN_CURVE: 0: 0C 0% 1: 0C 0% 2: 0C 0% 3: 0C 0% 4: 0C 0% OD_RANGE: FAN_CURVE(hotspot temp): 0C 0C FAN_CURVE(fan speed): 0% 0% $ echo "0 50 40" | sudo tee fan_curve kernel log: [ 756.442527] amdgpu 0000:03:00.0: amdgpu: Fan curve temp setting(50) must be within [0, 0]! [ 777.345800] amdgpu 0000:03:00.0: amdgpu: Fan curve temp setting(50) must be within [0, 0]! Closes: https://github.com/ROCm/amdgpu/issues/208 Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 470891606c5a97b1d0d937e0aa67a3bed9fcb056) Cc: stable@vger.kernel.org commit 2f0e491faee43181b6a86e90f34016b256042fe1 Author: Asad Kamal Date: Wed Mar 18 13:52:57 2026 +0800 drm/amd/pm: Return -EOPNOTSUPP for unsupported OD_MCLK on smu_v13_0_6 When SET_UCLK_MAX capability is absent, return -EOPNOTSUPP from smu_v13_0_6_emit_clk_levels() for OD_MCLK instead of 0. This makes unsupported OD_MCLK reporting consistent with other clock types and allows callers to skip the entry cleanly. Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit d82e0a72d9189e8acd353988e1a57f85ce479e37) Cc: stable@vger.kernel.org commit cdbc3b62cfc2785da32b82260f852370cc1f2a6a Author: Asad Kamal Date: Wed Mar 18 13:48:30 2026 +0800 drm/amd/pm: Skip redundant UCLK restore in smu_v13_0_6 Only reapply UCLK soft limits during PP_OD_RESTORE_DEFAULT when the current max differs from the DPM table max. This avoids redundant SMC updates and prevents -EINVAL on restore when no change is needed. Fixes: b7a900344546 ("drm/amd/pm: Allow setting max UCLK on SMU v13.0.6") Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 17f11bbbc76c8e83c8474ea708316b1e3631d927) commit 37c2caa167b0b8aca4f74c32404c5288b876a2a3 Author: Alex Hung Date: Mon Mar 9 11:16:08 2026 -0600 drm/amd/display: Fix drm_edid leak in amdgpu_dm [WHAT] When a sink is connected, aconnector->drm_edid was overwritten without freeing the previous allocation, causing a memory leak on resume. [HOW] Free the previous drm_edid before updating it. Reviewed-by: Roman Li Signed-off-by: Alex Hung Signed-off-by: Chuanyu Tseng Signed-off-by: Alex Deucher (cherry picked from commit 52024a94e7111366141cfc5d888b2ef011f879e5) Cc: stable@vger.kernel.org commit 14b81abe7bdc25f8097906fc2f91276ffedb2d26 Author: Eric Huang Date: Mon Mar 16 11:01:30 2026 -0400 drm/amdgpu: prevent immediate PASID reuse case PASID resue could cause interrupt issue when process immediately runs into hw state left by previous process exited with the same PASID, it's possible that page faults are still pending in the IH ring buffer when the process exits and frees up its PASID. To prevent the case, it uses idr cyclic allocator same as kernel pid's. Signed-off-by: Eric Huang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d) Cc: stable@vger.kernel.org commit 2d300ebfc411205fa31ba7741c5821d381912381 Author: Ruijing Dong Date: Tue Mar 17 13:54:11 2026 -0400 drm/amdgpu: fix strsep() corrupting lockup_timeout on multi-GPU (v3) amdgpu_device_get_job_timeout_settings() passes a pointer directly to the global amdgpu_lockup_timeout[] buffer into strsep(). strsep() destructively replaces delimiter characters with '\0' in-place. On multi-GPU systems, this function is called once per device. When a multi-value setting like "0,0,0,-1" is used, the first GPU's call transforms the global buffer into "0\00\00\0-1". The second GPU then sees only "0" (terminated at the first '\0'), parses a single value, hits the single-value fallthrough (index == 1), and applies timeout=0 to all rings — causing immediate false job timeouts. Fix this by copying into a stack-local array before calling strsep(), so the global module parameter buffer remains intact across calls. The buffer is AMDGPU_MAX_TIMEOUT_PARAM_LENGTH (256) bytes, which is safe for the stack. v2: wrap commit message to 72 columns, add Assisted-by tag. v3: use stack array with strscpy() instead of kstrdup()/kfree() to avoid unnecessary heap allocation (Christian). This patch was developed with assistance from Claude (claude-opus-4-6). Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Ruijing Dong Signed-off-by: Alex Deucher (cherry picked from commit 94d79f51efecb74be1d88dde66bdc8bfcca17935) Cc: stable@vger.kernel.org commit aed3d041ab061ec8a64f50a3edda0f4db7280025 Author: Yussuf Khalil Date: Fri Mar 6 12:06:35 2026 +0000 drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check"), amdgpu resets the CRTC state mode_changed flag to false when recomputing the DSC configuration results in no timing change for a particular stream. However, this is incorrect in scenarios where a change in MST/DSC configuration happens in the same KMS commit as another (unrelated) mode change. For example, the integrated panel of a laptop may be configured differently (e.g., HDR enabled/disabled) depending on whether external screens are attached. In this case, plugging in external DP-MST screens may result in the mode_changed flag being dropped incorrectly for the integrated panel if its DSC configuration did not change during precomputation in pre_validate_dsc(). At this point, however, dm_update_crtc_state() has already created new streams for CRTCs with DSC-independent mode changes. In turn, amdgpu_dm_commit_streams() will never release the old stream, resulting in a memory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to the new stream either, which manifests as a use-after-free when the stream gets disabled later on: BUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu] Write of size 4 at addr ffff88813d836524 by task kworker/9:9/29977 Workqueue: events drm_mode_rmfb_work_fn Call Trace: dump_stack_lvl+0x6e/0xa0 print_address_description.constprop.0+0x88/0x320 ? dc_stream_release+0x25/0x90 [amdgpu] print_report+0xfc/0x1ff ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x225/0x4e0 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_report+0xe1/0x180 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_check_range+0x125/0x200 dc_stream_release+0x25/0x90 [amdgpu] dc_state_destruct+0x14d/0x5c0 [amdgpu] dc_state_release.part.0+0x4e/0x130 [amdgpu] dm_atomic_destroy_state+0x3f/0x70 [amdgpu] drm_atomic_state_default_clear+0x8ee/0xf30 ? drm_mode_object_put.part.0+0xb1/0x130 __drm_atomic_state_free+0x15c/0x2d0 atomic_remove_fb+0x67e/0x980 Since there is no reliable way of figuring out whether a CRTC has unrelated mode changes pending at the time of DSC validation, remember the value of the mode_changed flag from before the point where a CRTC was marked as potentially affected by a change in DSC configuration. Reset the mode_changed flag to this earlier value instead in pre_validate_dsc(). Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5004 Fixes: 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check") Signed-off-by: Yussuf Khalil Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher (cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b) commit 63542bb402b7013171c9f621c28b609eda4dbf1f Author: Felix Gu Date: Sun Mar 22 21:29:56 2026 +0800 spi: meson-spicc: Fix double-put in remove path meson_spicc_probe() registers the controller with devm_spi_register_controller(), so teardown already drops the controller reference via devm cleanup. Calling spi_controller_put() again in meson_spicc_remove() causes a double-put. Fixes: 8311ee2164c5 ("spi: meson-spicc: fix memory leak in meson_spicc_remove") Signed-off-by: Felix Gu Reviewed-by: Johan Hovold Link: https://patch.msgid.link/20260322-rockchip-v1-1-fac3f0c6dad8@gmail.com Signed-off-by: Mark Brown commit 5a184f1cb43a8e035251c635f5c47da5dc3e3049 Author: Cezary Rojewski Date: Fri Mar 20 11:12:17 2026 +0100 ASoC: Intel: catpt: Fix the device initialization The DMA mask shall be coerced before any buffer allocations for the device are done. At the same time explain why DMA mask of 31 bits is used in the first place. Cc: Andy Shevchenko Fixes: 7a10b66a5df9 ("ASoC: Intel: catpt: Device driver lifecycle") Signed-off-by: Cezary Rojewski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260320101217.1243688-1-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 84481e705ab07ed46e56587fe846af194acacafe Author: SeongJae Park Date: Mon Mar 16 16:51:17 2026 -0700 mm/damon/stat: monitor all System RAM resources DAMON_STAT usage document (Documentation/admin-guide/mm/damon/stat.rst) says it monitors the system's entire physical memory. But, it is monitoring only the biggest System RAM resource of the system. When there are multiple System RAM resources, this results in monitoring only an unexpectedly small fraction of the physical memory. For example, suppose the system has a 500 GiB System RAM, 10 MiB non-System RAM, and 500 GiB System RAM resources in order on the physical address space. DAMON_STAT will monitor only the first 500 GiB System RAM. This situation is particularly common on NUMA systems. Select a physical address range that covers all System RAM areas of the system, to fix this issue and make it work as documented. [sj@kernel.org: return error if monitoring target region is invalid] Link: https://lkml.kernel.org/r/20260317053631.87907-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260316235118.873-1-sj@kernel.org Fixes: 369c415e6073 ("mm/damon: introduce DAMON_STAT module") Signed-off-by: SeongJae Park Cc: [6.17+] Signed-off-by: Andrew Morton commit 631c1111501f34980649242751e93cfdadfd1f1c Author: Lorenzo Stoakes (Oracle) Date: Mon Mar 16 14:01:22 2026 +0000 mm/zswap: add missing kunmap_local() Commit e2c3b6b21c77 ("mm: zswap: use SG list decompression APIs from zsmalloc") updated zswap_decompress() to use the scatterwalk API to copy data for uncompressed pages. In doing so, it mapped kernel memory locally for 32-bit kernels using kmap_local_folio(), however it never unmapped this memory. This resulted in the linked syzbot report where a BUG_ON() is triggered due to leaking the kmap slot. This patch fixes the issue by explicitly unmapping the established kmap. Also, add flush_dcache_folio() after the kunmap_local() call I had assumed that a new folio here combined with the flush that is done at the point of setting the PTE would suffice, but it doesn't seem that's actually the case, as update_mmu_cache() will in many archtectures only actually flush entries where a dcache flush was done on a range previously. I had also wondered whether kunmap_local() might suffice, but it doesn't seem to be the case. Some arches do seem to actually dcache flush on unmap, parisc does it if CONFIG_HIGHMEM is not set by setting ARCH_HAS_FLUSH_ON_KUNMAP and calling kunmap_flush_on_unmap() from __kunmap_local(), otherwise non-CONFIG_HIGHMEM callers do nothing here. Otherwise arch_kmap_local_pre_unmap() is called which does: * sparc - flush_cache_all() * arm - if VIVT, __cpuc_flush_dcache_area() * otherwise - nothing Also arch_kmap_local_post_unmap() is called which does: * arm - local_flush_tlb_kernel_page() * csky - kmap_flush_tlb() * microblaze, ppc - local_flush_tlb_page() * mips - local_flush_tlb_one() * sparc - flush_tlb_all() (again) * x86 - arch_flush_lazy_mmu_mode() * otherwise - nothing But this is only if it's high memory, and doesn't cover all architectures, so is presumably intended to handle other cache consistency concerns. In any case, VIPT is problematic here whether low or high memory (in spite of what the documentation claims, see [0] - 'the kernel did write to a page that is in the page cache page and / or in high memory'), because dirty cache lines may exist at the set indexed by the kernel direct mapping, which won't exist in the set indexed by any subsequent userland mapping, meaning userland might read stale data from L2 cache. Even if the documentation is correct and low memory is fine not to be flushed here, we can't be sure as to whether the memory is low or high (kmap_local_folio() will be a no-op if low), and this call should be harmless if it is low. VIVT would require more work if the memory were shared and already mapped, but this isn't the case here, and would anyway be handled by the dcache flush call. In any case, we definitely need this flush as far as I can tell. And we should probably consider updating the documentation unless it turns out there's somehow dcache synchronisation that happens for low memory/64-bit kernels elsewhere? [ljs@kernel.org: add flush_dcache_folio() after the kunmap_local() call] Link: https://lkml.kernel.org/r/13e09a99-181f-45ac-a18d-057faf94bccb@lucifer.local Link: https://lkml.kernel.org/r/20260316140122.339697-1-ljs@kernel.org Link: https://docs.kernel.org/core-api/cachetlb.html [0] Fixes: e2c3b6b21c77 ("mm: zswap: use SG list decompression APIs from zsmalloc") Signed-off-by: Lorenzo Stoakes (Oracle) Reported-by: syzbot+fe426bef95363177631d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69b75e2c.050a0220.12d28.015a.GAE@google.com Acked-by: Yosry Ahmed Acked-by: Johannes Weiner Reviewed-by: SeongJae Park Acked-by: Yosry Ahmed Acked-by: Nhat Pham Cc: Chengming Zhou Signed-off-by: Andrew Morton commit 38dfd294e24c0f397413799c2e5633aedb2058bf Author: Muhammad Usama Anjum Date: Tue Mar 10 17:17:39 2026 +0000 mailmap: update email address for Muhammad Usama Anjum Add updated email address. Link: https://lkml.kernel.org/r/20260310171757.3970390-1-usama.anjum@arm.com Signed-off-by: Muhammad Usama Anjum Cc: Arnd Bergmann Cc: Carlos Bilbao Cc: Hans Verkuil Cc: Jakub Kacinski Cc: Martin Kepplinger Cc: Shannon Nelson Signed-off-by: Andrew Morton commit a42c9b8b0c00ecd9b7467844f2fbfc766898bf54 Author: Felix Gu Date: Thu Mar 19 00:12:35 2026 +0800 spi: sn-f-ospi: Use devm_mutex_init() to simplify code Switch to devm_mutex_init() to handle mutex destruction automatically. This simplifies the error paths in probe() and removes the need for an explicit mutex_destroy() in remove() callback. Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260319-sn-f-v1-2-33a6738d2da8@gmail.com Signed-off-by: Mark Brown commit ef3d549e1deb3466c61f3b01d22fc3fe3e5efb08 Author: Felix Gu Date: Thu Mar 19 00:12:34 2026 +0800 spi: sn-f-ospi: Fix resource leak in f_ospi_probe() In f_ospi_probe(), when num_cs validation fails, it returns without calling spi_controller_put() on the SPI controller, which causes a resource leak. Use devm_spi_alloc_host() instead of spi_alloc_host() to ensure the SPI controller is properly freed when probe fails. Fixes: 1b74dd64c861 ("spi: Add Socionext F_OSPI SPI flash controller driver") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260319-sn-f-v1-1-33a6738d2da8@gmail.com Signed-off-by: Mark Brown commit 87997b6c6516e049cbaf2fc6810b213d587a06b1 Author: Michał Winiarski Date: Tue Feb 17 16:41:18 2026 +0100 drm/xe/pf: Fix use-after-free in migration restore When an error is returned from xe_sriov_pf_migration_restore_produce(), the data pointer is not set to NULL, which can trigger use-after-free in subsequent .write() calls. Set the pointer to NULL upon error to fix the problem. Fixes: 1ed30397c0b92 ("drm/xe/pf: Add support for encap/decap of bitstream to/from packet") Reported-by: Sebastian Österlund Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7230 Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260217154118.176902-1-michal.winiarski@intel.com Signed-off-by: Michał Winiarski (cherry picked from commit 4f53d8c6d23527d734fe3531d08e15cb170a0819) Signed-off-by: Rodrigo Vivi commit a3e93cac25316aad03bf561e3c205f4ca0b8f452 Author: Peter Zijlstra Date: Fri Mar 20 10:25:21 2026 +0100 x86/cpu: Add comment clarifying CRn pinning To avoid future confusion on the purpose and design of the CRn pinning code. Also note that if the attacker controls page-tables, the CRn bits lose much of the attraction anyway. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260320092521.GG3739106@noisy.programming.kicks-ass.net commit 70f8915ea4e909826306a8567c7fa46959e278db Author: Michal Piekos Date: Fri Mar 20 18:52:31 2026 +0100 pinctrl: sunxi: fix gpiochip_lock_as_irq() failure when pinmux is unknown Fixes kernel hang during boot due to inability to set up IRQ on AXP313a. The issue is caused by gpiochip_lock_as_irq() which is failing when gpio is in uninitialized state. Solution is to set pinmux to GPIO INPUT in sunxi_pinctrl_irq_request_resources() if it wasn't initialized earlier. Tested on Orange Pi Zero 3. Fixes: 01e10d0272b9 ("pinctrl: sunxi: Implement gpiochip::get_direction()") Reviewed-by: Andre Przywara Reviewed-by: Chen-Yu Tsai Signed-off-by: Michal Piekos Signed-off-by: Linus Walleij commit 42e06688c6cb7217578133bed67e9e3c1f061a58 Author: Andre Przywara Date: Fri Mar 20 18:52:30 2026 +0100 pinctrl: sunxi: pass down flags to pinctrl routines Recent changes in the Allwinner pinctrl/GPIO IP made us add some quirks, which the new SoCs (A523 family) need to use. We now have a comfortable "flags" field on the per-SoC setup side, to tag those quirks we need, but were translating those flag bits into specific fields for runtime use, in the init routine. Now the newest Allwinner GPIO IP adds even more quirks and exceptions, some of a boolean nature. To avoid inventing various new boolean flags for the runtime struct sunxi_pinctrl, let's just directly pass on the flags variable used by the setup code, so runtime can check for those various quirk bits directly. Rename the "variant" member to "flags", and directly copy the value from the setup code into there. Move the variant masking from the init routine to the functions which actually use the "variant" value. This mostly paves the way for the new A733 IP generation, which needs more quirks to be checked at runtime. Reviewed-by: Chen-Yu Tsai Signed-off-by: Andre Przywara Signed-off-by: Michal Piekos Signed-off-by: Linus Walleij commit 3645eb7e3915990a149460c151a00894cb586253 Author: Nikunj A Dadhania Date: Wed Mar 18 07:56:54 2026 +0000 x86/fred: Fix early boot failures on SEV-ES/SNP guests FRED-enabled SEV-(ES,SNP) guests fail to boot due to the following issues in the early boot sequence: * FRED does not have a #VC exception handler in the dispatch logic * Early FRED #VC exceptions attempt to use uninitialized per-CPU GHCBs instead of boot_ghcb Add X86_TRAP_VC case to fred_hwexc() with a new exc_vmm_communication() function that provides the unified entry point FRED requires, dispatching to existing user/kernel handlers based on privilege level. The function is already declared via DECLARE_IDTENTRY_VC(). Fix early GHCB access by falling back to boot_ghcb in __sev_{get,put}_ghcb() when per-CPU GHCBs are not yet initialized. Fixes: 14619d912b65 ("x86/fred: FRED entry/exit and dispatch code") Signed-off-by: Nikunj A Dadhania Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Cc: # 6.12+ Link: https://patch.msgid.link/20260318075654.1792916-4-nikunj@amd.com commit 34420cb92dbb9e37ff6c6603f4f5e1807db3f1de Author: Huiwen He Date: Mon Mar 23 17:08:12 2026 +0800 smb/client: ensure smb2_mapping_table rebuild on cmd changes The current rule for smb2_mapping_table.c uses `$(call cmd,...)`, which fails to track command line modifications in the Makefile (e.g., modifying the command to `perl -d` or `perl -w` for debug will not trigger a rebuild) and does not generate the required .cmd file for Kbuild. Fix this by transitioning to the standard `$(call if_changed,...)` macro. This includes adding the `FORCE` prerequisite and appending the output file to the `targets` variable so Kbuild can track it properly. As a result, Kbuild now automatically handles the cleaning of the generated file, allowing us to safely drop the redundant `clean-files` assignment. Fixes: c527e13a7a66 ("cifs: Autogenerate SMB2 error mapping table") Signed-off-by: Huiwen He Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 411df123c017169922cc767affce76282b8e6c85 Author: Borislav Petkov (AMD) Date: Thu Mar 19 12:07:59 2026 +0100 x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask Commit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so that whenever something else modifies CR4, that bit remains set. Which in itself is a perfectly fine idea. However, there's an issue when during boot FRED is initialized: first on the BSP and later on the APs. Thus, there's a window in time when exceptions cannot be handled. This becomes particularly nasty when running as SEV-{ES,SNP} or TDX guests which, when they manage to trigger exceptions during that short window described above, triple fault due to FRED MSRs not being set up yet. See Link tag below for a much more detailed explanation of the situation. So, as a result, the commit in that Link URL tried to address this shortcoming by temporarily disabling CR4 pinning when an AP is not online yet. However, that is a problem in itself because in this case, an attack on the kernel needs to only modify the online bit - a single bit in RW memory - and then disable CR4 pinning and then disable SM*P, leading to more and worse things to happen to the system. So, instead, remove the FRED bit from the CR4 pinning mask, thus obviating the need to temporarily disable CR4 pinning. If someone manages to disable FRED when poking at CR4, then idt_invalidate() would make sure the system would crash'n'burn on the first exception triggered, which is a much better outcome security-wise. Fixes: ff45746fbf00 ("x86/cpu: Add X86_CR4_FRED macro") Suggested-by: Dave Hansen Suggested-by: Peter Zijlstra Signed-off-by: Borislav Petkov (AMD) Cc: # 6.12+ Link: https://lore.kernel.org/r/177385987098.1647592.3381141860481415647.tip-bot2@tip-bot2 commit a8d51efb5929ae308895455a3e496b5eca2cd143 Author: Youngjun Park Date: Sun Mar 22 21:05:28 2026 +0900 PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask() Commit 35e4a69b2003f ("PM: sleep: Allow pm_restrict_gfp_mask() stacking") introduced refcount-based GFP mask management that warns when pm_restore_gfp_mask() is called with saved_gfp_count == 0. Some hibernation paths call pm_restore_gfp_mask() defensively where the GFP mask may or may not be restricted depending on the execution path. For example, the uswsusp interface invokes it in SNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE, and snapshot_release(). Before the stacking change this was a silent no-op; it now triggers a spurious WARNING. Remove the WARN_ON() wrapper from the !saved_gfp_count check while retaining the check itself, so that defensive calls remain harmless without producing false warnings. Fixes: 35e4a69b2003f ("PM: sleep: Allow pm_restrict_gfp_mask() stacking") Signed-off-by: Youngjun Park [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260322120528.750178-1-youngjun.park@lge.com Signed-off-by: Rafael J. Wysocki commit e02ea3ae8ee40d5835a845884c7b161a27c10bcb Author: David McFarland Date: Thu Feb 5 19:16:24 2026 -0400 platform/x86: intel-hid: disable wakeup_mode during hibernation Add a freeze handler which clears wakeup_mode. This fixes aborted hibernation on Dell Precision 3880. Wakeup event detected during hibernation, rolling back This system sends power button events during hibernation, even when triggered by software. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218634 Fixes: 0c4cae1bc00d ("PM: hibernate: Avoid missing wakeup events during hibernation") Signed-off-by: David McFarland Link: https://patch.msgid.link/20260205231629.1336348-1-corngood@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8a243d972aff2e0b0141048a3feaf3b13d78985c Author: Matthew Schwartz Date: Thu Mar 12 17:49:39 2026 -0700 platform/x86: asus-armoury: add support for GZ302EA and GZ302EAC Add TDP data for tablet models GZ302EA and GZ302EAC. Signed-off-by: Matthew Schwartz Reviewed-by: Denis Benato Link: https://patch.msgid.link/20260313004939.4103835-1-matthew.schwartz@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0198d2743207d67f995cd6df89e267e1b9f5e1f1 Author: Matthew Schwartz Date: Thu Mar 12 14:22:46 2026 -0700 platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC The ASUS ROG Flow Z13-KJP GZ302EAC model uses sys_vendor name ASUS rather than ASUSTeK COMPUTER INC., but it needs the same folio quirk as the other ROG Flow Z13. To keep things simple, just match on sys_vendor ASUS since it covers both. Signed-off-by: Matthew Schwartz Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Denis Benato Link: https://patch.msgid.link/20260312212246.1608080-1-matthew.schwartz@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7ff61be5a4844d4aaa31732a5831dd5cd6136448 Author: Alok Tiwari Date: Tue Mar 10 05:53:05 2026 -0700 platform/x86/amd/hsmp: Fix typo in error message Fix a typo in the HSMP error message where "tmeout" should be "timeout". Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20260310125307.700108-1-alok.a.tiwari@oracle.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2061f7b042f88d372cca79615f8425f3564c0b40 Author: Alok Tiwari Date: Tue Mar 10 06:01:35 2026 -0700 platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen The command length check validates inlen (> 5), but the error message incorrectly printed resp_len. Print inlen so the log reflects the actual command length. Fixes: 0c3d931b3ab9e ("Platform: OLPC: Add XO-1.75 EC driver") Signed-off-by: Alok Tiwari Acked-by: Lubomir Rintel Reviewed-by: Randy Dunlap Link: https://patch.msgid.link/20260310130138.700687-1-alok.a.tiwari@oracle.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5a3955f3602950d1888df743a5b1889e43b5cb60 Author: Nathan Chancellor Date: Fri Mar 13 14:06:34 2026 -0700 platform/x86: lenovo: wmi-gamezone: Drop gz_chain_head The gz_chain_head variable has been unused since the driver's initial addition to the tree. Its use was eliminated between v3 and v4 during development but due to the reference of gz_chain_head's wait_list member, the compiler could not warn that it was unused. After a (tip) commit ("locking/rwsem: Remove the list_head from struct rw_semaphore"), which removed a reference to the variable passed to __RWSEM_INITIALIZER(), certain configurations show an unused variable warning from the Lenovo wmi-gamezone driver: drivers/platform/x86/lenovo/wmi-gamezone.c:34:31: warning: 'gz_chain_head' defined but not used [-Wunused-variable] 34 | static BLOCKING_NOTIFIER_HEAD(gz_chain_head); | ^~~~~~~~~~~~~ include/linux/notifier.h:119:39: note: in definition of macro 'BLOCKING_NOTIFIER_HEAD' 119 | struct blocking_notifier_head name = \ | ^~~~ Remove the variable to prevent the warning from showing up. Fixes: 22024ac5366f ("platform/x86: Add Lenovo Gamezone WMI Driver") Signed-off-by: Nathan Chancellor Reviewed-by: Mark Pearson Link: https://patch.msgid.link/20260313-lenovo-wmi-gamezone-remove-gz_chain_head-v1-1-ce5231f0c6fa@kernel.org [ij: reorganized the changelog] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9f11d9b15efb5f77e810b6dfbeb01b4650a79eae Author: Li RongQing Date: Tue Mar 3 02:46:35 2026 -0500 platform/x86: ISST: Check HWP support before MSR access On some systems, HWP can be explicitly disabled in the BIOS settings When HWP is disabled by firmware, the HWP CPUID bit is not set, and attempting to read MSR_PM_ENABLE will result in a General Protection (GP) fault. unchecked MSR access error: RDMSR from 0x770 at rIP: 0xffffffffc33db92e (disable_dynamic_sst_features+0xe/0x50 [isst_tpmi_core]) Call Trace: ? ex_handler_msr+0xf6/0x150 ? fixup_exception+0x1ad/0x340 ? gp_try_fixup_and_notify+0x1e/0xb0 ? exc_general_protection+0xc9/0x390 ? terminate_walk+0x64/0x100 ? asm_exc_general_protection+0x22/0x30 ? disable_dynamic_sst_features+0xe/0x50 [isst_tpmi_core] isst_if_def_ioctl+0xece/0x1050 [isst_tpmi_core] ? ioctl_has_perm.constprop.42+0xe0/0x130 isst_if_def_ioctl+0x10d/0x1a0 [isst_if_common] __se_sys_ioctl+0x86/0xc0 do_syscall_64+0x8a/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 RIP: 0033:0x7f36eaef54a7 Add a check for X86_FEATURE_HWP before accessing the MSR. If HWP is not available, return true safely. Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI") Signed-off-by: Li RongQing Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260303074635.2218-1-lirongqing@baidu.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 435da773966c80e1b2b6aea75460ef0e893fd9e9 Author: Krishna Chomal Date: Mon Mar 2 13:05:25 2026 +0530 platform/x86: hp-wmi: Add support for Omen 16-k0xxx (8A4D) The HP Omen 16-k0xxx (board ID: 8A4D) has the same WMI interface as other Victus S boards, but requires additional quirks for correctly switching thermal profile. Create a new quirk omen_v1_legacy_thermal_params which allows a board to use Omen V1 thermal values, but rely on the older legacy HP_OMEN_EC_THERMAL_PROFILE_OFFSET. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to the newly added quirk. Testing on board 8A4D confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Qinfeng Wu Reported-by: Qinfeng Wu Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221150 Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260302073525.71037-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 84d29bfd1929d08f092851162a3d055a2134d043 Author: Krishna Chomal Date: Fri Feb 27 21:11:06 2026 +0530 platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C76) The HP Omen 16-wf1xxx (board ID: 8C76) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile (similar to board 8C78). Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_thermal_params. Testing on board 8C76 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: WJ Enderlava Reported-by: WJ Enderlava Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221149 Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260227154106.226809-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 55b964dfbadc3729d3606849471eab11705f578a Author: Raed Date: Wed Mar 11 18:43:38 2026 +0530 platform/x86: hp-wmi: Add Omen 16-xf0xxx (8BCA) support The HP Omen 16-xf0xxx board 8BCA uses the same Victus-S fan and thermal WMI path as other recently supported Omen/Victus boards, but it requires Omen v1 thermal profile parameters for correct platform profile behavior. Add board 8BCA to victus_s_thermal_profile_boards[] and map it to omen_v1_thermal_params. Validated on HP Omen 16-xf0xxx (board 8BCA): - /sys/firmware/acpi/platform_profile exposes low-power/balanced/performance - fan RPM reporting works (fan1_input/fan2_input) - manual fan control works through hp-wmi hwmon (pwm1/pwm1_enable) Signed-off-by: Raed Link: https://patch.msgid.link/20260311131338.965249-1-youaretalkingtoraed@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d2723918d51b238b42efcaac553697aa84f15232 Author: Denis Benato Date: Mon Mar 9 19:35:58 2026 +0100 platform/x86: asus-armoury: add support for G614FP Add TDP data for laptop model G614FP. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260309183559.433555-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e0836f48e19147a85ae652335e517b0385a32fd3 Author: Denis Benato Date: Mon Mar 9 19:35:57 2026 +0100 platform/x86: asus-armoury: add support for GA503QM Add TDP data for laptop model GA503QM. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260309183559.433555-2-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 93702ed64fd0c433289b3846c2cefced4a88a043 Author: Denis Benato Date: Wed Mar 4 15:11:02 2026 +0100 MAINTAINERS: change email address of Denis Benato I have been using a linux.dev email since that is hugely better than gmail. Signed-off-by: Denis Benato Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260304141102.63732-1-denis.benato@linux.dev Signed-off-by: Ilpo Järvinen commit 734eba62cd32cb9ceffa09e57cdc03d761528525 Author: Alberto Garcia Date: Mon Mar 9 18:39:41 2026 +0100 PM: hibernate: Drain trailing zero pages on userspace restore Commit 005e8dddd497 ("PM: hibernate: don't store zero pages in the image file") added an optimization to skip zero-filled pages in the hibernation image. On restore, zero pages are handled internally by snapshot_write_next() in a loop that processes them without returning to the caller. With the userspace restore interface, writing the last non-zero page to /dev/snapshot is followed by the SNAPSHOT_ATOMIC_RESTORE ioctl. At this point there are no more calls to snapshot_write_next() so any trailing zero pages are not processed, snapshot_image_loaded() fails because handle->cur is smaller than expected, the ioctl returns -EPERM and the image is not restored. The in-kernel restore path is not affected by this because the loop in load_image() in swap.c calls snapshot_write_next() until it returns 0. It is this final call that drains any trailing zero pages. Fixed by calling snapshot_write_next() in snapshot_write_finalize(), giving the kernel the chance to drain any trailing zero pages. Fixes: 005e8dddd497 ("PM: hibernate: don't store zero pages in the image file") Signed-off-by: Alberto Garcia Acked-by: Brian Geffon Link: https://patch.msgid.link/ef5a7c5e3e3dbd17dcb20efaa0c53a47a23498bb.1773075892.git.berto@igalia.com Signed-off-by: Rafael J. Wysocki commit 6a28fb8cb28b9eb39a392e531d938a889eacafc5 Author: Viresh Kumar Date: Fri Mar 20 15:08:14 2026 +0530 cpufreq: conservative: Reset requested_freq on limits change A recently reported issue highlighted that the cached requested_freq is not guaranteed to stay in sync with policy->cur. If the platform changes the actual CPU frequency after the governor sets one (e.g. due to platform-specific frequency scaling) and a re-sync occurs later, policy->cur may diverge from requested_freq. This can lead to incorrect behavior in the conservative governor. For example, the governor may assume the CPU is already running at the maximum frequency and skip further increases even though there is still headroom. Avoid this by resetting the cached requested_freq to policy->cur on detecting a change in policy limits. Reported-by: Lifeng Zheng Tested-by: Lifeng Zheng Link: https://lore.kernel.org/all/20260210115458.3493646-1-zhenglifeng1@huawei.com/ Signed-off-by: Viresh Kumar Reviewed-by: Zhongqiu Han Cc: All applicable Link: https://patch.msgid.link/d846a141a98ac0482f20560fcd7525c0f0ec2f30.1773999467.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki commit 8f13c0c6cb75cc4421d5a60fc060e9e6fd9d1097 Author: Viresh Kumar Date: Fri Mar 20 14:54:06 2026 +0530 cpufreq: Don't skip cpufreq_frequency_table_cpuinfo() The commit 6db0f533d320 ("cpufreq: preserve freq_table_sorted across suspend/hibernate") unintentionally made a change where cpufreq_frequency_table_cpuinfo() isn't getting called anymore for old policies getting re-initialized. This leads to potentially invalid values of policy->max and policy->cpuinfo_max_freq. Fix the issue by reverting the original commit and adding the condition for just the sorting function. Fixes: 6db0f533d320 ("cpufreq: preserve freq_table_sorted across suspend/hibernate") Signed-off-by: Viresh Kumar Cc: 6.19+ # 6.19+ Link: https://patch.msgid.link/65ba5c45749267c82e8a87af3dc788b37a0b3f48.1773998611.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki commit 05243d490bb7852a8acca7b5b5658019c7797a52 Author: Nikunj A Dadhania Date: Wed Mar 18 07:56:52 2026 +0000 x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() Move FSGSBASE enablement from identify_cpu() to cpu_init_exception_handling() to ensure it is enabled before any exceptions can occur on both boot and secondary CPUs. == Background == Exception entry code (paranoid_entry()) uses ALTERNATIVE patching based on X86_FEATURE_FSGSBASE to decide whether to use RDGSBASE/WRGSBASE instructions or the slower RDMSR/SWAPGS sequence for saving/restoring GSBASE. On boot CPU, ALTERNATIVE patching happens after enabling FSGSBASE in CR4. When the feature is available, the code is permanently patched to use RDGSBASE/WRGSBASE, which require CR4.FSGSBASE=1 to execute without triggering == Boot Sequence == Boot CPU (with CR pinning enabled): trap_init() cpu_init() <- Uses unpatched code (RDMSR/SWAPGS) x2apic_setup() ... arch_cpu_finalize_init() identify_boot_cpu() identify_cpu() cr4_set_bits(X86_CR4_FSGSBASE) # Enables the feature # This becomes part of cr4_pinned_bits ... alternative_instructions() <- Patches code to use RDGSBASE/WRGSBASE Secondary CPUs (with CR pinning enabled): start_secondary() cr4_init() <- Code already patched, CR4.FSGSBASE=1 set implicitly via cr4_pinned_bits cpu_init() <- exceptions work because FSGSBASE is already enabled Secondary CPU (with CR pinning disabled): start_secondary() cr4_init() <- Code already patched, CR4.FSGSBASE=0 cpu_init() x2apic_setup() rdmsrq(MSR_IA32_APICBASE) <- Triggers #VC in SNP guests exc_vmm_communication() paranoid_entry() <- Uses RDGSBASE with CR4.FSGSBASE=0 (patched code) ... ap_starting() identify_secondary_cpu() identify_cpu() cr4_set_bits(X86_CR4_FSGSBASE) <- Enables the feature, which is too late == CR Pinning == Currently, for secondary CPUs, CR4.FSGSBASE is set implicitly through CR-pinning: the boot CPU sets it during identify_cpu(), it becomes part of cr4_pinned_bits, and cr4_init() applies those pinned bits to secondary CPUs. This works but creates an undocumented dependency between cr4_init() and the pinning mechanism. == Problem == Secondary CPUs boot after alternatives have been applied globally. They execute already-patched paranoid_entry() code that uses RDGSBASE/WRGSBASE instructions, which require CR4.FSGSBASE=1. Upcoming changes to CR pinning behavior will break the implicit dependency, causing secondary CPUs to generate #UD. This issue manifests itself on AMD SEV-SNP guests, where the rdmsrq() in x2apic_setup() triggers a #VC exception early during cpu_init(). The #VC handler (exc_vmm_communication()) executes the patched paranoid_entry() path. Without CR4.FSGSBASE enabled, RDGSBASE instructions trigger #UD. == Fix == Enable FSGSBASE explicitly in cpu_init_exception_handling() before loading exception handlers. This makes the dependency explicit and ensures both boot and secondary CPUs have FSGSBASE enabled before paranoid_entry() executes. Fixes: c82965f9e530 ("x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit") Reported-by: Borislav Petkov Suggested-by: Sohil Mehta Signed-off-by: Nikunj A Dadhania Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Sohil Mehta Cc: Link: https://patch.msgid.link/20260318075654.1792916-2-nikunj@amd.com commit a0e0c2f8c5f32b675f58e25a9338283cedb5ad2b Author: Yixun Lan Date: Fri Mar 20 11:06:17 2026 +0000 reset: spacemit: k3: Decouple composite reset lines Instead of grouping several different reset lines into one composite reset, decouple them to individual ones which make it more aligned with underlying hardware. And for DWC USB driver, it will match well with the number of the reset property in the DT bindings. The DWC3 USB host controller in K3 SoC has three reset lines - AHB, VCC, PHY. The PCIe controller also has three reset lines - DBI, Slave, Master. Also three reset lines each for UCIE and RCPU block. As an agreement with maintainer, the reset IDs has been rearranged as contiguous number but keep most part unchanged to avoid break patches which already sent to mailing list. The changes of DT binding header file and reset driver are merged together as one single commit to avoid git-bisect breakage. Fixes: 938ce3b16582 ("reset: spacemit: Add SpacemiT K3 reset driver") Fixes: 216e0a5e98e5 ("dt-bindings: soc: spacemit: Add K3 reset support and IDs") Signed-off-by: Yixun Lan Reviewed-by: Philipp Zabel Acked-by: Conor Dooley Signed-off-by: Philipp Zabel commit fbffb8c7c7bb4d38e9f65e0bee446685011de5d8 Author: Guangshuo Li Date: Sat Mar 21 15:42:40 2026 +0800 reset: gpio: fix double free in reset_add_gpio_aux_device() error path When __auxiliary_device_add() fails, reset_add_gpio_aux_device() calls auxiliary_device_uninit(adev). The device release callback reset_gpio_aux_device_release() frees adev, but the current error path then calls kfree(adev) again, causing a double free. Keep kfree(adev) for the auxiliary_device_init() failure path, but avoid freeing adev after auxiliary_device_uninit(). Fixes: 5fc4e4cf7a22 ("reset: gpio: use software nodes to setup the GPIO lookup") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Reviewed-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 907150bbe566e23714a25d7bcb910f236c3c44c0 Author: Mihai Sain Date: Mon Feb 9 11:07:35 2026 +0200 ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB The pioB controller on the SAM9X7 SoC actually supports 27 GPIO lines. The previous value of 26 was incorrect, leading to the last pin being unavailable for use by the GPIO subsystem. Update the #gpio-lines property to reflect the correct hardware specification. Fixes: 41af45af8bc3 ("ARM: dts: at91: sam9x7: add device tree for SoC") Signed-off-by: Mihai Sain Link: https://lore.kernel.org/r/20260209090735.2016-1-mihai.sain@microchip.com Signed-off-by: Claudiu Beznea commit 8de4e0f44c638c66cdc5eeb4d5ab9acd61c31e4f Author: Felix Gu Date: Fri Mar 20 22:56:38 2026 +0800 gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio() devm_regmap_init_mmio() returns an ERR_PTR() on failure, not NULL. The original code checked for NULL which would never trigger on error, potentially leading to an invalid pointer dereference. Use IS_ERR() and PTR_ERR() to properly handle the error case. Fixes: e88500247dc3 ("gpio: add QIXIS FPGA GPIO controller") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260320-qixis-v1-1-a8efc22e8945@gmail.com Signed-off-by: Bartosz Golaszewski commit c6c56ff975f046be25f527231a239e37920aca5e Author: Long Li Date: Fri Mar 20 10:11:30 2026 +0800 xfs: remove redundant validation in xlog_recover_attri_commit_pass2 Remove the redundant post-parse validation switch. By the time that block is reached, xfs_attri_validate() has already guaranteed all name lengths are non-zero via xfs_attri_validate_namelen(), and xfs_attri_validate_name_iovec() has already returned -EFSCORRUPTED for NULL names. For the REMOVE case, attr_value and value_len are structurally guaranteed to be NULL/zero because the parsing loop only populates them when value_len != 0. All checks in that switch are therefore dead code. Reviewed-by: Darrick J. Wong Signed-off-by: Long Li Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit d72f2084e30966097c8eae762e31986a33c3c0ae Author: Long Li Date: Fri Mar 20 10:11:29 2026 +0800 xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 The ri_total checks for SET/REPLACE operations are hardcoded to 3, but xfs_attri_item_size() only emits a value iovec when value_len > 0, so ri_total is 2 when value_len == 0. For PPTR_SET/PPTR_REMOVE/PPTR_REPLACE, value_len is validated by xfs_attri_validate() to be exactly sizeof(struct xfs_parent_rec) and is never zero, so their hardcoded checks remain correct. This problem may cause log recovery failures. The following script can be used to reproduce the problem: #!/bin/bash mkfs.xfs -f /dev/sda mount /dev/sda /mnt/test/ touch /mnt/test/file for i in {1..200}; do attr -s "user.attr_$i" -V "value_$i" /mnt/test/file > /dev/null done echo 1 > /sys/fs/xfs/debug/larp echo 1 > /sys/fs/xfs/sda/errortag/larp attr -s "user.zero" -V "" /mnt/test/file echo 0 > /sys/fs/xfs/sda/errortag/larp umount /mnt/test mount /dev/sda /mnt/test/ # mount failed Fix this by deriving the expected count dynamically as "2 + !!value_len" for SET/REPLACE operations. Cc: stable@vger.kernel.org # v6.9 Fixes: ad206ae50eca ("xfs: check opcode and iovec count match in xlog_recover_attri_commit_pass2") Reviewed-by: Darrick J. Wong Signed-off-by: Long Li Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61 Author: Long Li Date: Tue Mar 17 09:51:55 2026 +0800 xfs: close crash window in attr dabtree inactivation When inactivating an inode with node-format extended attributes, xfs_attr3_node_inactive() invalidates all child leaf/node blocks via xfs_trans_binval(), but intentionally does not remove the corresponding entries from their parent node blocks. The implicit assumption is that xfs_attr_inactive() will truncate the entire attr fork to zero extents afterwards, so log recovery will never reach the root node and follow those stale pointers. However, if a log shutdown occurs after the leaf/node block cancellations commit but before the attr bmap truncation commits, this assumption breaks. Recovery replays the attr bmap intact (the inode still has attr fork extents), but suppresses replay of all cancelled leaf/node blocks, maybe leaving them as stale data on disk. On the next mount, xlog_recover_process_iunlinks() retries inactivation and attempts to read the root node via the attr bmap. If the root node was not replayed, reading the unreplayed root block triggers a metadata verification failure immediately; if it was replayed, following its child pointers to unreplayed child blocks triggers the same failure: XFS (pmem0): Metadata corruption detected at xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78 XFS (pmem0): Unmount and run xfs_repair XFS (pmem0): First 128 bytes of corrupted metadata buffer: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ XFS (pmem0): metadata I/O error in "xfs_da_read_buf+0x104/0x190" at daddr 0x78 len 8 error 117 Fix this in two places: In xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a child block, immediately remove the entry that references it from the parent node in the same transaction. This eliminates the window where the parent holds a pointer to a cancelled block. Once all children are removed, the now-empty root node is converted to a leaf block within the same transaction. This node-to-leaf conversion is necessary for crash safety. If the system shutdown after the empty node is written to the log but before the second-phase bmap truncation commits, log recovery will attempt to verify the root block on disk. xfs_da3_node_verify() does not permit a node block with count == 0; such a block will fail verification and trigger a metadata corruption shutdown. on the other hand, leaf blocks are allowed to have this transient state. In xfs_attr_inactive(), split the attr fork truncation into two explicit phases. First, truncate all extents beyond the root block (the child extents whose parent references have already been removed above). Second, invalidate the root block and truncate the attr bmap to zero in a single transaction. The two operations in the second phase must be atomic: as long as the attr bmap has any non-zero length, recovery can follow it to the root block, so the root block invalidation must commit together with the bmap-to-zero truncation. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Long Li Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e65bb55d7f8c2041c8fdb73cd29b0b4cad4ed847 Author: Long Li Date: Tue Mar 17 09:51:54 2026 +0800 xfs: factor out xfs_attr3_leaf_init Factor out wrapper xfs_attr3_leaf_init function, which exported for external use. Reviewed-by: Darrick J. Wong Signed-off-by: Long Li Signed-off-by: Carlos Maiolino commit ce4e789cf3561c9fac73cc24445bfed9ea0c514b Author: Long Li Date: Tue Mar 17 09:51:53 2026 +0800 xfs: factor out xfs_attr3_node_entry_remove Factor out wrapper xfs_attr3_node_entry_remove function, which exported for external use. Reviewed-by: Darrick J. Wong Signed-off-by: Long Li Signed-off-by: Carlos Maiolino commit e942498385bf80f4d6d075b47174035545eb6a2e Author: Long Li Date: Tue Mar 17 09:51:52 2026 +0800 xfs: only assert new size for datafork during truncate extents The assertion functions properly because we currently only truncate the attr to a zero size. Any other new size of the attr is not preempted. Make this assertion is specific to the datafork, preparing for subsequent patches to truncate the attribute to a non-zero size. Reviewed-by: Darrick J. Wong Signed-off-by: Long Li Signed-off-by: Carlos Maiolino commit ec42a3a90ae9ae64b16d01a2e5d32ec0865ca8cf Author: Bartosz Golaszewski Date: Wed Mar 18 15:00:54 2026 +0100 gpio: shared: handle pins shared by child nodes of devices Shared GPIOs may be assigned to child nodes of device nodes which don't themselves bind to any struct device. We need to pass the firmware node that is the actual consumer to gpiolib-shared and compare against it instead of unconditionally using the fwnode of the consumer device. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reported-by: Jon Hunter Closes: https://lore.kernel.org/all/921ba8ce-b18e-4a99-966d-c763d22081e2@nvidia.com/ Tested-by: Jon Hunter Acked-by: Jon Hunter Link: https://patch.msgid.link/20260318-gpio-shared-xlate-v2-2-0ce34c707e81@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 710abda58055ed5eaa8958107633cc12a365c328 Author: Bartosz Golaszewski Date: Wed Mar 18 15:00:53 2026 +0100 gpio: shared: call gpio_chip::of_xlate() if set OF-based GPIO controller drivers may provide a translation function that calculates the real chip offset from whatever devicetree sources provide. We need to take this into account in the shared GPIO management and call of_xlate() if it's provided and adjust the entry->offset we initially set when scanning the tree. To that end: modify the shared GPIO API to take the GPIO chip as argument on setup (to avoid having to rcu_dereference() it from the GPIO device) and protect the access to entry->offset with the existing lock. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reported-by: Jon Hunter Closes: https://lore.kernel.org/all/921ba8ce-b18e-4a99-966d-c763d22081e2@nvidia.com/ Reviewed-by: Linus Walleij Tested-by: Jon Hunter Acked-by: Jon Hunter Link: https://patch.msgid.link/20260318-gpio-shared-xlate-v2-1-0ce34c707e81@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit bfa71b7a9dc6b5b8af157686e03308291141d00c Author: Ville Syrjälä Date: Mon Mar 16 18:39:51 2026 +0200 drm/i915: Unlink NV12 planes earlier unlink_nv12_plane() will clobber parts of the plane state potentially already set up by plane_atomic_check(), so we must make sure not to call the two in the wrong order. The problem happens when a plane previously selected as a Y plane is now configured as a normal plane by user space. plane_atomic_check() will first compute the proper plane state based on the userspace request, and unlink_nv12_plane() later clears some of the state. This used to work on account of unlink_nv12_plane() skipping the state clearing based on the plane visibility. But I removed that check, thinking it was an impossible situation. Now when that situation happens unlink_nv12_plane() will just WARN and proceed to clobber the state. Rather than reverting to the old way of doing things, I think it's more clear if we unlink the NV12 planes before we even compute the new plane state. Cc: stable@vger.kernel.org Reported-by: Khaled Almahallawy Closes: https://lore.kernel.org/intel-gfx/20260212004852.1920270-1-khaled.almahallawy@intel.com/ Tested-by: Khaled Almahallawy Fixes: 6a01df2f1b2a ("drm/i915: Remove pointless visible check in unlink_nv12_plane()") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260316163953.12905-2-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar (cherry picked from commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc) Signed-off-by: Joonas Lahtinen commit 6ad2a661ff0d3d94884947d2a593311ba46d34c2 Author: Ville Syrjälä Date: Fri Mar 13 13:07:40 2026 +0200 drm/i915: Order OP vs. timeout correctly in __wait_for() Put the barrier() before the OP so that anything we read out in OP and check in COND will actually be read out after the timeout has been evaluated. Currently the only place where we use OP is __intel_wait_for_register(), but the use there is precisely susceptible to this reordering, assuming the ktime_*() stuff itself doesn't act as a sufficient barrier: __intel_wait_for_register(...) { ... ret = __wait_for(reg_value = intel_uncore_read_notrace(...), (reg_value & mask) == value, ...); ... } Cc: stable@vger.kernel.org Fixes: 1c3c1dc66a96 ("drm/i915: Add compiler barrier to wait_for") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260313110740.24620-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit a464bace0482aa9a83e9aa7beefbaf44cd58e6cf) Signed-off-by: Joonas Lahtinen commit 08441f10f4dc09fdeb64529953ac308abc79dd38 Author: Samasth Norway Ananda Date: Mon Mar 16 16:19:19 2026 -0700 drm/i915/gmbus: fix spurious timeout on 512-byte burst reads When reading exactly 512 bytes with burst read enabled, the extra_byte_added path breaks out of the inner do-while without decrementing len. The outer while(len) then re-enters and gmbus_wait() times out since all data has been delivered. Decrement len before the break so the outer loop terminates correctly. Fixes: d5dc0f43f268 ("drm/i915/gmbus: Enable burst read") Signed-off-by: Samasth Norway Ananda Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260316231920.135438-2-samasth.norway.ananda@oracle.com Signed-off-by: Jani Nikula (cherry picked from commit 4ab0f09ee73fc853d00466682635f67c531f909c) Signed-off-by: Joonas Lahtinen commit 0e55f63dd08f09651d39e1b709a91705a8a0ddcb Author: Namjae Jeon Date: Fri Mar 13 14:45:58 2026 +0900 ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number. Fix the remaining call sites to use the correct offsetof() value. Cc: stable@vger.kernel.org Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound") Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 309b44ed684496ed3f9c5715d10b899338623512 Author: Werner Kasselman Date: Tue Mar 17 07:55:37 2026 +0000 ksmbd: fix memory leaks and NULL deref in smb2_lock() smb2_lock() has three error handling issues after list_del() detaches smb_lock from lock_list at no_check_cl: 1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK path, goto out leaks smb_lock and its flock because the out: handler only iterates lock_list and rollback_list, neither of which contains the detached smb_lock. 2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out leaks smb_lock and flock for the same reason. The error code returned to the dispatcher is also stale. 3) In the rollback path, smb_flock_init() can return NULL on allocation failure. The result is dereferenced unconditionally, causing a kernel NULL pointer dereference. Add a NULL check to prevent the crash and clean up the bookkeeping; the VFS lock itself cannot be rolled back without the allocation and will be released at file or connection teardown. Fix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before the if(!rc) check in the UNLOCK branch so all exit paths share one free site, and by freeing smb_lock and flock before goto out in the non-UNLOCK branch. Propagate the correct error code in both cases. Fix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding a NULL check for locks_free_lock(rlock) in the shared cleanup. Found via call-graph analysis using sqry. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Suggested-by: ChenXiaoSong Signed-off-by: Werner Kasselman Reviewed-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 48623ec358c1c600fa1e38368746f933e0f1a617 Author: Werner Kasselman Date: Mon Mar 16 11:38:47 2026 +0000 ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() smb_grant_oplock() has two issues in the oplock publication sequence: 1) opinfo is linked into ci->m_op_list (via opinfo_add) before add_lease_global_list() is called. If add_lease_global_list() fails (kmalloc returns NULL), the error path frees the opinfo via __free_opinfo() while it is still linked in ci->m_op_list. Concurrent m_op_list readers (opinfo_get_list, or direct iteration in smb_break_all_levII_oplock) dereference the freed node. 2) opinfo->o_fp is assigned after add_lease_global_list() publishes the opinfo on the global lease list. A concurrent find_same_lease_key() can walk the lease list and dereference opinfo->o_fp->f_ci while o_fp is still NULL. Fix by restructuring the publication sequence to eliminate post-publish failure: - Set opinfo->o_fp before any list publication (fixes NULL deref). - Preallocate lease_table via alloc_lease_table() before opinfo_add() so add_lease_global_list() becomes infallible after publication. - Keep the original m_op_list publication order (opinfo_add before lease list) so concurrent opens via same_client_has_lease() and opinfo_get_list() still see the in-flight grant. - Use opinfo_put() instead of __free_opinfo() on err_out so that the RCU-deferred free path is used. This also requires splitting add_lease_global_list() to take a preallocated lease_table and changing its return type from int to void, since it can no longer fail. Fixes: 1dfd062caa16 ("ksmbd: fix use-after-free by using call_rcu() for oplock_info") Cc: stable@vger.kernel.org Signed-off-by: Werner Kasselman Reviewed-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 9bbb19d21ded7d78645506f20d8c44895e3d0fb9 Author: Hyunwoo Kim Date: Tue Mar 17 08:52:01 2026 +0900 ksmbd: do not expire session on binding failure When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() -- which belongs to another connection's user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS). Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put(). Cc: stable@vger.kernel.org Signed-off-by: Hyunwoo Kim Acked-by: Namjae Jeon Signed-off-by: Steve French commit c369299895a591d96745d6492d4888259b004a9e Author: Linus Torvalds Date: Sun Mar 22 14:42:17 2026 -0700 Linux 7.0-rc5 commit 493ad070cbcb0d62deed877d90e80e554cac7f01 Author: Arnaldo Carvalho de Melo Date: Sun Mar 22 18:33:28 2026 -0300 tools headers: Synchronize linux/build_bug.h with the kernel sources To pick up the changes in: 6ffd853b0b10e1e2 ("build_bug.h: correct function parameters names in kernel-doc") That just add some comments, addressing this perf tools build warning: Warning: Kernel ABI header differences: diff -u tools/include/linux/build_bug.h include/linux/build_bug.h Please take a look at tools/include/uapi/README for further info on this synchronization process. Cc: Andrew Morton Cc: Ian Rogers Cc: Randy Dunlap Signed-off-by: Arnaldo Carvalho de Melo commit 0a8b2a0857ede906f7b74a435b11778336770bea Author: Arnaldo Carvalho de Melo Date: Wed Mar 18 15:48:54 2026 -0300 tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources To pick the changes in: e2ffe85b6d2bb778 ("KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM") That just rebuilds kvm-stat.c on x86, no change in functionality. This silences these perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Please see tools/include/uapi/README for further details. Cc: Jim Mattson Cc: Paolo Bonzini Signed-off-by: Arnaldo Carvalho de Melo commit 3c71ae8ec9adde96f5ecfcbeef62ccf1d420f83f Author: Arnaldo Carvalho de Melo Date: Wed Mar 18 15:47:05 2026 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: da142f3d373a6dda ("KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the 'perf trace' ioctl syscall argument beautifiers. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Signed-off-by: Arnaldo Carvalho de Melo commit 4ddd7588fae6175e748cff22c79faafb4d455d42 Author: Arnaldo Carvalho de Melo Date: Wed Mar 18 15:42:16 2026 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes from these csets: 9073428bb204d921 ("x86/sev: Allow IBPB-on-Entry feature for SNP guests") That cause no changes to tooling as it doesn't include a new MSR to be captured by the tools/perf/trace/beauty/tracepoints/x86_msr.sh script. Just silences this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Cc: Borislav Petkov (AMD) Cc: Kim Phillips Signed-off-by: Arnaldo Carvalho de Melo commit ec69c9e88315c4be70c283f18c2ff130da6320b5 Author: Mikko Perttunen Date: Tue Mar 3 13:32:11 2026 +0900 i2c: tegra: Don't mark devices with pins as IRQ safe I2C devices with associated pinctrl states (DPAUX I2C controllers) will change pinctrl state during runtime PM. This requires taking a mutex, so these devices cannot be marked as IRQ safe. Add PINCTRL as dependency to avoid build errors. Signed-off-by: Mikko Perttunen Reported-by: Russell King Link: https://lore.kernel.org/all/E1vsNBv-00000009nfA-27ZK@rmk-PC.armlinux.org.uk/ Signed-off-by: Linus Torvalds commit d5273fd3ca0bf0b59fff49fb59237440998fbec8 Merge: ac57fa9faf716c 4a04d13576fd69 Author: Linus Torvalds Date: Sun Mar 22 11:16:06 2026 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix how linked registers track zero extension of subregisters (Daniel Borkmann) - Fix unsound scalar fork for OR instructions (Daniel Wade) - Fix exception exit lock check for subprogs (Ihor Solodrai) - Fix undefined behavior in interpreter for SDIV/SMOD instructions (Jenny Guanni Qu) - Release module's BTF when module is unloaded (Kumar Kartikeya Dwivedi) - Fix constant blinding for PROBE_MEM32 instructions (Sachin Kumar) - Reset register ID for END instructions to prevent incorrect value tracking (Yazhou Tang) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add a test cases for sync_linked_regs regarding zext propagation bpf: Fix sync_linked_regs regarding BPF_ADD_CONST32 zext propagation selftests/bpf: Add tests for maybe_fork_scalars() OR vs AND handling bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR selftests/bpf: Add tests for sdiv32/smod32 with INT_MIN dividend bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN selftests/bpf: Add tests for bpf_throw lock leak from subprogs bpf: Fix exception exit lock checking for subprogs bpf: Release module BTF IDR before module unload selftests/bpf: Fix pkg-config call on static builds bpf: Fix constant blinding for PROBE_MEM32 stores selftests/bpf: Add test for BPF_END register ID reset bpf: Reset register ID for BPF_END value tracking commit ac57fa9faf716c6a0e30128c2c313443cf633019 Merge: 11ac4ce3f708a0 50b35c9e50a865 Author: Linus Torvalds Date: Sun Mar 22 11:10:31 2026 -0700 Merge tag 'trace-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Revert "tracing: Remove pid in task_rename tracing output" A change was made to remove the pid field from the task_rename event because it was thought that it was always done for the current task and recording the pid would be redundant. This turned out to be incorrect and there are a few corner case where this is not true and caused some regressions in tooling. - Fix the reading from user space for migration The reading of user space uses a seq lock type of logic where it uses a per-cpu temporary buffer and disables migration, then enables preemption, does the copy from user space, disables preemption, enables migration and checks if there was any schedule switches while preemption was enabled. If there was a context switch, then it is considered that the per-cpu buffer could be corrupted and it tries again. There's a protection check that tests if it takes a hundred tries, it issues a warning and exits out to prevent a live lock. This was triggered because the task was selected by the load balancer to be migrated to another CPU, every time preemption is enabled the migration task would schedule in try to migrate the task but can't because migration is disabled and let it run again. This caused the scheduler to schedule out the task every time it enabled preemption and made the loop never exit (until the 100 iteration test triggered). Fix this by enabling and disabling preemption and keeping migration enabled if the reading from user space needs to be done again. This will let the migration thread migrate the task and the copy from user space will likely pass on the next iteration. - Fix trace_marker copy option freeing The "copy_trace_marker" option allows a tracing instance to get a copy of a write to the trace_marker file of the top level instance. This is managed by a link list protected by RCU. When an instance is removed, a check is made if the option is set, and if so synchronized_rcu() is called. The problem is that an iteration is made to reset all the flags to what they were when the instance was created (to perform clean ups) was done before the check of the copy_trace_marker option and that option was cleared, so the synchronize_rcu() was never called. Move the clearing of all the flags after the check of copy_trace_marker to do synchronize_rcu() so that the option is still set if it was before and the synchronization is performed. - Fix entries setting when validating the persistent ring buffer When validating the persistent ring buffer on boot up, the number of events per sub-buffer is added to the sub-buffer meta page. The validator was updating cpu_buffer->head_page (the first sub-buffer of the per-cpu buffer) and not the "head_page" variable that was iterating the sub-buffers. This was causing the first sub-buffer to be assigned the entries for each sub-buffer and not the sub-buffer that was supposed to be updated. - Use "hash" value to update the direct callers When updating the ftrace direct callers, it assigned a temporary callback to all the callback functions of the ftrace ops and not just the functions represented by the passed in hash. This causes an unnecessary slow down of the functions of the ftrace_ops that is not being modified. Only update the functions that are going to be modified to call the ftrace loop function so that the update can be made on those functions. * tag 'trace-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Use hash argument for tmp_ops in update_ftrace_direct_mod ring-buffer: Fix to update per-subbuf entries of persistent ring buffer tracing: Fix trace_marker copy link list updates tracing: Fix failure to read user space from system call trace events tracing: Revert "tracing: Remove pid in task_rename tracing output" commit 11ac4ce3f708a073eb9e35fa11f741bb51f45302 Merge: 8d8bd2a5aa980e 2f42e85622567a Author: Linus Torvalds Date: Sun Mar 22 11:05:34 2026 -0700 Merge tag 'i2c-for-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - fix broken I2C communication on Armada 3700 with recovery - fix device_node reference leak in probe (fsi) - fix NULL-deref when serial string is missing (cp2615) * tag 'i2c-for-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: pxa: defer reset on Armada 3700 when recovery is used i2c: fsi: Fix a potential leak in fsi_i2c_probe() i2c: cp2615: fix serial string NULL-deref at probe commit 8d8bd2a5aa980efaf39b3f46eb1bfd0b5da54453 Merge: ebfd9b7af2fb1e 1f6aa5bbf1d0f8 Author: Linus Torvalds Date: Sun Mar 22 10:54:12 2026 -0700 Merge tag 'x86-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Improve Qemu MCE-injection behavior by only using AMD SMCA MSRs if the feature bit is set - Fix the relative path of gettimeofday.c inclusion in vclock_gettime.c - Fix a boot crash on UV clusters when a socket is marked as 'deconfigured' which are mapped to the SOCK_EMPTY node ID by the UV firmware, while Linux APIs expect NUMA_NO_NODE. The difference being (0xffff [unsigned short ~0]) vs [int -1] * tag 'x86-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/platform/uv: Handle deconfigured sockets x86/entry/vdso: Fix path of included gettimeofday.c x86/mce/amd: Check SMCA feature bit before accessing SMCA MSRs commit ebfd9b7af2fb1e4bbc97a8b33845e7402c3defa9 Merge: dea622e183d34e e7fcc54524f04e Author: Linus Torvalds Date: Sun Mar 22 10:31:51 2026 -0700 Merge tag 'perf-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: - Fix a PMU driver crash on AMD EPYC systems, caused by a race condition in x86_pmu_enable() - Fix a possible counter-initialization bug in x86_pmu_enable() - Fix a counter inheritance bug in inherit_event() and __perf_event_read() - Fix an Intel PMU driver branch constraints handling bug found by UBSAN - Fix the Intel PMU driver's new Off-Module Response (OMR) support code for Diamond Rapids / Nova lake, to fix a snoop information parsing bug * tag 'perf-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Fix OMR snoop information parsing issues perf/x86/intel: Add missing branch counters constraint apply perf: Make sure to use pmu_ctx->pmu for groups x86/perf: Make sure to program the counter value for stopped events on migration perf/x86: Move event pointer setup earlier in x86_pmu_enable() commit dea622e183d34e6a4f90acfee9abb605885432bf Merge: d56d4a110f5a1f 4e5019216402ad Author: Linus Torvalds Date: Sun Mar 22 10:17:50 2026 -0700 Merge tag 'objtool-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Ingo Molnar: "Fix three more livepatching related build environment bugs, and a false positive warning with Clang jump tables" * tag 'objtool-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix Clang jump table detection livepatch/klp-build: Fix inconsistent kernel version objtool/klp: fix mkstemp() failure with long paths objtool/klp: fix data alignment in __clone_symbol() commit d56d4a110f5a1f340710c12a6a8e3ce915824b8e Merge: b5fddfad348297 14de1552a4e3fe Author: Linus Torvalds Date: Sun Mar 22 09:57:20 2026 -0700 Merge tag 'locking-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Fix a sparse build error regression in caused by the locking context-analysis changes" * tag 'locking-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: include/linux/local_lock_internal.h: Make this header file again compatible with sparse commit b5fddfad34829771c2d06ed43fea35b5e30bd1c9 Merge: d723091c8c3e07 76f0930d6e8092 Author: Linus Torvalds Date: Sun Mar 22 09:55:58 2026 -0700 Merge tag 'irq-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Ingo Molnar: "Fix a mailbox channel leak in the riscv-rpmi-sysmsi irqchip driver" * tag 'irq-urgent-2026-03-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in rpmi_sysmsi_probe() commit 4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a Author: Luca Leonardo Scorcia Date: Wed Feb 25 09:38:41 2026 +0000 drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register The call to mipi_dsi_host_register triggers a callback to mtk_dsi_bind, which uses dev_get_drvdata to retrieve the mtk_dsi struct, so this structure needs to be stored inside the driver data before invoking it. As drvdata is currently uninitialized it leads to a crash when registering the DSI DRM encoder right after acquiring the mode_config.idr_mutex, blocking all subsequent DRM operations. Fixes the following crash during mediatek-drm probe (tested on Xiaomi Smart Clock x04g): Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040 [...] Modules linked in: mediatek_drm(+) drm_display_helper cec drm_client_lib drm_dma_helper drm_kms_helper panel_simple [...] Call trace: drm_mode_object_add+0x58/0x98 (P) __drm_encoder_init+0x48/0x140 drm_encoder_init+0x6c/0xa0 drm_simple_encoder_init+0x20/0x34 [drm_kms_helper] mtk_dsi_bind+0x34/0x13c [mediatek_drm] component_bind_all+0x120/0x280 mtk_drm_bind+0x284/0x67c [mediatek_drm] try_to_bring_up_aggregate_device+0x23c/0x320 __component_add+0xa4/0x198 component_add+0x14/0x20 mtk_dsi_host_attach+0x78/0x100 [mediatek_drm] mipi_dsi_attach+0x2c/0x50 panel_simple_dsi_probe+0x4c/0x9c [panel_simple] mipi_dsi_drv_probe+0x1c/0x28 really_probe+0xc0/0x3dc __driver_probe_device+0x80/0x160 driver_probe_device+0x40/0x120 __device_attach_driver+0xbc/0x17c bus_for_each_drv+0x88/0xf0 __device_attach+0x9c/0x1cc device_initial_probe+0x54/0x60 bus_probe_device+0x34/0xa0 device_add+0x5b0/0x800 mipi_dsi_device_register_full+0xdc/0x16c mipi_dsi_host_register+0xc4/0x17c mtk_dsi_probe+0x10c/0x260 [mediatek_drm] platform_probe+0x5c/0xa4 really_probe+0xc0/0x3dc __driver_probe_device+0x80/0x160 driver_probe_device+0x40/0x120 __driver_attach+0xc8/0x1f8 bus_for_each_dev+0x7c/0xe0 driver_attach+0x24/0x30 bus_add_driver+0x11c/0x240 driver_register+0x68/0x130 __platform_register_drivers+0x64/0x160 mtk_drm_init+0x24/0x1000 [mediatek_drm] do_one_initcall+0x60/0x1d0 do_init_module+0x54/0x240 load_module+0x1838/0x1dc0 init_module_from_file+0xd8/0xf0 __arm64_sys_finit_module+0x1b4/0x428 invoke_syscall.constprop.0+0x48/0xc8 do_el0_svc+0x3c/0xb8 el0_svc+0x34/0xe8 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 52800022 941004ab 2a0003f3 37f80040 (29005a80) Fixes: e4732b590a77 ("drm/mediatek: dsi: Register DSI host after acquiring clocks and PHY") Signed-off-by: Luca Leonardo Scorcia Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20260225094047.76780-1-l.scorcia@gmail.com/ Signed-off-by: Chun-Kuang Hu commit 2452969ca1081fea6bd9ab7ad5e168a5d11f28ec Author: Felix Gu Date: Sun Feb 22 17:45:39 2026 +0800 iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode The DMA channel was requested in nxp_sar_adc_buffer_postenable() but was only released in nxp_sar_adc_buffer_software_do_predisable(). This caused a DMA channel resource leak when operating in trigger mode. Fix this by moving dma_request_chan() from nxp_sar_adc_buffer_postenable() into nxp_sar_adc_buffer_software_do_postenable(), ensuring the DMA channel is only requested in software mode. Fixes: 4434072a893e ("iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms") Signed-off-by: Felix Gu Cc: Signed-off-by: Jonathan Cameron commit 9d3fa23d5d55a137fd4396d3d4799102587a7f2b Author: Antoniu Miclaus Date: Thu Mar 12 13:20:23 2026 +0200 iio: accel: adxl313: add missing error check in predisable Check the return value of the FIFO bypass regmap_write() before proceeding to disable interrupts. Fixes: ff8093fa6ba4 ("iio: accel: adxl313: add buffered FIFO watermark with interrupt handling") Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit c354521708175d776d896f8bdae44b18711eccb6 Author: Antoniu Miclaus Date: Thu Mar 12 13:20:24 2026 +0200 iio: dac: ad5770r: fix error return in ad5770r_read_raw() Return the error code from regmap_bulk_read() instead of 0 so that I/O failures are properly propagated. Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support") Signed-off-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit 4f51e6c0baae80e52bd013092e82a55678be31fc Author: Valek Andrej Date: Fri Mar 13 10:24:13 2026 +0100 iio: accel: fix ADXL355 temperature signature value Temperature was wrongly represented as 12-bit signed, confirmed by checking the datasheet. Even if the temperature is negative, the value in the register stays unsigned. Fixes: 12ed27863ea3 iio: accel: Add driver support for ADXL355 Signed-off-by: Valek Andrej Cc: Signed-off-by: Jonathan Cameron commit 2932095c114b98cbb40ccf34fc00d613cb17cead Author: Cosmin Tanislav Date: Fri Jan 30 14:23:53 2026 +0200 counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member The counter driver can use HW channels 1 and 2, while the PWM driver can use HW channels 0, 1, 2, 3, 4, 6, 7. The dev member is assigned both by the counter driver and the PWM driver for channels 1 and 2, to their own struct device instance, overwriting the previous value. The sub-drivers race to assign their own struct device pointer to the same struct rz_mtu3_channel's dev member. The dev member of struct rz_mtu3_channel is used by the counter sub-driver for runtime PM. Depending on the probe order of the counter and PWM sub-drivers, the dev member may point to the wrong struct device instance, causing the counter sub-driver to do runtime PM actions on the wrong device. To fix this, use the parent pointer of the counter, which is assigned during probe to the correct struct device, not the struct device pointer inside the shared struct rz_mtu3_channel. Cc: stable@vger.kernel.org Fixes: 0be8907359df ("counter: Add Renesas RZ/G2L MTU3a counter driver") Signed-off-by: Cosmin Tanislav Link: https://lore.kernel.org/r/20260130122353.2263273-6-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: William Breathitt Gray commit 67c3f99bed6f422ba343d2b70a2eeeccdfd91bef Author: Cosmin Tanislav Date: Fri Jan 30 14:23:52 2026 +0200 counter: rz-mtu3-cnt: prevent counter from being toggled multiple times Runtime PM counter is incremented / decremented each time the sysfs enable file is written to. If user writes 0 to the sysfs enable file multiple times, runtime PM usage count underflows, generating the following message. rz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow! At the same time, hardware registers end up being accessed with clocks off in rz_mtu3_terminate_counter() to disable an already disabled channel. If user writes 1 to the sysfs enable file multiple times, runtime PM usage count will be incremented each time, requiring the same number of 0 writes to get it back to 0. If user writes 0 to the sysfs enable file while PWM is in progress, PWM is stopped without counter being the owner of the underlying MTU3 channel. Check against the cached count_is_enabled value and exit if the user is trying to set the same enable value. Cc: stable@vger.kernel.org Fixes: 0be8907359df ("counter: Add Renesas RZ/G2L MTU3a counter driver") Signed-off-by: Cosmin Tanislav Link: https://lore.kernel.org/r/20260130122353.2263273-5-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: William Breathitt Gray commit c7f27a8ab9f2f43570f0725256597a0d7abe2c5b Author: Song Liu Date: Sat Mar 21 20:30:45 2026 -0700 workqueue: Fix false positive stall reports On weakly ordered architectures (e.g., arm64), the lockless check in wq_watchdog_timer_fn() can observe a reordering between the worklist insertion and the last_progress_ts update. Specifically, the watchdog can see a non-empty worklist (from a list_add) while reading a stale last_progress_ts value, causing a false positive stall report. This was confirmed by reading pool->last_progress_ts again after holding pool->lock in wq_watchdog_timer_fn(): workqueue watchdog: pool 7 false positive detected! lockless_ts=4784580465 locked_ts=4785033728 diff=453263ms worklist_empty=0 To avoid slowing down the hot path (queue_work, etc.), recheck last_progress_ts with pool->lock held. This will eliminate the false positive with minimal overhead. Remove two extra empty lines in wq_watchdog_timer_fn() as we are on it. Fixes: 82607adcf9cd ("workqueue: implement lockup detector") Cc: stable@vger.kernel.org # v4.5+ Assisted-by: claude-code:claude-opus-4-6 Signed-off-by: Song Liu Signed-off-by: Tejun Heo commit b0377ee8042985b0d91bf579afcc4ee9150db14d Author: Sergey Senozhatsky Date: Thu Mar 19 12:44:56 2026 +0900 zram: do not slot_free() written-back slots slot_free() basically completely resets the slots by clearing all of its flags and attributes. While zram_writeback_complete() restores some of flags back (those that are necessary for async read decompression) we still lose a lot of slot's metadata. For example, slot's ac-time, or ZRAM_INCOMPRESSIBLE. More importantly, restoring flags/attrs requires extra attention as some of the flags are directly affecting zram device stats. And the original code did not pay that attention. Namely ZRAM_HUGE slots handling in zram_writeback_complete(). The call to slot_free() would decrement ->huge_pages, however when zram_writeback_complete() restored the slot's ZRAM_HUGE flag, it would not get reflected in an incremented ->huge_pages. So when the slot would finally get freed, slot_free() would decrement ->huge_pages again, leading to underflow. Fix this by open-coding the required memory free and stats updates in zram_writeback_complete(), rather than calling the destructive slot_free(). Since we now preserve the ZRAM_HUGE flag on written-back slots (for the deferred decompression path), we also update slot_free() to skip decrementing ->huge_pages if ZRAM_WB is set. Link: https://lkml.kernel.org/r/20260320023143.2372879-1-senozhatsky@chromium.org Link: https://lkml.kernel.org/r/20260319034912.1894770-1-senozhatsky@chromium.org Fixes: d38fab605c667 ("zram: introduce compressed data writeback") Signed-off-by: Sergey Senozhatsky Acked-by: Minchan Kim Cc: Brian Geffon Cc: Richard Chang Signed-off-by: Andrew Morton commit 26f775a054c3cda86ad465a64141894a90a9e145 Author: SeongJae Park Date: Thu Mar 19 07:52:17 2026 -0700 mm/damon/core: avoid use of half-online-committed context One major usage of damon_call() is online DAMON parameters update. It is done by calling damon_commit_ctx() inside the damon_call() callback function. damon_commit_ctx() can fail for two reasons: 1) invalid parameters and 2) internal memory allocation failures. In case of failures, the damon_ctx that attempted to be updated (commit destination) can be partially updated (or, corrupted from a perspective), and therefore shouldn't be used anymore. The function only ensures the damon_ctx object can safely deallocated using damon_destroy_ctx(). The API callers are, however, calling damon_commit_ctx() only after asserting the parameters are valid, to avoid damon_commit_ctx() fails due to invalid input parameters. But it can still theoretically fail if the internal memory allocation fails. In the case, DAMON may run with the partially updated damon_ctx. This can result in unexpected behaviors including even NULL pointer dereference in case of damos_commit_dests() failure [1]. Such allocation failure is arguably too small to fail, so the real world impact would be rare. But, given the bad consequence, this needs to be fixed. Avoid such partially-committed (maybe-corrupted) damon_ctx use by saving the damon_commit_ctx() failure on the damon_ctx object. For this, introduce damon_ctx->maybe_corrupted field. damon_commit_ctx() sets it when it is failed. kdamond_call() checks if the field is set after each damon_call_control->fn() is executed. If it is set, ignore remaining callback requests and return. All kdamond_call() callers including kdamond_fn() also check the maybe_corrupted field right after kdamond_call() invocations. If the field is set, break the kdamond_fn() main loop so that DAMON sill doesn't use the context that might be corrupted. [sj@kernel.org: let kdamond_call() with cancel regardless of maybe_corrupted] Link: https://lkml.kernel.org/r/20260320031553.2479-1-sj@kernel.org Link: https://sashiko.dev/#/patchset/20260319145218.86197-1-sj%40kernel.org Link: https://lkml.kernel.org/r/20260319145218.86197-1-sj@kernel.org Link: https://lore.kernel.org/20260319043309.97966-1-sj@kernel.org [1] Fixes: 3301f1861d34 ("mm/damon/sysfs: handle commit command using damon_call()") Signed-off-by: SeongJae Park Cc: [6.15+] Signed-off-by: Andrew Morton commit 3a206a8649f83bec99a3517da5e7dac9c138875e Author: Lorenzo Stoakes (Oracle) Date: Wed Mar 18 12:26:32 2026 +0000 mm/rmap: clear vma->anon_vma on error Commit 542eda1a8329 ("mm/rmap: improve anon_vma_clone(), unlink_anon_vmas() comments, add asserts") alters the way errors are handled, but overlooked one important aspect of clean up. When a VMA encounters an error state in anon_vma_clone() (that is, on attempted allocation of anon_vma_chain objects), it cleans up partially established state in cleanup_partial_anon_vmas(), before returning an error. However, this occurs prior to anon_vma->num_active_vmas being incremented, and it also fails to clear the VMA's vma->anon_vma field, which remains in place. This is immediately an inconsistent state, because anon_vma->num_active_vmas is supposed to track the number of VMAs whose vma->anon_vma field references that anon_vma, and now that count is off-by-negative-1 for each VMA for which this error state has occurred. When VMAs are unlinked from this anon_vma, unlink_anon_vmas() will eventually underflow anon_vma->num_active_vmas, which will trigger a warning. This will always eventually happen, as we unlink anon_vma's at process teardown. It could also cause maybe_reuse_anon_vma() to incorrectly permit the reuse of an anon_vma which has active VMAs attached, which will lead to a persistently invalid state. The solution is to clear the VMA's anon_vma field when we clean up partial state, as the fact we are doing so indicates clearly that the VMA is not correctly integrated into the anon_vma tree and thus this field is invalid. Link: https://lkml.kernel.org/r/20260318122632.63404-1-ljs@kernel.org Fixes: 542eda1a8329 ("mm/rmap: improve anon_vma_clone(), unlink_anon_vmas() comments, add asserts") Signed-off-by: Lorenzo Stoakes (Oracle) Reported-by: Sasha Levin Closes: https://lore.kernel.org/linux-mm/20260302151547.2389070-1-sashal@kernel.org/ Reported-by: Jiakai Xu Closes: https://lore.kernel.org/linux-mm/CAFb8wJvRhatRD-9DVmr5v5pixTMPEr3UKjYBJjCd09OfH55CKg@mail.gmail.com/ Acked-by: David Hildenbrand (Arm) Acked-by: Vlastimil Babka (SUSE) Tested-by: Jiakai Xu Acked-by: Harry Yoo Cc: Jann Horn Cc: Liam Howlett Cc: Rik van Riel Cc: Sasha Levin (Microsoft) Signed-off-by: Andrew Morton commit db08b1940f4beb25460b4a4e9da3446454f2e8fe Author: Cheng-Yang Chou Date: Sat Mar 21 18:54:58 2026 +0800 sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl() In the WAKE_SYNC path of scx_select_cpu_dfl(), waker_node was computed with cpu_to_node(), while node (for prev_cpu) was computed with scx_cpu_node_if_enabled(). When scx_builtin_idle_per_node is disabled, idle_cpumask(waker_node) is called with a real node ID even though per-node idle tracking is disabled, resulting in undefined behavior. Fix by using scx_cpu_node_if_enabled() for waker_node as well, ensuring both variables are computed consistently. Fixes: 48849271e6611 ("sched_ext: idle: Per-node idle cpumasks") Cc: stable@vger.kernel.org # v6.15+ Signed-off-by: Cheng-Yang Chou Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit d723091c8c3e076bb53d52ec3d5a801d49f30caf Merge: 113ae7b4decc6c 2b38efc05bf7a8 Author: Linus Torvalds Date: Sat Mar 21 16:59:09 2026 -0700 Merge tag 'driver-core-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Generalize driver_override in the driver core, providing a common sysfs implementation and concurrency-safe accessors for bus implementations - Do not use driver_override as IRQ name in the hwmon axi-fan driver - Remove an unnecessary driver_override check in sh platform_early - Migrate the platform bus to use the generic driver_override infrastructure, fixing a UAF condition caused by accessing the driver_override field without proper locking in the platform_match() callback * tag 'driver-core-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: driver core: platform: use generic driver_override infrastructure sh: platform_early: remove pdev->driver_override check hwmon: axi-fan: don't use driver_override as IRQ name docs: driver-model: document driver_override driver core: generalize driver_override in struct device commit fdc7aa54a5d44c05880a4aad7cfb41aacfd16d7b Author: David Lechner Date: Sat Mar 14 17:18:10 2026 -0500 iio: light: vcnl4035: fix scan buffer on big-endian Rework vcnl4035_trigger_consumer_handler() so that we are not passing what should be a u16 value as an int * to regmap_read(). This won't work on bit endian systems. Instead, add a new unsigned int variable to pass to regmap_read(). Then copy that value into the buffer struct. The buffer array is replaced with a struct since there is only one value being read. This allows us to use the correct u16 data type and has a side-effect of simplifying the alignment specification. Also fix the endianness of the scan format from little-endian to CPU endianness. Since we are using regmap to read the value, it will be CPU-endian. Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035") Signed-off-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 50b35c9e50a865600344ab1d8f9a8b3384d7e63d Author: Jiri Olsa Date: Thu Mar 12 13:37:38 2026 +0100 ftrace: Use hash argument for tmp_ops in update_ftrace_direct_mod The modify logic registers temporary ftrace_ops object (tmp_ops) to trigger the slow path for all direct callers to be able to safely modify attached addresses. At the moment we use ops->func_hash for tmp_ops filter, which represents all the systems attachments. It's faster to use just the passed hash filter, which contains only the modified sites and is always a subset of the ops->func_hash. Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Andrii Nakryiko Cc: Menglong Dong Cc: Song Liu Link: https://patch.msgid.link/20260312123738.129926-1-jolsa@kernel.org Fixes: e93672f770d7 ("ftrace: Add update_ftrace_direct_mod function") Signed-off-by: Jiri Olsa Signed-off-by: Steven Rostedt (Google) commit f35dbac6942171dc4ce9398d1d216a59224590a9 Author: Masami Hiramatsu (Google) Date: Thu Mar 19 18:12:19 2026 +0900 ring-buffer: Fix to update per-subbuf entries of persistent ring buffer Since the validation loop in rb_meta_validate_events() updates the same cpu_buffer->head_page->entries, the other subbuf entries are not updated. Fix to use head_page to update the entries field, since it is the cursor in this loop. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: Ian Rogers Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events") Link: https://patch.msgid.link/177391153882.193994.17158784065013676533.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 768461517a28d80fe81ea4d5d03a90cd184ea6ad Author: David Lechner Date: Sat Mar 14 18:13:32 2026 -0500 iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() Add a DMA-safe buffer and use it for spi_read() instead of a stack memory. All SPI buffers must be DMA-safe. Since we only need up to 3 bytes, we just use a u8[] instead of __be16 and __be32 and change the conversion functions appropriately. Fixes: 4d671b71beef ("iio: adc: ti-adc161s626: add support for TI 1-channel differential ADCs") Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 07183aac4a6828e474f00b37c9d795d0d99e18a7 Author: Steven Rostedt Date: Wed Mar 18 18:55:12 2026 -0400 tracing: Fix trace_marker copy link list updates When the "copy_trace_marker" option is enabled for an instance, anything written into /sys/kernel/tracing/trace_marker is also copied into that instances buffer. When the option is set, that instance's trace_array descriptor is added to the marker_copies link list. This list is protected by RCU, as all iterations uses an RCU protected list traversal. When the instance is deleted, all the flags that were enabled are cleared. This also clears the copy_trace_marker flag and removes the trace_array descriptor from the list. The issue is after the flags are called, a direct call to update_marker_trace() is performed to clear the flag. This function returns true if the state of the flag changed and false otherwise. If it returns true here, synchronize_rcu() is called to make sure all readers see that its removed from the list. But since the flag was already cleared, the state does not change and the synchronization is never called, leaving a possible UAF bug. Move the clearing of all flags below the updating of the copy_trace_marker option which then makes sure the synchronization is performed. Also use the flag for checking the state in update_marker_trace() instead of looking at if the list is empty. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260318185512.1b6c7db4@gandalf.local.home Fixes: 7b382efd5e8a ("tracing: Allow the top level trace_marker to write into another instances") Reported-by: Sasha Levin Closes: https://lore.kernel.org/all/20260225133122.237275-1-sashal@kernel.org/ Signed-off-by: Steven Rostedt (Google) commit edca33a56297d5741ccf867669debec116681987 Author: Steven Rostedt Date: Mon Mar 16 13:07:34 2026 -0400 tracing: Fix failure to read user space from system call trace events The system call trace events call trace_user_fault_read() to read the user space part of some system calls. This is done by grabbing a per-cpu buffer, disabling migration, enabling preemption, calling copy_from_user(), disabling preemption, enabling migration and checking if the task was preempted while preemption was enabled. If it was, the buffer is considered corrupted and it tries again. There's a safety mechanism that will fail out of this loop if it fails 100 times (with a warning). That warning message was triggered in some pi_futex stress tests. Enabling the sched_switch trace event and traceoff_on_warning, showed the problem: pi_mutex_hammer-1375 [006] d..21 138.981648: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981651: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981656: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981659: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981664: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981667: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981671: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981675: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981679: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981682: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981687: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981690: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981695: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981698: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981703: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981706: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981711: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981714: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981719: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981722: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981727: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981730: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 pi_mutex_hammer-1375 [006] d..21 138.981735: sched_switch: prev_comm=pi_mutex_hammer prev_pid=1375 prev_prio=95 prev_state=R+ ==> next_comm=migration/6 next_pid=47 next_prio=0 migration/6-47 [006] d..2. 138.981738: sched_switch: prev_comm=migration/6 prev_pid=47 prev_prio=0 prev_state=S ==> next_comm=pi_mutex_hammer next_pid=1375 next_prio=95 What happened was the task 1375 was flagged to be migrated. When preemption was enabled, the migration thread woke up to migrate that task, but failed because migration for that task was disabled. This caused the loop to fail to exit because the task scheduled out while trying to read user space. Every time the task enabled preemption the migration thread would schedule in, try to migrate the task, fail and let the task continue. But because the loop would only enable preemption with migration disabled, it would always fail because each time it enabled preemption to read user space, the migration thread would try to migrate it. To solve this, when the loop fails to read user space without being scheduled out, enabled and disable preemption with migration enabled. This will allow the migration task to successfully migrate the task and the next loop should succeed to read user space without being scheduled out. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260316130734.1858a998@gandalf.local.home Fixes: 64cf7d058a005 ("tracing: Have trace_marker use per-cpu data to read user space") Signed-off-by: Steven Rostedt (Google) commit 24869650dff34a6fc8fd1cc91b2058a72f9abc95 Author: David Lechner Date: Sat Mar 14 18:13:31 2026 -0500 iio: adc: ti-adc161s626: fix buffer read on big-endian Rework ti_adc_trigger_handler() to properly handle data on big-endian architectures. The scan data format is 16-bit CPU-endian, so we can't cast it to a int * on big-endian and expect it to work. Instead, we introduce a local int variable to read the data into, and then copy it to the buffer. Since the buffer isn't passed to any SPI functions, we don't need it to be DMA-safe. So we can drop it from the driver data struct and just use stack memory for the scan data. Since there is only one data value (plus timestamp), we don't need an array and can just declare a struct with the correct data type instead. Also fix alignment of iio_get_time_ns() to ( while we are touching this. Fixes: 4d671b71beef ("iio: adc: ti-adc161s626: add support for TI 1-channel differential ADCs") Signed-off-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit a6f22e50c7d51aa225c392c62c33f0fae11f734d Author: Xuewen Yan Date: Fri Mar 6 15:59:54 2026 +0800 tracing: Revert "tracing: Remove pid in task_rename tracing output" This reverts commit e3f6a42272e028c46695acc83fc7d7c42f2750ad. The commit says that the tracepoint only deals with the current task, however the following case is not current task: comm_write() { p = get_proc_task(inode); if (!p) return -ESRCH; if (same_thread_group(current, p)) set_task_comm(p, buffer); } where set_task_comm() calls __set_task_comm() which records the update of p and not current. So revert the patch to show pid. Cc: Cc: Cc: Cc: Link: https://patch.msgid.link/20260306075954.4533-1-xuewen.yan@unisoc.com Fixes: e3f6a42272e0 ("tracing: Remove pid in task_rename tracing output") Reported-by: Guohua Yan Signed-off-by: Xuewen Yan Reviewed-by: Steven Rostedt (Google) Signed-off-by: Steven Rostedt (Google) commit 4a04d13576fd69149b91672b5f1dc62eca272fa5 Author: Daniel Borkmann Date: Thu Mar 19 22:15:07 2026 +0100 selftests/bpf: Add a test cases for sync_linked_regs regarding zext propagation Add multiple test cases for linked register tracking with alu32 ops: - Add a test that checks sync_linked_regs() regarding reg->id (the linked target register) for BPF_ADD_CONST32 rather than known_reg->id (the branch register). - Add a test case for linked register tracking that exposes the cross-type sync_linked_regs() bug. One register uses alu32 (w7 += 1, BPF_ADD_CONST32) and another uses alu64 (r8 += 2, BPF_ADD_CONST64), both linked to the same base register. - Add a test case that exercises regsafe() path pruning when two execution paths reach the same program point with linked registers carrying different ADD_CONST flags (BPF_ADD_CONST32 from alu32 vs BPF_ADD_CONST64 from alu64). This particular test passes with and without the fix since the pruning will fail due to different ranges, but it would still be useful to carry this one as a regression test for the unreachable div by zero. With the fix applied all the tests pass: # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_linked_scalars [...] ./test_progs -t verifier_linked_scalars #602/1 verifier_linked_scalars/scalars: find linked scalars:OK #602/2 verifier_linked_scalars/sync_linked_regs_preserves_id:OK #602/3 verifier_linked_scalars/scalars_neg:OK #602/4 verifier_linked_scalars/scalars_neg_sub:OK #602/5 verifier_linked_scalars/scalars_neg_alu32_add:OK #602/6 verifier_linked_scalars/scalars_neg_alu32_sub:OK #602/7 verifier_linked_scalars/scalars_pos:OK #602/8 verifier_linked_scalars/scalars_sub_neg_imm:OK #602/9 verifier_linked_scalars/scalars_double_add:OK #602/10 verifier_linked_scalars/scalars_sync_delta_overflow:OK #602/11 verifier_linked_scalars/scalars_sync_delta_overflow_large_range:OK #602/12 verifier_linked_scalars/scalars_alu32_big_offset:OK #602/13 verifier_linked_scalars/scalars_alu32_basic:OK #602/14 verifier_linked_scalars/scalars_alu32_wrap:OK #602/15 verifier_linked_scalars/scalars_alu32_zext_linked_reg:OK #602/16 verifier_linked_scalars/scalars_alu32_alu64_cross_type:OK #602/17 verifier_linked_scalars/scalars_alu32_alu64_regsafe_pruning:OK #602/18 verifier_linked_scalars/alu32_negative_offset:OK #602/19 verifier_linked_scalars/spurious_precision_marks:OK #602 verifier_linked_scalars:OK Summary: 1/19 PASSED, 0 SKIPPED, 0 FAILED Co-developed-by: Puranjay Mohan Signed-off-by: Puranjay Mohan Signed-off-by: Daniel Borkmann Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260319211507.213816-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit bc308be380c136800e1e94c6ce49cb53141d6506 Author: Daniel Borkmann Date: Thu Mar 19 22:15:06 2026 +0100 bpf: Fix sync_linked_regs regarding BPF_ADD_CONST32 zext propagation Jenny reported that in sync_linked_regs() the BPF_ADD_CONST32 flag is checked on known_reg (the register narrowed by a conditional branch) instead of reg (the linked target register created by an alu32 operation). Example case with reg: 1. r6 = bpf_get_prandom_u32() 2. r7 = r6 (linked, same id) 3. w7 += 5 (alu32 -- r7 gets BPF_ADD_CONST32, zero-extended by CPU) 4. if w6 < 0xFFFFFFFC goto safe (narrows r6 to [0xFFFFFFFC, 0xFFFFFFFF]) 5. sync_linked_regs() propagates to r7 but does NOT call zext_32_to_64() 6. Verifier thinks r7 is [0x100000001, 0x100000004] instead of [1, 4] Since known_reg above does not have BPF_ADD_CONST32 set above, zext_32_to_64() is never called on alu32-derived linked registers. This causes the verifier to track incorrect 64-bit bounds, while the CPU correctly zero-extends the 32-bit result. The code checking known_reg->id was correct however (see scalars_alu32_wrap selftest case), but the real fix needs to handle both directions - zext propagation should be done when either register has BPF_ADD_CONST32, since the linked relationship involves a 32-bit operation regardless of which side has the flag. Example case with known_reg (exercised also by scalars_alu32_wrap): 1. r1 = r0; w1 += 0x100 (alu32 -- r1 gets BPF_ADD_CONST32) 2. if r1 > 0x80 - known_reg = r1 (has BPF_ADD_CONST32), reg = r0 (doesn't) Hence, fix it by checking for (reg->id | known_reg->id) & BPF_ADD_CONST32. Moreover, sync_linked_regs() also has a soundness issue when two linked registers used different ALU widths: one with BPF_ADD_CONST32 and the other with BPF_ADD_CONST64. The delta relationship between linked registers assumes the same arithmetic width though. When one register went through alu32 (CPU zero-extends the 32-bit result) and the other went through alu64 (no zero-extension), the propagation produces incorrect bounds. Example: r6 = bpf_get_prandom_u32() // fully unknown if r6 >= 0x100000000 goto out // constrain r6 to [0, U32_MAX] r7 = r6 w7 += 1 // alu32: r7.id = N | BPF_ADD_CONST32 r8 = r6 r8 += 2 // alu64: r8.id = N | BPF_ADD_CONST64 if r7 < 0xFFFFFFFF goto out // narrows r7 to [0xFFFFFFFF, 0xFFFFFFFF] At the branch on r7, sync_linked_regs() runs with known_reg=r7 (BPF_ADD_CONST32) and reg=r8 (BPF_ADD_CONST64). The delta path computes: r8 = r7 + (delta_r8 - delta_r7) = 0xFFFFFFFF + (2 - 1) = 0x100000000 Then, because known_reg->id has BPF_ADD_CONST32, zext_32_to_64(r8) is called, truncating r8 to [0, 0]. But r8 used a 64-bit ALU op -- the CPU does NOT zero-extend it. The actual CPU value of r8 is 0xFFFFFFFE + 2 = 0x100000000, not 0. The verifier now underestimates r8's 64-bit bounds, which is a soundness violation. Fix sync_linked_regs() by skipping propagation when the two registers have mixed ALU widths (one BPF_ADD_CONST32, the other BPF_ADD_CONST64). Lastly, fix regsafe() used for path pruning: the existing checks used "& BPF_ADD_CONST" to test for offset linkage, which treated BPF_ADD_CONST32 and BPF_ADD_CONST64 as equivalent. Fixes: 7a433e519364 ("bpf: Support negative offsets, BPF_SUB, and alu32 for linked register tracking") Reported-by: Jenny Guanni Qu Co-developed-by: Puranjay Mohan Signed-off-by: Puranjay Mohan Signed-off-by: Daniel Borkmann Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260319211507.213816-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 06880982c63012eb392df64c1ca587c294a72226 Merge: 1abd3feb36636b 0ad1734cc5598d Author: Alexei Starovoitov Date: Sat Mar 21 13:14:28 2026 -0700 Merge branch 'bpf-fix-unsound-scalar-forking-for-bpf_or' Daniel Wade says: ==================== bpf: Fix unsound scalar forking for BPF_OR maybe_fork_scalars() unconditionally sets the pushed path dst register to 0 for both BPF_AND and BPF_OR. For AND this is correct (0 & K == 0), but for OR it is wrong (0 | K == K, not 0). This causes the verifier to track an incorrect value on the pushed path, leading to a verifier/runtime divergence that allows out-of-bounds map value access. v4: Use block comment style for multi-line comments in selftests (Amery Hung) Add Reviewed-by/Acked-by tags v3: Use single-line comment style in selftests (Alexei Starovoitov) v2: Use push_stack(env, env->insn_idx, ...) to re-execute the insn on the pushed path (Eduard Zingerman) ==================== Link: https://patch.msgid.link/20260314021521.128361-1-danjwade95@gmail.com Signed-off-by: Alexei Starovoitov commit 0ad1734cc5598d3ddb6126a8960efe85f0f807d7 Author: Daniel Wade Date: Sat Mar 14 13:15:21 2026 +1100 selftests/bpf: Add tests for maybe_fork_scalars() OR vs AND handling Add three test cases to verifier_bounds.c to verify that maybe_fork_scalars() correctly tracks register values for BPF_OR operations with constant source operands: 1. or_scalar_fork_rejects_oob: After ARSH 63 + OR 8, the pushed path should have dst = 8. With value_size = 8, accessing map_value + 8 is out of bounds and must be rejected. 2. and_scalar_fork_still_works: Regression test ensuring AND forking continues to work. ARSH 63 + AND 4 produces pushed dst = 0 and current dst = 4, both within value_size = 8. 3. or_scalar_fork_allows_inbounds: After ARSH 63 + OR 4, the pushed path has dst = 4, which is within value_size = 8 and should be accepted. These tests exercise the fix in the previous patch, which makes the pushed path re-execute the ALU instruction so it computes the correct result for BPF_OR. Signed-off-by: Daniel Wade Reviewed-by: Amery Hung Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260314021521.128361-3-danjwade95@gmail.com Signed-off-by: Alexei Starovoitov commit c845894ebd6fb43226b3118d6b017942550910c5 Author: Daniel Wade Date: Sat Mar 14 13:15:20 2026 +1100 bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. When dst has signed range [-1, 0], it forks the verifier state: the pushed path gets dst = 0, the current path gets dst = -1. For BPF_AND this is correct: 0 & K == 0. For BPF_OR this is wrong: 0 | K == K, not 0. The pushed path therefore tracks dst as 0 when the runtime value is K, producing an exploitable verifier/runtime divergence that allows out-of-bounds map access. Fix this by passing env->insn_idx (instead of env->insn_idx + 1) to push_stack(), so the pushed path re-executes the ALU instruction with dst = 0 and naturally computes the correct result for any opcode. Fixes: bffacdb80b93 ("bpf: Recognize special arithmetic shift in the verifier") Signed-off-by: Daniel Wade Reviewed-by: Amery Hung Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260314021521.128361-2-danjwade95@gmail.com Signed-off-by: Alexei Starovoitov commit 1abd3feb36636b28d7722851fc0c8d392a87e12d Merge: a1e5c46eaed315 4ac95c65efeaf0 Author: Alexei Starovoitov Date: Sat Mar 21 13:12:17 2026 -0700 Merge branch 'bpf-fix-abs-int_min-undefined-behavior-in-interpreter-sdiv-smod' Jenny Guanni Qu says: ==================== bpf: Fix abs(INT_MIN) undefined behavior in interpreter sdiv/smod The BPF interpreter's signed 32-bit division and modulo handlers use abs() on s32 operands, which is undefined for S32_MIN. This causes the interpreter to compute wrong results, creating a mismatch with the verifier's range tracking. For example, INT_MIN / 2 returns 0x40000000 instead of the correct 0xC0000000. The verifier tracks the correct range, so a crafted BPF program can exploit the mismatch for out-of-bounds map value access (confirmed by KASAN). Patch 1 introduces abs_s32() which handles S32_MIN correctly and replaces all 8 abs((s32)...) call sites. s32 is the only affected case -- the s64 handlers do not use abs(). Patch 2 adds selftests covering sdiv32 and smod32 with INT_MIN dividend to prevent regression. Changes since v4: - Renamed __safe_abs32() to abs_s32() and dropped inline keyword per Alexei Starovoitov's feedback Changes since v3: - Fixed stray blank line deletion in the file header - Improved comment per Yonghong Song's suggestion - Added JIT vs interpreter context to selftest commit message Changes since v2: - Simplified to use -(u32)x per Mykyta Yatsenko's suggestion Changes since v1: - Moved helper above kerneldoc comment block to fix build warnings ==================== Link: https://patch.msgid.link/20260311011116.2108005-1-qguanni@gmail.com Signed-off-by: Alexei Starovoitov commit 4ac95c65efeaf0c010199b2b2f5f78b06f28dab6 Author: Jenny Guanni Qu Date: Wed Mar 11 01:11:16 2026 +0000 selftests/bpf: Add tests for sdiv32/smod32 with INT_MIN dividend Add tests to verify that signed 32-bit division and modulo operations produce correct results when the dividend is INT_MIN (0x80000000). The bug fixed in the previous commit only affects the BPF interpreter path. When JIT is enabled (the default on most architectures), the native CPU division instruction produces the correct result and these tests pass regardless. With bpf_jit_enable=0, the interpreter is used and without the previous fix, INT_MIN / 2 incorrectly returns 0x40000000 instead of 0xC0000000 due to abs(S32_MIN) undefined behavior, causing these tests to fail. Test cases: - SDIV32 INT_MIN / 2 = -1073741824 (imm and reg divisor) - SMOD32 INT_MIN % 2 = 0 (positive and negative divisor) Reviewed-by: Jiayuan Chen Acked-by: Yonghong Song Signed-off-by: Jenny Guanni Qu Link: https://lore.kernel.org/r/20260311011116.2108005-3-qguanni@gmail.com Signed-off-by: Alexei Starovoitov commit c77b30bd1dcb61f66c640ff7d2757816210c7cb0 Author: Jenny Guanni Qu Date: Wed Mar 11 01:11:15 2026 +0000 bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs() macro on s32 operands. The abs() macro documentation (include/linux/math.h) explicitly states the result is undefined when the input is the type minimum. When DST contains S32_MIN (0x80000000), abs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged on arm64/x86. This value is then sign-extended to u64 as 0xFFFFFFFF80000000, causing do_div() to compute the wrong result. The verifier's abstract interpretation (scalar32_min_max_sdiv) computes the mathematically correct result for range tracking, creating a verifier/interpreter mismatch that can be exploited for out-of-bounds map value access. Introduce abs_s32() which handles S32_MIN correctly by casting to u32 before negating, avoiding signed overflow entirely. Replace all 8 abs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers. s32 is the only affected case -- the s64 division/modulo handlers do not use abs(). Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.") Acked-by: Yonghong Song Acked-by: Mykyta Yatsenko Signed-off-by: Jenny Guanni Qu Link: https://lore.kernel.org/r/20260311011116.2108005-2-qguanni@gmail.com Signed-off-by: Alexei Starovoitov commit a1e5c46eaed3151be93e1aec9af0d8f8db79b8f6 Author: Ihor Solodrai Date: Thu Mar 19 17:08:09 2026 -0700 selftests/bpf: Add tests for bpf_throw lock leak from subprogs Add test cases to ensure the verifier correctly rejects bpf_throw from subprogs when RCU, preempt, or IRQ locks are held: * reject_subprog_rcu_lock_throw: subprog acquires bpf_rcu_read_lock and then calls bpf_throw * reject_subprog_throw_preempt_lock: always-throwing subprog called while caller holds bpf_preempt_disable * reject_subprog_throw_irq_lock: always-throwing subprog called while caller holds bpf_local_irq_save Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Ihor Solodrai Acked-by: Yonghong Song Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260320000809.643798-2-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 6c2128505f61b504c79a20b89596feba61388112 Author: Ihor Solodrai Date: Thu Mar 19 17:08:08 2026 -0700 bpf: Fix exception exit lock checking for subprogs process_bpf_exit_full() passes check_lock = !curframe to check_resource_leak(), which is false in cases when bpf_throw() is called from a static subprog. This makes check_resource_leak() to skip validation of active_rcu_locks, active_preempt_locks, and active_irq_id on exception exits from subprogs. At runtime bpf_throw() unwinds the stack via ORC without releasing any user-acquired locks, which may cause various issues as the result. Fix by setting check_lock = true for exception exits regardless of curframe, since exceptions bypass all intermediate frame cleanup. Update the error message prefix to "bpf_throw" for exception exits to distinguish them from normal BPF_EXIT. Fix reject_subprog_with_rcu_read_lock test which was previously passing for the wrong reason. Test program returned directly from the subprog call without closing the RCU section, so the error was triggered by the unclosed RCU lock on normal exit, not by bpf_throw. Update __msg annotations for affected tests to match the new "bpf_throw" error prefix. The spin_lock case is not affected because they are already checked [1] at the call site in do_check_insn() before bpf_throw can run. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/verifier.c?h=v7.0-rc4#n21098 Assisted-by: Claude:claude-opus-4-6 Fixes: f18b03fabaa9 ("bpf: Implement BPF exceptions") Signed-off-by: Ihor Solodrai Acked-by: Yonghong Song Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260320000809.643798-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 2f42e85622567a19459679f71e55d41904866aa7 Merge: f338e77383789c 78a6ee14f8b9e1 Author: Wolfram Sang Date: Sat Mar 21 19:52:12 2026 +0100 Merge tag 'i2c-host-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-fixes for v7.0-rc5 pxa: fix broken I2C communication on Armada 3700 with recovery fsi: fix device_node reference leak in probe cp2615: fix NULL-deref when serial string is missing commit 113ae7b4decc6c2d95bdbbe52e615a0137ef7f9f Merge: 55d55b97c7fca1 e7bae9a7a5e125 Author: Linus Torvalds Date: Sat Mar 21 09:09:51 2026 -0700 Merge tag 'hwmon-for-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - max6639: Fix pulses-per-revolution implementation - Several PMBus drivers: Add missing error checks * tag 'hwmon-for-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (max6639) Fix pulses-per-revolution implementation hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value hwmon: (pmbus/hac300s) Add error check for pmbus_read_word_data() return value commit 55d55b97c7fca1f795029c5aea3335a5d885632e Merge: 8991448e56cb21 3b2c2ab4ceb82a Author: Linus Torvalds Date: Sat Mar 21 08:46:13 2026 -0700 Merge tag 'bootconfig-fixes-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig fixes from Masami Hiramatsu: - Check error code of xbc_init_node() in override value path in xbc_parse_kv() - Fix fd leak in load_xbc_file() on fstat failure * tag 'bootconfig-fixes-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure lib/bootconfig: check xbc_init_node() return in override path commit 8991448e56cb2118b561eeda193af53b4ff6b632 Merge: a0c83177734ab9 b17b79ff896305 Author: Linus Torvalds Date: Sat Mar 21 08:42:17 2026 -0700 Merge tag 'for-7.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Another batch of fixes for problems that have been identified by tools analyzing code or by fuzzing. Most of them are short, two patches fix the same thing in many places so the diffs are bigger. - handle potential NULL pointer errors after attempting to read extent and checksum trees - prevent ENOSPC when creating many qgroups by ioctls in the same transaction - encoded write ioctl fixes (with 64K page and 4K block size): - fix unexpected bio length - do not let compressed bios and pages interfere with page cache - compression fixes on setups with 64K page and 4K block size: fix folio length assertions (zstd and lzo) - remap tree fixes: - make sure to hold block group reference while moving it - handle early exit when moving block group to unused list - handle deleted subvolumes with inconsistent state of deletion progress" * tag 'for-7.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: reject root items with drop_progress and zero drop_level btrfs: check block group before marking it unused in balance_remap_chunks() btrfs: hold block group reference during entire move_existing_remap() btrfs: fix an incorrect ASSERT() condition inside lzo_decompress_bio() btrfs: fix an incorrect ASSERT() condition inside zstd_decompress_bio() btrfs: do not touch page cache for encoded writes btrfs: fix a bug that makes encoded write bio larger than expected btrfs: reserve enough transaction items for qgroup ioctls btrfs: check for NULL root after calls to btrfs_csum_root() btrfs: check for NULL root after calls to btrfs_extent_root() commit c3fd16c3b98ed726294feab2f94f876290bf7b61 Author: Zubin Mithra Date: Wed Mar 18 13:40:13 2026 +0000 virt: tdx-guest: Fix handling of host controlled 'quote' buffer length Validate host controlled value `quote_buf->out_len` that determines how many bytes of the quote are copied out to guest userspace. In TDX environments with remote attestation, quotes are not considered private, and can be forwarded to an attestation server. Catch scenarios where the host specifies a response length larger than the guest's allocation, or otherwise races modifying the response while the guest consumes it. This prevents contents beyond the pages allocated for `quote_buf` (up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace, and possibly forwarded in attestation requests. Recall that some deployments want per-container configs-tsm-report interfaces, so the leak may cross container protection boundaries, not just local root. Fixes: f4738f56d1dc ("virt: tdx-guest: Add Quote generation support using TSM_REPORTS") Cc: stable@vger.kernel.org Signed-off-by: Zubin Mithra Reviewed-by: Dan Williams Reviewed-by: Kiryl Shutsemau (Meta) Reviewed-by: Kuppuswamy Sathyanarayanan Signed-off-by: Dan Williams commit 1af997cad473d505248df6d9577183bb91f69670 Author: Shawn Guo Date: Fri Feb 27 15:22:10 2026 +0800 arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges Reboot starts failing on Poplar since commit 8424ecdde7df ("arm64: mm: Set ZONE_DMA size based on devicetree's dma-ranges"), which effectively changes zone_dma_bits from 30 to 32 for arm64 platforms that do not properly define dma-ranges in device tree. It's unclear how Poplar reboot gets broken by this change exactly, but a dma-ranges limiting zone_dma to the first 1 GB fixes the regression. Fixes: 2f20182ed670 ("arm64: dts: hisilicon: add dts files for hi3798cv200-poplar board") Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo Signed-off-by: Wei Xu commit c1f2b0f2b5e37b2c27540a175aea2755a3799433 Author: Shawn Guo Date: Fri Feb 27 15:19:58 2026 +0800 arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity The PCIe reset GPIO on Poplar is actually active low. The active high worked before because kernel driver didn't respect the setting from DT. This is changed since commit 1d26a55fbeb9 ("PCI: histb: Switch to using gpiod API"), and thus PCIe on Poplar got brken since then. Fix the problem by correcting the polarity. Fixes: 32fa01761bd9 ("arm64: dts: hi3798cv200: enable PCIe support for poplar board") Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo Signed-off-by: Wei Xu commit bc0151c59e639c1311ee573434af74b4e2c81de4 Merge: 7a4fc5ca796569 27dfe9030acbc6 Author: Jakub Kicinski Date: Fri Mar 20 19:07:33 2026 -0700 Merge branch 'net-bcmasp-fix-issues-during-driver-unbind' Justin Chen says: ==================== net: bcmasp: Fix issues during driver unbind Fix two issues when we unbind the driver. We hit a double free of the WoL irq and a double disable of the clk. ==================== Link: https://patch.msgid.link/20260319234813.1937315-1-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 27dfe9030acbc601c260b42ecdbb4e5858a97b53 Author: Justin Chen Date: Thu Mar 19 16:48:13 2026 -0700 net: bcmasp: fix double disable of clk Switch to devm_clk_get_optional() so we can manage the clock ourselves. We dynamically control the clocks depending on the state of the interface for power savings. The default state is clock disabled, so unbinding the driver causes a double disable. Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260319234813.1937315-3-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit cbfa5be2bf64511d49b854a0f9fd6d0b5118621f Author: Justin Chen Date: Thu Mar 19 16:48:12 2026 -0700 net: bcmasp: fix double free of WoL irq We do not need to free wol_irq since it was instantiated with devm_request_irq(). So devres will free for us. Fixes: a2f0751206b0 ("net: bcmasp: Add support for WoL magic packet") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260319234813.1937315-2-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 7a4fc5ca79656955b88b6483f505321e1a683f0d Merge: 24dd586bb4cbba ee00a12593ffb6 Author: Jakub Kicinski Date: Fri Mar 20 19:05:14 2026 -0700 Merge branch 'rtnetlink-add-missing-attributes-in-if_nlmsg_size' Sabrina Dubroca says: ==================== rtnetlink: add missing attributes in if_nlmsg_size Once again we have some attributes added by rtnl_fill_ifinfo() that aren't counted in if_nlmsg_size(). ==================== Link: https://patch.msgid.link/cover.1773919462.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit ee00a12593ffb69db4dd1a1c00ecb0253376874a Author: Sabrina Dubroca Date: Fri Mar 20 00:02:53 2026 +0100 rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size rtnl_link_get_slave_info_data_size counts IFLA_INFO_SLAVE_DATA, but rtnl_link_slave_info_fill adds both IFLA_INFO_SLAVE_DATA and IFLA_INFO_SLAVE_KIND. Fixes: ba7d49b1f0f8 ("rtnetlink: provide api for getting and setting slave info") Reviewed-by: Jiri Pirko Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/049843b532e23cde7ddba263c0bbe35ba6f0d26d.1773919462.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 52501989c76206462d9b11a8485beef40ef41821 Author: Sabrina Dubroca Date: Fri Mar 20 00:02:52 2026 +0100 rtnetlink: count IFLA_PARENT_DEV_{NAME,BUS_NAME} in if_nlmsg_size Commit 00e77ed8e64d ("rtnetlink: add IFLA_PARENT_[DEV|DEV_BUS]_NAME") added those attributes to rtnl_fill_ifinfo, but forgot to extend if_nlmsg_size. Fixes: 00e77ed8e64d ("rtnetlink: add IFLA_PARENT_[DEV|DEV_BUS]_NAME") Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/0b849da95562af45487080528d60f578636aba5c.1773919462.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 24dd586bb4cbba1889a50abe74143817a095c1c9 Author: Qi Tang Date: Wed Mar 18 14:48:47 2026 +0800 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv pointer itself was not handled, so after tee() both the original and the cloned pipe_buffer share the same smc_spd_priv *. When both pipes are subsequently released, smc_rx_pipe_buf_release() is called twice against the same object: 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct] 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF] KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which then escalates to a NULL-pointer dereference and kernel panic via smc_rx_update_consumer() when it chases the freed priv->smc pointer: BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0 Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74 Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xce/0x650 kasan_report+0xc6/0x100 smc_rx_pipe_buf_release+0x78/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:smc_rx_update_consumer+0x8d/0x350 Call Trace: smc_rx_pipe_buf_release+0x121/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: Fatal exception Beyond the memory-safety problem, duplicating an SMC splice buffer is semantically questionable: smc_rx_update_cons() would advance the consumer cursor twice for the same data, corrupting receive-window accounting. A refcount on smc_spd_priv could fix the double-free, but the cursor-accounting issue would still need to be addressed separately. The .get callback is invoked by both tee(2) and splice_pipe_to_pipe() for partial transfers; both will now return -EFAULT. Users who need to duplicate SMC socket data must use a copy-based read path. Fixes: 9014db202cb7 ("smc: add support for splice()") Signed-off-by: Qi Tang Link: https://patch.msgid.link/20260318064847.23341-1-tpluszz77@gmail.com Signed-off-by: Jakub Kicinski commit 546b68ac893595877ffbd7751e5c55fd1c43ede6 Author: Yang Yang Date: Thu Mar 19 08:02:27 2026 +0000 openvswitch: validate MPLS set/set_masked payload length validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-size MPLS key data (struct ovs_key_mpls). Use the already normalized key_len (masked case included) and reject non-matching MPLS action key sizes. Reject invalid MPLS action payload lengths early. Fixes: fbdcdd78da7c ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction") Reported-by: Yifan Wu Reported-by: Juefei Pu Tested-by: Ao Zhou Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Yang Yang Reviewed-by: Ilya Maximets Link: https://patch.msgid.link/20260319080228.3423307-1-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski commit 6931d21f87bc6d657f145798fad0bf077b82486c Author: Yang Yang Date: Thu Mar 19 07:42:41 2026 +0000 openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev. Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL. Fixes: a9020fde67a6 ("openvswitch: Move tunnel destroy function to oppenvswitch module.") Reported-by: Yifan Wu Reported-by: Juefei Pu Tested-by: Ao Zhou Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Signed-off-by: Yang Yang Reviewed-by: Ilya Maximets Link: https://patch.msgid.link/20260319074241.3405262-1-n05ec@lzu.edu.cn Signed-off-by: Jakub Kicinski commit e069034bd660c7dff408f5906d89c5b396e96838 Merge: 7c770dadfda5cb baa35a698cea26 Author: Jakub Kicinski Date: Fri Mar 20 18:25:03 2026 -0700 Merge branch 'net-macb-fix-two-lock-warnings-when-wol-is-used' Kevin Hao says: ==================== net: macb: Fix two lock warnings when WOL is used This patch series addresses two lock warnings that occur when using WOL as a wakeup source on my AMD ZynqMP board. ==================== Link: https://patch.msgid.link/20260318-macb-irq-v2-0-f1179768ab24@gmail.com Signed-off-by: Jakub Kicinski commit baa35a698cea26930679a20a7550bbb4c8319725 Author: Kevin Hao Date: Wed Mar 18 14:36:59 2026 +0800 net: macb: Protect access to net_device::ip_ptr with RCU lock Access to net_device::ip_ptr and its associated members must be protected by an RCU lock. Since we are modifying this piece of code, let's also move it to execute only when WAKE_ARP is enabled. To minimize the duration of the RCU lock, a local variable is used to temporarily store the IP address. This change resolves the following RCU check warning: WARNING: suspicious RCU usage 7.0.0-rc3-next-20260310-yocto-standard+ #122 Not tainted ----------------------------- drivers/net/ethernet/cadence/macb_main.c:5944 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 5 locks held by rtcwake/518: #0: ffff000803ab1408 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0xf8/0x368 #1: ffff0008090bf088 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0xbc/0x1c8 #2: ffff00080098d588 (kn->active#70){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xcc/0x1c8 #3: ffff800081c84888 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x1ec/0x290 #4: ffff0008009ba0f8 (&dev->mutex){....}-{4:4}, at: device_suspend+0x118/0x4f0 stack backtrace: CPU: 3 UID: 0 PID: 518 Comm: rtcwake Not tainted 7.0.0-rc3-next-20260310-yocto-standard+ #122 PREEMPT Hardware name: ZynqMP ZCU102 Rev1.1 (DT) Call trace: show_stack+0x24/0x38 (C) __dump_stack+0x28/0x38 dump_stack_lvl+0x64/0x88 dump_stack+0x18/0x24 lockdep_rcu_suspicious+0x134/0x1d8 macb_suspend+0xd8/0x4c0 device_suspend+0x218/0x4f0 dpm_suspend+0x244/0x3a0 dpm_suspend_start+0x50/0x78 suspend_devices_and_enter+0xec/0x560 pm_suspend+0x194/0x290 state_store+0x110/0x158 kobj_attr_store+0x1c/0x30 sysfs_kf_write+0xa8/0xd0 kernfs_fop_write_iter+0x11c/0x1c8 vfs_write+0x248/0x368 ksys_write+0x7c/0xf8 __arm64_sys_write+0x28/0x40 invoke_syscall+0x4c/0xe8 el0_svc_common+0x98/0xf0 do_el0_svc+0x28/0x40 el0_svc+0x54/0x1e0 el0t_64_sync_handler+0x84/0x130 el0t_64_sync+0x198/0x1a0 Fixes: 0cb8de39a776 ("net: macb: Add ARP support to WOL") Signed-off-by: Kevin Hao Cc: stable@vger.kernel.org Reviewed-by: Théo Lebrun Link: https://patch.msgid.link/20260318-macb-irq-v2-2-f1179768ab24@gmail.com Signed-off-by: Jakub Kicinski commit 317e49358ebbf6390fa439ef3c142f9239dd25fb Author: Kevin Hao Date: Wed Mar 18 14:36:58 2026 +0800 net: macb: Move devm_{free,request}_irq() out of spin lock area The devm_free_irq() and devm_request_irq() functions should not be executed in an atomic context. During device suspend, all userspace processes and most kernel threads are frozen. Additionally, we flush all tx/rx status, disable all macb interrupts, and halt rx operations. Therefore, it is safe to split the region protected by bp->lock into two independent sections, allowing devm_free_irq() and devm_request_irq() to run in a non-atomic context. This modification resolves the following lockdep warning: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 501, name: rtcwake preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 0 7 locks held by rtcwake/501: #0: ffff0008038c3408 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0xf8/0x368 #1: ffff0008049a5e88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0xbc/0x1c8 #2: ffff00080098d588 (kn->active#70){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xcc/0x1c8 #3: ffff800081c84888 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x1ec/0x290 #4: ffff0008009ba0f8 (&dev->mutex){....}-{4:4}, at: device_suspend+0x118/0x4f0 #5: ffff800081d00458 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48 #6: ffff0008031fb9e0 (&bp->lock){-.-.}-{3:3}, at: macb_suspend+0x144/0x558 irq event stamp: 8682 hardirqs last enabled at (8681): [] _raw_spin_unlock_irqrestore+0x44/0x88 hardirqs last disabled at (8682): [] _raw_spin_lock_irqsave+0x38/0x98 softirqs last enabled at (7322): [] handle_softirqs+0x52c/0x588 softirqs last disabled at (7317): [] __do_softirq+0x20/0x2c CPU: 1 UID: 0 PID: 501 Comm: rtcwake Not tainted 7.0.0-rc3-next-20260310-yocto-standard+ #125 PREEMPT Hardware name: ZynqMP ZCU102 Rev1.1 (DT) Call trace: show_stack+0x24/0x38 (C) __dump_stack+0x28/0x38 dump_stack_lvl+0x64/0x88 dump_stack+0x18/0x24 __might_resched+0x200/0x218 __might_sleep+0x38/0x98 __mutex_lock_common+0x7c/0x1378 mutex_lock_nested+0x38/0x50 free_irq+0x68/0x2b0 devm_irq_release+0x24/0x38 devres_release+0x40/0x80 devm_free_irq+0x48/0x88 macb_suspend+0x298/0x558 device_suspend+0x218/0x4f0 dpm_suspend+0x244/0x3a0 dpm_suspend_start+0x50/0x78 suspend_devices_and_enter+0xec/0x560 pm_suspend+0x194/0x290 state_store+0x110/0x158 kobj_attr_store+0x1c/0x30 sysfs_kf_write+0xa8/0xd0 kernfs_fop_write_iter+0x11c/0x1c8 vfs_write+0x248/0x368 ksys_write+0x7c/0xf8 __arm64_sys_write+0x28/0x40 invoke_syscall+0x4c/0xe8 el0_svc_common+0x98/0xf0 do_el0_svc+0x28/0x40 el0_svc+0x54/0x1e0 el0t_64_sync_handler+0x84/0x130 el0t_64_sync+0x198/0x1a0 Fixes: 558e35ccfe95 ("net: macb: WoL support for GEM type of Ethernet controller") Cc: stable@vger.kernel.org Reviewed-by: Théo Lebrun Signed-off-by: Kevin Hao Link: https://patch.msgid.link/20260318-macb-irq-v2-1-f1179768ab24@gmail.com Signed-off-by: Jakub Kicinski commit a0c83177734ab98623795e1ba2cf4b72c23de5e7 Merge: 42bddab0563fe6 a6e77320badd14 Author: Linus Torvalds Date: Fri Mar 20 18:21:27 2026 -0700 Merge tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Regular weekly pull request, from sunny San Diego. Usual suspects in xe/i915/amdgpu with small fixes all over, then some minor fixes across a few other drivers. It's probably a bit on the heavy side, but most of the fix seem well contained, core: - drm_dev_unplug UAF fix pagemap: - lock handling fix xe: - A number of teardown fixes - Skip over non-leaf PTE for PRL generation - Fix an uninitialized variable - Fix a missing runtime PM reference i915/display: - Fix #15771: Screen corruption and stuttering on P14s w/ 3K display - Fix for PSR entry setup frames count on rejected commit - Fix OOPS if firmware is not loaded and suspend is attempted - Fix unlikely NULL deref due to DC6 on probe amdgpu: - Fix gamma 2.2 colorop TFs - BO list fix - LTO fix - DC FP fix - DisplayID handling fix - DCN 2.01 fix - MMHUB boundary fixes - ISP fix - TLB fence fix - Hainan pm fix radeon: - Hainan pm fix vmwgfx: - memory leak fix - doc warning fix imagination: - deadlock fix - interrupt handling fixes dw-hdmi-qp: - multi channel audio fix" * tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel: (40 commits) drm/xe: Fix missing runtime PM reference in ccs_mode_store drm/xe: Open-code GGTT MMIO access protection drm/xe/lrc: Fix uninitialized new_ts when capturing context timestamp drm/xe/oa: Allow reading after disabling OA stream drm/xe: Skip over non leaf pte for PRL generation drm/xe/guc: Ensure CT state transitions via STOP before DISABLED drm/xe: Trigger queue cleanup if not in wedged mode 2 drm/xe: Forcefully tear down exec queues in GuC submit fini drm/xe: Always kill exec queues in xe_guc_submit_pause_abort drm/xe/guc: Fail immediately on GuC load error drm/i915/gt: Check set_default_submission() before deferencing drm/radeon: apply state adjust rules to some additional HAINAN vairants drm/amdgpu: apply state adjust rules to some additional HAINAN vairants drm/amdgpu: rework how we handle TLB fences drm/bridge: dw-hdmi-qp: fix multi-channel audio output drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug drm/amdgpu: Fix ISP segfault issue in kernel v7.0 drm/amdgpu/gmc9.0: add bounds checking for cid drm/amdgpu/mmhub4.2.0: add bounds checking for cid drm/amdgpu/mmhub4.1.0: add bounds checking for cid ... commit e7bae9a7a5e1251ab414291f4e9304d702bb9221 Author: Guenter Roeck Date: Thu Mar 19 21:31:22 2026 -0700 hwmon: (max6639) Fix pulses-per-revolution implementation The valid range for the pulses-per-revolution devicetree property is 1..4. The current code checks for a range of 1..5. Fix it. Declare the variable used to retrieve pulses per revolution from devicetree as u32 (unsigned) to match the of_property_read_u32() API. The current code uses a postfix decrement when writing the pulses per resolution into the chip. This has no effect since the value is evaluated before it is decremented. Fix it by decrementing before evaluating the value. Fixes: 7506ebcd662b ("hwmon: (max6639) : Configure based on DT property") Cc: Naresh Solanki Signed-off-by: Guenter Roeck commit 42bddab0563fe67882b2722620a66dd98c8dbf33 Merge: d46d5c8383442a c4192754e836e0 Author: Linus Torvalds Date: Fri Mar 20 11:59:35 2026 -0700 Merge tag 'execve-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve fixes from Kees Cook: - binfmt_elf_fdpic: fix AUXV size calculation (Andrei Vagin) - fs/tests: exec: Remove bad test vector * tag 'execve-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: fs/tests: exec: Remove bad test vector binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4 commit d46d5c8383442ae44c3b782f87719990ac67925b Merge: c612261bedd6bb 5eb608319bb564 Author: Linus Torvalds Date: Fri Mar 20 11:52:32 2026 -0700 Merge tag 'tty-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some small tty/vt and serial driver fixes for 7.0-rc5. Included in here are: - 8250 driver fixes for reported problems - serial core lockup fix - uartlite driver bugfix - vt save/restore bugfix All of these have been in linux-next for over a week with no reported problems" * tag 'tty-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: vt: save/restore unicode screen buffer for alternate screen serial: 8250_dw: Ensure BUSY is deasserted serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling serial: 8250: Add serial8250_handle_irq_locked() serial: 8250_dw: Avoid unnecessary LCR writes serial: 8250: Protect LCR write in shutdown serial: 8250_pci: add support for the AX99100 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN serial: uartlite: fix PM runtime usage count underflow on probe serial: 8250: always disable IRQ during THRE test serial: 8250: Fix TX deadlock when using DMA commit 7a618ca9b9c4769fc5adf7344bb1dd98f823da22 Author: Nathan Chancellor Date: Wed Mar 18 17:20:18 2026 -0700 init/Kconfig: Require a release version of clang-22 for CC_HAS_COUNTED_BY_PTR Commit 150a04d817d8 ("compiler_types.h: Attributes: Add __counted_by_ptr macro") used Clang 22.0.0 as a minimum supported version for __counted_by_ptr, which made sense while 22.0.0 was the version of LLVM's main branch to allow developers to easily test and develop uses of __counted_by_ptr in their code. However, __counted_by_ptr requires a change [1] merged towards the end of the 22 development cycle to avoid errors when applied to void pointers. In file included from fs/xfs/xfs_attr_inactive.c:18: fs/xfs/libxfs/xfs_attr.h:59:2: error: 'counted_by' cannot be applied to a pointer with pointee of unknown size because 'void' is an incomplete type 59 | void *buffer __counted_by_ptr(bufsize); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is disruptive for deployed prerelease clang-22 builds (such as Android LLVM) or when bisecting between llvmorg-21-init and the fix. Require a released version of clang-22 (i.e., 21.1.0 or newer) to enabled __counted_by_ptr to ensure all fixes needed for proper support are present. Fixes: 150a04d817d8 ("compiler_types.h: Attributes: Add __counted_by_ptr macro") Link: https://github.com/llvm/llvm-project/commit/f29955a594aedf5943d492a999b83e8c6b8fafae [1] Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20260318-counted_by_ptr-release-clang-22-v1-1-e017da246df0@kernel.org Signed-off-by: Kees Cook commit 1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3 Author: Kyle Meyer Date: Fri Mar 20 12:19:20 2026 -0500 x86/platform/uv: Handle deconfigured sockets When a socket is deconfigured, it's mapped to SOCK_EMPTY (0xffff). This causes a panic while allocating UV hub info structures. Fix this by using NUMA_NO_NODE, allowing UV hub info structures to be allocated on valid nodes. Fixes: 8a50c5851927 ("x86/platform/uv: UV support for sub-NUMA clustering") Signed-off-by: Kyle Meyer Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Steve Wahl Cc: stable@vger.kernel.org Link: https://patch.msgid.link/ab2BmGL0ehVkkjKk@hpe.com commit 1c7bbaeed110b0fd9e65e173fb4d612f64a20d93 Author: Kees Cook Date: Fri Mar 20 10:51:18 2026 -0700 coccinelle: kmalloc_obj: Remove default GFP_KERNEL arg Remove any GFP_KERNEL arguments found in the new kmalloc_obj-family helpers. This captures the script used in commit 189f164e573e ("Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses"). Link: https://patch.msgid.link/20260320175113.work.016-kees@kernel.org Signed-off-by: Kees Cook commit c612261bedd6bbab7109f798715e449c9d20ff2f Merge: 9f582e39712f95 418eab7a6f3c00 Author: Linus Torvalds Date: Fri Mar 20 09:58:56 2026 -0700 Merge tag 'io_uring-7.0-20260320' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - A bit of a work-around for AF_UNIX recv multishot, as the in-kernel implementation doesn't properly signal EOF. We'll likely rework this one going forward, but the fix is sufficient for now - Two fixes for incrementally consumed buffers, for non-pollable files and for 0 byte reads * tag 'io_uring-7.0-20260320' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/kbuf: propagate BUF_MORE through early buffer commit path io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF io_uring/poll: fix multishot recv missing EOF on wakeup race commit 63f8b60151dc00895137bfadc987f258060ab264 Author: Vladimir Oltean Date: Fri Mar 20 17:06:53 2026 +0100 x86/entry/vdso: Fix path of included gettimeofday.c Commit in Fixes forgot to convert one include path to be relative to the kernel source directory after adding latter to flags-y. Fix it. [ bp: Rewrite commit message. ] Fixes: 693c819fedcd ("x86/entry/vdso: Refactor the vdso build") Signed-off-by: Vladimir Oltean Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20260307174406.1808981-1-vladimir.oltean@nxp.com commit 9f582e39712f950f13dfa1ad49748a90937e48be Merge: 007fe2321509a8 8c89a077ca796a Author: Linus Torvalds Date: Fri Mar 20 09:54:40 2026 -0700 Merge tag 'spi-fix-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "There's a couple of core fixes here from Johan, fixing a race condition and an error handling path, plus a bunch of driver specific fixups. The Qualcomm issues could be nasty if you ran into them, especially the DMA ordering one" * tag 'spi-fix-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: geni-qcom: Check DMA interrupts early in ISR spi: fix statistics allocation spi: fix use-after-free on controller registration failure spi: geni-qcom: Fix CPHA and CPOL mode change detection spi: axiado: Fix double-free in ax_spi_probe() spi: amlogic-spisg: Fix memory leak in aml_spisg_probe() spi: amlogic: spifc-a4: Remove redundant clock cleanup commit 007fe2321509a8287050413655f460d4c5ad8e8c Merge: c715f13bb30f9f 4221f30e3e0a25 Author: Linus Torvalds Date: Fri Mar 20 09:52:45 2026 -0700 Merge tag 'regulator-fix-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "Just one fix here from Hugo Villeneuve, the documentation for some of the regulator DT properties had been cut'n'pasted so that if anyone actually read it they'd be informed that those properties had completely incorrect meanings" * tag 'regulator-fix-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: dt-bindings: fix typos in regulator-uv-* descriptions commit c715f13bb30f9f4d1bd8888667ef32e43b6fedc1 Merge: d07252736a6e94 b826d2c0b0ecb8 Author: Linus Torvalds Date: Fri Mar 20 09:46:15 2026 -0700 Merge tag 'pmdomain-v7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - bcm: increase ASB control timeout for bcm2835 - mediatek: fix power domain count * tag 'pmdomain-v7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: bcm: bcm2835-power: Increase ASB control timeout pmdomain: mediatek: Fix power domain count commit d07252736a6e946ca0cf4e7ce456eab5c3fd73e2 Merge: f374ff79f4bc46 5e3486e64094c2 Author: Linus Torvalds Date: Fri Mar 20 09:40:25 2026 -0700 Merge tag 'mmc-v7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - sdhci: Fix timing selection for 1-bit bus width - sdhci-pci-gli: Fix DMA write corruption for GL9750 * tag 'mmc-v7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci: fix timing selection for 1-bit bus width mmc: sdhci-pci-gli: fix GL9750 DMA write corruption commit f374ff79f4bc4615cb5e13f77f349cb7a45c1c54 Merge: 6ac513185c410f e6d7eba23b666d Author: Linus Torvalds Date: Fri Mar 20 09:38:12 2026 -0700 Merge tag 'ata-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Niklas Cassel: - ADATA SU680 SSDs are causing command timeouts when LPM is enabled. Enable the ATA_QUIRK_NOLPM quirk to prevent LPM from being enabled on these devices (Damien) - When receiving a REPORT SUPPORTED OPERATION CODES command with an invalid REPORTING OPTIONS format, sense data should have the field pointer set to byte 2 (the location of the REPORTING OPTIONS field) instead of incorrectly pointing to byte 1 (Damien) * tag 'ata-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in() ata: libata-core: disable LPM on ADATA SU680 SSD commit 6ac513185c410f9404ff66b920bec137cbc6e543 Merge: 47e231cbd36366 b9465b04de4b90 Author: Linus Torvalds Date: Fri Mar 20 09:34:32 2026 -0700 Merge tag 'mtd/fixes-for-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fixes from Miquel Raynal: - In SPI NOR, there was an issue with the RDCR capability, leading to several platforms no longer capable of using it for wrong reasons (the follow-up commit renames the helper to avoid future confusion) - NAND controller drivers needed to be improved to fix some timings, a locking schenario and avoid certain operations during panic writes - The Spear600 DT binding conversion was done partially, leading to several warnings which have individually been fixed - Tudor gets replaced by Takahiro for the SPI NOR maintainance - Plus two more misc fixes * tag 'mtd/fixes-for-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: rawnand: pl353: make sure optimal timings are applied mtd: spi-nor: Rename spi_nor_spimem_check_op() mtd: spi-nor: Fix RDCR controller capability core check mtd: rawnand: brcmnand: skip DMA during panic write mtd: rawnand: serialize lock/unlock against other NAND operations dt-bindings: mtd: st,spear600-smi: Fix example dt-bindings: mtd: st,spear600-smi: #address/size-cells is mandatory dt-bindings: mtd: st,spear600-smi: Fix description mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() mtd: Avoid boot crash in RedBoot partition table parser MAINTAINERS: add Takahiro Kuwano as SPI NOR reviewer MAINTAINERS: remove Tudor Ambarus as SPI NOR maintainer commit 47e231cbd363669eef28dfa97496621e0fc6db88 Merge: 165160265e4be3 ba17de98545d07 Author: Linus Torvalds Date: Fri Mar 20 09:29:03 2026 -0700 Merge tag 'iommu-fixes-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: "Intel VT-d: - Abort all pending requests on dev_tlb_inv timeout to avoid hardlockup - Limit IOPF handling to PRI-capable device to avoid SVA attach failure AMD-Vi: - Make sure identity domain is not used when SNP is active Core fixes: - Handle mapping IOVA 0x0 correctly - Fix crash in SVA code - Kernel-doc fix in IO-PGTable code" * tag 'iommu-fixes-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/amd: Block identity domain when SNP enabled iommu/sva: Fix crash in iommu_sva_unbind_device() iommu/io-pgtable: fix all kernel-doc warnings in io-pgtable.h iommu: Fix mapping check for 0x0 to avoid re-mapping it iommu/vt-d: Only handle IOPF for SVA when PRI is supported iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry commit 165160265e4be3a6639dd4ea5ca0953a858e2156 Merge: c3d13784d5b200 8c6e9b60f5c798 Author: Linus Torvalds Date: Fri Mar 20 09:23:01 2026 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "There's a small crop of fixes for the MPAM resctrl driver, a fix for SCS/PAC patching with the AMDGPU driver and a page-table fix for realms running with 52-bit physical addresses: - Fix DWARF parsing for SCS/PAC patching to work with very large modules (such as the amdgpu driver) - Fixes to the mpam resctrl driver - Fix broken handling of 52-bit physical addresses when sharing memory from within a realm" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: realm: Fix PTE_NS_SHARED for 52bit PA support arm_mpam: Force __iomem casts arm_mpam: Disable preemption when making accesses to fake MSC in kunit test arm_mpam: Fix null pointer dereference when restoring bandwidth counters arm64/scs: Fix handling of advance_loc4 commit c3d13784d5b200fc4b4a1f5d5f5585b8e3a5777e Merge: 7006433ca2de80 c0e296f257671b Author: Linus Torvalds Date: Fri Mar 20 09:18:22 2026 -0700 Merge tag 'hyperv-fixes-signed-20260319' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V fixes from Wei Liu: - Fix ARM64 MSHV support (Anirudh Rayabharam) - Fix MSHV driver memory handling issues (Stanislav Kinsburskii) - Update maintainers for Hyper-V DRM driver (Saurabh Sengar) - Misc clean up in MSHV crashdump code (Ard Biesheuvel, Uros Bizjak) - Minor improvements to MSHV code (Mukesh R, Wei Liu) - Revert not yet released MSHV scrub partition hypercall (Wei Liu) * tag 'hyperv-fixes-signed-20260319' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv: Fix error handling in mshv_region_pin MAINTAINERS: Update maintainers for Hyper-V DRM driver mshv: Fix use-after-free in mshv_map_user_memory error path mshv: pass struct mshv_user_mem_region by reference x86/hyperv: Use any general-purpose register when saving %cr2 and %cr8 x86/hyperv: Use current_stack_pointer to avoid asm() in hv_hvcrash_ctxt_save() x86/hyperv: Save segment registers directly to memory in hv_hvcrash_ctxt_save() x86/hyperv: Use __naked attribute to fix stackless C function Revert "mshv: expose the scrub partition hypercall" mshv: add arm64 support for doorbell & intercept SINTs mshv: refactor synic init and cleanup x86/hyperv: print out reserved vectors in hexadecimal commit a6e77320badd1444b0429ff8b6f338b750a1dc4f Merge: a15130d588143a 65d046b2d8e0d6 Author: Dave Airlie Date: Sat Mar 21 02:12:41 2026 +1000 Merge tag 'drm-xe-fixes-2026-03-19' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - A number of teardown fixes (Daniele, Matt Brost, Zhanjun, Ashutosh) - Skip over non-leaf PTE for PRL generation (Brian) - Fix an unitialized variable (Umesh) - Fix a missing runtime PM reference (Sanjay) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/abxj4_dBHYBiSvDG@fedora commit 7006433ca2de80e4aa7d11dceb3124335cff5a43 Merge: f268964788a909 23b5df09c27aec Author: Linus Torvalds Date: Fri Mar 20 09:07:29 2026 -0700 Merge tag 'v7.0-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix reporting of i_blocks - Fix Kerberos mounts with different usernames to same server - Trivial comment cleanup * tag 'v7.0-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix generic/694 due to wrong ->i_blocks cifs: smb1: fix comment typo smb: client: fix krb5 mount with username option commit f268964788a90966f8d18fa00adb94d4ae2ea812 Merge: 0e4f8f1a3d081e b425e4d0eb321a Author: Linus Torvalds Date: Fri Mar 20 09:03:37 2026 -0700 Merge tag 'v7.0-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Three use after free fixes (in close, in compounded ops, and in tree disconnect) - Multichannel fix - return proper volume identifier (superblock uuid if available) in FS_OBJECT_ID queries * tag 'v7.0-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix use-after-free in durable v2 replay of active file handles ksmbd: fix use-after-free of share_conf in compound request ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION ksmbd: unset conn->binding on failed binding request ksmbd: fix share_conf UAF in tree_conn disconnect commit a15130d588143a20592d55e2bb2be5489116a88f Merge: 437eccb1a89d70 86650ee2241ff8 Author: Dave Airlie Date: Sat Mar 21 01:57:51 2026 +1000 Merge tag 'amd-drm-fixes-7.0-2026-03-19' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-03-19: amdgpu: - Fix gamma 2.2 colorop TFs - BO list fix - LTO fix - DC FP fix - DisplayID handling fix - DCN 2.01 fix - MMHUB boundary fixes - ISP fix - TLB fence fix - Hainan pm fix radeon: - Hainan pm fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260319131013.36639-1-alexander.deucher@amd.com commit 437eccb1a89d7038776d3119e54bfda119c6e92a Merge: d551d2e876bf0e cffcb42c57686e Author: Dave Airlie Date: Sat Mar 21 01:52:29 2026 +1000 Merge tag 'drm-misc-fixes-2026-03-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A doc warning fix and a memory leak fix for vmwgfx, a deadlock fix and interrupt handling fixes for imagination, a locking fix for pagemap_until, a UAF fix for drm_dev_unplug, and a multi-channel audio handling fix for dw-hdmi-qp. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260319-lush-righteous-malamute-e7bb98@houat commit d551d2e876bf0e5f41d3cf54d4d63180cd8b8ff0 Merge: f338e77383789c 0162ab3220bac8 Author: Dave Airlie Date: Sat Mar 21 01:43:57 2026 +1000 Merge tag 'drm-intel-fixes-2026-03-19' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix #15771: Screen corruption and stuttering on P14s w/ 3K display - Fix for PSR entry setup frames count on rejected commit - Fix OOPS if firmware is not loaded and suspend is attempted - Fix unlikely NULL deref due to DC6 on probe Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/abujAnD-lRDCVSKg@jlahtine-mobl commit 217c0a5c177a3d4f7c8497950cbf5c36756e8bbb Author: Mike Rapoport (Microsoft) Date: Fri Mar 20 15:59:48 2026 +0200 x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size ranges_to_free array should have enough room to store the entire EFI memmap plus an extra element for NULL entry. The calculation of this array size wrongly adds 1 to the overall size instead of adding 1 to the number of elements. Add parentheses to properly size the array. Reported-by: Guenter Roeck Fixes: a4b0bf6a40f3 ("x86/efi: defer freeing of boot services memory") Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Ard Biesheuvel commit 76f9377cd2ab7a9220c25d33940d9ca20d368172 Author: Joanne Koong Date: Thu Mar 19 17:51:45 2026 -0700 writeback: don't block sync for filesystems with no data integrity guarantees Add a SB_I_NO_DATA_INTEGRITY superblock flag for filesystems that cannot guarantee data persistence on sync (eg fuse). For superblocks with this flag set, sync kicks off writeback of dirty inodes but does not wait for the flusher threads to complete the writeback. This replaces the per-inode AS_NO_DATA_INTEGRITY mapping flag added in commit f9a49aa302a0 ("fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()"). The flag belongs at the superblock level because data integrity is a filesystem-wide property, not a per-inode one. Having this flag at the superblock level also allows us to skip having to iterate every dirty inode in wait_sb_inodes() only to skip each inode individually. Prior to this commit, mappings with no data integrity guarantees skipped waiting on writeback completion but still waited on the flusher threads to finish initiating the writeback. Waiting on the flusher threads is unnecessary. This commit kicks off writeback but does not wait on the flusher threads. This change properly addresses a recent report [1] for a suspend-to-RAM hang seen on fuse-overlayfs that was caused by waiting on the flusher threads to finish: Workqueue: pm_fs_sync pm_fs_sync_work_fn Call Trace: __schedule+0x457/0x1720 schedule+0x27/0xd0 wb_wait_for_completion+0x97/0xe0 sync_inodes_sb+0xf8/0x2e0 __iterate_supers+0xdc/0x160 ksys_sync+0x43/0xb0 pm_fs_sync_work_fn+0x17/0xa0 process_one_work+0x193/0x350 worker_thread+0x1a1/0x310 kthread+0xfc/0x240 ret_from_fork+0x243/0x280 ret_from_fork_asm+0x1a/0x30 On fuse this is problematic because there are paths that may cause the flusher thread to block (eg if systemd freezes the user session cgroups first, which freezes the fuse daemon, before invoking the kernel suspend. The kernel suspend triggers ->write_node() which on fuse issues a synchronous setattr request, which cannot be processed since the daemon is frozen. Or if the daemon is buggy and cannot properly complete writeback, initiating writeback on a dirty folio already under writeback leads to writeback_get_folio() -> folio_prepare_writeback() -> unconditional wait on writeback to finish, which will cause a hang). This commit restores fuse to its prior behavior before tmp folios were removed, where sync was essentially a no-op. [1] https://lore.kernel.org/linux-fsdevel/CAJnrk1a-asuvfrbKXbEwwDSctvemF+6zfhdnuzO65Pt8HsFSRw@mail.gmail.com/T/#m632c4648e9cafc4239299887109ebd880ac6c5c1 Fixes: 0c58a97f919c ("fuse: remove tmp folio for writebacks and internal rb tree") Reported-by: John Cc: stable@vger.kernel.org Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20260320005145.2483161-2-joannelkoong@gmail.com Reviewed-by: Jan Kara Reviewed-by: David Hildenbrand (Arm) Signed-off-by: Christian Brauner commit 2594196f4e3bd70782e7cf1e22e3e398cdb74f78 Author: Hasun Park Date: Fri Mar 20 01:33:21 2026 +0900 ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine Add a DMI quirk entry for ASUS HN7306EA in the ACP SoundWire legacy machine driver. Set driver_data to ASOC_SDW_ACP_DMIC for this board so the platform-specific DMIC quirk path is selected. Signed-off-by: Hasun Park Link: https://patch.msgid.link/20260319163321.30326-1-hasunpark@gmail.com Signed-off-by: Mark Brown commit 215e5fe75881a7e2425df04aeeed47a903d5cd5d Author: Cássio Gabriel Date: Thu Mar 19 21:45:26 2026 -0300 ASoC: SOF: topology: reject invalid vendor array size in token parser sof_parse_token_sets() accepts array->size values that can be invalid for a vendor tuple array header. In particular, a zero size does not advance the parser state and can lead to non-progress parsing on malformed topology data. Validate array->size against the minimum header size and reject values smaller than sizeof(*array) before parsing. This preserves behavior for valid topologies and hardens malformed-input handling. Signed-off-by: Cássio Gabriel Acked-by: Peter Ujfalusi Link: https://patch.msgid.link/20260319-sof-topology-array-size-fix-v1-1-f9191b16b1b7@gmail.com Signed-off-by: Mark Brown commit 1613462be621ad5103ec338a7b0ca0746ec4e5f1 Author: Juergen Gross Date: Tue Oct 14 13:28:15 2025 +0200 xen/privcmd: add boot control for restricted usage in domU When running in an unprivileged domU under Xen, the privcmd driver is restricted to allow only hypercalls against a target domain, for which the current domU is acting as a device model. Add a boot parameter "unrestricted" to allow all hypercalls (the hypervisor will still refuse destructive hypercalls affecting other guests). Make this new parameter effective only in case the domU wasn't started using secure boot, as otherwise hypercalls targeting the domU itself might result in violating the secure boot functionality. This is achieved by adding another lockdown reason, which can be tested to not being set when applying the "unrestricted" option. This is part of XSA-482 Signed-off-by: Juergen Gross --- V2: - new patch commit f5ebf241c407dbf629fcf515015e139fcea2c2f0 Author: Leon Romanovsky Date: Mon Mar 16 21:06:52 2026 +0200 mm/hmm: Indicate that HMM requires DMA coherency HMM is fundamentally about allowing a sophisticated device to perform DMA directly to a process’s memory while the CPU accesses that same memory at the same time. It is similar to SVA but does not rely on IOMMU support. Because the entire model depends on concurrent access to shared memory, it fails as a uAPI if SWIOTLB substitutes the memory or if the CPU caches are not coherent with DMA. Until now, there has been no reliable way to report this, and various approximations have been used: int hmm_dma_map_alloc(struct device *dev, struct hmm_dma_map *map, size_t nr_entries, size_t dma_entry_size) { <...> /* * The HMM API violates our normal DMA buffer ownership rules and can't * transfer buffer ownership. The dma_addressing_limited() check is a * best approximation to ensure no swiotlb buffering happens. */ dma_need_sync = !dev->dma_skip_sync; if (dma_need_sync || dma_addressing_limited(dev)) return -EOPNOTSUPP; So let's mark mapped buffers with DMA_ATTR_REQUIRE_COHERENT attribute to prevent silent data corruption if someone tries to use hmm in a system with swiotlb or incoherent DMA Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260316-dma-debug-overlap-v3-8-1dde90a7f08b@nvidia.com commit d9d43a3f5c48d5a3d1da922f46c4a30d94d61ba5 Author: Leon Romanovsky Date: Mon Mar 16 21:06:51 2026 +0200 RDMA/umem: Tell DMA mapping that UMEM requires coherency The RDMA subsystem exposes DMA regions through the verbs interface, which assumes a coherent system. Use the DMA_ATTR_REQUIRE_COHERENCE attribute to ensure coherency and avoid taking the SWIOTLB path. The RDMA verbs programming model resembles HMM and assumes concurrent DMA and CPU access to userspace memory. The hardware and programming model support "one-sided" operations initiated remotely without any local CPU involvement or notification. These include ATOMIC compare/swap, READ, and WRITE. A remote CPU can use these operations to traverse data structures, manipulate locks, and perform similar tasks without the host CPU’s awareness. If SWIOTLB substitutes memory or DMA is not cache coherent, these use cases break entirely. In-kernel RDMA is fine with incoherent mappings because kernel users do not rely on one-sided operations in ways that would expose these issues. A given region may also be exported multiple times, which can trigger warnings about cacheline overlaps. These warnings are suppressed when the new attribute is used. infiniband rocep8s0f0: mlx5_ib_reg_user_mr:1592:(pid 5812): start 0x2b28c000, iova 0x2b28c000, length 0x1000, access_flags 0x1 infiniband rocep8s0f0: mlx5_ib_reg_user_mr:1592:(pid 5812): start 0x2b28c001, iova 0x2b28c001, length 0xfff, access_flags 0x1 ------------[ cut here ]------------ DMA-API: mlx5_core 0000:08:00.0: cacheline tracking EEXIST, overlapping mappings aren't supported WARNING: kernel/dma/debug.c:620 at add_dma_entry+0x1bb/0x280, CPU#6: ibv_rc_pingpong/5812 Modules linked in: veth xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_fwctl zram zsmalloc mlx5_ib fuse rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_core ib_core CPU: 6 UID: 2733 PID: 5812 Comm: ibv_rc_pingpong Tainted: G W 6.19.0+ #129 PREEMPT Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:add_dma_entry+0x1be/0x280 Code: 8b 7b 10 48 85 ff 0f 84 c3 00 00 00 48 8b 6f 50 48 85 ed 75 03 48 8b 2f e8 ff 8e 6a 00 48 89 c6 48 8d 3d 55 ef 2d 01 48 89 ea <67> 48 0f b9 3a 48 85 db 74 1a 48 c7 c7 b0 00 2b 82 e8 9c 25 fd ff RSP: 0018:ff11000138717978 EFLAGS: 00010286 RAX: ffffffffa02d7831 RBX: ff1100010246de00 RCX: 0000000000000000 RDX: ff110001036fac30 RSI: ffffffffa02d7831 RDI: ffffffff82678650 RBP: ff110001036fac30 R08: ff11000110dcb4a0 R09: ff11000110dcb478 R10: 0000000000000000 R11: ffffffff824b30a8 R12: 0000000000000000 R13: 00000000ffffffef R14: 0000000000000202 R15: ff1100010246de00 FS: 00007f59b411c740(0000) GS:ff110008dcc99000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe538f7000 CR3: 000000010e066005 CR4: 0000000000373eb0 Call Trace: debug_dma_map_sg+0x1b4/0x390 __dma_map_sg_attrs+0x6d/0x1a0 dma_map_sgtable+0x19/0x30 ib_umem_get+0x254/0x380 [ib_uverbs] mlx5_ib_reg_user_mr+0x68/0x2a0 [mlx5_ib] ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xc2/0x130 [ib_uverbs] ib_uverbs_cmd_verbs+0xa0b/0xae0 [ib_uverbs] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_PORT_SPEED+0xe0/0xe0 [ib_uverbs] ? mmap_region+0x7a/0xb0 ? do_mmap+0x3b8/0x5c0 ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs] __x64_sys_ioctl+0x14f/0x8b0 ? ksys_mmap_pgoff+0xc5/0x190 do_syscall_64+0x8c/0xbf0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f59b430aeed Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 RSP: 002b:00007ffe538f9430 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe538f94c0 RCX: 00007f59b430aeed RDX: 00007ffe538f94e0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffe538f9480 R08: 0000000000000028 R09: 00007ffe538f9684 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffe538f9684 R13: 000000000000000c R14: 000000002b28d170 R15: 000000000000000c ---[ end trace 0000000000000000 ]--- Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260316-dma-debug-overlap-v3-7-1dde90a7f08b@nvidia.com commit 636e6572e848339d2ae591949fe81de2cef00563 Author: Leon Romanovsky Date: Mon Mar 16 21:06:50 2026 +0200 iommu/dma: add support for DMA_ATTR_REQUIRE_COHERENT attribute Add support for the DMA_ATTR_REQUIRE_COHERENT attribute to the exported functions. This attribute indicates that the SWIOTLB path must not be used and that no sync operations should be performed. Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260316-dma-debug-overlap-v3-6-1dde90a7f08b@nvidia.com commit 2536617f20ddc7c2f4cef59b549aa45d166b03b1 Author: Leon Romanovsky Date: Mon Mar 16 21:06:49 2026 +0200 dma-direct: prevent SWIOTLB path when DMA_ATTR_REQUIRE_COHERENT is set DMA_ATTR_REQUIRE_COHERENT indicates that SWIOTLB must not be used. Ensure the SWIOTLB path is declined whenever the DMA direct path is selected. Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260316-dma-debug-overlap-v3-5-1dde90a7f08b@nvidia.com commit 453b8fb68f3641fea970db88b7d9a153ed2a37e8 Author: Juergen Gross Date: Thu Oct 9 16:54:58 2025 +0200 xen/privcmd: restrict usage in unprivileged domU The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limited to root and the hypervisor will deny any hypercalls affecting other domains. In case the guest is booted using secure boot, however, the privcmd driver would be enabling a root user process to modify e.g. kernel memory contents, thus breaking the secure boot feature. The only known case where an unprivileged domU is really needing to use the privcmd driver is the case when it is acting as the device model for another guest. In this case all hypercalls issued via the privcmd driver will target that other guest. Fortunately the privcmd driver can already be locked down to allow only hypercalls targeting a specific domain, but this mode can be activated from user land only today. The target domain can be obtained from Xenstore, so when not running in dom0 restrict the privcmd driver to that target domain from the beginning, resolving the potential problem of breaking secure boot. This is XSA-482 Reported-by: Teddy Astie Fixes: 1c5de1939c20 ("xen: add privcmd driver") Signed-off-by: Juergen Gross --- V2: - defer reading from Xenstore if Xenstore isn't ready yet (Jan Beulich) - wait in open() if target domain isn't known yet - issue message in case no target domain found (Jan Beulich) commit e6a58fa2556203a7f6731b4071705dc81cca5ca5 Author: Leon Romanovsky Date: Mon Mar 16 21:06:48 2026 +0200 dma-mapping: Introduce DMA require coherency attribute The mapping buffers which carry this attribute require DMA coherent system. This means that they can't take SWIOTLB path, can perform CPU cache overlap and doesn't perform cache flushing. Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260316-dma-debug-overlap-v3-4-1dde90a7f08b@nvidia.com commit 9bb0a4d6a4433b75274204b083dac8e515d2007d Author: Leon Romanovsky Date: Mon Mar 16 21:06:47 2026 +0200 dma-mapping: Clarify valid conditions for CPU cache line overlap Rename the DMA_ATTR_CPU_CACHE_CLEAN attribute to better reflect that it is debugging aid to inform DMA core code that CPU cache line overlaps are allowed, and refine the documentation describing its use. Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260316-dma-debug-overlap-v3-3-1dde90a7f08b@nvidia.com commit 6f45b1604cf43945ef472ae4ef30354025307c19 Author: Leon Romanovsky Date: Mon Mar 16 21:06:46 2026 +0200 dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output Tracing prints decoded DMA attribute flags, but it does not yet include the recently added DMA_ATTR_CPU_CACHE_CLEAN. Add support for decoding and displaying this attribute in the trace output. Fixes: 61868dc55a11 ("dma-mapping: add DMA_ATTR_CPU_CACHE_CLEAN") Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260316-dma-debug-overlap-v3-2-1dde90a7f08b@nvidia.com commit eca58535b154e6951327319afda94ac80eae7dc3 Author: Leon Romanovsky Date: Mon Mar 16 21:06:45 2026 +0200 dma-debug: Allow multiple invocations of overlapping entries Repeated DMA mappings with DMA_ATTR_CPU_CACHE_CLEAN trigger the following splat. This prevents using the attribute in cases where a DMA region is shared and reused more than seven times. ------------[ cut here ]------------ DMA-API: exceeded 7 overlapping mappings of cacheline 0x000000000438c440 WARNING: kernel/dma/debug.c:467 at add_dma_entry+0x219/0x280, CPU#4: ibv_rc_pingpong/1644 Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_fwctl zram zsmalloc mlx5_ib fuse rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_core ib_core CPU: 4 UID: 2733 PID: 1644 Comm: ibv_rc_pingpong Not tainted 6.19.0+ #129 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:add_dma_entry+0x221/0x280 Code: c0 0f 84 f2 fe ff ff 83 e8 01 89 05 6d 99 11 01 e9 e4 fe ff ff 0f 8e 1f ff ff ff 48 8d 3d 07 ef 2d 01 be 07 00 00 00 48 89 e2 <67> 48 0f b9 3a e9 06 ff ff ff 48 c7 c7 98 05 2b 82 c6 05 72 92 28 RSP: 0018:ff1100010e657970 EFLAGS: 00010002 RAX: 0000000000000007 RBX: ff1100010234eb00 RCX: 0000000000000000 RDX: ff1100010e657970 RSI: 0000000000000007 RDI: ffffffff82678660 RBP: 000000000438c440 R08: 0000000000000228 R09: 0000000000000000 R10: 00000000000001be R11: 000000000000089d R12: 0000000000000800 R13: 00000000ffffffef R14: 0000000000000202 R15: ff1100010234eb00 FS: 00007fb15f3f6740(0000) GS:ff110008dcc19000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb15f32d3a0 CR3: 0000000116f59001 CR4: 0000000000373eb0 Call Trace: debug_dma_map_sg+0x1b4/0x390 __dma_map_sg_attrs+0x6d/0x1a0 dma_map_sgtable+0x19/0x30 ib_umem_get+0x284/0x3b0 [ib_uverbs] mlx5_ib_reg_user_mr+0x68/0x2a0 [mlx5_ib] ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xc2/0x130 [ib_uverbs] ib_uverbs_cmd_verbs+0xa0b/0xae0 [ib_uverbs] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_PORT_SPEED+0xe0/0xe0 [ib_uverbs] ? mmap_region+0x7a/0xb0 ? do_mmap+0x3b8/0x5c0 ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs] __x64_sys_ioctl+0x14f/0x8b0 ? ksys_mmap_pgoff+0xc5/0x190 do_syscall_64+0x8c/0xbf0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fb15f5e4eed Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 RSP: 002b:00007ffe09a5c540 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe09a5c5d0 RCX: 00007fb15f5e4eed RDX: 00007ffe09a5c5f0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffe09a5c590 R08: 0000000000000028 R09: 00007ffe09a5c794 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffe09a5c794 R13: 000000000000000c R14: 0000000025a49170 R15: 000000000000000c ---[ end trace 0000000000000000 ]--- Fixes: 61868dc55a11 ("dma-mapping: add DMA_ATTR_CPU_CACHE_CLEAN") Signed-off-by: Leon Romanovsky Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260316-dma-debug-overlap-v3-1-1dde90a7f08b@nvidia.com commit c961cc86af01246a7ce706bbc29072d314e00880 Author: Biju Das Date: Wed Mar 18 12:08:52 2026 +0000 reset: rzg2l-usbphy-ctrl: Fix malformed MODULE_AUTHOR string Fix a malformed MODULE_AUTHOR macro in the RZ/G2L USBPHY control driver where the author's name and opening angle bracket were missing, leaving only the email address with a stray closing >. Correct it to the standard Name format. Signed-off-by: Biju Das Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit e6d7eba23b666d85cacee0643be280d6ce1ebffc Author: Damien Le Moal Date: Fri Mar 20 12:48:01 2026 +0900 ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in() Commit 4ab7bb976343 ("ata: libata-scsi: Refactor ata_scsiop_maint_in()") modified ata_scsiop_maint_in() to directly call ata_scsi_set_invalid_field() to set the field pointer of the sense data of a failed MAINTENANCE IN command. However, in the case of an invalid command format, the sense data field incorrectly indicates byte 1 of the CDB. Fix this to indicate byte 2 of the command. Reported-by: Guenter Roeck Fixes: 4ab7bb976343 ("ata: libata-scsi: Refactor ata_scsiop_maint_in()") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Niklas Cassel commit fc3bbf34e643faa8678aabdc3810c60109f3435a Author: Pedro Demarchi Gomes Date: Wed Mar 18 22:52:24 2026 -0300 drm/shmem-helper: Fix huge page mapping in fault handler When running ./tools/testing/selftests/mm/split_huge_page_test multiple times with /sys/kernel/mm/transparent_hugepage/shmem_enabled and /sys/kernel/mm/transparent_hugepage/enabled set as always the following BUG occurs: [ 232.728858] ------------[ cut here ]------------ [ 232.729458] kernel BUG at mm/memory.c:2276! [ 232.729726] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 232.730217] CPU: 19 UID: 60578 PID: 1497 Comm: llvmpipe-9 Not tainted 7.0.0-rc1mm-new+ #19 PREEMPT(lazy) [ 232.730855] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/10/2025 [ 232.731360] RIP: 0010:walk_to_pmd+0x29e/0x3c0 [ 232.731569] Code: d8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ea 48 89 de 4c 89 f7 e8 ae 85 ff ff 85 c0 0f 84 1f fe ff ff 31 db eb d0 <0f> 0b 48 89 ea 48 89 de 4c 89 f7 e8 92 8b ff ff 85 c0 75 e8 48 b8 [ 232.732614] RSP: 0000:ffff8881aa6ff9a8 EFLAGS: 00010282 [ 232.732991] RAX: 8000000142e002e7 RBX: ffff8881433cae10 RCX: dffffc0000000000 [ 232.733362] RDX: 0000000000000000 RSI: 00007fb47840b000 RDI: 8000000142e002e7 [ 232.733801] RBP: 00007fb47840b000 R08: 0000000000000000 R09: 1ffff110354dff46 [ 232.734168] R10: fffffbfff0cb921d R11: 00000000910da5ce R12: 1ffffffff0c1fcdd [ 232.734459] R13: 1ffffffff0c23f36 R14: ffff888171628040 R15: 0000000000000000 [ 232.734861] FS: 00007fb4907f86c0(0000) GS:ffff888791f2c000(0000) knlGS:0000000000000000 [ 232.735265] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 232.735548] CR2: 00007fb47840be00 CR3: 000000015e6dc000 CR4: 00000000000006f0 [ 232.736031] Call Trace: [ 232.736273] [ 232.736500] get_locked_pte+0x1f/0xa0 [ 232.736878] insert_pfn+0x9f/0x350 [ 232.737190] ? __pfx_pat_pagerange_is_ram+0x10/0x10 [ 232.737614] ? __pfx_insert_pfn+0x10/0x10 [ 232.737990] ? __pfx_css_rstat_updated+0x10/0x10 [ 232.738281] ? __pfx_pfn_modify_allowed+0x10/0x10 [ 232.738552] ? lookup_memtype+0x62/0x180 [ 232.738761] vmf_insert_pfn_prot+0x14b/0x340 [ 232.739012] ? __pfx_vmf_insert_pfn_prot+0x10/0x10 [ 232.739247] ? __pfx___might_resched+0x10/0x10 [ 232.739475] drm_gem_shmem_fault.cold+0x18/0x39 [ 232.739677] ? rcu_read_unlock+0x20/0x70 [ 232.739882] __do_fault+0x251/0x7b0 [ 232.740028] do_fault+0x6e1/0xc00 [ 232.740167] ? __lock_acquire+0x590/0xc40 [ 232.740335] handle_pte_fault+0x439/0x760 [ 232.740498] ? mtree_range_walk+0x252/0xae0 [ 232.740669] ? __pfx_handle_pte_fault+0x10/0x10 [ 232.740899] __handle_mm_fault+0xa02/0xf30 [ 232.741066] ? __pfx___handle_mm_fault+0x10/0x10 [ 232.741255] ? find_vma+0xa1/0x120 [ 232.741403] handle_mm_fault+0x2bf/0x8f0 [ 232.741564] do_user_addr_fault+0x2d3/0xed0 [ 232.741736] ? trace_page_fault_user+0x1bf/0x240 [ 232.741969] exc_page_fault+0x87/0x120 [ 232.742124] asm_exc_page_fault+0x26/0x30 [ 232.742288] RIP: 0033:0x7fb4d73ed546 [ 232.742441] Code: 66 41 0f 6f fb 66 44 0f 6d dc 66 44 0f 6f c6 66 41 0f 6d f1 66 0f 6c fc 66 45 0f 6c c1 66 44 0f 6f c9 66 0f 6d ca 66 0f db f0 <66> 0f df 04 08 66 44 0f 6c ca 66 45 0f db c2 66 44 0f df 10 66 44 [ 232.743193] RSP: 002b:00007fb4907f68a0 EFLAGS: 00010206 [ 232.743565] RAX: 00007fb47840aa00 RBX: 00007fb4d73ec070 RCX: 0000000000001400 [ 232.743871] RDX: 0000000000002800 RSI: 0000000000003c00 RDI: 0000000000000001 [ 232.744150] RBP: 0000000000000004 R08: 0000000000001400 R09: 00007fb4d73ec060 [ 232.744433] R10: 000055f0261a4288 R11: 00007fb4c013da40 R12: 0000000000000008 [ 232.744712] R13: 0000000000000000 R14: 4332322132212110 R15: 0000000000000004 [ 232.746616] [ 232.746711] Modules linked in: nft_nat nft_masq veth bridge stp llc snd_seq_dummy snd_hrtimer snd_seq snd_seq_device snd_timer snd soundcore overlay rfkill nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr ppdev 9pnet_virtio 9pnet parport_pc i2c_piix4 netfs pcspkr parport i2c_smbus joydev sunrpc vfat fat loop dm_multipath nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport zram lz4hc_compress vmw_vmci lz4_compress vsock e1000 bochs serio_raw ata_generic pata_acpi scsi_dh_rdac scsi_dh_emc scsi_dh_alua i2c_dev fuse qemu_fw_cfg [ 232.749308] ---[ end trace 0000000000000000 ]--- [ 232.749507] RIP: 0010:walk_to_pmd+0x29e/0x3c0 [ 232.749692] Code: d8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 89 ea 48 89 de 4c 89 f7 e8 ae 85 ff ff 85 c0 0f 84 1f fe ff ff 31 db eb d0 <0f> 0b 48 89 ea 48 89 de 4c 89 f7 e8 92 8b ff ff 85 c0 75 e8 48 b8 [ 232.750428] RSP: 0000:ffff8881aa6ff9a8 EFLAGS: 00010282 [ 232.750645] RAX: 8000000142e002e7 RBX: ffff8881433cae10 RCX: dffffc0000000000 [ 232.750954] RDX: 0000000000000000 RSI: 00007fb47840b000 RDI: 8000000142e002e7 [ 232.751232] RBP: 00007fb47840b000 R08: 0000000000000000 R09: 1ffff110354dff46 [ 232.751514] R10: fffffbfff0cb921d R11: 00000000910da5ce R12: 1ffffffff0c1fcdd [ 232.751837] R13: 1ffffffff0c23f36 R14: ffff888171628040 R15: 0000000000000000 [ 232.752124] FS: 00007fb4907f86c0(0000) GS:ffff888791f2c000(0000) knlGS:0000000000000000 [ 232.752441] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 232.752674] CR2: 00007fb47840be00 CR3: 000000015e6dc000 CR4: 00000000000006f0 [ 232.752983] Kernel panic - not syncing: Fatal exception [ 232.753510] Kernel Offset: disabled [ 232.754643] ---[ end Kernel panic - not syncing: Fatal exception ]--- This happens when two concurrent page faults occur within the same PMD range. One fault installs a PMD mapping through vmf_insert_pfn_pmd(), while the other attempts to install a PTE mapping via vmf_insert_pfn(). The bug is triggered because a pmd_trans_huge is not expected when walking the page table inside vmf_insert_pfn. Avoid this race by adding a huge_fault callback to drm_gem_shmem_vm_ops so that PMD-sized mappings are handled through the appropriate huge page fault path. Fixes: 211b9a39f261 ("drm/shmem-helper: Map huge pages in fault handler") Signed-off-by: Pedro Demarchi Gomes Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20260319015224.46896-1-pedrodemargomes@gmail.com Signed-off-by: Boris Brezillon commit 01f784fc9d0ab2a6dac45ee443620e517cb2a19b Author: Thinh Nguyen Date: Sat Mar 14 01:17:40 2026 +0000 scsi: target: file: Use kzalloc_flex for aio_cmd The target_core_file doesn't initialize the aio_cmd->iocb for the ki_write_stream. When a write command fd_execute_rw_aio() is executed, we may get a bogus ki_write_stream value, causing unintended write failure status when checking iocb->ki_write_stream > max_write_streams in the block device. Let's just use kzalloc_flex when allocating the aio_cmd and let ki_write_stream=0 to fix this issue. Fixes: 732f25a2895a ("fs: add a write stream field to the kiocb") Fixes: c27683da6406 ("block: expose write streams for block device nodes") Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen Link: https://patch.msgid.link/f1a2f81c62f043e31f80bb92d5f29893400c8ee2.1773450782.git.Thinh.Nguyen@synopsys.com Signed-off-by: Martin K. Petersen commit d71afa9deb4d413232ba16d693f7d43b321931b4 Author: Yihang Li Date: Tue Mar 17 14:31:47 2026 +0800 scsi: scsi_transport_sas: Fix the maximum channel scanning issue After commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"), if the device supports multiple channels (0 to shost->max_channel), user_scan() invokes updated sas_user_scan() to perform the scan behavior for a specific transfer. However, when the user specifies shost->max_channel, it will return -EINVAL, which is not expected. Fix and support specifying the scan shost->max_channel for scanning. Fixes: 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans") Signed-off-by: Yihang Li Reviewed-by: John Garry Link: https://patch.msgid.link/20260317063147.2182562-1-liyihang9@huawei.com Signed-off-by: Martin K. Petersen commit 1333eee56cdf3f0cf67c6ab4114c2c9e0a952026 Author: Josef Bacik Date: Mon Mar 16 20:23:29 2026 -0400 scsi: target: tcm_loop: Drain commands in target_reset handler tcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS without draining any in-flight commands. The SCSI EH documentation (scsi_eh.rst) requires that when a reset handler returns SUCCESS the driver has made lower layers "forget about timed out scmds" and is ready for new commands. Every other SCSI LLD (virtio_scsi, mpt3sas, ipr, scsi_debug, mpi3mr) enforces this by draining or completing outstanding commands before returning SUCCESS. Because tcm_loop_target_reset() doesn't drain, the SCSI EH reuses in-flight scsi_cmnd structures for recovery commands (e.g. TUR) while the target core still has async completion work queued for the old se_cmd. The memset in queuecommand zeroes se_lun and lun_ref_active, causing transport_lun_remove_cmd() to skip its percpu_ref_put(). The leaked LUN reference prevents transport_clear_lun_ref() from completing, hanging configfs LUN unlink forever in D-state: INFO: task rm:264 blocked for more than 122 seconds. rm D 0 264 258 0x00004000 Call Trace: __schedule+0x3d0/0x8e0 schedule+0x36/0xf0 transport_clear_lun_ref+0x78/0x90 [target_core_mod] core_tpg_remove_lun+0x28/0xb0 [target_core_mod] target_fabric_port_unlink+0x50/0x60 [target_core_mod] configfs_unlink+0x156/0x1f0 [configfs] vfs_unlink+0x109/0x290 do_unlinkat+0x1d5/0x2d0 Fix this by making tcm_loop_target_reset() actually drain commands: 1. Issue TMR_LUN_RESET via tcm_loop_issue_tmr() to drain all commands that the target core knows about (those not yet CMD_T_COMPLETE). 2. Use blk_mq_tagset_busy_iter() to iterate all started requests and flush_work() on each se_cmd — this drains any deferred completion work for commands that already had CMD_T_COMPLETE set before the TMR (which the TMR skips via __target_check_io_state()). This is the same pattern used by mpi3mr, scsi_debug, and libsas to drain outstanding commands during reset. Fixes: e0eb5d38b732 ("scsi: target: tcm_loop: Use block cmd allocator for se_cmds") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Josef Bacik Link: https://patch.msgid.link/27011aa34c8f6b1b94d2e3cf5655b6d037f53428.1773706803.git.josef@toxicpanda.com Signed-off-by: Martin K. Petersen commit 61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f Author: Tyllis Xu Date: Sat Mar 14 12:01:50 2026 -0500 scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targets. This value is stored directly in vhost->num_targets without validation, and is then used as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which is only allocated for max_targets entries. Indices at or beyond max_targets access kernel memory outside the DMA-coherent allocation. The out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI MADs that are sent back to the VIO server, leaking kernel memory. Fix by clamping num_written to max_targets before storing it. Fixes: 072b91f9c651 ("[SCSI] ibmvfc: IBM Power Virtual Fibre Channel Adapter Client Driver") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Tyllis Xu Reviewed-by: Dave Marquardt Acked-by: Tyrel Datwyler Link: https://patch.msgid.link/20260314170151.548614-1-LivelyCarpet87@gmail.com Signed-off-by: Martin K. Petersen commit 7a9f448d44127217fabc4065c5ba070d4e0b5d37 Author: Greg Kroah-Hartman Date: Mon Feb 23 16:44:59 2026 +0100 scsi: ses: Handle positive SCSI error from ses_recv_diag() ses_recv_diag() can return a positive value, which also means that an error happened, so do not only test for negative values. Cc: James E.J. Bottomley Cc: Martin K. Petersen Cc: stable Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/2026022301-bony-overstock-a07f@gregkh Signed-off-by: Martin K. Petersen commit 7c770dadfda5cbbde6aa3c4363ed513f1d212bf8 Author: Toke Høiland-Jørgensen Date: Wed Mar 18 16:55:51 2026 +0100 net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdev_destroy() callback can proceed immediately to the call_rcu() invocation if the IFF_OVS_DATAPATH flag is already cleared on the netdev. The ovs_netdev_detach_dev() function clears the flag before completing the unregistration, and if it gets preempted after clearing the flag (as can happen on an -rt kernel), netdev_destroy() can complete and the device can be freed before the unregistration completes. This leads to a splat like: [ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI [ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT [ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025 [ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0 [ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90 [ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246 [ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000 [ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05 [ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000 [ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006 [ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000 [ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000 [ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0 [ 998.393944] PKRU: 55555554 [ 998.393946] Call Trace: [ 998.393949] [ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch] [ 998.394009] ? __die_body.cold+0x8/0x12 [ 998.394016] ? die_addr+0x3c/0x60 [ 998.394027] ? exc_general_protection+0x16d/0x390 [ 998.394042] ? asm_exc_general_protection+0x26/0x30 [ 998.394058] ? dev_set_promiscuity+0x8d/0xa0 [ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch] [ 998.394092] dp_device_event+0x41/0x80 [openvswitch] [ 998.394102] notifier_call_chain+0x5a/0xd0 [ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60 [ 998.394110] rtnl_dellink+0x169/0x3e0 [ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0 [ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0 [ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0 [ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 998.394132] netlink_rcv_skb+0x50/0x100 [ 998.394138] netlink_unicast+0x292/0x3f0 [ 998.394141] netlink_sendmsg+0x21b/0x470 [ 998.394145] ____sys_sendmsg+0x39d/0x3d0 [ 998.394149] ___sys_sendmsg+0x9a/0xe0 [ 998.394156] __sys_sendmsg+0x7a/0xd0 [ 998.394160] do_syscall_64+0x7f/0x170 [ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 998.394165] RIP: 0033:0x7fad61bf4724 [ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 [ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724 [ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003 [ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f [ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2f8380 [ 998.394196] R13: 0000000069b233d7 R14: 000055df0a256040 R15: 0000000000000000 [ 998.394200] To fix this, reorder the operations in ovs_netdev_detach_dev() to only clear the flag after completing the other operations, and introduce an smp_wmb() to make the ordering requirement explicit. The smp_wmb() is paired with a full smp_mb() in netdev_destroy() to make sure the call_rcu() invocation does not happen before the unregister operations are visible. Reported-by: Minxi Hou Tested-by: Minxi Hou Fixes: 549822767630 ("net: openvswitch: Avoid needlessly taking the RTNL on vport destroy") Signed-off-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260318155554.1133405-1-toke@redhat.com Signed-off-by: Jakub Kicinski commit 4527025d440ce84bf56e75ce1df2e84cb8178616 Author: Jakub Kicinski Date: Tue Mar 17 12:33:34 2026 -0700 nfc: nci: fix circular locking dependency in nci_close_device nci_close_device() flushes rx_wq and tx_wq while holding req_lock. This causes a circular locking dependency because nci_rx_work() running on rx_wq can end up taking req_lock too: nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete -> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target -> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock) Move the flush of rx_wq after req_lock has been released. This should safe (I think) because NCI_UP has already been cleared and the transport is closed, so the work will see it and return -ENETDOWN. NIPA has been hitting this running the nci selftest with a debug kernel on roughly 4% of the runs. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reviewed-by: Ian Ray Link: https://patch.msgid.link/20260317193334.988609-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 57ce3b2e9cdabcbc4d5a10f0e97a1399058c7417 Merge: cbcb3cfcdc436d 761fb8ec8778f0 Author: Jakub Kicinski Date: Thu Mar 19 16:49:38 2026 -0700 Merge tag 'for-net-2026-03-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_ll: Fix firmware leak on error path - hci_sync: annotate data-races around hdev->req_status - L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - L2CAP: Fix regressions caused by reusing ident - L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req - MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold * tag 'for-net-2026-03-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: L2CAP: Fix regressions caused by reusing ident Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Bluetooth: hci_ll: Fix firmware leak on error path Bluetooth: hci_sync: annotate data-races around hdev->req_status Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req ==================== Link: https://patch.msgid.link/20260319190455.135302-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 0e4f8f1a3d081e834be5fd0a62bdb2554fadd307 Merge: 9b70771216558b 2c98a8fbd6aa64 Author: Linus Torvalds Date: Thu Mar 19 16:28:41 2026 -0700 Merge tag 'parisc-for-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: "Fix for the cacheflush() syscall which had D/I caches mixed up" * tag 'parisc-for-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Flush correct cache in cacheflush() syscall commit 9b70771216558bffb329c2e69b2fd5fd71133e55 Merge: a1d9d8e833781c 21647677ba9af2 Author: Linus Torvalds Date: Thu Mar 19 16:13:51 2026 -0700 Merge tag 'pci-v7.0-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Create pwrctrl devices only for DT nodes below a PCI controller that describe PCI devices and are related to a power supply; this prevents waiting indefinitely for pwrctrl drivers that will never probe (Manivannan Sadhasivam) - Restore endpoint BAR mapping on subrange setup failure to make selftest reliable (Koichiro Den) * tag 'pci-v7.0-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: endpoint: pci-epf-test: Roll back BAR mapping when subrange setup fails PCI/pwrctrl: Create pwrctrl devices only for PCI device nodes PCI/pwrctrl: Ensure that remote endpoint node parent has supply requirement commit 78a6ee14f8b9e1c8f7c77612122444f3be8dc8cc Author: Gabor Juhos Date: Thu Feb 26 14:11:27 2026 +0100 i2c: pxa: defer reset on Armada 3700 when recovery is used The I2C communication is completely broken on the Armada 3700 platform since commit 0b01392c18b9 ("i2c: pxa: move to generic GPIO recovery"). For example, on the Methode uDPU board, probing of the two onboard temperature sensors fails ... [ 7.271713] i2c i2c-0: using pinctrl states for GPIO recovery [ 7.277503] i2c i2c-0: PXA I2C adapter [ 7.282199] i2c i2c-1: using pinctrl states for GPIO recovery [ 7.288241] i2c i2c-1: PXA I2C adapter [ 7.292947] sfp sfp-eth1: Host maximum power 3.0W [ 7.299614] sfp sfp-eth0: Host maximum power 3.0W [ 7.308178] lm75 1-0048: supply vs not found, using dummy regulator [ 32.489631] lm75 1-0048: probe with driver lm75 failed with error -121 [ 32.496833] lm75 1-0049: supply vs not found, using dummy regulator [ 82.890614] lm75 1-0049: probe with driver lm75 failed with error -121 ... and accessing the plugged-in SFP modules also does not work: [ 511.298537] sfp sfp-eth1: please wait, module slow to respond [ 536.488530] sfp sfp-eth0: please wait, module slow to respond ... [ 1065.688536] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO [ 1090.888532] sfp sfp-eth0: failed to read EEPROM: -EREMOTEIO After a discussion [1], there was an attempt to fix the problem by reverting the offending change by commit 7b211c767121 ("Revert "i2c: pxa: move to generic GPIO recovery""), but that only helped to fix the issue in the 6.1.y stable tree. The reason behind the partial succes is that there was another change in commit 20cb3fce4d60 ("i2c: Set i2c pinctrl recovery info from it's device pinctrl") in the 6.3-rc1 cycle which broke things further. The cause of the problem is the same in case of both offending commits mentioned above. Namely, the I2C core code changes the pinctrl state to GPIO while running the recovery initialization code. Although the PXA specific initialization also does this, but the key difference is that it happens before the controller is getting enabled in i2c_pxa_reset(), whereas in the case of the generic initialization it happens after that. Change the code to reset the controller only before the first transfer instead of before registering the controller. This ensures that the controller is not enabled at the time when the generic recovery code performs the pinctrl state changes, thus avoids the problem described above. As the result this change restores the original behaviour, which in turn makes the I2C communication to work again as it can be seen from the following log: [ 7.363250] i2c i2c-0: using pinctrl states for GPIO recovery [ 7.369041] i2c i2c-0: PXA I2C adapter [ 7.373673] i2c i2c-1: using pinctrl states for GPIO recovery [ 7.379742] i2c i2c-1: PXA I2C adapter [ 7.384506] sfp sfp-eth1: Host maximum power 3.0W [ 7.393013] sfp sfp-eth0: Host maximum power 3.0W [ 7.399266] lm75 1-0048: supply vs not found, using dummy regulator [ 7.407257] hwmon hwmon0: temp1_input not attached to any thermal zone [ 7.413863] lm75 1-0048: hwmon0: sensor 'tmp75c' [ 7.418746] lm75 1-0049: supply vs not found, using dummy regulator [ 7.426371] hwmon hwmon1: temp1_input not attached to any thermal zone [ 7.432972] lm75 1-0049: hwmon1: sensor 'tmp75c' [ 7.755092] sfp sfp-eth1: module MENTECHOPTO POS22-LDCC-KR rev 1.0 sn MNC208U90009 dc 200828 [ 7.764997] mvneta d0040000.ethernet eth1: unsupported SFP module: no common interface modes [ 7.785362] sfp sfp-eth0: module Mikrotik S-RJ01 rev 1.0 sn 61B103C55C58 dc 201022 [ 7.803426] hwmon hwmon2: temp1_input not attached to any thermal zone Link: https://lore.kernel.org/r/20230926160255.330417-1-robert.marko@sartura.hr #1 Cc: stable@vger.kernel.org # 6.3+ Fixes: 20cb3fce4d60 ("i2c: Set i2c pinctrl recovery info from it's device pinctrl") Signed-off-by: Gabor Juhos Tested-by: Robert Marko Reviewed-by: Linus Walleij Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260226-i2c-pxa-fix-i2c-communication-v4-1-797a091dae87@gmail.com commit cbcb3cfcdc436d6f91a3d95ecfa9c831abe14aed Author: Mohammad Heib Date: Tue Mar 17 19:08:06 2026 +0200 ionic: fix persistent MAC address override on PF The use of IONIC_CMD_LIF_SETATTR in the MAC address update path causes the ionic firmware to update the LIF's identity in its persistent state. Since the firmware state is maintained across host warm boots and driver reloads, any MAC change on the Physical Function (PF) becomes "sticky. This is problematic because it causes ethtool -P to report the user-configured MAC as the permanent factory address, which breaks system management tools that rely on a stable hardware identity. While Virtual Functions (VFs) need this hardware-level programming to properly handle MAC assignments in guest environments, the PF should maintain standard transient behavior. This patch gates the ionic_program_mac call using is_virtfn so that PF MAC changes remain local to the netdev filters and do not overwrite the firmware's permanent identity block. Fixes: 19058be7c48c ("ionic: VF initial random MAC address if no assigned mac") Signed-off-by: Mohammad Heib Reviewed-by: Simon Horman Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260317170806.35390-1-mheib@redhat.com Signed-off-by: Jakub Kicinski commit be627abcc0d5dbd5882873bd85fbc18aa3d189ed Author: Christophe JAILLET Date: Sun Mar 1 17:21:01 2026 +0100 i2c: fsi: Fix a potential leak in fsi_i2c_probe() In the commit in Fixes:, when the code has been updated to use an explicit for loop, instead of for_each_available_child_of_node(), the assumption that a reference to a device_node structure would be released at each iteration has been broken. Now, an explicit of_node_put() is needed to release the reference. Fixes: 095561f476ab ("i2c: fsi: Create busses for all ports") Signed-off-by: Christophe JAILLET Cc: # v5.3+ Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/fd805c39f8de51edf303856103d782138a1633c8.1772382022.git.christophe.jaillet@wanadoo.fr commit aa79f996eb41e95aed85a1bd7f56bcd6a3842008 Author: Johan Hovold Date: Mon Mar 9 08:50:16 2026 +0100 i2c: cp2615: fix serial string NULL-deref at probe The cp2615 driver uses the USB device serial string as the i2c adapter name but does not make sure that the string exists. Verify that the device has a serial number before accessing it to avoid triggering a NULL-pointer dereference (e.g. with malicious devices). Fixes: 4a7695429ead ("i2c: cp2615: add i2c driver for Silicon Labs' CP2615 Digital Audio Bridge") Cc: stable@vger.kernel.org # 5.13 Cc: Bence Csókás Signed-off-by: Johan Hovold Reviewed-by: Bence Csókás Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260309075016.25612-1-johan@kernel.org commit be5c5280cf2b20e363dc8e2a424dd200a29b1c77 Author: Cui Chao Date: Thu Mar 19 15:45:35 2026 +0800 cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi During the cxl_acpi probe process, it checks whether the cxl_nvb device and driver have been attached. Currently, the startup priority of the cxl_pmem driver is lower than that of the cxl_acpi driver. At this point, the cxl_nvb driver has not yet been registered on the cxl_bus, causing the attachment check to fail. This results in a failure to add the root nvdimm bridge, leading to a cxl_acpi probe failure and ultimately affecting the subsequent loading of cxl drivers. As a consequence, only one mem device object exists on the cxl_bus, while the cxl_port device objects and decoder device objects are missing. The solution is to raise the startup priority of cxl_pmem to be higher than that of cxl_acpi, ensuring that the cxl_pmem driver is registered before the aforementioned attachment check occurs. Co-developed-by: Wang Yinfeng Signed-off-by: Wang Yinfeng Signed-off-by: Cui Chao Fixes: e7e222ad73d9 ("cxl: Move devm_cxl_add_nvdimm_bridge() to cxl_pmem.ko") Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260319074535.1709250-1-cuichao1753@phytium.com.cn Signed-off-by: Dave Jiang commit 418eab7a6f3c002d8e64d6e95ec27118017019af Author: Jens Axboe Date: Thu Mar 19 14:29:20 2026 -0600 io_uring/kbuf: propagate BUF_MORE through early buffer commit path When io_should_commit() returns true (eg for non-pollable files), buffer commit happens at buffer selection time and sel->buf_list is set to NULL. When __io_put_kbufs() generates CQE flags at completion time, it calls __io_put_kbuf_ring() which finds a NULL buffer_list and hence cannot determine whether the buffer was consumed or not. This means that IORING_CQE_F_BUF_MORE is never set for non-pollable input with incrementally consumed buffers. Likewise for io_buffers_select(), which always commits upfront and discards the return value of io_kbuf_commit(). Add REQ_F_BUF_MORE to store the result of io_kbuf_commit() during early commit. Then __io_put_kbuf_ring() can check this flag and set IORING_F_BUF_MORE accordingy. Reported-by: Martin Michaelis Cc: stable@vger.kernel.org Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption") Link: https://github.com/axboe/liburing/issues/1553 Signed-off-by: Jens Axboe commit 3ecd3e03144b38a21a3b70254f1b9d2e16629b09 Author: Jens Axboe Date: Thu Mar 19 14:29:09 2026 -0600 io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF For a zero length transfer, io_kbuf_inc_commit() is called with !len. Since we never enter the while loop to consume the buffers, io_kbuf_inc_commit() ends up returning true, consuming the buffer. But if no data was consumed, by definition it cannot have consumed the buffer. Return false for that case. Reported-by: Martin Michaelis Cc: stable@vger.kernel.org Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption") Link: https://github.com/axboe/liburing/issues/1553 Signed-off-by: Jens Axboe commit a54142d9ff49dadb8bd063b8d016546e5706184c Author: Mickaël Salaün Date: Tue Mar 10 20:04:15 2026 +0100 selftests/landlock: Test tsync interruption and cancellation paths Add tsync_interrupt test to exercise the signal interruption path in landlock_restrict_sibling_threads(). When a signal interrupts wait_for_completion_interruptible() while the calling thread waits for sibling threads to finish credential preparation, the kernel: 1. Sets ERESTARTNOINTR to request a transparent syscall restart. 2. Calls cancel_tsync_works() to opportunistically dequeue task works that have not started running yet. 3. Breaks out of the preparation loop, then unblocks remaining task works via complete_all() and waits for them to finish. 4. Returns the error, causing abort_creds() in the syscall handler. Specifically, cancel_tsync_works() in its entirety, the ERESTARTNOINTR error branch in landlock_restrict_sibling_threads(), and the abort_creds() error branch in the landlock_restrict_self() syscall handler are timing-dependent and not exercised by the existing tsync tests, making code coverage measurements non-deterministic. The test spawns a signaler thread that rapidly sends SIGUSR1 to the calling thread while it performs landlock_restrict_self() with LANDLOCK_RESTRICT_SELF_TSYNC. Since ERESTARTNOINTR causes a transparent restart, userspace always sees the syscall succeed. This is a best-effort coverage test: the interruption path is exercised when the signal lands during the preparation wait, which depends on thread scheduling. The test creates enough idle sibling threads (200) to ensure multiple serialized waves of credential preparation even on machines with many cores (e.g., 64), widening the window for the signaler. Deterministic coverage would require wrapping the wait call with ALLOW_ERROR_INJECTION() and using CONFIG_FAIL_FUNCTION. Test coverage for security/landlock was 90.2% of 2105 lines according to LLVM 21, and it is now 91.1% of 2105 lines with this new test. Cc: Günther Noack Cc: Justin Suess Cc: Tingmao Wang Cc: Yihan Ding Link: https://lore.kernel.org/r/20260310190416.1913908-1-mic@digikod.net Signed-off-by: Mickaël Salaün commit 23b5df09c27aec13962b30d32a4167ebdd043f8e Author: Paulo Alcantara Date: Wed Mar 18 21:43:51 2026 -0300 smb: client: fix generic/694 due to wrong ->i_blocks When updating ->i_size, make sure to always update ->i_blocks as well until we query new allocation size from the server. generic/694 was failing because smb3_simple_falloc() was missing the update of ->i_blocks after calling cifs_setsize(). So, fix this by updating ->i_blocks directly in cifs_setsize(), so all places that call it doesn't need to worry about updating ->i_blocks later. Reported-by: Shyam Prasad N Closes: https://lore.kernel.org/r/CANT5p=rqgRwaADB=b_PhJkqXjtfq3SFv41SSTXSVEHnuh871pA@mail.gmail.com Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 8f9f64c8f90dca07d3b9f1d7ce5d34ccd246c9dd Author: Luca Leonardo Scorcia Date: Tue Mar 17 11:02:06 2026 +0000 pinctrl: mediatek: common: Fix probe failure for devices without EINT Some pinctrl devices like mt6397 or mt6392 don't support EINT at all, but the mtk_eint_init function is always called and returns -ENODEV, which then bubbles up and causes probe failure. To address this only call mtk_eint_init if EINT pins are present. Tested on Xiaomi Mi Smart Clock x04g (mt6392). Fixes: e46df235b4e6 ("pinctrl: mediatek: refactor EINT related code for all MediaTek pinctrl can fit") Signed-off-by: Luca Leonardo Scorcia Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Linus Walleij commit 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 Author: Luiz Augusto von Dentz Date: Tue Mar 17 11:54:01 2026 -0400 Bluetooth: L2CAP: Fix regressions caused by reusing ident This attempt to fix regressions caused by reusing ident which apparently is not handled well on certain stacks causing the stack to not respond to requests, so instead of simple returning the first unallocated id this stores the last used tx_ident and then attempt to use the next until all available ids are exausted and then cycle starting over to 1. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221120 Link: https://bugzilla.kernel.org/show_bug.cgi?id=221177 Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident") Signed-off-by: Luiz Augusto von Dentz Tested-by: Christian Eggers commit b6552e0503973daf6f23bd6ed9273ef131ee364f Author: Helen Koike Date: Thu Mar 19 08:58:01 2026 -0300 Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Before using sk pointer, check if it is null. Fix the following: KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267] CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025 Workqueue: events l2cap_info_timeout RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce veth0_macvtap: entered promiscuous mode RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: __kasan_check_byte+0x12/0x40 lock_acquire+0x79/0x2e0 lock_sock_nested+0x48/0x100 ? l2cap_sock_ready_cb+0x46/0x160 l2cap_sock_ready_cb+0x46/0x160 l2cap_conn_start+0x779/0xff0 ? __pfx_l2cap_conn_start+0x10/0x10 ? l2cap_info_timeout+0x60/0xa0 ? __pfx___mutex_lock+0x10/0x10 l2cap_info_timeout+0x68/0xa0 ? process_scheduled_works+0xa8d/0x18c0 process_scheduled_works+0xb6e/0x18c0 ? __pfx_process_scheduled_works+0x10/0x10 ? assign_work+0x3d5/0x5e0 worker_thread+0xa53/0xfc0 kthread+0x388/0x470 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x51e/0xb90 ? __pfx_ret_from_fork+0x10/0x10 veth1_macvtap: entered promiscuous mode ? __switch_to+0xc7d/0x1450 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Modules linked in: ---[ end trace 0000000000000000 ]--- batman_adv: batadv0: Interface activated: batadv_slave_0 batman_adv: batadv0: Interface activated: batadv_slave_1 netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce ieee80211 phy39: Selected rate control algorithm 'minstrel_ht' RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0 PKRU: 55555554 Kernel panic - not syncing: Fatal exception Fixes: 54a59aa2b562 ("Bluetooth: Add l2cap_chan->ops->ready()") Signed-off-by: Helen Koike Signed-off-by: Luiz Augusto von Dentz commit 31148a7be723aa9f2e8fbd62424825ab8d577973 Author: Anas Iqbal Date: Sun Mar 15 10:51:37 2026 +0000 Bluetooth: hci_ll: Fix firmware leak on error path Smatch reports: drivers/bluetooth/hci_ll.c:587 download_firmware() warn: 'fw' from request_firmware() not released on lines: 544. In download_firmware(), if request_firmware() succeeds but the returned firmware content is invalid (no data or zero size), the function returns without releasing the firmware, resulting in a resource leak. Fix this by calling release_firmware() before returning when request_firmware() succeeded but the firmware content is invalid. Fixes: 371805522f87 ("bluetooth: hci_uart: add LL protocol serdev driver support") Reviewed-by: Paul Menzel Signed-off-by: Anas Iqbal Signed-off-by: Luiz Augusto von Dentz commit b6807cfc195ef99e1ac37b2e1e60df40295daa8c Author: Cen Zhang Date: Sun Mar 15 20:07:26 2026 +0800 Bluetooth: hci_sync: annotate data-races around hdev->req_status __hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock: hdev->req_status = HCI_REQ_PEND; However, several other functions read or write hdev->req_status without holding any lock: - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue) - hci_cmd_sync_complete() reads/writes from HCI event completion - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write - hci_abort_conn() reads in connection abort path Since __hci_cmd_sync_sk() runs on hdev->req_workqueue while hci_send_cmd_sync() runs on hdev->workqueue, these are different workqueues that can execute concurrently on different CPUs. The plain C accesses constitute a data race. Add READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses to hdev->req_status to prevent potential compiler optimizations that could affect correctness (e.g., load fusing in the wait_event condition or store reordering). Signed-off-by: Cen Zhang Signed-off-by: Luiz Augusto von Dentz commit 5f5fa4cd35f707344f65ce9e225b6528691dbbaa Author: Luiz Augusto von Dentz Date: Mon Mar 16 15:03:27 2026 -0400 Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete This fixes the condition checking so mgmt_pending_valid is executed whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd) would kfree(cmd) without unlinking it from the list first, leaving a dangling pointer. Any subsequent list traversal (e.g., mgmt_pending_foreach during __mgmt_power_off, or another mgmt_pending_valid call) would dereference freed memory. Link: https://lore.kernel.org/linux-bluetooth/20260315132013.75ab40c5@kernel.org/T/#m1418f9c82eeff8510c1beaa21cf53af20db96c06 Fixes: 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") Signed-off-by: Luiz Augusto von Dentz Reviewed-by: Paul Menzel commit 598dbba9919c5e36c54fe1709b557d64120cb94b Author: Hyunwoo Kim Date: Fri Mar 13 05:26:16 2026 +0900 Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim Signed-off-by: Luiz Augusto von Dentz commit c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 Author: Hyunwoo Kim Date: Fri Mar 13 05:22:39 2026 +0900 Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb. The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path. Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly") Signed-off-by: Hyunwoo Kim Signed-off-by: Luiz Augusto von Dentz commit 9d87cb22195b2c67405f5485d525190747ad5493 Author: Minseo Park Date: Sun Mar 15 22:14:37 2026 +0900 Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Syzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd() that is triggered by a malformed Enhanced Credit Based Connection Request. The vulnerability stems from l2cap_ecred_conn_req(). The function allocates a local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel IDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more than 5 SCIDs, the function calculates `rsp_len` based on this unvalidated `cmd_len` before checking if the number of SCIDs exceeds L2CAP_ECRED_MAX_CID. If the SCID count is too high, the function correctly jumps to the `response` label to reject the packet, but `rsp_len` retains the attacker's oversized value. Consequently, l2cap_send_cmd() is instructed to read past the end of the 18-byte `pdu` buffer, triggering a KASAN panic. Fix this by moving the assignment of `rsp_len` to after the `num_scid` boundary check. If the packet is rejected, `rsp_len` will safely remain 0, and the error response will only read the 8-byte base header from the stack. Fixes: c28d2bff7044 ("Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short") Reported-by: syzbot+b7f3e7d9a596bf6a63e3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b7f3e7d9a596bf6a63e3 Tested-by: syzbot+b7f3e7d9a596bf6a63e3@syzkaller.appspotmail.com Signed-off-by: Minseo Park Signed-off-by: Luiz Augusto von Dentz commit a1d9d8e833781c44ab688708804ce35f20f3cbbd Merge: e9825d1c79570b 7ab4a7c5d96964 Author: Linus Torvalds Date: Thu Mar 19 11:25:40 2026 -0700 Merge tag 'net-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wireless, Bluetooth and netfilter. Nothing too exciting here, mostly fixes for corner cases. Current release - fix to a fix: - bonding: prevent potential infinite loop in bond_header_parse() Current release - new code bugs: - wifi: mac80211: check tdls flag in ieee80211_tdls_oper Previous releases - regressions: - af_unix: give up GC if MSG_PEEK intervened - netfilter: conntrack: add missing netlink policy validations - NFC: nxp-nci: allow GPIOs to sleep" * tag 'net-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (78 commits) MPTCP: fix lock class name family in pm_nl_create_listen_socket icmp: fix NULL pointer dereference in icmp_tag_validation() net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths net: shaper: protect from late creation of hierarchy net: shaper: protect late read accesses to the hierarchy net: mvpp2: guard flow control update with global_tx_fc in buffer switching nfnetlink_osf: validate individual option lengths in fingerprints netfilter: nf_tables: release flowtable after rcu grace period on error netfilter: bpf: defer hook memory release until rcu readers are done net: bonding: fix NULL deref in bond_debug_rlb_hash_show udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n net/mlx5e: Fix race condition during IPSec ESN update net/mlx5e: Prevent concurrent access to IPSec ASO context net/mlx5: qos: Restrict RTNL area to avoid a lock cycle ipv6: add NULL checks for idev in SRv6 paths NFC: nxp-nci: allow GPIOs to sleep net: macb: fix uninitialized rx_fs_lock net: macb: fix use-after-free access to PTP clock netdevsim: drop PSP ext ref on forward failure wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure ... commit 65d046b2d8e0d6d855379a981869005fd6b6a41b Author: Sanjay Yadav Date: Fri Mar 13 12:46:09 2026 +0530 drm/xe: Fix missing runtime PM reference in ccs_mode_store ccs_mode_store() calls xe_gt_reset() which internally invokes xe_pm_runtime_get_noresume(). That function requires the caller to already hold an outer runtime PM reference and warns if none is held: [46.891177] xe 0000:03:00.0: [drm] Missing outer runtime PM protection [46.891178] WARNING: drivers/gpu/drm/xe/xe_pm.c:885 at xe_pm_runtime_get_noresume+0x8b/0xc0 Fix this by protecting xe_gt_reset() with the scope-based guard(xe_pm_runtime)(xe), which is the preferred form when the reference lifetime matches a single scope. v2: - Use scope-based guard(xe_pm_runtime)(xe) (Shuicheng) - Update commit message accordingly Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7593 Fixes: 480b358e7d8e ("drm/xe: Do not wake device during a GT reset") Cc: # v6.19+ Cc: Thomas Hellström Cc: Matthew Brost Cc: Rodrigo Vivi Cc: Shuicheng Lin Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Shuicheng Lin Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260313071608.3459480-2-sanjay.kumar.yadav@intel.com (cherry picked from commit 7937ea733f79b3f25e802a0c8360bf7423856f36) Signed-off-by: Thomas Hellström commit 7ab4a7c5d969642782b8a5b608da0dd02aa9f229 Author: Li Xiasong Date: Thu Mar 19 19:21:59 2026 +0800 MPTCP: fix lock class name family in pm_nl_create_listen_socket In mptcp_pm_nl_create_listen_socket(), use entry->addr.family instead of sk->sk_family for lock class setup. The 'sk' parameter is a netlink socket, not the MPTCP subflow socket being created. Fixes: cee4034a3db1 ("mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()") Signed-off-by: Li Xiasong Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260319112159.3118874-1-lixiasong1@huawei.com Signed-off-by: Jakub Kicinski commit 614aefe56af8e13331e50220c936fc0689cf5675 Author: Weiming Shi Date: Wed Mar 18 21:06:01 2026 +0800 icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation. Fixes: 8ed1dc44d3e9 ("ipv4: introduce hardened ip_no_pmtu_disc mode") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Link: https://patch.msgid.link/20260318130558.1050247-4-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit b48731849609cbd8c53785a48976850b443153fd Author: Anas Iqbal Date: Wed Mar 18 08:42:12 2026 +0000 net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths Smatch reports: drivers/net/dsa/bcm_sf2.c:997 bcm_sf2_sw_resume() warn: 'priv->clk' from clk_prepare_enable() not released on lines: 983,990. The clock enabled by clk_prepare_enable() in bcm_sf2_sw_resume() is not released if bcm_sf2_sw_rst() or bcm_sf2_cfp_resume() fails. Add the missing clk_disable_unprepare() calls in the error paths to properly release the clock resource. Fixes: e9ec5c3bd238 ("net: dsa: bcm_sf2: request and handle clocks") Reviewed-by: Jonas Gorski Reviewed-by: Florian Fainelli Signed-off-by: Anas Iqbal Link: https://patch.msgid.link/20260318084212.1287-1-mohd.abd.6602@gmail.com Signed-off-by: Jakub Kicinski commit cce598ffc6afd01e7a780051f3ac624b60aa2ee4 Merge: 46eee1661aa9b4 424e95d62110cd Author: Marc Kleine-Budde Date: Thu Mar 19 17:16:03 2026 +0100 Merge patch series "can: fix can-gw Out-of-Bounds Heap R/W and isotp UAF" Marc Kleine-Budde says: This series is by Ali Norouzi and Oliver Hartkopp fixing a can-gw Out-of-Bounds Heap R/W and can-isotp UAF. Link: https://patch.msgid.link/20260319-fix-can-gw-and-can-isotp-v2-0-c45d52c6d2d8@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 424e95d62110cdbc8fd12b40918f37e408e35a92 Author: Oliver Hartkopp Date: Thu Mar 19 16:47:45 2026 +0100 can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_event_interruptible() and then calls kfree(so->tx.buf). If a signal interrupts the wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the loop exits early and release proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) while sendmsg may still be reading so->tx.buf for the final CAN frame in isotp_fill_dataframe(). The so->tx.buf can be allocated once when the standard tx.buf length needs to be extended. Move the kfree() of this potentially extended tx.buf to sk_destruct time when either isotp_sendmsg() and isotp_release() are done. Fixes: 96d1c81e6a04 ("can: isotp: add module parameter for maximum pdu size") Cc: stable@vger.kernel.org Reported-by: Ali Norouzi Co-developed-by: Ali Norouzi Signed-off-by: Ali Norouzi Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260319-fix-can-gw-and-can-isotp-v2-2-c45d52c6d2d8@pengutronix.de Signed-off-by: Marc Kleine-Budde commit b9c310d72783cc2f30d103eed83920a5a29c671a Author: Ali Norouzi Date: Thu Mar 19 16:47:44 2026 +0100 can: gw: fix OOB heap access in cgw_csum_crc8_rel() cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx(): int from = calc_idx(crc8->from_idx, cf->len); int to = calc_idx(crc8->to_idx, cf->len); int res = calc_idx(crc8->result_idx, cf->len); if (from < 0 || to < 0 || res < 0) return; However, the loop and the result write then use the raw s8 fields directly instead of the computed variables: for (i = crc8->from_idx; ...) /* BUG: raw negative index */ cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */ With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame, calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with i = -64, reading cf->data[-64], and the write goes to cf->data[-64]. This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the start of the canfd_frame on the heap. The companion function cgw_csum_xor_rel() uses `from`/`to`/`res` correctly throughout; fix cgw_csum_crc8_rel() to match. Confirmed with KASAN on linux-7.0-rc2: BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0 Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62 To configure the can-gw crc8 checksums CAP_NET_ADMIN is needed. Fixes: 456a8a646b25 ("can: gw: add support for CAN FD frames") Cc: stable@vger.kernel.org Reported-by: Ali Norouzi Reviewed-by: Oliver Hartkopp Acked-by: Oliver Hartkopp Signed-off-by: Ali Norouzi Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260319-fix-can-gw-and-can-isotp-v2-1-c45d52c6d2d8@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 01f2557aa684e514005541e71a3d01f4cd45c170 Author: Matthew Brost Date: Tue Mar 10 18:50:39 2026 -0400 drm/xe: Open-code GGTT MMIO access protection GGTT MMIO access is currently protected by hotplug (drm_dev_enter), which works correctly when the driver loads successfully and is later unbound or unloaded. However, if driver load fails, this protection is insufficient because drm_dev_unplug() is never called. Additionally, devm release functions cannot guarantee that all BOs with GGTT mappings are destroyed before the GGTT MMIO region is removed, as some BOs may be freed asynchronously by worker threads. To address this, introduce an open-coded flag, protected by the GGTT lock, that guards GGTT MMIO access. The flag is cleared during the dev_fini_ggtt devm release function to ensure MMIO access is disabled once teardown begins. Cc: stable@vger.kernel.org Fixes: 919bb54e989c ("drm/xe: Fix missing runtime outer protection for ggtt_remove_node") Reviewed-by: Zhanjun Dong Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-8-zhanjun.dong@intel.com (cherry picked from commit 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431) Signed-off-by: Thomas Hellström commit 3bfc213d4675736567a4e263c51c25144d565949 Author: Felix Gu Date: Mon Mar 9 20:16:15 2026 +0800 soc: microchip: mpfs-mss-top-sysreg: Fix resource leak on driver unbind Use devm_mfd_add_devices() instead of mfd_add_devices() to ensure child devices are properly removed when the driver unbinds. Fixes: 4aac11c9a6e7 ("soc: microchip: add mfd drivers for two syscon regions on PolarFire SoC") Signed-off-by: Felix Gu Signed-off-by: Conor Dooley commit 27459f86a43792d5c29f267a41dbd387601e772b Author: Felix Gu Date: Mon Mar 9 20:16:14 2026 +0800 soc: microchip: mpfs-control-scb: Fix resource leak on driver unbind Use devm_mfd_add_devices() instead of mfd_add_devices() to ensure child devices are properly removed when the driver unbinds. Fixes: 4aac11c9a6e7 ("soc: microchip: add mfd drivers for two syscon regions on PolarFire SoC") Signed-off-by: Felix Gu Signed-off-by: Conor Dooley commit e9825d1c79570b4c11259e826b3f7c1511544a85 Merge: d107dc8c9c6a9f 9633370653151a Author: Linus Torvalds Date: Thu Mar 19 08:45:34 2026 -0700 Merge tag 'pm-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix an idle loop issue exposed by recent changes and a race condition related to device removal in the runtime PM core code: - Consolidate the handling of two special cases in the idle loop that occur when only one CPU idle state is present (Rafael Wysocki) - Fix a race condition related to device removal in the runtime PM core code that may cause a stale device object pointer to be dereferenced (Bart Van Assche)" * tag 'pm-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: runtime: Fix a race condition related to device removal sched: idle: Consolidate the handling of two special cases commit c8cfeb4b9dda2cdfce79519aee4aaff16310a7b6 Author: Amelie Delaunay Date: Tue Mar 17 11:06:54 2026 +0100 pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC The HDP driver uses the generic GPIO chip API, but this configuration may not be enabled. Ensure it is enabled by selecting the appropriate option. Fixes: 4bcff9c05b9d ("pinctrl: stm32: use new generic GPIO chip API") Signed-off-by: Amelie Delaunay Signed-off-by: Linus Walleij commit d107dc8c9c6a9f9e4bb213f5a6398fc5c33a00a9 Merge: 1863b4055b7902 5cbcd6c0742a29 Author: Linus Torvalds Date: Thu Mar 19 08:42:59 2026 -0700 Merge tag 'acpi-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fixes from Rafael Wysocki: "These fix an MFD child automatic modprobe issue introduced recently, an ACPI processor driver issue introduced by a previous fix and an ACPICA issue causing confusing messages regarding _DSM arguments to be printed: - Update the format of the last argument of _DSM to avoid printing confusing error messages in some cases (Saket Dumbre) - Fix MFD child automatic modprobe issue by removing a stale check from acpi_companion_match() (Pratap Nirujogi) - Prevent possible use-after-free in acpi_processor_errata_piix4() from occurring by rearranging the code to print debug messages while holding references to relevant device objects (Rafael Wysocki)" * tag 'acpi-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: bus: Fix MFD child automatic modprobe issue ACPI: processor: Fix previous acpi_processor_errata_piix4() fix ACPICA: Update the format of Arg3 of _DSM commit e7577a06ae28287ca415aec5c12277e3a80ee372 Merge: d75ec7e8ba1979 dbdfaae9609629 Author: Paolo Abeni Date: Thu Mar 19 15:39:33 2026 +0100 Merge tag 'nf-26-03-19' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net The following patchset contains Netfilter fixes for *net*: 1) Fix UaF when netfilter bpf link goes away while nfnetlink dumps current hook list, we have to wait until rcu readers are gone. 2) Fix UaF when flowtable fails to register all devices, similar bug as 1). From Pablo Neira Ayuso. 3) nfnetlink_osf fails to properly validate option length fields. From Weiming Shi. netfilter pull request nf-26-03-19 * tag 'nf-26-03-19' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: nfnetlink_osf: validate individual option lengths in fingerprints netfilter: nf_tables: release flowtable after rcu grace period on error netfilter: bpf: defer hook memory release until rcu readers are done ==================== Link: https://patch.msgid.link/20260319093834.19933-1-fw@strlen.de Signed-off-by: Paolo Abeni commit 5cbcd6c0742a2986782a9e2c92aa250d8f5c137d Merge: bf504b229cb8d5 ab93d7eee94205 e7648ffecb7fcb Author: Rafael J. Wysocki Date: Thu Mar 19 14:57:06 2026 +0100 Merge branches 'acpica' and 'acpi-bus' Merge an ACPICA fix and a core ACPI support code fix for 7.0-rc5: - Update the format of the last argument of _DSM to avoid printing confusing error messages in some cases (Saket Dumbre) - Fix MFD child automatic modprobe issue by removing a stale check from acpi_companion_match() (Pratap Nirujogi) * acpica: ACPICA: Update the format of Arg3 of _DSM * acpi-bus: ACPI: bus: Fix MFD child automatic modprobe issue commit 46eee1661aa9b49966e6c43d07126fe408edda57 Author: Oliver Hartkopp Date: Wed Mar 18 18:34:13 2026 +0100 can: statistics: add missing atomic access in hot path Commit 80b5f90158d1 ("can: statistics: use atomic access in hot path") fixed a KCSAN issue in can_receive() but missed to convert the 'matches' variable used in can_rcv_filter(). Fixes: 80b5f90158d1 ("can: statistics: use atomic access in hot path") Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260318173413.28235-1-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 9633370653151a0d5637634d1887d2f32511e69f Merge: f4c31b07b13683 29ab7682776174 Author: Rafael J. Wysocki Date: Thu Mar 19 14:49:44 2026 +0100 Merge branch 'pm-runtime' Merge a fix for a race condition related to device removal (Bart Van Assche) for 7.0-rc5. * pm-runtime: PM: runtime: Fix a race condition related to device removal commit 7a57354756c7df223abe2c33774235ad70cb4231 Author: Wenyuan Li <2063309626@qq.com> Date: Mon Mar 16 00:00:22 2026 +0800 can: mcp251x: add error handling for power enable in open and resume Add missing error handling for mcp251x_power_enable() calls in both mcp251x_open() and mcp251x_can_resume() functions. In mcp251x_open(), if power enable fails, jump to error path to close candev without attempting to disable power again. In mcp251x_can_resume(), properly check return values of power enable calls for both power and transceiver regulators. If any fails, return the error code to the PM framework and log the failure. This ensures the driver properly handles power control failures and maintains correct device state. Signed-off-by: Wenyuan Li <2063309626@qq.com> Link: https://patch.msgid.link/tencent_F3EFC5D7738AC548857B91657715E2D3AA06@qq.com [mkl: fix patch description] [mkl: mcp251x_can_resume(): replace goto by return] Signed-off-by: Marc Kleine-Budde commit cadf6019231b614ebbd9ec2a16e5997ecbd8d016 Author: Marc Kleine-Budde Date: Tue Mar 10 13:48:03 2026 +0100 can: netlink: can_changelink(): add missing error handling to call can_ctrlmode_changelink() In commit e1a5cd9d6665 ("can: netlink: add can_ctrlmode_changelink()") the CAN Control Mode (IFLA_CAN_CTRLMODE) handling was factored out into the can_ctrlmode_changelink() function. But the call to can_ctrlmode_changelink() is missing the error handling. Add the missing error handling and propagation to the call can_ctrlmode_changelink(). Cc: stable@vger.kernel.org Fixes: e1a5cd9d6665 ("can: netlink: add can_ctrlmode_changelink()") Link: https://patch.msgid.link/20260310-can_ctrlmode_changelink-add-error-handling-v1-1-0daf63d85922@pengutronix.de Signed-off-by: Marc Kleine-Budde commit e6e3ea52bf07a0b7b9dff189616f189b83ee397a Author: Umesh Nerlige Ramappa Date: Thu Mar 12 05:53:09 2026 -0700 drm/xe/lrc: Fix uninitialized new_ts when capturing context timestamp Getting engine specific CTX TIMESTAMP register can fail. In that case, if the context is active, new_ts is uninitialized. Fix that case by initializing new_ts to the last value that was sampled in SW - lrc->ctx_timestamp. Flagged by static analysis. v2: Fix new_ts initialization (Ashutosh) Fixes: bb63e7257e63 ("drm/xe: Avoid toggling schedule state to check LRC timestamp in TDR") Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Ashutosh Dixit Link: https://patch.msgid.link/20260312125308.3126607-2-umesh.nerlige.ramappa@intel.com (cherry picked from commit 466e75d48038af252187855058a7a9312db9d2f8) Signed-off-by: Thomas Hellström commit 9be6fd9fbd2032b683e51374497768af9aaa228a Author: Ashutosh Dixit Date: Thu Mar 12 22:36:30 2026 -0700 drm/xe/oa: Allow reading after disabling OA stream Some OA data might be present in the OA buffer when OA stream is disabled. Allow UMD's to retrieve this data, so that all data till the point when OA stream is disabled can be retrieved. v2: Update tail pointer after disable (Umesh) Fixes: efb315d0a013 ("drm/xe/oa/uapi: Read file_operation") Cc: stable@vger.kernel.org Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://patch.msgid.link/20260313053630.3176100-1-ashutosh.dixit@intel.com (cherry picked from commit 4ff57c5e8dbba23b5457be12f9709d5c016da16e) Signed-off-by: Thomas Hellström commit 38b8dcde231641f00eee977d245dbfe5f6b06e11 Author: Brian Nguyen Date: Thu Mar 5 17:15:48 2026 +0000 drm/xe: Skip over non leaf pte for PRL generation The check using xe_child->base.children was insufficient in determining if a pte was a leaf node. So explicitly skip over every non-leaf pt and conditionally abort if there is a scenario where a non-leaf pt is interleaved between leaf pt, which results in the page walker skipping over some leaf pt. Note that the behavior being targeted for abort is PD[0] = 2M PTE PD[1] = PT -> 512 4K PTEs PD[2] = 2M PTE results in abort, page walker won't descend PD[1]. With new abort, ensuring valid PRL before handling a second abort. v2: - Revert to previous assert. - Revised non-leaf handling for interleaf child pt and leaf pte. - Update comments to specifications. (Stuart) - Remove unnecessary XE_PTE_PS64. (Matthew B) v3: - Modify secondary abort to only check non-leaf PTEs. (Matthew B) Fixes: b912138df299 ("drm/xe: Create page reclaim list on unbind") Signed-off-by: Brian Nguyen Reviewed-by: Matthew Brost Cc: Stuart Summers Link: https://patch.msgid.link/20260305171546.67691-6-brian3.nguyen@intel.com Signed-off-by: Matt Roper (cherry picked from commit 1d123587525db86cc8f0d2beb35d9e33ca3ade83) Signed-off-by: Thomas Hellström commit 7838dd8367419e9fc43b79c038321cb3c04de2a2 Author: Zhanjun Dong Date: Tue Mar 10 18:50:37 2026 -0400 drm/xe/guc: Ensure CT state transitions via STOP before DISABLED The GuC CT state transition requires moving to the STOP state before entering the DISABLED state. Update the driver teardown sequence to make the proper state machine transitions. Fixes: ee4b32220a6b ("drm/xe/guc: Add devm release action to safely tear down CT") Cc: stable@vger.kernel.org Signed-off-by: Zhanjun Dong Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-6-zhanjun.dong@intel.com (cherry picked from commit dace8cb0032f57ea67c87b3b92ad73c89dd2db44) Signed-off-by: Thomas Hellström commit e0f82655df6fbb15b318e9d56724cd54b1cfb04d Author: Matthew Brost Date: Tue Mar 10 18:50:35 2026 -0400 drm/xe: Trigger queue cleanup if not in wedged mode 2 The intent of wedging a device is to allow queues to continue running only in wedged mode 2. In other modes, queues should initiate cleanup and signal all remaining fences. Fix xe_guc_submit_wedge to correctly clean up queues when wedge mode != 2. Fixes: 7dbe8af13c18 ("drm/xe: Wedge the entire device") Cc: stable@vger.kernel.org Reviewed-by: Zhanjun Dong Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-4-zhanjun.dong@intel.com (cherry picked from commit e25ba41c8227c5393c16e4aab398076014bd345f) Signed-off-by: Thomas Hellström commit fb3738693cbdce104bf12615e980a6a37ff9087d Author: Matthew Brost Date: Tue Mar 10 18:50:34 2026 -0400 drm/xe: Forcefully tear down exec queues in GuC submit fini In GuC submit fini, forcefully tear down any exec queues by disabling CTs, stopping the scheduler (which cleans up lost G2H), killing all remaining queues, and resuming scheduling to allow any remaining cleanup actions to complete and signal any remaining fences. Split guc_submit_fini into device related and software only part. Using device-managed and drm-managed action guarantees the correct ordering of cleanup. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Reviewed-by: Zhanjun Dong Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-3-zhanjun.dong@intel.com (cherry picked from commit a6ab444a111a59924bd9d0c1e0613a75a0a40b89) Signed-off-by: Thomas Hellström commit 26c638d5602e329e0b26281a74c6ec69dee12f23 Author: Matthew Brost Date: Tue Mar 10 18:50:33 2026 -0400 drm/xe: Always kill exec queues in xe_guc_submit_pause_abort xe_guc_submit_pause_abort is intended to be called after something disastrous occurs (e.g., VF migration fails, device wedging, or driver unload) and should immediately trigger the teardown of remaining submission state. With that, kill any remaining queues in this function. Fixes: 7c4b7e34c83b ("drm/xe/vf: Abort VF post migration recovery on failure") Cc: stable@vger.kernel.org Signed-off-by: Zhanjun Dong Reviewed-by: Stuart Summers Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260310225039.1320161-2-zhanjun.dong@intel.com (cherry picked from commit 78f3bf00be4f15daead02ba32d4737129419c902) Signed-off-by: Thomas Hellström commit 9b72283ec9b8685acdb3467de8fbc3352fdb70bb Author: Daniele Ceraolo Spurio Date: Mon Mar 2 16:17:33 2026 -0800 drm/xe/guc: Fail immediately on GuC load error By using the same variable for both the return of poll_timeout_us and the return of the polled function guc_wait_ucode, the return value of the latter is overwritten and lost after exiting the polling loop. Since guc_wait_ucode returns -1 on GuC load failure, we lose that information and always continue as if the GuC had been loaded correctly. This is fixed by simply using 2 separate variables. Fixes: a4916b4da448 ("drm/xe/guc: Refactor GuC load to use poll_timeout_us()") Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: Matthew Brost Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260303001732.2540493-2-daniele.ceraolospurio@intel.com (cherry picked from commit c85ec5c5753a46b5c2aea1292536487be9470ffe) Signed-off-by: Thomas Hellström commit a437601a0a1383260222223440a95dd4322eb7fa Author: Baojun Xu Date: Thu Mar 19 17:07:47 2026 +0800 ASoC: tas2781: Add null check for calibration data For avoid null pointer problem if no calibration data exist. Fixes: 55137f5a68b5e ("ASoC: tas2781: Put three different calibrated data solution into the same data structure") Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20260319090747.2090-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit d75ec7e8ba1979a1eb0b9211d94d749cdce849c8 Author: Jakub Kicinski Date: Tue Mar 17 09:10:14 2026 -0700 net: shaper: protect from late creation of hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. The netdev may get unregistered in between the time we take the ref and the time we lock it. We may allocate the hierarchy after flush has already run, which would lead to a leak. Take the instance lock in pre- already, this saves us from the race and removes the need for dedicated lock/unlock callbacks completely. After all, if there's any chance of write happening concurrently with the flush - we're back to leaking the hierarchy. We may take the lock for devices which don't support shapers but we're only dealing with SET operations here, not taking the lock would be optimizing for an error case. Fixes: 93954b40f6a4 ("net-shapers: implement NL set and delete operations") Link: https://lore.kernel.org/20260309173450.538026-1-p@1g4.org Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260317161014.779569-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit 0f9ea7141f365b4f27226898e62220fb98ef8dc6 Author: Jakub Kicinski Date: Tue Mar 17 09:10:13 2026 -0700 net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. This is not proper, a conversion from a ref to a locked netdev must include a liveness check (a check if the netdev hasn't been unregistered already). Fix the read cases (those under RCU). Writes needs a separate change to protect from creating the hierarchy after flush has already run. Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation") Reported-by: Paul Moses Link: https://lore.kernel.org/20260309173450.538026-1-p@1g4.org Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260317161014.779569-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 8c6e9b60f5c7985a9fe41320556a92d7a33451df Author: Suzuki K Poulose Date: Mon Mar 16 16:19:01 2026 +0000 arm64: realm: Fix PTE_NS_SHARED for 52bit PA support With LPA/LPA2, the top bits of the PFN (Bits[51:48]) end up in the lower bits of the PTE. So, simply creating a mask of the "top IPA bit" doesn't work well for these configurations to set the "top" bit at the output of Stage1 translation. Fix this by using the __phys_to_pte_val() to do the right thing for all configurations. Tested using, kvmtool, placing the memory at a higher address (-m @). e.g: # lkvm run --realm -c 4 -m 512M@@128T -k Image --console serial sh-5.0# dmesg | grep "LPA2\|RSI" [ 0.000000] RME: Using RSI version 1.0 [ 0.000000] CPU features: detected: 52-bit Virtual Addressing (LPA2) [ 0.777354] CPU features: detected: 52-bit Virtual Addressing for KVM (LPA2) Fixes: 399306954996 ("arm64: realm: Query IPA size from the RMM") Cc: Catalin Marinas Cc: Steven Price Cc: Will Deacon Signed-off-by: Suzuki K Poulose Reviewed-by: Steven Price Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit 7e57523490cd2efb52b1ea97f2e0a74c0fb634cd Author: David Howells Date: Wed Mar 18 15:38:58 2026 +0000 netfs: Fix read abandonment during retry Under certain circumstances, all the remaining subrequests from a read request will get abandoned during retry. The abandonment process expects the 'subreq' variable to be set to the place to start abandonment from, but it doesn't always have a useful value (it will be uninitialised on the first pass through the loop and it may point to a deleted subrequest on later passes). Fix the first jump to "abandon:" to set subreq to the start of the first subrequest expected to need retry (which, in this abandonment case, turned out unexpectedly to no longer have NEED_RETRY set). Also clear the subreq pointer after discarding superfluous retryable subrequests to cause an oops if we do try to access it. Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Signed-off-by: David Howells Link: https://patch.msgid.link/3775287.1773848338@warthog.procyon.org.uk Reviewed-by: Paulo Alcantara (Red Hat) cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 8fb6857f2f5e35179ff35e7d25358b9add681b7e Author: Jori Koolstra Date: Wed Mar 18 21:39:52 2026 +0100 vfs: fix docstring of hash_name() The docstring of hash_name() is falsely reporting that it returns the component length, whereas it returns a pointer to the terminating '/' or NUL character in the pathname being resolved. Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260318203953.5770-1-jkoolstra@xs4all.nl Signed-off-by: Christian Brauner commit 8a63baadf08453f66eb582fdb6dd234f72024723 Author: Muhammad Hammad Ijaz Date: Mon Mar 16 12:31:01 2026 -0700 net: mvpp2: guard flow control update with global_tx_fc in buffer switching mvpp2_bm_switch_buffers() unconditionally calls mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and shared buffer pool modes. This function programs CM3 flow control registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference priv->cm3_base without any NULL check. When the CM3 SRAM resource is not present in the device tree (the third reg entry added by commit 60523583b07c ("dts: marvell: add CM3 SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains NULL and priv->global_tx_fc is false. Any operation that triggers mvpp2_bm_switch_buffers(), for example an MTU change that crosses the jumbo frame threshold, will crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits pc : readl+0x0/0x18 lr : mvpp2_cm3_read.isra.0+0x14/0x20 Call trace: readl+0x0/0x18 mvpp2_bm_pool_update_fc+0x40/0x12c mvpp2_bm_pool_update_priv_fc+0x94/0xd8 mvpp2_bm_switch_buffers.isra.0+0x80/0x1c0 mvpp2_change_mtu+0x140/0x380 __dev_set_mtu+0x1c/0x38 dev_set_mtu_ext+0x78/0x118 dev_set_mtu+0x48/0xa8 dev_ifsioc+0x21c/0x43c dev_ioctl+0x2d8/0x42c sock_ioctl+0x314/0x378 Every other flow control call site in the driver already guards hardware access with either priv->global_tx_fc or port->tx_fc. mvpp2_bm_switch_buffers() is the only place that omits this check. Add the missing priv->global_tx_fc guard to both the disable and re-enable calls in mvpp2_bm_switch_buffers(), consistent with the rest of the driver. Fixes: 3a616b92a9d1 ("net: mvpp2: Add TX flow control support for jumbo frames") Signed-off-by: Muhammad Hammad Ijaz Reviewed-by: Gunnar Kudrjavets Link: https://patch.msgid.link/20260316193157.65748-1-mhijaz@amazon.com Signed-off-by: Paolo Abeni commit dbdfaae9609629a9569362e3b8f33d0a20fd783c Author: Weiming Shi Date: Thu Mar 19 15:32:44 2026 +0800 nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nf_osf_match_one() to enter the option matching loop even when foptsize sums to zero, which matches packets with no TCP options where ctx->optp is NULL: Oops: general protection fault KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98) Call Trace: nf_osf_match (net/netfilter/nfnetlink_osf.c:227) xt_osf_match_packet (net/netfilter/xt_osf.c:32) ipt_do_table (net/ipv4/netfilter/ip_tables.c:293) nf_hook_slow (net/netfilter/core.c:623) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) Additionally, an MSS option (kind=2) with length < 4 causes out-of-bounds reads when nf_osf_match_one() unconditionally accesses optp[2] and optp[3] for MSS value extraction. While RFC 9293 section 3.2 specifies that the MSS option is always exactly 4 bytes (Kind=2, Length=4), the check uses "< 4" rather than "!= 4" because lengths greater than 4 do not cause memory safety issues -- the buffer is guaranteed to be at least foptsize bytes by the ctx->optsize == foptsize check. Reject fingerprints where any option has zero length, or where an MSS option has length less than 4, at add time rather than trusting these values in the packet matching hot path. Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Signed-off-by: Florian Westphal commit d73f4b53aaaea4c95f245e491aa5eeb8a21874ce Author: Pablo Neira Ayuso Date: Tue Mar 17 20:00:26 2026 +0100 netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtable can be already registered, exposing this flowtable to packet path and nfnetlink_hook control plane. This error path is rare, it should only happen by reaching the maximum number hooks or by failing to set up to hardware offload, just call synchronize_rcu(). There is a check for already used device hooks by different flowtable that could result in EEXIST at this late stage. The hook parser can be updated to perform this check earlier to this error path really becomes rarely exercised. Uncovered by KASAN reported as use-after-free from nfnetlink_hook path when dumping hooks. Fixes: 3b49e2e94e6e ("netfilter: nf_tables: add flow table netlink frontend") Reported-by: Yiming Qian Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 24f90fa3994b992d1a09003a3db2599330a5232a Author: Florian Westphal Date: Tue Mar 17 12:23:08 2026 +0100 netfilter: bpf: defer hook memory release until rcu readers are done Yiming Qian reports UaF when concurrent process is dumping hooks via nfnetlink_hooks: BUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0 Read of size 8 at addr ffff888003edbf88 by task poc/79 Call Trace: nfnl_hook_dump_one.isra.0+0xe71/0x10f0 netlink_dump+0x554/0x12b0 nfnl_hook_get+0x176/0x230 [..] Defer release until after concurrent readers have completed. Reported-by: Yiming Qian Fixes: 84601d6ee68a ("bpf: add bpf_link support for BPF_NETFILTER programs") Signed-off-by: Florian Westphal commit 1ca468e78ea97c3365befdd408f71bda4b295134 Author: Andy Shevchenko Date: Wed Mar 11 18:15:58 2026 +0100 pinctrl: intel: Enable 3-bit PAD_OWN feature Starting from revision 1.1 of the Chassis specification the PAD_OWN is represented by 3 bits instead of 2 bits in the previous revisions. Update the driver to support this feature. Signed-off-by: Andy Shevchenko commit a4337a24d13e9e3b98a113e71d6b80dc5ed5f8c4 Author: Andy Shevchenko Date: Wed Mar 11 18:14:04 2026 +0100 pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) The 1kOhm pull down and hardware debouncer are features of the revision 0.92 of the Chassis specification. Fix that in the code accordingly. Signed-off-by: Andy Shevchenko commit 340bba73c545bfc7e8fcbc5ee4c02f85088f024d Author: Andy Shevchenko Date: Wed Mar 11 20:30:25 2026 +0100 pinctrl: intel: Improve capability support The register space of a certain capability starts at the offset just after the respective node in the capability list. It means that there are no fixed offsets for them from SoC to SoC generation and they have to be calculated at run-time. Improve capability support by adding the respective calculation algorithm and in the result enable PWM on more platforms that currently may use the wrong register. Signed-off-by: Andy Shevchenko commit a343fb1e03cfc9f6dc83a5efb2a8d33e9cdaf6b9 Author: Konrad Dybcio Date: Tue Mar 17 15:14:40 2026 +0100 soc: qcom: pmic_glink_altmode: Fix TBT->SAFE->!TBT transition Similar to the case of commit d48708500610 ("soc: qcom: pmic_glink_altmode: Fix SVID=DP && unconnected edge case"), leaving the TBT altmode makes pmic_glink_altmode report a SVID=TBT && mux_ctrl=0 message. Said commit reordered the check such that the SVID is processed before checking for NO_CONN. Rework this to take into account valid values of mux_ctrl first and hopefully solve this for good.. Fixes: d48708500610 ("soc: qcom: pmic_glink_altmode: Fix SVID=DP && unconnected edge case") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260317-topic-tbt_pg_fixup-v1-1-325b8647bc82@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7c46bd845d89ad4772573cfe0f2a56b93db75cc7 Merge: 605b52497bf89b d5ad6ab61cbd89 Author: Jakub Kicinski Date: Wed Mar 18 19:25:40 2026 -0700 Merge tag 'wireless-2026-03-18' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just a few updates: - cfg80211: - guarantee pmsr work is cancelled - mac80211: - reject TDLS operations on non-TDLS stations - fix crash in AP_VLAN bandwidth change - fix leak or double-free on some TX preparation failures - remove keys needed for beacons _after_ stopping those - fix debugfs static branch race - avoid underflow in inactive time - fix another NULL dereference in mesh on invalid frames - ti/wlcore: avoid infinite realloc loop * tag 'wireless-2026-03-18' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom wifi: mac80211: fix NULL deref in mesh_matches_local() wifi: mac80211: check tdls flag in ieee80211_tdls_oper wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times wifi: mac80211: remove keys after disabling beaconing wifi: mac80211_hwsim: fully initialise PMSR capabilities ==================== Link: https://patch.msgid.link/20260318172515.381148-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 605b52497bf89b3b154674deb135da98f916e390 Author: Xiang Mei Date: Mon Mar 16 17:50:34 2026 -0700 net: bonding: fix NULL deref in bond_debug_rlb_hash_show rlb_clear_slave intentionally keeps RLB hash-table entries on the rx_hashtbl_used_head list with slave set to NULL when no replacement slave is available. However, bond_debug_rlb_hash_show visites client_info->slave without checking if it's NULL. Other used-list iterators in bond_alb.c already handle this NULL-slave state safely: - rlb_update_client returns early on !client_info->slave - rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance compare slave values before visiting - lb_req_update_subnet_clients continues if slave is NULL The following NULL deref crash can be trigger in bond_debug_rlb_hash_show: [ 1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41) [ 1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286 [ 1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204 [ 1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078 [ 1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000 [ 1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0 [ 1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8 [ 1.294864] FS: 0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000 [ 1.295239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0 [ 1.295897] Call Trace: [ 1.296134] seq_read_iter (fs/seq_file.c:231) [ 1.296341] seq_read (fs/seq_file.c:164) [ 1.296493] full_proxy_read (fs/debugfs/file.c:378 (discriminator 1)) [ 1.296658] vfs_read (fs/read_write.c:572) [ 1.296981] ksys_read (fs/read_write.c:717) [ 1.297132] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 1.297325] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Add a NULL check and print "(none)" for entries with no assigned slave. Fixes: caafa84251b88 ("bonding: add the debugfs interface to see RLB hash table") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Link: https://patch.msgid.link/20260317005034.1888794-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski commit b3a6df291fecf5f8a308953b65ca72b7fc9e015d Author: Xiang Mei Date: Mon Mar 16 18:02:41 2026 -0700 udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0 (success) without actually creating a socket. Callers such as fou_create() then proceed to dereference the uninitialized socket pointer, resulting in a NULL pointer dereference. The captured NULL deref crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764) [...] Call Trace: genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209) [...] netlink_rcv_skb (net/netlink/af_netlink.c:2550) genl_rcv (net/netlink/genetlink.c:1219) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1)) __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1)) __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130) This patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so callers correctly take their error paths. There is only one caller of the vulnerable function and only privileged users can trigger it. Fixes: fd384412e199b ("udp_tunnel: Seperate ipv6 functions into its own file.") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Link: https://patch.msgid.link/20260317010241.1893893-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski commit 6d43a9f6a1727f45fbc5b518a20250ebfec707f3 Merge: d0f9eca219e6e4 beb6e2e5976a12 Author: Jakub Kicinski Date: Wed Mar 18 17:54:58 2026 -0700 Merge branch 'mlx5-misc-fixes-2026-03-16' Tariq Toukan says: ==================== mlx5 misc fixes 2026-03-16 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/20260316094603.6999-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit beb6e2e5976a128b0cccf10d158124422210c5ef Author: Jianbo Liu Date: Mon Mar 16 11:46:03 2026 +0200 net/mlx5e: Fix race condition during IPSec ESN update In IPSec full offload mode, the device reports an ESN (Extended Sequence Number) wrap event to the driver. The driver validates this event by querying the IPSec ASO and checking that the esn_event_arm field is 0x0, which indicates an event has occurred. After handling the event, the driver must re-arm the context by setting esn_event_arm back to 0x1. A race condition exists in this handling path. After validating the event, the driver calls mlx5_accel_esp_modify_xfrm() to update the kernel's xfrm state. This function temporarily releases and re-acquires the xfrm state lock. So, need to acknowledge the event first by setting esn_event_arm to 0x1. This prevents the driver from reprocessing the same ESN update if the hardware sends events for other reason. Since the next ESN update only occurs after nearly 2^31 packets are received, there's no risk of missing an update, as it will happen long after this handling has finished. Processing the event twice causes the ESN high-order bits (esn_msb) to be incremented incorrectly. The driver then programs the hardware with this invalid ESN state, which leads to anti-replay failures and a complete halt of IPSec traffic. Fix this by re-arming the ESN event immediately after it is validated, before calling mlx5_accel_esp_modify_xfrm(). This ensures that any spurious, duplicate events are correctly ignored, closing the race window. Fixes: fef06678931f ("net/mlx5e: Fix ESN update kernel panic") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260316094603.6999-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 99b36850d881e2d65912b2520a1c80d0fcc9429a Author: Jianbo Liu Date: Mon Mar 16 11:46:02 2026 +0200 net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso struct for each PF, which contains a shared DMA-mapped context for all ASO operations. A race condition exists because the ASO spinlock is released before the hardware has finished processing WQE. If a second operation is initiated immediately after, it overwrites the shared context in the DMA area. When the first operation's completion is processed later, it reads this corrupted context, leading to unexpected behavior and incorrect results. This commit fixes the race by introducing a private context within each IPSec offload object. The shared ASO context is now copied to this private context while the ASO spinlock is held. Subsequent processing uses this saved, per-object context, ensuring its integrity is maintained. Fixes: 1ed78fc03307 ("net/mlx5e: Update IPsec soft and hard limits") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260316094603.6999-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit b7e3a5d9c0d66b7fb44f63aef3bd734821afa0c8 Author: Cosmin Ratiu Date: Mon Mar 16 11:46:01 2026 +0200 net/mlx5: qos: Restrict RTNL area to avoid a lock cycle A lock dependency cycle exists where: 1. mlx5_ib_roce_init -> mlx5_core_uplink_netdev_event_replay -> mlx5_blocking_notifier_call_chain (takes notifier_rwsem) -> mlx5e_mdev_notifier_event -> mlx5_netdev_notifier_register -> register_netdevice_notifier_dev_net (takes rtnl) => notifier_rwsem -> rtnl 2. mlx5e_probe -> _mlx5e_probe -> mlx5_core_uplink_netdev_set (takes uplink_netdev_lock) -> mlx5_blocking_notifier_call_chain (takes notifier_rwsem) => uplink_netdev_lock -> notifier_rwsem 3: devlink_nl_rate_set_doit -> devlink_nl_rate_set -> mlx5_esw_devlink_rate_leaf_tx_max_set -> esw_qos_devlink_rate_to_mbps -> mlx5_esw_qos_max_link_speed_get (takes rtnl) -> mlx5_esw_qos_lag_link_speed_get_locked -> mlx5_uplink_netdev_get (takes uplink_netdev_lock) => rtnl -> uplink_netdev_lock => BOOM! (lock cycle) Fix that by restricting the rtnl-protected section to just the necessary part, the call to netdev_master_upper_dev_get and speed querying, so that the last lock dependency is avoided and the cycle doesn't close. This is safe because mlx5_uplink_netdev_get uses netdev_hold to keep the uplink netdev alive while its master device is queried. Use this opportunity to rename the ambiguously-named "hold_rtnl_lock" argument to "take_rtnl" and remove the "_locked" suffix from mlx5_esw_qos_lag_link_speed_get_locked. Fixes: 6b4be64fd9fe ("net/mlx5e: Harden uplink netdev access against device unbind") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260316094603.6999-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d0f9eca219e6e46f1cf76fc28ae3f753b2b3ecd4 Merge: cf2ce96c7150f9 0d4aef630be9d5 Author: Jakub Kicinski Date: Wed Mar 18 17:41:00 2026 -0700 Merge tag 'batadv-net-pullrequest-20260317' of https://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - avoid OGM aggregation when skb tailroom is insufficient, by Yang Yang * tag 'batadv-net-pullrequest-20260317' of https://git.open-mesh.org/linux-merge: batman-adv: avoid OGM aggregation when skb tailroom is insufficient ==================== Link: https://patch.msgid.link/20260317160002.1869478-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit cf2ce96c7150f9997fc87281600c3de7f20311bd Merge: 06413793526251 6850deb6111834 Author: Jakub Kicinski Date: Wed Mar 18 17:38:15 2026 -0700 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-03-17 (igc, iavf, libie) Kohei Enju adds use of helper function to add missing update of skb->tail when padding is needed for igc. Zdenek Bouska clears stale XSK timestamps when taking down Tx rings on igc. Petr Oros changes handling of iavf VLAN filter handling when an added VLAN is also on the delete list to which can race and cause the VLAN filter to not be added. Michal frees cmd_buf for libie firmware logging to stop memory leaks. * '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: libie: prevent memleak in fwlog code iavf: fix VLAN filter lost on add/delete race igc: fix page fault in XDP TX timestamps handling igc: fix missing update of skb->tail in igc_xmit_frame() ==================== Link: https://patch.msgid.link/20260317211906.115505-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 146bd2a87a65aa407bb17fac70d8d583d19aba06 Author: Kumar Kartikeya Dwivedi Date: Thu Mar 12 13:53:07 2026 -0700 bpf: Release module BTF IDR before module unload Gregory reported in [0] that the global_map_resize test when run in repeatedly ends up failing during program load. This stems from the fact that BTF reference has not dropped to zero after the previous run's module is unloaded, and the older module's BTF is still discoverable and visible. Later, in libbpf, load_module_btfs() will find the ID for this stale BTF, open its fd, and then it will be used during program load where later steps taking module reference using btf_try_get_module() fail since the underlying module for the BTF is gone. Logically, once a module is unloaded, it's associated BTF artifacts should become hidden. The BTF object inside the kernel may still remain alive as long its reference counts are alive, but it should no longer be discoverable. To fix this, let us call btf_free_id() from the MODULE_STATE_GOING case for the module unload to free the BTF associated IDR entry, and disable its discovery once module unload returns to user space. If a race happens during unload, the outcome is non-deterministic anyway. However, user space should be able to rely on the guarantee that once it has synchronously established a successful module unload, no more stale artifacts associated with this module can be obtained subsequently. Note that we must be careful to not invoke btf_free_id() in btf_put() when btf_is_module() is true now. There could be a window where the module unload drops a non-terminal reference, frees the IDR, but the same ID gets reused and the second unconditional btf_free_id() ends up releasing an unrelated entry. To avoid a special case for btf_is_module() case, set btf->id to zero to make btf_free_id() idempotent, such that we can unconditionally invoke it from btf_put(), and also from the MODULE_STATE_GOING case. Since zero is an invalid IDR, the idr_remove() should be a noop. Note that we can be sure that by the time we reach final btf_put() for btf_is_module() case, the btf_free_id() is already done, since the module itself holds the BTF reference, and it will call this function for the BTF before dropping its own reference. [0]: https://lore.kernel.org/bpf/cover.1773170190.git.grbell@redhat.com Fixes: 36e68442d1af ("bpf: Load and verify kernel module BTFs") Acked-by: Martin KaFai Lau Suggested-by: Martin KaFai Lau Reported-by: Gregory Bell Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260312205307.1346991-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 06413793526251870e20402c39930804f14d59c0 Author: Minhong He Date: Mon Mar 16 15:33:01 2026 +0800 ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL pointer dereferences. Fixes: 1ababeba4a21 ("ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)") Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") Signed-off-by: Minhong He Reviewed-by: Andrea Mayer Link: https://patch.msgid.link/20260316073301.106643-1-heminhong@kylinos.cn Signed-off-by: Jakub Kicinski commit 55dc632ab2ac2889b15995a9eef56c753d48ebc7 Author: Ian Ray Date: Tue Mar 17 10:53:36 2026 +0200 NFC: nxp-nci: allow GPIOs to sleep Allow the firmware and enable GPIOs to sleep. This fixes a `WARN_ON' and allows the driver to operate GPIOs which are connected to I2C GPIO expanders. -- >8 -- kernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98 -- >8 -- Fixes: 43201767b44c ("NFC: nxp-nci: Convert to use GPIO descriptor") Cc: stable@vger.kernel.org Signed-off-by: Ian Ray Link: https://patch.msgid.link/20260317085337.146545-1-ian.ray@gehealthcare.com Signed-off-by: Jakub Kicinski commit 34b11cc56e4369bc08b1f4c4a04222d75ed596ce Author: Fedor Pchelkin Date: Mon Mar 16 13:38:25 2026 +0300 net: macb: fix uninitialized rx_fs_lock If hardware doesn't support RX Flow Filters, rx_fs_lock spinlock is not initialized leading to the following assertion splat triggerable via set_rxnfc callback. INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 1 PID: 949 Comm: syz.0.6 Not tainted 6.1.164+ #113 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106 assign_lock_key kernel/locking/lockdep.c:974 [inline] register_lock_class+0x141b/0x17f0 kernel/locking/lockdep.c:1287 __lock_acquire+0x74f/0x6c40 kernel/locking/lockdep.c:4928 lock_acquire kernel/locking/lockdep.c:5662 [inline] lock_acquire+0x190/0x4b0 kernel/locking/lockdep.c:5627 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x33/0x50 kernel/locking/spinlock.c:162 gem_del_flow_filter drivers/net/ethernet/cadence/macb_main.c:3562 [inline] gem_set_rxnfc+0x533/0xac0 drivers/net/ethernet/cadence/macb_main.c:3667 ethtool_set_rxnfc+0x18c/0x280 net/ethtool/ioctl.c:961 __dev_ethtool net/ethtool/ioctl.c:2956 [inline] dev_ethtool+0x229c/0x6290 net/ethtool/ioctl.c:3095 dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510 sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215 sock_ioctl+0x577/0x6d0 net/socket.c:1320 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 A more straightforward solution would be to always initialize rx_fs_lock, just like rx_fs_list. However, in this case the driver set_rxnfc callback would return with a rather confusing error code, e.g. -EINVAL. So deny set_rxnfc attempts directly if the RX filtering feature is not supported by hardware. Fixes: ae8223de3df5 ("net: macb: Added support for RX filtering") Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20260316103826.74506-2-pchelkin@ispras.ru Signed-off-by: Jakub Kicinski commit 8da13e6d63c1a97f7302d342c89c4a56a55c7015 Author: Fedor Pchelkin Date: Mon Mar 16 13:38:24 2026 +0300 net: macb: fix use-after-free access to PTP clock PTP clock is registered on every opening of the interface and destroyed on every closing. However it may be accessed via get_ts_info ethtool call which is possible while the interface is just present in the kernel. BUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426 Read of size 4 at addr ffff8880194345cc by task syz.0.6/948 CPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x17f/0x496 mm/kasan/report.c:420 kasan_report+0xd9/0x180 mm/kasan/report.c:524 ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426 gem_get_ts_info+0x138/0x1e0 drivers/net/ethernet/cadence/macb_main.c:3349 macb_get_ts_info+0x68/0xb0 drivers/net/ethernet/cadence/macb_main.c:3371 __ethtool_get_ts_info+0x17c/0x260 net/ethtool/common.c:558 ethtool_get_ts_info net/ethtool/ioctl.c:2367 [inline] __dev_ethtool net/ethtool/ioctl.c:3017 [inline] dev_ethtool+0x2b05/0x6290 net/ethtool/ioctl.c:3095 dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510 sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215 sock_ioctl+0x577/0x6d0 net/socket.c:1320 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Allocated by task 457: kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:699 [inline] ptp_clock_register+0x144/0x10e0 drivers/ptp/ptp_clock.c:235 gem_ptp_init+0x46f/0x930 drivers/net/ethernet/cadence/macb_ptp.c:375 macb_open+0x901/0xd10 drivers/net/ethernet/cadence/macb_main.c:2920 __dev_open+0x2ce/0x500 net/core/dev.c:1501 __dev_change_flags+0x56a/0x740 net/core/dev.c:8651 dev_change_flags+0x92/0x170 net/core/dev.c:8722 do_setlink+0xaf8/0x3a80 net/core/rtnetlink.c:2833 __rtnl_newlink+0xbf4/0x1940 net/core/rtnetlink.c:3608 rtnl_newlink+0x63/0xa0 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x3c6/0xed0 net/core/rtnetlink.c:6150 netlink_rcv_skb+0x15d/0x430 net/netlink/af_netlink.c:2511 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x6d7/0xa30 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x97e/0xeb0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x14b/0x180 net/socket.c:730 __sys_sendto+0x320/0x3b0 net/socket.c:2152 __do_sys_sendto net/socket.c:2164 [inline] __se_sys_sendto net/socket.c:2160 [inline] __x64_sys_sendto+0xdc/0x1b0 net/socket.c:2160 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 938: kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1729 [inline] slab_free_freelist_hook mm/slub.c:1755 [inline] slab_free mm/slub.c:3687 [inline] __kmem_cache_free+0xbc/0x320 mm/slub.c:3700 device_release+0xa0/0x240 drivers/base/core.c:2507 kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1cd/0x350 lib/kobject.c:729 put_device+0x1b/0x30 drivers/base/core.c:3805 ptp_clock_unregister+0x171/0x270 drivers/ptp/ptp_clock.c:391 gem_ptp_remove+0x4e/0x1f0 drivers/net/ethernet/cadence/macb_ptp.c:404 macb_close+0x1c8/0x270 drivers/net/ethernet/cadence/macb_main.c:2966 __dev_close_many+0x1b9/0x310 net/core/dev.c:1585 __dev_close net/core/dev.c:1597 [inline] __dev_change_flags+0x2bb/0x740 net/core/dev.c:8649 dev_change_flags+0x92/0x170 net/core/dev.c:8722 dev_ifsioc+0x151/0xe00 net/core/dev_ioctl.c:326 dev_ioctl+0x33e/0x1070 net/core/dev_ioctl.c:572 sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215 sock_ioctl+0x577/0x6d0 net/socket.c:1320 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Set the PTP clock pointer to NULL after unregistering. Fixes: c2594d804d5c ("macb: Common code to enable ptp support for MACB/GEM") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20260316103826.74506-1-pchelkin@ispras.ru Signed-off-by: Jakub Kicinski commit 7d9351435ebba08bbb60f42793175c9dc714d2fb Author: Wesley Atwell Date: Tue Mar 17 00:14:31 2026 -0600 netdevsim: drop PSP ext ref on forward failure nsim_do_psp() takes an extra reference to the PSP skb extension so the extension survives __dev_forward_skb(). That forward path scrubs the skb and drops attached skb extensions before nsim_psp_handle_ext() can reattach the PSP metadata. If __dev_forward_skb() fails in nsim_forward_skb(), the function returns before nsim_psp_handle_ext() can attach that extension to the skb, leaving the extra reference leaked. Drop the saved PSP extension reference before returning from the forward-failure path. Guard the put because plain or non-decapsulated traffic can also fail forwarding without ever taking the extra PSP reference. Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation") Signed-off-by: Wesley Atwell Reviewed-by: Daniel Zahka Link: https://patch.msgid.link/20260317061431.1482716-1-atwellwea@gmail.com Signed-off-by: Jakub Kicinski commit 3b2c2ab4ceb82af484310c3087541eab00ea288b Author: Josh Law Date: Thu Mar 19 08:43:06 2026 +0900 tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure If fstat() fails after open() succeeds, the function returns without closing the file descriptor. Also preserve errno across close(), since close() may overwrite it before the error is returned. Link: https://lore.kernel.org/all/20260318155847.78065-3-objecting@objecting.org/ Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command") Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit bb288d7d869e86d382f35a0e26242c5ccb05ca82 Author: Josh Law Date: Thu Mar 19 08:43:05 2026 +0900 lib/bootconfig: check xbc_init_node() return in override path The ':=' override path in xbc_parse_kv() calls xbc_init_node() to re-initialize an existing value node but does not check the return value. If xbc_init_node() fails (data offset out of range), parsing silently continues with stale node data. Add the missing error check to match the xbc_add_node() call path which already checks for failure. In practice, a bootconfig using ':=' to override a value near the 32KB data limit could silently retain the old value, meaning a security-relevant boot parameter override (e.g., a trace filter or debug setting) would not take effect as intended. Link: https://lore.kernel.org/all/20260318155847.78065-2-objecting@objecting.org/ Fixes: e5efaeb8a8f5 ("bootconfig: Support mixing a value and subkeys under a key") Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 1863b4055b7902de43a1dcc7396805eb631682e5 Merge: 8a30aeb0d1b4e4 d5b66179b0e27c Author: Linus Torvalds Date: Wed Mar 18 15:50:29 2026 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: - Disable the "padlock" SHA-1 and SHA-256 driver on Zhaoxin processors, since it does not compute hash values correctly - Make a generated file be removed by 'make clean' - Fix excessive stack usage in some of the arm64 AES code * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: powerpc: Add powerpc/aesp8-ppc.S to clean-files crypto: padlock-sha - Disable for Zhaoxin processor crypto: arm64/aes-neonbs - Move key expansion off the stack commit 201bc182ad6333468013f1af0719ffe125826b6a Author: William Roche Date: Tue Mar 17 10:38:10 2026 +0000 x86/mce/amd: Check SMCA feature bit before accessing SMCA MSRs People do effort to inject MCEs into guests in order to simulate/test handling of hardware errors. The real use case behind it is testing the handling of SIGBUS which the memory failure code sends to the process. If that process is QEMU, instead of killing the whole guest, the MCE can be injected into the guest kernel so that latter can attempt proper handling and kill the user *process* in the guest, instead, which caused the MCE. The assumption being here that the whole injection flow can supply enough information that the guest kernel can pinpoint the right process. But that's a different topic... Regardless of virtualization or not, access to SMCA-specific registers like MCA_DESTAT should only be done after having checked the smca feature bit. And there are AMD machines like Bulldozer (the one before Zen1) which do support deferred errors but are not SMCA machines. Therefore, properly check the feature bit before accessing related MSRs. [ bp: Rewrite commit message. ] Fixes: 7cb735d7c0cb ("x86/mce: Unify AMD DFR handler with MCA Polling") Signed-off-by: William Roche Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Yazen Ghannam Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260218163025.1316501-1-william.roche@oracle.com commit 8a30aeb0d1b4e4aaf7f7bae72f20f2ae75385ccb Merge: 04a9f176695468 5133b61aaf437e Author: Linus Torvalds Date: Wed Mar 18 14:27:11 2026 -0700 Merge tag 'nfsd-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Fix cache_request leak in cache_release() - Fix heap overflow in the NFSv4.0 LOCK replay cache - Hold net reference for the lifetime of /proc/fs/nfs/exports fd - Defer sub-object cleanup in export "put" callbacks * tag 'nfsd-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache sunrpc: fix cache_request leak in cache_release NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd NFSD: Defer sub-object cleanup in export put callbacks commit 86259558e422b250aa6aa57163a6d759074573f5 Author: Sanman Pradhan Date: Wed Mar 18 19:40:19 2026 +0000 hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() isl68137_avs_enable_show_page() uses the return value of pmbus_read_byte_data() without checking for errors. If the I2C transaction fails, a negative error code is passed through bitwise operations, producing incorrect output. Add an error check to propagate the return value if it is negative. Additionally, modernize the callback by replacing sprintf() with sysfs_emit(). Fixes: 038a9c3d1e424 ("hwmon: (pmbus/isl68137) Add driver for Intersil ISL68137 PWM Controller") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260318193952.47908-2-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit cdbefe9d4029d4834d404f7ba13a960b38a69e88 Author: Artem Bityutskiy Date: Wed Mar 11 11:00:34 2026 +0200 tools/power turbostat: Fix delimiter bug in print functions Commands that add counters, such as 'turbostat --show C1,C1+' display merged columns without a delimiter. This is caused by the bad syntax: '(*printed++ ? delim : "")', shared by print_name()/print_hex_value()/print_decimal_value()/print_float_value() Use '((*printed)++ ? delim : "")' to correctly increment the value at *printed. [lenb: fix code and commit message typo, re-word] Fixes: 56dbb878507b ("tools/power turbostat: Refactor added column header printing") Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit c4192754e836e0ffed95833509b6ada975b74418 Author: Kees Cook Date: Wed Mar 18 11:36:29 2026 -0700 fs/tests: exec: Remove bad test vector Drop an unusable test in the bprm stack limits. Reported-by: Guenter Roeck Closes: https://lore.kernel.org/all/a3e9b1c2-40c1-45df-9fa2-14ee6a7b3fe2@roeck-us.net Fixes: 60371f43e56b ("exec: Add KUnit test for bprm_stack_limits()") Signed-off-by: Kees Cook commit f8e478e3af57e603c7f1d4f9dba6d8948b8c32c1 Merge: 563d39928db602 04a9f176695468 Author: Arnaldo Carvalho de Melo Date: Wed Mar 18 15:04:13 2026 -0300 Merge remote-tracking branch 'torvalds/master' into perf-tools To pick up some extra files that need to be sync'ed with the kernel sources to try and reduce the number of PRs. Signed-off-by: Arnaldo Carvalho de Melo commit b826d2c0b0ecb844c84431ba6b502e744f5d919a Author: Maíra Canal Date: Tue Mar 17 19:41:49 2026 -0300 pmdomain: bcm: bcm2835-power: Increase ASB control timeout The bcm2835_asb_control() function uses a tight polling loop to wait for the ASB bridge to acknowledge a request. During intensive workloads, this handshake intermittently fails for V3D's master ASB on BCM2711, resulting in "Failed to disable ASB master for v3d" errors during runtime PM suspend. As a consequence, the failed power-off leaves V3D in a broken state, leading to bus faults or system hangs on later accesses. As the timeout is insufficient in some scenarios, increase the polling timeout from 1us to 5us, which is still negligible in the context of a power domain transition. Also, replace the open-coded ktime_get_ns()/ cpu_relax() polling loop with readl_poll_timeout_atomic(). Cc: stable@vger.kernel.org Fixes: 670c672608a1 ("soc: bcm: bcm2835-pm: Add support for power domains under a new binding.") Signed-off-by: Maíra Canal Reviewed-by: Stefan Wahren Signed-off-by: Ulf Hansson commit b9465b04de4b90228de03db9a1e0d56b00814366 Author: Olivier Sobrie Date: Tue Mar 17 18:18:07 2026 +0100 mtd: rawnand: pl353: make sure optimal timings are applied Timings of the nand are adjusted by pl35x_nfc_setup_interface() but actually applied by the pl35x_nand_select_target() function. If there is only one nand chip, the pl35x_nand_select_target() will only apply the timings once since the test at its beginning will always be true after the first call to this function. As a result, the hardware will keep using the default timings set at boot to detect the nand chip, not the optimal ones. With this patch, we program directly the new timings when pl35x_nfc_setup_interface() is called. Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller") Signed-off-by: Olivier Sobrie Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal commit 16dec014db0f4ac6f8090dea0bdfcb1ecebc12ca Author: Miquel Raynal Date: Tue Mar 17 18:17:22 2026 +0100 mtd: spi-nor: Rename spi_nor_spimem_check_op() This helper really is just a little helper for internal purposes, and is I/O operation oriented, despite its name. It has already been misused in commit 5008c3ec3f89 ("mtd: spi-nor: core: Check read CR support"), so rename it to clarify its purpose: it is only useful for reads and page programs. Signed-off-by: Miquel Raynal commit ac512cd351f7e4ab4569f6a52c116f4ab3a239cc Author: Miquel Raynal Date: Tue Mar 17 11:18:42 2026 +0100 mtd: spi-nor: Fix RDCR controller capability core check Commit 5008c3ec3f89 ("mtd: spi-nor: core: Check read CR support") adds a controller check to make sure the core will not use CR reads on controllers not supporting them. The approach is valid but the fix is incorrect. Unfortunately, the author could not catch it, because the expected behavior was met. The patch indeed drops the RDCR capability, but it does it for all controllers! The issue comes from the use of spi_nor_spimem_check_op() which is an internal helper dedicated to check read/write operations only, despite its generic name. This helper looks for the biggest number of address bytes that can be used for a page operation and tries 4 then 3. It then calls the usual spi-mem helpers to do the checks. These will always fail because there is now an inconsistency: the address cycles are forced to 4 (then 3) bytes, but the bus width during the address cycles rightfully remains 0. There is a non-zero address length but a zero address bus width, which is an invalid combination. The correct check in this case is to directly call spi_mem_supports_op() which doesn't messes up with the operation content. Fixes: 5008c3ec3f89 ("mtd: spi-nor: core: Check read CR support") Cc: stable@vger.kernel.org Acked-by: Tudor Ambarus Acked-by: Takahiro Kuwano Reviewed-by: Pratyush Yadav Signed-off-by: Miquel Raynal commit c23df30915f83e7257c8625b690a1cece94142a0 Author: Jiucheng Xu Date: Wed Mar 11 17:11:31 2026 +0800 erofs: add GFP_NOIO in the bio completion if needed The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencies, which can then call vm_map_ram() with GFP_KERNEL. Due to insufficient memory, vm_map_ram() may generate memory swapping I/O, which can cause submit_bio_wait to deadlock in some scenarios. Trimmed down the call stack, as follows: f2fs_submit_read_io submit_bio //bio_list is initialized. mmc_blk_mq_recovery z_erofs_endio vm_map_ram __pte_alloc_kernel __alloc_pages_direct_reclaim shrink_folio_list __swap_writepage submit_bio_wait //bio_list is non-NULL, hang!!! Use memalloc_noio_{save,restore}() to wrap up this path. Reviewed-by: Gao Xiang Signed-off-by: Jiucheng Xu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit c0e296f257671ba10249630fe58026f29e4804d9 Author: Stanislav Kinsburskii Date: Tue Mar 17 15:04:55 2026 +0000 mshv: Fix error handling in mshv_region_pin The current error handling has two issues: First, pin_user_pages_fast() can return a short pin count (less than requested but greater than zero) when it cannot pin all requested pages. This is treated as success, leading to partially pinned regions being used, which causes memory corruption. Second, when an error occurs mid-loop, already pinned pages from the current batch are not properly accounted for before calling mshv_region_invalidate_pages(), causing a page reference leak. Treat short pins as errors and fix partial batch accounting before cleanup. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 591721223be9e28f83489a59289579493b8e3d83 Author: Arnd Bergmann Date: Wed Mar 18 13:40:07 2026 +0100 ALSA: asihpi: avoid write overflow check warning clang-22 rightfully warns that the memcpy() in adapter_prepare() copies between different structures, crossing the boundary of nested structures inside it: In file included from sound/pci/asihpi/hpimsgx.c:13: In file included from include/linux/string.h:386: include/linux/fortify-string.h:569:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] 569 | __write_overflow_field(p_size_field, size); The two structures seem to refer to the same layout, despite the separate definitions, so the code is in fact correct. Avoid the warning by copying the two inner structures separately. I see the same pattern happens in other functions in the same file, so there is a chance that this may come back in the future, but this instance is the only one that I saw in practice, hitting it multiple times per day in randconfig build. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260318124016.3488566-1-arnd@kernel.org Signed-off-by: Takashi Iwai commit 9a6a2091324ab6525951651b3700e3bea0fe9a89 Author: Davidlohr Bueso Date: Sun Mar 1 14:17:39 2026 -0800 cxl/mbox: Use proper endpoint validity check upon sanitize Fuzzying CXL triggered: BUG: KASAN: null-ptr-deref in cxl_num_decoders_committed+0x3e/0x80 drivers/cxl/core/port.c:49 Read of size 4 at addr 0000000000000642 by task syz.0.97/2282 CPU: 2 UID: 0 PID: 2282 Comm: syz.0.97 Not tainted 7.0.0-rc1-gebd11be59f74-dirty #494 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 kasan_report+0xe0/0x110 mm/kasan/report.c:595 cxl_num_decoders_committed+0x3e/0x80 drivers/cxl/core/port.c:49 cxl_mem_sanitize+0x141/0x170 drivers/cxl/core/mbox.c:1304 security_sanitize_store+0xb0/0x120 drivers/cxl/core/memdev.c:173 dev_attr_store+0x46/0x70 drivers/base/core.c:2437 sysfs_kf_write+0x95/0xb0 fs/sysfs/file.c:142 kernfs_fop_write_iter+0x276/0x330 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x5df/0xaa0 fs/read_write.c:688 ksys_write+0x103/0x1f0 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x111/0x680 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f60a584ba79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f60a42a7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f60a5ab5fa0 RCX: 00007f60a584ba79 RDX: 0000000000000002 RSI: 00002000000001c0 RDI: 0000000000000003 RBP: 00007f60a58a49df R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f60a5ab6038 R14: 00007f60a5ab5fa0 R15: 00007ffe58fad8b8 This goes away using the correct check instead of abusing cxlmd->endpoint, which is unusable (ENXIO) until the driver has probed. During that window the memdev sysfs attributes are already visible, as soon as device_add() completes. Fixes: 29317f8dc6ed ("cxl/mem: Introduce cxl_memdev_attach for CXL-dependent operation") Signed-off-by: Davidlohr Bueso Reviewed-by: Jonathan Cameron Reviewed-by: Gregory Price Link: https://patch.msgid.link/20260301221739.1726722-1-dave@stgolabs.net Signed-off-by: Dave Jiang commit 04a9f1766954687f0a1b7a0f7184dc4f86edcb30 Merge: c5cb126c48e728 df3ef89d7ef818 Author: Linus Torvalds Date: Wed Mar 18 08:28:54 2026 -0700 Merge tag 'soc-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The firmware drivers for ARM SCMI, FF-A and the Tee subsystem, as well as the reset controller and cache controller subsystem all see small bugfixes for reference ounting errors, ABI correctness, and NULL pointer dereferences. Similarly, there are multiple reference counting fixes in drivers/soc/ for vendor specific drivers (rockchips, microchip), while the freescale drivers get a fix for a race condition and error handling. The devicetree fixes for Rockchips and NXP got held up, so for the moment there is only Renesas fixing problesm with SD card initialization, a boot hang on one board and incorrect descriptions for interrupts and clock registers on some SoCs. The Microchip polarfire gets a dts fix for a boot time warning. A defconfig fix avoids a warning about a conflicting assignment" * tag 'soc-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (21 commits) ARM: multi_v7_defconfig: Drop duplicate CONFIG_TI_PRUSS=m firmware: arm_scmi: Spelling s/mulit/multi/, s/currenly/currently/ firmware: arm_scmi: Fix NULL dereference on notify error path firmware: arm_scpi: Fix device_node reference leak in probe path firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap() arm64: dts: renesas: r8a78000: Fix out-of-range SPI interrupt numbers arm64: dts: renesas: rzg3s-smarc-som: Set bypass for Versa3 PLL2 arm64: dts: renesas: r9a09g087: Fix CPG register region sizes arm64: dts: renesas: r9a09g077: Fix CPG register region sizes arm64: dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes arm64: dts: renesas: rzv2-evk-cn15-sd: Add ramp delay for SD0 regulator arm64: dts: renesas: rzt2h-n2h-evk: Add ramp delay for SD0 card regulator tee: shm: Remove refcounting of kernel pages reset: rzg2l-usbphy-ctrl: Check pwrrdy is valid before using it soc: fsl: cpm1: qmc: Fix error check for devm_ioremap_resource() in qmc_qe_init_resources() soc: fsl: qbman: fix race condition in qman_destroy_fq soc: rockchip: grf: Add missing of_node_put() when returning cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() cache: starfive: fix device node leak in starlink_cache_init() riscv: dts: microchip: add can resets to mpfs ... commit f50200dd44125e445a6164e88c217472fa79cdbc Author: Sebastian Urban Date: Sun Mar 15 16:10:45 2026 +0100 usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer When a gadget request is only partially transferred in transfer() because the per-frame bandwidth budget is exhausted, the loop advances to the next queued request. If that next request is a zero-length packet (ZLP), len evaluates to zero and the code takes the unlikely(len == 0) path, which sets is_short = 1. This bypasses the bandwidth guard ("limit < ep->ep.maxpacket && limit < len") that lives in the else branch and would otherwise break out of the loop for non-zero requests. The is_short path then completes the URB before all data from the first request has been transferred. Reproducer (bulk IN, high speed): Device side (FunctionFS with Linux AIO): 1. Queue a 65024-byte write via io_submit (127 * 512, i.e. a multiple of the HS bulk max packet size). 2. Immediately queue a zero-length write (ZLP) via io_submit. Host side: 3. Submit a 65536-byte bulk IN URB. Expected: URB completes with actual_length = 65024. Actual: URB completes with actual_length = 53248, losing 11776 bytes that leak into subsequent URBs. At high speed the per-frame budget is 53248 bytes (512 * 13 * 8). The 65024-byte request exhausts this budget after 53248 bytes, leaving the request incomplete (req->req.actual < req->req.length). Neither the request nor the URB is finished, and rescan is 0, so the loop advances to the ZLP. For the ZLP, dev_len = 0, so len = min(12288, 0) = 0, taking the unlikely(len == 0) path and setting is_short = 1. The is_short handler then sets *status = 0, completing the URB with only 53248 of the expected 65024 bytes. Fix this by breaking out of the loop when the current request has remaining data (req->req.actual < req->req.length). The request resumes on the next timer tick, preserving correct data ordering. Signed-off-by: Sebastian Urban Cc: stable Reviewed-by: Alan Stern Link: https://patch.msgid.link/20260315151045.1155850-1-surban@surban.net Signed-off-by: Greg Kroah-Hartman commit 1a122198ee26d2f328edae802b2ca4fa0518a20a Author: Felix Gu Date: Mon Mar 16 23:30:06 2026 +0800 dwc3: google: Fix PM domain leak in dwc3_google_probe() When syscon_regmap_lookup_by_phandle_args() fails, the function was returning directly without cleaning up the power domain initialized earlier by dwc3_google_pm_domain_init(). Fix by jumping to err_deinit_pdom to properly clean up resources. Fixes: 8995a37371bf4 ("usb: dwc3: Add Google Tensor SoC DWC3 glue driver") Signed-off-by: Felix Gu Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260316-dwc3-google-v1-1-c9bde1b02f62@gmail.com Signed-off-by: Greg Kroah-Hartman commit f97e96c303d689708f7f713d8f3afcc31f1237e9 Author: Oliver Neukum Date: Tue Mar 17 09:41:10 2026 +0100 cdc-acm: new quirk for EPSON HMD This device has a union descriptor that is just garbage and needs a custom descriptor. In principle this could be done with a (conditionally activated) heuristic. That would match more devices without a need for defining a new quirk. However, this always carries the risk that the heuristics does the wrong thing and leads to more breakage. Defining the quirk and telling it exactly what to do is the safe and conservative approach. Signed-off-by: Oliver Neukum Cc: stable Link: https://patch.msgid.link/20260317084139.1461008-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit b2f6648c735639d246dc5f98f377b69d5374c2bd Author: Xu Yang Date: Mon Mar 16 17:48:11 2026 +0800 usb: hcd: queue wakeup_work to system_freezable_wq workqueue After commit 4fb352df14de ("PM: sleep: Do not flag runtime PM workqueue as freezable"), pm_wq workqueue will be unfreezable during system pm. This brings issue as below: [ 344.255749] ------------[ cut here ]------------ [ 344.277740] URB 000000004aae4ad1 submitted while active [ 344.282996] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x5a4/0x5e0, CPU#2: kworker/u16:14/964 [ 344.292477] Modules linked in: [ 344.295532] CPU: 2 UID: 0 PID: 964 Comm: kworker/u16:14 Not tainted 7.0.0-rc2-next-20260303-00006-gf03fe0b53b39-dirty #100 PREEMPT [ 344.307341] Hardware name: NXP i.MX943 EVK board (DT) [ 344.312386] Workqueue: async async_run_entry_fn [ 344.316919] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 344.323862] pc : usb_submit_urb+0x5a4/0x5e0 [ 344.328046] lr : usb_submit_urb+0x5a4/0x5e0 [ 344.332217] sp : ffff800083283b30 [ 344.335528] x29: ffff800083283b30 x28: ffff000082631000 x27: 0000000000000000 [ 344.342661] x26: 0000000000000003 x25: 0000000000000c00 x24: 0000000000000000 [ 344.349793] x23: 0000000000000004 x22: 0000000000000010 x21: 0000000000000000 [ 344.356917] x20: 0000000000000002 x19: ffff00008253ce40 x18: ffff000089e4eec0 [ 344.364050] x17: 000000040044ffff x16: 000005d9d87f6289 x15: 0000000000000000 [ 344.371174] x14: ffff000089e4eec0 x13: 6576697463612065 x12: 6c69687720646574 [ 344.378298] x11: 0000000000000058 x10: 0000000000000001 x9 : 0000000000000001 [ 344.385431] x8 : 0000000000000000 x7 : 0000005028dd0800 x6 : 0000000000000002 [ 344.392563] x5 : ffffc48f74e9daf8 x4 : 0000000000000000 x3 : 0000000000000000 [ 344.399696] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000089e4ee40 [ 344.406835] Call trace: [ 344.409280] usb_submit_urb+0x5a4/0x5e0 (P) [ 344.413456] hub_activate+0x268/0x878 [ 344.417116] hub_resume+0x5c/0x10c [ 344.420522] usb_resume_interface.isra.0+0xa8/0x110 [ 344.425393] usb_resume_both+0x10c/0x1e0 [ 344.429310] usb_resume+0x1c/0x70 [ 344.432621] usb_dev_resume+0x14/0x20 [ 344.436278] dpm_run_callback.isra.0+0x38/0xf8 [ 344.440715] device_resume+0xec/0x1e8 [ 344.444373] async_resume+0x20/0x38 [ 344.447848] async_run_entry_fn+0x34/0xe0 [ 344.451852] process_one_work+0x150/0x290 [ 344.455856] worker_thread+0x18c/0x300 [ 344.459600] kthread+0x118/0x124 [ 344.462824] ret_from_fork+0x10/0x20 The reason is if the host controller resume routine xhci_resume() call usb_hcd_resume_root_hub(), wakeup_work will be queued and run immediately. Then usb_autoresume_device() will be called and usb device will exit runtime suspended state (if it was suspended before). For a hub device, hub_resume()/hub_reset_resume() will be called accordingly. After the host controller device system resume is finished, the root hub usb device "usb1" will do system resume too. Then hub_resume() will be called again. Above sequence will cause hub->urb to be submitted twice. To avoid this issue, restore the previous behavior by queuing wakeup_work to system_freezable_wq workqueue. Acked-by: Alan Stern Fixes: 4fb352df14de ("PM: sleep: Do not flag runtime PM workqueue as freezable") Cc: stable Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260316094811.1559471-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit e002e92e88e12457373ed096b18716d97e7bbb20 Author: Kuen-Han Tsai Date: Mon Mar 16 15:49:09 2026 +0800 usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") reparents the gadget device to /sys/devices/virtual during unbind, clearing the gadget pointer. If the userspace tool queries on the surviving interface during this detached window, this leads to a NULL pointer dereference. Unable to handle kernel NULL pointer dereference Call trace: eth_get_drvinfo+0x50/0x90 ethtool_get_drvinfo+0x5c/0x1f0 __dev_ethtool+0xaec/0x1fe0 dev_ethtool+0x134/0x2e0 dev_ioctl+0x338/0x560 Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached, skip copying the fw_version and bus_info strings, which is natively handled by ethtool_get_drvinfo for empty strings. Suggested-by: Val Packett Reported-by: Val Packett Closes: https://lore.kernel.org/linux-usb/10890524-cf83-4a71-b879-93e2b2cc1fcc@packett.cool/ Fixes: ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260316-eth-null-deref-v1-1-07005f33be85@google.com Signed-off-by: Greg Kroah-Hartman commit 2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541 Author: Alan Stern Date: Sun Mar 15 14:31:00 2026 -0400 USB: dummy-hcd: Fix interrupt synchronization error This fixes an error in synchronization in the dummy-hcd driver. The error has a somewhat involved history. The synchronization mechanism was introduced by commit 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"), which added an emulated "interrupts enabled" flag together with code emulating synchronize_irq() (it waits until all current handler callbacks have returned). But the emulated interrupt-disable occurred too late, after the driver containing the handler callback routines had been told that it was unbound and no more callbacks would occur. Commit 4a5d797a9f9c ("usb: gadget: dummy_hcd: fix gpf in gadget_setup") tried to fix this by moving the synchronize_irq() emulation code from dummy_stop() to dummy_pullup(), which runs before the unbind callback. There still were races, though, because the emulated interrupt-disable still occurred too late. It couldn't be moved to dummy_pullup(), because that routine can be called for reasons other than an impending unbind. Therefore commits 7dc0c55e9f30 ("USB: UDC core: Add udc_async_callbacks gadget op") and 04145a03db9d ("USB: UDC: Implement udc_async_callbacks in dummy-hcd") added an API allowing the UDC core to tell dummy-hcd exactly when emulated interrupts and their callbacks should be disabled. That brings us to the current state of things, which is still wrong because the emulated synchronize_irq() occurs before the emulated interrupt-disable! That's no good, beause it means that more emulated interrupts can occur after the synchronize_irq() emulation has run, leading to the possibility that a callback handler may be running when the gadget driver is unbound. To fix this, we have to move the synchronize_irq() emulation code yet again, to the dummy_udc_async_callbacks() routine, which takes care of enabling and disabling emulated interrupt requests. The synchronization will now run immediately after emulated interrupts are disabled, which is where it belongs. Signed-off-by: Alan Stern Fixes: 04145a03db9d ("USB: UDC: Implement udc_async_callbacks in dummy-hcd") Cc: stable Link: https://patch.msgid.link/c7bc93fe-4241-4d04-bd56-27c12ba35c97@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 616a63ff495df12863692ab3f9f7b84e3fa7a66d Author: Alan Stern Date: Sun Mar 15 14:30:43 2026 -0400 USB: dummy-hcd: Fix locking/synchronization error Syzbot testing was able to provoke an addressing exception and crash in the usb_gadget_udc_reset() routine in drivers/usb/gadgets/udc/core.c, resulting from the fact that the routine was called with a second ("driver") argument of NULL. The bad caller was set_link_state() in dummy_hcd.c, and the problem arose because of a race between a USB reset and driver unbind. These sorts of races were not supposed to be possible; commit 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"), along with a few followup commits, was written specifically to prevent them. As it turns out, there are (at least) two errors remaining in the code. Another patch will address the second error; this one is concerned with the first. The error responsible for the syzbot crash occurred because the stop_activity() routine will sometimes drop and then re-acquire the dum->lock spinlock. A call to stop_activity() occurs in set_link_state() when handling an emulated USB reset, after the test of dum->ints_enabled and before the increment of dum->callback_usage. This allowed another thread (doing a driver unbind) to sneak in and grab the spinlock, and then clear dum->ints_enabled and dum->driver. Normally this other thread would have to wait for dum->callback_usage to go down to 0 before it would clear dum->driver, but in this case it didn't have to wait since dum->callback_usage had not yet been incremented. The fix is to increment dum->callback_usage _before_ calling stop_activity() instead of after. Then the thread doing the unbind will not clear dum->driver until after the call to usb_gadget_udc_reset() safely returns and dum->callback_usage has been decremented again. Signed-off-by: Alan Stern Reported-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/68fc7c9c.050a0220.346f24.023c.GAE@google.com/ Tested-by: syzbot+19bed92c97bee999e5db@syzkaller.appspotmail.com Fixes: 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change") Cc: stable Link: https://patch.msgid.link/46135f42-fdbe-46b5-aac0-6ca70492af15@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit d2d8c17ac01a1b1f638ea5d340a884ccc5015186 Author: Nathan Rebello Date: Fri Mar 13 18:24:53 2026 -0400 usb: typec: ucsi: validate connector number in ucsi_notify_common() The connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a 7-bit field (0-127) that is used to index into the connector array in ucsi_connector_change(). However, the array is only allocated for the number of connectors reported by the device (typically 2-4 entries). A malicious or malfunctioning device could report an out-of-range connector number in the CCI, causing an out-of-bounds array access in ucsi_connector_change(). Add a bounds check in ucsi_notify_common(), the central point where CCI is parsed after arriving from hardware, so that bogus connector numbers are rejected before they propagate further. Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API") Cc: stable Reviewed-by: Heikki Krogerus Signed-off-by: Nathan Rebello Link: https://patch.msgid.link/20260313222453.123-1-nathan.c.rebello@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8a768552f7a8276fb9e01d49773d2094ace7c8f1 Author: Heitor Alves de Siqueira Date: Thu Mar 12 09:27:28 2026 -0300 usb: usbtmc: Flush anchored URBs in usbtmc_release When calling usbtmc_release, pending anchored URBs must be flushed or killed to prevent use-after-free errors (e.g. in the HCD giveback path). Call usbtmc_draw_down() to allow anchored URBs to be completed. Fixes: 4f3c8d6eddc2 ("usb: usbtmc: Support Read Status Byte with SRQ per file") Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9a3c54f52bd1edbd975f Cc: stable Signed-off-by: Heitor Alves de Siqueira Link: https://patch.msgid.link/20260312-usbtmc-flush-release-v1-1-5755e9f4336f@igalia.com Signed-off-by: Greg Kroah-Hartman commit e1eabb072c75681f78312c484ccfffb7430f206e Author: Kuen-Han Tsai Date: Wed Mar 11 17:12:15 2026 +0800 usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop A race condition between gether_disconnect() and eth_stop() leads to a NULL pointer dereference. Specifically, if eth_stop() is triggered concurrently while gether_disconnect() is tearing down the endpoints, eth_stop() attempts to access the cleared endpoint descriptor, causing the following NPE: Unable to handle kernel NULL pointer dereference Call trace: __dwc3_gadget_ep_enable+0x60/0x788 dwc3_gadget_ep_enable+0x70/0xe4 usb_ep_enable+0x60/0x15c eth_stop+0xb8/0x108 Because eth_stop() crashes while holding the dev->lock, the thread running gether_disconnect() fails to acquire the same lock and spins forever, resulting in a hardlockup: Core - Debugging Information for Hardlockup core(7) Call trace: queued_spin_lock_slowpath+0x94/0x488 _raw_spin_lock+0x64/0x6c gether_disconnect+0x19c/0x1e8 ncm_set_alt+0x68/0x1a0 composite_setup+0x6a0/0xc50 The root cause is that the clearing of dev->port_usb in gether_disconnect() is delayed until the end of the function. Move the clearing of dev->port_usb to the very beginning of gether_disconnect() while holding dev->lock. This cuts off the link immediately, ensuring eth_stop() will see dev->port_usb as NULL and safely bail out. Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260311-gether-disconnect-npe-v1-1-454966adf7c7@google.com Signed-off-by: Greg Kroah-Hartman commit c5cb126c48e728aaf7f2ac209ef5506e47c2ad6a Merge: efa0adb5041591 5c52607c43c397 Author: Linus Torvalds Date: Wed Mar 18 08:11:46 2026 -0700 Merge tag 'v7.0-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Remove duplicate snp_leak_pages call in ccp * tag 'v7.0-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ccp - Fix leaking the same page twice commit efa0adb5041591a3bf63e30b36239e4537211222 Merge: a989fde763f4f2 c252c12d1f55bd Author: Linus Torvalds Date: Wed Mar 18 08:06:30 2026 -0700 Merge tag 'loongarch-fixes-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: - only use SC.Q when supported by the assembler to fix a build failure - fix calling smp_processor_id() in preemptible code - make a BPF helper arch_protect_bpf_trampoline() return 0 to fix a kernel memory access failure - fix a typo issue in kvm_vm_init_features() * tag 'loongarch-fixes-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Fix typo issue in kvm_vm_init_features() LoongArch: BPF: Make arch_protect_bpf_trampoline() return 0 LoongArch: No need to flush icache if text copy failed LoongArch: Check return values for set_memory_{rw,rox} LoongArch: Give more information if kmem access failed LoongArch: Fix calling smp_processor_id() in preemptible code LoongArch: Only use SC.Q when supported by the assembler commit 85d98669fa7f1d3041d962515e45ee6e392db6f8 Author: Loic Poulain Date: Mon Mar 2 15:26:03 2026 +0100 arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions (ESR=0x96000010) and kernel crashes on Monaco-based platforms. These faults are caused by the kernel inadvertently accessing hypervisor-owned memory that is not properly marked as reserved. >From boot log, The Qualcomm hypervisor reports the memory range at 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned: qhee_hyp_assign_remove_memory: 0x91a80000/0x80000 -> ret 0 However, the EFI memory map provided by firmware only reserves the subrange 0x91a40000–0x91a87fff (288 KiB). The remaining portion (0x91a88000–0x91afffff) is incorrectly reported as conventional memory (from efi debug): efi: 0x000091a40000-0x000091a87fff [Reserved...] efi: 0x000091a88000-0x0000938fffff [Conventional...] As a result, the allocator may hand out PFNs inside the hypervisor owned region, causing fatal aborts when the kernel accesses those addresses. Add a reserved-memory carveout for the Gunyah hypervisor metadata at 0x91a80000 (512 KiB) and mark it as no-map so Linux does not map or allocate from this area. For the record: Hyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC) UEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1 Fixes: 7be190e4bdd2 ("arm64: dts: qcom: add QCS8300 platform") Signed-off-by: Loic Poulain Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260302142603.1113355-1-loic.poulain@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5e4ed0320b964bb99c9e041d50544926dc09e203 Merge: 1f182ec9d7084d ca67bd564e94aa Author: Mark Brown Date: Wed Mar 18 13:26:52 2026 +0000 ASoC: fix usage of playback_only and capture_only Shengjiu Wang says: Check value of is_playback_only and is_capture_only in graph_util_parse_link_direction() and initialize playback_only and capture_only in imx-card.c commit ca67bd564e94aaa898a2cbb90922ca3cccd0612b Author: Shengjiu Wang Date: Wed Mar 18 18:28:50 2026 +0800 ASoC: fsl: imx-card: initialize playback_only and capture_only Fix uninitialized variable playback_only and capture_only because graph_util_parse_link_direction() may not write them. Fixes: 1877c3e7937f ("ASoC: imx-card: Add playback_only or capture_only support") Suggested-by: Kuninori Morimoto Acked-by: Kuninori Morimoto Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260318102850.2794029-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 0e9fc79132ce7ea1e48c388b864382aa38eb0ed4 Author: Shengjiu Wang Date: Wed Mar 18 18:28:49 2026 +0800 ASoC: simple-card-utils: Check value of is_playback_only and is_capture_only The audio-graph-card2 gets the value of 'playback-only' and 'capture_only' property in below sequence, if there is 'playback_only' or 'capture_only' property in port_cpu and port_codec nodes, but no these properties in ep_cpu and ep_codec nodes, the value of playback_only and capture_only will be flushed to zero in the end. graph_util_parse_link_direction(lnk, &playback_only, &capture_only); graph_util_parse_link_direction(ports_cpu, &playback_only, &capture_only); graph_util_parse_link_direction(ports_codec, &playback_only, &capture_only); graph_util_parse_link_direction(port_cpu, &playback_only, &capture_only); graph_util_parse_link_direction(port_codec, &playback_only, &capture_only); graph_util_parse_link_direction(ep_cpu, &playback_only, &capture_only); graph_util_parse_link_direction(ep_codec, &playback_only, &capture_only); So check the value of is_playback_only and is_capture_only in graph_util_parse_link_direction() function, if they are true, then rewrite the values, and no need to check the np variable as of_property_read_bool() will ignore if it was NULL. Fixes: 3cc393d2232e ("ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction") Fixes: 22a507d7680f ("ASoC: simple-card-utils: Check device node before overwrite direction") Suggested-by: Kuninori Morimoto Acked-by: Kuninori Morimoto Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260318102850.2794029-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit df3ef89d7ef8185fa719812e2d175b83112aa315 Merge: dfc80d650be7f9 4e701b47c3ba8f Author: Arnd Bergmann Date: Wed Mar 18 14:06:34 2026 +0100 Merge tag 'scmi-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI fixes for v7.0 Few fixes to: 1. Address a NULL dereference in the SCMI notify error path by ensurin __scmi_event_handler_get_ops() consistently returns an ERR_PTR on failure, as expected by callers. 2. Fix a device_node reference leak in the SCPI probe path by introducing scope-based cleanup for acquired DT nodes. 3. Correct minor spelling errors. * tag 'scmi-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Spelling s/mulit/multi/, s/currenly/currently/ firmware: arm_scmi: Fix NULL dereference on notify error path firmware: arm_scpi: Fix device_node reference leak in probe path Signed-off-by: Arnd Bergmann commit dfc80d650be7f9ccbe2173fe2c53a803e9da93a6 Merge: b3315ba042f2c8 a4e8473b775160 Author: Arnd Bergmann Date: Wed Mar 18 14:05:30 2026 +0100 Merge tag 'ffa-fix-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FF-A fix for v7.0 Fix removing the vm_id argument from ffa_rxtx_unmap(), as the FF-A specification mandates this field be zero in all contexts except a non-secure physical FF-A instance, where the ID is inherently 0. * tag 'ffa-fix-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap() Signed-off-by: Arnd Bergmann commit b3315ba042f2c8d3bc66502ada4555c11363cdeb Merge: ffe6989c73b31f 08d9a4580f7112 Author: Arnd Bergmann Date: Wed Mar 18 13:28:45 2026 +0100 Merge tag 'tee-fix-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes TEE shared memory update for 7.0 Remove refcounting of kernel pages in register_shm_helper() to support slab allocations. * tag 'tee-fix-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: shm: Remove refcounting of kernel pages Signed-off-by: Arnd Bergmann commit e8d97c270cb46a2a88739019d0f8547adc7d97da Author: Ming Qian Date: Fri Mar 6 11:10:57 2026 +0800 media: verisilicon: Fix kernel panic due to __initconst misuse Fix a kernel panic when probing the driver as a module: Unable to handle kernel paging request at virtual address ffffd9c18eb05000 of_find_matching_node_and_match+0x5c/0x1a0 hantro_probe+0x2f4/0x7d0 [hantro_vpu] The imx8mq_vpu_shared_resources array is referenced by variant structures through their shared_devices field. When built as a module, __initconst causes this data to be freed after module init, but it's later accessed during probe, causing a page fault. The imx8mq_vpu_shared_resources is referenced from non-init code, so keeping __initconst or __initconst_or_module here is wrong. Drop the __initconst annotation and let it live in the normal .rodata section. A bug of __initconst called from regular non-init probe code leading to bugs during probe deferrals or during unbind-bind cycles. Reported-by: Krzysztof Kozlowski Closes: https://lore.kernel.org/all/68ef934f-baa0-4bf6-93d8-834bbc441e66@kernel.org/ Reported-by: Franz Schnyder Closes: https://lore.kernel.org/all/n3qmcb62tepxltoskpf7ws6yiirc2so62ia23b42rj3wlmpl67@rvkbuirx7kkp/ Fixes: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC") Suggested-by: Krzysztof Kozlowski Suggested-by: Marco Felsch Reviewed-by: Marco Felsch Signed-off-by: Ming Qian Reviewed-by: Frank Li Reviewed-by: Krzysztof Kozlowski Cc: stable@kernel.org Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 8306a78a1c04cf87bfa9ae6451cc9d8f0f9dc0e0 Author: Daniel Lezcano Date: Tue Mar 17 19:09:38 2026 +0100 ALSA: usb-audio: qcom: Fix the license marking The Copyright for Qualcomm changed its format and replaces the old Qualcomm Innovative Center by Qualcomm Technology Inc. Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20260317180943.3062085-1-daniel.lezcano@oss.qualcomm.com Signed-off-by: Takashi Iwai commit b8bee48e38f2ddbdba5e58bc54ef54bb7d8d341b Author: Frank Zhang Date: Tue Mar 17 18:25:27 2026 +0800 ALSA:usb:qcom: add AUXILIARY_BUS to Kconfig dependencies The build can fail with: ERROR: modpost: "__auxiliary_driver_register" [sound/usb/qcom/snd-usb-audio-qmi.ko] undefined! ERROR: modpost: "auxiliary_driver_unregister" [sound/usb/qcom/snd-usb-audio-qmi.ko] undefined! Select AUXILIARY_BUS when SND_USB_AUDIO_QMI is enabled. Signed-off-by: Frank Zhang Link: https://patch.msgid.link/20260317102527.556248-1-rmxpzlb@gmail.com Signed-off-by: Takashi Iwai commit e7648ffecb7fcb7400e123bb6ea989633a104fc3 Author: Pratap Nirujogi Date: Tue Mar 17 23:47:57 2026 -0400 ACPI: bus: Fix MFD child automatic modprobe issue MFD child devices sharing parent's ACPI Companion fails to probe as acpi_companion_match() returns incompatible ACPI Companion handle for binding with the check for pnp.type.backlight added recently. Remove this pnp.type.backlight check in acpi_companion_match() to fix the automatic modprobe issue. Fixes: 7a7a7ed5f8bdb ("ACPI: scan: Register platform devices for backlight device objects") Signed-off-by: Pratap Nirujogi Link: https://patch.msgid.link/20260318034842.1216536-1-pratap.nirujogi@amd.com Signed-off-by: Rafael J. Wysocki commit bf504b229cb8d534eccbaeaa23eba34c05131e25 Author: Rafael J. Wysocki Date: Tue Mar 17 21:39:05 2026 +0100 ACPI: processor: Fix previous acpi_processor_errata_piix4() fix After commi f132e089fe89 ("ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()"), device pointers may be dereferenced after dropping references to the device objects pointed to by them, which may cause a use-after-free to occur. Moreover, debug messages about enabling the errata may be printed if the errata flags corresponding to them are unset. Address all of these issues by moving message printing to the points in the code where the errata flags are set. Fixes: f132e089fe89 ("ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()") Reported-by: Guenter Roeck Closes: https://lore.kernel.org/linux-acpi/938e2206-def5-4b7a-9b2c-d1fd37681d8a@roeck-us.net/ Reviewed-by: Guenter Roeck Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5975693.DvuYhMxLoT@rafael.j.wysocki commit c03b7dec3c4ddc97872fa12bfca75bae9cb46510 Author: Arnd Bergmann Date: Mon Feb 2 10:47:51 2026 +0100 media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() The deeply nested loop in rkvdec_init_v4l2_vp9_count_tbl() needs a lot of registers, so when the clang register allocator runs out, it ends up spilling countless temporaries to the stack: drivers/media/platform/rockchip/rkvdec/rkvdec-vp9.c:966:12: error: stack frame size (1472) exceeds limit (1280) in 'rkvdec_vp9_start' [-Werror,-Wframe-larger-than] Marking this function as noinline_for_stack keeps it out of rkvdec_vp9_start(), giving the compiler more room for optimization. The resulting code is good enough that both the total stack usage and the loop get enough better to stay under the warning limit, though it's still slow, and would need a larger rework if this function ends up being called in a fast path. Signed-off-by: Arnd Bergmann Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Mauro Carvalho Chehab commit 446c6a25a4494e137ec42e886da04e29efc2dc39 Author: Arnd Bergmann Date: Mon Feb 2 10:47:50 2026 +0100 media: rkvdec: reduce excessive stack usage in assemble_hw_pps() The rkvdec_pps had a large set of bitfields, all of which as misaligned. This causes clang-21 and likely other versions to produce absolutely awful object code and a warning about very large stack usage, on targets without unaligned access: drivers/media/platform/rockchip/rkvdec/rkvdec-vp9.c:966:12: error: stack frame size (1472) exceeds limit (1280) in 'rkvdec_vp9_start' [-Werror,-Wframe-larger-than] Part of the problem here is how all the bitfield accesses are inlined into a function that already has large structures on the stack. Mark set_field_order_cnt() as noinline_for_stack, and split out the following accesses in assemble_hw_pps() into another noinline function, both of which now using around 800 bytes of stack in the same configuration. There is clearly still something wrong with clang here, but splitting it into multiple functions reduces the risk of stack overflow. Fixes: fde24907570d ("media: rkvdec: Add H264 support for the VDPU383 variant") Link: https://godbolt.org/z/acP1eKeq9 Signed-off-by: Arnd Bergmann Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Mauro Carvalho Chehab commit daa87ca42652af0d6791ef875e3c4d724b099f22 Author: Detlev Casanova Date: Fri Jan 23 14:22:44 2026 -0500 media: rkvdec: Improve handling missing short/long term RPS The values of ext_sps_st_rps and ext_sps_lt_rps in struct rkvdec_hevc_run are not initialized when the respective controls are not set by userspace. When this is the case, set them to NULL so the rkvdec_hevc_run_preamble function that parses controls does not access garbage data which leads to a panic on unaccessible memory. Fixes: c9a59dc2acc7 ("media: rkvdec: Add HEVC support for the VDPU381 variant") Reported-by: Christian Hewitt Suggested-by: Jonas Karlman Signed-off-by: Detlev Casanova Tested-by: Christian Hewitt Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Mauro Carvalho Chehab commit bef4f4a88b73e4cc550d25f665b8a9952af22773 Author: Yuchan Nam Date: Fri Mar 6 21:52:23 2026 +0900 media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports. We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_ioctl_reinit() so REINIT is in the same exclusion domain. This keeps request cleanup and queue cancellation from running in parallel for request-capable devices. Fixes: 6093d3002eab ("media: vb2: keep a reference to the request until dqbuf") Cc: stable@vger.kernel.org Signed-off-by: Yuchan Nam Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit ac62a20035ecc18e6d365c6c792f5965ce1da77c Author: Michael Riesch Date: Mon Feb 16 13:28:48 2026 +0100 media: synopsys: csi2rx: add missing kconfig dependency Fix "ERROR: modpost: "phy_mipi_dphy_get_default_config_for_hsclk" [drivers/media/platform/synopsys/dw-mipi-csi2rx.ko] undefined!" by selecting GENERIC_PHY_MIPI_DPHY in the Kconfig entry. Fixes: 355a11004066 ("media: synopsys: add driver for the designware mipi csi-2 receiver") Cc: stable@kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602130253.BZnVd4jh-lkp@intel.com/ Signed-off-by: Michael Riesch Reviewed-by: Frank Li Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit 9232fa05921bc0ea0bc71947440ec9a50b3ad26e Author: Michael Riesch Date: Mon Feb 16 13:28:47 2026 +0100 media: synopsys: csi2rx: fix out-of-bounds check for formats array The out-of-bounds check for the format array is off by one. Fix the check. Fixes: 355a11004066 ("media: synopsys: add driver for the designware mipi csi-2 receiver") Cc: stable@kernel.org Suggested-by: Dan Carpenter Signed-off-by: Michael Riesch Reviewed-by: Frank Li Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab commit e37afcb56ae070477741fe2d6e61fc0c542cce2d Author: Shiraz Saleem Date: Mon Mar 16 13:39:47 2026 -0500 RDMA/irdma: Harden depth calculation functions An issue was exposed where OS can pass in U32_MAX for SQ/RQ/SRQ size. This can cause integer overflow and truncation of SQ/RQ/SRQ depth returning a success when it should have failed. Harden the functions to do all depth calculations and boundary checking in u64 sizes. Fixes: 563e1feb5f6e ("RDMA/irdma: Add SRQ support") Signed-off-by: Shiraz Saleem Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 7221f581eefa79ead06e171044f393fb7ee22f87 Author: Tatyana Nikolova Date: Mon Mar 16 13:39:46 2026 -0500 RDMA/irdma: Return EINVAL for invalid arp index error When rdma_connect() fails due to an invalid arp index, user space rdma core reports ENOMEM which is confusing. Modify irdma_make_cm_node() to return the correct error code. Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 6f52370970ac07d352a7af4089e55e0e6425f827 Author: Anil Samal Date: Mon Mar 16 13:39:45 2026 -0500 RDMA/irdma: Fix deadlock during netdev reset with active connections Resolve deadlock that occurs when user executes netdev reset while RDMA applications (e.g., rping) are active. The netdev reset causes ice driver to remove irdma auxiliary driver, triggering device_delete and subsequent client removal. During client removal, uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, creating circular dependency and indefinite wait in iWARP mode. Skip QP reference count wait during device reset to prevent deadlock. Fixes: c8f304d75f6c ("RDMA/irdma: Prevent QP use after free") Signed-off-by: Anil Samal Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit c45c6ebd693b944f1ffe429fdfb6cc1674c237be Author: Tatyana Nikolova Date: Mon Mar 16 13:39:44 2026 -0500 RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() During reset, irdma_modify_qp() to error should be called to disconnect the QP. Without this fix, if not preceded by irdma_modify_qp() to error, the API call irdma_destroy_qp() gets stuck waiting for the QP refcount to go to zero, because the cm_node associated with this QP isn't disconnected. Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions") Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit b415399c9a024d574b65479636f0d4eb625b9abd Author: Ivan Barrera Date: Mon Mar 16 13:39:43 2026 -0500 RDMA/irdma: Clean up unnecessary dereference of event->cm_node The cm_node is available and the usage of cm_node and event->cm_node seems arbitrary. Clean up unnecessary dereference of event->cm_node. Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") Signed-off-by: Ivan Barrera Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 5e8f0239731a83753473b7aa91bda67bbdff5053 Author: Tatyana Nikolova Date: Mon Mar 16 13:39:42 2026 -0500 RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() Remove a NOP wait_event() in irdma_modify_qp_roce() which is relevant for iWARP and likely a copy and paste artifact for RoCEv2. The wait event is for sending a reset on a TCP connection, after the reset has been requested in irdma_modify_qp(), which occurs only in iWarp mode. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 8c1f19a2225cf37b3f8ab0b5a8a5322291cda620 Author: Tatyana Nikolova Date: Mon Mar 16 13:39:41 2026 -0500 RDMA/irdma: Update ibqp state to error if QP is already in error state In irdma_modify_qp() update ibqp state to error if the irdma QP is already in error state, otherwise the ibqp state which is visible to the consumer app remains stale. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 11a95521fb93c91e2d4ef9d53dc80ef0a755549b Author: Jacob Moroni Date: Mon Mar 16 13:39:38 2026 -0500 RDMA/irdma: Initialize free_qp completion before using it In irdma_create_qp, if ib_copy_to_udata fails, it will call irdma_destroy_qp to clean up which will attempt to wait on the free_qp completion, which is not initialized yet. Fix this by initializing the completion before the ib_copy_to_udata call. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Jacob Moroni Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 0162ab3220bac870e43e229e6e3024d1a21c3f26 Author: Rahul Bukte Date: Tue Feb 3 10:18:39 2026 +0530 drm/i915/gt: Check set_default_submission() before deferencing When the i915 driver firmware binaries are not present, the set_default_submission pointer is not set. This pointer is dereferenced during suspend anyways. Add a check to make sure it is set before dereferencing. [ 23.289926] PM: suspend entry (deep) [ 23.293558] Filesystems sync: 0.000 seconds [ 23.298010] Freezing user space processes [ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds) [ 23.309766] OOM killer disabled. [ 23.313027] Freezing remaining freezable tasks [ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 23.342038] serial 00:05: disabled [ 23.345719] serial 00:02: disabled [ 23.349342] serial 00:01: disabled [ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache [ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache [ 23.361635] ata1.00: Entering standby power mode [ 23.368863] ata2.00: Entering standby power mode [ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 23.452194] #PF: supervisor instruction fetch in kernel mode [ 23.457896] #PF: error_code(0x0010) - not-present page [ 23.463065] PGD 0 P4D 0 [ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI [ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary) [ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [ 23.496511] Workqueue: async async_run_entry_fn [ 23.501087] RIP: 0010:0x0 [ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246 [ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f [ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000 [ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff [ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8 [ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68 [ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000 [ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0 [ 23.572539] PKRU: 55555554 [ 23.575281] Call Trace: [ 23.577770] [ 23.579905] intel_engines_reset_default_submission+0x42/0x60 [ 23.585695] __intel_gt_unset_wedged+0x191/0x200 [ 23.590360] intel_gt_unset_wedged+0x20/0x40 [ 23.594675] gt_sanitize+0x15e/0x170 [ 23.598290] i915_gem_suspend_late+0x6b/0x180 [ 23.602692] i915_drm_suspend_late+0x35/0xf0 [ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10 [ 23.611843] dpm_run_callback+0x78/0x1c0 [ 23.615817] device_suspend_late+0xde/0x2e0 [ 23.620037] async_suspend_late+0x18/0x30 [ 23.624082] async_run_entry_fn+0x25/0xa0 [ 23.628129] process_one_work+0x15b/0x380 [ 23.632182] worker_thread+0x2a5/0x3c0 [ 23.635973] ? __pfx_worker_thread+0x10/0x10 [ 23.640279] kthread+0xf6/0x1f0 [ 23.643464] ? __pfx_kthread+0x10/0x10 [ 23.647263] ? __pfx_kthread+0x10/0x10 [ 23.651045] ret_from_fork+0x131/0x190 [ 23.654837] ? __pfx_kthread+0x10/0x10 [ 23.658634] ret_from_fork_asm+0x1a/0x30 [ 23.662597] [ 23.664826] Modules linked in: [ 23.667914] CR2: 0000000000000000 [ 23.671271] ------------[ cut here ]------------ Signed-off-by: Rahul Bukte Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260203044839.1555147-1-suraj.kandpal@intel.com (cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad) Fixes: ff44ad51ebf8 ("drm/i915: Move engine->submit_request selection to a vfunc") Signed-off-by: Joonas Lahtinen commit bd71fb3fea9945987053968f028a948997cba8cc Author: Joanne Koong Date: Tue Mar 17 13:39:35 2026 -0700 iomap: fix invalid folio access when i_blkbits differs from I/O granularity Commit aa35dd5cbc06 ("iomap: fix invalid folio access after folio_end_read()") partially addressed invalid folio access for folios without an ifs attached, but it did not handle the case where 1 << inode->i_blkbits matches the folio size but is different from the granularity used for the IO, which means IO can be submitted for less than the full folio for the !ifs case. In this case, the condition: if (*bytes_submitted == folio_len) ctx->cur_folio = NULL; in iomap_read_folio_iter() will not invalidate ctx->cur_folio, and iomap_read_end() will still be called on the folio even though the IO helper owns it and will finish the read on it. Fix this by unconditionally invalidating ctx->cur_folio for the !ifs case. Reported-by: Johannes Thumshirn Tested-by: Johannes Thumshirn Link: https://lore.kernel.org/linux-fsdevel/b3dfe271-4e3d-4922-b618-e73731242bca@wdc.com/ Fixes: b2f35ac4146d ("iomap: add caller-provided callbacks for read and readahead") Cc: stable@vger.kernel.org Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20260317203935.830549-1-joannelkoong@gmail.com Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit e5966096d0856d071269cb5928d6bc33342d2dfd Author: Bill Wendling Date: Mon Mar 16 18:41:58 2026 +0000 xfs: annotate struct xfs_attr_list_context with __counted_by_ptr Add the `__counted_by_ptr` attribute to the `buffer` field of `struct xfs_attr_list_context`. This field is used to point to a buffer of size `bufsize`. The `buffer` field is assigned in: 1. `xfs_ioc_attr_list` in `fs/xfs/xfs_handle.c` 2. `xfs_xattr_list` in `fs/xfs/xfs_xattr.c` 3. `xfs_getparents` in `fs/xfs/xfs_handle.c` (implicitly initialized to NULL) In `xfs_ioc_attr_list`, `buffer` was assigned before `bufsize`. Reorder them to ensure `bufsize` is set before `buffer` is assigned, although no access happens between them. In `xfs_xattr_list`, `buffer` was assigned before `bufsize`. Reorder them to ensure `bufsize` is set before `buffer` is assigned. In `xfs_getparents`, `buffer` is NULL (from zero initialization) and remains NULL. `bufsize` is set to a non-zero value, but since `buffer` is NULL, no access occurs. In all cases, the pointer `buffer` is not accessed before `bufsize` is set. This patch was generated by CodeMender and reviewed by Bill Wendling. Tested by running xfstests. Signed-off-by: Bill Wendling Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 0c98524ab20193d8772cff9c71b00ad004fb1349 Author: Christoph Hellwig Date: Mon Mar 16 16:35:29 2026 +0100 xfs: cleanup buftarg handling in XFS_IOC_VERIFY_MEDIA The newly added XFS_IOC_VERIFY_MEDIA is a bit unusual in how it handles buftarg fields. Update it to be more in line with other XFS code: - use btp->bt_dev instead of btp->bt_bdev->bd_dev to retrieve the device number for tracing - use btp->bt_logical_sectorsize instead of bdev_logical_block_size(btp->bt_bdev) to retrieve the logical sector size - compare the buftarg and not the bdev to see if there is a separate log buftarg Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 268378b6ad20569af0d1957992de1c8b16c6e900 Author: hongao Date: Thu Mar 12 20:10:26 2026 +0800 xfs: scrub: unlock dquot before early return in quota scrub xchk_quota_item can return early after calling xchk_fblock_process_error. When that helper returns false, the function returned immediately without dropping dq->q_qlock, which can leave the dquot lock held and risk lock leaks or deadlocks in later quota operations. Fix this by unlocking dq->q_qlock before the early return. Signed-off-by: hongao Fixes: 7d1f0e167a067e ("xfs: check the ondisk space mapping behind a dquot") Cc: # v6.8 Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 7cac60947335f8d88a6390814840590a61134484 Author: Yuto Ohnuki Date: Tue Mar 10 18:38:40 2026 +0000 xfs: refactor xfsaild_push loop into helper Factor the loop body of xfsaild_push() into a separate xfsaild_process_logitem() helper to improve readability. This is a pure code movement with no functional change. Signed-off-by: Yuto Ohnuki Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 394d70b86fae9fe865e7e6d9540b7696f73aa9b6 Author: Yuto Ohnuki Date: Tue Mar 10 18:38:39 2026 +0000 xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer no longer protects the log item from reclaim, the log item may be freed by background reclaim or the dquot shrinker. The subsequent spin_lock() call dereferences lip->li_ailp, which is a use-after-free. Fix this by saving the ailp pointer in a local variable while the AIL lock is held and the log item is guaranteed to be valid. Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary") Cc: stable@vger.kernel.org # v5.9 Reviewed-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Yuto Ohnuki Signed-off-by: Carlos Maiolino commit 79ef34ec0554ec04bdbafafbc9836423734e1bd6 Author: Yuto Ohnuki Date: Tue Mar 10 18:38:38 2026 +0000 xfs: avoid dereferencing log items after push callbacks After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background inode reclaim or the dquot shrinker can free the log item while the AIL lock is not held, and the tracepoints in the switch statement dereference the log item after iop_push() returns. Fix this by capturing the log item type, flags, and LSN before calling xfsaild_push_item(), and introducing a new xfs_ail_push_class trace event class that takes these pre-captured values and the ailp pointer instead of the log item pointer. Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary") Cc: stable@vger.kernel.org # v5.9 Signed-off-by: Yuto Ohnuki Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 4f24a767e3d64a5f58c595b5c29b6063a201f1e3 Author: Yuto Ohnuki Date: Tue Mar 10 18:38:37 2026 +0000 xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes. Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable. Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary") Cc: stable@vger.kernel.org # v5.9 Signed-off-by: Yuto Ohnuki Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit d5ad6ab61cbd89afdb60881f6274f74328af3ee9 Author: Felix Fietkau Date: Sat Mar 14 06:54:55 2026 +0000 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do. Add kfree_skb() to the first error path so all three are consistent, and remove the now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to avoid double-free. Document the skb ownership guarantee in the function's kdoc. Signed-off-by: Felix Fietkau Link: https://patch.msgid.link/20260314065455.2462900-1-nbd@nbd.name Fixes: 06be6b149f7e ("mac80211: add ieee80211_tx_prepare_skb() helper function") Signed-off-by: Johannes Berg commit deb353d9bb009638b7762cae2d0b6e8fdbb41a69 Author: Guenter Roeck Date: Tue Mar 17 23:46:36 2026 -0700 wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push"), wl1271_tx_allocate() and with it wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails. However, in wlcore_tx_work_locked(), a return value of -EAGAIN from wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being full. This causes the code to flush the buffer, put the skb back at the head of the queue, and immediately retry the same skb in a tight while loop. Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens immediately with GFP_ATOMIC, this will result in an infinite loop and a CPU soft lockup. Return -ENOMEM instead so the packet is dropped and the loop terminates. The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y. Assisted-by: Gemini:gemini-3.1-pro Fixes: e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push") Cc: Peter Astrand Signed-off-by: Guenter Roeck Link: https://patch.msgid.link/20260318064636.3065925-1-linux@roeck-us.net Signed-off-by: Johannes Berg commit c73bb9a2d33bf81f6eecaa0f474b6c6dbe9855bd Author: Xiang Mei Date: Tue Mar 17 20:42:44 2026 -0700 wifi: mac80211: fix NULL deref in mesh_matches_local() mesh_matches_local() unconditionally dereferences ie->mesh_config to compare mesh configuration parameters. When called from mesh_rx_csa_frame(), the parsed action-frame elements may not contain a Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a kernel NULL pointer dereference. The other two callers are already safe: - ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before calling mesh_matches_local() - mesh_plink_get_event() is only reached through mesh_process_plink_frame(), which checks !elems->mesh_config, too mesh_rx_csa_frame() is the only caller that passes raw parsed elements to mesh_matches_local() without guarding mesh_config. An adjacent attacker can exploit this by sending a crafted CSA action frame that includes a valid Mesh ID IE but omits the Mesh Configuration IE, crashing the kernel. The captured crash log: Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: events_unbound cfg80211_wiphy_work [...] Call Trace: ? __pfx_mesh_matches_local (net/mac80211/mesh.c:65) ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686) [...] ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802) [...] cfg80211_wiphy_work (net/wireless/core.c:426) process_one_work (net/kernel/workqueue.c:3280) ? assign_work (net/kernel/workqueue.c:1219) worker_thread (net/kernel/workqueue.c:3352) ? __pfx_worker_thread (net/kernel/workqueue.c:3385) kthread (net/kernel/kthread.c:436) [...] ret_from_fork_asm (net/arch/x86/entry/entry_64.S:255) This patch adds a NULL check for ie->mesh_config at the top of mesh_matches_local() to return false early when the Mesh Configuration IE is absent. Fixes: 2e3c8736820b ("mac80211: support functions for mesh") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Link: https://patch.msgid.link/20260318034244.2595020-1-xmei5@asu.edu Signed-off-by: Johannes Berg commit 8780f561f6717dec52351251881bff79e960eb46 Author: Geoffrey D. Bennett Date: Wed Mar 18 06:02:30 2026 +1030 ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen from SKIP_IFACE_SETUP The Focusrite Scarlett 2i2 1st Gen (1235:8006) produces distorted/silent audio when QUIRK_FLAG_SKIP_IFACE_SETUP is active, as that flag causes the feedback format to be detected as 17.15 instead of 16.16. Add a DEVICE_FLG entry for this device before the Focusrite VENDOR_FLG entry so that it gets no quirk flags, overriding the vendor-wide SKIP_IFACE_SETUP. This device doesn't have the internal mixer, Air, or Safe modes that the quirk was designed to protect. Fixes: 38c322068a26 ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP") Reported-by: pairomaniac [https://github.com/geoffreybennett/linux-fcp/issues/54] Tested-by: pairomaniac [https://github.com/geoffreybennett/linux-fcp/issues/54] Signed-off-by: Geoffrey D. Bennett Link: https://patch.msgid.link/abmsTjKmQMKbhYtK@m.b4.vu Signed-off-by: Takashi Iwai commit b6398bc2ef3a78f1be37ba01ae0a5eedaee47803 Author: Artem Bityutskiy Date: Wed Mar 11 11:00:33 2026 +0200 tools/power turbostat: Fix --show/--hide for individual cpuidle counters Problem: individual swidle counter names (C1, C1+, C1-, etc.) cannot be selected via --show/--hide due to two bugs in probe_cpuidle_counts(): 1. The function returns immediately when BIC_cpuidle is not enabled, without checking deferred_add_index. 2. The deferred name check runs against name_buf before the trailing newline is stripped, so is_deferred_add("C1\n") never matches "C1". Fix: 1. Relax the early return to pass through when deferred names are queued. 2. Strip the trailing newline from name_buf before performing deferred name checks. 3. Check each suffixed variant (C1+, C1, C1-) individually so that e.g. "--show C1+" enables only the requested metric. In addition, introduce a helper function to avoid repeating the condition (readability cleanup). Fixes: ec4acd3166d8 ("tools/power turbostat: disable "cpuidle" invocation counters, by default") Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit 23cb4f5c81766e70e5f32ed0987ee8fb5ab2e00a Author: Artem Bityutskiy Date: Wed Mar 11 11:00:32 2026 +0200 tools/power turbostat: Fix incorrect format variable In the perf thread, core, and package counter loops, an incorrect 'mp->format' variable is used instead of 'pp->format'. [lenb: edit commit message] Fixes: 696d15cbd8c2 ("tools/power turbostat: Refactor floating point printout code") Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit ed532d738a82269dfe490436b9b8def2274cfb6e Author: Artem Bityutskiy Date: Wed Mar 11 11:00:31 2026 +0200 tools/power turbostat: Consistently use print_float_value() Fix the PMT thread code to use print_float_value(), to be consistent with the PMT core and package code. [lenb: commit message] Signed-off-by: Artem Bityutskiy Signed-off-by: Len Brown commit 511f76bf1dce5acf8907b65a7d1bc8f7e7c0d637 Author: Sebastian Krzyszkowiak Date: Sat Feb 21 19:15:19 2026 +0100 arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V The minimal voltage of VDD_SOC sourced from BUCK1 is 0.81V, which is the currently set value. However, BD71837 only guarantees accuracy of ±0.01V, and this still doesn't factor other reasons for actual voltage to slightly drop in, resulting in the possibility of running out of the operational range. Bump the voltage up to 0.85V, which should give enough headroom. Cc: stable@vger.kernel.org Fixes: 8f0216b006e5 ("arm64: dts: Add a device tree for the Librem 5 phone") Signed-off-by: Sebastian Krzyszkowiak Signed-off-by: Frank Li commit 4cd46ea0eb4504f7f4fea92cb4601c5c9a3e545e Author: Sebastian Krzyszkowiak Date: Sat Feb 21 19:15:18 2026 +0100 Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" This reverts commit c24a9b698fb02cd0723fa8375abab07f94b97b10. It's been found that there's a significant per-unit variance in accepted supply voltages and the current set still makes some units unstable. Revert back to nominal values. Cc: stable@vger.kernel.org Fixes: c24a9b698fb0 ("arm64: dts: imx8mq-librem5: Set the DVS voltages lower") Signed-off-by: Sebastian Krzyszkowiak Signed-off-by: Frank Li commit bccaf98c1077f2216ecae12923e21ffaebd67d95 Author: Max Krummenacher Date: Thu Feb 19 16:11:49 2026 +0100 Revert "ARM: dts: imx: move nand related property under nand@0" This reverts commit 8124b4a4a96b57d6cc3705a9df9623c52baa047b. The change introduced a regression: at least Colibri iMX6ULL and Colibri iMX7 no longer boot with that commit applied, while they boot again after reverting it. Although this has only been verified on these two modules, the issue is expected to affect all device trees using the gpmi-nand driver. [ 0.876938] Creating 5 MTD partitions on "gpmi-nand": [ 0.876974] 0x000000000000-0x000000080000 : "mx7-bcb" [ 0.879860] 0x000000080000-0x000000200000 : "u-boot1" [ 0.884761] 0x000000200000-0x000000380000 : "u-boot2" [ 0.886993] 0x000000380000-0x000000400000 : "u-boot-env" [ 0.894686] 0x000000400000-0x000020000000 : "ubi" [ 0.899054] gpmi-nand 33002000.nand-controller: driver registered. ... [ 0.960443] ubi0: default fastmap pool size: 200 [ 0.960476] ubi0: default fastmap WL pool size: 100 [ 0.960500] ubi0: attaching mtd4 [ 1.636355] ubi0 error: scan_peb: bad image sequence number 1588722158 in PEB 4060, expected 1574791632 ... [ 1.649889] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd4, error -22 [ 1.650029] UBI error: cannot attach mtd4 ... [ 1.670262] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,253) Fixes: 8124b4a4a96b ("ARM: dts: imx: move nand related property under nand@0") Signed-off-by: Max Krummenacher Signed-off-by: Frank Li commit a444083286434ec1fd127c5da11a3091e6013008 Author: Serhii Pievniev Date: Wed Feb 25 18:16:03 2026 -0500 tools/power/turbostat: Fix microcode patch level output for AMD/Hygon turbostat always used the same logic to read the microcode patch level, which is correct for Intel but not for AMD/Hygon. While Intel stores the patch level in the upper 32 bits of MSR, AMD stores it in the lower 32 bits, which causes turbostat to report the microcode version as 0x0 on AMD/Hygon. Fix by shifting right by 32 for non-AMD/Hygon, preserving the existing behavior for Intel and unknown vendors. Fixes: 3e4048466c39 ("tools/power turbostat: Add --no-msr option") Signed-off-by: Serhii Pievniev Signed-off-by: Len Brown commit 99b38fa34342b227a863948460b7937a97dbce28 Author: Zhang Rui Date: Tue Mar 10 14:02:01 2026 +0800 tools/power turbostat: Eliminate unnecessary data structure allocation Linux core_id's are a per-package namespace, not a per-node namespace. Rename topo.cores_per_node to topo.cores_per_pkg to reflect this. Eliminate topo.nodes_per_pkg from the sizing for core data structures, since it has no role except to unnecessarily bloat the allocation. Validated on multiple Intel platforms (ICX/SPR/SRF/EMR/GNR/CWF) with various CPU online/offline configurations and SMT enabled/disabled scenarios. No functional changes. [lenb: commit message] Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit b8ead30e2b2c7f32c8d2782e805160b110766592 Author: Len Brown Date: Sat Mar 7 21:43:11 2026 -0500 tools/power turbostat: Fix swidle header vs data display I changed my mind about displaying swidle statistics, which are "added counters". Recently I reverted the column headers to 8-columns, but kept print_decimal_value() padding out to 16-columns for all 64-bit counters. Simplify by keeping print_decimial_value() at %lld -- which will often fit into 8-columns, and live with the fact that it can overflow and shift the other columns, which continue to tab-delimited. This is a better compromise than inserting a bunch of space characters that most users don't like. Fixes: 1a23ba6a1ba2 ("tools/power turbostat: Print wide names only for RAW 64-bit columns") Reported-by: Artem Bityutskiy Signed-off-by: Len Brown commit b425e4d0eb321a1116ddbf39636333181675d8f4 Author: Hyunwoo Kim Date: Thu Mar 12 17:15:51 2026 +0900 ksmbd: fix use-after-free in durable v2 replay of active file handles parse_durable_handle_context() unconditionally assigns dh_info->fp->conn to the current connection when handling a DURABLE_REQ_V2 context with SMB2_FLAGS_REPLAY_OPERATION. ksmbd_lookup_fd_cguid() does not filter by fp->conn, so it returns file handles that are already actively connected. The unconditional overwrite replaces fp->conn, and when the overwriting connection is subsequently freed, __ksmbd_close_fd() dereferences the stale fp->conn via spin_lock(&fp->conn->llist_lock), causing a use-after-free. KASAN report: [ 7.349357] ================================================================== [ 7.349607] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x75/0xe0 [ 7.349811] Write of size 4 at addr ffff8881056ac18c by task kworker/1:2/108 [ 7.350010] [ 7.350064] CPU: 1 UID: 0 PID: 108 Comm: kworker/1:2 Not tainted 7.0.0-rc3+ #58 PREEMPTLAZY [ 7.350068] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 7.350070] Workqueue: ksmbd-io handle_ksmbd_work [ 7.350083] Call Trace: [ 7.350087] [ 7.350087] dump_stack_lvl+0x64/0x80 [ 7.350094] print_report+0xce/0x660 [ 7.350100] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 7.350101] ? __pfx___mod_timer+0x10/0x10 [ 7.350106] ? _raw_spin_lock+0x75/0xe0 [ 7.350108] kasan_report+0xce/0x100 [ 7.350109] ? _raw_spin_lock+0x75/0xe0 [ 7.350114] kasan_check_range+0x105/0x1b0 [ 7.350116] _raw_spin_lock+0x75/0xe0 [ 7.350118] ? __pfx__raw_spin_lock+0x10/0x10 [ 7.350119] ? __call_rcu_common.constprop.0+0x25e/0x780 [ 7.350125] ? close_id_del_oplock+0x2cc/0x4e0 [ 7.350128] __ksmbd_close_fd+0x27f/0xaf0 [ 7.350131] ksmbd_close_fd+0x135/0x1b0 [ 7.350133] smb2_close+0xb19/0x15b0 [ 7.350142] ? __pfx_smb2_close+0x10/0x10 [ 7.350143] ? xas_load+0x18/0x270 [ 7.350146] ? _raw_spin_lock+0x84/0xe0 [ 7.350148] ? __pfx__raw_spin_lock+0x10/0x10 [ 7.350150] ? _raw_spin_unlock+0xe/0x30 [ 7.350151] ? ksmbd_smb2_check_message+0xeb2/0x24c0 [ 7.350153] ? ksmbd_tree_conn_lookup+0xcd/0xf0 [ 7.350154] handle_ksmbd_work+0x40f/0x1080 [ 7.350156] process_one_work+0x5fa/0xef0 [ 7.350162] ? assign_work+0x122/0x3e0 [ 7.350163] worker_thread+0x54b/0xf70 [ 7.350165] ? __pfx_worker_thread+0x10/0x10 [ 7.350166] kthread+0x346/0x470 [ 7.350170] ? recalc_sigpending+0x19b/0x230 [ 7.350176] ? __pfx_kthread+0x10/0x10 [ 7.350178] ret_from_fork+0x4fb/0x6c0 [ 7.350183] ? __pfx_ret_from_fork+0x10/0x10 [ 7.350185] ? __switch_to+0x36c/0xbe0 [ 7.350188] ? __pfx_kthread+0x10/0x10 [ 7.350190] ret_from_fork_asm+0x1a/0x30 [ 7.350197] [ 7.350197] [ 7.355160] Allocated by task 123: [ 7.355261] kasan_save_stack+0x33/0x60 [ 7.355373] kasan_save_track+0x14/0x30 [ 7.355484] __kasan_kmalloc+0x8f/0xa0 [ 7.355593] ksmbd_conn_alloc+0x44/0x6d0 [ 7.355711] ksmbd_kthread_fn+0x243/0xd70 [ 7.355839] kthread+0x346/0x470 [ 7.355942] ret_from_fork+0x4fb/0x6c0 [ 7.356051] ret_from_fork_asm+0x1a/0x30 [ 7.356164] [ 7.356214] Freed by task 134: [ 7.356305] kasan_save_stack+0x33/0x60 [ 7.356416] kasan_save_track+0x14/0x30 [ 7.356527] kasan_save_free_info+0x3b/0x60 [ 7.356646] __kasan_slab_free+0x43/0x70 [ 7.356761] kfree+0x1ca/0x430 [ 7.356862] ksmbd_tcp_disconnect+0x59/0xe0 [ 7.356993] ksmbd_conn_handler_loop+0x77e/0xd40 [ 7.357138] kthread+0x346/0x470 [ 7.357240] ret_from_fork+0x4fb/0x6c0 [ 7.357350] ret_from_fork_asm+0x1a/0x30 [ 7.357463] [ 7.357513] The buggy address belongs to the object at ffff8881056ac000 [ 7.357513] which belongs to the cache kmalloc-1k of size 1024 [ 7.357857] The buggy address is located 396 bytes inside of [ 7.357857] freed 1024-byte region [ffff8881056ac000, ffff8881056ac400) Fix by removing the unconditional fp->conn assignment and rejecting the replay when fp->conn is non-NULL. This is consistent with ksmbd_lookup_durable_fd(), which also rejects file handles with a non-NULL fp->conn. For disconnected file handles (fp->conn == NULL), ksmbd_reopen_durable_fd() handles setting fp->conn. Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2") Signed-off-by: Hyunwoo Kim Acked-by: Namjae Jeon Signed-off-by: Steve French commit c33615f995aee80657b9fdfbc4ee7f49c2bd733d Author: Hyunwoo Kim Date: Thu Mar 12 17:17:02 2026 +0900 ksmbd: fix use-after-free of share_conf in compound request smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without validating tcon->t_state. ksmbd_tree_conn_lookup() checks t_state == TREE_CONNECTED on the initial lookup path, but the compound reuse path bypasses this check entirely. If a prior command in the compound (SMB2_TREE_DISCONNECT) sets t_state to TREE_DISCONNECTED and frees share_conf via ksmbd_share_config_put(), subsequent commands dereference the freed share_conf through work->tcon->share_conf. KASAN report: [ 4.144653] ================================================================== [ 4.145059] BUG: KASAN: slab-use-after-free in smb2_write+0xc74/0xe70 [ 4.145415] Read of size 4 at addr ffff88810430c194 by task kworker/1:1/44 [ 4.145772] [ 4.145867] CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted 7.0.0-rc3+ #60 PREEMPTLAZY [ 4.145871] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 4.145875] Workqueue: ksmbd-io handle_ksmbd_work [ 4.145888] Call Trace: [ 4.145892] [ 4.145894] dump_stack_lvl+0x64/0x80 [ 4.145910] print_report+0xce/0x660 [ 4.145919] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 4.145928] ? smb2_write+0xc74/0xe70 [ 4.145931] kasan_report+0xce/0x100 [ 4.145934] ? smb2_write+0xc74/0xe70 [ 4.145937] smb2_write+0xc74/0xe70 [ 4.145939] ? __pfx_smb2_write+0x10/0x10 [ 4.145942] ? _raw_spin_unlock+0xe/0x30 [ 4.145945] ? ksmbd_smb2_check_message+0xeb2/0x24c0 [ 4.145948] ? smb2_tree_disconnect+0x31c/0x480 [ 4.145951] handle_ksmbd_work+0x40f/0x1080 [ 4.145953] process_one_work+0x5fa/0xef0 [ 4.145962] ? assign_work+0x122/0x3e0 [ 4.145964] worker_thread+0x54b/0xf70 [ 4.145967] ? __pfx_worker_thread+0x10/0x10 [ 4.145970] kthread+0x346/0x470 [ 4.145976] ? recalc_sigpending+0x19b/0x230 [ 4.145980] ? __pfx_kthread+0x10/0x10 [ 4.145984] ret_from_fork+0x4fb/0x6c0 [ 4.145992] ? __pfx_ret_from_fork+0x10/0x10 [ 4.145995] ? __switch_to+0x36c/0xbe0 [ 4.145999] ? __pfx_kthread+0x10/0x10 [ 4.146003] ret_from_fork_asm+0x1a/0x30 [ 4.146013] [ 4.146014] [ 4.149858] Allocated by task 44: [ 4.149953] kasan_save_stack+0x33/0x60 [ 4.150061] kasan_save_track+0x14/0x30 [ 4.150169] __kasan_kmalloc+0x8f/0xa0 [ 4.150274] ksmbd_share_config_get+0x1dd/0xdd0 [ 4.150401] ksmbd_tree_conn_connect+0x7e/0x600 [ 4.150529] smb2_tree_connect+0x2e6/0x1000 [ 4.150645] handle_ksmbd_work+0x40f/0x1080 [ 4.150761] process_one_work+0x5fa/0xef0 [ 4.150873] worker_thread+0x54b/0xf70 [ 4.150978] kthread+0x346/0x470 [ 4.151071] ret_from_fork+0x4fb/0x6c0 [ 4.151176] ret_from_fork_asm+0x1a/0x30 [ 4.151286] [ 4.151332] Freed by task 44: [ 4.151418] kasan_save_stack+0x33/0x60 [ 4.151526] kasan_save_track+0x14/0x30 [ 4.151634] kasan_save_free_info+0x3b/0x60 [ 4.151751] __kasan_slab_free+0x43/0x70 [ 4.151861] kfree+0x1ca/0x430 [ 4.151952] __ksmbd_tree_conn_disconnect+0xc8/0x190 [ 4.152088] smb2_tree_disconnect+0x1cd/0x480 [ 4.152211] handle_ksmbd_work+0x40f/0x1080 [ 4.152326] process_one_work+0x5fa/0xef0 [ 4.152438] worker_thread+0x54b/0xf70 [ 4.152545] kthread+0x346/0x470 [ 4.152638] ret_from_fork+0x4fb/0x6c0 [ 4.152743] ret_from_fork_asm+0x1a/0x30 [ 4.152853] [ 4.152900] The buggy address belongs to the object at ffff88810430c180 [ 4.152900] which belongs to the cache kmalloc-96 of size 96 [ 4.153226] The buggy address is located 20 bytes inside of [ 4.153226] freed 96-byte region [ffff88810430c180, ffff88810430c1e0) [ 4.153549] [ 4.153596] The buggy address belongs to the physical page: [ 4.153750] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810430ce80 pfn:0x10430c [ 4.154000] flags: 0x100000000000200(workingset|node=0|zone=2) [ 4.154160] page_type: f5(slab) [ 4.154251] raw: 0100000000000200 ffff888100041280 ffff888100040110 ffff888100040110 [ 4.154461] raw: ffff88810430ce80 0000000800200009 00000000f5000000 0000000000000000 [ 4.154668] page dumped because: kasan: bad access detected [ 4.154820] [ 4.154866] Memory state around the buggy address: [ 4.155002] ffff88810430c080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 4.155196] ffff88810430c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 4.155391] >ffff88810430c180: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 4.155587] ^ [ 4.155693] ffff88810430c200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 4.155891] ffff88810430c280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 4.156087] ================================================================== Add the same t_state validation to the compound reuse path, consistent with ksmbd_tree_conn_lookup(). Fixes: 5005bcb42191 ("ksmbd: validate session id and tree id in the compound request") Signed-off-by: Hyunwoo Kim Acked-by: Namjae Jeon Signed-off-by: Steve French commit 3a64125730cabc34fccfbc230c2667c2e14f7308 Author: Namjae Jeon Date: Fri Mar 13 10:01:29 2026 +0900 ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION Use sb->s_uuid for a proper volume identifier as the primary choice. For filesystems that do not provide a UUID, fall back to stfs.f_fsid obtained from vfs_statfs(). Cc: stable@vger.kernel.org Reported-by: Hyunwoo Kim Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 Author: Namjae Jeon Date: Fri Mar 13 10:00:58 2026 +0900 ksmbd: unset conn->binding on failed binding request When a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbd_session_lookup_all() calls fall back to the global sessions table. This fix it by clearing conn->binding = false in the error path. Cc: stable@vger.kernel.org Reported-by: Hyunwoo Kim Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 5258572aa5fd5a7ed01b123b28241e0281b6fb9b Author: Nicholas Carlini Date: Mon Mar 9 08:29:49 2026 +0900 ksmbd: fix share_conf UAF in tree_conn disconnect __ksmbd_tree_conn_disconnect() drops the share_conf reference before checking tree_conn->refcount. When someone uses SMB3 multichannel and binds two connections to one session, a SESSION_LOGOFF on connection A calls ksmbd_conn_wait_idle(conn) which only drains connection A's request counter, not connection B's. This means there's a race condition: requests already dispatched on connection B hold tree_conn references via work->tcon. The disconnect path frees share_conf while those requests are still walking work->tcon->share_conf, causing a use-after-free. This fix combines the share_conf put with the tree_conn free so it only happens when the last reference is dropped. Fixes: b39a1833cc4a ("ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency") Signed-off-by: Nicholas Carlini Acked-by: Namjae Jeon Signed-off-by: Steve French commit 48e91af0cbe942d50ef6257d850accdca1d01378 Author: Even Xu Date: Tue Mar 17 13:56:29 2026 +0800 HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs Add Nova Lake THC QuickSPI device IDs to support list. Signed-off-by: Even Xu Signed-off-by: Jiri Kosina commit d56c9cca2e7f8f0ad91f37abd4e6357c2318b0db Author: Even Xu Date: Tue Mar 17 13:56:28 2026 +0800 HID: Intel-thc-hid: Intel-quicki2c: Add NVL Device IDs Add Nova Lake THC QuickI2C device IDs to support list. Signed-off-by: Even Xu Signed-off-by: Jiri Kosina commit 64dcbde7f8f870a4f2d9daf24ffb06f9748b5dd3 Author: Junrui Luo Date: Sat Mar 14 17:41:04 2026 +0800 bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in bnxt_async_event_process() uses a firmware-supplied 'type' field directly as an index into bp->bs_trace[] without bounds validation. The 'type' field is a 16-bit value extracted from DMA-mapped completion ring memory that the NIC writes directly to host RAM. A malicious or compromised NIC can supply any value from 0 to 65535, causing an out-of-bounds access into kernel heap memory. The bnxt_bs_trace_check_wrap() call then dereferences bs_trace->magic_byte and writes to bs_trace->last_offset and bs_trace->wrapped, leading to kernel memory corruption or a crash. Fix by adding a bounds check and defining BNXT_TRACE_MAX as DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 to cover all currently defined firmware trace types (0x0 through 0xc). Fixes: 84fcd9449fd7 ("bnxt_en: Manage the FW trace context memory") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Reviewed-by: Michael Chan Link: https://patch.msgid.link/SYBPR01MB7881A253A1C9775D277F30E9AF42A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski commit 32f59301b9898c0ab5e72908556d553e2d481945 Author: Sanman Pradhan Date: Tue Mar 17 17:46:31 2026 +0000 hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value ina233_read_word_data() uses the return value of pmbus_read_word_data() directly in a DIV_ROUND_CLOSEST() computation without first checking for errors. If the underlying I2C transaction fails, a negative error code is used in the arithmetic, producing a garbage sensor value instead of propagating the error. Add the missing error check before using the return value. Fixes: b64b6cb163f16 ("hwmon: Add driver for TI INA233 Current and Power Monitor") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260317174553.385567-1-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit c6f45ed26b6eb4766db06f21ff28a97ed485bcbb Author: Sanman Pradhan Date: Tue Mar 17 17:37:41 2026 +0000 hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value In mp2869_read_byte_data() and mp2869_read_word_data(), the return value of pmbus_read_byte_data() for PMBUS_STATUS_MFR_SPECIFIC is used directly inside FIELD_GET() macro arguments without error checking. If the I2C transaction fails, a negative error code is passed to FIELD_GET() and FIELD_PREP(), silently corrupting the status register bits being constructed. Extract the nested pmbus_read_byte_data() calls into a separate variable and check for errors before use. This also eliminates a redundant duplicate read of the same register in the PMBUS_STATUS_TEMPERATURE case. Fixes: a3a2923aaf7f2 ("hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260317173308.382545-4-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 19d4b9c8a136704d5f2544e7ac550f27918a5004 Author: Sanman Pradhan Date: Tue Mar 17 17:37:17 2026 +0000 hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value mp2973_read_word_data() XORs the return value of pmbus_read_word_data() with PB_STATUS_POWER_GOOD_N without first checking for errors. If the I2C transaction fails, a negative error code is XORed with the constant, producing a corrupted value that is returned as valid status data instead of propagating the error. Add the missing error check before modifying the return value. Fixes: acda945afb465 ("hwmon: (pmbus/mp2975) Fix PGOOD in READ_STATUS_WORD") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260317173308.382545-3-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit a989fde763f4f24209e4702f50a45be572340e68 Merge: 9e22d8e18f3705 a8aec14230322e Author: Linus Torvalds Date: Tue Mar 17 15:19:58 2026 -0700 Merge tag 'libnvdimm-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fix from Ira Weiny: - Fix old potential use after free bug * tag 'libnvdimm-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm/bus: Fix potential use after free in asynchronous initialization commit c925fccc4f8fae4354d98b2af606bd4747d3738d Author: Sanman Pradhan Date: Tue Mar 17 17:36:53 2026 +0000 hwmon: (pmbus/hac300s) Add error check for pmbus_read_word_data() return value hac300s_read_word_data() passes the return value of pmbus_read_word_data() directly to FIELD_GET() without checking for errors. If the I2C transaction fails, a negative error code is sign-extended and passed to FIELD_GET(), which silently produces garbage data instead of propagating the error. Add the missing error check before using the return value in the FIELD_GET() macro. Fixes: 669cf162f7a1 ("hwmon: Add support for HiTRON HAC300S PSU") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260317173308.382545-2-sanman.pradhan@hpe.com Signed-off-by: Guenter Roeck commit 86650ee2241ff84207eaa298ab318533f3c21a38 Author: Alex Deucher Date: Mon Sep 25 10:44:06 2023 -0400 drm/radeon: apply state adjust rules to some additional HAINAN vairants They need a similar workaround. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839 Signed-off-by: Alex Deucher (cherry picked from commit 87327658c848f56eac166cb382b57b83bf06c5ac) Cc: stable@vger.kernel.org commit 9787f7da186ee8143b7b6d914cfa0b6e7fee2648 Author: Alex Deucher Date: Mon Sep 25 10:44:07 2023 -0400 drm/amdgpu: apply state adjust rules to some additional HAINAN vairants They need a similar workaround. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839 Signed-off-by: Alex Deucher (cherry picked from commit 0de31d92a173d3d94f28051b0b80a6c98913aed4) Cc: stable@vger.kernel.org commit e9f58ff991dd4be13fd7a651bbf64329c090af09 Author: Alex Deucher Date: Mon Mar 16 11:04:46 2026 -0400 drm/amdgpu: rework how we handle TLB fences Add a new VM flag to indicate whether or not we need a TLB fence. Userqs (KFD or KGD) require a TLB fence. A TLB fence is not strictly required for kernel queues, but it shouldn't hurt. That said, enabling this unconditionally should be fine, but it seems to tickle some issues in KIQ/MES. Only enable them for KFD, or when KGD userq queues are enabled (currently via module parameter). Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4798 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4749 Fixes: f3854e04b708 ("drm/amdgpu: attach tlb fence to the PTs update") Cc: Christian König Cc: Prike Liang Reviewed-by: Prike Liang Signed-off-by: Alex Deucher (cherry picked from commit 69c5fbd2b93b5ced77c6e79afe83371bca84c788) Cc: stable@vger.kernel.org commit 9e22d8e18f37059678c2f34ab3b447b8c964c6bf Merge: f0caa1d49cc07b 8b8f1d5e350acd Author: Linus Torvalds Date: Tue Mar 17 15:00:53 2026 -0700 Merge tag 'linux_kselftest-kunit-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit fix from Shuah Khan: - Add documentation for --list_suites feature * tag 'linux_kselftest-kunit-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Add documentation of --list_suites commit 6850deb61118345996f03b87817b4ae0f2f25c38 Author: Michal Swiatkowski Date: Wed Feb 11 10:10:08 2026 +0100 libie: prevent memleak in fwlog code All cmd_buf buffers are allocated and need to be freed after usage. Add an error unwinding path that properly frees these buffers. The memory leak happens whenever fwlog configuration is changed. For example: $echo 256K > /sys/kernel/debug/ixgbe/0000\:32\:00.0/fwlog/log_size Fixes: 96a9a9341cda ("ice: configure FW logging") Reviewed-by: Aleksandr Loktionov Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit f0caa1d49cc07b30a7e2f104d3853ec6dc1c3cad Merge: 8a91ebb337fa68 e716edafedad49 Author: Linus Torvalds Date: Tue Mar 17 13:55:51 2026 -0700 Merge tag 'hid-for-linus-2026031701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - various fixes dealing with (intentionally) broken devices in HID core, logitech-hidpp and multitouch drivers (Lee Jones) - fix for OOB in wacom driver (Benoît Sevens) - fix for potentialy HID-bpf-induced buffer overflow in () (Benjamin Tissoires) - various other small fixes and device ID / quirk additions * tag 'hid-for-linus-2026031701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: multitouch: Check to ensure report responses match the request HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure HID: bpf: prevent buffer overflow in hid_hw_request selftests/hid: fix compilation when bpf_wq and hid_device are not exported HID: core: Mitigate potential OOB by removing bogus memset() HID: intel-thc-hid: Set HID_PHYS with PCI BDF HID: appletb-kbd: add .resume method in PM HID: logitech-hidpp: Enable MX Master 4 over bluetooth HID: input: Add HID_BATTERY_QUIRK_DYNAMIC for Elan touchscreens HID: input: Drop Asus UX550* touchscreen ignore battery quirks HID: asus: add xg mobile 2022 external hardware support HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq commit fc9c69be594756b81b54c6bc40803fa6052f35ae Author: Petr Oros Date: Wed Feb 25 11:01:37 2026 +0100 iavf: fix VLAN filter lost on add/delete race When iavf_add_vlan() finds an existing filter in IAVF_VLAN_REMOVE state, it transitions the filter to IAVF_VLAN_ACTIVE assuming the pending delete can simply be cancelled. However, there is no guarantee that iavf_del_vlans() has not already processed the delete AQ request and removed the filter from the PF. In that case the filter remains in the driver's list as IAVF_VLAN_ACTIVE but is no longer programmed on the NIC. Since iavf_add_vlans() only picks up filters in IAVF_VLAN_ADD state, the filter is never re-added, and spoof checking drops all traffic for that VLAN. CPU0 CPU1 Workqueue ---- ---- --------- iavf_del_vlan(vlan 100) f->state = REMOVE schedule AQ_DEL_VLAN iavf_add_vlan(vlan 100) f->state = ACTIVE iavf_del_vlans() f is ACTIVE, skip iavf_add_vlans() f is ACTIVE, skip Filter is ACTIVE in driver but absent from NIC. Transition to IAVF_VLAN_ADD instead and schedule IAVF_FLAG_AQ_ADD_VLAN_FILTER so iavf_add_vlans() re-programs the filter. A duplicate add is idempotent on the PF. Fixes: 0c0da0e95105 ("iavf: refactor VLAN filter states") Signed-off-by: Petr Oros Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 45b33e805bd39f615d9353a7194b2da5281332df Author: Zdenek Bouska Date: Wed Feb 25 10:58:29 2026 +0100 igc: fix page fault in XDP TX timestamps handling If an XDP application that requested TX timestamping is shutting down while the link of the interface in use is still up the following kernel splat is reported: [ 883.803618] [ T1554] BUG: unable to handle page fault for address: ffffcfb6200fd008 ... [ 883.803650] [ T1554] Call Trace: [ 883.803652] [ T1554] [ 883.803654] [ T1554] igc_ptp_tx_tstamp_event+0xdf/0x160 [igc] [ 883.803660] [ T1554] igc_tsync_interrupt+0x2d5/0x300 [igc] ... During shutdown of the TX ring the xsk_meta pointers are left behind, so that the IRQ handler is trying to touch them. This issue is now being fixed by cleaning up the stale xsk meta data on TX shutdown. TX timestamps on other queues remain unaffected. Fixes: 15fd021bc427 ("igc: Add Tx hardware timestamp request for AF_XDP zero-copy packet") Signed-off-by: Zdenek Bouska Reviewed-by: Paul Menzel Reviewed-by: Florian Bezdeka Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen commit 0ffba246652faf4a36aedc66059c2f94e4c83ea5 Author: Kohei Enju Date: Sat Feb 14 19:46:32 2026 +0000 igc: fix missing update of skb->tail in igc_xmit_frame() igc_xmit_frame() misses updating skb->tail when the packet size is shorter than the minimum one. Use skb_put_padto() in alignment with other Intel Ethernet drivers. Fixes: 0507ef8a0372 ("igc: Add transmit and receive fastpath and interrupt handlers") Signed-off-by: Kohei Enju Reviewed-by: Simon Horman Reviewed-by: Paul Menzel Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen commit 563d39928db602c58d24301769e25e33a48a65ab Author: Leo Yan Date: Sun Mar 1 17:43:25 2026 +0000 perf kvm stat: Fix relative paths for including headers Add an extra "../" to the relative paths so that the uAPI headers provided by tools can be found correctly. Fixes: a724a8fce5e25b45 ("perf kvm stat: Fix build error") Reported-by: Namhyung Kim Suggested-by: Ian Rogers Reviewed-by: Ian Rogers Signed-off-by: Leo Yan Signed-off-by: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 72a8b9c060d3188ff29e2a3f3ea47b1f2a67e005 Author: Thomas Richter Date: Tue Feb 17 14:14:56 2026 +0100 perf parse-events: Fix big-endian 'overwrite' by writing correct union member The "Read backward ring buffer" test crashes on big-endian (e.g. s390x) due to a NULL dereference when the backward mmap path isn't enabled. Reproducer: # ./perf test -F 'Read backward ring buffer' Segmentation fault (core dumped) # uname -m s390x # Root cause: get_config_terms() stores into evsel_config_term::val.val (u64) while later code reads boolean fields such as evsel_config_term::val.overwrite. On big-endian the 1-byte boolean is left-aligned, so writing evsel_config_term::val.val = 1 is read back as evsel_config_term::val.overwrite = 0, leaving backward mmap disabled and a NULL map being used. Store values in the union member that matches the term type, e.g.: /* for OVERWRITE */ new_term->val.overwrite = 1; /* not new_term->val.val = 1 */ to fix this. Improve add_config_term() and add two more parameters for string and value. Function add_config_term() now creates a complete node element of type evsel_config_term and handles all evsel_config_term::val union members. Impact: Enables backward mmap on big-endian and prevents the crash. No change on little-endian. Output after: # ./perf test -Fv 44 --- start --- Using CPUID IBM,9175,705,ME1,3.8,002f mmap size 1052672B mmap size 8192B ---- end ---- 44: Read backward ring buffer : Ok # Fixes: 159ca97cd97ce8cc ("perf parse-events: Refactor get_config_terms() to remove macros") Reviewed-by: James Clark Reviewed-by: Jan Polensky Signed-off-by: Thomas Richter Acked-by: Ian Rogers Cc: James Clark Signed-off-by: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 8dd1d9a335321d0829aeb85d8e1a897248d0da29 Author: Ian Rogers Date: Fri Feb 6 16:49:56 2026 -0800 perf metricgroup: Fix metricgroup__has_metric_or_groups() Use metricgroup__for_each_metric() rather than pmu_metrics_table__for_each_metric() that combines the default metric table with, a potentially empty, CPUID table. Fixes: cee275edcdb1acfd ("perf metricgroup: Don't early exit if no CPUID table exists") Reviewed-by: Leo Yan Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Tested-by: Leo Yan Cc: Ian Rogers Signed-off-by: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit a68ed2df72131447d131531a08fe4dfcf4fa4653 Author: Jens Axboe Date: Sun Mar 15 09:03:03 2026 -0600 io_uring/poll: fix multishot recv missing EOF on wakeup race When a socket send and shutdown() happen back-to-back, both fire wake-ups before the receiver's task_work has a chance to run. The first wake gets poll ownership (poll_refs=1), and the second bumps it to 2. When io_poll_check_events() runs, it calls io_poll_issue() which does a recv that reads the data and returns IOU_RETRY. The loop then drains all accumulated refs (atomic_sub_return(2) -> 0) and exits, even though only the first event was consumed. Since the shutdown is a persistent state change, no further wakeups will happen, and the multishot recv can hang forever. Check specifically for HUP in the poll loop, and ensure that another loop is done to check for status if more than a single poll activation is pending. This ensures we don't lose the shutdown event. Cc: stable@vger.kernel.org Fixes: dbc2564cfe0f ("io_uring: let fast poll support multishot") Reported-by: Francis Brosseau Link: https://github.com/axboe/liburing/issues/1549 Signed-off-by: Jens Axboe commit ab93d7eee94205430fc3b0532557cb0494bf2faf Author: Saket Dumbre Date: Tue Mar 17 20:34:49 2026 +0100 ACPICA: Update the format of Arg3 of _DSM To get rid of type incompatibility warnings in Linux. Fixes: 81f92cff6d42 ("ACPICA: ACPI_TYPE_ANY does not include the package type") Link: https://github.com/acpica/acpica/commit/4fb74872dcec Signed-off-by: Saket Dumbre Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12856643.O9o76ZdvQC@rafael.j.wysocki commit 2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d Author: Danilo Krummrich Date: Tue Mar 3 12:53:21 2026 +0100 driver core: platform: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 3d713e0e382e ("driver core: platform: add device binding path 'driver_override'") Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260303115720.48783-5-dakr@kernel.org Signed-off-by: Danilo Krummrich commit c5f60e3f07b6609562d21efda878e83ce8860728 Author: Danilo Krummrich Date: Tue Mar 17 00:37:15 2026 +0100 sh: platform_early: remove pdev->driver_override check In commit 507fd01d5333 ("drivers: move the early platform device support to arch/sh") platform_match() was copied over to the sh platform_early code, accidentally including the driver_override check. This check does not make sense for platform_early, as sysfs is not even available in first place at this point in the boot process, hence remove the check. Reviewed-by: Greg Kroah-Hartman Reviewed-by: Geert Uytterhoeven Fixes: 507fd01d5333 ("drivers: move the early platform device support to arch/sh") Link: https://lore.kernel.org/all/DH4M3DJ4P58T.1BGVAVXN71Z09@kernel.org/ Signed-off-by: Danilo Krummrich commit 813bbc4d33d2ca5b0da63e70ae13b60874f20d37 Author: Danilo Krummrich Date: Tue Mar 3 12:53:20 2026 +0100 hwmon: axi-fan: don't use driver_override as IRQ name Do not use driver_override as IRQ name, as it is not guaranteed to point to a valid string; use NULL instead (which makes the devm IRQ helpers use dev_name()). Fixes: 8412b410fa5e ("hwmon: Support ADI Fan Control IP") Reviewed-by: Nuno Sá Acked-by: Guenter Roeck Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260303115720.48783-4-dakr@kernel.org Signed-off-by: Danilo Krummrich commit bcd085d5c76f687f5b6df049f7c415ae63a9b857 Author: Danilo Krummrich Date: Tue Mar 3 12:53:19 2026 +0100 docs: driver-model: document driver_override Now that we support driver_override as a driver-core feature through struct device and struct bus_type, add some documentation in the context of how a device / driver binding is established. Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260303115720.48783-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit cb3d1049f4ea77d5ad93f17d8ac1f2ed4da70501 Author: Danilo Krummrich Date: Tue Mar 3 12:53:18 2026 +0100 driver core: generalize driver_override in struct device Currently, there are 12 busses (including platform and PCI) that duplicate the driver_override logic for their individual devices. All of them seem to be prone to the bug described in [1]. While this could be solved for every bus individually using a separate lock, solving this in the driver-core generically results in less (and cleaner) changes overall. Thus, move driver_override to struct device, provide corresponding accessors for busses and handle locking with a separate lock internally. In particular, add device_set_driver_override(), device_has_driver_override(), device_match_driver_override() and generalize the sysfs store() and show() callbacks via a driver_override feature flag in struct bus_type. Until all busses have migrated, keep driver_set_override() in place. Note that we can't use the device lock for the reasons described in [2]. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220789 [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [2] Tested-by: Gui-Dong Han Co-developed-by: Gui-Dong Han Signed-off-by: Gui-Dong Han Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260303115720.48783-2-dakr@kernel.org [ Use dev->bus instead of sp->bus for consistency; fix commit message to refer to the struct bus_type's driver_override feature flag. - Danilo ] Signed-off-by: Danilo Krummrich commit 0f2055db7b630559870afb40fc84490816ab8ec5 Author: Ethan Tidmore Date: Fri Mar 13 23:57:30 2026 -0500 RDMA/efa: Fix possible deadlock In the error path for efa_com_alloc_comp_ctx() the semaphore assigned to &aq->avail_cmds is not released. Detected by Smatch: drivers/infiniband/hw/efa/efa_com.c:662 efa_com_cmd_exec() warn: inconsistent returns '&aq->avail_cmds' Add release for &aq->avail_cmds in efa_com_alloc_comp_ctx() error path. Fixes: ef3b06742c8a2 ("RDMA/efa: Fix use of completion ctx after free") Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260314045730.1143862-1-ethantidmore06@gmail.com Signed-off-by: Leon Romanovsky commit f28599f3969d1d928276772f1306872344c967f0 Author: Chuck Lever Date: Fri Mar 13 15:41:59 2026 -0400 RDMA/rw: Fix MR pool exhaustion in bvec RDMA READ path When IOVA-based DMA mapping is unavailable (e.g., IOMMU passthrough mode), rdma_rw_ctx_init_bvec() falls back to checking rdma_rw_io_needs_mr() with the raw bvec count. Unlike the scatterlist path in rdma_rw_ctx_init(), which passes a post-DMA-mapping entry count that reflects coalescing of physically contiguous pages, the bvec path passes the pre-mapping page count. This overstates the number of DMA entries, causing every multi-bvec RDMA READ to consume an MR from the QP's pool. Under NFS WRITE workloads the server performs RDMA READs to pull data from the client. With the inflated MR demand, the pool is rapidly exhausted, ib_mr_pool_get() returns NULL, and rdma_rw_init_one_mr() returns -EAGAIN. svcrdma treats this as a DMA mapping failure, closes the connection, and the client reconnects -- producing a cycle of 71% RPC retransmissions and ~100 reconnections per test run. RDMA WRITEs (NFS READ direction) are unaffected because DMA_TO_DEVICE never triggers the max_sgl_rd check. Remove the rdma_rw_io_needs_mr() gate from the bvec path entirely, so that bvec RDMA operations always use the map_wrs path (direct WR posting without MR allocation). The bvec caller has no post-DMA-coalescing segment count available -- xdr_buf and svc_rqst hold pages as individual pointers, and physical contiguity is discovered only during DMA mapping -- so the raw page count cannot serve as a reliable input to rdma_rw_io_needs_mr(). iWARP devices, which require MRs unconditionally, are handled by an earlier check in rdma_rw_ctx_init_bvec() and are unaffected. Fixes: bea28ac14cab ("RDMA/core: add MR support for bvec-based RDMA operations") Signed-off-by: Chuck Lever Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260313194201.5818-3-cel@kernel.org Signed-off-by: Leon Romanovsky commit 00da250c21b074ea9494c375d0117b69e5b1d0a4 Author: Chuck Lever Date: Fri Mar 13 15:41:58 2026 -0400 RDMA/rw: Fall back to direct SGE on MR pool exhaustion When IOMMU passthrough mode is active, ib_dma_map_sgtable_attrs() produces no coalescing: each scatterlist page maps 1:1 to a DMA entry, so sgt.nents equals the raw page count. A 1 MB transfer yields 256 DMA entries. If that count exceeds the device's max_sgl_rd threshold (an optimization hint from mlx5 firmware), rdma_rw_io_needs_mr() steers the operation into the MR registration path. Each such operation consumes one or more MRs from a pool sized at max_rdma_ctxs -- roughly one MR per concurrent context. Under write-intensive workloads that issue many concurrent RDMA READs, the pool is rapidly exhausted, ib_mr_pool_get() returns NULL, and rdma_rw_init_one_mr() returns -EAGAIN. Upper layer protocols treat this as a fatal DMA mapping failure and tear down the connection. The max_sgl_rd check is a performance optimization, not a correctness requirement: the device can handle large SGE counts via direct posting, just less efficiently than with MR registration. When the MR pool cannot satisfy a request, falling back to the direct SGE (map_wrs) path avoids the connection reset while preserving the MR optimization for the common case where pool resources are available. Add a fallback in rdma_rw_ctx_init() so that -EAGAIN from rdma_rw_init_mr_wrs() triggers direct SGE posting instead of propagating the error. iWARP devices, which mandate MR registration for RDMA READs, and force_mr debug mode continue to treat -EAGAIN as terminal. Fixes: 00bd1439f464 ("RDMA/rw: Support threshold for registration vs scattering to local pages") Signed-off-by: Chuck Lever Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260313194201.5818-2-cel@kernel.org Signed-off-by: Leon Romanovsky commit 1f182ec9d7084db7dfdb2372d453c28f0e5c3f0a Author: Zhang Heng Date: Mon Mar 16 16:02:18 2026 +0800 ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF Add a DMI quirk for the Thin A15 B7VF fixing the issue where the internal microphone was not detected. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220833 Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260316080218.2931304-1-zhangheng@kylinos.cn Signed-off-by: Mark Brown commit cffcb42c57686e9a801dfcf37a3d0c62e51c1c3e Author: Jonas Karlman Date: Sat Feb 28 11:28:22 2026 +0000 drm/bridge: dw-hdmi-qp: fix multi-channel audio output Channel Allocation (PB4) and Level Shift Information (PB5) are configured with values from PB1 and PB2 due to the wrong offset being used. This results in missing audio channels or incorrect speaker placement when playing multi-channel audio. Use the correct offset to fix multi-channel audio output. Fixes: fd0141d1a8a2 ("drm/bridge: synopsys: Add audio support for dw-hdmi-qp") Reported-by: Christian Hewitt Signed-off-by: Jonas Karlman Signed-off-by: Christian Hewitt Reviewed-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260228112822.4056354-1-christianshewitt@gmail.com Signed-off-by: Luca Ceresoli commit 8c89a077ca796a2fe248c584e9d7e66cff0388c8 Author: Praveen Talari Date: Fri Mar 13 21:49:01 2026 +0530 spi: geni-qcom: Check DMA interrupts early in ISR The current interrupt handler only checks the GENI main IRQ status (m_irq) before deciding to return IRQ_NONE. This can lead to spurious IRQ_NONE returns when DMA interrupts are pending but m_irq is zero. Move the DMA TX/RX status register reads to the beginning of the ISR, right after reading m_irq. Update the early return condition to check all three status registers (m_irq, dma_tx_status, dma_rx_status) before returning IRQ_NONE. Signed-off-by: Praveen Talari Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260313-spi-geni-qcom-fix-dma-irq-handling-v1-1-0bd122589e02@oss.qualcomm.com Signed-off-by: Mark Brown commit 6bee098b91417654703e17eb5c1822c6dfd0c01d Author: Maarten Lankhorst Date: Fri Mar 13 16:17:27 2026 +0100 drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug When trying to do a rather aggressive test of igt's "xe_module_load --r reload" with a full desktop environment and game running I noticed a few OOPSes when dereferencing freed pointers, related to framebuffers and property blobs after the compositor exits. Solve this by guarding the freeing in drm_file with drm_dev_enter/exit, and immediately put the references from struct drm_file objects during drm_dev_unplug(). Related warnings for framebuffers on the subtest: [ 739.713076] ------------[ cut here ]------------ WARN_ON(!list_empty(&dev->mode_config.fb_list)) [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12: xe_module_load/13145 .... [ 739.713328] Call Trace: [ 739.713330] [ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe] [ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe] [ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe] [ 739.714041] xe_display_fini_early+0x33/0x50 [xe] [ 739.714284] devm_action_release+0xf/0x20 [ 739.714294] devres_release_all+0xad/0xf0 [ 739.714301] device_unbind_cleanup+0x12/0xa0 [ 739.714305] device_release_driver_internal+0x1b7/0x210 [ 739.714311] device_driver_detach+0x14/0x20 [ 739.714315] unbind_store+0xa6/0xb0 [ 739.714319] drv_attr_store+0x21/0x30 [ 739.714322] sysfs_kf_write+0x48/0x60 [ 739.714328] kernfs_fop_write_iter+0x16b/0x240 [ 739.714333] vfs_write+0x266/0x520 [ 739.714341] ksys_write+0x72/0xe0 [ 739.714345] __x64_sys_write+0x19/0x20 [ 739.714347] x64_sys_call+0xa15/0xa30 [ 739.714355] do_syscall_64+0xd8/0xab0 [ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53 and [ 739.714459] ------------[ cut here ]------------ [ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb->filp_head)) [ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at drm_framebuffer_free+0x6c/0x90 [drm], CPU#12: xe_module_load/13145 [ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm] ... [ 739.714869] Call Trace: [ 739.714871] [ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm] [ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm] [ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm] [ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe] [ 739.715576] xe_display_fini_early+0x33/0x50 [xe] [ 739.715821] devm_action_release+0xf/0x20 [ 739.715828] devres_release_all+0xad/0xf0 [ 739.715843] device_unbind_cleanup+0x12/0xa0 [ 739.715850] device_release_driver_internal+0x1b7/0x210 [ 739.715856] device_driver_detach+0x14/0x20 [ 739.715860] unbind_store+0xa6/0xb0 [ 739.715865] drv_attr_store+0x21/0x30 [ 739.715868] sysfs_kf_write+0x48/0x60 [ 739.715873] kernfs_fop_write_iter+0x16b/0x240 [ 739.715878] vfs_write+0x266/0x520 [ 739.715886] ksys_write+0x72/0xe0 [ 739.715890] __x64_sys_write+0x19/0x20 [ 739.715893] x64_sys_call+0xa15/0xa30 [ 739.715900] do_syscall_64+0xd8/0xab0 [ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53 and then finally file close blows up: [ 743.186530] Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP [ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted: G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)} [ 743.186537] Tainted: [W]=WARN [ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021 [ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm] [ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00 48 89 42 [ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202 [ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX: ffffffff8217ed03 [ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI: ffff88814675ba08 [ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09: 0000000000000000 [ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88814675ba00 [ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15: ffff88810c660bb0 [ 743.186595] FS: 00007ff377d21280(0000) GS:ffff888cec3f8000(0000) knlGS:0000000000000000 [ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4: 00000000003706f0 [ 743.186597] Call Trace: [ 743.186598] [ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe] [ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm] [ 743.186750] ? trace_hardirqs_on+0x5f/0x120 [ 743.186754] drm_mode_object_put+0x51/0x70 [drm] [ 743.186786] drm_fb_release+0x105/0x190 [drm] [ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410 [ 743.186817] ? rt_spin_lock+0xea/0x1b0 [ 743.186819] drm_file_free+0x1e0/0x2c0 [drm] [ 743.186843] drm_release_noglobal+0x91/0xf0 [drm] [ 743.186865] __fput+0x100/0x2e0 [ 743.186869] fput_close_sync+0x40/0xa0 [ 743.186870] __x64_sys_close+0x3e/0x80 [ 743.186873] x64_sys_call+0xa07/0xa30 [ 743.186879] do_syscall_64+0xd8/0xab0 [ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 743.186882] RIP: 0033:0x7ff37e567732 [ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00 [ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX: 00007ff37e567732 [ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012 [ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09: 0000000000000000 [ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12: 000055d60a7996e0 [ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15: 000055d60a782a30 [ 743.186892] [ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi nls_utf8 mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 i2c_mux snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink [ 743.186938] ---[ end trace 0000000000000000 ]--- And for property blobs: void drm_mode_config_cleanup(struct drm_device *dev) { ... list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list, head_global) { drm_property_blob_put(blob); } Resulting in: [ 371.072940] BUG: unable to handle page fault for address: 000001ffffffffff [ 371.072944] #PF: supervisor read access in kernel mode [ 371.072945] #PF: error_code(0x0000) - not-present page [ 371.072947] PGD 0 P4D 0 [ 371.072950] Oops: Oops: 0000 [#1] SMP [ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)} [ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021 [ 371.072957] RIP: 0010:drm_property_destroy_user_blobs+0x3b/0x90 [drm] [ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39 c3 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8 48 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01 00 48 89 70 [ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293 [ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX: ffff8881b92355c0 [ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI: ffff888118be4000 [ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09: ffff888cecc5b000 [ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12: 000001ffffffffc7 [ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15: ffff888118a1a970 [ 371.073028] FS: 00007f1faccbb280(0000) GS:ffff888cec2db000(0000) knlGS:0000000000000000 [ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4: 00000000003706f0 [ 371.073031] Call Trace: [ 371.073033] [ 371.073036] drm_file_free+0x1df/0x2a0 [drm] [ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm] [ 371.073113] __fput+0xe2/0x2b0 [ 371.073118] fput_close_sync+0x40/0xa0 [ 371.073119] __x64_sys_close+0x3e/0x80 [ 371.073122] x64_sys_call+0xa07/0xa30 [ 371.073126] do_syscall_64+0xc0/0x840 [ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 371.073132] RIP: 0033:0x7f1fb3501732 [ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00 [ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX: 00007f1fb3501732 [ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012 [ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09: 0000000000000000 [ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12: 00005585ba46eea0 [ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15: 00005585ba458a30 [ 371.073143] [ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd nls_utf8 wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink [ 371.073198] CR2: 000001ffffffffff [ 371.073199] ---[ end trace 0000000000000000 ]--- Add a guard around file close, and ensure the warnings from drm_mode_config do not trigger. Fix those by allowing an open reference to the file descriptor and cleaning up the file linked list entry in drm_mode_config_cleanup(). Cc: # v4.18+ Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged") Cc: Thomas Hellström Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260313151728.14990-4-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit d5b66179b0e27c14a9033c4356937506577485e3 Author: Eric Biggers Date: Mon Mar 16 21:49:25 2026 -0700 lib/crypto: powerpc: Add powerpc/aesp8-ppc.S to clean-files Make the generated file powerpc/aesp8-ppc.S be removed by 'make clean'. Fixes: 7cf2082e74ce ("lib/crypto: powerpc/aes: Migrate POWER8 optimized code into library") Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260317044925.104184-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 3fc4648b53b7e393b91e63600e28e6f25c8ef0c5 Author: Pratap Nirujogi Date: Wed Mar 11 12:15:09 2026 -0400 drm/amdgpu: Fix ISP segfault issue in kernel v7.0 Add NULL pointer checks for dev->type before accessing dev->type->name in ISP genpd add/remove functions to prevent kernel crashes. This regression was introduced in v7.0 as the wakeup sources are registered using physical device instead of ACPI device. This led to adding wakeup source device as the first child of AMDGPU device without initializing dev-type variable, and resulted in segfault when accessed it in the amdgpu isp driver. Fixes: 057edc58aa59 ("ACPI: PM: Register wakeup sources under physical devices") Suggested-by: Bin Du Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher (cherry picked from commit c51632d1ed7ac5aed2d40dbc0718d75342c12c6a) commit f39e1270277f4b06db0b2c6ec9405b6dd766fb13 Author: Alex Deucher Date: Mon Mar 16 15:51:08 2026 -0400 drm/amdgpu/gmc9.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Cc: Benjamin Cheng Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher (cherry picked from commit e14d468304832bcc4a082d95849bc0a41b18ddea) Cc: stable@vger.kernel.org commit 9c52f49545478aa47769378cd0b53c5005d6a846 Author: Alex Deucher Date: Wed Mar 4 17:26:17 2026 -0500 drm/amdgpu/mmhub4.2.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher (cherry picked from commit dea5f235baf3786bfd4fd920b03c19285fdc3d9f) Cc: stable@vger.kernel.org commit 3cdd405831d8cc50a5eae086403402697bb98a4a Author: Alex Deucher Date: Wed Mar 4 17:25:56 2026 -0500 drm/amdgpu/mmhub4.1.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher (cherry picked from commit 04f063d85090f5dd0c671010ce88ee49d9dcc8ed) Cc: stable@vger.kernel.org commit cdb82ecbeccb55fae75a3c956b605f7801a30db1 Author: Alex Deucher Date: Wed Mar 4 17:25:30 2026 -0500 drm/amdgpu/mmhub3.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher (cherry picked from commit f14f27bbe2a3ed7af32d5f6eaf3f417139f45253) Cc: stable@vger.kernel.org commit e5e6d67b1ce9764e67aef2d0eef9911af53ad99a Author: Alex Deucher Date: Wed Mar 4 17:25:09 2026 -0500 drm/amdgpu/mmhub3.0.2: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher (cherry picked from commit 1441f52c7f6ae6553664aa9e3e4562f6fc2fe8ea) Cc: stable@vger.kernel.org commit 5d4e88bcfef29569a1db224ef15e28c603666c6d Author: Alex Deucher Date: Wed Mar 4 17:24:35 2026 -0500 drm/amdgpu/mmhub3.0.1: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher (cherry picked from commit 5f76083183363c4528a4aaa593f5d38c28fe7d7b) Cc: stable@vger.kernel.org commit a54403a534972af5d9ba5aaa3bb6ead612500ec6 Author: Alex Deucher Date: Wed Mar 4 17:24:10 2026 -0500 drm/amdgpu/mmhub2.3: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher (cherry picked from commit 89cd90375c19fb45138990b70e9f4ba4806f05c4) Cc: stable@vger.kernel.org commit 0b26edac4ac5535df1f63e6e8ab44c24fe1acad7 Author: Alex Deucher Date: Wed Mar 4 17:22:43 2026 -0500 drm/amdgpu/mmhub2.0: add bounds checking for cid The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng Signed-off-by: Alex Deucher (cherry picked from commit e064cef4b53552602bb6ac90399c18f662f3cacd) Cc: stable@vger.kernel.org commit 39f44f54afa58661ecae9c27e15f5dbce2372892 Author: Andy Nguyen Date: Sun Mar 15 17:51:47 2026 +0100 drm/amd: fix dcn 2.01 check The ASICREV_IS_BEIGE_GOBY_P check always took precedence, because it includes all chip revisions upto NV_UNKNOWN. Fixes: 54b822b3eac3 ("drm/amd/display: Use dce_version instead of chip_id") Signed-off-by: Andy Nguyen Signed-off-by: Alex Deucher (cherry picked from commit 9c7be0efa6f0daa949a5f3e3fdf9ea090b0713cb) commit 2323b019651ad81c20a0f7f817c63392b3110652 Author: Srinivasan Shanmugam Date: Sun Mar 15 18:30:26 2026 +0530 drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() parse_edid_displayid_vrr() searches the EDID extension blocks for a DisplayID extension before parsing the dynamic video timing range. The code previously checked whether edid_ext was NULL after the search loop. However, edid_ext is assigned during each iteration of the loop, so it will never be NULL once the loop has executed. If no DisplayID extension is found, edid_ext ends up pointing to the last extension block, and the NULL check does not correctly detect the failure case. Instead, check whether the loop completed without finding a matching DisplayID block by testing "i == edid->extensions". This ensures the function exits early when no DisplayID extension is present and avoids parsing an unrelated EDID extension block. Also simplify the EDID validation check using "!edid || !edid->extensions". Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:13079 parse_edid_displayid_vrr() warn: variable dereferenced before check 'edid_ext' (see line 13075) Fixes: a638b837d0e6 ("drm/amd/display: Fix refresh rate range for some panel") Cc: Roman Li Cc: Alex Hung Cc: Jerry Zuo Cc: Sun peng Li Cc: Tom Chung Cc: Dan Carpenter Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Tom Chung Signed-off-by: Alex Deucher (cherry picked from commit 91c7e6342e98c846b259c57273436fdea4c043f2) commit ebe82c6e75cfc547154d0fd843b0dd6cca3d548f Author: Xi Ruoyao Date: Fri Mar 6 14:28:03 2026 +0800 drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} [Why] The dcn32_override_min_req_memclk function is in dcn32_fpu.c, which is compiled with CC_FLAGS_FPU into FP instructions. So when we call it we must use DC_FP_{START,END} to save and restore the FP context, and prepare the FP unit on architectures like LoongArch where the FP unit isn't always on. Reported-by: LiarOnce Fixes: ee7be8f3de1c ("drm/amd/display: Limit DCN32 8 channel or less parts to DPM1 for FPO") Signed-off-by: Xi Ruoyao Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 25bb1d54ba3983c064361033a8ec15474fece37e) Cc: stable@vger.kernel.org commit 10718159890bc99cbcc7b5a38dade05df335e797 Author: Calvin Owens Date: Thu Mar 12 10:13:34 2026 -0700 drm/amd/display: Fix uninitialized variable use which breaks full LTO Commit e1b385726f7f ("drm/amd/display: Add additional checks for PSP footer size") introduced a use of an uninitialized stack variable in dm_dmub_sw_init() (region_params.bss_data_size). Interestingly, this seems to cause no issue on normal kernels. But when full LTO is enabled, it causes the compiler to "optimize" out huge swaths of amdgpu initialization code, and the driver is unusable: amdgpu 0000:03:00.0: [drm] Loading DMUB firmware via PSP: version=0x07002F00 amdgpu 0000:03:00.0: sw_init of IP block failed 5 amdgpu 0000:03:00.0: amdgpu_device_ip_init failed amdgpu 0000:03:00.0: Fatal error during GPU init It surprises me that neither gcc nor clang emit a warning about this: I only found it by bisecting the LTO breakage. Fix by using the bss_data_size field from fw_meta_info_params, as was presumably intended. Fixes: e1b385726f7f ("drm/amd/display: Add additional checks for PSP footer size") Signed-off-by: Calvin Owens Reviewed-by: Harry Wentland Reviewed-by: Nathan Chancellor Signed-off-by: Alex Deucher (cherry picked from commit b7f1402f6ad24cc6b9a01fa09ebd1c6559d787d0) commit 6270b1a5dab94665d7adce3dc78bc9066ed28bdd Author: Jesse.Zhang Date: Thu Mar 12 18:06:17 2026 +0800 drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Userspace can pass an arbitrary number of BO list entries via the bo_number field. Although the previous multiplication overflow check prevents out-of-bounds allocation, a large number of entries could still cause excessive memory allocation (up to potentially gigabytes) and unnecessarily long list processing times. Introduce a hard limit of 128k entries per BO list, which is more than sufficient for any realistic use case (e.g., a single list containing all buffers in a large scene). This prevents memory exhaustion attacks and ensures predictable performance. Return -EINVAL if the requested entry count exceeds the limit Reviewed-by: Christian König Suggested-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332) Cc: stable@vger.kernel.org commit b49814033cb5224c818cfb04dccb3260da10cc4f Author: Alex Hung Date: Wed Mar 11 15:18:37 2026 -0600 drm/amd/display: Fix gamma 2.2 colorop TFs Use GAMMA22 for degamma/blend and GAMMA22_INV for shaper so curves match the color pipeline. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5016 Tested-by: Xaver Hugl Reviewed-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit d8f9f42effd767ffa7bbcd7e05fbd6b20737e468) commit c465f5591aa84a6f85d66d152e28b92844a45d4f Author: Christian Brauner Date: Tue Mar 17 16:59:45 2026 +0100 selftests/mount_setattr: increase tmpfs size for idmapped mount tests The mount_setattr_idmapped fixture mounts a 2 MB tmpfs at /mnt and then creates a 2 GB sparse ext4 image at /mnt/C/ext4.img. While ftruncate() succeeds (sparse file), mkfs.ext4 needs to write actual metadata blocks (inode tables, journal, bitmaps) which easily exceeds the 2 MB tmpfs limit, causing ENOSPC and failing the fixture setup for all mount_setattr_idmapped tests. This was introduced by commit d37d4720c3e7 ("selftests/mount_settattr: ensure that ext4 filesystem can be created") which increased the image size from 2 MB to 2 GB but didn't adjust the tmpfs size. Bump the tmpfs size to 256 MB which is sufficient for the ext4 metadata. Fixes: d37d4720c3e7 ("selftests/mount_settattr: ensure that ext4 filesystem can be created") Signed-off-by: Christian Brauner commit 4221f30e3e0a2507641b3397d21aff9e71e749f8 Author: Hugo Villeneuve Date: Tue Mar 17 11:23:39 2026 -0400 regulator: dt-bindings: fix typos in regulator-uv-* descriptions Remove word "over". Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20260317152357.3473584-1-hugo@hugovil.com Signed-off-by: Mark Brown commit 21647677ba9af2cb6bc460e17d9f29a7132c40c3 Author: Koichiro Den Date: Mon Mar 16 23:02:25 2026 +0900 PCI: endpoint: pci-epf-test: Roll back BAR mapping when subrange setup fails When the BAR subrange mapping test on DWC-based platforms fails due to insufficient free inbound iATU regions, pci_epf_test_bar_subrange_setup() returns an error (-ENOSPC) but does not restore the original BAR mapping. This causes subsequent test runs to become confusing, since the failure may leave room for the next subrange mapping test to pass. Fix this by restoring the original BAR mapping when preparation of the subrange mapping fails, so that no side effect remains regardless of the test success or failure. Fixes: 6c5e6101423b ("PCI: endpoint: pci-epf-test: Add BAR subrange mapping test support") Reported-by: Christian Bruel Closes: https://lore.kernel.org/linux-pci/b2b03ebe-9482-4a13-b22f-7b44da096eed@foss.st.com/ Signed-off-by: Koichiro Den Signed-off-by: Bjorn Helgaas Tested-by: Christian Bruel Reviewed-by: Niklas Cassel Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260316140225.1481658-1-den@valinux.co.jp commit 67253b28a61f0dff31f8f00dca8c9586f089b852 Author: Jonathan Cavitt Date: Mon Mar 16 15:15:56 2026 +0000 drm/pagemap_util: Ensure proper cache lock management on free For the sake of consistency, ensure that the cache lock is always unlocked after drm_pagemap_cache_fini. Spinlocks typically disable preemption and if the code-path missing the unlock is hit, preemption will remain disabled even if the lock is subsequently freed. Fixes static analysis issue. v2: - Use requested code flow (Maarten) v3: - Clear cache->dpagemap (Matt Brost, Maarten) v4: - Reword commit message (Thomas) Fixes: 77f14f2f2d73f ("drm/pagemap: Add a drm_pagemap cache and shrinker") Signed-off-by: Jonathan Cavitt Reviewed-by: Thomas Hellström Reviewed-by: Maarten Lankhorst Cc: Thomas Hellstrom Cc: Matthew Brost Cc: Maarten Lankhorst Signed-off-by: Thomas Hellström Link: https://patch.msgid.link/20260316151555.7553-2-jonathan.cavitt@intel.com commit f200b2f9a810c440c6750b56fc647b73337749a1 Author: Vee Satayamas Date: Sun Mar 15 21:25:12 2026 +0700 ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA Add a DMI quirk for the Asus Expertbook BM1403CDA to resolve the issue of the internal microphone not being detected. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221236 Signed-off-by: Vee Satayamas Reviewed-by: Zhang Heng Link: https://patch.msgid.link/20260315142511.66029-2-vsatayamas@gmail.com Signed-off-by: Mark Brown commit 0e01c3416eb863ee7f156a9d7e7421ec0a9f68a0 Author: Frej Drejhammar Date: Sun Feb 22 18:00:42 2026 +0100 USB: serial: io_edgeport: add support for Blackbox IC135A The Blackbox 724-746-5500 USB Director USB-RS-232 HUB, part number IC135A, is a rebadged Edgeport/4 with its own USB device id. Signed-off-by: Frej Drejhammar Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 74ef7844dd8c27d6b94ebc102bb4677edd3e7696 Author: Alessio Belle Date: Tue Mar 10 11:41:12 2026 +0000 drm/imagination: Disable interrupts before suspending the GPU This is an additional safety layer to ensure no accesses to the GPU registers can be made while it is powered off. While we can disable IRQ generation from GPU, META firmware, MIPS firmware and for safety events, we cannot do the same for the RISC-V firmware. To keep a unified approach, once the firmware has completed its power off sequence, disable IRQs for the while GPU at the kernel level instead. Signed-off-by: Alessio Belle Reviewed-by: Matt Coster Link: https://patch.msgid.link/20260310-drain-irqs-before-suspend-v1-2-bf4f9ed68e75@imgtec.com Signed-off-by: Matt Coster commit 2d7f05cddf4c268cc36256a2476946041dbdd36d Author: Alessio Belle Date: Tue Mar 10 11:41:11 2026 +0000 drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to kernel crashes when trying to access GPU registers. See example signature below. In a power off sequence initiated by the runtime PM suspend callback, wait for any IRQ handlers in progress on other CPU cores to finish, by calling synchronize_irq(). At the same time, remove the runtime PM resume/put calls in the threaded IRQ handler. On top of not being the right approach to begin with, and being at the wrong place as they should have wrapped all GPU register accesses, the driver would hit a deadlock between synchronize_irq() being called from a runtime PM suspend callback, holding the device power lock, and the resume callback requiring the same. Example crash signature on a TI AM68 SK platform: [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241246] Tainted: [M]=MACHINE_CHECK [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24 [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310 [ 337.241282] sp : ffff800085b0bd30 [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10 [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000 [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30 [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001 [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40 [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00 [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003 [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000 [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000 [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241342] Tainted: [M]=MACHINE_CHECK [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241345] Call trace: [ 337.241348] show_stack+0x18/0x24 (C) [ 337.241357] dump_stack_lvl+0x60/0x80 [ 337.241364] dump_stack+0x18/0x24 [ 337.241368] vpanic+0x124/0x2ec [ 337.241373] abort+0x0/0x4 [ 337.241377] add_taint+0x0/0xbc [ 337.241384] arm64_serror_panic+0x70/0x80 [ 337.241389] do_serror+0x3c/0x74 [ 337.241392] el1h_64_error_handler+0x30/0x48 [ 337.241400] el1h_64_error+0x6c/0x70 [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P) [ 337.241410] irq_thread_fn+0x2c/0xb0 [ 337.241416] irq_thread+0x170/0x334 [ 337.241421] kthread+0x12c/0x210 [ 337.241428] ret_from_fork+0x10/0x20 [ 337.241434] SMP: stopping secondary CPUs [ 337.241451] Kernel Offset: disabled [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b [ 337.241456] Memory Limit: none [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]--- Fixes: cc1aeedb98ad ("drm/imagination: Implement firmware infrastructure and META FW support") Fixes: 96822d38ff57 ("drm/imagination: Handle Rogue safety event IRQs") Cc: stable@vger.kernel.org # see patch description, needs adjustments for < 6.16 Signed-off-by: Alessio Belle Reviewed-by: Matt Coster Link: https://patch.msgid.link/20260310-drain-irqs-before-suspend-v1-1-bf4f9ed68e75@imgtec.com Signed-off-by: Matt Coster commit a55c2a5c8d680156495b7b1e2a9f5a3e313ba524 Author: Alessio Belle Date: Mon Mar 9 15:23:48 2026 +0000 drm/imagination: Fix deadlock in soft reset sequence The soft reset sequence is currently executed from the threaded IRQ handler, hence it cannot call disable_irq() which internally waits for IRQ handlers, i.e. itself, to complete. Use disable_irq_nosync() during a soft reset instead. Fixes: cc1aeedb98ad ("drm/imagination: Implement firmware infrastructure and META FW support") Cc: stable@vger.kernel.org Signed-off-by: Alessio Belle Reviewed-by: Matt Coster Link: https://patch.msgid.link/20260309-fix-soft-reset-v1-1-121113be554f@imgtec.com Signed-off-by: Matt Coster commit f8b8820a4a16c4ef673e90ded41e8348514e53f0 Author: Christoph Hellwig Date: Tue Mar 17 14:44:04 2026 +0100 fs: clear I_DIRTY_TIME in sync_lazytime For file systems implementing ->sync_lazytime, I_DIRTY_TIME fails to get cleared in sync_lazytime, and might cause additional calls to sync_lazytime during inode deactivation. Use the same pattern as in __mark_inode_dirty to clear the flag under the inode lock. Fixes: 5cf06ea56ee6 ("fs: add a ->sync_lazytime method") Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260317134409.1691317-1-hch@lst.de Signed-off-by: Christian Brauner commit 01e8d0f742222f1e68f48180d5480097adf7ae9f Author: Wanquan Zhong Date: Mon Mar 16 19:55:12 2026 +0800 USB: serial: option: add support for Rolling Wireless RW135R-GL Add VID/PID 33f8:1003 for the Rolling Wireless RW135R-GL M.2 module, which is used in laptop debug cards with MBIM interface for Linux/Chrome OS. The device supports mbim, pipe functionalities. Here are the outputs of usb-devices: T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=1003 Rev=05.15 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW135R-GL Module S: SerialNumber=12345678 C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms Signed-off-by: Wanquan Zhong Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 0496acc42fb51eee040b5170cec05cec41385540 Author: Zenghui Yu (Huawei) Date: Tue Mar 17 19:57:48 2026 +0800 KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() Using "(u64 __user *)hva + offset" to get the virtual addresses of S1/S2 descriptors looks really wrong, if offset is not zero. What we want to get for swapping is hva + offset, not hva + offset*8. ;-) Fix it. Fixes: f6927b41d573 ("KVM: arm64: Add helper for swapping guest descriptor") Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260317115748.47332-1-zenghui.yu@linux.dev Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit ba17de98545d07285d15ce4fe2afe98283338fb0 Author: Joe Damato Date: Mon Mar 9 16:52:33 2026 -0700 iommu/amd: Block identity domain when SNP enabled Previously, commit 8388f7df936b ("iommu/amd: Do not support IOMMU_DOMAIN_IDENTITY after SNP is enabled") prevented users from changing the IOMMU domain to identity if SNP was enabled. This resulted in an error when writing to sysfs: # echo "identity" > /sys/kernel/iommu_groups/50/type -bash: echo: write error: Cannot allocate memory However, commit 4402f2627d30 ("iommu/amd: Implement global identity domain") changed the flow of the code, skipping the SNP guard and allowing users to change the IOMMU domain to identity after a machine has booted. Once the user does that, they will probably try to bind and the device/driver will start to do DMA which will trigger errors: iommu ivhd3: AMD-Vi: Event logged [ILLEGAL_DEV_TABLE_ENTRY device=0000:43:00.0 pasid=0x00000 address=0x3737b01000 flags=0x0020] iommu ivhd3: AMD-Vi: Control Reg : 0xc22000142148d AMD-Vi: DTE[0]: 6000000000000003 AMD-Vi: DTE[1]: 0000000000000001 AMD-Vi: DTE[2]: 2000003088b3e013 AMD-Vi: DTE[3]: 0000000000000000 bnxt_en 0000:43:00.0 (unnamed net_device) (uninitialized): Error (timeout: 500015) msg {0x0 0x0} len:0 iommu ivhd3: AMD-Vi: Event logged [ILLEGAL_DEV_TABLE_ENTRY device=0000:43:00.0 pasid=0x00000 address=0x3737b01000 flags=0x0020] iommu ivhd3: AMD-Vi: Control Reg : 0xc22000142148d AMD-Vi: DTE[0]: 6000000000000003 AMD-Vi: DTE[1]: 0000000000000001 AMD-Vi: DTE[2]: 2000003088b3e013 AMD-Vi: DTE[3]: 0000000000000000 bnxt_en 0000:43:00.0: probe with driver bnxt_en failed with error -16 To prevent this from happening, create an attach wrapper for identity_domain_ops which returns EINVAL if amd_iommu_snp_en is true. With this commit applied: # echo "identity" > /sys/kernel/iommu_groups/62/type -bash: echo: write error: Invalid argument Fixes: 4402f2627d30 ("iommu/amd: Implement global identity domain") Signed-off-by: Joe Damato Reviewed-by: Vasant Hegde Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 06e14c36e20b48171df13d51b89fe67c594ed07a Author: Lizhi Hou Date: Wed Mar 4 22:18:42 2026 -0800 iommu/sva: Fix crash in iommu_sva_unbind_device() domain->mm->iommu_mm can be freed by iommu_domain_free(): iommu_domain_free() mmdrop() __mmdrop() mm_pasid_drop() After iommu_domain_free() returns, accessing domain->mm->iommu_mm may dereference a freed mm structure, leading to a crash. Fix this by moving the code that accesses domain->mm->iommu_mm to before the call to iommu_domain_free(). Fixes: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space") Signed-off-by: Lizhi Hou Reviewed-by: Jason Gunthorpe Reviewed-by: Yi Liu Reviewed-by: Vasant Hegde Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit 45c6a2dc7ec8339052666b06065c521a10cc29bb Author: Randy Dunlap Date: Sun Mar 1 16:52:14 2026 -0800 iommu/io-pgtable: fix all kernel-doc warnings in io-pgtable.h Avoid kernel-doc warnings in io-pgtable.h: - use the correct struct member names or kernel-doc format - add a missing struct member description - add a missing function return comment section Warning: include/linux/io-pgtable.h:187 struct member 'coherent_walk' not described in 'io_pgtable_cfg' Warning: include/linux/io-pgtable.h:187 struct member 'arm_lpae_s1_cfg' not described in 'io_pgtable_cfg' Warning: include/linux/io-pgtable.h:187 struct member 'arm_lpae_s2_cfg' not described in 'io_pgtable_cfg' Warning: include/linux/io-pgtable.h:187 struct member 'arm_v7s_cfg' not described in 'io_pgtable_cfg' Warning: include/linux/io-pgtable.h:187 struct member 'arm_mali_lpae_cfg' not described in 'io_pgtable_cfg' Warning: include/linux/io-pgtable.h:187 struct member 'apple_dart_cfg' not described in 'io_pgtable_cfg' Warning: include/linux/io-pgtable.h:187 struct member 'amd' not described in 'io_pgtable_cfg' Warning: include/linux/io-pgtable.h:223 struct member 'read_and_clear_dirty' not described in 'io_pgtable_ops' Warning: include/linux/io-pgtable.h:237 No description found for return value of 'alloc_io_pgtable_ops' Signed-off-by: Randy Dunlap Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 069c8f5aebe4d5224cf62acc7d4b3486091c658a Author: Nikola Z. Ivanov Date: Fri Mar 13 16:16:43 2026 +0200 net: usb: aqc111: Do not perform PM inside suspend callback syzbot reports "task hung in rpm_resume" This is caused by aqc111_suspend calling the PM variant of its write_cmd routine. The simplified call trace looks like this: rpm_suspend() usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPENDING aqc111_suspend() - called for the usb device interface aqc111_write32_cmd() usb_autopm_get_interface() pm_runtime_resume_and_get() rpm_resume() - here we call rpm_resume() on our parent rpm_resume() - Here we wait for a status change that will never happen. At this point we block another task which holds rtnl_lock and locks up the whole networking stack. Fix this by replacing the write_cmd calls with their _nopm variants Reported-by: syzbot+48dc1e8dfc92faf1124c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=48dc1e8dfc92faf1124c Fixes: e58ba4544c77 ("net: usb: aqc111: Add support for wake on LAN by MAGIC packet") Signed-off-by: Nikola Z. Ivanov Link: https://patch.msgid.link/20260313141643.1181386-1-zlatistiv@gmail.com Signed-off-by: Paolo Abeni commit 0a4d00e2e99a39a5698e4b63c394415dcbb39d90 Author: Antheas Kapenekakis Date: Fri Feb 27 09:06:37 2026 +0100 iommu: Fix mapping check for 0x0 to avoid re-mapping it Commit 789a5913b29c ("iommu/amd: Use the generic iommu page table") introduces the shared iommu page table for AMD IOMMU. Some bioses contain an identity mapping for address 0x0, which is not parsed properly (e.g., certain Strix Halo devices). This causes the DMA components of the device to fail to initialize (e.g., the NVMe SSD controller), leading to a failed post. Specifically, on the GPD Win 5, the NVME and SSD GPU fail to mount, making collecting errors difficult. While debugging, it was found that a -EADDRINUSE error was emitted and its source was traced to iommu_iova_to_phys(). After adding some debug prints, it was found that phys_addr becomes 0, which causes the code to try to re-map the 0 address and fail, causing a cascade leading to a failed post. This is because the GPD Win 5 contains a 0x0-0x1 identity mapping for DMA devices, causing it to be repeated for each device. The cause of this failure is the following check in iommu_create_device_direct_mappings(), where address aliasing is handled via the following check: ``` phys_addr = iommu_iova_to_phys(domain, addr); if (!phys_addr) { map_size += pg_size; continue; } ```` Obviously, the iommu_iova_to_phys() signature is faulty and aliases unmapped and 0 together, causing the allocation code to try to re-allocate the 0 address per device. However, it has too many instantiations to fix. Therefore, use a ternary so that when addr is 0, the check is done for address 1 instead. Suggested-by: Robin Murphy Fixes: 789a5913b29c ("iommu/amd: Use the generic iommu page table") Signed-off-by: Antheas Kapenekakis Reviewed-by: Vasant Hegde Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 4eae391a8e4cb065b900afcb95a3b0f97c75184d Author: Sebastian Reichel Date: Mon Mar 16 19:23:00 2026 +0100 ASoC: dt-bindings: rockchip: Add compatible for RK3576 SPDIF Add a compatible string for SPDIF on RK3576, which is similar to the one on RK3568. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260316-rk3576-spdif-v1-1-acb75088b560@collabora.com Signed-off-by: Mark Brown commit 39c20c4e83b9f78988541d829aa34668904e54a0 Author: Lu Baolu Date: Mon Mar 16 15:16:40 2026 +0800 iommu/vt-d: Only handle IOPF for SVA when PRI is supported In intel_svm_set_dev_pasid(), the driver unconditionally manages the IOPF handling during a domain transition. However, commit a86fb7717320 ("iommu/vt-d: Allow SVA with device-specific IOPF") introduced support for SVA on devices that handle page faults internally without utilizing the PCI PRI. On such devices, the IOMMU-side IOPF infrastructure is not required. Calling iopf_for_domain_replace() on these devices is incorrect and can lead to unexpected failures during PASID attachment or unwinding. Add a check for info->pri_supported to ensure that the IOPF queue logic is only invoked for devices that actually rely on the IOMMU's PRI-based fault handling. Fixes: 17fce9d2336d ("iommu/vt-d: Put iopf enablement in domain attach path") Cc: stable@vger.kernel.org Suggested-by: Kevin Tian Reviewed-by: Kevin Tian Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20260310075520.295104-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit fe89277c9ceb0d6af0aa665bcf24a41d8b1b79cd Author: Guanghui Feng Date: Mon Mar 16 15:16:39 2026 +0800 iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry During the qi_check_fault process after an IOMMU ITE event, requests at odd-numbered positions in the queue are set to QI_ABORT, only satisfying single-request submissions. However, qi_submit_sync now supports multiple simultaneous submissions, and can't guarantee that the wait_desc will be at an odd-numbered position. Therefore, if an item times out, IOMMU can't re-initiate the request, resulting in an infinite polling wait. This modifies the process by setting the status of all requests already fetched by IOMMU and recorded as QI_IN_USE status (including wait_desc requests) to QI_ABORT, thus enabling multiple requests to be resubmitted. Fixes: 8a1d82462540 ("iommu/vt-d: Multiple descriptors per qi_submit_sync()") Cc: stable@vger.kernel.org Signed-off-by: Guanghui Feng Tested-by: Shuai Xue Reviewed-by: Shuai Xue Reviewed-by: Samiullah Khawaja Link: https://lore.kernel.org/r/20260306101516.3885775-1-guanghuifeng@linux.alibaba.com Signed-off-by: Lu Baolu Fixes: 8a1d82462540 ("iommu/vt-d: Multiple descriptors per qi_submit_sync()") Signed-off-by: Joerg Roedel commit 769cafe477248a296cbf227bd6d8fddb7e00e020 Merge: f338e77383789c 73a505dc48144e Author: Greg Kroah-Hartman Date: Tue Mar 17 12:54:22 2026 +0100 Merge tag 'thunderbolt-for-v7.0-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fix for v7.0-rc5 This includes a single fix that reverses the check for return value of device_property_read_u8() during the driver load. This has been in linux-next with no reported issues. * tag 'thunderbolt-for-v7.0-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Fix property read in nhi_wake_supported() commit a0671125d4f55e1e98d9bde8a0b671941987e208 Author: Daniel Borkmann Date: Fri Mar 13 07:55:31 2026 +0100 clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry. The latter is achieved by first fully initializing a clsact instance, and then in a second step having a replacement failure for the new clsact qdisc instance. clsact_init() initializes ingress first and then takes care of the egress part. This can fail midway, for example, via tcf_block_get_ext(). Upon failure, the kernel will trigger the clsact_destroy() callback. Commit 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") details the way how the transition is happening. If tcf_block_get_ext on the q->ingress_block ends up failing, we took the tcx_miniq_inc reference count on the ingress side, but not yet on the egress side. clsact_destroy() tests whether the {ingress,egress}_entry was non-NULL. However, even in midway failure on the replacement, both are in fact non-NULL with a valid egress_entry from the previous clsact instance. What we really need to test for is whether the qdisc instance-specific ingress or egress side previously got initialized. This adds a small helper for checking the miniq initialization called mini_qdisc_pair_inited, and utilizes that upon clsact_destroy() in order to fix the use-after-free scenario. Convert the ingress_destroy() side as well so both are consistent to each other. Fixes: 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") Reported-by: Keenan Dong Signed-off-by: Daniel Borkmann Cc: Martin KaFai Lau Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20260313065531.98639-1-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit a17ce4bc6f4f9acf77ba416c36791a15602e53aa Author: Tomi Valkeinen Date: Wed Mar 11 07:34:46 2026 +0200 dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA A single AXIDMA controller can have one or two channels. When it has two channels, the reset for both are tied together: resetting one channel resets the other as well. This creates a problem where resetting one channel will reset the registers for both channels, including clearing interrupt enable bits for the other channel, which can then lead to timeouts as the driver is waiting for an interrupt which never comes. The driver currently has a probe-time work around for this: when a channel is created, the driver also resets and enables the interrupts. With two channels the reset for the second channel will clear the interrupt enables for the first one. The work around in the driver is just to manually enable the interrupts again in xilinx_dma_alloc_chan_resources(). This workaround only addresses the probe-time issue. When channels are reset at runtime (e.g., in xilinx_dma_terminate_all() or during error recovery), there's no corresponding mechanism to restore the other channel's interrupt enables. This leads to one channel having its interrupts disabled while the driver expects them to work, causing timeouts and DMA failures. A proper fix is a complicated matter, as we should not reset the other channel when it's operating normally. So, perhaps, there should be some kind of synchronization for a common reset, which is not trivial to implement. To add to the complexity, the driver also supports other DMA types, like VDMA, CDMA and MCDMA, which don't have a shared reset. However, when the two-channel AXIDMA is used in the (assumably) normal use case, providing DMA for a single memory-to-memory device, the common reset is a bit smaller issue: when something bad happens on one channel, or when one channel is terminated, the assumption is that we also want to terminate the other channel. And thus resetting both at the same time is "ok". With that line of thinking we can implement a bit better work around than just the current probe time work around: let's enable the AXIDMA interrupts at xilinx_dma_start_transfer() instead. This ensures interrupts are enabled whenever a transfer starts, regardless of any prior resets that may have cleared them. This approach is also more logical: enable interrupts only when needed for a transfer, rather than at resource allocation time, and, I think, all the other DMA types should also use this model, but I'm reluctant to do such changes as I cannot test them. The reset function still enables interrupts even though it's not needed for AXIDMA anymore, but it's common code for all DMA types (VDMA, CDMA, MCDMA), so leave it unchanged to avoid affecting other variants. Signed-off-by: Tomi Valkeinen Fixes: c0bba3a99f07 ("dmaengine: vdma: Add Support for Xilinx AXI Direct Memory Access Engine") Link: https://patch.msgid.link/20260311-xilinx-dma-fix-v2-1-a725abb66e3c@ideasonboard.com Signed-off-by: Vinod Koul commit c7d812e33f3e8ca0fa9eeabf71d1c7bc3acedc09 Author: Marek Vasut Date: Mon Mar 16 23:25:24 2026 +0100 dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction The segment .control and .status fields both contain top bits which are not part of the buffer size, the buffer size is located only in the bottom max_buffer_len bits. To avoid interference from those top bits, mask out the size using max_buffer_len first, and only then subtract the values. Fixes: a575d0b4e663 ("dmaengine: xilinx_dma: Introduce xilinx_dma_get_residue") Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260316222530.163815-1-marex@nabladev.com Signed-off-by: Vinod Koul commit f61d145999d61948a23cd436ebbfa4c3b9ab8987 Author: Marek Vasut Date: Mon Mar 16 23:18:57 2026 +0100 dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA The cyclic DMA calculation is currently entirely broken and reports residue only for the first segment. The problem is twofold. First, when the first descriptor finishes, it is moved from active_list to done_list, but it is never returned back into the active_list. The xilinx_dma_tx_status() expects the descriptor to be in the active_list to report any meaningful residue information, which never happens after the first descriptor finishes. Fix this up in xilinx_dma_start_transfer() and if the descriptor is cyclic, lift it from done_list and place it back into active_list list. Second, the segment .status fields of the descriptor remain dirty. Once the DMA did one pass on the descriptor, the .status fields are populated with data by the DMA, but the .status fields are not cleared before reuse during the next cyclic DMA round. The xilinx_dma_get_residue() recognizes that as if the descriptor was complete and had 0 residue, which is bogus. Reinitialize the status field before placing the descriptor back into the active_list. Fixes: c0bba3a99f07 ("dmaengine: vdma: Add Support for Xilinx AXI Direct Memory Access Engine") Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260316221943.160375-1-marex@nabladev.com Signed-off-by: Vinod Koul commit e9cc95397bb7da13fe8a5b53a2f23cfaf9018ade Author: Marek Vasut Date: Mon Mar 16 23:16:54 2026 +0100 dmaengine: xilinx: xilinx_dma: Fix dma_device directions Unlike chan->direction , struct dma_device .directions field is a bitfield. Turn chan->direction into a bitfield to make it compatible with struct dma_device .directions . Fixes: 7e01511443c3 ("dmaengine: xilinx_dma: Set dma_device directions") Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260316221728.160139-1-marex@nabladev.com Signed-off-by: Vinod Koul commit d849a2f7309fc0616e79d13b008b0a47e0458b6e Author: Paul Moses Date: Mon Mar 16 14:56:51 2026 +0000 xfrm: iptfs: only publish mode_data after clone setup iptfs_clone_state() stores x->mode_data before allocating the reorder window. If that allocation fails, the code frees the cloned state and returns -ENOMEM, leaving x->mode_data pointing at freed memory. The xfrm clone unwind later runs destroy_state() through x->mode_data, so the failed clone path tears down IPTFS state that clone_state() already freed. Keep the cloned IPTFS state private until all allocations succeed so failed clones leave x->mode_data unset. The destroy path already handles a NULL mode_data pointer. Fixes: 6be02e3e4f37 ("xfrm: iptfs: handle reordering of received packets") Cc: stable@vger.kernel.org Signed-off-by: Paul Moses Signed-off-by: Steffen Klassert commit b17b79ff896305fd74980a5f72afec370ee88ca4 Author: ZhengYuan Huang Date: Thu Mar 12 08:14:43 2026 +0800 btrfs: reject root items with drop_progress and zero drop_level [BUG] When recovering relocation at mount time, merge_reloc_root() and btrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against an impossible state: a non-zero drop_progress combined with a zero drop_level in a root_item, which can be triggered: ------------[ cut here ]------------ kernel BUG at fs/btrfs/relocation.c:1545! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2 RIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545 Code: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000 Call Trace: merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861 btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195 btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130 open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640 btrfs_fill_super fs/btrfs/super.c:987 [inline] btrfs_get_tree_super fs/btrfs/super.c:1951 [inline] btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline] btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128 vfs_get_tree+0x9a/0x370 fs/super.c:1758 fc_mount fs/namespace.c:1199 [inline] do_new_mount_fc fs/namespace.c:3642 [inline] do_new_mount fs/namespace.c:3718 [inline] path_mount+0x5b8/0x1ea0 fs/namespace.c:4028 do_mount fs/namespace.c:4041 [inline] __do_sys_mount fs/namespace.c:4229 [inline] __se_sys_mount fs/namespace.c:4206 [inline] __x64_sys_mount+0x282/0x320 fs/namespace.c:4206 ... RIP: 0033:0x7f969c9a8fde Code: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f ---[ end trace 0000000000000000 ]--- The bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic metadata fuzzing tool that corrupts btrfs metadata at runtime. [CAUSE] A non-zero drop_progress.objectid means an interrupted btrfs_drop_snapshot() left a resume point on disk, and in that case drop_level must be greater than 0 because the checkpoint is only saved at internal node levels. Although this invariant is enforced when the kernel writes the root item, it is not validated when the root item is read back from disk. That allows on-disk corruption to provide an invalid state with drop_progress.objectid != 0 and drop_level == 0. When relocation recovery later processes such a root item, merge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The same invalid metadata can also trigger the corresponding BUG_ON() in btrfs_drop_snapshot(). [FIX] Fix this by validating the root_item invariant in tree-checker when reading root items from disk: if drop_progress.objectid is non-zero, drop_level must also be non-zero. Reject such malformed metadata with -EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot() and triggers the BUG_ON. After the fix, the same corruption is correctly rejected by tree-checker and the BUG_ON is no longer triggered. Reviewed-by: Qu Wenruo Signed-off-by: ZhengYuan Huang Signed-off-by: David Sterba commit adbb0ebacc3223a2dc2e58ef3d4c10f5e9653f09 Author: Mark Harmstone Date: Thu Feb 19 19:19:00 2026 +0000 btrfs: check block group before marking it unused in balance_remap_chunks() Fix a potential segfault in balance_remap_chunks(): if we quit early because btrfs_inc_block_group_ro() fails, all the remaining items in the chunks list will still have their bg value set to NULL. It's thus not safe to dereference this pointer without checking first. Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260125120717.1578828-1-clm@meta.com/ Fixes: 81e5a4551c32 ("btrfs: allow balancing remap tree") Reviewed-by: Johannes Thumshirn Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 057495ccc0ad381015b45d3edf995c2b6b982474 Author: Mark Harmstone Date: Thu Feb 19 17:03:53 2026 +0000 btrfs: hold block group reference during entire move_existing_remap() There is a potential use-after-free in move_existing_remap(): we're calling btrfs_put_block_group() on dest_bg, then passing it to btrfs_add_block_group_free_space() a few lines later. Fix this by getting the BG at the start of the function and putting it near the end. This also means we're not doing a lookup twice for the same thing. Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260125123908.2096548-1-clm@meta.com/ Fixes: bbea42dfb91f ("btrfs: move existing remaps before relocating block group") Reviewed-by: Johannes Thumshirn Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5118130e722b1261a2e92b2fb0b067463c39ecc7 Author: Qu Wenruo Date: Thu Feb 19 18:51:14 2026 +1030 btrfs: fix an incorrect ASSERT() condition inside lzo_decompress_bio() [BUG] When running btrfs/284 with 64K page size and 4K fs block size, it crashes with the following ASSERT() triggered: BTRFS info (device dm-3): use lzo compression, level 1 assertion failed: folio_size(fi.folio) == sectorsize :: 0, in lzo.c:450 ------------[ cut here ]------------ kernel BUG at lzo.c:450! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 4 UID: 0 PID: 329 Comm: kworker/u37:2 Tainted: G OE 6.19.0-rc8-custom+ #185 PREEMPT(voluntary) Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: btrfs-endio simple_end_io_work [btrfs] pc : lzo_decompress_bio+0x61c/0x630 [btrfs] lr : lzo_decompress_bio+0x61c/0x630 [btrfs] Call trace: lzo_decompress_bio+0x61c/0x630 [btrfs] (P) end_bbio_compressed_read+0x2a8/0x2c0 [btrfs] btrfs_bio_end_io+0xc4/0x258 [btrfs] btrfs_check_read_bio+0x424/0x7e0 [btrfs] simple_end_io_work+0x40/0xa8 [btrfs] process_one_work+0x168/0x3f0 worker_thread+0x25c/0x398 kthread+0x154/0x250 ret_from_fork+0x10/0x20 Code: 912a2021 b0000e00 91246000 940244e9 (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] Commit 37cc07cab7dc ("btrfs: lzo: use folio_iter to handle lzo_decompress_bio()") added the ASSERT() to make sure the folio size matches the fs block size. But the check is completely wrong, the original intention is to make sure for bs > ps cases, we always got a large folio that covers a full fs block. However for bs < ps cases, a folio can never be smaller than page size, and the ASSERT() gets triggered immediately. [FIX] Check the folio size against @min_folio_size instead, which will never be smaller than PAGE_SIZE, and still cover bs > ps cases. Fixes: 37cc07cab7dc ("btrfs: lzo: use folio_iter to handle lzo_decompress_bio()") Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 96a2d235896b53291efc6d5c3de030e570f77070 Author: Qu Wenruo Date: Thu Feb 19 18:51:13 2026 +1030 btrfs: fix an incorrect ASSERT() condition inside zstd_decompress_bio() [BUG] When running btrfs/284 with 64K page size and 4K fs block size, it crashes with the following ASSERT() triggered: assertion failed: folio_size(fi.folio) == blocksize :: 0, in fs/btrfs/zstd.c:603 ------------[ cut here ]------------ kernel BUG at fs/btrfs/zstd.c:603! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 2 UID: 0 PID: 1183 Comm: kworker/u35:4 Not tainted 6.19.0-rc8-custom+ #185 PREEMPT(voluntary) Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: btrfs-endio simple_end_io_work [btrfs] pc : zstd_decompress_bio+0x4f0/0x508 [btrfs] lr : zstd_decompress_bio+0x4f0/0x508 [btrfs] Call trace: zstd_decompress_bio+0x4f0/0x508 [btrfs] (P) end_bbio_compressed_read+0x260/0x2c0 [btrfs] btrfs_bio_end_io+0xc4/0x258 [btrfs] btrfs_check_read_bio+0x424/0x7e0 [btrfs] simple_end_io_work+0x40/0xa8 [btrfs] process_one_work+0x168/0x3f0 worker_thread+0x25c/0x398 kthread+0x154/0x250 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- [CAUSE] Commit 1914b94231e9 ("btrfs: zstd: use folio_iter to handle zstd_decompress_bio()") added the ASSERT() to make sure the folio size matches the fs block size. But the check is completely wrong, the original intention is to make sure for bs > ps cases, we always got a large folio that covers a full fs block. However for bs < ps cases, a folio can never be smaller than page size, and the ASSERT() gets triggered immediately. [FIX] Check the folio size against @min_folio_size instead, which will never be smaller than PAGE_SIZE, and still cover bs > ps cases. Fixes: 1914b94231e9 ("btrfs: zstd: use folio_iter to handle zstd_decompress_bio()") Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3adf8f14152fba1cae51f9b0d3570a1da2153b16 Author: Qu Wenruo Date: Thu Feb 19 18:51:12 2026 +1030 btrfs: do not touch page cache for encoded writes [BUG] When running btrfs/284, the following ASSERT() will be triggered with 64K page size and 4K fs block size: assertion failed: folio_test_writeback(folio) :: 0, in subpage.c:476 ------------[ cut here ]------------ kernel BUG at subpage.c:476! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 4 UID: 0 PID: 2313 Comm: kworker/u37:2 Tainted: G OE 6.19.0-rc8-custom+ #185 PREEMPT(voluntary) Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: btrfs-endio simple_end_io_work [btrfs] pc : btrfs_subpage_clear_writeback+0x148/0x160 [btrfs] lr : btrfs_subpage_clear_writeback+0x148/0x160 [btrfs] Call trace: btrfs_subpage_clear_writeback+0x148/0x160 [btrfs] (P) btrfs_folio_clamp_clear_writeback+0xb4/0xd0 [btrfs] end_compressed_writeback+0xe0/0x1e0 [btrfs] end_bbio_compressed_write+0x1e8/0x218 [btrfs] btrfs_bio_end_io+0x108/0x258 [btrfs] simple_end_io_work+0x68/0xa8 [btrfs] process_one_work+0x168/0x3f0 worker_thread+0x25c/0x398 kthread+0x154/0x250 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- [CAUSE] The offending bio is from an encoded write, where the compressed data is directly written as a data extent, without touching the page cache. However the encoded write still utilizes the regular buffered write path for compressed data, by setting the compressed_bio::writeback flag. When that flag is set, at end_bbio_compressed_write() btrfs will go clearing the writeback flag of the folios in the page cache. However for bs < ps cases, the subpage helper has one extra check to make sure the folio has a writeback flag set in the first place. But since it's an encoded write, we never go through page cache, thus the folio has no writeback flag and triggers the ASSERT(). [FIX] Do not set compressed_bio::writeback flag for encoded writes, and change the ASSERT() in btrfs_submit_compressed_write() to make sure that flag is not set. Fixes: e1bc83f8b157 ("btrfs: get rid of compressed_folios[] usage for encoded writes") Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 65ee6061388b334c341fd37c22ec9149417f6ccf Author: Qu Wenruo Date: Thu Feb 19 18:51:11 2026 +1030 btrfs: fix a bug that makes encoded write bio larger than expected [BUG] When running btrfs/284 with 64K page size and 4K fs block size, the following ASSERT() can be triggered: assertion failed: cb->bbio.bio.bi_iter.bi_size == disk_num_bytes :: 0, in inode.c:9991 ------------[ cut here ]------------ kernel BUG at inode.c:9991! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 5 UID: 0 PID: 6787 Comm: btrfs Tainted: G OE 6.19.0-rc8-custom+ #1 PREEMPT(voluntary) Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 pc : btrfs_do_encoded_write+0x9b0/0x9c0 [btrfs] lr : btrfs_do_encoded_write+0x9b0/0x9c0 [btrfs] Call trace: btrfs_do_encoded_write+0x9b0/0x9c0 [btrfs] (P) btrfs_do_write_iter+0x1d8/0x208 [btrfs] btrfs_ioctl_encoded_write+0x3c8/0x6d0 [btrfs] btrfs_ioctl+0xeb0/0x2b60 [btrfs] __arm64_sys_ioctl+0xac/0x110 invoke_syscall.constprop.0+0x64/0xe8 el0_svc_common.constprop.0+0x40/0xe8 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x1b8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1a4/0x1a8 Code: 91180021 90001080 9111a000 94039d54 (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] After commit e1bc83f8b157 ("btrfs: get rid of compressed_folios[] usage for encoded writes"), the encoded write is changed to copy the content from the iov into a folio, and queue the folio into the compressed bio. However we always queue the full folio into the compressed bio, which can make the compressed bio larger than the on-disk extent, if the folio size is larger than the fs block size. Although we have an ASSERT() to catch such problem, for kernels without CONFIG_BTRFS_ASSERT, such larger than expected bio will just be submitted, possibly overwrite the next data extent, causing data corruption. [FIX] Instead of blindly queuing the full folio into the compressed bio, only queue the rounded up range, which is the old behavior before that offending commit. This also means we no longer need to zero the tailing range until the folio end (but still to the block boundary), as such range will not be submitted anyway. And since we're here, add a final ASSERT() into btrfs_submit_compressed_write() as the last safety net for kernels with btrfs assertions enabled Fixes: e1bc83f8b157 ("btrfs: get rid of compressed_folios[] usage for encoded writes") Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit f9a4e3015db1aeafbef407650eb8555445ca943e Author: Filipe Manana Date: Fri Feb 13 16:08:53 2026 +0000 btrfs: reserve enough transaction items for qgroup ioctls Currently our qgroup ioctls don't reserve any space, they just do a transaction join, which does not reserve any space, neither for the quota tree updates nor for the delayed refs generated when updating the quota tree. The quota root uses the global block reserve, which is fine most of the time since we don't expect a lot of updates to the quota root, or to be too close to -ENOSPC such that other critical metadata updates need to resort to the global reserve. However this is not optimal, as not reserving proper space may result in a transaction abort due to not reserving space for delayed refs and then abusing the use of the global block reserve. For example, the following reproducer (which is unlikely to model any real world use case, but just to illustrate the problem), triggers such a transaction abort due to -ENOSPC when running delayed refs: $ cat test.sh #!/bin/bash DEV=/dev/nullb0 MNT=/mnt/nullb0 umount $DEV &> /dev/null # Limit device to 1G so that it's much faster to reproduce the issue. mkfs.btrfs -f -b 1G $DEV mount -o commit=600 $DEV $MNT fallocate -l 800M $MNT/filler btrfs quota enable $MNT for ((i = 1; i <= 400000; i++)); do btrfs qgroup create 1/$i $MNT done umount $MNT When running this, we can see in dmesg/syslog that a transaction abort happened: [436.490] BTRFS error (device nullb0): failed to run delayed ref for logical 30408704 num_bytes 16384 type 176 action 1 ref_mod 1: -28 [436.493] ------------[ cut here ]------------ [436.494] BTRFS: Transaction aborted (error -28) [436.495] WARNING: fs/btrfs/extent-tree.c:2247 at btrfs_run_delayed_refs+0xd9/0x110 [btrfs], CPU#4: umount/2495372 [436.497] Modules linked in: btrfs loop (...) [436.508] CPU: 4 UID: 0 PID: 2495372 Comm: umount Tainted: G W 6.19.0-rc8-btrfs-next-225+ #1 PREEMPT(full) [436.510] Tainted: [W]=WARN [436.511] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [436.513] RIP: 0010:btrfs_run_delayed_refs+0xdf/0x110 [btrfs] [436.514] Code: 0f 82 ea (...) [436.518] RSP: 0018:ffffd511850b7d78 EFLAGS: 00010292 [436.519] RAX: 00000000ffffffe4 RBX: ffff8f120dad37e0 RCX: 0000000002040001 [436.520] RDX: 0000000000000002 RSI: 00000000ffffffe4 RDI: ffffffffc090fd80 [436.522] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffffc04d1867 [436.523] R10: ffff8f18dc1fffa8 R11: 0000000000000003 R12: ffff8f173aa89400 [436.524] R13: 0000000000000000 R14: ffff8f173aa89400 R15: 0000000000000000 [436.526] FS: 00007fe59045d840(0000) GS:ffff8f192e22e000(0000) knlGS:0000000000000000 [436.527] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [436.528] CR2: 00007fe5905ff2b0 CR3: 000000060710a002 CR4: 0000000000370ef0 [436.530] Call Trace: [436.530] [436.530] btrfs_commit_transaction+0x73/0xc00 [btrfs] [436.531] ? btrfs_attach_transaction_barrier+0x1e/0x70 [btrfs] [436.532] sync_filesystem+0x7a/0x90 [436.533] generic_shutdown_super+0x28/0x180 [436.533] kill_anon_super+0x12/0x40 [436.534] btrfs_kill_super+0x12/0x20 [btrfs] [436.534] deactivate_locked_super+0x2f/0xb0 [436.534] cleanup_mnt+0xea/0x180 [436.535] task_work_run+0x58/0xa0 [436.535] exit_to_user_mode_loop+0xed/0x480 [436.536] ? __x64_sys_umount+0x68/0x80 [436.536] do_syscall_64+0x2a5/0xf20 [436.537] entry_SYSCALL_64_after_hwframe+0x76/0x7e [436.537] RIP: 0033:0x7fe5906b6217 [436.538] Code: 0d 00 f7 (...) [436.540] RSP: 002b:00007ffcd87a61f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [436.541] RAX: 0000000000000000 RBX: 00005618b9ecadc8 RCX: 00007fe5906b6217 [436.541] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00005618b9ecb100 [436.542] RBP: 0000000000000000 R08: 00007ffcd87a4fe0 R09: 00000000ffffffff [436.544] R10: 0000000000000103 R11: 0000000000000246 R12: 00007fe59081626c [436.544] R13: 00005618b9ecb100 R14: 0000000000000000 R15: 00005618b9ecacc0 [436.545] [436.545] ---[ end trace 0000000000000000 ]--- Fix this by changing the qgroup ioctls to use start transaction instead of joining so that proper space is reserved for the delayed refs generated for the updates to the quota root. This way we don't get any transaction abort. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 89a8567d84bde88cb7cdbbac2ab2299c4f991490 Author: Claudiu Beznea Date: Mon Mar 16 15:32:46 2026 +0200 dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock Both rz_dmac_disable_hw() and rz_dmac_irq_handle_channel() update the CHCTRL register. To avoid concurrency issues when configuring functionalities exposed by this registers, take the virtual channel lock. All other CHCTRL updates were already protected by the same lock. Previously, rz_dmac_disable_hw() disabled and re-enabled local IRQs, before accessing CHCTRL registers but this does not ensure race-free access. Remove the local IRQ disable/enable code as well. Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Cc: stable@vger.kernel.org Reviewed-by: Biju Das Reviewed-by: Frank Li Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260316133252.240348-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit abb863e6213dc41a58ef8bb3289b7e77460dabf3 Author: Claudiu Beznea Date: Mon Mar 16 15:32:45 2026 +0200 dmaengine: sh: rz-dmac: Protect the driver specific lists The driver lists (ld_free, ld_queue) are used in rz_dmac_free_chan_resources(), rz_dmac_terminate_all(), rz_dmac_issue_pending(), and rz_dmac_irq_handler_thread(), all under the virtual channel lock. Take the same lock in rz_dmac_prep_slave_sg() and rz_dmac_prep_dma_memcpy() as well to avoid concurrency issues, since these functions also check whether the lists are empty and update or remove list entries. Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Cc: stable@vger.kernel.org Reviewed-by: Frank Li Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260316133252.240348-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit e716edafedad4952fe3a4a273d2e039a84e8681a Author: Lee Jones Date: Fri Feb 27 16:30:25 2026 +0000 HID: multitouch: Check to ensure report responses match the request It is possible for a malicious (or clumsy) device to respond to a specific report's feature request using a completely different report ID. This can cause confusion in the HID core resulting in nasty side-effects such as OOB writes. Add a check to ensure that the report ID in the response, matches the one that was requested. If it doesn't, omit reporting the raw event and return early. Signed-off-by: Lee Jones Signed-off-by: Benjamin Tissoires commit 2b4cb4e58f3463d142fcece5a19e0405fb82c794 Author: Filipe Manana Date: Sun Feb 8 19:43:01 2026 +0000 btrfs: check for NULL root after calls to btrfs_csum_root() btrfs_csum_root() can return a NULL pointer in case the root we are looking for is not in the rb tree that tracks roots. So add checks to every caller that is missing such check to log a message and return an error. Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260208161657.3972997-1-clm@meta.com/ Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 50242828700f06edfa8d563f9e0acc23a59424ee Author: Filipe Manana Date: Sun Feb 8 19:24:16 2026 +0000 btrfs: check for NULL root after calls to btrfs_extent_root() btrfs_extent_root() can return a NULL pointer in case the root we are looking for is not in the rb tree that tracks roots. So add checks to every caller that is missing such check to log a message and return an error. The same applies to callers of btrfs_block_group_root(), since it calls btrfs_extent_root(). Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260208161657.3972997-1-clm@meta.com/ Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 76f0930d6e809234904cf9f0f5f42ee6c1dc694e Author: Felix Gu Date: Sun Mar 15 15:17:54 2026 +0800 irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in rpmi_sysmsi_probe() When riscv_acpi_get_gsi_info() fails, the mailbox channel previously requested via mbox_request_channel() is not freed. Add the missing mbox_free_channel() call to prevent the resource leak. Fixes: 4752b0cfbc37 ("irqchip/riscv-rpmi-sysmsi: Add ACPI support") Signed-off-by: Felix Gu Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Reviewed-by: Rahul Pathak Link: https://patch.msgid.link/20260315-sysmsi-v1-1-5f090c86c2ca@gmail.com commit 7caac659a837af9fd4cad85be851982b88859484 Author: Jouni Högander Date: Thu Mar 12 10:37:10 2026 +0200 drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state PSR entry_setup_frames is currently computed directly into struct intel_dp:intel_psr:entry_setup_frames. This causes a problem if mode change gets rejected after PSR compute config: Psr_entry_setup_frames computed for this rejected state is in intel_dp:intel_psr:entry_setup_frame. Fix this by computing it into intel_crtc_state and copy the value into intel_dp:intel_psr:entry_setup_frames on PSR enable. Fixes: 2b981d57e480 ("drm/i915/display: Support PSR entry VSC packet to be transmitted one frame earlier") Cc: Mika Kahola Cc: # v6.8+ Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312083710.1593781-3-jouni.hogander@intel.com (cherry picked from commit 8c229b4aa00262c13787982e998c61c0783285e0) Signed-off-by: Joonas Lahtinen commit b0a4dba7b623aa7cbc9efcc56b4af2ec8b274f3e Author: Jouni Högander Date: Thu Mar 12 10:37:09 2026 +0200 drm/i915/psr: Disable PSR on update_m_n and update_lrr PSR/PR parameters might change based on update_m_n or update_lrr. Disable on update_m_n and update_lrr to ensure proper parameters are taken into use on next PSR enable in intel_psr_post_plane_update. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15771 Fixes: 2bc98c6f97af ("drm/i915/alpm: Compute ALPM parameters into crtc_state->alpm_state") Cc: # v6.19+ Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260312083710.1593781-2-jouni.hogander@intel.com (cherry picked from commit 65852b56bfa929f99e28c96fd98b02058959da7f) Signed-off-by: Joonas Lahtinen commit bb120ad57def62e3f23e3d999c5fbed11f610993 Author: Alexey Nepomnyashih Date: Mon Mar 16 19:18:22 2026 +0000 ALSA: firewire-lib: fix uninitialized local variable Similar to commit d8dc8720468a ("ALSA: firewire-lib: fix uninitialized local variable"), the local variable `curr_cycle_time` in process_rx_packets() is declared without initialization. When the tracepoint event is not probed, the variable may appear to be used without being initialized. In practice the value is only relevant when the tracepoint is enabled, however initializing it avoids potential use of an uninitialized value and improves code safety. Initialize `curr_cycle_time` to zero. Fixes: fef4e61b0b76 ("ALSA: firewire-lib: extend tracepoints event including CYCLE_TIME of 1394 OHCI") Cc: stable@vger.kernel.org Signed-off-by: Alexey Nepomnyashih Link: https://patch.msgid.link/20260316191824.83249-1-sdl@nppct.ru Signed-off-by: Takashi Iwai commit ffe6989c73b31f92a22cab1132e86545f8306d69 Merge: 9e22e9c4a5bd20 24ed11ee5bacf9 Author: Krzysztof Kozlowski Date: Tue Mar 17 09:35:40 2026 +0100 Merge tag 'v7.0-rockchip-drvfixes1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Fixing a missing of_node_put() call. * tag 'v7.0-rockchip-drvfixes1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: soc: rockchip: grf: Add missing of_node_put() when returning Signed-off-by: Krzysztof Kozlowski commit e4c00ba7274b613e3ab19e27eb009f0ec2e28379 Author: Paul SAGE Date: Sun Mar 15 03:24:30 2026 +0530 tg3: replace placeholder MAC address with device property On some systems (e.g. iMac 20,1 with BCM57766), the tg3 driver reads a default placeholder mac address (00:10:18:00:00:00) from the mailbox. The correct value on those systems are stored in the 'local-mac-address' property. This patch, detect the default value and tries to retrieve the correct address from the device_get_mac_address function instead. The patch has been tested on two different systems: - iMac 20,1 (BCM57766) model which use the local-mac-address property - iMac 13,2 (BCM57766) model which can use the mailbox, NVRAM or MAC control registers Tested-by: Rishon Jonathan R Co-developed-by: Vincent MORVAN Signed-off-by: Vincent MORVAN Signed-off-by: Paul SAGE Signed-off-by: Atharva Tiwari Reviewed-by: Michael Chan Link: https://patch.msgid.link/20260314215432.3589-1-atharvatiwarilinuxdev@gmail.com Signed-off-by: Jakub Kicinski commit b9ba668296ffd6143b01b0545a52bcda44f94837 Merge: d4a533ad249e9f 77914255155e68 Author: Jakub Kicinski Date: Mon Mar 16 20:14:50 2026 -0700 Merge branch 'net-usb-cdc_ncm-add-ndpoffset-to-ndp-nframes-bounds-check' tobgaertner says: ==================== net: usb: cdc_ncm: add ndpoffset to NDP nframes bounds check The nframes bounds check in cdc_ncm_rx_verify_ndp16() and cdc_ncm_rx_verify_ndp32() does not account for ndpoffset, allowing out-of-bounds reads when the NDP is placed near the end of the NTB. ==================== Link: https://patch.msgid.link/20260314054640.2895026-1-tob.gaertner@me.com Signed-off-by: Jakub Kicinski commit 77914255155e68a20aa41175edeecf8121dac391 Author: Tobi Gaertner Date: Fri Mar 13 22:46:40 2026 -0700 net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only. Fixes: 0fa81b304a79 ("cdc_ncm: Implement the 32-bit version of NCM Transfer Block") Signed-off-by: Tobi Gaertner Link: https://patch.msgid.link/20260314054640.2895026-3-tob.gaertner@me.com Signed-off-by: Jakub Kicinski commit 2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a Author: Tobi Gaertner Date: Fri Mar 13 22:46:39 2026 -0700 net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset: if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len) but the second check omits it: if ((sizeof(struct usb_cdc_ncm_ndp16) + ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) This validates the DPE array size against the total skb length as if the NDP were at offset 0, rather than at ndpoffset. When the NDP is placed near the end of the NTB (large wNdpIndex), the DPE entries can extend past the skb data buffer even though the check passes. cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating the DPE array. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Fixes: ff06ab13a4cc ("net: cdc_ncm: splitting rx_fixup for code reuse") Signed-off-by: Tobi Gaertner Link: https://patch.msgid.link/20260314054640.2895026-2-tob.gaertner@me.com Signed-off-by: Jakub Kicinski commit d4a533ad249e9fbdc2d0633f2ddd60a5b3a9a4ca Author: Lorenzo Bianconi Date: Fri Mar 13 12:27:00 2026 +0100 net: airoha: Remove airoha_dev_stop() in airoha_remove() Do not run airoha_dev_stop routine explicitly in airoha_remove() since ndo_stop() callback is already executed by unregister_netdev() in __dev_close_many routine if necessary and, doing so, we will end up causing an underflow in the qdma users atomic counters. Rely on networking subsystem to stop the device removing the airoha_eth module. Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260313-airoha-remove-ndo_stop-remove-net-v2-1-67542c3ceeca@kernel.org Signed-off-by: Jakub Kicinski commit 66360460cab63c248ca5b1070a01c0c29133b960 Author: Jamal Hadi Salim Date: Sun Mar 15 11:54:22 2026 -0400 net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. Failure to do so may cause crashes like the following: [ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139) [ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318 [ 238.029749][ T318] [ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full) [ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 238.029910][ T318] Call Trace: [ 238.029913][ T318] [ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122) [ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563) [ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231) [ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1)) [ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139) ... [ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256) [ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827) [ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.030054][ T318] qdisc_reset (net/sched/sch_generic.c:1034) [ 238.030062][ T318] teql_destroy (./include/linux/spinlock.h:395 net/sched/sch_teql.c:157) [ 238.030071][ T318] __qdisc_destroy (./include/net/pkt_sched.h:328 net/sched/sch_generic.c:1077) [ 238.030077][ T318] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 238.030089][ T318] ? __pfx_qdisc_graft (net/sched/sch_api.c:1091) [ 238.030095][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030102][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030106][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030114][ T318] tc_get_qdisc (net/sched/sch_api.c:1529 net/sched/sch_api.c:1556) ... [ 238.072958][ T318] Allocated by task 303 on cpu 5 at 238.026275s: [ 238.073392][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.073884][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.074230][ T318] __kasan_slab_alloc (mm/kasan/common.c:369) [ 238.074578][ T318] kmem_cache_alloc_node_noprof (./include/linux/kasan.h:253 mm/slub.c:4542 mm/slub.c:4869 mm/slub.c:4921) [ 238.076091][ T318] kmalloc_reserve (net/core/skbuff.c:616 (discriminator 107)) [ 238.076450][ T318] __alloc_skb (net/core/skbuff.c:713) [ 238.076834][ T318] alloc_skb_with_frags (./include/linux/skbuff.h:1383 net/core/skbuff.c:6763) [ 238.077178][ T318] sock_alloc_send_pskb (net/core/sock.c:2997) [ 238.077520][ T318] packet_sendmsg (net/packet/af_packet.c:2926 net/packet/af_packet.c:3019 net/packet/af_packet.c:3108) [ 238.081469][ T318] [ 238.081870][ T318] Freed by task 299 on cpu 1 at 238.028496s: [ 238.082761][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.083481][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.085348][ T318] kasan_save_free_info (mm/kasan/generic.c:587 (discriminator 1)) [ 238.085900][ T318] __kasan_slab_free (mm/kasan/common.c:287) [ 238.086439][ T318] kmem_cache_free (mm/slub.c:6168 (discriminator 3) mm/slub.c:6298 (discriminator 3)) [ 238.087007][ T318] skb_release_data (net/core/skbuff.c:1139) [ 238.087491][ T318] consume_skb (net/core/skbuff.c:1451) [ 238.087757][ T318] teql_master_xmit (net/sched/sch_teql.c:358) [ 238.088116][ T318] dev_hard_start_xmit (./include/linux/netdevice.h:5324 ./include/linux/netdevice.h:5333 net/core/dev.c:3871 net/core/dev.c:3887) [ 238.088468][ T318] sch_direct_xmit (net/sched/sch_generic.c:347) [ 238.088820][ T318] __qdisc_run (net/sched/sch_generic.c:420 (discriminator 1)) [ 238.089166][ T318] __dev_queue_xmit (./include/net/sch_generic.h:229 ./include/net/pkt_sched.h:121 ./include/net/pkt_sched.h:117 net/core/dev.c:4196 net/core/dev.c:4802) Workflow to reproduce: 1. Initialize a TEQL topology (dummy0 and ifb0 as slaves, teql0 up). 2. Start multiple sender workers continuously transmitting packets through teql0 to drive teql_master_xmit(). 3. In parallel, repeatedly delete and re-add the root qdisc on dummy0 and ifb0 via RTNETLINK, forcing frequent teardown and reset activity (teql_destroy() / qdisc_reset()). 4. After running both workloads concurrently for several iterations, KASAN reports slab-use-after-free or double-free in the skb free path. Fix this by moving dev_reset_queue to sch_generic.h and calling it, instead of qdisc_reset, in teql_destroy since it handles both the lock and lockless cases correctly for root qdiscs. Fixes: 96009c7d500e ("sched: replace __QDISC_STATE_RUNNING bit with a spin lock") Reported-by: Xianrui Dong Tested-by: Xianrui Dong Co-developed-by: Victor Nogueira Signed-off-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260315155422.147256-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 6d5e4538364b9ceb1ac2941a4deb86650afb3538 Author: Jiayuan Chen Date: Thu Mar 12 17:29:07 2026 +0800 net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9 Fixes: 8270d9c21041 ("net/smc: Limit backlog connections") Reported-by: syzbot+827ae2bfb3a3529333e9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67eaf9b8.050a0220.3c3d88.004a.GAE@google.com/T/ Suggested-by: Eric Dumazet Reviewed-by: Eric Dumazet Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260312092909.48325-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit b7405dcf7385445e10821777143f18c3ce20fa04 Author: Eric Dumazet Date: Sun Mar 15 10:41:52 2026 +0000 bonding: prevent potential infinite loop in bond_header_parse() bond_header_parse() can loop if a stack of two bonding devices is setup, because skb->dev always points to the hierarchy top. Add new "const struct net_device *dev" parameter to (struct header_ops)->parse() method to make sure the recursion is bounded, and that the final leaf parse method is called. Fixes: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()") Signed-off-by: Eric Dumazet Reviewed-by: Jiayuan Chen Tested-by: Jiayuan Chen Cc: Jay Vosburgh Cc: Andrew Lunn Link: https://patch.msgid.link/20260315104152.1436867-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit eade54040384f54b7fb330e4b0975c5734850b3c Author: Sheng Yong Date: Fri Feb 27 10:30:08 2026 +0800 erofs: set fileio bio failed in short read case For file-backed mount, IO requests are handled by vfs_iocb_iter_read(). However, it can be interrupted by SIGKILL, returning the number of bytes actually copied. Unused folios in bio are unexpectedly marked as uptodate. vfs_read filemap_read filemap_get_pages filemap_readahead erofs_fileio_readahead erofs_fileio_rq_submit vfs_iocb_iter_read filemap_read filemap_get_pages <= detect signal erofs_fileio_ki_complete <= set all folios uptodate This patch addresses this by setting short read bio with an error directly. Fixes: bc804a8d7e86 ("erofs: handle end of filesystem properly for file-backed mounts") Reported-by: chenguanyou Signed-off-by: Yunlei He Signed-off-by: Sheng Yong Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 50bfd2a22b75a904d5900d64530ae1b69a69907c Author: Joseph Salisbury Date: Mon Mar 16 21:13:49 2026 -0400 cifs: smb1: fix comment typo The file contains a spelling error in a source comment (resposne). Typos in comments reduce readability and make text searches less reliable for developers and maintainers. Replace 'resposne' with 'response' in the affected comment. This is a comment-only cleanup and does not change behavior. [v2: Removed Fixes: and Cc: to stable tags.] Signed-off-by: Joseph Salisbury Signed-off-by: Steve French commit 75cea0776de502f2a1be5ca02d37c586dc81887e Author: Smita Koralahalli Date: Mon Mar 16 20:19:49 2026 +0000 cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled Check the global CXL_HDM_DECODER_ENABLE bit instead of looping over per-decoder COMMITTED bits to determine whether to fall back to DVSEC range emulation. When the HDM decoder capability is globally enabled, ignore DVSEC range registers regardless of individual decoder commit state. should_emulate_decoders() currently loops over per-decoder COMMITTED bits, which leads to an incorrect DVSEC fallback when those bits are zero. One way to trigger this is to destroy a region and bounce the memdev: cxl disable-region region0 cxl destroy-region region0 cxl disable-memdev mem0 cxl enable-memdev mem0 Region teardown zeroes the HDM decoder registers including the committed bits. The subsequent memdev re-probe finds uncommitted decoders and falls back to DVSEC emulation, even though HDM remains globally enabled. Observed failures: should_emulate_decoders: cxl_port endpoint6: decoder6.0: committed: 0 base: 0x0_00000000 size: 0x0_00000000 devm_cxl_setup_hdm: cxl_port endpoint6: Fallback map 1 range register .. devm_cxl_add_region: cxl_acpi ACPI0017:00: decoder0.0: created region0 __construct_region: cxl_pci 0000:e1:00.0: mem1:decoder6.0: __construct_region region0 res: [mem 0x850000000-0x284fffffff flags 0x200] iw: 1 ig: 4096 cxl region0: pci0000:e0:port1 cxl_port_setup_targets expected iw: 1 ig: 4096 .. cxl region0: pci0000:e0:port1 cxl_port_setup_targets got iw: 1 ig: 256 state: disabled .. cxl_port endpoint6: failed to attach decoder6.0 to region0: -6 .. devm_cxl_add_region: cxl_acpi ACPI0017:00: decoder0.0: created region4 alloc_hpa: cxl region4: HPA allocation error (-34) .. Fixes: 52cc48ad2a76 ("cxl/hdm: Limit emulation to the number of range registers") Signed-off-by: Smita Koralahalli Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260316201950.224567-1-Smita.KoralahalliChannabasappa@amd.com Signed-off-by: Dave Jiang commit 4e5019216402ad0b4a84cff457b662d26803f103 Author: Josh Poimboeuf Date: Mon Mar 9 09:03:05 2026 -0700 objtool: Fix Clang jump table detection With Clang, there can be a conditional forward jump between the load of the jump table address and the indirect branch. Fixes the following warning: vmlinux.o: warning: objtool: ___bpf_prog_run+0x1c5: sibling call from callable instruction with modified stack frame Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com Link: https://patch.msgid.link/7d8600caed08901b6679767488acd639f6df9688.1773071992.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit ee226656cd64c1d781e6f91a38a5131106e9e094 Author: Manivannan Sadhasivam Date: Mon Feb 23 20:16:00 2026 +0530 PCI/pwrctrl: Create pwrctrl devices only for PCI device nodes A PCI host bridge node can have non-PCI child nodes (OPP tables, USB hub, etc.) as well as PCI device child nodes. Ensure that pwrctrl devices are only created for PCI device nodes by checking for the 'pci' prefix in the compatible property. Fixes: 4c4132489201 ("PCI/pwrctrl: Add APIs to create, destroy pwrctrl devices") Reported-by: Bjorn Andersson Closes: https://lore.kernel.org/all/20260212-rb3gen2-upd-gl3590-v1-1-18fb04bb32b0@oss.qualcomm.com Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260223-pwrctrl-fixes-7-0-v2-2-97566dfb1809@oss.qualcomm.com commit cf3287fb2c1ff74cb16e4348c6914acf140ebe30 Author: Manivannan Sadhasivam Date: Mon Feb 23 20:15:59 2026 +0530 PCI/pwrctrl: Ensure that remote endpoint node parent has supply requirement If OF graph is used in the PCI device node, the pwrctrl core creates a pwrctrl device even if the remote endpoint doesn't have power supply requirements. Since the device doesn't have any power supply requirements, there was no pwrctrl driver to probe, leading to PCI controller driver probe deferral as it waits for all pwrctrl drivers to probe before starting bus scan. This issue happens with Qcom ath12k devices with WSI interface attached to the Qcom IPQ platforms. Fix this issue by checking for the existence of at least one power supply property in the remote endpoint parent node. To consolidate all the checks, create a new helper pci_pwrctrl_is_required() and move all the checks there. Fixes: 9db826206f9b ("PCI/pwrctrl: Create pwrctrl device if graph port is found") Reported-by: Raj Kumar Bhagat Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Raj Kumar Bhagat Reviewed-by: Krishna Chaitanya Chundru Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260223-pwrctrl-fixes-7-0-v2-1-97566dfb1809@oss.qualcomm.com commit 5133b61aaf437e5f25b1b396b14242a6bb0508e2 Author: Jeff Layton Date: Tue Feb 24 11:33:35 2026 -0500 nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated based on OPEN responses and does not account for LOCK denied responses, which include the conflicting lock owner as a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT). When a LOCK operation is denied due to a conflict with an existing lock that has a large owner, nfsd4_encode_operation() copies the full encoded response into the undersized replay buffer via read_bytes_from_xdr_buf() with no bounds check. This results in a slab-out-of-bounds write of up to 944 bytes past the end of the buffer, corrupting adjacent heap memory. This can be triggered remotely by an unauthenticated attacker with two cooperating NFSv4.0 clients: one sets a lock with a large owner string, then the other requests a conflicting lock to provoke the denial. We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full opaque, but that would increase the size of every stateowner, when most lockowners are not that large. Instead, fix this by checking the encoded response length against NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the response is too large, set rp_buflen to 0 to skip caching the replay payload. The status is still cached, and the client already received the correct response on the original request. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@kernel.org Reported-by: Nicholas Carlini Tested-by: Nicholas Carlini Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 6f93f7b06810d04acc6b106a7d5ecd6000f80545 Author: Josh Poimboeuf Date: Tue Mar 10 16:37:48 2026 -0400 livepatch/klp-build: Fix inconsistent kernel version If .config hasn't been synced with auto.conf, any recent changes to CONFIG_LOCALVERSION* may not get reflected in the kernel version name. Use "make syncconfig" to force them to sync, and "make -s kernelrelease" to get the version instead of having to construct it manually. Fixes: 24ebfcd65a87 ("livepatch/klp-build: Introduce klp-build script for generating livepatch modules") Closes: https://lore.kernel.org/20260217160645.3434685-10-joe.lawrence@redhat.com Reported-by: Joe Lawrence Signed-off-by: Josh Poimboeuf Signed-off-by: Joe Lawrence Acked-by: Song Liu Link: https://patch.msgid.link/20260310203751.1479229-10-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit 28e367a969b0c54c87ca655ec180715fe469fd14 Author: Joe Lawrence Date: Tue Mar 10 16:37:41 2026 -0400 objtool/klp: fix mkstemp() failure with long paths The elf_create_file() function fails with EINVAL when the build directory path is long enough to truncate the "XXXXXX" suffix in the 256-byte tmp_name buffer. Simplify the code to remove the unnecessary dirname()/basename() split and concatenation. Instead, allocate the exact number of bytes needed for the path. Acked-by: Song Liu Signed-off-by: Joe Lawrence Link: https://patch.msgid.link/20260310203751.1479229-3-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit 2f2600decb3004938762a3f2d0eba3ea9e01045b Author: Joe Lawrence Date: Tue Mar 10 16:37:40 2026 -0400 objtool/klp: fix data alignment in __clone_symbol() Commit 356e4b2f5b80 ("objtool: Fix data alignment in elf_add_data()") corrected the alignment of data within a section (honoring the section's sh_addralign). Apply the same alignment when klp-diff mode clones a symbol, adjusting the new symbol's offset for the output section's sh_addralign. Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Signed-off-by: Joe Lawrence Link: https://patch.msgid.link/20260310203751.1479229-2-joe.lawrence@redhat.com Signed-off-by: Josh Poimboeuf commit 29ab768277617452d88c0607c9299cdc63b6e9ff Author: Bart Van Assche Date: Thu Mar 12 11:27:20 2026 -0700 PM: runtime: Fix a race condition related to device removal The following code in pm_runtime_work() may dereference the dev->parent pointer after the parent device has been freed: /* Maybe the parent is now able to suspend. */ if (parent && !parent->power.ignore_children) { spin_unlock(&dev->power.lock); spin_lock(&parent->power.lock); rpm_idle(parent, RPM_ASYNC); spin_unlock(&parent->power.lock); spin_lock(&dev->power.lock); } Fix this by inserting a flush_work() call in pm_runtime_remove(). Without this patch blktest block/001 triggers the following complaint sporadically: BUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160 Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081 Workqueue: pm pm_runtime_work Call Trace: dump_stack_lvl+0x61/0x80 print_address_description.constprop.0+0x8b/0x310 print_report+0xfd/0x1d7 kasan_report+0xd8/0x1d0 __kasan_check_byte+0x42/0x60 lock_acquire.part.0+0x38/0x230 lock_acquire+0x70/0x160 _raw_spin_lock+0x36/0x50 rpm_suspend+0xc6a/0xfe0 rpm_idle+0x578/0x770 pm_runtime_work+0xee/0x120 process_one_work+0xde3/0x1410 worker_thread+0x5eb/0xfe0 kthread+0x37b/0x480 ret_from_fork+0x6cb/0x920 ret_from_fork_asm+0x11/0x20 Allocated by task 4314: kasan_save_stack+0x2a/0x50 kasan_save_track+0x18/0x40 kasan_save_alloc_info+0x3d/0x50 __kasan_kmalloc+0xa0/0xb0 __kmalloc_noprof+0x311/0x990 scsi_alloc_target+0x122/0xb60 [scsi_mod] __scsi_scan_target+0x101/0x460 [scsi_mod] scsi_scan_channel+0x179/0x1c0 [scsi_mod] scsi_scan_host_selected+0x259/0x2d0 [scsi_mod] store_scan+0x2d2/0x390 [scsi_mod] dev_attr_store+0x43/0x80 sysfs_kf_write+0xde/0x140 kernfs_fop_write_iter+0x3ef/0x670 vfs_write+0x506/0x1470 ksys_write+0xfd/0x230 __x64_sys_write+0x76/0xc0 x64_sys_call+0x213/0x1810 do_syscall_64+0xee/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 4314: kasan_save_stack+0x2a/0x50 kasan_save_track+0x18/0x40 kasan_save_free_info+0x3f/0x50 __kasan_slab_free+0x67/0x80 kfree+0x225/0x6c0 scsi_target_dev_release+0x3d/0x60 [scsi_mod] device_release+0xa3/0x220 kobject_cleanup+0x105/0x3a0 kobject_put+0x72/0xd0 put_device+0x17/0x20 scsi_device_dev_release+0xacf/0x12c0 [scsi_mod] device_release+0xa3/0x220 kobject_cleanup+0x105/0x3a0 kobject_put+0x72/0xd0 put_device+0x17/0x20 scsi_device_put+0x7f/0xc0 [scsi_mod] sdev_store_delete+0xa5/0x120 [scsi_mod] dev_attr_store+0x43/0x80 sysfs_kf_write+0xde/0x140 kernfs_fop_write_iter+0x3ef/0x670 vfs_write+0x506/0x1470 ksys_write+0xfd/0x230 __x64_sys_write+0x76/0xc0 x64_sys_call+0x213/0x1810 Reported-by: Ming Lei Closes: https://lore.kernel.org/all/ZxdNvLNI8QaOfD2d@fedora/ Reported-by: syzbot+6c905ab800f20cf4086c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68c13942.050a0220.2ff435.000b.GAE@google.com/ Fixes: 5e928f77a09a ("PM: Introduce core framework for run-time PM of I/O devices (rev. 17)") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260312182720.2776083-1-bvanassche@acm.org Signed-off-by: Rafael J. Wysocki commit f4c31b07b136839e0fb3026f8a5b6543e3b14d2f Author: Rafael J. Wysocki Date: Fri Mar 13 13:25:41 2026 +0100 sched: idle: Consolidate the handling of two special cases There are two special cases in the idle loop that are handled inconsistently even though they are analogous. The first one is when a cpuidle driver is absent and the default CPU idle time power management implemented by the architecture code is used. In that case, the scheduler tick is stopped every time before invoking default_idle_call(). The second one is when a cpuidle driver is present, but there is only one idle state in its table. In that case, the scheduler tick is never stopped at all. Since each of these approaches has its drawbacks, reconcile them with the help of one simple heuristic. Namely, stop the tick if the CPU has been woken up by it in the previous iteration of the idle loop, or let it tick otherwise. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Reviewed-by: Frederic Weisbecker Reviewed-by: Qais Yousef Reviewed-by: Aboorva Devarajan Fixes: ed98c3491998 ("sched: idle: Do not stop the tick before cpuidle_idle_call()") [ rjw: Added Fixes tag, changelog edits ] Link: https://patch.msgid.link/4741364.LvFx2qVVIh@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit 8a91ebb337fa68e01339a8c1c411a38d66eac80e Merge: 2d1373e4246da3 182b9b3d8d1d36 Author: Linus Torvalds Date: Mon Mar 16 12:21:00 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-03-16-12-15' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "6 hotfixes. 4 are cc:stable. 3 are for MM. All are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-03-16-12-15' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS: update email address for Ignat Korchagin mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for shared THP mm/rmap: fix incorrect pte restoration for lazyfree folios mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd() build_bug.h: correct function parameters names in kernel-doc crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying commit dee0774bbb2abb172e9069ce5ffef579b12b3ae9 Author: Johan Hovold Date: Thu Mar 12 16:18:14 2026 +0100 spi: fix statistics allocation The controller per-cpu statistics is not allocated until after the controller has been registered with driver core, which leaves a window where accessing the sysfs attributes can trigger a NULL-pointer dereference. Fix this by moving the statistics allocation to controller allocation while tying its lifetime to that of the controller (rather than using implicit devres). Fixes: 6598b91b5ac3 ("spi: spi.c: Convert statistics to per-cpu u64_stats_t") Cc: stable@vger.kernel.org # 6.0 Cc: David Jander Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260312151817.32100-3-johan@kernel.org Signed-off-by: Mark Brown commit 8634e05b08ead636e926022f4a98416e13440df9 Author: Johan Hovold Date: Thu Mar 12 16:18:13 2026 +0100 spi: fix use-after-free on controller registration failure Make sure to deregister from driver core also in the unlikely event that per-cpu statistics allocation fails during controller registration to avoid use-after-free (of driver resources) and unclocked register accesses. Fixes: 6598b91b5ac3 ("spi: spi.c: Convert statistics to per-cpu u64_stats_t") Cc: stable@vger.kernel.org # 6.0 Cc: David Jander Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260312151817.32100-2-johan@kernel.org Signed-off-by: Mark Brown commit 0bdf27abaf8940592207be939142451436afe39f Author: Zhang Heng Date: Mon Mar 16 10:28:43 2026 +0800 ALSA: hda/realtek: add quirk for ASUS Strix G16 G615JMR The machine is equipped with ALC294 and requires the ALC287_FIXUP_TXNW2781_I2C_ASUS quirk for the amplifier to work properly. Since the machine's PCI SSID is also 1043:1204, HDA_CODEC_QUIRK is used to retain the previous quirk. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221173 Cc: Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260316022843.2809968-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit a6919f2a01f8fbf807b015e5b26aecae7db8117b Author: Sean Rhodes Date: Sun Mar 15 20:11:27 2026 +0000 ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter The initial StarFighter quirk fixed the runtime suspend pop by muting speakers in the shutup callback before power-down. Further hardware validation showed that the speaker path is controlled directly by LINE2 EAPD on NID 0x1b together with GPIO2 for the external amplifier. Replace the shutup-delay workaround with explicit sequencing of those controls at playback start and stop: - assert LINE2 EAPD and drive GPIO2 high on PREPARE - deassert LINE2 EAPD and drive GPIO2 low on CLEANUP This avoids the runtime suspend pop without a sleep, and also fixes pops around G3 entry and display-manager start that the original workaround did not cover. Fixes: 1cb3c20688fc ("ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter") Tested-by: Sean Rhodes Signed-off-by: Sean Rhodes Link: https://patch.msgid.link/20260315201127.33744-1-sean@starlabs.systems Signed-off-by: Takashi Iwai commit ab5119735e984f6b724ef1b699c01479949ed1de Author: Christian Borntraeger Date: Mon Mar 16 13:13:17 2026 +0100 KVM: s390: vsie: Avoid injecting machine check on signal The recent XFER_TO_GUEST_WORK change resulted in a situation, where the vsie code would interpret a signal during work as a machine check during SIE as both use the EINTR return code. The exit_reason of the sie64a function has nothing to do with the kvm_run exit_reason. Rename it and define a specific code for machine checks instead of abusing -EINTR. rename exit_reason into sie_return to avoid the naming conflict and change the code flow in vsie.c to have a separate variable for rc and sie_return. Fixes: 2bd1337a1295e ("KVM: s390: Use generic VIRT_XFER_TO_GUEST_WORK functions") Signed-off-by: Christian Borntraeger Reviewed-by: Heiko Carstens Reviewed-by: Claudio Imbrenda commit 1ca90f4ae554034d96764577196d8dd0c3bcd05e Author: Christian Borntraeger Date: Fri Mar 6 11:25:40 2026 +0100 KVM: s390: log machine checks more aggressively KVM will reinject machine checks that happen during guest activity. From a host perspective this machine check is no longer visible and even for the guest, the guest might decide to only kill a userspace program or even ignore the machine check. As this can be a disruptive event nevertheless, we should log this not only in the VM debug event (that gets lost after guest shutdown) but also on the global KVM event as well as syslog. Consolidate the logging and log with loglevel 2 and higher. Signed-off-by: Christian Borntraeger Acked-by: Janosch Frank Acked-by: Hendrik Brueckner commit 0c6294d98a6dfadd53296d762f4a396c2f04c7c1 Author: Janosch Frank Date: Tue Mar 3 13:46:35 2026 +0000 KVM: s390: selftests: Add IRQ routing address offset tests This test tries to setup routes which have address + offset combinations which cross a page. Reviewed-by: Matthew Rosato Tested-by: Matthew Rosato Signed-off-by: Janosch Frank Signed-off-by: Christian Borntraeger commit dcf96f7ad556d84d460e5f5cf06061eb1a13c272 Author: Janosch Frank Date: Tue Mar 3 13:46:34 2026 +0000 KVM: s390: Limit adapter indicator access to mapped page While we check the address for errors, we don't seem to check the bit offsets and since they are 32 and 64 bits a lot of memory can be reached indirectly via those offsets. Fixes: 84223598778b ("KVM: s390: irq routing for adapter interrupts.") Suggested-by: Claudio Imbrenda Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Tested-by: Matthew Rosato Signed-off-by: Janosch Frank Signed-off-by: Christian Borntraeger commit b00be77302d7ec4ad0367bb236494fce7172b730 Author: Janosch Frank Date: Wed Mar 4 10:18:37 2026 +0000 s390/mm: Add missing secure storage access fixups for donated memory There are special cases where secure storage access exceptions happen in a kernel context for pages that don't have the PG_arch_1 bit set. That bit is set for non-exported guest secure storage (memory) but is absent on storage donated to the Ultravisor since the kernel isn't allowed to export donated pages. Prior to this patch we would try to export the page by calling arch_make_folio_accessible() which would instantly return since the arch bit is absent signifying that the page was already exported and no further action is necessary. This leads to secure storage access exception loops which can never be resolved. With this patch we unconditionally try to export and if that fails we fixup. Fixes: 084ea4d611a3 ("s390/mm: add (non)secure page access exceptions handlers") Reported-by: Heiko Carstens Suggested-by: Heiko Carstens Reviewed-by: Claudio Imbrenda Tested-by: Christian Borntraeger Signed-off-by: Janosch Frank Signed-off-by: Christian Borntraeger commit 2d1373e4246da3b58e1df058374ed6b101804e07 Merge: f338e77383789c fc1cd1f18c34f9 Author: Linus Torvalds Date: Mon Mar 16 08:53:06 2026 -0700 Merge tag 'for-7.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix logging of new dentries when logging parent directory and there are conflicting inodes (e.g. deleted directory) - avoid taking big device lock for zone setup, this is not necessary during mount - tune message verbosity when auto-reclaiming zones when low on space - fix slightly misleading message of root item check * tag 'for-7.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: tree-checker: fix misleading root drop_level error message btrfs: log new dentries when logging parent dir of a conflicting inode btrfs: don't take device_list_mutex when querying zone info btrfs: pass 'verbose' parameter to btrfs_relocate_block_group commit c6cb77c474a32265e21c4871c7992468bf5e7638 Author: Ian Forbes Date: Mon Mar 2 14:03:30 2026 -0600 drm/vmwgfx: Don't overwrite KMS surface dirty tracker We were overwriting the surface's dirty tracker here causing a memory leak. Reported-by: Mika Penttilä Closes: https://lore.kernel.org/dri-devel/8c53f3c6-c6de-46fe-a8ca-d98dd52b3abe@redhat.com/ Fixes: 965544150d1c ("drm/vmwgfx: Refactor cursor handling") Signed-off-by: Ian Forbes Reviewed-by: Maaz Mombasawala Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20260302200330.66763-1-ian.forbes@broadcom.com commit c7feff27ea0a34540b4820abd0cdf0b5100516d4 Author: Randy Dunlap Date: Thu Feb 19 13:55:48 2026 -0800 drm/vmwgfx: fix kernel-doc warnings in vmwgfx_drv.h Fix 45+ kernel-doc warnings in vmwgfx_drv.h: - spell a struct name correctly - don't have structs between kernel-doc and its struct - end description of struct members with ':' - start all kernel-doc lines with " *" - mark private struct member and enum value with "private:" - add kernel-doc for enum vmw_dma_map_mode - add missing struct member comments - add missing function parameter comments - convert "/**" to "/*" for non-kernel-doc comments - add missing "Returns:" comments for several functions - correct a function parameter name to eliminate kernel-doc warnings (examples): Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:128 struct vmw_bo; error: Cannot parse struct or union! Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:151 struct member 'used_prio' not described in 'vmw_resource' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:151 struct member 'mob_node' not described in 'vmw_resource' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:199 bad line: SM4 device. Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:270 struct member 'private' not described in 'vmw_res_cache_entry' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:280 Enum value 'vmw_dma_alloc_coherent' not described in enum 'vmw_dma_map_mode' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:280 Enum value 'vmw_dma_map_bind' not described in enum 'vmw_dma_map_mode' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:295 struct member 'addrs' not described in 'vmw_sg_table' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:295 struct member 'mode' not described in 'vmw_sg_table' vmwgfx_drv.h:309: warning: Excess struct member 'num_regions' description in 'vmw_sg_table' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:402 struct member 'filp' not described in 'vmw_sw_context' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:732 This comment starts with '/**', but isn't a kernel-doc comment. Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:742 This comment starts with '/**', but isn't a kernel-doc comment. Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:762 This comment starts with '/**', but isn't a kernel-doc comment. Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:887 No description found for return value of 'vmw_fifo_caps' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:901 No description found for return value of 'vmw_is_cursor_bypass3_enabled' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:906 This comment starts with '/**', but isn't a kernel-doc comment. Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:961 This comment starts with '/**', but isn't a kernel-doc comment. Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:996 This comment starts with '/**', but isn't a kernel-doc comment. Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:1082 cannot understand function prototype: 'const struct dma_buf_ops vmw_prime_dmabuf_ops;' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:1303 struct member 'do_cpy' not described in 'vmw_diff_cpy' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:1385 function parameter 'fmt' not described in 'VMW_DEBUG_KMS' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:1389 This comment starts with '/**', but isn't a kernel-doc comment. Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:1426 function parameter 'vmw' not described in 'vmw_fifo_mem_read' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:1426 No description found for return value of 'vmw_fifo_mem_read' Warning: drivers/gpu/drm/vmwgfx/vmwgfx_drv.h:1441 function parameter 'fifo_reg' not described in 'vmw_fifo_mem_write' Signed-off-by: Randy Dunlap Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20260219215548.470810-1-rdunlap@infradead.org commit f7a4c78bfeb320299c1b641500fe7761eadbd101 Author: Lee Jones Date: Fri Feb 27 10:09:38 2026 +0000 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Presently, if the force feedback initialisation fails when probing the Logitech G920 Driving Force Racing Wheel for Xbox One, an error number will be returned and propagated before the userspace infrastructure (sysfs and /dev/input) has been torn down. If userspace ignores the errors and continues to use its references to these dangling entities, a UAF will promptly follow. We have 2 options; continue to return the error, but ensure that all of the infrastructure is torn down accordingly or continue to treat this condition as a warning by emitting the message but returning success. It is thought that the original author's intention was to emit the warning but keep the device functional, less the force feedback feature, so let's go with that. Signed-off-by: Lee Jones Reviewed-by: Günther Noack Signed-off-by: Benjamin Tissoires commit 2b658c1c442ec1cd9eec5ead98d68662c40fe645 Author: Benjamin Tissoires Date: Fri Mar 13 08:40:25 2026 +0100 HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense. Fixes: 8bd0488b5ea5 ("HID: bpf: add HID-BPF hooks for hid_hw_raw_requests") Cc: stable@vger.kernel.org Acked-by: Jiri Kosina Signed-off-by: Benjamin Tissoires commit 5d4c6c132ea9a967d48890dd03e6a786c060e968 Author: Benjamin Tissoires Date: Fri Mar 13 08:40:24 2026 +0100 selftests/hid: fix compilation when bpf_wq and hid_device are not exported This can happen in situations when CONFIG_HID_SUPPORT is set to no, or some complex situations where struct bpf_wq is not exported. So do the usual dance of hiding them before including vmlinux.h, and then redefining them and make use of CO-RE to have the correct offsets. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603111558.KLCIxsZB-lkp@intel.com/ Fixes: fe8d561db3e8 ("selftests/hid: add wq test for hid_bpf_input_report()") Cc: stable@vger.kernel.org Acked-by: Jiri Kosina Reviewed-by: Thomas Weißschuh Signed-off-by: Benjamin Tissoires commit 0a3fe972a7cb1404f693d6f1711f32bc1d244b1c Author: Lee Jones Date: Mon Mar 9 14:59:29 2026 +0000 HID: core: Mitigate potential OOB by removing bogus memset() The memset() in hid_report_raw_event() has the good intention of clearing out bogus data by zeroing the area from the end of the incoming data string to the assumed end of the buffer. However, as we have previously seen, doing so can easily result in OOB reads and writes in the subsequent thread of execution. The current suggestion from one of the HID maintainers is to remove the memset() and simply return if the incoming event buffer size is not large enough to fill the associated report. Suggested-by Benjamin Tissoires Signed-off-by: Lee Jones [bentiss: changed the return value] Signed-off-by: Benjamin Tissoires commit 5e3486e64094c28a526543f1e8aa0d5964b7f02d Author: Luke Wang Date: Wed Mar 11 17:50:06 2026 +0800 mmc: sdhci: fix timing selection for 1-bit bus width When 1-bit bus width is used with HS200/HS400 capabilities set, mmc_select_hs200() returns 0 without actually switching. This causes mmc_select_timing() to skip mmc_select_hs(), leaving eMMC in legacy mode (26MHz) instead of High Speed SDR (52MHz). Per JEDEC eMMC spec section 5.3.2, 1-bit mode supports High Speed SDR. Drop incompatible HS200/HS400/UHS/DDR caps early so timing selection falls through to mmc_select_hs() correctly. Fixes: f2119df6b764 ("mmc: sd: add support for signal voltage switch procedure") Signed-off-by: Luke Wang Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit ba3402f6c85bbeee5c11732c3aa4050a717e8f8f Author: Maramaina Naresh Date: Mon Mar 16 18:53:31 2026 +0530 spi: geni-qcom: Fix CPHA and CPOL mode change detection setup_fifo_params computes mode_changed from spi->mode flags but tests it against SE_SPI_CPHA and SE_SPI_CPOL, which are register offsets, not SPI mode bits. This causes CPHA and CPOL updates to be skipped on mode switches, leaving the controller with stale clock phase and polarity settings. Fix this by using SPI_CPHA and SPI_CPOL to detect mode changes before updating the corresponding registers. Fixes: 781c3e71c94c ("spi: spi-geni-qcom: rework setup_fifo_params") Signed-off-by: Maramaina Naresh Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260316-spi-geni-cpha-cpol-fix-v1-1-4cb44c176b79@oss.qualcomm.com Signed-off-by: Mark Brown commit 09e70e4f119ff650d24c96161fd2f62ac7e424b0 Author: Andy Shevchenko Date: Mon Mar 2 19:43:31 2026 +0100 regmap: Synchronize cache for the page selector If the selector register is represented in each page, its value according to the debugfs is stale because it gets synchronized only after the real page switch happens. Hence the regmap cache initialisation from the HW inherits outdated data in the selector register. Synchronize cache for the page selector just in time. Before (offset followed by hexdump, the first byte is selector): // Real registers 18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00 ... // Virtual (per port) 40: 05 ff 00 00 e0 e0 00 00 00 00 00 1f 50: 00 ff 00 00 e0 e0 00 00 00 00 00 1f 60: 01 ff 00 00 ff ff 00 00 00 00 00 00 70: 02 ff 00 00 cf f3 00 00 00 00 00 0c 80: 03 ff 00 00 00 00 00 00 00 00 00 ff 90: 04 ff 00 00 ff 0f 00 00 f0 00 00 00 After: // Real registers 18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00 ... // Virtual (per port) 40: 00 ff 00 00 e0 e0 00 00 00 00 00 1f 50: 01 ff 00 00 e0 e0 00 00 00 00 00 1f 60: 02 ff 00 00 ff ff 00 00 00 00 00 00 70: 03 ff 00 00 cf f3 00 00 00 00 00 0c 80: 04 ff 00 00 00 00 00 00 00 00 00 ff 90: 05 ff 00 00 ff 0f 00 00 f0 00 00 00 Fixes: 6863ca622759 ("regmap: Add support for register indirect addressing.") Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260302184753.2693803-1-andriy.shevchenko@linux.intel.com Tested-by: Marek Szyprowski Signed-off-by: Mark Brown commit 81f86728a9804c7ff99df8f2cb7a7a081a270400 Author: Leo Yan Date: Mon Mar 16 11:11:57 2026 +0000 tools headers: Skip arm64 cputype.h check Some definitions in the arm64 kernel's cputype.h are kernel specific and cause perf build failures when the header is synced into tools. Stop checking arm64's cputype.h. In the future, the header in tools will be updated manually when teaching tools about new CPUs. Signed-off-by: Leo Yan Acked-by: Mark Rutland Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 6f770b73d0311a5b099277653199bb6421c4fed2 Author: Shigeru Yoshida Date: Sun Mar 15 17:27:49 2026 +0900 dma: swiotlb: add KMSAN annotations to swiotlb_bounce() When a device performs DMA to a bounce buffer, KMSAN is unaware of the write and does not mark the data as initialized. When swiotlb_bounce() later copies the bounce buffer back to the original buffer, memcpy propagates the uninitialized shadow to the original buffer, causing false positive uninit-value reports. Fix this by calling kmsan_unpoison_memory() on the bounce buffer before copying it back in the DMA_FROM_DEVICE path, so that memcpy naturally propagates initialized shadow to the destination. Suggested-by: Alexander Potapenko Link: https://lore.kernel.org/CAG_fn=WUGta-paG1BgsGRoAR+fmuCgh3xo=R3XdzOt_-DqSdHw@mail.gmail.com/ Fixes: 7ade4f10779c ("dma: kmsan: unpoison DMA mappings") Signed-off-by: Shigeru Yoshida Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260315082750.2375581-1-syoshida@redhat.com commit 4bc7bc457922742d38915458e630195e761c1efd Author: Daniel Schaefer Date: Fri Mar 13 21:39:25 2026 +0800 HID: intel-thc-hid: Set HID_PHYS with PCI BDF Currently HID_PHYS is empty, which means userspace tools (e.g. fwupd) that depend on it for distinguishing the devices, are unable to do so. Other drivers like i2c-hid, usbhid, surface-hid, all populate it. With this change it's set to, for example: HID_PHYS=0000:00:10.0 Each function has just a single HID device, as far as I can tell, so there is no need to add a suffix. Tested with fwupd 2.1.1, can avoid https://github.com/fwupd/fwupd/pull/9995 Cc: Even Xu Cc: Xinpeng Sun Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: Sakari Ailus Signed-off-by: Daniel Schaefer Reviewed-by: Even Xu Signed-off-by: Jiri Kosina commit eb2d16a7d599dc9d4df391b5e660df9949963786 Author: Eric Dumazet Date: Sat Mar 14 17:02:10 2026 +0000 af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb. Validate families early, do not wait set_ipsecrequest(). [1] skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev: kernel BUG at net/core/skbuff.c:214 ! Call Trace: skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150 Fixes: 08de61beab8a ("[PFKEYV2]: Extension for dynamic update of endpoint address(es)") Reported-by: syzbot+b518dfc8e021988fbd55@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69b5933c.050a0220.248e02.00f2.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Steffen Klassert Cc: Herbert Xu Signed-off-by: Steffen Klassert commit 29fe3a61bcdce398ee3955101c39f89c01a8a77e Author: Minwoo Ra Date: Sat Mar 14 00:58:44 2026 +0900 xfrm: prevent policy_hthresh.work from racing with netns teardown A XFRM_MSG_NEWSPDINFO request can queue the per-net work item policy_hthresh.work onto the system workqueue. The queued callback, xfrm_hash_rebuild(), retrieves the enclosing struct net via container_of(). If the net namespace is torn down before that work runs, the associated struct net may already have been freed, and xfrm_hash_rebuild() may then dereference stale memory. xfrm_policy_fini() already flushes policy_hash_work during teardown, but it does not synchronize policy_hthresh.work. Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the queued work cannot outlive the net namespace teardown and access a freed struct net. Fixes: 880a6fab8f6b ("xfrm: configure policy hash table thresholds by netlink") Signed-off-by: Minwoo Ra Signed-off-by: Steffen Klassert commit 09c8ef6236004601b930965dfed432ac0e683b7e Merge: 6df6ea4b3d1567 16fdabe143fce2 Author: Bartosz Golaszewski Date: Mon Mar 16 10:23:47 2026 +0100 Merge branch 'gpio/dev-init-rework' into gpio/for-current Pull in the gpiochip_add_data_with_key() rework addressing resource leaks in error path. commit ce5ae93d1a216680460040c7c0465a6e3b629dec Author: Damien Le Moal Date: Sun Mar 15 07:24:15 2026 +0900 ata: libata-core: disable LPM on ADATA SU680 SSD ADATA SU680 SSDs suffer from NCQ read and write commands timeouts or bus errors when link power management (LPM) is enabled. Flag these devices with the ATA_QUIRK_NOLPM quirk to prevent the use of LPM and avoid these command failures. Reported-by: Mohammad Khaled Bayan Closes: https://bugs.launchpad.net/ubuntu/+source/linux-hwe-6.17/+bug/2144060 Cc: stable@vger.kernel.org Tested-by: Mohammad-Khaled Bayan Signed-off-by: Damien Le Moal Reviewed-by: Martin K. Petersen Signed-off-by: Niklas Cassel commit ac57eb3b7d2ad649025b5a0fa207315f755ac4f6 Author: Imre Deak Date: Mon Mar 9 18:48:03 2026 +0200 drm/i915/dmc: Fix an unlikely NULL pointer deference at probe intel_dmc_update_dc6_allowed_count() oopses when DMC hasn't been initialized, and dmc is thus NULL. That would be the case when the call path is intel_power_domains_init_hw() -> {skl,bxt,icl}_display_core_init() -> gen9_set_dc_state() -> intel_dmc_update_dc6_allowed_count(), as intel_power_domains_init_hw() is called *before* intel_dmc_init(). However, gen9_set_dc_state() calls intel_dmc_update_dc6_allowed_count() conditionally, depending on the current and target DC states. At probe, the target is disabled, but if DC6 is enabled, the function is called, and an oops follows. Apparently it's quite unlikely that DC6 is enabled at probe, as we haven't seen this failure mode before. It is also strange to have DC6 enabled at boot, since that would require the DMC firmware (loaded by BIOS); the BIOS loading the DMC firmware and the driver stopping / reprogramming the firmware is a poorly specified sequence and as such unlikely an intentional BIOS behaviour. It's more likely that BIOS is leaving an unintentionally enabled DC6 HW state behind (without actually loading the required DMC firmware for this). The tracking of the DC6 allowed counter only works if starting / stopping the counter depends on the _SW_ DC6 state vs. the current _HW_ DC6 state (since stopping the counter requires the DC5 counter captured when the counter was started). Thus, using the HW DC6 state is incorrect and it also leads to the above oops. Fix both issues by using the SW DC6 state for the tracking. This is v2 of the fix originally sent by Jani, updated based on the first Link: discussion below. Link: https://lore.kernel.org/all/3626411dc9e556452c432d0919821b76d9991217@intel.com Link: https://lore.kernel.org/all/20260228130946.50919-2-ltao@redhat.com Fixes: 88c1f9a4d36d ("drm/i915/dmc: Create debugfs entry for dc6 counter") Cc: Mohammed Thasleem Cc: Jani Nikula Cc: Tao Liu Cc: # v6.16+ Tested-by: Tao Liu Reviewed-by: Jani Nikula Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260309164803.1918158-1-imre.deak@intel.com (cherry picked from commit 2344b93af8eb5da5d496b4e0529d35f0f559eaf0) Signed-off-by: Joonas Lahtinen commit c252c12d1f55bd5737e3b8e7839914ccdc7a701c Author: Bibo Mao Date: Mon Mar 16 10:36:02 2026 +0800 LoongArch: KVM: Fix typo issue in kvm_vm_init_features() Most of VM feature detections are integer OR operations, and integer assignment operation will clear previous integer OR operation. So here change all integer assignment operations to integer OR operations. Fixes: 82db90bf461b ("LoongArch: KVM: Move feature detection in kvm_vm_init_features()") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit b254c629a963f0b9d635902f3f979bddbc65f90f Author: Tiezhu Yang Date: Mon Mar 16 10:36:01 2026 +0800 LoongArch: BPF: Make arch_protect_bpf_trampoline() return 0 Occasionally there exist "text_copy_cb: operation failed" when executing the bpf selftests, the reason is copy_to_kernel_nofault() failed and the ecode of ESTAT register is 0x4 (PME: Page Modification Exception) due to the pte is not writeable. The root cause is that there is another place to set the pte entry as readonly which is in the generic weak version of arch_protect_bpf_trampoline(). There are two ways to fix this race condition issue: the direct way is to modify the generic weak arch_protect_bpf_trampoline() to add a mutex lock for set_memory_rox(), but the other simple and proper way is to just make arch_protect_bpf_trampoline() return 0 in the arch-specific code because LoongArch has already use the BPF prog pack allocator for trampoline. Here are the trimmed kernel log messages: copy_to_kernel_nofault: memory access failed, ecode 0x4 copy_to_kernel_nofault: the caller is text_copy_cb+0x50/0xa0 text_copy_cb: operation failed ------------[ cut here ]------------ bpf_prog_pack bug: missing bpf_arch_text_invalidate? WARNING: kernel/bpf/core.c:1008 at bpf_prog_pack_free+0x200/0x228 ... Call Trace: [<9000000000248914>] show_stack+0x64/0x188 [<9000000000241308>] dump_stack_lvl+0x6c/0x9c [<90000000002705bc>] __warn+0x9c/0x200 [<9000000001c428c0>] __report_bug+0xa8/0x1c0 [<9000000001c42b5c>] report_bug+0x64/0x120 [<9000000001c7dcd0>] do_bp+0x270/0x3c0 [<9000000000246f40>] handle_bp+0x120/0x1c0 [<900000000047b030>] bpf_prog_pack_free+0x200/0x228 [<900000000047b2ec>] bpf_jit_binary_pack_free+0x24/0x60 [<900000000026989c>] bpf_jit_free+0x54/0xb0 [<900000000029e10c>] process_one_work+0x184/0x610 [<900000000029ef8c>] worker_thread+0x24c/0x388 [<90000000002a902c>] kthread+0x13c/0x170 [<9000000001c7dfe8>] ret_from_kernel_thread+0x28/0x1c0 [<9000000000246624>] ret_from_kernel_thread_asm+0xc/0x88 ---[ end trace 0000000000000000 ]--- Here is a simple shell script to reproduce: #!/bin/bash for ((i=1; i<=1000; i++)) do echo "Under testing $i ..." dmesg -c > /dev/null ./test_progs -t fentry_attach_stress > /dev/null dmesg -t | grep "text_copy_cb: operation failed" if [ $? -eq 0 ]; then break fi done Cc: stable@vger.kernel.org Fixes: 4ab17e762b34 ("LoongArch: BPF: Use BPF prog pack allocator") Acked-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit d3b8491961207ac967795c34375890407fd51a45 Author: Tiezhu Yang Date: Mon Mar 16 10:36:01 2026 +0800 LoongArch: No need to flush icache if text copy failed If copy_to_kernel_nofault() failed, no need to flush icache and just return immediately. Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 431ce839dad66d0d56fb604785452c6a57409f35 Author: Tiezhu Yang Date: Mon Mar 16 10:36:01 2026 +0800 LoongArch: Check return values for set_memory_{rw,rox} set_memory_rw() and set_memory_rox() may fail, so we should check the return values and return immediately in larch_insn_text_copy(). Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit a47f0754bdd01f971c9715acdbdd3a07515c8f83 Author: Tiezhu Yang Date: Mon Mar 16 10:36:01 2026 +0800 LoongArch: Give more information if kmem access failed If memory access such as copy_{from, to}_kernel_nofault() failed, its users do not know what happened, so it is very useful to print the exception code for such cases. Furthermore, it is better to print the caller function to know where is the entry. Here are the low level call chains: copy_from_kernel_nofault() copy_from_kernel_nofault_loop() __get_kernel_nofault() copy_to_kernel_nofault() copy_to_kernel_nofault_loop() __put_kernel_nofault() Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 8a69d02481ff97683952e94b9d1eae29b45f88fd Author: Xi Ruoyao Date: Mon Mar 16 10:36:01 2026 +0800 LoongArch: Fix calling smp_processor_id() in preemptible code Fix the warning: BUG: using smp_processor_id() in preemptible [00000000] code: systemd/1 caller is larch_insn_text_copy+0x40/0xf0 Simply changing it to raw_smp_processor_id() is not enough: if preempt and CPU hotplug happens after raw_smp_processor_id() but before calling stop_machine(), the CPU where raw_smp_processor_id() has run may become offline when stop_machine() and no CPU will run copy_to_kernel_nofault() in text_copy_cb(). Thus guard the larch_insn_text_copy() calls with cpus_read_lock() and change stop_machine() to stop_machine_cpuslocked() to prevent this. I've considered moving the locks inside larch_insn_text_copy() but doing so seems not an easy hack. In bpf_arch_text_poke() obviously the memcpy() call must be guarded by text_mutex, so we have to leave the acquire of text_mutex out of larch_insn_text_copy(). But in the entire kernel the acquire of mutexes is always after cpus_read_lock(), so we cannot put cpus_read_lock() into larch_insn_text_copy() while leaving the text_mutex acquire out (or we risk a deadlock due to inconsistent lock acquire order). So let's fix the bug first and leave the posssible refactor as future work. Fixes: 9fbd18cf4c69 ("LoongArch: BPF: Add dynamic code modification support") Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen commit c8b8f3c50f487b145433a6c3f95efd8790079a06 Author: Thomas Weißschuh Date: Mon Mar 16 10:36:00 2026 +0800 LoongArch: Only use SC.Q when supported by the assembler The 128-bit atomic cmpxchg implementation uses the SC.Q instruction. Older versions of GNU AS do not support that instruction, erroring out: ERROR:root:{standard input}: Assembler messages: {standard input}:4831: Error: no match insn: sc.q $t0,$t1,$r14 {standard input}:6407: Error: no match insn: sc.q $t0,$t1,$r23 {standard input}:10856: Error: no match insn: sc.q $t0,$t1,$r14 make[4]: *** [../scripts/Makefile.build:289: mm/slub.o] Error 1 (Binutils 2.41) So test support for SC.Q in Kconfig and disable the atomics if the instruction is not available. Fixes: f0e4b1b6e295 ("LoongArch: Add 128-bit atomic cmpxchg support") Closes: https://lore.kernel.org/lkml/20260216082834-edc51c46-7b7a-4295-8ea5-4d9a3ca2224f@linutronix.de/ Reviewed-by: Xi Ruoyao Acked-by: Hengqi Chen Tested-by: Hengqi Chen Signed-off-by: Thomas Weißschuh Signed-off-by: Huacai Chen commit 12b4c5d98cd7ca46d5035a57bcd995df614c14e1 Author: Paulo Alcantara Date: Fri Mar 13 00:03:38 2026 -0300 smb: client: fix krb5 mount with username option Customer reported that some of their krb5 mounts were failing against a single server as the client was trying to mount the shares with wrong credentials. It turned out the client was reusing SMB session from first mount to try mounting the other shares, even though a different username= option had been specified to the other mounts. By using username mount option along with sec=krb5 to search for principals from keytab is supported by cifs.upcall(8) since cifs-utils-4.8. So fix this by matching username mount option in match_session() even with Kerberos. For example, the second mount below should fail with -ENOKEY as there is no 'foobar' principal in keytab (/etc/krb5.keytab). The client ends up reusing SMB session from first mount to perform the second one, which is wrong. ``` $ ktutil ktutil: add_entry -password -p testuser -k 1 -e aes256-cts Password for testuser@ZELDA.TEST: ktutil: write_kt /etc/krb5.keytab ktutil: quit $ klist -ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ---------------------------------------------------------------- 1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96) $ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser $ mount.cifs //w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar $ mount -t cifs | grep -Po 'username=\K\w+' testuser testuser ``` Reported-by: Oscar Santos Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French commit d487085006109e5981e059476818243759d2e925 Author: Konrad Dybcio Date: Fri Mar 6 12:20:14 2026 +0100 soc: qcom: pmic_glink_altmode: Fix SVID=DP && unconnected edge case The commit referenced in Fixes started evaluating the value of alt_port->mux_ctrl before checking the active SVID. This led to drm_aux_hpd_bridge_notify() no longer being called for the 'DP unplug' case. Perhaps somewhat interestingly, the firmware sends a notification with SVID=DP, mux_ctrl=MUX_CTRL_STATE_NO_CONN and pin_assignment=0 on unplug. 'pin_assignment' was previously interpreted as a bitfield excerpt from the second byte of the DP pg_altmode payload (and stored as an u8). That value is used in pmic_glink_altmode_sc8280xp_notify(), decremented by 1 (DPAM_HPD_A). Previously, this would result in an u8 underflow that would rollover to 0xff (which prior to the Fixes patch would have caused a pmic_glink_altmode_safe() and 'disconnected' bridge notification). That check was removed, without a replacement. Resolve this issue by making sure the SID=DP && mux_ctrl=NO_CONN combo once again results in a HPD bridge notification. Fixes: 0539c5a6fdef ("soc: qcom: pmic_glink_altmode: Consume TBT3/USB4 mode notifications") Reported-by: Abel Vesa Tested-by: Abel Vesa Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260306-topic-pgaltmode_fixup-v1-1-ec154b2d8e89@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 641f6fda143b879da1515f821ee475073678cf2a Author: Mukesh Ojha Date: Thu Jan 29 20:53:20 2026 +0530 soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei It looks element length declared in servreg_loc_pfr_req_ei for reason not matching servreg_loc_pfr_req's reason field due which we could observe decoding error on PD crash. qmi_decode_string_elem: String len 81 >= Max Len 65 Fix this by matching with servreg_loc_pfr_req's reason field. Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation") Signed-off-by: Mukesh Ojha Reviewed-by: Dmitry Baryshkov Tested-by: Nikita Travkin Link: https://lore.kernel.org/r/20260129152320.3658053-2-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7fc5e2f5603cfb305d0a8071f56b5bdb55161aeb Author: Felix Gu Date: Mon Mar 2 01:08:40 2026 +0800 spi: axiado: Fix double-free in ax_spi_probe() ctlr is allocated using devm_spi_alloc_host(), which automatically handles reference counting via the devm framework. Calling spi_controller_put() manually in the probe error path is redundant and results in a double-free. Fixes: e75a6b00ad79 ("spi: axiado: Add driver for Axiado SPI DB controller") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260302-axiado-v1-1-1132819f1cb7@gmail.com Signed-off-by: Mark Brown commit 399b6fd37a102c73cefa32a0ec945d76d80fa35f Author: Hasun Park Date: Mon Mar 9 00:16:53 2026 +0900 ASoC: amd: acp: add PX13 SoundWire machine link for rt721+tas2783x2 Add an ACP70 SoundWire machine entry for ASUS PX13 (HN7306EA/HN7306EAC) with rt721 and two TAS2783 amps on link1. Describe rt721 with jack/DMIC endpoints on this platform and add explicit left/right TAS2783 speaker endpoint mapping via name prefixes. Signed-off-by: Hasun Park Link: https://patch.msgid.link/20260308151654.29059-3-hasunpark@gmail.com Signed-off-by: Mark Brown commit d0426510a9e1fabf074e274ceff26ffc6500980a Author: Hasun Park Date: Mon Mar 9 00:16:52 2026 +0900 ASoC: amd: acp: add DMI override for ACP70 flag Some ASUS ProArt PX13 systems expose ACP ACPI config flags that can select a non-working fallback path. Add a DMI override in snd_amd_acp_find_config() for ACP70+ boards and return 0 so ACP ACPI flag-based selection is skipped on this platform. This keeps machine driver selection on the intended SoundWire path. Signed-off-by: Hasun Park Link: https://patch.msgid.link/20260308151654.29059-2-hasunpark@gmail.com Signed-off-by: Mark Brown commit fe757092d2329c397ecb32f2bf68a5b1c4bd9193 Author: Guangshuo Li Date: Fri Mar 13 12:06:11 2026 +0800 ASoC: sma1307: fix double free of devm_kzalloc() memory A previous change added NULL checks and cleanup for allocation failures in sma1307_setting_loaded(). However, the cleanup for mode_set entries is wrong. Those entries are allocated with devm_kzalloc(), so they are device-managed resources and must not be freed with kfree(). Manually freeing them in the error path can lead to a double free when devres later releases the same memory. Drop the manual kfree() loop and let devres handle the cleanup. Fixes: 0ec6bd16705fe ("ASoC: sma1307: Add NULL check in sma1307_setting_loaded()") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260313040611.391479-1-lgs201920130244@gmail.com Signed-off-by: Mark Brown commit b8db9552997924b750e727a625a30eaa4603bbb9 Author: Felix Gu Date: Sun Mar 8 14:49:21 2026 +0800 spi: amlogic-spisg: Fix memory leak in aml_spisg_probe() In aml_spisg_probe(), ctlr is allocated by spi_alloc_target()/spi_alloc_host(), but fails to call spi_controller_put() in several error paths. This leads to a memory leak whenever the driver fails to probe after the initial allocation. Convert to use devm_spi_alloc_host()/devm_spi_alloc_target() to fix the memory leak. Fixes: cef9991e04ae ("spi: Add Amlogic SPISG driver") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260308-spisg-v1-1-2cace5cafc24@gmail.com Signed-off-by: Mark Brown commit a00da54d06f435dbbeacb84f9121dbbe6d6eda74 Author: Felix Gu Date: Sun Mar 8 21:34:55 2026 +0800 spi: amlogic: spifc-a4: Remove redundant clock cleanup The driver uses devm_clk_get_enabled() which enables the clock and registers a callback to automatically disable it when the device is unbound. Remove the redundant aml_sfc_disable_clk() call in the error paths and remove callback. Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260308-spifc-a4-1-v1-1-77e286c26832@gmail.com Signed-off-by: Mark Brown commit f338e77383789c0cae23ca3d48adcc5e9e137e3c Author: Linus Torvalds Date: Sun Mar 15 13:52:05 2026 -0700 Linux 7.0-rc4 commit 5c2fe8d11ae05411566f9d69321375ea686603d4 Merge: d9bf296c398d09 8ddc0c26916574 Author: Linus Torvalds Date: Sun Mar 15 13:15:39 2026 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "The one core change is a re-roll of the tag allocation fix from the last pull request that uses the correct goto to unroll all the allocations. The remianing fixes are all small ones in drivers" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: hisi_sas: Fix NULL pointer exception during user_scan() scsi: qla2xxx: Completely fix fcport double free scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend scsi: core: Fix error handling for scsi_alloc_sdev() commit d9bf296c398d093f9641568411dee16285302113 Merge: 62cda74c79da1e 5ef268cb7a0aac Author: Linus Torvalds Date: Sun Mar 15 13:08:05 2026 -0700 Merge tag 'probes-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - Avoid crash when rmmod/insmod after ftrace killed This fixes a kernel crash caused by kprobes on the symbol in a module which is unloaded after ftrace_kill() is called. - Remove unneeded warnings from __arm_kprobe_ftrace() Remove unneeded WARN messages which can be triggered if the kprobe is using ftrace and it fails to enable the ftrace. Since kprobes correctly handle such failure, we don't need to warn it. * tag 'probes-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() kprobes: avoid crash when rmmod/insmod after ftrace killed commit 62cda74c79da1ebd46be7362e8329c6fa5d0caf3 Merge: 11e8c7e9471cf8 e2715ea5fb352c Author: Linus Torvalds Date: Sun Mar 15 12:50:05 2026 -0700 Merge tag 'bootconfig-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig fixes from Masami Hiramatsu: - fix off-by-one in xbc_verify_tree() unclosed brace error. This fixes a wrong error place in unclosed brace error message - check bounds before writing in __xbc_open_brace(). This fixes to check the array index before setting array, so that the bootconfig can support 16th-depth nested brace correctly - fix snprintf truncation check in xbc_node_compose_key_after(). This fixes to handle the return value of snprintf() correctly in case of the return value == size - Add bootconfig tests about braces Add test cases for checking error position about unclosed brace and ensuring supporting 16th depth nested braces correctly * tag 'bootconfig-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: Add bootconfig tests about braces lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() lib/bootconfig: check bounds before writing in __xbc_open_brace() lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error commit 11e8c7e9471cf8e6ae6ec7324a3174191cd965e3 Merge: 4f3df2e5ea69f5 d2ea4ff1ce5078 Author: Linus Torvalds Date: Sun Mar 15 12:22:10 2026 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Quite a large pull request, partly due to skipping last week and therefore having material from ~all submaintainers in this one. About a fourth of it is a new selftest, and a couple more changes are large in number of files touched (fixing a -Wflex-array-member-not-at-end compiler warning) or lines changed (reformatting of a table in the API documentation, thanks rST). But who am I kidding---it's a lot of commits and there are a lot of bugs being fixed here, some of them on the nastier side like the RISC-V ones. ARM: - Correctly handle deactivation of interrupts that were activated from LRs. Since EOIcount only denotes deactivation of interrupts that are not present in an LR, start EOIcount deactivation walk *after* the last irq that made it into an LR - Avoid calling into the stubs to probe for ICH_VTR_EL2.TDS when pKVM is already enabled -- not only thhis isn't possible (pKVM will reject the call), but it is also useless: this can only happen for a CPU that has already booted once, and the capability will not change - Fix a couple of low-severity bugs in our S2 fault handling path, affecting the recently introduced LS64 handling and the even more esoteric handling of hwpoison in a nested context - Address yet another syzkaller finding in the vgic initialisation, where we would end-up destroying an uninitialised vgic with nasty consequences - Address an annoying case of pKVM failing to boot when some of the memblock regions that the host is faulting in are not page-aligned - Inject some sanity in the NV stage-2 walker by checking the limits against the advertised PA size, and correctly report the resulting faults PPC: - Fix a PPC e500 build error due to a long-standing wart that was exposed by the recent conversion to kmalloc_obj(); rip out all the ugliness that led to the wart RISC-V: - Prevent speculative out-of-bounds access using array_index_nospec() in APLIC interrupt handling, ONE_REG regiser access, AIA CSR access, float register access, and PMU counter access - Fix potential use-after-free issues in kvm_riscv_gstage_get_leaf(), kvm_riscv_aia_aplic_has_attr(), and kvm_riscv_aia_imsic_has_attr() - Fix potential null pointer dereference in kvm_riscv_vcpu_aia_rmw_topei() - Fix off-by-one array access in SBI PMU - Skip THP support check during dirty logging - Fix error code returned for Smstateen and Ssaia ONE_REG interface - Check host Ssaia extension when creating AIA irqchip x86: - Fix cases where CPUID mitigation features were incorrectly marked as available whenever the kernel used scattered feature words for them - Validate _all_ GVAs, rather than just the first GVA, when processing a range of GVAs for Hyper-V's TLB flush hypercalls - Fix a brown paper bug in add_atomic_switch_msr() - Use hlist_for_each_entry_srcu() when traversing mask_notifier_list, to fix a lockdep warning; KVM doesn't hold RCU, just irq_srcu - Ensure AVIC VMCB fields are initialized if the VM has an in-kernel local APIC (and AVIC is enabled at the module level) - Update CR8 write interception when AVIC is (de)activated, to fix a bug where the guest can run in perpetuity with the CR8 intercept enabled - Add a quirk to skip the consistency check on FREEZE_IN_SMM, i.e. to allow L1 hypervisors to set FREEZE_IN_SMM. This reverts (by default) an unintentional tightening of userspace ABI in 6.17, and provides some amount of backwards compatibility with hypervisors who want to freeze PMCs on VM-Entry - Validate the VMCS/VMCB on return to a nested guest from SMM, because either userspace or the guest could stash invalid values in memory and trigger the processor's consistency checks Generic: - Remove a subtle pseudo-overlay of kvm_stats_desc, which, aside from being unnecessary and confusing, triggered compiler warnings due to -Wflex-array-member-not-at-end - Document that vcpu->mutex is take outside of kvm->slots_lock and kvm->slots_arch_lock, which is intentional and desirable despite being rather unintuitive Selftests: - Increase the maximum number of NUMA nodes in the guest_memfd selftest to 64 (from 8)" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (43 commits) KVM: selftests: Verify SEV+ guests can read and write EFER, CR0, CR4, and CR8 Documentation: kvm: fix formatting of the quirks table KVM: x86: clarify leave_smm() return value selftests: kvm: add a test that VMX validates controls on RSM selftests: kvm: extract common functionality out of smm_test.c KVM: SVM: check validity of VMCB controls when returning from SMM KVM: VMX: check validity of VMCS controls when returning from SMM KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() KVM: VMX: Fix a wrong MSR update in add_atomic_switch_msr() KVM: x86: hyper-v: Validate all GVAs during PV TLB flush KVM: x86: synthesize CPUID bits only if CPU capability is set KVM: PPC: e500: Rip out "struct tlbe_ref" KVM: PPC: e500: Fix build error due to using kmalloc_obj() with wrong type KVM: selftests: Increase 'maxnode' for guest_memfd tests KVM: arm64: pkvm: Don't reprobe for ICH_VTR_EL2.TDS on CPU hotplug KVM: arm64: vgic: Pick EOIcount deactivations from AP-list tail KVM: arm64: Remove the redundant ISB in __kvm_at_s1e2() ... commit 4f3df2e5ea69f5717d2721922aff263c31957548 Merge: 13af67f599c9f1 82f73ef9c41e06 Author: Linus Torvalds Date: Sun Mar 15 11:36:11 2026 -0700 Merge tag 'powerpc-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix KUAP warning in VMX usercopy path - Fix lockdep warning during PCI enumeration - Fix to move CMA reservations to arch_mm_preinit - Fix to check current->mm is alive before getting user callchain Thanks to Aboorva Devarajan, Christophe Leroy (CS GROUP), Dan Horák, Nicolin Chen, Nilay Shroff, Qiao Zhao, Ritesh Harjani (IBM), Saket Kumar Bhaskar, Sayali Patil, Shrikanth Hegde, Venkat Rao Bagalkote, and Viktor Malik. * tag 'powerpc-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/iommu: fix lockdep warning during PCI enumeration powerpc/selftests/copyloops: extend selftest to exercise __copy_tofrom_user_power7_vmx powerpc: fix KUAP warning in VMX usercopy path powerpc, perf: Check that current->mm is alive before getting user callchain powerpc/mem: Move CMA reservations to arch_mm_preinit commit 13af67f599c9f177ac7ca4442be967a91c9ebae4 Merge: 164cb546e99996 8cc7dd77a1466f Author: Linus Torvalds Date: Sun Mar 15 11:26:36 2026 -0700 Merge tag 'x86-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "Work around S2RAM hang if the firmware unexpectedly re-enables the x2apic hardware while it was disabled by the kernel. Force-disable it again and issue a warning into the syslog" * tag 'x86-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Disable x2apic on resume if the kernel expects so commit 164cb546e9999637e26eac76971e6c4438a400a9 Merge: 63724e9519a312 755a648e78f125 Author: Linus Torvalds Date: Sun Mar 15 11:14:09 2026 -0700 Merge tag 'timers-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix function tracer recursion bug by marking jiffies_64_to_clock_t() notrace" * tag 'timers-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time/jiffies: Mark jiffies_64_to_clock_t() notrace commit 63724e9519a312d7d0b8767d0aeb53bc15a7fdd5 Merge: 97450311306e95 192d852129b1b7 Author: Linus Torvalds Date: Sun Mar 15 10:49:47 2026 -0700 Merge tag 'sched-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "More MM-CID fixes, mostly fixing hangs/races: - Fix CID hangs due to a race between concurrent forks - Fix vfork()/CLONE_VM MMCID bug causing hangs - Remove pointless preemption guard - Fix CID task list walk performance regression on large systems by removing the known-flaky and slow counting logic using for_each_process_thread() in mm_cid_*fixup_tasks_to_cpus(), and implementing a simple sched_mm_cid::node list instead" * tag 'sched-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/mmcid: Avoid full tasklist walks sched/mmcid: Remove pointless preempt guard sched/mmcid: Handle vfork()/CLONE_VM correctly sched/mmcid: Prevent CID stalls due to concurrent forks commit 97450311306e95e2feb87c088acd6af216a3b077 Merge: be2e3750ce0ce1 9a73f085dc9198 Author: Linus Torvalds Date: Sun Mar 15 10:36:01 2026 -0700 Merge tag 'objtool-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Ingo Molnar: - Fix cross-build bug by using HOSTCFLAGS for HAVE_XXHASH test - Fix klp bug by fixing detection of corrupt static branch/call entries - Handle unsupported pr_debug() usage more gracefully - Fix hypothetical klp bug by avoiding NULL pointer dereference when printing code symbol name - Fix data alignment bug in elf_add_data() causing mangled strings - Fix confusing ERROR_INSN() error message - Handle unexpected Clang RSP musical chairs causing false positive warnings - Fix another objtool stack overflow in validate_branch() * tag 'objtool-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix another stack overflow in validate_branch() objtool: Handle Clang RSP musical chairs objtool: Fix ERROR_INSN() error message objtool: Fix data alignment in elf_add_data() objtool: Use HOSTCFLAGS for HAVE_XXHASH test objtool/klp: Avoid NULL pointer dereference when printing code symbol name objtool/klp: Disable unsupported pr_debug() usage objtool/klp: Fix detection of corrupt static branch/call entries commit be2e3750ce0ce1b9ba77b521fee7f3e9166e64e9 Merge: 9a48d4a130871b b330fbfd34d762 Author: Linus Torvalds Date: Sun Mar 15 10:32:57 2026 -0700 Merge tag 'irq-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "Two fixes for the riscv-aplic irqchip driver: - Fix probing dependency bug on probing failure - Fix double register_syscore() bug" * tag 'irq-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/riscv-aplic: Register syscore operations only once irqchip/riscv-aplic: Do not clear ACPI dependencies on probe failure commit 1744a6ef48b9a48f017e3e1a0d05de0a6978396e Author: Marc Zyngier Date: Thu Mar 12 14:08:50 2026 +0000 KVM: arm64: Discard PC update state on vcpu reset Our vcpu reset suffers from a particularly interesting flaw, as it does not correctly deal with state that will have an effect on the execution flow out of reset. Take the following completely random example, never seen in the wild and that never resulted in a couple of sleepless nights: /s - vcpu-A issues a PSCI_CPU_OFF using the SMC conduit - SMC being a trapped instruction (as opposed to HVC which is always normally executed), we annotate the vcpu as needing to skip the next instruction, which is the SMC itself - vcpu-A is now safely off - vcpu-B issues a PSCI_CPU_ON for vcpu-A, providing a starting PC - vcpu-A gets reset, get the new PC, and is sent on its merry way - right at the point of entering the guest, we notice that a PC increment is pending (remember the earlier SMC?) - vcpu-A skips its first instruction... What could possibly go wrong? Well, I'm glad you asked. For pKVM as a NV guest, that first instruction is extremely significant, as it indicates whether the CPU is booting or resuming. Having skipped that instruction, nothing makes any sense anymore, and CPU hotplugging fails. This is all caused by the decoupling of PC update from the handling of an exception that triggers such update, making it non-obvious what affects what when. Fix this train wreck by discarding all the PC-affecting state on vcpu reset. Fixes: f5e30680616ab ("KVM: arm64: Move __adjust_pc out of line") Cc: stable@vger.kernel.org Reviewed-by: Suzuki K Poulose Reviewed-by: Joey Gouly Link: https://patch.msgid.link/20260312140850.822968-1-maz@kernel.org Signed-off-by: Marc Zyngier commit dd154646d292cce7de952f216760c58c35cfecde Author: Ariana Lazar Date: Tue Mar 10 13:56:44 2026 +0200 iio: dac: mcp47feb02: Fix Vref validation [1-999] case Store reference voltages in uV instead of mV to avoid invalid error code in dev_err_probe() call. Vref variables store the actual value returned by devm_regulator_get_enable_read_voltage() function instead of the results of dividing it by MILLI. The corner case [1-999] divided by MILLI of the voltage reference variable value would become 0 is covered too. Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02") Link: https://lore.kernel.org/all/aYXvP5FLA5BvkoVX@stanley.mountain/ Signed-off-by: Ariana Lazar Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit c05a87d9ec3bf8727a5d746ce855003c6f2f8bb4 Author: Josh Poimboeuf Date: Mon Mar 9 20:45:45 2026 -0700 iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() If 'pin' is not one of its expected values, the value of 'int_out_ctrl_shift' is undefined. With UBSAN enabled, this causes Clang to generate undefined behavior, resulting in the following warning: drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: bmi160_setup_irq() falls through to next function __cfi_bmi160_core_runtime_resume() Prevent the UB and improve error handling by returning an error if 'pin' has an unexpected value. While at it, simplify the code a bit by moving the 'pin_name' assignment to the first switch statement. Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support") Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com Signed-off-by: Josh Poimboeuf Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 793b008cd39516385791a1d1d223d817e947a471 Author: Andrii Kovalchuk Date: Sun Mar 15 01:08:51 2026 +0000 ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk Add a PCI quirk for HP ENVY Laptop 13-ba0xxx (PCI device ID 0x8756) to enable proper mute LED and mic mute behavior using the ALC245_FIXUP_HP_X360_MUTE_LEDS fixup. Signed-off-by: Andrii Kovalchuk Link: https://patch.msgid.link/u0s-uRVegF9BN0t-4JnOUwsIAR-mVc4U4FJfJHdEHX7ro_laErHD9y35NebWybcN16gVaVHPJo1ap3AoJ1a2gqJImPvThgeNt_SYVY1KaDw=@proton.me Signed-off-by: Takashi Iwai commit 2c98a8fbd6aa647414c6248dacf254ebe91c79ad Author: Helge Deller Date: Mon Mar 9 15:16:37 2026 +0100 parisc: Flush correct cache in cacheflush() syscall The assembly flush instructions were swapped for I- and D-cache flags: SYSCALL_DEFINE3(cacheflush, ...) { if (cache & DCACHE) { "fic ...\n" } if (cache & ICACHE && error == 0) { "fdc ...\n" } Fix it by using fdc for DCACHE, and fic for ICACHE flushing. Reported-by: Felix Lechner Fixes: c6d96328fecd ("parisc: Add cacheflush() syscall") Cc: # v6.5+ Signed-off-by: Helge Deller commit 9a48d4a130871bea7a7ae2d83cda0326b1922d3e Merge: f26de90c68a66e f311a05784634f Author: Linus Torvalds Date: Sat Mar 14 16:25:10 2026 -0700 Merge tag 'i3c/fixes-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c fixes from Alexandre Belloni: "This introduces the I3C_OR_I2C symbol which is not a fix per se but is affecting multiple subsystems so it is included to ease synchronization. Apart from that, Adrian is mostly fixing the mipi-i3c-hci driver DMA handling, and I took the opportunity to add two fixes for the dw-i3c driver. Subsystem: - simplify combined i3c/i2c dependencies Drivers: - dw: handle 2C properly, fix possible race condition - mipi-i3c-hci: many DMA related fixes" * tag 'i3c/fixes-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter i3c: mipi-i3c-hci: Fallback to software reset when bus disable fails i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization i3c: mipi-i3c-hci: Fix race in DMA error handling in interrupt context i3c: mipi-i3c-hci: Consolidate common xfer processing logic i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler i3c: mipi-i3c-hci: Fix race in DMA ring dequeue i3c: mipi-i3c-hci: Fix race in DMA ring enqueue for parallel xfers i3c: mipi-i3c-hci: Consolidate spinlocks i3c: mipi-i3c-hci: Factor out DMA mapping from queuing path i3c: mipi-i3c-hci: Fix Hot-Join NACK i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors i3c: simplify combined i3c/i2c dependencies commit f26de90c68a66ec95accc50555692d545e04a135 Merge: 267594792a7101 d800d0bb2009a7 Author: Linus Torvalds Date: Sat Mar 14 16:15:49 2026 -0700 Merge tag 'i2c-for-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "Designware DT binding maintainer update" * tag 'i2c-for-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: dw: Update maintainer commit 267594792a71018788af69e836c52e34bb8054af Merge: 69237f8c1f6911 592c61f3bfceaa Author: Linus Torvalds Date: Sat Mar 14 12:35:16 2026 -0700 Merge tag 'rust-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Remap paths to avoid absolute ones starting with the upcoming Rust 1.95.0 release. This improves build reproducibility, avoids leaking the exact path and avoids having the same path appear in two forms The approach here avoids remapping debug information as well, in order to avoid breaking tools that used the paths to access source files, which was the previous attempt that needed to be reverted - Allow 'unused_features' lint for the upcoming Rust 1.96.0 release. While well-intentioned, we do not benefit much from the new lint - Emit dependency information into '$(depfile)' directly to avoid a temporary '.d' file (it was an old approach) 'kernel' crate: - 'str' module: fix warning under '!CONFIG_BLOCK' by making 'NullTerminatedFormatter' public - 'cpufreq' module: suppress false positive Clippy warning 'pin-init' crate: - Remove '#[disable_initialized_field_access]' attribute which was unsound. This means removing the support for structs with unaligned fields (through the 'repr(packed)' attribute), for now And document the load-bearing fact of field accessors (i.e. that they are required for soundness) - Replace shadowed return token by 'unsafe'-to-create token in order to remain sound in the face of the likely upcoming Type Alias Impl Trait (TAIT) and the next trait solver in upstream Rust" * tag 'rust-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: kbuild: allow `unused_features` rust: cpufreq: suppress clippy::double_parens in Policy doctest rust: pin-init: replace shadowed return token by `unsafe`-to-create token rust: pin-init: internal: init: document load-bearing fact of field accessors rust: pin-init: internal: init: remove `#[disable_initialized_field_access]` rust: build: remap path to avoid absolute path rust: kbuild: emit dep-info into $(depfile) directly rust: str: make NullTerminatedFormatter public commit 43d222fbcdff9a715dbe63a0c9e5902f1c9ddd10 Merge: 719d3e71691db7 718d0766ce4c76 Author: Jakub Kicinski Date: Sat Mar 14 12:19:48 2026 -0700 Merge branch 'net-macb-fix-ethernet-malfunction-on-amd-versal-board-after-suspend' Kevin Hao says: ==================== net: macb: Fix Ethernet malfunction on AMD Versal board after suspend On Versal boards, the tx/rx queue pointer registers are cleared after suspend, which causes Ethernet malfunction. This patch series addresses this issue by reinitializing the tx/rx queue pointer registers and the rx ring. ==================== Link: https://patch.msgid.link/20260312-macb-versal-v1-0-467647173fa4@gmail.com Signed-off-by: Jakub Kicinski commit 718d0766ce4c7634ce62fa78b526ea7263487edd Author: Kevin Hao Date: Thu Mar 12 16:13:59 2026 +0800 net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume On certain platforms, such as AMD Versal boards, the tx/rx queue pointer registers are cleared after suspend, and the rx queue pointer register is also disabled during suspend if WOL is enabled. Previously, we assumed that these registers would be restored by macb_mac_link_up(). However, in commit bf9cf80cab81, macb_init_buffers() was moved from macb_mac_link_up() to macb_open(). Therefore, we should call macb_init_buffers() to reinitialize the tx/rx queue pointer registers during resume. Due to the reset of these two registers, we also need to adjust the tx/rx rings accordingly. The tx ring will be handled by gem_shuffle_tx_rings() in macb_mac_link_up(), so we only need to initialize the rx ring here. Fixes: bf9cf80cab81 ("net: macb: Fix tx/rx malfunction after phy link down and up") Reported-by: Quanyang Wang Signed-off-by: Kevin Hao Tested-by: Quanyang Wang Cc: stable@vger.kernel.org Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260312-macb-versal-v1-2-467647173fa4@gmail.com Signed-off-by: Jakub Kicinski commit 1a7124ecd655bcaf1845197fe416aa25cff4c3ea Author: Kevin Hao Date: Thu Mar 12 16:13:58 2026 +0800 net: macb: Introduce gem_init_rx_ring() Extract the initialization code for the GEM RX ring into a new function. This change will be utilized in a subsequent patch. No functional changes are introduced. Signed-off-by: Kevin Hao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260312-macb-versal-v1-1-467647173fa4@gmail.com Signed-off-by: Jakub Kicinski commit 719d3e71691db7c4f1658ba5a6d1472928121594 Author: Meghana Malladi Date: Wed Mar 11 15:24:41 2026 +0530 net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode Page recycling was removed from the XDP_DROP path in emac_run_xdp() to avoid conflicts with AF_XDP zero-copy mode, which uses xsk_buff_free() instead. However, this causes a memory leak when running XDP programs that drop packets in non-zero-copy mode (standard page pool mode). The pages are never returned to the page pool, leading to OOM conditions. Fix this by handling cleanup in the caller, emac_rx_packet(). When emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP, the caller now recycles the page back to the page pool. The zero-copy path, emac_rx_packet_zc() already handles cleanup correctly with xsk_buff_free(). Fixes: 7a64bb388df3 ("net: ti: icssg-prueth: Add AF_XDP zero copy for RX") Signed-off-by: Meghana Malladi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260311095441.1691636-1-m-malladi@ti.com Signed-off-by: Jakub Kicinski commit ebba09f198078b7a2565004104ef762d1148e7f0 Author: AlanSong-oc Date: Fri Mar 13 16:01:49 2026 +0800 crypto: padlock-sha - Disable for Zhaoxin processor For Zhaoxin processors, the XSHA1 instruction requires the total memory allocated at %rdi register must be 32 bytes, while the XSHA1 and XSHA256 instruction doesn't perform any operation when %ecx is zero. Due to these requirements, the current padlock-sha driver does not work correctly with Zhaoxin processors. It cannot pass the self-tests and therefore does not activate the driver on Zhaoxin processors. This issue has been reported in Debian [1]. The self-tests fail with the following messages [2]: alg: shash: sha1-padlock-nano test failed (wrong result) on test vector 0, cfg="init+update+final aligned buffer" alg: self-tests for sha1 using sha1-padlock-nano failed (rc=-22) alg: shash: sha256-padlock-nano test failed (wrong result) on test vector 0, cfg="init+update+final aligned buffer" alg: self-tests for sha256 using sha256-padlock-nano failed (rc=-22) Disable the padlock-sha driver on Zhaoxin processors with the CPU family 0x07 and newer. Following the suggestion in [3], support for PHE will be added to lib/crypto/ instead. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1113996 [2] https://linux-hardware.org/?probe=271fabb7a4&log=dmesg [3] https://lore.kernel.org/linux-crypto/aUI4CGp6kK7mxgEr@gondor.apana.org.au/ Fixes: 63dc06cd12f9 ("crypto: padlock-sha - Use API partial block handling") Cc: stable@vger.kernel.org Signed-off-by: AlanSong-oc Link: https://lore.kernel.org/r/20260313080150.9393-2-AlanSong-oc@zhaoxin.com Signed-off-by: Eric Biggers commit fa103fc8f56954a60699a29215cb713448a39e87 Author: Dipayaan Roy Date: Wed Mar 11 12:22:04 2026 -0700 net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown A potential race condition exists in mana_hwc_destroy_channel() where hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and Event Queue (EQ) are destroyed. This allows an in-flight CQ interrupt handler to dereference freed memory, leading to a use-after-free or NULL pointer dereference in mana_hwc_handle_resp(). mana_smc_teardown_hwc() signals the hardware to stop but does not synchronize against IRQ handlers already executing on other CPUs. The IRQ synchronization only happens in mana_hwc_destroy_cq() via mana_gd_destroy_eq() -> mana_gd_deregister_irq(). Since this runs after kfree(hwc->caller_ctx), a concurrent mana_hwc_rx_event_handler() can dereference freed caller_ctx (and rxq->msg_buf) in mana_hwc_handle_resp(). Fix this by reordering teardown to reverse-of-creation order: destroy the TX/RX work queues and CQ/EQ before freeing hwc->caller_ctx. This ensures all in-flight interrupt handlers complete before the memory they access is freed. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy Reviewed-by: Simon Horman Link: https://patch.msgid.link/abHA3AjNtqa1nx9k@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Jakub Kicinski commit 69237f8c1f69112cca7388af7fab6d0ee45a2525 Merge: 5c75125672443a d0d9b1f4f5391e Author: Linus Torvalds Date: Sat Mar 14 09:43:12 2026 -0700 Merge tag 'usb-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here is a large chunk of USB driver fixes for 7.0-rc4. Included in here are: - usb gadget reverts due to reported issues, and then a follow-on fix to hopefully resolve the reported overall problem - xhci driver fixes - dwc3 driver fixes - usb core "killable" bulk message api addition to fix a usbtmc driver bug where userspace could hang the driver for forever - small USB driver fixes for reported issues - new usb device quirks All except the last USB device quirk change have been in linux-next with no reported issues. That one came in too late, and is 'obviously correct' :)" * tag 'usb-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (35 commits) USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed usb: roles: get usb role switch from parent only for usb-b-connector Revert "tcpm: allow looking for role_sw device in the main node" usb: gadget: f_ncm: Fix net_device lifecycle with device_move Revert "usb: gadget: u_ether: add gether_opts for config caching" Revert "usb: gadget: u_ether: use header file" Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device" Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind" Revert "usb: legacy: ncm: Fix NPE in gncm_bind" Revert "usb: gadget: f_ncm: Fix atomic context locking issue" usb: typec: altmode/displayport: set displayport signaling rate in configure message usb: dwc3: pci: add support for the Intel Nova Lake -H usb/core/quirks: Add Huawei ME906S-device to wakeup quirk usb: gadget: uvc: fix interval_duration calculation xhci: Fix NULL pointer dereference when reading portli debugfs files usb: xhci: Prevent interrupt storm on host controller error (HCE) usb: xhci: Fix memory leak in xhci_disable_slot() usb: class: cdc-wdm: fix reordering issue in read code path usb: renesas_usbhs: fix use-after-free in ISR during device removal usb: cdc-acm: Restore CAP_BRK functionnality to CH343 ... commit 6cfc3bc02b977f2fba5f7268e6504d1931a774f7 Author: Justin Chen Date: Thu Mar 12 12:18:52 2026 -0700 net: bcmgenet: increase WoL poll timeout Some systems require more than 5ms to get into WoL mode. Increase the timeout value to 50ms. Fixes: c51de7f3976b ("net: bcmgenet: add Wake-on-LAN support code") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260312191852.3904571-1-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 5c75125672443a209a40033f0df5fb823e356452 Merge: 4dad25aa60dace 163cc462dea7d5 Author: Linus Torvalds Date: Sat Mar 14 09:38:49 2026 -0700 Merge tag 'char-misc-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / IIO driver fixes from Greg KH: "Here are some char/misc/iio/binder fixes for 7.0-rc4. Nothing major in here, just the usual: - lots of iio driver fixes for reported issues - rust binder fixes for problems found - gpib driver binding to the wrong device fix - firmware driver fix All of these have been in linux-next with no reported issues" * tag 'char-misc-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (28 commits) gpib: lpvo_usb: fix unintended binding of FTDI 8U232AM devices firmware: stratix10-svc: Add Multi SVC clients support rust_binder: use lock_vma_under_rcu() in use_page_slow() rust_binder: call set_notification_done() without proc lock rust_binder: avoid reading the written value in offsets array rust_binder: check ownership before using vma rust_binder: fix oneway spam detection firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled iio: imu: adis: Fix NULL pointer dereference in adis_init iio: imu: inv_icm45600: fix regulator put warning when probe fails iio: buffer: Fix wait_queue not being removed iio: gyro: mpu3050-core: fix pm_runtime error handling iio: gyro: mpu3050-i2c: fix pm_runtime error handling iio: adc: ad7768-1: Fix ERR_PTR dereference in ad7768_fill_scale_tbl iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() iio: magnetometer: tlv493d: remove erroneous shift in X-axis data iio: proximity: hx9023s: Protect against division by zero in set_samp_freq iio: proximity: hx9023s: fix assignment order for __counted_by iio: chemical: bme680: Fix measurement wait duration calculation ... commit 4dad25aa60daced1d3bfbdd531c901620e8fb88f Merge: 1c9982b4961334 a75281626fc8fa Author: Linus Torvalds Date: Sat Mar 14 09:33:58 2026 -0700 Merge tag 'staging-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are three small staging driver fixes for 7.0-rc4 that resolve some reported problems. They are: - two rtl8723bs data validation bugfixes - sm750fb removal path bugfix All of these have been in linux-next for many weeks with no reported issues" * tag 'staging-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() staging: sm750fb: add missing pci_release_region on error and removal commit eeeff8dda634191c8e7599acf311df6758922b67 Merge: 74c1e2737bd5f7 f173d0f4c0f689 Author: Jakub Kicinski Date: Sat Mar 14 09:13:58 2026 -0700 Merge tag 'nf-26-03-13' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net This is a much earlier pull request than usual, due to the large backlog. We are aware of several unfixed issues, in particular in ctnetlink, patches are being worked on. The following patchset contains Netfilter fixes for *net*: 1) fix a use-after-free in ctnetlink, from Hyunwoo Kim, broken since v3.10. 2) add missing netlink range checks in ctnetlink, broken since v2.6 days. 3) fix content length truncation in sip conntrack helper, from Lukas Johannes Möller. Broken since 2.6.34. 4) Revert a recent patch to add stronger checks for overlapping ranges in nf_tables rbtree set type. Patch is correct, but several nftables version have a bug (now fixed) that trigger the checks incorrectly. 5) Reset mac header before the vlan push to avoid warning splat (and make things functional). From Eric Woudstra. 6) Add missing bounds check in H323 conntrack helper, broken since this helper was added 20 years ago, from Jenny Guanni Qu. 7) Fix a memory leak in the dynamic set infrastructure, from Pablo Neira Ayuso. Broken since v5.11. 8+9) a few spots failed to purge skbs queued to userspace via nfqueue, this causes RCU escape / use-after-free. Also from Pablo. broken since v3.4 added the CT target to xtables. 10) Fix undefined behaviour in xt_time, use u32 for a shift-by-31 operation, not s32, from Jenny Guanni Qu. 11) H323 conntrack helper lacks a check for length variable becoming negative after decrement, causes major out-of-bounds read due to cast to unsigned size later, also from Jenny. Both issues exist since 2.6 days. * tag 'nf-26-03-13' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() netfilter: xt_time: use unsigned int for monthday bit shift netfilter: xt_CT: drop pending enqueued packets on template removal netfilter: nft_ct: drop pending enqueued packets on removal nf_tables: nft_dynset: fix possible stateful expression memleak in error path netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case netfilter: nf_flow_table_ip: reset mac header before vlan push netfilter: revert nft_set_rbtree: validate open interval overlap netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() netfilter: conntrack: add missing netlink policy validations netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ==================== Link: https://patch.msgid.link/20260313150614.21177-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 74c1e2737bd5f70043654162476ebd01588439dc Merge: 922814879542c2 99b2c531e0e797 Author: Jakub Kicinski Date: Sat Mar 14 08:39:28 2026 -0700 Merge tag 'for-net-2026-03-12' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: Fix hci_le_create_conn_sync - MGMT: Fix list corruption and UAF in command complete handlers - L2CAP: Disconnect if received packet's SDU exceeds IMTU - L2CAP: Disconnect if sum of payload sizes exceed SDU - L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - L2CAP: Validate L2CAP_INFO_RSP payload length before access - L2CAP: Fix use-after-free in l2cap_unregister_user - ISO: Fix defer tests being unstable - HIDP: Fix possible UAF - SMP: make SM/PER/KDU/BI-04-C happy - qca: fix ROM version reading on WCN3998 chips * tag 'for-net-2026-03-12' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: qca: fix ROM version reading on WCN3998 chips Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user Bluetooth: HIDP: Fix possible UAF Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Bluetooth: hci_sync: Fix hci_le_create_conn_sync Bluetooth: ISO: Fix defer tests being unstable Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU ==================== Link: https://patch.msgid.link/20260312200655.1215688-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 17ad31b3a43b72aec3a3d83605891e1397d0d065 Author: Jeff Layton Date: Mon Feb 23 12:09:58 2026 -0500 sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the request's readers count but never checks whether it should free the request. In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the cache_request is removed from the queue and freed along with its buffer and cache_head reference. cache_release() lacks this cleanup. The only other path that frees requests with readers == 0 is cache_dequeue(), but it runs only when CACHE_PENDING transitions from set to clear. If that transition already happened while readers was still non-zero, cache_dequeue() will have skipped the request, and no subsequent call will clean it up. Add the same cleanup logic from cache_read() to cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request. Reported-by: NeilBrown Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@kernel.org Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit e7fcf179b82d3a3730fd8615da01b087cc654d0b Author: Chuck Lever Date: Thu Feb 19 16:50:17 2026 -0500 NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage. Reported-by: Misbah Anjum N Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/ Fixes: 96d851c4d28d ("nfsd: use proper net while reading "exports" file") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Tested-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit 48db892356d6cb80f6942885545de4a6dd8d2a29 Author: Chuck Lever Date: Thu Feb 19 16:50:16 2026 -0500 NFSD: Defer sub-object cleanup in export put callbacks svc_export_put() calls path_put() and auth_domain_put() immediately when the last reference drops, before the RCU grace period. RCU readers in e_show() and c_show() access both ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) without holding a reference. If cache_clean removes the entry and drops the last reference concurrently, the sub-objects are freed while still in use, producing a NULL pointer dereference in d_path. Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or ex_stats") moved kfree of ex_uuid and ex_stats into the call_rcu callback, but left path_put() and auth_domain_put() running before the grace period because both may sleep and call_rcu callbacks execute in softirq context. Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the callback until after the RCU grace period and executes it in process context where sleeping is permitted. This allows path_put() and auth_domain_put() to be moved into the deferred callback alongside the other resource releases. Apply the same fix to expkey_put(), which has the identical pattern with ek_path and ek_client. A dedicated workqueue scopes the shutdown drain to only NFSD export release work items; flushing the shared system_unbound_wq would stall on unrelated work from other subsystems. nfsd_export_shutdown() uses rcu_barrier() followed by flush_workqueue() to ensure all deferred release callbacks complete before the export caches are destroyed. Reported-by: Misbah Anjum N Closes: https://lore.kernel.org/linux-nfs/dcd371d3a95815a84ba7de52cef447b8@linux.ibm.com/ Fixes: c224edca7af0 ("nfsd: no need get cache ref when protected by rcu") Fixes: 1b10f0b603c0 ("SUNRPC: no need get cache ref when protected by rcu") Cc: stable@vger.kernel.org Reviwed-by: Jeff Layton Reviewed-by: NeilBrown Tested-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit 922814879542c2e397b0e9641fd36b8202a8e555 Author: Deepanshu Kartikey Date: Mon Mar 9 21:29:08 2026 +0530 atm: lec: fix use-after-free in sock_def_readable() A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue. The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown. Fix this by converting priv->lecd to an RCU-protected pointer: - Mark priv->lecd as __rcu in lec.h - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment - Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach() - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd - Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock. - Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns. v2: Switch from spinlock + sock_hold/put approach to RCU to properly fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet: 1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy. 2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue(). Note: Syzbot patch testing was attempted but the test VM terminated unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly. Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925 Link: https://lore.kernel.org/all/20260309093614.502094-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260309155908.508768-1-kartikey406@gmail.com Signed-off-by: Jakub Kicinski commit 59f68dc1d8df3142cb58fd2568966a9bb7b0ed8a Author: Matthew Schwartz Date: Fri Mar 13 10:25:03 2026 -0700 ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC Fixes lack of audio output on the ASUS ROG Flow Z13-KJP GZ302EAC model, similar to the ASUS ROG Flow Z13 GZ302EA. Signed-off-by: Matthew Schwartz Link: https://patch.msgid.link/20260313172503.285846-1-matthew.schwartz@linux.dev Signed-off-by: Takashi Iwai commit 7bae956cac0433c4d41aac9f1d04e42694e0b706 Author: Zhang Heng Date: Fri Mar 13 16:06:24 2026 +0800 ALSA: hda/realtek: add quirk for Lenovo Yoga 7 2-in-1 16AKP10 This machine is equipped with ALC287 and requires the quirk ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN to fix the issue where the bass speakers are not configured and the speaker volume cannot be controlled. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221210 Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260313080624.1395362-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 79a86a6cc3669416a21fef32d0767d39ba84b3aa Author: David Lechner Date: Sat Mar 7 19:44:09 2026 -0600 iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace Add a hack to push two timestamps in the hid-sensor-rotation scan data to avoid breaking userspace applications that depend on the timestamp being at the incorrect location in the scan data due to unintentional misalignment in older kernels. When this driver was written, the timestamp was in the correct location because of the way iio_compute_scan_bytes() was implemented at the time. (Samples were 24 bytes each.) Then commit 883f61653069 ("iio: buffer: align the size of scan bytes to size of the largest element") changed the computed scan_bytes to be a different size (32 bytes), which caused iio_push_to_buffers_with_timestamp() to place the timestamp at an incorrect offset. There have been long periods of time (6 years each) where the timestamp was in either location, so to not break either case, we open-code the timestamps to be pushed to both locations in the scan data. Reported-by: Jonathan Cameron Closes: https://lore.kernel.org/linux-iio/20260215162351.79f40b32@jic23-huawei/ Fixes: 883f61653069 ("iio: buffer: align the size of scan bytes to size of the largest element") Signed-off-by: David Lechner Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit 9e22e9c4a5bd208a2d17f0b1a8414c170b4e5939 Author: Nathan Chancellor Date: Thu Mar 5 15:25:18 2026 -0700 ARM: multi_v7_defconfig: Drop duplicate CONFIG_TI_PRUSS=m Commit ee1ab82ee032 ("ARM: defconfig: move entries") added a duplicate instance of CONFIG_TI_PRUSS=m, causing a Kconfig warning: arch/arm/configs/multi_v7_defconfig:1152:warning: override: reassigning to symbol TI_PRUSS Drop the first instance, as the second instance added by the aforementioned change is where savedefconfig puts it. Fixes: ee1ab82ee032 ("ARM: defconfig: move entries") Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20260305-arm-defconfig-drop-duplicate-ti-pruss-v1-1-2839e3b42a8b@kernel.org Signed-off-by: Krzysztof Kozlowski commit 9978d74031f25fde575bef3e4e3e35c5009091ce Author: Felix Gu Date: Wed Mar 4 22:14:32 2026 +0800 iio: proximity: rfd77402: Fix completion race condition in IRQ mode In IRQ mode, the completion was being reinitialized after the measurement command had already been sent to the hardware. This created a race condition where the IRQ handler could call complete() before reinit_completion() was executed. Consequently, wait_for_completion_timeout() would fail to see the signal and wait until it timed out. Move reinit_completion() to occur before the measurement command is triggered to ensure the synchronization primitive is ready to capture the interrupt. Fixes: dc81be96a73a ("iio: proximity: rfd77402: Add interrupt handling support") Signed-off-by: Felix Gu Reviewed-by: Shrikant Raskar Cc: Signed-off-by: Jonathan Cameron commit e2dcc248c3db0a420f07fba5638599e50866db62 Merge: 22e6afddb5f929 85c2601e2c2feb Author: Krzysztof Kozlowski Date: Sat Mar 14 12:01:58 2026 +0100 Merge tag 'renesas-fixes-for-v7.0-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas fixes for v7.0 - Fix SD card initialization on the RZ/T2H and RZ/N2H EVK boards, - Remove WDT nodes meant for other CPU cores on the RZ/V2H(P) SoC, - Fix Clock Pulse Generator registers on the RZ/T2H and RZ/N2H SoCs, - Fix Versa3-related boot hangs on the RZ/G3S SoM, - Fix Extended SPI interrupts on the R-Car X5H SoC. * tag 'renesas-fixes-for-v7.0-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: r8a78000: Fix out-of-range SPI interrupt numbers arm64: dts: renesas: rzg3s-smarc-som: Set bypass for Versa3 PLL2 arm64: dts: renesas: r9a09g087: Fix CPG register region sizes arm64: dts: renesas: r9a09g077: Fix CPG register region sizes arm64: dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes arm64: dts: renesas: rzv2-evk-cn15-sd: Add ramp delay for SD0 regulator arm64: dts: renesas: rzt2h-n2h-evk: Add ramp delay for SD0 card regulator Signed-off-by: Krzysztof Kozlowski commit dbbd550d7c8d90d3af9fe8a12a9caff077ddb8e3 Author: Vladimir Zapolskiy Date: Sat Mar 14 03:29:33 2026 +0200 interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes() The change to dynamic IDs for SM8450 platform interconnects left two links unconverted, fix it to avoid the NULL pointer dereference in runtime, when a pointer to a destination interconnect is not valid: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 <...> Call trace: icc_link_nodes+0x3c/0x100 (P) qcom_icc_rpmh_probe+0x1b4/0x528 platform_probe+0x64/0xc0 really_probe+0xc4/0x2a8 __driver_probe_device+0x80/0x140 driver_probe_device+0x48/0x170 __device_attach_driver+0xc0/0x148 bus_for_each_drv+0x88/0xf0 __device_attach+0xb0/0x1c0 device_initial_probe+0x58/0x68 bus_probe_device+0x40/0xb8 deferred_probe_work_func+0x90/0xd0 process_one_work+0x15c/0x3c0 worker_thread+0x2e8/0x400 kthread+0x150/0x208 ret_from_fork+0x10/0x20 Code: 900310f4 911d6294 91008280 94176078 (f94002a0) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception Fixes: 51513bec806f ("interconnect: qcom: sm8450: convert to dynamic IDs") Signed-off-by: Vladimir Zapolskiy Reviewed-by: Dmitry Baryshkov Link: https://msgid.link/20260314012933.350644-1-vladimir.zapolskiy@linaro.org Signed-off-by: Georgi Djakov commit 0d4aef630be9d5f9c1227d07669c26c4383b5ad0 Author: Yang Yang Date: Sat Mar 14 07:11:27 2026 +0000 batman-adv: avoid OGM aggregation when skb tailroom is insufficient When OGM aggregation state is toggled at runtime, an existing forwarded packet may have been allocated with only packet_len bytes, while a later packet can still be selected for aggregation. Appending in this case can hit skb_put overflow conditions. Reject aggregation when the target skb tailroom cannot accommodate the new packet. The caller then falls back to creating a new forward packet instead of appending. Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Signed-off-by: Yuan Tan Signed-off-by: Xin Liu Signed-off-by: Ao Zhou Signed-off-by: Yang Yang Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 5c52607c43c397b79a9852ce33fc61de58c3645c Author: Guenter Roeck Date: Wed Mar 4 12:39:34 2026 -0800 crypto: ccp - Fix leaking the same page twice Commit 551120148b67 ("crypto: ccp - Fix a case where SNP_SHUTDOWN is missed") fixed a case where SNP is left in INIT state if page reclaim fails. It removes the transition to the INIT state for this command and adjusts the page state management. While doing this, it added a call to snp_leak_pages() after a call to snp_reclaim_pages() failed. Since snp_reclaim_pages() already calls snp_leak_pages() internally on the pages it fails to reclaim, calling it again leaks the exact same page twice. Fix by removing the extra call to snp_leak_pages(). The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y. Assisted-by: Gemini:gemini-3.1-pro Fixes: 551120148b67 ("crypto: ccp - Fix a case where SNP_SHUTDOWN is missed") Cc: Tycho Andersen (AMD) Cc: Tom Lendacky Signed-off-by: Guenter Roeck Reviewed-by: Tom Lendacky Reviewed-by: Tycho Andersen (AMD) Signed-off-by: Herbert Xu commit 4819c64e61779a77abac552558803e546657bdb5 Merge: 263447532463cf fb22bb9701d48c Author: Linus Walleij Date: Sat Mar 14 00:37:21 2026 +0100 Merge tag 'renesas-pinctrl-fixes-for-v7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into fixes pinctrl: renesas: Fixes for v7.0 - Fix device node leaks and invalid wait contexts on RZ/T2H and RZ/N2H, - Fix GPIO .get() callback on RZ/A1. Signed-off-by: Linus Walleij commit 1c9982b4961334c1edb0745a04cabd34bc2de675 Merge: 9abff5748e4fb2 b28913e897edfe Author: Linus Torvalds Date: Fri Mar 13 15:38:55 2026 -0700 Merge tag 'drm-fixes-2026-03-14' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "The weekly drm fixes. This is mostly msm fixes across the functions, with amdgpu and i915. It also has a core rust fix and changes in nova-core to take advantage of it, and otherwise just has some minor driver fixes, and marks loongsoon as orphaned. rust: - Fix safety issue in dma_read! and dma_write! nova-core: - Fix UB in DmaGspMem pointer accessors - Fix stack overflow in GSP memory allocation loongsoon: - mark drm driver as unmaintained msm: - Core: - Adjusted msm_iommu_pagetable_prealloc_allocate() allocation type - DPU: - Fixed blue screens on Hamoa laptops by reverting the LM reservation - Fixed the size of the LM block on several platforms - Dropped usage of %pK (again) - Fixed smatch warning on SSPP v13+ code - Fixed INTF_6 interrupts on Lemans - DSI: - Fixed DSI PHY revision on Kaanapali - Fixed pixel clock calculation for the bonded DSI mode panels with compression enabled - DT bindings: - Fixed DisplayPort description on Glymur - Fixed model name in SM8750 MDSS schema - GPU: - Added MODULE_DEVICE_TABLE to the GPU driver - Fix bogus protect error on X2-85 - Fix dma_free_attrs() buffer size - Gen8 UBWC fix for Glymur i915: - Avoid hang when configuring VRR [icl] - Fix sg_table overflow with >4GB folios - Fix PSR Selective Update handling - Fix eDP ALPM read-out sequence amdgpu: - SMU13 fix - SMU14 fix - Fixes for bringup hw testing - Kerneldoc fix - GC12 idle power fix for compute workloads - DCCG fixes amdkfd: - Fix missing BO unreserve in an error path ivpu: - drop unnecessary bootparams register setting amdxdna: - fix runtime/suspend resume deadlock bridge: - ti-sn65dsi83: fix DSI rounding and dual LVDS gud: - fix NULL crtc dereference on display disable" * tag 'drm-fixes-2026-03-14' of https://gitlab.freedesktop.org/drm/kernel: (44 commits) drm/amd: Set num IP blocks to 0 if discovery fails drm/amdkfd: Unreserve bo if queue update failed drm/amd/display: Check for S0i3 to be done before DCCG init on DCN21 drm/amd/display: Add missing DCCG register entries for DCN20-DCN316 gpu: nova-core: gsp: fix UB in DmaGspMem pointer accessors drm/loongson: Mark driver as orphaned accel/amdxdna: Fix runtime suspend deadlock when there is pending job gpu: nova-core: fix stack overflow in GSP memory allocation accel/ivpu: Remove boot params address setting via MMIO register drm/i915/dp: Read ALPM caps after DPCD init drm/i915/psr: Write DSC parameters on Selective Update in ET mode drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters drm/i915/dsc: Add Selective Update register definitions drm/i915/psr: Repeat Selective Update area alignment drm/i915: Fix potential overflow of shmem scatterlist length drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding drm/gud: fix NULL crtc dereference on display disable drm/sitronix/st7586: fix bad pixel data due to byte swap ... commit 9abff5748e4fb2055a54de6b8e43f4395d2481d9 Merge: b073bcb8d43fd3 98c790b1007641 Author: Linus Torvalds Date: Fri Mar 13 15:11:05 2026 -0700 Merge tag 'wq-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fixes from Tejun Heo: - Improve workqueue stall diagnostics: dump all busy workers (not just running ones), show wall-clock duration of in-flight work items, and add a sample module for reproducing stalls - Fix POOL_BH vs WQ_BH flag namespace mismatch in pr_cont_worker_id() - Rename pool->watchdog_ts to pool->last_progress_ts and related functions for clarity * tag 'wq-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Rename show_cpu_pool{s,}_hog{s,}() to reflect broadened scope workqueue: Add stall detector sample module workqueue: Show all busy workers in stall diagnostics workqueue: Show in-flight work item duration in stall diagnostics workqueue: Rename pool->watchdog_ts to pool->last_progress_ts workqueue: Use POOL_BH instead of WQ_BH when checking pool flags commit b073bcb8d43fd39f00ef07df5a47818a99c999eb Merge: 8369b2e97d8065 a72f73c4dd9b20 Author: Linus Torvalds Date: Fri Mar 13 15:06:31 2026 -0700 Merge tag 'cgroup-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Hide PF_EXITING tasks from cgroup.procs to avoid exposing dead tasks that haven't been removed yet, fixing a systemd timeout issue on PREEMPT_RT - Call rebuild_sched_domains() directly in CPU hotplug instead of deferring to a workqueue, fixing a race where online/offline CPUs could briefly appear in stale sched domains * tag 'cgroup-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Don't expose dead tasks in cgroup cgroup/cpuset: Call rebuild_sched_domains() directly in hotplug commit 8369b2e97d806537dcdba1d6b3bb46fb1407dab0 Merge: 8040dc41d27265 2fcfe5951eb2e8 Author: Linus Torvalds Date: Fri Mar 13 14:54:56 2026 -0700 Merge tag 'sched_ext-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix data races flagged by KCSAN: add missing READ_ONCE()/WRITE_ONCE() annotations for lock-free accesses to module parameters and dsq->seq - Fix silent truncation of upper 32 enqueue flags (SCX_ENQ_PREEMPT and above) when passed through the int sched_class interface - Documentation updates: scheduling class precedence, task ownership state machine, example scheduler descriptions, config list cleanup - Selftest fix for format specifier and buffer length in file_write_long() * tag 'sched_ext-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Use WRITE_ONCE() for the write side of scx_enable helper pointer sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags sched_ext: Documentation: Update sched-ext.rst sched_ext: Use READ_ONCE() for scx_slice_bypass_us in scx_bypass() sched_ext: Documentation: Mention scheduling class precedence sched_ext: Document task ownership state machine sched_ext: Use READ_ONCE() for lock-free reads of module param variables sched_ext/selftests: Fix format specifier and buffer length in file_write_long() sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update commit 8040dc41d272658ac22939ed9cb5ff24240ad851 Merge: 8d9968859cf4ef 35b16a7a2c4fc4 Author: Linus Torvalds Date: Fri Mar 13 14:24:15 2026 -0700 Merge tag 'perf-tools-fixes-for-v7.0-1-2026-03-13' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix stale build ID in module MMAP2 records in events synthesized for pre-existing processes - Fix rust cross compilation - hashmap__new() error pointer return handling fixes - Fix off-by-one bug in outside of functions check on the disasm code - Update header copies of kernel headers, including prctl.h, mount.h, fs.h, irq_vectors.h, perf_event.h, gfp_types.h, kvm.h, cpufeatures.h msr-index.h, also the syscall tables files that introduced the 'rseq_slice_yield' syscall - Finish removal of ETM_OPT_* on the ARM coresight support, needed to sync the coresight-pmu.h header with the kernel sources - Make in-target rule robust against too long argument error * tag 'perf-tools-fixes-for-v7.0-1-2026-03-13' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (22 commits) perf synthetic-events: Fix stale build ID in module MMAP2 records perf annotate loongarch: Fix off-by-one bug in outside check perf ftrace: Fix hashmap__new() error checking perf annotate: Fix hashmap__new() error checking perf cs-etm: Sync coresight-pmu.h header with the kernel sources perf cs-etm: Finish removal of ETM_OPT_* tools headers UAPI: Update tools' copy of linux/coresight-pmu.h tools headers: Update the syscall tables and unistd.h, to support the new 'rseq_slice_yield' syscall perf disasm: Fix off-by-one bug in outside check tools arch x86: Sync msr-index.h to pick MSR_{OMR_[0-3],CORE_PERF_GLOBAL_STATUS_SET} tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources tools headers x86 cpufeatures: Sync with the kernel sources tools headers UAPI: Sync linux/kvm.h with the kernel sources tools headers: Update the linux/gfp_types.h copy with the kernel sources perf beauty: Update the linux/perf_event.h copy with the kernel sources perf beauty: Update the arch/x86/include/asm/irq_vectors.h copy with the kernel sources perf beauty: Sync UAPI linux/fs.h with kernel sources perf beauty: Sync linux/mount.h copy with the kernel sources tools build: Fix rust cross compilation perf build: Prevent "argument list too long" error ... commit 8d9968859cf4efabf39b4c22eacdb990e5f7178e Merge: 2c361c9b7f452c 598bbefa8032cc Author: Linus Torvalds Date: Fri Mar 13 14:18:13 2026 -0700 Merge tag 's390-7.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Revert IRQ entry/exit path optimization that incorrectly cleared some PSW bits before irqentry_exit(), causing boot failures with linux-next and HRTIMER_REARM_DEFERRED (which only uncovered the problem) - Fix zcrypt code to show CCA card serial numbers even when the default crypto domain is offline by selecting any domain available, preventing empty sysfs entries * tag 's390-7.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute s390: Revert "s390/irq/idle: Remove psw bits early" commit b2ae73d954f71c7dd605eecfd817ed018dce7cc7 Author: Saurabh Sengar Date: Thu Mar 12 21:21:48 2026 -0700 MAINTAINERS: Update maintainers for Hyper-V DRM driver Add myself, Dexuan, and Long as maintainers. Deepak is stepping down from these responsibilities. Signed-off-by: Saurabh Sengar Signed-off-by: Wei Liu commit 6922db250422a0dfee34de322f86b7a73d713d33 Author: Stanislav Kinsburskii Date: Thu Mar 12 16:02:53 2026 +0000 mshv: Fix use-after-free in mshv_map_user_memory error path In the error path of mshv_map_user_memory(), calling vfree() directly on the region leaves the MMU notifier registered. When userspace later unmaps the memory, the notifier fires and accesses the freed region, causing a use-after-free and potential kernel panic. Replace vfree() with mshv_partition_put() to properly unregister the MMU notifier before freeing the region. Fixes: b9a66cd5ccbb9 ("mshv: Add support for movable memory regions") Signed-off-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit 2c361c9b7f452cf5331fe0d1230ab23c374a1fd2 Merge: 399af66228cfd7 b282c43ed156ae Author: Linus Torvalds Date: Fri Mar 13 14:03:58 2026 -0700 Merge tag 'ceph-for-7.0-rc4' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A small pile of CephFS and messenger bug fixes, all marked for stable" * tag 'ceph-for-7.0-rc4' of https://github.com/ceph/ceph-client: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() libceph: Use u32 for non-negative values in ceph_monmap_decode() MAINTAINERS: update email address of Dongsheng Yang libceph: reject preamble if control segment is empty libceph: admit message frames only in CEPH_CON_S_OPEN state libceph: prevent potential out-of-bounds reads in process_message_header() ceph: do not skip the first folio of the next object in writeback ceph: fix memory leaks in ceph_mdsc_build_path() ceph: add a bunch of missing ceph_path_info initializers ceph: fix i_nlink underrun during async unlink commit 399af66228cfd7df79dc360810b6b673000f8090 Merge: d874ca05223894 362c4909808679 Author: Linus Torvalds Date: Fri Mar 13 10:49:15 2026 -0700 Merge tag 'xfs-fixes-7.0-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "A couple race fixes found on the new healthmon mechanism, and another flushing dquots during filesystem shutdown" * tag 'xfs-fixes-7.0-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix integer overflow in bmap intent sort comparator xfs: fix undersized l_iclog_roundoff values xfs: ensure dquot item is deleted from AIL only after log shutdown xfs: remove redundant set null for ip->i_itemp xfs: fix returned valued from xfs_defer_can_append xfs: Remove redundant NULL check after __GFP_NOFAIL xfs: fix race between healthmon unmount and read_iter xfs: remove scratch field from struct xfs_gc_bio commit d874ca0522389405e26bc2ba38b59c9849c52cc1 Merge: b36eb6e3f5d8d4 e3beefd3af09f8 Author: Linus Torvalds Date: Fri Mar 13 10:46:32 2026 -0700 Merge tag 'v7.0-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix reconnect when using non-default port - Fix default retransmission behavior - Fix open handle reuse in cifs_open - Fix export for smb2-mapperror-test - Fix potential corruption on write retry - Fix potentially uninitialized superblock flags - Fix missing O_DIRECT and O_SYNC flags on create * tag 'v7.0-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: make default value of retrans as zero smb: client: fix open handle lookup in cifs_open() smb: client: fix iface port assignment in parse_server_interfaces smb/client: only export symbol for 'smb2maperror-test' module smb: client: fix in-place encryption corruption in SMB2_write() smb: client: fix sbflags initialization smb: client: fix atomic open with O_DIRECT & O_SYNC commit b36eb6e3f5d8d48798617e554fc886d277921f69 Merge: ff30ea1fb1c0f3 f879365c5bb210 Author: Linus Torvalds Date: Fri Mar 13 10:31:10 2026 -0700 Merge tag 'spi-fix-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of device ID and quirk updates, plus a bunch of small fixes most of which (other than the Cadence one) are unremarkable error handling fixes" * tag 'spi-fix-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: atcspi200: Handle invalid buswidth and fix compiler warning spi: dt-bindings: sun6i: Allow Dual SPI and Quad SPI for newer SoCs spi: intel-pci: Add support for Nova Lake mobile SPI flash spi: cadence-qspi: Fix requesting of APB and AHB clocks on JH7110 spi: rockchip-sfc: Fix double-free in remove() callback spi: atcspi200: Fix double-free in atcspi_configure_dma() spi: amlogic: spifc-a4: Fix DMA mapping error handling commit ff30ea1fb1c0f3077ce02781641e240964b7fb89 Merge: 56cf10db2ae0bb 21b3fb7dc19caa Author: Linus Torvalds Date: Fri Mar 13 10:29:45 2026 -0700 Merge tag 'regulator-fix-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of small driver specific fixes for pca9450, cleaning up logging and fixing warnings due to confusion with interrupt type" * tag 'regulator-fix-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: pca9450: Correct probed name for PCA9452 regulator: pca9450: Correct interrupt type commit d0d9b1f4f5391e6a00cee81d73ed2e8f98446d5f Author: Vyacheslav Vahnenko Date: Fri Mar 13 15:36:38 2026 +0300 USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed Add USB_QUIRK_NO_BOS for ezcap401 capture card, without it dmesg will show "unable to get BOS descriptor or descriptor too short" and "unable to read config index 0 descriptor/start: -71" errors and device will not able to work at full speed at 10gbs Signed-off-by: Vyacheslav Vahnenko Cc: stable Link: https://patch.msgid.link/20260313123638.20481-1-vahnenko2003@gmail.com Signed-off-by: Greg Kroah-Hartman commit 56cf10db2ae0bb90c69b644d639b559106d52a8d Merge: 73548503dca50d 9250673cf23572 Author: Linus Torvalds Date: Fri Mar 13 10:15:14 2026 -0700 Merge tag 'sound-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "There have been continuous flux but most of them are device-specific small fixes, while we see a few core fixes at this time (minor PCM fix for linked streams and a few ASoC core fixes for delayed work, etc) Core: - PCM: Fix use-after-free in linked stream drain ASoC: - core: Fixes for delayed works, empty DMI string handling and DT overlay - qcom: qdsp6: Fix ADSP stop/start crash via component removal ordering - tegra: Add support for Tegra238 audio graph card - amd: Fix missing error checks for clock acquisition - rt1011: Fix incorrect DAPM context retrieval helper HD-audio: - Add quirk for Gigabyte H610M, ASUS UM6702RC, HP 14s-dr5xxx, and ThinkPad X390 USB-audio: - Scarlett2: Fix NULL dereference for malformed endpoint descriptors - Add quirk for SPACETOUCH" * tag 'sound-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition ASoC: detect empty DMI strings ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition ALSA: usb-audio: Add iface reset and delay quirk for SPACETOUCH USB Audio ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays ASoC: soc-core: flush delayed work before removing DAIs and widgets ASoC: soc-core: drop delayed_work_pending() check before flush ASoC: tegra: Add support for Tegra238 soundcard ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk ALSA: hda/realtek: add quirk for ASUS UM6702RC ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone firmware: cs_dsp: Fix fragmentation regression in firmware download ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start commit 73548503dca50d2c2aa8c8cbb6eb8c1bf5959b21 Merge: e67bf352a0847a 7d0abefec48dfe Author: Linus Torvalds Date: Fri Mar 13 10:13:06 2026 -0700 Merge tag 'block-7.0-20260312' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Fix nvme-pci IRQ race and slab-out-of-bounds access - Fix recursive workqueue locking for target async events - Various cleanups - Fix a potential NULL pointer dereference in ublk on size setting - ublk automatic partition scanning fix - Two s390 dasd fixes * tag 'block-7.0-20260312' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: nvme: Annotate struct nvme_dhchap_key with __counted_by nvme-core: do not pass empty queue_limits to blk_mq_alloc_queue() nvme-pci: Fix race bug in nvme_poll_irqdisable() nvmet: move async event work off nvmet-wq nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set s390/dasd: Copy detected format information to secondary device s390/dasd: Move quiesce state with pprc swap ublk: don't clear GD_SUPPRESS_PART_SCAN for unprivileged daemons ublk: fix NULL pointer dereference in ublk_ctrl_set_size() commit e67bf352a0847a65a157d5b02a6024c65a781e08 Merge: 8174dafb2d9a85 c2c185be5c85d3 Author: Linus Torvalds Date: Fri Mar 13 10:09:35 2026 -0700 Merge tag 'io_uring-7.0-20260312' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix an inverted true/false comment on task_no_new_privs, from the BPF filtering changes merged in this release - Use the migration disabling way of running the BPF filters, as the io_uring side doesn't do that already - Fix an issue with ->rings stability under resize, both for local task_work additions and for eventfd signaling - Fix an issue with SQE mixed mode, where a bounds check wasn't correct for having a 128b SQE - Fix an issue where a legacy provided buffer group is changed to to ring mapped one while legacy buffers from that group are in flight * tag 'io_uring-7.0-20260312' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/kbuf: check if target buffer list is still legacy on recycle io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops io_uring/eventfd: use ctx->rings_rcu for flags checking io_uring: ensure ctx->rings is stable for task work flags manipulation io_uring/bpf_filter: use bpf_prog_run_pin_on_cpu() to prevent migration io_uring/register: fix comment about task_no_new_privs commit 8174dafb2d9a85c895d3bfb9cc3e7c236107c93f Merge: 92e989acfb8349 464b1c115852fe Author: Linus Torvalds Date: Fri Mar 13 10:07:33 2026 -0700 Merge tag 'slab-for-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Fix for a memory leak that can occur when already so low on memory that we can't allocate a new slab anymore (Qing Wang) - Fix for a case where slabobj_ext array for a slab might be allocated from the same slab, making it permanently non-freeable (Harry Yoo) * tag 'slab-for-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: fix memory leak when refill_sheaf() fails mm/slab: fix an incorrect check in obj_exts_alloc_size() commit 92e989acfb83493e0305bc9fdcc666275ddd46c9 Merge: 0257f64bdac7fd 5c3daa5301693d Author: Linus Torvalds Date: Fri Mar 13 10:06:00 2026 -0700 Merge tag 'pwrseq-fixes-for-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing fix from Bartosz Golaszewski: - fix OF-node reference leak in pwrseq-pcie-m2 * tag 'pwrseq-fixes-for-v7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: pcie-m2: Fix device node reference leak in probe commit f173d0f4c0f689173f8cdac79991043a4a89bf66 Author: Jenny Guanni Qu Date: Thu Mar 12 14:49:50 2026 +0000 netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read. Add a check to ensure len is positive after the decrement. Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper") Reported-by: Klaudia Kloc Reported-by: Dawid Moczadło Tested-by: Jenny Guanni Qu Signed-off-by: Jenny Guanni Qu Signed-off-by: Florian Westphal commit 00050ec08cecfda447e1209b388086d76addda3a Author: Jenny Guanni Qu Date: Thu Mar 12 14:59:49 2026 +0000 netfilter: xt_time: use unsigned int for monthday bit shift The monthday field can be up to 31, and shifting a signed integer 1 by 31 positions (1 << 31) is undefined behavior in C, as the result overflows a 32-bit signed int. Use 1U to ensure well-defined behavior for all valid monthday values. Change the weekday shift to 1U as well for consistency. Fixes: ee4411a1b1e0 ("[NETFILTER]: x_tables: add xt_time match") Reported-by: Klaudia Kloc Reported-by: Dawid Moczadło Tested-by: Jenny Guanni Qu Signed-off-by: Jenny Guanni Qu Signed-off-by: Florian Westphal commit f62a218a946b19bb59abdd5361da85fa4606b96b Author: Pablo Neira Ayuso Date: Thu Mar 12 13:48:48 2026 +0100 netfilter: xt_CT: drop pending enqueued packets on template removal Templates refer to objects that can go away while packets are sitting in nfqueue refer to: - helper, this can be an issue on module removal. - timeout policy, nfnetlink_cttimeout might remove it. The use of templates with zone and event cache filter are safe, since this just copies values. Flush these enqueued packets in case the template rule gets removed. Fixes: 24de58f46516 ("netfilter: xt_CT: allow to attach timeout policy + glue code") Reported-by: Yiming Qian Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 36eae0956f659e48d5366d9b083d9417f3263ddc Author: Pablo Neira Ayuso Date: Thu Mar 12 13:48:47 2026 +0100 netfilter: nft_ct: drop pending enqueued packets on removal Packets sitting in nfqueue might hold a reference to: - templates that specify the conntrack zone, because a percpu area is used and module removal is possible. - conntrack timeout policies and helper, where object removal leave a stale reference. Since these objects can just go away, drop enqueued packets to avoid stale reference to them. If there is a need for finer grain removal, this logic can be revisited to make selective packet drop upon dependencies. Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") Reported-by: Yiming Qian Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 0548a13b5a145b16e4da0628b5936baf35f51b43 Author: Pablo Neira Ayuso Date: Thu Mar 12 12:38:59 2026 +0100 nf_tables: nft_dynset: fix possible stateful expression memleak in error path If cloning the second stateful expression in the element via GFP_ATOMIC fails, then the first stateful expression remains in place without being released.   unreferenced object (percpu) 0x607b97e9cab8 (size 16):     comm "softirq", pid 0, jiffies 4294931867     hex dump (first 16 bytes on cpu 3):       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     backtrace (crc 0):       pcpu_alloc_noprof+0x453/0xd80       nft_counter_clone+0x9c/0x190 [nf_tables]       nft_expr_clone+0x8f/0x1b0 [nf_tables]       nft_dynset_new+0x2cb/0x5f0 [nf_tables]       nft_rhash_update+0x236/0x11c0 [nf_tables]       nft_dynset_eval+0x11f/0x670 [nf_tables]       nft_do_chain+0x253/0x1700 [nf_tables]       nft_do_chain_ipv4+0x18d/0x270 [nf_tables]       nf_hook_slow+0xaa/0x1e0       ip_local_deliver+0x209/0x330 Fixes: 563125a73ac3 ("netfilter: nftables: generalize set extension to support for several expressions") Reported-by: Gurpreet Shergill Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 1e3a3593162c96e8a8de48b1e14f60c3b57fca8a Author: Jenny Guanni Qu Date: Thu Mar 12 02:29:32 2026 +0000 netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking that len bytes remain in the buffer. The existing boundary check only validates the 2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint() reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte slab-out-of-bounds read. Add a boundary check for len bytes after get_bits() and before get_uint(). Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper") Reported-by: Klaudia Kloc Reported-by: Dawid Moczadło Signed-off-by: Jenny Guanni Qu Signed-off-by: Florian Westphal commit a3aca98aec9a278ee56da4f8013bfa1dd1a1c298 Author: Eric Woudstra Date: Tue Mar 10 15:39:33 2026 +0100 netfilter: nf_flow_table_ip: reset mac header before vlan push With double vlan tagged packets in the fastpath, getting the error: skb_vlan_push got skb with skb->data not at mac header (offset 18) Call skb_reset_mac_header() before calling skb_vlan_push(). Fixes: c653d5a78f34 ("netfilter: flowtable: inline vlan encapsulation in xmit path") Signed-off-by: Eric Woudstra Acked-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 598adea720b97572c7028635cb1c59b3684e128c Author: Florian Westphal Date: Wed Mar 11 16:24:02 2026 +0100 netfilter: revert nft_set_rbtree: validate open interval overlap This reverts commit 648946966a08 ("netfilter: nft_set_rbtree: validate open interval overlap"). There have been reports of nft failing to laod valid rulesets after this patch was merged into -stable. I can reproduce several such problem with recent nft versions, including nft 1.1.6 which is widely shipped by distributions. We currently have little choice here. This commit can be resurrected at some point once the nftables fix that triggers the false overlap positive has appeared in common distros (see e83e32c8d1cd ("mnl: restore create element command with large batches" in nftables.git). Fixes: 648946966a08 ("netfilter: nft_set_rbtree: validate open interval overlap") Acked-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit fbce58e719a17aa215c724473fd5baaa4a8dc57c Author: Lukas Johannes Möller Date: Tue Mar 10 21:49:01 2026 +0000 netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are silently truncated before computing the SIP message boundary. For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate where the current message ends. The loop then treats trailing data in the TCP segment as a second SIP message and processes it through the SDP parser. Fix this by changing clen to unsigned long to match the return type of simple_strtoul(), and reject Content-Length values that exceed the remaining TCP payload length. Fixes: f5b321bd37fb ("netfilter: nf_conntrack_sip: add TCP support") Signed-off-by: Lukas Johannes Möller Signed-off-by: Florian Westphal commit f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05 Author: Florian Westphal Date: Tue Mar 10 00:28:29 2026 +0100 netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly. Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN. Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations") Fixes: a258860e01b8 ("netfilter: ctnetlink: add full support for SCTP to ctnetlink") Reported-by: Hyunwoo Kim Signed-off-by: Florian Westphal commit 5cb81eeda909dbb2def209dd10636b51549a3f8a Author: Hyunwoo Kim Date: Sun Mar 8 02:21:37 2026 +0900 netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the conntrack reference immediately after netlink_dump_start(). When the dump spans multiple rounds, the second recvmsg() triggers the dump callback which dereferences the now-freed conntrack via nfct_help(ct), leading to a use-after-free on ct->ext. The bug is that the netlink_dump_control has no .start or .done callbacks to manage the conntrack reference across dump rounds. Other dump functions in the same file (e.g. ctnetlink_get_conntrack) properly use .start/.done callbacks for this purpose. Fix this by adding .start and .done callbacks that hold and release the conntrack reference for the duration of the dump, and move the nfct_help() call after the cb->args[0] early-return check in the dump callback to avoid dereferencing ct->ext unnecessarily. BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0 Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133 CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY Call Trace: ctnetlink_exp_ct_dump_table+0x4f/0x2e0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 ? aa_sk_perm+0x184/0x450 sock_recvmsg+0xde/0xf0 Allocated by task 133: kmem_cache_alloc_noprof+0x134/0x440 __nf_conntrack_alloc+0xa8/0x2b0 ctnetlink_create_conntrack+0xa1/0x900 ctnetlink_new_conntrack+0x3cf/0x7d0 nfnetlink_rcv_msg+0x48e/0x510 netlink_rcv_skb+0xc9/0x1f0 nfnetlink_rcv+0xdb/0x220 netlink_unicast+0x3ec/0x590 netlink_sendmsg+0x397/0x690 __sys_sendmsg+0xf4/0x180 Freed by task 0: slab_free_after_rcu_debug+0xad/0x1e0 rcu_core+0x5c3/0x9c0 Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack") Signed-off-by: Hyunwoo Kim Signed-off-by: Florian Westphal commit fb75437b447875ae97ea3a173e734dbd553a3881 Author: Krzysztof Kozlowski Date: Fri Mar 6 18:27:18 2026 +0000 arm_mpam: Force __iomem casts Code allocates standard kernel memory to pass to the MPAM, which expects __iomem. The code is safe, because __iomem accessors should work fine on kernel mapped memory, however leads to sparse warnings: test_mpam_devices.c:327:42: warning: incorrect type in initializer (different address spaces) test_mpam_devices.c:327:42: expected char [noderef] __iomem *buf test_mpam_devices.c:327:42: got void * test_mpam_devices.c:342:24: warning: cast removes address space '__iomem' of expression Cast the pointer to memory via __force to silence them. Signed-off-by: Krzysztof Kozlowski Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512160133.eAzPdJv2-lkp@intel.com/ Acked-by: Ben Horgan Signed-off-by: James Morse Signed-off-by: Will Deacon commit c1376f1ff3f016a4b84e8030ed69df82e018d231 Author: Ben Horgan Date: Fri Mar 6 18:27:17 2026 +0000 arm_mpam: Disable preemption when making accesses to fake MSC in kunit test Accesses to MSC must be made from a cpu that is affine to that MSC and the driver checks this in __mpam_write_reg() using smp_processor_id(). A fake in-memory MSC is used for testing. When using that, it doesn't matter which cpu we access it from but calling smp_processor_id() from a preemptible context gives warnings when running with CONFIG_DEBUG_PREEMPT. Add a test helper that wraps mpam_reset_msc_bitmap() with preemption disabled to ensure all (fake) MSC accesses are made with preemption disabled. Signed-off-by: Ben Horgan Reviewed-by: James Morse Signed-off-by: James Morse Signed-off-by: Will Deacon commit 4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415 Author: Ben Horgan Date: Fri Mar 6 18:27:16 2026 +0000 arm_mpam: Fix null pointer dereference when restoring bandwidth counters When an MSC supporting memory bandwidth monitoring is brought offline and then online, mpam_restore_mbwu_state() calls __ris_msmon_read() via ipi to restore the configuration of the bandwidth counters. It doesn't care about the value read, mbwu_arg.val, and doesn't set it leading to a null pointer dereference when __ris_msmon_read() adds to it. This results in a kernel oops with a call trace such as: Call trace: __ris_msmon_read+0x19c/0x64c (P) mpam_restore_mbwu_state+0xa0/0xe8 smp_call_on_cpu_callback+0x1c/0x38 process_one_work+0x154/0x4b4 worker_thread+0x188/0x310 kthread+0x11c/0x130 ret_from_fork+0x10/0x20 Provide a local variable for val to avoid __ris_msmon_read() dereferencing a null pointer when adding to val. Fixes: 41e8a14950e1 ("arm_mpam: Track bandwidth counter state for power management") Signed-off-by: Ben Horgan Reviewed-by: James Morse Signed-off-by: James Morse Signed-off-by: Will Deacon commit d499e9627d70b1269020d59b95ed3e18bee6b8cd Author: Pepper Gray Date: Tue Mar 10 14:44:28 2026 +0100 arm64/scs: Fix handling of advance_loc4 DW_CFA_advance_loc4 is defined but no handler is implemented. Its CFA opcode defaults to EDYNSCS_INVALID_CFA_OPCODE triggering an error which wrongfully prevents modules from loading. Link: https://bugs.gentoo.org/971060 Signed-off-by: Pepper Gray Signed-off-by: Will Deacon commit 5ef268cb7a0aac55521fd9881f1939fa94a8988e Author: Masami Hiramatsu (Google) Date: Fri Mar 13 23:04:11 2026 +0900 kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() Remove unneeded warnings for handled errors from __arm_kprobe_ftrace() because all caller handled the error correctly. Link: https://lore.kernel.org/all/177261531182.1312989.8737778408503961141.stgit@mhiramat.tok.corp.google.com/ Reported-by: Zw Tang Closes: https://lore.kernel.org/all/CAPHJ_V+J6YDb_wX2nhXU6kh466Dt_nyDSas-1i_Y8s7tqY-Mzw@mail.gmail.com/ Fixes: 9c89bb8e3272 ("kprobes: treewide: Cleanup the error messages for kprobes") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit e113f0b46d19626ec15388bcb91432c9a4fd6261 Author: Masami Hiramatsu (Google) Date: Fri Mar 13 23:14:14 2026 +0900 kprobes: avoid crash when rmmod/insmod after ftrace killed After we hit ftrace is killed by some errors, the kernel crash if we remove modules in which kprobe probes. BUG: unable to handle page fault for address: fffffbfff805000d PGD 817fcc067 P4D 817fcc067 PUD 817fc8067 PMD 101555067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI CPU: 4 UID: 0 PID: 2012 Comm: rmmod Tainted: G W OE Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE RIP: 0010:kprobes_module_callback+0x89/0x790 RSP: 0018:ffff88812e157d30 EFLAGS: 00010a02 RAX: 1ffffffff805000d RBX: dffffc0000000000 RCX: ffffffff86a8de90 RDX: ffffed1025c2af9b RSI: 0000000000000008 RDI: ffffffffc0280068 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1025c2af9a R10: ffff88812e157cd7 R11: 205d323130325420 R12: 0000000000000002 R13: ffffffffc0290488 R14: 0000000000000002 R15: ffffffffc0280040 FS: 00007fbc450dd740(0000) GS:ffff888420331000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff805000d CR3: 000000010f624000 CR4: 00000000000006f0 Call Trace: notifier_call_chain+0xc6/0x280 blocking_notifier_call_chain+0x60/0x90 __do_sys_delete_module.constprop.0+0x32a/0x4e0 do_syscall_64+0x5d/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is because the kprobe on ftrace does not correctly handles the kprobe_ftrace_disabled flag set by ftrace_kill(). To prevent this error, check kprobe_ftrace_disabled in __disarm_kprobe_ftrace() and skip all ftrace related operations. Link: https://lore.kernel.org/all/176473947565.1727781.13110060700668331950.stgit@mhiramat.tok.corp.google.com/ Reported-by: Ye Bin Closes: https://lore.kernel.org/all/20251125020536.2484381-1-yebin@huaweicloud.com/ Fixes: ae6aa16fdc16 ("kprobes: introduce ftrace based optimization") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Acked-by: Steven Rostedt (Google) commit 7d73872d949c488a1d7c308031d6a9d89b5e0a8b Author: Deepanshu Kartikey Date: Fri Mar 13 14:54:17 2026 +0530 wifi: mac80211: check tdls flag in ieee80211_tdls_oper When NL80211_TDLS_ENABLE_LINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDLS stations, causing unintended side effects like modifying channel context and HT protection before failing. Add a check for sta->sta.tdls early in the ENABLE_LINK case, before any side effects occur, to ensure the operation is only allowed for actual TDLS peers. Reported-by: syzbot+56b6a844a4ea74487b7b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=56b6a844a4ea74487b7b Tested-by: syzbot+56b6a844a4ea74487b7b@syzkaller.appspotmail.com Suggested-by: Johannes Berg Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260313092417.520807-1-kartikey406@gmail.com Signed-off-by: Johannes Berg commit fc1cd1f18c34f91e78362f9629ab9fd43b9dcab9 Author: ZhengYuan Huang Date: Thu Mar 12 08:33:21 2026 +0800 btrfs: tree-checker: fix misleading root drop_level error message Fix tree-checker error message to report "invalid root drop_level" instead of the misleading "invalid root level". Fixes: 259ee7754b67 ("btrfs: tree-checker: Add ROOT_ITEM check") Reviewed-by: Qu Wenruo Signed-off-by: ZhengYuan Huang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9573a365ff9ff45da9222d3fe63695ce562beb24 Author: Filipe Manana Date: Tue Mar 3 16:57:43 2026 +0000 btrfs: log new dentries when logging parent dir of a conflicting inode If we log the parent directory of a conflicting inode, we are not logging the new dentries of the directory, so when we finish we have the parent directory's inode marked as logged but we did not log its new dentries. As a consequence if the parent directory is explicitly fsynced later and it does not have any new changes since we logged it, the fsync is a no-op and after a power failure the new dentries are missing. Example scenario: $ mkdir foo $ sync $rmdir foo $ mkdir dir1 $ mkdir dir2 # A file with the same name and parent as the directory we just deleted # and was persisted in a past transaction. So the deleted directory's # inode is a conflicting inode of this new file's inode. $ touch foo $ ln foo dir2/link # The fsync on dir2 will log the parent directory (".") because the # conflicting inode (deleted directory) does not exists anymore, but it # it does not log its new dentries (dir1). $ xfs_io -c "fsync" dir2 # This fsync on the parent directory is no-op, since the previous fsync # logged it (but without logging its new dentries). $ xfs_io -c "fsync" . # After log replay dir1 is missing. Fix this by ensuring we log new dir dentries whenever we log the parent directory of a no longer existing conflicting inode. A test case for fstests will follow soon. Reported-by: Vyacheslav Kovalevsky Link: https://lore.kernel.org/linux-btrfs/182055fa-e9ce-4089-9f5f-4b8a23e8dd91@gmail.com/ Fixes: a3baaf0d786e ("Btrfs: fix fsync after succession of renames and unlink/rmdir") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 77603ab10429fe713a03345553ca8dbbfb1d91c6 Author: Johannes Thumshirn Date: Tue Mar 3 11:53:46 2026 +0100 btrfs: don't take device_list_mutex when querying zone info Shin'ichiro reported sporadic hangs when running generic/013 in our CI system. When enabling lockdep, there is a lockdep splat when calling btrfs_get_dev_zone_info_all_devices() in the mount path that can be triggered by i.e. generic/013: ====================================================== WARNING: possible circular locking dependency detected 7.0.0-rc1+ #355 Not tainted ------------------------------------------------------ mount/1043 is trying to acquire lock: ffff8881020b5470 (&vblk->vdev_mutex){+.+.}-{4:4}, at: virtblk_report_zones+0xda/0x430 but task is already holding lock: ffff888102a738e0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: btrfs_get_dev_zone_info_all_devices+0x45/0x90 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&fs_devs->device_list_mutex){+.+.}-{4:4}: __mutex_lock+0xa3/0x1360 btrfs_create_pending_block_groups+0x1f4/0x9d0 __btrfs_end_transaction+0x3e/0x2e0 btrfs_zoned_reserve_data_reloc_bg+0x2f8/0x390 open_ctree+0x1934/0x23db btrfs_get_tree.cold+0x105/0x26c vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #3 (btrfs_trans_num_extwriters){++++}-{0:0}: join_transaction+0xc2/0x5c0 start_transaction+0x17c/0xbc0 btrfs_zoned_reserve_data_reloc_bg+0x2b4/0x390 open_ctree+0x1934/0x23db btrfs_get_tree.cold+0x105/0x26c vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #2 (btrfs_trans_num_writers){++++}-{0:0}: lock_release+0x163/0x4b0 __btrfs_end_transaction+0x1c7/0x2e0 btrfs_dirty_inode+0x6f/0xd0 touch_atime+0xe5/0x2c0 btrfs_file_mmap_prepare+0x65/0x90 __mmap_region+0x4b9/0xf00 mmap_region+0xf7/0x120 do_mmap+0x43d/0x610 vm_mmap_pgoff+0xd6/0x190 ksys_mmap_pgoff+0x7e/0xc0 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (&mm->mmap_lock){++++}-{4:4}: __might_fault+0x68/0xa0 _copy_to_user+0x22/0x70 blkdev_copy_zone_to_user+0x22/0x40 virtblk_report_zones+0x282/0x430 blkdev_report_zones_ioctl+0xfd/0x130 blkdev_ioctl+0x20f/0x2c0 __x64_sys_ioctl+0x86/0xd0 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #0 (&vblk->vdev_mutex){+.+.}-{4:4}: __lock_acquire+0x1522/0x2680 lock_acquire+0xd5/0x2f0 __mutex_lock+0xa3/0x1360 virtblk_report_zones+0xda/0x430 blkdev_report_zones_cached+0x162/0x190 btrfs_get_dev_zones+0xdc/0x2e0 btrfs_get_dev_zone_info+0x219/0xe80 btrfs_get_dev_zone_info_all_devices+0x62/0x90 open_ctree+0x1200/0x23db btrfs_get_tree.cold+0x105/0x26c vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e other info that might help us debug this: Chain exists of: &vblk->vdev_mutex --> btrfs_trans_num_extwriters --> &fs_devs->device_list_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&fs_devs->device_list_mutex); lock(btrfs_trans_num_extwriters); lock(&fs_devs->device_list_mutex); lock(&vblk->vdev_mutex); *** DEADLOCK *** 3 locks held by mount/1043: #0: ffff88811063e878 (&fc->uapi_mutex){+.+.}-{4:4}, at: __do_sys_fsconfig+0x2ae/0x680 #1: ffff88810cb9f0e8 (&type->s_umount_key#31/1){+.+.}-{4:4}, at: alloc_super+0xc0/0x3e0 #2: ffff888102a738e0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: btrfs_get_dev_zone_info_all_devices+0x45/0x90 stack backtrace: CPU: 2 UID: 0 PID: 1043 Comm: mount Not tainted 7.0.0-rc1+ #355 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/10/2025 Call Trace: dump_stack_lvl+0x5b/0x80 print_circular_bug.cold+0x18d/0x1d8 check_noncircular+0x10d/0x130 __lock_acquire+0x1522/0x2680 ? vmap_small_pages_range_noflush+0x3ef/0x820 lock_acquire+0xd5/0x2f0 ? virtblk_report_zones+0xda/0x430 ? lock_is_held_type+0xcd/0x130 __mutex_lock+0xa3/0x1360 ? virtblk_report_zones+0xda/0x430 ? virtblk_report_zones+0xda/0x430 ? __pfx_copy_zone_info_cb+0x10/0x10 ? virtblk_report_zones+0xda/0x430 virtblk_report_zones+0xda/0x430 ? __pfx_copy_zone_info_cb+0x10/0x10 blkdev_report_zones_cached+0x162/0x190 ? __pfx_copy_zone_info_cb+0x10/0x10 btrfs_get_dev_zones+0xdc/0x2e0 btrfs_get_dev_zone_info+0x219/0xe80 btrfs_get_dev_zone_info_all_devices+0x62/0x90 open_ctree+0x1200/0x23db btrfs_get_tree.cold+0x105/0x26c ? rcu_is_watching+0x18/0x50 vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f615e27a40e RSP: 002b:00007fff11b18fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af RAX: ffffffffffffffda RBX: 000055572e92ab10 RCX: 00007f615e27a40e RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 RBP: 00007fff11b19100 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000055572e92bc40 R14: 00007f615e3faa60 R15: 000055572e92bd08 Don't hold the device_list_mutex while calling into btrfs_get_dev_zone_info() in btrfs_get_dev_zone_info_all_devices() to mitigate the issue. This is safe, as no other thread can touch the device list at the moment of execution. Reported-by: Shin'ichiro Kawasaki Reviewed-by: Damien Le Moal Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4f6abe9c743eaf9a473b06ebc01bec81163b3343 Author: Johannes Thumshirn Date: Fri Feb 27 14:12:24 2026 +0100 btrfs: pass 'verbose' parameter to btrfs_relocate_block_group Function `btrfs_relocate_chunk()` always passes verbose=true to `btrfs_relocate_block_group()` instead of the `verbose` parameter passed into it by it's callers. While user initiated rebalancing should be logged in the Kernel's log buffer. This causes excessive log spamming from automatic rebalancing, e.g. on zoned filesystems running low on usable space. Reviewed-by: Filipe Manana Reviewed-by: Qu Wenruo Reviewed-by: Damien Le Moal Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit daf8e3b253aa760ff9e96c7768a464bc1d6b3c90 Author: Hyunwoo Kim Date: Wed Mar 11 03:16:29 2026 +0900 xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() After cancel_delayed_work_sync() is called from xfrm_nat_keepalive_net_fini(), xfrm_state_fini() flushes remaining states via __xfrm_state_delete(), which calls xfrm_nat_keepalive_state_updated() to re-schedule nat_keepalive_work. The following is a simple race scenario: cpu0 cpu1 cleanup_net() [Round 1] ops_undo_list() xfrm_net_exit() xfrm_nat_keepalive_net_fini() cancel_delayed_work_sync(nat_keepalive_work); xfrm_state_fini() xfrm_state_flush() xfrm_state_delete(x) __xfrm_state_delete(x) xfrm_nat_keepalive_state_updated(x) schedule_delayed_work(nat_keepalive_work); rcu_barrier(); net_complete_free(); net_passive_dec(net); llist_add(&net->defer_free_list, &defer_free_list); cleanup_net() [Round 2] rcu_barrier(); net_complete_free() kmem_cache_free(net_cachep, net); nat_keepalive_work() // on freed net To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync(). Fixes: f531d13bdfe3 ("xfrm: support sending NAT keepalives in ESP in UDP states") Signed-off-by: Hyunwoo Kim Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 995a418a6ca33e466e5e1527663ae3d5eee18304 Author: Wang Jun <1742789905@qq.com> Date: Thu Mar 12 22:51:36 2026 +0800 auxdisplay: lcd2s: add error handling for i2c transfers The lcd2s_print() and lcd2s_gotoxy() functions currently ignore the return value of lcd2s_i2c_master_send(), which can fail. This can lead to silent data loss or incorrect cursor positioning. Add proper error checking: if the number of bytes sent does not match the expected length, return -EIO; otherwise propagate any error code from the I2C transfer. Signed-off-by: Wang Jun <1742789905@qq.com> Signed-off-by: Andy Shevchenko commit e2715ea5fb352cd43fce437b91aa0fd50aaaf384 Author: Masami Hiramatsu (Google) Date: Fri Mar 13 13:18:55 2026 +0900 bootconfig: Add bootconfig tests about braces Add more bootconfig tests for checking the error message of non closing brace and max number of nested braces. Link: https://lore.kernel.org/all/177337553551.416919.11217619471547711262.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) commit 1120a36bb1e9b9e22de75ecb4ef0b998f73a97f1 Author: Josh Law Date: Thu Mar 12 19:11:43 2026 +0000 lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() snprintf() returns the number of characters that would have been written excluding the NUL terminator. Output is truncated when the return value is >= the buffer size, not just > the buffer size. When ret == size, the current code takes the non-truncated path, advancing buf by ret and reducing size to 0. This is wrong because the output was actually truncated (the last character was replaced by NUL). Fix by using >= so the truncation path is taken correctly. Link: https://lore.kernel.org/all/20260312191143.28719-4-objecting@objecting.org/ Fixes: 76db5a27a827 ("bootconfig: Add Extra Boot Config support") Cc: stable@vger.kernel.org Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 560f763baa0f2c9a44da4294c06af071405ac46f Author: Josh Law Date: Thu Mar 12 19:11:42 2026 +0000 lib/bootconfig: check bounds before writing in __xbc_open_brace() The bounds check for brace_index happens after the array write. While the current call pattern prevents an actual out-of-bounds access (the previous call would have returned an error), the write-before-check pattern is fragile and would become a real out-of-bounds write if the error return were ever not propagated. Move the bounds check before the array write so the function is self-contained and safe regardless of caller behavior. Link: https://lore.kernel.org/all/20260312191143.28719-3-objecting@objecting.org/ Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes") Cc: stable@vger.kernel.org Signed-off-by: Josh Law Signed-off-by: Masami Hiramatsu (Google) commit 5eb608319bb56464674a71b4a66ea65c6c435d64 Author: Nicolas Pitre Date: Tue Jan 27 17:56:01 2026 -0500 vt: save/restore unicode screen buffer for alternate screen The alternate screen support added by commit 23743ba64709 ("vt: add support for smput/rmput escape codes") only saves and restores the regular screen buffer (vc_origin), but completely ignores the corresponding unicode screen buffer (vc_uni_lines) creating a messed-up display. Add vc_saved_uni_lines to save the unicode screen buffer when entering the alternate screen, and restore it when leaving. Also ensure proper cleanup in reset_terminal() and vc_deallocate(). Fixes: 23743ba64709 ("vt: add support for smput/rmput escape codes") Cc: stable Signed-off-by: Nicolas Pitre Link: https://patch.msgid.link/5o2p6qp3-91pq-0p17-or02-1oors4417ns7@onlyvoer.pbz Signed-off-by: Greg Kroah-Hartman commit 904eaf90a5e573c53117fd6cd4a06295b8bb2031 Merge: 0b352f83cabfef d87f8bc47fbf01 Author: Steffen Klassert Date: Fri Mar 13 08:44:04 2026 +0100 Merge branch 'xfrm-fix-most-sparse-warnings' Sabrina Dubroca says: ==================== xfrm: fix most sparse warnings This series fixes most of the sparse warnings currently reported about RCU pointers for files under net/xfrm. There's no actual bug in the current code, we only need to use the correct helpers in each context. ==================== Signed-off-by: Steffen Klassert commit 82f73ef9c41e0623e0a8bdce4fa44a7237709f0c Author: Nilay Shroff Date: Tue Mar 10 13:51:24 2026 +0530 powerpc/iommu: fix lockdep warning during PCI enumeration Commit a75b2be249d6 ("iommu: Add iommu_driver_get_domain_for_dev() helper") introduced iommu_driver_get_domain_for_dev() for driver code paths that hold iommu_group->mutex while attaching a device to an IOMMU domain. The same commit also added a lockdep assertion in iommu_get_domain_for_dev() to ensure that callers do not hold iommu_group->mutex when invoking it. On powerpc platforms, when PCI device ownership is switched from BLOCKED to the PLATFORM domain, the attach callback spapr_tce_platform_iommu_attach_dev() still calls iommu_get_domain_for_dev(). This happens while iommu_group->mutex is held during domain switching, which triggers the lockdep warning below during PCI enumeration: WARNING: drivers/iommu/iommu.c:2252 at iommu_get_domain_for_dev+0x38/0x80, CPU#2: swapper/0/1 Modules linked in: CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc2+ #35 PREEMPT Hardware name: IBM,9105-22A Power11 (architected) 0x820200 0xf000007 of:IBM,FW1120.00 (RB1120_115) hv:phyp pSeries NIP: c000000000c244c4 LR: c00000000005b5a4 CTR: c00000000005b578 REGS: c00000000a7bf280 TRAP: 0700 Not tainted (7.0.0-rc2+) MSR: 8000000002029033 CR: 22004422 XER: 0000000a CFAR: c000000000c24508 IRQMASK: 0 GPR00: c00000000005b5a4 c00000000a7bf520 c000000001dc8100 0000000000000001 GPR04: c00000000f972f10 0000000000000000 0000000000000000 0000000000000001 GPR08: 0000001ffbc60000 0000000000000001 0000000000000000 0000000000000000 GPR12: c00000000005b578 c000001fffffe480 c000000000011618 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: ffffffffffffefff 0000000000000000 c000000002d30eb0 0000000000000001 GPR24: c0000000017881f8 0000000000000000 0000000000000001 c00000000f972e00 GPR28: c00000000bbba0d0 0000000000000000 c00000000bbba0d0 c00000000f972e00 NIP [c000000000c244c4] iommu_get_domain_for_dev+0x38/0x80 LR [c00000000005b5a4] spapr_tce_platform_iommu_attach_dev+0x2c/0x98 Call Trace: iommu_get_domain_for_dev+0x68/0x80 (unreliable) spapr_tce_platform_iommu_attach_dev+0x2c/0x98 __iommu_attach_device+0x44/0x220 __iommu_device_set_domain+0xf4/0x194 __iommu_group_set_domain_internal+0xec/0x228 iommu_setup_default_domain+0x5f4/0x6a4 __iommu_probe_device+0x674/0x724 iommu_probe_device+0x50/0xb4 iommu_add_device+0x48/0x198 pci_dma_dev_setup_pSeriesLP+0x198/0x4f0 pcibios_bus_add_device+0x80/0x464 pci_bus_add_device+0x40/0x100 pci_bus_add_devices+0x54/0xb0 pcibios_init+0xd8/0x140 do_one_initcall+0x8c/0x598 kernel_init_freeable+0x3ec/0x850 kernel_init+0x34/0x270 ret_from_kernel_user_thread+0x14/0x1c Fix this by using iommu_driver_get_domain_for_dev() instead of iommu_get_domain_for_dev() in spapr_tce_platform_iommu_attach_dev(), which is the appropriate helper for callers holding the group mutex. Cc: stable@vger.kernel.org Fixes: a75b2be249d6 ("iommu: Add iommu_driver_get_domain_for_dev() helper") Closes: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/d5c834ff-4c95-44dd-8bef-57242d63aeee@linux.ibm.com/ Signed-off-by: Nilay Shroff Reviewed-by: Nicolin Chen Tested-by: Venkat Rao Bagalkote [Maddy: Added Closes, tested and reviewed by tags] Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260310082129.3630996-1-nilay@linux.ibm.com commit 99600f79b28c83c68bae199a3d8e95049a758308 Author: Sabrina Dubroca Date: Wed Mar 11 23:35:09 2026 +0100 mpls: add missing unregister_netdevice_notifier to mpls_init If mpls_init() fails after registering mpls_dev_notifier, it never gets removed. Add the missing unregister_netdevice_notifier() call to the error handling path. Fixes: 5be2062e3080 ("mpls: Handle error of rtnl_register_module().") Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/7c55363c4f743d19e2306204a134407c90a69bbb.1773228081.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 8431c602f551549f082bbfa67f3003f2d8e3e132 Author: Eric Dumazet Date: Wed Mar 11 12:31:10 2026 +0000 ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Blamed commits forgot that vxlan/geneve use udp_tunnel[6]_xmit_skb() which call iptunnel_xmit_stats(). iptunnel_xmit_stats() was assuming tunnels were only using NETDEV_PCPU_STAT_TSTATS. @syncp offset in pcpu_sw_netstats and pcpu_dstats is different. 32bit kernels would either have corruptions or freezes if the syncp sequence was overwritten. This patch also moves pcpu_stat_type closer to dev->{t,d}stats to avoid a potential cache line miss since iptunnel_xmit_stats() needs to read it. Fixes: 6fa6de302246 ("geneve: Handle stats using NETDEV_PCPU_STAT_DSTATS.") Fixes: be226352e8dc ("vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.") Signed-off-by: Eric Dumazet Reviewed-by: Guillaume Nault Link: https://patch.msgid.link/20260311123110.1471930-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e1f0a18c9564cdb16523c802e2c6fe5874e3d944 Author: Jiayuan Chen Date: Wed Mar 11 15:06:02 2026 +0800 net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect syzkaller reported a bug [1], and the reproducer is available at [2]. ROSE sockets use four sk->sk_state values: TCP_CLOSE, TCP_LISTEN, TCP_SYN_SENT, and TCP_ESTABLISHED. rose_connect() already rejects calls for TCP_ESTABLISHED (-EISCONN) and TCP_CLOSE with SS_CONNECTING (-ECONNREFUSED), but lacks a check for TCP_SYN_SENT. When rose_connect() is called a second time while the first connection attempt is still in progress (TCP_SYN_SENT), it overwrites rose->neighbour via rose_get_neigh(). If that returns NULL, the socket is left with rose->state == ROSE_STATE_1 but rose->neighbour == NULL. When the socket is subsequently closed, rose_release() sees ROSE_STATE_1 and calls rose_write_internal() -> rose_transmit_link(skb, NULL), causing a NULL pointer dereference. Per connect(2), a second connect() while a connection is already in progress should return -EALREADY. Add this missing check for TCP_SYN_SENT to complete the state validation in rose_connect(). [1] https://syzkaller.appspot.com/bug?extid=d00f90e0af54102fb271 [2] https://gist.github.com/mrpre/9e6779e0d13e2c66779b1653fef80516 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+d00f90e0af54102fb271@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0027.GAE@google.com/T/ Suggested-by: Eric Dumazet Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260311070611.76913-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 3715a00855316066cdda69d43648336367422127 Author: Hyunwoo Kim Date: Wed Mar 11 03:18:09 2026 +0900 bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from br_cfm_frame_rx() are silently rejected. The cc_peer_disable() helper retains cancel_delayed_work_sync() because it is also used for the CC enable/disable toggle path where the work must remain re-schedulable. Fixes: dc32cbb3dbd7 ("bridge: cfm: Kernel space implementation of CFM. CCM frame RX added.") Signed-off-by: Hyunwoo Kim Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/abBgYT5K_FI9rD1a@v4bel Signed-off-by: Jakub Kicinski commit 39ebc8d7f561e1b64eca87353ef9b18e2825e591 Author: Josh Law Date: Thu Mar 12 19:11:41 2026 +0000 lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error __xbc_open_brace() pushes entries with post-increment (open_brace[brace_index++]), so brace_index always points one past the last valid entry. xbc_verify_tree() reads open_brace[brace_index] to report which brace is unclosed, but this is one past the last pushed entry and contains stale/zero data, causing the error message to reference the wrong node. Use open_brace[brace_index - 1] to correctly identify the unclosed brace. brace_index is known to be > 0 here since we are inside the if (brace_index) guard. Link: https://lore.kernel.org/all/20260312191143.28719-2-objecting@objecting.org/ Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes") Cc: stable@vger.kernel.org Signed-off-by: Josh Law Reviewed-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit b28913e897edfeedc4e33b03b28068b27d002e6c Merge: dd0365021be3e8 0073a17b466684 Author: Dave Airlie Date: Fri Mar 13 10:39:57 2026 +1000 Merge tag 'drm-rust-fixes-2026-03-12' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-fixes Core Changes: - Fix safety issue in dma_read! and dma_write!. Driver Changes (Nova Core): - Fix UB in DmaGspMem pointer accessors. - Fix stack overflow in GSP memory allocation. Signed-off-by: Dave Airlie From: Alice Ryhl Link: https://patch.msgid.link/abNBSol3CLRCqlkZ@google.com commit dd0365021be3e8693680bb1d2616edf7d5e17800 Merge: 8c835a10c021c0 3646ff28780b4c Author: Dave Airlie Date: Fri Mar 13 09:04:51 2026 +1000 Merge tag 'amd-drm-fixes-7.0-2026-03-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-03-12: amdgpu: - SMU13 fix - SMU14 fix - Fixes for bringup hw testing - Kerneldoc fix - GC12 idle power fix for compute workloads - DCCG fixes amdkfd: - Fix missing BO unreserve in an error path Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260312180351.3874990-1-alexander.deucher@amd.com commit 8c835a10c021c08c3781305b806b15656c2dd7c8 Merge: 3c9eced53749be 335b237d902c73 Author: Dave Airlie Date: Fri Mar 13 08:47:59 2026 +1000 Merge tag 'drm-intel-fixes-2026-03-12' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Avoid hang when configuring VRR [icl] (Ville Syrjälä) - Fix sg_table overflow with >4GB folios (Janusz Krzysztofik) - Fix PSR Selective Update handling [psr] (Jouni Högander) - Fix eDP ALPM read-out sequence [dp] (Arun R Murthy) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/abJ_MQ7o-5ghyaNW@linux commit 3c9eced53749be418128170f89979f5d50547fd1 Merge: 50ae4ce2a6ace9 49973e2a4156a8 Author: Dave Airlie Date: Fri Mar 13 08:32:14 2026 +1000 Merge tag 'drm-misc-fixes-2026-03-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A pixel byte swap fix for st7586, a null pointer dereference fix for gud, two timings fixes for ti-sn65dsi83, an initialization fix for ivpu, and a runtime suspend deadlock fix for amdxdna. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260312-accurate-ambrosial-trout-bfabf8@houat commit 7d0abefec48dfefeec28dc7c3105a88c43747d02 Merge: 4c527c7e030672 fa655a9ca73f7d Author: Jens Axboe Date: Thu Mar 12 15:15:53 2026 -0600 Merge tag 'nvme-7.0-2026-03-12' of git://git.infradead.org/nvme into block-7.0 Pull NVMe fixes from Keith: "- Fix nvme-pci IRQ race and slab-out-of-bounds access (Sungwoo Kim) - Fix recursive workqueue locking for target async events (Chaitanya) - Various cleanups (Maurizio Lombardi, Thorsten Blum)" * tag 'nvme-7.0-2026-03-12' of git://git.infradead.org/nvme: nvme: Annotate struct nvme_dhchap_key with __counted_by nvme-core: do not pass empty queue_limits to blk_mq_alloc_queue() nvme-pci: Fix race bug in nvme_poll_irqdisable() nvmet: move async event work off nvmet-wq nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set commit e5b31d988a41549037b8d8721a3c3cae893d8670 Author: Kuniyuki Iwashima Date: Wed Mar 11 05:40:40 2026 +0000 af_unix: Give up GC if MSG_PEEK intervened. Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same issue previously fixed by commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK"). After GC was replaced with the current algorithm, the cited commit removed the locking dance in unix_peek_fds() and reintroduced the same issue. The problem is that MSG_PEEK bumps a file refcount without interacting with GC. Consider an SCC containing sk-A and sk-B, where sk-A is close()d but can be recv()ed via sk-B. The bad thing happens if sk-A is recv()ed with MSG_PEEK from sk-B and sk-B is close()d while GC is checking unix_vertex_dead() for sk-A and sk-B. GC thread User thread --------- ----------- unix_vertex_dead(sk-A) -> true <------. \ `------ recv(sk-B, MSG_PEEK) invalidate !! -> sk-A's file refcount : 1 -> 2 close(sk-B) -> sk-B's file refcount : 2 -> 1 unix_vertex_dead(sk-B) -> true Initially, sk-A's file refcount is 1 by the inflight fd in sk-B recvq. GC thinks sk-A is dead because the file refcount is the same as the number of its inflight fds. However, sk-A's file refcount is bumped silently by MSG_PEEK, which invalidates the previous evaluation. At this moment, sk-B's file refcount is 2; one by the open fd, and one by the inflight fd in sk-A. The subsequent close() releases one refcount by the former. Finally, GC incorrectly concludes that both sk-A and sk-B are dead. One option is to restore the locking dance in unix_peek_fds(), but we can resolve this more elegantly thanks to the new algorithm. The point is that the issue does not occur without the subsequent close() and we actually do not need to synchronise MSG_PEEK with the dead SCC detection. When the issue occurs, close() and GC touch the same file refcount. If GC sees the refcount being decremented by close(), it can just give up garbage-collecting the SCC. Therefore, we only need to signal the race during MSG_PEEK with a proper memory barrier to make it visible to the GC. Let's use seqcount_t to notify GC when MSG_PEEK occurs and let it defer the SCC to the next run. This way no locking is needed on the MSG_PEEK side, and we can avoid imposing a penalty on every MSG_PEEK unnecessarily. Note that we can retry within unix_scc_dead() if MSG_PEEK is detected, but we do not do so to avoid hung task splat from abusive MSG_PEEK calls. Fixes: 118f457da9ed ("af_unix: Remove lock dance in unix_peek_fds().") Reported-by: Igor Ushakov Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260311054043.1231316-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 0257f64bdac7fdca30fa3cae0df8b9ecbec7733a Merge: 61c0b2ae734fc9 a076cc74744d83 Author: Linus Torvalds Date: Thu Mar 12 13:01:37 2026 -0700 Merge tag 'pm-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: - Make the idle loop skip the cpuidle governor .reflect() callback after it has skipped the .select() one (Rafael Wysocki) - Fix swapped power/energy unit labels in cpupower (Kaushlendra Kumar) - Add support for setting EPP via systemd service and intel_pstate turbo boost support to cpupower (Jan Kiszka, Zhang Rui) * tag 'pm-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: sched: idle: Make skipping governor callbacks more consistent cpupower: Add intel_pstate turbo boost support for Intel platforms cpupower: Add support for setting EPP via systemd service cpupower: fix swapped power/energy unit labels commit 61c0b2ae734fc9d33ede9cbf7d3cad67a7b0ce28 Merge: 8004279c41adf3 97d9960f355cca Author: Linus Torvalds Date: Thu Mar 12 12:43:19 2026 -0700 Merge tag 'acpi-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: - On some platforms, the ACPI companion object of the ACPI video bus platform device is shared with multiple other platform devices which leads to driver probe issues, so replace that device with an auxiliary one (which arguably is a better match for the given use case) and update the ACPI video bus driver accordingly (Rafael Wysocki) - Address sparse warnings in acpi_os_initialize() by adding __iomem to a local variable declaration (Ben Dooks) * tag 'acpi-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() ACPI: video: Switch over to auxiliary bus type commit 8004279c41adf3238ba71931219205cd1f59343b Merge: e0b38d286eef46 4529e001543297 Author: Linus Torvalds Date: Thu Mar 12 12:38:17 2026 -0700 Merge tag 'nfs-for-7.0-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Fix NFS KConfig typos - Decrement re_receiving on the early exit paths - return EISDIR on nfs3_proc_create if d_alias is a dir * tag 'nfs-for-7.0-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS: Fix NFS KConfig typos xprtrdma: Decrement re_receiving on the early exit paths nfs: return EISDIR on nfs3_proc_create if d_alias is a dir commit 99b2c531e0e797119ae1b9195a8764ee98b00e65 Author: Dmitry Baryshkov Date: Wed Mar 11 01:02:57 2026 +0200 Bluetooth: qca: fix ROM version reading on WCN3998 chips WCN3998 uses a bit different format for rom version: [ 5.479978] Bluetooth: hci0: setting up wcn399x [ 5.633763] Bluetooth: hci0: QCA Product ID :0x0000000a [ 5.645350] Bluetooth: hci0: QCA SOC Version :0x40010224 [ 5.650906] Bluetooth: hci0: QCA ROM Version :0x00001001 [ 5.665173] Bluetooth: hci0: QCA Patch Version:0x00006699 [ 5.679356] Bluetooth: hci0: QCA controller version 0x02241001 [ 5.691109] Bluetooth: hci0: QCA Downloading qca/crbtfw21.tlv [ 6.680102] Bluetooth: hci0: QCA Downloading qca/crnv21.bin [ 6.842948] Bluetooth: hci0: QCA setup on UART is completed Fixes: 523760b7ff88 ("Bluetooth: hci_qca: Added support for WCN3998") Reviewed-by: Bartosz Golaszewski Signed-off-by: Dmitry Baryshkov Signed-off-by: Luiz Augusto von Dentz commit dd815e6e3918dc75a49aaabac36e4f024d675101 Author: Lukas Johannes Möller Date: Tue Mar 10 21:59:47 2026 +0000 Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access l2cap_information_rsp() checks that cmd_len covers the fixed l2cap_info_rsp header (type + result, 4 bytes) but then reads rsp->data without verifying that the payload is present: - L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads 4 bytes past the header (needs cmd_len >= 8). - L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header (needs cmd_len >= 5). A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an out-of-bounds read of adjacent skb data. Guard each data access with the required payload length check. If the payload is too short, skip the read and let the state machine complete with safe defaults (feat_mask and remote_fixed_chan remain zero from kzalloc), so the info timer cleanup and l2cap_conn_start() still run and the connection is not stalled. Fixes: 4e8402a3f884 ("[Bluetooth] Retrieve L2CAP features mask on connection setup") Cc: stable@vger.kernel.org Signed-off-by: Lukas Johannes Möller Signed-off-by: Luiz Augusto von Dentz commit 15145675690cab2de1056e7ed68e59cbd0452529 Author: Lukas Johannes Möller Date: Tue Mar 10 21:59:46 2026 +0000 Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() l2cap_ecred_reconf_rsp() casts the incoming data to struct l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes with result at offset 0). This causes two problems: - The sizeof(*rsp) length check requires 8 bytes instead of the correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected with -EPROTO. - rsp->result reads from offset 6 instead of offset 0, returning wrong data when the packet is large enough to pass the check. Fix by using the correct type. Also pass the already byte-swapped result variable to BT_DBG instead of the raw __le16 field. Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Cc: stable@vger.kernel.org Signed-off-by: Lukas Johannes Möller Signed-off-by: Luiz Augusto von Dentz commit 5b3e2052334f2ff6d5200e952f4aa66994d09899 Author: Luiz Augusto von Dentz Date: Tue Mar 3 13:29:53 2026 -0500 Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marked as pending (FLAG_DEFER_SETUP) which can cause more than L2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defer causing an overflow. The spec is quite clear that the same identifier shall not be used on subsequent requests: 'Within each signaling channel a different Identifier shall be used for each successive request or indication.' https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355d So this attempts to check if there are any channels pending with the same identifier and rejects if any are found. Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Reported-by: Yiming Qian Signed-off-by: Luiz Augusto von Dentz commit 752a6c9596dd25efd6978a73ff21f3b592668f4a Author: Shaurya Rane Date: Thu Nov 6 23:50:16 2025 +0530 Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user After commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del"), l2cap_conn_del() uses conn->lock to protect access to conn->users. However, l2cap_register_user() and l2cap_unregister_user() don't use conn->lock, creating a race condition where these functions can access conn->users and conn->hchan concurrently with l2cap_conn_del(). This can lead to use-after-free and list corruption bugs, as reported by syzbot. Fix this by changing l2cap_register_user() and l2cap_unregister_user() to use conn->lock instead of hci_dev_lock(), ensuring consistent locking for the l2cap_conn structure. Reported-by: syzbot+14b6d57fb728e27ce23c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=14b6d57fb728e27ce23c Fixes: ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del") Signed-off-by: Shaurya Rane Signed-off-by: Luiz Augusto von Dentz commit dbf666e4fc9bdd975a61bf682b3f75cb0145eedd Author: Luiz Augusto von Dentz Date: Thu Mar 5 10:17:47 2026 -0500 Bluetooth: HIDP: Fix possible UAF This fixes the following trace caused by not dropping l2cap_conn reference when user->remove callback is called: [ 97.809249] l2cap_conn_free: freeing conn ffff88810a171c00 [ 97.809907] CPU: 1 UID: 0 PID: 1419 Comm: repro_standalon Not tainted 7.0.0-rc1-dirty #14 PREEMPT(lazy) [ 97.809935] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 97.809947] Call Trace: [ 97.809954] [ 97.809961] dump_stack_lvl (lib/dump_stack.c:122) [ 97.809990] l2cap_conn_free (net/bluetooth/l2cap_core.c:1808) [ 97.810017] l2cap_conn_del (./include/linux/kref.h:66 net/bluetooth/l2cap_core.c:1821 net/bluetooth/l2cap_core.c:1798) [ 97.810055] l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7347 (discriminator 1) net/bluetooth/l2cap_core.c:7340 (discriminator 1)) [ 97.810086] ? __pfx_l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7341) [ 97.810117] hci_conn_hash_flush (./include/net/bluetooth/hci_core.h:2152 (discriminator 2) net/bluetooth/hci_conn.c:2644 (discriminator 2)) [ 97.810148] hci_dev_close_sync (net/bluetooth/hci_sync.c:5360) [ 97.810180] ? __pfx_hci_dev_close_sync (net/bluetooth/hci_sync.c:5285) [ 97.810212] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810242] ? up_write (./arch/x86/include/asm/atomic64_64.h:87 (discriminator 5) ./include/linux/atomic/atomic-arch-fallback.h:2852 (discriminator 5) ./include/linux/atomic/atomic-long.h:268 (discriminator 5) ./include/linux/atomic/atomic-instrumented.h:3391 (discriminator 5) kernel/locking/rwsem.c:1385 (discriminator 5) kernel/locking/rwsem.c:1643 (discriminator 5)) [ 97.810267] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810290] ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/context_tracking.h:128 kernel/rcu/tree.c:752) [ 97.810320] hci_unregister_dev (net/bluetooth/hci_core.c:504 net/bluetooth/hci_core.c:2716) [ 97.810346] vhci_release (drivers/bluetooth/hci_vhci.c:691) [ 97.810375] ? __pfx_vhci_release (drivers/bluetooth/hci_vhci.c:678) [ 97.810404] __fput (fs/file_table.c:470) [ 97.810430] task_work_run (kernel/task_work.c:235) [ 97.810451] ? __pfx_task_work_run (kernel/task_work.c:201) [ 97.810472] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810495] ? do_raw_spin_unlock (./include/asm-generic/qspinlock.h:128 (discriminator 5) kernel/locking/spinlock_debug.c:142 (discriminator 5)) [ 97.810527] do_exit (kernel/exit.c:972) [ 97.810547] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810574] ? __pfx_do_exit (kernel/exit.c:897) [ 97.810594] ? lock_acquire (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:5870 (discriminator 6) kernel/locking/lockdep.c:5825 (discriminator 6)) [ 97.810616] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810639] ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:95 (discriminator 4) kernel/locking/spinlock_debug.c:118 (discriminator 4)) [ 97.810664] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810688] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 97.810721] do_group_exit (kernel/exit.c:1093) [ 97.810745] get_signal (kernel/signal.c:3007 (discriminator 1)) [ 97.810772] ? security_file_permission (./arch/x86/include/asm/jump_label.h:37 security/security.c:2366) [ 97.810803] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810826] ? vfs_read (fs/read_write.c:555) [ 97.810854] ? __pfx_get_signal (kernel/signal.c:2800) [ 97.810880] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810905] ? __pfx_vfs_read (fs/read_write.c:555) [ 97.810932] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810960] arch_do_signal_or_restart (arch/x86/kernel/signal.c:337 (discriminator 1)) [ 97.810990] ? __pfx_arch_do_signal_or_restart (arch/x86/kernel/signal.c:334) [ 97.811021] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.811055] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.811078] ? ksys_read (fs/read_write.c:707) [ 97.811106] ? __pfx_ksys_read (fs/read_write.c:707) [ 97.811137] exit_to_user_mode_loop (kernel/entry/common.c:66 kernel/entry/common.c:98) [ 97.811169] ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/context_tracking.h:128 kernel/rcu/tree.c:752) [ 97.811192] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.811215] ? trace_hardirqs_off (./include/trace/events/preemptirq.h:36 (discriminator 33) kernel/trace/trace_preemptirq.c:95 (discriminator 33) kernel/trace/trace_preemptirq.c:90 (discriminator 33)) [ 97.811240] do_syscall_64 (./include/linux/irq-entry-common.h:226 ./include/linux/irq-entry-common.h:256 ./include/linux/entry-common.h:325 arch/x86/entry/syscall_64.c:100) [ 97.811268] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.811292] ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3)) [ 97.811318] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 97.811338] RIP: 0033:0x445cfe [ 97.811352] Code: Unable to access opcode bytes at 0x445cd4. Code starting with the faulting instruction =========================================== [ 97.811360] RSP: 002b:00007f65c41c6dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 97.811378] RAX: fffffffffffffe00 RBX: 00007f65c41c76c0 RCX: 0000000000445cfe [ 97.811391] RDX: 0000000000000400 RSI: 00007f65c41c6e40 RDI: 0000000000000004 [ 97.811403] RBP: 00007f65c41c7250 R08: 0000000000000000 R09: 0000000000000000 [ 97.811415] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffe8 [ 97.811428] R13: 0000000000000000 R14: 00007fff780a8c00 R15: 00007f65c41c76c0 [ 97.811453] [ 98.402453] ================================================================== [ 98.403560] BUG: KASAN: use-after-free in __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776) [ 98.404541] Read of size 8 at addr ffff888113ee40a8 by task khidpd_00050004/1430 [ 98.405361] [ 98.405563] CPU: 1 UID: 0 PID: 1430 Comm: khidpd_00050004 Not tainted 7.0.0-rc1-dirty #14 PREEMPT(lazy) [ 98.405588] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 98.405600] Call Trace: [ 98.405607] [ 98.405614] dump_stack_lvl (lib/dump_stack.c:122) [ 98.405641] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 98.405667] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.405691] ? __virt_addr_valid (arch/x86/mm/physaddr.c:55) [ 98.405724] ? __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776) [ 98.405748] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597) [ 98.405778] ? __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776) [ 98.405807] __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776) [ 98.405832] ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:95 (discriminator 4) kernel/locking/spinlock_debug.c:118 (discriminator 4)) [ 98.405859] ? l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2)) [ 98.405888] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 98.405915] ? __pfx___mutex_lock (kernel/locking/mutex.c:775) [ 98.405939] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.405963] ? lock_acquire (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:5870 (discriminator 6) kernel/locking/lockdep.c:5825 (discriminator 6)) [ 98.405984] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 98.406015] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.406038] ? lock_release (kernel/locking/lockdep.c:5536 kernel/locking/lockdep.c:5889 kernel/locking/lockdep.c:5875) [ 98.406061] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.406085] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./arch/x86/include/asm/irqflags.h:159 ./include/linux/spinlock_api_smp.h:178 kernel/locking/spinlock.c:194) [ 98.406107] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.406130] ? __timer_delete_sync (kernel/time/timer.c:1592) [ 98.406158] ? l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2)) [ 98.406186] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.406210] l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2)) [ 98.406263] hidp_session_thread (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/linux/kref.h:64 net/bluetooth/hidp/core.c:996 net/bluetooth/hidp/core.c:1305) [ 98.406293] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264) [ 98.406323] ? kthread (kernel/kthread.c:433) [ 98.406340] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251) [ 98.406370] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.406393] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 98.406424] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251) [ 98.406453] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.406476] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1)) [ 98.406499] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.406523] ? kthread (kernel/kthread.c:433) [ 98.406539] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.406565] ? kthread (kernel/kthread.c:433) [ 98.406581] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264) [ 98.406610] kthread (kernel/kthread.c:467) [ 98.406627] ? __pfx_kthread (kernel/kthread.c:412) [ 98.406645] ret_from_fork (arch/x86/kernel/process.c:164) [ 98.406674] ? __pfx_ret_from_fork (arch/x86/kernel/process.c:153) [ 98.406704] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.406728] ? __pfx_kthread (kernel/kthread.c:412) [ 98.406747] ret_from_fork_asm (arch/x86/entry/entry_64.S:258) [ 98.406774] [ 98.406780] [ 98.433693] The buggy address belongs to the physical page: [ 98.434405] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888113ee7c40 pfn:0x113ee4 [ 98.435557] flags: 0x200000000000000(node=0|zone=2) [ 98.436198] raw: 0200000000000000 ffffea0004244308 ffff8881f6f3ebc0 0000000000000000 [ 98.437195] raw: ffff888113ee7c40 0000000000000000 00000000ffffffff 0000000000000000 [ 98.438115] page dumped because: kasan: bad access detected [ 98.438951] [ 98.439211] Memory state around the buggy address: [ 98.439871] ffff888113ee3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.440714] ffff888113ee4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 98.441580] >ffff888113ee4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 98.442458] ^ [ 98.443011] ffff888113ee4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 98.443889] ffff888113ee4180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 98.444768] ================================================================== [ 98.445719] Disabling lock debugging due to kernel taint [ 98.448074] l2cap_conn_free: freeing conn ffff88810c22b400 [ 98.450012] CPU: 1 UID: 0 PID: 1430 Comm: khidpd_00050004 Tainted: G B 7.0.0-rc1-dirty #14 PREEMPT(lazy) [ 98.450040] Tainted: [B]=BAD_PAGE [ 98.450047] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 98.450059] Call Trace: [ 98.450065] [ 98.450071] dump_stack_lvl (lib/dump_stack.c:122) [ 98.450099] l2cap_conn_free (net/bluetooth/l2cap_core.c:1808) [ 98.450125] l2cap_conn_put (net/bluetooth/l2cap_core.c:1822) [ 98.450154] session_free (net/bluetooth/hidp/core.c:990) [ 98.450181] hidp_session_thread (net/bluetooth/hidp/core.c:1307) [ 98.450213] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264) [ 98.450271] ? kthread (kernel/kthread.c:433) [ 98.450293] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251) [ 98.450339] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.450368] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 98.450406] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251) [ 98.450442] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.450471] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1)) [ 98.450499] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.450528] ? kthread (kernel/kthread.c:433) [ 98.450547] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.450578] ? kthread (kernel/kthread.c:433) [ 98.450598] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264) [ 98.450637] kthread (kernel/kthread.c:467) [ 98.450657] ? __pfx_kthread (kernel/kthread.c:412) [ 98.450680] ret_from_fork (arch/x86/kernel/process.c:164) [ 98.450715] ? __pfx_ret_from_fork (arch/x86/kernel/process.c:153) [ 98.450752] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 98.450782] ? __pfx_kthread (kernel/kthread.c:412) [ 98.450804] ret_from_fork_asm (arch/x86/entry/entry_64.S:258) [ 98.450836] Fixes: b4f34d8d9d26 ("Bluetooth: hidp: add new session-management helpers") Reported-by: soufiane el hachmi Tested-by: soufiane el hachmi Signed-off-by: Luiz Augusto von Dentz commit 17f89341cb4281d1da0e2fb0de5406ab7c4e25ef Author: Wang Tao Date: Fri Feb 27 11:03:39 2026 +0000 Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") introduced mgmt_pending_valid(), which not only validates the pending command but also unlinks it from the pending list if it is valid. This change in semantics requires updates to several completion handlers to avoid list corruption and memory safety issues. This patch addresses two left-over issues from the aforementioned rework: 1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove() is replaced with mgmt_pending_free() in the success path. Since mgmt_pending_valid() already unlinks the command at the beginning of the function, calling mgmt_pending_remove() leads to a double list_del() and subsequent list corruption/kernel panic. 2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error path is removed. Since the current command is already unlinked by mgmt_pending_valid(), this foreach loop would incorrectly target other pending mesh commands, potentially freeing them while they are still being processed concurrently (leading to UAFs). The redundant mgmt_cmd_status() is also simplified to use cmd->opcode directly. Fixes: 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") Signed-off-by: Wang Tao Signed-off-by: Luiz Augusto von Dentz commit 2cabe7ff1001b7a197009cf50ba71701f9cbd354 Author: Michael Grzeschik Date: Thu Mar 5 14:50:52 2026 +0100 Bluetooth: hci_sync: Fix hci_le_create_conn_sync While introducing hci_le_create_conn_sync the functionality of hci_connect_le was ported to hci_le_create_conn_sync including the disable of the scan before starting the connection. When this code was run non synchronously the immediate call that was setting the flag HCI_LE_SCAN_INTERRUPTED had an impact. Since the completion handler for the LE_SCAN_DISABLE was not immediately called. In the completion handler of the LE_SCAN_DISABLE event, this flag is checked to set the state of the hdev to DISCOVERY_STOPPED. With the synchronised approach the later setting of the HCI_LE_SCAN_INTERRUPTED flag has not the same effect. The completion handler would immediately fire in the LE_SCAN_DISABLE call, check for the flag, which is then not yet set and do nothing. To fix this issue and make the function call work as before, we move the setting of the flag HCI_LE_SCAN_INTERRUPTED before disabling the scan. Fixes: 8e8b92ee60de ("Bluetooth: hci_sync: Add hci_le_create_conn_sync") Signed-off-by: Michael Grzeschik Signed-off-by: Luiz Augusto von Dentz commit 62bcaa6b351b6dc400f6c6b83762001fd9f5c12d Author: Luiz Augusto von Dentz Date: Fri Feb 27 15:23:01 2026 -0500 Bluetooth: ISO: Fix defer tests being unstable iso-tester defer tests seem to fail with hci_conn_hash_lookup_cig being unable to resolve a cig in set_cig_params_sync due a race where it is run immediatelly before hci_bind_cis is able to set the QoS settings into the hci_conn object. So this moves the assigning of the QoS settings to be done directly by hci_le_set_cig_params to prevent that from happening again. Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Luiz Augusto von Dentz commit 0e4d4dcc1a6e82cc6f9abf32193558efa7e1613d Author: Christian Eggers Date: Wed Feb 25 18:07:28 2026 +0100 Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy The last test step ("Test with Invalid public key X and Y, all set to 0") expects to get an "DHKEY check failed" instead of "unspecified". Fixes: 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys are identical") Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz commit b6a2bf43aa37670432843bc73ae2a6288ba4d6f8 Author: Christian Eggers Date: Wed Feb 25 18:07:27 2026 +0100 Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Core 6.0, Vol 3, Part A, 3.4.3: "... If the sum of the payload sizes for the K-frames exceeds the specified SDU length, the receiver shall disconnect the channel." This fixes L2CAP/LE/CFC/BV-27-C (running together with 'l2test -r -P 0x0027 -V le_public'). Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly") Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz commit e1d9a66889867c232657a9b6f25d451d7c3ab96f Author: Christian Eggers Date: Wed Feb 25 18:07:25 2026 +0100 Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU Core 6.0, Vol 3, Part A, 3.4.3: "If the SDU length field value exceeds the receiver's MTU, the receiver shall disconnect the channel..." This fixes L2CAP/LE/CFC/BV-26-C (running together with 'l2test -r -P 0x0027 -V le_public -I 100'). Fixes: aac23bf63659 ("Bluetooth: Implement LE L2CAP reassembly") Signed-off-by: Christian Eggers Signed-off-by: Luiz Augusto von Dentz commit e0b38d286eef4633d231859e47679772db07db07 Merge: 2c7e63d702f6c4 0749cab6174dc0 Author: Linus Torvalds Date: Thu Mar 12 12:15:27 2026 -0700 Merge tag 'for-7.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - detect possible file name hash collision earlier so it does not lead to transaction abort - handle b-tree leaf overflows when snapshotting a subvolume with set received UUID, leading to transaction abort - in zoned mode, reorder relocation block group initialization after the transaction kthread start - fix orphan cleanup state tracking of subvolume, this could lead to invalid dentries under some conditions - add locking around updates of dynamic reclain state update - in subpage mode, add missing RCU unlock when trying to releae extent buffer - remap tree fixes: - add missing description strings for the newly added remap tree - properly update search key when iterating backrefs * tag 'for-7.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: remove duplicated definition of btrfs_printk_in_rcu() btrfs: remove unnecessary transaction abort in the received subvol ioctl btrfs: abort transaction on failure to update root in the received subvol ioctl btrfs: fix transaction abort on set received ioctl due to item overflow btrfs: fix transaction abort when snapshotting received subvolumes btrfs: fix transaction abort on file creation due to name hash collision btrfs: read key again after incrementing slot in move_existing_remaps() btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer() btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create btrfs: zoned: move btrfs_zoned_reserve_data_reloc_bg() after kthread start btrfs: hold space_info->lock when clearing periodic reclaim ready btrfs: print-tree: add remap tree definitions commit 2c7e63d702f6c4209c5af833308e7fcbc7d4ab17 Merge: 281f36d4a9970c c38b8f5f791ecc Author: Linus Torvalds Date: Thu Mar 12 11:33:35 2026 -0700 Merge tag 'net-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from CAN and netfilter. Current release - regressions: - eth: mana: Null service_wq on setup error to prevent double destroy Previous releases - regressions: - nexthop: fix percpu use-after-free in remove_nh_grp_entry - sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bpf: fix nd_tbl NULL dereference when IPv6 is disabled - neighbour: restore protocol != 0 check in pneigh update - tipc: fix divide-by-zero in tipc_sk_filter_connect() - eth: - mlx5: - fix crash when moving to switchdev mode - fix DMA FIFO desync on error CQE SQ recovery - iavf: fix PTP use-after-free during reset - bonding: fix type confusion in bond_setup_by_slave() - lan78xx: fix WARN in __netif_napi_del_locked on disconnect Previous releases - always broken: - core: add xmit recursion limit to tunnel xmit functions - net-shapers: don't free reply skb after genlmsg_reply() - netfilter: - fix stack out-of-bounds read in pipapo_drop() - fix OOB read in nfnl_cthelper_dump_table() - mctp: - fix device leak on probe failure - i2c: fix skb memory leak in receive path - can: keep the max bitrate error at 5% - eth: - bonding: fix nd_tbl NULL dereference when IPv6 is disabled - bnxt_en: fix RSS table size check when changing ethtool channels - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - octeontx2-af: devlink: fix NIX RAS reporter recovery condition" * tag 'net-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (71 commits) net: prevent NULL deref in ip[6]tunnel_xmit() octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status octeontx2-af: devlink: fix NIX RAS reporter recovery condition net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support net/mana: Null service_wq on setup error to prevent double destroy selftests: rtnetlink: add neighbour update test neighbour: restore protocol != 0 check in pneigh update net: dsa: realtek: Fix LED group port bit for non-zero LED group tipc: fix divide-by-zero in tipc_sk_filter_connect() net: dsa: microchip: Fix error path in PTP IRQ setup bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled ipv6: move the disable_ipv6_mod knob to core code net: bcmgenet: fix broken EEE by converting to phylib-managed state net-shapers: don't free reply skb after genlmsg_reply() net: dsa: mxl862xx: don't set user_mii_bus net: ethernet: arc: emac: quiesce interrupts before requesting IRQ page_pool: store detach_time as ktime_t to avoid false-negatives net: macb: Shuffle the tx ring before enabling tx ... commit a076cc74744d83fb9f70147a154b99278945a3d2 Merge: d557640e4ce589 06c2a67e90c1f0 Author: Rafael J. Wysocki Date: Thu Mar 12 19:00:30 2026 +0100 Merge branch 'pm-tools' Merge cpupower utility updates, including a fix and improvements of the existing functionality, for 7.0-rc4. * pm-tools: cpupower: Add intel_pstate turbo boost support for Intel platforms cpupower: Add support for setting EPP via systemd service cpupower: fix swapped power/energy unit labels commit 281f36d4a9970c206c2c44042904d4e34c092fbe Merge: 80234b5ab240f5 8e135b8aee5a06 Author: Linus Torvalds Date: Thu Mar 12 10:58:02 2026 -0700 Merge tag 'apparmor-pr-mainline-2026-03-09' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull AppArmor fixes from John Johansen: - fix race between freeing data and fs accessing it - fix race on unreferenced rawdata dereference - fix differential encoding verification - fix unconfined unprivileged local user can do privileged policy management - Fix double free of ns_name in aa_replace_profiles() - fix missing bounds check on DEFAULT table in verify_dfa() - fix side-effect bug in match_char() macro usage - fix: limit the number of levels of policy namespaces - replace recursive profile removal with iterative approach - fix memory leak in verify_header - validate DFA start states are in bounds in unpack_pdb * tag 'apparmor-pr-mainline-2026-03-09' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor: fix race between freeing data and fs accessing it apparmor: fix race on rawdata dereference apparmor: fix differential encoding verification apparmor: fix unprivileged local user can do privileged policy management apparmor: Fix double free of ns_name in aa_replace_profiles() apparmor: fix missing bounds check on DEFAULT table in verify_dfa() apparmor: fix side-effect bug in match_char() macro usage apparmor: fix: limit the number of levels of policy namespaces apparmor: replace recursive profile removal with iterative approach apparmor: fix memory leak in verify_header apparmor: validate DFA start states are in bounds in unpack_pdb commit 2619da73bb2f10d88f7e1087125c40144fdf0987 Author: David Woodhouse Date: Thu Mar 5 20:49:55 2026 +0100 KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs Commit 94dfc73e7cf4 ("treewide: uapi: Replace zero-length arrays with flexible-array members") broke the userspace API for C++. These structures ending in VLAs are typically a *header*, which can be followed by an arbitrary number of entries. Userspace typically creates a larger structure with some non-zero number of entries, for example in QEMU's kvm_arch_get_supported_msr_feature(): struct { struct kvm_msrs info; struct kvm_msr_entry entries[1]; } msr_data = {}; While that works in C, it fails in C++ with an error like: flexible array member 'kvm_msrs::entries' not at end of 'struct msr_data' Fix this by using __DECLARE_FLEX_ARRAY() for the VLA, which uses [0] for C++ compilation. Fixes: 94dfc73e7cf4 ("treewide: uapi: Replace zero-length arrays with flexible-array members") Cc: stable@vger.kernel.org Signed-off-by: David Woodhouse Link: https://patch.msgid.link/3abaf6aefd6e5efeff3b860ac38421d9dec908db.camel@infradead.org [sean: tag for stable@] Signed-off-by: Sean Christopherson commit 97d9960f355cca99960eb44cd1bba1d7ba1073ee Merge: 6ab3532b4c98f4 393815f5765110 Author: Rafael J. Wysocki Date: Thu Mar 12 18:42:41 2026 +0100 Merge branch 'acpi-osl' Merge an ACPI OS services layer (OSL) fix that addresses sparse warnings in acpi_os_initialize() (Ben Dooks) * acpi-osl: ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() commit d2ea4ff1ce50787a98a3900b3fb1636f3620b7cf Author: Sean Christopherson Date: Tue Mar 10 14:18:41 2026 -0700 KVM: selftests: Verify SEV+ guests can read and write EFER, CR0, CR4, and CR8 Add "do no harm" testing of EFER, CR0, CR4, and CR8 for SEV+ guests to verify that the guest can read and write the registers, without hitting e.g. a #VC on SEV-ES guests due to KVM incorrectly trying to intercept a register. Signed-off-by: Sean Christopherson Message-ID: <20260310211841.2552361-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c38b8f5f791ecce13ab77e2257f8fd2444ba80f6 Author: Eric Dumazet Date: Thu Mar 12 04:39:08 2026 +0000 net: prevent NULL deref in ip[6]tunnel_xmit() Blamed commit missed that both functions can be called with dev == NULL. Also add unlikely() hints for these conditions that only fuzzers can hit. Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions") Signed-off-by: Eric Dumazet CC: Weiming Shi Link: https://patch.msgid.link/20260312043908.2790803-1-edumazet@google.com Signed-off-by: Paolo Abeni commit c2c185be5c85d37215397c8e8781abf0a69bec1f Author: Jens Axboe Date: Thu Mar 12 08:59:25 2026 -0600 io_uring/kbuf: check if target buffer list is still legacy on recycle There's a gap between when the buffer was grabbed and when it potentially gets recycled, where if the list is empty, someone could've upgraded it to a ring provided type. This can happen if the request is forced via io-wq. The legacy recycling is missing checking if the buffer_list still exists, and if it's of the correct type. Add those checks. Cc: stable@vger.kernel.org Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Reported-by: Keenan Dong Signed-off-by: Jens Axboe commit a7b9ce39fbe4ae2919fe4f7ac16c293cb6632d30 Author: Ilpo Järvinen Date: Tue Feb 3 19:10:49 2026 +0200 serial: 8250_dw: Ensure BUSY is deasserted DW UART cannot write to LCR, DLL, and DLH while BUSY is asserted. Existance of BUSY depends on uart_16550_compatible, if UART HW is configured with it those registers can always be written. There currently is dw8250_force_idle() which attempts to achieve non-BUSY state by disabling FIFO, however, the solution is unreliable when Rx keeps getting more and more characters. Create a sequence of operations that ensures UART cannot keep BUSY asserted indefinitely. The new sequence relies on enabling loopback mode temporarily to prevent incoming Rx characters keeping UART BUSY. Ensure no Tx in ongoing while the UART is switches into the loopback mode (requires exporting serial8250_fifo_wait_for_lsr_thre() and adding DMA Tx pause/resume functions). According to tests performed by Adriana Nicolae , simply disabling FIFO or clearing FIFOs only once does not always ensure BUSY is deasserted but up to two tries may be needed. This could be related to ongoing Rx of a character (a guess, not known for sure). Therefore, retry FIFO clearing a few times (retry limit 4 is arbitrary number but using, e.g., p->fifosize seems overly large). Tests performed by others did not exhibit similar challenge but it does not seem harmful to leave the FIFO clearing loop in place for all DW UARTs with BUSY functionality. Use the new dw8250_idle_enter/exit() to do divisor writes and LCR writes. In case of plain LCR writes, opportunistically try to update LCR first and only invoke dw8250_idle_enter() if the write did not succeed (it has been observed that in practice most LCR writes do succeed without complications). This issue was first reported by qianfan Zhao who put lots of debugging effort into understanding the solution space. Fixes: c49436b657d0 ("serial: 8250_dw: Improve unwritable LCR workaround") Fixes: 7d4008ebb1c9 ("tty: add a DesignWare 8250 driver") Cc: stable Reported-by: qianfan Zhao Link: https://lore.kernel.org/linux-serial/289bb78a-7509-1c5c-2923-a04ed3b6487d@163.com/ Reported-by: Adriana Nicolae Link: https://lore.kernel.org/linux-serial/20250819182322.3451959-1-adriana@arista.com/ Reported-by: Bandal, Shankar Tested-by: Bandal, Shankar Tested-by: Murthy, Shanth Reviewed-by: Andy Shevchenko Signed-off-by: Ilpo Järvinen Link: https://patch.msgid.link/20260203171049.4353-8-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit e0a368ae79531ff92105a2692f10d83052055856 Author: Ilpo Järvinen Date: Tue Feb 3 19:10:48 2026 +0200 serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY When DW UART is !uart_16550_compatible, it can indicate BUSY at any point (when under constant Rx pressure) unless a complex sequence of steps is performed. Any LCR write can run a foul with the condition that prevents writing LCR while the UART is BUSY, which triggers BUSY_DETECT interrupt that seems unmaskable using IER bits. Normal flow is that dw8250_handle_irq() handles BUSY_DETECT condition by reading USR register. This BUSY feature, however, breaks the assumptions made in serial8250_do_shutdown(), which runs synchronize_irq() after clearing IER and assumes no interrupts can occur after that point but then proceeds to update LCR, which on DW UART can trigger an interrupt. If serial8250_do_shutdown() releases the interrupt handler before the handler has run and processed the BUSY_DETECT condition by read the USR register, the IRQ is not deasserted resulting in interrupt storm that triggers "irq x: nobody cared" warning leading to disabling the IRQ. Add late synchronize_irq() into serial8250_do_shutdown() to ensure BUSY_DETECT from DW UART is handled before port's interrupt handler is released. Alternative would be to add DW UART specific shutdown function but it would mostly duplicate the generic code and the extra synchronize_irq() seems pretty harmless in serial8250_do_shutdown(). Fixes: 7d4008ebb1c9 ("tty: add a DesignWare 8250 driver") Cc: stable Reported-by: Bandal, Shankar Tested-by: Bandal, Shankar Tested-by: Murthy, Shanth Reviewed-by: Andy Shevchenko Signed-off-by: Ilpo Järvinen Link: https://patch.msgid.link/20260203171049.4353-7-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 73a4ed8f9efaaaf8207614ccc1c9d5ca1888f23a Author: Ilpo Järvinen Date: Tue Feb 3 19:10:47 2026 +0200 serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm INTC10EE UART can end up into an interrupt storm where it reports IIR_NO_INT (0x1). If the storm happens during active UART operation, it is promptly stopped by IIR value change due to Rx or Tx events. However, when there is no activity, either due to idle serial line or due to specific circumstances such as during shutdown that writes IER=0, there is nothing to stop the storm. During shutdown the storm is particularly problematic because serial8250_do_shutdown() calls synchronize_irq() that will hang in waiting for the storm to finish which never happens. This problem can also result in triggering a warning: irq 45: nobody cared (try booting with the "irqpoll" option) [...snip...] handlers: serial8250_interrupt Disabling IRQ #45 Normal means to reset interrupt status by reading LSR, MSR, USR, or RX register do not result in the UART deasserting the IRQ. Add a quirk to INTC10EE UARTs to enable Tx interrupts if UART's Tx is currently empty and inactive. Rework IIR_NO_INT to keep track of the number of consecutive IIR_NO_INT, and on fourth one perform the quirk. Enabling Tx interrupts should change IIR value from IIR_NO_INT to IIR_THRI which has been observed to stop the storm. Fixes: e92fad024929 ("serial: 8250_dw: Add ACPI ID for Granite Rapids-D UART") Cc: stable Reported-by: Bandal, Shankar Tested-by: Bandal, Shankar Tested-by: Murthy, Shanth Reviewed-by: Andy Shevchenko Signed-off-by: Ilpo Järvinen Link: https://patch.msgid.link/20260203171049.4353-6-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 883c5a2bc934c165c4491d1ef7da0ac4e9765077 Author: Ilpo Järvinen Date: Tue Feb 3 19:10:46 2026 +0200 serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling dw8250_handle_irq() takes port's lock multiple times with no good reason to release it in between and calls serial8250_handle_irq() that also takes port's lock. Take port's lock only once in dw8250_handle_irq() and use serial8250_handle_irq_locked() to avoid releasing port's lock in between. As IIR_NO_INT check in serial8250_handle_irq() was outside of port's lock, it has to be done already in dw8250_handle_irq(). DW UART can, in addition to IIR_NO_INT, report BUSY_DETECT (0x7) which collided with the IIR_NO_INT (0x1) check in serial8250_handle_irq() (because & is used instead of ==) meaning that no other work is done by serial8250_handle_irq() during an BUSY_DETECT interrupt. This allows reorganizing code in dw8250_handle_irq() to do both IIR_NO_INT and BUSY_DETECT handling right at the start simplifying the logic. Tested-by: Bandal, Shankar Tested-by: Murthy, Shanth Cc: stable Reviewed-by: Andy Shevchenko Signed-off-by: Ilpo Järvinen Link: https://patch.msgid.link/20260203171049.4353-5-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8324a54f604da18f21070702a8ad82ab2062787b Author: Ilpo Järvinen Date: Tue Feb 3 19:10:45 2026 +0200 serial: 8250: Add serial8250_handle_irq_locked() 8250_port exports serial8250_handle_irq() to HW specific 8250 drivers. It takes port's lock within but a HW specific 8250 driver may want to take port's lock itself, do something, and then call the generic handler in 8250_port but to do that, the caller has to release port's lock for no good reason. Introduce serial8250_handle_irq_locked() which a HW specific driver can call while already holding port's lock. As this is new export, put it straight into a namespace (where all 8250 exports should eventually be moved). Tested-by: Bandal, Shankar Tested-by: Murthy, Shanth Cc: stable Reviewed-by: Andy Shevchenko Signed-off-by: Ilpo Järvinen Link: https://patch.msgid.link/20260203171049.4353-4-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8002d6d6d0d8a36a7d6ca523b17a51cb0fa7c3c3 Author: Ilpo Järvinen Date: Tue Feb 3 19:10:44 2026 +0200 serial: 8250_dw: Avoid unnecessary LCR writes When DW UART is configured with BUSY flag, LCR writes may not always succeed which can make any LCR write complex and very expensive. Performing write directly can trigger IRQ and the driver has to perform complex and distruptive sequence while retrying the write. Therefore, it's better to avoid doing LCR write that would not change the value of the LCR register. Add LCR write avoidance code into the 8250_dw driver's .serial_out() functions. Reported-by: Bandal, Shankar Tested-by: Bandal, Shankar Tested-by: Murthy, Shanth Cc: stable Reviewed-by: Andy Shevchenko Signed-off-by: Ilpo Järvinen Link: https://patch.msgid.link/20260203171049.4353-3-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 59a33d83bbe6d73d2071d7ae21590b29faed0503 Author: Ilpo Järvinen Date: Tue Feb 3 19:10:43 2026 +0200 serial: 8250: Protect LCR write in shutdown The 8250_dw driver needs to potentially perform very complex operations during LCR writes because its BUSY handling prevents updates to LCR while UART is BUSY (which is not fully under our control without those complex operations). Thus, LCR writes should occur under port's lock. Move LCR write under port's lock in serial8250_do_shutdown(). Also split the LCR RMW so that the logic is on a separate line for clarity. Reported-by: Bandal, Shankar Tested-by: Bandal, Shankar Tested-by: Murthy, Shanth Cc: stable Reviewed-by: Andy Shevchenko Signed-off-by: Ilpo Järvinen Link: https://patch.msgid.link/20260203171049.4353-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 9c0072bc33d349c83d223e64be30794e11938a6b Author: Martin Roukala (né Peres) Date: Mon Mar 9 15:53:10 2026 +0200 serial: 8250_pci: add support for the AX99100 This is found in popular brands such as StarTech.com or Delock, and has been a source of frustration to quite a few people, if I can trust Amazon comments complaining about Linux support via the official out-of-the-tree driver. Signed-off-by: Martin Roukala (né Peres) Cc: stable Link: https://patch.msgid.link/20260309-8250_pci_ax99100-v1-1-3328bdfd8e94@mupuf.org Signed-off-by: Greg Kroah-Hartman commit 455ce986fa356ff43a43c0d363ba95fa152f21d5 Author: Jiayuan Chen Date: Wed Feb 4 15:43:20 2026 +0800 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized): - uart_write_room() returns kfifo_avail() which can be > 0 - uart_write() checks xmit_buf and returns 0 if NULL This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write: while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits } For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs. Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write(). Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13 Signed-off-by: Jiayuan Chen Cc: stable Link: https://patch.msgid.link/20260204074327.226165-1-jiayuan.chen@linux.dev Signed-off-by: Greg Kroah-Hartman commit d54801cd509515f674a5aac1d3ea1401d2a05863 Author: Maciej Andrzejewski ICEYE Date: Thu Mar 5 13:37:51 2026 +0100 serial: uartlite: fix PM runtime usage count underflow on probe ulite_probe() calls pm_runtime_put_autosuspend() at the end of probe without holding a corresponding PM runtime reference for non-console ports. During ulite_assign(), uart_add_one_port() triggers uart_configure_port() which calls ulite_pm() via uart_change_pm(). For non-console ports, the UART core performs a balanced get/put cycle: uart_change_pm(ON) -> ulite_pm() -> pm_runtime_get_sync() +1 uart_change_pm(OFF) -> ulite_pm() -> pm_runtime_put_autosuspend() -1 This leaves no spare reference for the pm_runtime_put_autosuspend() at the end of probe. The PM runtime core prevents the count from actually going below zero, and instead triggers a "Runtime PM usage count underflow!" warning. For console ports the bug is masked: the UART core skips the uart_change_pm(OFF) call, so the UART core's unbalanced get happens to pair with probe's trailing put. Add pm_runtime_get_noresume() before pm_runtime_enable() to take an explicit probe-owned reference that the trailing pm_runtime_put_autosuspend() can release. This ensures a correct usage count regardless of whether the port is a console. Fixes: 5bbe10a6942d ("tty: serial: uartlite: Add runtime pm support") Cc: stable Signed-off-by: Maciej Andrzejewski ICEYE Link: https://patch.msgid.link/20260305123746.4152800-1-maciej.andrzejewski@m-works.net Signed-off-by: Greg Kroah-Hartman commit 24b98e8664e157aff0814a0f49895ee8223f382f Author: Peng Zhang Date: Tue Feb 24 13:16:39 2026 +0100 serial: 8250: always disable IRQ during THRE test commit 039d4926379b ("serial: 8250: Toggle IER bits on only after irq has been set up") moved IRQ setup before the THRE test, in combination with commit 205d300aea75 ("serial: 8250: change lock order in serial8250_do_startup()") the interrupt handler can run during the test and race with its IIR reads. This can produce wrong THRE test results and cause spurious registration of the serial8250_backup_timeout timer. Unconditionally disable the IRQ for the short duration of the test and re-enable it afterwards to avoid the race. Fixes: 039d4926379b ("serial: 8250: Toggle IER bits on only after irq has been set up") Depends-on: 205d300aea75 ("serial: 8250: change lock order in serial8250_do_startup()") Cc: stable Signed-off-by: Peng Zhang Reviewed-by: Muchun Song Signed-off-by: Alban Bedel Tested-by: Maximilian Lueer Link: https://patch.msgid.link/20260224121639.579404-1-alban.bedel@lht.dlh.de Signed-off-by: Greg Kroah-Hartman commit a424a34b8faddf97b5af41689087e7a230f79ba7 Author: Raul E Rangel Date: Mon Feb 9 13:58:18 2026 -0700 serial: 8250: Fix TX deadlock when using DMA `dmaengine_terminate_async` does not guarantee that the `__dma_tx_complete` callback will run. The callback is currently the only place where `dma->tx_running` gets cleared. If the transaction is canceled and the callback never runs, then `dma->tx_running` will never get cleared and we will never schedule new TX DMA transactions again. This change makes it so we clear `dma->tx_running` after we terminate the DMA transaction. This is "safe" because `serial8250_tx_dma_flush` is holding the UART port lock. The first thing the callback does is also grab the UART port lock, so access to `dma->tx_running` is serialized. Fixes: 9e512eaaf8f4 ("serial: 8250: Fix fifo underflow on flush") Cc: stable Signed-off-by: Raul E Rangel Link: https://patch.msgid.link/20260209135815.1.I16366ecb0f62f3c96fe3dd5763fcf6f3c2b4d8cd@changeid Signed-off-by: Greg Kroah-Hartman commit 592c61f3bfceaa29f8275696bd67c3dfad7ef72e Author: Miguel Ojeda Date: Thu Mar 12 12:10:14 2026 +0100 rust: kbuild: allow `unused_features` Starting with the upcoming Rust 1.96.0 (to be released 2026-05-28), `rustc` introduces the new lint `unused_features` [1], which warns [2]: warning: feature `used_with_arg` is declared but not used --> :1:93 | 1 | #![feature(asm_const,asm_goto,arbitrary_self_types,lint_reasons,offset_of_nested,raw_ref_op,used_with_arg)] | ^^^^^^^^^^^^^ | = note: `#[warn(unused_features)]` (part of `#[warn(unused)]`) on by default The original goal of using `-Zcrate-attr` automatically was that there is a consistent set of features enabled and managed globally for all Rust kernel code (modulo exceptions like the `rust/` crated). While we could require crates to enable features manually (even if we still keep the `-Zallow-features=` list, i.e. removing the `-Zcrate-attr` list), it is not really worth making all developers worry about it just for a new lint. The features are expected to eventually become stable anyway (most already did), and thus having to remove features in every file that may use them is not worth it either. Thus just allow the new lint globally. The lint actually existed for a long time, which is why `rustc` does not complain about an unknown lint in the stable versions we support, but it was "disabled" years ago [3], and now it was made to work again. For extra context, the new implementation of the lint has already been improved to avoid linting about features that became stable thanks to Benno's report and the ensuing discussion [4] [5], but while that helps, it is still the case that we may have features enabled that are not used for one reason or another in a particular crate. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://github.com/rust-lang/rust/pull/152164 [1] Link: https://github.com/Rust-for-Linux/pin-init/pull/114 [2] Link: https://github.com/rust-lang/rust/issues/44232 [3] Link: https://github.com/rust-lang/rust/issues/153523 [4] Link: https://github.com/rust-lang/rust/pull/153610 [5] Reviewed-by: Benno Lossin Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260312111014.74198-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit b22c526569e6af84008b674e66378e771bfbdd94 Author: Adam Ford Date: Mon Feb 9 23:37:01 2026 -0600 pmdomain: mediatek: Fix power domain count The wrong value of the number of domains is wrong which leads to failures when trying to enumerate nested power domains. PM: genpd_xlate_onecell: invalid domain index 0 PM: genpd_xlate_onecell: invalid domain index 1 PM: genpd_xlate_onecell: invalid domain index 3 PM: genpd_xlate_onecell: invalid domain index 4 PM: genpd_xlate_onecell: invalid domain index 5 PM: genpd_xlate_onecell: invalid domain index 13 PM: genpd_xlate_onecell: invalid domain index 14 Attempts to use these power domains fail, so fix this by using the correct value of calculated power domains. Signed-off-by: Adam Ford Fixes: 88914db077b6 ("pmdomain: mediatek: Add support for Hardware Voter power domains") Reviewed-by: AngeloGioacchino Del Regno Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 1965445e13c09b79932ca8154977b4408cb9610c Author: Aditya Garg Date: Tue Feb 17 02:54:46 2026 +0530 HID: appletb-kbd: add .resume method in PM Upon resuming from suspend, the Touch Bar driver was missing a resume method in order to restore the original mode the Touch Bar was on before suspending. It is the same as the reset_resume method. [jkosina@suse.com: rebased on top of the pm_ptr() conversion] Cc: stable@vger.kernel.org Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 70031e70ca15ede6a39db4d978e53a6cc720d454 Author: Adrian Freund Date: Wed Mar 11 20:19:33 2026 +0100 HID: logitech-hidpp: Enable MX Master 4 over bluetooth The Logitech MX Master 4 can be connected over bluetooth or through a Logitech Bolt receiver. This change adds support for non-standard HID features, such as high resolution scrolling when the mouse is connected over bluetooth. Because no Logitech Bolt receiver driver exists yet those features won't be available when the mouse is connected through the receiver. Signed-off-by: Adrian Freund Signed-off-by: Jiri Kosina commit 9250673cf23572b08c51bcdbb2919e9982bfc36b Merge: 5182e5ec4355dd 30c64fb9839949 Author: Takashi Iwai Date: Thu Mar 12 12:59:28 2026 +0100 Merge tag 'asoc-fix-v7.0-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.0 Quite a large pull request, but nothing too concerning here - everything is fairly small. We've got a couple of smaller core fixes for races on card teardown from Matteo Cotifava, a fix for handling dodgy DMI information generated by u-boot, some driver specific fixes and some new device IDs for Tegra. commit e7fcc54524f04e42641de99028edd9c69dc19f8c Author: Dapeng Mi Date: Wed Mar 11 15:52:00 2026 +0800 perf/x86/intel: Fix OMR snoop information parsing issues When omr_source is 0x2, the omr_snoop (bit[6]) and omr_promoted (bit[7]) fields are combined to represent the snoop information. However, the omr_promoted field was not left-shifted by 1 bit, resulting in incorrect snoop information. Besides, the snoop information parsing is not accurate for some OMR sources, like the snoop information should be SNOOP_NONE for these memory access (omr_source >= 7) instead of SNOOP_HIT. Fix these issues. Closes: https://lore.kernel.org/all/CAP-5=fW4zLWFw1v38zCzB9-cseNSTTCtup=p2SDxZq7dPayVww@mail.gmail.com/ Fixes: d2bdcde9626c ("perf/x86/intel: Add support for PEBS memory auxiliary info field in DMR") Reported-by: Ian Rogers Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ian Rogers Link: https://patch.msgid.link/20260311075201.2951073-1-dapeng1.mi@linux.intel.com commit 1d07bbd7ea36ea0b8dfa8068dbe67eb3a32d9590 Author: Dapeng Mi Date: Sat Feb 28 13:33:20 2026 +0800 perf/x86/intel: Add missing branch counters constraint apply When running the command: 'perf record -e "{instructions,instructions:p}" -j any,counter sleep 1', a "shift-out-of-bounds" warning is reported on CWF. UBSAN: shift-out-of-bounds in /kbuild/src/consumer/arch/x86/events/intel/lbr.c:970:15 shift exponent 64 is too large for 64-bit type 'long long unsigned int' ...... intel_pmu_lbr_counters_reorder.isra.0.cold+0x2a/0xa7 intel_pmu_lbr_save_brstack+0xc0/0x4c0 setup_arch_pebs_sample_data+0x114b/0x2400 The warning occurs because the second "instructions:p" event, which involves branch counters sampling, is incorrectly programmed to fixed counter 0 instead of the general-purpose (GP) counters 0-3 that support branch counters sampling. Currently only GP counters 0-3 support branch counters sampling on CWF, any event involving branch counters sampling should be programed on GP counters 0-3. Since the counter index of fixed counter 0 is 32, it leads to the "src" value in below code is right shifted 64 bits and trigger the "shift-out-of-bounds" warning. cnt = (src >> (order[j] * LBR_INFO_BR_CNTR_BITS)) & LBR_INFO_BR_CNTR_MASK; The root cause is the loss of the branch counters constraint for the new event in the branch counters sampling event group. Since it isn't yet part of the sibling list. This results in the second "instructions:p" event being programmed on fixed counter 0 incorrectly instead of the appropriate GP counters 0-3. To address this, we apply the missing branch counters constraint for the last event in the group. Additionally, we introduce a new function, `intel_set_branch_counter_constr()`, to apply the branch counters constraint and avoid code duplication. Fixes: 33744916196b ("perf/x86/intel: Support branch counters logging") Reported-by: Xudong Hao Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260228053320.140406-2-dapeng1.mi@linux.intel.com Cc: stable@vger.kernel.org commit 4b9ce671960627b2505b3f64742544ae9801df97 Author: Peter Zijlstra Date: Mon Mar 9 13:55:46 2026 +0100 perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access when group_sched_in() fails and needs to roll back. This *should* be handled by the transaction callbacks, but he found that when the group leader is a software event, the transaction handlers of the wrong PMU are used. Despite the move_group case in perf_event_open() and group_sched_in() using pmu_ctx->pmu. Turns out, inherit uses event->pmu to clone the events, effectively undoing the move_group case for all inherited contexts. Fix this by also making inherit use pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context. Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the group case. Fixes: bd2756811766 ("perf: Rewrite core context handling") Reported-by: Oliver Rosenberg Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ian Rogers Link: https://patch.msgid.link/20260309133713.GB606826@noisy.programming.kicks-ass.net commit f1cac6ac62d28a9a57b17f51ac5795bf250c12d3 Author: Peter Zijlstra Date: Wed Mar 11 21:29:14 2026 +0100 x86/perf: Make sure to program the counter value for stopped events on migration Both Mi Dapeng and Ian Rogers noted that not everything that sets HES_STOPPED is required to EF_UPDATE. Specifically the 'step 1' loop of rescheduling explicitly does EF_UPDATE to ensure the counter value is read. However, then 'step 2' simply leaves the new counter uninitialized when HES_STOPPED, even though, as noted above, the thing that stopped them might not be aware it needs to EF_RELOAD -- since it didn't EF_UPDATE on stop. One such location that is affected is throttling, throttle does pmu->stop(, 0); and unthrottle does pmu->start(, 0); possibly restarting an uninitialized counter. Fixes: a4eaf7f14675 ("perf: Rework the PMU methods") Reported-by: Dapeng Mi Reported-by: Ian Rogers Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Link: https://patch.msgid.link/20260311204035.GX606826@noisy.programming.kicks-ass.net commit 8d5fae6011260de209aaf231120e8146b14bc8e0 Author: Breno Leitao Date: Tue Mar 10 03:13:16 2026 -0700 perf/x86: Move event pointer setup earlier in x86_pmu_enable() A production AMD EPYC system crashed with a NULL pointer dereference in the PMU NMI handler: BUG: kernel NULL pointer dereference, address: 0000000000000198 RIP: x86_perf_event_update+0xc/0xa0 Call Trace: amd_pmu_v2_handle_irq+0x1a6/0x390 perf_event_nmi_handler+0x24/0x40 The faulting instruction is `cmpq $0x0, 0x198(%rdi)` with RDI=0, corresponding to the `if (unlikely(!hwc->event_base))` check in x86_perf_event_update() where hwc = &event->hw and event is NULL. drgn inspection of the vmcore on CPU 106 showed a mismatch between cpuc->active_mask and cpuc->events[]: active_mask: 0x1e (bits 1, 2, 3, 4) events[1]: 0xff1100136cbd4f38 (valid) events[2]: 0x0 (NULL, but active_mask bit 2 set) events[3]: 0xff1100076fd2cf38 (valid) events[4]: 0xff1100079e990a90 (valid) The event that should occupy events[2] was found in event_list[2] with hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run (which clears hw.state and sets active_mask) but events[2] was never populated. Another event (event_list[0]) had hw.state=0x7 (STOPPED|UPTODATE|ARCH), showing it was stopped when the PMU rescheduled events, confirming the throttle-then-reschedule sequence occurred. The root cause is commit 7e772a93eb61 ("perf/x86: Fix NULL event access and potential PEBS record loss") which moved the cpuc->events[idx] assignment out of x86_pmu_start() and into step 2 of x86_pmu_enable(), after the PERF_HES_ARCH check. This broke any path that calls pmu->start() without going through x86_pmu_enable() -- specifically the unthrottle path: perf_adjust_freq_unthr_events() -> perf_event_unthrottle_group() -> perf_event_unthrottle() -> event->pmu->start(event, 0) -> x86_pmu_start() // sets active_mask but not events[] The race sequence is: 1. A group of perf events overflows, triggering group throttle via perf_event_throttle_group(). All events are stopped: active_mask bits cleared, events[] preserved (x86_pmu_stop no longer clears events[] after commit 7e772a93eb61). 2. While still throttled (PERF_HES_STOPPED), x86_pmu_enable() runs due to other scheduling activity. Stopped events that need to move counters get PERF_HES_ARCH set and events[old_idx] cleared. In step 2 of x86_pmu_enable(), PERF_HES_ARCH causes these events to be skipped -- events[new_idx] is never set. 3. The timer tick unthrottles the group via pmu->start(). Since commit 7e772a93eb61 removed the events[] assignment from x86_pmu_start(), active_mask[new_idx] is set but events[new_idx] remains NULL. 4. A PMC overflow NMI fires. The handler iterates active counters, finds active_mask[2] set, reads events[2] which is NULL, and crashes dereferencing it. Move the cpuc->events[hwc->idx] assignment in x86_pmu_enable() to before the PERF_HES_ARCH check, so that events[] is populated even for events that are not immediately started. This ensures the unthrottle path via pmu->start() always finds a valid event pointer. Fixes: 7e772a93eb61 ("perf/x86: Fix NULL event access and potential PEBS record loss") Signed-off-by: Breno Leitao Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260310-perf-v2-1-4a3156fce43c@debian.org commit 14de1552a4e3fece78bb20314887e70888c9d448 Author: Bart Van Assche Date: Wed Mar 11 16:14:55 2026 -0700 include/linux/local_lock_internal.h: Make this header file again compatible with sparse There are two versions of the __this_cpu_local_lock() definitions in include/linux/local_lock_internal.h: one version that relies on the Clang overloading functionality and another version that does not. Select the latter version when using sparse. This patch fixes the following errors reported by sparse: include/linux/local_lock_internal.h:331:40: sparse: sparse: multiple definitions for function '__this_cpu_local_lock' include/linux/local_lock_internal.h:325:37: sparse: the previous one is here Closes: https://lore.kernel.org/oe-kbuild-all/202603062334.wgI5htP0-lkp@intel.com/ Fixes: d3febf16dee2 ("locking/local_lock: Support Clang's context analysis") Reported-by: kernel test robot Signed-off-by: Bart Van Assche Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Marco Elver Link: https://patch.msgid.link/20260311231455.1961413-1-bvanassche@acm.org commit 487f9b3dc6e507a982f1b984aa6bfbd9dc4b0567 Author: John Hubbard Date: Wed Mar 11 21:19:34 2026 -0700 rust: cpufreq: suppress clippy::double_parens in Policy doctest The kernel fmt! proc macro wraps each format argument as &(arg). Passing a tuple such as (a, b) produces &((a, b)) after expansion. Clippy flags that as double_parens, but it is a false positive fixed in Clippy 1.92 [1] [2]. Suppress the warning on the affected doctest function with a reason attribute so it can be removed once the minimum toolchain moves past 1.92. [ We may end up deciding to support per-version Clippy lints, in which case we will need [3]. In the future, if [4] gets fixed, we may be able to use `Delimiter::None` as Gary suggested in [5]. Link: https://lore.kernel.org/rust-for-linux/20260307170929.153892-1-ojeda@kernel.org/ [3] Link: https://github.com/rust-lang/rust/issues/67062 [4] Link: https://lore.kernel.org/rust-for-linux/DGUA5GY2DGYN.3PG0FKLG7GFN1@garyguo.net/ [5] - Miguel ] Link: https://github.com/rust-lang/rust-clippy/issues/15852 [1] Link: https://github.com/rust-lang/rust-clippy/pull/15939 [2] Suggested-by: Gary Guo Signed-off-by: John Hubbard Acked-by: Viresh Kumar Link: https://patch.msgid.link/20260312041934.362840-2-jhubbard@nvidia.com [ Reworded to replace GitHub-like short link with full URLs in Link tags. Reworded reason string to match the style of a couple others we have elsewhere. - Miguel ] Signed-off-by: Miguel Ojeda commit fdbaa9d2b78e0da9e1aeb303bbdc3adfe6d8e749 Author: Benno Lossin Date: Wed Mar 11 11:50:49 2026 +0100 rust: pin-init: replace shadowed return token by `unsafe`-to-create token We use a unit struct `__InitOk` in the closure generated by the initializer macros as the return value. We shadow it by creating a struct with the same name again inside of the closure, preventing early returns of `Ok` in the initializer (before all fields have been initialized). In the face of Type Alias Impl Trait (TAIT) and the next trait solver, this solution no longer works [1]. The shadowed struct can be named through type inference. In addition, there is an RFC proposing to add the feature of path inference to Rust, which would similarly allow [2]. Thus remove the shadowed token and replace it with an `unsafe` to create token. The reason we initially used the shadowing solution was because an alternative solution used a builder pattern. Gary writes [3]: In the early builder-pattern based InitOk, having a single InitOk type for token is unsound because one can launder an InitOk token used for one place to another initializer. I used a branded lifetime solution, and then you figured out that using a shadowed type would work better because nobody could construct it at all. The laundering issue does not apply to the approach we ended up with today. With this change, the example by Tim Chirananthavat in [1] no longer compiles and results in this error: error: cannot construct `pin_init::__internal::InitOk` with struct literal syntax due to private fields --> src/main.rs:26:17 | 26 | InferredType {} | ^^^^^^^^^^^^ | = note: private field `0` that was not provided help: you might have meant to use the `new` associated function | 26 - InferredType {} 26 + InferredType::new() | Applying the suggestion of using the `::new()` function, results in another expected error: error[E0133]: call to unsafe function `pin_init::__internal::InitOk::new` is unsafe and requires unsafe block --> src/main.rs:26:17 | 26 | InferredType::new() | ^^^^^^^^^^^^^^^^^^^ call to unsafe function | = note: consult the function's documentation for information on how to avoid undefined behavior Reported-by: Tim Chirananthavat Link: https://github.com/rust-lang/rust/issues/153535 [1] Link: https://github.com/rust-lang/rfcs/pull/3444#issuecomment-4016145373 [2] Link: https://github.com/rust-lang/rust/issues/153535#issuecomment-4017620804 [3] Fixes: fc6c6baa1f40 ("rust: init: add initialization macros") Cc: stable@vger.kernel.org Signed-off-by: Benno Lossin Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260311105056.1425041-1-lossin@kernel.org [ Added period as mentioned. - Miguel ] Signed-off-by: Miguel Ojeda commit d87f8bc47fbf012a7f115e311d0603d97e47c34c Author: Sabrina Dubroca Date: Mon Mar 9 11:32:43 2026 +0100 xfrm: avoid RCU warnings around the per-netns netlink socket net->xfrm.nlsk is used in 2 types of contexts: - fully under RCU, with rcu_read_lock + rcu_dereference and a NULL check - in the netlink handlers, with requests coming from a userspace socket In the 2nd case, net->xfrm.nlsk is guaranteed to stay non-NULL and the object is alive, since we can't enter the netns destruction path while the user socket holds a reference on the netns. After adding the __rcu annotation to netns_xfrm.nlsk (which silences sparse warnings in the RCU users and __net_init code), we need to tell sparse that the 2nd case is safe. Add a helper for that. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 103b4f5b4007cb484f40b1c8095a7e0526e5aff6 Author: Sabrina Dubroca Date: Mon Mar 9 11:32:42 2026 +0100 xfrm: add rcu_access_pointer to silence sparse warning for xfrm_input_afinfo xfrm_input_afinfo is __rcu, we should use rcu_access_pointer to avoid a sparse warning: net/xfrm/xfrm_input.c:78:21: error: incompatible types in comparison expression (different address spaces): net/xfrm/xfrm_input.c:78:21: struct xfrm_input_afinfo const [noderef] __rcu * net/xfrm/xfrm_input.c:78:21: struct xfrm_input_afinfo const * Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 2da6901866e7137f4e1a51a5f0bd1fbd0848a4eb Author: Sabrina Dubroca Date: Mon Mar 9 11:32:41 2026 +0100 xfrm: policy: silence sparse warning in xfrm_policy_unregister_afinfo xfrm_policy_afinfo is __rcu, use rcu_access_pointer to silence: net/xfrm/xfrm_policy.c:4152:43: error: incompatible types in comparison expression (different address spaces): net/xfrm/xfrm_policy.c:4152:43: struct xfrm_policy_afinfo const [noderef] __rcu * net/xfrm/xfrm_policy.c:4152:43: struct xfrm_policy_afinfo const * Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit b1f9c67781efd8a0ebd5019f14fbbac981cff7c1 Author: Sabrina Dubroca Date: Mon Mar 9 11:32:40 2026 +0100 xfrm: policy: fix sparse warnings in xfrm_policy_{init,fini} In xfrm_policy_init: add rcu_assign_pointer to fix warning: net/xfrm/xfrm_policy.c:4238:29: warning: incorrect type in assignment (different address spaces) net/xfrm/xfrm_policy.c:4238:29: expected struct hlist_head [noderef] __rcu *table net/xfrm/xfrm_policy.c:4238:29: got struct hlist_head * add rcu_dereference_protected to silence warning: net/xfrm/xfrm_policy.c:4265:36: warning: incorrect type in argument 1 (different address spaces) net/xfrm/xfrm_policy.c:4265:36: expected struct hlist_head *n net/xfrm/xfrm_policy.c:4265:36: got struct hlist_head [noderef] __rcu *table The netns is being created, no concurrent access is possible yet. In xfrm_policy_fini, net is going away, there shouldn't be any concurrent changes to the hashtables, so we can use rcu_dereference_protected to silence warnings: net/xfrm/xfrm_policy.c:4291:17: warning: incorrect type in argument 1 (different address spaces) net/xfrm/xfrm_policy.c:4291:17: expected struct hlist_head const *h net/xfrm/xfrm_policy.c:4291:17: got struct hlist_head [noderef] __rcu *table net/xfrm/xfrm_policy.c:4292:36: warning: incorrect type in argument 1 (different address spaces) net/xfrm/xfrm_policy.c:4292:36: expected struct hlist_head *n net/xfrm/xfrm_policy.c:4292:36: got struct hlist_head [noderef] __rcu *table Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 05b8673963c492fe36533e99a4a3c6661ca09ed0 Author: Sabrina Dubroca Date: Mon Mar 9 11:32:39 2026 +0100 xfrm: state: silence sparse warnings during netns exit Silence sparse warnings in xfrm_state_fini: net/xfrm/xfrm_state.c:3327:9: warning: incorrect type in argument 1 (different address spaces) net/xfrm/xfrm_state.c:3327:9: expected struct hlist_head const *h net/xfrm/xfrm_state.c:3327:9: got struct hlist_head [noderef] __rcu *state_byseq Add xfrm_state_deref_netexit() to wrap those calls. The netns is going away, we don't have to worry about the state_by* pointers being changed behind our backs. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit f468fdd52b97a63c4fb916fb882b936d8b43b8ae Author: Sabrina Dubroca Date: Mon Mar 9 11:32:38 2026 +0100 xfrm: remove rcu/state_hold from xfrm_state_lookup_spi_proto xfrm_state_lookup_spi_proto is called under xfrm_state_lock by xfrm_alloc_spi, no need to take a reference on the state and pretend to be under RCU. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 33cefb76a8edee8af257abfe6f42fb987c77132f Author: Sabrina Dubroca Date: Mon Mar 9 11:32:37 2026 +0100 xfrm: state: add xfrm_state_deref_prot to state_by* walk under lock We're under xfrm_state_lock for all those walks, we can use xfrm_state_deref_prot to silence sparse warnings such as: net/xfrm/xfrm_state.c:933:17: warning: dereference of noderef expression Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 55b5bc03148b26ce8156bc47b637a7337aa7d257 Author: Sabrina Dubroca Date: Mon Mar 9 11:32:36 2026 +0100 xfrm: state: fix sparse warnings around XFRM_STATE_INSERT We're under xfrm_state_lock in all those cases, use xfrm_state_deref_prot(state_by*) to avoid sparse warnings: net/xfrm/xfrm_state.c:2597:25: warning: cast removes address space '__rcu' of expression net/xfrm/xfrm_state.c:2597:25: warning: incorrect type in argument 2 (different address spaces) net/xfrm/xfrm_state.c:2597:25: expected struct hlist_head *h net/xfrm/xfrm_state.c:2597:25: got struct hlist_head [noderef] __rcu * Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit e2f845f672782b2522062cf1c9aad774276250d7 Author: Sabrina Dubroca Date: Mon Mar 9 11:32:35 2026 +0100 xfrm: state: fix sparse warnings in xfrm_state_init Use rcu_assign_pointer, and tmp variables for freeing on the error path without accessing net->xfrm.state_by*. Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 9f455aac17db0aa1486c94dd2c231353ebc9d8bc Author: Sabrina Dubroca Date: Mon Mar 9 11:32:34 2026 +0100 xfrm: state: fix sparse warnings on xfrm_state_hold_rcu In all callers, x is not an __rcu pointer. We can drop the annotation to avoid sparse warnings: net/xfrm/xfrm_state.c:58:39: warning: incorrect type in argument 1 (different address spaces) net/xfrm/xfrm_state.c:58:39: expected struct refcount_struct [usertype] *r net/xfrm/xfrm_state.c:58:39: got struct refcount_struct [noderef] __rcu * net/xfrm/xfrm_state.c:1166:42: warning: incorrect type in argument 1 (different address spaces) net/xfrm/xfrm_state.c:1166:42: expected struct xfrm_state [noderef] __rcu *x net/xfrm/xfrm_state.c:1166:42: got struct xfrm_state *[assigned] x (repeated for each caller) Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 146c9ab38b48004b40735b6c1e1c2b5adf6436f9 Author: Sayali Patil Date: Wed Mar 4 17:52:01 2026 +0530 powerpc/selftests/copyloops: extend selftest to exercise __copy_tofrom_user_power7_vmx The new PowerPC VMX fast path (__copy_tofrom_user_power7_vmx) is not exercised by existing copyloops selftests. This patch updates the selftest to exercise the VMX variant, ensuring the VMX copy path is validated. Changes include: - COPY_LOOP=test___copy_tofrom_user_power7_vmx with -D VMX_TEST is used in existing selftest build targets. - Inclusion of ../utils.c to provide get_auxv_entry() for hardware feature detection. - At runtime, the test skips execution if Altivec is not available. - Copy sizes above VMX_COPY_THRESHOLD are used to ensure the VMX path is taken. This enables validation of the VMX fast path without affecting systems that do not support Altivec. Signed-off-by: Sayali Patil Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260304122201.153049-2-sayalip@linux.ibm.com commit 6bc9c0a905228bea5c53ec195fe54f5f0233dccc Author: Sayali Patil Date: Wed Mar 4 17:52:00 2026 +0530 powerpc: fix KUAP warning in VMX usercopy path On powerpc with PREEMPT_FULL or PREEMPT_LAZY and function tracing enabled, KUAP warnings can be triggered from the VMX usercopy path under memory stress workloads. KUAP requires that no subfunctions are called once userspace access has been enabled. The existing VMX copy implementation violates this requirement by invoking enter_vmx_usercopy() from the assembly path after userspace access has already been enabled. If preemption occurs in this window, the AMR state may not be preserved correctly, leading to unexpected userspace access state and resulting in KUAP warnings. Fix this by restructuring the VMX usercopy flow so that VMX selection and VMX state management are centralized in raw_copy_tofrom_user(), which is invoked by the raw_copy_{to,from,in}_user() wrappers. The new flow is: - raw_copy_{to,from,in}_user() calls raw_copy_tofrom_user() - raw_copy_tofrom_user() decides whether to use the VMX path based on size and CPU capability - Call enter_vmx_usercopy() before enabling userspace access - Enable userspace access as per the copy direction and perform the VMX copy - Disable userspace access as per the copy direction - Call exit_vmx_usercopy() - Fall back to the base copy routine if the VMX copy faults With this change, the VMX assembly routines no longer perform VMX state management or call helper functions; they only implement the copy operations. The previous feature-section based VMX selection inside __copy_tofrom_user_power7() is removed, and a dedicated __copy_tofrom_user_power7_vmx() entry point is introduced. This ensures correct KUAP ordering, avoids subfunction calls while KUAP is unlocked, and eliminates the warnings while preserving the VMX fast path. Fixes: de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection") Reported-by: Shrikanth Hegde Closes: https://lore.kernel.org/all/20260109064917.777587-2-sshegde@linux.ibm.com/ Suggested-by: Christophe Leroy (CS GROUP) Reviewed-by: Christophe Leroy (CS GROUP) Co-developed-by: Aboorva Devarajan Signed-off-by: Aboorva Devarajan Signed-off-by: Sayali Patil Tested-by: Shrikanth Hegde Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260304122201.153049-1-sayalip@linux.ibm.com commit e9bbfb4bfa86c6b5515b868d6982ac60505d7e39 Author: Viktor Malik Date: Mon Mar 9 15:40:45 2026 +0100 powerpc, perf: Check that current->mm is alive before getting user callchain It may happen that mm is already released, which leads to kernel panic. This adds the NULL check for current->mm, similarly to commit 20afc60f892d ("x86, perf: Check that current->mm is alive before getting user callchain"). I was getting this panic when running a profiling BPF program (profile.py from bcc-tools): [26215.051935] Kernel attempted to read user page (588) - exploit attempt? (uid: 0) [26215.051950] BUG: Kernel NULL pointer dereference on read at 0x00000588 [26215.051952] Faulting instruction address: 0xc00000000020fac0 [26215.051957] Oops: Kernel access of bad area, sig: 11 [#1] [...] [26215.052049] Call Trace: [26215.052050] [c000000061da6d30] [c00000000020fc10] perf_callchain_user_64+0x2d0/0x490 (unreliable) [26215.052054] [c000000061da6dc0] [c00000000020f92c] perf_callchain_user+0x1c/0x30 [26215.052057] [c000000061da6de0] [c0000000005ab2a0] get_perf_callchain+0x100/0x360 [26215.052063] [c000000061da6e70] [c000000000573bc8] bpf_get_stackid+0x88/0xf0 [26215.052067] [c000000061da6ea0] [c008000000042258] bpf_prog_16d4ab9ab662f669_do_perf_event+0xf8/0x274 [...] In addition, move storing the top-level stack entry to generic perf_callchain_user to make sure the top-evel entry is always captured, even if current->mm is NULL. Fixes: 20002ded4d93 ("perf_counter: powerpc: Add callchain support") Signed-off-by: Viktor Malik Tested-by: Qiao Zhao Tested-by: Venkat Rao Bagalkote Reviewed-by: Saket Kumar Bhaskar [Maddy: fixed message to avoid checkpatch format style error] Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260309144045.169427-1-vmalik@redhat.com commit 0a8321dde01ffdbd9455a028194d57484def59eb Author: Ritesh Harjani (IBM) Date: Sun Mar 1 00:17:59 2026 +0530 powerpc/mem: Move CMA reservations to arch_mm_preinit commit 4267739cabb8 ("arch, mm: consolidate initialization of SPARSE memory model"), changed the initialization order of "pageblock_order" from... start_kernel() - setup_arch() - initmem_init() - sparse_init() - set_pageblock_order(); // this sets the pageblock_order - xxx_cma_reserve(); to... start_kernel() - setup_arch() - xxx_cma_reserve(); - mm_core_init_early() - free_area_init() - sparse_init() - set_pageblock_order() // this sets the pageblock_order. So this means, pageblock_order is not initialized before these cma reservation function calls, hence we are seeing CMA failures like... [ 0.000000] kvm_cma_reserve: reserving 3276 MiB for global area [ 0.000000] cma: pageblock_order not yet initialized. Called during early boot? [ 0.000000] cma: Failed to reserve 3276 MiB .... [ 0.000000][ T0] cma: pageblock_order not yet initialized. Called during early boot? [ 0.000000][ T0] cma: Failed to reserve 1024 MiB This patch moves these CMA reservations to arch_mm_preinit() which happens in mm_core_init() (which happens after pageblock_order is initialized), but before the memblock moves the free memory to buddy. Fixes: 4267739cabb8 ("arch, mm: consolidate initialization of SPARSE memory model") Suggested-by: Mike Rapoport Reported-and-tested-by: Sourabh Jain Closes: https://lore.kernel.org/linuxppc-dev/4c338a29-d190-44f3-8874-6cfa0a031f0b@linux.ibm.com/ Signed-off-by: Ritesh Harjani (IBM) Tested-by: Dan Horák Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/6e532cf0db5be99afbe20eed699163d5e86cd71f.1772303986.git.ritesh.list@gmail.com commit 50ae4ce2a6ace992025be3fdb14e244e88ddae18 Merge: 1f318b96cc84d7 e4eb11b34d6c84 Author: Dave Airlie Date: Thu Mar 12 14:38:07 2026 +1000 Merge tag 'drm-msm-fixes-2026-03-06' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v7.0: Core: - Adjusted msm_iommu_pagetable_prealloc_allocate() allocation type DPU: - Fixed blue screens on Hamoa laptops by reverting the LM reservation - Fixed the size of the LM block on several platforms - Dropped usage of %pK (again) - Fixed smatch warning on SSPP v13+ code - Fixed INTF_6 interrupts on Lemans DSI: - Fixed DSI PHY revision on Kaanapali - Fixed pixel clock calculation for the bonded DSI mode panels with compression enabled DT bindings: - Fixed DisplayPort description on Glymur - Fixed model name in SM8750 MDSS schema GPU: - Added MODULE_DEVICE_TABLE to the GPU driver - Fix bogus protect error on X2-85 - Fix dma_free_attrs() buffer size - Gen8 UBWC fix for Glymur From: Rob Clark Link: https://patch.msgid.link/CACSVV00wZ95gFDLfzJ0Ywb8rsjPSjZ1aHdwE4smnyuZ=Fg-g8Q@mail.gmail.com Signed-off-by: Dave Airlie commit 0fc773b0e4c1d9fe7cbf56d4df08d7bf90b58fb2 Author: Mukesh R Date: Tue Mar 3 16:02:51 2026 -0800 mshv: pass struct mshv_user_mem_region by reference For unstated reasons, function mshv_partition_ioctl_set_memory passes struct mshv_user_mem_region by value instead of by reference. Change it to pass by reference. Signed-off-by: Mukesh R Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit afeb96cb188d44a61033d838fda0acaa11d1ff24 Author: Uros Bizjak Date: Wed Mar 11 11:26:00 2026 +0100 x86/hyperv: Use any general-purpose register when saving %cr2 and %cr8 hv_hvcrash_ctxt_save() in arch/x86/hyperv/hv_crash.c currently saves %cr2 and %cr8 using %eax ("=a"). This unnecessarily forces a specific register. Update the inline assembly to use a general-purpose register ("=r") for both %cr2 and %cr8. This makes the code more flexible for the compiler while producing the same saved context contents. No functional changes. Signed-off-by: Uros Bizjak Cc: K. Y. Srinivasan Cc: Haiyang Zhang Cc: Wei Liu Cc: Dexuan Cui Cc: Long Li Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: H. Peter Anvin Signed-off-by: Wei Liu commit 2536091d585ac0b60ccf80cbe7a0bf4bfb75ec00 Author: Uros Bizjak Date: Wed Mar 11 11:25:59 2026 +0100 x86/hyperv: Use current_stack_pointer to avoid asm() in hv_hvcrash_ctxt_save() Use current_stack_pointer to avoid asm() when saving %rsp to the crash context memory in hv_hvcrash_ctxt_save(). The new code is more readable and results in exactly the same object file. Signed-off-by: Uros Bizjak Cc: K. Y. Srinivasan Cc: Haiyang Zhang Cc: Wei Liu Cc: Dexuan Cui Cc: Long Li Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: H. Peter Anvin Signed-off-by: Wei Liu commit 3484127c19aca9e93ef6631e7a47bc4f56212da9 Author: Uros Bizjak Date: Wed Mar 11 11:25:58 2026 +0100 x86/hyperv: Save segment registers directly to memory in hv_hvcrash_ctxt_save() hv_hvcrash_ctxt_save() in arch/x86/hyperv/hv_crash.c currently saves segment registers via a general-purpose register (%eax). Update the code to save segment registers (cs, ss, ds, es, fs, gs) directly to the crash context memory using movw. This avoids unnecessary use of a general-purpose register, making the code simpler and more efficient. The size of the corresponding object file improves as follows: text data bss dec hex filename 4167 176 200 4543 11bf hv_crash-old.o 4151 176 200 4527 11af hv_crash-new.o No functional change occurs to the saved context contents; this is purely a code-quality improvement. Signed-off-by: Uros Bizjak Cc: K. Y. Srinivasan Cc: Haiyang Zhang Cc: Wei Liu Cc: Dexuan Cui Cc: Long Li Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: H. Peter Anvin Signed-off-by: Wei Liu commit 87f7dff3ec75b91def0024ebaaf732457f47a63b Author: Alok Tiwari Date: Tue Mar 10 11:48:17 2026 -0700 octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status The NIX RAS health report path uses nix_af_rvu_err when handling the NIX_AF_RVU_RAS case, so the report prints the ERR interrupt status rather than the RAS interrupt status. Use nix_af_rvu_ras for the NIX_AF_RVU_RAS report. Fixes: 5ed66306eab6 ("octeontx2-af: Add devlink health reporters for NIX") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20260310184824.1183651-2-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit dc26ca99b835e21e76a58b1463b84adb0ca34f58 Author: Alok Tiwari Date: Tue Mar 10 11:48:16 2026 -0700 octeontx2-af: devlink: fix NIX RAS reporter recovery condition The NIX RAS health reporter recovery routine checks nix_af_rvu_int to decide whether to re-enable NIX_AF_RAS interrupts. This is the RVU interrupt status field and is unrelated to RAS events, so the recovery flow may incorrectly skip re-enabling NIX_AF_RAS interrupts. Check nix_af_rvu_ras instead before writing NIX_AF_RAS_ENA_W1S. Fixes: 5ed66306eab6 ("octeontx2-af: Add devlink health reporters for NIX") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20260310184824.1183651-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 840c9d13cb1ca96683a5307ee8e221be163a2c1e Author: Chintan Vankar Date: Tue Mar 10 21:39:40 2026 +0530 net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support The "rx_filter" member of "hwtstamp_config" structure is an enum field and does not support bitwise OR combination of multiple filter values. It causes error while linuxptp application tries to match rx filter version. Fix this by storing the requested filter type in a new port field. Fixes: 97248adb5a3b ("net: ti: am65-cpsw: Update hw timestamping filter for PTPv1 RX packets") Signed-off-by: Chintan Vankar Link: https://patch.msgid.link/20260310160940.109822-1-c-vankar@ti.com Signed-off-by: Jakub Kicinski commit 87c2302813abc55c46485711a678e3c312b00666 Author: Shiraz Saleem Date: Mon Mar 9 10:24:43 2026 -0700 net/mana: Null service_wq on setup error to prevent double destroy In mana_gd_setup() error path, set gc->service_wq to NULL after destroy_workqueue() to match the cleanup in mana_gd_cleanup(). This prevents a use-after-free if the workqueue pointer is checked after a failed setup. Fixes: f975a0955276 ("net: mana: Fix double destroy_workqueue on service rescan PCI path") Signed-off-by: Shiraz Saleem Signed-off-by: Konstantin Taranov Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260309172443.688392-1-kotaranov@linux.microsoft.com Signed-off-by: Jakub Kicinski commit ead054054874d7de4c1724e18c1adf90fdb5d7db Merge: 14ad51036c57e9 329f0b9b48ee6a Author: Jakub Kicinski Date: Wed Mar 11 19:12:59 2026 -0700 Merge tag 'nf-26-03-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net Due to large volume of backlogged patches its unlikely I will make the 2nd planned PR this week, so several legit fixes will be pushed back to next week. Sorry for the inconvenience but I am out of ideas and alternatives. 1) syzbot managed to add/remove devices to a flowtable, due to a bug in the flowtable netdevice notifier this gets us a double-add and eventually UaF when device is removed again (we only expect one entry, duplicate remains past net_device end-of-life). From Phil Sutter, bug added in 6.16. 2) Yiming Qian reports another nf_tables transaction handling bug: in some cases error unwind misses to undo certain set elements, resulting in refcount underflow and use-after-free, bug added in 6.4. 3) Jenny Guanni Qu found out-of-bounds read in pipapo set type. While the value is never used, it still rightfully triggers KASAN splats. Bug exists since this set type was added in 5.6. 4) a few x_tables modules contain copypastry tcp option parsing code which can read 1 byte past the option area. This bug is ancient, fix from David Dull. 5) nfnetlink_queue leaks kernel memory if userspace provides bad NFQA_VLAN/NFQA_L2HDR attributes. From Hyunwoo Kim, bug stems from from 4.7 days. 6) nfnetlink_cthelper has incorrect loop restart logic which may result in reading one pointer past end of array. From 3.6 days, fix also from Hyunwoo Kim. 7) xt_IDLETIMER v0 extension must reject working with timers added by revision v1, else we get list corruption. Bug added in v5.7. From Yifan Wu, Juefei Pu and Yuan Tan via Xin Lu. * tag 'nf-26-03-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path netfilter: x_tables: guard option walkers against 1-byte tail reads netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() netfilter: nf_tables: always walk all pending catchall elements netfilter: nf_tables: Fix for duplicate device in netdev hooks ==================== Link: https://patch.msgid.link/20260310132050.630-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 14ad51036c57e91e85b83f61df1d27e347912c32 Merge: e62a22f4347562 e94eaef11142b0 Author: Jakub Kicinski Date: Wed Mar 11 19:08:15 2026 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-03-10 (ice, iavf, i40e, e1000e, e1000) Nikolay Aleksandrov changes return code of RDMA related ice devlink get parameters when irdma is not enabled to -EOPNOTSUPP as current return of -ENODEV causes issues with devlink output. Petr Oros resolves a couple of issues in iavf; freeing PTP resources before reset and disable. Fixing contention issues with the netdev lock between reset and some ethtool operations. Alok Tiwari corrects an incorrect comparison of cloud filter values and adjust some passed arguments to sizeof() for consistency on i40e. Matt Vollrath removes an incorrect decrement for DMA error on e1000 and e1000e drivers. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: e1000/e1000e: Fix leak in DMA error cleanup i40e: fix src IP mask checks and memcpy argument names in cloud filter iavf: fix incorrect reset handling in callbacks iavf: fix PTP use-after-free during reset drivers: net: ice: fix devlink parameters get without irdma ==================== Link: https://patch.msgid.link/20260310205654.4109072-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit e62a22f43475624ea466fd9b766f62e8458f4cd9 Merge: e8f0dc024ce554 68e76fc12df091 Author: Jakub Kicinski Date: Wed Mar 11 19:04:58 2026 -0700 Merge branch 'neighbour-fix-update-of-proxy-neighbour' Sabrina Dubroca says: ==================== neighbour: fix update of proxy neighbour While re-reading some "old" patches I ran into a small change of behavior in commit dc2a27e524ac ("neighbour: Update pneigh_entry in pneigh_create()."). The old behavior was not consistent between ->protocol and ->flags, and didn't offer a way to clear protocol, so maybe it's better to change that (7-years-old [1]) behavior. But then we should change non-proxy neighbours as well to keep neigh/pneigh consistent. [1] df9b0e30d44c ("neighbor: Add protocol attribute") ==================== Link: https://patch.msgid.link/cover.1772894876.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 68e76fc12df091b04ede5f6244385a35abae0a80 Author: Sabrina Dubroca Date: Tue Mar 10 22:59:17 2026 +0100 selftests: rtnetlink: add neighbour update test Check that protocol and flags are updated correctly for neighbour and pneigh entries. Signed-off-by: Sabrina Dubroca Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/d28f72b5b4ff4c9ecbbbde06146a938dcc4c264a.1772894876.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit cbada1048847a348797aec63a1d8056621cbe653 Author: Sabrina Dubroca Date: Tue Mar 10 22:59:16 2026 +0100 neighbour: restore protocol != 0 check in pneigh update Prior to commit dc2a27e524ac ("neighbour: Update pneigh_entry in pneigh_create()."), a pneigh's protocol was updated only when the value of the NDA_PROTOCOL attribute was non-0. While moving the code, that check was removed. This is a small change of user-visible behavior, and inconsistent with the (non-proxy) neighbour behavior. Fixes: dc2a27e524ac ("neighbour: Update pneigh_entry in pneigh_create().") Signed-off-by: Sabrina Dubroca Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/38c61de1bb032871a886aff9b9b52fe1cdd4cada.1772894876.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit e8f0dc024ce55451ebd54bad975134ba802e4fcc Author: Marek Behún Date: Wed Mar 11 12:12:37 2026 +0100 net: dsa: realtek: Fix LED group port bit for non-zero LED group The rtl8366rb_led_group_port_mask() function always returns LED port bit in LED group 0; the switch statement returns the same thing in all non-default cases. This means that the driver does not currently support configuring LEDs in non-zero LED groups. Fix this. Fixes: 32d617005475a71e ("net: dsa: realtek: add LED drivers for rtl8366rb") Signed-off-by: Marek Behún Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260311111237.29002-1-kabel@kernel.org Signed-off-by: Jakub Kicinski commit 6c5a9baa15de240e747263aba435a0951da8d8d2 Author: Mehul Rao Date: Tue Mar 10 13:07:30 2026 -0400 tipc: fix divide-by-zero in tipc_sk_filter_connect() A user can set conn_timeout to any value via setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in tipc_sk_filter_connect() executes: delay %= (tsk->conn_timeout / 4); If conn_timeout is in the range [0, 3], the integer division yields 0, and the modulo operation triggers a divide-by-zero exception, causing a kernel oops/panic. Fix this by clamping conn_timeout to a minimum of 4 at the point of use in tipc_sk_filter_connect(). Oops: divide error: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+ RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362) Call Trace: tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406) __release_sock (include/net/sock.h:1185 net/core/sock.c:3213) release_sock (net/core/sock.c:3797) tipc_connect (net/tipc/socket.c:2570) __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098) Fixes: 6787927475e5 ("tipc: buffer overflow handling in listener socket") Cc: stable@vger.kernel.org Signed-off-by: Mehul Rao Reviewed-by: Tung Nguyen Link: https://patch.msgid.link/20260310170730.28841-1-mehulrao@gmail.com Signed-off-by: Jakub Kicinski commit 99c8c16a4aad0b37293cae213e15957c573cf79b Author: Bastien Curutchet (Schneider Electric) Date: Mon Mar 9 14:15:43 2026 +0100 net: dsa: microchip: Fix error path in PTP IRQ setup If request_threaded_irq() fails during the PTP message IRQ setup, the newly created IRQ mapping is never disposed. Indeed, the ksz_ptp_irq_setup()'s error path only frees the mappings that were successfully set up. Dispose the newly created mapping if the associated request_threaded_irq() fails at setup. Cc: stable@vger.kernel.org Fixes: d0b8fec8ae505 ("net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()") Signed-off-by: Bastien Curutchet (Schneider Electric) Reviewed-by: Simon Horman Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260309-ksz-ptp-irq-fix-v1-1-757b3b985955@bootlin.com Signed-off-by: Jakub Kicinski commit 20c1be4cc86fa34bd68496a1b8168f1af0a2ee72 Merge: 908c344d5cfac4 d56b5d163458c4 Author: Jakub Kicinski Date: Wed Mar 11 17:53:40 2026 -0700 Merge branch 'net-bpf-nd_tbl-fixes-for-when-ipv6-disable-1' Ricardo B. Marlière says: ==================== {net,bpf}: nd_tbl fixes for when ipv6.disable=1 Please consider merging these four patches to fix three crashes that were found after this report: https://lore.kernel.org/all/CAHXs0ORzd62QOG-Fttqa2Cx_A_VFp=utE2H2VTX5nqfgs7LDxQ@mail.gmail.com The first patch from Jakub Kicinski is a preparation in order to enable the use ipv6_mod_enabled() even when CONFIG_IPV6=n. ==================== Link: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-0-e2677e85628c@suse.com Signed-off-by: Jakub Kicinski commit d56b5d163458c45ab8fa1f00bd875af01b3ce28c Author: Ricardo B. Marlière Date: Sat Mar 7 17:50:56 2026 -0300 bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bpf_redirect_neigh() is called with explicit AF_INET6 nexthop parameters, __bpf_redirect_neigh_v6() can skip the IPv6 FIB lookup and call bpf_out_neigh_v6() directly. bpf_out_neigh_v6() then calls ip_neigh_gw6(), which uses ipv6_stub->nd_tbl. BUG: kernel NULL pointer dereference, address: 0000000000000248 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:skb_do_redirect+0x44f/0xf40 Call Trace: ? srso_alias_return_thunk+0x5/0xfbef5 ? __tcf_classify.constprop.0+0x83/0x160 ? srso_alias_return_thunk+0x5/0xfbef5 ? tcf_classify+0x2b/0x50 ? srso_alias_return_thunk+0x5/0xfbef5 ? tc_run+0xb8/0x120 ? srso_alias_return_thunk+0x5/0xfbef5 __dev_queue_xmit+0x6fa/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 packet_sendmsg+0x10da/0x1700 ? srso_alias_return_thunk+0x5/0xfbef5 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by adding an early check in bpf_out_neigh_v6(). If IPv6 is disabled, drop the packet before neighbor lookup. Suggested-by: Fernando Fernandez Mancera Fixes: ba452c9e996d ("bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop") Signed-off-by: Ricardo B. Marlière Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-4-e2677e85628c@suse.com Signed-off-by: Jakub Kicinski commit dcb4e2231469523d20cf0a2477d68245795c205d Author: Ricardo B. Marlière Date: Sat Mar 7 17:50:55 2026 -0300 bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bpf_redirect_neigh() is called from tc with an explicit nexthop of nh_family == AF_INET6, bpf_out_neigh_v4() takes the AF_INET6 branch and calls ip_neigh_gw6(), which relies on ipv6_stub->nd_tbl. BUG: kernel NULL pointer dereference, address: 0000000000000248 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:skb_do_redirect+0xb93/0xf00 Call Trace: ? srso_alias_return_thunk+0x5/0xfbef5 ? __tcf_classify.constprop.0+0x83/0x160 ? srso_alias_return_thunk+0x5/0xfbef5 ? tcf_classify+0x2b/0x50 ? srso_alias_return_thunk+0x5/0xfbef5 ? tc_run+0xb8/0x120 ? srso_alias_return_thunk+0x5/0xfbef5 __dev_queue_xmit+0x6fa/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? alloc_skb_with_frags+0x58/0x200 packet_sendmsg+0x10da/0x1700 ? srso_alias_return_thunk+0x5/0xfbef5 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by adding an early check in the AF_INET6 branch of bpf_out_neigh_v4(). If IPv6 is disabled, unlock RCU and drop the packet. Suggested-by: Fernando Fernandez Mancera Fixes: ba452c9e996d ("bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop") Signed-off-by: Ricardo B. Marlière Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-3-e2677e85628c@suse.com Signed-off-by: Jakub Kicinski commit 30021e969d48e5819d5ae56936c2f34c0f7ce997 Author: Ricardo B. Marlière Date: Sat Mar 7 17:50:54 2026 -0300 net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bond_validate_na(), which calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can crash in __ipv6_chk_addr_and_flags(). BUG: kernel NULL pointer dereference, address: 00000000000005d8 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170 Call Trace: ipv6_chk_addr+0x1f/0x30 bond_validate_na+0x12e/0x1d0 [bonding] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] bond_rcv_validate+0x1a0/0x450 [bonding] bond_handle_frame+0x5e/0x290 [bonding] ? srso_alias_return_thunk+0x5/0xfbef5 __netif_receive_skb_core.constprop.0+0x3e8/0xe50 ? srso_alias_return_thunk+0x5/0xfbef5 ? update_cfs_rq_load_avg+0x1a/0x240 ? srso_alias_return_thunk+0x5/0xfbef5 ? __enqueue_entity+0x5e/0x240 __netif_receive_skb_one_core+0x39/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x30/0x200 ? srso_alias_return_thunk+0x5/0xfbef5 net_rx_action+0x338/0x3b0 handle_softirqs+0xc9/0x2a0 do_softirq+0x42/0x60 __local_bh_enable_ip+0x62/0x70 __dev_queue_xmit+0x2d3/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? packet_parse_headers+0x10a/0x1a0 packet_sendmsg+0x10da/0x1700 ? kick_pool+0x5f/0x140 ? srso_alias_return_thunk+0x5/0xfbef5 ? __queue_work+0x12d/0x4f0 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr(). Suggested-by: Fernando Fernandez Mancera Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") Signed-off-by: Ricardo B. Marlière Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-2-e2677e85628c@suse.com Signed-off-by: Jakub Kicinski commit 94a4b1f959989de9c54d43c3a102fb1ee92e1414 Author: Jakub Kicinski Date: Sat Mar 7 17:50:53 2026 -0300 ipv6: move the disable_ipv6_mod knob to core code From: Jakub Kicinski Make sure disable_ipv6_mod itself is not part of the IPv6 module, in case core code wants to refer to it. We will remove support for IPv6=m soon, this change helps make fixes we commit before that less messy. Link: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-1-e2677e85628c@suse.com Signed-off-by: Jakub Kicinski commit e3beefd3af09f8e460ddaf39063d3d7664d7ab59 Author: Shyam Prasad N Date: Wed Mar 11 10:48:54 2026 +0530 cifs: make default value of retrans as zero When retrans mount option was introduced, the default value was set as 1. However, in the light of some bugs that this has exposed recently we should change it to 0 and retain the old behaviour before this option was introduced. Cc: Reviewed-by: Bharath SM Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 40e75e42f49ca54b4ff41f3edb94f5ef0299140c Author: Paulo Alcantara Date: Wed Mar 11 15:00:52 2026 -0300 smb: client: fix open handle lookup in cifs_open() When looking up open handles to be re-used in cifs_open(), calling cifs_get_{writable,readable}_path() is wrong as it will look up for the first matching open handle, and if @file->f_flags doesn't match, it will ignore the remaining open handles in cifsInodeInfo::openFileList that might potentially match @file->f_flags. For writable and readable handles, fix this by calling __cifs_get_writable_file() and __find_readable_file(), respectively, with FIND_OPEN_FLAGS set. With the patch, the following program ends up with two opens instead of three sent over the wire. ``` #define _GNU_SOURCE #include #include #include int main(int argc, char *argv[]) { int fd; fd = open("/mnt/1/foo", O_CREAT | O_WRONLY | O_TRUNC, 0664); close(fd); fd = open("/mnt/1/foo", O_DIRECT | O_WRONLY); close(fd); fd = open("/mnt/1/foo", O_WRONLY); close(fd); fd = open("/mnt/1/foo", O_DIRECT | O_WRONLY); close(fd); return 0; } ``` ``` $ mount.cifs //srv/share /mnt/1 -o ... $ gcc test.c && ./a.out ``` Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: ChenXiaoSong Cc: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit d4c7210d2f3ea481a6481f03040a64d9077a6172 Author: Henrique Carvalho Date: Wed Mar 11 20:17:23 2026 -0300 smb: client: fix iface port assignment in parse_server_interfaces parse_server_interfaces() initializes interface socket addresses with CIFS_PORT. When the mount uses a non-default port this overwrites the configured destination port. Later, cifs_chan_update_iface() copies this sockaddr into server->dstaddr, causing reconnect attempts to use the wrong port after server interface updates. Use the existing port from server->dstaddr instead. Cc: stable@vger.kernel.org Fixes: fe856be475f7 ("CIFS: parse and store info on iface queries") Tested-by: Dr. Thomas Orgis Reviewed-by: Enzo Matsumiya Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit f311a05784634febd299f03476b80f3f18489767 Author: Adrian Ng Ho Yin Date: Fri Feb 13 14:00:48 2026 +0800 i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach The DesignWare I3C master controller ACKs IBIs as soon as a valid Device Address Table (DAT) entry is present. This can create a race between device attachment (after DAA) and the point where the client driver enables IBIs via i3c_device_enable_ibi(). Set DEV_ADDR_TABLE_SIR_REJECT in the DAT entry during attach_i3c_dev() and reattach_i3c_dev() so that IBIs are rejected by default. The bit is managed thereafter by the existing dw_i3c_master_set_sir_enabled() function, which clears it in enable_ibi() after ENEC is issued, and restores it in disable_ibi() after DISEC. Fixes: 1dd728f5d4d4 ("i3c: master: Add driver for Synopsys DesignWare IP") Signed-off-by: Adrian Ng Ho Yin Reviewed-by: Frank Li Link: https://patch.msgid.link/53f5b8cbdd8af789ec38b95b02873f32f9182dd6.1770962368.git.adrianhoyin.ng@altera.com Signed-off-by: Alexandre Belloni commit f26ecaa0f0abfe5db173416214098a00d3b7db79 Author: Peter Yin Date: Mon Mar 2 15:56:42 2026 +0800 i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter The DesignWare I3C master driver creates a virtual I2C adapter to provide backward compatibility with I2C devices. However, the current implementation does not associate this virtual adapter with any Device Tree node. Propagate the of_node from the I3C master platform device to the virtual I2C adapter's device structure. This ensures that standard I2C aliases are correctly resolved and bus numbering remains consistent. Signed-off-by: Peter Yin Reviewed-by: Frank Li Link: https://patch.msgid.link/20260302075645.1492766-1-peteryin.openbmc@gmail.com Signed-off-by: Alexandre Belloni commit 9a258d1336f7ff3add8b92d566d3a421f03bf4d2 Author: Adrian Hunter Date: Fri Mar 6 09:24:51 2026 +0200 i3c: mipi-i3c-hci: Fallback to software reset when bus disable fails Disruption of the MIPI I3C HCI controller's internal state can cause i3c_hci_bus_disable() to fail when attempting to shut down the bus. In the code paths where bus disable is invoked - bus clean-up and runtime suspend - the controller does not need to remain operational afterward, so a full controller reset is a safe recovery mechanism. Add a fallback to issue a software reset when disabling the bus fails. This ensures the bus is reliably halted even if the controller's state machine is stuck or unresponsive. The fallback is used both during bus clean-up and in the runtime suspend path. In the latter case, ensure interrupts are quiesced after reset. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-15-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit c6396b835a5e599c4df656112140f065bb544a24 Author: Adrian Hunter Date: Fri Mar 6 09:24:50 2026 +0200 i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization Shared interrupts may fire unexpectedly, including during periods when the controller is not yet fully initialized. Commit b9a15012a1452 ("i3c: mipi-i3c-hci: Add optional Runtime PM support") addressed this issue for the runtime-suspended state, but the same problem can also occur before the bus is enabled for the first time. Ensure the IRQ handler ignores interrupts until initialization is complete by making consistent use of the existing irq_inactive flag. The flag is now set to false immediately before enabling the bus. To guarantee correct ordering with respect to the IRQ handler, protect all transitions of irq_inactive with the same spinlock used inside the handler. Fixes: b8460480f62e1 ("i3c: mipi-i3c-hci: Allow for Multi-Bus Instances") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-14-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit e44d2719225e618dde74c7056f8e6949f884095e Author: Adrian Hunter Date: Fri Mar 6 09:24:49 2026 +0200 i3c: mipi-i3c-hci: Fix race in DMA error handling in interrupt context The DMA ring halts whenever a transfer encounters an error. The interrupt handler previously attempted to detect this situation and restart the ring if a transfer completed at the same time. However, this restart logic runs entirely in interrupt context and is inherently racy: it interacts with other paths manipulating the ring state, and fully serializing it within the interrupt handler is not practical. Move this error-recovery logic out of the interrupt handler and into the transfer-processing path (i3c_hci_process_xfer()), where serialization and state management are already controlled. Introduce a new optional I/O-ops callback, handle_error(), invoked when a completed transfer reports an error. For DMA operation, the implementation simply calls the existing dequeue function, which safely aborts and restarts the ring when needed. This removes the fragile ring-restart logic from the interrupt handler and centralizes error handling where proper sequencing can be ensured. Fixes: ccdb2e0e3b00d ("i3c: mipi-i3c-hci: Add Intel specific quirk to ring resuming") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-13-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 7ac45bc68f089887ab3a70358057edb7e6b6084e Author: Adrian Hunter Date: Fri Mar 6 09:24:48 2026 +0200 i3c: mipi-i3c-hci: Consolidate common xfer processing logic Several parts of the MIPI I3C HCI driver duplicate the same sequence for queuing a transfer, waiting for completion, and handling timeouts. This logic appears in five separate locations and will be affected by an upcoming fix. Refactor the repeated code into a new helper, i3c_hci_process_xfer(), and store the timeout value in the hci_xfer structure so that callers do not need to pass it as a separate parameter. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-12-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit b6d586431ae20d5157ee468d0ef62ad26798ef13 Author: Adrian Hunter Date: Fri Mar 6 09:24:47 2026 +0200 i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort The DMA dequeue path attempts to restart the ring after aborting an in-flight transfer, but the current sequence is incomplete. The controller must be brought out of the aborted state and the ring control registers must be programmed in the correct order: first clearing ABORT, then re-enabling the ring and asserting RUN_STOP to resume operation. Add the missing controller resume step and update the ring control writes so that the ring is restarted using the proper sequence. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-11-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit ec3cfd835f7c4bbd23bc9ad909d2fdc772a578bb Author: Adrian Hunter Date: Fri Mar 6 09:24:46 2026 +0200 i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor The internal control command descriptor used for no-op commands includes a Transaction ID (TID) field, but the no-op command constructed in hci_dma_dequeue_xfer() omitted it. As a result, the hardware receives a no-op descriptor without the expected TID. This bug has gone unnoticed because the TID is currently not validated in the no-op completion path, but the descriptor format requires it to be present. Add the missing TID field when generating a no-op descriptor so that its layout matches the defined command structure. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-10-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit b795e68bf3073d67bebbb5a44d93f49efc5b8cc7 Author: Adrian Hunter Date: Fri Mar 6 09:24:45 2026 +0200 i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue The logic used to abort the DMA ring contains several flaws: 1. The driver unconditionally issues a ring abort even when the ring has already stopped. 2. The completion used to wait for abort completion is never re-initialized, resulting in incorrect wait behavior. 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which resets hardware ring pointers and disrupts the controller state. 4. If the ring is already stopped, the abort operation should be considered successful without attempting further action. Fix the abort handling by checking whether the ring is running before issuing an abort, re-initializing the completion when needed, ensuring that RING_CTRL_ENABLE remains asserted during abort, and treating an already stopped ring as a successful condition. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-9-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit f0b5159637ca0b8feaaa95de0f5ea38f1ba26729 Author: Adrian Hunter Date: Fri Mar 6 09:24:44 2026 +0200 i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler The DMA ring bookkeeping in the MIPI I3C HCI driver is updated from two contexts: the DMA ring dequeue path (hci_dma_dequeue_xfer()) and the interrupt handler (hci_dma_xfer_done()). Both modify the ring's in-flight transfer state - specifically rh->src_xfers[] and xfer->ring_entry - but without any serialization. This allows the two paths to race, potentially leading to inconsistent ring state. Serialize access to the shared ring state by extending the existing spinlock to cover the DMA dequeue path and the entire interrupt handler. Since the core IRQ handler now holds this lock, remove the per-function locking from the PIO and DMA sub-handlers. Additionally, clear the completed entry in rh->src_xfers[] in hci_dma_xfer_done() so it cannot be matched or completed again. Finally, place the ring restart sequence under the same lock in hci_dma_dequeue_xfer() to avoid concurrent enqueue or completion operations while the ring state is being modified. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-8-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 1dca8aee80eea76d2aae21265de5dd64f6ba0f09 Author: Adrian Hunter Date: Fri Mar 6 09:24:43 2026 +0200 i3c: mipi-i3c-hci: Fix race in DMA ring dequeue The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for multiple transfers that timeout around the same time. However, the function is not serialized and can race with itself. When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes incomplete transfers, and then restarts the ring. If another timeout triggers a parallel call into the same function, the two instances may interfere with each other - stopping or restarting the ring at unexpected times. Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to itself. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-7-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 4decbbc8a8cf0a69ab011d7c2c88ed3cd0a00ddd Author: Adrian Hunter Date: Fri Mar 6 09:24:42 2026 +0200 i3c: mipi-i3c-hci: Fix race in DMA ring enqueue for parallel xfers The I3C subsystem allows multiple transfers to be queued concurrently. However, the MIPI I3C HCI driver's DMA enqueue path, hci_dma_queue_xfer(), lacks sufficient serialization. In particular, the allocation of the enqueue_ptr and its subsequent update in the RING_OPERATION1 register, must be done atomically. Otherwise, for example, it would be possible for 2 transfers to be allocated the same enqueue_ptr. Extend the use of the existing spinlock for that purpose. Keep a count of the number of xfers enqueued so that it is easy to determine if the ring has enough space. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-6-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit fa12bb903bc3ed1826e355d267fe134bde95e23c Author: Adrian Hunter Date: Fri Mar 6 09:24:41 2026 +0200 i3c: mipi-i3c-hci: Consolidate spinlocks The MIPI I3C HCI driver currently uses separate spinlocks for different contexts (PIO vs. DMA rings). This split is unnecessary and complicates upcoming fixes. The driver does not support concurrent PIO and DMA operation, and it only supports a single DMA ring, so a single lock is sufficient for all paths. Introduce a unified spinlock in struct i3c_hci, switch both PIO and DMA code to use it, and remove the per-context locks. No functional change is intended in this patch. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-5-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit f3bcbfe1b8b0b836b772927f75f8cb6e759eb00a Author: Adrian Hunter Date: Fri Mar 6 09:24:40 2026 +0200 i3c: mipi-i3c-hci: Factor out DMA mapping from queuing path Prepare for fixing a race in the DMA ring enqueue path when handling parallel transfers. Move all DMA mapping out of hci_dma_queue_xfer() and into a new helper that performs the mapping up front. This refactoring allows the upcoming fix to extend the spinlock coverage around the enqueue operation without performing DMA mapping under the spinlock. No functional change is intended in this patch. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-4-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit fa9586bd77ada1e3861c7bef65f6bb9dcf8d9481 Author: Adrian Hunter Date: Fri Mar 6 09:24:39 2026 +0200 i3c: mipi-i3c-hci: Fix Hot-Join NACK The MIPI I3C HCI host controller driver does not implement Hot-Join handling, yet Hot-Join response control defaults to allowing devices to Hot-Join the bus. Configure HC_CONTROL_HOT_JOIN_CTRL to NACK all Hot-Join attempts. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-3-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 4167b8914463132654e01e16259847d097f8a7f7 Author: Adrian Hunter Date: Fri Mar 6 09:24:38 2026 +0200 i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors The MIPI I3C HCI driver currently returns -ETIME for various timeout conditions, while other I3C master drivers consistently use -ETIMEDOUT for the same class of errors. Align the HCI driver with the rest of the subsystem by replacing all uses of -ETIME with -ETIMEDOUT. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260306072451.11131-2-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 35b16a7a2c4fc458304447128b86514ce9f70f3c Author: Chuck Lever Date: Tue Mar 10 13:59:51 2026 -0400 perf synthetic-events: Fix stale build ID in module MMAP2 records perf_event__synthesize_modules() allocates a single union perf_event and reuses it across every kernel module callback. After the first module is processed, perf_record_mmap2__read_build_id() sets PERF_RECORD_MISC_MMAP_BUILD_ID in header.misc and writes that module's build ID into the event. On subsequent iterations the callback overwrites start, len, pid, and filename for the next module but never clears the stale build ID fields or the MMAP_BUILD_ID flag. When perf_record_mmap2__read_build_id() runs for the second module it sees the flag, reads the stale build ID into a dso_id, and __dso__improve_id() permanently poisons the DSO with the wrong build ID. Every module after the first therefore receives the first module's build ID in its MMAP2 record. On a system with the sunrpc and nfsd modules loaded, this causes perf script and perf report to show [unknown] for all module symbols. The latent bug has existed since commit d9f2ecbc5e47fca7 ("perf dso: Move build_id to dso_id") introduced the PERF_RECORD_MISC_MMAP_BUILD_ID check in perf_record_mmap2__read_build_id(). Commit 53b00ff358dc75b1 ("perf record: Make --buildid-mmap the default") then exposed it to all users by making the MMAP2-with-build-ID path the default. Both commits were merged in the same series. Clear the MMAP_BUILD_ID flag and zero the build_id union before each call to perf_record_mmap2__read_build_id() so that every module starts with a clean slate. Fixes: d9f2ecbc5e47fca7 ("perf dso: Move build_id to dso_id") Reviewed-by: Ian Rogers Signed-off-by: Chuck Lever Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 6f02c6b196036dbb6defb4647d8707d29b7fe95b Author: Tom Ryan Date: Mon Mar 9 22:20:02 2026 -0700 io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops When IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY, the boundary check for 128-byte SQE operations in io_init_req() validated the logical SQ head position rather than the physical SQE index. The existing check: !(ctx->cached_sq_head & (ctx->sq_entries - 1)) ensures the logical position isn't at the end of the ring, which is correct for NO_SQARRAY rings where physical == logical. However, when sq_array is present, an unprivileged user can remap any logical position to an arbitrary physical index via sq_array. Setting sq_array[N] = sq_entries - 1 places a 128-byte operation at the last physical SQE slot, causing the 128-byte memcpy in io_uring_cmd_sqe_copy() to read 64 bytes past the end of the SQE array. Replace the cached_sq_head alignment check with a direct validation of the physical SQE index, which correctly handles both sq_array and NO_SQARRAY cases. Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED") Signed-off-by: Tom Ryan Link: https://patch.msgid.link/20260310052003.72871-1-ryan36005@gmail.com Signed-off-by: Jens Axboe commit 177c69432161f6e4bab07ccacf8a1748a6898a6b Author: Jens Axboe Date: Mon Mar 9 14:35:49 2026 -0600 io_uring/eventfd: use ctx->rings_rcu for flags checking Similarly to what commit e78f7b70e837 did for local task work additions, use ->rings_rcu under RCU rather than dereference ->rings directly. See that commit for more details. Cc: stable@vger.kernel.org Fixes: 79cfe9e59c2a ("io_uring/register: add IORING_REGISTER_RESIZE_RINGS") Signed-off-by: Jens Axboe commit 96189080265e6bb5dde3a4afbaf947af493e3f82 Author: Jens Axboe Date: Mon Mar 9 14:21:37 2026 -0600 io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being freed. Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is protected by RCU. The task work flags manipulation is inside RCU already, and if the resize ring freeing is done post an RCU synchronize, then there's no need to add locking to the fast path of task work additions. Note: this is only done for DEFER_TASKRUN, as that's the only setup mode that supports ring resizing. If this ever changes, then they too need to use the io_ctx_mark_taskrun() helper. Link: https://lore.kernel.org/io-uring/20260309062759.482210-1-naup96721@gmail.com/ Cc: stable@vger.kernel.org Fixes: 79cfe9e59c2a ("io_uring/register: add IORING_REGISTER_RESIZE_RINGS") Reported-by: Hao-Yu Yang Suggested-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 30c64fb9839949f085c8eb55b979cbd8a4c51f00 Author: Chen Ni Date: Tue Mar 10 12:43:27 2026 +0800 ASoC: amd: acp-mach-common: Add missing error check for clock acquisition The acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not check the return values of clk_get(). This could lead to a kernel crash when the invalid pointers are later dereferenced by clock core functions. Fix this by: 1. Changing clk_get() to the device-managed devm_clk_get(). 2. Adding IS_ERR() checks immediately after each clock acquisition. Fixes: 8b7256266848 ("ASoC: amd: acp: Add support for RT5682-VS codec") Fixes: d4c750f2c7d4 ("ASoC: amd: acp: Add generic machine driver support for ACP cards") Signed-off-by: Chen Ni Link: https://patch.msgid.link/20260310044327.2582018-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit f879365c5bb210ed0d0b0aae1a0202d0c0b4b9d0 Author: CL Wang Date: Tue Mar 3 10:47:37 2026 +0800 spi: atcspi200: Handle invalid buswidth and fix compiler warning The kernel test robot reported a compile-time error regarding the FIELD_PREP() value being too large for the TRANS_DUAL_QUAD field: error: FIELD_PREP: value too large for the field note: in expansion of macro 'TRANS_DUAL_QUAD' tc |= TRANS_DUAL_QUAD(ffs(op->data.buswidth) - 1); This occurs because TRANS_DUAL_QUAD is defined as a 2-bit field, and GCC's static analysis cannot deduce that `ffs(op->data.buswidth) - 1` will strictly fall within the 0~3 range. Although the SPI framework guarantees that `op->data.buswidth` is valid at runtime (e.g., 1, 2, 4, 8), an explicit bounds check is necessary to satisfy the compiler. To resolve the build warning, introduce a safe fallback mechanism. If an unexpected buswidth is encountered, the driver will trigger a WARN_ON_ONCE to leave a trace and fall back to width_code = 0 (standard 1-bit SPI mode). This approach guarantees predictable hardware behavior. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602140738.P7ZozxzI-lkp@intel.com/ Suggested-by: Pei Xiao Signed-off-by: CL Wang Link: https://patch.msgid.link/20260303024737.1791196-1-cl634@andestech.com Signed-off-by: Mark Brown commit dca01b0a264642929732c4db4a07e7b213304c15 Author: Paolo Bonzini Date: Wed Mar 11 19:16:52 2026 +0100 Documentation: kvm: fix formatting of the quirks table A recently added quirk does not fit in the left column of the table, so it all has to be reformatted and realigned. Signed-off-by: Paolo Bonzini commit 3646ff28780b4c52c5b5081443199e7a430110e5 Author: Mario Limonciello Date: Tue Mar 10 11:58:22 2026 -0500 drm/amd: Set num IP blocks to 0 if discovery fails If discovery has failed for any reason (such as no support for a block) then there is no need to unwind all the IP blocks in fini. In this condition there can actually be failures during the unwind too. Reset num_ip_blocks to zero during failure path and skip the unnecessary cleanup path. Suggested-by: Lijo Lazar Reviewed-by: Lijo Lazar Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit fae5984296b981c8cc3acca35b701c1f332a6cd8) Cc: stable@vger.kernel.org commit 2ce75a0b7e1bfddbcb9bc8aeb2e5e7fa99971acf Author: Philip Yang Date: Tue Dec 9 15:13:23 2025 -0500 drm/amdkfd: Unreserve bo if queue update failed Error handling path should unreserve bo then return failed. Fixes: 305cd109b761 ("drm/amdkfd: Validate user queue update") Signed-off-by: Philip Yang Reviewed-by: Alex Sierra Signed-off-by: Alex Deucher (cherry picked from commit c24afed7de9ecce341825d8ab55a43a254348b33) commit becbab4a5a02156000f3aaff8bb70e8fd3e0d4cf Author: Ivan Lipski Date: Wed Feb 25 21:48:36 2026 -0500 drm/amd/display: Check for S0i3 to be done before DCCG init on DCN21 [WHY] On DCN21, dccg2_init() is called in dcn10_init_hw() before bios_golden_init(). During S0i3 resume, BIOS sets MICROSECOND_TIME_BASE_DIV to 0x00120464 as a marker. dccg2_init() overwrites this to 0x00120264, causing dcn21_s0i3_golden_init_wa() to misdetect the state and skip golden init. Eventually during the resume sequence, a flip timeout occurs. [HOW] Skip DCCG on dccg2_is_s0i3_golden_init_wa_done() on DCN21. Fixes: 4c595e75110e ("drm/amd/display: Migrate DCCG registers access from hwseq to dccg component.") Reviewed-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit c61eda434336cf2c033aa35efdc9a08b31d2fdfa) commit 33efc6346e8cf75219673fe1ca1916ab40643728 Author: Ivan Lipski Date: Tue Feb 24 16:28:00 2026 -0500 drm/amd/display: Add missing DCCG register entries for DCN20-DCN316 Commit 4c595e75110e ("drm/amd/display: Migrate DCCG registers access from hwseq to dccg component.") moved register writes from hwseq to dccg2_*() functions but did not add the registers to the DCCG register list macros. The struct fields default to 0, so REG_WRITE() targets MMIO offset 0, causing a GPU hang on resume (seen on DCN21/DCN30 during IGT kms_cursor_crc@cursor-suspend). Add - MICROSECOND_TIME_BASE_DIV - MILLISECOND_TIME_BASE_DIV - DCCG_GATE_DISABLE_CNTL - DCCG_GATE_DISABLE_CNTL2 - DC_MEM_GLOBAL_PWR_REQ_CNTL to macros in dcn20_dccg.h, dcn301_dccg.h, dcn31_dccg.h, and dcn314_dccg.h. Fixes: 4c595e75110e ("drm/amd/display: Migrate DCCG registers access from hwseq to dccg component.") Reported-by: Rafael Passos Reviewed-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit e6e2b956fc814de766d3480be7018297c41d3ce0) commit 6b1ca262a943a3307ee905faac0f4ff61ec3d656 Author: Paolo Bonzini Date: Tue Mar 10 20:33:39 2026 +0100 KVM: x86: clarify leave_smm() return value The return value of vmx_leave_smm() is unrelated from that of nested_vmx_enter_non_root_mode(). Check explicitly for success (which happens to be 0) and return 1 just like everywhere else in vmx_leave_smm(). Likewise, in svm_leave_smm() return 0/1 instead of the 0/1/-errno returned by tenter_svm_guest_mode(). Signed-off-by: Paolo Bonzini commit 3e745694b032b405ff1ced74a8b3b95cdd00a385 Author: Paolo Bonzini Date: Mon Mar 9 13:44:40 2026 +0100 selftests: kvm: add a test that VMX validates controls on RSM Add a test checking that invalid eVMCS contents are validated after an RSM instruction is emulated. The failure mode is simply that the RSM succeeds, because KVM virtualizes NMIs anyway while running L2; the two pin-based execution controls used by the test are entirely handled by KVM and not by the processor. Signed-off-by: Paolo Bonzini commit c52b534f26574ddf2f67cf07992ae2c25e8932c8 Author: Paolo Bonzini Date: Mon Mar 9 13:43:57 2026 +0100 selftests: kvm: extract common functionality out of smm_test.c Signed-off-by: Paolo Bonzini commit be5fa8737d42c5ba16d2ea72c23681f8abbb07e8 Author: Paolo Bonzini Date: Mon Mar 9 12:40:52 2026 +0100 KVM: SVM: check validity of VMCB controls when returning from SMM The VMCB12 is stored in guest memory and can be mangled while in SMM; it is then reloaded by svm_leave_smm(), but it is not checked again for validity. Move the cached vmcb12 control and save consistency checks out of svm_set_nested_state() and into a helper, and reuse it in svm_leave_smm(). Signed-off-by: Paolo Bonzini commit 5a30e8aea079b3e4e79d6ce7a878f5f42efe9d0b Author: Paolo Bonzini Date: Mon Mar 9 12:40:40 2026 +0100 KVM: VMX: check validity of VMCS controls when returning from SMM The VMCS12 is not available while in SMM. However, it can be overwritten if userspace manages to trigger copy_enlightened_to_vmcs12() - for example via KVM_GET_NESTED_STATE. Because of this, the VMCS12 has to be checked for validity before it is used to generate the VMCS02. Move the check code out of vmx_set_nested_state() (the other "not a VMLAUNCH/VMRESUME" path that emulates a nested vmentry) and reuse it in vmx_leave_smm(). Signed-off-by: Paolo Bonzini commit 87d0f901a9bd8ae6be57249c737f20ac0cace93d Author: Sean Christopherson Date: Tue Feb 3 11:07:10 2026 -0800 KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated Explicitly set/clear CR8 write interception when AVIC is (de)activated to fix a bug where KVM leaves the interception enabled after AVIC is activated. E.g. if KVM emulates INIT=>WFS while AVIC is deactivated, CR8 will remain intercepted in perpetuity. On its own, the dangling CR8 intercept is "just" a performance issue, but combined with the TPR sync bug fixed by commit d02e48830e3f ("KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active"), the danging intercept is fatal to Windows guests as the TPR seen by hardware gets wildly out of sync with reality. Note, VMX isn't affected by the bug as TPR_THRESHOLD is explicitly ignored when Virtual Interrupt Delivery is enabled, i.e. when APICv is active in KVM's world. I.e. there's no need to trigger update_cr8_intercept(), this is firmly an SVM implementation flaw/detail. WARN if KVM gets a CR8 write #VMEXIT while AVIC is active, as KVM should never enter the guest with AVIC enabled and CR8 writes intercepted. Fixes: 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC") Cc: stable@vger.kernel.org Cc: Jim Mattson Cc: Naveen N Rao (AMD) Cc: Maciej S. Szmigiero Reviewed-by: Naveen N Rao (AMD) Reviewed-by: Jim Mattson Link: https://patch.msgid.link/20260203190711.458413-3-seanjc@google.com Signed-off-by: Sean Christopherson [Squash fix to avic_deactivate_vmcb. - Paolo] Signed-off-by: Paolo Bonzini commit 3989a6d036c8ec82c0de3614bed23a1dacd45de5 Author: Sean Christopherson Date: Tue Feb 3 11:07:09 2026 -0800 KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC Initialize all per-vCPU AVIC control fields in the VMCB if AVIC is enabled in KVM and the VM has an in-kernel local APIC, i.e. if it's _possible_ the vCPU could activate AVIC at any point in its lifecycle. Configuring the VMCB if and only if AVIC is active "works" purely because of optimizations in kvm_create_lapic() to speculatively set apicv_active if AVIC is enabled *and* to defer updates until the first KVM_RUN. In quotes because KVM likely won't do the right thing if kvm_apicv_activated() is false, i.e. if a vCPU is created while APICv is inhibited at the VM level for whatever reason. E.g. if the inhibit is *removed* before KVM_REQ_APICV_UPDATE is handled in KVM_RUN, then __kvm_vcpu_update_apicv() will elide calls to vendor code due to seeing "apicv_active == activate". Cleaning up the initialization code will also allow fixing a bug where KVM incorrectly leaves CR8 interception enabled when AVIC is activated without creating a mess with respect to whether AVIC is activated or not. Cc: stable@vger.kernel.org Fixes: 67034bb9dd5e ("KVM: SVM: Add irqchip_split() checks before enabling AVIC") Fixes: 6c3e4422dd20 ("svm: Add support for dynamic APICv") Reviewed-by: Naveen N Rao (AMD) Reviewed-by: Jim Mattson Link: https://patch.msgid.link/20260203190711.458413-2-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit e2ffe85b6d2bb7780174b87aa4468a39be17eb81 Author: Jim Mattson Date: Thu Feb 5 15:15:26 2026 -0800 KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM Add KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM to allow L1 to set FREEZE_IN_SMM in vmcs12's GUEST_IA32_DEBUGCTL field, as permitted prior to commit 6b1dd26544d0 ("KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest"). Enable the quirk by default for backwards compatibility (like all quirks); userspace can disable it via KVM_CAP_DISABLE_QUIRKS2 for consistency with the constraints on WRMSR(IA32_DEBUGCTL). Note that the quirk only bypasses the consistency check. The vmcs02 bit is still owned by the host, and PMCs are not frozen during virtualized SMM. In particular, if a host administrator decides that PMCs should not be frozen during physical SMM, then L1 has no say in the matter. Fixes: 095686e6fcb4 ("KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter") Cc: stable@vger.kernel.org Signed-off-by: Jim Mattson Link: https://patch.msgid.link/20260205231537.1278753-1-jmattson@google.com [sean: tag for stable@, clean-up and fix goofs in the comment and docs] Signed-off-by: Sean Christopherson [Rename quirk. - Paolo] Signed-off-by: Paolo Bonzini commit b54e4707a64be93a8ab3348e32e89817229b5eaa Author: Li RongQing Date: Wed Feb 4 04:12:06 2026 -0500 KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() The mask_notifier_list is protected by kvm->irq_srcu, but the traversal in kvm_fire_mask_notifiers() incorrectly uses hlist_for_each_entry_rcu(). This leads to lockdep warnings because the standard RCU iterator expects to be under rcu_read_lock(), not SRCU. Replace the RCU variant with hlist_for_each_entry_srcu() and provide the proper srcu_read_lock_held() annotation to ensure correct synchronization and silence lockdep. Signed-off-by: Li RongQing Link: https://patch.msgid.link/20260204091206.2617-1-lirongqing@baidu.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit f78e627a01bd4ec0219566d2c9c40f3c3614f875 Author: Namhyung Kim Date: Fri Feb 20 14:02:16 2026 -0800 KVM: VMX: Fix a wrong MSR update in add_atomic_switch_msr() The previous change had a bug to update a guest MSR with a host value. Fixes: c3d6a7210a4de9096 ("KVM: VMX: Dedup code for adding MSR to VMCS's auto list") Signed-off-by: Namhyung Kim Reviewed-by: Dapeng Mi Link: https://patch.msgid.link/20260220220216.389475-1-namhyung@kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit a5264387c2ee42fca92ac792199008fc60ee82f1 Author: Manuel Andreas Date: Thu Feb 19 21:05:49 2026 +0100 KVM: x86: hyper-v: Validate all GVAs during PV TLB flush In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX allow a guest to request invalidation of portions of a virtual TLB. For this, the hypercall parameter includes a list of GVAs that are supposed to be invalidated. Currently, only the base GVA is checked to be canonical. In reality, this check needs to be performed for the entire range of GVAs, as checking only the base GVA enables guests running on Intel hardware to trigger a WARN_ONCE in the host (see Fixes commit below). Move the check for non-canonical addresses to be performed for every GVA of the supplied range to avoid the splat, and to be more in line with the Hyper-V specification, since, although unlikely, a range starting with an invalid GVA may still contain GVAs that are valid. Fixes: fa787ac07b3c ("KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush") Signed-off-by: Manuel Andreas Reviewed-by: Vitaly Kuznetsov Link: https://patch.msgid.link/00a7a31b-573b-4d92-91f8-7d7e2f88ea48@tum.de [sean: massage changelog] Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 4b3b8a8b0df1a5e7a1af04ff512df2c80db35dc8 Author: Carlos López Date: Mon Feb 9 16:31:09 2026 +0100 KVM: x86: synthesize CPUID bits only if CPU capability is set KVM incorrectly synthesizes CPUID bits for KVM-only leaves, as the following branch in kvm_cpu_cap_init() is never taken: if (leaf < NCAPINTS) kvm_cpu_caps[leaf] &= kernel_cpu_caps[leaf]; This means that bits set via SYNTHESIZED_F() for KVM-only leaves are unconditionally set. This for example can cause issues for SEV-SNP guests running on Family 19h CPUs, as TSA_SQ_NO and TSA_L1_NO are always enabled by KVM in 80000021[ECX]. When userspace issues a SNP_LAUNCH_UPDATE command to update the CPUID page for the guest, SNP firmware will explicitly reject the command if the page sets sets these bits on vulnerable CPUs. To fix this, check in SYNTHESIZED_F() that the corresponding X86 capability is set before adding it to to kvm_cpu_cap_features. Fixes: 31272abd5974 ("KVM: SVM: Advertise TSA CPUID bits to guests") Link: https://lore.kernel.org/all/20260208164233.30405-1-clopez@suse.de/ Signed-off-by: Carlos López Reviewed-by: Nikolay Borisov Link: https://patch.msgid.link/20260209153108.70667-2-clopez@suse.de Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit fe2a08eca5caa77398bfa321bd321d087b0b44b0 Author: Sean Christopherson Date: Tue Mar 3 11:03:39 2026 -0800 KVM: PPC: e500: Rip out "struct tlbe_ref" Complete the ~13 year journey started by commit 47bf379742bf ("kvm/ppc/e500: eliminate tlb_refs"), and actually remove "struct tlbe_ref". No functional change intended (verified disassembly of e500_mmu.o and e500_mmu_host.o is identical before and after). Link: https://patch.msgid.link/20260303190339.974325-3-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 4c0134639694fcdc4ab041d7c53d6188a3e18040 Author: Sean Christopherson Date: Tue Mar 3 11:03:38 2026 -0800 KVM: PPC: e500: Fix build error due to using kmalloc_obj() with wrong type Fix a build error in kvmppc_e500_tlb_init() that was introduced by the conversion to use kzalloc_objs(), as KVM confusingly uses the size of the structure that is one and only field in tlbe_priv: arch/powerpc/kvm/e500_mmu.c:923:33: error: assignment to 'struct tlbe_priv *' from incompatible pointer type 'struct tlbe_ref *' [-Wincompatible-pointer-types] 923 | vcpu_e500->gtlb_priv[0] = kzalloc_objs(struct tlbe_ref, | ^ KVM has been flawed since commit 0164c0f0c404 ("KVM: PPC: e500: clear up confusion between host and guest entries"), but the issue went unnoticed until kmalloc_obj() came along and enforced types, as "struct tlbe_priv" was just a wrapper of "struct tlbe_ref" (why on earth the two ever existed separately...). Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Cc: Kees Cook Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260303190339.974325-2-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit cf534a09fb621b0aa875613e3cd88aee336e16d7 Author: Kai Huang Date: Tue Mar 3 09:51:58 2026 +1300 KVM: selftests: Increase 'maxnode' for guest_memfd tests Increase 'maxnode' when using 'get_mempolicy' syscall in guest_memfd mmap and NUMA policy tests to fix a failure on one Intel GNR platform. On a CXL-capable platform, the memory affinity of CXL memory regions may not be covered by the SRAT. Since each CXL memory region is enumerated via a CFMWS table, at early boot the kernel parses all CFMWS tables to detect all CXL memory regions and assigns a 'faked' NUMA node for each of them, starting from the highest NUMA node ID enumerated via the SRAT. This increases the 'nr_node_ids'. E.g., on the aforementioned Intel GNR platform which has 4 NUMA nodes and 18 CFMWS tables, it increases to 22. This results in the 'get_mempolicy' syscall failure on that platform, because currently 'maxnode' is hard-coded to 8 but the 'get_mempolicy' syscall requires the 'maxnode' to be not smaller than the 'nr_node_ids'. Increase the 'maxnode' to the number of bits of 'nodemask', which is 'unsigned long', to fix this. This may not cover all systems. Perhaps a better way is to always set the 'nodemask' and 'maxnode' based on the actual maximum NUMA node ID on the system, but for now just do the simple way. Reported-by: Yi Lai Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221014 Closes: https://lore.kernel.org/all/bug-221014-28872@https.bugzilla.kernel.org%2F Signed-off-by: Kai Huang Reviewed-by: Yuan Yao Link: https://patch.msgid.link/20260302205158.178058-1-kai.huang@intel.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 6e827fa2c5783758dcab9cf8346efc8af8d48576 Merge: 94fe3e6515ddca a79f7b4aeb8e75 Author: Paolo Bonzini Date: Wed Mar 11 18:41:09 2026 +0100 Merge tag 'kvmarm-fixes-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.0, take #3 - Correctly handle deeactivation of out-of-LRs interrupts by starting the EOIcount deactivation walk *after* the last irq that made it into an LR. This avoids deactivating irqs that are in the LRs and that the vcpu hasn't deactivated yet. - Avoid calling into the stubs to probe for ICH_VTR_EL2.TDS when pKVM is already enabled -- not only thhis isn't possible (pKVM will reject the call), but it is also useless: this can only happen for a CPU that has already booted once, and the capability will not change. commit 94fe3e6515ddca2fd33ca1ec53d3635e54fbe456 Merge: 40c2ffcac080dc f8211e95dfda70 Author: Paolo Bonzini Date: Wed Mar 11 18:01:55 2026 +0100 Merge tag 'kvm-x86-generic-7.0-rc3' of https://github.com/kvm-x86/linux into HEAD KVM generic changes for 7.0 - Remove a subtle pseudo-overlay of kvm_stats_desc, which, aside from being unnecessary and confusing, triggered compiler warnings due to -Wflex-array-member-not-at-end. - Document that vcpu->mutex is take outside of kvm->slots_lock and kvm->slots_arch_lock, which is intentional and desirable despite being rather unintuitive. commit 40c2ffcac080dc426d1fddf9e8f2562f918ed85a Merge: de353e3fccd938 c61ec3e8cc5d46 Author: Paolo Bonzini Date: Wed Mar 11 18:01:03 2026 +0100 Merge tag 'kvm-riscv-fixes-7.0-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 7.0, take #1 - Prevent speculative out-of-bounds access using array_index_nospec() in APLIC interrupt handling, ONE_REG regiser access, AIA CSR access, float register access, and PMU counter access - Fix potential use-after-free issues in kvm_riscv_gstage_get_leaf(), kvm_riscv_aia_aplic_has_attr(), and kvm_riscv_aia_imsic_has_attr() - Fix potential null pointer dereference in kvm_riscv_vcpu_aia_rmw_topei() - Fix off-by-one array access in SBI PMU - Skip THP support check during dirty logging - Fix error code returned for Smstateen and Ssaia ONE_REG interface - Check host Ssaia extension when creating AIA irqchip commit de353e3fccd938242d66338d64d9cc8cfa40eb9f Merge: 11439c4635edd6 3599c714c08c32 Author: Paolo Bonzini Date: Wed Mar 11 18:00:54 2026 +0100 Merge tag 'kvmarm-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.0, take #2 - Fix a couple of low-severity bugs in our S2 fault handling path, affecting the recently introduced LS64 handling and the even more esoteric handling of hwpoison in a nested context - Address yet another syzkaller finding in the vgic initialisation, were we would end-up destroying an uninitialised vgic, with nasty consequences - Address an annoying case of pKVM failing to boot when some of the memblock regions that the host is faulting in are not page-aligned - Inject some sanity in the NV stage-2 walker by checking the limits against the advertised PA size, and correctly report the resulting faults - Drop an unnecessary ISB when emulating an EL2 S1 address translation commit 464b1c115852fe025635ae2065e00caced184d92 Author: Qing Wang Date: Wed Mar 11 17:36:17 2026 +0800 slab: fix memory leak when refill_sheaf() fails When refill_sheaf() partially fills one sheaf (e.g., fills 5 objects but need to fill 10), it will update sheaf->size and return -ENOMEM. However, the callers (alloc_full_sheaf() and __pcs_replace_empty_main()) directly call free_empty_sheaf() on failure, which only does kfree(sheaf), causing the partially allocated objects memory in sheaf->objects[] leaked. Fix this by calling sheaf_flush_unused() before free_empty_sheaf() to free objects of sheaf->objects[]. And also add a WARN_ON() in free_empty_sheaf() to catch any future cases where a non-empty sheaf is being freed. Fixes: ed30c4adfc2b ("slab: add optimized sheaf refill from partial list") Signed-off-by: Qing Wang Link: https://patch.msgid.link/20260311093617.4155965-1-wangqing7171@gmail.com Reviewed-by: Harry Yoo Reviewed-by: Hao Li Signed-off-by: Vlastimil Babka (SUSE) commit 3fde5281b805370a6c3bd2ef462ebff70a0ea2c6 Author: Ard Biesheuvel Date: Mon Mar 2 17:45:31 2026 +0100 x86/hyperv: Use __naked attribute to fix stackless C function hv_crash_c_entry() is a C function that is entered without a stack, and this is only allowed for functions that have the __naked attribute, which informs the compiler that it must not emit the usual prologue and epilogue or emit any other kind of instrumentation that relies on a stack frame. So split up the function, and set the __naked attribute on the initial part that sets up the stack, GDT, IDT and other pieces that are needed for ordinary C execution. Given that function calls are not permitted either, use the existing long return coded in an asm() block to call the second part of the function, which is an ordinary function that is permitted to call other functions as usual. Reviewed-by: Andrew Cooper # asm parts, not hv parts Reviewed-by: Mukesh Rathor Acked-by: Uros Bizjak Cc: Wei Liu Cc: linux-hyperv@vger.kernel.org Fixes: 94212d34618c ("x86/hyperv: Implement hypervisor RAM collection into vmcore") Signed-off-by: Ard Biesheuvel Signed-off-by: Wei Liu commit edd20cb693d9cb5e3d6fcecd858093dab4e2b0aa Author: Wei Liu Date: Wed Mar 11 16:51:00 2026 +0000 Revert "mshv: expose the scrub partition hypercall" This reverts commit 36d6cbb62133fc6eea28f380409e0fb190f3dfbe. Calling this as a passthrough hypercall leaves the VM in an inconsistent state. Revert before it is released. Signed-off-by: Wei Liu commit 80234b5ab240f52fa45d201e899e207b9265ef91 Merge: 2b8e3fac9bac1f 97e4567d399412 Author: Linus Torvalds Date: Wed Mar 11 09:30:20 2026 -0700 Merge tag 'rproc-v7.0-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc fixes from Bjorn Andersson: - Correct the early return from the i.MX remoteproc prepare operation, which prevented the platform-specific prepare function from being reached - Ensure that the Mediatek SCP clock is released during system suspend after the recent refactoring to avoid issues with the clock framework's prepare lock. - Correct the type of the subsys_name_len field in the sysmon event QMI message, as the recent introduction of big endian support in the QMI encoder highlighted the type mismatch and resulted in a failure to encode the message - Roll back the devm_ioremap_resource_wc() to a devm_ioremap_wc() in the Qualcomm WCNSS remoteproc driver, after reports that requesting this resource fails on some platforms * tag 'rproc-v7.0-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: remoteproc: imx_rproc: Fix unreachable platform prepare_ops remoteproc: mediatek: Unprepare SCP clock during system suspend remoteproc: sysmon: Correct subsys_name_len type in QMI request remoteproc: qcom_wcnss: Fix reserved region mapping failure commit 2b8e3fac9bac1f2bb67571a00bb58851826fe705 Merge: b29fb8829bff24 35e4f2a17eb402 Author: Linus Torvalds Date: Wed Mar 11 08:35:31 2026 -0700 Merge tag 'powerpc-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Correct MSI allocation tracking - Always use 64 bits PTE for powerpc/e500 - Fix inline assembly for clang build on PPC32 - Fixes for clang build issues in powerpc64/ftrace - Fixes for powerpc64/bpf JIT and tailcall support - Cleanup MPC83XX devicetrees - Fix keymile vendor prefix - Fix to use big-endian types for crash variables Thanks to Abhishek Dubey, Christophe Leroy (CS GROUP), Hari Bathini, Heiko Schocher, J. Neuschäfer, Mahesh Salgaonkar, Nam Cao, Nilay Shroff, Rob Herring (Arm), Saket Kumar Bhaskar, Sourabh Jain, Stan Johnson, and Venkat Rao Bagalkote. * tag 'powerpc-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (23 commits) powerpc/pseries: Correct MSI allocation tracking powerpc: dts: mpc83xx: Add unit addresses to /memory powerpc: dts: mpc8315erdb: Add missing #cells properties to SPI bus powerpc: dts: mpc8315erdb: Rename LED nodes to comply with schema powerpc: dts: mpc8315erdb: Use IRQ_TYPE_* macros powerpc: dts: mpc8313erdb: Use IRQ_TYPE_* macros powerpc: 83xx: km83xx: Fix keymile vendor prefix dt-bindings: powerpc: Add Freescale/NXP MPC83xx SoCs powerpc64/bpf: fix kfunc call support powerpc64/bpf: fix handling of BPF stack in exception callback powerpc64/bpf: remove BPF redzone protection in trampoline stack powerpc64/bpf: use consistent tailcall offset in trampoline powerpc64/bpf: fix the address returned by bpf_get_func_ip powerpc64/bpf: do not increment tailcall count when prog is NULL powerpc64/ftrace: workaround clang recording GEP in __patchable_function_entries powerpc64/ftrace: fix OOL stub count with clang powerpc64: make clang cross-build friendly powerpc/crash: adjust the elfcorehdr size powerpc/kexec/core: use big-endian types for crash variables powerpc/prom_init: Fixup missing #size-cells on PowerMac media-bay nodes ... commit da9ba4dcc01e7cf52b7676f0ee9607b8358c2171 Author: Kamal Dasu Date: Thu Mar 5 15:21:57 2026 -0500 mtd: rawnand: brcmnand: skip DMA during panic write When oops_panic_write is set, the driver disables interrupts and switches to PIO polling mode but still falls through into the DMA path. DMA cannot be used reliably in panic context, so make the DMA path an else branch to ensure only PIO is used during panic writes. Fixes: c1ac2dc34b51 ("mtd: rawnand: brcmnand: When oops in progress use pio and interrupt polling") Signed-off-by: Kamal Dasu Reviewed-by: William Zhang Reviewed-by: Florian Fainelli Signed-off-by: Miquel Raynal commit bab2bc6e850a697a23b9e5f0e21bb8c187615e95 Author: Kamal Dasu Date: Thu Mar 5 14:49:06 2026 -0500 mtd: rawnand: serialize lock/unlock against other NAND operations nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmd_pending conflicts on the NAND controller. Add nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access. Fixes: 92270086b7e5 ("mtd: rawnand: Add support for manufacturer specific lock/unlock operation") Signed-off-by: Kamal Dasu Reviewed-by: William Zhang Signed-off-by: Miquel Raynal commit a9683730e8b1d632674f81844ed03ddfbe4821c0 Author: Casey Connolly Date: Fri Mar 6 18:47:07 2026 +0100 ASoC: detect empty DMI strings Some bootloaders like recent versions of U-Boot may install some DMI properties with empty values rather than not populate them. This manages to make its way through the validator and cleanup resulting in a rogue hyphen being appended to the card longname. Fixes: 4e01e5dbba96 ("ASoC: improve the DMI long card code in asoc-core") Signed-off-by: Casey Connolly Link: https://patch.msgid.link/20260306174707.283071-2-casey.connolly@linaro.org Signed-off-by: Mark Brown commit 073b2db72426adee591a0f5a967009ea459ef688 Author: Miquel Raynal Date: Wed Feb 25 17:24:45 2026 +0100 dt-bindings: mtd: st,spear600-smi: Fix example Example is wrong, the reg property of the flash is always matching the node name. Fixes: 68cd8ef48452 ("dt-bindings: mtd: st,spear600-smi: convert to DT schema") Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit c21cac8cdcdcb7940c0aab85246ffbb649b73937 Author: Miquel Raynal Date: Wed Feb 25 17:24:44 2026 +0100 dt-bindings: mtd: st,spear600-smi: #address/size-cells is mandatory These properties must be set because they overwrite the default values, especially #size-cells which is 0 for most controllers and is 'const: 1' here. Fixes: 68cd8ef48452 ("dt-bindings: mtd: st,spear600-smi: convert to DT schema") Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit db9a26765010c55712d8cff32ea9d99732407c55 Author: Miquel Raynal Date: Wed Feb 25 17:24:43 2026 +0100 dt-bindings: mtd: st,spear600-smi: Fix description The description mixes two nodes. There is the controller, and there is the flash. Describe the flash (which itself can be considered an mtd device, unlike the top level controller), and move the st,smi-fast-mode property inside, as this property is flash specific and should not live in the parent controller node. Fixes: 68cd8ef48452 ("dt-bindings: mtd: st,spear600-smi: convert to DT schema") Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 0073a17b466684413ac87cf8ff6c19560db44e7a Author: Danilo Krummrich Date: Mon Mar 9 23:53:24 2026 +0100 gpu: nova-core: gsp: fix UB in DmaGspMem pointer accessors The DmaGspMem pointer accessor methods (gsp_write_ptr, gsp_read_ptr, cpu_read_ptr, cpu_write_ptr, advance_cpu_read_ptr, advance_cpu_write_ptr) dereference a raw pointer to DMA memory, creating an intermediate reference before calling volatile read/write methods. This is undefined behavior since DMA memory can be concurrently modified by the device. Fix this by moving the implementations into a gsp_mem module in fw.rs that uses the dma_read!() / dma_write!() macros, making the original methods on DmaGspMem thin forwarding wrappers. An alternative approach would have been to wrap the shared memory in Opaque, but that would have required even more unsafe code. Since the gsp_mem module lives in fw.rs (to access firmware-specific binding field names), GspMem, Msgq and their relevant fields are temporarily widened to pub(super). This will be reverted once IoView projections are available. Cc: Gary Guo Closes: https://lore.kernel.org/nouveau/DGUT14ILG35P.1UMNRKU93JUM1@kernel.org/ Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260309225408.27714-1-dakr@kernel.org [ Use pub(super) where possible; replace bitwise-and with modulo operator analogous to [1]. - Danilo ] Link: https://lore.kernel.org/all/20260129-nova-core-cmdq1-v3-1-2ede85493a27@nvidia.com/ [1] Signed-off-by: Danilo Krummrich commit 163cc462dea7d5b75be4db49ca78a2b99c55375e Author: Johan Hovold Date: Thu Mar 5 16:17:28 2026 +0100 gpib: lpvo_usb: fix unintended binding of FTDI 8U232AM devices The LPVO USB GPIB adapter apparently uses an FTDI 8U232AM with the default PID, but this device id is already handled by the ftdi_sio serial driver. Stop binding to the default PID to avoid breaking existing setups with FTDI 8U232AM. Anyone using this driver should blacklist the ftdi_sio driver and add the device id manually through sysfs (e.g. using udev rules). Fixes: fce79512a96a ("staging: gpib: Add LPVO DIY USB GPIB driver") Fixes: e6ab504633e4 ("staging: gpib: Destage gpib") Cc: Dave Penkler Cc: stable Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305151729.10501-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8345b1539faa49fcf9c9439c3cbd97dac6eca171 Author: Xu Yang Date: Mon Mar 9 15:43:13 2026 +0800 usb: roles: get usb role switch from parent only for usb-b-connector usb_role_switch_is_parent() was walking up to the parent node and checking for the "usb-role-switch" property regardless of the type of the passed fwnode. This could cause unrelated device nodes to be probed as potential role switch parent, leading to spurious matches and "-EPROBE_DEFER" being returned infinitely. Till now only Type-B connector node will have a parent node which may present "usb-role-switch" property and register the role switch device. For Type-C connector node, its parent node will always be a Type-C chip device which will never register the role switch device. However, it may still present a non-boolean "usb-role-switch = <&usb_controller>" property for historical compatibility. So restrict the helper to only operate on Type-B connector when attempting to get the role switch from parent node. Fixes: 6fadd72943b8 ("usb: roles: get usb-role-switch from parent") Cc: stable Signed-off-by: Xu Yang Tested-by: Arnaud Ferraris Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260309074313.2809867-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 6b275bfaa16be3fb1689fa6794e445ecd127a1b4 Author: Xu Yang Date: Mon Mar 9 15:43:12 2026 +0800 Revert "tcpm: allow looking for role_sw device in the main node" This reverts commit 1366cd228b0c67b60a2c0c26ef37fe9f7cfedb7f. The fwnode_usb_role_switch_get() returns NULL only if no connection is found, returns ERR_PTR(-EPROBE_DEFER) if connection is found but deferred probe is needed, or a valid pointer of usb_role_switch. When switching from a NULL check to IS_ERR_OR_NULL(), usb_role_switch_get() returns NULL and overwrites the ERR_PTR(-EPROBE_DEFER) returned by fwnode_usb_role_switch_get(). This causes the deferred probe indication to be lost, preventing the USB role switch from ever being retrieved. Fixes: 1366cd228b0c ("tcpm: allow looking for role_sw device in the main node") Cc: stable Signed-off-by: Xu Yang Tested-by: Arnaud Ferraris Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260309074313.2809867-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit ec35c1969650e7cb6c8a91020e568ed46e3551b0 Author: Kuen-Han Tsai Date: Mon Mar 9 20:04:52 2026 +0800 usb: gadget: f_ncm: Fix net_device lifecycle with device_move The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to solve this by removing SET_NETDEV_DEV entirely [1] was reverted due to power management ordering concerns and a NO-CARRIER regression. A subsequent attempt to defer net_device allocation to bind [2] broke 1:1 mapping between function instance and network device, making it impossible for configfs to report the resolved interface name. This results in a regression where the DHCP server fails on pmOS. Use device_move to reparent the net_device between the gadget device and /sys/devices/virtual/ across bind/unbind cycles. This preserves the network interface across USB reconnection, allowing the DHCP server to retain their binding. Introduce gether_attach_gadget()/gether_detach_gadget() helpers and use __free(detach_gadget) macro to undo attachment on bind failure. The bind_count ensures device_move executes only on the first bind. [1] https://lore.kernel.org/lkml/f2a4f9847617a0929d62025748384092e5f35cce.camel@crapouillou.net/ [2] https://lore.kernel.org/linux-usb/795ea759-7eaf-4f78-81f4-01ffbf2d7961@ixit.cz/ Fixes: 40d133d7f542 ("usb: gadget: f_ncm: convert to new function interface with backward compatibility") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-7-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman commit 3131c1aff7cdffb96239f06f98e16188cbc2083f Author: Kuen-Han Tsai Date: Mon Mar 9 20:04:51 2026 +0800 Revert "usb: gadget: u_ether: add gether_opts for config caching" This reverts commit e065c6a7e46c2ee9c677fdbf50035323d2de1215. This commit is being reverted as part of a series-wide revert. By deferring the net_device allocation to the bind() phase, a single function instance will spawn multiple network devices if it is symlinked to multiple USB configurations. This causes regressions for userspace tools (like the postmarketOS DHCP daemon) that rely on reading the interface name (e.g., "usb0") from configfs. Currently, configfs returns the template "usb%d", causing the userspace network setup to fail. Crucially, because this patch breaks the 1:1 mapping between the function instance and the network device, this naming issue cannot simply be patched. Configfs only exposes a single 'ifname' attribute per instance, making it impossible to accurately report the actual interface name when multiple underlying network devices can exist for that single instance. All configurations tied to the same function instance are meant to share a single network device. Revert this change to restore the 1:1 mapping by allocating the network device at the instance level (alloc_inst). Reported-by: David Heidelberg Closes: https://lore.kernel.org/linux-usb/70b558ea-a12e-4170-9b8e-c951131249af@ixit.cz/ Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-6-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman commit 3549d0ae5f7e647ffd09d69f927a18ae7a520f6f Author: Kuen-Han Tsai Date: Mon Mar 9 20:04:50 2026 +0800 Revert "usb: gadget: u_ether: use header file" This reverts commit 7a7930c0f934fb0c46de6e7ca08e14e11df35dd6. This commit is being reverted as part of a series-wide revert. By deferring the net_device allocation to the bind() phase, a single function instance will spawn multiple network devices if it is symlinked to multiple USB configurations. This causes regressions for userspace tools (like the postmarketOS DHCP daemon) that rely on reading the interface name (e.g., "usb0") from configfs. Currently, configfs returns the template "usb%d", causing the userspace network setup to fail. Crucially, because this patch breaks the 1:1 mapping between the function instance and the network device, this naming issue cannot simply be patched. Configfs only exposes a single 'ifname' attribute per instance, making it impossible to accurately report the actual interface name when multiple underlying network devices can exist for that single instance. All configurations tied to the same function instance are meant to share a single network device. Revert this change to restore the 1:1 mapping by allocating the network device at the instance level (alloc_inst). Reported-by: David Heidelberg Closes: https://lore.kernel.org/linux-usb/70b558ea-a12e-4170-9b8e-c951131249af@ixit.cz/ Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-5-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman commit 46662d3a1ad40282ba9f753cccc6f909ec4468cc Author: Kuen-Han Tsai Date: Mon Mar 9 20:04:49 2026 +0800 Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device" This reverts commit 0c0981126b99288ed354d3d414c8a5fd42ac9e25. This commit is being reverted as part of a series-wide revert. By deferring the net_device allocation to the bind() phase, a single function instance will spawn multiple network devices if it is symlinked to multiple USB configurations. This causes regressions for userspace tools (like the postmarketOS DHCP daemon) that rely on reading the interface name (e.g., "usb0") from configfs. Currently, configfs returns the template "usb%d", causing the userspace network setup to fail. Crucially, because this patch breaks the 1:1 mapping between the function instance and the network device, this naming issue cannot simply be patched. Configfs only exposes a single 'ifname' attribute per instance, making it impossible to accurately report the actual interface name when multiple underlying network devices can exist for that single instance. All configurations tied to the same function instance are meant to share a single network device. Revert this change to restore the 1:1 mapping by allocating the network device at the instance level (alloc_inst). Reported-by: David Heidelberg Closes: https://lore.kernel.org/linux-usb/70b558ea-a12e-4170-9b8e-c951131249af@ixit.cz/ Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-4-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman commit 37893bc5de2460c543ec1aa8250c37a305234054 Author: Kuen-Han Tsai Date: Mon Mar 9 20:04:48 2026 +0800 Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind" This reverts commit 56a512a9b4107079f68701e7d55da8507eb963d9. This commit is being reverted as part of a series-wide revert. By deferring the net_device allocation to the bind() phase, a single function instance will spawn multiple network devices if it is symlinked to multiple USB configurations. This causes regressions for userspace tools (like the postmarketOS DHCP daemon) that rely on reading the interface name (e.g., "usb0") from configfs. Currently, configfs returns the template "usb%d", causing the userspace network setup to fail. Crucially, because this patch breaks the 1:1 mapping between the function instance and the network device, this naming issue cannot simply be patched. Configfs only exposes a single 'ifname' attribute per instance, making it impossible to accurately report the actual interface name when multiple underlying network devices can exist for that single instance. All configurations tied to the same function instance are meant to share a single network device. Revert this change to restore the 1:1 mapping by allocating the network device at the instance level (alloc_inst). Reported-by: David Heidelberg Closes: https://lore.kernel.org/linux-usb/70b558ea-a12e-4170-9b8e-c951131249af@ixit.cz/ Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-3-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman commit f2524c0e6ff0a5f72f1e1a32441c69d3b56430c4 Author: Kuen-Han Tsai Date: Mon Mar 9 20:04:47 2026 +0800 Revert "usb: legacy: ncm: Fix NPE in gncm_bind" This reverts commit fde0634ad9856b3943a2d1a8cc8de174a63ac840. This commit is being reverted as part of a series-wide revert. By deferring the net_device allocation to the bind() phase, a single function instance will spawn multiple network devices if it is symlinked to multiple USB configurations. This causes regressions for userspace tools (like the postmarketOS DHCP daemon) that rely on reading the interface name (e.g., "usb0") from configfs. Currently, configfs returns the template "usb%d", causing the userspace network setup to fail. Crucially, because this patch breaks the 1:1 mapping between the function instance and the network device, this naming issue cannot simply be patched. Configfs only exposes a single 'ifname' attribute per instance, making it impossible to accurately report the actual interface name when multiple underlying network devices can exist for that single instance. All configurations tied to the same function instance are meant to share a single network device. Revert this change to restore the 1:1 mapping by allocating the network device at the instance level (alloc_inst). Reported-by: David Heidelberg Closes: https://lore.kernel.org/linux-usb/70b558ea-a12e-4170-9b8e-c951131249af@ixit.cz/ Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-2-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman commit 11199720fac2debbe718aec11e026ab3330dc80d Author: Kuen-Han Tsai Date: Mon Mar 9 20:04:46 2026 +0800 Revert "usb: gadget: f_ncm: Fix atomic context locking issue" This reverts commit 0d6c8144ca4d93253de952a5ea0028c19ed7ab68. This commit is being reverted as part of a series-wide revert. By deferring the net_device allocation to the bind() phase, a single function instance will spawn multiple network devices if it is symlinked to multiple USB configurations. This causes regressions for userspace tools (like the postmarketOS DHCP daemon) that rely on reading the interface name (e.g., "usb0") from configfs. Currently, configfs returns the template "usb%d", causing the userspace network setup to fail. Crucially, because this patch breaks the 1:1 mapping between the function instance and the network device, this naming issue cannot simply be patched. Configfs only exposes a single 'ifname' attribute per instance, making it impossible to accurately report the actual interface name when multiple underlying network devices can exist for that single instance. All configurations tied to the same function instance are meant to share a single network device. Revert this change to restore the 1:1 mapping by allocating the network device at the instance level (alloc_inst). Reported-by: David Heidelberg Closes: https://lore.kernel.org/linux-usb/70b558ea-a12e-4170-9b8e-c951131249af@ixit.cz/ Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-1-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman commit e8557acfa079a54b59a21f447c82a31aec7717df Author: RD Babiera Date: Tue Mar 10 20:41:05 2026 +0000 usb: typec: altmode/displayport: set displayport signaling rate in configure message dp_altmode_configure sets the signaling rate to the current configuration's rate and then shifts the value to the Select Configuration bitfield. On the initial configuration, dp->data.conf is 0 to begin with, so the signaling rate field is never set, which leads to some DisplayPort Alt Mode partners sending NAK to the Configure message. Set the signaling rate to the capabilities supported by both the port and the port partner. If the cable supports DisplayPort Alt Mode, then include its capabilities as well. Fixes: a17fae8fc38e ("usb: typec: Add Displayport Alternate Mode 2.1 Support") Cc: stable Signed-off-by: RD Babiera Acked-by: Heikki Krogerus Link: https://patch.msgid.link/20260310204106.3939862-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman commit 17ab4d4078e22be7fd8fd6fc710c15c085a4cb1b Author: Heikki Krogerus Date: Mon Mar 9 14:02:04 2026 +0100 usb: dwc3: pci: add support for the Intel Nova Lake -H This patch adds the necessary PCI ID for Intel Nova Lake -H devices. Signed-off-by: Heikki Krogerus Cc: stable Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260309130204.208661-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 0326ff28d56b4fa202de36ffc8462a354f383a64 Author: Christoffer Sandberg Date: Fri Mar 6 18:28:14 2026 +0100 usb/core/quirks: Add Huawei ME906S-device to wakeup quirk Similar to other Huawei LTE modules using this quirk, this version with another vid/pid suffers from spurious wakeups. Setting the quirk fixes the issue for this device as well. Cc: stable Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260306172817.2098898-1-wse@tuxedocomputers.com Signed-off-by: Greg Kroah-Hartman commit 56135c0c60b07729401af9d329fa9c0eded845a6 Author: Junzhong Pan Date: Fri Mar 6 11:30:09 2026 +0800 usb: gadget: uvc: fix interval_duration calculation To correctly convert bInterval as interval_duration: interval_duration = 2^(bInterval-1) * frame_interval Current code uses a wrong left shift operand, computing 2^bInterval instead of 2^(bInterval-1). Fixes: 010dc57cb516 ("usb: gadget: uvc: fix interval_duration calculation") Cc: stable Signed-off-by: Junzhong Pan Reviewed-by: Xu Yang Link: https://patch.msgid.link/20260306-fix-uvc-interval-v1-1-9a2df6859859@linux.spacemit.com Signed-off-by: Greg Kroah-Hartman commit ae4ff9dead5efa2025eddfcdb29411432bf40a7c Author: Mathias Nyman Date: Thu Mar 5 00:36:39 2026 +0200 xhci: Fix NULL pointer dereference when reading portli debugfs files Michal reported and debgged a NULL pointer dereference bug in the recently added portli debugfs files Oops is caused when there are more port registers counted in xhci->max_ports than ports reported by Supported Protocol capabilities. This is possible if max_ports is more than maximum port number, or if there are gaps between ports of different speeds the 'Supported Protocol' capabilities. In such cases port->rhub will be NULL so we can't reach xhci behind it. Add an explicit NULL check for this case, and print portli in hex without dereferencing port->rhub. Reported-by: Michal Pecio Closes: https://lore.kernel.org/linux-usb/20260304103856.48b785fd.michal.pecio@gmail.com Fixes: 384c57ec7205 ("usb: xhci: Add debugfs support for xHCI Port Link Info (PORTLI) register.") Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260304223639.3882398-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit d6d5febd12452b7fd951fdd15c3ec262f01901a4 Author: Dayu Jiang Date: Thu Mar 5 00:36:38 2026 +0200 usb: xhci: Prevent interrupt storm on host controller error (HCE) The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults. When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt(). Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors. This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC. CC: stable@vger.kernel.org Signed-off-by: Dayu Jiang Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260304223639.3882398-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit c1c8550e70401159184130a1afc6261db01fc0ce Author: Zilin Guan Date: Thu Mar 5 00:36:37 2026 +0200 usb: xhci: Fix memory leak in xhci_disable_slot() xhci_alloc_command() allocates a command structure and, when the second argument is true, also allocates a completion structure. Currently, the error handling path in xhci_disable_slot() only frees the command structure using kfree(), causing the completion structure to leak. Use xhci_free_command() instead of kfree(). xhci_free_command() correctly frees both the command structure and the associated completion structure. Since the command structure is allocated with zero-initialization, command->in_ctx is NULL and will not be erroneously freed by xhci_free_command(). This bug was found using an experimental static analysis tool we are developing. The tool is based on the LLVM framework and is specifically designed to detect memory management issues. It is currently under active development and not yet publicly available, but we plan to open-source it after our research is published. The bug was originally detected on v6.13-rc1 using our static analysis tool, and we have verified that the issue persists in the latest mainline kernel. We performed build testing on x86_64 with allyesconfig using GCC=11.4.0. Since triggering these error paths in xhci_disable_slot() requires specific hardware conditions or abnormal state, we were unable to construct a test case to reliably trigger these specific error paths at runtime. Fixes: 7faac1953ed1 ("xhci: avoid race between disable slot command and host runtime suspend") CC: stable@vger.kernel.org Signed-off-by: Zilin Guan Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260304223639.3882398-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8df672bfe3ec2268c2636584202755898e547173 Author: Oliver Neukum Date: Wed Mar 4 14:01:12 2026 +0100 usb: class: cdc-wdm: fix reordering issue in read code path Quoting the bug report: Due to compiler optimization or CPU out-of-order execution, the desc->length update can be reordered before the memmove. If this happens, wdm_read() can see the new length and call copy_to_user() on uninitialized memory. This also violates LKMM data race rules [1]. Fix it by using WRITE_ONCE and memory barriers. Fixes: afba937e540c9 ("USB: CDC WDM driver") Cc: stable Signed-off-by: Oliver Neukum Closes: https://lore.kernel.org/linux-usb/CALbr=LbrUZn_cfp7CfR-7Z5wDTHF96qeuM=3fO2m-q4cDrnC4A@mail.gmail.com/ Reported-by: Gui-Dong Han Reviewed-by: Gui-Dong Han Link: https://patch.msgid.link/20260304130116.1721682-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 3cbc242b88c607f55da3d0d0d336b49bf1e20412 Author: Fan Wu Date: Tue Mar 3 07:33:44 2026 +0000 usb: renesas_usbhs: fix use-after-free in ISR during device removal In usbhs_remove(), the driver frees resources (including the pipe array) while the interrupt handler (usbhs_interrupt) is still registered. If an interrupt fires after usbhs_pipe_remove() but before the driver is fully unbound, the ISR may access freed memory, causing a use-after-free. Fix this by calling devm_free_irq() before freeing resources. This ensures the interrupt handler is both disabled and synchronized (waits for any running ISR to complete) before usbhs_pipe_remove() is called. Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code") Cc: stable Suggested-by: Alan Stern Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260303073344.34577-1-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman commit 14ae24cba291bddfdc296bbcbfd00cd09d0498ef Author: Marc Zyngier Date: Sun Mar 1 12:44:40 2026 +0000 usb: cdc-acm: Restore CAP_BRK functionnality to CH343 The CH343 USB/serial adapter is as buggy as it is popular (very). One of its quirks is that despite being capable of signalling a BREAK condition, it doesn't advertise it. This used to work nonetheless until 66aad7d8d3ec5 ("usb: cdc-acm: return correct error code on unsupported break") applied some reasonable restrictions, preventing breaks from being emitted on devices that do not advertise CAP_BRK. Add a quirk for this particular device, so that breaks can still be produced on some of my machines attached to my console server. Fixes: 66aad7d8d3ec5 ("usb: cdc-acm: return correct error code on unsupported break") Signed-off-by: Marc Zyngier Cc: stable Cc: Oliver Neukum Cc: Greg Kroah-Hartman Acked-by: Oliver Neukum Link: https://patch.msgid.link/20260301124440.1192752-1-maz@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8479891d1f04a8ce55366fe4ca361ccdb96f02e1 Author: Seungjin Bae Date: Sat Feb 28 05:43:25 2026 -0500 usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() The `check_command_size_in_blocks()` function calculates the data size in bytes by left shifting `common->data_size_from_cmnd` by the block size (`common->curlun->blkbits`). However, it does not validate whether this shift operation will cause an integer overflow. Initially, the block size is set up in `fsg_lun_open()` , and the `common->data_size_from_cmnd` is set up in `do_scsi_command()`. During initialization, there is no integer overflow check for the interaction between two variables. So if a malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data (`common->data_size_from_cmnd`), the left shift operation can wrap around. This results in a truncated data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds accesses. Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any overflows. Fixes: 144974e7f9e3 ("usb: gadget: mass_storage: support multi-luns with different logic block size") Signed-off-by: Seungjin Bae Reviewed-by: Alan Stern Link: https://patch.msgid.link/20260228104324.1696455-2-eeodqql09@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7f58b4148ef5d8ee0fb7d8113dcc38ff5374babc Author: John Keeping Date: Fri Feb 27 11:15:39 2026 +0000 usb: gadget: f_hid: fix SuperSpeed descriptors When adding dynamic configuration for bInterval, the value was removed from the static SuperSpeed endpoint descriptors but was not set from the configured value in hidg_bind(). Thus at SuperSpeed the interrupt endpoints have bInterval as zero which is not valid per the USB specification. Add the missing setting for SuperSpeed endpoints. Fixes: ea34925f5b2ee ("usb: gadget: hid: allow dynamic interval configuration via configfs") Cc: stable Signed-off-by: John Keeping Acked-by: Peter Korsgaard Link: https://patch.msgid.link/20260227111540.431521-1-jkeeping@inmusicbrands.com Signed-off-by: Greg Kroah-Hartman commit 9f6a983cfa22ac662c86e60816d3a357d4b551e9 Author: Jie Deng Date: Fri Feb 27 16:49:31 2026 +0800 usb: core: new quirk to handle devices with zero configurations Some USB devices incorrectly report bNumConfigurations as 0 in their device descriptor, which causes the USB core to reject them during enumeration. logs: usb 1-2: device descriptor read/64, error -71 usb 1-2: no configurations usb 1-2: can't read configurations, error -22 However, these devices actually work correctly when treated as having a single configuration. Add a new quirk USB_QUIRK_FORCE_ONE_CONFIG to handle such devices. When this quirk is set, assume the device has 1 configuration instead of failing with -EINVAL. This quirk is applied to the device with VID:PID 5131:2007 which exhibits this behavior. Signed-off-by: Jie Deng Link: https://patch.msgid.link/20260227084931.1527461-1-dengjie03@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit 45dba8011efac11a2f360383221b541f5ea53ce5 Author: Greg Kroah-Hartman Date: Mon Feb 23 13:19:43 2026 +0100 usb: misc: uss720: properly clean up reference in uss720_probe() If get_1284_register() fails, the usb device reference count is incorrect and needs to be properly dropped before returning. That will happen when the kref is dropped in the call to destroy_priv(), so jump to that error path instead of returning directly. Cc: stable Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026022342-smokiness-stove-d792@gregkh Signed-off-by: Greg Kroah-Hartman commit 1015c27a5e1a63efae2b18a9901494474b4d1dc3 Author: Alan Stern Date: Tue Feb 17 22:10:32 2026 -0500 USB: core: Limit the length of unkillable synchronous timeouts The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device. To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector. In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout. Signed-off-by: Alan Stern Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") CC: stable@vger.kernel.org Link: https://patch.msgid.link/15fc9773-a007-47b0-a703-df89a8cf83dd@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 7784caa413a89487dd14dd5c41db8753483b2acb Author: Alan Stern Date: Tue Feb 17 22:09:22 2026 -0500 USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for some usb_bulk_msg() calls. Since the user can specify arbitrarily long timeouts and usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable() instead to avoid the possibility of the user hanging a kernel thread indefinitely. Reported-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/8e1c7ac5-e076-44b0-84b8-1b34b20f0ae1@suse.com/T/#t Tested-by: syzbot+25ba18e2c5040447585d@syzkaller.appspotmail.com Signed-off-by: Alan Stern Fixes: 048c6d88a021 ("usb: usbtmc: Add ioctls to set/get usb timeout") CC: stable@vger.kernel.org Link: https://patch.msgid.link/81c6fc24-0607-40f1-8c20-5270dab2fad5@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 416909962e7cdf29fd01ac523c953f37708df93d Author: Alan Stern Date: Tue Feb 17 22:07:47 2026 -0500 USB: usbcore: Introduce usb_bulk_msg_killable() The synchronous message API in usbcore (usb_control_msg(), usb_bulk_msg(), and so on) uses uninterruptible waits. However, drivers may call these routines in the context of a user thread, which means it ought to be possible to at least kill them. For this reason, introduce a new usb_bulk_msg_killable() function which behaves the same as usb_bulk_msg() except for using wait_for_completion_killable_timeout() instead of wait_for_completion_timeout(). The same can be done later for usb_control_msg() later on, if it turns out to be needed. Signed-off-by: Alan Stern Suggested-by: Oliver Neukum Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowland.harvard.edu/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") CC: stable@vger.kernel.org Link: https://patch.msgid.link/248628b4-cc83-4e81-a620-3ce4e0376d41@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit e293015ba76eb96ce4ebed7e3b2cb1a7d319f3e9 Author: Gabor Juhos Date: Wed Feb 18 21:21:07 2026 +0100 usb: core: don't power off roothub PHYs if phy_set_mode() fails Remove the error path from the usb_phy_roothub_set_mode() function. The code is clearly wrong, because phy_set_mode() calls can't be balanced with phy_power_off() calls. Additionally, the usb_phy_roothub_set_mode() function is called only from usb_add_hcd() before it powers on the PHYs, so powering off those makes no sense anyway. Presumably, the code is copy-pasted from the phy_power_on() function without adjusting the error handling. Cc: stable@vger.kernel.org # v5.1+ Fixes: b97a31348379 ("usb: core: comply to PHY framework") Signed-off-by: Gabor Juhos Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20260218-usb-phy-poweroff-fix-v1-1-66e6831e860e@gmail.com Signed-off-by: Greg Kroah-Hartman commit 227312b4a65c373d5d8b4683b7fc36203fedc516 Author: Hans de Goede Date: Sat Feb 28 15:52:58 2026 +0100 HID: input: Add HID_BATTERY_QUIRK_DYNAMIC for Elan touchscreens Elan touchscreens have a HID-battery device for the stylus which is always there even if there is no stylus. This is causing upower to report an empty battery for the stylus and some desktop-environments will show a notification about this, which is quite annoying. Because of this the HID-battery is being ignored on all Elan I2c and USB touchscreens, but this causes there to be no battery reporting for the stylus at all. This adds a new HID_BATTERY_QUIRK_DYNAMIC and uses these for the Elan touchscreens. This new quirks causes the present value of the battery to start at 0, which will make userspace ignore it and only sets present to 1 after receiving a battery input report which only happens when the stylus gets in range. Reported-by: ggrundik@gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221118 Signed-off-by: Hans de Goede Reviewed-by: Sebastian Reichel Signed-off-by: Jiri Kosina commit 487b23afaf4b258a70d3e4a8febf66f09850e75f Author: Hans de Goede Date: Sat Feb 28 15:52:57 2026 +0100 HID: input: Drop Asus UX550* touchscreen ignore battery quirks Drop the Asus UX550* touchscreen ignore battery quirks, there is a blanket HID_BATTERY_QUIRK_IGNORE for all USB_VENDOR_ID_ELAN USB touchscreens now, so these are just a duplicate of those. Signed-off-by: Hans de Goede Signed-off-by: Jiri Kosina commit 53f3a900e9a383d47af7253076e19f510c5708d0 Author: Chen Ni Date: Tue Mar 10 10:42:46 2026 +0800 ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition The acp3x_5682_init() function did not check the return value of clk_get(), which could lead to dereferencing error pointers in rt5682_clk_enable(). Fix this by: 1. Changing clk_get() to the device-managed devm_clk_get(). 2. Adding proper IS_ERR() checks for both clock acquisitions. Fixes: 6b8e4e7db3cd ("ASoC: amd: Add machine driver for Raven based platform") Signed-off-by: Chen Ni Link: https://patch.msgid.link/20260310024246.2153827-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit 362c490980867930a098b99f421268fbd7ca05fd Author: Long Li Date: Tue Mar 10 20:32:33 2026 +0800 xfs: fix integer overflow in bmap intent sort comparator xfs_bmap_update_diff_items() sorts bmap intents by inode number using a subtraction of two xfs_ino_t (uint64_t) values, with the result truncated to int. This is incorrect when two inode numbers differ by more than INT_MAX (2^31 - 1), which is entirely possible on large XFS filesystems. Fix this by replacing the subtraction with cmp_int(). Cc: # v4.9 Fixes: 9f3afb57d5f1 ("xfs: implement deferred bmbt map/unmap operations") Signed-off-by: Long Li Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 743956bb9990214ff1dac66ef59e27221dc3c2d8 Author: Chen-Yu Tsai Date: Mon Mar 2 23:35:56 2026 +0800 spi: dt-bindings: sun6i: Allow Dual SPI and Quad SPI for newer SoCs Support for Dual SPI and Quad SPI was added to the Linux driver in commit 0605d9fb411f ("spi: sun6i: add quirk for dual and quad SPI modes support") and commit 25453d797d7a ("spi: sun6i: add dual and quad SPI modes support for R329/D1/R528/T113s"). However the binding was never updated to allow these modes. Allow them by adding 2 and 4 to the allowed bus widths for the newer variants. While at it, also add 0 to the allowed bus widths. This signals that RX or TX is not available, i.e. the MISO or MOSI pin is disconnected. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260302153559.3199783-2-wens@kernel.org Signed-off-by: Mark Brown commit 393815f57651101f1590632092986d1d5a3a41bd Author: Ben Dooks Date: Wed Mar 11 10:58:35 2026 +0000 ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() The pointer returned from acpi_os_map_generic_address() is tagged with __iomem, so make the rv it is returned to also of void __iomem * type. Fixes the following sparse warning: drivers/acpi/osl.c:1686:20: warning: incorrect type in assignment (different address spaces) drivers/acpi/osl.c:1686:20: expected void *rv drivers/acpi/osl.c:1686:20: got void [noderef] __iomem * Fixes: 6915564dc5a8 ("ACPI: OSL: Change the type of acpi_os_map_generic_address() return value") Signed-off-by: Ben Dooks [ rjw: Subject tweak, added Fixes tag ] Link: https://patch.msgid.link/20260311105835.463030-1-ben.dooks@codethink.co.uk Signed-off-by: Rafael J. Wysocki commit 192d852129b1b7c4f0ddbab95d0de1efd5ee1405 Author: Thomas Gleixner Date: Tue Mar 10 21:29:09 2026 +0100 sched/mmcid: Avoid full tasklist walks Chasing vfork()'ed tasks on a CID ownership mode switch requires a full task list walk, which is obviously expensive on large systems. Avoid that by keeping a list of tasks using a mm MMCID entity in mm::mm_cid and walk this list instead. This removes the proven to be flaky counting logic and avoids a full task list walk in the case of vfork()'ed tasks. Fixes: fbd0e71dc370 ("sched/mmcid: Provide CID ownership mode fixup functions") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Tested-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260310202526.183824481@kernel.org commit 7574ac6e49789ddee1b1be9b2afb42b4a1b4b1f4 Author: Thomas Gleixner Date: Tue Mar 10 21:29:04 2026 +0100 sched/mmcid: Remove pointless preempt guard This is a leftover from the early versions of this function where it could be invoked without mm::mm_cid::lock held. Remove it and add lockdep asserts instead. Fixes: 653fda7ae73d ("sched/mmcid: Switch over to the new mechanism") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Tested-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260310202526.116363613@kernel.org commit 28b5a1395036d6c7a6c8034d85ad3d7d365f192c Author: Thomas Gleixner Date: Tue Mar 10 21:28:58 2026 +0100 sched/mmcid: Handle vfork()/CLONE_VM correctly Matthieu and Jiri reported stalls where a task endlessly loops in mm_get_cid() when scheduling in. It turned out that the logic which handles vfork()'ed tasks is broken. It is invoked when the number of tasks associated to a process is smaller than the number of MMCID users. It then walks the task list to find the vfork()'ed task, but accounts all the already processed tasks as well. If that double processing brings the number of to be handled tasks to 0, the walk stops and the vfork()'ed task's CID is not fixed up. As a consequence a subsequent schedule in fails to acquire a (transitional) CID and the machine stalls. Cure this by removing the accounting condition and make the fixup always walk the full task list if it could not find the exact number of users in the process' thread list. Fixes: fbd0e71dc370 ("sched/mmcid: Provide CID ownership mode fixup functions") Closes: https://lore.kernel.org/b24ffcb3-09d5-4e48-9070-0b69bc654281@kernel.org Reported-by: Matthieu Baerts Reported-by: Jiri Slaby Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Tested-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260310202526.048657665@kernel.org commit b2e48c429ec54715d16fefa719dd2fbded2e65be Author: Thomas Gleixner Date: Tue Mar 10 21:28:53 2026 +0100 sched/mmcid: Prevent CID stalls due to concurrent forks A newly forked task is accounted as MMCID user before the task is visible in the process' thread list and the global task list. This creates the following problem: CPU1 CPU2 fork() sched_mm_cid_fork(tnew1) tnew1->mm.mm_cid_users++; tnew1->mm_cid.cid = getcid() -> preemption fork() sched_mm_cid_fork(tnew2) tnew2->mm.mm_cid_users++; // Reaches the per CPU threshold mm_cid_fixup_tasks_to_cpus() for_each_other(current, p) .... As tnew1 is not visible yet, this fails to fix up the already allocated CID of tnew1. As a consequence a subsequent schedule in might fail to acquire a (transitional) CID and the machine stalls. Move the invocation of sched_mm_cid_fork() after the new task becomes visible in the thread and the task list to prevent this. This also makes it symmetrical vs. exit() where the task is removed as CID user before the task is removed from the thread and task lists. Fixes: fbd0e71dc370 ("sched/mmcid: Provide CID ownership mode fixup functions") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Tested-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260310202525.969061974@kernel.org commit a1621e06ccec0da034b692ea143a586f846cd157 Merge: a0b9b0f1433c84 22fd7f7fed2ae3 Author: Greg Kroah-Hartman Date: Wed Mar 11 11:07:50 2026 +0100 Merge tag 'stratix10_svc_fix_for_v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-linus Dinh writes: firmware: stratix10-svc: add multiple svc clients support - Add a dedicated thread for each svc client to fix a timeout issue when the svc driver is handling multiple clients. * tag 'stratix10_svc_fix_for_v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: firmware: stratix10-svc: Add Multi SVC clients support commit 755a648e78f12574482d4698d877375793867fa1 Author: Steven Rostedt Date: Fri Mar 6 21:24:03 2026 -0500 time/jiffies: Mark jiffies_64_to_clock_t() notrace The trace_clock_jiffies() function that handles the "uptime" clock for tracing calls jiffies_64_to_clock_t(). This causes the function tracer to constantly recurse when the tracing clock is set to "uptime". Mark it notrace to prevent unnecessary recursion when using the "uptime" clock. Fixes: 58d4e21e50ff3 ("tracing: Fix wraparound problems in "uptime" trace clock") Signed-off-by: Steven Rostedt (Google) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260306212403.72270bb2@robin commit b282c43ed156ae15ea76748fc15cd5c39dc9ab72 Author: Raphael Zimmer Date: Tue Mar 10 15:28:15 2026 +0100 libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In ceph_handle_auth_reply(), the value of the payload_len field of such a message is stored in a variable of type int. A value greater than INT_MAX leads to an integer overflow and is interpreted as a negative value. This leads to decrementing the pointer address by this value and subsequently accessing it because ceph_decode_need() only checks that the memory access does not exceed the end address of the allocation. This patch fixes the issue by changing the data type of payload_len to u32. Additionally, the data type of result_msg_len is changed to u32, as it is also a variable holding a non-negative length. Also, an additional layer of sanity checks is introduced, ensuring that directly after reading it from the message, payload_len and result_msg_len are not greater than the overall segment length. BUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph] Read of size 4 at addr ffff88811404df14 by task kworker/20:1/262 CPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: ceph-msgr ceph_con_workfn [libceph] Call Trace: dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x620 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x72/0x210 kasan_report+0xe7/0x130 ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] __asan_report_load_n_noabort+0xf/0x20 ceph_handle_auth_reply+0x642/0x7a0 [libceph] mon_dispatch+0x973/0x23d0 [libceph] ? apparmor_socket_recvmsg+0x6b/0xa0 ? __pfx_mon_dispatch+0x10/0x10 [libceph] ? __kasan_check_write+0x14/0x30i ? mutex_unlock+0x7f/0xd0 ? __pfx_mutex_unlock+0x10/0x10 ? __pfx_do_recvmsg+0x10/0x10 [libceph] ceph_con_process_message+0x1f1/0x650 [libceph] process_message+0x1e/0x450 [libceph] ceph_con_v2_try_read+0x2e48/0x6c80 [libceph] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [libceph] ? save_fpregs_to_fpstate+0xb0/0x230 ? raw_spin_rq_unlock+0x17/0xa0 ? finish_task_switch.isra.0+0x13b/0x760 ? __switch_to+0x385/0xda0 ? __kasan_check_write+0x14/0x30 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 ceph_con_workfn+0x248/0x10c0 [libceph] process_one_work+0x629/0xf80 ? __kasan_check_write+0x14/0x30 worker_thread+0x87f/0x1570 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_try_to_wake_up+0x10/0x10 ? kasan_print_address_stack_frame+0x1f7/0x280 ? __pfx_worker_thread+0x10/0x10 kthread+0x396/0x830 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? __pfx_kthread+0x10/0x10 ? __kasan_check_write+0x14/0x30 ? recalc_sigpending+0x180/0x210 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3f7/0x610 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x385/0xda0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 [ idryomov: replace if statements with ceph_decode_need() for payload_len and result_msg_len ] Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Viacheslav Dubeyko Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 770444611f047dbfd4517ec0bc1b179d40c2f346 Author: Raphael Zimmer Date: Thu Feb 26 16:07:31 2026 +0100 libceph: Use u32 for non-negative values in ceph_monmap_decode() This patch fixes unnecessary implicit conversions that change signedness of blob_len and num_mon in ceph_monmap_decode(). Currently blob_len and num_mon are (signed) int variables. They are used to hold values that are always non-negative and get assigned in ceph_decode_32_safe(), which is meant to assign u32 values. Both variables are subsequently used as unsigned values, and the value of num_mon is further assigned to monmap->num_mon, which is of type u32. Therefore, both variables should be of type u32. This is especially relevant for num_mon. If the value read from the incoming message is very large, it is interpreted as a negative value, and the check for num_mon > CEPH_MAX_MON does not catch it. This leads to the attempt to allocate a very large chunk of memory for monmap, which will most likely fail. In this case, an unnecessary attempt to allocate memory is performed, and -ENOMEM is returned instead of -EINVAL. Cc: stable@vger.kernel.org Signed-off-by: Raphael Zimmer Reviewed-by: Viacheslav Dubeyko Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 49973e2a4156a88e46ba1c1c484b7c214199a181 Author: Thomas Zimmermann Date: Mon Mar 9 09:14:49 2026 +0100 drm/loongson: Mark driver as orphaned The maintainer's email address has been bouncing for months. Mark the loongson DRM driver as orphaned. Signed-off-by: Thomas Zimmermann Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260309081503.67123-1-tzimmermann@suse.de commit 6df6ea4b3d1567dbe6442f308735c23b63007c7f Author: Barnabás Pőcze Date: Tue Mar 10 20:44:03 2026 +0000 gpiolib: clear requested flag if line is invalid If `gpiochip_line_is_valid()` fails, then `-EINVAL` is returned, but `desc->flags` will have `GPIOD_FLAG_REQUESTED` set, which will result in subsequent calls misleadingly returning `-EBUSY`. Fix that by clearing the flag in case of failure. Fixes: a501624864f3 ("gpio: Respect valid_mask when requesting GPIOs") Signed-off-by: Barnabás Pőcze Reviewed-by: Matti Vaittinen Link: https://patch.msgid.link/20260310204359.1202451-1-pobrn@protonmail.com Signed-off-by: Bartosz Golaszewski commit 5182e5ec4355dd690307f5d5c28cbfc5b2c06a97 Author: Lianqin Hu Date: Wed Mar 11 07:22:38 2026 +0000 ALSA: usb-audio: Add iface reset and delay quirk for SPACETOUCH USB Audio Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: New USB device found, idVendor=0666, idProduct=0880 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: USB Audio usb 1-1: Manufacturer: SPACETOUCH usb 1-1: SerialNumber: 000000000 Signed-off-by: Lianqin Hu Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/TYUPR06MB6217ACC80B70BE25D87456B0D247A@TYUPR06MB6217.apcprd06.prod.outlook.com commit 775af5cbb22c1de2ad0f486959739c35cfc55ac8 Author: Daniel Gomez Date: Tue Mar 10 12:36:24 2026 +0100 scripts: kconfig: merge_config.sh: fix indentation Replace spaces with tabs for consistency with the rest of the script. Fixes: 5fa9b82cbcfc5 ("scripts: kconfig: merge_config.sh: refactor from shell/sed/grep to awk") Signed-off-by: Daniel Gomez Link: https://patch.msgid.link/20260310-fixes-merge-config-v1-2-beaeeaded6bd@samsung.com Signed-off-by: Nathan Chancellor commit 5f47be1b44bf2754c45e8c58ca036b474c9ecbc7 Author: Daniel Gomez Date: Tue Mar 10 12:36:23 2026 +0100 scripts: kconfig: merge_config.sh: pass output file as awk variable The refactoring commit 5fa9b82cbcfc5 ("scripts: kconfig: merge_config.sh: refactor from shell/sed/grep to awk") passes $TMP_FILE.new as ARGV[3] to awk, using it as both an output destination and an input file argument. When the base file is empty, nothing is written to ARGV[3] during processing, so awk fails trying to open it for reading: awk: cmd. line:52: fatal: cannot open file `./.tmp.config.grcQin34jb.new' for reading: No such file or directory mv: cannot stat './.tmp.config.grcQin34jb.new': No such file or directory Pass the output path via -v outfile instead and drop the FILENAME == ARGV[3] { nextfile }. Fixes: 5fa9b82cbcfc5 ("scripts: kconfig: merge_config.sh: refactor from shell/sed/grep to awk") Signed-off-by: Daniel Gomez Link: https://patch.msgid.link/20260310-fixes-merge-config-v1-1-beaeeaded6bd@samsung.com Signed-off-by: Nathan Chancellor commit b29fb8829bff243512bb8c8908fd39406f9fd4c3 Merge: b4f0dd314b39ea 441336115df26b Author: Linus Torvalds Date: Tue Mar 10 20:30:52 2026 -0700 Merge tag 'v7.0-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix potential use after free errors - Fix refcount leak in smb2 open error path - Prevent allowing logging signing or encryption keys * tag 'v7.0-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: Don't log keys in SMB3 signing and encryption key generation smb: server: fix use-after-free in smb2_open() ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() ksmbd: fix use-after-free by using call_rcu() for oplock_info ksmbd: fix use-after-free in proc_show_files due to early rcu_read_unlock smb/server: Fix another refcount leak in smb2_open() commit 908c344d5cfac4160f49715da9efacdf5b6a28bd Author: Nicolai Buchwitz Date: Tue Mar 10 06:49:35 2026 +0100 net: bcmgenet: fix broken EEE by converting to phylib-managed state The bcmgenet EEE implementation is broken in several ways. phy_support_eee() is never called, so the PHY never advertises EEE and phylib never sets phydev->enable_tx_lpi. bcmgenet_mac_config() checks priv->eee.eee_enabled to decide whether to enable the MAC LPI logic, but that field is never initialised to true, so the MAC never enters Low Power Idle even when EEE is negotiated - wasting the power savings EEE is designed to provide. The only way to get EEE working at all is a manual 'ethtool --set-eee eth0 eee on' after every link-up, and even then bcmgenet_get_eee() immediately clobbers the reported state because phy_ethtool_get_eee() overwrites eee_enabled and tx_lpi_enabled with the uninitialised PHY eee_cfg values. Finally, bcmgenet_mac_config() is only called on link-up, so EEE is never disabled in hardware on link-down. Fix all of this by removing the MAC-side EEE state tracking (priv->eee) and aligning with the pattern used by other non-phylink MAC drivers such as FEC. Call phy_support_eee() in bcmgenet_mii_probe() so the PHY advertises EEE link modes and phylib tracks negotiation state. Move the EEE hardware control to bcmgenet_mii_setup(), which is called on every link event, and drive it directly from phydev->enable_tx_lpi - the flag phylib sets when EEE is negotiated and the user has not disabled it. This enables EEE automatically once the link partner agrees and disables it cleanly on link-down. Make bcmgenet_get_eee() and bcmgenet_set_eee() pure passthroughs to phy_ethtool_get_eee() and phy_ethtool_set_eee(), with the MAC hardware register read/written for tx_lpi_timer. Drop struct ethtool_keee eee from struct bcmgenet_priv. Fixes: fe0d4fd9285e ("net: phy: Keep track of EEE configuration") Link: https://lore.kernel.org/netdev/d352039f-4cbb-41e6-9aeb-0b4f3941b54c@lunn.ch/ Suggested-by: Andrew Lunn Signed-off-by: Nicolai Buchwitz Reviewed-by: Florian Fainelli Tested-by: Florian Fainelli Link: https://patch.msgid.link/20260310054935.1238594-1-nb@tipi-net.de Signed-off-by: Jakub Kicinski commit 57885276cc16a2e2b76282c808a4e84cbecb3aae Author: Paul Moses Date: Mon Mar 9 17:35:10 2026 +0000 net-shapers: don't free reply skb after genlmsg_reply() genlmsg_reply() hands the reply skb to netlink, and netlink_unicast() consumes it on all return paths, whether the skb is queued successfully or freed on an error path. net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit() currently jump to free_msg after genlmsg_reply() fails and call nlmsg_free(msg), which can hit the same skb twice. Return the genlmsg_reply() error directly and keep free_msg only for pre-reply failures. Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation") Fixes: 553ea9f1efd6 ("net: shaper: implement introspection support") Cc: stable@vger.kernel.org Signed-off-by: Paul Moses Link: https://patch.msgid.link/20260309173450.538026-2-p@1g4.org Signed-off-by: Jakub Kicinski commit f441b489cc66fbc44d78b6c123e74283b8077431 Author: Daniel Golle Date: Tue Mar 10 00:41:56 2026 +0000 net: dsa: mxl862xx: don't set user_mii_bus The PHY addresses in the MII bus are not equal to the port addresses, so the bus cannot be assigned as user_mii_bus. Falling back on the user_mii_bus in case a PHY isn't declared in device tree will result in using the wrong (in this case: off-by-+1) PHY. Remove the wrong assignment. Fixes: 23794bec1cb60 ("net: dsa: add basic initial driver for MxL862xx switches") Suggested-by: Vladimir Oltean Signed-off-by: Daniel Golle Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/0f0df310fd8cab57e0e5e3d0831dd057fd05bcd5.1773103271.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 2503d08f8a2de618e5c3a8183b250ff4a2e2d52c Author: Fan Wu Date: Mon Mar 9 13:24:09 2026 +0000 net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Normal RX/TX interrupts are enabled later, in arc_emac_open(), so probe should not see interrupt delivery in the usual case. However, hardware may still present stale or latched interrupt status left by firmware or the bootloader. If probe later unwinds after devm_request_irq() has installed the handler, such a stale interrupt can still reach arc_emac_intr() during teardown and race with release of the associated net_device. Avoid that window by putting the device into a known quiescent state before requesting the IRQ: disable all EMAC interrupt sources and clear any pending EMAC interrupt status bits. This keeps the change hardware-focused and minimal, while preventing spurious IRQ delivery from leftover state. Fixes: e4f2379db6c6 ("ethernet/arc/arc_emac - Add new driver") Cc: stable@vger.kernel.org Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260309132409.584966-1-fanwu01@zju.edu.cn Signed-off-by: Jakub Kicinski commit 28b225282d44e2ef40e7f46cfdbd5d1b20b8874f Author: Jakub Kicinski Date: Mon Mar 9 17:39:07 2026 -0700 page_pool: store detach_time as ktime_t to avoid false-negatives While testing other changes in vng I noticed that nl_netdev.page_pool_check flakes. This never happens in real CI. Turns out vng may boot and get to that test in less than a second. page_pool_detached() records the detach time in seconds, so if vng is fast enough detach time is set to 0. Other code treats 0 as "not detached". detach_time is only used to report the state to the user, so it's not a huge deal in practice but let's fix it. Store the raw ktime_t (nanoseconds) instead. A nanosecond value of 0 is practically impossible. Acked-by: Jesper Dangaard Brouer Fixes: 69cb4952b6f6 ("net: page_pool: report when page pool was destroyed") Link: https://patch.msgid.link/20260310003907.3540019-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 881a0263d502e1a93ebc13a78254e9ad19520232 Author: Kevin Hao Date: Sat Mar 7 15:08:54 2026 +0800 net: macb: Shuffle the tx ring before enabling tx Quanyang observed that when using an NFS rootfs on an AMD ZynqMp board, the rootfs may take an extended time to recover after a suspend. Upon investigation, it was determined that the issue originates from a problem in the macb driver. According to the Zynq UltraScale TRM [1], when transmit is disabled, the transmit buffer queue pointer resets to point to the address specified by the transmit buffer queue base address register. In the current implementation, the code merely resets `queue->tx_head` and `queue->tx_tail` to '0'. This approach presents several issues: - Packets already queued in the tx ring are silently lost, leading to memory leaks since the associated skbs cannot be released. - Concurrent write access to `queue->tx_head` and `queue->tx_tail` may occur from `macb_tx_poll()` or `macb_start_xmit()` when these values are reset to '0'. - The transmission may become stuck on a packet that has already been sent out, with its 'TX_USED' bit set, but has not yet been processed. However, due to the manipulation of 'queue->tx_head' and 'queue->tx_tail', `macb_tx_poll()` incorrectly assumes there are no packets to handle because `queue->tx_head == queue->tx_tail`. This issue is only resolved when a new packet is placed at this position. This is the root cause of the prolonged recovery time observed for the NFS root filesystem. To resolve this issue, shuffle the tx ring and tx skb array so that the first unsent packet is positioned at the start of the tx ring. Additionally, ensure that updates to `queue->tx_head` and `queue->tx_tail` are properly protected with the appropriate lock. [1] https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm Fixes: bf9cf80cab81 ("net: macb: Fix tx/rx malfunction after phy link down and up") Reported-by: Quanyang Wang Signed-off-by: Kevin Hao Cc: stable@vger.kernel.org Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260307-zynqmp-v2-1-6ef98a70e1d0@gmail.com Signed-off-by: Jakub Kicinski commit 85b731ad4bbf6eb3fedf267ab00be3596f148432 Author: Alan Borzeszkowski Date: Mon Mar 9 16:37:03 2026 +0100 spi: intel-pci: Add support for Nova Lake mobile SPI flash Add Intel Nova Lake PCD-H SPI serial flash PCI ID to the list of supported devices. Signed-off-by: Alan Borzeszkowski Acked-by: Mika Westerberg Link: https://patch.msgid.link/20260309153703.74282-1-alan.borzeszkowski@linux.intel.com Signed-off-by: Mark Brown commit 182b9b3d8d1d36500f58e4f3dc82b144d6487bdf Author: Ignat Korchagin Date: Mon Mar 9 17:34:45 2026 +0000 MAINTAINERS: update email address for Ignat Korchagin Since I'm moving from Cloudflare update my email address in the MAINTAINERS file and add an entry to .mailmap so nothing gets lost. Link: https://lkml.kernel.org/r/20260309173445.71393-1-ignat@cloudflare.com Signed-off-by: Ignat Korchagin Acked-by: Lukas Wunner Cc: David Howells Cc: Herbert Xu Signed-off-by: Andrew Morton commit 939080834fef3ce42fdbcfef33fd29c9ffe5bbed Author: Wei Yang Date: Thu Mar 5 01:50:06 2026 +0000 mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for shared THP Commit 60fbb14396d5 ("mm/huge_memory: adjust try_to_migrate_one() and split_huge_pmd_locked()") return false unconditionally after split_huge_pmd_locked(). This may fail try_to_migrate() early when TTU_SPLIT_HUGE_PMD is specified. The reason is the above commit adjusted try_to_migrate_one() to, when a PMD-mapped THP entry is found, and TTU_SPLIT_HUGE_PMD is specified (for example, via unmap_folio()), return false unconditionally. This breaks the rmap walk and fail try_to_migrate() early, if this PMD-mapped THP is mapped in multiple processes. The user sensible impact of this bug could be: * On memory pressure, shrink_folio_list() may split partially mapped folio with split_folio_to_list(). Then free unmapped pages without IO. If failed, it may not be reclaimed. * On memory failure, memory_failure() would call try_to_split_thp_page() to split folio contains the bad page. If succeed, the PG_has_hwpoisoned bit is only set in the after-split folio contains @split_at. By doing so, we limit bad memory. If failed to split, the whole folios is not usable. One way to reproduce: Create an anonymous THP range and fork 512 children, so we have a THP shared mapped in 513 processes. Then trigger folio split with /sys/kernel/debug/split_huge_pages debugfs to split the THP folio to order 0. Without the above commit, we can successfully split to order 0. With the above commit, the folio is still a large folio. And currently there are two core users of TTU_SPLIT_HUGE_PMD: * try_to_unmap_one() * try_to_migrate_one() try_to_unmap_one() would restart the rmap walk, so only try_to_migrate_one() is affected. We can't simply revert commit 60fbb14396d5 ("mm/huge_memory: adjust try_to_migrate_one() and split_huge_pmd_locked()"), since it removed some duplicated check covered by page_vma_mapped_walk(). This patch fixes this by restart page_vma_mapped_walk() after split_huge_pmd_locked(). Since we cannot simply return "true" to fix the problem, as that would affect another case: When invoking folio_try_share_anon_rmap_pmd() from split_huge_pmd_locked(), the latter can fail and leave a large folio mapped through PTEs, in which case we ought to return true from try_to_migrate_one(). This might result in unnecessary walking of the rmap but is relatively harmless. Link: https://lkml.kernel.org/r/20260305015006.27343-1-richard.weiyang@gmail.com Fixes: 60fbb14396d5 ("mm/huge_memory: adjust try_to_migrate_one() and split_huge_pmd_locked()") Signed-off-by: Wei Yang Reviewed-by: Baolin Wang Reviewed-by: Zi Yan Tested-by: Lance Yang Reviewed-by: Lance Yang Reviewed-by: Gavin Guo Acked-by: David Hildenbrand (arm) Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Signed-off-by: Andrew Morton commit 29f40594a28114b9a9bc87f6cf7bbee9609628f2 Author: Dev Jain Date: Tue Mar 3 11:45:28 2026 +0530 mm/rmap: fix incorrect pte restoration for lazyfree folios We batch unmap anonymous lazyfree folios by folio_unmap_pte_batch. If the batch has a mix of writable and non-writable bits, we may end up setting the entire batch writable. Fix this by respecting writable bit during batching. Although on a successful unmap of a lazyfree folio, the soft-dirty bit is lost, preserve it on pte restoration by respecting the bit during batching, to make the fix consistent w.r.t both writable bit and soft-dirty bit. I was able to write the below reproducer and crash the kernel. Explanation of reproducer (set 64K mTHP to always): Fault in a 64K large folio. Split the VMA at mid-point with MADV_DONTFORK. fork() - parent points to the folio with 8 writable ptes and 8 non-writable ptes. Merge the VMAs with MADV_DOFORK so that folio_unmap_pte_batch() can determine all the 16 ptes as a batch. Do MADV_FREE on the range to mark the folio as lazyfree. Write to the memory to dirty the pte, eventually rmap will dirty the folio. Then trigger reclaim, we will hit the pte restoration path, and the kernel will crash with the trace given below. The BUG happens at: BUG_ON(atomic_inc_return(&ptc->anon_map_count) > 1 && rw); The code path is asking for anonymous page to be mapped writable into the pagetable. The BUG_ON() firing implies that such a writable page has been mapped into the pagetables of more than one process, which breaks anonymous memory/CoW semantics. [ 21.134473] kernel BUG at mm/page_table_check.c:118! [ 21.134497] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 21.135917] Modules linked in: [ 21.136085] CPU: 1 UID: 0 PID: 1735 Comm: dup-lazyfree Not tainted 7.0.0-rc1-00116-g018018a17770 #1028 PREEMPT [ 21.136858] Hardware name: linux,dummy-virt (DT) [ 21.137019] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 21.137308] pc : page_table_check_set+0x28c/0x2a8 [ 21.137607] lr : page_table_check_set+0x134/0x2a8 [ 21.137885] sp : ffff80008a3b3340 [ 21.138124] x29: ffff80008a3b3340 x28: fffffdffc3d14400 x27: ffffd1a55e03d000 [ 21.138623] x26: 0040000000000040 x25: ffffd1a55f7dd000 x24: 0000000000000001 [ 21.139045] x23: 0000000000000001 x22: 0000000000000001 x21: ffffd1a55f217f30 [ 21.139629] x20: 0000000000134521 x19: 0000000000134519 x18: 005c43e000040000 [ 21.140027] x17: 0001400000000000 x16: 0001700000000000 x15: 000000000000ffff [ 21.140578] x14: 000000000000000c x13: 005c006000000000 x12: 0000000000000020 [ 21.140828] x11: 0000000000000000 x10: 005c000000000000 x9 : ffffd1a55c079ee0 [ 21.141077] x8 : 0000000000000001 x7 : 005c03e000040000 x6 : 000000004000ffff [ 21.141490] x5 : ffff00017fffce00 x4 : 0000000000000001 x3 : 0000000000000002 [ 21.141741] x2 : 0000000000134510 x1 : 0000000000000000 x0 : ffff0000c08228c0 [ 21.141991] Call trace: [ 21.142093] page_table_check_set+0x28c/0x2a8 (P) [ 21.142265] __page_table_check_ptes_set+0x144/0x1e8 [ 21.142441] __set_ptes_anysz.constprop.0+0x160/0x1a8 [ 21.142766] contpte_set_ptes+0xe8/0x140 [ 21.142907] try_to_unmap_one+0x10c4/0x10d0 [ 21.143177] rmap_walk_anon+0x100/0x250 [ 21.143315] try_to_unmap+0xa0/0xc8 [ 21.143441] shrink_folio_list+0x59c/0x18a8 [ 21.143759] shrink_lruvec+0x664/0xbf0 [ 21.144043] shrink_node+0x218/0x878 [ 21.144285] __node_reclaim.constprop.0+0x98/0x338 [ 21.144763] user_proactive_reclaim+0x2a4/0x340 [ 21.145056] reclaim_store+0x3c/0x60 [ 21.145216] dev_attr_store+0x20/0x40 [ 21.145585] sysfs_kf_write+0x84/0xa8 [ 21.145835] kernfs_fop_write_iter+0x130/0x1c8 [ 21.145994] vfs_write+0x2b8/0x368 [ 21.146119] ksys_write+0x70/0x110 [ 21.146240] __arm64_sys_write+0x24/0x38 [ 21.146380] invoke_syscall+0x50/0x120 [ 21.146513] el0_svc_common.constprop.0+0x48/0xf8 [ 21.146679] do_el0_svc+0x28/0x40 [ 21.146798] el0_svc+0x34/0x110 [ 21.146926] el0t_64_sync_handler+0xa0/0xe8 [ 21.147074] el0t_64_sync+0x198/0x1a0 [ 21.147225] Code: f9400441 b4fff241 17ffff94 d4210000 (d4210000) [ 21.147440] ---[ end trace 0000000000000000 ]--- #define _GNU_SOURCE #include #include #include #include #include #include #include #include void write_to_reclaim() { const char *path = "/sys/devices/system/node/node0/reclaim"; const char *value = "409600000000"; int fd = open(path, O_WRONLY); if (fd == -1) { perror("open"); exit(EXIT_FAILURE); } if (write(fd, value, sizeof("409600000000") - 1) == -1) { perror("write"); close(fd); exit(EXIT_FAILURE); } printf("Successfully wrote %s to %s\n", value, path); close(fd); } int main() { char *ptr = mmap((void *)(1UL << 30), 1UL << 16, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if ((unsigned long)ptr != (1UL << 30)) { perror("mmap"); return 1; } /* a 64K folio gets faulted in */ memset(ptr, 0, 1UL << 16); /* 32K half will not be shared into child */ if (madvise(ptr, 1UL << 15, MADV_DONTFORK)) { perror("madvise madv dontfork"); return 1; } pid_t pid = fork(); if (pid < 0) { perror("fork"); return 1; } else if (pid == 0) { sleep(15); } else { /* merge VMAs. now first half of the 16 ptes are writable, the other half not. */ if (madvise(ptr, 1UL << 15, MADV_DOFORK)) { perror("madvise madv fork"); return 1; } if (madvise(ptr, (1UL << 16), MADV_FREE)) { perror("madvise madv free"); return 1; } /* dirty the large folio */ (*ptr) += 10; write_to_reclaim(); // sleep(10); waitpid(pid, NULL, 0); } } Link: https://lkml.kernel.org/r/20260303061528.2429162-1-dev.jain@arm.com Fixes: 354dffd29575 ("mm: support batched unmap for lazyfree large folios during reclamation") Signed-off-by: Dev Jain Acked-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes Reviewed-by: Barry Song Reviewed-by: Wei Yang Tested-by: Lance Yang Cc: Anshuman Khandual Cc: Harry Yoo Cc: Jann Horn Cc: Liam Howlett Cc: Rik van Riel Cc: Ryan Roberts Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit fae654083bfa409bb2244f390232e2be47f05bfc Author: Chris Down Date: Tue Mar 3 07:21:21 2026 +0000 mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd() move_pages_huge_pmd() handles UFFDIO_MOVE for both normal THPs and huge zero pages. For the huge zero page path, src_folio is explicitly set to NULL, and is used as a sentinel to skip folio operations like lock and rmap. In the huge zero page branch, src_folio is NULL, so folio_mk_pmd(NULL, pgprot) passes NULL through folio_pfn() and page_to_pfn(). With SPARSEMEM_VMEMMAP this silently produces a bogus PFN, installing a PMD pointing to non-existent physical memory. On other memory models it is a NULL dereference. Use page_folio(src_page) to obtain the valid huge zero folio from the page, which was obtained from pmd_page() and remains valid throughout. After commit d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero folio special"), moved huge zero PMDs must remain special so vm_normal_page_pmd() continues to treat them as special mappings. move_pages_huge_pmd() currently reconstructs the destination PMD in the huge zero page branch, which drops PMD state such as pmd_special() on architectures with CONFIG_ARCH_HAS_PTE_SPECIAL. As a result, vm_normal_page_pmd() can treat the moved huge zero PMD as a normal page and corrupt its refcount. Instead of reconstructing the PMD from the folio, derive the destination entry from src_pmdval after pmdp_huge_clear_flush(), then handle the PMD metadata the same way move_huge_pmd() does for moved entries by marking it soft-dirty and clearing uffd-wp. Link: https://lkml.kernel.org/r/a1e787dd-b911-474d-8570-f37685357d86@lucifer.local Fixes: e3981db444a0 ("mm: add folio_mk_pmd()") Signed-off-by: Chris Down Signed-off-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Tested-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Arm) Cc: Signed-off-by: Andrew Morton commit 6ffd853b0b10e1e292cef0bfd0997986471254de Author: Randy Dunlap Date: Sun Mar 1 16:51:44 2026 -0800 build_bug.h: correct function parameters names in kernel-doc Use the correct function (or macro) names to avoid kernel-doc warnings: Warning: include/linux/build_bug.h:38 function parameter 'cond' not described in 'BUILD_BUG_ON_MSG' Warning: include/linux/build_bug.h:38 function parameter 'msg' not described in 'BUILD_BUG_ON_MSG' Warning: include/linux/build_bug.h:76 function parameter 'expr' not described in 'static_assert' Link: https://lkml.kernel.org/r/20260302005144.3467019-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 36f46b0e36892eba08978eef7502ff3c94ddba77 Author: Thorsten Blum Date: Sat Feb 28 00:00:09 2026 +0100 crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying When debug logging is enabled, read_key_from_user_keying() logs the first 8 bytes of the key payload and partially exposes the dm-crypt key. Stop logging any key bytes. Link: https://lkml.kernel.org/r/20260227230008.858641-2-thorsten.blum@linux.dev Fixes: 479e58549b0f ("crash_dump: store dm crypt keys in kdump reserved memory") Signed-off-by: Thorsten Blum Cc: Baoquan He Cc: Coiby Xu Cc: Dave Young Cc: Vivek Goyal Cc: Signed-off-by: Andrew Morton commit 88d37abb366be95d772ceb4c7f26772e78447252 Author: Ye Bin Date: Tue Mar 10 21:08:47 2026 +0800 smb/client: only export symbol for 'smb2maperror-test' module Only export smb2_get_err_map_test smb2_error_map_table_test and smb2_error_map_num symbol for 'smb2maperror-test' module. Fixes: 7d0bf050a587 ("smb/client: make SMB2 maperror KUnit tests a separate module") Signed-off-by: Ye Bin Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit d78840a6a38d312dc1a51a65317bb67e46f0b929 Author: Bharath SM Date: Mon Mar 9 16:00:49 2026 +0530 smb: client: fix in-place encryption corruption in SMB2_write() SMB2_write() places write payload in iov[1..n] as part of rq_iov. smb3_init_transform_rq() pointer-shares rq_iov, so crypt_message() encrypts iov[1] in-place, replacing the original plaintext with ciphertext. On a replayable error, the retry sends the same iov[1] which now contains ciphertext instead of the original data, resulting in corruption. The corruption is most likely to be observed when connections are unstable, as reconnects trigger write retries that re-send the already-encrypted data. This affects SFU mknod, MF symlinks, etc. On kernels before 6.10 (prior to the netfs conversion), sync writes also used this path and were similarly affected. The async write path wasn't unaffected as it uses rq_iter which gets deep-copied. Fix by moving the write payload into rq_iter via iov_iter_kvec(), so smb3_init_transform_rq() deep-copies it before encryption. Cc: stable@vger.kernel.org #6.3+ Acked-by: Henrique Carvalho Acked-by: Shyam Prasad N Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Bharath SM Signed-off-by: Steve French commit fae11330dc0642065568d6c0045322293fe59bc6 Author: Arnd Bergmann Date: Fri Mar 6 16:07:13 2026 +0100 smb: client: fix sbflags initialization The newly introduced variable is initialized in an #ifdef block but used outside of it, leading to undefined behavior when CONFIG_CIFS_ALLOW_INSECURE_LEGACY is disabled: fs/smb/client/dir.c:417:9: error: variable 'sbflags' is uninitialized when used here [-Werror,-Wuninitialized] 417 | if (sbflags & CIFS_MOUNT_DYNPERM) | ^~~~~~~ Move the initialization into the declaration, the same way as the other similar function do it. Fixes: 4fc3a433c139 ("smb: client: use atomic_t for mnt_cifs_flags") Signed-off-by: Arnd Bergmann Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 4a7d2729dc99437dbb880a64c47828c0d191b308 Author: Paulo Alcantara Date: Sat Mar 7 18:20:16 2026 -0300 smb: client: fix atomic open with O_DIRECT & O_SYNC When user application requests O_DIRECT|O_SYNC along with O_CREAT on open(2), CREATE_NO_BUFFER and CREATE_WRITE_THROUGH bits were missed in CREATE request when performing an atomic open, thus leading to potentially data integrity issues. Fix this by setting those missing bits in CREATE request when O_DIRECT|O_SYNC has been specified in cifs_do_create(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Acked-by: Henrique Carvalho Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French commit e94eaef11142b01f77bf8ba4d0b59720b7858109 Author: Matt Vollrath Date: Tue Feb 24 18:28:33 2026 -0500 e1000/e1000e: Fix leak in DMA error cleanup If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented after a successful mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping would leak. In these commits, a faulty while condition caused an infinite loop in dma_error: Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e driver") Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver") Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") fixed the infinite loop, but introduced the off-by-one error. This issue may still exist in the igbvf driver, but I did not address it in this patch. Fixes: c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") Assisted-by: Claude:claude-4.6-opus Signed-off-by: Matt Vollrath Signed-off-by: Tony Nguyen commit e809085f492842ce7a519c9ef72d40f4bca89c13 Author: Alok Tiwari Date: Mon Nov 10 11:13:38 2025 -0800 i40e: fix src IP mask checks and memcpy argument names in cloud filter Fix following issues in the IPv4 and IPv6 cloud filter handling logic in both the add and delete paths: - The source-IP mask check incorrectly compares mask.src_ip[0] against tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This likely goes unnoticed because the check is in an "else if" path that only executes when dst_ip is not set, most cloud filter use cases focus on destination-IP matching, and the buggy condition can accidentally evaluate true in some cases. - memcpy() for the IPv4 source address incorrectly uses ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although both arrays are the same size. - The IPv4 memcpy operations used ARRAY_SIZE(tcf.dst_ip) and ARRAY_SIZE (tcf.src_ip), Update these to use sizeof(cfilter->ip.v4.dst_ip) and sizeof(cfilter->ip.v4.src_ip) to ensure correct and explicit copy size. - In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when comparing dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent explicit, even though both fields are struct in6_addr. Fixes: e284fc280473 ("i40e: Add and delete cloud filter") Signed-off-by: Alok Tiwari Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen commit b4f0dd314b39ea154f62f3bd3115ed0470f9f71e Merge: 1f318b96cc84d7 b12bbe35c7c1e4 Author: Linus Torvalds Date: Tue Mar 10 12:47:56 2026 -0700 Merge tag 'mm-hotfixes-stable-2026-03-09-16-36' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "15 hotfixes. 6 are cc:stable. 14 are for MM. Singletons, with one doubleton - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-03-09-16-36' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS, mailmap: update email address for Lorenzo Stoakes mm/mmu_notifier: clean up mmu_notifier.h kernel-doc uaccess: correct kernel-doc parameter format mm/huge_memory: fix a folio_split() race condition with folio_try_get() MAINTAINERS: add co-maintainer and reviewer for SLAB ALLOCATOR MAINTAINERS: add RELAY entry memcg: fix slab accounting in refill_obj_stock() trylock path mm/hugetlb.c: use __pa() instead of virt_to_phys() in early bootmem alloc code zram: rename writeback_compressed device attr tools/testing: fix testing/vma and testing/radix-tree build Revert "ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor()" mm/cma: move put_page_testzero() out of VM_WARN_ON in cma_release() mm/damon/core: clear walk_control on inactive context in damos_walk() mm: memfd_luo: always dirty all folios mm: memfd_luo: always make all folios uptodate commit 30e4b2290cc2a8d1b9ddb9dcb9c981df1f2a7399 Author: Peter Ujfalusi Date: Tue Mar 10 08:53:50 2026 +0200 ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put The correct helper to use in rt1011_recv_spk_mode_put() to retrieve the DAPM context is snd_soc_component_to_dapm(), from kcontrol we will receive NULL pointer. Closes: https://github.com/thesofproject/linux/issues/5691 Fixes: 5b35bb517f27 ("ASoC: codecs: rt1011: convert to snd_soc_dapm_xxx()") Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260310065350.18921-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit e06e6b8001233241eb5b2e2791162f0585f50f4b Author: Paul Chaignon Date: Tue Mar 10 12:39:51 2026 +0100 selftests/bpf: Fix pkg-config call on static builds For commit b0dcdcb9ae75 ("resolve_btfids: Fix linker flags detection"), I suggested setting HOSTPKG_CONFIG to $PKG_CONFIG when compiling resolve_btfids, but I forgot the quotes around that variable. As a result, when running vmtest.sh with static linking, it fails as follows: $ LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh [...] make: unrecognized option '--static' Usage: make [options] [target] ... [...] This worked when I tested it because HOSTPKG_CONFIG didn't have a default value in the resolve_btfids Makefile, but once it does, the quotes aren't preserved and it fails on the next make call. Fixes: b0dcdcb9ae75 ("resolve_btfids: Fix linker flags detection") Signed-off-by: Paul Chaignon Acked-by: Mykyta Yatsenko Acked-by: Ihor Solodrai Link: https://lore.kernel.org/r/abADBwn_ykblpABE@mail.gmail.com Signed-off-by: Alexei Starovoitov commit 57d2371d52be1d574b33382bfbf8052485b99d8b Author: Zhang Rui Date: Wed Mar 4 08:30:12 2026 +0800 tools/power turbostat: Fix illegal memory access when SMT is present and disabled When SMT is present and disabled, turbostat may under-size the thread_data array. This can corrupt results or cause turbostat to exit with a segmentation fault. [lenb: commit message] Fixes: a2b4d0f8bf07 ("tools/power turbostat: Favor cpu# over core#") Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit 2321a9596d2260310267622e0ad8fbfa6f95378f Author: Sachin Kumar Date: Mon Mar 9 18:25:42 2026 +0000 bpf: Fix constant blinding for PROBE_MEM32 stores BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1. The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification, before bpf_jit_blind_constants() runs during JIT compilation. The blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through unblinded. Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the existing BPF_ST|BPF_MEM cases. The blinding transformation is identical: load the blinded immediate into BPF_REG_AX via mov+xor, then convert the immediate store to a register store (BPF_STX). The rewritten STX instruction must preserve the BPF_PROBE_MEM32 mode so the architecture JIT emits the correct arena addressing (R12-based on x86-64). Cannot use the BPF_STX_MEM() macro here because it hardcodes BPF_MEM mode; construct the instruction directly instead. Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.") Reviewed-by: Puranjay Mohan Reviewed-by: Emil Tsalapatis Signed-off-by: Sachin Kumar Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/Y6IT5VvNRchPBLI5D7JZHBzZrU9rb0ycRJPJzJSXGj7kJlX8RJwZFSM2YZjcDxoQKABkxt1T8Os2gi23PYyFuQe6KkZGWVyfz8K5afdy9ak=@protonmail.com Signed-off-by: Alexei Starovoitov commit ac72464b10d5975639dedaccf0c372ef670f6abc Merge: 1f318b96cc84d7 ea1989746b77c3 Author: Alexei Starovoitov Date: Tue Mar 10 11:46:31 2026 -0700 Merge branch 'bpf-reset-register-id-for-bpf_end-value-tracking' Yazhou Tang says: ==================== bpf: Reset register ID for BPF_END value tracking This patchset fixes a register's scalar ID issue for BPF_END operations reported by Guillaume Laporte. Please see commit log of 1/2 for more details. Changes v1 => v2: 1. Reset register ID inside scalar_byte_swap() conditionally. (Eduard) v1: https://lore.kernel.org/bpf/20260303093956.395076-1-tangyazhou@zju.edu.cn/ ==================== Link: https://patch.msgid.link/20260304083228.142016-1-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit 6b13cb8f48a42ddf6dd98865b673a82e37ff238b Author: Lizhi Hou Date: Tue Mar 10 11:00:58 2026 -0700 accel/amdxdna: Fix runtime suspend deadlock when there is pending job The runtime suspend callback drains the running job workqueue before suspending the device. If a job is still executing and calls pm_runtime_resume_and_get(), it can deadlock with the runtime suspend path. Fix this by moving pm_runtime_resume_and_get() from the job execution routine to the job submission routine, ensuring the device is resumed before the job is queued and avoiding the deadlock during runtime suspend. Fixes: 063db451832b ("accel/amdxdna: Enhance runtime power management") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260310180058.336348-1-lizhi.hou@amd.com commit ea1989746b77c3f63bce43af247e1de29ed6bf4a Author: Yazhou Tang Date: Wed Mar 4 16:32:28 2026 +0800 selftests/bpf: Add test for BPF_END register ID reset Add a test case to ensure that BPF_END operations correctly break register's scalar ID ties. The test creates a scenario where r1 is a copy of r0, r0 undergoes a byte swap, and then r0 is checked against a constant. - Without the fix in the verifier, the bounds learned from r0 are incorrectly propagated to r1, making the verifier believe r1 is bounded and wrongly allowing subsequent pointer arithmetic. - With the fix, r1 remains an unbounded scalar, and the verifier correctly rejects the arithmetic operation between the frame pointer and the unbounded register. Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Signed-off-by: Yazhou Tang Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260304083228.142016-3-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit a3125bc01884431d30d731461634c8295b6f0529 Author: Yazhou Tang Date: Wed Mar 4 16:32:27 2026 +0800 bpf: Reset register ID for BPF_END value tracking When a register undergoes a BPF_END (byte swap) operation, its scalar value is mutated in-place. If this register previously shared a scalar ID with another register (e.g., after an `r1 = r0` assignment), this tie must be broken. Currently, the verifier misses resetting `dst_reg->id` to 0 for BPF_END. Consequently, if a conditional jump checks the swapped register, the verifier incorrectly propagates the learned bounds to the linked register, leading to false confidence in the linked register's value and potentially allowing out-of-bounds memory accesses. Fix this by explicitly resetting `dst_reg->id` to 0 in the BPF_END case to break the scalar tie, similar to how BPF_NEG handles it via `__mark_reg_known`. Fixes: 9d2119984224 ("bpf: Add bitwise tracking for BPF_END") Closes: https://lore.kernel.org/bpf/AMBPR06MB108683CFEB1CB8D9E02FC95ECF17EA@AMBPR06MB10868.eurprd06.prod.outlook.com/ Link: https://lore.kernel.org/bpf/4be25f7442a52244d0dd1abb47bc6750e57984c9.camel@gmail.com/ Reported-by: Guillaume Laporte Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Signed-off-by: Yazhou Tang Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260304083228.142016-2-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit b330fbfd34d7624bec62b99ad88dba2614326a19 Author: Jessica Liu Date: Tue Mar 10 14:17:31 2026 +0800 irqchip/riscv-aplic: Register syscore operations only once Since commit 95a8ddde3660 ("irqchip/riscv-aplic: Preserve APLIC states across suspend/resume"), when multiple NUMA nodes exist and AIA is not configured as "none", aplic_probe() is called multiple times. This leads to register_syscore(&aplic_syscore) being invoked repeatedly, causing the following Oops: list_add double add: new=ffffffffb91461f0, prev=ffffffffb91461f0, next=ffffffffb915c408. [] __list_add_valid_or_report+0x60/0xc0 [] register_syscore+0x3e/0x70 [] aplic_probe+0xc6/0x112 Fix this by registering syscore operations only once, using a static variable aplic_syscore_registered to track registration. [ tglx: Trim backtrace properly ] Fixes: 95a8ddde3660 ("irqchip/riscv-aplic: Preserve APLIC states across suspend/resume") Signed-off-by: Jessica Liu Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260310141731145xMwLsyvXl9Gw-m6A4VRYj@zte.com.cn commit 620b6ded72a7f0f77be6ec44d0462bb85729ab7a Author: Jessica Liu Date: Tue Mar 10 14:16:00 2026 +0800 irqchip/riscv-aplic: Do not clear ACPI dependencies on probe failure aplic_probe() calls acpi_dev_clear_dependencies() unconditionally at the end, even when the preceding setup (MSI or direct mode) has failed. This is incorrect because if the device failed to probe, it should not be considered as active and should not clear dependencies for other devices waiting on it. Fix this by returning immediately when the setup fails, skipping the ACPI dependency cleanup. Also, explicitly return 0 on success instead of relying on the value of 'rc' to make the success path clear. Fixes: 5122e380c23b ("irqchip/riscv-aplic: Add ACPI support") Signed-off-by: Jessica Liu Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260310141600411Fu8H8-GXOOgKISU48Tjgx@zte.com.cn commit c7940c8bf215b9dc6211781c77ce80e76982a723 Author: Tim Kovalenko Date: Mon Mar 9 12:34:21 2026 -0400 gpu: nova-core: fix stack overflow in GSP memory allocation The `Cmdq::new` function was allocating a `PteArray` struct on the stack and was causing a stack overflow with 8216 bytes. Modify the `PteArray` to calculate and write the Page Table Entries directly into the coherent DMA buffer one-by-one. This reduces the stack usage quite a lot. Reported-by: Gary Guo Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/509436-Nova/topic/.60Cmdq.3A.3Anew.60.20uses.20excessive.20stack.20size/near/570375549 Link: https://lore.kernel.org/rust-for-linux/CANiq72mAQxbRJZDnik3Qmd4phvFwPA01O2jwaaXRh_T+2=L-qA@mail.gmail.com/ Fixes: f38b4f105cfc ("gpu: nova-core: Create initial Gsp") Acked-by: Alexandre Courbot Signed-off-by: Tim Kovalenko Link: https://patch.msgid.link/20260309-drm-rust-next-v4-4-4ef485b19a4c@proton.me [ * Use PteArray::entry() in LogBuffer::new(), * Add TODO comment to use IoView projections once available, * Add PTE_ARRAY_SIZE constant to avoid duplication. - Danilo ] Signed-off-by: Danilo Krummrich commit 697f514ad9dbe600a808326d80b02caab03b7f90 Author: Yihan Ding Date: Fri Mar 6 10:16:51 2026 +0800 landlock: Clean up interrupted thread logic in TSYNC In landlock_restrict_sibling_threads(), when the calling thread is interrupted while waiting for sibling threads to prepare, it executes a recovery path. Previously, this path included a wait_for_completion() call on all_prepared to prevent a Use-After-Free of the local shared_ctx. However, this wait is redundant. Exiting the main do-while loop already leads to a bottom cleanup section that unconditionally waits for all_finished. Therefore, replacing the wait with a simple break is safe, prevents UAF, and correctly unblocks the remaining task_works. Clean up the error path by breaking the loop and updating the surrounding comments to accurately reflect the state machine. Suggested-by: Günther Noack Signed-off-by: Yihan Ding Tested-by: Günther Noack Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260306021651.744723-3-dingyihan@uniontech.com Signed-off-by: Mickaël Salaün commit ff88df67dbf78b5eb909f8a3da4115b1cfd998ab Author: Yihan Ding Date: Fri Mar 6 10:16:50 2026 +0800 landlock: Serialize TSYNC thread restriction syzbot found a deadlock in landlock_restrict_sibling_threads(). When multiple threads concurrently call landlock_restrict_self() with sibling thread restriction enabled, they can deadlock by mutually queueing task_works on each other and then blocking in kernel space (waiting for the other to finish). Fix this by serializing the TSYNC operations within the same process using the exec_update_lock. This prevents concurrent invocations from deadlocking. We use down_write_trylock() and restart the syscall if the lock cannot be acquired immediately. This ensures that if a thread fails to get the lock, it will return to userspace, allowing it to process any pending TSYNC task_works from the lock holder, and then transparently restart the syscall. Fixes: 42fc7e6543f6 ("landlock: Multithreading support for landlock_restrict_self()") Reported-by: syzbot+7ea2f5e9dfd468201817@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7ea2f5e9dfd468201817 Suggested-by: Günther Noack Suggested-by: Tingmao Wang Tested-by: Justin Suess Signed-off-by: Yihan Ding Tested-by: Günther Noack Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260306021651.744723-2-dingyihan@uniontech.com Signed-off-by: Mickaël Salaün commit d1afcd71658220aa03453dc263064e42ff30b1e5 Author: Denis Benato Date: Sat Feb 28 20:10:05 2026 +0100 HID: asus: add xg mobile 2022 external hardware support XG mobile station 2022 has a different PID than the 2023 model: add it that model to hid-asus. Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina commit 22fd7f7fed2ae3702f90d1985c326354e86b9c75 Author: Muhammad Amirul Asyraf Mohamad Jamian Date: Thu Mar 5 01:31:51 2026 -0800 firmware: stratix10-svc: Add Multi SVC clients support In the current implementation, SVC client drivers such as socfpga-hwmon, intel_fcs, stratix10-soc, stratix10-rsu each send an SMC command that triggers a single thread in the stratix10-svc driver. Upon receiving a callback, the initiating client driver sends a stratix10-svc-done signal, terminating the thread without waiting for other pending SMC commands to complete. This leads to a timeout issue in the firmware SVC mailbox service when multiple client drivers send SMC commands concurrently. To resolve this issue, a dedicated thread is now created per channel. The stratix10-svc driver will support up to the number of channels defined by SVC_NUM_CHANNEL. Thread synchronization is handled using a mutex to prevent simultaneous issuance of SMC commands by multiple threads. SVC_NUM_DATA_IN_FIFO is reduced from 32 to 8, since each channel now has its own dedicated FIFO and the SDM processes commands one at a time. 8 entries per channel is sufficient while keeping the total aggregate capacity the same (4 channels x 8 = 32 entries). Additionally, a thread task is now validated before invoking kthread_stop when the user aborts, ensuring safe termination. Timeout values have also been adjusted to accommodate the increased load from concurrent client driver activity. Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") Cc: stable@vger.kernel.org Signed-off-by: Ang Tien Sung Signed-off-by: Fong, Yan Kei Signed-off-by: Muhammad Amirul Asyraf Mohamad Jamian Link: https://lore.kernel.org/all/20260305093151.2678-1-muhammad.amirul.asyraf.mohamad.jamian@altera.com Signed-off-by: Dinh Nguyen commit fdadbf6e84c44df8dbb85cfdd38bc10e4431501d Author: Petr Oros Date: Wed Feb 11 20:18:55 2026 +0100 iavf: fix incorrect reset handling in callbacks Three driver callbacks schedule a reset and wait for its completion: ndo_change_mtu(), ethtool set_ringparam(), and ethtool set_channels(). Waiting for reset in ndo_change_mtu() and set_ringparam() was added by commit c2ed2403f12c ("iavf: Wait for reset in callbacks which trigger it") to fix a race condition where adding an interface to bonding immediately after MTU or ring parameter change failed because the interface was still in __RESETTING state. The same commit also added waiting in iavf_set_priv_flags(), which was later removed by commit 53844673d555 ("iavf: kill "legacy-rx" for good"). Waiting in set_channels() was introduced earlier by commit 4e5e6b5d9d13 ("iavf: Fix return of set the new channel count") to ensure the PF has enough time to complete the VF reset when changing channel count, and to return correct error codes to userspace. Commit ef490bbb2267 ("iavf: Add net_shaper_ops support") added net_shaper_ops to iavf, which required reset_task to use _locked NAPI variants (napi_enable_locked, napi_disable_locked) that need the netdev instance lock. Later, commit 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations") and commit 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock") started holding the netdev instance lock during ndo and ethtool callbacks for drivers with net_shaper_ops. Finally, commit 120f28a6f314 ("iavf: get rid of the crit lock") replaced the driver's crit_lock with netdev_lock in reset_task, causing incorrect behavior: the callback holds netdev_lock and waits for reset_task, but reset_task needs the same lock: Thread 1 (callback) Thread 2 (reset_task) ------------------- --------------------- netdev_lock() [blocked on workqueue] ndo_change_mtu() or ethtool op iavf_schedule_reset() iavf_wait_for_reset() iavf_reset_task() waiting... netdev_lock() <- blocked This does not strictly deadlock because iavf_wait_for_reset() uses wait_event_interruptible_timeout() with a 5-second timeout. The wait eventually times out, the callback returns an error to userspace, and after the lock is released reset_task completes the reset. This leads to incorrect behavior: userspace sees an error even though the configuration change silently takes effect after the timeout. Fix this by extracting the reset logic from iavf_reset_task() into a new iavf_reset_step() function that expects netdev_lock to be already held. The three callbacks now call iavf_reset_step() directly instead of scheduling the work and waiting, performing the reset synchronously in the caller's context which already holds netdev_lock. This eliminates both the incorrect error reporting and the need for iavf_wait_for_reset(), which is removed along with the now-unused reset_waitqueue. The workqueue-based iavf_reset_task() becomes a thin wrapper that acquires netdev_lock and calls iavf_reset_step(), preserving its use for PF-initiated resets. The callbacks may block for several seconds while iavf_reset_step() polls hardware registers, but this is acceptable since netdev_lock is a per-device mutex and only serializes operations on the same interface. v3: - Remove netif_running() guard from iavf_set_channels(). Unlike set_ringparam where descriptor counts are picked up by iavf_open() directly, num_req_queues is only consumed during iavf_reinit_interrupt_scheme() in the reset path. Skipping the reset on a down device would silently discard the channel count change. - Remove dead reset_waitqueue code (struct field, init, and all wake_up calls) since iavf_wait_for_reset() was the only consumer. Fixes: 120f28a6f314 ("iavf: get rid of the crit lock") Reviewed-by: Jacob Keller Signed-off-by: Petr Oros Reviewed-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit efc54fb13d79117a825fef17364315a58682c7ec Author: Petr Oros Date: Thu Jan 29 10:57:23 2026 +0100 iavf: fix PTP use-after-free during reset Commit 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") introduced a worker to cache PHC time, but failed to stop it during reset or disable. This creates a race condition where `iavf_reset_task()` or `iavf_disable_vf()` free adapter resources (AQ) while the worker is still running. If the worker triggers `iavf_queue_ptp_cmd()` during teardown, it accesses freed memory/locks, leading to a crash. Fix this by calling `iavf_ptp_release()` before tearing down the adapter. This ensures `ptp_clock_unregister()` synchronously cancels the worker and cleans up the chardev before the backing resources are destroyed. Fixes: 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") Signed-off-by: Petr Oros Reviewed-by: Ivan Vecera Acked-by: Jacob Keller Reviewed-by: Vadim Fedorenko Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit bd98c6204d1195973b1760fe45860863deb6200c Author: Nikolay Aleksandrov Date: Fri Feb 13 10:48:41 2026 +0200 drivers: net: ice: fix devlink parameters get without irdma If CONFIG_IRDMA isn't enabled but there are ice NICs in the system, the driver will prevent full devlink dev param show dump because its rdma get callbacks return ENODEV and stop the dump. For example: $ devlink dev param show pci/0000:82:00.0: name msix_vec_per_pf_max type generic values: cmode driverinit value 2 name msix_vec_per_pf_min type generic values: cmode driverinit value 2 kernel answers: No such device Returning EOPNOTSUPP allows the dump to continue so we can see all devices' devlink parameters. Fixes: c24a65b6a27c ("iidc/ice/irdma: Update IDC to support multiple consumers") Signed-off-by: Nikolay Aleksandrov Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit fa655a9ca73f7df32b8ca4d14ce11742f9578288 Author: Thorsten Blum Date: Tue Mar 3 22:31:01 2026 +0100 nvme: Annotate struct nvme_dhchap_key with __counted_by Add the __counted_by() compiler attribute to the flexible array member 'key' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Reviewed-by: Christoph Hellwig Signed-off-by: Thorsten Blum Signed-off-by: Keith Busch commit 0375c81eb2256366cd9602441d48b8b937e79635 Author: Maurizio Lombardi Date: Fri Feb 20 14:30:16 2026 +0100 nvme-core: do not pass empty queue_limits to blk_mq_alloc_queue() In nvme_alloc_admin_tag_set(), an empty queue_limits struct is currently allocated on the stack and passed by reference to blk_mq_alloc_queue(). This is redundant because blk_mq_alloc_queue() already handles a NULL limits pointer by internally substituting it with a default empty queue_limits struct. Remove the unnecessary local variable and pass a NULL value. Reviewed-by: Kanchan Joshi Signed-off-by: Maurizio Lombardi Signed-off-by: Keith Busch commit fc71f409b22ca831a9f87a2712eaa09ef2bb4a5e Author: Sungwoo Kim Date: Sat Mar 7 14:46:36 2026 -0500 nvme-pci: Fix race bug in nvme_poll_irqdisable() In the following scenario, pdev can be disabled between (1) and (3) by (2). This sets pdev->msix_enabled = 0. Then, pci_irq_vector() will return MSI-X IRQ(>15) for (1) whereas return INTx IRQ(<=15) for (2). This causes IRQ warning because it tries to enable INTx IRQ that has never been disabled before. To fix this, save IRQ number into a local variable and ensure disable_irq() and enable_irq() operate on the same IRQ number. Even if pci_free_irq_vectors() frees the IRQ concurrently, disable_irq() and enable_irq() on a stale IRQ number is still valid and safe, and the depth accounting reamins balanced. task 1: nvme_poll_irqdisable() disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) ...(1) enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) ...(3) task 2: nvme_reset_work() nvme_dev_disable() pdev->msix_enable = 0; ...(2) crash log: ------------[ cut here ]------------ Unbalanced enable for IRQ 10 WARNING: kernel/irq/manage.c:753 at __enable_irq+0x102/0x190 kernel/irq/manage.c:753, CPU#1: kworker/1:0H/26 Modules linked in: CPU: 1 UID: 0 PID: 26 Comm: kworker/1:0H Not tainted 6.19.0-dirty #9 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: kblockd blk_mq_timeout_work RIP: 0010:__enable_irq+0x107/0x190 kernel/irq/manage.c:753 Code: ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 79 48 8d 3d 2e 7a 3f 05 41 8b 74 24 2c <67> 48 0f b9 3a e8 ef b9 21 00 5b 41 5c 5d e9 46 54 66 03 e8 e1 b9 RSP: 0018:ffffc900001bf550 EFLAGS: 00010046 RAX: 0000000000000007 RBX: 0000000000000000 RCX: ffffffffb20c0e90 RDX: 0000000000000000 RSI: 000000000000000a RDI: ffffffffb74b88f0 RBP: ffffc900001bf560 R08: ffff88800197cf00 R09: 0000000000000001 R10: 0000000000000003 R11: 0000000000000003 R12: ffff8880012a6000 R13: 1ffff92000037eae R14: 000000000000000a R15: 0000000000000293 FS: 0000000000000000(0000) GS:ffff8880b49f7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555da4a25fa8 CR3: 00000000208e8000 CR4: 00000000000006f0 Call Trace: enable_irq+0x121/0x1e0 kernel/irq/manage.c:797 nvme_poll_irqdisable+0x162/0x1c0 drivers/nvme/host/pci.c:1494 nvme_timeout+0x965/0x14b0 drivers/nvme/host/pci.c:1744 blk_mq_rq_timed_out block/blk-mq.c:1653 [inline] blk_mq_handle_expired+0x227/0x2d0 block/blk-mq.c:1721 bt_iter+0x2fc/0x3a0 block/blk-mq-tag.c:292 __sbitmap_for_each_set include/linux/sbitmap.h:269 [inline] sbitmap_for_each_set include/linux/sbitmap.h:290 [inline] bt_for_each block/blk-mq-tag.c:324 [inline] blk_mq_queue_tag_busy_iter+0x969/0x1e80 block/blk-mq-tag.c:536 blk_mq_timeout_work+0x627/0x870 block/blk-mq.c:1763 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x65c/0xe60 kernel/workqueue.c:3421 kthread+0x41a/0x930 kernel/kthread.c:463 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 irq event stamp: 74478 hardirqs last enabled at (74477): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline] hardirqs last enabled at (74477): [] _raw_spin_unlock_irq+0x2c/0x60 kernel/locking/spinlock.c:202 hardirqs last disabled at (74478): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (74478): [] _raw_spin_lock_irqsave+0x85/0xa0 kernel/locking/spinlock.c:162 softirqs last enabled at (74304): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (74304): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (74304): [] __irq_exit_rcu+0xdc/0x120 kernel/softirq.c:723 softirqs last disabled at (74287): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (74287): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (74287): [] __irq_exit_rcu+0xdc/0x120 kernel/softirq.c:723 ---[ end trace 0000000000000000 ]--- Fixes: fa059b856a59 (nvme-pci: Simplify nvme_poll_irqdisable) Acked-by: Chao Shi Acked-by: Weidong Zhu Acked-by: Dave Tian Reviewed-by: Christoph Hellwig Signed-off-by: Sungwoo Kim Signed-off-by: Keith Busch commit 2922e3507f6d5caa7f1d07f145e186fc6f317a4e Author: Chaitanya Kulkarni Date: Wed Feb 25 20:30:03 2026 -0800 nvmet: move async event work off nvmet-wq For target nvmet_ctrl_free() flushes ctrl->async_event_work. If nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue completion for the same worker:- A. Async event work queued on nvmet-wq (prior to disconnect): nvmet_execute_async_event() queue_work(nvmet_wq, &ctrl->async_event_work) nvmet_add_async_event() queue_work(nvmet_wq, &ctrl->async_event_work) B. Full pre-work chain (RDMA CM path): nvmet_rdma_cm_handler() nvmet_rdma_queue_disconnect() __nvmet_rdma_queue_disconnect() queue_work(nvmet_wq, &queue->release_work) process_one_work() lock((wq_completion)nvmet-wq) <--------- 1st nvmet_rdma_release_queue_work() C. Recursive path (same worker): nvmet_rdma_release_queue_work() nvmet_rdma_free_queue() nvmet_sq_destroy() nvmet_ctrl_put() nvmet_ctrl_free() flush_work(&ctrl->async_event_work) __flush_work() touch_wq_lockdep_map() lock((wq_completion)nvmet-wq) <--------- 2nd Lockdep splat: ============================================ WARNING: possible recursive locking detected 6.19.0-rc3nvme+ #14 Tainted: G N -------------------------------------------- kworker/u192:42/44933 is trying to acquire lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 but task is already holding lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 3 locks held by kworker/u192:42/44933: #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660 #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530 Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma] Call Trace: __flush_work+0x268/0x530 nvmet_ctrl_free+0x140/0x310 [nvmet] nvmet_cq_put+0x74/0x90 [nvmet] nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma] nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma] process_one_work+0x206/0x660 worker_thread+0x184/0x320 kthread+0x10c/0x240 ret_from_fork+0x319/0x390 Move async event work to a dedicated nvmet-aen-wq to avoid reentrant flush on nvmet-wq. Reviewed-by: Christoph Hellwig Signed-off-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit b4e78f1427c7d6859229ae9616df54e1fc05a516 Author: Sungwoo Kim Date: Sun Mar 8 14:20:59 2026 -0400 nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set dev->online_queues is a count incremented in nvme_init_queue. Thus, valid indices are 0 through dev->online_queues − 1. This patch fixes the loop condition to ensure the index stays within the valid range. Index 0 is excluded because it is the admin queue. KASAN splat: ================================================================== BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline] BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404 Read of size 2 at addr ffff88800592a574 by task kworker/u8:5/74 CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: nvme-reset-wq nvme_reset_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xce/0x5d0 mm/kasan/report.c:482 kasan_report+0xdc/0x110 mm/kasan/report.c:595 __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379 nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline] nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404 nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x65c/0xe60 kernel/workqueue.c:3421 kthread+0x41a/0x930 kernel/kthread.c:463 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Allocated by task 34 on cpu 1 at 4.241550s: kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57 kasan_save_track+0x1c/0x70 mm/kasan/common.c:78 kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663 kmalloc_array_node_noprof include/linux/slab.h:1075 [inline] nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline] nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534 local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324 pci_call_probe drivers/pci/pci-driver.c:392 [inline] __pci_device_probe drivers/pci/pci-driver.c:417 [inline] pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x29b/0xb70 drivers/base/dd.c:661 __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803 driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833 __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159 async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x65c/0xe60 kernel/workqueue.c:3421 kthread+0x41a/0x930 kernel/kthread.c:463 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 The buggy address belongs to the object at ffff88800592a000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 244 bytes to the right of allocated 1152-byte region [ffff88800592a000, ffff88800592a480) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff) page_type: f5(slab) raw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001 head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 000fffffc0000003 ffffea0000164a01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800592a400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88800592a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88800592a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88800592a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800592a600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Fixes: 0f0d2c876c96 (nvme: free sq/cq dbbuf pointers when dbbuf set fails) Acked-by: Chao Shi Acked-by: Weidong Zhu Acked-by: Dave Tian Signed-off-by: Sungwoo Kim Signed-off-by: Keith Busch commit 52a8a1ba883defbfe3200baa22cf4cd21985d51a Author: Darrick J. Wong Date: Wed Mar 4 20:26:20 2026 -0800 xfs: fix undersized l_iclog_roundoff values If the superblock doesn't list a log stripe unit, we set the incore log roundoff value to 512. This leads to corrupt logs and unmountable filesystems in generic/617 on a disk with 4k physical sectors... XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Torn write (CRC failure) detected at log block 0x318e. Truncating head block from 0x3197. XFS (sda1): failed to locate log tail XFS (sda1): log mount/recovery failed: error -74 XFS (sda1): log mount failed XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Ending clean mount ...on the current xfsprogs for-next which has a broken mkfs. xfs_info shows this... meta-data=/dev/sda1 isize=512 agcount=4, agsize=644992 blks = sectsz=4096 attr=2, projid32bit=1 = crc=1 finobt=1, sparse=1, rmapbt=1 = reflink=1 bigtime=1 inobtcount=1 nrext64=1 = exchange=1 metadir=1 data = bsize=4096 blocks=2579968, imaxpct=25 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0, ftype=1, parent=1 log =internal log bsize=4096 blocks=16384, version=2 = sectsz=4096 sunit=0 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 = rgcount=0 rgsize=268435456 extents = zoned=0 start=0 reserved=0 ...observe that the log section has sectsz=4096 sunit=0, which means that the roundoff factor is 512, not 4096 as you'd expect. We should fix mkfs not to generate broken filesystems, but anyone can fuzz the ondisk superblock so we should be more cautious. I think the inadequate logic predates commit a6a65fef5ef8d0, but that's clearly going to require a different backport. Cc: stable@vger.kernel.org # v5.14 Fixes: a6a65fef5ef8d0 ("xfs: log stripe roundoff is a property of the log") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit c7c92f76f90a81dcc5c48cefa3343556501870b9 Author: Ian Rogers Date: Fri Mar 6 10:53:06 2026 -0800 perf annotate loongarch: Fix off-by-one bug in outside check A copy-paste of a similar issue fixed by Peter Collingbourne in: https://lore.kernel.org/linux-perf-users/20260304190613.2507582-1-pcc@google.com/ Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Bill Wendling Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Mark Rutland Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Collingbourne Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit d557640e4ce589a24dca5ca7ce3b9680f471325f Author: Rafael J. Wysocki Date: Sat Mar 7 17:12:05 2026 +0100 sched: idle: Make skipping governor callbacks more consistent If the cpuidle governor .select() callback is skipped because there is only one idle state in the cpuidle driver, the .reflect() callback should be skipped as well, at least for consistency (if not for correctness), so do it. Fixes: e5c9ffc6ae1b ("cpuidle: Skip governor when only one idle state is available") Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Reviewed-by: Aboorva Devarajan Reviewed-by: Frederic Weisbecker Link: https://patch.msgid.link/12857700.O9o76ZdvQC@rafael.j.wysocki commit 4c527c7e030672efd788d0806d7a68972a7ba3c1 Author: Stefan Haberland Date: Tue Mar 10 15:23:30 2026 +0100 s390/dasd: Copy detected format information to secondary device During online processing for a DASD device an IO operation is started to determine the format of the device. CDL format contains specifically sized blocks at the beginning of the disk. For a PPRC secondary device no real IO operation is possible therefore this IO request can not be started and this step is skipped for online processing of secondary devices. This is generally fine since the secondary is a copy of the primary device. In case of an additional partition detection that is run after a swap operation the format information is needed to properly drive partition detection IO. Currently the information is not passed leading to IO errors during partition detection and a wrongly detected partition table which in turn might lead to data corruption on the disk with the wrong partition table. Fix by passing the format information from primary to secondary device. Fixes: 413862caad6f ("s390/dasd: add copy pair swap capability") Cc: stable@vger.kernel.org #6.1 Reviewed-by: Jan Hoeppner Acked-by: Eduard Shishkin Signed-off-by: Stefan Haberland Link: https://patch.msgid.link/20260310142330.4080106-3-sth@linux.ibm.com Signed-off-by: Jens Axboe commit 40e9cd4ae8ec43b107ed2bff422a8fa39dcf4e4b Author: Stefan Haberland Date: Tue Mar 10 15:23:29 2026 +0100 s390/dasd: Move quiesce state with pprc swap Quiesce and resume is a mechanism to suspend operations on DASD devices. In the context of a controlled copy pair swap operation, the quiesce operation is usually issued before the actual swap and a resume afterwards. During the swap operation, the underlying device is exchanged. Therefore, the quiesce flag must be moved to the secondary device to ensure a consistent quiesce state after the swap. The secondary device itself cannot be suspended separately because there is no separate block device representation for it. Fixes: 413862caad6f ("s390/dasd: add copy pair swap capability") Cc: stable@vger.kernel.org #6.1 Reviewed-by: Jan Hoeppner Signed-off-by: Stefan Haberland Link: https://patch.msgid.link/20260310142330.4080106-2-sth@linux.ibm.com Signed-off-by: Jens Axboe commit be34705aa527872e5ce83927b7bc9307ba8095ca Author: Chen Ni Date: Fri Mar 6 12:10:52 2026 +0800 perf ftrace: Fix hashmap__new() error checking The hashmap__new() function never returns NULL, it returns error pointers. Fix the error checking to match. Additionally, set ftrace->profile_hash to NULL on error, and return the exact error code from hashmap__new(). Fixes: 0f223813edd051a5 ("perf ftrace: Add 'profile' command") Suggested-by: Ian Rogers Signed-off-by: Chen Ni Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 21b3fb7dc19caa488d285e3c47999f7f1a179334 Author: Peng Fan Date: Tue Mar 10 12:25:53 2026 +0800 regulator: pca9450: Correct probed name for PCA9452 An incorrect device name was logged for PCA9452 because the dev_info() ternary omitted PCA9452 and fell through to "pca9450bc". Introduce a type_name and set it per device type so the probed message matches the actual PMIC. While here, make the PCA9451A case explicit. No functional changes. Fixes: 017b76fb8e5b6 ("regulator: pca9450: Add PMIC pca9452 support") Signed-off-by: Peng Fan Link: https://patch.msgid.link/20260310-pca9450-irq-v1-2-36adf52c2c55@nxp.com Signed-off-by: Mark Brown commit 5d0efaf47ee90ac60efae790acee3a3ed99ebf80 Author: Peng Fan Date: Tue Mar 10 12:25:52 2026 +0800 regulator: pca9450: Correct interrupt type Kernel warning on i.MX8MP-EVK when doing module test: irq: type mismatch, failed to map hwirq-3 for gpio@30200000! Per PCA945[X] specification: The IRQ_B pin is pulled low when any unmasked interrupt bit status is changed and it is released high once application processor read INT1 register. So the interrupt should be configured as IRQF_TRIGGER_LOW, not IRQF_TRIGGER_FALLING. Fixes: 0935ff5f1f0a4 ("regulator: pca9450: add pca9450 pmic driver") Signed-off-by: Peng Fan Link: https://patch.msgid.link/20260310-pca9450-irq-v1-1-36adf52c2c55@nxp.com Signed-off-by: Mark Brown commit e53c0e99fd93da200c413deb57875f9f5fdb314a Author: Mark Brown Date: Sat Mar 7 09:50:35 2026 +0000 spi: cadence-qspi: Fix requesting of APB and AHB clocks on JH7110 The move of the AHB and APB clocks from a JH7110 specific quirk to the main clock init dropped the specification of the clock names to request for the AHB and APB clocks, resulting in the clock framework requesting a clock with a NULL name three times. On most platforms where the clocks are physically the same or some are always on this makes no difference but the reason we had the specific quirk for JH7110 is that it does actually have separate, controllable clocks. Update the new code to request the AHB and APB clocks by name to restore the original behaviour on JH7110. Fixes: 324ecc7788c2 ("spi: cadence-qspi: Kill cqspi_jh7110_clk_init") Reported-by: Ron Economos Closes: https://lore.kernel.org/r/a3ca5e9b-7446-497e-8df2-7ef2b42a02e9@w6rz.net Tested-by: Ron Economos Link: https://patch.msgid.link/20260307-spi-cadence-qspi-fix-jh7110-v1-1-c9f37b8c58b1@kernel.org Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260307-spi-cadence-qspi-fix-jh7110-v1-1-c9f37b8c58b1@kernel.org commit 73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d Merge: 6f1a9140ecda3b 47bba09b14fa21 Author: Paolo Abeni Date: Tue Mar 10 15:13:55 2026 +0100 Merge tag 'linux-can-fixes-for-7.0-20260310' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-03-10 this is a pull request of 2 patches for net/main. Haibo Chen's patch fixes the maximum allowed bit rate error, which was broken in v6.19. Wenyuan Li contributes a patch for the hi311x driver that adds missing error checking in the caller of the hi3110_power_enable() function, hi3110_open(). linux-can-fixes-for-7.0-20260310 * tag 'linux-can-fixes-for-7.0-20260310' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value can: dev: keep the max bitrate error at 5% ==================== Link: https://patch.msgid.link/20260310103547.2299403-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni commit 6ab3532b4c98f4e51969f0e5f3fc919c535f3ce1 Author: Rafael J. Wysocki Date: Mon Mar 9 21:54:17 2026 +0100 ACPI: video: Switch over to auxiliary bus type Commit 02c057ddefef ("ACPI: video: Convert the driver to a platform one") switched over the ACPI video bus driver from an ACPI driver to a platform driver, but that change introduced an unwanted and unexpected side effect. Namely, on some systems, the ACPI device object of the ACPI video bus device is an ACPI companion of multiple platform devices and, after adding video_device_ids[] as an acpi_match_table to the acpi_video_bus platform driver, all of those devices started to match that driver and its probe callback is invoked for all of them (it fails, but it leaves a confusing message in the log). Moreover, the MODULE_DEVICE_TABLE() of the ACPI video driver module matches all of the devices sharing the ACPI companion with the ACPI video bus device. To address this, make the core ACPI device enumeration code create an auxiliary device for the ACPI video bus device object instead of a platform device and switch over the ACPI video bus driver (once more) to an auxiliary driver. Auxiliary driver generally is a better match for ACPI video bus than platform driver, among other things because the ACPI video bus device does not require any resources to be allocated for it during enumeration. It also allows the ACPI video bus driver to stop abusing device matching based on ACPI device IDs and it allows a special case to be dropped from acpi_create_platform_device() because that function need not worry about the ACPI video bus device any more. Fixes: 02c057ddefef ("ACPI: video: Convert the driver to a platform one") Reported-by: Pratap Nirujogi Closes: https://lore.kernel.org/linux-acpi/007e3390-6b2b-457e-83c7-c794c5952018@amd.com/ Tested-by: Pratap Nirujogi Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) [ rjw: Added AUXILIARY_BUS selection to CONFIG_ACPI to fix build issue ] [ rjw: Fixed error path in acpi_create_video_bus_device() ] Link: https://patch.msgid.link/5986516.DvuYhMxLoT@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit bf29cb3641b80bac759c3332b02e0b270e16bf94 Author: Chen Ni Date: Fri Mar 6 11:56:48 2026 +0800 perf annotate: Fix hashmap__new() error checking The hashmap__new() function never returns NULL, it returns error pointers. Fix the error checking to match. Additionally, set src->samples to NULL to prevent any later code from accidentally using the error pointer. Fixes: d3e7cad6f36d9e80 ("perf annotate: Add a hashmap for symbol histogram") Reviewed-by: Ian Rogers Signed-off-by: Chen Ni Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Tianyou Li Signed-off-by: Arnaldo Carvalho de Melo commit 329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf Author: Yuan Tan Date: Mon Mar 9 03:41:46 2026 -0700 netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels IDLETIMER revision 0 rules reuse existing timers by label and always call mod_timer() on timer->timer. If the label was created first by revision 1 with XT_IDLETIMER_ALARM, the object uses alarm timer semantics and timer->timer is never initialized. Reusing that object from revision 0 causes mod_timer() on an uninitialized timer_list, triggering debugobjects warnings and possible panic when panic_on_warn=1. Fix this by rejecting revision 0 rule insertion when an existing timer with the same label is of ALARM type. Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target") Co-developed-by: Yifan Wu Signed-off-by: Yifan Wu Co-developed-by: Juefei Pu Signed-off-by: Juefei Pu Signed-off-by: Yuan Tan Signed-off-by: Xin Liu Signed-off-by: Florian Westphal commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89 Author: Hyunwoo Kim Date: Sun Mar 8 02:23:34 2026 +0900 netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0 Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Hyunwoo Kim Signed-off-by: Florian Westphal commit f1ba83755d81c6fc66ac7acd723d238f974091e9 Author: Hyunwoo Kim Date: Sun Mar 8 02:24:06 2026 +0900 netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its sk_buff. This leaks the nf_queue_entry, its associated sk_buff, and all held references (net_device refcounts, struct net refcount). Repeated triggering exhausts kernel memory. Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in this file. Fixes: 8d45ff22f1b4 ("netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR") Reviewed-by: David Dull Signed-off-by: Hyunwoo Kim Signed-off-by: Florian Westphal commit cfe770220ac2dbd3e104c6b45094037455da81d4 Author: David Dull Date: Sat Mar 7 20:26:21 2026 +0200 netfilter: x_tables: guard option walkers against 1-byte tail reads When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area. Add an explicit i == optlen - 1 check before dereferencing op[i + 1] in xt_tcpudp and xt_dccp option walkers. Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables") Signed-off-by: David Dull Signed-off-by: Florian Westphal commit d6d8cd2db236a9dd13dbc2d05843b3445cc964b5 Author: Jenny Guanni Qu Date: Fri Mar 6 19:12:38 2026 +0000 netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() pipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the to_offset argument on every iteration, including the last one where i == m->field_count - 1. This reads one element past the end of the stack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS] with NFT_PIPAPO_MAX_FIELDS == 16). Although pipapo_unmap() returns early when is_last is true without using the to_offset value, the argument is evaluated at the call site before the function body executes, making this a genuine out-of-bounds stack read confirmed by KASAN: BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables] Read of size 4 at addr ffff8000810e71a4 This frame has 1 object: [32, 160) 'rulemap' The buggy address is at offset 164 -- exactly 4 bytes past the end of the rulemap array. Pass 0 instead of rulemap[i + 1].n on the last iteration to avoid the out-of-bounds read. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Jenny Guanni Qu Signed-off-by: Florian Westphal commit 7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9 Author: Florian Westphal Date: Thu Mar 5 21:32:00 2026 +0100 netfilter: nf_tables: always walk all pending catchall elements During transaction processing we might have more than one catchall element: 1 live catchall element and 1 pending element that is coming as part of the new batch. If the map holding the catchall elements is also going away, its required to toggle all catchall elements and not just the first viable candidate. Otherwise, we get: WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..] Fixes: 628bd3e49cba ("netfilter: nf_tables: drop map element references from preparation phase") Reported-by: Yiming Qian Signed-off-by: Florian Westphal commit b7cdc5a97d02c943f4bdde4d5767ad0c13cad92b Author: Phil Sutter Date: Thu Mar 5 13:01:44 2026 +0100 netfilter: nf_tables: Fix for duplicate device in netdev hooks When handling NETDEV_REGISTER notification, duplicate device registration must be avoided since the device may have been added by nft_netdev_hook_alloc() already when creating the hook. Suggested-by: Florian Westphal Reported-by: syzbot+bb9127e278fa198e110c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bb9127e278fa198e110c Fixes: a331b78a5525 ("netfilter: nf_tables: Respect NETDEV_REGISTER events") Tested-by: Helen Koike Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal commit e3741935a341983885aba1b09c6dfbc9e6ff5466 Author: James Clark Date: Fri Mar 6 14:08:35 2026 +0000 perf cs-etm: Sync coresight-pmu.h header with the kernel sources Update the header to pull in the changes from commit 3285c471d0c0b991 ("coresight: Remove misleading definitions"). Signed-off-by: James Clark Requested-by: Arnaldo Carvalho de Melo Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Link: https://lore.kernel.org/r/557db631-aef8-43b1-9f45-fae75910ccb4@linaro.org Signed-off-by: Arnaldo Carvalho de Melo commit 3c3b41e5911db7668e3938eae8df7ed80c76c153 Author: James Clark Date: Fri Mar 6 14:08:34 2026 +0000 perf cs-etm: Finish removal of ETM_OPT_* These #defines have been removed from the kernel headers in favour of the string based PMU format attributes. Usages were previously removed from the recording side of cs-etm in Perf. Finish the removal by removing usages from the decode side too. It's a straight replacement of the old #defines with the new register bit definitions. Except cs_etm__setup_timeless_decoding() which wasn't looking at the saved metadata and was instead hard coding an access to 'attr.config'. This was vulnerable to the same issue of .config being moved to .config2 etc that the original removal of ETM_OPT_* tried to fix. So fix that too. Signed-off-by: James Clark Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 59bdbabccaa470ed94aae7d94a1229c7b0ff4681 Author: Andrzej Kacprowski Date: Thu Mar 5 15:22:26 2026 +0100 accel/ivpu: Remove boot params address setting via MMIO register The NPU 60XX uses the default boot params location specified in the firmware image header, consistent with earlier generations. Remove the unnecessary MMIO register write, freeing the AON register for future use. Fixes: 44e4c88951fa ("accel/ivpu: Implement warm boot flow for NPU6 and unify boot handling") Signed-off-by: Andrzej Kacprowski Reviewed-by: Karol Wachowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260305142226.194995-1-andrzej.kacprowski@linux.intel.com (cherry picked from commit 81e62e7bf8b9309bf0febdf00940818f98bc23d8) Signed-off-by: Thomas Zimmermann commit 6f1a9140ecda3baba3d945b9a6155af4268aafc4 Author: Weiming Shi Date: Sat Mar 7 00:01:34 2026 +0800 net: add xmit recursion limit to tunnel xmit functions Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves, and those GRE tunnels route back through the bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing kernel stack overflow. The existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not sufficient because tunnel recursion involves route lookups and full IP output, consuming much more stack per level. Use a lower limit of 4 (IP_TUNNEL_RECURSION_LIMIT) to prevent overflow. Add recursion detection using dev_xmit_recursion helpers directly in iptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel paths including UDP encapsulated tunnels (VXLAN, Geneve, etc.). Move dev_xmit_recursion helpers from net/core/dev.h to public header include/linux/netdevice.h so they can be used by tunnel code. BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160 Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11 Workqueue: mld mld_ifc_work Call Trace: __build_flow_key.constprop.0 (net/ipv4/route.c:515) ip_rt_update_pmtu (net/ipv4/route.c:1073) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) mld_sendpack mld_ifc_work process_one_work worker_thread Fixes: 745e20f1b626 ("net: add a recursion limit in xmit path") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Link: https://patch.msgid.link/20260306160133.3852900-2-bestswngs@gmail.com Signed-off-by: Paolo Abeni commit a5f930eebde6f27c1e404f566c09332f42f349fb Author: Dongsheng Yang Date: Tue Mar 10 07:05:14 2026 +0000 MAINTAINERS: update email address of Dongsheng Yang My easystack email will be unreachable soon, update my email address to linux.dev one. Signed-off-by: Dongsheng Yang Signed-off-by: Ilya Dryomov commit c4c22b846eceff05b1129b8844a80310e55a7f87 Author: Ilya Dryomov Date: Sun Mar 8 20:01:27 2026 +0100 libceph: reject preamble if control segment is empty While head_onwire_len() has a branch to handle ctrl_len == 0 case, prepare_read_control() always sets up a kvec for the CRC meaning that a non-empty control segment is effectively assumed. All frames that clients deal with meet that assumption, so let's make it official and treat the preamble with an empty control segment as malformed. Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov Reviewed-by: Alex Markuze commit a5a373705081d7cc6363e16990e2361b0b362314 Author: Ilya Dryomov Date: Sun Mar 8 17:57:23 2026 +0100 libceph: admit message frames only in CEPH_CON_S_OPEN state Similar checks are performed for all control frames, but an early check for message frames was missing. process_message() is already set up to terminate the loop in case the state changes while con->ops->dispatch() handler is being executed. Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov Reviewed-by: Alex Markuze Reviewed-by: Viacheslav Dubeyko commit 69fb5d91bba44ecf7eb80530b85fa4fb028921d5 Author: Ilya Dryomov Date: Sun Mar 8 17:38:00 2026 +0100 libceph: prevent potential out-of-bounds reads in process_message_header() If the message frame is (maliciously) corrupted in a way that the length of the control segment ends up being less than the size of the message header or a different frame is made to look like a message frame, out-of-bounds reads may ensue in process_message_header(). Perform an explicit bounds check before decoding the message header. Cc: stable@vger.kernel.org Reported-by: Raphael Zimmer Signed-off-by: Ilya Dryomov Reviewed-by: Alex Markuze Reviewed-by: Viacheslav Dubeyko commit 3228835877e77200a8c16f26b22017f850f8b0c3 Merge: 7d86aa41c073c4 a8ba129af46856 Author: Paolo Abeni Date: Tue Mar 10 12:07:08 2026 +0100 Merge branch 'amd-xgbe-rx-adaptation-and-phy-handling-fixes' Raju Rangoju says: ==================== amd-xgbe: RX adaptation and PHY handling fixes This series fixes several issues in the amd-xgbe driver related to RX adaptation and PHY handling in 10GBASE-KR mode, particularly when auto-negotiation is disabled. Patch 1 fixes link status handling during RX adaptation by correctly reading the latched link status bit so transient link drops are detected without losing the current state. Patch 2 prevents CRC errors that can occur when performing RX adaptation with auto-negotiation turned off. The driver now stops TX/RX before re-triggering RX adaptation and only re-enables traffic once adaptation completes and the link is confirmed up, ensuring packets are not corrupted during the adaptation window. Patch 3 restores the intended ordering of PHY reset relative to phy_start(), making sure PHY settings are reset before the PHY is started instead of afterwards. ==================== Link: https://patch.msgid.link/20260306111629.1515676-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit a8ba129af46856112981c124850ec6a85a1c1ab6 Author: Raju Rangoju Date: Fri Mar 6 16:46:29 2026 +0530 amd-xgbe: reset PHY settings before starting PHY commit f93505f35745 ("amd-xgbe: let the MAC manage PHY PM") moved xgbe_phy_reset() from xgbe_open() to xgbe_start(), placing it after phy_start(). As a result, the PHY settings were being reset after the PHY had already started. Reorder the calls so that the PHY settings are reset before phy_start() is invoked. Fixes: f93505f35745 ("amd-xgbe: let the MAC manage PHY PM") Reviewed-by: Maxime Chevallier Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260306111629.1515676-4-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 27a4dd0c702b3b2b9cf2c045d100cc2fe8720b81 Author: Raju Rangoju Date: Fri Mar 6 16:46:28 2026 +0530 amd-xgbe: prevent CRC errors during RX adaptation with AN disabled When operating in 10GBASE-KR mode with auto-negotiation disabled and RX adaptation enabled, CRC errors can occur during the RX adaptation process. This happens because the driver continues transmitting and receiving packets while adaptation is in progress. Fix this by stopping TX/RX immediately when the link goes down and RX adaptation needs to be re-triggered, and only re-enabling TX/RX after adaptation completes and the link is confirmed up. Introduce a flag to track whether TX/RX was disabled for adaptation so it can be restored correctly. This prevents packets from being transmitted or received during the RX adaptation window and avoids CRC errors from corrupted frames. The flag tracking the data path state is synchronized with hardware state in xgbe_start() to prevent stale state after device restarts. This ensures that after a restart cycle (where xgbe_stop disables TX/RX and xgbe_start re-enables them), the flag correctly reflects that the data path is active. Fixes: 4f3b20bfbb75 ("amd-xgbe: add support for rx-adaptation") Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260306111629.1515676-3-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 6485cb96be5cd0f4bf39554737ba11322cc9b053 Author: Raju Rangoju Date: Fri Mar 6 16:46:27 2026 +0530 amd-xgbe: fix link status handling in xgbe_rx_adaptation The link status bit is latched low to allow detection of momentary link drops. If the status indicates that the link is already down, read it again to obtain the current state. Fixes: 4f3b20bfbb75 ("amd-xgbe: add support for rx-adaptation") Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260306111629.1515676-2-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 8cc7dd77a1466f0ec58c03478b2e735a5b289b96 Author: Shashank Balaji Date: Fri Mar 6 14:46:28 2026 +0900 x86/apic: Disable x2apic on resume if the kernel expects so When resuming from s2ram, firmware may re-enable x2apic mode, which may have been disabled by the kernel during boot either because it doesn't support IRQ remapping or for other reasons. This causes the kernel to continue using the xapic interface, while the hardware is in x2apic mode, which causes hangs. This happens on defconfig + bare metal + s2ram. Fix this in lapic_resume() by disabling x2apic if the kernel expects it to be disabled, i.e. when x2apic_mode = 0. The ACPI v6.6 spec, Section 16.3 [1] says firmware restores either the pre-sleep configuration or initial boot configuration for each CPU, including MSR state: When executing from the power-on reset vector as a result of waking from an S2 or S3 sleep state, the platform firmware performs only the hardware initialization required to restore the system to either the state the platform was in prior to the initial operating system boot, or to the pre-sleep configuration state. In multiprocessor systems, non-boot processors should be placed in the same state as prior to the initial operating system boot. (further ahead) If this is an S2 or S3 wake, then the platform runtime firmware restores minimum context of the system before jumping to the waking vector. This includes: CPU configuration. Platform runtime firmware restores the pre-sleep configuration or initial boot configuration of each CPU (MSR, MTRR, firmware update, SMBase, and so on). Interrupts must be disabled (for IA-32 processors, disabled by CLI instruction). (and other things) So at least as per the spec, re-enablement of x2apic by the firmware is allowed if "x2apic on" is a part of the initial boot configuration. [1] https://uefi.org/specs/ACPI/6.6/16_Waking_and_Sleeping.html#initialization [ bp: Massage. ] Fixes: 6e1cb38a2aef ("x64, x2apic/intr-remap: add x2apic support, including enabling interrupt-remapping") Co-developed-by: Rahul Bukte Signed-off-by: Rahul Bukte Signed-off-by: Shashank Balaji Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Thomas Gleixner Reviewed-by: Sohil Mehta Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260306-x2apic-fix-v2-1-bee99c12efa3@sony.com commit 7d86aa41c073c4e7eb75fd2e674f1fd8f289728a Author: Chengfeng Ye Date: Fri Mar 6 03:14:02 2026 +0000 mctp: route: hold key->lock in mctp_flow_prepare_output() mctp_flow_prepare_output() checks key->dev and may call mctp_dev_set_key(), but it does not hold key->lock while doing so. mctp_dev_set_key() and mctp_dev_release_key() are annotated with __must_hold(&key->lock), so key->dev access is intended to be serialized by key->lock. The mctp_sendmsg() transmit path reaches mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output() without holding key->lock, so the check-and-set sequence is racy. Example interleaving: CPU0 CPU1 ---- ---- mctp_flow_prepare_output(key, devA) if (!key->dev) // sees NULL mctp_flow_prepare_output( key, devB) if (!key->dev) // still NULL mctp_dev_set_key(devB, key) mctp_dev_hold(devB) key->dev = devB mctp_dev_set_key(devA, key) mctp_dev_hold(devA) key->dev = devA // overwrites devB Now both devA and devB references were acquired, but only the final key->dev value is tracked for release. One reference can be lost, causing a resource leak as mctp_dev_release_key() would only decrease the reference on one dev. Fix by taking key->lock around the key->dev check and mctp_dev_set_key() call. Fixes: 67737c457281 ("mctp: Pass flow data & flow release events to drivers") Signed-off-by: Chengfeng Ye Link: https://patch.msgid.link/20260306031402.857224-1-dg573847474@gmail.com Signed-off-by: Paolo Abeni commit 950803f7254721c1c15858fbbfae3deaaeeecb11 Author: Jiayuan Chen Date: Fri Mar 6 10:15:07 2026 +0800 bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900 RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000 R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780 R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0 Call Trace: ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900 dev_hard_header include/linux/netdevice.h:3439 [inline] packet_snd net/packet/af_packet.c:3028 [inline] packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646 __sys_sendmsg+0x170/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe1a0e6c1a9 When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond, bond_setup_by_slave() directly copies the slave's header_ops to the bond device: bond_dev->header_ops = slave_dev->header_ops; This causes a type confusion when dev_hard_header() is later called on the bond device. Functions like ipgre_header(), ip6gre_header(),all use netdev_priv(dev) to access their device-specific private data. When called with the bond device, netdev_priv() returns the bond's private data (struct bonding) instead of the expected type (e.g. struct ip_tunnel), leading to garbage values being read and kernel crashes. Fix this by introducing bond_header_ops with wrapper functions that delegate to the active slave's header_ops using the slave's own device. This ensures netdev_priv() in the slave's header functions always receives the correct device. The fix is placed in the bonding driver rather than individual device drivers, as the root cause is bond blindly inheriting header_ops from the slave without considering that these callbacks expect a specific netdev_priv() layout. The type confusion can be observed by adding a printk in ipgre_header() and running the following commands: ip link add dummy0 type dummy ip addr add 10.0.0.1/24 dev dummy0 ip link set dummy0 up ip link add gre1 type gre local 10.0.0.1 ip link add bond1 type bond mode active-backup ip link set gre1 master bond1 ip link set gre1 up ip link set bond1 up ip addr add fe80::1/64 dev bond1 Fixes: 1284cd3a2b74 ("bonding: two small fixes for IPoIB support") Suggested-by: Jay Vosburgh Reviewed-by: Eric Dumazet Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260306021508.222062-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 47bba09b14fa21712398febf36cb14fd4fc3bded Author: Wenyuan Li <2063309626@qq.com> Date: Tue Mar 10 13:08:44 2026 +0800 can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value In hi3110_open(), the return value of hi3110_power_enable() is not checked. If power enable fails, the device may not function correctly, while the driver still returns success. Add a check for the return value and propagate the error accordingly. Signed-off-by: Wenyuan Li <2063309626@qq.com> Link: https://patch.msgid.link/tencent_B5E2E7528BB28AA8A2A56E16C49BD58B8B07@qq.com Fixes: 57e83fb9b746 ("can: hi311x: Add Holt HI-311x CAN driver") [mkl: adjust subject, commit message and jump label] Signed-off-by: Marc Kleine-Budde commit 1eea46908c57abb7109b1fce024f366ae6c69c4f Author: Haibo Chen Date: Fri Mar 6 17:04:48 2026 +0800 can: dev: keep the max bitrate error at 5% Commit b360a13d44db ("can: dev: print bitrate error with two decimal digits") changed calculation of the bit rate error from on-tenth of a percent to on-hundredth of a percent, but forgot to adjust the scale of the CAN_CALC_MAX_ERROR constant. Keeping the existing logic unchanged: Only when the bitrate error exceeds 5% should an error be returned. Otherwise, simply output a warning log. Fixes: b360a13d44db ("can: dev: print bitrate error with two decimal digits") Signed-off-by: Haibo Chen Link: https://patch.msgid.link/20260306-can-fix-v1-1-ac526cec6777@nxp.com Cc: stable@kernel.org [mkl: improve commit message] Signed-off-by: Marc Kleine-Budde commit e3f5e0f22cfc2371e7471c9fd5b4da78f9df7c69 Author: Haiyue Wang Date: Thu Mar 5 22:32:34 2026 +0800 mctp: i2c: fix skb memory leak in receive path When 'midev->allow_rx' is false, the newly allocated skb isn't consumed by netif_rx(), it needs to free the skb directly. Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver") Signed-off-by: Haiyue Wang Link: https://patch.msgid.link/20260305143240.97592-1-haiyuewa@163.com Signed-off-by: Paolo Abeni commit 8dafa9f5900c4855a65dbfee51e3bd00636deee1 Author: Harry Yoo Date: Mon Mar 9 16:22:19 2026 +0900 mm/slab: fix an incorrect check in obj_exts_alloc_size() obj_exts_alloc_size() prevents recursive allocation of slabobj_ext array from the same cache, to avoid creating slabs that are never freed. There is one mistake that returns the original size when memory allocation profiling is disabled. The assumption was that memcg-triggered slabobj_ext allocation is always served from KMALLOC_CGROUP type. But this is wrong [1]: when the caller specifies both __GFP_RECLAIMABLE and __GFP_ACCOUNT with SLUB_TINY enabled, the allocation is served from normal kmalloc. This is because kmalloc_type() prioritizes __GFP_RECLAIMABLE over __GFP_ACCOUNT, and SLUB_TINY aliases KMALLOC_RECLAIM with KMALLOC_NORMAL. As a result, the recursion guard is bypassed and the problematic slabs can be created. Fix this by removing the mem_alloc_profiling_enabled() check entirely. The remaining is_kmalloc_normal() check is still sufficient to detect whether the cache is of KMALLOC_NORMAL type and avoid bumping the size if it's not. Without SLUB_TINY, no functional change intended. With SLUB_TINY, allocations with __GFP_ACCOUNT|__GFP_RECLAIMABLE now allocate a larger array if the sizes equal. Reported-by: Zw Tang Fixes: 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from its own slab") Closes: https://lore.kernel.org/linux-mm/CAPHJ_VKuMKSke8b11AZQw1PTSFN4n2C0gFxC6xGOG0ZLHgPmnA@mail.gmail.com [1] Cc: stable@vger.kernel.org Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260309072219.22653-1-harry.yoo@oracle.com Tested-by: Zw Tang Signed-off-by: Vlastimil Babka (SUSE) commit a79f7b4aeb8e7562cd6dbf9c223e2c2a04b1a85f Author: Marc Zyngier Date: Tue Mar 10 08:54:33 2026 +0000 KVM: arm64: pkvm: Don't reprobe for ICH_VTR_EL2.TDS on CPU hotplug Hotplugging a CPU off and back on fails with pKVM, as we try to probe for ICH_VTR_EL2.TDS. In a non-VHE setup, this is achieved by using an EL2 stub helper. However, the stubs are out of reach once pKVM has deprivileged the kernel. The CPU never boots. Since pKVM doesn't allow late onlining of CPUs, we can detect that protected mode is enforced early on, and return the current state of the capability. Fixes: 2a28810cbb8b2 ("KVM: arm64: GICv3: Detect and work around the lack of ICV_DIR_EL1 trapping") Reported-by: Vincent Donnefort Tested-by: Vincent Donnefort Reviewed-by: Suzuki K Poulose Signed-off-by: Marc Zyngier Link: https://patch.msgid.link/20260310085433.3936742-1-maz@kernel.org Cc: stable@vger.kernel.org commit fdfd103aec837fc318fbd381cc65990ad7b62e5b Merge: 0d9a60a0618d25 dbe17e7783cb5d Author: Paolo Abeni Date: Tue Mar 10 10:36:48 2026 +0100 Merge branch 'net-enetc-fix-fallback-phy-address-handling-and-do-not-skip-setting-for-addr-0' Wei Fang says: ==================== net: enetc: fix fallback PHY address handling and do not skip setting for addr 0 There are two potential issues when PHY address 0 is used on the board, see the commit messages of the patches for more details. v1: https://lore.kernel.org/imx/20260303103047.228005-1-wei.fang@nxp.com/ ==================== Link: https://patch.msgid.link/20260305031211.904812-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit dbe17e7783cb5d6451ff1217d0464865857e97e1 Author: Wei Fang Date: Thu Mar 5 11:12:11 2026 +0800 net: enetc: do not skip setting LaBCR[MDIO_PHYAD_PRTAD] for addr 0 Given that some platforms may use PHY address 0 (I suppose the PHY may not treat address 0 as a broadcast address or default response address). It is possible for some boards to connect multiple PHYs to the same ENETC MAC, for example: - a PHY with a non-zero address connects to ENETC MAC through SGMII interface (selected via DTS_A) - a PHY with address 0 connects to ENETC MAC through RGMII interface (selected via DTS_B) For the case where the ENETC port MDIO is used to manage the PHY, when switching from DTS_A to DTS_B via soft reboot, LaBCR[MDIO_PHYAD_PRTAD] must be updated to 0 because the NETCMIX block is not reset during soft reboot. However, the current driver explicitly skips configuring address 0, causing LaBCR[MDIO_PHYAD_PRTAD] to retain its old value. Therefore, remove the special-case skip of PHY address 0 so that valid configurations using address 0 are properly supported. Fixes: 6633df05f3ad ("net: enetc: set the external PHY address in IERB for port MDIO usage") Fixes: 50bfd9c06f0f ("net: enetc: set external PHY address in IERB for i.MX94 ENETC") Reviewed-by: Clark Wang Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260305031211.904812-3-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 246953f33e8cf95621d6c00332e2780ce1594082 Author: Wei Fang Date: Thu Mar 5 11:12:10 2026 +0800 net: enetc: fix incorrect fallback PHY address handling The current netc_get_phy_addr() implementation falls back to PHY address 0 when the "mdio" node or the PHY child node is missing. On i.MX95, this causes failures when a real PHY is actually assigned address 0 and is managed through the EMDIO interface. Because the bit 0 of phy_mask will be set, leading imx95_enetc_mdio_phyaddr_config() to return an error, and the netc_blk_ctrl driver probe subsequently fails. Fix this by returning -ENODEV when neither an "mdio" node nor any PHY node is present, it means that ENETC port MDIO is not used to manage the PHY, so there is no need to configure LaBCR[MDIO_PHYAD_PRTAD]. Reported-by: Alexander Stein Closes: https://lore.kernel.org/all/7825188.GXAFRqVoOG@steina-w Fixes: 6633df05f3ad ("net: enetc: set the external PHY address in IERB for port MDIO usage") Reviewed-by: Clark Wang Tested-by: Alexander Stein Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260305031211.904812-2-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit fb22bb9701d48c4b0e81fe204c2f96a37a520568 Author: Dmitry Torokhov Date: Wed Feb 18 12:58:09 2026 -0800 pinctrl: renesas: rza1: Normalize return value of gpio_get() The GPIO .get() callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by rza1_gpio_get() is normalized to the [0, 1] range. Fixes: 86ef402d805d606a ("gpiolib: sanitize the return value of gpio_chip::get()") Signed-off-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Reviewed-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/aZYnyl-Nf4S1U2yj@google.com Signed-off-by: Geert Uytterhoeven commit 263447532463cf4444a3595e835b99a4e90952fa Author: Neil Armstrong Date: Wed Mar 4 18:41:08 2026 +0100 pinctrl: qcom: spmi-gpio: implement .get_direction() GPIO controller driver should typically implement the .get_direction() callback as GPIOLIB internals may try to use it to determine the state of a pin. Since introduction of shared proxy, it prints a warning splat when using a shared spmi gpio. The implementation is not easy because the controller supports enabling the input and output logic at the same time, so we aligns on the behaviour of the .get() operation and return -EINVAL in other situations. Fixes: eadff3024472 ("pinctrl: Qualcomm SPMI PMIC GPIO pin controller driver") Fixes: d7b5f5cc5eb4 ("pinctrl: qcom: spmi-gpio: Add support for GPIO LV/MV subtype") Signed-off-by: Neil Armstrong Reviewed-by: Konrad Dybcio Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 186ac39b8a7d3ec7ce9c5dd45e5c2730177f375c Author: Long Li Date: Thu Mar 5 16:49:22 2026 +0800 xfs: ensure dquot item is deleted from AIL only after log shutdown In xfs_qm_dqflush(), when a dquot flush fails due to corruption (the out_abort error path), the original code removed the dquot log item from the AIL before calling xfs_force_shutdown(). This ordering introduces a subtle race condition that can lead to data loss after a crash. The AIL tracks the oldest dirty metadata in the journal. The position of the tail item in the AIL determines the log tail LSN, which is the oldest LSN that must be preserved for crash recovery. When an item is removed from the AIL, the log tail can advance past the LSN of that item. The race window is as follows: if the dquot item happens to be at the tail of the log, removing it from the AIL allows the log tail to advance. If a concurrent log write is sampling the tail LSN at the same time and subsequently writes a complete checkpoint (i.e., one containing a commit record) to disk before the shutdown takes effect, the journal will no longer protect the dquot's last modification. On the next mount, log recovery will not replay the dquot changes, even though they were never written back to disk, resulting in silent data loss. Fix this by calling xfs_force_shutdown() before xfs_trans_ail_delete() in the out_abort path. Once the log is shut down, no new log writes can complete with an updated tail LSN, making it safe to remove the dquot item from the AIL. Cc: stable@vger.kernel.org Fixes: b707fffda6a3 ("xfs: abort consistently on dquot flush failure") Signed-off-by: Long Li Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit f1d77b863b414586ee45e10d9837c9ab27d8692d Author: Long Li Date: Thu Mar 5 16:49:21 2026 +0800 xfs: remove redundant set null for ip->i_itemp ip->i_itemp has been set null in xfs_inode_item_destroy(), so there is no need set it null again in xfs_inode_free_callback(). Signed-off-by: Long Li Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit df1d8abf36ca3681c21a6809eaa9a1e01ef897a6 Author: Takashi Iwai Date: Mon Mar 9 11:46:27 2026 +0100 ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces The Scarlett2 mixer quirk in USB-audio driver may hit a NULL dereference when a malformed USB descriptor is passed, since it assumes the presence of an endpoint in the parsed interface in scarlett2_find_fc_interface(), as reported by fuzzer. For avoiding the NULL dereference, just add the sanity check of bNumEndpoints and skip the invalid interface. Reported-by: syzbot+8f29539ef9a1c8334f42@syzkaller.appspotmail.com Closes: https://lore.kernel.org/69acbbe1.050a0220.310d8.0001.GAE@google.com Reported-by: syzbot+ae893a8901067fde2741@syzkaller.appspotmail.com Closes: https://lore.kernel.org/69acf72a.050a0220.310d8.0004.GAE@google.com Cc: Link: https://patch.msgid.link/20260309104632.141895-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 335b237d902c7362cb7228802e68374406b24acf Author: Arun R Murthy Date: Wed Mar 4 12:51:57 2026 +0530 drm/i915/dp: Read ALPM caps after DPCD init For eDP read the ALPM DPCD caps after DPCD initalization and just before the PSR init. v2: Move intel_alpm_init to intel_edp_init_dpcd (Jouni) v3: Add Fixes with commit-id (Jouni) v4: Separated the alpm dpcd read caps from alpm_init and moved to intel_edp_init_dpcd. v5: Read alpm_caps always for eDP irrespective of the eDP version (Jouni) v6: replace drm_dp_dpcd_readb with drm_dp_dpcd_read_byte (Jouni) Fixes: 15438b325987 ("drm/i915/alpm: Add compute config for lobf") Signed-off-by: Arun R Murthy Reviewed-by: Animesh Manna Reviewed-by: Jouni Högander Signed-off-by: Animesh Manna Link: https://patch.msgid.link/20260304072157.1123283-1-arun.r.murthy@intel.com (cherry picked from commit 88442ba208dd5d3405de3f5000cf5b2c86876ae3) Signed-off-by: Tvrtko Ursulin commit 5923a6e0459fdd3edac4ad5abccb24d777d8f1b6 Author: Jouni Högander Date: Wed Mar 4 13:30:11 2026 +0200 drm/i915/psr: Write DSC parameters on Selective Update in ET mode There are slice row per frame and pic height parameters in DSC that needs to be configured on every Selective Update in Early Transport mode. Use helper provided by DSC code to configure these on Selective Update when in Early Transport mode. Also fill crtc_state->psr2_su_area with full frame area on full frame update for DSC calculation. v2: move psr2_su_area under skip_sel_fetch_set_loop label Bspec: 68927, 71709 Fixes: 467e4e061c44 ("drm/i915/psr: Enable psr2 early transport as possible") Cc: # v6.9+ Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260304113011.626542-5-jouni.hogander@intel.com (cherry picked from commit 3140af2fab505a4cd47d516284529bf1585628be) Signed-off-by: Tvrtko Ursulin commit bb5f1cd10101c2567bff4d0e760b74aee7c42f44 Author: Jouni Högander Date: Wed Mar 4 13:30:10 2026 +0200 drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters There are slice row per frame and pic height configuration in DSC Selective Update Parameter Set 1 register. Add helper for configuring these. v2: - Add WARN_ON_ONCE if vdsc instances per pipe > 2 - instead of checking vdsc instances per pipe being > 1 check == 2 Bspec: 71709 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260304113011.626542-4-jouni.hogander@intel.com (cherry picked from commit c8698d61aeb3f70fe33761ee9d3d0e131b5bc2eb) Signed-off-by: Tvrtko Ursulin [tursulin: fixup forward declaration conflict] commit c2c79c6d5b939ae8a42ddb884f576bddae685672 Author: Jouni Högander Date: Wed Mar 4 13:30:09 2026 +0200 drm/i915/dsc: Add Selective Update register definitions Add definitions for DSC_SU_PARAMETER_SET_0_DSC0 and DSC_SU_PARAMETER_SET_0_DSC1 registers. These are for Selective Update Early Transport configuration. Bspec: 71709 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260304113011.626542-3-jouni.hogander@intel.com (cherry picked from commit 24f96d903daf3dcf8fafe84d3d22b80ef47ba493) Signed-off-by: Tvrtko Ursulin commit 1be2fca84f520105413d0d89ed04bb0ff742ab16 Author: Jouni Högander Date: Wed Mar 4 13:30:08 2026 +0200 drm/i915/psr: Repeat Selective Update area alignment Currently we are aligning Selective Update area to cover cursor fully if needed only once. It may happen that cursor is in Selective Update area after pipe alignment and after that covering cursor plane only partially. Fix this by looping alignment as long as alignment isn't needed anymore. v2: - do not unecessarily loop if cursor was already fully covered - rename aligned as su_area_changed Fixes: 1bff93b8bc27 ("drm/i915/psr: Extend SU area to cover cursor fully if needed") Cc: # v6.9+ Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20260304113011.626542-2-jouni.hogander@intel.com (cherry picked from commit 681e12440d8b110350a5709101169f319e10ccbb) Signed-off-by: Tvrtko Ursulin commit 029ae067431ab9d0fca479bdabe780fa436706ea Author: Janusz Krzysztofik Date: Tue Feb 24 10:49:06 2026 +0100 drm/i915: Fix potential overflow of shmem scatterlist length When a scatterlists table of a GEM shmem object of size 4 GB or more is populated with pages allocated from a folio, unsigned int .length attribute of a scatterlist may get overflowed if total byte length of pages allocated to that single scatterlist happens to reach or cross the 4GB limit. As a consequence, users of the object may suffer from hitting unexpected, premature end of the object's backing pages. [278.780187] ------------[ cut here ]------------ [278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915] ... [278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S U 6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary) [278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER [278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024 [278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915] ... [278.780786] Call Trace: [278.780787] [278.780788] ? __apply_to_page_range+0x3e6/0x910 [278.780795] ? __pfx_remap_sg+0x10/0x10 [i915] [278.780906] apply_to_page_range+0x14/0x30 [278.780908] remap_io_sg+0x14d/0x260 [i915] [278.781013] vm_fault_cpu+0xd2/0x330 [i915] [278.781137] __do_fault+0x3a/0x1b0 [278.781140] do_fault+0x322/0x640 [278.781143] __handle_mm_fault+0x938/0xfd0 [278.781150] handle_mm_fault+0x12c/0x300 [278.781152] ? lock_mm_and_find_vma+0x4b/0x760 [278.781155] do_user_addr_fault+0x2d6/0x8e0 [278.781160] exc_page_fault+0x96/0x2c0 [278.781165] asm_exc_page_fault+0x27/0x30 ... That issue was apprehended by the author of a change that introduced it, and potential risk even annotated with a comment, but then never addressed. When adding folio pages to a scatterlist table, take care of byte length of any single scatterlist not exceeding max_segment. Fixes: 0b62af28f249b ("i915: convert shmem_sg_free_table() to use a folio_batch") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14809 Cc: Matthew Wilcox (Oracle) Cc: Andrew Morton Cc: stable@vger.kernel.org # v6.5+ Signed-off-by: Janusz Krzysztofik Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260224094944.2447913-2-janusz.krzysztofik@linux.intel.com (cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60) Signed-off-by: Tvrtko Ursulin commit 237aab549676288d9255bb8dcc284738e56eaa31 Author: Ville Syrjälä Date: Tue Mar 3 11:54:14 2026 +0200 drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL Apparently ICL may hang with an MCE if we write TRANS_VRR_VMAX/FLIPLINE before enabling TRANS_DDI_FUNC_CTL. Personally I was only able to reproduce a hang (on an Dell XPS 7390 2-in-1) with an external display connected via a dock using a dodgy type-C cable that made the link training fail. After the failed link training the machine would hang. TGL seemed immune to the problem for whatever reason. BSpec does tell us to configure VRR after enabling TRANS_DDI_FUNC_CTL as well. The DMC firmware also does the VRR restore in two stages: - first stage seems to be unconditional and includes TRANS_VRR_CTL and a few other VRR registers, among other things - second stage is conditional on the DDI being enabled, and includes TRANS_DDI_FUNC_CTL and TRANS_VRR_VMAX/VMIN/FLIPLINE, among other things So let's reorder the steps to match to avoid the hang, and toss in an extra WARN to make sure we don't screw this up later. BSpec: 22243 Cc: stable@vger.kernel.org Cc: Ankit Nautiyal Reported-by: Benjamin Tissoires Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15777 Tested-by: Benjamin Tissoires Fixes: dda7dcd9da73 ("drm/i915/vrr: Use fixed timings for platforms that support VRR") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260303095414.4331-1-ville.syrjala@linux.intel.com Reviewed-by: Ankit Nautiyal (cherry picked from commit 93f3a267c3dd4d811b224bb9e179a10d81456a74) Signed-off-by: Tvrtko Ursulin commit 0d9a60a0618d255530ca56072c5f39eb58e1ed4a Author: Pavan Chebbi Date: Fri Mar 6 14:58:54 2026 -0800 bnxt_en: Fix RSS table size check when changing ethtool channels When changing channels, the current check in bnxt_set_channels() is not checking for non-default RSS contexts when the RSS table size changes. The current check for IFF_RXFH_CONFIGURED is only sufficient for the default RSS context. Expand the check to include the presence of any non-default RSS contexts. Allowing such change will result in incorrect configuration of the context's RSS table when the table size changes. Fixes: b3d0083caf9a ("bnxt_en: Support RSS contexts in ethtool .{get|set}_rxfh()") Reported-by: Björn Töpel Link: https://lore.kernel.org/netdev/20260303181535.2671734-1-bjorn@kernel.org/ Reviewed-by: Andy Gospodarek Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20260306225854.3575672-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 183f682591a932cf80a85bfc7ad748f5d90c2de7 Merge: 7a85d370bbd0d5 312c816c6bc303 Author: Jakub Kicinski Date: Mon Mar 9 19:48:39 2026 -0700 Merge branch 'net-usb-lan78xx-accumulated-bug-fixes' Oleksij Rempel says: ==================== net: usb: lan78xx: accumulated bug fixes This series contains a collection of standalone bug fixes for the Microchip LAN78xx driver, addressing packet handling, TX statistics, invalid register accesses, and a kernel warning during disconnect. ==================== Link: https://patch.msgid.link/20260305143429.530909-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 312c816c6bc30342bc30dca0d6db617ab4d3ae4e Author: Oleksij Rempel Date: Thu Mar 5 15:34:29 2026 +0100 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect Remove redundant netif_napi_del() call from disconnect path. A WARN may be triggered in __netif_napi_del_locked() during USB device disconnect: WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 This happens because netif_napi_del() is called in the disconnect path while NAPI is still enabled. However, it is not necessary to call netif_napi_del() explicitly, since unregister_netdev() will handle NAPI teardown automatically and safely. Removing the redundant call avoids triggering the warning. Full trace: lan78xx 1-1:1.0 enu1: Failed to read register index 0x000000c4. ret = -ENODEV lan78xx 1-1:1.0 enu1: Failed to set MAC down with error -ENODEV lan78xx 1-1:1.0 enu1: Link is Down lan78xx 1-1:1.0 enu1: Failed to read register index 0x00000120. ret = -ENODEV ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 Modules linked in: flexcan can_dev fuse CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.0-rc2-00624-ge926949dab03 #9 PREEMPT Hardware name: SKOV IMX8MP CPU revC - bd500 (DT) Workqueue: usb_hub_wq hub_event pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __netif_napi_del_locked+0x2b4/0x350 lr : __netif_napi_del_locked+0x7c/0x350 sp : ffffffc085b673c0 x29: ffffffc085b673c0 x28: ffffff800b7f2000 x27: ffffff800b7f20d8 x26: ffffff80110bcf58 x25: ffffff80110bd978 x24: 1ffffff0022179eb x23: ffffff80110bc000 x22: ffffff800b7f5000 x21: ffffff80110bc000 x20: ffffff80110bcf38 x19: ffffff80110bcf28 x18: dfffffc000000000 x17: ffffffc081578940 x16: ffffffc08284cee0 x15: 0000000000000028 x14: 0000000000000006 x13: 0000000000040000 x12: ffffffb0022179e8 x11: 1ffffff0022179e7 x10: ffffffb0022179e7 x9 : dfffffc000000000 x8 : 0000004ffdde8619 x7 : ffffff80110bcf3f x6 : 0000000000000001 x5 : ffffff80110bcf38 x4 : ffffff80110bcf38 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 1ffffff0022179e7 x0 : 0000000000000000 Call trace: __netif_napi_del_locked+0x2b4/0x350 (P) lan78xx_disconnect+0xf4/0x360 usb_unbind_interface+0x158/0x718 device_remove+0x100/0x150 device_release_driver_internal+0x308/0x478 device_release_driver+0x1c/0x30 bus_remove_device+0x1a8/0x368 device_del+0x2e0/0x7b0 usb_disable_device+0x244/0x540 usb_disconnect+0x220/0x758 hub_event+0x105c/0x35e0 process_one_work+0x760/0x17b0 worker_thread+0x768/0xce8 kthread+0x3bc/0x690 ret_from_fork+0x10/0x20 irq event stamp: 211604 hardirqs last enabled at (211603): [] _raw_spin_unlock_irqrestore+0x84/0x98 hardirqs last disabled at (211604): [] el1_dbg+0x24/0x80 softirqs last enabled at (211296): [] handle_softirqs+0x820/0xbc8 softirqs last disabled at (210993): [] __do_softirq+0x18/0x20 ---[ end trace 0000000000000000 ]--- lan78xx 1-1:1.0 enu1: failed to kill vid 0081/0 Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management") Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20260305143429.530909-5-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7 Author: Oleksij Rempel Date: Thu Mar 5 15:34:28 2026 +0100 net: usb: lan78xx: skip LTM configuration for LAN7850 Do not configure Latency Tolerance Messaging (LTM) on USB 2.0 hardware. The LAN7850 is a High-Speed (USB 2.0) only device and does not support SuperSpeed features like LTM. Currently, the driver unconditionally attempts to configure LTM registers during initialization. On the LAN7850, these registers do not exist, resulting in writes to invalid or undocumented memory space. This issue was identified during a port to the regmap API with strict register validation enabled. While no functional issues or crashes have been observed from these invalid writes, bypassing LTM initialization on the LAN7850 ensures the driver strictly adheres to the hardware's valid register map. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20260305143429.530909-4-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 50988747c30df47b73b787f234f746027cb7ec6c Author: Oleksij Rempel Date: Thu Mar 5 15:34:27 2026 +0100 net: usb: lan78xx: fix TX byte statistics for small packets Account for hardware auto-padding in TX byte counters to reflect actual wire traffic. The LAN7850 hardware automatically pads undersized frames to the minimum Ethernet frame length (ETH_ZLEN, 60 bytes). However, the driver tracks the network statistics based on the unpadded socket buffer length. This results in the tx_bytes counter under-reporting the actual physical bytes placed on the Ethernet wire for small packets (like short ARP or ICMP requests). Use max_t() to ensure the transmission statistics accurately account for the hardware-generated padding. Fixes: d383216a7efe ("lan78xx: Introduce Tx URB processing improvements") Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20260305143429.530909-3-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit e4f774a0cc955ce762aec91c66915a6e15087ab7 Author: Oleksij Rempel Date: Thu Mar 5 15:34:26 2026 +0100 net: usb: lan78xx: fix silent drop of packets with checksum errors Do not drop packets with checksum errors at the USB driver level; pass them to the network stack. Previously, the driver dropped all packets where the 'Receive Error Detected' (RED) bit was set, regardless of the specific error type. This caused packets with only IP or TCP/UDP checksum errors to be dropped before reaching the kernel, preventing the network stack from accounting for them or performing software fallback. Add a mask for hard hardware errors to safely drop genuinely corrupt frames, while allowing checksum-errored frames to pass with their ip_summed field explicitly set to CHECKSUM_NONE. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20260305143429.530909-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 7a85d370bbd0d55791ec57ea8ba13032410e8b9d Author: Eric Dumazet Date: Sat Mar 7 12:06:07 2026 +0000 MAINTAINERS: include/net/tc_wrapper.h belongs to TC subsystem include/net/tc_wrapper.h changes should be reviewed by TC maintainers. Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260307120607.3504191-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b2662e7593e94ae09b1cf7ee5f09160a3612bcb2 Author: Mehul Rao Date: Fri Mar 6 18:38:20 2026 -0500 net: nexthop: fix percpu use-after-free in remove_nh_grp_entry When removing a nexthop from a group, remove_nh_grp_entry() publishes the new group via rcu_assign_pointer() then immediately frees the removed entry's percpu stats with free_percpu(). However, the synchronize_net() grace period in the caller remove_nexthop_from_groups() runs after the free. RCU readers that entered before the publish still see the old group and can dereference the freed stats via nh_grp_entry_stats_inc() -> get_cpu_ptr(nhge->stats), causing a use-after-free on percpu memory. Fix by deferring the free_percpu() until after synchronize_net() in the caller. Removed entries are chained via nh_list onto a local deferred free list. After the grace period completes and all RCU readers have finished, the percpu stats are safely freed. Fixes: f4676ea74b85 ("net: nexthop: Add nexthop group entry stats") Cc: stable@vger.kernel.org Signed-off-by: Mehul Rao Reviewed-by: Eric Dumazet Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260306233821.196789-1-mehulrao@gmail.com Signed-off-by: Jakub Kicinski commit 288598d80a068a0e9281de35bcb4ce495f189e2a Author: Shuangpeng Bai Date: Thu Mar 5 22:40:06 2026 -0500 serial: caif: hold tty->link reference in ldisc_open and ser_release A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port. Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path. With this change applied, the reproducer no longer triggers the UAF in my testing. Link: https://gist.github.com/shuangpengbai/c898debad6bdf170a84be7e6b3d8707f Link: https://lore.kernel.org/netdev/20260301220525.1546355-1-shuangpeng.kernel@gmail.com Fixes: e31d5a05948e ("caif: tty's are kref objects so take a reference") Signed-off-by: Shuangpeng Bai Reviewed-by: Jiayuan Chen Link: https://patch.msgid.link/20260306034006.3395740-1-shuangpeng.kernel@gmail.com Signed-off-by: Jakub Kicinski commit 87d126852158467ab87d5cbc36ccfd3f15464a6c Author: Álvaro Fernández Rojas Date: Fri Mar 6 13:29:55 2026 +0100 net: sfp: improve Huawei MA5671a fixup With the current sfp_fixup_ignore_tx_fault() fixup we ignore the TX_FAULT signal, but we also need to apply sfp_fixup_ignore_los() in order to be able to communicate with the module even if the fiber isn't connected for configuration purposes. This is needed for all the MA5671a firmwares, excluding the FS modded firmware. Fixes: 2069624dac19 ("net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT") Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260306125139.213637-1-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 4185b95f8a42d92d68c49289b4644546b51e252b Author: Sen Wang Date: Sun Mar 8 23:21:09 2026 -0500 ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays graph_util_is_ports0() identifies DPCM front-end (ports@0) vs back-end (ports@1) by calling of_get_child_by_name() to find the first "ports" child and comparing pointers. This relies on child iteration order matching DTS source order. When the DPCM topology comes from a DT overlay, __of_attach_node() inserts new children at the head of the sibling list, reversing the order. of_get_child_by_name() then returns ports@1 instead of ports@0, causing all front-end links to be classified as back-ends. The card registers with no PCM devices. Fix this by matching the unit address directly from the node name instead of relying on sibling order. Fixes: 92939252458f ("ASoC: simple-card-utils: add asoc_graph_is_ports0()") Signed-off-by: Sen Wang Acked-by: Kuninori Morimoto Link: https://patch.msgid.link/20260309042109.2576612-1-sen@ti.com Signed-off-by: Mark Brown commit 634672f9d6d8a75568834be7748685a3eacc406e Merge: 95bc5c225513fc 1bc17c67194716 Author: Mark Brown Date: Tue Mar 10 00:57:27 2026 +0000 ASoC: tegra: Add Tegra238 sound card support Merge series from "Sheetal ." : Add Tegra238 sound card support in the Tegra audio graph card driver, as Tegra238 requires different PLLA and PLLA_OUT0 clock rates compared to other Tegra platforms. commit 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 Author: John Johansen Date: Sun Mar 1 16:10:51 2026 -0800 apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. Fix this by moving the put of i_private referenced data to the correct place which is during inode eviction. Fixes: c961ee5f21b20 ("apparmor: convert from securityfs to apparmorfs for policy ns files") Reported-by: Qualys Security Advisory Reviewed-by: Georgia Garcia Reviewed-by: Maxime Bélair Reviewed-by: Cengiz Can Signed-off-by: John Johansen commit a0b7091c4de45a7325c8780e6934a894f92ac86b Author: John Johansen Date: Tue Feb 24 10:20:02 2026 -0800 apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker can start open()ing one of the rawdata files, and at the same time remove the last reference to this rawdata (by removing the corresponding profile, for example), which frees its struct aa_loaddata; as a result, when seq_rawdata_open() is reached, i_private is a dangling pointer and freed memory is accessed. The rawdata inodes weren't refcounted to avoid a circular refcount and were supposed to be held by the profile rawdata reference. However during profile removal there is a window where the vfs and profile destruction race, resulting in the use after free. Fix this by moving to a double refcount scheme. Where the profile refcount on rawdata is used to break the circular dependency. Allowing for freeing of the rawdata once all inode references to the rawdata are put. Fixes: 5d5182cae401 ("apparmor: move to per loaddata files, instead of replicating in profiles") Reported-by: Qualys Security Advisory Reviewed-by: Georgia Garcia Reviewed-by: Maxime Bélair Reviewed-by: Cengiz Can Tested-by: Salvatore Bonaccorso Signed-off-by: John Johansen commit 39440b137546a3aa383cfdabc605fb73811b6093 Author: John Johansen Date: Fri Oct 17 01:53:00 2025 -0700 apparmor: fix differential encoding verification Differential encoding allows loops to be created if it is abused. To prevent this the unpack should verify that a diff-encode chain terminates. Unfortunately the differential encode verification had two bugs. 1. it conflated states that had gone through check and already been marked, with states that were currently being checked and marked. This means that loops in the current chain being verified are treated as a chain that has already been verified. 2. the order bailout on already checked states compared current chain check iterators j,k instead of using the outer loop iterator i. Meaning a step backwards in states in the current chain verification was being mistaken for moving to an already verified state. Move to a double mark scheme where already verified states get a different mark, than the current chain being kept. This enables us to also drop the backwards verification check that was the cause of the second error as any already verified state is already marked. Fixes: 031dcc8f4e84 ("apparmor: dfa add support for state differential encoding") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: John Johansen commit 6601e13e82841879406bf9f369032656f441a425 Author: John Johansen Date: Fri Nov 7 08:36:04 2025 -0800 apparmor: fix unprivileged local user can do privileged policy management An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface. This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege escalation. The policy management interface can not have its permissions simply changed from 0666 to 0600 because non-root processes need to be able to load policy to different policy namespaces. Instead ensure the task writing the interface has privileges that are a subset of the task that opened the interface. This is already done via policy for confined processes, but unconfined can delegate access to the opened fd, by-passing the usual policy check. Fixes: b7fd2c0340eac ("apparmor: add per policy ns .load, .replace, .remove interface files") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: John Johansen commit 5df0c44e8f5f619d3beb871207aded7c78414502 Author: John Johansen Date: Wed Sep 10 06:22:17 2025 -0700 apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL after 1071 error = aa_unpack(udata, &lh, &ns_name); and if ent->ns_name contains an ns_name in 1089 } else if (ent->ns_name) { then ns_name is assigned the ent->ns_name 1095 ns_name = ent->ns_name; however ent->ns_name is freed at 1262 aa_load_ent_free(ent); and then again when freeing ns_name at 1270 kfree(ns_name); Fix this by NULLing out ent->ns_name after it is transferred to ns_name Fixes: 145a0ef21c8e9 ("apparmor: fix blob compression when ns is forced on a policy load ") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: John Johansen commit d352873bbefa7eb39995239d0b44ccdf8aaa79a4 Author: Massimiliano Pellizzer Date: Thu Jan 29 16:51:11 2026 +0100 apparmor: fix missing bounds check on DEFAULT table in verify_dfa() The verify_dfa() function only checks DEFAULT_TABLE bounds when the state is not differentially encoded. When the verification loop traverses the differential encoding chain, it reads k = DEFAULT_TABLE[j] and uses k as an array index without validation. A malformed DFA with DEFAULT_TABLE[j] >= state_count, therefore, causes both out-of-bounds reads and writes. [ 57.179855] ================================================================== [ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660 [ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993 [ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy) [ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.181563] Call Trace: [ 57.181572] [ 57.181577] dump_stack_lvl+0x5e/0x80 [ 57.181596] print_report+0xc8/0x270 [ 57.181605] ? verify_dfa+0x59a/0x660 [ 57.181608] kasan_report+0x118/0x150 [ 57.181620] ? verify_dfa+0x59a/0x660 [ 57.181623] verify_dfa+0x59a/0x660 [ 57.181627] aa_dfa_unpack+0x1610/0x1740 [ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470 [ 57.181640] unpack_pdb+0x86d/0x46b0 [ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181656] ? aa_unpack_nameX+0x1a8/0x300 [ 57.181659] aa_unpack+0x20b0/0x4c30 [ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181664] ? stack_depot_save_flags+0x33/0x700 [ 57.181681] ? kasan_save_track+0x4f/0x80 [ 57.181683] ? kasan_save_track+0x3e/0x80 [ 57.181686] ? __kasan_kmalloc+0x93/0xb0 [ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130 [ 57.181697] ? policy_update+0x154/0x330 [ 57.181704] aa_replace_profiles+0x15a/0x1dd0 [ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181712] ? aa_loaddata_alloc+0x77/0x140 [ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181717] ? _copy_from_user+0x2a/0x70 [ 57.181730] policy_update+0x17a/0x330 [ 57.181733] profile_replace+0x153/0x1a0 [ 57.181735] ? rw_verify_area+0x93/0x2d0 [ 57.181740] vfs_write+0x235/0xab0 [ 57.181745] ksys_write+0xb0/0x170 [ 57.181748] do_syscall_64+0x8e/0x660 [ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.181765] RIP: 0033:0x7f6192792eb2 Remove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE entries unconditionally. Fixes: 031dcc8f4e84 ("apparmor: dfa add support for state differential encoding") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: Massimiliano Pellizzer Signed-off-by: John Johansen commit 8756b68edae37ff546c02091989a4ceab3f20abd Author: Massimiliano Pellizzer Date: Thu Jan 29 17:08:25 2026 +0100 apparmor: fix side-effect bug in match_char() macro usage The match_char() macro evaluates its character parameter multiple times when traversing differential encoding chains. When invoked with *str++, the string pointer advances on each iteration of the inner do-while loop, causing the DFA to check different characters at each iteration and therefore skip input characters. This results in out-of-bounds reads when the pointer advances past the input buffer boundary. [ 94.984676] ================================================================== [ 94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760 [ 94.985655] Read of size 1 at addr ffff888100342000 by task file/976 [ 94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy) [ 94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.986329] Call Trace: [ 94.986341] [ 94.986347] dump_stack_lvl+0x5e/0x80 [ 94.986374] print_report+0xc8/0x270 [ 94.986384] ? aa_dfa_match+0x5ae/0x760 [ 94.986388] kasan_report+0x118/0x150 [ 94.986401] ? aa_dfa_match+0x5ae/0x760 [ 94.986405] aa_dfa_match+0x5ae/0x760 [ 94.986408] __aa_path_perm+0x131/0x400 [ 94.986418] aa_path_perm+0x219/0x2f0 [ 94.986424] apparmor_file_open+0x345/0x570 [ 94.986431] security_file_open+0x5c/0x140 [ 94.986442] do_dentry_open+0x2f6/0x1120 [ 94.986450] vfs_open+0x38/0x2b0 [ 94.986453] ? may_open+0x1e2/0x2b0 [ 94.986466] path_openat+0x231b/0x2b30 [ 94.986469] ? __x64_sys_openat+0xf8/0x130 [ 94.986477] do_file_open+0x19d/0x360 [ 94.986487] do_sys_openat2+0x98/0x100 [ 94.986491] __x64_sys_openat+0xf8/0x130 [ 94.986499] do_syscall_64+0x8e/0x660 [ 94.986515] ? count_memcg_events+0x15f/0x3c0 [ 94.986526] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986540] ? handle_mm_fault+0x1639/0x1ef0 [ 94.986551] ? vma_start_read+0xf0/0x320 [ 94.986558] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986561] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986563] ? fpregs_assert_state_consistent+0x50/0xe0 [ 94.986572] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986574] ? arch_exit_to_user_mode_prepare+0x9/0xb0 [ 94.986587] ? srso_alias_return_thunk+0x5/0xfbef5 [ 94.986588] ? irqentry_exit+0x3c/0x590 [ 94.986595] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 94.986597] RIP: 0033:0x7fda4a79c3ea Fix by extracting the character value before invoking match_char, ensuring single evaluation per outer loop. Fixes: 074c1cd798cb ("apparmor: dfa move character match into a macro") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: Massimiliano Pellizzer Signed-off-by: John Johansen commit 306039414932c80f8420695a24d4fe10c84ccfb2 Author: John Johansen Date: Tue Mar 3 11:08:02 2026 -0800 apparmor: fix: limit the number of levels of policy namespaces Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't strictly tied to user namespaces and it is possible to create them and nest them arbitrarily deep which can be used to exhaust system resource. Hard cap policy namespaces to the same depth as user namespaces. Fixes: c88d4c7b049e8 ("AppArmor: core policy routines") Reported-by: Qualys Security Advisory Reviewed-by: Ryan Lee Reviewed-by: Cengiz Can Signed-off-by: John Johansen commit ab09264660f9de5d05d1ef4e225aa447c63a8747 Author: Massimiliano Pellizzer Date: Tue Jan 13 09:09:43 2026 +0100 apparmor: replace recursive profile removal with iterative approach The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion. Fixes: c88d4c7b049e ("AppArmor: core policy routines") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: Massimiliano Pellizzer Signed-off-by: John Johansen commit e38c55d9f834e5b848bfed0f5c586aaf45acb825 Author: Massimiliano Pellizzer Date: Tue Jan 20 15:24:04 2026 +0100 apparmor: fix memory leak in verify_header The function sets `*ns = NULL` on every call, leaking the namespace string allocated in previous iterations when multiple profiles are unpacked. This also breaks namespace consistency checking since *ns is always NULL when the comparison is made. Remove the incorrect assignment. The caller (aa_unpack) initializes *ns to NULL once before the loop, which is sufficient. Fixes: dd51c8485763 ("apparmor: provide base for multiple profiles to be replaced at once") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: Massimiliano Pellizzer Signed-off-by: John Johansen commit 9063d7e2615f4a7ab321de6b520e23d370e58816 Author: Massimiliano Pellizzer Date: Thu Jan 15 15:30:50 2026 +0100 apparmor: validate DFA start states are in bounds in unpack_pdb Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue. Fixes: ad5ff3db53c6 ("AppArmor: Add ability to load extended policy") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: Massimiliano Pellizzer Signed-off-by: John Johansen commit 95bc5c225513fc3c4ce169563fb5e3929fbb938b Author: matteo.cotifava Date: Mon Mar 9 22:54:12 2026 +0100 ASoC: soc-core: flush delayed work before removing DAIs and widgets When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler. During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed work with a pmdown_time timer delay. Since this happens after the flush in snd_soc_unbind_card(), the new work is not caught. soc_remove_link_components() then frees DAPM widgets before this work fires, leading to the use-after-free. The existing flush in soc_free_pcm_runtime() also cannot help as it runs after soc_remove_link_components() has already freed the widgets. Add a flush in soc_cleanup_card_resources() after snd_card_disconnect_sync() (after which no new PCM closes can schedule further delayed work) and before soc_remove_link_dais() and soc_remove_link_components() (which tear down the structures the delayed work accesses). Fixes: e894efef9ac7 ("ASoC: core: add support to card rebind") Signed-off-by: Matteo Cotifava Link: https://patch.msgid.link/20260309215412.545628-3-cotifavamatteo@gmail.com Signed-off-by: Mark Brown commit 3c99c9f0ed60582c1c9852b685d78d5d3a50de63 Author: matteo.cotifava Date: Mon Mar 9 22:54:11 2026 +0100 ASoC: soc-core: drop delayed_work_pending() check before flush The delayed_work_pending() check before flush_delayed_work() in soc_free_pcm_runtime() is unnecessary and racy. flush_delayed_work() is safe to call unconditionally - it is a no-op when no work is pending. Remove the check. The original check was added by commit 9c9b65203492 ("ASoC: core: only flush inited work during free") but delayed_work_pending() followed by flush_delayed_work() has a time-of-check/time-of-use window where work can become pending between the two calls. Fixes: 9c9b65203492 ("ASoC: core: only flush inited work during free") Signed-off-by: Matteo Cotifava Link: https://patch.msgid.link/20260309215412.545628-2-cotifavamatteo@gmail.com Signed-off-by: Mark Brown commit d0d727746944096a6681dc6adb5f123fc5aa018d Author: Luca Ceresoli Date: Thu Feb 26 17:16:45 2026 +0100 drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output Dual LVDS output (available on the SN65DSI84) requires HSYNC_PULSE_WIDTH and HORIZONTAL_BACK_PORCH to be divided by two with respect to the values used for single LVDS output. While not clearly stated in the datasheet, this is needed according to the DSI Tuner [0] output. It also makes sense intuitively because in dual LVDS output two pixels at a time are output and so the output clock is half of the pixel clock. Some dual-LVDS panels refuse to show any picture without this fix. Divide by two HORIZONTAL_FRONT_PORCH too, even though this register is used only for test pattern generation which is not currently implemented by this driver. [0] https://www.ti.com/tool/DSI-TUNER Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver") Cc: stable@vger.kernel.org Reviewed-by: Marek Vasut Link: https://patch.msgid.link/20260226-ti-sn65dsi83-dual-lvds-fixes-and-test-pattern-v1-2-2e15f5a9a6a0@bootlin.com Signed-off-by: Luca Ceresoli commit 2f22702dc0fee06a240404e0f7ead5b789b253d8 Author: Luca Ceresoli Date: Thu Feb 26 17:16:44 2026 +0100 drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding The DSI frequency must be in the range: (CHA_DSI_CLK_RANGE * 5 MHz) <= DSI freq < ((CHA_DSI_CLK_RANGE + 1) * 5 MHz) So the register value should point to the lower range value, but DIV_ROUND_UP() rounds the division to the higher range value, resulting in an excess of 1 (unless the frequency is an exact multiple of 5 MHz). For example for a 437100000 MHz clock CHA_DSI_CLK_RANGE should be 87 (0x57): (87 * 5 = 435) <= 437.1 < (88 * 5 = 440) but current code returns 88 (0x58). Fix the computation by removing the DIV_ROUND_UP(). Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver") Cc: stable@vger.kernel.org Reviewed-by: Marek Vasut Link: https://patch.msgid.link/20260226-ti-sn65dsi83-dual-lvds-fixes-and-test-pattern-v1-1-2e15f5a9a6a0@bootlin.com Signed-off-by: Luca Ceresoli commit 652a3017c485937cdb0706aa54f9dc74312c97a7 Author: Cheng-Yang Chou Date: Fri Mar 6 14:42:54 2026 +0800 crypto: arm64/aes-neonbs - Move key expansion off the stack aesbs_setkey() and aesbs_cbc_ctr_setkey() allocate struct crypto_aes_ctx on the stack. On arm64, the kernel-mode NEON context is also stored on the stack, causing the combined frame size to exceed 1024 bytes and triggering -Wframe-larger-than= warnings. Allocate struct crypto_aes_ctx on the heap instead and use kfree_sensitive() to ensure the key material is zeroed on free. Use a goto-based cleanup path to ensure kfree_sensitive() is always called. Signed-off-by: Cheng-Yang Chou Fixes: 4fa617cc6851 ("arm64/fpsimd: Allocate kernel mode FP/SIMD buffers on the stack") Link: https://lore.kernel.org/r/20260306064254.2079274-1-yphbchou0911@gmail.com Signed-off-by: Eric Biggers commit 3b4a3a00de8770f3a60c1fa483921ce37415132d Author: Weizhao Ouyang Date: Mon Mar 9 20:15:05 2026 +0800 scripts: kconfig: merge_config.sh: fix unexpected operator warning Fix a warning for: $ ./scripts/kconfig/merge_config.sh .config extra.config Using .config as base Merging extra.config ./scripts/kconfig/merge_config.sh: 384: [: false: unexpected operator The shellcheck report is also attached: if [ "$STRICT" == "true" ] && [ "$STRICT_MODE_VIOLATED" == "true" ]; then ^-- SC3014 (warning): In POSIX sh, == in place of = is undefined. ^-- SC3014 (warning): In POSIX sh, == in place of = is undefined. Fixes: dfc97e1c5da5 ("scripts: kconfig: merge_config.sh: use awk in checks too") Signed-off-by: Weizhao Ouyang Reviewed-by: Mikko Rapeli Link: https://patch.msgid.link/20260309121505.40454-1-o451686892@gmail.com Signed-off-by: Nathan Chancellor commit a76e30c2479ce6ffa2aa6c8a8462897afc82bc90 Author: Charles Mirabile Date: Sat Mar 7 23:43:30 2026 -0500 kbuild: Delete .builtin-dtbs.S when running make clean The makefile tries to delete a file named ".builtin-dtb.S" but the file created by scripts/Makefile.vmlinux is actually called ".builtin-dtbs.S". Fixes: 654102df2ac2a ("kbuild: add generic support for built-in boot DTBs") Cc: stable@vger.kernel.org Signed-off-by: Charles Mirabile Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20260308044338.181403-1-cmirabil@redhat.com [nathan: Small commit message adjustments] Signed-off-by: Nathan Chancellor commit 785d4625d3e05bb0ac536ff4fd74d096cfe51714 Author: Jens Axboe Date: Mon Mar 9 14:20:14 2026 -0600 io_uring/bpf_filter: use bpf_prog_run_pin_on_cpu() to prevent migration Since the caller, __io_uring_run_bpf_filters(), doesn't prevent migration, it should use the migration disabling variant for running the BPF program. Fixes: d42eb05e60fe ("io_uring: add support for BPF filtering for opcode restrictions") Signed-off-by: Jens Axboe commit 111e2863372c322e836e0c896f6dd9cf4ee08c71 Author: Felix Gu Date: Tue Mar 10 02:01:34 2026 +0800 spi: rockchip-sfc: Fix double-free in remove() callback The driver uses devm_spi_register_controller() for registration, which automatically unregisters the controller via devm cleanup when the device is removed. The manual call to spi_unregister_controller() in the remove() callback can lead to a double-free. And to make sure controller is unregistered before DMA buffer is unmapped, switch to use spi_register_controller() in probe(). Fixes: 8011709906d0 ("spi: rockchip-sfc: Support pm ops") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260310-sfc-v2-1-67fab04b097f@gmail.com Signed-off-by: Mark Brown commit 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 Author: Benoît Sevens Date: Tue Mar 3 13:58:28 2026 +0000 HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure. Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes. Add explicit length checks for these report IDs and log a warning if a short report is received. Signed-off-by: Benoît Sevens Reviewed-by: Jason Gerecke Signed-off-by: Jiri Kosina commit 06c2a67e90c1f04de10ac3091b97665beacb48ce Merge: 1f318b96cc84d7 3817b1d34432d3 Author: Rafael J. Wysocki Date: Mon Mar 9 18:41:20 2026 +0100 Merge tag 'linux-cpupower-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull cpupower utility updates for 7.0-rc4 from Shuah Khan: "linux-cpupower-7.0-rc4 - Adds support for setting EPP via systemd service - Fixes swapped power/energy unit labels - Adds intel_pstate turbo boost support for Intel platforms" * tag 'linux-cpupower-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: Add intel_pstate turbo boost support for Intel platforms cpupower: Add support for setting EPP via systemd service cpupower: fix swapped power/energy unit labels commit 8b8f1d5e350acdf972b6b02e225d9e14c600f7ad Author: Ryota Sakamoto Date: Sun Mar 8 18:06:20 2026 +0900 kunit: Add documentation of --list_suites Commit 60f3ada4174f ("kunit: Add --list_suites to show suites") introduced the --list_suites option to kunit.py, but the update to the corresponding run_wrapper documentation was omitted. Add the missing description for --list_suites to keep the documentation in sync with the tool's supported arguments. Fixes: 60f3ada4174f ("kunit: Add --list_suites to show suites") Signed-off-by: Ryota Sakamoto Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 2fcfe5951eb2e8440fc5e1dd6ea977336ff83a1d Author: zhidao su Date: Mon Mar 9 10:46:12 2026 +0800 sched_ext: Use WRITE_ONCE() for the write side of scx_enable helper pointer scx_enable() uses double-checked locking to lazily initialize a static kthread_worker pointer. The fast path reads helper locklessly: if (!READ_ONCE(helper)) { // lockless read -- no helper_mutex The write side initializes helper under helper_mutex, but previously used a plain assignment: helper = kthread_run_worker(0, "scx_enable_helper"); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ plain write -- KCSAN data race with READ_ONCE() above Since READ_ONCE() on the fast path and the plain write on the initialization path access the same variable without a common lock, they constitute a data race. KCSAN requires that all sides of a lock-free access use READ_ONCE()/WRITE_ONCE() consistently. Use a temporary variable to stage the result of kthread_run_worker(), and only WRITE_ONCE() into helper after confirming the pointer is valid. This avoids a window where a concurrent caller on the fast path could observe an ERR pointer via READ_ONCE(helper) before the error check completes. Fixes: b06ccbabe250 ("sched_ext: Fix starvation of scx_enable() under fair-class saturation") Signed-off-by: zhidao su Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 9a73f085dc91980ab7fcc5e9716f4449424b3b59 Author: Josh Poimboeuf Date: Fri Mar 6 10:28:14 2026 -0800 objtool: Fix another stack overflow in validate_branch() The insn state is getting saved on the stack twice for each recursive iteration. No need for that, once is enough. Fixes the following reported stack overflow: drivers/scsi/qla2xxx/qla_dbg.o: error: SIGSEGV: objtool stack overflow! Segmentation fault Fixes: 70589843b36f ("objtool: Add option to trace function validation") Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/90956545-2066-46e3-b547-10c884582eb0@app.fastmail.com Link: https://patch.msgid.link/8b97f62d083457f3b0a29a424275f7957dd3372f.1772821683.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit 7fdaa640c810cb42090a182c33f905bcc47a616a Author: Josh Poimboeuf Date: Fri Mar 6 09:35:06 2026 -0800 objtool: Handle Clang RSP musical chairs For no apparent reason (possibly related to CONFIG_KMSAN), Clang can randomly pass the value of RSP to other registers and then back again to RSP. Handle that accordingly. Fixes the following warnings: drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x165: undefined stack state drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x165: unknown CFA base reg -1 Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/90956545-2066-46e3-b547-10c884582eb0@app.fastmail.com Link: https://patch.msgid.link/240e6a172cc73292499334a3724d02ccb3247fc7.1772818491.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit 3306a589e598b50a5bbdfe837371670b507043c0 Author: Jann Horn Date: Mon Mar 9 15:34:41 2026 +0100 io_uring/register: fix comment about task_no_new_privs The actual code is right, but the comment is the wrong way around. Fixes: ed82f35b926b ("io_uring: allow registration of per-task restrictions") Signed-off-by: Jann Horn Signed-off-by: Jens Axboe commit a8aec14230322ed8f1e8042b6d656c1631d41163 Author: Ira Weiny Date: Fri Mar 6 12:33:05 2026 -0600 nvdimm/bus: Fix potential use after free in asynchronous initialization Dingisoul with KASAN reports a use after free if device_add() fails in nd_async_device_register(). Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init") correctly added a reference on the parent device to be held until asynchronous initialization was complete. However, if device_add() results in an allocation failure the ref count of the device drops to 0 prior to the parent pointer being accessed. Thus resulting in use after free. The bug bot AI correctly identified the fix. Save a reference to the parent pointer to be used to drop the parent reference regardless of the outcome of device_add(). Reported-by: Dingisoul Closes: http://lore.kernel.org/8855544b-be9e-4153-aa55-0bc328b13733@gmail.com Fixes: b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init") Cc: stable@vger.kernel.org Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260306-fix-uaf-async-init-v1-1-a28fd7526723@intel.com Signed-off-by: Ira Weiny commit 1bc17c67194716f53037685b7059a22cc1a911b2 Author: Sheetal Date: Tue Mar 3 15:32:49 2026 +0530 ASoC: tegra: Add support for Tegra238 soundcard Tegra238 platforms use different clock rates for plla and plla_out0 clocks. Add Tegra238 support in the Tegra sound card driver to apply specific clock configurations. Signed-off-by: Aditya Bavanari Signed-off-by: Sheetal Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260303100249.3214529-3-sheetal@nvidia.com Signed-off-by: Mark Brown commit 0b352f83cabfefdaafa806d6471f0eca117dc7d5 Author: Fernando Fernandez Mancera Date: Wed Mar 4 15:09:35 2026 +0100 xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly In iptfs_reassem_cont(), IP-TFS attempts to append data to the new inner packet 'newskb' that is being reassembled. First a zero-copy approach is tried if it succeeds then newskb becomes non-linear. When a subsequent fragment in the same datagram does not meet the fast-path conditions, a memory copy is performed. It calls skb_put() to append the data and as newskb is non-linear it triggers SKB_LINEAR_ASSERT check. Oops: invalid opcode: 0000 [#1] SMP NOPTI [...] RIP: 0010:skb_put+0x3c/0x40 [...] Call Trace: iptfs_reassem_cont+0x1ab/0x5e0 [xfrm_iptfs] iptfs_input_ordered+0x2af/0x380 [xfrm_iptfs] iptfs_input+0x122/0x3e0 [xfrm_iptfs] xfrm_input+0x91e/0x1a50 xfrm4_esp_rcv+0x3a/0x110 ip_protocol_deliver_rcu+0x1d7/0x1f0 ip_local_deliver_finish+0xbe/0x1e0 __netif_receive_skb_core.constprop.0+0xb56/0x1120 __netif_receive_skb_list_core+0x133/0x2b0 netif_receive_skb_list_internal+0x1ff/0x3f0 napi_complete_done+0x81/0x220 virtnet_poll+0x9d6/0x116e [virtio_net] __napi_poll.constprop.0+0x2b/0x270 net_rx_action+0x162/0x360 handle_softirqs+0xdc/0x510 __irq_exit_rcu+0xe7/0x110 irq_exit_rcu+0xe/0x20 common_interrupt+0x85/0xa0 Fix this by checking if the skb is non-linear. If it is, linearize it by calling skb_linearize(). As the initial allocation of newskb originally reserved enough tailroom for the entire reassembled packet we do not need to check if we have enough tailroom or extend it. Fixes: 5f2b6a909574 ("xfrm: iptfs: add skb-fragment sharing code") Reported-by: Hao Long Closes: https://lore.kernel.org/netdev/DGRCO9SL0T5U.JTINSHJQ9KPK@imlonghao.com/ Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Steffen Klassert commit 155a3bedccaf57c69aa0b590ba3fb579debf3a4d Author: Ming Lei Date: Sun Mar 8 22:39:02 2026 +0800 ublk: don't clear GD_SUPPRESS_PART_SCAN for unprivileged daemons When UBLK_F_NO_AUTO_PART_SCAN is set, GD_SUPPRESS_PART_SCAN is cleared unconditionally, including for unprivileged daemons. Keep it consistent with the code block for setting GD_SUPPRESS_PART_SCAN by not clearing it for unprivileged daemons. In reality this isn't a problem because ioctl(BLKRRPART) requires CAP_SYS_ADMIN, but it is more reliable to not clear the bit. Cc: Alexander Atanasov Fixes: 8443e2087e70 ("ublk: add UBLK_F_NO_AUTO_PART_SCAN feature flag") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit ad0e9ac2d5f5ab7a773c2c07ecf06ee59db9259f Author: Felix Gu Date: Thu Mar 5 20:22:38 2026 +0800 spi: atcspi200: Fix double-free in atcspi_configure_dma() The driver uses devm_dma_request_chan() which registers automatic cleanup via devm_add_action_or_reset(). Calling dma_release_channel() manually on the RX channel when TX channel request fails causes a double-free when the devm cleanup runs. Remove the unnecessary manual cleanup and simplify the error handling since devm will properly release channels on probe failure or driver detach. Fixes: 34e3815ea459 ("spi: atcspi200: Add ATCSPI200 SPI controller driver") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260305-atcspi2000-v1-1-eafe08dcca60@gmail.com Signed-off-by: Mark Brown commit b20b437666e1cb26a7c499d1664e8f2a0ac67000 Author: Felix Gu Date: Fri Mar 6 01:24:32 2026 +0800 spi: amlogic: spifc-a4: Fix DMA mapping error handling Fix three bugs in aml_sfc_dma_buffer_setup() error paths: 1. Unnecessary goto: When the first DMA mapping (sfc->daddr) fails, nothing needs cleanup. Use direct return instead of goto. 2. Double-unmap bug: When info DMA mapping failed, the code would unmap sfc->daddr inline, then fall through to out_map_data which would unmap it again, causing a double-unmap. 3. Wrong unmap size: The out_map_info label used datalen instead of infolen when unmapping sfc->iaddr, which could lead to incorrect DMA sync behavior. Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260306-spifc-a4-v1-1-f22c9965f64a@gmail.com Signed-off-by: Mark Brown commit d800d0bb2009a73630a096d7c7a80a2e64c1e41e Author: Mika Westerberg Date: Wed Feb 25 13:51:09 2026 +0100 dt-bindings: i2c: dw: Update maintainer Jarkko does now work for Intel anymore and since I'm currently maintaining this driver, update my contact information here to make sure patches get Cc'd to me as well. Signed-off-by: Mika Westerberg Reported-by: Andy Shevchenko (internally) Reviewed-by: Andy Shevchenko Acked-by: Rob Herring (Arm) Signed-off-by: Wolfram Sang commit 73a505dc48144ec72e25874e2b2a72487b02d3bc Author: Konrad Dybcio Date: Mon Mar 9 10:39:49 2026 +0100 thunderbolt: Fix property read in nhi_wake_supported() device_property_read_foo() returns 0 on success and only then modifies 'val'. Currently, val is left uninitialized if the aforementioned function returns non-zero, making nhi_wake_supported() return true almost always (random != 0) if the property is not present in device firmware. Invert the check to make it make sense. Fixes: 3cdb9446a117 ("thunderbolt: Add support for Intel Ice Lake") Cc: stable@vger.kernel.org Signed-off-by: Konrad Dybcio Signed-off-by: Mika Westerberg commit 081a0b78ef30f5746cda3e92e28b4d4ae92901d1 Author: Hristo Venev Date: Wed Feb 25 19:07:56 2026 +0200 ceph: do not skip the first folio of the next object in writeback When `ceph_process_folio_batch` encounters a folio past the end of the current object, it should leave it in the batch so that it is picked up in the next iteration. Removing the folio from the batch means that it does not get written back and remains dirty instead. This makes `fsync()` silently skip some of the data, delays capability release, and breaks coherence with `O_DIRECT`. The link below contains instructions for reproducing the bug. Cc: stable@vger.kernel.org Fixes: ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") Link: https://tracker.ceph.com/issues/75156 Signed-off-by: Hristo Venev Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 040d159a45ded7f33201421a81df0aa2a86e5a0b Author: Max Kellermann Date: Tue Feb 24 14:26:57 2026 +0100 ceph: fix memory leaks in ceph_mdsc_build_path() Add __putname() calls to error code paths that did not free the "path" pointer obtained by __getname(). If ownership of this pointer is not passed to the caller via path_info.path, the function must free it before returning. Cc: stable@vger.kernel.org Fixes: 3fd945a79e14 ("ceph: encode encrypted name in ceph_mdsc_build_path and dentry release") Fixes: 550f7ca98ee0 ("ceph: give up on paths longer than PATH_MAX") Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 43323a5934b660afae687e8e4e95ac328615a5c4 Author: Max Kellermann Date: Tue Feb 24 14:10:29 2026 +0100 ceph: add a bunch of missing ceph_path_info initializers ceph_mdsc_build_path() must be called with a zero-initialized ceph_path_info parameter, or else the following ceph_mdsc_free_path_info() may crash. Example crash (on Linux 6.18.12): virt_to_cache: Object is not a Slab page! WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400 [...] Call Trace: [...] ceph_open+0x13d/0x3e0 do_dentry_open+0x134/0x480 vfs_open+0x2a/0xe0 path_openat+0x9a3/0x1160 [...] cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400 [...] kernel BUG at mm/slub.c:634! Oops: invalid opcode: 0000 [#1] SMP NOPTI RIP: 0010:__slab_free+0x1a4/0x350 Some of the ceph_mdsc_build_path() callers had initializers, but others had not, even though they were all added by commit 15f519e9f883 ("ceph: fix race condition validating r_parent before applying state"). The ones without initializer are suspectible to random crashes. (I can imagine it could even be possible to exploit this bug to elevate privileges.) Unfortunately, these Ceph functions are undocumented and its semantics can only be derived from the code. I see that ceph_mdsc_build_path() initializes the structure only on success, but not on error. Calling ceph_mdsc_free_path_info() after a failed ceph_mdsc_build_path() call does not even make sense, but that's what all callers do, and for it to be safe, the structure must be zero-initialized. The least intrusive approach to fix this is therefore to add initializers everywhere. Cc: stable@vger.kernel.org Fixes: 15f519e9f883 ("ceph: fix race condition validating r_parent before applying state") Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit ce0123cbb4a40a2f1bbb815f292b26e96088639f Author: Max Kellermann Date: Fri Sep 5 23:15:30 2025 +0200 ceph: fix i_nlink underrun during async unlink During async unlink, we drop the `i_nlink` counter before we receive the completion (that will eventually update the `i_nlink`) because "we assume that the unlink will succeed". That is not a bad idea, but it races against deletions by other clients (or against the completion of our own unlink) and can lead to an underrun which emits a WARNING like this one: WARNING: CPU: 85 PID: 25093 at fs/inode.c:407 drop_nlink+0x50/0x68 Modules linked in: CPU: 85 UID: 3221252029 PID: 25093 Comm: php-cgi8.1 Not tainted 6.14.11-cm4all1-ampere #655 Hardware name: Supermicro ARS-110M-NR/R12SPD-A, BIOS 1.1b 10/17/2023 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : drop_nlink+0x50/0x68 lr : ceph_unlink+0x6c4/0x720 sp : ffff80012173bc90 x29: ffff80012173bc90 x28: ffff086d0a45aaf8 x27: ffff0871d0eb5680 x26: ffff087f2a64a718 x25: 0000020000000180 x24: 0000000061c88647 x23: 0000000000000002 x22: ffff07ff9236d800 x21: 0000000000001203 x20: ffff07ff9237b000 x19: ffff088b8296afc0 x18: 00000000f3c93365 x17: 0000000000070000 x16: ffff08faffcbdfe8 x15: ffff08faffcbdfec x14: 0000000000000000 x13: 45445f65645f3037 x12: 34385f6369706f74 x11: 0000a2653104bb20 x10: ffffd85f26d73290 x9 : ffffd85f25664f94 x8 : 00000000000000c0 x7 : 0000000000000000 x6 : 0000000000000002 x5 : 0000000000000081 x4 : 0000000000000481 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff08727d3f91e8 Call trace: drop_nlink+0x50/0x68 (P) vfs_unlink+0xb0/0x2e8 do_unlinkat+0x204/0x288 __arm64_sys_unlinkat+0x3c/0x80 invoke_syscall.constprop.0+0x54/0xe8 do_el0_svc+0xa4/0xc8 el0_svc+0x18/0x58 el0t_64_sync_handler+0x104/0x130 el0t_64_sync+0x154/0x158 In ceph_unlink(), a call to ceph_mdsc_submit_request() submits the CEPH_MDS_OP_UNLINK to the MDS, but does not wait for completion. Meanwhile, between this call and the following drop_nlink() call, a worker thread may process a CEPH_CAP_OP_IMPORT, CEPH_CAP_OP_GRANT or just a CEPH_MSG_CLIENT_REPLY (the latter of which could be our own completion). These will lead to a set_nlink() call, updating the `i_nlink` counter to the value received from the MDS. If that new `i_nlink` value happens to be zero, it is illegal to decrement it further. But that is exactly what ceph_unlink() will do then. The WARNING can be reproduced this way: 1. Force async unlink; only the async code path is affected. Having no real clue about Ceph internals, I was unable to find out why the MDS wouldn't give me the "Fxr" capabilities, so I patched get_caps_for_async_unlink() to always succeed. (Note that the WARNING dump above was found on an unpatched kernel, without this kludge - this is not a theoretical bug.) 2. Add a sleep call after ceph_mdsc_submit_request() so the unlink completion gets handled by a worker thread before drop_nlink() is called. This guarantees that the `i_nlink` is already zero before drop_nlink() runs. The solution is to skip the counter decrement when it is already zero, but doing so without a lock is still racy (TOCTOU). Since ceph_fill_inode() and handle_cap_grant() both hold the `ceph_inode_info.i_ceph_lock` spinlock while set_nlink() runs, this seems like the proper lock to protect the `i_nlink` updates. I found prior art in NFS and SMB (using `inode.i_lock`) and AFS (using `afs_vnode.cb_lock`). All three have the zero check as well. Cc: stable@vger.kernel.org Fixes: 2ccb45462aea ("ceph: perform asynchronous unlink if we have sufficient caps") Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit e1c9866173c5f8521f2d0768547a01508cb9ff27 Author: Tuo Li Date: Tue Jan 6 11:24:28 2026 +0800 dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() At the end of this function, d is the traversal cursor of flist, but the code completes found instead. This can lead to issues such as NULL pointer dereferences, double completion, or descriptor leaks. Fix this by completing d instead of found in the final list_for_each_entry_safe() loop. Fixes: aa8d18becc0c ("dmaengine: idxd: add callback support for iaa crypto") Signed-off-by: Tuo Li Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260106032428.162445-1-islituo@gmail.com Signed-off-by: Vinod Koul commit e9075e420a1eb3b52c60f3b95893a55e77419ce8 Author: Deepanshu Kartikey Date: Sat Mar 7 10:09:47 2026 +0530 netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path in netfs_unbuffered_write() unconditionally calls stream->prepare_write() without checking if it is NULL. Filesystems such as 9P do not set the prepare_write operation, so stream->prepare_write remains NULL. When get_user_pages() fails with -EFAULT and the subrequest is flagged for retry, this results in a NULL pointer dereference at fs/netfs/direct_write.c:189. Fix this by mirroring the pattern already used in write_retry.c: if stream->prepare_write is NULL, skip renegotiation and directly reissue the subrequest via netfs_reissue_write(), which handles iterator reset, IN_PROGRESS flag, stats update and reissue internally. Fixes: a0b4c7a49137 ("netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence") Reported-by: syzbot+7227db0fbac9f348dba0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7227db0fbac9f348dba0 Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260307043947.347092-1-kartikey406@gmail.com Tested-by: syzbot+7227db0fbac9f348dba0@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 67e467a11f62ff64ad219dc6aa5459e132c79d14 Author: Deepanshu Kartikey Date: Sat Mar 7 14:30:41 2026 +0530 netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators When a process crashes and the kernel writes a core dump to a 9P filesystem, __kernel_write() creates an ITER_KVEC iterator. This iterator reaches netfs_limit_iter() via netfs_unbuffered_write(), which only handles ITER_FOLIOQ, ITER_BVEC and ITER_XARRAY iterator types, hitting the BUG() for any other type. Fix this by adding netfs_limit_kvec() following the same pattern as netfs_limit_bvec(), since both kvec and bvec are simple segment arrays with pointer and length fields. Dispatch it from netfs_limit_iter() when the iterator type is ITER_KVEC. Fixes: cae932d3aee5 ("netfs: Add func to calculate pagecount/size-limited span of an iterator") Reported-by: syzbot+9c058f0d63475adc97fd@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9c058f0d63475adc97fd Tested-by: syzbot+9c058f0d63475adc97fd@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260307090041.359870-1-kartikey406@gmail.com Signed-off-by: Christian Brauner commit 542127f6528ca7cc3cf61e1651d6ccb58495f953 Author: Uzair Mughal Date: Sat Mar 7 06:29:06 2026 +0500 ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 The Lenovo ThinkPad X390 (ALC257 codec, subsystem ID 0x17aa2288) does not report headset button press events. Headphone insertion is detected (SW_HEADPHONE_INSERT), but pressing the inline microphone button on a headset produces no input events. Add a SND_PCI_QUIRK entry that maps this subsystem ID to ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK, which enables headset jack button detection through alc_fixup_headset_jack() and ThinkPad ACPI integration. This is the same fixup used by similar ThinkPad models (P1 Gen 3, X1 Extreme Gen 3). Signed-off-by: Uzair Mughal Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260307012906.20093-1-contact@uzair.is-a.dev commit 178dd118c0f07fd63a9ed74cfbd8c31ae50e33af Author: Liucheng Lu Date: Sat Mar 7 11:27:27 2026 +0800 ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk HP Laptop 14s-dr5xxx with ALC236 codec does not handle the toggling of the mute LED. This patch adds a quirk entry for subsystem ID 0x8a1f using ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED behavior. Signed-off-by: Liucheng Lu Link: https://patch.msgid.link/PAVPR03MB9774F3FCE9CCD181C585281AE37BA@PAVPR03MB9774.eurprd03.prod.outlook.com Signed-off-by: Takashi Iwai commit 0d3429f12133c2ca47aa82ddab2342bc360c47d3 Author: Zhang Heng Date: Fri Mar 6 20:33:17 2026 +0800 ALSA: hda/realtek: add quirk for ASUS UM6702RC The sound card of this machine cannot adjust the volume, it can only be 0 or 100%. The reason is that the DAC with pin 0x17 is connected to 0x06. Testing found that connecting 0x02 can fix this problem. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220356 Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260306123317.575346-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 Author: Mehul Rao Date: Thu Mar 5 14:35:07 2026 -0500 ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() In the drain loop, the local variable 'runtime' is reassigned to a linked stream's runtime (runtime = s->runtime at line 2157). After releasing the stream lock at line 2169, the code accesses runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size (lines 2170-2178) — all referencing the linked stream's runtime without any lock or refcount protecting its lifetime. A concurrent close() on the linked stream's fd triggers snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private() → snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime). No synchronization prevents kfree(runtime) from completing while the drain path dereferences the stale pointer. Fix by caching the needed runtime fields (no_period_wakeup, rate, buffer_size) into local variables while still holding the stream lock, and using the cached values after the lock is released. Fixes: f2b3614cefb6 ("ALSA: PCM - Don't check DMA time-out too shortly") Cc: stable@vger.kernel.org Signed-off-by: Mehul Rao Link: https://patch.msgid.link/20260305193508.311096-1-mehulrao@gmail.com Signed-off-by: Takashi Iwai commit 56fbbe096a89ff4b52af78a21a4afd9d94bdcc80 Author: Zhang Heng Date: Thu Mar 5 10:35:59 2026 +0800 ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone The BIOS of this machine has set 0x19 to mic, which needs to be set to headphone pin in order to work properly. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220814 Signed-off-by: Zhang Heng Link: https://patch.msgid.link/b55f6ebe-7449-49f7-ae85-00d2ba1e7af0@kylinos.cn Signed-off-by: Takashi Iwai commit e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8 Author: Alexander Stein Date: Tue Oct 14 08:13:08 2025 +0200 dmaengine: xilinx: xdma: Fix regmap init error handling devm_regmap_init_mmio returns an ERR_PTR() upon error, not NULL. Fix the error check and also fix the error message. Use the error code from ERR_PTR() instead of the wrong value in ret. Fixes: 17ce252266c7 ("dmaengine: xilinx: xdma: Add xilinx xdma driver") Signed-off-by: Alexander Stein Reviewed-by: Frank Li Link: https://patch.msgid.link/20251014061309.283468-1-alexander.stein@ew.tq-group.com Signed-off-by: Vinod Koul commit 3f63297ff61a994b99d710dcb6dbde41c4003233 Author: LUO Haowen Date: Wed Mar 4 14:45:09 2026 +0800 dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. Others have submitted this issue (https://lore.kernel.org/dmaengine/ 20240722030405.3385-1-zhengdongxiong@gxmicro.cn/), but it has not been fixed yet. Therefore, more supplementary information is provided here. As mentioned in the "PCS-CCS-CB-TCB" Producer-Consumer Synchronization of "DesignWare Cores PCI Express Controller Databook, version 6.00a": 1. The Consumer CYCLE_STATE (CCS) bit in the register only needs to be initialized once; the value will update automatically to be ~CYCLE_BIT (CB) in the next chunk. 2. The Consumer CYCLE_BIT bit in the register is loaded from the LL element and tested against CCS. When CB = CCS, the data transfer is executed. Otherwise not. The current logic sets customer (HDMA) CS and CB bits to 1 in each chunk while setting the producer (software) CB of odd chunks to 0 and even chunks to 1 in the linked list. This is leading to a mismatch between the producer CB and consumer CS bits. This issue can be reproduced by setting the transmission data size to exceed one chunk. By the way, in the EDMA using the same "PCS-CCS-CB-TCB" mechanism, the CS bit is only initialized once and this issue was not found. Refer to drivers/dma/dw-edma/dw-edma-v0-core.c:dw_edma_v0_core_start. So fix this issue by initializing the CYCLE_STATE and CYCLE_BIT bits only once. Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA") Signed-off-by: LUO Haowen Reviewed-by: Frank Li Link: https://patch.msgid.link/tencent_CB11AA9F3920C1911AF7477A9BD8EFE0AD05@qq.com Signed-off-by: Vinod Koul commit 441336115df26b966575de56daf7107ed474faed Author: Thorsten Blum Date: Tue Mar 3 14:25:53 2026 +0100 ksmbd: Don't log keys in SMB3 signing and encryption key generation When KSMBD_DEBUG_AUTH logging is enabled, generate_smb3signingkey() and generate_smb3encryptionkey() log the session, signing, encryption, and decryption key bytes. Remove the logs to avoid exposing credentials. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1e689a56173827669a35da7cb2a3c78ed5c53680 Author: Marios Makassikis Date: Tue Mar 3 11:14:32 2026 +0100 smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window. Cc: stable@vger.kernel.org Signed-off-by: Marios Makassikis Acked-by: Namjae Jeon Signed-off-by: Steve French commit eac3361e3d5dd8067b3258c69615888eb45e9f25 Author: Namjae Jeon Date: Mon Mar 2 12:55:02 2026 +0900 ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is being accessed after rcu_read_unlock() has been called. This creates a race condition where the memory could be freed by a concurrent writer between the unlock and the subsequent pointer dereferences (opinfo->is_lease, etc.), leading to a use-after-free. Fixes: 5fb282ba4fef ("ksmbd: fix possible null-deref in smb_lazy_parent_lease_break_close") Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 1dfd062caa165ec9d7ee0823087930f3ab8a6294 Author: Namjae Jeon Date: Sat Mar 7 11:32:31 2026 +0900 ksmbd: fix use-after-free by using call_rcu() for oplock_info ksmbd currently frees oplock_info immediately using kfree(), even though it is accessed under RCU read-side critical sections in places like opinfo_get() and proc_show_files(). Since there is no RCU grace period delay between nullifying the pointer and freeing the memory, a reader can still access oplock_info structure after it has been freed. This can leads to a use-after-free especially in opinfo_get() where atomic_inc_not_zero() is called on already freed memory. Fix this by switching to deferred freeing using call_rcu(). Fixes: 18b4fac5ef17 ("ksmbd: fix use-after-free in smb_break_all_levII_oplock()") Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 40955015fae4908157ac6c959ea696d05e6e9b31 Author: Ali Khaledi Date: Mon Mar 2 10:15:48 2026 +0900 ksmbd: fix use-after-free in proc_show_files due to early rcu_read_unlock The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window. A concurrent opinfo_put() can free the opinfo between the unlock and the subsequent access to opinfo->is_lease, opinfo->o_lease->state, and opinfo->level. Fix this by deferring rcu_read_unlock() until after all opinfo field accesses are complete. The values needed (const_names, count, level) are copied into local variables under the RCU read lock, and the potentially-sleeping seq_printf calls happen after the lock is released. Found by AI-assisted code review (Claude Opus 4.6, Anthropic) in collaboration with Ali Khaledi. Cc: stable@vger.kernel.org Fixes: b38f99c1217a ("ksmbd: add procfs interface for runtime monitoring and statistics") Signed-off-by: Ali Khaledi Acked-by: Namjae Jeon Signed-off-by: Steve French commit c15e7c62feb3751cbdd458555819df1d70374890 Author: Guenter Roeck Date: Thu Feb 26 21:54:21 2026 -0800 smb/server: Fix another refcount leak in smb2_open() If ksmbd_override_fsids() fails, we jump to err_out2. At that point, fp is NULL because it hasn't been assigned dh_info.fp yet, so ksmbd_fd_put(work, fp) will not be called. However, dh_info.fp was already inserted into the session file table by ksmbd_reopen_durable_fd(), so it will leak in the session file table until the session is closed. Move fp = dh_info.fp; ahead of the ksmbd_override_fsids() check to fix the problem. Found by an experimental AI code review agent at Google. Fixes: c8efcc786146a ("ksmbd: add support for durable handles v1/v2") Signed-off-by: Guenter Roeck Reviewed-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit facfdef64d11c08e6f1e69d02a0b87cb74cee0f5 Author: Richard Fitzgerald Date: Wed Mar 4 14:12:50 2026 +0000 firmware: cs_dsp: Fix fragmentation regression in firmware download Use vmalloc() instead of kmalloc(..., GFP_DMA) to alloc the temporary buffer for firmware download blobs. This avoids the problem that a heavily fragmented system cannot allocate enough physically-contiguous memory for a large blob. The redundant alloc buffer mechanism was removed in commit 900baa6e7bb0 ("firmware: cs_dsp: Remove redundant download buffer allocator"). While doing that I was overly focused on the possibility of the underlying bus requiring DMA-safe memory. So I used GFP_DMA kmalloc()s. I failed to notice that the code I was removing used vmalloc(). This creates a regression. Way back in 2014 the problem of fragmentation with kmalloc()s was fixed by commit cdcd7f728753 ("ASoC: wm_adsp: Use vmalloc to allocate firmware download buffer"). Although we don't need physically-contiguous memory, we don't know if the bus needs some particular alignment of the buffers. Since the change in 2014, the firmware download has always used whatever alignment vmalloc() returns. To avoid introducing a new problem, the temporary buffer is still used, to keep the same alignment of pointers passed to regmap_raw_write(). Signed-off-by: Richard Fitzgerald Fixes: 900baa6e7bb0 ("firmware: cs_dsp: Remove redundant download buffer allocator") Link: https://patch.msgid.link/20260304141250.1578597-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d6db827b430bdcca3976cebca7bd69cca03cde2c Author: Ravi Hothi Date: Fri Feb 27 20:15:34 2026 +0530 ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start During ADSP stop and start, the kernel crashes due to the order in which ASoC components are removed. On ADSP stop, the q6apm-audio .remove callback unloads topology and removes PCM runtimes during ASoC teardown. This deletes the RTDs that contain the q6apm DAI components before their removal pass runs, leaving those components still linked to the card and causing crashes on the next rebind. Fix this by ensuring that all dependent (child) components are removed first, and the q6apm component is removed last. [ 48.105720] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 [ 48.114763] Mem abort info: [ 48.117650] ESR = 0x0000000096000004 [ 48.121526] EC = 0x25: DABT (current EL), IL = 32 bits [ 48.127010] SET = 0, FnV = 0 [ 48.130172] EA = 0, S1PTW = 0 [ 48.133415] FSC = 0x04: level 0 translation fault [ 48.138446] Data abort info: [ 48.141422] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 48.147079] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 48.152354] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 48.157859] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001173cf000 [ 48.164517] [00000000000000d0] pgd=0000000000000000, p4d=0000000000000000 [ 48.171530] Internal error: Oops: 0000000096000004 [#1] SMP [ 48.177348] Modules linked in: q6prm_clocks q6apm_lpass_dais q6apm_dai snd_q6dsp_common q6prm snd_q6apm 8021q garp mrp stp llc snd_soc_hdmi_codec apr pdr_interface phy_qcom_edp fastrpc qcom_pd_mapper rpmsg_ctrl qrtr_smd rpmsg_char qcom_pdr_msg qcom_iris v4l2_mem2mem videobuf2_dma_contig ath11k_pci msm ubwc_config at24 ath11k videobuf2_memops mac80211 ocmem videobuf2_v4l2 libarc4 drm_gpuvm mhi qrtr videodev drm_exec snd_soc_sc8280xp gpu_sched videobuf2_common nvmem_qcom_spmi_sdam snd_soc_qcom_sdw drm_dp_aux_bus qcom_q6v5_pas qcom_spmi_temp_alarm snd_soc_qcom_common rtc_pm8xxx qcom_pon drm_display_helper cec qcom_pil_info qcom_stats soundwire_bus drm_client_lib mc dispcc0_sa8775p videocc_sa8775p qcom_q6v5 camcc_sa8775p snd_soc_dmic phy_qcom_sgmii_eth snd_soc_max98357a i2c_qcom_geni snd_soc_core dwmac_qcom_ethqos llcc_qcom icc_bwmon qcom_sysmon snd_compress qcom_refgen_regulator coresight_stm stmmac_platform snd_pcm_dmaengine qcom_common coresight_tmc stmmac coresight_replicator qcom_glink_smem coresight_cti stm_core [ 48.177444] coresight_funnel snd_pcm ufs_qcom phy_qcom_qmp_usb gpi phy_qcom_snps_femto_v2 coresight phy_qcom_qmp_ufs qcom_wdt gpucc_sa8775p pcs_xpcs mdt_loader qcom_ice icc_osm_l3 qmi_helpers snd_timer snd soundcore display_connector qcom_rng nvmem_reboot_mode drm_kms_helper phy_qcom_qmp_pcie sha256 cfg80211 rfkill socinfo fuse drm backlight ipv6 [ 48.301059] CPU: 2 UID: 0 PID: 293 Comm: kworker/u32:2 Not tainted 6.19.0-rc6-dirty #10 PREEMPT [ 48.310081] Hardware name: Qualcomm Technologies, Inc. Lemans EVK (DT) [ 48.316782] Workqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface] [ 48.323672] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 48.330825] pc : mutex_lock+0xc/0x54 [ 48.334514] lr : soc_dapm_shutdown_dapm+0x44/0x174 [snd_soc_core] [ 48.340794] sp : ffff800084ddb7b0 [ 48.344207] x29: ffff800084ddb7b0 x28: ffff00009cd9cf30 x27: ffff00009cd9cc00 [ 48.351544] x26: ffff000099610190 x25: ffffa31d2f19c810 x24: ffffa31d2f185098 [ 48.358869] x23: ffff800084ddb7f8 x22: 0000000000000000 x21: 00000000000000d0 [ 48.366198] x20: ffff00009ba6c338 x19: ffff00009ba6c338 x18: 00000000ffffffff [ 48.373528] x17: 000000040044ffff x16: ffffa31d4ae6dca8 x15: 072007740775076f [ 48.380853] x14: 0765076d07690774 x13: 00313a323a656369 x12: 767265733a637673 [ 48.388182] x11: 00000000000003f9 x10: ffffa31d4c7dea98 x9 : 0000000000000001 [ 48.395519] x8 : ffff00009a2aadc0 x7 : 0000000000000003 x6 : 0000000000000000 [ 48.402854] x5 : 0000000000000000 x4 : 0000000000000028 x3 : ffff000ef397a698 [ 48.410180] x2 : ffff00009a2aadc0 x1 : 0000000000000000 x0 : 00000000000000d0 [ 48.417506] Call trace: [ 48.420025] mutex_lock+0xc/0x54 (P) [ 48.423712] snd_soc_dapm_shutdown+0x44/0xbc [snd_soc_core] [ 48.429447] soc_cleanup_card_resources+0x30/0x2c0 [snd_soc_core] [ 48.435719] snd_soc_bind_card+0x4dc/0xcc0 [snd_soc_core] [ 48.441278] snd_soc_add_component+0x27c/0x2c8 [snd_soc_core] [ 48.447192] snd_soc_register_component+0x9c/0xf4 [snd_soc_core] [ 48.453371] devm_snd_soc_register_component+0x64/0xc4 [snd_soc_core] [ 48.459994] apm_probe+0xb4/0x110 [snd_q6apm] [ 48.464479] apr_device_probe+0x24/0x40 [apr] [ 48.468964] really_probe+0xbc/0x298 [ 48.472651] __driver_probe_device+0x78/0x12c [ 48.477132] driver_probe_device+0x40/0x160 [ 48.481435] __device_attach_driver+0xb8/0x134 [ 48.486011] bus_for_each_drv+0x80/0xdc [ 48.489964] __device_attach+0xa8/0x1b0 [ 48.493916] device_initial_probe+0x50/0x54 [ 48.498219] bus_probe_device+0x38/0xa0 [ 48.502170] device_add+0x590/0x760 [ 48.505761] device_register+0x20/0x30 [ 48.509623] of_register_apr_devices+0x1d8/0x318 [apr] [ 48.514905] apr_pd_status+0x2c/0x54 [apr] [ 48.519114] pdr_notifier_work+0x8c/0xe0 [pdr_interface] [ 48.524570] process_one_work+0x150/0x294 [ 48.528692] worker_thread+0x2d8/0x3d8 [ 48.532551] kthread+0x130/0x204 [ 48.535874] ret_from_fork+0x10/0x20 [ 48.539559] Code: d65f03c0 d5384102 d503201f d2800001 (c8e17c02) [ 48.545823] ---[ end trace 0000000000000000 ]--- Fixes: 5477518b8a0e ("ASoC: qdsp6: audioreach: add q6apm support") Cc: stable@vger.kernel.org Signed-off-by: Ravi Hothi Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260227144534.278568-1-ravi.hothi@oss.qualcomm.com Signed-off-by: Mark Brown commit 1f318b96cc84d7c2ab792fcc0bfd42a7ca890681 Author: Linus Torvalds Date: Sun Mar 8 16:56:54 2026 -0700 Linux 7.0-rc3 commit 7149be786da012afc6bae293d38f8c1fff1fb90d Author: Shenghao Yang Date: Sun Feb 22 13:45:51 2026 +0800 drm/gud: fix NULL crtc dereference on display disable gud_plane_atomic_update() currently handles both crtc state and framebuffer updates - the complexity has led to a few accidental NULL pointer dereferences. Commit dc2d5ddb193e ("drm/gud: fix NULL fb and crtc dereferences on USB disconnect") [1] fixed an earlier dereference but planes can also be disabled in non-hotplug paths (e.g. display disables via the desktop environment). The drm_dev_enter() call would not cause an early return in those and subsequently oops on dereferencing crtc: BUG: kernel NULL pointer dereference, address: 00000000000005c8 CPU: 6 UID: 1000 PID: 3473 Comm: kwin_wayland Not tainted 6.18.2-200.vanilla.gud.fc42.x86_64 #1 PREEMPT(lazy) RIP: 0010:gud_plane_atomic_update+0x148/0x470 [gud] drm_atomic_helper_commit_planes+0x28e/0x310 drm_atomic_helper_commit_tail+0x2a/0x70 commit_tail+0xf1/0x150 drm_atomic_helper_commit+0x13c/0x180 drm_atomic_commit+0xb1/0xe0 info ? __pfx___drm_printfn_info+0x10/0x10 drm_mode_atomic_ioctl+0x70f/0x7c0 ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 drm_ioctl_kernel+0xae/0x100 drm_ioctl+0x2a8/0x550 ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x7e/0x7f0 ? __ct_user_enter+0x56/0xd0 ? do_syscall_64+0x158/0x7f0 ? __ct_user_enter+0x56/0xd0 ? do_syscall_64+0x158/0x7f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Split out crtc handling from gud_plane_atomic_update() into atomic_enable() and atomic_disable() functions to delegate crtc state transitioning work to the DRM helpers. To preserve the gud state commit sequence [2], switch to the runtime PM version of drm_atomic_helper_commit_tail() which ensures that crtcs are enabled (hence sending the GUD_REQ_SET_CONTROLLER_ENABLE and GUD_REQ_SET_DISPLAY_ENABLE requests) before a framebuffer update is sent. [1] https://lore.kernel.org/all/20251231055039.44266-1-me@shenghaoyang.info/ [2] https://github.com/notro/gud/wiki/GUD-Protocol#display-state Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601142159.0v8ilfVs-lkp@intel.com/ Fixes: 73cfd166e045 ("drm/gud: Replace simple display pipe with DRM atomic helpers") Cc: # 6.19.x Cc: # 6.18.x Signed-off-by: Shenghao Yang Reviewed-by: Thomas Zimmermann Acked-by: Ruben Wauters Signed-off-by: Ruben Wauters Link: https://patch.msgid.link/20260222054551.80864-1-me@shenghaoyang.info commit fc9f248d8c591454e257edd54ac4085d84f11e6a Merge: 014441d1e4b2f5 a4b0bf6a40f3c1 Author: Linus Torvalds Date: Sun Mar 8 12:13:09 2026 -0700 Merge tag 'efi-fixes-for-v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fix from Ard Biesheuvel: "Fix for the x86 EFI workaround keeping boot services code and data regions reserved until after SetVirtualAddressMap() completes: deferred struct page initialization may result in some of this memory being lost permanently" * tag 'efi-fixes-for-v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: x86/efi: defer freeing of boot services memory commit ef3b06742c8a201d0e83edc9a33a89a4fe3009f8 Author: Yonatan Nachum Date: Sun Mar 8 16:53:50 2026 +0000 RDMA/efa: Fix use of completion ctx after free On admin queue completion handling, if the admin command completed with error we print data from the completion context. The issue is that we already freed the completion context in polling/interrupts handler which means we print data from context in an unknown state (it might be already used again). Change the admin submission flow so alloc/dealloc of the context will be symmetric and dealloc will be called after any potential use of the context. Fixes: 68fb9f3e312a ("RDMA/efa: Remove redundant NULL pointer check of CQE") Reviewed-by: Daniel Kranzdorf Reviewed-by: Michael Margolin Signed-off-by: Yonatan Nachum Link: https://patch.msgid.link/20260308165350.18219-1-ynachum@amazon.com Signed-off-by: Leon Romanovsky commit 014441d1e4b2f5be728433b761df3377dee7a487 Merge: c23719abc3308d cfc69c2e6c699c Author: Linus Torvalds Date: Sun Mar 8 10:17:05 2026 -0700 Merge tag 'i2c-for-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "A revert for the i801 driver restoring old locking behaviour" * tag 'i2c-for-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" commit 4e701b47c3ba8f4eaf51d676732b11204bc75b35 Author: Geert Uytterhoeven Date: Fri Feb 20 10:55:15 2026 +0100 firmware: arm_scmi: Spelling s/mulit/multi/, s/currenly/currently/ Fix misspellings of "multi" and "currently". Signed-off-by: Geert Uytterhoeven Message-Id: <6735401861e0c2f3e5e680533cd6f71c4d6fd5eb.1771581270.git.geert+renesas@glider.be> Signed-off-by: Sudeep Holla commit c23719abc3308df7ed3ad35650ad211fb2d2003d Merge: 6ff1020c2f7b55 b5ef09a77d0b52 Author: Linus Torvalds Date: Sat Mar 7 17:12:06 2026 -0800 Merge tag 'x86-urgent-2026-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix SEV guest boot failures in certain circumstances, due to very early code relying on a BSS-zeroed variable that isn't actually zeroed yet an may contain non-zero bootup values Move the variable into the .data section go gain even earlier zeroing - Expose & allow the IBPB-on-Entry feature on SNP guests, which was not properly exposed to guests due to initial implementational caution - Fix O= build failure when CONFIG_EFI_SBAT_FILE is using relative file paths - Fix the various SNC (Sub-NUMA Clustering) topology enumeration bugs/artifacts (sched-domain build errors mostly). SNC enumeration data got more complicated with Granite Rapids X (GNR) and Clearwater Forest X (CWF), which exposed these bugs and made their effects more serious - Also use the now sane(r) SNC code to fix resctrl SNC detection bugs - Work around a historic libgcc unwinder bug in the vdso32 sigreturn code (again), which regressed during an overly aggressive recent cleanup of DWARF annotations * tag 'x86-urgent-2026-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/entry/vdso32: Work around libgcc unwinder bug x86/resctrl: Fix SNC detection x86/topo: Fix SNC topology mess x86/topo: Replace x86_has_numa_in_package x86/topo: Add topology_num_nodes_per_package() x86/numa: Store extra copy of numa_nodes_parsed x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths x86/sev: Allow IBPB-on-Entry feature for SNP guests x86/boot/sev: Move SEV decompressor variables into the .data section commit 6ff1020c2f7b5593b916afbc87a835371ab1d51b Merge: b1b9a9d0b5c875 e48a869957a70c Author: Linus Torvalds Date: Sat Mar 7 17:09:15 2026 -0800 Merge tag 'timers-urgent-2026-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Make clock_adjtime() syscall timex validation slightly more permissive for auxiliary clocks, to not reject syscalls based on the status field that do not try to modify the status field. This makes the ABI behavior in clock_adjtime() consistent with CLOCK_REALTIME" * tag 'timers-urgent-2026-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping: Fix timex status validation for auxiliary clocks commit b1b9a9d0b5c875decbc129c16c6e827fb50489a5 Merge: 1954c4f0122061 d658686a1331db Author: Linus Torvalds Date: Sat Mar 7 17:07:13 2026 -0800 Merge tag 'sched-urgent-2026-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix a DL scheduler bug that may corrupt internal metrics during PI and setscheduler() syscalls, resulting in kernel warnings and misbehavior. Found during stress-testing" * tag 'sched-urgent-2026-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting commit 46d8a07b4ae262e2fec6ce2aa454e06243661265 Author: David Lechner Date: Sat Feb 28 22:30:30 2026 -0600 drm/sitronix/st7586: fix bad pixel data due to byte swap Correctly set dbi->write_memory_bpw for the ST7586 driver. This driver is for a monochrome display that has an unusual data format, so the default value set in mipi_dbi_spi_init() is not correct simply because this controller is non-standard. Previously, we were using dbi->swap_bytes to make the same sort of workaround, but it was removed in the same commit that added dbi->write_memory_bpw, so we need to use the latter now to have the correct behavior. This fixes every 3 columns of pixels being swapped on the display. There are 3 pixels per byte, so the byte swap caused this effect. Fixes: df3fb27a74a4 ("drm/mipi-dbi: Make bits per word configurable for pixel transfers") Acked-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Signed-off-by: David Lechner Link: https://patch.msgid.link/20260228-drm-mipi-dbi-fix-st7586-byte-swap-v1-1-e78f6c24cd28@baylibre.com commit 1954c4f012206147c34acda8da04f827aa7d3ee3 Author: Eric Dumazet Date: Sat Mar 7 20:07:15 2026 +0000 eventpoll: Convert epoll_put_uevent() to scoped user access Saves two function calls, and one stac/clac pair. stac/clac is rather expensive on older cpus like Zen 2. A synthetic network stress test gives a ~1.5% increase of pps on AMD Zen 2. Signed-off-by: Eric Dumazet Cc: Christophe Leroy Cc: Dave Hansen Cc: Kuniyuki Iwashima Signed-off-by: Linus Torvalds commit 4da879a0d3fd170a70994b73baa554c6913918b5 Author: Gary Guo Date: Mon Mar 2 16:42:36 2026 +0000 rust: dma: use pointer projection infra for `dma_{read,write}` macro Current `dma_read!`, `dma_write!` macros also use a custom `addr_of!()`-based implementation for projecting pointers, which has soundness issue as it relies on absence of `Deref` implementation on types. It also has a soundness issue where it does not protect against unaligned fields (when `#[repr(packed)]` is used) so it can generate misaligned accesses. This commit migrates them to use the general pointer projection infrastructure, which handles these cases correctly. As part of migration, the macro is updated to have an improved surface syntax. The current macro have dma_read!(a.b.c[d].e.f) to mean `a.b.c` is a DMA coherent allocation and it should project into it with `[d].e.f` and do a read, which is confusing as it makes the indexing operator integral to the macro (so it will break if you have an array of `CoherentAllocation`, for example). This also is problematic as we would like to generalize `CoherentAllocation` from just slices to arbitrary types. Make the macro expects `dma_read!(path.to.dma, .path.inside.dma)` as the canonical syntax. The index operator is no longer special and is just one type of projection (in additional to field projection). Similarly, make `dma_write!(path.to.dma, .path.inside.dma, value)` become the canonical syntax for writing. Another issue of the current macro is that it is always fallible. This makes sense with existing design of `CoherentAllocation`, but once we support fixed size arrays with `CoherentAllocation`, it is desirable to have the ability to perform infallible indexing as well, e.g. doing a `[0]` index of `[Foo; 2]` is okay and can be checked at build-time, so forcing falliblity is non-ideal. To capture this, the macro is changed to use `[idx]` as infallible projection and `[idx]?` as fallible index projection (those syntax are part of the general projection infra). A benefit of this is that while individual indexing operation may fail, the overall read/write operation is not fallible. Fixes: ad2907b4e308 ("rust: add dma coherent allocator abstraction") Reviewed-by: Benno Lossin Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260302164239.284084-4-gary@kernel.org [ Capitalize safety comments; slightly improve wording in doc-comments. - Danilo ] Signed-off-by: Danilo Krummrich commit f41941aab3acd33f13d65a2ae496329bc8ae4de0 Author: Gary Guo Date: Mon Mar 2 16:42:35 2026 +0000 rust: ptr: add projection infrastructure Add a generic infrastructure for performing field and index projections on raw pointers. This will form the basis of performing I/O projections. Pointers manipulations are intentionally using the safe wrapping variants instead of the unsafe variants, as the latter requires pointers to be inside an allocation which is not necessarily true for I/O pointers. This projection macro protects against rogue `Deref` implementation, which can causes the projected pointer to be outside the bounds of starting pointer. This is extremely unlikely and Rust has a lint to catch this, but is unsoundness regardless. The protection works by inducing type inference ambiguity when `Deref` is implemented. This projection macro also stops projecting into unaligned fields (i.e. fields of `#[repr(packed)]` structs), as misaligned pointers require special handling. This is implemented by attempting to create reference to projected field inside a `if false` block. Despite being unreachable, Rust still checks that they're not unaligned fields. The projection macro supports both fallible and infallible index projections. These are described in detail inside the documentation. Signed-off-by: Gary Guo Reviewed-by: Benno Lossin Acked-by: Miguel Ojeda Link: https://patch.msgid.link/20260302164239.284084-3-gary@kernel.org [ * Add intro-doc links where possible, * Fix typos and slightly improve wording, e.g. "as documentation describes" -> "as the documentation of [`Self::proj`] describes", * Add an empty line between regular and safety comments, before examples, and between logically independent comments, * Capitalize various safety comments. - Danilo ] Signed-off-by: Danilo Krummrich commit 3b5d535c635cbf88dbb63231cbae265b22e6a5f5 Merge: fb07430e6f98cc 14d4ac19d18953 Author: Linus Torvalds Date: Sat Mar 7 14:04:50 2026 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two core changes and the rest in drivers, one core change to quirk the behaviour of the Iomega Zip drive and one to fix a hang caused by tag reallocation problems, which has mostly been seen by the iscsi client. Note the latter fixes the problem but still has a slight sysfs memory leak, so will be amended in the next pull request (once we've run the fix for the fix through our testing)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: target: Fix recursive locking in __configfs_open_file() scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP scsi: mpi3mr: Clear reset history on ready and recheck state after timeout scsi: core: Fix refcount leak for tagset_refcnt commit 08da98f18f4f99aa16838397b76086d2d1d364b3 Author: Gary Guo Date: Mon Mar 2 16:42:34 2026 +0000 rust: ptr: add `KnownSize` trait to support DST size info extraction Add a `KnownSize` trait which is used obtain a size from a raw pointer's metadata. This makes it possible to obtain size information on a raw slice pointer. This is similar to Rust `core::mem::size_of_val_raw` which is not yet stable. Signed-off-by: Gary Guo Reviewed-by: Benno Lossin Acked-by: Miguel Ojeda Link: https://patch.msgid.link/20260302164239.284084-2-gary@kernel.org [ Fix wording in doc-comment. - Danilo ] Signed-off-by: Danilo Krummrich commit 6da5e537f5afe091658e846da1949d7e557d2ade Author: Marc Zyngier Date: Sat Mar 7 19:11:51 2026 +0000 KVM: arm64: vgic: Pick EOIcount deactivations from AP-list tail Valentine reports that their guests fail to boot correctly, losing interrupts, and indicates that the wrong interrupt gets deactivated. What happens here is that if the maintenance interrupt is slow enough to kick us out of the guest, extra interrupts can be activated from the LRs. We then exit and proceed to handle EOIcount deactivations, picking active interrupts from the AP list. But we start from the top of the list, potentially deactivating interrupts that were in the LRs, while EOIcount only denotes deactivation of interrupts that are not present in an LR. Solve this by tracking the last interrupt that made it in the LRs, and start the EOIcount deactivation walk *after* that interrupt. Since this only makes sense while the vcpu is loaded, stash this in the per-CPU host state. Huge thanks to Valentine for doing all the detective work and providing an initial patch. Fixes: 3cfd59f81e0f3 ("KVM: arm64: GICv3: Handle LR overflow when EOImode==0") Fixes: 281c6c06e2a7b ("KVM: arm64: GICv2: Handle LR overflow when EOImode==0") Reported-by: Valentine Burley Tested-by: Valentine Burley Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20260307115955.369455-1-valentine.burley@collabora.com Link: https://patch.msgid.link/20260307191151.3781182-1-maz@kernel.org Cc: stable@vger.kernel.org commit 598bbefa8032cc58b564a81d1ad68bd815c8dc0f Author: Harald Freudenberger Date: Fri Feb 27 14:30:51 2026 +0100 s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute The serialnr sysfs attribute for CCA cards when queried always used the default domain for sending the request down to the card. If for any reason exactly this default domain is disabled then the attribute code fails to retrieve the CCA info and the sysfs entry shows an empty string. Works as designed but the serial number is a card attribute and thus it does not matter which domain is used for the query. So if there are other domains on this card available, these could be used. So extend the code to use AUTOSEL_DOM for the domain value to address any online domain within the card for querying the cca info and thus show the serialnr as long as there is one domain usable regardless of the default domain setting. Fixes: 8f291ebf3270 ("s390/zcrypt: enable card/domain autoselect on ep11 cprbs") Suggested-by: Ingo Franzki Signed-off-by: Harald Freudenberger Reviewed-by: Ingo Franzki Cc: stable@vger.kernel.org Signed-off-by: Vasily Gorbik commit 75aa996ea63f8656b668f8d9acb2c7a77c055e7f Author: Heiko Carstens Date: Fri Mar 6 12:19:19 2026 +0100 s390: Revert "s390/irq/idle: Remove psw bits early" This reverts commit d8b5cf9c63143fae54a734c41e3bb55cf3f365c7. Mikhail Zaslonko reported that linux-next doesn't boot anymore [2]. Reason for this is recent change [2] was supposed to slightly optimize the irq entry/exit path by removing some psw bits early in case of an idle exit. This however is incorrect since irqentry_exit() requires the correct old psw state at irq entry. Otherwise the embedded regs_irqs_disabled() will not provide the correct result. With linux-next and HRTIMER_REARM_DEFERRED this leads to the observed boot problems, however the commit is broken in any case. Revert the commit which introduced this. Thanks to Peter Zijlstra for pointing out that this is a bug in the s390 entry code. Fixes: d8b5cf9c6314 ("s390/irq/idle: Remove psw bits early") [1] Reported-by: Mikhail Zaslonko Reported-by: Peter Zijlstra Closes: https://lore.kernel.org/r/af549a19-db99-4b16-8511-bf315177a13e@linux.ibm.com/ [2] Signed-off-by: Heiko Carstens Acked-by: Mikhail Zaslonko Tested-by: Mikhail Zaslonko Acked-by: Vasily Gorbik Link: https://lore.kernel.org/r/20260306111919.362559-1-hca@linux.ibm.com Signed-off-by: Vasily Gorbik commit fb07430e6f98ccff61f6f1a06d01d7f12e29c6d3 Merge: 6deccafcb45b53 e31a374a99f502 Author: Linus Torvalds Date: Sat Mar 7 13:21:43 2026 -0800 Merge tag 'fbdev-for-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fix from Helge Deller: "Silence build error in au1100fb driver found by kernel test robot" * tag 'fbdev-for-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: au1100fb: Fix build on MIPS64 commit 6deccafcb45b53825b2039c475da0258c899418b Merge: 8b7f4cd3ac300c 8475d8fe21ec9c Author: Linus Torvalds Date: Sat Mar 7 12:38:16 2026 -0800 Merge tag 'parisc-for-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: "While testing Sasha Levin's 'kallsyms: embed source file:line info in kernel stack traces' patch series, which increases the typical kernel image size, I found some issues with the parisc initial kernel mapping which may prevent the kernel to boot. The three small patches here fix this" * tag 'parisc-for-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix initial page table creation for boot parisc: Check kernel mapping earlier at bootup parisc: Increase initial mapping to 64 MB with KALLSYMS commit 8b7f4cd3ac300cad4446eeb4c9eb69d02ef52d6c Merge: 03dcad79eec3b2 b0dcdcb9ae757c Author: Linus Torvalds Date: Sat Mar 7 12:20:37 2026 -0800 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix u32/s32 bounds when ranges cross min/max boundary (Eduard Zingerman) - Fix precision backtracking with linked registers (Eduard Zingerman) - Fix linker flags detection for resolve_btfids (Ihor Solodrai) - Fix race in update_ftrace_direct_add/del (Jiri Olsa) - Fix UAF in bpf_trampoline_link_cgroup_shim (Lang Xu) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: resolve_btfids: Fix linker flags detection selftests/bpf: add reproducer for spurious precision propagation through calls bpf: collect only live registers in linked regs Revert "selftests/bpf: Update reg_bound range refinement logic" selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary bpf: Fix u32/s32 bounds when ranges cross min/max boundary bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim ftrace: Add missing ftrace_lock to update_ftrace_direct_add/del commit 03dcad79eec3b2056c31031217cda9be70eabe11 Merge: aed0af05a87344 78c2ce0fd6ddb6 Author: Linus Torvalds Date: Sat Mar 7 11:56:55 2026 -0800 Merge tag 'rcu-fixes.v7.0-20260307a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU selftest fixes from Boqun Feng: "Fix a regression in RCU torture test pre-defined scenarios caused by commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") which limits PREEMPT_NONE to architectures that do not support preemption at all and PREEMPT_VOLUNTARY to those architectures that do not yet have PREEMPT_LAZY support. Since major architectures (e.g. x86 and arm64) no longer support CONFIG_PREEMPT_NONE and CONFIG_PREEMPT_VOLUNTARY, using them in rcutorture, rcuscale, refscale, and scftorture pre-defined scenarios causes config checking errors. Switch these kconfigs to PREEMPT_LAZY" * tag 'rcu-fixes.v7.0-20260307a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: scftorture: Update due to x86 not supporting none/voluntary preemption refscale: Update due to x86 not supporting none/voluntary preemption rcuscale: Update due to x86 not supporting none/voluntary preemption rcutorture: Update due to x86 not supporting none/voluntary preemption commit 555317d6100164748f7d09f80142739bd29f0cda Author: Cristian Marussi Date: Thu Mar 5 13:10:11 2026 +0000 firmware: arm_scmi: Fix NULL dereference on notify error path Since commit b5daf93b809d1 ("firmware: arm_scmi: Avoid notifier registration for unsupported events") the call chains leading to the helper __scmi_event_handler_get_ops expect an ERR_PTR to be returned on failure to get an handler for the requested event key, while the current helper can still return a NULL when no handler could be found or created. Fix by forcing an ERR_PTR return value when the handler reference is NULL. Fixes: b5daf93b809d1 ("firmware: arm_scmi: Avoid notifier registration for unsupported events") Signed-off-by: Cristian Marussi Reviewed-by: Dan Carpenter Message-Id: <20260305131011.541444-1-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla commit 879c001afbac3df94160334fe5117c0c83b2cf48 Author: Felix Gu Date: Wed Jan 21 21:08:19 2026 +0800 firmware: arm_scpi: Fix device_node reference leak in probe path A device_node reference obtained from the device tree is not released on all error paths in the arm_scpi probe path. Specifically, a node returned by of_parse_phandle() could be leaked when the probe failed after the node was acquired. The probe function returns early and the shmem reference is not released. Use __free(device_node) scope-based cleanup to automatically release the reference when the variable goes out of scope. Fixes: ed7ecb883901 ("firmware: arm_scpi: Add compatibility checks for shmem node") Signed-off-by: Felix Gu Message-Id: <20260121-arm_scpi_2-v2-1-702d7fa84acb@gmail.com> Signed-off-by: Sudeep Holla commit aed0af05a873445bed7f28f299da57d54765cc80 Merge: 7b6e48df8892e1 d008ba8be89847 Author: Linus Torvalds Date: Sat Mar 7 09:50:54 2026 -0800 Merge tag 'trace-v7.0-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix possible NULL pointer dereference in trace_data_alloc() On the trace_data_alloc() error path, it can call trigger_data_free() with a NULL pointer. This used to be a kfree() but was changed to trigger_data_free() to clean up any partial initialization. The issue is that trigger_data_free() does not expect a NULL pointer. Have trigger_data_free() return safely on NULL pointer. - Fix multiple events on the command line and bootconfig If multiple events are enabled on the command line separately and not grouped, only the last event gets enabled. That is: trace_event=sched_switch trace_event=sched_waking will only enable sched_waking whereas: trace_event=sched_switch,sched_waking will enable both. The bootconfig makes it even worse as the second way is the more common method. The issue is that a temporary buffer is used to store the events to enable later in boot. Each time the cmdline callback is called, it overwrites what was previously there. Have the callback append the next value (delimited by a comma) if the temporary buffer already has content. - Fix command line trace_buffer_size if >= 2G The logic to allocate the trace buffer uses "int" for the size parameter in the command line code causing overflow issues if more that 2G is specified. * tag 'trace-v7.0-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G tracing: Fix enabling multiple events on the kernel command line and bootconfig tracing: Add NULL pointer check to trigger_data_free() commit b0dcdcb9ae757c8a8ba2fb24d34f8d147bae707b Author: Ihor Solodrai Date: Wed Mar 4 17:47:30 2026 -0800 resolve_btfids: Fix linker flags detection The "|| echo -lzstd" default makes zstd an unconditional link dependency of resolve_btfids. On systems where libzstd-dev is not installed and pkg-config fails, the linker fails: ld: cannot find -lzstd: No such file or directory libzstd is a transitive dependency of libelf, so the -lzstd flag is strictly necessary only for static builds [1]. Remove ZSTD_LIBS variable, and instead set LIBELF_LIBS depending on whether the build is static or not. Use $(HOSTPKG_CONFIG) as primary source of the flags list. Also add a default value for HOSTPKG_CONFIG in case it's not built via the toplevel Makefile. Pass it from selftests/bpf too. [1] https://lore.kernel.org/bpf/4ff82800-2daa-4b9f-95a9-6f512859ee70@linux.dev/ Reported-by: BPF CI Bot (Claude Opus 4.6) Reported-by: Vitaly Chikunov Closes: https://lore.kernel.org/bpf/aaWqMcK-2AQw5dx8@altlinux.org/ Fixes: 4021848a903e ("selftests/bpf: Pass through build flags to bpftool and resolve_btfids") Signed-off-by: Ihor Solodrai Reviewed-by: Paul Chaignon Link: https://lore.kernel.org/r/20260305014730.3123382-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 7b6e48df8892e1f128473e6971b3b8b24eb39f4b Merge: e33aafac04bdd8 25dd70a03b1f5f Author: Linus Torvalds Date: Sat Mar 7 08:39:59 2026 -0800 Merge tag 'hwmon-for-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Fix initialization commands for AHT20 - Correct a malformed email address (emc1403) - Check the it87_lock() return value - Fix inverted polarity (max6639) - Fix overflows, underflows, sign extension, and other problems in macsmc - Fix stack overflow in debugfs read (pmbus/q54sj108a2) - Drop support for SMARC-sAM67 (discontinued and never released to market) * tag 'hwmon-for-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read hwmon: (max6639) fix inverted polarity dt-bindings: hwmon: sl28cpld: Drop sa67mcu compatible hwmon: (it87) Check the it87_lock() return value Revert "hwmon: add SMARC-sAM67 support" hwmon: (aht10) Fix initialization commands for AHT20 hwmon: (emc1403) correct a malformed email address hwmon: (macsmc) Fix overflows, underflows, and sign extension hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver commit e33aafac04bdd8f03300651916386e296eb8020a Merge: 0f912c8917e810 9de68394a61528 Author: Linus Torvalds Date: Sat Mar 7 08:16:48 2026 -0800 Merge tag 'driver-core-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fix from Danilo Krummrich: - Revert "driver core: enforce device_lock for driver_match_device()": When a device is already present in the system and a driver is registered on the same bus, we iterate over all devices registered on this bus to see if one of them matches. If we come across an already bound one where the corresponding driver crashed while holding the device lock (e.g. in probe()) we can't make any progress anymore. Thus, revert and clarify that an implementer of struct bus_type must not expect match() to be called with the device lock held. * tag 'driver-core-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: Revert "driver core: enforce device_lock for driver_match_device()" commit 8ddc0c26916574395447ebf4cff684314f6873a9 Author: Xingui Yang Date: Thu Mar 5 14:40:39 2026 +0800 scsi: hisi_sas: Fix NULL pointer exception during user_scan() user_scan() invokes updated sas_user_scan() for channel 0, and if successful, iteratively scans remaining channels (1 to shost->max_channel) via scsi_scan_host_selected() in commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"). However, hisi_sas supports only one channel, and the current value of max_channel is 1. sas_user_scan() for channel 1 will trigger the following NULL pointer exception: [ 441.554662] Unable to handle kernel NULL pointer dereference at virtual address 00000000000008b0 [ 441.554699] Mem abort info: [ 441.554710] ESR = 0x0000000096000004 [ 441.554718] EC = 0x25: DABT (current EL), IL = 32 bits [ 441.554723] SET = 0, FnV = 0 [ 441.554726] EA = 0, S1PTW = 0 [ 441.554730] FSC = 0x04: level 0 translation fault [ 441.554735] Data abort info: [ 441.554737] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 441.554742] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 441.554747] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 441.554752] user pgtable: 4k pages, 48-bit VAs, pgdp=00000828377a6000 [ 441.554757] [00000000000008b0] pgd=0000000000000000, p4d=0000000000000000 [ 441.554769] Internal error: Oops: 0000000096000004 [#1] SMP [ 441.629589] Modules linked in: arm_spe_pmu arm_smmuv3_pmu tpm_tis_spi hisi_uncore_sllc_pmu hisi_uncore_pa_pmu hisi_uncore_l3c_pmu hisi_uncore_hha_pmu hisi_uncore_ddrc_pmu hisi_uncore_cpa_pmu hns3_pmu hisi_ptt hisi_pcie_pmu tpm_tis_core spidev spi_hisi_sfc_v3xx hisi_uncore_pmu spi_dw_mmio fuse hclge hclge_common hisi_sec2 hisi_hpre hisi_zip hisi_qm hns3 hisi_sas_v3_hw sm3_ce sbsa_gwdt hnae3 hisi_sas_main uacce hisi_dma i2c_hisi dm_mirror dm_region_hash dm_log dm_mod [ 441.670819] CPU: 46 UID: 0 PID: 6994 Comm: bash Kdump: loaded Not tainted 7.0.0-rc2+ #84 PREEMPT [ 441.691327] pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 441.698277] pc : sas_find_dev_by_rphy+0x44/0x118 [ 441.702896] lr : sas_find_dev_by_rphy+0x3c/0x118 [ 441.707502] sp : ffff80009abbba40 [ 441.710805] x29: ffff80009abbba40 x28: ffff082819a40008 x27: ffff082810c37c08 [ 441.717930] x26: ffff082810c37c28 x25: ffff082819a40290 x24: ffff082810c37c00 [ 441.725054] x23: 0000000000000000 x22: 0000000000000001 x21: ffff082819a40000 [ 441.732179] x20: ffff082819a40290 x19: 0000000000000000 x18: 0000000000000020 [ 441.739304] x17: 0000000000000000 x16: ffffb5dad6bda690 x15: 00000000ffffffff [ 441.746428] x14: ffff082814c3b26c x13: 00000000ffffffff x12: ffff082814c3b26a [ 441.753553] x11: 00000000000000c0 x10: 000000000000003a x9 : ffffb5dad5ea94f4 [ 441.760678] x8 : 000000000000003a x7 : ffff80009abbbab0 x6 : 0000000000000030 [ 441.767802] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 441.774926] x2 : ffff08280f35a300 x1 : ffffb5dad7127180 x0 : 0000000000000000 [ 441.782053] Call trace: [ 441.784488] sas_find_dev_by_rphy+0x44/0x118 (P) [ 441.789095] sas_target_alloc+0x24/0xb0 [ 441.792920] scsi_alloc_target+0x290/0x330 [ 441.797010] __scsi_scan_target+0x88/0x258 [ 441.801096] scsi_scan_channel+0x74/0xb8 [ 441.805008] scsi_scan_host_selected+0x170/0x188 [ 441.809615] sas_user_scan+0xfc/0x148 [ 441.813267] store_scan+0x10c/0x180 [ 441.816743] dev_attr_store+0x20/0x40 [ 441.820398] sysfs_kf_write+0x84/0xa8 [ 441.824054] kernfs_fop_write_iter+0x130/0x1c8 [ 441.828487] vfs_write+0x2c0/0x370 [ 441.831880] ksys_write+0x74/0x118 [ 441.835271] __arm64_sys_write+0x24/0x38 [ 441.839182] invoke_syscall+0x50/0x120 [ 441.842919] el0_svc_common.constprop.0+0xc8/0xf0 [ 441.847611] do_el0_svc+0x24/0x38 [ 441.850913] el0_svc+0x38/0x158 [ 441.854043] el0t_64_sync_handler+0xa0/0xe8 [ 441.858214] el0t_64_sync+0x1ac/0x1b0 [ 441.861865] Code: aa1303e0 97ff70a8 34ffff80 d10a4273 (f9445a75) [ 441.867946] ---[ end trace 0000000000000000 ]--- Therefore, set max_channel to 0. Fixes: e21fe3a52692 ("scsi: hisi_sas: add initialisation for v3 pci-based controller") Signed-off-by: Xingui Yang Signed-off-by: Yihang Li Link: https://patch.msgid.link/20260305064039.4096775-1-liyihang9@huawei.com Signed-off-by: Martin K. Petersen commit c0b7da13a04bd70ef6070bfb9ea85f582294560a Author: Vladimir Riabchun Date: Tue Feb 10 11:08:22 2026 +0100 scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea. Fixes: 82f522ae0d97 ("scsi: qla2xxx: Fix double free of fcport") Fixes: 4895009c4bb7 ("scsi: qla2xxx: Prevent command send on chip reset") Signed-off-by: Vladimir Riabchun Signed-off-by: Farhat Abbas Link: https://patch.msgid.link/aYsDln9NFQQsPDgg@vova-pc Signed-off-by: Martin K. Petersen commit b0bd84c39289ef6a6c3827dd52c875659291970a Author: Wang Shuaiwei Date: Sat Mar 7 11:51:28 2026 +0800 scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend In __ufshcd_wl_suspend(), cancel_delayed_work_sync() is called to cancel the UFS RTC work, but it is placed after ufshcd_vops_suspend(hba, pm_op, POST_CHANGE). This creates a race condition where ufshcd_rtc_work() can still be running while ufshcd_vops_suspend() is executing. When UFSHCD_CAP_CLK_GATING is not supported, the condition !hba->clk_gating.active_reqs is always true, causing ufshcd_update_rtc() to be executed. Since ufshcd_vops_suspend() typically performs clock gating operations, executing ufshcd_update_rtc() at that moment triggers an SError. The kernel panic trace is as follows: Kernel panic - not syncing: Asynchronous SError Interrupt Call trace: dump_backtrace+0xec/0x128 show_stack+0x18/0x28 dump_stack_lvl+0x40/0xa0 dump_stack+0x18/0x24 panic+0x148/0x374 nmi_panic+0x3c/0x8c arm64_serror_panic+0x64/0x8c do_serror+0xc4/0xc8 el1h_64_error_handler+0x34/0x4c el1h_64_error+0x68/0x6c el1_interrupt+0x20/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c ktime_get+0xc4/0x12c ufshcd_mcq_sq_stop+0x4c/0xec ufshcd_mcq_sq_cleanup+0x64/0x1dc ufshcd_clear_cmd+0x38/0x134 ufshcd_issue_dev_cmd+0x298/0x4d0 ufshcd_exec_dev_cmd+0x1a4/0x1c4 ufshcd_query_attr+0xbc/0x19c ufshcd_rtc_work+0x10c/0x1c8 process_scheduled_works+0x1c4/0x45c worker_thread+0x32c/0x3e8 kthread+0x120/0x1d8 ret_from_fork+0x10/0x20 Fix this by moving cancel_delayed_work_sync() before the call to ufshcd_vops_suspend(hba, pm_op, PRE_CHANGE), ensuring the UFS RTC work is fully completed or cancelled at that point. Cc: Bean Huo Fixes: 6bf999e0eb41 ("scsi: ufs: core: Add UFS RTC support") Reviewed-by: Bart Van Assche Signed-off-by: Wang Shuaiwei Link: https://patch.msgid.link/20260307035128.3419687-1-wangshuaiwei1@xiaomi.com Signed-off-by: Martin K. Petersen commit 4ce7ada40c008fa21b7e52ab9d04e8746e2e9325 Author: Junxiao Bi Date: Wed Mar 4 08:46:03 2026 -0800 scsi: core: Fix error handling for scsi_alloc_sdev() After scsi_sysfs_device_initialize() was called, error paths must call __scsi_remove_device(). Fixes: 1ac22c8eae81 ("scsi: core: Fix refcount leak for tagset_refcnt") Cc: stable@vger.kernel.org Signed-off-by: Junxiao Bi Reviewed-by: John Garry Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260304164603.51528-1-junxiao.bi@oracle.com Signed-off-by: Martin K. Petersen commit 0f912c8917e810a4aa81d122a8e7d0a918505ab9 Merge: 4ae12d8bd9a830 e2dcf9065536ab Author: Linus Torvalds Date: Sat Mar 7 07:44:32 2026 -0800 Merge tag 'for-linus-7.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - a cleanup of arch/x86/kernel/head_64.S removing the pre-built page tables for Xen guests - a small comment update - another cleanup for Xen PVH guests mode - fix an issue with Xen PV-devices backed by driver domains * tag 'for-linus-7.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/xenbus: better handle backend crash xenbus: add xenbus_device parameter to xenbus_read_driver_state() x86/PVH: Use boot params to pass RSDP address in start_info page x86/xen: update outdated comment xen/acpi-processor: fix _CST detection using undersized evaluation buffer x86/xen: Build identity mapping page tables dynamically for XENPV commit 57ccf5ccdc56954f2a91a7f66684fd31c566bde5 Author: Tejun Heo Date: Sat Mar 7 04:53:32 2026 -1000 sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags enqueue_task_scx() takes int enq_flags from the sched_class interface. SCX enqueue flags starting at bit 32 (SCX_ENQ_PREEMPT and above) are silently truncated when passed through activate_task(). extra_enq_flags was added as a workaround - storing high bits in rq->scx.extra_enq_flags and OR-ing them back in enqueue_task_scx(). However, the OR target is still the int parameter, so the high bits are lost anyway. The current impact is limited as the only affected flag is SCX_ENQ_PREEMPT which is informational to the BPF scheduler - its loss means the scheduler doesn't know about preemption but doesn't cause incorrect behavior. Fix by renaming the int parameter to core_enq_flags and introducing a u64 enq_flags local that merges both sources. All downstream functions already take u64 enq_flags. Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class") Cc: stable@vger.kernel.org # v6.12+ Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit ea7e2e43d768102e2601dbbda42041c78d7a99f9 Author: Antoniu Miclaus Date: Fri Feb 27 14:20:46 2026 +0200 iio: imu: adis16550: fix swapped gyro/accel filter functions The low-pass filter handlers for IIO_ANGL_VEL and IIO_ACCEL call each other's filter functions in both read_raw and write_raw. Swap them so each channel type uses its correct filter accessor. Fixes: bac4368fab62 ("iio: imu: adis16550: add adis16550 support") Signed-off-by: Antoniu Miclaus Acked-by: Robert Budai Cc: Signed-off-by: Jonathan Cameron commit 7cf2f6ed8e7a3bf481ef70b6b4a2edb8abfa5c57 Author: Billy Tsai Date: Tue Mar 3 10:38:26 2026 +0800 iio: adc: aspeed: clear reference voltage bits before configuring vref Ensures the reference voltage bits are cleared in the ADC engine control register before configuring the voltage reference. This avoids potential misconfigurations caused by residual bits. Fixes: 1b5ceb55fec2 ("iio: adc: aspeed: Support ast2600 adc.") Signed-off-by: Billy Tsai Cc: Signed-off-by: Jonathan Cameron commit 2f168094177f8553a36046afce139001801ca917 Author: Felix Gu Date: Tue Mar 3 21:47:33 2026 +0800 iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() The completion is not reinit before wait_for_completion_timeout(), so wait_for_completion_timeout() will return immediately after the first successful completion. Fixes: a9306887eba4 ("iio: adc: ti-ads1119: Add driver") Signed-off-by: Felix Gu Reviewed-by: Francesco Dolcini Cc: Signed-off-by: Jonathan Cameron commit 6f658d19a5a29a602c372e8cfe8d4a623367d211 Author: Chunyang Chen Date: Thu Mar 5 20:43:02 2026 +0800 iio: adc: ti-ads1018: fix type overflow for data rate The variable 'drate' is currently defined as u8. However, the data rate values in ads1018 can reach up to 3300 Hz, which exceeds the maximum value of 255 that a u8 can hold. Change the type of 'drate' to u32 to match the data_rate_mode_to_hz array definition and ensure the data rate is handled correctly. Fixes: bf0bba486b5b ("iio: adc: Add ti-ads1018 driver") Signed-off-by: Chunyang Chen Reviewed-by: Andy Shevchenko Reviewed-by: Kurt Borja Signed-off-by: Jonathan Cameron commit d20bbae6e5d408a8a7c2a4344d76dd1ac557a149 Author: Dmitry Torokhov Date: Thu Mar 5 11:21:53 2026 -0800 iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() GPIO state was inadvertently overwritten by the result of spi_sync(), resulting in ti_ads7950_get() only returning 0 as GPIO state (or error). Fix this by introducing a separate variable to hold the state. Fixes: c97dce792dc8 ("iio: adc: ti-ads7950: add GPIO support") Reported-by: David Lechner Signed-off-by: Dmitry Torokhov Cc: Signed-off-by: Jonathan Cameron commit e2fa075d5ce1963e7cb7b0ac708ba567e5af66db Author: Dmitry Torokhov Date: Thu Mar 5 11:21:52 2026 -0800 iio: adc: ti-ads7950: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by ti_ads7950_get() for output pins is normalized to the [0, 1] range. Fixes: 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()") Reviewed-by: Andy Shevchenko Reviewed-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Signed-off-by: Dmitry Torokhov Cc: Signed-off-by: Jonathan Cameron commit 35e4f2a17eb40288f9bcdb09549fa04a63a96279 Author: Nam Cao Date: Mon Mar 2 01:39:48 2026 +0100 powerpc/pseries: Correct MSI allocation tracking The per-device MSI allocation calculation in pseries_irq_domain_alloc() is clearly wrong. It can still happen to work when nr_irqs is 1. Correct it. Fixes: c0215e2d72de ("powerpc/pseries: Fix MSI-X allocation failure when quota is exceeded") Cc: stable@vger.kernel.org Signed-off-by: Nam Cao Reviewed-by: Mahesh Salgaonkar Reviewed-by: Nilay Shroff [maddy: Fixed Nilay's reviewed-by tag] Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260302003948.1452016-1-namcao@linutronix.de commit 6373a2b5c878e920341d7bda84ac1126f72e6a68 Author: J. Neuschäfer Date: Tue Mar 3 16:50:55 2026 +0100 powerpc: dts: mpc83xx: Add unit addresses to /memory This fixes dtschema warnings such as the following: arch/powerpc/boot/dts/mpc8315erdb.dtb: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728]]} Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303-mpc83xx-cleanup-v2-5-187d3a13effa@posteo.net commit fde54f1a4dc7bfd83908380c0b4b6a830a0f9e01 Author: J. Neuschäfer Date: Tue Mar 3 16:50:54 2026 +0100 powerpc: dts: mpc8315erdb: Add missing #cells properties to SPI bus These properties are required by the spi-controller binding. Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303-mpc83xx-cleanup-v2-4-187d3a13effa@posteo.net commit 31618e0e21c4633c365b26e6d45cae2084f4245b Author: J. Neuschäfer Date: Tue Mar 3 16:50:53 2026 +0100 powerpc: dts: mpc8315erdb: Rename LED nodes to comply with schema The leds-gpio.yaml schema requires that GPIO LED nodes contain "led", and preferably start with "led-" Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303-mpc83xx-cleanup-v2-3-187d3a13effa@posteo.net commit 4f439747811977d05a87da65c1ae11246d4f4dee Author: J. Neuschäfer Date: Tue Mar 3 16:50:52 2026 +0100 powerpc: dts: mpc8315erdb: Use IRQ_TYPE_* macros This increases readability, because "0x8" isn't very descriptive. mpc8315erdb.dtb remains identical after this patch. Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303-mpc83xx-cleanup-v2-2-187d3a13effa@posteo.net commit 38ce944d47b717cac6b5f2bae9dd247f87f21ac7 Author: J. Neuschäfer Date: Tue Mar 3 16:50:51 2026 +0100 powerpc: dts: mpc8313erdb: Use IRQ_TYPE_* macros This increases readability, because "0x8" isn't very descriptive. mpc8313erdb.dtb remains identical after this patch. Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303-mpc83xx-cleanup-v2-1-187d3a13effa@posteo.net commit 691417ffe7821721e0a28bd25ad8c0dc0d4ae4ad Author: J. Neuschäfer Date: Tue Mar 3 16:31:42 2026 +0100 powerpc: 83xx: km83xx: Fix keymile vendor prefix When kmeter.c was refactored into km83xx.c in 2011, the "keymile" vendor prefix was changed to upper-case "Keymile". The devicetree at arch/powerpc/boot/dts/kmeter1.dts never underwent the same change, suggesting that this was simply a mistake. Fixes: 93e2b95c81042d ("powerpc/83xx: rename and update kmeter1") Signed-off-by: J. Neuschäfer Reviewed-by: Heiko Schocher Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303-keymile-v1-1-463a11e71702@posteo.net commit 202d23eeccd4b12047869538d6fb91d1e42c4ddd Author: J. Neuschäfer Date: Tue Mar 3 17:04:08 2026 +0100 dt-bindings: powerpc: Add Freescale/NXP MPC83xx SoCs Add a new binding for MPC83xx platforms, describing the board compatible strings used in currently existing device trees. Note that the SoC bus is called immr@... in many existing devicetrees, but this contradicts the simple-bus binding. Reviewed-by: Rob Herring (Arm) Reviewed-by: Christophe Leroy Signed-off-by: J. Neuschäfer Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303-ppcyaml-soc-v5-1-2982d5a857bc@posteo.net commit 01b6ac72729610ae732ca2a66e3a642e23f6cd60 Author: Hari Bathini Date: Tue Mar 3 23:40:30 2026 +0530 powerpc64/bpf: fix kfunc call support Commit 61688a82e047 ("powerpc/bpf: enable kfunc call") inadvertently enabled kfunc call support for 32-bit powerpc but that support will not be possible until ABI mismatch between 32-bit powerpc and eBPF is handled in 32-bit powerpc JIT code. Till then, advertise support only for 64-bit powerpc. Also, in powerpc ABI, caller needs to extend the arguments properly based on signedness. The JIT code is responsible for handling this explicitly for kfunc calls as verifier can't handle this for each architecture-specific ABI needs. But this was not taken care of while kfunc call support was enabled for powerpc. Fix it by handling this with bpf_jit_find_kfunc_model() and using zero_extend() & sign_extend() helper functions. Fixes: 61688a82e047 ("powerpc/bpf: enable kfunc call") Cc: stable@vger.kernel.org Signed-off-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303181031.390073-7-hbathini@linux.ibm.com commit 51b8de4b3d27ec12128fa2405e526c527a77ae65 Author: Hari Bathini Date: Tue Mar 3 23:40:29 2026 +0530 powerpc64/bpf: fix handling of BPF stack in exception callback Exception callback reuses the stack frame of exception boundary. When exception boundary and exception callback programs have different BPF stack depth, the current stack unwind in exception callback will fail. Adjust the stack frame size of exception callback, in its prologue, if its BPF stack depth is different from that of exception boundary. Reported-by: bot+bpf-ci@kernel.org Closes: https://lore.kernel.org/bpf/2a310e86a59eb4c44c3ac9e5647814469d9c955580c9c0f1b3d9ca4a44717a34@mail.kernel.org/ Fixes: 11d45eee9f42 ("powerpc64/bpf: Additional NVR handling for bpf_throw") Signed-off-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303181031.390073-6-hbathini@linux.ibm.com commit 2d347d10f8e20e28a9eab52edf55079ae1ec0aae Author: Hari Bathini Date: Tue Mar 3 23:40:28 2026 +0530 powerpc64/bpf: remove BPF redzone protection in trampoline stack Since bpf2bpf tailcall support is enabled for 64-bit powerpc with kernel commit 2ed2d8f6fb38 ("powerpc64/bpf: Support tailcalls with subprogs"), 'tailcalls/tailcall_bpf2bpf_hierarchy_fexit' BPF selftest is triggering "corrupted stack end detected inside scheduler" with the config option CONFIG_SCHED_STACK_END_CHECK enabled. While reviewing the stack layout for BPF trampoline, observed that the dummy frame is trying to protect the redzone of BPF program. This is because tail call info and NVRs save area are in redzone at the time of tailcall as the current BPF program stack frame is teared down before the tailcall. But saving this redzone in the dummy frame of trampoline is unnecessary because of the follow reasons: 1) Firstly, trampoline can be attached to BPF entry/main program or subprog. But prologue part of the BPF entry/main program, where the trampoline attachpoint is, is skipped during tailcall. So, protecting the redzone does not arise when the trampoline is not even triggered in this scenario. 2) In case of subprog, the caller's stackframe is already setup and the subprog's stackframe is yet to be setup. So, nothing on the redzone to be protected. Also, using dummy frame in BPF trampoline, wastes critically scarce kernel stack space, especially in tailcall sequence, for marginal benefit in stack unwinding. So, drop setting up the dummy frame. Instead, save return address in bpf trampoline frame and use it as appropriate. Pruning this unnecessary stack usage mitigates the likelihood of stack overflow in scenarios where bpf2bpf tailcalls and fexit programs are mixed. Reported-by: Saket Kumar Bhaskar Fixes: 2ed2d8f6fb38 ("powerpc64/bpf: Support tailcalls with subprogs") Tested-by: Venkat Rao Bagalkote Signed-off-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303181031.390073-5-hbathini@linux.ibm.com commit 3727d6ec13665c1d99bf6dedb107104368ba42b4 Author: Hari Bathini Date: Tue Mar 3 23:40:27 2026 +0530 powerpc64/bpf: use consistent tailcall offset in trampoline Ideally, the offset used to load the tail call info field and to find the pass by reference address for tail call field should be the same. But while setting up the tail call info in the trampoline, this was not followed. This can be misleading and can lead to unpredictable results if and when bpf_has_stack_frame() ends up returning true for trampoline frame. Since commit 15513beeb673 ("powerpc64/bpf: Moving tail_call_cnt to bottom of frame") and commit 2ed2d8f6fb38 ("powerpc64/bpf: Support tailcalls with subprogs") ensured tail call field is at the bottom of the stack frame for BPF programs as well as BPF trampoline, avoid relying on bpf_jit_stack_tailcallinfo_offset() and bpf_has_stack_frame() for trampoline frame and always calculate tail call field offset with reference to older frame. Fixes: 2ed2d8f6fb38 ("powerpc64/bpf: Support tailcalls with subprogs") Signed-off-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303181031.390073-4-hbathini@linux.ibm.com commit 157820264ac3dadfafffad63184b883eb28f9ae0 Author: Hari Bathini Date: Tue Mar 3 23:40:26 2026 +0530 powerpc64/bpf: fix the address returned by bpf_get_func_ip bpf_get_func_ip() helper function returns the address of the traced function. It relies on the IP address stored at ctx - 16 by the bpf trampoline. On 64-bit powerpc, this address is recovered from LR accounting for OOL trampoline. But the address stored here was off by 4-bytes. Ensure the address is the actual start of the traced function. Reported-by: Abhishek Dubey Fixes: d243b62b7bd3 ("powerpc64/bpf: Add support for bpf trampolines") Cc: stable@vger.kernel.org Tested-by: Venkat Rao Bagalkote Signed-off-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303181031.390073-3-hbathini@linux.ibm.com commit 521bd39d9d28ce54cbfec7f9b89c94ad4fdb8350 Author: Hari Bathini Date: Tue Mar 3 23:40:25 2026 +0530 powerpc64/bpf: do not increment tailcall count when prog is NULL Do not increment tailcall count, if tailcall did not succeed due to missing BPF program. Fixes: ce0761419fae ("powerpc/bpf: Implement support for tail calls") Cc: stable@vger.kernel.org Tested-by: Venkat Rao Bagalkote Signed-off-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260303181031.390073-2-hbathini@linux.ibm.com commit db54c28702f7270e74dce36c84cb0db4cec96389 Author: Hari Bathini Date: Tue Jan 27 14:19:26 2026 +0530 powerpc64/ftrace: workaround clang recording GEP in __patchable_function_entries Support for -fpatchable-function-entry on ppc64le was added in Clang with [1]. However, when no prefix NOPs are specified - as is the case with CONFIG_PPC_FTRACE_OUT_OF_LINE - the first NOP is emitted at LEP, but Clang records the Global Entry Point (GEP) unlike GCC which does record the Local Entry Point (LEP). Issue [2] has been raised to align Clang's behavior with GCC. As a temporary workaround to ensure ftrace initialization works as expected with Clang, derive the LEP using ppc_function_entry() for kernel symbols and by looking for the below module GEP sequence for module addresses, until [2] is resolved: ld r2, -8(r12) add r2, r2, r12 [1] https://github.com/llvm/llvm-project/pull/151569 [2] https://github.com/llvm/llvm-project/issues/163706 Signed-off-by: Hari Bathini Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260127084926.34497-4-hbathini@linux.ibm.com commit 875612a7745013a43c67493cb0583ee3f7476344 Author: Hari Bathini Date: Tue Jan 27 14:19:25 2026 +0530 powerpc64/ftrace: fix OOL stub count with clang The total number of out-of-line (OOL) stubs required for function tracing is determined using the following command: $(OBJDUMP) -r -j __patchable_function_entries vmlinux.o While this works correctly with GNU objdump, llvm-objdump does not list the expected relocation records for this section. Fix this by using the -d option and counting R_PPC64_ADDR64 relocation entries. This works as desired with both objdump and llvm-objdump. Signed-off-by: Hari Bathini Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260127084926.34497-3-hbathini@linux.ibm.com commit 73cdf24e81e4eba52a40a6b10c6cf285d0ac23fd Author: Hari Bathini Date: Tue Jan 27 14:19:24 2026 +0530 powerpc64: make clang cross-build friendly ARCH_USING_PATCHABLE_FUNCTION_ENTRY depends on toolchain support for -fpatchable-function-entry option. The current script that checks for this support only handles GCC. Rename the script and extend it to detect support for -fpatchable-function-entry with Clang as well, allowing clean cross-compilation with Clang toolchains. Signed-off-by: Hari Bathini Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260127084926.34497-2-hbathini@linux.ibm.com commit 325d1ba3cac4a1c0bf981f73f4edbb7411f0e4dc Merge: 6895e1d7c3171d 223ffb6a3d0582 Author: Alexei Starovoitov Date: Fri Mar 6 18:24:41 2026 -0800 Merge branch 'bpf-fix-precision-backtracking-bug-with-linked-registers' Eduard Zingerman says: ==================== bpf: Fix precision backtracking bug with linked registers Emil Tsalapatis reported a verifier bug hit by the scx_lavd sched_ext scheduler. The essential part of the verifier log looks as follows: 436: ... // checkpoint hit for 438: (1d) if r7 == r8 goto ... frame 3: propagating r2,r7,r8 frame 2: propagating r6 mark_precise: frame3: last_idx ... mark_precise: frame3: regs=r2,r7,r8 stack= before 436: ... mark_precise: frame3: regs=r2,r7 stack= before 435: ... mark_precise: frame3: regs=r2,r7 stack= before 434: (85) call bpf_trace_vprintk#177 verifier bug: backtracking call unexpected regs 84 The log complains that registers r2 and r7 are tracked as precise while processing the bpf_trace_vprintk() call in precision backtracking. This can't be right, as r2 is reset by the call and there is nothing to backtrack it to. The precision propagation is triggered when a checkpoint is hit at instruction 438, r2 is dead at that instruction. This happens because of the following sequence of events: - Instruction 438 is first reached with registers r2 and r7 having the same id via a path that does not call bpf_trace_vprintk(): - Checkpoint is created at 438. - The jump at 438 is predicted, hence r7 and registers linked to it (r2) are propagated as precise, marking r2 and r7 precise in the checkpoint. - Instruction 438 is reached a second time with r2 undefined and via a path that calls bpf_trace_vprintk(): - Checkpoint is hit. - propagate_precision() picks registers r2 and r7 and propagates precision marks for those up to the helper call. The root cause is the fact that states_equal() and propagate_precision() assume that the precision flag can't be set for a dead register (as computed by compute_live_registers()). However, this is not the case when linked registers are at play. Fix this by accounting for live register flags in collect_linked_regs(). --- ==================== Link: https://patch.msgid.link/20260306-linked-regs-and-propagate-precision-v1-0-18e859be570d@gmail.com Signed-off-by: Alexei Starovoitov commit 223ffb6a3d0582522455e83ccf7ad2d3a753e039 Author: Eduard Zingerman Date: Fri Mar 6 16:02:48 2026 -0800 selftests/bpf: add reproducer for spurious precision propagation through calls Add a test for the scenario described in the previous commit: an iterator loop with two paths where one ties r2/r7 via shared scalar id and skips a call, while the other goes through the call. Precision marks from the linked registers get spuriously propagated to the call path via propagate_precision(), hitting "backtracking call unexpected regs" in backtrack_insn(). Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260306-linked-regs-and-propagate-precision-v1-2-18e859be570d@gmail.com Signed-off-by: Alexei Starovoitov commit 2658a1720a1944fbaeda937000ad2b3c3dfaf1bb Author: Eduard Zingerman Date: Fri Mar 6 16:02:47 2026 -0800 bpf: collect only live registers in linked regs Fix an inconsistency between func_states_equal() and collect_linked_regs(): - regsafe() uses check_ids() to verify that cached and current states have identical register id mapping. - func_states_equal() calls regsafe() only for registers computed as live by compute_live_registers(). - clean_live_states() is supposed to remove dead registers from cached states, but it can skip states belonging to an iterator-based loop. - collect_linked_regs() collects all registers sharing the same id, ignoring the marks computed by compute_live_registers(). Linked registers are stored in the state's jump history. - backtrack_insn() marks all linked registers for an instruction as precise whenever one of the linked registers is precise. The above might lead to a scenario: - There is an instruction I with register rY known to be dead at I. - Instruction I is reached via two paths: first A, then B. - On path A: - There is an id link between registers rX and rY. - Checkpoint C is created at I. - Linked register set {rX, rY} is saved to the jump history. - rX is marked as precise at I, causing both rX and rY to be marked precise at C. - On path B: - There is no id link between registers rX and rY, otherwise register states are sub-states of those in C. - Because rY is dead at I, check_ids() returns true. - Current state is considered equal to checkpoint C, propagate_precision() propagates spurious precision mark for register rY along the path B. - Depending on a program, this might hit verifier_bug() in the backtrack_insn(), e.g. if rY ∈ [r1..r5] and backtrack_insn() spots a function call. The reproducer program is in the next patch. This was hit by sched_ext scx_lavd scheduler code. Changes in tests: - verifier_scalar_ids.c selftests need modification to preserve some registers as live for __msg() checks. - exceptions_assert.c adjusted to match changes in the verifier log, R0 is dead after conditional instruction and thus does not get range. - precise.c adjusted to match changes in the verifier log, register r9 is dead after comparison and it's range is not important for test. Reported-by: Emil Tsalapatis Fixes: 0fb3cf6110a5 ("bpf: use register liveness information for func_states_equal") Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260306-linked-regs-and-propagate-precision-v1-1-18e859be570d@gmail.com Signed-off-by: Alexei Starovoitov commit 4ae12d8bd9a830799db335ee661d6cbc6597f838 Merge: 591d8796b26ff7 fdb12c8a24a453 Author: Linus Torvalds Date: Fri Mar 6 20:27:13 2026 -0800 Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Split out .modinfo section from ELF_DETAILS macro, as that macro may be used in other areas that expect to discard .modinfo, breaking certain image layouts - Adjust genksyms parser to handle optional attributes in certain declarations, necessary after commit 07919126ecfc ("netfilter: annotate NAT helper hook pointers with __rcu") - Include resolve_btfids in external module build created by scripts/package/install-extmod-build when it may be run on external modules - Avoid removing objtool binary with 'make clean', as it is required for external module builds * tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Leave objtool binary around with 'make clean' kbuild: install-extmod-build: Package resolve_btfids if necessary genksyms: Fix parsing a declarator with a preceding attribute kbuild: Split .modinfo out from ELF_DETAILS commit 591d8796b26ff707e35aad00f1274049126feba5 Merge: 4660e168c6fd0c 674c5ff0f440a0 Author: Linus Torvalds Date: Fri Mar 6 20:20:17 2026 -0800 Merge tag 's390-7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix stackleak and xor lib inline asm, constraints and clobbers to prevent miscompilations and incomplete stack poisoning * tag 's390-7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/stackleak: Fix __stackleak_poison() inline assembly constraint s390/xor: Improve inline assembly constraints s390/xor: Fix xor_xc_2() inline assembly constraints s390/xor: Fix xor_xc_5() inline assembly commit 4660e168c6fd0cd448315bd617c5df7bb21daaf1 Merge: e0c505cb764e73 d87c828daa7ead Author: Linus Torvalds Date: Fri Mar 6 19:57:03 2026 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "The main changes are a fix to the way in which we manage the access flag setting for mappings using the contiguous bit and a fix for a hang on the kexec/hibernation path. Summary: - Fix kexec/hibernation hang due to bogus read-only mappings - Fix sparse warnings in our cmpxchg() implementation - Prevent runtime-const being used in modules, just like x86 - Fix broken elision of access flag modifications for contiguous entries on systems without support for hardware updates - Fix a broken SVE selftest that was testing the wrong instruction" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: selftest/arm64: Fix sve2p1_sigill() to hwcap test arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults arm64: make runtime const not usable by modules arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation arm64: Silence sparse warnings caused by the type casting in (cmp)xchg commit d008ba8be8984760e36d7dcd4adbd5a41a645708 Author: Calvin Owens Date: Fri Mar 6 19:19:25 2026 -0800 tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G Some of the sizing logic through tracer_alloc_buffers() uses int internally, causing unexpected behavior if the user passes a value that does not fit in an int (on my x86 machine, the result is uselessly tiny buffers). Fix by plumbing the parameter's real type (unsigned long) through to the ring buffer allocation functions, which already use unsigned long. It has always been possible to create larger ring buffers via the sysfs interface: this only affects the cmdline parameter. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/bff42a4288aada08bdf74da3f5b67a2c28b761f8.1772852067.git.calvin@wbinvd.org Fixes: 73c5162aa362 ("tracing: keep ring buffer to minimum size till used") Signed-off-by: Calvin Owens Signed-off-by: Steven Rostedt (Google) commit c113d5e32678c8de40694b738000a4a2143e2f81 Merge: 4245a79003adf3 86292155bea578 Author: Jakub Kicinski Date: Fri Mar 6 18:58:36 2026 -0800 Merge branch 'net-spacemit-a-few-error-handling-fixes' Vivian Wang says: ==================== net: spacemit: A few error handling fixes Recently a user reported a supposed UAF/double-free in this driver. It turned out to be a false positive (ugh) from a bug with riscv's kfence_protect_page() [1], but it did also prompt me to review the driver code yet again. These are some fixes for error handling problems that I've found. [1]: https://lore.kernel.org/r/20260303-handle-kfence-protect-spurious-fault-v2-0-f80d8354d79d@iscas.ac.cn/ ==================== Link: https://patch.msgid.link/20260305-k1-ethernet-more-fixes-v2-0-e4e434d65055@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 86292155bea578ebab0ca3b65d4d87ecd8a0e9ea Author: Vivian Wang Date: Thu Mar 5 14:39:39 2026 +0800 net: spacemit: Fix error handling in emac_tx_mem_map() The DMA mappings were leaked on mapping error. Free them with the existing emac_free_tx_buf() function. Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20260305-k1-ethernet-more-fixes-v2-2-e4e434d65055@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 3aa1417803c1833cbd5bacb7e6a6489a196f2519 Author: Vivian Wang Date: Thu Mar 5 14:39:38 2026 +0800 net: spacemit: Fix error handling in emac_alloc_rx_desc_buffers() Even if we get a dma_mapping_error() while mapping an RX buffer, we should still update rx_ring->head to ensure that the buffers we were able to allocate and map are used. Fix this by breaking out to the existing code after the loop, analogous to the existing handling for skb allocation failure. Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20260305-k1-ethernet-more-fixes-v2-1-e4e434d65055@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 6895e1d7c3171dc29097393749a6f4ebfb316860 Merge: 56145d237385ca d87c9305a8841b Author: Alexei Starovoitov Date: Fri Mar 6 18:11:03 2026 -0800 Merge branch 'bpf-fix-u32-s32-bounds-when-ranges-cross-min-max-boundary' Eduard Zingerman says: ==================== bpf: Fix u32/s32 bounds when ranges cross min/max boundary Cover the following cases in range refinement logic for 32-bit ranges: - s32 range crosses U32_MAX/0 boundary, positive part of the s32 range overlaps with u32 range. - s32 range crosses U32_MAX/0 boundary, negative part of the s32 range overlaps with u32 range. These cases are already handled for 64-bit range refinement. Without the fix the test in patch 2 is rejected by the verifier. The test was reduced from sched-ext program. Changelog: - v2 -> v3: - Reverted da653de268d3 (Paul) - Removed !BPF_F_TEST_REG_INVARIANTS flag from crossing_32_bit_signed_boundary_2() (Paul) - v1 -> v2: - Extended commit message and comments (Emil) - Targeting 'bpf' tree instead of bpf-next (Alexei) v1: https://lore.kernel.org/bpf/9a23fbacdc6d33ec8fcb3f6988395b5129f75369.camel@gmail.com/T v2: https://lore.kernel.org/bpf/20260305-bpf-32-bit-range-overflow-v2-0-7169206a3041@gmail.com/ --- ==================== Link: https://patch.msgid.link/20260306-bpf-32-bit-range-overflow-v3-0-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov commit d87c9305a8841b312b14ca0c360a563ef60b2a5b Author: Eduard Zingerman Date: Fri Mar 6 16:54:26 2026 -0800 Revert "selftests/bpf: Update reg_bound range refinement logic" This reverts commit da653de268d32a80e135c9eb960a8147c186f1bc. Removed logic is now covered by range_refine_in_halves() which handles both 32-bit and 64-bit refinements. Suggested-by: Paul Chaignon Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-3-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov commit f81fdfd16771e266753146bd83f6dd23515ebee9 Author: Eduard Zingerman Date: Fri Mar 6 16:54:25 2026 -0800 selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary Two test cases for signed/unsigned 32-bit bounds refinement when s32 range crosses the sign boundary: - s32 range [S32_MIN..1] overlapping with u32 range [3..U32_MAX], s32 range tail before sign boundary overlaps with u32 range. - s32 range [-3..5] overlapping with u32 range [0..S32_MIN+3], s32 range head after the sign boundary overlaps with u32 range. This covers both branches added in the __reg32_deduce_bounds(). Also, crossing_32_bit_signed_boundary_2() no longer triggers invariant violations. Reviewed-by: Emil Tsalapatis Reviewed-by: Paul Chaignon Acked-by: Shung-Hsi Yu Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-2-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov commit fbc7aef517d8765e4c425d2792409bb9bf2e1f13 Author: Eduard Zingerman Date: Fri Mar 6 16:54:24 2026 -0800 bpf: Fix u32/s32 bounds when ranges cross min/max boundary Same as in __reg64_deduce_bounds(), refine s32/u32 ranges in __reg32_deduce_bounds() in the following situations: - s32 range crosses U32_MAX/0 boundary, positive part of the s32 range overlaps with u32 range: 0 U32_MAX | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | |----------------------------|----------------------------| |xxxxx s32 range xxxxxxxxx] [xxxxxxx| 0 S32_MAX S32_MIN -1 - s32 range crosses U32_MAX/0 boundary, negative part of the s32 range overlaps with u32 range: 0 U32_MAX | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | |----------------------------|----------------------------| |xxxxxxxxx] [xxxxxxxxxxxx s32 range | 0 S32_MAX S32_MIN -1 - No refinement if ranges overlap in two intervals. This helps for e.g. consider the following program: call %[bpf_get_prandom_u32]; w0 &= 0xffffffff; if w0 < 0x3 goto 1f; // on fall-through u32 range [3..U32_MAX] if w0 s> 0x1 goto 1f; // on fall-through s32 range [S32_MIN..1] if w0 s< 0x0 goto 1f; // range can be narrowed to [S32_MIN..-1] r10 = 0; 1: ...; The reg_bounds.c selftest is updated to incorporate identical logic, refinement based on non-overflowing range halves: ((x ∩ [0, smax]) ∩ (y ∩ [0, smax])) ∪ ((x ∩ [smin,-1]) ∩ (y ∩ [smin,-1])) Reported-by: Andrea Righi Reported-by: Emil Tsalapatis Closes: https://lore.kernel.org/bpf/aakqucg4vcujVwif@gpd4/T/ Reviewed-by: Emil Tsalapatis Acked-by: Shung-Hsi Yu Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-1-f7f67e060a6b@gmail.com Signed-off-by: Alexei Starovoitov commit 4245a79003adf30e67f8e9060915bd05cb31d142 Author: Miaoqian Lin Date: Thu Mar 5 12:31:01 2026 +0000 rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() rxrpc_kernel_lookup_peer() can also return error pointers in addition to NULL, so just checking for NULL is not sufficient. Fix this by: (1) Changing rxrpc_kernel_lookup_peer() to return -ENOMEM rather than NULL on allocation failure. (2) Making the callers in afs use IS_ERR() and PTR_ERR() to pass on the error code returned. Fixes: 72904d7b9bfb ("rxrpc, afs: Allow afs to pin rxrpc_peer objects") Signed-off-by: Miaoqian Lin Co-developed-by: David Howells Signed-off-by: David Howells cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/368272.1772713861@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit 7a4d74676c31951c28b1df3dce4769d3acfb8e96 Merge: 0cc0c2e661af41 ce2da643f00af3 Author: Jakub Kicinski Date: Fri Mar 6 17:48:03 2026 -0800 Merge branch 'further-sja1105-phylink-link-replay-fixups' Vladimir Oltean says: ==================== Further SJA1105 phylink link replay fixups While I was playing around with the subsystem knowledge in Chris Mason's review-prompts to see what LLMs would have needed to catch the bug behind commit bfd264fbbbca ("net: dsa: sja1105: protect link replay helpers against NULL phylink instance"), it flagged another issue instead, which IMO is valid. This is being fixed in patch 2/2. Patch 1/2 is preparatory reordering for that. I haven't noticed any physical issues, it only has to do with the soundness of the new call path introduced in January in commit 0b2edc531e0b ("net: dsa: sja1105: let phylink help with the replay of link callbacks"). ==================== Link: https://patch.msgid.link/20260304220900.3865120-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit ce2da643f00af3111f1fffe2adea8506592ef6e5 Author: Vladimir Oltean Date: Thu Mar 5 00:09:00 2026 +0200 net: dsa: sja1105: ensure phylink_replay_link_end() will not be missed Most errors that can occur in sja1105_static_config_reload() are fatal (example: fail to communicate with hardware), but not all are. For example, sja1105_static_config_upload() -> kcalloc() may fail, and if that happens, we have called phylink_replay_link_begin() but never phylink_replay_link_end(). Under that circumstance, all port phylink instances are left in a state where the resolver is stopped with the PHYLINK_DISABLE_REPLAY bit set. We have effectively disabled link management with no way to recover from this condition. Avoid that situation by ensuring phylink_replay_link_begin() is always paired with phylink_replay_link_end(), regardless of whether we faced any errors during switch reset, configuration reload and general state reload. Fixes: 0b2edc531e0b ("net: dsa: sja1105: let phylink help with the replay of link callbacks") Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260304220900.3865120-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 976703cae7375898b445fc40d14faf849e916a4b Author: Vladimir Oltean Date: Thu Mar 5 00:08:59 2026 +0200 net: dsa: sja1105: reorder sja1105_reload_cbs() and phylink_replay_link_end() Move phylink_replay_link_end() as the last locked operation under sja1105_static_config_reload(). The purpose is to be able to goto this step from the error path of intermediate steps (we must call phylink_replay_link_end()). sja1105_reload_cbs() notably does not depend on port states or link speeds. See commit 954ad9bf13c4 ("net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload") which has discussed this issue specifically. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260304220900.3865120-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 0cc0c2e661af418bbf7074179ea5cfffc0a5c466 Author: Weiming Shi Date: Wed Mar 4 12:42:18 2026 +0800 net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit through slave devices, but does not update skb->dev to the slave device beforehand. When a gretap tunnel is a TEQL slave, the transmit path reaches iptunnel_xmit() which saves dev = skb->dev (still pointing to teql0 master) and later calls iptunnel_xmit_stats(dev, pkt_len). This function does: get_cpu_ptr(dev->tstats) Since teql_master_setup() does not set dev->pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats for teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes NULL + __per_cpu_offset[cpu], resulting in a page fault. BUG: unable to handle page fault for address: ffff8880e6659018 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 68bc067 P4D 68bc067 PUD 0 Oops: Oops: 0002 [#1] SMP KASAN PTI RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89) Call Trace: ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) __gre_xmit (net/ipv4/ip_gre.c:478) gre_tap_xmit (net/ipv4/ip_gre.c:779) teql_master_xmit (net/sched/sch_teql.c:319) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) neigh_direct_output (net/core/neighbour.c:1660) ip_finish_output2 (net/ipv4/ip_output.c:237) __ip_finish_output.part.0 (net/ipv4/ip_output.c:315) ip_mc_output (net/ipv4/ip_output.c:369) ip_send_skb (net/ipv4/ip_output.c:1508) udp_send_skb (net/ipv4/udp.c:1195) udp_sendmsg (net/ipv4/udp.c:1485) inet_sendmsg (net/ipv4/af_inet.c:859) __sys_sendto (net/socket.c:2206) Fix this by setting skb->dev = slave before calling netdev_start_xmit(), so that tunnel xmit functions see the correct slave device with properly allocated tstats. Fixes: 039f50629b7f ("ip_tunnel: Move stats update to iptunnel_xmit()") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Link: https://patch.msgid.link/20260304044216.3517851-3-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit 5c3398a54266541610c8d0a7082e654e9ff3e259 Author: Jian Zhang Date: Thu Mar 5 14:06:55 2026 +0800 net: ncsi: fix skb leak in error paths Early return paths in NCSI RX and AEN handlers fail to release the received skb, resulting in a memory leak. Specifically, ncsi_aen_handler() returns on invalid AEN packets without consuming the skb. Similarly, ncsi_rcv_rsp() exits early when failing to resolve the NCSI device, response handler, or request, leaving the skb unfreed. CC: stable@vger.kernel.org Fixes: 7a82ecf4cfb8 ("net/ncsi: NCSI AEN packet handler") Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler") Signed-off-by: Jian Zhang Link: https://patch.msgid.link/20260305060656.3357250-1-zhangjian.3032@bytedance.com Signed-off-by: Jakub Kicinski commit 63f428cb941fb0efd6bf0cd9d743cb2d0539a0e4 Merge: aed763abf0e905 a6413e6f6c9d9b Author: Jakub Kicinski Date: Fri Mar 6 17:26:04 2026 -0800 Merge branch 'mlx5-misc-fixes-2026-03-05' Tariq Toukan says: ==================== mlx5 misc fixes 2026-03-05 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/20260305142634.1813208-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa Author: Dragos Tatulea Date: Thu Mar 5 16:26:34 2026 +0200 net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. Such issue can be observed with the test_xdp_native_adjst_tail_shrnk_data selftest when using a payload of 3600 and shrinking by 256 bytes (an upcoming selftest patch): the last fragment gets released by the XDP code but doesn't get tracked by the driver. This results in a negative pp_ref_count during page release and the following splat: WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137 Modules linked in: [...] CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core] [...] Call Trace: mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core] mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core] mlx5e_close_rq+0x50/0x60 [mlx5_core] mlx5e_close_queues+0x36/0x2c0 [mlx5_core] mlx5e_close_channel+0x1c/0x50 [mlx5_core] mlx5e_close_channels+0x45/0x80 [mlx5_core] mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core] mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core] netif_set_mtu_ext+0xf1/0x230 do_setlink.isra.0+0x219/0x1180 rtnl_newlink+0x79f/0xb60 rtnetlink_rcv_msg+0x213/0x3a0 netlink_rcv_skb+0x48/0xf0 netlink_unicast+0x24a/0x350 netlink_sendmsg+0x1ee/0x410 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x232/0x280 ___sys_sendmsg+0x78/0xb0 __sys_sendmsg+0x5f/0xb0 [...] do_syscall_64+0x57/0xc50 This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags. Fixes: afd5ba577c10 ("net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Amery Hung Link: https://patch.msgid.link/20260305142634.1813208-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit db25c42c2e1f9c0d136420fff5e5700f7e771a6f Author: Dragos Tatulea Date: Thu Mar 5 16:26:33 2026 +0200 net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63). - mlx5 device skips counting this fragment. Internal frag counter remains 0. - mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error. Resulting splat during the test: WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70 The problem applies for XDP_PASS as well which is handled in a different code path in the driver. This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags. Fixes: 87bcef158ac1 ("net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ") Signed-off-by: Dragos Tatulea Cc: Amery Hung Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260305142634.1813208-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 1633111d69053512d099658d4a05fc736fab36b0 Author: Gal Pressman Date: Thu Mar 5 16:26:32 2026 +0200 net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX error CQE, a recovery flow is triggered, mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc, desyncing the DMA FIFO producer and consumer. After recovery, the producer pushes new DMA entries at the old dma_fifo_pc, while the consumer reads from position 0. This causes us to unmap stale DMA addresses from before the recovery. The DMA FIFO is a purely software construct with no HW counterpart. At the point of reset, all WQEs have been flushed so dma_fifo_cc is already equal to dma_fifo_pc. There is no need to reset either counter, similar to how skb_fifo pc/cc are untouched. Remove the 'dma_fifo_cc = 0' reset. This fixes the following WARNING: WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90 Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:iommu_dma_unmap_page+0x79/0x90 Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00 Call Trace: ? __warn+0x7d/0x110 ? iommu_dma_unmap_page+0x79/0x90 ? report_bug+0x16d/0x180 ? handle_bug+0x4f/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? iommu_dma_unmap_page+0x79/0x90 ? iommu_dma_unmap_page+0x2e/0x90 dma_unmap_page_attrs+0x10d/0x1b0 mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core] mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core] mlx5e_napi_poll+0x8b/0xac0 [mlx5_core] __napi_poll+0x24/0x190 net_rx_action+0x32a/0x3b0 ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core] ? notifier_call_chain+0x35/0xa0 handle_softirqs+0xc9/0x270 irq_exit_rcu+0x71/0xd0 common_interrupt+0x7f/0xa0 asm_common_interrupt+0x22/0x40 Fixes: db75373c91b0 ("net/mlx5e: Recover Send Queue (SQ) from error state") Signed-off-by: Gal Pressman Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260305142634.1813208-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 76324e4041c0efb4808702b05426d7a0a7d8df5b Author: Carolina Jubran Date: Thu Mar 5 16:26:31 2026 +0200 net/mlx5: Fix peer miss rules host disabled checks The check on mlx5_esw_host_functions_enabled(esw->dev) for adding VF peer miss rules is incorrect. These rules match traffic from peer's VFs, so the local device's host function status is irrelevant. Remove this check to ensure peer VF traffic is properly handled regardless of local host configuration. Also fix the PF peer miss rule deletion to be symmetric with the add path, so only attempt to delete the rule if it was actually created. Fixes: 520369ef43a8 ("net/mlx5: Support disabling host PFs") Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260305142634.1813208-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 24b2795f9683e092dc22a68f487e7aaaf2ddafea Author: Patrisious Haddad Date: Thu Mar 5 16:26:30 2026 +0200 net/mlx5: Fix crash when moving to switchdev mode When moving to switchdev mode when the device doesn't support IPsec, we try to clean up the IPsec resources anyway which causes the crash below, fix that by correctly checking for IPsec support before trying to clean up its resources. [27642.515799] WARNING: arch/x86/mm/fault.c:1276 at do_user_addr_fault+0x18a/0x680, CPU#4: devlink/6490 [27642.517159] Modules linked in: xt_conntrack xt_MASQUERADE ip6table_nat ip6table_filter ip6_tables iptable_nat nf_nat xt_addrtype rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_fwctl nfnetlink zram zsmalloc mlx5_ib fuse rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_core ib_core [27642.521358] CPU: 4 UID: 0 PID: 6490 Comm: devlink Not tainted 6.19.0-rc5_for_upstream_min_debug_2026_01_14_16_47 #1 NONE [27642.522923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [27642.524528] RIP: 0010:do_user_addr_fault+0x18a/0x680 [27642.525362] Code: ff 0f 84 75 03 00 00 48 89 ee 4c 89 e7 e8 5e b9 22 00 49 89 c0 48 85 c0 0f 84 a8 02 00 00 f7 c3 60 80 00 00 74 22 31 c9 eb ae <0f> 0b 48 83 c4 10 48 89 ea 48 89 de 4c 89 f7 5b 5d 41 5c 41 5d 41 [27642.528166] RSP: 0018:ffff88810770f6b8 EFLAGS: 00010046 [27642.529038] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff88810b980f00 [27642.530158] RDX: 00000000000000a0 RSI: 0000000000000002 RDI: ffff88810770f728 [27642.531270] RBP: 00000000000000a0 R08: 0000000000000000 R09: 0000000000000000 [27642.532383] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888103f3c4c0 [27642.533499] R13: 0000000000000000 R14: ffff88810770f728 R15: 0000000000000000 [27642.534614] FS: 00007f197c741740(0000) GS:ffff88856a94c000(0000) knlGS:0000000000000000 [27642.535915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [27642.536858] CR2: 00000000000000a0 CR3: 000000011334c003 CR4: 0000000000172eb0 [27642.537982] Call Trace: [27642.538466] [27642.538907] exc_page_fault+0x76/0x140 [27642.539583] asm_exc_page_fault+0x22/0x30 [27642.540282] RIP: 0010:_raw_spin_lock_irqsave+0x10/0x30 [27642.541134] Code: 07 85 c0 75 11 ba ff 00 00 00 f0 0f b1 17 75 06 b8 01 00 00 00 c3 31 c0 c3 90 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00 00 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 7e 02 00 00 48 89 d8 5b [27642.543936] RSP: 0018:ffff88810770f7d8 EFLAGS: 00010046 [27642.544803] RAX: 0000000000000000 RBX: 0000000000000202 RCX: ffff888113ad96d8 [27642.545916] RDX: 0000000000000001 RSI: ffff88810770f818 RDI: 00000000000000a0 [27642.547027] RBP: 0000000000000098 R08: 0000000000000400 R09: ffff88810b980f00 [27642.548140] R10: 0000000000000001 R11: ffff888101845a80 R12: 00000000000000a8 [27642.549263] R13: ffffffffa02a9060 R14: 00000000000000a0 R15: ffff8881130d8a40 [27642.550379] complete_all+0x20/0x90 [27642.551010] mlx5e_ipsec_disable_events+0xb6/0xf0 [mlx5_core] [27642.552022] mlx5e_nic_disable+0x12d/0x220 [mlx5_core] [27642.552929] mlx5e_detach_netdev+0x66/0xf0 [mlx5_core] [27642.553822] mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core] [27642.554821] mlx5e_vport_rep_load+0x419/0x590 [mlx5_core] [27642.555757] ? xa_load+0x53/0x90 [27642.556361] __esw_offloads_load_rep+0x54/0x70 [mlx5_core] [27642.557328] mlx5_esw_offloads_rep_load+0x45/0xd0 [mlx5_core] [27642.558320] esw_offloads_enable+0xb4b/0xc90 [mlx5_core] [27642.559247] mlx5_eswitch_enable_locked+0x34e/0x4f0 [mlx5_core] [27642.560257] ? mlx5_rescan_drivers_locked+0x222/0x2d0 [mlx5_core] [27642.561284] mlx5_devlink_eswitch_mode_set+0x5ac/0x9c0 [mlx5_core] [27642.562334] ? devlink_rate_set_ops_supported+0x21/0x3a0 [27642.563220] devlink_nl_eswitch_set_doit+0x67/0xe0 [27642.564026] genl_family_rcv_msg_doit+0xe0/0x130 [27642.564816] genl_rcv_msg+0x183/0x290 [27642.565466] ? __devlink_nl_pre_doit.isra.0+0x160/0x160 [27642.566329] ? devlink_nl_eswitch_get_doit+0x290/0x290 [27642.567181] ? devlink_nl_pre_doit_parent_dev_optional+0x20/0x20 [27642.568147] ? genl_family_rcv_msg_dumpit+0xf0/0xf0 [27642.568966] netlink_rcv_skb+0x4b/0xf0 [27642.569629] genl_rcv+0x24/0x40 [27642.570215] netlink_unicast+0x255/0x380 [27642.570901] ? __alloc_skb+0xfa/0x1e0 [27642.571560] netlink_sendmsg+0x1f3/0x420 [27642.572249] __sock_sendmsg+0x38/0x60 [27642.572911] __sys_sendto+0x119/0x180 [27642.573561] ? __sys_recvmsg+0x5c/0xb0 [27642.574227] __x64_sys_sendto+0x20/0x30 [27642.574904] do_syscall_64+0x55/0xc10 [27642.575554] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [27642.576391] RIP: 0033:0x7f197c85e807 [27642.577050] Code: c7 c0 ff ff ff ff eb be 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 45 08 0d 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 69 c3 55 48 89 e5 53 48 83 ec 38 44 89 4d d0 [27642.579846] RSP: 002b:00007ffebd4e2248 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [27642.581082] RAX: ffffffffffffffda RBX: 000055cfcd9cd2a0 RCX: 00007f197c85e807 [27642.582200] RDX: 0000000000000038 RSI: 000055cfcd9cd490 RDI: 0000000000000003 [27642.583320] RBP: 00007ffebd4e2290 R08: 00007f197c942200 R09: 000000000000000c [27642.584437] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [27642.585555] R13: 000055cfcd9cd490 R14: 00007ffebd4e45d1 R15: 000055cfcd9cd2a0 [27642.586671] [27642.587121] ---[ end trace 0000000000000000 ]--- [27642.587910] BUG: kernel NULL pointer dereference, address: 00000000000000a0 Fixes: 664f76be38a1 ("net/mlx5: Fix IPsec cleanup over MPV device") Signed-off-by: Patrisious Haddad Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260305142634.1813208-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit aed763abf0e905b4b8d747d1ba9e172961572f57 Author: Cosmin Ratiu Date: Thu Mar 5 10:10:19 2026 +0200 net/mlx5: Fix deadlock between devlink lock and esw->wq esw->work_queue executes esw_functions_changed_event_handler -> esw_vfs_changed_event_handler and acquires the devlink lock. .eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) -> mlx5_devlink_eswitch_mode_set -> mlx5_eswitch_disable_locked -> mlx5_eswitch_event_handler_unregister -> flush_workqueue deadlocks when esw_vfs_changed_event_handler executes. Fix that by no longer flushing the work to avoid the deadlock, and using a generation counter to keep track of work relevance. This avoids an old handler manipulating an esw that has undergone one or more mode changes: - the counter is incremented in mlx5_eswitch_event_handler_unregister. - the counter is read and passed to the ephemeral mlx5_host_work struct. - the work handler takes the devlink lock and bails out if the current generation is different than the one it was scheduled to operate on. - mlx5_eswitch_cleanup does the final draining before destroying the wq. No longer flushing the workqueue has the side effect of maybe no longer cancelling pending vport_change_handler work items, but that's ok since those are disabled elsewhere: - mlx5_eswitch_disable_locked disables the vport eq notifier. - mlx5_esw_vport_disable disarms the HW EQ notification and marks vport->enabled under state_lock to false to prevent pending vport handler from doing anything. - mlx5_eswitch_cleanup destroys the workqueue and makes sure all events are disabled/finished. Fixes: f1bc646c9a06 ("net/mlx5: Use devl_ API in mlx5_esw_offloads_devlink_port_register") Signed-off-by: Cosmin Ratiu Reviewed-by: Moshe Shemesh Reviewed-by: Dragos Tatulea Reviewed-by: Simon Horman Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260305081019.1811100-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 55f854dd5bdd8e19b936a00ef1f8d776ac32c7b0 Author: Laurent Vivier Date: Wed Mar 4 14:43:38 2026 +0100 qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size Commit c7159e960f14 ("usbnet: limit max_mtu based on device's hard_mtu") capped net->max_mtu to the device's hard_mtu in usbnet_probe(). While this correctly prevents oversized packets on standard USB network devices, it breaks the qmi_wwan driver. qmi_wwan relies on userspace (e.g. ModemManager) setting a large MTU on the wwan0 interface to configure rx_urb_size via usbnet_change_mtu(). QMI modems negotiate USB transfer sizes of 16,383 or 32,767 bytes, and the USB receive buffers must be sized accordingly. With max_mtu capped to hard_mtu (~1500 bytes), userspace can no longer raise the MTU, the receive buffers remain small, and download speeds drop from >300 Mbps to ~0.8 Mbps. Introduce a FLAG_NOMAXMTU driver flag that allows individual usbnet drivers to opt out of the max_mtu cap. Set this flag in qmi_wwan's driver_info structures to restore the previous behavior for QMI devices, while keeping the safety fix in place for all other usbnet drivers. Fixes: c7159e960f14 ("usbnet: limit max_mtu based on device's hard_mtu") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/lkml/CAPh3n803k8JcBPV5qEzUB-oKzWkAs-D5CU7z=Vd_nLRCr5ZqQg@mail.gmail.com/ Reported-by: Koen Vandeputte Tested-by: Daniele Palmas Signed-off-by: Laurent Vivier Link: https://patch.msgid.link/20260304134338.1785002-1-lvivier@redhat.com Signed-off-by: Jakub Kicinski commit 03910cdc214d26db8b77ff128435f3bab1c0072d Merge: 224a0d284c3caf 3348be7978f450 Author: Jakub Kicinski Date: Fri Mar 6 16:25:19 2026 -0800 Merge branch 'bond-fix-2-link-state-issues' Hangbin Liu says: ==================== bond: fix 2 link state issues This patch set fixes two bonding link state issues: 1. Broadcast mode incorrectly sets usable_slaves, causing updelay to be ignored 2. BOND_LINK_FAIL and BOND_LINK_BACK are treated as invalid states, generating confusing error messages Here is the reproducer: ``` ip netns add ns ip -n ns link add bond0 type bond mode 3 miimon 100 updelay 200 downdelay 200 ip -n ns link add type veth ip -n ns link add type veth ip -n ns link set veth1 up ip -n ns link set veth3 up ip -n ns link set veth0 master bond0 ip -n ns link set veth2 master bond0 ip -n ns link set bond0 up sleep 1 ip -n ns link set veth3 down sleep 1 ip -n ns link set veth3 up sleep 1 dmesg | tail ``` ==================== Link: https://patch.msgid.link/20260304-b4-bond_updelay-v1-0-f72eb2e454d0@gmail.com Signed-off-by: Jakub Kicinski commit 3348be7978f450ede0c308a4e8416ac716cf1015 Author: Hangbin Liu Date: Wed Mar 4 15:13:54 2026 +0800 bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states Before the fixed commit, we check slave->new_link during commit state, which values are only BOND_LINK_{NOCHANGE, UP, DOWN}. After the commit, we start using slave->link_new_state, which state also could be BOND_LINK_{FAIL, BACK}. For example, when we set updelay/downdelay, after a failover, the slave->link_new_state could be set to BOND_LINK_{FAIL, BACK} in bond_miimon_inspect(). And later in bond_miimon_commit(), it will treat it as invalid and print an error, which would cause confusion for users. [ 106.440254] bond0: (slave veth2): link status down for interface, disabling it in 200 ms [ 106.440265] bond0: (slave veth2): invalid new link 1 on slave [ 106.648276] bond0: (slave veth2): link status definitely down, disabling slave [ 107.480271] bond0: (slave veth2): link status up, enabling it in 200 ms [ 107.480288] bond0: (slave veth2): invalid new link 3 on slave [ 107.688302] bond0: (slave veth2): link status definitely up, 10000 Mbps full duplex Let's handle BOND_LINK_{FAIL, BACK} as valid link states. Fixes: 1899bb325149 ("bonding: fix state transition issue in link monitoring") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260304-b4-bond_updelay-v1-2-f72eb2e454d0@gmail.com Signed-off-by: Jakub Kicinski commit 45fc134bcfadde456639c1b1e206e6918d69a553 Author: Hangbin Liu Date: Wed Mar 4 15:13:53 2026 +0800 bonding: do not set usable_slaves for broadcast mode After commit e0caeb24f538 ("net: bonding: update the slave array for broadcast mode"), broadcast mode will also set all_slaves and usable_slaves during bond_enslave(). But if we also set updelay, during enslave, the slave init state will be BOND_LINK_BACK. And later bond_update_slave_arr() will alloc usable_slaves but add nothing. This will cause bond_miimon_inspect() to have ignore_updelay always true. So the updelay will be always ignored. e.g. [ 6.498368] bond0: (slave veth2): link status definitely down, disabling slave [ 7.536371] bond0: (slave veth2): link status up, enabling it in 0 ms [ 7.536402] bond0: (slave veth2): link status definitely up, 10000 Mbps full duplex To fix it, we can either always call bond_update_slave_arr() on every place when link changes. Or, let's just not set usable_slaves for broadcast mode. Fixes: e0caeb24f538 ("net: bonding: update the slave array for broadcast mode") Reported-by: Liang Li Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260304-b4-bond_updelay-v1-1-f72eb2e454d0@gmail.com Signed-off-by: Jakub Kicinski commit e0c505cb764e73273b3ddce80b5944fa5b796bd9 Merge: 325a118c120452 048efe129a2972 Author: Linus Torvalds Date: Fri Mar 6 16:07:22 2026 -0800 Merge tag 'v7.0-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix potential oops on open failure - Fix unmount to better free deferred closes - Use proper constant-time MAC comparison function - Two buffer allocation size fixes - Two minor cleanups - make SMB2 kunit tests a distinct module * tag 'v7.0-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix oops due to uninitialised var in smb2_unlink() cifs: open files should not hold ref on superblock smb: client: Compare MACs in constant time smb/client: remove unused SMB311_posix_query_info() smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() smb: update some doc references smb/client: make SMB2 maperror KUnit tests a separate module commit 224a0d284c3caf1951302d1744a714784febed71 Author: Johan Hovold Date: Thu Mar 5 11:45:49 2026 +0100 net: mctp: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. This driver takes a reference to the USB device during probe but does not to release it on probe failures. Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks. Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver") Cc: stable@vger.kernel.org # 6.15 Signed-off-by: Johan Hovold Acked-by: Jeremy Kerr Link: https://patch.msgid.link/20260305104549.16110-1-johan@kernel.org Signed-off-by: Jakub Kicinski commit a72f73c4dd9b209c53cf8b03b6e97fcefad4262c Author: Sebastian Andrzej Siewior Date: Fri Mar 6 20:22:35 2026 +0100 cgroup: Don't expose dead tasks in cgroup Once a task exits it has its state set to TASK_DEAD and then it is removed from the cgroup it belonged to. The last step happens on the task gets out of its last schedule() invocation and is delayed on PREEMPT_RT due to locking constraints. As a result it is possible to receive a pid via waitpid() of a task which is still listed in cgroup.procs for the cgroup it belonged to. This is something that systemd does not expect and as a result it waits for its exit until a time out occurs. This can also be reproduced on !PREEMPT_RT kernel with a significant delay in do_exit() after exit_notify(). Hide the task from the output which have PF_EXITING set which is done before the parent is notified. Keeping zombies with live threads shouldn't break anything (suggested by Tejun). Reported-by: Bert Karwatzki Closes: https://lore.kernel.org/all/20260219164648.3014-1-spasswolf@web.de/ Tested-by: Bert Karwatzki Fixes: 9311e6c29b34 ("cgroup: Fix sleeping from invalid context warning on PREEMPT_RT") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Tejun Heo commit 2a0596d516870951ce0e8edf510e48c87cb80761 Author: Cheng-Yang Chou Date: Sat Mar 7 02:21:01 2026 +0800 sched_ext: Documentation: Update sched-ext.rst - Remove CONFIG_PAHOLE_HAS_BTF_TAG from required config list - Document ext_idle.c as the built-in idle CPU selection policy - Add descriptions for example schedulers in tools/sched_ext/ Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 72ecb1dae72775fa9fea0159d8445d620a0a2295 Author: Mario Limonciello Date: Thu Mar 5 09:06:11 2026 -0600 drm/amd: Fix a few more NULL pointer dereference in device cleanup I found a few more paths that cleanup fails due to a NULL version pointer on unsupported hardware. Add NULL checks as applicable. Fixes: 39fc2bc4da00 ("drm/amdgpu: Protect GPU register accesses in powergated state in some paths") Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit f5a05f8414fc10f307eb965f303580c7778f8dd2) Cc: stable@vger.kernel.org commit a6571045cf06c4aa749b4801382ae96650e2f0e1 Author: Yang Wang Date: Wed Mar 4 18:45:45 2026 -0500 drm/amdgpu: fix gpu idle power consumption issue for gfx v12 Older versions of the MES firmware may cause abnormal GPU power consumption. When performing inference tasks on the GPU (e.g., with Ollama using ROCm), the GPU may show abnormal power consumption in idle state and incorrect GPU load information. This issue has been fixed in firmware version 0x8b and newer. Closes: https://github.com/ROCm/ROCm/issues/5706 Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 4e22a5fe6ea6e0b057e7f246df4ac3ff8bfbc46a) commit 52289ce48ef1f8a81cd39df1574098356e3c9d4c Author: Cristian Ciocaltea Date: Thu Mar 5 13:16:36 2026 +0200 drm/amdgpu: Fix kernel-doc comments for some LUT properties The following members of struct amdgpu_mode_info do not have valid references in the related kernel-doc sections: - plane_shaper_lut_property - plane_shaper_lut_size_property, - plane_lut3d_size_property Correct all affected comment blocks. Fixes: f545d82479b4 ("drm/amd/display: add plane shaper LUT and TF driver-specific properties") Fixes: 671994e3bf33 ("drm/amd/display: add plane 3D LUT driver-specific properties") Reviewed-by: Melissa Wen Signed-off-by: Cristian Ciocaltea Signed-off-by: Alex Deucher (cherry picked from commit ec5708d6e547f7efe2f009073bfa98dbc4c5c2ac) commit 062ea905fff7756b2e87143ffccaece5cdb44267 Author: Mario Limonciello Date: Wed Mar 4 14:07:40 2026 -0600 drm/amd: Fix NULL pointer dereference in device cleanup When GPU initialization fails due to an unsupported HW block IP blocks may have a NULL version pointer. During cleanup in amdgpu_device_fini_hw, the code calls amdgpu_device_set_pg_state and amdgpu_device_set_cg_state which iterate over all IP blocks and access adev->ip_blocks[i].version without NULL checks, leading to a kernel NULL pointer dereference. Add NULL checks for adev->ip_blocks[i].version in both amdgpu_device_set_cg_state and amdgpu_device_set_pg_state to prevent dereferencing NULL pointers during GPU teardown when initialization has failed. Fixes: 39fc2bc4da00 ("drm/amdgpu: Protect GPU register accesses in powergated state in some paths") Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit b7ac77468cda92eecae560b05f62f997a12fe2f2) Cc: stable@vger.kernel.org commit 9d4837a26149355ffe3a1f80de80531eafdd3353 Author: Yang Wang Date: Tue Mar 3 21:14:10 2026 -0500 drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14 add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14.0.2/14.0.3 Fixes: 9710b84e2a6a ("drm/amd/pm: add overdrive support on smu v14.0.2/3") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5018 Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 1b5cf07d80bb16d1593579ccdb23f08ea4262c14) commit cb47c882c31334aadc13ace80781728ed22a05ee Author: Yang Wang Date: Tue Mar 3 21:10:11 2026 -0500 drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13 add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13.0.0/13.0.7 Fixes: cfffd980bf21 ("drm/amd/pm: add zero RPM OD setting support for SMU13") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5018 Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 576a10797b607ee9e4068218daf367b481564120) commit 3b1679e086bb869ca02722f6bd29b3573a6a0e7e Author: Andrei-Alexandru Tachici Date: Mon Mar 2 11:27:34 2026 +0100 tracing: Fix enabling multiple events on the kernel command line and bootconfig Multiple events can be enabled on the kernel command line via a comma separator. But if the are specified one at a time, then only the last event is enabled. This is because the event names are saved in a temporary buffer, and each call by the init cmdline code will reset that buffer. This also affects names in the boot config file, as it may call the callback multiple times with an example of: kernel.trace_event = ":mod:rproc_qcom_common", ":mod:qrtr", ":mod:qcom_aoss" Change the cmdline callback function to append a comma and the next value if the temporary buffer already has content. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260302-trace-events-allow-multiple-modules-v1-1-ce4436e37fb8@oss.qualcomm.com Signed-off-by: Andrei-Alexandru Tachici Signed-off-by: Steven Rostedt (Google) commit 325a118c12045239076b7ea9e66391dd6f56f72e Merge: dfb31428444b00 9f2c7349b2810c Author: Linus Torvalds Date: Fri Mar 6 13:37:52 2026 -0800 Merge tag 'pci-v7.0-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Initialize msi_addr_mask for OF-created PCI devices to fix sparc and powerpc probe regressions (Nilay Shroff) - Orphan the Altera PCIe controller driver (Dave Hansen) * tag 'pci-v7.0-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: MAINTAINERS: Orphan Altera PCIe controller driver sparc/PCI: Initialize msi_addr_mask for OF-created PCI devices powerpc/pci: Initialize msi_addr_mask for OF-created PCI devices commit dfb31428444b00824b161d8c0741d4868552813a Merge: 3593e678f5e8b2 96bfe9ff7e88f0 Author: Linus Torvalds Date: Fri Mar 6 13:29:12 2026 -0800 Merge tag 'drm-fixes-2026-03-07' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes pull. There is one mm fix in here for a HMM livelock triggered by the xe driver tests. Otherwise it's a pretty wide range of fixes across the board, ttm UAF regression fix, amdgpu fixes, nouveau doesn't crash my laptop anymore fix, and a fair bit of misc. Seems about right for rc3. mm: - mm: Fix a hmm_range_fault() livelock / starvation problem pagemap: - Revert "drm/pagemap: Disable device-to-device migration" ttm: - fix function return breaking reclaim - fix build failure on PREEMPT_RT - fix bo->resource UAF dma-buf: - include ioctl.h in uapi header sched: - fix kernel doc warning amdgpu: - LUT fixes - VCN5 fix - Dispclk fix - SMU 13.x fix - Fix race in VM acquire - PSP 15.x fix - UserQ fix amdxdna: - fix invalid payload for failed command - fix NULL ptr dereference - fix major fw version check - avoid inconsistent fw state on error i915/display: - Fix for Lenovo T14 G7 display not refreshing xe: - Do not preempt fence signaling CS instructions - Some leak and finalization fixes - Workaround fix nouveau: - avoid runtime suspend oops when using dp aux panthor: - fix gem_sync argument ordering solomon: - fix incorrect display output renesas: - fix DSI divider programming ethosu: - fix job submit error clean-up refcount - fix NPU_OP_ELEMENTWISE validation - handle possible underflows in IFM size calcs" * tag 'drm-fixes-2026-03-07' of https://gitlab.freedesktop.org/drm/kernel: (38 commits) accel: ethosu: Handle possible underflow in IFM size calculations accel: ethosu: Fix NPU_OP_ELEMENTWISE validation with scalar accel: ethosu: Fix job submit error clean-up refcount underflows accel/amdxdna: Split mailbox channel create function drm/panthor: Correct the order of arguments passed to gem_sync Revert "drm/syncobj: Fix handle <-> fd ioctls with dirty stack" drm/ttm: Fix bo resource use-after-free nouveau/dpcd: return EBUSY for aux xfer if the device is asleep accel/amdxdna: Fix major version check on NPU1 platform drm/amdgpu/userq: refcount userqueues to avoid any race conditions drm/amdgpu/userq: Consolidate wait ioctl exit path drm/amdgpu/psp: Use Indirect access address for GFX to PSP mailbox drm/amdgpu: Fix use-after-free race in VM acquire drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x drm/xe: Fix memory leak in xe_vm_madvise_ioctl drm/xe/reg_sr: Fix leak on xa_store failure drm/xe/xe2_hpg: Correct implementation of Wa_16025250150 drm/xe/gsc: Fix GSC proxy cleanup on early initialization failure Revert "drm/pagemap: Disable device-to-device migration" drm/i915/psr: Fix for Panel Replay X granularity DPCD register handling ... commit 0e16181704e37330069c24cea143f15b7b298da3 Author: Dave Hansen Date: Thu Mar 5 09:28:05 2026 -0800 MAINTAINERS: Remove bouncing T7XX reviewer This reviewer's email no longer works. Remove it from MAINTAINERS. Cc: Chandrashekar Devegowda Cc: Liu Haijun Cc: Ricardo Martinez Cc: Sergey Ryazanov Cc: Johannes Berg Cc: Andrew Lunn Signed-off-by: Dave Hansen Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20260305172806.3118806-1-dave.hansen@linux.intel.com Signed-off-by: Jakub Kicinski commit 3593e678f5e8b21b8f54b4267027bd55b19cb7b8 Merge: 651690480a965c b11b9b6751b2cd Author: Linus Torvalds Date: Fri Mar 6 12:34:49 2026 -0800 Merge tag 'linux_kselftest-kunit-fixes-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit fixes from Shuah Khan: - Fix rust warnings when CONFIG_PRINTK is disabled - Reduce stack usage in kunit_run_tests() to fix warnings when CONFIG_FRAME_WARN is set to a relatively low value - Update email address for David Gow - Copy caller args in kunit tool in run_kernel to prevent mutation * tag 'linux_kselftest-kunit-fixes-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: reduce stack usage in kunit_run_tests() kunit: tool: copy caller args in run_kernel to prevent mutation rust: kunit: fix warning when !CONFIG_PRINTK MAINTAINERS: Update email address for David Gow commit e4eb11b34d6c84f398d8f08d7cb4d6c38e739dd2 Author: Pengyu Luo Date: Sat Mar 7 00:32:38 2026 +0800 drm/msm/dsi: fix pclk rate calculation for bonded dsi Recently, we round up new_hdisplay once at most, for bonded dsi, we may need twice, since they are independent links, we should round up each half separately. This also aligns with the hdisplay we program later in dsi_timing_setup() Example: full_hdisplay = 1904, dsc_bpp = 8, bpc = 8 new_full_hdisplay = DIV_ROUND_UP(1904 * 8, 8 * 3) = 635 if we use half display new_half_hdisplay = DIV_ROUND_UP(952 * 8, 8 * 3) = 318 new_full_display = 636 Fixes: 7c9e4a554d4a ("drm/msm/dsi: Reduce pclk rate for compression") Signed-off-by: Pengyu Luo Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/709716/ Link: https://lore.kernel.org/r/20260306163255.215456-1-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov commit 651690480a965ca196ce42d4562543f3e61cb226 Merge: 5abeba615cb9b2 3b46d61890632c Author: Linus Torvalds Date: Fri Mar 6 10:33:32 2026 -0800 Merge tag 'spi-fix-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One device specific fix here, it was possible we might end up trying to dereference an invalid pointer while reporting a transfer timeout on DesignWare controllers" * tag 'spi-fix-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-dw-dma: fix print error log when wait finish transaction commit 5abeba615cb9b2eca3069daa7ae2c899f2efa167 Merge: d249037ac4701c 2d85ecd6fb0eb2 Author: Linus Torvalds Date: Fri Mar 6 10:27:45 2026 -0800 Merge tag 'regulator-fix-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of small, driver specific fixes which might not even have much impact if you have the affected devices depending on your setup" * tag 'regulator-fix-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: pf9453: Respect IRQ trigger settings from firmware regulator: mt6363: Fix incorrect and redundant IRQ disposal in probe commit d249037ac4701c32d99bc062834d592a57cfed00 Merge: 48976c0eba2ff3 8457669db968c9 Author: Linus Torvalds Date: Fri Mar 6 10:06:04 2026 -0800 Merge tag 'sound-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Again a collection of device-specific fixes. Most of changes are fairly small device-specific quirks of fixes for HD- and USB-audio, ASoC Intel, AMD, fsl, Cirrus and co. The only large LOC is for plumbing ASoC ACP driver to add the Cirrus Logic codec support, so this one is also just adding some tables" * tag 'sound-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (21 commits) ALSA: us122l: drop redundant interface references ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA ASoC: dt-bindings: renesas,rz-ssi: Document RZ/G3L SoC ASoC: SDCA: Add allocation failure check for Entity name ALSA: hda/senary: Ensure EAPD is enabled during init ALSA: hda/senary: Use codec->core.afg for GPIO access ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_SKIP_IFACE_SETUP ASoC: dt-bindings: tegra: Add compatible for Tegra238 sound card ALSA: hda/hdmi: Add Tegra238 HDA codec device ID ASoC: cs35l56: Suppress pointless warning about number of GPIO pulls ASoC: amd: acp: Add ACP6.3 match entries for Cirrus Logic parts ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCD SKU ASoC: rt1321: fix DMIC ch2/3 mask issue ASoC: cs35l56: Only patch ASP registers if the DAI is part of a DAIlink ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() ALSA: firewire: dice: Fix printf warning with W=1 ALSA: hda/tas2781: A workaround solution to lower-vol issue among lower calibrated-impedance micro-speaker on TAS2781 ALSA: hda/realtek: Add quirk for HP Pavilion 15-eh1xxx to enable mute LED ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio ... commit 457965c13f0837a289c9164b842d0860133f6274 Author: Guenter Roeck Date: Thu Mar 5 11:33:39 2026 -0800 tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse() jumps to the out_free error path. While kfree() safely handles a NULL pointer, trigger_data_free() does not. This causes a NULL pointer dereference in trigger_data_free() when evaluating data->cmd_ops->set_filter. Fix the problem by adding a NULL pointer check to trigger_data_free(). The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y. Cc: Miaoqian Lin Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt (Google) Link: https://patch.msgid.link/20260305193339.2810953-1-linux@roeck-us.net Fixes: 0550069cc25f ("tracing: Properly process error handling in event_hist_trigger_parse()") Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Guenter Roeck Signed-off-by: Steven Rostedt (Google) commit 48976c0eba2ff3a3b893c35853bdf27369b16655 Merge: 54de8b835b5d3f e31b556c0ba21f Author: Linus Torvalds Date: Fri Mar 6 10:00:58 2026 -0800 Merge tag 'hid-for-linus-2026030601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - fix a few memory leaks (Günther Noack) - fix potential kernel crashes in cmedia, creative-sb0540 and zydacron (Greg Kroah-Hartman) - fix NULL pointer dereference in pidff (Tomasz Pakuła) - fix battery reporting for Apple Magic Trackpad 2 (Julius Lehmann) - mcp2221 proper handling of failed read operation (Romain Sioen) - various device quirks / device ID additions * tag 'hid-for-linus-2026030601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: mcp2221: cancel last I2C command on read error HID: asus: add xg mobile 2023 external hardware support HID: multitouch: Keep latency normal on deactivate for reactivation gesture HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs selftests: hid: tests: test_wacom_generic: add tests for display devices and opaque devices HID: multitouch: new class MT_CLS_EGALAX_P80H84 HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 HID: pidff: Fix condition effect bit clearing HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them HID: asus: avoid memory leak in asus_report_fixup() HID: magicmouse: avoid memory leak in magicmouse_report_fixup() HID: apple: avoid memory leak in apple_report_fixup() HID: Document memory allocation properties of report_fixup() commit 54de8b835b5d3f78081ad17c964ffc7fcf771716 Merge: 9a881ea3da166b d1a196e0a6dcdd Author: Linus Torvalds Date: Fri Mar 6 09:48:50 2026 -0800 Merge tag 'platform-drivers-x86-v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - alienware-wmi-wmax: Add G-Mode support to m18 laptops - asus-armoury: Add support for FA401UM, G733QS, GX650RX - dell-wmi-sysman: Don't hex dump plaintext password data - hp-bioscfg: Support large number of enumeration attributes - hp-wmi: Add support for Omen 14-fb1xxx, 16-xd0xxx, 16-wf0xxx, and Victus-d0xxx - int3472: Handle GPIO type 0x10 (DOVDD) - intel-hid: - Add Dell 14 & 16 Plus 2-in-1 to dmi_vgbs_allow_list - Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - mellanox: mlxreg: Fix kernel-doc warnings - oxpec: Add support for OneXPlayer X1 Air, X1z, APEX, and Aokzoe A2 Pro - redmi-wmi: Add more Fn hotkey mappings - thinkpad_acpi: Fix errors reading battery thresholds - touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - uniwill-laptop: - FN lock/super key lock attributes rename - Fix crash on unexpected battery event - A special key combination can alter FN lock status so mark it volatile - Handle FN lock event * tag 'platform-drivers-x86-v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (27 commits) platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data platform_data/mlxreg: mlxreg.h: fix all kernel-doc warnings platform/x86: asus-armoury: add support for FA401UM platform/x86: asus-armoury: add support for GX650RX platform/x86: hp-bioscfg: Support allocations of larger data platform/x86: oxpec: Add support for Aokzoe A2 Pro platform/x86: oxpec: Add support for OneXPlayer X1 Air platform/x86: oxpec: Add support for OneXPlayer X1z platform/x86: oxpec: Add support for OneXPlayer APEX platform/x86: uniwill-laptop: Handle FN lock event platform/x86: uniwill-laptop: Mark FN lock status as being volatile platform/x86: uniwill-laptop: Fix crash on unexpected battery event platform/x86: uniwill-laptop: Rename FN lock and super key lock attrs platform/x86: redmi-wmi: Add more hotkey mappings platform/x86: alienware-wmi-wmax: Add G-Mode support to m18 laptops platform/x86: hp-wmi: add Omen 14-fb1xxx (board 8E41) support platform/x86: dell-wmi: Add audio/mic mute key codes platform/x86: hp-wmi: Add Victus 16-d0xxx support platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 platform/x86: int3472: Handle GPIO type 0x10 (DOVDD) ... commit 9a881ea3da166b05ec0eb66df22a7228b90aa66c Merge: 345dfaaf9f8b8d 6432f15c818cb3 Author: Linus Torvalds Date: Fri Mar 6 09:22:51 2026 -0800 Merge tag 'slab-for-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Fix for slab->stride truncation on 64k page systems due to short type. It was not due to races and lack of barriers in the end. (Harry Yoo) - Fix for severe performance regression due to unnecessary sheaf refill restrictions exposed by mempool allocation strategy. (Vlastimil Babka) - Stable fix for potential silent percpu sheaf flushing failures on PREEMPT_RT. (Vlastimil Babka) * tag 'slab-for-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: change stride type from unsigned short to unsigned int mm/slab: allow sheaf refill if blocking is not allowed slab: distinguish lock and trylock for sheaf_flush_main() commit 345dfaaf9f8b8dd0fc563e6f48586922b38ed11c Merge: 0b2758f48f22b1 0fb59eaca18f12 Author: Linus Torvalds Date: Fri Mar 6 09:16:39 2026 -0800 Merge tag 'pmdomain-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - rockchip: Fix PD_VCODEC for RK3588 - bcm: Fix broken reset status read for bcm2835 * tag 'pmdomain-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: rockchip: Fix PD_VCODEC for RK3588 pmdomain: bcm: bcm2835-power: Fix broken reset status read commit 0b2758f48f22b173963f39e553d0ecd05f3b4433 Author: Linus Torvalds Date: Fri Mar 6 09:10:36 2026 -0800 Require (reasonably) normal mappings for MADV_DOFORK This came up as a result of the tracing fix pull request, and commit e39bb9e02b68 ("tracing: Fix WARN_ON in tracing_buffers_mmap_close") in particular. The use of MADV_DOFORK confused the ring buffer mapping reference counting just because it was unexpected, since the mapping was originally done with VM_DONTCOPY. The tracing code may well be the only case of this (and fixed it all by just using the mmap open callback to unconfuse itself), but it's just strange that we allow MADV_DOFORK on special mappings where the kernel has set the "don't copy this" bit. The code already disallowed it for VM_IO mappings (going back to the original commit f822566165dd: "madvise MADV_DONTFORK/MADV_DOFORK"), so just extend it to any of the VM_SPECIAL cases (which includes VM_DONTEXPAND | VM_PFNMAP | VM_MIXEDMAP in addition to VM_IO). We could also allow MADV_DOFORK only on mappings that had been marked DONTFORK by the user. But that would require us to track that (presumably with another VM_xyz bit), so let's just do this trivial and straightforward modifications. If anybody notices, Lorenzo will be boarding Flying Pig Airlines. Suggested-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes (Oracle) Link: https://lore.kernel.org/all/a8907468-d7e9-4727-af28-66d905093230@kernel.org/ Cc: Steven Rostedt Cc: Jason Gunthorpe Signed-off-by: Linus Torvalds commit ca174c705db52db3cc842e754fd25a5f50eb702d Author: Waiman Long Date: Thu Mar 5 14:53:29 2026 -0500 cgroup/cpuset: Call rebuild_sched_domains() directly in hotplug Besides deferring the call to housekeeping_update(), commit 6df415aa46ec ("cgroup/cpuset: Defer housekeeping_update() calls from CPU hotplug to workqueue") also defers the rebuild_sched_domains() call to the workqueue. So a new offline CPU may still be in a sched domain or new online CPU not showing up in the sched domains for a short transition period. That could be a problem in some corner cases and can be the cause of a reported test failure[1]. Fix it by calling rebuild_sched_domains_cpuslocked() directly in hotplug as before. If isolated partition invalidation or recreation is being done, the housekeeping_update() call to update the housekeeping cpumasks will still be deferred to a workqueue. In commit 3bfe47967191 ("cgroup/cpuset: Move housekeeping_update()/rebuild_sched_domains() together"), housekeeping_update() is called before rebuild_sched_domains() because it needs to access the HK_TYPE_DOMAIN housekeeping cpumask. That is now changed to use the static HK_TYPE_DOMAIN_BOOT cpumask as HK_TYPE_DOMAIN cpumask is now changeable at run time. As a result, we can move the rebuild_sched_domains() call before housekeeping_update() with the slight advantage that it will be done in the same cpus_read_lock critical section without the possibility of interference by a concurrent cpu hot add/remove operation. As it doesn't make sense to acquire cpuset_mutex/cpuset_top_mutex after calling housekeeping_update() and immediately release them again, move the cpuset_full_unlock() operation inside update_hk_sched_domains() and rename it to cpuset_update_sd_hk_unlock() to signify that it will release the full set of locks. [1] https://lore.kernel.org/lkml/1a89aceb-48db-4edd-a730-b445e41221fe@nvidia.com Fixes: 6df415aa46ec ("cgroup/cpuset: Defer housekeeping_update() calls from CPU hotplug to workqueue") Tested-by: Jon Hunter Reviewed-by: Chen Ridong Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 1dde502587657045b267f179d7a1ecc7b8a1a265 Author: David Carlier Date: Fri Mar 6 04:50:55 2026 +0000 sched_ext: Use READ_ONCE() for scx_slice_bypass_us in scx_bypass() Commit 0927780c90ce ("sched_ext: Use READ_ONCE() for lock-free reads of module param variables") annotated the plain reads of scx_slice_bypass_us and scx_bypass_lb_intv_us in bypass_lb_cpu(), but missed a third site in scx_bypass(): WRITE_ONCE(scx_slice_dfl, scx_slice_bypass_us * NSEC_PER_USEC); scx_slice_bypass_us is a module parameter writable via sysfs in process context through set_slice_us() -> param_set_uint_minmax(), which performs a plain store without holding bypass_lock. scx_bypass() reads the variable under bypass_lock, but since the writer does not take that lock, the two accesses are concurrent. WRITE_ONCE() only applies volatile semantics to the store of scx_slice_dfl -- the val expression containing scx_slice_bypass_us is evaluated as a plain read, providing no protection against concurrent writes. Wrap the read with READ_ONCE() to complete the annotation started by commit 0927780c90ce and make the access KCSAN-clean, consistent with the existing READ_ONCE(scx_slice_bypass_us) in bypass_lb_cpu(). Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit 617f5e9fad91ebddf0b39e5eb5063d22459557e5 Merge: 723b5c93aaffe0 d240b079a37e90 Author: Linus Torvalds Date: Fri Mar 6 08:44:20 2026 -0800 Merge tag 'v7.0-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix use-after-free in ccp - Fix bug when SEV is disabled in ccp - Fix tfm_count leak in atmel-sha204a * tag 'v7.0-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: atmel-sha204a - Fix OOM ->tfm_count leak crypto: ccp - Fix use-after-free on error path crypto: ccp - allow callers to use HV-Fixed page API when SEV is disabled commit 723b5c93aaffe05cd2cb6585c3b4bc9fd131df27 Merge: a028739a433088 ee0e6e69a772d6 Author: Linus Torvalds Date: Fri Mar 6 08:41:20 2026 -0800 Merge tag 'ata-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Niklas Cassel: - Fix a problem where the deferred non-NCQ command would incorrectly get completed as a failed command, if there was another command that timed out. Found by Gemini (Guenter) - The deferred non-NCQ command work is only supposed to run after the last NCQ command finishes. However, because the work was never canceled on error (e.g. a timeout), the work could incorrectly run when commands were still in flight. Found by syzbot (me) - Add a quirk to make sure that QEMU harddrives can potentially use up to 32 MiB I/Os (Pedro) - Add a quirk to disable LPM on Seagate ST1000DM010-2EP102 (Maximilian) * tag 'ata-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-eh: Fix detection of deferred qc timeouts ata: libata-core: Add BRIDGE_OK quirk for QEMU drives ata: libata: cancel pending work after clearing deferred_qc ata: libata-core: Disable LPM on ST1000DM010-2EP102 commit 98c790b100764102d877e9339471b8c4c9233f2c Author: Breno Leitao Date: Fri Mar 6 02:46:42 2026 -0800 workqueue: Rename show_cpu_pool{s,}_hog{s,}() to reflect broadened scope show_cpu_pool_hog() and show_cpu_pools_hogs() no longer only dump CPU hogs — since commit 8823eaef45da ("workqueue: Show all busy workers in stall diagnostics"), they dump every in-flight worker in the pool's busy_hash. Rename them to show_cpu_pool_busy_workers() and show_cpu_pools_busy_workers() to accurately describe what they do. Also fix the pr_info() message to say "stalled worker pools" instead of "stalled CPU-bound worker pools", since sleeping/blocked workers are now included. No functional change. Suggested-by: Tejun Heo Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit a028739a4330881a6a3b5aa4a39381bbcacf2f2f Merge: 3ad66a34cce2c5 ce8ee8583ed831 Author: Linus Torvalds Date: Fri Mar 6 08:36:18 2026 -0800 Merge tag 'block-7.0-20260305' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Improve quirk visibility and configurability (Maurizio) - Fix runtime user modification to queue setup (Keith) - Fix multipath leak on try_module_get failure (Keith) - Ignore ambiguous spec definitions for better atomics support (John) - Fix admin queue leak on controller reset (Ming) - Fix large allocation in persistent reservation read keys (Sungwoo Kim) - Fix fcloop callback handling (Justin) - Securely free DHCHAP secrets (Daniel) - Various cleanups and typo fixes (John, Wilfred) - Avoid a circular lock dependency issue in the sysfs nr_requests or scheduler store handling - Fix a circular lock dependency with the pcpu mutex and the queue freeze lock - Cleanup for bio_copy_kern(), using __bio_add_page() rather than the bio_add_page(), as adding a page here cannot fail. The exiting code had broken cleanup for the error condition, so make it clear that the error condition cannot happen - Fix for a __this_cpu_read() in preemptible context splat * tag 'block-7.0-20260305' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: use trylock to avoid lockdep circular dependency in sysfs nvme: fix memory allocation in nvme_pr_read_keys() block: use __bio_add_page in bio_copy_kern block: break pcpu_alloc_mutex dependency on freeze_lock blktrace: fix __this_cpu_read/write in preemptible context nvme-multipath: fix leak on try_module_get failure nvmet-fcloop: Check remoteport port_state before calling done callback nvme-pci: do not try to add queue maps at runtime nvme-pci: cap queue creation to used queues nvme-pci: ensure we're polling a polled queue nvme: fix memory leak in quirks_param_set() nvme: correct comment about nvme_ns_remove() nvme: stop setting namespace gendisk device driver data nvme: add support for dynamic quirk configuration via module parameter nvme: fix admin queue leak on controller reset nvme-fabrics: use kfree_sensitive() for DHCHAP secrets nvme: stop using AWUPF nvme: expose active quirks in sysfs nvme/host: fixup some typos commit 8ce8d0524c136f60a1bddb0951db2999342d7217 Author: Christian Loehle Date: Fri Mar 6 10:30:51 2026 +0000 sched_ext: Documentation: Mention scheduling class precedence Mention the scheduling class precedence of fair and sched_ext to clear up how sched_ext partial mode works. Signed-off-by: Christian Loehle Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 3ad66a34cce2c5a6532ac0b979fdf58677193c67 Merge: 7fe44c4388146b 531bb98a030cc1 Author: Linus Torvalds Date: Fri Mar 6 08:31:36 2026 -0800 Merge tag 'io_uring-7.0-20260305' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix a typo in the mock_file help text - Fix a comment regarding IORING_SETUP_TASKRUN_FLAG in the io_uring.h UAPI header - Use READ_ONCE() for reading refill queue entries - Reject SEND_VECTORIZED for fixed buffer sends, as it isn't implemented. Currently this flag is silently ignored This is in preparation for making these work, but first we need a fixup so that older kernels will correctly reject them - Ensure "0" means default for the rx page size * tag 'io_uring-7.0-20260305' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/zcrx: use READ_ONCE with user shared RQEs io_uring/mock: Fix typo in help text io_uring/net: reject SEND_VECTORIZED when unsupported io_uring: correct comment for IORING_SETUP_TASKRUN_FLAG io_uring/zcrx: don't set rx_page_size when not requested commit a4e8473b775160f3ce978f621cf8dea2c7250433 Author: Yeoreum Yun Date: Wed Mar 4 12:09:53 2026 +0000 firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap() According to the FF-A specification (DEN0077, v1.1, §13.7), when FFA_RXTX_UNMAP is invoked from any instance other than non-secure physical, the w1 register must be zero (MBZ). If a non-zero value is supplied in this context, the SPMC must return FFA_INVALID_PARAMETER. The Arm FF-A driver operates exclusively as a guest or non-secure physical instance where the partition ID is always zero and is not invoked from a hypervisor context where w1 carries a VM ID. In this execution model, the partition ID observed by the driver is always zero, and passing a VM ID is unnecessary and potentially invalid. Remove the vm_id parameter from ffa_rxtx_unmap() and ensure that the SMC call is issued with w1 implicitly zeroed, as required by the specification. This prevents invalid parameter errors and aligns the implementation with the defined FF-A ABI behavior. Fixes: 3bbfe9871005 ("firmware: arm_ffa: Add initial Arm FFA driver support") Signed-off-by: Yeoreum Yun Message-Id: <20260304120953.847671-1-yeoreum.yun@arm.com> Signed-off-by: Sudeep Holla commit 7fe44c4388146bdbb3c5932d81a26d9fa0fd3ec9 Author: Christian Loehle Date: Fri Mar 6 10:49:18 2026 +0000 bpf: drop kthread_exit from noreturn_deny kthread_exit became a macro to do_exit in commit 28aaa9c39945 ("kthread: consolidate kthread exit paths to prevent use-after-free"), so there is no kthread_exit function BTF ID to resolve. Remove it from noreturn_deny to avoid resolve_btfids unresolved symbol warnings. Signed-off-by: Christian Loehle Signed-off-by: Linus Torvalds commit 1fd1dc41724319406b0aff221a352a400b0ddfc5 Author: Josh Poimboeuf Date: Wed Mar 4 19:31:21 2026 -0800 objtool: Fix ERROR_INSN() error message Confusingly, ERROR_INSN() shows "warning:" instead of "error:". Fix that. Link: https://patch.msgid.link/c4fe793bb3d23fac2c636b2511059af1158410e2.1772681234.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit 356e4b2f5b80f757965f3f4d0219c81fca91b6f2 Author: Josh Poimboeuf Date: Wed Mar 4 19:31:20 2026 -0800 objtool: Fix data alignment in elf_add_data() Any data added to a section needs to be aligned in accordance with the section's sh_addralign value. Particularly strings added to a .str1.8 section. Otherwise you may get some funky strings. Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Link: https://patch.msgid.link/d962fc0ca24fa0825cca8dad71932dccdd9312a9.1772681234.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit 32234049107d012703d50547e815f198f147968b Author: HONG Yifan Date: Tue Mar 3 01:03:39 2026 +0000 objtool: Use HOSTCFLAGS for HAVE_XXHASH test Previously, HAVE_XXHASH is tested by invoking HOSTCC without HOSTCFLAGS. Consider the following scenario: - The host machine has libxxhash installed - We build the kernel with HOSTCFLAGS containing a --sysroot that does not have xxhash.h (for hermetic builds) In this case, HAVE_XXHASH is set to y, but when it builds objtool with HOSTCFLAGS, because the --sysroot does not contain xxhash.h, the following error is raised: <...>/common/tools/objtool/include/objtool/checksum_types.h:12:10: fatal error: 'xxhash.h' file not found 12 | #include | ^~~~~~~~~~ To resolve the error, we test HAVE_XXHASH by invoking HOSTCC with HOSTCFLAGS. Signed-off-by: HONG Yifan Reviewed-by: Carlos Llamas Link: https://patch.msgid.link/20260303010340.306164-1-elsk@google.com Signed-off-by: Josh Poimboeuf commit 11c2adcd1fa2a9380a507db1e57c8542bfc81827 Author: Josh Poimboeuf Date: Tue Feb 10 13:50:11 2026 -0800 objtool/klp: Avoid NULL pointer dereference when printing code symbol name Fix a hypothetical NULL pointer defereference of the 'code_sym' variable. In theory this should never happen. Reviewed-and-tested-by: Song Liu Link: https://patch.msgid.link/64116517bc93851a98fe366ea0a4d807f4c70aab.1770759954.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit e476bb277cf91b7ac3ea803ec78a4f0791bddec3 Author: Josh Poimboeuf Date: Tue Feb 10 13:50:10 2026 -0800 objtool/klp: Disable unsupported pr_debug() usage Instead of erroring out on unsupported pr_debug() (e.g., when patching a module), issue a warning and make it inert, similar to how unsupported tracepoints are currently handled. Reviewed-and-tested-by: Song Liu Link: https://patch.msgid.link/3a7db3a5b7d4abf9b2534803a74e2e7231322738.1770759954.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit f9fb44b0ecefc1f218db56661ed66d4e8d67317d Author: Josh Poimboeuf Date: Tue Feb 10 13:50:09 2026 -0800 objtool/klp: Fix detection of corrupt static branch/call entries Patching a function which references a static key living in a kernel module is unsupported due to ordering issues inherent to late module patching: 1) Load a livepatch module which has a __jump_table entry which needs a klp reloc to reference static key K which lives in module M. 2) The __jump_table klp reloc does *not* get resolved because module M is not yet loaded. 3) jump_label_add_module() corrupts memory (or causes a panic) when dereferencing the uninitialized pointer to key K. validate_special_section_klp_reloc() intends to prevent that from ever happening by catching it at build time. However, it incorrectly assumes the special section entry's reloc symbol references have already been converted from section symbols to object symbols, causing the validation to miss corruption in extracted static branch/call table entries. Make sure the references have been properly converted before doing the validation. Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Reported-by: Song Liu Reviewed-and-tested-by: Song Liu Link: https://patch.msgid.link/124ad747b751df0df1725eff89de8332e3fb26d6.1770759954.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit 93d0fcdddc9e7be9d4f42acbe57bc90dbb0fe75d Author: Keith Busch Date: Thu Mar 5 12:40:56 2026 -0800 cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch Commit e7e222ad73d9 ("cxl: Move devm_cxl_add_nvdimm_bridge() to cxl_pmem.ko") moves devm_cxl_add_nvdimm_bridge() into the cxl_pmem file, which has independent config compile options for built-in or module. The call from cxl_acpi_probe() is guarded by IS_ENABLED(CONFIG_CXL_PMEM), which evaluates to true for both =y and =m. When CONFIG_CXL_PMEM=m, a built-in cxl_acpi attempts to reference a symbol exported by a module, which fails to link. CXL_PMEM cannot simply be promoted to =y in this configuration because it depends on LIBNVDIMM, which may itself be =m. Add a Kconfig dependency to prevent CXL_ACPI from being built-in when CXL_PMEM is a module. This contrains CXL_ACPI to =m when CXL_PMEM=m, while still allowing CXL_ACPI to be freely configured when CXL_PMEM is either built-in or disabled. [ dj: Fix up commit reference formatting. ] Fixes: e7e222ad73d9 ("cxl: Move devm_cxl_add_nvdimm_bridge() to cxl_pmem.ko") Signed-off-by: Keith Busch Reviewed-by: Jonathan Cameron Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260305204057.1516948-1-kbusch@meta.com Signed-off-by: Dave Jiang commit ebe7561e9b9203611cea72a764bc321ff308f737 Author: Cosmin Tanislav Date: Thu Feb 5 12:39:30 2026 +0200 pinctrl: renesas: rzt2h: Fix invalid wait context The rzt2h_gpio_get_direction() function is called from gpiod_get_direction(), which ends up being used within the __setup_irq() call stack when requesting an interrupt. __setup_irq() holds a raw_spinlock_t with IRQs disabled, which creates an atomic context. spinlock_t cannot be used within atomic context when PREEMPT_RT is enabled, since it may become a sleeping lock. An "[ BUG: Invalid wait context ]" splat is observed when running with CONFIG_PROVE_LOCKING enabled, describing exactly the aforementioned call stack. __setup_irq() needs to hold a raw_spinlock_t with IRQs disabled to serialize access against a concurrent hard interrupt. Switch to raw_spinlock_t to fix this. Fixes: 829dde3369a9 ("pinctrl: renesas: rzt2h: Add GPIO IRQ chip to handle interrupts") Signed-off-by: Cosmin Tanislav Reviewed-by: Sebastian Andrzej Siewior Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260205103930.666051-1-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Geert Uytterhoeven commit e825c79ef914bd55cf7c2476ddcfb2738eb689c3 Author: Felix Gu Date: Tue Jan 27 00:35:47 2026 +0800 pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register() When calling of_parse_phandle_with_fixed_args(), the caller is responsible for calling of_node_put() to release the device node reference. In rzt2h_gpio_register(), the driver fails to call of_node_put() to release the reference in of_args.np, which causes a memory leak. Add the missing of_node_put() call to fix the leak. Fixes: 34d4d093077a ("pinctrl: renesas: Add support for RZ/T2H") Signed-off-by: Felix Gu Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260127-rzt2h-v1-1-86472e7421b8@gmail.com Signed-off-by: Geert Uytterhoeven commit 85c2601e2c2feb60980c7ca23de28c49472f61f1 Author: Geert Uytterhoeven Date: Wed Mar 4 17:29:01 2026 +0100 arm64: dts: renesas: r8a78000: Fix out-of-range SPI interrupt numbers SPI interrupts are in the range 0-987. Extended SPI interrupts should use GIC_ESPI, instead of abusing GIC_SPI with a manual offset of 4064. Fixes: 63500d12cf76d003 ("arm64: dts: renesas: Add R8A78000 SoC support") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/1f9dd274720ea1b66617a5dd84f76c3efc829dc8.1772641415.git.geert+renesas@glider.be commit 6dcbb6f070cccabc6a13d640a5a84de581fdd761 Author: Claudiu Beznea Date: Mon Mar 2 15:57:03 2026 +0200 arm64: dts: renesas: rzg3s-smarc-som: Set bypass for Versa3 PLL2 The default settings for the Versa3 device on the Renesas RZ/G3S SMARC SoM board have PLL2 disabled. PLL2 was later enabled together with audio support, as it is required to support both 44.1 kHz and 48 kHz audio. With PLL2 enabled, it was observed that Linux occasionally either hangs during boot (the last log message being related to the I2C probe) or randomly crashes. This was mainly reproducible on cold boots. During debugging, it was also noticed that the Unicode replacement character (�) sometimes appears on the serial console. Further investigation traced this to the configuration applied through the Versa3 register at offset 0x1c, which controls PLL enablement. The appearance of the Unicode replacement character suggested an issue with the SoC reference clock. The RZ/G3S reference clock is provided by the Versa3 clock generator (REF output). After checking with the Renesas Versa3 hardware team, it was found that this is related to the PLL2 lock bit being set through the renesas,settings DT property. The PLL lock bit must be set to avoid unstable clock output from the PLL. However, due to the Versa3 hardware design, when a PLL lock bit is set, all outputs (including the REF clock) are temporarily disabled until the configured PLLs become stable. As an alternative, the bypass bit can be used. This does not interrupt the PLL2 output or any other Versa3 outputs, but it may result in temporary instability on PLL2 output while the configuration is applied. Since PLL2 feeds only the audio path and audio is not used during early boot, this is acceptable and does not affect system boot. Drop the PLL2 lock bit and set the bypass bit instead. This has been tested with more than 1000 cold boots. Fixes: a94253232b04 ("arm64: dts: renesas: rzg3s-smarc-som: Add versa3 clock generator node") Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260302135703.162601-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f459672cf3ffd3c062973838951418271aa2ceef Author: Lad Prabhakar Date: Fri Feb 13 13:17:42 2026 +0000 arm64: dts: renesas: r9a09g087: Fix CPG register region sizes The CPG register regions were incorrectly sized. Update them to match the actual hardware specification: - First region (0x80280000): 0x1000 -> 0x10000 (64kiB) - Second region (0x81280000): 0x9000 -> 0x10000 (64kiB) Fixes: 4b3d31f0b81fe ("arm64: dts: renesas: Add initial SoC DTSI for the RZ/N2H SoC") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260213131742.3606334-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit b12985ceca18bcf67f176883175d544daad5e00e Author: Lad Prabhakar Date: Fri Feb 13 13:17:41 2026 +0000 arm64: dts: renesas: r9a09g077: Fix CPG register region sizes The CPG register regions were incorrectly sized. Update them to match the actual hardware specification: - First region (0x80280000): 0x1000 -> 0x10000 (64kiB) - Second region (0x81280000): 0x9000 -> 0x10000 (64kiB) Fixes: d17b34744f5e4 ("arm64: dts: renesas: Add initial support for the Renesas RZ/T2H SoC") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260213131742.3606334-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a3f34651de4287138c0da19ba321ad72622b4af3 Author: Fabrizio Castro Date: Tue Feb 3 12:42:46 2026 +0000 arm64: dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes The HW user manual for the Renesas RZ/V2H(P) SoC (a.k.a r9a09g057) states that only WDT1 is supposed to be accessed by the CA55 cores. WDT0 is supposed to be used by the CM33 core, WDT2 is supposed to be used by the CR8 core 0, and WDT3 is supposed to be used by the CR8 core 1. Remove wdt{0,2,3} from the SoC specific device tree to make it compliant with the specification from the HW manual. This change is harmless as there are currently no users of the wdt{0,2,3} device tree nodes, only the wdt1 node is actually used. Fixes: 095105496e7d ("arm64: dts: renesas: r9a09g057: Add WDT0-WDT3 nodes") Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260203124247.7320-3-fabrizio.castro.jz@renesas.com Signed-off-by: Geert Uytterhoeven commit 5c03465ecf6a56b7b261df9594f0e10612f53a50 Author: Lad Prabhakar Date: Fri Jan 23 22:59:57 2026 +0000 arm64: dts: renesas: rzv2-evk-cn15-sd: Add ramp delay for SD0 regulator Set an appropriate ramp delay for the SD0 I/O voltage regulator in the CN15 SD overlay to make UHS-I voltage switching reliable during card initialization. This issue was observed on the RZ/V2H EVK, while the same UHS-I cards worked on the RZ/V2N EVK without problems. Adding the ramp delay makes the behavior consistent and avoids SD init timeouts. Before this change SD0 could fail with: mmc0: error -110 whilst initialising SD card With the delay in place UHS-I cards enumerate correctly: mmc0: new UHS-I speed SDR104 SDXC card at address aaaa mmcblk0: mmc0:aaaa SR64G 59.5 GiB mmcblk0: p1 Fixes: 3d6c2bc7629c8 ("arm64: dts: renesas: Add CN15 eMMC and SD overlays for RZ/V2H and RZ/V2N EVKs") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260123225957.1007089-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit bb70589b67039e491dd60cf71272884e926a0f95 Author: Lad Prabhakar Date: Fri Jan 23 22:59:54 2026 +0000 arm64: dts: renesas: rzt2h-n2h-evk: Add ramp delay for SD0 card regulator Add a ramp delay of 60 uV/us to the vqmmc_sdhi0 voltage regulator to fix UHS-I SD card detection failures. Measurements on CN78 pin 4 showed the actual voltage ramp time to be 21.86ms when switching between 3.3V and 1.8V. A 25ms ramp delay has been configured to provide adequate margin. The calculation is based on the voltage delta of 1.5V (3.3V - 1.8V): 1500000 uV / 60 uV/us = 25000 us (25ms) Prior to this patch, UHS-I cards failed to initialize with: mmc0: error -110 whilst initialising SD card After this patch, UHS-I cards are properly detected on SD0: mmc0: new UHS-I speed SDR104 SDXC card at address aaaa mmcblk0: mmc0:aaaa SR64G 59.5 GiB Fixes: d065453e5ee09 ("arm64: dts: renesas: rzt2h-rzn2h-evk: Enable SD card slot") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260123225957.1007089-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit d87c828daa7ead9763416f75cc416496969cf1dc Author: Yifan Wu Date: Thu Mar 5 09:36:37 2026 +0800 selftest/arm64: Fix sve2p1_sigill() to hwcap test The FEAT_SVE2p1 is indicated by ID_AA64ZFR0_EL1.SVEver. However, the BFADD requires the FEAT_SVE_B16B16, which is indicated by ID_AA64ZFR0_EL1.B16B16. This could cause the test to incorrectly fail on a CPU that supports FEAT_SVE2.1 but not FEAT_SVE_B16B16. LD1Q Gather load quadwords which is decoded from SVE encodings and implied by FEAT_SVE2p1. Fixes: c5195b027d29 ("kselftest/arm64: Add SVE 2.1 to hwcap test") Signed-off-by: Yifan Wu Reviewed-by: Mark Brown Signed-off-by: Will Deacon commit 6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09 Author: Peddolla Harshavardhan Reddy Date: Thu Mar 5 21:36:59 2026 +0530 wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down When the nl80211 socket that originated a PMSR request is closed, cfg80211_release_pmsr() sets the request's nl_portid to zero and schedules pmsr_free_wk to process the abort asynchronously. If the interface is concurrently torn down before that work runs, cfg80211_pmsr_wdev_down() calls cfg80211_pmsr_process_abort() directly. However, the already- scheduled pmsr_free_wk work item remains pending and may run after the interface has been removed from the driver. This could cause the driver's abort_pmsr callback to operate on a torn-down interface, leading to undefined behavior and potential crashes. Cancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down() before calling cfg80211_pmsr_process_abort(). This ensures any pending or in-progress work is drained before interface teardown proceeds, preventing the work from invoking the driver abort callback after the interface is gone. Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API") Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260305160712.1263829-3-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg commit f303406efd0b6b8740ce5c47e852097bbcf54879 Author: Claudio Imbrenda Date: Tue Mar 3 18:52:06 2026 +0100 KVM: s390: Fix a deadlock In some scenarios, a deadlock can happen, involving _do_shadow_pte(). Convert all usages of pgste_get_lock() to pgste_get_trylock() in _do_shadow_pte() and return -EAGAIN. All callers can already deal with -EAGAIN being returned. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Tested-by: Christian Borntraeger Reviewed-by: Janosch Frank Reviewed-by: Christoph Schlameuss Signed-off-by: Claudio Imbrenda commit 97c5550b763171dbef61e6239cab372b9f9cd4a2 Author: Piotr Jaroszynski Date: Thu Mar 5 15:26:29 2026 -0800 arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults contpte_ptep_set_access_flags() compared the gathered ptep_get() value against the requested entry to detect no-ops. ptep_get() ORs AF/dirty from all sub-PTEs in the CONT block, so a dirty sibling can make the target appear already-dirty. When the gathered value matches entry, the function returns 0 even though the target sub-PTE still has PTE_RDONLY set in hardware. For a CPU with FEAT_HAFDBS this gathered view is fine, since hardware may set AF/dirty on any sub-PTE and CPU TLB behavior is effectively gathered across the CONT range. But page-table walkers that evaluate each descriptor individually (e.g. a CPU without DBM support, or an SMMU without HTTU, or with HA/HD disabled in CD.TCR) can keep faulting on the unchanged target sub-PTE, causing an infinite fault loop. Gathering can therefore cause false no-ops when only a sibling has been updated: - write faults: target still has PTE_RDONLY (needs PTE_RDONLY cleared) - read faults: target still lacks PTE_AF Fix by checking each sub-PTE against the requested AF/dirty/write state (the same bits consumed by __ptep_set_access_flags()), using raw per-PTE values rather than the gathered ptep_get() view, before returning no-op. Keep using the raw target PTE for the write-bit unfold decision. Per Arm ARM (DDI 0487) D8.7.1 ("The Contiguous bit"), any sub-PTE in a CONT range may become the effective cached translation and software must maintain consistent attributes across the range. Fixes: 4602e5757bcc ("arm64/mm: wire up PTE_CONT for user mappings") Cc: Ryan Roberts Cc: Catalin Marinas Cc: Will Deacon Cc: Jason Gunthorpe Cc: John Hubbard Cc: Zi Yan Cc: Breno Leitao Cc: stable@vger.kernel.org Reviewed-by: Alistair Popple Reviewed-by: James Houghton Reviewed-by: Ryan Roberts Reviewed-by: Catalin Marinas Tested-by: Breno Leitao Signed-off-by: Piotr Jaroszynski Acked-by: Balbir Singh Signed-off-by: Will Deacon commit 25966fc097691e5c925ad080f64a2f19c5fd940a Author: Mehul Rao Date: Thu Mar 5 14:31:46 2026 -0500 ublk: fix NULL pointer dereference in ublk_ctrl_set_size() ublk_ctrl_set_size() unconditionally dereferences ub->ub_disk via set_capacity_and_notify() without checking if it is NULL. ub->ub_disk is NULL before UBLK_CMD_START_DEV completes (it is only assigned in ublk_ctrl_start_dev()) and after UBLK_CMD_STOP_DEV runs (ublk_detach_disk() sets it to NULL). Since the UBLK_CMD_UPDATE_SIZE handler performs no state validation, a user can trigger a NULL pointer dereference by sending UPDATE_SIZE to a device that has been added but not yet started, or one that has been stopped. Fix this by checking ub->ub_disk under ub->mutex before dereferencing it, and returning -ENODEV if the disk is not available. Fixes: 98b995660bff ("ublk: Add UBLK_U_CMD_UPDATE_SIZE") Cc: stable@vger.kernel.org Signed-off-by: Mehul Rao Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 3599c714c08c324f0fcfa392bfb857c92c575400 Author: Zenghui Yu (Huawei) Date: Fri Mar 6 15:44:22 2026 +0800 KVM: arm64: Remove the redundant ISB in __kvm_at_s1e2() We already have an ISB in __kvm_at() to make the address translation result visible to subsequent reads of PAR_EL1. Remove the redundant one right after it. Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260306074422.47694-1-zenghui.yu@linux.dev Signed-off-by: Marc Zyngier commit 244acf1976b889b80b234982a70e9550c6f0bab7 Author: Fuad Tabba Date: Wed Mar 4 16:22:22 2026 +0000 KVM: arm64: Fix vma_shift staleness on nested hwpoison path When user_mem_abort() handles a nested stage-2 fault, it truncates vma_pagesize to respect the guest's mapping size. However, the local variable vma_shift is never updated to match this new size. If the underlying host page turns out to be hardware poisoned, kvm_send_hwpoison_signal() is called with the original, larger vma_shift instead of the actual mapping size. This signals incorrect poison boundaries to userspace and breaks hugepage memory poison containment for nested VMs. Update vma_shift to match the truncated vma_pagesize when operating on behalf of a nested hypervisor. Fixes: fd276e71d1e7 ("KVM: arm64: nv: Handle shadow stage 2 page faults") Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260304162222.836152-3-tabba@google.com [maz: simplified vma_shift assignment from the original patch] Signed-off-by: Marc Zyngier commit 8475d8fe21ec9c7eb2faca555fbc5b68cf0d2597 Author: Helge Deller Date: Wed Mar 4 22:24:18 2026 +0100 parisc: Fix initial page table creation for boot The KERNEL_INITIAL_ORDER value defines the initial size (usually 32 or 64 MB) of the page table during bootup. Up until now the whole area was initialized with PTE entries, but there was no check if we filled too many entries. Change the code to fill up with so many entries that the "_end" symbol can be reached by the kernel, but not more entries than actually fit into the initial PTE tables. Signed-off-by: Helge Deller Cc: # v6.0+ commit 17c144f1104bfc29a3ce3f7d0931a1bfb7a3558c Author: Helge Deller Date: Tue Mar 3 23:36:11 2026 +0100 parisc: Check kernel mapping earlier at bootup The check if the initial mapping is sufficient needs to happen much earlier during bootup. Move this test directly to the start_parisc() function and use native PDC iodc functions to print the warning, because panic() and printk() are not functional yet. This fixes boot when enabling various KALLSYSMS options which need much more space. Signed-off-by: Helge Deller Cc: # v6.0+ commit 8e732934fb81282be41602550e7e07baf265e972 Author: Helge Deller Date: Tue Mar 3 23:36:10 2026 +0100 parisc: Increase initial mapping to 64 MB with KALLSYMS The 32MB initial kernel mapping can become too small when CONFIG_KALLSYMS is used. Increase the mapping to 64 MB in this case. Signed-off-by: Helge Deller Cc: # v6.0+ commit b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828 Author: Kuniyuki Iwashima Date: Fri Mar 6 07:24:02 2026 +0000 wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. syzbot reported static_branch_dec() underflow in aql_enable_write(). [0] The problem is that aql_enable_write() does not serialise concurrent write()s to the debugfs. aql_enable_write() checks static_key_false(&aql_disable.key) and later calls static_branch_inc() or static_branch_dec(), but the state may change between the two calls. aql_disable does not need to track inc/dec. Let's use static_branch_enable() and static_branch_disable(). [0]: val == 0 WARNING: kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288 Modules linked in: CPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G U L syzkaller #0 PREEMPT(full) Tainted: [U]=USER, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311 Code: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00 RSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4 RDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a R13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98 FS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0 Call Trace: __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline] __static_key_slow_dec kernel/jump_label.c:321 [inline] static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336 aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343 short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383 vfs_write+0x2aa/0x1070 fs/read_write.c:684 ksys_pwrite64 fs/read_write.c:793 [inline] __do_sys_pwrite64 fs/read_write.c:801 [inline] __se_sys_pwrite64 fs/read_write.c:798 [inline] __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f530cf9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 RAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9 RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010 RBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000 R10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978 Fixes: e908435e402a ("mac80211: introduce aql_enable node in debugfs") Reported-by: syzbot+feb9ce36a95341bb47a4@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69a8979e.a70a0220.b118c.0025.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260306072405.3649474-1-kuniyu@google.com Signed-off-by: Johannes Berg commit 672e5229e1ecfc2a3509b53adcb914d8b024a853 Author: Felix Fietkau Date: Thu Mar 5 17:08:12 2026 +0000 mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations ieee80211_chan_bw_change() iterates all stations and accesses link->reserved.oper via sta->sdata->link[link_id]. For stations on AP_VLAN interfaces (e.g. 4addr WDS clients), sta->sdata points to the VLAN sdata, whose link never participates in chanctx reservations. This leaves link->reserved.oper zero-initialized with chan == NULL, causing a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() when accessing chandef->chan->band during CSA. Resolve the VLAN sdata to its parent AP sdata using get_bss_sdata() before accessing link data. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Link: https://patch.msgid.link/20260305170812.2904208-1-nbd@nbd.name [also change sta->sdata in ARRAY_SIZE even if it doesn't matter] Signed-off-by: Johannes Berg commit ac6f24cc9c0a9aefa55ec9696dcafa971d4d760b Author: Nicolas Cavallari Date: Tue Mar 3 17:06:39 2026 +0100 wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times Inactive times of around 0xffffffff milliseconds have been observed on an ath9k device on ARM. This is likely due to a memory ordering race in the jiffies_to_msecs(jiffies - last_active()) calculation causing an overflow when the observed jiffies is below ieee80211_sta_last_active(). Use jiffies_delta_to_msecs() instead to avoid this problem. Fixes: 7bbdd2d98797 ("mac80211: implement station stats retrieval") Signed-off-by: Nicolas Cavallari Link: https://patch.msgid.link/20260303161701.31808-1-nicolas.cavallari@green-communications.fr Signed-off-by: Johannes Berg commit 708bbb45537780a8d3721ca1e0cf1932c1d1bf5f Author: Johannes Berg Date: Tue Mar 3 15:03:39 2026 +0100 wifi: mac80211: remove keys after disabling beaconing We shouldn't remove keys before disable beaconing, at least when beacon protection is used, since that would remove keys that are still used for beacon transmission at the same time. Stop before removing keys so there's no race. Fixes: af2d14b01c32 ("mac80211: Beacon protection using the new BIGTK (STA)") Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260303150339.574e7887b3ab.I50d708f5aa22584506a91d0da7f8a73ba39fceac@changeid Signed-off-by: Johannes Berg commit bd9121a5e9fa03fcf32afa5f3d238e942ae6045e Author: Johannes Berg Date: Tue Mar 3 12:37:39 2026 +0100 wifi: mac80211_hwsim: fully initialise PMSR capabilities Since the recent additions to PMSR capabilities, it's no longer sufficient to call parse_pmsr_capa() here since the capabilities that were added aren't represented/filled by it. Always init the data to zero to avoid using uninitialized memory. Fixes: 86c6b6e4d187 ("wifi: nl80211/cfg80211: add new FTM capabilities") Reported-by: syzbot+c686c6b197d10ff3a749@syzkaller.appspotmail.com Closes: https://lore.kernel.org/69a67aa3.a70a0220.b118c.000a.GAE@google.com/ Link: https://patch.msgid.link/20260303113739.176403-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit 96bfe9ff7e88f0541002640acbcb3ec63c9d0130 Merge: 431989960f9442 0cfe9c4838f114 Author: Dave Airlie Date: Fri Mar 6 19:45:11 2026 +1000 Merge tag 'drm-xe-fixes-2026-03-05' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Cross-subsystem Changes: - mm: Fix a hmm_range_fault() livelock / starvation problem (Thomas) Core Changes: - Revert "drm/pagemap: Disable device-to-device migration" (Thomas) Driver Changes: - Do not preempt fence signaling CS instructions (Brost) - Some leak and finalization fixes (Shuicheng, Tomasz, Varun, Zhanjun) - Workaround fix (Roper) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aamGvvGRBRtX8-6u@intel.com commit 431989960f9442b0d3b41d899005f8fcbcfc1130 Merge: 3d3234d5daaacd 021f1b77f70d62 Author: Dave Airlie Date: Fri Mar 6 19:40:23 2026 +1000 Merge tag 'drm-misc-fixes-2026-03-06' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Another early drm-misc-fixes PR to revert the previous uapi fix sent in drm-misc-fixes-2026-03-05, together with a UAF fix in TTM, an argument order fix for panthor, a fix for the firmware getting stuck on resource allocation error handling for amdxdna, and a few fixes for ethosu (size calculation and reference underflows, and a validation fix). Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260306-grumpy-pegasus-of-witchcraft-6bd2db@houat commit 3d3234d5daaacd468d1bc2c22ed8a26124e9da57 Merge: 3fcb1cbd7678ec 8f3c6f08ababad Author: Dave Airlie Date: Fri Mar 6 17:45:47 2026 +1000 Merge tag 'drm-misc-fixes-2026-03-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A return type fix for ttm, a display fix for solomon, several misc fixes for amdxdna, a DSI clock rate fix for rz-du, a uapi fix for syncobj, a possible build failure fix for dma-buf, a doc warning fix for sched, a build failure fix for ttm tests, and a crash fix when suspended for nouveau. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260305-ludicrous-quirky-raven-7cdafd@houat commit ee0e6e69a772d601e152e5368a1da25d656122a8 Author: Guenter Roeck Date: Thu Mar 5 18:48:05 2026 -0800 ata: libata-eh: Fix detection of deferred qc timeouts If the ata_qc_for_each_raw() loop finishes without finding a matching SCSI command for any QC, the variable qc will hold a pointer to the last element examined, which has the tag i == ATA_MAX_QUEUE - 1. This qc can match the port deferred QC (ap->deferred_qc). If that happens, the condition qc == ap->deferred_qc evaluates to true despite the loop not breaking with a match on the SCSI command for this QC. In that case, the error handler mistakenly intercepts a command that has not been issued yet and that has not timed out, and thus erroneously returning a timeout error. Fix the problem by checking for i < ATA_MAX_QUEUE in addition to qc == ap->deferred_qc. The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y. Assisted-by: Gemini:gemini-3.1-pro Fixes: eddb98ad9364 ("ata: libata-eh: correctly handle deferred qc timeouts") Signed-off-by: Guenter Roeck [cassel: modified commit log as suggested by Damien] Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 54fcd2f95f8d216183965a370ec69e1aab14f5da Author: Carlos Maiolino Date: Wed Mar 4 19:54:27 2026 +0100 xfs: fix returned valued from xfs_defer_can_append xfs_defer_can_append returns a bool, it shouldn't be returning a NULL. Found by code inspection. Fixes: 4dffb2cbb483 ("xfs: allow pausing of pending deferred work items") Cc: # v6.8 Signed-off-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Acked-by: Souptick Joarder Signed-off-by: Carlos Maiolino commit 3fcb1cbd7678ec057c62dbfe49369cf65badf8a4 Merge: 681d787cb61f36 a99cac460ddeb3 Author: Dave Airlie Date: Fri Mar 6 17:10:00 2026 +1000 Merge tag 'drm-intel-fixes-2026-03-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix for #7284: Lenovo T14 G7 display not refreshing Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/aakz17Jx3Ye9Vqci@jlahtine-mobl commit c61ec3e8cc5d46fa269434a9ec16ca36d362e0dd Author: Anup Patel Date: Tue Jan 20 13:29:49 2026 +0530 RISC-V: KVM: Check host Ssaia extension when creating AIA irqchip The KVM user-space may create KVM AIA irqchip before checking VCPU Ssaia extension availability so KVM AIA irqchip must fail when host does not have Ssaia extension. Fixes: 89d01306e34d ("RISC-V: KVM: Implement device interface for AIA irqchip") Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20260120080013.2153519-4-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel commit 24433b2b5c74a9fee7baa3a97a1947446868901d Author: Anup Patel Date: Tue Jan 20 13:29:48 2026 +0530 RISC-V: KVM: Fix error code returned for Ssaia ONE_REG Return -ENOENT for Ssaia ONE_REG when Ssaia is not enabled for a VCPU. This will make Ssaia ONE_REG error codes consistent with other ONE_REG interfaces of KVM RISC-V. Fixes: 2a88f38cd58d ("RISC-V: KVM: return ENOENT in *_one_reg() when reg is unknown") Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20260120080013.2153519-3-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel commit 45700a743af3b7402cb7238860a25c62f0498ab4 Author: Anup Patel Date: Tue Jan 20 13:29:47 2026 +0530 RISC-V: KVM: Fix error code returned for Smstateen ONE_REG Return -ENOENT for Smstateen ONE_REG when: 1) Smstateen is not enabled for a VCPU 2) ONE_REG id is out of range This will make Smstateen ONE_REG error codes consistent with other ONE_REG interfaces of KVM RISC-V. Fixes: c04913f2b54e ("RISCV: KVM: Add sstateen0 to ONE_REG") Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20260120080013.2153519-2-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel commit 2dda6a9e09ee4f3c30ea72ba949a6ea781205e3a Author: Lukas Gerlach Date: Tue Mar 3 15:19:44 2026 +0100 KVM: riscv: Fix Spectre-v1 in PMU counter access Guest-controlled counter indices received via SBI ecalls are used to index into the PMC array. Sanitize them with array_index_nospec() to prevent speculative out-of-bounds access. Similar to x86 commit 13c5183a4e64 ("KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks"). Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf") Reviewed-by: Radim Krčmář Signed-off-by: Lukas Gerlach Link: https://lore.kernel.org/r/20260303-kvm-riscv-spectre-v1-v2-4-192caab8e0dc@cispa.de Signed-off-by: Anup Patel commit 8f0c15c4b14f27dd9bd35971adb9c908241f2f63 Author: Lukas Gerlach Date: Tue Mar 3 15:19:43 2026 +0100 KVM: riscv: Fix Spectre-v1 in floating-point register access User-controlled indices are used to index into floating-point registers. Sanitize them with array_index_nospec() to prevent speculative out-of-bounds access. Reviewed-by: Radim Krčmář Signed-off-by: Lukas Gerlach Link: https://lore.kernel.org/r/20260303-kvm-riscv-spectre-v1-v2-3-192caab8e0dc@cispa.de Signed-off-by: Anup Patel commit ec87a82ca8740891bce9e93e79ea2cd6c2d70ac8 Author: Lukas Gerlach Date: Tue Mar 3 15:19:42 2026 +0100 KVM: riscv: Fix Spectre-v1 in AIA CSR access User-controlled indices are used to access AIA CSR registers. Sanitize them with array_index_nospec() to prevent speculative out-of-bounds access. Similar to x86 commit 8c86405f606c ("KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks") and arm64 commit 41b87599c743 ("KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()"). Reviewed-by: Radim Krčmář Signed-off-by: Lukas Gerlach Link: https://lore.kernel.org/r/20260303-kvm-riscv-spectre-v1-v2-2-192caab8e0dc@cispa.de Signed-off-by: Anup Patel commit f9e26fc325411a34555ad07ddf0a19ff72ea06d4 Author: Lukas Gerlach Date: Tue Mar 3 15:19:41 2026 +0100 KVM: riscv: Fix Spectre-v1 in ONE_REG register access User-controlled register indices from the ONE_REG ioctl are used to index into arrays of register values. Sanitize them with array_index_nospec() to prevent speculative out-of-bounds access. Reviewed-by: Radim Krčmář Signed-off-by: Lukas Gerlach Link: https://lore.kernel.org/r/20260303-kvm-riscv-spectre-v1-v2-1-192caab8e0dc@cispa.de Signed-off-by: Anup Patel commit b342166cbcf96a8c846db96529e75dc2d2420d58 Author: Wang Yechao Date: Thu Feb 26 19:12:31 2026 +0800 RISC-V: KVM: Skip THP support check during dirty logging When dirty logging is enabled, guest stage mappings are forced to PAGE_SIZE granularity. Changing the mapping page size at this point is incorrect. Fixes: ed7ae7a34bea ("RISC-V: KVM: Transparent huge page support") Signed-off-by: Wang Yechao Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260226191231140_X1Juus7s2kgVlc0ZyW_K@zte.com.cn Signed-off-by: Anup Patel commit 7120a9d9e0232ad3c661a100973c57328f462b80 Author: Jiakai Xu Date: Wed Mar 4 08:08:04 2026 +0000 RISC-V: KVM: Fix potential UAF in kvm_riscv_aia_imsic_has_attr() The KVM_DEV_RISCV_AIA_GRP_APLIC branch of aia_has_attr() was identified to have a race condition with concurrent KVM_SET_DEVICE_ATTR ioctls, leading to a use-after-free bug. Upon analyzing the code, it was discovered that the KVM_DEV_RISCV_AIA_GRP_IMSIC branch of aia_has_attr() suffers from the same lack of synchronization. It invokes kvm_riscv_aia_imsic_has_attr() without holding dev->kvm->lock. While aia_has_attr() is running, a concurrent aia_set_attr() could call aia_init() under the dev->kvm->lock. If aia_init() fails, it may trigger kvm_riscv_vcpu_aia_imsic_cleanup(), which frees imsic_state. Without proper locking, kvm_riscv_aia_imsic_has_attr() could attempt to access imsic_state while it is being deallocated. Although this specific path has not yet been reported by a fuzzer, it is logically identical to the APLIC issue. Fix this by acquiring the dev->kvm->lock before calling kvm_riscv_aia_imsic_has_attr(), ensuring consistency with the locking pattern used for other AIA attribute groups. Fixes: 5463091a51cf ("RISC-V: KVM: Expose IMSIC registers as attributes of AIA irqchip") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260304080804.2281721-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 721ead7757125d66ec9b4ad98939a13d25e0b473 Author: Jiakai Xu Date: Mon Mar 2 13:27:03 2026 +0000 RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr() Fuzzer reports a KASAN use-after-free bug triggered by a race between KVM_HAS_DEVICE_ATTR and KVM_SET_DEVICE_ATTR ioctls on the AIA device. The root cause is that aia_has_attr() invokes kvm_riscv_aia_aplic_has_attr() without holding dev->kvm->lock, while a concurrent aia_set_attr() may call aia_init() under that lock. When aia_init() fails after kvm_riscv_aia_aplic_init() has succeeded, it calls kvm_riscv_aia_aplic_cleanup() in its fail_cleanup_imsics path, which frees both aplic_state and aplic_state->irqs. The concurrent has_attr path can then dereference the freed aplic->irqs in aplic_read_pending(): irqd = &aplic->irqs[irq]; /* UAF here */ KASAN report: BUG: KASAN: slab-use-after-free in aplic_read_pending arch/riscv/kvm/aia_aplic.c:119 [inline] BUG: KASAN: slab-use-after-free in aplic_read_pending_word arch/riscv/kvm/aia_aplic.c:351 [inline] BUG: KASAN: slab-use-after-free in aplic_mmio_read_offset arch/riscv/kvm/aia_aplic.c:406 Read of size 8 at addr ff600000ba965d58 by task 9498 Call Trace: aplic_read_pending arch/riscv/kvm/aia_aplic.c:119 [inline] aplic_read_pending_word arch/riscv/kvm/aia_aplic.c:351 [inline] aplic_mmio_read_offset arch/riscv/kvm/aia_aplic.c:406 kvm_riscv_aia_aplic_has_attr arch/riscv/kvm/aia_aplic.c:566 aia_has_attr arch/riscv/kvm/aia_device.c:469 allocated by task 9473: kvm_riscv_aia_aplic_init arch/riscv/kvm/aia_aplic.c:583 aia_init arch/riscv/kvm/aia_device.c:248 [inline] aia_set_attr arch/riscv/kvm/aia_device.c:334 freed by task 9473: kvm_riscv_aia_aplic_cleanup arch/riscv/kvm/aia_aplic.c:644 aia_init arch/riscv/kvm/aia_device.c:292 [inline] aia_set_attr arch/riscv/kvm/aia_device.c:334 Fix this race by acquiring dev->kvm->lock in aia_has_attr() before calling kvm_riscv_aia_aplic_has_attr(), consistent with the locking pattern used in aia_get_attr() and aia_set_attr(). Fixes: 289a007b98b06d ("RISC-V: KVM: Expose APLIC registers as attributes of AIA irqchip") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260302132703.1721415-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 5c1bb07871119eae6434c640e5e645a74d54a222 Author: Radim Krčmář Date: Fri Feb 27 13:46:16 2026 +0000 RISC-V: KVM: fix off-by-one array access in SBI PMU The indexed array only has RISCV_KVM_MAX_COUNTERS elements. The out-of-bound access could have been performed by a guest, but it could only access another guest accessible data. Fixes: 8f0153ecd3bf ("RISC-V: KVM: Add skeleton support for perf") Signed-off-by: Radim Krčmář Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260227134617.23378-1-radim.krcmar@oss.qualcomm.com Signed-off-by: Anup Patel commit c28eb189e481f5dac993d1907710716a9b561890 Author: Jiakai Xu Date: Thu Feb 26 08:51:19 2026 +0000 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_vcpu_aia_rmw_topei() kvm_riscv_vcpu_aia_rmw_topei() assumes that the per-vCPU IMSIC state has been initialized once AIA is reported as available and initialized at the VM level. This assumption does not always hold. Under fuzzed ioctl sequences, a guest may access the IMSIC TOPEI CSR before the vCPU IMSIC state is set up. In this case, vcpu->arch.aia_context.imsic_state is still NULL, and the TOPEI RMW path dereferences it unconditionally, leading to a host kernel crash. The crash manifests as: Unable to handle kernel paging request at virtual address dfffffff0000000e ... kvm_riscv_vcpu_aia_imsic_rmw arch/riscv/kvm/aia_imsic.c:909 kvm_riscv_vcpu_aia_rmw_topei arch/riscv/kvm/aia.c:231 csr_insn arch/riscv/kvm/vcpu_insn.c:208 system_opcode_insn arch/riscv/kvm/vcpu_insn.c:281 kvm_riscv_vcpu_virtual_insn arch/riscv/kvm/vcpu_insn.c:355 kvm_riscv_vcpu_exit arch/riscv/kvm/vcpu_exit.c:230 kvm_arch_vcpu_ioctl_run arch/riscv/kvm/vcpu.c:1008 ... Fix this by explicitly checking whether the vCPU IMSIC state has been initialized before handling TOPEI CSR accesses. If not, forward the CSR emulation to user space. Fixes: db8b7e97d6137 ("RISC-V: KVM: Add in-kernel virtualization of AIA IMSIC") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Nutty Liu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260226085119.643295-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit dec9ed9944349643874d482238ca2437d4f47b61 Author: Jiakai Xu Date: Mon Feb 2 04:00:59 2026 +0000 RISC-V: KVM: Fix use-after-free in kvm_riscv_gstage_get_leaf() While fuzzing KVM on RISC-V, a use-after-free was observed in kvm_riscv_gstage_get_leaf(), where ptep_get() dereferences a freed gstage page table page during gfn unmap. The crash manifests as: use-after-free in ptep_get include/linux/pgtable.h:340 [inline] use-after-free in kvm_riscv_gstage_get_leaf arch/riscv/kvm/gstage.c:89 Call Trace: ptep_get include/linux/pgtable.h:340 [inline] kvm_riscv_gstage_get_leaf+0x2ea/0x358 arch/riscv/kvm/gstage.c:89 kvm_riscv_gstage_unmap_range+0xf0/0x308 arch/riscv/kvm/gstage.c:265 kvm_unmap_gfn_range+0x168/0x1fc arch/riscv/kvm/mmu.c:256 kvm_mmu_unmap_gfn_range virt/kvm/kvm_main.c:724 [inline] page last free pid 808 tgid 808 stack trace: kvm_riscv_mmu_free_pgd+0x1b6/0x26a arch/riscv/kvm/mmu.c:457 kvm_arch_flush_shadow_all+0x1a/0x24 arch/riscv/kvm/mmu.c:134 kvm_flush_shadow_all virt/kvm/kvm_main.c:344 [inline] The UAF is caused by gstage page table walks running concurrently with gstage pgd teardown. In particular, kvm_unmap_gfn_range() can traverse gstage page tables while kvm_arch_flush_shadow_all() frees the pgd, leading to use-after-free of page table pages. Fix the issue by serializing gstage unmap and pgd teardown with kvm->mmu_lock. Holding mmu_lock ensures that gstage page tables remain valid for the duration of unmap operations and prevents concurrent frees. This matches existing RISC-V KVM usage of mmu_lock to protect gstage map/unmap operations, e.g. kvm_riscv_mmu_iounmap. Fixes: dd82e35638d67f ("RISC-V: KVM: Factor-out g-stage page table management") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260202040059.1801167-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 8565617a8599dd17b96b7bf7e1eb19809ac6ae5e Author: Lukas Gerlach Date: Fri Jan 16 10:57:31 2026 +0100 KVM: riscv: Fix Spectre-v1 in APLIC interrupt handling Guests can control IRQ indices via MMIO. Sanitize them with array_index_nospec() to prevent speculative out-of-bounds access to the aplic->irqs[] array. Similar to arm64 commit 41b87599c743 ("KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()") and x86 commit 8c86405f606c ("KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks"). Fixes: 74967aa208e2 ("RISC-V: KVM: Add in-kernel emulation of AIA APLIC") Signed-off-by: Lukas Gerlach Reviewed-by: Nutty Liu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260116095731.24555-1-lukas.gerlach@cispa.de Signed-off-by: Anup Patel commit 048efe129a297256d3c2088cf8d79515ff5ec864 Author: Paulo Alcantara Date: Thu Mar 5 21:57:06 2026 -0300 smb: client: fix oops due to uninitialised var in smb2_unlink() If SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the iovs set @rqst will be left uninitialised, hence calling SMB2_open_free(), SMB2_close_free() or smb2_set_related() on them will oops. Fix this by initialising @close_iov and @open_iov before setting them in @rqst. Reported-by: Thiago Becker Fixes: 1cf9f2a6a544 ("smb: client: handle unlink(2) of files open by different clients") Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French commit f76a93241d71fbba8425e3967097b498c29264ed Author: Mieczyslaw Nalewaj Date: Tue Mar 3 17:25:12 2026 -0300 net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets rx_packets should report the number of frames successfully received: unicast + multicast + broadcast. Subtracting ifOutDiscards (a TX counter) is incorrect and can undercount RX packets. RX drops are already reported via rx_dropped (e.g. etherStatsDropEvents), so there is no need to adjust rx_packets. This patch removes the subtraction of ifOutDiscards from rx_packets in rtl8365mb_stats_update(). Link: https://lore.kernel.org/netdev/878777925.105015.1763423928520@mail.yahoo.com/ Fixes: 4af2950c50c8 ("net: dsa: realtek-smi: add rtl8365mb subdriver for RTL8365MB-VC") Signed-off-by: Mieczyslaw Nalewaj Signed-off-by: Luiz Angelo Daros de Luca Reviewed-by: Simon Horman Acked-by: Linus Walleij Link: https://patch.msgid.link/20260303-realtek_namiltd_fix2-v1-1-bfa433d3401e@gmail.com Signed-off-by: Jakub Kicinski commit 580cc37b1de4fcd9997c48d7080e744533f09f36 Author: Benno Lossin Date: Mon Mar 2 15:04:15 2026 +0100 rust: pin-init: internal: init: document load-bearing fact of field accessors The functions `[Pin]Init::__[pinned_]init` and `ptr::write` called from the `init!` macro require the passed pointer to be aligned. This fact is ensured by the creation of field accessors to previously initialized fields. Since we missed this very important fact from the beginning [1], document it in the code. Link: https://rust-for-linux.zulipchat.com/#narrow/channel/561532-pin-init/topic/initialized.20field.20accessor.20detection/with/576210658 [1] Fixes: 90e53c5e70a6 ("rust: add pin-init API core") Cc: # 6.6.y, 6.12.y: 42415d163e5d: rust: pin-init: add references to previously initialized fields Cc: # 6.6.y, 6.12.y, 6.18.y, 6.19.y Signed-off-by: Benno Lossin Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260302140424.4097655-2-lossin@kernel.org [ Updated Cc: stable@ tags as discussed. - Miguel ] Signed-off-by: Miguel Ojeda commit a075082a15e7f5c4889d0cbb51a4041c332cb00c Author: Benno Lossin Date: Mon Mar 2 15:04:14 2026 +0100 rust: pin-init: internal: init: remove `#[disable_initialized_field_access]` Gary noticed [1] that the initializer macros as well as the `[Pin]Init` traits cannot support unaligned fields, since they use operations that require aligned pointers. This means that any code using structs with unaligned fields in pin-init is unsound. By default, the `init!` macro generates references to initialized fields, which makes the compiler check that those fields are aligned. However, we added the `#[disable_initialized_field_access]` attribute to avoid this behavior in commit ceca298c53f9 ("rust: pin-init: internal: init: add escape hatch for referencing initialized fields"). Thus remove the `#[disable_initialized_field_access]` attribute from `init!`, which is the only safe way to create an initializer handling unaligned fields. If support for in-place initializing structs with unaligned fields is required in the future, we could figure out a solution. This is tracked in [2]. Reported-by: Gary Guo Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/561532-pin-init/topic/initialized.20field.20accessor.20detection/with/576210658 [1] Link: https://github.com/Rust-for-Linux/pin-init/issues/112 [2] Fixes: ceca298c53f9 ("rust: pin-init: internal: init: add escape hatch for referencing initialized fields") Signed-off-by: Benno Lossin Acked-by: Janne Grunau Reviewed-by: Gary Guo Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260302140424.4097655-1-lossin@kernel.org [ Adjusted tags and reworded as discussed. - Miguel ] Signed-off-by: Miguel Ojeda commit dda135077ecc9f15c407f094dcfe7800376be867 Author: Gary Guo Date: Thu Feb 26 15:21:11 2026 +0000 rust: build: remap path to avoid absolute path When building with an out directory (O=), absolute paths can end up in the file name in `#[track_caller]` or the panic message. This is not desirable as this leaks the exact path being used to build the kernel and means that the same location can appear in two forms (relative or absolute). This is reported by Asahi [1] and is being workaround in [2] previously to force everything to be absolute path. Using absolute path for everything solves the inconsistency, however it does not address the reproducibility issue. So, fix this by remap all absolute paths to srctree to relative path instead. This is previously attempted in commit dbdffaf50ff9 ("kbuild, rust: use -fremap-path-prefix to make paths relative") but that was reverted as remapping debug info causes some tool (e.g. objdump) to be unable to find sources. Therefore, use `--remap-path-scope` to only remap macros but leave debuginfo untouched. `--remap-path-scope` is only stable in Rust 1.95, so use `rustc-option` to detect its presence. This feature has been available as `-Zremap-path-scope` for all versions that we support; however due to bugs in the Rust compiler, it does not work reliably until 1.94. I opted to not enable it for 1.94 as it's just a single version that we missed. This change can be validated by building a kernel with O=, strip debug info on vmlinux, and then check if the absolute path exists in `strings vmlinux`, e.g. `strings vmlinux |grep \/home`. Reported-by: Janne Grunau Reported-by: Asahi Lina Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/Per-call-site.20data.20and.20lock.20class.20keys/near/572466559 [1] Link: https://github.com/AsahiLinux/linux/commit/54ab88878869036c9d6620101bfe17a81e88c2f9 [2] Signed-off-by: Gary Guo Acked-by: Nicolas Schier # kbuild Link: https://patch.msgid.link/20260226152112.3222886-1-gary@kernel.org [ Reworded for few typos. - Miguel ] Signed-off-by: Miguel Ojeda commit e174dd14bf0beac811a5201e370ab26ce8c67f23 Author: Gary Guo Date: Tue Feb 24 15:29:56 2026 +0800 rust: kbuild: emit dep-info into $(depfile) directly After commit 295d8398c67e ("kbuild: specify output names separately for each emission type from rustc"), the preferred pattern is to ask rustc to emit dependency information into $(depfile) directly, and after commit 2185242faddd ("kbuild: remove sed commands after rustc rules"), the post-processing to remove comments is no longer necessary as fixdep can handle comments directly. Thus, emit dep-info into $(depfile) directly and remove the mv and sed invocation. This fixes the issue where a non-ignored .d file is emitted during compilation and removed shortly afterwards. [ Like Gary mentioned in Zulip, this likely happened due to rebasing the builds part of the old `syn` work I had. - Miguel ] Reported-by: Onur Özkan Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/syn.20artifact.20being.20tracked.20by.20git/with/575467879 Fixes: 7dbe46c0b11d ("rust: kbuild: add proc macro library support") Signed-off-by: Gary Guo Tested-by: Onur Özkan Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260224072957.214979-1-gary@garyguo.net [ Reworded for a couple of typos. - Miguel ] Signed-off-by: Miguel Ojeda commit 4355b13d46f696d687f42b982efed7570e03e532 Author: Krzysztof Kozlowski Date: Wed Feb 25 18:34:20 2026 +0100 dt-bindings: display/msm: qcom,sm8750-mdss: Fix model typo Fix obvious model typo (SM8650->SM8750) in the description. Signed-off-by: Krzysztof Kozlowski Fixes: 6b93840116df ("dt-bindings: display/msm: qcom,sm8750-mdss: Add SM8750") Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/707192/ Link: https://lore.kernel.org/r/20260225173419.125565-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit fd941c787cbb402e8ebd84336f2a0026d5d0724d Author: Pengyu Luo Date: Thu Feb 26 20:29:57 2026 +0800 drm/msm/dsi/phy: fix hardware revision The hardware revision for TSMC 3nm-based Qualcomm SOCs should be 7.2, this can be confirmed from REG_DSI_7nm_PHY_CMN_REVISION_ID0, the value is 0x27, which means hardware revision is 7.2 No functional change. Fixes: 1337d7ebfb6d ("drm/msm/dsi/phy: Add support for SM8750") Suggested-by: Dmitry Baryshkov Signed-off-by: Pengyu Luo Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/707414/ Link: https://lore.kernel.org/r/20260226122958.22555-2-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov commit 7403e87c138475a74e5176176778f391d847f42d Author: Abel Vesa Date: Tue Mar 3 11:03:11 2026 +0200 dt-bindings: display: msm: Fix reg ranges and clocks on Glymur The Glymur platform has four DisplayPort controllers. The hardware supports four streams (MST) per controller. However, on Glymur the first three controllers only have two streams wired to the display subsystem, while the fourth controller operates in single-stream mode. Add a dedicated clause for the Glymur compatible to require the register ranges for all four stream blocks, while allowing either one pixel clock (for the single-stream controller) or two pixel clocks (for the remaining controllers). Update the Glymur MDSS schema example by adding the missing p2, p3, mst2link and mst3link register blocks. Without these, the bindings validation fails. Also replace the made-up register addresses with the actual addresses from the first controller to match the SoC devicetree description. Cc: stable@vger.kernel.org # v6.19 Fixes: 8f63bf908213 ("dt-bindings: display: msm: Document the Glymur DiplayPort controller") Fixes: 1aee577bbc60 ("dt-bindings: display: msm: Document the Glymur Mobile Display SubSystem") Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/708518/ Link: https://lore.kernel.org/r/20260303-glymur-fix-dp-bindings-reg-clocks-v4-1-1ebd9c7c2cee@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 4ce71cea574658f5c5c7412b1a3cc54efe4f9b50 Author: Abhinav Kumar Date: Thu Mar 5 18:17:07 2026 +0800 drm/msm/dpu: Correct the SA8775P intr_underrun/intr_underrun index The intr_underrun and intr_vsync indices have been swapped, just simply corrects them. Cc: stable@vger.kernel.org Fixes: b139c80d181c ("drm/msm/dpu: Add SA8775P support") Signed-off-by: Abhinav Kumar Signed-off-by: Yongxing Mou Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/709209/ Link: https://lore.kernel.org/r/20260305-mdss_catalog-v5-2-06678ac39ac7@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 7e459c41264fdd87b096ede8da796a302d569722 Author: Akhil P Oommen Date: Thu Mar 5 23:51:16 2026 +0530 drm/msm/a8xx: Fix ubwc config related to swizzling To disable l2/l3 swizzling in A8x, set the respective bits in both GRAS_NC_MODE_CNTL and RB_CCU_NC_MODE_CNTL registers. This is required for Glymur where it is recommended to keep l2/l3 swizzling disabled. Fixes: 288a93200892 ("drm/msm/adreno: Introduce A8x GPU Support") Signed-off-by: Akhil P Oommen Message-ID: <20260305-a8xx-ubwc-fix-v1-1-d99b6da4c5a9@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov Signed-off-by: Rob Clark commit 021f1b77f70d62351bba67b050b8d784641d817f Author: Rob Herring (Arm) Date: Wed Feb 18 16:21:57 2026 -0600 accel: ethosu: Handle possible underflow in IFM size calculations If the command stream has larger padding sizes than the IFM and OFM diminsions, then the calculations will underflow to a negative value. The result is a very large region bounds which is caught on submit, but it's better to catch it earlier. Current mesa ethosu driver has a signedness bug which resulted in padding of 127 (the max) and triggers this issue. Reviewed-and-Tested-by: Anders Roxell Link: https://patch.msgid.link/20260218-ethos-fixes-v1-3-be3fa3ea9a30@kernel.org Signed-off-by: Rob Herring (Arm) commit 838ae99f9a77a5724ee6d4e7b7b1eb079147f888 Author: Rob Herring (Arm) Date: Wed Feb 18 16:21:56 2026 -0600 accel: ethosu: Fix NPU_OP_ELEMENTWISE validation with scalar The NPU_OP_ELEMENTWISE instruction uses a scalar value for IFM2 if the IFM2_BROADCAST "scalar" mode is set. It is a bit (7) on the u65 and part of a field (bits 3:0) on the u85. The driver was hardcoded to the u85. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Reviewed-and-Tested-by: Anders Roxell Link: https://patch.msgid.link/20260218-ethos-fixes-v1-2-be3fa3ea9a30@kernel.org Signed-off-by: Rob Herring (Arm) commit 150bceb3e0a4a30950279d91ea0e8cc69a736742 Author: Rob Herring (Arm) Date: Wed Feb 18 16:21:55 2026 -0600 accel: ethosu: Fix job submit error clean-up refcount underflows If the job submit fails before adding the job to the scheduler queue such as when the GEM buffer bounds checks fail, then doing a ethosu_job_put() results in a pm_runtime_put_autosuspend() without the corresponding pm_runtime_resume_and_get(). The dma_fence_put()'s are also unnecessary, but seem to be harmless. Split the ethosu_job_cleanup() function into 2 parts for the before and after the job is queued. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Reviewed-and-Tested-by: Anders Roxell Link: https://patch.msgid.link/20260218-ethos-fixes-v1-1-be3fa3ea9a30@kernel.org Signed-off-by: Rob Herring (Arm) commit 78c2ce0fd6ddb6c87aaa56b0d49c70e17df21e6d Author: Paul E. McKenney Date: Tue Mar 3 15:59:03 2026 -0800 scftorture: Update due to x86 not supporting none/voluntary preemption As of v7.0-rc1, architectures that support preemption, including x86 and arm64, no longer support CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY. Attempting to build kernels with these two Kconfig options results in .config errors. This commit therefore switches such scftorture scenarios to CONFIG_PREEMPT_LAZY. Signed-off-by: Paul E. McKenney Signed-off-by: Boqun Feng Link: https://patch.msgid.link/20260303235903.1967409-4-paulmck@kernel.org commit 3c6ddb58f670baa584b22eef761aade77bd81b16 Author: Paul E. McKenney Date: Tue Mar 3 15:59:02 2026 -0800 refscale: Update due to x86 not supporting none/voluntary preemption As of v7.0-rc1, architectures that support preemption, including x86 and arm64, no longer support CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY. Attempting to build kernels with these two Kconfig options results in .config errors. This commit therefore switches such refscale scenarios to CONFIG_PREEMPT_LAZY. Signed-off-by: Paul E. McKenney Signed-off-by: Boqun Feng Link: https://patch.msgid.link/20260303235903.1967409-3-paulmck@kernel.org commit 59af2d5652e998fea64335de6145afb3c1e0c958 Author: Paul E. McKenney Date: Tue Mar 3 15:59:01 2026 -0800 rcuscale: Update due to x86 not supporting none/voluntary preemption As of v7.0-rc1, architectures that support preemption, including x86 and arm64, no longer support CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY. Attempting to build kernels with these two Kconfig options results in .config errors. This commit therefore switches such rcuscale scenarios to CONFIG_PREEMPT_LAZY. Signed-off-by: Paul E. McKenney Signed-off-by: Boqun Feng Link: https://patch.msgid.link/20260303235903.1967409-2-paulmck@kernel.org commit f2fa6cc736ef518628f6a9d1155f9ec24e0af4e7 Author: Paul E. McKenney Date: Wed Mar 4 16:01:19 2026 -0800 rcutorture: Update due to x86 not supporting none/voluntary preemption As of v7.0-rc1, architectures that support preemption, including x86 and arm64, no longer support CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY. Attempting to build kernels with these two Kconfig options results in .config errors. This commit therefore switches such rcutorture scenarios to CONFIG_PREEMPT_LAZY. Signed-off-by: Paul E. McKenney Reviewed-by: Joel Fernandes Signed-off-by: Boqun Feng Link: https://patch.msgid.link/bfe89f6c-3b63-40c6-aa6d-5f523e3e9a31@paulmck-laptop commit 0693907ffaca001036009bc82dc334fb8e11540f Author: Arnaldo Carvalho de Melo Date: Thu Mar 5 17:28:44 2026 -0300 tools headers UAPI: Update tools' copy of linux/coresight-pmu.h To get the comment changes in this commit: 171efc70097a9f5f ("x86/ibs: Fix typo in dc_l2tlb_miss comment") This silences this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/amd/ibs.h arch/x86/include/asm/amd/ibs.h Signed-off-by: Arnaldo Carvalho de Melo commit c9d77f0a0c78eacdf6bbac07c494205a2c3053b4 Author: Arnaldo Carvalho de Melo Date: Thu Mar 5 17:16:07 2026 -0300 tools headers: Update the syscall tables and unistd.h, to support the new 'rseq_slice_yield' syscall Picking up the changes from these csets: 2153b2e8917b73e9 ("sparc: Add architecture support for clone3") 99d2592023e5d0a3 ("rseq: Implement sys_rseq_slice_yield()") 4ac286c4a8d904c8 ("s390/syscalls: Switch to generic system call table generation") This makes 'perf trace' support it, now its possible, for instance, to do: # perf trace -e rseq_slice_yield --max-stack=16 Here is an example with the 'sendmmsg' syscall: root@x1:~# perf trace -e sendmmsg --max-stack 16 --max-events=1 0.000 ( 0.062 ms): dbus-broker/1012 sendmmsg(fd: 150, mmsg: 0x7ffef57cca50, vlen: 1, flags: DONTWAIT|NOSIGNAL) = 1 syscall_exit_to_user_mode_prepare ([kernel.kallsyms]) syscall_exit_to_user_mode_prepare ([kernel.kallsyms]) syscall_exit_to_user_mode ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64 ([kernel.kallsyms]) [0x117ce7] (/usr/lib64/libc.so.6 (deleted)) root@x1:~# To do a system wide tracing of the new 'rseq_slice_yield' syscall with a backtrace of at most 16 entries. This addresses these perf tools build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h diff -u tools/scripts/syscall.tbl scripts/syscall.tbl diff -u tools/perf/arch/x86/entry/syscalls/syscall_32.tbl arch/x86/entry/syscalls/syscall_32.tbl diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl diff -u tools/perf/arch/powerpc/entry/syscalls/syscall.tbl arch/powerpc/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/s390/entry/syscalls/syscall.tbl arch/s390/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/mips/entry/syscalls/syscall_n64.tbl arch/mips/kernel/syscalls/syscall_n64.tbl diff -u tools/perf/arch/arm/entry/syscalls/syscall.tbl arch/arm/tools/syscall.tbl diff -u tools/perf/arch/sh/entry/syscalls/syscall.tbl arch/sh/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/sparc/entry/syscalls/syscall.tbl arch/sparc/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/xtensa/entry/syscalls/syscall.tbl arch/xtensa/kernel/syscalls/syscall.tbl Cc: Andreas Larsson Cc: Heiko Carstens Cc: Ludwig Rydberg Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit 5ee8dbf54602dc340d6235b1d6aa17c0f283f48c Merge: 6a42ff33f38d17 a300000233a9ff Author: Linus Torvalds Date: Thu Mar 5 11:52:03 2026 -0800 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity fix from Eric Biggers: "Prevent CONFIG_FS_VERITY from being enabled when the page size is 256K, since it doesn't work in that case" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fsverity: add dependency on 64K or smaller pages commit b3ce769203a99d6f3c6d6269ec09232a8c5da422 Author: Peter Collingbourne Date: Wed Mar 4 11:06:12 2026 -0800 perf disasm: Fix off-by-one bug in outside check If a branch target points to one past the end of a function, the branch should be treated as a branch to another function. This can happen e.g. with a tail call to a function that is laid out immediately after the caller. Fixes: 751b1783da784299 ("perf annotate: Mark jumps to outher functions with the call arrow") Reviewed-by: Ian Rogers Signed-off-by: Peter Collingbourne Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Bill Wendling Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Mark Rutland Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Link: https://linux-review.googlesource.com/id/Ide471112e82d68177e0faf08ca411d9fcf0a7bdf Signed-off-by: Arnaldo Carvalho de Melo commit 1e972ec76e10cf9cdacf1db2fbf69f7216903a86 Author: Arnaldo Carvalho de Melo Date: Wed Mar 4 17:22:20 2026 -0300 tools arch x86: Sync msr-index.h to pick MSR_{OMR_[0-3],CORE_PERF_GLOBAL_STATUS_SET} To pick up the changes in: 4e955c08d6dc76fb ("perf/x86/intel: Support the 4 new OMR MSRs introduced in DMR and NVL") 736a2dcfdae72483 ("x86/CPU/AMD: Simplify the spectral chicken fix") 56bb2736975068cc ("KVM: x86/pmu: Load/put mediated PMU context when entering/exiting guest") Addressing this tools/perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h That makes the beautification scripts to pick some new entries: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before.txt $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after.txt $ diff -u before.txt after.txt --- before.txt 2026-03-04 17:21:39.165956041 -0300 +++ after.txt 2026-03-04 17:21:52.479191640 -0300 @@ -130,6 +130,11 @@ [0x0000038e] = "CORE_PERF_GLOBAL_STATUS", [0x0000038f] = "CORE_PERF_GLOBAL_CTRL", [0x00000390] = "CORE_PERF_GLOBAL_OVF_CTRL", + [0x00000391] = "CORE_PERF_GLOBAL_STATUS_SET", + [0x000003e0] = "OMR_0", + [0x000003e1] = "OMR_1", + [0x000003e2] = "OMR_2", + [0x000003e3] = "OMR_3", [0x000003f1] = "IA32_PEBS_ENABLE", [0x000003f2] = "PEBS_DATA_CFG", [0x000003f4] = "IA32_PEBS_BASE", $ Now one can use those strings in 'perf trace' to do filtering, e.g.: # perf trace -e msr:*_msr/max-stack=32/ --filter="msr==CORE_PERF_GLOBAL_STATUS_SET" Cc: Borislav Petkov (AMD) Cc: Dapeng Mi Cc: Peter Zijlstra Cc: Sean Christopherson Signed-off-by: Arnaldo Carvalho de Melo commit 6a42ff33f38d171a6bf8304f6323c43e8a0ed9b6 Merge: 398871616ffd8a 3875ceb592d3cb Author: Linus Torvalds Date: Thu Mar 5 11:49:05 2026 -0800 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: - Several test fixes: - Fix flakiness in the interrupt context tests in certain VMs - Make the lib/crypto/ KUnit tests depend on the corresponding library options rather than selecting them. This follows the standard KUnit convention, and it fixes an issue where enabling CONFIG_KUNIT_ALL_TESTS pulled in all the crypto library code - Add a kunitconfig file for lib/crypto/ - Fix a couple stale references to "aes-generic" that made it in concurrently with the rename to "aes-lib" - Update the help text for several CRYPTO kconfig options to remove outdated information about users that now use the library instead * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: crypto: testmgr - Fix stale references to aes-generic crypto: Clean up help text for CRYPTO_CRC32 crypto: Clean up help text for CRYPTO_CRC32C crypto: Clean up help text for CRYPTO_XXHASH crypto: Clean up help text for CRYPTO_SHA256 crypto: Clean up help text for CRYPTO_BLAKE2B lib/crypto: tests: Add a .kunitconfig file lib/crypto: tests: Depend on library options rather than selecting them kunit: irq: Ensure timer doesn't fire too frequently commit 398871616ffd8a793f01861b0ee66f6bee494389 Merge: abacaf559950ee 084f843093bee5 Author: Linus Torvalds Date: Thu Mar 5 11:37:27 2026 -0800 Merge tag 'acpi-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fixes from Rafael Wysocki: - Revert a commit related to ACPI device power management that was not supposed to make any functional difference, but it did so and introduced a regression (Rafael Wysocki) - Update the _CPC object definition in ACPICA to match ACPI 6.6 and prevent the kernel from printing a false-positive warning regarding _CPC output package format on platforms shipping with firmware based on ACPI 6.6 (Saket Dumbre) * tag 'acpi-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM" ACPICA: Update the _CPC definition to match ACPI 6.6 commit abacaf559950eec0d99d37ff6b92049409af5943 Merge: 18ecff396c9edb cf440e5b40649d Author: Linus Torvalds Date: Thu Mar 5 11:00:46 2026 -0800 Merge tag 'net-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from CAN, netfilter and wireless. Current release - new code bugs: - sched: cake: fixup cake_mq rate adjustment for diffserv config - wifi: fix missing ieee80211_eml_params member initialization Previous releases - regressions: - tcp: give up on stronger sk_rcvbuf checks (for now) Previous releases - always broken: - net: fix rcu_tasks stall in threaded busypoll - sched: - fq: clear q->band_pkt_count[] in fq_reset() - only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - bridge: check relevant per-VLAN options in VLAN range grouping - xsk: fix fragment node deletion to prevent buffer leak Misc: - spring cleanup of inactive maintainers" * tag 'net-7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (138 commits) xdp: produce a warning when calculated tailroom is negative net: enetc: use truesize as XDP RxQ info frag_size libeth, idpf: use truesize as XDP RxQ info frag_size i40e: use xdp.frame_sz as XDP RxQ info frag_size i40e: fix registering XDP RxQ info ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz ice: fix rxq info registering in mbuf packets xsk: introduce helper to determine rxq->frag_size xdp: use modulo operation to calculate XDP frag tailroom selftests/tc-testing: Add tests exercising act_ife metalist replace behaviour net/sched: act_ife: Fix metalist update behavior selftests: net: add test for IPv4 route with loopback IPv6 nexthop net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled MAINTAINERS: remove Thomas Falcon from IBM ibmvnic MAINTAINERS: remove Claudiu Manoil and Alexandre Belloni from Ocelot switch MAINTAINERS: replace Taras Chornyi with Elad Nachman for Marvell Prestera MAINTAINERS: remove Jonathan Lemon from OpenCompute PTP MAINTAINERS: replace Clark Wang with Frank Li for Freescale FEC ... commit 084f843093bee5563b179fd4b630122ba820e0c7 Merge: 00fd9aad55e7ce 800ca7b88a0c0e Author: Rafael J. Wysocki Date: Thu Mar 5 18:46:43 2026 +0100 Merge branch 'acpica' Merge a fix updating the _CPC object definition in ACPICA to avoid printing a false-positive output package format warning on new platforms (Saket Dumbre) * acpica: ACPICA: Update the _CPC definition to match ACPI 6.6 commit 9f2c7349b2810c671badfc1adc804f711a83e420 Author: Dave Hansen Date: Thu Mar 5 09:18:52 2026 -0800 MAINTAINERS: Orphan Altera PCIe controller driver Email to Joyce Ooi now bounces. Remove the address and mark the Altera PCIe controller driver as an orphan for now. Signed-off-by: Dave Hansen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260305171852.3114177-1-dave.hansen@linux.intel.com commit 9e83d5104a70d8545bad61a77e166190d9447e1d Author: Breno Leitao Date: Thu Mar 5 08:15:41 2026 -0800 workqueue: Add stall detector sample module Add a sample module under samples/workqueue/stall_detector/ that reproduces a workqueue stall caused by PF_WQ_WORKER misuse. The module queues two work items on the same per-CPU pool, then clears PF_WQ_WORKER and sleeps in wait_event_idle(), hiding from the concurrency manager and stalling the second work item indefinitely. This is useful for testing the workqueue watchdog stall diagnostics. Signed-off-by: Breno Leitao Acked-by: Song Liu Signed-off-by: Tejun Heo commit 8823eaef45da7f156a1396f40d53b985c511edef Author: Breno Leitao Date: Thu Mar 5 08:15:40 2026 -0800 workqueue: Show all busy workers in stall diagnostics show_cpu_pool_hog() only prints workers whose task is currently running on the CPU (task_is_running()). This misses workers that are busy processing a work item but are sleeping or blocked — for example, a worker that clears PF_WQ_WORKER and enters wait_event_idle(). Such a worker still occupies a pool slot and prevents progress, yet produces an empty backtrace section in the watchdog output. This is happening on real arm64 systems, where toggle_allocation_gate() IPIs every single CPU in the machine (which lacks NMI), causing workqueue stalls that show empty backtraces because toggle_allocation_gate() is sleeping in wait_event_idle(). Remove the task_is_running() filter so every in-flight worker in the pool's busy_hash is dumped. The busy_hash is protected by pool->lock, which is already held. Signed-off-by: Breno Leitao Acked-by: Song Liu Signed-off-by: Tejun Heo commit e8e14ac7cfe437b896838e7f7d07c573965b4e4e Author: Breno Leitao Date: Thu Mar 5 08:15:39 2026 -0800 workqueue: Show in-flight work item duration in stall diagnostics When diagnosing workqueue stalls, knowing how long each in-flight work item has been executing is valuable. Add a current_start timestamp (jiffies) to struct worker, set it when a work item begins execution in process_one_work(), and print the elapsed wall-clock time in show_pwq(). Unlike current_at (which tracks CPU runtime and resets on wakeup for CPU-intensive detection), current_start is never reset because the diagnostic cares about total wall-clock time including sleeps. Before: in-flight: 165:stall_work_fn [wq_stall] After: in-flight: 165:stall_work_fn [wq_stall] for 100s Signed-off-by: Breno Leitao Acked-by: Song Liu Signed-off-by: Tejun Heo commit 6037160e52d72028da68546fd270a7dcac130d85 Author: Breno Leitao Date: Thu Mar 5 08:15:38 2026 -0800 workqueue: Rename pool->watchdog_ts to pool->last_progress_ts The watchdog_ts name doesn't convey what the timestamp actually tracks. This field tracks the last time a workqueue got progress. Rename it to last_progress_ts to make it clear that it records when the pool last made forward progress (started processing new work items). No functional change. Signed-off-by: Breno Leitao Acked-by: Song Liu Signed-off-by: Tejun Heo commit f42f9091be9e5ff57567a3945cfcdd498f475348 Author: Breno Leitao Date: Thu Mar 5 08:15:37 2026 -0800 workqueue: Use POOL_BH instead of WQ_BH when checking pool flags pr_cont_worker_id() checks pool->flags against WQ_BH, which is a workqueue-level flag (defined in workqueue.h). Pool flags use a separate namespace with POOL_* constants (defined in workqueue.c). The correct constant is POOL_BH. Both WQ_BH and POOL_BH are defined as (1 << 0) so this has no behavioral impact, but it is semantically wrong and inconsistent with every other pool-level BH check in the file. Fixes: 4cb1ef64609f ("workqueue: Implement BH workqueues to eventually replace tasklets") Signed-off-by: Breno Leitao Acked-by: Song Liu Signed-off-by: Tejun Heo commit d5b8b0347fa8470b751a506fb801797e271d7548 Author: Lizhi Hou Date: Wed Mar 4 22:20:41 2026 -0800 accel/amdxdna: Split mailbox channel create function The management channel used for firmware control command submission is currently created after the firmware is started. If channel creation fails (for example, due to memory allocation failure or workqueue creation interruption), the firmware remains in a pending state and is unable to receive any control commands. To avoid leaving the firmware in this inconsistent state, split xdna_mailbox_create_channel() into two separate functions so that resource allocation can be completed before interacting with the hardware. xdna_mailbox_alloc_channel() Allocates memory and initializes the workqueue. This can be called earlier, before interacting with the hardware. xdna_mailbox_start_channel() Performs the hardware interaction required to start the channel. Rename xdna_mailbox_destroy_channel() to xdna_mailbox_free_channel(). Ensure that xdna_mailbox_stop_channel() and xdna_mailbox_free_channel() properly unwind the corresponding start and allocation steps, respectively. Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260305062041.3954024-1-lizhi.hou@amd.com commit 97e4567d39941248579da34b7fbb568e6659511e Author: Peng Fan Date: Sun Feb 8 19:30:35 2026 +0800 remoteproc: imx_rproc: Fix unreachable platform prepare_ops Smatch reports unreachable code in imx_rproc_prepare(), where an early return inside the reserved-memory parsing loop prevents platform prepare_ops from being executed. When of_reserved_mem_region_to_resource() fails, imx_rproc_prepare() returns immediately, so the platform-specific prepare callback is never called. As a result, prepare_ops such as imx_rproc_sm_lmm_prepare() on i.MX95 have no chance to run. This is problematic when Linux controls the M7 Logical Machine and is responsible for preparing resources such as TCM. Without running the platform prepare callback, loading the M7 ELF into TCM may fail if the bootloader did not power up and initialize TCM. Fix this by breaking out of the reserved-memory loop instead of returning, allowing the platform prepare_ops to be executed as intended. Fixes: edd2a9956055 ("remoteproc: imx_rproc: Introduce prepare ops for imx_rproc_dcfg") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-remoteproc/aYYXAa2Fj36XG4yQ@p14s/T/#t Signed-off-by: Peng Fan Reviewed-by: Daniel Baluta Link: https://lore.kernel.org/r/20260208-imx-rproc-fix-v1-1-ad74555eb9a4@nxp.com Signed-off-by: Mathieu Poirier commit 35c3f72a2d55dbf52f28f4ecae51c76be1acf545 Author: Tzung-Bi Shih Date: Fri Feb 6 03:30:33 2026 +0000 remoteproc: mediatek: Unprepare SCP clock during system suspend Prior to commit d935187cfb27 ("remoteproc: mediatek: Break lock dependency to prepare_lock"), `scp->clk` was prepared and enabled only when it needs to communicate with the SCP. The commit d935187cfb27 moved the prepare operation to remoteproc's prepare(), keeping the clock prepared as long as the SCP is running. The power consumption due to the prolonged clock preparation can be negligible when the system is running, as SCP is designed to be a very power efficient processor. However, the clock remains prepared even when the system enters system suspend. This prevents the underlying clock controller (and potentially the parent PLLs) from shutting down, which increases power consumption and may block the system from entering deep sleep states. Add suspend and resume callbacks. Unprepare the clock in suspend() if it was active and re-prepare it in resume() to ensure the clock is properly disabled during system suspend, while maintaining the "always prepared" semantics while the system is active. The driver doesn't implement .attach() callback, hence it only checks for RPROC_RUNNING. Fixes: d935187cfb27 ("remoteproc: mediatek: Break lock dependency to prepare_lock") Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260206033034.3031781-1-tzungbi@kernel.org Signed-off-by: Mathieu Poirier commit 76e8173ba92e15eeb0421b7cdbaef20513193b51 Author: Akash Goel Date: Thu Mar 5 11:07:23 2026 +0000 drm/panthor: Correct the order of arguments passed to gem_sync This commit corrects the order of arguments passed to panthor_gem_sync() function, called when the SYNC_WAIT condition has to be evaluated for a blocked GPU queue. Fixes: cd2c9c3015e6 ("drm/panthor: Add flag to map GEM object Write-Back Cacheable") Signed-off-by: Akash Goel Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Reviewed-by: Liviu Dudau Link: https://patch.msgid.link/20260305110723.2871733-1-akash.goel@arm.com Signed-off-by: Liviu Dudau commit e31a374a99f5026df6ebff2a1c49492276e776fd Author: Helge Deller Date: Wed Mar 4 19:15:48 2026 +0100 fbdev: au1100fb: Fix build on MIPS64 Fix an error reported by the kernel test robot: au1100fb.c: error: implicit declaration of function 'KSEG1ADDR'; did you mean 'CKSEG1ADDR'? arch/mips/include/asm/addrspace.h defines KSEG1ADDR only for 32 bit configurations. So provide its compile-test stub also for 64bit mips builds. Fixes: 6f366e86481a ("fbdev: au1100fb: Make driver compilable on non-mips platforms") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202603042127.PT6LuKqi-lkp@intel.com/ Signed-off-by: Helge Deller Acked-by: Uwe Kleine-König commit e07fc9e2da91f6d9eeafa2961be9dc09d65ed633 Author: Fuad Tabba Date: Wed Mar 4 16:22:21 2026 +0000 KVM: arm64: Fix page leak in user_mem_abort() on atomic fault When a guest performs an atomic/exclusive operation on memory lacking the required attributes, user_mem_abort() injects a data abort and returns early. However, it fails to release the reference to the host page acquired via __kvm_faultin_pfn(). A malicious guest could repeatedly trigger this fault, leaking host page references and eventually causing host memory exhaustion (OOM). Fix this by consolidating the early error returns to a new out_put_page label that correctly calls kvm_release_page_unused(). Fixes: 2937aeec9dc5 ("KVM: arm64: Handle DABT caused by LS64* instructions on unsupported memory") Signed-off-by: Fuad Tabba Reviewed-by: Yuan Yao Link: https://patch.msgid.link/20260304162222.836152-2-tabba@google.com Signed-off-by: Marc Zyngier commit 8457669db968c98edb781892d73fa559e1efcbd4 Merge: 3d543d9515928e 325291b20f8a6f Author: Takashi Iwai Date: Thu Mar 5 17:22:14 2026 +0100 Merge tag 'asoc-fix-v7.0-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.0 A moderately large pile of fixes, though none of them are super major, plus a few new quirks and device IDs. commit 70f54f61a3d52af13b72248a63e98eddf4c990ac Author: Andrea Righi Date: Thu Mar 5 07:29:00 2026 +0100 sched_ext: Document task ownership state machine The task ownership state machine in sched_ext is quite hard to follow from the code alone. The interaction of ownership states, memory ordering rules and cross-CPU "lock dancing" makes the overall model subtle. Extend the documentation next to scx_ops_state to provide a more structured and self-contained description of the state transitions and their synchronization rules. The new reference should make the code easier to reason about and maintain and can help future contributors understand the overall task-ownership workflow. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 0927780c90ce551869fb692279d66387a4b66af5 Author: zhidao su Date: Thu Mar 5 14:18:56 2026 +0800 sched_ext: Use READ_ONCE() for lock-free reads of module param variables bypass_lb_cpu() reads scx_bypass_lb_intv_us and scx_slice_bypass_us without holding any lock, in timer callback context where module parameter writes via sysfs can happen concurrently: min_delta_us = scx_bypass_lb_intv_us / SCX_BYPASS_LB_MIN_DELTA_DIV; ^^^^^^^^^^^^^^^^^^^^ plain read -- KCSAN data race if (delta < DIV_ROUND_UP(min_delta_us, scx_slice_bypass_us)) ^^^^^^^^^^^^^^^^^ plain read -- KCSAN data race scx_bypass_lb_intv_us already uses READ_ONCE() in scx_bypass_lb_timerfn() and scx_bypass() for its other lock-free read sites, leaving bypass_lb_cpu() inconsistent. scx_slice_bypass_us has the same lock-free access pattern in the same function. Fix both plain reads by using READ_ONCE() to complete the concurrent access annotation and make the code KCSAN-clean. Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 18ecff396c9edb9add34f612d9fb99bb34833cc0 Merge: c107785c7e8dba f26b098d937488 Author: Linus Torvalds Date: Thu Mar 5 08:05:05 2026 -0800 Merge tag 'trace-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix thresh_return of function graph tracer The update to store data on the shadow stack removed the abuse of using the task recursion word as a way to keep track of what functions to ignore. The trace_graph_return() was updated to handle this, but when function_graph tracer is using a threshold (only trace functions that took longer than a specified time), it uses trace_graph_thresh_return() instead. This function was still incorrectly using the task struct recursion word causing the function graph tracer to permanently set all functions to "notrace" - Fix thresh_return nosleep accounting When the calltime was moved to the shadow stack storage instead of being on the fgraph descriptor, the calculations for the amount of sleep time was updated. The calculation was done in the trace_graph_thresh_return() function, which also called the trace_graph_return(), which did the calculation again, causing the time to be doubled. Remove the call to trace_graph_return() as what it needed to do wasn't that much, and just do the work in trace_graph_thresh_return(). - Fix syscall trace event activation on boot up The syscall trace events are pseudo events attached to the raw_syscall tracepoints. When the first syscall event is enabled, it enables the raw_syscall tracepoint and doesn't need to do anything when a second syscall event is also enabled. When events are enabled via the kernel command line, syscall events are partially enabled as the enabling is called before rcu_init. This is due to allow early events to be enabled immediately. Because kernel command line events do not distinguish between different types of events, the syscall events are enabled here but are not fully functioning. After rcu_init, they are disabled and re-enabled so that they can be fully enabled. The problem happened is that this "disable-enable" is done one at a time. If more than one syscall event is specified on the command line, by disabling them one at a time, the counter never gets to zero, and the raw_syscall is not disabled and enabled, keeping the syscall events in their non-fully functional state. Instead, disable all events and re-enabled them all, as that will ensure the raw_syscall event is also disabled and re-enabled. - Disable preemption in ftrace pid filtering The ftrace pid filtering attaches to the fork and exit tracepoints to add or remove pids that should be traced. They access variables protected by RCU (preemption disabled). Now that tracepoint callbacks are called with preemption enabled, this protection needs to be added explicitly, and not depend on the functions being called with preemption disabled. - Disable preemption in event pid filtering The event pid filtering needs the same preemption disabling guards as ftrace pid filtering. - Fix accounting of the memory mapped ring buffer on fork Memory mapping the ftrace ring buffer sets the vm_flags to DONTCOPY. But this does not prevent the application from calling madvise(MADVISE_DOFORK). This causes the mapping to be copied on fork. After the first tasks exits, the mapping is considered unmapped by everyone. But when he second task exits, the counter goes below zero and triggers a WARN_ON. Since nothing prevents two separate tasks from mmapping the ftrace ring buffer (although two mappings may mess each other up), there's no reason to stop the memory from being copied on fork. Update the vm_operations to have an ".open" handler to update the accounting and let the ring buffer know someone else has it mapped. - Add all ftrace headers in MAINTAINERS file The MAINTAINERS file only specifies include/linux/ftrace.h But misses ftrace_irq.h and ftrace_regs.h. Make the file use wildcards to get all *ftrace* files. * tag 'trace-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Add MAINTAINERS entries for all ftrace headers tracing: Fix WARN_ON in tracing_buffers_mmap_close tracing: Disable preemption in the tracepoint callbacks handling filtered pids ftrace: Disable preemption in the tracepoint callbacks handling filtered pids tracing: Fix syscall events activation by ensuring refcount hits zero fgraph: Fix thresh_return nosleeptime double-adjust fgraph: Fix thresh_return clear per-task notrace commit cf440e5b40649d1ffbc6c4e33fef3223c7482897 Merge: 5d1271ff4c131c 8821e857759be9 Author: Jakub Kicinski Date: Thu Mar 5 08:02:27 2026 -0800 Merge branch 'Address-XDP-frags-having-negative-tailroom' Larysa Zaremba says: ==================== Address XDP frags having negative tailroom Aside from the issue described below, tailroom calculation does not account for pages being split between frags, e.g. in i40e, enetc and AF_XDP ZC with smaller chunks. These series address the problem by calculating modulo (skb_frag_off() % rxq->frag_size) in order to get data offset within a smaller block of memory. Please note, xskxceiver tail grow test passes without modulo e.g. in xdpdrv mode on i40e, because there is not enough descriptors to get to flipped buffers. Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, namely bpf_xdp_frags_increase_tail(), clearly expects a truesize. Such difference leads to unspecific memory corruption issues under certain circumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when running xskxceiver's XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses all DMA-writable space in 2 buffers. This would be fine, if only rxq->frag_size was properly set to 4K, but value of 3K results in a negative tailroom, because there is a non-zero page offset. We are supposed to return -EINVAL and be done with it in such case, but due to tailroom being stored as an unsigned int, it is reported to be somewhere near UINT_MAX, resulting in a tail being grown, even if the requested offset is too much(it is around 2K in the abovementioned test). This later leads to all kinds of unspecific calltraces. [ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6 [ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4 [ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000] [ 7340.339230] in xskxceiver[42b5,400000+69000] [ 7340.340300] likely on CPU 6 (core 0, socket 6) [ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 <4c> 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe [ 7340.340888] likely on CPU 3 (core 0, socket 3) [ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff <8b> 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7 [ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI [ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy) [ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 [ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80 [ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 <8b> 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89 [ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202 [ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010 [ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff [ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0 [ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0 [ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500 [ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000 [ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0 [ 7340.421237] PKRU: 55555554 [ 7340.421623] Call Trace: [ 7340.421987] [ 7340.422309] ? softleaf_from_pte+0x77/0xa0 [ 7340.422855] swap_pte_batch+0xa7/0x290 [ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270 [ 7340.424102] zap_pte_range+0x281/0x580 [ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240 [ 7340.425177] unmap_page_range+0x24d/0x420 [ 7340.425714] unmap_vmas+0xa1/0x180 [ 7340.426185] exit_mmap+0xe1/0x3b0 [ 7340.426644] __mmput+0x41/0x150 [ 7340.427098] exit_mm+0xb1/0x110 [ 7340.427539] do_exit+0x1b2/0x460 [ 7340.427992] do_group_exit+0x2d/0xc0 [ 7340.428477] get_signal+0x79d/0x7e0 [ 7340.428957] arch_do_signal_or_restart+0x34/0x100 [ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0 [ 7340.430159] do_syscall_64+0x188/0x6b0 [ 7340.430672] ? __do_sys_clone3+0xd9/0x120 [ 7340.431212] ? switch_fpu_return+0x4e/0xd0 [ 7340.431761] ? arch_exit_to_user_mode_prepare.isra.0+0xa1/0xc0 [ 7340.432498] ? do_syscall_64+0xbb/0x6b0 [ 7340.433015] ? __handle_mm_fault+0x445/0x690 [ 7340.433582] ? count_memcg_events+0xd6/0x210 [ 7340.434151] ? handle_mm_fault+0x212/0x340 [ 7340.434697] ? do_user_addr_fault+0x2b4/0x7b0 [ 7340.435271] ? clear_bhb_loop+0x30/0x80 [ 7340.435788] ? clear_bhb_loop+0x30/0x80 [ 7340.436299] ? clear_bhb_loop+0x30/0x80 [ 7340.436812] ? clear_bhb_loop+0x30/0x80 [ 7340.437323] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 7340.437973] RIP: 0033:0x7f4161b14169 [ 7340.438468] Code: Unable to access opcode bytes at 0x7f4161b1413f. [ 7340.439242] RSP: 002b:00007ffc6ebfa770 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 7340.440173] RAX: fffffffffffffe00 RBX: 00000000000005a1 RCX: 00007f4161b14169 [ 7340.441061] RDX: 00000000000005a1 RSI: 0000000000000109 RDI: 00007f415bfff990 [ 7340.441943] RBP: 00007ffc6ebfa7a0 R08: 0000000000000000 R09: 00000000ffffffff [ 7340.442824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 7340.443707] R13: 0000000000000000 R14: 00007f415bfff990 R15: 00007f415bfff6c0 [ 7340.444586] [ 7340.444922] Modules linked in: rfkill intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit libnvdimm kvm_intel vfat fat kvm snd_pcm irqbypass rapl iTCO_wdt snd_timer intel_pmc_bxt iTCO_vendor_support snd ixgbevf virtio_net soundcore i2c_i801 pcspkr libeth_xdp net_failover i2c_smbus lpc_ich failover libeth virtio_balloon joydev 9p fuse loop zram lz4hc_compress lz4_compress 9pnet_virtio 9pnet netfs ghash_clmulni_intel serio_raw qemu_fw_cfg [ 7340.449650] ---[ end trace 0000000000000000 ]--- The issue can be fixed in all in-tree drivers, but we cannot just trust OOT drivers to not do this. Therefore, make tailroom a signed int and produce a warning when it is negative to prevent such mistakes in the future. The issue can also be easily reproduced with ice driver, by applying the following diff to xskxceiver and enjoying a kernel panic in xdpdrv mode: diff --git a/tools/testing/selftests/bpf/prog_tests/test_xsk.c b/tools/testing/selftests/bpf/prog_tests/test_xsk.c index 5af28f359cfd..042d587fa7ef 100644 --- a/tools/testing/selftests/bpf/prog_tests/test_xsk.c +++ b/tools/testing/selftests/bpf/prog_tests/test_xsk.c @@ -2541,8 +2541,8 @@ int testapp_adjust_tail_grow_mb(struct test_spec *test) { test->mtu = MAX_ETH_JUMBO_SIZE; /* Grow by (frag_size - last_frag_Size) - 1 to stay inside the last fragment */ - return testapp_adjust_tail(test, (XSK_UMEM__MAX_FRAME_SIZE / 2) - 1, - XSK_UMEM__LARGE_FRAME_SIZE * 2); + return testapp_adjust_tail(test, XSK_UMEM__MAX_FRAME_SIZE * 100, + 6912); } int testapp_tx_queue_consumer(struct test_spec *test) If we print out the values involved in the tailroom calculation: tailroom = rxq->frag_size - skb_frag_size(frag) - skb_frag_off(frag); 4294967040 = 3456 - 3456 - 256 I personally reproduced and verified the issue in ice and i40e, aside from WiP ixgbevf implementation. ==================== Link: https://patch.msgid.link/20260305111253.2317394-1-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit 8821e857759be9db3cde337ad328b71fe5c8a55f Author: Larysa Zaremba Date: Thu Mar 5 12:12:50 2026 +0100 xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, namely bpf_xdp_frags_increase_tail(), clearly expects a truesize. Such difference leads to unspecific memory corruption issues under certain circumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when running xskxceiver's XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses all DMA-writable space in 2 buffers. This would be fine, if only rxq->frag_size was properly set to 4K, but value of 3K results in a negative tailroom, because there is a non-zero page offset. We are supposed to return -EINVAL and be done with it in such case, but due to tailroom being stored as an unsigned int, it is reported to be somewhere near UINT_MAX, resulting in a tail being grown, even if the requested offset is too much (it is around 2K in the abovementioned test). This later leads to all kinds of unspecific calltraces. [ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6 [ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4 [ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000] [ 7340.339230] in xskxceiver[42b5,400000+69000] [ 7340.340300] likely on CPU 6 (core 0, socket 6) [ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 <4c> 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe [ 7340.340888] likely on CPU 3 (core 0, socket 3) [ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff <8b> 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7 [ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI [ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy) [ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 [ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80 [ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 <8b> 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89 [ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202 [ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010 [ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff [ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0 [ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0 [ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500 [ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000 [ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0 [ 7340.421237] PKRU: 55555554 [ 7340.421623] Call Trace: [ 7340.421987] [ 7340.422309] ? softleaf_from_pte+0x77/0xa0 [ 7340.422855] swap_pte_batch+0xa7/0x290 [ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270 [ 7340.424102] zap_pte_range+0x281/0x580 [ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240 [ 7340.425177] unmap_page_range+0x24d/0x420 [ 7340.425714] unmap_vmas+0xa1/0x180 [ 7340.426185] exit_mmap+0xe1/0x3b0 [ 7340.426644] __mmput+0x41/0x150 [ 7340.427098] exit_mm+0xb1/0x110 [ 7340.427539] do_exit+0x1b2/0x460 [ 7340.427992] do_group_exit+0x2d/0xc0 [ 7340.428477] get_signal+0x79d/0x7e0 [ 7340.428957] arch_do_signal_or_restart+0x34/0x100 [ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0 [ 7340.430159] do_syscall_64+0x188/0x6b0 [ 7340.430672] ? __do_sys_clone3+0xd9/0x120 [ 7340.431212] ? switch_fpu_return+0x4e/0xd0 [ 7340.431761] ? arch_exit_to_user_mode_prepare.isra.0+0xa1/0xc0 [ 7340.432498] ? do_syscall_64+0xbb/0x6b0 [ 7340.433015] ? __handle_mm_fault+0x445/0x690 [ 7340.433582] ? count_memcg_events+0xd6/0x210 [ 7340.434151] ? handle_mm_fault+0x212/0x340 [ 7340.434697] ? do_user_addr_fault+0x2b4/0x7b0 [ 7340.435271] ? clear_bhb_loop+0x30/0x80 [ 7340.435788] ? clear_bhb_loop+0x30/0x80 [ 7340.436299] ? clear_bhb_loop+0x30/0x80 [ 7340.436812] ? clear_bhb_loop+0x30/0x80 [ 7340.437323] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 7340.437973] RIP: 0033:0x7f4161b14169 [ 7340.438468] Code: Unable to access opcode bytes at 0x7f4161b1413f. [ 7340.439242] RSP: 002b:00007ffc6ebfa770 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 7340.440173] RAX: fffffffffffffe00 RBX: 00000000000005a1 RCX: 00007f4161b14169 [ 7340.441061] RDX: 00000000000005a1 RSI: 0000000000000109 RDI: 00007f415bfff990 [ 7340.441943] RBP: 00007ffc6ebfa7a0 R08: 0000000000000000 R09: 00000000ffffffff [ 7340.442824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 7340.443707] R13: 0000000000000000 R14: 00007f415bfff990 R15: 00007f415bfff6c0 [ 7340.444586] [ 7340.444922] Modules linked in: rfkill intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit libnvdimm kvm_intel vfat fat kvm snd_pcm irqbypass rapl iTCO_wdt snd_timer intel_pmc_bxt iTCO_vendor_support snd ixgbevf virtio_net soundcore i2c_i801 pcspkr libeth_xdp net_failover i2c_smbus lpc_ich failover libeth virtio_balloon joydev 9p fuse loop zram lz4hc_compress lz4_compress 9pnet_virtio 9pnet netfs ghash_clmulni_intel serio_raw qemu_fw_cfg [ 7340.449650] ---[ end trace 0000000000000000 ]--- The issue can be fixed in all in-tree drivers, but we cannot just trust OOT drivers to not do this. Therefore, make tailroom a signed int and produce a warning when it is negative to prevent such mistakes in the future. Fixes: bf25146a5595 ("bpf: add frags support to the bpf_xdp_adjust_tail() API") Reviewed-by: Aleksandr Loktionov Reviewed-by: Toke Høiland-Jørgensen Acked-by: Martin KaFai Lau Signed-off-by: Larysa Zaremba Link: https://patch.msgid.link/20260305111253.2317394-10-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit f8e18abf183dbd636a8725532c7f5aa58957de84 Author: Larysa Zaremba Date: Thu Mar 5 12:12:49 2026 +0100 net: enetc: use truesize as XDP RxQ info frag_size The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects truesize instead of DMA write size. Different assumptions in enetc driver configuration lead to negative tailroom. Set frag_size to the same value as frame_sz. Fixes: 2768b2e2f7d2 ("net: enetc: register XDP RX queues with frag_size") Reviewed-by: Aleksandr Loktionov Reviewed-by: Vladimir Oltean Signed-off-by: Larysa Zaremba Link: https://patch.msgid.link/20260305111253.2317394-9-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit 75d9228982f23d68066ca0b7d87014c3eb8ddc85 Author: Larysa Zaremba Date: Thu Mar 5 12:12:48 2026 +0100 libeth, idpf: use truesize as XDP RxQ info frag_size The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buffer size instead of DMA write size. Different assumptions in idpf driver configuration lead to negative tailroom. To make it worse, buffer sizes are not actually uniform in idpf when splitq is enabled, as there are several buffer queues, so rxq->rx_buf_size is meaningless in this case. Use truesize of the first bufq in AF_XDP ZC, as there is only one. Disable growing tail for regular splitq. Fixes: ac8a861f632e ("idpf: prepare structures to support XDP") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Link: https://patch.msgid.link/20260305111253.2317394-8-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit c69d22c6c46a1d792ba8af3d8d6356fdc0e6f538 Author: Larysa Zaremba Date: Thu Mar 5 12:12:47 2026 +0100 i40e: use xdp.frame_sz as XDP RxQ info frag_size The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buffer size instead of DMA write size. Different assumptions in i40e driver configuration lead to negative tailroom. Set frag_size to the same value as frame_sz in shared pages mode, use new helper to set frag_size when AF_XDP ZC is active. Fixes: a045d2f2d03d ("i40e: set xdp_rxq_info::frag_size") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Link: https://patch.msgid.link/20260305111253.2317394-7-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit 8f497dc8a61429cc004720aa8e713743355d80cf Author: Larysa Zaremba Date: Thu Mar 5 12:12:46 2026 +0100 i40e: fix registering XDP RxQ info Current way of handling XDP RxQ info in i40e has a problem, where frag_size is not updated when xsk_buff_pool is detached or when MTU is changed, this leads to growing tail always failing for multi-buffer packets. Couple XDP RxQ info registering with buffer allocations and unregistering with cleaning the ring. Fixes: a045d2f2d03d ("i40e: set xdp_rxq_info::frag_size") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Link: https://patch.msgid.link/20260305111253.2317394-6-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit e142dc4ef0f451b7ef99d09aaa84e9389af629d7 Author: Larysa Zaremba Date: Thu Mar 5 12:12:45 2026 +0100 ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead of DMA write size. Different assumptions in ice driver configuration lead to negative tailroom. This allows to trigger kernel panic, when using XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to 6912 and the requested offset to a huge value, e.g. XSK_UMEM__MAX_FRAME_SIZE * 100. Due to other quirks of the ZC configuration in ice, panic is not observed in ZC mode, but tailroom growing still fails when it should not. Use fill queue buffer truesize instead of DMA write size in XDP RxQ info. Fix ZC mode too by using the new helper. Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Link: https://patch.msgid.link/20260305111253.2317394-5-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit 02852b47c706772af795d3e28fca99fc9b923b2c Author: Larysa Zaremba Date: Thu Mar 5 12:12:44 2026 +0100 ice: fix rxq info registering in mbuf packets XDP RxQ info contains frag_size, which depends on the MTU. This makes the old way of registering RxQ info before calculating new buffer sizes invalid. Currently, it leads to frag_size being outdated, making it sometimes impossible to grow tailroom in a mbuf packet. E.g. fragments are actually 3K+, but frag size is still as if MTU was 1500. Always register new XDP RxQ info after reconfiguring memory pools. Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Link: https://patch.msgid.link/20260305111253.2317394-4-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit 16394d80539937d348dd3b9ea32415c54e67a81b Author: Larysa Zaremba Date: Thu Mar 5 12:12:43 2026 +0100 xsk: introduce helper to determine rxq->frag_size rxq->frag_size is basically a step between consecutive strictly aligned frames. In ZC mode, chunk size fits exactly, but if chunks are unaligned, there is no safe way to determine accessible space to grow tailroom. Report frag_size to be zero, if chunks are unaligned, chunk_size otherwise. Fixes: 24ea50127ecf ("xsk: support mbuf on ZC RX") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Link: https://patch.msgid.link/20260305111253.2317394-3-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit 88b6b7f7b216108a09887b074395fa7b751880b1 Author: Larysa Zaremba Date: Thu Mar 5 12:12:42 2026 +0100 xdp: use modulo operation to calculate XDP frag tailroom The current formula for calculating XDP tailroom in mbuf packets works only if each frag has its own page (if rxq->frag_size is PAGE_SIZE), this defeats the purpose of the parameter overall and without any indication leads to negative calculated tailroom on at least half of frags, if shared pages are used. There are not many drivers that set rxq->frag_size. Among them: * i40e and enetc always split page uniformly between frags, use shared pages * ice uses page_pool frags via libeth, those are power-of-2 and uniformly distributed across page * idpf has variable frag_size with XDP on, so current API is not applicable * mlx5, mtk and mvneta use PAGE_SIZE or 0 as frag_size for page_pool As for AF_XDP ZC, only ice, i40e and idpf declare frag_size for it. Modulo operation yields good results for aligned chunks, they are all power-of-2, between 2K and PAGE_SIZE. Formula without modulo fails when chunk_size is 2K. Buffers in unaligned mode are not distributed uniformly, so modulo operation would not work. To accommodate unaligned buffers, we could define frag_size as data + tailroom, and hence do not subtract offset when calculating tailroom, but this would necessitate more changes in the drivers. Define rxq->frag_size as an even portion of a page that fully belongs to a single frag. When calculating tailroom, locate the data start within such portion by performing a modulo operation on page offset. Fixes: bf25146a5595 ("bpf: add frags support to the bpf_xdp_adjust_tail() API") Acked-by: Jakub Kicinski Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Link: https://patch.msgid.link/20260305111253.2317394-2-larysa.zaremba@intel.com Signed-off-by: Jakub Kicinski commit 5d1271ff4c131cd4a601dabdfdcdc1fe1252493f Author: Victor Nogueira Date: Wed Mar 4 09:06:03 2026 -0500 selftests/tc-testing: Add tests exercising act_ife metalist replace behaviour Add 2 test cases to exercise fix in act_ife's internal metalist behaviour. - Update decode ife action into encode with tcindex metadata - Update decode ife action into encode with multiple metadata Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20260304140603.76500-2-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit e2cedd400c3ec0302ffca2490e8751772906ac23 Author: Jamal Hadi Salim Date: Wed Mar 4 09:06:02 2026 -0500 net/sched: act_ife: Fix metalist update behavior Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op: [ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597) [ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1)) [ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2)) [ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171) [ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57) [ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3)) [ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45) [ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879) To solve this issue, fix the replace behavior by adding the metalist to the ife rcu data structure. Fixes: aa9fd9a325d51 ("sched: act: ife: update parameters via rcu handling") Reported-by: Ruitong Liu Tested-by: Ruitong Liu Co-developed-by: Victor Nogueira Signed-off-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260304140603.76500-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 4517b74cc07c3b766ca92cf6cea352e65f6e8f9b Merge: 168ff39e475889 46c1ef0cfcea50 Author: Jakub Kicinski Date: Thu Mar 5 07:53:19 2026 -0800 Merge branch 'net-ipv6-fix-panic-when-ipv4-route-references-loopback-ipv6-nexthop-and-add-selftest' Jiayuan Chen says: ==================== net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop and add selftest syzbot reported a kernel panic [1] when an IPv4 route references a loopback IPv6 nexthop object: BUG: unable to handle page fault for address: ffff8d069e7aa000 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 6aa01067 P4D 6aa01067 PUD 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 2 UID: 0 PID: 530 Comm: ping Not tainted 6.19.0+ #193 PREEMPT RIP: 0010:ip_route_output_key_hash_rcu+0x578/0x9e0 RSP: 0018:ffffd2ffc1573918 EFLAGS: 00010286 RAX: ffff8d069e7aa000 RBX: ffffd2ffc1573988 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffd2ffc1573978 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d060d496000 R13: 0000000000000000 R14: ffff8d060399a600 R15: ffff8d06019a6ab8 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8d069e7aa000 CR3: 0000000106eb0001 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: ip_route_output_key_hash+0x86/0x1a0 __ip4_datagram_connect+0x2b5/0x4e0 udp_connect+0x2c/0x60 inet_dgram_connect+0x88/0xd0 __sys_connect_file+0x56/0x90 __sys_connect+0xa8/0xe0 __x64_sys_connect+0x18/0x30 x64_sys_call+0xfb9/0x26e0 do_syscall_64+0xd3/0x1510 entry_SYSCALL_64_after_hwframe+0x76/0x7e Reproduction: ip -6 nexthop add id 100 dev lo ip route add 172.20.20.0/24 nhid 100 ping -c1 172.20.20.1 # kernel crash Problem Description When a standalone IPv6 nexthop object is created with a loopback device, fib6_nh_init() misclassifies it as a reject route. Nexthop objects have no destination prefix (fc_dst=::), so fib6_is_reject() always matches any loopback nexthop. The reject path skips fib_nh_common_init(), leaving nhc_pcpu_rth_output unallocated. When an IPv4 route later references this nexthop and triggers a route lookup, __mkroute_output() calls raw_cpu_ptr(nhc->nhc_pcpu_rth_output) on a NULL pointer, causing a page fault. The reject classification was designed for regular IPv6 routes to prevent kernel routing loops, but nexthop objects should not be subject to this check since they carry no destination information. Loop prevention is handled separately when the route itself is created. [1] https://syzkaller.appspot.com/bug?extid=334190e097a98a1b81bb ==================== Link: https://patch.msgid.link/20260304113817.294966-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 46c1ef0cfcea50aaf0b52316fdab94bf4b45795b Author: Jiayuan Chen Date: Wed Mar 4 19:38:14 2026 +0800 selftests: net: add test for IPv4 route with loopback IPv6 nexthop Add a regression test for a kernel panic that occurs when an IPv4 route references an IPv6 nexthop object created on the loopback device. The test creates an IPv6 nexthop on lo, binds an IPv4 route to it, then triggers a route lookup via ping to verify the kernel does not crash. ./fib_nexthops.sh Tests passed: 249 Tests failed: 0 Reviewed-by: Ido Schimmel Signed-off-by: Jiayuan Chen Reviewed-by: David Ahern Link: https://patch.msgid.link/20260304113817.294966-3-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 21ec92774d1536f71bdc90b0e3d052eff99cf093 Author: Jiayuan Chen Date: Wed Mar 4 19:38:13 2026 +0800 net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop When a standalone IPv6 nexthop object is created with a loopback device (e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies it as a reject route. This is because nexthop objects have no destination prefix (fc_dst=::), causing fib6_is_reject() to match any loopback nexthop. The reject path skips fib_nh_common_init(), leaving nhc_pcpu_rth_output unallocated. If an IPv4 route later references this nexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and panics. Simplify the check in fib6_nh_init() to only match explicit reject routes (RTF_REJECT) instead of using fib6_is_reject(). The loopback promotion heuristic in fib6_is_reject() is handled separately by ip6_route_info_create_nh(). After this change, the three cases behave as follows: 1. Explicit reject route ("ip -6 route add unreachable 2001:db8::/64"): RTF_REJECT is set, enters reject path, skips fib_nh_common_init(). No behavior change. 2. Implicit loopback reject route ("ip -6 route add 2001:db8::/32 dev lo"): RTF_REJECT is not set, takes normal path, fib_nh_common_init() is called. ip6_route_info_create_nh() still promotes it to reject afterward. nhc_pcpu_rth_output is allocated but unused, which is harmless. 3. Standalone nexthop object ("ip -6 nexthop add id 100 dev lo"): RTF_REJECT is not set, takes normal path, fib_nh_common_init() is called. nhc_pcpu_rth_output is properly allocated, fixing the crash when IPv4 routes reference this nexthop. Suggested-by: Ido Schimmel Fixes: 493ced1ac47c ("ipv4: Allow routes to use nexthop objects") Reported-by: syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@google.com/T/ Signed-off-by: Jiayuan Chen Reviewed-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20260304113817.294966-2-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 168ff39e4758897d2eee4756977d036d52884c7e Author: Fernando Fernandez Mancera Date: Wed Mar 4 13:03:57 2026 +0100 net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If an IPv6 packet is injected into the interface, route_shortcircuit() is called and a NULL pointer dereference happens on neigh_lookup(). BUG: kernel NULL pointer dereference, address: 0000000000000380 Oops: Oops: 0000 [#1] SMP NOPTI [...] RIP: 0010:neigh_lookup+0x20/0x270 [...] Call Trace: vxlan_xmit+0x638/0x1ef0 [vxlan] dev_hard_start_xmit+0x9e/0x2e0 __dev_queue_xmit+0xbee/0x14e0 packet_sendmsg+0x116f/0x1930 __sys_sendto+0x1f5/0x200 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x12f/0x1590 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix this by adding an early check on route_shortcircuit() when protocol is ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because VXLAN can be built-in even when IPv6 is built as a module. Fixes: e15a00aafa4b ("vxlan: add ipv6 route short circuit support") Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260304120357.9778-2-fmancera@suse.de Signed-off-by: Jakub Kicinski commit e5e890630533bdc15b26a34bb8e7ef539bdf1322 Author: Fernando Fernandez Mancera Date: Wed Mar 4 13:03:56 2026 +0100 net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. Then, if neigh_suppress is enabled and an ICMPv6 Neighbor Discovery packet reaches the bridge, br_do_suppress_nd() will dereference ipv6_stub->nd_tbl which is NULL, passing it to neigh_lookup(). This causes a kernel NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000268 Oops: 0000 [#1] PREEMPT SMP NOPTI [...] RIP: 0010:neigh_lookup+0x16/0xe0 [...] Call Trace: ? neigh_lookup+0x16/0xe0 br_do_suppress_nd+0x160/0x290 [bridge] br_handle_frame_finish+0x500/0x620 [bridge] br_handle_frame+0x353/0x440 [bridge] __netif_receive_skb_core.constprop.0+0x298/0x1110 __netif_receive_skb_one_core+0x3d/0xa0 process_backlog+0xa0/0x140 __napi_poll+0x2c/0x170 net_rx_action+0x2c4/0x3a0 handle_softirqs+0xd0/0x270 do_softirq+0x3f/0x60 Fix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in the callers. This is in essence disabling NS/NA suppression when IPv6 is disabled. Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports") Reported-by: Guruprasad C P Closes: https://lore.kernel.org/netdev/CAHXs0ORzd62QOG-Fttqa2Cx_A_VFp=utE2H2VTX5nqfgs7LDxQ@mail.gmail.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260304120357.9778-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit b92b0075ee1870f78f59ab1f7da7dbfdd718ad7a Author: Pedro Falcato Date: Thu Mar 5 14:53:12 2026 +0000 ata: libata-core: Add BRIDGE_OK quirk for QEMU drives Currently, whenever you boot with a QEMU drive over an AHCI interface, you get: [ 1.632121] ata1.00: applying bridge limits This happens due to the kernel not believing the given drive is SATA, since word 93 of IDENTIFY (ATA_ID_HW_CONFIG) is non-zero. The result is a pretty severe limit in max_hw_sectors_kb, which limits our IO sizes. QEMU has set word 93 erroneously for SATA drives but does not, in any way, emulate any of these real hardware details. There is no PATA drive and no SATA cable. As such, add a BRIDGE_OK quirk for QEMU HARDDISK. Special care is taken to limit this quirk to "2.5+", to allow for fixed future versions. This results in the max_hw_sectors being limited solely by the controller interface's limits. Which, for AHCI controllers, takes it from 128KB to 32767KB. Cc: stable@vger.kernel.org Signed-off-by: Pedro Falcato Reviewed-by: Damien Le Moal Reviewed-by: Hannes Reinecke Signed-off-by: Niklas Cassel commit eb54fa1025f8b520f0e83a807d76e35e4587c5ff Author: Zenghui Yu (Huawei) Date: Thu Feb 26 01:35:15 2026 +0800 KVM: arm64: nv: Inject a SEA if failed to read the descriptor Failure to read the descriptor (because it is outside of a memslot) should result in a SEA being injected in the guest. Suggested-by: Marc Zyngier Link: https://lore.kernel.org/r/86ms1m9lp3.wl-maz@kernel.org Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260225173515.20490-4-zenghui.yu@linux.dev Signed-off-by: Marc Zyngier commit 99a339377f3c1bdf6edd5614d36893ab1806f9e6 Author: Zenghui Yu (Huawei) Date: Thu Feb 26 01:35:14 2026 +0800 KVM: arm64: nv: Report addrsz fault at level 0 with a bad VTTBR.BADDR As per R_BFHQH, " When an Address size fault is generated, the reported fault code indicates one of the following: If the fault was generated due to the TTBR_ELx used in the translation having nonzero address bits above the OA size, then a fault at level 0. " Fix the reported Address size fault level as being 0 if the base address is wrongly programmed by L1. Fixes: 61e30b9eef7f ("KVM: arm64: nv: Implement nested Stage-2 page table walk logic") Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260225173515.20490-3-zenghui.yu@linux.dev Signed-off-by: Marc Zyngier commit 4c2264ecdf39ddbdb62e37b156015aacf05d0dcb Author: Zenghui Yu (Huawei) Date: Thu Feb 26 01:35:13 2026 +0800 KVM: arm64: nv: Check S2 limits based on implemented PA size check_base_s2_limits() checks the validity of SL0 and inputsize against ia_size (inputsize again!) but the pseudocode from DDI0487 G.a AArch64.TranslationTableWalk() says that we should check against the implemented PA size. We would otherwise fail to walk S2 with a valid configuration. E.g., granule size = 4KB, inputsize = 40 bits, initial lookup level = 0 (no concatenation) on a system with 48 bits PA range supported is allowed by architecture. Fix it by obtaining PA size by kvm_get_pa_bits(). Note that kvm_get_pa_bits() returns the fixed limit now and should eventually reflect the per VM PARange (one day!). Given that the configured PARange should not be greater that kvm_ipa_limit, it at least fixes the problem described above. While at it, inject a level 0 translation fault to guest if check_base_s2_limits() fails, as per the pseudocode. Fixes: 61e30b9eef7f ("KVM: arm64: nv: Implement nested Stage-2 page table walk logic") Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260225173515.20490-2-zenghui.yu@linux.dev Signed-off-by: Marc Zyngier commit 02b2920e30e323522438593e6ed9525f31cc727e Merge: c952291593e544 ed6579002548f3 Author: Jakub Kicinski Date: Thu Mar 5 07:35:45 2026 -0800 Merge branch 'maintainers-annual-cleanup-of-inactive-maintainers' Jakub Kicinski says: ==================== MAINTAINERS: annual cleanup of inactive maintainers Annual cleanup of inactive maintainers under networking. The goal is to make sure MAINTAINERS reflect reality for code which is relatively actively changed (at least 70 commits in the last 2 years or at least 120 commits in the last 5 years). Those who either: - were the initial author / "upstreamer" of the driver; or - authored at least 1/3rd of the exiting code base (per git blame); or - authored at least 25% of commits before becoming inactive are moved to CREDITS. The discovery of inactive maintainers was done using gitdm tools, with a bunch of ad-hoc scripts on top to do the rest. I tried to double check the results but this is mostly a scripted cleanup so please report inaccuracies if any. ==================== Link: https://patch.msgid.link/20260303215339.2333548-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ed6579002548f3d9c00380e2aeaa8305d3ed8fc5 Author: Jakub Kicinski Date: Tue Mar 3 13:53:11 2026 -0800 MAINTAINERS: remove Thomas Falcon from IBM ibmvnic We have not seen emails or tags from Thomas's IBM address (tlfalcon@linux.ibm.com) in over 5 years. Looks like Thomas is active in perf tooling at Intel (thomas.falcon@intel.com). Subsystem IBM Power SRIOV Virtual NIC Device Driver Changes 49 / 134 (36%) Last activity: 2025-08-26 Haren Myneni : Tags 3c14917953a5 2025-08-26 00:00:00 2 Rick Lindsley : Nick Child : Author d93a6caab5d7 2025-03-25 00:00:00 14 Tags d93a6caab5d7 2025-03-25 00:00:00 16 Thomas Falcon : Top reviewers: [22]: drt@linux.ibm.com [13]: horms@kernel.org [9]: ricklind@linux.vnet.ibm.com [3]: davemarq@linux.ibm.com INACTIVE MAINTAINER Thomas Falcon Move Thomas to CREDITS as the initial author of ibmvnic. Acked-by: Thomas Falcon Link: https://patch.msgid.link/20260303215339.2333548-12-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4d37e68c46d15beb4af782b19d7f1b382316776c Author: Jakub Kicinski Date: Tue Mar 3 13:53:10 2026 -0800 MAINTAINERS: remove Claudiu Manoil and Alexandre Belloni from Ocelot switch We have not seen tags from Claudiu for the Ocelot switch driver in over 5 years. He is active upstream in other NXP subsystems (ENETC, gianfar), with 46 emails on lore since 2024. We have not seen tags from Alexandre for the Ocelot switch driver in over 5 years. He is very active upstream in other subsystems (RTC, I3C, Atmel/Microchip SoC), with over 1,200 emails on lore since 2024. Vladimir Oltean is active. Subsystem OCELOT ETHERNET SWITCH DRIVER Changes 180 / 494 (36%) Last activity: 2026-02-12 Vladimir Oltean : Author c22ba07c827f 2026-02-10 00:00:00 33 Tags 026f6513c588 2026-02-12 00:00:00 39 Claudiu Manoil : Alexandre Belloni : Top reviewers: [49]: f.fainelli@gmail.com [19]: horms@kernel.org [10]: richardcochran@gmail.com [9]: jacob.e.keller@intel.com [8]: colin.foster@in-advantage.com INACTIVE MAINTAINER Claudiu Manoil Acked-by: Claudiu Manoil Acked-by: Alexandre Belloni Link: https://patch.msgid.link/20260303215339.2333548-11-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9ede3e910f088fb3ffec0ed821f0b03951000d23 Author: Jakub Kicinski Date: Tue Mar 3 13:53:09 2026 -0800 MAINTAINERS: replace Taras Chornyi with Elad Nachman for Marvell Prestera We have not seen emails or tags from Taras in over 5 years, and there is no recent mailing list activity. Elad Nachman has been providing reviews in the last couple of years and is the top reviewer for this subsystem. Subsystem MARVELL PRESTERA ETHERNET SWITCH DRIVER Changes 39 / 157 (24%) (No activity) Top reviewers: [8]: enachman@marvell.com [6]: horms@kernel.org [4]: idosch@nvidia.com [3]: andrew@lunn.ch [3]: jacob.e.keller@intel.com [3]: jiri@nvidia.com INACTIVE MAINTAINER Taras Chornyi Link: https://patch.msgid.link/20260303215339.2333548-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 60da2d2752ac4513fc3a91a0558dfd8176d2313f Author: Jakub Kicinski Date: Tue Mar 3 13:53:08 2026 -0800 MAINTAINERS: remove Jonathan Lemon from OpenCompute PTP We have not seen emails or tags from Jonathan in over 5 years, and there is no recent mailing list activity. Vadim Fedorenko is active. Subsystem OPENCOMPUTE PTP CLOCK DRIVER Changes 49 / 130 (37%) Last activity: 2025-11-25 Jonathan Lemon : Vadim Fedorenko : Author d3ca2ef0c915 2025-09-19 00:00:00 5 Tags 648282e2d1e5 2025-11-25 00:00:00 20 Top reviewers: [7]: horms@kernel.org [4]: jiri@nvidia.com [3]: richardcochran@gmail.com [2]: aleksandr.loktionov@intel.com INACTIVE MAINTAINER Jonathan Lemon Add Jonathan to CREDITS as the initial author of ptp_ocp. Acked-by: Vadim Fedorenko Link: https://patch.msgid.link/20260303215339.2333548-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 34f49454b25cd2e532f137174ef59b778f1a09f5 Author: Jakub Kicinski Date: Tue Mar 3 13:53:07 2026 -0800 MAINTAINERS: replace Clark Wang with Frank Li for Freescale FEC We have not seen tags from Clark for FEC in over 5 years. He has some limited recent activity on the mailing list in other NXP subsystems (stmmac, phy). Wei Fang and Shenwei Wang are active, with decent review coverage (61%). Frank Li has been reviewing code actively more recenty, let's make it official. Subsystem FREESCALE IMX / MXC FEC DRIVER Changes 57 / 92 (61%) Last activity: 2026-02-10 Wei Fang : Author 25eb3058eb70 2026-02-10 00:00:00 33 Tags 25eb3058eb70 2026-02-10 00:00:00 61 Shenwei Wang : Author d466c16026e9 2025-09-14 00:00:00 6 Tags d466c16026e9 2025-09-14 00:00:00 6 Clark Wang : Top reviewers: [23]: Frank.Li@nxp.com [17]: andrew@lunn.ch [4]: csokas.bence@prolan.hu [3]: horms@kernel.org [2]: maxime.chevallier@bootlin.com INACTIVE MAINTAINER Clark Wang Reviewed-by: Wei Fang Link: https://patch.msgid.link/20260303215339.2333548-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 593cdf14523bfb837b947012cdc6545a53ea67b5 Author: Jakub Kicinski Date: Tue Mar 3 13:53:06 2026 -0800 MAINTAINERS: remove DENG Qingfang from MediaTek switch We have not seen tags from DENG Qingfang for the MediaTek switch driver in over 5 years. He is active upstream with PPP/PPPoE patches in net-next. Chester and Daniel are active. Subsystem MEDIATEK SWITCH DRIVER Changes 26 / 70 (37%) Last activity: 2025-12-01 Chester A. Unal : Tags 585943b7ad30 2025-12-01 00:00:00 7 Daniel Golle : Author 497041d76301 2025-04-23 00:00:00 2 Tags 3b87e60d2131 2025-12-01 00:00:00 14 DENG Qingfang : Sean Wang : Top reviewers: [4]: andrew@lunn.ch [4]: florian.fainelli@broadcom.com [4]: arinc.unal@arinc9.com [2]: olteanv@gmail.com INACTIVE MAINTAINER DENG Qingfang Acked-by: Chester A. Unal Link: https://patch.msgid.link/20260303215339.2333548-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 77f72ef58fb849cbe39fd69a20f9ae5076cd442b Author: Jakub Kicinski Date: Tue Mar 3 13:53:05 2026 -0800 MAINTAINERS: remove Sean Wang from MediaTek Ethernet and switch We have not seen tags from Sean in over 5 years, with only one mailing list post since 2024. Felix and Lorenzo are active for the Ethernet driver, and Chester, Daniel and DENG Qingfang are active for the switch driver. Subsystem MEDIATEK ETHERNET DRIVER Changes 55 / 113 (48%) Last activity: 2025-10-12 Felix Fietkau : Author d4736737110f 2025-09-02 00:00:00 3 Tags d4736737110f 2025-09-02 00:00:00 4 Sean Wang : Lorenzo Bianconi : Author 96326447d466 2025-08-13 00:00:00 35 Tags 3abc0e55ea1f 2025-10-12 00:00:00 40 Top reviewers: [26]: horms@kernel.org [5]: andrew@lunn.ch [4]: jacob.e.keller@intel.com [3]: shannon.nelson@amd.com [3]: michal.swiatkowski@linux.intel.com INACTIVE MAINTAINER Sean Wang Subsystem MEDIATEK SWITCH DRIVER Changes 26 / 70 (37%) Last activity: 2025-12-01 Chester A. Unal : Tags 585943b7ad30 2025-12-01 00:00:00 7 Daniel Golle : Author 497041d76301 2025-04-23 00:00:00 2 Tags 3b87e60d2131 2025-12-01 00:00:00 14 DENG Qingfang : Sean Wang : Top reviewers: [4]: andrew@lunn.ch [4]: florian.fainelli@broadcom.com [4]: arinc.unal@arinc9.com [2]: olteanv@gmail.com INACTIVE MAINTAINER Sean Wang Acked-by: Chester A. Unal Link: https://patch.msgid.link/20260303215339.2333548-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e07f796a86b2f0fda976268a08c321579022fcbc Author: Jakub Kicinski Date: Tue Mar 3 13:53:03 2026 -0800 MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 We have not seen tags from Jerin for OcteonTX2 in over 5 years. Recent lore activity is in DPDK (non-kernel), not Linux. Sunil, Linu, Geetha, hariprasad, and Subbaraya are active, though the review coverage isn't great (38%). Subsystem MARVELL OCTEONTX2 RVU ADMIN FUNCTION DRIVER Changes 53 / 138 (38%) Last activity: 2026-02-18 Sunil Goutham : Author fc1b2901e0fe 2024-03-08 00:00:00 1 Tags 70f8986ecef1 2025-06-16 00:00:00 9 Linu Cherian : Author a861e5809f3e 2025-10-30 00:00:00 7 Tags a861e5809f3e 2025-10-30 00:00:00 7 Geetha sowjanya : Author 70e9a5760abf 2026-01-29 00:00:00 16 Tags 70e9a5760abf 2026-01-29 00:00:00 20 Jerin Jacob : hariprasad : Author 45be47bf5d7d 2026-02-18 00:00:00 22 Tags 45be47bf5d7d 2026-02-18 00:00:00 25 Subbaraya Sundeep : Author 47a1208776d7 2025-10-30 00:00:00 20 Tags 47a1208776d7 2025-10-30 00:00:00 30 Top reviewers: [36]: horms@kernel.org [4]: jacob.e.keller@intel.com [4]: kalesh-anakkur.purayil@broadcom.com [3]: vadim.fedorenko@linux.dev [2]: shaojijie@huawei.com [2]: jiri@nvidia.com INACTIVE MAINTAINER Jerin Jacob Link: https://patch.msgid.link/20260303215339.2333548-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 80f8a19fe7cf5b1b5d541c7aaa37aa9d7653bda5 Author: Jakub Kicinski Date: Tue Mar 3 13:53:02 2026 -0800 MAINTAINERS: remove Manish Chopra from QLogic QL4xxx (now orphan) We have not seen tags from Manish for the QL4xxx driver in over 5 years, and there is no mailing list activity since Oct 2023. There has been no maintainer activity in this subsystem at all. Since there is no other maintainer for this driver it becomes an Orphan. Subsystem QLOGIC QL4xxx ETHERNET DRIVER Changes 40 / 74 (54%) (No activity) Top reviewers: [30]: horms@kernel.org [2]: jiri@nvidia.com [2]: shannon.nelson@amd.com [1]: saeedm@nvidia.com [1]: aleksandr.loktionov@intel.com [1]: kory.maincent@bootlin.com INACTIVE MAINTAINER Manish Chopra Link: https://patch.msgid.link/20260303215339.2333548-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f9b5bf12eb65e1e708a883a1e24712e81ed2f340 Author: Jakub Kicinski Date: Tue Mar 3 13:53:01 2026 -0800 MAINTAINERS: remove Johan Hedberg from Bluetooth subsystem We have not seen emails or tags from Johan in over 5 years, and there is no recent mailing list activity. Marcel Holtmann hasn't provided any tags in the Bluetooth subsystem in over 5 years, but he is active on the Bluetooth mailing list, providing informal review. Luiz Augusto von Dentz is very active, handling essentially all commits and reviews (12% coverage, but Luiz is the sole active committer). Subsystem BLUETOOTH SUBSYSTEM Changes 50 / 411 (12%) Last activity: 2026-02-23 Marcel Holtmann : Johan Hedberg : Luiz Augusto von Dentz : Author 138d7eca445e 2026-02-23 00:00:00 164 Committer 138d7eca445e 2026-02-23 00:00:00 361 Tags 138d7eca445e 2026-02-23 00:00:00 362 Top reviewers: [15]: pmenzel@molgen.mpg.de [8]: keescook@chromium.org [5]: willemb@google.com [4]: horms@kernel.org [3]: kuniyu@amazon.com [3]: luiz.von.dentz@intel.com INACTIVE MAINTAINER Johan Hedberg Acked-by: Marcel Holtmann Link: https://patch.msgid.link/20260303215339.2333548-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c952291593e54415a7bb74c4a7187a7c7c7e8651 Author: Sun Jian Date: Wed Feb 25 19:14:51 2026 +0800 selftests: net: tun: don't abort XFAIL cases The tun UDP tunnel GSO fixture contains XFAIL-marked variants intended to exercise failure paths (e.g. EMSGSIZE / "Message too long"). Using ASSERT_EQ() in these tests aborts the subtest, which prevents the harness from classifying them as XFAIL and can make the overall net: tun test fail. Switch the relevant ASSERT_EQ() checks to EXPECT_EQ() so the subtests continue running and the failures are correctly reported and accounted as XFAIL where applicable. Signed-off-by: Sun Jian Link: https://patch.msgid.link/20260225111451.347923-2-sun.jian.kdev@gmail.com Signed-off-by: Jakub Kicinski commit 6be2681514261324c8ee8a1c6f76cefdf700220f Author: Sun Jian Date: Wed Feb 25 19:14:50 2026 +0800 selftests/harness: order TEST_F and XFAIL_ADD constructors TEST_F() allocates and registers its struct __test_metadata via mmap() inside its constructor, and only then assigns the _##fixture_##test##_object pointer. XFAIL_ADD() runs in a constructor too and reads _##fixture_##test##_object to initialize xfail->test. If XFAIL_ADD runs first, xfail->test can be NULL and the expected failure will be reported as FAIL. Use constructor priorities to ensure TEST_F registration runs before XFAIL_ADD, without adding extra state or runtime lookups. Fixes: 2709473c9386 ("selftests: kselftest_harness: support using xfail") Signed-off-by: Sun Jian Link: https://patch.msgid.link/20260225111451.347923-1-sun.jian.kdev@gmail.com Signed-off-by: Jakub Kicinski commit 37380976cf22893537ff229224a0daa2f4a28e65 Merge: 0abc73c8a40fd6 9df95785d3d830 Author: Jakub Kicinski Date: Thu Mar 5 07:33:25 2026 -0800 Merge tag 'nf-26-03-05' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net 1) Inseo An reported a bug with the set element handling in nf_tables: When set cannot accept more elements, we unlink and immediately free an element that was inserted into a public data structure, freeing it without waiting for RCU grace period. Fix this by doing the increment earlier and by deferring possible unlink-and-free to the existing abort path, which performs the needed synchronize_rcu before free. From Pablo Neira Ayuso. This is an ancient bug, dating back to kernel 4.10. 2) syzbot reported WARN_ON() splat in nf_tables that occurs on memory allocation failure. Fix this by a new iterator annotation: The affected walker does not need to clone the data structure and can just use the live version if no clone exists yet. Also from Pablo. This bug existed since 6.10 days. 3) Ancient forever bug in nft_pipapo data structure: The garbage collection logic to remove expired elements is broken. We must unlink from data structure and can only hand the freeing to call_rcu after the clone/live pointers of the data structures have been swapped. Else, readers can observe the free'd element. Reported by Yiming Qian. * tag 'nf-26-03-05' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase netfilter: nf_tables: clone set on flush only netfilter: nf_tables: unconditionally bump set->nelems before insertion ==================== Link: https://patch.msgid.link/20260305122635.23525-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 8531d5a83d8eb8affb5c0249b466c28d94192603 Author: Marc Zyngier Date: Thu Mar 5 13:27:51 2026 +0000 KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault If, for any odd reason, we cannot converge to mapping size that is completely contained in a memblock region, we fail to install a S2 mapping and go back to the faulting instruction. Rince, repeat. This happens when faulting in regions that are smaller than a page or that do not have PAGE_SIZE-aligned boundaries (as witnessed on an O6 board that refuses to boot in protected mode). In this situation, fallback to using a PAGE_SIZE mapping anyway -- it isn't like we can go any lower. Fixes: e728e705802fe ("KVM: arm64: Adjust range correctly during host stage-2 faults") Link: https://lore.kernel.org/r/86wlzr77cn.wl-maz@kernel.org Cc: stable@vger.kernel.org Cc: Quentin Perret Reviewed-by: Quentin Perret Link: https://patch.msgid.link/20260305132751.2928138-1-maz@kernel.org Signed-off-by: Marc Zyngier commit ac6769c8f948dff33265c50e524aebf9aa6f1be0 Author: Marc Zyngier Date: Sat Feb 28 16:45:59 2026 +0000 KVM: arm64: Eagerly init vgic dist/redist on vgic creation If vgic_allocate_private_irqs_locked() fails for any odd reason, we exit kvm_vgic_create() early, leaving dist->rd_regions uninitialised. kvm_vgic_dist_destroy() then comes along and walks into the weeds trying to free the RDs. Got to love this stuff. Solve it by moving all the static initialisation early, and make sure that if we fail halfway, we're in a reasonable shape to perform the rest of the teardown. While at it, reset the vgic model on failure, just in case... Reported-by: syzbot+f6a46b038fc243ac0175@syzkaller.appspotmail.com Tested-by: syzbot+f6a46b038fc243ac0175@syzkaller.appspotmail.com Fixes: b3aa9283c0c50 ("KVM: arm64: vgic: Hoist SGI/PPI alloc from vgic_init() to kvm_create_vgic()") Link: https://lore.kernel.org/r/69a2d58c.050a0220.3a55be.003b.GAE@google.com Link: https://patch.msgid.link/20260228164559.936268-1-maz@kernel.org Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit f26b098d937488e8f5c617d465760a10bfcc7f13 Author: Jerome Marchand Date: Thu Mar 5 10:31:17 2026 +0100 ftrace: Add MAINTAINERS entries for all ftrace headers There is currently no entry for ftrace_irq.h and ftrace_regs.h. Add a generic entry for all *ftrace* headers to include them and prevent overlooking future ftrace headers. Cc: Masami Hiramatsu Cc: Mark Rutland Link: https://patch.msgid.link/20260305093117.853700-1-jmarchan@redhat.com Signed-off-by: Jerome Marchand Signed-off-by: Steven Rostedt (Google) commit 0abc73c8a40fd64ac1739c90bb4f42c418d27a5e Author: Lorenzo Bianconi Date: Tue Mar 3 18:56:39 2026 +0100 net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() Reset eBPF program pointer to old_prog and do not decrease its ref-count if mtk_open routine in mtk_xdp_setup() fails. Fixes: 7c26c20da5d42 ("net: ethernet: mtk_eth_soc: add basic XDP support") Suggested-by: Paolo Valerio Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260303-mtk-xdp-prog-ptr-fix-v2-1-97b6dbbe240f@kernel.org Signed-off-by: Paolo Abeni commit ee8ade4d9678a456bb5ea675c270738b250eda68 Author: Maarten Lankhorst Date: Thu Mar 5 12:37:34 2026 +0100 Revert "drm/syncobj: Fix handle <-> fd ioctls with dirty stack" This reverts commit 2e3649e237237258a08d75afef96648dd2b379f7. The problem occurs when userspace is compiled against new headers with new members, but don't correctly initialise those new members. This is not a kernel problem, and should be fixed in userspace by correctly zero'ing all members. Cc: Rob Clark Cc: Julian Orth Cc: Christian König Cc: Michel Dänzer Reviewed-by: Christian König Acked-by: Julian Orth Link: https://patch.msgid.link/20260305113734.1309238-1-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 3d543d9515928e4754a741c338dbcdf68ac47e39 Author: Johan Hovold Date: Thu Mar 5 12:18:10 2026 +0100 ALSA: us122l: drop redundant interface references Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. Similarly, USB core holds a reference to all interfaces in the active configuration so there is no need for a driver to take a reference to a sibling interface only to release it at disconnect either. Drop the redundant references to reduce cargo culting, make it easier to spot drivers where extra references are needed, and reduce the risk of memory leaks when drivers fail to release them. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260305111810.18688-1-johan@kernel.org Signed-off-by: Takashi Iwai commit 9df95785d3d8302f7c066050117b04cd3c2048c2 Author: Florian Westphal Date: Tue Mar 3 16:31:32 2026 +0100 netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports (local denial of service). We must split GC in an unlink and a reclaim phase. We cannot queue elements for freeing until pointers have been swapped. Expired elements are still exposed to both the packet path and userspace dumpers via the live copy of the data structure. call_rcu() does not protect us: dump operations or element lookups starting after call_rcu has fired can still observe the free'd element, unless the commit phase has made enough progress to swap the clone and live pointers before any new reader has picked up the old version. This a similar approach as done recently for the rbtree backend in commit 35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert"). Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: Yiming Qian Signed-off-by: Florian Westphal commit fb7fb4016300ac622c964069e286dc83166a5d52 Author: Pablo Neira Ayuso Date: Mon Mar 2 23:28:15 2026 +0100 netfilter: nf_tables: clone set on flush only Syzbot with fault injection triggered a failing memory allocation with GFP_KERNEL which results in a WARN splat: iter.err WARNING: net/netfilter/nf_tables_api.c:845 at nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845, CPU#0: syz.0.17/5992 Modules linked in: CPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845 Code: 8b 05 86 5a 4e 09 48 3b 84 24 a0 00 00 00 75 62 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 63 6d fa f7 90 <0f> 0b 90 43 +80 7c 35 00 00 0f 85 23 fe ff ff e9 26 fe ff ff 89 d9 RSP: 0018:ffffc900045af780 EFLAGS: 00010293 RAX: ffffffff89ca45bd RBX: 00000000fffffff4 RCX: ffff888028111e40 RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 RBP: ffffc900045af870 R08: 0000000000400dc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff1d141db R12: ffffc900045af7e0 R13: 1ffff920008b5f24 R14: dffffc0000000000 R15: ffffc900045af920 FS: 000055557a6a5500(0000) GS:ffff888125496000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb5ea271fc0 CR3: 000000003269e000 CR4: 00000000003526f0 Call Trace: __nft_release_table+0xceb/0x11f0 net/netfilter/nf_tables_api.c:12115 nft_rcv_nl_event+0xc25/0xdb0 net/netfilter/nf_tables_api.c:12187 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380 netlink_release+0x123b/0x1ad0 net/netlink/af_netlink.c:761 __sock_release net/socket.c:662 [inline] sock_close+0xc3/0x240 net/socket.c:1455 Restrict set clone to the flush set command in the preparation phase. Add NFT_ITER_UPDATE_CLONE and use it for this purpose, update the rbtree and pipapo backends to only clone the set when this iteration type is used. As for the existing NFT_ITER_UPDATE type, update the pipapo backend to use the existing set clone if available, otherwise use the existing set representation. After this update, there is no need to clone a set that is being deleted, this includes bound anonymous set. An alternative approach to NFT_ITER_UPDATE_CLONE is to add a .clone interface and call it from the flush set path. Reported-by: syzbot+4924a0edc148e8b4b342@syzkaller.appspotmail.com Fixes: 3f1d886cc7c3 ("netfilter: nft_set_pipapo: move cloning of match info to insert/removal path") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit def602e498a4f951da95c95b1b8ce8ae68aa733a Author: Pablo Neira Ayuso Date: Mon Mar 2 23:12:37 2026 +0100 netfilter: nf_tables: unconditionally bump set->nelems before insertion In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while RCU reader can be walking over it already. To address this issue, add the element transaction even if set is full, but toggle the set_full flag to report -ENFILE so the abort path safely unwinds the set to its previous state. As for element updates, decrement set->nelems to restore it. A simpler fix is to call synchronize_rcu() in the error path. However, with a large batch adding elements to already maxed-out set, this could cause noticeable slowdown of such batches. Fixes: 35d0ac9070ef ("netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL") Reported-by: Inseo An Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit b824c3e16c1904bf80df489e293d1e3cbf98896d Author: Sebastian Andrzej Siewior Date: Mon Mar 2 17:26:31 2026 +0100 net: Provide a PREEMPT_RT specific check for netdev_queue::_xmit_lock After acquiring netdev_queue::_xmit_lock the number of the CPU owning the lock is recorded in netdev_queue::xmit_lock_owner. This works as long as the BH context is not preemptible. On PREEMPT_RT the softirq context is preemptible and without the softirq-lock it is possible to have multiple user in __dev_queue_xmit() submitting a skb on the same CPU. This is fine in general but this means also that the current CPU is recorded as netdev_queue::xmit_lock_owner. This in turn leads to the recursion alert and the skb is dropped. Instead checking the for CPU number, that owns the lock, PREEMPT_RT can check if the lockowner matches the current task. Add netif_tx_owned() which returns true if the current context owns the lock by comparing the provided CPU number with the recorded number. This resembles the current check by negating the condition (the current check returns true if the lock is not owned). On PREEMPT_RT use rt_mutex_owner() to return the lock owner and compare the current task against it. Use the new helper in __dev_queue_xmit() and netif_local_xmit_active() which provides a similar check. Update comments regarding pairing READ_ONCE(). Reported-by: Bert Karwatzki Closes: https://lore.kernel.org/all/20260216134333.412332-1-spasswolf@web.de Fixes: 3253cb49cbad4 ("softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT") Signed-off-by: Sebastian Andrzej Siewior Reported-by: Bert Karwatzki Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260302162631.uGUyIqDT@linutronix.de Signed-off-by: Paolo Abeni commit ce8ee8583ed83122405eabaa8fb351be4d9dc65c Author: Ming Lei Date: Thu Mar 5 11:15:50 2026 +0800 block: use trylock to avoid lockdep circular dependency in sysfs Use trylock instead of blocking lock acquisition for update_nr_hwq_lock in queue_requests_store() and elv_iosched_store() to avoid circular lock dependency with kernfs active reference during concurrent disk deletion: update_nr_hwq_lock -> kn->active (via del_gendisk -> kobject_del) kn->active -> update_nr_hwq_lock (via sysfs write path) Return -EBUSY when the lock is not immediately available. Reported-and-tested-by: Yi Zhang Closes: https://lore.kernel.org/linux-block/CAHj4cs-em-4acsHabMdT=jJhXkCzjnprD-aQH1OgrZo4nTnmMw@mail.gmail.com/ Fixes: 626ff4f8ebcb ("blk-mq: convert to serialize updating nr_requests with update_nr_hwq_lock") Signed-off-by: Ming Lei Tested-by: Yi Zhang Signed-off-by: Jens Axboe commit c242e92c9da456d361d1d4482fb6e93ee95bd8cf Author: Kamal Heib Date: Mon Mar 2 23:36:45 2026 -0500 RDMA/bng_re: Fix silent failure in HWRM version query If the firmware version query fails, the driver currently ignores the error and continues initializing. This leaves the device in a bad state. Fix this by making bng_re_query_hwrm_version() return the error code and update the driver to check for this error and stop the setup process safely if it happens. Fixes: 745065770c2d ("RDMA/bng_re: Register and get the resources from bnge driver") Signed-off-by: Kamal Heib Link: https://patch.msgid.link/20260303043645.425724-1-kheib@redhat.com Reviewed-by: Siva Reddy Kallam Signed-off-by: Leon Romanovsky commit 281cb17787d4284a7790b9cbd80fded826ca7739 Author: hongao Date: Wed Mar 4 19:29:14 2026 +0800 xfs: Remove redundant NULL check after __GFP_NOFAIL kzalloc() is called with __GFP_NOFAIL, so a NULL return is not expected. Drop the redundant !map check in xfs_dabuf_map(). Also switch the nirecs-sized allocation to kcalloc(). Signed-off-by: hongao Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 91d7e9df42598af28ca440b95b16a4e51a408771 Author: Thadeu Lima de Souza Cascardo Date: Wed Mar 4 20:27:52 2026 -0300 drm/ttm: Fix bo resource use-after-free When allocating a lot of buffers and putting the TTM under memory pressure, during swapout, it might crash the system with the stack trace below. It turns out that ttm_bo_swapout_cb might replace bo->resource when it moves it to system cached. When commit c06da4b3573a ("drm/ttm: Tidy usage of local variables a little bit") used a local variable for bo->resource, it used the freed resource later in the function, leading to a UAF. Move back to using bo->resource in all cases in that function instead of a local variable. [ 604.814275] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 604.814284] #PF: supervisor read access in kernel mode [ 604.814288] #PF: error_code(0x0000) - not-present page [ 604.814291] PGD 0 P4D 0 [ 604.814296] Oops: Oops: 0000 [#1] SMP NOPTI [ 604.814303] CPU: 2 UID: 0 PID: 4408 Comm: vulkan Tainted: G W 7.0.0-rc2-00001-gc50a051e6aca #21 PREEMPT(full) aef6eb0c02036a7c8a5e62e0c84a30c2be90688d [ 604.814309] Tainted: [W]=WARN [ 604.814311] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0133 08/05/2024 [ 604.814314] RIP: 0010:ttm_resource_move_to_lru_tail+0x100/0x160 [ttm] [ 604.814329] Code: 5b 5d e9 83 b4 1b cb 48 63 d2 48 c1 e0 04 48 8b 4e 40 48 8d 7e 40 48 8b ac d3 d8 00 00 00 48 89 c3 48 8d 54 05 68 48 8b 46 48 <48> 3b 38 0f 85 b3 3b 00 00 48 3b 79 08 0f 85 a9 3b 00 00 48 89 41 [ 604.814332] RSP: 0018:ffffcfe54e3d7578 EFLAGS: 00010256 [ 604.814336] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8cf09eced300 [ 604.814339] RDX: 0000000000000068 RSI: ffff8cf1d4c1fc00 RDI: ffff8cf1d4c1fc40 [ 604.814341] RBP: 0000000000000000 R08: ffff8cf09eced300 R09: 0000000000000000 [ 604.814344] R10: 0000000000000000 R11: 0000000000000016 R12: ffff8cf1d4c1fc00 [ 604.814346] R13: 0000000000000400 R14: ffff8cf096289c00 R15: ffff8cf084c8f688 [ 604.814349] FS: 00007f00531b7780(0000) GS:ffff8cf4217a0000(0000) knlGS:0000000000000000 [ 604.814352] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 604.814355] CR2: 0000000000000000 CR3: 000000018e3df000 CR4: 0000000000350ef0 [ 604.814358] Call Trace: [ 604.814362] [ 604.814368] ttm_bo_swapout_cb+0x24c/0x280 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.814380] ttm_lru_walk_for_evict+0xac/0x1d0 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.814394] ttm_bo_swapout+0x5b/0x80 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.814405] ttm_global_swapout+0x63/0x100 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.814415] ttm_tt_populate+0x82/0x130 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.814424] ttm_bo_populate+0x37/0xa0 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.814433] ttm_bo_handle_move_mem+0x157/0x170 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.814443] ttm_bo_validate+0xd9/0x180 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.814453] ttm_bo_init_reserved+0xa0/0x1b0 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.814461] ? srso_return_thunk+0x5/0x5f [ 604.814469] amdgpu_bo_create+0x1f5/0x500 [amdgpu 361516226706227f4403914dbfdd3f90996136ca] [ 604.814855] ? __pfx_amdgpu_bo_user_destroy+0x10/0x10 [amdgpu 361516226706227f4403914dbfdd3f90996136ca] [ 604.815182] amdgpu_bo_create_user+0x3d/0x70 [amdgpu 361516226706227f4403914dbfdd3f90996136ca] [ 604.815504] amdgpu_gem_create_ioctl+0x16c/0x3b0 [amdgpu 361516226706227f4403914dbfdd3f90996136ca] [ 604.815830] ? __pfx_amdgpu_bo_user_destroy+0x10/0x10 [amdgpu 361516226706227f4403914dbfdd3f90996136ca] [ 604.816155] ? __pfx_amdgpu_gem_create_ioctl+0x10/0x10 [amdgpu 361516226706227f4403914dbfdd3f90996136ca] [ 604.816478] drm_ioctl_kernel+0xae/0x100 [ 604.816486] drm_ioctl+0x283/0x510 [ 604.816491] ? __pfx_amdgpu_gem_create_ioctl+0x10/0x10 [amdgpu 361516226706227f4403914dbfdd3f90996136ca] [ 604.816819] amdgpu_drm_ioctl+0x4a/0x80 [amdgpu 361516226706227f4403914dbfdd3f90996136ca] [ 604.817135] __x64_sys_ioctl+0x96/0xe0 [ 604.817142] do_syscall_64+0x11b/0x7e0 [ 604.817148] ? srso_return_thunk+0x5/0x5f [ 604.817152] ? srso_return_thunk+0x5/0x5f [ 604.817156] ? walk_system_ram_range+0xb0/0x110 [ 604.817161] ? srso_return_thunk+0x5/0x5f [ 604.817165] ? __pte_offset_map+0x1b/0xb0 [ 604.817170] ? srso_return_thunk+0x5/0x5f [ 604.817174] ? pte_offset_map_lock+0x87/0xf0 [ 604.817179] ? srso_return_thunk+0x5/0x5f [ 604.817183] ? insert_pfn+0x9f/0x1f0 [ 604.817188] ? srso_return_thunk+0x5/0x5f [ 604.817192] ? vmf_insert_pfn_prot+0x97/0x190 [ 604.817197] ? srso_return_thunk+0x5/0x5f [ 604.817201] ? ttm_bo_vm_fault_reserved+0x1a6/0x3f0 [ttm a469cf7fcb6737fdcf3fb5cdbcc8b1ca41f3e302] [ 604.817213] ? srso_return_thunk+0x5/0x5f [ 604.817217] ? amdgpu_gem_fault+0xe2/0x100 [amdgpu 361516226706227f4403914dbfdd3f90996136ca] [ 604.817542] ? srso_return_thunk+0x5/0x5f [ 604.817546] ? __do_fault+0x33/0x180 [ 604.817550] ? srso_return_thunk+0x5/0x5f [ 604.817554] ? do_fault+0x178/0x610 [ 604.817559] ? srso_return_thunk+0x5/0x5f [ 604.817562] ? __handle_mm_fault+0x9be/0x1120 [ 604.817567] ? srso_return_thunk+0x5/0x5f [ 604.817574] ? srso_return_thunk+0x5/0x5f [ 604.817578] ? count_memcg_events+0xc4/0x160 [ 604.817583] ? srso_return_thunk+0x5/0x5f [ 604.817587] ? handle_mm_fault+0x1d7/0x2e0 [ 604.817593] ? srso_return_thunk+0x5/0x5f [ 604.817596] ? do_user_addr_fault+0x173/0x660 [ 604.817602] ? srso_return_thunk+0x5/0x5f [ 604.817607] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 604.817612] RIP: 0033:0x7f00532cef4d [ 604.817617] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 [ 604.817620] RSP: 002b:00007ffd69ab0650 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 604.817624] RAX: ffffffffffffffda RBX: 00007ffd69ab07d0 RCX: 00007f00532cef4d [ 604.817627] RDX: 00007ffd69ab0700 RSI: 00000000c0206440 RDI: 0000000000000005 [ 604.817629] RBP: 00007ffd69ab06a0 R08: 00007f00533a0ac0 R09: 0000000000000000 [ 604.817632] R10: 00007ffd69ab07c0 R11: 0000000000000246 R12: 00007ffd69ab0700 [ 604.817634] R13: 00000000c0206440 R14: 0000000000000005 R15: 0000000000000243 [ 604.817642] Cc: Tvrtko Ursulin Cc: Christian König Fixes: c06da4b3573a ("drm/ttm: Tidy usage of local variables a little bit") Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260304-ttm_bo_res_uaf-v1-1-43f20125b67f@igalia.com commit ae779bcb18cb0ef0da1402b9dd837e2084e23e27 Merge: 550921c67baa36 2cd70e3968f505 Author: Jakub Kicinski Date: Wed Mar 4 18:48:51 2026 -0800 Merge branch 'net-stmmac-fix-vlan-handling-when-interface-is-down' Ovidiu Panait says: ==================== net: stmmac: Fix VLAN handling when interface is down VLAN register accesses on the MAC side require the PHY RX clock to be active. When the network interface is down, the PHY is suspended and the RX clock is unavailable, causing VLAN operations to fail with timeouts. The VLAN core automatically removes VID 0 after the interface goes down and re-adds it when it comes back up, so these timeouts happen during normal interface down/up: # ip link set end1 down renesas-gbeth 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter renesas-gbeth 15c40000.ethernet end1: failed to kill vid 0081/0 Adding VLANs while the interface is down also fails: # ip link add link end1 name end1.10 type vlan id 10 renesas-gbeth 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter RTNETLINK answers: Device or resource busy Patch 4 fixes this by adding checks in the VLAN paths for netif_running(), and skipping register accesses if the interface is down. Only the software state is updated in this case. When the interface is brought up, the VLAN state is restored to hardware. Patches 1-3 fix some issues in the existing VLAN implementation. ==================== Link: https://patch.msgid.link/20260303145828.7845-1-ovidiu.panait.rb@renesas.com Signed-off-by: Jakub Kicinski commit 2cd70e3968f505996d5fefdf7ca684f0f4575734 Author: Ovidiu Panait Date: Tue Mar 3 14:58:28 2026 +0000 net: stmmac: Defer VLAN HW configuration when interface is down VLAN register accesses on the MAC side require the PHY RX clock to be active. When the network interface is down, the PHY is suspended and the RX clock is unavailable, causing VLAN operations to fail with timeouts. The VLAN core automatically removes VID 0 after the interface goes down and re-adds it when it comes back up, so these timeouts happen during normal interface down/up: # ip link set end1 down renesas-gbeth 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter renesas-gbeth 15c40000.ethernet end1: failed to kill vid 0081/0 Adding VLANs while the interface is down also fails: # ip link add link end1 name end1.10 type vlan id 10 renesas-gbeth 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter RTNETLINK answers: Device or resource busy To fix this, check if the interface is up before accessing VLAN registers. The software state is always kept up to date regardless of interface state. When the interface is brought up, stmmac_vlan_restore() is called to write the VLAN state to hardware. Fixes: ed64639bc1e0 ("net: stmmac: Add support for VLAN Rx filtering") Signed-off-by: Ovidiu Panait Link: https://patch.msgid.link/20260303145828.7845-5-ovidiu.panait.rb@renesas.com Signed-off-by: Jakub Kicinski commit bd7ad51253a76fb35886d01cfe9a37f0e4ed6709 Author: Ovidiu Panait Date: Tue Mar 3 14:58:27 2026 +0000 net: stmmac: Fix VLAN HW state restore When the network interface is opened or resumed, a DMA reset is performed, which resets all hardware state, including VLAN state. Currently, only the resume path is restoring the VLAN state via stmmac_restore_hw_vlan_rx_fltr(), but that is incomplete: the VLAN hash table and the VLAN_TAG control bits are not restored. Therefore, add stmmac_vlan_restore(), which restores the full VLAN state by updating both the HW filter entries and the hash table, and call it from both the open and resume paths. The VLAN restore is moved outside of phylink_rx_clk_stop_block/unblock in the resume path because receive clock stop is already disabled when stmmac supports VLAN. Also, remove the hash readback code in vlan_restore_hw_rx_fltr() that attempts to restore VTHM by reading VLAN_HASH_TABLE, as it always reads zero after DMA reset, making it dead code. Fixes: 3cd1cfcba26e ("net: stmmac: Implement VLAN Hash Filtering in XGMAC") Fixes: ed64639bc1e0 ("net: stmmac: Add support for VLAN Rx filtering") Signed-off-by: Ovidiu Panait Link: https://patch.msgid.link/20260303145828.7845-4-ovidiu.panait.rb@renesas.com Signed-off-by: Jakub Kicinski commit e38200e361cbe331806dc454c76c11c7cd95e1b9 Author: Ovidiu Panait Date: Tue Mar 3 14:58:26 2026 +0000 net: stmmac: Improve double VLAN handling The double VLAN bits (EDVLP, ESVL, DOVLTC) are handled inconsistently between the two vlan_update_hash() implementations: - dwxgmac2_update_vlan_hash() explicitly clears the double VLAN bits when is_double is false, meaning that adding a 802.1Q VLAN will disable double VLAN mode: $ ip link add link eth0 name eth0.200 type vlan id 200 protocol 802.1ad $ ip link add link eth0 name eth0.100 type vlan id 100 # Double VLAN bits no longer set - vlan_update_hash() sets these bits and only clears them when the last VLAN has been removed, so double VLAN mode remains enabled even after all 802.1AD VLANs are removed. Address both issues by tracking the number of active 802.1AD VLANs in priv->num_double_vlans. Pass this count to stmmac_vlan_update() so both implementations correctly set the double VLAN bits when any 802.1AD VLAN is active, and clear them only when none remain. Also update vlan_update_hash() to explicitly clear the double VLAN bits when is_double is false, matching the dwxgmac2 behavior. Signed-off-by: Ovidiu Panait Link: https://patch.msgid.link/20260303145828.7845-3-ovidiu.panait.rb@renesas.com Signed-off-by: Jakub Kicinski commit 35dfedce442c4060cfe5b98368bc9643fb995716 Author: Ovidiu Panait Date: Tue Mar 3 14:58:25 2026 +0000 net: stmmac: Fix error handling in VLAN add and delete paths stmmac_vlan_rx_add_vid() updates active_vlans and the VLAN hash register before writing the HW filter entry. If the filter write fails, it leaves a stale VID in active_vlans and the hash register. stmmac_vlan_rx_kill_vid() has the reverse problem: it clears active_vlans before removing the HW filter. On failure, the VID is gone from active_vlans but still present in the HW filter table. To fix this, reorder the operations to update the hash table first, then attempt the HW filter operation. If the HW filter fails, roll back both the active_vlans bitmap and the hash table by calling stmmac_vlan_update() again. Fixes: ed64639bc1e0 ("net: stmmac: Add support for VLAN Rx filtering") Signed-off-by: Ovidiu Panait Link: https://patch.msgid.link/20260303145828.7845-2-ovidiu.panait.rb@renesas.com Signed-off-by: Jakub Kicinski commit 550921c67baa3669e108308b0d8cc9ee6471604b Merge: ff2c591625a6f1 554a1c34c11a05 Author: Jakub Kicinski Date: Wed Mar 4 18:35:35 2026 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-03-03 (ice, libie, iavf, igb, igc) Larysa removes VF restriction for LLDP filters on ice to allow for LLDP traffic to reach the correct destination. Jakub adds retry mechanism for AdminQ Read/Write SFF EEPROM call to follow hardware specification on ice. Zilin Guan adds cleanup path to free XDP rings on failure in ice_set_ringparam(). Michal bypasses firmware logging unroll in libie when it isn't supported. Kohei Enju fixes iavf to take into account hardware MTU support when setting max MTU values. Vivek Behera fixes issues on igb and igc using incorrect IRQs when Tx/Rx queues do not share the same IRQ. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: igc: Fix trigger of incorrect irq in igc_xsk_wakeup function igb: Fix trigger of incorrect irq in igb_xsk_wakeup iavf: fix netdev->max_mtu to respect actual hardware limit libie: don't unroll if fwlog isn't supported ice: Fix memory leak in ice_set_ringparam() ice: fix retry for AQ command 0x06EE ice: reintroduce retry mechanism for indirect AQ ice: fix adding AQ LLDP filter for VF ==================== Link: https://patch.msgid.link/20260303231155.2895065-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit ff2c591625a6f187164aa256fec2356799ee87e5 Merge: f43ed0c5450cd3 1777f349ff41b6 Author: Jakub Kicinski Date: Wed Mar 4 18:21:15 2026 -0800 Merge branch 'mptcp-misc-fixes-for-v7-0-rc2' Matthieu Baerts says: ==================== mptcp: misc fixes for v7.0-rc2 Here are various unrelated fixes: - Patch 1: avoid bufferbloat in simult_flows selftest which can cause instabilities. A fix for v5.10. - Patches 2-3: reduce RM_ADDR lost by not sending it over the same subflow as the one being removed, if possible. A fix for v5.13. - Patches 4-5: avoid a WARN when using signal + subflow endpoints with a subflow limit of 0, and removing such endpoints during an active connection. A fix for v5.17. ==================== Link: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-0-4b5462b6f016@kernel.org Signed-off-by: Jakub Kicinski commit 1777f349ff41b62dfe27454b69c27b0bc99ffca5 Author: Matthieu Baerts (NGI0) Date: Tue Mar 3 11:56:06 2026 +0100 selftests: mptcp: join: check removing signal+subflow endp This validates the previous commit: endpoints with both the signal and subflow flags should always be marked as used even if it was not possible to create new subflows due to the MPTCP PM limits. For this test, an extra endpoint is created with both the signal and the subflow flags, and limits are set not to create extra subflows. In this case, an ADD_ADDR is sent, but no subflows are created. Still, the local endpoint is marked as used, and no warning is fired when removing the endpoint, after having sent a RM_ADDR. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-5-4b5462b6f016@kernel.org Signed-off-by: Jakub Kicinski commit 579a752464a64cb5f9139102f0e6b90a1f595ceb Author: Matthieu Baerts (NGI0) Date: Tue Mar 3 11:56:05 2026 +0100 mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to find a combination of actions that was generating this warning: msk->pm.local_addr_used == 0 WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline], CPU#1: syz.2.17/961 WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline], CPU#1: syz.2.17/961 WARNING: net/mptcp/pm_kernel.c:1071 at mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210, CPU#1: syz.2.17/961 Modules linked in: CPU: 1 UID: 0 PID: 961 Comm: syz.2.17 Not tainted 6.19.0-08368-gfafda3b4b06b #22 PREEMPT(full) Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.17.0-debian-1.17.0-1build1 04/01/2014 RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_kernel.c:1071 [inline] RIP: 0010:mptcp_nl_remove_subflow_and_signal_addr net/mptcp/pm_kernel.c:1103 [inline] RIP: 0010:mptcp_pm_nl_del_addr_doit+0x81d/0x8f0 net/mptcp/pm_kernel.c:1210 Code: 89 c5 e8 46 30 6f fe e9 21 fd ff ff 49 83 ed 80 e8 38 30 6f fe 4c 89 ef be 03 00 00 00 e8 db 49 df fe eb ac e8 24 30 6f fe 90 <0f> 0b 90 e9 1d ff ff ff e8 16 30 6f fe eb 05 e8 0f 30 6f fe e8 9a RSP: 0018:ffffc90001663880 EFLAGS: 00010293 RAX: ffffffff82de1a6c RBX: 0000000000000000 RCX: ffff88800722b500 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8880158b22d0 R08: 0000000000010425 R09: ffffffffffffffff R10: ffffffff82de18ba R11: 0000000000000000 R12: ffff88800641a640 R13: ffff8880158b1880 R14: ffff88801ec3c900 R15: ffff88800641a650 FS: 00005555722c3500(0000) GS:ffff8880f909d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f66346e0f60 CR3: 000000001607c000 CR4: 0000000000350ef0 Call Trace: genl_family_rcv_msg_doit+0x117/0x180 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x3a8/0x3f0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x16d/0x240 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x3e9/0x4c0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x4aa/0x5b0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xc9/0xf0 net/socket.c:742 ____sys_sendmsg+0x272/0x3b0 net/socket.c:2592 ___sys_sendmsg+0x2de/0x320 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x110/0x1a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x143/0x440 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66346f826d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc83d8bdc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f6634985fa0 RCX: 00007f66346f826d RDX: 00000000040000b0 RSI: 0000200000000740 RDI: 0000000000000007 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6634985fa8 R13: 00007f6634985fac R14: 0000000000000000 R15: 0000000000001770 The actions that caused that seem to be: - Set the MPTCP subflows limit to 0 - Create an MPTCP endpoint with both the 'signal' and 'subflow' flags - Create a new MPTCP connection from a different address: an ADD_ADDR linked to the MPTCP endpoint will be sent ('signal' flag), but no subflows is initiated ('subflow' flag) - Remove the MPTCP endpoint In this case, msk->pm.local_addr_used has been kept to 0 -- because no subflows have been created -- but the corresponding bit in msk->pm.id_avail_bitmap has been cleared when the ADD_ADDR has been sent. This later causes a splat when removing the MPTCP endpoint because msk->pm.local_addr_used has been kept to 0. Now, if an endpoint has both the signal and subflow flags, but it is not possible to create subflows because of the limits or the c-flag case, then the local endpoint counter is still incremented: the endpoint is used at the end. This avoids issues later when removing the endpoint and calling __mark_subflow_endp_available(), which expects msk->pm.local_addr_used to have been previously incremented if the endpoint was marked as used according to msk->pm.id_avail_bitmap. Note that signal_and_subflow variable is reset to false when the limits and the c-flag case allows subflows creation. Also, local_addr_used is only incremented for non ID0 subflows. Fixes: 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/613 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-4-4b5462b6f016@kernel.org Signed-off-by: Jakub Kicinski commit 560edd99b5f58b2d4bbe3c8e51e1eed68d887b0e Author: Matthieu Baerts (NGI0) Date: Tue Mar 3 11:56:04 2026 +0100 selftests: mptcp: join: check RM_ADDR not sent over same subflow This validates the previous commit: RM_ADDR were sent over the first found active subflow which could be the same as the one being removed. It is more likely to loose this notification. For this check, RM_ADDR are explicitly dropped when trying to send them over the initial subflow, when removing the endpoint attached to it. If it is dropped, the test will complain because some RM_ADDR have not been received. Note that only the RM_ADDR are dropped, to allow the linked subflow to be quickly and cleanly closed. To only drop those RM_ADDR, a cBPF byte code is used. If the IPTables commands fail, that's OK, the tests will continue to pass, but not validate this part. This can be ignored: another subtest fully depends on such command, and will be marked as skipped. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 8dd5efb1f91b ("mptcp: send ack for rm_addr") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-3-4b5462b6f016@kernel.org Signed-off-by: Jakub Kicinski commit fb8d0bccb221080630efcd9660c9f9349e53cc9e Author: Matthieu Baerts (NGI0) Date: Tue Mar 3 11:56:03 2026 +0100 mptcp: pm: avoid sending RM_ADDR over same subflow RM_ADDR are sent over an active subflow, the first one in the subflows list. There is then a high chance the initial subflow is picked. With the in-kernel PM, when an endpoint is removed, a RM_ADDR is sent, then linked subflows are closed. This is done for each active MPTCP connection. MPTCP endpoints are likely removed because the attached network is no longer available or usable. In this case, it is better to avoid sending this RM_ADDR over the subflow that is going to be removed, but prefer sending it over another active and non stale subflow, if any. This modification avoids situations where the other end is not notified when a subflow is no longer usable: typically when the endpoint linked to the initial subflow is removed, especially on the server side. Fixes: 8dd5efb1f91b ("mptcp: send ack for rm_addr") Cc: stable@vger.kernel.org Reported-by: Frank Lorenz Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/612 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-2-4b5462b6f016@kernel.org Signed-off-by: Jakub Kicinski commit 8c09412e584d9bcc0e71d758ec1008d1c8d1a326 Author: Paolo Abeni Date: Tue Mar 3 11:56:02 2026 +0100 selftests: mptcp: more stable simult_flows tests By default, the netem qdisc can keep up to 1000 packets under its belly to deal with the configured rate and delay. The simult flows test-case simulates very low speed links, to avoid problems due to slow CPUs and the TCP stack tend to transmit at a slightly higher rate than the (virtual) link constraints. All the above causes a relatively large amount of packets being enqueued in the netem qdiscs - the longer the transfer, the longer the queue - producing increasingly high TCP RTT samples and consequently increasingly larger receive buffer size due to DRS. When the receive buffer size becomes considerably larger than the needed size, the tests results can flake, i.e. because minimal inaccuracy in the pacing rate can lead to a single subflow usage towards the end of the connection for a considerable amount of data. Address the issue explicitly setting netem limits suitable for the configured link speeds and unflake all the affected tests. Fixes: 1a418cb8e888 ("mptcp: simult flow self-tests") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260303-net-mptcp-misc-fixes-7-0-rc2-v1-1-4b5462b6f016@kernel.org Signed-off-by: Jakub Kicinski commit f43ed0c5450cd3a68313c9fd02b298fc58fd4b80 Merge: 40bf00ec2ee271 d793458c45df2a Author: Jakub Kicinski Date: Wed Mar 4 18:15:51 2026 -0800 Merge branch 'nfc-fix-leaks-and-races-surfaced-by-nipa' Jakub Kicinski says: ==================== nfc: fix leaks and races surfaced by NIPA I recently added the nci test to NIPA. Somewhat surprisingly it runs without much settup but hits kmemleaks fairly often. Fix a handful of issues to make the test pass in a stable way. ==================== Link: https://patch.msgid.link/20260303162346.2071888-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d793458c45df2aed498d7f74145eab7ee22d25aa Author: Jakub Kicinski Date: Tue Mar 3 08:23:45 2026 -0800 nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references. Set SEND_SHUTDOWN first so that if tx_work is already running it will see the flag and skip transmitting, then use cancel_work_sync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs. Fixes: 23b7869c0fd0 ("NFC: add the NFC socket raw protocol") Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260303162346.2071888-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 0efdc02f4f6d52f8ca5d5889560f325a836ce0a8 Author: Jakub Kicinski Date: Tue Mar 3 08:23:44 2026 -0800 nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback Move clear_bit(NCI_DATA_EXCHANGE) before invoking the data exchange callback in nci_data_exchange_complete(). The callback (e.g. rawsock_data_exchange_complete) may immediately schedule another data exchange via schedule_work(tx_work). On a multi-CPU system, tx_work can run and reach nci_transceive() before the current nci_data_exchange_complete() clears the flag, causing test_and_set_bit(NCI_DATA_EXCHANGE) to return -EBUSY and the new transfer to fail. This causes intermittent flakes in nci/nci_dev in NIPA: # # RUN NCI.NCI1_0.t4t_tag_read ... # # t4t_tag_read: Test terminated by timeout # # FAIL NCI.NCI1_0.t4t_tag_read # not ok 3 NCI.NCI1_0.t4t_tag_read Fixes: 38f04c6b1b68 ("NFC: protect nci_data_exchange transactions") Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260303162346.2071888-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 66083581945bd5b8e99fe49b5aeb83d03f62d053 Author: Jakub Kicinski Date: Tue Mar 3 08:23:43 2026 -0800 nfc: nci: complete pending data exchange on device close In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference. NIPA occasionally hits this leak: unreferenced object 0xff1100000f435000 (size 2048): comm "nci_dev", pid 3954, jiffies 4295441245 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ backtrace (crc ec2b3c5): __kmalloc_noprof+0x4db/0x730 sk_prot_alloc.isra.0+0xe4/0x1d0 sk_alloc+0x36/0x760 rawsock_create+0xd1/0x540 nfc_sock_create+0x11f/0x280 __sock_create+0x22d/0x630 __sys_socket+0x115/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0x117/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: 38f04c6b1b68 ("NFC: protect nci_data_exchange transactions") Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260303162346.2071888-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d42449d2c17cdf06d1f63268557450bd3f051e9a Author: Jakub Kicinski Date: Tue Mar 3 08:23:42 2026 -0800 nfc: digital: free skb on digital_in_send error paths digital_in_send() takes ownership of the skb passed by the caller (nfc_data_exchange), make sure it's freed on all error paths. Found looking around the real driver for similar bugs to the one just fixed in nci. Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support") Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260303162346.2071888-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7bd4b0c4779f978a6528c9b7937d2ca18e936e2c Author: Jakub Kicinski Date: Tue Mar 3 08:23:41 2026 -0800 nfc: nci: free skb on nci_transceive early error paths nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes the nci/nci_dev selftest hits the error path occasionally in NIPA, and kmemleak detects leaks: unreferenced object 0xff11000015ce6a40 (size 640): comm "nci_dev", pid 3954, jiffies 4295441246 hex dump (first 32 bytes): 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace (crc 7c40cc2a): kmem_cache_alloc_node_noprof+0x492/0x630 __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xc6/0x8f0 sock_alloc_send_pskb+0x326/0x3f0 nfc_alloc_send_skb+0x94/0x1d0 rawsock_sendmsg+0x162/0x4c0 do_syscall_64+0x117/0xfc0 Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260303162346.2071888-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 40bf00ec2ee271df5ba67593991760adf8b5d0ed Author: Bobby Eshleman Date: Mon Mar 2 16:32:56 2026 -0800 net: devmem: use READ_ONCE/WRITE_ONCE on binding->dev binding->dev is protected on the write-side in mp_dmabuf_devmem_uninstall() against concurrent writes, but due to the concurrent bare reads in net_devmem_get_binding() and validate_xmit_unreadable_skb() it should be wrapped in a READ_ONCE/WRITE_ONCE pair to make sure no compiler optimizations play with the underlying register in unforeseen ways. Doesn't present a critical bug because the known compiler optimizations don't result in bad behavior. There is no tearing on u64, and load omissions/invented loads would only break if additional binding->dev references were inlined together (they aren't right now). This just more strictly follows the linux memory model (i.e., "Lock-Protected Writes With Lockless Reads" in tools/memory-model/Documentation/access-marking.txt). Fixes: bd61848900bf ("net: devmem: Implement TX path") Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260302-devmem-membar-fix-v2-1-5b33c9cbc28b@meta.com Signed-off-by: Jakub Kicinski commit a4c2b8be2e5329e7fac6e8f64ddcb8958155cfcb Author: Eric Dumazet Date: Wed Mar 4 01:56:40 2026 +0000 net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset() When/if a NIC resets, queues are deactivated by dev_deactivate_many(), then reactivated when the reset operation completes. fq_reset() removes all the skbs from various queues. If we do not clear q->band_pkt_count[], these counters keep growing and can eventually reach sch->limit, preventing new packets to be queued. Many thanks to Praveen for discovering the root cause. Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling") Diagnosed-by: Praveen Kaligineedi Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260304015640.961780-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit f7d92f11bd33a6eb49c7c812255ef4ab13681f0f Author: Ian Ray Date: Mon Mar 2 18:32:37 2026 +0200 net: nfc: nci: Fix zero-length proprietary notifications NCI NFC controllers may have proprietary OIDs with zero-length payload. One example is: drivers/nfc/nxp-nci/core.c, NXP_NCI_RF_TXLDO_ERROR_NTF. Allow a zero length payload in proprietary notifications *only*. Before: -- >8 -- kernel: nci: nci_recv_frame: len 3 -- >8 -- After: -- >8 -- kernel: nci: nci_recv_frame: len 3 kernel: nci: nci_ntf_packet: NCI RX: MT=ntf, PBF=0, GID=0x1, OID=0x23, plen=0 kernel: nci: nci_ntf_packet: unknown ntf opcode 0x123 kernel: nfc nfc0: NFC: RF transmitter couldn't start. Bad power and/or configuration? -- >8 -- After fixing the hardware: -- >8 -- kernel: nci: nci_recv_frame: len 27 kernel: nci: nci_ntf_packet: NCI RX: MT=ntf, PBF=0, GID=0x1, OID=0x5, plen=24 kernel: nci: nci_rf_intf_activated_ntf_packet: rf_discovery_id 1 -- >8 -- Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet") Signed-off-by: Ian Ray Link: https://patch.msgid.link/20260302163238.140576-1-ian.ray@gehealthcare.com Signed-off-by: Jakub Kicinski commit 165573e41f2f66ef98940cf65f838b2cb575d9d1 Author: Eric Dumazet Date: Mon Mar 2 20:55:27 2026 +0000 tcp: secure_seq: add back ports to TS offset This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") tcp_tw_recycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways. One of them is to bring back TCP ports in TS offset randomization. As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset. Fixes: 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") Reported-by: Zhouyan Deng Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Acked-by: Florian Westphal Link: https://patch.msgid.link/20260302205527.1982836-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7f083faf59d14c04e01ec05a7507f036c965acf8 Author: Koichiro Den Date: Sat Feb 28 23:53:07 2026 +0900 net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush qdiscs for queues which will no longer be used. qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with qdisc_lock(). However, for lockless qdiscs, the dequeue path is serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so qdisc_reset() can run concurrently with __qdisc_run() and free skbs while they are still being dequeued, leading to UAF. This can easily be reproduced on e.g. virtio-net by imposing heavy traffic while frequently changing the number of queue pairs: iperf3 -ub0 -c $peer -t 0 & while :; do ethtool -L eth0 combined 1 ethtool -L eth0 combined 2 done With KASAN enabled, this leads to reports like: BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760 ... Call Trace: ... __qdisc_run+0x133f/0x1760 __dev_queue_xmit+0x248f/0x3550 ip_finish_output2+0xa42/0x2110 ip_output+0x1a7/0x410 ip_send_skb+0x2e6/0x480 udp_send_skb+0xb0a/0x1590 udp_sendmsg+0x13c9/0x1fc0 ... Allocated by task 1270 on cpu 5 at 44.558414s: ... alloc_skb_with_frags+0x84/0x7c0 sock_alloc_send_pskb+0x69a/0x830 __ip_append_data+0x1b86/0x48c0 ip_make_skb+0x1e8/0x2b0 udp_sendmsg+0x13a6/0x1fc0 ... Freed by task 1306 on cpu 3 at 44.558445s: ... kmem_cache_free+0x117/0x5e0 pfifo_fast_reset+0x14d/0x580 qdisc_reset+0x9e/0x5f0 netif_set_real_num_tx_queues+0x303/0x840 virtnet_set_channels+0x1bf/0x260 [virtio_net] ethnl_set_channels+0x684/0xae0 ethnl_default_set_doit+0x31a/0x890 ... Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the serialization model already used by dev_reset_queue(). Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state reflects an empty queue, avoiding needless re-scheduling. Fixes: 6b3ba9146fe6 ("net: sched: allow qdiscs to handle locking") Signed-off-by: Koichiro Den Link: https://patch.msgid.link/20260228145307.3955532-1-den@valinux.co.jp Signed-off-by: Jakub Kicinski commit 681d787cb61f3616dde8d4b747bacf03b3e4d665 Merge: 11439c4635edd6 65b5c326ce4103 Author: Dave Airlie Date: Thu Mar 5 10:57:30 2026 +1000 Merge tag 'amd-drm-fixes-7.0-2026-03-04' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-03-04: amdgpu: - LUT fixes - VCN5 fix - Dispclk fix - SMU 13.x fix - Fix race in VM acquire - PSP 15.x fix - UserQ fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260304204837.1937266-1-alexander.deucher@amd.com commit 25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43 Author: Sanman Pradhan Date: Wed Mar 4 15:51:17 2026 -0800 hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read The q54sj108a2_debugfs_read function suffers from a stack buffer overflow due to incorrect arguments passed to bin2hex(). The function currently passes 'data' as the destination and 'data_char' as the source. Because bin2hex() converts each input byte into two hex characters, a 32-byte block read results in 64 bytes of output. Since 'data' is only 34 bytes (I2C_SMBUS_BLOCK_MAX + 2), this writes 30 bytes past the end of the buffer onto the stack. Additionally, the arguments were swapped: it was reading from the zero-initialized 'data_char' and writing to 'data', resulting in all-zero output regardless of the actual I2C read. Fix this by: 1. Expanding 'data_char' to 66 bytes to safely hold the hex output. 2. Correcting the bin2hex() argument order and using the actual read count. 3. Using a pointer to select the correct output buffer for the final simple_read_from_buffer call. Fixes: d014538aa385 ("hwmon: (pmbus) Driver for Delta power supplies Q54SJ108A2") Cc: stable@vger.kernel.org Signed-off-by: Sanman Pradhan Link: https://lore.kernel.org/r/20260304235116.1045-1-sanman.p211993@gmail.com Signed-off-by: Guenter Roeck commit c649e99764f6baeddb65e9b88a24df082636a8f4 Merge: 18b43bec543791 7e1e6d6845329a Author: Jakub Kicinski Date: Wed Mar 4 16:47:45 2026 -0800 Merge tag 'linux-can-fixes-for-7.0-20260302' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-03-02 The first 2 patches are by Oliver Hartkopp. The first fixes the locking for CAN Broadcast Manager op runtime updates, the second fixes the packet statisctics for the CAN dummy driver. Alban Bedel's patch fixes a potential problem in the error path of the mcp251x's ndo_open callback. A patch by Ziyi Guo add USB endpoint type validation to the esd_usb driver. The next 6 patches are by Greg Kroah-Hartman and fix URB data parsing for the ems_usb and ucan driver, fix URB anchoring in the etas_es58x, and in the f81604 driver fix URB data parsing, add URB error handling and fix URB anchoring. A patch by me targets the gs_usb driver and fixes interoperability with the CANable-2.5 firmware by always configuring the bit rate before starting the device. The last patch is by Frank Li and fixes a CHECK_DTBS warning for the nxp,sja1000 dt-binding. * tag 'linux-can-fixes-for-7.0-20260302' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: dt-bindings: net: can: nxp,sja1000: add reference to mc-peripheral-props.yaml can: gs_usb: gs_can_open(): always configure bitrates before starting device can: usb: f81604: correctly anchor the urb in the read bulk callback can: usb: f81604: handle bulk write errors properly can: usb: f81604: handle short interrupt urb messages properly can: usb: etas_es58x: correctly anchor the urb in the read bulk callback can: ucan: Fix infinite loop from zero-length messages can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message can: esd_usb: add endpoint type validation can: mcp251x: fix deadlock in error path of mcp251x_open can: dummy_can: dummy_can_init(): fix packet statistics can: bcm: fix locking for bcm_op runtime updates ==================== Link: https://patch.msgid.link/20260302152755.1700177-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 18b43bec5437914e3b51bb08dc6c6e7b0a2df4d1 Author: Jason Xing Date: Tue Mar 3 11:37:20 2026 +0800 mailmap: reflect my gmail as default Use my gmail instead so that I can easily handle those emails that CC me. Signed-off-by: Jason Xing Link: https://patch.msgid.link/20260303033720.84108-1-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit c107785c7e8dbabd1c18301a1c362544b5786282 Merge: 0b3bb205808195 f9d69d5e7bde22 Author: Linus Torvalds Date: Wed Mar 4 15:42:24 2026 -0800 Merge tag 'modules-7.0-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module fixes from Sami Tolvanen: - Fix a potential kernel panic in the module loader by adding a bounds check for the ELF section index. This prevents crashes if attempting to load a module that uses SHN_XINDEX or is corrupted. - Fix the Kconfig menu layout for module versioning, signing, and compression options so they correctly appear as submenus in menuconfig. - Remove a redundant lockdep_free_key_range() call in the load_module() error path. This is already handled by module_deallocate() calling free_mod_mem() since the module_memory rework. * tag 'modules-7.0-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: module: Fix kernel panic when a symbol st_shndx is out of bounds module: Fix the modversions and signing submenus module: Remove duplicate freeing of lockdep classes commit 2697c45a481a299faa575a55cf1ff41826024e4f Merge: 126fe7ef12ffe4 4e10a730d1b511 Author: Jakub Kicinski Date: Wed Mar 4 15:29:56 2026 -0800 Merge tag 'wireless-2026-03-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Some more fixes: - mt76 gets three almost identical new length checks - cw1200 & ti: locking fixes - mac80211 has a fix for the recent EML frame handling - rsi driver no longer oddly responds to config, which had triggered a warning in mac80211 - ath12k has two fixes for station statistics handling * tag 'wireless-2026-03-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() wifi: wlcore: Fix a locking bug wifi: cw1200: Fix locking in error paths wifi: mac80211: fix missing ieee80211_eml_params member initialization wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config wifi: ath12k: fix station lookup failure when disconnecting from AP wifi: ath12k: use correct pdev id when requesting firmware stats ==================== Link: https://patch.msgid.link/20260304112500.169639-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 0b3bb205808195159be633a8cefb602670e856fb Merge: ecc64d2dc9ff97 d320f160aa5ff3 Author: Linus Torvalds Date: Wed Mar 4 15:03:16 2026 -0800 Merge tag 'vfs-7.0-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - kthread: consolidate kthread exit paths to prevent use-after-free - iomap: - don't mark folio uptodate if read IO has bytes pending - don't report direct-io retries to fserror - reject delalloc mappings during writeback - ns: tighten visibility checks - netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence * tag 'vfs-7.0-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: reject delalloc mappings during writeback iomap: don't mark folio uptodate if read IO has bytes pending selftests: fix mntns iteration selftests nstree: tighten permission checks for listing nsfs: tighten permission checks for handle opening nsfs: tighten permission checks for ns iteration ioctls netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence kthread: consolidate kthread exit paths to prevent use-after-free iomap: don't report direct-io retries to fserror commit 126fe7ef12ffe42fdc600fe22df733e96fa418ec Author: Joe Damato Date: Mon Mar 2 18:42:01 2026 -0800 mailmap: Add entry for Joe Damato My Fastly email address is no longer used. Add a mailmap entry to reflect that. Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260303024202.2526604-1-joe@dama.to Signed-off-by: Jakub Kicinski commit 6944e6d8a6d4c1e654de1da112da8fef1b30e623 Author: Cheng-Yang Chou Date: Thu Mar 5 03:57:57 2026 +0800 sched_ext/selftests: Fix format specifier and buffer length in file_write_long() Use %ld (not %lu) for signed long, and pass the actual string length returned by sprintf() to write_text() instead of sizeof(buf). Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 170a4b21f49b3dcff3115b4c90758f0a0d77375a Author: Olivier Sobrie Date: Wed Mar 4 22:20:39 2026 +0100 hwmon: (max6639) fix inverted polarity According to MAX6639 documentation: D1: PWM Output Polarity. PWM output is low at 100% duty cycle when this bit is set to zero. PWM output is high at 100% duty cycle when this bit is set to 1. Up to commit 0f33272b60ed ("hwmon: (max6639) : Update hwmon init using info structure"), the polarity was set to high (0x2) when no platform data was set. After the patch, the polarity register wasn't set anymore if no platform data was specified. Nowadays, since commit 7506ebcd662b ("hwmon: (max6639) : Configure based on DT property"), it is always set to low which doesn't match with the comment above and change the behavior compared to versions prior 0f33272b60ed. Fixes: 0f33272b60ed ("hwmon: (max6639) : Update hwmon init using info structure") Signed-off-by: Olivier Sobrie Link: https://lore.kernel.org/r/20260304212039.570274-1-olivier@sobrie.be Signed-off-by: Guenter Roeck commit 8f3c6f08ababad2e3bdd239728cf66a9949446b4 Author: Dave Airlie Date: Tue Feb 24 13:17:50 2026 +1000 nouveau/dpcd: return EBUSY for aux xfer if the device is asleep If we have runtime suspended, and userspace wants to use /dev/drm_dp_* then just tell it the device is busy instead of crashing in the GSP code. WARNING: CPU: 2 PID: 565741 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c:164 r535_gsp_msgq_wait+0x9a/0xb0 [nouveau] CPU: 2 UID: 0 PID: 565741 Comm: fwupd Not tainted 6.18.10-200.fc43.x86_64 #1 PREEMPT(lazy) Hardware name: LENOVO 20QTS0PQ00/20QTS0PQ00, BIOS N2OET65W (1.52 ) 08/05/2024 RIP: 0010:r535_gsp_msgq_wait+0x9a/0xb0 [nouveau] This is a simple fix to get backported. We should probably engineer a proper power domain solution to wake up devices and keep them awake while fw updates are happening. Cc: stable@vger.kernel.org Fixes: 8894f4919bc4 ("drm/nouveau: register a drm_dp_aux channel for each dp connector") Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260224031750.791621-1-airlied@gmail.com Signed-off-by: Danilo Krummrich commit 22e6afddb5f92955006564fbba199f82d3972ae4 Merge: 4bc732b00a9f1f e0cf84109bc6c6 Author: Arnd Bergmann Date: Wed Mar 4 21:42:21 2026 +0100 Merge tag 'reset-fixes-for-v7.0' of https://git.pengutronix.de/git/pza/linux into arm/fixes Reset controller fixes for v7.0 * Fix NULL pointer dereference in reset-rzg2l-usbphy-ctrl driver for renesas,rzg2l-usbphy-ctrl devices without pwrrdy control. * tag 'reset-fixes-for-v7.0' of https://git.pengutronix.de/git/pza/linux: reset: rzg2l-usbphy-ctrl: Check pwrrdy is valid before using it Signed-off-by: Arnd Bergmann commit 4bc732b00a9f1f31f130e2dc3668e2760f2e961b Merge: b69d48137ea138 3f4e403304186d Author: Arnd Bergmann Date: Wed Mar 4 21:39:09 2026 +0100 Merge tag 'soc_fsl-7.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux into arm/fixes FSL SOC Fixes for 7.0 - Fix a race condition in Freescale Queue and Buffer Manager. - Fix a trivial error verification in CPM1 * tag 'soc_fsl-7.0-2' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux: soc: fsl: cpm1: qmc: Fix error check for devm_ioremap_resource() in qmc_qe_init_resources() soc: fsl: qbman: fix race condition in qman_destroy_fq Signed-off-by: Arnd Bergmann commit b69d48137ea138e054f7d40e72306ef7ef85548d Merge: 11439c4635edd6 0528a348b04b32 Author: Arnd Bergmann Date: Wed Mar 4 21:35:01 2026 +0100 Merge tag 'riscv-soc-fixes-for-v7.0-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V soc fixes for v7.0-rc1 drivers: Fix leaks in probe/init function teardown code in three drivers. microchip: Fix a warning introduced by a recent binding change, that made resets required on Polarfire SoC's CAN IP. Signed-off-by: Conor Dooley * tag 'riscv-soc-fixes-for-v7.0-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() cache: starfive: fix device node leak in starlink_cache_init() riscv: dts: microchip: add can resets to mpfs soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe() Signed-off-by: Arnd Bergmann commit 5b2a16ab0dbd090dc545c05ee79a077cc7a9c1e0 Author: Loic Poulain Date: Mon Feb 2 16:56:11 2026 +0100 arm64: dts: qcom: monaco: Fix UART10 pinconf UART10 RTS and TX pins were incorrectly mapped to gpio84 and gpio85. Correct them to gpio85 (RTS) and gpio86 (TX) to match the hardware I/O mapping. Fixes: 467284a3097f ("arm64: dts: qcom: qcs8300: Add QUPv3 configuration") Signed-off-by: Loic Poulain Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260202155611.1568-1-loic.poulain@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f82859c84a9862e242c904e72fb0625fef9b24e7 Author: Lizhi Hou Date: Wed Mar 4 11:50:12 2026 -0800 accel/amdxdna: Fix major version check on NPU1 platform Add the missing major number in npu1_fw_feature_table. Without the major version specified, the firmware feature check fails, preventing new firmware commands from being enabled on the NPU1 platform. With the correct major version populated, the driver properly detects firmware support and enables the new command. Fixes: f1eac46fe5f7 ("accel/amdxdna: Update firmware version check for latest firmware") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260304195012.3616908-1-lizhi.hou@amd.com commit da994db94e60f9a9411108ddf4d1836147ad4c9c Author: Bjorn Andersson Date: Fri Feb 20 15:11:48 2026 -0600 remoteproc: sysmon: Correct subsys_name_len type in QMI request The QMI message encoder has up until recently read a single byte (as elem_size == 1), but with the introduction of big endian support it's become apparent that this field is expected to be a full u32 - regardless of the size of the length in the encoded message (which is what elem_size specifies). The result is that the encoder now reads past the length byte and rejects the unreasonably large length formed when including the following 3 bytes from the subsys_name array. Fix this by changing to the expected type. Fixes: 1fb82ee806d1 ("remoteproc: qcom: Introduce sysmon") Signed-off-by: Bjorn Andersson Reviewed-by: Chris Lew Link: https://lore.kernel.org/r/20260220-qmi-encode-invalid-length-v2-1-5674be35ab29@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e48a869957a70cc39b4090cd27c36a86f8db9b92 Author: Miroslav Lichvar Date: Wed Feb 25 09:51:35 2026 +0100 timekeeping: Fix timex status validation for auxiliary clocks The timekeeping_validate_timex() function validates the timex status of an auxiliary system clock even when the status is not to be changed, which causes unexpected errors for applications that make read-only clock_adjtime() calls, or set some other timex fields, but without clearing the status field. Do the AUX-specific status validation only when the modes field contains ADJ_STATUS, i.e. the application is actually trying to change the status. This makes the AUX-specific clock_adjtime() behavior consistent with CLOCK_REALTIME. Fixes: 4eca49d0b621 ("timekeeping: Prepare do_adtimex() for auxiliary clocks") Signed-off-by: Miroslav Lichvar Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260225085231.276751-1-mlichvar@redhat.com commit 65b5c326ce4103620c977b8dcb1699bdac4da143 Author: Sunil Khatri Date: Mon Mar 2 18:50:46 2026 +0530 drm/amdgpu/userq: refcount userqueues to avoid any race conditions To avoid race condition and avoid UAF cases, implement kref based queues and protect the below operations using xa lock a. Getting a queue from xarray b. Increment/Decrement it's refcount Every time some one want to access a queue, always get via amdgpu_userq_get to make sure we have locks in place and get the object if active. A userqueue is destroyed on the last refcount is dropped which typically would be via IOCTL or during fini. v2: Add the missing drop in one the condition in the signal ioclt [Alex] v3: remove the queue from the xarray first in the free queue ioctl path [Christian] - Pass queue to the amdgpu_userq_put directly. - make amdgpu_userq_put xa_lock free since we are doing put for each get only and final put is done via destroy and we remove the queue from xa with lock. - use userq_put in fini too so cleanup is done fully. v4: Use xa_erase directly rather than doing load and erase in free ioctl. Also remove some of the error logs which could be exploited by the user to flood the logs [Christian] Signed-off-by: Sunil Khatri Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 4952189b284d4d847f92636bb42dd747747129c0) Cc: # 048c1c4e5171: drm/amdgpu/userq: Consolidate wait ioctl exit path Cc: commit 048c1c4e51715ffddd4189745c07f530f34fbe37 Author: Tvrtko Ursulin Date: Mon Feb 23 12:41:32 2026 +0000 drm/amdgpu/userq: Consolidate wait ioctl exit path If we gate the fence destruction with a check telling us whether there are valid pointers in there we can eliminate the need for dual, basically identical, exit paths. Reviewed-by: Alex Deucher Signed-off-by: Tvrtko Ursulin Signed-off-by: Alex Deucher (cherry picked from commit bea29bb0dd29012949cd44fdb122465a9fd5cf91) commit a145bbff6f53ab80757a15eba5ad2ba8e3bdc9dc Author: sguttula Date: Wed Feb 25 13:57:01 2026 +0530 drm/amdgpu/psp: Use Indirect access address for GFX to PSP mailbox The reason the RAP is not granting access to 0x58200 is that a dedicated RSMU slot would have to be spent for this address range, and MPASP is close to running out of RSMU slots. This will help to fix PSP TOC load failure during secureboot. GFX Driver Need to use indirect access for SMN address regs. Signed-off-by: sguttula Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 9b822e26eea3899003aa8a89d5e2c4408e066e20) commit 2c1030f2e84885cc58bffef6af67d5b9d2e7098f Author: Alysa Liu Date: Thu Feb 5 11:21:45 2026 -0500 drm/amdgpu: Fix use-after-free race in VM acquire Replace non-atomic vm->process_info assignment with cmpxchg() to prevent race when parent/child processes sharing a drm_file both try to acquire the same VM after fork(). Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alysa Liu Signed-off-by: Alex Deucher (cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618) Cc: stable@vger.kernel.org commit 68785c5e79e0fc1eacf63026fbba32be3867f410 Author: Yang Wang Date: Wed Feb 25 22:51:06 2026 -0500 drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x v1: The metrics->EnergyAccumulator field has been deprecated on newer pmfw. v2: add smu 13.0.0/13.0.7/13.0.10 support. Signed-off-by: Yang Wang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 8de9edb35976fa56565dc8fbb5d1310e8e10187c) Cc: stable@vger.kernel.org commit b12bbe35c7c1e431f2fa01fe9291daa52fb7ab43 Author: Lorenzo Stoakes (Oracle) Date: Tue Mar 3 19:50:25 2026 +0000 MAINTAINERS, mailmap: update email address for Lorenzo Stoakes I want to experiment with a new email setup, and using the @kernel.org address is the easiest way to have flexibility on this. Link: https://lkml.kernel.org/r/20260303195025.1170895-1-ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) Signed-off-by: Andrew Morton commit 599b4e290c8766b19378d85d4310c6ec8f90ade4 Author: Randy Dunlap Date: Sun Mar 1 16:52:22 2026 -0800 mm/mmu_notifier: clean up mmu_notifier.h kernel-doc Eliminate kernel-doc warnings in mmu_notifier.h: - add a missing struct short description - use the correct format for function parameters - add missing function return comment sections Warning: include/linux/mmu_notifier.h:236 missing initial short description on line: * struct mmu_interval_notifier_ops Warning: include/linux/mmu_notifier.h:325 function parameter 'interval_sub' not described in 'mmu_interval_set_seq' Warning: include/linux/mmu_notifier.h:325 function parameter 'cur_seq' not described in 'mmu_interval_set_seq' Warning: include/linux/mmu_notifier.h:346 function parameter 'interval_sub' not described in 'mmu_interval_read_retry' Warning: include/linux/mmu_notifier.h:346 function parameter 'seq' not described in 'mmu_interval_read_retry' Warning: include/linux/mmu_notifier.h:346 No description found for return value of 'mmu_interval_read_retry' Warning: include/linux/mmu_notifier.h:370 function parameter 'interval_sub' not described in 'mmu_interval_check_retry' Warning: include/linux/mmu_notifier.h:370 function parameter 'seq' not described in 'mmu_interval_check_retry' Warning: include/linux/mmu_notifier.h:370 No description found for return value of 'mmu_interval_check_retry' Link: https://lkml.kernel.org/r/20260302005222.3470783-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Reviewed-by: Jason Gunthorpe Cc: David Hildenbrand Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Randy Dunlap Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7392f8e4ea632622b2cd2086675ba022db238b3a Author: Randy Dunlap Date: Sun Mar 1 16:52:29 2026 -0800 uaccess: correct kernel-doc parameter format Use the correct kernel-doc function parameter format to avoid kernel-doc warnings: Warning: include/linux/uaccess.h:814 function parameter 'uptr' not described in 'scoped_user_rw_access_size' Warning: include/linux/uaccess.h:826 function parameter 'uptr' not described in 'scoped_user_rw_access' Link: https://lkml.kernel.org/r/20260302005229.3471955-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 577a1f495fd78d8fb61b67ac3d3b595b01f6fcb0 Author: Zi Yan Date: Mon Mar 2 15:31:59 2026 -0500 mm/huge_memory: fix a folio_split() race condition with folio_try_get() During a pagecache folio split, the values in the related xarray should not be changed from the original folio at xarray split time until all after-split folios are well formed and stored in the xarray. Current use of xas_try_split() in __split_unmapped_folio() lets some after-split folios show up at wrong indices in the xarray. When these misplaced after-split folios are unfrozen, before correct folios are stored via __xa_store(), and grabbed by folio_try_get(), they are returned to userspace at wrong file indices, causing data corruption. More detailed explanation is at the bottom. The reproducer is at: https://github.com/dfinity/thp-madv-remove-test It 1. creates a memfd, 2. forks, 3. in the child process, maps the file with large folios (via shmem code path) and reads the mapped file continuously with 16 threads, 4. in the parent process, uses madvise(MADV_REMOVE) to punch poles in the large folio. Data corruption can be observed without the fix. Basically, data from a wrong page->index is returned. Fix it by using the original folio in xas_try_split() calls, so that folio_try_get() can get the right after-split folios after the original folio is unfrozen. Uniform split, split_huge_page*(), is not affected, since it uses xas_split_alloc() and xas_split() only once and stores the original folio in the xarray. Change xas_split() used in uniform split branch to use the original folio to avoid confusion. Fixes below points to the commit introduces the code, but folio_split() is used in a later commit 7460b470a131f ("mm/truncate: use folio_split() in truncate operation"). More details: For example, a folio f is split non-uniformly into f, f2, f3, f4 like below: +----------------+---------+----+----+ | f | f2 | f3 | f4 | +----------------+---------+----+----+ but the xarray would look like below after __split_unmapped_folio() is done: +----------------+---------+----+----+ | f | f2 | f3 | f3 | +----------------+---------+----+----+ After __split_unmapped_folio(), the code changes the xarray and unfreezes after-split folios: 1. unfreezes f2, __xa_store(f2) 2. unfreezes f3, __xa_store(f3) 3. unfreezes f4, __xa_store(f4), which overwrites the second f3 to f4. 4. unfreezes f. Meanwhile, a parallel filemap_get_entry() can read the second f3 from the xarray and use folio_try_get() on it at step 2 when f3 is unfrozen. Then, f3 is wrongly returned to user. After the fix, the xarray looks like below after __split_unmapped_folio(): +----------------+---------+----+----+ | f | f | f | f | +----------------+---------+----+----+ so that the race window no longer exists. [ziy@nvidia.com: move comment, per David] Link: https://lkml.kernel.org/r/5C9FA053-A4C6-4615-BE05-74E47A6462B3@nvidia.com Link: https://lkml.kernel.org/r/20260302203159.3208341-1-ziy@nvidia.com Fixes: 00527733d0dc ("mm/huge_memory: add two new (not yet used) functions for folio_split()") Signed-off-by: Zi Yan Reported-by: Bas van Dijk Closes: https://lore.kernel.org/all/CAKNNEtw5_kZomhkugedKMPOG-sxs5Q5OLumWJdiWXv+C9Yct0w@mail.gmail.com/ Tested-by: Lance Yang Reviewed-by: Lorenzo Stoakes Reviewed-by: Wei Yang Reviewed-by: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Hugh Dickins Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Nico Pache Cc: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit 431b04f0084d244569e81ca4216a40644b23b0c5 Author: Vlastimil Babka (SUSE) Date: Mon Mar 2 11:13:46 2026 +0100 MAINTAINERS: add co-maintainer and reviewer for SLAB ALLOCATOR Promote Harry Yoo from reviewer to maintainer. Harry's been involved in slab development for multiple years now and doing a great job. Add Hao Li as a new reviewer. Hao has been doing very useful reviews for a while now, so make it official and ensure the Cc's. Link: https://lkml.kernel.org/r/20260302101345.36713-2-vbabka@kernel.org Signed-off-by: Vlastimil Babka (SUSE) Acked-by: Lorenzo Stoakes Acked-by: Harry Yoo Acked-by: Hao Li Acked-by: SeongJae Park Cc: Christoph Lameter Cc: David Rientjes Cc: Roman Gushchin Signed-off-by: Andrew Morton commit 06de173b138513087896f9cf090f30b35846518d Author: Jason Xing Date: Sun Mar 1 10:09:02 2026 +0800 MAINTAINERS: add RELAY entry RELAYFS was originally developed by Tom Zanussi and Karim Yaghmour in 2005[1]. Jens Axboe converted it from filesystem into a generic API in 2006[2] and made it widely known through the notable I/O tracing tool blktrace. In the decade, there remain a few users scatterred across different subsystems, like recently added wifi commit[3] that is an example to show how to communicate between users and kernel. Last year I've already done some maintenance and added/corrected some diagnostic counters. At Tencent, we internally maintain RELAY as one of most crucial components of network observibility platform which was shared a bit at LPC 2025[4][5] and hopefully will be published in the paper this year. RELAY has proven highly efficient due to its inherent design essence. This design becomes the indispensable way to build a 7x24 platform monitoring various hot paths even without any selectively sampling (yes, sampling is commonly used to avoid the overall performance degradation). One of the recommended usages is to use its zerocopy function relay_reserve() to transfer data in a raw format that can be recognized and parsed by the corresponding application to userspace without introducing heavy locks and complicated logic that appears in other types of approaches, like printk. More details can be discovered by reading through the Documentation :) Credits are given to the all the contributors and reviewers for RELAY/RELAYFS in the past and future! Many thanks! [1]: commit e82894f84dbb ("[PATCH] relayfs") [2]: commit b86ff981a825 ("[PATCH] relay: migrate from relayfs to a generic relay API") [3]: commit c1bf6959dd81 ("wifi: ath11k: Register relayfs entries for CFR dump") [4]: https://lpc.events/event/19/contributions/2055/ [5]: https://lpc.events/event/19/contributions/2010/ Link: https://lkml.kernel.org/r/20260301020902.56476-1-kerneljasonxing@gmail.com Signed-off-by: Jason Xing Acked-by: Andrew Morton Acked-by: Jens Axboe Cc: Andriy Shevchenko Cc: Tom Zanussi Signed-off-by: Andrew Morton commit dccd5ee2625d50239510bcd73ed78559005e00a3 Author: Hao Li Date: Thu Feb 26 19:51:37 2026 +0800 memcg: fix slab accounting in refill_obj_stock() trylock path In the trylock path of refill_obj_stock(), mod_objcg_mlstate() should use the real alloc/free bytes (i.e., nr_acct) for accounting, rather than nr_bytes. The user-visible impact is that the NR_SLAB_RECLAIMABLE_B and NR_SLAB_UNRECLAIMABLE_B stats can end up being incorrect. For example, if a user allocates a 6144-byte object, then before this fix efill_obj_stock() calls mod_objcg_mlstate(..., nr_bytes=2048), even though it should account for 6144 bytes (i.e., nr_acct). When the user later frees the same object with kfree(), refill_obj_stock() calls mod_objcg_mlstate(..., nr_bytes=6144). This ends up adding 6144 to the stats, but it should be applying -6144 (i.e., nr_acct) since the object is being freed. Link: https://lkml.kernel.org/r/20260226115145.62903-1-hao.li@linux.dev Fixes: 200577f69f29 ("memcg: objcg stock trylock without irq disabling") Signed-off-by: Hao Li Acked-by: Shakeel Butt Acked-by: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit a1e59fc6ee4ed8988ea4aeb9224e75d03175be9c Author: Ritesh Harjani (IBM) Date: Thu Feb 26 17:56:30 2026 +0530 mm/hugetlb.c: use __pa() instead of virt_to_phys() in early bootmem alloc code Architecture like powerpc, checks for pfn_valid() in their virt_to_phys() implementation (when CONFIG_DEBUG_VIRTUAL is enabled) [1]. Commit d49004c5f0c1 "arch, mm: consolidate initialization of nodes, zones and memory map" changed the order of initialization between hugetlb_bootmem_alloc() and free_area_init(). This means, pfn_valid() can now return false in alloc_bootmem() path, since sparse_init() is not yet done. Since, alloc_bootmem() uses memblock_alloc(.., MEMBLOCK_ALLOC_ACCESSIBLE), this means these allocations are always going to happen below high_memory, where __pa() should return valid physical addresses. Hence this patch converts the two callers of virt_to_phys() in alloc_bootmem() path to __pa() to avoid this bootup warning: ------------[ cut here ]------------ WARNING: arch/powerpc/include/asm/io.h:879 at virt_to_phys+0x44/0x1b8, CPU#0: swapper/0 Modules linked in: <...> NIP [c000000000601584] virt_to_phys+0x44/0x1b8 LR [c000000004075de4] alloc_bootmem+0x144/0x1a8 Call Trace: [c000000004d1fb50] [c000000004075dd4] alloc_bootmem+0x134/0x1a8 [c000000004d1fba0] [c000000004075fac] __alloc_bootmem_huge_page+0x164/0x230 [c000000004d1fbe0] [c000000004030bc4] alloc_bootmem_huge_page+0x44/0x138 [c000000004d1fc10] [c000000004076e48] hugetlb_hstate_alloc_pages+0x350/0x5ac [c000000004d1fd30] [c0000000040782f0] hugetlb_bootmem_alloc+0x15c/0x19c [c000000004d1fd70] [c00000000406d7b4] mm_core_init_early+0x7c/0xdf4 [c000000004d1ff30] [c000000004011d84] start_kernel+0xac/0xc58 [c000000004d1ffe0] [c00000000000e99c] start_here_common+0x1c/0x20 [1]: https://lore.kernel.org/linuxppc-dev/87tsv5h544.ritesh.list@gmail.com/ Link: https://lkml.kernel.org/r/b4a7d2c6c4c1dd81dddc904fc21f01303290a4b8.1772107852.git.riteshh@linux.ibm.com Fixes: d49004c5f0c1 ("arch, mm: consolidate initialization of nodes, zones and memory map") Signed-off-by: Ritesh Harjani (IBM) Reviewed-by: Mike Rapoport (Microsoft) Cc: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit ba4c3698e6963eacd8e7c86c13343631bfeabe55 Author: Sergey Senozhatsky Date: Thu Feb 26 11:54:21 2026 +0900 zram: rename writeback_compressed device attr Rename writeback_compressed attr to compressed_writeback to avoid possible confusion and have more natural naming. writeback_compressed may look like an alternative version of writeback while in fact writeback_compressed only sets a writeback property. Make this distinction more clear with a new compressed_writeback name. This updates a feature which is new in 7.0-rcX. Link: https://lkml.kernel.org/r/20260226025429.1042083-1-senozhatsky@chromium.org Fixes: 4c1d61389e8e ("zram: introduce writeback_compressed device attribute") Signed-off-by: Sergey Senozhatsky Suggested-by: Minchan Kim Acked-by: Minchan Kim Cc: Brian Geffon Cc: Richard Chang Cc: Suren Baghdasaryan Cc: "Christoph Böhmwalder" Cc: Jens Axboe Cc: Jonathan Corbet Cc: Lars Ellenberg Cc: Philipp Reisner Cc: Shuah Khan Signed-off-by: Andrew Morton commit 5548dd7fa84510f7bbce67c35cc3b388c86aeddf Author: Mike Rapoport (Microsoft) Date: Thu Feb 26 01:31:11 2026 +0200 tools/testing: fix testing/vma and testing/radix-tree build Build of VMA and radix-tree tests is unhappy after the conversion of kzalloc() to kzalloc_obj() in lib/idr.c: cc -I../shared -I. -I../../include -I../../arch/x86/include -I../../../lib -g -Og -Wall -D_LGPL_SOURCE -fsanitize=address -fsanitize=undefined -DNUM_VMA_FLAG_BITS=128 -DNUM_MM_FLAG_BITS=128 -c -o idr.o idr.c idr.c: In function `ida_alloc_range': idr.c:420:34: error: implicit declaration of function `kzalloc_obj'; did you mean `kzalloc_node'? [-Wimplicit-function-declaration] 420 | bitmap = kzalloc_obj(*bitmap, GFP_NOWAIT); | ^~~~~~~~~~~ | kzalloc_node idr.c:420:32: error: assignment to `struct ida_bitmap *' from `int' makes pointer from integer without a cast [-Wint-conversion] 420 | bitmap = kzalloc_obj(*bitmap, GFP_NOWAIT); | ^ idr.c:447:40: error: assignment to `struct ida_bitmap *' from `int' makes pointer from integer without a cast [-Wint-conversion] 447 | bitmap = kzalloc_obj(*bitmap, GFP_NOWAIT); | ^ idr.c:468:15: error: assignment to `struct ida_bitmap *' from `int' makes pointer from integer without a cast [-Wint-conversion] 468 | alloc = kzalloc_obj(*bitmap, gfp); | ^ make: *** [: idr.o] Error 1 Import necessary macros from include/linux to tools/include/linux to fix the compilation. Link: https://lkml.kernel.org/r/20260225233111.2760752-1-rppt@kernel.org Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Signed-off-by: Mike Rapoport (Microsoft) Tested-by: SeongJae Park Reviewed-by: Lorenzo Stoakes Cc: David Hildenbrand Cc: Kees Cook Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 2d28ed588f8d7d0d41b0a4fad7f0d05e4bbf1797 Author: Axel Rasmussen Date: Tue Feb 24 16:24:34 2026 -0800 Revert "ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor()" This change swapped out mod_node_page_state for lruvec_stat_add_folio. But, these two APIs are not interchangeable: the lruvec version also increments memcg stats, in addition to "global" pgdat stats. So after this change, the "pagetables" memcg stat in memory.stat always yields "0", which is a userspace visible regression. I tried to look for a refactor where we add a variant of lruvec_stat_mod_folio which takes a pgdat and a memcg instead of a folio, to try to adhere to the spirit of the original patch. But at the end of the day this just means we have to call folio_memcg(ptdesc_folio(ptdesc)) anyway, which doesn't really accomplish much. This regression is visible in master as well as 6.18 stable, so CC stable too. Link: https://lkml.kernel.org/r/20260225002434.2953895-1-axelrasmussen@google.com Fixes: f0c92726e89f ("ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor()") Signed-off-by: Axel Rasmussen Acked-by: Shakeel Butt Acked-by: Johannes Weiner Reviewed-by: Vishal Moola (Oracle) Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Roman Gushchin Cc: Muchun Song Cc: Signed-off-by: Andrew Morton commit f4355d6bb39fc8e53d772fa0654c8441b214e349 Author: Zi Yan Date: Tue Feb 24 22:12:31 2026 -0500 mm/cma: move put_page_testzero() out of VM_WARN_ON in cma_release() When CONFIG_DEBUG_VM is not set, VM_WARN_ON is a NOP. Putting any statement with side effect inside it is incorrect. Collect all !put_page_testzero() results and check the sum using WARN instead after the loop. It restores the same check in free_contig_range() before commit e0c1326779cc ("mm: page_alloc: add alloc_contig_frozen_{range,pages}()"), the commit prior to the Fixes one. Link: https://lkml.kernel.org/r/20260225031231.2352011-1-ziy@nvidia.com Fixes: 9bda131c6093 ("mm: cma: add cma_alloc_frozen{_compound}()") Signed-off-by: Zi Yan Reported-by: Ron Economos Closes: https://lore.kernel.org/all/1b17c38f-30d3-4bb4-a7e1-e74b19ada885@w6rz.net/ Suggested-by: Kefeng Wang Reviewed-by: Vishal Moola (Oracle) Debugged-by: David Hildenbrand (Arm) Acked-by: David Hildenbrand (Arm) Tested-by: Ron Economos Reviewed-by: Kefeng Wang Reviewed-by: Anshuman Khandual Reviewed-by: SeongJae Park Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d210fdcac9c0d1380eab448aebc93f602c1cd4e6 Author: Raul Pazemecxas De Andrade Date: Mon Feb 23 17:10:59 2026 -0800 mm/damon/core: clear walk_control on inactive context in damos_walk() damos_walk() sets ctx->walk_control to the caller-provided control structure before checking whether the context is running. If the context is inactive (damon_is_running() returns false), the function returns -EINVAL without clearing ctx->walk_control. This leaves a dangling pointer to a stack-allocated structure that will be freed when the caller returns. This is structurally identical to the bug fixed in commit f9132fbc2e83 ("mm/damon/core: remove call_control in inactive contexts") for damon_call(), which had the same pattern of linking a control object and returning an error without unlinking it. The dangling walk_control pointer can cause: 1. Use-after-free if the context is later started and kdamond    dereferences ctx->walk_control (e.g., in damos_walk_cancel()    which writes to control->canceled and calls complete()) 2. Permanent -EBUSY from subsequent damos_walk() calls, since the    stale pointer is non-NULL Nonetheless, the real user impact is quite restrictive. The use-after-free is impossible because there is no damos_walk() callers who starts the context later. The permanent -EBUSY can actually confuse users, as DAMON is not running. But the symptom is kept only while the context is turned off. Turning it on again will make DAMON internally uses a newly generated damon_ctx object that doesn't have the invalid damos_walk_control pointer, so everything will work fine again. Fix this by clearing ctx->walk_control under walk_control_lock before returning -EINVAL, mirroring the fix pattern from f9132fbc2e83. Link: https://lkml.kernel.org/r/20260224011102.56033-1-sj@kernel.org Fixes: bf0eaba0ff9c ("mm/damon/core: implement damos_walk()") Reported-by: Raul Pazemecxas De Andrade Closes: https://lore.kernel.org/CPUPR80MB8171025468965E583EF2490F956CA@CPUPR80MB8171.lamprd80.prod.outlook.com Signed-off-by: Raul Pazemecxas De Andrade Signed-off-by: SeongJae Park Reviewed-by: SeongJae Park Cc: [6.14+] Signed-off-by: Andrew Morton commit 7e04bf1f33151a30e06a65b74b5f2c19fc2be128 Author: Pratyush Yadav (Google) Date: Mon Feb 23 18:39:29 2026 +0100 mm: memfd_luo: always dirty all folios A dirty folio is one which has been written to. A clean folio is its opposite. Since a clean folio has no user data, it can be freed under memory pressure. memfd preservation with LUO saves the flag at preserve(). This is problematic. The folio might get dirtied later. Saving it at freeze() also doesn't work, since the dirty bit from PTE is normally synced at unmap and there might still be mappings of the file at freeze(). To see why this is a problem, say a folio is clean at preserve, but gets dirtied later. The serialized state of the folio will mark it as clean. After retrieve, the next kernel will see the folio as clean and might try to reclaim it under memory pressure. This will result in losing user data. Mark all folios of the file as dirty, and always set the MEMFD_LUO_FOLIO_DIRTY flag. This comes with the side effect of making all clean folios un-reclaimable. This is a cost that has to be paid for participants of live update. It is not expected to be a common use case to preserve a lot of clean folios anyway. Since the value of pfolio->flags is a constant now, drop the flags variable and set it directly. Link: https://lkml.kernel.org/r/20260223173931.2221759-3-pratyush@kernel.org Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Mike Rapoport (Microsoft) Cc: Pasha Tatashin Cc: Signed-off-by: Andrew Morton commit 50d7b4332f27762d24641970fc34bb68a2621926 Author: Pratyush Yadav (Google) Date: Mon Feb 23 18:39:28 2026 +0100 mm: memfd_luo: always make all folios uptodate Patch series "mm: memfd_luo: fixes for folio flag preservation". This series contains a couple fixes for flag preservation for memfd live update. The first patch fixes memfd preservation when fallocate() was used to pre-allocate some pages. For these memfds, all the writes to fallocated pages touched after preserve were lost. The second patch fixes dirty flag tracking. If the dirty flag is not tracked correctly, the next kernel might incorrectly reclaim some folios under memory pressure, losing user data. This is a theoretical bug that I observed when reading the code, and haven't been able to reproduce it. This patch (of 2): When a folio is added to a shmem file via fallocate, it is not zeroed on allocation. This is done as a performance optimization since it is possible the folio will never end up being used at all. When the folio is used, shmem checks for the uptodate flag, and if absent, zeroes the folio (and sets the flag) before returning to user. With LUO, the flags of each folio are saved at preserve time. It is possible to have a memfd with some folios fallocated but not uptodate. For those, the uptodate flag doesn't get saved. The folios might later end up being used and become uptodate. They would get passed to the next kernel via KHO correctly since they did get preserved. But they won't have the MEMFD_LUO_FOLIO_UPTODATE flag. This means that when the memfd is retrieved, the folios will be added to the shmem file without the uptodate flag. They will be zeroed before first use, losing the data in those folios. Since we take a big performance hit in allocating, zeroing, and pinning all folios at prepare time anyway, take some more and zero all non-uptodate ones too. Later when there is a stronger need to make prepare faster, this can be optimized. To avoid racing with another uptodate operation, take the folio lock. Link: https://lkml.kernel.org/r/20260223173931.2221759-2-pratyush@kernel.org Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Mike Rapoport (Microsoft) Cc: Pasha Tatashin Cc: Signed-off-by: Andrew Morton commit f8e2019c3bd1ea73ca25cd69a8141555243c9a11 Author: Günther Noack Date: Fri Feb 20 17:06:27 2026 +0100 samples/landlock: Bump ABI version to 8 The sample tool should print a warning if it is not running on a kernel that provides the newest Landlock ABI version. Link: https://lore.kernel.org/all/20260218.ufao5Vaefa2u@digikod.net/ Suggested-by: Mickaël Salaün Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260220160627.53913-1-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit bb8369ead40771b9550e5dbc287d6b707dd6c2b3 Author: Mickaël Salaün Date: Tue Feb 17 13:23:40 2026 +0100 landlock: Improve TSYNC types Constify pointers when it makes sense. Consistently use size_t for loops, especially to match works->size type. Add new lines to improve readability. Cc: Jann Horn Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260217122341.2359582-2-mic@digikod.net Signed-off-by: Mickaël Salaün commit 929553bbb4cdda9be22175e1adb4d5814b770855 Author: Mickaël Salaün Date: Tue Feb 17 13:23:39 2026 +0100 landlock: Fully release unused TSYNC work entries If task_work_add() failed, ctx->task is put but the tsync_works struct is not reset to its previous state. The first consequence is that the kernel allocates memory for dying threads, which could lead to user-accounted memory exhaustion (not very useful nor specific to this case). The second consequence is that task_work_cancel(), called by cancel_tsync_works(), can dereference a NULL task pointer. Fix this issues by keeping a consistent works->size wrt the added task work. This is done in a new tsync_works_trim() helper which also cleans up the shared_ctx and work fields. As a safeguard, add a pointer check to cancel_tsync_works() and update tsync_works_release() accordingly. Cc: Jann Horn Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260217122341.2359582-1-mic@digikod.net [mic: Replace memset() with compound literal] Signed-off-by: Mickaël Salaün commit 405ca72dc589dd746e5ee5378bb9d9ee7f844010 Author: Mickaël Salaün Date: Tue Mar 3 18:36:31 2026 +0100 landlock: Fix formatting Auto-format with clang-format -i security/landlock/*.[ch] Cc: Günther Noack Cc: Kees Cook Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260303173632.88040-1-mic@digikod.net Signed-off-by: Mickaël Salaün commit 77b310bb7b5ff8c017524df83292e0242ba89791 Author: Davidlohr Bueso Date: Mon Feb 2 11:13:30 2026 -0800 cxl/region: Fix leakage in __construct_region() Failing the first sysfs_update_group() needs to explicitly kfree the resource as it is too early for cxl_region_iomem_release() to do so. Signed-off-by: Davidlohr Bueso Reviewed-by: Ira Weiny Reviewed-by: Gregory Price Fixes: d6602e25819d (cxl/region: Add support to indicate region has extended linear cache) Link: https://patch.msgid.link/20260202191330.245608-1-dave@stgolabs.net Signed-off-by: Dave Jiang commit 7a8464555d2e5f038758bb19e72ab4710b79e9cd Author: zhidao su Date: Wed Mar 4 13:37:30 2026 +0800 sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update bpf_iter_scx_dsq_new() reads dsq->seq via READ_ONCE() without holding any lock, making dsq->seq a lock-free concurrently accessed variable. However, dispatch_enqueue(), the sole writer of dsq->seq, uses a plain increment without the matching WRITE_ONCE() on the write side: dsq->seq++; ^^^^^^^^^^^ plain write -- KCSAN data race The KCSAN documentation requires that if one accessor uses READ_ONCE() or WRITE_ONCE() on a variable to annotate lock-free access, all other accesses must also use the appropriate accessor. A plain write leaves the pair incomplete and will trigger KCSAN warnings. Fix by using WRITE_ONCE() for the write side of the update: WRITE_ONCE(dsq->seq, dsq->seq + 1); This is consistent with bpf_iter_scx_dsq_new() and makes the concurrent access annotation complete and KCSAN-clean. Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 2b76e0cc7803e5ab561c875edaba7f6bbd87fbb0 Author: Matthew Schwartz Date: Mon Mar 2 13:07:17 2026 -0800 mmc: sdhci-pci-gli: fix GL9750 DMA write corruption The GL9750 SD host controller has intermittent data corruption during DMA write operations. The GM_BURST register's R_OSRC_Lmt field (bits 17:16), which limits outstanding DMA read requests from system memory, is not being cleared during initialization. The Windows driver sets R_OSRC_Lmt to zero, limiting requests to the smallest unit. Clear R_OSRC_Lmt to match the Windows driver behavior. This eliminates write corruption verified with f3write/f3read tests while maintaining DMA performance. Cc: stable@vger.kernel.org Fixes: e51df6ce668a ("mmc: host: sdhci-pci: Add Genesys Logic GL975x support") Closes: https://lore.kernel.org/linux-mmc/33d12807-5c72-41ce-8679-57aa11831fad@linux.dev/ Acked-by: Adrian Hunter Signed-off-by: Matthew Schwartz Reviewed-by: Ben Chuang Signed-off-by: Ulf Hansson commit ecc64d2dc9ff9738d2a896beb68e02c2feaf9a02 Merge: 4053c47680da0a 6932256d3a3764 Author: Linus Torvalds Date: Wed Mar 4 08:21:11 2026 -0800 Merge tag 'sysctl-7.00-fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl fix from Joel Granados: - Fix error when reporting jiffies converted values back to user space Return the converted value instead of "Invalid argument" error * tag 'sysctl-7.00-fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: time/jiffies: Fix sysctl file error on configurations where USER_HZ < HZ commit 0100e495cdf0436bd4ed2dc034d385b44cb5993c Author: Jisheng Zhang Date: Sat Feb 21 10:38:47 2026 +0800 arm64: make runtime const not usable by modules Similar as commit 284922f4c563 ("x86: uaccess: don't use runtime-const rewriting in modules") does, make arm64's runtime const not usable by modules too, to "make sure this doesn't get forgotten the next time somebody wants to do runtime constant optimizations". The reason is well explained in the above commit: "The runtime-const infrastructure was never designed to handle the modular case, because the constant fixup is only done at boot time for core kernel code." Signed-off-by: Jisheng Zhang Signed-off-by: Will Deacon commit 4053c47680da0a03a8df66735904d5b92db6a144 Merge: 40d3f622477ccd 24d87712727a50 Author: Linus Torvalds Date: Wed Mar 4 08:12:06 2026 -0800 Merge tag 'media/v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "Fix for MPEG-TS decoder in dvb-net" * tag 'media/v7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: dvb-net: fix OOB access in ULE extension header tables commit 340cea84f691c5206561bb2e0147158fe02070be Author: Shyam Prasad N Date: Wed Mar 4 18:15:53 2026 +0530 cifs: open files should not hold ref on superblock Today whenever we deal with a file, in addition to holding a reference on the dentry, we also get a reference on the superblock. This happens in two cases: 1. when a new cinode is allocated 2. when an oplock break is being processed The reasoning for holding the superblock ref was to make sure that when umount happens, if there are users of inodes and dentries, it does not try to clean them up and wait for the last ref to superblock to be dropped by last of such users. But the side effect of doing that is that umount silently drops a ref on the superblock and we could have deferred closes and lease breaks still holding these refs. Ideally, we should ensure that all of these users of inodes and dentries are cleaned up at the time of umount, which is what this code is doing. This code change allows these code paths to use a ref on the dentry (and hence the inode). That way, umount is ensured to clean up SMB client resources when it's the last ref on the superblock (For ex: when same objects are shared). The code change also moves the call to close all the files in deferred close list to the umount code path. It also waits for oplock_break workers to be flushed before calling kill_anon_super (which eventually frees up those objects). Fixes: 24261fc23db9 ("cifs: delay super block destruction until all cifsFileInfo objects are gone") Fixes: 705c79101ccf ("smb: client: fix use-after-free in cifs_oplock_break") Cc: Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit b5ef09a77d0b5213268300eedd8a7d28b4e92d47 Author: H. Peter Anvin Date: Thu Feb 26 17:03:07 2026 -0800 x86/entry/vdso32: Work around libgcc unwinder bug The unwinder code in libgcc has a long standing bug which causes it to fail to pick up the signal frame CFI flag. This is a generic bug across all platforms. It affects the __kernel_sigreturn and __kernel_rt_sigreturn vdso entry points on i386. The x86-64 kernel doesn't provide a sigreturn stub, and so there is no kernel-provided code that is affected on x86-64. libgcc does have a legacy fallback path which happens to work as long as the bytes immediately before each of the sigreturn functions fall outside any function. This patch adds a nop before the ALIGN to each of the sigreturn stubs to ensure that this is, indeed, the case. The rest of the patch is just a comment which documents the invariants that need to be maintained for this legacy path to work correctly. This is a manifest bug: in the current vdso, __kernel_vsyscall is a multiple of 16 bytes long and thus __kernel_sigreturn does not have any padding in front of it. Closes: https://lore.kernel.org/lkml/f3412cc3e8f66d1853cc9d572c0f2fab076872b1.camel@xry111.site Fixes: 884961618ee5 ("x86/entry/vdso32: Remove open-coded DWARF in sigreturn.S") Reported-by: Xi Ruoyao Signed-off-by: H. Peter Anvin (Intel) Signed-off-by: Peter Zijlstra (Intel) Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124050 Link: https://patch.msgid.link/20260227010308.310342-1-hpa@zytor.com commit d658686a1331db3bb108ca079d76deb3208ed949 Author: Juri Lelli Date: Mon Mar 2 16:45:40 2026 +0100 sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting Running stress-ng --schedpolicy 0 on an RT kernel on a big machine might lead to the following WARNINGs (edited). sched: DL de-boosted task PID 22725: REPLENISH flag missing WARNING: CPU: 93 PID: 0 at kernel/sched/deadline.c:239 dequeue_task_dl+0x15c/0x1f8 ... (running_bw underflow) Call trace: dequeue_task_dl+0x15c/0x1f8 (P) dequeue_task+0x80/0x168 deactivate_task+0x24/0x50 push_dl_task+0x264/0x2e0 dl_task_timer+0x1b0/0x228 __hrtimer_run_queues+0x188/0x378 hrtimer_interrupt+0xfc/0x260 ... The problem is that when a SCHED_DEADLINE task (lock holder) is changed to a lower priority class via sched_setscheduler(), it may fail to properly inherit the parameters of potential DEADLINE donors if it didn't already inherit them in the past (shorter deadline than donor's at that time). This might lead to bandwidth accounting corruption, as enqueue_task_dl() won't recognize the lock holder as boosted. The scenario occurs when: 1. A DEADLINE task (donor) blocks on a PI mutex held by another DEADLINE task (holder), but the holder doesn't inherit parameters (e.g., it already has a shorter deadline) 2. sched_setscheduler() changes the holder from DEADLINE to a lower class while still holding the mutex 3. The holder should now inherit DEADLINE parameters from the donor and be enqueued with ENQUEUE_REPLENISH, but this doesn't happen Fix the issue by introducing __setscheduler_dl_pi(), which detects when a DEADLINE (proper or boosted) task gets setscheduled to a lower priority class. In case, the function makes the task inherit DEADLINE parameters of the donoer (pi_se) and sets ENQUEUE_REPLENISH flag to ensure proper bandwidth accounting during the next enqueue operation. Fixes: 2279f540ea7d ("sched/deadline: Fix priority inheritance with multiple scheduling classes") Reported-by: Bruno Goncalves Signed-off-by: Juri Lelli Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260302-upstream-fix-deadline-piboost-b4-v3-1-6ba32184a9e0@redhat.com commit 40d3f622477ccd99118498df5283941bf546dd9c Merge: 0031c06807cfa8 b6c3af46c26f2d Author: Linus Torvalds Date: Wed Mar 4 08:03:43 2026 -0800 Merge tag 'pinctrl-v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "All of these are driver fixes except a memory leak in the pinconf_generic_parse_dt_config() helper which is the most important fix. - Rename and fix up the Intel Equilibrium immutable interrupt chip - Handle the Qualcomm QCS615 dual edge GPIO IRQ by adding the right flag - Fix a memory leak in the widely used pinconf_generic_parse_dt_config() and a more local leak in aml_dt_node_to_map_pinmux() - Fix double put in the Cirrus cs42l43_pin_probe() - Staticize amdisp_pinctrl_ops, Qualcomm SDM660 groups and functions - Unexport CIX sky1_pinctrl_pm_ops - Fix configuration of deferred pin in the Rockchip driver - Implement .get_direction() in the Sunxi driver squelching a dmesg warning message - Fix a readout of the last bank of registers in the Cypress CY8C95x0 driver" * tag 'pinctrl-v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: cy8c95x0: Don't miss reading the last bank registers pinctrl: sunxi: Implement gpiochip::get_direction() pinctrl: rockchip: Fix configuring a deferred pin pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() pinctrl: meson: amlogic-a4: Fix device node reference leak in aml_dt_node_to_map_pinmux() pinctrl: qcom: sdm660-lpass-lpi: Make groups and functions variables static pinctrl: cix: sky1: Unexport sky1_pinctrl_pm_ops pinctrl: amdisp: Make amdisp_pinctrl_ops variable static pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() pinctrl: qcom: qcs615: Add missing dual edge GPIO IRQ errata flag pinctrl: equilibrium: fix warning trace on load pinctrl: equilibrium: rename irq_chip function callbacks commit 1b3f004bac8e2c9e340ac237bd5b36b686ae63e8 Author: Arnaldo Carvalho de Melo Date: Wed Mar 4 12:54:08 2026 -0300 tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources To pick the changes in: 6517dfbcc918f970 ("KVM: x86: Add x2APIC "features" to control EOI broadcast suppression") 20c3c4108d58f87c ("KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command") This silences these perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Cc: Khushit Shah Cc: Michael Roth Signed-off-by: Arnaldo Carvalho de Melo commit 4ebe2b8cda7e91a30c1cf1d297605682540d4ad9 Author: Arnaldo Carvalho de Melo Date: Wed Mar 4 12:47:03 2026 -0300 tools headers x86 cpufeatures: Sync with the kernel sources To pick the changes from: f24ef0093dd8cf60 ("KVM: x86: Advertise MOVRS CPUID to userspace") f49ecf5e110ab0ed ("x86/cpufeature: Replace X86_FEATURE_SYSENTER32 with X86_FEATURE_SYSFAST32") db5e82496492b489 ("KVM: SVM: Virtualize and advertise support for ERAPS") This causes these perf files to be rebuilt and brings some X86_FEATURE that may be used by: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Please see tools/include/uapi/README for further details. Cc: Amit Shah Cc: Dave Hansen Cc: H. Peter Anvin Cc: Sean Christopherson Cc: Zhao Liu Signed-off-by: Arnaldo Carvalho de Melo commit 59674fc9d0bfd96ce8a776680ee1cf22c28c9ac7 Author: Tony Luck Date: Tue Mar 3 11:55:44 2026 +0100 x86/resctrl: Fix SNC detection Now that the x86 topology code has a sensible nodes-per-package measure, that does not depend on the online status of CPUs, use this to divinate the SNC mode. Note that when Cluster on Die (CoD) is configured on older systems this will also show multiple NUMA nodes per package. Intel Resource Director Technology is incomaptible with CoD. Print a warning and do not use the fixup MSR_RMID_SNC_CONFIG. Signed-off-by: Tony Luck Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ingo Molnar Tested-by: Zhang Rui Tested-by: Chen Yu Link: https://patch.msgid.link/aaCxbbgjL6OZ6VMd@agluck-desk3 Link: https://patch.msgid.link/20260303110100.367976706@infradead.org commit 528d89a4707e5bfd86e30823c45dbb66877df900 Author: Peter Zijlstra Date: Tue Mar 3 11:55:43 2026 +0100 x86/topo: Fix SNC topology mess Per 4d6dd05d07d0 ("sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode"), the original crazy SNC-3 SLIT table was: node distances: node 0 1 2 3 4 5 0: 10 15 17 21 28 26 1: 15 10 15 23 26 23 2: 17 15 10 26 23 21 3: 21 28 26 10 15 17 4: 23 26 23 15 10 15 5: 26 23 21 17 15 10 And per: https://lore.kernel.org/lkml/20250825075642.GQ3245006@noisy.programming.kicks-ass.net/ The suggestion was to average the off-trace clusters to restore sanity. However, 4d6dd05d07d0 implements this under various assumptions: - anything GNR/CWF with numa_in_package; - there will never be more than 2 packages; - the off-trace cluster will have distance >20 And then HPE shows up with a machine that matches the Vendor-Family-Model checks but looks like this: Here's an 8 socket (2 chassis) HPE system with SNC enabled: node 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0: 10 12 16 16 16 16 18 18 40 40 40 40 40 40 40 40 1: 12 10 16 16 16 16 18 18 40 40 40 40 40 40 40 40 2: 16 16 10 12 18 18 16 16 40 40 40 40 40 40 40 40 3: 16 16 12 10 18 18 16 16 40 40 40 40 40 40 40 40 4: 16 16 18 18 10 12 16 16 40 40 40 40 40 40 40 40 5: 16 16 18 18 12 10 16 16 40 40 40 40 40 40 40 40 6: 18 18 16 16 16 16 10 12 40 40 40 40 40 40 40 40 7: 18 18 16 16 16 16 12 10 40 40 40 40 40 40 40 40 8: 40 40 40 40 40 40 40 40 10 12 16 16 16 16 18 18 9: 40 40 40 40 40 40 40 40 12 10 16 16 16 16 18 18 10: 40 40 40 40 40 40 40 40 16 16 10 12 18 18 16 16 11: 40 40 40 40 40 40 40 40 16 16 12 10 18 18 16 16 12: 40 40 40 40 40 40 40 40 16 16 18 18 10 12 16 16 13: 40 40 40 40 40 40 40 40 16 16 18 18 12 10 16 16 14: 40 40 40 40 40 40 40 40 18 18 16 16 16 16 10 12 15: 40 40 40 40 40 40 40 40 18 18 16 16 16 16 12 10 10 = Same chassis and socket 12 = Same chassis and socket (SNC) 16 = Same chassis and adjacent socket 18 = Same chassis and non-adjacent socket 40 = Different chassis Turns out, the 'max 2 packages' thing is only relevant to the SNC-3 parts, the smaller parts do 8 sockets (like usual). The above SLIT table is sane, but violates the previous assumptions and trips a WARN. Now that the topology code has a sensible measure of nodes-per-package, we can use that to divinate the SNC mode at hand, and only fix up SNC-3 topologies. There is a 'healthy' amount of paranoia code validating the assumptions on the SLIT table, a simple pr_err(FW_BUG) print on failure and a fallback to using the regular table. Lets see how long this lasts :-) Fixes: 4d6dd05d07d0 ("sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode") Reported-by: Kyle Meyer Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ingo Molnar Tested-by: K Prateek Nayak Tested-by: Zhang Rui Tested-by: Chen Yu Tested-by: Kyle Meyer Link: https://patch.msgid.link/20260303110100.238361290@infradead.org commit 717b64d58cff6fb97f97be07e382ed7641167a56 Author: Peter Zijlstra Date: Tue Mar 3 11:55:42 2026 +0100 x86/topo: Replace x86_has_numa_in_package .. with the brand spanking new topology_num_nodes_per_package(). Having the topology setup determine this value during MADT/SRAT parsing before SMP bringup avoids having to detect this situation when building the SMP topology masks. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ingo Molnar Tested-by: Tony Luck Tested-by: K Prateek Nayak Tested-by: Zhang Rui Tested-by: Chen Yu Tested-by: Kyle Meyer Link: https://patch.msgid.link/20260303110100.123701837@infradead.org commit ae6730ff42b3a13d94b405edeb5e40108b6d21b6 Author: Peter Zijlstra Date: Tue Mar 3 11:55:41 2026 +0100 x86/topo: Add topology_num_nodes_per_package() Use the MADT and SRAT table data to compute __num_nodes_per_package. Specifically, SRAT has already been parsed in x86_numa_init(), which is called before acpi_boot_init() which parses MADT. So both are available in topology_init_possible_cpus(). This number is useful to divinate the various Intel CoD/SNC and AMD NPS modes, since the platforms are failing to provide this otherwise. Doing it this way is independent of the number of online CPUs and other such shenanigans. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ingo Molnar Tested-by: Tony Luck Tested-by: K Prateek Nayak Tested-by: Zhang Rui Tested-by: Chen Yu Tested-by: Kyle Meyer Link: https://patch.msgid.link/20260303110100.004091624@infradead.org commit 48084cc153a5b0fbf0aa98d47670d3be0b9f64d5 Author: Peter Zijlstra Date: Tue Mar 3 11:55:40 2026 +0100 x86/numa: Store extra copy of numa_nodes_parsed The topology setup code needs to know the total number of physical nodes enumerated in SRAT; however NUMA_EMU can cause the existing numa_nodes_parsed bitmap to be fictitious. Therefore, keep a copy of the bitmap specifically to retain the physical node count. Suggested-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ingo Molnar Tested-by: K Prateek Nayak Tested-by: Zhang Rui Tested-by: Chen Yu Tested-by: Kyle Meyer Link: https://patch.msgid.link/20260303110059.889884023@infradead.org commit 9cd284105bb77b063b61523f62096e853b8b890b Author: Arnaldo Carvalho de Melo Date: Wed Mar 4 12:32:19 2026 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: f7ab71f178d56447 ("KVM: s390: Add explicit padding to struct kvm_s390_keyop") 0ee4ddc1647b8b3b ("KVM: s390: Storage key manipulation IOCTL") fa9893fadbc245e1 ("KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching") f174a9ffcd48d78a ("KVM: arm64: Add exit to userspace on {LD,ST}64B* outside of memslots") That just rebuilds perf, as these patches add just one new KVM ioctl, but for S390, that is not being considered by tools/perf/trace/beauty/kvm_ioctl.sh so far. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Please see tools/include/uapi/README for further details. Cc: Arnd Bergmann Cc: Claudio Imbrenda Cc: Marc Zyngier Cc: Michael Roth Cc: Sean Christopherson Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit d90c470b0eca9d2d77a23a1cd7d6ac7fb02d7cb8 Merge: 8da8df43124128 c3320153769f05 Author: Jens Axboe Date: Wed Mar 4 08:15:17 2026 -0700 Merge tag 'nvme-7.0-2026-03-04' of git://git.infradead.org/nvme into block-7.0 Pull NVMe fixes from Keith: "- Improve quirk visibility and configurability (Maurizio) - Fix runtime user modification to queue setup (Keith) - Fix multipath leak on try_module_get failure (Keith) - Ignore ambiguous spec definitions for better atomics support (John) - Fix admin queue leak on controller reset (Ming) - Fix large allocation in persistent reservation read keys (Sungwoo Kim) - Fix fcloop callback handling (Justin) - Securely free DHCHAP secrets (Daniel) - Various cleanups and typo fixes (John, Wilfred)" * tag 'nvme-7.0-2026-03-04' of git://git.infradead.org/nvme: nvme: fix memory allocation in nvme_pr_read_keys() nvme-multipath: fix leak on try_module_get failure nvmet-fcloop: Check remoteport port_state before calling done callback nvme-pci: do not try to add queue maps at runtime nvme-pci: cap queue creation to used queues nvme-pci: ensure we're polling a polled queue nvme: fix memory leak in quirks_param_set() nvme: correct comment about nvme_ns_remove() nvme: stop setting namespace gendisk device driver data nvme: add support for dynamic quirk configuration via module parameter nvme: fix admin queue leak on controller reset nvme-fabrics: use kfree_sensitive() for DHCHAP secrets nvme: stop using AWUPF nvme: expose active quirks in sysfs nvme/host: fixup some typos commit 916a9f385d81a65f7209614742208b8a923434bd Author: Arnaldo Carvalho de Melo Date: Wed Mar 4 11:49:24 2026 -0300 tools headers: Update the linux/gfp_types.h copy with the kernel sources To pick up the changes in: f3ec502b6755a3bf ("mm/slab: mark alloc tags empty for sheaves allocated with __GFP_NO_OBJ_EXT") 241b3a09639c317b ("mm: clarify GFP_ATOMIC/GFP_NOWAIT doc-comment") That just adds some comments, so no changes in perf tooling, just silences this build warning: Warning: Kernel ABI header differences: diff -u tools/include/linux/gfp_types.h include/linux/gfp_types.h Please see tools/include/uapi/README. Signed-off-by: Arnaldo Carvalho de Melo commit c3320153769f05fd7fe9d840cb555dd3080ae424 Author: Sungwoo Kim Date: Fri Feb 27 19:19:28 2026 -0500 nvme: fix memory allocation in nvme_pr_read_keys() nvme_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for rse via struct_size(). The upper limit is PR_KEYS_MAX (64K). A malicious or buggy userspace can pass a large num_keys value that results in a 4MB allocation attempt at most, causing a warning in the page allocator when the order exceeds MAX_PAGE_ORDER. To fix this, use kvzalloc() instead of kzalloc(). This bug has the same reasoning and fix with the patch below: https://lore.kernel.org/linux-block/20251212013510.3576091-1-kartikey406@gmail.com/ Warning log: WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216, CPU#1: syz-executor117/272 Modules linked in: CPU: 1 UID: 0 PID: 272 Comm: syz-executor117 Not tainted 6.19.0 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:__alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216 Code: ff 83 bd a8 fe ff ff 0a 0f 86 69 fb ff ff 0f b6 1d f9 f9 c4 04 80 fb 01 0f 87 3b 76 30 ff 83 e3 01 75 09 c6 05 e4 f9 c4 04 01 <0f> 0b 48 c7 85 70 fe ff ff 00 00 00 00 e9 8f fd ff ff 31 c0 e9 0d RSP: 0018:ffffc90000fcf450 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff920001f9ea0 RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0 RBP: ffffc90000fcf648 R08: ffff88800b6c3380 R09: 0000000000000001 R10: ffffc90000fcf840 R11: ffff88807ffad280 R12: 0000000000000000 R13: 0000000000040dc0 R14: 0000000000000001 R15: ffffc90000fcf620 FS: 0000555565db33c0(0000) GS:ffff8880be26c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000000c CR3: 0000000003b72000 CR4: 00000000000006f0 Call Trace: alloc_pages_mpol+0x236/0x4d0 mm/mempolicy.c:2486 alloc_frozen_pages_noprof+0x149/0x180 mm/mempolicy.c:2557 ___kmalloc_large_node+0x10c/0x140 mm/slub.c:5598 __kmalloc_large_node_noprof+0x25/0xc0 mm/slub.c:5629 __do_kmalloc_node mm/slub.c:5645 [inline] __kmalloc_noprof+0x483/0x6f0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] nvme_pr_read_keys+0x8f/0x4c0 drivers/nvme/host/pr.c:245 blkdev_pr_read_keys block/ioctl.c:456 [inline] blkdev_common_ioctl+0x1b71/0x29b0 block/ioctl.c:730 blkdev_ioctl+0x299/0x700 block/ioctl.c:786 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x1bf/0x220 fs/ioctl.c:583 x64_sys_call+0x1280/0x21b0 mnt/fuzznvme_1/fuzznvme/linux-build/v6.19/./arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x71/0x330 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb893d3108d Code: 28 c3 e8 46 1e 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff61f2f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffff61f3138 RCX: 00007fb893d3108d RDX: 0000000020000040 RSI: 00000000c01070ce RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffff61f3138 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffff61f3128 R14: 00007fb893dae530 R15: 0000000000000001 Fixes: 5fd96a4e15de (nvme: Add pr_ops read_keys support) Acked-by: Chao Shi Acked-by: Weidong Zhu Acked-by: Dave Tian Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Sungwoo Kim Signed-off-by: Keith Busch commit ecd5a2fd4c7495a1a923c754c47cdd500f5b30df Author: Arnaldo Carvalho de Melo Date: Wed Mar 4 11:49:24 2026 -0300 perf beauty: Update the linux/perf_event.h copy with the kernel sources Update it as one comment got realigned, probably in a merge, so no changes in perf tooling, just silences this build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/perf_event.h include/uapi/linux/perf_event.h Signed-off-by: Arnaldo Carvalho de Melo commit 3abbb7cae8d8bffae3516d885cde9f13c6ceb833 Author: Arnaldo Carvalho de Melo Date: Wed Mar 4 11:49:24 2026 -0300 perf beauty: Update the arch/x86/include/asm/irq_vectors.h copy with the kernel sources To pick up the change in: a1fab3e69d9d0e9b ("x86/irq: Fix comment on IRQ vector layout") That just adds one comment, so no changes in perf tooling, just silences this build warning: diff -u tools/perf/trace/beauty/arch/x86/include/asm/irq_vectors.h arch/x86/include/asm/irq_vectors.h Signed-off-by: Arnaldo Carvalho de Melo commit e367679f167e46372cafca9cd903d60f84aa5e72 Author: Arnaldo Carvalho de Melo Date: Wed Mar 4 11:46:01 2026 -0300 perf beauty: Sync UAPI linux/fs.h with kernel sources To pick up changes from: 0e6b7eae1fded85f ("fs: add FS_XFLAG_VERITY for fs-verity files") These are used to beautify fs syscall arguments, albeit the changes in this update are not affecting those beautifiers. This addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fs.h include/uapi/linux/fs.h Please see tools/include/uapi/README. Cc: Andrey Albershteyn Cc: Christian Brauner Signed-off-by: Arnaldo Carvalho de Melo commit 6036165ab1851ee28cedea592ee0393b77bfd0c0 Author: Arnaldo Carvalho de Melo Date: Wed Mar 4 11:41:12 2026 -0300 perf beauty: Sync linux/mount.h copy with the kernel sources To pick the changes from: 9b8a0ba68246a61d ("mount: add OPEN_TREE_NAMESPACE") 0e5032237ee55301 ("statmount: accept fd as a parameter") That doesn't change anything in tools this time as nothing that is harvested by the beauty scripts got changed: $ ls -1 tools/perf/trace/beauty/*mount*sh tools/perf/trace/beauty/fsmount.sh tools/perf/trace/beauty/mount_flags.sh tools/perf/trace/beauty/move_mount_flags.sh $ This addresses this perf build warning. Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/mount.h include/uapi/linux/mount.h Please see tools/include/uapi/README for further details. Cc: Christian Brauner Cc: Bhavik Sachdev Signed-off-by: Arnaldo Carvalho de Melo commit 30f998c992c9d32a5c2774ec1b624339483db19d Author: Dmitrii Dolgov <9erthalion6@gmail.com> Date: Thu Feb 26 17:59:59 2026 +0100 tools build: Fix rust cross compilation Currently no target is specified to compile rust code when needed, which breaks cross compilation. E.g. for arm64: LD /tmp/build/tests/workloads/perf-test-in.o aarch64-linux-gnu-ld: /tmp/build/tests/workloads/code_with_type.a(code_with_type.code_with_type.d12f4324cb53c560-cgu.0.rcgu.o): Relocations in generic ELF (EM: 62) aarch64-linux-gnu-ld: /tmp/build/tests/workloads/code_with_type.a(code_with_type.code_with_type.d12f4324cb53c560-cgu.0.rcgu.o): Relocations in generic ELF (EM: 62) [...repeated...] aarch64-linux-gnu-ld: /tmp/build/tests/workloads/code_with_type.a(code_with_type.code_with_type.d12f4324cb53c560-cgu.0.rcgu.o): Relocations in generic ELF (EM: 62) aarch64-linux-gnu-ld: /tmp/build/tests/workloads/code_with_type.a(code_with_type.code_with_type.d12f4324cb53c560-cgu.0.rcgu.o): Relocations in generic ELF (EM: 62) aarch64-linux-gnu-ld: /tmp/build/tests/workloads/code_with_type.a: error adding symbols: file in wrong format make[5]: *** [/perf/tools/build/Makefile.build:162: /tmp/build/tests/workloads/perf-test-in.o] Error 1 make[4]: *** [/perf/tools/build/Makefile.build:156: workloads] Error 2 make[3]: *** [/perf/tools/build/Makefile.build:156: tests] Error 2 make[2]: *** [Makefile.perf:785: /tmp/build/perf-test-in.o] Error 2 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [Makefile.perf:289: sub-make] Error 2 make: *** [Makefile:76: all] Error 2 Detect required target and pass it via rust_flags to the compiler. Note that CROSS_COMPILE might be different from what rust compiler expects, since it may omit the target vendor value, e.g. "aarch64-linux-gnu" instead of "aarch64-unknown-linux-gnu". Thus explicitly map supported CROSS_COMPILE values to corresponding Rust versions, as suggested by Miguel Ojeda. Tested using arm64 cross-compilation example from [1]. Fixes: 2e05bb52a12d3cdb ("perf test workload: Add code_with_type test workload") Reviewed-by: Ian Rogers Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Cc: Levi Zim Cc: Miguel Ojeda Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nicolas Schier Link: https://perfwiki.github.io/main/arm64-cross-compilation-dockerfile/ [1] Signed-off-by: Arnaldo Carvalho de Melo commit c25c4aa3f79a488cc270507935a29c07dc6bddfc Author: Catalin Marinas Date: Fri Feb 27 18:53:06 2026 +0000 arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation Commit 143937ca51cc ("arm64, mm: avoid always making PTE dirty in pte_mkwrite()") changed pte_mkwrite_novma() to only clear PTE_RDONLY when PTE_DIRTY is set. This was to allow writable-clean PTEs for swap pages that haven't actually been written. However, this broke kexec and hibernation for some platforms. Both go through trans_pgd_create_copy() -> _copy_pte(), which calls pte_mkwrite_novma() to make the temporary linear-map copy fully writable. With the updated pte_mkwrite_novma(), read-only kernel pages (without PTE_DIRTY) remain read-only in the temporary mapping. While such behaviour is fine for user pages where hardware DBM or trapping will make them writeable, subsequent in-kernel writes by the kexec relocation code will fault. Add PTE_DIRTY back to all _PAGE_KERNEL* protection definitions. This was the case prior to 5.4, commit aa57157be69f ("arm64: Ensure VM_WRITE|VM_SHARED ptes are clean by default"). With the kernel linear-map PTEs always having PTE_DIRTY set, pte_mkwrite_novma() correctly clears PTE_RDONLY. Fixes: 143937ca51cc ("arm64, mm: avoid always making PTE dirty in pte_mkwrite()") Signed-off-by: Catalin Marinas Cc: stable@vger.kernel.org Reported-by: Jianpeng Chang Link: https://lore.kernel.org/r/20251204062722.3367201-1-jianpeng.chang.cn@windriver.com Cc: Will Deacon Cc: Huang, Ying Cc: Guenter Roeck Reviewed-by: Huang Ying Signed-off-by: Will Deacon commit e2dcf9065536ab4a1b00828ff0d19f7d282dfecc Author: Juergen Gross Date: Wed Feb 18 10:52:05 2026 +0100 xen/xenbus: better handle backend crash When the backend domain crashes, coordinated device cleanup is not possible (as it involves waiting for the backend state change). In that case, toolstack forcefully removes frontend xenstore entries. xenbus_dev_changed() handles this case, and triggers device cleanup. It's possible that toolstack manages to connect new device in that place, before xenbus_dev_changed() notices the old one is missing. If that happens, new one won't be probed and will forever remain in XenbusStateInitialising. Fix this by checking the frontend's state in Xenstore. In case it has been reset to XenbusStateInitialising by Xen tools, consider this being the result of an unplug+plug operation. It's important that cleanup on such unplug doesn't modify Xenstore entries (especially the "state" key) as it belong to the new device to be probed - changing it would derail establishing connection to the new backend (most likely, closing the device before it was even connected). Handle this case by setting new xenbus_device->vanished flag to true, and check it before changing state entry. And even if xenbus_dev_changed() correctly detects the device was forcefully removed, the cleanup handling is still racy. Since this whole handling doesn't happened in a single Xenstore transaction, it's possible that toolstack might put a new device there already. Avoid re-creating the state key (which in the case of loosing the race would actually close newly attached device). The problem does not apply to frontend domain crash, as this case involves coordinated cleanup. Problem originally reported at https://lore.kernel.org/xen-devel/aOZvivyZ9YhVWDLN@mail-itl/T/#t, including reproduction steps. Based-on-patch-by: Marek Marczykowski-Górecki Tested-by: Marek Marczykowski-Górecki Signed-off-by: Juergen Gross Message-ID: <20260218095205.453657-3-jgross@suse.com> commit 82169dace41cbaa951341b0f80f4570be3b2dec0 Author: Juergen Gross Date: Wed Feb 18 10:52:04 2026 +0100 xenbus: add xenbus_device parameter to xenbus_read_driver_state() In order to prepare checking the xenbus device status in xenbus_read_driver_state(), add the pointer to struct xenbus_device as a parameter. Tested-by: Marek Marczykowski-Górecki Signed-off-by: Juergen Gross Acked-by: "Martin K. Petersen" # SCSI Acked-by: Jakub Kicinski Acked-by: Bjorn Helgaas # drivers/pci/xen-pcifront.c Signed-off-by: Juergen Gross Message-ID: <20260218095205.453657-2-jgross@suse.com> commit 212dd8477653fe72c2a6a99143cd662f6430cf4f Author: Catalin Marinas Date: Fri Feb 27 15:51:42 2026 +0000 arm64: Silence sparse warnings caused by the type casting in (cmp)xchg The arm64 xchg/cmpxchg() wrappers cast the arguments to (unsigned long) prior to invoking the static inline functions implementing the operation. Some restrictive type annotations (e.g. __bitwise) lead to sparse warnings like below: sparse warnings: (new ones prefixed by >>) fs/crypto/bio.c:67:17: sparse: sparse: cast from restricted blk_status_t >> fs/crypto/bio.c:67:17: sparse: sparse: cast to restricted blk_status_t Force the casting in the arm64 xchg/cmpxchg() wrappers to silence sparse. Signed-off-by: Catalin Marinas Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602230947.uNRsPyBn-lkp@intel.com/ Link: https://lore.kernel.org/r/202602230947.uNRsPyBn-lkp@intel.com/ Cc: Will Deacon Cc: Mark Rutland Cc: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Will Deacon commit b6712d91f8f5a289f642c208083a8f5c27b8ab90 Author: Markus Mayer Date: Tue Mar 3 13:15:01 2026 -0800 perf build: Prevent "argument list too long" error Due to a recent change, building perf may result in a build error when it is trying to "prune orphans". The file list passed to "rm" may exceed what the shell can handle. The build will then abort with an error like this: TEST [...]/arm64/build/linux-custom/tools/perf/pmu-events/metric_test.log make[5]: /bin/sh: Argument list too long make[5]: *** [pmu-events/Build:217: prune_orphans] Error 127 make[5]: *** Waiting for unfinished jobs.... make[4]: *** [Makefile.perf:773: [...]/tools/perf/pmu-events/pmu-events-in.o] Error 2 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [Makefile.perf:289: sub-make] Error 2 Processing the arguments via "xargs", instead of passing the list of files directly to "rm" via the shell, prevents this issue. Fixes: 36a1b0061a584430 ("perf build: Reduce pmu-events related copying and mkdirs") Reviewed-by: Ian Rogers Signed-off-by: Markus Mayer Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit f079ff37324accb91c6247b59e249ebc22bf55f5 Author: Changqing Li Date: Mon Jul 28 17:31:53 2025 +0800 tools build: Make in-target rule robust against too long argument error The command length of in-target scales with the depth of the directory times the number of objects in the Makefile. When there are many objects, and O=[absolute_path] is set, and the absolute_path is relatively long. It is possible that this line "$(call if_changed,$(host)ld_multi)" will report error: "make[4]: /bin/sh: Argument list too long" For example, build perf tools with O=/long/output/path Like built-in.a and *.mod rules in scripts/Makefile.build, add $(objpredix)/ by the shell command instead of by Make's builtin function. Reviewed-by: Ian Rogers Signed-off-by: Changqing Li Cc: Charlie Jenkins Cc: James Clark Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit cfdf6456c0aca337ff05cb1eb6e6f453e1d9dea1 Author: Arnaldo Carvalho de Melo Date: Fri Feb 27 09:08:14 2026 -0300 tools headers: Sync uapi/linux/prctl.h with the kernel source To pick up the changes in these csets: 5ca243f6e3c30b97 ("prctl: add arch-agnostic prctl()s for indirect branch tracking") 28621ec2d46c6adf ("rseq: Add prctl() to enable time slice extensions") That don't introduced these new prctls: $ tools/perf/trace/beauty/prctl_option.sh > before.txt $ cp include/uapi/linux/prctl.h tools/perf/trace/beauty/include/uapi/linux/prctl.h $ tools/perf/trace/beauty/prctl_option.sh > after.txt $ diff -u before.txt after.txt --- before.txt 2026-02-27 09:07:16.435611457 -0300 +++ after.txt 2026-02-27 09:07:28.189816531 -0300 @@ -73,6 +73,10 @@ [76] = "LOCK_SHADOW_STACK_STATUS", [77] = "TIMER_CREATE_RESTORE_IDS", [78] = "FUTEX_HASH", + [79] = "RSEQ_SLICE_EXTENSION", + [80] = "GET_INDIR_BR_LP_STATUS", + [81] = "SET_INDIR_BR_LP_STATUS", + [82] = "LOCK_INDIR_BR_LP_STATUS", }; static const char *prctl_set_mm_options[] = { [1] = "START_CODE", $ That now will be used to decode the syscall option and also to compose filters, for instance: [root@five ~]# perf trace -e syscalls:sys_enter_prctl --filter option==SET_NAME 0.000 Isolated Servi/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23f13b7aee) 0.032 DOM Worker/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23deb25670) 7.920 :3474328/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fbb10) 7.935 StreamT~s #374/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fb970) 8.400 Isolated Servi/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24bab10) 8.418 StreamT~s #374/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24ba970) ^C[root@five ~]# This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/prctl.h include/uapi/linux/prctl.h Please see tools/include/uapi/README for further details. Cc: Deepak Gupta Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Arnaldo Carvalho de Melo commit 8da8df43124128e0478beadb58faa9cab56a3f13 Author: Yang Xiuwei Date: Wed Mar 4 12:51:19 2026 +0800 block: use __bio_add_page in bio_copy_kern Since the bio is allocated with the exact number of pages needed via blk_rq_map_bio_alloc(), and the loop iterates exactly that many times, bio_add_page() cannot fail due to insufficient space. Switch to __bio_add_page() and remove the dead error handling code. Suggested-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Signed-off-by: Yang Xiuwei Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 0cfe9c4838f1147713f6b5c02094cd4dc0c598fa Author: Varun Gupta Date: Mon Feb 23 23:21:45 2026 +0530 drm/xe: Fix memory leak in xe_vm_madvise_ioctl When check_bo_args_are_sane() validation fails, jump to the new free_vmas cleanup label to properly free the allocated resources. This ensures proper cleanup in this error path. Fixes: 293032eec4ba ("drm/xe/bo: Update atomic_access attribute on madvise") Cc: stable@vger.kernel.org # v6.18+ Reviewed-by: Shuicheng Lin Signed-off-by: Varun Gupta Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260223175145.1532801-1-varun.gupta@intel.com Signed-off-by: Tejas Upadhyay (cherry picked from commit 29bd06faf727a4b76663e4be0f7d770e2d2a7965) Signed-off-by: Rodrigo Vivi commit 3091723785def05ebfe6a50866f87a044ae314ba Author: Shuicheng Lin Date: Wed Feb 4 17:28:11 2026 +0000 drm/xe/reg_sr: Fix leak on xa_store failure Free the newly allocated entry when xa_store() fails to avoid a memory leak on the error path. v2: use goto fail_free. (Bala) Fixes: e5283bd4dfec ("drm/xe/reg_sr: Remove register pool") Cc: Balasubramani Vivekanandan Cc: Matt Roper Signed-off-by: Shuicheng Lin Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260204172810.1486719-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper (cherry picked from commit 6bc6fec71ac45f52db609af4e62bdb96b9f5fadb) Signed-off-by: Rodrigo Vivi commit 89865e6dc8487b627302bdced3f965cd0c406835 Author: Matt Roper Date: Fri Feb 27 08:43:41 2026 -0800 drm/xe/xe2_hpg: Correct implementation of Wa_16025250150 Wa_16025250150 asks us to set five register fields of the register to 0x1 each. However we were just OR'ing this into the existing register value (which has a default of 0x4 for each nibble-sized field) resulting in final field values of 0x5 instead of the desired 0x1. Correct the RTP programming (use FIELD_SET instead of SET) to ensure each field is assigned to exactly the value we want. Cc: Aradhya Bhatia Cc: Tejas Upadhyay Cc: stable@vger.kernel.org # v6.16+ Fixes: 7654d51f1fd8 ("drm/xe/xe2hpg: Add Wa_16025250150") Reviewed-by: Ngai-Mint Kwan Link: https://patch.msgid.link/20260227164341.3600098-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper (cherry picked from commit d139209ef88e48af1f6731cd45440421c757b6b5) Signed-off-by: Rodrigo Vivi commit b3368ecca9538b88ddf982ea99064860fd5add97 Author: Zhanjun Dong Date: Fri Feb 20 17:53:08 2026 -0500 drm/xe/gsc: Fix GSC proxy cleanup on early initialization failure xe_gsc_proxy_remove undoes what is done in both xe_gsc_proxy_init and xe_gsc_proxy_start; however, if we fail between those 2 calls, it is possible that the HW forcewake access hasn't been initialized yet and so we hit errors when the cleanup code tries to write GSC register. To avoid that, split the cleanup in 2 functions so that the HW cleanup is only called if the HW setup was completed successfully. Since the HW cleanup (interrupt disabling) is now removed from xe_gsc_proxy_remove, the cleanup on error paths in xe_gsc_proxy_start must be updated to disable interrupts before returning. Fixes: ff6cd29b690b ("drm/xe: Cleanup unwind of gt initialization") Signed-off-by: Zhanjun Dong Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260220225308.101469-1-zhanjun.dong@intel.com (cherry picked from commit 2b37c401b265c07b46408b5cb36a4b757c9b5060) Signed-off-by: Rodrigo Vivi commit a99d34e5ecb9a8f2212ee5a01140313bb115f9be Author: Thomas Hellström Date: Wed Feb 11 11:41:59 2026 +0100 Revert "drm/pagemap: Disable device-to-device migration" With commit a69d1ab971a6 ("mm: Fix a hmm_range_fault() livelock / starvation problem") device-to-device migration is not functional again and the disabling can be reverted. Add the above commit as a Fixes: tag in order for the revert to not take place unless that commit is present. This reverts commit 10dd1eaa80a56d3cf6d7c36b5269c8fed617f001. Cc: Matthew Brost Fixes: b570f37a2ce4 ("mm: Fix a hmm_range_fault() livelock / starvation problem") Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260211104159.114947-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 1a3c0049b3f56278c9caf2784c53f6ab435fd12c) Signed-off-by: Rodrigo Vivi [Rodrigo updated Fixes tag] commit d320f160aa5ff36cdf83c645cca52b615e866e32 Author: Darrick J. Wong Date: Mon Mar 2 09:30:02 2026 -0800 iomap: reject delalloc mappings during writeback Filesystems should never provide a delayed allocation mapping to writeback; they're supposed to allocate the space before replying. This can lead to weird IO errors and crashes in the block layer if the filesystem is being malicious, or if it hadn't set iomap->dev because it's a delalloc mapping. Fix this by failing writeback on delalloc mappings. Currently no filesystems actually misbehave in this manner, but we ought to be stricter about things like that. Cc: stable@vger.kernel.org # v5.5 Fixes: 598ecfbaa742ac ("iomap: lift the xfs writeback code to iomap") Signed-off-by: Darrick J. Wong Link: https://patch.msgid.link/20260302173002.GL13829@frogsfrogsfrogs Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Christian Brauner commit 531bb98a030cc1073bd7ed9a502c0a3a781e92ee Author: Pavel Begunkov Date: Wed Mar 4 12:37:43 2026 +0000 io_uring/zcrx: use READ_ONCE with user shared RQEs Refill queue entries are shared with the user space, use READ_ONCE when reading them. Fixes: 34a3e60821ab9 ("io_uring/zcrx: implement zerocopy receive pp memory provider"); Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit a99cac460ddeb3705cb54a8421339f351586b25d Author: Jouni Högander Date: Wed Feb 25 09:42:21 2026 +0200 drm/i915/psr: Fix for Panel Replay X granularity DPCD register handling DP specification is saying value 0xff 0xff in PANEL REPLAY SELECTIVE UPDATE X GRANULARITY CAPABILITY registers (0xb2 and 0xb3) means full-line granularity. Take this into account when handling Panel Replay X granularity informed by the panel. Fixes: 1cc854647450 ("drm/i915/psr: Use SU granularity information available in intel_connector") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7284 Tested-by: Mark Pearson Signed-off-by: Jouni Högander Reviewed-by: Uma Shankar Link: https://patch.msgid.link/20260225074221.1744330-2-jouni.hogander@intel.com (cherry picked from commit f5c8f824a495e849492f09a43bd965a8f4d86cb2) Signed-off-by: Joonas Lahtinen commit ace7dcc8181373a0338efa1686c5e36eb121dff2 Author: Jouni Högander Date: Wed Feb 25 09:42:20 2026 +0200 drm/dp: Add definition for Panel Replay full-line granularity DP specification is saying value 0xff 0xff in PANEL REPLAY SELECTIVE UPDATE X GRANULARITY CAPABILITY registers (0xb2 and 0xb3) means full-line granularity. Add definition for this. Cc: dri-devel@lists.freedesktop.org Signed-off-by: Jouni Högander Reviewed-by: Uma Shankar Acked-by: Maarten Lankhorst Link: https://patch.msgid.link/20260225074221.1744330-1-jouni.hogander@intel.com (cherry picked from commit b93311673263bb98a200ab1cb6304f969bdada5c) Signed-off-by: Joonas Lahtinen commit d3ccc4d86dfe2d7321276bb1a97ab0afcbfd7200 Merge: 10047142d6ce3b debc1a492b2695 Author: Christian Brauner Date: Wed Mar 4 14:19:05 2026 +0100 Merge patch "iomap: don't mark folio uptodate if read IO has bytes pending" Joanne Koong says: This is a fix for this scenario: ->read_folio() gets called on a folio size that is 16k while the file is 4k: a) ifs->read_bytes_pending gets initialized to 16k b) ->read_folio_range() is called for the 4k read c) the 4k read succeeds, ifs->read_bytes_pending is now 12k and the 0 to 4k range is marked uptodate d) the post-eof blocks are zeroed and marked uptodate in the call to iomap_set_range_uptodate() e) iomap_set_range_uptodate() sees all the ranges are marked uptodate and it marks the folio uptodate f) iomap_read_end() gets called to subtract the 12k from ifs->read_bytes_pending. it too sees all the ranges are marked uptodate and marks the folio uptodate using XOR g) the XOR call clears the uptodate flag on the folio The same situation can occur if the last range read for the folio is done as an inline read and all the previous ranges have already completed by the time the inline read completes. For more context, the full discussion can be found in [1]. There was a discussion about alternative approaches in that thread, but they had more complications. There is another discussion in v1 [2] about consolidating the read paths. Until that is resolved, this patch fixes the issue. [1] https://lore.kernel.org/linux-fsdevel/CAJnrk1Z9za5w4FoJqTGx50zR2haHHaoot1KJViQyEHJQq4=34w@mail.gmail.com/#t [2] https://lore.kernel.org/linux-fsdevel/20260219003911.344478-1-joannelkoong@gmail.com/T/#u * patches from https://patch.msgid.link/20260303233420.874231-1-joannelkoong@gmail.com: iomap: don't mark folio uptodate if read IO has bytes pending Link: https://patch.msgid.link/20260303233420.874231-1-joannelkoong@gmail.com Signed-off-by: Christian Brauner commit debc1a492b2695d05973994fb0f796dbd9ceaae6 Author: Joanne Koong Date: Tue Mar 3 15:34:20 2026 -0800 iomap: don't mark folio uptodate if read IO has bytes pending If a folio has ifs metadata attached to it and the folio is partially read in through an async IO helper with the rest of it then being read in through post-EOF zeroing or as inline data, and the helper successfully finishes the read first, then post-EOF zeroing / reading inline will mark the folio as uptodate in iomap_set_range_uptodate(). This is a problem because when the read completion path later calls iomap_read_end(), it will call folio_end_read(), which sets the uptodate bit using XOR semantics. Calling folio_end_read() on a folio that was already marked uptodate clears the uptodate bit. Fix this by not marking the folio as uptodate if the read IO has bytes pending. The folio uptodate state will be set in the read completion path through iomap_end_read() -> folio_end_read(). Reported-by: Wei Gao Suggested-by: Sasha Levin Tested-by: Wei Gao Reviewed-by: Darrick J. Wong Cc: stable@vger.kernel.org # v6.19 Link: https://lore.kernel.org/linux-fsdevel/aYbmy8JdgXwsGaPP@autotest-wegao.qe.prg2.suse.org/ Fixes: b2f35ac4146d ("iomap: add caller-provided callbacks for read and readahead") Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20260303233420.874231-2-joannelkoong@gmail.com Signed-off-by: Christian Brauner commit 6932256d3a3764f3a5e06e2cb8603be45b6a9fef Author: Gerd Rausch Date: Wed Feb 25 15:37:49 2026 -0800 time/jiffies: Fix sysctl file error on configurations where USER_HZ < HZ Commit 2dc164a48e6fd ("sysctl: Create converter functions with two new macros") incorrectly returns error to user space when jiffies sysctl converter is used. The old overflow check got replaced with an unconditional one: + if (USER_HZ < HZ) + return -EINVAL; which will always be true on configurations with "USER_HZ < HZ". Remove the check; it is no longer needed as clock_t_to_jiffies() returns ULONG_MAX for the overflow case and proc_int_u2k_conv_uop() checks for "> INT_MAX" after conversion Fixes: 2dc164a48e6fd ("sysctl: Create converter functions with two new macros") Reported-by: Colm Harrington Signed-off-by: Gerd Rausch Signed-off-by: Joel Granados commit cfc69c2e6c699c96949f7b0455195b0bfb7dc715 Author: Charles Haithcock Date: Fri Feb 27 18:41:15 2026 -0700 i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" This reverts commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1. Under rare circumstances, multiple udev threads can collect i801 device info on boot and walk i801_acpi_io_handler somewhat concurrently. The first will note the area is reserved by acpi to prevent further touches. This ultimately causes the area to be deregistered. The second will enter i801_acpi_io_handler after the area is unregistered but before a check can be made that the area is unregistered. i2c_lock_bus relies on the now unregistered area containing lock_ops to lock the bus. The end result is a kernel panic on boot with the following backtrace; [ 14.971872] ioatdma 0000:09:00.2: enabling device (0100 -> 0102) [ 14.971873] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 14.971880] #PF: supervisor read access in kernel mode [ 14.971884] #PF: error_code(0x0000) - not-present page [ 14.971887] PGD 0 P4D 0 [ 14.971894] Oops: 0000 [#1] PREEMPT SMP PTI [ 14.971900] CPU: 5 PID: 956 Comm: systemd-udevd Not tainted 5.14.0-611.5.1.el9_7.x86_64 #1 [ 14.971905] Hardware name: XXXXXXXXXXXXXXXXXXXXXXX BIOS 1.20.10.SV91 01/30/2023 [ 14.971908] RIP: 0010:i801_acpi_io_handler+0x2d/0xb0 [i2c_i801] [ 14.971929] Code: 00 00 49 8b 40 20 41 57 41 56 4d 8b b8 30 04 00 00 49 89 ce 41 55 41 89 d5 41 54 49 89 f4 be 02 00 00 00 55 4c 89 c5 53 89 fb <48> 8b 00 4c 89 c7 e8 18 61 54 e9 80 bd 80 04 00 00 00 75 09 4c 3b [ 14.971933] RSP: 0018:ffffbaa841483838 EFLAGS: 00010282 [ 14.971938] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9685e01ba568 [ 14.971941] RDX: 0000000000000008 RSI: 0000000000000002 RDI: 0000000000000000 [ 14.971944] RBP: ffff9685ca22f028 R08: ffff9685ca22f028 R09: ffff9685ca22f028 [ 14.971948] R10: 000000000000000b R11: 0000000000000580 R12: 0000000000000580 [ 14.971951] R13: 0000000000000008 R14: ffff9685e01ba568 R15: ffff9685c222f000 [ 14.971954] FS: 00007f8287c0ab40(0000) GS:ffff96a47f940000(0000) knlGS:0000000000000000 [ 14.971959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 14.971963] CR2: 0000000000000000 CR3: 0000000168090001 CR4: 00000000003706f0 [ 14.971966] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 14.971968] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 14.971972] Call Trace: [ 14.971977] [ 14.971981] ? show_trace_log_lvl+0x1c4/0x2df [ 14.971994] ? show_trace_log_lvl+0x1c4/0x2df [ 14.972003] ? acpi_ev_address_space_dispatch+0x16e/0x3c0 [ 14.972014] ? __die_body.cold+0x8/0xd [ 14.972021] ? page_fault_oops+0x132/0x170 [ 14.972028] ? exc_page_fault+0x61/0x150 [ 14.972036] ? asm_exc_page_fault+0x22/0x30 [ 14.972045] ? i801_acpi_io_handler+0x2d/0xb0 [i2c_i801] [ 14.972061] acpi_ev_address_space_dispatch+0x16e/0x3c0 [ 14.972069] ? __pfx_i801_acpi_io_handler+0x10/0x10 [i2c_i801] [ 14.972085] acpi_ex_access_region+0x5b/0xd0 [ 14.972093] acpi_ex_field_datum_io+0x73/0x2e0 [ 14.972100] acpi_ex_read_data_from_field+0x8e/0x230 [ 14.972106] acpi_ex_resolve_node_to_value+0x23d/0x310 [ 14.972114] acpi_ds_evaluate_name_path+0xad/0x110 [ 14.972121] acpi_ds_exec_end_op+0x321/0x510 [ 14.972127] acpi_ps_parse_loop+0xf7/0x680 [ 14.972136] acpi_ps_parse_aml+0x17a/0x3d0 [ 14.972143] acpi_ps_execute_method+0x137/0x270 [ 14.972150] acpi_ns_evaluate+0x1f4/0x2e0 [ 14.972158] acpi_evaluate_object+0x134/0x2f0 [ 14.972164] acpi_evaluate_integer+0x50/0xe0 [ 14.972173] ? vsnprintf+0x24b/0x570 [ 14.972181] acpi_ac_get_state.part.0+0x23/0x70 [ 14.972189] get_ac_property+0x4e/0x60 [ 14.972195] power_supply_show_property+0x90/0x1f0 [ 14.972205] add_prop_uevent+0x29/0x90 [ 14.972213] power_supply_uevent+0x109/0x1d0 [ 14.972222] dev_uevent+0x10e/0x2f0 [ 14.972228] uevent_show+0x8e/0x100 [ 14.972236] dev_attr_show+0x19/0x40 [ 14.972246] sysfs_kf_seq_show+0x9b/0x100 [ 14.972253] seq_read_iter+0x120/0x4b0 [ 14.972262] ? selinux_file_permission+0x106/0x150 [ 14.972273] vfs_read+0x24f/0x3a0 [ 14.972284] ksys_read+0x5f/0xe0 [ 14.972291] do_syscall_64+0x5f/0xe0 ... The kernel panic is mitigated by setting limiting the count of udev children to 1. Revert to using the acpi_lock to continue protecting marking the area as owned by firmware without relying on a lock in a potentially unmapped region of memory. Fixes: f707d6b9e7c1 ("i2c: i801: replace acpi_lock with I2C bus lock") Signed-off-by: Charles Haithcock [wsa: added Fixes-tag and updated comment stating the importance of the lock] Signed-off-by: Wolfram Sang commit 325291b20f8a6f14b9c82edbf5d12e4e71f6adaa Author: Zhang Heng Date: Wed Mar 4 14:32:55 2026 +0800 ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA Add a DMI quirk for the ASUS EXPERTBOOK PM1503CDA fixing the issue where the internal microphone was not detected. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221070 Cc: stable@vger.kernel.org Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260304063255.139331-1-zhangheng@kylinos.cn Signed-off-by: Mark Brown commit fbb143e4a6efa4a175e856fc898754b06cb13c4f Author: Biju Das Date: Wed Mar 4 07:19:55 2026 +0000 ASoC: dt-bindings: renesas,rz-ssi: Document RZ/G3L SoC Document RZ/G3L SSIF-2 bindings. The RZ/G3L SSIF-2 IP is identical to one found on the RZ/G2L SoC. Signed-off-by: Biju Das Link: https://patch.msgid.link/20260304072000.6787-1-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown commit 3d1973a0c76a78a4728cff13648a188ed486cf44 Author: Jan Stancek Date: Wed Feb 25 20:30:23 2026 +0100 x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths CONFIG_EFI_SBAT_FILE can be a relative path. When compiling using a different output directory (O=) the build currently fails because it can't find the filename set in CONFIG_EFI_SBAT_FILE: arch/x86/boot/compressed/sbat.S: Assembler messages: arch/x86/boot/compressed/sbat.S:6: Error: file not found: kernel.sbat Add $(srctree) as include dir for sbat.o. [ bp: Massage commit message. ] Fixes: 61b57d35396a ("x86/efi: Implement support for embedding SBAT data for x86") Signed-off-by: Jan Stancek Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Vitaly Kuznetsov Cc: Link: https://patch.msgid.link/f4eda155b0cef91d4d316b4e92f5771cb0aa7187.1772047658.git.jstancek@redhat.com commit a58d487fb1a52579d3c37544ea371da78ed70c45 Author: Maarten Lankhorst Date: Wed Mar 4 09:56:16 2026 +0100 drm/ttm/tests: Fix build failure on PREEMPT_RT Fix a compile error in the kunit tests when CONFIG_PREEMPT_RT is enabled, and the normal mutex is converted into a rtmutex. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602261547.3bM6yVAS-lkp@intel.com/ Reviewed-by: Jouni Högander Link: https://patch.msgid.link/20260304085616.1216961-1-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 0fb59eaca18f1254ecdce34354eec3cb1b3b5e10 Author: Shawn Lin Date: Wed Feb 25 10:55:01 2026 +0800 pmdomain: rockchip: Fix PD_VCODEC for RK3588 >From the RK3588 TRM Table 7-1 RK3588 Voltage Domain and Power Domain Summary, PD_RKVDEC0/1 and PD_VENC0/1 rely on VD_VCODEC which require extra voltages to be applied, otherwise it breaks RK3588-evb1-v10 board after vdec support landed[1]. The panic looks like below: rockchip-pm-domain fd8d8000.power-management:power-controller: failed to set domain 'rkvdec0' on, val=0 rockchip-pm-domain fd8d8000.power-management:power-controller: failed to set domain 'rkvdec1' on, val=0 ... Hardware name: Rockchip RK3588S EVB1 V10 Board (DT) Workqueue: pm genpd_power_off_work_fn Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x40/0x84 dump_stack+0x18/0x24 vpanic+0x1ec/0x4fc vpanic+0x0/0x4fc check_panic_on_warn+0x0/0x94 arm64_serror_panic+0x6c/0x78 do_serror+0xc4/0xcc el1h_64_error_handler+0x3c/0x5c el1h_64_error+0x6c/0x70 regmap_mmio_read32le+0x18/0x24 (P) regmap_bus_reg_read+0xfc/0x130 regmap_read+0x188/0x1ac regmap_read+0x54/0x78 rockchip_pd_power+0xcc/0x5f0 rockchip_pd_power_off+0x1c/0x4c genpd_power_off+0x84/0x120 genpd_power_off+0x1b4/0x260 genpd_power_off_work_fn+0x38/0x58 process_scheduled_works+0x194/0x2c4 worker_thread+0x2ac/0x3d8 kthread+0x104/0x124 ret_from_fork+0x10/0x20 SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x3000000,000e0005,40230521,0400720b Memory Limit: none ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]--- Chaoyi pointed out the PD_VCODEC is the parent of PD_RKVDEC0/1 and PD_VENC0/1, so checking the PD_VCODEC is enough. [1] https://lore.kernel.org/linux-rockchip/20251020212009.8852-2-detlev.casanova@collabora.com/ Fixes: db6df2e3fc16 ("pmdomain: rockchip: add regulator support") Cc: stable@vger.kernel.org Suggested-by: Chaoyi Chen Signed-off-by: Shawn Lin Reviewed-by: Chaoyi Chen Reviewed-by: Sebastian Reichel Signed-off-by: Ulf Hansson commit 6432f15c818cb30eec7c4ca378ecdebd9796f741 Author: Harry Yoo Date: Tue Mar 3 22:57:22 2026 +0900 mm/slab: change stride type from unsigned short to unsigned int Commit 7a8e71bc619d ("mm/slab: use stride to access slabobj_ext") defined the type of slab->stride as unsigned short, because the author initially planned to store stride within the lower 16 bits of the page_type field, but later stored it in unused bits in the counters field instead. However, the idea of having only 2-byte stride turned out to be a serious mistake. On systems with 64k pages, order-1 pages are 128k, which is larger than USHRT_MAX. It triggers a debug warning because s->size is 128k while stride, truncated to 2 bytes, becomes zero: ------------[ cut here ]------------ Warning! stride (0) != s->size (131072) WARNING: mm/slub.c:2231 at alloc_slab_obj_exts_early.constprop.0+0x524/0x534, CPU#6: systemd-sysctl/307 Modules linked in: CPU: 6 UID: 0 PID: 307 Comm: systemd-sysctl Not tainted 7.0.0-rc1+ #6 PREEMPTLAZY Hardware name: IBM,9009-22A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW950.E0 (VL950_179) hv:phyp pSeries NIP: c0000000008a9ac0 LR: c0000000008a9abc CTR: 0000000000000000 REGS: c0000000141f7390 TRAP: 0700 Not tainted (7.0.0-rc1+) MSR: 8000000000029033 CR: 28004400 XER: 00000005 CFAR: c000000000279318 IRQMASK: 0 GPR00: c0000000008a9abc c0000000141f7630 c00000000252a300 c00000001427b200 GPR04: 0000000000000004 0000000000000000 c000000000278fd0 0000000000000000 GPR08: fffffffffffe0000 0000000000000000 0000000000000000 0000000022004400 GPR12: c000000000f644b0 c000000017ff8f00 0000000000000000 0000000000000000 GPR16: 0000000000000000 c0000000141f7aa0 0000000000000000 c0000000141f7a88 GPR20: 0000000000000000 0000000000400cc0 ffffffffffffffff c00000001427b180 GPR24: 0000000000000004 00000000000c0cc0 c000000004e89a20 c00000005de90011 GPR28: 0000000000010010 c00000005df00000 c000000006017f80 c00c000000177a00 NIP [c0000000008a9ac0] alloc_slab_obj_exts_early.constprop.0+0x524/0x534 LR [c0000000008a9abc] alloc_slab_obj_exts_early.constprop.0+0x520/0x534 Call Trace: [c0000000141f7630] [c0000000008a9abc] alloc_slab_obj_exts_early.constprop.0+0x520/0x534 (unreliable) [c0000000141f76c0] [c0000000008aafbc] allocate_slab+0x154/0x94c [c0000000141f7760] [c0000000008b41c0] refill_objects+0x124/0x16c [c0000000141f77c0] [c0000000008b4be0] __pcs_replace_empty_main+0x2b0/0x444 [c0000000141f7810] [c0000000008b9600] __kvmalloc_node_noprof+0x840/0x914 [c0000000141f7900] [c000000000a3dd40] seq_read_iter+0x60c/0xb00 [c0000000141f7a10] [c000000000b36b24] proc_reg_read_iter+0x154/0x1fc [c0000000141f7a50] [c0000000009cee7c] vfs_read+0x39c/0x4e4 [c0000000141f7b30] [c0000000009d0214] ksys_read+0x9c/0x180 [c0000000141f7b90] [c00000000003a8d0] system_call_exception+0x1e0/0x4b0 [c0000000141f7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec This leads to slab_obj_ext() returning the first slabobj_ext or all objects and confuses the reference counting of object cgroups [1] and memory (un)charging for memory cgroups [2]. Fortunately, the counters field has 32 unused bits instead of 16 on 64-bit CPUs, which is wide enough to hold any value of s->size. Change the type to unsigned int. Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/lkml/ca241daa-e7e7-4604-a48d-de91ec9184a5@linux.ibm.com [1] Closes: https://lore.kernel.org/all/ddff7c7d-c0c3-4780-808f-9a83268bbf0c@linux.ibm.com [2] Fixes: 7a8e71bc619d ("mm/slab: use stride to access slabobj_ext") Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260303135722.2680521-1-harry.yoo@oracle.com Reviewed-by: Hao Li Tested-by: Venkat Rao Bagalkote Signed-off-by: Vlastimil Babka (SUSE) commit fb1091febd668398aa84c161b8d9a1834321e021 Author: Vlastimil Babka (SUSE) Date: Mon Mar 2 10:55:37 2026 +0100 mm/slab: allow sheaf refill if blocking is not allowed Ming Lei reported [1] a regression in the ublk null target benchmark due to sheaves. The profile shows that the alloc_from_pcs() fastpath fails and allocations fall back to ___slab_alloc(). It also shows the allocations happen through mempool_alloc(). The strategy of mempool_alloc() is to call the underlying allocator (here slab) without __GFP_DIRECT_RECLAIM first. This does not play well with __pcs_replace_empty_main() checking for gfpflags_allow_blocking() to decide if it should refill an empty sheaf or fallback to the slowpath, so we end up falling back. We could change the mempool strategy but there might be other paths doing the same ting. So instead allow sheaf refill when blocking is not allowed, changing the condition to gfpflags_allow_spinning(). The original condition was unnecessarily restrictive. Note this doesn't fully resolve the regression [1] as another component of that are memoryless nodes, which is to be addressed separately. Reported-by: Ming Lei Fixes: e47c897a2949 ("slab: add sheaves to most caches") Link: https://lore.kernel.org/all/aZ0SbIqaIkwoW2mB@fedora/ [1] Link: https://patch.msgid.link/20260302095536.34062-2-vbabka@kernel.org Signed-off-by: Vlastimil Babka (SUSE) commit aac9b27f7c1f2b2cf7f50a9ca633ecbbcaf22af9 Author: Niklas Cassel Date: Tue Mar 3 11:03:42 2026 +0100 ata: libata: cancel pending work after clearing deferred_qc Syzbot reported a WARN_ON() in ata_scsi_deferred_qc_work(), caused by ap->ops->qc_defer() returning non-zero before issuing the deferred qc. ata_scsi_schedule_deferred_qc() is called during each command completion. This function will check if there is a deferred QC, and if ap->ops->qc_defer() returns zero, meaning that it is possible to queue the deferred qc at this time (without being deferred), then it will queue the work which will issue the deferred qc. Once the work get to run, which can potentially be a very long time after the work was scheduled, there is a WARN_ON() if ap->ops->qc_defer() returns non-zero. While we hold the ap->lock both when assigning and clearing deferred_qc, and the work itself holds the ap->lock, the code currently does not cancel the work after clearing the deferred qc. This means that the following scenario can happen: 1) One or several NCQ commands are queued. 2) A non-NCQ command is queued, gets stored in ap->deferred_qc. 3) Last NCQ command gets completed, work is queued to issue the deferred qc. 4) Timeout or error happens, ap->deferred_qc is cleared. The queued work is currently NOT canceled. 5) Port is reset. 6) One or several NCQ commands are queued. 7) A non-NCQ command is queued, gets stored in ap->deferred_qc. 8) Work is finally run. Yet at this time, there is still NCQ commands in flight. The work in 8) really belongs to the non-NCQ command in 2), not to the non-NCQ command in 7). The reason why the work is executed when it is not supposed to, is because it was never canceled when ap->deferred_qc was cleared in 4). Thus, ensure that we always cancel the work after clearing ap->deferred_qc. Another potential fix would have been to let ata_scsi_deferred_qc_work() do nothing if ap->ops->qc_defer() returns non-zero. However, canceling the work when clearing ap->deferred_qc seems slightly more logical, as we hold the ap->lock when clearing ap->deferred_qc, so we know that the work cannot be holding the lock. (The function could be waiting for the lock, but that is okay since it will do nothing if ap->deferred_qc is not set.) Reported-by: syzbot+bcaf842a1e8ead8dfb89@syzkaller.appspotmail.com Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Fixes: eddb98ad9364 ("ata: libata-eh: correctly handle deferred qc timeouts") Reviewed-by: Igor Pylypiv Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 61ded1083b264ff67ca8c2de822c66b6febaf9a8 Author: Yujie Liu Date: Fri Feb 27 16:24:52 2026 +0800 drm/sched: Fix kernel-doc warning for drm_sched_job_done() There is a kernel-doc warning for the scheduler: Warning: drivers/gpu/drm/scheduler/sched_main.c:367 function parameter 'result' not described in 'drm_sched_job_done' Fix the warning by describing the undocumented error code. Fixes: 539f9ee4b52a ("drm/scheduler: properly forward fence errors") Signed-off-by: Yujie Liu [phasta: Flesh out commit message] Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260227082452.1802922-1-yujie.liu@intel.com commit 0ca1a8331c0fa5e57844e003a5d667a15b1e002c Author: Darrick J. Wong Date: Mon Mar 2 09:31:58 2026 -0800 xfs: fix race between healthmon unmount and read_iter xfs/1879 on one of my test VMs got stuck due to the xfs_io healthmon subcommand sleeping in wait_event_interruptible at: xfs_healthmon_read_iter+0x558/0x5f8 [xfs] vfs_read+0x248/0x320 ksys_read+0x78/0x120 Looking at xfs_healthmon_read_iter, in !O_NONBLOCK mode it will sleep until the mount cookie == DETACHED_MOUNT_COOKIE, there are events waiting to be formatted, or there are formatted events in the read buffer that could be copied to userspace. Poking into the running kernel, I see that there are zero events in the list, the read buffer is empty, and the mount cookie is indeed in DETACHED state. IOWs, xfs_healthmon_has_eventdata should have returned true, but instead we're asleep waiting for a wakeup. I think what happened here is that xfs_healthmon_read_iter and xfs_healthmon_unmount were racing with each other, and _read_iter lost the race. _unmount queued an unmount event, which woke up _read_iter. It found, formatted, and copied the event out to userspace. That cleared out the pending event list and emptied the read buffer. xfs_io then called read() again, so _has_eventdata decided that we should sleep on the empty event queue. Next, _unmount called xfs_healthmon_detach, which set the mount cookie to DETACHED. Unfortunately, it didn't call wake_up_all on the hm, so the wait_event_interruptible in the _read_iter thread remains asleep. That's why the test stalled. Fix this by moving the wake_up_all call to xfs_healthmon_detach. Fixes: b3a289a2a9397b ("xfs: create event queuing, formatting, and discovery infrastructure") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 6270b8ac2f41858952074b23c2d3d9aa2fe1bfa9 Author: Damien Le Moal Date: Thu Feb 26 07:46:46 2026 +0900 xfs: remove scratch field from struct xfs_gc_bio The scratch field in struct xfs_gc_bio is unused. Remove it. Fixes: 102f444b57b3 ("xfs: rework zone GC buffer management") Signed-off-by: Damien Le Moal Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit b3b1d3ae1d87bc9398fb715c945968bf4c75a09a Author: Maximilian Pezzullo Date: Wed Mar 4 08:22:59 2026 +0100 ata: libata-core: Disable LPM on ST1000DM010-2EP102 According to a user report, the ST1000DM010-2EP102 has problems with LPM, causing random system freezes. The drive belongs to the same BarraCuda family as the ST2000DM008-2FR102 which has the same issue. Cc: stable@vger.kernel.org Fixes: 7627a0edef54 ("ata: ahci: Drop low power policy board type") Reported-by: Filippo Baiamonte Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221163 Signed-off-by: Maximilian Pezzullo Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 5c3daa5301693d2e5364483a3405649a0fdaed98 Author: Felix Gu Date: Mon Mar 2 22:31:44 2026 +0800 power: sequencing: pcie-m2: Fix device node reference leak in probe In pwrseq_pcie_m2_probe(), ctx->of_node acquires an explicit reference to the device node using of_node_get(), but there is no corresponding of_node_put() in the driver's error handling paths or removal. Since the ctx is tied to the lifecycle of the platform device, there is no need to hold an additional reference to the device's own of_node. Fixes: 52e7b5bd62ba ("power: sequencing: Add the Power Sequencing driver for the PCIe M.2 connectors") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260302-m2-v1-1-a6533e18aa69@gmail.com Signed-off-by: Bartosz Golaszewski commit a08aaf3968aec5d05cd32c801b8cc0c61da69c41 Author: Abhijit Gangurde Date: Fri Feb 27 11:48:09 2026 +0530 RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() ionic_build_hdr() populated the Ethernet source MAC (hdr->eth.smac_h) by passing the header’s storage directly to rdma_read_gid_l2_fields(). However, ib_ud_header_init() is called after that and re-initializes the UD header, which wipes the previously written smac_h. As a result, packets are emitted with an zero source MAC address on the wire. Correct the source MAC by reading the GID-derived smac into a temporary buffer and copy it after ib_ud_header_init() completes. Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Cc: stable@vger.kernel.org # 6.18 Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20260227061809.2979990-1-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky commit 29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2 Author: Jacob Moroni Date: Fri Feb 27 15:27:43 2026 +0000 RDMA/irdma: Fix double free related to rereg_user_mr If IB_MR_REREG_TRANS is set during rereg_user_mr, the umem will be released and a new one will be allocated in irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans fails after the new umem is allocated, it releases the umem, but does not set iwmr->region to NULL. The problem is that this failure is propagated to the user, who will then call ibv_dereg_mr (as they should). Then, the dereg_mr path will see a non-NULL umem and attempt to call ib_umem_release again. Fix this by setting iwmr->region to NULL after ib_umem_release. Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region") Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260227152743.1183388-1-jmoroni@google.com Signed-off-by: Leon Romanovsky commit fbdfa8da05b6ae44114fc4f9b3e83e1736fd411c Author: Naveen Anandhan Date: Sat Feb 28 13:17:35 2026 +0530 selftests: tc-testing: fix list_categories() crash on list type list_categories() builds a set directly from the 'category' field of each test case. Since 'category' is a list, set(map(...)) attempts to insert lists into a set, which raises: TypeError: unhashable type: 'list' Flatten category lists and collect unique category names using set.update() instead. Signed-off-by: Naveen Anandhan Signed-off-by: David S. Miller commit 04e707cb77c272cb0bb2e2e3c5c7f844d804a089 Author: Sourabh Jain Date: Fri Feb 27 22:48:01 2026 +0530 powerpc/crash: adjust the elfcorehdr size With crash hotplug support enabled, additional memory is allocated to the elfcorehdr kexec segment to accommodate resources added during memory hotplug events. However, the kdump FDT is not updated with the same size, which can result in elfcorehdr corruption in the kdump kernel. Update elf_headers_sz (the kimage member representing the size of the elfcorehdr kexec segment) to reflect the total memory allocated for the elfcorehdr segment instead of the elfcorehdr buffer size at the time of kdump load. This allows of_kexec_alloc_and_setup_fdt() to reserve the full elfcorehdr memory in the kdump FDT and prevents elfcorehdr corruption. Fixes: 849599b702ef8 ("powerpc/crash: add crash memory hotplug support") Reviewed-by: Hari Bathini Signed-off-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260227171801.2238847-1-sourabhjain@linux.ibm.com commit 20197b967a6a29dab81495f25a988515bda84cfe Author: Sourabh Jain Date: Wed Dec 24 20:42:57 2025 +0530 powerpc/kexec/core: use big-endian types for crash variables Use explicit word-sized big-endian types for kexec and crash related variables. This makes the endianness unambiguous and avoids type mismatches that trigger sparse warnings. The change addresses sparse warnings like below (seen on both 32-bit and 64-bit builds): CHECK ../arch/powerpc/kexec/core.c sparse: expected unsigned int static [addressable] [toplevel] [usertype] crashk_base sparse: got restricted __be32 [usertype] sparse: warning: incorrect type in assignment (different base types) sparse: expected unsigned int static [addressable] [toplevel] [usertype] crashk_size sparse: got restricted __be32 [usertype] sparse: warning: incorrect type in assignment (different base types) sparse: expected unsigned long long static [addressable] [toplevel] mem_limit sparse: got restricted __be32 [usertype] sparse: warning: incorrect type in assignment (different base types) sparse: expected unsigned int static [addressable] [toplevel] [usertype] kernel_end sparse: got restricted __be32 [usertype] No functional change intended. Fixes: ea961a828fe7 ("powerpc: Fix endian issues in kexec and crash dump code") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512221405.VHPKPjnp-lkp@intel.com/ Signed-off-by: Sourabh Jain Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251224151257.28672-1-sourabhjain@linux.ibm.com commit 6fc5d63c6ff5fe5e5beea3e7fe2ca3058351ae99 Author: Rob Herring (Arm) Date: Wed Oct 29 12:40:46 2025 -0500 powerpc/prom_init: Fixup missing #size-cells on PowerMac media-bay nodes Similar to other PowerMac mac-io devices, the media-bay node is missing the "#size-cells" property. Depends-on: commit 045b14ca5c36 ("of: WARN on deprecated #address-cells/#size-cells handling") Reported-by: Stan Johnson Signed-off-by: Rob Herring (Arm) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251029174047.1620073-1-robh@kernel.org commit 0706178339974d4332a782ba851cb6694bd210fe Author: Rob Herring (Arm) Date: Wed Jan 28 08:02:20 2026 -0600 powerpc: dts: fsl: Drop unused .dtsi files These files are not included by anything and therefore don't get built or tested. There's also no upstream driver for the interlaken-lac stuff. Signed-off-by: Rob Herring (Arm) Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260128140222.1627203-1-robh@kernel.org commit 0ee95a1d458630272d0415d0ffa9424fcb606c90 Author: Christophe Leroy (CS GROUP) Date: Tue Feb 3 08:30:41 2026 +0100 powerpc/uaccess: Fix inline assembly for clang build on PPC32 Test robot reports the following error with clang-16.0.6: In file included from kernel/rseq.c:75: include/linux/rseq_entry.h:141:3: error: invalid operand for instruction unsafe_get_user(offset, &ucs->post_commit_offset, efault); ^ include/linux/uaccess.h:608:2: note: expanded from macro 'unsafe_get_user' arch_unsafe_get_user(x, ptr, local_label); \ ^ arch/powerpc/include/asm/uaccess.h:518:2: note: expanded from macro 'arch_unsafe_get_user' __get_user_size_goto(__gu_val, __gu_addr, sizeof(*(p)), e); \ ^ arch/powerpc/include/asm/uaccess.h:284:2: note: expanded from macro '__get_user_size_goto' __get_user_size_allowed(x, ptr, size, __gus_retval); \ ^ arch/powerpc/include/asm/uaccess.h:275:10: note: expanded from macro '__get_user_size_allowed' case 8: __get_user_asm2(x, (u64 __user *)ptr, retval); break; \ ^ arch/powerpc/include/asm/uaccess.h:258:4: note: expanded from macro '__get_user_asm2' " li %1+1,0\n" \ ^ :7:5: note: instantiated into assembly here li 31+1,0 ^ 1 error generated. On PPC32, for 64 bits vars a pair of registers is used. Usually the lower register in the pair is the high part and the higher register is the low part. GCC uses r3/r4 ... r11/r12 ... r14/r15 ... r30/r31 In older kernel code inline assembly was using %1 and %1+1 to represent 64 bits values. However here it looks like clang uses r31 as high part, allthough r32 doesn't exist hence the error. Allthoug %1+1 should work, most places now use %L1 instead of %1+1, so let's do the same here. With that change, the build doesn't fail anymore and a disassembly shows clang uses r17/r18 and r31/r14 pair when GCC would have used r16/r17 and r30/r31: Disassembly of section .fixup: 00000000 <.fixup>: 0: 38 a0 ff f2 li r5,-14 4: 3a 20 00 00 li r17,0 8: 3a 40 00 00 li r18,0 c: 48 00 00 00 b c <.fixup+0xc> c: R_PPC_REL24 .text+0xbc 10: 38 a0 ff f2 li r5,-14 14: 3b e0 00 00 li r31,0 18: 39 c0 00 00 li r14,0 1c: 48 00 00 00 b 1c <.fixup+0x1c> 1c: R_PPC_REL24 .text+0x144 Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602021825.otcItxGi-lkp@intel.com/ Fixes: c20beffeec3c ("powerpc/uaccess: Use flexible addressing with __put_user()/__get_user()") Signed-off-by: Christophe Leroy (CS GROUP) Acked-by: Nathan Chancellor Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/8ca3a657a650e497a96bfe7acde2f637dadab344.1770103646.git.chleroy@kernel.org commit b9e7e3ea605f23d342c67fc5bded99bcaa32d93b Author: Christophe Leroy Date: Tue Jan 6 18:40:19 2026 +0100 powerpc/e500: Always use 64 bits PTE Today there are two PTE formats for e500: - The 64 bits format, used - On 64 bits kernel - On 32 bits kernel with 64 bits physical addresses - On 32 bits kernel with support of huge pages - The 32 bits format, used in other cases Maintaining two PTE formats means unnecessary maintenance burden because every change needs to be implemented and tested for both formats. Remove the 32 bits PTE format. The memory usage increase due to larger PTEs is minimal (approx. 0,1% of memory). This also means that from now on huge pages are supported also with 32 bits physical addresses. Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/04a658209ea78dcc0f3dbde6b2c29cf1939adfe9.1767721208.git.chleroy@kernel.org commit e39bb9e02b68942f8e9359d2a3efe7d37ae6be0e Author: Qing Wang Date: Fri Feb 27 10:58:42 2026 +0800 tracing: Fix WARN_ON in tracing_buffers_mmap_close When a process forks, the child process copies the parent's VMAs but the user_mapped reference count is not incremented. As a result, when both the parent and child processes exit, tracing_buffers_mmap_close() is called twice. On the second call, user_mapped is already 0, causing the function to return -ENODEV and triggering a WARN_ON. Normally, this isn't an issue as the memory is mapped with VM_DONTCOPY set. But this is only a hint, and the application can call madvise(MADVISE_DOFORK) which resets the VM_DONTCOPY flag. When the application does that, it can trigger this issue on fork. Fix it by incrementing the user_mapped reference count without re-mapping the pages in the VMA's open callback. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Vincent Donnefort Cc: Lorenzo Stoakes Link: https://patch.msgid.link/20260227025842.1085206-1-wangqing7171@gmail.com Fixes: cf9f0f7c4c5bb ("tracing: Allow user-space mapping of the ring-buffer") Reported-by: syzbot+3b5dd2030fe08afdf65d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3b5dd2030fe08afdf65d Tested-by: syzbot+3b5dd2030fe08afdf65d@syzkaller.appspotmail.com Signed-off-by: Qing Wang Signed-off-by: Steven Rostedt (Google) commit a5dd6f58666f22ae16b98a2177bebc3340d38fe9 Author: Masami Hiramatsu (Google) Date: Tue Mar 3 21:57:38 2026 -0500 tracing: Disable preemption in the tracepoint callbacks handling filtered pids Filtering PIDs for events triggered the following during selftests: [37] event tracing - restricts events based on pid notrace filtering [ 155.874095] [ 155.874869] ============================= [ 155.876037] WARNING: suspicious RCU usage [ 155.877287] 7.0.0-rc1-00004-g8cd473a19bc7 #7 Not tainted [ 155.879263] ----------------------------- [ 155.882839] kernel/trace/trace_events.c:1057 suspicious rcu_dereference_check() usage! [ 155.889281] [ 155.889281] other info that might help us debug this: [ 155.889281] [ 155.894519] [ 155.894519] rcu_scheduler_active = 2, debug_locks = 1 [ 155.898068] no locks held by ftracetest/4364. [ 155.900524] [ 155.900524] stack backtrace: [ 155.902645] CPU: 1 UID: 0 PID: 4364 Comm: ftracetest Not tainted 7.0.0-rc1-00004-g8cd473a19bc7 #7 PREEMPT(lazy) [ 155.902648] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 155.902651] Call Trace: [ 155.902655] [ 155.902659] dump_stack_lvl+0x67/0x90 [ 155.902665] lockdep_rcu_suspicious+0x154/0x1a0 [ 155.902672] event_filter_pid_sched_process_fork+0x9a/0xd0 [ 155.902678] kernel_clone+0x367/0x3a0 [ 155.902689] __x64_sys_clone+0x116/0x140 [ 155.902696] do_syscall_64+0x158/0x460 [ 155.902700] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.902702] ? trace_irq_disable+0x1d/0xc0 [ 155.902709] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.902711] RIP: 0033:0x4697c3 [ 155.902716] Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00 [ 155.902718] RSP: 002b:00007ffc41150428 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 155.902721] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004697c3 [ 155.902722] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 155.902724] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000003fccf990 [ 155.902725] R10: 000000003fccd690 R11: 0000000000000246 R12: 0000000000000001 [ 155.902726] R13: 000000003fce8103 R14: 0000000000000001 R15: 0000000000000000 [ 155.902733] [ 155.902747] The tracepoint callbacks recently were changed to allow preemption. The event PID filtering callbacks that were attached to the fork and exit tracepoints expected preemption disabled in order to access the RCU protected PID lists. Add a guard(preempt)() to protect the references to the PID list. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260303215738.6ab275af@fedora Fixes: a46023d5616e ("tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast") Link: https://patch.msgid.link/20260303131706.96057f61a48a34c43ce1e396@kernel.org Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit cc337974cd1084f9821179eb66f4e470d9fd2ed8 Author: Steven Rostedt Date: Mon Mar 2 21:35:46 2026 -0500 ftrace: Disable preemption in the tracepoint callbacks handling filtered pids When function trace PID filtering is enabled, the function tracer will attach a callback to the fork tracepoint as well as the exit tracepoint that will add the forked child PID to the PID filtering list as well as remove the PID that is exiting. Commit a46023d5616e ("tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast") removed the disabling of preemption when calling tracepoint callbacks. The callbacks used for the PID filtering accounting depended on preemption being disabled, and now the trigger a "suspicious RCU usage" warning message. Make them explicitly disable preemption. Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260302213546.156e3e4f@gandalf.local.home Fixes: a46023d5616e ("tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast") Signed-off-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit 0a663b764dbdf135a126284f454c9f01f95a87d4 Author: Huiwen He Date: Tue Feb 24 10:35:44 2026 +0800 tracing: Fix syscall events activation by ensuring refcount hits zero When multiple syscall events are specified in the kernel command line (e.g., trace_event=syscalls:sys_enter_openat,syscalls:sys_enter_close), they are often not captured after boot, even though they appear enabled in the tracing/set_event file. The issue stems from how syscall events are initialized. Syscall tracepoints require the global reference count (sys_tracepoint_refcount) to transition from 0 to 1 to trigger the registration of the syscall work (TIF_SYSCALL_TRACEPOINT) for tasks, including the init process (pid 1). The current implementation of early_enable_events() with disable_first=true used an interleaved sequence of "Disable A -> Enable A -> Disable B -> Enable B". If multiple syscalls are enabled, the refcount never drops to zero, preventing the 0->1 transition that triggers actual registration. Fix this by splitting early_enable_events() into two distinct phases: 1. Disable all events specified in the buffer. 2. Enable all events specified in the buffer. This ensures the refcount hits zero before re-enabling, allowing syscall events to be properly activated during early boot. The code is also refactored to use a helper function to avoid logic duplication between the disable and enable phases. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260224023544.1250787-1-hehuiwen@kylinos.cn Fixes: ce1039bd3a89 ("tracing: Fix enabling of syscall events on the command line") Signed-off-by: Huiwen He Signed-off-by: Steven Rostedt (Google) commit b96d0c59cdbb2a22b2545f6f3d5c6276b05761dd Author: Shengming Hu Date: Sat Feb 21 11:33:14 2026 +0800 fgraph: Fix thresh_return nosleeptime double-adjust trace_graph_thresh_return() called handle_nosleeptime() and then delegated to trace_graph_return(), which calls handle_nosleeptime() again. When sleep-time accounting is disabled this double-adjusts calltime and can produce bogus durations (including underflow). Fix this by computing rettime once, applying handle_nosleeptime() only once, using the adjusted calltime for threshold comparison, and writing the return event directly via __trace_graph_return() when the threshold is met. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260221113314048jE4VRwIyZEALiYByGK0My@zte.com.cn Fixes: 3c9880f3ab52b ("ftrace: Use a running sleeptime instead of saving on shadow stack") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Shengming Hu Signed-off-by: Steven Rostedt (Google) commit 6ca8379b5d36e22b04e6315c3e49a6083377c862 Author: Shengming Hu Date: Sat Feb 21 11:30:07 2026 +0800 fgraph: Fix thresh_return clear per-task notrace When tracing_thresh is enabled, function graph tracing uses trace_graph_thresh_return() as the return handler. Unlike trace_graph_return(), it did not clear the per-task TRACE_GRAPH_NOTRACE flag set by the entry handler for set_graph_notrace addresses. This could leave the task permanently in "notrace" state and effectively disable function graph tracing for that task. Mirror trace_graph_return()'s per-task notrace handling by clearing TRACE_GRAPH_NOTRACE and returning early when set. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260221113007819YgrZsMGABff4Rc-O_fZxL@zte.com.cn Fixes: b84214890a9bc ("function_graph: Move graph notrace bit to shadow stack global var") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Shengming Hu Signed-off-by: Steven Rostedt (Google) commit 26bc83b88bbbf054f0980a4a42047a8d1e210e4c Author: Eric Biggers Date: Tue Feb 17 20:27:02 2026 -0800 smb: client: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 9e7dc228bb6d4afa74dd6bab4f3aad43126cc2db Author: J. Neuschäfer Date: Wed Mar 4 01:42:57 2026 +0100 io_uring/mock: Fix typo in help text Fix the spelling of "subsystem". Signed-off-by: J. Neuschäfer Signed-off-by: Jens Axboe commit 46d0d6f50dab706637f4c18a470aac20a21900d3 Author: Eric Biggers Date: Mon Mar 2 12:34:09 2026 -0800 net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. Fixes: cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.") Fixes: 658ddaaf6694 ("tcp: md5: RST: getting md5 key from listener") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260302203409.13388-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 7f5d8e63f3d4dc952548502a2227de780cbcd21f Author: Stephen Hemminger Date: Mon Mar 2 11:50:20 2026 -0800 MAINTAINERS: update the skge/sky2 maintainers Mark the skge and sky2 drivers as orphan. I no longer have any Marvell/SysKonnect boards to test with and mail to Mirko Lindner bounced because Marvell sold off that divsion. Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20260302195120.187183-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski commit e2f27363aa6d983504c6836dd0975535e2e9dba0 Author: Raju Rangoju Date: Mon Mar 2 09:51:24 2026 +0530 amd-xgbe: fix sleep while atomic on suspend/resume The xgbe_powerdown() and xgbe_powerup() functions use spinlocks (spin_lock_irqsave) while calling functions that may sleep: - napi_disable() can sleep waiting for NAPI polling to complete - flush_workqueue() can sleep waiting for pending work items This causes a "BUG: scheduling while atomic" error during suspend/resume cycles on systems using the AMD XGBE Ethernet controller. The spinlock protection in these functions is unnecessary as these functions are called from suspend/resume paths which are already serialized by the PM core Fix this by removing the spinlock. Since only code that takes this lock is xgbe_powerdown() and xgbe_powerup(), remove it completely. Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver") Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260302042124.1386445-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 5af6e8b54927f7a8d3c7fd02b1bdc09e93d5c079 Author: Breno Leitao Date: Mon Mar 2 03:40:46 2026 -0800 netconsole: fix sysdata_release_enabled_show checking wrong flag sysdata_release_enabled_show() checks SYSDATA_TASKNAME instead of SYSDATA_RELEASE, causing the configfs release_enabled attribute to reflect the taskname feature state rather than the release feature state. This is a copy-paste error from the adjacent sysdata_taskname_enabled_show() function. The corresponding _store function already uses the correct SYSDATA_RELEASE flag. Fixes: 343f90227070 ("netconsole: implement configfs for release_enabled") Signed-off-by: Breno Leitao Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260302-sysdata_release_fix-v1-1-e5090f677c7c@debian.org Signed-off-by: Jakub Kicinski commit 4ee7fa6cf78ff26d783d39e2949d14c4c1cd5e7f Author: Yung Chih Su Date: Mon Mar 2 14:02:47 2026 +0800 net: ipv4: fix ARM64 alignment fault in multipath hash seed `struct sysctl_fib_multipath_hash_seed` contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byte alignment requirement. In `fib_multipath_hash_from_keys()`, the code evaluates the entire struct atomically via `READ_ONCE()`: mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed; While this silently works on GCC by falling back to unaligned regular loads which the ARM64 kernel tolerates, it causes a fatal kernel panic when compiled with Clang and LTO enabled. Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire instructions (`ldar` / `ldapr`) to prevent compiler reordering bugs under Clang LTO. Since the macro evaluates the full 8-byte struct, Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly requires `ldar` to be naturally aligned, thus executing it on a 4-byte aligned address triggers a strict Alignment Fault (FSC = 0x21). Fix the read side by moving the `READ_ONCE()` directly to the `u32` member, which emits a safe 32-bit `ldar Wn`. Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire struct in `proc_fib_multipath_hash_set_seed()` is also flawed. Analysis shows that Clang splits this 8-byte write into two separate 32-bit `str` instructions. While this avoids an alignment fault, it destroys atomicity and exposes a tear-write vulnerability. Fix this by explicitly splitting the write into two 32-bit `WRITE_ONCE()` operations. Finally, add the missing `READ_ONCE()` when reading `user_seed` in `proc_fib_multipath_hash_seed()` to ensure proper pairing and concurrency safety. Fixes: 4ee2a8cace3f ("net: ipv4: Add a sysctl to set multipath hash seed") Signed-off-by: Yung Chih Su Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260302060247.7066-1-yuuchihsu@gmail.com Signed-off-by: Jakub Kicinski commit 67edfec516d30d3e62925c397be4a1e5185802fc Author: Eric Biggers Date: Mon Mar 2 12:36:00 2026 -0800 net/tcp-ao: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. Fixes: 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> Link: https://patch.msgid.link/20260302203600.13561-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 2ffb4f5c2ccb2fa1c049dd11899aee7967deef5a Author: Jakub Kicinski Date: Sun Mar 1 11:45:48 2026 -0800 ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_get_dev_rcu() with commit 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address"). KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:ip6_rt_pcpu_alloc (net/ipv6/route.c:1418) Call Trace: ip6_pol_route (net/ipv6/route.c:2318) fib6_rule_lookup (net/ipv6/fib6_rules.c:115) ip6_route_output_flags (net/ipv6/route.c:2607) vrf_process_v6_outbound (drivers/net/vrf.c:437) I was tempted to rework the un-slaving code to clear the flag first and insert synchronize_rcu() before we remove the upper. But looks like the explicit fallback to loopback_dev is an established pattern. And I guess avoiding the synchronize_rcu() is nice, too. Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address") Reviewed-by: David Ahern Link: https://patch.msgid.link/20260301194548.927324-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3ac88a9948792b092a4b11323e2abd1ecbe0cc68 Author: Alexandre Courbot Date: Tue Feb 24 11:25:34 2026 +0900 rust: str: make NullTerminatedFormatter public If `CONFIG_BLOCK` is disabled, the following warnings are displayed during build: warning: struct `NullTerminatedFormatter` is never constructed --> ../rust/kernel/str.rs:667:19 | 667 | pub(crate) struct NullTerminatedFormatter<'a> { | ^^^^^^^^^^^^^^^^^^^^^^^ | = note: `#[warn(dead_code)]` (part of `#[warn(unused)]`) on by default warning: associated function `new` is never used --> ../rust/kernel/str.rs:673:19 | 671 | impl<'a> NullTerminatedFormatter<'a> { | ------------------------------------ associated function in this implementation 672 | /// Create a new [`Self`] instance. 673 | pub(crate) fn new(buffer: &'a mut [u8]) -> Option> { Fix them by making `NullTerminatedFormatter` public, as it could be useful for drivers anyway. Fixes: cdde7a1951ff ("rust: str: introduce `NullTerminatedFormatter`") Signed-off-by: Alexandre Courbot Reviewed-by: Alice Ryhl Reviewed-by: Andreas Hindborg Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260224-nullterminatedformatter-v1-1-5bef7b9b3d4c@nvidia.com Signed-off-by: Miguel Ojeda commit 8098179dc981c361c4ff238bc3935329a93bbdfb Author: ZhangGuoDong Date: Tue Mar 3 15:13:13 2026 +0000 smb/client: remove unused SMB311_posix_query_info() It is currently unused, as now we are doing compounding instead (see smb2_query_path_info()). Signed-off-by: ZhangGuoDong Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 9621b996e4db1dbc2b3dc5d5910b7d6179397320 Author: ZhangGuoDong Date: Tue Mar 3 15:13:12 2026 +0000 smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() SMB311_posix_query_info() is currently unused, but it may still be used in some stable versions, so these changes are submitted as a separate patch. Use `sizeof(struct smb311_posix_qinfo)` instead of sizeof its pointer, so the allocated buffer matches the actual struct size. Fixes: b1bc1874b885 ("smb311: Add support for SMB311 query info (non-compounded)") Reported-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 12c43a062acb0ac137fc2a4a106d4d084b8c5416 Author: ZhangGuoDong Date: Tue Mar 3 15:13:11 2026 +0000 smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() Use `sizeof(struct smb311_posix_qinfo)` instead of sizeof its pointer, so the allocated buffer matches the actual struct size. Fixes: 6a5f6592a0b6 ("SMB311: Add support for query info using posix extensions (level 100)") Reported-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 56145d237385ca0e7ca9ff7b226aaf2eb8ef368b Author: Lang Xu Date: Tue Mar 3 17:52:17 2026 +0800 bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is considered released but may still be referenced via 'tr->progs_hlist' in 'cgroup_shim_find'. The actual cleanup of 'tr->progs_hlist' in 'bpf_shim_tramp_link_release' is deferred. During this window, another process can cause a use-after-free via 'bpf_trampoline_link_cgroup_shim'. Based on Martin KaFai Lau's suggestions, I have created a simple patch. To fix this: Add an atomic non-zero check in 'bpf_trampoline_link_cgroup_shim'. Only increment the refcount if it is not already zero. Testing: I verified the fix by adding a delay in 'bpf_shim_tramp_link_release' to make the bug easier to trigger: static void bpf_shim_tramp_link_release(struct bpf_link *link) { /* ... */ if (!shim_link->trampoline) return; + msleep(100); WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL)); bpf_trampoline_put(shim_link->trampoline); } Before the patch, running a PoC easily reproduced the crash(almost 100%) with a call trace similar to KaiyanM's report. After the patch, the bug no longer occurs even after millions of iterations. Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor") Reported-by: Kaiyan Mei Closes: https://lore.kernel.org/bpf/3c4ebb0b.46ff8.19abab8abe2.Coremail.kaiyanm@hust.edu.cn/ Signed-off-by: Lang Xu Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/279EEE1BA1DDB49D+20260303095217.34436-1-xulang@uniontech.com commit 0031c06807cfa8aa51a759ff8aa09e1aa48149af Merge: 6a8dab043c6494 085f067389d12b Author: Linus Torvalds Date: Tue Mar 3 14:25:18 2026 -0800 Merge tag 'cgroup-for-7.0-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Fix circular locking dependency in cpuset partition code by deferring housekeeping_update() calls to a workqueue instead of calling them directly under cpus_read_lock - Fix null-ptr-deref in rebuild_sched_domains_cpuslocked() when generate_sched_domains() returns NULL due to kmalloc failure - Fix incorrect cpuset behavior for effective_xcpus in partition_xcpus_del() and cpuset_update_tasks_cpumask() in update_cpumasks_hier() - Fix race between task migration and cgroup iteration * tag 'cgroup-for-7.0-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: fix null-ptr-deref in rebuild_sched_domains_cpuslocked cgroup/cpuset: Call housekeeping_update() without holding cpus_read_lock cgroup/cpuset: Defer housekeeping_update() calls from CPU hotplug to workqueue cgroup/cpuset: Move housekeeping_update()/rebuild_sched_domains() together kselftest/cgroup: Simplify test_cpuset_prs.sh by removing "S+" command cgroup/cpuset: Set isolated_cpus_updating only if isolated_cpus is changed cgroup/cpuset: Clarify exclusion rules for cpuset internal variables cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier() cgroup/cpuset: Fix incorrect change to effective_xcpus in partition_xcpus_del() cgroup: fix race between task migration and iteration commit 6a8dab043c649450ee58c84c3c6051def96778ed Merge: c44db6c820140f b06ccbabe2506f Author: Linus Torvalds Date: Tue Mar 3 14:14:20 2026 -0800 Merge tag 'sched_ext-for-7.0-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix starvation of scx_enable() under fair-class saturation by offloading the enable path to an RT kthread - Fix out-of-bounds access in idle mask initialization on systems with non-contiguous NUMA node IDs - Fix a preemption window during scheduler exit and a refcount underflow in cgroup init error path - Fix SCX_EFLAG_INITIALIZED being a no-op flag - Add READ_ONCE() annotations for KCSAN-clean lockless accesses and replace naked scx_root dereferences with container_of() in kobject callbacks - Tooling and selftest fixes: compilation issues with clang 17, strtoul() misuse, unused options cleanup, and Kconfig sync * tag 'sched_ext-for-7.0-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Fix starvation of scx_enable() under fair-class saturation sched_ext: Remove redundant css_put() in scx_cgroup_init() selftests/sched_ext: Fix peek_dsq.bpf.c compile error for clang 17 selftests/sched_ext: Add -fms-extensions to bpf build flags tools/sched_ext: Add -fms-extensions to bpf build flags sched_ext: Use READ_ONCE() for plain reads of scx_watchdog_timeout sched_ext: Replace naked scx_root dereferences in kobject callbacks sched_ext: Use READ_ONCE() for the read side of dsq->nr update tools/sched_ext: fix strtoul() misuse in scx_hotplug_seq() sched_ext: Fix SCX_EFLAG_INITIALIZED being a no-op flag sched_ext: Fix out-of-bounds access in scx_idle_init_masks() sched_ext: Disable preemption between scx_claim_exit() and kicking helper work tools/sched_ext: Add Kconfig to sync with upstream tools/sched_ext: Sync README.md Kconfig with upstream scx selftests/sched_ext: Remove duplicated unistd.h include in rt_stall.c tools/sched_ext: scx_sdt: Remove unused '-f' option tools/sched_ext: scx_central: Remove unused '-p' option selftests/sched_ext: Fix unused-result warning for read() selftests/sched_ext: Abort test loop on signal commit b06ccbabe2506fd70b9167a644978b049150224a Author: Tejun Heo Date: Tue Mar 3 01:01:15 2026 -1000 sched_ext: Fix starvation of scx_enable() under fair-class saturation During scx_enable(), the READY -> ENABLED task switching loop changes the calling thread's sched_class from fair to ext. Since fair has higher priority than ext, saturating fair-class workloads can indefinitely starve the enable thread, hanging the system. This was introduced when the enable path switched from preempt_disable() to scx_bypass() which doesn't protect against fair-class starvation. Note that the original preempt_disable() protection wasn't complete either - in partial switch modes, the calling thread could still be starved after preempt_enable() as it may have been switched to ext class. Fix it by offloading the enable body to a dedicated system-wide RT (SCHED_FIFO) kthread which cannot be starved by either fair or ext class tasks. scx_enable() lazily creates the kthread on first use and passes the ops pointer through a struct scx_enable_cmd containing the kthread_work, then synchronously waits for completion. The workfn runs on a different kthread from sch->helper (which runs disable_work), so it can safely flush disable_work on the error path without deadlock. Fixes: 8c2090c504e9 ("sched_ext: Initialize in bypass mode") Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Tejun Heo commit 554a1c34c11a057d01819ce9bb04653a8ffc8071 Author: Vivek Behera Date: Tue Jan 20 08:52:16 2026 +0100 igc: Fix trigger of incorrect irq in igc_xsk_wakeup function This patch addresses the issue where the igc_xsk_wakeup function was triggering an incorrect IRQ for tx-0 when the i226 is configured with only 2 combined queues or in an environment with 2 active CPU cores. This prevented XDP Zero-copy send functionality in such split IRQ configurations. The fix implements the correct logic for extracting q_vectors saved during rx and tx ring allocation and utilizes flags provided by the ndo_xsk_wakeup API to trigger the appropriate IRQ. Fixes: fc9df2a0b520 ("igc: Enable RX via AF_XDP zero-copy") Fixes: 15fd021bc427 ("igc: Add Tx hardware timestamp request for AF_XDP zero-copy packet") Signed-off-by: Vivek Behera Reviewed-by: Jacob Keller Reviewed-by: Aleksandr loktinov Reviewed-by: Piotr Kwapulinski Reviewed-by: Song Yoong Siang Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen commit d4c13ab36273a8c318ba06799793cc1f5d9c6fa1 Author: Vivek Behera Date: Thu Jan 22 15:16:52 2026 +0100 igb: Fix trigger of incorrect irq in igb_xsk_wakeup The current implementation in the igb_xsk_wakeup expects the Rx and Tx queues to share the same irq. This would lead to triggering of incorrect irq in split irq configuration. This patch addresses this issue which could impact environments with 2 active cpu cores or when the number of queues is reduced to 2 or less cat /proc/interrupts | grep eno2 167: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0 0-edge eno2 168: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0 1-edge eno2-rx-0 169: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0 2-edge eno2-rx-1 170: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0 3-edge eno2-tx-0 171: 0 0 0 0 IR-PCI-MSIX-0000:08:00.0 4-edge eno2-tx-1 Furthermore it uses the flags input argument to trigger either rx, tx or both rx and tx irqs as specified in the ndo_xsk_wakeup api documentation Fixes: 80f6ccf9f116 ("igb: Introduce XSK data structures and helpers") Signed-off-by: Vivek Behera Reviewed-by: Aleksandr Loktionov Suggested-by: Maciej Fijalkowski Acked-by: Maciej Fijalkowski Tested-by: Saritha Sanigani (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit b84852170153671bb0fa6737a6e48370addd8e1a Author: Kohei Enju Date: Tue Feb 10 15:57:14 2026 +0000 iavf: fix netdev->max_mtu to respect actual hardware limit iavf sets LIBIE_MAX_MTU as netdev->max_mtu, ignoring vf_res->max_mtu from PF [1]. This allows setting an MTU beyond the actual hardware limit, causing TX queue timeouts [2]. Set correct netdev->max_mtu using vf_res->max_mtu from the PF. Note that currently PF drivers such as ice/i40e set the frame size in vf_res->max_mtu, not MTU. Convert vf_res->max_mtu to MTU before setting netdev->max_mtu. [1] # ip -j -d link show $DEV | jq '.[0].max_mtu' 16356 [2] iavf 0000:00:05.0 enp0s5: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5692 ms iavf 0000:00:05.0 enp0s5: NIC Link is Up Speed is 10 Gbps Full Duplex iavf 0000:00:05.0 enp0s5: NETDEV WATCHDOG: CPU: 6: transmit queue 3 timed out 5312 ms iavf 0000:00:05.0 enp0s5: NIC Link is Up Speed is 10 Gbps Full Duplex ... Fixes: 5fa4caff59f2 ("iavf: switch to Page Pool") Signed-off-by: Kohei Enju Reviewed-by: Alexander Lobakin Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 636cc3bd12f499c74eaf5dc9a7d5b832f1bb24ed Author: Michal Swiatkowski Date: Wed Feb 11 10:11:40 2026 +0100 libie: don't unroll if fwlog isn't supported The libie_fwlog_deinit() function can be called during driver unload even when firmware logging was never properly initialized. This led to call trace: [ 148.576156] Oops: Oops: 0000 [#1] SMP NOPTI [ 148.576167] CPU: 80 UID: 0 PID: 12843 Comm: rmmod Kdump: loaded Not tainted 6.17.0-rc7next-queue-3oct-01915-g06d79d51cf51 #1 PREEMPT(full) [ 148.576177] Hardware name: HPE ProLiant DL385 Gen10 Plus/ProLiant DL385 Gen10 Plus, BIOS A42 07/18/2020 [ 148.576182] RIP: 0010:__dev_printk+0x16/0x70 [ 148.576196] Code: 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 41 55 41 54 49 89 d4 55 48 89 fd 53 48 85 f6 74 3c <4c> 8b 6e 50 48 89 f3 4d 85 ed 75 03 4c 8b 2e 48 89 df e8 f3 27 98 [ 148.576204] RSP: 0018:ffffd2fd7ea17a48 EFLAGS: 00010202 [ 148.576211] RAX: ffffd2fd7ea17aa0 RBX: ffff8eb288ae2000 RCX: 0000000000000000 [ 148.576217] RDX: ffffd2fd7ea17a70 RSI: 00000000000000c8 RDI: ffffffffb68d3d88 [ 148.576222] RBP: ffffffffb68d3d88 R08: 0000000000000000 R09: 0000000000000000 [ 148.576227] R10: 00000000000000c8 R11: ffff8eb2b1a49400 R12: ffffd2fd7ea17a70 [ 148.576231] R13: ffff8eb3141fb000 R14: ffffffffc1215b48 R15: ffffffffc1215bd8 [ 148.576236] FS: 00007f5666ba6740(0000) GS:ffff8eb2472b9000(0000) knlGS:0000000000000000 [ 148.576242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 148.576247] CR2: 0000000000000118 CR3: 000000011ad17000 CR4: 0000000000350ef0 [ 148.576252] Call Trace: [ 148.576258] [ 148.576269] _dev_warn+0x7c/0x96 [ 148.576290] libie_fwlog_deinit+0x112/0x117 [libie_fwlog] [ 148.576303] ixgbe_remove+0x63/0x290 [ixgbe] [ 148.576342] pci_device_remove+0x42/0xb0 [ 148.576354] device_release_driver_internal+0x19c/0x200 [ 148.576365] driver_detach+0x48/0x90 [ 148.576372] bus_remove_driver+0x6d/0xf0 [ 148.576383] pci_unregister_driver+0x2e/0xb0 [ 148.576393] ixgbe_exit_module+0x1c/0xd50 [ixgbe] [ 148.576430] __do_sys_delete_module.isra.0+0x1bc/0x2e0 [ 148.576446] do_syscall_64+0x7f/0x980 It can be reproduced by trying to unload ixgbe driver in recovery mode. Fix that by checking if fwlog is supported before doing unroll. Fixes: 641585bc978e ("ixgbe: fwlog support for e610") Reviewed-by: Aleksandr Loktionov Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit fe868b499d16f55bbeea89992edb98043c9de416 Author: Zilin Guan Date: Thu Jan 22 03:26:44 2026 +0000 ice: Fix memory leak in ice_set_ringparam() In ice_set_ringparam, tx_rings and xdp_rings are allocated before rx_rings. If the allocation of rx_rings fails, the code jumps to the done label leaking both tx_rings and xdp_rings. Furthermore, if the setup of an individual Rx ring fails during the loop, the code jumps to the free_tx label which releases tx_rings but leaks xdp_rings. Fix this by introducing a free_xdp label and updating the error paths to ensure both xdp_rings and tx_rings are properly freed if rx_rings allocation or setup fails. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: fcea6f3da546 ("ice: Add stats and ethtool support") Fixes: efc2214b6047 ("ice: Add support for XDP") Signed-off-by: Zilin Guan Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit fb4903b3354aed4a2301180cf991226f896c87ed Author: Jakub Staniszewski Date: Tue Jan 13 20:38:17 2026 +0100 ice: fix retry for AQ command 0x06EE Executing ethtool -m can fail reporting a netlink I/O error while firmware link management holds the i2c bus used to communicate with the module. According to Intel(R) Ethernet Controller E810 Datasheet Rev 2.8 [1] Section 3.3.10.4 Read/Write SFF EEPROM (0x06EE) request should to be retried upon receiving EBUSY from firmware. Commit e9c9692c8a81 ("ice: Reimplement module reads used by ethtool") implemented it only for part of ice_get_module_eeprom(), leaving all other calls to ice_aq_sff_eeprom() vulnerable to returning early on getting EBUSY without retrying. Remove the retry loop from ice_get_module_eeprom() and add Admin Queue (AQ) command with opcode 0x06EE to the list of commands that should be retried on receiving EBUSY from firmware. Cc: stable@vger.kernel.org Fixes: e9c9692c8a81 ("ice: Reimplement module reads used by ethtool") Signed-off-by: Jakub Staniszewski Co-developed-by: Dawid Osuchowski Signed-off-by: Dawid Osuchowski Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Link: https://www.intel.com/content/www/us/en/content-details/613875/intel-ethernet-controller-e810-datasheet.html [1] Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 326256c0a72d4877cec1d4df85357da106233128 Author: Jakub Staniszewski Date: Tue Jan 13 20:38:16 2026 +0100 ice: reintroduce retry mechanism for indirect AQ Add retry mechanism for indirect Admin Queue (AQ) commands. To do so we need to keep the command buffer. This technically reverts commit 43a630e37e25 ("ice: remove unused buffer copy code in ice_sq_send_cmd_retry()"), but combines it with a fix in the logic by using a kmemdup() call, making it more robust and less likely to break in the future due to programmer error. Cc: Michal Schmidt Cc: stable@vger.kernel.org Fixes: 3056df93f7a8 ("ice: Re-send some AQ commands, as result of EBUSY AQ error") Signed-off-by: Jakub Staniszewski Co-developed-by: Dawid Osuchowski Signed-off-by: Dawid Osuchowski Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit eef33aa44935d001747ca97703c08dd6f9031162 Author: Larysa Zaremba Date: Wed Dec 3 14:29:48 2025 +0100 ice: fix adding AQ LLDP filter for VF The referenced commit came from a misunderstanding of the FW LLDP filter AQ (Admin Queue) command due to the error in the internal documentation. Contrary to the assumptions in the original commit, VFs can be added and deleted from this filter without any problems. Introduced dev_info message proved to be useful, so reverting the whole commit does not make sense. Without this fix, trusted VFs do not receive LLDP traffic, if there is an AQ LLDP filter on PF. When trusted VF attempts to add an LLDP multicast MAC address, the following message can be seen in dmesg on host: ice 0000:33:00.0: Failed to add Rx LLDP rule on VSI 20 error: -95 Revert checking VSI type when adding LLDP filter through AQ. Fixes: 4d5a1c4e6d49 ("ice: do not add LLDP-specific filter if not necessary") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 3875ceb592d3cb23dc932165cc1eeb74cf4dc319 Author: Eric Biggers Date: Mon Mar 2 15:48:56 2026 -0800 crypto: testmgr - Fix stale references to aes-generic Due to commit a2484474272e ("crypto: aes - Replace aes-generic with wrapper around lib"), the "aes-generic" driver name has been replaced with "aes-lib". Update a couple testmgr entries that were added concurrently with this change. Fixes: a22d48cbe558 ("crypto: testmgr - Add test vectors for authenc(hmac(sha224),cbc(aes))") Fixes: 030218dedee2 ("crypto: testmgr - Add test vectors for authenc(hmac(sha384),cbc(aes))") Acked-by: Aleksander Jan Bajkowski Link: https://lore.kernel.org/r/20260302234856.30569-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e4eb6e4dd6348dd00e19c2275e3fbaed304ca3bd Author: Thomas Fourier Date: Thu Feb 26 10:57:11 2026 +0100 drm/msm: Fix dma_free_attrs() buffer size The gpummu->table buffer is alloc'd with size TABLE_SIZE + 32 in a2xx_gpummu_new() but freed with size TABLE_SIZE in a2xx_gpummu_destroy(). Change the free size to match the allocation. Fixes: c2052a4e5c99 ("drm/msm: implement a2xx mmu") Cc: Signed-off-by: Thomas Fourier Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/707340/ Message-ID: <20260226095714.12126-2-fourier.thomas@gmail.com> Signed-off-by: Rob Clark commit 20f644f42e3b8e729d3c3199d48e75c0b257de8f Author: Akhil P Oommen Date: Wed Feb 25 13:11:57 2026 +0530 drm/msm/a6xx: Fix the bogus protect error on X2-85 Update the X2-85 gpu's register protect count configuration with the correct count_max value to avoid blocking the entire MMIO region from the UMD. Protect configurations are a bit complicated on A8xx. There are 2 set of protect registers with different counts: Global and Pipe-specific. The last-span-unbound feature is available only on the Pipe-specific protect registers. Due to this, we cannot use the BUILD_BUG sanity check for A8x protect configurations, so remove the A840 entry from there. Fixes: 01ff3bf27215 ("drm/msm/a8xx: Add support for Adreno X2-85 GPU") Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/706944/ Message-ID: <20260225-glymur-protect-fix-v1-1-0deddedf9277@oss.qualcomm.com> Signed-off-by: Rob Clark commit 3817b1d34432d3d83a61576719570d04c341b7cd Author: Zhang Rui Date: Mon Feb 9 11:24:41 2026 +0800 cpupower: Add intel_pstate turbo boost support for Intel platforms On modern Intel platforms, the intel_pstate driver is commonly used and it provides turbo boost control via /sys/devices/system/cpu/intel_pstate/no_turbo. However, cpupower doesn't handle this. it 1. shows turbo boost as "active" blindly for Intel platforms 2. controls turbo boost functionality via the generic /sys/devices/system/cpu/cpufreq/boost sysfs interface only. Enhance the cpupower tool to ensure the "--boost" command works seamlessly on Intel platforms with intel_pstate driver running. Without this patch, $ echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 1 $ sudo cpupower frequency-info --boost analyzing CPU 21: boost state support: Supported: yes Active: yes $ sudo cpupower set --boost 0 Error setting turbo-boost $ sudo cpupower set --boost 1 Error setting turbo-boost With this patch, $ cat /sys/devices/system/cpu/intel_pstate/no_turbo 0 $ sudo cpupower set --boost 0 $ sudo cpupower frequency-info --boost analyzing CPU 21: boost state support: Supported: yes Active: no $ cat /sys/devices/system/cpu/intel_pstate/no_turbo 1 $ sudo cpupower set --boost 1 $ sudo cpupower frequency-info --boost analyzing CPU 28: boost state support: Supported: yes Active: yes $ cat /sys/devices/system/cpu/intel_pstate/no_turbo 0 Signed-off-by: Zhang Rui Signed-off-by: Shuah Khan commit 50ad1a31bed898787e12b73cb5716fe7960cdde4 Author: Jan Kiszka Date: Sat Feb 21 07:21:55 2026 +0100 cpupower: Add support for setting EPP via systemd service Extend the systemd service so that it can be used for tuning the Energy Performance Preference (EPP) as well. Available options can be read from /sys/devices/system/cpu/cpufreq/policy0/energy_performance_available_preferences. The desired one can then be set in cpupower-service.conf. Signed-off-by: Jan Kiszka Signed-off-by: Shuah Khan commit 19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4 Author: Alison Schofield Date: Thu Feb 26 10:44:36 2026 -0800 cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by calling delete_switch_port(). There are two places during this work where the parent_port may be used after freeing: First, a concurrent detach may have already processed a port by the time a second worker finds it via bus_find_device(). Without pinning parent_port, it may already be freed when we discover port->dead and attempt to unlock the parent_port. In a production kernel that's a silent memory corruption, with lock debug, it looks like this: []DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current()) []WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310 []Call Trace: []mutex_unlock+0xd/0x20 []cxl_detach_ep+0x180/0x400 [cxl_core] []devm_action_release+0x10/0x20 []devres_release_all+0xa8/0xe0 []device_unbind_cleanup+0xd/0xa0 []really_probe+0x1a6/0x3e0 Second, delete_switch_port() releases three devm actions registered against parent_port. The last of those is unregister_port() and it calls device_unregister() on the child port, which can cascade. If parent_port is now also empty the device core may unregister and free it too. So by the time delete_switch_port() returns, parent_port may be free, and the subsequent device_unlock(&parent_port->dev) operates on freed memory. The kernel log looks same as above, with a different offset in cxl_detach_ep(). Both of these issues stem from the absence of a lifetime guarantee between a child port and its parent port. Establish a lifetime rule for ports: child ports hold a reference to their parent device until release. Take the reference when the port is allocated and drop it when released. This ensures the parent is valid for the full lifetime of the child and eliminates the use after free window in cxl_detach_ep(). This is easily reproduced with a reload of cxl_acpi in QEMU with CXL devices present. Fixes: 2345df54249c ("cxl/memdev: Fix endpoint port removal") Reviewed-by: Dave Jiang Reviewed-by: Li Ming Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260226184439.1732841-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit c44db6c820140ffbc0e293a34c6a6de4b363422b Merge: af4e9ef3d78420 f8db8009ea6529 Author: Linus Torvalds Date: Tue Mar 3 09:08:00 2026 -0800 Merge tag 'for-7.0-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "One-liner or short fixes for minor/moderate problems reported recently: - fixes or level adjustments of error messages - fix leaked transaction handles after aborted transactions, when using the remap tree feature - fix a few leaked chunk maps after errors - fix leaked page array in io_uring encoded read if an error occurs and the 'finished' is not called - fix double release of reserved extents when doing a range COW - don't commit super block when the filesystem is in shutdown state - fix squota accounting condition when checking members vs parent usage - other error handling fixes" * tag 'for-7.0-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: check block group lookup in remove_range_from_remap_tree() btrfs: fix transaction handle leaks in btrfs_last_identity_remap_gone() btrfs: fix chunk map leak in btrfs_map_block() after btrfs_translate_remap() btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() btrfs: fix compat mask in error messages in btrfs_check_features() btrfs: print correct subvol num if active swapfile prevents deletion btrfs: fix warning in scrub_verify_one_metadata() btrfs: fix objectid value in error message in check_extent_data_ref() btrfs: fix incorrect key offset in error message in check_dev_extent_item() btrfs: fix error message order of parameters in btrfs_delete_delayed_dir_index() btrfs: don't commit the super block when unmounting a shutdown filesystem btrfs: free pages on error in btrfs_uring_read_extent() btrfs: fix referenced/exclusive check in squota_check_parent_usage() btrfs: remove pointless WARN_ON() in cache_save_setup() btrfs: convert log messages to error level in btrfs_replay_log() btrfs: remove btrfs_handle_fs_error() after failure to recover log trees btrfs: remove redundant warning message in btrfs_check_uuid_tree() btrfs: change warning messages to error level in open_ctree() btrfs: fix a double release on reserved extents in cow_one_range() btrfs: handle discard errors in in btrfs_finish_extent_commit() commit 147dae12985947cdb9e1918142f06482c5077a81 Author: Nilay Shroff Date: Fri Feb 20 12:32:28 2026 +0530 sparc/PCI: Initialize msi_addr_mask for OF-created PCI devices Recent changes replaced the use of no_64bit_msi with msi_addr_mask, which is now expected to be initialized to DMA_BIT_MASK(64) during PCI device setup. On SPARC systems, this initialization was inadvertently missed for devices instantiated from device tree nodes, leaving msi_addr_mask unset for OF-created pci_dev instances. As a result, MSI address validation fails during probe, causing affected devices to fail initialization. Initialize pdev->msi_addr_mask to DMA_BIT_MASK(64) in of_create_pci_dev() so that MSI address validation succeeds and PCI device probing works as expected. Fixes: 386ced19e9a3 ("PCI/MSI: Convert the boolean no_64bit_msi flag to a DMA address mask") Signed-off-by: Nilay Shroff Signed-off-by: Bjorn Helgaas Tested-by: Han Gao # SPARC Enterprise T5220 Tested-by: Nathaniel Roach # SPARC T5-2 Reviewed-by: Vivian Wang Link: https://patch.msgid.link/20260220070239.1693303-3-nilay@linux.ibm.com commit 2185904ff8b5da76a4353e5d1236caa78e0d98e3 Author: Nilay Shroff Date: Fri Feb 20 12:32:27 2026 +0530 powerpc/pci: Initialize msi_addr_mask for OF-created PCI devices Recent changes replaced the use of no_64bit_msi with msi_addr_mask. As a result, msi_addr_mask is now expected to be initialized to DMA_BIT_MASK(64) when a pci_dev is set up. However, this initialization was missed on powerpc due to differences in the device initialization path compared to other (x86) architecture. Due to this, now PCI device probe method fails on powerpc system. On powerpc systems, struct pci_dev instances are created from device tree nodes via of_create_pci_dev(). Because msi_addr_mask was not initialized there, it remained zero. Later, during MSI setup, msi_verify_entries() validates the programmed MSI address against pdev->msi_addr_mask. Since the mask was not set correctly, the validation fails, causing PCI driver probe failures for devices on powerpc systems. Initialize pdev->msi_addr_mask to DMA_BIT_MASK(64) in of_create_pci_dev() so that MSI address validation succeeds and device probe works as expected. Fixes: 386ced19e9a3 ("PCI/MSI: Convert the boolean no_64bit_msi flag to a DMA address mask") Signed-off-by: Nilay Shroff Signed-off-by: Bjorn Helgaas Tested-by: Venkat Rao Bagalkote Tested-by: Nam Cao Reviewed-by: Nam Cao Reviewed-by: Vivian Wang Acked-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260220070239.1693303-2-nilay@linux.ibm.com commit 1336b579f6079fb8520be03624fcd9ba443c930b Author: Cheng-Yang Chou Date: Tue Mar 3 22:35:30 2026 +0800 sched_ext: Remove redundant css_put() in scx_cgroup_init() The iterator css_for_each_descendant_pre() walks the cgroup hierarchy under cgroup_lock(). It does not increment the reference counts on yielded css structs. According to the cgroup documentation, css_put() should only be used to release a reference obtained via css_get() or css_tryget_online(). Since the iterator does not use either of these to acquire a reference, calling css_put() in the error path of scx_cgroup_init() causes a refcount underflow. Remove the unbalanced css_put() to prevent a potential Use-After-Free (UAF) vulnerability. Fixes: 819513666966 ("sched_ext: Add cgroup support") Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Cheng-Yang Chou Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 0749cab6174dc035b1628fb6db03abf758cfda6f Author: Filipe Manana Date: Fri Feb 27 12:09:47 2026 +0000 btrfs: remove duplicated definition of btrfs_printk_in_rcu() It's defined twice in a row for the !CONFIG_PRINTK case, so remove one of the duplicates. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8dd0e6807b54a2411ed7263018139c60d1406e39 Author: Filipe Manana Date: Fri Feb 27 00:05:08 2026 +0000 btrfs: remove unnecessary transaction abort in the received subvol ioctl If we fail to remove an item from the uuid tree, we don't need to abort the transaction since we have not done any change before. So remove that transaction abort. Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 0f475ee0ebce5c9492b260027cd95270191675fa Author: Filipe Manana Date: Fri Feb 27 00:02:33 2026 +0000 btrfs: abort transaction on failure to update root in the received subvol ioctl If we failed to update the root we don't abort the transaction, which is wrong since we already used the transaction to remove an item from the uuid tree. Fixes: dd5f9615fc5c ("Btrfs: maintain subvolume items in the UUID tree") CC: stable@vger.kernel.org # 3.12+ Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 87f2c46003fce4d739138aab4af1942b1afdadac Author: Filipe Manana Date: Thu Feb 26 23:41:07 2026 +0000 btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl fails due to an item overflow when attempting to add the BTRFS_UUID_KEY_RECEIVED_SUBVOL we have to abort the transaction since we did some metadata updates before. This means that if a user calls this ioctl with the same received UUID field for a lot of subvolumes, we will hit the overflow, trigger the transaction abort and turn the filesystem into RO mode. A malicious user could exploit this, and this ioctl does not even requires that a user has admin privileges (CAP_SYS_ADMIN), only that he/she owns the subvolume. Fix this by doing an early check for item overflow before starting a transaction. This is also race safe because we are holding the subvol_sem semaphore in exclusive (write) mode. A test case for fstests will follow soon. Fixes: dd5f9615fc5c ("Btrfs: maintain subvolume items in the UUID tree") CC: stable@vger.kernel.org # 3.12+ Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e1b18b959025e6b5dbad668f391f65d34b39595a Author: Filipe Manana Date: Mon Feb 23 16:19:31 2026 +0000 btrfs: fix transaction abort when snapshotting received subvolumes Currently a user can trigger a transaction abort by snapshotting a previously received snapshot a bunch of times until we reach a BTRFS_UUID_KEY_RECEIVED_SUBVOL item overflow (the maximum item size we can store in a leaf). This is very likely not common in practice, but if it happens, it turns the filesystem into RO mode. The snapshot, send and set_received_subvol and subvol_setflags (used by receive) don't require CAP_SYS_ADMIN, just inode_owner_or_capable(). A malicious user could use this to turn a filesystem into RO mode and disrupt a system. Reproducer script: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi # Use smallest node size to make the test faster. mkfs.btrfs -f --nodesize 4K $DEV mount $DEV $MNT # Create a subvolume and set it to RO so that it can be used for send. btrfs subvolume create $MNT/sv touch $MNT/sv/foo btrfs property set $MNT/sv ro true # Send and receive the subvolume into snaps/sv. mkdir $MNT/snaps btrfs send $MNT/sv | btrfs receive $MNT/snaps # Now snapshot the received subvolume, which has a received_uuid, a # lot of times to trigger the leaf overflow. total=500 for ((i = 1; i <= $total; i++)); do echo -ne "\rCreating snapshot $i/$total" btrfs subvolume snapshot -r $MNT/snaps/sv $MNT/snaps/sv_$i > /dev/null done echo umount $MNT When running the test: $ ./test.sh (...) Create subvolume '/mnt/sdi/sv' At subvol /mnt/sdi/sv At subvol sv Creating snapshot 496/500ERROR: Could not create subvolume: Value too large for defined data type Creating snapshot 497/500ERROR: Could not create subvolume: Read-only file system Creating snapshot 498/500ERROR: Could not create subvolume: Read-only file system Creating snapshot 499/500ERROR: Could not create subvolume: Read-only file system Creating snapshot 500/500ERROR: Could not create subvolume: Read-only file system And in dmesg/syslog: $ dmesg (...) [251067.627338] BTRFS warning (device sdi): insert uuid item failed -75 (0x4628b21c4ac8d898, 0x2598bee2b1515c91) type 252! [251067.629212] ------------[ cut here ]------------ [251067.630033] BTRFS: Transaction aborted (error -75) [251067.630871] WARNING: fs/btrfs/transaction.c:1907 at create_pending_snapshot.cold+0x52/0x465 [btrfs], CPU#10: btrfs/615235 [251067.632851] Modules linked in: btrfs dm_zero (...) [251067.644071] CPU: 10 UID: 0 PID: 615235 Comm: btrfs Tainted: G W 6.19.0-rc8-btrfs-next-225+ #1 PREEMPT(full) [251067.646165] Tainted: [W]=WARN [251067.646733] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [251067.648735] RIP: 0010:create_pending_snapshot.cold+0x55/0x465 [btrfs] [251067.649984] Code: f0 48 0f (...) [251067.653313] RSP: 0018:ffffce644908fae8 EFLAGS: 00010292 [251067.653987] RAX: 00000000ffffff01 RBX: ffff8e5639e63a80 RCX: 00000000ffffffd3 [251067.655042] RDX: ffff8e53faa76b00 RSI: 00000000ffffffb5 RDI: ffffffffc0919750 [251067.656077] RBP: ffffce644908fbd8 R08: 0000000000000000 R09: ffffce644908f820 [251067.657068] R10: ffff8e5adc1fffa8 R11: 0000000000000003 R12: ffff8e53c0431bd0 [251067.658050] R13: ffff8e5414593600 R14: ffff8e55efafd000 R15: 00000000ffffffb5 [251067.659019] FS: 00007f2a4944b3c0(0000) GS:ffff8e5b27dae000(0000) knlGS:0000000000000000 [251067.660115] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [251067.660943] CR2: 00007ffc5aa57898 CR3: 00000005813a2003 CR4: 0000000000370ef0 [251067.661972] Call Trace: [251067.662292] [251067.662653] create_pending_snapshots+0x97/0xc0 [btrfs] [251067.663413] btrfs_commit_transaction+0x26e/0xc00 [btrfs] [251067.664257] ? btrfs_qgroup_convert_reserved_meta+0x35/0x390 [btrfs] [251067.665238] ? _raw_spin_unlock+0x15/0x30 [251067.665837] ? record_root_in_trans+0xa2/0xd0 [btrfs] [251067.666531] btrfs_mksubvol+0x330/0x580 [btrfs] [251067.667145] btrfs_mksnapshot+0x74/0xa0 [btrfs] [251067.667827] __btrfs_ioctl_snap_create+0x194/0x1d0 [btrfs] [251067.668595] btrfs_ioctl_snap_create_v2+0x107/0x130 [btrfs] [251067.669479] btrfs_ioctl+0x1580/0x2690 [btrfs] [251067.670093] ? count_memcg_events+0x6d/0x180 [251067.670849] ? handle_mm_fault+0x1a0/0x2a0 [251067.671652] __x64_sys_ioctl+0x92/0xe0 [251067.672406] do_syscall_64+0x50/0xf20 [251067.673129] entry_SYSCALL_64_after_hwframe+0x76/0x7e [251067.674096] RIP: 0033:0x7f2a495648db [251067.674812] Code: 00 48 89 (...) [251067.678227] RSP: 002b:00007ffc5aa57840 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [251067.679691] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2a495648db [251067.681145] RDX: 00007ffc5aa588b0 RSI: 0000000050009417 RDI: 0000000000000004 [251067.682511] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [251067.683842] R10: 000000000000000a R11: 0000000000000246 R12: 00007ffc5aa59910 [251067.685176] R13: 00007ffc5aa588b0 R14: 0000000000000004 R15: 0000000000000006 [251067.686524] [251067.686972] ---[ end trace 0000000000000000 ]--- [251067.687890] BTRFS: error (device sdi state A) in create_pending_snapshot:1907: errno=-75 unknown [251067.689049] BTRFS info (device sdi state EA): forced readonly [251067.689054] BTRFS warning (device sdi state EA): Skipping commit of aborted transaction. [251067.690119] BTRFS: error (device sdi state EA) in cleanup_transaction:2043: errno=-75 unknown [251067.702028] BTRFS info (device sdi state EA): last unmount of filesystem 46dc3975-30a2-4a69-a18f-418b859cccda Fix this by ignoring -EOVERFLOW errors from btrfs_uuid_tree_add() in the snapshot creation code when attempting to add the BTRFS_UUID_KEY_RECEIVED_SUBVOL item. This is OK because it's not critical and we are still able to delete the snapshot, as snapshot/subvolume deletion ignores if a BTRFS_UUID_KEY_RECEIVED_SUBVOL is missing (see inode.c:btrfs_delete_subvolume()). As for send/receive, we can still do send/receive operations since it always peeks the first root ID in the existing BTRFS_UUID_KEY_RECEIVED_SUBVOL (it could peek any since all snapshots have the same content), and even if the key is missing, it falls back to searching by BTRFS_UUID_KEY_SUBVOL key. A test case for fstests will be sent soon. Fixes: dd5f9615fc5c ("Btrfs: maintain subvolume items in the UUID tree") CC: stable@vger.kernel.org # 3.12+ Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2d1ababdedd4ba38867c2500eb7f95af5ddeeef7 Author: Filipe Manana Date: Thu Feb 26 11:05:43 2026 +0000 btrfs: fix transaction abort on file creation due to name hash collision If we attempt to create several files with names that result in the same hash, we have to pack them in same dir item and that has a limit inherent to the leaf size. However if we reach that limit, we trigger a transaction abort and turns the filesystem into RO mode. This allows for a malicious user to disrupt a system, without the need to have administration privileges/capabilities. Reproducer: $ cat exploit-hash-collisions.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi # Use smallest node size to make the test faster and require fewer file # names that result in hash collision. mkfs.btrfs -f --nodesize 4K $DEV mount $DEV $MNT # List of names that result in the same crc32c hash for btrfs. declare -a names=( 'foobar' '%a8tYkxfGMLWRGr55QSeQc4PBNH9PCLIvR6jZnkDtUUru1t@RouaUe_L:@xGkbO3nCwvLNYeK9vhE628gss:T$yZjZ5l-Nbd6CbC$M=hqE-ujhJICXyIxBvYrIU9-TDC' 'AQci3EUB%shMsg-N%frgU:02ByLs=IPJU0OpgiWit5nexSyxZDncY6WB:=zKZuk5Zy0DD$Ua78%MelgBuMqaHGyKsJUFf9s=UW80PcJmKctb46KveLSiUtNmqrMiL9-Y0I_l5Fnam04CGIg=8@U:Z' 'CvVqJpJzueKcuA$wqwePfyu7VxuWNN3ho$p0zi2H8QFYK$7YlEqOhhb%:hHgjhIjW5vnqWHKNP4' 'ET:vk@rFU4tsvMB0$C_p=xQHaYZjvoF%-BTc%wkFW8yaDAPcCYoR%x$FH5O:' 'HwTon%v7SGSP4FE08jBwwiu5aot2CFKXHTeEAa@38fUcNGOWvE@Mz6WBeDH_VooaZ6AgsXPkVGwy9l@@ZbNXabUU9csiWrrOp0MWUdfi$EZ3w9GkIqtz7I_eOsByOkBOO' 'Ij%2VlFGXSuPvxJGf5UWy6O@1svxGha%b@=%wjkq:CIgE6u7eJOjmQY5qTtxE2Rjbis9@us' 'KBkjG5%9R8K9sOG8UTnAYjxLNAvBmvV5vz3IiZaPmKuLYO03-6asI9lJ_j4@6Xo$KZicaLWJ3Pv8XEwVeUPMwbHYWwbx0pYvNlGMO9F:ZhHAwyctnGy%_eujl%WPd4U2BI7qooOSr85J-C2V$LfY' 'NcRfDfuUQ2=zP8K3CCF5dFcpfiOm6mwenShsAb_F%n6GAGC7fT2JFFn:c35X-3aYwoq7jNX5$ZJ6hI3wnZs$7KgGi7wjulffhHNUxAT0fRRLF39vJ@NvaEMxsMO' 'Oj42AQAEzRoTxa5OuSKIr=A_lwGMy132v4g3Pdq1GvUG9874YseIFQ6QU' 'Ono7avN5GjC:_6dBJ_' 'WHmN2gnmaN-9dVDy4aWo:yNGFzz8qsJyJhWEWcud7$QzN2D9R0efIWWEdu5kwWr73NZm4=@CoCDxrrZnRITr-kGtU_cfW2:%2_am' 'WiFnuTEhAG9FEC6zopQmj-A-$LDQ0T3WULz%ox3UZAPybSV6v1Z$b4L_XBi4M4BMBtJZpz93r9xafpB77r:lbwvitWRyo$odnAUYlYMmU4RvgnNd--e=I5hiEjGLETTtaScWlQp8mYsBovZwM2k' 'XKyH=OsOAF3p%uziGF_ZVr$ivrvhVgD@1u%5RtrV-gl_vqAwHkK@x7YwlxX3qT6WKKQ%PR56NrUBU2dOAOAdzr2=5nJuKPM-T-$ZpQfCL7phxQbUcb:BZOTPaFExc-qK-gDRCDW2' 'd3uUR6OFEwZr%ns1XH_@tbxA@cCPmbBRLdyh7p6V45H$P2$F%w0RqrD3M0g8aGvWpoTFMiBdOTJXjD:JF7=h9a_43xBywYAP%r$SPZi%zDg%ql-KvkdUCtF9OLaQlxmd' 'ePTpbnit%hyNm@WELlpKzNZYOzOTf8EQ$sEfkMy1VOfIUu3coyvIr13-Y7Sv5v-Ivax2Go_GQRFMU1b3362nktT9WOJf3SpT%z8sZmM3gvYQBDgmKI%%RM-G7hyrhgYflOw%z::ZRcv5O:lDCFm' 'evqk743Y@dvZAiG5J05L_ROFV@$2%rVWJ2%3nxV72-W7$e$-SK3tuSHA2mBt$qloC5jwNx33GmQUjD%akhBPu=VJ5g$xhlZiaFtTrjeeM5x7dt4cHpX0cZkmfImndYzGmvwQG:$euFYmXn$_2rA9mKZ' 'gkgUtnihWXsZQTEkrMAWIxir09k3t7jk_IK25t1:cy1XWN0GGqC%FrySdcmU7M8MuPO_ppkLw3=Dfr0UuBAL4%GFk2$Ma10V1jDRGJje%Xx9EV2ERaWKtjpwiZwh0gCSJsj5UL7CR8RtW5opCVFKGGy8Cky' 'hNgsG_8lNRik3PvphqPm0yEH3P%%fYG:kQLY=6O-61Wa6nrV_WVGR6TLB09vHOv%g4VQRP8Gzx7VXUY1qvZyS' 'isA7JVzN12xCxVPJZ_qoLm-pTBuhjjHMvV7o=F:EaClfYNyFGlsfw-Kf%uxdqW-kwk1sPl2vhbjyHU1A6$hz' 'kiJ_fgcdZFDiOptjgH5PN9-PSyLO4fbk_:u5_2tz35lV_iXiJ6cx7pwjTtKy-XGaQ5IefmpJ4N_ZqGsqCsKuqOOBgf9LkUdffHet@Wu' 'lvwtxyhE9:%Q3UxeHiViUyNzJsy:fm38pg_b6s25JvdhOAT=1s0$pG25x=LZ2rlHTszj=gN6M4zHZYr_qrB49i=pA--@WqWLIuX7o1S_SfS@2FSiUZN' 'rC24cw3UBDZ=5qJBUMs9e$=S4Y94ni%Z8639vnrGp=0Hv4z3dNFL0fBLmQ40=EYIY:Z=SLc@QLMSt2zsss2ZXrP7j4=' 'uwGl2s-fFrf@GqS=DQqq2I0LJSsOmM%xzTjS:lzXguE3wChdMoHYtLRKPvfaPOZF2fER@j53evbKa7R%A7r4%YEkD=kicJe@SFiGtXHbKe4gCgPAYbnVn' 'UG37U6KKua2bgc:IHzRs7BnB6FD:2Mt5Cc5NdlsW%$1tyvnfz7S27FvNkroXwAW:mBZLA1@qa9WnDbHCDmQmfPMC9z-Eq6QT0jhhPpqyymaD:R02ghwYo%yx7SAaaq-:x33LYpei$5g8DMl3C' 'y2vjek0FE1PDJC0qpfnN:x8k2wCFZ9xiUF2ege=JnP98R%wxjKkdfEiLWvQzmnW' '8-HCSgH5B%K7P8_jaVtQhBXpBk:pE-$P7ts58U0J@iR9YZntMPl7j$s62yAJO@_9eanFPS54b=UTw$94C-t=HLxT8n6o9P=QnIxq-f1=Ne2dvhe6WbjEQtc' 'YPPh:IFt2mtR6XWSmjHptXL_hbSYu8bMw-JP8@PNyaFkdNFsk$M=xfL6LDKCDM-mSyGA_2MBwZ8Dr4=R1D%7-mCaaKGxb990jzaagRktDTyp' '9hD2ApKa_t_7x-a@GCG28kY:7$M@5udI1myQ$x5udtggvagmCQcq9QXWRC5hoB0o-_zHQUqZI5rMcz_kbMgvN5jr63LeYA4Cj-c6F5Ugmx6DgVf@2Jqm%MafecpgooqreJ53P-QTS' ) # Now create files with all those names in the same parent directory. # It should not fail since a 4K leaf has enough space for them. for name in "${names[@]}"; do touch $MNT/$name done # Now add one more file name that causes a crc32c hash collision. # This should fail, but it should not turn the filesystem into RO mode # (which could be exploited by malicious users) due to a transaction # abort. touch $MNT/'W6tIm-VK2@BGC@IBfcgg6j_p:pxp_QUqtWpGD5Ok_GmijKOJJt' # Check that we are able to create another file, with a name that does not cause # a crc32c hash collision. echo -n "hello world" > $MNT/baz # Unmount and mount again, verify file baz exists and with the right content. umount $MNT mount $DEV $MNT echo "File baz content: $(cat $MNT/baz)" umount $MNT When running the reproducer: $ ./exploit-hash-collisions.sh (...) touch: cannot touch '/mnt/sdi/W6tIm-VK2@BGC@IBfcgg6j_p:pxp_QUqtWpGD5Ok_GmijKOJJt': Value too large for defined data type ./exploit-hash-collisions.sh: line 57: /mnt/sdi/baz: Read-only file system cat: /mnt/sdi/baz: No such file or directory File baz content: And the transaction abort stack trace in dmesg/syslog: $ dmesg (...) [758240.509761] ------------[ cut here ]------------ [758240.510668] BTRFS: Transaction aborted (error -75) [758240.511577] WARNING: fs/btrfs/inode.c:6854 at btrfs_create_new_inode+0x805/0xb50 [btrfs], CPU#6: touch/888644 [758240.513513] Modules linked in: btrfs dm_zero (...) [758240.523221] CPU: 6 UID: 0 PID: 888644 Comm: touch Tainted: G W 6.19.0-rc8-btrfs-next-225+ #1 PREEMPT(full) [758240.524621] Tainted: [W]=WARN [758240.525037] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [758240.526331] RIP: 0010:btrfs_create_new_inode+0x80b/0xb50 [btrfs] [758240.527093] Code: 0f 82 cf (...) [758240.529211] RSP: 0018:ffffce64418fbb48 EFLAGS: 00010292 [758240.529935] RAX: 00000000ffffffd3 RBX: 0000000000000000 RCX: 00000000ffffffb5 [758240.531040] RDX: 0000000d04f33e06 RSI: 00000000ffffffb5 RDI: ffffffffc0919dd0 [758240.531920] RBP: ffffce64418fbc10 R08: 0000000000000000 R09: 00000000ffffffb5 [758240.532928] R10: 0000000000000000 R11: ffff8e52c0000000 R12: ffff8e53eee7d0f0 [758240.533818] R13: ffff8e57f70932a0 R14: ffff8e5417629568 R15: 0000000000000000 [758240.534664] FS: 00007f1959a2a740(0000) GS:ffff8e5b27cae000(0000) knlGS:0000000000000000 [758240.535821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [758240.536644] CR2: 00007f1959b10ce0 CR3: 000000012a2cc005 CR4: 0000000000370ef0 [758240.537517] Call Trace: [758240.537828] [758240.538099] btrfs_create_common+0xbf/0x140 [btrfs] [758240.538760] path_openat+0x111a/0x15b0 [758240.539252] do_filp_open+0xc2/0x170 [758240.539699] ? preempt_count_add+0x47/0xa0 [758240.540200] ? __virt_addr_valid+0xe4/0x1a0 [758240.540800] ? __check_object_size+0x1b3/0x230 [758240.541661] ? alloc_fd+0x118/0x180 [758240.542315] do_sys_openat2+0x70/0xd0 [758240.543012] __x64_sys_openat+0x50/0xa0 [758240.543723] do_syscall_64+0x50/0xf20 [758240.544462] entry_SYSCALL_64_after_hwframe+0x76/0x7e [758240.545397] RIP: 0033:0x7f1959abc687 [758240.546019] Code: 48 89 fa (...) [758240.548522] RSP: 002b:00007ffe16ff8690 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [758240.566278] RAX: ffffffffffffffda RBX: 00007f1959a2a740 RCX: 00007f1959abc687 [758240.567068] RDX: 0000000000000941 RSI: 00007ffe16ffa333 RDI: ffffffffffffff9c [758240.567860] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [758240.568707] R10: 00000000000001b6 R11: 0000000000000202 R12: 0000561eec7c4b90 [758240.569712] R13: 0000561eec7c311f R14: 00007ffe16ffa333 R15: 0000000000000000 [758240.570758] [758240.571040] ---[ end trace 0000000000000000 ]--- [758240.571681] BTRFS: error (device sdi state A) in btrfs_create_new_inode:6854: errno=-75 unknown [758240.572899] BTRFS info (device sdi state EA): forced readonly Fix this by checking for hash collision, and if the adding a new name is possible, early in btrfs_create_new_inode() before we do any tree updates, so that we don't need to abort the transaction if we cannot add the new name due to the leaf size limit. A test case for fstests will be sent soon. Fixes: caae78e03234 ("btrfs: move common inode creation code into btrfs_create_new_inode()") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ae1238b77feafa2f7f10bcd0432a99e098a98ec6 Author: Mark Harmstone Date: Wed Feb 25 10:36:06 2026 +0000 btrfs: read key again after incrementing slot in move_existing_remaps() Fix move_existing_remaps() so that if we increment the slot because the key we encounter isn't a REMAP_BACKREF, we don't reuse the objectid and offset of the old item. Link: https://lore.kernel.org/linux-btrfs/20260125123908.2096548-1-clm@meta.com/ Reported-by: Chris Mason Fixes: bbea42dfb91f ("btrfs: move existing remaps before relocating block group") Reviewed-by: Johannes Thumshirn Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit b2840e33127ce0eea880504b7f133e780f567a9b Author: Bart Van Assche Date: Wed Feb 25 11:59:58 2026 -0800 btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer() Call rcu_read_lock() before exiting the loop in try_release_subpage_extent_buffer() because there is a rcu_read_unlock() call past the loop. This has been detected by the Clang thread-safety analyzer. Fixes: ad580dfa388f ("btrfs: fix subpage deadlock in try_release_subpage_extent_buffer()") CC: stable@vger.kernel.org # 6.18+ Reviewed-by: Qu Wenruo Reviewed-by: Boris Burkov Signed-off-by: Bart Van Assche Reviewed-by: David Sterba Signed-off-by: David Sterba commit 674c5ff0f440a051ebf299d29a4c013133d81a65 Author: Heiko Carstens Date: Mon Mar 2 14:35:00 2026 +0100 s390/stackleak: Fix __stackleak_poison() inline assembly constraint The __stackleak_poison() inline assembly comes with a "count" operand where the "d" constraint is used. "count" is used with the exrl instruction and "d" means that the compiler may allocate any register from 0 to 15. If the compiler would allocate register 0 then the exrl instruction would not or the value of "count" into the executed instruction - resulting in a stackframe which is only partially poisoned. Use the correct "a" constraint, which excludes register 0 from register allocation. Fixes: 2a405f6bb3a5 ("s390/stackleak: provide fast __stackleak_poison() implementation") Cc: stable@vger.kernel.org Signed-off-by: Heiko Carstens Reviewed-by: Vasily Gorbik Link: https://lore.kernel.org/r/20260302133500.1560531-4-hca@linux.ibm.com Signed-off-by: Vasily Gorbik commit 87ff6da3001b2a35d241c5d965b82536f6418277 Author: Heiko Carstens Date: Mon Mar 2 14:34:59 2026 +0100 s390/xor: Improve inline assembly constraints The inline assembly constraint for the "bytes" operand is "d" for all xor() inline assemblies. "d" means that any register from 0 to 15 can be used. If the compiler would use register 0 then the exrl instruction would not or the value of "bytes" into the executed instruction - resulting in an incorrect result. However all the xor() inline assemblies make hard-coded use of register 0, and it is correctly listed in the clobber list, so that this cannot happen. Given that this is quite subtle use the better "a" constraint, which excludes register 0 from register allocation in any case. Signed-off-by: Heiko Carstens Reviewed-by: Vasily Gorbik Link: https://lore.kernel.org/r/20260302133500.1560531-3-hca@linux.ibm.com Signed-off-by: Vasily Gorbik commit f775276edc0c505dc0f782773796c189f31a1123 Author: Heiko Carstens Date: Mon Mar 2 14:34:58 2026 +0100 s390/xor: Fix xor_xc_2() inline assembly constraints The inline assembly constraints for xor_xc_2() are incorrect. "bytes", "p1", and "p2" are input operands, while all three of them are modified within the inline assembly. Given that the function consists only of this inline assembly it seems unlikely that this may cause any problems, however fix this in any case. Fixes: 2cfc5f9ce7f5 ("s390/xor: optimized xor routing using the XC instruction") Cc: stable@vger.kernel.org Signed-off-by: Heiko Carstens Reviewed-by: Vasily Gorbik Link: https://lore.kernel.org/r/20260302133500.1560531-2-hca@linux.ibm.com Signed-off-by: Vasily Gorbik commit 5f25805303e201f3afaff0a90f7c7ce257468704 Author: Vasily Gorbik Date: Mon Mar 2 19:03:34 2026 +0100 s390/xor: Fix xor_xc_5() inline assembly xor_xc_5() contains a larl 1,2f that is not used by the asm and is not declared as a clobber. This can corrupt a compiler-allocated value in %r1 and lead to miscompilation. Remove the instruction. Fixes: 745600ed6965 ("s390/lib: Use exrl instead of ex in xor functions") Cc: stable@vger.kernel.org Reviewed-by: Juergen Christ Reviewed-by: Heiko Carstens Reviewed-by: Sven Schnelle Signed-off-by: Vasily Gorbik commit 5131fa077f9bb386a1b901bf5b247041f0ec8f80 Author: Boris Burkov Date: Tue Feb 24 14:25:35 2026 -0800 btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like: drwxrwxrwt 1 root root 16 Jan 23 16:49 . drwxr-xr-x 1 root root 24 Jan 23 16:48 .. d????????? ? ? ? ? ? broken_subvol and similarly stat-ing the file fails. In this state, deleting the subvol fails with ENOENT, but attempting to create a new file or subvol over it errors out with EEXIST and even aborts the fs. Which leaves us a bit stuck. dmesg contains a single notable error message reading: "could not do orphan cleanup -2" 2 is ENOENT and the error comes from the failure handling path of btrfs_orphan_cleanup(), with the stack leading back up to btrfs_lookup(). btrfs_lookup btrfs_lookup_dentry btrfs_orphan_cleanup // prints that message and returns -ENOENT After some detailed inspection of the internal state, it became clear that: - there are no orphan items for the subvol - the subvol is otherwise healthy looking, it is not half-deleted or anything, there is no drop progress, etc. - the subvol was created a while ago and does the meaningful first btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much later. - after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT, which results in a negative dentry for the subvolume via d_splice_alias(NULL, dentry), leading to the observed behavior. The bug can be mitigated by dropping the dentry cache, at which point we can successfully delete the subvolume if we want. i.e., btrfs_lookup() btrfs_lookup_dentry() if (!sb_rdonly(inode->vfs_inode)->vfs_inode) btrfs_orphan_cleanup(sub_root) test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) btrfs_search_slot() // finds orphan item for inode N ... prints "could not do orphan cleanup -2" if (inode == ERR_PTR(-ENOENT)) inode = NULL; return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume btrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) on the root when it runs, so it cannot run more than once on a given root, so something else must run concurrently. However, the obvious routes to deleting an orphan when nlinks goes to 0 should not be able to run without first doing a lookup into the subvolume, which should run btrfs_orphan_cleanup() and set the bit. The final important observation is that create_subvol() calls d_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if the dentry cache gets dropped, the next lookup into the subvolume will make a real call into btrfs_orphan_cleanup() for the first time. This opens up the possibility of concurrently deleting the inode/orphan items but most typical evict() paths will be holding a reference on the parent dentry (child dentry holds parent->d_lockref.count via dget in d_alloc(), released in __dentry_kill()) and prevent the parent from being removed from the dentry cache. The one exception is delayed iputs. Ordered extent creation calls igrab() on the inode. If the file is unlinked and closed while those refs are held, iput() in __dentry_kill() decrements i_count but does not trigger eviction (i_count > 0). The child dentry is freed and the subvol dentry's d_lockref.count drops to 0, making it evictable while the inode is still alive. Since there are two races (the race between writeback and unlink and the race between lookup and delayed iputs), and there are too many moving parts, the following three diagrams show the complete picture. (Only the second and third are races) Phase 1: Create Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set btrfs_mksubvol() lookup_one_len() __lookup_slow() d_alloc_parallel() __d_alloc() // d_lockref.count = 1 create_subvol(dentry) // doesn't touch the bit.. d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.count == 1 Phase 2: Create a delayed iput for a file in the subvol but leave the subvol in state where its dentry can be evicted (d_lockref.count == 0) T1 (task) T2 (writeback) T3 (OE workqueue) write() // dirty pages btrfs_writepages() btrfs_run_delalloc_range() cow_file_range() btrfs_alloc_ordered_extent() igrab() // i_count: 1 -> 2 btrfs_unlink_inode() btrfs_orphan_add() close() __fput() dput() finish_dput() __dentry_kill() dentry_unlink_inode() iput() // 2 -> 1 --parent->d_lockref.count // 1 -> 0; evictable finish_ordered_fn() btrfs_finish_ordered_io() btrfs_put_ordered_extent() btrfs_add_delayed_iput() Phase 3: Once the delayed iput is pending and the subvol dentry is evictable, the shrinker can free it, causing the next lookup to go through btrfs_lookup() and call btrfs_orphan_cleanup() for the first time. If the cleaner kthread processes the delayed iput concurrently, the two race: T1 (shrinker) T2 (cleaner kthread) T3 (lookup) super_cache_scan() prune_dcache_sb() __dentry_kill() // subvol dentry freed btrfs_run_delayed_iputs() iput() // i_count -> 0 evict() // sets I_FREEING btrfs_evict_inode() // truncation loop btrfs_lookup() btrfs_lookup_dentry() btrfs_orphan_cleanup() // first call (bit never set) btrfs_iget() // blocks on I_FREEING btrfs_orphan_del() // inode freed // returns -ENOENT btrfs_del_orphan_item() // -ENOENT // "could not do orphan cleanup -2" d_splice_alias(NULL, dentry) // negative dentry for valid subvol The most straightforward fix is to ensure the invariant that a dentry for a subvolume can exist if and only if that subvolume has BTRFS_ROOT_ORPHAN_CLEANUP set on its root (and is known to have no orphans or ran btrfs_orphan_cleanup()). Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 17da926ca8757cc0432ce3e13230759894a6b017 Author: Johannes Thumshirn Date: Tue Feb 24 13:51:13 2026 +0100 btrfs: zoned: move btrfs_zoned_reserve_data_reloc_bg() after kthread start btrfs_zoned_reserve_data_reloc_bg() is called on each mount of a file system and allocates a new block-group, to assign it to be the dedicated relocation target, if no pre-existing usable block-group for this task is found. If for some reason the transaction is aborted, btrfs_end_transaction() will wake up the transaction kthread. But the transaction kthread is not yet initialized at the time btrfs_zoned_reserve_data_reloc_bg() is called, leading to the following NULL-pointer dereference: RSP: 0018:ffffc9000c617c98 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 000000000000073c RCX: 0000000000000002 RDX: 0000000000000001 RSI: 0000000000000003 RDI: 0000000000000001 RBP: 0000000000000207 R08: ffffffff8223c71d R09: 0000000000000635 R10: ffff888108588000 R11: 0000000000000003 R12: 0000000000000003 R13: 000000000000073c R14: 0000000000000000 R15: ffff888114dd6000 FS: 00007f2993745840(0000) GS:ffff8882b508d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000073c CR3: 0000000121a82006 CR4: 0000000000770eb0 PKRU: 55555554 Call Trace: try_to_wake_up (./include/linux/spinlock.h:557 kernel/sched/core.c:4106) __btrfs_end_transaction (fs/btrfs/transaction.c:1115 (discriminator 2)) btrfs_zoned_reserve_data_reloc_bg (fs/btrfs/zoned.c:2840) open_ctree (fs/btrfs/disk-io.c:3588) btrfs_get_tree.cold (fs/btrfs/super.c:982 fs/btrfs/super.c:1944 fs/btrfs/super.c:2087 fs/btrfs/super.c:2121) vfs_get_tree (fs/super.c:1752) __do_sys_fsconfig (fs/fsopen.c:231 fs/fsopen.c:295 fs/fsopen.c:473) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) RIP: 0033:0x7f299392740e Move the call to btrfs_zoned_reserve_data_reloc_bg() after the transaction_kthread has been initialized to fix this problem. Fixes: 694ce5e143d6 ("btrfs: zoned: reserve data_reloc block group on mount") Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit b8883b61f2fc50dcf22938cbed40fec05020552f Author: Sun YangKai Date: Mon Feb 9 20:53:39 2026 +0800 btrfs: hold space_info->lock when clearing periodic reclaim ready btrfs_set_periodic_reclaim_ready() requires space_info->lock to be held, as enforced by lockdep_assert_held(). However, btrfs_reclaim_sweep() was calling it after do_reclaim_sweep() returns, at which point space_info->lock is no longer held. Fix this by explicitly acquiring space_info->lock before clearing the periodic reclaim ready flag in btrfs_reclaim_sweep(). Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260208182556.891815-1-clm@meta.com/ Fixes: 19eff93dc738 ("btrfs: fix periodic reclaim condition") Reviewed-by: Boris Burkov Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit b85cfdf46b2402a9e57d6b7d43e2c977f9554645 Author: Mark Harmstone Date: Mon Feb 9 18:00:14 2026 +0000 btrfs: print-tree: add remap tree definitions Add the definitions for the remap tree to print-tree.c, so that we get more useful information if a tree is dumped to dmesg. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 00fd9aad55e7ced494a738a07662155d058b872f Author: Rafael J. Wysocki Date: Tue Mar 3 15:26:31 2026 +0100 Revert "ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM" Revert commit 88fad6ce090b ("ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM") that introduced a SoundWire suspend regression [1]. It is actually not true that the commit above doesn't make a functional difference because acpi_subsys_suspend(), for example, may resume devices in runtime-suspend which affects the subsequent handling of those devices during the suspend transition. For this reason, the devices that were handled by the ACPI PM domain before that commit may be handled differently now which may lead to suspend-resume issues. Fixes: 88fad6ce090b ("ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM") Reported-by: Péter Ujfalusi Closes: https://github.com/thesofproject/linux/pull/5677#issuecomment-3984375077 [1] Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2829615.mvXUDI8C0e@rafael.j.wysocki commit 27990181031fdcdbe0f7c46011f6404e5d116386 Author: Charles Keepax Date: Tue Mar 3 14:17:07 2026 +0000 ASoC: SDCA: Add allocation failure check for Entity name Currently find_sdca_entity_iot() can allocate a string for the Entity name but it doesn't check if that allocation succeeded. Add the missing NULL check after the allocation. Fixes: 48fa77af2f4a ("ASoC: SDCA: Add terminal type into input/output widget name") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260303141707.3841635-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 7271cb98e4981e32c9b2a5f9eb5ad0cd0cdd5bf3 Author: Hou Wenlong Date: Sun Mar 1 13:04:52 2026 +0800 x86/PVH: Use boot params to pass RSDP address in start_info page After commit e6e094e053af75 ("x86/acpi, x86/boot: Take RSDP address from boot params if available"), the RSDP address can be passed in boot params. Therefore, store the RSDP address in start_info page into boot params in the PVH entry instead of registering a different callback. This removes an absolute reference during the PVH entry and is more standardized. Signed-off-by: Hou Wenlong Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <76675c4d49d3a8f72252076812ef8f22276230c2.1772282441.git.houwenlong.hwl@antgroup.com> commit b8c460a045985a8cb7a7c34912d2db91afee242f Author: kexinsun Date: Tue Feb 24 10:24:24 2026 +0800 x86/xen: update outdated comment The function xen_flush_tlb_others() was renamed xen_flush_tlb_multi() by commit 4ce94eabac16 ("x86/mm/tlb: Flush remote and local TLBs concurrently"). Update the comment accordingly. Signed-off-by: kexinsun Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260224022424.1718-1-kexinsun@smail.nju.edu.cn> commit 8b57227d59a86fc06d4f09de08f98133680f2cae Author: David Thomson Date: Tue Feb 24 09:37:11 2026 +0000 xen/acpi-processor: fix _CST detection using undersized evaluation buffer read_acpi_id() attempts to evaluate _CST using a stack buffer of sizeof(union acpi_object) (48 bytes), but _CST returns a nested Package of sub-Packages (one per C-state, each containing a register descriptor, type, latency, and power) requiring hundreds of bytes. The evaluation always fails with AE_BUFFER_OVERFLOW. On modern systems using FFH/MWAIT entry (where pblk is zero), this causes the function to return before setting the acpi_id_cst_present bit. In check_acpi_ids(), flags.power is then zero for all Phase 2 CPUs (physical CPUs beyond dom0's vCPU count), so push_cxx_to_hypervisor() is never called for them. On a system with dom0_max_vcpus=2 and 8 physical CPUs, only PCPUs 0-1 receive C-state data. PCPUs 2-7 are stuck in C0/C1 idle, unable to enter C2/C3. This costs measurable wall power (4W observed on an Intel Core Ultra 7 265K with Xen 4.20). The function never uses the _CST return value -- it only needs to know whether _CST exists. Replace the broken acpi_evaluate_object() call with acpi_has_method(), which correctly detects _CST presence using acpi_get_handle() without any buffer allocation. This brings C-state detection to parity with the P-state path, which already works correctly for Phase 2 CPUs. Fixes: 59a568029181 ("xen/acpi-processor: C and P-state driver that uploads said data to hypervisor.") Signed-off-by: David Thomson Reviewed-by: Jan Beulich Signed-off-by: Juergen Gross Message-ID: <20260224093707.19679-1-dt@linux-mail.net> commit 63dc2c34a91642d9ae615a9609841fa317a36c92 Author: Hou Wenlong Date: Thu Jan 22 18:06:14 2026 +0800 x86/xen: Build identity mapping page tables dynamically for XENPV After commit 47ffe0578aee ("x86/pvh: Add 64bit relocation page tables"), the PVH entry uses a new set of page tables instead of the preconstructed page tables in head64.S. Since those preconstructed page tables are only used in XENPV now and XENPV does not actually need the preconstructed identity page tables directly, they can be filled in xen_setup_kernel_pagetable(). Therefore, build the identity mapping page table dynamically to remove the preconstructed page tables and make the code cleaner. Signed-off-by: Hou Wenlong Reviewed-by: Juergen Gross Acked-by: "Borislav Petkov (AMD)" Signed-off-by: Juergen Gross Message-ID: <453981eae7e8158307f971d1632d5023adbe03c3.1769074722.git.houwenlong.hwl@antgroup.com> commit d1a196e0a6dcddd03748468a0e9e3100790fc85c Author: Thorsten Blum Date: Tue Mar 3 12:30:51 2026 +0100 platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data set_new_password() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials. Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260303113050.58127-2-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1a86a1f7d88996085934139fa4c063b6299a2dd3 Author: YiFei Zhu Date: Fri Feb 27 22:19:37 2026 +0000 net: Fix rcu_tasks stall in threaded busypoll I was debugging a NIC driver when I noticed that when I enable threaded busypoll, bpftrace hangs when starting up. dmesg showed: rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 10658 jiffies old. rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 40793 jiffies old. rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 131273 jiffies old. rcu_tasks_wait_gp: rcu_tasks grace period number 85 (since boot) is 402058 jiffies old. INFO: rcu_tasks detected stalls on tasks: 00000000769f52cd: .N nvcsw: 2/2 holdout: 1 idle_cpu: -1/64 task:napi/eth2-8265 state:R running task stack:0 pid:48300 tgid:48300 ppid:2 task_flags:0x208040 flags:0x00004000 Call Trace: ? napi_threaded_poll_loop+0x27c/0x2c0 ? __pfx_napi_threaded_poll+0x10/0x10 ? napi_threaded_poll+0x26/0x80 ? kthread+0xfa/0x240 ? __pfx_kthread+0x10/0x10 ? ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ? ret_from_fork_asm+0x1a/0x30 The cause is that in threaded busypoll, the main loop is in napi_threaded_poll rather than napi_threaded_poll_loop, where the latter rarely iterates more than once within its loop. For rcu_softirq_qs_periodic inside napi_threaded_poll_loop to report its qs state, the last_qs must be 100ms behind, and this can't happen because napi_threaded_poll_loop rarely iterates in threaded busypoll, and each time napi_threaded_poll_loop is called last_qs is reset to latest jiffies. This patch changes so that in threaded busypoll, last_qs is saved in the outer napi_threaded_poll, and whether busy_poll_last_qs is NULL indicates whether napi_threaded_poll_loop is called for busypoll. This way last_qs would not reset to latest jiffies on each invocation of napi_threaded_poll_loop. Fixes: c18d4b190a46 ("net: Extend NAPI threaded polling to allow kthread based busy polling") Cc: stable@vger.kernel.org Signed-off-by: YiFei Zhu Reviewed-by: Samiullah Khawaja Link: https://patch.msgid.link/20260227221937.1060857-1-zhuyifei@google.com Signed-off-by: Paolo Abeni commit 9de68394a61528d40f575c3e6719cc75c56f62c3 Author: Danilo Krummrich Date: Mon Mar 2 01:25:44 2026 +0100 Revert "driver core: enforce device_lock for driver_match_device()" This reverts commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") and commit 289b14592cef ("driver core: fix inverted "locked" suffix of driver_match_device()"). While technically correct, there is a major downside to this approach: When a device is already present in the system and a driver is registered on the same bus, we iterate over all devices registered on this bus to see if one of them matches. If we come across an already bound one where the corresponding driver crashed while holding the device lock (e.g. in probe()) we can't make any progress anymore. However, drivers are typically the least tested code in the kernel and hence it is a case that is likely to happen regularly. Besides hurting developer ergonomics, it potentially decreases chances of shutting things down cleanly and obtaining logs in production environments as well [1]. This came up in the context of a firewire bug, which only in combination with the reverted commit, caused the machine to hang [2]. Additionally, it was observed in [3]. Thus, revert commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") and add a brief note clarifying that an implementer of struct bus_type must not expect match() to be called with the device lock held. Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Link: https://lore.kernel.org/all/67f655bb-4d81-4609-b008-68d200255dd2@davidgow.net/ [2] Link: https://lore.kernel.org/lkml/CALbr=LZ4v7N=tO1vgOsyj9AS+XuNbn6kG-QcF+PacdMjSo0iyw@mail.gmail.com/ [3] Reported-by: Linus Torvalds Closes: https://lore.kernel.org/driver-core/CAHk-=wgJ_L1C=HjcYJotg_zrZEmiLFJaoic+PWthjuQrutrfJw@mail.gmail.com/ Reviewed-by: Gui-Dong Han Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260302002545.19389-1-dakr@kernel.org [ Add additional Link: reference. - Danilo ] Signed-off-by: Danilo Krummrich commit 6a877ececd6daa002a9a0002cd0fbca6592a9244 Author: Allison Henderson Date: Fri Feb 27 13:23:36 2026 -0700 net/rds: Fix circular locking dependency in rds_tcp_tune syzbot reported a circular locking dependency in rds_tcp_tune() where sk_net_refcnt_upgrade() is called while holding the socket lock: ====================================================== WARNING: possible circular locking dependency detected ====================================================== kworker/u10:8/15040 is trying to acquire lock: ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x6f0 but task is already holding lock: ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: rds_tcp_tune+0xd7/0x930 The issue occurs because sk_net_refcnt_upgrade() performs memory allocation (via get_net_track() -> ref_tracker_alloc()) while the socket lock is held, creating a circular dependency with fs_reclaim. Fix this by moving sk_net_refcnt_upgrade() outside the socket lock critical section. This is safe because the fields modified by the sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not accessed by any concurrent code path at this point. v2: - Corrected fixes tag - check patch line wrap nits - ai commentary nits Reported-by: syzbot+2e2cf5331207053b8106@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2e2cf5331207053b8106 Fixes: 3a58f13a881e ("net: rds: acquire refcount on TCP sockets") Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260227202336.167757-1-achender@kernel.org Signed-off-by: Paolo Abeni commit 710f5c76580306cdb9ec51fac8fcf6a8faff7821 Author: Eric Dumazet Date: Fri Feb 27 17:26:03 2026 +0000 indirect_call_wrapper: do not reevaluate function pointer We have an increasing number of READ_ONCE(xxx->function) combined with INDIRECT_CALL_[1234]() helpers. Unfortunately this forces INDIRECT_CALL_[1234]() to read xxx->function many times, which is not what we wanted. Fix these macros so that xxx->function value is not reloaded. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux add/remove: 0/0 grow/shrink: 1/65 up/down: 122/-1084 (-962) Function old new delta ip_push_pending_frames 59 181 +122 ip6_finish_output 687 681 -6 __udp_enqueue_schedule_skb 1078 1072 -6 ioam6_output 2319 2312 -7 xfrm4_rcv_encap_finish2 64 56 -8 xfrm4_output 297 289 -8 vrf_ip_local_out 278 270 -8 vrf_ip6_local_out 278 270 -8 seg6_input_finish 64 56 -8 rpl_output 700 692 -8 ipmr_forward_finish 124 116 -8 ip_forward_finish 143 135 -8 ip6mr_forward2_finish 100 92 -8 ip6_forward_finish 73 65 -8 input_action_end_bpf 1091 1083 -8 dst_input 52 44 -8 __xfrm6_output 801 793 -8 __xfrm4_output 83 75 -8 bpf_input 500 491 -9 __tcp_check_space 530 521 -9 input_action_end_dt6 291 280 -11 vti6_tnl_xmit 1634 1622 -12 bpf_xmit 1203 1191 -12 rpl_input 497 483 -14 rawv6_send_hdrinc 1355 1341 -14 ndisc_send_skb 1030 1016 -14 ipv6_srh_rcv 1377 1363 -14 ip_send_unicast_reply 1253 1239 -14 ip_rcv_finish 226 212 -14 ip6_rcv_finish 300 286 -14 input_action_end_x_core 205 191 -14 input_action_end_x 355 341 -14 input_action_end_t 205 191 -14 input_action_end_dx6_finish 127 113 -14 input_action_end_dx4_finish 373 359 -14 input_action_end_dt4 426 412 -14 input_action_end_core 186 172 -14 input_action_end_b6_encap 292 278 -14 input_action_end_b6 198 184 -14 igmp6_send 1332 1318 -14 ip_sublist_rcv 864 848 -16 ip6_sublist_rcv 1091 1075 -16 ipv6_rpl_srh_rcv 1937 1920 -17 xfrm_policy_queue_process 1246 1228 -18 seg6_output_core 903 885 -18 mld_sendpack 856 836 -20 NF_HOOK 756 736 -20 vti_tunnel_xmit 1447 1426 -21 input_action_end_dx6 664 642 -22 input_action_end 1502 1480 -22 sock_sendmsg_nosec 134 111 -23 ip6mr_forward2 388 364 -24 sock_recvmsg_nosec 134 109 -25 seg6_input_core 836 810 -26 ip_send_skb 172 146 -26 ip_local_out 140 114 -26 ip6_local_out 140 114 -26 __sock_sendmsg 162 136 -26 __ip_queue_xmit 1196 1170 -26 __ip_finish_output 405 379 -26 ipmr_queue_fwd_xmit 373 346 -27 sock_recvmsg 173 145 -28 ip6_xmit 1635 1607 -28 xfrm_output_resume 1418 1389 -29 ip_build_and_send_pkt 625 591 -34 dst_output 504 432 -72 Total: Before=25217686, After=25216724, chg -0.00% Fixes: 283c16a2dfd3 ("indirect call wrappers: helpers to speed-up indirect calls of builtin") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260227172603.1700433-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 4e10a730d1b511ff49723371ed6d694dd1b2c785 Author: Lorenzo Bianconi Date: Thu Feb 26 20:11:16 2026 +0100 wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob access. Fixes: 577dbc6c656d ("mt76: mt7915: enable offloading of sequence number assignment") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-3-b0f6d1ad4850@kernel.org [fix check to also cover mgmt->u.action.u.addba_req.capab, correct Fixes tag] Signed-off-by: Johannes Berg commit c41a9abd6ae31d130e8f332e7c8800c4c866234b Author: Lorenzo Bianconi Date: Thu Feb 26 20:11:15 2026 +0100 wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7925_mac_write_txwi_80211 in order to avoid a possible oob access. Fixes: c948b5da6bbec ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-2-b0f6d1ad4850@kernel.org Signed-off-by: Johannes Berg commit 60862846308627e9e15546bb647a00de44deb27b Author: Lorenzo Bianconi Date: Thu Feb 26 20:11:14 2026 +0100 wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7996_mac_write_txwi_80211 in order to avoid a possible oob access. Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-1-b0f6d1ad4850@kernel.org Signed-off-by: Johannes Berg commit 9003a0e3b6a7d950705b4c01ae4b3c968dc366f4 Merge: 72c6df8f284b3a 7259b1a0e54c2d Author: Johannes Berg Date: Tue Mar 3 12:05:09 2026 +0100 Merge tag 'ath-current-20260302' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v7.0-rc3 Fix issues with ath12k station statistics requests. ================== Signed-off-by: Johannes Berg commit 72c6df8f284b3a49812ce2ac136727ace70acc7c Author: Bart Van Assche Date: Mon Feb 23 14:00:25 2026 -0800 wifi: wlcore: Fix a locking bug Make sure that wl->mutex is locked before it is unlocked. This has been detected by the Clang thread-safety analyzer. Fixes: 45aa7f071b06 ("wlcore: Use generic runtime pm calls for wowlan elp configuration") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260223220102.2158611-26-bart.vanassche@linux.dev Signed-off-by: Johannes Berg commit d98c24617a831e92e7224a07dcaed2dd0b02af96 Author: Bart Van Assche Date: Mon Feb 23 14:00:24 2026 -0800 wifi: cw1200: Fix locking in error paths cw1200_wow_suspend() must only return with priv->conf_mutex locked if it returns zero. This mutex must be unlocked if an error is returned. Add mutex_unlock() calls to the error paths from which that call is missing. This has been detected by the Clang thread-safety analyzer. Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260223220102.2158611-25-bart.vanassche@linux.dev Signed-off-by: Johannes Berg commit 699f3b2e51d0b6e15a2e88980e34909a11382a36 Merge: 210fd8f40820c3 6c73126ecd1080 Author: Paolo Abeni Date: Tue Mar 3 11:34:22 2026 +0100 Merge branch 'avoid-compiler-and-iq-oq-reordering' Vimlesh Kumar says: ==================== avoid compiler and IQ/OQ reordering Utilize READ_ONCE and WRITE_ONCE APIs to prevent compiler optimization and reordering. Ensure IO queue OUT/IN_CNT registers are flushed. Relocate IQ/OQ IN/OUT_CNTS updates to occur before NAPI completion, and replace napi_complete with napi_complete_done. ==================== Link: https://patch.msgid.link/20260227091402.1773833-1-vimleshk@marvell.com Signed-off-by: Paolo Abeni commit 6c73126ecd1080351b468fe43353b2f705487f44 Author: Vimlesh Kumar Date: Fri Feb 27 09:14:00 2026 +0000 octeon_ep_vf: avoid compiler and IQ/OQ reordering Utilize READ_ONCE and WRITE_ONCE APIs for IO queue Tx/Rx variable access to prevent compiler optimization and reordering. Additionally, ensure IO queue OUT/IN_CNT registers are flushed by performing a read-back after writing. The compiler could reorder reads/writes to pkts_pending, last_pkt_count, etc., causing stale values to be used when calculating packets to process or register updates to send to hardware. The Octeon hardware requires a read-back after writing to OUT_CNT/IN_CNT registers to ensure the write has been flushed through any posted write buffers before the interrupt resend bit is set. Without this, we have observed cases where the hardware didn't properly update its internal state. wmb/rmb only provides ordering guarantees but doesn't prevent the compiler from performing optimizations like caching in registers, load tearing etc. Fixes: 1cd3b407977c3 ("octeon_ep_vf: add Tx/Rx processing and interrupt support") Signed-off-by: Sathesh Edara Signed-off-by: Shinas Rasheed Signed-off-by: Vimlesh Kumar Link: https://patch.msgid.link/20260227091402.1773833-5-vimleshk@marvell.com Signed-off-by: Paolo Abeni commit 2ae7d20fb24f598f60faa8f6ecc856dac782261a Author: Vimlesh Kumar Date: Fri Feb 27 09:13:59 2026 +0000 octeon_ep_vf: Relocate counter updates before NAPI Relocate IQ/OQ IN/OUT_CNTS updates to occur before NAPI completion. Moving the IQ/OQ counter updates before napi_complete_done ensures 1. Counter registers are updated before re-enabling interrupts. 2. Prevents a race where new packets arrive but counters aren't properly synchronized. Fixes: 1cd3b407977c3 ("octeon_ep_vf: add Tx/Rx processing and interrupt support") Signed-off-by: Sathesh Edara Signed-off-by: Shinas Rasheed Signed-off-by: Vimlesh Kumar Link: https://patch.msgid.link/20260227091402.1773833-4-vimleshk@marvell.com Signed-off-by: Paolo Abeni commit 43b3160cb639079a15daeb5f080120afbfbfc918 Author: Vimlesh Kumar Date: Fri Feb 27 09:13:58 2026 +0000 octeon_ep: avoid compiler and IQ/OQ reordering Utilize READ_ONCE and WRITE_ONCE APIs for IO queue Tx/Rx variable access to prevent compiler optimization and reordering. Additionally, ensure IO queue OUT/IN_CNT registers are flushed by performing a read-back after writing. The compiler could reorder reads/writes to pkts_pending, last_pkt_count, etc., causing stale values to be used when calculating packets to process or register updates to send to hardware. The Octeon hardware requires a read-back after writing to OUT_CNT/IN_CNT registers to ensure the write has been flushed through any posted write buffers before the interrupt resend bit is set. Without this, we have observed cases where the hardware didn't properly update its internal state. wmb/rmb only provides ordering guarantees but doesn't prevent the compiler from performing optimizations like caching in registers, load tearing etc. Fixes: 37d79d0596062 ("octeon_ep: add Tx/Rx processing and interrupt support") Signed-off-by: Sathesh Edara Signed-off-by: Shinas Rasheed Signed-off-by: Vimlesh Kumar Link: https://patch.msgid.link/20260227091402.1773833-3-vimleshk@marvell.com Signed-off-by: Paolo Abeni commit 18c04a808c436d629d5812ce883e3822a5f5a47f Author: Vimlesh Kumar Date: Fri Feb 27 09:13:57 2026 +0000 octeon_ep: Relocate counter updates before NAPI Relocate IQ/OQ IN/OUT_CNTS updates to occur before NAPI completion, and replace napi_complete with napi_complete_done. Moving the IQ/OQ counter updates before napi_complete_done ensures 1. Counter registers are updated before re-enabling interrupts. 2. Prevents a race where new packets arrive but counters aren't properly synchronized. napi_complete_done (vs napi_complete) allows for better interrupt coalescing. Fixes: 37d79d0596062 ("octeon_ep: add Tx/Rx processing and interrupt support") Signed-off-by: Sathesh Edara Signed-off-by: Shinas Rasheed Signed-off-by: Vimlesh Kumar Link: https://patch.msgid.link/20260227091402.1773833-2-vimleshk@marvell.com Signed-off-by: Paolo Abeni commit 210fd8f40820c3c1f97ead0cb171374a09fdcbe0 Merge: 1939d9816dbfc0 181cafbd8a01d2 Author: Paolo Abeni Date: Tue Mar 3 10:47:44 2026 +0100 Merge branch 'bonding-fix-missing-xdp-compat-check-on-xmit_hash_policy-change' Jiayuan Chen says: ==================== bonding: fix missing XDP compat check on xmit_hash_policy change syzkaller reported a bug https://syzkaller.appspot.com/bug?extid=5a287bcdc08104bc3132 When a bond device is in 802.3ad or balance-xor mode, XDP is supported only when xmit_hash_policy != vlan+srcmac. This constraint is enforced in bond_option_mode_set() via bond_xdp_check(), which prevents switching to an XDP-incompatible mode while a program is loaded. However, the symmetric path -- changing xmit_hash_policy while XDP is loaded -- had no such guard in bond_option_xmit_hash_policy_set(). This means the following sequence silently creates an inconsistent state: 1. Create a bond in 802.3ad mode with xmit_hash_policy=layer2+3. 2. Attach a native XDP program to the bond. 3. Change xmit_hash_policy to vlan+srcmac (no error, not checked). Now bond->xdp_prog is set but bond_xdp_check() returns false for the same device. When the bond is later torn down (e.g. netns deletion), dev_xdp_uninstall() calls bond_xdp_set(dev, NULL) to remove the program, which hits the bond_xdp_check() guard and returns -EOPNOTSUPP, triggering a kernel WARNING: bond1 (unregistering): Error: No native XDP support for the current bonding mode ------------[ cut here ]------------ dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL) WARNING: net/core/dev.c:10361 at dev_xdp_uninstall net/core/dev.c:10361 [inline], CPU#0: kworker/u8:22/11031 Modules linked in: CPU: 0 UID: 0 PID: 11031 Comm: kworker/u8:22 Not tainted syzkaller #0 PREEMPT(full) Workqueue: netns cleanup_net RIP: 0010:dev_xdp_uninstall net/core/dev.c:10361 [inline] RIP: 0010:unregister_netdevice_many_notify+0x1efd/0x2370 net/core/dev.c:12393 RSP: 0018:ffffc90003b2f7c0 EFLAGS: 00010293 RAX: ffffffff8971e99c RBX: ffff888052f84c40 RCX: ffff88807896bc80 RDX: 0000000000000000 RSI: 00000000ffffffa1 RDI: 0000000000000000 RBP: ffffc90003b2f930 R08: ffffc90003b2f207 R09: 1ffff92000765e40 R10: dffffc0000000000 R11: fffff52000765e41 R12: 00000000ffffffa1 R13: ffff888052f84c38 R14: 1ffff1100a5f0988 R15: ffffc9000df67000 FS: 0000000000000000(0000) GS:ffff8881254ae000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f60871d5d58 CR3: 000000006c41c000 CR4: 00000000003526f0 Call Trace: ops_exit_rtnl_list net/core/net_namespace.c:187 [inline] ops_undo_list+0x3d3/0x940 net/core/net_namespace.c:248 cleanup_net+0x56b/0x800 net/core/net_namespace.c:704 process_one_work kernel/workqueue.c:3275 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439 kthread+0x388/0x470 kernel/kthread.c:467 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Beyond the WARNING itself, when dev_xdp_install() fails during dev_xdp_uninstall(), bond_xdp_set() returns early without calling bpf_prog_put() on the old program. dev_xdp_uninstall() then releases only the reference held by dev->xdp_state[], while the reference held by bond->xdp_prog is never dropped, leaking the struct bpf_prog. The fix refactors the core logic of bond_xdp_check() into a new helper __bond_xdp_check_mode(mode, xmit_policy) that takes both parameters explicitly, avoiding the need to read them from the bond struct. bond_xdp_check() becomes a thin wrapper around it. bond_option_xmit_hash_policy_set() then uses __bond_xdp_check_mode() directly, passing the candidate xmit_policy before it is committed, mirroring exactly what bond_option_mode_set() already does for mode changes. Patch 1 adds the kernel fix. Patch 2 adds a selftest that reproduces the WARNING by attaching native XDP to a bond in 802.3ad mode, then attempting to change xmit_hash_policy to vlan+srcmac -- verifying the change is rejected with the fix applied. ==================== Link: https://patch.msgid.link/20260226080306.98766-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 181cafbd8a01d22f3078a84f079c4a7cc0653068 Author: Jiayuan Chen Date: Thu Feb 26 16:03:02 2026 +0800 selftests/bpf: add test for xdp_bonding xmit_hash_policy compat Add a selftest to verify that changing xmit_hash_policy to vlan+srcmac is rejected when a native XDP program is loaded on a bond in 802.3ad mode. Without the fix in bond_option_xmit_hash_policy_set(), the change succeeds silently, creating an inconsistent state that triggers a kernel WARNING in dev_xdp_uninstall() when the bond is torn down. The test attaches native XDP to a bond0 (802.3ad, layer2+3), then attempts to switch xmit_hash_policy to vlan+srcmac and asserts the operation fails. It also verifies the change succeeds after XDP is detached, confirming the rejection is specific to the XDP-loaded state. Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260226080306.98766-3-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 479d589b40b836442bbdadc3fdb37f001bb67f26 Author: Jiayuan Chen Date: Thu Feb 26 16:03:01 2026 +0800 bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded bond_option_mode_set() already rejects mode changes that would make a loaded XDP program incompatible via bond_xdp_check(). However, bond_option_xmit_hash_policy_set() has no such guard. For 802.3ad and balance-xor modes, bond_xdp_check() returns false when xmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually absent due to hardware offload. This means a user can: 1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode with a compatible xmit_hash_policy (e.g. layer2+3). 2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded. This leaves bond->xdp_prog set but bond_xdp_check() now returning false for the same device. When the bond is later destroyed, dev_xdp_uninstall() calls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits the bond_xdp_check() guard and returns -EOPNOTSUPP, triggering: WARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL)) Fix this by rejecting xmit_hash_policy changes to vlan+srcmac when an XDP program is loaded on a bond in 802.3ad or balance-xor mode. commit 39a0876d595b ("net, bonding: Disallow vlan+srcmac with XDP") introduced bond_xdp_check() which returns false for 802.3ad/balance-xor modes when xmit_hash_policy is vlan+srcmac. The check was wired into bond_xdp_set() to reject XDP attachment with an incompatible policy, but the symmetric path -- preventing xmit_hash_policy from being changed to an incompatible value after XDP is already loaded -- was left unguarded in bond_option_xmit_hash_policy_set(). Note: commit 094ee6017ea0 ("bonding: check xdp prog when set bond mode") later added a similar guard to bond_option_mode_set(), but bond_option_xmit_hash_policy_set() remained unprotected. Reported-by: syzbot+5a287bcdc08104bc3132@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6995aff6.050a0220.2eeac1.014e.GAE@google.com/T/ Fixes: 39a0876d595b ("net, bonding: Disallow vlan+srcmac with XDP") Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260226080306.98766-2-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 7ae0d8f1abbbba6f98cac735145e1206927c67d9 Author: wangdicheng Date: Tue Mar 3 16:15:16 2026 +0800 ALSA: hda/senary: Ensure EAPD is enabled during init The driver sets spec->gen.own_eapd_ctl to take manual control of the EAPD (External Amplifier). However, senary_init does not turn on the EAPD, while senary_shutdown turns it off. Since the generic driver skips EAPD handling when own_eapd_ctl is set, the EAPD remains off after initialization (e.g., after resume), leaving the codec in a non-functional state. Explicitly call senary_auto_turn_eapd in senary_init to ensure the EAPD is enabled and the codec is functional. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260303081516.583438-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit 08d9a4580f71120be3c5b221af32dca00a48ceb0 Author: Matthew Wilcox Date: Fri Feb 20 14:19:59 2026 +0530 tee: shm: Remove refcounting of kernel pages Earlier TEE subsystem assumed to refcount all the memory pages to be shared with TEE implementation to be refcounted. However, the slab allocations within the kernel don't allow refcounting kernel pages. It is rather better to trust the kernel clients to not free pages while being shared with TEE implementation. Hence, remove refcounting of kernel pages from register_shm_helper() API. Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page") Reported-by: Marco Felsch Reported-by: Sven Püschel Signed-off-by: Matthew Wilcox Co-developed-by: Sumit Garg Signed-off-by: Sumit Garg Tested-by: Sven Püschel Signed-off-by: Jens Wiklander commit 75ad51825933575906394d0d5db04586b02db00a Author: Zhao Mengmeng Date: Tue Mar 3 15:23:17 2026 +0800 selftests/sched_ext: Fix peek_dsq.bpf.c compile error for clang 17 When compiling sched_ext selftests using clang 17.0.6, it raised compiler crash and build error: Error at line 68: Unsupport signed division for DAG: 0x55b2f9a60240: i64 = sdiv 0x55b2f9a609b0, Constant:i64<100>, peek_dsq.bpf.c:68:25 @[ peek_dsq.bpf.c:95:4 @[ peek_dsq.bpf.c:169:8 @[ peek _dsq.bpf.c:140:6 ] ] ]Please convert to unsigned div/mod After digging, it's not a compiler error, clang supported Signed division only when using -mcpu=v4, while we use -mcpu=v3 currently, the better way is to use unsigned div, see [1] for details. [1] https://github.com/llvm/llvm-project/issues/70433 Signed-off-by: Zhao Mengmeng Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 01a867c2e090cb440c8f27158e8650c8ddefec8e Author: Zhao Mengmeng Date: Tue Mar 3 15:23:16 2026 +0800 selftests/sched_ext: Add -fms-extensions to bpf build flags Similar to commit 835a50753579 ("selftests/bpf: Add -fms-extensions to bpf build flags") and commit 639f58a0f480 ("bpftool: Fix build warnings due to MS extensions") Fix "declaration does not declare anything" warning by using -fms-extensions and -Wno-microsoft-anon-tag flags to build bpf programs that #include "vmlinux.h" Signed-off-by: Zhao Mengmeng Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 9af832c0a76eedce169c4c6360e4e20d8a0c9ab1 Author: Zhao Mengmeng Date: Tue Mar 3 15:23:15 2026 +0800 tools/sched_ext: Add -fms-extensions to bpf build flags Similar to commit 835a50753579 ("selftests/bpf: Add -fms-extensions to bpf build flags") and commit 639f58a0f480 ("bpftool: Fix build warnings due to MS extensions") The kernel is now built with -fms-extensions, therefore generated vmlinux.h contains types like: struct aes_key { struct aes_enckey; union aes_invkey_arch inv_k; }; struct ns_common { ... union { struct ns_tree; struct callback_head ns_rcu; }; }; Which raise warning like below when building scx scheduler: tools/sched_ext/build/include/vmlinux.h:50533:3: warning: declaration does not declare anything [-Wmissing-declarations] 50533 | struct ns_tree; | ^ Fix it by using -fms-extensions and -Wno-microsoft-anon-tag flags to build bpf programs that #include "vmlinux.h" Signed-off-by: Zhao Mengmeng Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 3f27958b729a2337336a6b50e0d9aee5fbbce816 Author: zhidao su Date: Tue Mar 3 14:09:58 2026 +0800 sched_ext: Use READ_ONCE() for plain reads of scx_watchdog_timeout scx_watchdog_timeout is written with WRITE_ONCE() in scx_enable(): WRITE_ONCE(scx_watchdog_timeout, timeout); However, three read-side accesses use plain reads without the matching READ_ONCE(): /* check_rq_for_timeouts() - L2824 */ last_runnable + scx_watchdog_timeout /* scx_watchdog_workfn() - L2852 */ scx_watchdog_timeout / 2 /* scx_enable() - L5179 */ scx_watchdog_timeout / 2 The KCSAN documentation requires that if one accessor uses WRITE_ONCE() to annotate lock-free access, all other accesses must also use the appropriate accessor. Plain reads alongside WRITE_ONCE() leave the pair incomplete and can trigger KCSAN warnings. Note that scx_tick() already uses the correct READ_ONCE() annotation: last_check + READ_ONCE(scx_watchdog_timeout) Fix the three remaining plain reads to match, making all accesses to scx_watchdog_timeout consistently annotated and KCSAN-clean. Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 398c0c8bbc8f5a9d2f43863275a427a9d3720b6f Author: Frank Li Date: Mon Mar 2 16:59:55 2026 -0500 dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning Change additionalProperties to unevaluatedProperties because it refs to /schemas/input/matrix-keymap.yaml. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-victgo.dtb: keypad@70 (holtek,ht16k33): 'keypad,num-columns', 'keypad,num-rows' do not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/auxdisplay/holtek,ht16k33.yaml# Fixes: f12b457c6b25c ("dt-bindings: auxdisplay: ht16k33: Convert to json-schema") Acked-by: Rob Herring (Arm) Signed-off-by: Frank Li Signed-off-by: Andy Shevchenko commit a116bac87118903925108e57781bbfc7a7eea27b Author: Isaac J. Manjarres Date: Mon Mar 2 16:23:09 2026 -0800 dma-buf: Include ioctl.h in UAPI header include/uapi/linux/dma-buf.h uses several macros from ioctl.h to define its ioctl commands. However, it does not include ioctl.h itself. So, if userspace source code tries to include the dma-buf.h file without including ioctl.h, it can result in build failures. Therefore, include ioctl.h in the dma-buf UAPI header. Signed-off-by: Isaac J. Manjarres Reviewed-by: T.J. Mercier Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260303002309.1401849-1-isaacmanjarres@google.com commit 8fb54c7307f6add04246d2f7845e42ecd41950fe Author: MeiChia Chiu Date: Tue Mar 3 13:47:25 2026 +0800 wifi: mac80211: fix missing ieee80211_eml_params member initialization The missing initialization causes driver to misinterpret the EML control bitmap, resulting in incorrect link bitmap handling. Fixes: 0d95280a2d54e ("wifi: mac80211: Add eMLSR/eMLMR action frame parsing support") Signed-off-by: MeiChia Chiu Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260303054725.471548-1-MeiChia.Chiu@mediatek.com Signed-off-by: Johannes Berg commit 83307aebe6a1a4fddf5dec6071716ce251da9cc9 Author: wangdicheng Date: Tue Mar 3 13:42:42 2026 +0800 ALSA: hda/senary: Use codec->core.afg for GPIO access Replace the hardcoded GPIO node ID (0x01) with codec->core.afg. This follows the standard HDA driver practice and makes the driver more robust against different hardware configurations. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20260303054242.318062-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit 93992667d0ab695ac30ceec91a516fd4bf725d75 Author: Rong Zhang Date: Tue Mar 3 01:32:59 2026 +0800 ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_SKIP_IFACE_SETUP QUIRK_FLAG_SKIP_IFACE_SETUP was introduced into usb-audio before without appropriate documentation, so add it. Fixes: 38c322068a26 ("ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP") Cc: stable@vger.kernel.org Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260302173300.322673-1-i@rong.moe Signed-off-by: Takashi Iwai commit a300000233a9ff842e2fb450fb9a79f7827a586d Author: Eric Biggers Date: Sat Feb 21 12:45:25 2026 -0800 fsverity: add dependency on 64K or smaller pages Currently, all filesystems that support fsverity (ext4, f2fs, and btrfs) cache the Merkle tree in the pagecache at a 64K aligned offset after the end of the file data. This offset needs to be a multiple of the page size, which is guaranteed only when the page size is 64K or smaller. 64K was chosen to be the "largest reasonable page size". But it isn't the largest *possible* page size: the hexagon and powerpc ports of Linux support 256K pages, though that configuration is rarely used. For now, just disable support for FS_VERITY in these odd configurations to ensure it isn't used in cases where it would have incorrect behavior. Fixes: 671e67b47e9f ("fs-verity: add Kconfig and the helper functions for hashing") Reported-by: Christoph Hellwig Closes: https://lore.kernel.org/r/20260119063349.GA643@lst.de Reviewed-by: Theodore Ts'o Link: https://lore.kernel.org/r/20260221204525.30426-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1939d9816dbfc057508267f0c5214f9478fbd6d1 Author: Arthur Kiyanovski Date: Sun Mar 1 19:16:51 2026 +0000 MAINTAINERS: ena: update AMAZON ETHERNET maintainers Remove Shay Agroskin and Saeed Bishara. Promote David Arinzon to maintainer. Signed-off-by: Arthur Kiyanovski Link: https://patch.msgid.link/20260301191652.5916-1-akiyano@amazon.com Signed-off-by: Jakub Kicinski commit 3f10543c5bdd11568d1a54f5b1d955f5652e3095 Author: Simon Baatz Date: Sun Mar 1 09:41:33 2026 +0100 selftests/net: packetdrill: restore tcp_rcv_big_endseq.pkt Commit 1cc93c48b5d7 ("selftests/net: packetdrill: remove tests for tcp_rcv_*big") removed the test for the reverted commit 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks") but also the one for commit 9ca48d616ed7 ("tcp: do not accept packets beyond window"). Restore the test with the necessary adaptation: expect a delayed ACK instead of an immediate one, since tcp_can_ingest() does not fail anymore for the last data packet. Signed-off-by: Simon Baatz Link: https://patch.msgid.link/20260301-tcp_rcv_big_endseq-v1-1-86ab7415ab58@gmail.com Signed-off-by: Jakub Kicinski commit 7cbe98f7bef965241a5908d50d557008cf998aee Author: Mieczyslaw Nalewaj Date: Sun Mar 1 18:13:14 2026 -0300 net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value Function rtl8365mb_phy_ocp_write() always returns 0, even when an error occurs during register access. This patch fixes the return value to propagate the actual error code from regmap operations. Link: https://lore.kernel.org/netdev/a2dfde3c-d46f-434b-9d16-1e251e449068@yahoo.com/ Fixes: 2796728460b8 ("net: dsa: realtek: rtl8365mb: serialize indirect PHY register access") Signed-off-by: Mieczyslaw Nalewaj Reviewed-by: Andrew Lunn Signed-off-by: Luiz Angelo Daros de Luca Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260301-realtek_namiltd_fix1-v1-1-43a6bb707f9c@gmail.com Signed-off-by: Jakub Kicinski commit f33ac74f9cc1cdadd3921246832b2084a5dec53a Author: Geert Uytterhoeven Date: Thu Feb 26 15:46:09 2026 +0100 crypto: Clean up help text for CRYPTO_CRC32 F2fs and RoCEv2 stopped using this CRC32 implementation in commits 3ca4bec40ee211cd ("f2fs: switch to using the crc32 library") and ccca5e8aa1457231 ("RDMA/rxe: switch to using the crc32 library"). Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/0f76ebf05bb1b6ca50db97988f9ac20944534b4c.1772116160.git.geert+renesas@glider.be Signed-off-by: Eric Biggers commit 0ef6eb10f2e0fe38bb795b2ecdb01b8c9b536ea8 Author: Geert Uytterhoeven Date: Thu Feb 26 15:46:08 2026 +0100 crypto: Clean up help text for CRYPTO_CRC32C Ext4, jbd2, iSCSI, NVMeoF/TCP, and Btrfs stopped using this CRC32c implementation in commits f2b4fa19647e18a2 ("ext4: switch to using the crc32c library"), dd348f054b24a3f5 ("jbd2: switch to using the crc32c library"), 92186c1455a2d356 ("scsi: iscsi_tcp: Switch to using the crc32c library"), 427fff9aff295e2c ("nvme-tcp: use crc32c() and skb_copy_and_crc32c_datagram_iter()"), and fe11ac191ce0ad91 ("btrfs: switch to library APIs for checksums"). Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/f567add7840bc612382237b3e76f3a8bdbd671e6.1772116160.git.geert+renesas@glider.be Signed-off-by: Eric Biggers commit a9ad29b7ad6c5e36ffa543ceb3c4439e63186339 Author: Geert Uytterhoeven Date: Thu Feb 26 15:46:07 2026 +0100 crypto: Clean up help text for CRYPTO_XXHASH Btrfs stopped using this xxHash implementation in commit fe11ac191ce0ad91 ("btrfs: switch to library APIs for checksums"). Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/3b632975201074ccaa129f4901a66aff87b19742.1772116160.git.geert+renesas@glider.be Signed-off-by: Eric Biggers commit a70d9d655fd0549dd7cd9de437eb3fbe2e78c8ab Author: Geert Uytterhoeven Date: Thu Feb 26 15:46:06 2026 +0100 crypto: Clean up help text for CRYPTO_SHA256 NFS, Ceph, SMB, and Btrfs stopped using this SHA-256 implementation in commits c2c90a8b2620626c ("nfsd: use SHA-256 library API instead of crypto_shash API"), 27c0a7b05d13a0dc ("libceph: Use HMAC-SHA256 library instead of crypto_shash"), 924067ef183bd17f ("ksmbd: Use HMAC-SHA256 library for message signing and key generation"), and fe11ac191ce0ad91 ("btrfs: switch to library APIs for checksums"). Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/bf8e1c229b36fc5349e29701e962d0dfd4fd21b6.1772116160.git.geert+renesas@glider.be Signed-off-by: Eric Biggers commit 5d75c7bcc40a90f77f315e1c91dfb2f1b189a435 Author: Geert Uytterhoeven Date: Thu Feb 26 15:46:05 2026 +0100 crypto: Clean up help text for CRYPTO_BLAKE2B Btrfs stopped using this BLAKE2b implementation in commit fe11ac191ce0ad91 ("btrfs: switch to library APIs for checksums"). Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/98b983d2f2bddf0e5e8e1c970446c3c64527ef89.1772116160.git.geert+renesas@glider.be Signed-off-by: Eric Biggers commit 20d6f07004d639967dcb00994d56ce6d16118e9e Author: Eric Biggers Date: Sat Feb 28 20:01:40 2026 -0800 lib/crypto: tests: Add a .kunitconfig file Add a .kunitconfig file to the lib/crypto/ directory so that the crypto library tests can be run more easily using kunit.py. Example with UML: tools/testing/kunit/kunit.py run --kunitconfig=lib/crypto Example with QEMU: tools/testing/kunit/kunit.py run --kunitconfig=lib/crypto --arch=arm64 --make_options LLVM=1 Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260301040140.490310-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 70c3054505bbb7c6a876761eb26407f97c36e001 Merge: a8df7892a9f42b 31ddc62c1cd92e Author: Mark Brown Date: Mon Mar 2 23:11:46 2026 +0000 ASoC: fsl_easrc: Fix control writes Merge series from Mark Brown : I noticed that neither of the put() operations for the controls defined by the fsl_easrc driver was flagging value changes properly, fix that. commit 3b46d61890632c8f8b117147b6923bff4b42ccb7 Author: Vladimir Yakovlev Date: Tue Mar 3 01:20:17 2026 +0300 spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*). Signed-off-by: Vladimir Yakovlev Link: https://patch.msgid.link/20260302222017.992228-2-vovchkir@gmail.com Signed-off-by: Mark Brown commit 30d937f63bd19bbcaafa4b892eb251f8bbbf04ef Author: Dillon Varone Date: Wed Feb 18 14:34:28 2026 -0500 drm/amd/display: Fallback to boot snapshot for dispclk [WHY & HOW] If the dentist is unavailable, fallback to reading CLKIP via the boot snapshot to get the current dispclk. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Dillon Varone Signed-off-by: Alex Hung Cc: Mario Limonciello Cc: Alex Deucher Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 2ab77600d1e55a042c02437326d3c7563e853c6c) Cc: stable@vger.kernel.org commit 389c2024cab817366e6b8345f679f41064fa94d6 Author: sguttula Date: Sat Feb 21 10:47:59 2026 +0530 drm/amdgpu: Enable DPG support for VCN5 This will set DPG flags for enabling power gating on GFX11_5_4 Signed-off-by: sguttula Reviewed-by: Pratik Vishwakarma Signed-off-by: Alex Deucher (cherry picked from commit a503c266d70d3363ba6bffb883cd6ecdb092670c) commit a4fa2355e0add57253468ef13bd08f11285f3b6e Author: Alex Hung Date: Fri Feb 27 12:30:38 2026 -0700 drm/amd/display: Enable DEGAMMA and reject COLOR_PIPELINE+DEGAMMA_LUT [WHAT] Create DEGAMMA properties even if color pipeline is enabled, and enforce the mutual exclusion in atomic check by rejecting any commit that attempts to enable both COLOR_PIPELINE on the plane and DEGAMMA_LUT on the CRTC simultaneously. Fixes: 18a4127e9315 ("drm/amd/display: Disable CRTC degamma when color pipeline is enabled") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4963 Reviewed-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 196a6aa727f1f15eb54dda5e60a41543ea9397ee) commit c28b3ec3ca034fd1abc832fef46ce36eb13f8fad Author: Alex Hung Date: Fri Feb 27 12:26:04 2026 -0700 drm/amd/display: Use mpc.preblend flag to indicate 3D LUT [WHAT] New ASIC's 3D LUT is indicated by mpc.preblend. Fixes: 0de2b1afea8d ("drm/amd/display: add 3D LUT colorop") Reviewed-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 43175f6164d32cb96362d16e357689f74298145c) commit fdb12c8a24a453bdd6759979b6ef1e04ebd4beb4 Author: Nathan Chancellor Date: Fri Feb 27 22:40:48 2026 -0700 kbuild: Leave objtool binary around with 'make clean' The difference between 'make clean' and 'make mrproper' is documented in 'make help' as: clean - Remove most generated files but keep the config and enough build support to build external modules mrproper - Remove all generated files + config + various backup files After commit 68b4fe32d737 ("kbuild: Add objtool to top-level clean target"), running 'make clean' then attempting to build an external module with the resulting build directory fails with $ make ARCH=x86_64 O=build clean $ make -C build M=... MO=... ... /bin/sh: line 1: .../build/tools/objtool/objtool: No such file or directory as 'make clean' removes the objtool binary. Split the objtool clean target into mrproper and clean like Kbuild does and remove all generated artifacts with 'make clean' except for the objtool binary, which is removed with 'make mrproper'. To avoid a small race when running the objtool clean target through both objtool_mrproper and objtool_clean when running 'make mrproper', modify objtool's clean up find command to avoid using find's '-delete' command by piping the files into 'xargs rm -f' like the rest of Kbuild does. Cc: stable@vger.kernel.org Fixes: 68b4fe32d737 ("kbuild: Add objtool to top-level clean target") Reported-by: Michal Suchanek Closes: https://lore.kernel.org/20260225112633.6123-1-msuchanek@suse.de/ Reported-by: Rainer Fiebig Closes: https://lore.kernel.org/62d12399-76e5-3d40-126a-7490b4795b17@mailbox.org/ Acked-by: Josh Poimboeuf Acked-by: Peter Zijlstra (Intel) Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Link: https://patch.msgid.link/20260227-avoid-objtool-binary-removal-clean-v1-1-122f3e55eae9@kernel.org Signed-off-by: Nathan Chancellor commit 800ca7b88a0c0eba6fa721e043eb3ed5b10ecc4f Author: Saket Dumbre Date: Sat Feb 21 12:36:39 2026 +0100 ACPICA: Update the _CPC definition to match ACPI 6.6 Update the _CPC definition to also support return package sub-type of a Package (with Integer and Buffer) as per ACPI Spec 6.6. Link: https://github.com/acpica/acpica/commit/17a761944cc2 Signed-off-by: Saket Dumbre Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2829238.mvXUDI8C0e@rafael.j.wysocki commit 50d4cc74b8a720a9682a9c94f7e62a5de6b2ed3a Author: David Lechner Date: Sat Feb 28 14:02:23 2026 -0600 iio: orientation: hid-sensor-rotation: fix quaternion alignment Restore the alignment of sampled_vals to 16 bytes by using IIO_DECLARE_QUATERNION(). This field contains a quaternion value which has scan_type.repeat = 4 and storagebits = 32. So the alignment must be 16 bytes to match the assumptions of iio_storage_bytes_for_si() and also to not break userspace. Reported-by: Lixu Zhang Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221077 Fixes: b31a74075cb4 ("iio: orientation: hid-sensor-rotation: remove unnecessary alignment") Tested-by: Lixu Zhang Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 56bd57e7b161f75535df91b229b0b2c64c6e5581 Author: David Lechner Date: Sat Feb 28 14:02:22 2026 -0600 iio: add IIO_DECLARE_QUATERNION() macro Add a new IIO_DECLARE_QUATERNION() macro that is used to declare the field in an IIO buffer struct that contains a quaternion vector. Quaternions are currently the only IIO data type that uses the .repeat feature of struct iio_scan_type. This has an implicit rule that the element in the buffer must be aligned to the entire size of the repeated element. This macro will make that requirement explicit. Since this is the only user, we just call the macro IIO_DECLARE_QUATERNION() instead of something more generic. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 36f6d4db3c5cb0f58fb02b1f54f9e86522d2f918 Author: Felix Gu Date: Tue Mar 3 00:00:04 2026 +0800 iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD As there is no threaded handler, replace devm_request_threaded_irq() with devm_request_irq(), and as the handler calls iio_trigger_poll() which may not be called from a threaded handler replace IRQF_ONESHOT with IRQF_NO_THREAD. Since commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler"), the IRQ core checks IRQF_ONESHOT flag in IRQ request and gives a warning if there is no threaded handler. Fixes: a9306887eba4 ("iio: adc: ti-ads1119: Add driver") Signed-off-by: Felix Gu Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit f8211e95dfda702ba81ea2e3e7a8c6c967f385fa Author: Sean Christopherson Date: Mon Mar 2 09:02:39 2026 -0800 Documentation: KVM: Formalizing taking vcpu->mutex *outside* of kvm->slots_lock Explicitly document the ordering of vcpu->mutex being taken *outside* of kvm->slots_lock. While somewhat unintuitive since vCPUs conceptually have narrower scope than VMs, the scope of the owning object (vCPU versus VM) doesn't automatically carry over to the lock. In this case, vcpu->mutex has far broader scope than kvm->slots_lock. As Paolo put it, it's a "don't worry about multiple ioctls at the same time" mutex that's intended to be taken at the outer edges of KVM. More importantly, arm64 and x86 have gained flows that take kvm->slots_lock inside of vcpu->mutex. x86's kvm_inhibit_apic_access_page() is particularly nasty, as slots_lock is taken quite deep within KVM_RUN, i.e. simply swapping the ordering isn't an option. Commit to the vcpu->mutex => kvm->slots_lock ordering, as vcpu->mutex really is intended to be a "top-level" lock, whereas kvm->slots_lock is "just" a helper lock. Opportunistically document that vcpu->mutex is also taken outside of slots_arch_lock, e.g. when allocating shadow roots on x86 (which is the entire reason slots_arch_lock exists, as shadow roots must be allocated while holding kvm->srcu) kvm_mmu_new_pgd() | -> kvm_mmu_reload() | -> kvm_mmu_load() | -> mmu_alloc_shadow_roots() | -> mmu_first_shadow_root_alloc() but also when manipulating memslots in vCPU context, e.g. when inhibiting the APIC-access page via the aforementioned kvm_inhibit_apic_access_page() kvm_inhibit_apic_access_page() | -> __x86_set_memory_region() | -> kvm_set_internal_memslot() | -> kvm_set_memory_region() | -> kvm_set_memslot() Cc: Oliver Upton Cc: Marc Zyngier Link: https://patch.msgid.link/20260302170239.596810-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 3ebc98c1ae7efda949a015990280a097f4a5453a Author: Jiri Olsa Date: Mon Mar 2 09:16:22 2026 +0100 ftrace: Add missing ftrace_lock to update_ftrace_direct_add/del Ihor and Kumar reported splat from ftrace_get_addr_curr [1], which happened because of the missing ftrace_lock in update_ftrace_direct_add/del functions allowing concurrent access to ftrace internals. The ftrace_update_ops function must be guarded by ftrace_lock, adding that. Fixes: 05dc5e9c1fe1 ("ftrace: Add update_ftrace_direct_add function") Fixes: 8d2c1233f371 ("ftrace: Add update_ftrace_direct_del function") Reported-by: Ihor Solodrai Reported-by: Kumar Kartikeya Dwivedi Closes: https://lore.kernel.org/bpf/1b58ffb2-92ae-433a-ba46-95294d6edea2@linux.dev/ Tested-by: Ihor Solodrai Signed-off-by: Jiri Olsa Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20260302081622.165713-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 6270ee26e1edd862ea17e3eba148ca8fb2c99dc9 Author: Lizhi Hou Date: Thu Feb 26 13:38:57 2026 -0800 accel/amdxdna: Fix NULL pointer dereference of mgmt_chann mgmt_chann may be set to NULL if the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL pointer dereference in aie2_hw_stop(). Fix this by introducing a dedicated helper to destroy mgmt_chann and by adding proper NULL checks before accessing it. Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260226213857.3068474-1-lizhi.hou@amd.com commit af4e9ef3d78420feb8fe58cd9a1ab80c501b3c08 Author: David Laight Date: Mon Mar 2 13:27:51 2026 +0000 uaccess: Fix scoped_user_read_access() for 'pointer to const' If a 'const struct foo __user *ptr' is used for the address passed to scoped_user_read_access() then you get a warning/error uaccess.h:691:1: error: initialization discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] for the void __user *_tmpptr = __scoped_user_access_begin(mode, uptr, size, elbl) assignment. Fix by using 'auto' for both _tmpptr and the redeclaration of uptr. Replace the CLASS() with explicit __cleanup() functions on uptr. Fixes: e497310b4ffb ("uaccess: Provide scoped user access regions") Signed-off-by: David Laight Reviewed-and-tested-by: Christophe Leroy (CS GROUP) Signed-off-by: Linus Torvalds commit 494eaf4651975127d34d5ae6555c72dedba092c9 Author: zhidao su Date: Mon Mar 2 17:14:40 2026 +0800 sched_ext: Replace naked scx_root dereferences in kobject callbacks scx_attr_ops_show() and scx_uevent() access scx_root->ops.name directly. This is problematic for two reasons: 1. The file-level comment explicitly identifies naked scx_root dereferences as a temporary measure that needs to be replaced with proper per-instance access. 2. scx_attr_events_show(), the neighboring sysfs show function in the same group, already uses the correct pattern: struct scx_sched *sch = container_of(kobj, struct scx_sched, kobj); Having inconsistent access patterns in the same sysfs/uevent group is error-prone. The kobject embedded in struct scx_sched is initialized as: kobject_init_and_add(&sch->kobj, &scx_ktype, NULL, "root"); so container_of(kobj, struct scx_sched, kobj) correctly retrieves the owning scx_sched instance in both callbacks. Replace the naked scx_root dereferences with container_of()-based access, consistent with scx_attr_events_show() and in preparation for proper multi-instance scx_sched support. Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 9adfcef334bf9c6ef68eaecfca5f45d18614efe0 Author: zhidao su Date: Mon Mar 2 17:14:39 2026 +0800 sched_ext: Use READ_ONCE() for the read side of dsq->nr update scx_bpf_dsq_nr_queued() reads dsq->nr via READ_ONCE() without holding any lock, making dsq->nr a lock-free concurrently accessed variable. However, dsq_mod_nr(), the sole writer of dsq->nr, only uses WRITE_ONCE() on the write side without the matching READ_ONCE() on the read side: WRITE_ONCE(dsq->nr, dsq->nr + delta); ^^^^^^^ plain read -- KCSAN data race The KCSAN documentation requires that if one accessor uses READ_ONCE() or WRITE_ONCE() on a variable to annotate lock-free access, all other accesses must also use the appropriate accessor. A plain read on the right-hand side of WRITE_ONCE() leaves the pair incomplete and will trigger KCSAN warnings. Fix by using READ_ONCE() for the read side of the update: WRITE_ONCE(dsq->nr, READ_ONCE(dsq->nr) + delta); This is consistent with scx_bpf_dsq_nr_queued() and makes the concurrent access annotation complete and KCSAN-clean. Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit b11b9b6751b2cd74960dccd91667c5117fce743c Author: Arnd Bergmann Date: Mon Feb 2 10:48:53 2026 +0100 kunit: reduce stack usage in kunit_run_tests() Some of the recent changes to the kunit framework caused the stack usage for kunit_run_tests() to grow higher than most other kernel functions, which triggers a warning when CONFIG_FRAME_WARN is set to a relatively low value: lib/kunit/test.c: In function 'kunit_run_tests': lib/kunit/test.c:801:1: error: the frame size of 1312 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Split out the inner loop into a separate function to ensure that each function remains under the limit, and pass the kunit_result_stats structures by reference to avoid excessive copies. Fixed checkpatch warnings at commit time: Shuah Khan Cc: Carlos Llamas Signed-off-by: Arnd Bergmann Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 1b37ac211a22d4c65aad1ae2da07f078197e7394 Merge: 11439c4635edd6 364410170ab33f Author: Linus Torvalds Date: Mon Mar 2 09:05:20 2026 -0800 Merge tag 'nfsd-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Restore previous nfsd thread count reporting behavior - Fix credential reference leaks in the NFSD netlink admin protocol * tag 'nfsd-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: report the requested maximum number of threads instead of number running nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit(). nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). commit 40804c4974b8df2adab72f6475d343eaff72b7f6 Author: Shuvam Pandey Date: Thu Feb 26 21:14:10 2026 +0545 kunit: tool: copy caller args in run_kernel to prevent mutation run_kernel() appended KUnit flags directly to the caller-provided args list. When exec_tests() calls run_kernel() repeatedly (e.g. with --run_isolated), each call mutated the same list, causing later runs to inherit stale filter_glob values and duplicate kunit.enable flags. Fix this by copying args at the start of run_kernel(). Add a regression test that calls run_kernel() twice with the same list and verifies the original remains unchanged. Fixes: ff9e09a3762f ("kunit: tool: support running each suite/test separately") Signed-off-by: Shuvam Pandey Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 7dd34dfc8dfa92a7244242098110388367996ac3 Author: Alexandre Courbot Date: Tue Feb 24 19:37:56 2026 +0900 rust: kunit: fix warning when !CONFIG_PRINTK If `CONFIG_PRINTK` is not set, then the following warnings are issued during build: warning: unused variable: `args` --> ../rust/kernel/kunit.rs:16:12 | 16 | pub fn err(args: fmt::Arguments<'_>) { | ^^^^ help: if this is intentional, prefix it with an underscore: `_args` | = note: `#[warn(unused_variables)]` (part of `#[warn(unused)]`) on by default warning: unused variable: `args` --> ../rust/kernel/kunit.rs:32:13 | 32 | pub fn info(args: fmt::Arguments<'_>) { | ^^^^ help: if this is intentional, prefix it with an underscore: `_args` Fix this by adding a no-op assignment using `args` when `CONFIG_PRINTK` is not set. Fixes: a66d733da801 ("rust: support running Rust documentation tests as KUnit ones") Signed-off-by: Alexandre Courbot Reviewed-by: Alice Ryhl Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 03464a48cc8636b6de2febbc5ef39093a9a15e82 Author: David Gow Date: Tue Feb 10 21:10:26 2026 +0800 MAINTAINERS: Update email address for David Gow Update my email address for KUnit related things in MAINTAINERS (and add an entry to .mailmap so nothing gets lost). Signed-off-by: David Gow Signed-off-by: Shuah Khan commit b570f37a2ce480be26c665345c5514686a8a0274 Author: Thomas Hellström Date: Tue Feb 10 12:56:53 2026 +0100 mm: Fix a hmm_range_fault() livelock / starvation problem If hmm_range_fault() fails a folio_trylock() in do_swap_page, trying to acquire the lock of a device-private folio for migration, to ram, the function will spin until it succeeds grabbing the lock. However, if the process holding the lock is depending on a work item to be completed, which is scheduled on the same CPU as the spinning hmm_range_fault(), that work item might be starved and we end up in a livelock / starvation situation which is never resolved. This can happen, for example if the process holding the device-private folio lock is stuck in migrate_device_unmap()->lru_add_drain_all() sinc lru_add_drain_all() requires a short work-item to be run on all online cpus to complete. A prerequisite for this to happen is: a) Both zone device and system memory folios are considered in migrate_device_unmap(), so that there is a reason to call lru_add_drain_all() for a system memory folio while a folio lock is held on a zone device folio. b) The zone device folio has an initial mapcount > 1 which causes at least one migration PTE entry insertion to be deferred to try_to_migrate(), which can happen after the call to lru_add_drain_all(). c) No or voluntary only preemption. This all seems pretty unlikely to happen, but indeed is hit by the "xe_exec_system_allocator" igt test. Resolve this by waiting for the folio to be unlocked if the folio_trylock() fails in do_swap_page(). Rename migration_entry_wait_on_locked() to softleaf_entry_wait_unlock() and update its documentation to indicate the new use-case. Future code improvements might consider moving the lru_add_drain_all() call in migrate_device_unmap() to be called *after* all pages have migration entries inserted. That would eliminate also b) above. v2: - Instead of a cond_resched() in hmm_range_fault(), eliminate the problem by waiting for the folio to be unlocked in do_swap_page() (Alistair Popple, Andrew Morton) v3: - Add a stub migration_entry_wait_on_locked() for the !CONFIG_MIGRATION case. (Kernel Test Robot) v4: - Rename migrate_entry_wait_on_locked() to softleaf_entry_wait_on_locked() and update docs (Alistair Popple) v5: - Add a WARN_ON_ONCE() for the !CONFIG_MIGRATION version of softleaf_entry_wait_on_locked(). - Modify wording around function names in the commit message (Andrew Morton) Suggested-by: Alistair Popple Fixes: 1afaeb8293c9 ("mm/migrate: Trylock device page in do_swap_page") Cc: Ralph Campbell Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Andrew Morton Cc: Matthew Brost Cc: John Hubbard Cc: Alistair Popple Cc: linux-mm@kvack.org Cc: Signed-off-by: Thomas Hellström Cc: # v6.15+ Reviewed-by: John Hubbard #v3 Reviewed-by: Alistair Popple Link: https://patch.msgid.link/20260210115653.92413-1-thomas.hellstrom@linux.intel.com (cherry picked from commit a69d1ab971a624c6f112cea61536569d579c3215) Signed-off-by: Rodrigo Vivi commit 539d1b47e935e8384977dd7e5cec370c08b7a644 Author: Nilay Shroff Date: Sun Mar 1 18:29:43 2026 +0530 block: break pcpu_alloc_mutex dependency on freeze_lock While nr_hw_update allocates tagset tags it acquires ->pcpu_alloc_mutex after ->freeze_lock is acquired or queue is frozen. This potentially creates a circular dependency involving ->fs_reclaim if reclaim is triggered simultaneously in a code path which first acquires ->pcpu_ alloc_mutex. As the queue is already frozen while nr_hw_queue update allocates tagsets, the reclaim can't forward progress and thus it could cause a potential deadlock as reported in lockdep splat[1]. Fix this by pre-allocating tagset tags before we freeze queue during nr_hw_queue update. Later the allocated tagset tags could be safely installed and used after queue is frozen. Reported-by: Yi Zhang Closes: https://lore.kernel.org/all/CAHj4cs8F=OV9s3La2kEQ34YndgfZP-B5PHS4Z8_b9euKG6J4mw@mail.gmail.com/ [1] Signed-off-by: Nilay Shroff Reviewed-by: Ming Lei Tested-by: Yi Zhang Reviewed-by: Yu Kuai [axboe: fix brace style issue] Signed-off-by: Jens Axboe commit c36e28becd0586ac98318fd335e5e91d19cd2623 Author: Pavel Begunkov Date: Mon Mar 2 14:32:04 2026 +0000 io_uring/net: reject SEND_VECTORIZED when unsupported IORING_SEND_VECTORIZED with registered buffers is not implemented but could be. Don't silently ignore the flag in this case but reject it with an error. It only affects sendzc as normal sends don't support registered buffers. Fixes: 6f02527729bd3 ("io_uring/net: Allow to do vectorized send") Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit da46b5dfef48658d03347cda21532bcdbb521e67 Author: Chaitanya Kulkarni Date: Sun Mar 1 16:22:07 2026 -0800 blktrace: fix __this_cpu_read/write in preemptible context tracing_record_cmdline() internally uses __this_cpu_read() and __this_cpu_write() on the per-CPU variable trace_cmdline_save, and trace_save_cmdline() explicitly asserts preemption is disabled via lockdep_assert_preemption_disabled(). These operations are only safe when preemption is off, as they were designed to be called from the scheduler context (probe_wakeup_sched_switch() / probe_wakeup()). __blk_add_trace() was calling tracing_record_cmdline(current) early in the blk_tracer path, before ring buffer reservation, from process context where preemption is fully enabled. This triggers the following using blktests/blktrace/002: blktrace/002 (blktrace ftrace corruption with sysfs trace) [failed] runtime 0.367s ... 0.437s something found in dmesg: [ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33 [ 81.239580] null_blk: disk nullb1 created [ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516 [ 81.362842] caller is tracing_record_cmdline+0x10/0x40 [ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full) [ 81.362877] Tainted: [N]=TEST [ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 81.362881] Call Trace: [ 81.362884] [ 81.362886] dump_stack_lvl+0x8d/0xb0 ... (See '/mnt/sda/blktests/results/nodev/blktrace/002.dmesg' for the entire message) [ 81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33 [ 81.239580] null_blk: disk nullb1 created [ 81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516 [ 81.362842] caller is tracing_record_cmdline+0x10/0x40 [ 81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G N 7.0.0-rc1lblk+ #84 PREEMPT(full) [ 81.362877] Tainted: [N]=TEST [ 81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 81.362881] Call Trace: [ 81.362884] [ 81.362886] dump_stack_lvl+0x8d/0xb0 [ 81.362895] check_preemption_disabled+0xce/0xe0 [ 81.362902] tracing_record_cmdline+0x10/0x40 [ 81.362923] __blk_add_trace+0x307/0x5d0 [ 81.362934] ? lock_acquire+0xe0/0x300 [ 81.362940] ? iov_iter_extract_pages+0x101/0xa30 [ 81.362959] blk_add_trace_bio+0x106/0x1e0 [ 81.362968] submit_bio_noacct_nocheck+0x24b/0x3a0 [ 81.362979] ? lockdep_init_map_type+0x58/0x260 [ 81.362988] submit_bio_wait+0x56/0x90 [ 81.363009] __blkdev_direct_IO_simple+0x16c/0x250 [ 81.363026] ? __pfx_submit_bio_wait_endio+0x10/0x10 [ 81.363038] ? rcu_read_lock_any_held+0x73/0xa0 [ 81.363051] blkdev_read_iter+0xc1/0x140 [ 81.363059] vfs_read+0x20b/0x330 [ 81.363083] ksys_read+0x67/0xe0 [ 81.363090] do_syscall_64+0xbf/0xf00 [ 81.363102] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 81.363106] RIP: 0033:0x7f281906029d [ 81.363111] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 63 0a 00 e8 59 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 33 0e 00 00 74 17 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec [ 81.363113] RSP: 002b:00007ffca127dd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 81.363120] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f281906029d [ 81.363122] RDX: 0000000000001000 RSI: 0000559f8bfae000 RDI: 0000000000000000 [ 81.363123] RBP: 0000000000001000 R08: 0000002863a10a81 R09: 00007f281915f000 [ 81.363124] R10: 00007f2818f77b60 R11: 0000000000000246 R12: 0000559f8bfae000 [ 81.363126] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a [ 81.363142] The same BUG fires from blk_add_trace_plug(), blk_add_trace_unplug(), and blk_add_trace_rq() paths as well. The purpose of tracing_record_cmdline() is to cache the task->comm for a given PID so that the trace can later resolve it. It is only meaningful when a trace event is actually being recorded. Ring buffer reservation via ring_buffer_lock_reserve() disables preemption, and preemption remains disabled until the event is committed :- __blk_add_trace() __trace_buffer_lock_reserve() __trace_buffer_lock_reserve() ring_buffer_lock_reserve() preempt_disable_notrace(); <--- With this fix blktests for blktrace pass: blktests (master) # ./check blktrace blktrace/001 (blktrace zone management command tracing) [passed] runtime 3.650s ... 3.647s blktrace/002 (blktrace ftrace corruption with sysfs trace) [passed] runtime 0.411s ... 0.384s Fixes: 7ffbd48d5cab ("tracing: Cache comms only after an event occurred") Reported-by: Shinichiro Kawasaki Suggested-by: Steven Rostedt Signed-off-by: Chaitanya Kulkarni Reviewed-by: Steven Rostedt (Google) Signed-off-by: Jens Axboe commit 99f9b5343cae80eb0dfe050baf6c86d722b3ba2e Author: Tomasz Lis Date: Thu Feb 26 22:26:58 2026 +0100 drm/xe/queue: Call fini on exec queue creation fail Every call to queue init should have a corresponding fini call. Skipping this would mean skipping removal of the queue from GuC list (which is part of guc_id allocation). A damaged queue stored in exec_queue_lookup list would lead to invalid memory reference, sooner or later. Call fini to free guc_id. This must be done before any internal LRCs are freed. Since the finalization with this extra call became very similar to __xe_exec_queue_fini(), reuse that. To make this reuse possible, alter xe_lrc_put() so it can survive NULL parameters, like other similar functions. v2: Reuse _xe_exec_queue_fini(). Make xe_lrc_put() aware of NULLs. Fixes: 3c1fa4aa60b1 ("drm/xe: Move queue init before LRC creation") Signed-off-by: Tomasz Lis Reviewed-by: Matthew Brost (v1) Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260226212701.2937065-2-tomasz.lis@intel.com (cherry picked from commit 393e5fea6f7d7054abc2c3d97a4cfe8306cd6079) Signed-off-by: Rodrigo Vivi commit e377182f0266f46f02d01838e6bde67b9dac0d66 Author: Shuicheng Lin Date: Wed Feb 25 01:34:49 2026 +0000 drm/xe/configfs: Free ctx_restore_mid_bb in release ctx_restore_mid_bb memory is allocated in wa_bb_store(), but xe_config_device_release() only frees ctx_restore_post_bb. Free ctx_restore_mid_bb[0].cs as well to avoid leaking the allocation when the configfs device is removed. Fixes: b30d5de3d40c ("drm/xe/configfs: Add mid context restore bb") Signed-off-by: Shuicheng Lin Reviewed-by: Nitin Gote Link: https://patch.msgid.link/20260225013448.3547687-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper (cherry picked from commit a235e7d0098337c3f2d1e8f3610c719a589e115f) Signed-off-by: Rodrigo Vivi commit cdc8a1e11f4d5b480ec750e28010c357185b95a6 Author: Matthew Brost Date: Wed Jan 14 16:45:46 2026 -0800 drm/xe: Do not preempt fence signaling CS instructions If a batch buffer is complete, it makes little sense to preempt the fence signaling instructions in the ring, as the largest portion of the work (the batch buffer) is already done and fence signaling consists of only a few instructions. If these instructions are preempted, the GuC would need to perform a context switch just to signal the fence, which is costly and delays fence signaling. Avoid this scenario by disabling preemption immediately after the BB start instruction and re-enabling it after executing the fence signaling instructions. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Daniele Ceraolo Spurio Cc: Carlos Santa Signed-off-by: Matthew Brost Reviewed-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260115004546.58060-1-matthew.brost@intel.com (cherry picked from commit 2bcbf2dcde0c839a73af664a3c77d4e77d58a3eb) Signed-off-by: Rodrigo Vivi commit 2e3649e237237258a08d75afef96648dd2b379f7 Author: Julian Orth Date: Sun Mar 1 13:34:42 2026 +0100 drm/syncobj: Fix handle <-> fd ioctls with dirty stack Consider the following application: #include #include #include #include int main(void) { int fd = open("/dev/dri/renderD128", O_RDWR); struct drm_syncobj_create arg1; ioctl(fd, DRM_IOCTL_SYNCOBJ_CREATE, &arg1); struct drm_syncobj_handle arg2; memset(&arg2, 1, sizeof(arg2)); // simulate dirty stack arg2.handle = arg1.handle; arg2.flags = 0; arg2.fd = 0; arg2.pad = 0; // arg2.point = 0; // userspace is required to set point to 0 ioctl(fd, DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD, &arg2); } The last ioctl returns EINVAL because args->point is not 0. However, userspace developed against older kernel versions is not aware of the new point field and might therefore not initialize it. The correct check would be if (args->flags & DRM_SYNCOBJ_FD_TO_HANDLE_FLAGS_TIMELINE) return -EINVAL; However, there might already be userspace that relies on this not returning an error as long as point == 0. Therefore use the more lenient check. Fixes: c2d3a7300695 ("drm/syncobj: Extend EXPORT_SYNC_FILE for timeline syncobjs") Signed-off-by: Julian Orth Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260301-point-v1-1-21fc5fd98614@gmail.com commit e176ad7b57a1a15ece213251b7f3103bd929e26c Author: Michael Walle Date: Mon Mar 2 13:24:52 2026 +0100 dt-bindings: hwmon: sl28cpld: Drop sa67mcu compatible I was just informed that this product is discontinued (without being ever released to the market). Pull the plug and let's not waste any more maintainers time and revert commit 0f6eae86e626 ("dt-bindings: hwmon: sl28cpld: add sa67mcu compatible"). Acked-by: Conor Dooley Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20260302122540.1377444-8-mwalle@kernel.org Signed-off-by: Guenter Roeck commit 2d85ecd6fb0eb2fee0ffa040ec1ddea57b09bc38 Author: Franz Schnyder Date: Wed Feb 18 11:25:14 2026 +0100 regulator: pf9453: Respect IRQ trigger settings from firmware The datasheet specifies, that the IRQ_B pin is pulled low when any unmasked interrupt bit status is changed, and it is released high once the application processor reads the INT1 register. As it specifies a level-low behavior, it should not force a falling-edge interrupt. Remove the IRQF_TRIGGER_FALLING to not force the falling-edge interrupt and instead rely on the flag from the device tree. Fixes: 0959b6706325 ("regulator: pf9453: add PMIC PF9453 support") Cc: stable@vger.kernel.org Signed-off-by: Franz Schnyder Link: https://patch.msgid.link/20260218102518.238943-2-fra.schnyder@gmail.com Signed-off-by: Mark Brown commit a8df7892a9f42b2e2d5851f8835c734bd7fe8ad4 Author: Sheetal Date: Mon Mar 2 14:23:22 2026 +0530 ASoC: dt-bindings: tegra: Add compatible for Tegra238 sound card Tegra238 requires different PLLA and PLLA_OUT0 clock rates compared to other Tegra platforms. Add Tegra238 compatible string to the APE tegra-audio-graph-card bindings. Signed-off-by: Sheetal Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260302085323.3139571-2-sheetal@nvidia.com Signed-off-by: Mark Brown commit d973b1039ccde6b241b438d53297edce4de45b5c Author: Sebastian Krzyszkowiak Date: Sat Feb 21 17:28:04 2026 +0100 wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config This triggers a WARN_ON in ieee80211_hw_conf_init and isn't the expected behavior from the driver - other drivers default to 0 too. Fixes: 0a44dfc07074 ("wifi: mac80211: simplify non-chanctx drivers") Signed-off-by: Sebastian Krzyszkowiak Link: https://patch.msgid.link/20260221-rsi-config-ret-v1-1-9a8f805e2f31@puri.sm Signed-off-by: Johannes Berg commit fb797a70108f3fda83fde6dea30bee4be7d5df8b Author: Chris Brandt Date: Thu Feb 26 20:52:16 2026 -0500 drm: renesas: rz-du: mipi_dsi: Set DSI divider Before the MIPI DSI clock source can be configured, the target divide ratio needs to be set. Signed-off-by: Chris Brandt Reviewed-by: Biju Das Tested-by: Biju Das Fixes: 5a4326f2e3b1 ("clk: renesas: rzg2l: Remove DSI clock rate restrictions") Link: https://patch.msgid.link/20260227015216.2721504-1-chris.brandt@renesas.com Signed-off-by: Biju Das commit 7e1e6d6845329adb2da75110a061557e9c26d9b7 Author: Frank Li Date: Thu Feb 12 11:30:00 2026 -0500 dt-bindings: net: can: nxp,sja1000: add reference to mc-peripheral-props.yaml Add a reference to mc-peripheral-props.yaml to allow vendor-specific properties for memory access timings. Fix below CHECK_DTBS warings: arch/arm/boot/dts/nxp/imx/imx27-phytec-phycore-rdk.dtb: can@4,0 (nxp,sja1000): Unevaluated properties are not allowed ('fsl,weim-cs-timing' was unexpected) from schema $id: http://devicetree.org/schemas/net/can/nxp,sja1000.yaml Signed-off-by: Frank Li Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260212163000.1195586-1-Frank.Li@nxp.com Signed-off-by: Marc Kleine-Budde commit 2df6162785f31f1bbb598cfc3b08e4efc88f80b6 Author: Marc Kleine-Budde Date: Thu Feb 19 13:57:34 2026 +0100 can: gs_usb: gs_can_open(): always configure bitrates before starting device So far the driver populated the struct can_priv::do_set_bittiming() and struct can_priv::fd::do_set_data_bittiming() callbacks. Before bringing up the interface, user space has to configure the bitrates. With these callbacks the configuration is directly forwarded into the CAN hardware. Then the interface can be brought up. An ifdown-ifup cycle (without changing the bit rates) doesn't re-configure the bitrates in the CAN hardware. This leads to a problem with the CANable-2.5 [1] firmware, which resets the configured bit rates during ifdown. To fix the problem remove both bit timing callbacks and always configure the bitrates in the struct net_device_ops::ndo_open() callback. [1] https://github.com/Elmue/CANable-2.5-firmware-Slcan-and-Candlelight Cc: stable@vger.kernel.org Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Link: https://patch.msgid.link/20260219-gs_usb-always-configure-bitrates-v2-1-671f8ba5b0a5@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 9073428bb204d921ae15326bb7d4558d9d269aab Author: Kim Phillips Date: Tue Feb 3 16:24:03 2026 -0600 x86/sev: Allow IBPB-on-Entry feature for SNP guests The SEV-SNP IBPB-on-Entry feature does not require a guest-side implementation. It was added in Zen5 h/w, after the first SNP Zen implementation, and thus was not accounted for when the initial set of SNP features were added to the kernel. In its abundant precaution, commit 8c29f0165405 ("x86/sev: Add SEV-SNP guest feature negotiation support") included SEV_STATUS' IBPB-on-Entry bit as a reserved bit, thereby masking guests from using the feature. Allow guests to make use of IBPB-on-Entry when supported by the hypervisor, as the bit is now architecturally defined and safe to expose. Fixes: 8c29f0165405 ("x86/sev: Add SEV-SNP guest feature negotiation support") Signed-off-by: Kim Phillips Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikunj A Dadhania Reviewed-by: Tom Lendacky Cc: stable@kernel.org Link: https://patch.msgid.link/20260203222405.4065706-2-kim.phillips@amd.com commit 4ca191cec17a997d0e3b2cd312f3a884288acc27 Author: Tom Lendacky Date: Wed Feb 4 09:01:00 2026 -0600 x86/boot/sev: Move SEV decompressor variables into the .data section As part of the work to remove the dependency on calling into the decompressor code (startup_64()) for a UEFI boot, a call to rmpadjust() was removed from sev_enable() in favor of checking the value of the snp_vmpl variable. When booting through a non-UEFI path and calling startup_64(), the call to sev_enable() is performed before the BSS section is zeroed. With the removal of the rmpadjust() call and the corresponding check of the return code, the snp_vmpl variable is checked. Since the kernel is running at VMPL0, the snp_vmpl variable will not have been set and should be the default value of 0. However, since the call occurs before the BSS is zeroed, the snp_vmpl variable may not actually be zero, which will cause the guest boot to fail. Since the decompressor relocates itself, the BSS would need to be cleared both before and after the relocation, but this would, in effect, cause all of the changes to BSS variables before relocation to be lost after relocation. Instead, move the snp_vmpl variable into the .data section so that it is initialized and the value made safe during relocation. As a pre-caution against future changes, move other SEV-related decompressor variables into the .data section, too. Fixes: 68a501d7fd82 ("x86/boot: Drop redundant RMPADJUST in SEV SVSM presence check") Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Ard Biesheuvel Reviewed-by: Changyuan Lyu Tested-by: Kevin Hui Tested-by: Changyuan Lyu Cc: stable@vger.kernel.org Link: https://patch.msgid.link/5648b7de5b0a5d0dfef3785f9582b718678c6448.1770217260.git.thomas.lendacky@amd.com commit 6dfd65a69e69a00faadd80b709aea71b71f6967a Merge: 5eaad4f768266f 952caa5da10bed Author: Marc Kleine-Budde Date: Mon Mar 2 11:04:38 2026 +0100 Merge patch series "can: usb: f81604: handle short interrupt urb messages properly" In this series Greg Kroah-Hartman takes the recent fixes on the gs_usb driver and applies similar fixes to the f81604 driver. Link: https://patch.msgid.link/2026022331-opal-evaluator-a928@gregkh Signed-off-by: Marc Kleine-Budde commit 952caa5da10bed22be09612433964f6877ba0dde Author: Greg Kroah-Hartman Date: Mon Feb 23 13:10:32 2026 +0100 can: usb: f81604: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also. Cc: Ji-Ze Hong (Peter Hong) Cc: Marc Kleine-Budde Cc: Vincent Mailhol Cc: stable@kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026022334-starlight-scaling-2cea@gregkh Fixes: 88da17436973 ("can: usb: f81604: add Fintek F81604 support") Signed-off-by: Marc Kleine-Budde commit 51f94780720fa90c424f67e3e9784cb8ef8190e5 Author: Greg Kroah-Hartman Date: Mon Feb 23 13:10:31 2026 +0100 can: usb: f81604: handle bulk write errors properly If a write urb fails then more needs to be done other than just logging the message, otherwise the transmission could be stalled. Properly increment the error counters and wake up the queues so that data will continue to flow. Cc: Ji-Ze Hong (Peter Hong) Cc: Marc Kleine-Budde Cc: Vincent Mailhol Cc: stable@kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026022334-slackness-dynamic-9195@gregkh Fixes: 88da17436973 ("can: usb: f81604: add Fintek F81604 support") Signed-off-by: Marc Kleine-Budde commit 7299b1b39a255f6092ce4ec0b65f66e9d6a357af Author: Greg Kroah-Hartman Date: Mon Feb 23 13:10:30 2026 +0100 can: usb: f81604: handle short interrupt urb messages properly If an interrupt urb is received that is not the correct length, properly detect it and don't attempt to treat the data as valid. Cc: Ji-Ze Hong (Peter Hong) Cc: Marc Kleine-Budde Cc: Vincent Mailhol Cc: stable@kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026022331-opal-evaluator-a928@gregkh Fixes: 88da17436973 ("can: usb: f81604: add Fintek F81604 support") Signed-off-by: Marc Kleine-Budde commit 5eaad4f768266f1f17e01232ffe2ef009f8129b7 Author: Greg Kroah-Hartman Date: Mon Feb 23 17:39:20 2026 +0100 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also. Cc: Vincent Mailhol Cc: Marc Kleine-Budde Cc: stable@kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Reviewed-by: Vincent Mailhol Tested-by: Vincent Mailhol Link: https://patch.msgid.link/2026022320-poser-stiffly-9d84@gregkh Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Signed-off-by: Marc Kleine-Budde commit 1e446fd0582ad8be9f6dafb115fc2e7245f9bea7 Author: Greg Kroah-Hartman Date: Mon Feb 23 17:30:20 2026 +0100 can: ucan: Fix infinite loop from zero-length messages If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for forever in ucan_read_bulk_callback(), hanging the system. If the length is 0, just skip the message and go on to the next one. This has been fixed in the kvaser_usb driver in the past in commit 0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in command parsers"), so there must be some broken devices out there like this somewhere. Cc: Marc Kleine-Budde Cc: Vincent Mailhol Cc: stable@kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026022319-huff-absurd-6a18@gregkh Fixes: 9f2d3eae88d2 ("can: ucan: add driver for Theobroma Systems UCAN devices") Signed-off-by: Marc Kleine-Budde commit 38a01c9700b0dcafe97dfa9dc7531bf4a245deff Author: Greg Kroah-Hartman Date: Mon Feb 23 17:51:17 2026 +0100 can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length which is set by the driver as the max size of the buffer. When parsing the messages in ems_usb_read_bulk_callback() properly check the size both at the beginning of parsing the message to make sure it is big enough for the expected structure, and at the end of the message to make sure we don't overflow past the end of the buffer for the next message. Cc: Vincent Mailhol Cc: Marc Kleine-Budde Cc: stable@kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026022316-answering-strainer-a5db@gregkh Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface") Signed-off-by: Marc Kleine-Budde commit 968b098220e393a10488b6a5dddb302b2eaedf66 Author: Ziyi Guo Date: Fri Feb 13 20:39:27 2026 +0000 can: esd_usb: add endpoint type validation esd_usb_probe() constructs bulk pipes for two endpoints without verifying their transfer types: - usb_rcvbulkpipe(dev->udev, 1) for RX (version reply, async RX data) - usb_sndbulkpipe(dev->udev, 2) for TX (version query, CAN frames) A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes, triggering the WARNING in usb_submit_urb(). Use usb_find_common_endpoints() to discover and validate the first bulk IN and bulk OUT endpoints at probe time, before any allocation. Found pipes are saved to struct esd_usb and code uses them directly instead of making pipes in place. Similar to - commit 136bed0bfd3b ("can: mcba_usb: properly check endpoint type") which established the usb_find_common_endpoints() + stored pipes pattern for CAN USB drivers. Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Suggested-by: Vincent Mailhol Signed-off-by: Ziyi Guo Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/20260213203927.599163-1-n7l8m4@u.northwestern.edu Signed-off-by: Marc Kleine-Budde commit 5f4338e5633dc034a81000b2516a78cfb51c601d Author: Sheetal Date: Mon Mar 2 14:12:17 2026 +0530 ALSA: hda/hdmi: Add Tegra238 HDA codec device ID Add Tegra238 HDA codec device in hda_device_id list. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260302084217.3135982-1-sheetal@nvidia.com Signed-off-by: Takashi Iwai commit 189645ba9cd9c1eed45151aacaae4347c1eb86a7 Author: Randy Dunlap Date: Sat Feb 28 17:48:11 2026 -0800 gpio: nomadik: repair some kernel-doc comments Avoid these kernel-doc warnings by: - adding short descriptions for enums - using correct (matching) struct names in kernel-doc short descriptions - using the correct struct member name for @nfunctions Warning: include/linux/gpio/gpio-nomadik.h:116 missing initial short description on line: * enum prcm_gpiocr_reg_index Warning: include/linux/gpio/gpio-nomadik.h:125 missing initial short description on line: * enum prcm_gpiocr_altcx_index Warning: include/linux/gpio/gpio-nomadik.h:146 expecting prototype for struct prcm_gpio_altcx. Prototype was for struct prcm_gpiocr_altcx instead Warning: include/linux/gpio/gpio-nomadik.h:156 expecting prototype for struct prcm_gpio_altcx_pin_desc. Prototype was for struct prcm_gpiocr_altcx_pin_desc instead Warning: include/linux/gpio/gpio-nomadik.h:212 struct member 'nfunctions' not described in 'nmk_pinctrl_soc_data' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260301014811.3133250-1-rdunlap@infradead.org Signed-off-by: Bartosz Golaszewski commit ab3f894de216f4a62adc3b57e9191888cbf26885 Author: Alban Bedel Date: Mon Feb 9 15:47:05 2026 +0100 can: mcp251x: fix deadlock in error path of mcp251x_open The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish. This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but for the error path. To solve this issue move the call to free_irq() after the lock is released. Setting `priv->force_quit = 1` beforehand ensure that the IRQ handler will exit right away once it acquired the lock. Signed-off-by: Alban Bedel Link: https://patch.msgid.link/20260209144706.2261954-1-alban.bedel@lht.dlh.de Fixes: bf66f3736a94 ("can: mcp251x: Move to threaded interrupts instead of workqueues.") Signed-off-by: Marc Kleine-Budde commit c77bfbdd6aac31b152ee81522cd90ad1de18738f Author: Oliver Hartkopp Date: Mon Jan 26 11:45:40 2026 +0100 can: dummy_can: dummy_can_init(): fix packet statistics The former implementation was only counting the tx_packets value but not the tx_bytes as the skb was dropped on driver layer. Enable CAN echo support (IFF_ECHO) in dummy_can_init(), which activates the code for setting and retrieving the echo SKB and counts the tx_bytes correctly. Fixes: 816cf430e84b ("can: add dummy_can driver") Cc: Vincent Mailhol Signed-off-by: Oliver Hartkopp Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/20260126104540.21024-1-socketcan@hartkopp.net [mkl: make commit message imperative] Signed-off-by: Marc Kleine-Budde commit c35636e91e392e1540949bbc67932167cb48bc3a Author: Oliver Hartkopp Date: Wed Feb 18 11:58:06 2026 +0100 can: bcm: fix locking for bcm_op runtime updates Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates") added a locking for some variables that can be modified at runtime when updating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup(). Usually the RX_SETUP only handles and filters incoming traffic with one exception: When the RX_RTR_FRAME flag is set a predefined CAN frame is sent when a specific RTR frame is received. Therefore the rx bcm_op uses bcm_can_tx() which uses the bcm_tx_lock that was only initialized in bcm_tx_setup(). Add the missing spin_lock_init() when allocating the bcm_op in bcm_rx_setup() to handle the RTR case properly. Fixes: c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates") Reported-by: syzbot+5b11eccc403dd1cea9f8@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-can/699466e4.a70a0220.2c38d7.00ff.GAE@google.com/ Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260218-bcm_spin_lock_init-v1-1-592634c8a5b5@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 48647d3f9a644d1e81af6558102d43cdb260597b Author: Vlastimil Babka Date: Wed Feb 11 10:42:30 2026 +0100 slab: distinguish lock and trylock for sheaf_flush_main() sheaf_flush_main() can be called from __pcs_replace_full_main() where it's fine if the trylock fails, and pcs_flush_all() where it's not expected to and for some flush callers (when destroying the cache or memory hotremove) it would be actually a problem if it failed and left the main sheaf not flushed. The flush callers can however safely use local_lock() instead of trylock. The trylock failure should not happen in practice on !PREEMPT_RT, but can happen on PREEMPT_RT. The impact is limited in practice because when a trylock fails in the kmem_cache_destroy() path, it means someone is using the cache while destroying it, which is a bug on its own. The memory hotremove path is unlikely to be employed in a production RT config, but it's possible. To fix this, split the function into sheaf_flush_main() (using local_lock()) and sheaf_try_flush_main() (using local_trylock()) where both call __sheaf_flush_main_batch() to flush a single batch of objects. This will also allow lockdep to verify our context assumptions. The problem was raised in an off-list question by Marcelo. Fixes: 2d517aa09bbc ("slab: add opt-in caching layer of percpu sheaves") Cc: stable@vger.kernel.org Reported-by: Marcelo Tosatti Signed-off-by: Vlastimil Babka Reviewed-by: Harry Yoo Reviewed-by: Hao Li Link: https://patch.msgid.link/20260211-b4-sheaf-flush-v1-1-4e7f492f0055@suse.cz Signed-off-by: Vlastimil Babka (SUSE) commit 8a9ebe8c3ca4c5bdad8f010656f4c2155da589fd Author: Randy Dunlap Date: Sat Feb 28 17:48:22 2026 -0800 gpio: timberdale: repair kernel-doc comments Use a ':' after struct member names to avoid kernel-doc warnings: Warning: include/linux/timb_gpio.h:22 struct member 'gpio_base' not described in 'timbgpio_platform_data' Warning: include/linux/timb_gpio.h:22 struct member 'nr_pins' not described in 'timbgpio_platform_data' Warning: include/linux/timb_gpio.h:22 struct member 'irq_base' not described in 'timbgpio_platform_data' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260301014822.3133268-1-rdunlap@infradead.org Signed-off-by: Bartosz Golaszewski commit 0d10393d5eac33cbd92f7a41fddca12c41d3cb7e Author: Roshan Kumar Date: Sun Mar 1 10:56:38 2026 +0000 xfrm: iptfs: validate inner IPv4 header length in IPTFS payload Add validation of the inner IPv4 packet tot_len and ihl fields parsed from decrypted IPTFS payloads in __input_process_payload(). A crafted ESP packet containing an inner IPv4 header with tot_len=0 causes an infinite loop: iplen=0 leads to capturelen=min(0, remaining)=0, so the data offset never advances and the while(data < tail) loop never terminates, spinning forever in softirq context. Reject inner IPv4 packets where tot_len < ihl*4 or ihl*4 < sizeof(struct iphdr), which catches both the tot_len=0 case and malformed ihl values. The normal IP stack performs this validation in ip_rcv_core(), but IPTFS extracts and processes inner packets before they reach that layer. Reported-by: Roshan Kumar Fixes: 6c82d2433671 ("xfrm: iptfs: add basic receive packet (tunnel egress) handling") Cc: stable@vger.kernel.org Signed-off-by: Roshan Kumar Signed-off-by: Steffen Klassert commit 6f0402539b7da2b941a5a43754c15e53ac3cc276 Author: ZhangGuoDong Date: Wed Feb 25 04:10:59 2026 +0000 smb: update some doc references To make it easier to locate the documentation during development. Signed-off-by: ZhangGuoDong Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 7d0bf050a58747bb8f977a6281e63660a66d1c81 Author: ChenXiaoSong Date: Sat Feb 21 08:07:12 2026 +0000 smb/client: make SMB2 maperror KUnit tests a separate module Build the SMB2 maperror KUnit tests as `smb2maperror_test.ko`. Link: https://lore.kernel.org/linux-cifs/20260210081040.4156383-1-geert@linux-m68k.org/ Suggested-by: Geert Uytterhoeven Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 23942b71f07cc99e39d9216a5b370df494759d8c Author: Felix Gu Date: Mon Feb 23 02:24:34 2026 +0800 regulator: mt6363: Fix incorrect and redundant IRQ disposal in probe In mt6363_regulator_probe(), devm_add_action_or_reset() is used to automatically dispose of the IRQ mapping if the probe fails or the device is removed. The manual call to irq_dispose_mapping() in the error path was redundant as the reset action already triggers mt6363_irq_remove(). Furthermore, the manual call incorrectly passed the hardware IRQ number (info->hwirq) instead of the virtual IRQ mapping (info->virq). Remove the redundant and incorrect manual disposal. Fixes: 3c36965df808 ("regulator: Add support for MediaTek MT6363 SPMI PMIC Regulators") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260223-mt6363-v1-1-c99a2e8ac621@gmail.com Signed-off-by: Mark Brown commit ca5056f5a78ce62588878d138e8141f01d70e61b Author: Richard Fitzgerald Date: Thu Feb 26 11:35:11 2026 +0000 ASoC: cs35l56: Suppress pointless warning about number of GPIO pulls In cs35l56_process_xu_onchip_speaker_id() the warning that the number of pulls != number of GPIOs should only be printed if pulls are defined. Pull settings are optional because there would normally be an external resistor providing the pull. The warning would still be true if pulls are not defined, but in that case is just log noise. While we're changing that block of code, also fix the indenting of the arguments to the dev_warn(). Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260226113511.1768838-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit fd13fc700e3e239826a46448bf7f01847dd26f5a Author: Simon Trimmer Date: Tue Feb 24 13:03:07 2026 +0000 ASoC: amd: acp: Add ACP6.3 match entries for Cirrus Logic parts This adds some match entries for a few system configurations: cs42l43 link 0 UID 0 cs35l56 link 1 UID 0 cs35l56 link 1 UID 1 cs35l56 link 1 UID 2 cs35l56 link 1 UID 3 cs42l45 link 1 UID 0 cs35l63 link 0 UID 0 cs35l63 link 0 UID 2 cs35l63 link 0 UID 4 cs35l63 link 0 UID 6 cs42l45 link 0 UID 0 cs35l63 link 1 UID 0 cs35l63 link 1 UID 1 cs42l45 link 0 UID 0 cs35l63 link 1 UID 1 cs35l63 link 1 UID 3 cs42l45 link 1 UID 0 cs35l63 link 0 UID 0 cs35l63 link 0 UID 1 cs42l43 link 1 UID 0 cs35l56 link 1 UID 0 cs35l56 link 1 UID 1 cs35l56 link 1 UID 2 cs35l56 link 1 UID 3 cs35l56 link 1 UID 0 cs35l56 link 1 UID 1 cs35l56 link 1 UID 2 cs35l56 link 1 UID 3 cs35l63 link 0 UID 0 cs35l63 link 0 UID 2 cs35l63 link 0 UID 4 cs35l63 link 0 UID 6 cs42l43 link 0 UID 1 cs42l43b link 0 UID 1 cs42l45 link 0 UID 0 cs42l45 link 1 UID 0 Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20260224130307.526626-1-simont@opensource.cirrus.com Signed-off-by: Mark Brown commit 70eddf6a0a3fc6d3ab6f77251676da97cc7f12ae Author: Oliver Freyermuth Date: Tue Feb 24 20:02:24 2026 +0100 ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCD SKU This adds the necessary quirk for the Alienware 18 Area 51 (2025). Complements commit 1b03391d073d ("ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCC SKU"). Signed-off-by: Oliver Freyermuth Tested-by: Oliver Freyermuth Link: https://patch.msgid.link/20260224190224.30630-1-o.freyermuth@googlemail.com Signed-off-by: Mark Brown commit 986841dcad257615a6e3f89231bb38e1f3506b77 Author: Shuming Fan Date: Wed Feb 25 17:12:10 2026 +0800 ASoC: rt1321: fix DMIC ch2/3 mask issue This patch fixed the DMIC ch2/3 mask missing problem. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20260225091210.3648905-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 9351cf3fd92dc1349bb75f2f7f7324607dcf596f Author: Richard Fitzgerald Date: Thu Feb 26 11:01:37 2026 +0000 ASoC: cs35l56: Only patch ASP registers if the DAI is part of a DAIlink Move the ASP register patches to a separate struct and apply this from the ASP DAI probe() function so that the registers are only patched if the DAI is part of a DAI link. Some systems use the ASP as a special-purpose interconnect and on these systems the ASP registers are configured by a third party (the firmware, the BIOS, or another device using the amp's secondary host control interface). If the machine driver does not hook up the ASP DAI then the ASP registers must be omitted from the patch to prevent overwriting the third party configuration. If the machine driver includes the ASP DAI in a DAI link, this implies that the machine driver and higher components (such as alsa-ucm) are taking ownership of the ASP. In this case the ASP registers are patched to known defaults and the machine driver should configure the ASP. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260226110137.1664562-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 31ddc62c1cd92e51b9db61d7954b85ae2ec224da Author: Mark Brown Date: Thu Feb 5 00:25:38 2026 +0000 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() ALSA controls should return 1 if the value in the control changed but the control put operation fsl_easrc_set_reg() only returns 0 or a negative error code, causing ALSA to not generate any change events. Add a suitable check by using regmap_update_bits_check() with the underlying regmap, this is more clearly and simply correct than trying to verify that one of the generic ops is exactly equivalent to this one. Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260205-asoc-fsl-easrc-fix-events-v1-2-39d4c766918b@kernel.org Signed-off-by: Mark Brown commit 54a86cf48eaa6d1ab5130d756b718775e81e1748 Author: Mark Brown Date: Thu Feb 5 00:25:37 2026 +0000 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() ALSA controls should return 1 if the value in the control changed but the control put operation fsl_easrc_iec958_put_bits() unconditionally returns 0, causing ALSA to not generate any change events. This is detected by mixer-test with large numbers of messages in the form: No event generated for Context 3 IEC958 CS5 Context 3 IEC958 CS5.0 orig 5224 read 5225, is_volatile 0 Add a suitable check. Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260205-asoc-fsl-easrc-fix-events-v1-1-39d4c766918b@kernel.org Signed-off-by: Mark Brown commit 11439c4635edd669ae435eec308f4ab8a0804808 Author: Linus Torvalds Date: Sun Mar 1 15:39:31 2026 -0800 Linux 7.0-rc2 commit 949d0a46ad1b9ab3450fb6ed69ff1e3e13c657bd Merge: e2bd1b136926f1 55365ab85a93ed Author: Linus Torvalds Date: Sun Mar 1 15:34:47 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Arm: - Make sure we don't leak any S1POE state from guest to guest when the feature is supported on the HW, but not enabled on the host - Propagate the ID registers from the host into non-protected VMs managed by pKVM, ensuring that the guest sees the intended feature set - Drop double kern_hyp_va() from unpin_host_sve_state(), which could bite us if we were to change kern_hyp_va() to not being idempotent - Don't leak stage-2 mappings in protected mode - Correctly align the faulting address when dealing with single page stage-2 mappings for PAGE_SIZE > 4kB - Fix detection of virtualisation-capable GICv5 IRS, due to the maintainer being obviously fat fingered... [his words, not mine] - Remove duplication of code retrieving the ASID for the purpose of S1 PT handling - Fix slightly abusive const-ification in vgic_set_kvm_info() Generic: - Remove internal Kconfigs that are now set on all architectures - Remove per-architecture code to enable KVM_CAP_SYNC_MMU, all architectures finally enable it in Linux 7.0" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: always define KVM_CAP_SYNC_MMU KVM: remove CONFIG_KVM_GENERIC_MMU_NOTIFIER KVM: arm64: Deduplicate ASID retrieval code irqchip/gic-v5: Fix inversion of IRS_IDR0.virt flag KVM: arm64: Revert accidental drop of kvm_uninit_stage2_mmu() for non-NV VMs KVM: arm64: Fix protected mode handling of pages larger than 4kB KVM: arm64: vgic: Handle const qualifier from gic_kvm_info allocation type KVM: arm64: Remove redundant kern_hyp_va() in unpin_host_sve_state() KVM: arm64: Fix ID register initialization for non-protected pKVM guests KVM: arm64: Optimise away S1POE handling when not supported by host KVM: arm64: Hide S1POE from guests when not supported by the host commit e2bd1b136926f1ff65d4e0f87ac49b9a4621238c Merge: 5920da4455a393 fd3634312a04f3 Author: Linus Torvalds Date: Sun Mar 1 13:32:32 2026 -0800 Merge tag 'core-debugobjects-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects fix from Thomas Gleixner: "A single fix for debugobjects. The deferred page initialization prevents debug objects from allocating slab pages until the initialization is complete. That causes depletion of the pool and disabling of debugobjects. The reason is that debugobjects uses __GFP_HIGH for allocations as it might be invoked from arbitrary contexts. When PREEMPT_COUNT is disabled there is no way to know whether the context is safe to set __GFP_KSWAPD_RECLAIM. This worked until v6.18. Since then allocations w/o a reclaim flag cause new_slab() to end up in alloc_frozen_pages_nolock_noprof(), which returns early when deferred page initialization has not yet completed. Work around that when PREEMPT_COUNT is enabled as the preempt counter allows debugobjects to add __GFP_KSWAPD_RECLAIM to the GFP flags when the context is preemtible. When PREEMPT_COUNT is disabled the context is unknown and the reclaim bit can't be set because the caller might hold locks which might deadlock in the allocator. That makes debugobjects depend on PREEMPT_COUNT || !DEFERRED_STRUCT_PAGE_INIT, which limits the coverage slightly, but keeps it functional for most cases" * tag 'core-debugobjects-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobject: Make it work with deferred page initialization - again commit 5920da4455a393490309d6483636b9749ec785fd Merge: f6542af92298d8 237dc6a054f678 Author: Linus Torvalds Date: Sun Mar 1 13:16:35 2026 -0800 Merge tag 'x86-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix speculative safety in fred_extint() - Fix __WARN_printf() trap in early_fixup_exception() - Fix clang-build boot bug for unusual alignments, triggered by CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y - Replace the final few __ASSEMBLY__ stragglers that snuck in lately into non-UAPI x86 headers and use __ASSEMBLER__ consistently (again) * tag 'x86-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/headers: Replace __ASSEMBLY__ stragglers with __ASSEMBLER__ x86/cfi: Fix CFI rewrite for odd alignments x86/bug: Handle __WARN_printf() trap in early_fixup_exception() x86/fred: Correct speculative safety in fred_extint() commit f6542af92298d8a44ab5588144086fa2d0edf391 Merge: 61706251492eff b777b5e09eabee Author: Linus Torvalds Date: Sun Mar 1 12:15:58 2026 -0800 Merge tag 'timers-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Improve the inlining of jiffies_to_msecs() and jiffies_to_usecs(), for the common HZ=100, 250 or 1000 cases. Only use a function call for odd HZ values like HZ=300 that generate more code. The function call overhead showed up in performance tests of the TCP code" * tag 'timers-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time/jiffies: Inline jiffies_to_msecs() and jiffies_to_usecs() commit 61706251492eff650e91c58507bc77e1a12c7fbb Merge: cb36eabcaf28ac 3b68df978133ac Author: Linus Torvalds Date: Sun Mar 1 11:09:24 2026 -0800 Merge tag 'sched-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix zero_vruntime tracking when there's a single task running - Fix slice protection logic - Fix the ->vprot logic for reniced tasks - Fix lag clamping in mixed slice workloads - Fix objtool uaccess warning (and bug) in the !CONFIG_RSEQ_SLICE_EXTENSION case caused by unexpected un-inlining, which triggers with older compilers - Fix a comment in the rseq registration rseq_size bound check code - Fix a legacy RSEQ ABI quirk that handled 32-byte area sizes differently, which special size we now reached naturally and want to avoid. The visible ugliness of the new reserved field will be avoided the next time the RSEQ area is extended. * tag 'sched-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq: slice ext: Ensure rseq feature size differs from original rseq size rseq: Clarify rseq registration rseq_size bound check comment sched/core: Fix wakeup_preempt's next_class tracking rseq: Mark rseq_arm_slice_extension_timer() __always_inline sched/fair: Fix lag clamp sched/eevdf: Update se->vprot in reweight_entity() sched/fair: Only set slice protection at pick time sched/fair: Fix zero_vruntime tracking commit cb36eabcaf28acaeb14b236fc090340f78b2cc48 Merge: b4102208706710 c9bc1753b3cc41 Author: Linus Torvalds Date: Sun Mar 1 11:07:20 2026 -0800 Merge tag 'perf-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events fixes from Ingo Molnar: - Fix lock ordering bug found by lockdep in perf_event_wakeup() - Fix uncore counter enumeration on Granite Rapids and Sierra Forest - Fix perf_mmap() refcount bug found by Syzkaller - Fix __perf_event_overflow() vs perf_remove_from_context() race * tag 'perf-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race perf/core: Fix refcount bug and potential UAF in perf_mmap perf/x86/intel/uncore: Add per-scheduler IMC CAS count events perf/core: Fix invalid wait context in ctx_sched_in() commit b4102208706710b3d6da7ea2ee916cea32823b7c Merge: afa844360bc527 ab6088e7a95943 Author: Linus Torvalds Date: Sun Mar 1 11:00:43 2026 -0800 Merge tag 'locking-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Now that LLVM 22 has been released officially, require a release version to use the new CONFIG_WARN_CONTEXT_ANALYSIS feature. In particular this avoids the widely used Android clang 22.0.1 pre-release build which is known to be broken for this usecase" * tag 'locking-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: lib/Kconfig.debug: Require a release version of LLVM 22 for context analysis commit afa844360bc527d2a7e9e2542b5bd59b361cfb7c Merge: 39c633261414f1 fe5669e363b129 Author: Linus Torvalds Date: Sun Mar 1 10:58:16 2026 -0800 Merge tag 'irq-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irqchip driver fixes from Ingo Molnar: - Fix frozen interrupt bug in the sifive-plic driver - Limit per-device MSI interrupts on uncommon gic-v3-its hardware variants - Address Sparse warning by constifying a variable in the MMP driver - Revert broken commit and also fix an error check in the ls-extirq driver * tag 'irq-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/ls-extirq: Fix devm_of_iomap() error check Revert "irqchip/ls-extirq: Use for_each_of_imap_item iterator" irqchip/mmp: Make icu_irq_chip variable static const irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports irqchip/sifive-plic: Fix frozen interrupt due to affinity setting commit 39c633261414f12cb533a8b802ee57e2d2e3c482 Merge: eb71ab2bf72260 2f38fd99c00046 Author: Linus Torvalds Date: Sun Mar 1 09:59:29 2026 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All changes in drivers (well technically SES is enclosure services, but its change is minor). The biggest is the write combining change in lpfc followed by the additional NULL checks in mpi3mr" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Fix shift out of bounds when MAXQ=32 scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() scsi: snic: MAINTAINERS: Update snic maintainers scsi: snic: Remove unused linkstatus scsi: pm8001: Fix use-after-free in pm8001_queue_command() scsi: mpi3mr: Add NULL checks when resetting request and reply queues scsi: ufs: core: Reset urgent_bkops_lvl to allow runtime PM power mode scsi: ses: Fix devices attaching to different hosts scsi: ufs: core: Fix RPMB region size detection for UFS 2.2 scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT scsi: lpfc: Properly set WC for DPP mapping commit 773ef9f95385bae52dcb7fd129fefba3a71a04db Author: David Lechner Date: Sat Feb 14 16:33:54 2026 -0600 iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count is derived by taking the difference of the last and first register addresses, dividing by the size of each channel (2 bytes). It needs to also add 1 to account for the fact that the count is inclusive of both the first and last channels. Thanks to the aligned_s64 timestamp field, there was already extra padding in the buffer, so there were no runtime issues caused by this bug. Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver") Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron commit c47ac75f5f24020cc0c8b835457a7637ad450939 Author: Srinivas Pandruvada Date: Fri Feb 20 14:45:14 2026 -0800 iio: hid-sensors: Use software trigger Recent changes linux mainline resulted in warning: "genirq: Warn about using IRQF_ONESHOT without a threaded handler" when HID sensor hub is used. When INDIO_BUFFER_TRIGGERED is used, the core attaches a poll function when enabling the buffer. This poll function uses request_threaded_irq() with both bottom half and top half handlers. But when using HID sensor hub, bottom half (thread handler) is not registered. In HID sensors, once a sensor is powered on, the hub collects samples and pushes data to the host when programmed thresholds are met. When this data is received for a sensor, it is pushed using iio_push_to_buffers_with_ts(). The sensor is powered ON or OFF based on the trigger callback set_trigger_state() when the poll function is attached. During the call to iio_triggered_buffer_setup_ext(), the HID sensor specifies only a handler function but provides no thread handler, as there is no data to read from the hub in thread context. Internally, this results in calling request_threaded_irq(). Recent kernel changes now warn when request_threaded_irq() is called without a thread handler. To address this issue, fundamental changes are required to avoid using iio_triggered_buffer_setup_ext(). HID sensors can use INDIO_BUFFER_SOFTWARE instead of INDIO_BUFFER_TRIGGERED, as this can work in trigger-less mode. In this approach, when user space opens the buffer, the sensor is powered on, and when the buffer is closed, the sensor is powered off using iio_buffer_setup_ops callbacks. Signed-off-by: Srinivas Pandruvada Signed-off-by: Jonathan Cameron commit 20c2a46da4c65ac9c84f2876e2369a260b50e95b Author: Felix Gu Date: Mon Feb 23 14:45:13 2026 +0800 iio: adc: ad4062: Replace IRQF_ONESHOT with IRQF_NO_THREAD In ad4062_request_irq(), when request irq for "gp1", the code uses IRQF_ONESHOT flag, which is not appropriate for a primary handler that does not have a secondary threaded handler. And since commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler"), the IRQ core checks IRQF_ONESHOT flag in IRQ request and gives a warning if there is no threaded handler. Since there is no threaded handler, replace devm_request_threaded_irq with devm_request_irq, and replace IRQF_ONESHOT with IRQF_NO_THREAD. Also remove an extraneous semicolon at the end of ad4062_write_raw_dispatch(). Found by code review, compile pass. Fixes: d5284402d28f ("iio: adc: Add support for ad4062") Signed-off-by: Felix Gu Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Jonathan Cameron commit d14116f6529fa085b1a1b1f224dc9604e4d2a29c Author: Ethan Tidmore Date: Tue Feb 24 16:48:18 2026 -0600 iio: gyro: mpu3050: Fix out-of-sequence free_irq() The triggered buffer is initialized before the IRQ is requested. The removal path currently calls iio_triggered_buffer_cleanup() before free_irq(). This violates the expected LIFO. Place free_irq() in the correct location relative to iio_triggered_buffer_cleanup(). Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") Suggested-by: Jonathan Cameron Reviewed-by: Linus Walleij Signed-off-by: Ethan Tidmore Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 4c05799449108fb0e0a6bd30e65fffc71e60db4d Author: Ethan Tidmore Date: Tue Feb 24 16:48:17 2026 -0600 iio: gyro: mpu3050: Move iio_device_register() to correct location iio_device_register() should be at the end of the probe function to prevent race conditions. Place iio_device_register() at the end of the probe function and place iio_device_unregister() accordingly. Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") Suggested-by: Jonathan Cameron Reviewed-by: Linus Walleij Signed-off-by: Ethan Tidmore Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 4216db1043a3be72ef9c2b7b9f393d7fa72496e6 Author: Ethan Tidmore Date: Tue Feb 24 16:48:16 2026 -0600 iio: gyro: mpu3050: Fix irq resource leak The interrupt handler is setup but only a few lines down if iio_trigger_register() fails the function returns without properly releasing the handler. Add cleanup goto to resolve resource leak. Detected by Smatch: drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn: 'irq' from request_threaded_irq() not released on lines: 1124. Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") Reviewed-by: Linus Walleij Signed-off-by: Ethan Tidmore Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6 Author: Ethan Tidmore Date: Tue Feb 24 16:48:15 2026 -0600 iio: gyro: mpu3050: Fix incorrect free_irq() variable The handler for the IRQ part of this driver is mpu3050->trig but, in the teardown free_irq() is called with handler mpu3050. Use correct IRQ handler when calling free_irq(). Fixes: 3904b28efb2c7 ("iio: gyro: Add driver for the MPU-3050 gyroscope") Reviewed-by: Linus Walleij Signed-off-by: Ethan Tidmore Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 679c04c10d65d32a3f269e696b22912ff0a001b9 Author: Francesco Lavra Date: Wed Feb 25 11:06:01 2026 +0100 iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only The st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace writes the buffer sampling frequency sysfs attribute, calls st_lsm6dsx_check_odr(), which accesses the odr_table array at index `sensor->id`; since this array is only 2 entries long, an access for any sensor type other than accelerometer or gyroscope is an out-of-bounds access. The motivation for being able to set a buffer frequency different from the sensor sampling frequency is to support use cases that need accurate event detection (which requires a high sampling frequency) while retrieving sensor data at low frequency. Since all the supported event types are generated from acceleration data only, do not create the buffer sampling frequency attribute for sensor types other than the accelerometer. Fixes: 6b648a36c200 ("iio: imu: st_lsm6dsx: Decouple sensor ODR from FIFO batch data rate") Signed-off-by: Francesco Lavra Cc: Signed-off-by: Jonathan Cameron commit 630748afa7030b272b7bee5df857e7bcf132ed51 Author: Francesco Lavra Date: Wed Feb 25 11:06:00 2026 +0100 iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only The st_lsm6dsx_set_fifo_odr() function, which is called when enabling and disabling the hardware FIFO, checks the contents of the hw->settings->batch array at index sensor->id, and then sets the current ODR value in sensor registers that depend on whether the register address is set in the above array element. This logic is valid for internal sensors only, i.e. the accelerometer and gyroscope; however, since commit c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support"), this function is called also when configuring the hardware FIFO for external sensors (i.e. sensors accessed through the sensor hub functionality), which can result in unrelated device registers being written. Add a check to the beginning of st_lsm6dsx_set_fifo_odr() so that it does not touch any registers unless it is called for internal sensors. Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support") Signed-off-by: Francesco Lavra Cc: Signed-off-by: Jonathan Cameron commit b403981da8a26f57f07859a9704392b1183e2a6e Author: Felix Gu Date: Wed Feb 25 22:48:57 2026 +0800 iio: dac: mcp47feb02: Fix mutex used before initialization The mcp47feb02_parse_fw() function uses data->lock, but the mutex was initialized after this function in probe path. Since mcp47feb02_parse_fw() is only called from probe(), remove the lock. Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02") Signed-off-by: Felix Gu Signed-off-by: Jonathan Cameron commit 57b207e38d414a27fda9fff638a0d3e7ef16b917 Author: Giorgi Tchankvetadze Date: Tue Feb 24 17:23:55 2026 +0400 iio: adc: ade9000: fix wrong return type in streaming push The else branch of ade9000_iio_push_streaming() incorrectly returns IRQ_HANDLED on regmap_write failure. This function returns int (0 on success, negative errno on failure), so IRQ_HANDLED (1) would be misinterpreted as a non-error by callers. Return ret instead, consistent with every other error path in the function. Fixes: 81de7b4619fc ("iio: adc: add ade9000 support") Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit 86133fb1ec36b2f5cec29d71fbae84877c3a1358 Author: Giorgi Tchankvetadze Date: Thu Feb 26 18:07:02 2026 +0400 iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power The switch statement in ade9000_write_raw() attempts to match chan->address against ADE9000_REG_AWATTOS (0x00F) to dispatch the calibration offset write for active power channels. However, chan->address is set via ADE9000_ADDR_ADJUST(ADE9000_REG_AWATT, num), so after masking the phase bits, tmp holds ADE9000_REG_AWATT (0x210), which never matches 0x00F. As a result, writing IIO_CHAN_INFO_CALIBBIAS for IIO_POWER always falls through to the default case and returns -EINVAL, making active power offset calibration silently broken. Fix this by matching against ADE9000_REG_AWATT instead, which is the actual base address stored in chan->address for watt channels. Reference:ADE9000 datasheet (Rev. B), AWATTOS is the offset correction register at 0x00F (p. 44), while AWATT is the total active power register at 0x210 (p. 48). Fixes: 81de7b4619fc ("iio: adc: add ade9000 support") Signed-off-by: Giorgi Tchankvetadze Reviewed-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit bd66aa1c8b8cabf459064a46d3430a5ec5138418 Author: Antoniu Miclaus Date: Fri Feb 27 14:43:05 2026 +0200 iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 FIELD_PREP(BIT(0), fifo_samples & BIT(8)) produces either 0 or 256, and since FIELD_PREP masks to bit 0, 256 & 1 evaluates to 0. Use !! to convert the result to a proper 0-or-1 value. Fixes: df36de13677a ("iio: accel: add ADXL380 driver") Signed-off-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit 0206dd36418c104c0b3dea4ed7047e21eccb30b0 Author: Antoniu Miclaus Date: Fri Feb 27 15:33:30 2026 +0200 iio: adc: ade9000: move mutex init before IRQ registration Move devm_mutex_init() before ade9000_request_irq() calls so that st->lock is initialized before any handler that depends on it can run. Fixes: 81de7b4619fc ("iio: adc: add ade9000 support") Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit c53bca092486809d266b5921b9e6f9df2688fc26 Author: Felix Gu Date: Fri Feb 27 21:54:29 2026 +0800 iio: pressure: abp2030pa: Remove IRQF_ONESHOT from devm_request_irq() Since commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler"), the IRQ core checks IRQF_ONESHOT flag in IRQ request and gives a warning if there is no threaded handler. Remove IRQF_ONESHOT from devm_request_irq(). Fixes: 47d323ce1e89 ("iio: pressure: add Honeywell ABP2 driver") Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Felix Gu Tested-by: Petre Rodan Signed-off-by: Jonathan Cameron commit 48a5c36577ebe0144f8ede70e59b59ea18b75089 Author: Felix Gu Date: Sat Feb 28 01:48:19 2026 +0800 iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion() In ads1119_single_conversion(), if pm_runtime_resume_and_get() fails, the code jumps to the pdown label, which calls pm_runtime_put_autosuspend(). Since pm_runtime_resume_and_get() automatically decrements the usage counter on failure, the subsequent call to pm_runtime_put_autosuspend() causes an unbalanced reference counter. Fixes: a9306887eba4 ("iio: adc: ti-ads1119: Add driver") Signed-off-by: Felix Gu Reviewed-by: João Paulo Gonçalves Cc: Signed-off-by: Jonathan Cameron commit eb71ab2bf72260054677e348498ba995a057c463 Merge: 63a43faf6a68ce b9c0a5c48396ae Author: Linus Torvalds Date: Sat Feb 28 19:54:28 2026 -0800 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix alignment of arm64 JIT buffer to prevent atomic tearing (Fuad Tabba) - Fix invariant violation for single value tnums in the verifier (Harishankar Vishwanathan, Paul Chaignon) - Fix a bunch of issues found by ASAN in selftests/bpf (Ihor Solodrai) - Fix race in devmpa and cpumap on PREEMPT_RT (Jiayuan Chen) - Fix show_fdinfo of kprobe_multi when cookies are not present (Jiri Olsa) - Fix race in freeing special fields in BPF maps to prevent memory leaks (Kumar Kartikeya Dwivedi) - Fix OOB read in dmabuf_collector (T.J. Mercier) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (36 commits) selftests/bpf: Avoid simplification of crafted bounds test selftests/bpf: Test refinement of single-value tnum bpf: Improve bounds when tnum has a single possible value bpf: Introduce tnum_step to step through tnum's members bpf: Fix race in devmap on PREEMPT_RT bpf: Fix race in cpumap on PREEMPT_RT selftests/bpf: Add tests for special fields races bpf: Retire rcu_trace_implies_rcu_gp() from local storage bpf: Delay freeing fields in local storage bpf: Lose const-ness of map in map_check_btf() bpf: Register dtor for freeing special fields selftests/bpf: Fix OOB read in dmabuf_collector selftests/bpf: Fix a memory leak in xdp_flowtable test bpf: Fix stack-out-of-bounds write in devmap bpf: Fix kprobe_multi cookies access in show_fdinfo callback bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing selftests/bpf: Don't override SIGSEGV handler with ASAN selftests/bpf: Check BPFTOOL env var in detect_bpftool_path() selftests/bpf: Fix out-of-bounds array access bugs reported by ASAN selftests/bpf: Fix array bounds warning in jit_disasm_helpers ... commit 63a43faf6a68ce0045c874b32e60acac2089a41a Merge: 42eb01783091e4 78437ab3b769f8 Author: Linus Torvalds Date: Sat Feb 28 19:35:30 2026 -0800 Merge tag 'driver-core-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Do not register imx_clk_scu_driver in imx8qxp_clk_probe(); besides fixing two other issues, this avoids a deadlock in combination with commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") - Move secondary node lookup from device_get_next_child_node() to fwnode_get_next_child_node(); this avoids issues when users switch from the device API to the fwnode API - Export io_define_{read,write}!() to avoid unused import warnings when CONFIG_PCI=n * tag 'driver-core-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: clk: scu/imx8qxp: do not register driver in probe() rust: io: macro_export io_define_read!() and io_define_write!() device property: Allow secondary lookup in fwnode_get_next_child_node() commit 4478e8eeb87120c11e90041864c2233238b2155a Author: Eric Biggers Date: Thu Feb 26 11:17:49 2026 -0800 lib/crypto: tests: Depend on library options rather than selecting them The convention for KUnit tests is to have the test kconfig options visible only when the code they depend on is already enabled. This way only the tests that are relevant to the particular kernel build can be enabled, either manually or via KUNIT_ALL_TESTS. Update lib/crypto/tests/Kconfig to follow that convention, i.e. depend on the corresponding library options rather than selecting them. This fixes an issue where enabling KUNIT_ALL_TESTS enabled non-test code. This does mean that it becomes a bit more difficult to enable *all* the crypto library tests (which is what I do as a maintainer of the code), since doing so will now require enabling other options that select the libraries. Regardless, we should follow the standard KUnit convention. I'll also add a .kunitconfig file that does enable all these options. Note: currently most of the crypto library options are selected by visible options in crypto/Kconfig, which can be used to enable them without too much trouble. If in the future we end up with more cases like CRYPTO_LIB_CURVE25519 which is selected only by WIREGUARD (thus making CRYPTO_LIB_CURVE25519_KUNIT_TEST effectively depend on WIREGUARD after this commit), we could consider adding a new kconfig option that enables all the library code specifically for testing. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/r/CAMuHMdULzMdxuTVfg8_4jdgzbzjfx-PHkcgbGSthcUx_sHRNMg@mail.gmail.com Fixes: 4dcf6caddaa0 ("lib/crypto: tests: Add KUnit tests for SHA-224 and SHA-256") Fixes: 571eaeddb67d ("lib/crypto: tests: Add KUnit tests for SHA-384 and SHA-512") Fixes: 6dd4d9f7919e ("lib/crypto: tests: Add KUnit tests for Poly1305") Fixes: 66b130607908 ("lib/crypto: tests: Add KUnit tests for SHA-1 and HMAC-SHA1") Fixes: d6b6aac0cdb4 ("lib/crypto: tests: Add KUnit tests for MD5 and HMAC-MD5") Fixes: afc4e4a5f122 ("lib/crypto: tests: Migrate Curve25519 self-test to KUnit") Fixes: 6401fd334ddf ("lib/crypto: tests: Add KUnit tests for BLAKE2b") Fixes: 15c64c47e484 ("lib/crypto: tests: Add SHA3 kunit tests") Fixes: b3aed551b3fc ("lib/crypto: tests: Add KUnit tests for POLYVAL") Fixes: ed894faccb8d ("lib/crypto: tests: Add KUnit tests for ML-DSA verification") Fixes: 7246fe6cd644 ("lib/crypto: tests: Add KUnit tests for NH") Cc: stable@vger.kernel.org Reviewed-by: David Gow Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260226191749.39397-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 14d4ac19d1895397532eec407433c5d74d9da53b Author: Prithvi Tambewagh Date: Mon Feb 16 11:50:02 2026 +0530 scsi: target: Fix recursive locking in __configfs_open_file() In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This function called filp_open(), following which these functions were called (in reverse order), according to the call trace: down_read __configfs_open_file do_dentry_open vfs_open do_open path_openat do_filp_open file_open_name filp_open target_core_item_dbroot_store flush_write_buffer configfs_write_iter target_core_item_dbroot_store() tries to validate the new file path by trying to open the file path provided to it; however, in this case, the bug report shows: db_root: not a directory: /sys/kernel/config/target/dbroot indicating that the same configfs file was tried to be opened, on which it is currently working on. Thus, it is trying to acquire frag_sem semaphore of the same file of which it already holds the semaphore obtained in flush_write_buffer(), leading to acquiring the semaphore in a nested manner and a possibility of recursive locking. Fix this by modifying target_core_item_dbroot_store() to use kern_path() instead of filp_open() to avoid opening the file using filesystem-specific function __configfs_open_file(), and further modifying it to make this fix compatible. Reported-by: syzbot+f6e8174215573a84b797@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f6e8174215573a84b797 Tested-by: syzbot+f6e8174215573a84b797@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Prithvi Tambewagh Reviewed-by: Dmitry Bogdanov Link: https://patch.msgid.link/20260216062002.61937-1-activprithvi@gmail.com Signed-off-by: Martin K. Petersen commit 80bf3b28d32b431f84f244a8469488eb6d96afbb Author: Florian Fuchs Date: Fri Feb 27 19:18:23 2026 +0100 scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP The Iomega ZIP 100 (Z100P2) can't process IO Advice Hints Grouping mode page query. It immediately switches to the status phase 0xb8 after receiving the subpage code 0x05 of MODE_SENSE_10 command, which fails imm_out() and turns into DID_ERROR of this command, which leads to unusable device. This was tested with an Iomega ZIP 100 (Z100P2) connected with a StarTech PEX1P2 AX99100 PCIe parallel port card. Prior to this fix, Test Unit Ready fails and the drive can't be used: IMM: returned SCSI status b8 sd 7:0:6:0: [sdh] Test Unit Ready failed: Result: hostbyte=0x01 driverbyte=DRIVER_OK Signed-off-by: Florian Fuchs Link: https://patch.msgid.link/20260227181823.892932-1-fuchsfl@gmail.com Signed-off-by: Martin K. Petersen commit dbd53975ed4132d161b6a97ebe785a262380182d Author: Ranjan Kumar Date: Wed Feb 25 13:56:22 2026 +0530 scsi: mpi3mr: Clear reset history on ready and recheck state after timeout The driver retains reset history even after the IOC has successfully reached the READY state. That leaves stale reset information active during normal operation and can mislead recovery and diagnostics. In addition, if the IOC becomes READY just as the ready timeout loop exits, the driver still follows the failure path and may retry or report failure incorrectly. Clear reset history once READY is confirmed so driver state matches actual IOC status. After the timeout loop, recheck the IOC state and treat READY as success instead of failing. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260225082622.82588-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 1ac22c8eae81366101597d48360718dff9b9d980 Author: Junxiao Bi Date: Mon Feb 23 15:27:28 2026 -0800 scsi: core: Fix refcount leak for tagset_refcnt This leak will cause a hang when tearing down the SCSI host. For example, iscsid hangs with the following call trace: [130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured PID: 2528 TASK: ffff9d0408974e00 CPU: 3 COMMAND: "iscsid" #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4 #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0 #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp] #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi] #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi] #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6 #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef Fixes: 8fe4ce5836e9 ("scsi: core: Fix a use-after-free") Cc: stable@vger.kernel.org Signed-off-by: Junxiao Bi Reviewed-by: Mike Christie Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260223232728.93350-1-junxiao.bi@oracle.com Signed-off-by: Martin K. Petersen commit 9439a661c2e80485406ce2c90b107ca17858382d Author: Raju Rangoju Date: Thu Feb 26 22:37:53 2026 +0530 amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds Extend the MAC_TCR_SS (Speed Select) register field width from 2 bits to 3 bits to properly support all speed settings. The MAC_TCR register's SS field encoding requires 3 bits to represent all supported speeds: - 0x00: 10Gbps (XGMII) - 0x02: 2.5Gbps (GMII) / 100Mbps - 0x03: 1Gbps / 10Mbps - 0x06: 2.5Gbps (XGMII) - P100a only With only 2 bits, values 0x04-0x07 cannot be represented, which breaks 2.5G XGMII mode on newer platforms and causes incorrect speed select values to be programmed. Fixes: 07445f3c7ca1 ("amd-xgbe: Add support for 10 Mbps speed") Co-developed-by: Guruvendra Punugupati Signed-off-by: Guruvendra Punugupati Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260226170753.250312-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 147792c395db870756a0dc87ce656c75ae7ab7e8 Author: MD Danish Anwar Date: Thu Feb 26 15:53:56 2026 +0530 net: ti: icssg-prueth: Fix ping failure after offload mode setup when link speed is not 1G When both eth interfaces with links up are added to a bridge or hsr interface, ping fails if the link speed is not 1Gbps (e.g., 100Mbps). The issue is seen because when switching to offload (bridge/hsr) mode, prueth_emac_restart() restarts the firmware and clears DRAM with memset_io(), setting all memory to 0. This includes PORT_LINK_SPEED_OFFSET which firmware reads for link speed. The value 0 corresponds to FW_LINK_SPEED_1G (0x00), so for 1Gbps links the default value is correct and ping works. For 100Mbps links, the firmware needs FW_LINK_SPEED_100M (0x01) but gets 0 instead, causing ping to fail. The function emac_adjust_link() is called to reconfigure, but it detects no state change (emac->link is still 1, speed/duplex match PHY) so new_state remains false and icssg_config_set_speed() is never called to correct the firmware speed value. The fix resets emac->link to 0 before calling emac_adjust_link() in prueth_emac_common_start(). This forces new_state=true, ensuring icssg_config_set_speed() is called to write the correct speed value to firmware memory. Fixes: 06feac15406f ("net: ti: icssg-prueth: Fix emac link speed handling") Signed-off-by: MD Danish Anwar Link: https://patch.msgid.link/20260226102356.2141871-1-danishanwar@ti.com Signed-off-by: Jakub Kicinski commit dff8e3c025862001956b8edb29c1287c9efcd902 Author: Kaushlendra Kumar Date: Wed Feb 4 10:51:40 2026 +0530 cpupower: fix swapped power/energy unit labels Fix error where microWatts and microJoules units were interchanged. Signed-off-by: Kaushlendra Kumar Signed-off-by: Shuah Khan commit 42eb01783091e49020221a8a7d6c00e154ae7e58 Merge: 9197e5949a41cf f505a45776d149 Author: Linus Torvalds Date: Sat Feb 28 10:45:56 2026 -0800 Merge tag 'v7.0rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Two multichannel fixes - Locking fix for superblock flags - Fix to remove debug message that could log password - Cleanup fix for setting credentials * tag 'v7.0rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: Use snprintf in cifs_set_cifscreds smb: client: Don't log plaintext credentials in cifs_set_cifscreds smb: client: fix broken multichannel with krb5+signing smb: client: use atomic_t for mnt_cifs_flags smb: client: fix cifs_pick_channel when channels are equally loaded commit 9197e5949a41cfb5d44a6b8a860766266340d558 Author: Takashi Sakamoto Date: Sat Feb 28 11:56:03 2026 +0900 firewire: ohci: initialize page array to use alloc_pages_bulk() correctly The call of alloc_pages_bulk() skips to fill entries of page array when the entries already have values. While, 1394 OHCI PCI driver passes the page array without initializing. It could cause invalid state at PFN validation in vmap(). Fixes: f2ae92780ab9 ("firewire: ohci: split page allocation from dma mapping") Reported-by: John Ogness Reported-and-tested-by: Harald Arnesen Reported-and-tested-by: David Gow Closes: https://lore.kernel.org/lkml/87tsv1vig5.fsf@jogness.linutronix.de/ Signed-off-by: Takashi Sakamoto Signed-off-by: Linus Torvalds commit 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb Author: Jiayuan Chen Date: Wed Feb 25 20:32:40 2026 +0800 atm: lec: fix null-ptr-deref in lec_arp_clear_vccs syzkaller reported a null-ptr-deref in lec_arp_clear_vccs(). This issue can be easily reproduced using the syzkaller reproducer. In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc). When the underlying VCC is closed, lec_vcc_close() iterates over all ARP entries and calls lec_arp_clear_vccs() for each matched entry. For example, when lec_vcc_close() iterates through the hlists in priv->lec_arp_empty_ones or other ARP tables: 1. In the first iteration, for the first matched ARP entry sharing the VCC, lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back) and sets vcc->user_back to NULL. 2. In the second iteration, for the next matched ARP entry sharing the same VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash. Fix this by adding a null check for vpriv before dereferencing it. If vpriv is already NULL, it means the VCC has been cleared by a previous call, so we can safely skip the cleanup and just clear the entry's vcc/recv_vcc pointers. The entire cleanup block (including vcc_release_async()) is placed inside the vpriv guard because a NULL vpriv indicates the VCC has already been fully released by a prior iteration — repeating the teardown would redundantly set flags and trigger callbacks on an already-closing socket. The Fixes tag points to the initial commit because the entry->vcc path has been vulnerable since the original code. The entry->recv_vcc path was later added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back") with the same pattern, and both paths are fixed here. Reported-by: syzbot+72e3ea390c305de0e259@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68c95a83.050a0220.3c6139.0e5c.GAE@google.com/T/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Dan Carpenter Reviewed-by: Simon Horman Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260225123250.189289-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 2f9339c052bdbafaa8b02188d069fbb0e8df1f26 Merge: 463e1337515c13 e96493229a6399 Author: Linus Torvalds Date: Sat Feb 28 09:21:18 2026 -0800 Merge tag 'spi-fix-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "One fix for the stm32 driver which got broken for DMA chaining cases, plus a removal of some straggling bindings for the Bikal SoC which has been pulled out of the kernel" * tag 'spi-fix-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: stm32: fix missing pointer assignment in case of dma chaining spi: dt-bindings: snps,dw-abp-ssi: Remove unused bindings commit 463e1337515c132413be8185a99cbddb87260dec Merge: 201795a1b72570 bfd7db781e2e7a Author: Linus Torvalds Date: Sat Feb 28 09:18:02 2026 -0800 Merge tag 'regulator-fix-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A small pile of fixes, none of which are super major - the code fixes are improved error handling and fixing a leak of a device node. We also have a typo fix and an improvement to make the binding example for mt6359 more directly usable" * tag 'regulator-fix-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: Kconfig: fix a typo regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio() regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read() regulator: tps65185: check devm_kzalloc() result in probe regulator: dt-bindings: mt6359: make regulator names unique commit 74badb9c20b1a9c02a95c735c6d3cd6121679c93 Author: Guenter Roeck Date: Thu Feb 26 21:58:12 2026 -0800 dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler Commit 31a7a0bbeb00 ("dpaa2-switch: add bounds check for if_id in IRQ handler") introduces a range check for if_id to avoid an out-of-bounds access. If an out-of-bounds if_id is detected, the interrupt status is not cleared. This may result in an interrupt storm. Clear the interrupt status after detecting an out-of-bounds if_id to avoid the problem. Found by an experimental AI code review agent at Google. Fixes: 31a7a0bbeb00 ("dpaa2-switch: add bounds check for if_id in IRQ handler") Cc: Junrui Luo Signed-off-by: Guenter Roeck Reviewed-by: Ioana Ciornei Link: https://patch.msgid.link/20260227055812.1777915-1-linux@roeck-us.net Signed-off-by: Jakub Kicinski commit 201795a1b72570374e6d2c72d5c1c23c9cfc3929 Merge: 4d349ee5c7782f d879ac6756b662 Author: Linus Torvalds Date: Sat Feb 28 09:01:33 2026 -0800 Merge tag 's390-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix guest pfault init to pass a physical address to DIAG 0x258, restoring pfault interrupts and avoiding vCPU stalls during host page-in - Fix kexec/kdump hangs with stack protector by marking s390_reset_system() __no_stack_protector; set_prefix(0) switches lowcore and the canary no longer matches - Fix idle/vtime cputime accounting (idle-exit ordering, vtimer double-forwarding) and small cleanups * tag 's390-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/pfault: Fix virtual vs physical address confusion s390/kexec: Disable stack protector in s390_reset_system() s390/idle: Remove psw_idle() prototype s390/vtime: Use lockdep_assert_irqs_disabled() instead of BUG_ON() s390/vtime: Use __this_cpu_read() / get rid of READ_ONCE() s390/irq/idle: Remove psw bits early s390/idle: Inline update_timer_idle() s390/idle: Slightly optimize idle time accounting s390/idle: Add comment for non obvious code s390/vtime: Fix virtual timer forwarding s390/idle: Fix cpu idle exit cpu time accounting commit 0eb5965b29989e9e593f502f7c4ef3923141adfd Merge: 6df0022b6cdbe3 f7387d6579d65e Author: Jakub Kicinski Date: Sat Feb 28 08:55:14 2026 -0800 Merge branch 'xsk-fixes-for-af_xdp-fragment-handling' Nikhil P. Rao says: ==================== xsk: Fixes for AF_XDP fragment handling This series fixes two issues in AF_XDP zero-copy fragment handling: Patch 1 fixes a buffer leak caused by incorrect list node handling after commit b692bf9a7543. The list_node field is now reused for both the xskb pool list and the buffer free list. Using list_del() instead of list_del_init() causes list_empty() checks in xp_free() to fail, preventing buffers from being added to the free list. Patch 2 fixes partial packet delivery to userspace. In the zero-copy path, if the Rx queue fills up while enqueuing fragments, the remaining fragments are dropped, causing the application to receive incomplete packets. The fix ensures the Rx queue has sufficient space for all fragments before starting to enqueue them. [1] https://lore.kernel.org/oe-kbuild-all/202602051720.YfZO23pZ-lkp@intel.com/ [2] https://lore.kernel.org/oe-kbuild-all/202602172046.vf9DtpdF-lkp@intel.com/ ==================== Link: https://patch.msgid.link/20260225000456.107806-1-nikhil.rao@amd.com Signed-off-by: Jakub Kicinski commit f7387d6579d65efd490a864254101cb665f2e7a7 Author: Nikhil P. Rao Date: Wed Feb 25 00:00:27 2026 +0000 xsk: Fix zero-copy AF_XDP fragment drop AF_XDP should ensure that only a complete packet is sent to application. In the zero-copy case, if the Rx queue gets full as fragments are being enqueued, the remaining fragments are dropped. For the multi-buffer case, add a check to ensure that the Rx queue has enough space for all fragments of a packet before starting to enqueue them. Fixes: 24ea50127ecf ("xsk: support mbuf on ZC RX") Signed-off-by: Nikhil P. Rao Link: https://patch.msgid.link/20260225000456.107806-3-nikhil.rao@amd.com Signed-off-by: Jakub Kicinski commit 60abb0ac11dccd6b98fd9182bc5f85b621688861 Author: Nikhil P. Rao Date: Wed Feb 25 00:00:26 2026 +0000 xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list and the buffer free list, this causes a buffer leak as described below. xp_free() checks if a buffer is already on the free list using list_empty(&xskb->list_node). When list_del() is used to remove a node from the xskb pool list, it doesn't reinitialize the node pointers. This means list_empty() will return false even after the node has been removed, causing xp_free() to incorrectly skip adding the buffer to the free list. Fix this by using list_del_init() instead of list_del() in all fragment handling paths, this ensures the list node is reinitialized after removal, allowing the list_empty() to work correctly. Fixes: b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node") Acked-by: Maciej Fijalkowski Signed-off-by: Nikhil P. Rao Link: https://patch.msgid.link/20260225000456.107806-2-nikhil.rao@amd.com Signed-off-by: Jakub Kicinski commit 6df0022b6cdbe31c00cf7a47addaf242a2984016 Merge: 1cc93c48b5d7ad 0942fc6d324eb9 Author: Jakub Kicinski Date: Sat Feb 28 08:43:56 2026 -0800 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-02-19 (idpf, ice, i40e, ixgbevf, e1000e) For idpf: Li Li moves the check for software marker to occur after incrementing next to clean to avoid re-encountering the same packet. He also adds a couple of checks to prevent NULL pointer dereferences and NULLs rss_key, after free, in error path so that later checks are properly evaluated. Brian Vazquez adjusts IRQ naming to have correlation with netdev naming. Sreedevi removes validation of action type as part of ntuple rule deletion. For ice: Aaron Ma breaks RDMA initialization into two steps and adjusts calls so that VSIs are entirely configured before plugging. Michal Schmidt fixes initialization of loopback VSI to have proper resources allocated to allow for loopback testing to occur. For i40e: Thomas Gleixner fixes a leak of preempt count by replacing get_cpu() with smp_processor_id(). For ixgbevf: Jedrzej adds a check for mailbox version before attempting to call an associated link state call that is supported in that mailbox version. For e1000e: Vitaly clears power gating feature for Panther Lake systems to avoid packet issues. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: e1000e: clear DPG_EN after reset to avoid autonomous power-gating e1000e: introduce new board type for Panther Lake PCH ixgbevf: fix link setup issue i40e: Fix preempt count leak in napi poll tracepoint ice: fix crash in ethtool offline loopback test ice: recap the VSI and QoS info after rebuild idpf: Fix flow rule delete failure due to invalid validation idpf: change IRQ naming to match netdev and ethtool queue numbering idpf: nullify pointers after they are freed idpf: skip deallocating txq group's txqs if it is NULL idpf: skip deallocating bufq_sets from rx_qgrp if it is NULL idpf: increment completion queue next_to_clean in sw marker wait routine ==================== Link: https://patch.msgid.link/20260225211546.1949260-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1cc93c48b5d7add5ea038860539893ce1310d72d Author: Jakub Kicinski Date: Thu Feb 26 19:34:46 2026 -0800 selftests/net: packetdrill: remove tests for tcp_rcv_*big Since commit 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks") has been reverted we need to remove the corresponding tests. Link: https://lore.kernel.org/20260227003359.2391017-1-kuba@kernel.org Link: https://patch.msgid.link/20260227033446.2596457-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 026dfef287c07f37d4d4eef7a0b5a4bfdb29b32d Author: Jakub Kicinski Date: Thu Feb 26 16:33:59 2026 -0800 tcp: give up on stronger sk_rcvbuf checks (for now) We hit another corner case which leads to TcpExtTCPRcvQDrop Connections which send RPCs in the 20-80kB range over loopback experience spurious drops. The exact conditions for most of the drops I investigated are that: - socket exchanged >1MB of data so its not completely fresh - rcvbuf is around 128kB (default, hasn't grown) - there is ~60kB of data in rcvq - skb > 64kB arrives The sum of skb->len (!) of both of the skbs (the one already in rcvq and the arriving one) is larger than rwnd. My suspicion is that this happens because __tcp_select_window() rounds the rwnd up to (1 << wscale) if less than half of the rwnd has been consumed. Eric suggests that given the number of Fixes we already have pointing to 1d2fbaad7cd8 it's probably time to give up on it, until a bigger revamp of rmem management. Also while we could risk tweaking the rwnd math, there are other drops on workloads I investigated, after the commit in question, not explained by this phenomenon. Suggested-by: Eric Dumazet Link: https://lore.kernel.org/20260225122355.585fd57b@kernel.org Fixes: 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks") Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260227003359.2391017-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4 Author: Kuniyuki Iwashima Date: Fri Feb 27 03:55:35 2026 +0000 udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected. Let's say we bind() an UDP socket to the wildcard address with a non-zero port, connect() it to an address, and disconnect it from the address. bind() sets SOCK_BINDPORT_LOCK on sk->sk_userlocks (but not SOCK_BINDADDR_LOCK), and connect() calls udp_lib_hash4() to put the socket into the 4-tuple hash table. Then, __udp_disconnect() calls sk->sk_prot->rehash(sk). It computes a new hash based on the wildcard address and moves the socket to a new slot in the 4-tuple hash table, leaving a garbage in the chain that no packet hits. Let's remove such a socket from 4-tuple hash table when disconnected. Note that udp_sk(sk)->udp_portaddr_hash needs to be udpated after udp_hash4_dec(hslot2) in udp_unhash4(). Fixes: 78c91ae2c6de ("ipv4/udp: Add 4-tuple hash for connected socket") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260227035547.3321327-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 55365ab85a93edec22395547cdc7cbe73a98231b Merge: 70295a479da684 54e367cb94d6be Author: Paolo Bonzini Date: Sat Feb 28 15:33:34 2026 +0100 Merge tag 'kvmarm-fixes-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.0, take #1 - Make sure we don't leak any S1POE state from guest to guest when the feature is supported on the HW, but not enabled on the host - Propagate the ID registers from the host into non-protected VMs managed by pKVM, ensuring that the guest sees the intended feature set - Drop double kern_hyp_va() from unpin_host_sve_state(), which could bite us if we were to change kern_hyp_va() to not being idempotent - Don't leak stage-2 mappings in protected mode - Correctly align the faulting address when dealing with single page stage-2 mappings for PAGE_SIZE > 4kB - Fix detection of virtualisation-capable GICv5 IRS, due to the maintainer being obviously fat fingered... - Remove duplication of code retrieving the ASID for the purpose of S1 PT handling - Fix slightly abusive const-ification in vgic_set_kvm_info() commit 70295a479da684905c18d96656d781823f418ec2 Author: Paolo Bonzini Date: Wed Feb 11 19:06:31 2026 +0100 KVM: always define KVM_CAP_SYNC_MMU KVM_CAP_SYNC_MMU is provided by KVM's MMU notifiers, which are now always available. Move the definition from individual architectures to common code. Signed-off-by: Paolo Bonzini commit 407fd8b8d8cce03856aa67329715de48b254b529 Author: Paolo Bonzini Date: Wed Feb 11 19:03:03 2026 +0100 KVM: remove CONFIG_KVM_GENERIC_MMU_NOTIFIER All architectures now use MMU notifier for KVM page table management. Remove the Kconfig symbol and the code that is used when it is disabled. Signed-off-by: Paolo Bonzini commit 0ed2e8bf61d6d5df1d78f4e24b682dff4c394e17 Author: Jens Axboe Date: Sat Feb 28 04:56:20 2026 -0700 io_uring: correct comment for IORING_SETUP_TASKRUN_FLAG Sync with a recent liburing fix, which corrects the comment explaining when the IORING_SETUP_TASKRUN_FLAG setup flag is valid to use. May be use with COOP_TASKRUN or DEFER_TASKRUN, not useful without either of this task_work mechanisms being used. Link: https://github.com/axboe/liburing/pull/1543 Signed-off-by: Jens Axboe commit d4d5633d8b19b0e745a7910aea49956b3b47900d Author: Takashi Iwai Date: Fri Feb 27 16:57:00 2026 +0100 ALSA: firewire: dice: Fix printf warning with W=1 The use of snprintf() may cause a warning with W=1 due to the possibly truncated string. As the truncation doesn't really matter (and won't happen practically) in the case of dice driver, just shut it up by replacing with scnprintf(). Link: https://patch.msgid.link/20260227155705.1557224-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 05ac3846ffe53fc63e454eb195ce8a6bab7a6a88 Author: Shenghao Ding Date: Fri Feb 27 22:46:40 2026 +0800 ALSA: hda/tas2781: A workaround solution to lower-vol issue among lower calibrated-impedance micro-speaker on TAS2781 On TAS2781, if the Speaker calibrated impedance is lower than default value hard-coded inside the TAS2781, it will cuase vol lower than normal. In order to fix this issue, the parameter of SineGainI need updating. Signed-off-by: Shenghao Ding Tested-by: Matthew Schwartz Link: https://patch.msgid.link/20260227144641.1243-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit 068641bc9dc3d680d1ec4f6ee9199d4812041dff Author: Zhang Heng Date: Fri Feb 27 20:13:27 2026 +0800 ALSA: hda/realtek: Add quirk for HP Pavilion 15-eh1xxx to enable mute LED The HP Pavilion 15-eh1xxx series uses the HP mainboard 88D1 with ALC245 and needs the ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT quirk to make the mute led working. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215978 Cc: Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260227121327.3751341-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit bd72a37b219b9b424bc5ec28f660ebdc129de7cb Author: Lianqin Hu Date: Fri Feb 27 02:11:02 2026 +0000 ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: New USB device found, idVendor=0624, idProduct=3d3f usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: AB13X USB Audio usb 1-1: Manufacturer: Generic usb 1-1: SerialNumber: 20210726905926 Signed-off-by: Lianqin Hu Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/TYUPR06MB621795D087BF2D594027C235D273A@TYUPR06MB6217.apcprd06.prod.outlook.com commit 778031e1658d206a52bf9491c91ae5d4f4a2509d Author: Matt DeVillier Date: Thu Feb 26 10:30:55 2026 -0600 ALSA: hda/ca0132: Set HP/Speaker auto-detect default from headphone pin verb HP/Speaker auto-detect (VNID_HP_ASEL) has been off by default for every CA0132 device since the driver was added in 2012. vnode_lswitch is always initialized to 0 in ca0132_init_chip(), and no quirk or other code path enables it. As a result, headphone jack detection works only after the user manually turns on "HP/Speaker Auto Detect" in alsamixer, which is not obvious on laptops with combo jacks (e.g. Google Link, Alienware). Change the default to follow the headphone pin config: if the pin verb has presence detect enabled (no AC_DEFCFG_MISC_NO_PRESENCE) and the codec supports it (AC_PINCAP_PRES_DETECT), enable HP_ASEL by default. This lets firmware (coreboot, UEFI, etc.) express whether the headphone jack supports insertion detection. Devices with combo jacks can default to auto-detect; devices with fixed/no jack leave it off. Signed-off-by: Matt DeVillier Link: https://patch.msgid.link/20260226163055.825167-1-matt.devillier@gmail.com Signed-off-by: Takashi Iwai commit 89ff45359abbf9d8d3c4aa3f5a57ed0be82b5a12 Author: Lizhi Hou Date: Thu Feb 26 16:48:41 2026 -0800 accel/amdxdna: Fill invalid payload for failed command Newer userspace applications may read the payload of a failed command to obtain detailed error information. However, the driver and old firmware versions may not support returning advanced error information. In this case, initialize the command payload with an invalid value so userspace can detect that no detailed error information is available. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260227004841.3080241-1-lizhi.hou@amd.com commit d240b079a37e90af03fd7dfec94930eb6c83936e Author: Thorsten Blum Date: Thu Feb 19 00:54:00 2026 +0100 crypto: atmel-sha204a - Fix OOM ->tfm_count leak If memory allocation fails, decrement ->tfm_count to avoid blocking future reads. Cc: stable@vger.kernel.org Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator") Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 889b0e2721e793eb46cf7d17b965aa3252af3ec8 Author: Alper Ak Date: Mon Feb 9 13:30:42 2026 +0300 crypto: ccp - Fix use-after-free on error path In the error path of sev_tsm_init_locked(), the code dereferences 't' after it has been freed with kfree(). The pr_err() statement attempts to access t->tio_en and t->tio_init_done after the memory has been released. Move the pr_err() call before kfree(t) to access the fields while the memory is still valid. This issue reported by Smatch static analyser Fixes:4be423572da1 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)") Signed-off-by: Alper Ak Acked-by: Tom Lendacky Signed-off-by: Herbert Xu commit 8168a7b72bdee3790b126f63bd30306759206b15 Author: Ashish Kalra Date: Fri Feb 6 21:26:45 2026 +0000 crypto: ccp - allow callers to use HV-Fixed page API when SEV is disabled When SEV is disabled, the HV-Fixed page allocation call fails, which in turn causes SFS initialization to fail. Fix the HV-Fixed API so callers (for example, SFS) can use it even when SEV is disabled by performing normal page allocation and freeing. Fixes: e09701dcdd9c ("crypto: ccp - Add new HV-Fixed page allocation/free API") Cc: stable@vger.kernel.org Signed-off-by: Ashish Kalra Reviewed-by: Tom Lendacky Signed-off-by: Herbert Xu commit dabffd08545ffa1d7183bc45e387860984025291 Author: Long Li Date: Thu Feb 26 11:28:33 2026 -0800 net: mana: Ring doorbell at 4 CQ wraparounds MANA hardware requires at least one doorbell ring every 8 wraparounds of the CQ. The driver rings the doorbell as a form of flow control to inform hardware that CQEs have been consumed. The NAPI poll functions mana_poll_tx_cq() and mana_poll_rx_cq() can poll up to CQE_POLLING_BUFFER (512) completions per call. If the CQ has fewer than 512 entries, a single poll call can process more than 4 wraparounds without ringing the doorbell. The doorbell threshold check also uses ">" instead of ">=", delaying the ring by one extra CQE beyond 4 wraparounds. Combined, these issues can cause the driver to exceed the 8-wraparound hardware limit, leading to missed completions and stalled queues. Fix this by capping the number of CQEs polled per call to 4 wraparounds of the CQ in both TX and RX paths. Also change the doorbell threshold from ">" to ">=" so the doorbell is rung as soon as 4 wraparounds are reached. Cc: stable@vger.kernel.org Fixes: 58a63729c957 ("net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings") Signed-off-by: Long Li Reviewed-by: Haiyang Zhang Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260226192833.1050807-1-longli@microsoft.com Signed-off-by: Jakub Kicinski commit 15fba71533bcdfaa8eeba69a5a5a2927afdf664a Author: Valentin Spreckels Date: Thu Feb 26 20:54:09 2026 +0100 net: usb: r8152: add TRENDnet TUC-ET2G The TRENDnet TUC-ET2G is a RTL8156 based usb ethernet adapter. Add its vendor and product IDs. Signed-off-by: Valentin Spreckels Link: https://patch.msgid.link/20260226195409.7891-2-valentin@spreckels.dev Signed-off-by: Jakub Kicinski commit b14e82abf78affa50f4cabe8493e17f9adcfcec7 Author: Victor Nogueira Date: Wed Feb 25 10:43:49 2026 -0300 selftests/tc-testing: Create tests to exercise act_ct binding restrictions Add 4 test cases to exercise new act_ct binding restrictions: - Try to attach act_ct to an ets qdisc - Attach act_ct to an ingress qdisc - Attach act_ct to a clsact/egress qdisc - Attach act_ct to a shared block Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260225134349.1287037-2-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 11cb63b0d1a0685e0831ae3c77223e002ef18189 Author: Victor Nogueira Date: Wed Feb 25 10:43:48 2026 -0300 net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/ Reported-by: GangMin Kim Fixes: 3f14b377d01d ("net/sched: act_ct: fix skb leak and crash on ooo frags") CC: stable@vger.kernel.org Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260225134349.1287037-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit ba14798653bb815b4dcd116c5265a9f748bc0c7f Author: Florian Westphal Date: Thu Feb 26 17:19:17 2026 +0100 selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels Jakub reports test flakes on debug kernels: FAIL: test_udp_gro_ct: Expected software segmentation to occur, had 23 and 17 This test assumes that the kernels nfnetlink_queue module sees N GSO packets, segments them into M skbs and queues them to userspace for reinjection. Hence, if M >= N, no segmentation occurred. However, its possible that this happens: - nfnetlink_queue gets GSO packet - segments that into n skbs - userspace buffer is full, kernel drops the segmented skbs -> "toqueue" counter incremented by 1, "fromqueue" is unchanged. If this happens often enough in a single run, M >= N check triggers incorrectly. To solve this, allow the nf_queue.c test program to set the FAIL_OPEN flag so that the segmented skbs bypass the queueing step in the kernel if the receive buffer is full. Also, reduce number of sending socat instances, decrease their priority and increase nice value for the nf_queue program itself to reduce the probability of overruns happening in the first place. Fixes: 59ecffa3995e ("selftests: netfilter: nft_queue.sh: add udp fraglist gro test case") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20260218184114.0b405b72@kernel.org/ Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260226161920.1205-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 71347b9d8cdaef11c7392718fefe20d2ab512cfb Merge: 29252397bcc1e0 15c2715a52645f Author: Jakub Kicinski Date: Fri Feb 27 18:35:42 2026 -0800 Merge branch 'net-sched-sch_cake-fixes-for-cake_mq' Jonas Köppeler says: ==================== net/sched: sch_cake: fixes for cake_mq This patch contains two fixes for cake_mq: - do not sync when bandwidth is unlimited - adjust the rates for all tins during sync ==================== Link: https://patch.msgid.link/20260226-cake-mq-skip-sync-bandwidth-unlimited-v1-0-01830bb4db87@tu-berlin.de Signed-off-by: Jakub Kicinski commit 15c2715a52645fd8e6e18b7abc3449292d118c7c Author: Jonas Köppeler Date: Thu Feb 26 12:40:16 2026 +0100 net/sched: sch_cake: fixup cake_mq rate adjustment for diffserv config cake_mq's rate adjustment during the sync periods did not adjust the rates for every tin in a diffserv config. This lead to inconsistencies of rates between the tins. Fix this by setting the rates for all tins during synchronization. Fixes: 1bddd758bac2 ("net/sched: sch_cake: share shaper state across sub-instances of cake_mq") Signed-off-by: Jonas Köppeler Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260226-cake-mq-skip-sync-bandwidth-unlimited-v1-2-01830bb4db87@tu-berlin.de Signed-off-by: Jakub Kicinski commit 0b3cd139be565b85f4a3579e376152b9def6256a Author: Jonas Köppeler Date: Thu Feb 26 12:40:15 2026 +0100 net/sched: sch_cake: avoid sync overhead when unlimited Skip inter-instance sync when no rate limit is configured, as it serves no purpose and only adds overhead. Fixes: 1bddd758bac2 ("net/sched: sch_cake: share shaper state across sub-instances of cake_mq") Signed-off-by: Jonas Köppeler Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260226-cake-mq-skip-sync-bandwidth-unlimited-v1-1-01830bb4db87@tu-berlin.de Signed-off-by: Jakub Kicinski commit 29252397bcc1e0a1f85e5c3bee59c325f5c26341 Author: Eric Dumazet Date: Wed Feb 25 20:35:45 2026 +0000 inet: annotate data-races around isk->inet_num UDP/TCP lookups are using RCU, thus isk->inet_num accesses should use READ_ONCE() and WRITE_ONCE() where needed. Fixes: 3ab5aee7fe84 ("net: Convert TCP & DCCP hash tables to use RCU / hlist_nulls") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260225203545.1512417-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b9c0a5c48396aea4cde25fc701027ebbc5d78de1 Merge: 8c0d9e178d4a91 024cea2d647ed8 Author: Alexei Starovoitov Date: Fri Feb 27 16:11:50 2026 -0800 Merge branch 'fix-invariant-violation-for-single-value-tnums' Paul Chaignon says: ==================== Fix invariant violation for single-value tnums We're hitting an invariant violation in Cilium that sometimes leads to BPF programs being rejected and Cilium failing to start [1]. As far as I know this is the first case of invariant violation found in a real program (i.e., not by a fuzzer). The following extract from verifier logs shows what's happening: from 201 to 236: R1=0 R6=ctx() R7=1 R9=scalar(smin=umin=smin32=umin32=3584,smax=umax=smax32=umax32=3840,var_off=(0xe00; 0x100)) R10=fp0 236: R1=0 R6=ctx() R7=1 R9=scalar(smin=umin=smin32=umin32=3584,smax=umax=smax32=umax32=3840,var_off=(0xe00; 0x100)) R10=fp0 ; if (magic == MARK_MAGIC_HOST || magic == MARK_MAGIC_OVERLAY || magic == MARK_MAGIC_ENCRYPT) @ bpf_host.c:1337 236: (16) if w9 == 0xe00 goto pc+45 ; R9=scalar(smin=umin=smin32=umin32=3585,smax=umax=smax32=umax32=3840,var_off=(0xe00; 0x100)) 237: (16) if w9 == 0xf00 goto pc+1 verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0xe01, 0xe00] s64=[0xe01, 0xe00] u32=[0xe01, 0xe00] s32=[0xe01, 0xe00] var_off=(0xe00, 0x0) More details are given in the second patch, but in short, the verifier should be able to detect that the false branch of instruction 237 is never true. After instruction 236, the u64 range and the tnum overlap in a single value, 0xf00. The long-term solution to invariant violation is likely to rely on the refinement + invariant violation check to detect dead branches, as started by Eduard. To fix the current issue, we need something with less refactoring that we can backport to affected kernels. The solution implemented in the second patch is to improve the bounds refinement to avoid this case. It relies on a new tnum helper, tnum_step, first sent as an RFC in [2]. The last two patches extend and update the selftests. Link: https://github.com/cilium/cilium/issues/44216 [1] Link: https://lore.kernel.org/bpf/20251107192328.2190680-2-harishankar.vishwanathan@gmail.com/ [2] Changes in v3: - Fix commit description error spotted by AI bot. - Simplify constants in first two tests (Eduard). - Rework comment on third test (Eduard). - Add two new negative test cases (Eduard). - Rebased. Changes in v2: - Add guard suggested by Hari in tnum_step, to avoid undefined behavior spotted by AI code review. - Add explanation diagrams in code as suggested by Eduard. - Rework conditions for readability as suggested by Eduard. - Updated reference to SMT formula. - Rebased. ==================== Link: https://patch.msgid.link/cover.1772225741.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 024cea2d647ed8ab942f19544b892d324dba42b4 Author: Paul Chaignon Date: Fri Feb 27 22:42:45 2026 +0100 selftests/bpf: Avoid simplification of crafted bounds test The reg_bounds_crafted tests validate the verifier's range analysis logic. They focus on the actual ranges and thus ignore the tnum. As a consequence, they carry the assumption that the tested cases can be reproduced in userspace without using the tnum information. Unfortunately, the previous change the refinement logic breaks that assumption for one test case: (u64)2147483648 (u32) [4294967294; 0x100000000] The tested bytecode is shown below. Without our previous improvement, on the false branch of the condition, R7 is only known to have u64 range [0xfffffffe; 0x100000000]. With our improvement, and using the tnum information, we can deduce that R7 equals 0x100000000. 19: (bc) w0 = w6 ; R6=0x80000000 20: (bc) w0 = w7 ; R7=scalar(smin=umin=0xfffffffe,smax=umax=0x100000000,smin32=-2,smax32=0,var_off=(0x0; 0x1ffffffff)) 21: (be) if w6 <= w7 goto pc+3 ; R6=0x80000000 R7=0x100000000 R7's tnum is (0; 0x1ffffffff). On the false branch, regs_refine_cond_op refines R7's u32 range to [0; 0x7fffffff]. Then, __reg32_deduce_bounds refines the s32 range to 0 using u32 and finally also sets u32=0. From this, __reg_bound_offset improves the tnum to (0; 0x100000000). Finally, our previous patch uses this new tnum to deduce that it only intersect with u64=[0xfffffffe; 0x100000000] in a single value: 0x100000000. Because the verifier uses the tnum to reach this constant value, the selftest is unable to reproduce it by only simulating ranges. The solution implemented in this patch is to change the test case such that there is more than one overlap value between u64 and the tnum. The max. u64 value is thus changed from 0x100000000 to 0x300000000. Acked-by: Eduard Zingerman Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/50641c6a7ef39520595dcafa605692427c1006ec.1772225741.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit e6ad477d1bf8829973cddd9accbafa9d1a6cd15a Author: Paul Chaignon Date: Fri Feb 27 22:36:30 2026 +0100 selftests/bpf: Test refinement of single-value tnum This patch introduces selftests to cover the new bounds refinement logic introduced in the previous patch. Without the previous patch, the first two tests fail because of the invariant violation they trigger. The last test fails because the R10 access is not detected as dead code. In addition, all three tests fail because of R0 having a non-constant value in the verifier logs. In addition, the last two cases are covering the negative cases: when we shouldn't refine the bounds because the u64 and tnum overlap in at least two values. Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/90d880c8cf587b9f7dc715d8961cd1b8111d01a8.1772225741.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit efc11a667878a1d655ff034a93a539debbfedb12 Author: Paul Chaignon Date: Fri Feb 27 22:35:02 2026 +0100 bpf: Improve bounds when tnum has a single possible value We're hitting an invariant violation in Cilium that sometimes leads to BPF programs being rejected and Cilium failing to start [1]. The following extract from verifier logs shows what's happening: from 201 to 236: R1=0 R6=ctx() R7=1 R9=scalar(smin=umin=smin32=umin32=3584,smax=umax=smax32=umax32=3840,var_off=(0xe00; 0x100)) R10=fp0 236: R1=0 R6=ctx() R7=1 R9=scalar(smin=umin=smin32=umin32=3584,smax=umax=smax32=umax32=3840,var_off=(0xe00; 0x100)) R10=fp0 ; if (magic == MARK_MAGIC_HOST || magic == MARK_MAGIC_OVERLAY || magic == MARK_MAGIC_ENCRYPT) @ bpf_host.c:1337 236: (16) if w9 == 0xe00 goto pc+45 ; R9=scalar(smin=umin=smin32=umin32=3585,smax=umax=smax32=umax32=3840,var_off=(0xe00; 0x100)) 237: (16) if w9 == 0xf00 goto pc+1 verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0xe01, 0xe00] s64=[0xe01, 0xe00] u32=[0xe01, 0xe00] s32=[0xe01, 0xe00] var_off=(0xe00, 0x0) We reach instruction 236 with two possible values for R9, 0xe00 and 0xf00. This is perfectly reflected in the tnum, but of course the ranges are less accurate and cover [0xe00; 0xf00]. Taking the fallthrough path at instruction 236 allows the verifier to reduce the range to [0xe01; 0xf00]. The tnum is however not updated. With these ranges, at instruction 237, the verifier is not able to deduce that R9 is always equal to 0xf00. Hence the fallthrough pass is explored first, the verifier refines the bounds using the assumption that R9 != 0xf00, and ends up with an invariant violation. This pattern of impossible branch + bounds refinement is common to all invariant violations seen so far. The long-term solution is likely to rely on the refinement + invariant violation check to detect dead branches, as started by Eduard. To fix the current issue, we need something with less refactoring that we can backport. This patch uses the tnum_step helper introduced in the previous patch to detect the above situation. In particular, three cases are now detected in the bounds refinement: 1. The u64 range and the tnum only overlap in umin. u64: ---[xxxxxx]----- tnum: --xx----------x- 2. The u64 range and the tnum only overlap in the maximum value represented by the tnum, called tmax. u64: ---[xxxxxx]----- tnum: xx-----x-------- 3. The u64 range and the tnum only overlap in between umin (excluded) and umax. u64: ---[xxxxxx]----- tnum: xx----x-------x- To detect these three cases, we call tnum_step(tnum, umin), which returns the smallest member of the tnum greater than umin, called tnum_next here. We're in case (1) if umin is part of the tnum and tnum_next is greater than umax. We're in case (2) if umin is not part of the tnum and tnum_next is equal to tmax. Finally, we're in case (3) if umin is not part of the tnum, tnum_next is inferior or equal to umax, and calling tnum_step a second time gives us a value past umax. This change implements these three cases. With it, the above bytecode looks as follows: 0: (85) call bpf_get_prandom_u32#7 ; R0=scalar() 1: (47) r0 |= 3584 ; R0=scalar(smin=0x8000000000000e00,umin=umin32=3584,smin32=0x80000e00,var_off=(0xe00; 0xfffffffffffff1ff)) 2: (57) r0 &= 3840 ; R0=scalar(smin=umin=smin32=umin32=3584,smax=umax=smax32=umax32=3840,var_off=(0xe00; 0x100)) 3: (15) if r0 == 0xe00 goto pc+2 ; R0=3840 4: (15) if r0 == 0xf00 goto pc+1 4: R0=3840 6: (95) exit In addition to the new selftests, this change was also verified with Agni [3]. For the record, the raw SMT is available at [4]. The property it verifies is that: If a concrete value x is contained in all input abstract values, after __update_reg_bounds, it will continue to be contained in all output abstract values. Link: https://github.com/cilium/cilium/issues/44216 [1] Link: https://pchaigno.github.io/test-verifier-complexity.html [2] Link: https://github.com/bpfverif/agni [3] Link: https://pastebin.com/raw/naCfaqNx [4] Fixes: 0df1a55afa83 ("bpf: Warn on internal verifier errors") Acked-by: Eduard Zingerman Tested-by: Marco Schirrmeister Co-developed-by: Harishankar Vishwanathan Signed-off-by: Harishankar Vishwanathan Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/ef254c4f68be19bd393d450188946821c588565d.1772225741.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 76e954155b45294c502e3d3a9e15757c858ca55e Author: Harishankar Vishwanathan Date: Fri Feb 27 22:32:21 2026 +0100 bpf: Introduce tnum_step to step through tnum's members This commit introduces tnum_step(), a function that, when given t, and a number z returns the smallest member of t larger than z. The number z must be greater or equal to the smallest member of t and less than the largest member of t. The first step is to compute j, a number that keeps all of t's known bits, and matches all unknown bits to z's bits. Since j is a member of the t, it is already a candidate for result. However, we want our result to be (minimally) greater than z. There are only two possible cases: (1) Case j <= z. In this case, we want to increase the value of j and make it > z. (2) Case j > z. In this case, we want to decrease the value of j while keeping it > z. (Case 1) j <= z t = xx11x0x0 z = 10111101 (189) j = 10111000 (184) ^ k (Case 1.1) Let's first consider the case where j < z. We will address j == z later. Since z > j, there had to be a bit position that was 1 in z and a 0 in j, beyond which all positions of higher significance are equal in j and z. Further, this position could not have been unknown in a, because the unknown positions of a match z. This position had to be a 1 in z and known 0 in t. Let k be position of the most significant 1-to-0 flip. In our example, k = 3 (starting the count at 1 at the least significant bit). Setting (to 1) the unknown bits of t in positions of significance smaller than k will not produce a result > z. Hence, we must set/unset the unknown bits at positions of significance higher than k. Specifically, we look for the next larger combination of 1s and 0s to place in those positions, relative to the combination that exists in z. We can achieve this by concatenating bits at unknown positions of t into an integer, adding 1, and writing the bits of that result back into the corresponding bit positions previously extracted from z. >From our example, considering only positions of significance greater than k: t = xx..x z = 10..1 + 1 ----- 11..0 This is the exact combination 1s and 0s we need at the unknown bits of t in positions of significance greater than k. Further, our result must only increase the value minimally above z. Hence, unknown bits in positions of significance smaller than k should remain 0. We finally have, result = 11110000 (240) (Case 1.2) Now consider the case when j = z, for example t = 1x1x0xxx z = 10110100 (180) j = 10110100 (180) Matching the unknown bits of the t to the bits of z yielded exactly z. To produce a number greater than z, we must set/unset the unknown bits in t, and *all* the unknown bits of t candidates for being set/unset. We can do this similar to Case 1.1, by adding 1 to the bits extracted from the masked bit positions of z. Essentially, this case is equivalent to Case 1.1, with k = 0. t = 1x1x0xxx z = .0.1.100 + 1 --------- .0.1.101 This is the exact combination of bits needed in the unknown positions of t. After recalling the known positions of t, we get result = 10110101 (181) (Case 2) j > z t = x00010x1 z = 10000010 (130) j = 10001011 (139) ^ k Since j > z, there had to be a bit position which was 0 in z, and a 1 in j, beyond which all positions of higher significance are equal in j and z. This position had to be a 0 in z and known 1 in t. Let k be the position of the most significant 0-to-1 flip. In our example, k = 4. Because of the 0-to-1 flip at position k, a member of t can become greater than z if the bits in positions greater than k are themselves >= to z. To make that member *minimally* greater than z, the bits in positions greater than k must be exactly = z. Hence, we simply match all of t's unknown bits in positions more significant than k to z's bits. In positions less significant than k, we set all t's unknown bits to 0 to retain minimality. In our example, in positions of greater significance than k (=4), t=x000. These positions are matched with z (1000) to produce 1000. In positions of lower significance than k, t=10x1. All unknown bits are set to 0 to produce 1001. The final result is: result = 10001001 (137) This concludes the computation for a result > z that is a member of t. The procedure for tnum_step() in this commit implements the idea described above. As a proof of correctness, we verified the algorithm against a logical specification of tnum_step. The specification asserts the following about the inputs t, z and output res that: 1. res is a member of t, and 2. res is strictly greater than z, and 3. there does not exist another value res2 such that 3a. res2 is also a member of t, and 3b. res2 is greater than z 3c. res2 is smaller than res We checked the implementation against this logical specification using an SMT solver. The verification formula in SMTLIB format is available at [1]. The verification returned an "unsat": indicating that no input assignment exists for which the implementation and the specification produce different outputs. In addition, we also automatically generated the logical encoding of the C implementation using Agni [2] and verified it against the same specification. This verification also returned an "unsat", confirming that the implementation is equivalent to the specification. The formula for this check is also available at [3]. Link: https://pastebin.com/raw/2eRWbiit [1] Link: https://github.com/bpfverif/agni [2] Link: https://pastebin.com/raw/EztVbBJ2 [3] Co-developed-by: Srinivas Narayana Signed-off-by: Srinivas Narayana Co-developed-by: Santosh Nagarakatte Signed-off-by: Santosh Nagarakatte Signed-off-by: Harishankar Vishwanathan Link: https://lore.kernel.org/r/93fdf71910411c0f19e282ba6d03b4c65f9c5d73.1772225741.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 62413a9c3cb183afb9bb6e94dd68caf4e4145f4c Author: Paul Moses Date: Mon Feb 23 15:05:44 2026 +0000 net/sched: act_gate: snapshot parameters with RCU on replace The gate action can be replaced while the hrtimer callback or dump path is walking the schedule list. Convert the parameters to an RCU-protected snapshot and swap updates under tcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits the entry list, preserve the existing schedule so the effective state is unchanged. Fixes: a51c328df310 ("net: qos: introduce a gate control flow action") Cc: stable@vger.kernel.org Signed-off-by: Paul Moses Tested-by: Vladimir Oltean Acked-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Link: https://patch.msgid.link/20260223150512.2251594-2-p@1g4.org Signed-off-by: Jakub Kicinski commit 8c0d9e178d4a91ae596b2780d9b0a77f9d4186ad Merge: 5263e30fffbcc7 1872e75375c40a Author: Alexei Starovoitov Date: Fri Feb 27 16:06:40 2026 -0800 Merge branch 'bpf-cpumap-devmap-fix-per-cpu-bulk-queue-races-on-preempt_rt' Jiayuan Chen says: ==================== bpf: Fix per-CPU bulk queue races on PREEMPT_RT On PREEMPT_RT kernels, local_bh_disable() only calls migrate_disable() (when PREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable preemption. This means CFS scheduling can preempt a task inside the per-CPU bulk queue (bq) operations in cpumap and devmap, allowing another task on the same CPU to concurrently access the same bq, leading to use-after-free, list corruption, and kernel panics. Patch 1 fixes the cpumap race in bq_flush_to_queue(), originally reported by syzbot [1]. Patch 2 fixes the same class of race in devmap's bq_xmit_all(), identified by code inspection after Sebastian Andrzej Siewior pointed out that devmap has the same per-CPU bulk queue pattern [2]. Both patches use local_lock_nested_bh() to serialize access to the per-CPU bq. On non-RT this is a pure lockdep annotation with no overhead; on PREEMPT_RT it provides a per-CPU sleeping lock. To reproduce the devmap race, insert an mdelay(100) in bq_xmit_all() after "cnt = bq->count" and before the actual transmit loop. Then pin two threads to the same CPU, each running BPF_PROG_TEST_RUN with an XDP program that redirects to a DEVMAP entry (e.g. a veth pair). CFS timeslicing during the mdelay window causes interleaving. Without the fix, KASAN reports null-ptr-deref due to operating on freed frames: BUG: KASAN: null-ptr-deref in __build_skb_around+0x22d/0x340 Write of size 32 at addr 0000000000000d50 by task devmap_race_rep/449 CPU: 0 UID: 0 PID: 449 Comm: devmap_race_rep Not tainted 6.19.0+ #31 PREEMPT_RT Call Trace: __build_skb_around+0x22d/0x340 build_skb_around+0x25/0x260 __xdp_build_skb_from_frame+0x103/0x860 veth_xdp_rcv_bulk_skb.isra.0+0x162/0x320 veth_xdp_rcv.constprop.0+0x61e/0xbb0 veth_poll+0x280/0xb50 __napi_poll.constprop.0+0xa5/0x590 net_rx_action+0x4b0/0xea0 handle_softirqs.isra.0+0x1b3/0x780 __local_bh_enable_ip+0x12a/0x240 xdp_test_run_batch.constprop.0+0xedd/0x1f60 bpf_test_run_xdp_live+0x304/0x640 bpf_prog_test_run_xdp+0xd24/0x1b70 __sys_bpf+0x61c/0x3e00 Kernel panic - not syncing: Fatal exception in interrupt [1] https://lore.kernel.org/all/69369331.a70a0220.38f243.009d.GAE@google.com/T/ [2] https://lore.kernel.org/bpf/20260212023634.366343-1-jiayuan.chen@linux.dev/ v3 -> v4: https://lore.kernel.org/all/20260213034018.284146-1-jiayuan.chen@linux.dev/ - Move panic trace to cover letter. (Sebastian Andrzej Siewior) - Add Reviewed-by: Sebastian Andrzej Siewior to both patches from cover letter. v2 -> v3: https://lore.kernel.org/bpf/20260212023634.366343-1-jiayuan.chen@linux.dev/ - Fix commit message: remove incorrect "spin_lock() becomes rt_mutex" claim, the per-CPU bq has no spin_lock at all. (Sebastian Andrzej Siewior) - Fix commit message: accurately describe local_lock_nested_bh() behavior instead of referencing local_lock(). (Sebastian Andrzej Siewior) - Remove incomplete discussion of snapshot alternative. (Sebastian Andrzej Siewior) - Remove panic trace from commit message. (Sebastian Andrzej Siewior) - Add patch 2/2 for devmap, same race pattern. (Sebastian Andrzej Siewior) v1 -> v2: https://lore.kernel.org/bpf/20260211064417.196401-1-jiayuan.chen@linux.dev/ - Use local_lock_nested_bh()/local_unlock_nested_bh() instead of local_lock()/local_unlock(), since these paths already run under local_bh_disable(). (Sebastian Andrzej Siewior) - Replace "Caller must hold bq->bq_lock" comment with lockdep_assert_held() in bq_flush_to_queue(). (Sebastian Andrzej Siewior) - Fix Fixes tag to 3253cb49cbad ("softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT") which is the actual commit that makes the race possible. (Sebastian Andrzej Siewior) ==================== Link: https://patch.msgid.link/20260225121459.183121-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit 1872e75375c40add4a35990de3be77b5741c252c Author: Jiayuan Chen Date: Wed Feb 25 20:14:56 2026 +0800 bpf: Fix race in devmap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_dev_bulk_queue (bq) can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code assumes bq_enqueue() and __dev_flush() run atomically with respect to each other on the same CPU, relying on local_bh_disable() to prevent preemption. However, on PREEMPT_RT, local_bh_disable() only calls migrate_disable() (when PREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable preemption, which allows CFS scheduling to preempt a task during bq_xmit_all(), enabling another task on the same CPU to enter bq_enqueue() and operate on the same per-CPU bq concurrently. This leads to several races: 1. Double-free / use-after-free on bq->q[]: bq_xmit_all() snapshots cnt = bq->count, then iterates bq->q[0..cnt-1] to transmit frames. If preempted after the snapshot, a second task can call bq_enqueue() -> bq_xmit_all() on the same bq, transmitting (and freeing) the same frames. When the first task resumes, it operates on stale pointers in bq->q[], causing use-after-free. 2. bq->count and bq->q[] corruption: concurrent bq_enqueue() modifying bq->count and bq->q[] while bq_xmit_all() is reading them. 3. dev_rx/xdp_prog teardown race: __dev_flush() clears bq->dev_rx and bq->xdp_prog after bq_xmit_all(). If preempted between bq_xmit_all() return and bq->dev_rx = NULL, a preempting bq_enqueue() sees dev_rx still set (non-NULL), skips adding bq to the flush_list, and enqueues a frame. When __dev_flush() resumes, it clears dev_rx and removes bq from the flush_list, orphaning the newly enqueued frame. 4. __list_del_clearprev() on flush_node: similar to the cpumap race, both tasks can call __list_del_clearprev() on the same flush_node, the second dereferences the prev pointer already set to NULL. The race between task A (__dev_flush -> bq_xmit_all) and task B (bq_enqueue -> bq_xmit_all) on the same CPU: Task A (xdp_do_flush) Task B (ndo_xdp_xmit redirect) ---------------------- -------------------------------- __dev_flush(flush_list) bq_xmit_all(bq) cnt = bq->count /* e.g. 16 */ /* start iterating bq->q[] */ <-- CFS preempts Task A --> bq_enqueue(dev, xdpf) bq->count == DEV_MAP_BULK_SIZE bq_xmit_all(bq, 0) cnt = bq->count /* same 16! */ ndo_xdp_xmit(bq->q[]) /* frames freed by driver */ bq->count = 0 <-- Task A resumes --> ndo_xdp_xmit(bq->q[]) /* use-after-free: frames already freed! */ Fix this by adding a local_lock_t to xdp_dev_bulk_queue and acquiring it in bq_enqueue() and __dev_flush(). These paths already run under local_bh_disable(), so use local_lock_nested_bh() which on non-RT is a pure annotation with no overhead, and on PREEMPT_RT provides a per-CPU sleeping lock that serializes access to the bq. Fixes: 3253cb49cbad ("softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT") Reported-by: Sebastian Andrzej Siewior Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Jiayuan Chen Signed-off-by: Jiayuan Chen Link: https://lore.kernel.org/r/20260225121459.183121-3-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit 869c63d5975d55e97f6b168e885452b3da20ea47 Author: Jiayuan Chen Date: Wed Feb 25 20:14:55 2026 +0800 bpf: Fix race in cpumap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bq) can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code assumes bq_enqueue() and __cpu_map_flush() run atomically with respect to each other on the same CPU, relying on local_bh_disable() to prevent preemption. However, on PREEMPT_RT, local_bh_disable() only calls migrate_disable() (when PREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable preemption, which allows CFS scheduling to preempt a task during bq_flush_to_queue(), enabling another task on the same CPU to enter bq_enqueue() and operate on the same per-CPU bq concurrently. This leads to several races: 1. Double __list_del_clearprev(): after bq->count is reset in bq_flush_to_queue(), a preempting task can call bq_enqueue() -> bq_flush_to_queue() on the same bq when bq->count reaches CPU_MAP_BULK_SIZE. Both tasks then call __list_del_clearprev() on the same bq->flush_node, the second call dereferences the prev pointer that was already set to NULL by the first. 2. bq->count and bq->q[] races: concurrent bq_enqueue() can corrupt the packet queue while bq_flush_to_queue() is processing it. The race between task A (__cpu_map_flush -> bq_flush_to_queue) and task B (bq_enqueue -> bq_flush_to_queue) on the same CPU: Task A (xdp_do_flush) Task B (cpu_map_enqueue) ---------------------- ------------------------ bq_flush_to_queue(bq) spin_lock(&q->producer_lock) /* flush bq->q[] to ptr_ring */ bq->count = 0 spin_unlock(&q->producer_lock) bq_enqueue(rcpu, xdpf) <-- CFS preempts Task A --> bq->q[bq->count++] = xdpf /* ... more enqueues until full ... */ bq_flush_to_queue(bq) spin_lock(&q->producer_lock) /* flush to ptr_ring */ spin_unlock(&q->producer_lock) __list_del_clearprev(flush_node) /* sets flush_node.prev = NULL */ <-- Task A resumes --> __list_del_clearprev(flush_node) flush_node.prev->next = ... /* prev is NULL -> kernel oops */ Fix this by adding a local_lock_t to xdp_bulk_queue and acquiring it in bq_enqueue() and __cpu_map_flush(). These paths already run under local_bh_disable(), so use local_lock_nested_bh() which on non-RT is a pure annotation with no overhead, and on PREEMPT_RT provides a per-CPU sleeping lock that serializes access to the bq. To reproduce, insert an mdelay(100) between bq->count = 0 and __list_del_clearprev() in bq_flush_to_queue(), then run reproducer provided by syzkaller. Fixes: 3253cb49cbad ("softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT") Reported-by: syzbot+2b3391f44313b3983e91@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69369331.a70a0220.38f243.009d.GAE@google.com/T/ Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Jiayuan Chen Signed-off-by: Jiayuan Chen Link: https://lore.kernel.org/r/20260225121459.183121-2-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit 5263e30fffbcc7934671f0421eafb87b690a01d2 Merge: 6881af27f9ea0f 2939d7b3b0e5f3 Author: Alexei Starovoitov Date: Fri Feb 27 15:39:01 2026 -0800 Merge branch 'close-race-in-freeing-special-fields-and-map-value' Kumar Kartikeya Dwivedi says: ==================== Close race in freeing special fields and map value There exists a race across various map types where the freeing of special fields (tw, timer, wq, kptr, etc.) can be done eagerly when a logical delete operation is done on a map value, such that the program which continues to have access to such a map value can recreate the fields and cause them to leak. The set contains fixes for this case. It is a continuation of Mykyta's previous attempt in [0], but applies to all fields. A test is included which reproduces the bug reliably in absence of the fixes. Local Storage Benchmarks ------------------------ Evaluation Setup: Benchmarked on a dual-socket Intel Xeon Gold 6348 (Ice Lake) @ 2.60GHz (56 cores / 112 threads), with the CPU governor set to performance. Bench was pinned to a single NUMA node throughout the test. Benchmark comes from [1] using the following command: ./bench -p 1 local-storage-create --storage-type --batch-size <16,32,64> Before the test, 10 runs of all cases ([socket|task] x 3 batch sizes x 7 iterations per batch size) are done to warm up and prime the machine. Then, 3 runs of all cases are done (with and without the patch, across reboots). For each comparison, we have 21 samples, i.e. per batch size (e.g. socket 16) of a given local storage, we have 3 runs x 7 iterations. The statistics (mean, median, stddev) and t-test is done for each scenario (local storage and batch size pair) individually (21 samples for either case). All values are for local storage creations in thousand creations / sec (k/s). Baseline (without patch) With patch Delta Case Median Mean Std. Dev. Median Mean Std. Dev. Median % --------------------------------------------------------------------------------------------------- socket 16 432.026 431.941 1.047 431.347 431.953 1.635 -0.679 -0.16% socket 32 432.641 432.818 1.535 432.488 432.302 1.508 -0.153 -0.04% socket 64 431.504 431.996 1.337 429.145 430.326 2.469 -2.359 -0.55% task 16 38.816 39.382 1.456 39.657 39.337 1.831 +0.841 +2.17% task 32 38.815 39.644 2.690 38.721 39.122 1.636 -0.094 -0.24% task 64 37.562 38.080 1.701 39.554 38.563 1.689 +1.992 +5.30% The cases for socket are within the range of noise, and improvements in task local storage are due to high variance (CV ~4%-6% across batch sizes). The only statistically significant case worth mentioning is socket with batch size 64 with p-value from t-test < 0.05, but the absolute difference is small (~2k/s). TL;DR there doesn't appear to be any significant regression or improvement. [0]: https://lore.kernel.org/bpf/20260216131341.1285427-1-mykyta.yatsenko5@gmail.com [1]: https://lore.kernel.org/bpf/20260205222916.1788211-1-ameryhung@gmail.com Changelog: ---------- v2 -> v3 v2: https://lore.kernel.org/bpf/20260227052031.3988575-1-memxor@gmail.com * Add syzbot Tested-by. * Add Amery's Reviewed-by. * Fix missing rcu_dereference_check() in __bpf_selem_free_rcu. (BPF CI Bot) * Remove migrate_disable() in bpf_selem_free_rcu. (Alexei) v1 -> v2 v1: https://lore.kernel.org/bpf/20260225185121.2057388-1-memxor@gmail.com * Add Paul's Reviewed-by. * Fix use-after-free in accessing bpf_mem_alloc embedded in map. (syzbot CI) * Add benchmark numbers for local storage. * Add extra test case for per-cpu hashmap coverage with up to 16 refcount leaks. * Target bpf tree. ==================== Link: https://patch.msgid.link/20260227224806.646888-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 2939d7b3b0e5f35359ce8f69dbbad0bfc4e920b6 Author: Kumar Kartikeya Dwivedi Date: Fri Feb 27 14:48:05 2026 -0800 selftests/bpf: Add tests for special fields races Add a couple of tests to ensure that the refcount drops to zero when we exercise the race where creation of a special field succeeds the logical bpf_obj_free_fields done when deleting an element. Prior to previous changes, the fields would be freed eagerly and repopulate and end up leaking, causing the reference to not drop down correctly. Running this test on a kernel without fixes will cause a hang in delete_module, since the module reference stays active due to the leaked kptr not dropping it. After the fixes tests succeed as expected. Reviewed-by: Amery Hung Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260227224806.646888-6-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit baa35b3cb6b642b903162aacff13181e170c4ecc Author: Kumar Kartikeya Dwivedi Date: Fri Feb 27 14:48:04 2026 -0800 bpf: Retire rcu_trace_implies_rcu_gp() from local storage This assumption will always hold going forward, hence just remove the various checks and assume it is true with a comment for the uninformed reader. Reviewed-by: Paul E. McKenney Reviewed-by: Amery Hung Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260227224806.646888-5-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit f41deee082dc7b1c198de21710cb5cb9c604cae0 Author: Kumar Kartikeya Dwivedi Date: Fri Feb 27 14:48:03 2026 -0800 bpf: Delay freeing fields in local storage Currently, when use_kmalloc_nolock is false, the freeing of fields for a local storage selem is done eagerly before waiting for the RCU or RCU tasks trace grace period to elapse. This opens up a window where the program which has access to the selem can recreate the fields after the freeing of fields is done eagerly, causing memory leaks when the element is finally freed and returned to the kernel. Make a few changes to address this. First, delay the freeing of fields until after the grace periods have expired using a __bpf_selem_free_rcu wrapper which is eventually invoked after transitioning through the necessary number of grace period waits. Replace usage of the kfree_rcu with call_rcu to be able to take a custom callback. Finally, care needs to be taken to extend the rcu barriers for all cases, and not just when use_kmalloc_nolock is true, as RCU and RCU tasks trace callbacks can be in flight for either case and access the smap field, which is used to obtain the BTF record to walk over special fields in the map value. While we're at it, drop migrate_disable() from bpf_selem_free_rcu, since migration should be disabled for RCU callbacks already. Fixes: 9bac675e6368 ("bpf: Postpone bpf_obj_free_fields to the rcu callback") Reviewed-by: Amery Hung Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260227224806.646888-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit ae51772b1e94ba1d76db19085957dbccac189c1c Author: Kumar Kartikeya Dwivedi Date: Fri Feb 27 14:48:02 2026 -0800 bpf: Lose const-ness of map in map_check_btf() BPF hash map may now use the map_check_btf() callback to decide whether to set a dtor on its bpf_mem_alloc or not. Unlike C++ where members can opt out of const-ness using mutable, we must lose the const qualifier on the callback such that we can avoid the ugly cast. Make the change and adjust all existing users, and lose the comment in hashtab.c. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260227224806.646888-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 1df97a7453eec80c1912c2d0360290a3970a7671 Author: Kumar Kartikeya Dwivedi Date: Fri Feb 27 14:48:01 2026 -0800 bpf: Register dtor for freeing special fields There is a race window where BPF hash map elements can leak special fields if the program with access to the map value recreates these special fields between the check_and_free_fields done on the map value and its eventual return to the memory allocator. Several ways were explored prior to this patch, most notably [0] tried to use a poison value to reject attempts to recreate special fields for map values that have been logically deleted but still accessible to BPF programs (either while sitting in the free list or when reused). While this approach works well for task work, timers, wq, etc., it is harder to apply the idea to kptrs, which have a similar race and failure mode. Instead, we change bpf_mem_alloc to allow registering destructor for allocated elements, such that when they are returned to the allocator, any special fields created while they were accessible to programs in the mean time will be freed. If these values get reused, we do not free the fields again before handing the element back. The special fields thus may remain initialized while the map value sits in a free list. When bpf_mem_alloc is retired in the future, a similar concept can be introduced to kmalloc_nolock-backed kmem_cache, paired with the existing idea of a constructor. Note that the destructor registration happens in map_check_btf, after the BTF record is populated and (at that point) avaiable for inspection and duplication. Duplication is necessary since the freeing of embedded bpf_mem_alloc can be decoupled from actual map lifetime due to logic introduced to reduce the cost of rcu_barrier()s in mem alloc free path in 9f2c6e96c65e ("bpf: Optimize rcu_barrier usage between hash map and bpf_mem_alloc."). As such, once all callbacks are done, we must also free the duplicated record. To remove dependency on the bpf_map itself, also stash the key size of the map to obtain value from htab_elem long after the map is gone. [0]: https://lore.kernel.org/bpf/20260216131341.1285427-1-mykyta.yatsenko5@gmail.com Fixes: 14a324f6a67e ("bpf: Wire up freeing of referenced kptr") Fixes: 1bfbc267ec91 ("bpf: Enable bpf_timer and bpf_wq in any context") Reported-by: Alexei Starovoitov Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260227224806.646888-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 4d349ee5c7782f8b27f6cb550f112c5e26fff38d Merge: 1c63df24be5f06 df6e4ab654dc48 Author: Linus Torvalds Date: Fri Feb 27 13:40:30 2026 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "The diffstat is dominated by changes to our TLB invalidation errata handling and the introduction of a new GCS selftest to catch one of the issues that is fixed here relating to PROT_NONE mappings. - Fix cpufreq warning due to attempting a cross-call with interrupts masked when reading local AMU counters - Fix DEBUG_PREEMPT warning from the delay loop when it tries to access per-cpu errata workaround state for the virtual counter - Re-jig and optimise our TLB invalidation errata workarounds in preparation for more hardware brokenness - Fix GCS mappings to interact properly with PROT_NONE and to avoid corrupting the pte on CPUs with FEAT_LPA2 - Fix ioremap_prot() to extract only the memory attributes from the user pte and ignore all the other 'prot' bits" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: topology: Fix false warning in counters_read_on_cpu() for same-CPU reads arm64: Fix sampling the "stable" virtual counter in preemptible section arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI arm64: tlb: Allow XZR argument to TLBI ops kselftest: arm64: Check access to GCS after mprotect(PROT_NONE) arm64: gcs: Honour mprotect(PROT_NONE) on shadow stack mappings arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled arm64: io: Extract user memory type in ioremap_prot() arm64: io: Rename ioremap_prot() to __ioremap_prot() commit 1c63df24be5f06f61b94e63cbe01aa852e463438 Merge: aed968f8a6cd60 39195990e4c093 Author: Linus Torvalds Date: Fri Feb 27 13:32:52 2026 -0800 Merge tag 'pci-v7.0-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Update MAINTAINERS email address (Shawn Guo) - Refresh cached Endpoint driver MSI Message Address to fix a v7.0 regression when kernel changes the address after firmware has configured it (Niklas Cassel) - Flush Endpoint MSI-X writes so they complete before the outbound ATU entry is unmapped (Niklas Cassel) - Correct the PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value, which broke VMM use of PCI capabilities (Bjorn Helgaas) * tag 'pci-v7.0-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry PCI: dwc: ep: Refresh MSI Message Address cache on change MAINTAINERS: Update Shawn Guo's address for HiSilicon PCIe controller driver commit 10047142d6ce3b8562546c61f3cf57f852b9b950 Merge: a0b4c7a49137ed 4c7b2ec23cc5d8 Author: Christian Brauner Date: Fri Feb 27 22:00:19 2026 +0100 Merge patch series "tighten nstree visibility checks" Christian Brauner says: Listing various namespaces is currently only scoped on owning namespace. We can make this more fine-grained so that we scope visibility even tighter. To make it possible to change behavior restrict visibility for now. This shouldn't be a big deal as there aren't actual large users out there and paves the way to make this even cleaner in the future. * patches from https://patch.msgid.link/20260226-work-visibility-fixes-v1-0-d2c2853313bd@kernel.org: selftests: fix mntns iteration selftests nstree: tighten permission checks for listing nsfs: tighten permission checks for handle opening nsfs: tighten permission checks for ns iteration ioctls Link: https://patch.msgid.link/20260226-work-visibility-fixes-v1-0-d2c2853313bd@kernel.org Signed-off-by: Christian Brauner commit 4c7b2ec23cc5d880e3ffe35e8c2aad686b67723a Author: Christian Brauner Date: Thu Feb 26 14:50:12 2026 +0100 selftests: fix mntns iteration selftests Now that we changed permission checking make sure that we reflect that in the selftests. Link: https://patch.msgid.link/20260226-work-visibility-fixes-v1-4-d2c2853313bd@kernel.org Fixes: 9d87b1067382 ("selftests: add tests for mntns iteration") Reviewed-by: Jeff Layton Cc: stable@kernel.org # v6.14+ Signed-off-by: Christian Brauner commit 8d76afe84fa2babf604b3c173730d4d2b067e361 Author: Christian Brauner Date: Thu Feb 26 14:50:11 2026 +0100 nstree: tighten permission checks for listing Even privileged services should not necessarily be able to see other privileged service's namespaces so they can't leak information to each other. Use may_see_all_namespaces() helper that centralizes this policy until the nstree adapts. Link: https://patch.msgid.link/20260226-work-visibility-fixes-v1-3-d2c2853313bd@kernel.org Fixes: 76b6f5dfb3fd ("nstree: add listns()") Reviewed-by: Jeff Layton Cc: stable@kernel.org # v6.19+ Signed-off-by: Christian Brauner commit d2324a9317f00013facb0ba00b00440e19d2af5e Author: Christian Brauner Date: Thu Feb 26 14:50:10 2026 +0100 nsfs: tighten permission checks for handle opening Even privileged services should not necessarily be able to see other privileged service's namespaces so they can't leak information to each other. Use may_see_all_namespaces() helper that centralizes this policy until the nstree adapts. Link: https://patch.msgid.link/20260226-work-visibility-fixes-v1-2-d2c2853313bd@kernel.org Fixes: 5222470b2fbb ("nsfs: support file handles") Reviewed-by: Jeff Layton Cc: stable@kernel.org # v6.18+ Signed-off-by: Christian Brauner commit e6b899f08066e744f89df16ceb782e06868bd148 Author: Christian Brauner Date: Thu Feb 26 14:50:09 2026 +0100 nsfs: tighten permission checks for ns iteration ioctls Even privileged services should not necessarily be able to see other privileged service's namespaces so they can't leak information to each other. Use may_see_all_namespaces() helper that centralizes this policy until the nstree adapts. Link: https://patch.msgid.link/20260226-work-visibility-fixes-v1-1-d2c2853313bd@kernel.org Fixes: a1d220d9dafa ("nsfs: iterate through mount namespaces") Reviewed-by: Jeff Layton Cc: stable@kernel.org # v6.12+ Signed-off-by: Christian Brauner commit 4529e0015432977af3ecc3b9f940fc2a1ef1b265 Author: Anna Schumaker Date: Wed Feb 18 11:41:15 2026 -0500 NFS: Fix NFS KConfig typos Two issues were noticed after the NFS v4.0 KConfig changes were merged upstream. First, the text of CONFIG_NFS_V4 should not encourage people to select it if they are unsure. Second, the new CONFIG_NFS_V4_0 option should default to "on" instead of "off" to avoid breaking people's setups if they are using NFS v4.0. Reported-by: Niklas Cassel Reported-by: Geert Uytterhoeven Fixes: 4e0269352534 ("NFS: Add a way to disable NFS v4.0 via KConfig") Fixes: 7537db24806f ("NFS: Merge CONFIG_NFS_V4_1 with CONFIG_NFS_V4") Signed-off-by: Anna Schumaker commit 7b6275c80a0c81c5f8943272292dfe67730ce849 Author: Eric Badger Date: Mon Feb 23 10:28:55 2026 -0800 xprtrdma: Decrement re_receiving on the early exit paths In the event that rpcrdma_post_recvs() fails to create a work request (due to memory allocation failure, say) or otherwise exits early, we should decrement ep->re_receiving before returning. Otherwise we will hang in rpcrdma_xprt_drain() as re_receiving will never reach zero and the completion will never be triggered. On a system with high memory pressure, this can appear as the following hung task: INFO: task kworker/u385:17:8393 blocked for more than 122 seconds. Tainted: G S E 6.19.0 #3 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u385:17 state:D stack:0 pid:8393 tgid:8393 ppid:2 task_flags:0x4248060 flags:0x00080000 Workqueue: xprtiod xprt_autoclose [sunrpc] Call Trace: __schedule+0x48b/0x18b0 ? ib_post_send_mad+0x247/0xae0 [ib_core] schedule+0x27/0xf0 schedule_timeout+0x104/0x110 __wait_for_common+0x98/0x180 ? __pfx_schedule_timeout+0x10/0x10 wait_for_completion+0x24/0x40 rpcrdma_xprt_disconnect+0x444/0x460 [rpcrdma] xprt_rdma_close+0x12/0x40 [rpcrdma] xprt_autoclose+0x5f/0x120 [sunrpc] process_one_work+0x191/0x3e0 worker_thread+0x2e3/0x420 ? __pfx_worker_thread+0x10/0x10 kthread+0x10d/0x230 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x273/0x2b0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Fixes: 15788d1d1077 ("xprtrdma: Do not refresh Receive Queue while it is draining") Signed-off-by: Eric Badger Reviewed-by: Chuck Lever Signed-off-by: Anna Schumaker commit 3d17d76d1ffb139a7492317b196ee03c8eabc9dc Author: Jakub Kicinski Date: Fri Feb 27 09:07:45 2026 -0800 io_uring/zcrx: don't set rx_page_size when not requested The rx_buf_len parameter was recently added to the Rx zero-copy implementation. The expectation is that when not set system will maintain previous behavior and use the default buffer size (PAGE_SIZE). This works correctly at the iouring level, but we don't preserve the same "zero means default" semantics when registering the memory provider on the netdev. mp_param.rx_page_size is unconditionally set to PAGE_SIZE. This causes __net_mp_open_rxq() to check for QCFG_RX_PAGE_SIZE support in the driver, and return -EOPNOTSUPP for drivers that don't advertise it -- even though the user never asked for large buffers. Only set mp_param.rx_page_size when rx_buf_len was explicitly provided, so that the default page size path works on all zcrx-capable drivers. mlx5 and fbnic only support 4kB pages in the current release. Fixes: 795663b4d160 ("io_uring/zcrx: implement large rx buffer support") Signed-off-by: Jakub Kicinski Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 032e084f0d43fda78c33abfc704ac13a0891a6e7 Author: David Carlier Date: Fri Feb 27 18:43:09 2026 +0000 tools/sched_ext: fix strtoul() misuse in scx_hotplug_seq() scx_hotplug_seq() uses strtoul() but validates the result with a negative check (val < 0), which can never be true for an unsigned return value. Use the endptr mechanism to verify the entire string was consumed, and check errno == ERANGE for overflow detection. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit aed968f8a6cd60a4aa32b5e9c0973c95c443ef4e Merge: 962336b9ff822e e46f25f5a81f6f Author: Linus Torvalds Date: Fri Feb 27 10:52:57 2026 -0800 Merge tag 'cxl-fixes-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl fixes from Dave Jiang: - Fix incorrect usages of decoder flags - Validate payload size before accessing contents - Fix race condition when creating nvdimm objects - Fix deadlock on attach failure * tag 'cxl-fixes-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/region: Test CXL_DECODER_F_NORMALIZED_ADDRESSING as a bitmask cxl: Test CXL_DECODER_F_LOCK as a bitmask cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() cxl: Fix race of nvdimm_bus object when creating nvdimm objects cxl: Move devm_cxl_add_nvdimm_bridge() to cxl_pmem.ko cxl/port: Hold port host lock during dport adding. cxl/port: Introduce port_to_host() helper cxl/memdev: fix deadlock in cxl_memdev_autoremove() on attach failure commit 962336b9ff822e6b3288465106892bdcd2d577e1 Merge: 78d964c47f91c2 901084c51a0a8f Author: Linus Torvalds Date: Fri Feb 27 10:49:54 2026 -0800 Merge tag 'mmc-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Avoid bitfield RMW for claim/retune flags MMC host: - dw_mmc-rockchip: Fix runtime PM support for internal phase support - mmci: Fix device_node reference leak in of_get_dml_pipe_index() - sdhci-brcmstb: Use correct register offset for V1 pin_sel restore" * tag 'mmc-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: core: Avoid bitfield RMW for claim/retune flags mmc: sdhci-brcmstb: use correct register offset for V1 pin_sel restore mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() commit 78d964c47f91c22e9214956316743d2759cd0fd2 Merge: 530b0b61df5a28 3c4617117a2b76 Author: Linus Torvalds Date: Fri Feb 27 10:42:02 2026 -0800 Merge tag 'block-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: "Two sets of fixes, one for drbd, and one for the zoned loop driver" * tag 'block-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: zloop: check for spurious options passed to remove zloop: advertise a volatile write cache drbd: fix null-pointer dereference on local read error drbd: Replace deprecated strcpy with strscpy drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() commit 530b0b61df5a2824250060f2a1ab77d7501a747d Merge: 764a167f54a5ae 85f6c439a69afe Author: Linus Torvalds Date: Fri Feb 27 10:39:11 2026 -0800 Merge tag 'io_uring-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: "Just two minor patches in here, ensuring the use of READ_ONCE() for sqe field reading is consistent across the codebase. There were two missing cases, now they are covered too" * tag 'io_uring-7.0-20260227' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/timeout: READ_ONCE sqe->addr io_uring/cmd_net: use READ_ONCE() for ->addr3 read commit 764a167f54a5ae2dd7ad93267e69b296dcb948b7 Merge: 3feb464fb7784d 650b774cf94495 Author: Linus Torvalds Date: Fri Feb 27 10:21:06 2026 -0800 Merge tag 'xfs-fixes-7.0-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "Nothing reeeally stands out here: a few bug fixes, some refactoring to easily fit the bug fixes, and a couple cosmetic changes" * tag 'xfs-fixes-7.0-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: add static size checks for ioctl UABI xfs: remove duplicate static size checks xfs: Add comments for usages of some macros. xfs: Update lazy counters in xfs_growfs_rt_bmblock() xfs: Add a comment in xfs_log_sb() xfs: Fix xfs_last_rt_bmblock() xfs: don't report half-built inodes to fserror xfs: don't report metadata inodes to fserror xfs: fix potential pointer access race in xfs_healthmon_get xfs: fix xfs_group release bug in xfs_dax_notify_dev_failure xfs: fix xfs_group release bug in xfs_verify_report_losses xfs: fix copy-paste error in previous fix xfs: Fix error pointer dereference xfs: remove metafile inodes from the active inode stat xfs: cleanup inode counter stats xfs: fix code alignment issues in xfs_ondisk.c xfs: Replace &rtg->rtg_group with rtg_group() xfs: Refactoring the nagcount and delta calculation xfs: Replace ASSERT with XFS_IS_CORRUPT in xfs_rtcopy_summary() commit e31b556c0ba21f20c298aa61181b96541140b7b9 Author: Romain Sioen Date: Fri Feb 6 17:32:58 2026 +0100 HID: mcp2221: cancel last I2C command on read error When an I2C SMBus read operation fails, the MCP2221 internal state machine may not reset correctly, causing subsequent transactions to fail. By adding a short delay and explicitly cancelling the last command, we ensure the device is ready for the next operation. Fix an issue where i2cdetect was not able to detect all devices correctly on the bus. Signed-off-by: Romain Sioen Signed-off-by: Jiri Kosina commit 3feb464fb7784d09008dce6c95f895e815ee97d0 Merge: d5a8e4be465149 e9217ca77dc35b Author: Linus Torvalds Date: Fri Feb 27 09:54:02 2026 -0800 Merge tag 'slab-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Fix for spurious page allocation warnings on sheaf refill (Harry Yoo) - Fix for CONFIG_MEM_ALLOC_PROFILING_DEBUG warnings (Suren Baghdasaryan) - Fix for kernel-doc warning on ksize() (Sanjay Chitroda) - Fix to avoid setting slab->stride later than on slab allocation. Doesn't yet fix the reports from powerpc; debugging is making progress (Harry Yoo) * tag 'slab-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: initialize slab->stride early to avoid memory ordering issues mm/slub: drop duplicate kernel-doc for ksize() mm/slab: mark alloc tags empty for sheaves allocated with __GFP_NO_OBJ_EXT mm/slab: pass __GFP_NOWARN to refill_sheaf() if fallback is available commit d5a8e4be46514982c143a91549c678002b839a28 Merge: bbcb2cd6751a94 ec2cceadfae723 Author: Linus Torvalds Date: Fri Feb 27 09:42:17 2026 -0800 Merge tag 'gpio-fixes-for-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix memory leaks in shared GPIO management - normalize the return values of gpio_chip::get() in GPIO core on behalf of drivers that return invalid values (this is done because adding stricter sanitization of callback retvals led to breakages in existing users, we'll revert that once all are fixed) * tag 'gpio-fixes-for-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: normalize the return value of gc->get() on behalf of buggy drivers gpio: shared: fix memory leaks commit bbcb2cd6751a9457275728f7004600320703a788 Merge: 466d6175e3451f 71c1978ab6d2c6 Author: Linus Torvalds Date: Fri Feb 27 09:34:02 2026 -0800 Merge tag 'sound-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A bunch of small device-specific fixes. Mostly quirks and fix-ups for USB- and HD-audio at this time, in addition to a couple of ASoC AMD and Cirrus fixes" * tag 'sound-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits) ASoC: SDCA: Fix comments for sdca_irq_request() ALSA: us144mkii: Drop kernel-doc markers ALSA: usb: qcom: Correct parameter comment for uaudio_transfer_buffer_setup() ALSA: usb-audio: Drop superfluous kernel-doc markers ALSA: hda: cs35l56: Remove unnecessary struct cs_dsp_client_ops ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() ALSA: usb-audio: Use correct version for UAC3 header validation ALSA: hda/realtek: add quirk for Acer Nitro ANV15-51 ALSA: hda/intel: increase default bdl_pos_adj for Nvidia controllers ALSA: usb-audio: Use inclusive terms ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 ALSA: usb-audio: Check max frame size for implicit feedback mode, too ALSA: usb-audio: Cap the packet size pre-calculations ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table ASoC: cs42l43: Report insert for exotic peripherals ALSA: usb-audio: Skip clock selector for Focusrite devices ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices ALSA: usb-audio: Improve Focusrite sample rate filtering ALSA: hda/realtek: add quirk for Samsung Galaxy Book Flex (NT950QCT-A38A) ... commit 550bae2c0931dbb664a61b08c21cf156f0a5362a Author: Maíra Canal Date: Thu Feb 12 11:49:44 2026 -0300 pmdomain: bcm: bcm2835-power: Fix broken reset status read bcm2835_reset_status() has a misplaced parenthesis on every PM_READ() call. Since PM_READ(reg) expands to readl(power->base + (reg)), the expression: PM_READ(PM_GRAFX & PM_V3DRSTN) computes the bitwise AND of the register offset PM_GRAFX with the bitmask PM_V3DRSTN before using the result as a register offset, reading from the wrong MMIO address instead of the intended PM_GRAFX register. The same issue affects the PM_IMAGE cases. Fix by moving the closing parenthesis so PM_READ() receives only the register offset, and the bitmask is applied to the value returned by the read. Fixes: 670c672608a1 ("soc: bcm: bcm2835-pm: Add support for power domains under a new binding.") Signed-off-by: Maíra Canal Reviewed-by: Florian Fainelli Reviewed-by: Stefan Wahren Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 466d6175e3451fd7758928a1050bdab44f8ebc48 Merge: a75cb869a8ccc8 103d53eb6fb11c Author: Linus Torvalds Date: Fri Feb 27 08:56:07 2026 -0800 Merge tag 'drm-fixes-2026-02-27' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Regular fixes pull, amdxdna and amdgpu are the main ones, with a couple of intel fixes, then a scattering of fixes across drivers, nothing too major. i915/display: - Fix Panel Replay stuck with X during mode transitions on Panther Lake xe: - W/a fix for multi-cast registers - Fix xe_sync initialization issues amdgpu: - UserQ fixes - DC fix - RAS fixes - VCN 5 fix - Slot reset fix - Remove MES workaround that's no longer needed amdxdna: - deadlock fix - NULL ptr deref fix - suspend failure fix - OOB access fix - buffer overflow fix - input sanitiation fix - firmware loading fix dw-dp: - An error handling fix ethosu: - A binary shift overflow fix imx: - An error handling fix logicvc: - A dt node reference leak fix nouveau: - A WARN_ON removal samsung-dsim: - A memory leak fix tiny: - sharp-memory: NULL pointer deref fix vmwgfx: - A reference count and error handling fix" * tag 'drm-fixes-2026-02-27' of https://gitlab.freedesktop.org/drm/kernel: (39 commits) drm/amd: Disable MES LR compute W/A drm/amdgpu: Fix error handling in slot reset drm/amdgpu/vcn5: Add SMU dpm interface type drm/amdgpu: Fix locking bugs in error paths drm/amdgpu: Unlock a mutex before destroying it drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink drm/amdgpu: add upper bound check on user inputs in wait ioctl drm/amdgpu: add upper bound check on user inputs in signal ioctl drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl accel/amdxdna: Use a different name for latest firmware drm/client: Do not destroy NULL modes drm/gpusvm: Fix drm_gpusvm_pages_valid_unlocked() kernel-doc drm/xe/sync: Fix user fence leak on alloc failure drm/xe/sync: Cleanup partially initialized sync on parse failure drm/xe/wa: Steer RMW of MCR registers while building default LRC accel/amdxdna: Validate command buffer payload count accel/amdxdna: Prevent ubuf size overflow accel/amdxdna: Fix out-of-bounds memset in command slot handling accel/amdxdna: Fix command hang on suspended hardware context ... commit 39195990e4c093c9eecf88f29811c6de29265214 Author: Bjorn Helgaas Date: Fri Feb 27 06:10:08 2026 -0600 PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value fb82437fdd8c ("PCI: Change capability register offsets to hex") incorrectly converted the PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value from decimal 52 to hex 0x32: -#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52 /* v2 endpoints with link end here */ +#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 0x32 /* end of v2 EPs w/ link */ This broke PCI capabilities in a VMM because subsequent ones weren't DWORD-aligned. Change PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 to the correct value of 0x34. fb82437fdd8c was from Baruch Siach , but this was not Baruch's fault; it's a mistake I made when applying the patch. Fixes: fb82437fdd8c ("PCI: Change capability register offsets to hex") Reported-by: David Woodhouse Closes: https://lore.kernel.org/all/3ae392a0158e9d9ab09a1d42150429dd8ca42791.camel@infradead.org Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Wilczyński commit f505a45776d149632e3bd0b87f0da1609607161a Author: Thorsten Blum Date: Thu Feb 26 23:15:22 2026 +0100 smb: client: Use snprintf in cifs_set_cifscreds Replace unbounded sprintf() calls with the safer snprintf(). Avoid using magic numbers and use strlen() to calculate the key descriptor buffer size. Save the size in a local variable and reuse it for the bounded snprintf() calls. Remove CIFSCREDS_DESC_SIZE. Signed-off-by: Thorsten Blum Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 0f5197ea9a73a4c406c75e6d8af3a13f7f96ae89 Author: Keith Busch Date: Wed Feb 25 11:38:05 2026 -0800 nvme-multipath: fix leak on try_module_get failure We need to fall back to the synchronous removal if we can't get a reference on the module needed for the deferred removal. Fixes: 62188639ec16 ("nvme-multipath: introduce delayed removal of the multipath head node") Reviewed-by: Nilay Shroff Reviewed-by: John Garry Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 663eb8763c251dbcd0536b14ec134e63e4173348 Author: Arnd Bergmann Date: Wed Feb 4 17:41:58 2026 +0100 i3c: simplify combined i3c/i2c dependencies All combined i2c/i3c drivers appear to suffer from the same link time problem when CONFIG_I3C is set to 'm': arm-linux-gnueabi-ld: drivers/iio/magnetometer/mmc5633.o: in function `mmc5633_i3c_driver_init': mmc5633.c:(.init.text+0x30): undefined reference to `i3c_driver_register_with_owner' This was previously fixed every time by marking individual drivers as 'depends on I2C; depends on I3C || !I3C', but this gets tedious and is somewhat confusing. Add a Kconfig symbol 'I3C_OR_I2C' to help replace those dependencies, and use this in all the existing drivers that had already fixed it as well as the new mmc5633 driver. Reviewed-by: Jonathan Cameron Signed-off-by: Arnd Bergmann Acked-by: Guenter Roeck Acked-by: Jonathan Cameron Link: https://patch.msgid.link/20260204164216.544409-1-arnd@kernel.org Signed-off-by: Alexandre Belloni commit e9217ca77dc35b4978db0fe901685ddb3f1e223a Author: Harry Yoo Date: Mon Feb 23 16:58:09 2026 +0900 mm/slab: initialize slab->stride early to avoid memory ordering issues When alloc_slab_obj_exts() is called later (instead of during slab allocation and initialization), slab->stride and slab->obj_exts are updated after the slab is already accessible by multiple CPUs. The current implementation does not enforce memory ordering between slab->stride and slab->obj_exts. For correctness, slab->stride must be visible before slab->obj_exts. Otherwise, concurrent readers may observe slab->obj_exts as non-zero while stride is still stale. With stale slab->stride, slab_obj_ext() could return the wrong obj_ext. This could cause two problems: - obj_cgroup_put() is called on the wrong objcg, leading to a use-after-free due to incorrect reference counting [1] by decrementing the reference count more than it was incremented. - refill_obj_stock() is called on the wrong objcg, leading to a page_counter overflow [2] by uncharging more memory than charged. Fix this by unconditionally initializing slab->stride in alloc_slab_obj_exts_early(), before the need_slab_obj_exts() check. In the case of SLAB_OBJ_EXT_IN_OBJ, it is overridden in the function. This ensures updates to slab->stride become visible before the slab can be accessed by other CPUs via the per-node partial slab list (protected by spinlock with acquire/release semantics). Thanks to Shakeel Butt for pointing out this issue [3]. [vbabka@kernel.org: the bug reports [1] and [2] are not yet fully fixed, with investigation ongoing, but it is nevertheless a step in the right direction to only set stride once after allocating the slab and not change it later ] Fixes: 7a8e71bc619d ("mm/slab: use stride to access slabobj_ext") Reported-by: Venkat Rao Bagalkote Link: https://lore.kernel.org/lkml/ca241daa-e7e7-4604-a48d-de91ec9184a5@linux.ibm.com [1] Link: https://lore.kernel.org/all/ddff7c7d-c0c3-4780-808f-9a83268bbf0c@linux.ibm.com [2] Link: https://lore.kernel.org/linux-mm/aZu9G9mVIVzSm6Ft@hyeyoo [3] Signed-off-by: Harry Yoo Signed-off-by: Vlastimil Babka (SUSE) commit 81af9e40e2e4e1aa95f09fb34811760be6742c58 Author: Abel Vesa Date: Thu Feb 19 13:11:48 2026 +0200 phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4 According to internal documentation, on SM8650, when the PHY is configured in Gear 4, the QPHY_V6_PCS_UFS_PLL_CNTL register needs to have the same value as for Gear 5. At the moment, there is no board that comes with a UFS 3.x device, so this issue doesn't show up, but with the new Eliza SoC, which uses the same init sequence as SM8650, on the MTP board, the link startup fails with the current Gear 4 PCS table. So fix that by moving the entry into the PCS generic table instead, while keeping the value from Gear 5 configuration. Cc: stable@vger.kernel.org # v6.10 Fixes: b9251e64a96f ("phy: qcom: qmp-ufs: update SM8650 tables for Gear 4 & 5") Suggested-by: Nitin Rawat Signed-off-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Neil Armstrong Tested-by: Neil Armstrong # on SM8650-HDK Link: https://patch.msgid.link/20260219-phy-qcom-qmp-ufs-fix-sm8650-pcs-g4-table-v1-1-f136505b57f6@oss.qualcomm.com Signed-off-by: Vinod Koul commit 584b457f4166293bdfa50f930228e9fb91a38392 Author: Felix Gu Date: Thu Feb 12 18:39:19 2026 +0800 phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() The serdes device_node is obtained using of_get_child_by_name(), which increments the reference count. However, it is never put, leading to a reference leak. Add the missing of_node_put() calls to ensure the reference count is properly balanced. Fixes: 7ae14cf581f2 ("phy: ti: j721e-wiz: Implement DisplayPort mode to the wiz driver") Suggested-by: Vladimir Oltean Signed-off-by: Felix Gu Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260212-wiz-v2-1-6e8bd4cc7a4a@gmail.com Signed-off-by: Vinod Koul commit f0cf0a882a02dcf28547f32264f6fd37e9a7b147 Author: Yixun Lan Date: Mon Feb 16 23:26:53 2026 +0800 phy: k1-usb: add disconnect function support A disconnect status BIT of USB2 PHY need to be cleared, otherwise it will fail to work properly during next connection when devices connect to roothub directly. Fixes: fe4bc1a08638 ("phy: spacemit: support K1 USB2.0 PHY controller") Signed-off-by: Yixun Lan Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260216152653.25244-1-dlan@kernel.org Signed-off-by: Vinod Koul commit 6e3f4514e3b432871ac81717d24f56b441857f77 Author: Tvrtko Ursulin Date: Fri Feb 27 12:49:01 2026 +0000 drm/ttm: Fix ttm_pool_beneficial_order() return type Fix a nasty copy and paste bug, where the incorrect boolean return type of the ttm_pool_beneficial_order() helper had a consequence of avoiding direct reclaim too eagerly for drivers which use this feature (currently amdgpu). Signed-off-by: Tvrtko Ursulin Fixes: 7e9c548d3709 ("drm/ttm: Allow drivers to specify maximum beneficial TTM pool size") Cc: Christian König Cc: Thadeu Lima de Souza Cascardo Cc: dri-devel@lists.freedesktop.org Cc: # v6.19+ Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260227124901.3177-1-tvrtko.ursulin@igalia.com commit a258d843a3e4cb687da19437f8f81fee55ad7d35 Author: Vladimir Oltean Date: Thu Feb 26 20:28:53 2026 +0200 phy: lynx-28g: skip CDR lock workaround for lanes disabled in the device tree The blamed commit introduced support for specifying individual lanes as OF nodes in the device, and these can have status = "disabled". When that happens, for_each_available_child_of_node() skips them and lynx_28g_probe_lane() -> devm_phy_create() is not called, so lane->phy will be NULL. Yet it will be dereferenced in lynx_28g_cdr_lock_check(), resulting in a crash. This used to be well handled in v3 of that patch: https://lore.kernel.org/linux-phy/20250926180505.760089-14-vladimir.oltean@nxp.com/ but until v5 was merged, the logic to support per-lane OF nodes was split into a separate change, and the per-SoC compatible strings patch was deferred to a "part 2" set. The splitting was done improperly, and that handling of NULL lane->phy pointers was not integrated into the proper commit. Fixes: 7df7d58abbd6 ("phy: lynx-28g: support individual lanes as OF PHY providers") Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260226182853.1103616-1-vladimir.oltean@nxp.com Signed-off-by: Vinod Koul commit 48fafffcf29bb968c9dee6bf507c1e57d0ccb6b5 Author: Vladimir Oltean Date: Thu Feb 26 17:33:15 2026 +0200 phy: make PHY_COMMON_PROPS Kconfig symbol conditionally user-selectable Geert reports that enabling CONFIG_KUNIT_ALL_TESTS shouldn't enable features that aren't enabled without it. That isn't what "*all* tests" means, but as the prompt puts it, "All KUnit tests with satisfied dependencies". The impact is that enabling CONFIG_KUNIT_ALL_TESTS brings features which cannot be disabled as built-in into the kernel. Keep the pattern where consumer drivers have to "select PHY_COMMON_PROPS", but if KUNIT_ALL_TESTS is enabled, also make PHY_COMMON_PROPS user selectable, so it can be turned off. Modify PHY_COMMON_PROPS_TEST to depend on PHY_COMMON_PROPS rather than select it. Fixes: e7556b59ba65 ("phy: add phy_get_rx_polarity() and phy_get_tx_polarity()") Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/linux-phy/CAMuHMdUBaoYKNj52gn8DQeZFZ42Cvm6xT6fvo0-_twNv1k3Jhg@mail.gmail.com/ Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260226153315.3530378-1-vladimir.oltean@nxp.com Signed-off-by: Vinod Koul commit 377f8e788945d45b012ed9cfc35ca56c02e86cd8 Author: Denis Benato Date: Mon Feb 16 18:55:38 2026 +0100 HID: asus: add xg mobile 2023 external hardware support XG mobile stations have the 0x5a endpoint and has to be initialized: add them to hid-asus. Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina commit 3350c2b3f2b8a3b985a020a4ef4f2f050a4b6a1d Author: Randy Dunlap Date: Wed Feb 25 21:12:29 2026 -0800 platform_data/mlxreg: mlxreg.h: fix all kernel-doc warnings Use the correct kernel-doc format & notation to eliminate kernel-doc warnings: Warning: include/linux/platform_data/mlxreg.h:24 Enum value 'MLX_WDT_TYPE1' not described in enum 'mlxreg_wdt_type' Warning: include/linux/platform_data/mlxreg.h:24 Enum value 'MLX_WDT_TYPE2' not described in enum 'mlxreg_wdt_type' Warning: include/linux/platform_data/mlxreg.h:24 Enum value 'MLX_WDT_TYPE3' not described in enum 'mlxreg_wdt_type' Warning: include/linux/platform_data/mlxreg.h:37 bad line: PHYs ready / unready state; Warning: include/linux/platform_data/mlxreg.h:153 struct member 'np' not described in 'mlxreg_core_data' Warning: include/linux/platform_data/mlxreg.h:153 struct member 'hpdev' not described in 'mlxreg_core_data' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260226051232.549537-1-rdunlap@infradead.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c55b84fa567ed33bc651675bcaf8d53bd12d910a Author: Denis Benato Date: Thu Feb 26 15:19:44 2026 +0100 platform/x86: asus-armoury: add support for FA401UM Add TDP data for laptop model FA401UM. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260226141944.352923-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 622cc8d078e5d7586f0e40dd7aea515a946da48c Author: Denis Benato Date: Thu Feb 26 15:19:43 2026 +0100 platform/x86: asus-armoury: add support for GX650RX Add TDP data for laptop model GX650RX. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260226141944.352923-2-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 916727cfdb72cd01fef3fa6746e648f8cb70e713 Author: Mario Limonciello Date: Wed Feb 25 15:06:46 2026 -0600 platform/x86: hp-bioscfg: Support allocations of larger data Some systems have much larger amounts of enumeration attributes than have been previously encountered. This can lead to page allocation failures when using kcalloc(). Switch over to using kvcalloc() to allow larger allocations. Fixes: 6b2770bfd6f92 ("platform/x86: hp-bioscfg: enum-attributes") Cc: stable@vger.kernel.org Reported-by: Paul Kerry Tested-by: Paul Kerry Closes: https://bugs.debian.org/1127612 Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260225210646.59381-1-mario.limonciello@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit cd0883055b04586770dab43c64159348bf480a3e Author: Antheas Kapenekakis Date: Mon Feb 23 19:29:53 2026 +0100 platform/x86: oxpec: Add support for Aokzoe A2 Pro Aokzoe A2 Pro is an older device that the oxpec driver is missing the quirk for. It has the same behavior as the AOKZOE A1 devices. Add a quirk for it to the oxpec driver. Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260223183004.2696892-5-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2a3b4a8c10a64a62c4243007139d253dc1324dfd Author: Antheas Kapenekakis Date: Mon Feb 23 19:29:52 2026 +0100 platform/x86: oxpec: Add support for OneXPlayer X1 Air X1 Air is an X1 variant with a newer Intel chipset. It uses the same registers as the X1. Add a quirk for it to the oxpec driver. Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260223183004.2696892-4-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4049c46edb5d44c0de045f6f504371705dd603dd Author: Antheas Kapenekakis Date: Mon Feb 23 19:29:51 2026 +0100 platform/x86: oxpec: Add support for OneXPlayer X1z X1z is a variant of OneXPlayer X1 A with 8840U. It seems that only one user has this one. Add a quirk for it to the oxpec driver. Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260223183004.2696892-3-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3385ea97c14d271dcb0c6e6fcf16972f819eecd8 Author: Antheas Kapenekakis Date: Mon Feb 23 19:29:50 2026 +0100 platform/x86: oxpec: Add support for OneXPlayer APEX OneXPlayer Apex is a new Strix Halo handheld. It uses the same registers as the OneXPlayer Fly devices. Add a quirk for it to the oxpec driver. Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260223183004.2696892-2-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 24d87712727a5017ad142d63940589a36cd25647 Author: Ariel Silver Date: Sat Feb 21 15:26:00 2026 +0100 media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer. Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Ariel Silver Signed-off-by: Ariel Silver Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab commit 16fdabe143fce2cbf89139677728e17e21b46c28 Author: Tzung-Bi Shih Date: Thu Feb 5 09:28:40 2026 +0000 gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Since commit aab5c6f20023 ("gpio: set device type for GPIO chips"), `gdev->dev.release` is unset. As a result, the reference count to `gdev->dev` isn't dropped on the error handling paths. Drop the reference on errors. Also reorder the instructions to make the error handling simpler. Now gpiochip_add_data_with_key() roughly looks like: >>> Some memory allocation. Go to ERR ZONE 1 on errors. >>> device_initialize(). gpiodev_release() takes over the responsibility for freeing the resources of `gdev->dev`. The subsequent error handling paths shouldn't go through ERR ZONE 1 again which leads to double free. >>> Some initialization mainly on `gdev`. >>> The rest of initialization. Go to ERR ZONE 2 on errors. >>> Chip registration success and exit. >>> ERR ZONE 2. gpio_device_put() and exit. >>> ERR ZONE 1. Cc: stable@vger.kernel.org Fixes: aab5c6f20023 ("gpio: set device type for GPIO chips") Reviewed-by: Linus Walleij Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260205092840.2574840-1-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit a0b9b0f1433c845bda708753db32befef78e0f1f Author: Alice Ryhl Date: Wed Feb 18 15:13:23 2026 +0000 rust_binder: use lock_vma_under_rcu() in use_page_slow() There's no reason to lock the whole mm when we are doing operations on the vma if we can help it, so to reduce contention, use the lock_vma_under_rcu() abstraction. Signed-off-by: Alice Ryhl Reviewed-by: Jann Horn Reviewed-by: Liam R. Howlett Link: https://patch.msgid.link/20260218-binder-vma-rcu-v1-1-8bd45b2b1183@google.com Signed-off-by: Greg Kroah-Hartman commit 2e303f0febb65a434040774b793ba8356698802b Author: Alice Ryhl Date: Tue Feb 24 18:16:39 2026 +0000 rust_binder: call set_notification_done() without proc lock Consider the following sequence of events on a death listener: 1. The remote process dies and sends a BR_DEAD_BINDER message. 2. The local process invokes the BC_CLEAR_DEATH_NOTIFICATION command. 3. The local process then invokes the BC_DEAD_BINDER_DONE. Then, the kernel will reply to the BC_DEAD_BINDER_DONE command with a BR_CLEAR_DEATH_NOTIFICATION_DONE reply using push_work_if_looper(). However, this can result in a deadlock if the current thread is not a looper. This is because dead_binder_done() still holds the proc lock during set_notification_done(), which called push_work_if_looper(). Normally, push_work_if_looper() takes the thread lock, which is fine to take under the proc lock. But if the current thread is not a looper, then it falls back to delivering the reply to the process work queue, which involves taking the proc lock. Since the proc lock is already held, this is a deadlock. Fix this by releasing the proc lock during set_notification_done(). It was not intentional that it was held during that function to begin with. I don't think this ever happens in Android because BC_DEAD_BINDER_DONE is only invoked in response to BR_DEAD_BINDER messages, and the kernel always delivers BR_DEAD_BINDER to a looper. So there's no scenario where Android userspace will call BC_DEAD_BINDER_DONE on a non-looper thread. Cc: stable Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: syzbot+c8287e65a57a89e7fb72@syzkaller.appspotmail.com Tested-by: syzbot+c8287e65a57a89e7fb72@syzkaller.appspotmail.com Signed-off-by: Alice Ryhl Reviewed-by: Gary Guo Reviewed-by: Andreas Hindborg Link: https://patch.msgid.link/20260224-binder-dead-binder-done-proc-lock-v1-1-bbe1b8a6e74a@google.com Signed-off-by: Greg Kroah-Hartman commit 4cb9e13fec0de7c942f5f927469beb8e48ddd20f Author: Alice Ryhl Date: Wed Feb 18 11:53:27 2026 +0000 rust_binder: avoid reading the written value in offsets array When sending a transaction, its offsets array is first copied into the target proc's vma, and then the values are read back from there. This is normally fine because the vma is a read-only mapping, so the target process cannot change the value under us. However, if the target process somehow gains the ability to write to its own vma, it could change the offset before it's read back, causing the kernel to misinterpret what the sender meant. If the sender happens to send a payload with a specific shape, this could in the worst case lead to the receiver being able to privilege escalate into the sender. The intent is that gaining the ability to change the read-only vma of your own process should not be exploitable, so remove this TOCTOU read even though it's unexploitable without another Binder bug. Cc: stable Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: Jann Horn Reviewed-by: Jann Horn Signed-off-by: Alice Ryhl Acked-by: Liam R. Howlett Link: https://patch.msgid.link/20260218-binder-vma-check-v2-2-60f9d695a990@google.com Signed-off-by: Greg Kroah-Hartman commit 8ef2c15aeae07647f530d30f6daaf79eb801bcd1 Author: Alice Ryhl Date: Wed Feb 18 11:53:26 2026 +0000 rust_binder: check ownership before using vma When installing missing pages (or zapping them), Rust Binder will look up the vma in the mm by address, and then call vm_insert_page (or zap_page_range_single). However, if the vma is closed and replaced with a different vma at the same address, this can lead to Rust Binder installing pages into the wrong vma. By installing the page into a writable vma, it becomes possible to write to your own binder pages, which are normally read-only. Although you're not supposed to be able to write to those pages, the intent behind the design of Rust Binder is that even if you get that ability, it should not lead to anything bad. Unfortunately, due to another bug, that is not the case. To fix this, store a pointer in vm_private_data and check that the vma returned by vma_lookup() has the right vm_ops and vm_private_data before trying to use the vma. This should ensure that Rust Binder will refuse to interact with any other VMA. The plan is to introduce more vma abstractions to avoid this unsafe access to vm_ops and vm_private_data, but for now let's start with the simplest possible fix. C Binder performs the same check in a slightly different way: it provides a vm_ops->close that sets a boolean to true, then checks that boolean after calling vma_lookup(), but this is more fragile than the solution in this patch. (We probably still want to do both, but the vm_ops->close callback will be added later as part of the follow-up vma API changes.) It's still possible to remap the vma so that pages appear in the right vma, but at the wrong offset, but this is a separate issue and will be fixed when Rust Binder gets a vm_ops->close callback. Cc: stable Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: Jann Horn Reviewed-by: Jann Horn Signed-off-by: Alice Ryhl Acked-by: Danilo Krummrich Acked-by: Liam R. Howlett Link: https://patch.msgid.link/20260218-binder-vma-check-v2-1-60f9d695a990@google.com Signed-off-by: Greg Kroah-Hartman commit 4fc87c240b8f30e22b7ebaae29d57105589e1c0b Author: Carlos Llamas Date: Tue Feb 10 23:28:20 2026 +0000 rust_binder: fix oneway spam detection The spam detection logic in TreeRange was executed before the current request was inserted into the tree. So the new request was not being factored in the spam calculation. Fix this by moving the logic after the new range has been inserted. Also, the detection logic for ArrayRange was missing altogether which meant large spamming transactions could get away without being detected. Fix this by implementing an equivalent low_oneway_space() in ArrayRange. Note that I looked into centralizing this logic in RangeAllocator but iterating through 'state' and 'size' got a bit too complicated (for me) and I abandoned this effort. Cc: stable Cc: Alice Ryhl Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Signed-off-by: Carlos Llamas Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260210232949.3770644-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit be11a537224d72b906db6b98510619770298c8a4 Author: Chintan Vankar Date: Tue Feb 24 23:43:59 2026 +0530 net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table In the current implementation, flushing multicast entries in MAC mode incorrectly deletes entries for all ports instead of only the target port, disrupting multicast traffic on other ports. The cause is adding multicast entries by setting only host port bit, and not setting the MAC port bits. Fix this by setting the MAC port's bit in the port mask while adding the multicast entry. Also fix the flush logic to preserve the host port bit during removal of MAC port and free ALE entries when mask contains only host port. Fixes: 5c50a856d550 ("drivers: net: ethernet: cpsw: add multicast address to ALE table") Signed-off-by: Chintan Vankar Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260224181359.2055322-1-c-vankar@ti.com Signed-off-by: Jakub Kicinski commit 7e5b450c490ada6f70e08bbd913f0981d33a5a1a Merge: 2ef2b20cf4e04a 13540021be228d Author: Jakub Kicinski Date: Thu Feb 26 19:24:32 2026 -0800 Merge branch 'bridge-check-relevant-options-in-vlan-range-grouping' Danielle Ratson says: ==================== bridge: Check relevant options in VLAN range grouping The br_vlan_opts_eq_range() function determines if consecutive VLANs can be grouped together in a range for compact netlink notifications. It currently checks state, tunnel info, and multicast router configuration, but misses two categories of per-VLAN options that affect the output: 1. User-visible priv_flags (neigh_suppress, mcast_enabled) 2. Port multicast context options (mcast_max_groups, mcast_n_groups) When VLANs have different settings for these options, they are incorrectly grouped into ranges, causing netlink notifications to report only one VLAN's settings for the entire range. Fix by checking priv_flags equality, but only for flags that affect netlink output (BR_VLFLAG_NEIGH_SUPPRESS_ENABLED and BR_VLFLAG_MCAST_ENABLED), and comparing multicast context options (mcast_max_groups, mcast_n_groups). Add a test with four test cases for each option, to ensure that VLANs with different values are not grouped into ranges and VLANs with matching values are properly grouped together. ==================== Link: https://patch.msgid.link/20260225143956.3995415-1-danieller@nvidia.com Signed-off-by: Jakub Kicinski commit 13540021be228dcda63d02b2245ce8dad01d8473 Author: Danielle Ratson Date: Wed Feb 25 16:39:56 2026 +0200 selftests: net: Add bridge VLAN range grouping tests Add a new test file bridge_vlan_dump.sh with four test cases that verify VLANs with different per-VLAN options are not incorrectly grouped into ranges in the dump output. The tests verify the kernel's br_vlan_opts_eq_range() function correctly prevents VLAN range grouping when neigh_suppress, mcast_max_groups, mcast_n_groups, or mcast_enabled options differ. Each test verifies that VLANs with different option values appear as individual entries rather than ranges, and that VLANs with matching values are properly grouped together. Example output: $ ./bridge_vlan_dump.sh TEST: VLAN range grouping with neigh_suppress [ OK ] TEST: VLAN range grouping with mcast_max_groups [ OK ] TEST: VLAN range grouping with mcast_n_groups [ OK ] TEST: VLAN range grouping with mcast_enabled [ OK ] Signed-off-by: Danielle Ratson Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260225143956.3995415-3-danieller@nvidia.com Signed-off-by: Jakub Kicinski commit 93c9475c04acad2457a7e7ea4e3ec40a6e6d94a7 Author: Danielle Ratson Date: Wed Feb 25 16:39:55 2026 +0200 bridge: Check relevant per-VLAN options in VLAN range grouping The br_vlan_opts_eq_range() function determines if consecutive VLANs can be grouped together in a range for compact netlink notifications. It currently checks state, tunnel info, and multicast router configuration, but misses two categories of per-VLAN options that affect the output: 1. User-visible priv_flags (neigh_suppress, mcast_enabled) 2. Port multicast context (mcast_max_groups, mcast_n_groups) When VLANs have different settings for these options, they are incorrectly grouped into ranges, causing netlink notifications to report only one VLAN's settings for the entire range. Fix by checking priv_flags equality, but only for flags that affect netlink output (BR_VLFLAG_NEIGH_SUPPRESS_ENABLED and BR_VLFLAG_MCAST_ENABLED), and comparing multicast context (mcast_max_groups and mcast_n_groups). Example showing the bugs before the fix: $ bridge vlan set vid 10 dev dummy1 neigh_suppress on $ bridge vlan set vid 11 dev dummy1 neigh_suppress off $ bridge -d vlan show dev dummy1 port vlan-id dummy1 10-11 ... neigh_suppress on $ bridge vlan set vid 10 dev dummy1 mcast_max_groups 100 $ bridge vlan set vid 11 dev dummy1 mcast_max_groups 200 $ bridge -d vlan show dev dummy1 port vlan-id dummy1 10-11 ... mcast_max_groups 100 After the fix, VLANs 10 and 11 are shown as separate entries with their correct individual settings. Fixes: a1aee20d5db2 ("net: bridge: Add netlink knobs for number / maximum MDB entries") Fixes: 83f6d600796c ("bridge: vlan: Allow setting VLAN neighbor suppression state") Signed-off-by: Danielle Ratson Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260225143956.3995415-2-danieller@nvidia.com Signed-off-by: Jakub Kicinski commit 2ef2b20cf4e04ac8a6ba68493f8780776ff84300 Author: Eric Dumazet Date: Wed Feb 25 13:15:47 2026 +0000 net: annotate data-races around sk->sk_{data_ready,write_space} skmsg (and probably other layers) are changing these pointers while other cpus might read them concurrently. Add corresponding READ_ONCE()/WRITE_ONCE() annotations for UDP, TCP and AF_UNIX. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Reported-by: syzbot+87f770387a9e5dc6b79b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/699ee9fc.050a0220.1cd54b.0009.GAE@google.com/ Signed-off-by: Eric Dumazet Cc: Daniel Borkmann Cc: John Fastabend Cc: Jakub Sitnicki Cc: Willem de Bruijn Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260225131547.1085509-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 754a3d081aa205e86af5f889c947157060340185 Merge: e35626f610f3d2 cfc83a3c71517b Author: Jakub Kicinski Date: Thu Feb 26 19:15:08 2026 -0800 Merge tag 'batadv-net-pullrequest-20260225' of https://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - Avoid double-rtnl_lock ELP metric worker, by Sven Eckelmann * tag 'batadv-net-pullrequest-20260225' of https://git.open-mesh.org/linux-merge: batman-adv: Avoid double-rtnl_lock ELP metric worker ==================== Link: https://patch.msgid.link/20260225084614.229077-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit e35626f610f3d2b7953ccddf6a77453da22b3a9e Author: Davide Caratti Date: Tue Feb 24 21:28:32 2026 +0100 net/sched: ets: fix divide by zero in the offload path Offloading ETS requires computing each class' WRR weight: this is done by averaging over the sums of quanta as 'q_sum' and 'q_psum'. Using unsigned int, the same integer size as the individual DRR quanta, can overflow and even cause division by zero, like it happened in the following splat: Oops: divide error: 0000 [#1] SMP PTI CPU: 13 UID: 0 PID: 487 Comm: tc Tainted: G E 6.19.0-virtme #45 PREEMPT(full) Tainted: [E]=UNSIGNED_MODULE Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets] Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44 RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246 RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660 RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000 FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0 Call Trace: ets_qdisc_change+0x870/0xf40 [sch_ets] qdisc_create+0x12b/0x540 tc_modify_qdisc+0x6d7/0xbd0 rtnetlink_rcv_msg+0x168/0x6b0 netlink_rcv_skb+0x5c/0x110 netlink_unicast+0x1d6/0x2b0 netlink_sendmsg+0x22e/0x470 ____sys_sendmsg+0x38a/0x3c0 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x111/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f440b81c77e Code: 4d 89 d8 e8 d4 bc 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa RSP: 002b:00007fff951e4c10 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000481820 RCX: 00007f440b81c77e RDX: 0000000000000000 RSI: 00007fff951e4cd0 RDI: 0000000000000003 RBP: 00007fff951e4c20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff951f4fa8 R13: 00000000699ddede R14: 00007f440bb01000 R15: 0000000000486980 Modules linked in: sch_ets(E) netdevsim(E) ---[ end trace 0000000000000000 ]--- RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets] Code: e4 45 31 ff eb 03 41 89 c7 41 89 cb 89 ce 83 f9 0f 0f 87 b7 00 00 00 45 8b 08 31 c0 45 01 cc 45 85 c9 74 09 41 6b c4 64 31 d2 <41> f7 f2 89 c2 44 29 fa 45 89 df 41 83 fb 0f 0f 87 c7 00 00 00 44 RSP: 0018:ffffd0a180d77588 EFLAGS: 00010246 RAX: 00000000ffffff38 RBX: ffff8d3d482ca000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffd0a180d77660 RBP: ffffd0a180d77690 R08: ffff8d3d482ca2d8 R09: 00000000fffffffe R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffe R13: ffff8d3d472f2000 R14: 0000000000000003 R15: 0000000000000000 FS: 00007f440b6c2740(0000) GS:ffff8d3dc9803000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000003cdd2000 CR3: 0000000007b58002 CR4: 0000000000172ef0 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x30000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]--- Fix this using 64-bit integers for 'q_sum' and 'q_psum'. Cc: stable@vger.kernel.org Fixes: d35eb52bd2ac ("net: sch_ets: Make the ETS qdisc offloadable") Signed-off-by: Davide Caratti Reviewed-by: Jamal Hadi Salim Reviewed-by: Petr Machata Link: https://patch.msgid.link/28504887df314588c7255e9911769c36f751edee.1771964872.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 2f37dc436d4e61ff7ae0b0353cf91b8c10396e4d Author: Thorsten Blum Date: Thu Feb 26 22:28:45 2026 +0100 smb: client: Don't log plaintext credentials in cifs_set_cifscreds When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing credentials. Fixes: 8a8798a5ff90 ("cifs: fetch credentials out of keyring for non-krb5 auth multiuser mounts") Cc: stable@vger.kernel.org Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Thorsten Blum Signed-off-by: Steve French commit d9d1e319b39ea685ede59319002d567c159d23c3 Author: Paulo Alcantara Date: Wed Feb 25 21:34:55 2026 -0300 smb: client: fix broken multichannel with krb5+signing When mounting a share with 'multichannel,max_channels=n,sec=krb5i', the client was duplicating signing key for all secondary channels, thus making the server fail all commands sent from secondary channels due to bad signatures. Every channel has its own signing key, so when establishing a new channel with krb5 auth, make sure to use the new session key as the derived key to generate channel's signing key in SMB2_auth_kerberos(). Repro: $ mount.cifs //srv/share /mnt -o multichannel,max_channels=4,sec=krb5i $ sleep 5 $ umount /mnt $ dmesg ... CIFS: VFS: sign fail cmd 0x5 message id 0x2 CIFS: VFS: \\srv SMB signature verification returned error = -13 CIFS: VFS: sign fail cmd 0x5 message id 0x2 CIFS: VFS: \\srv SMB signature verification returned error = -13 CIFS: VFS: sign fail cmd 0x4 message id 0x2 CIFS: VFS: \\srv SMB signature verification returned error = -13 Reported-by: Xiaoli Feng Reviewed-by: Enzo Matsumiya Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 4fc3a433c13944ee5766ec5b9bf6f1eb4d29b880 Author: Paulo Alcantara Date: Mon Feb 23 13:34:35 2026 -0300 smb: client: use atomic_t for mnt_cifs_flags Use atomic_t for cifs_sb_info::mnt_cifs_flags as it's currently accessed locklessly and may be changed concurrently in mount/remount and reconnect paths. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit a75cb869a8ccc88b0bc7a44e1597d9c7995c56e5 Merge: 69062f234a2837 6b4f875aac344c Author: Linus Torvalds Date: Thu Feb 26 16:01:18 2026 -0800 Merge tag 'v7.0-rc1-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - auth security improvement - fix potential buffer overflow in smbdirect negotiation * tag 'v7.0-rc1-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() ksmbd: Compare MACs in constant time commit 994d5dfa4e670087ef92cfc60ee57102ffc8ef38 Merge: dceddeecce3f4b 9990cd4f8827bd Author: Greg Kroah-Hartman Date: Thu Feb 26 15:48:29 2026 -0800 Merge tag 'iio-fixes-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into work-linus Jonathan writes: IIO: 1st set of fixes for the 7.0 cycle Usual mixed bag of ancient bugs that have been discovered and more recent stuff. core - Cleanup a wait_queue if a driver is removed at exacty the wrong moment. adi,adf4377 - Check correct masks when waiting for reset to complete. adi,adis - Fix a NULL pointer dereference if ops not provided to adis_init() bosch,bme680 - Fix typo in value used to calculate measurement wait duration. infineon,tlv493d - Drop incorrect shifting of some bits for x-axis invensense,icm42600 - Fix corner case of output data rate being set to the value it already has which resulted in waiting for ever for a flag to say the update was completed. - Fix a case where the buffer is turned off whilst ODR switch is in progress. invensense,icm45600 - Interrupt 1 drive bit was inverted. - Fix a underflow for regulator put warning if probe fails invensense,mpu9150 - Work around a hardware quirk where reading from irq status is not sufficient to acknowledge an interrupt. maxim,ds4424 - Reject -128 as a possible raw value as it's out of range with the sign / magnitude encoding used by this chip. microchip,mcp4131 - Shift the wiper value only once. rohm,bh1780 - Fix a runtime reference count issue on an error path. sensiron,sps30 - Fix two buffer size issues due to sizeof() wrong thing. tyhx,hx9023s - Ensure count used by __counted_by is set before accessing the buffer. - Avoid a potential division by zero. * tag 'iio-fixes-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: imu: adis: Fix NULL pointer dereference in adis_init iio: imu: inv_icm45600: fix regulator put warning when probe fails iio: buffer: Fix wait_queue not being removed iio: gyro: mpu3050-core: fix pm_runtime error handling iio: gyro: mpu3050-i2c: fix pm_runtime error handling iio: adc: ad7768-1: Fix ERR_PTR dereference in ad7768_fill_scale_tbl iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() iio: magnetometer: tlv493d: remove erroneous shift in X-axis data iio: proximity: hx9023s: Protect against division by zero in set_samp_freq iio: proximity: hx9023s: fix assignment order for __counted_by iio: chemical: bme680: Fix measurement wait duration calculation iio: dac: ds4424: reject -128 RAW value iio: imu: inv_icm45600: fix INT1 drive bit inverted iio: potentiometer: mcp4131: fix double application of wiper shift iio: imu: inv-mpu9150: fix irq ack preventing irq storms iio: frequency: adf4377: Fix duplicated soft reset mask iio: light: bh1780: fix PM runtime leak on error path iio: imu: inv_icm42600: fix odr switch when turning buffer off iio: imu: inv_icm42600: fix odr switch to the same value commit dceddeecce3f4baa497bbb9c2a1edfb095655ac7 Merge: 6de23f81a5e08b c45f7263100cec Author: Greg Kroah-Hartman Date: Thu Feb 26 15:47:15 2026 -0800 Merge tag 'stratix10_rsu_fix_for_v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into work-linus Dinh writes: firmware: stratix10-rsu: fix NULL pointer dereference when RSU is disabled - Fix a kernel panic that happens in the driver when the First Stage Boot Loader has not enabled the Remote System Update(RSU). * tag 'stratix10_rsu_fix_for_v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled commit 69062f234a2837d2302a41c2ba125521630deea8 Merge: 944e15f200475d 410aed670cddac Author: Linus Torvalds Date: Thu Feb 26 15:27:41 2026 -0800 Merge tag 'mm-hotfixes-stable-2026-02-26-14-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "12 hotfixes. 7 are cc:stable. 8 are for MM. All are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-02-26-14-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS: update Yosry Ahmed's email address mailmap: add entry for Daniele Alessandrelli mm: fix NULL NODE_DATA dereference for memoryless nodes on boot mm/tracing: rss_stat: ensure curr is false from kthread context mm/kfence: fix KASAN hardware tag faults during late enablement mm/damon/core: disallow non-power of two min_region_sz Squashfs: check metadata block offset is within range MAINTAINERS, mailmap: update e-mail address for Vlastimil Babka liveupdate: luo_file: remember retrieve() status mm: thp: deny THP for files on anonymous inodes mm: change vma_alloc_folio_noprof() macro to inline function mm/kfence: disable KFENCE upon KASAN HW tags enablement commit 103d53eb6fb11cfc3d502eb7b6efa706e139b947 Merge: 82a499d2cae693 6b0d812971370c Author: Dave Airlie Date: Fri Feb 27 09:19:41 2026 +1000 Merge tag 'amd-drm-fixes-7.0-2026-02-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-02-26: amdgpu: - UserQ fixes - DC fix - RAS fixes - VCN 5 fix - Slot reset fix - Remove MES workaround that's no longer needed Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260226161330.3549393-1-alexander.deucher@amd.com commit 944e15f200475d530096cba489833dc6dcd8d1e1 Merge: e094883b508bbc d5b5e8149af0f5 Author: Linus Torvalds Date: Thu Feb 26 15:19:16 2026 -0800 Merge tag 'dma-mapping-7.0-2026-02-26' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two DMA-mapping fixes for the recently merged API rework (Jiri Pirko and Stian Halseth)" * tag 'dma-mapping-7.0-2026-02-26' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: sparc: Fix page alignment in dma mapping dma-mapping: avoid random addr value print out on error path commit e96493229a6399e902062213c6381162464cdd50 Author: Alain Volmat Date: Tue Feb 24 16:09:22 2026 +0100 spi: stm32: fix missing pointer assignment in case of dma chaining Commit c4f2c05ab029 ("spi: stm32: fix pointer-to-pointer variables usage") introduced a regression since dma descriptors generated as part of the stm32_spi_prepare_rx_dma_mdma_chaining function are not well propagated to the caller function, leading to mdma-dma chaining being no more functional. Fixes: c4f2c05ab029 ("spi: stm32: fix pointer-to-pointer variables usage") Signed-off-by: Alain Volmat Acked-by: Antonio Quartulli Link: https://patch.msgid.link/20260224-spi-stm32-chaining-fix-v1-1-5da7a4851b66@foss.st.com Signed-off-by: Mark Brown commit 82a499d2cae69341191447de5e0bf35282676892 Merge: 5e061aac4c0c9d 0879c3f04f67e2 Author: Dave Airlie Date: Fri Feb 27 09:13:40 2026 +1000 Merge tag 'drm-xe-fixes-2026-02-26' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - W/a fix for multi-cast registers (Roper) - Fix xe_sync initialization issues (Shuicheng) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aaBGHy_0RLGGIBP5@intel.com commit e094883b508bbcb54f9dfbbd4cdae66c25d86c81 Merge: db5781c407dde9 3d9b8b00da184f Author: Linus Torvalds Date: Thu Feb 26 14:45:29 2026 -0800 Merge tag 'acpi-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "New platform quirks for two systems: - Add a quirk for Lenovo G70-35 to save the ACPI NVS memory on system suspend (Piotr Mazek) - Add a DMI quirk for Acer Aspire One D255 to work around a backlight issue by returning false to _OSI("Windows 2009") (Sofia Schneider)" * tag 'acpi-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: OSI: Add DMI quirk for Acer Aspire One D255 ACPI: PM: Save NVS memory on Lenovo G70-35 commit b6c3af46c26f2d07c10a1452adc34b821719327e Author: Andy Shevchenko Date: Mon Feb 23 19:06:51 2026 +0100 pinctrl: cy8c95x0: Don't miss reading the last bank registers When code had been changed to use for_each_set_clump8(), it mistakenly switched from chip->nport to chip->tpin since the cy8c9540 and cy8c9560 have a 4-pin gap. This, in particular, led to the missed read of the last bank interrupt status register and hence missing interrupts on those pins. Restore the upper limit in for_each_set_clump8() to take into consideration that gap. Fixes: 83e29a7a1fdf ("pinctrl: cy8c95x0; Switch to use for_each_set_clump8()") Cc: stable@vger.kernel.org Signed-off-by: Andy Shevchenko Signed-off-by: Linus Walleij commit db5781c407dde9f1f037d312c8e0ca986f661e1a Merge: c45be7c4206593 b78030d0f10570 Author: Linus Torvalds Date: Thu Feb 26 14:40:21 2026 -0800 Merge tag 'pm-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix two intel_pstate driver issues causing it to crash on sysfs attribute accesses when some CPUs in the system are offline, finalize changes related to turning pm_runtime_put() into a void function, and update Daniel Lezcano's contact information: - Fix two issues in the intel_pstate driver causing it to crash when its sysfs interface is used on a system with some offline CPUs (David Arcari, Srinivas Pandruvada) - Update the last user of the pm_runtime_put() return value to discard it and turn pm_runtime_put() into a void function (Rafael Wysocki) - Update Daniel Lezcano's contact information in MAINTAINERS and .mailmap (Daniel Lezcano)" * tag 'pm-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: MAINTAINERS: Update contact with the kernel.org address cpufreq: intel_pstate: Fix crash during turbo disable cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() PM: runtime: Change pm_runtime_put() return type to void pmdomain: imx: gpcv2: Discard pm_runtime_put() return value commit dd677d0598387ea623820ab2bd0e029c377445a3 Author: Justin Tee Date: Thu Dec 4 12:26:13 2025 -0800 nvmet-fcloop: Check remoteport port_state before calling done callback In nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when remoteport->port_state is FC_OBJSTATE_ONLINE. Otherwise, the nvme_fc_xmt_ls_rsp's LLDD call to lport->ops->xmt_ls_rsp is expected to fail and the nvme-fc transport layer itself will directly call nvme_fc_xmt_ls_rsp_free instead of relying on LLDD's done callback to free the lsrsp resources. Update the fcloop_t2h_xmt_ls_rsp routine to check remoteport->port_state. If online, then lsrsp->done callback will free the lsrsp. Else, return -ENODEV to signal the nvme-fc transport to handle freeing lsrsp. Cc: Ewan D. Milne Tested-by: Aristeu Rozanski Acked-by: Aristeu Rozanski Reviewed-by: Daniel Wagner Closes: https://lore.kernel.org/linux-nvme/21255200-a271-4fa0-b099-97755c8acd4c@work/ Fixes: 10c165af35d2 ("nvmet-fcloop: call done callback even when remote port is gone") Signed-off-by: Justin Tee Signed-off-by: Keith Busch commit c45be7c420659391530fe3508191083bc0bbfe15 Merge: 3f4a08e6444234 cae66f1a1dcd23 Author: Linus Torvalds Date: Thu Feb 26 14:34:21 2026 -0800 Merge tag 'for-linus-7.0-1' of https://github.com/cminyard/linux-ipmi Pull IPMI driver fixes from Corey Minyard: "This mostly revolves around getting the driver to behave when the IPMI device misbehaves. Past attempts have not worked very well because I didn't have hardware I could make do this, and AI was fairly useless for help on this. So I modified qemu and my test suite so I could reproduce a misbehaving IPMI device, and with that I was able to fix the issues" * tag 'for-linus-7.0-1' of https://github.com/cminyard/linux-ipmi: ipmi:si: Fix check for a misbehaving BMC ipmi:msghandler: Handle error returns from the SMI sender ipmi:si: Don't block module unload if the BMC is messed up ipmi:si: Use a long timeout when the BMC is misbehaving ipmi:si: Handle waiting messages when BMC failure detected ipmi:ls2k: Make ipmi_ls2k_platform_driver static ipmi: ipmb: initialise event handler read bytes ipmi: Consolidate the run to completion checking for xmit msgs lock ipmi: Fix use-after-free and list corruption on sender error commit 749989b2d90ddc7dd253ad3b11a77cf882721acf Author: David Carlier Date: Thu Feb 26 12:45:17 2026 +0000 sched_ext: Fix SCX_EFLAG_INITIALIZED being a no-op flag SCX_EFLAG_INITIALIZED is the sole member of enum scx_exit_flags with no explicit value, so the compiler assigns it 0. This makes the bitwise OR in scx_ops_init() a no-op: sch->exit_info->flags |= SCX_EFLAG_INITIALIZED; /* |= 0 */ As a result, BPF schedulers cannot distinguish whether ops.init() completed successfully by inspecting exit_info->flags. Assign the value 1LLU << 0 so the flag is actually set. Fixes: f3aec2adce8d ("sched_ext: Add SCX_EFLAG_INITIALIZED to indicate successful ops.init()") Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit 459cb3c054c2352bb321648744b620259a716b60 Author: Thomas Weißschuh Date: Thu Feb 26 08:41:48 2026 +0100 kbuild: install-extmod-build: Package resolve_btfids if necessary When CONFIG_DEBUG_INFO_BTF_MODULES is enabled and vmlinux is available, Makefile.modfinal and gen-btf.sh will try to use resolve_btfids on the module .ko. install-extmod-build currently does not package resolve_btfids, so that step fails. Package resolve_btfids if it may be used. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20260226-kbuild-resolve_btfids-v1-1-2bf38b93dfe7@linutronix.de [nathan: Small commit message tweaks] Signed-off-by: Nathan Chancellor commit 3d9b8b00da184f885c4db08fe5521f6a3e3f964e Merge: 5ede90206273ff 023cd6d90f8aa2 Author: Rafael J. Wysocki Date: Thu Feb 26 21:51:33 2026 +0100 Merge branch 'acpi-pm' Add a quirk for Lenovo G70-35 to save the ACPI NVS memory on system suspend (Piotr Mazek) * acpi-pm: ACPI: PM: Save NVS memory on Lenovo G70-35 commit b78030d0f10570845568153637c5831e27d9871f Merge: 3ea20672d23b21 6b050482ec4056 3afd8df024339c Author: Rafael J. Wysocki Date: Thu Feb 26 21:35:47 2026 +0100 Merge branches 'pm-cpufreq' and 'pm-runtime' Merge cpufreq and runtime PM updates for 7.0-rc2: - Fix two issues in the intel_pstate driver causing it to crash when its sysfs interface is used on a system with some offline CPUs (David Arcari, Srinivas Pandruvada) - Update the last user of the pm_runtime_put() return value to discard it and turn pm_runtime_put() into a void function (Rafael Wysocki) * pm-cpufreq: cpufreq: intel_pstate: Fix crash during turbo disable cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() * pm-runtime: PM: runtime: Change pm_runtime_put() return type to void pmdomain: imx: gpcv2: Discard pm_runtime_put() return value commit 5e061aac4c0c9d26dffb81aec6c8d70bed048f2d Merge: f91d5e94228fd9 75c151ceaacf5c Author: Dave Airlie Date: Fri Feb 27 05:49:05 2026 +1000 Merge tag 'drm-misc-fixes-2026-02-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Several fixes for: - amdxdna: Fix for a deadlock, a NULL pointer dereference, a suspend failure, a hang, an out-of-bounds access, a buffer overflow, input sanitization and other minor fixes. - dw-dp: An error handling fix - ethosu: A binary shift overflow fix - imx: An error handling fix - logicvc: A dt node reference leak fix - nouveau: A WARN_ON removal - samsung-dsim: A memory leak fix - sharp-memory: A NULL pointer dereference fix - vmgfx: A reference count and error handling fix Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260226-heretic-stimulating-swine-6a2f27@penduick commit f91d5e94228fd9617c299a7592f025b650e92216 Merge: 6de23f81a5e08b eb4a7139e97374 Author: Dave Airlie Date: Fri Feb 27 05:43:36 2026 +1000 Merge tag 'drm-intel-fixes-2026-02-25' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix #7153: Panel Replay stuck with X during mode transitions on Panther Lake Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/aZ8JxQkN5oMxXsT6@jlahtine-mobl commit 6881af27f9ea0f5ca8f606f573ef5cc25ca31fe4 Author: T.J. Mercier Date: Tue Feb 24 16:33:48 2026 -0800 selftests/bpf: Fix OOB read in dmabuf_collector Dmabuf name allocations can be less than DMA_BUF_NAME_LEN characters, but bpf_probe_read_kernel always tries to read exactly that many bytes. If a name is less than DMA_BUF_NAME_LEN characters, bpf_probe_read_kernel will read past the end. bpf_probe_read_kernel_str stops at the first NUL terminator so use it instead, like iter_dmabuf_for_each already does. Fixes: ae5d2c59ecd7 ("selftests/bpf: Add test for dmabuf_iter") Reported-by: Jerome Lee Signed-off-by: T.J. Mercier Link: https://lore.kernel.org/r/20260225003349.113746-1-tjmercier@google.com Signed-off-by: Alexei Starovoitov commit 60e3cbef3500ad6101bc91946e645f69b1bb9556 Author: Ihor Solodrai Date: Tue Feb 24 16:33:51 2026 -0800 selftests/bpf: Fix a memory leak in xdp_flowtable test test_progs run with ASAN reported [1]: ==126==ERROR: LeakSanitizer: detected memory leaks Direct leak of 32 byte(s) in 1 object(s) allocated from: #0 0x7f1ff3cfa340 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x5610c15bb520 in bpf_program_attach_fd /codebuild/output/src685977285/src/actions-runner/_work/vmtest/vmtest/src/tools/lib/bpf/libbpf.c:13164 #2 0x5610c15bb740 in bpf_program__attach_xdp /codebuild/output/src685977285/src/actions-runner/_work/vmtest/vmtest/src/tools/lib/bpf/libbpf.c:13204 #3 0x5610c14f91d3 in test_xdp_flowtable /codebuild/output/src685977285/src/actions-runner/_work/vmtest/vmtest/src/tools/testing/selftests/bpf/prog_tests/xdp_flowtable.c:138 #4 0x5610c1533566 in run_one_test /codebuild/output/src685977285/src/actions-runner/_work/vmtest/vmtest/src/tools/testing/selftests/bpf/test_progs.c:1406 #5 0x5610c1537fb0 in main /codebuild/output/src685977285/src/actions-runner/_work/vmtest/vmtest/src/tools/testing/selftests/bpf/test_progs.c:2097 #6 0x7f1ff25df1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #7 0x7f1ff25df28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #8 0x5610c0bd3180 in _start (/tmp/work/vmtest/vmtest/selftests/bpf/test_progs+0x593180) (BuildId: cdf9f103f42307dc0a2cd6cfc8afcbc1366cf8bd) Fix by properly destroying bpf_link on exit in xdp_flowtable test. [1] https://github.com/kernel-patches/vmtest/actions/runs/22361085418/job/64716490680 Signed-off-by: Ihor Solodrai Reviewed-by: Subbaraya Sundeep Link: https://lore.kernel.org/r/20260225003351.465104-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit b7bf516c3ecd9a2aae2dc2635178ab87b734fef1 Author: Kohei Enju Date: Wed Feb 25 05:34:44 2026 +0000 bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-of-bounds write. Add a max parameter to get_upper_ifindexes() to avoid the issue. When there are too many upper devices, return -EOVERFLOW and abort the redirect. To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Then send a packet to the device to trigger the XDP redirect path. Reported-by: syzbot+10cc7f13760b31bd2e61@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/698c4ce3.050a0220.340abe.000b.GAE@google.com/T/ Fixes: aeea1b86f936 ("bpf, devmap: Exclude XDP broadcast to master device") Reviewed-by: Toke Høiland-Jørgensen Signed-off-by: Kohei Enju Link: https://lore.kernel.org/r/20260225053506.4738-1-kohei@enjuk.jp Signed-off-by: Alexei Starovoitov commit ad6fface76da42721c15e8fb281570aaa44a2c01 Author: Jiri Olsa Date: Wed Feb 25 12:12:49 2026 +0100 bpf: Fix kprobe_multi cookies access in show_fdinfo callback We don't check if cookies are available on the kprobe_multi link before accessing them in show_fdinfo callback, we should. Cc: stable@vger.kernel.org Fixes: da7e9c0a7fbc ("bpf: Add show_fdinfo for kprobe_multi") Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260225111249.186230-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit ef06fd16d48704eac868441d98d4ef083d8f3d07 Author: Fuad Tabba Date: Thu Feb 26 07:55:25 2026 +0000 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing struct bpf_plt contains a u64 target field. Currently, the BPF JIT allocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT buffer. Because the base address of the JIT buffer can be 4-byte aligned (e.g., ending in 0x4 or 0xc), the relative padding logic in build_plt() fails to ensure that target lands on an 8-byte boundary. This leads to two issues: 1. UBSAN reports misaligned-access warnings when dereferencing the structure. 2. More critically, target is updated concurrently via WRITE_ONCE() in bpf_arch_text_poke() while the JIT'd code executes ldr. On arm64, 64-bit loads/stores are only guaranteed to be single-copy atomic if they are 64-bit aligned. A misaligned target risks a torn read, causing the JIT to jump to a corrupted address. Fix this by increasing the allocation alignment requirement to 8 bytes (sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of the JIT buffer to an 8-byte boundary, allowing the relative padding math in build_plt() to correctly align the target field. Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64") Signed-off-by: Fuad Tabba Acked-by: Will Deacon Link: https://lore.kernel.org/r/20260226075525.233321-1-tabba@google.com Signed-off-by: Alexei Starovoitov commit d2395bb194ef212b36521ec4fa85e38b45675acb Author: Nathan Chancellor Date: Wed Feb 25 15:07:17 2026 -0700 genksyms: Fix parsing a declarator with a preceding attribute After commit 07919126ecfc ("netfilter: annotate NAT helper hook pointers with __rcu"), genksyms fails to parse the __rcu annotation when building with CONFIG_DEBUG_INFO_BTF=y, CONFIG_PAHOLE_HAS_BTF_TAG=y, and a version of clang that supports btf_type_tag. $ clang --version | head -1 ClangBuiltLinux clang version 22.1.0 (https://github.com/llvm/llvm-project.git 4434dabb69916856b824f68a64b029c67175e532) $ cat kernel/configs/repro.config CONFIG_BPF_SYSCALL=y CONFIG_MODVERSIONS=y # CONFIG_DEBUG_INFO_NONE is not set CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y CONFIG_DEBUG_INFO_BTF=y $ make -skj"$(nproc)" ARCH=x86_64 LLVM=1 mrproper defconfig repro.config all WARNING: modpost: EXPORT symbol "nf_nat_ftp_hook" [vmlinux] version generation failed, symbol will not be versioned. ... WARNING: modpost: EXPORT symbol "nf_nat_irc_hook" [vmlinux] version generation failed, symbol will not be versioned. ... genksyms falls over parsing the __rcu attribute in the declarator: # Kernel reproducer $ make -skj"$(nproc)" ARCH=x86_64 KCFLAGS=-D__GENKSYMS__ LLVM=1 net/netfilter/nf_conntrack_ftp.i $ scripts/genksyms/genksyms -w :2: syntax error Optionally allow an attribute to precede a declarator to resolve this error and properly generate symbol versions. Fixes: 07919126ecfc ("netfilter: annotate NAT helper hook pointers with __rcu") Link: https://patch.msgid.link/20260225-genksyms-fix-attribute-declarator-v1-1-1b21478663fb@kernel.org Tested-by: Nicolas Schier Reviewed-by: Nicolas Schier Signed-off-by: Nathan Chancellor commit 8678591b47469fe16357234efef9b260317b8be4 Author: Nathan Chancellor Date: Wed Feb 25 15:02:51 2026 -0700 kbuild: Split .modinfo out from ELF_DETAILS Commit 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped") added .modinfo to ELF_DETAILS while removing it from COMMON_DISCARDS, as it was needed in vmlinux.unstripped and ELF_DETAILS was present in all architecture specific vmlinux linker scripts. While this shuffle is fine for vmlinux, ELF_DETAILS and COMMON_DISCARDS may be used by other linker scripts, such as the s390 and x86 compressed boot images, which may not expect to have a .modinfo section. In certain circumstances, this could result in a bootloader failing to load the compressed kernel [1]. Commit ddc6cbef3ef1 ("s390/boot/vmlinux.lds.S: Ensure bzImage ends with SecureBoot trailer") recently addressed this for the s390 bzImage but the same bug remains for arm, parisc, and x86. The presence of .modinfo in the x86 bzImage was the root cause of the issue worked around with commit d50f21091358 ("kbuild: align modinfo section for Secureboot Authenticode EDK2 compat"). misc.c in arch/x86/boot/compressed includes lib/decompress_unzstd.c, which in turn includes lib/xxhash.c and its MODULE_LICENSE / MODULE_DESCRIPTION macros due to the STATIC definition. Split .modinfo out from ELF_DETAILS into its own macro and handle it in all vmlinux linker scripts. Discard .modinfo in the places where it was previously being discarded from being in COMMON_DISCARDS, as it has never been necessary in those uses. Cc: stable@vger.kernel.org Fixes: 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped") Reported-by: Ed W Closes: https://lore.kernel.org/587f25e0-a80e-46a5-9f01-87cb40cfa377@wildgooses.com/ [1] Tested-by: Ed W # x86_64 Link: https://patch.msgid.link/20260225-separate-modinfo-from-elf-details-v1-1-387ced6baf4b@kernel.org Signed-off-by: Nathan Chancellor commit df6e4ab654dc482c1d45776257a62ac10e14086c Author: Sumit Gupta Date: Thu Feb 26 17:29:11 2026 +0530 arm64: topology: Fix false warning in counters_read_on_cpu() for same-CPU reads The counters_read_on_cpu() function warns when called with IRQs disabled to prevent deadlock in smp_call_function_single(). However, this warning is spurious when reading counters on the current CPU, since no IPI is needed for same CPU reads. Commit 12eb8f4fff24 ("cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs") changed the CPPC Frequency Invariance Engine to read AMU counters directly from the scheduler tick for non-PCC register spaces (like FFH), instead of deferring to a kthread. This means counters_read_on_cpu() is now called with IRQs disabled from the tick handler, triggering the warning. Fix this by restructuring the logic: when IRQs are disabled (tick context), call the function directly for same-CPU reads. Otherwise use smp_call_function_single(). Fixes: 997c021abc6e ("cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs") Suggested-by: Will Deacon Signed-off-by: Sumit Gupta Signed-off-by: Will Deacon commit e5cb94ba5f96d691d8885175d4696d6ae6bc5ec9 Author: Marc Zyngier Date: Thu Feb 26 08:22:32 2026 +0000 arm64: Fix sampling the "stable" virtual counter in preemptible section Ben reports that when running with CONFIG_DEBUG_PREEMPT, using __arch_counter_get_cntvct_stable() results in well deserves warnings, as we access a per-CPU variable without preemption disabled. Fix the issue by disabling preemption on reading the counter. We can probably do a lot better by not disabling preemption on systems that do not require horrible workarounds to return a valid counter value, but this plugs the issue for the time being. Fixes: 29cc0f3aa7c6 ("arm64: Force the use of CNTVCT_EL0 in __delay()") Reported-by: Ben Horgan Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/aZw3EGs4rbQvbAzV@e134344.arm.com Tested-by: Ben Horgan Tested-by: André Draszik Signed-off-by: Will Deacon commit 3f4a08e64442340f4807de63e30aef22cc308830 Merge: e3c81bae4f282a 795469820c638b Author: Linus Torvalds Date: Thu Feb 26 10:05:15 2026 -0800 Merge tag 'kmalloc_obj-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kmalloc_obj fixes from Kees Cook: - Fix pointer-to-array allocation types for ubd and kcsan - Force size overflow helpers to __always_inline - Bump __builtin_counted_by_ref to Clang 22.1 from 22.0 (Nathan Chancellor) * tag 'kmalloc_obj-v7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: kcsan: test: Adjust "expect" allocation type for kmalloc_obj overflow: Make sure size helpers are always inlined init/Kconfig: Adjust fixed clang version for __builtin_counted_by_ref ubd: Use pointer-to-pointers for io_thread_req arrays commit 795469820c638b4449f3bb90ee5e98ebccfbc480 Author: Kees Cook Date: Mon Feb 23 14:01:56 2026 -0800 kcsan: test: Adjust "expect" allocation type for kmalloc_obj The call to kmalloc_obj(observed.lines) returns "char (*)[3][512]", a pointer to the whole 2D array. But "expect" wants to be "char (*)[512]", the decayed pointer type, as if it were observed.lines itself (though without the "3" bounds). This produces the following build error: ../kernel/kcsan/kcsan_test.c: In function '__report_matches': ../kernel/kcsan/kcsan_test.c:171:16: error: assignment to 'char (*)[512]' from incompatible pointer type 'char (*)[3][512]' [-Wincompatible-pointer-types] 171 | expect = kmalloc_obj(observed.lines); | ^ Instead of changing the "expect" type to "char (*)[3][512]" and requiring a dereference at each use (e.g. "(expect*)[0]"), just explicitly cast the return to the desired type. Note that I'm intentionally not switching back to byte-based "kmalloc" here because I cannot find a way for the Coccinelle script (which will be used going forward to catch future conversions) to exclude this case. Tested with: $ ./tools/testing/kunit/kunit.py run \ --kconfig_add CONFIG_DEBUG_KERNEL=y \ --kconfig_add CONFIG_KCSAN=y \ --kconfig_add CONFIG_KCSAN_KUNIT_TEST=y \ --arch=x86_64 --qemu_args '-smp 2' kcsan Reported-by: Nathan Chancellor Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Signed-off-by: Kees Cook commit 71c1978ab6d2c6d48c31311855f1a85377c152ae Author: Takashi Iwai Date: Thu Feb 26 16:47:52 2026 +0100 ASoC: SDCA: Fix comments for sdca_irq_request() The kernel-doc comments for sdca_irq_request() contained some typos that lead to build warnings with W=1. Let's correct them. Fixes: b126394d9ec6 ("ASoC: SDCA: Generic interrupt support") Acked-by: Mark Brown Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260226154753.1083320-1-tiwai@suse.de commit e3c81bae4f282a6be56bc22e05e2ce3dd92ae301 Merge: b9c8fc2caea6ff 7c2889af823340 Author: Linus Torvalds Date: Thu Feb 26 08:37:18 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Seems bigger than usual, a number of things were posted near/during the merg window: - Fix some compilation regressions related to the new DMABUF code - Close a race with ib_register_device() vs netdev events that causes GID table corruption - Compilation warnings with some compilers in bng_re - Correct error unwind in bng_re and the umem pinned dmabuf - Avoid NULL pointer crash in ionic during query_port() - Check the size for uAPI validation checks in EFA - Several system call stack leaks in drivers found with AI - Fix the new restricted_node_type so it works with wildcard listens too" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/uverbs: Import DMA-BUF module in uverbs_std_types_dmabuf file RDMA/umem: Fix double dma_buf_unpin in failure path RDMA/core: Check id_priv->restricted_node_type in cma_listen_on_dev() RDMA/ionic: Fix kernel stack leak in ionic_create_cq() RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() RDMA/efa: Fix typo in efa_alloc_mr() RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port RDMA/bng_re: Unwind bng_re_dev_init properly RDMA/bng_re: Remove unnessary validity checks RDMA/core: Fix stale RoCE GIDs during netdev events at registration RDMA/uverbs: select CONFIG_DMA_SHARED_BUFFER commit 2b351ea42820a7ecc2e8305724536512984f4419 Author: Sanjay Chitroda Date: Thu Feb 26 11:17:12 2026 +0530 mm/slub: drop duplicate kernel-doc for ksize() The implementation of ksize() was updated with kernel-doc by commit fab0694646d7 ("mm/slab: move [__]ksize and slab_ksize() to mm/slub.c") However, the public header still contains a kernel-doc comment attached to the ksize() prototype. Having documentation both in the header and next to the implementation causes Sphinx to treat the function as being documented twice, resulting in the warning: WARNING: Duplicate C declaration, also defined at core-api/mm-api:521 Declaration is '.. c:function:: size_t ksize(const void *objp)' Kernel-doc guidelines recommend keeping the documentation with the function implementation. Therefore remove the redundant kernel-doc block from include/linux/slab.h so that the implementation in slub.c remains the canonical source for documentation. No functional change. Fixes: fab0694646d7 ("mm/slab: move [__]ksize and slab_ksize() to mm/slub.c") Signed-off-by: Sanjay Chitroda Link: https://patch.msgid.link/20260226054712.3610744-1-sanjayembedded@gmail.com Signed-off-by: Vlastimil Babka (SUSE) commit f3ec502b6755a3bfb12c1c47025ef989ff9efc72 Author: Suren Baghdasaryan Date: Wed Feb 25 08:34:07 2026 -0800 mm/slab: mark alloc tags empty for sheaves allocated with __GFP_NO_OBJ_EXT alloc_empty_sheaf() allocates sheaves from SLAB_KMALLOC caches using __GFP_NO_OBJ_EXT to avoid recursion, however it does not mark their allocation tags empty before freeing, which results in a warning when CONFIG_MEM_ALLOC_PROFILING_DEBUG is set. Fix this by marking allocation tags for such sheaves as empty. The problem was technically introduced in commit 4c0a17e28340 but only becomes possible to hit with commit 913ffd3a1bf5. Fixes: 4c0a17e28340 ("slab: prevent recursive kmalloc() in alloc_empty_sheaf()") Fixes: 913ffd3a1bf5 ("slab: handle kmalloc sheaves bootstrap") Reported-by: David Wang <00107082@163.com> Closes: https://lore.kernel.org/all/20260223155128.3849-1-00107082@163.com/ Analyzed-by: Harry Yoo Signed-off-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Tested-by: Harry Yoo Tested-by: David Wang <00107082@163.com> Link: https://patch.msgid.link/20260225163407.2218712-1-surenb@google.com Signed-off-by: Vlastimil Babka (SUSE) commit 021ca6b670bebebc409d43845efcfe8c11c1dd54 Author: Harry Yoo Date: Mon Feb 23 22:33:22 2026 +0900 mm/slab: pass __GFP_NOWARN to refill_sheaf() if fallback is available When refill_sheaf() is called, failing to refill the sheaf doesn't necessarily mean the allocation will fail because a fallback path might be available and serve the allocation request. Suppress spurious warnings by passing __GFP_NOWARN along with __GFP_NOMEMALLOC whenever a fallback path is available. When the caller is alloc_full_sheaf() or __pcs_replace_empty_main(), the kernel always falls back to the slowpath (__slab_alloc_node()). For __prefill_sheaf_pfmemalloc(), the fallback path is available only when gfp_pfmemalloc_allowed() returns true. Reported-and-tested-by: Chris Bainbridge Closes: https://lore.kernel.org/linux-mm/aZt2-oS9lkmwT7Ch@debian.local Fixes: 1ce20c28eafd ("slab: handle pfmemalloc slabs properly with sheaves") Link: https://lore.kernel.org/linux-mm/aZwSreGj9-HHdD-j@hyeyoo Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260223133322.16705-1-harry.yoo@oracle.com Tested-by: Mikhail Gavrilov Signed-off-by: Vlastimil Babka (SUSE) commit ec3070f01fa30f2c5547d645dbb76174304bf0e4 Author: Werner Sembach Date: Thu Jan 8 17:09:54 2026 +0100 HID: multitouch: Keep latency normal on deactivate for reactivation gesture Uniwill devices have a built in gesture in the touchpad to de- and reactivate it by double taping the upper left corner. This gesture stops working when latency is set to high, so this patch keeps the latency on normal. Cc: stable@vger.kernel.org Signed-off-by: Werner Sembach [jkosina@suse.com: change bit from 24 to 25] [jkosina@suse.com: update shortlog] Signed-off-by: Jiri Kosina commit b9c8fc2caea6ff7e45c6942de8fee53515c66b34 Merge: f4d0ec0aa20d49 baed0d9ba91d4f Author: Linus Torvalds Date: Thu Feb 26 08:00:13 2026 -0800 Merge tag 'net-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from IPsec, Bluetooth and netfilter Current release - regressions: - wifi: fix dev_alloc_name() return value check - rds: fix recursive lock in rds_tcp_conn_slots_available Current release - new code bugs: - vsock: lock down child_ns_mode as write-once Previous releases - regressions: - core: - do not pass flow_id to set_rps_cpu() - consume xmit errors of GSO frames - netconsole: avoid OOB reads, msg is not nul-terminated - netfilter: h323: fix OOB read in decode_choice() - tcp: re-enable acceptance of FIN packets when RWIN is 0 - udplite: fix null-ptr-deref in __udp_enqueue_schedule_skb(). - wifi: brcmfmac: fix potential kernel oops when probe fails - phy: register phy led_triggers during probe to avoid AB-BA deadlock - eth: - bnxt_en: fix deleting of Ntuple filters - wan: farsync: fix use-after-free bugs caused by unfinished tasklets - xscale: check for PTP support properly Previous releases - always broken: - tcp: fix potential race in tcp_v6_syn_recv_sock() - kcm: fix zero-frag skb in frag_list on partial sendmsg error - xfrm: - fix race condition in espintcp_close() - always flush state and policy upon NETDEV_UNREGISTER event - bluetooth: - purge error queues in socket destructors - fix response to L2CAP_ECRED_CONN_REQ - eth: - mlx5: - fix circular locking dependency in dump - fix "scheduling while atomic" in IPsec MAC address query - gve: fix incorrect buffer cleanup for QPL - team: avoid NETDEV_CHANGEMTU event when unregistering slave - usb: validate USB endpoints" * tag 'net-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (72 commits) netfilter: nf_conntrack_h323: fix OOB read in decode_choice() dpaa2-switch: validate num_ifs to prevent out-of-bounds write net: consume xmit errors of GSO frames vsock: document write-once behavior of the child_ns_mode sysctl vsock: lock down child_ns_mode as write-once selftests/vsock: change tests to respect write-once child ns mode net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query net/mlx5: Fix missing devlink lock in SRIOV enable error path net/mlx5: E-switch, Clear legacy flag when moving to switchdev net/mlx5: LAG, disable MPESW in lag_disable_change() net/mlx5: DR, Fix circular locking dependency in dump selftests: team: Add a reference count leak test team: avoid NETDEV_CHANGEMTU event when unregistering slave net: mana: Fix double destroy_workqueue on service rescan PCI path MAINTAINERS: Update maintainer entry for QUALCOMM ETHQOS ETHERNET DRIVER dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() selftests/net: packetdrill: Verify acceptance of FIN packets when RWIN is 0 tcp: re-enable acceptance of FIN packets when RWIN is 0 vsock: Use container_of() to get net namespace in sysctl handlers net: usb: kaweth: validate USB endpoints ... commit dc9786a06d53291a5af824e854dd0769b1a97dbe Author: Takashi Iwai Date: Thu Feb 26 16:54:45 2026 +0100 ALSA: us144mkii: Drop kernel-doc markers We don't process this driver code for kernel-doc, and the "/**" marker leads to warnings with W=1 builds. Drop the superfluous markers, and also fix the invalid mark up, too. Link: https://patch.msgid.link/20260226155456.1092186-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 1d6452a0ce78cd3f4e48943b5ba21d273a658298 Author: Takashi Iwai Date: Thu Feb 26 16:43:49 2026 +0100 ALSA: usb: qcom: Correct parameter comment for uaudio_transfer_buffer_setup() At fixing the memory leak of xfer buffer, we forgot to update the corresponding comment, too. This resulted in a kernel-doc warning with W=1. Let's correct it. Fixes: 5c7ef5001292 ("ALSA: qc_audio_offload: avoid leaking xfer_buf allocation") Link: https://patch.msgid.link/20260226154414.1081568-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit 3540cc453f5679d8c4d5ccc9834a1f5f8184af3a Author: Takashi Iwai Date: Thu Feb 26 16:43:48 2026 +0100 ALSA: usb-audio: Drop superfluous kernel-doc markers We don't process USB-audio driver code for kernel-doc, and the "/**" marker leads to warnings with W=1 builds. Drop the superfluous markers. Link: https://patch.msgid.link/20260226154414.1081568-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit 7259b1a0e54c2d3051ac8f1eb01de121b11118ea Author: Baochen Qiang Date: Thu Jan 29 10:24:06 2026 +0800 wifi: ath12k: fix station lookup failure when disconnecting from AP In ath12k_wmi_tlv_fw_stats_data_parse() and ath12k_wmi_tlv_rssi_chain_parse(), the driver uses ieee80211_find_sta_by_ifaddr() to look up the station associated with the incoming firmware statistics. This works under normal conditions but fails during AP disconnection, resulting in log messages like: wlan0: deauthenticating from xxxxxx by local choice (Reason: 3=DEAUTH_LEAVING) wlan0: moving STA xxxxxx to state 3 wlan0: moving STA xxxxxx to state 2 wlan0: moving STA xxxxxx to state 1 ath12k_pci 0000:02:00.0: not found station bssid xxxxxx for vdev stat ath12k_pci 0000:02:00.0: not found station of bssid xxxxxx for rssi chain ath12k_pci 0000:02:00.0: failed to pull fw stats: -71 ath12k_pci 0000:02:00.0: time out while waiting for get fw stats wlan0: Removed STA xxxxxx wlan0: Destroyed STA xxxxxx The failure happens because the station has already been removed from ieee80211_local::sta_hash by the time firmware statistics are requested through drv_sta_statistics(). Switch the lookup to ath12k_link_sta_find_by_addr(), which searches the driver's link station hash table that still has the station recorded at that time. This also implicitly fixes another issue: the current code always uses deflink regardless of which link the statistics belong to, which is incorrect in MLO scenarios. The new helper returns the correct link station. Additionally, raise the log level on lookup failures. With the updated helper, such failures should no longer occur under normal conditions. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 79e7b04b5388 ("wifi: ath12k: report station mode signal strength") Fixes: 6af5bc381b36 ("wifi: ath12k: report station mode per-chain signal strength") Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260129-ath12k-fw-stats-fixes-v1-2-55d66064f4d5@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 8f153eb745463b0715f1aad41e765cd83e9da8c0 Author: Baochen Qiang Date: Thu Jan 29 10:24:05 2026 +0800 wifi: ath12k: use correct pdev id when requesting firmware stats To get firmware statistics, currently ar->pdev->pdev_id is passed as an argument to ath12k_mac_get_fw_stats() in ath12k_mac_op_sta_statistics(). For single pdev device like WCN7850, its value is 0 which represents the SoC pdev id. As a result, WCN7850 firmware sends the same reply to host twice, which further results in memory leak: unreferenced object 0xffff88812e286000 (size 192): comm "softirq", pid 0, jiffies 4294981997 hex dump (first 32 bytes): 10 a5 40 11 81 88 ff ff 10 a5 40 11 81 88 ff ff ..@.......@..... 00 00 00 00 00 00 00 00 80 ff ff ff 33 05 00 00 ............3... backtrace (crc cecc8c82): __kmalloc_cache_noprof ath12k_wmi_tlv_fw_stats_parse ath12k_wmi_tlv_iter ath12k_wmi_op_rx ath12k_htc_rx_completion_handler ath12k_ce_per_engine_service ath12k_pci_ce_workqueue process_one_work bh_worker tasklet_action handle_softirqs Detailed explanation is: 1. ath12k_mac_get_fw_stats() called in ath12k_mac_op_sta_statistics() to get vdev statistics, making the caller thread wait. 2. firmware sends the first reply, ath12k_wmi_tlv_fw_stats_data_parse() allocates buffers to cache necessary information. Following that, in ath12k_wmi_fw_stats_process() if events of all started vdev haved been received, is_end flag is set hence the waiting thread gets waken up by the ar->fw_stats_done/->fw_stats_complete signals. 3. ath12k_mac_get_fw_stats() wakes up and returns successfully. ath12k_mac_op_sta_statistics() saves required parameters and calls ath12k_fw_stats_reset() to free buffers allocated earlier. 4. firmware sends the second reply. As usual, buffers are allocated and attached to the ar->fw_stats.vdevs list. Note this time there is no thread waiting, therefore no chance to free those buffers. 5. ath12k module gets unloaded. If there has been no more firmware statistics request made since step 4, or if the request fails (see the example in the following patch), there is no chance to call ath12k_fw_stats_reset(). Consequently those buffers leak. Actually for single pdev device, using SoC pdev id in ath12k_mac_op_sta_statistics() is wrong, because the purpose is to get statistics of a specific station, which is mapped to a specific pdev. That said, the id of actual individual pdev should be fetched and used instead. The helper ath12k_mac_get_target_pdev_id() serves for this purpose, hence use it to fix this issue. Note it also works for other devices as well due to the single_pdev_only check inside. The same applies to ath12k_mac_op_get_txpower() and ath12k_mac_op_link_sta_statistics() as well. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 79e7b04b5388 ("wifi: ath12k: report station mode signal strength") Fixes: e92c658b056b ("wifi: ath12k: add get_txpower mac ops") Fixes: ebebe66ec208 ("wifi: ath12k: fill link station statistics for MLO") Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260129-ath12k-fw-stats-fixes-v1-1-55d66064f4d5@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7c698de0dc5daa1e1a5fd1f0c6aa1b6bb2f5d867 Author: Takashi Iwai Date: Tue Feb 24 10:00:02 2026 +0100 HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list EPOMAKER TH87 has the very same ID as Apple Aluminum keyboard (05ac:024f) although it doesn't work as expected in compatible way. Put three entries to the non-apple keyboards list to exclude this device: one for BT ("TH87"), one for USB ("HFD Epomaker TH87") and one for dongle ("2.4G Wireless Receiver"). Link: https://bugzilla.suse.com/show_bug.cgi?id=1258455 Signed-off-by: Takashi Iwai Signed-off-by: Jiri Kosina commit 22f8bcec5aeb05104b3eaa950cb5a345e95f0aa8 Author: Zhang Lixu Date: Tue Feb 3 08:55:07 2026 +0800 HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs Add device IDs of Nova Lake-H and Nova Lake-S into ishtp support list. Signed-off-by: Zhang Lixu Reviewed-by: Andy Shevchenko Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit f8db8009ea65297dba7786668d4561f6dbd99678 Author: Mark Harmstone Date: Thu Feb 19 14:30:59 2026 +0000 btrfs: check block group lookup in remove_range_from_remap_tree() Add a check in remove_range_from_remap_tree() after we call btrfs_lookup_block_group(), to check if it is NULL. This shouldn't happen, but if it does we at least get an error rather than a segfault. Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260125125129.2245240-1-clm@meta.com/ Fixes: 979e1dc3d69e ("btrfs: handle deletions from remapped block group") Reviewed-by: Filipe Manana Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7885ca40c305c64ffa444e1fc55edd6acb7a6e5b Author: Mark Harmstone Date: Thu Feb 19 14:16:02 2026 +0000 btrfs: fix transaction handle leaks in btrfs_last_identity_remap_gone() btrfs_abort_transaction(), unlike btrfs_commit_transaction(), doesn't also free the transaction handle. Fix the instances in btrfs_last_identity_remap_gone() where we're also leaking the transaction on abort. Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260125125129.2245240-1-clm@meta.com/ Fixes: 979e1dc3d69e ("btrfs: handle deletions from remapped block group") Reviewed-by: Filipe Manana Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 54b9395b186a60d1655186c561a505c590654395 Author: Mark Harmstone Date: Fri Feb 20 12:52:56 2026 +0000 btrfs: fix chunk map leak in btrfs_map_block() after btrfs_translate_remap() If the call to btrfs_translate_remap() in btrfs_map_block() returns an error code, we were leaking the chunk map. Fix it by jumping to out rather than returning directly. Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260125125830.2352988-1-clm@meta.com/ Fixes: 18ba64992871 ("btrfs: redirect I/O for remapped block groups") Reviewed-by: Filipe Manana Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit f15fb3d41543244d1179f423da4a4832a55bc050 Author: Mark Harmstone Date: Fri Feb 20 12:53:17 2026 +0000 btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() Fix a chunk map leak in btrfs_map_block(): if we return early with -EINVAL, we're not freeing the chunk map that we've just looked up. Fixes: 0ae653fbec2b ("btrfs: reduce chunk_map lookups in btrfs_map_block()") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Filipe Manana Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 587bb33b10bda645a1028c1737ad3992b3d7cf61 Author: Mark Harmstone Date: Tue Feb 17 17:46:41 2026 +0000 btrfs: fix compat mask in error messages in btrfs_check_features() Commit d7f67ac9a928 ("btrfs: relax block-group-tree feature dependency checks") introduced a regression when it comes to handling unsupported incompat or compat_ro flags. Beforehand we only printed the flags that we didn't recognize, afterwards we printed them all, which is less useful. Fix the error handling so it behaves like it used to. Fixes: d7f67ac9a928 ("btrfs: relax block-group-tree feature dependency checks") Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1c7e9111f4e6d6d42bc47759c9af1ef91f03ac2c Author: Mark Harmstone Date: Tue Feb 17 17:32:39 2026 +0000 btrfs: print correct subvol num if active swapfile prevents deletion Fix the error message in btrfs_delete_subvolume() if we can't delete a subvolume because it has an active swapfile: we were printing the number of the parent rather than the target. Fixes: 60021bd754c6 ("btrfs: prevent subvol with swapfile from being deleted") Reviewed-by: Qu Wenruo Reviewed-by: Filipe Manana Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 44e2fda66427a0442d8d2c0e6443256fb458ab6b Author: Mark Harmstone Date: Tue Feb 17 17:46:13 2026 +0000 btrfs: fix warning in scrub_verify_one_metadata() Commit b471965fdb2d ("btrfs: fix replace/scrub failure with metadata_uuid") fixed the comparison in scrub_verify_one_metadata() to use metadata_uuid rather than fsid, but left the warning as it was. Fix it so it matches what we're doing. Fixes: b471965fdb2d ("btrfs: fix replace/scrub failure with metadata_uuid") Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit a10172780526c2002e062102ad4f2aabac495889 Author: Mark Harmstone Date: Tue Feb 17 14:39:46 2026 +0000 btrfs: fix objectid value in error message in check_extent_data_ref() Fix a copy-paste error in check_extent_data_ref(): we're printing root as in the message above, we should be printing objectid. Fixes: f333a3c7e832 ("btrfs: tree-checker: validate dref root and objectid") Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 511dc8912ae3e929c1a182f5e6b2326516fd42a0 Author: Mark Harmstone Date: Tue Feb 17 10:21:44 2026 +0000 btrfs: fix incorrect key offset in error message in check_dev_extent_item() Fix the error message in check_dev_extent_item(), when an overlapping stripe is encountered. For dev extents, objectid is the disk number and offset the physical address, so prev_key->objectid should actually be prev_key->offset. (I can't take any credit for this one - this was discovered by Chris and his friend Claude.) Reported-by: Chris Mason Fixes: 008e2512dc56 ("btrfs: tree-checker: add dev extent item checks") Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3cf0f35779d364cf2003c617bb7f3f3e41023372 Author: Mark Harmstone Date: Tue Feb 17 18:25:42 2026 +0000 btrfs: fix error message order of parameters in btrfs_delete_delayed_dir_index() Fix the error message in btrfs_delete_delayed_dir_index() if __btrfs_add_delayed_item() fails: the message says root, inode, index, error, but we're actually passing index, root, inode, error. Fixes: adc1ef55dc04 ("btrfs: add details to error messages at btrfs_delete_delayed_dir_index()") Signed-off-by: Mark Harmstone Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a7526533128fd3210e15cee1e14c7a0fe97087c1 Author: Miquel Sabaté Solà Date: Mon Feb 16 01:22:52 2026 +0100 btrfs: don't commit the super block when unmounting a shutdown filesystem When unmounting a filesystem we will try, among many other things, to commit the super block. On a filesystem that was shutdown, though, this will always fail with -EROFS as writes are forbidden on this context; and an error will be reported. Don't commit the super block on this situation, which should be fine as the filesystem is frozen before shutdown and, therefore, it should be at a consistent state. Signed-off-by: Miquel Sabaté Solà Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3f501412f2079ca14bf68a18d80a2b7a823f1f64 Author: Miquel Sabaté Solà Date: Mon Feb 16 22:12:15 2026 +0100 btrfs: free pages on error in btrfs_uring_read_extent() In this function the 'pages' object is never freed in the hopes that it is picked up by btrfs_uring_read_finished() whenever that executes in the future. But that's just the happy path. Along the way previous allocations might have gone wrong, or we might not get -EIOCBQUEUED from btrfs_encoded_read_regular_fill_pages(). In all these cases, we go to a cleanup section that frees all memory allocated by this function without assuming any deferred execution, and this also needs to happen for the 'pages' allocation. Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)") Signed-off-by: Miquel Sabaté Solà Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2ab22446425c2c72b44926bc964c263e06e7e137 Author: Boris Burkov Date: Wed Feb 11 11:01:25 2026 -0800 btrfs: fix referenced/exclusive check in squota_check_parent_usage() We compared rfer_cmpr against excl_cmpr_sum instead of rfer_cmpr_sum which is confusing. I expect that rfer_cmpr == excl_cmpr in squota, but it is much better to be consistent in case of any surprises or bugs. Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/cover.1764796022.git.boris@bur.io/T/#mccb231643ffd290b44a010d4419474d280be5537 Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8ac7fad32b93044f4350ab35f11fee1a61286723 Author: Filipe Manana Date: Tue Feb 10 14:23:29 2026 +0000 btrfs: remove pointless WARN_ON() in cache_save_setup() This WARN_ON(ret) is never executed since the previous if statement makes us jump into the 'out_put' label when ret is not zero. The existing transaction abort inside the if statement also gives us a stack trace, so we don't need to move the WARN_ON(ret) into the if statement either. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 912db40655684a0a427c8b118dd0c36eb5a61fe4 Author: Filipe Manana Date: Mon Feb 9 09:49:49 2026 +0000 btrfs: convert log messages to error level in btrfs_replay_log() We are logging messages as warnings but they should really have an error level instead, as if the respective conditions are met the mount will fail. So convert them to error level and also log the error code returned by read_tree_block(). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4db8d56c6f4cbea7293d4236efac4a507dbfa6b1 Author: Filipe Manana Date: Mon Feb 9 15:47:57 2026 +0000 btrfs: remove btrfs_handle_fs_error() after failure to recover log trees There is no need to call btrfs_handle_fs_error() (which we are trying to deprecate) if we fail to recover log trees: 1) Such a failure results in failing the mount immediately; 2) If the recovery started a transaction before failing, it has already aborted the transaction down in the call chain. So remove the btrfs_handle_fs_error() call, replace it with an error message and assert that the FS is in error state (so that no partial updates are committed due to a transaction that was not aborted). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 64def7d7d62b61044fe619e3cc9cbe60454decd9 Author: Filipe Manana Date: Mon Feb 9 15:37:41 2026 +0000 btrfs: remove redundant warning message in btrfs_check_uuid_tree() If we fail to start the UUID rescan kthread, btrfs_check_uuid_tree() logs an error message and returns the error to the single caller, open_ctree(). This however is redundant since the caller already logs an error message, which is also more informative since it logs the error code. Some remove the warning message from btrfs_check_uuid_tree() as it doesn't add any value. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0649355303995d6539df1fa8feaf50497f94db9b Author: Filipe Manana Date: Mon Feb 9 15:27:14 2026 +0000 btrfs: change warning messages to error level in open_ctree() Failure to read the fs root results in a mount error, but we log a warning message. Same goes for checking the UUID tree, an error results in a mount failure but we log a warning message. Change the level of the logged messages from warning to error. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a4fe134fc1d8eb7dcd07e0961c5711b443decd89 Author: Qu Wenruo Date: Mon Feb 9 14:01:45 2026 +1030 btrfs: fix a double release on reserved extents in cow_one_range() [BUG] Commit c28214bde6da ("btrfs: refactor the main loop of cow_file_range()") refactored the handling of COWing one range. However it changed the error handling of the reserved extent. The old cleanup looks like this: out_drop_extent_cache: btrfs_drop_extent_map_range(inode, start, start + cur_alloc_size - 1, false); out_reserve: btrfs_dec_block_group_reservations(fs_info, ins.objectid); btrfs_free_reserved_extent(fs_info, ins.objectid, ins.offset, true); [...] clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; /* * For the range (2). If we reserved an extent for our delalloc range * (or a subrange) and failed to create the respective ordered extent, * then it means that when we reserved the extent we decremented the * extent's size from the data space_info's bytes_may_use counter and * incremented the space_info's bytes_reserved counter by the same * amount. We must make sure extent_clear_unlock_delalloc() does not try * to decrement again the data space_info's bytes_may_use counter, * therefore we do not pass it the flag EXTENT_CLEAR_DATA_RESV. */ if (cur_alloc_size) { extent_clear_unlock_delalloc(inode, start, start + cur_alloc_size - 1, locked_folio, &cached, clear_bits, page_ops); btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size, NULL); } Which only calls EXTENT_CLEAR_META_RESV. As the reserved extent is properly handled by btrfs_free_reserved_extent(). However the new cleanup is: extent_clear_unlock_delalloc(inode, file_offset, cur_end, locked_folio, cached, EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | EXTENT_DEFRAG | EXTENT_DO_ACCOUNTING, PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK); btrfs_qgroup_free_data(inode, NULL, file_offset, cur_len, NULL); btrfs_dec_block_group_reservations(fs_info, ins->objectid); btrfs_free_reserved_extent(fs_info, ins->objectid, ins->offset, true); The flag EXTENT_DO_ACCOUNTING implies both EXTENT_CLEAR_META_RESV and EXTENT_CLEAR_DATA_RESV, which will release the bytes_may_use, which later btrfs_free_reserved_extent() will do again, causing incorrect double release (and may underflow bytes_may_use). [FIX] Use EXTENT_CLEAR_META_RESV to replace EXTENT_DO_ACCOUNTING, and add back the comments on why we only use EXTENT_CLEAR_META_RESV. Fixes: c28214bde6da ("btrfs: refactor the main loop of cow_file_range()") Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260208184920.1102719-1-clm@meta.com/ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 2970525f789c080e7e82ecb09cd85a8bb1d284e4 Author: Jingkai Tan Date: Thu Jan 22 21:14:10 2026 +0000 btrfs: handle discard errors in in btrfs_finish_extent_commit() Coverity (ID: 1226842) reported that the return value of btrfs_discard_extent() is assigned to ret but is immediately overwritten by unpin_extent_range() without being checked. Use the same error handling that is done later in the same function. Signed-off-by: Jingkai Tan Reviewed-by: David Sterba Signed-off-by: David Sterba commit a0b4c7a49137ed21279f354eb59f49ddae8dffc2 Author: David Howells Date: Thu Feb 26 13:32:33 2026 +0000 netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence Fix netfslib such that when it's making an unbuffered or DIO write, to make sure that it sends each subrequest strictly sequentially, waiting till the previous one is 'committed' before sending the next so that we don't have pieces landing out of order and potentially leaving a hole if an error occurs (ENOSPC for example). This is done by copying in just those bits of issuing, collecting and retrying subrequests that are necessary to do one subrequest at a time. Retrying, in particular, is simpler because if the current subrequest needs retrying, the source iterator can just be copied again and the subrequest prepped and issued again without needing to be concerned about whether it needs merging with the previous or next in the sequence. Note that the issuing loop waits for a subrequest to complete right after issuing it, but this wait could be moved elsewhere allowing preparatory steps to be performed whilst the subrequest is in progress. In particular, once content encryption is available in netfslib, that could be done whilst waiting, as could cleanup of buffers that have been completed. Fixes: 153a9961b551 ("netfs: Implement unbuffered/DIO write support") Signed-off-by: David Howells Link: https://patch.msgid.link/58526.1772112753@warthog.procyon.org.uk Tested-by: Steve French Reviewed-by: Paulo Alcantara (Red Hat) cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 786ea2b694f48e1b34f1dcf104e09357fc99ef34 Author: Richard Fitzgerald Date: Thu Feb 26 12:41:15 2026 +0000 ALSA: hda: cs35l56: Remove unnecessary struct cs_dsp_client_ops Since commit af37511305c0 ("firmware: cs_dsp: Don't require client to provide a struct cs_dsp_client_ops") the client doesn't have to provide a struct cs_dsp_client_ops. So remove the dummy cs_dsp_client_ops. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260226124115.1811187-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 36d9579fed6c9429aa172f77bd28c58696ce8e2b Author: Francesco Lavra Date: Tue Feb 10 19:09:32 2026 +0100 drm/solomon: Fix page start when updating rectangle in page addressing mode In page addressing mode, the pixel values of a dirty rectangle must be sent to the display controller one page at a time. The range of pages corresponding to a given rectangle is being incorrectly calculated as if the Y value of the top left coordinate of the rectangle was 0. This can result in rectangle updates being displayed on wrong parts of the screen. Fix the above issue by consolidating the start page calculation in a single place at the beginning of the update_rect function, and using the calculated value for all addressing modes. Fixes: b0daaa5cfaa5 ("drm/ssd130x: Support page addressing mode") Signed-off-by: Francesco Lavra Reviewed-by: Javier Martinez Canillas Link: https://patch.msgid.link/20260210180932.736502-1-flavra@baylibre.com Signed-off-by: Javier Martinez Canillas commit 1a7ba00901438985d817a24628753ef0323a4860 Merge: 003ce8c9b2ca28 32fc4168fa56f6 Author: Takashi Iwai Date: Thu Feb 26 13:17:44 2026 +0100 Merge tag 'asoc-fix-v7.0-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.0 One quirk and a fix for handling of exotic peripherals on cs42l43. commit baed0d9ba91d4f390da12d5039128ee897253d60 Author: Vahagn Vardanian Date: Wed Feb 25 14:06:18 2026 +0100 netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the top of the function: unsigned int type, ext, len = 0; ... if (ext || (son->attr & OPEN)) { BYTE_ALIGN(bs); if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here */ return H323_ERROR_BOUND; len = get_len(bs); /* OOB read */ When the bitstream is exactly consumed (bs->cur == bs->end), the check nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end), which is false. The subsequent get_len() call then dereferences *bs->cur++, reading 1 byte past the end of the buffer. If that byte has bit 7 set, get_len() reads a second byte as well. This can be triggered remotely by sending a crafted Q.931 SETUP message with a User-User Information Element containing exactly 2 bytes of PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with the nf_conntrack_h323 helper active. The decoder fully consumes the PER buffer before reaching this code path, resulting in a 1-2 byte heap-buffer-overflow read confirmed by AddressSanitizer. Fix this by checking for 2 bytes (the maximum that get_len() may read) instead of the uninitialized `len`. This matches the pattern used at every other get_len() call site in the same file, where the caller checks for 2 bytes of available data before calling get_len(). Fixes: ec8a8f3c31dd ("netfilter: nf_ct_h323: Extend nf_h323_error_boundary to work on bits as well") Signed-off-by: Vahagn Vardanian Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260225130619.1248-2-fw@strlen.de Signed-off-by: Paolo Abeni commit 003ce8c9b2ca28fbb4860651e76fb1c9a91f2ea1 Author: Richard Fitzgerald Date: Thu Feb 26 11:17:28 2026 +0000 ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() In cs35l56_hda_posture_put() assign ucontrol->value.integer.value[0] to a long instead of an unsigned long. ucontrol->value.integer.value[0] is a long. This fixes the sparse warning: sound/hda/codecs/side-codecs/cs35l56_hda.c:256:20: warning: unsigned value that used to be signed checked against zero? sound/hda/codecs/side-codecs/cs35l56_hda.c:252:29: signed value source Signed-off-by: Richard Fitzgerald Fixes: 73cfbfa9caea8 ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L56 amplifier") Link: https://patch.msgid.link/20260226111728.1700431-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 8a5752c6dcc085a3bfc78589925182e4e98468c5 Author: Junrui Luo Date: Tue Feb 24 19:05:56 2026 +0800 dpaa2-switch: validate num_ifs to prevent out-of-bounds write The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This value controls iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports num_ifs >= 64, the loop can write past the array bounds. Add a bound check for num_ifs in dpaa2_switch_init(). dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all ports match the flood filter, the loop fills all 64 slots and the control interface write overflows by one entry. The check uses >= because num_ifs == DPSW_MAX_IF is also functionally broken. build_if_id_bitmap() silently drops any ID >= 64: if (id[i] < DPSW_MAX_IF) bmap[id[i] / 64] |= ... Fixes: 539dda3c5d19 ("staging: dpaa2-switch: properly setup switching domains") Signed-off-by: Junrui Luo Reviewed-by: Ioana Ciornei Link: https://patch.msgid.link/SYBPR01MB78812B47B7F0470B617C408AAF74A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Paolo Abeni commit 7aa767d0d3d04e50ae94e770db7db8197f666970 Author: Jakub Kicinski Date: Mon Feb 23 15:51:00 2026 -0800 net: consume xmit errors of GSO frames udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests currently in NIPA. They fail in the same exact way, TCP GRO test stalls occasionally and the test gets killed after 10min. These tests use veth to simulate GRO. They attach a trivial ("return XDP_PASS;") XDP program to the veth to force TSO off and NAPI on. Digging into the failure mode we can see that the connection is completely stuck after a burst of drops. The sender's snd_nxt is at sequence number N [1], but the receiver claims to have received (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle is that senders rtx queue is not empty (let's say the block in the rtx queue is at sequence number N - 4 * MSS [3]). In this state, sender sends a retransmission from the rtx queue with a single segment, and sequence numbers N-4*MSS:N-3*MSS [3]. Receiver sees it and responds with an ACK all the way up to N + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA because it has no recollection of ever sending data that far out [1]. And we are stuck. The root cause is the mess of the xmit return codes. veth returns an error when it can't xmit a frame. We end up with a loss event like this: ------------------------------------------------- | GSO super frame 1 | GSO super frame 2 | |-----------------------------------------------| | seg | seg | seg | seg | seg | seg | seg | seg | | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | ------------------------------------------------- x ok ok | ok ok ok \\ snd_nxt "x" means packet lost by veth, and "ok" means it went thru. Since veth has TSO disabled in this test it sees individual segments. Segment 1 is on the retransmit queue and will be resent. So why did the sender not advance snd_nxt even tho it clearly did send up to seg 8? tcp_write_xmit() interprets the return code from the core to mean that data has not been sent at all. Since TCP deals with GSO super frames, not individual segment the crux of the problem is that loss of a single segment can be interpreted as loss of all. TCP only sees the last return code for the last segment of the GSO frame (in <> brackets in the diagram above). Of course for the problem to occur we need a setup or a device without a Qdisc. Otherwise Qdisc layer disconnects the protocol layer from the device errors completely. We have multiple ways to fix this. 1) make veth not return an error when it lost a packet. While this is what I think we did in the past, the issue keeps reappearing and it's annoying to debug. The game of whack a mole is not great. 2) fix the damn return codes We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the documentation, so maybe we should make the return code from ndo_start_xmit() a boolean. I like that the most, but perhaps some ancient, not-really-networking protocol would suffer. 3) make TCP ignore the errors It is not entirely clear to me what benefit TCP gets from interpreting the result of ip_queue_xmit()? Specifically once the connection is established and we're pushing data - packet loss is just packet loss? 4) this fix Ignore the rc in the Qdisc-less+GSO case, since it's unreliable. We already always return OK in the TCQ_F_CAN_BYPASS case. In the Qdisc-less case let's be a bit more conservative and only mask the GSO errors. This path is taken by non-IP-"networks" like CAN, MCTP etc, so we could regress some ancient thing. This is the simplest, but also maybe the hackiest fix? Similar fix has been proposed by Eric in the past but never committed because original reporter was working with an OOT driver and wasn't providing feedback (see Link). Link: https://lore.kernel.org/CANn89iJcLepEin7EtBETrZ36bjoD9LrR=k4cfwWh046GB+4f9A@mail.gmail.com Fixes: 1f59533f9ca5 ("qdisc: validate frames going through the direct_xmit path") Signed-off-by: Jakub Kicinski Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260223235100.108939-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit f0a2f2aadbef0d44e6df7b43a32b509fbbf39349 Merge: 97f87e578883ab b6302e057fdc8f Author: Paolo Abeni Date: Thu Feb 26 11:10:05 2026 +0100 Merge branch 'vsock-add-write-once-semantics-to-child_ns_mode' Bobby Eshleman says: ==================== vsock: add write-once semantics to child_ns_mode Two administrator processes may race when setting child_ns_mode: one sets it to "local" and creates a namespace, but another changes it to "global" in between. The first process ends up with a namespace in the wrong mode. Make child_ns_mode write-once so that a namespace manager can set it once, check the value, and be guaranteed it won't change before creating its namespaces. Writing a different value after the first write returns -EBUSY. One patch for the implementation, one for docs, and one for tests. v2: https://lore.kernel.org/r/20260218-vsock-ns-write-once-v2-0-19e4c50d509a@meta.com v1: https://lore.kernel.org/r/20260217-vsock-ns-write-once-v1-1-a1fb30f289a9@meta.com ==================== Link: https://patch.msgid.link/20260223-vsock-ns-write-once-v3-0-c0cde6959923@meta.com Signed-off-by: Paolo Abeni commit b6302e057fdc8f199ddae736ecdf45029f892e5c Author: Bobby Eshleman Date: Mon Feb 23 14:38:34 2026 -0800 vsock: document write-once behavior of the child_ns_mode sysctl Update the vsock child_ns_mode documentation to include the new write-once semantics of setting child_ns_mode. The semantics are implemented in a preceding patch in this series. Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260223-vsock-ns-write-once-v3-3-c0cde6959923@meta.com Signed-off-by: Paolo Abeni commit 102eab95f025b4d3f3a6c0a858400aca2af2fe52 Author: Bobby Eshleman Date: Mon Feb 23 14:38:33 2026 -0800 vsock: lock down child_ns_mode as write-once Two administrator processes may race when setting child_ns_mode as one process sets child_ns_mode to "local" and then creates a namespace, but another process changes child_ns_mode to "global" between the write and the namespace creation. The first process ends up with a namespace in "global" mode instead of "local". While this can be detected after the fact by reading ns_mode and retrying, it is fragile and error-prone. Make child_ns_mode write-once so that a namespace manager can set it once and be sure it won't change. Writing a different value after the first write returns -EBUSY. This applies to all namespaces, including init_net, where an init process can write "local" to lock all future namespaces into local mode. Fixes: eafb64f40ca4 ("vsock: add netns to vsock core") Suggested-by: Daan De Meyer Suggested-by: Stefano Garzarella Co-developed-by: Stefano Garzarella Signed-off-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260223-vsock-ns-write-once-v3-2-c0cde6959923@meta.com Signed-off-by: Paolo Abeni commit a382a34276cb94d1cdc620b622dd85c55589a166 Author: Bobby Eshleman Date: Mon Feb 23 14:38:32 2026 -0800 selftests/vsock: change tests to respect write-once child ns mode The child_ns_mode sysctl parameter becomes write-once in a future patch in this series, which breaks existing tests. This patch updates the tests to respect this new policy. No additional tests are added. Add "global-parent" and "local-parent" namespaces as intermediaries to spawn namespaces in the given modes. This avoids the need to change "child_ns_mode" in the init_ns. nsenter must be used because ip netns unshares the mount namespace so nested "ip netns add" breaks exec calls from the init ns. Adds nsenter to the deps check. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260223-vsock-ns-write-once-v3-1-c0cde6959923@meta.com Signed-off-by: Paolo Abeni commit 7c2889af823340d1d410939b9d547bf184d5fa54 Author: Leon Romanovsky Date: Wed Feb 25 15:48:59 2026 +0200 RDMA/uverbs: Import DMA-BUF module in uverbs_std_types_dmabuf file Fix the following compilation error: ERROR: modpost: module ib_uverbs uses symbol dma_buf_move_notify from namespace DMA_BUF, but does not import it. Fixes: 0ac6f4056c4a ("RDMA/uverbs: Add DMABUF object type and operations") Link: https://patch.msgid.link/20260225-fix-uverbs-compilation-v1-1-acf7b3d0f9fa@nvidia.com Signed-off-by: Leon Romanovsky commit 28aaa9c39945b7925a1cc1d513c8f21ed38f5e4f Author: Christian Brauner Date: Thu Feb 26 10:43:55 2026 +0100 kthread: consolidate kthread exit paths to prevent use-after-free Guillaume reported crashes via corrupted RCU callback function pointers during KUnit testing. The crash was traced back to the pidfs rhashtable conversion which replaced the 24-byte rb_node with an 8-byte rhash_head in struct pid, shrinking it from 160 to 144 bytes. struct kthread (without CONFIG_BLK_CGROUP) is also 144 bytes. With CONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN both round up to 192 bytes and share the same slab cache. struct pid.rcu.func and struct kthread.affinity_node both sit at offset 0x78. When a kthread exits via make_task_dead() it bypasses kthread_exit() and misses the affinity_node cleanup. free_kthread_struct() frees the memory while the node is still linked into the global kthread_affinity_list. A subsequent list_del() by another kthread writes through dangling list pointers into the freed and reused memory, corrupting the pid's rcu.func pointer. Instead of patching free_kthread_struct() to handle the missed cleanup, consolidate all kthread exit paths. Turn kthread_exit() into a macro that calls do_exit() and add kthread_do_exit() which is called from do_exit() for any task with PF_KTHREAD set. This guarantees that kthread-specific cleanup always happens regardless of the exit path - make_task_dead(), direct do_exit(), or kthread_exit(). Replace __to_kthread() with a new tsk_is_kthread() accessor in the public header. Export do_exit() since module code using the kthread_exit() macro now needs it directly. Reported-by: Guillaume Tucker Tested-by: Guillaume Tucker Tested-by: Mark Brown Tested-by: David Gow Cc: Link: https://lore.kernel.org/all/20260224-mittlerweile-besessen-2738831ae7f6@brauner Co-developed-by: Linus Torvalds Fixes: 4d13f4304fa4 ("kthread: Implement preferred affinity") Signed-off-by: Linus Torvalds Signed-off-by: Christian Brauner commit cd3c877d04683b44a4d50dcdfad54b356e65d158 Author: Darrick J. Wong Date: Tue Feb 24 07:46:37 2026 -0800 iomap: don't report direct-io retries to fserror iomap's directio implementation has two magic errno codes that it uses to signal callers -- ENOTBLK tells the filesystem that it should retry a write with the pagecache; and EAGAIN tells the caller that pagecache flushing or invalidation failed and that it should try again. Neither of these indicate data loss, so let's not report them. Fixes: a9d573ee88af98 ("iomap: report file I/O errors to the VFS") Signed-off-by: Darrick J. Wong Link: https://patch.msgid.link/20260224154637.GD2390381@frogsfrogsfrogs Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit 54f9d645a5453d0bfece0c465d34aaf072ea99fa Author: Jun Seo Date: Thu Feb 26 10:08:20 2026 +0900 ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields. The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section. Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") Cc: Signed-off-by: Jun Seo Link: https://patch.msgid.link/20260226010820.36529-1-jun.seo.93@proton.me Signed-off-by: Takashi Iwai commit aa4876fe2d9fcbcaa0592b25f34ec6f6ea7876c1 Author: Zhang Heng Date: Mon Feb 9 21:41:49 2026 +0800 ALSA: hda/realtek: add quirk for Acer Nitro ANV15-51 fix mute/micmute LEDs and headset microphone for Acer Nitro ANV15-51. [ The headset microphone issue is solved by Kailang] Link: https://bugzilla.kernel.org/show_bug.cgi?id=220279 Cc: stable@vger.kernel.org Signed-off-by: Zhang Heng Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260209134149.3076957-1-zhangheng@kylinos.cn commit 97f87e578883abe2c8bec947dbdfdc4bf624f796 Merge: 6668c6f2dde1d6 859380694f4345 Author: Jakub Kicinski Date: Wed Feb 25 20:01:52 2026 -0800 Merge branch 'mlx5-misc-fixes-2026-02-24' Tariq Toukan says: ==================== mlx5 misc fixes 2026-02-24 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/20260224114652.1787431-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 859380694f434597407632c29f30fdb5e763e6cc Author: Jianbo Liu Date: Tue Feb 24 13:46:52 2026 +0200 net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by replacing mlx5_query_mac_address() with ether_addr_copy() to get the local MAC address directly from netdev->dev_addr. The issue occurs because mlx5_query_mac_address() queries the hardware which involves mlx5_cmd_exec() that can sleep, but it is called from the mlx5e_ipsec_handle_event workqueue which runs in atomic context. The MAC address is already available in netdev->dev_addr, so no need to query hardware. This avoids the sleeping call and resolves the bug. Call trace: BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200 __schedule+0x7ab/0xa20 schedule+0x1c/0xb0 schedule_timeout+0x6e/0xf0 __wait_for_common+0x91/0x1b0 cmd_exec+0xa85/0xff0 [mlx5_core] mlx5_cmd_exec+0x1f/0x50 [mlx5_core] mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core] mlx5_query_mac_address+0x19/0x30 [mlx5_core] mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core] mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core] mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core] process_one_work+0x178/0x2e0 worker_thread+0x2ea/0x430 Fixes: cee137a63431 ("net/mlx5e: Handle ESN update events") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260224114652.1787431-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 60253042c0b87b61596368489c44d12ba720d11c Author: Shay Drory Date: Tue Feb 24 13:46:51 2026 +0200 net/mlx5: Fix missing devlink lock in SRIOV enable error path The cited commit miss to add locking in the error path of mlx5_sriov_enable(). When pci_enable_sriov() fails, mlx5_device_disable_sriov() is called to clean up. This cleanup function now expects to be called with the devlink instance lock held. Add the missing devl_lock(devlink) and devl_unlock(devlink) Fixes: 84a433a40d0e ("net/mlx5: Lock mlx5 devlink reload callbacks") Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260224114652.1787431-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d7073e8b978ae925f1f0f08754f33f84d8547ea7 Author: Shay Drory Date: Tue Feb 24 13:46:50 2026 +0200 net/mlx5: E-switch, Clear legacy flag when moving to switchdev The cited commit introduced MLX5_PRIV_FLAGS_SWITCH_LEGACY to identify when a transition to legacy mode is requested via devlink. However, the logic failed to clear this flag if the mode was subsequently changed back to MLX5_ESWITCH_OFFLOADS (switchdev). Consequently, if a user toggled from legacy to switchdev, the flag remained set, leaving the driver with wrong state indicating Fix this by explicitly clearing the MLX5_PRIV_FLAGS_SWITCH_LEGACY bit when the requested mode is MLX5_ESWITCH_OFFLOADS. Fixes: 2a4f56fbcc47 ("net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only") Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260224114652.1787431-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit bd7b9f83fb9f85228c3ac9748d9cba9fab7fb5a2 Author: Shay Drory Date: Tue Feb 24 13:46:49 2026 +0200 net/mlx5: LAG, disable MPESW in lag_disable_change() mlx5_lag_disable_change() unconditionally called mlx5_disable_lag() when LAG was active, which is incorrect for MLX5_LAG_MODE_MPESW. Hnece, call mlx5_disable_mpesw() when running in MPESW mode. Fixes: a32327a3a02c ("net/mlx5: Lag, Control MultiPort E-Switch single FDB mode") Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260224114652.1787431-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 2700b7e603af39ca55fe9fc876ca123efd44680f Author: Shay Drory Date: Tue Feb 24 13:46:48 2026 +0200 net/mlx5: DR, Fix circular locking dependency in dump Fix a circular locking dependency between dbg_mutex and the domain rx/tx mutexes that could lead to a deadlock. The dump path in dr_dump_domain_all() was acquiring locks in the order: dbg_mutex -> rx.mutex -> tx.mutex While the table/matcher creation paths acquire locks in the order: rx.mutex -> tx.mutex -> dbg_mutex This inverted lock ordering creates a circular dependency. Fix this by changing dr_dump_domain_all() to acquire the domain lock before dbg_mutex, matching the order used in mlx5dr_table_create() and mlx5dr_matcher_create(). Lockdep splat: ====================================================== WARNING: possible circular locking dependency detected 6.19.0-rc6net_next_e817c4e #1 Not tainted ------------------------------------------------------ sos/30721 is trying to acquire lock: ffff888102df5900 (&dmn->info.rx.mutex){+.+.}-{4:4}, at: dr_dump_start+0x131/0x450 [mlx5_core] but task is already holding lock: ffff888102df5bc0 (&dmn->dump_info.dbg_mutex){+.+.}-{4:4}, at: dr_dump_start+0x10b/0x450 [mlx5_core] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&dmn->dump_info.dbg_mutex){+.+.}-{4:4}: __mutex_lock+0x91/0x1060 mlx5dr_matcher_create+0x377/0x5e0 [mlx5_core] mlx5_cmd_dr_create_flow_group+0x62/0xd0 [mlx5_core] mlx5_create_flow_group+0x113/0x1c0 [mlx5_core] mlx5_chains_create_prio+0x453/0x2290 [mlx5_core] mlx5_chains_get_table+0x2e2/0x980 [mlx5_core] esw_chains_create+0x1e6/0x3b0 [mlx5_core] esw_create_offloads_fdb_tables.cold+0x62/0x63f [mlx5_core] esw_offloads_enable+0x76f/0xd20 [mlx5_core] mlx5_eswitch_enable_locked+0x35a/0x500 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x561/0x950 [mlx5_core] devlink_nl_eswitch_set_doit+0x67/0xe0 genl_family_rcv_msg_doit+0xe0/0x130 genl_rcv_msg+0x188/0x290 netlink_rcv_skb+0x4b/0xf0 genl_rcv+0x24/0x40 netlink_unicast+0x1ed/0x2c0 netlink_sendmsg+0x210/0x450 __sock_sendmsg+0x38/0x60 __sys_sendto+0x119/0x180 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x70/0xd00 entry_SYSCALL_64_after_hwframe+0x4b/0x53 -> #1 (&dmn->info.tx.mutex){+.+.}-{4:4}: __mutex_lock+0x91/0x1060 mlx5dr_table_create+0x11d/0x530 [mlx5_core] mlx5_cmd_dr_create_flow_table+0x62/0x140 [mlx5_core] __mlx5_create_flow_table+0x46f/0x960 [mlx5_core] mlx5_create_flow_table+0x16/0x20 [mlx5_core] esw_create_offloads_fdb_tables+0x136/0x240 [mlx5_core] esw_offloads_enable+0x76f/0xd20 [mlx5_core] mlx5_eswitch_enable_locked+0x35a/0x500 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x561/0x950 [mlx5_core] devlink_nl_eswitch_set_doit+0x67/0xe0 genl_family_rcv_msg_doit+0xe0/0x130 genl_rcv_msg+0x188/0x290 netlink_rcv_skb+0x4b/0xf0 genl_rcv+0x24/0x40 netlink_unicast+0x1ed/0x2c0 netlink_sendmsg+0x210/0x450 __sock_sendmsg+0x38/0x60 __sys_sendto+0x119/0x180 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x70/0xd00 entry_SYSCALL_64_after_hwframe+0x4b/0x53 -> #0 (&dmn->info.rx.mutex){+.+.}-{4:4}: __lock_acquire+0x18b6/0x2eb0 lock_acquire+0xd3/0x2c0 __mutex_lock+0x91/0x1060 dr_dump_start+0x131/0x450 [mlx5_core] seq_read_iter+0xe3/0x410 seq_read+0xfb/0x130 full_proxy_read+0x53/0x80 vfs_read+0xba/0x330 ksys_read+0x65/0xe0 do_syscall_64+0x70/0xd00 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&dmn->dump_info.dbg_mutex); lock(&dmn->info.tx.mutex); lock(&dmn->dump_info.dbg_mutex); lock(&dmn->info.rx.mutex); *** DEADLOCK *** Fixes: 9222f0b27da2 ("net/mlx5: DR, Add support for dumping steering info") Signed-off-by: Shay Drory Reviewed-by: Yevgeny Kliteynik Reviewed-by: Alex Vesker Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260224114652.1787431-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6668c6f2dde1d6693e5c7a512ba2d6b27002644c Merge: 77da71283cad94 017c1792525064 Author: Jakub Kicinski Date: Wed Feb 25 19:54:28 2026 -0800 Merge tag 'wireless-2026-02-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== A good number of fixes: - cfg80211: - cancel rfkill work appropriately - fix radiotap parsing to correctly reject field 18 - fix wext (yes...) off-by-one for IGTK key ID - mac80211: - fix for mesh NULL pointer dereference - fix for stack out-of-bounds (2 bytes) write on specific multi-link action frames - set default WMM parameters for all links - mwifiex: check dev_alloc_name() return value correctly - libertas: fix potential timer use-after-free - brcmfmac: fix crash on probe failure * tag 'wireless-2026-02-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration wifi: mac80211: set default WMM parameters on all links wifi: libertas: fix use-after-free in lbs_free_adapter() wifi: mwifiex: Fix dev_alloc_name() return value check wifi: brcmfmac: Fix potential kernel oops when probe fails wifi: radiotap: reject radiotap with unknown bits wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() wifi: cfg80211: wext: fix IGTK key ID off-by-one ==================== Link: https://patch.msgid.link/20260225113159.360574-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 77da71283cad9446d4160531accfb80ebf3d1cbb Merge: f975a095527657 58f8ef625e23a6 Author: Jakub Kicinski Date: Wed Feb 25 19:17:12 2026 -0800 Merge branch 'team-fix-reference-count-leak-when-changing-port-netns' Ido Schimmel says: ==================== team: Fix reference count leak when changing port netns Patch #1 fixes a reference count leak that was reported by syzkaller. The leak happens when a net device that is member in a team is changing netns. The fix is to align the team driver with the bond driver and have it suppress NETDEV_CHANGEMTU events for a net device that is being unregistered. Without this change, the NETDEV_CHANGEMTU event causes inetdev_event() to recreate an inet device for this net device in its original netns, after it was previously destroyed upon NETDEV_UNREGISTER. Later on, when inetdev_event() receives a NETDEV_REGISTER event for this net device in the new nents, it simply leaks the reference: case NETDEV_REGISTER: pr_debug("%s: bug\n", __func__); RCU_INIT_POINTER(dev->ip_ptr, NULL); break; addrconf_notify() handles this differently and reuses the existing inet6 device if one exists when a NETDEV_REGISTER event is received. This creates a different problem where it is possible for a net device to reference an inet6 device that was created in a previous netns. A more generic fix that we can try in net-next is to revert the changes in the bond and team drivers and instead have IPv4 and IPv6 destroy and recreate an inet device if one already exists upon NETDEV_REGISTER. Patch #2 adds a selftest that passes with the fix and hangs without it. ==================== Link: https://patch.msgid.link/20260224125709.317574-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 58f8ef625e23a607f4a89758d6b328a2701f7354 Author: Ido Schimmel Date: Tue Feb 24 14:57:09 2026 +0200 selftests: team: Add a reference count leak test Add a test for the issue that was fixed in "team: avoid NETDEV_CHANGEMTU event when unregistering slave". The test hangs due to a reference count leak without the fix: # make -C tools/testing/selftests TARGETS="drivers/net/team" TEST_PROGS=refleak.sh TEST_GEN_PROGS="" run_tests [...] TAP version 13 1..1 # timeout set to 45 # selftests: drivers/net/team: refleak.sh [ 50.681299][ T496] unregister_netdevice: waiting for dummy1 to become free. Usage count = 3 [ 71.185325][ T496] unregister_netdevice: waiting for dummy1 to become free. Usage count = 3 And passes with the fix: # make -C tools/testing/selftests TARGETS="drivers/net/team" TEST_PROGS=refleak.sh TEST_GEN_PROGS="" run_tests [...] TAP version 13 1..1 # timeout set to 45 # selftests: drivers/net/team: refleak.sh ok 1 selftests: drivers/net/team: refleak.sh Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260224125709.317574-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit bb4c698633c0e19717586a6524a33196cff01a32 Author: Tetsuo Handa Date: Tue Feb 24 14:57:08 2026 +0200 team: avoid NETDEV_CHANGEMTU event when unregistering slave syzbot is reporting unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3 ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline] netdev_hold include/linux/netdevice.h:4429 [inline] inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286 inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline] netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886 netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907 dev_set_mtu+0x126/0x260 net/core/dev_api.c:248 team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333 team_del_slave drivers/net/team/team_core.c:1936 [inline] team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline] call_netdevice_notifiers net/core/dev.c:2295 [inline] __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592 do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060 rtnl_changelink net/core/rtnetlink.c:3776 [inline] __rtnl_newlink net/core/rtnetlink.c:3935 [inline] rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 problem. Ido Schimmel found steps to reproduce ip link add name team1 type team ip link add name dummy1 mtu 1499 master team1 type dummy ip netns add ns1 ip link set dev dummy1 netns ns1 ip -n ns1 link del dev dummy1 and also found that the same issue was fixed in the bond driver in commit f51048c3e07b ("bonding: avoid NETDEV_CHANGEMTU event when unregistering slave"). Let's do similar thing for the team driver, with commit ad7c7b2172c3 ("net: hold netdev instance lock during sysfs operations") and commit 303a8487a657 ("net: s/__dev_set_mtu/__netif_set_mtu/") also applied. Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Suggested-by: Ido Schimmel Reviewed-by: Jiri Pirko Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") Signed-off-by: Tetsuo Handa Signed-off-by: Ido Schimmel Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260224125709.317574-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit f975a0955276579e2176a134366ed586071c7c6a Author: Dipayaan Roy Date: Tue Feb 24 04:38:36 2026 -0800 net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() destroys gc->service_wq. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-checking gc->service_wq in mana_gd_cleanup() and setting it to NULL after destruction. Call stack of issue for reference: [Sat Feb 21 18:53:48 2026] Call Trace: [Sat Feb 21 18:53:48 2026] [Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana] [Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana] [Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0 [Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70 [Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250 [Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20 [Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90 [Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30 [Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana] [Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana] [Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0 [Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0 [Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130 [Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30 [Sat Feb 21 18:53:48 2026] Fixes: 505cc26bcae0 ("net: mana: Add support for auxiliary device servicing events") Reviewed-by: Haiyang Zhang Signed-off-by: Dipayaan Roy Reviewed-by: Simon Horman Link: https://patch.msgid.link/aZ2bzL64NagfyHpg@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Jakub Kicinski commit 916864e5eda0c52572b11b4cacce41b89622cc35 Author: Mohd Ayaan Anwar Date: Tue Feb 24 17:58:47 2026 +0530 MAINTAINERS: Update maintainer entry for QUALCOMM ETHQOS ETHERNET DRIVER Replace Vinod Koul with Mohd Ayaan Anwar as the maintainer of the QUALCOMM ETHQOS ETHERNET DRIVER. Vinod confirmed he is no longer active in this area and agreed to be removed. Acked-by: Vinod Koul Suggested-by: Russell King (Oracle) Signed-off-by: Mohd Ayaan Anwar Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260224-qcom_ethqos_maintainer-v1-1-24e02701ea52@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 676c7af91fcd740d34e7cb788cbc58e3bcafde39 Author: Felix Gu Date: Tue Feb 24 19:04:04 2026 +0800 dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() The devm_add_action_or_reset() function already executes the cleanup action on failure before returning an error, so the explicit goto error and subsequent zl3073x_dev_dpll_fini() call causes double cleanup. Fixes: ebb1031c5137 ("dpll: zl3073x: Refactor DPLL initialization") Reviewed-by: Ivan Vecera Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260224-dpll-v2-1-d7786414a830@gmail.com Signed-off-by: Jakub Kicinski commit 7c9db1a1cd3be140f7807aa9f405cc17be59dc2a Merge: 5cc619583c7e73 74511332309844 Author: Jakub Kicinski Date: Wed Feb 25 19:07:07 2026 -0800 Merge branch 'tcp-re-enable-acceptance-of-fin-packets-when-rwin-is-0' Simon Baatz says: ==================== tcp: re-enable acceptance of FIN packets when RWIN is 0 this series restores the ability to accept in‑sequence FIN packets even when the advertised receive window is zero, and adds a packetdrill test to guard the behavior. ==================== Link: https://patch.msgid.link/20260224-fix_zero_wnd_fin-v2-0-a16677ea7cea@gmail.com Signed-off-by: Jakub Kicinski commit 74511332309844c3de64970841b3c250d85f34ce Author: Simon Baatz Date: Tue Feb 24 09:20:13 2026 +0100 selftests/net: packetdrill: Verify acceptance of FIN packets when RWIN is 0 Add a packetdrill test that verifies we accept bare FIN packets when the advertised receive window is zero. Signed-off-by: Simon Baatz Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260224-fix_zero_wnd_fin-v2-2-a16677ea7cea@gmail.com Signed-off-by: Jakub Kicinski commit 1e3bb184e94125bae7c1703472109a646d0f79d9 Author: Simon Baatz Date: Tue Feb 24 09:20:12 2026 +0100 tcp: re-enable acceptance of FIN packets when RWIN is 0 Commit 2bd99aef1b19 ("tcp: accept bare FIN packets under memory pressure") allowed accepting FIN packets in tcp_data_queue() even when the receive window was closed, to prevent ACK/FIN loops with broken clients. Such a FIN packet is in sequence, but because the FIN consumes a sequence number, it extends beyond the window. Before commit 9ca48d616ed7 ("tcp: do not accept packets beyond window"), tcp_sequence() only required the seq to be within the window. After that change, the entire packet (including the FIN) must fit within the window. As a result, such FIN packets are now dropped and the handling path is no longer reached. Be more lenient by not counting the sequence number consumed by the FIN when calling tcp_sequence(), restoring the previous behavior for cases where only the FIN extends beyond the window. Fixes: 9ca48d616ed7 ("tcp: do not accept packets beyond window") Signed-off-by: Simon Baatz Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260224-fix_zero_wnd_fin-v2-1-a16677ea7cea@gmail.com Signed-off-by: Jakub Kicinski commit 5cc619583c7e735c4fb801bede671fb6f9c79425 Author: Greg Kroah-Hartman Date: Mon Feb 23 18:32:18 2026 +0100 vsock: Use container_of() to get net namespace in sysctl handlers current->nsproxy is should not be accessed directly as syzbot has found that it could be NULL at times, causing crashes. Fix up the af_vsock sysctl handlers to use container_of() to deal with the current net namespace instead of attempting to rely on current. This is the same type of change done in commit 7f5611cbc487 ("rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy") Signed-off-by: Greg Kroah-Hartman Reviewed-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Fixes: eafb64f40ca4 ("vsock: add netns to vsock core") Link: https://patch.msgid.link/2026022318-rearview-gallery-ae13@gregkh Signed-off-by: Jakub Kicinski commit 4b063c002ca759d1b299988ee23f564c9609c875 Author: Greg Kroah-Hartman Date: Mon Feb 23 14:00:06 2026 +0100 net: usb: kaweth: validate USB endpoints The kaweth driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints. Cc: stable Signed-off-by: Greg Kroah-Hartman Reviewed-by: Simon Horman Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Link: https://patch.msgid.link/2026022305-substance-virtual-c728@gregkh Signed-off-by: Jakub Kicinski commit c58b6c29a4c9b8125e8ad3bca0637e00b71e2693 Author: Greg Kroah-Hartman Date: Mon Feb 23 13:59:26 2026 +0100 net: usb: kalmia: validate USB endpoints The kalmia driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints. Cc: stable Signed-off-by: Greg Kroah-Hartman Reviewed-by: Simon Horman Fixes: d40261236e8e ("net/usb: Add Samsung Kalmia driver for Samsung GT-B3730") Link: https://patch.msgid.link/2026022326-shack-headstone-ef6f@gregkh Signed-off-by: Jakub Kicinski commit 11de1d3ae5565ed22ef1f89d73d8f2d00322c699 Author: Greg Kroah-Hartman Date: Mon Feb 23 13:58:48 2026 +0100 net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints. Cc: Petko Manolov Cc: stable Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026022347-legibly-attest-cc5c@gregkh Signed-off-by: Jakub Kicinski commit 12133a483dfa832241fbbf09321109a0ea8a520e Author: Greg Kroah-Hartman Date: Mon Feb 23 12:28:30 2026 +0100 nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a "dangling" reference count on the usb interface that was grabbed in the probe callback. Fix this up by properly dropping the reference after we are done with it. Cc: stable Signed-off-by: Greg Kroah-Hartman Reviewed-by: Simon Horman Fixes: c46ee38620a2 ("NFC: pn533: add NXP pn533 nfc device driver") Link: https://patch.msgid.link/2026022329-flashing-ought-7573@gregkh Signed-off-by: Jakub Kicinski commit f4d0ec0aa20d49f09dc01d82894ce80d72de0560 Merge: d9d32e5bd5a4e5 4a2d046e4b1320 Author: Linus Torvalds Date: Wed Feb 25 16:39:25 2026 -0800 Merge tag 'erofs-for-7.0-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Do not share the page cache if the real @aops differs - Fix the incomplete condition for interlaced plain extents - Get rid of more unnecessary #ifdefs * tag 'erofs-for-7.0-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix interlaced plain identification for encoded extents erofs: remove more unnecessary #ifdefs erofs: allow sharing page cache with the same aops only commit 2a064262eb378263792cf1fb044de631ac41bcc5 Author: David Carlier Date: Wed Feb 25 21:15:23 2026 +0000 sched_ext: Fix out-of-bounds access in scx_idle_init_masks() scx_idle_node_masks is allocated with num_possible_nodes() elements but indexed by NUMA node IDs via for_each_node(). On systems with non-contiguous NUMA node numbering (e.g. nodes 0 and 4), node IDs can exceed the array size, causing out-of-bounds memory corruption. Use nr_node_ids instead, which represents the maximum node ID range and is the correct size for arrays indexed by node ID. Fixes: 7c60329e3521 ("sched_ext: Add NUMA-awareness to the default idle selection policy") Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit 6b0d812971370c64b837a2db4275410f478272fe Author: Mario Limonciello Date: Wed Feb 25 10:51:16 2026 -0600 drm/amd: Disable MES LR compute W/A A workaround was introduced in commit 1fb710793ce2 ("drm/amdgpu: Enable MES lr_compute_wa by default") to help with some hangs observed in gfx1151. This WA didn't fully fix the issue. It was actually fixed by adjusting the VGPR size to the correct value that matched the hardware in commit b42f3bf9536c ("drm/amdkfd: bump minimum vgpr size for gfx1151"). There are reports of instability on other products with newer GC microcode versions, and I believe they're caused by this workaround. As we don't need the workaround any more, remove it. Fixes: b42f3bf9536c ("drm/amdkfd: bump minimum vgpr size for gfx1151") Acked-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 9973e64bd6ee7642860a6f3b6958cbf14e89cabd) Cc: stable@vger.kernel.org commit b57c4ec98c17789136a4db948aec6daadceb5024 Author: Lijo Lazar Date: Tue Feb 24 10:18:51 2026 +0530 drm/amdgpu: Fix error handling in slot reset If the device has not recovered after slot reset is called, it goes to out label for error handling. There it could make decision based on uninitialized hive pointer and could result in accessing an uninitialized list. Initialize the list and hive properly so that it handles the error situation and also releases the reset domain lock which is acquired during error_detected callback. Fixes: 732c6cefc1ec ("drm/amdgpu: Replace tmp_adev with hive in amdgpu_pci_slot_reset") Signed-off-by: Lijo Lazar Reviewed-by: Ce Sun Signed-off-by: Alex Deucher (cherry picked from commit bb71362182e59caa227e4192da5a612b09349696) commit a5fe1a54513196e4bc8f9170006057dc31e7155e Author: sguttula Date: Sat Feb 21 10:03:32 2026 +0530 drm/amdgpu/vcn5: Add SMU dpm interface type This will set AMDGPU_VCN_SMU_DPM_INTERFACE_* smu_type based on soc type and fixing ring timeout issue seen for DPM enabled case. Signed-off-by: sguttula Reviewed-by: Pratik Vishwakarma Signed-off-by: Alex Deucher (cherry picked from commit f0f23c315b38c55e8ce9484cf59b65811f350630) commit 480ad5f6ead4a47b969aab6618573cd6822bb6a4 Author: Bart Van Assche Date: Mon Feb 23 13:50:23 2026 -0800 drm/amdgpu: Fix locking bugs in error paths Do not unlock psp->ras_context.mutex if it has not been locked. This has been detected by the Clang thread-safety analyzer. Cc: Alex Deucher Cc: Christian König Cc: YiPeng Chai Cc: Hawking Zhang Cc: amd-gfx@lists.freedesktop.org Fixes: b3fb79cda568 ("drm/amdgpu: add mutex to protect ras shared memory") Acked-by: Christian König Signed-off-by: Bart Van Assche Signed-off-by: Alex Deucher (cherry picked from commit 6fa01b4335978051d2cd80841728fd63cc597970) commit 5e0bcc7b88bcd081aaae6f481b10d9ab294fcb69 Author: Bart Van Assche Date: Mon Feb 23 14:00:07 2026 -0800 drm/amdgpu: Unlock a mutex before destroying it Mutexes must be unlocked before these are destroyed. This has been detected by the Clang thread-safety analyzer. Cc: Alex Deucher Cc: Christian König Cc: Yang Wang Cc: Hawking Zhang Cc: amd-gfx@lists.freedesktop.org Fixes: f5e4cc8461c4 ("drm/amdgpu: implement RAS ACA driver framework") Reviewed-by: Yang Wang Acked-by: Christian König Signed-off-by: Bart Van Assche Signed-off-by: Alex Deucher (cherry picked from commit 270258ba320beb99648dceffb67e86ac76786e55) commit 28dfe4317541e57fe52f9a290394cd29c348228b Author: Natalie Vock Date: Mon Feb 23 12:45:37 2026 +0100 drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink This can be called while preemption is disabled, for example by dcn32_internal_validate_bw which is called with the FPU active. Fixes "BUG: scheduling while atomic" messages I encounter on my Navi31 machine. Signed-off-by: Natalie Vock Signed-off-by: Alex Deucher (cherry picked from commit b42dae2ebc5c84a68de63ec4ffdfec49362d53f1) Cc: stable@vger.kernel.org commit 64ac7c09fc44985ec9bb6a9db740899fa40ca613 Author: Sunil Khatri Date: Tue Feb 24 12:13:09 2026 +0530 drm/amdgpu: add upper bound check on user inputs in wait ioctl Huge input values in amdgpu_userq_wait_ioctl can lead to a OOM and could be exploited. So check these input value against AMDGPU_USERQ_MAX_HANDLES which is big enough value for genuine use cases and could potentially avoid OOM. v2: squash in Srini's fix Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit fcec012c664247531aed3e662f4280ff804d1476) Cc: stable@vger.kernel.org commit ea78f8c68f4f6211c557df49174c54d167821962 Author: Sunil Khatri Date: Fri Feb 20 13:47:58 2026 +0530 drm/amdgpu: add upper bound check on user inputs in signal ioctl Huge input values in amdgpu_userq_signal_ioctl can lead to a OOM and could be exploited. So check these input value against AMDGPU_USERQ_MAX_HANDLES which is big enough value for genuine use cases and could potentially avoid OOM. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit be267e15f99bc97cbe202cd556717797cdcf79a5) Cc: stable@vger.kernel.org commit 7b7d7693a55d606d700beb9549c9f7f0e5d9c24f Author: Tvrtko Ursulin Date: Mon Feb 23 12:41:31 2026 +0000 drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings Userspace can either deliberately pass in the too small num_fences, or the required number can legitimately grow between the two calls to the userq wait ioctl. In both cases we do not want the emit the kernel warning backtrace since nothing is wrong with the kernel and userspace will simply get an errno reported back. So lets simply drop the WARN_ONs. Reviewed-by: Alex Deucher Signed-off-by: Tvrtko Ursulin Fixes: a292fdecd728 ("drm/amdgpu: Implement userqueue signal/wait IOCTL") Cc: Arunpravin Paneer Selvam Cc: Christian König Cc: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 2c333ea579de6cc20ea7bc50e9595ef72863e65c) commit 49abfa812617a7f2d0132c70d23ac98b389c6ec1 Author: Tvrtko Ursulin Date: Mon Feb 23 12:41:30 2026 +0000 drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl Drop reference to syncobj and timeline fence when aborting the ioctl due output array being too small. Reviewed-by: Alex Deucher Signed-off-by: Tvrtko Ursulin Fixes: a292fdecd728 ("drm/amdgpu: Implement userqueue signal/wait IOCTL") Cc: Arunpravin Paneer Selvam Cc: Christian König Cc: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 68951e9c3e6bb22396bc42ef2359751c8315dd27) Cc: # v6.16+ commit 75c151ceaacf5ca8f2f34ebf863d88002fb12587 Author: Lizhi Hou Date: Wed Feb 25 12:47:52 2026 -0800 accel/amdxdna: Use a different name for latest firmware Using legacy driver with latest firmware causes a power off issue. Fix this by assigning a different filename (npu_7.sbin) to the latest firmware. The driver attempts to load the latest firmware first and falls back to the previous firmware version if loading fails. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5009 Fixes: f1eac46fe5f7 ("accel/amdxdna: Update firmware version check for latest firmware") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260225204752.2711734-1-lizhi.hou@amd.com commit c22533c66ccae10511ad6a7afc34bb26c47577e3 Author: Niklas Cassel Date: Wed Feb 11 18:55:41 2026 +0100 PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write transaction. There's no completion for posted writes, so the writel() may return before the PCI write completes. dw_pcie_ep_raise_msix_irq() also unmaps the outbound ATU entry used for the PCI write, so the write races with the unmap. If the PCI write loses the race with the ATU unmap, the write may corrupt host memory or cause IOMMU errors, e.g., these when running fio with a larger queue depth against nvmet-pci-epf: arm-smmu-v3 fc900000.iommu: 0x0000010000000010 arm-smmu-v3 fc900000.iommu: 0x0000020000000000 arm-smmu-v3 fc900000.iommu: 0x000000090000f040 arm-smmu-v3 fc900000.iommu: 0x0000000000000000 arm-smmu-v3 fc900000.iommu: event: F_TRANSLATION client: 0000:01:00.0 sid: 0x100 ssid: 0x0 iova: 0x90000f040 ipa: 0x0 arm-smmu-v3 fc900000.iommu: unpriv data write s1 "Input address caused fault" stag: 0x0 Flush the write by performing a readl() of the same address to ensure that the write has reached the destination before the ATU entry is unmapped. The same problem was solved for dw_pcie_ep_raise_msi_irq() in commit 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU mapping"), but there it was solved by dedicating an outbound iATU only for MSI. We can't do the same for MSI-X because each vector can have a different msg_addr and the msg_addr may be changed while the vector is masked. Fixes: beb4641a787d ("PCI: dwc: Add MSI-X callbacks handler") Signed-off-by: Niklas Cassel [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Link: https://patch.msgid.link/20260211175540.105677-2-cassel@kernel.org commit 468711a40d5dfc01bf0a24c1981246a2c93ac405 Author: Niklas Cassel Date: Tue Feb 10 19:12:25 2026 +0100 PCI: dwc: ep: Refresh MSI Message Address cache on change Endpoint drivers use dw_pcie_ep_raise_msi_irq() to raise MSI interrupts to the host. After 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU mapping"), dw_pcie_ep_raise_msi_irq() caches the Message Address from the MSI Capability in ep->msi_msg_addr. But that Message Address is controlled by the host, and it may change. For example, if: - firmware on the host configures the Message Address and triggers an MSI, - a driver on the Endpoint raises the MSI via dw_pcie_ep_raise_msi_irq(), which caches the Message Address, - a kernel on the host reconfigures the Message Address and the host kernel driver triggers another MSI, dw_pcie_ep_raise_msi_irq() notices that the Message Address no longer matches the cached ep->msi_msg_addr, warns about it, and returns error instead of raising the MSI. The host kernel may hang because it never receives the MSI. This was seen with the nvmet_pci_epf_driver: the host UEFI performs NVMe commands, e.g. Identify Controller to get the name of the controller, nvmet-pci-epf posts the completion queue entry and raises an IRQ using dw_pcie_ep_raise_msi_irq(). When the host boots Linux, we see a WARN_ON_ONCE() from dw_pcie_ep_raise_msi_irq(), and the host kernel hangs because the nvme driver never gets an IRQ. Remove the warning when dw_pcie_ep_raise_msi_irq() notices that Message Address has changed, remap using the new address, and update the ep->msi_msg_addr cache. Fixes: 8719c64e76bf ("PCI: dwc: ep: Cache MSI outbound iATU mapping") Signed-off-by: Niklas Cassel [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Tested-by: Shin'ichiro Kawasaki Tested-by: Koichiro Den Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260210181225.3926165-2-cassel@kernel.org commit a8f78680ee6bf795086384e8aea159a52814f827 Author: Mark Rutland Date: Wed Feb 18 16:43:48 2026 +0000 arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI The ARM64_WORKAROUND_REPEAT_TLBI workaround is used to mitigate several errata where broadcast TLBI;DSB sequences don't provide all the architecturally required synchronization. The workaround performs more work than necessary, and can have significant overhead. This patch optimizes the workaround, as explained below. The workaround was originally added for Qualcomm Falkor erratum 1009 in commit: d9ff80f83ecb ("arm64: Work around Falkor erratum 1009") As noted in the message for that commit, the workaround is applied even in cases where it is not strictly necessary. The workaround was later reused without changes for: * Arm Cortex-A76 erratum #1286807 SDEN v33: https://developer.arm.com/documentation/SDEN-885749/33-0/ * Arm Cortex-A55 erratum #2441007 SDEN v16: https://developer.arm.com/documentation/SDEN-859338/1600/ * Arm Cortex-A510 erratum #2441009 SDEN v19: https://developer.arm.com/documentation/SDEN-1873351/1900/ The important details to note are as follows: 1. All relevant errata only affect the ordering and/or completion of memory accesses which have been translated by an invalidated TLB entry. The actual invalidation of TLB entries is unaffected. 2. The existing workaround is applied to both broadcast and local TLB invalidation, whereas for all relevant errata it is only necessary to apply a workaround for broadcast invalidation. 3. The existing workaround replaces every TLBI with a TLBI;DSB;TLBI sequence, whereas for all relevant errata it is only necessary to execute a single additional TLBI;DSB sequence after any number of TLBIs are completed by a DSB. For example, for a sequence of batched TLBIs: TLBI [, ] TLBI [, ] TLBI [, ] DSB ISH ... the existing workaround will expand this to: TLBI [, ] DSB ISH // additional TLBI [, ] // additional TLBI [, ] DSB ISH // additional TLBI [, ] // additional TLBI [, ] DSB ISH // additional TLBI [, ] // additional DSB ISH ... whereas it is sufficient to have: TLBI [, ] TLBI [, ] TLBI [, ] DSB ISH TLBI [, ] // additional DSB ISH // additional Using a single additional TBLI and DSB at the end of the sequence can have significantly lower overhead as each DSB which completes a TLBI must synchronize with other PEs in the system, with potential performance effects both locally and system-wide. 4. The existing workaround repeats each specific TLBI operation, whereas for all relevant errata it is sufficient for the additional TLBI to use *any* operation which will be broadcast, regardless of which translation regime or stage of translation the operation applies to. For example, for a single TLBI: TLBI ALLE2IS DSB ISH ... the existing workaround will expand this to: TLBI ALLE2IS DSB ISH TLBI ALLE2IS // additional DSB ISH // additional ... whereas it is sufficient to have: TLBI ALLE2IS DSB ISH TLBI VALE1IS, XZR // additional DSB ISH // additional As the additional TLBI doesn't have to match a specific earlier TLBI, the additional TLBI can be implemented in separate code, with no memory of the earlier TLBIs. The additional TLBI can also use a cheaper TLBI operation. 5. The existing workaround is applied to both Stage-1 and Stage-2 TLB invalidation, whereas for all relevant errata it is only necessary to apply a workaround for Stage-1 invalidation. Architecturally, TLBI operations which invalidate only Stage-2 information (e.g. IPAS2E1IS) are not required to invalidate TLB entries which combine information from Stage-1 and Stage-2 translation table entries, and consequently may not complete memory accesses translated by those combined entries. In these cases, completion of memory accesses is only guaranteed after subsequent invalidation of Stage-1 information (e.g. VMALLE1IS). Taking the above points into account, this patch reworks the workaround logic to reduce overhead: * New __tlbi_sync_s1ish() and __tlbi_sync_s1ish_hyp() functions are added and used in place of any dsb(ish) which is used to complete broadcast Stage-1 TLB maintenance. When the ARM64_WORKAROUND_REPEAT_TLBI workaround is enabled, these helpers will execute an additional TLBI;DSB sequence. For consistency, it might make sense to add __tlbi_sync_*() helpers for local and stage 2 maintenance. For now I've left those with open-coded dsb() to keep the diff small. * The duplication of TLBIs in __TLBI_0() and __TLBI_1() is removed. This is no longer needed as the necessary synchronization will happen in __tlbi_sync_s1ish() or __tlbi_sync_s1ish_hyp(). * The additional TLBI operation is chosen to have minimal impact: - __tlbi_sync_s1ish() uses "TLBI VALE1IS, XZR". This is only used at EL1 or at EL2 with {E2H,TGE}=={1,1}, where it will target an unused entry for the reserved ASID in the kernel's own translation regime, and have no adverse affect. - __tlbi_sync_s1ish_hyp() uses "TLBI VALE2IS, XZR". This is only used in hyp code, where it will target an unused entry in the hyp code's TTBR0 mapping, and should have no adverse effect. * As __TLBI_0() and __TLBI_1() no longer replace each TLBI with a TLBI;DSB;TLBI sequence, batching TLBIs is worthwhile, and there's no need for arch_tlbbatch_should_defer() to consider ARM64_WORKAROUND_REPEAT_TLBI. When building defconfig with GCC 15.1.0, compared to v6.19-rc1, this patch saves ~1KiB of text, makes the vmlinux ~42KiB smaller, and makes the resulting Image 64KiB smaller: | [mark@lakrids:~/src/linux]% size vmlinux-* | text data bss dec hex filename | 21179831 19660919 708216 41548966 279fca6 vmlinux-after | 21181075 19660903 708216 41550194 27a0172 vmlinux-before | [mark@lakrids:~/src/linux]% ls -l vmlinux-* | -rwxr-xr-x 1 mark mark 157771472 Feb 4 12:05 vmlinux-after | -rwxr-xr-x 1 mark mark 157815432 Feb 4 12:05 vmlinux-before | [mark@lakrids:~/src/linux]% ls -l Image-* | -rw-r--r-- 1 mark mark 41007616 Feb 4 12:05 Image-after | -rw-r--r-- 1 mark mark 41073152 Feb 4 12:05 Image-before Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Marc Zyngier Cc: Oliver Upton Cc: Ryan Roberts Cc: Will Deacon Signed-off-by: Will Deacon commit bfd9c931d19aa59fb8371d557774fa169b15db9a Author: Mark Rutland Date: Wed Feb 18 16:43:47 2026 +0000 arm64: tlb: Allow XZR argument to TLBI ops The TLBI instruction accepts XZR as a register argument, and for TLBI operations with a register argument, there is no functional difference between using XZR or another GPR which contains zeroes. Operations without a register argument are encoded as if XZR were used. Allow the __TLBI_1() macro to use XZR when a register argument is all zeroes. Today this only results in a trivial code saving in __do_compat_cache_op()'s workaround for Neoverse-N1 erratum #1542419. In subsequent patches this pattern will be used more generally. There should be no functional change as a result of this patch. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Marc Zyngier Cc: Oliver Upton Cc: Ryan Roberts Cc: Will Deacon Signed-off-by: Will Deacon commit 9d1a7c4a457eac8a7e07e1685f95e54fa551db5e Author: Catalin Marinas Date: Mon Feb 23 17:45:32 2026 +0000 kselftest: arm64: Check access to GCS after mprotect(PROT_NONE) A GCS mapping should not be accessible after mprotect(PROT_NONE). Add a kselftest for this scenario. Signed-off-by: Catalin Marinas Cc: Shuah Khan Cc: Mark Brown Cc: Will Deacon Cc: David Hildenbrand Reviewed-by: Mark Brown Signed-off-by: Will Deacon commit 47a8aad135ac1aed04b7b0c0a8157fd208075827 Author: Catalin Marinas Date: Mon Feb 23 17:45:31 2026 +0000 arm64: gcs: Honour mprotect(PROT_NONE) on shadow stack mappings vm_get_page_prot() short-circuits the protection_map[] lookup for a VM_SHADOW_STACK mapping since it uses a different PIE index from the typical read/write/exec permissions. However, the side effect is that it also ignores mprotect(PROT_NONE) by creating an accessible PTE. Special-case the !(vm_flags & VM_ACCESS_FLAGS) flags to use the protection_map[VM_NONE] permissions instead. No GCS attributes are required for an inaccessible PTE. Signed-off-by: Catalin Marinas Fixes: 6497b66ba694 ("arm64/mm: Map pages for guarded control stack") Cc: stable@vger.kernel.org Cc: Mark Brown Cc: Will Deacon Cc: David Hildenbrand Reviewed-by: David Hildenbrand (Arm) Signed-off-by: Will Deacon commit 8a85b3131225a8c8143ba2ae29c0eef8c1f9117f Author: Catalin Marinas Date: Mon Feb 23 17:45:30 2026 +0000 arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled When FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the shareability attribute with bits 50-51 of the output address. The _PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this matches the other _PAGE_* definitions) but using this macro directly leads to the following panic when enabling GCS on a system/model with LPA2: Unable to handle kernel paging request at virtual address fffff1ffc32d8008 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000 [fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Tainted: G M 7.0.0-rc1 #1 PREEMPT Tainted: [M]=MACHINE_CHECK Hardware name: QEMU QEMU Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025 pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : zap_huge_pmd+0x168/0x468 lr : zap_huge_pmd+0x2c/0x468 sp : ffff800080beb660 x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898 x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41 x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000 x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007 x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000 x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370 x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000 x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600 Call trace: zap_huge_pmd+0x168/0x468 (P) unmap_page_range+0xd70/0x1560 unmap_single_vma+0x48/0x80 unmap_vmas+0x90/0x180 unmap_region+0x88/0xe4 vms_complete_munmap_vmas+0xf8/0x1e0 do_vmi_align_munmap+0x158/0x180 do_vmi_munmap+0xac/0x160 __vm_munmap+0xb0/0x138 vm_munmap+0x14/0x20 gcs_free+0x70/0x80 mm_release+0x1c/0xc8 exit_mm_release+0x28/0x38 do_exit+0x190/0x8ec do_group_exit+0x34/0x90 get_signal+0x794/0x858 arch_do_signal_or_restart+0x11c/0x3e0 exit_to_user_mode_loop+0x10c/0x17c el0_da+0x8c/0x9c el0t_64_sync_handler+0xd0/0xf0 el0t_64_sync+0x198/0x19c Code: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420) Similarly to how the kernel handles protection_map[], use a gcs_page_prot variable to store the protection bits and clear PTE_SHARED if LPA2 is enabled. Also remove the unused PAGE_GCS{,_RO} macros. Signed-off-by: Catalin Marinas Fixes: 6497b66ba694 ("arm64/mm: Map pages for guarded control stack") Reported-by: Emanuele Rocca Cc: stable@vger.kernel.org Cc: Mark Brown Cc: Will Deacon Reviewed-by: David Hildenbrand (Arm) Signed-off-by: Will Deacon commit 8f098037139b294050053123ab2bc0f819d08932 Author: Will Deacon Date: Mon Feb 23 22:10:11 2026 +0000 arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' being accessed by the kernel. On arm64, the 'pgprot_t' contains all of the non-address bits from the pte, including the permission controls, and so we end up returning a new user mapping from ioremap_prot() which faults when accessed from the kernel on systems with PAN: | Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000 | ... | Call trace: | __memcpy_fromio+0x80/0xf8 | generic_access_phys+0x20c/0x2b8 | __access_remote_vm+0x46c/0x5b8 | access_remote_vm+0x18/0x30 | environ_read+0x238/0x3e8 | vfs_read+0xe4/0x2b0 | ksys_read+0xcc/0x178 | __arm64_sys_read+0x4c/0x68 Extract only the memory type from the user 'pgprot_t' in ioremap_prot() and assert that we're being passed a user mapping, to protect us against any changes in future that may require additional handling. To avoid falsely flagging users of ioremap(), provide our own ioremap() macro which simply wraps __ioremap_prot(). Cc: Zeng Heng Cc: Jinjiang Tu Cc: Catalin Marinas Fixes: 893dea9ccd08 ("arm64: Add HAVE_IOREMAP_PROT support") Reported-by: Jinjiang Tu Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit f6bf47ab32e0863df50f5501d207dcdddb7fc507 Author: Will Deacon Date: Mon Feb 23 22:10:10 2026 +0000 arm64: io: Rename ioremap_prot() to __ioremap_prot() Rename our ioremap_prot() implementation to __ioremap_prot() and convert all arch-internal callers over to the new function. ioremap_prot() remains as a #define to __ioremap_prot() for generic_access_phys() and will be subsequently extended to handle user permissions in 'prot'. Cc: Zeng Heng Cc: Jinjiang Tu Cc: Catalin Marinas Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit 0942fc6d324eb9c6b16187b2aa994c0823557f06 Author: Vitaly Lifshits Date: Tue Jan 6 16:14:20 2026 +0200 e1000e: clear DPG_EN after reset to avoid autonomous power-gating Panther Lake systems introduced an autonomous power gating feature for the integrated Gigabit Ethernet in shutdown state (S5) state. As part of it, the reset value of DPG_EN bit was changed to 1. Clear this bit after performing hardware reset to avoid errors such as Tx/Rx hangs, or packet loss/corruption. Fixes: 0c9183ce61bc ("e1000e: Add support for the next LOM generation") Signed-off-by: Vitaly Lifshits Reviewed-by: Aleksandr Loktionov Tested-by: Avigail Dahan Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen commit 5b644464eeeac485685c6632bcc95347ae6c8677 Author: Vitaly Lifshits Date: Tue Jan 6 16:14:19 2026 +0200 e1000e: introduce new board type for Panther Lake PCH Add new board type for Panther Lake devices for separating device-specific features and flows. Additionally, remove the deprecated device IDs 0x57B5 and 0x57B6, which are not used by any existing devices. Signed-off-by: Vitaly Lifshits Tested-by: Avigail Dahan Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen commit feae40a6a178bb525a15f19288016e5778102a99 Author: Jedrzej Jagielski Date: Wed Dec 10 12:26:51 2025 +0100 ixgbevf: fix link setup issue It may happen that VF spawned for E610 adapter has problem with setting link up. This happens when ixgbevf supporting mailbox API 1.6 cooperates with PF driver which doesn't support this version of API, and hence doesn't support new approach for getting PF link data. In that case VF asks PF to provide link data but as PF doesn't support it, returns -EOPNOTSUPP what leads to early bail from link configuration sequence. Avoid such situation by using legacy VFLINKS approach whenever negotiated API version is less than 1.6. To reproduce the issue just create VF and set its link up - adapter must be any from the E610 family, ixgbevf must support API 1.6 or higher while ixgbevf must not. Fixes: 53f0eb62b4d2 ("ixgbevf: fix getting link speed data for E610 devices") Reviewed-by: Aleksandr Loktionov Reviewed-by: Piotr Kwapulinski Reviewed-by: Paul Menzel Cc: stable@vger.kernel.org Signed-off-by: Jedrzej Jagielski Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9 Author: Thomas Gleixner Date: Sat Feb 7 11:50:23 2026 +0100 i40e: Fix preempt count leak in napi poll tracepoint Using get_cpu() in the tracepoint assignment causes an obvious preempt count leak because nothing invokes put_cpu() to undo it: softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101? This clearly has seen a lot of testing in the last 3+ years... Use smp_processor_id() instead. Fixes: 6d4d584a7ea8 ("i40e: Add i40e_napi_poll tracepoint") Signed-off-by: Thomas Gleixner Cc: Tony Nguyen Cc: Przemek Kitszel Cc: intel-wired-lan@lists.osuosl.org Cc: netdev@vger.kernel.org Reviewed-by: Joe Damato Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit a9c354e656597aededa027d63d2ff0973f6b033f Author: Michal Schmidt Date: Mon Feb 2 11:17:54 2026 +0100 ice: fix crash in ethtool offline loopback test Since the conversion of ice to page pool, the ethtool loopback test crashes: BUG: kernel NULL pointer dereference, address: 000000000000000c #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 1100f1067 P4D 0 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 23 UID: 0 PID: 5904 Comm: ethtool Kdump: loaded Not tainted 6.19.0-0.rc7.260128g1f97d9dcf5364.49.eln154.x86_64 #1 PREEMPT(lazy) Hardware name: [...] RIP: 0010:ice_alloc_rx_bufs+0x1cd/0x310 [ice] Code: 83 6c 24 30 01 66 41 89 47 08 0f 84 c0 00 00 00 41 0f b7 dc 48 8b 44 24 18 48 c1 e3 04 41 bb 00 10 00 00 48 8d 2c 18 8b 04 24 <89> 45 0c 41 8b 4d 00 49 d3 e3 44 3b 5c 24 24 0f 83 ac fe ff ff 44 RSP: 0018:ff7894738aa1f768 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000700 RDI: 0000000000000000 RBP: 0000000000000000 R08: ff16dcae79880200 R09: 0000000000000019 R10: 0000000000000001 R11: 0000000000001000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ff16dcae6c670000 FS: 00007fcf428850c0(0000) GS:ff16dcb149710000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000c CR3: 0000000121227005 CR4: 0000000000773ef0 PKRU: 55555554 Call Trace: ice_vsi_cfg_rxq+0xca/0x460 [ice] ice_vsi_cfg_rxqs+0x54/0x70 [ice] ice_loopback_test+0xa9/0x520 [ice] ice_self_test+0x1b9/0x280 [ice] ethtool_self_test+0xe5/0x200 __dev_ethtool+0x1106/0x1a90 dev_ethtool+0xbe/0x1a0 dev_ioctl+0x258/0x4c0 sock_do_ioctl+0xe3/0x130 __x64_sys_ioctl+0xb9/0x100 do_syscall_64+0x7c/0x700 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] It crashes because we have not initialized libeth for the rx ring. Fix it by treating ICE_VSI_LB VSIs slightly more like normal PF VSIs and letting them have a q_vector. It's just a dummy, because the loopback test does not use interrupts, but it contains a napi struct that can be passed to libeth_rx_fq_create() called from ice_vsi_cfg_rxq() -> ice_rxq_pp_create(). Fixes: 93f53db9f9dc ("ice: switch to Page Pool") Signed-off-by: Michal Schmidt Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 6aa07e23dd3ccd35a0100c06fcb6b6c3b01e7965 Author: Aaron Ma Date: Thu Jan 29 12:00:26 2026 +0800 ice: recap the VSI and QoS info after rebuild Fix IRDMA hardware initialization timeout (-110) after resume by separating VSI-dependent configuration from RDMA resource allocation, ensuring VSI is rebuilt before IRDMA accesses it. After resume from suspend, IRDMA hardware initialization fails: ice: IRDMA hardware initialization FAILED init_state=4 status=-110 Separate RDMA initialization into two phases: 1. ice_init_rdma() - Allocate resources only (no VSI/QoS access, no plug) 2. ice_rdma_finalize_setup() - Assign VSI/QoS info and plug device This allows: - ice_init_rdma() to stay in ice_resume() (mirrors ice_deinit_rdma() in ice_suspend()) - VSI assignment deferred until after ice_vsi_rebuild() completes - QoS info updated after ice_dcb_rebuild() completes - Device plugged only when control queues, VSI, and DCB are all ready Fixes: bc69ad74867db ("ice: avoid IRQ collision to fix init failure on ACPI S3 resume") Reviewed-by: Aleksandr Loktionov Signed-off-by: Aaron Ma Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 2c31557336a8e4d209ed8d4513cef2c0f15e7ef4 Author: Sreedevi Joshi Date: Tue Jan 13 12:01:13 2026 -0600 idpf: Fix flow rule delete failure due to invalid validation When deleting a flow rule using "ethtool -N delete ", idpf_sideband_action_ena() incorrectly validates fsp->ring_cookie even though ethtool doesn't populate this field for delete operations. The uninitialized ring_cookie may randomly match RX_CLS_FLOW_DISC or RX_CLS_FLOW_WAKE, causing validation to fail and preventing legitimate rule deletions. Remove the unnecessary sideband action enable check and ring_cookie validation during delete operations since action validation is not required when removing existing rules. Fixes: ada3e24b84a0 ("idpf: add flow steering support") Signed-off-by: Sreedevi Joshi Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen commit 1500a8662d2d41d6bb03e034de45ddfe6d7d362d Author: Brian Vazquez Date: Mon Jan 26 21:55:59 2026 +0000 idpf: change IRQ naming to match netdev and ethtool queue numbering The code uses the vidx for the IRQ name but that doesn't match ethtool reporting nor netdev naming, this makes it hard to tune the device and associate queues with IRQs. Sequentially requesting irqs starting from '0' makes the output consistent. This commit changes the interrupt numbering but preserves the name format, maintaining ABI compatibility. Existing tools relying on the old numbering are already non-functional, as they lack a useful correlation to the interrupts. Before: ethtool -L eth1 tx 1 combined 3 grep . /proc/irq/*/*idpf*/../smp_affinity_list /proc/irq/67/idpf-Mailbox-0/../smp_affinity_list:0-55,112-167 /proc/irq/68/idpf-eth1-TxRx-1/../smp_affinity_list:0 /proc/irq/70/idpf-eth1-TxRx-3/../smp_affinity_list:1 /proc/irq/71/idpf-eth1-TxRx-4/../smp_affinity_list:2 /proc/irq/72/idpf-eth1-Tx-5/../smp_affinity_list:3 ethtool -S eth1 | grep -v ': 0' NIC statistics: tx_q-0_pkts: 1002 tx_q-1_pkts: 2679 tx_q-2_pkts: 1113 tx_q-3_pkts: 1192 <----- tx_q-3 vs idpf-eth1-Tx-5 rx_q-0_pkts: 1143 rx_q-1_pkts: 3172 rx_q-2_pkts: 1074 After: ethtool -L eth1 tx 1 combined 3 grep . /proc/irq/*/*idpf*/../smp_affinity_list /proc/irq/67/idpf-Mailbox-0/../smp_affinity_list:0-55,112-167 /proc/irq/68/idpf-eth1-TxRx-0/../smp_affinity_list:0 /proc/irq/70/idpf-eth1-TxRx-1/../smp_affinity_list:1 /proc/irq/71/idpf-eth1-TxRx-2/../smp_affinity_list:2 /proc/irq/72/idpf-eth1-Tx-3/../smp_affinity_list:3 ethtool -S eth1 | grep -v ': 0' NIC statistics: tx_q-0_pkts: 118 tx_q-1_pkts: 134 tx_q-2_pkts: 228 tx_q-3_pkts: 138 <--- tx_q-3 matches idpf-eth1-Tx-3 rx_q-0_pkts: 111 rx_q-1_pkts: 366 rx_q-2_pkts: 120 Fixes: d4d558718266 ("idpf: initialize interrupts and enable vport") Signed-off-by: Brian Vazquez Reviewed-by: Brett Creeley Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Reviewed-by: Eric Dumazet Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit bc3b31977314433e4685ae92853d1b6e91ad7bc2 Author: Li Li Date: Fri Jan 23 06:58:06 2026 +0000 idpf: nullify pointers after they are freed rss_data->rss_key needs to be nullified after it is freed. Checks like "if (!rss_data->rss_key)" in the code could fail if it is not nullified. Tested: built and booted the kernel. Fixes: 83f38f210b85 ("idpf: Fix RSS LUT NULL pointer crash on early ethtool operations") Signed-off-by: Li Li Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit e403bf4013a665961bdfdf65193e3076c3d155a5 Author: Li Li Date: Mon Jan 12 23:09:44 2026 +0000 idpf: skip deallocating txq group's txqs if it is NULL In idpf_txq_group_alloc(), if any txq group's txqs failed to allocate memory: for (j = 0; j < tx_qgrp->num_txq; j++) { tx_qgrp->txqs[j] = kzalloc(sizeof(*tx_qgrp->txqs[j]), GFP_KERNEL); if (!tx_qgrp->txqs[j]) goto err_alloc; } It would cause a NULL ptr kernel panic in idpf_txq_group_rel(): for (j = 0; j < txq_grp->num_txq; j++) { if (flow_sch_en) { kfree(txq_grp->txqs[j]->refillq); txq_grp->txqs[j]->refillq = NULL; } kfree(txq_grp->txqs[j]); txq_grp->txqs[j] = NULL; } [ 6.532461] BUG: kernel NULL pointer dereference, address: 0000000000000058 ... [ 6.534433] RIP: 0010:idpf_txq_group_rel+0xc9/0x110 ... [ 6.538513] Call Trace: [ 6.538639] [ 6.538760] idpf_vport_queues_alloc+0x75/0x550 [ 6.538978] idpf_vport_open+0x4d/0x3f0 [ 6.539164] idpf_open+0x71/0xb0 [ 6.539324] __dev_open+0x142/0x260 [ 6.539506] netif_open+0x2f/0xe0 [ 6.539670] dev_open+0x3d/0x70 [ 6.539827] bond_enslave+0x5ed/0xf50 [ 6.540005] ? rcutree_enqueue+0x1f/0xb0 [ 6.540193] ? call_rcu+0xde/0x2a0 [ 6.540375] ? barn_get_empty_sheaf+0x5c/0x80 [ 6.540594] ? __kfree_rcu_sheaf+0xb6/0x1a0 [ 6.540793] ? nla_put_ifalias+0x3d/0x90 [ 6.540981] ? kvfree_call_rcu+0xb5/0x3b0 [ 6.541173] ? kvfree_call_rcu+0xb5/0x3b0 [ 6.541365] do_set_master+0x114/0x160 [ 6.541547] do_setlink+0x412/0xfb0 [ 6.541717] ? security_sock_rcv_skb+0x2a/0x50 [ 6.541931] ? sk_filter_trim_cap+0x7c/0x320 [ 6.542136] ? skb_queue_tail+0x20/0x50 [ 6.542322] ? __nla_validate_parse+0x92/0xe50 ro[o t t o6 .d5e4f2a5u4l0t]- ? security_capable+0x35/0x60 [ 6.542792] rtnl_newlink+0x95c/0xa00 [ 6.542972] ? __rtnl_unlock+0x37/0x70 [ 6.543152] ? netdev_run_todo+0x63/0x530 [ 6.543343] ? allocate_slab+0x280/0x870 [ 6.543531] ? security_capable+0x35/0x60 [ 6.543722] rtnetlink_rcv_msg+0x2e6/0x340 [ 6.543918] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 6.544138] netlink_rcv_skb+0x16a/0x1a0 [ 6.544328] netlink_unicast+0x20a/0x320 [ 6.544516] netlink_sendmsg+0x304/0x3b0 [ 6.544748] __sock_sendmsg+0x89/0xb0 [ 6.544928] ____sys_sendmsg+0x167/0x1c0 [ 6.545116] ? ____sys_recvmsg+0xed/0x150 [ 6.545308] ___sys_sendmsg+0xdd/0x120 [ 6.545489] ? ___sys_recvmsg+0x124/0x1e0 [ 6.545680] ? rcutree_enqueue+0x1f/0xb0 [ 6.545867] ? rcutree_enqueue+0x1f/0xb0 [ 6.546055] ? call_rcu+0xde/0x2a0 [ 6.546222] ? evict+0x286/0x2d0 [ 6.546389] ? rcutree_enqueue+0x1f/0xb0 [ 6.546577] ? kmem_cache_free+0x2c/0x350 [ 6.546784] __x64_sys_sendmsg+0x72/0xc0 [ 6.546972] do_syscall_64+0x6f/0x890 [ 6.547150] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 6.547393] RIP: 0033:0x7fc1a3347bd0 ... [ 6.551375] RIP: 0010:idpf_txq_group_rel+0xc9/0x110 ... [ 6.578856] Rebooting in 10 seconds.. We should skip deallocating txqs[j] if it is NULL in the first place. Tested: with this patch, the kernel panic no longer appears. Fixes: 1c325aac10a8 ("idpf: configure resources for TX queues") Signed-off-by: Li Li Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit d11e5da2d6d87d123e339dc9af7bc1682fc533ce Author: Li Li Date: Mon Jan 12 23:09:43 2026 +0000 idpf: skip deallocating bufq_sets from rx_qgrp if it is NULL In idpf_rxq_group_alloc(), if rx_qgrp->splitq.bufq_sets failed to get allocated: rx_qgrp->splitq.bufq_sets = kcalloc(vport->num_bufqs_per_qgrp, sizeof(struct idpf_bufq_set), GFP_KERNEL); if (!rx_qgrp->splitq.bufq_sets) { err = -ENOMEM; goto err_alloc; } idpf_rxq_group_rel() would attempt to deallocate it in idpf_rxq_sw_queue_rel(), causing a kernel panic: ``` [ 7.967242] early-network-sshd-n-rexd[3148]: knetbase: Info: [ 8.127804] BUG: kernel NULL pointer dereference, address: 00000000000000c0 ... [ 8.129779] RIP: 0010:idpf_rxq_group_rel+0x101/0x170 ... [ 8.133854] Call Trace: [ 8.133980] [ 8.134092] idpf_vport_queues_alloc+0x286/0x500 [ 8.134313] idpf_vport_open+0x4d/0x3f0 [ 8.134498] idpf_open+0x71/0xb0 [ 8.134668] __dev_open+0x142/0x260 [ 8.134840] netif_open+0x2f/0xe0 [ 8.135004] dev_open+0x3d/0x70 [ 8.135166] bond_enslave+0x5ed/0xf50 [ 8.135345] ? nla_put_ifalias+0x3d/0x90 [ 8.135533] ? kvfree_call_rcu+0xb5/0x3b0 [ 8.135725] ? kvfree_call_rcu+0xb5/0x3b0 [ 8.135916] do_set_master+0x114/0x160 [ 8.136098] do_setlink+0x412/0xfb0 [ 8.136269] ? security_sock_rcv_skb+0x2a/0x50 [ 8.136509] ? sk_filter_trim_cap+0x7c/0x320 [ 8.136714] ? skb_queue_tail+0x20/0x50 [ 8.136899] ? __nla_validate_parse+0x92/0xe50 [ 8.137112] ? security_capable+0x35/0x60 [ 8.137304] rtnl_newlink+0x95c/0xa00 [ 8.137483] ? __rtnl_unlock+0x37/0x70 [ 8.137664] ? netdev_run_todo+0x63/0x530 [ 8.137855] ? allocate_slab+0x280/0x870 [ 8.138044] ? security_capable+0x35/0x60 [ 8.138235] rtnetlink_rcv_msg+0x2e6/0x340 [ 8.138431] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 8.138650] netlink_rcv_skb+0x16a/0x1a0 [ 8.138840] netlink_unicast+0x20a/0x320 [ 8.139028] netlink_sendmsg+0x304/0x3b0 [ 8.139217] __sock_sendmsg+0x89/0xb0 [ 8.139399] ____sys_sendmsg+0x167/0x1c0 [ 8.139588] ? ____sys_recvmsg+0xed/0x150 [ 8.139780] ___sys_sendmsg+0xdd/0x120 [ 8.139960] ? ___sys_recvmsg+0x124/0x1e0 [ 8.140152] ? rcutree_enqueue+0x1f/0xb0 [ 8.140341] ? rcutree_enqueue+0x1f/0xb0 [ 8.140528] ? call_rcu+0xde/0x2a0 [ 8.140695] ? evict+0x286/0x2d0 [ 8.140856] ? rcutree_enqueue+0x1f/0xb0 [ 8.141043] ? kmem_cache_free+0x2c/0x350 [ 8.141236] __x64_sys_sendmsg+0x72/0xc0 [ 8.141424] do_syscall_64+0x6f/0x890 [ 8.141603] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 8.141841] RIP: 0033:0x7f2799d21bd0 ... [ 8.149905] Kernel panic - not syncing: Fatal exception [ 8.175940] Kernel Offset: 0xf800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 8.176425] Rebooting in 10 seconds.. ``` Tested: With this patch, the kernel panic no longer appears. Fixes: 95af467d9a4e ("idpf: configure resources for RX queues") Signed-off-by: Li Li Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 712896ac4bce38a965a1c175f6e7804ed0381334 Author: Li Li Date: Mon Jan 5 06:47:28 2026 +0000 idpf: increment completion queue next_to_clean in sw marker wait routine Currently, in idpf_wait_for_sw_marker_completion(), when an IDPF_TXD_COMPLT_SW_MARKER packet is found, the routine breaks out of the for loop and does not increment the next_to_clean counter. This causes the subsequent NAPI polls to run into the same IDPF_TXD_COMPLT_SW_MARKER packet again and print out the following: [ 23.261341] idpf 0000:05:00.0 eth1: Unknown TX completion type: 5 Instead, we should increment next_to_clean regardless when an IDPF_TXD_COMPLT_SW_MARKER packet is found. Tested: with the patch applied, we do not see the errors above from NAPI polls anymore. Fixes: 9d39447051a0 ("idpf: remove SW marker handling from NAPI") Signed-off-by: Li Li Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 622d68772ddf07573cf88e833afe8ba6c70ac748 Author: Anirudh Rayabharam (Microsoft) Date: Wed Feb 25 12:44:03 2026 +0000 mshv: add arm64 support for doorbell & intercept SINTs On x86, the HYPERVISOR_CALLBACK_VECTOR is used to receive synthetic interrupts (SINTs) from the hypervisor for doorbells and intercepts. There is no such vector reserved for arm64. On arm64, the hypervisor exposes a synthetic register that can be read to find the INTID that should be used for SINTs. This INTID is in the PPI range. To better unify the code paths, introduce mshv_sint_vector_init() that either reads the synthetic register and obtains the INTID (arm64) or just uses HYPERVISOR_CALLBACK_VECTOR as the interrupt vector (x86). Reviewed-by: Michael Kelley Reviewed-by: Stanislav Kinsburskii Signed-off-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit 5a674ef871fe9d4c7477127340941f2c4d9a2741 Author: Anirudh Rayabharam (Microsoft) Date: Wed Feb 25 12:44:02 2026 +0000 mshv: refactor synic init and cleanup Rename mshv_synic_init() to mshv_synic_cpu_init() and mshv_synic_cleanup() to mshv_synic_cpu_exit() to better reflect that these functions handle per-cpu synic setup and teardown. Use mshv_synic_init/cleanup() to perform init/cleanup that is not per-cpu. Move all the synic related setup from mshv_parent_partition_init. Move the reboot notifier to mshv_synic.c because it currently only operates on the synic cpuhp state. Move out synic_pages from the global mshv_root since its use is now completely local to mshv_synic.c. This is in preparation for adding more stuff to mshv_synic_init(). No functional change. Reviewed-by: Michael Kelley Signed-off-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit d9d32e5bd5a4e57675f2b70ddf73c3dc5cf44fc2 Merge: 0e335a7745b0a3 55db009926634b Author: Linus Torvalds Date: Wed Feb 25 10:41:14 2026 -0800 Merge tag 'ata-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Niklas Cassel: - The newly introduced feature that issues a deferred (non-NCQ) command from a workqueue, forgot to consider the case where the deferred QC times out. Fix the code to take timeouts into consideration, which avoids a use after free (Damien) - The newly introduced feature that issues a deferred (non-NCQ) command from a workqueue, when unloading the module, calls cancel_work_sync(), a function that can sleep, while holding a spin lock. Move the function call outside the lock (Damien) * tag 'ata-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-core: fix cancellation of a port deferred qc work ata: libata-eh: correctly handle deferred qc timeouts commit 0e335a7745b0a3e0421d6b4fff718c0deeb130ee Merge: bfbc0b5b32a8f2 4a1ddb0f1c48c2 Author: Linus Torvalds Date: Wed Feb 25 10:34:23 2026 -0800 Merge tag 'vfs-7.0-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix an uninitialized variable in file_getattr(). The flags_valid field wasn't initialized before calling vfs_fileattr_get(), triggering KMSAN uninit-value reports in fuse - Fix writeback wakeup and logging timeouts when DETECT_HUNG_TASK is not enabled. sysctl_hung_task_timeout_secs is 0 in that case causing spurious "waiting for writeback completion for more than 1 seconds" warnings - Fix a null-ptr-deref in do_statmount() when the mount is internal - Add missing kernel-doc description for the @private parameter in iomap_readahead() - Fix mount namespace creation to hold namespace_sem across the mount copy in create_new_namespace(). The previous drop-and-reacquire pattern was fragile and failed to clean up mount propagation links if the real rootfs was a shared or dependent mount - Fix /proc mount iteration where m->index wasn't updated when m->show() overflows, causing a restart to repeatedly show the same mount entry in a rapidly expanding mount table - Return EFSCORRUPTED instead of ENOSPC in minix_new_inode() when the inode number is out of range - Fix unshare(2) when CLONE_NEWNS is set and current->fs isn't shared. copy_mnt_ns() received the live fs_struct so if a subsequent namespace creation failed the rollback would leave pwd and root pointing to detached mounts. Always allocate a new fs_struct when CLONE_NEWNS is requested - fserror bug fixes: - Remove the unused fsnotify_sb_error() helper now that all callers have been converted to fserror_report_metadata - Fix a lockdep splat in fserror_report() where igrab() takes inode::i_lock which can be held in IRQ context. Replace igrab() with a direct i_count bump since filesystems should not report inodes that are about to be freed or not yet exposed - Handle error pointer in procfs for try_lookup_noperm() - Fix an integer overflow in ep_loop_check_proc() where recursive calls returning INT_MAX would overflow when +1 is added, breaking the recursion depth check - Fix a misleading break in pidfs * tag 'vfs-7.0-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pidfs: avoid misleading break eventpoll: Fix integer overflow in ep_loop_check_proc() proc: Fix pointer error dereference fserror: fix lockdep complaint when igrabbing inode fsnotify: drop unused helper unshare: fix unshare_fs() handling minix: Correct errno in minix_new_inode namespace: fix proc mount iteration mount: hold namespace_sem across copy in create_new_namespace() iomap: Describe @private in iomap_readahead() statmount: Fix the null-ptr-deref in do_statmount() writeback: Fix wakeup and logging timeouts for !DETECT_HUNG_TASK fs: init flags_valid before calling vfs_fileattr_get commit 1be3b77de4eb89af8ae2fd6610546be778e25589 Author: Ziyi Guo Date: Mon Feb 9 15:19:37 2026 +0000 usb: image: mdc800: kill download URB on timeout mdc800_device_read() submits download_urb and waits for completion. If the timeout fires and the device has not responded, the function returns without killing the URB, leaving it active. A subsequent read() resubmits the same URB while it is still in-flight, triggering the WARN in usb_submit_urb(): "URB submitted while active" Check the return value of wait_event_timeout() and kill the URB if it indicates timeout, ensuring the URB is complete before its status is inspected or the URB is resubmitted. Similar to - commit 372c93131998 ("USB: yurex: fix control-URB timeout handling") - commit b98d5000c505 ("media: rc: iguanair: handle timeouts") Signed-off-by: Ziyi Guo Cc: stable Link: https://patch.msgid.link/20260209151937.2247202-1-n7l8m4@u.northwestern.edu Signed-off-by: Greg Kroah-Hartman commit 2d6d260e9a3576256fe9ef6d1f7930c9ec348723 Author: Oliver Neukum Date: Mon Feb 9 15:20:48 2026 +0100 usb: mdc800: handle signal and read racing If a signal arrives after a read has partially completed, we need to return the number of bytes read. -EINTR is correct only if that number is zero. Signed-off-by: Oliver Neukum Cc: stable Link: https://patch.msgid.link/20260209142048.1503791-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 085f067389d12bd9800c0a9672a174c1de7a8069 Author: Chen Ridong Date: Wed Feb 25 01:15:23 2026 +0000 cgroup/cpuset: fix null-ptr-deref in rebuild_sched_domains_cpuslocked A null-pointer-dereference bug was reported by syzbot: Oops: general protection fault, probably for address 0xdffffc0000000000: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:bitmap_subset include/linux/bitmap.h:433 [inline] RIP: 0010:cpumask_subset include/linux/cpumask.h:836 [inline] RIP: 0010:rebuild_sched_domains_locked kernel/cgroup/cpuset.c:967 RSP: 0018:ffffc90003ecfbc0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000020 RDX: ffff888028de0000 RSI: ffffffff8200f003 RDI: ffffffff8df14f28 RBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff R10: ffffffff8e7d95b3 R11: 0000000000000001 R12: 0000000000000000 R13: 00000000000f4240 R14: dffffc0000000000 R15: 0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2f463fff CR3: 000000003704c000 CR4: 00000000003526f0 Call Trace: rebuild_sched_domains_cpuslocked kernel/cgroup/cpuset.c:983 [inline] rebuild_sched_domains+0x21/0x40 kernel/cgroup/cpuset.c:990 sched_rt_handler+0xb5/0xe0 kernel/sched/rt.c:2911 proc_sys_call_handler+0x47f/0x5a0 fs/proc/proc_sysctl.c:600 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1070 fs/read_write.c:688 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The issue occurs when generate_sched_domains() returns ndoms = 1 and doms = NULL due to a kmalloc failure. This leads to a null-pointer dereference when accessing doms in rebuild_sched_domains_locked(). Fix this by adding a NULL check for doms before accessing it. Fixes: 6ee43047e8ad ("cpuset: Remove unnecessary checks in rebuild_sched_domains_locked") Reported-by: syzbot+460792609a79c085f79f@syzkaller.appspotmail.com Acked-by: Waiman Long Signed-off-by: Chen Ridong Signed-off-by: Tejun Heo commit 3ea20672d23b21327266534e08ca10d8f281f4ab Author: Daniel Lezcano Date: Tue Feb 24 13:41:20 2026 +0100 MAINTAINERS: Update contact with the kernel.org address Use the kernel.org address as a unified single entry to send patches to. At the same time, update mailmap to group all past contributions. Signed-off-by: Daniel Lezcano commit 0410e1a4c545c769c59c6eda897ad5d574d0c865 Author: Chen Ni Date: Mon Feb 9 15:56:18 2026 +0800 mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() Fix wrong variable used for error checking after dma_alloc_coherent() call. The function checks cdns_ctrl->dma_cdma_desc instead of cdns_ctrl->cdma_desc, which could lead to incorrect error handling. Fixes: ec4ba01e894d ("mtd: rawnand: Add new Cadence NAND driver to MTD subsystem") Cc: stable@vger.kernel.org Signed-off-by: Chen Ni Reviewed-by: Alok Tiwari Signed-off-by: Miquel Raynal commit 8e2f8020270af7777d49c2e7132260983e4fc566 Author: Finn Thain Date: Mon Feb 16 18:01:30 2026 +1100 mtd: Avoid boot crash in RedBoot partition table parser Given CONFIG_FORTIFY_SOURCE=y and a recent compiler, commit 439a1bcac648 ("fortify: Use __builtin_dynamic_object_size() when available") produces the warning below and an oops. Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000 ------------[ cut here ]------------ WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1 memcmp: detected buffer overflow: 15 byte read of buffer size 14 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE As Kees said, "'names' is pointing to the final 'namelen' many bytes of the allocation ... 'namelen' could be basically any length at all. This fortify warning looks legit to me -- this code used to be reading beyond the end of the allocation." Since the size of the dynamic allocation is calculated with strlen() we can use strcmp() instead of memcmp() and remain within bounds. Cc: Kees Cook Cc: stable@vger.kernel.org Cc: linux-hardening@vger.kernel.org Link: https://lore.kernel.org/all/202602151911.AD092DFFCD@keescook/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Kees Cook Signed-off-by: Finn Thain Signed-off-by: Miquel Raynal commit 82d938d5266256d2f4d90ed3733a421493eb3623 Author: Tudor Ambarus Date: Fri Feb 13 17:02:34 2026 +0000 MAINTAINERS: add Takahiro Kuwano as SPI NOR reviewer Takahiro has been an active contributor to the SPI NOR subsystem, providing valuable patches and reviews. Add him as a designated reviewer to help facilitate patch processing and maintenance. Cc: Takahiro Kuwano Signed-off-by: Tudor Ambarus Acked-by: Takahiro Kuwano Acked-by: Michael Walle Signed-off-by: Miquel Raynal commit 2b476739f93d286dc7c2b9d14301eaccccd789d3 Author: Tudor Ambarus Date: Fri Feb 13 17:02:33 2026 +0000 MAINTAINERS: remove Tudor Ambarus as SPI NOR maintainer I have not been actively involved in SPI NOR development recently and would like to step down to focus on my current day-to-day work. The subsystem remains in good hands with Pratyush and Michael. Signed-off-by: Tudor Ambarus Acked-by: Michael Walle Signed-off-by: Miquel Raynal commit d879ac6756b662a085a743e76023c768c3241579 Author: Alexander Gordeev Date: Tue Feb 24 07:41:07 2026 +0100 s390/pfault: Fix virtual vs physical address confusion When Linux is running as guest, runs a user space process and the user space process accesses a page that the host has paged out, the guest gets a pfault interrupt and schedules a different process. Without this mechanism the host would have to suspend the whole virtual CPU until the page has been paged in. To setup the pfault interrupt the real address of parameter list should be passed to DIAGNOSE 0x258, but a virtual address is passed instead. That has a performance impact, since the pfault setup never succeeds, the interrupt is never delivered to a guest and the whole virtual CPU is suspended as result. Cc: stable@vger.kernel.org Fixes: c98d2ecae08f ("s390/mm: Uncouple physical vs virtual address spaces") Reported-by: Claudio Imbrenda Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev Signed-off-by: Vasily Gorbik commit 1623a554c68f352c17d0a358bc62580dc187f06b Author: Vasily Gorbik Date: Mon Feb 23 23:33:52 2026 +0100 s390/kexec: Disable stack protector in s390_reset_system() s390_reset_system() calls set_prefix(0), which switches back to the absolute lowcore. At that point the stack protector canary no longer matches the canary from the lowcore the function was entered with, so the stack check fails. Mark s390_reset_system() __no_stack_protector. This is safe here since its callers (__do_machine_kdump() and __do_machine_kexec()) are effectively no-return and fall back to disabled_wait() on failure. Fixes: f5730d44e05e ("s390: Add stackprotector support") Reported-by: Nikita Dubrovskii Reviewed-by: Heiko Carstens Acked-by: Alexander Gordeev Signed-off-by: Vasily Gorbik commit 05c58a660543ce52a62b63b540f1f886c8066286 Merge: 6de23f81a5e08b acbc0437ca3cf6 Author: Vasily Gorbik Date: Wed Feb 25 16:59:16 2026 +0100 Merge branch 'idle-vtime-fixes-cleanups' into fixes Pull a small idle/vtime series with two cputime accounting fixes plus related cleanups and minor improvements. * idle-vtime-fixes-cleanups: s390/idle: Remove psw_idle() prototype s390/vtime: Use lockdep_assert_irqs_disabled() instead of BUG_ON() s390/vtime: Use __this_cpu_read() / get rid of READ_ONCE() s390/irq/idle: Remove psw bits early s390/idle: Inline update_timer_idle() s390/idle: Slightly optimize idle time accounting s390/idle: Add comment for non obvious code s390/vtime: Fix virtual timer forwarding s390/idle: Fix cpu idle exit cpu time accounting Signed-off-by: Vasily Gorbik commit acbc0437ca3cf6c19005476a4f1f5a7c96ff4256 Author: Heiko Carstens Date: Wed Feb 18 15:20:12 2026 +0100 s390/idle: Remove psw_idle() prototype psw_idle() does not exist anymore. Remove its prototype. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 80f63fd09efe9d9c016fd6378116eb7394edd2f2 Author: Heiko Carstens Date: Wed Feb 18 15:20:11 2026 +0100 s390/vtime: Use lockdep_assert_irqs_disabled() instead of BUG_ON() Use lockdep_assert_irqs_disabled() instead of BUG_ON(). This avoids crashing the kernel, and generates better code if CONFIG_PROVE_LOCKING is disabled. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit e282ccd308de7b2a65eb4596da8030c18b543071 Author: Heiko Carstens Date: Wed Feb 18 15:20:10 2026 +0100 s390/vtime: Use __this_cpu_read() / get rid of READ_ONCE() do_account_vtime() runs always with interrupts disabled, therefore use __this_cpu_read() instead of this_cpu_read() to get rid of a pointless preempt_disable() / preempt_enable() pair. Also there are no concurrent writers to the cpu time accounting fields in lowcore. Therefore get rid of READ_ONCE() usages. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit d8b5cf9c63143fae54a734c41e3bb55cf3f365c7 Author: Heiko Carstens Date: Wed Feb 18 15:20:09 2026 +0100 s390/irq/idle: Remove psw bits early Remove wait, io, external interrupt bits early in do_io_irq()/do_ext_irq() when previous context was idle. This saves one conditional branch and is closer to the original old assembly code. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 257c14e5a1d8de40fded80fd8b525af55a6ded26 Author: Heiko Carstens Date: Wed Feb 18 15:20:08 2026 +0100 s390/idle: Inline update_timer_idle() Inline update_timer_idle() again to avoid an extra function call. This way the generated code is close to old assembler version again. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 00d8b035eb71262abb547d47717b19f4a55ad4f2 Author: Heiko Carstens Date: Wed Feb 18 15:20:07 2026 +0100 s390/idle: Slightly optimize idle time accounting Slightly optimize account_idle_time_irq() and update_timer_idle(): - Use fast single instruction __atomic64() primitives to update per cpu idle_time and idle_count, instead of READ_ONCE() / WRITE_ONCE() pairs - stcctm() is an inline assembly with a full memory barrier. This leads to a not necessary extra dereference of smp_cpu_mtid in update_timer_idle(). Avoid this and read smp_cpu_mtid into a variable - Use __this_cpu_add() instead of this_cpu_add() to avoid disabling / enabling of preemption several times in a loop in update_timer_idle(). Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit aefa6ec890f0d39a89fc80e95908ec1996337eee Author: Heiko Carstens Date: Wed Feb 18 15:20:06 2026 +0100 s390/idle: Add comment for non obvious code Add a comment to update_timer_idle() which describes why wall time (not steal time) is added to steal_timer. This is not obvious and was reported by Frederic Weisbecker. Reported-by: Frederic Weisbecker Closes: https://lore.kernel.org/all/aXEVM-04lj0lntMr@localhost.localdomain/ Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit dbc0fb35679ed5d0adecf7d02137ac2c77244b3b Author: Heiko Carstens Date: Wed Feb 18 15:20:05 2026 +0100 s390/vtime: Fix virtual timer forwarding Since delayed accounting of system time [1] the virtual timer is forwarded by do_account_vtime() but also vtime_account_kernel(), vtime_account_softirq(), and vtime_account_hardirq(). This leads to double accounting of system, guest, softirq, and hardirq time. Remove accounting from the vtime_account*() family to restore old behavior. There is only one user of the vtimer interface, which might explain why nobody noticed this so far. Fixes: b7394a5f4ce9 ("sched/cputime, s390: Implement delayed accounting of system time") [1] Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 0d785e2c324c90662baa4fe07a0d02233ff92824 Author: Heiko Carstens Date: Wed Feb 18 15:20:04 2026 +0100 s390/idle: Fix cpu idle exit cpu time accounting With the conversion to generic entry [1] cpu idle exit cpu time accounting was converted from assembly to C. This introduced an reversed order of cpu time accounting. On cpu idle exit the current accounting happens with the following call chain: -> do_io_irq()/do_ext_irq() -> irq_enter_rcu() -> account_hardirq_enter() -> vtime_account_irq() -> vtime_account_kernel() vtime_account_kernel() accounts the passed cpu time since last_update_timer as system time, and updates last_update_timer to the current cpu timer value. However the subsequent call of -> account_idle_time_irq() will incorrectly subtract passed cpu time from timer_idle_enter to the updated last_update_timer value from system_timer. Then last_update_timer is updated to a sys_enter_timer, which means that last_update_timer goes back in time. Subsequently account_hardirq_exit() will account too much cpu time as hardirq time. The sum of all accounted cpu times is still correct, however some cpu time which was previously accounted as system time is now accounted as hardirq time, plus there is the oddity that last_update_timer goes back in time. Restore previous behavior by extracting cpu time accounting code from account_idle_time_irq() into a new update_timer_idle() function and call it before irq_enter_rcu(). Fixes: 56e62a737028 ("s390: convert to generic entry") [1] Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 85f6c439a69afe4fa8a688512e586971e97e273a Author: Pavel Begunkov Date: Wed Feb 25 10:35:57 2026 +0000 io_uring/timeout: READ_ONCE sqe->addr We should use READ_ONCE when reading from a SQE, make sure timeout gets a stable timespec address. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit e9fb2028f1eb563e653cff3b0d1c87c5e0203d45 Author: Panagiotis Foliadis Date: Wed Feb 25 14:53:43 2026 +0000 ALSA: hda/intel: increase default bdl_pos_adj for Nvidia controllers The default bdl_pos_adj of 32 for Nvidia HDA controllers is insufficient on GA102 (and likely other recent Nvidia GPUs) after S3 suspend/resume. The controller's DMA timing degrades after resume, causing premature IRQ detection in azx_position_ok() which results in silent HDMI/DP audio output despite userspace reporting a valid playback state and correct ELD data. Increase bdl_pos_adj to 64 for AZX_DRIVER_NVIDIA, matching the value already used by Intel Apollo Lake for the same class of timing issue. Cc: stable@vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221069 Suggested-by: Charalampos Mitrodimas Signed-off-by: Panagiotis Foliadis Link: https://patch.msgid.link/20260225-nvidia-audio-fix-v1-1-b1383c37ec49@posteo.net Signed-off-by: Takashi Iwai commit ab6088e7a95943af3452b20e3b96caaaef3eeebd Author: Nathan Chancellor Date: Tue Feb 24 16:16:30 2026 -0700 lib/Kconfig.debug: Require a release version of LLVM 22 for context analysis Using a prerelease version as a minimum supported version for CONFIG_WARN_CONTEXT_ANALYSIS was reasonable to do while LLVM 22 was the development version so that people could immediately build from main and start testing and validating this in their own code. However, it can be problematic when using prerelease versions of LLVM 22, such as Android clang 22.0.1 (the current android mainline compiler) or when bisecting LLVM between llvmorg-22-init and llvmorg-23-init, to build the kernel, as all compiler fixes for the context analysis may not be present, potentially resulting in warnings that can easily turn into errors. Now that LLVM 22 is released as 22.1.0, upgrade the check to require at least this version to ensure that a user's toolchain actually has all the changes needed for a smooth experience with context analysis. Fixes: 3269701cb256 ("compiler-context-analysis: Add infrastructure for Context Analysis with Clang") Signed-off-by: Nathan Chancellor Signed-off-by: Peter Zijlstra (Intel) Acked-by: Marco Elver Link: https://patch.msgid.link/20260224-bump-clang-ver-context-analysis-v1-1-16cc7a90a040@kernel.org commit c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae Author: Peter Zijlstra Date: Tue Feb 24 13:29:09 2026 +0100 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race Make sure that __perf_event_overflow() runs with IRQs disabled for all possible callchains. Specifically the software events can end up running it with only preemption disabled. This opens up a race vs perf_event_exit_event() and friends that will go and free various things the overflow path expects to be present, like the BPF program. Fixes: 592903cdcbf6 ("perf_counter: add an event_list") Reported-by: Simond Hu Signed-off-by: Peter Zijlstra (Intel) Tested-by: Simond Hu Link: https://patch.msgid.link/20260224122909.GV1395416@noisy.programming.kicks-ass.net commit 6b050482ec40569429d963ac52afa878691b04c9 Author: Srinivas Pandruvada Date: Tue Feb 24 16:17:52 2026 -0800 cpufreq: intel_pstate: Fix crash during turbo disable When the system is booted with kernel command line argument "nosmt" or "maxcpus" to limit the number of CPUs, disabling turbo via: echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo results in a crash: PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI ... RIP: 0010:store_no_turbo+0x100/0x1f0 ... This occurs because for_each_possible_cpu() returns CPUs even if they are not online. For those CPUs, all_cpu_data[] will be NULL. Since commit 973207ae3d7c ("cpufreq: intel_pstate: Rearrange max frequency updates handling code"), all_cpu_data[] is dereferenced even for CPUs which are not online, causing the NULL pointer dereference. To fix that, pass CPU number to intel_pstate_update_max_freq() and use all_cpu_data[] for those CPUs for which there is a valid cpufreq policy. Fixes: 973207ae3d7c ("cpufreq: intel_pstate: Rearrange max frequency updates handling code") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221068 Signed-off-by: Srinivas Pandruvada Cc: 6.16+ # 6.16+ Link: https://patch.msgid.link/20260225001752.890164-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 650b774cf94495465d6a38c31bb1a6ce697b6b37 Author: Wilfred Mallawa Date: Wed Feb 11 13:29:04 2026 +1000 xfs: add static size checks for ioctl UABI The ioctl structures in libxfs/xfs_fs.h are missing static size checks. It is useful to have static size checks for these structures as adding new fields to them could cause issues (e.g. extra padding that may be inserted by the compiler). So add these checks to xfs/xfs_ondisk.h. Due to different padding/alignment requirements across different architectures, to avoid build failures, some structures are ommited from the size checks. For example, structures with "compat_" definitions in xfs/xfs_ioctl32.h are ommited. Signed-off-by: Wilfred Mallawa Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit e97cbf863d8918452c9f81bebdade8d04e2e7b60 Author: Wilfred Mallawa Date: Wed Feb 11 13:29:02 2026 +1000 xfs: remove duplicate static size checks In libxfs/xfs_ondisk.h, remove some duplicate entries of XFS_CHECK_STRUCT_SIZE(). Signed-off-by: Wilfred Mallawa Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 9a654a8fa3191e9ea32c4494b943c0872a3f5d27 Author: Nirjhar Roy (IBM) Date: Fri Feb 20 12:24:01 2026 +0530 xfs: Add comments for usages of some macros. Add comments explaining when to use XFS_IS_CORRUPT() and ASSERT() Suggested-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Nirjhar Roy (IBM) Signed-off-by: Carlos Maiolino commit c2368fc89a684be2900daaa2bbf68cbc147e8d3d Author: Nirjhar Roy (IBM) Date: Fri Feb 20 12:24:00 2026 +0530 xfs: Update lazy counters in xfs_growfs_rt_bmblock() Update lazy counters in xfs_growfs_rt_bmblock() similar to the way it is done xfs_growfs_data_private(). This is because the lazy counters are not always updated and synching the counters will avoid inconsistencies between frexents and rtextents(total realtime extent count). This will be more useful once realtime shrink is implemented as this will prevent some transient state to occur where frexents might be greater than total rtextents. Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Nirjhar Roy (IBM) Signed-off-by: Carlos Maiolino commit ac1d977096a17d56c55bd7f90be48e81ac4cec3f Author: Nirjhar Roy (IBM) Date: Fri Feb 20 12:23:59 2026 +0530 xfs: Add a comment in xfs_log_sb() Add a comment explaining why the sb_frextents are updated outside the if (xfs_has_lazycount(mp) check even though it is a lazycounter. RT groups are supported only in v5 filesystems which always have lazycounter enabled - so putting it inside the if(xfs_has_lazycount(mp) check is redundant. Suggested-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Nirjhar Roy (IBM) Signed-off-by: Carlos Maiolino commit 8baa9bccc0156d6952d337bf17f57ce15902dfe4 Author: Nirjhar Roy (IBM) Date: Fri Feb 20 12:23:58 2026 +0530 xfs: Fix xfs_last_rt_bmblock() Bug description: If the size of the last rtgroup i.e, the rtg passed to xfs_last_rt_bmblock() is such that the last rtextent falls in 0th word offset of a bmblock of the bitmap file tracking this (last) rtgroup, then in that case xfs_last_rt_bmblock() incorrectly returns the next bmblock number instead of the current/last used bmblock number. When xfs_last_rt_bmblock() incorrectly returns the next bmblock, the loop to grow/modify the bmblocks in xfs_growfs_rtg() doesn't execute and xfs_growfs basically does a nop in certain cases. xfs_growfs will do a nop when the new size of the fs will have the same number of rtgroups i.e, we are only growing the last rtgroup. Reproduce: $ mkfs.xfs -m metadir=0 -r rtdev=/dev/loop1 /dev/loop0 \ -r size=32769b -f $ mount -o rtdev=/dev/loop1 /dev/loop0 /mnt/scratch $ xfs_growfs -R $(( 32769 + 1 )) /mnt/scratch $ xfs_info /mnt/scratch | grep rtextents $ # We can see that rtextents hasn't changed Fix: Fix this by returning the current/last used bmblock when the last rtgroup size is not a multiple xfs_rtbitmap_rtx_per_rbmblock() and the next bmblock when the rtgroup size is a multiple of xfs_rtbitmap_rtx_per_rbmblock() i.e, the existing blocks are completely used up. Also, I have renamed xfs_last_rt_bmblock() to xfs_last_rt_bmblock_to_extend() to signify that this function returns the bmblock number to extend and NOT always the last used bmblock number. Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Nirjhar Roy (IBM) Signed-off-by: Carlos Maiolino commit 115ea07b94d2f13942fbd93c6acde376db36b16a Author: Darrick J. Wong Date: Wed Feb 18 15:25:38 2026 -0800 xfs: don't report half-built inodes to fserror Sam Sun apparently found a syzbot way to fuzz a filesystem such that xfs_iget_cache_miss would free the inode before the fserror code could catch up. Frustratingly he doesn't use the syzbot dashboard so there's no C reproducer and not even a full error report, so I'm guessing that: Inodes that are being constructed or torn down inside XFS are not visible to the VFS. They should never be reported to fserror. Also, any inode that has been freshly allocated in _cache_miss should be marked INEW immediately because, well, it's an incompletely constructed inode that isn't yet visible to the VFS. Reported-by: Sam Sun Fixes: 5eb4cb18e445d0 ("xfs: convey metadata health events to the health monitor") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 75690e5fdd74fc4d2a4aec58be9a82aec7cee721 Author: Darrick J. Wong Date: Wed Feb 18 15:25:38 2026 -0800 xfs: don't report metadata inodes to fserror Internal metadata inodes are not exposed to userspace programs, so it makes no sense to pass them to the fserror functions (aka fsnotify). Instead, report metadata file problems as general filesystem corruption. Fixes: 5eb4cb18e445d0 ("xfs: convey metadata health events to the health monitor") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 94014a23e91a3944947048169ccf38b4561cfd0c Author: Darrick J. Wong Date: Wed Feb 18 15:25:37 2026 -0800 xfs: fix potential pointer access race in xfs_healthmon_get Pankaj Raghav asks about this code in xfs_healthmon_get: hm = mp->m_healthmon; if (hm && !refcount_inc_not_zero(&hm->ref)) hm = NULL; rcu_read_unlock(); return hm; (slightly edited to compress a mailing list thread) "Nit: Should we do a READ_ONCE(mp->m_healthmon) here to avoid any compiler tricks that can result in an undefined behaviour? I am not sure if I am being paranoid here. "So this is my understanding: RCU guarantees that we get a valid object (actual data of m_healthmon) but does not guarantee the compiler will not reread the pointer between checking if hm is !NULL and accessing the pointer as we are doing it lockless. "So just a barrier() call in rcu_read_lock is enough to make sure this doesn't happen and probably adding a READ_ONCE() is not needed?" After some initial confusion I concluded that he's correct. The compiler could very well eliminate the hm variable in favor of walking the pointers twice, turning the code into: if (mp->m_healthmon && !refcount_inc_not_zero(&mp->m_healthmon->ref)) If this happens, then xfs_healthmon_detach can sneak in between the two sides of the && expression and set mp->m_healthmon to NULL, and thereby cause a null pointer dereference crash. Fix this by using the rcu pointer assignment and dereference functions, which ensure that the proper reordering barriers are in place. Practically speaking, gcc seems to allocate an actual variable for hm and only reads mp->m_healthmon once (as intended), but we ought to be more explicit about requiring this. Reported-by: Pankaj Raghav Fixes: a48373e7d35a89f6f ("xfs: start creating infrastructure for health monitoring") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Pankaj Raghav Signed-off-by: Carlos Maiolino commit eb8550fb75a875657dc29e3925a40244ec6b6bd6 Author: Darrick J. Wong Date: Wed Feb 18 15:25:36 2026 -0800 xfs: fix xfs_group release bug in xfs_dax_notify_dev_failure Chris Mason reports that his AI tools noticed that we were using xfs_perag_put and xfs_group_put to release the group reference returned by xfs_group_next_range. However, the iterator function returns an object with an active refcount, which means that we must use the correct function to release the active refcount, which is _rele. Cc: # v6.0 Fixes: 6f643c57d57c56 ("xfs: implement ->notify_failure() for XFS") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 161456987a1fe4ad73c3f36dec1f684316ac9bdd Author: Darrick J. Wong Date: Wed Feb 18 15:25:35 2026 -0800 xfs: fix xfs_group release bug in xfs_verify_report_losses Chris Mason reports that his AI tools noticed that we were using xfs_perag_put and xfs_group_put to release the group reference returned by xfs_group_next_range. However, the iterator function returns an object with an active refcount, which means that we must use the correct function to release the active refcount, which is _rele. Fixes: b8accfd65d31f2 ("xfs: add media verification ioctl") Reported-by: Chris Mason Link: https://lore.kernel.org/linux-xfs/20260206030527.2506821-1-clm@meta.com/ Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit e764dd439d68cfc16724e469db390d779ab49521 Author: Darrick J. Wong Date: Wed Feb 18 15:25:35 2026 -0800 xfs: fix copy-paste error in previous fix Chris Mason noticed that there is a copy-paste error in a recent change to xrep_dir_teardown that nulls out pointers after freeing the resources. Fixes: ba408d299a3bb3c ("xfs: only call xf{array,blob}_destroy if we have a valid pointer") Link: https://lore.kernel.org/linux-xfs/20260205194211.2307232-1-clm@meta.com/ Reported-by: Chris Mason Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit cddfa648f1ab99e30e91455be19cd5ade26338c2 Author: Ethan Tidmore Date: Thu Feb 19 21:38:25 2026 -0600 xfs: Fix error pointer dereference The function try_lookup_noperm() can return an error pointer and is not checked for one. Add checks for error pointer in xrep_adoption_check_dcache() and xrep_adoption_zap_dcache(). Detected by Smatch: fs/xfs/scrub/orphanage.c:449 xrep_adoption_check_dcache() error: 'd_child' dereferencing possible ERR_PTR() fs/xfs/scrub/orphanage.c:485 xrep_adoption_zap_dcache() error: 'd_child' dereferencing possible ERR_PTR() Fixes: 73597e3e42b4 ("xfs: ensure dentry consistency when the orphanage adopts a file") Cc: stable@vger.kernel.org # v6.16 Signed-off-by: Ethan Tidmore Reviewed-by: Darrick J. Wong Reviewed-by: Nirjhar Roy (IBM) Signed-off-by: Carlos Maiolino commit 47553dd60b1da88df2354f841a4f71dd4de6478a Author: Christoph Hellwig Date: Mon Feb 2 15:14:32 2026 +0100 xfs: remove metafile inodes from the active inode stat The active inode (or active vnode until recently) stat can get much larger than expected on file systems with a lot of metafile inodes like zoned file systems on SMR hard disks with 10.000s of rtg rmap inodes. Remove all metafile inodes from the active counter to make it more useful to track actual workloads and add a separate counter for active metafile inodes. This fixes xfs/177 on SMR hard drives. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 03a6d6c4c85d2758534638fb2bb5f72e0f8877d0 Author: Christoph Hellwig Date: Mon Feb 2 15:14:31 2026 +0100 xfs: cleanup inode counter stats Most of them are unused, so mark them as such. Give the remaining ones names that match their use instead of the historic IRIX ones based on vnodes. Note that the names are purely internal to the XFS code, the user interface is based on section names and arrays of counters. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit fd81d3fd01a5ee4bd26a7dc440e7a2209277d14b Author: Wilfred Mallawa Date: Fri Feb 13 08:50:06 2026 +1000 xfs: fix code alignment issues in xfs_ondisk.c Fixup some code alignment issues in xfs_ondisk.c Signed-off-by: Wilfred Mallawa Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 4ad85e633bc576a5cc8c8310aab141af7ed20efa Author: Nirjhar Roy (IBM) Date: Wed Feb 11 19:25:14 2026 +0530 xfs: Replace &rtg->rtg_group with rtg_group() Use the already existing rtg_group() wrapper instead of directly accessing the struct xfs_group member in struct xfs_rtgroup. Reviewed-by: Christoph Hellwig Signed-off-by: Nirjhar Roy (IBM) [cem: Conflict resolution against 06873dbd940d] Signed-off-by: Carlos Maiolino commit a49b7ff63f98ba1c4503869c568c99ecffa478f2 Author: Nirjhar Roy (IBM) Date: Wed Feb 11 19:25:13 2026 +0530 xfs: Refactoring the nagcount and delta calculation Introduce xfs_growfs_compute_delta() to calculate the nagcount and delta blocks and refactor the code from xfs_growfs_data_private(). No functional changes. Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Nirjhar Roy (IBM) Signed-off-by: Carlos Maiolino commit 18c16f602a67782f5eb4b5ab9ba73350b9f711ec Author: Nirjhar Roy (IBM) Date: Wed Feb 4 20:36:26 2026 +0530 xfs: Replace ASSERT with XFS_IS_CORRUPT in xfs_rtcopy_summary() Replace ASSERT(sum > 0) with an XFS_IS_CORRUPT() and place it just after the call to xfs_rtget_summary() so that we don't end up using an illegal value of sum. Signed-off-by: Nirjhar Roy (IBM) Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 104016eb671e19709721c1b0048dd912dc2e96be Author: Jacob Moroni Date: Tue Feb 24 23:41:53 2026 +0000 RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately unpinned but the umem_dmabuf->pinned flag is still set. Then, when ib_umem_release() is called, it calls ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again. Fix this by removing the immediate unpin upon failure and just let the ib_umem_release/revoke path handle it. This also ensures the proper unmap-unpin unwind ordering if the dmabuf_map_pages call happened to fail due to dma_resv_wait_timeout (and therefore has a non-NULL umem_dmabuf->sgt). Fixes: 1e4df4a21c5a ("RDMA/umem: Allow pinned dmabuf umem usage") Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260224234153.1207849-1-jmoroni@google.com Signed-off-by: Leon Romanovsky commit 93a4a9b732fbb479f95d327aa867d094aed3f712 Author: Stefan Metzmacher Date: Tue Feb 24 17:59:52 2026 +0100 RDMA/core: Check id_priv->restricted_node_type in cma_listen_on_dev() When listening on wildcard addresses we have a global list for the application layer rdma_cm_id and for any existing device or any device added in future we try to listen on any wildcard listener. When the listener has a restricted_node_type we should prevent listening on devices with a different node type. While there fix the documentation comment of rdma_restrict_node_type() to include rdma_resolve_addr() instead of having rdma_bind_addr() twice. Fixes: a760e80e90f5 ("RDMA/core: introduce rdma_restrict_node_type()") Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Steve French Cc: Namjae Jeon Cc: Tom Talpey Cc: Long Li Cc: linux-rdma@vger.kernel.org Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Link: https://patch.msgid.link/20260224165951.3582093-2-metze@samba.org Signed-off-by: Leon Romanovsky commit 54e367cb94d6bef941bbc1132d9959dc73bd4b6f Author: Marc Zyngier Date: Wed Feb 25 10:47:18 2026 +0000 KVM: arm64: Deduplicate ASID retrieval code We currently have three versions of the ASID retrieval code, one in the S1 walker, and two in the VNCR handling (although the last two are limited to the EL2&0 translation regime). Make this code common, and take this opportunity to also simplify the code a bit while switching over to the TTBRx_EL1_ASID macro. Reviewed-by: Joey Gouly Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260225104718.14209-1-maz@kernel.org Signed-off-by: Marc Zyngier commit ee66bc29578391c9b48523dc9119af67bd5c7c0f Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:36 2026 -0800 dmaengine: idxd: Fix leaking event log memory During the device remove process, the device is reset, causing the configuration registers to go back to their default state, which is zero. As the driver is checking if the event log support was enabled before deallocating, it will fail if a reset happened before. Do not check if the support was enabled, the check for 'idxd->evl' being valid (only allocated if the HW capability is available) is enough. Fixes: 244da66cda35 ("dmaengine: idxd: setup event log configuration") Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-10-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit c311f5e9248471a950f0a524c2fd736414d98900 Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:35 2026 -0800 dmaengine: idxd: Fix freeing the allocated ida too late It can happen that when the cdev .release() is called, the driver already called ida_destroy(). Move ida_free() to the _del() path. We see with DEBUG_KOBJECT_RELEASE enabled and forcing an early PCI unbind. Fixes: 04922b7445a1 ("dmaengine: idxd: fix cdev setup and free device lifetime issues") Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-9-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478 Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:34 2026 -0800 dmaengine: idxd: Fix memory leak when a wq is reset idxd_wq_disable_cleanup() which is called from the reset path for a workqueue, sets the wq type to NONE, which for other parts of the driver mean that the wq is empty (all its resources were released). Only set the wq type to NONE after its resources are released. Fixes: da32b28c95a7 ("dmaengine: idxd: cleanup workqueue config after disabling") Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-8-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit 3d33de353b1ff9023d5ec73b9becf80ea87af695 Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:33 2026 -0800 dmaengine: idxd: Fix not releasing workqueue on .release() The workqueue associated with an DSA/IAA device is not released when the object is freed. Fixes: 47c16ac27d4c ("dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime") Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-7-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit 4fd3c4679f4f33873d7cb90b3eb553bea4db1038 Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:32 2026 -0800 dmaengine: idxd: Wait for submitted operations on .device_synchronize() When the dmaengine "core" asks the driver to synchronize, send a Drain operation to the device workqueue, which will wait for the already submitted operations to finish. Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-6-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit 2a93f5747d0eef89a3158c91d185d37d0bca2491 Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:31 2026 -0800 dmaengine: idxd: Flush all pending descriptors When used as a dmaengine, the DMA "core" might ask the driver to terminate all pending requests, when that happens, flush all pending descriptors. In this context, flush means removing the requests from the pending lists, so even if they are completed after, the user is not notified. Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-5-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit f019d7814bceb6d8a017b3e55cb53deb1e6fd36b Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:30 2026 -0800 dmaengine: idxd: Flush kernel workqueues on Function Level Reset When a Function Level Reset (FLR) happens, terminate the pending descriptors that were issued by in-kernel users and disable the interrupts associated with those. They will be re-enabled after FLR finishes. idxd_wq_flush_desc() is declared on idxd.h because it's going to be used in by the DMA backend in a future patch. Signed-off-by: Vinicius Costa Gomes Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-4-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit d6077df7b75d26e4edf98983836c05d00ebabd8d Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:29 2026 -0800 dmaengine: idxd: Fix possible invalid memory access after FLR In the case that the first Function Level Reset (FLR) concludes correctly, but in the second FLR the scratch area for the saved configuration cannot be allocated, it's possible for a invalid memory access to happen. Always set the deallocated scratch area to NULL after FLR completes. Fixes: 98d187a98903 ("dmaengine: idxd: Enable Function Level Reset (FLR) for halt") Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-3-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit 52d2edea0d63c935e82631e4b9e4a94eccf97b5b Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:28 2026 -0800 dmaengine: idxd: Fix crash when the event log is disabled If reporting errors to the event log is not supported by the hardware, and an error that causes Function Level Reset (FLR) is received, the driver will try to restore the event log even if it was not allocated. Also, only try to free the event log if it was properly allocated. Fixes: 6078a315aec1 ("dmaengine: idxd: Add idxd_device_config_save() and idxd_device_config_restore() helpers") Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-2-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit caf91cdf2de8b7134749d32cd4ae5520b108abb7 Author: Vinicius Costa Gomes Date: Wed Jan 21 10:34:27 2026 -0800 dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config() Move the check for IDXD_FLAG_CONFIGURABLE and the locking to "inside" idxd_device_config(), as this is common to all callers, and the one that wasn't holding the lock was an error (that was causing the lockdep warning). Suggested-by: Dave Jiang Reviewed-by: Dave Jiang Signed-off-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-1-7ed70658a9d1@intel.com Signed-off-by: Vinod Koul commit a4b0bf6a40f3c107c67a24fbc614510ef5719980 Author: Mike Rapoport (Microsoft) Date: Wed Feb 25 08:55:55 2026 +0200 x86/efi: defer freeing of boot services memory efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA using memblock_free_late(). There are two issue with that: memblock_free_late() should be used for memory allocated with memblock_alloc() while the memory reserved with memblock_reserve() should be freed with free_reserved_area(). More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y efi_free_boot_services() is called before deferred initialization of the memory map is complete. Benjamin Herrenschmidt reports that this causes a leak of ~140MB of RAM on EC2 t3a.nano instances which only have 512MB or RAM. If the freed memory resides in the areas that memory map for them is still uninitialized, they won't be actually freed because memblock_free_late() calls memblock_free_pages() and the latter skips uninitialized pages. Using free_reserved_area() at this point is also problematic because __free_page() accesses the buddy of the freed page and that again might end up in uninitialized part of the memory map. Delaying the entire efi_free_boot_services() could be problematic because in addition to freeing boot services memory it updates efi.memmap without any synchronization and that's undesirable late in boot when there is concurrency. More robust approach is to only defer freeing of the EFI boot services memory. Split efi_free_boot_services() in two. First efi_unmap_boot_services() collects ranges that should be freed into an array then efi_free_boot_services() later frees them after deferred init is complete. Link: https://lore.kernel.org/all/ec2aaef14783869b3be6e3c253b2dcbf67dbc12a.camel@kernel.crashing.org Fixes: 916f676f8dc0 ("x86, efi: Retain boot service code until after switching to virtual mode") Cc: Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Benjamin Herrenschmidt Signed-off-by: Ard Biesheuvel commit 77b19d053ac2cce9e873007ad4b09f2323c93576 Author: Shenghui Shi Date: Mon Feb 9 18:37:25 2026 +0800 dmaengine: dw-edma: fix MSI data programming for multi-IRQ case When using MSI (not MSI-X) with multiple IRQs, the MSI data value must be unique per vector to ensure correct interrupt delivery. Currently, the driver fails to increment the MSI data per vector, causing interrupts to be misrouted. Fix this by caching the base MSI data and adjusting each vector's data accordingly during IRQ setup. Fixes: e63d79d1ff04 ("dmaengine: dw-edma: Add Synopsys DesignWare eDMA IP core driver") Signed-off-by: Shenghui Shi Reviewed-by: Frank Li Link: https://patch.msgid.link/20260209103726.414-1-brody.shi@m2semi.com Signed-off-by: Vinod Koul commit 4a2d046e4b13202a6301a993961f5b30ae4d7119 Author: Gao Xiang Date: Tue Feb 24 18:31:25 2026 +0800 erofs: fix interlaced plain identification for encoded extents Only plain data whose start position and on-disk physical length are both aligned to the block size should be classified as interlaced plain extents. Otherwise, it must be treated as shifted plain extents. This issue was found by syzbot using a crafted compressed image containing plain extents with unaligned physical lengths, which can cause OOB read in z_erofs_transform_plain(). Reported-and-tested-by: syzbot+d988dc155e740d76a331@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/699d5714.050a0220.cdd3c.03e7.GAE@google.com Fixes: 1d191b4ca51d ("erofs: implement encoded extent metadata") Signed-off-by: Gao Xiang commit 2e7b5cf72e51c9cf9c8b75190189c757df31ddd9 Author: Joy Zou Date: Wed Sep 17 17:53:42 2025 +0800 dmaengine: fsl-edma: fix channel parameter config for fixed channel requests Configure only the requested channel when a fixed channel is specified to avoid modifying other channels unintentionally. Fix parameter configuration when a fixed DMA channel is requested on i.MX9 AON domain and i.MX8QM/QXP/DXL platforms. When a client requests a fixed channel (e.g., channel 6), the driver traverses channels 0-5 and may unintentionally modify their configuration if they are unused. This leads to issues such as setting the `is_multi_fifo` flag unexpectedly, causing memcpy tests to fail when using the dmatest tool. Only affect edma memcpy test when the channel is fixed. Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support") Signed-off-by: Joy Zou Cc: stable@vger.kernel.org Reviewed-by: Frank Li Link: https://patch.msgid.link/20250917-b4-edma-chanconf-v1-1-886486e02e91@nxp.com Signed-off-by: Vinod Koul commit 4e9113c533acee2ba1f72fd68ee6ecd36b64484e Author: Takashi Iwai Date: Wed Feb 25 09:52:31 2026 +0100 ALSA: usb-audio: Use inclusive terms Replace the remaining with inclusive terms; it's only this function name we overlooked at the previous conversion. Fixes: 53837b4ac2bd ("ALSA: usb-audio: Replace slave/master terms") Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260225085233.316306-5-tiwai@suse.de Signed-off-by: Takashi Iwai commit c5bf24c8aba1ff711226ee0f039ff01a5754692b Author: Takashi Iwai Date: Wed Feb 25 09:52:30 2026 +0100 ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 Although DIYINHK USB Audio 2.0 (ID 20b1:2009) shows the implicit feedback source for the capture stream, this would cause several problems for the playback. Namely, the device can get wMaxPackSize 1024 for 24/32 bit format with 6 channels, and when a high sample rate like 352.8kHz or 384kHz is played, the packet size overflows the max limit. Also, the device has another two playback altsets, and those aren't properly handled with the implicit feedback. Since the device has been working well even before introducing the implicit feedback, we can assume that it works fine in the async mode. This patch adds the explicit skip of the implicit fb detection to make the playback running in the async mode. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260225085233.316306-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit 7cb2a5422f5bbdf1cf32eae0eda41000485b9346 Author: Takashi Iwai Date: Wed Feb 25 09:52:29 2026 +0100 ALSA: usb-audio: Check max frame size for implicit feedback mode, too When the packet sizes are taken from the capture stream in the implicit feedback mode, the sizes might be larger than the upper boundary defined by the descriptor. As already done for other transfer modes, we have to cap the sizes accordingly at sending, otherwise this would lead to an error in USB core at submission of URBs. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260225085233.316306-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit 7fe8dec3f628e9779f1631576f8e693370050348 Author: Takashi Iwai Date: Wed Feb 25 09:52:28 2026 +0100 ALSA: usb-audio: Cap the packet size pre-calculations We calculate the possible packet sizes beforehand for adaptive and synchronous endpoints, but we didn't take care of the max frame size for those pre-calculated values. When a device or a bus limits the packet size, a high sample rate or a high number of channels may lead to the packet sizes that are larger than the given limit, which results in an error from the USB core at submitting URBs. As a simple workaround, just add the sanity checks of pre-calculated packet sizes to have the upper boundary of ep->maxframesize. Fixes: f0bd62b64016 ("ALSA: usb-audio: Improve frames size computation") Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260225085233.316306-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 29c8b85adb47daefc213381bc1831787f512d89b Author: Sascha Bischoff Date: Wed Feb 25 08:31:40 2026 +0000 irqchip/gic-v5: Fix inversion of IRS_IDR0.virt flag It appears that a !! became ! during a cleanup, resulting in inverted logic when detecting if a host GICv5 implementation is capable of virtualization. Re-add the missing !, fixing the behaviour. Fixes: 3227c3a89d65f ("irqchip/gic-v5: Check if impl is virt capable") Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20260225083130.3378490-1-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2 Author: Sabrina Dubroca Date: Tue Feb 24 00:05:14 2026 +0100 esp: fix skb leak with espintcp and async crypto When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us. With async crypto (esp_output_done), we need to drop the skb when esp_output_tail_tcp returns an error. Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 7d2fc41f91bc69acb6e01b0fa23cd7d0109a6a23 Author: Sabrina Dubroca Date: Tue Feb 24 00:05:13 2026 +0100 xfrm: call xdo_dev_state_delete during state update When we update an SA, we construct a new state and call xdo_dev_state_add, but never insert it. The existing state is updated, then we immediately destroy the new state. Since we haven't added it, we don't go through the standard state delete code, and we're skipping removing it from the device (but xdo_dev_state_free will get called when we destroy the temporary state). This is similar to commit c5d4d7d83165 ("xfrm: Fix deletion of offloaded SAs on failure."). Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit b57defcf8f109da5ba9cf59b2a736606faf3d846 Author: Sabrina Dubroca Date: Tue Feb 24 00:05:12 2026 +0100 xfrm: fix the condition on x->pcpu_num in xfrm_sa_len pcpu_num = 0 is a valid value. The marker for "unset pcpu_num" which makes copy_to_user_state_extra not add the XFRMA_SA_PCPU attribute is UINT_MAX. Fixes: 1ddf9916ac09 ("xfrm: Add support for per cpu xfrm state handling.") Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit aa8a3f3c67235422a0c3608a8772f69ca3b7b63f Author: Sabrina Dubroca Date: Tue Feb 24 00:05:11 2026 +0100 xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi We're returning an error caused by invalid user input without setting an extack. Add one. Fixes: 1ddf9916ac09 ("xfrm: Add support for per cpu xfrm state handling.") Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit 83236b2e43dba00bee5b82eb5758816b1a674f6a Author: Tejun Heo Date: Tue Feb 24 21:39:58 2026 -1000 sched_ext: Disable preemption between scx_claim_exit() and kicking helper work scx_claim_exit() atomically sets exit_kind, which prevents scx_error() from triggering further error handling. After claiming exit, the caller must kick the helper kthread work which initiates bypass mode and teardown. If the calling task gets preempted between claiming exit and kicking the helper work, and the BPF scheduler fails to schedule it back (since error handling is now disabled), the helper work is never queued, bypass mode never activates, tasks stop being dispatched, and the system wedges. Disable preemption across scx_claim_exit() and the subsequent work kicking in all callers - scx_disable() and scx_vexit(). Add lockdep_assert_preemption_disabled() to scx_claim_exit() to enforce the requirement. Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class") Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit c601fd5414315fc515f746b499110e46272e7243 Author: Jonathan Cavitt Date: Tue Feb 24 22:12:28 2026 +0000 drm/client: Do not destroy NULL modes 'modes' in drm_client_modeset_probe may fail to kcalloc. If this occurs, we jump to 'out', calling modes_destroy on it, which dereferences it. This may result in a NULL pointer dereference in the error case. Prevent that. Fixes: 3039cc0c0653 ("drm/client: Make copies of modes") Signed-off-by: Jonathan Cavitt Cc: Ville Syrjälä Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260224221227.69126-2-jonathan.cavitt@intel.com commit c45f7263100cece247dd3fa5fe277bd97fdb5687 Author: Liwei Song Date: Thu Feb 12 12:00:35 2026 +0800 firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled When the Remote System Update (RSU) isn't enabled in the First Stage Boot Loader (FSBL), the driver encounters a NULL pointer dereference when excute svc_normal_to_secure_thread() thread, resulting in a kernel panic: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Mem abort info: ... Data abort info: ... [0000000000000008] user address but active_mm is swapper Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 79 Comm: svc_smc_hvc_thr Not tainted 6.19.0-rc8-yocto-standard+ #59 PREEMPT Hardware name: SoCFPGA Stratix 10 SoCDK (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : svc_normal_to_secure_thread+0x38c/0x990 lr : svc_normal_to_secure_thread+0x144/0x990 ... Call trace: svc_normal_to_secure_thread+0x38c/0x990 (P) kthread+0x150/0x210 ret_from_fork+0x10/0x20 Code: 97cfc113 f9400260 aa1403e1 f9400400 (f9400402) ---[ end trace 0000000000000000 ]--- The issue occurs because rsu_send_async_msg() fails when RSU is not enabled in firmware, causing the channel to be freed via stratix10_svc_free_channel(). However, the probe function continues execution and registers svc_normal_to_secure_thread(), which subsequently attempts to access the already-freed channel, triggering the NULL pointer dereference. Fix this by properly cleaning up the async client and returning early on failure, preventing the thread from being used with an invalid channel. Fixes: 15847537b623 ("firmware: stratix10-rsu: Migrate RSU driver to use stratix10 asynchronous framework.") Cc: stable@kernel.org Signed-off-by: Liwei Song Signed-off-by: Dinh Nguyen commit 2f61f38a217462411fed950e843b82bc119884cf Author: Russell King (Oracle) Date: Mon Feb 23 12:19:08 2026 +0000 net: stmmac: fix timestamping configuration after suspend/resume When stmmac_init_timestamping() is called, it clears the receive and transmit path booleans that allow timestamps to be read. These are never re-initialised until after userspace requests timestamping features to be enabled. However, our copy of the timestamp configuration is not cleared, which means we return the old configuration to userspace when requested. This is inconsistent. Fix this by clearing the timestamp configuration. Fixes: d6228b7cdd6e ("net: stmmac: implement the SIOCGHWTSTAMP ioctl") Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Link: https://patch.msgid.link/E1vuUu4-0000000Afea-0j9B@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b6c94c71f349479b76fcc0ef0dc7147f3f326dff Author: Markus Niebel Date: Mon Feb 9 16:50:14 2026 +0100 arm64: dts: imx93-tqma9352: improve eMMC pad configuration Use DSE x4 an PullUp for CMD an DAT, DSE x4 and PullDown for CLK to improve stability and detection at low temperatures under -25°C. Fixes: 0b5fdfaa8e45 ("arm64: dts: freescale: imx93-tqma9352: set SION for cmd and data pad of USDHC") Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Frank Li commit 44db7bc66eb38e85bb32777c5fd3a4e7baa84147 Author: Markus Niebel Date: Mon Feb 9 16:50:13 2026 +0100 arm64: dts: imx91-tqma9131: improve eMMC pad configuration Use DSE x4 an PullUp for CMD an DAT, DSE x4 and PullDown for CLK to improve stability and detection at low temperatures under -25°C. Fixes: e71db39f0c7c ("arm64: dts: freescale: add initial device tree for TQMa91xx/MBa91xxCA") Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Frank Li commit 4b44cbb264d0ed3f2f2bc2659db6ce45882f4670 Author: Kees Cook Date: Tue Feb 24 15:24:52 2026 -0800 overflow: Make sure size helpers are always inlined With kmalloc_obj() performing implicit size calculations, the embedded size_mul() calls, while marked inline, were not always being inlined. I noticed a couple places where allocations were making a call out for things that would otherwise be compile-time calculated. Force the compilers to always inline these calculations. Reviewed-by: Gustavo A. R. Silva Link: https://patch.msgid.link/20260224232451.work.614-kees@kernel.org Signed-off-by: Kees Cook commit 201ceb94aa1def0024a7c18ce643e5f65026be06 Author: Eric Biggers Date: Mon Feb 23 19:37:51 2026 -0800 kunit: irq: Ensure timer doesn't fire too frequently Fix a bug where kunit_run_irq_test() could hang if the system is too slow. This was noticed with the crypto library tests in certain VMs. Specifically, if kunit_irq_test_timer_func() and the associated hrtimer code took over 5us to run, then the CPU would spend all its time executing that code in hardirq context. As a result, the task executing kunit_run_irq_test() never had a chance to run, exit the loop, and cancel the timer. To fix it, make kunit_irq_test_timer_func() increase the timer interval when the other contexts aren't having a chance to run. Fixes: 950a81224e8b ("lib/crypto: tests: Add hash-test-template.h and gen-hash-testvecs.py") Cc: stable@vger.kernel.org Reviewed-by: David Gow Link: https://lore.kernel.org/r/20260224033751.97615-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 3c4617117a2b7682cf037be5e5533e379707f050 Author: Christoph Hellwig Date: Tue Feb 24 06:21:45 2026 -0800 zloop: check for spurious options passed to remove Zloop uses a command option parser for all control commands, but most options are only valid for adding a new device. Check for incorrectly specified options in the remove handler. Fixes: eb0570c7df23 ("block: new zoned loop block device driver") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit 6acf7860dcc79ed045cc9e6a79c8a8bb6959dba7 Author: Christoph Hellwig Date: Tue Feb 24 06:21:44 2026 -0800 zloop: advertise a volatile write cache Zloop is file system backed and thus needs to sync the underlying file system to persist data. Set BLK_FEAT_WRITE_CACHE so that the block layer actually send flush commands, and fix the flush implementation as sync_filesystem requires s_umount to be held and the code currently misses that. Fixes: eb0570c7df23 ("block: new zoned loop block device driver") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 Author: Jens Axboe Date: Tue Feb 24 11:51:16 2026 -0700 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty. Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}. The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions. Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock. Cc: stable@vger.kernel.org Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer") Reported-by: syzbot+ab12f0c08dd7ab8d057c@syzkaller.appspotmail.com Tested-by: syzbot+ab12f0c08dd7ab8d057c@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/ Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds commit 08903184553def7ba1ad6ba4fa8afe1ba2ee0a21 Author: Luke Wang Date: Tue Feb 3 19:23:08 2026 +0800 arm64: dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD During system resume, the following errors occurred: [ 430.638625] mmc1: error -84 writing Cache Enable bit [ 430.643618] mmc1: error -84 doing runtime resume For eMMC and SD, there are two tuning pass windows and the gap between those two windows may only have one cell. If tuning step > 1, the gap may just be skipped and host assumes those two windows as a continuous windows. This will cause a wrong delay cell near the gap to be selected. Set the tuning step to 1 to avoid selecting the wrong delay cell. For SDIO, the gap is sufficiently large, so the default tuning step does not cause this issue. Fixes: 0565d20cd8c2 ("arm64: dts: freescale: Support i.MX93 9x9 Quick Start Board") Signed-off-by: Luke Wang Reviewed-by: Frank Li Signed-off-by: Frank Li commit 1f99b5d93d99ca17d50b386a674d0ce1f20932d8 Author: Sebastian Krzyszkowiak Date: Wed Jan 28 00:28:28 2026 +0100 arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency According to i.MX 8M Quad Reference Manual, GPU_AHB_CLK_ROOT's maximum frequency is 400MHz. Fixes: 45d2c84eb3a2 ("arm64: dts: imx8mq: add GPU node") Reviewed-by: Frank Li Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Peng Fan Reviewed-by: Fabio Estevam Signed-off-by: Frank Li commit 2f38fd99c0004676d835ae96ac4f3b54edc02c82 Author: wangshuaiwei Date: Tue Feb 24 14:32:28 2026 +0800 scsi: ufs: core: Fix shift out of bounds when MAXQ=32 According to JESD223F, the maximum number of queues (MAXQ) is 32. When MCQ is enabled and ESI is disabled, nr_hw_queues=32 causes a shift overflow problem. Fix this by using 64-bit intermediate values to handle the nr_hw_queues=32 case safely. Signed-off-by: wangshuaiwei Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260224063228.50112-1-wangshuaiwei1@xiaomi.com Signed-off-by: Martin K. Petersen commit 410aed670cddac1de4f0c2865f30ec623fd20f78 Author: Yosry Ahmed Date: Mon Feb 23 16:00:26 2026 +0000 MAINTAINERS: update Yosry Ahmed's email address Use my kernel.org email address. Link: https://lkml.kernel.org/r/20260223160027.122307-1-yosry@kernel.org Signed-off-by: Yosry Ahmed Cc: Johannes Weiner Cc: Nhat Pham Signed-off-by: Andrew Morton commit 37a012c5c10c3364c5cba5def30dd7a17a6b587a Author: Daniele Alessandrelli Date: Mon Feb 23 17:09:05 2026 +0000 mailmap: add entry for Daniele Alessandrelli My Intel email is going to bounce soon. Map it to my personal Gmail address. Link: https://lkml.kernel.org/r/20260223170905.278956-1-daniele.alessandrelli@intel.com Signed-off-by: Daniele Alessandrelli Cc: Daniele Alessandrelli Signed-off-by: Andrew Morton commit a4ab97e34bb687a2ca63fc70b47e8762e689797f Author: Ming Lei Date: Sun Feb 22 19:57:02 2026 +0800 mm: fix NULL NODE_DATA dereference for memoryless nodes on boot Commit d49004c5f0c1 ("arch, mm: consolidate initialization of nodes, zones and memory map") moved free_area_init() from setup_arch() to mm_core_init_early(), which runs after setup_arch() returns. This changed the ordering relative to init_cpu_to_node() on x86. Before the commit, free_area_init() ran during paging_init() (called from setup_arch()) *before* init_cpu_to_node(). After the commit, it runs *after* init_cpu_to_node(). On machines with memoryless NUMA nodes (e.g., node 0 has CPUs but no memory), this causes a NULL pointer dereference: 1. numa_register_nodes() skips memoryless nodes: no alloc_node_data() and no node_set_online() for them. 2. init_cpu_to_node() sets memoryless nodes online (they have CPUs) but does not allocate NODE_DATA. 3. free_area_init() checks "if (!node_online(nid))" to decide whether to call alloc_offline_node_data(). Since the memoryless node is now online, the allocation is skipped, leaving NODE_DATA(nid) == NULL. 4. The immediate "pgdat = NODE_DATA(nid)" dereferences NULL. The crash happens before console_init(), so no output is visible without earlyprintk. With earlyprintk enabled, the following panic is observed: BUG: unable to handle page fault for address: 000000000002a1e0 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:free_area_init_node+0x3a/0x540 Call Trace: free_area_init+0x331/0x4e0 start_kernel+0x69/0x4a0 x86_64_start_reservations+0x24/0x30 x86_64_start_kernel+0x125/0x130 common_startup_64+0x13e/0x148 Kernel panic - not syncing: Attempted to kill the idle task! Fix this by checking "if (!NODE_DATA(nid))" instead of "if (!node_online(nid))". This directly tests whether the per-node data structure needs to be allocated, regardless of the node's online status. This change is also safe for non-x86 architectures as they all allocate NODE_DATA for every node including memoryless ones, so the check simply evaluates to false with no change in behavior. Link: https://lkml.kernel.org/r/20260222115702.3659-1-ming.lei@redhat.com Fixes: d49004c5f0c1 ("arch, mm: consolidate initialization of nodes, zones and memory map") Signed-off-by: Ming Lei Reviewed-by: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit 079c24d5690262e83ee476e2a548e416f3237511 Author: Kalesh Singh Date: Thu Feb 19 15:36:56 2026 -0800 mm/tracing: rss_stat: ensure curr is false from kthread context The rss_stat trace event allows userspace tools, like Perfetto [1], to inspect per-process RSS metric changes over time. The curr field was introduced to rss_stat in commit e4dcad204d3a ("rss_stat: add support to detect RSS updates of external mm"). Its intent is to indicate whether the RSS update is for the mm_struct of the current execution context; and is set to false when operating on a remote mm_struct (e.g., via kswapd or a direct reclaimer). However, an issue arises when a kernel thread temporarily adopts a user process's mm_struct. Kernel threads do not have their own mm_struct and normally have current->mm set to NULL. To operate on user memory, they can "borrow" a memory context using kthread_use_mm(), which sets current->mm to the user process's mm. This can be observed, for example, in the USB Function Filesystem (FFS) driver. The ffs_user_copy_worker() handles AIO completions and uses kthread_use_mm() to copy data to a user-space buffer. If a page fault occurs during this copy, the fault handler executes in the kthread's context. At this point, current is the kthread, but current->mm points to the user process's mm. Since the rss_stat event (from the page fault) is for that same mm, the condition current->mm == mm becomes true, causing curr to be incorrectly set to true when the trace event is emitted. This is misleading because it suggests the mm belongs to the kthread, confusing userspace tools that track per-process RSS changes and corrupting their mm_id-to-process association. Fix this by ensuring curr is always false when the trace event is emitted from a kthread context by checking for the PF_KTHREAD flag. Link: https://lkml.kernel.org/r/20260219233708.1971199-1-kaleshsingh@google.com Link: https://perfetto.dev/ [1] Fixes: e4dcad204d3a ("rss_stat: add support to detect RSS updates of external mm") Signed-off-by: Kalesh Singh Acked-by: Zi Yan Acked-by: SeongJae Park Reviewed-by: Pedro Falcato Cc: "David Hildenbrand (Arm)" Cc: Joel Fernandes Cc: Lorenzo Stoakes Cc: Minchan Kim Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: [5.10+] Signed-off-by: Andrew Morton commit d155aab90fffa00f93cea1f107aef0a3d548b2ff Author: Alexander Potapenko Date: Fri Feb 20 15:49:40 2026 +0100 mm/kfence: fix KASAN hardware tag faults during late enablement When KASAN hardware tags are enabled, re-enabling KFENCE late (via /sys/module/kfence/parameters/sample_interval) causes KASAN faults. This happens because the KFENCE pool and metadata are allocated via the page allocator, which tags the memory, while KFENCE continues to access it using untagged pointers during initialization. Use __GFP_SKIP_KASAN for late KFENCE pool and metadata allocations to ensure the memory remains untagged, consistent with early allocations from memblock. To support this, add __GFP_SKIP_KASAN to the allowlist in __alloc_contig_verify_gfp_mask(). Link: https://lkml.kernel.org/r/20260220144940.2779209-1-glider@google.com Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Alexander Potapenko Suggested-by: Ernesto Martinez Garcia Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Greg KH Cc: Kees Cook Cc: Marco Elver Cc: Signed-off-by: Andrew Morton commit c80f46ac228b48403866d65391ad09bdf0e8562a Author: SeongJae Park Date: Sat Feb 14 13:41:21 2026 -0800 mm/damon/core: disallow non-power of two min_region_sz DAMON core uses min_region_sz parameter value as the DAMON region alignment. The alignment is made using ALIGN() and ALIGN_DOWN(), which support only the power of two alignments. But DAMON core API callers can set min_region_sz to an arbitrary number. Users can also set it indirectly, using addr_unit. When the alignment is not properly set, DAMON behavior becomes difficult to expect and understand, makes it effectively broken. It doesn't cause a kernel crash-like significant issue, though. Fix the issue by disallowing min_region_sz input that is not a power of two. Add the check to damon_commit_ctx(), as all DAMON API callers who set min_region_sz uses the function. This can be a sort of behavioral change, but it does not break users, for the following reasons. As the symptom is making DAMON effectively broken, it is not reasonable to believe there are real use cases of non-power of two min_region_sz. There is no known use case or issue reports from the setup, either. In future, if we find real use cases of non-power of two alignments and we can support it with low enough overhead, we can consider moving the restriction. But, for now, simply disallowing the corner case should be good enough as a hot fix. Link: https://lkml.kernel.org/r/20260214214124.87689-1-sj@kernel.org Fixes: d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") Signed-off-by: SeongJae Park Cc: Quanmin Yan Cc: [6.18+] Signed-off-by: Andrew Morton commit fdb24a820a5832ec4532273282cbd4f22c291a0d Author: Phillip Lougher Date: Tue Feb 17 05:09:55 2026 +0000 Squashfs: check metadata block offset is within range Syzkaller reports a "general protection fault in squashfs_copy_data" This is ultimately caused by a corrupted index look-up table, which produces a negative metadata block offset. This is subsequently passed to squashfs_copy_data (via squashfs_read_metadata) where the negative offset causes an out of bounds access. The fix is to check that the offset is within range in squashfs_read_metadata. This will trap this and other cases. Link: https://lkml.kernel.org/r/20260217050955.138351-1-phillip@squashfs.org.uk Fixes: f400e12656ab ("Squashfs: cache operations") Reported-by: syzbot+a9747fe1c35a5b115d3f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/699234e2.a70a0220.2c38d7.00e2.GAE@google.com/ Signed-off-by: Phillip Lougher Cc: Christian Brauner Cc: Signed-off-by: Andrew Morton commit 319d0bff22f3dd7a982c289e8336da69f0581299 Author: Vlastimil Babka (SUSE) Date: Tue Feb 17 11:21:52 2026 +0100 MAINTAINERS, mailmap: update e-mail address for Vlastimil Babka Hopefully improve e-mail performance. Link: https://lkml.kernel.org/r/20260217102151.10425-2-vbabka@kernel.org Signed-off-by: Vlastimil Babka (SUSE) Signed-off-by: Andrew Morton commit f85b1c6af5bc3872f994df0a5688c1162de07a62 Author: Pratyush Yadav (Google) Date: Mon Feb 16 14:22:19 2026 +0100 liveupdate: luo_file: remember retrieve() status LUO keeps track of successful retrieve attempts on a LUO file. It does so to avoid multiple retrievals of the same file. Multiple retrievals cause problems because once the file is retrieved, the serialized data structures are likely freed and the file is likely in a very different state from what the code expects. The retrieve boolean in struct luo_file keeps track of this, and is passed to the finish callback so it knows what work was already done and what it has left to do. All this works well when retrieve succeeds. When it fails, luo_retrieve_file() returns the error immediately, without ever storing anywhere that a retrieve was attempted or what its error code was. This results in an errored LIVEUPDATE_SESSION_RETRIEVE_FD ioctl to userspace, but nothing prevents it from trying this again. The retry is problematic for much of the same reasons listed above. The file is likely in a very different state than what the retrieve logic normally expects, and it might even have freed some serialization data structures. Attempting to access them or free them again is going to break things. For example, if memfd managed to restore 8 of its 10 folios, but fails on the 9th, a subsequent retrieve attempt will try to call kho_restore_folio() on the first folio again, and that will fail with a warning since it is an invalid operation. Apart from the retry, finish() also breaks. Since on failure the retrieved bool in luo_file is never touched, the finish() call on session close will tell the file handler that retrieve was never attempted, and it will try to access or free the data structures that might not exist, much in the same way as the retry attempt. There is no sane way of attempting the retrieve again. Remember the error retrieve returned and directly return it on a retry. Also pass this status code to finish() so it can make the right decision on the work it needs to do. This is done by changing the bool to an integer. A value of 0 means retrieve was never attempted, a positive value means it succeeded, and a negative value means it failed and the error code is the value. Link: https://lkml.kernel.org/r/20260216132221.987987-1-pratyush@kernel.org Fixes: 7c722a7f44e0 ("liveupdate: luo_file: implement file systems callbacks") Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Mike Rapoport (Microsoft) Cc: Pasha Tatashin Cc: Signed-off-by: Andrew Morton commit dd085fe9a8ebfc5d10314c60452db38d2b75e609 Author: Deepanshu Kartikey Date: Sat Feb 14 05:45:35 2026 +0530 mm: thp: deny THP for files on anonymous inodes file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_file_pseudo(), which does not call get_write_access() and leaves inode->i_writecount at 0. Combined with S_ISREG(inode->i_mode) being true, they appear as read-only regular files when CONFIG_READ_ONLY_THP_FOR_FS is enabled, making them eligible for THP collapse. Anonymous inodes can never pass the inode_is_open_for_write() check since their i_writecount is never incremented through the normal VFS open path. The right thing to do is to exclude them from THP eligibility altogether, since CONFIG_READ_ONLY_THP_FOR_FS was designed for real filesystem files (e.g. shared libraries), not for pseudo-filesystem inodes. For guest_memfd, this allows khugepaged and MADV_COLLAPSE to create large folios in the page cache via the collapse path, but the guest_memfd fault handler does not support large folios. This triggers WARN_ON_ONCE(folio_test_large(folio)) in kvm_gmem_fault_user_mapping(). For secretmem, collapse_file() tries to copy page contents through the direct map, but secretmem pages are removed from the direct map. This can result in a kernel crash: BUG: unable to handle page fault for address: ffff88810284d000 RIP: 0010:memcpy_orig+0x16/0x130 Call Trace: collapse_file hpage_collapse_scan_file madvise_collapse Secretmem is not affected by the crash on upstream as the memory failure recovery handles the failed copy gracefully, but it still triggers confusing false memory failure reports: Memory failure: 0x106d96f: recovery action for clean unevictable LRU page: Recovered Check IS_ANON_FILE(inode) in file_thp_enabled() to deny THP for all anonymous inode files. Link: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44 Link: https://lore.kernel.org/linux-mm/CAEvNRgHegcz3ro35ixkDw39ES8=U6rs6S7iP0gkR9enr7HoGtA@mail.gmail.com Link: https://lkml.kernel.org/r/20260214001535.435626-1-kartikey406@gmail.com Fixes: 7fbb5e188248 ("mm: remove VM_EXEC requirement for THP eligibility") Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=33a04338019ac7e43a44 Tested-by: syzbot+33a04338019ac7e43a44@syzkaller.appspotmail.com Tested-by: Lance Yang Acked-by: David Hildenbrand (Arm) Reviewed-by: Barry Song Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Dev Jain Cc: Fangrui Song Cc: Liam Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: Yang Shi Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit eb9549346f7578eda3755683ac2cfb4d94c0675f Author: Arnd Bergmann Date: Mon Feb 16 13:17:44 2026 +0100 mm: change vma_alloc_folio_noprof() macro to inline function In a few rare configurations with extra warnings eanbled, the new drm_pagemap_migrate_populate_ram_pfn() calls vma_alloc_folio_noprof() but that does not use all the arguments, leading to a harmless warning: drivers/gpu/drm/drm_pagemap.c: In function 'drm_pagemap_migrate_populate_ram_pfn': drivers/gpu/drm/drm_pagemap.c:701:63: error: parameter 'addr' set but not used [-Werror=unused-but-set-parameter=] 701 | unsigned long addr) | ~~~~~~~~~~~~~~^~~~ Replace the macro with an inline function so the compiler can see how the argument would be used, but is still able to optimize out the assignments. Link: https://lkml.kernel.org/r/20260216121751.2378374-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Lorenzo Stoakes Acked-by: Zi Yan Reviewed-by: Suren Baghdasaryan Cc: Alexei Starovoitov Cc: Brendan Jackman Cc: David Hildenbrand Cc: Johannes Weiner Cc: Joshua Hahn Cc: Kefeng Wang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 09833d99db36d74456a4d13eb29c32d56ff8f2b6 Author: Alexander Potapenko Date: Fri Feb 13 10:54:10 2026 +0100 mm/kfence: disable KFENCE upon KASAN HW tags enablement KFENCE does not currently support KASAN hardware tags. As a result, the two features are incompatible when enabled simultaneously. Given that MTE provides deterministic protection and KFENCE is a sampling-based debugging tool, prioritize the stronger hardware protections. Disable KFENCE initialization and free the pre-allocated pool if KASAN hardware tags are detected to ensure the system maintains the security guarantees provided by MTE. Link: https://lkml.kernel.org/r/20260213095410.1862978-1-glider@google.com Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Alexander Potapenko Suggested-by: Marco Elver Reviewed-by: Marco Elver Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Ernesto Martinez Garcia Cc: Greg KH Cc: Kees Cook Cc: Signed-off-by: Andrew Morton commit a46435537a844d0f7b4b620baf962cad136422de Author: Jens Axboe Date: Tue Feb 24 11:36:09 2026 -0700 io_uring/cmd_net: use READ_ONCE() for ->addr3 read Any SQE read should use READ_ONCE(), to ensure the result is read once and only once. Doesn't really matter for this case, but it's better to keep these 100% consistent and always use READ_ONCE() for the prep side of SQE handling. Fixes: 5d24321e4c15 ("io_uring: Introduce getsockname io_uring cmd") Signed-off-by: Jens Axboe commit a75281626fc8fa6dc6c9cc314ee423e8bc45203b Author: Luka Gejak Date: Tue Feb 24 14:26:47 2026 +0100 staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie The current code checks 'i + 5 < in_len' at the end of the if statement. However, it accesses 'in_ie[i + 5]' before that check, which can lead to an out-of-bounds read. Move the length check to the beginning of the conditional to ensure the index is within bounds before accessing the array. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable Signed-off-by: Luka Gejak Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260224132647.11642-2-luka.gejak@linux.dev Signed-off-by: Greg Kroah-Hartman commit ee0ff6690f2641b8f6ba8026ec17f6bc48f86649 Author: Cheng-Yang Chou Date: Tue Feb 17 15:26:00 2026 +0800 tools/sched_ext: Add Kconfig to sync with upstream Add the missing Kconfig file to tools/sched_ext/ as referenced in the README. Ref: https://github.com/sched-ext/scx/blob/main/kernel.config Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 095f5693329221ffd9dfe5fcd0079263d462e441 Author: Cheng-Yang Chou Date: Tue Feb 17 15:25:59 2026 +0800 tools/sched_ext: Sync README.md Kconfig with upstream scx Sync the documentation with the upstream scx repository to reflect the current recommended configuration. Ref: https://github.com/sched-ext/scx/blob/main/README.md#build--install Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit fe5669e363b129cde285bfb4d45abb72d1d77cfc Author: Ioana Ciornei Date: Tue Feb 24 13:36:10 2026 +0200 irqchip/ls-extirq: Fix devm_of_iomap() error check The devm_of_iomap() function returns an ERR_PTR() encoded error code on failure. Replace the incorrect check against NULL with IS_ERR(). Fixes: 05cd654829dd ("irqchip/ls-extirq: Convert to a platform driver to make it work again") Reported-by: Dan Carpenter Signed-off-by: Ioana Ciornei Signed-off-by: Thomas Gleixner Reviewed-by: Herve Codina Link: https://patch.msgid.link/20260224113610.1129022-3-ioana.ciornei@nxp.com Closes: https://lore.kernel.org/all/aYXvfbfT6w0TMsXS@stanley.mountain/ commit e08f2adcf990b8cf272e90898401a9e481c1c667 Author: Ioana Ciornei Date: Tue Feb 24 13:36:09 2026 +0200 Revert "irqchip/ls-extirq: Use for_each_of_imap_item iterator" This reverts commit 3ac6dfe3d7a2396602b67667249b146504dfbd2a. The ls-extirq uses interrupt-map but it's a non-standard use documented in fsl,ls-extirq.yaml: # The driver(drivers/irqchip/irq-ls-extirq.c) have not use standard DT # function to parser interrupt-map. So it doesn't consider '#address-size' # in parent interrupt controller, such as GIC. # # When dt-binding verify interrupt-map, item data matrix is spitted at # incorrect position. Remove interrupt-map restriction because it always # wrong. This means that by using for_each_of_imap_item and the underlying of_irq_parse_imap_parent() on its interrupt-map property will effectively break its functionality Revert the patch making use of for_each_of_imap_item() in ls-extirq. Fixes: 3ac6dfe3d7a2 ("irqchip/ls-extirq: Use for_each_of_imap_item iterator") Signed-off-by: Ioana Ciornei Signed-off-by: Thomas Gleixner Acked-by: Herve Codina Link: https://patch.msgid.link/20260224113610.1129022-2-ioana.ciornei@nxp.com commit bfd7db781e2e7a99b086d645a104d16e368f58ff Author: Felix Gu Date: Tue Feb 24 20:23:30 2026 +0800 regulator: Kconfig: fix a typo Fixes a typo in Kconfig, HWWON -> HWMON Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260224-kconfig-v1-1-b0c5459ed7a0@gmail.com Signed-off-by: Mark Brown commit 4baaddaa44af01cd4ce239493060738fd0881835 Author: Felix Gu Date: Tue Feb 24 19:19:03 2026 +0800 regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio() In bq257xx_reg_dt_parse_gpio(), if fails to get subchild, it returns without calling of_node_put(child), causing the device node reference leak. Fixes: 981dd162b635 ("regulator: bq257xx: Add bq257xx boost regulator driver") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260224-bq257-v1-1-8ebbc731c1c3@gmail.com Signed-off-by: Mark Brown commit 0902010c8d163f7b62e655efda1a843529152c7c Author: Felix Gu Date: Tue Feb 24 18:07:59 2026 +0800 regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read() In fp9931_hwmon_read(), if regmap_read() failed, the function returned the error code without calling pm_runtime_put_autosuspend(), causing a PM reference leak. Fixes: 12d821bd13d4 ("regulator: Add FP9931/JD9930 driver") Signed-off-by: Felix Gu Reviewed-by: Andreas Kemnade Link: https://patch.msgid.link/20260224-fp9931-v1-1-1cf05cabef4a@gmail.com Signed-off-by: Mark Brown commit 74b6e83942dcc9f3cca9e561b205a5b19940a344 Author: Matthew Brost Date: Thu Feb 19 12:50:29 2026 -0800 drm/gpusvm: Fix drm_gpusvm_pages_valid_unlocked() kernel-doc The kernel-doc for drm_gpusvm_pages_valid_unlocked() was stale and still referenced old range-based arguments and naming. Update the documentation to match the current function arguments and signature. Signed-off-by: Matthew Brost Reviewed-by: Maarten Lankhorst Link: https://patch.msgid.link/20260219205029.1011336-1-matthew.brost@intel.com commit 62c015373e1cdb1cdca824bd2dbce2dac0819467 Author: Peter Wang Date: Mon Feb 23 18:37:57 2026 +0800 scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume Move the link recovery trigger from ufshcd_uic_pwr_ctrl() to __ufshcd_wl_resume(). Ensure link recovery is only attempted when hibern8 exit fails during resume, not during hibern8 enter in suspend. Improve error handling and prevent unnecessary link recovery attempts. Fixes: 35dabf4503b9 ("scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume") Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260223103906.2533654-1-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 30df81f2228d65bddf492db3929d9fcaffd38fc5 Author: Peter Wang Date: Mon Feb 23 14:56:09 2026 +0800 scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL pointer dereference when accessing hwq->id. This can happen if ufshcd_mcq_req_to_hwq() returns NULL. This patch adds a NULL check for hwq before accessing its id field to prevent a kernel crash. Kernel log excerpt: [] notify_die+0x4c/0x8c [] __die+0x60/0xb0 [] die+0x4c/0xe0 [] die_kernel_fault+0x74/0x88 [] __do_kernel_fault+0x314/0x318 [] do_page_fault+0xa4/0x5f8 [] do_translation_fault+0x34/0x54 [] do_mem_abort+0x50/0xa8 [] el1_abort+0x3c/0x64 [] el1h_64_sync_handler+0x44/0xcc [] el1h_64_sync+0x80/0x88 [] ufshcd_add_command_trace+0x23c/0x320 [] ufshcd_compl_one_cqe+0xa4/0x404 [] ufshcd_mcq_poll_cqe_lock+0xac/0x104 [] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod] [] __handle_irq_event_percpu+0xc8/0x348 [] handle_irq_event+0x3c/0xa8 [] handle_fasteoi_irq+0xf8/0x294 [] generic_handle_domain_irq+0x54/0x80 [] gic_handle_irq+0x1d4/0x330 [] call_on_irq_stack+0x44/0x68 [] do_interrupt_handler+0x78/0xd8 [] el1_interrupt+0x48/0xa8 [] el1h_64_irq_handler+0x14/0x24 [] el1h_64_irq+0x80/0x88 [] arch_local_irq_enable+0x4/0x1c [] cpuidle_enter+0x34/0x54 [] do_idle+0x1dc/0x2f8 [] cpu_startup_entry+0x30/0x3c [] secondary_start_kernel+0x134/0x1ac [] __secondary_switched+0xc4/0xcc Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260223065657.2432447-1-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit f69cfd8e8fd13b5d57e638fa1542fcd56f594ef0 Author: Wei Liu Date: Tue Feb 24 17:08:28 2026 +0000 x86/hyperv: print out reserved vectors in hexadecimal Signed-off-by: Wei Liu commit 56e0a838277b12d48477b9c7478ceb5ae528ae2c Author: Shawn Guo Date: Tue Feb 24 15:57:53 2026 +0800 MAINTAINERS: Update Shawn Guo's address for HiSilicon PCIe controller driver Shawn is no longer with Linaro. Use his korg email address instead. Signed-off-by: Shawn Guo Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260224075753.122091-1-shawnguo@kernel.org commit 8feedae96f872f1b74ad40c72b5cd6a47c44d9dd Merge: 7dff99b354601d 4c9d07865c06bb Author: Alexei Starovoitov Date: Mon Feb 23 18:40:09 2026 -0800 Merge branch 'selftests-bpf-fixes-for-userspace-asan' Ihor Solodrai says: ==================== selftests/bpf: Fixes for userspace ASAN This series includes various fixes aiming to enable test_progs run with userspace address sanitizer on BPF CI. The first five patches add a simplified implementation of strscpy() to selftests/bpf and then replace strcpy/strncpy usages across the tests with it. See relevant discussions [1][2]. Patch #6 fixes the selftests/bpf/test_progs build with: SAN_CFLAGS="-fsanitize=address -fno-omit-frame-pointer" The subsequent patches fix bugs reported by the address sanitizer on attempt to run the tests. [1] https://lore.kernel.org/bpf/CAADnVQ+9uw2_o388j43EWiAPdMB=3FLx2jq-9zRSvqrv-wgRag@mail.gmail.com/ [2] https://lore.kernel.org/bpf/20260220182011.802116-1-ihor.solodrai@linux.dev/ --- v3->v4: - combine strscpy and ASAN series into one (Alexei) - make the count arg of strscpy() optional via macro and fixup relevant call sites (Alexei) - remove strscpy_cat() from this series (Alexei) v3: https://lore.kernel.org/bpf/20260220222604.1155148-1-ihor.solodrai@linux.dev/ v2->v3: - rebase on top of "selftests/bpf: Add and use strscpy()" - https://lore.kernel.org/bpf/20260220182011.802116-1-ihor.solodrai@linux.dev/ - uprobe_multi_test.c: memset static struct child at the beginning of a test *and* zero out child->thread in release_child (patch #9, Mykyta) - nits in test_sysctl.c (patch #11, Eduard) - bpftool_helpers.c: update to use strscpy (patch #14, Alexei) - add __asan_on_error handler to still dump test logs even with ASAN build (patch #15, Mykyta) v2: https://lore.kernel.org/bpf/20260218003041.1156774-1-ihor.solodrai@linux.dev/ v1->v2: - rebase on bpf (v1 was targeting bpf-next) - add ASAN flag handling in selftests/bpf/Makefile (Eduard) - don't override SIGSEGV handler in test_progs with ASAN (Eduard) - add error messages in detect_bpftool_path (Mykyta) - various nits (Eduard, Jiri, Mykyta, Alexis) v1: https://lore.kernel.org/bpf/20260212011356.3266753-1-ihor.solodrai@linux.dev/ ==================== Link: https://patch.msgid.link/20260223190736.649171-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 4c9d07865c06bb9b9faff1ecf6c4b7cc8f7d67a9 Author: Ihor Solodrai Date: Mon Feb 23 11:11:18 2026 -0800 selftests/bpf: Don't override SIGSEGV handler with ASAN test_progs has custom SIGSEGV handler, which interferes with the address sanitizer [1]. Add an #ifndef to avoid this. Additionally, declare an __asan_on_error() to dump the test logs in the same way it happens in the custom SIGSEGV handler. [1] https://lore.kernel.org/bpf/73d832948b01dbc0ebc60d85574bdf8537f3a810.camel@gmail.com/ Acked-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223191118.655185-3-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit a2714e730304c79bf85d2178387255ef8348b897 Author: Ihor Solodrai Date: Mon Feb 23 11:11:17 2026 -0800 selftests/bpf: Check BPFTOOL env var in detect_bpftool_path() The bpftool_maps_access and bpftool_metadata tests may fail on BPF CI with "command not found", depending on a workflow. This happens because detect_bpftool_path() only checks two hardcoded relative paths: - ./tools/sbin/bpftool - ../tools/sbin/bpftool Add support for a BPFTOOL environment variable that allows specifying the exact path to the bpftool binary. Acked-by: Mykyta Yatsenko Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223191118.655185-2-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit ad90ecedad755e2f3e31364ec3130e5bb2f4b64a Author: Ihor Solodrai Date: Mon Feb 23 11:11:16 2026 -0800 selftests/bpf: Fix out-of-bounds array access bugs reported by ASAN - kmem_cache_iter: remove unnecessary debug output - lwt_seg6local: change the type of foobar to char[] - the sizeof(foobar) returned the pointer size and not a string length as intended - verifier_log: increase prog_name buffer size in verif_log_subtest() - compiler has a conservative estimate of fixed_log_sz value, making ASAN complain on snprint() call Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223191118.655185-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 3e711c8e4707c46cc45d9775b50204d0f2790d77 Author: Ihor Solodrai Date: Mon Feb 23 11:07:33 2026 -0800 selftests/bpf: Fix array bounds warning in jit_disasm_helpers Compiler cannot infer upper bound for labels.cnt and warns about potential buffer overflow in snprintf. Add an explicit bounds check (... && i < MAX_LOCAL_LABELS) in the loop condition to fix the warning. Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-18-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 2bb270a0ac68990648c5e84abf73bb7493230ea6 Author: Ihor Solodrai Date: Mon Feb 23 11:07:32 2026 -0800 selftests/bpf: Free bpf_object in test_sysctl ASAN reported a resource leak due to the bpf_object not being tracked in test_sysctl. Add obj field to struct sysctl_test to properly clean it up. Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-17-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 71dca2950fe9abf8e6fd3d9f5e6342da6634b898 Author: Ihor Solodrai Date: Mon Feb 23 11:07:31 2026 -0800 selftests/bpf: Fix resource leaks caused by missing cleanups ASAN reported a number of resource leaks: - Add missing *__destroy(skel) calls - Replace bpf_link__detach() with bpf_link__destroy() where appropriate - cgrp_local_storage: Add bpf_link__destroy() when bpf_iter_create fails - dynptr: Add missing bpf_object__close() Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-16-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 68b8bea1eec392aa50736a859b8f1418067a3bc4 Author: Ihor Solodrai Date: Mon Feb 23 11:07:30 2026 -0800 selftests/bpf: Fix double thread join in uprobe_multi_test ASAN reported a "joining already joined thread" error. The release_child() may be called multiple times for the same struct child. Fix by resetting child->thread to 0 after pthread_join. Also memset(0) static child variable in test_attach_api(). Acked-by: Mykyta Yatsenko Acked-by: Jiri Olsa Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-15-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit f7ac552be7f13e834a942f64b1ac87e7755b32f4 Author: Ihor Solodrai Date: Mon Feb 23 11:07:29 2026 -0800 selftests/bpf: Fix use-after-free in xdp_metadata test ASAN reported a use-after-free in close_xsk(). The xsk->socket internally references xsk->umem via socket->ctx->umem, so the socket must be deleted before the umem. Fix the order of operations in close_xsk(). Acked-by: Mykyta Yatsenko Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-14-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit ff9511410d5fbdec21a3bbfaa477aa1f56735b33 Author: Ihor Solodrai Date: Mon Feb 23 11:07:28 2026 -0800 veristat: Fix a memory leak for preset ENUMERATOR ASAN detected a memory leak in veristat. The cleanup code handling ENUMERATOR value missed freeing strdup-ed svalue. Fix it. Acked-by: Mykyta Yatsenko Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-13-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 3eb4a2e399c6766ea0c8291e2adb5e6dc42b6e68 Author: Ihor Solodrai Date: Mon Feb 23 11:07:27 2026 -0800 selftests/bpf: Fix cleanup in check_fd_array_cnt__fd_array_too_big() The Close() macro uses the passed in expression three times, which leads to repeated execution in case it has side effects. That is, Close(i--) would decrement i three times. ASAN caught a stack-buffer-undeflow error at a point where this was overlooked. Fix it. Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-12-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 9d0272c91fbc3ae86f2c3b6ba0a0b0ee77d862e3 Author: Ihor Solodrai Date: Mon Feb 23 11:07:26 2026 -0800 selftests/bpf: Fix memory leaks in tests Fix trivial memory leaks detected by userspace ASAN: - htab_update: free value buffer in test_reenter_update cleanup - test_xsk: inline pkt_stream_replace() in testapp_stats_rx_full() and testapp_stats_fill_empty() - testing_helpers: free buffer allocated by getline() in parse_test_list_file Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-11-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit a1a771bd649212ef32cf9b0bcc63213a762d354a Author: Ihor Solodrai Date: Mon Feb 23 11:07:25 2026 -0800 selftests/bpf: Refactor bpf_get_ksyms() trace helper ASAN reported a memory leak in bpf_get_ksyms(): it allocates a struct ksyms internally and never frees it. Move struct ksyms to trace_helpers.h and return it from the bpf_get_ksyms(), giving ownership to the caller. Add filtered_syms and filtered_cnt fields to the ksyms to hold the filtered array of symbols, previously returned by bpf_get_ksyms(). Fixup the call sites: kprobe_multi_test and bench_trigger. Signed-off-by: Ihor Solodrai Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260223190736.649171-10-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 45897ced3c1d3940fb5b68fe48c9e144143ae0ae Author: Ihor Solodrai Date: Mon Feb 23 11:07:24 2026 -0800 selftests/bpf: Add DENYLIST.asan Add a denylist file for tests that should be skipped when built with userspace ASAN: $ make ... SAN_CFLAGS="-fsanitize=address -fno-omit-frame-pointer" Skip the following tests: - *arena*: userspace ASAN does not understand BPF arena maps and gets confused particularly when map_extra is non-zero - non-zero map_extra leads to mmap with MAP_FIXED, and ASAN treats this as an unknown memory region - task_local_data: ASAN complains about "incorrect" aligned_alloc() usage, but it's intentional in the test - uprobe_multi_test: very slow with ASAN enabled Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-9-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit c5c1e313493cd836863bb673bb2b8beaa915cad9 Author: Ihor Solodrai Date: Mon Feb 23 11:07:23 2026 -0800 resolve_btfids: Fix memory leaks reported by ASAN Running resolve_btfids with ASAN reveals memory leaks in btf_id handling. - Change get_id() to use a local buffer - Make btf_id__add() strdup the name internally - Add btf_id__free_all() that frees all nodese of a tree - Call the cleanup function on exit for every tree Acked-by: Jiri Olsa Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-8-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 4021848a903e65f74cf88997c12b96d6bc2453e6 Author: Ihor Solodrai Date: Mon Feb 23 11:07:22 2026 -0800 selftests/bpf: Pass through build flags to bpftool and resolve_btfids EXTRA_* and SAN_* build flags were not correctly propagated to bpftool and resolve_btids when building selftests/bpf. This led to various build errors on attempt to build with SAN_CFLAGS="-fsanitize=address", for example. Fix the makefiles to address this: - Pass SAN_CFLAGS/SAN_LDFLAGS to bpftool and resolve_btfids build - Propagate EXTRA_LDFLAGS to resolve_btfids link command - Use pkg-config to detect zlib and zstd for resolve_btfids, similar libelf handling Also check for ASAN flag in selftests/bpf/Makefile for convenience. Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-7-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 9d8685239e85ba5a4899b5b3534c732e3ae5f2aa Author: Ihor Solodrai Date: Mon Feb 23 11:07:21 2026 -0800 selftests/bpf: Use memcpy() for bounded non-NULL-terminated copies Replace strncpy() with memcpy() in cases where the source is non-NULL-terminated and the copy length is known. Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-6-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 3ed0bc2d4994c718fb5476b45d4aafec42a1d040 Author: Ihor Solodrai Date: Mon Feb 23 11:07:20 2026 -0800 selftests/bpf: Use strscpy in bpftool_helpers.c Replace strncpy() calls in bpftool_helpers.c with strscpy(). Pass the destination buffer size to detect_bpftool_path() instead of hardcoding BPFTOOL_PATH_MAX_LEN. Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-5-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 43277d8f57b490550d33f6f4cb73c28ec6024696 Author: Ihor Solodrai Date: Mon Feb 23 11:07:19 2026 -0800 selftests/bpf: Replace strncpy() with strscpy() strncpy() does not guarantee NULL-termination and is considered deprecated [1]. Replace strncpy() calls with strscpy(). [1] https://docs.kernel.org/process/deprecated.html#strncpy-on-nul-terminated-strings Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-4-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit e46f25f5a81f6f1a9ab93bcda80d5dfaea9f4897 Author: Alison Schofield Date: Mon Feb 23 11:13:40 2026 -0800 cxl/region: Test CXL_DECODER_F_NORMALIZED_ADDRESSING as a bitmask The CXL decoder flags are defined as bitmasks, not bit indices. Using test_bit() to check them interprets the mask value as a bit index, which is the wrong test. For CXL_DECODER_F_NORMALIZED_ADDRESSING the test reads beyond the flags word, making the flag sometimes appear set and blocking creation of CXL region debugfs attributes that support poison operations. Replace test_bit() with a bitmask check. Found with cxl-test. Fixes: 208f432406b7 ("cxl: Disable HPA/SPA translation handlers for Normalized Addressing") Signed-off-by: Alison Schofield Reviewed-by: Gregory Price Tested-by: Gregory Price Link: https://patch.msgid.link/63fe4a6203e40e404347f1cdc7a1c55cb4959b86.1771873256.git.alison.schofield@intel.com Signed-off-by: Dave Jiang commit 0a70b7cd397e545e926c93715ff6366b67c716f6 Author: Alison Schofield Date: Mon Feb 23 11:13:39 2026 -0800 cxl: Test CXL_DECODER_F_LOCK as a bitmask The CXL decoder flags are defined as bitmasks, not bit indices. Using test_bit() to check them interprets the mask value as a bit index, which is the wrong test. For CXL_DECODER_F_LOCK the test reads beyond the defined bits, causing the test to always return false and allowing resets that should have been blocked. Replace test_bit() with a bitmask check. Fixes: 2230c4bdc412 ("cxl: Add handling of locked CXL decoder") Signed-off-by: Alison Schofield Reviewed-by: Gregory Price Tested-by: Gregory Price Link: https://patch.msgid.link/98851c4770e4631753cf9f75b58a3a6daeca2ea2.1771873256.git.alison.schofield@intel.com Signed-off-by: Dave Jiang commit 60b5d1f68338aff2c5af0113f04aefa7169c50c2 Author: Davidlohr Bueso Date: Thu Feb 19 16:16:17 2026 -0800 cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() cxl_payload_from_user_allowed() casts and dereferences the input payload without first verifying its size. When a raw mailbox command is sent with an undersized payload (ie: 1 byte for CXL_MBOX_OP_CLEAR_LOG, which expects a 16-byte UUID), uuid_equal() reads past the allocated buffer, triggering a KASAN splat: BUG: KASAN: slab-out-of-bounds in memcmp+0x176/0x1d0 lib/string.c:683 Read of size 8 at addr ffff88810130f5c0 by task syz.1.62/2258 CPU: 2 UID: 0 PID: 2258 Comm: syz.1.62 Not tainted 6.19.0-dirty #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xab/0xe0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xce/0x650 mm/kasan/report.c:482 kasan_report+0xce/0x100 mm/kasan/report.c:595 memcmp+0x176/0x1d0 lib/string.c:683 uuid_equal include/linux/uuid.h:73 [inline] cxl_payload_from_user_allowed drivers/cxl/core/mbox.c:345 [inline] cxl_mbox_cmd_ctor drivers/cxl/core/mbox.c:368 [inline] cxl_validate_cmd_from_user drivers/cxl/core/mbox.c:522 [inline] cxl_send_cmd+0x9c0/0xb50 drivers/cxl/core/mbox.c:643 __cxl_memdev_ioctl drivers/cxl/core/memdev.c:698 [inline] cxl_memdev_ioctl+0x14f/0x190 drivers/cxl/core/memdev.c:713 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa8/0x330 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdaf331ba79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdaf1d77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fdaf3585fa0 RCX: 00007fdaf331ba79 RDX: 00002000000001c0 RSI: 00000000c030ce02 RDI: 0000000000000003 RBP: 00007fdaf33749df R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fdaf3586038 R14: 00007fdaf3585fa0 R15: 00007ffced2af768 Add 'in_size' parameter to cxl_payload_from_user_allowed() and validate the payload is large enough. Fixes: 6179045ccc0c ("cxl/mbox: Block immediate mode in SET_PARTITION_INFO command") Fixes: 206f9fa9d555 ("cxl/mbox: Add Clear Log mailbox command") Signed-off-by: Davidlohr Bueso Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260220001618.963490-2-dave@stgolabs.net Signed-off-by: Dave Jiang commit 96a1fd0d84b17360840f344826897fa71049870e Author: Dave Jiang Date: Thu Feb 12 14:50:38 2026 -0700 cxl: Fix race of nvdimm_bus object when creating nvdimm objects Found issue during running of cxl-translate.sh unit test. Adding a 3s sleep right before the test seems to make the issue reproduce fairly consistently. The cxl_translate module has dependency on cxl_acpi and causes orphaned nvdimm objects to reprobe after cxl_acpi is removed. The nvdimm_bus object is registered by the cxl_nvb object when cxl_acpi_probe() is called. With the nvdimm_bus object missing, __nd_device_register() will trigger NULL pointer dereference when accessing the dev->parent that points to &nvdimm_bus->dev. [ 192.884510] BUG: kernel NULL pointer dereference, address: 000000000000006c [ 192.895383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20250812-19.fc42 08/12/2025 [ 192.897721] Workqueue: cxl_port cxl_bus_rescan_queue [cxl_core] [ 192.899459] RIP: 0010:kobject_get+0xc/0x90 [ 192.924871] Call Trace: [ 192.925959] [ 192.926976] ? pm_runtime_init+0xb9/0xe0 [ 192.929712] __nd_device_register.part.0+0x4d/0xc0 [libnvdimm] [ 192.933314] __nvdimm_create+0x206/0x290 [libnvdimm] [ 192.936662] cxl_nvdimm_probe+0x119/0x1d0 [cxl_pmem] [ 192.940245] cxl_bus_probe+0x1a/0x60 [cxl_core] [ 192.943349] really_probe+0xde/0x380 This patch also relies on the previous change where devm_cxl_add_nvdimm_bridge() is called from drivers/cxl/pmem.c instead of drivers/cxl/core.c to ensure the dependency of cxl_acpi on cxl_pmem. 1. Set probe_type of cxl_nvb to PROBE_FORCE_SYNCHRONOUS to ensure the driver is probed synchronously when add_device() is called. 2. Add a check in __devm_cxl_add_nvdimm_bridge() to ensure that the cxl_nvb driver is attached during cxl_acpi_probe(). 3. Take the cxl_root uport_dev lock and the cxl_nvb->dev lock in devm_cxl_add_nvdimm() before checking nvdimm_bus is valid. 4. Set cxl_nvdimm flag to CXL_NVD_F_INVALIDATED so cxl_nvdimm_probe() will exit with -EBUSY. The removal of cxl_nvdimm devices should prevent any orphaned devices from probing once the nvdimm_bus is gone. [ dj: Fixed 0-day reported kdoc issue. ] [ dj: Fix cxl_nvb reference leak on error. Gregory (kreview-0811365) ] Suggested-by: Dan Williams Fixes: 8fdcb1704f61 ("cxl/pmem: Add initial infrastructure for pmem support") Tested-by: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260205001633.1813643-3-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 07ed4f05bbfd2bc014974dcc4297fd3aa1cb88c0 Author: Bart Van Assche Date: Mon Feb 23 14:00:14 2026 -0800 hwmon: (it87) Check the it87_lock() return value Return early in it87_resume() if it87_lock() fails instead of ignoring the return value of that function. This patch suppresses a Clang thread-safety warning. Cc: Frank Crawford Cc: Guenter Roeck Cc: Jean Delvare Cc: linux-hwmon@vger.kernel.org Fixes: 376e1a937b30 ("hwmon: (it87) Add calls to smbus_enable/smbus_disable as required") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20260223220102.2158611-15-bart.vanassche@linux.dev [groeck: Declare 'ret' at the beginning of it87_resume()] Signed-off-by: Guenter Roeck commit 297318a1c26dabb5a2d8540fdf436c22094eb2d7 Author: Andy Shevchenko Date: Tue Feb 24 12:52:18 2026 +0100 spi: dt-bindings: snps,dw-abp-ssi: Remove unused bindings As stated in the da0a672268b3 ("spi: dw: Remove not-going-to-be-supported code for Baikal SoC") the Baikal platforms are not supported and the respective driver code was removed. Remove the currently unused bindings. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260224115218.3499222-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 364410170ab33f6e7ef0eb2afb12bf89b0feb3a6 Author: Jeff Layton Date: Thu Feb 5 07:59:20 2026 -0500 nfsd: report the requested maximum number of threads instead of number running The current netlink and /proc interfaces deviate from their traditional values when dynamic threading is enabled, and there is currently no way to know what the current setting is. This patch brings the reporting back in line with traditional behavior. Make these interfaces report the requested maximum number of threads instead of the number currently running. Also, update documentation and comments to reflect that this value represents a maximum and not the number currently running. Fixes: d8316b837c2c ("nfsd: add controls to set the minimum number of threads per pool") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit e710b2283725f0db9e5b99c2483df3f4a7feadbd Author: Michael Walle Date: Mon Feb 23 11:04:48 2026 +0100 Revert "hwmon: add SMARC-sAM67 support" This reverts commit 443b39c82c322c9f3c38bea0389fe927ba00b3b4. I was just informed that this product is discontinued (without being ever released to the market). Pull the plug and let's not waste any more maintainers time. Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20260223100459.844967-4-mwalle@kernel.org Signed-off-by: Guenter Roeck commit 5ede90206273ff156a778254f0f972a55e973c89 Author: Sofia Schneider Date: Sun Feb 22 23:52:40 2026 -0300 ACPI: OSI: Add DMI quirk for Acer Aspire One D255 The screen backlight turns off during boot (specifically during udev device initialization) when returning true for _OSI("Windows 2009"). Analyzing the device's DSDT reveals that the firmware takes a different code path when Windows 7 is reported, which leads to the backlight shutoff. Add a DMI quirk to invoke dmi_disable_osi_win7 for this model. Signed-off-by: Sofia Schneider Link: https://patch.msgid.link/20260223025240.518509-1-sofia@schn.dev Signed-off-by: Rafael J. Wysocki commit ab39cc4cb8ceecdc2b61747433e7237f1ac2b789 Author: David Arcari Date: Tue Feb 24 07:21:06 2026 -0500 cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() The update_cpu_qos_request() function attempts to initialize the 'freq' variable by dereferencing 'cpudata' before verifying if the 'policy' is valid. This issue occurs on systems booted with the "nosmt" parameter, where all_cpu_data[cpu] is NULL for the SMT sibling threads. As a result, any call to update_qos_requests() will result in a NULL pointer dereference as the code will attempt to access pstate.turbo_freq using the NULL cpudata pointer. Also, pstate.turbo_freq may be updated by intel_pstate_get_hwp_cap() after initializing the 'freq' variable, so it is better to defer the 'freq' until intel_pstate_get_hwp_cap() has been called. Fix this by deferring the 'freq' assignment until after the policy and driver_data have been validated. Fixes: ae1bdd23b99f ("cpufreq: intel_pstate: Adjust frequency percentage computations") Reported-by: Jirka Hladky Closes: https://lore.kernel.org/all/CAE4VaGDfiPvz3AzrwrwM4kWB3SCkMci25nPO8W1JmTBd=xHzZg@mail.gmail.com/ Signed-off-by: David Arcari Cc: 6.18+ # 6.18+ [ rjw: Added one paragraph to the changelog ] Link: https://patch.msgid.link/20260224122106.228116-1-darcari@redhat.com Signed-off-by: Rafael J. Wysocki commit 1348659dc92e9f0f3f86961745792102b8afbfff Merge: fb73d0e19f12b7 138d7eca445ef3 Author: Paolo Abeni Date: Tue Feb 24 15:03:07 2026 +0100 Merge tag 'for-net-2026-02-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - purge error queues in socket destructors - hci_sync: Fix CIS host feature condition - L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ - L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short - L2CAP: Fix response to L2CAP_ECRED_CONN_REQ - L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ - L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ - hci_qca: Cleanup on all setup failures * tag 'for-net-2026-02-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ Bluetooth: Fix CIS host feature condition Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ Bluetooth: hci_qca: Cleanup on all setup failures Bluetooth: purge error queues in socket destructors Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ ==================== Link: https://patch.msgid.link/20260223211634.3800315-1-luiz.dentz@gmail.com Signed-off-by: Paolo Abeni commit fb73d0e19f12b793bfe013171d931587f37e3552 Author: Shyam Sundar S K Date: Mon Feb 23 13:10:20 2026 +0530 MAINTAINERS: Update AMD XGBE driver maintainers Due to additional responsibilities, Shyam Sundar S K will no longer be supporting the AMD XGBE driver. Maintenance will be handled by Raju Rangoju going forward. Cc: Raju Rangoju Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20260223074020.1987884-1-Shyam-sundar.S-k@amd.com Signed-off-by: Paolo Abeni commit 78437ab3b769f80526416570f60173c89858dd84 Author: Danilo Krummrich Date: Fri Feb 13 00:58:11 2026 +0100 clk: scu/imx8qxp: do not register driver in probe() imx_clk_scu_init() registers the imx_clk_scu_driver while commonly being called from IMX driver's probe() callbacks. However, it neither makes sense to register drivers from probe() callbacks of other drivers, nor does the driver core allow registering drivers with a device lock already being held. The latter was revealed by commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") leading to a deadlock condition described in [1]. Besides that, nothing seems to unregister the imx_clk_scu_driver once the corresponding driver module is unloaded, which leaves the driver-core with a dangling pointer. Also, if there are multiple matching devices for the imx8qxp_clk_driver, imx8qxp_clk_probe() calls imx_clk_scu_init() multiple times. However, any subsequent call after the first one will fail, since the driver-core does not allow to register the same struct platform_driver multiple times. Hence, register the imx_clk_scu_driver from module_init() and unregister it in module_exit(). Note that we first register the imx8qxp_clk_driver and then call imx_clk_scu_module_init() to avoid having to call imx_clk_scu_module_exit() in the unwind path of imx8qxp_clk_init(). Fixes: dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") Fixes: 220175cd3979 ("clk: imx: scu: fix build break when compiled as modules") Reported-by: Alexander Stein Closes: https://lore.kernel.org/lkml/13955113.uLZWGnKmhe@steina-w/ Tested-by: Alexander Stein # TQMa8x/MBa8x Link: https://lore.kernel.org/lkml/DFU7CEPUSG9A.1KKGVW4HIPMSH@kernel.org/ [1] Acked-by: Abel Vesa Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20260212235842.85934-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit c8dbdc6e380e7e96a51706db3e4b7870d8a9402d Author: Andrew Lunn Date: Sun Feb 22 16:26:01 2026 +0100 net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled: [ 1362.049207] [<8054e4b8>] led_trigger_register+0x5c/0x1fc <-- Trying to get lock "triggers_list_lock" via down_write(&triggers_list_lock); [ 1362.054536] [<80662830>] phy_led_triggers_register+0xd0/0x234 [ 1362.060329] [<8065e200>] phy_attach_direct+0x33c/0x40c [ 1362.065489] [<80651fc4>] phylink_fwnode_phy_connect+0x15c/0x23c [ 1362.071480] [<8066ee18>] mtk_open+0x7c/0xba0 [ 1362.075849] [<806d714c>] __dev_open+0x280/0x2b0 [ 1362.080384] [<806d7668>] __dev_change_flags+0x244/0x24c [ 1362.085598] [<806d7698>] dev_change_flags+0x28/0x78 [ 1362.090528] [<807150e4>] dev_ioctl+0x4c0/0x654 <-- Hold lock "rtnl_mutex" by calling rtnl_lock(); [ 1362.094985] [<80694360>] sock_ioctl+0x2f4/0x4e0 [ 1362.099567] [<802e9c4c>] sys_ioctl+0x32c/0xd8c [ 1362.104022] [<80014504>] syscall_common+0x34/0x58 Here LED_TRIGGER_PHY is registering LED triggers during phy_attach while holding RTNL and then taking triggers_list_lock. [ 1362.191101] [<806c2640>] register_netdevice_notifier+0x60/0x168 <-- Trying to get lock "rtnl_mutex" via rtnl_lock(); [ 1362.197073] [<805504ac>] netdev_trig_activate+0x194/0x1e4 [ 1362.202490] [<8054e28c>] led_trigger_set+0x1d4/0x360 <-- Hold lock "triggers_list_lock" by down_read(&triggers_list_lock); [ 1362.207511] [<8054eb38>] led_trigger_write+0xd8/0x14c [ 1362.212566] [<80381d98>] sysfs_kf_bin_write+0x80/0xbc [ 1362.217688] [<8037fcd8>] kernfs_fop_write_iter+0x17c/0x28c [ 1362.223174] [<802cbd70>] vfs_write+0x21c/0x3c4 [ 1362.227712] [<802cc0c4>] ksys_write+0x78/0x12c [ 1362.232164] [<80014504>] syscall_common+0x34/0x58 Here LEDS_TRIGGER_NETDEV is being enabled on an LED. It first takes triggers_list_lock and then RTNL. A classical AB-BA deadlock. phy_led_triggers_registers() does not require the RTNL, it does not make any calls into the network stack which require protection. There is also no requirement the PHY has been attached to a MAC, the triggers only make use of phydev state. This allows the call to phy_led_triggers_registers() to be placed elsewhere. PHY probe() and release() don't hold RTNL, so solving the AB-BA deadlock. Reported-by: Shiji Yang Closes: https://lore.kernel.org/all/OS7PR01MB13602B128BA1AD3FA38B6D1FFBC69A@OS7PR01MB13602.jpnprd01.prod.outlook.com/ Fixes: 06f502f57d0d ("leds: trigger: Introduce a NETDEV trigger") Cc: stable@vger.kernel.org Signed-off-by: Andrew Lunn Tested-by: Shiji Yang Link: https://patch.msgid.link/20260222152601.1978655-1-andrew@lunn.ch Signed-off-by: Paolo Abeni commit 4a1ddb0f1c48c2b56f21d8b5200e2e29adf4c1df Author: Christian Brauner Date: Tue Feb 24 12:09:00 2026 +0100 pidfs: avoid misleading break The break would only break out of the scoped_guard() loop, not the switch statement. It still works correct as is ofc but let's avoid the confusion. Reported-by: David Lechner Link:: https://lore.kernel.org/cd2153f1-098b-463c-bbc1-5c6ca9ef1f12@baylibre.com Signed-off-by: Christian Brauner commit 3d7e6ce34f4fcc7083510c28b17a7c36462a25d4 Author: Ziyi Guo Date: Sun Feb 22 05:06:33 2026 +0000 net: usb: pegasus: enable basic endpoint checking pegasus_probe() fills URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_rcvbulkpipe(dev, 1) for RX data - usb_sndbulkpipe(dev, 2) for TX data - usb_rcvintpipe(dev, 3) for status interrupts A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a pegasus_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls before any resource allocation to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time, and avoid triggering assertion. Similar fix to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") - commit 9e7021d2aeae ("net: usb: catc: enable basic endpoint checking") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ziyi Guo Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260222050633.410165-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni commit bf4fde7db4a8e2613cba36d81ac271f3d66c28f7 Author: Ferry Meng Date: Tue Feb 24 14:02:07 2026 +0800 erofs: remove more unnecessary #ifdefs Many #ifdefs can be replaced with IS_ENABLED() to improve code readability. No functional changes. Signed-off-by: Ferry Meng Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 983512f3a87fd8dc4c94dfa6b596b6e57df5aad7 Author: Sebastian Andrzej Siewior Date: Fri Feb 20 19:38:58 2026 +0100 net: Drop the lock in skb_may_tx_timestamp() skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must not be taken in IRQ context, only softirq is okay. A few drivers receive the timestamp via a dedicated interrupt and complete the TX timestamp from that handler. This will lead to a deadlock if the lock is already write-locked on the same CPU. Taking the lock can be avoided. The socket (pointed by the skb) will remain valid until the skb is released. The ->sk_socket and ->file member will be set to NULL once the user closes the socket which may happen before the timestamp arrives. If we happen to observe the pointer while the socket is closing but before the pointer is set to NULL then we may use it because both pointer (and the file's cred member) are RCU freed. Drop the lock. Use READ_ONCE() to obtain the individual pointer. Add a matching WRITE_ONCE() where the pointer are cleared. Link: https://lore.kernel.org/all/20260205145104.iWinkXHv@linutronix.de Fixes: b245be1f4db1a ("net-timestamp: no-payload only sysctl") Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Willem de Bruijn Reviewed-by: Jason Xing Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260220183858.N4ERjFW6@linutronix.de Signed-off-by: Paolo Abeni commit faa72102b178c7ae6c6afea23879e7c84fc59b4e Author: Jason Gunthorpe Date: Mon Feb 16 11:02:50 2026 -0400 RDMA/ionic: Fix kernel stack leak in ionic_create_cq() struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask) __u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK }; rsvd[7]: 7 bytes of stack memory leaked unconditionally. cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but udma_count could be 1, meaning cqid[1] might never be written via ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4 bytes) is also leaked. So potentially 11 bytes leaked. Cc: stable@vger.kernel.org Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Signed-off-by: Jason Gunthorpe Link: https://patch.msgid.link/4-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com Acked-by: Abhijit Gangurde Signed-off-by: Leon Romanovsky commit 74586c6da9ea222a61c98394f2fc0a604748438c Author: Jason Gunthorpe Date: Mon Feb 16 11:02:49 2026 -0400 RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() struct irdma_create_ah_resp { // 8 bytes, no padding __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) __u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK }; rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata(). The reserved members of the structure were not zeroed. Cc: stable@vger.kernel.org Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Jason Gunthorpe Link: https://patch.msgid.link/3-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com Signed-off-by: Leon Romanovsky commit 117942ca43e2e3c3d121faae530989931b7f67e1 Author: Jason Gunthorpe Date: Mon Feb 16 11:02:48 2026 -0400 IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Fix a user triggerable leak on the system call failure path. Cc: stable@vger.kernel.org Fixes: ec34a922d243 ("[PATCH] IB/mthca: Add SRQ implementation") Signed-off-by: Jason Gunthorpe Link: https://patch.msgid.link/2-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com Signed-off-by: Leon Romanovsky commit f22c77ce49db0589103d96487dca56f5b2136362 Author: Jason Gunthorpe Date: Mon Feb 16 11:02:47 2026 -0400 RDMA/efa: Fix typo in efa_alloc_mr() The pattern is to check the entire driver request space, not just sizeof something unrelated. Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation") Signed-off-by: Jason Gunthorpe Link: https://patch.msgid.link/1-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com Acked-by: Michael Margolin Signed-off-by: Leon Romanovsky commit fd80bd7105f88189f47d465ca8cb7d115570de30 Author: Kamal Heib Date: Fri Feb 20 17:21:26 2026 -0500 RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port The function ionic_query_port() calls ib_device_get_netdev() without checking the return value which could lead to NULL pointer dereference, Fix it by checking the return value and return -ENODEV if the 'ndev' is NULL. Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality") Signed-off-by: Kamal Heib Link: https://patch.msgid.link/20260220222125.16973-2-kheib@redhat.com Signed-off-by: Leon Romanovsky commit 01e10d0272b932f908b4f9b6609a10cb1f35fafe Author: Chen-Yu Tsai Date: Tue Feb 24 17:24:18 2026 +0800 pinctrl: sunxi: Implement gpiochip::get_direction() After commit 471e998c0e31 ("gpiolib: remove redundant callback check"), a warning will be printed if the gpio driver does not implement this callback. The warning was added in commit e623c4303ed1 ("gpiolib: sanitize the return value of gpio_chip::get_direction()"), but was masked by the "redundant" check. The warning can be triggered by any action that calls the callback, such as dumping the GPIO state from /sys/kernel/debug/gpio. Implement it for the sunxi driver. This is simply a matter of reading out the mux value from the registers, then checking if it is one of the GPIO functions and which direction it is. Signed-off-by: Chen-Yu Tsai Reviewed-by: Jernej Skrabec Reviewed-by: Bartosz Golaszewski Reviewed-by: Andre Przywara Signed-off-by: Linus Walleij commit 45fe4592454368df24d18352be700ff40e7df0c0 Author: Krzysztof Kozlowski Date: Mon Feb 23 11:57:18 2026 +0100 pinctrl: rockchip: Fix configuring a deferred pin Commit e2c58cbe3aff ("pinctrl: rockchip: Simplify locking with scoped_guard()") added a scoped_guard() over existing code containing a "break" instruction. That "break" was for the outer (existing) for-loop, which now exits inner, scoped_guard() loop. If GPIO driver did not probe, then driver will not bail out, but instead continue to configure the pin. Fix the issue by simplifying the code - the break in original code was leading directly to end of the function returning 0, thus we can simply return here rockchip_pinconf_defer_pin status. Reported-by: David Lechner Closes: https://lore.kernel.org/r/f5b38942-a584-4e78-a893-de4a219070b2@baylibre.com/ Fixes: e2c58cbe3aff ("pinctrl: rockchip: Simplify locking with scoped_guard()") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit fd5bed798f45eb3a178ad527b43ab92705faaf8a Author: Felix Gu Date: Mon Feb 23 17:39:07 2026 +0800 pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() devm_add_action_or_reset() already invokes the action on failure, so the explicit put causes a double-put. Fixes: 9b07cdf86a0b ("pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()") Signed-off-by: Felix Gu Reviewed-by: Charles Keepax Signed-off-by: Linus Walleij commit a2539b92e4b791c1ba482930b5e51b1591975461 Author: Felix Gu Date: Thu Feb 19 00:51:22 2026 +0800 pinctrl: meson: amlogic-a4: Fix device node reference leak in aml_dt_node_to_map_pinmux() The of_get_parent() function returns a device_node with an incremented reference count. Use the __free(device_node) cleanup attribute to ensure of_node_put() is automatically called when pnode goes out of scope, fixing a reference leak. Fixes: 6e9be3abb78c ("pinctrl: Add driver support for Amlogic SoCs") Signed-off-by: Felix Gu Signed-off-by: Linus Walleij commit e9e268ea9df102abef34d7afba59ef4d5868d5d7 Author: Krzysztof Kozlowski Date: Mon Feb 16 09:25:50 2026 +0100 pinctrl: qcom: sdm660-lpass-lpi: Make groups and functions variables static File-scope 'sdm660_lpi_pinctrl_groups' and 'sdm660_lpi_pinctrl_functions' are not used outside of this unit, so make them static to silence sparse warnings: pinctrl-sdm660-lpass-lpi.c:79:27: warning: symbol 'sdm660_lpi_pinctrl_groups' was not declared. Should it be static? pinctrl-sdm660-lpass-lpi.c:116:27: warning: symbol 'sdm660_lpi_pinctrl_functions' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Linus Walleij commit c2e174994c9e98956a85dee9af6fbb293f5ad673 Author: Krzysztof Kozlowski Date: Mon Feb 16 09:58:40 2026 +0100 pinctrl: cix: sky1: Unexport sky1_pinctrl_pm_ops File-scope 'sky1_pinctrl_pm_ops' is not used outside of this unit (and it should not be!), so unexport it and make it static to silence sparse warning: pinctrl-sky1.c:525:25: warning: symbol 'sky1_pinctrl_pm_ops' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit a48150d05190b41b5eec19f74b751a75a15a456a Author: Krzysztof Kozlowski Date: Mon Feb 16 09:58:39 2026 +0100 pinctrl: amdisp: Make amdisp_pinctrl_ops variable static File-scope 'amdisp_pinctrl_ops' is not used outside of this unit, so make it static to silence sparse warning: pinctrl-amdisp.c:83:26: warning: symbol 'amdisp_pinctrl_ops' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 7a648d598cb8e8c62af3f0e020a25820a3f3a9a7 Author: Felix Gu Date: Sat Feb 14 23:14:51 2026 +0800 pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns directly. This bypasses the cleanup logic and results in a memory leak of the cfg buffer. Fix this by jumping to the out label on failure, ensuring kfree(cfg) is called before returning. Fixes: 90a18c512884 ("pinctrl: pinconf-generic: Handle string values for generic properties") Signed-off-by: Felix Gu Reviewed-by: Antonio Borneo Signed-off-by: Linus Walleij commit 82aec772fca2223bc5774bd9af486fd95766e578 Author: Jakub Kicinski Date: Thu Feb 19 11:50:21 2026 -0800 netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00) Fixes: c62c0a17f9b7 ("netconsole: Append kernel version to message") Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260219195021.2099699-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit bae8a5d2e759da2e0cba33ab2080deee96a09373 Author: Duoming Zhou Date: Thu Feb 19 20:46:37 2026 +0800 net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series card is being detached, the fst_card_info is deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task may still be running or pending, leading to use-after-free bugs when the already freed fst_card_info is accessed in fst_process_tx_work_q() or fst_process_int_work_q(). A typical race condition is depicted below: CPU 0 (cleanup) | CPU 1 (tasklet) | fst_start_xmit() fst_remove_one() | tasklet_schedule() unregister_hdlc_device()| | fst_process_tx_work_q() //handler kfree(card) //free | do_bottom_half_tx() | card-> //use The following KASAN trace was captured: ================================================================== BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00 Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32 ... Call Trace: dump_stack_lvl+0x55/0x70 print_report+0xcb/0x5d0 ? do_bottom_half_tx+0xb88/0xd00 kasan_report+0xb8/0xf0 ? do_bottom_half_tx+0xb88/0xd00 do_bottom_half_tx+0xb88/0xd00 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx___hrtimer_run_queues+0x10/0x10 fst_process_tx_work_q+0x67/0x90 tasklet_action_common+0x1fa/0x720 ? hrtimer_interrupt+0x31f/0x780 handle_softirqs+0x176/0x530 __irq_exit_rcu+0xab/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 41 on cpu 3 at 72.330843s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 __kasan_kmalloc+0x7f/0x90 fst_add_one+0x1a5/0x1cd0 local_pci_probe+0xdd/0x190 pci_device_probe+0x341/0x480 really_probe+0x1c6/0x6a0 __driver_probe_device+0x248/0x310 driver_probe_device+0x48/0x210 __device_attach_driver+0x160/0x320 bus_for_each_drv+0x101/0x190 __device_attach+0x198/0x3a0 device_initial_probe+0x78/0xa0 pci_bus_add_device+0x81/0xc0 pci_bus_add_devices+0x7e/0x190 enable_slot+0x9b9/0x1130 acpiphp_check_bridge.part.0+0x2e1/0x460 acpiphp_hotplug_notify+0x36c/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... Freed by task 41 on cpu 1 at 75.138639s: kasan_save_stack+0x24/0x50 kasan_save_track+0x17/0x60 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x135/0x410 fst_remove_one+0x2ca/0x540 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0x364/0x530 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device+0xd/0x20 disable_slot+0x116/0x260 acpiphp_disable_and_eject_slot+0x4b/0x190 acpiphp_hotplug_notify+0x230/0x3c0 acpi_device_hotplug+0x203/0xb10 acpi_hotplug_work_fn+0x59/0x80 ... The buggy address belongs to the object at ffff88800aad1000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 28 bytes inside of freed 1024-byte region The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x100000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88800aad1000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88800aad1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88800aad1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fix this by ensuring that both fst_tx_task and fst_int_task are properly canceled before the fst_card_info is released. Add tasklet_kill() in fst_remove_one() to synchronize with any pending or running tasklets. Since unregister_hdlc_device() stops data transmission and reception, and fst_disable_intr() prevents further interrupts, it is appropriate to place tasklet_kill() after these calls. The bugs were identified through static analysis. To reproduce the issue and validate the fix, a FarSync T-series card was simulated in QEMU and delays(e.g., mdelay()) were introduced within the tasklet handler to increase the likelihood of triggering the race condition. Fixes: 2f623aaf9f31 ("net: farsync: Fix kmemleak when rmmods farsync") Signed-off-by: Duoming Zhou Reviewed-by: Jijie Shao Link: https://patch.msgid.link/20260219124637.72578-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni commit fdcfce93073d990ed4b71752e31ad1c1d6e9d58b Author: Jann Horn Date: Mon Feb 23 20:59:33 2026 +0100 eventpoll: Fix integer overflow in ep_loop_check_proc() If a recursive call to ep_loop_check_proc() hits the `result = INT_MAX`, an integer overflow will occur in the calling ep_loop_check_proc() at `result = max(result, ep_loop_check_proc(ep_tovisit, depth + 1) + 1)`, breaking the recursion depth check. Fix it by using a different placeholder value that can't lead to an overflow. Reported-by: Guenter Roeck Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn Link: https://patch.msgid.link/20260223-epoll-int-overflow-v1-1-452f35132224@google.com Signed-off-by: Christian Brauner commit 021fd0f87004e949cba6f27199b9925bc24ec3a0 Author: Fernando Fernandez Mancera Date: Thu Feb 19 08:57:38 2026 +0100 net/rds: fix recursive lock in rds_tcp_conn_slots_available syzbot reported a recursive lock warning in rds_tcp_get_peer_sport() as it calls inet6_getname() which acquires the socket lock that was already held by __release_sock(). kworker/u8:6/2985 is trying to acquire lock: ffff88807a07aa20 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] ffff88807a07aa20 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet6_getname+0x15d/0x650 net/ipv6/af_inet6.c:533 but task is already holding lock: ffff88807a07aa20 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] ffff88807a07aa20 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_sock_set_cork+0x2c/0x2e0 net/ipv4/tcp.c:3694 lock_sock_nested+0x48/0x100 net/core/sock.c:3780 lock_sock include/net/sock.h:1709 [inline] inet6_getname+0x15d/0x650 net/ipv6/af_inet6.c:533 rds_tcp_get_peer_sport net/rds/tcp_listen.c:70 [inline] rds_tcp_conn_slots_available+0x288/0x470 net/rds/tcp_listen.c:149 rds_recv_hs_exthdrs+0x60f/0x7c0 net/rds/recv.c:265 rds_recv_incoming+0x9f6/0x12d0 net/rds/recv.c:389 rds_tcp_data_recv+0x7f1/0xa40 net/rds/tcp_recv.c:243 __tcp_read_sock+0x196/0x970 net/ipv4/tcp.c:1702 rds_tcp_read_sock net/rds/tcp_recv.c:277 [inline] rds_tcp_data_ready+0x369/0x950 net/rds/tcp_recv.c:331 tcp_rcv_established+0x19e9/0x2670 net/ipv4/tcp_input.c:6675 tcp_v6_do_rcv+0x8eb/0x1ba0 net/ipv6/tcp_ipv6.c:1609 sk_backlog_rcv include/net/sock.h:1185 [inline] __release_sock+0x1b8/0x3a0 net/core/sock.c:3213 Reading from the socket struct directly is safe from possible paths. For rds_tcp_accept_one(), the socket has just been accepted and is not yet exposed to concurrent access. For rds_tcp_conn_slots_available(), direct access avoids the recursive deadlock seen during backlog processing where the socket lock is already held from the __release_sock(). However, rds_tcp_conn_slots_available() is also called from the normal softirq path via tcp_data_ready() where the lock is not held. This is also safe because inet_dport is a stable 16 bits field. A READ_ONCE() annotation as the value might be accessed lockless in a concurrent access context. Note that it is also safe to call rds_tcp_conn_slots_available() from rds_conn_shutdown() because the fan-out is disabled. Fixes: 9d27a0fb122f ("net/rds: Trigger rds_send_ping() more than once") Reported-by: syzbot+5efae91f60932839f0a5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5efae91f60932839f0a5 Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20260219075738.4403-1-fmancera@suse.de Signed-off-by: Paolo Abeni commit 017c1792525064a723971f0216e6ef86a8c7af11 Author: Vahagn Vardanian Date: Mon Feb 23 00:00:00 2026 +0000 wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced at lines 1638 and 1642 without a prior NULL check: ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl; ... pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value); The mesh_matches_local() check above only validates the Mesh ID, Mesh Configuration, and Supported Rates IEs. It does not verify the presence of the Mesh Channel Switch Parameters IE (element ID 118). When a received CSA action frame omits that IE, ieee802_11_parse_elems() leaves elems->mesh_chansw_params_ie as NULL, and the unconditional dereference causes a kernel NULL pointer dereference. A remote mesh peer with an established peer link (PLINK_ESTAB) can trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame that includes a matching Mesh ID and Mesh Configuration IE but omits the Mesh Channel Switch Parameters IE. No authentication beyond the default open mesh peering is required. Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000 Fix by adding a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns, consistent with how other optional IEs are guarded throughout the mesh code. The bug has been present since v3.13 (released 2014-01-19). Fixes: 8f2535b92d68 ("mac80211: process the CSA frame for mesh accordingly") Cc: stable@vger.kernel.org Signed-off-by: Vahagn Vardanian Signed-off-by: Johannes Berg commit 3d2e5d12a2eef0ca8a629a422aa593673235c77c Author: Siva Reddy Kallam Date: Wed Feb 18 09:12:46 2026 +0000 RDMA/bng_re: Unwind bng_re_dev_init properly Fix below smatch warning: drivers/infiniband/hw/bng_re/bng_dev.c:270 bng_re_dev_init() warn: missing unwind goto? Current bng_re_dev_init function is not having clear unwinding code. So, added proper unwinding with ladder. Fixes: 4f830cd8d7fe ("RDMA/bng_re: Add infrastructure for enabling Firmware channel") Reported-by: Simon Horman Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601010413.sWadrQel-lkp@intel.com/ Signed-off-by: Siva Reddy Kallam Link: https://patch.msgid.link/20260218091246.1764808-3-siva.kallam@broadcom.com Signed-off-by: Leon Romanovsky commit 7a23af417d9dd57b4382356b2e7442e5d2bf5bea Author: Siva Reddy Kallam Date: Wed Feb 18 09:12:45 2026 +0000 RDMA/bng_re: Remove unnessary validity checks Fix below smatch warning: drivers/infiniband/hw/bng_re/bng_dev.c:113 bng_re_net_ring_free() warn: variable dereferenced before check 'rdev' (see line 107) current driver has unnessary validity checks. So, removing these unnessary validity checks. Fixes: 4f830cd8d7fe ("RDMA/bng_re: Add infrastructure for enabling Firmware channel") Fixes: 745065770c2d ("RDMA/bng_re: Register and get the resources from bnge driver") Fixes: 04e031ff6e60 ("RDMA/bng_re: Initialize the Firmware and Hardware") Fixes: d0da769c19d0 ("RDMA/bng_re: Add Auxiliary interface") Reported-by: Simon Horman Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601010413.sWadrQel-lkp@intel.com/ Signed-off-by: Siva Reddy Kallam Link: https://patch.msgid.link/20260218091246.1764808-2-siva.kallam@broadcom.com Signed-off-by: Leon Romanovsky commit 9af0feae8016ba58ad7ff784a903404986b395b1 Author: Jiri Pirko Date: Tue Jan 27 10:38:39 2026 +0100 RDMA/core: Fix stale RoCE GIDs during netdev events at registration RoCE GID entries become stale when netdev properties change during the IB device registration window. This is reproducible with a udev rule that sets a MAC address when a VF netdev appears: ACTION=="add", SUBSYSTEM=="net", KERNEL=="eth4", \ RUN+="/sbin/ip link set eth4 address 88:22:33:44:55:66" After VF creation, show_gids displays GIDs derived from the original random MAC rather than the configured one. The root cause is a race between netdev event processing and device registration: CPU 0 (driver) CPU 1 (udev/workqueue) ────────────── ────────────────────── ib_register_device() ib_cache_setup_one() gid_table_setup_one() _gid_table_setup_one() ← GID table allocated rdma_roce_rescan_device() ← GIDs populated with OLD MAC ip link set eth4 addr NEW_MAC NETDEV_CHANGEADDR queued netdevice_event_work_handler() ib_enum_all_roce_netdevs() ← Iterates DEVICE_REGISTERED ← Device NOT marked yet, SKIP! enable_device_and_get() xa_set_mark(DEVICE_REGISTERED) ← Too late, event was lost The netdev event handler uses ib_enum_all_roce_netdevs() which only iterates devices marked DEVICE_REGISTERED. However, this mark is set late in the registration process, after the GID cache is already populated. Events arriving in this window are silently dropped. Fix this by introducing a new xarray mark DEVICE_GID_UPDATES that is set immediately after the GID table is allocated and initialized. Use the new mark in ib_enum_all_roce_netdevs() function to iterate devices instead of DEVICE_REGISTERED. This is safe because: - After _gid_table_setup_one(), all required structures exist (port_data, immutable, cache.gid) - The GID table mutex serializes concurrent access between the initial rescan and event handlers - Event handlers correctly update stale GIDs even when racing with rescan - The mark is cleared in ib_cache_cleanup_one() before teardown This also fixes similar races for IP address events (inetaddr_event, inet6addr_event) which use the same enumeration path. Fixes: 0df91bb67334 ("RDMA/devices: Use xarray to store the client_data") Signed-off-by: Jiri Pirko Link: https://patch.msgid.link/20260127093839.126291-1-jiri@resnulli.us Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Signed-off-by: Leon Romanovsky commit b4f4fd947a2a6df7cf1f530dd1028d9f3849eff5 Author: Alex Tran Date: Sat Jan 31 15:57:43 2026 -0800 selftests: hid: tests: test_wacom_generic: add tests for display devices and opaque devices Verify Wacom devices set INPUT_PROP_DIRECT on display devices and INPUT_PROP_POINTER on opaque devices. Verify INPUT_PROP_POINTER is not set on display devices and INPUT_PROP_DIRECT is not set on opaque devices. Moved test_prop_pointer into TestOpaqueTablet. Created a DirectTabletTest mixin class for test_prop_direct that can be inherited by display tablet test classes.Used DirectTabletTest for TestDTH2452Tablet case. Signed-off-by: Alex Tran Tested-by: Erin Skomra Reviewed-by: Erin Skomra Signed-off-by: Jiri Kosina commit a2e70a89fa58133521b2deae4427d35776bda935 Author: Ian Ray Date: Tue Feb 17 13:51:51 2026 +0200 HID: multitouch: new class MT_CLS_EGALAX_P80H84 Fixes: f9e82295eec1 ("HID: multitouch: add eGalaxTouch P80H84 support") Signed-off-by: Ian Ray Signed-off-by: Jiri Kosina commit 5f3518d77419255f8b12bb23c8ec22acbeb6bc5b Author: Julius Lehmann Date: Sat Feb 14 20:34:21 2026 +0100 HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 Battery reporting does not work for the Apple Magic Trackpad 2 if it is connected via USB. The current hid descriptor fixup code checks for a hid descriptor length of exactly 83 bytes. If the hid descriptor is larger, which is the case for newer apple mice, the fixup is not applied. This fix checks for hid descriptor sizes greater/equal 83 bytes which applies the fixup for newer devices as well. Signed-off-by: Julius Lehmann Signed-off-by: Jiri Kosina commit ac47870fd795549f03d57e0879fc730c79119f4b Author: Pengyu Luo Date: Sat Feb 14 18:51:28 2026 +0800 drm/msm/dsi: fix hdisplay calculation when programming dsi registers Recently, the hdisplay calculation is working for 3:1 compressed ratio only. If we have a video panel with DSC BPP = 8, and BPC = 10, we still use the default bits_per_pclk = 24, then we get the wrong hdisplay. We can draw the conclusion by cross-comparing the calculation with the calculation in dsi_adjust_pclk_for_compression(). Since CMD mode does not use this, we can remove !(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO) safely. Fixes: efcbd6f9cdeb ("drm/msm/dsi: Enable widebus for DSI") Signed-off-by: Pengyu Luo Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/704822/ Link: https://lore.kernel.org/r/20260214105145.105308-1-mitltlatltl@gmail.com Signed-off-by: Dmitry Baryshkov commit 6a087ac23f5b6619033ad08e60c355b00bb8ce51 Author: Ihor Solodrai Date: Mon Feb 23 11:07:18 2026 -0800 selftests/bpf: Replace strcpy() calls with strscpy() strcpy() does not perform bounds checking and is considered deprecated [1]. Replace strcpy() calls with strscpy() defined in bpf_util.h. [1] https://docs.kernel.org/process/deprecated.html#strcpy Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-3-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 63c49efc987afefc6b9bb7de083eb8748e0b1789 Author: Ihor Solodrai Date: Mon Feb 23 11:07:17 2026 -0800 selftests/bpf: Add simple strscpy() implementation Replace bpf_strlcpy() in bpf_util.h with a sized_strscpy(), which is a simplified sized_strscpy() from the kernel (lib/string.c [1]). It: * takes a count (destination size) parameter * guarantees NULL-termination * returns the number of characters copied or -E2BIG Re-define strscpy macro similar to in-kernel implementation [2]: allow the count parameter to be optional. Add #ifdef-s to tools/include/linux/args.h, as they may be defined in other system headers (for example, __CONCAT in sys/cdefs.h). Fixup the single existing bpf_strlcpy() call in cgroup_helpers.c [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/lib/string.c?h=v6.19#n113 [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/string.h?h=v6.19#n91 Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260223190736.649171-2-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 3aa677625c8fad39989496c51bcff3872c1f16f1 Author: Tung Nguyen Date: Fri Feb 20 05:05:41 2026 +0000 tipc: fix duplicate publication key in tipc_service_insert_publ() TIPC uses named table to store TIPC services represented by type and instance. Each time an application calls TIPC API bind() to bind a type/instance to a socket, an entry is created and inserted into the named table. It looks like this: named table: key1, entry1 (type, instance ...) key2, entry2 (type, instance ...) In the above table, each entry represents a route for sending data from one socket to the other. For all publications originated from the same node, the key is UNIQUE to identify each entry. It is calculated by this formula: key = socket portid + number of bindings + 1 (1) where: - socket portid: unique and calculated by using linux kernel function get_random_u32_below(). So, the value is randomized. - number of bindings: the number of times a type/instance pair is bound to a socket. This number is linearly increased, starting from 0. While the socket portid is unique and randomized by linux kernel, the linear increment of "number of bindings" in formula (1) makes "key" not unique anymore. For example: - Socket 1 is created with its associated port number 20062001. Type 1000, instance 1 is bound to socket 1: key1: 20062001 + 0 + 1 = 20062002 Then, bind() is called a second time on Socket 1 to by the same type 1000, instance 1: key2: 20062001 + 1 + 1 = 20062003 Named table: key1 (20062002), entry1 (1000, 1 ...) key2 (20062003), entry2 (1000, 1 ...) - Socket 2 is created with its associated port number 20062002. Type 1000, instance 1 is bound to socket 2: key3: 20062002 + 0 + 1 = 20062003 TIPC looks up the named table and finds out that key2 with the same value already exists and rejects the insertion into the named table. This leads to failure of bind() call from application on Socket 2 with error message EINVAL "Invalid argument". This commit fixes this issue by adding more port id checking to make sure that the key is unique to publications originated from the same port id and node. Fixes: 218527fe27ad ("tipc: replace name table service range array with rb tree") Signed-off-by: Tung Nguyen Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260220050541.237962-1-tung.quang.nguyen@est.tech Signed-off-by: Jakub Kicinski commit 4cfe066a82cdf9e83e48b16000f55280efc98325 Author: Ivan Vecera Date: Fri Feb 20 16:57:54 2026 +0100 dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs The REF_PHASE_OFFSET_COMP register is 48-bit wide on most zl3073x chip variants, but only 32-bit wide on chip IDs 0x0E30, 0x0E93..0x0E97 and 0x1F60. The driver unconditionally uses 48-bit read/write operations, which on 32-bit variants causes reading 2 bytes past the register boundary (corrupting the value) and writing 2 bytes into the adjacent register. Fix this by storing the chip ID in the device structure during probe and adding a helper to detect the affected variants. Use the correct register width for read/write operations and the matching sign extension bit (31 vs 47) when interpreting the phase compensation value. Fixes: 6287262f761e ("dpll: zl3073x: Add support to adjust phase") Signed-off-by: Ivan Vecera Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260220155755.448185-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit ca220141fa8ebae09765a242076b2b77338106b0 Author: Jiayuan Chen Date: Thu Feb 19 09:42:51 2026 +0800 kcm: fix zero-frag skb in frag_list on partial sendmsg error Syzkaller reported a warning in kcm_write_msgs() when processing a message with a zero-fragment skb in the frag_list. When kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb, it allocates a new skb (tskb) and links it into the frag_list before copying data. If the copy subsequently fails (e.g. -EFAULT from user memory), tskb remains in the frag_list with zero fragments: head skb (msg being assembled, NOT yet in sk_write_queue) +-----------+ | frags[17] | (MAX_SKB_FRAGS, all filled with data) | frag_list-+--> tskb +-----------+ +----------+ | frags[0] | (empty! copy failed before filling) +----------+ For SOCK_SEQPACKET with partial data already copied, the error path saves this message via partial_message for later completion. For SOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a subsequent zero-length write(fd, NULL, 0) completes the message and queues it to sk_write_queue. kcm_write_msgs() then walks the frag_list and hits: WARN_ON(!skb_shinfo(skb)->nr_frags) TCP has a similar pattern where skbs are enqueued before data copy and cleaned up on failure via tcp_remove_empty_skb(). KCM was missing the equivalent cleanup. Fix this by tracking the predecessor skb (frag_prev) when allocating a new frag_list entry. On error, if the tail skb has zero frags, use frag_prev to unlink and free it in O(1) without walking the singly-linked frag_list. frag_prev is safe to dereference because the entire message chain is only held locally (or in kcm->seq_skb) and is not added to sk_write_queue until MSG_EOR, so the send path cannot free it underneath us. Also change the WARN_ON to WARN_ON_ONCE to avoid flooding the log if the condition is somehow hit repeatedly. There are currently no KCM selftests in the kernel tree; a simple reproducer is available at [1]. [1] https://gist.github.com/mrpre/a94d431c757e8d6f168f4dd1a3749daa Reported-by: syzbot+52624bdfbf2746d37d70@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000269a1405a12fdc77@google.com/T/ Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260219014256.370092-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit fb868db5f4bccd7a78219313ab2917429f715cea Author: Ankit Garg Date: Fri Feb 20 13:53:24 2026 -0800 gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA buffer cleanup path. It iterates num_bufs times and attempts to unmap entries in the dma array. This leads to two issues: 1. The dma array shares storage with tx_qpl_buf_ids (union). Interpreting buffer IDs as DMA addresses results in attempting to unmap incorrect memory locations. 2. num_bufs in QPL mode (counting 2K chunks) can significantly exceed the size of the dma array, causing out-of-bounds access warnings (trace below is how we noticed this issue). UBSAN: array-index-out-of-bounds in drivers/net/ethernet/drivers/net/ethernet/google/gve/gve_tx_dqo.c:178:5 index 18 is out of range for type 'dma_addr_t[18]' (aka 'unsigned long long[18]') Workqueue: gve gve_service_task [gve] Call Trace: dump_stack_lvl+0x33/0xa0 __ubsan_handle_out_of_bounds+0xdc/0x110 gve_tx_stop_ring_dqo+0x182/0x200 [gve] gve_close+0x1be/0x450 [gve] gve_reset+0x99/0x120 [gve] gve_service_task+0x61/0x100 [gve] process_scheduled_works+0x1e9/0x380 Fix this by properly checking for QPL mode and delegating to gve_free_tx_qpl_bufs() to reclaim the buffers. Cc: stable@vger.kernel.org Fixes: a6fb8d5a8b69 ("gve: Tx path for DQO-QPL") Signed-off-by: Ankit Garg Reviewed-by: Jordan Rhee Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260220215324.1631350-1-joshwash@google.com Signed-off-by: Jakub Kicinski commit 7bb09315f93dce6acc54bf59e5a95ba7365c2be4 Author: Hyunwoo Kim Date: Fri Feb 20 18:40:36 2026 +0900 tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object. The following is a simple race scenario: cpu0 cpu1 tls_sk_proto_close() tls_sw_cancel_work_tx() tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask)) set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work); schedule_delayed_work(&tx_ctx->tx_work.work, 0); To prevent this race condition, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync(). Fixes: f87e62d45e51 ("net/tls: remove close callback sock unlock/lock around TX work flush") Signed-off-by: Hyunwoo Kim Reviewed-by: Simon Horman Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/aZgsFO6nfylfvLE7@v4bel Signed-off-by: Jakub Kicinski commit 8a8a9fac9efa6423fd74938b940cb7d731780718 Author: Eric Dumazet Date: Fri Feb 20 22:26:05 2026 +0000 net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change. Compute flow_id in set_rps_cpu(), do not assume we can use the value computed by get_rps_cpu(). Otherwise we risk out-of-bound access and/or crashes. Fixes: 48aa30443e52 ("net: Cache hash and flow_id to avoid recalculation") Signed-off-by: Eric Dumazet Cc: Krishna Kumar Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260220222605.3468081-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 41e09ec73d7431dffda01b1e7208a272a5c90fb9 Author: Jakub Kicinski Date: Fri Feb 20 17:18:58 2026 -0800 MAINTAINERS: include all of framer under pef2256 The "framer" infrastructure only has one driver - pef2256 and is not covered by any MAINTAINERS entry of its own. This leads to author not being CCed on patches. Let's include all of framer/ under the pef2256 entry. We can split it in the very unlikely event of another driver appearing. Link: https://lore.kernel.org/aZefB5f3EAkQQM1m@google.com Acked-by: Herve Codina Link: https://patch.msgid.link/20260221011858.3403605-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 55db009926634b20955bd8abbee921adbc8d2cb4 Author: Damien Le Moal Date: Fri Feb 20 12:09:12 2026 +0900 ata: libata-core: fix cancellation of a port deferred qc work cancel_work_sync() is a sleeping function so it cannot be called with the spin lock of a port being held. Move the call to this function in ata_port_detach() after EH completes, with the port lock released, together with other work cancellation calls. Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Igor Pylypiv commit eddb98ad9364b4e778768785d46cfab04ce52100 Author: Damien Le Moal Date: Fri Feb 20 13:43:00 2026 +0900 ata: libata-eh: correctly handle deferred qc timeouts A deferred qc may timeout while waiting for the device queue to drain to be submitted. In such case, since the qc is not active, ata_scsi_cmd_error_handler() ends up calling scsi_eh_finish_cmd(), which frees the qc. But as the port deferred_qc field still references this finished/freed qc, the deferred qc work may eventually attempt to call ata_qc_issue() against this invalid qc, leading to errors such as reported by UBSAN (syzbot run): UBSAN: shift-out-of-bounds in drivers/ata/libata-core.c:5166:24 shift exponent 4210818301 is too large for 64-bit type 'long long unsigned int' ... Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233 __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494 ata_qc_issue.cold+0x38/0x9f drivers/ata/libata-core.c:5166 ata_scsi_deferred_qc_work+0x154/0x1f0 drivers/ata/libata-scsi.c:1679 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Fix this by checking if the qc of a timed out SCSI command is a deferred one, and in such case, clear the port deferred_qc field and finish the SCSI command with DID_TIME_OUT. Reported-by: syzbot+1f77b8ca15336fff21ff@syzkaller.appspotmail.com Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Igor Pylypiv commit 4ced4cf5c9d172d91f181df3accdf949d3761aab Author: Andrei Vagin Date: Tue Feb 17 18:01:05 2026 +0000 binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4 Commit 4e6e8c2b757f ("binfmt_elf: Wire up AT_HWCAP3 at AT_HWCAP4") added support for AT_HWCAP3 and AT_HWCAP4, but it missed updating the AUX vector size calculation in create_elf_fdpic_tables() and AT_VECTOR_SIZE_BASE in include/linux/auxvec.h. Similar to the fix for AT_HWCAP2 in commit c6a09e342f8e ("binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined"), this omission leads to a mismatch between the reserved space and the actual number of AUX entries, eventually triggering a kernel BUG_ON(csp != sp). Fix this by incrementing nitems when ELF_HWCAP3 or ELF_HWCAP4 are defined and updating AT_VECTOR_SIZE_BASE. Cc: Mark Brown Cc: Max Filippov Reviewed-by: Michal Koutný Reviewed-by: Mark Brown Reviewed-by: Cyrill Gorcunov Reviewed-by: Alexander Mikhalitsyn Fixes: 4e6e8c2b757f ("binfmt_elf: Wire up AT_HWCAP3 at AT_HWCAP4") Signed-off-by: Andrei Vagin Link: https://patch.msgid.link/20260217180108.1420024-2-avagin@google.com Signed-off-by: Kees Cook commit 5886cc8f895bf578903eb681fca9123065e1012e Author: Thomas Weißschuh Date: Mon Feb 23 08:16:55 2026 +0100 drm/msm/dpu: Don't use %pK through printk (again) In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. This was previously fixed in this driver in commit 1ba9fbe40337 ("drm/msm: Don't use %pK through printk") but an additional usage was reintroduced in commit 39a750ff5fc9 ("drm/msm/dpu: Add DSPP GC driver to provide GAMMA_LUT DRM property") Signed-off-by: Thomas Weißschuh Fixes: 39a750ff5fc9 ("drm/msm/dpu: Add DSPP GC driver to provide GAMMA_LUT DRM property") Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/706229/ Link: https://lore.kernel.org/r/20260223-restricted-pointers-msm-v1-1-14c0b451e372@linutronix.de Signed-off-by: Dmitry Baryshkov commit 9f593419eb42c68f31829aed3c199591190bfe5d Author: Dmitry Baryshkov Date: Sat Feb 14 01:02:59 2026 +0200 Revert "drm/msm/dpu: try reserving the DSPP-less LM first" This reverts commit 42f62cd79578 ("drm/msm/dpu: try reserving the DSPP-less LM first"). It seems on later DPUs using higher LMs require some additional setup or conflicts with the hardware defaults. Val (and other developers) reported blue screen on Hamoa (X1E80100) laptops. Revert the offending commit until we understand, what is the issue. Fixes: 42f62cd79578 ("drm/msm/dpu: try reserving the DSPP-less LM first") Reported-by: Val Packett Closes: https://lore.kernel.org/r/33424a9d-10a6-4479-bba6-12f8ce60da1a@packett.cool Signed-off-by: Dmitry Baryshkov Tested-by: Manivannan Sadhasivam # T14s Patchwork: https://patchwork.freedesktop.org/patch/704814/ Link: https://lore.kernel.org/r/20260214-revert-dspp-less-v1-1-be0d636a2a6e@oss.qualcomm.com commit b1dcc804f4662256a3e4bd8ac182a7a2c9464723 Author: sunliming Date: Fri Jan 30 13:36:15 2026 +0800 drm/msm/dpu: Fix smatch warnings about variable dereferenced before check Fix below smatch warnings: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp_v13.c:161 dpu_hw_sspp_setup_pe_config_v13() warn: variable dereferenced before check 'ctx' (see line 159) Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601252214.oEaY3UZM-lkp@intel.com/ Signed-off-by: sunliming Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/701853/ Link: https://lore.kernel.org/r/20260130053615.24886-1-sunliming@linux.dev Signed-off-by: Dmitry Baryshkov commit 6f6f3535192dd597c5326ea5456ae3bafc7d43b2 Author: Kees Cook Date: Fri Feb 6 14:21:52 2026 -0800 drm/msm: Adjust msm_iommu_pagetable_prealloc_allocate() allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "void **" but the returned type will be "void ***". These are the same allocation size (pointer size), but the types do not match. Adjust the allocation type to match the assignment. Signed-off-by: Kees Cook Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/703588/ Link: https://lore.kernel.org/r/20260206222151.work.016-kees@kernel.org Signed-off-by: Dmitry Baryshkov commit f7bf1319739291067b2bc4b22bd56336afad8f0a Author: Konrad Dybcio Date: Tue Jan 27 11:58:49 2026 +0100 drm/msm/dpu: Fix LM size on a number of platforms The register space has grown with what seems to be DPU8. Bump up the .len to match. Fixes: e3b1f369db5a ("drm/msm/dpu: Add X1E80100 support") Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP") Fixes: efcd0107727c ("drm/msm/dpu: add support for SM8550") Fixes: 100d7ef6995d ("drm/msm/dpu: add support for SM8450") Fixes: 178575173472 ("drm/msm/dpu: add catalog entry for SAR2130P") Signed-off-by: Konrad Dybcio Reviewed-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/701063/ Link: https://lore.kernel.org/r/20260127-topic-lm_size_fix-v1-1-25f88d014dfd@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit a9dece60cc8246e5fc4c46d391272024bf1d309d Author: Akhil P Oommen Date: Sat Jan 24 06:32:56 2026 +0530 drm/msm/adreno: Add GPU to MODULE_DEVICE_TABLE Since it is possible to independently probe Adreno GPU, add GPU match table to MODULE_DEVICE_TABLE to allow auto-loading of msm module. Signed-off-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/700656/ Link: https://lore.kernel.org/r/20260124-adreno-module-table-v1-1-9c2dbb2638b4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 7adaaee5edd35a423ae199c41b86bd1ed60ed483 Author: Bart Van Assche Date: Mon Feb 23 15:05:15 2026 -0800 Input: synaptics-rmi4 - fix a locking bug in an error path Lock f54->data_mutex when entering the function statement since jumping to the 'error' label when checking report_size fails causes that mutex to be unlocked. This bug has been detected by the Clang thread-safety checker. Fixes: 3a762dbd5347 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260223215118.2154194-16-bvanassche@acm.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit f709859f331b8fbd7fede5769d668008fc5ba789 Author: Nathan Chancellor Date: Mon Feb 23 11:23:12 2026 -0700 init/Kconfig: Adjust fixed clang version for __builtin_counted_by_ref Commit d39a1d7486d9 ("compiler_types: Disable __builtin_counted_by_ref for Clang") used 22.0.0 as the fixed version for a compiler crash but the fix was only merged in main (23.0.0) and release/22.x (22.1.0). With the current fixed version number, prerelease or Android LLVM 22 builds will still be able to hit the compiler crash when building the kernel. This can be particularly disruptive when bisecting LLVM. Use 21.1.0 as the fixed version number to ensure the fix for this crash is always present. Fixes: d39a1d7486d9 ("compiler_types: Disable __builtin_counted_by_ref for Clang") Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20260223-fix-clang-version-builtin-counted-by-ref-v1-1-3ea478a24f0a@kernel.org Signed-off-by: Kees Cook commit 96a7b71c4438d3b72d6c95e3efdc9e8e8aee6b78 Author: Kees Cook Date: Mon Feb 23 13:43:45 2026 -0800 ubd: Use pointer-to-pointers for io_thread_req arrays Having an unbounded array for irq_req_buffer and io_req_buffer doesn't provide any bounds safety, and confuses the needed allocation type, which is returning a pointer to pointers. Instead of the implicit cast, switch the variable types. Reported-by: Nathan Chancellor Reported-by: Guenter Roeck Closes: https://lore.kernel.org/all/b04b6c13-7d0e-4a89-9e68-b572b6c686ac@roeck-us.net Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Acked-by: Richard Weinberger Link: https://patch.msgid.link/20260223214341.work.846-kees@kernel.org Signed-off-by: Kees Cook commit 0879c3f04f67e2a1677c25dcc24669ce21eb6a6c Author: Shuicheng Lin Date: Thu Feb 19 23:35:19 2026 +0000 drm/xe/sync: Fix user fence leak on alloc failure When dma_fence_chain_alloc() fails, properly release the user fence reference to prevent a memory leak. Fixes: 0995c2fc39b0 ("drm/xe: Enforce correct user fence signaling order using") Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260219233516.2938172-6-shuicheng.lin@intel.com (cherry picked from commit a5d5634cde48a9fcd68c8504aa07f89f175074a0) Cc: stable@vger.kernel.org Signed-off-by: Rodrigo Vivi commit 1bfd7575092420ba5a0b944953c95b74a5646ff8 Author: Shuicheng Lin Date: Thu Feb 19 23:35:18 2026 +0000 drm/xe/sync: Cleanup partially initialized sync on parse failure xe_sync_entry_parse() can allocate references (syncobj, fence, chain fence, or user fence) before hitting a later failure path. Several of those paths returned directly, leaving partially initialized state and leaking refs. Route these error paths through a common free_sync label and call xe_sync_entry_cleanup(sync) before returning the error. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260219233516.2938172-5-shuicheng.lin@intel.com (cherry picked from commit f939bdd9207a5d1fc55cced5459858480686ce22) Cc: stable@vger.kernel.org Signed-off-by: Rodrigo Vivi commit 5839419cffc7788a356428d321e3ec18055c0286 Author: Christoffer Sandberg Date: Mon Feb 23 15:20:45 2026 +0100 Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table The device occasionally wakes up from suspend with missing input on the internal keyboard and the following suspend attempt results in an instant wake-up. The quirks fix both issues for this device. Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260223142054.50310-1-wse@tuxedocomputers.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 138d7eca445ef37a0333425d269ee59900ca1104 Author: Luiz Augusto von Dentz Date: Fri Feb 13 13:33:33 2026 -0500 Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE. Link: https://lore.kernel.org/linux-bluetooth/5782243.rdbgypaU67@n9w6sw14/ Fixes: 27e2d4c8d28b ("Bluetooth: Add basic LE L2CAP connect request receiving support") Signed-off-by: Luiz Augusto von Dentz Tested-by: Christian Eggers commit a8d1d73c81d1e70d2aa49fdaf59d933bb783ffe5 Author: Luiz Augusto von Dentz Date: Tue Feb 17 13:29:43 2026 -0500 Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ Upon receiving L2CAP_ECRED_CONN_REQ the given MTU shall be checked against the suggested MTU of the listening socket as that is required by the likes of PTS L2CAP/ECFC/BV-27-C test which expects L2CAP_CR_LE_UNACCEPT_PARAMS if the MTU is lowers than socket omtu. In order to be able to set chan->omtu the code now allows setting setsockopt(BT_SNDMTU), but it is only allowed when connection has not been stablished since there is no procedure to reconfigure the output MTU. Link: https://github.com/bluez/bluez/issues/1895 Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Signed-off-by: Luiz Augusto von Dentz commit 7cff9a40c6b0f72ccefdaf0ffe03cfac30348f51 Author: Mariusz Skamra Date: Thu Feb 12 14:46:46 2026 +0100 Bluetooth: Fix CIS host feature condition This fixes the condition for sending the LE Set Host Feature command. The command is sent to indicate host support for Connected Isochronous Streams in this case. It has been observed that the system could not initialize BIS-only capable controllers because the controllers do not support the command. As per Core v6.2 | Vol 4, Part E, Table 3.1 the command shall be supported if CIS Central or CIS Peripheral is supported; otherwise, the command is optional. Fixes: 709788b154ca ("Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings") Cc: stable@vger.kernel.org Signed-off-by: Mariusz Skamra Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit a84097e625f2b9e7f273161c004f34b7be63b348 Author: Waiman Long Date: Sat Feb 21 13:54:18 2026 -0500 cgroup/cpuset: Call housekeeping_update() without holding cpus_read_lock The current cpuset partition code is able to dynamically update the sched domains of a running system and the corresponding HK_TYPE_DOMAIN housekeeping cpumask to perform what is essentially the "isolcpus=domain,..." boot command line feature at run time. The housekeeping cpumask update requires flushing a number of different workqueues which may not be safe with cpus_read_lock() held as the workqueue flushing code may acquire cpus_read_lock() or acquiring locks which have locking dependency with cpus_read_lock() down the chain. Below is an example of such circular locking problem. ====================================================== WARNING: possible circular locking dependency detected 6.18.0-test+ #2 Tainted: G S ------------------------------------------------------ test_cpuset_prs/10971 is trying to acquire lock: ffff888112ba4958 ((wq_completion)sync_wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x7a/0x180 but task is already holding lock: ffffffffae47f450 (cpuset_mutex){+.+.}-{4:4}, at: cpuset_partition_write+0x85/0x130 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (cpuset_mutex){+.+.}-{4:4}: -> #3 (cpu_hotplug_lock){++++}-{0:0}: -> #2 (rtnl_mutex){+.+.}-{4:4}: -> #1 ((work_completion)(&arg.work)){+.+.}-{0:0}: -> #0 ((wq_completion)sync_wq){+.+.}-{0:0}: Chain exists of: (wq_completion)sync_wq --> cpu_hotplug_lock --> cpuset_mutex 5 locks held by test_cpuset_prs/10971: #0: ffff88816810e440 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0xf9/0x1d0 #1: ffff8891ab620890 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x260/0x5f0 #2: ffff8890a78b83e8 (kn->active#187){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2b6/0x5f0 #3: ffffffffadf32900 (cpu_hotplug_lock){++++}-{0:0}, at: cpuset_partition_write+0x77/0x130 #4: ffffffffae47f450 (cpuset_mutex){+.+.}-{4:4}, at: cpuset_partition_write+0x85/0x130 Call Trace: : touch_wq_lockdep_map+0x93/0x180 __flush_workqueue+0x111/0x10b0 housekeeping_update+0x12d/0x2d0 update_parent_effective_cpumask+0x595/0x2440 update_prstate+0x89d/0xce0 cpuset_partition_write+0xc5/0x130 cgroup_file_write+0x1a5/0x680 kernfs_fop_write_iter+0x3df/0x5f0 vfs_write+0x525/0xfd0 ksys_write+0xf9/0x1d0 do_syscall_64+0x95/0x520 entry_SYSCALL_64_after_hwframe+0x76/0x7e To avoid such a circular locking dependency problem, we have to call housekeeping_update() without holding the cpus_read_lock() and cpuset_mutex. The current set of wq's flushed by housekeeping_update() may not have work functions that call cpus_read_lock() directly, but we are likely to extend the list of wq's that are flushed in the future. Moreover, the current set of work functions may hold locks that may have cpu_hotplug_lock down the dependency chain. So housekeeping_update() is now called after releasing cpus_read_lock and cpuset_mutex at the end of a cpuset operation. These two locks are then re-acquired later before calling rebuild_sched_domains_locked(). To enable mutual exclusion between the housekeeping_update() call and other cpuset control file write actions, a new top level cpuset_top_mutex is introduced. This new mutex will be acquired first to allow sharing variables used by both code paths. However, cpuset update from CPU hotplug can still happen in parallel with the housekeeping_update() call, though that should be rare in production environment. As cpus_read_lock() is now no longer held when tmigr_isolated_exclude_cpumask() is called, it needs to acquire it directly. The lockdep_is_cpuset_held() is also updated to return true if either cpuset_top_mutex or cpuset_mutex is held. Fixes: 03ff73510169 ("cpuset: Update HK_TYPE_DOMAIN cpumask from cpuset") Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 6df415aa46ec10d607da5063d88492a7c7762074 Author: Waiman Long Date: Sat Feb 21 13:54:17 2026 -0500 cgroup/cpuset: Defer housekeeping_update() calls from CPU hotplug to workqueue The cpuset_handle_hotplug() may need to invoke housekeeping_update(), for instance, when an isolated partition is invalidated because its last active CPU has been put offline. As we are going to enable dynamic update to the nozh_full housekeeping cpumask (HK_TYPE_KERNEL_NOISE) soon with the help of CPU hotplug, allowing the CPU hotplug path to call into housekeeping_update() directly from update_isolation_cpumasks() will likely cause deadlock. So we have to defer any call to housekeeping_update() after the CPU hotplug operation has finished. This is now done via the workqueue where the update_hk_sched_domains() function will be invoked via the hk_sd_workfn(). An concurrent cpuset control file write may have executed the required update_hk_sched_domains() function before the work function is called. So the work function call may become a no-op when it is invoked. Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 3bfe47967191f42d17510713b31a47d9284b8c5a Author: Waiman Long Date: Sat Feb 21 13:54:16 2026 -0500 cgroup/cpuset: Move housekeeping_update()/rebuild_sched_domains() together With the latest changes in sched/isolation.c, rebuild_sched_domains*() requires the HK_TYPE_DOMAIN housekeeping cpumask to be properly updated first, if needed, before the sched domains can be rebuilt. So the two naturally fit together. Do that by creating a new update_hk_sched_domains() helper to house both actions. The name of the isolated_cpus_updating flag to control the call to housekeeping_update() is now outdated. So change it to update_housekeeping to better reflect its purpose. Also move the call to update_hk_sched_domains() to the end of cpuset and hotplug operations before releasing the cpuset_mutex. Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 5e6aac573cc4cc8e62aebf880b824e219a5ff557 Author: Waiman Long Date: Sat Feb 21 13:54:15 2026 -0500 kselftest/cgroup: Simplify test_cpuset_prs.sh by removing "S+" command The "S+" command is used in the test matrix to enable the cpuset controller. However this can be done automatically and we never use the "S-" command to disable cpuset controller. Simplify the test matrix and reduce clutter by removing the command and doing that automatically. There is no functional change to the test cases. Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 14713ed9e9291813849018f32edbf5f6de362088 Author: Waiman Long Date: Sat Feb 21 13:54:14 2026 -0500 cgroup/cpuset: Set isolated_cpus_updating only if isolated_cpus is changed As cpuset is updating HK_TYPE_DOMAIN housekeeping mask when there is a change in the set of isolated CPUs, making this change is now more costly than before. Right now, the isolated_cpus_updating flag can be set even if there is no real change in isolated_cpus. Put in additional checks to make sure that isolated_cpus_updating is set only if there is a real change in isolated_cpus. Reviewed-by: Chen Ridong Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 17b1860034c769c9f7669ae2612e91ef8fdde769 Author: Waiman Long Date: Sat Feb 21 13:54:13 2026 -0500 cgroup/cpuset: Clarify exclusion rules for cpuset internal variables Clarify the locking rules associated with file level internal variables inside the cpuset code. There is no functional change. Reviewed-by: Chen Ridong Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 68230aac8b9aad243626fbaf3ca170012c17fec5 Author: Waiman Long Date: Sat Feb 21 13:54:12 2026 -0500 cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier() Commit e2ffe502ba45 ("cgroup/cpuset: Add cpuset.cpus.exclusive for v2") incorrectly changed the 2nd parameter of cpuset_update_tasks_cpumask() from tmp->new_cpus to cp->effective_cpus. This second parameter is just a temporary cpumask for internal use. The cpuset_update_tasks_cpumask() function was originally called update_tasks_cpumask() before commit 381b53c3b549 ("cgroup/cpuset: rename functions shared between v1 and v2"). This mistake can incorrectly change the effective_cpus of the cpuset when it is the top_cpuset or in arm64 architecture where task_cpu_possible_mask() may differ from cpu_possible_mask. So far top_cpuset hasn't been passed to update_cpumasks_hier() yet, but arm64 arch can still be impacted. Fix it by reverting the incorrect change. Fixes: e2ffe502ba45 ("cgroup/cpuset: Add cpuset.cpus.exclusive for v2") Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit f9a1767ce3a34bc33c3d33473f65dc13a380e379 Author: Waiman Long Date: Sat Feb 21 13:54:11 2026 -0500 cgroup/cpuset: Fix incorrect change to effective_xcpus in partition_xcpus_del() The effective_xcpus of a cpuset can contain offline CPUs. In partition_xcpus_del(), the xcpus parameter is incorrectly used as a temporary cpumask to mask out offline CPUs. As xcpus can be the effective_xcpus of a cpuset, this can result in unexpected changes in that cpumask. Fix this problem by not making any changes to the xcpus parameter. Fixes: 11e5f407b64a ("cgroup/cpuset: Keep track of CPUs in isolated partitions") Reviewed-by: Chen Ridong Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 05761c2c2b5bfec85c47f60c903c461e9b56cf87 Author: Luiz Augusto von Dentz Date: Wed Feb 11 15:18:03 2026 -0500 Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ Similar to 03dba9cea72f ("Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION") the result code L2CAP_CR_LE_ENCRYPTION shall be used when BT_SECURITY_MEDIUM is set since that means security mode 2 which mean it doesn't require authentication which results in qualification test L2CAP/ECFC/BV-32-C failing. Link: https://github.com/bluez/bluez/issues/1871 Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Signed-off-by: Luiz Augusto von Dentz commit 5c4e9a8b18457ad28b57069ef0f14661e3192b2e Author: Jinwang Li Date: Thu Feb 5 14:26:00 2026 +0800 Bluetooth: hci_qca: Cleanup on all setup failures The setup process previously combined error handling and retry gating under one condition. As a result, the final failed attempt exited without performing cleanup. Update the failure path to always perform power and port cleanup on setup failure, and reopen the port only when retrying. Fixes: 9e80587aba4c ("Bluetooth: hci_qca: Enhance retry logic in qca_setup") Signed-off-by: Jinwang Li Reviewed-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 21e4271e65094172aadd5beb8caea95dd0fbf6d7 Author: Heitor Alves de Siqueira Date: Wed Feb 11 15:03:35 2026 -0300 Bluetooth: purge error queues in socket destructors When TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued into sk_error_queue and will stay there until consumed. If userspace never gets to read the timestamps, or if the controller is removed unexpectedly, these SKBs will leak. Fix by adding skb_queue_purge() calls for sk_error_queue in affected bluetooth destructors. RFCOMM does not currently use sk_error_queue. Fixes: 134f4b39df7b ("Bluetooth: add support for skb TX SND/COMPLETION timestamping") Reported-by: syzbot+7ff4013eabad1407b70a@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=7ff4013eabad1407b70a Cc: stable@vger.kernel.org Signed-off-by: Heitor Alves de Siqueira Signed-off-by: Luiz Augusto von Dentz commit c28d2bff70444a85b3b86aaf241ece9408c7858c Author: Luiz Augusto von Dentz Date: Thu Feb 5 15:11:34 2026 -0500 Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short Test L2CAP/ECFC/BV-26-C expect the response to L2CAP_ECRED_CONN_REQ with and MTU value < L2CAP_ECRED_MIN_MTU (64) to be L2CAP_CR_LE_INVALID_PARAMS rather than L2CAP_CR_LE_UNACCEPT_PARAMS. Also fix not including the correct number of CIDs in the response since the spec requires all CIDs being rejected to be included in the response. Link: https://github.com/bluez/bluez/issues/1868 Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Signed-off-by: Luiz Augusto von Dentz commit 7accb1c4321acb617faf934af59d928b0b047e2b Author: Luiz Augusto von Dentz Date: Tue Feb 3 15:16:16 2026 -0500 Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ This fixes responding with an invalid result caused by checking the wrong size of CID which should have been (cmd_len - sizeof(*req)) and on top of it the wrong result was use L2CAP_CR_LE_INVALID_PARAMS which is invalid/reserved for reconf when running test like L2CAP/ECFC/BI-03-C: > ACL Data RX: Handle 64 flags 0x02 dlen 14 LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 6 MTU: 64 MPS: 64 Source CID: 64 < ACL Data TX: Handle 64 flags 0x00 dlen 10 LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2 ! Result: Reserved (0x000c) Result: Reconfiguration failed - one or more Destination CIDs invalid (0x0003) Fiix L2CAP/ECFC/BI-04-C which expects L2CAP_RECONF_INVALID_MPS (0x0002) when more than one channel gets its MPS reduced: > ACL Data RX: Handle 64 flags 0x02 dlen 16 LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 8 MTU: 264 MPS: 99 Source CID: 64 ! Source CID: 65 < ACL Data TX: Handle 64 flags 0x00 dlen 10 LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2 ! Result: Reconfiguration successful (0x0000) Result: Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time (0x0002) Fix L2CAP/ECFC/BI-05-C when SCID is invalid (85 unconnected): > ACL Data RX: Handle 64 flags 0x02 dlen 14 LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 6 MTU: 65 MPS: 64 ! Source CID: 85 < ACL Data TX: Handle 64 flags 0x00 dlen 10 LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2 ! Result: Reconfiguration successful (0x0000) Result: Reconfiguration failed - one or more Destination CIDs invalid (0x0003) Fix L2CAP/ECFC/BI-06-C when MPS < L2CAP_ECRED_MIN_MPS (64): > ACL Data RX: Handle 64 flags 0x02 dlen 14 LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 6 MTU: 672 ! MPS: 63 Source CID: 64 < ACL Data TX: Handle 64 flags 0x00 dlen 10 LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2 ! Result: Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time (0x0002) Result: Reconfiguration failed - other unacceptable parameters (0x0004) Fix L2CAP/ECFC/BI-07-C when MPS reduced for more than one channel: > ACL Data RX: Handle 64 flags 0x02 dlen 16 LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 3 len 8 MTU: 84 ! MPS: 71 Source CID: 64 ! Source CID: 65 < ACL Data TX: Handle 64 flags 0x00 dlen 10 LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2 ! Result: Reconfiguration successful (0x0000) Result: Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time (0x0002) Link: https://github.com/bluez/bluez/issues/1865 Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Signed-off-by: Luiz Augusto von Dentz commit f9b888599418951b8229bbb28851ed4da50c58e9 Author: Rob Herring (Arm) Date: Wed Jan 28 16:02:42 2026 -0600 remoteproc: qcom_wcnss: Fix reserved region mapping failure Commit c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") switched from devm_ioremap_wc() to devm_ioremap_resource_wc(). The difference is devm_ioremap_resource_wc() also requests the resource which fails. Testing of both fixed and dynamic reserved regions indicates that requesting the resource should work, so I'm not sure why it doesn't work in this case. Fix the issue by reverting back to devm_ioremap_wc(). Reported-by: Marek Szyprowski Reported-by: André Apitzsch Fixes: c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Rob Herring (Arm) Tested-by: Marek Szyprowski Tested-by: André Apitzsch # on BQ Aquaris M5 Link: https://lore.kernel.org/r/20260128220243.3018526-1-robh@kernel.org Signed-off-by: Bjorn Andersson commit 16cb1a64dce56708a1684bf755ad52fb52c41f87 Author: Arnd Bergmann Date: Mon Feb 16 13:12:00 2026 +0100 RDMA/uverbs: select CONFIG_DMA_SHARED_BUFFER The addition of dmabuf support in uverbs means that it is no longer possible to build infiniband support if that is disabled: arm-linux-gnueabi-ld: drivers/infiniband/core/ib_core_uverbs.o: in function `rdma_user_mmap_entry_remove.part.0': ib_core_uverbs.c:(.text+0x508): undefined reference to `dma_buf_move_notify' (dma_buf_move_notify): Unknown destination type (ARM/Thumb) in drivers/infiniband/core/ib_core_uverbs.o ib_core_uverbs.c:(.text+0x518): undefined reference to `dma_resv_wait_timeout' (dma_resv_wait_timeout): Unknown destination type (ARM/Thumb) in drivers/infiniband/core/ib_core_uverbs.o Select this from Kconfig, as we do for the other users. Fixes: 0ac6f4056c4a ("RDMA/uverbs: Add DMABUF object type and operations") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260216121213.2088910-1-arnd@kernel.org Signed-off-by: Leon Romanovsky commit f9d69d5e7bde2295eb7488a56f094ac8f5383b92 Author: Ihor Solodrai Date: Tue Dec 30 10:32:08 2025 -0800 module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn't check for bounds of the ELF section index in simplify_symbols(): for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) { const char *name = info->strtab + sym[i].st_name; switch (sym[i].st_shndx) { case SHN_COMMON: [...] default: /* Divert to percpu allocation if a percpu var. */ if (sym[i].st_shndx == info->index.pcpu) secbase = (unsigned long)mod_percpu(mod); else /** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr; sym[i].st_value += secbase; break; } } A symbol with an out-of-bounds st_shndx value, for example 0xffff (known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic: BUG: unable to handle page fault for address: ... RIP: 0010:simplify_symbols+0x2b2/0x480 ... Kernel panic - not syncing: Fatal exception This can happen when module ELF is legitimately using SHN_XINDEX or when it is corrupted. Add a bounds check in simplify_symbols() to validate that st_shndx is within the valid range before using it. This issue was discovered due to a bug in llvm-objcopy, see relevant discussion for details [1]. [1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/ Signed-off-by: Ihor Solodrai Reviewed-by: Daniel Gomez Reviewed-by: Petr Pavlu Signed-off-by: Sami Tolvanen commit 7a875c09899ba0404844abfd8f0d54cdc481c151 Author: Oliver Neukum Date: Mon Feb 9 15:37:20 2026 +0100 usb: yurex: fix race in probe The bbu member of the descriptor must be set to the value standing for uninitialized values before the URB whose completion handler sets bbu is submitted. Otherwise there is a window during which probing can overwrite already retrieved data. Cc: stable Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20260209143720.1507500-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 0d6c8144ca4d93253de952a5ea0028c19ed7ab68 Author: Kuen-Han Tsai Date: Sat Feb 21 22:48:16 2026 +0800 usb: gadget: f_ncm: Fix atomic context locking issue The ncm_set_alt function was holding a mutex to protect against races with configfs, which invokes the might-sleep function inside an atomic context. Remove the struct net_device pointer from the f_ncm_opts structure to eliminate the contention. The connection state is now managed by a new boolean flag to preserve the use-after-free fix from commit 6334b8e4553c ("usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error"). BUG: sleeping function called from invalid context Call Trace: dump_stack_lvl+0x83/0xc0 dump_stack+0x14/0x16 __might_resched+0x389/0x4c0 __might_sleep+0x8e/0x100 ... __mutex_lock+0x6f/0x1740 ... ncm_set_alt+0x209/0xa40 set_config+0x6b6/0xb40 composite_setup+0x734/0x2b40 ... Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") Cc: stable@kernel.org Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260221-legacy-ncm-v2-2-dfb891d76507@google.com Signed-off-by: Greg Kroah-Hartman commit fde0634ad9856b3943a2d1a8cc8de174a63ac840 Author: Kuen-Han Tsai Date: Sat Feb 21 22:48:15 2026 +0800 usb: legacy: ncm: Fix NPE in gncm_bind Commit 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") deferred the allocation of the net_device. This change leads to a NULL pointer dereference in the legacy NCM driver as it attempts to access the net_device before it's fully instantiated. Store the provided qmult, host_addr, and dev_addr into the struct ncm_opts->net_opts during gncm_bind(). These values will be properly applied to the net_device when it is allocated and configured later in the binding process by the NCM function driver. Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") Cc: stable@kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202602181727.fd76c561-lkp@intel.com Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260221-legacy-ncm-v2-1-dfb891d76507@google.com Signed-off-by: Greg Kroah-Hartman commit b9fde507355342a2d64225d582dc8b98ff5ecb19 Author: Jiasheng Jiang Date: Thu Feb 19 02:38:34 2026 +0000 usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling The `tpg->tpg_nexus` pointer in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can be NULL if the USB host sends requests before the nexus is fully established or immediately after it is dropped. Currently, functions like `bot_submit_command()` and the data transfer paths retrieve `tv_nexus = tpg->tpg_nexus` and immediately dereference `tv_nexus->tvn_se_sess` without any validation. If a malicious or misconfigured USB host sends a BOT (Bulk-Only Transport) command during this race window, it triggers a NULL pointer dereference, leading to a kernel panic (local DoS). This exposes an inconsistent API usage within the module, as peer functions like `usbg_submit_command()` and `bot_send_bad_response()` correctly implement a NULL check for `tv_nexus` before proceeding. Fix this by bringing consistency to the nexus handling. Add the missing `if (!tv_nexus)` checks to the vulnerable BOT command and request processing paths, aborting the command gracefully with an error instead of crashing the system. Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT") Cc: stable Signed-off-by: Jiasheng Jiang Reviewed-by: Thinh Nguyen Link: https://patch.msgid.link/20260219023834.17976-1-jiashengjiangcool@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7dff99b354601dd01829e1511711846e04340a69 Author: Linus Torvalds Date: Mon Feb 23 11:18:48 2026 -0800 Remove WARN_ALL_UNSEEDED_RANDOM kernel config option This config option goes way back - it used to be an internal debug option to random.c (at that point called DEBUG_RANDOM_BOOT), then was renamed and exposed as a config option as CONFIG_WARN_UNSEEDED_RANDOM, and then further renamed to the current CONFIG_WARN_ALL_UNSEEDED_RANDOM. It was all done with the best of intentions: the more limited rate-limited reports were reporting some cases, but if you wanted to see all the gory details, you'd enable this "ALL" option. However, it turns out - perhaps not surprisingly - that when people don't care about and fix the first rate-limited cases, they most certainly don't care about any others either, and so warning about all of them isn't actually helping anything. And the non-ratelimited reporting causes problems, where well-meaning people enable debug options, but the excessive flood of messages that nobody cares about will hide actual real information when things go wrong. I just got a kernel bug report (which had nothing to do with randomness) where two thirds of the the truncated dmesg was just variations of random: get_random_u32 called from __get_random_u32_below+0x10/0x70 with crng_init=0 and in the process early boot messages had been lost (in addition to making the messages that _hadn't_ been lost harder to read). The proper way to find these things for the hypothetical developer that cares - if such a person exists - is almost certainly with boot time tracing. That gives you the option to get call graphs etc too, which is likely a requirement for fixing any problems anyway. See Documentation/trace/boottime-trace.rst for that option. And if we for some reason do want to re-introduce actual printing of these things, it will need to have some uniqueness filtering rather than this "just print it all" model. Fixes: cc1e127bfa95 ("random: remove ratelimiting for in-kernel unseeded randomness") Acked-by: Jason Donenfeld Signed-off-by: Linus Torvalds commit 93cd0d664661f58f7e7bed7373714ab2ace41734 Author: A1RM4X Date: Wed Feb 4 14:26:48 2026 -0500 USB: add QUIRK_NO_BOS for video capture several devices Several USB capture devices also need the USB_QUIRK_NO_BOS set for them to work properly, odds are they are all the same chip inside, just different vendor/product ids. This fixes up: - ASUS TUF 4K PRO - Avermedia Live Gamer Ultra 2.1 (GC553G2) - UGREEN 35871 to now run at full speed (10 Gbps/4K 60 fps mode.) Link: https://lore.kernel.org/r/CACy+XB-f-51xGpNQFCSm5pE_momTQLu=BaZggHYU1DiDmFX=ug@mail.gmail.com Cc: stable Signed-off-by: A1RM4X Signed-off-by: Greg Kroah-Hartman commit 43d37df67f7770d8d261fdcb64ecc8c314e91303 Author: Matt Roper Date: Fri Feb 6 14:30:59 2026 -0800 drm/xe/wa: Steer RMW of MCR registers while building default LRC When generating the default LRC, if a register is not masked, we apply any save-restore programming necessary via a read-modify-write sequence that will ensure we only update the relevant bits/fields without clobbering the rest of the register. However some of the registers that need to be updated might be MCR registers which require steering to a non-terminated instance to ensure we can read back a valid, non-zero value. The steering of reads originating from a command streamer is controlled by register CS_MMIO_GROUP_INSTANCE_SELECT. Emit additional MI_LRI commands to update the steering before any RMW of an MCR register to ensure the reads are performed properly. Note that needing to perform a RMW of an MCR register while building the default LRC is pretty rare. Most of the MCR registers that are part of an engine's LRCs are also masked registers, so no MCR is necessary. Fixes: f2f90989ccff ("drm/xe: Avoid reading RMW registers in emit_wa_job") Cc: Michal Wajdeczko Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20260206223058.387014-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper (cherry picked from commit 6c2e331c915ba9e774aa847921262805feb00863) Signed-off-by: Rodrigo Vivi commit be237352f84059344cb9609e55f38fe0e492deee Merge: 6de23f81a5e08b 97af85787c1964 Author: Martin K. Petersen Date: Mon Feb 23 13:39:58 2026 -0500 Merge branch '7.0/scsi-queue' into 7.0/scsi-fixes Pull in remaining fixes from 7.0/scsi-queue. Signed-off-by: Martin K. Petersen commit e7e222ad73d93fe54d6e6e3a15253a0ecf081a1b Author: Dave Jiang Date: Wed Feb 11 17:31:23 2026 -0700 cxl: Move devm_cxl_add_nvdimm_bridge() to cxl_pmem.ko Moving the symbol devm_cxl_add_nvdimm_bridge() to drivers/cxl/cxl_pmem.c, so that cxl_pmem can export a symbol that gives cxl_acpi a depedency on cxl_pmem kernel module. This is a prepatory patch to resolve the issue of a race for nvdimm_bus object that is created during cxl_acpi_probe(). No functional changes besides moving code. Suggested-by: Dan Williams Acked-by: Ira Weiny Tested-by: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260205001633.1813643-2-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 075e70d13edfcb309c8fdc1f444fbd1f834ca1d4 Author: Cheng-Yang Chou Date: Mon Feb 23 02:47:09 2026 +0800 selftests/sched_ext: Remove duplicated unistd.h include in rt_stall.c The header is included twice in rt_stall.c. Remove the redundant inclusion to clean up the code. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit cbb297323dbed4f6087b5f189585413801d1d45b Author: Cheng-Yang Chou Date: Sun Feb 22 21:08:26 2026 +0800 tools/sched_ext: scx_sdt: Remove unused '-f' option The '-f' option is defined in getopt() but not handled in the switch statement or documented in the help text. Providing '-f' currently triggers the default error path. Remove it to sync the optstring with the actual implementation. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 0c36a6f6f0eb071379b7995ef571c18c1235adf2 Author: Cheng-Yang Chou Date: Sun Feb 22 21:08:25 2026 +0800 tools/sched_ext: scx_central: Remove unused '-p' option The '-p' option is defined in getopt() but not handled in the switch statement or documented in the help text. Providing '-p' currently triggers the default error path. Remove it to sync the optstring with the actual implementation. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 1f0638604f65dae9fc8b6ce937907daf5f0132d0 Author: Cheng-Yang Chou Date: Sun Feb 22 16:25:22 2026 +0800 selftests/sched_ext: Fix unused-result warning for read() The read() call in run_test() triggers a warn_unused_result compiler warning, which breaks the build under -Werror. Check the return value of read() and exit the child process on failure to satisfy the compiler and handle pipe read errors. Reviewed-by: Andrea Righi Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 8d597ba6ec18dae2eec143d4e1c9d81441ca0dda Author: Petr Pavlu Date: Thu Feb 5 15:37:08 2026 +0100 module: Fix the modversions and signing submenus The module Kconfig file contains a set of options related to "Module versioning support" (depends on MODVERSIONS) and "Module signature verification" (depends on MODULE_SIG). The Kconfig tool automatically creates submenus when an entry for a symbol is followed by consecutive items that all depend on the symbol. However, this functionality doesn't work for the mentioned module options. The MODVERSIONS options are interleaved with ASM_MODVERSIONS, which has no 'depends on MODVERSIONS' but instead uses 'default HAVE_ASM_MODVERSIONS && MODVERSIONS'. Similarly, the MODULE_SIG options are interleaved by a comment warning not to forget signing modules with scripts/sign-file, which uses the condition 'depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL'. The result is that the options are confusingly shown when using a menuconfig tool, as follows: [*] Module versioning support Module versioning implementation (genksyms (from source code)) ---> [ ] Extended Module Versioning Support [*] Basic Module Versioning Support [*] Source checksum for all modules [*] Module signature verification [ ] Require modules to be validly signed [ ] Automatically sign all modules Hash algorithm to sign modules (SHA-256) ---> Fix the issue by using if/endif to group related options together in kernel/module/Kconfig, similarly to how the MODULE_DEBUG options are already grouped. Note that the signing-related options depend on 'MODULE_SIG || IMA_APPRAISE_MODSIG', with the exception of MODULE_SIG_FORCE, which is valid only for MODULE_SIG and is therefore kept separately. For consistency, do the same for the MODULE_COMPRESS entries. The options are then properly placed into submenus, as follows: [*] Module versioning support Module versioning implementation (genksyms (from source code)) ---> [ ] Extended Module Versioning Support [*] Basic Module Versioning Support [*] Source checksum for all modules [*] Module signature verification [ ] Require modules to be validly signed [ ] Automatically sign all modules Hash algorithm to sign modules (SHA-256) ---> Signed-off-by: Petr Pavlu Reviewed-by: Daniel Gomez Signed-off-by: Sami Tolvanen commit a7b4bc094fbaa7dc7b7b91ae33549bbd7eefaac1 Author: Petr Pavlu Date: Wed Jan 7 13:22:57 2026 +0100 module: Remove duplicate freeing of lockdep classes In the error path of load_module(), under the free_module label, the code calls lockdep_free_key_range() to release lock classes associated with the MOD_DATA, MOD_RODATA and MOD_RO_AFTER_INIT module regions, and subsequently invokes module_deallocate(). Since commit ac3b43283923 ("module: replace module_layout with module_memory"), the module_deallocate() function calls free_mod_mem(), which releases the lock classes as well and considers all module regions. Attempting to free these classes twice is unnecessary. Remove the redundant code in load_module(). Fixes: ac3b43283923 ("module: replace module_layout with module_memory") Signed-off-by: Petr Pavlu Reviewed-by: Daniel Gomez Reviewed-by: Aaron Tomlin Acked-by: Song Liu Acked-by: Peter Zijlstra (Intel) Signed-off-by: Sami Tolvanen commit 551d44200152cb26f75d2ef990aeb6185b7e37fd Author: Linus Torvalds Date: Mon Feb 23 09:33:08 2026 -0800 default_gfp(): avoid using the "newfangled" __VA_OPT__ trick The default_gfp() helper that I added is not wrong, but it turns out that it causes unnecessary headaches for 'sparse' which doesn't support the use of __VA_OPT__ (introduced in C++20 and C23, and supported by gcc and clang for a long time). We do already use __VA_OPT__ in some other cases in the kernel (drm/xe and btrfs), but it has been fairly limited. Now it triggers for pretty much everything, and sparse ends up not working at all. We can use the traditional gcc ',##__VA_ARGS__' syntax instead: it may not be the "C standard" way and is slightly less natural in this context, but it is the traditional model for this and avoids the sparse problem. Reported-and-tested-by: Ricardo Ribalda Reported-and-tested-by: Richard Fitzgerald Reported-by: Ben Dooks Fixes: e19e1b480ac7 ("add default_gfp() helper macro and use it in the new *alloc_obj() helpers") Signed-off-by: Linus Torvalds commit 901ec3470994006bc8dd02399e16b675566c3416 Author: Lizhi Hou Date: Thu Feb 19 13:19:46 2026 -0800 accel/amdxdna: Validate command buffer payload count The count field in the command header is used to determine the valid payload size. Verify that the valid payload does not exceed the remaining buffer space. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260219211946.1920485-1-lizhi.hou@amd.com commit 03808abb1d868aed7478a11a82e5bb4b3f1ca6d6 Author: Lizhi Hou Date: Tue Feb 17 11:28:15 2026 -0800 accel/amdxdna: Prevent ubuf size overflow The ubuf size calculation may overflow, resulting in an undersized allocation and possible memory corruption. Use check_add_overflow() helpers to validate the size calculation before allocation. Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260217192815.1784689-1-lizhi.hou@amd.com commit 1110a949675ebd56b3f0286e664ea543f745801c Author: Lizhi Hou Date: Tue Feb 17 10:54:15 2026 -0800 accel/amdxdna: Fix out-of-bounds memset in command slot handling The remaining space in a command slot may be smaller than the size of the command header. Clearing the command header with memset() before verifying the available slot space can result in an out-of-bounds write and memory corruption. Fix this by moving the memset() call after the size validation. Fixes: 3d32eb7a5ecf ("accel/amdxdna: Fix cu_idx being cleared by memset() during command setup") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260217185415.1781908-1-lizhi.hou@amd.com commit 07efce5a6611af6714ea3ef65694e0c8dd7e44f5 Author: Lizhi Hou Date: Wed Feb 11 12:53:41 2026 -0800 accel/amdxdna: Fix command hang on suspended hardware context When a hardware context is suspended, the job scheduler is stopped. If a command is submitted while the context is suspended, the job is queued in the scheduler but aie2_sched_job_run() is never invoked to restart the hardware context. As a result, the command hangs. Fix this by modifying the hardware context suspend routine to keep the job scheduler running so that queued jobs can trigger context restart properly. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260211205341.722982-1-lizhi.hou@amd.com commit fdb65acfe655f844ae1e88696b9656d3ef5bb8fb Author: Lizhi Hou Date: Wed Feb 11 12:47:16 2026 -0800 accel/amdxdna: Fix suspend failure after enabling turbo mode Enabling turbo mode disables hardware clock gating. Suspend requires hardware clock gating to be re-enabled, otherwise suspend will fail. Fix this by calling aie2_runtime_cfg() from aie2_hw_stop() to re-enable clock gating during suspend. Also ensure that firmware is initialized in aie2_hw_start() before modifying clock-gating settings during resume. Fixes: f4d7b8a6bc8c ("accel/amdxdna: Enhance power management settings") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260211204716.722788-1-lizhi.hou@amd.com commit 1aa82181a3c285c7351523d587f7981ae4c015c8 Author: Lizhi Hou Date: Wed Feb 11 12:46:44 2026 -0800 accel/amdxdna: Fix dead lock for suspend and resume When an application issues a query IOCTL while auto suspend is running, a deadlock can occur. The query path holds dev_lock and then calls pm_runtime_resume_and_get(), which waits for the ongoing suspend to complete. Meanwhile, the suspend callback attempts to acquire dev_lock and blocks, resulting in a deadlock. Fix this by releasing dev_lock before calling pm_runtime_resume_and_get() and reacquiring it after the call completes. Also acquire dev_lock in the resume callback to keep the locking consistent. Fixes: 063db451832b ("accel/amdxdna: Enhance runtime power management") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260211204644.722758-1-lizhi.hou@amd.com commit 57aa3917a3b3bd805a3679371f97a1ceda3c5510 Author: Mario Limonciello Date: Tue Feb 10 10:42:51 2026 -0600 accel/amdxdna: Reduce log noise during process termination During process termination, several error messages are logged that are not actual errors but expected conditions when a process is killed or interrupted. This creates unnecessary noise in the kernel log. The specific scenarios are: 1. HMM invalidation returns -ERESTARTSYS when the wait is interrupted by a signal during process cleanup. This is expected when a process is being terminated and should not be logged as an error. 2. Context destruction returns -ENODEV when the firmware or device has already stopped, which commonly occurs during cleanup if the device was already torn down. This is also an expected condition during orderly shutdown. Downgrade these expected error conditions from error level to debug level to reduce log noise while still keeping genuine errors visible. Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup") Reviewed-by: Lizhi Hou Signed-off-by: Mario Limonciello Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260210164521.1094274-3-mario.limonciello@amd.com commit 8363c02863332992a1822688da41f881d88d1631 Author: Lizhi Hou Date: Thu Feb 5 22:03:06 2026 -0800 accel/amdxdna: Fix crash when destroying a suspended hardware context If userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, the driver may crash because the mailbox channel pointer is NULL for the suspended context. Fix this by checking the mailbox channel pointer in aie2_destroy_context() before accessing it. Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup") Reviewed-by: Karol Wachowski Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260206060306.4050531-1-lizhi.hou@amd.com commit c68a6af400ca80596e8c37de0a1cb564aa9da8a4 Author: Lizhi Hou Date: Thu Feb 5 22:02:51 2026 -0800 accel/amdxdna: Switch to always use chained command Preempt commands are only supported when submitted as chained commands. To ensure preempt support works consistently, always submit commands in chained command format. Set force_cmdlist to true so that single commands are filled using the chained command layout, enabling correct handling of preempt commands. Fixes: 3a0ff7b98af4 ("accel/amdxdna: Support preemption requests") Reviewed-by: Karol Wachowski Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260206060251.4050512-1-lizhi.hou@amd.com commit 08fe1b5166fdc81b010d7bf39cd6440620e7931e Author: Lizhi Hou Date: Thu Feb 5 22:02:37 2026 -0800 accel/amdxdna: Remove buffer size check when creating command BO Large command buffers may be used, and they do not always need to be mapped or accessed by the driver. Performing a size check at command BO creation time unnecessarily rejects valid use cases. Remove the buffer size check from command BO creation, and defer vmap and size validation to the paths where the driver actually needs to map and access the command buffer. Fixes: ac49797c1815 ("accel/amdxdna: Add GEM buffer object management") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260206060237.4050492-1-lizhi.hou@amd.com commit 9d851afa482680bdd7c158cc8720284dc9ecb5fe Author: Cheng-Yang Chou Date: Sat Feb 21 23:40:42 2026 +0800 selftests/sched_ext: Abort test loop on signal The runner sets exit_req on SIGINT/SIGTERM but ignores it during the main loop. This prevents users from cleanly interrupting a test run. Check exit_req each iteration to safely break out on exit signals. Signed-off-by: Cheng-Yang Chou Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 410666a298c34ebd57256fde6b24c96bd23059a2 Author: Roberto Bergantinos Corpas Date: Thu Feb 19 13:04:40 2026 +0100 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative. This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open. This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection). While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don't attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops. Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly.") Reviewed-by: Olga Kornievskaia Reviewed-by: Scott Mayhew Signed-off-by: Roberto Bergantinos Corpas Signed-off-by: Anna Schumaker commit 0066688dbcdcf51680f499936faffe6d0e94194e Author: Li Ming Date: Tue Feb 10 19:46:57 2026 +0800 cxl/port: Hold port host lock during dport adding. CXL testing environment can trigger following trace Oops: general protection fault, probably for non-canonical address 0xdffffc0000000092: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000490-0x0000000000000497] RIP: 0010:cxl_dpa_to_region+0x105/0x1f0 [cxl_core] Call Trace: cxl_event_trace_record+0xd1/0xa70 [cxl_core] __cxl_event_trace_record+0x12f/0x1e0 [cxl_core] cxl_mem_get_records_log+0x261/0x500 [cxl_core] cxl_mem_get_event_records+0x7c/0xc0 [cxl_core] cxl_mock_mem_probe+0xd38/0x1c60 [cxl_mock_mem] platform_probe+0x9d/0x130 really_probe+0x1c8/0x960 __driver_probe_device+0x187/0x3e0 driver_probe_device+0x45/0x120 __device_attach_driver+0x15d/0x280 When CXL subsystem adds a cxl port to a hierarchy, there is a small window where the new port becomes visible before it is bound to a driver. This happens because device_add() adds a device to bus device list before bus_probe_device() binds it to a driver. So if two cxl memdevs are trying to add a dport to a same port via devm_cxl_enumerate_ports(), the second cxl memdev may observe the port and attempt to add a dport, but fails because the port has not yet been attached to cxl port driver. That causes the memdev->endpoint can not be updated. The sequence is like: CPU 0 CPU 1 devm_cxl_enumerate_ports() # port not found, add it add_port_attach_ep() # hold the parent port lock # to add the new port devm_cxl_create_port() device_add() # Add dev to bus devs list bus_add_device() devm_cxl_enumerate_ports() # found the port find_cxl_port_by_uport() # hold port lock to add a dport device_lock(the port) find_or_add_dport() cxl_port_add_dport() return -ENXIO because port->dev.driver is NULL device_unlock(the port) bus_probe_device() # hold the port lock # for attaching device_lock(the port) attaching the new port device_unlock(the port) To fix this race, require that dport addition holds the host lock of the target port(the host of CXL root and all cxl host bridge ports is the platform firmware device, the host of all other ports is their parent port). The CXL subsystem already requires holding the host lock while attaching a new port. Therefore, successfully acquiring the host lock guarantees that port attaching has completed. Fixes: 4f06d81e7c6a ("cxl: Defer dport allocation for switch ports") Signed-off-by: Li Ming Reviewed-by: Dan Williams Tested-by: Alison Schofield Link: https://patch.msgid.link/20260210-fix-port-enumeration-failure-v3-2-06acce0b9ead@zohomail.com Signed-off-by: Dave Jiang commit 822655e6751dde2df7ddaa828c5aba217726c5a2 Author: Li Ming Date: Mon Feb 23 09:29:00 2026 -0700 cxl/port: Introduce port_to_host() helper In CXL subsystem, a port has its own host device for the port creation and removal. The host of CXL root and all the first level ports is the platform firmware device, the host of other ports is their parent port's device. Create this new helper to much easier to get the host of a cxl port. Introduce port_to_host() and use it to replace all places where using open coded to get the host of a port. Remove endpoint_host() as its functionality can be replaced by port_to_host(). [dj: Squashed commit 1 and 3 in the series to commit 1. ] Signed-off-by: Li Ming Tested-by: Alison Schofield Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260210-fix-port-enumeration-failure-v3-1-06acce0b9ead@zohomail.com Signed-off-by: Dave Jiang commit ec197dca8735f7627e5cff7e3fa8839b53a28514 Author: Fuad Tabba Date: Sun Feb 22 08:33:52 2026 +0000 KVM: arm64: Revert accidental drop of kvm_uninit_stage2_mmu() for non-NV VMs Commit 0c4762e26879 ("KVM: arm64: nv: Avoid NV stage-2 code when NV is not supported") added an early return to several functions in arch/arm64/kvm/nested.c to prevent a UBSAN shift-out-of-bounds error when accessing the pgt union for non-nested VMs. However, this early return was inadvertently applied to kvm_arch_flush_shadow_all() as well, causing it to skip the call to kvm_uninit_stage2_mmu(kvm) for all non-nested VMs. For pKVM, skipping this teardown means the host never unshares the guest's memory with the EL2 hypervisor. When the host kernel later recycles these leaked pages for a new VM, it attempts to re-share them. The hypervisor correctly rejects this with -EPERM, triggering a host WARN_ON and hanging the guest. Fix this by dropping the early return from kvm_arch_flush_shadow_all(). The for-loop guarding the nested MMU cleanup already bounds itself when nested_mmus_size == 0, allowing execution to proceed to kvm_uninit_stage2_mmu() as intended. Reported-by: Mark Brown Closes: https://lore.kernel.org/all/60916cb6-f460-4751-b910-f63c58700ad0@sirena.org.uk/ Fixes: 0c4762e26879 ("KVM: arm64: nv: Avoid NV stage-2 code when NV is not supported") Signed-off-by: Fuad Tabba Tested-by: Mark Brown Link: https://patch.msgid.link/20260222083352.89503-1-tabba@google.com Signed-off-by: Marc Zyngier commit b7df21c59739cceb7b866c6c5e8a6ba03875ab71 Author: Ravi Hothi Date: Fri Feb 20 14:32:20 2026 +0530 arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity The WCD9370 audio codec reset line on QCM6490 IDP should be active-low, but the device tree described it as active-high. As a result, the codec is kept in reset and fails to reset the SoundWire, leading to timeouts and ASoC card probe failure (-ETIMEDOUT). Fix the reset GPIO polarity to GPIO_ACTIVE_LOW so the codec can properly initialize. Fixes: aa04c298619f ("arm64: dts: qcom: qcm6490-idp: Add WSA8830 speakers and WCD9370 headset codec") Signed-off-by: Ravi Hothi Reviewed-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260220090220.2992193-1-ravi.hothi@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9836feedcf559449e82eb0f741084086780104e5 Author: Armin Wolf Date: Wed Feb 18 01:51:01 2026 +0100 platform/x86: uniwill-laptop: Handle FN lock event On many devices, the user can toggle the Fn lock state by pressing Fn + Esc. Forward the associated event to the fn_lock sysfs attribute as a poll notification. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260218005101.73680-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2be519d94544e226636c185e28ec1a72d01aab87 Author: Armin Wolf Date: Wed Feb 18 01:51:00 2026 +0100 platform/x86: uniwill-laptop: Mark FN lock status as being volatile It turns out that the FN lock status can be changed by the underlying hardware when the user presses a special key combination. Mark the associated register as volatile to prevent regmap from caching said value. Also add the necessary suspend/resume handling. Fixes: d050479693bb ("platform/x86: Add Uniwill laptop driver") Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260218005101.73680-4-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 67e7eb4c130a74c5da9ab43316e00ed3186d1811 Author: Armin Wolf Date: Wed Feb 18 01:50:59 2026 +0100 platform/x86: uniwill-laptop: Fix crash on unexpected battery event On devices that have not UNIWILL_FEATURE_BATTERY set, the underlying hardware might still send the UNIWILL_OSD_BATTERY_ALERT event. In such a situation, the driver will access uninitialized data structures when handling said event. Prevent this by only handling the UNIWILL_OSD_BATTERY_ALERT event when UNIWILL_FEATURE_BATTERY is set. Fixes: d050479693bb ("platform/x86: Add Uniwill laptop driver") Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260218005101.73680-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2d53dfacf067968a9ff90c03700fb9b28049f4c6 Author: Armin Wolf Date: Wed Feb 18 01:50:58 2026 +0100 platform/x86: uniwill-laptop: Rename FN lock and super key lock attrs It turns out that both sysfs attributes actually directly control the FN lock status/super key enable status, rather than the triggering of the associated events. This behavior was first observed on a Tuxedo notebook and was belived to be a hardware quirk. However, it seems that i simply misunderstood the manual of the OEM software for Intel NUC devices. The correct behavior is: - fn_lock_toggle_enable enables/disables FN lock mode - super_key_toggle_enable enables/disables the super key Rename both sysfs attributes to avoid confusing users. Fixes: d050479693bb ("platform/x86: Add Uniwill laptop driver") Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260218005101.73680-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 318c58852e686c009825ae8c071080b9ccdd2af0 Author: Gregory Price Date: Wed Feb 11 14:22:27 2026 -0500 cxl/memdev: fix deadlock in cxl_memdev_autoremove() on attach failure cxl_memdev_autoremove() takes device_lock(&cxlmd->dev) via guard(device) and then calls cxl_memdev_unregister() when the attach callback was provided but cxl_mem_probe() failed to bind. cxl_memdev_unregister() calls cdev_device_del() device_del() bus_remove_device() device_release_driver() This path is reached when a driver uses the @attach parameter to devm_cxl_add_memdev() and the CXL topology fails to enumerate (e.g. DVSEC range registers decode outside platform-defined CXL ranges, causing the endpoint port probe to fail). Add cxl_memdev_attach_failed() to set the scope of the check correctly. Reported-by: kreview-c94b85d6d2 Fixes: 29317f8dc6ed ("cxl/mem: Introduce cxl_memdev_attach for CXL-dependent operation") Signed-off-by: Gregory Price Reviewed-by: Dan Williams Reviewed-by: Davidlohr Bueso Link: https://patch.msgid.link/20260211192228.2148713-1-gourry@gourry.net Signed-off-by: Dave Jiang commit e0cf84109bc6c6768337123f1de24ff56b41c91b Author: Claudiu Beznea Date: Wed Feb 4 15:34:27 2026 +0200 reset: rzg2l-usbphy-ctrl: Check pwrrdy is valid before using it The pwrrdy regmap_filed is allocated in rzg2l_usbphy_ctrl_pwrrdy_init() only if the driver data is set to RZG2L_USBPHY_CTRL_PWRRDY. Check that pwrrdy is valid before using it to avoid "Unable to handle kernel NULL pointer dereference at virtual address" errors. Fixes: c5b7cd9adefc ("reset: rzg2l-usbphy-ctrl: Add suspend/resume support") Signed-off-by: Claudiu Beznea Reviewed-by: Biju Das Signed-off-by: Philipp Zabel commit e3aa6feaf0cc30a3c941d15ff04bc1005a8aa315 Author: Jesse Guo Date: Mon Jan 26 04:48:26 2026 +0800 platform/x86: redmi-wmi: Add more hotkey mappings This patch adds more Fn hotkeys (like Refresh rate toggle). Additionally, remap the setup key from KEY_SETUP to KEY_CONFIG. As KEY_CONFIG is supported by Desktop Environments for launching system settings, whereas KEY_SETUP is often ignored by userspace. Signed-off-by: Jesse Guo Reviewed-by: Gladyshev Ilya Link: https://patch.msgid.link/TYCPR01MB6851636256C39B170F2312E5D192A@TYCPR01MB6851.jpnprd01.prod.outlook.com Signed-off-by: Ilpo Järvinen commit bd5914caeb4b2de233992c31babccda88041b035 Author: Kurt Borja Date: Thu Jan 29 12:19:24 2026 -0500 platform/x86: alienware-wmi-wmax: Add G-Mode support to m18 laptops Alienware m18 laptops support G-Mode. Therefore, match them with G-Series quirks. Cc: stable@vger.kernel.org Tested-by: Olexa Bilaniuk Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20260129-m18-gmode-v1-1-48be521487b9@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 729ffcffa73069cb066fd54a2bc7b09e5f782d48 Author: Anton Plotnikov Date: Tue Feb 3 18:48:32 2026 +0200 platform/x86: hp-wmi: add Omen 14-fb1xxx (board 8E41) support Reverse engineering of the HP Omen Windows utility shows that for performance mode it uses the same codes listed in hp_thermal_profile_omen_v1. Therefore it seems sufficient to add the board model name to omen_thermal_profile_boards. Tested on Omen 14-fb1xxx: CPU power in performance profile reaches the Windows limit (65W), instead of 45W in automatic BIOS mode. Max fan speed was reached as well. Link: https://patch.msgid.link/20260203164832.40514-1-plotnikovanton@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 26a7601471f62b95d56a81c3a8ccb551b5a6630f Author: Kurt Borja Date: Sat Feb 7 12:16:34 2026 -0500 platform/x86: dell-wmi: Add audio/mic mute key codes Add audio/mic mute key codes found in Alienware m18 r1 AMD. Cc: stable@vger.kernel.org Tested-by: Olexa Bilaniuk Suggested-by: Olexa Bilaniuk Signed-off-by: Kurt Borja Acked-by: Pali Rohár Link: https://patch.msgid.link/20260207-mute-keys-v2-1-c55e5471c9c1@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 249f05e625c6e6c14b27fd34a2f06a1afb9b456d Author: Victor Lattaro Volpini Date: Tue Feb 10 00:00:52 2026 +0000 platform/x86: hp-wmi: Add Victus 16-d0xxx support This patch enables Victus thermal profile support for the HP Victus 16-d0xxx. It does so by adding model's DMI board name 88F8 to victus_thermal_profile_boards. Tested on a Victus 16-d0xxx: - Victus thermal profile choices available (quiet, balanced, performance) instead of the default ones (cool, quiet, balanced, performance); - Profile switching works correctly; - About 4% increase in FPS using benchmark Cyberpunk 2077 on performance profile; - No noticeable regressions. Signed-off-by: Victor Lattaro Volpini Link: https://patch.msgid.link/20260210000048.250280-1-victorlattaro@proton.me Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b38d478dad79e61e8a65931021bdfd7a71741212 Author: Leif Skunberg Date: Tue Feb 10 09:56:25 2026 +0100 platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 The Lenovo ThinkPad X1 Fold 16 Gen 1 has physical volume up/down buttons that are handled through the intel-hid 5-button array interface. The firmware does not advertise 5-button array support via HEBC, so the driver relies on a DMI allowlist to enable it. Add the ThinkPad X1 Fold 16 Gen 1 to the button_array_table so the volume buttons work out of the box. Signed-off-by: Leif Skunberg Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260210085625.34380-1-diamondback@cohunt.app Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2a7b7652b1bb3fadc3bd47d622bfb127a93ab6b0 Author: Leif Skunberg Date: Tue Feb 10 14:21:29 2026 +0100 platform/x86: int3472: Handle GPIO type 0x10 (DOVDD) The Lenovo ThinkPad X1 Fold 16 Gen 1 has an OV5675 sensor (ACPI HID OVTI5675) behind an INT3472 discrete PMIC controller. The INT3472 _DSM returns GPIO type 0x10 for one of the pins, which controls the DOVDD (digital I/O power) regulator enable. Type 0x10 is not currently handled by the driver, causing the GPIO to be ignored with a warning. Add INT3472_GPIO_TYPE_DOVDD (0x10) and handle it as a regulator with con_id "dovdd" to match the supply name used by sensor drivers (e.g. ov5675). Also increase GPIO_SUPPLY_NAME_LENGTH from 5 to 6 to accommodate the "dovdd" name (5 chars + null terminator). Signed-off-by: Leif Skunberg Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260210132129.17943-1-diamondback@cohunt.app Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3ecea84d2b90bbf934d5ca75514fa902fd71e03f Author: Daniel J Blueman Date: Fri Feb 20 20:44:58 2026 +0800 arm64: dts: qcom: hamoa/x1: fix idle exit latency Designs based on the Qualcomm X1 Hamoa reference platform report: driver: Idle state 1 target residency too low This is because the declared X1 idle entry plus exit latency of 680us exceeds the declared minimum 600us residency time: entry-latency-us = <180>; exit-latency-us = <500>; min-residency-us = <600>; Fix this to be 320us so the sum of the entry and exit latencies matches the downstream 500us exit latency, as directed by Maulik. Tested on a Lenovo Yoga Slim 7x with Qualcomm X1E-80-100. Fixes: 2e65616ef07f ("arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers") Signed-off-by: Daniel J Blueman Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260220124626.8611-1-daniel@quora.org Signed-off-by: Bjorn Andersson commit f0109b9d3e1e455429279d602f6276e34689750a Author: Greg Kroah-Hartman Date: Mon Feb 23 14:31:35 2026 +0100 staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() Just like in commit 154828bf9559 ("staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser"), we don't trust the data in the frame so we should check the length better before acting on it Cc: stable Assisted-by: gkh_clanker_2000 Tested-by: Navaneeth K Reviewed-by: Navaneeth K Link: https://patch.msgid.link/2026022336-arrange-footwork-6e54@gregkh Signed-off-by: Greg Kroah-Hartman commit 8225489ddb900656cc21573b4e1b00c9181fd777 Author: Artem Lytkin Date: Mon Feb 16 20:20:38 2026 +0000 staging: sm750fb: add missing pci_release_region on error and removal hw_sm750_map() calls pci_request_region() but never releases the region on error paths or in lynxfb_pci_remove(). This causes a resource leak that prevents the PCI region from being mapped again after driver removal or a failed probe. A TODO comment in the code acknowledges this missing cleanup. Restructure the error handling in hw_sm750_map() to properly release the PCI region on ioremap failures, and add pci_release_region() to lynxfb_pci_remove(). Signed-off-by: Artem Lytkin Cc: stable Link: https://patch.msgid.link/20260216202038.1828-1-iprintercanon@gmail.com Signed-off-by: Greg Kroah-Hartman commit cae66f1a1dcd23e17da5a015ef9d731129f9d2dd Author: Corey Minyard Date: Fri Feb 13 00:15:04 2026 -0600 ipmi:si: Fix check for a misbehaving BMC There is a race on checking the state in the sender, it needs to be checked under a lock. But you also need a check to avoid issues with a misbehaving BMC for run to completion mode. So leave the check at the beginning for run to completion, and add a check under the lock to avoid the race. Reported-by: Rafael J. Wysocki Fixes: bc3a9d217755 ("ipmi:si: Gracefully handle if the BMC is non-functional") Cc: stable@vger.kernel.org # 4.18 Signed-off-by: Corey Minyard Reviewed-by: Rafael J. Wysocki (Intel) commit 62cd145453d577113f993efd025f258dd86aa183 Author: Corey Minyard Date: Thu Feb 12 21:56:54 2026 -0600 ipmi:msghandler: Handle error returns from the SMI sender It used to be, until recently, that the sender operation on the low level interfaces would not fail. That's not the case any more with recent changes. So check the return value from the sender operation, and propagate it back up from there and handle the errors in all places. Reported-by: Rafael J. Wysocki Fixes: bc3a9d217755 ("ipmi:si: Gracefully handle if the BMC is non-functional") Cc: stable@vger.kernel.org # 4.18 Signed-off-by: Corey Minyard Reviewed-by: Rafael J. Wysocki (Intel) commit f895e5df80316a308c2f7d64d13a78494630ea05 Author: Corey Minyard Date: Thu Feb 12 21:52:48 2026 -0600 ipmi:si: Don't block module unload if the BMC is messed up If the BMC is in a bad state, don't bother waiting for queues messages since there can't be any. Otherwise the unload is blocked until the BMC is back in a good state. Reported-by: Rafael J. Wysocki Fixes: bc3a9d217755 ("ipmi:si: Gracefully handle if the BMC is non-functional") Cc: stable@vger.kernel.org # 4.18 Signed-off-by: Corey Minyard Reviewed-by: Rafael J. Wysocki (Intel) commit 4b73231b2a61c4142a027613d277a19c484dfcc3 Author: Yufan Chen Date: Sun Feb 22 18:40:35 2026 +0800 regulator: tps65185: check devm_kzalloc() result in probe tps65185_probe() dereferences the allocation result immediately by using data->regmap. If devm_kzalloc() returns NULL under memory pressure, this leads to a NULL pointer dereference. Add the missing allocation check and return -ENOMEM on failure. Signed-off-by: Yufan Chen Link: https://patch.msgid.link/20260222104035.90790-1-ericterminal@gmail.com Signed-off-by: Mark Brown commit 32fc4168fa56f6301d858c778a3d712774e9657e Author: Azamat Almazbek uulu Date: Sat Feb 21 12:48:13 2026 +0100 ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table The ASUS ExpertBook BM1503CDA (Ryzen 5 7535U, Barcelo-R) has an internal DMIC connected through the AMD ACP (Audio CoProcessor) but is missing from the DMI quirk table, so the acp6x machine driver probe returns -ENODEV and no DMIC capture device is created. Add the DMI entry so the internal microphone works out of the box. Signed-off-by: Azamat Almazbek uulu Reviewed-by: Vijendar Mukunda Link: https://patch.msgid.link/20260221114813.5610-1-almazbek1608@gmail.com Signed-off-by: Mark Brown commit 37da69dbaa60a778ffa67a066b77d287d704c659 Author: Denis Benato Date: Wed Feb 11 22:26:59 2026 +0100 platform/x86: asus-armoury: add support for G733QS Add TDP data for laptop model G733QS. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260211212659.16542-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 857f5036f8fd729e097efbe3ba421b75e27346cb Author: Peter Metz Date: Fri Feb 13 17:58:02 2026 -0500 platform/x86: intel-hid: Add Dell 16 Plus 2-in-1 to dmi_vgbs_allow_list The Dell 16 Plus 2-in-1 (model DB06250) requires the VGBS allow list entry to correctly enable the tablet mode switch. Without this, the chassis state is not reported, and the hinge rotation only emits unknown scancodes. Link: https://lore.kernel.org/platform-driver-x86/CAP3yi-BWm0LqkhfzTrGy5n-KQ=3+T8eRMoR+Z+7Ke2VJB43kTA@mail.gmail.com/ Signed-off-by: Peter Metz Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260213230310.299974-1-peter.metz@unarin.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6b3fa0615cd8432148581de62a52f83847af3d70 Author: Peter Metz Date: Thu Feb 12 23:46:27 2026 -0500 platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list The Dell 14 Plus 2-in-1 (model DB04250) requires the VGBS allow list entry to correctly enable the tablet mode switch. Without this, the chassis state is not reported, and the hinge rotation only emits unknown scancodes. Verified on Dell 14 Plus 2-in-1 DB04250. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221090 Signed-off-by: Peter Metz Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260213044627.203638-1-peter.metz@unarin.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 53e977b1d50c46f2c4ec3865cd13a822f58ad3cd Author: Jonathan Teh Date: Mon Feb 16 01:01:29 2026 +0000 platform/x86: thinkpad_acpi: Fix errors reading battery thresholds Check whether the battery supports the relevant charge threshold before reading the value to silence these errors: thinkpad_acpi: acpi_evalf(BCTG, dd, ...) failed: AE_NOT_FOUND ACPI: \_SB_.PCI0.LPC_.EC__.HKEY: BCTG: evaluate failed thinkpad_acpi: acpi_evalf(BCSG, dd, ...) failed: AE_NOT_FOUND ACPI: \_SB_.PCI0.LPC_.EC__.HKEY: BCSG: evaluate failed when reading the charge thresholds via sysfs on platforms that do not support them such as the ThinkPad T400. Fixes: 2801b9683f74 ("thinkpad_acpi: Add support for battery thresholds") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=202619 Signed-off-by: Jonathan Teh Reviewed-by: Mark Pearson Link: https://patch.msgid.link/MI0P293MB01967B206E1CA6F337EBFB12926CA@MI0P293MB0196.ITAP293.PROD.OUTLOOK.COM Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 13fa3aaf02edaad9b41fc61d7f6326d2b6a4bf80 Author: Krishna Chomal Date: Mon Feb 16 12:50:03 2026 +0530 platform/x86: hp-wmi: Add Omen 16-wf0xxx fan and thermal support The HP Omen 16-wf0xxx (board ID: 8BAB) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile (similar to HP Omen 16-wf1xxx, board ID: 8C78). Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_thermal_params. Testing on HP Omen 16-wf0xxx confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Suggested-by: Noah Provenzano Tested-by: Juan Martin Morales Reported-by: Juan Martin Morales Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220639 Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260216072003.90151-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7d87ed70fc95482c12edf9493c249b6413be485e Author: Hans de Goede Date: Tue Feb 17 14:23:46 2026 +0100 platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 The touchscreen on the SUPI S10 tablet reports inverted Y coordinates, causing touch input to be mirrored vertically relative to the display. Add a quirk to set the "touchscreen-inverted-y" boolean device-property on the touchscreen device, so that the goodix_ts driver will fixup the coordinates. Reported-by: Yajat Kumar Closes: https://lore.kernel.org/linux-input/20251230221639.582406-1-yajatapps3@gmail.com/ Tested-by: Yajat Kumar Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20260217132346.34535-1-johannes.goede@oss.qualcomm.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3c99a545b372c77b5d39715968a141f523eccbf2 Author: Krishna Chomal Date: Wed Feb 18 10:32:35 2026 +0530 platform/x86: hp-wmi: Add Omen 16-xd0xxx fan and thermal support The HP Omen 16-xd0xxx (board ID: 8BCD) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile (similar to HP Omen 16-wf1xxx, board ID: 8C78). Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_thermal_params. Testing on HP Omen 16-xd0xxx confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Varad Amol Pisale Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260218050235.94687-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3f4e403304186d79fddace860360540fc3af97f9 Author: Chen Ni Date: Mon Feb 9 09:59:04 2026 +0800 soc: fsl: cpm1: qmc: Fix error check for devm_ioremap_resource() in qmc_qe_init_resources() Fix wrong variable used for error checking after devm_ioremap_resource() call. The function checks qmc->scc_pram instead of qmc->dpram, which could lead to incorrect error handling. Fixes: eb680d563089 ("soc: fsl: cpm1: qmc: Add support for QUICC Engine (QE) implementation") Signed-off-by: Chen Ni Acked-by: Herve Codina Link: https://lore.kernel.org/r/20260209015904.871269-1-nichen@iscas.ac.cn Signed-off-by: Christophe Leroy (CS GROUP) commit 014077044e874e270ec480515edbc1cadb976cf2 Author: Richard Genoud Date: Tue Dec 23 08:25:49 2025 +0100 soc: fsl: qbman: fix race condition in qman_destroy_fq When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between fq_table[fq->idx] state and freeing/allocating from the pool and WARN_ON(fq_table[fq->idx]) in qman_create_fq() gets triggered. Indeed, we can have: Thread A Thread B qman_destroy_fq() qman_create_fq() qman_release_fqid() qman_shutdown_fq() gen_pool_free() -- At this point, the fqid is available again -- qman_alloc_fqid() -- so, we can get the just-freed fqid in thread B -- fq->fqid = fqid; fq->idx = fqid * 2; WARN_ON(fq_table[fq->idx]); fq_table[fq->idx] = fq; fq_table[fq->idx] = NULL; And adding some logs between qman_release_fqid() and fq_table[fq->idx] = NULL makes the WARN_ON() trigger a lot more. To prevent that, ensure that fq_table[fq->idx] is set to NULL before gen_pool_free() is called by using smp_wmb(). Fixes: c535e923bb97 ("soc/fsl: Introduce DPAA 1.x QMan device driver") Signed-off-by: Richard Genoud Tested-by: CHAMPSEIX Thomas Link: https://lore.kernel.org/r/20251223072549.397625-1-richard.genoud@bootlin.com Signed-off-by: Christophe Leroy (CS GROUP) commit 3afd8df024339c7da1a5a0302f3987866dd16e40 Author: Rafael J. Wysocki Date: Mon Dec 22 21:36:25 2025 +0100 PM: runtime: Change pm_runtime_put() return type to void The primary role of pm_runtime_put() is to decrement the runtime PM usage counter of the given device. It always does that regardless of the value returned by it later. In addition, if the runtime PM usage counter after decrementation turns out to be zero, a work item is queued up to check whether or not the device can be suspended. This is not guaranteed to succeed though and even if it is successful, the device may still not be suspended going forward. There are multiple valid reasons why pm_runtime_put() may not decide to queue up the work item mentioned above, including, but not limited to, the case when user space has written "on" to the device's runtime PM "control" file in sysfs. In all of those cases, pm_runtime_put() returns a negative error code (even though the device's runtime PM usage counter has been successfully decremented by it) which is very confusing. In fact, its return value should only be used for debug purposes and care should be taken when doing it even in that case. Accordingly, to avoid the confusion mentioned above, change the return type of pm_runtime_put() to void. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Reviewed-by: Brian Norris Link: https://patch.msgid.link/14387202.RDIVbhacDa@rafael.j.wysocki commit 7a73801fdaf8aee90d23ba77976082a48d156a21 Author: Rafael J. Wysocki Date: Mon Dec 22 21:29:41 2025 +0100 pmdomain: imx: gpcv2: Discard pm_runtime_put() return value Passing pm_runtime_put() return value to the callers is not particularly useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. Accordingly, update imx_pgc_domain_suspend() to simply discard the return value of pm_runtime_put() and always return success to the caller. This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki Acked-by: Peng Fan Acked-by: Ulf Hansson Link: https://patch.msgid.link/15658107.tv2OnDr8pf@rafael.j.wysocki commit 901084c51a0a8fb42a3f37d2e9c62083c495f824 Author: Penghe Geng Date: Thu Feb 19 15:29:54 2026 -0500 mmc: core: Avoid bitfield RMW for claim/retune flags Move claimed and retune control flags out of the bitfield word to avoid unrelated RMW side effects in asynchronous contexts. The host->claimed bit shared a word with retune flags. Writes to claimed in __mmc_claim_host() or retune_now in mmc_mq_queue_rq() can overwrite other bits when concurrent updates happen in other contexts, triggering spurious WARN_ON(!host->claimed). Convert claimed, can_retune, retune_now and retune_paused to bool to remove shared-word coupling. Fixes: 6c0cedd1ef952 ("mmc: core: Introduce host claiming by context") Fixes: 1e8e55b67030c ("mmc: block: Add CQE support") Cc: stable@vger.kernel.org Suggested-by: Adrian Hunter Signed-off-by: Penghe Geng Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 6510e1324bcdc8caf21f6d17efe27604c48f0d64 Author: Charles Keepax Date: Mon Feb 23 09:36:16 2026 +0000 ASoC: cs42l43: Report insert for exotic peripherals For some exotic peripherals the type detect can return a reserved value of 0x4. This will currently return an error and not report anything to user-space, update this to report the insert normally. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260223093616.3800350-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 162d331d833dc73a3e905a24c44dd33732af1fc5 Author: Ariel Silver Date: Fri Feb 20 10:11:29 2026 +0000 wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds write. Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element") Reported-by: Ariel Silver Signed-off-by: Ariel Silver Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260220101129.1202657-1-Ariel.Silver@cybereason.com Signed-off-by: Johannes Berg commit 79ad471530e0baef0dce991816013df55e401d9c Author: Kamal Dasu Date: Mon Feb 16 14:15:43 2026 -0500 mmc: sdhci-brcmstb: use correct register offset for V1 pin_sel restore The restore path for SDIO_CFG_CORE_V1 was incorrectly using SDIO_CFG_SD_PIN_SEL (offset 0x44) instead of SDIO_CFG_V1_SD_PIN_SEL (offset 0x54), causing the wrong register to be written on resume. The save path already uses the correct V1-specific offset. This affects BCM7445 and BCM72116 platforms which use the V1 config core. Fixes: b7e614802e3f ("mmc: sdhci-brcmstb: save and restore registers during PM") Signed-off-by: Kamal Dasu Cc: stable@vger.kernel.org Tested-by: Florian Fainelli Reviewed-by: Florian Fainelli Signed-off-by: Ulf Hansson commit 6465a8bbb0f6ad98aeb66dc9ea19c32c193a610b Author: Shawn Lin Date: Fri Jan 16 08:55:30 2026 +0800 mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support RK3576 is the first platform to introduce internal phase support, and subsequent platforms are expected to adopt a similar design. In this architecture, runtime suspend powers off the attached power domain, which resets registers, including vendor-specific ones such as SDMMC_TIMING_CON0, SDMMC_TIMING_CON1, and SDMMC_MISC_CON. These registers must be saved and restored, a requirement that falls outside the scope of the dw_mmc core. Fixes: 59903441f5e4 ("mmc: dw_mmc-rockchip: Add internal phase support") Signed-off-by: Shawn Lin Tested-by: Marco Schirrmeister Reviewed-by: Heiko Stuebner Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit af12e64ae0661546e8b4f5d30d55c5f53a11efe7 Author: Felix Gu Date: Tue Jan 20 22:26:46 2026 +0800 mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In of_get_dml_pipe_index(), it does not release the reference. Fixes: 9cb15142d0e3 ("mmc: mmci: Add qcom dml support to the driver.") Signed-off-by: Felix Gu Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit ec2cceadfae72304ca19650f9cac4b2a97b8a2fc Author: Bartosz Golaszewski Date: Thu Feb 19 10:51:33 2026 +0100 gpiolib: normalize the return value of gc->get() on behalf of buggy drivers Commit 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()") started checking the return value of the .get() callback in struct gpio_chip. Now - almost a year later - it turns out that there are quite a few drivers in tree that can break with this change. Partially revert it: normalize the return value in GPIO core but also emit a warning. Cc: stable@vger.kernel.org Fixes: 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()") Reported-by: Dmitry Torokhov Closes: https://lore.kernel.org/all/aZSkqGTqMp_57qC7@google.com/ Reviewed-by: Linus Walleij Reviewed-by: Dmitry Torokhov Link: https://patch.msgid.link/20260219-gpiolib-set-normalize-v2-1-f84630e45796@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit eb4a7139e97374f42b7242cc754e77f1623fbcd5 Author: Jouni Högander Date: Thu Feb 12 08:27:31 2026 +0200 drm/i915/alpm: ALPM disable fixes PORT_ALPM_CTL is supposed to be written only before link training. Remove writing it from ALPM disable. Also clearing ALPM_CTL_ALPM_AUX_LESS_ENABLE and is not about disabling ALPM but switching to AUX-Wake ALPM. Stop touching this bit on ALPM disable. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7153 Fixes: 1ccbf135862b ("drm/i915/psr: Enable ALPM on source side for eDP Panel replay") Cc: Animesh Manna Cc: Jani Nikula Cc: # v6.10+ Signed-off-by: Jouni Högander Reviewed-by: Michał Grzelak Link: https://patch.msgid.link/20260212062731.397801-1-jouni.hogander@intel.com (cherry picked from commit 008304c9ae75c772d3460040de56e12112cdf5e6) Signed-off-by: Joonas Lahtinen commit 77de62ad3de3967818c3dbe656b7336ebee461d2 Author: Haocheng Yu Date: Tue Feb 3 00:20:56 2026 +0800 perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a refcount_t: addition on 0; use-after-free warning in perf_mmap. The issue is caused by a race condition between a failing mmap() setup and a concurrent mmap() on a dependent event (e.g., using output redirection). In perf_mmap(), the ring_buffer (rb) is allocated and assigned to event->rb with the mmap_mutex held. The mutex is then released to perform map_range(). If map_range() fails, perf_mmap_close() is called to clean up. However, since the mutex was dropped, another thread attaching to this event (via inherited events or output redirection) can acquire the mutex, observe the valid event->rb pointer, and attempt to increment its reference count. If the cleanup path has already dropped the reference count to zero, this results in a use-after-free or refcount saturation warning. Fix this by extending the scope of mmap_mutex to cover the map_range() call. This ensures that the ring buffer initialization and mapping (or cleanup on failure) happens atomically effectively, preventing other threads from accessing a half-initialized or dying ring buffer. Closes: https://lore.kernel.org/oe-kbuild-all/202602020208.m7KIjdzW-lkp@intel.com/ Reported-by: kernel test robot Signed-off-by: Haocheng Yu Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260202162057.7237-1-yuhaocheng035@gmail.com commit 6a8a48644c4b804123e59dbfc5d6cd29a0194046 Author: Zide Chen Date: Mon Feb 9 16:52:25 2026 -0800 perf/x86/intel/uncore: Add per-scheduler IMC CAS count events IMC on SPR and EMR does not support sub-channels. In contrast, CPUs that use gnr_uncores[] (e.g. Granite Rapids and Sierra Forest) implement two command schedulers (SCH0/SCH1) per memory channel, providing logically independent command and data paths. Do not reuse the spr_uncore_imc[] configuration for these CPUs. Instead, introduce a dedicated gnr_uncore_imc[] with per-scheduler events, so userspace can monitor SCH0 and SCH1 independently. On these CPUs, replace cas_count_{read,write} with cas_count_{read,write}_sch{0,1}. This may break existing userspace that relies on cas_count_{read,write}, prompting it to switch to the per-scheduler events, as the legacy event reports only partial traffic (SCH0). Fixes: 632c4bf6d007 ("perf/x86/intel/uncore: Support Granite Rapids") Fixes: cb4a6ccf3583 ("perf/x86/intel/uncore: Support Sierra Forest and Grand Ridge") Reported-by: Reinette Chatre Signed-off-by: Zide Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260210005225.20311-1-zide.chen@intel.com commit 486ff5ad49bc50315bcaf6d45f04a33ef0a45ced Author: Namhyung Kim Date: Mon Jun 2 21:51:05 2025 -0700 perf/core: Fix invalid wait context in ctx_sched_in() Lockdep found a bug in the event scheduling when a pinned event was failed and wakes up the threads in the ring buffer like below. It seems it should not grab a wait-queue lock under perf-context lock. Let's do it with irq_work. [ 39.913691] ============================= [ 39.914157] [ BUG: Invalid wait context ] [ 39.914623] 6.15.0-next-20250530-next-2025053 #1 Not tainted [ 39.915271] ----------------------------- [ 39.915731] repro/837 is trying to lock: [ 39.916191] ffff88801acfabd8 (&event->waitq){....}-{3:3}, at: __wake_up+0x26/0x60 [ 39.917182] other info that might help us debug this: [ 39.917761] context-{5:5} [ 39.918079] 4 locks held by repro/837: [ 39.918530] #0: ffffffff8725cd00 (rcu_read_lock){....}-{1:3}, at: __perf_event_task_sched_in+0xd1/0xbc0 [ 39.919612] #1: ffff88806ca3c6f8 (&cpuctx_lock){....}-{2:2}, at: __perf_event_task_sched_in+0x1a7/0xbc0 [ 39.920748] #2: ffff88800d91fc18 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_in+0x1f9/0xbc0 [ 39.921819] #3: ffffffff8725cd00 (rcu_read_lock){....}-{1:3}, at: perf_event_wakeup+0x6c/0x470 Fixes: f4b07fd62d4d ("perf/core: Use POLLHUP for a pinned event in error") Closes: https://lore.kernel.org/lkml/aD2w50VDvGIH95Pf@ly-workstation Reported-by: "Lai, Yi" Signed-off-by: Namhyung Kim Signed-off-by: Peter Zijlstra (Intel) Tested-by: "Lai, Yi" Link: https://patch.msgid.link/20250603045105.1731451-1-namhyung@kernel.org commit 3b68df978133ac3d46d570af065a73debbb68248 Author: Mathieu Desnoyers Date: Fri Feb 20 15:06:41 2026 -0500 rseq: slice ext: Ensure rseq feature size differs from original rseq size Before rseq became extensible, its original size was 32 bytes even though the active rseq area was only 20 bytes. This had the following impact in terms of userspace ecosystem evolution: * The GNU libc between 2.35 and 2.39 expose a __rseq_size symbol set to 32, even though the size of the active rseq area is really 20. * The GNU libc 2.40 changes this __rseq_size to 20, thus making it express the active rseq area. * Starting from glibc 2.41, __rseq_size corresponds to the AT_RSEQ_FEATURE_SIZE from getauxval(3). This means that users of __rseq_size can always expect it to correspond to the active rseq area, except for the value 32, for which the active rseq area is 20 bytes. Exposing a 32 bytes feature size would make life needlessly painful for userspace. Therefore, add a reserved field at the end of the rseq area to bump the feature size to 33 bytes. This reserved field is expected to be replaced with whatever field will come next, expecting that this field will be larger than 1 byte. The effect of this change is to increase the size from 32 to 64 bytes before we actually have fields using that memory. Clarify the allocation size and alignment requirements in the struct rseq uapi comment. Change the value returned by getauxval(AT_RSEQ_ALIGN) to return the value of the active rseq area size rounded up to next power of 2, which guarantees that the rseq structure will always be aligned on the nearest power of two large enough to contain it, even as it grows. Change the alignment check in the rseq registration accordingly. This will minimize the amount of ABI corner-cases we need to document and require userspace to play games with. The rule stays simple when __rseq_size != 32: #define rseq_field_available(field) (__rseq_size >= offsetofend(struct rseq_abi, field)) Signed-off-by: Mathieu Desnoyers Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260220200642.1317826-3-mathieu.desnoyers@efficios.com commit 26d43a90be81fc90e26688a51d3ec83188602731 Author: Mathieu Desnoyers Date: Fri Feb 20 15:06:40 2026 -0500 rseq: Clarify rseq registration rseq_size bound check comment The rseq registration validates that the rseq_size argument is greater or equal to 32 (the original rseq size), but the comment associated with this check does not clearly state this. Clarify the comment to that effect. Fixes: ee3e3ac05c26 ("rseq: Introduce extensible rseq ABI") Signed-off-by: Mathieu Desnoyers Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260220200642.1317826-2-mathieu.desnoyers@efficios.com commit 5324953c06bd929c135d9e04be391ee2c11b5a19 Author: Peter Zijlstra Date: Wed Feb 18 17:33:29 2026 +0100 sched/core: Fix wakeup_preempt's next_class tracking Kernel test robot reported that tools/testing/selftests/kvm/hardware_disable_test was failing due to commit 704069649b5b ("sched/core: Rework sched_class::wakeup_preempt() and rq_modified_*()") It turns out there were two related problems that could lead to a missed preemption: - when hitting newidle balance from the idle thread, it would elevate rb->next_class from &idle_sched_class to &fair_sched_class, causing later wakeup_preempt() calls to not hit the sched_class_above() case, and not issue resched_curr(). Notably, this modification pattern should only lower the next_class, and never raise it. Create two new helper functions to wrap this. - when doing schedule_idle(), it was possible to miss (re)setting rq->next_class to &idle_sched_class, leading to the very same problem. Cc: Sean Christopherson Fixes: 704069649b5b ("sched/core: Rework sched_class::wakeup_preempt() and rq_modified_*()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202602122157.4e861298-lkp@intel.com Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260218163329.GQ1395416@noisy.programming.kicks-ass.net commit 4c652a47722f69c6f2685f05b17490ea97f643a8 Author: Arnd Bergmann Date: Fri Feb 6 08:41:13 2026 +0100 rseq: Mark rseq_arm_slice_extension_timer() __always_inline objtool warns about this function being called inside of a uaccess section: kernel/entry/common.o: warning: objtool: irqentry_exit+0x1dc: call to rseq_arm_slice_extension_timer() with UACCESS enabled Interestingly, this happens with CONFIG_RSEQ_SLICE_EXTENSION disabled, so this is an empty function, as the normal implementation is already marked __always_inline. I could reproduce this multiple times with gcc-11 but not with gcc-15, so the compiler probably got better at identifying the trivial function. Mark all the empty helpers for !RSEQ_SLICE_EXTENSION as __always_inline for consistency, avoiding this warning. Fixes: 0ac3b5c3dc45 ("rseq: Implement time slice extension enforcement timer") Signed-off-by: Arnd Bergmann Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260206074122.709580-1-arnd@kernel.org commit 6e3c0a4e1ad1e0455b7880fad02b3ee179f56c09 Author: Peter Zijlstra Date: Tue Apr 22 12:16:28 2025 +0200 sched/fair: Fix lag clamp Vincent reported that he was seeing undue lag clamping in a mixed slice workload. Implement the max_slice tracking as per the todo comment. Fixes: 147f3efaa241 ("sched/fair: Implement an EEVDF-like scheduling policy") Reported-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Tested-by: Vincent Guittot Tested-by: K Prateek Nayak Tested-by: Shubhang Kaushik Link: https://patch.msgid.link/20250422101628.GA33555@noisy.programming.kicks-ass.net commit ff38424030f98976150e42ca35f4b00e6ab8fa23 Author: Wang Tao Date: Tue Jan 20 12:31:13 2026 +0000 sched/eevdf: Update se->vprot in reweight_entity() In the EEVDF framework with Run-to-Parity protection, `se->vprot` is an independent variable defining the virtual protection timestamp. When `reweight_entity()` is called (e.g., via nice/renice), it performs the following actions to preserve Lag consistency: 1. Scales `se->vlag` based on the new weight. 2. Calls `place_entity()`, which recalculates `se->vruntime` based on the new weight and scaled lag. However, the current implementation fails to update `se->vprot`, leading to mismatches between the task's actual runtime and its expected duration. Fixes: 63304558ba5d ("sched/eevdf: Curb wakeup-preemption") Suggested-by: Zhang Qiao Signed-off-by: Wang Tao Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Tested-by: K Prateek Nayak Tested-by: Shubhang Kaushik Link: https://patch.msgid.link/20260120123113.3518950-1-wangtao554@huawei.com commit bcd74b2ffdd0a2233adbf26b65c62fc69a809c8e Author: Peter Zijlstra Date: Fri Jan 23 16:49:09 2026 +0100 sched/fair: Only set slice protection at pick time We should not (re)set slice protection in the sched_change pattern which calls put_prev_task() / set_next_task(). Fixes: 63304558ba5d ("sched/eevdf: Curb wakeup-preemption") Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Tested-by: K Prateek Nayak Tested-by: Shubhang Kaushik Link: https://patch.msgid.link/20260219080624.561421378%40infradead.org commit b3d99f43c72b56cf7a104a364e7fb34b0702828b Author: Peter Zijlstra Date: Mon Feb 9 15:28:16 2026 +0100 sched/fair: Fix zero_vruntime tracking It turns out that zero_vruntime tracking is broken when there is but a single task running. Current update paths are through __{en,de}queue_entity(), and when there is but a single task, pick_next_task() will always return that one task, and put_prev_set_next_task() will end up in neither function. This can cause entity_key() to grow indefinitely large and cause overflows, leading to much pain and suffering. Furtermore, doing update_zero_vruntime() from __{de,en}queue_entity(), which are called from {set_next,put_prev}_entity() has problems because: - set_next_entity() calls __dequeue_entity() before it does cfs_rq->curr = se. This means the avg_vruntime() will see the removal but not current, missing the entity for accounting. - put_prev_entity() calls __enqueue_entity() before it does cfs_rq->curr = NULL. This means the avg_vruntime() will see the addition *and* current, leading to double accounting. Both cases are incorrect/inconsistent. Noting that avg_vruntime is already called on each {en,de}queue, remove the explicit avg_vruntime() calls (which removes an extra 64bit division for each {en,de}queue) and have avg_vruntime() update zero_vruntime itself. Additionally, have the tick call avg_vruntime() -- discarding the result, but for the side-effect of updating zero_vruntime. While there, optimize avg_vruntime() by noting that the average of one value is rather trivial to compute. Test case: # taskset -c -p 1 $$ # taskset -c 2 bash -c 'while :; do :; done&' # cat /sys/kernel/debug/sched/debug | awk '/^cpu#/ {P=0} /^cpu#2,/ {P=1} {if (P) print $0}' | grep -e zero_vruntime -e "^>" PRE: .zero_vruntime : 31316.407903 >R bash 487 50787.345112 E 50789.145972 2.800000 50780.298364 16 120 0.000000 0.000000 0.000000 / .zero_vruntime : 382548.253179 >R bash 487 427275.204288 E 427276.003584 2.800000 427268.157540 23 120 0.000000 0.000000 0.000000 / POST: .zero_vruntime : 17259.709467 >R bash 526 17259.709467 E 17262.509467 2.800000 16915.031624 9 120 0.000000 0.000000 0.000000 / .zero_vruntime : 18702.723356 >R bash 526 18702.723356 E 18705.523356 2.800000 18358.045513 9 120 0.000000 0.000000 0.000000 / Fixes: 79f3f9bedd14 ("sched/eevdf: Fix min_vruntime vs avg_vruntime") Reported-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Tested-by: Shubhang Kaushik Link: https://patch.msgid.link/20260219080624.438854780%40infradead.org commit 237dc6a054f6787c2a8f61c59086030267e5e1c5 Author: Thomas Huth Date: Thu Dec 18 19:20:29 2025 +0100 x86/headers: Replace __ASSEMBLY__ stragglers with __ASSEMBLER__ After converting the __ASSEMBLY__ statements to __ASSEMBLER__ in commit 24a295e4ef1ca ("x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-UAPI headers"), some new code has been added that uses __ASSEMBLY__ again. Convert these stragglers, too. This is a mechanical patch, done with a simple "sed -i" command. Signed-off-by: Thomas Huth Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251218182029.166993-1-thuth@redhat.com commit 24c8147abb39618d74fcc36e325765e8fe7bdd7a Author: Peter Zijlstra Date: Wed Feb 11 13:59:43 2026 +0100 x86/cfi: Fix CFI rewrite for odd alignments Rustam reported his clang builds did not boot properly; turns out his .config has: CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y set. Fix up the FineIBT code to deal with this unusual alignment. Fixes: 931ab63664f0 ("x86/ibt: Implement FineIBT") Reported-by: Rustam Kovhaev Signed-off-by: Peter Zijlstra (Intel) Tested-by: Rustam Kovhaev commit a0cb371b521dde44f32cfe954b6ef6f82b407393 Author: Hou Wenlong Date: Sat Jan 10 11:47:37 2026 +0800 x86/bug: Handle __WARN_printf() trap in early_fixup_exception() The commit 5b472b6e5bd9 ("x86_64/bug: Implement __WARN_printf()") implemented __WARN_printf(), which changed the mechanism to use UD1 instead of UD2. However, it only handles the trap in the runtime IDT handler, while the early booting IDT handler lacks this handling. As a result, the usage of WARN() before the runtime IDT setup can lead to kernel crashes. Since KMSAN is enabled after the runtime IDT setup, it is safe to use handle_bug() directly in early_fixup_exception() to address this issue. Fixes: 5b472b6e5bd9 ("x86_64/bug: Implement __WARN_printf()") Signed-off-by: Hou Wenlong Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/c4fb3645f60d3a78629d9870e8fcc8535281c24f.1768016713.git.houwenlong.hwl@antgroup.com commit aa280a08e7d8fae58557acc345b36b3dc329d595 Author: Andrew Cooper Date: Tue Jan 6 13:15:04 2026 +0000 x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to memory predictions. For all practical purposes, this means array_index_nospec() must be used in the expression that accesses the array. As the code currently stands, it's the wrong side of irqentry_enter(), and 'index' is put into %ebp across the function call. Remove the index variable and reposition array_index_nospec(), so it's calculated immediately before the array access. Fixes: 14619d912b65 ("x86/fred: FRED entry/exit and dispatch code") Signed-off-by: Andrew Cooper Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260106131504.679932-1-andrew.cooper3@citrix.com commit 03c0d030f5874eec6ce22750b2b8751d6d4303b5 Author: Hongbo Li Date: Sat Feb 14 03:02:48 2026 +0000 erofs: allow sharing page cache with the same aops only Inode with identical data but different @aops cannot be mixed because the page cache is managed by different subsystems (e.g., @aops for compressed on-disk inodes cannot handle plain on-disk inodes). In this patch, we never allow inodes to share the page cache among plain, compressed, and fileio cases. When a shared inode is created, we initialize @aops that is the same as the initial real inode, and subsequent inodes cannot share the page cache if the inferred @aops differ from the corresponding shared inode. This is reasonable as a first step because, in typical use cases, if an inode is compressible, it will fall into compressed inodes across different filesystem images unless users use plain filesystems. However, in that cases, users will use plain filesystems all the time. Fixes: 5ef3208e3be5 ("erofs: introduce the page cache share feature") Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 32e0a7ad9c841f46549ccac0f1cca347a40d8685 Author: Daniel J Blueman Date: Fri Feb 20 17:34:51 2026 +0800 gpio: shared: fix memory leaks On a Snapdragon X1 Elite laptop (Lenovo Yoga Slim 7x), kmemleak reports three sets of: unreferenced object 0xffff00080187f400 (size 1024): comm "swapper/0", pid 1, jiffies 4294667327 hex dump (first 32 bytes): 58 bd 70 01 08 00 ff ff 58 bd 70 01 08 00 ff ff X.p.....X.p..... 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ backtrace (crc 1665d1f8): kmemleak_alloc+0xf4/0x12c __kmalloc_cache_noprof+0x370/0x49c gpio_shared_make_ref+0x70/0x16c gpio_shared_of_traverse+0x4e8/0x5f4 gpio_shared_of_traverse+0x200/0x5f4 gpio_shared_of_traverse+0x200/0x5f4 gpio_shared_of_traverse+0x200/0x5f4 gpio_shared_of_traverse+0x200/0x5f4 gpio_shared_init+0x34/0x1c4 do_one_initcall+0x50/0x280 kernel_init_freeable+0x290/0x33c kernel_init+0x28/0x14c ret_from_fork+0x10/0x20 unreferenced object 0xffff00080170c140 (size 8): comm "swapper/0", pid 1, jiffies 4294667327 hex dump (first 8 bytes): 72 65 73 65 74 00 00 00 reset... backtrace (crc fc24536): kmemleak_alloc+0xf4/0x12c __kmalloc_node_track_caller_noprof+0x3c4/0x584 kstrdup+0x4c/0xcc gpio_shared_make_ref+0x8c/0x16c gpio_shared_of_traverse+0x4e8/0x5f4 gpio_shared_of_traverse+0x200/0x5f4 gpio_shared_of_traverse+0x200/0x5f4 gpio_shared_of_traverse+0x200/0x5f4 gpio_shared_of_traverse+0x200/0x5f4 gpio_shared_init+0x34/0x1c4 do_one_initcall+0x50/0x280 kernel_init_freeable+0x290/0x33c kernel_init+0x28/0x14c ret_from_fork+0x10/0x20 Fix this by decrementing the reference count of each list entry rather than only the first. Fix verified on the same laptop. Fixes: a060b8c511abb gpiolib: implement low-level, shared GPIO support Signed-off-by: Daniel J Blueman Link: https://patch.msgid.link/20260220093452.101655-1-daniel@quora.org Signed-off-by: Bartosz Golaszewski commit 09a30b7a035f9f4ac918c8a9af89d70e43462152 Author: Maulik Shah Date: Mon Feb 9 09:33:44 2026 +0530 pinctrl: qcom: qcs615: Add missing dual edge GPIO IRQ errata flag Wakeup capable GPIOs uses PDC as parent IRQ chip and PDC on qcs615 do not support dual edge IRQs. Add missing wakeirq_dual_edge_errata configuration to enable workaround for dual edge GPIO IRQs. Fixes: b698f36a9d40 ("pinctrl: qcom: add the tlmm driver for QCS615 platform") Signed-off-by: Maulik Shah Reviewed-by: Dmitry Baryshkov Signed-off-by: Linus Walleij commit 3e00b1b332e54ba50cca6691f628b9c06574024f Author: Florian Eckert Date: Thu Feb 5 13:55:46 2026 +0100 pinctrl: equilibrium: fix warning trace on load The callback functions 'eqbr_irq_mask()' and 'eqbr_irq_ack()' are also called in the callback function 'eqbr_irq_mask_ack()'. This is done to avoid source code duplication. The problem, is that in the function 'eqbr_irq_mask()' also calles the gpiolib function 'gpiochip_disable_irq()' This generates the following warning trace in the log for every gpio on load. [ 6.088111] ------------[ cut here ]------------ [ 6.092440] WARNING: CPU: 3 PID: 1 at drivers/gpio/gpiolib.c:3810 gpiochip_disable_irq+0x39/0x50 [ 6.097847] Modules linked in: [ 6.097847] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.12.59+ #0 [ 6.097847] Tainted: [W]=WARN [ 6.097847] RIP: 0010:gpiochip_disable_irq+0x39/0x50 [ 6.097847] Code: 39 c6 48 19 c0 21 c6 48 c1 e6 05 48 03 b2 38 03 00 00 48 81 fe 00 f0 ff ff 77 11 48 8b 46 08 f6 c4 02 74 06 f0 80 66 09 fb c3 <0f> 0b 90 0f 1f 40 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 [ 6.097847] RSP: 0000:ffffc9000000b830 EFLAGS: 00010046 [ 6.097847] RAX: 0000000000000045 RBX: ffff888001be02a0 RCX: 0000000000000008 [ 6.097847] RDX: ffff888001be9000 RSI: ffff888001b2dd00 RDI: ffff888001be02a0 [ 6.097847] RBP: ffffc9000000b860 R08: 0000000000000000 R09: 0000000000000000 [ 6.097847] R10: 0000000000000001 R11: ffff888001b2a154 R12: ffff888001be0514 [ 6.097847] R13: ffff888001be02a0 R14: 0000000000000008 R15: 0000000000000000 [ 6.097847] FS: 0000000000000000(0000) GS:ffff888041d80000(0000) knlGS:0000000000000000 [ 6.097847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.097847] CR2: 0000000000000000 CR3: 0000000003030000 CR4: 00000000001026b0 [ 6.097847] Call Trace: [ 6.097847] [ 6.097847] ? eqbr_irq_mask+0x63/0x70 [ 6.097847] ? no_action+0x10/0x10 [ 6.097847] eqbr_irq_mask_ack+0x11/0x60 In an other driver (drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c) the interrupt is not disabled here. To fix this, do not call the 'eqbr_irq_mask()' and 'eqbr_irq_ack()' function. Implement instead this directly without disabling the interrupts. Fixes: 52066a53bd11 ("pinctrl: equilibrium: Convert to immutable irq_chip") Signed-off-by: Florian Eckert Signed-off-by: Linus Walleij commit 1f96b84835eafb3e6f366dc3a66c0e69504cec9d Author: Florian Eckert Date: Thu Feb 5 13:55:45 2026 +0100 pinctrl: equilibrium: rename irq_chip function callbacks Renaming of the irq_chip callback functions to improve clarity. Signed-off-by: Florian Eckert Signed-off-by: Linus Walleij commit c17ee635fd3a482b2ad2bf5e269755c2eae5f25e Merge: 803ec1faf7c182 6de23f81a5e08b Author: Maxime Ripard Date: Mon Feb 23 10:09:45 2026 +0100 Merge drm/drm-fixes into drm-misc-fixes 7.0-rc1 was just released, let's merge it to kick the new release cycle. Signed-off-by: Maxime Ripard commit 0d58273be0b9c3cec3be5488ca37f6ddbaf13cf0 Author: Geoffrey D. Bennett Date: Sat Feb 21 02:36:56 2026 +1030 ALSA: usb-audio: Skip clock selector for Focusrite devices Add QUIRK_FLAG_SKIP_CLOCK_SELECTOR for Focusrite devices. During interface parsing, snd_usb_clock_find_source() reads the clock selector value then writes it back unchanged. On Focusrite devices this redundant write results in a ~300ms delay per altsetting, adding ~1.8s to probe time on a typical device with 6 altsettings. Enabling SKIP_CLOCK_SELECTOR skips the redundant write-back. Signed-off-by: Geoffrey D. Bennett Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/00e53ae0a508b41516b41833daa17823381a649c.1771594828.git.g@b4.vu commit 38c322068a26a01d7ff64da92179e68cdde9860b Author: Geoffrey D. Bennett Date: Sat Feb 21 02:36:35 2026 +1030 ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP Add a quirk flag to skip the usb_set_interface(), snd_usb_init_pitch(), and snd_usb_init_sample_rate() calls in __snd_usb_parse_audio_interface(). These are redundant with snd_usb_endpoint_prepare() at stream-open time. Enable the quirk for Focusrite devices, as init_sample_rate(rate_max) sets 192kHz during probing, which disables the internal mixer and Air and Safe modes. Fixes: 16f1f838442d ("Revert "ALSA: usb-audio: Drop superfluous interface setup at parsing"") Signed-off-by: Geoffrey D. Bennett Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/65a7909b15f9feb76c2a6f4f8814c240ddc50737.1771594828.git.g@b4.vu commit a8cc55bf81a45772cad44c83ea7bb0e98431094a Author: Geoffrey D. Bennett Date: Sat Feb 21 02:34:48 2026 +1030 ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices Remove QUIRK_FLAG_VALIDATE_RATES for Focusrite. With the previous commit, focusrite_valid_sample_rate() produces correct rate tables without USB probing. QUIRK_FLAG_VALIDATE_RATES sends SET_CUR requests for each rate (~25ms each) and leaves the device at 192kHz. This is a problem because that rate: 1) disables the internal mixer, so outputs are silent until an application opens the PCM and sets a lower rate, and 2) the Air and Safe modes get disabled. Fixes: 5963e5262180 ("ALSA: usb-audio: Enable rate validation for Scarlett devices") Signed-off-by: Geoffrey D. Bennett Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/09b9c012024c998c4ca14bd876ef0dce0d0b6101.1771594828.git.g@b4.vu commit 24d2d3c5f94007a5a0554065ab7349bb69e28bcb Author: Geoffrey D. Bennett Date: Sat Feb 21 02:33:45 2026 +1030 ALSA: usb-audio: Improve Focusrite sample rate filtering Replace the bLength == 10 max_rate check in focusrite_valid_sample_rate() with filtering that also examines the bmControls VAL_ALT_SETTINGS bit. When VAL_ALT_SETTINGS is readable, the device uses strict per-altsetting rate filtering (only the highest rate pair for that altsetting is valid). When it is not readable, all rates up to max_rate are valid. For devices without the bLength == 10 Format Type descriptor extension but with VAL_ALT_SETTINGS readable and multiple altsettings (only seen in Scarlett 18i8 3rd Gen playback), fall back to the Focusrite convention: alt 1 = 48kHz, alt 2 = 96kHz, alt 3 = 192kHz. This produces correct rate tables for all tested Focusrite devices (all Scarlett 2nd, 3rd, and 4th Gen, Clarett+, and Vocaster) using only USB descriptors, allowing QUIRK_FLAG_VALIDATE_RATES to be removed for Focusrite in the next commit. Signed-off-by: Geoffrey D. Bennett Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/7e18c1f393a6ecb6fc75dd867a2c4dbe135e3e22.1771594828.git.g@b4.vu commit 9fb16a5c5ff93058851099a2b80a899b0c53fe3f Author: Juhyung Park Date: Sun Feb 22 21:26:09 2026 +0900 ALSA: hda/realtek: add quirk for Samsung Galaxy Book Flex (NT950QCT-A38A) Similar to other Samsung laptops, NT950QCT also requires the ALC298_FIXUP_SAMSUNG_AMP quirk applied. Cc: Signed-off-by: Juhyung Park Link: https://patch.msgid.link/20260222122609.281191-2-qkrwngud825@gmail.com Signed-off-by: Takashi Iwai commit 43a44fb7f2fa163926b23149805e989ba2395db1 Author: Juhyung Park Date: Sun Feb 22 21:26:08 2026 +0900 ALSA: hda/realtek: fix model name typo for Samsung Galaxy Book Flex (NT950QCG-X716) There's no product named "Samsung Galaxy Flex Book". Use the correct "Samsung Galaxy Book Flex" name. Link: https://www.samsung.com/sec/support/model/NT950QCG-X716 Link: https://www.samsung.com/us/computing/galaxy-books/galaxy-book-flex/galaxy-book-flex-15-6-qled-512gb-storage-s-pen-included-np950qcg-k01us Cc: Signed-off-by: Juhyung Park Link: https://patch.msgid.link/20260222122609.281191-1-qkrwngud825@gmail.com Signed-off-by: Takashi Iwai commit cbddd303416456db5ceeedaf9e262096f079e861 Author: Panagiotis Foliadis Date: Sat Feb 21 19:40:58 2026 +0000 ALSA: hda/realtek: Add quirk for Acer Aspire V3-572G The Acer Aspire V3-572G has a combo jack (ALC283) but the BIOS sets pin 0x19 to 0x411111f0 (not connected), so the headset mic is not detected. Add a quirk to override pin 0x19 as a headset mic and enable headset mode. Cc: stable@vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221075 Suggested-by: Charalampos Mitrodimas Signed-off-by: Panagiotis Foliadis Reviewed-by: Charalampos Mitrodimas Link: https://patch.msgid.link/20260221-fix-detect-mic-v1-1-b6e427b5275d@posteo.net Signed-off-by: Takashi Iwai commit 1d241483368f2fd87fbaba64d6aec6bad3a1e12e Author: Geoffrey D. Bennett Date: Fri Feb 20 21:58:48 2026 +1030 ALSA: scarlett2: Fix DSP filter control array handling scarlett2_add_dsp_ctls() was incorrectly storing the precomp and PEQ filter coefficient control pointers into the precomp_flt_switch_ctls and peq_flt_switch_ctls arrays instead of the intended targets precomp_flt_ctls and peq_flt_ctls. Pass NULL instead, as the filter coefficient control pointers are not used, and remove the unused precomp_flt_ctls and peq_flt_ctls arrays from struct scarlett2_data. Additionally, scarlett2_update_filter_values() was reading dsp_input_count * peq_flt_count values for SCARLETT2_CONFIG_PEQ_FLT_SWITCH, but the peq_flt_switch array is indexed only by dsp_input_count (one switch per DSP input, not per filter). Fix the read count. Fixes: b64678eb4e70 ("ALSA: scarlett2: Add DSP controls") Signed-off-by: Geoffrey D. Bennett Link: https://patch.msgid.link/86497b71db060677d97c38a6ce5f89bb3b25361b.1771581197.git.g@b4.vu Signed-off-by: Takashi Iwai commit 1cb3c20688fc8380c9b365d03aea7e84faf6a9fd Author: Sean Rhodes Date: Thu Feb 19 20:14:26 2026 +0000 ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter On Star Labs StarFighter (Realtek ALC233/235), the internal speakers can emit an audible pop when entering or leaving runtime suspend. Mute the speaker output paths via snd_hda_gen_shutup_speakers() in the Realtek shutup callback before the codec is powered down. This is enough to avoid the pop without special EAPD handling. Test results: - runtime PM pop fixed - still reaches D3 (PCI 0000:00:1f.3 power_state=D3hot) - does not address pops on cold boot (G3 exit) or around display manager start/shutdown journalctl -k (boot): - snd_hda_codec_alc269 hdaudioC0D0: ALC233: picked fixup for PCI SSID 7017:2014 - snd_hda_codec_alc269 hdaudioC0D0: autoconfig for ALC233: line_outs=1 (0x1b/0x0/0x0/0x0/0x0) type:speaker Suggested-by: Takashi Iwai Tested-by: Sean Rhodes Signed-off-by: Sean Rhodes Link: https://patch.msgid.link/4d5fb71b132bb283fd41c622b8413770b2065242.1771532060.git.sean@starlabs.systems Signed-off-by: Takashi Iwai commit 2259d14499d16b115ef8d5d2ddc867e2be7cb5b5 Author: Ramanathan Choodamani Date: Thu Feb 5 15:12:16 2026 +0530 wifi: mac80211: set default WMM parameters on all links Currently, mac80211 only initializes default WMM parameters on the deflink during do_open(). For MLO cases, this leaves the additional links without proper WMM defaults if hostapd does not supply per-link WMM parameters, leading to inconsistent QoS behavior across links. Set default WMM parameters for each link during ieee80211_vif_update_links(), because this ensures all individual links in an MLD have valid WMM settings during bring-up and behave consistently across different BSS. Signed-off-by: Ramanathan Choodamani Signed-off-by: Aishwarya R Link: https://patch.msgid.link/20260205094216.3093542-1-aishwarya.r@oss.qualcomm.com Signed-off-by: Johannes Berg commit 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 Author: Daniel Hodges Date: Fri Feb 6 14:53:56 2026 -0500 wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If a timer callback is executing when lbs_free_adapter() is called, the callback will access freed memory since lbs_cfg_free() frees the containing structure immediately after lbs_free_adapter() returns. Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler) access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields, which would all be use-after-free violations. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning. This bug was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where del_timer() was used instead of del_timer_sync() in the cleanup path. The command_timer has had the same issue since the driver was first written. Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware") Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence") Cc: stable@vger.kernel.org Signed-off-by: Daniel Hodges Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev Signed-off-by: Johannes Berg commit 25723454f67980712234a42caca606b6710fd1e1 Author: Chen-Yu Tsai Date: Tue Feb 10 18:03:34 2026 +0800 wifi: mwifiex: Fix dev_alloc_name() return value check dev_alloc_name() returns the allocated ID on success, which could be over 0. Fix the return value check to check for negative error codes. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aYmsQfujoAe5qO02@stanley.mountain/ Fixes: 7bab5bdb81e3 ("wifi: mwifiex: Allocate dev name earlier for interface workqueue name") Signed-off-by: Chen-Yu Tsai Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/20260210100337.1131279-1-wenst@chromium.org Signed-off-by: Johannes Berg commit 9990cd4f8827bd1ae3fb6eb7407630d8d463c430 Author: Radu Sabau Date: Fri Feb 20 16:16:41 2026 +0200 iio: imu: adis: Fix NULL pointer dereference in adis_init The adis_init() function dereferences adis->ops to check if the individual function pointers (write, read, reset) are NULL, but does not first check if adis->ops itself is NULL. Drivers like adis16480, adis16490, adis16545 and others do not set custom ops and rely on adis_init() assigning the defaults. Since struct adis is zero-initialized by devm_iio_device_alloc(), adis->ops is NULL when adis_init() is called, causing a NULL pointer dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : adis_init+0xc0/0x118 Call trace: adis_init+0xc0/0x118 adis16480_probe+0xe0/0x670 Fix this by checking if adis->ops is NULL before dereferencing it, falling through to assign the default ops in that case. Fixes: 3b29bcee8f6f ("iio: imu: adis: Add custom ops struct") Signed-off-by: Radu Sabau Reviewed-by: Andy Shevchenko Reviewed-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit 2617595538be8a2f270ad13fccb9f56007b292d7 Author: Jean-Baptiste Maneyrol Date: Tue Feb 17 11:44:50 2026 +0100 iio: imu: inv_icm45600: fix regulator put warning when probe fails When the driver probe fails we encounter a regulator put warning because vddio regulator is not stopped before release. The issue comes from pm_runtime not already setup when core probe fails and the vddio regulator disable callback is called. Fix the issue by setting pm_runtime active early before vddio regulator resource cleanup. This requires to cut pm_runtime set_active and enable in 2 function calls. Fixes: 7ff021a3faca ("iio: imu: inv_icm45600: add new inv_icm45600 driver") Signed-off-by: Jean-Baptiste Maneyrol Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit 064234044056c93a3719d6893e6e5a26a94a61b6 Author: Nuno Sá Date: Mon Feb 16 13:24:27 2026 +0000 iio: buffer: Fix wait_queue not being removed In the edge case where the IIO device is unregistered while we're buffering, we were directly returning an error without removing the wait queue. Instead, set 'ret' and break out of the loop. Fixes: 9eeee3b0bf19 ("iio: Add output buffer support") Signed-off-by: Nuno Sá Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit acc3949aab3e8094641a9c7c2768de1958c88378 Author: Antoniu Miclaus Date: Mon Feb 16 11:57:56 2026 +0200 iio: gyro: mpu3050-core: fix pm_runtime error handling The return value of pm_runtime_get_sync() is not checked, allowing the driver to access hardware that may fail to resume. The device usage count is also unconditionally incremented. Use pm_runtime_resume_and_get() which propagates errors and avoids incrementing the usage count on failure. In preenable, add pm_runtime_put_autosuspend() on set_8khz_samplerate() failure since postdisable does not run when preenable fails. Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope") Reviewed-by: Linus Walleij Signed-off-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit 91f950b4cbb1aa9ea4eb3999f1463e8044b717fb Author: Antoniu Miclaus Date: Mon Feb 16 11:57:55 2026 +0200 iio: gyro: mpu3050-i2c: fix pm_runtime error handling The return value of pm_runtime_get_sync() is not checked, and the function always returns success. This allows I2C mux operations to proceed even when the device fails to resume. Use pm_runtime_resume_and_get() and propagate its return value to properly handle resume failures. Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope") Signed-off-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit dd6183e42719cc54057579b8e6be5348cecfeda7 Author: Ethan Tidmore Date: Sat Feb 14 12:46:37 2026 -0600 iio: adc: ad7768-1: Fix ERR_PTR dereference in ad7768_fill_scale_tbl The function iio_get_current_scan_type() can return an error pointer, the return value scan_type is not checked for this and immediately dereferenced which can cause a kernel panic. Add check for IS_ERR() and propagate the error back. Fixes: ff085189cb17 ("iio: adc: ad7768-1: add support for ADAQ776x-1 ADC Family") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202602051234.5gArzLyZ-lkp@intel.com/ Signed-off-by: Ethan Tidmore Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit c3914ce1963c4db25e186112c90fa5d2361e9e0a Author: Antoniu Miclaus Date: Thu Feb 12 14:46:08 2026 +0200 iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() sizeof(num) evaluates to sizeof(size_t) which is 8 bytes on 64-bit, but the buffer elements are only 4 bytes. The same function already uses sizeof(*meas) on line 312, making the mismatch evident. Use sizeof(*meas) consistently. Fixes: b2e171f5a5c6 ("iio: sps30: add support for serial interface") Signed-off-by: Antoniu Miclaus Acked-by: Tomasz Duszynski Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 216345f98cae7fcc84f49728c67478ac00321c87 Author: Antoniu Miclaus Date: Thu Feb 12 14:46:07 2026 +0200 iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() sizeof(num) evaluates to sizeof(size_t) (8 bytes on 64-bit) instead of the intended __be32 element size (4 bytes). Use sizeof(*meas) to correctly match the buffer element type. Fixes: 8f3f13085278 ("iio: sps30: separate core and interface specific code") Signed-off-by: Antoniu Miclaus Acked-by: Tomasz Duszynski Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 82ee91d6b15f06b6094eea2c26afe0032fe8e177 Author: Antoniu Miclaus Date: Tue Feb 10 18:49:50 2026 +0200 iio: magnetometer: tlv493d: remove erroneous shift in X-axis data TLV493D_BX2_MAG_X_AXIS_LSB is defined as GENMASK(7, 4). FIELD_GET() already right-shifts bits [7:4] to [3:0], so the additional >> 4 discards most of the X-axis low nibble. The Y and Z axes correctly omit this extra shift. Remove it. Fixes: 106511d280c7 ("iio: magnetometer: add support for Infineon TLV493D 3D Magentic sensor") Signed-off-by: Antoniu Miclaus Cc: Signed-off-by: Jonathan Cameron commit a318cfc0853706f1d6ce682dba660bc455d674ef Author: Yasin Lee Date: Fri Feb 13 23:14:44 2026 +0800 iio: proximity: hx9023s: Protect against division by zero in set_samp_freq Avoid division by zero when sampling frequency is unspecified. Fixes: 60df548277b7 ("iio: proximity: Add driver support for TYHX's HX9023S capacitive proximity sensor") Signed-off-by: Yasin Lee Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 585b90c0161ab77416fe3acdbdc55b978e33e16c Author: Yasin Lee Date: Fri Feb 13 23:14:43 2026 +0800 iio: proximity: hx9023s: fix assignment order for __counted_by Initialize fw_size before copying firmware data into the flexible array member to match the __counted_by() annotation. This fixes the incorrect assignment order that triggers runtime safety checks. Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing functionality") Signed-off-by: Yasin Lee Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit f55b9510cd9437da3a0efa08b089caeb47595ff1 Author: Chris Spencer Date: Thu Feb 5 14:55:45 2026 +0000 iio: chemical: bme680: Fix measurement wait duration calculation This function refers to the Bosch BME680 API as the source of the calculation, but one of the constants does not match the Bosch implementation. This appears to be a simple transposition of two digits, resulting in a wait time that is too short. This can cause the following 'device measurement cycle incomplete' check to occasionally fail, returning EBUSY to user space. Adjust the constant to match the Bosch implementation and resolve the EBUSY errors. Fixes: 4241665e6ea0 ("iio: chemical: bme680: Fix sensor data read operation") Link: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x.c#L521 Signed-off-by: Chris Spencer Acked-by: Vasileios Amoiridis Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit 5187e03b817c26c1c3bcb2645a612ea935c4be89 Author: Oleksij Rempel Date: Wed Feb 4 15:00:33 2026 +0100 iio: dac: ds4424: reject -128 RAW value The DS442x DAC uses sign-magnitude encoding, so -128 cannot be represented in hardware (7-bit magnitude). Previously, passing -128 resulted in a truncated value that programmed 0mA (magnitude 0) instead of the expected maximum negative current, effectively failing silently. Reject -128 to avoid producing the wrong current. Fixes: d632a2bd8ffc ("iio: dac: ds4422/ds4424 dac driver") Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 7ef74d961d1ad6ec72b50887ca119d7f98f07717 Author: Jean-Baptiste Maneyrol Date: Thu Feb 5 17:59:14 2026 +0100 iio: imu: inv_icm45600: fix INT1 drive bit inverted Drive bit must be set for open-drain mode and be cleared for push-pull mode. Referring to datasheet DS-000576_ICM-45605.pdf section 17.23 INT1_CONFIG2. Fixes: 06674a72cf7a ("iio: imu: inv_icm45600: add buffer support in iio devices") Signed-off-by: Jean-Baptiste Maneyrol Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit 85e4614524dca6c0a43874f475a17de2b9725648 Author: Lukas Schmid Date: Mon Feb 2 21:15:35 2026 +0100 iio: potentiometer: mcp4131: fix double application of wiper shift The MCP4131 wiper address is shifted twice when preparing the SPI command in mcp4131_write_raw(). The address is already shifted when assigned to the local variable "address", but is then shifted again when written to data->buf[0]. This results in an incorrect command being sent to the device and breaks wiper writes to the second channel. Remove the second shift and use the pre-shifted address directly when composing the SPI transfer. Fixes: 22d199a53910 ("iio: potentiometer: add driver for Microchip MCP413X/414X/415X/416X/423X/424X/425X/426X") Signed-off-by: Lukas Schmid # Cc: Signed-off-by: Jonathan Cameron commit d23d763e00ace4e9c59f8d33e0713d401133ba88 Author: Andreas Kemnade Date: Wed Dec 31 22:14:16 2025 +0100 iio: imu: inv-mpu9150: fix irq ack preventing irq storms IRQ needs to be acked. for some odd reasons, reading from irq status does not reliable help, enable acking from any register to be on the safe side and read the irq status register. Comments in the code indicate a known unreliability with that register. The blamed commit was tested with mpu6050 in lg,p895 and lg,p880 according to Tested-bys. But with the MPU9150 in the Epson Moverio BT-200 this leads to irq storms without properly acking the irq. Fixes: 0a3b517c8089 ("iio: imu: inv_mpu6050: fix interrupt status read for old buggy chips") Signed-off-by: Andreas Kemnade Acked-by: Jean-Baptiste Maneyrol Signed-off-by: Jonathan Cameron commit 6c8bf4b604a8a6346ca71f1c027fa01c2c2e04cb Author: SeungJu Cheon Date: Sat Jan 24 04:47:58 2026 +0900 iio: frequency: adf4377: Fix duplicated soft reset mask The regmap_read_poll_timeout() uses ADF4377_0000_SOFT_RESET_R_MSK twice instead of checking both SOFT_RESET_MSK (bit 0) and SOFT_RESET_R_MSK (bit 7). This causes an incomplete reset status check. The code first sets both SOFT_RESET and SOFT_RESET_R bits to 1 via regmap_update_bits(), then polls for them to be cleared. Since we set both bits before polling, we should be waiting for both to clear. Fix by using both masks as done in regmap_update_bits() above. Fixes: eda549e2e524 ("iio: frequency: adf4377: add support for ADF4377") Signed-off-by: SeungJu Cheon Cc: Stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit dd72e6c3cdea05cad24e99710939086f7a113fb5 Author: Antoniu Miclaus Date: Fri Jan 30 13:30:20 2026 +0200 iio: light: bh1780: fix PM runtime leak on error path Move pm_runtime_put_autosuspend() before the error check to ensure the PM runtime reference count is always decremented after pm_runtime_get_sync(), regardless of whether the read operation succeeds or fails. Fixes: 1f0477f18306 ("iio: light: new driver for the ROHM BH1780") Signed-off-by: Antoniu Miclaus Reviewed-by: Linus Walleij Cc: Signed-off-by: Jonathan Cameron commit ffd32db8263d2d785a2c419486a450dc80693235 Author: Jean-Baptiste Maneyrol Date: Fri Jan 30 17:10:23 2026 +0100 iio: imu: inv_icm42600: fix odr switch when turning buffer off ODR switch is done in 2 steps when FIFO is on : change the ODR register value and acknowledge change when reading the FIFO ODR change flag. When we are switching odr and turning buffer off just afterward, we are losing the FIFO ODR change flag and ODR switch is blocked. Fix the issue by force applying any waiting ODR change when turning buffer off. Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping") Signed-off-by: Jean-Baptiste Maneyrol Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit c9f3a593137d862d424130343e77d4b5260a4f5a Author: Jean-Baptiste Maneyrol Date: Fri Jan 30 16:38:47 2026 +0100 iio: imu: inv_icm42600: fix odr switch to the same value ODR switch is done in 2 steps when FIFO is on : change the ODR register value and acknowledge change when reading the FIFO ODR change flag. When we are switching to the same odr value, we end up waiting for a FIFO ODR flag that is never happening. Fix the issue by doing nothing and exiting properly when we are switching to the same ODR value. Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping") Signed-off-by: Jean-Baptiste Maneyrol Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit 243307a0d1b0d01538e202c00454c28b21d4432e Author: Marek Szyprowski Date: Tue Feb 3 11:21:33 2026 +0100 wifi: brcmfmac: Fix potential kernel oops when probe fails When probe of the sdio brcmfmac device fails for some reasons (i.e. missing firmware), the sdiodev->bus is set to error instead of NULL, thus the cleanup later in brcmf_sdio_remove() tries to free resources via invalid bus pointer. This happens because sdiodev->bus is set 2 times: first in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix this by chaning the brcmf_sdio_probe() function to return the error code and set sdio->bus only there. Fixes: 0ff0843310b7 ("wifi: brcmfmac: Add optional lpo clock enable support") Signed-off-by: Marek Szyprowski Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260203102133.1478331-1-m.szyprowski@samsung.com Signed-off-by: Johannes Berg commit c854758abe0b8d86f9c43dc060ff56a0ee5b31e0 Author: Johannes Berg Date: Tue Feb 17 13:05:26 2026 +0100 wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value. Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present. Cc: stable@vger.kernel.org Fixes: 33e5a2f776e3 ("wireless: update radiotap parser") Reported-by: syzbot+b09c1af8764c0097bb19@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/69944a91.a70a0220.2c38d7.00fc.GAE@google.com Link: https://patch.msgid.link/20260217120526.162647-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit 767d23ade706d5fa51c36168e92a9c5533c351a1 Author: Daniil Dulov Date: Wed Feb 11 11:20:24 2026 +0300 wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 The problem arises due to the rfkill_block work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphy_unregister(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 1f87f7d3a3b4 ("cfg80211: add rfkill support") Cc: stable@vger.kernel.org Signed-off-by: Daniil Dulov Link: https://patch.msgid.link/20260211082024.1967588-1-d.dulov@aladdin.ru Signed-off-by: Johannes Berg commit c8d7f21ead727485ebf965e2b4d42d4a4f0840f6 Author: Johannes Berg Date: Mon Feb 9 19:12:20 2026 +0100 wifi: cfg80211: wext: fix IGTK key ID off-by-one The IGTK key ID must be 4 or 5, but the code checks against key ID + 1, so must check against 5/6 rather than 4/5. Fix that. Reported-by: Jouni Malinen Fixes: 08645126dd24 ("cfg80211: implement wext key handling") Link: https://patch.msgid.link/20260209181220.362205-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit d5b5e8149af0f5efed58653cbebf1cb3258ce49a Author: Stian Halseth Date: Wed Feb 18 13:00:24 2026 +0100 sparc: Fix page alignment in dma mapping 'phys' may include an offset within the page, while previously used 'base_paddr' was already page-aligned. This caused incorrect DMA mapping in dma_4u_map_phys and dma_4v_map_phys. Fix both functions by masking 'phys' with IO_PAGE_MASK, covering both generic SPARC code and sun4v. Fixes: 38c0d0ebf520 ("sparc: Use physical address DMA mapping") Reported-by: Stian Halseth Closes: https://github.com/sparclinux/issues/issues/75 Suggested-by: Marek Szyprowski Signed-off-by: Stian Halseth Tested-by: Nathaniel Roach Tested-by: Han Gao # on SPARC Enterprise T5220 [mszyprow: adjusted commit description a bit] Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260218120056.3366-2-stian@itx.no commit 47322c469d4a63ac45b705ca83680671ff71c975 Author: Jiri Pirko Date: Mon Feb 9 16:38:05 2026 +0100 dma-mapping: avoid random addr value print out on error path dma_addr is unitialized in dma_direct_map_phys() when swiotlb is forced and DMA_ATTR_MMIO is set which leads to random value print out in warning. Fix that by just returning DMA_MAPPING_ERROR. Fixes: e53d29f957b3 ("dma-mapping: convert dma_direct_*map_page to be phys_addr_t based") Signed-off-by: Jiri Pirko Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260209153809.250835-2-jiri@resnulli.us commit 6b4f875aac344cdd52a1f34cc70ed2f874a65757 Author: Nicholas Carlini Date: Thu Feb 19 20:58:57 2026 +0900 ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message. By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow. This fix replaces min_t(int, ...) with min_t(u32) Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Nicholas Carlini Reviewed-by: Stefan Metzmacher Acked-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c5794709bc9105935dbedef8b9cf9c06f2b559fa Author: Eric Biggers Date: Tue Feb 17 20:28:29 2026 -0800 ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq(). Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Acked-by: Namjae Jeon Signed-off-by: Steve French commit bfcaf4e8ae9b4f52b97fb04ce03be3a01d41cdd0 Author: Danilo Krummrich Date: Mon Feb 16 14:14:33 2026 +0100 rust: io: macro_export io_define_read!() and io_define_write!() Currently, the define_read!() and define_write!() I/O macros are crate public. The only user outside of the I/O module is PCI (for the configurations space I/O backend). Consequently, when CONFIG_PCI=n this causes a compile time warning [1]. In order to fix this, rename the macros to io_define_read!() and io_define_write!() and use #[macro_export] to export them. This is better than making the crate public visibility conditional, as eventually subsystems will have their own crate. Also, I/O backends are valid to be implemented by drivers as well. For instance, there are devices (such as GPUs) that run firmware which allows to program other devices only accessible through the primary device through indirect I/O. Since the macros are now public, also add the corresponding documentation. Fixes: 121d87b28e1d ("rust: io: separate generic I/O helpers from MMIO implementation") Reported-by: Miguel Ojeda Closes: https://lore.kernel.org/driver-core/CANiq72khOYkt6t5zwMvSiyZvWWHMZuNCMERXu=7K=_5tT-8Pgg@mail.gmail.com/ [1] Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Link: https://patch.msgid.link/20260216131534.65008-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit be704107e79696e855aa41e901a926039b6d2410 Author: David Lechner Date: Thu Feb 19 16:55:30 2026 -0600 regulator: dt-bindings: mt6359: make regulator names unique Update the example devicetree with unique regulator names for all regulators. This reflects the same change made to the actual .dtsi file. Signed-off-by: David Lechner Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260219-mtk-mt6359-fix-regulator-names-v1-2-ee0fcebfe1d9@baylibre.com Signed-off-by: Mark Brown commit b7497b5a99f54ab8dcda5b14a308385b2fb03d8d Author: Hao Yu Date: Mon Feb 23 01:03:31 2026 +0800 hwmon: (aht10) Fix initialization commands for AHT20 According to the AHT20 datasheet (updated to V1.0 after the 2023.09 version), the initialization command for AHT20 is 0b10111110 (0xBE). The previous sequence (0xE1) used in earlier versions is no longer compatible with newer AHT20 sensors. Update the initialization command to ensure the sensor is properly initialized. While at it, use binary notation for DHT20_CMD_INIT to match the notation used in the datasheet. Fixes: d2abcb5cc885 ("hwmon: (aht10) Add support for compatible aht20") Signed-off-by: Hao Yu Link: https://lore.kernel.org/r/20260222170332.1616-3-haoyufine@gmail.com Signed-off-by: Guenter Roeck commit ac209a7d816d918582d0d6387e93d02679f9c8ed Author: Randy Dunlap Date: Sat Feb 14 17:03:27 2026 -0800 hwmon: (emc1403) correct a malformed email address Add a closing '>' to Kalhan's emaill address. line 60: Kalhan Trisal Link: https://lore.kernel.org/r/20260215010327.1687304-1-rdunlap@infradead.org Signed-off-by: Guenter Roeck commit 579b86f3c26fee97996e68c1cbfb7461711f3de3 Author: Guenter Roeck Date: Thu Jan 29 09:51:11 2026 -0800 hwmon: (macsmc) Fix overflows, underflows, and sign extension The macsmc-hwmon driver experienced several issues related to value scaling and type conversion: 1. macsmc_hwmon_read_f32_scaled() clipped values to INT_MAX/INT_MIN. On 64-bit systems, hwmon supports long values, so clipping to 32-bit range was premature and caused loss of range for high-power sensors. Changed it to use long and clip to LONG_MAX/LONG_MIN. 2. The overflow check in macsmc_hwmon_read_f32_scaled() used 1UL, which is 32-bit on some platforms. Switched to 1ULL. 3. macsmc_hwmon_read_key() used a u32 temporary variable for f32 values. When assigned to a 64-bit long, negative values were zero-extended instead of sign-extended, resulting in large positive numbers. 4. macsmc_hwmon_read_ioft_scaled() used mult_frac() which could overflow during intermediate multiplication. Switched to mul_u64_u32_div() to handle the 64-bit multiplication safely. 5. ioft values (unsigned 48.16) could overflow long when scaled by 1,000,000. Added explicit clipping to LONG_MAX in the caller. 6. macsmc_hwmon_write_f32() truncated its long argument to int, potentially causing issues for large values. Fix these issues by using appropriate types and helper functions. Fixes: 785205fd8139 ("hwmon: Add Apple Silicon SMC hwmon driver") Cc: James Calligeros Cc: Nathan Chancellor Cc: Neal Gompa Cc: Janne Grunau Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20260129175112.3751907-3-linux@roeck-us.net Reviewed-by: James Calligeros Signed-off-by: Guenter Roeck commit 5dd69b864911ae3847365e8bafe7854e79fbeecb Author: Guenter Roeck Date: Thu Jan 29 09:51:10 2026 -0800 hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver The recently added macsmc-hwmon driver contained several critical bugs in its sensor population logic and float conversion routines. Specifically: - The voltage sensor population loop used the wrong prefix ("volt-" instead of "voltage-") and incorrectly assigned sensors to the temperature sensor array (hwmon->temp.sensors) instead of the voltage sensor array (hwmon->volt.sensors). This would lead to out-of-bounds memory access or data corruption when both temperature and voltage sensors were present. - The float conversion in macsmc_hwmon_write_f32() had flawed exponent logic for values >= 2^24 and lacked masking for the mantissa, which could lead to incorrect values being written to the SMC. Fix these issues to ensure correct sensor registration and reliable manual fan control. Confirm that the reported overflow in FIELD_PREP is fixed by declaring macsmc_hwmon_write_f32() as __always_inline for a compile test. Fixes: 785205fd8139 ("hwmon: Add Apple Silicon SMC hwmon driver") Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/linux-hwmon/20260119195817.GA1035354@ax162/ Cc: James Calligeros Cc: Nathan Chancellor Cc: Neal Gompa Cc: Janne Grunau Signed-off-by: Guenter Roeck Tested-by: Nathan Chancellor # build only Link: https://lore.kernel.org/r/20260129175112.3751907-2-linux@roeck-us.net Reviewed-by: James Calligeros Signed-off-by: Guenter Roeck commit 7ec1bd3d9be671d04325b9e06149b8813f6a4836 Author: Potin Lai Date: Thu Jan 22 16:37:56 2026 +0800 soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching The siliconid_to_name() function currently masks the input silicon ID with 0xff00ffff, but compares it against unmasked table entries. This causes matching to fail if the table entries contain non-zero values in the bits covered by the mask (bits 16-23). Update the logic to apply the 0xff00ffff mask to the table entries during comparison. This ensures that only the relevant model and revision bits are considered, providing a consistent match across different manufacturing batches. [arj: Add Fixes: tag, fix 'soninfo' typo, clarify function reference] Fixes: e0218dca5787 ("soc: aspeed: Add soc info driver") Signed-off-by: Potin Lai Link: https://patch.msgid.link/20260122-soc_aspeed_name_fix-v1-1-33a847f2581c@gmail.com Signed-off-by: Andrew Jeffery commit 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 Author: Andy Shevchenko Date: Tue Feb 10 14:58:22 2026 +0100 device property: Allow secondary lookup in fwnode_get_next_child_node() When device_get_child_node_count() got split to the fwnode and device respective APIs, the fwnode didn't inherit the ability to traverse over the secondary fwnode. Hence any user, that switches from device to fwnode API misses this feature. In particular, this was revealed by the commit 1490cbb9dbfd ("device property: Split fwnode_get_child_node_count()") that effectively broke the GPIO enumeration on Intel Galileo boards. Fix this by moving the secondary lookup from device to fwnode API. Note, in general no device_*() API should go into the depth of the fwnode implementation. Fixes: 114dbb4fa7c4 ("drivers property: When no children in primary, try secondary") Cc: stable@vger.kernel.org Signed-off-by: Andy Shevchenko Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Sakari Ailus Link: https://patch.msgid.link/20260210135822.47335-1-andriy.shevchenko@linux.intel.com Signed-off-by: Danilo Krummrich commit 663c28469d3274d6456f206a6671c91493d85ff1 Author: Henrique Carvalho Date: Sat Feb 21 01:59:44 2026 -0300 smb: client: fix cifs_pick_channel when channels are equally loaded cifs_pick_channel uses (start % chan_count) when channels are equally loaded, but that can return a channel that failed the eligibility checks. Drop the fallback and return the scan-selected channel instead. If none is eligible, keep the existing behavior of using the primary channel. Signed-off-by: Henrique Carvalho Acked-by: Paulo Alcantara (Red Hat) Acked-by: Meetakshi Setiya Reviewed-by: Shyam Prasad N Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 29d1f56c4f3001b7f547123e0a307c009ac717f8 Author: Heiko Stuebner Date: Tue Feb 10 13:01:42 2026 +0100 Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro" This reverts commit 6d54d935062e2d4a7d3f779ceb9eeff108d0535d. It seems there are different variants of the Wifi chipset in use on the Pinebook Pro. And according to the reported regression - see Closes below, the reverted change causes issues with one Wifi chipset. The original commit message indicates a "further description" only and does not indicate this would fix an actual problem, so a revert should not cause further problems. Fixes: 6d54d935062e ("arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro") Cc: Jan Palus Cc: Peter Robinson Cc: Thorsten Leemhuis Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/r/aUKOlj-RvTYlrpiS@rock.grzadka/ Tested-by: Jan Palus Reviewed-by: Dragan Simic Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260210120142.698512-1-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 24ed11ee5bacf9a9aca18fc6b47667c7f38d578b Author: Shawn Lin Date: Wed Feb 11 21:02:37 2026 +0800 soc: rockchip: grf: Add missing of_node_put() when returning Fix the smatch checking: drivers/soc/rockchip/grf.c:249 rockchip_grf_init() warn: inconsistent refcounting 'np->kobj.kref.refcount.refs.counter': Reported-by: Dan Carpenter Fixes: 75fb63ae0312 ("soc: rockchip: grf: Support multiple grf to be handled") Closes: https://lore.kernel.org/all/aYXvgTcUJWQL2can@stanley.mountain/ Signed-off-by: Shawn Lin Link: https://patch.msgid.link/1770814957-17762-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Heiko Stuebner commit 6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f Author: Linus Torvalds Date: Sun Feb 22 13:18:59 2026 -0800 Linux 7.0-rc1 commit fbf33803618ad4f531f78fe15cf328fe6c7f9978 Merge: 75e1f66a9ed09f 693680b9add63d Author: Linus Torvalds Date: Sun Feb 22 13:12:04 2026 -0800 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity fixes from Eric Biggers: - Fix a build error on parisc - Remove the non-large-folio-aware function fsverity_verify_page() * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fsverity: fix build error by adding fsverity_readahead() stub fsverity: remove fsverity_verify_page() f2fs: make f2fs_verify_cluster() partially large-folio-aware f2fs: remove unnecessary ClearPageUptodate in f2fs_verify_cluster() commit 75e1f66a9ed09f29c6883ea379c174e8cf31f7cc Merge: aaf96df9593bf4 beeebffc807531 Author: Linus Torvalds Date: Sun Feb 22 13:09:33 2026 -0800 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fix from Eric Biggers: "Fix a big endian specific issue in the PPC64-optimized AES code" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: powerpc/aes: Fix rndkey_from_vsx() on big endian CPUs commit aaf96df9593bf4ab1b73c17891e4efe7570fdef3 Author: Mark Brown Date: Tue Feb 17 13:10:46 2026 +0000 CREDITS: Add -next to Stephen Rothwell's entry Stephen retired and stepped back from -next maintainership, update his entry in CREDITS to recognise his 18 years of hard work making it what it is today and all the impact it's had on our development process. Also update to his current GnuPG key while we're here. Acked-by: Stephen Rothwell Acked-by: SeongJae Park Reviewed-by: Randy Dunlap Signed-off-by: Mark Brown Acked-by: Krzysztof Kozlowski Signed-off-by: Linus Torvalds commit 746b9ef5d5ccbded13bdc1f9575fb587fe13794e Author: Arnd Bergmann Date: Tue Feb 17 08:26:49 2026 +0000 x509: select CONFIG_CRYPTO_LIB_SHA256 The x509 public key code gained a dependency on the sha256 hash implementation, causing a rare link time failure in randconfig builds: arm-linux-gnueabi-ld: crypto/asymmetric_keys/x509_public_key.o: in function `x509_get_sig_params': x509_public_key.c:(.text.x509_get_sig_params+0x12): undefined reference to `sha256' arm-linux-gnueabi-ld: (sha256): Unknown destination type (ARM/Thumb) in crypto/asymmetric_keys/x509_public_key.o x509_public_key.c:(.text.x509_get_sig_params+0x12): dangerous relocation: unsupported relocation Select the necessary library code from Kconfig. Fixes: 2c62068ac86b ("x509: Separately calculate sha256 for blacklist") Signed-off-by: Arnd Bergmann Signed-off-by: David Howells Reviewed-by: Eric Biggers Signed-off-by: Linus Torvalds commit fd1d6b9d13f35dccbacbae25ed53593cd9086f84 Author: Haiyue Wang Date: Sun Feb 22 20:11:00 2026 +0800 xz: fix arm fdt compile error for kmalloc replacement Align to the commit bf4afc53b77a ("Convert 'alloc_obj' family to use the new default GFP_KERNEL argument") update the 'kmalloc_obj' declaration for userspace to fix below compile error: In file included from arch/arm/boot/compressed/../../../../lib/decompress_unxz.c:241, from arch/arm/boot/compressed/decompress.c:56: arch/arm/boot/compressed/../../../../lib/xz/xz_dec_stream.c: In function 'xz_dec_init': arch/arm/boot/compressed/../../../../lib/xz/xz_dec_stream.c:787:28: error: implicit declaration of function 'kmalloc_obj'; did you mean 'kmalloc'? [-Wimplicit-function-declaration] 787 | struct xz_dec *s = kmalloc_obj(*s); | ^~~~~~~~~~~ | kmalloc Signed-off-by: Haiyue Wang Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Fixes: bf4afc53b77a ("Convert 'alloc_obj' family to use the new default GFP_KERNEL argument") Reviewed-by: Kees Cook Acked-by: Lasse Collin Signed-off-by: Linus Torvalds commit 08f97454b7fa39bfcf82524955c771d2d693d6fe Author: Marc Zyngier Date: Sun Feb 22 13:35:13 2026 +0000 KVM: arm64: Fix protected mode handling of pages larger than 4kB Since 3669ddd8fa8b5 ("KVM: arm64: Add a range to pkvm_mappings"), pKVM tracks the memory that has been mapped into a guest in a side data structure. Crucially, it uses it to find out whether a page has already been mapped, and therefore refuses to map it twice. So far, so good. However, this very patch completely breaks non-4kB page support, with guests being unable to boot. The most obvious symptom is that we take the same fault repeatedly, and not making forward progress. A quick investigation shows that this is because of the above rejection code. As it turns out, there are multiple issues at play: - while the HPFAR_EL2 register gives you the faulting IPA minus the bottom 12 bits, it will still give you the extra bits that are part of the page offset for anything larger than 4kB, even for a level-3 mapping - pkvm_pgtable_stage2_map() assumes that the address passed as a parameter is aligned to the size of the intended mapping - the faulting address is only aligned for a non-page mapping When the planets are suitably aligned (pun intended), the guest faults on a page by accessing it past the bottom 4kB, and extra bits get set in the HPFAR_EL2 register. If this results in a page mapping (which is likely with large granule sizes), nothing aligns it further down, and pkvm_mapping_iter_first() finds an intersection that doesn't really exist. We assume this is a spurious fault and return -EAGAIN. And again... This doesn't hit outside of the protected code, as the page table code always aligns the IPA down to a page boundary, hiding the issue for everyone else. Fix it by always forcing the alignment on vma_pagesize, irrespective of the value of vma_pagesize. Fixes: 3669ddd8fa8b5 ("KVM: arm64: Add a range to pkvm_mappings") Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Link: https://https://patch.msgid.link/20260222141000.3084258-1-maz@kernel.org Cc: stable@vger.kernel.org commit 5f2eac7767493bf23e6552db82ab25de0dccd54f Merge: 1dd419145d090f 969c3cca0f3b88 Author: Linus Torvalds Date: Sun Feb 22 09:43:11 2026 -0800 Merge tag 'rtc-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: - loongson: Loongson-2K0300 support - s35390a: nvmem support - zynqmp: rework calibration * tag 'rtc-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: ds1390: fix number of bytes read from RTC rtc: class: Remove duplicate check for alarm rtc: optee: simplify OP-TEE context match rtc: interface: Alarm race handling should not discard preceding error rtc: s35390a: implement nvmem support rtc: loongson: Add Loongson-2K0300 support dt-bindings: rtc: loongson: Document Loongson-2K0300 compatible dt-bindings: rtc: loongson: Correct Loongson-1C interrupts property dt-bindings: rtc: renesas,rz-rtca3: Add RZ/V2N support dt-bindings: rtc: cpcap: convert to schema rtc: zynqmp: use dynamic max and min offset ranges rtc: zynqmp: rework set_offset rtc: zynqmp: rework read_offset rtc: zynqmp: check calibration max value rtc: zynqmp: correct frequency value rtc: amlogic-a4: Remove IRQF_ONESHOT rtc: pcf8563: use correct of_node for output clock rtc: max31335: use correct CONFIG symbol in IS_REACHABLE() rtc: nvvrs: Add ARCH_TEGRA to the NV VRS RTC driver commit 1dd419145d090f8fdf149cbb39dea6d968659dd2 Merge: d2ba6e9c0ae54b 97b281d7edb2ae Author: Linus Torvalds Date: Sun Feb 22 08:43:31 2026 -0800 Merge tag 'rust-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Pass '-Zunstable-options' flag required by the future Rust 1.95.0 - Fix 'objtool' warning for Rust 1.84.0 'kernel' crate: - 'irq' module: add missing bound detected by the future Rust 1.95.0 - 'list' module: add missing 'unsafe' blocks and placeholder safety comments to macros (an issue for future callers within the crate) 'pin-init' crate: - Clean Clippy warning that changed behavior in the future Rust 1.95.0" * tag 'rust-fixes-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: list: Add unsafe blocks for container_of and safety comments rust: pin-init: replace clippy `expect` with `allow` rust: irq: add `'static` bounds to irq callbacks objtool/rust: add one more `noreturn` Rust function rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 commit d2ba6e9c0ae54b3d0973e23d8806cd9a16b9faef Merge: 189f164e573e18 75f3cf0d1561b0 Author: Linus Torvalds Date: Sun Feb 22 08:40:13 2026 -0800 Merge tag 'trace-rv-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verifier fix from Steven Rostedt: - Fix multiple definition of __pcpu_unique_da_mon_this After refactoring monitors, we used static per-cpu variables with the same names across different per-cpu monitors. This is explicitly disallowed for modules on some architectures (alpha) or if CONFIG_DEBUG_FORCE_WEAK_PER_CPU is enabled (e.g. Fedora's debug kernel). Make sure all those variables have different names to avoid compilation issues. * tag 'trace-rv-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rv: Fix multiple definition of __pcpu_unique_da_mon_this commit 189f164e573e18d9f8876dbd3ad8fcbe11f93037 Author: Kees Cook Date: Sat Feb 21 23:46:04 2026 -0800 Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses Conversion performed via this Coccinelle script: // SPDX-License-Identifier: GPL-2.0-only // Options: --include-headers-for-types --all-includes --include-headers --keep-comments virtual patch @gfp depends on patch && !(file in "tools") && !(file in "samples")@ identifier ALLOC = {kmalloc_obj,kmalloc_objs,kmalloc_flex, kzalloc_obj,kzalloc_objs,kzalloc_flex, kvmalloc_obj,kvmalloc_objs,kvmalloc_flex, kvzalloc_obj,kvzalloc_objs,kvzalloc_flex}; @@ ALLOC(... - , GFP_KERNEL ) $ make coccicheck MODE=patch COCCI=gfp.cocci Build and boot tested x86_64 with Fedora 42's GCC and Clang: Linux version 6.19.0+ (user@host) (gcc (GCC) 15.2.1 20260123 (Red Hat 15.2.1-7), GNU ld version 2.44-12.fc42) #1 SMP PREEMPT_DYNAMIC 1970-01-01 Linux version 6.19.0+ (user@host) (clang version 20.1.8 (Fedora 20.1.8-4.fc42), LLD 20.1.8) #1 SMP PREEMPT_DYNAMIC 1970-01-01 Signed-off-by: Kees Cook Signed-off-by: Linus Torvalds commit 32a92f8c89326985e05dce8b22d3f0aa07a3e1bd Author: Linus Torvalds Date: Sat Feb 21 20:03:00 2026 -0800 Convert more 'alloc_obj' cases to default GFP_KERNEL arguments This converts some of the visually simpler cases that have been split over multiple lines. I only did the ones that are easy to verify the resulting diff by having just that final GFP_KERNEL argument on the next line. Somebody should probably do a proper coccinelle script for this, but for me the trivial script actually resulted in an assertion failure in the middle of the script. I probably had made it a bit _too_ trivial. So after fighting that far a while I decided to just do some of the syntactically simpler cases with variations of the previous 'sed' scripts. The more syntactically complex multi-line cases would mostly really want whitespace cleanup anyway. Signed-off-by: Linus Torvalds commit 323bbfcf1ef8836d0d2ad9e2c1f1c684f0e3b5b3 Author: Linus Torvalds Date: Sat Feb 21 17:06:51 2026 -0800 Convert 'alloc_flex' family to use the new default GFP_KERNEL argument This is the exact same thing as the 'alloc_obj()' version, only much smaller because there are a lot fewer users of the *alloc_flex() interface. As with alloc_obj() version, this was done entirely with mindless brute force, using the same script, except using 'flex' in the pattern rather than 'objs*'. Signed-off-by: Linus Torvalds commit bf4afc53b77aeaa48b5409da5c8da6bb4eff7f43 Author: Linus Torvalds Date: Sat Feb 21 16:37:42 2026 -0800 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument This was done entirely with mindless brute force, using git grep -l '\ commit e19e1b480ac73c3e62ffebbca1174f0f511f43e7 Author: Linus Torvalds Date: Sat Feb 21 16:14:11 2026 -0800 add default_gfp() helper macro and use it in the new *alloc_obj() helpers Most simple allocations use GFP_KERNEL, and with the new allocation helpers being introduced, let's just take advantage of that to simplify that default case. It's a numbers game: git grep 'alloc_obj(' | sed 's/.*\(GFP_[_A-Z]*\).*/\1/' | sort | uniq -c | sort -n | tail shows that about 90% of all those new allocator instances just use that standard GFP_KERNEL. Those helpers are already macros, and we can easily just make it be the default case when the gfp argument is missing. And yes, we could do that for all the legacy interfaces too, but let's keep it to just the new ones at least for now, since those all got converted recently anyway, so this is not any "extra" noise outside of that limited conversion. And, in fact, I want to do this before doing the -rc1 release, exactly so that we don't get extra merge conflicts. Signed-off-by: Linus Torvalds commit fa5c82f4d2bbde10e9fd3a32aecacfe3813919ba Author: Linus Torvalds Date: Sat Feb 21 15:12:09 2026 -0800 slab.h: disable completely broken overflow handling in flex allocations Commit 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") started using the new allocation helpers, and in the process showed that they were completely non-working. The overflow logic in overflows_flex_counter_type() is completely the wrong way around, and that broke __alloc_flex() completely. By chance, the resulting code was then such a mess that clang generated sufficiently garbage code that objtool warned about it all. Which made it somewhat quicker to narrow things down. While fixing overflows_flex_counter_type() would presumably fix this all, I'm excising the whole broken overflow logic from __alloc_flex(), because we don't want that kind of code in basic allocation functions anyway. That (no longer) broken overflows_flex_counter_type() thing needs to be inserted into the actual __set_flex_counter() logic in the unlikely case that we ever want this at all. And made conditional. Fixes: 81cee9166a90 ("compiler_types: Introduce __flex_counter() and family") Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Cc: Kees Cook Link: https://lore.kernel.org/all/CAHk-=whEd020BYzGTzYrENjD9Z5_82xx6h8HsQvH5xDSnv0=Hw@mail.gmail.com/ Signed-off-by: Linus Torvalds commit 8934827db5403eae57d4537114a9ff88b0a8460f Merge: c7decec2f2d2ab 7a70c15bd1449f Author: Linus Torvalds Date: Sat Feb 21 11:02:58 2026 -0800 Merge tag 'kmalloc_obj-treewide-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kmalloc_obj conversion from Kees Cook: "This does the tree-wide conversion to kmalloc_obj() and friends using coccinelle, with a subsequent small manual cleanup of whitespace alignment that coccinelle does not handle. This uncovered a clang bug in __builtin_counted_by_ref(), so the conversion is preceded by disabling that for current versions of clang. The imminent clang 22.1 release has the fix. I've done allmodconfig build tests for x86_64, arm64, i386, and arm. I did defconfig builds for alpha, m68k, mips, parisc, powerpc, riscv, s390, sparc, sh, arc, csky, xtensa, hexagon, and openrisc" * tag 'kmalloc_obj-treewide-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: kmalloc_obj: Clean up after treewide replacements treewide: Replace kmalloc with kmalloc_obj for non-scalar types compiler_types: Disable __builtin_counted_by_ref for Clang commit c7decec2f2d2ab0366567f9e30c0e1418cece43f Merge: 3544d5ce36f403 dbf0108347bdb5 Author: Linus Torvalds Date: Sat Feb 21 10:51:08 2026 -0800 Merge tag 'perf-tools-for-v7.0-1-2026-02-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Arnaldo Carvalho de Melo: - Introduce 'perf sched stats' tool with record/report/diff workflows using schedstat counters - Add a faster libdw based addr2line implementation and allow selecting it or its alternatives via 'perf config addr2line.style=' - Data-type profiling fixes and improvements including the ability to select fields using 'perf report''s -F/-fields, e.g.: 'perf report --fields overhead,type' - Add 'perf test' regression tests for Data-type profiling with C and Rust workloads - Fix srcline printing with inlines in callchains, make sure this has coverage in 'perf test' - Fix printing of leaf IP in LBR callchains - Fix display of metrics without sufficient permission in 'perf stat' - Print all machines in 'perf kvm report -vvv', not just the host - Switch from SHA-1 to BLAKE2s for build ID generation, remove SHA-1 code - Fix 'perf report's histogram entry collapsing with '-F' option - Use system's cacheline size instead of a hardcoded value in 'perf report' - Allow filtering conversion by time range in 'perf data' - Cover conversion to CTF using 'perf data' in 'perf test' - Address newer glibc const-correctness (-Werror=discarded-qualifiers) issues - Fixes and improvements for ARM's CoreSight support, simplify ARM SPE event config in 'perf mem', update docs for 'perf c2c' including the ARM events it can be used with - Build support for generating metrics from arch specific python script, add extra AMD, Intel, ARM64 metrics using it - Add AMD Zen 6 events and metrics - Add JSON file with OpenHW Risc-V CVA6 hardware counters - Add 'perf kvm' stats live testing - Add more 'perf stat' tests to 'perf test' - Fix segfault in `perf lock contention -b/--use-bpf` - Fix various 'perf test' cases for s390 - Build system cleanups, bump minimum shellcheck version to 0.7.2 - Support building the capstone based annotation routines as a plugin - Allow passing extra Clang flags via EXTRA_BPF_FLAGS * tag 'perf-tools-for-v7.0-1-2026-02-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (255 commits) perf test script: Add python script testing support perf test script: Add perl script testing support perf script: Allow the generated script to be a path perf test: perf data --to-ctf testing perf test: Test pipe mode with data conversion --to-json perf json: Pipe mode --to-ctf support perf json: Pipe mode --to-json support perf check: Add libbabeltrace to the listed features perf build: Allow passing extra Clang flags via EXTRA_BPF_FLAGS perf test data_type_profiling.sh: Skip just the Rust tests if code_with_type workload is missing tools build: Fix feature test for rust compiler perf libunwind: Fix calls to thread__e_machine() perf stat: Add no-affinity flag perf evlist: Reduce affinity use and move into iterator, fix no affinity perf evlist: Missing TPEBS close in evlist__close() perf evlist: Special map propagation for tool events that read on 1 CPU perf stat-shadow: In prepare_metric fix guard on reading NULL perf_stat_evsel Revert "perf tool_pmu: More accurately set the cpus for tool events" tools build: Emit dependencies file for test-rust.bin tools build: Make test-rust.bin be removed by the 'clean' target ... commit 3544d5ce36f403db6e5c994f526101c870ffe9fe Merge: 981361604566a2 e3a22b532080bf Author: Linus Torvalds Date: Sat Feb 21 10:25:42 2026 -0800 Merge tag 'cocci-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull coccinelle updates from Julia Lawall: "This simplifies and clarifies the handling of output generated by Coccinelle that is sent to standard error. By default, this goes to /dev/null. Remind the user of that and encourage them to provide another file name (Benjamin Philip)" * tag 'cocci-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: Documentation: Coccinelle: document debug log handling scripts: coccicheck: warn on unset debug file scripts: coccicheck: simplify debug file handling commit 981361604566a28517a518c317943d9b7c392217 Merge: f9d66e64a2bcb9 8c1f92ca8bca3c Author: Linus Torvalds Date: Sat Feb 21 10:20:32 2026 -0800 Merge tag 'ntb-7.0' of https://github.com/jonmason/ntb Pull NTB (PCIe non-transparent bridge) updates from Jon Mason: "NTB updates include debugfs improvements, correctness fixes, cleanups, and new hardware support: ntb_transport QP stats are converted to seq_file, a tx_memcpy_offload module parameter is introduced with associated ordering fixes, and a debugfs queue name truncation bug is corrected. Additional fixes address format specifier mismatches in ntb_tool and boundary conditions in the Switchtec driver, while unused MSI helpers are removed and the codebase migrates to dma_map_phys(). Intel Gen6 (Diamond Rapids) NTB support is also added" * tag 'ntb-7.0' of https://github.com/jonmason/ntb: NTB: ntb_transport: Use seq_file for QP stats debugfs NTB: ntb_transport: Fix too small buffer for debugfs_name ntb/ntb_tool: correct sscanf format for u64 and size_t in tool_peer_mw_trans_write ntb: intel: Add Intel Gen6 NTB support for DiamondRapids NTB/msi: Remove unused functions ntb: ntb_hw_switchtec: Increase MAX_MWS limit to 256 ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut NTB: epf: allow built-in build ntb: migrate to dma_map_phys instead of map_page NTB: ntb_transport: Add 'tx_memcpy_offload' module option NTB: ntb_transport: Remove unused 'retries' field from ntb_queue_entry commit f9d66e64a2bcb979d47eb7d67aa7e9b454fd5d15 Merge: 817c16e5655958 ea129e55c9e06a Author: Linus Torvalds Date: Sat Feb 21 10:05:49 2026 -0800 Merge tag 'io_uring-20260221' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - A fix for a missing URING_CMD128 opcode check, fixing an issue with the SQE mixed mode support introduced in 6.19. Merged late due to having multiple dependencies - Add sqe->cmd size checking for big SQEs, similar to what we have for normal sized SQEs - Fix a race condition in zcrx, that leads to a double free * tag 'io_uring-20260221' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: Add size check for sqe->cmd io_uring: add IORING_OP_URING_CMD128 to opcode checks io_uring/zcrx: fix user_ref race between scrub and refill paths commit 817c16e5655958c34035a10c8c4b93e33e529624 Merge: 4cf44657887b4c f043a93fff9e3e Author: Linus Torvalds Date: Sat Feb 21 09:58:22 2026 -0800 Merge tag 'fixes-2026-02-21' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fix from Mike Rapoport: "Fix detection of NUMA node for CXL windows phys_to_target_node() may assign a CXL Fixed Memory Window to the wrong NUMA node when a CXL node resides in the gap of discontinuous System RAM node. Fix this by checking both numa_meminfo and numa_reserved_meminfo, preferring the reserved NID when the address appears in both" * tag 'fixes-2026-02-21' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: mm: numa_memblks: Identify the accurate NUMA ID of CFMW commit 4cf44657887b4c41374981d0afb2ca302b189e15 Merge: 8eb604d4ee8bf6 640c9dc72f21f3 Author: Linus Torvalds Date: Sat Feb 21 09:38:59 2026 -0800 Merge tag 'sched_ext-for-7.0-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Various bug fixes for the example schedulers and selftests * tag 'sched_ext-for-7.0-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: tools/sched_ext: fix getopt not re-parsed on restart tools/sched_ext: scx_userland: fix data races on shared counters tools/sched_ext: scx_pair: fix stride == 0 crash on single-CPU systems tools/sched_ext: scx_central: fix CPU_SET and skeleton leak on early exit tools/sched_ext: scx_userland: fix stale data on restart tools/sched_ext: scx_flatcg: fix potential stack overflow from VLA in fcg_read_stats selftests/sched_ext: Fix rt_stall flaky failure tools/sched_ext: scx_userland: fix restart and stats thread lifecycle bugs tools/sched_ext: scx_central: fix sched_setaffinity() call with the set size tools/sched_ext: scx_flatcg: zero-initialize stats counter array commit 8eb604d4ee8bf6183b00b8a96f0007b1be28ca9d Merge: d79526b89571ae a09dc10d1353f0 Author: Linus Torvalds Date: Sat Feb 21 09:11:32 2026 -0800 Merge tag 'v7.0-rc-part2-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: "Two small fixes: - fix potential deadlock - minor cleanup" * tag 'v7.0-rc-part2-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths smb: server: Remove duplicate include of misc.h commit e3a22b532080bf32a4d4eb6172c8cb878123e13c Author: Benjamin Philip Date: Wed Jan 7 00:38:36 2026 +0530 Documentation: Coccinelle: document debug log handling The current debug documentation does not mention that logs are printed to stdout unless DEBUG_FILE is set. It also doesn't mention that Coccinelle cannot overwrite debug files. Document this behaviour in the examples and reference it in the debugging section. Signed-off-by: Benjamin Philip Signed-off-by: Julia Lawall commit bb1c9ccf740eae3f116a2bb5d26c2bfb80cc8c7e Author: Benjamin Philip Date: Wed Jan 7 00:38:35 2026 +0530 scripts: coccicheck: warn on unset debug file coccicheck prints debug logs to stdout unless a debug file has been set. This makes it hard to read coccinelle's suggested changes, especially for someone new to coccicheck. From this commit, we warn about this behaviour from within the script on an unset debug file. Explicitly setting the debug file to /dev/null suppresses the warning while keeping the default. Signed-off-by: Benjamin Philip Signed-off-by: Julia Lawall commit 8952cfe431cf5b1d615f054f698cd74034bd1385 Author: Benjamin Philip Date: Wed Jan 7 00:38:34 2026 +0530 scripts: coccicheck: simplify debug file handling This commit separates handling unset files and pre-existing files. It also eliminates a duplicated check for unset files in run_cmd_parmap(). Signed-off-by: Benjamin Philip Signed-off-by: Julia Lawall commit cfc83a3c71517b59c1047db57da31e26a9dc2f33 Author: Sven Eckelmann Date: Mon Feb 16 11:20:29 2026 +0100 batman-adv: Avoid double-rtnl_lock ELP metric worker batadv_v_elp_get_throughput() might be called when the RTNL lock is already held. This could be problematic when the work queue item is cancelled via cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case, an rtnl_lock() would cause a deadlock. To avoid this, rtnl_trylock() was used in this function to skip the retrieval of the ethtool information in case the RTNL lock was already held. But for cfg80211 interfaces, batadv_get_real_netdev() was called - which also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must also be used instead and the lockless version __batadv_get_real_netdev() has to be called. Cc: stable@vger.kernel.org Fixes: 8c8ecc98f5c6 ("batman-adv: Drop unmanaged ELP metric worker") Reported-by: Christian Schmidbauer Signed-off-by: Sven Eckelmann Tested-by: Sören Skaarup Signed-off-by: Simon Wunderlich commit 97d5c8f5c09a604c4873c8348f58de3cea69a7df Author: Tomasz Pakuła Date: Wed Feb 4 22:44:55 2026 +0100 HID: pidff: Fix condition effect bit clearing As reported by MPDarkGuy on discord, NULL pointer dereferences were happening because not all the conditional effects bits were cleared. Properly clear all conditional effect bits from ffbit Fixes: 7f3d7bc0df4b ("HID: pidff: Better quirk assigment when searching for fields") Cc: stable@vger.kernel.org # 6.18.x Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 7a70c15bd1449f1eb30991772edce37b41e496fb Author: Kees Cook Date: Sat Feb 21 00:12:19 2026 -0800 kmalloc_obj: Clean up after treewide replacements Coccinelle doesn't handle re-indenting line escapes. Fix the 2 places where these got misaligned. Remove 2 now-redundant type casts, found with: $ git grep -P 'struct (\S+).*\)\s*k\S+alloc_(objs?|flex)\(struct \1' Signed-off-by: Kees Cook commit 69050f8d6d075dc01af7a5f2f550a8067510366f Author: Kees Cook Date: Fri Feb 20 23:49:23 2026 -0800 treewide: Replace kmalloc with kmalloc_obj for non-scalar types This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook commit d39a1d7486d98668dd34aaa6732aad7977c45f5a Author: Kees Cook Date: Fri Feb 20 13:15:58 2026 -0800 compiler_types: Disable __builtin_counted_by_ref for Clang Unfortunately, there is a corner case of __builtin_counted_by_ref() usage that crashes[1] Clang since support was introduced in Clang 19. Disable it prior to Clang 22. Found while tested kmalloc_obj treewide refactoring (via kmalloc_flex() usage). Link: https://github.com/llvm/llvm-project/issues/182575 [1] Signed-off-by: Kees Cook commit d4f687fbbce45b5e88438e89b5e26c0c15847992 Author: Ralf Lici Date: Wed Feb 18 21:08:26 2026 +0100 ovpn: tcp - fix packet extraction from stream When processing TCP stream data in ovpn_tcp_recv, we receive large cloned skbs from __strp_rcv that may contain multiple coalesced packets. The current implementation has two bugs: 1. Header offset overflow: Using pskb_pull with large offsets on coalesced skbs causes skb->data - skb->head to exceed the u16 storage of skb->network_header. This causes skb_reset_network_header to fail on the inner decapsulated packet, resulting in packet drops. 2. Unaligned protocol headers: Extracting packets from arbitrary positions within the coalesced TCP stream provides no alignment guarantees for the packet data causing performance penalties on architectures without efficient unaligned access. Additionally, openvpn's 2-byte length prefix on TCP packets causes the subsequent 4-byte opcode and packet ID fields to be inherently misaligned. Fix both issues by allocating a new skb for each openvpn packet and using skb_copy_bits to extract only the packet content into the new buffer, skipping the 2-byte length prefix. Also, check the length before invoking the function that performs the allocation to avoid creating an invalid skb. If the packet has to be forwarded to userspace the 2-byte prefix can be pushed to the head safely, without misalignment. As a side effect, this approach also avoids the expensive linearization that pskb_pull triggers on cloned skbs with page fragments. In testing, this resulted in TCP throughput improvements of up to 74%. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Signed-off-by: Ralf Lici Signed-off-by: Antonio Quartulli Reviewed-by: Sabrina Dubroca Signed-off-by: David S. Miller commit 640c9dc72f21f325700a4b0f839ad568ff21c697 Author: David Carlier Date: Wed Feb 18 19:22:35 2026 +0000 tools/sched_ext: fix getopt not re-parsed on restart After goto restart, optind retains its advanced position from the previous getopt loop, causing getopt() to immediately return -1. This silently drops all command-line options on the restarted skeleton. Reset optind to 1 at the restart label so options are re-parsed. Affected schedulers: scx_simple, scx_central, scx_flatcg, scx_pair, scx_sdt, scx_cpu0. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit f892f9f99464bead942a75d2b00dda6be07de97f Author: David Carlier Date: Wed Feb 18 19:22:23 2026 +0000 tools/sched_ext: scx_userland: fix data races on shared counters The stats thread reads nr_vruntime_enqueues, nr_vruntime_dispatches, nr_vruntime_failed, and nr_curr_enqueued concurrently with the main thread writing them, with no synchronization. Use __atomic builtins with relaxed ordering for all accesses to these counters to eliminate the data races. Only display accuracy is affected, not scheduling correctness. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit d79526b89571ae447c1a5cfd3d627efa07098348 Merge: 0de6219fd74440 40534d19ed2afb Author: Linus Torvalds Date: Fri Feb 20 17:14:36 2026 -0800 Merge tag 'spi-fix-v7.0-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "There's a relatively large but ultimately simple fix for spidev here which addresses some ABBA races by simplifying down to just using a single lock, it's not clear to me that there was ever any benefit in having the two separate locks in the first place. We also have simple missing error check fix in in the wpcm-fiu driver" * tag 'spi-fix-v7.0-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spidev: fix lock inversion between spi_lock and buf_lock spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() commit 0de6219fd74440199fb0bfc6ce02bb8bdb8e9466 Merge: 3f6eb5a6d27b56 09ad01a530bb6a Author: Linus Torvalds Date: Fri Feb 20 17:11:55 2026 -0800 Merge tag 'regulator-fix-v7.0-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A few driver specific fixes, plus a patch from Bjorn which removes a fixed limit on regulator names that was breaking some Qualcomm systems" * tag 'regulator-fix-v7.0-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: s2mps11: fix pctrlsel macro usage in s2mpg10_of_parse_cb() regulator: s2mps11: drop redundant sanity checks in s2mpg10_of_parse_cb() regulator: core: Remove regulator supply_name length limit regulator: mt6363: Fix interrmittent timeout commit 3f6eb5a6d27b56ea44c2de9f9028d803aeccbfe8 Merge: 433b23a3dad2b9 8c746e22096579 Author: Linus Torvalds Date: Fri Feb 20 17:05:52 2026 -0800 Merge tag 'pci-v7.0-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Fix bridge window selection bug that prevented resource assignment (Kai-Heng Feng) - Fix bridge window sizing, which failed to assign resources for windows containing only optional resources (ROMs, SR-IOV BARs, etc) (Ilpo Järvinen) - Select CONFIGFS_FS when PCI_EPF_TEST is enabled to avoid a link error (Arnd Bergmann) - Fix recently merged Endpoint inbound submapping feature (Koichiro Den) * tag 'pci-v7.0-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: dwc: ep: Always clear IB maps on BAR update PCI: dwc: ep: Return after clearing BAR-match inbound mapping PCI: endpoint: pci-epf-test: Select configfs PCI: Account fully optional bridge windows correctly PCI: Validate window resource type in pbus_select_window_for_type() commit 3f1af4853076c5c811e08c8a7863959e07791999 Merge: 470c7ca2b4c3e3 ce5a0f4612dbac Author: Jakub Kicinski Date: Fri Feb 20 16:34:52 2026 -0800 Merge branch 'bnxt_en-fix-rss-context-and-ntuple-filter-issues' Michael Chan says: ==================== bnxt_en: Fix RSS context and ntuple filter issues The first patch fixes the problem of ifup failing if one or more RSS contexts were previously created. The 2nd patch fixes ntuple filter deletion errors in ifdown state. The last patch adds self tests to cover these failure cases. ==================== Link: https://patch.msgid.link/20260219185313.2682148-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit ce5a0f4612dbacc805fe16719f9f6bd18352b70d Author: Pavan Chebbi Date: Thu Feb 19 10:53:13 2026 -0800 selftests: drv-net: rss_ctx: test RSS contexts persist after ifdown/up Add a test to verify that RSS contexts persist across interface down/up along with their associated Ntuple filters. Another test that creates contexts/rules keeping interface down and test their persistence is also added. Tested on bnxt_en: TAP version 13 1..1 # timeout set to 0 # selftests: drivers/net/hw: rss_ctx.py # TAP version 13 # 1..2 # ok 1 rss_ctx.test_rss_context_persist_create_and_ifdown # ok 2 rss_ctx.test_rss_context_persist_ifdown_and_create # SKIP Create context not supported with interface down # # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:1 error:0 Reviewed-by: Andy Gospodarek Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20260219185313.2682148-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit c1bbd9900d65ac65b9fce9f129e3369a04871570 Author: Pavan Chebbi Date: Thu Feb 19 10:53:12 2026 -0800 bnxt_en: Fix deleting of Ntuple filters Ntuple filters can be deleted when the interface is down. The current code blindly sends the filter delete command to FW. When the interface is down, all the VNICs are deleted in the FW. When the VNIC is freed in the FW, all the associated filters are also freed. We need not send the free command explicitly. Sending such command will generate FW error in the dmesg. In order to fix this, we can safely return from bnxt_hwrm_cfa_ntuple_filter_free() when BNXT_STATE_OPEN is not true which confirms the VNICs have been deleted. Fixes: 8336a974f37d ("bnxt_en: Save user configured filters in a lookup list") Suggested-by: Michael Chan Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20260219185313.2682148-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit e123d9302d223767bd910bfbcfe607bae909f8ac Author: Pavan Chebbi Date: Thu Feb 19 10:53:11 2026 -0800 bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when netif_running() is true to help delete RSS contexts with interface down. Having that condition will make the driver leak VNICs in FW whenever close() happens with active RSS contexts. On the subsequent open(), as part of RSS context restoration, we will end up trying to create extra VNICs for which we did not make any reservation. FW can fail this request, thereby making us lose active RSS contexts. Suppose an RSS context is deleted already and we try to process a delete request again, then the HWRM functions will check for validity of the request and they simply return if the resource is already freed. So, even for delete-when-down cases, netif_running() check is not necessary. Remove the netif_running() condition check when deleting an RSS context. Reported-by: Jakub Kicinski Fixes: 667ac333dbb7 ("eth: bnxt: allow deleting RSS contexts when the device is down") Reviewed-by: Andy Gospodarek Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Link: https://patch.msgid.link/20260219185313.2682148-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 433b23a3dad2b9423fc0d415c6d43add73ac7788 Merge: 7e8d85235677b6 1afafbaf749d8e Author: Linus Torvalds Date: Fri Feb 20 16:18:48 2026 -0800 Merge tag 'dmi-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging Pull dmi update from Jean Delvare: - include product_family info in dmi-id modalias * tag 'dmi-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: firmware/dmi: Include product_family info to modalias commit 470c7ca2b4c3e3a51feeb952b7f97a775b5c49cd Author: Kuniyuki Iwashima Date: Thu Feb 19 17:31:31 2026 +0000 udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb(). syzbot reported null-ptr-deref of udp_sk(sk)->udp_prod_queue. [0] Since the cited commit, udp_lib_init_sock() can fail, as can udp_init_sock() and udpv6_init_sock(). Let's handle the error in udplite_sk_init() and udplitev6_sk_init(). [0]: BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:82 [inline] BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline] BUG: KASAN: null-ptr-deref in __udp_enqueue_schedule_skb+0x151/0x1480 net/ipv4/udp.c:1719 Read of size 4 at addr 0000000000000008 by task syz.2.18/2944 CPU: 1 UID: 0 PID: 2944 Comm: syz.2.18 Not tainted syzkaller #0 PREEMPTLAZY Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 kasan_report+0xa2/0xe0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 instrument_atomic_read include/linux/instrumented.h:82 [inline] atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline] __udp_enqueue_schedule_skb+0x151/0x1480 net/ipv4/udp.c:1719 __udpv6_queue_rcv_skb net/ipv6/udp.c:795 [inline] udpv6_queue_rcv_one_skb+0xa2e/0x1ad0 net/ipv6/udp.c:906 udp6_unicast_rcv_skb+0x227/0x380 net/ipv6/udp.c:1064 ip6_protocol_deliver_rcu+0xe17/0x1540 net/ipv6/ip6_input.c:438 ip6_input_finish+0x191/0x350 net/ipv6/ip6_input.c:489 NF_HOOK+0x354/0x3f0 include/linux/netfilter.h:318 ip6_input+0x16c/0x2b0 net/ipv6/ip6_input.c:500 NF_HOOK+0x354/0x3f0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6149 [inline] __netif_receive_skb+0xd3/0x370 net/core/dev.c:6262 process_backlog+0x4d6/0x1160 net/core/dev.c:6614 __napi_poll+0xae/0x320 net/core/dev.c:7678 napi_poll net/core/dev.c:7741 [inline] net_rx_action+0x60d/0xdc0 net/core/dev.c:7893 handle_softirqs+0x209/0x8d0 kernel/softirq.c:622 do_softirq+0x52/0x90 kernel/softirq.c:523 __local_bh_enable_ip+0xe7/0x120 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline] __dev_queue_xmit+0x109c/0x2dc0 net/core/dev.c:4856 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline] ip6_finish_output+0x158/0x4e0 net/ipv6/ip6_output.c:219 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x342/0x580 net/ipv6/ip6_output.c:246 ip6_send_skb+0x1d7/0x3c0 net/ipv6/ip6_output.c:1984 udp_v6_send_skb+0x9a5/0x1770 net/ipv6/udp.c:1442 udp_v6_push_pending_frames+0xa2/0x140 net/ipv6/udp.c:1469 udpv6_sendmsg+0xfe0/0x2830 net/ipv6/udp.c:1759 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3eb/0x580 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd2/0xf20 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f67b4d9c629 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f67b5c98028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f67b5015fa0 RCX: 00007f67b4d9c629 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f67b4e32b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000040000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f67b5016038 R14: 00007f67b5015fa0 R15: 00007ffe3cb66dd8 Fixes: b650bf0977d3 ("udp: remove busylock and add per NUMA queues") Reported-by: syzbot Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260219173142.310741-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 7e8d85235677b6571857c26854ad1d4edc64c50c Merge: 99e447220b938d fbd03587ba732c Author: Linus Torvalds Date: Fri Feb 20 16:10:54 2026 -0800 Merge tag 'gpio-fixes-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - add a missing IS_ERR() check in gpio-nomadik - fix a NULL-pointer dereference in GPIO character device code - restore label matching in swnode-lookup due to reported regressions in existing users (this will get removed again once we audit and update all drivers) - fix remove path in GPIO sysfs code - normalize the return value of gpio_chip::get() in gpio-amd-fch * tag 'gpio-fixes-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: amd-fch: ionly return allowed values from amd_fch_gpio_get() gpio: sysfs: fix chip removal with GPIOs exported over sysfs gpio: swnode: restore the swnode-name-against-chip-label matching gpio: cdev: Avoid NULL dereference in linehandle_create() gpio: nomadik: Add missing IS_ERR() check commit 594163ea88a03bdb412063af50fc7177ef3cbeae Author: Linus Walleij Date: Thu Feb 19 12:38:50 2026 +0100 net: ethernet: xscale: Check for PTP support properly In ixp4xx_get_ts_info() ixp46x_ptp_find() is called unconditionally despite this feature only existing on ixp46x, leading to the following splat from tcpdump: root@OpenWrt:~# tcpdump -vv -X -i eth0 (...) Unable to handle kernel NULL pointer dereference at virtual address 00000238 when read (...) Call trace: ptp_clock_index from ixp46x_ptp_find+0x1c/0x38 ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64 ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108 __ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648 __dev_ethtool from dev_ethtool+0x160/0x234 dev_ethtool from dev_ioctl+0x2cc/0x460 dev_ioctl from sock_ioctl+0x1ec/0x524 sock_ioctl from sys_ioctl+0x51c/0xa94 sys_ioctl from ret_fast_syscall+0x0/0x44 (...) Segmentation fault Check for ixp46x in ixp46x_ptp_find() before trying to set up PTP to avoid this. To avoid altering the returned error code from ixp4xx_hwtstamp_set() which before this patch was -EOPNOTSUPP, we return -EOPNOTSUPP from ixp4xx_hwtstamp_set() if ixp46x_ptp_find() fails no matter the error code. The helper function ixp46x_ptp_find() helper returns -ENODEV. Fixes: 9055a2f59162 ("ixp4xx_eth: make ptp support a platform driver") Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260219-ixp4xx-fix-ethernet-v3-1-f235ccc3cd46@kernel.org Signed-off-by: Jakub Kicinski commit 2bb995e6155cb4f254574598cbd6fe1dcc99766a Author: Dmitry Torokhov Date: Wed Feb 18 16:56:00 2026 -0800 net: phy: qcom: qca807x: normalize return value of gpio_get The GPIO get callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by qca807x_gpio_get() is normalized to the [0, 1] range. Fixes: 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()") Signed-off-by: Dmitry Torokhov Reviewed-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Link: https://patch.msgid.link/aZZeyr2ysqqk2GqA@google.com Signed-off-by: Jakub Kicinski commit 0aebd81fa8aef55001467e61660fe0c0f8d1cee8 Merge: 9b8eeccd7110d1 4efa91a2857605 Author: Jakub Kicinski Date: Fri Feb 20 15:57:55 2026 -0800 Merge tag 'ipsec-2026-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-02-20 1) Check the value of ipv6_dev_get_saddr() to fix an uninitialized saddr in xfrm6_get_saddr(). From Jiayuan Chen. 2) Skip the templates check for packet offload in tunnel mode. Is was already done by the hardware and causes an unexpected XfrmInTmplMismatch increase. From Leon Romanovsky. 3) Fix a unregister_netdevice stall due to not dropped refcounts by always flushing xfrm state and policy on a NETDEV_UNREGISTER event. From Tetsuo Handa. * tag 'ipsec-2026-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: always flush state and policy upon NETDEV_UNREGISTER event xfrm: skip templates check for packet offload tunnel mode xfrm6: fix uninitialized saddr in xfrm6_get_saddr() ==================== Link: https://patch.msgid.link/20260220094133.14219-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit 9b8eeccd7110d10f9c1b1aa456f5efac23e4e383 Author: Satish Kharat Date: Thu Feb 19 11:24:00 2026 -0800 MAINTAINERS: update enic and usnic maintainers Remove Christian Benvenuti from the enic/usnic maintainer lists because he is no longer working on the drivers and the email address is no longer valid. Keep Satish Kharat as the enic maintainer and the usnic co-maintainer. Signed-off-by: Satish Kharat Acked-by: Leon Romanovsky Link: https://patch.msgid.link/20260219-enic-maintainers-update-v2-v1-1-c58aa11c2ea8@cisco.com Signed-off-by: Jakub Kicinski commit 99e447220b938dfed6488db95a2930b57ea849ba Merge: bc1d4e705f48f0 709cc48d3d01fa Author: Linus Torvalds Date: Fri Feb 20 15:54:48 2026 -0800 Merge tag 'i2c-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: "Designware: - refactor the transfer path to support I2C_M_STOP - handle pm runtime by using the active auto try macros - handle controllers lacking explicit START and STOP conditions - general cleanups Other i2c drivers: - qualcomm: add support for qcs8300-cci - amd8111: general cleanups - cp2112: add DT bindings" * tag 'i2c-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: Add CP2112 HID USB to SMBus Bridge i2c: amd8111: switch to devm_ functions i2c: amd8111: Remove spaces in MODULE_* macros i2c: designware-platdrv: fix cleanup on probe failure i2c: designware-platdrv: simplify reset control dt-bindings: i2c: qcom-cci: Document qcs8300 compatible i2c: designware: Remove dead code in AMD ISP case i2c: designware: Support of controller with IC_EMPTYFIFO_HOLD_MASTER disabled i2c: designware: Use runtime PM macro for auto-cleanup i2c: designware: Implement I2C_M_STOP support commit bc1d4e705f48f001f3a5480f04067c48bd00bcf0 Merge: d4a292c5f8e65d 89339d889d63a4 Author: Linus Torvalds Date: Fri Feb 20 15:47:44 2026 -0800 Merge tag 'sound-fix-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Here are a bunch of updates, but there should be no big surprises; mostly device-specific quirks and fix-ups or non-code changes: - Quirks for ASoC AMD, HD-audio and USB-audio - Fixes in ASoC fsl, rockchip, renesas, aw codecs - Fixes for USB-audio packet handling in the implicit feedback mode - Updates of SPDX license IDs in some files" * tag 'sound-fix-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (28 commits) ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models ASoC: amd: acp: Add ACP7.0 match entries for Realtek parts ALSA: echoaudio: Add SPDX ids to some files ALSA: isa: Add SPDX id lines to some files ALSA: core: Add SPDX license id to files ASoC: tas2783A: add explicit port prepare handling ASoC: renesas: rz-ssi: Fix playback and capture ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 ASoC: qcom: sm8250: Add quinary MI2S support ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR ALSA: usb-audio: Avoid potentially repeated XRUN error messages ALSA: usb-audio: Add sanity check for OOB writes at silencing ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling ALSA: usb-audio: Update the number of packets properly at receiving ... commit d4a292c5f8e65d2784b703c67179f4f7d0c7846c Merge: eee3666c92406f ae9e8654579709 Author: Linus Torvalds Date: Fri Feb 20 15:36:38 2026 -0800 Merge tag 'drm-next-2026-02-21' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "This is the fixes and cleanups for the end of the merge window, it's nearly all amdgpu, with some amdkfd, then a pagemap core fix, i915/xe display fixes, and some xe driver fixes. Nothing seems out of the ordinary, except amdgpu is a little more volume than usual. pagemap: - drm/pagemap: pass pagemap_addr by reference amdgpu: - DML 2.1 fixes - Panel replay fixes - Display writeback fixes - MES 11 old firmware compat fix - DC CRC improvements - DPIA fixes - XGMI fixes - ASPM fix - SMU feature bit handling fixes - DC LUT fixes - RAS fixes - Misc memory leak in error path fixes - SDMA queue reset fixes - PG handling fixes - 5 level GPUVM page table fix - SR-IOV fix - Queue reset fix - SMU 13.x fixes - DC resume lag fix - MPO fixes - DCN 3.6 fix - VSDB fixes - HWSS clean up - Replay fixes - DCE cursor fixes - DCN 3.5 SR DDR5 latency fixes - HPD fixes - Error path unwind fixes - SMU13/14 mode1 reset fixes - PSP 15 updates - SMU 15 updates - Sync fix in amdgpu_dma_buf_move_notify() - HAINAN fix - PSP 13.x fix - GPUVM locking fix - Fixes for DC analog support - DC FAMS fixes - DML 2.1 fixes - eDP fixes - Misc DC fixes - Fastboot fix - 3DLUT fixes - GPUVM fixes - 64bpp format fix - Fix for MacBooks with switchable gfx amdkfd: - Fix possible double deletion of validate list - Event setup fix - Device disconnect regression fix - APU GTT as VRAM fix - Fix piority inversion with MQDs - NULL check fix radeon: - HAINAN fix i915/xe display: - Regresion fix for HDR 4k displays (#15503) - Fixup for Dell XPS 13 7390 eDP rate limit - Memory leak fix on ACPI _DSM handling - Add missing slice count check during DP mode validation xe: - drm/xe: Prevent VFs from exposing the CCS mode sysfs file - SRIOV related fixes - PAT cache fix - MMIO read fix - W/a fixes - Adjust type of xe_modparam.force_vram_bar_size - Wedge mode fix - HWMon fix * tag 'drm-next-2026-02-21' of https://gitlab.freedesktop.org/drm/kernel: (143 commits) drm/amd/display: Remove unneeded DAC link encoder register drm/amd/display: Enable DAC in DCE link encoder drm/amd/display: Set CRTC source for DAC using registers drm/amd/display: Initialize DAC in DCE link encoder using VBIOS drm/amd/display: Turn off DAC in DCE link encoder using VBIOS drm/amd/display: Don't call find_analog_engine() twice drm/amdgpu: fix 4-level paging if GMC supports 57-bit VA v2 drm/amdgpu: keep vga memory on MacBooks with switchable graphics drm/amdgpu: Set atomics to true for xgmi drm/amdkfd: Check for NULL return values drm/amd/display: Use same max plane scaling limits for all 64 bpp formats drm/amdgpu: Set vmid0 PAGE_TABLE_DEPTH for GFX12.1 drm/amdkfd: Disable MQD queue priority drm/amd/display: Remove conditional for shaper 3DLUT power-on drm/amd/display: Check return of shaper curve to HW format drm/amd/display: Correct logic check error for fastboot drm/amd/display: Skip eDP detection when no sink Revert "drm/amd/display: Add Gfx Base Case For Linear Tiling Handling" Revert "drm/amd/display: Correct hubp GfxVersion verification" Revert "drm/amd/display: Add Handling for gfxversion DcGfxBase" ... commit eee3666c92406fd8e5e3084b0b3129528dfe9557 Merge: 68010e7b3daf0c 0f967cb8ea0448 Author: Linus Torvalds Date: Fri Feb 20 15:24:21 2026 -0800 Merge tag 'fbdev-for-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull more fbdev updates from Helge Deller: "Code cleanups for the au1100fb fbdev driver (Uwe Kleine-König)" * tag 'fbdev-for-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: au1100fb: Replace license boilerplate by SPDX header fbdev: au1100fb: Fold au1100fb.h into its only user fbdev: au1100fb: Replace custom printk wrappers by pr_* fbdev: au1100fb: Make driver compilable on non-mips platforms fbdev: au1100fb: Use proper conversion specifiers in printk formats fbdev: au1100fb: Mark several local functions as static fbdev: au1100fb: Don't store device specific data in global variables commit 68010e7b3daf0c2cf91eccb329703e82d1ef5aff Merge: b3f1da2a4d851b 9678e53179aa7e Author: Linus Torvalds Date: Fri Feb 20 15:05:26 2026 -0800 Merge tag 'trace-v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix possible dereference of uninitialized pointer When validating the persistent ring buffer on boot up, if the first validation fails, a reference to "head_page" is performed in the error path, but it skips over the initialization of that variable. Move the initialization before the first validation check. - Fix use of event length in validation of persistent ring buffer On boot up, the persistent ring buffer is checked to see if it is valid by several methods. One being to walk all the events in the memory location to make sure they are all valid. The length of the event is used to move to the next event. This length is determined by the data in the buffer. If that length is corrupted, it could possibly make the next event to check located at a bad memory location. Validate the length field of the event when doing the event walk. - Fix function graph on archs that do not support use of ftrace_ops When an architecture defines HAVE_DYNAMIC_FTRACE_WITH_ARGS, it means that its function graph tracer uses the ftrace_ops of the function tracer to call its callbacks. This allows a single registered callback to be called directly instead of checking the callback's meta data's hash entries against the function being traced. For architectures that do not support this feature, it must always call the loop function that tests each registered callback (even if there's only one). The loop function tests each callback's meta data against its hash of functions and will call its callback if the function being traced is in its hash map. The issue was that there was no check against this and the direct function was being called even if the architecture didn't support it. This meant that if function tracing was enabled at the same time as a callback was registered with the function graph tracer, its callback would be called for every function that the function tracer also traced, even if the callback's meta data only wanted to be called back for a small subset of functions. Prevent the direct calling for those architectures that do not support it. - Fix references to trace_event_file for hist files The hist files used event_file_data() to get a reference to the associated trace_event_file the histogram was attached to. This would return a pointer even if the trace_event_file is about to be freed (via RCU). Instead it should use the event_file_file() helper that returns NULL if the trace_event_file is marked to be freed so that no new references are added to it. - Wake up hist poll readers when an event is being freed When polling on a hist file, the task is only awoken when a hist trigger is triggered. This means that if an event is being freed while there's a task waiting on its hist file, it will need to wait until the hist trigger occurs to wake it up and allow the freeing to happen. Note, the event will not be completely freed until all references are removed, and a hist poller keeps a reference. But it should still be woken when the event is being freed. * tag 'trace-v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Wake up poll waiters for hist files when removing an event tracing: Fix checking of freed trace_event_file for hist files fgraph: Do not call handlers direct when not using ftrace_ops tracing: ring-buffer: Fix to check event length before using ring-buffer: Fix possible dereference of uninitialized pointer commit b3f1da2a4d851b8e1ccf932e52c6772fe2253a47 Merge: 233a0c0f449830 ecb7c2484cfc83 Author: Linus Torvalds Date: Fri Feb 20 14:57:09 2026 -0800 Merge tag 'for-7.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - multiple error handling fixes of unexpected conditions - reset block group size class once it becomes empty so that its class can be changed - error message level adjustments - fixes of returned error values - use correct block reserve for delayed refs * tag 'for-7.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found btrfs: fix lost error return in btrfs_find_orphan_roots() btrfs: fix lost return value on error in finish_verity() btrfs: change unaligned root messages to error level in btrfs_validate_super() btrfs: use the correct type to initialize block reserve for delayed refs btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() btrfs: reset block group size class when it becomes empty btrfs: replace BUG() with error handling in __btrfs_balance() btrfs: handle unexpected exact match in btrfs_set_inode_index_count() commit 233a0c0f4498309f98d98a4b6543fa05a12d9587 Merge: 219d7660c57ec7 99853d9daef240 Author: Linus Torvalds Date: Fri Feb 20 14:46:31 2026 -0800 Merge tag 'ecryptfs-7.0-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs Pull ecryptfs updates from Tyler Hicks: "This consists of some really minor typo fixes that fell through the cracks and some more recent code cleanups: - Comment typo fixes - Removal of an unused function declaration - Use strscpy() instead of the deprecated strcpy() - Use string copying helpers instead of memcpy() and manually terminating strings" * tag 'ecryptfs-7.0-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs: ecryptfs: Replace memcpy + NUL termination in ecryptfs_copy_filename ecryptfs: Drop redundant NUL terminations after calling ecryptfs_to_hex ecryptfs: Replace memcpy + NUL termination in ecryptfs_new_file_context ecryptfs: Replace strcpy with strscpy in ecryptfs_validate_options ecryptfs: Replace strcpy with strscpy in ecryptfs_cipher_code_to_string ecryptfs: Replace strcpy with strscpy in ecryptfs_set_default_crypt_stat_vals ecryptfs: simplify list initialization in ecryptfs_parse_packet_set() ecryptfs: Remove unused declartion ecryptfs_fill_zeros() ecryptfs: Fix packet format comment in parse_tag_67_packet() ecryptfs: comment typo fix ecryptfs: keystore: Fix typo 'the the' in comment commit 8c1f92ca8bca3ce2d2c085571af89503bc7bc7c4 Author: Koichiro Den Date: Wed Jan 7 13:24:58 2026 +0900 NTB: ntb_transport: Use seq_file for QP stats debugfs The ./qp*/stats debugfs file for each NTB transport QP is currently implemented with a hand-crafted kmalloc() buffer and a series of scnprintf() calls. This is a pre-seq_file style pattern and makes future extensions easy to truncate. Convert the stats file to use the seq_file helpers via DEFINE_SHOW_ATTRIBUTE(), which simplifies the code and lets the seq_file core handle buffering and partial reads. Reviewed-by: Frank Li Reviewed-by: Dave Jiang Signed-off-by: Koichiro Den Signed-off-by: Jon Mason commit 6a4b50585d74fe45d3ade1e3e86ba8aae79761a5 Author: Koichiro Den Date: Wed Jan 7 13:24:57 2026 +0900 NTB: ntb_transport: Fix too small buffer for debugfs_name The buffer used for "qp%d" was only 4 bytes, which truncates names like "qp10" to "qp1" and causes multiple queues to share the same directory. Enlarge the buffer and use sizeof() to avoid truncation. Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support") Cc: # v3.9+ Reviewed-by: Frank Li Reviewed-by: Dave Jiang Signed-off-by: Koichiro Den Signed-off-by: Jon Mason commit 21fbdc4d0b1e7f9cabacc3587d07c62e01c7b5e8 Author: yangqixiao Date: Tue Dec 30 20:46:56 2025 +0800 ntb/ntb_tool: correct sscanf format for u64 and size_t in tool_peer_mw_trans_write The sscanf() call in tool_peer_mw_trans_write() uses "%lli:%zi" to parse user input into 'u64 addr' and 'size_t wsize'. This is incorrect: - "%lli" expects a signed long long *, but 'addr' is u64 (unsigned). Input like "0x8000000000000000" is misinterpreted as negative, leading to corrupted address values. - "%zi" expects a signed ssize_t *, but 'wsize' is size_t (unsigned). Input of "-1" is successfully parsed and stored as SIZE_MAX (e.g., 0xFFFFFFFFFFFFFFFF), which may cause buffer overflows or infinite loops in subsequent memory operations. Fix by using format specifiers that match the actual variable types: - "%llu" for u64 (supports hex/decimal, standard for kernel u64 parsing) - "%zu" for size_t (standard and safe; rejects negative input) Signed-off-by: yangqixiao Reviewed-by: Dave Jiang Signed-off-by: Jon Mason commit 4921811678e93a83cbfebc14814a165ae794bf1d Author: Dave Jiang Date: Thu Jan 8 14:21:01 2026 -0700 ntb: intel: Add Intel Gen6 NTB support for DiamondRapids Add DiamondRapids NTB support by adding the DID and adjust the changed PPD0 offset. Signed-off-by: Dave Jiang Signed-off-by: Jon Mason commit 7bd27439a578bb7724a9f09f240337ab95d68d2b Author: Dr. David Alan Gilbert Date: Thu Feb 20 02:03:57 2025 +0000 NTB/msi: Remove unused functions ntbm_msi_free_irq() and ntb_msi_peer_addr() were both added in 2019's commit 26b3a37b9284 ("NTB: Introduce MSI library") but have remained unused. Remove them, and the ntbm_msi_callback_match() helper that was used by ntbm_msi_free_irq(). Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Jon Mason commit b1f4077465b2110d8a486cd6f1aed0c2569c339a Author: Maciej Grochowski Date: Thu Feb 13 14:53:19 2025 -0800 ntb: ntb_hw_switchtec: Increase MAX_MWS limit to 256 Microchip NTB switchtec devices supports up to 512 LUT's across all NT partitions. This patch enable symmetric NTB configuration to utilize all 512 memory windows across 2 peers partitions. Signed-off-by: Maciej Grochowski Signed-off-by: Jon Mason commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface Author: Maciej Grochowski Date: Thu Feb 13 14:53:18 2025 -0800 ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, This patch protects against invalid index out of bounds access to mw_sizes When invalid access print message to user that configuration is not valid. Signed-off-by: Maciej Grochowski Signed-off-by: Jon Mason commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 Author: Maciej Grochowski Date: Thu Feb 13 14:53:17 2025 -0800 ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut Number of MW LUTs depends on NTB configuration and can be set to zero, in such scenario rounddown_pow_of_two will cause undefined behaviour and should not be performed. This patch ensures that rounddown_pow_of_two is called on valid value. Signed-off-by: Maciej Grochowski Signed-off-by: Jon Mason commit f39e7d0e7f0dc3f8886d957d268eb5c5b28ddf97 Author: Baruch Siach Date: Mon Nov 3 09:44:55 2025 +0200 NTB: epf: allow built-in build ntb_hw_epf works just as well when built into the kernel image. Don't force module build. Signed-off-by: Baruch Siach Signed-off-by: Jon Mason commit c722e055d8630683177c46738f41fe5fbb0e5045 Author: Chu Guangqing Date: Fri Oct 24 14:20:42 2025 +0800 ntb: migrate to dma_map_phys instead of map_page After introduction of dma_map_phys(), there is no need to convert from physical address to struct page in order to map page. So let's use it directly. Signed-off-by: Chu Guangqing Signed-off-by: Jon Mason commit 322617a06c97153f7b0681ecaa55490abccff7fa Author: Koichiro Den Date: Thu Oct 23 16:21:05 2025 +0900 NTB: ntb_transport: Add 'tx_memcpy_offload' module option Some platforms (e.g. R-Car S4) do not gain from using a DMAC on TX path in ntb_transport and end up CPU-bound on memcpy_toio(). Add a module parameter 'tx_memcpy_offload' that moves the TX memcpy_toio() and descriptor writes to a per-QP kernel thread. It is disabled by default. This change also fixes a rare ordering hazard in ntb_tx_copy_callback(), that was observed on R-Car S4 once throughput improved with the new module parameter: the DONE flag write to the peer MW, which is WC mapped, could be observed after the DB/MSI trigger. Both operations are posted PCIe MWr (often via different OB iATUs), so WC buffering and bridges may reorder visibility. Insert dma_mb() to enforce store->load ordering and then read back hdr->flags to flush the posted write before ringing the doorbell / issuing MSI. While at it, update tx_index with WRITE_ONCE() at the earlier possible location to make ntb_transport_tx_free_entry() robust. Signed-off-by: Koichiro Den Signed-off-by: Jon Mason commit b36490b5fb9866295cc13808b04a968b13acbab3 Author: Koichiro Den Date: Thu Oct 23 16:21:04 2025 +0900 NTB: ntb_transport: Remove unused 'retries' field from ntb_queue_entry Drop the unused field 'retries' from struct ntb_queue_entry for simplicity's sake. Signed-off-by: Koichiro Den Signed-off-by: Jon Mason commit 969c3cca0f3b88682cd833cee4cf01b0915629a3 Author: Andreas Gabriel-Platschek Date: Mon Feb 9 06:34:39 2026 +0100 rtc: ds1390: fix number of bytes read from RTC The spi_write_then_read() reads 8 bytes starting from DS1390_REG_SECONDS (== 0x01), so the last byte read would already be part of the alarm (Tenths and Hundredths of Seconds) feature. However 7 bytes are engouh -- seconds (0x01), minutes (0x02), hours (0x03), day (0x04), date (0x05), month/century (0x06) and year (0x07). Signed-off-by: Andreas Gabriel-Platschek Link: https://patch.msgid.link/20260209053439.313825-1-andi.platschek@gmail.com Signed-off-by: Alexandre Belloni commit 76e8919aef2dca25a07a0d6480e486ebe5e9ea79 Author: Jinjie Ruan Date: Thu Jan 22 17:00:31 2026 +0800 rtc: class: Remove duplicate check for alarm In __devm_rtc_register_device(), the callee rtc_initialize_alarm() will check the alarm, there is no need to check in advance, so remove it. Signed-off-by: Jinjie Ruan Link: https://patch.msgid.link/20260122090031.3871746-1-ruanjinjie@huawei.com Signed-off-by: Alexandre Belloni commit d1f64cdfafdbd3fe220a59b85f13e125f49ce73e Author: Rouven Czerwinski Date: Mon Jan 26 11:11:26 2026 +0100 rtc: optee: simplify OP-TEE context match Simplify the TEE implementor ID match by returning the boolean expression directly instead of going through an if/else. Signed-off-by: Rouven Czerwinski Link: https://patch.msgid.link/20260126-optee-simplify-context-match-v1-3-d4104e526cb6@linaro.org Signed-off-by: Alexandre Belloni commit 219d7660c57ec7457a6020f3d025cfe1139ffc64 Merge: 43257b2ebd1f08 08020dbe3125e9 Author: Linus Torvalds Date: Fri Feb 20 14:06:06 2026 -0800 Merge tag 'apparmor-pr-2026-02-18' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull AppArmor updates from John Johansen: "Features: - add .kunitconfig - audit execpath in userns mediation - add support loading per permission tagging Cleanups: - remove unused percpu critical sections in buffer management - document the buffer hold, add an overflow guard - split xxx_in_ns into its two separate semantic use cases - remove apply_modes_to_perms from label_match - refactor/cleanup cred helper fns. - guard against free attachment/data routines being called with NULL - drop in_atomic flag in common_mmap, common_file_perm, and cleanup - make str table more generic and be able to have multiple entries - Replace deprecated strcpy with memcpy in gen_symlink_name - Replace deprecated strcpy in d_namespace_path - Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init - replace sprintf with snprintf in aa_new_learning_profile Bug Fixes: - fix cast in format string DEBUG statement - fix make aa_labelmatch return consistent - fix fmt string type error in process_strs_entry - fix kernel-doc comments for inview - fix invalid deref of rawdata when export_binary is unset - avoid per-cpu hold underflow in aa_get_buffer - fix fast path cache check for unix sockets - fix rlimit for posix cpu timers - fix label and profile debug macros - move check for aa_null file to cover all cases - return -ENOMEM in unpack_perms_table upon alloc failure - fix boolean argument in apparmor_mmap_file - Fix & Optimize table creation from possibly unaligned memory - Allow apparmor to handle unaligned dfa tables - fix NULL deref in aa_sock_file_perm - fix NULL pointer dereference in __unix_needs_revalidation - fix signedness bug in unpack_tags()" * tag 'apparmor-pr-2026-02-18' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (34 commits) apparmor: fix signedness bug in unpack_tags() apparmor: fix cast in format string DEBUG statement apparmor: fix aa_label to return state from compount and component match apparmor: fix fmt string type error in process_strs_entry apparmor: fix kernel-doc comments for inview apparmor: fix invalid deref of rawdata when export_binary is unset apparmor: add .kunitconfig apparmor: cleanup remove unused percpu critical sections in buffer management apparmor: document the buffer hold, add an overflow guard apparmor: avoid per-cpu hold underflow in aa_get_buffer apparmor: split xxx_in_ns into its two separate semantic use cases apparmor: make label_match return a consistent value apparmor: remove apply_modes_to_perms from label_match apparmor: fix fast path cache check for unix sockets apparmor: fix rlimit for posix cpu timers apparmor: refactor/cleanup cred helper fns. apparmor: fix label and profile debug macros apparmor: move check for aa_null file to cover all cases apparmor: guard against free routines being called with a NULL apparmor: return -ENOMEM in unpack_perms_table upon alloc failure ... commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 Author: Anthony Pighin (Nokia) Date: Tue Nov 25 17:35:19 2025 +0000 rtc: interface: Alarm race handling should not discard preceding error Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") should not discard any errors from the preceding validations. Prior to that commit, if the alarm feature was disabled, or the set_alarm failed, a meaningful error code would be returned to the caller for further action. After, more often than not, the __rtc_read_time will cause a success return code instead, misleading the caller. An example of this is when timer_enqueue is called for a rtc-abx080x device. Since that driver does not clear the alarm feature bit, but instead relies on the set_alarm operation to return invalid, the discard of the return code causes very different behaviour; i.e. hwclock: select() to /dev/rtc0 to wait for clock tick timed out Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm") Signed-off-by: Anthony Pighin (Nokia) Reviewed-by: Esben Haabendal Tested-by: Nick Bowler Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com Signed-off-by: Alexandre Belloni commit 43257b2ebd1f08536e3a8c06e2946af902015162 Merge: a95f71ad3e2e22 c732084c891d89 Author: Linus Torvalds Date: Fri Feb 20 12:51:07 2026 -0800 Merge tag 'kmalloc_obj-prep-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kmalloc_obj prep from Kees Cook: "Fixes for return types to prepare for the kmalloc_obj treewide conversion, that haven't yet appeared during the merge window: dm-crypt, dm-zoned, drm/msm, and arm64 kvm" * tag 'kmalloc_obj-prep-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: KVM: arm64: vgic: Handle const qualifier from gic_kvm_info allocation type drm/msm: Adjust msm_iommu_pagetable_prealloc_allocate() allocation type dm: dm-zoned: Adjust dmz_load_mapping() allocation type dm-crypt: Adjust crypt_alloc_tfms_aead() allocation type commit ae9e8654579709c2f10b8c86a8467e1710d4599f Merge: 7a4a583db62818 2d01d88a532b88 Author: Dave Airlie Date: Sat Feb 21 06:30:06 2026 +1000 Merge tag 'drm-xe-next-fixes-2026-02-19' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - drm/xe: Prevent VFs from exposing the CCS mode sysfs file (Nareshkumar) Cross-subsystem Changes: - drm/pagemap: pass pagemap_addr by reference (Arnd) Driver Changes: - SRIOV related fixes (Michal, Piotr) - PAT cache fix (Jia) - MMIO read fix (Shuicheng) - W/a fixes (Roper) - Adjust type of xe_modparam.force_vram_bar_size (Shuicheng) - Wedge mode fix (Raag) - HWMon fix (Karthik) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aZeR6CXDRbeudIVR@intel.com commit a95f71ad3e2e224277508e006580c333d0a5fe36 Merge: f283371efd6a0e 561f60dfd1c10a Author: Linus Torvalds Date: Fri Feb 20 12:21:00 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM updates from Russell King: - avoid %pK for ARM MM prints - implement ARCH_HAS_CC_CAN_LINK to ensure runnable user progs - handle BE8 and BE32 for user progs * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9470/1: Handle BE8 vs BE32 in ARCH_CC_CAN_LINK ARM: 9469/1: Implement ARCH_HAS_CC_CAN_LINK ARM: 9467/1: mm: Don't use %pK through printk commit 7a4a583db62818a362c5721a7b4624248f967647 Merge: 7b5570df351317 777a02812f739a Author: Dave Airlie Date: Sat Feb 21 06:13:33 2026 +1000 Merge tag 'drm-intel-next-fixes-2026-02-20' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Add missing slice count check during DP mode validation Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/aZgb43cDcTPBYssk@jlahtine-mobl commit f283371efd6a0ec1713349cd8c12fa5ffb19c60a Merge: a27a5c0f080394 948a013a54c47d Author: Linus Torvalds Date: Fri Feb 20 12:04:40 2026 -0800 Merge tag 'efi-fixes-for-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: "Mixed bag of EFI tweaks and bug fixes: - Add a missing symbol export spotted by Arnd's randconfig testing - Fix kexec from a kernel booted with 'noefi' - Fix memblock handling of the unaccepted memory table - Constify an occurrence of struct efivar_operations - Add Ilias as EFI reviewer" * tag 'efi-fixes-for-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: Align unaccepted memory range to page boundary efi: Fix reservation of unaccepted memory table MAINTAINERS: Add a reviewer entry for EFI efi: stmm: Constify struct efivar_operations x86/kexec: Copy ACPI root pointer address from config table efi: export sysfb_primary_display for EDID commit 7b5570df351317f9c74719e8a23fa3aec0739178 Merge: 3e2138510b2ad5 3ce2ad267079fc Author: Dave Airlie Date: Sat Feb 21 05:55:40 2026 +1000 Merge tag 'amd-drm-next-6.20-2026-02-19' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.20-2026-02-19: amdgpu: - Fixes for DC analog support - DC FAMS fixes - DML 2.1 fixes - eDP fixes - Misc DC fixes - Fastboot fix - 3DLUT fixes - GPUVM fixes - 64bpp format fix - XGMI fix - Fix for MacBooks with switchable gfx amdkfd: - Fix piority inversion with MQDs - NULL check fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260219172807.2451298-1-alexander.deucher@amd.com commit a27a5c0f08039475e21f3517e1bfe4a05bb82887 Merge: 9806790115d194 729a2e8e9ac470 Author: Linus Torvalds Date: Fri Feb 20 09:44:39 2026 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Two arm64 fixes: one fixes a warning that started showing up with gcc 16 and the other fixes a lockup in udelay() when running on a vCPU loaded on a CPU with the new-fangled WFIT instruction: - Fix compiler warning from huge_pte_clear() with GCC 16 - Fix hang in udelay() on systems with WFIT by consistently using the virtual counter to calculate the delta" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) arm64: Force the use of CNTVCT_EL0 in __delay() commit 9806790115d1949ee0bd6ef8533293b5a293a1bb Merge: 9abf79529f4c4b 123d2e75a14e8a Author: Linus Torvalds Date: Fri Feb 20 09:24:45 2026 -0800 Merge tag 's390-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Heiko Carstens: - Make KEXEC_SIG available again for CONFIG_MODULES=n - The s390 topology code used to call rebuild_sched_domains() before common code scheduling domains were setup. This was silently ignored by common code, but now results in a warning. Address by avoiding the early call - Convert debug area lock from spinlock to raw spinlock to address lockdep warnings - The recent 3490 tape device driver rework resulted in a different device driver name, which is visible via sysfs for user space. This breaks at least one user space application. Change the device driver name back to its old name to fix this * tag 's390-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/tape: Fix device driver name s390/debug: Convert debug area lock from a spinlock to a raw spinlock s390/smp: Avoid calling rebuild_sched_domains() early s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n commit 9abf79529f4c4bc43464dcb82bfcc16297f90cc6 Merge: c8cb804a8add8d 0d4b3ca115b543 Author: Linus Torvalds Date: Fri Feb 20 09:16:09 2026 -0800 Merge tag 'xtensa-20260219' of https://github.com/jcmvbkbc/linux-xtensa Pull Xtensa update from Max Filippov: - fix unhandled case in the load/store fault handler in configurations with MMU * tag 'xtensa-20260219' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: align: validate access in fast_load_store commit c8cb804a8add8d6f41b3805441b2ad16e30fbcc0 Merge: d31558c077d8be 5043d7ed39dfdc Author: Linus Torvalds Date: Fri Feb 20 08:57:35 2026 -0800 Merge tag 'for-linus-7.0-rc1a-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fix from Juergen Gross: "A single patch fixing a boot regression when running as a Xen PV guest. This issue was introduced in this merge window" * tag 'for-linus-7.0-rc1a-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86/xen: Fix Xen PV guest boot commit d31558c077d8be422b65e97974017c030b4bd91a Merge: 8bf22c33e7a172 158ebb578cd5f7 Author: Linus Torvalds Date: Fri Feb 20 08:48:31 2026 -0800 Merge tag 'hyperv-next-signed-20260218' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V updates from Wei Liu: - Debugfs support for MSHV statistics (Nuno Das Neves) - Support for the integrated scheduler (Stanislav Kinsburskii) - Various fixes for MSHV memory management and hypervisor status handling (Stanislav Kinsburskii) - Expose more capabilities and flags for MSHV partition management (Anatol Belski, Muminul Islam, Magnus Kulke) - Miscellaneous fixes to improve code quality and stability (Carlos López, Ethan Nelson-Moore, Li RongQing, Michael Kelley, Mukesh Rathor, Purna Pavan Chandra Aekkaladevi, Stanislav Kinsburskii, Uros Bizjak) - PREEMPT_RT fixes for vmbus interrupts (Jan Kiszka) * tag 'hyperv-next-signed-20260218' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: (34 commits) mshv: Handle insufficient root memory hypervisor statuses mshv: Handle insufficient contiguous memory hypervisor status mshv: Introduce hv_deposit_memory helper functions mshv: Introduce hv_result_needs_memory() helper function mshv: Add SMT_ENABLED_GUEST partition creation flag mshv: Add nested virtualization creation flag Drivers: hv: vmbus: Simplify allocation of vmbus_evt mshv: expose the scrub partition hypercall mshv: Add support for integrated scheduler mshv: Use try_cmpxchg() instead of cmpxchg() x86/hyperv: Fix error pointer dereference x86/hyperv: Reserve 3 interrupt vectors used exclusively by MSHV Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT x86/hyperv: Remove ASM_CALL_CONSTRAINT with VMMCALL insn x86/hyperv: Use savesegment() instead of inline asm() to save segment registers mshv: fix SRCU protection in irqfd resampler ack handler mshv: make field names descriptive in a header struct x86/hyperv: Update comment in hyperv_cleanup() mshv: clear eventfd counter on irqfd shutdown x86/hyperv: Use memremap()/memunmap() instead of ioremap_cache()/iounmap() ... commit 0d195d3b205ca90db30d70d09d7bb6909aac178f Author: Christoph Böhmwalder Date: Fri Feb 20 12:39:37 2026 +0100 drbd: fix null-pointer dereference on local read error In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to __req_mod() with a NULL peer_device: __req_mod(req, what, NULL, &m); The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this NULL peer_device to drbd_set_out_of_sync(), which dereferences it, causing a null-pointer dereference. Fix this by obtaining the peer_device via first_peer_device(device), matching how drbd_req_destroy() handles the same situation. Cc: stable@vger.kernel.org Reported-by: Tuo Li Link: https://lore.kernel.org/linux-block/20260104165355.151864-1-islituo@gmail.com Signed-off-by: Christoph Böhmwalder Signed-off-by: Jens Axboe commit 803ec1faf7c1823e6e3b1f2aaa81be18528c9436 Author: Osama Abdelkader Date: Mon Feb 9 19:41:14 2026 +0100 drm/bridge: samsung-dsim: Fix memory leak in error path In samsung_dsim_host_attach(), drm_bridge_add() is called to add the bridge. However, if samsung_dsim_register_te_irq() or pdata->host_ops->attach() fails afterwards, the function returns without removing the bridge, causing a memory leak. Fix this by adding proper error handling with goto labels to ensure drm_bridge_remove() is called in all error paths. Also ensure that samsung_dsim_unregister_te_irq() is called if the attach operation fails after the TE IRQ has been registered. samsung_dsim_unregister_te_irq() function is moved without changes to be before samsung_dsim_host_attach() to avoid forward declaration. Fixes: e7447128ca4a ("drm: bridge: Generalize Exynos-DSI driver into a Samsung DSIM bridge") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260209184115.10937-1-osama.abdelkader@gmail.com Signed-off-by: Luca Ceresoli commit 496daa2759260374bb9c9b2196a849aa3bc513a8 Author: Chen Ni Date: Fri Feb 6 12:06:21 2026 +0800 drm/bridge: synopsys: dw-dp: Check return value of devm_drm_bridge_add() in dw_dp_bind() Return the value of devm_drm_bridge_add() in order to propagate the error properly, if it fails due to resource allocation failure or bridge registration failure. This ensures that the bind function fails safely rather than proceeding with a potentially incomplete bridge setup. Fixes: b726970486d8 ("drm/bridge: synopsys: dw-dp: add bridge before attaching") Signed-off-by: Chen Ni Reviewed-by: Andy Yan Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260206040621.4095517-1-nichen@iscas.ac.cn Signed-off-by: Luca Ceresoli commit c5f8658f97ec392eeaf355d4e9775ae1f23ca1d3 Author: Chen Ni Date: Wed Feb 4 17:06:29 2026 +0800 drm/imx: parallel-display: check return value of devm_drm_bridge_add() in imx_pd_probe() Return the value of devm_drm_bridge_add() in order to propagate the error properly, if it fails due to resource allocation failure or bridge registration failure. This ensures that the probe function fails safely rather than proceeding with a potentially incomplete bridge setup. Fixes: bf7e97910b9f ("drm/imx: parallel-display: add the bridge before attaching it") Signed-off-by: Chen Ni Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260204090629.2209542-1-nichen@iscas.ac.cn Signed-off-by: Luca Ceresoli commit 75f3cf0d1561b0a1cfa97ee35d78ca0118e584d5 Author: Mikhail Gavrilov Date: Mon Feb 16 22:27:07 2026 +0500 rv: Fix multiple definition of __pcpu_unique_da_mon_this The refactoring in commit 30984ccf31b7 ("rv: Refactor da_monitor to minimise macros") replaced per-monitor unique variable names (da_mon_##name) with a fixed name (da_mon_this). While this works for 'static' variables (each translation unit gets its own copy), DEFINE_PER_CPU internally generates a non-static dummy variable __pcpu_unique_ for each per-cpu definition. The requirement for this variable to be unique although static exists for modules on specific architectures (alpha) and if the kernel is built with CONFIG_DEBUG_FORCE_WEAK_PER_CPU (e.g. Fedora's debug kernel). When multiple per-cpu monitors (e.g. sco and sts) are built-in simultaneously, they all produce the same __pcpu_unique_da_mon_this symbol, causing a link error: ld: kernel/trace/rv/monitors/sts/sts.o: multiple definition of `__pcpu_unique_da_mon_this'; kernel/trace/rv/monitors/sco/sco.o: first defined here Fix this by introducing a DA_MON_NAME macro that expands to a per-monitor unique name (da_mon_) via the existing CONCATENATE helper. This restores the uniqueness that was present before the refactoring. Fixes: 30984ccf31b7 ("rv: Refactor da_monitor to minimise macros") Reviewed-by: Gabriele Monaco Signed-off-by: Mikhail Gavrilov Link: https://lore.kernel.org/r/20260216172707.1441516-1-mikhail.v.gavrilov@gmail.com Signed-off-by: Gabriele Monaco commit f6a495484a27150fb85f943e1a7464da88c2a797 Author: Ethan Tidmore Date: Thu Feb 19 16:10:01 2026 -0600 proc: Fix pointer error dereference The function try_lookup_noperm() can return an error pointer. Add check for error pointer. Detected by Smatch: fs/proc/base.c:2148 proc_fill_cache() error: 'child' dereferencing possible ERR_PTR() Fixes: 1df98b8bbcca ("proc_fill_cache(): clean up, get rid of pointless find_inode_number() use") Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260219221001.1117135-1-ethantidmore06@gmail.com Signed-off-by: Christian Brauner commit 97b281d7edb2ae662365be2809cd728470119720 Author: Philipp Stanner Date: Mon Feb 16 14:16:15 2026 +0100 rust: list: Add unsafe blocks for container_of and safety comments impl_list_item_mod.rs calls container_of! without unsafe blocks at a couple of places. Since container_of! is unsafe, the blocks are strictly necessary. The problem was so far not visible because the "unsafe-op-in-unsafe-fn" check is a lint rather than a hard compiler error, and Rust suppresses lints triggered inside of a macro from another crate. Thus, the error becomes only visible once someone from within the kernel crate tries to use linked lists: error[E0133]: call to unsafe function `core::ptr::mut_ptr::::byte_sub` is unsafe and requires unsafe block --> rust/kernel/lib.rs:252:29 | 252 | let container_ptr = field_ptr.byte_sub(offset).cast::<$Container>(); | ^^^^^^^^^^^^^^^^^^^^^^^^^^ call to unsafe function | ::: rust/kernel/drm/jq.rs:98:1 | 98 | / impl_list_item! { 99 | | impl ListItem<0> for BasicItem { using ListLinks { self.links }; } 100 | | } | |_- in this macro invocation | note: an unsafe function restricts its caller, but its body is safe by default --> rust/kernel/list/impl_list_item_mod.rs:216:13 | 216 | unsafe fn view_value(me: *mut $crate::list::ListLinks<$num>) -> *const Self { | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | ::: rust/kernel/drm/jq.rs:98:1 | 98 | / impl_list_item! { 99 | | impl ListItem<0> for BasicItem { using ListLinks { self.links }; } 100 | | } | |_- in this macro invocation = note: requested on the command line with `-D unsafe-op-in-unsafe-fn` = note: this error originates in the macro `$crate::container_of` which comes from the expansion of the macro `impl_list_item` Therefore, add unsafe blocks to container_of! calls to fix the issue. [ As discussed, let's fix the build for those that want to use the macro within the `kernel` crate now and we can discuss the proper safety comments afterwards. Thus I removed the ones from the patch. However, we cannot just avoid the comments with `CLIPPY=1`, so I provided placeholders for now, like we did in the past. They were also needed for an `unsafe impl`. While I am not happy about it, it isn't worse than the current status (the comments were meant to be there), and at least this shows what is missing -- our pre-existing "good first issue" [1] may motivate new contributors to complete them properly. Finally, I moved one of the existing safety comments one line down so that Clippy could locate it. Link: https://github.com/Rust-for-Linux/linux/issues/351 [1] - Miguel ] Cc: stable@vger.kernel.org Fixes: c77f85b347dd ("rust: list: remove OFFSET constants") Suggested-by: Alice Ryhl Signed-off-by: Philipp Stanner Reviewed-by: Gary Guo Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260216131613.45344-3-phasta@kernel.org [ Fixed formatting. Reworded to fix the lint suppression explanation. Indent build error. - Miguel ] Signed-off-by: Miguel Ojeda commit bfd264fbbbca7a39ea430d7bc2baf8ee2ea958e4 Author: Vladimir Oltean Date: Wed Feb 18 18:05:51 2026 +0200 net: dsa: sja1105: protect link replay helpers against NULL phylink instance There is a crash when unbinding the sja1105 driver under special circumstances: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 Call trace: phylink_run_resolve_and_disable+0x10/0x90 sja1105_static_config_reload+0xc0/0x410 sja1105_vlan_filtering+0x100/0x140 dsa_port_vlan_filtering+0x13c/0x368 dsa_port_reset_vlan_filtering.isra.0+0xe8/0x198 dsa_port_bridge_leave+0x130/0x248 dsa_user_changeupper.part.0+0x74/0x158 dsa_user_netdevice_event+0x50c/0xa50 notifier_call_chain+0x78/0x148 raw_notifier_call_chain+0x20/0x38 call_netdevice_notifiers_info+0x58/0xa8 __netdev_upper_dev_unlink+0xac/0x220 netdev_upper_dev_unlink+0x38/0x70 del_nbp+0x1a4/0x320 br_del_if+0x3c/0xd8 br_device_event+0xf8/0x2d8 notifier_call_chain+0x78/0x148 raw_notifier_call_chain+0x20/0x38 call_netdevice_notifiers_info+0x58/0xa8 unregister_netdevice_many_notify+0x314/0x848 unregister_netdevice_queue+0xe8/0xf8 dsa_user_destroy+0x50/0xa8 dsa_port_teardown+0x80/0x98 dsa_switch_teardown_ports+0x4c/0xb8 dsa_switch_deinit+0x94/0xb8 dsa_switch_put_tree+0x2c/0xc0 dsa_unregister_switch+0x38/0x60 sja1105_remove+0x24/0x40 spi_remove+0x38/0x60 device_remove+0x54/0x90 device_release_driver_internal+0x1d4/0x230 device_driver_detach+0x20/0x38 unbind_store+0xbc/0xc8 ---[ end trace 0000000000000000 ]--- which requires an explanation. When a port offloads a bridge, the switch must be reset to change the VLAN awareness state (the SJA1105_VLAN_FILTERING reason for sja1105_static_config_reload()). When the port leaves a VLAN-aware bridge, it must also be reset for the same reason: it is returning to operation as a VLAN-unaware standalone port. sja1105_static_config_reload() triggers the phylink link replay helpers. Because sja1105 is a switch, it has multiple user ports. During unbind, ports are torn down one by one in dsa_switch_teardown_ports() -> dsa_port_teardown() -> dsa_user_destroy(). The crash happens when the first user port is not part of the VLAN-aware bridge, but any other user port is. Tearing down the first user port causes phylink_destroy() to be called on dp->pl, and this pointer to be set to NULL. Then, when the second user port is torn down, this was offloading a VLAN-aware bridge port, so indirectly it will trigger sja1105_static_config_reload(). The latter function iterates using dsa_switch_for_each_available_port(), and unconditionally dereferences dp->pl, including for the aforementioned torn down previous port, and passes that to phylink. This is where the NULL pointer is coming from. There are multiple levels at which this could be avoided: - add an "if (dp->pl)" in sja1105_static_config_reload() - make the phylink replay helpers NULL-tolerant - mark ports as DSA_PORT_TYPE_UNUSED after dsa_port_phylink_destroy() has run, such that subsequent dsa_switch_for_each_available_port() iterations skip them - disconnect the entire switch at once from switchdev and NETDEV_CHANGEUPPER events while unbinding, not just port by port, likely using a "ds->unbinding = true" mechanism or similar however options 3 and 4 are quite heavy and might have side effects. Although 2 allows to keep the driver simpler, the phylink API it not NULL-tolerant in general and is not responsible for the NULL pointer (this is something done by dsa_port_phylink_destroy()). So I went with 1. Functionally speaking, skipping the replay helpers for ports without a phylink instance is fine, because that only happens during driver removal (an operation which cannot be cancelled). The ports are not required to work (although they probably still will - untested assumption - as long as we don't overwrite the last port speed with SJA1105_SPEED_AUTO). Fixes: 0b2edc531e0b ("net: dsa: sja1105: let phylink help with the replay of link callbacks") Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260218160551.194782-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit f1e2f0ce704e4a14e3f367d3b97d3dd2d8e183b7 Author: Martin Pålsson Date: Wed Feb 18 05:28:22 2026 +0000 net: usb: lan78xx: scan all MDIO addresses on LAN7801 The LAN7801 is designed exclusively for external PHYs (unlike the LAN7800/LAN7850 which have internal PHYs), but lan78xx_mdio_init() restricts PHY scanning to MDIO addresses 0-7 by setting phy_mask to ~(0xFF). This prevents discovery of external PHYs wired to addresses outside that range. One such case is the DP83TC814 100BASE-T1 PHY, which is typically configured at MDIO address 10 via PHYAD bootstrap pins and goes undetected with the current mask. Remove the restrictive phy_mask assignment for the LAN7801 so that the default mask of 0 applies, allowing all 32 MDIO addresses to be scanned during bus registration. Fixes: 02dc1f3d613d ("lan78xx: add LAN7801 MAC only support") Signed-off-by: Martin Pålsson Link: https://patch.msgid.link/0110019c6f388aff-98d99cf0-4425-4fff-b16b-dea5ad8fafe0-000000@eu-north-1.amazonses.com Signed-off-by: Jakub Kicinski commit 64868f5ecadeb359a49bc4485bfa7c497047f13a Author: Ziyi Guo Date: Tue Feb 17 17:50:12 2026 +0000 net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue flow control functions unrelated to RX multicast configuration. The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, leading to a double usb_submit_urb() on the same URB: kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); } kaweth_set_rx_mode() { netif_stop_queue(); netif_wake_queue(); // wakes TX queue before URB is done } kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); // URB submitted while active } This triggers the WARN in usb_submit_urb(): "URB submitted while active" This is a similar class of bug fixed in rtl8150 by - commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast"). Also kaweth_set_rx_mode() is already functionally broken, the real set_rx_mode action is performed by kaweth_async_set_rx_mode(), which in turn is not a no-op only at ndo_open() time. Suggested-by: Paolo Abeni Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ziyi Guo Link: https://patch.msgid.link/20260217175012.1234494-1-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski commit e1512c1db9e8794d8d130addd2615ec27231d994 Author: Hyunwoo Kim Date: Wed Feb 18 02:16:43 2026 +0900 espintcp: Fix race condition in espintcp_close() This issue was discovered during a code audit. After cancel_work_sync() is called from espintcp_close(), espintcp_tx_work() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the espintcp_tx_work() worker may dereference a freed espintcp ctx or sk. The following is a simple race scenario: cpu0 cpu1 espintcp_close() cancel_work_sync(&ctx->work); espintcp_write_space() schedule_work(&ctx->work); To prevent this race condition, cancel_work_sync() is replaced with disable_work_sync(). Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") Signed-off-by: Hyunwoo Kim Reviewed-by: Simon Horman Link: https://patch.msgid.link/aZSie7rEdh9Nu0eM@v4bel Signed-off-by: Jakub Kicinski commit f891007ab1c77436950d10e09eae54507f1865ff Author: Eric Dumazet Date: Wed Feb 18 14:13:37 2026 +0000 psp: use sk->sk_hash in psp_write_headers() udp_flow_src_port() is indirectly using sk->sk_txhash as a base, because __tcp_transmit_skb() uses skb_set_hash_from_sk(). This is problematic because this field can change over the lifetime of a TCP flow, thanks to calls to sk_rethink_txhash(). Problem is that some NIC might (ab)use the PSP UDP source port in their RSS computation, and PSP packets for a given flow could jump from one queue to another. In order to avoid surprises, it is safer to let Protective Load Balancing (PLB) get its entropy from the IPv6 flowlabel, and change psp_write_headers() to use sk->sk_hash which does not change for the duration of the flow. We might add a sysctl to select the behavior, if there is a need for it. Fixes: fc724515741a ("psp: provide encapsulation helper for drivers") Signed-off-by: Eric Dumazet Reviewed-By: Daniel Zahka Link: https://patch.msgid.link/20260218141337.999945-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae Author: Eric Dumazet Date: Tue Feb 17 16:12:05 2026 +0000 tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/ Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8c746e22096579897d1f8f74dbb6b17a6862fb6d Author: Koichiro Den Date: Mon Feb 2 23:54:07 2026 +0900 PCI: dwc: ep: Always clear IB maps on BAR update dw_pcie_ep_set_bar() currently tears down existing inbound mappings only when either the previous or the new struct pci_epf_bar uses submaps (num_submap != 0). If both the old and new mappings are BAR Match Mode, reprogramming the same ATU index is sufficient, so no explicit teardown was needed. However, some callers may reuse the same struct pci_epf_bar instance and update it in place before calling set_bar() again. In that case ep_func->epf_bar[bar] and the passed-in epf_bar can point to the same object, so we cannot reliably distinguish BAR Match Mode -> BAR Match Mode from Address Match Mode -> BAR Match Mode. As a result, the conditional teardown based on num_submap becomes unreliable and existing inbound maps may be left active. Call dw_pcie_ep_clear_ib_maps() unconditionally before reprogramming the BAR so that in-place updates are handled correctly. This introduces a behavioral change in a corner case: if a BAR reprogramming attempt fails (especially for the long-standing BAR Match Mode -> BAR Match Mode update case), the previously programmed inbound mapping will already have been torn down. This should be acceptable, since the caller observes the error and should not use the BAR for any real transactions in that case. While at it, document that the existing update parameter check is best-effort for in-place updates. Fixes: cc839bef7727 ("PCI: dwc: ep: Support BAR subrange inbound mapping via Address Match Mode iATU") Signed-off-by: Koichiro Den Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260202145407.503348-3-den@valinux.co.jp commit 88a71941b90ddda44f4105e354e82a89b0389bc6 Author: Koichiro Den Date: Mon Feb 2 23:54:06 2026 +0900 PCI: dwc: ep: Return after clearing BAR-match inbound mapping dw_pcie_ep_clear_ib_maps() first checks whether the inbound mapping for a BAR is in BAR Match Mode (tracked via ep_func->bar_to_atu[bar]). Once found, the iATU region is disabled and the bookkeeping is cleared. BAR Match Mode and Address Match Mode mappings are mutually exclusive for a given BAR, so there is nothing left for the Address Match Mode teardown path to do after the BAR Match Mode mapping has been removed. Return early after clearing the BAR Match Mode mapping to avoid running the Address Match Mode teardown path. This makes the helper's intention explicit and helps detect incorrect use of pci_epc_set_bar(). Suggested-by: Niklas Cassel Signed-off-by: Koichiro Den Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260202145407.503348-2-den@valinux.co.jp commit 5ddb66967924e38c680e6a304585c0f553681a3a Author: Arnd Bergmann Date: Wed Feb 11 08:07:40 2026 +0100 PCI: endpoint: pci-epf-test: Select configfs Like some of the other endpoint modules, pci-epf-test now also uses configfs, but is missing an indication in Kconfig: arm-linux-gnueabi-ld: drivers/pci/endpoint/functions/pci-epf-test.o: in function `pci_epf_test_add_cfs': pci-epf-test.c:(.text.pci_epf_test_add_cfs+0x2c): undefined reference to `config_group_init_type_name' Select the symbol as needed. Fixes: ffcc4850a161 ("PCI: endpoint: pci-epf-test: Allow overriding default BAR sizes") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602180706.VtXkmtqL-lkp@intel.com/ Signed-off-by: Arnd Bergmann Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260211070812.4087119-1-arnd@kernel.org commit a3b93b42238b3bb9eefc25729f567e66eea66a56 Author: Ilpo Järvinen Date: Thu Feb 19 00:34:18 2026 +0200 PCI: Account fully optional bridge windows correctly pbus_size_mem_optional() adds dev_res->add_size of a bridge window into children_add_size when the window has a non-optional part. However, if the bridge window is fully optional, only r_size is added (which is zero for such a window). Also, a second dev_res entry will be added by pci_dev_res_add_to_list() into realloc_head for the bridge window (resulting in triggering the realloc_head-must-be-fully-consumed sanity check after a single pass of the resource assignment algorithm): WARNING: drivers/pci/setup-bus.c:2153 at pci_assign_unassigned_root_bus_resources+0xa5/0x260 Correct these problems by always adding dev_res->add_size for bridge windows and not calling pci_dev_res_add_to_list() if the dev_res entry exists. Fixes: 6a5e64c75e82 ("PCI: Add pbus_mem_size_optional() to handle optional sizes") Reported-by: RavitejaX Veesam Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: RavitejaX Veesam Link: https://patch.msgid.link/20260218223419.22366-1-ilpo.jarvinen@linux.intel.com commit 9678e53179aa7e907360f5b5b275769008a69b80 Author: Petr Pavlu Date: Thu Feb 19 17:27:02 2026 +0100 tracing: Wake up poll waiters for hist files when removing an event The event_hist_poll() function attempts to verify whether an event file is being removed, but this check may not occur or could be unnecessarily delayed. This happens because hist_poll_wakeup() is currently invoked only from event_hist_trigger() when a hist command is triggered. If the event file is being removed, no associated hist command will be triggered and a waiter will be woken up only after an unrelated hist command is triggered. Fix the issue by adding a call to hist_poll_wakeup() in remove_event_file_dir() after setting the EVENT_FILE_FL_FREED flag. This ensures that a task polling on a hist file is woken up and receives EPOLLERR. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: Tom Zanussi Acked-by: Masami Hiramatsu (Google) Link: https://patch.msgid.link/20260219162737.314231-3-petr.pavlu@suse.com Fixes: 1bd13edbbed6 ("tracing/hist: Add poll(POLLIN) support on hist file") Signed-off-by: Petr Pavlu Signed-off-by: Steven Rostedt (Google) commit f0a0da1f907e8488826d91c465f7967a56a95aca Author: Petr Pavlu Date: Thu Feb 19 17:27:01 2026 +0100 tracing: Fix checking of freed trace_event_file for hist files The event_hist_open() and event_hist_poll() functions currently retrieve a trace_event_file pointer from a file struct by invoking event_file_data(), which simply returns file->f_inode->i_private. The functions then check if the pointer is NULL to determine whether the event is still valid. This approach is flawed because i_private is assigned when an eventfs inode is allocated and remains set throughout its lifetime. Instead, the code should call event_file_file(), which checks for EVENT_FILE_FL_FREED. Using the incorrect access function may result in the code potentially opening a hist file for an event that is being removed or becoming stuck while polling on this file. Correct the access method to event_file_file() in both functions. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: Tom Zanussi Link: https://patch.msgid.link/20260219162737.314231-2-petr.pavlu@suse.com Fixes: 1bd13edbbed6 ("tracing/hist: Add poll(POLLIN) support on hist file") Signed-off-by: Petr Pavlu Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit f4ff9f646a4d373f9e895c2f0073305da288bc0a Author: Steven Rostedt Date: Wed Feb 18 10:42:44 2026 -0500 fgraph: Do not call handlers direct when not using ftrace_ops The function graph tracer was modified to us the ftrace_ops of the function tracer. This simplified the code as well as allowed more features of the function graph tracer. Not all architectures were converted over as it required the implementation of HAVE_DYNAMIC_FTRACE_WITH_ARGS to implement. For those architectures, it still did it the old way where the function graph tracer handle was called by the function tracer trampoline. The handler then had to check the hash to see if the registered handlers wanted to be called by that function or not. In order to speed up the function graph tracer that used ftrace_ops, if only one callback was registered with function graph, it would call its function directly via a static call. Now, if the architecture does not support the use of using ftrace_ops and still has the ftrace function trampoline calling the function graph handler, then by doing a direct call it removes the check against the handler's hash (list of functions it wants callbacks to), and it may call that handler for functions that the handler did not request calls for. On 32bit x86, which does not support the ftrace_ops use with function graph tracer, it shows the issue: ~# trace-cmd start -p function -l schedule ~# trace-cmd show # tracer: function_graph # # CPU DURATION FUNCTION CALLS # | | | | | | | 2) * 11898.94 us | schedule(); 3) # 1783.041 us | schedule(); 1) | schedule() { ------------------------------------------ 1) bash-8369 => kworker-7669 ------------------------------------------ 1) | schedule() { ------------------------------------------ 1) kworker-7669 => bash-8369 ------------------------------------------ 1) + 97.004 us | } 1) | schedule() { [..] Now by starting the function tracer is another instance: ~# trace-cmd start -B foo -p function This causes the function graph tracer to trace all functions (because the function trace calls the function graph tracer for each on, and the function graph trace is doing a direct call): ~# trace-cmd show # tracer: function_graph # # CPU DURATION FUNCTION CALLS # | | | | | | | 1) 1.669 us | } /* preempt_count_sub */ 1) + 10.443 us | } /* _raw_spin_unlock_irqrestore */ 1) | tick_program_event() { 1) | clockevents_program_event() { 1) 1.044 us | ktime_get(); 1) 6.481 us | lapic_next_event(); 1) + 10.114 us | } 1) + 11.790 us | } 1) ! 181.223 us | } /* hrtimer_interrupt */ 1) ! 184.624 us | } /* __sysvec_apic_timer_interrupt */ 1) | irq_exit_rcu() { 1) 0.678 us | preempt_count_sub(); When it should still only be tracing the schedule() function. To fix this, add a macro FGRAPH_NO_DIRECT to be set to 0 when the architecture does not support function graph use of ftrace_ops, and set to 1 otherwise. Then use this macro to know to allow function graph tracer to call the handlers directly or not. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Mark Rutland Link: https://patch.msgid.link/20260218104244.5f14dade@gandalf.local.home Fixes: cc60ee813b503 ("function_graph: Use static_call and branch to optimize entry function") Signed-off-by: Steven Rostedt (Google) commit 912b0ee248c529a4f45d1e7f568dc1adddbf2a4a Author: Masami Hiramatsu (Google) Date: Mon Feb 16 18:30:15 2026 +0900 tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rb_read_data_buffer(). Since this function is used for validating possibly broken ring buffers, the length of the event could be broken. In that case, the new event (e + len) can point a wrong address. To avoid invalid memory access at boot, check whether the length of each event is in the possible range before using it. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events") Link: https://patch.msgid.link/177123421541.142205.9414352170164678966.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit f1547779402c4cd67755c33616b7203baa88420b Author: Daniil Dulov Date: Fri Feb 13 13:01:30 2026 +0300 ring-buffer: Fix possible dereference of uninitialized pointer There is a pointer head_page in rb_meta_validate_events() which is not initialized at the beginning of a function. This pointer can be dereferenced if there is a failure during reader page validation. In this case the control is passed to "invalid" label where the pointer is dereferenced in a loop. To fix the issue initialize orig_head and head_page before calling rb_validate_buffer. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: stable@vger.kernel.org Reported-by: kernel test robot Reported-by: Dan Carpenter Acked-by: Masami Hiramatsu (Google) Link: https://patch.msgid.link/20260213100130.2013839-1-d.dulov@aladdin.ru Closes: https://lore.kernel.org/r/202406130130.JtTGRf7W-lkp@intel.com/ Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events") Signed-off-by: Daniil Dulov Signed-off-by: Steven Rostedt (Google) commit 8bf22c33e7a172fbc72464f4cc484d23a6b412ba Merge: 4f13d0dabc87fb 571dcbeb8e6351 Author: Linus Torvalds Date: Thu Feb 19 10:39:08 2026 -0800 Merge tag 'net-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Netfilter. Current release - new code bugs: - net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT - eth: mlx5e: XSK, Fix unintended ICOSQ change - phy_port: correctly recompute the port's linkmodes - vsock: prevent child netns mode switch from local to global - couple of kconfig fixes for new symbols Previous releases - regressions: - nfc: nci: fix false-positive parameter validation for packet data - net: do not delay zero-copy skbs in skb_attempt_defer_free() Previous releases - always broken: - mctp: ensure our nlmsg responses to user space are zero-initialised - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() - fixes for ICMP rate limiting Misc: - intel: fix PCI device ID conflict between i40e and ipw2200" * tag 'net-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (85 commits) net: nfc: nci: Fix parameter validation for packet data net/mlx5e: Use unsigned for mlx5e_get_max_num_channels net/mlx5e: Fix deadlocks between devlink and netdev instance locks net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event net/mlx5: Fix misidentification of write combining CQE during poll loop net/mlx5e: Fix misidentification of ASO CQE during poll loop net/mlx5: Fix multiport device check over light SFs bonding: alb: fix UAF in rlb_arp_recv during bond up/down bnge: fix reserving resources from FW eth: fbnic: Advertise supported XDP features. rds: tcp: fix uninit-value in __inet_bind net/rds: Fix NULL pointer dereference in rds_tcp_accept_one octeontx2-af: Fix default entries mcam entry action net/mlx5e: XSK, Fix unintended ICOSQ change ipv6: icmp: icmpv6_xrlim_allow() optimization if net.ipv6.icmp.ratelimit is zero ipv4: icmp: icmpv4_xrlim_allow() optimization if net.ipv4.icmp_ratelimit is zero ipv6: icmp: remove obsolete code in icmpv6_xrlim_allow() inet: move icmp_global_{credit,stamp} to a separate cache line icmp: prevent possible overflow in icmp_global_allow() selftests/net: packetdrill: add ipv4-mapped-ipv6 tests ... commit 4f13d0dabc87fb585b96d90cc4b29f67a2995405 Merge: 2b7a25df823dc7 1e5c009126952f Author: Linus Torvalds Date: Thu Feb 19 10:36:54 2026 -0800 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix invalid write loop logic in libbpf's bpf_linker__add_buf() (Amery Hung) - Fix a potential use-after-free of BTF object (Anton Protopopov) - Add feature detection to libbpf and avoid moving arena global variables on older kernels (Emil Tsalapatis) - Remove extern declaration of bpf_stream_vprintk() from libbpf headers (Ihor Solodrai) - Fix truncated netlink dumps in bpftool (Jakub Kicinski) - Fix map_kptr grace period wait in bpf selftests (Kumar Kartikeya Dwivedi) - Remove hexdump dependency while building bpf selftests (Matthieu Baerts) - Complete fsession support in BPF trampolines on riscv (Menglong Dong) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Remove hexdump dependency libbpf: Remove extern declaration of bpf_stream_vprintk() selftests/bpf: Use vmlinux.h in test_xdp_meta bpftool: Fix truncated netlink dumps libbpf: Delay feature gate check until object prepare time libbpf: Do not use PROG_TYPE_TRACEPOINT program for feature gating bpf: Add a map/btf from a fd array more consistently selftests/bpf: Fix map_kptr grace period wait selftests/bpf: enable fsession_test on riscv64 selftests/bpf: Adjust selftest due to function rename bpf, riscv: add fsession support for trampolines bpf: Fix a potential use-after-free of BTF object bpf, riscv: introduce emit_store_stack_imm64() for trampoline libbpf: Fix invalid write loop logic in bpf_linker__add_buf() libbpf: Add gating for arena globals relocation feature commit c732084c891d89a1a0824126b3075999a981bc88 Author: Kees Cook Date: Fri Feb 6 14:30:23 2026 -0800 KVM: arm64: vgic: Handle const qualifier from gic_kvm_info allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "struct gic_kvm_info", but the returned type, while matching, is const qualified. To get them exactly matching, just use the dereferenced pointer for the sizeof(). Link: https://patch.msgid.link/20260206223022.it.052-kees@kernel.org Signed-off-by: Kees Cook commit 48634a9ea06a453a3f0635a7063dcc63f6729436 Author: Kees Cook Date: Fri Feb 6 14:21:52 2026 -0800 drm/msm: Adjust msm_iommu_pagetable_prealloc_allocate() allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "void **" but the returned type will be "void ***". These are the same allocation size (pointer size), but the types do not match. Adjust the allocation type to match the assignment. Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260206222151.work.016-kees@kernel.org Signed-off-by: Kees Cook commit a3fab954405e61f593f57bdb3510e304c6a0aa80 Author: Kees Cook Date: Fri Apr 25 23:17:08 2025 -0700 dm: dm-zoned: Adjust dmz_load_mapping() allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "struct dmz_mblock **" but the returned type will be "struct dmz_mblk **". These are the same allocation size (pointer size), but the types do not match. Adjust the allocation type to match the assignment. Link: https://patch.msgid.link/20250426061707.work.587-kees@kernel.org Signed-off-by: Kees Cook commit c6fcccd5398775624582777776113dd220db2bbd Author: Kees Cook Date: Fri Apr 25 23:16:30 2025 -0700 dm-crypt: Adjust crypt_alloc_tfms_aead() allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "struct crypto_skcipher **" but the returned type will be "struct crypto_aead **". These are the same allocation size (pointer size), but the types don't match. Adjust the allocation type to match the assignment. Link: https://patch.msgid.link/20250426061629.work.266-kees@kernel.org Signed-off-by: Kees Cook commit ecfa6f34492c493a9a1dc2900f3edeb01c79946b Author: Greg Kroah-Hartman Date: Thu Feb 19 15:33:54 2026 +0100 HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them In commit 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at raw event handle"), we handle the fact that raw event callbacks can happen even for a HID device that has not been "claimed" causing a crash if a broken device were attempted to be connected to the system. Fix up the remaining in-tree HID drivers that forgot to add this same check to resolve the same issue. Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: Bastien Nocera Cc: linux-input@vger.kernel.org Cc: stable Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman Signed-off-by: Benjamin Tissoires commit 2bad24c17742fc88973d6aea526ce1353f5334a3 Author: Günther Noack Date: Thu Feb 19 16:43:38 2026 +0100 HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer. Also fix a harmless out-of-bounds read by copying only the original descriptor size. Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Günther Noack Signed-off-by: Benjamin Tissoires commit 91e8c6e601bdc1ccdf886479b6513c01c7e51c2c Author: Günther Noack Date: Thu Feb 19 16:43:37 2026 +0100 HID: magicmouse: avoid memory leak in magicmouse_report_fixup() The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller. Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Günther Noack Signed-off-by: Benjamin Tissoires commit 239c15116d80f67d32f00acc34575f1a6b699613 Author: Günther Noack Date: Thu Feb 19 16:43:36 2026 +0100 HID: apple: avoid memory leak in apple_report_fixup() The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller. Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Günther Noack Signed-off-by: Benjamin Tissoires commit 6b3e458806e34f1142592f786d3eb0ebac209cc2 Author: Günther Noack Date: Thu Feb 19 16:43:35 2026 +0100 HID: Document memory allocation properties of report_fixup() The memory pointer returned by the report_fixup() hook does not get freed by the caller. Instead, report_fixup() must return (in return value and *rsize) a memory buffer with at least the same lifetime as the input buffer (defined by rdesc and original *rsize). This is usually achieved using one of the following techniques: * Returning a pointer and size to a sub-portion of the input buffer * Returning a pointer to a static buffer * Allocating a buffer with a devm_*() function, which will automatically get freed when the device is removed. Signed-off-by: Günther Noack Signed-off-by: Benjamin Tissoires commit 571dcbeb8e635182bb825ae758399831805693c2 Author: Michael Thalmeier Date: Wed Feb 18 09:30:00 2026 +0100 net: nfc: nci: Fix parameter validation for packet data Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") communication with nci nfc chips is not working any more. The mentioned commit tries to fix access of uninitialized data, but failed to understand that in some cases the data packet is of variable length and can therefore not be compared to the maximum packet length given by the sizeof(struct). Fixes: 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data") Cc: stable@vger.kernel.org Signed-off-by: Michael Thalmeier Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com Link: https://patch.msgid.link/20260218083000.301354-1-michael.thalmeier@hale.at Signed-off-by: Jakub Kicinski commit 7997bca6c2b00310161fbcd628dc0161fd3b040c Merge: e6834a4c474697 57a94d4b22b0c6 Author: Jakub Kicinski Date: Thu Feb 19 09:26:39 2026 -0800 Merge branch 'mlx5-misc-fixes-2026-02-18' Tariq Toukan says: ==================== mlx5 misc fixes 2026-02-18 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/20260218072904.1764634-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 57a94d4b22b0c6cc5d601e6b6238d78fb923d991 Author: Cosmin Ratiu Date: Wed Feb 18 09:29:04 2026 +0200 net/mlx5e: Use unsigned for mlx5e_get_max_num_channels The max number of channels is always an unsigned int, use the correct type to fix compilation errors done with strict type checking, e.g.: error: call to ‘__compiletime_assert_1110’ declared with attribute error: min(mlx5e_get_devlink_param_num_doorbells(mdev), mlx5e_get_max_num_channels(mdev)) signedness error Fixes: 74a8dadac17e ("net/mlx5e: Preparations for supporting larger number of channels") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260218072904.1764634-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 83ac0304a2d77519dae1e54c9713cbe1aedf19c9 Author: Cosmin Ratiu Date: Wed Feb 18 09:29:03 2026 +0200 net/mlx5e: Fix deadlocks between devlink and netdev instance locks In the mentioned "Fixes" commit, various work tasks triggering devlink health reporter recovery were switched to use netdev_trylock to protect against concurrent tear down of the channels being recovered. But this had the side effect of introducing potential deadlocks because of incorrect lock ordering. The correct lock order is described by the init flow: probe_one -> mlx5_init_one (acquires devlink lock) -> mlx5_init_one_devl_locked -> mlx5_register_device -> mlx5_rescan_drivers_locked -...-> mlx5e_probe -> _mlx5e_probe -> register_netdev (acquires rtnl lock) -> register_netdevice (acquires netdev lock) => devlink lock -> rtnl lock -> netdev lock. But in the current recovery flow, the order is wrong: mlx5e_tx_err_cqe_work (acquires netdev lock) -> mlx5e_reporter_tx_err_cqe -> mlx5e_health_report -> devlink_health_report (acquires devlink lock => boom!) -> devlink_health_reporter_recover -> mlx5e_tx_reporter_recover -> mlx5e_tx_reporter_recover_from_ctx -> mlx5e_tx_reporter_err_cqe_recover The same pattern exists in: mlx5e_reporter_rx_timeout mlx5e_reporter_tx_ptpsq_unhealthy mlx5e_reporter_tx_timeout Fix these by moving the netdev_trylock calls from the work handlers lower in the call stack, in the respective recovery functions, where they are actually necessary. Fixes: 8f7b00307bf1 ("net/mlx5e: Convert mlx5 netdevs to instance locking") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260218072904.1764634-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 9854b243ce4225328d0b32fdc998d35b6952d3f7 Author: Gal Pressman Date: Wed Feb 18 09:29:02 2026 +0200 net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event The macsec_aso_set_arm_event function calls mlx5_aso_poll_cq once without a retry loop. If the CQE is not immediately available after posting the WQE, the function fails unnecessarily. Use read_poll_timeout() to poll 3-10 usecs for CQE, consistent with other ASO polling code paths in the driver. Fixes: 739cfa34518e ("net/mlx5: Make ASO poll CQ usable in atomic context") Signed-off-by: Gal Pressman Reviewed-by: Jianbo Liu Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260218072904.1764634-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d451994ebc7d4392610bd4b2ab339b255deb4143 Author: Gal Pressman Date: Wed Feb 18 09:29:01 2026 +0200 net/mlx5: Fix misidentification of write combining CQE during poll loop The write combining completion poll loop uses usleep_range() which can sleep much longer than requested due to scheduler latency. Under load, we witnessed a 20ms+ delay until the process was rescheduled, causing the jiffies based timeout to expire while the thread is sleeping. The original do-while loop structure (poll, sleep, check timeout) would exit without a final poll when waking after timeout, missing a CQE that arrived during sleep. Instead of the open-coded while loop, use the kernel's poll_timeout_us() which always performs an additional check after the sleep expiration, and is less error-prone. Note: poll_timeout_us() doesn't accept a sleep range, by passing 10 sleep_us the sleep range effectively changes from 2-10 to 3-10 usecs. Fixes: d98995b4bf98 ("net/mlx5: Reimplement write combining test") Signed-off-by: Gal Pressman Reviewed-by: Jianbo Liu Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260218072904.1764634-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ae3cb71e6c4dbda0c0b7c10475b744377813c7bd Author: Gal Pressman Date: Wed Feb 18 09:29:00 2026 +0200 net/mlx5e: Fix misidentification of ASO CQE during poll loop The ASO completion poll loop uses usleep_range() which can sleep much longer than requested due to scheduler latency. Under load, we witnessed a 20ms+ delay until the process was rescheduled, causing the jiffies based timeout to expire while the thread is sleeping. The original do-while loop structure (poll, sleep, check timeout) would exit without a final poll when waking after timeout, missing a CQE that arrived during sleep. Instead of the open-coded while loop, use the kernel's read_poll_timeout() which always performs an additional check after the sleep expiration, and is less error-prone. Note: read_poll_timeout() doesn't accept a sleep range, by passing 10 sleep_us the sleep range effectively changes from 2-10 to 3-10 usecs. Fixes: 739cfa34518e ("net/mlx5: Make ASO poll CQ usable in atomic context") Fixes: 7e3fce82d945 ("net/mlx5e: Overcome slow response for first macsec ASO WQE") Signed-off-by: Gal Pressman Reviewed-by: Jianbo Liu Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260218072904.1764634-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 47bf2e813817159f4d195be83a9b5a640ee6baec Author: Shay Drory Date: Wed Feb 18 09:28:59 2026 +0200 net/mlx5: Fix multiport device check over light SFs Driver is using num_vhca_ports capability to distinguish between multiport master device and multiport slave device. num_vhca_ports is a capability the driver sets according to the MAX num_vhca_ports capability reported by FW. On the other hand, light SFs doesn't set the above capbility. This leads to wrong results whenever light SFs is checking whether he is a multiport master or slave. Therefore, use the MAX capability to distinguish between master and slave devices. Fixes: e71383fb9cd1 ("net/mlx5: Light probe local SFs") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260218072904.1764634-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e6834a4c474697df23ab9948fd3577b26bf48656 Author: Hangbin Liu Date: Wed Feb 18 06:09:19 2026 +0000 bonding: alb: fix UAF in rlb_arp_recv during bond up/down The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_hashtbl while RX handlers are still running, leading to a null pointer dereference detected by KASAN. However, the root cause is that rlb_arp_recv() can still be accessed after setting recv_probe to NULL, which is actually a use-after-free (UAF) issue. That is the reason for using the referenced commit in the Fixes tag. [ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI [ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] [ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary) [ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022 [ 214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding] [ 214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00 [ 214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206 [ 214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e [ 214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8 [ 214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8 [ 214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119 [ 214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810 [ 214.286943] FS: 00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000 [ 214.295966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0 [ 214.310347] Call Trace: [ 214.313070] [ 214.315318] ? __pfx_rlb_arp_recv+0x10/0x10 [bonding] [ 214.320975] bond_handle_frame+0x166/0xb60 [bonding] [ 214.326537] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] [ 214.332680] __netif_receive_skb_core.constprop.0+0x576/0x2710 [ 214.339199] ? __pfx_arp_process+0x10/0x10 [ 214.343775] ? sched_balance_find_src_group+0x98/0x630 [ 214.349513] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 214.356513] ? arp_rcv+0x307/0x690 [ 214.360311] ? __pfx_arp_rcv+0x10/0x10 [ 214.364499] ? __lock_acquire+0x58c/0xbd0 [ 214.368975] __netif_receive_skb_one_core+0xae/0x1b0 [ 214.374518] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 214.380743] ? lock_acquire+0x10b/0x140 [ 214.385026] process_backlog+0x3f1/0x13a0 [ 214.389502] ? process_backlog+0x3aa/0x13a0 [ 214.394174] __napi_poll.constprop.0+0x9f/0x370 [ 214.399233] net_rx_action+0x8c1/0xe60 [ 214.403423] ? __pfx_net_rx_action+0x10/0x10 [ 214.408193] ? lock_acquire.part.0+0xbd/0x260 [ 214.413058] ? sched_clock_cpu+0x6c/0x540 [ 214.417540] ? mark_held_locks+0x40/0x70 [ 214.421920] handle_softirqs+0x1fd/0x860 [ 214.426302] ? __pfx_handle_softirqs+0x10/0x10 [ 214.431264] ? __neigh_event_send+0x2d6/0xf50 [ 214.436131] do_softirq+0xb1/0xf0 [ 214.439830] The issue is reproducible by repeatedly running ip link set bond0 up/down while receiving ARP messages, where rlb_arp_recv() can race with rlb_deinitialize() and dereference a freed rx_hashtbl entry. Fix this by setting recv_probe to NULL and then calling synchronize_net() to wait for any concurrent RX processing to finish. This ensures that no RX handler can access rx_hashtbl after it is freed in bond_alb_deinitialize(). Reported-by: Liang Li Fixes: 3aba891dde38 ("bonding: move processing of recv handlers into handle_frame()") Reviewed-by: Nikolay Aleksandrov Acked-by: Jay Vosburgh Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20260218060919.101574-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 604530085b2ef484843c723a105b6fd3218b4710 Author: Vikas Gupta Date: Wed Feb 18 10:57:55 2026 +0530 bnge: fix reserving resources from FW HWRM_FUNC_CFG is used to reserve resources, whereas HWRM_FUNC_QCFG is intended for querying resource information from the firmware. Since __bnge_hwrm_reserve_pf_rings() reserves resources for a specific PF, the command type should be HWRM_FUNC_CFG. Fixes: 627c67f038d2 ("bng_en: Add resource management support") Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260218052755.4097468-1-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 3ce2ad267079fcdd2c087bbbfb4f91bec527a4d5 Author: Timur Kristóf Date: Mon Feb 2 12:25:08 2026 +0100 drm/amd/display: Remove unneeded DAC link encoder register Not needed anymore since we use the VBIOS function. Signed-off-by: Timur Kristóf Tested-by: Mauro Rossi Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 4bd8b5f8bcb57b430c35494d8a2471ce5fd7661d Author: Timur Kristóf Date: Mon Feb 2 12:25:07 2026 +0100 drm/amd/display: Enable DAC in DCE link encoder Ensure that the DAC output is enabled at the correct time by moving it to the DCE link encoder similarly to how digital outputs are enabled. This also removes the call to DAC1EncoderControl from the DCE HWSS, which always felt like it was a hacky solution. Fixes: 0fbe321a93ce ("drm/amd/display: Implement DCE analog link encoders (v2)") Signed-off-by: Timur Kristóf Tested-by: Mauro Rossi Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit cbced93894d145239c83881d7fd953b7392c23a8 Author: Timur Kristóf Date: Mon Feb 2 12:25:06 2026 +0100 drm/amd/display: Set CRTC source for DAC using registers Apparently the VBIOS SelectCRTC_Source function overwrites a few registers (such as FMT_*) which DC writes in a different place, which can cause problems. Instead of using the SelectCRTC_Source function from the VBIOS, use the DAC_SOURCE_SELECT register directly, similarly to how it is done for digital link encoders. Fixes: 3be26d81b150 ("drm/amd/display: Support DAC in dce110_hwseq") Signed-off-by: Timur Kristóf Tested-by: Mauro Rossi Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit e2a024345bce78a8e1ed7d9e84c859b05979e41e Author: Timur Kristóf Date: Mon Feb 2 12:25:05 2026 +0100 drm/amd/display: Initialize DAC in DCE link encoder using VBIOS The VBIOS DAC1EncoderControl() function can initialize the DAC, by writing board-specific values to certain registers. Call this at link encoder hardware initialization time similarly to how the equivalent UNIPHYTransmitterControl initialization is done. This fixes DAC output on the Radeon HD 7790. Also remove the ENCODER_CONTROL_SETUP enum from the dac_encoder_control_prepare_params function which is actually not a supported operation for DAC encoders. Fixes: 0fbe321a93ce ("drm/amd/display: Implement DCE analog link encoders (v2)") Signed-off-by: Timur Kristóf Tested-by: Mauro Rossi Suggested-by: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit e021ee995056ee7e58114edd92bcd4578d8b4bb5 Author: Timur Kristóf Date: Mon Feb 2 12:25:04 2026 +0100 drm/amd/display: Turn off DAC in DCE link encoder using VBIOS Apparently, the VBIOS DAC1EncoderControl function is much more graceful about turning off the DAC. It writes various DAC registers in a specific sequence. Use that instead of just clearing the DAC_ENABLE register. Do this in just the dce110_link_encoder_disable_output function and remove it from the HWSS. Fixes: 0fbe321a93ce ("drm/amd/display: Implement DCE analog link encoders (v2)") Signed-off-by: Timur Kristóf Tested-by: Mauro Rossi Suggested-by: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 613b1737abe1bd0a65b49851e777231302095e28 Author: Timur Kristóf Date: Mon Feb 2 12:25:03 2026 +0100 drm/amd/display: Don't call find_analog_engine() twice The analog engine is already there in the link_analog_engine variable and assigned to enc_init_data.analog_engine already. I suspect this was a rebase mistake. Fixes: 436d0d22aa70 ("drm/amd/display: Pass proper DAC encoder ID to VBIOS") Signed-off-by: Timur Kristóf Tested-by: Mauro Rossi Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit aa25c111a782e711d9eaad0adc3d5e086d175a29 Author: Christian König Date: Wed Feb 11 13:28:55 2026 +0100 drm/amdgpu: fix 4-level paging if GMC supports 57-bit VA v2 It turned that using 4 level page tables on GMC generations which support 57bit VAs actually doesn't work at all. Background is that the GMC actually can't switch between 4 and 5 levels, but rather just uses a subset of address space when less than 5 levels are selected. Philip already removed the automatically switch to 4levels, now fix it as well should it be enabled by module parameters. v2: fix AMDGPU_GMC_HOLE_MASK as well, fix off by one issue pointed out by Philip Signed-off-by: Christian König Acked-by: Alex Deucher Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 096bb75e13cc508d3915b7604e356bcb12b17766 Author: Alex Deucher Date: Mon Feb 16 10:02:32 2026 -0500 drm/amdgpu: keep vga memory on MacBooks with switchable graphics On Intel MacBookPros with switchable graphics, when the iGPU is enabled, the address of VRAM gets put at 0 in the dGPU's virtual address space. This is non-standard and seems to cause issues with the cursor if it ends up at 0. We have the framework to reserve memory at 0 in the address space, so enable it here if the vram start address is 0. Reviewed-and-tested-by: Mario Kleiner Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4302 Cc: stable@vger.kernel.org Cc: Mario Kleiner Signed-off-by: Alex Deucher commit 23c098b5fc89c17cec6b25ebe071f47a54b7d613 Author: Harish Kasiviswanathan Date: Thu Feb 12 12:13:26 2026 -0500 drm/amdgpu: Set atomics to true for xgmi xgmi support atomics between links. Set them to true. This only set for GFX12 onwards to avoid regression on older generations v2: Use correct xgmi flag that indicates CPU connection Signed-off-by: Harish Kasiviswanathan Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 09da66f139b43c217e22435d6e50b0d9960f5183 Author: Andrew Martin Date: Fri Dec 12 15:59:17 2025 +0800 drm/amdkfd: Check for NULL return values This patch fixes issues when the code moves forward with a potential NULL pointer, without checking. Removed one redundant NULL check for a function parameter. This check is already done in the only caller. Signed-off-by: Andrew Martin Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit f0157ce46cf0e5e2257e19d590c9b16036ce26d4 Author: Mario Kleiner Date: Fri Feb 6 23:38:28 2026 +0100 drm/amd/display: Use same max plane scaling limits for all 64 bpp formats The plane scaling hw seems to have the same min/max plane scaling limits for all 16 bpc / 64 bpp interleaved pixel color formats. Therefore add cases to amdgpu_dm_plane_get_min_max_dc_plane_scaling() for all the 16 bpc fixed-point / unorm formats to use the same .fp16 up/downscaling factor limits as used by the fp16 floating point formats. So far, 16 bpc unorm formats were not handled, and the default: path returned max/min factors for 32 bpp argb8888 formats, which were wrong and bigger than what many DCE / DCN hw generations could handle. The result sometimes was misscaling of framebuffers with DRM_FORMAT_XRGB16161616, DRM_FORMAT_ARGB16161616, DRM_FORMAT_XBGR16161616, DRM_FORMAT_ABGR16161616, leading to very wrong looking display, as tested on Polaris11 / DCE-11.2. So far this went unnoticed, because only few userspace clients used such 16 bpc unorm framebuffers, and those didn't use hw plane scaling, so they did not experience this issue. With upcoming Mesa 26 exposing 16 bpc unorm formats under both OpenGL and Vulkan under Wayland, and the upcoming GNOME 50 Mutter Wayland compositor allowing for direct scanout of these formats, the scaling hw will be used on these formats if possible for HiDPI display scaling, so it is important to use the correct hw scaling limits to avoid wrong display. Tested on AMD Polaris 11 / DCE 11.2 with upcoming Mesa 26 and GNOME 50 on HiDPI displays with scaling enabled. The mutter Wayland compositor now correctly falls back to scaling via desktop compositing instead of direct scanout, thereby avoiding wrong image display. For unscaled mode, it correctly uses direct scanout. Fixes: 580204038f5b ("drm/amd/display: Enable support for 16 bpc fixed-point framebuffers.") Signed-off-by: Mario Kleiner Tested-by: Mario Kleiner Cc: Alex Deucher Cc: Harry Wentland Cc: Leo Li Signed-off-by: Alex Deucher commit a1e0a6b55216820286b31443724b26ed58e96e0b Author: Harish Kasiviswanathan Date: Fri Jan 30 15:31:14 2026 -0500 drm/amdgpu: Set vmid0 PAGE_TABLE_DEPTH for GFX12.1 GFX12.1 uses 2 level gart table. Set the context register appropriately Signed-off-by: Feifei Xu Signed-off-by: Harish Kasiviswanathan Reviewed-by: Mukul Joshi Signed-off-by: Alex Deucher commit 73463e26f7e2adc5e00873a8afb03ddf49fd838f Author: Andrew Martin Date: Mon Feb 2 05:42:44 2026 -0500 drm/amdkfd: Disable MQD queue priority This solves a priority inversion issue, caused by the language runtime making high-priority queues wait for activity on lower-priority queues. Signed-off-by: Andrew Martin Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 Author: Alex Hung Date: Wed Feb 4 22:05:16 2026 -0700 drm/amd/display: Remove conditional for shaper 3DLUT power-on [Why] Shaper programming has high chance to fail on first time after power-on or reboot. This can be verified by running IGT's kms_colorop. [How] Always power on the shaper and 3DLUT before programming by removing the debug flag of low power mode. Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d3b03850bddc775eacb13cb3969141cf725308ab Author: Alex Hung Date: Thu Feb 5 22:54:27 2026 -0700 drm/amd/display: Check return of shaper curve to HW format [Why & How] Check return of cm3_helper_translate_curve_to_hw_format. This is reported as a CHECKED_RETURN error by Coverity. Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b6a65009e7ce3f0cc72da18f186adb60717b51a0 Author: Charlene Liu Date: Thu Feb 5 20:28:49 2026 -0500 drm/amd/display: Correct logic check error for fastboot [Why] Fix fastboot broken in driver. This is caused by an open source backport change 7495962c. from the comment, the intended check is to disable fastboot for pre-DCN10. but the logic check is reversed, and causes fastboot to be disabled on all DCN10 and after. fastboot is for driver trying to pick up bios used hw setting and bypass reprogramming the hw if dc_validate_boot_timing() condition meets. Fixes: 7495962cbceb ("drm/amd/display: Disable fastboot on DCE 6 too") Cc: stable@vger.kernel.org Reviewed-by: Mario Limonciello Reviewed-by: Ovidiu Bunea Signed-off-by: Charlene Liu Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d1d51519bc3bf4ae316203427d733a002d947cd0 Author: Saidireddy Yenugu Date: Wed Jan 21 18:57:25 2026 +0530 drm/amd/display: Skip eDP detection when no sink [Why & How] When there is no eDP panel connected and during s0ix resume, unnecessary eDP power sequence and HPD happening, resulting in ~2 seconds delay. Fixed the issue by avoiding link detect for eDP connection with no sink in dm_resume. Reviewed-by: Mario Limonciello Signed-off-by: Saidireddy Yenugu Co-developed-by: ThummarDip Kishorbhai Signed-off-by: ThummarDip Kishorbhai Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d637dd7288814bc4dfbc851780f7a3eada1e13d3 Author: Nicholas Carbones Date: Mon Feb 9 11:37:23 2026 +0800 Revert "drm/amd/display: Add Gfx Base Case For Linear Tiling Handling" This reverts commit 08a01ec306db ("drm/amd/display: Add Gfx Base Case For Linear Tiling Handling") Reason for revert: Got blank screen issues while doing PNP Reviewed-by: Joshua Aberback Signed-off-by: Nicholas Carbones Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c1cf87eb796a8342ca3fe096ea96aee9fcd937b3 Author: Nicholas Carbones Date: Mon Feb 9 11:34:00 2026 +0800 Revert "drm/amd/display: Correct hubp GfxVersion verification" This reverts commit 3303aa64e7a6 ("drm/amd/display: Correct hubp GfxVersion verification") Reason for revert: Got blank screen issues while doing PNP Reviewed-by: Joshua Aberback Signed-off-by: Nicholas Carbones Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1a524d9a872f0fa164160869f2b69b590a22ad4f Author: Nicholas Carbones Date: Wed Feb 4 16:52:48 2026 -0500 Revert "drm/amd/display: Add Handling for gfxversion DcGfxBase" This reverts commit 2e193f5b1b4f ("drm/amd/display: Add Handling for gfxversion DcGfxBase") Reason for revert: Cause some regressions Reviewed-by: Dillon Varone Signed-off-by: Nicholas Carbones Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4c595e75110ece20af3a68c1ebef8ed4c1b69afe Author: Bhuvanachandra Pinninti Date: Tue Feb 3 15:37:07 2026 +0530 drm/amd/display: Migrate DCCG registers access from hwseq to dccg component. [Why] Direct DCCG register access in hwseq layer was creating register conflicts. [How] Migrated DCCG registers from hwseq-dccg component. Reviewed-by: Martin Leung Signed-off-by: Bhuvanachandra Pinninti Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 63b7f5826508a2b81e3010200d13ce92f0b2311d Author: Muaaz Nisar Date: Wed Feb 4 03:08:01 2026 -0500 drm/amd/display: Implementing ramless idle mouse trigger [Why & How] Adding mouse trigger in dc_stream to recover from low refresh rate idle state upon mouse movement without vsync interrupts. Reviewed-by: Aric Cyr Signed-off-by: Muaaz Nisar Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c6e2639cdcf07810dcd56c64ab1aeccaa5877035 Author: Charlene Liu Date: Mon Feb 2 20:34:42 2026 -0500 drm/amd/display: Disable SR feature on eDP1 by default [Why & How] Disable SR feature on eDP1 by default. Reviewed-by: Wenjing Liu Signed-off-by: Charlene Liu Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 8175ea4159e9c4275503cb287802fae6d6a8a055 Author: Dmytro Laktyushkin Date: Wed Jan 28 11:09:23 2026 -0500 drm/amd/display: Expose functions of other dcn use [Why & HOw] Expose some functions for later dcns to reuse Reviewed-by: Charlene Liu Reviewed-by: Nicholas Kazlauskas Signed-off-by: Dmytro Laktyushkin Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e977fcb3a318b53b47f23b44ac237fceb1b731fe Author: Dimitri Daskalakis Date: Tue Feb 17 19:06:20 2026 -0800 eth: fbnic: Advertise supported XDP features. Drivers are supposed to advertise the XDP features they support. This was missed while adding XDP support. Before: $ ynl --family netdev --dump dev-get ... {'ifindex': 3, 'xdp-features': set(), 'xdp-rx-metadata-features': set(), 'xsk-features': set()}, ... After: $ ynl --family netdev --dump dev-get ... {'ifindex': 3, 'xdp-features': {'basic', 'rx-sg'}, 'xdp-rx-metadata-features': set(), 'xsk-features': set()}, ... Fixes: 168deb7b31b2 ("eth: fbnic: Add support for XDP_TX action") Signed-off-by: Jakub Kicinski Signed-off-by: Dimitri Daskalakis Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260218030620.3329608-1-dimitri.daskalakis1@gmail.com Signed-off-by: Paolo Abeni commit 0f967cb8ea04486953f85b249b42dda3de842053 Author: Uwe Kleine-König Date: Mon Feb 16 00:33:23 2026 +0100 fbdev: au1100fb: Replace license boilerplate by SPDX header This also gets rid of an old address of the FSF. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit cd849d26d09dc661d835e5d2b59dfb34948cc776 Author: Uwe Kleine-König Date: Mon Feb 16 00:33:22 2026 +0100 fbdev: au1100fb: Fold au1100fb.h into its only user This gets rid of a header that is only used once. The copyrights and license specifications are all already covered in the au1100fb.c file. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit bcf4373eec313b2538208a1131cb32dcc1a500fb Author: Uwe Kleine-König Date: Mon Feb 16 00:33:21 2026 +0100 fbdev: au1100fb: Replace custom printk wrappers by pr_* The global wrappers also have the advantage to do stricter format checking, so the pr_devel formats are also checked if DEBUG is not defined. The global variants only check for DEBUG being defined and not its actual value, so the #define to zero is dropped, too. There is only a slight semantic change as the (by default disabled) debug output doesn't contain __FILE__ any more. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 6f366e86481a7503a821de82930df517dddd4047 Author: Uwe Kleine-König Date: Mon Feb 16 00:33:20 2026 +0100 fbdev: au1100fb: Make driver compilable on non-mips platforms The header asm/mach-au1x00/au1000.h is unused apart from pulling in (for mdelay()) and (for KSEG1ADDR()). Then the only platform specific part in the driver is the usage of the KSEG1ADDR macro, which for the non-mips case can be stubbed. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 13c89a37c6f6f33d9afbd8b4adf121c3d51c81d2 Author: Uwe Kleine-König Date: Mon Feb 16 00:33:19 2026 +0100 fbdev: au1100fb: Use proper conversion specifiers in printk formats %zu is the dedicated type for size_t. %d only works on 32bit architectures where size_t is typedef'd to be unsigned int. (And then the signedness doesn't fit, but `gcc -Wformat` doesn't stumble over this. Also the size of dma_addr_t is architecture dependent and it should be printkd using %pad (and the value passed by reference). This prepares allowing this driver to be compiled on non-mips platforms. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 2bb53005f4670b8c17c181b9559319b27a6ab74e Author: Uwe Kleine-König Date: Mon Feb 16 00:33:18 2026 +0100 fbdev: au1100fb: Mark several local functions as static This fixes several (fatal) compiler warnings à la drivers/video/fbdev/au1100fb.c:530:6: error: no previous prototype for ‘au1100fb_drv_remove’ [-Werror=missing-prototypes] 523 | void au1100fb_drv_remove(struct platform_device *dev) | ^~~~~~~~~~~~~~~~~~~ Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 7939cecdc6fa39ea9e74507a389f31a7a7936b18 Author: Uwe Kleine-König Date: Mon Feb 16 00:33:17 2026 +0100 fbdev: au1100fb: Don't store device specific data in global variables Using global data to store device specific data is a bad pattern that breaks if there is more than one device. So expand driver data and drop the global variables. While there is probably no machine that has two or more au1100fb devices, this makes the driver a better template for new drivers and saves some memory if there is no such bound device. bloat-o-meter reports (for ARCH=arm allmodconfig + CONFIG_FB_AU1100=y and ignoring the rename of the init function): add/remove: 1/4 grow/shrink: 2/2 up/down: 1360/-4800 (-3440) Function old new delta au1100fb_drv_probe 2648 3328 +680 $a 12808 13484 +676 au1100fb_drv_resume 404 400 -4 au1100fb_fix 68 - -68 au1100fb_var 160 - -160 fbregs 2048 - -2048 $d 9525 7009 -2516 Total: Before=38664, After=35224, chg -8.90% Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 89339d889d63a4f981f185d048796762e86aa6c0 Merge: d08008f196107a 0783052534f547 Author: Takashi Iwai Date: Thu Feb 19 16:50:38 2026 +0100 Merge tag 'asoc-fix-v7.0-rockchip-i2s-tdm' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Additional Rockchip fix for v7.0 One more ASoC fix, for a regression with the Rockchip I2S TDM support on a number of platforms. commit 81b1f046ff8a5ad5da2c970cff354b61dfa1d6b1 Author: Thorsten Blum Date: Mon Jan 12 18:04:12 2026 +0100 drbd: Replace deprecated strcpy with strscpy strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(). No functional changes. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Reviewed-by: Christoph Böhmwalder Signed-off-by: Jens Axboe commit ab140365fb62c0bdab22b2f516aff563b2559e3b Author: Lars Ellenberg Date: Thu Feb 19 15:20:12 2026 +0100 drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if some other code path decided to do lc_try_lock() with bad timing. If that happened, we logged "LOGIC BUG for enr=...", but still did not return an error. The rest of the code now assumed that this request has references for the relevant activity log extents. The implcations are that during an active resync, mutual exclusivity of resync versus application IO is not guaranteed. And a potential crash at this point may not realizs that these extents could have been target of in-flight IO and would need to be resynced just in case. Also, once the request completes, it will give up activity log references it does not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put(). Fix: Do not crash the kernel for a condition that is harmless during normal operation: also catch "e->refcnt == 0", not only "e == NULL" when being noisy about "al_complete_io() called on inactive extent %u\n". And do not try to be smart and "guess" whether something will work, then be surprised when it does not. Deal with the fact that it may or may not work. If it does not, remember a possible "partially in activity log" state (only possible for requests that cross extent boundaries), and return an error code from drbd_al_begin_io_nonblock(). A latter call for the same request will then resume from where we left off. Cc: stable@vger.kernel.org Signed-off-by: Lars Ellenberg Signed-off-by: Christoph Böhmwalder Signed-off-by: Jens Axboe commit 7b821da55b3f88c1703ff2c2074d182295a84f6b Author: Tabrez Ahmed Date: Tue Feb 17 19:23:49 2026 +0530 rds: tcp: fix uninit-value in __inet_bind KMSAN reported an uninit-value access in __inet_bind() when binding an RDS TCP socket. The uninitialized memory originates from rds_tcp_conn_alloc(), which uses kmem_cache_alloc() to allocate the rds_tcp_connection structure. Specifically, the field 't_client_port_group' is incremented in rds_tcp_conn_path_connect() without being initialized first: if (++tc->t_client_port_group >= port_groups) Since kmem_cache_alloc() does not zero the memory, this field contains garbage, leading to the KMSAN report. Fix this by using kmem_cache_zalloc() to ensure the structure is zero-initialized upon allocation. Reported-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=aae646f09192f72a68dc Tested-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com Fixes: a20a6992558f ("net/rds: Encode cp_index in TCP source port") Signed-off-by: Tabrez Ahmed Reviewed-by: Charalampos Mitrodimas Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20260217135350.33641-1-tabreztalks@gmail.com Signed-off-by: Paolo Abeni commit 6bf45704a92a128a8bfb2dd4d550c61b257c8f9a Author: Allison Henderson Date: Mon Feb 16 15:26:43 2026 -0700 net/rds: Fix NULL pointer dereference in rds_tcp_accept_one Save a local pointer to new_sock->sk and hold a reference before installing callbacks in rds_tcp_accept_one. After rds_tcp_set_callbacks() or rds_tcp_reset_callbacks(), tc->t_sock is set to new_sock which may race with the shutdown path. A concurrent rds_tcp_conn_path_shutdown() may call sock_release(), which sets new_sock->sk = NULL and may eventually free sk when the refcount reaches zero. Subsequent accesses to new_sock->sk->sk_state would dereference NULL, causing the crash. The fix saves a local sk pointer before callbacks are installed so that sk_state can be accessed safely even after new_sock->sk is nulled, and uses sock_hold()/sock_put() to ensure sk itself remains valid for the duration. Fixes: 826c1004d4ae ("net/rds: rds_tcp_conn_path_shutdown must not discard messages") Reported-by: syzbot+96046021045ffe6d7709@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=96046021045ffe6d7709 Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260216222643.2391390-1-achender@kernel.org Signed-off-by: Paolo Abeni commit 123d2e75a14e8a21cecac3f3452221ba901f8111 Author: Jan Höppner Date: Thu Feb 19 12:05:53 2026 +0100 s390/tape: Fix device driver name Recent cleanups and code consolidations in the s390 tape device driver renamed files and function namespaces from tape_34xx to tape_3490 to better reflect the single support of the IBM 3490E device in the codebase. These changes also renamed the driver name to tape_3490, which consequently broke userspace as the sysfs driver path is now /sys/bus/ccw/drivers/tape_3490/ instead of /sys/bus/ccw/drivers/tape_34xx/. Change the device driver name back to tape_34xx to fix userspace. Fixes: 9872dae6102e ("s390/tape: Rename tape_34xx.c to tape_3490.c") Reported-by: Alexander Egorenkov Reviewed-by: Jens Remus Tested-by: Alexander Egorenkov Signed-off-by: Jan Höppner Signed-off-by: Heiko Carstens commit ea129e55c9e06a51a93c3f5ef3e32a6cfa3f8ec7 Author: Govindarajulu Varadarajan Date: Wed Feb 18 20:59:30 2026 -0800 io_uring: Add size check for sqe->cmd For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to check if size of user struct does not exceed 80 bytes at compile time. User doesn't have to track this manually during development. Replace io_uring_sqe_cmd() inline func with macro and add io_uring_sqe128_cmd() which checks struct size for 16 bytes cmd and 80 bytes cmd respectively. Signed-off-by: Govindarajulu Varadarajan Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 42a6bd57ee9f930a72c26f863c72f666d6ed9ea5 Author: Caleb Sander Mateos Date: Wed Feb 18 18:35:34 2026 -0700 io_uring: add IORING_OP_URING_CMD128 to opcode checks io_should_commit(), io_uring_classic_poll(), and io_do_iopoll() compare struct io_kiocb's opcode against IORING_OP_URING_CMD to implement special treatment for uring_cmds. The recently added opcode IORING_OP_URING_CMD128 is meant to be equivalent to IORING_OP_URING_CMD, so treat it the same way in these functions. Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED") Signed-off-by: Caleb Sander Mateos Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit 709cc48d3d01facaeb1eec3d93e1e1fb2fb21717 Merge: 2b7a25df823dc7 079a015b5a630a Author: Wolfram Sang Date: Thu Feb 19 15:11:15 2026 +0100 Merge branch 'i2c/i2c-host-2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow commit 729a2e8e9ac47099a967567389cc9d73ef4194ca Author: Arnd Bergmann Date: Mon Feb 16 11:54:21 2026 +0100 arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) gcc-16 warns about an instance that older compilers did not: arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_clear': arch/arm64/mm/hugetlbpage.c:369:57: error: parameter 'addr' set but not used [-Werror=unused-but-set-parameter=] The issue here is that __pte_clear() does not actually use its second argument, but when CONFIG_ARM64_CONTPTE is enabled it still gets updated. Replace the macro with an inline function to let the compiler see the argument getting passed down. Suggested-by: Catalin Marinas Signed-off-by: Arnd Bergmann Reviewed-by: Dev Jain Signed-off-by: Will Deacon commit 29cc0f3aa7c64d3b3cb9d94c0a0984ba6717bf72 Author: Marc Zyngier Date: Fri Feb 13 14:16:19 2026 +0000 arm64: Force the use of CNTVCT_EL0 in __delay() Quentin forwards a report from Hyesoo Yu, describing an interesting problem with the use of WFxT in __delay() when a vcpu is loaded and that KVM is *not* in VHE mode (either nVHE or hVHE). In this case, CNTVOFF_EL2 is set to a non-zero value to reflect the state of the guest virtual counter. At the same time, __delay() is using get_cycles() to read the counter value, which is indirected to reading CNTPCT_EL0. The core of the issue is that WFxT is using the *virtual* counter, while the kernel is using the physical counter, and that the offset introduces a really bad discrepancy between the two. Fix this by forcing the use of CNTVCT_EL0, making __delay() consistent irrespective of the value of CNTVOFF_EL2. Reported-by: Hyesoo Yu Reported-by: Quentin Perret Reviewed-by: Quentin Perret Fixes: 7d26b0516a0d ("arm64: Use WFxT for __delay() when possible") Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/ktosachvft2cgqd5qkukn275ugmhy6xrhxur4zqpdxlfr3qh5h@o3zrfnsq63od Cc: stable@vger.kernel.org Signed-off-by: Will Deacon commit 0783052534f547f8f201dd4554b1df9f1f8615b5 Author: Detlev Casanova Date: Wed Feb 18 15:18:34 2026 -0500 ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk Drivers will not always call set_sysclk() for all clocks, especially when default mclk-fs can be used. When that is the case, use the clock rate set in the params multiplied by the default mclk-fs. Fixes: 5323186e2e8d ("ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback") Signed-off-by: Detlev Casanova Reported-by: Luca Ceresoli Link: https://patch.msgid.link/20260218201834.924358-1-detlev.casanova@collabora.com Signed-off-by: Mark Brown commit d08008f196107a80c4e88b866d594b88a56ceaa9 Merge: d649c58bcad8fb 80ca113671a005 Author: Takashi Iwai Date: Thu Feb 19 12:08:48 2026 +0100 Merge tag 'asoc-fix-v7.0-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.0 merge window A reasonably small set of fixes and quriks that came in during the merge window, there's one more pending that I'll send tomorrow if you didn't send a PR already. commit d649c58bcad8fb9b749e3837136a201632fa109d Author: Aaron Erhardt Date: Wed Feb 18 22:32:10 2026 +0100 ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Depending on the timing during boot, the BIOS might report wrong pin capabilities, which can lead to HDMI audio being disabled. Therefore, force HDMI audio connection on TUXEDO InfinityBook S 14 Gen6. Signed-off-by: Aaron Erhardt Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260218213234.429686-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai commit 023cd6d90f8aa2ef7b72d84be84a18e61ecebd64 Author: Piotr Mazek Date: Thu Feb 5 23:05:02 2026 +0100 ACPI: PM: Save NVS memory on Lenovo G70-35 [821d6f0359b0614792ab8e2fb93b503e25a65079] prevented machines produced later than 2012 from saving NVS region to accelerate S3. Despite being made after 2012, Lenovo G70-35 still needs NVS memory saving during S3. A quirk is introduced for this platform. Signed-off-by: Piotr Mazek [ rjw: Subject adjustment ] Link: https://patch.msgid.link/GV2PPF3CD5B63CC2442EE3F76F8443EAD90D499A@GV2PPF3CD5B63CC.EURP251.PROD.OUTLOOK.COM Signed-off-by: Rafael J. Wysocki commit a58b8764aed9648357b1c5b6368c9943ba33b7f9 Author: Benno Lossin Date: Sun Feb 15 14:22:30 2026 +0100 rust: pin-init: replace clippy `expect` with `allow` `clippy` has changed behavior in [1] (Rust 1.95) where it no longer warns about the `let_and_return` lint when a comment is placed between the let binding and the return expression. Nightly thus fails to build, because the expectation is no longer fulfilled. Thus replace the expectation with an `allow`. [ The errors were: error: this lint expectation is unfulfilled --> rust/pin-init/src/lib.rs:1279:10 | 1279 | #[expect(clippy::let_and_return)] | ^^^^^^^^^^^^^^^^^^^^^^ | = note: `-D unfulfilled-lint-expectations` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(unfulfilled_lint_expectations)]` error: this lint expectation is unfulfilled --> rust/pin-init/src/lib.rs:1295:10 | 1295 | #[expect(clippy::let_and_return)] | ^^^^^^^^^^^^^^^^^^^^^^ - Miguel ] Link: https://github.com/rust-lang/rust-clippy/pull/16461 [1] Signed-off-by: Benno Lossin Cc: stable@vger.kernel.org # Needed in 6.18.y and later. Link: https://patch.msgid.link/20260215132232.1549861-1-lossin@kernel.org Signed-off-by: Miguel Ojeda commit 621609f1e5ca43a75edd497dd1c28bd84aa66433 Author: Benno Lossin Date: Sat Feb 14 10:27:40 2026 +0100 rust: irq: add `'static` bounds to irq callbacks These callback functions take a generic `T` that is used in the body as the generic argument in `Registration` and `ThreadedRegistration`. Those types require `T: 'static`, but due to a compiler bug this requirement isn't propagated to the function. Thus add the bound. This was caught in the upstream Rust CI [1]. [ The three errors looked similar and will start appearing with Rust 1.95.0 (expected 2026-04-16). The first one was: error[E0310]: the parameter type `T` may not live long enough Error: --> rust/kernel/irq/request.rs:266:43 | 266 | let registration = unsafe { &*(ptr as *const Registration) }; | ^^^^^^^^^^^^^^^^^^^^^^ | | | the parameter type `T` must be valid for the static lifetime... | ...so that the type `T` will meet its required lifetime bounds | help: consider adding an explicit lifetime bound | 264 | unsafe extern "C" fn handle_irq_callback(_irq: i32, ptr: *mut c_void) -> c_uint { | +++++++++ - Miguel ] Link: https://github.com/rust-lang/rust/pull/149389 [1] Signed-off-by: Benno Lossin Cc: stable@vger.kernel.org Fixes: 29e16fcd67ee ("rust: irq: add &Device argument to irq callbacks") Reviewed-by: Gary Guo Reviewed-by: Daniel Almeida Acked-by: Danilo Krummrich Link: https://lore.kernel.org/rust-for-linux/20260217222425.8755-1-cole@unwrap.rs/ Link: https://patch.msgid.link/20260214092740.3201946-1-lossin@kernel.org Signed-off-by: Miguel Ojeda commit 768f4dc4cc318a547303f3ec984e5b366566950b Merge: 6c4b2243cb6c07 294f54f849d846 Author: Christian Brauner Date: Thu Feb 19 09:12:13 2026 +0100 Merge patch series "fserror: bug fixes" This contains two fixes for the new fserror infrastructure. * patches from https://patch.msgid.link/177148129514.716249.10889194125495783768.stgit@frogsfrogsfrogs: fserror: fix lockdep complaint when igrabbing inode fsnotify: drop unused helper Link: https://patch.msgid.link/177148129514.716249.10889194125495783768.stgit@frogsfrogsfrogs Signed-off-by: Christian Brauner commit 294f54f849d846f4643a67db9b41b63867dc8bfe Author: Darrick J. Wong Date: Wed Feb 18 22:09:37 2026 -0800 fserror: fix lockdep complaint when igrabbing inode Christoph Hellwig reported a lockdep splat in generic/108: ================================ WARNING: inconsistent lock state 6.19.0+ #4827 Tainted: G N -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. swapper/1/0 [HC1[1]:SC0[0]:HE0:SE1] takes: ffff88811ed1b140 (&sb->s_type->i_lock_key#33){?.+.}-{3:3}, at: igrab+0x1a/0xb0 {HARDIRQ-ON-W} state was registered at: lock_acquire+0xca/0x2c0 _raw_spin_lock+0x2e/0x40 unlock_new_inode+0x2c/0xc0 xfs_iget+0xcf4/0x1080 xfs_trans_metafile_iget+0x3d/0x100 xfs_metafile_iget+0x2b/0x50 xfs_mount_setup_metadir+0x20/0x60 xfs_mountfs+0x457/0xa60 xfs_fs_fill_super+0x6b3/0xa90 get_tree_bdev_flags+0x13c/0x1e0 vfs_get_tree+0x27/0xe0 vfs_cmd_create+0x54/0xe0 __do_sys_fsconfig+0x309/0x620 do_syscall_64+0x8b/0xf80 entry_SYSCALL_64_after_hwframe+0x76/0x7e irq event stamp: 139080 hardirqs last enabled at (139079): [] do_idle+0x1ec/0x270 hardirqs last disabled at (139080): [] common_interrupt+0x19/0xe0 softirqs last enabled at (139032): [] __irq_exit_rcu+0xc3/0x120 softirqs last disabled at (139025): [] __irq_exit_rcu+0xc3/0x120 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&sb->s_type->i_lock_key#33); lock(&sb->s_type->i_lock_key#33); *** DEADLOCK *** 1 lock held by swapper/1/0: #0: ffff8881052c81a0 (&vblk->vqs[i].lock){-.-.}-{3:3}, at: virtblk_done+0x4b/0x110 stack backtrace: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G N 6.19.0+ #4827 PREEMPT(full) Tainted: [N]=TEST Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x5b/0x80 print_usage_bug.part.0+0x22c/0x2c0 mark_lock+0xa6f/0xe90 __lock_acquire+0x10b6/0x25e0 lock_acquire+0xca/0x2c0 _raw_spin_lock+0x2e/0x40 igrab+0x1a/0xb0 fserror_report+0x135/0x260 iomap_finish_ioend_buffered+0x170/0x210 clone_endio+0x8f/0x1c0 blk_update_request+0x1e4/0x4d0 blk_mq_end_request+0x1b/0x100 virtblk_done+0x6f/0x110 vring_interrupt+0x59/0x80 __handle_irq_event_percpu+0x8a/0x2e0 handle_irq_event+0x33/0x70 handle_edge_irq+0xdd/0x1e0 __common_interrupt+0x6f/0x180 common_interrupt+0xb7/0xe0 It looks like the concern here is that inode::i_lock is sometimes taken in IRQ context, and sometimes it is held when going to IRQ context, though it's a little difficult to tell since I think this is a kernel from after the actual 6.19 release but before 7.0-rc1. Either way, we don't need to take i_lock, because filesystems should not report files to fserror if they're about to be freed or have not yet been exposed to other threads, because the resulting fsnotify report will be meaningless. Therefore, bump inode::i_count directly and clarify the preconditions on the inode being passed in. Link: https://lore.kernel.org/linux-fsdevel/aY7BndIgQg3ci_6s@infradead.org/ Reported-by: Christoph Hellwig Signed-off-by: Darrick J. Wong Link: https://patch.msgid.link/177148129564.716249.3069780698231701540.stgit@frogsfrogsfrogs Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit 249013e673fce3506c61063c7cbedd75b4c668d8 Author: Darrick J. Wong Date: Wed Feb 18 22:09:21 2026 -0800 fsnotify: drop unused helper Remove this helper now that all users have been converted to fserror_report_metadata as of 7.0-rc1. Cc: jack@suse.cz Cc: amir73il@gmail.com Signed-off-by: Darrick J. Wong Link: https://patch.msgid.link/177148129543.716249.980530449513340111.stgit@frogsfrogsfrogs Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit 158ebb578cd5f7881fdc7c4ecebddcf9463f91fd Author: Stanislav Kinsburskii Date: Thu Feb 5 18:42:27 2026 +0000 mshv: Handle insufficient root memory hypervisor statuses When creating guest partition objects, the hypervisor may fail to allocate root partition pages and return an insufficient memory status. In this case, deposit memory using the root partition ID instead. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Mukesh R Signed-off-by: Wei Liu commit cf82dd5ea95815e6c0612b61118d2358ef5c05b0 Author: Stanislav Kinsburskii Date: Thu Feb 5 18:42:21 2026 +0000 mshv: Handle insufficient contiguous memory hypervisor status The HV_STATUS_INSUFFICIENT_CONTIGUOUS_MEMORY status indicates that the hypervisor lacks sufficient contiguous memory for its internal allocations. When this status is encountered, allocate and deposit HV_MAX_CONTIGUOUS_ALLOCATION_PAGES contiguous pages to the hypervisor. HV_MAX_CONTIGUOUS_ALLOCATION_PAGES is defined in the hypervisor headers, a deposit of this size will always satisfy the hypervisor's requirements. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Mukesh R Signed-off-by: Wei Liu commit ede54383e646821b499873c1caf2dd97551da8eb Author: Stanislav Kinsburskii Date: Thu Feb 5 18:42:15 2026 +0000 mshv: Introduce hv_deposit_memory helper functions Introduce hv_deposit_memory_node() and hv_deposit_memory() helper functions to handle memory deposit with proper error handling. The new hv_deposit_memory_node() function takes the hypervisor status as a parameter and validates it before depositing pages. It checks for HV_STATUS_INSUFFICIENT_MEMORY specifically and returns an error for unexpected status codes. This is a precursor patch to new out-of-memory error codes support. No functional changes intended. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Mukesh R Signed-off-by: Wei Liu commit 7db44aa173de03c170d4dfa5864ae126678a5ad5 Author: Stanislav Kinsburskii Date: Thu Feb 5 18:42:10 2026 +0000 mshv: Introduce hv_result_needs_memory() helper function Replace direct comparisons of hv_result(status) against HV_STATUS_INSUFFICIENT_MEMORY with a new hv_result_needs_memory() helper function. This improves code readability and provides a consistent and extendable interface for checking out-of-memory conditions in hypercall results. No functional changes intended. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Mukesh R Signed-off-by: Wei Liu commit 2b7a25df823dc7d8f56f8ce7c2d2dac391cea9c2 Merge: eeccf287a2a517 90627a1e08e602 Author: Linus Torvalds Date: Wed Feb 18 21:40:16 2026 -0800 Merge tag 'mm-nonmm-stable-2026-02-18-19-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more non-MM updates from Andrew Morton: - "two fixes in kho_populate()" fixes a couple of not-major issues in the kexec handover code (Ran Xiaokai) - misc singletons * tag 'mm-nonmm-stable-2026-02-18-19-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: lib/group_cpus: handle const qualifier from clusters allocation type kho: remove unnecessary WARN_ON(err) in kho_populate() kho: fix missing early_memunmap() call in kho_populate() scripts/gdb: implement x86_page_ops in mm.py objpool: fix the overestimation of object pooling metadata size selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT delayacct: fix build regression on accounting tool commit eeccf287a2a517954b57cf9d733b3cf5d47afa34 Merge: 956b9cbd7f156c ac1ea219590c09 Author: Linus Torvalds Date: Wed Feb 18 20:50:32 2026 -0800 Merge tag 'mm-stable-2026-02-18-19-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - "mm/vmscan: fix demotion targets checks in reclaim/demotion" fixes a couple of issues in the demotion code - pages were failed demotion and were finding themselves demoted into disallowed nodes (Bing Jiao) - "Remove XA_ZERO from error recovery of dup_mmap()" fixes a rare mapledtree race and performs a number of cleanups (Liam Howlett) - "mm: add bitmap VMA flag helpers and convert all mmap_prepare to use them" implements a lot of cleanups following on from the conversion of the VMA flags into a bitmap (Lorenzo Stoakes) - "support batch checking of references and unmapping for large folios" implements batching to greatly improve the performance of reclaiming clean file-backed large folios (Baolin Wang) - "selftests/mm: add memory failure selftests" does as claimed (Miaohe Lin) * tag 'mm-stable-2026-02-18-19-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (36 commits) mm/page_alloc: clear page->private in free_pages_prepare() selftests/mm: add memory failure dirty pagecache test selftests/mm: add memory failure clean pagecache test selftests/mm: add memory failure anonymous page test mm: rmap: support batched unmapping for file large folios arm64: mm: implement the architecture-specific clear_flush_young_ptes() arm64: mm: support batch clearing of the young flag for large folios arm64: mm: factor out the address and ptep alignment into a new helper mm: rmap: support batched checks of the references for large folios tools/testing/vma: add VMA userland tests for VMA flag functions tools/testing/vma: separate out vma_internal.h into logical headers tools/testing/vma: separate VMA userland tests into separate files mm: make vm_area_desc utilise vma_flags_t only mm: update all remaining mmap_prepare users to use vma_flags_t mm: update shmem_[kernel]_file_*() functions to use vma_flags_t mm: update secretmem to use VMA flags on mmap_prepare mm: update hugetlbfs to use VMA flags on mmap_prepare mm: add basic VMA flag operation helper functions tools: bitmap: add missing bitmap_[subset(), andnot()] mm: add mk_vma_flags() bitmap flag macro helper ... commit 45be47bf5d7db0f762a93e9c0ede6cb3c91edf3b Author: Hariprasad Kelam Date: Mon Feb 16 14:33:38 2026 +0530 octeontx2-af: Fix default entries mcam entry action As per design, AF should update the default MCAM action only when mcam_index is -1. A bug in the previous patch caused default entries to be changed even when the request was not for them. Fixes: 570ba37898ec ("octeontx2-af: Update RSS algorithm index") Signed-off-by: Hariprasad Kelam Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260216090338.1318976-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit 284f1f176f29ef0db4be806e3255b7154b250c92 Merge: 0da1dba72616b1 71e99ee20fc3f6 Author: Jakub Kicinski Date: Wed Feb 18 17:09:30 2026 -0800 Merge tag 'nf-26-02-17' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net The following patchset contains Netfilter fixes for *net*: 1) Add missing __rcu annotations to NAT helper hook pointers in Amanda, FTP, IRC, SNMP and TFTP helpers. From Sun Jian. 2-4): - Add global spinlock to serialize nft_counter fetch+reset operations. - Use atomic64_xchg() for nft_quota reset instead of read+subtract pattern. Note AI review detects a race in this change but it isn't new. The 'racing' bit only exists to prevent constant stream of 'quota expired' notifications. - Revert commit_mutex usage in nf_tables reset path, it caused circular lock dependency. All from Brian Witte. 5) Fix uninitialized l3num value in nf_conntrack_h323 helper. 6) Fix musl libc compatibility in netfilter_bridge.h UAPI header. This change isn't nice (UAPI headers should not include libc headers), but as-is musl builds may fail due to redefinition of struct ethhdr. 7) Fix protocol checksum validation in IPVS for IPv6 with extension headers, from Julian Anastasov. 8) Fix device reference leak in IPVS when netdev goes down. Also from Julian. 9) Remove WARN_ON_ONCE when accessing forward path array, this can trigger with sufficiently long forward paths. From Pablo Neira Ayuso. 10) Fix use-after-free in nf_tables_addchain() error path, from Inseo An. * tag 'nf-26-02-17' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() net: remove WARN_ON_ONCE when accessing forward path array ipvs: do not keep dest_dst if dev is going down ipvs: skip ipv6 extension headers for csum checks include: uapi: netfilter_bridge.h: Cover for musl libc netfilter: nf_conntrack_h323: don't pass uninitialised l3num value netfilter: nf_tables: revert commit_mutex usage in reset path netfilter: nft_quota: use atomic64_xchg for reset netfilter: nft_counter: serialize reset with spinlock netfilter: annotate NAT helper hook pointers with __rcu ==================== Link: https://patch.msgid.link/20260217163233.31455-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 0da1dba72616b178a64a762a235a24e9899e495d Author: Tariq Toukan Date: Tue Feb 17 09:45:25 2026 +0200 net/mlx5e: XSK, Fix unintended ICOSQ change XSK wakeup must use the async ICOSQ (with proper locking), as it is not guaranteed to run on the same CPU as the channel. The commit that converted the NAPI trigger path to use the sync ICOSQ incorrectly applied the same change to XSK, causing XSK wakeups to use the sync ICOSQ as well. Revert XSK flows to use the async ICOSQ. XDP program attach/detach triggers channel reopen, while XSK pool enable/disable can happen on-the-fly via NDOs without reopening channels. As a result, xsk_pool state cannot be reliably used at mlx5e_open_channel() time to decide whether an async ICOSQ is needed. Update the async_icosq_needed logic to depend on the presence of an XDP program rather than the xsk_pool, ensuring the async ICOSQ is available when XSK wakeups are enabled. This fixes multiple issues: 1. Illegal synchronize_rcu() in an RCU read- side critical section via mlx5e_xsk_wakeup() -> mlx5e_trigger_napi_icosq() -> synchronize_net(). The stack holds RCU read-lock in xsk_poll(). 2. Hitting a NULL pointer dereference in mlx5e_xsk_wakeup(): [] BUG: kernel NULL pointer dereference, address: 0000000000000240 [] #PF: supervisor read access in kernel mode [] #PF: error_code(0x0000) - not-present page [] PGD 0 P4D 0 [] Oops: Oops: 0000 [#1] SMP [] CPU: 0 UID: 0 PID: 2255 Comm: qemu-system-x86 Not tainted 6.19.0-rc5+ #229 PREEMPT(none) [] Hardware name: [...] [] RIP: 0010:mlx5e_xsk_wakeup+0x53/0x90 [mlx5_core] Reported-by: Daniel Borkmann Closes: https://lore.kernel.org/all/20260123223916.361295-1-daniel@iogearbox.net/ Fixes: 56aca3e0f730 ("net/mlx5e: Use regular ICOSQ for triggering NAPI") Tested-by: Daniel Borkmann Signed-off-by: Tariq Toukan Reviewed-by: Dragos Tatulea Acked-by: Alice Mikityanska Link: https://patch.msgid.link/20260217074525.1761454-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit b1216f1d667be672d1594e59c8c94b7669519711 Merge: 570e4549f63293 9395b1bb1f14ae Author: Jakub Kicinski Date: Wed Feb 18 16:46:38 2026 -0800 Merge branch 'icmp-better-deal-with-ddos' Eric Dumazet says: ==================== icmp: better deal with DDOS When dealing with death of big UDP servers, admins might want to increase net.ipv4.icmp_msgs_per_sec and net.ipv4.icmp_msgs_burst to big values (2,000,000 or more). They also might need to tune the per-host ratelimit to 1ms or 0ms in favor of the global rate limit. This series fixes bugs showing up in all these needs. ==================== Link: https://patch.msgid.link/20260216142832.3834174-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9395b1bb1f14ae3fa1e4e2f7988f029cb1c009ed Author: Eric Dumazet Date: Mon Feb 16 14:28:32 2026 +0000 ipv6: icmp: icmpv6_xrlim_allow() optimization if net.ipv6.icmp.ratelimit is zero If net.ipv6.icmp.ratelimit is zero we do not have to call inet_getpeer_v6() and inet_peer_xrlim_allow(). Both can be very expensive under DDOS. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260216142832.3834174-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit d8d9ef29886733428470655f2f99bc7493589fcb Author: Eric Dumazet Date: Mon Feb 16 14:28:31 2026 +0000 ipv4: icmp: icmpv4_xrlim_allow() optimization if net.ipv4.icmp_ratelimit is zero If net.ipv4.icmp_ratelimit is zero, we do not have to call inet_getpeer_v4() and inet_peer_xrlim_allow(). Both can be very expensive under DDOS. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260216142832.3834174-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 0201eedb69b24a6be9b7c1716287a89c4dde2320 Author: Eric Dumazet Date: Mon Feb 16 14:28:30 2026 +0000 ipv6: icmp: remove obsolete code in icmpv6_xrlim_allow() Following part was needed before the blamed commit, because inet_getpeer_v6() second argument was the prefix. /* Give more bandwidth to wider prefixes. */ if (rt->rt6i_dst.plen < 128) tmo >>= ((128 - rt->rt6i_dst.plen)>>5); Now inet_getpeer_v6() retrieves hosts, we need to remove @tmo adjustement or wider prefixes likes /24 allow 8x more ICMP to be sent for a given ratelimit. As we had this issue for a while, this patch changes net.ipv6.icmp.ratelimit default value from 1000ms to 100ms to avoid potential regressions. Also add a READ_ONCE() when reading net->ipv6.sysctl.icmpv6_time. Fixes: fd0273d7939f ("ipv6: Remove external dependency on rt6i_dst and rt6i_src") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Cc: Martin KaFai Lau Link: https://patch.msgid.link/20260216142832.3834174-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 87b08913a9ae82082e276d237ece08fc8ee24380 Author: Eric Dumazet Date: Mon Feb 16 14:28:29 2026 +0000 inet: move icmp_global_{credit,stamp} to a separate cache line icmp_global_credit was meant to be changed ~1000 times per second, but if an admin sets net.ipv4.icmp_msgs_per_sec to a very high value, icmp_global_credit changes can inflict false sharing to surrounding fields that are read mostly. Move icmp_global_credit and icmp_global_stamp to a separate cacheline aligned group. Fixes: b056b4cd9178 ("icmp: move icmp_global.credit and icmp_global.stamp to per netns storage") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260216142832.3834174-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 034bbd806298e9ba4197dd1587b0348ee30996ea Author: Eric Dumazet Date: Mon Feb 16 14:28:28 2026 +0000 icmp: prevent possible overflow in icmp_global_allow() Following expression can overflow if sysctl_icmp_msgs_per_sec is big enough. sysctl_icmp_msgs_per_sec * delta / HZ; Fixes: 4cdf507d5452 ("icmp: add a global rate limitation") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260216142832.3834174-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 570e4549f63293ca4973ef367ff02554f3e3dfc2 Author: Eric Dumazet Date: Tue Feb 17 14:29:24 2026 +0000 selftests/net: packetdrill: add ipv4-mapped-ipv6 tests Add ipv4-mapped-ipv6 case to ksft_runner.sh before an upcoming TCP fix in this area. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260217142924.1853498-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8927a108a7662eb83eb667bc0c5a0633397122b1 Author: Anatol Belski Date: Wed Feb 18 14:48:02 2026 +0000 mshv: Add SMT_ENABLED_GUEST partition creation flag Add support for HV_PARTITION_CREATION_FLAG_SMT_ENABLED_GUEST to allow userspace VMMs to enable SMT for guest partitions. Expose this via new MSHV_PT_BIT_SMT_ENABLED_GUEST flag in the UAPI. Without this flag, the hypervisor schedules guest VPs incorrectly, causing SMT unusable. Signed-off-by: Anatol Belski Signed-off-by: Wei Liu commit a284dbc96a47891a7a595a1c81b1e2da4d309cf6 Author: Muminul Islam Date: Wed Feb 18 14:47:59 2026 +0000 mshv: Add nested virtualization creation flag Introduce HV_PARTITION_CREATION_FLAG_NESTED_VIRTUALIZATION_CAPABLE to indicate support for nested virtualization during partition creation. This enables clearer configuration and capability checks for nested virtualization scenarios. Signed-off-by: Stanislav Kinsburskii Signed-off-by: Muminul Islam Signed-off-by: Wei Liu commit 30d25a8fc04cf1806c09362616e861d6fd339f98 Author: Michael Kelley Date: Wed Feb 18 09:01:21 2026 -0800 Drivers: hv: vmbus: Simplify allocation of vmbus_evt The per-cpu variable vmbus_evt is currently dynamically allocated. It's only 8 bytes, so just allocate it statically to simplify and save a few lines of code. Signed-off-by: Michael Kelley Reviewed-by: Long Li Signed-off-by: Wei Liu commit 36d6cbb62133fc6eea28f380409e0fb190f3dfbe Author: Magnus Kulke Date: Wed Feb 18 23:32:17 2026 +0000 mshv: expose the scrub partition hypercall This hypercall needs to be exposed for VMMs to soft-reboot guests. It will reset APIC and synthetic interrupt controller state, among others. Signed-off-by: Magnus Kulke Signed-off-by: Wei Liu commit 4bef6b28bab8697b4f9255c375da2b6b6943a969 Author: Stanislav Kinsburskii Date: Wed Feb 18 19:11:40 2026 +0000 mshv: Add support for integrated scheduler Query the hypervisor for integrated scheduler support and use it if configured. Microsoft Hypervisor originally provided two schedulers: root and core. The root scheduler allows the root partition to schedule guest vCPUs across physical cores, supporting both time slicing and CPU affinity (e.g., via cgroups). In contrast, the core scheduler delegates vCPU-to-physical-core scheduling entirely to the hypervisor. Direct virtualization introduces a new privileged guest partition type - L1 Virtual Host (L1VH) — which can create child partitions from its own resources. These child partitions are effectively siblings, scheduled by the hypervisor's core scheduler. This prevents the L1VH parent from setting affinity or time slicing for its own processes or guest VPs. While cgroups, CFS, and cpuset controllers can still be used, their effectiveness is unpredictable, as the core scheduler swaps vCPUs according to its own logic (typically round-robin across all allocated physical CPUs). As a result, the system may appear to "steal" time from the L1VH and its children. To address this, Microsoft Hypervisor introduces the integrated scheduler. This allows an L1VH partition to schedule its own vCPUs and those of its guests across its "physical" cores, effectively emulating root scheduler behavior within the L1VH, while retaining core scheduler behavior for the rest of the system. The integrated scheduler is controlled by the root partition and gated by the vmm_enable_integrated_scheduler capability bit. If set, the hypervisor supports the integrated scheduler. The L1VH partition must then check if it is enabled by querying the corresponding extended partition property. If this property is true, the L1VH partition must use the root scheduler logic; otherwise, it must use the core scheduler. This requirement makes reading VMM capabilities in L1VH partition a requirement too. Signed-off-by: Andreea Pintilie Signed-off-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 0597696017fe6c172bce7827be32f4bbd02542ab Author: Uros Bizjak Date: Wed Feb 18 12:00:18 2026 +0100 mshv: Use try_cmpxchg() instead of cmpxchg() Use !try_cmpxchg() instead of cmpxchg (*ptr, old, new) != old. x86 CMPXCHG instruction returns success in ZF flag, so this change saves a compare after CMPXCHG. The generated assembly code improves from e.g.: 415: 48 8b 44 24 30 mov 0x30(%rsp),%rax 41a: 48 8b 54 24 38 mov 0x38(%rsp),%rdx 41f: f0 49 0f b1 91 a8 02 lock cmpxchg %rdx,0x2a8(%r9) 426: 00 00 428: 48 3b 44 24 30 cmp 0x30(%rsp),%rax 42d: 0f 84 09 ff ff ff je 33c <...> to: 415: 48 8b 44 24 30 mov 0x30(%rsp),%rax 41a: 48 8b 54 24 38 mov 0x38(%rsp),%rdx 41f: f0 49 0f b1 91 a8 02 lock cmpxchg %rdx,0x2a8(%r9) 426: 00 00 428: 0f 84 0e ff ff ff je 33c <...> No functional change intended. Signed-off-by: Uros Bizjak Cc: K. Y. Srinivasan Cc: Haiyang Zhang Cc: Wei Liu Cc: Dexuan Cui Cc: Long Li Signed-off-by: Wei Liu commit 705d01c8d78121ee1634bfc602ac4b0ad1438fab Author: Ethan Tidmore Date: Wed Feb 18 13:09:03 2026 -0600 x86/hyperv: Fix error pointer dereference The function idle_thread_get() can return an error pointer and is not checked for it. Add check for error pointer. Detected by Smatch: arch/x86/hyperv/hv_vtl.c:126 hv_vtl_bringup_vcpu() error: 'idle' dereferencing possible ERR_PTR() Fixes: 2b4b90e053a29 ("x86/hyperv: Use per cpu initial stack for vtl context") Signed-off-by: Ethan Tidmore Signed-off-by: Wei Liu commit fe9f15983c4823a8473e289b4a302946a4864ef5 Author: Mukesh Rathor Date: Tue Feb 17 15:11:58 2026 -0800 x86/hyperv: Reserve 3 interrupt vectors used exclusively by MSHV MSVC compiler, used to compile the Microsoft Hypervisor, currently has an assert intrinsic that uses interrupt vector 0x29 to create an exception. This will cause hypervisor to then crash and collect core. As such, if this interrupt number is assigned to a device by Linux and the device generates it, hypervisor will crash. There are two other such vectors hard coded in the hypervisor, 0x2C and 0x2D for debug purposes. Fortunately, the three vectors are part of the kernel driver space and that makes it feasible to reserve them early so they are not assigned later. Signed-off-by: Mukesh Rathor Signed-off-by: Wei Liu commit 1e5c009126952f673ffa2427acbd69e57493f0d2 Author: Matthieu Baerts (NGI0) Date: Wed Feb 18 13:01:44 2026 +0100 selftests/bpf: Remove hexdump dependency The verification signature header generation requires converting a binary certificate to a C array. Previously this only worked with xxd, and a switch to hexdump has been done in commit b640d556a2b3 ("selftests/bpf: Remove xxd util dependency"). hexdump is a more common utility program, yet it might not be installed by default. When it is not installed, BPF selftests build without errors, but tests_progs is unusable: it exits with the 255 code and without any error messages. When manually reproducing the issue, it is not too hard to find out that the generated verification_cert.h file is incorrect, but that's time consuming. When digging the BPF selftests build logs, this line can be seen amongst thousands others, but ignored: /bin/sh: 2: hexdump: not found Here, od is used instead of hexdump. od is coming from the coreutils package, and this new od command produces the same output when using od from GNU coreutils, uutils, and even busybox. This is more portable, and it produces a similar results to what was done before with hexdump: there is an extra comma at the end instead of trailing whitespaces, but the C code is not impacted. Fixes: b640d556a2b3 ("selftests/bpf: Remove xxd util dependency") Signed-off-by: Matthieu Baerts (NGI0) Tested-by: Alan Maguire Link: https://lore.kernel.org/r/20260218-bpf-sft-hexdump-od-v2-1-2f9b3ee5ab86@kernel.org Signed-off-by: Alexei Starovoitov commit 956b9cbd7f156c8672dac94a00de3c6a0939c692 Merge: fa2827e72cfcfa f94711255a73d8 Author: Linus Torvalds Date: Wed Feb 18 14:59:55 2026 -0800 Merge tag 'kbuild-fixes-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Ensure tools/objtool is cleaned by 'make clean' and 'make mrproper' - Fix test program for CONFIG_CC_CAN_LINK to avoid a warning, which is made fatal by -Werror - Drop explicit LZMA parallel compression in scripts/make_fit.py - Several fixes for commit 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") * tag 'kbuild-fixes-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: rpm-pkg: Disable automatic requires for manual debuginfo package kbuild: rpm-pkg: Fix manual debuginfo generation when using .src.rpm kernel: rpm-pkg: Restore find-debuginfo.sh approach to -debuginfo package kbuild: rpm-pkg: Restrict manual debug package creation scripts/make_fit.py: Drop explicit LZMA parallel compression kbuild: Fix CC_CAN_LINK detection kbuild: Add objtool to top-level clean target commit f06eab00e2e0b8a190f44c5b0ceeb19a73462e38 Merge: 3b39d73cc33793 0cecd492f5165d Author: Alexei Starovoitov Date: Wed Feb 18 14:58:47 2026 -0800 Merge branch 'libbpf-remove-extern-declaration-of-bpf_stream_vprintk' Ihor Solodrai says: ==================== libbpf: Remove extern declaration of bpf_stream_vprintk() The first patch adjusts a selftest that has been using bpf_stream_printk() macro. The second patch removes the declaration. ==================== Link: https://patch.msgid.link/20260218215651.2057673-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 0cecd492f5165d3e7a314b87e9b7787734eab324 Author: Ihor Solodrai Date: Wed Feb 18 13:56:51 2026 -0800 libbpf: Remove extern declaration of bpf_stream_vprintk() An issue was reported that building BPF program which includes both vmlinux.h and bpf_helpers.h from libbpf fails due to conflicting declarations of bpf_stream_vprintk(). Remove the extern declaration from bpf_helpers.h to address this. In order to use bpf_stream_printk() macro, BPF programs are expected to either include vmlinux.h of the kernel they are targeting, or add their own extern declaration. Reported-by: Luca Boccassi Closes: https://github.com/libbpf/libbpf/issues/947 Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260218215651.2057673-3-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit b3dfa128f7da7c4dd371a4aff685cd249604e029 Author: Ihor Solodrai Date: Wed Feb 18 13:56:50 2026 -0800 selftests/bpf: Use vmlinux.h in test_xdp_meta - Replace linux/* includes with vmlinux.h - Include errno.h - Include bpf_tracing_net.h for TC_ACT_* and ETH_* - Use BPF_STDERR instead of BPF_STREAM_STDERR Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260218215651.2057673-2-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit fc1e8a6f129d87c64ac8e58b50d9dfa66217cfda Author: Liam Mitchell Date: Wed Feb 18 14:21:35 2026 -0800 Input: bcm5974 - recover from failed mode switch Mode switches sent before control response are ignored. This results in an unresponsive trackpad and "bcm5974: bad trackpad package, length: 8" repeated in logs. On receiving unknown 8-byte packets, assume that mode switch was ignored and schedule an asynchronous mode reset. The reset will switch the device to normal mode, wait, then switch back to wellspring mode. Signed-off-by: Liam Mitchell Link: https://lore.kernel.org/linux-input/CAOQ1CL4+DP1TuLAGNsz5GdFBTHvnTg=5q=Dr2Z1OQc6RXydSYA@mail.gmail.com/ Acked-by: Henrik Rydberg Link: https://patch.msgid.link/20260213-bcm5974-reset-v2-1-1837851336b0@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit fa2827e72cfcfac683e2e3ab355a0dbc97d52522 Merge: 9a199794fd789c 15176b818e048c Author: Linus Torvalds Date: Wed Feb 18 14:33:18 2026 -0800 Merge tag 'thermal-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "This fixes a sysfs group leak on DLVR registration failure in the Intel int340x thermal driver (Kaushlendra Kumar)" * tag 'thermal-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: int340x: Fix sysfs group leak on DLVR registration failure commit 9a199794fd789c783d34281ac1acde011a7affa8 Merge: c3c1e9853363d2 b89d8be0dcf9d7 Author: Linus Torvalds Date: Wed Feb 18 14:28:57 2026 -0800 Merge tag 'acpi-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI support updates from Rafael J. Wysocki: "These are mostly fixes and cleanups on top of the ACPI support updates merged recently, including two new quirks, an ACPI CPPC library fix, and fixes and cleanups of a few core ACPI device drivers: - Add an unused power resource handling quirk for THUNDEROBOT ZERO (Zhai Can) - Fix remaining for_each_possible_cpu() in the ACPI CPPC library to use online CPUs (Sean V Kelley) - Drop redundant checks from the ACPI notify handler and the driver remove callback in the ACPI battery driver (Rafael Wysocki) - Move the creation of the wakeup source during the ACPI button driver probe to an earlier point to avoid missing a wakeup event due to a race and clean up system wakeup handling and remove callback in that driver (Rafael Wysocki) - Drop unnecessary driver_data pointer clearing from the ACPI EC and SMBUS HC drivers and make the ACPI backlight (video) driver clear the device's driver_data pointer on remove (Rafael Wysocki) - Force enabling of PWM2 on the Yogabook YB1-X90 tablets (Yauhen Kharuzhy)" * tag 'acpi-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO ACPI: driver: Drop driver_data pointer clearing from two drivers ACPI: video: Clear driver_data pointer on remove ACPI: button: Tweak acpi_button_remove() ACPI: button: Tweak system wakeup handling ACPI: battery: Drop redundant checks from acpi_battery_remove() ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 ACPI: button: Call device_init_wakeup() earlier during probe ACPI: battery: Drop redundant check from acpi_battery_notify() commit 7be41fb00e2c2a823f271a8318b453ca11812f1e Author: Dan Carpenter Date: Wed Oct 29 08:30:11 2025 +0300 accel: ethosu: Fix shift overflow in cmd_to_addr() The "((cmd[0] & 0xff0000) << 16)" shift is zero. This was intended to be (((u64)cmd[0] & 0xff0000) << 16). Move the cast to the correct location. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aQGmY64tWcwOGFP4@stanley.mountain Signed-off-by: Rob Herring (Arm) commit c3c1e9853363d247270f9d500cbaa1df8f14d4f9 Merge: 23b0f90ba871f0 becbdde56a5c0e Author: Linus Torvalds Date: Wed Feb 18 14:11:47 2026 -0800 Merge tag 'pm-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These are mostly fixes on top of the power management updates merged recently in cpuidle governors, in the Intel RAPL power capping driver and in the wake IRQ management code: - Fix the handling of package-scope MSRs in the intel_rapl power capping driver when called from the PMU subsystem and make it add all package CPUs to the PMU cpumask to allow tools to read RAPL events from any CPU in the package (Kuppuswamy Satharayananyan) - Rework the invalid version check in the intel_rapl_tpmi power capping driver to account for the fact that on partitioned systems, multiple TPMI instances may exist per package, but RAPL registers are only valid on one instance (Kuppuswamy Satharayananyan) - Describe the new intel_idle.table command line option in the admin-guide intel_idle documentation (Artem Bityutskiy) - Fix a crash in the ladder cpuidle governor on systems with only one (polling) idle state available by making the cpuidle core bypass the governor in those cases and adjust the other existing governors to that change (Aboorva Devarajan, Christian Loehle) - Update kerneldoc comments for wake IRQ management functions that have not been matching the code (Wang Jiayue)" * tag 'pm-7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle: menu: Remove single state handling cpuidle: teo: Remove single state handling cpuidle: haltpoll: Remove single state handling cpuidle: Skip governor when only one idle state is available powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check PM: sleep: wakeirq: Update outdated documentation comments Documentation: PM: Document intel_idle.table command line option powercap: intel_rapl: Expose all package CPUs in PMU cpumask powercap: intel_rapl: Remove incorrect CPU check in PMU context commit beeebffc807531f69445356180238500f56951cc Author: Eric Biggers Date: Sun Feb 15 18:21:04 2026 -0800 lib/crypto: powerpc/aes: Fix rndkey_from_vsx() on big endian CPUs I finally got a big endian PPC64 kernel to boot in QEMU. The PPC64 VSX optimized AES library code does work in that case, with the exception of rndkey_from_vsx() which doesn't take into account that the order in which the VSX code stores the round key words depends on the endianness. So fix rndkey_from_vsx() to do the right thing on big endian CPUs. Fixes: 7cf2082e74ce ("lib/crypto: powerpc/aes: Migrate POWER8 optimized code into library") Link: https://lore.kernel.org/r/20260216022104.332991-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 08020dbe3125e936429e7966bf072e08fa964f36 Author: Massimiliano Pellizzer Date: Tue Feb 10 18:15:38 2026 +0100 apparmor: fix signedness bug in unpack_tags() Smatch static checker warning: security/apparmor/policy_unpack.c:966 unpack_pdb() warn: unsigned 'unpack_tags(e, &pdb->tags, info)' is never less than zero. unpack_tags() is declared with return type size_t (unsigned) but returns negative errno values on failure. The caller in unpack_pdb() tests the return with `< 0`, which is always false for an unsigned type, making error handling dead code. Malformed tag data would be silently accepted instead of causing a load failure. Change return type of unpack_tags() from size_t to int to match the functions's actual semantic. Fixes: 3d28e2397af7 ("apparmor: add support loading per permission tagging") Reported-by: Dan Carpenter Signed-off-by: Massimiliano Pellizzer Signed-off-by: John Johansen commit b89d8be0dcf9d734583f10d88b85256ec67dd0dd Merge: ca8ee553dbc497 b83afb7e8c3388 1abdf9e7967f15 85d0bd1d4cccd8 Author: Rafael J. Wysocki Date: Wed Feb 18 20:21:59 2026 +0100 Merge branches 'acpi-battery', 'acpi-button' and 'acpi-driver' Merge additional updates of multiple core ACPI device drivers (battery, button, video, EC, SMBUS HC) for 7.0-rc1: - Drop redundant checks from the ACPI notify handler and the driver remove callback in the ACPI battery driver (Rafael Wysocki) - Move the creation of the wakeup source during the ACPI button driver probe to an earlier point to avoid missing a wakeup event due to a race and clean up system wakeup handling and remove callback in that driver (Rafael Wysocki) - Drop unnecessary driver_data pointer clearing from the ACPI EC and SMBUS HC drivers and make the ACPI backlight (video) driver clear the device's driver_data pointer on remove (Rafael Wysocki) * acpi-battery: ACPI: battery: Drop redundant checks from acpi_battery_remove() ACPI: battery: Drop redundant check from acpi_battery_notify() * acpi-button: ACPI: button: Tweak acpi_button_remove() ACPI: button: Tweak system wakeup handling ACPI: button: Call device_init_wakeup() earlier during probe * acpi-driver: ACPI: driver: Drop driver_data pointer clearing from two drivers ACPI: video: Clear driver_data pointer on remove commit ca8ee553dbc497228e4f85ee1eef83ed7fac363c Merge: a8c975302868c7 cd7ef20ba8c6e9 56eb0c0ed345da Author: Rafael J. Wysocki Date: Wed Feb 18 20:17:53 2026 +0100 Merge branches 'acpi-pm' and 'acpi-cppc' Merge an ACPI power management update and an ACPI CPPC library update for 7.0-rc1: - Add an unused power resource handling quirk for THUNDEROBOT ZERO (Zhai Can) - Fix remaining for_each_possible_cpu() in the ACPI CPPC library to use online CPUs (Sean V Kelley) * acpi-pm: ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO * acpi-cppc: ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs commit becbdde56a5c0e40c9bbbb6b8d5ffbb8de635d63 Merge: bd9635c4d6728a c7d54dafa042cf 93983a9f3beea7 Author: Rafael J. Wysocki Date: Wed Feb 18 19:48:30 2026 +0100 Merge branches 'pm-powercap' and 'pm-cpuidle' Merge additional power capping and cpuidle updates for 7.0-rc1: - Fix the handling of package-scope MSRs in the intel_rapl power capping driver when called from the PMU subsystem and make it add all package CPUs to the PMU cpumask to allow tools to read RAPL events from any CPU in the package (Kuppuswamy Sathyanarayanan) - Rework the invalid version check in the intel_rapl_tpmi power capping driver to account for the fact that on partitioned systems, multiple TPMI instances may exist per package, but RAPL registers are only valid on one instance (Kuppuswamy Satharayananyan) - Describe the new intel_idle.table command line option in the admin-guide intel_idle documentation (Artem Bityutskiy) - Fix a crash in the ladder cpuidle governor on systems with only one (polling) idle state available by making the cpuidle core bypass the governor in those cases and adjust the other existing governors to that change (Aboorva Devarajan, Christian Loehle) * pm-powercap: powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check powercap: intel_rapl: Expose all package CPUs in PMU cpumask powercap: intel_rapl: Remove incorrect CPU check in PMU context * pm-cpuidle: cpuidle: menu: Remove single state handling cpuidle: teo: Remove single state handling cpuidle: haltpoll: Remove single state handling cpuidle: Skip governor when only one idle state is available Documentation: PM: Document intel_idle.table command line option commit 23b0f90ba871f096474e1c27c3d14f455189d2d9 Merge: 7ad54bbbc9c512 d174174c6776a3 Author: Linus Torvalds Date: Wed Feb 18 10:45:36 2026 -0800 Merge tag 'sysctl-7.00-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl updates from Joel Granados: - Remove macros from proc handler converters Replace the proc converter macros with "regular" functions. Though it is more verbose than the macro version, it helps when debugging and better aligns with coding-style.rst. - General cleanup Remove superfluous ctl_table forward declarations. Const qualify the memory_allocation_profiling_sysctl and loadpin_sysctl_table arrays. Add missing kernel doc to proc_dointvec_conv. - Testing This series was run through sysctl selftests/kunit test suite in x86_64. And went into linux-next after rc4, giving it a good 3 weeks of testing * tag 'sysctl-7.00-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions sysctl: Replace unidirectional INT converter macros with functions sysctl: Add kernel doc to proc_douintvec_conv sysctl: Replace UINT converter macros with functions sysctl: Add CONFIG_PROC_SYSCTL guards for converter macros sysctl: clarify proc_douintvec_minmax doc sysctl: Return -ENOSYS from proc_douintvec_conv when CONFIG_PROC_SYSCTL=n sysctl: Remove unused ctl_table forward declarations loadpin: Implement custom proc_handler for enforce alloc_tag: move memory_allocation_profiling_sysctls into .rodata sysctl: Add missing kernel-doc for proc_dointvec_conv commit 7ad54bbbc9c512ba3bc90e4368264bcf15c25759 Merge: 2961f841b025fb ef0e60083f768b Author: Linus Torvalds Date: Wed Feb 18 09:52:38 2026 -0800 Merge tag 'turbostat-2026.02.14-AMD-RAPL-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat fix from Len Brown: "Fix a recent AMD regression due to errant code cleanup" * tag 'turbostat-2026.02.14-AMD-RAPL-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: Fix AMD RAPL regression commit 003049b1c4fb8aabb93febb7d1e49004f6ad653b Author: Kai Aizen Date: Wed Feb 18 17:36:41 2026 +0000 io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_dec) to manipulate user_refs. This is serialized against other callers by rq_lock, but io_zcrx_scrub() modifies the same counter with atomic_xchg() WITHOUT holding rq_lock. On SMP systems, the following race exists: CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock) put_niov_uref: atomic_read(uref) - 1 // window opens atomic_xchg(uref, 0) - 1 return_niov_freelist(niov) [PUSH #1] // window closes atomic_dec(uref) - wraps to -1 returns true return_niov(niov) return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE] The same niov is pushed to the freelist twice, causing free_count to exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds write (a u32 value) past the kvmalloc'd freelist array into the adjacent slab object. Fix this by replacing the non-atomic read-then-dec in io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically tests and decrements user_refs. This makes the operation safe against concurrent atomic_xchg from scrub without requiring scrub to acquire rq_lock. Fixes: 34a3e60821ab ("io_uring/zcrx: implement zerocopy receive pp memory provider") Cc: stable@vger.kernel.org Signed-off-by: Kai Aizen [pavel: removed a warning and a comment] Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 80ca113671a005430207d351cb403c1637106212 Author: Shengjiu Wang Date: Thu Feb 12 10:18:29 2026 +0800 ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names In the original txt format binding document ak4458.txt, the supply names are 'AVDD-supply', 'DVDD-supply', and they are also used in driver. But in the commit converting to yaml format, they are changed to 'avdd-supply', 'dvdd-supply'. After search all the dts file, these names 'AVDD-supply', 'DVDD-supply', 'avdd-supply', 'dvdd-supply' are not used in any dts file. So it is safe to fix the yaml binding document. Fixes: 829d78e3ea32 ("ASoC: dt-bindings: ak5558: Convert to dtschema") Cc: stable@vger.kernel.org Signed-off-by: Shengjiu Wang Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260212021829.3244736-4-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit e570a5ca307f6d7a6acd080fc219db2ce3c0737b Author: Shengjiu Wang Date: Thu Feb 12 10:18:28 2026 +0800 ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names In the original txt format binding document ak4458.txt, the supply names are 'AVDD-supply', 'DVDD-supply', and they are also used in driver. But in the commit converting to yaml format, they are changed to 'avdd-supply', 'dvdd-supply'. After search all the dts file, these names 'AVDD-supply', 'DVDD-supply', 'avdd-supply', 'dvdd-supply' are not used in any dts file. So it is safe to fix this yaml binding document. Fixes: 009e83b591dd ("ASoC: dt-bindings: ak4458: Convert to dtschema") Cc: stable@vger.kernel.org Signed-off-by: Shengjiu Wang Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260212021829.3244736-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 50a634f1d795721ce68583c78ba493f1d7aa8bc2 Author: Shengjiu Wang Date: Thu Feb 12 10:18:27 2026 +0800 ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false When including the dai-common.yaml, and allow '#sound-dai-cells' and "sound-name-prefix' to be used, should use unevaluatedProperties:false according to writing-bindings.rst. Fixes: 8d7de4a014f5 ("ASoC: dt-bindings: asahi-kasei,ak4458: Reference common DAI properties") Cc: stable@vger.kernel.org Signed-off-by: Shengjiu Wang Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260212021829.3244736-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 3acf517e1ae05ef66561b7a2782690387ce46e21 Author: Vijendar Mukunda Date: Wed Feb 18 16:15:34 2026 +0530 ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models This patch adds a quirk to include the codec amplifier function for Lenovo models listed in the quirk table. Note: In these models, the RT722 codec amplifier is excluded, and an external amplifier is used instead. Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20260218104734.3641481-3-Vijendar.Mukunda@amd.com Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Mark Brown commit 7869f1c1123cfc0fb22a9de96cc6eb75072a3971 Author: Vijendar Mukunda Date: Wed Feb 18 16:15:33 2026 +0530 ASoC: amd: acp: Add ACP7.0 match entries for Realtek parts This patch adds below machine configuration for the ACP7.0 & ACP7.1 platforms. Link 0: RT1320 amplifier Link 1: RT722 codec with three endpoints: Headset, Speaker, and DMIC. Note: The Speaker endpoint on the RT722 codec is not used. Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20260218104734.3641481-2-Vijendar.Mukunda@amd.com Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Mark Brown commit 625be3456b3ced6e2dca6166962c0cf6cc2e546d Author: David Carlier Date: Tue Feb 17 20:08:36 2026 +0000 tools/sched_ext: scx_pair: fix stride == 0 crash on single-CPU systems nr_cpu_ids / 2 produces stride 0 on a single-CPU system, which later causes SCX_BUG_ON(i == j) to fire. Validate stride after option parsing to also catch invalid user-supplied values via -S. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit 55a24d9203979d1cd0196ba1d189860e8b828c2e Author: David Carlier Date: Tue Feb 17 19:48:00 2026 +0000 tools/sched_ext: scx_central: fix CPU_SET and skeleton leak on early exit Use CPU_SET_S() instead of CPU_SET() on the dynamically allocated cpuset to avoid a potential out-of-bounds write when nr_cpu_ids exceeds CPU_SETSIZE. Also destroy the skeleton before returning on invalid central CPU ID to prevent a resource leak. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit 4a063f64f905310ae7ec81f2e1cc9fdefb7ac3d7 Author: Samson Tam Date: Mon Dec 15 17:14:21 2025 -0500 drm/amd/display: Add static keyword for sharpness tables [Why & How] Sharpness tables are only accessed in dc_spl_isharp_filters source file. Reviewed-by: Joshua Aberback Reviewed-by: Jun Lei Signed-off-by: Samson Tam Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 17ff034f805e032ed1358624a71381f9d6e29e9e Author: Timur Kristóf Date: Mon Jan 26 22:08:26 2026 +0100 drm/amd/display: Only use analog stream encoder with analog engine Some GPUs have analog connectors that work with a DP bridge chip and don't actually have an internal DAC: Those should not use the analog stream encoders. Fixes: 5834c33fd3f6 ("drm/amd/display: Add concept of analog encoders (v2)") Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit f402898bd101af3166bde236b7f6a43d926e17a0 Author: Timur Kristóf Date: Mon Jan 26 22:08:25 2026 +0100 drm/amd/display: Only use analog link encoder with analog engine Some GPUs have analog connectors that work with a DP bridge chip and don't actually have an internal DAC: Those should not use the analog link encoder code path. Fixes: 0fbe321a93ce ("drm/amd/display: Implement DCE analog link encoders (v2)") Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 2de34fbcab2063cd3d52e5872a801b9a5fc755d0 Author: Timur Kristóf Date: Mon Jan 26 22:08:24 2026 +0100 drm/amd/display: Use DCE 6 link encoder for DCE 6 analog connectors DCE 6 should use the DCE 6 specific link encoder. This was a copy paste mistake. Fixes: 0fbe321a93ce ("drm/amd/display: Implement DCE analog link encoders (v2)") Signed-off-by: Timur Kristóf Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit ecb7c2484cfc83a93658907580035a8adf1e0a92 Author: Filipe Manana Date: Wed Feb 4 17:15:53 2026 +0000 btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found If btrfs_search_slot_for_read() returns 1, it means we did not find any key greater than or equals to the key we asked for, meaning we have reached the end of the tree and therefore the path is not valid. If this happens we need to break out of the loop and stop, instead of continuing and accessing an invalid path. Fixes: 5223cc60b40a ("btrfs: drop the path before adding qgroup items when enabling qgroups") Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7b54e08f2ef8f94d7e3959dde3694c4c34fa7701 Author: Filipe Manana Date: Sun Feb 8 19:48:14 2026 +0000 btrfs: fix lost error return in btrfs_find_orphan_roots() If the call to btrfs_get_fs_root() returns an error different from -ENOENT we break out of the loop and then return 0, losing the error. Fix this by returning the error instead of breaking from the loop. Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260208185321.1128472-1-clm@meta.com/ Fixes: 8670a25ecb2f ("btrfs: use single return variable in btrfs_find_orphan_roots()") Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 29e525665a77a70ea8f19310e96b1b1472b07fc9 Author: Filipe Manana Date: Sun Feb 8 18:30:08 2026 +0000 btrfs: fix lost return value on error in finish_verity() If btrfs_update_inode() or del_orphan() fail, we jump to the 'end_trans' label and then return 0 instead of the error returned by one of those calls. Fix this and return the error. Fixes: 61fb7f04ee06 ("btrfs: remove out label in finish_verity()") Reported-by: Chris Mason Link: https://lore.kernel.org/linux-btrfs/20260208161129.3888234-1-clm@meta.com/ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f46a283bbc58d7871ab22f5882e942f889fa2b0e Author: Filipe Manana Date: Tue Feb 3 15:59:26 2026 +0000 btrfs: change unaligned root messages to error level in btrfs_validate_super() If the root nodes for the chunk root, tree root or log root are not sector size aligned, we are logging a warning message but these are in fact errors that makes the super block validation fail. So change the level of the messages from warning to error. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2155d0c0a761a56ce7ede83a26eb23ea0f935260 Author: Filipe Manana Date: Tue Feb 3 18:03:35 2026 +0000 btrfs: use the correct type to initialize block reserve for delayed refs When initializing the delayed refs block reserve for a transaction handle we are passing a type of BTRFS_BLOCK_RSV_DELOPS, which is meant for delayed items and not for delayed refs. The correct type for delayed refs is BTRFS_BLOCK_RSV_DELREFS. On release of any excess space reserved in a local delayed refs reserve, we also should transfer that excess space to the global block reserve (it it's full, we return to the space info for general availability). By initializing a transaction's local delayed refs block reserve with a type of BTRFS_BLOCK_RSV_DELOPS, we were also causing any excess space released from the delayed block reserve (fs_info->delayed_block_rsv, used for delayed inodes and items) to be transferred to the global block reserve instead of the global delayed refs block reserve. This was an unintentional change in commit 28270e25c69a ("btrfs: always reserve space for delayed refs when starting transaction"), but it's not particularly serious as things tend to cancel out each other most of the time and it's relatively rare to be anywhere near exhaustion of the global reserve. Fix this by initializing a transaction's local delayed refs reserve with a type of BTRFS_BLOCK_RSV_DELREFS and making btrfs_block_rsv_release() attempt to transfer unused space from such a reserve into the global block reserve, just as we did before that commit for when the block reserve is a delayed refs rsv. Reported-by: Alex Lyakas Link: https://lore.kernel.org/linux-btrfs/CAOcd+r0FHG5LWzTSu=LknwSoqxfw+C00gFAW7fuX71+Z5AfEew@mail.gmail.com/ Fixes: 28270e25c69a ("btrfs: always reserve space for delayed refs when starting transaction") Reviewed-by: Alex Lyakas Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3 Author: Qu Wenruo Date: Tue Jan 27 15:46:55 2026 +1030 btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() [BUG] There is a bug report that when btrfs hits ENOSPC error in a critical path, btrfs flips RO (this part is expected, although the ENOSPC bug still needs to be addressed). The problem is after the RO flip, if there is a read repair pending, we can hit the ASSERT() inside btrfs_repair_io_failure() like the following: BTRFS info (device vdc): relocating block group 30408704 flags metadata|raid1 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -28) WARNING: fs/btrfs/extent-tree.c:3235 at __btrfs_free_extent.isra.0+0x453/0xfd0, CPU#1: btrfs/383844 Modules linked in: kvm_intel kvm irqbypass [...] ---[ end trace 0000000000000000 ]--- BTRFS info (device vdc state EA): 2 enospc errors during balance BTRFS info (device vdc state EA): balance: ended with status: -30 BTRFS error (device vdc state EA): parent transid verify failed on logical 30556160 mirror 2 wanted 8 found 6 BTRFS error (device vdc state EA): bdev /dev/nvme0n1 errs: wr 0, rd 0, flush 0, corrupt 10, gen 0 [...] assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938 ------------[ cut here ]------------ assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938 kernel BUG at fs/btrfs/bio.c:938! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 868 Comm: kworker/u8:13 Tainted: G W N 6.19.0-rc6+ #4788 PREEMPT(full) Tainted: [W]=WARN, [N]=TEST Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Workqueue: btrfs-endio simple_end_io_work RIP: 0010:btrfs_repair_io_failure.cold+0xb2/0x120 RSP: 0000:ffffc90001d2bcf0 EFLAGS: 00010246 RAX: 0000000000000051 RBX: 0000000000001000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8305cf42 RDI: 00000000ffffffff RBP: 0000000000000002 R08: 00000000fffeffff R09: ffffffff837fa988 R10: ffffffff8327a9e0 R11: 6f69747265737361 R12: ffff88813018d310 R13: ffff888168b8a000 R14: ffffc90001d2bd90 R15: ffff88810a169000 FS: 0000000000000000(0000) GS:ffff8885e752c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 ------------[ cut here ]------------ [CAUSE] The cause of -ENOSPC error during the test case btrfs/124 is still unknown, although it's known that we still have cases where metadata can be over-committed but can not be fulfilled correctly, thus if we hit such ENOSPC error inside a critical path, we have no choice but abort the current transaction. This will mark the fs read-only. The problem is inside the btrfs_repair_io_failure() path that we require the fs not to be mount read-only. This is normally fine, but if we are doing a read-repair meanwhile the fs flips RO due to a critical error, we can enter btrfs_repair_io_failure() with super block set to read-only, thus triggering the above crash. [FIX] Just replace the ASSERT() with a proper return if the fs is already read-only. Reported-by: Christoph Hellwig Link: https://lore.kernel.org/linux-btrfs/20260126045555.GB31641@lst.de/ Tested-by: Christoph Hellwig Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5870ec7c8fe57a8b2c65005e5da5efc054faa3e6 Author: Jiasheng Jiang Date: Wed Jan 14 01:13:38 2026 +0000 btrfs: reset block group size class when it becomes empty Block group size classes are managed consistently everywhere. Currently, btrfs_use_block_group_size_class() sets a block group's size class to specialize it for a specific allocation size. However, this size class remains "stale" even if the block group becomes completely empty (both used and reserved bytes reach zero). This happens in two scenarios: 1. When space reservations are freed (e.g., due to errors or transaction aborts) via btrfs_free_reserved_bytes(). 2. When the last extent in a block group is freed via btrfs_update_block_group(). While size classes are advisory, a stale size class can cause find_free_extent to unnecessarily skip candidate block groups during initial search loops. This undermines the purpose of size classes to reduce fragmentation by keeping block groups restricted to a specific size class when they could be reused for any size. Fix this by resetting the size class to BTRFS_BG_SZ_NONE whenever a block group's used and reserved counts both reach zero. This ensures that empty block groups are fully available for any allocation size in the next cycle. Fixes: 52bb7a2166af ("btrfs: introduce size class to block group allocator") Reviewed-by: Boris Burkov Signed-off-by: Jiasheng Jiang Reviewed-by: David Sterba Signed-off-by: David Sterba commit be6324a809dbda76d5fdb23720ad9b20e5c1905c Author: Adarsh Das Date: Tue Feb 3 22:53:57 2026 +0530 btrfs: replace BUG() with error handling in __btrfs_balance() We search with offset (u64)-1 which should never match exactly. Previously this was handled with BUG(). Now logs an error and return -EUCLEAN. Reviewed-by: Qu Wenruo Signed-off-by: Adarsh Das Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1c88823a1958011343fa33b12a40fe42e829d9d9 Author: Adarsh Das Date: Tue Feb 3 22:53:56 2026 +0530 btrfs: handle unexpected exact match in btrfs_set_inode_index_count() We search with offset (u64)-1 which should never match exactly. Previously the code silently returned success without setting the index count. Now logs an error and return -EUCLEAN instead. Reviewed-by: Qu Wenruo Signed-off-by: Adarsh Das Reviewed-by: David Sterba , Signed-off-by: David Sterba commit 3ce500aac0e71f71b358fe68aa69f0912047968c Author: Benjamin Block Date: Tue Feb 17 14:29:12 2026 +0100 s390/debug: Convert debug area lock from a spinlock to a raw spinlock With PREEMPT_RT as potential configuration option, spinlock_t is now considered as a sleeping lock, and thus might cause issues when used in an atomic context. But even with PREEMPT_RT as potential configuration option, raw_spinlock_t remains as a true spinning lock/atomic context. This creates potential issues with the s390 debug/tracing feature. The functions to trace errors are called in various contexts, including under lock of raw_spinlock_t, and thus the used spinlock_t in each debug area is in violation of the locking semantics. Here are two examples involving failing PCI Read accesses that are traced while holding `pci_lock` in `drivers/pci/access.c`: ============================= [ BUG: Invalid wait context ] 6.19.0-devel #18 Not tainted ----------------------------- bash/3833 is trying to lock: 0000027790baee30 (&rc->lock){-.-.}-{3:3}, at: debug_event_common+0xfc/0x300 other info that might help us debug this: context-{5:5} 5 locks held by bash/3833: #0: 0000027efbb29450 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x7c/0xf0 #1: 00000277f0504a90 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x13e/0x260 #2: 00000277beed8c18 (kn->active#339){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x164/0x260 #3: 00000277e9859190 (&dev->mutex){....}-{4:4}, at: pci_dev_lock+0x2e/0x40 #4: 00000383068a7708 (pci_lock){....}-{2:2}, at: pci_bus_read_config_dword+0x4a/0xb0 stack backtrace: CPU: 6 UID: 0 PID: 3833 Comm: bash Kdump: loaded Not tainted 6.19.0-devel #18 PREEMPTLAZY Hardware name: IBM 9175 ME1 701 (LPAR) Call Trace: [<00000383048afec2>] dump_stack_lvl+0xa2/0xe8 [<00000383049ba166>] __lock_acquire+0x816/0x1660 [<00000383049bb1fa>] lock_acquire+0x24a/0x370 [<00000383059e3860>] _raw_spin_lock_irqsave+0x70/0xc0 [<00000383048bbb6c>] debug_event_common+0xfc/0x300 [<0000038304900b0a>] __zpci_load+0x17a/0x1f0 [<00000383048fad88>] pci_read+0x88/0xd0 [<00000383054cbce0>] pci_bus_read_config_dword+0x70/0xb0 [<00000383054d55e4>] pci_dev_wait+0x174/0x290 [<00000383054d5a3e>] __pci_reset_function_locked+0xfe/0x170 [<00000383054d9b30>] pci_reset_function+0xd0/0x100 [<00000383054ee21a>] reset_store+0x5a/0x80 [<0000038304e98758>] kernfs_fop_write_iter+0x1e8/0x260 [<0000038304d995da>] new_sync_write+0x13a/0x180 [<0000038304d9c5d0>] vfs_write+0x200/0x330 [<0000038304d9c88c>] ksys_write+0x7c/0xf0 [<00000383059cfa80>] __do_syscall+0x210/0x500 [<00000383059e4c06>] system_call+0x6e/0x90 INFO: lockdep is turned off. ============================= [ BUG: Invalid wait context ] 6.19.0-devel #3 Not tainted ----------------------------- bash/6861 is trying to lock: 0000009da05c7430 (&rc->lock){-.-.}-{3:3}, at: debug_event_common+0xfc/0x300 other info that might help us debug this: context-{5:5} 5 locks held by bash/6861: #0: 000000acff404450 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x7c/0xf0 #1: 000000acff41c490 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x13e/0x260 #2: 0000009da36937d8 (kn->active#75){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x164/0x260 #3: 0000009dd15250d0 (&zdev->state_lock){+.+.}-{4:4}, at: enable_slot+0x2e/0xc0 #4: 000001a19682f708 (pci_lock){....}-{2:2}, at: pci_bus_read_config_byte+0x42/0xa0 stack backtrace: CPU: 16 UID: 0 PID: 6861 Comm: bash Kdump: loaded Not tainted 6.19.0-devel #3 PREEMPTLAZY Hardware name: IBM 9175 ME1 701 (LPAR) Call Trace: [<000001a194837ec2>] dump_stack_lvl+0xa2/0xe8 [<000001a194942166>] __lock_acquire+0x816/0x1660 [<000001a1949431fa>] lock_acquire+0x24a/0x370 [<000001a19596b810>] _raw_spin_lock_irqsave+0x70/0xc0 [<000001a194843b6c>] debug_event_common+0xfc/0x300 [<000001a194888b0a>] __zpci_load+0x17a/0x1f0 [<000001a194882d88>] pci_read+0x88/0xd0 [<000001a195453b88>] pci_bus_read_config_byte+0x68/0xa0 [<000001a195457bc2>] pci_setup_device+0x62/0xad0 [<000001a195458e70>] pci_scan_single_device+0x90/0xe0 [<000001a19488a0f6>] zpci_bus_scan_device+0x46/0x80 [<000001a19547f958>] enable_slot+0x98/0xc0 [<000001a19547f134>] power_write_file+0xc4/0x110 [<000001a194e20758>] kernfs_fop_write_iter+0x1e8/0x260 [<000001a194d215da>] new_sync_write+0x13a/0x180 [<000001a194d245d0>] vfs_write+0x200/0x330 [<000001a194d2488c>] ksys_write+0x7c/0xf0 [<000001a195957a30>] __do_syscall+0x210/0x500 [<000001a19596cbb6>] system_call+0x6e/0x90 INFO: lockdep is turned off. Since it is desired to keep it possible to create trace records in most situations, including this particular case (failing PCI config space accesses are relevant), convert the used spinlock_t in `struct debug_info` to raw_spinlock_t. The impact is small, as the debug area lock only protects bounded memory access without external dependencies, apart from one function debug_set_size() where kfree() is implicitly called with the lock held. Move debug_info_free() out of this lock, to keep remove this external dependency. Acked-by: Heiko Carstens Signed-off-by: Benjamin Block Signed-off-by: Heiko Carstens commit 6c4b2243cb6c0755159bd567130d5e12e7b10d9f Author: Al Viro Date: Sat Feb 7 08:25:24 2026 +0000 unshare: fix unshare_fs() handling There's an unpleasant corner case in unshare(2), when we have a CLONE_NEWNS in flags and current->fs hadn't been shared at all; in that case copy_mnt_ns() gets passed current->fs instead of a private copy, which causes interesting warts in proof of correctness] > I guess if private means fs->users == 1, the condition could still be true. Unfortunately, it's worse than just a convoluted proof of correctness. Consider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS (and current->fs->users == 1). We pass current->fs to copy_mnt_ns(), all right. Suppose it succeeds and flips current->fs->{pwd,root} to corresponding locations in the new namespace. Now we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM). We call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's destroyed and its mount tree is dissolved, but... current->fs->root and current->fs->pwd are both left pointing to now detached mounts. They are pinning those, so it's not a UAF, but it leaves the calling process with unshare(2) failing with -ENOMEM _and_ leaving it with pwd and root on detached isolated mounts. The last part is clearly a bug. There is other fun related to that mess (races with pivot_root(), including the one between pivot_root() and fork(), of all things), but this one is easy to isolate and fix - treat CLONE_NEWNS as "allocate a new fs_struct even if it hadn't been shared in the first place". Sure, we could go for something like "if both CLONE_NEWNS *and* one of the things that might end up failing after copy_mnt_ns() call in create_new_namespaces() are set, force allocation of new fs_struct", but let's keep it simple - the cost of copy_fs_struct() is trivial. Another benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets a freshly allocated fs_struct, yet to be attached to anything. That seriously simplifies the analysis... FWIW, that bug had been there since the introduction of unshare(2) ;-/ Signed-off-by: Al Viro Link: https://patch.msgid.link/20260207082524.GE3183987@ZenIV Tested-by: Waiman Long Signed-off-by: Christian Brauner commit ef0b64741a53e47ce8022c973099e969094aa536 Author: Jori Koolstra Date: Mon Dec 1 13:23:38 2025 +0100 minix: Correct errno in minix_new_inode The cases (!j || j > sbi->s_ninodes) can never occur unless the filesystem is broken, so this should not return ENOSPC, but EFSCORRUPTED. Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20251201122338.90568-1-jkoolstra@xs4all.nl Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 4a403d7aa9074f527f064ef0806aaab38d14b07c Author: Christian Brauner Date: Thu Jan 29 14:52:22 2026 +0100 namespace: fix proc mount iteration The m->index isn't updated when m->show() overflows and retains its value before the current mount causing a restart to start at the same value. If that happens in short order to due a quickly expanding mount table this would cause the same mount to be shown again and again. Ensure that *pos always equals the mount id of the mount that was returned by start/next. On restart after overflow mnt_find_id_at(*pos) finds the exact mount. This should avoid duplicates, avoid skips and should handle concurrent modification just fine. Cc: Fixed: 2eea9ce4310d8 ("mounts: keep list of mounts in an rbtree") Link: https://patch.msgid.link/20260129-geleckt-treuhand-4bb940acacd9@brauner Signed-off-by: Christian Brauner commit a41dbf5e004edbe1260883c43a8bd134d9cb0c1c Author: Christian Brauner Date: Sat Feb 14 16:22:13 2026 +0100 mount: hold namespace_sem across copy in create_new_namespace() Fix an oversight when creating a new mount namespace. If someone had the bright idea to make the real rootfs a shared or dependent mount and it is later copied the copy will become a peer of the old real rootfs mount or a dependent mount of it. The namespace semaphore is dropped and we use mount lock exact to lock the new real root mount. If that fails or the subsequent do_loopback() fails we rely on the copy of the real root mount to be cleaned up by path_put(). The problem is that this doesn't deal with mount propagation and will leave the mounts linked in the propagation lists. When creating a new mount namespace create_new_namespace() first acquires namespace_sem to clone the nullfs root, drops it, then reacquires it via LOCK_MOUNT_EXACT which takes inode_lock first to respect the inode_lock -> namespace_sem lock ordering. This drop-and-reacquire pattern is fragile and was the source of the propagation cleanup bug fixed in the preceding commit. Extend lock_mount_exact() with a copy_mount mode that clones the mount under the locks atomically. When copy_mount is true, path_overmounted() is skipped since we're copying the mount, not mounting on top of it - the nullfs root always has rootfs mounted on top so the check would always fail. If clone_mnt() fails after get_mountpoint() has pinned the mountpoint, __unlock_mount() is used to properly unpin the mountpoint and release both locks. This allows create_new_namespace() to use LOCK_MOUNT_EXACT_COPY which takes inode_lock and namespace_sem once and holds them throughout the clone and subsequent mount operations, eliminating the drop-and-reacquire pattern entirely. Reported-by: syzbot+a89f9434fb5a001ccd58@syzkaller.appspotmail.com Fixes: 9b8a0ba68246 ("mount: add OPEN_TREE_NAMESPACE") # mainline only Link: https://lore.kernel.org/699047f6.050a0220.2757fb.0024.GAE@google.com Signed-off-by: Christian Brauner commit 948a013a54c47d5eba06e644b99d4927a8bc62f8 Author: Kiryl Shutsemau (Meta) Date: Tue Feb 17 10:49:57 2026 +0000 efi: Align unaccepted memory range to page boundary The accept_memory() and range_contains_unaccepted_memory() functions employ a "guard page" logic to prevent crashes with load_unaligned_zeropad(). This logic extends the range to be accepted (or checked) by one unit_size if the end of the range is aligned to a unit_size boundary. However, if the caller passes a range that is not page-aligned, the 'end' of the range might not be numerically aligned to unit_size, even if it covers the last page of a unit. This causes the "if (!(end % unit_size))" check to fail, skipping the necessary extension and leaving the next unit unaccepted, which can lead to a kernel panic when accessed by load_unaligned_zeropad(). Align the start address down and the size up to the nearest page boundary before performing the unit_size alignment check. This ensures that the guard unit is correctly added when the range effectively ends on a unit boundary. Signed-off-by: Kiryl Shutsemau (Meta) Reviewed-by: Tom Lendacky Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Ard Biesheuvel commit 0862438c90487e79822d5647f854977d50381505 Author: Kiryl Shutsemau (Meta) Date: Tue Feb 17 10:49:56 2026 +0000 efi: Fix reservation of unaccepted memory table The reserve_unaccepted() function incorrectly calculates the size of the memblock reservation for the unaccepted memory table. It aligns the size of the table, but fails to account for cases where the table's starting physical address (efi.unaccepted) is not page-aligned. If the table starts at an offset within a page and its end crosses into a subsequent page that the aligned size does not cover, the end of the table will not be reserved. This can lead to the table being overwritten or inaccessible, causing a kernel panic in accept_memory(). This issue was observed when starting Intel TDX VMs with specific memory sizes (e.g., > 64GB). Fix this by calculating the end address first (including the unaligned start) and then aligning it up, ensuring the entire range is covered by the reservation. Fixes: 8dbe33956d96 ("efi/unaccepted: Make sure unaccepted table is mapped") Reported-by: Moritz Sanft Signed-off-by: Kiryl Shutsemau (Meta) Reviewed-by: Tom Lendacky Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Ard Biesheuvel commit 21279b1096b1546cc71dbf2f0b50df9151bd3421 Author: Ilias Apalodimas Date: Tue Feb 17 14:01:56 2026 +0200 MAINTAINERS: Add a reviewer entry for EFI Over the years I've contributed patches to the EFI subsystem mostly around TPM and EFI variables. Add me as a reviewer. Signed-off-by: Ilias Apalodimas Signed-off-by: Ard Biesheuvel commit 62cb7abdef118ffdc9748ad4de69bb9b38771340 Author: Krzysztof Kozlowski Date: Sun Feb 15 12:06:28 2026 +0100 efi: stmm: Constify struct efivar_operations The 'struct efivar_operations' is not modified by the driver after initialization, so it should follow typical practice of being static const for increased code safety and readability. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Ilias Apalodimas Signed-off-by: Ard Biesheuvel commit e00ac9e5afb5d80c0168ec88d8e8662a54af8249 Author: Ard Biesheuvel Date: Tue Feb 17 12:09:35 2026 +0100 x86/kexec: Copy ACPI root pointer address from config table Dave reports that kexec may fail when the first kernel boots via the EFI stub but without EFI runtime services, as in that case, the RSDP address field in struct bootparams is never assigned. Kexec copies this value into the version of struct bootparams that it provides to the incoming kernel, which may have no other means to locate the ACPI root pointer. So take the value from the EFI config tables if no root pointer has been set in the first kernel's struct bootparams. Fixes: a1b87d54f4e4 ("x86/efistub: Avoid legacy decompressor when doing EFI boot") Cc: # v6.1 Reported-by: Dave Young Tested-by: Dave Young Link: https://lore.kernel.org/linux-efi/aZQg_tRQmdKNadCg@darkstar.users.ipa.redhat.com/ Signed-off-by: Ard Biesheuvel commit fbd03587ba732c612b8a569d1cf5bed72bd3a27c Author: Dmitry Torokhov Date: Tue Feb 17 14:11:49 2026 -0800 gpio: amd-fch: ionly return allowed values from amd_fch_gpio_get() As of 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()") gpiolib requires drivers implementing GPIOs to only return 0, 1 or negative error for the get() callbacks. Ensure that amd-fch complies with this requirement. Fixes: 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()") Reported-and-tested-by: Tj Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/aZTlwnvHt2Gho4yN@google.com Signed-off-by: Bartosz Golaszewski commit 5043d7ed39dfdce3107d6642aa31bb7736547104 Author: Juergen Gross Date: Sat Feb 14 14:50:35 2026 +0100 x86/xen: Fix Xen PV guest boot A recent patch moving the call of sparse_init() to common mm code broke booting as a Xen PV guest. Reason is that the Xen PV specific boot code relied on struct page area being accessible rather early, but this changed by the move of the call of sparse_init(). Fortunately the fix is rather easy: there is a static branch available indicating whether struct page contents are usable by Xen. This static branch just needs to be tested in some places for avoiding the access of struct page. Fixes: 4267739cabb8 ("arch, mm: consolidate initialization of SPARSE memory model") Signed-off-by: Juergen Gross Message-ID: <20260214135035.119357-1-jgross@suse.com> commit 6766f59012301f1bf3f46c6e7149caca45d92309 Author: Bartosz Golaszewski Date: Thu Feb 12 14:35:05 2026 +0100 gpio: sysfs: fix chip removal with GPIOs exported over sysfs Currently if we export a GPIO over sysfs and unbind the parent GPIO controller, the exported attribute will remain under /sys/class/gpio because once we remove the parent device, we can no longer associate the descriptor with it in gpiod_unexport() and never drop the final reference. Rework the teardown code: provide an unlocked variant of gpiod_unexport() and remove all exported GPIOs with the sysfs_lock taken before unregistering the parent device itself. This is done to prevent any new exports happening before we unregister the device completely. Cc: stable@vger.kernel.org Fixes: 1cd53df733c2 ("gpio: sysfs: don't look up exported lines as class devices") Link: https://patch.msgid.link/20260212133505.81516-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit ff91965ad8b214e0771bc5a15253f14f583a7649 Author: Bartosz Golaszewski Date: Wed Feb 11 09:53:13 2026 +0100 gpio: swnode: restore the swnode-name-against-chip-label matching Using the remote firmware node for software node lookup is the right thing to do. The GPIO controller we want to resolve should have the software node we scooped out of the reference attached to it. However, there are existing users who abuse the software node API by creating dummy swnodes whose name is set to the expected label string of the GPIO controller whose pins they want to control and use them in their local swnode references as GPIO properties. This used to work when we compared the software node's name to the chip's label. When we switched to using a real fwnode lookup, these users broke down because the firmware nodes in question were never attached to the controllers they were looking for. Restore the label matching as a fallback to fix the broken users but add a big FIXME urging for a better solution. Cc: stable@vger.kernel.org # v6.18, v6.19 Fixes: 216c12047571 ("gpio: swnode: allow referencing GPIO chips by firmware nodes") Link: https://lore.kernel.org/all/aYkdKfP5fg6iywgr@jekhomev/ Acked-by: Andy Shevchenko Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20260211085313.16792-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit a3345015c2aefd38fff0cf0908045ddb74f5bccc Author: Tim Bird Date: Thu Feb 12 16:49:28 2026 -0700 ALSA: echoaudio: Add SPDX ids to some files Add SPDX-License-Identifier lines to some files in the sound subsystem - mostly in the echoaudio drivers. Remove boilerplate GPL headers. Signed-off-by: Tim Bird Link: https://patch.msgid.link/20260212234928.3739815-1-tim.bird@sony.com Signed-off-by: Takashi Iwai commit 246184460766dc6f6c915720fb028badd02c96ee Author: Tim Bird Date: Thu Feb 12 12:59:05 2026 -0700 ALSA: isa: Add SPDX id lines to some files Add SPDX-License-Identifier lines to several files where they are missing, mostly in the sound/isa subdir. Use GPL-2.0 as the id. [ note: the same change applied to sound/hda/core/trace.c, too -- tiwai ] Signed-off-by: Tim Bird Link: https://patch.msgid.link/20260212195905.3726149-1-tim.bird@sony.com Signed-off-by: Takashi Iwai commit 65ff3a8d0b0ab127b2580fcf334a06f76ae4744d Author: Tim Bird Date: Thu Feb 12 11:31:03 2026 -0700 ALSA: core: Add SPDX license id to files Add an SPDX id of LGPL-2.0+ to files in the sound core sub-system that are missing ids. Remove boilerplate text. These files were originally submitted in a big commit for the ALSA sound system for kernel version 2.5.4, by Jaroslav Kysela, in Feb 2002. Signed-off-by: Tim Bird Link: https://patch.msgid.link/20260212183103.3720788-1-tim.bird@sony.com Signed-off-by: Takashi Iwai commit f8e6343b7a89c7c649db5a9e309ba7aa20401813 Author: Jan Kiszka Date: Mon Feb 16 17:24:56 2026 +0100 Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT Resolves the following lockdep report when booting PREEMPT_RT on Hyper-V with related guest support enabled: [ 1.127941] hv_vmbus: registering driver hyperv_drm [ 1.132518] ============================= [ 1.132519] [ BUG: Invalid wait context ] [ 1.132521] 6.19.0-rc8+ #9 Not tainted [ 1.132524] ----------------------------- [ 1.132525] swapper/0/0 is trying to lock: [ 1.132526] ffff8b9381bb3c90 (&channel->sched_lock){....}-{3:3}, at: vmbus_chan_sched+0xc4/0x2b0 [ 1.132543] other info that might help us debug this: [ 1.132544] context-{2:2} [ 1.132545] 1 lock held by swapper/0/0: [ 1.132547] #0: ffffffffa010c4c0 (rcu_read_lock){....}-{1:3}, at: vmbus_chan_sched+0x31/0x2b0 [ 1.132557] stack backtrace: [ 1.132560] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-rc8+ #9 PREEMPT_{RT,(lazy)} [ 1.132565] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/25/2025 [ 1.132567] Call Trace: [ 1.132570] [ 1.132573] dump_stack_lvl+0x6e/0xa0 [ 1.132581] __lock_acquire+0xee0/0x21b0 [ 1.132592] lock_acquire+0xd5/0x2d0 [ 1.132598] ? vmbus_chan_sched+0xc4/0x2b0 [ 1.132606] ? lock_acquire+0xd5/0x2d0 [ 1.132613] ? vmbus_chan_sched+0x31/0x2b0 [ 1.132619] rt_spin_lock+0x3f/0x1f0 [ 1.132623] ? vmbus_chan_sched+0xc4/0x2b0 [ 1.132629] ? vmbus_chan_sched+0x31/0x2b0 [ 1.132634] vmbus_chan_sched+0xc4/0x2b0 [ 1.132641] vmbus_isr+0x2c/0x150 [ 1.132648] __sysvec_hyperv_callback+0x5f/0xa0 [ 1.132654] sysvec_hyperv_callback+0x88/0xb0 [ 1.132658] [ 1.132659] [ 1.132660] asm_sysvec_hyperv_callback+0x1a/0x20 As code paths that handle vmbus IRQs use sleepy locks under PREEMPT_RT, the vmbus_isr execution needs to be moved into thread context. Open- coding this allows to skip the IPI that irq_work would additionally bring and which we do not need, being an IRQ, never an NMI. This affects both x86 and arm64, therefore hook into the common driver logic. Signed-off-by: Jan Kiszka Reviewed-by: Florian Bezdeka Tested-by: Florian Bezdeka Reviewed-by: Michael Kelley Tested-by: Michael Kelley Signed-off-by: Wei Liu commit 693680b9add63dbebb2505a553ff52f8c706c8c0 Author: Eric Biggers Date: Tue Feb 17 17:22:44 2026 -0800 fsverity: fix build error by adding fsverity_readahead() stub hppa-linux-gcc 9.5.0 generates a call to fsverity_readahead() in f2fs_readahead() when CONFIG_FS_VERITY=n, because it fails to do the expected dead code elimination based on vi always being NULL. Fix the build error by adding an inline stub for fsverity_readahead(). Since it's just for opportunistic readahead, just make it a no-op. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602180838.pwICdY2r-lkp@intel.com/ Fixes: 45dcb3ac9832 ("f2fs: consolidate fsverity_info lookup") Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260218012244.18536-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 5959495449caf325a0394602568e287f2b829818 Author: Eric Biggers Date: Tue Feb 17 17:06:30 2026 -0800 fsverity: remove fsverity_verify_page() Now that fsverity_verify_page() has no callers, remove it. Suggested-by: Linus Torvalds Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260218010630.7407-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 78cdb14893614dc46a06fe075abf19e0d8eddc66 Author: Eric Biggers Date: Tue Feb 17 17:06:29 2026 -0800 f2fs: make f2fs_verify_cluster() partially large-folio-aware f2fs_verify_cluster() is the only remaining caller of the non-large-folio-aware function fsverity_verify_page(). To unblock the removal of that function, change f2fs_verify_cluster() to verify the entire folio of each page and mark it up-to-date. Note that this doesn't actually make f2fs_verify_cluster() large-folio-aware, as it is still passed an array of pages. Currently, it's never called with large folios. Suggested-by: Matthew Wilcox Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260218010630.7407-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 079220c56f83b8abaf74724903c52cbad06d7163 Author: Eric Biggers Date: Tue Feb 17 17:06:28 2026 -0800 f2fs: remove unnecessary ClearPageUptodate in f2fs_verify_cluster() Remove the unnecessary clearing of PG_uptodate. It's guaranteed to already be clear. Suggested-by: Matthew Wilcox Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260218010630.7407-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 885e78d71f772dd4c83f83530814870062115f85 Author: Uros Bizjak Date: Fri Nov 21 15:14:11 2025 +0100 x86/hyperv: Remove ASM_CALL_CONSTRAINT with VMMCALL insn Unlike CALL instruction, VMMCALL does not push to the stack, so it's OK to allow the compiler to insert it before the frame pointer gets set up by the containing function. ASM_CALL_CONSTRAINT is for CALLs that must be inserted after the frame pointer is set up, so it is over-constraining here and can be removed. Signed-off-by: Uros Bizjak Tested-by: Michael Kelley Cc: K. Y. Srinivasan Cc: Haiyang Zhang Cc: Wei Liu Cc: Dexuan Cui Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: H. Peter Anvin Signed-off-by: Wei Liu commit 834ef6aa0996121184728279c4b81a3b70ee649b Author: Uros Bizjak Date: Fri Nov 21 15:14:10 2025 +0100 x86/hyperv: Use savesegment() instead of inline asm() to save segment registers Use standard savesegment() utility macro to save segment registers. Signed-off-by: Uros Bizjak Acked-by: Wei Liu Tested-by: Michael Kelley Cc: K. Y. Srinivasan Cc: Haiyang Zhang Cc: Dexuan Cui Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: H. Peter Anvin Signed-off-by: Wei Liu commit ccd8e87748ad083047d6c8544c5809b7f96cc8df Author: Dimitri Daskalakis Date: Sat Feb 14 09:19:49 2026 -0800 eth: fbnic: Add validation for MTU changes Increasing the MTU beyond the HDS threshold causes the hardware to fragment packets across multiple buffers. If a single-buffer XDP program is attached, the driver will drop all multi-frag frames. While we can't prevent a remote sender from sending non-TCP packets larger than the MTU, this will prevent users from inadvertently breaking new TCP streams. Traditionally, drivers supported XDP with MTU less than 4Kb (packet per page). Fbnic currently prevents attaching XDP when MTU is too high. But it does not prevent increasing MTU after XDP is attached. Fixes: 1b0a3950dbd4 ("eth: fbnic: Add XDP pass, drop, abort support") Signed-off-by: Jakub Kicinski Signed-off-by: Dimitri Daskalakis Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit ef0e60083f768b32cda17b1b0ca9519405db89a6 Author: Len Brown Date: Tue Feb 17 20:31:51 2026 -0600 tools/power turbostat: Fix AMD RAPL regression turbostat.c:8688: rapl_perf_init: Assertion `next_domain < num_domains' failed. Two recent cleanup patches that were not supposed to change anything broke the core_id code needed for AMD RAPL initialization: commit 070e92361eec ("tools/power turbostat: Enhance HT enumeration") commit ddf60e38ca04 ("tools/power turbostat: Simplify global core_id calculation") Reported-by: Linus Torvalds Signed-off-by: Len Brown commit 97af85787c1964a7e7b146c5d4e021f089af47ea Author: Karan Tilak Kumar Date: Tue Feb 17 12:46:58 2026 -0800 scsi: snic: MAINTAINERS: Update snic maintainers Update snic maintainers. Signed-off-by: Karan Tilak Kumar Link: https://patch.msgid.link/20260217204658.5465-1-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 3e2138510b2ad556a12a7b284a025a23992e4aa1 Merge: 42ebf3b3170925 fd1fa48b935f22 Author: Dave Airlie Date: Wed Feb 18 12:37:11 2026 +1000 Merge tag 'amd-drm-next-6.20-2026-02-13' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.20-2026-02-13: amdgpu: - SMU 13.x fixes - DC resume lag fix - MPO fixes - DCN 3.6 fix - VSDB fixes - HWSS clean up - Replay fixes - DCE cursor fixes - DCN 3.5 SR DDR5 latency fixes - HPD fixes - Error path unwind fixes - SMU13/14 mode1 reset fixes - PSP 15 updates - SMU 15 updates - RAS fixes - Sync fix in amdgpu_dma_buf_move_notify() - HAINAN fix - PSP 13.x fix - GPUVM locking fix amdkfd: - APU GTT as VRAM fix radeon: - HAINAN fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260213220825.1454189-1-alexander.deucher@amd.com commit af3973e7b4fd91e6884b312526168869fb013d68 Author: Thomas Fourier Date: Mon Feb 16 15:10:55 2026 +0100 scsi: snic: Remove unused linkstatus The (struct vnic_dev).linkstatus buffer is freed in svnic_dev_unregister() and referenced in svnic_dev_link_status() but never alloc'd. This means (struct vnic_dev).linkstatus is always null and the dealloc the reference in svnic_dev_link_status() is dead code. Signed-off-by: Thomas Fourier Acked-by: Karan Tilak Kumar Link: https://patch.msgid.link/20260216141056.59429-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen commit 38353c26db28efd984f51d426eac2396d299cca7 Author: Salomon Dushimirimana Date: Fri Feb 13 19:28:06 2026 +0000 scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free. Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled. Fixes: e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") Signed-off-by: Salomon Dushimirimana Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260213192806.439432-1-salomondush@google.com Signed-off-by: Martin K. Petersen commit 42ebf3b31709255443df0e280a630feb7c3db0ab Merge: 218da1209de0d6 57b85fd53fccfd Author: Dave Airlie Date: Wed Feb 18 12:32:33 2026 +1000 Merge tag 'drm-intel-next-fixes-2026-02-13' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Regresion fix for HDR 4k displays (#15503) - Fixup for Dell XPS 13 7390 eDP rate limit - Memory leak fix on ACPI _DSM handling Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/aY8CtbhijtetQ6P3@jlahtine-mobl commit fa96392ebebc8fade2b878acb14cce0f71016503 Author: Ranjan Kumar Date: Thu Feb 12 12:30:26 2026 +0530 scsi: mpi3mr: Add NULL checks when resetting request and reply queues The driver encountered a crash during resource cleanup when the reply and request queues were NULL due to freed memory. This issue occurred when the creation of reply or request queues failed, and the driver freed the memory first, but attempted to mem set the content of the freed memory, leading to a system crash. Add NULL pointer checks for reply and request queues before accessing the reply/request memory during cleanup Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260212070026.30263-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 5b313760059c9df7d60aba7832279bcb81b4aec0 Author: Won Jung Date: Wed Feb 11 15:01:05 2026 +0900 scsi: ufs: core: Reset urgent_bkops_lvl to allow runtime PM power mode Ensures that UFS Runtime PM can achieve power saving after System PM suspend by resetting hba->urgent_bkops_lvl. Also modify the ufshcd_bkops_exception_event_handler to avoid setting urgent_bkops_lvl when status is 0, which helps maintain optimal power management. On UFS devices supporting UFSHCD_CAP_AUTO_BKOPS_SUSPEND, a BKOPS exception event can lead to a situation where UFS Runtime PM can't enter low-power mode states even after the BKOPS exception has been resolved. BKOPS exception with bkops status 0 occurs, the driver logs: "ufshcd_bkops_exception_event_handler: device raised urgent BKOPS exception for bkops status 0" When a BKOPS exception occurs, ufshcd_bkops_exception_event_handler() reads the BKOPS status and sets hba->urgent_bkops_lvl to BKOPS_STATUS_NO_OP(0). This allows the device to perform Runtime PM without changing the UFS power mode. (__ufshcd_wl_suspend(hba, UFS_RUNTIME_PM)) During system PM suspend, ufshcd_disable_auto_bkops() is called, disabling auto bkops. After UFS System PM Resume, when runtime PM attempts to suspend again, ufshcd_urgent_bkops() is invoked. Since hba->urgent_bkops_lvl remains at BKOPS_STATUS_NO_OP(0), ufshcd_enable_auto_bkops() is triggered. However, in ufshcd_bkops_ctrl(), the driver compares the current BKOPS status with hba->urgent_bkops_lvl, and only enables auto bkops if curr_status >= hba->urgent_bkops_lvl. Since both values are 0, the condition is met As a result, __ufshcd_wl_suspend(hba, UFS_RUNTIME_PM) skips power mode transitions and remains in an active state, preventing power saving even though no urgent BKOPS condition exists. Signed-off-by: Won Jung Reviewed-by: Peter Wang Link: https://patch.msgid.link/1891546521.01770806581968.JavaMail.epsvc@epcpadp2new Signed-off-by: Martin K. Petersen commit 70ca8caa96ce473647054f5c7b9dab5423902402 Author: Tomas Henzl Date: Tue Feb 10 20:18:50 2026 +0100 scsi: ses: Fix devices attaching to different hosts On a multipath SAS system some devices don't end up with correct symlinks from the SCSI device to its enclosure. Some devices even have enclosure links pointing to enclosures attached to different SCSI hosts. ses_match_to_enclosure() calls enclosure_for_each_device() which iterates over all enclosures on the system, not just enclosures attached to the current SCSI host. Replace the iteration with a direct call to ses_enclosure_find_by_addr(). Reviewed-by: David Jeffery Signed-off-by: Tomas Henzl Link: https://patch.msgid.link/20260210191850.36784-1-thenzl@redhat.com Signed-off-by: Martin K. Petersen commit 2e6b5cd6a4b37a95b78cf8c39a979b58c915c8ed Author: Alexey Charkov Date: Mon Feb 9 19:17:34 2026 +0400 scsi: ufs: core: Fix RPMB region size detection for UFS 2.2 Older UFS spec devices (2.2 and earlier) do not expose per-region RPMB sizes, as only one RPMB region is supported. In such cases, the size of the single RPMB region can be deduced from the Logical Block Count and Logical Block Size fields in the RPMB Unit Descriptor. Add a fallback mechanism to calculate the RPMB region size from these fields if the device implements an older spec, so that the RPMB driver can work with such devices - otherwise it silently skips the whole RPMB. Section 14.1.4.6 (RPMB Unit Descriptor) Link: https://www.jedec.org/system/files/docs/JESD220C-2_2.pdf Cc: stable@vger.kernel.org Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices") Reviewed-by: Bean Huo Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20260209-ufs-rpmb-v3-1-b1804e71bd38@flipper.net Signed-off-by: Martin K. Petersen commit 57297736c08233987e5d29ce6584c6ca2a831b12 Author: Jan Kiszka Date: Thu Jan 29 15:30:39 2026 +0100 scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT This resolves the follow splat and lock-up when running with PREEMPT_RT enabled on Hyper-V: [ 415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002 [ 415.140822] INFO: lockdep is turned off. [ 415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common [ 415.140846] Preemption disabled at: [ 415.140847] [] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)} [ 415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024 [ 415.140857] Call Trace: [ 415.140861] [ 415.140861] ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc] [ 415.140863] dump_stack_lvl+0x91/0xb0 [ 415.140870] __schedule_bug+0x9c/0xc0 [ 415.140875] __schedule+0xdf6/0x1300 [ 415.140877] ? rtlock_slowlock_locked+0x56c/0x1980 [ 415.140879] ? rcu_is_watching+0x12/0x60 [ 415.140883] schedule_rtlock+0x21/0x40 [ 415.140885] rtlock_slowlock_locked+0x502/0x1980 [ 415.140891] rt_spin_lock+0x89/0x1e0 [ 415.140893] hv_ringbuffer_write+0x87/0x2a0 [ 415.140899] vmbus_sendpacket_mpb_desc+0xb6/0xe0 [ 415.140900] ? rcu_is_watching+0x12/0x60 [ 415.140902] storvsc_queuecommand+0x669/0xbe0 [hv_storvsc] [ 415.140904] ? HARDIRQ_verbose+0x10/0x10 [ 415.140908] ? __rq_qos_issue+0x28/0x40 [ 415.140911] scsi_queue_rq+0x760/0xd80 [scsi_mod] [ 415.140926] __blk_mq_issue_directly+0x4a/0xc0 [ 415.140928] blk_mq_issue_direct+0x87/0x2b0 [ 415.140931] blk_mq_dispatch_queue_requests+0x120/0x440 [ 415.140933] blk_mq_flush_plug_list+0x7a/0x1a0 [ 415.140935] __blk_flush_plug+0xf4/0x150 [ 415.140940] __submit_bio+0x2b2/0x5c0 [ 415.140944] ? submit_bio_noacct_nocheck+0x272/0x360 [ 415.140946] submit_bio_noacct_nocheck+0x272/0x360 [ 415.140951] ext4_read_bh_lock+0x3e/0x60 [ext4] [ 415.140995] ext4_block_write_begin+0x396/0x650 [ext4] [ 415.141018] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4] [ 415.141038] ext4_da_write_begin+0x1c4/0x350 [ext4] [ 415.141060] generic_perform_write+0x14e/0x2c0 [ 415.141065] ext4_buffered_write_iter+0x6b/0x120 [ext4] [ 415.141083] vfs_write+0x2ca/0x570 [ 415.141087] ksys_write+0x76/0xf0 [ 415.141089] do_syscall_64+0x99/0x1490 [ 415.141093] ? rcu_is_watching+0x12/0x60 [ 415.141095] ? finish_task_switch.isra.0+0xdf/0x3d0 [ 415.141097] ? rcu_is_watching+0x12/0x60 [ 415.141098] ? lock_release+0x1f0/0x2a0 [ 415.141100] ? rcu_is_watching+0x12/0x60 [ 415.141101] ? finish_task_switch.isra.0+0xe4/0x3d0 [ 415.141103] ? rcu_is_watching+0x12/0x60 [ 415.141104] ? __schedule+0xb34/0x1300 [ 415.141106] ? hrtimer_try_to_cancel+0x1d/0x170 [ 415.141109] ? do_nanosleep+0x8b/0x160 [ 415.141111] ? hrtimer_nanosleep+0x89/0x100 [ 415.141114] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 415.141116] ? xfd_validate_state+0x26/0x90 [ 415.141118] ? rcu_is_watching+0x12/0x60 [ 415.141120] ? do_syscall_64+0x1e0/0x1490 [ 415.141121] ? do_syscall_64+0x1e0/0x1490 [ 415.141123] ? rcu_is_watching+0x12/0x60 [ 415.141124] ? do_syscall_64+0x1e0/0x1490 [ 415.141125] ? do_syscall_64+0x1e0/0x1490 [ 415.141127] ? irqentry_exit+0x140/0x7e0 [ 415.141129] entry_SYSCALL_64_after_hwframe+0x76/0x7e get_cpu() disables preemption while the spinlock hv_ringbuffer_write is using is converted to an rt-mutex under PREEMPT_RT. Signed-off-by: Jan Kiszka Tested-by: Florian Bezdeka Reviewed-by: Michael Kelley Tested-by: Michael Kelley Link: https://patch.msgid.link/0c7fb5cd-fb21-4760-8593-e04bade84744@siemens.com Signed-off-by: Martin K. Petersen commit bffda93a51b40afd67c11bf558dc5aae83ca0943 Author: Mathias Krause Date: Thu Feb 12 11:23:27 2026 -0800 scsi: lpfc: Properly set WC for DPP mapping Using set_memory_wc() to enable write-combining for the DPP portion of the MMIO mapping is wrong as set_memory_*() is meant to operate on RAM only, not MMIO mappings. In fact, as used currently triggers a BUG_ON() with enabled CONFIG_DEBUG_VIRTUAL. Simply map the DPP region separately and in addition to the already existing mappings, avoiding any possible negative side effects for these. Fixes: 1351e69fc6db ("scsi: lpfc: Add push-to-adapter support to sli4") Signed-off-by: Mathias Krause Signed-off-by: Justin Tee Reviewed-by: Mathias Krause Link: https://patch.msgid.link/20260212192327.141104-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit be054cc66f739a9ba615dba9012a07fab8e7dd6f Author: Ruitong Liu Date: Sat Feb 14 01:59:48 2026 +0800 net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDIT_F_TXQ_SKBHASH support. The inclusive range size is computed as: mapping_mod = queue_mapping_max - queue_mapping + 1; The range size can be 65536 when the requested range covers all possible u16 queue IDs (e.g. queue_mapping=0 and queue_mapping_max=U16_MAX). That value cannot be represented in a u16 and previously wrapped to 0, so tcf_skbedit_hash() could trigger a divide-by-zero: queue_mapping += skb_get_hash(skb) % params->mapping_mod; Compute mapping_mod in a wider type and reject ranges larger than U16_MAX to prevent params->mapping_mod from becoming 0 and avoid the crash. Fixes: 38a6f0865796 ("net: sched: support hash selecting tx queue") Cc: stable@vger.kernel.org # 6.12+ Signed-off-by: Ruitong Liu Link: https://patch.msgid.link/20260213175948.1505257-1-cnitlrt@gmail.com Signed-off-by: Jakub Kicinski commit a07c33c6f2fc693bf9c67514fcc15d9d417f390d Author: Stefano Garzarella Date: Mon Feb 16 17:31:47 2026 +0100 vsock: document namespace mode sysctls Add documentation for the vsock per-namespace sysctls (`ns_mode` and `child_ns_mode`) to Documentation/admin-guide/sysctl/net.rst. These sysctls were introduced by commit eafb64f40ca4 ("vsock: add netns to vsock core"). Document the two namespace modes (`global` and `local`), the inheritance behavior of `child_ns_mode`, and the restriction preventing local namespaces from setting `child_ns_mode` to `global`. Signed-off-by: Stefano Garzarella Tested-by: Randy Dunlap Acked-by: Randy Dunlap Link: https://patch.msgid.link/20260216163147.236844-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit ffe68c3766997d82e9ccaf1cdbd47eba269c4aa2 Author: Thomas Fourier Date: Fri Feb 13 17:43:39 2026 +0100 net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle dma_free_coherent() in error path takes priv->rx_buf.alloc_len as the dma handle. This would lead to improper unmapping of the buffer. Change the dma handle to priv->rx_buf.alloc_phys. Fixes: 6af55ff52b02 ("Driver for Beckhoff CX5020 EtherCAT master module.") Cc: Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20260213164340.77272-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski commit e3f000f0dee1bfab52e2e61ca6a3835d9e187e35 Author: Eric Dumazet Date: Fri Feb 13 14:25:57 2026 +0000 macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reported that a race condition still happens after my prior patch. macvlan_common_newlink() might have made @dev visible before detecting an error, and its caller will directly call free_netdev(dev). We must respect an RCU period, either in macvlan or the core networking stack. After adding a temporary mdelay(1000) in macvlan_forward_source_one() to open the race window, valis repro was: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip link set up dev p2 ip link add mv0 link p2 type macvlan mode source (ip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20 &) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4 PING 1.2.3.4 (1.2.3.4): 56 data bytes RTNETLINK answers: Invalid argument BUG: KASAN: slab-use-after-free in macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) Read of size 8 at addr ffff888016bb89c0 by task e/175 CPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) ? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) kasan_report (mm/kasan/report.c:597) ? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) ? tasklet_init (kernel/softirq.c:983) macvlan_handle_frame (drivers/net/macvlan.c:501) Allocated by task 169: kasan_save_stack (mm/kasan/common.c:58) kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:70 mm/kasan/common.c:79) __kasan_kmalloc (mm/kasan/common.c:419) __kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5657 mm/slub.c:7140) alloc_netdev_mqs (net/core/dev.c:12012) rtnl_create_link (net/core/rtnetlink.c:3648) rtnl_newlink (net/core/rtnetlink.c:3830 net/core/rtnetlink.c:3957 net/core/rtnetlink.c:4072) rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) Freed by task 169: kasan_save_stack (mm/kasan/common.c:58) kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:70 mm/kasan/common.c:79) kasan_save_free_info (mm/kasan/generic.c:587) __kasan_slab_free (mm/kasan/common.c:287) kfree (mm/slub.c:6674 mm/slub.c:6882) rtnl_newlink (net/core/rtnetlink.c:3845 net/core/rtnetlink.c:3957 net/core/rtnetlink.c:4072) rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) Fixes: f8db6475a836 ("macvlan: fix error recovery in macvlan_common_newlink()") Signed-off-by: Eric Dumazet Reported-by: valis Link: https://patch.msgid.link/20260213142557.3059043-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 32b70e62034aa72f8414ad4e9122cce7ad418c48 Author: Jakub Kicinski Date: Fri Feb 13 19:51:59 2026 -0800 selftests: tc_actions: don't dump 2MB of \0 to stdout Since we started running selftests in NIPA we have been seeing tc_actions.sh generate a soft lockup warning on ~20% of the runs. On the pre-netdev foundation setup it was actually a missed irq splat from the console. Now it's either that or a lockup. I initially suspected a socket locking issue since the test is exercising local loopback with act_mirred. After hours of staring at this I noticed in strace that ncat when -o $file is specified _both_ saves the output to the file and still prints it to stdout. Because the file being sent is constructed with: dd conv=sparse status=none if=/dev/zero bs=1M count=2 of=$mirred ^^^^^^^^^ the data printed is all \0. Most terminals don't display nul characters (and neither does vng output capture save them). But QEMU's serial console still has to poke them thru which is very slow and causes the lockup (if the file is >600kB). Replace the '-o $file' with '> $file'. This speeds the test up from 2m20s to 18s on debug kernels, and prevents the warnings. Fixes: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260214035159.2119699-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9e371b0ba7f5344b071ff813b7dddade8ba7f8c4 Author: Fernando Fernandez Mancera Date: Sat Feb 14 18:25:43 2026 +0100 ipv6: addrconf: reduce default temp_valid_lft to 2 days This is a recommendation from RFC 8981 and it was intended to be changed by commit 969c54646af0 ("ipv6: Implement draft-ietf-6man-rfc4941bis") but it only changed the sysctl documentation. Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260214172543.5783-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit ad5dfde2a5733aaf652ea3e40c8c5e071e935901 Author: Eric Dumazet Date: Mon Feb 16 10:01:49 2026 +0000 ping: annotate data-races in ping_lookup() isk->inet_num, isk->inet_rcv_saddr and sk->sk_bound_dev_if are read locklessly in ping_lookup(). Add READ_ONCE()/WRITE_ONCE() annotations. The race on isk->inet_rcv_saddr is probably coming from IPv6 support, but does not deserve a specific backport. Fixes: dbca1596bbb0 ("ping: convert to RCU lookups, get rid of rwlock") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260216100149.3319315-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 458c95de5c55c05b7a149da1509f4f0f68d28625 Author: Arnd Bergmann Date: Mon Feb 16 11:55:17 2026 +0100 net: dsa: MxL862xx: don't force-enable MAXLINEAR_GPHY The newly added dsa driver attempts to enable the corresponding PHY driver, but that one has additional dependencies that may not be available: WARNING: unmet direct dependencies detected for MAXLINEAR_GPHY Depends on [m]: NETDEVICES [=y] && PHYLIB [=y] && (HWMON [=m] || HWMON [=m]=n [=n]) Selected by [y]: - NET_DSA_MXL862 [=y] && NETDEVICES [=y] && NET_DSA [=y] aarch64-linux-ld: drivers/net/phy/mxl-gpy.o: in function `gpy_probe': mxl-gpy.c:(.text.gpy_probe+0x13c): undefined reference to `devm_hwmon_device_register_with_info' aarch64-linux-ld: drivers/net/phy/mxl-gpy.o: in function `gpy_hwmon_read': mxl-gpy.c:(.text.gpy_hwmon_read+0x48): undefined reference to `polynomial_calc' There is actually no compile-time dependency, as DSA correctly uses the PHY abstractions. Remove the 'select' statement to reduce the complexity. Fixes: 23794bec1cb6 ("net: dsa: add basic initial driver for MxL862xx switches") Signed-off-by: Arnd Bergmann Reviewed-by: Daniel Golle Link: https://patch.msgid.link/20260216105522.2382373-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit a047497f952831e377564b606dcb74a7cb309384 Author: Ivan Vecera Date: Mon Feb 16 20:40:07 2026 +0100 dpll: zl3073x: Fix ref frequency setting The frequency for an input reference is computed as: frequency = freq_base * freq_mult * freq_ratio_m / freq_ratio_n Before commit 5bc02b190a3fb ("dpll: zl3073x: Cache all reference properties in zl3073x_ref"), zl3073x_dpll_input_pin_frequency_set() explicitly wrote 1 to both the REF_RATIO_M and REF_RATIO_N hardware registers whenever a new frequency was set. This ensured the FEC ratio was always reset to 1:1 alongside the new base/multiplier values. The refactoring in that commit introduced zl3073x_ref_freq_set() to update the cached ref state, but this helper only sets freq_base and freq_mult without resetting freq_ratio_m and freq_ratio_n to 1. Because zl3073x_ref_state_set() uses a compare-and-write strategy, unchanged ratio fields are never written to the hardware. If the device previously had non-unity FEC ratio values, they remain in effect after a frequency change, resulting in an incorrect computed frequency. Explicitly set freq_ratio_m and freq_ratio_n to 1 in zl3073x_ref_freq_set() to restore the original behavior. Fixes: 5bc02b190a3fb ("dpll: zl3073x: Cache all reference properties in zl3073x_ref") Signed-off-by: Ivan Vecera Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260216194007.680416-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 0943404b1f3b178e1e54386dadcbf4f2729c7762 Author: Eric Dumazet Date: Mon Feb 16 19:36:53 2026 +0000 net: do not delay zero-copy skbs in skb_attempt_defer_free() After the blamed commit, TCP tx zero copy notifications could be arbitrarily delayed and cause regressions in applications waiting for them. Signed-off-by: Eric Dumazet Fixes: e20dfbad8aab ("net: fix napi_consume_skb() with alien skbs") Reviewed-by: Jason Xing Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260216193653.627617-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6e980df452169f82674f2e650079c1fe0aee343d Author: Arnd Bergmann Date: Mon Feb 16 11:54:54 2026 +0100 net: psp: select CONFIG_SKB_EXTENSIONS psp now uses skb extensions, failing to build when that is disabled: In file included from include/net/psp.h:7, from net/psp/psp_sock.c:9: include/net/psp/functions.h: In function '__psp_skb_coalesce_diff': include/net/psp/functions.h:60:13: error: implicit declaration of function 'skb_ext_find'; did you mean 'skb_ext_copy'? [-Wimplicit-function-declaration] 60 | a = skb_ext_find(one, SKB_EXT_PSP); | ^~~~~~~~~~~~ | skb_ext_copy include/net/psp/functions.h:60:31: error: 'SKB_EXT_PSP' undeclared (first use in this function) 60 | a = skb_ext_find(one, SKB_EXT_PSP); | ^~~~~~~~~~~ include/net/psp/functions.h:60:31: note: each undeclared identifier is reported only once for each function it appears in include/net/psp/functions.h: In function '__psp_sk_rx_policy_check': include/net/psp/functions.h:94:53: error: 'SKB_EXT_PSP' undeclared (first use in this function) 94 | struct psp_skb_ext *pse = skb_ext_find(skb, SKB_EXT_PSP); | ^~~~~~~~~~~ net/psp/psp_sock.c: In function 'psp_sock_recv_queue_check': net/psp/psp_sock.c:164:41: error: 'SKB_EXT_PSP' undeclared (first use in this function) 164 | pse = skb_ext_find(skb, SKB_EXT_PSP); | ^~~~~~~~~~~ Select the Kconfig symbol as we do from its other users. Fixes: 6b46ca260e22 ("net: psp: add socket security association code") Signed-off-by: Arnd Bergmann Reviewed-by: Simon Horman Reviewed-by: Daniel Zahka Link: https://patch.msgid.link/20260216105500.2382181-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 3b39d73cc3379360a33eb583b17f21fe55e1288e Author: Jakub Kicinski Date: Tue Feb 17 11:41:50 2026 -0800 bpftool: Fix truncated netlink dumps Netlink requires that the recv buffer used during dumps is at least min(PAGE_SIZE, 8k) (see the man page). Otherwise the messages will get truncated. Make sure bpftool follows this requirement, avoid missing information on systems with large pages. Acked-by: Quentin Monnet Fixes: 7084566a236f ("tools/bpftool: Remove libbpf_internal.h usage in bpftool") Signed-off-by: Jakub Kicinski Link: https://lore.kernel.org/r/20260217194150.734701-1-kuba@kernel.org Signed-off-by: Alexei Starovoitov commit 452a3eee22c57a5786ae6db5c97f3b0ec13bb3b7 Author: Eric Dumazet Date: Mon Feb 16 10:22:02 2026 +0000 ipv6: fix a race in ip6_sock_set_v6only() It is unlikely that this function will be ever called with isk->inet_num being not zero. Perform the check on isk->inet_num inside the locked section for complete safety. Fixes: 9b115749acb24 ("ipv6: add ip6_sock_set_v6only") Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260216102202.3343588-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2d01d88a532b8847757d3015c66beca315f496bf Author: Nareshkumar Gollakoti Date: Mon Feb 2 22:38:12 2026 +0530 drm/xe: Prevent VFs from exposing the CCS mode sysfs file Skip creating CCS sysfs files in VF mode to ensure VFs do not try to change CCS mode, as it is predefined and immutable in the SR-IOV mode. Reviewed-by: Michal Wajdeczko Signed-off-by: Nareshkumar Gollakoti Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260202170810.1393147-5-naresh.kumar.g@intel.com (cherry picked from commit 4e8f602ac3574cf1ebc7acfb6624d06e04b30c91) Signed-off-by: Rodrigo Vivi commit 93d08a1cfc2fb6a5f3e9953eee807c66f38d5547 Author: Karthik Poosa Date: Fri Feb 6 13:46:55 2026 +0530 drm/xe/hwmon: Prevent unintended VRAM channel creation Remove the unnecessary VRAM channel entry introduced in xe_hwmon_channel. Without this, adding any new hwmon channel causes extra VRAM channel to appear. This remained unnoticed earlier because VRAM was the final xe hwmon channel. v2: Use MAX_VRAM_CHANNELS with in_range() instead of CHANNEL_VRAM_N_MAX. (Raag) Fixes: 49a498338417 ("drm/xe/hwmon: Expose individual VRAM channel temperature") Signed-off-by: Karthik Poosa Reviewed-by: Raag Jadav Link: https://patch.msgid.link/20260206081655.2115439-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 48eb073c7d95883eca2789447f94e1e8cafbabe5) Signed-off-by: Rodrigo Vivi commit b61d56516647aed3cee373237ce2913b9faf9285 Author: Arnd Bergmann Date: Mon Feb 16 14:46:01 2026 +0100 drm/pagemap: pass pagemap_addr by reference Passing a structure by value into a function is sometimes problematic, for a number of reasons. Of of these is a warning from the 32-bit arm compiler: drivers/gpu/drm/drm_gpusvm.c: In function '__drm_gpusvm_unmap_pages': drivers/gpu/drm/drm_gpusvm.c:1152:33: note: parameter passing for argument of type 'struct drm_pagemap_addr' changed in GCC 9.1 1152 | dpagemap->ops->device_unmap(dpagemap, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1153 | dev, *addr); | ~~~~~~~~~~~ This particular problem is harmless since we are not mixing compiler versions inside of the compiler. However, passing this by reference avoids the warning along with providing slightly better calling conventions as it avoids an extra copy on the stack. Fixes: 75af93b3f5d0 ("drm/pagemap, drm/xe: Support destination migration over interconnect") Fixes: 2df55d9e66a2 ("drm/xe: Support pcie p2p dma as a fast interconnect") Signed-off-by: Arnd Bergmann Reviewed-by: Thomas Hellström Signed-off-by: Thomas Hellström Link: https://patch.msgid.link/20260216134644.1025365-1-arnd@kernel.org Acked-by: Maarten Lankhorst (cherry picked from commit 95162db0208aee122d10ac1342fe97a1721cd258) Signed-off-by: Rodrigo Vivi commit 4e83a8d58e1c721a89b3ffe15f549007080272e2 Author: Raag Jadav Date: Thu Feb 12 11:26:22 2026 +0530 drm/xe/bo: Redirect faults to dummy page for wedged device As per uapi documentation[1], the prerequisite for wedged device is to redirected page faults to a dummy page. Follow it. [1] Documentation/gpu/drm-uapi.rst v2: Add uapi reference and fixes tag (Matthew Brost) Fixes: 7bc00751f877 ("drm/xe: Use device wedged event") Signed-off-by: Raag Jadav Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20260212055622.2054991-1-raag.jadav@intel.com Signed-off-by: Matt Roper (cherry picked from commit c020fff70d757612933711dd3cc3751d7d782d3c) Signed-off-by: Rodrigo Vivi commit 1acec6ef0511b92e7974cc5a8768bfd3a659feaf Author: Shuicheng Lin Date: Mon Feb 2 18:18:54 2026 +0000 drm/xe: Make xe_modparam.force_vram_bar_size signed vram_bar_size is registered as an int module parameter and is documented to accept negative values to disable BAR resizing. Store it as an int in xe_modparam as well, so negative values work as intended and the module_param type matches. Fixes: 80742a1aa26e ("drm/xe: Allow to drop vram resizing") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Link: https://patch.msgid.link/20260202181853.1095736-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper (cherry picked from commit 25c9aa4dcb5ef2ad9f354d19f8f1eeb690d1c161) Signed-off-by: Rodrigo Vivi commit 5e905ec67214444362b81345ef8fde63e58425b6 Author: Piotr Piórkowski Date: Mon Feb 2 12:50:41 2026 +0100 drm/xe/vf: Avoid reading media version when media GT is disabled When the media GT is not allowed, a VF must not attempt to read the media version from the GuC. The GuC may not be loaded, and any attempt to communicate with it would result in a timeout and a VF probe failure: (...) [ 1912.406046] xe 0000:01:00.1: [drm] *ERROR* Tile0: GT1: GuC mmio request 0x5507: no reply 0x5507 [ 1912.407277] xe 0000:01:00.1: [drm] *ERROR* Tile0: GT1: [GUC COMMUNICATION] MMIO send failed (-ETIMEDOUT) [ 1912.408689] xe 0000:01:00.1: [drm] *ERROR* VF: Tile0: GT1: Failed to reset GuC state (-ETIMEDOUT) [ 1912.413986] xe 0000:01:00.1: probe with driver xe failed with error -110 Let's skip reading the media version for VFs when the media GT is not allowed. v2: move the condition directly to the VF path Fixes: 7abd69278bb5 ("drm/xe/configfs: Add attribute to disable GT types") Signed-off-by: Piotr Piórkowski Cc: Matt Roper Cc: Michal Wajdeczko Cc: Shuicheng Lin Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260202115041.2863357-1-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski (cherry picked from commit 0bcacf56dc0b265f9c47056c6a4f0c1394a8a3f0) Signed-off-by: Rodrigo Vivi commit bc6387a2e0c1562faa56ce2a98cef50cab809e08 Author: Matt Roper Date: Thu Feb 5 14:05:09 2026 -0800 drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138 The PSS_CHICKEN register has been part of the RCS engine's LRC since it was first introduced in Xe_LP. That means that any workarounds that adjust its value (such as Wa_14019988906 and Wa_14019877138) need to be implemented in the lrc_was[] table so that they become part of the default LRC from which all subsequent LRCs are copied. Although these workarounds were implemented correctly on most platforms, they were incorrectly placed on the engine_was[] table for Xe2_HPG. Move the workarounds to the proper lrc_was[] table and switch the 'xe_rtp_match_first_render_or_compute' rule to specifically match the RCS since that's the engine whose LRC manages the register. Bspec: 65182 Fixes: 7f3ee7d88058 ("drm/xe/xe2hpg: Add initial GT workarounds") Reviewed-by: Shekhar Chauhan Link: https://patch.msgid.link/20260205220508.51905-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper (cherry picked from commit e04c609eedf4d6748ac0bcada4de1275b034fed6) Signed-off-by: Rodrigo Vivi commit 4a9b4e1fa52a6aaa1adbb7f759048df14afed54c Author: Shuicheng Lin Date: Fri Jan 30 16:56:22 2026 +0000 drm/xe/mmio: Avoid double-adjust in 64-bit reads xe_mmio_read64_2x32() was adjusting register addresses and then calling xe_mmio_read32(), which applies the adjustment again. This may shift accesses twice if adj_offset < adj_limit. There is no issue currently, as for media gt, adj_offset > adj_limit, so the 2nd adjust will be a no-op. But it may not work in future. To fix it, replace the adjusted-address comparison with a direct sanity check that ensures the MMIO address adjustment cutoff never falls within the 8-byte range of a 64-bit register. And let xe_mmio_read32() handle address translation. v2: rewrite the sanity check in a more natural way. (Matt) v3: Add Fixes tag. (Jani) Fixes: 07431945d8ae ("drm/xe: Avoid 64-bit register reads") Reviewed-by: Matt Roper Cc: Jani Nikula Cc: Rodrigo Vivi Signed-off-by: Shuicheng Lin Link: https://patch.msgid.link/20260130165621.471408-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper (cherry picked from commit a30f999681126b128a43137793ac84b6a5b7443f) Signed-off-by: Rodrigo Vivi commit fbbe32618e97eff81577a01eb7d9adcd64a216d7 Author: Jia Yao Date: Thu Feb 5 16:15:29 2026 +0000 drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise When user provides a bogus pat_index value through the madvise IOCTL, the xe_pat_index_get_coh_mode() function performs an array access without validating bounds. This allows a malicious user to trigger an out-of-bounds kernel read from the xe->pat.table array. The vulnerability exists because the validation in madvise_args_are_sane() directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without first checking if pat_index is within [0, xe->pat.n_entries). Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug builds, it still performs the unsafe array access in production kernels. v2(Matthew Auld) - Using array_index_nospec() to mitigate spectre attacks when the value is used v3(Matthew Auld) - Put the declarations at the start of the block Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe") Reviewed-by: Matthew Auld Cc: # v6.18+ Cc: Matthew Brost Cc: Shuicheng Lin Cc: Himal Prasad Ghimiray Cc: "Thomas Hellström" Cc: Rodrigo Vivi Cc: Matthew Auld Signed-off-by: Jia Yao Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260205161529.1819276-1-jia.yao@intel.com (cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29) Signed-off-by: Rodrigo Vivi commit 2a673fb4d787ce6672862cb693112378bff86abb Author: Michal Wajdeczko Date: Tue Feb 3 20:37:45 2026 +0100 drm/xe/configfs: Fix 'parameter name omitted' errors On some configs and old compilers we can get following build errors: ../drivers/gpu/drm/xe/xe_configfs.h: In function 'xe_configfs_get_ctx_restore_mid_bb': ../drivers/gpu/drm/xe/xe_configfs.h:40:76: error: parameter name omitted static inline u32 xe_configfs_get_ctx_restore_mid_bb(struct pci_dev *pdev, enum xe_engine_class, ^~~~~~~~~~~~~~~~~~~~ ../drivers/gpu/drm/xe/xe_configfs.h: In function 'xe_configfs_get_ctx_restore_post_bb': ../drivers/gpu/drm/xe/xe_configfs.h:42:77: error: parameter name omitted static inline u32 xe_configfs_get_ctx_restore_post_bb(struct pci_dev *pdev, enum xe_engine_class, ^~~~~~~~~~~~~~~~~~~~ when trying to define our configfs stub functions. Fix that. Fixes: 7a4756b2fd04 ("drm/xe/lrc: Allow to add user commands mid context switch") Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260203193745.576-1-michal.wajdeczko@intel.com (cherry picked from commit f59cde8a2452b392115d2af8f1143a94725f4827) Signed-off-by: Rodrigo Vivi commit bf7172cd25ed182f30af2cbb9f80c730dc717d8e Author: Michal Wajdeczko Date: Wed Feb 4 00:53:32 2026 +0100 drm/xe/pf: Fix sysfs initialization In case of devm_add_action_or_reset() failure the provided cleanup action will be run immediately on the not yet initialized kobject. This may lead to errors like: [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called. [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9 [ ] RIP: 0010:kobject_put+0xdf/0x250 [ ] Call Trace: [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe] [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe] [ ] xe_sriov_init_late+0x5f/0x2c0 [xe] [ ] xe_device_probe+0x5f2/0xc20 [xe] [ ] xe_pci_probe+0x396/0x610 [xe] [ ] local_pci_probe+0x47/0xb0 [ ] refcount_t: underflow; use-after-free. [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9 [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0 [ ] Call Trace: [ ] kobject_put+0x174/0x250 [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe] [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe] [ ] xe_sriov_init_late+0x5f/0x2c0 [xe] [ ] xe_device_probe+0x5f2/0xc20 [xe] [ ] xe_pci_probe+0x396/0x610 [xe] [ ] local_pci_probe+0x47/0xb0 Fix that by calling kobject_init() and kobject_add() separately and register cleanup action after the kobject is initialized. Also make this cleanup registration a part of the create helper to fix another mistake, as in the loop we were wrongly passing parent kobject while registering cleanup action, and this resulted in some undetected leaks. Fixes: 5c170a4d9c53 ("drm/xe/pf: Prepare sysfs for SR-IOV admin attributes") Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Reviewed-by: Shuicheng Lin Link: https://patch.msgid.link/20260203235332.1350-1-michal.wajdeczko@intel.com (cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324) Signed-off-by: Rodrigo Vivi commit 2961f841b025fb234860bac26dfb7fa7cb0fb122 Merge: 75a452d31ba697 51496091dd37b4 Author: Linus Torvalds Date: Tue Feb 17 15:51:14 2026 -0800 Merge tag 'turbostat-2026.02.14' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat updates from Len Brown: - Add L2 statistics columns for recent Intel processors: L2MRPS = L2 Cache M-References Per Second L2%hit = L2 Cache Hit % - Sort work and output by cpu# rather than core# - Minor features and fixes * tag 'turbostat-2026.02.14' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: (23 commits) tools/power turbostat: version 2026.02.14 tools/power turbostat: Fix and document --header_iterations tools/power turbostat: Use strtoul() for iteration parsing tools/power turbostat: Favor cpu# over core# tools/power turbostat: Expunge logical_cpu_id tools/power turbostat: Enhance HT enumeration tools/power turbostat: Simplify global core_id calculation tools/power turbostat: Unify even/odd/average counter referencing tools/power turbostat: Allocate average counters dynamically tools/power turbostat: Delete core_data.core_id tools/power turbostat: Rename physical_core_id to core_id tools/power turbostat: Cleanup package_id tools/power turbostat: Cleanup internal use of "base_cpu" tools/power turbostat: Add L2 cache statistics tools/power turbostat: Remove redundant newlines from err(3) strings tools/power turbostat: Allow more use of is_hybrid flag tools/power turbostat: Rename "LLCkRPS" column to "LLCMRPS" tools/power turbostat.8: Document the "--force" option tools/power turbostat: Harden against unexpected values tools/power turbostat: Dump hypervisor name ... commit 75a452d31ba697fc986609dd4905294e07687992 Merge: 87a367f1bffadf 10d7c95af043b4 Author: Linus Torvalds Date: Tue Feb 17 15:37:06 2026 -0800 Merge tag 'ntfs3_for_7.0' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "New code: - improve readahead for bitmap initialization and large directory scans - fsync files by syncing parent inodes - drop of preallocated clusters for sparse and compressed files - zero-fill folios beyond i_valid in ntfs_read_folio() - implement llseek SEEK_DATA/SEEK_HOLE by scanning data runs - implement iomap-based file operations - allow explicit boolean acl/prealloc mount options - fall-through between switch labels - delayed-allocation (delalloc) support Fixes: - check return value of indx_find to avoid infinite loop - initialize new folios before use - infinite loop in attr_load_runs_range on inconsistent metadata - infinite loop triggered by zero-sized ATTR_LIST - ntfs_mount_options leak in ntfs_fill_super() - deadlock in ni_read_folio_cmpr - circular locking dependency in run_unpack_ex - prevent infinite loops caused by the next valid being the same - restore NULL folio initialization in ntfs_writepages() - slab-out-of-bounds read in DeleteIndexEntryRoot Updates: - allow readdir() to finish after directory mutations without rewinddir() - handle attr_set_size() errors when truncating files - make ntfs_writeback_ops static - refactor duplicate kmemdup pattern in do_action() - avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() Replaced: - use wait_on_buffer() directly - rename ni_readpage_cmpr into ni_read_folio_cmpr" * tag 'ntfs3_for_7.0' of https://github.com/Paragon-Software-Group/linux-ntfs3: (26 commits) fs/ntfs3: add delayed-allocation (delalloc) support fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() fs/ntfs3: add fall-through between switch labels fs/ntfs3: allow explicit boolean acl/prealloc mount options fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot ntfs3: Restore NULL folio initialization in ntfs_writepages() ntfs3: Refactor duplicate kmemdup pattern in do_action() fs/ntfs3: prevent infinite loops caused by the next valid being the same fs/ntfs3: make ntfs_writeback_ops static ntfs3: fix circular locking dependency in run_unpack_ex fs/ntfs3: implement iomap-based file operations fs/ntfs3: fix deadlock in ni_read_folio_cmpr fs/ntfs3: implement llseek SEEK_DATA/SEEK_HOLE by scanning data runs fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() fs/ntfs3: handle attr_set_size() errors when truncating files fs/ntfs3: drop preallocated clusters for sparse and compressed files fs/ntfs3: fsync files by syncing parent inodes fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super() fs/ntfs3: allow readdir() to finish after directory mutations without rewinddir() fs/ntfs3: improve readahead for bitmap initialization and large directory scans ... commit 87a367f1bffadf1db5def15bd0cd2148acd057ad Merge: 0ba83f0968f345 cfdde144ae455b Author: Linus Torvalds Date: Tue Feb 17 15:18:51 2026 -0800 Merge tag 'ceph-for-7.0-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "This adds support for the upcoming aes256k key type in CephX that is based on Kerberos 5 and brings a bunch of assorted CephFS fixes from Ethan and Sam. One of Sam's patches in particular undoes a change in the fscrypt area that had an inadvertent side effect of making CephFS behave as if mounted with wsize=4096 and leading to the corresponding degradation in performance, especially for sequential writes" * tag 'ceph-for-7.0-rc1' of https://github.com/ceph/ceph-client: ceph: assert loop invariants in ceph_writepages_start() ceph: remove error return from ceph_process_folio_batch() ceph: fix write storm on fscrypted files ceph: do not propagate page array emplacement errors as batch errors ceph: supply snapshot context in ceph_uninline_data() ceph: supply snapshot context in ceph_zero_partial_object() libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing libceph: add support for CEPH_CRYPTO_AES256KRB5 libceph: introduce ceph_crypto_key_prepare() libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() libceph: define and enforce CEPH_MAX_KEY_LEN commit 0ba83f0968f34543e57d4a4eddc0a9d0c8c88627 Merge: 1d22968feb2095 869056dbbd636f Author: Linus Torvalds Date: Tue Feb 17 15:08:24 2026 -0800 Merge tag 'ovl-update-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs update from Amir Goldstein: "Relax the semantics of uuid=off to cater to a use case of overlayfs lower layers on btrfs clones, whose UUID are ephemeral and an upper layer on a different filesystem" * tag 'ovl-update-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: relax requirement for uuid=off,index=on commit 1d22968feb2095136dd5f03aae2832a6b6aa6628 Merge: e81dd54f62c753 dc96f01d54cc7c Author: Linus Torvalds Date: Tue Feb 17 15:02:49 2026 -0800 Merge tag 'v7.0-rc-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix three potential double free vulnerabilities - Fix data corruption due to racy lease checks - Enforce SMB1 signing verification checks - Fix invalid mount option parsing - Remove unneeded tracepoint - Various minor error code corrections - Minor cleanup * tag 'v7.0-rc-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: terminate session upon failed client required signing cifs: some missing initializations on replay cifs: remove unnecessary tracing after put tcon cifs: update internal module version number smb: client: fix data corruption due to racy lease checks smb/client: move NT_STATUS_MORE_ENTRIES smb/client: rename to NT_ERROR_INVALID_DATATYPE smb/client: rename to NT_STATUS_SOME_NOT_MAPPED smb/client: map NT_STATUS_PRIVILEGE_NOT_HELD smb/client: map NT_STATUS_MORE_PROCESSING_REQUIRED smb/client: map NT_STATUS_BUFFER_OVERFLOW smb/client: map NT_STATUS_NOTIFY_ENUM_DIR cifs: SMB1 split: Remove duplicate include of cifs_debug.h smb: client: fix regression with mount options parsing commit 593fffb8bcfdacc2111a9951afe1fae77988aa4a Merge: b0b1a8583d8e79 d7988720ef3ea5 Author: Andrii Nakryiko Date: Tue Feb 17 14:15:57 2026 -0800 Merge branch 'libbpf-fix-perm-errors-for-ldimm_64_full_range_off' Emil Tsalapatis says: ==================== libbpf: Fix perm errors for LDIMM_64_FULL_RANGE_OFF Commit 728ff167910e ("libbpf: Add gating for arena globals relocation feature") adds a feature flag for testing whether the running kernel supports LDIMM64 instructions with large direct offsets. Fix two edge cases that can cause unexpected -EPERM errors in two ways: 1) The probe program used for the feature has type TRACEPOINT, but it's possible the caller does not have permission to load it, even if it is able to do so for generic BPF programs. Use the SOCKET_FILTER type instead that requires fewer permissions. This does not affect the check itself, which will always fail verification anyway. 2) The probe is triggered during bpf_object__collect_relos(), itself called in bpf_object_open(), to compute the arena relocation offsets of arena variables. However, the caller may not have permissions to load BPF programs. This is the case in some systems with the bpftool calls made by the BPF selftests during compilation, e.g., for skeleton generation. Move all uses of the feature check to bpf_object_prepare() time instead. Fixes: 728ff167910e ("libbpf: Add gating for arena globals relocation feature") Signed-off-by: Emil Tsalapatis v2 -> v3: https://lore.kernel.org/bpf/20260214021014.15670-1-emil@etsalapatis.com/ - Only zero out the first byte of the log buffer (Andrii) - Minimize invocations of the feature gate (Andrii) v1 -> v2: https://lore.kernel.org/bpf/20260213181752.505318-1-emil@etsalapatis.com/ - Adjust the hash of the original commit post-tree rebase - Ensure close() is not called on invalid prog_fd in feature probe (Coverity) ==================== Link: https://patch.msgid.link/20260217204345.548648-1-emil@etsalapatis.com Signed-off-by: Andrii Nakryiko commit d7988720ef3ea5926f1b886b27eddf08abbadba0 Author: Emil Tsalapatis Date: Tue Feb 17 15:43:45 2026 -0500 libbpf: Delay feature gate check until object prepare time Commit 728ff167910e ("libbpf: Add gating for arena globals relocation feature") adds a feature gate check that loads a map and BPF program to test the running kernel supports large direct offsets for LDIMM64 instructions. This check is currently used to calculate arena symbol offsets during bpf_object__collect_relos, itself called by bpf_object_open. However, the program calling bpf_object_open may not have the permissions to load maps and programs. This is the case with the BPF selftests, where bpftool is invoked at compilation time during skeleton generation. This causes errors as the feature gate unexpectedly fails with -EPERM. Avoid this by moving all the use of the FEAT_LDIMM64_FULL_RANGE_OFF feature gate to BPF object preparation time instead. Fixes: 728ff167910e ("libbpf: Add gating for arena globals relocation feature") Signed-off-by: Emil Tsalapatis Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260217204345.548648-3-emil@etsalapatis.com commit 7cefbb47ccb2ded187f72db17a46f19d7cf4bf08 Author: Emil Tsalapatis Date: Tue Feb 17 15:43:44 2026 -0500 libbpf: Do not use PROG_TYPE_TRACEPOINT program for feature gating Commit 728ff167910e uses a PROG_TYPE_TRACEPOINT BPF test program to check whether the running kernel supports large LDIMM64 offsets. The feature gate incorrectly assumes that the program will fail at verification time with one of two messages, depending on whether the feature is supported by the running kernel. However, PROG_TYPE_TRACEPOINT programs may fail to load before verification even starts, e.g., if the shell does not have the appropriate capabilities. Use a BPF_PROG_TYPE_SOCKET_FILTER program for the feature gate instead. Also fix two minor issues. First, ensure the log buffer for the test is initialized: Failing program load before verification led to libbpf dumping uninitialized data to stdout. Also, ensure that close() is only called for program_fd in the probe if the program load actually succeeded. The call was currently failing silently with -EBADF most of the time. Fixes: 728ff167910e ("libbpf: Add gating for arena globals relocation feature") Reported-by: Alexei Starovoitov Signed-off-by: Emil Tsalapatis Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260217204345.548648-2-emil@etsalapatis.com commit e81dd54f62c753dd423d1a9b62481a1c599fb975 Merge: 9b725d5959a1d9 ab736ed52e3409 Author: Linus Torvalds Date: Tue Feb 17 11:47:17 2026 -0800 Merge tag 'dmaengine-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "Core: - Add Frank Li as susbstem reviewer to help with reviews New Support: - Mediatek support for Dimensity 6300 and 9200 controller - Qualcomm Kaanapali and Glymur GPI DMA engine - Synopsis DW AXI Agilex5 - Renesas RZ/V2N SoC - Atmel microchip lan9691-dma - Tegra ADMA tegra264 Updates: - sg_nents_for_dma() helper use in subsystem - pm_runtime_mark_last_busy() redundant call update for subsystem - Residue support for xilinx AXIDMA driver - Intel Max SGL Size Support and capabilities for DSA3.0 - AXI dma larger than 32bits address support" * tag 'dmaengine-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (64 commits) dmaengine: add Frank Li as reviewer dt-bindings: dma: qcom,gpi: Update max interrupts lines to 16 dmaengine: fsl-edma: don't explicitly disable clocks in .remove() dmaengine: xilinx: xdma: use sg_nents_for_dma() helper dmaengine: sh: use sg_nents_for_dma() helper dmaengine: sa11x0: use sg_nents_for_dma() helper dmaengine: qcom: bam_dma: use sg_nents_for_dma() helper dmaengine: qcom: adm: use sg_nents_for_dma() helper dmaengine: pxa-dma: use sg_nents_for_dma() helper dmaengine: lgm: use sg_nents_for_dma() helper dmaengine: k3dma: use sg_nents_for_dma() helper dmaengine: dw-axi-dmac: use sg_nents_for_dma() helper dmaengine: bcm2835-dma: use sg_nents_for_dma() helper dmaengine: axi-dmac: use sg_nents_for_dma() helper dmaengine: altera-msgdma: use sg_nents_for_dma() helper scatterlist: introduce sg_nents_for_dma() helper dmaengine: idxd: Add Max SGL Size Support for DSA3.0 dmaengine: idxd: Expose DSA3.0 capabilities through sysfs dmaengine: sh: rz-dmac: Make channel irq local dmaengine: pl08x: Fix comment stating the difference between PL080 and PL081 ... commit 9b725d5959a1d9bb670ccdb23add45f0eaafefb5 Merge: 4e15e819710e35 dbeea86fecef7c Author: Linus Torvalds Date: Tue Feb 17 11:40:04 2026 -0800 Merge tag 'phy-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "Core: - Add suuport for "rx-polarity" and "tx-polarity" device tree properties and phy common properties to manage this New Support: - Qualcomm Glymur PCIe Gen4 2-lanes PCIe phy, DP and edp phy, USB UNI PHY and SMB2370 eUSB2 repeater. SC8280xp QMP UFS PHY, Kaanapali PCIe phy and QMP PHY, QCS615 QMP USB3+DP PHY and driver support for that. - SpacemiT PCIe/combo PHY and K1 USB2 PHY driver. - HDMI 2.1 FRL configuration support and driver enabling for rockchip samsung-hdptx driver - TI TCAN1046 phy - Renesas RZ/V2H(P) and RZ/V2N usb3 - Mediatek MT8188 hdmi-phy - Google Tensor SoC USB PHY driver - Apple Type-C PHY Updates: - Subsystem conversion for clock round_rate() to determine_rate() - TI USB3 DT schema conversion - Samsung ExynosAutov920 usb3, combo hsphy and ssphy support" * tag 'phy-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (143 commits) phy: ti: phy-j721e-wiz: convert from divider_round_rate() to divider_determine_rate() dt-bindings: phy: ti,control-phy-otghs: convert to DT schema dt-bindings: phy: ti,phy-usb3: convert to DT schema phy: tegra: xusb: Remove unused powered_on variable phy: renesas: rcar-gen3-usb2: add regulator dependency phy: GOOGLE_USB: add TYPEC dependency phy: enter drivers/phy/Makefile even without CONFIG_GENERIC_PHY phy: renesas: rcar-gen3-usb2: Use mux-state for phyrst management phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control phy: renesas: rcar-gen3-usb2: Use devm_pm_runtime_enable() phy: renesas: rcar-gen3-usb2: Factor out VBUS control logic dt-bindings: phy: renesas,usb2-phy: Document RZ/G3E SoC dt-bindings: phy: renesas,usb2-phy: Document mux-states property dt-bindings: phy: renesas,usb2-phy: Document USB VBUS regulator phy: rockchip: samsung-hdptx: Add HDMI 2.1 FRL support phy: rockchip: samsung-hdptx: Extend rk_hdptx_phy_verify_hdmi_config() helper phy: rockchip: samsung-hdptx: Switch to driver specific HDMI config phy: rockchip: samsung-hdptx: Drop hw_rate driver data phy: rockchip: samsung-hdptx: Compute clk rate from PLL config phy: rockchip: samsung-hdptx: Cleanup *_cmn_init_seq lists ... commit 4e15e819710e3518ec28735a12e0f45b7550290d Merge: d295082ea672e7 dc3a6a942e9ee3 Author: Linus Torvalds Date: Tue Feb 17 10:07:13 2026 -0800 Merge tag 'soundwire-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: - support for Qualcomm v2.2.0 controllers - bus method updates for .probe(), .remove() and .shutdown() and remove function return value updates - Avell B.ON dmi-quirks mapping - mark cs42l45 codec as wake capable * tag 'soundwire-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: intel_ace2x: add SND_HDA_CORE dependency dt-bindings: soundwire: qcom: Add SoundWire v2.2.0 compatible soundwire: Use bus methods for .probe(), .remove() and .shutdown() soundwire: Make remove function return no value soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) soundwire: qcom: Use guard to avoid mixing cleanup and goto soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list commit d295082ea672e7277388e1cf7c5af73788cf8029 Merge: 17f8d2009367c3 c86d39d6805474 Author: Linus Torvalds Date: Tue Feb 17 09:46:03 2026 -0800 Merge tag 'spdx-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull SPDX updates from Greg KH: "Here are two small changes that add some missing SPDX license lines to some core kernel files. These are: - adding SPDX license lines to kdb files - adding SPDX license lines to the remaining kernel/ files Both of these have been in linux-next for a while with no reported issues" * tag 'spdx-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: kernel: debug: Add SPDX license ids to kdb files kernel: add SPDX-License-Identifier lines commit 17f8d2009367c3da82882f70ccbdca9f8c7b5f20 Merge: 3ad7945754000d da87d45b195148 Author: Linus Torvalds Date: Tue Feb 17 09:36:43 2026 -0800 Merge tag 'usb-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the "big" set of USB and Thunderbolt driver updates for 7.0-rc1. Overall more lines were removed than added, thanks to dropping the obsolete isp1362 USB host controller driver, always a nice change. Other than that, nothing major happening here, highlights are: - lots of dwc3 driver updates and new hardware support added - usb gadget function driver updates - usb phy driver updates - typec driver updates and additions - USB rust binding updates for syntax and formatting changes - more usb serial device ids added - other smaller USB core and driver updates and additions All of these have been in linux-next for a long time, with no reported problems" * tag 'usb-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (77 commits) usb: typec: ucsi: Add Thunderbolt alternate mode support usb: typec: hd3ss3220: Check if regulator needs to be switched usb: phy: tegra: parametrize PORTSC1 register offset usb: phy: tegra: parametrize HSIC PTS value usb: phy: tegra: return error value from utmi_wait_register usb: phy: tegra: cosmetic fixes dt-bindings: usb: renesas,usbhs: Add RZ/G3E SoC support usb: dwc2: fix resume failure if dr_mode is host usb: cdns3: fix role switching during resume usb: dwc3: gadget: Move vbus draw to workqueue context USB: serial: option: add Telit FN920C04 RNDIS compositions usb: dwc3: Log dwc3 address in traces usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN usb: phy: tegra: add HSIC support usb: phy: tegra: use phy type directly usb: typec: ucsi: Enforce mode selection for cros_ec_ucsi usb: typec: ucsi: Support mode selection to activate altmodes usb: typec: Introduce mode_selection bit usb: typec: Implement mode selection usb: typec: Expose alternate mode priority via sysfs ... commit 3ad7945754000d868ed86315d33085a914c422c1 Merge: a5f22b9b139762 0a15f43b92ddaa Author: Linus Torvalds Date: Tue Feb 17 09:30:52 2026 -0800 Merge tag 'tty-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial driver updates from Greg KH: "Here is the small amount of tty and serial driver updates for 7.0-rc1. Nothing major in here at all, just some driver updates and minor tweaks and cleanups including: - sh-sci serial driver updates - 8250 driver updates - attempt to make the tty ports have their own workqueue, but was reverted after testing found it to have problems on some platforms. This will probably come back for 7.1 after it has been reworked and resubmitted - other tiny tty driver changes All of these have been in linux-next for a while with no reported problems" * tag 'tty-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (49 commits) Revert "tty: tty_port: add workqueue to flip TTY buffer" tty: tty_port: add workqueue to flip TTY buffer serial: 8250_pci: Remove custom deprecated baud setting routine serial: 8250_omap: Remove custom deprecated baud setting routine dt-bindings: serial: renesas,scif: Document RZ/G3L SoC serial: 8250: omap: set out-of-band wakeup if wakeup pinctrl exists tty: hvc-iucv: Remove KMSG_COMPONENT macro dt-bindings: serial: google,goldfish-tty: Convert to DT schema dt-bindings: serial: sh-sci: Fold single-entry compatibles into enum serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done serial: 8250: 8250_omap.c: Add support for handling UART error conditions serial: SH_SCI: improve "DMA support" prompt serial: Kconfig: fix ordering of entries for menu display serial: 8250: fix ordering of entries for menu display serial: imx: change SERIAL_IMX_CONSOLE to bool 8250_men_mcb: drop unneeded MODULE_ALIAS serial: men_z135_uart: drop unneeded MODULE_ALIAS dt-bindings: serial: renesas,rsci: Document RZ/V2H(P) and RZ/V2N SoCs serial: rsci: Convert to FIELD_MODIFY() dt-bindings: serial: 8250: add SpacemiT K3 UART compatible ... commit a5f22b9b139762685810aa5a41fd0181488aea13 Merge: 505d195b0f96fd 319e3ff5ed7bc1 Author: Linus Torvalds Date: Tue Feb 17 09:20:58 2026 -0800 Merge tag 'staging-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the big set of staging driver updates for 7.0-rc1. Well, not that big, just lots of tiny coding style cleanups primarily in one driver as everyone seems to have glomed onto it for some reason that escapes me (is there a tutorial out there somewhere pointing people at this?) Not much overall, the changes can be summarized as: - cleanups for the rtl8723bs driver, so many cleanups... - vme_user driver cleanups - sm750fb driver cleanups - tiny greybus driver cleanups - other really small staging driver cleanups All of these have been in linux-next for a while with no reported issues" * tag 'staging-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (119 commits) staging: rtl8723bs: refactor ODM_SetIQCbyRFpath to reduce duplication staging: rtl8723bs: rename CamelCase function Set_MSR to set_msr staging: rtl8723bs: remove unnecessary blank lines in rtw_io.c staging: rtl8723bs: remove stale TODO item regarding %pM staging: rtl8723bs: remove unused allocation wrapper functions staging: rtl8723bs: use standard skb allocation APIs staging: rtl8723bs: replace rtw_zmalloc() with kzalloc() staging: rtl8723bs: replace rtw_malloc() with kmalloc() staging: rtl8723bs: introduce kmemdup() where applicable staging: sm750fb: Clean up variable names staging: rtl8723bs: fix null dereference in find_network staging: rtl8723bs: use unaligned access macros in rtw_security.c staging: rtl8723bs: fix potential race in expire_timeout_chk staging: rtl8723bs: remove dead debugging code in rtw_mlme_ext.c staging: rtl8723bs: modernize hex output in rtw_report_sec_ie staging: rtl8723bs: fix spacing around operators staging: rtl8723bs: rename u1bTmp to val staging: rtl8723bs: remove unused private debug counters staging: rtl8723bs: remove thread wraper functions and add IS_ERR() check staging: rtl8723bs: fix firmware memory leak on error ... commit 505d195b0f96fd613a51b13dde37aa5ad301eb32 Merge: 99dfe2d4da67d8 3c4ae63073d84a Author: Linus Torvalds Date: Tue Feb 17 09:11:04 2026 -0800 Merge tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/IIO driver updates from Greg KH: "Here is the big set of char/misc/iio and other smaller driver subsystem changes for 7.0-rc1. Lots of little things in here, including: - Loads of iio driver changes and updates and additions - gpib driver updates - interconnect driver updates - i3c driver updates - hwtracing (coresight and intel) driver updates - deletion of the obsolete mwave driver - binder driver updates (rust and c versions) - mhi driver updates (causing a merge conflict, see below) - mei driver updates - fsi driver updates - eeprom driver updates - lots of other small char and misc driver updates and cleanups All of these have been in linux-next for a while, with no reported issues" * tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (297 commits) mux: mmio: fix regmap leak on probe failure rust_binder: return p from rust_binder_transaction_target_node() drivers: android: binder: Update ARef imports from sync::aref rust_binder: fix needless borrow in context.rs iio: magn: mmc5633: Fix Kconfig for combination of I3C as module and driver builtin iio: sca3000: Fix a resource leak in sca3000_probe() iio: proximity: rfd77402: Add interrupt handling support iio: proximity: rfd77402: Document device private data structure iio: proximity: rfd77402: Use devm-managed mutex initialization iio: proximity: rfd77402: Use kernel helper for result polling iio: proximity: rfd77402: Align polling timeout with datasheet iio: cros_ec: Allow enabling/disabling calibration mode iio: frequency: ad9523: correct kernel-doc bad line warning iio: buffer: buffer_impl.h: fix kernel-doc warnings iio: gyro: itg3200: Fix unchecked return value in read_raw MAINTAINERS: add entry for ADE9000 driver iio: accel: sca3000: remove unused last_timestamp field iio: accel: adxl372: remove unused int2_bitmask field iio: adc: ad7766: Use iio_trigger_generic_data_rdy_poll() iio: magnetometer: Remove IRQF_ONESHOT ... commit 99dfe2d4da67d863ff8f185d1e8033cce28e4c49 Merge: 7b751b01ade7f6 dfe48ea179733b Author: Linus Torvalds Date: Tue Feb 17 08:48:45 2026 -0800 Merge tag 'block-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull more block updates from Jens Axboe: - Fix partial IOVA mapping cleanup in error handling - Minor prep series ignoring discard return value, as the inline value is always known - Ensure BLK_FEAT_STABLE_WRITES is set for drbd - Fix leak of folio in bio_iov_iter_bounce_read() - Allow IOC_PR_READ_* for read-only open - Another debugfs deadlock fix - A few doc updates * tag 'block-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: blk-mq: use NOIO context to prevent deadlock during debugfs creation blk-stat: convert struct blk_stat_callback to kernel-doc block: fix enum descriptions kernel-doc block: update docs for bio and bvec_iter block: change return type to void nvmet: ignore discard return value md: ignore discard return value block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova block: fix folio leak in bio_iov_iter_bounce_read() block: allow IOC_PR_READ_* ioctls with BLK_OPEN_READ drbd: always set BLK_FEAT_STABLE_WRITES commit 7b751b01ade7f666de2f5c365bd9562c2dcd7d60 Merge: 9702969978695d be3573124e6307 Author: Linus Torvalds Date: Tue Feb 17 08:33:49 2026 -0800 Merge tag 'io_uring-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull more io_uring updates from Jens Axboe: "This is a mix of cleanups and fixes. No major fixes in here, just a bunch of little fixes. Some of them marked for stable as it fixes behavioral issues - Fix an issue with SOCKET_URING_OP_SETSOCKOPT for netlink sockets, due to a too restrictive check on it having an ioctl handler - Remove a redundant SQPOLL check in ring creation - Kill dead accounting for zero-copy send, which doesn't use ->buf or ->len post the initial setup - Fix missing clamp of the allocation hint, which could cause allocations to fall outside of the range the application asked for. Still within the allowed limits. - Fix for IORING_OP_PIPE's handling of direct descriptors - Tweak to the API for the newly added BPF filters, making them more future proof in terms of how applications deal with them - A few fixes for zcrx, fixing a few error handling conditions - Fix for zcrx request flag checking - Add support for querying the zcrx page size - Improve the NO_SQARRAY static branch inc/dec, avoiding busy conditions causing too much traffic - Various little cleanups" * tag 'io_uring-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/bpf_filter: pass in expected filter payload size io_uring/bpf_filter: move filter size and populate helper into struct io_uring/cancel: de-unionize file and user_data in struct io_cancel_data io_uring/rsrc: improve regbuf iov validation io_uring: remove unneeded io_send_zc accounting io_uring/cmd_net: fix too strict requirement on ioctl io_uring: delay sqarray static branch disablement io_uring/query: add query.h copyright notice io_uring/query: return support for custom rx page size io_uring/zcrx: check unsupported flags on import io_uring/zcrx: fix post open error handling io_uring/zcrx: fix sgtable leak on mapping failures io_uring: use the right type for creds iteration io_uring/openclose: fix io_pipe_fixed() slot tracking for specific slots io_uring/filetable: clamp alloc_hint to the configured alloc range io_uring/rsrc: replace reg buffer bit field with flags io_uring/zcrx: improve types for size calculation io_uring/tctx: avoid modifying loop variable in io_ring_add_registered_file io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check commit 777a02812f739af9e349cd0f695400a1d84053f4 Author: Imre Deak Date: Mon Feb 16 09:04:18 2026 +0200 drm/i915/dp: Add missing slice count check during mode validation Add the missing check for a valid slice count during mode validation when DSC is enabled. Cc: Vinod Govindapillai Fixes: 745395b51c26 ("drm/i915/dp: Add intel_dp_mode_valid_with_dsc()") Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260216070421.714884-2-imre.deak@intel.com (cherry picked from commit ec4db429fd38e5c5cbea3521049739fd2718845c) Signed-off-by: Joonas Lahtinen commit 40534d19ed2afb880ecf202dab26a8e7a5808d16 Author: Fabian Godehardt Date: Wed Feb 11 08:26:16 2026 +0100 spi: spidev: fix lock inversion between spi_lock and buf_lock The spidev driver previously used two mutexes, spi_lock and buf_lock, but acquired them in different orders depending on the code path: write()/read(): buf_lock -> spi_lock ioctl(): spi_lock -> buf_lock This AB-BA locking pattern triggers lockdep warnings and can cause real deadlocks: WARNING: possible circular locking dependency detected spidev_ioctl() -> mutex_lock(&spidev->buf_lock) spidev_sync_write() -> mutex_lock(&spidev->spi_lock) *** DEADLOCK *** The issue is reproducible with a simple userspace program that performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from separate threads on the same spidev file descriptor. Fix this by simplifying the locking model and removing the lock inversion entirely. spidev_sync() no longer performs any locking, and all callers serialize access using spi_lock. buf_lock is removed since its functionality is fully covered by spi_lock, eliminating the possibility of lock ordering issues. This removes the lock inversion and prevents deadlocks without changing userspace ABI or behaviour. Signed-off-by: Fabian Godehardt Link: https://patch.msgid.link/20260211072616.489522-1-fg@emlix.com Signed-off-by: Mark Brown commit 93983a9f3beea791c21d77c2425488ad327d4fda Author: Christian Loehle Date: Tue Feb 17 00:20:05 2026 +0530 cpuidle: menu: Remove single state handling cpuidle systems where the governor has no choice because there's only a single idle state are now handled by cpuidle core and bypass the governor, so remove the related handling. Signed-off-by: Christian Loehle [ rjw: Rebase on top of the cpuidle changes merged recently ] Link: https://patch.msgid.link/20260216185005.1131593-5-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki commit 825d5d347935d5fc339df969c572e382393f40ec Author: Christian Loehle Date: Tue Feb 17 00:20:04 2026 +0530 cpuidle: teo: Remove single state handling cpuidle systems where the governor has no choice because there's only a single idle state are now handled by cpuidle core and bypass the governor, so remove the related handling. Signed-off-by: Christian Loehle Link: https://patch.msgid.link/20260216185005.1131593-4-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki commit 9b9c0ff095f04c27da1f761d77c19cd53594d18e Author: Aboorva Devarajan Date: Tue Feb 17 00:20:03 2026 +0530 cpuidle: haltpoll: Remove single state handling cpuidle systems where the governor has no choice because there's only a single idle state are now handled by cpuidle core and bypass the governor, so remove the related handling. Signed-off-by: Aboorva Devarajan Reviewed-by: Christian Loehle [ rjw: Extended the change to drop a redundant local variable ] Link: https://patch.msgid.link/20260216185005.1131593-3-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki commit 3ee5333feec43b4c75c8d3dc70f4c776b7c1b3ed Author: Heiko Carstens Date: Mon Feb 16 15:02:33 2026 +0100 s390/smp: Avoid calling rebuild_sched_domains() early Since a recent cpuset code change [1] the kernel emits warnings like this: WARNING: kernel/cgroup/cpuset.c:966 at rebuild_sched_domains_locked+0xe0/0x120, CPU#0: kworker/0:0/9 Modules linked in: CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.20.0-20260215.rc0.git3.bb7a3fc2c976.300.fc43.s390x+git #1 PREEMPTLAZY Hardware name: IBM 3931 A01 703 (KVM/Linux) Workqueue: events topology_work_fn Krnl PSW : 0704c00180000000 000002922e7af5c4 (rebuild_sched_domains_locked+0xe4/0x120) ... Call Trace: [<000002922e7af5c4>] rebuild_sched_domains_locked+0xe4/0x120 [<000002922e7af634>] rebuild_sched_domains+0x34/0x50 [<000002922e6ba232>] process_one_work+0x1b2/0x490 [<000002922e6bc4b8>] worker_thread+0x1f8/0x3b0 [<000002922e6c6a98>] kthread+0x148/0x170 [<000002922e645ffc>] __ret_from_fork+0x3c/0x240 [<000002922f51f492>] ret_from_fork+0xa/0x30 Reason for this is that the s390 specific smp initialization code schedules a work which rebuilds scheduling domains way before the scheduler is smp aware. With the mentioned commit the (invalid) rebuild request is not anymore silently discarded but instead leads to warning. Address this by avoiding the early rebuild request. Reported-by: Marc Hartmayer Tested-by: Marc Hartmayer Fixes: 6ee43047e8ad ("cpuset: Remove unnecessary checks in rebuild_sched_domains_locked") [1] Signed-off-by: Heiko Carstens commit dd3411959b57df6e05a3ccbac67b0a836871c0c4 Author: Alexander Egorenkov Date: Mon Feb 16 07:29:16 2026 +0100 s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n The commit c8424e776b09 ("MODSIGN: Export module signature definitions") replaced the dependency of KEXEC_SIG on SYSTEM_DATA_VERIFICATION with the dependency on MODULE_SIG_FORMAT. This change disables KEXEC_SIG in s390 kernels built with MODULES=n if nothing else selects MODULE_SIG_FORMAT. Furthermore, the signature verification in s390 kexec does not require MODULE_SIG_FORMAT because it requires only the struct module_signature and, therefore, does not depend on code in kernel/module_signature.c. But making ARCH_SUPPORTS_KEXEC_SIG depend on SYSTEM_DATA_VERIFICATION is also incorrect because it makes KEXEC_SIG available on s390 only if some other arbitrary option (for instance a file system or device driver) selects it directly or indirectly. To properly make KEXEC_SIG available for s390 kernels built with MODULES=y as well as MODULES=n _and_ also not depend on arbitrary options selecting SYSTEM_DATA_VERIFICATION, set ARCH_SUPPORTS_KEXEC_SIG=y for s390 and select SYSTEM_DATA_VERIFICATION when KEXEC_SIG=y. Fixes: c8424e776b09 ("MODSIGN: Export module signature definitions") Suggested-by: Heiko Carstens Signed-off-by: Alexander Egorenkov Signed-off-by: Heiko Carstens commit e5c9ffc6ae1bcdb1062527d611043681ac301aca Author: Aboorva Devarajan Date: Tue Feb 17 00:20:02 2026 +0530 cpuidle: Skip governor when only one idle state is available On certain platforms (PowerNV systems without a power-mgt DT node), cpuidle may register only a single idle state. In cases where that single state is a polling state (state 0), the ladder governor may incorrectly treat state 1 as the first usable state and pass an out-of-bounds index. This can lead to a NULL enter callback being invoked, ultimately resulting in a system crash. [ 13.342636] cpuidle-powernv : Only Snooze is available [ 13.351854] Faulting instruction address: 0x00000000 [ 13.376489] NIP [0000000000000000] 0x0 [ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668 Fix this by adding a bail-out in cpuidle_select() that returns state 0 directly when state_count <= 1, bypassing the governor and keeping the tick running. Fixes: dc2251bf98c6 ("cpuidle: Eliminate the CPUIDLE_DRIVER_STATE_START symbol") Signed-off-by: Aboorva Devarajan Reviewed-by: Christian Loehle Link: https://patch.msgid.link/20260216185005.1131593-2-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki commit 71e99ee20fc3f662555118cf1159443250647533 Author: Inseo An Date: Tue Feb 17 21:14:40 2026 +0900 netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between. This creates two use-after-free conditions: 1) Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it. 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain. Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed. Fixes: 91c7b38dc9f0 ("netfilter: nf_tables: use new transaction infrastructure to handle chain") Signed-off-by: Inseo An Signed-off-by: Florian Westphal commit 008e7a7c293b30bc43e4368dac6ea3808b75a572 Author: Pablo Neira Ayuso Date: Tue Feb 17 12:56:39 2026 +0100 net: remove WARN_ON_ONCE when accessing forward path array Although unlikely, recent support for IPIP tunnels increases chances of reaching this WARN_ON_ONCE if userspace manages to build a sufficiently long forward path. Remove it. Fixes: ddb94eafab8b ("net: resolve forwarding path from virtual netdevice and HW destination address") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 8fde939b0206afc1d5846217a01a16b9bc8c7896 Author: Julian Anastasov Date: Sat Feb 14 16:58:50 2026 +0200 ipvs: do not keep dest_dst if dev is going down There is race between the netdev notifier ip_vs_dst_event() and the code that caches dst with dev that is going down. As the FIB can be notified for the closed device after our handler finishes, it is possible valid route to be returned and cached resuling in a leaked dev reference until the dest is not removed. To prevent new dest_dst to be attached to dest just after the handler dropped the old one, add a netif_running() check to make sure the notifier handler is not currently running for device that is closing. Fixes: 7a4f0761fce3 ("IPVS: init and cleanup restructuring") Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit 05cfe9863ef049d98141dc2969eefde72fb07625 Author: Julian Anastasov Date: Sat Feb 14 16:58:49 2026 +0200 ipvs: skip ipv6 extension headers for csum checks Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem. Fixes: 2906f66a5682 ("ipvs: SCTP Trasport Loadbalancing Support") Fixes: 0bbdd42b7efa ("IPVS: Extend protocol DNAT/SNAT and state handlers") Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 Author: Phil Sutter Date: Sat Feb 14 15:54:06 2026 +0100 include: uapi: netfilter_bridge.h: Cover for musl libc Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to zero. To avoid struct redefinition errors, user space is therefore supposed to include netinet/if_ether.h before (or instead of) linux/if_ether.h. To relieve them from this burden, include the libc header here if not building for kernel space. Reported-by: Alyssa Ross Suggested-by: Florian Westphal Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal commit a6d28eb8efe96b3e35c92efdf1bfacb0cccf541f Author: Florian Westphal Date: Wed Feb 11 12:53:09 2026 +0100 netfilter: nf_conntrack_h323: don't pass uninitialised l3num value Mihail Milev reports: Error: UNINIT (CWE-457): net/netfilter/nf_conntrack_h323_main.c:1189:2: var_decl: Declaring variable "tuple" without initializer. net/netfilter/nf_conntrack_h323_main.c:1197:2: uninit_use_in_call: Using uninitialized value "tuple.src.l3num" when calling "__nf_ct_expect_find". net/netfilter/nf_conntrack_expect.c:142:2: read_value: Reading value "tuple->src.l3num" when calling "nf_ct_expect_dst_hash". 1195| tuple.dst.protonum = IPPROTO_TCP; 1196| 1197|-> exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple); 1198| if (exp && exp->master == ct) 1199| return exp; Switch this to a C99 initialiser and set the l3num value. Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port") Signed-off-by: Florian Westphal commit 7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc Author: Brian Witte Date: Wed Feb 4 14:26:36 2026 -0600 netfilter: nf_tables: revert commit_mutex usage in reset path It causes circular lock dependency between commit_mutex, nfnl_subsys_ipset and nlk_cb_mutex when nft reset, ipset list, and iptables-nft with '-m set' rule run at the same time. Previous patches made it safe to run individual reset handlers concurrently so commit_mutex is no longer required to prevent this. Fixes: bd662c4218f9 ("netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests") Fixes: 3d483faa6663 ("netfilter: nf_tables: Add locking for NFT_MSG_GETSETELEM_RESET requests") Fixes: 3cb03edb4de3 ("netfilter: nf_tables: Add locking for NFT_MSG_GETRULE_RESET requests") Link: https://lore.kernel.org/all/aUh_3mVRV8OrGsVo@strlen.de/ Reported-by: Closes: https://syzkaller.appspot.com/bug?extid=ff16b505ec9152e5f448 Signed-off-by: Brian Witte Signed-off-by: Florian Westphal commit 30c4d7fb59ac4c8d7fa7937df11eed10b368fa11 Author: Brian Witte Date: Wed Feb 4 14:26:38 2026 -0600 netfilter: nft_quota: use atomic64_xchg for reset Use atomic64_xchg() to atomically read and zero the consumed value on reset, which is simpler than the previous read+sub pattern and doesn't require lock serialization. Fixes: bd662c4218f9 ("netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests") Fixes: 3d483faa6663 ("netfilter: nf_tables: Add locking for NFT_MSG_GETSETELEM_RESET requests") Fixes: 3cb03edb4de3 ("netfilter: nf_tables: Add locking for NFT_MSG_GETRULE_RESET requests") Suggested-by: Pablo Neira Ayuso Signed-off-by: Brian Witte Signed-off-by: Florian Westphal commit 779c60a5190c42689534172f4b49e927c9959e4e Author: Brian Witte Date: Wed Feb 4 14:26:37 2026 -0600 netfilter: nft_counter: serialize reset with spinlock Add a global static spinlock to serialize counter fetch+reset operations, preventing concurrent dump-and-reset from underrunning values. The lock is taken before fetching the total so that two parallel resets cannot both read the same counter values and then both subtract them. A global lock is used for simplicity since resets are infrequent. If this becomes a bottleneck, it can be replaced with a per-net lock later. Fixes: bd662c4218f9 ("netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests") Fixes: 3d483faa6663 ("netfilter: nf_tables: Add locking for NFT_MSG_GETSETELEM_RESET requests") Fixes: 3cb03edb4de3 ("netfilter: nf_tables: Add locking for NFT_MSG_GETRULE_RESET requests") Suggested-by: Florian Westphal Signed-off-by: Brian Witte Signed-off-by: Florian Westphal commit 07919126ecfc392102555a70016db3e591abcb3d Author: Sun Jian Date: Thu Feb 5 20:30:17 2026 +0800 netfilter: annotate NAT helper hook pointers with __rcu The NAT helper hook pointers are updated and dereferenced under RCU rules, but lack the proper __rcu annotation. This makes sparse report address space mismatches when the hooks are used with rcu_dereference(). Add the missing __rcu annotations to the global hook pointer declarations and definitions in Amanda, FTP, IRC, SNMP and TFTP. No functional change intended. Suggested-by: Florian Westphal Signed-off-by: Sun Jian Signed-off-by: Florian Westphal commit 0d68ad088e334088b031423e59886ae118c11202 Author: Niranjan H Y Date: Sat Feb 14 16:17:10 2026 +0530 ASoC: tas2783A: add explicit port prepare handling TAS2783a required port prepare bits to be set during playback even when it is using simplified CP_SM. Normally, SoundWire core handles prepare sequencing automatically depending on the type of the device available. For simplified CP_SM there is no need to set the prepare bits. However, due to a hardware limitation in TAS2783A, the port must still be explicitly prepared and de-prepared by the driver to ensure reliable playback. Add a custom .port_prep() callback to program DPN_PREPARECTRL during PRE_PREP and PRE_DEPREP operations. Signed-off-by: Niranjan H Y Link: https://patch.msgid.link/20260214104710.632-1-niranjan.hy@ti.com Signed-off-by: Mark Brown commit 82e3265487c018814b789e251fb8aee8e683674c Author: Claudiu Beznea Date: Fri Feb 13 19:24:34 2026 +0200 ASoC: renesas: rz-ssi: Fix playback and capture In the current codebase the rz_ssi_stream_get() is called at the beginning of rz_ssi_dai_trigger() before rz_ssi_stream_init() is called. Since rz_ssi_stream_init() sets the ssi->{playback, capture}->substream, relying on it in rz_ssi_stream_get() is incorrect. Fix this by checking substream->stream instead as the original code did. Fixes: 53dfb2ad6fcf ("ASoC: renesas: rz-ssi: Simplify the logic in rz_ssi_stream_is_play()") Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260213172434.3801015-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit 77c5e3fdd2793f478e6fdae55c9ea85b21d06f8f Merge: 26f29b14916964 a8c198d16c64cd Author: Paolo Abeni Date: Tue Feb 17 13:34:41 2026 +0100 Merge branch 'selftests-forwarding-fix-br_netfilter-related-test-failures' Aleksei Oladko says: ==================== selftests: forwarding: fix br_netfilter related test failures This patch series fixes kselftests that fail when the br_nefilter module is loaded. The failures occur because the tests generate packets that are either modified or encapsulated, but their IP headers are not fully correct for sanity checks performed by be_netfilter. Signed-off-by: Aleksei Oladko ==================== Link: https://patch.msgid.link/20260213131907.43351-1-aleksey.oladko@virtuozzo.com Signed-off-by: Paolo Abeni commit a8c198d16c64cdf57f481a4cd3e769502802369e Author: Aleksei Oladko Date: Fri Feb 13 13:19:07 2026 +0000 selftests: forwarding: fix pedit tests failure with br_netfilter enabled The tests use the tc pedit action to modify the IPv4 source address ("pedit ex munge ip src set"), but the IP header checksum is not recalculated after the modification. As a result, the modified packet fails sanity checks in br_netfilter after bridging and is dropped, which causes the test to fail. Fix this by ensuring net.bridge.bridge-nf-call-iptables is set to 0 during the test execution. This prevents the bridge from passing L2 traffic to netfilter, bypassing the checksum validation that causes the test failure. Fixes: 92ad3828944e ("selftests: forwarding: Add a test for pedit munge SIP and DIP") Fixes: 226657ba2389 ("selftests: forwarding: Add a forwarding test for pedit munge dsfield") Signed-off-by: Aleksei Oladko Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260213131907.43351-4-aleksey.oladko@virtuozzo.com Signed-off-by: Paolo Abeni commit ce9f6aec0fb780dafc1dfc5f47c688422aff464a Author: Aleksei Oladko Date: Fri Feb 13 13:19:06 2026 +0000 selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled The test generates VXLAN traffic using mausezahn, where the encapsulated inner IPv6 packet has an incorrect payload length set in the IPv6 header. After VXLAN decapsulation, such packets do not pass sanity checks in br_netfilter and are dropped, which causes the test to fail. Fix this by setting the correct IPv6 payload length for the encapsulated packet generated by mausezahn, so that the packet is accepted by br_netfilter. tools/testing/selftests/net/forwarding/vxlan_bridge_1d_ipv6.sh lines 698-706 )"00:03:"$( : Payload length )"3a:"$( : Next header )"04:"$( : Hop limit )"$saddr:"$( : IP saddr )"$daddr:"$( : IP daddr )"80:"$( : ICMPv6.type )"00:"$( : ICMPv6.code )"00:"$( : ICMPv6.checksum ) Data after IPv6 header: • 80: — 1 byte (ICMPv6 type) • 00: — 1 byte (ICMPv6 code) • 00: — 1 byte (ICMPv6 checksum, truncated) Total: 3 bytes → 00:03 is correct. The old value 00:08 did not match the actual payload size. Fixes: b07e9957f220 ("selftests: forwarding: Add VxLAN tests with a VLAN-unaware bridge for IPv6") Signed-off-by: Aleksei Oladko Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260213131907.43351-3-aleksey.oladko@virtuozzo.com Signed-off-by: Paolo Abeni commit 02cb2e6bacbb08ebf6acb61be816efd11e1f4a21 Author: Aleksei Oladko Date: Fri Feb 13 13:19:05 2026 +0000 selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled The test generates VXLAN traffic using mausezahn, where the encapsulated inner IPv4 packet contains a zero IP header checksum. After VXLAN decapsulation, such packets do not pass sanity checks in br_netfilter and are dropped, which causes the test to fail. Fix this by calculating and setting a valid IPv4 header checksum for the encapsulated packet generated by mausezahn, so that the packet is accepted by br_netfilter. Fixed by using the payload_template_calc_checksum() / payload_template_expand_checksum() helpers that are only available in v6.3 and newer kernels. Fixes: a0b61f3d8ebf ("selftests: forwarding: vxlan_bridge_1d: Add an ECN decap test") Signed-off-by: Aleksei Oladko Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260213131907.43351-2-aleksey.oladko@virtuozzo.com Signed-off-by: Paolo Abeni commit 91062e119b4eafde553c894ca072cd615a6dae2e Author: Erik Sanjaya Date: Tue Feb 17 17:21:12 2026 +0700 ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA The ASUS Zenbook 14 UX3405MA uses an ALC294 codec with CS35L41 amplifiers over SPI. The existing quirk for this model only configured the amplifiers, leaving the headset microphone on the combo jack non-functional. Introduce a new fixup that configures pin 0x19 as headset mic input and chains to ALC245_FIXUP_CS35L41_SPI_2 to preserve speaker functionality. Similar to the fix done for the UM3406HA in commit 018f659753fd ("ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14"). Signed-off-by: Erik Sanjaya Link: https://patch.msgid.link/20260217102112.20651-1-sirreidlos@gmail.com Signed-off-by: Takashi Iwai commit 26f29b14916964043bc25b55ad1b9f5e9a12ca53 Author: Eric Dumazet Date: Fri Feb 13 12:04:27 2026 +0000 net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT CONFIG_PREEMPT_RT is special, make this clear in backlog_lock_irq_save() and backlog_unlock_irq_restore(). The issue shows up with CONFIG_DEBUG_IRQFLAGS=y raw_local_irq_restore() called with IRQs enabled WARNING: kernel/locking/irqflag-debug.c:10 at warn_bogus_irq_restore+0xc/0x20 kernel/locking/irqflag-debug.c:10, CPU#1: aoe_tx0/1321 Modules linked in: CPU: 1 UID: 0 PID: 1321 Comm: aoe_tx0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:warn_bogus_irq_restore+0xc/0x20 kernel/locking/irqflag-debug.c:10 Call Trace: backlog_unlock_irq_restore net/core/dev.c:253 [inline] enqueue_to_backlog+0x525/0xcf0 net/core/dev.c:5347 netif_rx_internal+0x120/0x550 net/core/dev.c:5659 __netif_rx+0xa9/0x110 net/core/dev.c:5679 loopback_xmit+0x43a/0x660 drivers/net/loopback.c:90 __netdev_start_xmit include/linux/netdevice.h:5275 [inline] netdev_start_xmit include/linux/netdevice.h:5284 [inline] xmit_one net/core/dev.c:3864 [inline] dev_hard_start_xmit+0x2df/0x830 net/core/dev.c:3880 __dev_queue_xmit+0x16f4/0x3990 net/core/dev.c:4829 dev_queue_xmit include/linux/netdevice.h:3384 [inline] Fixes: 27a01c1969a5 ("net: fully inline backlog_unlock_irq_restore()") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260213120427.2914544-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 636fd32d401572f6cfe89ba17df4eb251020c10f Author: Arnd Bergmann Date: Fri Feb 13 08:44:00 2026 +0100 printk: add CONFIG_PRINTK dependency for netconsole The 'select PRINTK_EXECUTION_CTX' line now causes a harmless warning when NETCONSOLE_DYNAMIC is enabled but PRINTK is not: WARNING: unmet direct dependencies detected for PRINTK_EXECUTION_CTX Depends on [n]: PRINTK [=n] Selected by [y]: - NETCONSOLE_DYNAMIC [=y] && NETDEVICES [=y] && NET_CORE [=y] && NETCONSOLE [=y] && SYSFS [=y] && CONFIGFS_FS [=y] && (NETCONSOLE [=y]!=y [=y] || CONFIGFS_FS [=y]!=m [=m]) In that configuration, the netconsole driver is useless anyway, so avoid this with an added dependency that prevents CONFIG_NETCONSOLE to be enabled without CONFIG_PRINTK. Fixes: 60325c27d3cf ("printk: Add execution context (task name/CPU) to printk_info") Signed-off-by: Arnd Bergmann Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260213074431.1729627-1-arnd@kernel.org Signed-off-by: Paolo Abeni commit 9874b1ba464aee2f7080290652a65a0c8a530d10 Merge: c7d9be66b71af4 a8470953b4caf5 Author: Paolo Abeni Date: Tue Feb 17 13:00:15 2026 +0100 Merge branch 'net-bridge-mcast-fix-mdb_n_entries-counting-warning' Nikolay Aleksandrov says: ==================== net: bridge: mcast: fix mdb_n_entries counting warning The first patch fixes a warning in the mdb_n_entries code which was reported by syzbot, the second patch adds tests for different ways which used to trigger said warning. For more information please check the individual commit messages. ==================== Link: https://patch.msgid.link/20260213070031.1400003-1-nikolay@nvidia.com Signed-off-by: Paolo Abeni commit a8470953b4caf52b32d27e2a23797824b312a325 Author: Nikolay Aleksandrov Date: Fri Feb 13 09:00:31 2026 +0200 selftests: forwarding: bridge_mdb_max: add tests for mdb_n_entries warning Recently we were able to trigger a warning in the mdb_n_entries counting code. Add tests that exercise different ways which used to trigger that warning. Reviewed-by: Ido Schimmel Signed-off-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260213070031.1400003-3-nikolay@nvidia.com Signed-off-by: Paolo Abeni commit 8b769e311a86bb9d15c5658ad283b86fc8f080a2 Author: Nikolay Aleksandrov Date: Fri Feb 13 09:00:30 2026 +0200 net: bridge: mcast: always update mdb_n_entries for vlan contexts syzbot triggered a warning[1] about the number of mdb entries in a context. It turned out that there are multiple ways to trigger that warning today (some got added during the years), the root cause of the problem is that the increase is done conditionally, and over the years these different conditions increased so there were new ways to trigger the warning, that is to do a decrease which wasn't paired with a previous increase. For example one way to trigger it is with flush: $ ip l add br0 up type bridge vlan_filtering 1 mcast_snooping 1 $ ip l add dumdum up master br0 type dummy $ bridge mdb add dev br0 port dumdum grp 239.0.0.1 permanent vid 1 $ ip link set dev br0 down $ ip link set dev br0 type bridge mcast_vlan_snooping 1 ^^^^ this will enable snooping, but will not update mdb_n_entries because in __br_multicast_enable_port_ctx() we check !netif_running $ bridge mdb flush dev br0 ^^^ this will trigger the warning because it will delete the pg which we added above, which will try to decrease mdb_n_entries Fix the problem by removing the conditional increase and always keep the count up-to-date while the vlan exists. In order to do that we have to first initialize it on port-vlan context creation, and then always increase or decrease the value regardless of mcast options. To keep the current behaviour we have to enforce the mdb limit only if the context is port's or if the port-vlan's mcast snooping is enabled. [1] ------------[ cut here ]------------ n == 0 WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline], CPU#0: syz.4.4607/22043 WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline], CPU#0: syz.4.4607/22043 WARNING: net/bridge/br_multicast.c:718 at br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825, CPU#0: syz.4.4607/22043 Modules linked in: CPU: 0 UID: 0 PID: 22043 Comm: syz.4.4607 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline] RIP: 0010:br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline] RIP: 0010:br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825 Code: 41 5f 5d e9 04 7a 48 f7 e8 3f 73 5c f7 90 0f 0b 90 e9 cf fd ff ff e8 31 73 5c f7 90 0f 0b 90 e9 16 fd ff ff e8 23 73 5c f7 90 <0f> 0b 90 e9 60 fd ff ff e8 15 73 5c f7 eb 05 e8 0e 73 5c f7 48 8b RSP: 0018:ffffc9000c207220 EFLAGS: 00010293 RAX: ffffffff8a68042d RBX: ffff88807c6f1800 RCX: ffff888066e90000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff888066e90000 R09: 000000000000000c R10: 000000000000000c R11: 0000000000000000 R12: ffff8880303ef800 R13: dffffc0000000000 R14: ffff888050eb11c4 R15: 1ffff1100a1d6238 FS: 00007fa45921b6c0(0000) GS:ffff8881256f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa4591f9ff8 CR3: 0000000081df2000 CR4: 00000000003526f0 Call Trace: br_mdb_flush_pgs net/bridge/br_mdb.c:1525 [inline] br_mdb_flush net/bridge/br_mdb.c:1544 [inline] br_mdb_del_bulk+0x5e2/0xb20 net/bridge/br_mdb.c:1561 rtnl_mdb_del+0x48a/0x640 net/core/rtnetlink.c:-1 rtnetlink_rcv_msg+0x77e/0xbe0 net/core/rtnetlink.c:6967 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa45839aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa45921b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fa458615fa0 RCX: 00007fa45839aeb9 RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 RBP: 00007fa458408c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa458616038 R14: 00007fa458615fa0 R15: 00007fff0b59fae8 Fixes: b57e8d870d52 ("net: bridge: Maintain number of MDB entries in net_bridge_mcast_port") Reported-by: syzbot+d5d1b7343531d17bd3c5@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/aYrWbRp83MQR1ife@debil/T/#t Reviewed-by: Ido Schimmel Signed-off-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260213070031.1400003-2-nikolay@nvidia.com Signed-off-by: Paolo Abeni commit e65ca16463112677923c61f58cc09e121be1bbce Author: Arnd Bergmann Date: Fri Feb 13 17:51:51 2026 +0100 efi: export sysfb_primary_display for EDID The sysfb_primary_display structure is now part of efi-init.c but conditionally defined. One of the users is missing in the condition: aarch64-linux-ld: drivers/video/fbdev/core/fbmon.o: in function `fb_firmware_edid': fbmon.c:(.text.fb_firmware_edid+0x3c): undefined reference to `sysfb_primary_display' Export it whenever CONFIG_FIRMWARE_EDID is set, so the fbdev core code can use it. Fixes: 4fcae6358871 ("sysfb: Move edid_info into sysfb_primary_display") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602111543.Do4nkY5l-lkp@intel.com/ Signed-off-by: Arnd Bergmann Acked-by: Thomas Zimmermann Signed-off-by: Ard Biesheuvel commit c7d9be66b71af490446127c6ffcb66d6bb71b8b9 Author: Ethan Nelson-Moore Date: Thu Feb 12 20:55:09 2026 -0800 net: arcnet: com20020-pci: fix support for 2.5Mbit cards Commit 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata") converted the com20020-pci driver to use a card info structure instead of a single flag mask in driver_data. However, it failed to take into account that in the original code, driver_data of 0 indicates a card with no special flags, not a card that should not have any card info structure. This introduced a null pointer dereference when cards with no flags were probed. Commit bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()") then papered over this issue by rejecting cards with no driver_data instead of resolving the problem at its source. Fix the original issue by introducing a new card info structure for 2.5Mbit cards that does not set any flags and using it if no driver_data is present. Fixes: 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata") Fixes: bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()") Cc: stable@vger.kernel.org Reviewed-by: Simon Horman Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260213045510.32368-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni commit da29e453dcb3aa7cabead7915f5f945d0add3a52 Author: Allison Henderson Date: Thu Feb 12 20:54:09 2026 -0700 net/rds: rds_sendmsg should not discard payload_len Commit 3db6e0d172c9 ("rds: use RCU to synchronize work-enqueue with connection teardown") modifies rds_sendmsg to avoid enqueueing work while a tear down is in progress. However, it also changed the return value of rds_sendmsg to that of rds_send_xmit instead of the payload_len. This means the user may incorrectly receive errno values when it should have simply received a payload of 0 while the peer attempts a reconnections. So this patch corrects the teardown handling code to only use the out error path in that case, thus restoring the original payload_len return value. Fixes: 3db6e0d172c9 ("rds: use RCU to synchronize work-enqueue with connection teardown") Reviewed-by: Simon Horman Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260213035409.1963391-1-achender@kernel.org Signed-off-by: Paolo Abeni commit 6d1dc8014334c7fb25719999bca84d811e60a559 Author: Ziyi Guo Date: Thu Feb 12 22:40:40 2026 +0000 xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added. Fixes: 8d3d53b3e433 ("xen-netback: Add support for multiple queues") Signed-off-by: Ziyi Guo Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20260212224040.86674-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni commit 9e7021d2aeae57c323a6f722ed7915686cdcc123 Author: Ziyi Guo Date: Thu Feb 12 21:41:54 2026 +0000 net: usb: catc: enable basic endpoint checking catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX - usb_rcvintpipe(usbdev, 2) for interrupt status A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a catc_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time. Similar to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") which fixed the issue in rtl8150. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Simon Horman Signed-off-by: Ziyi Guo Link: https://patch.msgid.link/20260212214154.3609844-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni commit 7bc0df86c2384bc1e2012a2c946f82305054da64 Author: Takashi Iwai Date: Tue Feb 17 11:44:11 2026 +0100 ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 Acer Swift SF314 (SSID 1025:136d) needs a bit of tweaks of the pin configurations for NID 0x16 and 0x19 to make the headphone / headset jack working. NID 0x17 can remain as is for the working speaker, and the built-in mic is supported via SOF. Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=221086 Link: https://patch.msgid.link/20260217104414.62911-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 94560267d6c41b1ff3fafbab726e3f8a55a6af34 Author: Antonio Quartulli Date: Thu Feb 12 22:31:19 2026 +0100 ovpn: tcp - don't deref NULL sk_socket member after tcp_close() When deleting a peer in case of keepalive expiration, the peer is removed from the OpenVPN hashtable and is temporary inserted in a "release list" for further processing. This happens in: ovpn_peer_keepalive_work() unlock_ovpn(release_list) This processing includes detaching from the socket being used to talk to this peer, by restoring its original proto and socket ops/callbacks. In case of TCP it may happen that, while the peer is sitting in the release list, userspace decides to close the socket. This will result in a concurrent execution of: tcp_close(sk) __tcp_close(sk) sock_orphan(sk) sk_set_socket(sk, NULL) The last function call will set sk->sk_socket to NULL. When the releasing routine is resumed, ovpn_tcp_socket_detach() will attempt to dereference sk->sk_socket to restore its original ops member. This operation will crash due to sk->sk_socket being NULL. Fix this race condition by testing-and-accessing sk->sk_socket atomically under sk->sk_callback_lock. Link: https://lore.kernel.org/netdev/176996279620.3109699.15382994681575380467@eldamar.lan/ Link: https://github.com/OpenVPN/ovpn-net-next/issues/29 Signed-off-by: Antonio Quartulli Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Link: https://patch.msgid.link/20260212213130.11497-1-antonio@openvpn.net Signed-off-by: Paolo Abeni commit e74ff27fc63b931ff6fbc37aa8bc8539b00d86b6 Merge: 22069735ff6db9 b660b13d4c6379 Author: Paolo Abeni Date: Tue Feb 17 11:15:54 2026 +0100 Merge tag 'ovpn-net-20260212' of https://github.com/OpenVPN/ovpn-net-next Antonio Quartulli says: ==================== This batch includes the following fixes: * set sk_user_data before installing callbacks, to avoid dropping early packets * fix use-after-free in ovpn_net_xmit when accessing shared skbs that got released * fix TX bytes stats by adding-up every positively processed GSO segment ==================== Link: https://patch.msgid.link/20260212210340.11260-1-antonio@openvpn.net Signed-off-by: Paolo Abeni commit f0617176be5e497b67b3c87bac35b26ebccac499 Author: Krzysztof Kozlowski Date: Mon Feb 16 12:04:50 2026 +0100 irqchip/mmp: Make icu_irq_chip variable static const File-scope 'icu_irq_chip' is not used outside of this unit and is not modified anywhere, so make it static const to silence sparse warning: irq-mmp.c:139:17: warning: symbol 'icu_irq_chip' was not declared. Should it be static? Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260216110449.160277-2-krzysztof.kozlowski@oss.qualcomm.com commit ce9e40a9a5e5cff0b1b0d2fa582b3d71a8ce68e8 Author: Marc Zyngier Date: Fri Feb 6 15:48:16 2026 +0000 irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports The ITS driver blindly assumes that EventIDs are in abundant supply, to the point where it never checks how many the hardware actually supports. It turns out that some pretty esoteric integrations make it so that only a few bits are available, all the way down to a single bit. Enforce the advertised limitation at the point of allocating the device structure, and hope that the endpoint driver can deal with such limitation. Fixes: 84a6a2e7fc18d ("irqchip: GICv3: ITS: device allocation and configuration") Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Reviewed-by: Robin Murphy Reviewed-by: Zenghui Yu Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260206154816.3582887-1-maz@kernel.org commit 1072020685f4b81f6efad3b412cdae0bd62bb043 Author: Nam Cao Date: Thu Feb 12 12:41:25 2026 +0100 irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLIC ignores interrupt completion message for disabled interrupt, explained by the specification: The PLIC signals it has completed executing an interrupt handler by writing the interrupt ID it received from the claim to the claim/complete register. The PLIC does not check whether the completion ID is the same as the last claim ID for that target. If the completion ID does not match an interrupt source that is currently enabled for the target, the completion is silently ignored. This caused problems in the past, because an interrupt can be disabled while still being handled and plic_irq_eoi() had no effect. That was fixed by checking if the interrupt is disabled, and if so enable it, before sending the completion message. That check is done with irqd_irq_disabled(). However, that is not sufficient because the enable bit for the handling hart can be zero despite irqd_irq_disabled(d) being false. This can happen when affinity setting is changed while a hart is still handling the interrupt. This problem is easily reproducible by dumping a large file to uart (which generates lots of interrupts) and at the same time keep changing the uart interrupt's affinity setting. The uart port becomes frozen almost instantaneously. Fix this by checking PLIC's enable bit instead of irqd_irq_disabled(). Fixes: cc9f04f9a84f ("irqchip/sifive-plic: Implement irq_set_affinity() for SMP host") Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260212114125.3148067-1-namcao@linutronix.de commit 22069735ff6db9ee4c6ceb6a29e858e86c6099da Merge: ee5492fd88cfc0 e7a3c1adc127f9 Author: Paolo Abeni Date: Tue Feb 17 10:42:22 2026 +0100 Merge branch 'eth-fbnic-fix-and-improve-header-data-split-configuration' Bobby Eshleman says: ==================== eth: fbnic: fix and improve header/data split configuration This series fixes TCP HDS configuration in the fbnic driver and adds a devmem selftest for the intended behavior. The issues fixed include setting the correct CSR for EN_HDR_SPLIT, adjusting the hds threshold clamp to avoid long headers overflowing into the payload page, and configuring the device to use L4/L3/L2 header boundaries when present by programming the DMA hint bit unconditionally for all steering rule types. Prior to these fixes, small payloads fail devmem.check_rx_hds(). Testing: IFC0=enp1s0 IFC1=eth0 export REMOTE_TYPE=netns export REMOTE_ARGS=ns-remote export NETIF=$IFC0 export LOCAL_V4=192.0.3.1 export REMOTE_V4=192.0.3.2 sysctl -w net.ipv6.conf.$IFC0.keep_addr_on_down=1 ./tools/testing/selftests/drivers/net/hw/devmem.py TAP version 13 1..4 ok 1 devmem.check_rx ok 2 devmem.check_tx ok 3 devmem.check_tx_chunks ok 4 devmem.check_rx_hds To: Alexander Duyck To: Jakub Kicinski To: kernel-team@meta.com To: Andrew Lunn To: David S. Miller To: Eric Dumazet To: Paolo Abeni To: Mohsin Bashir To: Shuah Khan Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-kselftest@vger.kernel.org Signed-off-by: Bobby Eshleman ==================== Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-0-55d050e6f606@meta.com Signed-off-by: Paolo Abeni commit e7a3c1adc127f9f91a35169d34f7471d417d72a6 Author: Bobby Eshleman Date: Wed Feb 11 17:00:44 2026 -0800 selftests: drv-net: add HDS payload sweep test for devmem TCP Add check_rx_hds test that verifies header/data split works across payload sizes. The test sweeps payload sizes from 1 byte to 8KB, if any data propagates up to userspace as SCM_DEVMEM_LINEAR, then the test fails. This shows that regardless of payload size, ncdevmem's configuration of hds-thresh to 0 is respected. Add -L (--fail-on-linear) flag to ncdevmem that causes the receiver to fail if any SCM_DEVMEM_LINEAR cmsg is received. Use socat option for fixed block sizing and tcp nodelay to disable nagle's algo to avoid buffering. Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-4-55d050e6f606@meta.com Signed-off-by: Paolo Abeni commit 0f30a31b55c4179fc55613a75ef41d496687d465 Author: Bobby Eshleman Date: Wed Feb 11 17:00:43 2026 -0800 eth: fbnic: set DMA_HINT_L4 for all flows fbnic always advertises ETHTOOL_TCP_DATA_SPLIT_ENABLED via ethtool .get_ringparam. To enable proper splitting for all flow types, even for IP/Ethernet flows, this patch sets DMA_HINT_L4 unconditionally for all RSS and NFC flow steering rules. According to the spec, L4 falls back to L3 if no valid L4 is found, and L3 falls back to L2 if no L3 is found. This makes sure that the correct header boundary is used regardless of traffic type. This is important for zero-copy use cases where we must ensure that all ZC packets are split correctly. Fixes: 2b30fc01a6c7 ("eth: fbnic: Add support for HDS configuration") Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-3-55d050e6f606@meta.com Signed-off-by: Paolo Abeni commit bd254115f38db3c046332bb62e8719e0dc7c2b53 Author: Bobby Eshleman Date: Wed Feb 11 17:00:42 2026 -0800 eth: fbnic: increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes Increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes. The previous minimum was too small to guarantee that very long L2+L3+L4 headers always fit within the header buffer. When EN_HDR_SPLIT is disabled and a packet exceeds MAX_HEADER_BYTES, splitting occurs at that byte offset instead of the header boundary, resulting in some of the header landing in the payload page. The increased minimum ensures headers always fit with the MAX_HEADER_BYTES cut off and land in the header page. Fixes: 2b30fc01a6c7 ("eth: fbnic: Add support for HDS configuration") Signed-off-by: Bobby Eshleman Acked-by: Mohsin Bashir Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-2-55d050e6f606@meta.com Signed-off-by: Paolo Abeni commit bbeb3bfbffe0279fa47c041658b037fb38a93965 Author: Bobby Eshleman Date: Wed Feb 11 17:00:41 2026 -0800 eth: fbnic: set FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT on RDE_CTL0 Fix EN_HDR_SPLIT configuration by writing the field to RDE_CTL0 instead of RDE_CTL1. Because drop mode configuration and header splitting enablement both use RDE_CTL0, we consolidate these configurations into the single function fbnic_config_drop_mode. Fixes: 2b30fc01a6c7 ("eth: fbnic: Add support for HDS configuration") Signed-off-by: Bobby Eshleman Acked-by: Mohsin Bashir Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-1-55d050e6f606@meta.com Signed-off-by: Paolo Abeni commit 46120745bb4e7e1f09959624716b4c5d6e2c2e9e Author: Ethan Tidmore Date: Sun Feb 15 22:04:38 2026 -0600 drm/tiny: sharp-memory: fix pointer error dereference The function devm_drm_dev_alloc() returns a pointer error upon failure not NULL. Change null check to pointer error check. Detected by Smatch: drivers/gpu/drm/tiny/sharp-memory.c:549 sharp_memory_probe() error: 'smd' dereferencing possible ERR_PTR() Fixes: b8f9f21716fec ("drm/tiny: Add driver for Sharp Memory LCD") Signed-off-by: Ethan Tidmore Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260216040438.43702-1-ethantidmore06@gmail.com commit 07676846132340c7d0f50eca189a24cea4ae3cd8 Author: David Carlier Date: Sat Feb 14 08:00:33 2026 +0000 tools/sched_ext: scx_userland: fix stale data on restart Reset all counters, tasks and vruntime_head list on restart. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit cabd76bbc03617e55c25f0b06167aa5e0b911a36 Author: David Carlier Date: Sat Feb 14 07:32:05 2026 +0000 tools/sched_ext: scx_flatcg: fix potential stack overflow from VLA in fcg_read_stats fcg_read_stats() had a VLA allocating 21 * nr_cpus * 8 bytes on the stack, risking stack overflow on large CPU counts (nr_cpus can be up to 512). Fix by using a single heap allocation with the correct size, reusing it across all stat indices, and freeing it at the end. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit f94711255a73d8938cf3bb405a0af3a4d2700ed1 Author: Nathan Chancellor Date: Mon Feb 16 16:29:54 2026 -0700 kbuild: rpm-pkg: Disable automatic requires for manual debuginfo package Stefano reports that after commit 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually"), building with an rpm package using rpm 4.20.0 fails with: RPM build errors: Dependency tokens must begin with alpha-numeric, '_' or '/': #�) = 0x0d000002 Dependency tokens must begin with alpha-numeric, '_' or '/': �) = 0x0d000000 Dependency tokens must begin with alpha-numeric, '_' or '/': ) = 0x7c0e000000 Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000 Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800 Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000 Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800 This error comes from the automatic requirements feature of rpm. The -debuginfo subpackage has no dependencies, so disable this feature with 'AutoReq: 0' for this subpackage, avoiding the error. This matches the official %_debug_template macro that rpm provides. While automatic provides should be default enabled, be explicit like %_debug_template does. Additionally, while in the area, add the manual debug information package to the Development/Debug group, further aligning with %_debug_template. Cc: stable@vger.kernel.org Fixes: 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") Reported-by: Stefano Garzarella Closes: https://lore.kernel.org/CAGxU2F7FFNgb781_A7a1oL63n9Oy8wsyWceKhUpeZ6mLk=focw@mail.gmail.com/ Tested-by: Stefano Garzarella Link: https://patch.msgid.link/20260216-improve-manual-debuginfo-template-v1-1-e584b3f8d3be@kernel.org Signed-off-by: Nathan Chancellor commit be3573124e630736d2d39650b12f5ef220b47ac1 Author: Jens Axboe Date: Tue Feb 10 10:00:44 2026 -0700 io_uring/bpf_filter: pass in expected filter payload size It's quite possible that opcodes that have payloads attached to them, like IORING_OP_OPENAT/OPENAT2 or IORING_OP_SOCKET, that these paylods can change over time. For example, on the openat/openat2 side, the struct open_how argument is extensible, and could be extended in the future to allow further arguments to be passed in. Allow registration of a cBPF filter to give the size of the filter as seen by userspace. If that filter is for an opcode that takes extra payload data, allow it if the application payload expectation is the same size than the kernels. If that is the case, the kernel supports filtering on the payload that the application expects. If the size differs, the behavior depends on the IO_URING_BPF_FILTER_SZ_STRICT flag: 1) If IO_URING_BPF_FILTER_SZ_STRICT is set and the size expectation differs, fail the attempt to load the filter. 2) If IO_URING_BPF_FILTER_SZ_STRICT isn't set, allow the filter if the userspace pdu size is smaller than what the kernel offers. 3) Regardless if IO_URING_BPF_FILTER_SZ_STRICT, fail loading the filter if the userspace pdu size is bigger than what the kernel supports. An attempt to load a filter due to sizing will error with -EMSGSIZE. For that error, the registration struct will have filter->pdu_size populated with the pdu size that the kernel uses. Reported-by: Christian Brauner Signed-off-by: Jens Axboe commit d21c362182aff7b4d994e35ceb04b6ed2da141d9 Author: Jens Axboe Date: Tue Feb 10 09:29:59 2026 -0700 io_uring/bpf_filter: move filter size and populate helper into struct Rather than open-code this logic in io_uring_populate_bpf_ctx() with a switch, move it to the issue side definitions. Outside of making this easier to extend in the future, it's also a prep patch for using the pdu size for a given opcode filter elsewhere. Signed-off-by: Jens Axboe commit 9478c166c46934160135e197b049b5a05753f2ad Author: Dave Airlie Date: Thu Nov 21 11:46:01 2024 +1000 nouveau/gsp: drop WARN_ON in ACPI probes These WARN_ONs seem to trigger a lot, and we don't seem to have a plan to fix them, so just drop them, as they are most likely harmless. Cc: stable@vger.kernel.org Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20241121014601.229391-1-airlied@gmail.com Signed-off-by: Danilo Krummrich commit 9702969978695d9a699a1f34771580cdbb153b33 Merge: 45a43ac5acc90b 27125df9a5d3b4 Author: Linus Torvalds Date: Mon Feb 16 13:41:38 2026 -0800 Merge tag 'slab-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull more slab updates from Vlastimil Babka: - Two stable fixes for kmalloc_nolock() usage from NMI context (Harry Yoo) - Allow kmalloc_nolock() allocations to be freed with kfree() and thus also kfree_rcu() and simplify slabobj_ext handling - we no longer need to track how it was allocated to use the matching freeing function (Harry Yoo) * tag 'slab-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: drop the OBJEXTS_NOSPIN_ALLOC flag from enum objext_flags mm/slab: allow freeing kmalloc_nolock()'d objects using kfree[_rcu]() mm/slab: use prandom if !allow_spin mm/slab: do not access current->mems_allowed_seq if !allow_spin commit 22dbb0987bd1e0ec3b1e4ad20756a98f99aa4a08 Author: Jens Axboe Date: Mon Feb 16 14:16:27 2026 -0700 io_uring/cancel: de-unionize file and user_data in struct io_cancel_data By having them share the same space in struct io_cancel_data, it ends up disallowing IORING_ASYNC_CANCEL_FD|IORING_ASYNC_CANCEL_USERDATA from working. Eg you cannot match on both a file and user_data for cancelation purposes. This obviously isn't a common use case as nobody has reported this, but it does result in -ENOENT potentially being returned when trying to match on both, rather than actually doing what the API says it would. Fixes: 4bf94615b888 ("io_uring: allow IORING_OP_ASYNC_CANCEL with 'fd' key") Signed-off-by: Jens Axboe commit 45a43ac5acc90b8f4835eea92692f620e561a06b Merge: 543b9b63394ee6 dedfae78f00960 Author: Linus Torvalds Date: Mon Feb 16 13:00:36 2026 -0800 Merge tag 'vfs-7.0-rc1.misc.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull more misc vfs updates from Christian Brauner: "Features: - Optimize close_range() from O(range size) to O(active FDs) by using find_next_bit() on the open_fds bitmap instead of linearly scanning the entire requested range. This is a significant improvement for large-range close operations on sparse file descriptor tables. - Add FS_XFLAG_VERITY file attribute for fs-verity files, retrievable via FS_IOC_FSGETXATTR and file_getattr(). The flag is read-only. Add tracepoints for fs-verity enable and verify operations, replacing the previously removed debug printk's. - Prevent nfsd from exporting special kernel filesystems like pidfs and nsfs. These filesystems have custom ->open() and ->permission() export methods that are designed for open_by_handle_at(2) only and are incompatible with nfsd. Update the exportfs documentation accordingly. Fixes: - Fix KMSAN uninit-value in ovl_fill_real() where strcmp() was used on a non-null-terminated decrypted directory entry name from fscrypt. This triggered on encrypted lower layers when the decrypted name buffer contained uninitialized tail data. The fix also adds VFS-level name_is_dot(), name_is_dotdot(), and name_is_dot_dotdot() helpers, replacing various open-coded "." and ".." checks across the tree. - Fix read-only fsflags not being reset together with xflags in vfs_fileattr_set(). Currently harmless since no read-only xflags overlap with flags, but this would cause inconsistencies for any future shared read-only flag - Return -EREMOTE instead of -ESRCH from PIDFD_GET_INFO when the target process is in a different pid namespace. This lets userspace distinguish "process exited" from "process in another namespace", matching glibc's pidfd_getpid() behavior Cleanups: - Use C-string literals in the Rust seq_file bindings, replacing the kernel::c_str!() macro (available since Rust 1.77) - Fix typo in d_walk_ret enum comment, add porting notes for the readlink_copy() calling convention change" * tag 'vfs-7.0-rc1.misc.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: add porting notes about readlink_copy() pidfs: return -EREMOTE when PIDFD_GET_INFO is called on another ns nfsd: do not allow exporting of special kernel filesystems exportfs: clarify the documentation of open()/permission() expotrfs ops fsverity: add tracepoints fs: add FS_XFLAG_VERITY for fs-verity files rust: seq_file: replace `kernel::c_str!` with C-Strings fs: dcache: fix typo in enum d_walk_ret comment ovl: use name_is_dot* helpers in readdir code fs: add helpers name_is_dot{,dot,_dotdot} ovl: Fix uninit-value in ovl_fill_real fs: reset read-only fsflags together with xflags fs/file: optimize close_range() complexity from O(N) to O(Sparse) commit 543b9b63394ee67ecf5298fe42cbe65b21a16eac Merge: 57d76ceccee4b4 3673dd3c7dc1f3 Author: Linus Torvalds Date: Mon Feb 16 12:37:13 2026 -0800 Merge tag 'kernel-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pidfs updates from Christian Brauner: - pid: introduce task_ppid_vnr() helper - pidfs: convert rb-tree to rhashtable Mateusz reported performance penalties during task creation because pidfs uses pidmap_lock to add elements into the rbtree. Switch to an rhashtable to have separate fine-grained locking and to decouple from pidmap_lock moving all heavy manipulations outside of it Also move inode allocation outside of pidmap_lock. With this there's nothing happening for pidfs under pidmap_lock - pid: reorder fields in pid_namespace to reduce false sharing - Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers" - ipc: Add SPDX license id to mqueue.c * tag 'kernel-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pid: introduce task_ppid_vnr() helper pidfs: implement ino allocation without the pidmap lock Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers" pid: reorder fields in pid_namespace to reduce false sharing pidfs: convert rb-tree to rhashtable ipc: Add SPDX license id to mqueue.c commit 57d76ceccee4b497eb835831206b50e72915a501 Merge: 2228d9cf7a562d 450517fa5aae98 Author: Linus Torvalds Date: Mon Feb 16 12:21:22 2026 -0800 Merge tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - iTCO: Drop vendor support - s3c2410_wdt: Drop S3C2410 support - Convert mpc8xxx-wdt to YAML - Several small fixes and improvements * tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog: dt-bindings: watchdog: qcom-wdt: Document Glymur watchdog dt-bindings: watchdog: Convert mpc8xxx-wdt to YAML dt-bindings: watchdog: samsung-wdt: Split if:then: and constrain more dt-bindings: watchdog: samsung-wdt: Drop S3C2410 watchdog: s3c2410_wdt: Drop S3C2410 support dt-bindings: watchdog: samsung-wdt: Define cluster constraints top-level watchdog: rzv2h_wdt: Discard pm_runtime_put() return value watchdog: rz: Discard pm_runtime_put() return values watchdog: Make API functions const correct watchdog: imx7ulp_wdt: handle the nowayout option watchdog: sbsa: Update the W_IIDR Implementer bit mask to 0xFFF watchdog: Always return time left until watchdog times out watchdog: iTCO: Drop vendor support watchdog: starfive-wdt: Fix PM reference leak in probe error path fix it87_wdt early reboot by reporting running timer commit 2228d9cf7a562d1b0ca86bd529f6acb94f4bb80f Merge: 4bfa4a54b02029 b2c87f5e98cd88 Author: Linus Torvalds Date: Mon Feb 16 11:15:19 2026 -0800 Merge tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "New Support & Features: - Add support for the TI LP5812 4x3 matrix RGB LED driver, including autonomous animation engine control and extensive scan multiplexing modes - Add a new driver for the ams Osram AS3668 4-channel I2C LED controller - Extend the is31fl32xx driver to support the is31fl3293 variant, which features 3 channels and 12-bit PWM resolution Improvements & Fixes: - Prevent the ExpressWire KTD2801 chip from entering an undefined state by disabling interrupts during time-sensitive communication - Ensure the Qualcomm LPG driver detects hardware write failures by checking the return value of regmap_bulk_write() during LUT programming - Fix kernel-doc warnings in the lm3692x driver by documenting missing struct members and standardizing the comment style - Update the ExpressWire library to use fsleep() and unexport internal-only functions - Improve the is31fl32xx driver by reordering code to eliminate unnecessary forward declarations Cleanups & Refactoring: - Simplify the LP55XX common LED driver by utilizing the for_each_available_child_of_node_scoped() macro for more concise node iteration Device Tree Bindings Updates: - Add new YAML bindings for the TI LP5860 and LP5812 LED controllers, and the ams Osram AS3668 - Convert the TI LM3697 white LED driver binding to DT schema format - Allow multicolor LED nodes to be named with numeric suffixes (e.g., multi-led-0) to handle multiple instances without unit addresses - Document support for the PMH0101 variant in the Qualcomm LPG PWM and SPMI Flash LED bindings - Add the issi,is31fl3293 compatible string to the is31fl32xx binding" * tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: dt-bindings: leds: Convert ti,lm3697 to DT schema leds: as3668: Driver for the ams Osram 4-channel i2c LED driver dt-bindings: leds: Add new as3668 support docs: leds: Document TI LP5812 LED driver leds: Add basic support for TI/National Semiconductor LP5812 LED Driver leds: qcom-lpg: Check the return value of regmap_bulk_write() dt-bindings: leds: qcom,spmi-flash-led: Add PMH0101 compatible dt-bindings: leds: leds-qcom-lpg: Add support for PMH0101 PWM dt-bindings: leds: Allow differently named multicolor LEDs leds: lp55xx: Simplify with scoped for each OF child loop dt-bindings: leds: add TI/National Semiconductor LP5812 LED Driver leds: is31f132xx: Add support for is31fl3293 leds: is31f132xx: Re-order code to remove forward declarations dt-bindings: leds: Add issi,is31fl3293 to leds-is31fl32xx leds: expresswire: Fix chip state breakage dt-bindings: leds: Add LP5860 LED controller leds: lm3692x: Fix kernel-doc for struct lm3692x_led commit 4bfa4a54b02029b3996b9f9021f5f745c71e9064 Merge: 4668c4831fbcb9 83333aa97441ba Author: Linus Torvalds Date: Mon Feb 16 11:10:33 2026 -0800 Merge tag 'backlight-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Support & Features: - Add a new driver for the Congatec Board Controller (CGBC) backlight, providing brightness control via the board controller's PWM interface Improvements & Fixes: - Resolve build failures in the Awinic AW99706 driver by switching to the correct GPIO consumer header - Extend the Qualcomm WLED driver to support the specific over-voltage protection (OVP) values required for the PMI8994 and PMI8950 variants Device Tree Bindings Updates: - Document the device-specific over-voltage protection (OVP) millivolt ranges and default values for Qualcomm PMI8994 and PMI8950 WLED controllers" * tag 'backlight-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: qcom-wled: Change PM8950 WLED configurations dt-bindings: backlight: qcom-wled: Document ovp values for PMI8950 backlight: qcom-wled: Support ovp values for PMI8994 dt-bindings: backlight: qcom-wled: Document ovp values for PMI8994 backlight: aw99706: Fix build errors caused by wrong gpio header backlight: Add Congatec Board Controller (CGBC) backlight support commit 4668c4831fbcb924ef9ce63b32f8a4daefd3d6fc Merge: 46a1daac56b3bf 845776177cf3b7 Author: Linus Torvalds Date: Mon Feb 16 11:05:44 2026 -0800 Merge tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Support & Features: - Add comprehensive support for the ROHM BD72720 PMIC, including core MFD, regulator, GPIO, clock gate, RTC, and power-supply drivers - Add support for the Rockchip RK801 PMIC, including core MFD and regulator drivers - Add support for the ROHM BD73900 PMIC by leveraging existing common drivers - Wire up RTC, hwmon, and input sub-devices for the Apple SMC (macsmc) driver - Add support for the Delta Networks TN48M switch CPLD via the simple-mfd-i2c driver - Add support for the TS133 variant to the QNAP MCU driver - Provide support for the sama7d65 XLCD controller in the Atmel HLCDC driver - Add backlight sub-device support to the Congatec Board Controller (cgbc) - Add Intel Nova Lake-S (NVL-S) PCI IDs to the Intel LPSS driver Improvements & Fixes: - Implement a "wrapper regmap" for the ROHM BD72720 to handle dual I2C slave addresses (0x4b and 0x4c) transparently for child devices - Introduce mutex locking around 'mfd_of_node_list' in the MFD core to ensure safe concurrent access - Fix a potential regulator resource leak in the Arizona core driver during boot sequence failures - Resolve child device duplication issues on driver rebind for Qualcomm PM8xxx and OMAP USB host drivers by using of_platform_depopulate() - Fix IRQ domain name duplication for the Samsung S2MPG10 by adding a unique domain suffix - Implement LOCK register handling for the TI TPS65214 variant to unlock registers at probe time - Fully convert the Loongson-2K BMC driver to use managed resources (pcim) and the standard PCI resource API - Ensure the Apple SMC mutex is correctly initialized during probe to prevent NULL pointer dereferences - Expand the ROHM BD71828 power-supply driver to support 9-bit register addresses - Simplify the Samsung S5M RTC driver by querying platform device IRQ resources directly - Revert an incorrect read-to-write mask change in the DA9052 SPI driver to restore default OTP behavior - Fix kernel-doc warnings in the TI TPS6105x driver - Cleanups & Refactoring - Simplify the MFD core by utilizing the scoped for_each_child_of_node_scoped() macro and streamlining device_node storage - Rename ROHM BD71828 IC-specific entities to use consistent prefixes for better extensibility - Refactor ROHM BD71828 regmap definitions using the regmap_reg_range() macro - Update the ROHM BD71828 driver to use standard C-style comment headers - Remove the now unused 'irq_data' field from the Samsung SEC core structure - Drop unnecessary use of irqd_get_trigger_type() in the Maxim MAX77759 driver - Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT is selected - Add missing charger-related registers to the ROHM BD71828 core header and Type-C CC registers to the AXP717 Device Tree Binding Updates: - Add new bindings for the ROHM BD72720 PMIC, Rockchip RK801 PMIC, Bitmain BM1880 System Controller, and NXP LPC32xx System Control Block - Clarify trickle-charge terminology and add properties for voltage drop (VDR) correction and upper charge limits to the generic battery binding - Document GPR syscon for NXP S32 SoCs and the smp-memram subnode for Aspeed SCU - Document numerous new Qualcomm SPMI PMIC compatibles (pmcx0102, pmh0101, pmk8850, etc) - Add compatibles for the sama7d65 XLCD (Atmel), LAN9691 Flexcom (Microchip), and various MediaTek SCPSYS and regulator components - Fix a dead link to the audio codec binding in the DA9055 documentation" * tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (41 commits) dt-bindings: mfd: da9055: Fix dead link to codec binding mfd: cgbc: Add support for backlight dt-bindings: mfd: qcom,spmi-pmic: Document PMICs present on Glymur and Kaanapali dt-bindings: mfd: Document smp-memram subnode for aspeed,ast2x00-scu mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs mfd: ls2kbmc: Use PCI API instead of direct accesses mfd: ls2kbmc: Fully convert to use managed resources dt-bindings: mfd: mediatek: mt6397: Add missing MT6331 regulator compat dt-bindings: mfd: mediatek,mt8195-scpsys: Add mediatek,mt6795-scpsys dt-bindings: mfd: atmel,sama5d2-flexcom: Add microchip,lan9691-flexcom mfd: omap-usb-host: Fix OF populate on driver rebind mfd: qcom-pm8xxx: Fix OF populate on driver rebind dt-bindings: mfd: syscon: Allow syscon compatible for mediatek,mt7981-topmisc mfd: qnap-mcu: Add driver data for TS133 variant dt-bindings: mfd: qnap,ts433-mcu: Add qnap,ts133-mcu compatible mfd: sec: Fix IRQ domain names duplication mfd: simple-mfd-i2c: Add Delta TN48M CPLD support mfd: macsmc: Initialize mutex dt-bindings: mfd: nxp: Add NXP LPC32xx System Control Block mfd: Kconfig: Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT ... commit dfe48ea179733be948c432f6af2fc3913cf5dd28 Author: Yu Kuai Date: Sat Feb 14 13:43:50 2026 +0800 blk-mq: use NOIO context to prevent deadlock during debugfs creation Creating debugfs entries can trigger fs reclaim, which can enter back into the block layer request_queue. This can cause deadlock if the queue is frozen. Previously, a WARN_ON_ONCE check was used in debugfs_create_files() to detect this condition, but it was racy since the queue can be frozen from another context at any time. Introduce blk_debugfs_lock()/blk_debugfs_unlock() helpers that combine the debugfs_mutex with memalloc_noio_save()/restore() to prevent fs reclaim from triggering block I/O. Also add blk_debugfs_lock_nomemsave() and blk_debugfs_unlock_nomemrestore() variants for callers that don't need NOIO protection (e.g., debugfs removal or read-only operations). Replace all raw debugfs_mutex lock/unlock pairs with these helpers, using the _nomemsave/_nomemrestore variants where appropriate. Reported-by: Yi Zhang Closes: https://lore.kernel.org/all/CAHj4cs9gNKEYAPagD9JADfO5UH+OiCr4P7OO2wjpfOYeM-RV=A@mail.gmail.com/ Reported-by: Shinichiro Kawasaki Closes: https://lore.kernel.org/all/aYWQR7CtYdk3K39g@shinmob/ Suggested-by: Christoph Hellwig Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 46a1daac56b3bf1bdbd8b37e6db811f015bc1f4b Merge: 6086f349a30232 9c5a40f2922a5a Author: Linus Torvalds Date: Mon Feb 16 09:35:24 2026 -0800 Merge tag 'pinctrl-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Core changes: - Drop the unused devm_pinctrl_unregister() function - Move pretended generic pin control functionality out of the core and into the Amlogic AM4 driver. We have something better coming (hopefully) New hardware support: - Spacemit K3 (RISC-V) pin control support - Atmel AT91 PIO4 (ARM32) SAMA7D65 pin control support - Exynos9610 (ARM64) pin control support - Qualcomm Mahua TLMM (ARM64) pin control support - Microchip Polarfire MSSIO (RISC-V) pin control support - Ocelot LAN9645XF (multiplatform) pin control support Improvements: - Using a few more guards for locking - Various nonurgent fixes and tweaks" * tag 'pinctrl-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (73 commits) pinctrl: generic: move function to amlogic-am4 driver pinctrl: intel: Align Copyright note with corporate guidelines pinctrl: mediatek: remove unused drv_offset field pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree pinctrl: single: fix refcount leak in pcs_add_gpio_func() pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpers pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition pinctrl: core: Remove duplicate error messages pinctrl: core: Simplify devm_pinctrl_*() pinctrl: core: Remove unused devm_pinctrl_unregister() dt-bindings: pinctrl: spacemit: fix drive-strength check warning pinctrl: fix kismet issues with GENERIC_PINCTRL pinctrl: tangier: Join tng_pinctrl_probe() into its wrapper pinctrl: tangier: Remove duplicate error messages pinctrl: lynxpoint: Remove duplicate error messages pinctrl: cherryview: Remove duplicate error messages pinctrl: baytrail: Remove duplicate error messages pinctrl: intel: Remove duplicate error messages pinctrl: equilibrium: Fix device node reference leak in pinbank_init() dt-bindings: pinctrl: pinctrl-microchip-sgpio: add LAN969x ... commit 6086f349a30232f3119ec647356cd191087b1333 Merge: 2d10a488717e1b 720452a6d0fdc9 Author: Linus Torvalds Date: Mon Feb 16 09:30:44 2026 -0800 Merge tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: "Cleanups and fixes" * tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (28 commits) Revert "clk: microchip: core: allow driver to be compiled with COMPILE_TEST" Revert "clk: microchip: fix typo in reference to a config option" MIPS: Implement ARCH_HAS_CC_CAN_LINK MIPS: rb532: Fix MMIO UART resource registration MIPS: Work around LLVM bug when gp is used as global register variable MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI MIPS: Loongson2ef: Use pcibios_align_resource() to block io range MIPS: Loongson2ef: Register PCI controller in early stage clk: microchip: fix typo in reference to a config option MIPS: Loongson64: dts: fix phy-related definition of LS7A GMAC clk: microchip: core: allow driver to be compiled with COMPILE_TEST MIPS: drop unused pic32.h header watchdog: pic32-wdt: update include to use pic32.h from platform_data watchdog: pic32-dmt: update include to use pic32.h from platform_data serial: pic32_uart: update include to use pic32.h from platform_data rtc: pic32: update include to use pic32.h from platform_data pinctrl: pic32: update include to use pic32.h from platform_data mmc: sdhci-pic32: update include to use pic32.h from platform_data irqchip/irq-pic32-evic: update include to use pic32.h from platform_data clk: microchip: core: update include to use pic32.h from platform_data ... commit cd7ef20ba8c6e936dba133b4136537a8ada22976 Author: Zhai Can Date: Sun Feb 15 00:14:52 2026 +0800 ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO On the THUNDEROBOT ZERO laptop, the second NVMe slot and the discrete NVIDIA GPU are both controlled by power-resource PXP. Due to the SSDT table bug (lack of reference), PXP will be shut dow as an "unused" power resource during initialization, making the NVMe slot #2 + NVIDIA both inaccessible. This issue was introduced by commit a1224f34d72a ("ACPI: PM: Check states of power resources during initialization"). Here are test results on the three consecutive commits: (bad again!) a1224f34d72a ACPI: PM: Check states of power resources during initialization (good) bc2836859643 ACPI: PM: Do not turn off power resources in unknown state (bad) 519d81956ee2 Linux 5.15-rc6 On commit bc2836859643 ("ACPI: PM: Do not turn off power resources in unknown state") this was not an issue because the power resource state left UNKNOWN thus being ignored. See also commit 9b04d99788cf ("ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini") which is another almost identical case to this one. Fixes: a1224f34d72a ("ACPI: PM: Check states of power resources during initialization") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221087 Signed-off-by: Zhai Can Link: https://patch.msgid.link/20260214161452.2849346-1-bczhc0@126.com Signed-off-by: Rafael J. Wysocki commit 3678a334a55e869b413e2fb4824e92200b149d73 Author: Randy Dunlap Date: Sun Feb 15 21:29:51 2026 -0800 blk-stat: convert struct blk_stat_callback to kernel-doc Most of struct blk_stat_callback documentation is already in kernel-doc format. Convert the remaining struct members to kernel-doc to avoid kernel-doc warnings: Warning: block/blk-stat.h:62 struct member 'list' not described in 'blk_stat_callback' Warning: block/blk-stat.h:62 struct member 'timer_fn' not described in 'blk_stat_callback' Warning: block/blk-stat.h:62 struct member 'rcu' not described in 'blk_stat_callback' Warning: block/blk-stat.h:133 No description found for return value of 'blk_stat_is_active' Signed-off-by: Randy Dunlap Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit 4c431a76a288ce958aaa114d8ea6fc0968942832 Author: Randy Dunlap Date: Sun Feb 15 21:29:41 2026 -0800 block: fix enum descriptions kernel-doc Fix all kernel-doc warnings in blk_types.h: Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_READ' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_FLUSH' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DISCARD' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_SECURE_ERASE' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_APPEND' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE_ZEROES' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_OPEN' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_CLOSE' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_FINISH' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET_ALL' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_IN' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_OUT' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_LAST' not described in enum 'req_op' Signed-off-by: Randy Dunlap Signed-off-by: Jens Axboe commit 09ad01a530bb6ad260bda4fa56bab84619d90968 Author: André Draszik Date: Tue Feb 10 17:23:51 2026 +0000 regulator: s2mps11: fix pctrlsel macro usage in s2mpg10_of_parse_cb() Commit 979dd8da76eb ("regulator: s2mps11: add S2MPG11 regulator") incorrectly ended up using macros for S2MPG10 in the S2MPG11 case. They happen to end up giving the same result, but for clarity, the correct macros should be used. No functional change. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260210-s2mpg1x-regulators-fixes-v2-2-ab3d3457f1ae@linaro.org Signed-off-by: Mark Brown commit 5a1256acaa856e6770d74dd786b1b12548969c28 Author: André Draszik Date: Tue Feb 10 17:23:50 2026 +0000 regulator: s2mps11: drop redundant sanity checks in s2mpg10_of_parse_cb() The sanity checks being removed in this commit are useless as earlier code already checks for all conditions, including all error cases like out-of-bounds conditions. In other words, the code being removed here has no effect, as any potential error it could catch will already have been caught by earlier code. The checks removed here are also incomplete (as they're off-by-one) - they should have been checking >= ARRAY_SIZE() to be complete. Simply remove this redundant and incorrect code. No functional change. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aYmsu8qREppwBESH@stanley.mountain/ Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://patch.msgid.link/20260210-s2mpg1x-regulators-fixes-v2-1-ab3d3457f1ae@linaro.org Signed-off-by: Mark Brown commit 957e5be2e1ff10d4b5e86d420c12580897069114 Author: Luca Weiss Date: Wed Feb 11 12:30:10 2026 +0100 ASoC: qcom: sm8250: Add quinary MI2S support Add support for the QUINARY_MI2S_RX which is used on some devices to send audio data to speaker amplifiers. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260211-snd-sm8250-quinary-mi2s-v1-1-f62e49d85af8@fairphone.com Signed-off-by: Mark Brown commit ff9cadd1a2c0b2665b7377ac79540d66f212e7e3 Author: Gustavo Salvini Date: Tue Feb 10 12:51:56 2026 -0300 ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR The ASUS Vivobook Pro 15X (M6501RR) with AMD Ryzen 9 6900HX has an internal DMIC that is not detected without a DMI quirk entry, as the BIOS does not set the AcpDmicConnected ACPI _DSD property. Adding the DMI entry enables the ACP6x DMIC machine driver to probe successfully. Cc: stable@vger.kernel.org Signed-off-by: Gustavo Salvini Link: https://patch.msgid.link/20260210155156.29079-1-guspatagonico@gmail.com Signed-off-by: Mark Brown commit 10d7c95af043b45a85dc738c3271bf760ff3577e Author: Konstantin Komarov Date: Mon Feb 16 17:10:26 2026 +0100 fs/ntfs3: add delayed-allocation (delalloc) support This patch implements delayed allocation (delalloc) in ntfs3 driver. It introduces an in-memory delayed-runlist (run_da) and the helpers to track, reserve and later convert those delayed reservations into real clusters at writeback time. The change keeps on-disk formats untouched and focuses on pagecache integration, correctness and safe interaction with fallocate, truncate, and dio/iomap paths. Key points: - add run_da (delay-allocated run tree) and bookkeeping for delayed clusters. - mark ranges as delalloc (DELALLOC_LCN) instead of immediately allocating. Actual allocation performed later (writeback / attr_set_size_ex / explicit flush paths). - direct i/o / iomap paths updated to avoid dio collisions with delalloc: dio falls back or forces allocation of delayed blocks before proceeding. - punch/collapse/truncate/fallocate check and cancel delay-alloc reservations. Sparse/compressed files handled specially. - free-space checks updated (ntfs_check_free_space) to account for reserved delalloc clusters and MFT record budgeting. - delayed allocations are committed on last writer (file release) and on explicit allocation flush paths. Tested-by: syzbot@syzkaller.appspotmail.com Reported-by: syzbot+2bd8e813c7f767aa9bb1@syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov commit 2e02f9efdbc6c73544e315b7eb85e55a59776b6f Author: Pavel Begunkov Date: Mon Feb 16 13:55:30 2026 +0000 io_uring/rsrc: improve regbuf iov validation Deduplicate io_buffer_validate() calls by moving the checks into io_sqe_buffer_register(). Now we also don't need special handling in io_buffer_validate() passing through buffer removal requests. I also was using it as a cleanup before some other changes. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 046fcc83ac1ba8747f0bcae13f5e433802735245 Author: Dylan Yudaken Date: Sun Feb 15 23:15:23 2026 +0000 io_uring: remove unneeded io_send_zc accounting zc->len and zc->buf are not actually used once you get to the retry stage. The buffer remains in kmsg->msg.msg_iter, which is setup in io_send_setup. Note: it still seems needed in io_send due to io_send_select_buffer needing it (for the len parameter). Signed-off-by: Dylan Yudaken Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 600b665b903733bd60334e86031b157cc823ee55 Author: Asbjørn Sloth Tønnesen Date: Mon Feb 16 10:27:18 2026 +0000 io_uring/cmd_net: fix too strict requirement on ioctl Attempting SOCKET_URING_OP_SETSOCKOPT on an AF_NETLINK socket resulted in an -EOPNOTSUPP, as AF_NETLINK doesn't have an ioctl in its struct proto, but only in struct proto_ops. Prior to the blamed commit, io_uring_cmd_sock() only had two cmd_op operations, both requiring ioctl, thus the check was warranted. Since then, 4 new cmd_op operations have been added, none of which depend on ioctl. This patch moves the ioctl check, so it only applies to the original operations. AFAICT, the ioctl requirement was unintentional, and it wasn't visible in the blamed patch within 3 lines of context. Cc: stable@vger.kernel.org Fixes: a5d2f99aff6b ("io_uring/cmd: Introduce SOCKET_URING_OP_GETSOCKOPT") Signed-off-by: Asbjørn Sloth Tønnesen Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 2d10a488717e1b314d332f05b5966f7c25716a11 Merge: 0f2acd3148e0ef 73c12f209462d1 Author: Linus Torvalds Date: Mon Feb 16 07:04:01 2026 -0800 Merge tag 'probes-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull kprobes updates from Masami Hiramatsu: - Use a dedicated kernel thread to optimize the kprobes instead of using workqueue thread. Since the kprobe optimizer waits a long time for synchronize_rcu_task(), it can block other workers in the same queue if it uses a workqueue. - kprobe-events: return immediately if no new probe events are specified on the kernel command line at boot time. This shortens the kernel boot time. - When a kprobe is fully removed from the kernel code, retry optimizing another kprobe which is blocked by that kprobe. * tag 'probes-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kprobes: Use dedicated kthread for kprobe optimizer tracing: kprobe-event: Return directly when trace kprobes is empty kprobes: retry blocked optprobe in do_free_cleaned_kprobes commit e98696edac6945144ece6819b0fad47192df4b2b Author: Takashi Iwai Date: Mon Feb 16 15:12:08 2026 +0100 ALSA: usb-audio: Avoid potentially repeated XRUN error messages Some XRUN-related error messages may repeat themselves, because there can be multiple pending packets. Modify notify_xrun() function to return whether it's being stopped or not, and show the error message only once when the XRUN is actually handled. Along with it, fix a typo of word package to packet in the error message. Link: https://patch.msgid.link/20260216141209.1849200-5-tiwai@suse.de Signed-off-by: Takashi Iwai commit fba2105a157fffcf19825e4eea498346738c9948 Author: Takashi Iwai Date: Mon Feb 16 15:12:07 2026 +0100 ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received packets fit with the buffer size. But when the setup in the capture stream differs from the playback stream (e.g. due to the USB core limitation of max packet size), such an inconsistency may lead to OOB writes to the buffer, resulting in a crash. For addressing it, add a sanity check of the transfer buffer size at prepare_silent_urb(), and stop the data copy if the received data overflows. Also, report back the transfer error properly from there, too. Note that this doesn't fix the root cause of the playback error itself, but this merely covers the kernel Oops. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit 36adb51ac0b19edb32ffeea3fe66b174bad25ead Author: Takashi Iwai Date: Mon Feb 16 15:12:06 2026 +0100 ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling We did manual copies over loop for the packet data update of the implicit feedback, but this can be optimized with a simple memcpy(). Along with it, change the data type of snd_usb_packet_info struct to align with other (from uint32_t to int). No functional changes but only code optimizations. Link: https://patch.msgid.link/20260216141209.1849200-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit cf044e44190234a41a788de1cdbb6c21f4a52e1e Author: Takashi Iwai Date: Mon Feb 16 15:12:05 2026 +0100 ALSA: usb-audio: Update the number of packets properly at receiving At receiving the packets from the implicit feedback source, we didn't update ctx->packets field but only the ctx->packet_size[] data. In exceptional cases, this might lead to unexpectedly superfluous data transfer (although this won't happen usually due to the nature of USB isochronous transfer). Fix it to update the field properly. Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 6af6be278e3ba2ffb6af5b796c89dfb3f5d9063e Author: Douglas Anderson Date: Sun Feb 15 12:05:55 2026 -0800 gpio: cdev: Avoid NULL dereference in linehandle_create() In linehandle_create(), there is a statement like this: retain_and_null_ptr(lh); Soon after, there is a debug printout that dereferences "lh", which will crash things. Avoid the crash by using handlereq.lines, which is the same value. Fixes: da7e394bf58f ("gpio: convert linehandle_create() to FD_PREPARE()") Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260215120555.v2.1.I77c3eb563271c21870379eefd16ebbc4e09635bb@changeid Signed-off-by: Bartosz Golaszewski commit 58433885ee99e8c96757e82ccf6d50646c4dfe09 Author: Ethan Tidmore Date: Fri Feb 13 22:45:31 2026 -0600 gpio: nomadik: Add missing IS_ERR() check The function gpio_device_get_desc() can return an error pointer and is not checked for one. Add check for error pointer. Fixes: ddeb66d2cb10f ("gpio: nomadik: don't print out global GPIO numbers in debugfs callbacks") Cc: stable@vger.kernel.org Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260214044531.43539-1-ethantidmore06@gmail.com Signed-off-by: Bartosz Golaszewski commit 0f2acd3148e0ef42bdacbd477f90e8533f96b2ac Merge: 26a4cfaff82a2d a16ac6ca46d62b Author: Linus Torvalds Date: Sun Feb 15 19:45:00 2026 -0800 Merge tag 'm68knommu-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: - defconfig cleanup - fix for legacy 68000 CPU memmove() of non-aligned pointers - replace strcpy() with strscpy() for ucsimm target * tag 'm68knommu-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: Replace deprecated strcpy with strscpy in init_ucsimm m68k: nommu: fix memmove() with differently aligned src and dest for 68000 m68k: defconfig: Clean up references to non-existing configs commit dc96f01d54cc7c785c98ee6e2b53075949ac16ed Author: Aaditya Kansal Date: Thu Feb 5 06:30:12 2026 +0530 smb: client: terminate session upon failed client required signing Currently, when smb signature verification fails, the behaviour is to log the failure without any action to terminate the session. Call cifs_reconnect() when client required signature verification fails. Otherwise, log the error without reconnecting. Signed-off-by: Aaditya Kansal Signed-off-by: Steve French commit 14f66f44646333d2bfd7ece36585874fd72f8286 Author: Shyam Prasad N Date: Sat Feb 14 15:59:13 2026 +0530 cifs: some missing initializations on replay In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of certain local variables before replay. This change makes sure that these variables get initialized after the label. Cc: stable@vger.kernel.org Reported-by: Yuchan Nam Tested-by: Yuchan Nam Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 56112578c71213a10c995a56835bddb5e9ab1ed0 Author: Pavel Begunkov Date: Sun Feb 15 22:06:52 2026 +0000 io_uring: delay sqarray static branch disablement io_key_has_sqarray static branch can be easily switched on/off by the user every time patching the kernel. That can be very disruptive as it might require heavy synchronisation across all CPUs. Use deferred static keys, which can rate-limit it by deferring, batching and potentially effectively eliminating dec+inc pairs. Fixes: 9b296c625ac1d ("io_uring: static_key for !IORING_SETUP_NO_SQARRAY") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 6b34f8edf8b807b7f87901623aa52dfa1b29ef93 Author: Pavel Begunkov Date: Sun Feb 15 21:38:09 2026 +0000 io_uring/query: add query.h copyright notice Add a copyright notice to io_uring's query uapi header. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit c29214677a9fc1a3a4ee65e189afeb5fd10d676f Author: Pavel Begunkov Date: Sun Feb 15 21:34:28 2026 +0000 io_uring/query: return support for custom rx page size Add an ability to query if the zcrx rx page size setting is available. Note, even when the API is supported by io_uring, the registration can still get rejected for various reasons, e.g. when the NIC or the driver doesn't support it, when the particular specified size is unsupported, when the memory area doesn't satisfy all requirements, etc. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 7496e658a76a61758b20e27cea8abcfeafe3aec4 Author: Pavel Begunkov Date: Sun Feb 15 21:29:12 2026 +0000 io_uring/zcrx: check unsupported flags on import The imoorted zcrx registration path checks for ZCRX_REG_IMPORT, as it should, but doesn't reject any unsupported flags. Fix that. Cc: stable@vger.kernel.org Fixes: 00d91481279fb ("io_uring/zcrx: share an ifq between rings") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 26a4cfaff82a2dcb810f6bfd5f4842f9b6046c8a Merge: 011af61b9f7c91 e1e828a1e9a79a Author: Linus Torvalds Date: Sun Feb 15 10:47:59 2026 -0800 Merge tag 'docs-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux Pull documentation fixes from Jonathan Corbet: "A handful of small, late-arriving documentation fixes" * tag 'docs-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: docs: toshiba_haps: fix grammar error in SSD warning Docs/mm: fix typos and grammar in page_tables.rst Docs/core-api: fix typos in rbtree.rst docs: clarify wording in programming-language.rst docs: process: maintainer-pgp-guide: update kernel.org docs link docs: kdoc_parser: allow __exit in function prototypes commit 011af61b9f7c9104eae7ad9951456330d950c771 Merge: c4f414becb6ac9 ce8ded2e61f477 Author: Linus Torvalds Date: Sun Feb 15 10:24:46 2026 -0800 Merge tag '9p-for-7.0-rc1' of https://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: - 9p/xen racy double-free fix - track 9p RPC waiting time as IO * tag '9p-for-7.0-rc1' of https://github.com/martinetd/linux: 9p/xen: protect xen_9pfs_front_free against concurrent calls 9p: Track 9P RPC waiting time as IO wait: Introduce io_wait_event_killable() commit c4f414becb6ac9c71ea80dd8b28478d357c62bb7 Merge: bb7a3fc2c976b5 43185067c6fd55 Author: Linus Torvalds Date: Sun Feb 15 10:20:37 2026 -0800 Merge tag 'tsm-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm Pull TSM updates from Dan Williams: "A couple of updates to the maximum buffer sizes supported for the configfs-tsm-reports interface. This interface is a common transport that conveys the varied architecture specific launch attestation reports for confidential VMs. - Prepare the configfs-tsm-reports interface for passing larger attestation evidence blobs for "Device Identifier Composition Engine" (DICE) and Post Quantum Crypto (PQC) - Update the tdx-guest driver for DICE evidence (larger certificate chains and the CBOR Web Token schema)" * tag 'tsm-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: configfs-tsm-report: tdx_guest: Increase Quote buffer size to 128KB configfs-tsm-report: Increase TSM_REPORT_OUTBLOB_MAX to 16MB configfs-tsm-report: Document size limits for outblob attributes commit bb7a3fc2c976b5d0deb35a54ca237519816d7ba9 Merge: 348e77b8145676 efdc383d1cc28d Author: Linus Torvalds Date: Sun Feb 15 08:29:26 2026 -0800 Merge tag 'i2c-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: - core: cleaner fwnode usage - tegra: timing improvements and Tegra264 support - lpi2c: fix SMBus block read NACK after byte count - amd-mp2, designware, mlxbf, rtl9300, spacemit, tegra: cleanups - designware: - use a dedicated algorithm for AMD Navi - replace magic numbers with named constants - replace min_t() with min() to avoid u8 truncation - refactor core to enable mode switching - imx-lpi2c: add runtime PM support for IRQ and clock handling - lan9691-i2c: add new driver - rtl9300: use OF helpers directly and avoid fwnode handling - spacemit: add bus reset support - units: add HZ_PER_GHZ and use it in several i2c drivers - at24 i2c eeprom: - add a set of new compatibles to DT bindings - use dev_err_probe() consistently in the driver * tag 'i2c-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (46 commits) i2c: imx-lpi2c: fix SMBus block read NACK after byte count i2c: designware: Remove an unnecessary condition i2c: designware: Enable mode swapping i2c: designware: Combine the init functions i2c: designware: Combine some of the common functions i2c: designware: Use device_is_compatible() instead of custom approach dt-bindings: eeprom: at24: Add compatible for Puya P24C128F drivers/i2c/busses: use min() instead of min_t() i2c: imx-lpi2c: Add runtime PM support for IRQ and clock management on i.MX8QXP/8QM i2c: amd-mp2: clean up amd_mp2_find_device() i2c: designware: Replace magic numbers with named constants i2c: rtl9300: use of instead of fwnode i2c: rtl9300: remove const cast i2c: tegra: remove unused rst i2c: designware: Remove not-going-to-be-supported code for Baikal SoC i2c: spacemit: drop useless spaces i2c: mlxbf: Use HZ_PER_KHZ in the driver i2c: mlxbf: Remove unused bus speed definitions i2c: core: Use dev_fwnode() i2c: core: Replace custom implementation of device_match_fwnode() ... commit 348e77b8145676184fb49063d5543e054fd74909 Merge: 13c916af3abf98 273a171dee33cb Author: Linus Torvalds Date: Sun Feb 15 08:24:19 2026 -0800 Merge tag 'input-for-v7.0-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - support for FocalTech FT8112 added to i2c-hid driver - support for FocalTech FT3518 added to edt-ft5x06 driver - support for power buttons in TWL603x chips added to twl4030-pwrbutton driver - an update to gpio-decoder driver to make it usable on non-OF platforms and to clean up the code - an update to synaptics_i2c driver switching it to use managed resources and a fix to restarting polling after resume - an update to gpio-keys driver to fall back to getting IRQ from resources if not specified using other means - an update to ili210x driver to support polling mode - a number of input drivers switched to scnprintf() to suppress truncation warnings - a number of updates and conversions of device tree bindings to yaml format - fixes to spelling in comments and messages in several drivers - other assorted fixups * tag 'input-for-v7.0-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (57 commits) dt-bindings: input: qcom,pm8941-pwrkey: Document PMM8654AU dt-bindings: input: touchscreen: imagis: allow linux,keycodes for ist3038 Input: apbps2 - fix comment style and typos Input: gpio_keys - fall back to platform_get_irq() for interrupt-only keys Input: novatek-nvt-ts - drop wake_type check dt-bindings: input: touchscreen: tsc2007: document '#io-channel-cells' Input: ili210x - add support for polling mode dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek Input: appletouch - fix potential race between resume and open HID: i2c-hid: Add FocalTech FT8112 dt-bindings: input: i2c-hid: Introduce FocalTech FT8112 Input: synaptics_i2c - switch to using managed resources Input: synaptics_i2c - guard polling restart in resume Input: gpio_decoder - don't use "proxy" headers Input: gpio_decoder - make use of the macros from bits.h Input: gpio_decoder - replace custom loop by gpiod_get_array_value_cansleep() Input: gpio_decoder - unify messages with help of dev_err_probe() Input: gpio_decoder - make use of device properties Input: serio - complete sizeof(*pointer) conversions Input: wdt87xx_i2c - switch to use dev_err_probe() ... commit 13c916af3abf98f4a2a00b9463d2fc00cc6bc00e Merge: ca4ee40bf13dbd 5921ae27ea7b0e Author: Linus Torvalds Date: Sun Feb 15 08:18:57 2026 -0800 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "Not much changed in the clk framework this time except the clk.h consumer API moved the context saving APIs around to fix a build error in certain configurations. There was a change to the core framework for CLK_OPS_PARENT_ENABLE behavior during registration, but it wrecked existing drivers that didn't expect things to be turned off during clk registration so it got reverted. This cycle is really a large collection of new clk drivers, primarily for Qualcomm SoCs but also for Amlogic, SpacemiT, Google, and Aspeed. Another big change in here is support for automatic hardware clock gating on Samsung SoCs where the clks turn on and off when needed. Ideally more vendors move to this method for better power savings. The highlights are in the updates section below. Beyond all the new drivers we have a bunch of cleanups like converting drivers from divider_round_rate() to divider_determine_rate() and using scoped for each OF child loops. Otherwise it's the usual data fixes and plugging reference leaks, etc. that's all pretty ordinary but not critical enough to fix until the next release. New Drivers: - Qualcomm Kaanapali global, tcsr, rpmh, display, gpu, camera, and video clk controllers - Qualcomm SM8750 camera clk controllers - Qualcomm MSM8940 and SDM439 global clk controllers - Google GS101 Display Process Unit (DPU) clk controllers - SpacemiT K3 clk controllers - Amlogic t7 clk controllers - Aspeed AST2700 clk controllers Updates: - Convert clock dividers from round_rate() to determine_rate() - Fix sparse warnings, kernel-doc warnings, and plug leaked OF refs - Automatic hardware clk gating on Google GS101 SoCs - Amlogic s4 video clks - CAN-FD clks and resets on Renesas RZ/T2H, RZ/N2H, RZ/V2H, and RZ/V2N - Expanded Serial Peripheral Interface (xSPI) clocks and resets on Renesas RZ/T21H and RZ/N2H - DMAC, interrupt controller (ICU), SPI, and thermal (TSU) clocks and resets on Renesas RZ/V2N - More serial (RSCI) clocks and resets on Renesas RZ/V2H and RZ/V2N - CPU frequency scaling on T-HEAD TH1520" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (165 commits) clk: aspeed: Add reset for HACE/VIDEO dt-bindings: clock: aspeed: Add VIDEO reset definition clk: aspeed: add AST2700 clock driver MAINTAINERS: Add entry for ASPEED clock drivers. clk: aspeed: Move the existing ASPEED clk drivers into aspeed subdirectory. Revert "clk: Respect CLK_OPS_PARENT_ENABLE during recalc" clk: Disable KUNIT_UML_PCI dt-bindings: clk: rs9: Fix DIF pattern match clk: rs9: Convert to DEFINE_SIMPLE_DEV_PM_OPS() clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 clk: qcom: sm8750: Constify 'qcom_cc_desc' in SM8750 camcc clk: zynqmp: pll: Fix zynqmp_clk_divider_determine_rate kerneldoc clk: zynqmp: divider: Fix zynqmp_clk_divider_determine_rate kerneldoc clk: mediatek: Fix error handling in runtime PM setup clk: mediatek: don't select clk-mt8192 for all ARM64 builds clk: mediatek: Add mfg_eb as parent to mt8196 mfgpll clocks clk: mediatek: Refactor pllfh registration to pass device clk: mediatek: Pass device to clk_hw_register for PLLs clk: mediatek: Refactor pll registration to pass device clk: Respect CLK_OPS_PARENT_ENABLE during recalc ... commit a5a50f1415692a0fe3bf0ec17f422cac8e158e65 Author: Shyam Prasad N Date: Sat Feb 14 13:05:50 2026 +0530 cifs: remove unnecessary tracing after put tcon This code was recently changed from manually decrementing tcon ref to using cifs_put_tcon. But even before that change this tracing happened after decrementing the ref count, which is wrong. With cifs_put_tcon, tracing already happens inside it. So just removing the extra tracing here. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit a09dc10d1353f0e92c21eae2a79af1c2b1ddcde8 Author: Fedor Pchelkin Date: Sat Feb 14 18:45:14 2026 +0300 ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths There are two places where ksmbd_vfs_kern_path_end_removing() needs to be called in order to balance what the corresponding successful call to ksmbd_vfs_kern_path_start_removing() has done, i.e. drop inode locks and put the taken references. Otherwise there might be potential deadlocks and unbalanced locks which are caught like: BUG: workqueue leaked lock or atomic: kworker/5:21/0x00000000/7596 last function: handle_ksmbd_work 2 locks held by kworker/5:21/7596: #0: ffff8881051ae448 (sb_writers#3){.+.+}-{0:0}, at: ksmbd_vfs_kern_path_locked+0x142/0x660 #1: ffff888130e966c0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: ksmbd_vfs_kern_path_locked+0x17d/0x660 CPU: 5 PID: 7596 Comm: kworker/5:21 Not tainted 6.1.162-00456-gc29b353f383b #138 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: ksmbd-io handle_ksmbd_work Call Trace: dump_stack_lvl+0x44/0x5b process_one_work.cold+0x57/0x5c worker_thread+0x82/0x600 kthread+0x153/0x190 ret_from_fork+0x22/0x30 Found by Linux Verification Center (linuxtesting.org). Fixes: d5fc1400a34b ("smb/server: avoid deadlock when linking with ReplaceIfExists") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1aade89ecca465be1d08ea3fb55832254117932f Author: Chen Ni Date: Wed Feb 11 12:55:33 2026 +0800 smb: server: Remove duplicate include of misc.h Remove duplicate inclusion of misc.h in server.c to clean up redundant code. Signed-off-by: Chen Ni Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5d540e4508950c674d6feef1d95463d039bbf4f5 Author: Pavel Begunkov Date: Sat Feb 14 22:20:47 2026 +0000 io_uring/zcrx: fix post open error handling Closing a queue doesn't guarantee that all associated page pools are terminated right away, let the refcounting do the work instead of releasing the zcrx ctx directly. Cc: stable@vger.kernel.org Fixes: e0793de24a9f6 ("io_uring/zcrx: set pp memory provider for an rx queue") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit a983aae397767e9da931128ff2b5bf9066513ce3 Author: Pavel Begunkov Date: Sat Feb 14 22:19:32 2026 +0000 io_uring/zcrx: fix sgtable leak on mapping failures In an unlikely case when io_populate_area_dma() fails, which could only happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine, io_zcrx_map_area() will have an initialised and not freed table. It was supposed to be cleaned up in the error path, but !is_mapped prevents that. Fixes: 439a98b972fbb ("io_uring/zcrx: deduplicate area mapping") Cc: stable@vger.kernel.org Reported-by: Jens Axboe Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit ca4ee40bf13dbd3a4be3b40a00c33a1153d487e5 Author: Helge Deller Date: Sat Feb 14 22:16:34 2026 +0100 Partly revert "drm/hyperv: Remove reference to hyperv_fb driver" This partly reverts commit 8f582bcd132c ("drm/hyperv: Remove reference to hyperv_fb driver") which was messed up by me while trying to fix a merge conflict. Signed-off-by: Helge Deller Signed-off-by: Linus Torvalds commit 273a171dee33cb77070d7259c469d9440548c7df Merge: 19a5d9ba6208e9 ab2e361ca97a42 Author: Dmitry Torokhov Date: Sat Feb 14 13:06:51 2026 -0800 Merge branch 'next' into for-linus Prepare input updates for 7.0 merge window. commit 64275e9fda3702bfb5ab3b95f7c2b9b414667164 Merge: 787fe1d43a21d6 92860256402cce Author: Linus Torvalds Date: Sat Feb 14 12:47:15 2026 -0800 Merge tag 'loongarch-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Select HAVE_CMPXCHG_{LOCAL,DOUBLE} - Add 128-bit atomic cmpxchg support - Add HOTPLUG_SMT implementation - Wire up memfd_secret system call - Fix boot errors and unwind errors for KASAN - Use BPF prog pack allocator and add BPF arena support - Update dts files to add nand controllers - Some bug fixes and other small changes * tag 'loongarch-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: dts: loongson-2k1000: Add nand controller support LoongArch: dts: loongson-2k0500: Add nand controller support LoongArch: BPF: Implement bpf_addr_space_cast instruction LoongArch: BPF: Implement PROBE_MEM32 pseudo instructions LoongArch: BPF: Use BPF prog pack allocator LoongArch: Use IS_ERR_PCPU() macro for KGDB LoongArch: Rework KASAN initialization for PTW-enabled systems LoongArch: Disable instrumentation for setup_ptwalker() LoongArch: Remove some extern variables in source files LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT LoongArch: Handle percpu handler address for ORC unwinder LoongArch: Use %px to print unmodified unwinding address LoongArch: Prefer top-down allocation after arch_mem_init() LoongArch: Add HOTPLUG_SMT implementation LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE LoongArch: Wire up memfd_secret system call LoongArch: Replace seq_printf() with seq_puts() for simple strings LoongArch: Add 128-bit atomic cmpxchg support LoongArch: Add detection for SC.Q support LoongArch: Select HAVE_CMPXCHG_LOCAL in Kconfig commit 787fe1d43a21d688afac740f92485e9373d19f01 Merge: 8b3c75a39cc3cd f56ccc32468ee7 Author: Linus Torvalds Date: Sat Feb 14 12:39:34 2026 -0800 Merge tag 'memblock-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: - update tools/include/linux/mm.h to fix memblock tests compilation - drop redundant struct page* parameter from memblock_free_pages() and get struct page from the pfn - add underflow detection for size calculation in memtest and warn about underflow when VM_DEBUG is enabled * tag 'memblock-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: mm/memtest: add underflow detection for size calculation memblock: drop redundant 'struct page *' argument from memblock_free_pages() memblock test: include from tools mm.h stub commit 8b3c75a39cc3cde78332f0e10898104a5e1e2807 Merge: 6179d7a630c274 a86039b76e5d1e Author: Linus Torvalds Date: Sat Feb 14 11:54:12 2026 -0800 Merge tag 'fbdev-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "It's now easily possible to replace the framebuffer penguin boot logo with an own logo at compile time (Vincent Mailhol) The hyperv framebuffer driver has been removed, since the hyperv DRM driver now seems to provide equal functionality. Various console_conditional_schedule() calls across the console drivers (fbcon, printk, vt) have been removed since they are no longer necessary. All other patches are either fixes in au1100fb, au1200fb, ffb, rivafb, vt8500lcdfb and of_display_timing, or minor cleanups in the fbcon and omapfb drivers" * tag 'fbdev-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (32 commits) fbcon: Declare struct fb_info.fbcon_par as of type struct fbcon_par fbcon: Remove struct fbcon_display.inverse fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() fbdev: ffb: fix corrupted video output on Sun FFB1 fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() staging: fbtft: Make framebuffer registration message debug-only staging: fbtft: Fix build failure when CONFIG_FB_DEVICE=n fbdev: au1100fb: Check return value of clk_enable() in .resume() printk, vt, fbcon: Remove console_conditional_schedule() fbdev: fix fb_pad_unaligned_buffer mask fbdev: of: display_timing: fix refcount leak in of_get_display_timings() fbdev: vt8500lcdfb: fix missing dma_free_coherent() video/logo: don't select LOGO_LINUX_MONO and LOGO_LINUX_VGA16 by default video/logo: move logo selection logic to Kconfig video/logo: remove logo_mac_clut224 sh: defconfig: remove CONFIG_LOGO_SUPERH_* newport_con: depend on LOGO_LINUX_CLUT224 instead of LOGO_SGI_CLUT224 video/logo: allow custom logo video/logo: add a type parameter to the logo makefile function video/logo: remove orphan .pgm Makefile rule ... commit 6179d7a630c2747e2a9329149de2a7aa67a95978 Merge: 986d555afd5045 07158813600748 Author: Linus Torvalds Date: Sat Feb 14 11:30:05 2026 -0800 Merge tag 'caps-pr-20260213' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux Pull capabilities updates from Serge Hallyn: - add KUnit tests for some core capabilities helpers - avoid emitting IPC audit messages when there's not actually a permission being denied * tag 'caps-pr-20260213' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux: ipc: don't audit capability check in ipc_permissions() security: Add KUnit tests for kuid_root_in_ns and vfsuid_root_in_currentns commit 986d555afd50452909b2fb52c00554419832eac2 Merge: 2bfc50c6e6e67b 42023d4b6d2661 Author: Linus Torvalds Date: Sat Feb 14 11:20:26 2026 -0800 Merge tag 'rpmsg-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: - Fix a race in rpmsg driver_override_show() and use the existing helper to implement the store() - Implement support for EPOLLOUT in the virtio rpmsg driver * tag 'rpmsg-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: core: fix race in driver_override_show() and use core helper rpmsg: virtio: EPOLLOUT support commit 2bfc50c6e6e67b08770c6ef46660c3ee9c6a1519 Merge: f0a475aedd190d 26aa5295010ffa Author: Linus Torvalds Date: Sat Feb 14 11:17:54 2026 -0800 Merge tag 'rproc-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Fix a memory remapping issue and make a few life-cycle improvements in the i.MX HiFi remoteproc driver - Add support the System Manager CPU and LMM APIs and use this to support i.MX95 - Rework the handling of the Mediatek SCP clock to avoid a potential circular deadlock in the clock providers - Refactor the Qualcomm secure-world helpers and add support in the Qualcomm PAS remoteproc driver for reading a resource-table from secure world. Use this to configure the IOMMU on newer targets where Linux runs in EL2 * tag 'rproc-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: remoteproc: imx_rproc: Fix invalid loaded resource table detection remoteproc: mediatek: Break lock dependency to `prepare_lock` remoteproc: imx_rproc: Add support for i.MX95 remoteproc: imx_rproc: Add support for System Manager CPU API remoteproc: imx_rproc: Add support for System Manager LMM API remoteproc: imx_rproc: Introduce prepare ops for imx_rproc_dcfg remoteproc: imx_rproc: Add runtime ops copy to support dynamic behavior dt-bindings: remoteproc: fsl,imx-rproc: Add support for i.MX95 dt-bindings: remoteproc: Add HSM M4F core on TI K3 SoCs remoteproc: xlnx_r5: Simplify with scoped for each OF child loop remoteproc: mtk_scp: Simplify with scoped for each OF child loop remoteproc: imx_dsp_rproc: Only reset carveout memory at RPROC_OFFLINE state dt-bindings: remoteproc: qcom,sm8550-pas: Drop SM8750 ADSP from if-branch dt-bindings: remoteproc: qcom,adsp: Allow cx-supply on qcom,sdm845-slpi-pas remoteproc: imx_dsp_rproc: Fix multiple start/stop operations remoteproc: imx_rproc: Use strstarts for "rsc-table" check remoteproc: imx_dsp_rproc: Wait for suspend ACK only if WAIT_FW_CONFIRMATION is set remoteproc: imx_dsp_rproc: Rename macro to reflect multiple contexts remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized dt-bindings: remoteproc: Fix dead link to Keystone DSP GPIO binding commit f0a475aedd190db95cf92914ca7760c06fbdb704 Merge: dd530598bc02f9 75df94d05fc03f Author: Linus Torvalds Date: Sat Feb 14 11:13:32 2026 -0800 Merge tag 'mailbox-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: "Platform and core updates PCC: - Updates to transmission and interrupt handling, including dynamic txdone configuration, ->last_tx_done() wiring, and SHMEM initialization fixes. Reverted previous shared buffer patch MediaTek - Introduce mtk-vcp-mailbox driver and bindings for MT8196 VCP - Expand mtk-cmdq for MT8196 with GCE virtualization, mminfra_offset, and instruction generation data Spreadtrum (SPRD) - Add Mailbox Revision 2 support and UMS9230 bindings - Fix unhandled interrupt masking and TX done delivery flags Microchip - Add pic64gx compatibility to MPFS - Fix out-of-bounds access and smatch warnings in mchp-ipc-sbi Core & Misc Platform Updates - Prevent out-of-bounds access in fw_mbox_index_xlate() - Add bindings for Qualcomm CPUCP (Kaanapali) - Simplify mtk-cmdq and zynqmp-ipi with scoped OF child iterators - Consolidate various minor fixes, dead code removal, and typo corrections across Broadcom, NXP, Samsung, Xilinx, ARM, and core headers" * tag 'mailbox-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: (34 commits) mailbox: sprd: mask interrupts that are not handled mailbox: sprd: add support for mailbox revision 2 mailbox: sprd: clear delivery flag before handling TX done dt-bindings: mailbox: sprd: add compatible for UMS9230 mailbox: bcm-ferxrm-mailbox: Use default primary handler mailbox: Remove mailbox_client.h from controller drivers mailbox: zynqmp-ipi: Simplify with scoped for each OF child loop mailbox: mtk-cmdq: Simplify with scoped for each OF child loop dt-bindings: mailbox: xlnx,zynqmp-ipi-mailbox: Document msg region requirement mailbox: Improve RISCV_SBI_MPXY_MBOX guidance mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch warnings mailbox: arm_mhuv3: fix typo in comment mailbox: cix: fix typo in error message mailbox: imx: Skip the suspend flag for i.MX7ULP mailbox: exynos: drop unneeded runtime pointer (pclk) mailbox: pcc: Remove spurious IRQF_ONESHOT usage mailbox: mtk-cmdq: Add driver data to support for MT8196 mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction mailbox: mtk-cmdq: Add GCE hardware virtualization configuration mailbox: mtk-cmdq: Add cmdq private data to cmdq_pkt for generating instruction ... commit dd530598bc02f9db0ebef644d8e2002aecf0ab15 Merge: 3e48a11675c506 c1f57406672ba6 Author: Linus Torvalds Date: Sat Feb 14 10:50:31 2026 -0800 Merge tag 'exfat-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Improve error code handling and four cleanups - Reduce unnecessary valid_size extension during mmap write to avoid over-extending writes - Optimize consecutive FAT entry reads by caching buffer heads in __exfat_ent_get to significantly reduce sb_bread() calls - Add multi-cluster (contiguous cluster) support to exfat_get_cluster() and exfat_map_cluster() for better sequential read performance, especially on small cluster sizes * tag 'exfat-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: add blank line after declarations exfat: remove unnecessary else after return statement exfat: support multi-cluster for exfat_get_cluster exfat: return the start of next cache in exfat_cache_lookup exfat: tweak cluster cache to support zero offset exfat: support multi-cluster for exfat_map_cluster exfat: remove handling of non-file types in exfat_map_cluster exfat: reuse cache to improve exfat_get_cluster exfat: reduce the number of parameters for exfat_get_cluster() exfat: remove the unreachable warning for cache miss cases exfat: remove the check for infinite cluster chain loop exfat: improve exfat_find_last_cluster exfat: improve exfat_count_num_clusters exfat: support reuse buffer head for exfat_ent_get exfat: add cache option for __exfat_ent_get exfat: reduce unnecessary writes during mmap write exfat: improve error code handling in exfat_find_empty_entry() commit 5921ae27ea7b0e8cda621f8951ca79b34c36ce49 Merge: a612d3d6d7d970 5f35b48a0daa79 7fbabe8f07e41e Author: Stephen Boyd Date: Sat Feb 14 10:23:59 2026 -0800 Merge branches 'clk-aspeed' and 'clk-qcom' into clk-next * clk-aspeed: clk: aspeed: Add reset for HACE/VIDEO dt-bindings: clock: aspeed: Add VIDEO reset definition clk: aspeed: add AST2700 clock driver MAINTAINERS: Add entry for ASPEED clock drivers. clk: aspeed: Move the existing ASPEED clk drivers into aspeed subdirectory. * clk-qcom: (49 commits) clk: qcom: sm8750: Constify 'qcom_cc_desc' in SM8750 camcc clk: qcom: gfx3d: add parent to parent request map clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src clk: qcom: dispcc-sdm845: Enable parents for pixel clocks clk: qcom: regmap-divider: convert from divider_round_rate() to divider_determine_rate() clk: qcom: regmap-divider: convert from divider_ro_round_rate() to divider_ro_determine_rate() clk: qcom: alpha-pll: convert from divider_round_rate() to divider_determine_rate() clk: qcom: Add support for GPUCC and GXCLK for Kaanapali clk: qcom: Add support for VideoCC driver for Kaanapali clk: qcom: camcc: Add support for camera clock controller for Kaanapali clk: qcom: dispcc: Add support for display clock controller Kaanapali clk: qcom: clk-alpha-pll: Add support for controlling Pongo EKO_T PLL clk: qcom: clk-alpha-pll: Update the PLL support for cal_l clk: qcom: camcc: Add camera clock controller driver for SM8750 SoC clk: qcom: clk-alpha-pll: Add support for controlling Rivian PLL dt-bindings: clock: qcom: document the Kaanapali GPU Clock Controller dt-bindings: clock: qcom: Add Kaanapali video clock controller dt-bindings: clock: qcom: Add support for CAMCC for Kaanapali dt-bindings: clock: qcom: document Kaanapali DISPCC clock controller dt-bindings: clock: qcom: Add camera clock controller for SM8750 SoC ... commit a612d3d6d7d9708236c788bf94f4cd2dd1bfb05b Merge: b675697d807507 90ecc4b3c10344 9160ca46d2e320 2fa598ae979964 f08e7edbe2ab91 Author: Stephen Boyd Date: Sat Feb 14 10:23:51 2026 -0800 Merge branches 'clk-imx', 'clk-divider', 'clk-rockchip' and 'clk-microchip' into clk-next * clk-imx: clk: imx: fracn-gppll: Add 241.90 MHz Support clk: imx: fracn-gppll: Add 332.60 MHz Support * clk-divider: rtc: ac100: convert from divider_round_rate() to divider_determine_rate() clk: zynqmp: divider: convert from divider_round_rate() to divider_determine_rate() clk: x86: cgu: convert from divider_round_rate() to divider_determine_rate() clk: versaclock3: convert from divider_round_rate() to divider_determine_rate() clk: stm32: stm32-core: convert from divider_round_rate_parent() to divider_determine_rate() clk: stm32: stm32-core: convert from divider_ro_round_rate() to divider_ro_determine_rate() clk: sprd: div: convert from divider_round_rate() to divider_determine_rate() clk: sophgo: sg2042-clkgen: convert from divider_round_rate() to divider_determine_rate() clk: nxp: lpc32xx: convert from divider_round_rate() to divider_determine_rate() clk: nuvoton: ma35d1-divider: convert from divider_round_rate() to divider_determine_rate() clk: milbeaut: convert from divider_round_rate() to divider_determine_rate() clk: milbeaut: convert from divider_ro_round_rate() to divider_ro_determine_rate() clk: loongson1: convert from divider_round_rate() to divider_determine_rate() clk: hisilicon: clkdivider-hi6220: convert from divider_round_rate() to divider_determine_rate() clk: bm1880: convert from divider_round_rate() to divider_determine_rate() clk: bm1880: convert from divider_ro_round_rate() to divider_ro_determine_rate() clk: actions: owl-divider: convert from divider_round_rate() to divider_determine_rate() clk: actions: owl-composite: convert from owl_divider_helper_round_rate() to divider_determine_rate() clk: sunxi-ng: convert from divider_round_rate_parent() to divider_determine_rate() clk: sophgo: cv18xx-ip: convert from divider_round_rate() to divider_determine_rate() * clk-rockchip: clk: rockchip: Fix error pointer check after rockchip_clk_register_gate_link() * clk-microchip: dt-bindings: clock: mpfs-clkcfg: Add pic64gx compatibility dt-bindings: clock: mpfs-ccc: Add pic64gx compatibility clk: microchip: drop POLARFIRE from ARCH_MICROCHIP_POLARFIRE clk: microchip: core: remove unused include asm/traps.h clk: microchip: core: correct return value on *_get_parent() clk: microchip: core: remove duplicate determine_rate on pic32_sclk_ops commit b675697d807507244bfd00adc30534df6e888cfd Merge: 16c3c4e2881ef7 d8b210f8729241 d5798ed98baa76 448b50b5cf12b7 847eaf0d3123ea Author: Stephen Boyd Date: Sat Feb 14 10:23:37 2026 -0800 Merge branches 'clk-amlogic', 'clk-thead', 'clk-mediatek' and 'clk-samsung' into clk-next * clk-amlogic: clk: meson: gxbb: use the existing HHI_HDMI_PLL_CNTL3 macro clk: meson: g12a: Limit the HDMI PLL OD to /4 clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs clk: amlogic: remove potentially unsafe flags from S4 video clocks clk: amlogic: add video-related clocks for S4 SoC dt-bindings: clock: add video clock indices for Amlogic S4 SoC clk: meson: t7: add t7 clock peripherals controller driver clk: meson: t7: add support for the T7 SoC PLL clock dt-bindings: clock: add Amlogic T7 peripherals clock controller dt-bindings: clock: add Amlogic T7 SCMI clock controller dt-bindings: clock: add Amlogic T7 PLL clock controller * clk-thead: clk: thead: th1520-ap: Support CPU frequency scaling clk: thead: th1520-ap: Add macro to define multiplexers with flags clk: thead: th1520-ap: Support setting PLL rates clk: thead: th1520-ap: Add C910 bus clock clk: thead: th1520-ap: Poll for PLL lock and wait for stability dt-bindings: clock: thead,th1520-clk-ap: Add ID for C910 bus clock * clk-mediatek: Revert "clk: Respect CLK_OPS_PARENT_ENABLE during recalc" clk: mediatek: Fix error handling in runtime PM setup clk: mediatek: don't select clk-mt8192 for all ARM64 builds clk: mediatek: Add mfg_eb as parent to mt8196 mfgpll clocks clk: mediatek: Refactor pllfh registration to pass device clk: mediatek: Pass device to clk_hw_register for PLLs clk: mediatek: Refactor pll registration to pass device clk: Respect CLK_OPS_PARENT_ENABLE during recalc dt-bindings: clock: mediatek,mt7622-pciesys: Remove syscon compatible clk: mediatek: Drop __initconst from gates * clk-samsung: clk: samsung: gs101: add support for Display Process Unit (DPU) clocks dt-bindings: samsung: exynos-sysreg: add gs101 dpu compatible dt-bindings: clock: google,gs101-clock: Add DPU clock management unit dt-bindings: clock: google,gs101-clock: fix alphanumeric ordering clk: samsung: fix sysreg save/restore when PM is enabled for CMU clk: samsung: avoid warning message on legacy Exynos (auto clock gating) clk: samsung: gs101: Enable auto_clock_gate mode for each gs101 CMU clk: samsung: Implement automatic clock gating mode for CMUs dt-bindings: clock: google,gs101-clock: add samsung,sysreg property as required clk: samsung: exynosautov920: add clock support dt-bindings: clock: exynosautov920: add MFD clock definitions commit 16c3c4e2881ef7d30b3f6131e78535937c328573 Merge: 341d72ebc23036 b079e4e628c886 6294bb8eda88c5 2d4235b18974f9 Author: Stephen Boyd Date: Sat Feb 14 10:23:04 2026 -0800 Merge branches 'clk-renesas', 'clk-cleanup', 'clk-spacemit' and 'clk-tegra' into clk-next * clk-renesas: (25 commits) dt-bindings: clk: rs9: Fix DIF pattern match clk: rs9: Convert to DEFINE_SIMPLE_DEV_PM_OPS() clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 clk: renesas: Add missing log message terminators clk: renesas: rzg2l: Remove DSI clock rate restrictions clk: renesas: rzv2h: Deassert reset on assert timeout clk: renesas: rzg2l: Deassert reset on assert timeout clk: renesas: cpg-mssr: Unlock before reset verification clk: renesas: r9a09g056: Add entries for CANFD clk: renesas: r9a09g057: Add entries for CANFD clk: renesas: r9a09g077: Add CANFD clocks clk: renesas: cpg-mssr: Handle RZ/T2H register layout in PM callbacks dt-bindings: clock: renesas,r9a09g077/87: Add PCLKCAN ID clk: renesas: cpg-mssr: Simplify pointer math in cpg_rzt2h_mstp_read() clk: renesas: r9a09g056: Add clock and reset entries for TSU clk: renesas: r9a09g057: Add entries for RSCIs clk: renesas: r9a09g056: Add entries for RSCIs clk: renesas: r9a09g056: Add entries for the RSPIs clk: renesas: r9a09g056: Add entries for ICU clk: renesas: r9a09g056: Add entries for the DMACs ... * clk-cleanup: clk: Disable KUNIT_UML_PCI clk: zynqmp: pll: Fix zynqmp_clk_divider_determine_rate kerneldoc clk: zynqmp: divider: Fix zynqmp_clk_divider_determine_rate kerneldoc clk: tegra: tegra124-emc: fix device leak on set_rate() clk: Annotate #else and #endif clk: Merge prepare and unprepare sections clk: Move clk_{save,restore}_context() to COMMON_CLK section clk: clk-apple-nco: Add "apple,t8103-nco" compatible clk: versatile: impd1: Simplify with scoped for each OF child loop clk: scpi: Simplify with scoped for each OF child loop clk: lmk04832: Simplify with scoped for each OF child loop * clk-spacemit: clk: spacemit: k3: add the clock tree clk: spacemit: k3: extract common header clk: spacemit: ccu_pll: add plla type clock clk: spacemit: ccu_mix: add inverted enable gate clock dt-bindings: soc: spacemit: k3: add clock support clk: spacemit: add platform SoC prefix to reset name clk: spacemit: extract common ccu functions reset: spacemit: fix auxiliary device id clk: spacemit: prepare common ccu header clk: spacemit: Hide common clock driver from user controller clk: spacemit: Respect Kconfig setting when building modules * clk-tegra: clk: tegra30: Add CSI pad clock gates clk: tegra: Set CSUS as vi_sensor's gate for Tegra20, Tegra30 and Tegra114 clk: tegra20: Reparent dsi clock to pll_d_out0 clk: tegra: tegra124-emc: Simplify with scoped for each OF child loop clk: tegra: Adjust callbacks in tegra_clock_pm clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() commit 92978c83bb4eef55d02a6c990c01c423131eefa7 Author: Kuniyuki Iwashima Date: Sat Jan 24 04:18:41 2026 +0000 nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit(). nfsd_nl_listener_set_doit() uses get_current_cred() without put_cred(). As we can see from other callers, svc_xprt_create_from_sa() does not require the extra refcount. nfsd_nl_listener_set_doit() is always in the process context, sendmsg(), and current->cred does not go away. Let's use current_cred() in nfsd_nl_listener_set_doit(). Fixes: 16a471177496 ("NFSD: add listener-{set,get} netlink command") Cc: stable@vger.kernel.org Signed-off-by: Kuniyuki Iwashima Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 1cb968a2013ffa8112d52ebe605009ea1c6a582c Author: Kuniyuki Iwashima Date: Sat Jan 24 04:18:40 2026 +0000 nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of struct cred. [0] nfsd_nl_threads_set_doit() passes get_current_cred() to nfsd_svc(), but put_cred() is not called after that. The cred is finally passed down to _svc_xprt_create(), which calls get_cred() with the cred for struct svc_xprt. The ownership of the refcount by get_current_cred() is not transferred to anywhere and is just leaked. nfsd_svc() is also called from write_threads(), but it does not bump file->f_cred there. nfsd_nl_threads_set_doit() is called from sendmsg() and current->cred does not go away. Let's use current_cred() in nfsd_nl_threads_set_doit(). [0]: BUG: memory leak unreferenced object 0xffff888108b89480 (size 184): comm "syz-executor", pid 5994, jiffies 4294943386 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 369454a7): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4958 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270 prepare_creds+0x22/0x600 kernel/cred.c:185 copy_creds+0x44/0x290 kernel/cred.c:286 copy_process+0x7a7/0x2870 kernel/fork.c:2086 kernel_clone+0xac/0x6e0 kernel/fork.c:2651 __do_sys_clone+0x7f/0xb0 kernel/fork.c:2792 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 924f4fb003ba ("NFSD: convert write_threads to netlink command") Cc: stable@vger.kernel.org Reported-by: syzbot+dd3b43aa0204089217ee@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69744674.a00a0220.33ccc7.0000.GAE@google.com/ Tested-by: syzbot+dd3b43aa0204089217ee@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 3e48a11675c50698374d4ac596fb506736eb1c53 Merge: 770aaedb461a05 52190933c37a96 Author: Linus Torvalds Date: Sat Feb 14 09:48:10 2026 -0800 Merge tag 'f2fs-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this development cycle, we focused on several key performance optimizations: - introducing large folio support to enhance read speeds for immutable files - reducing checkpoint=enable latency by flushing only committed dirty pages - implementing tracepoints to diagnose and resolve lock priority inversion. Additionally, we introduced the packed_ssa feature to optimize the SSA footprint when utilizing large block sizes. Detail summary: Enhancements: - support large folio for immutable non-compressed case - support non-4KB block size without packed_ssa feature - optimize f2fs_enable_checkpoint() to avoid long delay - optimize f2fs_overwrite_io() for f2fs_iomap_begin - optimize NAT block loading during checkpoint write - add write latency stats for NAT and SIT blocks in f2fs_write_checkpoint - pin files do not require sbi->writepages lock for ordering - avoid f2fs_map_blocks() for consecutive holes in readpages - flush plug periodically during GC to maximize readahead effect - add tracepoints to catch lock overheads - add several sysfs entries to tune internal lock priorities Fixes: - fix lock priority inversion issue - fix incomplete block usage in compact SSA summaries - fix to show simulate_lock_timeout correctly - fix to avoid mapping wrong physical block for swapfile - fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - fix to avoid UAF in f2fs_write_end_io()" * tag 'f2fs-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (61 commits) f2fs: sysfs: introduce critical_task_priority f2fs: introduce trace_f2fs_priority_update f2fs: fix lock priority inversion issue f2fs: optimize f2fs_overwrite_io() for f2fs_iomap_begin f2fs: fix incomplete block usage in compact SSA summaries f2fs: decrease maximum flush retry count in f2fs_enable_checkpoint() f2fs: optimize NAT block loading during checkpoint write f2fs: change size parameter of __has_cursum_space() to unsigned int f2fs: add write latency stats for NAT and SIT blocks in f2fs_write_checkpoint f2fs: pin files do not require sbi->writepages lock for ordering f2fs: fix to show simulate_lock_timeout correctly f2fs: introduce FAULT_SKIP_WRITE f2fs: check skipped write in f2fs_enable_checkpoint() Revert "f2fs: add timeout in f2fs_enable_checkpoint()" f2fs: fix to unlock folio in f2fs_read_data_large_folio() f2fs: fix error path handling in f2fs_read_data_large_folio() f2fs: use folio_end_read f2fs: fix to avoid mapping wrong physical block for swapfile f2fs: avoid f2fs_map_blocks() for consecutive holes in readpages f2fs: advance index and offset after zeroing in large folio read ... commit e1e828a1e9a79af76a7cdc271e0a506e496c2eaa Author: Berke Antar Date: Sat Feb 7 23:06:43 2026 +0100 docs: toshiba_haps: fix grammar error in SSD warning Replace "make this driver to fail" with "cause this driver to fail" to correct the grammar. Signed-off-by: Berke Antar Message-ID: Signed-off-by: Jonathan Corbet commit fe58576e6a2e9f74b770a5a51a77bde77bca26d3 Author: Min-Hsun Chang Date: Mon Feb 9 22:56:03 2026 +0800 Docs/mm: fix typos and grammar in page_tables.rst Correct several spelling and grammatical errors in the page tables documentation. This includes: - Fixing "a address" to "an address" - Fixing "pfs" to "pfns" - Correcting the possessive "Torvald's" to "Torvalds's" - Fixing "instruction that want" to "instruction that wants" - Fixing "code path" to "code paths" Signed-off-by: Min-Hsun Chang Reviewed-by: Linus Walleij Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Jonathan Corbet Message-ID: <20260209145603.96664-1-chmh0624@gmail.com> commit 2ade267bd8872fb01750d4c1303735624087579a Author: Min-Hsun Chang Date: Tue Feb 10 14:08:29 2026 +0800 Docs/core-api: fix typos in rbtree.rst Correct minor typographical errors in the red-black tree documentation: - Remove redundant "a" in the cached rbtrees section. - Fix "updated" to "update" in the augmented rbtrees section. - Fix "be looking" to "by looking" in the interval tree sample usage. Signed-off-by: Min-Hsun Chang Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260210060829.42975-1-chmh0624@gmail.com> commit 47cb33cedf47fea2026ac826babc5c8d4d447a75 Author: Ariful Islam Shoikot Date: Sat Feb 14 19:28:41 2026 +0600 docs: clarify wording in programming-language.rst Clarify that the Linux kernel is written in C and improve punctuation in the clang sentence. Signed-off-by: Ariful Islam Shoikot Signed-off-by: Jonathan Corbet Message-ID: <20260214132842.1161-1-islamarifulshoikat@gmail.com> commit 11506b3c233fcead6eba2842d17ec29c84f550d4 Author: Andreas Hindborg Date: Sat Feb 14 10:12:54 2026 +0100 block: update docs for bio and bvec_iter The documentation for bio and bvec_iter refers to a vector named bvl_vec. This does not exist. Update the documentation comment with correct use. Also update documentation comments for remaining fields of `bvec_iter` to improve readability. The fields of `bvec_iter` is using a mix of tabs and spaces for indentation. While at it, change them all to tabs, which is most prevalent in this struct definition. Signed-off-by: Andreas Hindborg Signed-off-by: Jens Axboe commit ac83896172798cf82ebc643cf555aa4cdd3a07da Author: Hongbo Li Date: Fri Feb 13 02:28:12 2026 +0000 iomap: Describe @private in iomap_readahead() The kernel test rebot reports the kernel-doc warning: ``` Warning: fs/iomap/buffered-io.c:624 function parameter 'private' not described in 'iomap_readahead' ``` The former commit in "iomap: stash iomap read ctx in the private field of iomap_iter" has added a new parameter @private to iomap_readahead(), so let's describe the parameter. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601261111.vIL9rhgD-lkp@intel.com/ Fixes: 8806f279244b ("iomap: stash iomap read ctx in the private field of iomap_iter") Signed-off-by: Hongbo Li Link: https://patch.msgid.link/20260213022812.766187-1-lihongbo22@huawei.com Reviewed-by: Gao Xiang Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit 81f16c9778d730f573d0d565706bb7227e2405f4 Author: Qing Wang Date: Fri Feb 13 18:30:06 2026 +0800 statmount: Fix the null-ptr-deref in do_statmount() If the mount is internal, it's mnt_ns will be MNT_NS_INTERNAL, which is defined as ERR_PTR(-EINVAL). So, in the do_statmount(), need to check ns of mount by IS_ERR() and return. Fixes: 0e5032237ee5 ("statmount: accept fd as a parameter") Reported-by: syzbot+9e03a9535ea65f687a44@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/698e287a.a70a0220.2c38d7.009e.GAE@google.com/ Signed-off-by: Qing Wang Link: https://patch.msgid.link/20260213103006.2472569-1-wangqing7171@gmail.com Reviewed-by: Bhavik Sachdev Signed-off-by: Christian Brauner commit 9eed043d10f17301c1b5141e16bb98a85a8fd07e Author: Huacai Chen Date: Tue Feb 3 17:40:14 2026 +0800 writeback: Fix wakeup and logging timeouts for !DETECT_HUNG_TASK Recent changes of fs-writeback cause such warnings if DETECT_HUNG_TASK is not enabled: INFO: The task sync:1342 has been waiting for writeback completion for more than 1 seconds. The reason is sysctl_hung_task_timeout_secs is 0 when DETECT_HUNG_TASK is not enabled, then it causes the warning message even if the writeback lasts for only one second. Guard the wakeup and logging with "#ifdef CONFIG_DETECT_HUNG_TASK" can eliminate the warning messages. But on the other hand, it is possible that sysctl_hung_task_timeout_secs be also 0 when DETECT_HUNG_TASK is enabled. So let's just check the value of sysctl_hung_task_timeout_secs to decide whether do wakeup and logging. Fixes: 1888635532fb ("writeback: Wake up waiting tasks when finishing the writeback of a chunk.") Fixes: d6e621590764 ("writeback: Add logging for slow writeback (exceeds sysctl_hung_task_timeout_secs)") Signed-off-by: Huacai Chen Link: https://patch.msgid.link/20260203094014.2273240-1-chenhuacai@loongson.cn Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit cb184dd19154fc486fa3d9e02afe70a97e54e055 Author: Edward Adam Davis Date: Fri Feb 6 14:20:28 2026 +0800 fs: init flags_valid before calling vfs_fileattr_get syzbot reported a uninit-value bug in [1]. Similar to the "*get" context where the kernel's internal file_kattr structure is initialized before calling vfs_fileattr_get(), we should use the same mechanism when using fa. [1] BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 vfs_fileattr_get fs/file_attr.c:94 [inline] __do_sys_file_getattr fs/file_attr.c:416 [inline] Local variable fa.i created at: __do_sys_file_getattr fs/file_attr.c:380 [inline] __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372 Reported-by: syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7c31755f2cea07838b0c Tested-by: syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Link: https://patch.msgid.link/tencent_B6C4583771D76766D71362A368696EC3B605@qq.com Signed-off-by: Christian Brauner commit e9e0b48cd15b46dcb2bbc165f6b0fee698b855d6 Author: Simon Ser Date: Sun Feb 8 22:47:26 2026 +0000 drm/fourcc: fix plane order for 10/12/16-bit YCbCr formats The short comments had the correct order, but the long comments had the planes reversed. Fixes: 2271e0a20ef7 ("drm: drm_fourcc: add 10/12/16bit software decoder YCbCr formats") Signed-off-by: Simon Ser Reviewed-by: Daniel Stone Reviewed-by: Robert Mader Link: https://patch.msgid.link/20260208224718.57199-1-contact@emersion.fr commit a86039b76e5d1e886d42ec28f569a9ef76409750 Author: Thomas Zimmermann Date: Tue Feb 10 10:43:32 2026 +0100 fbcon: Declare struct fb_info.fbcon_par as of type struct fbcon_par The only correct type for the field fbcon_par in struct fb_info is struct fbcon_par. Declare is as such. The field is a pointer to fbcon-private data. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 30baedeeeab524172abc0b58cb101e8df86b5be8 Author: Thomas Zimmermann Date: Mon Feb 9 17:15:43 2026 +0100 fbcon: Remove struct fbcon_display.inverse The field inverse in struct fbcon_display is unused. Remove it. Signed-off-by: Thomas Zimmermann Cc: # v6.0+ Signed-off-by: Helge Deller commit ce4e25198a6aaaaf36248edf8daf3d744ec8e309 Author: Felix Gu Date: Tue Feb 3 20:14:58 2026 +0800 fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() In au1200fb_drv_probe(), when platform_get_irq fails(), it directly returns from the function with an error code, which causes a memory leak. Replace it with a goto label to ensure proper cleanup. Fixes: 4e88761f5f8c ("fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe") Signed-off-by: Felix Gu Signed-off-by: Helge Deller commit b28da0d092461ac239ff034a8ac3129320177ba3 Author: René Rebe Date: Thu Feb 5 16:49:58 2026 +0100 fbdev: ffb: fix corrupted video output on Sun FFB1 Fix Sun FFB1 corrupted video out ([1] and [2]) by disabling overlay and initializing window mode to a known state. The issue never appeared on my FFB2+/vertical nor Elite3D/M6. It could also depend on the PROM version. /SUNW,ffb@1e,0: FFB at 000001fc00000000, type 11, DAC pnum[236c] rev[10] manuf_rev[4] X (II) /dev/fb0: Detected FFB1, Z-buffer, Single-buffered. X (II) /dev/fb0: BT9068 (PAC1) ramdac detected (with normal cursor control) X (II) /dev/fb0: Detected Creator/Creator3D [1] https://www.instagram.com/p/DUTcSmSjSem/ [2] https://chaos.social/@ReneRebe/116023241660154102 Signed-off-by: René Rebe Cc: stable@kernel.org Signed-off-by: Helge Deller commit c39ee2d264f98efa14aa46c9942114cb03c7baa6 Author: Felix Gu Date: Sat Jan 31 20:48:33 2026 +0800 fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() Use for_each_child_of_node_scoped instead of for_each_child_of_node to ensure automatic of_node_put on early exit paths, preventing device node reference leak. Fixes: cc3f414cf2e4 ("video: add of helper for display timings/videomode") Signed-off-by: Felix Gu Signed-off-by: Helge Deller commit c595c19602cea955e23b8957e109f2da26407f8d Author: Chintan Patel Date: Wed Jan 21 19:16:35 2026 -0800 staging: fbtft: Make framebuffer registration message debug-only The framebuffer registration message is informational only and not useful during normal operation. Convert it to debug-level logging to keep the driver quiet when working correctly. Suggested-by: Greg Kroah-Hartman Reviewed-by: Andy Shevchenko Signed-off-by: Chintan Patel Signed-off-by: Helge Deller commit be26a07c61af5fe8eafbd3d172d4b6ab726d99d0 Author: Chintan Patel Date: Wed Jan 21 19:16:34 2026 -0800 staging: fbtft: Fix build failure when CONFIG_FB_DEVICE=n When CONFIG_FB_DEVICE is disabled, struct fb_info does not provide a valid dev pointer. Direct dereferences of fb_info->dev therefore result in build failures. Fix this by avoiding direct accesses to fb_info->dev and switching the affected debug logging to framebuffer helpers that do not rely on a device pointer. This fixes the following build failure reported by the kernel test robot. Fixes: a06d03f9f238 ("staging: fbtft: Make FB_DEVICE dependency optional") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601110740.Y9XK5HtN-lkp@intel.com Reviewed-by: Andy Shevchenko Signed-off-by: Chintan Patel Signed-off-by: Helge Deller commit cbfb9c715f33a07a46d577fe8d62869eb6363064 Author: Chen Ni Date: Thu Jan 29 12:07:14 2026 +0800 fbdev: au1100fb: Check return value of clk_enable() in .resume() Check the return value of clk_enable() in au1100fb_drv_resume() and return the error on failure. This ensures the system is aware of the resume failure and can track its state accurately. Signed-off-by: Chen Ni Acked-by: Uwe Kleine-König Signed-off-by: Helge Deller commit 8e9bf8b9e8c0a3e1ef16dd48260a113f65ed01d2 Author: Sebastian Andrzej Siewior Date: Mon Jan 26 19:08:36 2026 +0100 printk, vt, fbcon: Remove console_conditional_schedule() do_con_write(), fbcon_redraw.*() invoke console_conditional_schedule() which is a conditional scheduling point based on printk's internal variables console_may_schedule. It may only be used if the console lock is acquired for instance via console_lock() or console_trylock(). Prinkt sets the internal variable to 1 (and allows to schedule) if the console lock has been acquired via console_lock(). The trylock does not allow it. The console_conditional_schedule() invocation in do_con_write() is invoked shortly before console_unlock(). The console_conditional_schedule() invocation in fbcon_redraw.*() original from fbcon_scroll() / vt's con_scroll() which originate from a line feed. In console_unlock() the variable is set to 0 (forbids to schedule) and it tries to schedule while making progress printing. This is brand new compared to when console_conditional_schedule() was added in v2.4.9.11. In v2.6.38-rc3, console_unlock() (started its existence) iterated over all consoles and flushed them with disabled interrupts. A scheduling attempt here was not possible, it relied that a long print scheduled before console_unlock(). Since commit 8d91f8b15361d ("printk: do cond_resched() between lines while outputting to consoles"), which appeared in v4.5-rc1, console_unlock() attempts to schedule if it was allowed to schedule while during console_lock(). Each record is idealy one line so after every line feed. This console_conditional_schedule() is also only relevant on PREEMPT_NONE and PREEMPT_VOLUNTARY builds. In other configurations cond_resched() becomes a nop and has no impact. I'm bringing this all up just proof that it is not required anymore. It becomes a problem on a PREEMPT_RT build with debug code enabled because that might_sleep() in cond_resched() remains and triggers a warnings. This is due to legacy_kthread_func-> console_flush_one_record -> vt_console_print-> lf -> con_scroll -> fbcon_scroll and vt_console_print() acquires a spinlock_t which does not allow a voluntary schedule. There is no need to fb_scroll() to schedule since console_flush_one_record() attempts to schedule after each line. !PREEMPT_RT is not affected because the legacy printing thread is only enabled on PREEMPT_RT builds. Therefore I suggest to remove console_conditional_schedule(). Cc: Simona Vetter Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Fixes: 5f53ca3ff83b4 ("printk: Implement legacy printer kthread for PREEMPT_RT") Signed-off-by: Sebastian Andrzej Siewior Acked-by: Greg Kroah-Hartman Acked-by: Petr Mladek # from printk() POV Signed-off-by: Helge Deller commit 4a16b380333d2a07a4b3ceadee3ac2a320d266ef Author: Osama Abdelkader Date: Tue Jan 27 20:30:55 2026 +0100 fbdev: fix fb_pad_unaligned_buffer mask mask is u8, so it should use 0xff instead of 0xfff Signed-off-by: Osama Abdelkader Signed-off-by: Helge Deller commit eacf9840ae1285a1ef47eb0ce16d786e542bd4d7 Author: Weigang He Date: Fri Jan 16 09:57:51 2026 +0000 fbdev: of: display_timing: fix refcount leak in of_get_display_timings() of_parse_phandle() returns a device_node with refcount incremented, which is stored in 'entry' and then copied to 'native_mode'. When the error paths at lines 184 or 192 jump to 'entryfail', native_mode's refcount is not decremented, causing a refcount leak. Fix this by changing the goto target from 'entryfail' to 'timingfail', which properly calls of_node_put(native_mode) before cleanup. Fixes: cc3f414cf2e4 ("video: add of helper for display timings/videomode") Cc: stable@vger.kernel.org Signed-off-by: Weigang He Signed-off-by: Helge Deller commit 88b3b9924337336a31cefbe99a22ed09401be74a Author: Thomas Fourier Date: Mon Jan 12 15:00:27 2026 +0100 fbdev: vt8500lcdfb: fix missing dma_free_coherent() fbi->fb.screen_buffer is allocated with dma_alloc_coherent() but is not freed if the error path is reached. Fixes: e7b995371fe1 ("video: vt8500: Add devicetree support for vt8500-fb and wm8505-fb") Cc: Signed-off-by: Thomas Fourier Signed-off-by: Helge Deller commit 994fcd4b107d747bee88888a849dcdd00cf739ba Author: Vincent Mailhol Date: Sat Jan 10 13:23:24 2026 +0100 video/logo: don't select LOGO_LINUX_MONO and LOGO_LINUX_VGA16 by default Nowadays, nearly all systems have a color depth of eight or more and are thus able to display the clut224 logo. This means that the monochrome and vga16 logos will never be displayed on an average machine and are thus just a waste of bytes. Set CONFIG_LOGO_LINUX_MONO and CONFIG_LOGO_LINUX_VGA16 configuration symbols to no by default. Signed-off-by: Vincent Mailhol Signed-off-by: Helge Deller commit ac6d088b3b20f9efb883e8302288276db3bdc2b8 Author: Vincent Mailhol Date: Thu Jan 8 20:04:55 2026 +0100 video/logo: move logo selection logic to Kconfig Now that the path to the logo file can be directly entered in Kbuild, there is no more need to handle all the logo file selection in the Makefile and the C files. The only exception is the logo_spe_clut224 which is only used by the Cell processor (found for example in the Playstation 3) [1]. This extra logo uses its own different image which shows up on a separate line just below the normal logo. Because the extra logo uses a different image, it can not be factorized under the custom logo logic. Move all the logo file selection logic to Kbuild (except from the logo_spe_clut224.ppm), this done, clean-up the C code to only leave one entry for each logo type (monochrome, 16-colors and 224-colors). [1] Cell SPE logos Link: https://lore.kernel.org/all/20070710122702.765654000@pademelon.sonytel.be/ Signed-off-by: Vincent Mailhol Signed-off-by: Helge Deller commit 3092718e1280fcbdfc4f4b4a3258be8992a0c244 Author: Vincent Mailhol Date: Thu Jan 8 20:04:54 2026 +0100 video/logo: remove logo_mac_clut224 The logo_mac_clut224 depends on the runtime value MACH_IS_MAC being true to be displayed. This makes that logo a one-of-a-kind, as it is the only one whose selection can not be decided at compile time. This dynamic logo selection logic conflicts with our upcoming plans to simplify the logo selection code. Considering that the logo_mac_clut224 is only used by the Macintosh 68k, a machine whose sales ended some thirty years ago and which thus represents a very small user base, it is preferable to resolve the conflict in favour of code simplicity. Remove the logo_mac_clut224 so that the logo selection can be statically determined at compile time. The users who wish to continue using that logo can still download it from [1] and add: CONFIG_LOGO_LINUX_CLUT224=y CONFIG_LOGO_LINUX_CLUT224_FILE="/path/to/logo_mac_clut224.ppm" to their configuration file to restore it. [1] logo_mac_clut224.ppm file Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/drivers/video/logo/logo_mac_clut224.ppm?h=v6.18 Signed-off-by: Vincent Mailhol Signed-off-by: Helge Deller commit 9db021e6cbd6c9b4c8548ee5387d3b4c9372a011 Author: Vincent Mailhol Date: Thu Jan 8 20:04:53 2026 +0100 sh: defconfig: remove CONFIG_LOGO_SUPERH_* CONFIG_LOGO_SUPERH_MONO, CONFIG_LOGO_SUPERH_VGA16 and CONFIG_LOGO_SUPERH_CLUT224 will be removed in an upcoming change but are still referenced in some of the defconfig. Remove all the occurrences of CONFIG_LOGO_SUPERH_*. Signed-off-by: Vincent Mailhol Signed-off-by: Helge Deller commit 555cdf5242fd75c7d5fd01a93d72342d50483003 Author: Vincent Mailhol Date: Thu Jan 8 20:04:52 2026 +0100 newport_con: depend on LOGO_LINUX_CLUT224 instead of LOGO_SGI_CLUT224 newport_show_logo() is only activated if CONFIG_LOGO_SGI_CLUT224 is set (otherwise it is a NOP). This configuration item will be removed in an upcoming change so instead, make it depend on LOGO_LINUX_CLUT224. Signed-off-by: Vincent Mailhol Signed-off-by: Helge Deller commit dfa6ce636cb8faeaef02b09c973400a410004edf Author: Vincent Mailhol Date: Thu Jan 8 20:04:51 2026 +0100 video/logo: allow custom logo Some people like to replace the default Tux boot logo by an image of their own. There exist a few tutorials here [1] and there [2]. But this requires modifying the source tree which is a bit cumbersome. Add a string entry in Kbuild for each of the logo categories (monochrome, 16-colors, 224-colors). The string entry takes a path to a .pbm or .ppm image allowing the user to more easily provide a custom logo without having to modify the sources. Add an help entry with a short hint on how to convert images to the portable pixmap file format. Update the Makefile accordingly. When converted to .c file, the logo will have one of these fixed file name: - logo_linux_mono.c - logo_linux_vga16.c - logo_linux_clut224.c: depending on the image type and this regardless of the name of the .pgm/.ppm source filename. This will allow for further simplifications in an upcoming change. [1] ArmadeuS Project wiki -- Linux Boot Logo Link: https://www.armadeus.org/wiki/index.php?title=Linux_Boot_Logo [2] Timesys -- How To Use a Custom Boot Logo / Splash Screen Link: https://linuxlink.timesys.com/docs/wiki/engineering/HOWTO_Use_a_custom_boot_logo Signed-off-by: Vincent Mailhol Signed-off-by: Helge Deller commit a7aa2b512b141afe638b715f7b84c1588cdc9845 Author: Vincent Mailhol Date: Thu Jan 8 20:04:50 2026 +0100 video/logo: add a type parameter to the logo makefile function When translating a portable pixmap file into a .c file, the pnmtologo tool expects to receive the image type (either mono, vga16 or clut224) as an argument under the -t option. Currently, this information is stored in the file name. Because we will allow for custom logo in an upcoming change, it is preferable to decouple the image name from its type. Add a new $2 parameter to the Makefile logo function which contains the image type. Update all the individual targets to provide this new argument. Signed-off-by: Vincent Mailhol Signed-off-by: Helge Deller commit 672b35216282199fa2906fb32697a25a686a1adc Author: Vincent Mailhol Date: Thu Jan 8 20:04:49 2026 +0100 video/logo: remove orphan .pgm Makefile rule The kernel has no actual grey-scale logos. And looking at the git history, it seems that there never was one (or maybe there was in the pre-git history? I did not check that far…) Remove the Makefile rule for the .pgm grey scale images. Signed-off-by: Vincent Mailhol Reviewed-by: Geert Uytterhoeven Signed-off-by: Helge Deller commit b3dce279c900ea6b46431b86c9804b4738ff0ec2 Author: Dan Carpenter Date: Thu Jan 8 23:00:57 2026 +0300 fbdev: omapfb: remove duplicate check in omapfb_setup_mem() We know "size" is non-zero because it is checked on the line before. Delete the duplicate check and pull the code in a tab. Signed-off-by: Dan Carpenter Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit c2925992232fdc4e90f030b77e7867921db071b5 Author: Chintan Patel Date: Tue Jan 6 20:42:57 2026 -0800 fbdev: sh_mobile_lcdc: Make FB_DEVICE dependency optional The sh_mobile_lcdc driver exposes overlay configuration via sysfs, but the core driver does not require CONFIG_FB_DEVICE. Make overlay sysfs optional so that the driver can build and operate even when FB_DEVICE is disabled. The kernel naturally ignores the missing attribute group, preserving buildability and type safety. Suggested-by: Helge Deller Signed-off-by: Chintan Patel Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit bf9ec461a7d1b82bbc3fe110fba9e9533879849d Author: Chintan Patel Date: Tue Jan 6 20:42:56 2026 -0800 fbdev: omapfb: Make FB_DEVICE dependency optional omapfb provides several sysfs interfaces for framebuffer configuration and debugging, but these are not required for the core driver. Remove the hard dependency on CONFIG_FB_DEVICE and make sysfs support optional by using dev_of_fbinfo() to obtain the backing device at runtime. When FB_DEVICE is disabled, sysfs operations are skipped while the code still builds and is type-checked. Suggested-by: Helge Deller Signed-off-by: Chintan Patel Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 553d8a6e512abbddf37b7baa2bde8de691704856 Author: Chintan Patel Date: Tue Jan 6 20:42:55 2026 -0800 staging: fbtft: Make FB_DEVICE dependency optional fbtft provides sysfs interfaces for debugging and gamma configuration, but these are not required for the core driver. Drop the hard dependency on CONFIG_FB_DEVICE and make sysfs support optional by using dev_of_fbinfo() at runtime. When FB_DEVICE is disabled, sysfs operations are skipped while the code remains buildable and type-checked. Suggested-by: Thomas Zimmermann Suggested-by: Helge Deller Reviewed-by: Helge Deller Signed-off-by: Chintan Patel Reviewed-by: Andy Shevchenko Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 39b65316fe9d6d3f730632408ace28d49c5845a4 Author: Chintan Patel Date: Tue Jan 6 20:42:54 2026 -0800 fb: Add dev_of_fbinfo() helper for optional sysfs support Add dev_of_fbinfo() to return the framebuffer struct device when CONFIG_FB_DEVICE is enabled, or NULL otherwise. This allows fbdev drivers to use sysfs interfaces via runtime checks instead of CONFIG_FB_DEVICE ifdefs, keeping the code clean while remaining fully buildable. Suggested-by: Helge Deller Reviewed-by: Helge Deller Reviewed-by: Andy Shevchenko Signed-off-by: Chintan Patel Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 8f582bcd132cf1290e1fbd56b9f783dabe637dd4 Author: Prasanna Kumar T S M Date: Fri Dec 26 20:31:46 2025 -0800 drm/hyperv: Remove reference to hyperv_fb driver Remove hyperv_fb reference as the driver is removed. Signed-off-by: Prasanna Kumar T S M Signed-off-by: Helge Deller commit d65f2978f3632cd0cf08d95514a579dcc9eefe57 Author: Prasanna Kumar T S M Date: Fri Dec 26 20:27:02 2025 -0800 drivers: hv: vmbus_drv: Remove reference to hpyerv_fb Remove hyperv_fb reference as the driver is removed. Signed-off-by: Prasanna Kumar T S M Signed-off-by: Helge Deller commit 011a0502801c8536f64141a2b61362c14f456544 Author: Andrey Vatoropin Date: Wed Dec 17 09:11:05 2025 +0000 fbcon: check return value of con2fb_acquire_newinfo() If fbcon_open() fails when called from con2fb_acquire_newinfo() then info->fbcon_par pointer remains NULL which is later dereferenced. Add check for return value of the function con2fb_acquire_newinfo() to avoid it. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: d1baa4ffa677 ("fbcon: set_con2fb_map fixes") Cc: stable@vger.kernel.org Signed-off-by: Andrey Vatoropin Signed-off-by: Helge Deller commit 40227f2efcfb7148fdee8d69ba52301951ef8a32 Author: Prasanna Kumar T S M Date: Fri Dec 26 20:24:46 2025 -0800 fbdev: hyperv_fb: Remove hyperv_fb driver The HyperV DRM driver is available since 5.14. This makes the hyperv_fb driver redundant, remove it. Signed-off-by: Prasanna Kumar T S M Signed-off-by: Helge Deller commit 68eeb0871e986ae5462439dae881e3a27bcef85f Author: Hans de Goede Date: Sun Dec 21 17:57:40 2025 +0100 fbdev: Use device_create_with_groups() to fix sysfs groups registration race The fbdev sysfs attributes are registered after sending the uevent for the device creation, leaving a race window where e.g. udev rules may not be able to access the sysfs attributes because the registration is not done yet. Fix this by switching to device_create_with_groups(). This also results in a nice cleanup. After switching to device_create_with_groups() all that is left of fb_init_device() is setting the drvdata and that can be passed to device_create[_with_groups]() too. After which fb_init_device() can be completely removed. Dropping fb_init_device() + fb_cleanup_device() in turn allows removing fb_info.class_flag as they were the only user of this field. Fixes: 5fc830d6aca1 ("fbdev: Register sysfs groups through device_add_group") Cc: stable@vger.kernel.org Cc: Shixiong Ou Signed-off-by: Hans de Goede Signed-off-by: Helge Deller commit 120adae7b42faa641179270c067864544a50ab69 Author: Greg Kroah-Hartman Date: Sun Dec 28 14:17:03 2025 +0100 fbdev: smscufx: properly copy ioctl memory to kernelspace The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from userspace to kernelspace, and instead directly references the memory, which can cause problems if invalid data is passed from userspace. Fix this all up by correctly copying the memory before accessing it within the kernel. Reported-by: Tianchu Chen Cc: stable Cc: Steve Glendinning Cc: Helge Deller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Helge Deller commit 0209e21e3c372fa2da04c39214bec0b64e4eb5f4 Author: Guangshuo Li Date: Sun Dec 7 15:25:32 2025 +0800 fbdev: rivafb: fix divide error in nv3_arb() A userspace program can trigger the RIVA NV3 arbitration code by calling the FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver recomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz (derived from the PRAMDAC MCLK PLL) as a divisor without validating it first. In a normal setup, state->mclk_khz is provided by the real hardware and is non-zero. However, an attacker can construct a malicious or misconfigured device (e.g. a crafted/emulated PCI device) that exposes a bogus PLL configuration, causing state->mclk_khz to become zero. Once nv3_get_param() calls nv3_arb(), the division by state->mclk_khz in the gns calculation causes a divide error and crashes the kernel. Fix this by checking whether state->mclk_khz is zero and bailing out before doing the division. The following log reveals it: rivafb: setting virtual Y resolution to 2184 divide error: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline] RIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546 Call Trace: nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603 nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline] CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246 riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779 rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196 fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188 __x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Signed-off-by: Helge Deller commit f043a93fff9e3e3e648b6525483f59104b0819fa Author: Cui Chao Date: Fri Feb 13 14:03:47 2026 +0800 mm: numa_memblks: Identify the accurate NUMA ID of CFMW In some physical memory layout designs, the address space of CFMW (CXL Fixed Memory Window) resides between multiple segments of system memory belonging to the same NUMA node. In numa_cleanup_meminfo, these multiple segments of system memory are merged into a larger numa_memblk. When identifying which NUMA node the CFMW belongs to, it may be incorrectly assigned to the NUMA node of the merged system memory. When a CXL RAM region is created in userspace, the memory capacity of the newly created region is not added to the CFMW-dedicated NUMA node. Instead, it is accumulated into an existing NUMA node (e.g., NUMA0 containing RAM). This makes it impossible to clearly distinguish between the two types of memory, which may affect memory-tiering applications. Example memory layout: Physical address space: 0x00000000 - 0x1FFFFFFF System RAM (node0) 0x20000000 - 0x2FFFFFFF CXL CFMW (node2) 0x40000000 - 0x5FFFFFFF System RAM (node0) 0x60000000 - 0x7FFFFFFF System RAM (node1) After numa_cleanup_meminfo, the two node0 segments are merged into one: 0x00000000 - 0x5FFFFFFF System RAM (node0) // CFMW is inside the range 0x60000000 - 0x7FFFFFFF System RAM (node1) So the CFMW (0x20000000-0x2FFFFFFF) will be incorrectly assigned to node0. To address this scenario, accurately identifying the correct NUMA node can be achieved by checking whether the region belongs to both numa_meminfo and numa_reserved_meminfo. While this issue is only observed in a QEMU configuration, and no known end users are impacted by this problem, it is likely that some firmware implementation is leaving memory map holes in a CXL Fixed Memory Window. CXL hotplug depends on mapping free window capacity, and it seems to be only a coincidence to have not hit this problem yet. Fixes: 779dd20cfb56 ("cxl/region: Add region creation support") Signed-off-by: Cui Chao Cc: stable@vger.kernel.org Reviewed-by: Jonathan Cameron Reviewed-by: Gregory Price Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260213060347.2389818-2-cuichao1753@phytium.com.cn Signed-off-by: Mike Rapoport (Microsoft) commit 8e61cfc5f52c7673f12bc8e993f4ebb811136b16 Author: Steve French Date: Sat Dec 13 12:48:49 2025 -0600 cifs: update internal module version number to 2.59 Signed-off-by: Steve French commit 770aaedb461a055f79b971d538678942b6607894 Merge: 3c6e577d5ae705 8c5d862fcb2116 Author: Linus Torvalds Date: Fri Feb 13 19:33:39 2026 -0800 Merge tag 'bootconfig-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig updates from Masami Hiramatsu: - Update the bootconfig parser to stop searching for a value when it encounters a newline character - Update the tests for bootconfig parser to ensure the good examples to be parsed correctly by comparing the expected results * tag 'bootconfig-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: Check the parsed output of the good examples bootconfig: Terminate value search if it hits a newline commit 3c6e577d5ae705edebed9882ff474d7a48a47dd2 Merge: f50822fd8675c6 53b2fae90ff01f Author: Linus Torvalds Date: Fri Feb 13 19:25:16 2026 -0800 Merge tag 'trace-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: "User visible changes: - Add an entry into MAINTAINERS file for RUST versions of code There's now RUST code for tracing and static branches. To differentiate that code from the C code, add entries in for the RUST version (with "[RUST]" around it) so that the right maintainers get notified on changes. - New bitmask-list option added to tracefs When this is set, bitmasks in trace event are not displayed as hex numbers, but instead as lists: e.g. 0-5,7,9 instead of 0000015f - New show_event_filters file in tracefs Instead of having to search all events/*/*/filter for any active filters enabled in the trace instance, the file show_event_filters will list them so that there's only one file that needs to be examined to see if any filters are active. - New show_event_triggers file in tracefs Instead of having to search all events/*/*/trigger for any active triggers enabled in the trace instance, the file show_event_triggers will list them so that there's only one file that needs to be examined to see if any triggers are active. - Have traceoff_on_warning disable trace pintk buffer too Recently recording of trace_printk() could go to other trace instances instead of the top level instance. But if traceoff_on_warning triggers, it doesn't stop the buffer with trace_printk() and that data can easily be lost by being overwritten. Have traceoff_on_warning also disable the instance that has trace_printk() being written to it. - Update the hist_debug file to show what function the field uses When CONFIG_HIST_TRIGGERS_DEBUG is enabled, a hist_debug file exists for every event. This displays the internal data of any histogram enabled for that event. But it is lacking the function that is called to process one of its fields. This is very useful information that was missing when debugging histograms. - Up the histogram stack size from 16 to 31 Stack traces can be used as keys for event histograms. Currently the size of the stack that is stored is limited to just 16 entries. But the storage space in the histogram is 256 bytes, meaning that it can store up to 31 entries (plus one for the count of entries). Instead of letting that space go to waste, up the limit from 16 to 31. This makes the keys much more useful. - Fix permissions of per CPU file buffer_size_kb The per CPU file of buffer_size_kb was incorrectly set to read only in a previous cleanup. It should be writable. - Reset "last_boot_info" if the persistent buffer is cleared The last_boot_info shows address information of a persistent ring buffer if it contains data from a previous boot. It is cleared when recording starts again, but it is not cleared when the buffer is reset. The data is useless after a reset so clear it on reset too. Internal changes: - A change was made to allow tracepoint callbacks to have preemption enabled, and instead be protected by SRCU. This required some updates to the callbacks for perf and BPF. perf needed to disable preemption directly in its callback because it expects preemption disabled in the later code. BPF needed to disable migration, as its code expects to run completely on the same CPU. - Have irq_work wake up other CPU if current CPU is "isolated" When there's a waiter waiting on ring buffer data and a new event happens, an irq work is triggered to wake up that waiter. This is noisy on isolated CPUs (running NO_HZ_FULL). Trigger an IPI to a house keeping CPU instead. - Use proper free of trigger_data instead of open coding it in. - Remove redundant call of event_trigger_reset_filter() It was called immediately in a function that was called right after it. - Workqueue cleanups - Report errors if tracing_update_buffers() were to fail. - Make the enum update workqueue generic for other parts of tracing On boot up, a work queue is created to convert enum names into their numbers in the trace event format files. This work queue can also be used for other aspects of tracing that takes some time and shouldn't be called by the init call code. The blk_trace initialization takes a bit of time. Have the initialization code moved to the new tracing generic work queue function. - Skip kprobe boot event creation call if there's no kprobes defined on cmdline The kprobe initialization to set up kprobes if they are defined on the cmdline requires taking the event_mutex lock. This can be held by other tracing code doing initialization for a long time. Since kprobes added to the kernel command line need to be setup immediately, as they may be tracing early initialization code, they cannot be postponed in a work queue and must be setup in the initcall code. If there's no kprobe on the kernel cmdline, there's no reason to take the mutex and slow down the boot up code waiting to get the lock only to find out there's nothing to do. Simply exit out early if there's no kprobes on the kernel cmdline. If there are kprobes on the cmdline, then someone cares more about tracing over the speed of boot up. - Clean up the trigger code a bit - Move code out of trace.c and into their own files trace.c is now over 11,000 lines of code and has become more difficult to maintain. Start splitting it up so that related code is in their own files. Move all the trace_printk() related code into trace_printk.c. Move the __always_inline stack functions into trace.h. Move the pid filtering code into a new trace_pid.c file. - Better define the max latency and snapshot code The latency tracers have a "max latency" buffer that is a copy of the main buffer and gets swapped with it when a new high latency is detected. This keeps the trace up to the highest latency around where this max_latency buffer is never written to. It is only used to save the last max latency trace. A while ago a snapshot feature was added to tracefs to allow user space to perform the same logic. It could also enable events to trigger a "snapshot" if one of their fields hit a new high. This was built on top of the latency max_latency buffer logic. Because snapshots came later, they were dependent on the latency tracers to be enabled. In reality, the latency tracers depend on the snapshot code and not the other way around. It was just that they came first. Restructure the code and the kconfigs to have the latency tracers depend on snapshot code instead. This actually simplifies the logic a bit and allows to disable more when the latency tracers are not defined and the snapshot code is. - Fix a "false sharing" in the hwlat tracer code The loop to search for latency in hardware was using a variable that could be changed by user space for each sample. If the user change this variable, it could cause a bus contention, and reading that variable can show up as a large latency in the trace causing a false positive. Read this variable at the start of the sample with a READ_ONCE() into a local variable and keep the code from sharing cache lines with readers. - Fix function graph tracer static branch optimization code When only one tracer is defined for function graph tracing, it uses a static branch to call that tracer directly. When another tracer is added, it goes into loop logic to call all the registered callbacks. The code was incorrect when going back to one tracer and never re-enabled the static branch again to do the optimization code. - And other small fixes and cleanups" * tag 'trace-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (46 commits) function_graph: Restore direct mode when callbacks drop to one tracing: Fix indentation of return statement in print_trace_fmt() tracing: Reset last_boot_info if ring buffer is reset tracing: Fix to set write permission to per-cpu buffer_size_kb tracing: Fix false sharing in hwlat get_sample() tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection tracing: Better separate SNAPSHOT and MAX_TRACE options tracing: Add tracer_uses_snapshot() helper to remove #ifdefs tracing: Rename trace_array field max_buffer to snapshot_buffer tracing: Move pid filtering into trace_pid.c tracing: Move trace_printk functions out of trace.c and into trace_printk.c tracing: Use system_state in trace_printk_init_buffers() tracing: Have trace_printk functions use flags instead of using global_trace tracing: Make tracing_update_buffers() take NULL for global_trace tracing: Make printk_trace global for tracing system tracing: Move ftrace_trace_stack() out of trace.c and into trace.h tracing: Move __trace_buffer_{un}lock_*() functions to trace.h tracing: Make tracing_selftest_running global to the tracing subsystem tracing: Make tracing_disabled global for tracing system tracing: Clean up use of trace_create_maxlat_file() ... commit f50822fd8675c68d294e89bd102f7b487ca3acd3 Merge: 1b49e363252632 5a5203a45b063a Author: Linus Torvalds Date: Fri Feb 13 15:39:15 2026 -0800 Merge tag 'platform-drivers-x86-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: "Highlights: - amd/pmf: - Avoid overwriting BIOS input values when events occur rapidly - Fix PMF driver issues related to S4 (in part on crypto/ccp side) - Add NPU metrics API (for accel side consumers) - Allow disabling Smart PC function through a module parameter - asus-wmi & HID/asus: - Unification of backlight control (replaces quirks) - Support multiple interfaces for controlling keyboard/RGB brightness - Simplify init sequence - hp-wmi: - Add manual fan control for Victus S models - Add fan mode keep-alive - Fix platform profile values for Omen 16-wf1xxx - Add EC offset to get the thermal profile - intel/pmc: Show substate residencies also for non-primary PMCs - intel/ISST: - Store and restore data for all domains - Write interface improvements - lenovo-wmi: - Support multiple Capability Data - Add HWMON reporting and tuning support - mellanox/mlx-platform: Add HI173 & HI174 support - surface/aggregator_registry: Add Surface Pro 11 (QCOM) - thinkpad_acpi: Add support for HW damage detection capability - uniwill: Implement cTGP setting - wmi: - Introduce marshalling support - Convert a few drivers to use the new buffer-based WMI API - tools/power/x86/intel-speed-select: Allow read operations for non-root - Miscellaneous cleanups / refactoring / improvements" * tag 'platform-drivers-x86-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (68 commits) platform/x86: lenovo-wmi-{capdata,other}: Fix HWMON channel visibility platform/x86: hp-wmi: Add EC offsets to read Victus S thermal profile platform: mellanox: mlx-platform: Add support DGX flavor of next-generation 800GB/s ethernet switch. platform: mellanox: mlx-platform: Add support for new Nvidia DGX system based on class VMOD0010 HID: asus: add support for the asus-wmi brightness handler platform/x86: asus-wmi: add keyboard brightness event handler platform/x86: asus-wmi: remove unused keyboard backlight quirk HID: asus: listen to the asus-wmi brightness device instead of creating one platform/x86: asus-wmi: Add support for multiple kbd led handlers HID: asus: early return for ROG devices HID: asus: move vendor initialization to probe HID: asus: fortify keyboard handshake HID: asus: use same report_id in response HID: asus: initialize additional endpoints only for certain devices HID: asus: simplify RGB init sequence platform/wmi: string-kunit: Add missing oversized string test case platform/x86/amd/pmf: Added a module parameter to disable the Smart PC function platform/x86/uniwill: Implement cTGP setting platform/x86: uniwill-laptop: Introduce device descriptor system platform/x86/amd: Use scope-based cleanup for wbrf_record() ... commit 1b49e363252632d0493546511a41a65ed1a6fbbb Merge: 72f05009d804c7 7e96d76c74175e Author: Linus Torvalds Date: Fri Feb 13 15:06:58 2026 -0800 Merge tag 'mtd/for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "MTD: - prioritize ofpart in physmap-core probing - conversions to scoped for each OF child loops Bindings: - The bulk of the changes consists of binding fixes/updates to restrict the use of undefined properties, which was mostly ineffective in the current form because of the nesting of partition nodes and the lack of compatible strings - YAML conversions and the addition of a dma-coherent property in the cdns,hp-nfc driver SPI NAND: - support for octal DTR modes (8D-8D-8D) - support for Foresee F35SQB002G chips And small misc fixes" * tag 'mtd/for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (65 commits) mtd: spi-nor: hisi-sfc: fix refcounting bug in hisi_spi_nor_register_all() mtd: spinand: fix NULL pointer dereference in spinand_support_vendor_ops() mtd: rawnand: pl353: Add message about ECC mode mtd: rawnand: pl353: Fix software ECC support mtd: spinand: winbond: Remove unneeded semicolon dt-bindings: mtd: cdns,hp-nfc: Add dma-coherent property mtd: spinand: Disable continuous read during probe mtd: spinand: add Foresee F35SQB002G flash support mtd: spinand: winbond: W35N octal DTR support mtd: spinand: Add octal DTR support mtd: spinand: Warn if using SSDR-only vendor commands in a non SSDR mode mtd: spinand: Give the bus interface to the configuration helper mtd: spinand: Propagate the bus interface across core helpers mtd: spinand: Add support for setting a bus interface mtd: spinand: Gather all the bus interface steps in one single function mtd: spinand: winbond: Configure the IO mode after the dummy cycles mtd: spinand: winbond: Rename IO_MODE register macro mtd: spinand: winbond: Fix style mtd: spinand: winbond: Register W35N vendor specific operation mtd: spinand: winbond: Register W25N vendor specific operation ... commit 72f05009d804c7ec92459da94ccc9ccb77686950 Merge: 44331bd6a6107a 8a840ab0567ff2 Author: Linus Torvalds Date: Fri Feb 13 14:51:39 2026 -0800 Merge tag 'dma-mapping-7.0-2026-02-13' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping update from Marek Szyprowski: "A small code cleanup for the DMA-mapping subsystem: removal of unused hooks (Robin Murphy)" * tag 'dma-mapping-7.0-2026-02-13' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: Remove dma_mark_clean (again) commit b0b1a8583d8e797114e613139e3e3318a1704690 Author: Anton Protopopov Date: Fri Feb 13 21:29:49 2026 +0000 bpf: Add a map/btf from a fd array more consistently The add_fd_from_fd_array() function takes a file descriptor as a parameter and tries to add either map or btf to the corresponding list of used objects. As was reported by Dan Carpenter, since the commit c81e4322acf0 ("bpf: Fix a potential use-after-free of BTF object"), the fdget() is called twice on the file descriptor, and thus userspace, potentially, can replace the file pointed to by the file descriptor in between the two calls. On practice, this shouldn't break anything on the kernel side, but for consistency fix the code such that only one fdget() is executed. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/aY689z7gHNv8rgVO@stanley.mountain/ Fixes: ccd2d799ed44 ("bpf: Fix a potential use-after-free of BTF object") Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20260213212949.759321-1-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit de516a9167e4634cadee1e7ff13fd08e2a122bf0 Merge: 2669dde7a8c67e 0265c1fd912ee0 Author: Alexei Starovoitov Date: Wed Feb 11 13:17:14 2026 -0800 Merge branch 'bpf-fsession-support-for-riscv' Menglong Dong says: ==================== bpf: fsession support for riscv Implement bpf fsession for the riscv architecture. Changes v4 -> v3: * fix the build error * v3: https://lore.kernel.org/bpf/20260206122002.1494125-1-dongml2@chinatelecom.cn/ Changes v3 -> v2: * fix some comments. * v2: https://lore.kernel.org/bpf/20260206115823.1070354-1-dongml2@chinatelecom.cn/T/#t Changes v2 -> v1: * use bpf_prog_calls_session_cookie() in invoke_bpf() in the 2nd patch. * v1: https://lore.kernel.org/bpf/20260203055231.1088479-1-dongml2@chinatelecom.cn/ ==================== Link: https://patch.msgid.link/20260208053311.698352-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 2669dde7a8c67e3efe8052d75d6040de2cbb5e5a Author: Kumar Kartikeya Dwivedi Date: Wed Feb 11 10:57:47 2026 -0800 selftests/bpf: Fix map_kptr grace period wait Commit c27cea4416a3 ("rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast") broke map_kptr selftest since it removed the function we were kprobing. Use a new kfunc that invokes call_rcu_tasks_trace and sets a program provided pointer to an integer to 1. Technically this can be unsafe if the memory being written to from the callback disappears, but this is just for usage in a test where we ensure we spin until we see the value to be set to 1, so it's ok. Reported-by: Shung-Hsi Yu Fixes: c27cea4416a3 ("rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast") Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260211185747.3630539-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 0265c1fd912ee0ea0cb00c539fb73e99578a866d Author: Menglong Dong Date: Sun Feb 8 13:33:11 2026 +0800 selftests/bpf: enable fsession_test on riscv64 Now that the RISC-V trampoline JIT supports BPF_TRACE_FSESSION, run the fsession selftest on riscv64 as well as x86_64. Signed-off-by: Menglong Dong Tested-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/r/20260208053311.698352-4-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov Reviewed-by: Pu Lehui Signed-off-by: Alexei Starovoitov commit 48f624c3dc71c2b807ce138bb70d1f5216532874 Author: Ihor Solodrai Date: Tue Feb 10 15:58:55 2026 -0800 selftests/bpf: Adjust selftest due to function rename do_filp_open() was renamed in commit 541003b576c3 ("rename do_filp_open() to do_file_open()") This broke test_profiler, because it uses a kretprobe on that function. Fix it by renaming accordingly. Reported-by: Shung-Hsi Yu Closes: https://lore.kernel.org/bpf/djwjf2vfb7gro3rfag666bojod6ytcectahnb5z6hx2hawimtj@sx47ghzjg4lw/ Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260210235855.215679-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 35b3515be0ecb9dd82e9b237d8c3b0f6b2057f2e Author: Menglong Dong Date: Sun Feb 8 13:33:10 2026 +0800 bpf, riscv: add fsession support for trampolines Implement BPF_TRACE_FSESSION support in the RISC-V trampoline JIT. The logic here is similar to what we did in x86_64. In order to simply the logic, we factor out the function invoke_bpf() for fentry and fexit. Signed-off-by: Menglong Dong Tested-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/r/20260208053311.698352-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov Reviewed-by: Pu Lehui Signed-off-by: Alexei Starovoitov commit ccd2d799ed4467c07f5ee18c2f5c59bcc990822c Author: Anton Protopopov Date: Mon Feb 9 13:29:04 2026 +0000 bpf: Fix a potential use-after-free of BTF object Refcounting in the check_pseudo_btf_id() function is incorrect: the __check_pseudo_btf_id() function might get called with a zero refcounted btf. Fix this, and patch related code accordingly. v3: rephrase a comment (AI) v2: fix a refcount leak introduced in v1 (AI) Reported-by: syzbot+5a0f1995634f7c1dadbf@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5a0f1995634f7c1dadbf Fixes: 76145f725532 ("bpf: Refactor check_pseudo_btf_id") Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20260209132904.63908-1-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 93fd420d71beed5f17e690921acfdee252b4e234 Author: Menglong Dong Date: Sun Feb 8 13:33:09 2026 +0800 bpf, riscv: introduce emit_store_stack_imm64() for trampoline Introduce a helper to store 64-bit immediate on the trampoline stack with a help of a register. Signed-off-by: Menglong Dong Tested-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/r/20260208053311.698352-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov Reviewed-by: Pu Lehui Signed-off-by: Alexei Starovoitov commit 04999b99e81eaa7b6223ec1c03af3bcb4ac57aaa Author: Amery Hung Date: Mon Feb 9 15:01:34 2026 -0800 libbpf: Fix invalid write loop logic in bpf_linker__add_buf() Fix bpf_linker__add_buf()'s logic of copying data from memory buffer into memfd. In the event of short write not writing entire buf_sz bytes into memfd file, we'll append bytes from the beginning of buf *again* (corrupting ELF file contents) instead of correctly appending the rest of not-yet-read buf contents. Closes: https://github.com/libbpf/libbpf/issues/945 Fixes: 6d5e5e5d7ce1 ("libbpf: Extend linker API to support in-memory ELF files") Signed-off-by: Amery Hung Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20260209230134.3530521-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 728ff167910ef16e97717719c749ddf4064c653b Author: Emil Tsalapatis Date: Tue Feb 10 13:45:32 2026 -0500 libbpf: Add gating for arena globals relocation feature Add feature gating for the arena globals relocation introduced in commit c1f61171d44b. The commit depends on a previous commit in the same patchset that is absent from older kernels (12a1fe6e12db "bpf/verifier: Do not limit maximum direct offset into arena map"). Without this commit, arena globals relocation with arenas >= 512MiB fails to load and breaks libbpf's backwards compatibility. Introduce a libbpf feature to check whether the running kernel allows for full range ldimm64 offset, and only relocate arena globals if it does. Fixes: c1f61171d44b ("libbpf: Move arena globals to the end of the arena") Signed-off-by: Emil Tsalapatis Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260210184532.255475-1-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 85d0bd1d4cccd8e91e11de2d5dddf9691d780468 Author: Rafael J. Wysocki Date: Fri Feb 13 19:26:48 2026 +0100 ACPI: driver: Drop driver_data pointer clearing from two drivers It is not necessary to clear the driver_data pointer in the ACPI companion device object on driver remove in the EC and SMBUS HC ACPI drivers because that pointer is not used there any more after recent changes. Drop the unnecessary statements. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/6242843.lOV4Wx5bFT@rafael.j.wysocki commit 2995e713d8a76249bde325b464183430e21266aa Author: Rafael J. Wysocki Date: Fri Feb 13 19:25:43 2026 +0100 ACPI: video: Clear driver_data pointer on remove After commit 02c057ddefef ("ACPI: video: Convert the driver to a platform one") the driver_data pointer in the ACPI companion device object is not cleared automatically on driver remove any more, so clear it directly in acpi_video_bus_remove(). Fixes: 02c057ddefef ("ACPI: video: Convert the driver to a platform one") Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12840288.O9o76ZdvQC@rafael.j.wysocki commit 0b87d51690dd5131cbe9fbd23746b037aab89815 Author: Franz Schnyder Date: Fri Feb 6 13:37:36 2026 +0100 drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used Fallback to polling to detect hotplug events on systems without interrupts. On systems where the interrupt line of the bridge is not connected, the bridge cannot notify hotplug events. Only add the DRM_BRIDGE_OP_HPD flag if an interrupt has been registered otherwise remain in polling mode. Fixes: 55e8ff842051 ("drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type") Cc: stable@vger.kernel.org # 6.16: 9133bc3f0564: drm/bridge: ti-sn65dsi86: Add Signed-off-by: Franz Schnyder Reviewed-by: Douglas Anderson [dianders: Adjusted Fixes/stable line based on discussion] Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260206123758.374555-1-fra.schnyder@gmail.com commit ee5492fd88cfc079c19fbeac78e9e53b7f6c04f3 Author: Chengfeng Ye Date: Wed Feb 11 19:13:29 2026 +0000 fbnic: close fw_log race between users and teardown Fixes a theoretical race on fw_log between the teardown path and fw_log write functions. fw_log is written inside fbnic_fw_log_write() and can be reached from the mailbox handler fbnic_fw_msix_intr(), but fw_log is freed before IRQ/MBX teardown during cleanup, resulting in a potential data race of dereferencing a freed/null variable. Possible Interleaving Scenario: CPU0: fbnic_fw_msix_intr() // Entry fbnic_fw_log_write() if (fbnic_fw_log_ready()) // true ... preempt ... CPU1: fbnic_remove() // Entry fbnic_fw_log_free() vfree(log->data_start); log->data_start = NULL; CPU0: continues, walks log->entries or writes to log->data_start The initialization also has an incorrect order problem, as the fw_log is currently allocated after MBX setup during initialization. Fix the problems by adjusting the synchronization order to put initialization in place before the mailbox is enabled, and not cleared until after the mailbox has been disabled. Fixes: ecc53b1b46c89 ("eth: fbnic: Enable firmware logging") Signed-off-by: Chengfeng Ye Link: https://patch.msgid.link/20260211191329.530886-1-dg573847474@gmail.com Signed-off-by: Jakub Kicinski commit 36e838630c111a510f47e49d559bd26aba7d9a1b Merge: a49d2a2c37a625 6a997f38bdf822 Author: Jakub Kicinski Date: Fri Feb 13 12:28:40 2026 -0800 Merge branch 'vsock-fix-child-netns-mode-initialization-and-restriction' Stefano Garzarella says: ==================== vsock: fix child netns mode initialization and restriction This series fixes two issues in the vsock network namespace support recently introduced by commit eafb64f40ca4 ("vsock: add netns to vsock core"). Patch 1 fixes `child_ns_mode` being always hardcoded to "global" for new namespaces, breaking propagation of the "local" mode through nested namespaces. Patch 2 prevents a "local" namespace from switching `child_ns_mode` to "global", which would allow nested namespaces to escape vsock isolation and access global CIDs. ==================== Link: https://patch.msgid.link/20260212205916.97533-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit 6a997f38bdf822d4c5cc10b445ff1cb26872580a Author: Stefano Garzarella Date: Thu Feb 12 21:59:16 2026 +0100 vsock: prevent child netns mode switch from local to global A "local" namespace can change its `child_ns_mode` sysctl to "global", allowing nested namespaces to access global CIDs. This can be exploited by an unprivileged user who gained CAP_NET_ADMIN through a user namespace. Prevent this by rejecting writes that attempt to set `child_ns_mode` to "global" when the current namespace's mode is "local". Fixes: eafb64f40ca4 ("vsock: add netns to vsock core") Cc: bobbyeshleman@meta.com Signed-off-by: Stefano Garzarella Reviewed-by: Bobby Eshleman Link: https://patch.msgid.link/20260212205916.97533-3-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit 9dd391493a727464e9a03cfff9356c8e10b8da0b Author: Stefano Garzarella Date: Thu Feb 12 21:59:15 2026 +0100 vsock: fix child netns mode initialization When a new network namespace is created, vsock_net_init() correctly initializes the namespace's mode by reading the parent's `child_ns_mode` via vsock_net_child_mode(). However, the `child_ns_mode` of the new namespace was always hardcoded to VSOCK_NET_MODE_GLOBAL, regardless of its own mode. This means that if a parent namespace has `child_ns_mode` set to "local", the child namespace correctly gets mode "local", but its `child_ns_mode` is reset to "global". As a result, further nested namespaces will incorrectly get mode "global" instead of inheriting "local", breaking the expected propagation of the mode through nested namespaces. Fix this by initializing `child_ns_mode` to the namespace's own mode, so the setting propagates correctly through all levels of nesting. Fixes: eafb64f40ca4 ("vsock: add netns to vsock core") Cc: bobbyeshleman@meta.com Signed-off-by: Stefano Garzarella Reviewed-by: Bobby Eshleman Link: https://patch.msgid.link/20260212205916.97533-2-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit a49d2a2c37a6252c41cbdd505f9d1c58d5a3817a Author: Daniel Machon Date: Thu Feb 12 12:02:30 2026 +0100 net: sparx5/lan969x: fix PTP clock max_adj value The max_adj field in ptp_clock_info tells userspace how much the PHC clock frequency can be adjusted. ptp4l reads this and will never request a correction larger than max_adj. On both sparx5 and lan969x the clock offset may never converge because the servo needs a frequency correction larger than the current max_adj of 200000 (200 ppm) allows. The servo rails at the max and the offset stays in the tens of microseconds. The hardware has no inherent max adjustment limit; frequency correction is done by writing a 64-bit clock period increment to CLK_PER_CFG, and the register has plenty of range. The 200000 value was just an overly conservative software limit. The max_adj is shared between sparx5 and lan969x, and the increased value is safe for both. Fix this by increasing max_adj to 10000000 (10000 ppm), giving the servo sufficient headroom. Fixes: 0933bd04047c ("net: sparx5: Add support for ptp clocks") Signed-off-by: Daniel Machon Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260212-sparx5-ptp-max-adj-v2-v1-1-06b200e50ce3@microchip.com Signed-off-by: Jakub Kicinski commit 8244f959e2c125c849e569f5b23ed49804cce695 Author: Kuniyuki Iwashima Date: Wed Feb 11 17:50:21 2026 +0000 ipv6: Fix out-of-bound access in fib6_add_rt2node(). syzbot reported out-of-bound read in fib6_add_rt2node(). [0] When IPv6 route is created with RTA_NH_ID, struct fib6_info does not have the trailing struct fib6_nh. The cited commit started to check !iter->fib6_nh->fib_nh_gw_family to ensure that rt6_qualify_for_ecmp() will return false for iter. If iter->nh is not NULL, rt6_qualify_for_ecmp() returns false anyway. Let's check iter->nh before reading iter->fib6_nh and avoid OOB read. [0]: BUG: KASAN: slab-out-of-bounds in fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142 Read of size 1 at addr ffff8880384ba6de by task syz.0.18/5500 CPU: 0 UID: 0 PID: 5500 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142 fib6_add_rt2node_nh net/ipv6/ip6_fib.c:1363 [inline] fib6_add+0x910/0x18c0 net/ipv6/ip6_fib.c:1531 __ip6_ins_rt net/ipv6/route.c:1351 [inline] ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3957 inet6_rtm_newroute+0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9316b9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd8809b678 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f9316e15fa0 RCX: 00007f9316b9aeb9 RDX: 0000000000000000 RSI: 0000200000004380 RDI: 0000000000000003 RBP: 00007f9316c08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9316e15fac R14: 00007f9316e15fa0 R15: 00007f9316e15fa0 Allocated by task 5499: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_noprof+0x40c/0x7e0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] fib6_info_alloc+0x30/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x142/0x860 net/ipv6/route.c:3820 ip6_route_add+0x49/0x1b0 net/ipv6/route.c:3949 inet6_rtm_newroute+0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: bbf4a17ad9ff ("ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF") Reported-by: syzbot+707d6a5da1ab9e0c6f9d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/698cbfba.050a0220.2eeac1.009d.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Fernando Fernandez Mancera Reviewed-by: Shigeru Yoshida Link: https://patch.msgid.link/20260211175133.3657034-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 6db8b56eed62baacaf37486e83378a72635c04cc Author: Qanux Date: Wed Feb 11 12:04:12 2026 +0800 ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much data to write for each node. It trusts this field as-is from the incoming packet, with no consistency check against trace->type (the 24-bit field that tells which data items are present). A crafted packet can set nodelen=0 while setting type bits 0-21, causing the function to write ~100 bytes past the allocated region (into skb_shared_info), which corrupts adjacent heap memory and leads to a kernel panic. Add a shared helper ioam6_trace_compute_nodelen() in ioam6.c to derive the expected nodelen from the type field, and use it: - in ioam6_iptunnel.c (send path, existing validation) to replace the open-coded computation; - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose nodelen is inconsistent with the type field, before any data is written. Per RFC 9197, bits 12-21 are each short (4-octet) fields, so they are included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to 0xff1ffc00). Fixes: 9ee11f0fff20 ("ipv6: ioam: Data plane support for Pre-allocated Trace") Cc: stable@vger.kernel.org Signed-off-by: Junxi Qian Reviewed-by: Justin Iurman Link: https://patch.msgid.link/20260211040412.86195-1-qjx1298677004@gmail.com Signed-off-by: Jakub Kicinski commit a68a9bd086c2822d0c629443bd16ad1317afe501 Author: Pin-yen Lin Date: Mon Feb 9 16:59:36 2026 -0800 selftests: netconsole: Increase port listening timeout wait_for_port() can wait up to 2 seconds with the sleep and the polling in wait_local_port_listen() combined. So, in netcons_basic.sh, the socat process could die before the test writes to the netconsole. Increase the timeout to 3 seconds to make netcons_basic.sh pass consistently. Fixes: 3dc6c76391cb ("selftests: net: Add IPv6 support to netconsole basic tests") Signed-off-by: Pin-yen Lin Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260210005939.3230550-1-treapking@google.com Signed-off-by: Jakub Kicinski commit 44331bd6a6107a33f8082521b227ffa4ec063a40 Merge: a353e7260b5951 61dc9f776705d6 Author: Linus Torvalds Date: Fri Feb 13 12:13:27 2026 -0800 Merge tag 'mm-hotfixes-stable-2026-02-13-07-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: "Three MM hotfixes, all three are cc:stable" * tag 'mm-hotfixes-stable-2026-02-13-07-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: procfs: fix possible double mmput() in do_procmap_query() mm/page_alloc: skip debug_check_no_{obj,locks}_freed with FPI_TRYLOCK mm/hugetlb: restore failed global reservations to subpool commit 51496091dd37b405e6e399a9638da3f1da3f4c64 Author: Len Brown Date: Fri Feb 13 13:38:02 2026 -0600 tools/power turbostat: version 2026.02.14 Since release 2025.12.02: Add L2 statistics columns for recent Intel processors: L2MRPS = L2 Cache M-References Per Second L2%hit = L2 Cache Hit % Sort work and output by cpu# rather than core# This commit: Version number and white space (indent -l160) No functional change. Signed-off-by: Len Brown commit 96718ad296af4a6d984b3a09276b165ab6a3b0c8 Author: Len Brown Date: Fri Feb 13 13:26:12 2026 -0600 tools/power turbostat: Fix and document --header_iterations The "header_iterations" option is commonly used to de-clutter the screen of redundant header label rows in an interactive session: Eg. every 10 rows: $ sudo turbostat --header_iterations 10 -S -q -i 1 But --header_iterations was missing from turbostat.8 Also turbostat help advertised the "-N" short option that did not actually work: $ turbostat --help -N, --header_iterations num print header every num iterations Repair "-N" Document "--header_iterations" on turbostat.8 Signed-off-by: Len Brown commit 8e5c0cc326f2e95a71bb6e6063e65caa60c8f951 Author: Kaushlendra Kumar Date: Mon Dec 8 08:38:04 2025 +0530 tools/power turbostat: Use strtoul() for iteration parsing Replace strtod() with strtoul() and check errno for -n/-N options, since num_iterations and header_iterations are unsigned long counters. Reject zero and conversion errors; negative inputs wrap to large positive values per standard unsigned semantics. Signed-off-by: Kaushlendra Kumar Signed-off-by: Len Brown commit a2b4d0f8bf07a4a4fe8a526e10c45e593c7a3bf0 Author: Len Brown Date: Thu Feb 12 14:04:25 2026 -0600 tools/power turbostat: Favor cpu# over core# Turbostat collects statistics and outputs results in "topology order", which means it prioritizes the core# over the cpu#. The strategy is to minimize wakesups to a core -- which is important when measuring an idle system. But core order is problematic, because Linux core#'s are physical (within each package), and thus subject to APIC-id scrambling that may be done by the hardware or the BIOS. As a result users may be are faced with rows in a confusing order: sudo turbostat -q --show topology,Busy%,CPU%c6,UncMHz sleep 1 Core CPU Busy% CPU%c6 UncMHz - - 1.25 72.18 3400 0 4 7.74 0.00 1 5 1.77 88.59 2 6 0.48 96.73 3 7 0.21 98.34 4 8 0.14 96.85 5 9 0.26 97.55 6 10 0.44 97.24 7 11 0.12 96.18 8 0 5.41 0.31 3400 8 1 0.19 12 2 0.41 0.22 12 3 0.08 32 12 0.04 99.21 33 13 0.25 94.92 Abandon the legacy "core# topology order" in favor of simply ordering by cpu#, with a special case to handle HT siblings that may not have adjacent cpu#'s. sudo ./turbostat -q --show topology,Busy%,CPU%c6,UncMHz sleep 1 1.003001 sec Core CPU Busy% CPU%c6 UncMHz - - 1.38 80.55 1600 8 0 10.94 0.00 1600 8 1 0.53 12 2 2.90 0.45 12 3 0.11 0 4 1.96 91.20 1 5 0.97 96.40 2 6 0.24 94.72 3 7 0.31 98.01 4 8 0.20 98.20 5 9 0.62 96.00 6 10 0.06 98.15 7 11 0.12 99.31 32 12 0.04 99.07 33 13 0.27 95.09 The result is that cpu#'s now take precedence over core#'s. Signed-off-by: Len Brown commit a353e7260b5951a62dce43630ae9265accd96a4b Merge: cb5573868ea85d ebcff9dacaf2c1 Author: Linus Torvalds Date: Fri Feb 13 12:02:18 2026 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: - in-order support in virtio core - multiple address space support in vduse - fixes, cleanups all over the place, notably dma alignment fixes for non-cache-coherent systems * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (59 commits) vduse: avoid adding implicit padding vhost: fix caching attributes of MMIO regions by setting them explicitly vdpa/mlx5: update MAC address handling in mlx5_vdpa_set_attr() vdpa/mlx5: reuse common function for MAC address updates vdpa/mlx5: update mlx_features with driver state check crypto: virtio: Replace package id with numa node id crypto: virtio: Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req crypto: virtio: Add spinlock protection with virtqueue notification Documentation: Add documentation for VDUSE Address Space IDs vduse: bump version number vduse: add vq group asid support vduse: merge tree search logic of IOTLB_GET_FD and IOTLB_GET_INFO ioctls vduse: take out allocations from vduse_dev_alloc_coherent vduse: remove unused vaddr parameter of vduse_domain_free_coherent vduse: refactor vdpa_dev_add for goto err handling vhost: forbid change vq groups ASID if DRIVER_OK is set vdpa: document set_group_asid thread safety vduse: return internal vq group struct as map token vduse: add vq group support vduse: add v1 API definition ... commit cb5573868ea85ddbc74dd9a917acd1e434d21390 Merge: c87c79345ea8ff b1195183ed42f1 Author: Linus Torvalds Date: Fri Feb 13 11:31:15 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM updates from Paolo Bonzini: "Loongarch: - Add more CPUCFG mask bits - Improve feature detection - Add lazy load support for FPU and binary translation (LBT) register state - Fix return value for memory reads from and writes to in-kernel devices - Add support for detecting preemption from within a guest - Add KVM steal time test case to tools/selftests ARM: - Add support for FEAT_IDST, allowing ID registers that are not implemented to be reported as a normal trap rather than as an UNDEF exception - Add sanitisation of the VTCR_EL2 register, fixing a number of UXN/PXN/XN bugs in the process - Full handling of RESx bits, instead of only RES0, and resulting in SCTLR_EL2 being added to the list of sanitised registers - More pKVM fixes for features that are not supposed to be exposed to guests - Make sure that MTE being disabled on the pKVM host doesn't give it the ability to attack the hypervisor - Allow pKVM's host stage-2 mappings to use the Force Write Back version of the memory attributes by using the "pass-through' encoding - Fix trapping of ICC_DIR_EL1 on GICv5 hosts emulating GICv3 for the guest - Preliminary work for guest GICv5 support - A bunch of debugfs fixes, removing pointless custom iterators stored in guest data structures - A small set of FPSIMD cleanups - Selftest fixes addressing the incorrect alignment of page allocation - Other assorted low-impact fixes and spelling fixes RISC-V: - Fixes for issues discoverd by KVM API fuzzing in kvm_riscv_aia_imsic_has_attr(), kvm_riscv_aia_imsic_rw_attr(), and kvm_riscv_vcpu_aia_imsic_update() - Allow Zalasr, Zilsd and Zclsd extensions for Guest/VM - Transparent huge page support for hypervisor page tables - Adjust the number of available guest irq files based on MMIO register sizes found in the device tree or the ACPI tables - Add RISC-V specific paging modes to KVM selftests - Detect paging mode at runtime for selftests s390: - Performance improvement for vSIE (aka nested virtualization) - Completely new memory management. s390 was a special snowflake that enlisted help from the architecture's page table management to build hypervisor page tables, in particular enabling sharing the last level of page tables. This however was a lot of code (~3K lines) in order to support KVM, and also blocked several features. The biggest advantages is that the page size of userspace is completely independent of the page size used by the guest: userspace can mix normal pages, THPs and hugetlbfs as it sees fit, and in fact transparent hugepages were not possible before. It's also now possible to have nested guests and guests with huge pages running on the same host - Maintainership change for s390 vfio-pci - Small quality of life improvement for protected guests x86: - Add support for giving the guest full ownership of PMU hardware (contexted switched around the fastpath run loop) and allowing direct access to data MSRs and PMCs (restricted by the vPMU model). KVM still intercepts access to control registers, e.g. to enforce event filtering and to prevent the guest from profiling sensitive host state. This is more accurate, since it has no risk of contention and thus dropped events, and also has significantly less overhead. For more information, see the commit message for merge commit bf2c3138ae36 ("Merge tag 'kvm-x86-pmu-6.20' ...") - Disallow changing the virtual CPU model if L2 is active, for all the same reasons KVM disallows change the model after the first KVM_RUN - Fix a bug where KVM would incorrectly reject host accesses to PV MSRs when running with KVM_CAP_ENFORCE_PV_FEATURE_CPUID enabled, even if those were advertised as supported to userspace, - Fix a bug with protected guest state (SEV-ES/SNP and TDX) VMs, where KVM would attempt to read CR3 configuring an async #PF entry - Fail the build if EXPORT_SYMBOL_GPL or EXPORT_SYMBOL is used in KVM (for x86 only) to enforce usage of EXPORT_SYMBOL_FOR_KVM_INTERNAL. Only a few exports that are intended for external usage, and those are allowed explicitly - When checking nested events after a vCPU is unblocked, ignore -EBUSY instead of WARNing. Userspace can sometimes put the vCPU into what should be an impossible state, and spurious exit to userspace on -EBUSY does not really do anything to solve the issue - Also throw in the towel and drop the WARN on INIT/SIPI being blocked when vCPU is in Wait-For-SIPI, which also resulted in playing whack-a-mole with syzkaller stuffing architecturally impossible states into KVM - Add support for new Intel instructions that don't require anything beyond enumerating feature flags to userspace - Grab SRCU when reading PDPTRs in KVM_GET_SREGS2 - Add WARNs to guard against modifying KVM's CPU caps outside of the intended setup flow, as nested VMX in particular is sensitive to unexpected changes in KVM's golden configuration - Add a quirk to allow userspace to opt-in to actually suppress EOI broadcasts when the suppression feature is enabled by the guest (currently limited to split IRQCHIP, i.e. userspace I/O APIC). Sadly, simply fixing KVM to honor Suppress EOI Broadcasts isn't an option as some userspaces have come to rely on KVM's buggy behavior (KVM advertises Supress EOI Broadcast irrespective of whether or not userspace I/O APIC supports Directed EOIs) - Clean up KVM's handling of marking mapped vCPU pages dirty - Drop a pile of *ancient* sanity checks hidden behind in KVM's unused ASSERT() macro, most of which could be trivially triggered by the guest and/or user, and all of which were useless - Fold "struct dest_map" into its sole user, "struct rtc_status", to make it more obvious what the weird parameter is used for, and to allow fropping these RTC shenanigans if CONFIG_KVM_IOAPIC=n - Bury all of ioapic.h, i8254.h and related ioctls (including KVM_CREATE_IRQCHIP) behind CONFIG_KVM_IOAPIC=y - Add a regression test for recent APICv update fixes - Handle "hardware APIC ISR", a.k.a. SVI, updates in kvm_apic_update_apicv() to consolidate the updates, and to co-locate SVI updates with the updates for KVM's own cache of ISR information - Drop a dead function declaration - Minor cleanups x86 (Intel): - Rework KVM's handling of VMCS updates while L2 is active to temporarily switch to vmcs01 instead of deferring the update until the next nested VM-Exit. The deferred updates approach directly contributed to several bugs, was proving to be a maintenance burden due to the difficulty in auditing the correctness of deferred updates, and was polluting "struct nested_vmx" with a growing pile of booleans - Fix an SGX bug where KVM would incorrectly try to handle EPCM page faults, and instead always reflect them into the guest. Since KVM doesn't shadow EPCM entries, EPCM violations cannot be due to KVM interference and can't be resolved by KVM - Fix a bug where KVM would register its posted interrupt wakeup handler even if loading kvm-intel.ko ultimately failed - Disallow access to vmcb12 fields that aren't fully supported, mostly to avoid weirdness and complexity for FRED and other features, where KVM wants enable VMCS shadowing for fields that conditionally exist - Print out the "bad" offsets and values if kvm-intel.ko refuses to load (or refuses to online a CPU) due to a VMCS config mismatch x86 (AMD): - Drop a user-triggerable WARN on nested_svm_load_cr3() failure - Add support for virtualizing ERAPS. Note, correct virtualization of ERAPS relies on an upcoming, publicly announced change in the APM to reduce the set of conditions where hardware (i.e. KVM) *must* flush the RAP - Ignore nSVM intercepts for instructions that are not supported according to L1's virtual CPU model - Add support for expedited writes to the fast MMIO bus, a la VMX's fastpath for EPT Misconfig - Don't set GIF when clearing EFER.SVME, as GIF exists independently of SVM, and allow userspace to restore nested state with GIF=0 - Treat exit_code as an unsigned 64-bit value through all of KVM - Add support for fetching SNP certificates from userspace - Fix a bug where KVM would use vmcb02 instead of vmcb01 when emulating VMLOAD or VMSAVE on behalf of L2 - Misc fixes and cleanups x86 selftests: - Add a regression test for TPR<=>CR8 synchronization and IRQ masking - Overhaul selftest's MMU infrastructure to genericize stage-2 MMU support, and extend x86's infrastructure to support EPT and NPT (for L2 guests) - Extend several nested VMX tests to also cover nested SVM - Add a selftest for nested VMLOAD/VMSAVE - Rework the nested dirty log test, originally added as a regression test for PML where KVM logged L2 GPAs instead of L1 GPAs, to improve test coverage and to hopefully make the test easier to understand and maintain guest_memfd: - Remove kvm_gmem_populate()'s preparation tracking and half-baked hugepage handling. SEV/SNP was the only user of the tracking and it can do it via the RMP - Retroactively document and enforce (for SNP) that KVM_SEV_SNP_LAUNCH_UPDATE and KVM_TDX_INIT_MEM_REGION require the source page to be 4KiB aligned, to avoid non-trivial complexity for something that no known VMM seems to be doing and to avoid an API special case for in-place conversion, which simply can't support unaligned sources - When populating guest_memfd memory, GUP the source page in common code and pass the refcounted page to the vendor callback, instead of letting vendor code do the heavy lifting. Doing so avoids a looming deadlock bug with in-place due an AB-BA conflict betwee mmap_lock and guest_memfd's filemap invalidate lock Generic: - Fix a bug where KVM would ignore the vCPU's selected address space when creating a vCPU-specific mapping of guest memory. Actually this bug could not be hit even on x86, the only architecture with multiple address spaces, but it's a bug nevertheless" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (267 commits) KVM: s390: Increase permitted SE header size to 1 MiB MAINTAINERS: Replace backup for s390 vfio-pci KVM: s390: vsie: Fix race in acquire_gmap_shadow() KVM: s390: vsie: Fix race in walk_guest_tables() KVM: s390: Use guest address to mark guest page dirty irqchip/riscv-imsic: Adjust the number of available guest irq files RISC-V: KVM: Transparent huge page support RISC-V: KVM: selftests: Add Zalasr extensions to get-reg-list test RISC-V: KVM: Allow Zalasr extensions for Guest/VM KVM: riscv: selftests: Add riscv vm satp modes KVM: riscv: selftests: add Zilsd and Zclsd extension to get-reg-list test riscv: KVM: allow Zilsd and Zclsd extensions for Guest/VM RISC-V: KVM: Skip IMSIC update if vCPU IMSIC state is not initialized RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() RISC-V: KVM: Remove unnecessary 'ret' assignment KVM: s390: Add explicit padding to struct kvm_s390_keyop KVM: LoongArch: selftests: Add steal time test case LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side LoongArch: KVM: Add paravirt preempt feature in hypervisor side ... commit afdfb71c018e9a0aa2e51fb8186d3fb1acdd3f0e Author: Nathan Chancellor Date: Fri Feb 13 01:45:13 2026 -0500 kbuild: rpm-pkg: Fix manual debuginfo generation when using .src.rpm Commit 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") added uses of OBJCOPY and READELF, variables from Kbuild. These variables are defined and work properly when using the binrpm-pkg target because rpmbuild is run within Kbuild. However, these variables are not defined when building from a source RPM package generated with the srcrpm-pkg target, breaking the build when generating the debug info subpackage. Define a default value for these variables so that these commands respect the value from Kbuild but continue to work when built from a source RPM package. Cc: stable@vger.kernel.org Fixes: 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") Reported-by: Lukas Herbolt Closes: https://lore.kernel.org/20260212135855.147906-2-lukas@herbolt.com/ Tested-by: Lukas Herbolt Link: https://patch.msgid.link/20260213-fix-debuginfo-srcrpm-pkg-v1-1-45cd0c0501b9@kernel.org Signed-off-by: Nathan Chancellor commit ffe9ac1ad56df8f915896b97bd7645f522c47ce9 Author: Nathan Chancellor Date: Tue Feb 10 00:04:49 2026 -0700 kernel: rpm-pkg: Restore find-debuginfo.sh approach to -debuginfo package Commit 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") effectively reverted commit a7c699d090a1 ("kbuild: rpm-pkg: build a debuginfo RPM") but the approach it took is not safe for older RPM releases. Restore commit a7c699d090a1 ("kbuild: rpm-pkg: build a debuginfo RPM") for the !CONFIG_MODULE_SIG case to allow more environments and configurations to take advantage of the separate debug information package process. Cc: stable@vger.kernel.org Fixes: 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") Tested-by: Stefano Garzarella Tested-by: Steve French Tested-by: Juergen Gross Acked-by: Nicolas Schier Link: https://patch.msgid.link/20260210-kbuild-fix-debuginfo-rpm-v1-2-0730b92b14bc@kernel.org Signed-off-by: Nathan Chancellor commit 6d6b8b0e28c468263d7fcb071e5cb284ae343df2 Author: Nathan Chancellor Date: Tue Feb 10 00:04:48 2026 -0700 kbuild: rpm-pkg: Restrict manual debug package creation Commit 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") moved away from the built-in RPM machinery for generating -debuginfo packages to a more manual way to be compatible with module signing, as the built-in machinery strips the modules after the installation process, breaking the signatures. Unfortunately, prior to rpm 4.20.0, there is a bug where a custom %files directive is ignored for a -debuginfo subpackage [1], meaning builds using older versions of RPM (such as on RHEL9 or RHEL10) fail with: Checking for unpackaged file(s): /usr/lib/rpm/check-files .../rpmbuild/BUILDROOT/kernel-6.19.0_dirty-1.x86_64 error: Installed (but unpackaged) file(s) found: /debuginfo.list /usr/lib/debug/.build-id/09/748c214974bfba1522d434a7e0a02e2fd7f29b.debug /usr/lib/debug/.build-id/0b/b96dd9c7d3689d82e56d2e73b46f53103cc6c7.debug /usr/lib/debug/.build-id/0e/979a2f34967c7437fd30aabb41de1f0c8b6a66.debug ... To workaround this, restrict the manual debug info package creation process to when it is necessary (CONFIG_MODULE_SIG=y) and possible (when using RPM >= 4.20.0). A follow up change will restore the RPM debuginfo creation process using a separate internal flag to allow the package to be built in more situations, as RPM 4.20.0 is a fairly recent version and the built-in -debuginfo generation works fine when module signing is disabled. Cc: stable@vger.kernel.org Fixes: 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") Link: https://github.com/rpm-software-management/rpm/commit/49f906998f3cf1f4152162ca61ac0869251c380f [1] Reported-by: Steve French Closes: https://lore.kernel.org/CAH2r5mugbrHTwnaQwQiYEUVwbtqmvFYf0WZiLrrJWpgT8iwftw@mail.gmail.com/ Tested-by: Stefano Garzarella Tested-by: Steve French Tested-by: Juergen Gross Acked-by: Nicolas Schier Link: https://patch.msgid.link/20260210-kbuild-fix-debuginfo-rpm-v1-1-0730b92b14bc@kernel.org Signed-off-by: Nathan Chancellor commit c87c79345ea8ff917354e9223d44034e4aef2690 Merge: b52343d1cb47bb 68e25613ed4d06 Author: Linus Torvalds Date: Fri Feb 13 11:24:38 2026 -0800 Merge tag 'uml-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML updates from Johannes Berg: "UML was _really_ quiet, with just four small commits: - two signal handling fixes - dynamic addition of virtio devices - a single code cleanup" * tag 'uml-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: arch/um: remove unused varible err in remove_files_and_dir() um: virtio_uml: Support adding devices via mconsole um: Handle SIGCHLD in seccomp mode like other IRQ signals um: Preserve errno within signal handler commit 59f18d88d96e87e8c1faa171904dae43b19729db Author: Chen-Yu Tsai Date: Thu Feb 12 15:43:07 2026 +0800 scripts/make_fit.py: Drop explicit LZMA parallel compression Parallel compression for LZMA was added using the plzip tool. However plzip produces lzip format output, which is different from the raw LZMA format that the lzma tool produces. This causes depthcharge (the second stage bootloader on Chromebooks) to fail to load the payload. Drop the explicit LZMA parallel compression toolchain. If the lzma tool on the build machine is from xz-utils, then there's a chance parallel compression is already enabled. The xz-utils manpage says the following for the -T (threads) argument: Specify the number of worker threads to use. Setting threads to a special value 0 makes xz use up to as many threads as the processor(s) on the system support. The actual number of threads can be fewer than threads if the input file is not big enough for threading with the given settings or if using more threads would exceed the memory usage limit. [...] The default value for threads is 0. In xz 5.4.x and older the default is 1. Fixes: fcdcf22a34b0 ("scripts/make_fit: Support a few more parallel compressors") Signed-off-by: Chen-Yu Tsai Reviewed-by: Simon Glass Link: https://patch.msgid.link/20260212074308.2189032-1-wenst@chromium.org Signed-off-by: Nathan Chancellor commit be55899b71630c79ad01df54c92e467e47644f87 Author: Mickaël Salaün Date: Thu Feb 12 14:35:43 2026 +0100 kbuild: Fix CC_CAN_LINK detection Most samples cannot be build on some environments because they depend on CC_CAN_LINK, which is set according to the result of scripts/cc-can-link.sh called by cc_can_link_user. Because cc-can-link.sh must now build without warning, it may fail because it is calling printf() with an empty string: + cat + gcc -m32 -Werror -Wl,--fatal-warnings -x c - -o /dev/null : In function ‘main’: :4:9: error: zero-length gnu_printf format string [-Werror=format-zero-length] cc1: all warnings being treated as errors Fix this warning and the samples build by actually printing something. Cc: stable@vger.kernel.org Fixes: d81d9d389b9b ("kbuild: don't enable CC_CAN_LINK if the dummy program generates warnings") Signed-off-by: Mickaël Salaün Reviewed-by: Nicolas Schier Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/20260212133544.1331437-1-mic@digikod.net Signed-off-by: Nathan Chancellor commit b52343d1cb47bb27ca32a3f4952cc2fd3cd165bf Author: Thomas Weißschuh Date: Fri Feb 13 08:39:29 2026 +0100 ARM: clean up the memset64() C wrapper The current logic to split the 64-bit argument into its 32-bit halves is byte-order specific and a bit clunky. Use a union instead which is easier to read and works in all cases. GCC still generates the same machine code. While at it, rename the arguments of the __memset64() prototype to actually reflect their semantics. Signed-off-by: Thomas Weißschuh Signed-off-by: Linus Torvalds commit 0b82cc331d2e23537670878c62c19ee3f4147a93 Author: Ihor Solodrai Date: Fri Feb 13 10:21:36 2026 -0800 selftests/sched_ext: Fix rt_stall flaky failure The rt_stall test measures the runtime ratio between an EXT and an RT task pinned to the same CPU, verifying that the deadline server prevents RT tasks from starving SCHED_EXT tasks. It expects the EXT task to get at least 4% of CPU time. The test is flaky because sched_stress_test() calls sleep(RUN_TIME) immediately after fork(), without waiting for the RT child to complete its setup (set_affinity + set_sched). If the RT child experiences scheduling latency before completing setup, that delay eats into the measurement window: the RT child runs for less than RUN_TIME seconds, and the EXT task's measured ratio drops below the 4% threshold. For example, in the failing CI run [1]: EXT=0.140s RT=4.750s total=4.890s (expected ~5.0s) ratio=2.86% < 4% → FAIL The 110ms gap (5.0 - 4.89) corresponds to the RT child's setup time being counted inside the measurement window, during which fewer deadline server ticks fire for the EXT task. Fix by using pipes to synchronize: each child signals the parent after completing its setup, and the parent waits for both signals before starting sleep(RUN_TIME). This ensures the measurement window only counts time when both tasks are fully configured and competing. [1] https://github.com/kernel-patches/bpf/actions/runs/21961895809/job/63442490449 Fixes: be621a76341c ("selftests/sched_ext: Add test for sched_ext dl_server") Assisted-by: claude-opus-4-6-v1 Signed-off-by: Ihor Solodrai Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit cd7a5651db263b5384aef1950898e5e889425134 Author: Thomas Weißschuh Date: Fri Feb 13 08:35:14 2026 +0100 alpha: add missing address argument in call to page_table_check_pte_clear() After the merge of the alpha and mm trees, this code does not compile, as a parameter is missing in a call to page_table_check_pte_clear(). The parameter was re-added in commit d7b4b67eb6b3 ("mm/page_table_check: reinstate address parameter in [__]page_table_check_pte_clear()"). The alpha-specific code was newly added in commit dd5712f3379c ("alpha: fix user-space corruption during memory compaction"). Fixes: 4cff5c05e076 ("Merge tag 'mm-stable-2026-02-11-19-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm") Signed-off-by: Thomas Weißschuh Acked-by: Magnus Lindholm Signed-off-by: Linus Torvalds commit 7e96d76c74175ef9747f6fc14ee567f89d72153c Merge: 87538275929865 6c7860aa28b81b Author: Miquel Raynal Date: Fri Feb 13 18:10:09 2026 +0100 Merge tag 'nand/for-7.0' into mtd/next SPI NAND - The major feature this release is the support for octal DTR modes (8D-8D-8D). - There has been as well a series of conversion to scoped for each OF child loops. - Support for Foresee F35SQB002G chips has been added. Other changes are small fixes. commit 888a0a802c467bbe34a42167bdf9d7331333440a Author: Felix Gu Date: Thu Feb 12 20:41:40 2026 +0800 spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() platform_get_resource_byname() can return NULL, which would cause a crash when passed the pointer to resource_size(). Move the fiu->memory_size assignment after the error check for devm_ioremap_resource() to prevent the potential NULL pointer dereference. Fixes: 9838c182471e ("spi: wpcm-fiu: Add direct map support") Signed-off-by: Felix Gu Reviewed-by: J. Neuschäfer Link: https://patch.msgid.link/20260212-wpcm-v1-1-5b7c4f526aac@gmail.com Signed-off-by: Mark Brown commit ee5c38a8d31e5dea52299c43c2ec3213351ab6e1 Author: Kees Cook Date: Fri Feb 6 14:30:23 2026 -0800 KVM: arm64: vgic: Handle const qualifier from gic_kvm_info allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "struct gic_kvm_info", but the returned type, while matching, is const qualified. To get them exactly matching, just use the dereferenced pointer for the sizeof(). Signed-off-by: Kees Cook Link: https://patch.msgid.link/20260206223022.it.052-kees@kernel.org Signed-off-by: Marc Zyngier commit 02471a78a052b631204aed051ab718e4d14ae687 Author: Fuad Tabba Date: Fri Feb 13 14:38:15 2026 +0000 KVM: arm64: Remove redundant kern_hyp_va() in unpin_host_sve_state() The `sve_state` pointer in `hyp_vcpu->vcpu.arch` is initialized as a hypervisor virtual address during vCPU initialization in `pkvm_vcpu_init_sve()`. `unpin_host_sve_state()` calls `kern_hyp_va()` on this address. Since `kern_hyp_va()` is idempotent, it's not a bug. However, it is unnecessary and potentially confusing. Remove the redundant conversion. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260213143815.1732675-5-tabba@google.com Signed-off-by: Marc Zyngier commit 7e7c2cf0024d89443a7af52e09e47b1fe634ab17 Author: Fuad Tabba Date: Fri Feb 13 14:38:14 2026 +0000 KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the `kvm` structure for each VM. For non-protected VMs, this structure is initialized from the host's `kvm` state. Currently, `pkvm_init_features_from_host()` copies the `KVM_ARCH_FLAG_ID_REGS_INITIALIZED` flag from the host without the underlying `id_regs` data being initialized. This results in the hypervisor seeing the flag as set while the ID registers remain zeroed. Consequently, `kvm_has_feat()` checks at EL2 fail (return 0) for non-protected VMs. This breaks logic that relies on feature detection, such as `ctxt_has_tcrx()` for TCR2_EL1 support. As a result, certain system registers (e.g., TCR2_EL1, PIR_EL1, POR_EL1) are not saved/restored during the world switch, which could lead to state corruption. Fix this by explicitly copying the ID registers from the host `kvm` to the hypervisor `kvm` for non-protected VMs during initialization, since we trust the host with its non-protected guests' features. Also ensure `KVM_ARCH_FLAG_ID_REGS_INITIALIZED` is cleared initially in `pkvm_init_features_from_host` so that `vm_copy_id_regs` can properly initialize them and set the flag once done. Fixes: 41d6028e28bd ("KVM: arm64: Convert the SVE guest vcpu flag to a vm flag") Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260213143815.1732675-4-tabba@google.com Signed-off-by: Marc Zyngier commit 9cb0468d0b335ccf769bd8e161cc96195e82d8b1 Author: Fuad Tabba Date: Fri Feb 13 14:38:13 2026 +0000 KVM: arm64: Optimise away S1POE handling when not supported by host Although ID register sanitisation prevents guests from seeing the feature, adding this check to the helper allows the compiler to entirely eliminate S1POE-specific code paths (such as context switching POR_EL1) when the host kernel is compiled without support (CONFIG_ARM64_POE is disabled). This aligns with the pattern used for other optional features like SVE (kvm_has_sve()) and FPMR (kvm_has_fpmr()), ensuring no POE logic if the host lacks support, regardless of the guest configuration state. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260213143815.1732675-3-tabba@google.com Signed-off-by: Marc Zyngier commit f66857bafd4f151c5cc6856e47be2e12c1721e43 Author: Fuad Tabba Date: Fri Feb 13 14:38:12 2026 +0000 KVM: arm64: Hide S1POE from guests when not supported by the host When CONFIG_ARM64_POE is disabled, KVM does not save/restore POR_EL1. However, ID_AA64MMFR3_EL1 sanitisation currently exposes the feature to guests whenever the hardware supports it, ignoring the host kernel configuration. If a guest detects this feature and attempts to use it, the host will fail to context-switch POR_EL1, potentially leading to state corruption. Fix this by masking ID_AA64MMFR3_EL1.S1POE in the sanitised system registers, preventing KVM from advertising the feature when the host does not support it (i.e. system_supports_poe() is false). Fixes: 70ed7238297f ("KVM: arm64: Sanitise ID_AA64MMFR3_EL1") Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260213143815.1732675-2-tabba@google.com Signed-off-by: Marc Zyngier commit 6be5c151eb1ebf4d5007b9f60c729f7381255a23 Author: Len Brown Date: Thu Feb 12 23:52:02 2026 -0600 tools/power turbostat: Expunge logical_cpu_id There is only once cpu_id name space -- cpu_id. Expunge the term logical_cpu_id. No functional change. Signed-off-by: Len Brown commit 070e92361eeca21407ce90b582698a877ece5694 Author: Len Brown Date: Thu Feb 12 23:31:02 2026 -0600 tools/power turbostat: Enhance HT enumeration Record the cpu_id of each CPU HT sibling -- will need this later. Rename "thread_id" to "ht_id" to disambiguate that the scope of this id is within a Core -- it is not a global cpu_id. No functional change. Signed-off-by: Len Brown commit ddf60e38ca048842a34eb6e9d7a0d3e7d459df8d Author: Len Brown Date: Thu Feb 12 23:06:47 2026 -0600 tools/power turbostat: Simplify global core_id calculation Standardize the generation of globally unique core_id's in a macro, and simplify the related code. No functional change. Signed-off-by: Len Brown commit a854684986b7056dd1be8730ccce24d0d5a413e9 Author: Len Brown Date: Sun Feb 8 12:18:35 2026 -0600 tools/power turbostat: Unify even/odd/average counter referencing Update the syntax of accesses to the even and odd counters to match the average counters. No functional change. Signed-off-by: Len Brown commit 3cecd4a62d227d86ec6eb5387add0ca3d4d02b27 Author: Len Brown Date: Sun Feb 8 12:08:26 2026 -0600 tools/power turbostat: Allocate average counters dynamically The current static definition of average{} is inconsistent with the dynamically allocated even{} and odd{} counters. Allocate average{} counters dynamically. No functional change. Signed-off-by: Len Brown commit 439632cf95d369ea05841d45d48fbd1d5968d268 Author: Len Brown Date: Sun Feb 8 09:34:34 2026 -0600 tools/power turbostat: Delete core_data.core_id Delete redundant core_data.core_id. Use cpus[].core_id as the single copy of the truth. No functional change. Signed-off-by: Len Brown commit 5e160646f4dbca7cf9cc09abc31a22931e362b8a Author: Len Brown Date: Sun Feb 8 09:25:51 2026 -0600 tools/power turbostat: Rename physical_core_id to core_id The Linux Kernel topology sysfs is flawed. core_id is not globally unique, but is per-package. Turbostat works around this when it needs to, with rapl_core_id = cpus[cpu].core_id; rapl_core_id += cpus[cpu].package_id * nr_cores_per_package Otherwise, turbostat handles core_id as subservient to each package. As there is only one core_id namespace, rename physical_core_id to simply be core_id. No functional change. Signed-off-by: Len Brown commit 4aaf7d07a089696e16e1ca70c2d501dc8a2224a4 Author: Len Brown Date: Sun Feb 8 09:09:25 2026 -0600 tools/power turbostat: Cleanup package_id The kernel topology sysfs uses the name "physical_package_id" because it is allowed to be sparse. Inside Turbostat, that physical package_id namespace is the only package_id namespace, so re-name it to simply be "package_id" in cpus[]. Delete the redundant copy of package_id in pkg_data. Rely instead on the single copy of the truth in cpus[]. No functional change. Signed-off-by: Len Brown commit 54ca69f33cf1b67dd3dc9555fb9d82c83ee3ba89 Author: Len Brown Date: Sat Feb 7 10:17:38 2026 -0600 tools/power turbostat: Cleanup internal use of "base_cpu" Disambiguate the uses "base_cpu": master_cpu: lowest permitted cpu#, read global MSRs here package_data.first_cpu: lowest permitted cpu# in that package core_data.first_cpu: lowest permitted cpu# in the core current_cpu: where I'm running now No functional change. Signed-off-by: Len Brown commit dd23bfe4c317a9b5cbb4edfd36e5b8df12e84b8d Author: Len Brown Date: Wed Jan 21 21:55:39 2026 -0600 tools/power turbostat: Add L2 cache statistics version 2026.02.04 Add support for L2 cache statistics: L2MRPS and L2%hit L2 statistics join the LLC in the "cache" counter group. While the underlying LLC perf kernel support was architectural, L2 perf counters are model-specific: Support Intel Xeon -- Sapphire Rapids and newer. Support Intel Atom -- Gracemont and newer. Support Intel Hybrid -- Alder Lake and newer. Example: alder-lake-n$ sudo turbostat --quiet --show CPU,Busy%,cache my_workload CPU Busy% LLCMRPS LLC%hit L2MRPS L2%hit - 49.82 1210 85.02 2909 31.63 0 99.14 322 88.89 767 32.38 1 0.91 1 32.47 1 18.86 2 0.20 0 40.78 0 23.34 3 99.17 295 81.79 706 31.89 4 0.68 1 58.71 1 15.61 5 99.16 299 85.65 726 31.32 6 0.08 0 45.35 0 31.71 7 99.21 293 83.63 707 30.92 where "my_workload" is a wrapper for a yogini workload that has 4 fully-busy threads with 2MB working set each. Note that analogous to the system summary for multiple LLC systems, the system summary row for the L2 is the aggregate of all CPUS in the system -- there is no per-cache roll-up. Signed-off-by: Len Brown commit baa47c4f89eb2e7614e6a06dd5957632e38c4e74 Author: Keith Busch Date: Tue Feb 10 10:38:09 2026 -0800 nvme-pci: do not try to add queue maps at runtime The block layer allocates the set's maps once. We can't add special purpose queues at runtime if they weren't allocated at initialization time. Tested-by: Kanchan Joshi Reviewed-by: Kanchan Joshi Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 4735b510a00fb2d4ac9e8d21a8c9552cb281f585 Author: Keith Busch Date: Tue Feb 10 11:00:12 2026 -0800 nvme-pci: cap queue creation to used queues If the user reduces the special queue count at runtime and resets the controller, we need to reduce the number of queues and interrupts requested accordingly rather than start with the pre-allocated queue count. Tested-by: Kanchan Joshi Reviewed-by: Kanchan Joshi Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 166e31d7dbf6aa44829b98aa446bda5c9580f12a Author: Keith Busch Date: Tue Feb 10 09:26:54 2026 -0800 nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would race with the now interrupt driven queue and may cause double completions. Reviewed-by: Christoph Hellwig Reviewed-by: Kanchan Joshi Signed-off-by: Keith Busch commit 53b2fae90ff01fede6520ca744ed5e8e366497ba Author: Shengming Hu Date: Fri Feb 13 14:29:32 2026 +0800 function_graph: Restore direct mode when callbacks drop to one When registering a second fgraph callback, direct path is disabled and array loop is used instead. When ftrace_graph_active falls back to one, we try to re-enable direct mode via ftrace_graph_enable_direct(true, ...). But ftrace_graph_enable_direct() incorrectly disables the static key rather than enabling it. This leaves fgraph_do_direct permanently off after first multi-callback transition, so direct fast mode is never restored. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260213142932519cuWSpEXeS4-UnCvNXnK2P@zte.com.cn Fixes: cc60ee813b503 ("function_graph: Use static_call and branch to optimize entry function") Signed-off-by: Shengming Hu Signed-off-by: Steven Rostedt (Google) commit 1abdf9e7967f154b3d4bfe0681dd38b8e036ee63 Author: Rafael J. Wysocki Date: Thu Feb 12 14:33:00 2026 +0100 ACPI: button: Tweak acpi_button_remove() Modify acpi_button_remove() to get the ACPI device object pointer from button->adev instead of retrieving it with the help of the ACPI_COMPANION() macro to reduce overhead slightly. While at it, rename the struct acpi_device pointer variable in acpi_button_remove() to adev. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/13948466.uLZWGnKmhe@rafael.j.wysocki commit d323436b13f34b1df8261eb68989abda47e1785b Author: Rafael J. Wysocki Date: Thu Feb 12 14:31:33 2026 +0100 ACPI: button: Tweak system wakeup handling Modify struct acpi_button to hold a struct device pointer instead of a struct platform_device one to avoid unnecessary pointer dereferences and use that pointer consistently for system wakeup initialization, handling and cleanup. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/1948258.tdWV9SEqCh@rafael.j.wysocki commit b83afb7e8c3388dc82b5ea5b15d328d569a6fc41 Author: Rafael J. Wysocki Date: Thu Feb 12 14:26:54 2026 +0100 ACPI: battery: Drop redundant checks from acpi_battery_remove() In acpi_battery_remove(), "battery" cannot be NULL because it is the driver data of the platform device passed to that function and it has been set by acpi_battery_probe(), so drop the redundant check of it against NULL. Moreover, getting the ACPI device pointer from battery->device is slightly less overhead than using the ACPI_COMPANION() macro on the platform device to retrieve it, so do that and drop the check of that pointer against NULL which is also redundant. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12836976.O9o76ZdvQC@rafael.j.wysocki commit 218da1209de0d67eae3913e5b261ac57412889f9 Merge: 2f5db9b4002470 5028a24aa89a2c Author: Dave Airlie Date: Fri Feb 13 11:46:51 2026 +1000 Merge tag 'amd-drm-next-6.20-2026-02-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.20-2026-02-06: amdgpu: - DML 2.1 fixes - Panel replay fixes - Display writeback fixes - MES 11 old firmware compat fix - DC CRC improvements - DPIA fixes - XGMI fixes - ASPM fix - SMU feature bit handling fixes - DC LUT fixes - RAS fixes - Misc memory leak in error path fixes - SDMA queue reset fixes - PG handling fixes - 5 level GPUVM page table fix - SR-IOV fix - Queue reset fix amdkfd: - Fix possible double deletion of validate list - Event setup fix - Device disconnect regression fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260206192706.59396-1-alexander.deucher@amd.com commit cee73b1e840c154f64ace682cb477c1ae2e29cc4 Merge: 7563f7e0e9fc79 18be4ca5cb4e5a Author: Linus Torvalds Date: Thu Feb 12 19:17:44 2026 -0800 Merge tag 'riscv-for-linus-7.0-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: - Add support for control flow integrity for userspace processes. This is based on the standard RISC-V ISA extensions Zicfiss and Zicfilp - Improve ptrace behavior regarding vector registers, and add some selftests - Optimize our strlen() assembly - Enable the ISO-8859-1 code page as built-in, similar to ARM64, for EFI volume mounting - Clean up some code slightly, including defining copy_user_page() as copy_page() rather than memcpy(), aligning us with other architectures; and using max3() to slightly simplify an expression in riscv_iommu_init_check() * tag 'riscv-for-linus-7.0-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (42 commits) riscv: lib: optimize strlen loop efficiency selftests: riscv: vstate_exec_nolibc: Use the regular prctl() function selftests: riscv: verify ptrace accepts valid vector csr values selftests: riscv: verify ptrace rejects invalid vector csr inputs selftests: riscv: verify syscalls discard vector context selftests: riscv: verify initial vector state with ptrace selftests: riscv: test ptrace vector interface riscv: ptrace: validate input vector csr registers riscv: csr: define vtype register elements riscv: vector: init vector context with proper vlenb riscv: ptrace: return ENODATA for inactive vector extension kselftest/riscv: add kselftest for user mode CFI riscv: add documentation for shadow stack riscv: add documentation for landing pad / indirect branch tracking riscv: create a Kconfig fragment for shadow stack and landing pad support arch/riscv: add dual vdso creation logic and select vdso based on hw arch/riscv: compile vdso with landing pad and shadow stack note riscv: enable kernel access to shadow stack memory via the FWFT SBI call riscv: add kernel command line option to opt out of user CFI riscv/hwprobe: add zicfilp / zicfiss enumeration in hwprobe ... commit 8383522821c6fea6bbb4bc0317056c433a482a95 Merge: 6c28aa8dfdf24f 026f6513c5880c Author: Jakub Kicinski Date: Thu Feb 12 19:01:17 2026 -0800 Merge branch 'net-mscc-ocelot-fix-missing-lock-in-ocelot_port_xmit' Ziyi Guo says: ==================== net: mscc: ocelot: fix missing lock in ocelot_port_xmit() ocelot_port_xmit() calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock. Both functions contain lockdep_assert_held() for the injection lock, and the correct caller felix_port_deferred_xmit() properly acquires the lock using ocelot_lock_inj_grp() before calling these functions. this v3 splits the fix into a 3-patch series to separate refactoring from the behavioral change: 1/3: Extract the PTP timestamp handling into an ocelot_xmit_timestamp() helper so the logic isn't duplicated when the function is split. 2/3: Split ocelot_port_xmit() into ocelot_port_xmit_fdma() and ocelot_port_xmit_inj(), keeping the FDMA and register injection code paths fully separate. 3/3: Add ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() in ocelot_port_xmit_inj() to fix the missing lock protection. Patches 1-2 are pure refactors with no behavioral change. Patch 3 is the actual bug fix. ==================== Link: https://patch.msgid.link/20260208225602.1339325-1-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski commit 026f6513c5880c2c89e38ad66bbec2868f978605 Author: Ziyi Guo Date: Sun Feb 8 22:56:02 2026 +0000 net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() ocelot_port_xmit_inj() calls ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock. Both functions contain lockdep_assert_held() for the injection lock, and the correct caller felix_port_deferred_xmit() properly acquires the lock using ocelot_lock_inj_grp() before calling these functions. Add ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() around the register injection path to fix the missing lock protection. The FDMA path is not affected as it uses its own locking mechanism. Fixes: c5e12ac3beb0 ("net: mscc: ocelot: serialize access to the injection/extraction groups") Signed-off-by: Ziyi Guo Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260208225602.1339325-4-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski commit 47f79b20e7fb885aa1623b759a68e8e27401ec4d Author: Ziyi Guo Date: Sun Feb 8 22:56:01 2026 +0000 net: mscc: ocelot: split xmit into FDMA and register injection paths Split ocelot_port_xmit() into two separate functions: - ocelot_port_xmit_fdma(): handles the FDMA injection path - ocelot_port_xmit_inj(): handles the register-based injection path The top-level ocelot_port_xmit() now dispatches to the appropriate function based on the ocelot_fdma_enabled static key. This is a pure refactor with no behavioral change. Separating the two code paths makes each one simpler and prepares for adding proper locking to the register injection path without affecting the FDMA path. Signed-off-by: Ziyi Guo Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260208225602.1339325-3-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski commit 29372f07f7969a2f0490793226ecf6c8c6bde0fa Author: Ziyi Guo Date: Sun Feb 8 22:56:00 2026 +0000 net: mscc: ocelot: extract ocelot_xmit_timestamp() helper Extract the PTP timestamp handling logic from ocelot_port_xmit() into a separate ocelot_xmit_timestamp() helper function. This is a pure refactor with no behavioral change. The helper returns false if the skb was consumed (freed) due to a timestamp request failure, and true if the caller should continue with frame injection. The rew_op value is returned via pointer. This prepares for splitting ocelot_port_xmit() into separate FDMA and register injection paths in a subsequent patch. Signed-off-by: Ziyi Guo Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260208225602.1339325-2-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski commit 6c28aa8dfdf24f554d4c5d4ff7d723a95360d94a Author: Daniel Machon Date: Tue Feb 10 14:44:01 2026 +0100 net: sparx5/lan969x: fix DWRR cost max to match hardware register width DWRR (Deficit Weighted Round Robin) scheduling distributes bandwidth across traffic classes based on per-queue cost values, where lower cost means higher bandwidth share. The SPX5_DWRR_COST_MAX constant is 63 (6 bits) but the hardware register field HSCH_DWRR_ENTRY_DWRR_COST is GENMASK(24, 20), only 5 bits wide (max 31). This causes sparx5_weight_to_hw_cost() to compute cost values that silently overflow via FIELD_PREP, resulting in incorrect scheduling weights. Set SPX5_DWRR_COST_MAX to 31 to match the hardware register width. Fixes: 211225428d65 ("net: microchip: sparx5: add support for offloading ets qdisc") Signed-off-by: Daniel Machon Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260210-sparx5-fix-dwrr-cost-max-v1-1-58fbdbc25652@microchip.com Signed-off-by: Jakub Kicinski commit 8930878101cd40063888a68af73b1b0f8b6c79bc Author: Duoming Zhou Date: Tue Feb 10 17:45:37 2026 +0800 atm: fore200e: fix use-after-free in tasklets during device removal When the PCA-200E or SBA-200E adapter is being detached, the fore200e is deallocated. However, the tx_tasklet or rx_tasklet may still be running or pending, leading to use-after-free bug when the already freed fore200e is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet(). One of the race conditions can occur as follows: CPU 0 (cleanup) | CPU 1 (tasklet) fore200e_pca_remove_one() | fore200e_interrupt() fore200e_shutdown() | tasklet_schedule() kfree(fore200e) | fore200e_tx_tasklet() | fore200e-> // UAF Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to synchronize with any pending or running tasklets. Moreover, since fore200e_reset() could prevent further interrupts or data transfers, the tasklet_kill() should be placed after fore200e_reset() to prevent the tasklet from being rescheduled in fore200e_interrupt(). Finally, it only needs to do tasklet_kill() when the fore200e state is greater than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized in earlier states. In a word, the tasklet_kill() should be placed in the FORE200E_STATE_IRQ branch within the switch...case structure. This bug was identified through static analysis. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@kernel.org Suggested-by: Jijie Shao Signed-off-by: Duoming Zhou Reviewed-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260210094537.9767-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski commit babab1b42ed68877ef669a08384becf281ad2582 Author: Jie Zhang Date: Mon Feb 9 17:50:32 2026 -0500 net: stmmac: fix oops when split header is enabled For GMAC4, when split header is enabled, in some rare cases, the hardware does not fill buf2 of the first descriptor with payload. Thus we cannot assume buf2 is always fully filled if it is not the last descriptor. Otherwise, the length of buf2 of the second descriptor will be calculated wrong and cause an oops: Unable to handle kernel paging request at virtual address ffff00019246bfc0 ... x2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000 Call trace: dcache_inval_poc+0x28/0x58 (P) dma_direct_sync_single_for_cpu+0x38/0x6c __dma_sync_single_for_cpu+0x34/0x6c stmmac_napi_poll_rx+0x8f0/0xb60 __napi_poll.constprop.0+0x30/0x144 net_rx_action+0x160/0x274 handle_softirqs+0x1b8/0x1fc ... To fix this, the PL bit-field in RDES3 register is used for all descriptors, whether it is the last descriptor or not. Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support") Reviewed-by: Jacob Keller Signed-off-by: Jie Zhang Link: https://patch.msgid.link/20260209225037.589130-1-jie.zhang@analog.com Signed-off-by: Jakub Kicinski commit d03e094473ecdeb68d853752ba467abe13e1de44 Author: Ethan Nelson-Moore Date: Mon Feb 9 18:12:34 2026 -0800 net: intel: fix PCI device ID conflict between i40e and ipw2200 The ID 8086:104f is matched by both i40e and ipw2200. The same device ID should not be in more than one driver, because in that case, which driver is used is unpredictable. Fix this by taking advantage of the fact that i40e devices use PCI_CLASS_NETWORK_ETHERNET and ipw2200 devices use PCI_CLASS_NETWORK_OTHER to differentiate the devices. Fixes: 2e45d3f4677a ("i40e: Add support for X710 B/P & SFP+ cards") Cc: stable@vger.kernel.org Acked-by: Johannes Berg Signed-off-by: Ethan Nelson-Moore Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20260210021235.16315-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit ed6788c5a7614d00321bc4c88fdb9d83fcba0e02 Author: Gal Pressman Date: Tue Feb 10 11:31:10 2026 +0200 selftests: drv-net: limit RPS test CPUs to supported range The _get_unused_cpus() function can return CPU numbers >= 16, which exceeds RPS_MAX_CPUS in toeplitz.c. When this happens, the test fails with a cryptic message: # Exception| Traceback (most recent call last): # Exception| File "/tmp/cur/linux/tools/testing/selftests/net/lib/py/ksft.py", line 319, in ksft_run # Exception| func(*args) # Exception| File "/tmp/cur/linux/tools/testing/selftests/drivers/net/hw/toeplitz.py", line 189, in test # Exception| with bkg(" ".join(rx_cmd), ksft_ready=True, exit_wait=True) as rx_proc: # Exception| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # Exception| File "/tmp/cur/linux/tools/testing/selftests/net/lib/py/utils.py", line 124, in __init__ # Exception| super().__init__(comm, background=True, # Exception| File "/tmp/cur/linux/tools/testing/selftests/net/lib/py/utils.py", line 77, in __init__ # Exception| raise Exception("Did not receive ready message") # Exception| Exception: Did not receive ready message Rename _get_unused_cpus() to _get_unused_rps_cpus() and cap the CPU search range to RPS_MAX_CPUS. Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260210093110.1935149-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 10ec0fc0ccc525abc807b0ca8ad5a26a0bd56361 Author: Yue Haibing Date: Wed Feb 11 10:21:46 2026 +0800 selftests: net: lib: Fix jq parsing error The testcase failed as below: $./vlan_bridge_binding.sh ... + adf_ip_link_set_up d1 + local name=d1 + shift + ip_link_is_up d1 + ip_link_has_flag d1 UP + local name=d1 + shift + local flag=UP + shift ++ ip -j link show d1 ++ jq --arg flag UP 'any(.[].flags.[]; . == $flag)' jq: error: syntax error, unexpected '[', expecting FORMAT or QQSTRING_START (Unix shell quoting issues?) at , line 1: any(.[].flags.[]; . == $flag) jq: 1 compile error Remove the extra dot (.) after flags array to fix this. Fixes: 4baa1d3a5080 ("selftests: net: lib: Add ip_link_has_flag()") Signed-off-by: Yue Haibing Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260211022146.190948-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit fe6515f5952c166bdc4efa2090609e68018338a4 Author: Chen Ni Date: Wed Feb 11 11:20:21 2026 +0800 bng_en: Remove duplicate include Remove duplicate inclusion of . Signed-off-by: Chen Ni Reviewed-by: Vikas Gupta Link: https://patch.msgid.link/20260211032021.2719742-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski commit a2646773a005b59fd1dc7ff3ba15df84889ca5d2 Author: Ido Schimmel Date: Mon Feb 9 14:53:53 2026 +0100 selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 As explained in [1], iproute2 started rejecting tc-police burst sizes that result in an overflow. This can happen when the burst size is high enough and the rate is low enough. A couple of test cases specify such configurations, resulting in iproute2 errors and test failure. Fix by reducing the burst size so that the test will pass with both new and old iproute2 versions. [1] https://lore.kernel.org/netdev/20250916215731.3431465-1-jay.vosburgh@canonical.com/ Fixes: cb12d1763267 ("selftests: mlxsw: tc_restrictions: Test tc-police restrictions") Signed-off-by: Ido Schimmel Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/88b00c6e85188aa6a065dc240206119b328c46e1.1770643998.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit a6a9bc544b675d8b5180f2718ec985ad267b5cbf Author: Jeremy Kerr Date: Mon Feb 9 15:27:33 2026 +0800 net: mctp: ensure our nlmsg responses are initialised Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from DEVCORE Research Team working with Trend Micro Zero Day Initiative report that a RTM_GETNEIGH will return uninitalised data in the pad bytes of the ndmsg data. Ensure we're initialising the netlink data to zero, in the link, addr and neigh response messages. Fixes: 831119f88781 ("mctp: Add neighbour netlink interface") Fixes: 06d2f4c583a7 ("mctp: Add netlink route management") Fixes: 583be982d934 ("mctp: Add device handling and netlink interface") Signed-off-by: Jeremy Kerr Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260209-dev-mctp-nlmsg-v1-1-f1e30c346a43@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 7563f7e0e9fc79c41b2aea045a87b8de942fd616 Merge: 7449f86bafcdb5 12bdf471e374b3 Author: Linus Torvalds Date: Thu Feb 12 18:24:37 2026 -0800 Merge tag 'for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "power-supply core: - sysfs: constify pointer passed to dev_attr_psp - extend DT binding documentation for battery cells to allow describing voltage drop behaviour power-supply drivers: - multiple: Remove unused gpio include header - multiple: Fix potential IRQ use-after-free on driver unload - bd71828: Add support for ROHM BD72720 - misc small fixes reset drivers: - tdx-ec-poweroff: fix restart" * tag 'for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (30 commits) power: supply: bd71828: Use dev_err_probe() dt-bindings: power: supply: google,goldfish-battery: Convert to DT schema power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer power: supply: wm97xx: Use devm_power_supply_register() power: supply: wm97xx: Use devm_kcalloc() power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler power: reset: tdx-ec-poweroff: fix restart docs: power: update documentation about removed function power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() MAINTAINERS: adjust file entry in ROHM BD71828 CHARGER power: supply: ab8500_chargalg: improve kernel-doc power: supply: sysfs: Constify pointer passed to dev_attr_psp() power: supply: bq27xxx: fix wrong errno when bus ops are unsupported power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write power: supply: sbs-battery: Fix use-after-free in power_supply_changed() power: supply: rt9455: Fix use-after-free in power_supply_changed() power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() power: supply: pf1550: Fix use-after-free in power_supply_changed() power: supply: goldfish: Fix use-after-free in power_supply_changed() ... commit 7c375811b5117dd26e36fc508cff1fb5cd4121aa Author: Chen Ni Date: Thu Feb 12 13:50:28 2026 +0800 myri10ge: replace comma with semicolons Commit fd24173439c0 ("myri10ge: avoid uninitialized variable use") added commas instead of semicolons Acked-by: Arnd Bergmann Signed-off-by: Chen Ni Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260212055028.3248491-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 7449f86bafcdb588422bb14a4babfd285e723670 Merge: 8429538c2c0420 dd2fdc3504592d Author: Linus Torvalds Date: Thu Feb 12 17:49:33 2026 -0800 Merge tag 'nfs-for-7.0-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client updates from Anna Schumaker: "New Features: - Use an LRU list for returning unused delegations - Introduce a KConfig option to disable NFS v4.0 and make NFS v4.1 the default Bugfixes: - NFS/localio: - Handle short writes by retrying - Prevent direct reclaim recursion into NFS via nfs_writepages - Use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit - Remove -EAGAIN handling in nfs_local_doio() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - fs/nfs: Fix a readdir slow-start regression - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path Other cleanups and improvements: - A few other NFS/localio cleanups - Various other delegation handling cleanups from Christoph - Unify security_inode_listsecurity() calls - Improvements to NFSv4 lease handling - Clean up SUNRPC *_debug fields when CONFIG_SUNRPC_DEBUG is not set" * tag 'nfs-for-7.0-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (60 commits) SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path nfs: nfs4proc: Convert comma to semicolon SUNRPC: Change list definition method sunrpc: rpc_debug and others are defined even if CONFIG_SUNRPC_DEBUG unset NFSv4: limit lease period in nfs4_set_lease_period() NFSv4: pass lease period in seconds to nfs4_set_lease_period() nfs: unify security_inode_listsecurity() calls fs/nfs: Fix readdir slow-start regression pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN NFS: fix delayed delegation return handling NFS: simplify error handling in nfs_end_delegation_return NFS: fold nfs_abort_delegation_return into nfs_end_delegation_return NFS: remove the delegation == NULL check in nfs_end_delegation_return NFS: use bool for the issync argument to nfs_end_delegation_return NFS: return void from ->return_delegation NFS: return void from nfs4_inode_make_writeable NFS: Merge CONFIG_NFS_V4_1 with CONFIG_NFS_V4 NFS: Add a way to disable NFS v4.0 via KConfig NFS: Move sequence slot operations into minorversion operations NFS: Pass a struct nfs_client to nfs4_init_sequence() ... commit 5a702856624675351c9a122b0e8d33db93e9d121 Merge: 37a93dd5c49b5f 4cebb26ac6f02b Author: Jakub Kicinski Date: Thu Feb 12 17:45:02 2026 -0800 Merge branch 'net-phy_port-sfp-modules-representation-and-phy_port-listing' Maxime Chevallier says: ==================== net: phy_port: SFP modules representation and phy_port listing (part) ==================== Applying just the initial cleanup + fixes from the series. Link: https://patch.msgid.link/20260205092317.755906-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 4cebb26ac6f02b49b8a7c6974af3b4f23685e1a2 Author: Maxime Chevallier Date: Thu Feb 5 10:23:06 2026 +0100 net: phy: phy_port: Correctly recompute the port's linkmodes a PHY-driven phy_port contains a 'supported' field containing the linkmodes available on this port. This is populated based on : - The PHY's reported features - The DT representation of the connector - The PHY's attach_mdi() callback As these different attrbution methods work in conjunction, the helper phy_port_update_supported() recomputes the final 'supported' value based on the populated mediums, linkmodes and pairs. However this recompute wasn't correctly implemented, and added more modes than necessary by or'ing the medium-specific modes to the existing support. Let's fix this and properly filter the modes. Fixes: 589e934d2735 ("net: phy: Introduce PHY ports representation") Signed-off-by: Maxime Chevallier Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260205092317.755906-4-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 6248f3dc4ec536163bf8e1761f3c08d6f31c3cfe Author: Maxime Chevallier Date: Thu Feb 5 10:23:05 2026 +0100 net: phy: phy_port: Cleanup the of-parsing logic for phy_port We don't need to maintain a mediums bitfield, let's drop it and drop a bogus check for empty mediums, as we already check it above. Signed-off-by: Maxime Chevallier Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260205092317.755906-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 056166710543a01ebcf25449bb462388e44b6ef6 Author: Maxime Chevallier Date: Thu Feb 5 10:23:04 2026 +0100 net: phy: initialize the port support based on the PHY's for OF ports With the phy_port infrastructure came an ethernet-connector binding, allowing to represent the MDI of a PHY in devicetree. This allows specifying the mediums and pairs of a port. Let's initialize the port's supported list based on what the PHY reports, so that we can then filter it with what the connector allows using. Signed-off-by: Maxime Chevallier Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260205092317.755906-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 8429538c2c0420c65fbb4872966622b96ec36cea Author: Linus Torvalds Date: Thu Feb 12 17:19:36 2026 -0800 tools/testing: keep legacy generated files around in .gitignore file People keep removing generated files from .gitignore files even when the files stay around. Please don't do that: just because the file is no longer being generated doesn't make it magically go away, and doesn't make it suddenly be something that should now not be ignored any more. Fixes: dd2c6ec24fca ("selftests/mm: remove virtual_address_range test") Cc: Lorenzo Stoakes Cc: SeongJae Park Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 2c75a8d92cf173113d1e43a41cb472cd93561bf8 Merge: 311aa68319f6a3 ff4a46c278ac6a Author: Linus Torvalds Date: Thu Feb 12 17:12:43 2026 -0800 Merge tag 'ata-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ATA updates from Damien Le Moal: - Cleanup IRQ masking in the handling of completed report zones commands (Niklas) - Improve the handling of Thunderbolt attached devices to speed up device removal (Henry) - Several patches to generalize the existing max_sec quirks to facilitates quirking the maximum command size of buggy drives, many of which have recently showed up with the recent increase of the default max_sectors block limit (Niklas) - Cleanup the ahci-platform and sata dt-bindings schema (Rob, Manivannan) - Improve device node scan in the ahci-dwc driver (Krzysztof) - Remove clang W=1 warnings with the ahci-imx and ahci-xgene drivers (Krzysztof) - Fix a long standing potential command starvation situation with non-NCQ commands issued when NCQ commands are on-going (me) - Limit max_sectors to 8191 on the INTEL SSDSC2KG480G8 SSD (Niklas) - Remove Vesa Local Bus (VLB) support in the pata_legacy driver (Ethan) - Simple fixes in the pata_cypress (typo) and pata_ftide010 (timing) drivers (Ethan, Linus W) * tag 'ata-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: pata_ftide010: Fix some DMA timings ata: pata_cypress: fix typo in error message ata: pata_legacy: remove VLB support ata: libata-core: Quirk INTEL SSDSC2KG480G8 max_sectors dt-bindings: ata: sata: Document the graph port ata: libata-scsi: avoid Non-NCQ command starvation ata: libata-scsi: refactor ata_scsi_translate() ata: ahci-xgene: Fix Wvoid-pointer-to-enum-cast warning ata: ahci-imx: Fix Wvoid-pointer-to-enum-cast warning ata: ahci-dwc: Simplify with scoped for each OF child loop dt-bindings: ata: ahci-platform: Drop unnecessary select schema ata: libata: Allow more quirks ata: libata: Add libata.force parameter max_sec ata: libata: Add support to parse equal sign in libata.force ata: libata: Change libata.force to use the generic ATA_QUIRK_MAX_SEC quirk ata: libata: Add ata_force_get_fe_for_dev() helper ata: libata: Add ATA_QUIRK_MAX_SEC and convert all device quirks ata: libata: avoid long timeouts on hot-unplugged SATA DAS ata: libata-scsi: Remove superfluous local_irq_save() commit 311aa68319f6a3d64a1e6d940d885830c7acba4c Merge: e812928be2ee1c d6c58f4eb3d00a Author: Linus Torvalds Date: Thu Feb 12 17:05:20 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "Usual smallish cycle. The NFS biovec work to push it down into RDMA instead of indirecting through a scatterlist is pretty nice to see, been talked about for a long time now. - Various code improvements in irdma, rtrs, qedr, ocrdma, irdma, rxe - Small driver improvements and minor bug fixes to hns, mlx5, rxe, mana, mlx5, irdma - Robusness improvements in completion processing for EFA - New query_port_speed() verb to move past limited IBA defined speed steps - Support for SG_GAPS in rts and many other small improvements - Rare list corruption fix in iwcm - Better support different page sizes in rxe - Device memory support for mana - Direct bio vec to kernel MR for use by NFS-RDMA - QP rate limiting for bnxt_re - Remote triggerable NULL pointer crash in siw - DMA-buf exporter support for RDMA mmaps like doorbells" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (66 commits) RDMA/mlx5: Implement DMABUF export ops RDMA/uverbs: Add DMABUF object type and operations RDMA/uverbs: Support external FD uobjects RDMA/siw: Fix potential NULL pointer dereference in header processing RDMA/umad: Reject negative data_len in ib_umad_write IB/core: Extend rate limit support for RC QPs RDMA/mlx5: Support rate limit only for Raw Packet QP RDMA/bnxt_re: Report QP rate limit in debugfs RDMA/bnxt_re: Report packet pacing capabilities when querying device RDMA/bnxt_re: Add support for QP rate limiting MAINTAINERS: Drop RDMA files from Hyper-V section RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc svcrdma: use bvec-based RDMA read/write API RDMA/core: add rdma_rw_max_sge() helper for SQ sizing RDMA/core: add MR support for bvec-based RDMA operations RDMA/core: use IOVA-based DMA mapping for bvec RDMA operations RDMA/core: add bio_vec based RDMA read/write API RDMA/irdma: Use kvzalloc for paged memory DMA address array RDMA/rxe: Fix race condition in QP timer handlers RDMA/mana_ib: Add device‑memory support ... commit e812928be2ee1c2744adf20ed04e0ce1e2fc5c13 Merge: cebcffe666cc82 63fbf275fa9f18 Author: Linus Torvalds Date: Thu Feb 12 16:33:05 2026 -0800 Merge tag 'cxl-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL updates from Dave Jiang: - Introduce cxl_memdev_attach and pave way for soft reserved handling, type2 accelerator enabling, and LSA 2.0 enabling. All these series require the endpoint driver to settle before continuing the memdev driver probe. - Address CXL port error protocol handling and reporting. The large patch series was split into three parts. The first two parts are included here with the final part coming later. The first part consists of a series of code refactoring to PCI AER sub-system that addresses CXL and also CXL RAS code to prepare for port error handling. The second part refactors the CXL code to move management of component registers to cxl_port objects to allow all CXL AER errors to be handled through the cxl_port hierarchy. - Provide AMD Zen5 platform address translation for CXL using ACPI PRMT. This includes a conventions document to explain why this is needed and how it's implemented. - Misc CXL patches of fixes, cleanups, and updates. Including CXL address translation for unaligned MOD3 regions. [ TLA service: CXL is "Compute Express Link" ] * tag 'cxl-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (59 commits) cxl: Disable HPA/SPA translation handlers for Normalized Addressing cxl/region: Factor out code into cxl_region_setup_poison() cxl/atl: Lock decoders that need address translation cxl: Enable AMD Zen5 address translation using ACPI PRMT cxl/acpi: Prepare use of EFI runtime services cxl: Introduce callback for HPA address ranges translation cxl/region: Use region data to get the root decoder cxl/region: Add @hpa_range argument to function cxl_calc_interleave_pos() cxl/region: Separate region parameter setup and region construction cxl: Simplify cxl_root_ops allocation and handling cxl/region: Store HPA range in struct cxl_region cxl/region: Store root decoder in struct cxl_region cxl/region: Rename misleading variable name @hpa to @hpa_range Documentation/driver-api/cxl: ACPI PRM Address Translation Support and AMD Zen5 enablement cxl, doc: Moving conventions in separate files cxl, doc: Remove isonum.txt inclusion cxl/port: Unify endpoint and switch port lookup cxl/port: Move endpoint component register management to cxl_port cxl/port: Map Port RAS registers cxl/port: Move dport RAS setup to dport add time ... commit cebcffe666cc82e68842e27852a019ca54072cb7 Merge: d4a379a52c3c2d 96ca4caf9066f5 Author: Linus Torvalds Date: Thu Feb 12 15:52:39 2026 -0800 Merge tag 'vfio-v7.0-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: "A small cycle with the bulk in selftests and reintroducing poison handling in the nvgrace-gpu driver. The rest are fixes, cleanups, and some dmabuf structure consolidation. - Update outdated mdev comment referencing the renamed mdev_type_add() function (Julia Lawall) - Introduce selftest support for IOMMU mapping of PCI MMIO BARs (Alex Mastro) - Relax selftest assertion relative to differences in huge page handling between legacy (v1) TYPE1 IOMMU mapping behavior and the compatibility mode supported by IOMMUFD (David Matlack) - Reintroduce memory poison handling support for non-struct-page- backed memory in the nvgrace-gpu variant driver (Ankit Agrawal) - Replace dma_buf_phys_vec with phys_vec to avoid duplicate structure and semantics (Leon Romanovsky) - Add missing upstream bridge locking across PCI function reset, resolving an assertion failure when secondary bus reset is used to provide that reset (Anthony Pighin) - Fixes to hisi_acc vfio-pci variant driver to resolve corner case issues related to resets, repeated migration, and error injection scenarios (Longfang Liu, Weili Qian) - Restrict vfio selftest builds to arm64 and x86_64, resolving compiler warnings on 32-bit archs (Ted Logan) - Un-deprecate the fsl-mc vfio bus driver as a new maintainer has stepped up (Ioana Ciornei)" * tag 'vfio-v7.0-rc1' of https://github.com/awilliam/linux-vfio: vfio/fsl-mc: add myself as maintainer vfio: selftests: only build tests on arm64 and x86_64 hisi_acc_vfio_pci: fix the queue parameter anomaly issue hisi_acc_vfio_pci: resolve duplicate migration states hisi_acc_vfio_pci: update status after RAS error hisi_acc_vfio_pci: fix VF reset timeout issue vfio/pci: Lock upstream bridge for vfio_pci_core_disable() types: reuse common phys_vec type instead of DMABUF open‑coded variant vfio/nvgrace-gpu: register device memory for poison handling mm: add stubs for PFNMAP memory failure registration functions vfio: selftests: Drop IOMMU mapping size assertions for VFIO_TYPE1_IOMMU vfio: selftests: Add vfio_dma_mapping_mmio_test vfio: selftests: Align BAR mmaps for efficient IOMMU mapping vfio: selftests: Centralize IOMMU mode name definitions vfio/mdev: update outdated comment commit 4c91b67f87ac032c77650108ef9841772b9dc364 Author: Paulo Alcantara Date: Thu Feb 12 19:53:07 2026 -0300 smb: client: fix data corruption due to racy lease checks Customer reported data corruption in some of their files. It turned out the client would end up calling cacheless IO functions while having RHW lease, bypassing the pagecache and then leaving gaps in the file while writing to it. It was related to concurrent opens changing the lease state while having writes in flight. Lease breaks and re-opens due to reconnect could also cause same issue. Fix this by serialising the lease updates with cifsInodeInfo::open_file_lock. When handling oplock break, make sure to use the downgraded oplock value rather than one in cifsInodeinfo as it could be changed concurrently. Reported-by: Frank Sorenson Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 90627a1e08e602b8b7bea970d7d5007626be7527 Author: Kees Cook Date: Fri Feb 6 14:20:13 2026 -0800 lib/group_cpus: handle const qualifier from clusters allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "const struct cpumask **", but the returned type, while matching, is not const qualified. To get them exactly matching, just use the dereferenced pointer for the sizeof(). Link: https://lkml.kernel.org/r/20260206222010.work.349-kees@kernel.org Signed-off-by: Kees Cook Cc: Wangyang Guo Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit f7a553b813f85a5a39e1123c7a588a3d383877ab Author: Ran Xiaokai Date: Thu Feb 12 11:11:46 2026 +0000 kho: remove unnecessary WARN_ON(err) in kho_populate() The following pr_warn() provides detailed error and location information, WARN_ON(err) adds no additional debugging value, so remove the redundant WARN_ON() call. Link: https://lkml.kernel.org/r/20260212111146.210086-3-ranxiaokai627@163.com Signed-off-by: Ran Xiaokai Reviewed-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Cc: Alexander Graf Cc: Mike Rapoport Signed-off-by: Andrew Morton commit 34df6c4734db4765d6ec2b0f0b61d4aec4a8f345 Author: Ran Xiaokai Date: Thu Feb 12 11:11:45 2026 +0000 kho: fix missing early_memunmap() call in kho_populate() Patch series "two fixes in kho_populate()", v3. This patch (of 2): kho_populate() returns without calling early_memunmap() on success path, this will cause early ioremap virtual address space leak. Link: https://lkml.kernel.org/r/20260212111146.210086-1-ranxiaokai627@163.com Link: https://lkml.kernel.org/r/20260212111146.210086-2-ranxiaokai627@163.com Fixes: b50634c5e84a ("kho: cleanup error handling in kho_populate()") Signed-off-by: Ran Xiaokai Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Mike Rapoport Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 55f8b4518d14b7436f70defe27faba4eca0cd4e1 Author: Seongjun Hong Date: Mon Feb 2 12:42:41 2026 +0900 scripts/gdb: implement x86_page_ops in mm.py Implement all member functions of x86_page_ops strictly following the logic of aarch64_page_ops. This includes full support for SPARSEMEM and standard page translation functions. This fixes compatibility with 'lx-' commands on x86_64, preventing AttributeErrors when using lx-pfn_to_page and others. Link: https://lkml.kernel.org/r/20260202034241.649268-1-hsj0512@snu.ac.kr Signed-off-by: Seongjun Hong Cc: Jan Kiszka Signed-off-by: Andrew Morton commit 5ed4b6b37c647d168ae31035b3f61b705997e043 Author: zhouwenhao Date: Mon Feb 2 21:28:46 2026 +0800 objpool: fix the overestimation of object pooling metadata size objpool uses struct objpool_head to store metadata information, and its cpu_slots member points to an array of pointers that store the addresses of the percpu ring arrays. However, the memory size allocated during the initialization of cpu_slots is nr_cpu_ids * sizeof(struct objpool_slot). On a 64-bit machine, the size of struct objpool_slot is 16 bytes, which is twice the size of the actual pointer required, and the extra memory is never be used, resulting in a waste of memory. Therefore, the memory size required for cpu_slots needs to be corrected. Link: https://lkml.kernel.org/r/20260202132846.68257-1-zhouwenhao7600@gmail.com Fixes: b4edb8d2d464 ("lib: objpool added: ring-array based lockless MPMC") Signed-off-by: zhouwenhao Reviewed-by: Andrew Morton Cc: "Masami Hiramatsu (Google)" Cc: Matt Wu Cc: wuqiang.matt Signed-off-by: Andrew Morton commit b24335521de92fd2ee22460072b75367ca8860b0 Author: Aristeu Rozanski Date: Mon Feb 2 09:38:05 2026 -0500 selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT In order to synchronize new processes to test inheritance of memfd_noexec sysctl, memfd_test sets up the sysctl with a value before creating the new process. The new process then sends itself a SIGSTOP in order to wait for the parent to flip the sysctl value and send a SIGCONT signal. This would work as intended if it wasn't the fact that the new process is being created with CLONE_NEWPID, which creates a new PID namespace and the new process has PID 1 in this namespace. There're restrictions on sending signals to PID 1 and, although it's relaxed for other than root PID namespace, it's biting us here. In this specific case the SIGSTOP sent by the new process is ignored (no error to kill() is returned) and it never stops its execution. This is usually not noticiable as the parent usually manages to set the new sysctl value before the child has a chance to run and the test succeeds. But if you run the test in a loop, it eventually reproduces: while [ 1 ]; do ./memfd_test >log 2>&1 || break; done; cat log So this patch replaces the SIGSTOP/SIGCONT synchronization with IPC semaphore. Link: https://lkml.kernel.org/r/a7776389-b3d6-4b18-b438-0b0e3ed1fd3b@work Fixes: 6469b66e3f5a ("selftests: improve vm.memfd_noexec sysctl tests") Signed-off-by: Aristeu Rozanski Cc: Aleksa Sarai Cc: Shuah Khan Cc: liuye Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 9333980c230fc29afb41dc52b58a0dc9ea201f2a Author: Arnd Bergmann Date: Tue Feb 10 11:34:22 2026 +0100 delayacct: fix build regression on accounting tool The accounting tool was modified for the original ABI using a custom 'timespec64' type in linux/taskstats.h, which I changed to use the regular __kernel_timespec type, causing a build failure: getdelays.c:202:45: warning: 'struct timespec64' declared inside parameter list will not be visible outside of this definition or declaration 202 | static const char *format_timespec64(struct timespec64 *ts) | ^~~~~~~~~~ Change the tool to match the updated header. Link: https://lkml.kernel.org/r/20260210103427.2984963-1-arnd@kernel.org Fixes: 503efe850c74 ("delayacct: add timestamp of delay max") Fixes: f06e31eef4c1 ("delayacct: fix uapi timespec64 definition") Signed-off-by: Arnd Bergmann Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202602091611.lxgINqXp-lkp@intel.com/ Signed-off-by: Andrew Morton commit ac1ea219590c09572ed5992dc233bbf7bb70fef9 Author: Mikhail Gavrilov Date: Sat Feb 7 22:36:14 2026 +0500 mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-order pages and split via split_page(), tail pages retain stale page->private values. This causes a use-after-free in the swap subsystem. The swap code uses page->private to track swap count continuations, assuming freshly allocated pages have page->private == 0. When stale values are present, swap_count_continued() incorrectly assumes the continuation list is valid and iterates over uninitialized page->lru containing LIST_POISON values, causing a crash: KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] RIP: 0010:__do_sys_swapoff+0x1151/0x1860 Fix this by clearing page->private in free_pages_prepare(), ensuring all freed pages have clean state regardless of previous use. Link: https://lkml.kernel.org/r/20260207173615.146159-1-mikhail.v.gavrilov@gmail.com Fixes: 3b8000ae185c ("mm/vmalloc: huge vmalloc backing pages should be split rather than compound") Signed-off-by: Mikhail Gavrilov Suggested-by: Zi Yan Acked-by: Zi Yan Acked-by: David Hildenbrand (Arm) Reviewed-by: Vlastimil Babka Cc: Brendan Jackman Cc: Chris Li Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kairui Song Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Nicholas Piggin Cc: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit d4a379a52c3c2dc44366c4f6722c063a7d0de179 Merge: 041c16acbafbdd 1982257570b84d Author: Linus Torvalds Date: Thu Feb 12 15:43:02 2026 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Usual driver updates (qla2xxx, mpi3mr, mpt3sas, ufs) plus assorted cleanups and fixes. The biggest core change is the massive code motion in the sd driver to remove forward declarations and the most significant change is to enumify the queuecommand return" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (78 commits) scsi: csiostor: Fix dereference of null pointer rn scsi: buslogic: Reduce stack usage scsi: ufs: host: mediatek: Require CONFIG_PM scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() scsi: mpi3mr: Make driver probing asynchronous scsi: ufs: core: Flush exception handling work when RPM level is zero scsi: efct: Use IRQF_ONESHOT and default primary handler scsi: ufs: core: Use a host-wide tagset in SDB mode scsi: qla2xxx: target: Add WQ_PERCPU to alloc_workqueue() users scsi: qla2xxx: Add WQ_PERCPU to alloc_workqueue() users scsi: qla4xxx: Add WQ_PERCPU to alloc_workqueue() users scsi: mpi3mr: Driver version update to 8.17.0.3.50 scsi: mpi3mr: Fixed the W=1 compilation warning scsi: mpi3mr: Record and report controller firmware faults scsi: mpi3mr: Update MPI Headers to revision 39 scsi: mpi3mr: Use negotiated link rate from DevicePage0 scsi: mpi3mr: Avoid redundant diag-fault resets scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context scsi: mpi3mr: Add module parameter to control threaded IRQ polling ... commit d51b5076c7468fad568645caf38a6979458a5de1 Author: Miaohe Lin Date: Fri Feb 6 11:16:39 2026 +0800 selftests/mm: add memory failure dirty pagecache test This patch adds a new testcase to validate memory failure handling for dirty pagecache. This performs similar operations as clean pagecaches except fsync() is not used to keep pages dirty. This test helps ensure that memory failure handling for dirty pagecache works correctly, including proper SIGBUS delivery, page isolation, and recovery paths. Link: https://lkml.kernel.org/r/20260206031639.2707102-4-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: David Hildenbrand Cc: kernel test robot Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 12e8a2fae372c55c17a410929cfa60f96b93d17a Author: Miaohe Lin Date: Fri Feb 6 11:16:38 2026 +0800 selftests/mm: add memory failure clean pagecache test This patch adds a new testcase to validate memory failure handling for clean pagecache. This test performs similar operations as anonymous pages except allocating memory using mmap() with a file fd. This test helps ensure that memory failure handling for clean pagecache works correctly, including unchanged page content, page isolation, and recovery paths. Link: https://lkml.kernel.org/r/20260206031639.2707102-3-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601221142.mDWA1ucw-lkp@intel.com/ Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ff4ef2fbd10192357da76fd80796b7262df21b78 Author: Miaohe Lin Date: Fri Feb 6 11:16:37 2026 +0800 selftests/mm: add memory failure anonymous page test Patch series "selftests/mm: add memory failure selftests", v4. Introduce selftests to validate the functionality of memory failure. These tests help ensure that memory failure handling for anonymous pages, pagecaches pages works correctly, including proper SIGBUS delivery to user processes, page isolation, and recovery paths. Currently madvise syscall is used to inject memory failures. And only anonymous pages and pagecaches are tested. More test scenarios, e.g. hugetlb, shmem, thp, will be added. Also more memory failure injecting methods will be supported, e.g. APEI Error INJection, if required. This patch (of 3): This patch adds a new kselftest to validate memory failure handling for anonymous pages. The test performs the following operations: 1. Allocates anonymous pages using mmap(). 2. Injects memory failure via madvise syscall. 3. Verifies expected error handling behavior. 4. Unpoison memory. This test helps ensure that memory failure handling for anonymous pages works correctly, including proper SIGBUS delivery to user processes, page isolation and recovery paths. Link: https://lkml.kernel.org/r/20260206031639.2707102-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20260206031639.2707102-2-linmiaohe@huawei.com Signed-off-by: Miaohe Lin Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: kernel test robot Signed-off-by: Andrew Morton commit a67fe41e214fcfd8b66dfb73d3abe4b7a4b3751d Author: Baolin Wang Date: Mon Feb 9 22:07:28 2026 +0800 mm: rmap: support batched unmapping for file large folios Similar to folio_referenced_one(), we can apply batched unmapping for file large folios to optimize the performance of file folios reclamation. Barry previously implemented batched unmapping for lazyfree anonymous large folios[1] and did not further optimize anonymous large folios or file-backed large folios at that stage. As for file-backed large folios, the batched unmapping support is relatively straightforward, as we only need to clear the consecutive (present) PTE entries for file-backed large folios. Note that it's not ready to support batched unmapping for uffd case, so let's still fallback to per-page unmapping for the uffd case. Performance testing: Allocate 10G clean file-backed folios by mmap() in a memory cgroup, and try to reclaim 8G file-backed folios via the memory.reclaim interface. I can observe 75% performance improvement on my Arm64 32-core server (and 50%+ improvement on my X86 machine) with this patch. W/o patch: real 0m1.018s user 0m0.000s sys 0m1.018s W/ patch: real 0m0.249s user 0m0.000s sys 0m0.249s [1] https://lore.kernel.org/all/20250214093015.51024-4-21cnbao@gmail.com/T/#u Link: https://lkml.kernel.org/r/b53a16f67c93a3fe65e78092069ad135edf00eff.1770645603.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Ryan Roberts Acked-by: Barry Song Reviewed-by: Harry Yoo Acked-by: David Hildenbrand (Arm) Cc: Catalin Marinas Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 07f440c23a197616f7b7607b98b9427da23f9f6f Author: Baolin Wang Date: Mon Feb 9 22:07:27 2026 +0800 arm64: mm: implement the architecture-specific clear_flush_young_ptes() Implement the Arm64 architecture-specific clear_flush_young_ptes() to enable batched checking of young flags and TLB flushing, improving performance during large folio reclamation. Performance testing: Allocate 10G clean file-backed folios by mmap() in a memory cgroup, and try to reclaim 8G file-backed folios via the memory.reclaim interface. I can observe 33% performance improvement on my Arm64 32-core server (and 10%+ improvement on my X86 machine). Meanwhile, the hotspot folio_check_references() dropped from approximately 35% to around 5%. W/o patchset: real 0m1.518s user 0m0.000s sys 0m1.518s W/ patchset: real 0m1.018s user 0m0.000s sys 0m1.018s Link: https://lkml.kernel.org/r/ce749fbae3e900e733fa104a16fcb3ca9fe4f9bd.1770645603.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Ryan Roberts Reviewed-by: David Hildenbrand (Arm) Cc: Barry Song Cc: Catalin Marinas Cc: Harry Yoo Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 6f0e1142173a54b8a18c59fc3cbae3b31ee423d9 Author: Baolin Wang Date: Mon Feb 9 22:07:26 2026 +0800 arm64: mm: support batch clearing of the young flag for large folios Currently, contpte_ptep_test_and_clear_young() and contpte_ptep_clear_flush_young() only clear the young flag and flush TLBs for PTEs within the contiguous range. To support batch PTE operations for other sized large folios in the following patches, adding a new parameter to specify the number of PTEs that map consecutive pages of the same large folio in a single VMA and a single page table. While we are at it, rename the functions to maintain consistency with other contpte_*() functions. Link: https://lkml.kernel.org/r/5644250dcc0417278c266ad37118d27f541fd052.1770645603.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Ryan Roberts Reviewed-by: David Hildenbrand (Arm) Cc: Barry Song Cc: Catalin Marinas Cc: Harry Yoo Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 67d59bddfc26a2f7d5740d4d7ce9ff45274322d5 Author: Baolin Wang Date: Mon Feb 9 22:07:25 2026 +0800 arm64: mm: factor out the address and ptep alignment into a new helper Factor out the contpte block's address and ptep alignment into a new helper, and will be reused in the following patch. No functional changes. Link: https://lkml.kernel.org/r/8076d12cb244b2d9e91119b44dc6d5e4ad9c00af.1770645603.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Ryan Roberts Cc: Barry Song Cc: Catalin Marinas Cc: Harry Yoo Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 52e054f7184097bea009963e033cdd54af7bf8a2 Author: Baolin Wang Date: Mon Feb 9 22:07:24 2026 +0800 mm: rmap: support batched checks of the references for large folios Patch series "support batch checking of references and unmapping for large folios", v6. Currently, folio_referenced_one() always checks the young flag for each PTE sequentially, which is inefficient for large folios. This inefficiency is especially noticeable when reclaiming clean file-backed large folios, where folio_referenced() is observed as a significant performance hotspot. Moreover, on Arm architecture, which supports contiguous PTEs, there is already an optimization to clear the young flags for PTEs within a contiguous range. However, this is not sufficient. We can extend this to perform batched operations for the entire large folio (which might exceed the contiguous range: CONT_PTE_SIZE). Similar to folio_referenced_one(), we can also apply batched unmapping for large file folios to optimize the performance of file folio reclamation. By supporting batched checking of the young flags, flushing TLB entries, and unmapping, I can observed a significant performance improvements in my performance tests for file folios reclamation. Please check the performance data in the commit message of each patch. This patch (of 5): Currently, folio_referenced_one() always checks the young flag for each PTE sequentially, which is inefficient for large folios. This inefficiency is especially noticeable when reclaiming clean file-backed large folios, where folio_referenced() is observed as a significant performance hotspot. Moreover, on Arm64 architecture, which supports contiguous PTEs, there is already an optimization to clear the young flags for PTEs within a contiguous range. However, this is not sufficient. We can extend this to perform batched operations for the entire large folio (which might exceed the contiguous range: CONT_PTE_SIZE). Introduce a new API: clear_flush_young_ptes() to facilitate batched checking of the young flags and flushing TLB entries, thereby improving performance during large folio reclamation. And it will be overridden by the architecture that implements a more efficient batch operation in the following patches. While we are at it, rename ptep_clear_flush_young_notify() to clear_flush_young_ptes_notify() to indicate that this is a batch operation. Link: https://lkml.kernel.org/r/cover.1770645603.git.baolin.wang@linux.alibaba.com Link: https://lkml.kernel.org/r/12132694536834262062d1fb304f8f8a064b6750.1770645603.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Harry Yoo Reviewed-by: Ryan Roberts Acked-by: David Hildenbrand (Arm) Cc: Catalin Marinas Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Cc: Barry Song Signed-off-by: Andrew Morton commit f615cc92641a403d354c6ee68263074a86de49c7 Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:22 2026 +0000 tools/testing/vma: add VMA userland tests for VMA flag functions Now we have the capability to test the new helpers for the bitmap VMA flags in userland, do so. We also update the Makefile such that both VMA (and while we're here) mm_struct flag sizes can be customised on build. We default to 128-bit to enable testing of flags above word size even on 64-bit systems. We add userland tests to ensure that we do not regress VMA flag behaviour with the introduction when using bitmap VMA flags, nor accidentally introduce unexpected results due to for instance higher bit values not being correctly cleared/set. As part of this change, make __mk_vma_flags() a custom function so we can handle specifying invalid VMA bits. This is purposeful so we can have the VMA tests work at lower and higher number of VMA flags without having to duplicate code too much. Link: https://lkml.kernel.org/r/7fe6afe9c8c61e4d3cfc9a2d50a5d24da8528e68.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Cc: Pedro Falcato Signed-off-by: Andrew Morton commit a1f0dacaaba14c7f949f5c6ab876944034620904 Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:21 2026 +0000 tools/testing/vma: separate out vma_internal.h into logical headers The vma_internal.h file is becoming entirely unmanageable. It combines duplicated kernel implementation logic that needs to be kept in-sync with the kernel, stubbed out declarations that we simply ignore for testing purposes and custom logic added to aid testing. If we separate each of the three things into separate headers it makes things far more manageable, so do so: * include/stubs.h contains the stubbed declarations, * include/dup.h contains the duplicated kernel declarations, and * include/custom.h contains declarations customised for testing. [lorenzo.stoakes@oracle.com: avoid a duplicate struct define] Link: https://lkml.kernel.org/r/1e032732-61c3-485c-9aa7-6a09016fefc1@lucifer.local Link: https://lkml.kernel.org/r/dd57baf5b5986cb96a167150ac712cbe804b63ee.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Cc: Pedro Falcato Signed-off-by: Andrew Morton commit 6aacab308a5dfd222b2d23662bbae60c11007cfb Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:20 2026 +0000 tools/testing/vma: separate VMA userland tests into separate files So far the userland VMA tests have been established as a rough expression of what's been possible. Adapt it into a more usable form by separating out tests and shared helper functions. Since we test functions that are declared statically in mm/vma.c, we make use of the trick of #include'ing kernel C files directly. In order for the tests to continue to function, we must therefore also this way into the tests/ directory. We try to keep as much shared logic actually modularised into a separate compilation unit in shared.c, however the merge_existing() and attach_vma() helpers rely on statically declared mm/vma.c functions so these must be declared in main.c. Link: https://lkml.kernel.org/r/a0455ccfe4fdcd1c962c64f76304f612e5662a4e.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Cc: Pedro Falcato Signed-off-by: Andrew Morton commit 53f1d936445131cb5da2212c2b60884a25cb0330 Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:19 2026 +0000 mm: make vm_area_desc utilise vma_flags_t only Now we have eliminated all uses of vm_area_desc->vm_flags, eliminate this field, and have mmap_prepare users utilise the vma_flags_t vm_area_desc->vma_flags field only. As part of this change we alter is_shared_maywrite() to accept a vma_flags_t parameter, and introduce is_shared_maywrite_vm_flags() for use with legacy vm_flags_t flags. We also update struct mmap_state to add a union between vma_flags and vm_flags temporarily until the mmap logic is also converted to using vma_flags_t. Also update the VMA userland tests to reflect this change. Link: https://lkml.kernel.org/r/fd2a2938b246b4505321954062b1caba7acfc77a.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Signed-off-by: Andrew Morton commit 5bd2c0650a9030007af5c2cf2a01dccdc67a6991 Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:18 2026 +0000 mm: update all remaining mmap_prepare users to use vma_flags_t We will be shortly removing the vm_flags_t field from vm_area_desc so we need to update all mmap_prepare users to only use the dessc->vma_flags field. This patch achieves that and makes all ancillary changes required to make this possible. This lays the groundwork for future work to eliminate the use of vm_flags_t in vm_area_desc altogether and more broadly throughout the kernel. While we're here, we take the opportunity to replace VM_REMAP_FLAGS with VMA_REMAP_FLAGS, the vma_flags_t equivalent. No functional changes intended. Link: https://lkml.kernel.org/r/fb1f55323799f09fe6a36865b31550c9ec67c225.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Damien Le Moal [zonefs] Acked-by: "Darrick J. Wong" Acked-by: Pedro Falcato Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Liam Howlett Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Signed-off-by: Andrew Morton commit 590d356aa433074ece2b0d02faa5f959b26d54d6 Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:17 2026 +0000 mm: update shmem_[kernel]_file_*() functions to use vma_flags_t In order to be able to use only vma_flags_t in vm_area_desc we must adjust shmem file setup functions to operate in terms of vma_flags_t rather than vm_flags_t. This patch makes this change and updates all callers to use the new functions. No functional changes intended. [akpm@linux-foundation.org: comment fixes, per Baolin] Link: https://lkml.kernel.org/r/736febd280eb484d79cef5cf55b8a6f79ad832d2.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Baolin Wang Reviewed-by: Jarkko Sakkinen Reviewed-by: Liam R. Howlett Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: "Darrick J. Wong" Cc: Damien Le Moal Cc: Yury Norov Cc: Chris Mason Cc: Pedro Falcato Signed-off-by: Andrew Morton commit fd3196ee9ca135afdf3250d7a13219c1de96531c Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:16 2026 +0000 mm: update secretmem to use VMA flags on mmap_prepare This patch updates secretmem to use the new vma_flags_t type which will soon supersede vm_flags_t altogether. In order to make this change we also have to update mlock_future_ok(), we replace the vm_flags_t parameter with a simple boolean is_vma_locked one, which also simplifies the invocation here. This is laying the groundwork for eliminating the vm_flags_t in vm_area_desc and more broadly throughout the kernel. No functional changes intended. [lorenzo.stoakes@oracle.com: fix check_brk_limits(), per Chris] Link: https://lkml.kernel.org/r/3aab9ab1-74b4-405e-9efb-08fc2500c06e@lucifer.local Link: https://lkml.kernel.org/r/a243a09b0a5d0581e963d696de1735f61f5b2075.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Cc: Pedro Falcato Signed-off-by: Andrew Morton commit 097e8db5e22b03d6791abc243183f597d0f76a7b Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:15 2026 +0000 mm: update hugetlbfs to use VMA flags on mmap_prepare In order to update all mmap_prepare users to utilising the new VMA flags type vma_flags_t and associated helper functions, we start by updating hugetlbfs which has a lot of additional logic that requires updating to make this change. This is laying the groundwork for eliminating the vm_flags_t from struct vm_area_desc and using vma_flags_t only, which further lays the ground for removing the deprecated vm_flags_t type altogether. No functional changes intended. Link: https://lkml.kernel.org/r/9226bec80c9aa3447cc2b83354f733841dba8a50.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Cc: Pedro Falcato Signed-off-by: Andrew Morton commit bae0ba7c7c0a022287d8b093da63ebcb794d77ea Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:14 2026 +0000 mm: add basic VMA flag operation helper functions Now we have the mk_vma_flags() macro helper which permits easy specification of any number of VMA flags, add helper functions which operate with vma_flags_t parameters. This patch provides vma_flags_test[_mask](), vma_flags_set[_mask]() and vma_flags_clear[_mask]() respectively testing, setting and clearing flags with the _mask variants accepting vma_flag_t parameters, and the non-mask variants implemented as macros which accept a list of flags. This allows us to trivially test/set/clear aggregate VMA flag values as necessary, for instance: if (vma_flags_test(&flags, VMA_READ_BIT, VMA_WRITE_BIT)) goto readwrite; vma_flags_set(&flags, VMA_READ_BIT, VMA_WRITE_BIT); vma_flags_clear(&flags, VMA_READ_BIT, VMA_WRITE_BIT); We also add a function for testing that ALL flags are set for convenience, e.g.: if (vma_flags_test_all(&flags, VMA_READ_BIT, VMA_MAYREAD_BIT)) { /* Both READ and MAYREAD flags set */ ... } The compiler generates optimal assembly for each such that they behave as if the caller were setting the bitmap flags manually. This is important for e.g. drivers which manipulate flag values rather than a VMA's specific flag values. We also add helpers for testing, setting and clearing flags for VMA's and VMA descriptors to reduce boilerplate. Also add the EMPTY_VMA_FLAGS define to aid initialisation of empty flags. Finally, update the userland VMA tests to add the helpers there so they can be utilised as part of userland testing. Link: https://lkml.kernel.org/r/885d4897d67a6a57c0b07fa182a7055ad752df11.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Signed-off-by: Andrew Morton commit 21c8a5bae7bd594f5b89db551b618d60b994b8cf Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:13 2026 +0000 tools: bitmap: add missing bitmap_[subset(), andnot()] The bitmap_subset() and bitmap_andnot() functions are not present in the tools version of include/linux/bitmap.h, so add them as subsequent patches implement test code that requires them. We also add the missing __bitmap_subset() to tools/lib/bitmap.c. Link: https://lkml.kernel.org/r/0fd0d4ec868297f522003cb4b5898b53b498805b.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Cc: Pedro Falcato Signed-off-by: Andrew Morton commit 1c628004e0de0383a5a56facdb0bf28a54441b5f Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:12 2026 +0000 mm: add mk_vma_flags() bitmap flag macro helper This patch introduces the mk_vma_flags() macro helper to allow easy manipulation of VMA flags utilising the new bitmap representation implemented of VMA flags defined by the vma_flags_t type. It is a variadic macro which provides a bitwise-or'd representation of all of each individual VMA flag specified. Note that, while we maintain VM_xxx flags for backwards compatibility until the conversion is complete, we define VMA flags of type vma_flag_t using VMA_xxx_BIT to avoid confusing the two. This helper macro therefore can be used thusly: vma_flags_t flags = mk_vma_flags(VMA_READ_BIT, VMA_WRITE_BIT); Testing has demonstrated that the compiler optimises this code such that it generates the same assembly utilising this macro as it does if the flags were specified manually, for instance: vma_flags_t get_flags(void) { return mk_vma_flags(VMA_READ_BIT, VMA_WRITE_BIT, VMA_EXEC_BIT); } Generates the same code as: vma_flags_t get_flags(void) { vma_flags_t flags; vma_flags_clear_all(&flags); vma_flag_set(&flags, VMA_READ_BIT); vma_flag_set(&flags, VMA_WRITE_BIT); vma_flag_set(&flags, VMA_EXEC_BIT); return flags; } And: vma_flags_t get_flags(void) { vma_flags_t flags; unsigned long *bitmap = ACCESS_PRIVATE(&flags, __vma_flags); *bitmap = 1UL << (__force int)VMA_READ_BIT; *bitmap |= 1UL << (__force int)VMA_WRITE_BIT; *bitmap |= 1UL << (__force int)VMA_EXEC_BIT; return flags; } That is: get_flags: movl $7, %eax ret Link: https://lkml.kernel.org/r/fde00df6ff7fb8c4b42cc0defa5a4924c7a1943a.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Suggested-by: Jason Gunthorpe Reviewed-by: Pedro Falcato Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Signed-off-by: Andrew Morton commit e388d31257eddc1077a02ed786513d606c9e3266 Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:11 2026 +0000 mm: rename vma_flag_test/set_atomic() to vma_test/set_atomic_flag() In order to stay consistent between functions which manipulate a vm_flags_t argument of the form of vma_flags_...() and those which manipulate a VMA (in this case the flags field of a VMA), rename vma_flag_[test/set]_atomic() to vma_[test/set]_atomic_flag(). This lays the groundwork for adding VMA flag manipulation functions in a subsequent commit. Link: https://lkml.kernel.org/r/033dcf12e819dee5064582bced9b12ea346d1607.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Cc: Pedro Falcato Signed-off-by: Andrew Morton commit a30de4c6b79a83944d0d6a54cd6ae63014b62ef7 Author: Lorenzo Stoakes Date: Thu Jan 22 16:06:10 2026 +0000 mm/vma: remove __private sparse decoration from vma_flags_t Patch series "mm: add bitmap VMA flag helpers and convert all mmap_prepare to use them", v2. We introduced the bitmap VMA type vma_flags_t in the aptly named commit 9ea35a25d51b ("mm: introduce VMA flags bitmap type") in order to permit future growth in VMA flags and to prevent the asinine requirement that VMA flags be available to 64-bit kernels only if they happened to use a bit number about 32-bits. This is a long-term project as there are very many users of VMA flags within the kernel that need to be updated in order to utilise this new type. In order to further this aim, this series adds a number of helper functions to enable ordinary interactions with VMA flags - that is testing, setting and clearing them. In order to make working with VMA bit numbers less cumbersome this series introduces the mk_vma_flags() helper macro which generates a vma_flags_t from a variadic parameter list, e.g.: vma_flags_t flags = mk_vma_flags(VMA_READ_BIT, VMA_WRITE_BIT, VMA_EXEC_BIT); It turns out that the compiler optimises this very well to the point that this is just as efficient as using VM_xxx pre-computed bitmap values. This series then introduces the following functions: bool vma_flags_test_mask(vma_flags_t flags, vma_flags_t to_test); bool vma_flags_test_all_mask(vma_flags_t flags, vma_flags_t to_test); void vma_flags_set_mask(vma_flags_t *flags, vma_flags_t to_set); void vma_flags_clear_mask(vma_flags_t *flags, vma_flags_t to_clear); Providing means of testing any flag, testing all flags, setting, and clearing a specific vma_flags_t mask. For convenience, helper macros are provided - vma_flags_test(), vma_flags_set() and vma_flags_clear(), each of which utilise mk_vma_flags() to make these operations easier, as well as an EMPTY_VMA_FLAGS macro to make initialisation of an empty vma_flags_t value easier, e.g.: vma_flags_t flags = EMPTY_VMA_FLAGS; vma_flags_set(&flags, VMA_READ_BIT, VMA_WRITE_BIT, VMA_EXEC_BIT); ... if (vma_flags_test(flags, VMA_READ_BIT)) { ... } ... if (vma_flags_test_all_mask(flags, VMA_REMAP_FLAGS)) { ... } ... vma_flags_clear(&flags, VMA_READ_BIT); Since callers are often dealing with a vm_area_struct (VMA) or vm_area_desc (VMA descriptor as used in .mmap_prepare) object, this series further provides helpers for these - firstly vma_set_flags_mask() and vma_set_flags() for a VMA: vma_flags_t flags = EMPTY_VMA_FLAGS: vma_flags_set(&flags, VMA_READ_BIT, VMA_WRITE_BIT, VMA_EXEC_BIT); ... vma_set_flags_mask(&vma, flags); ... vma_set_flags(&vma, VMA_DONTDUMP_BIT); Note that these do NOT ensure appropriate locks are taken and assume the callers takes care of this. For VMA descriptors this series adds vma_desc_[test, set, clear]_flags_mask() and vma_desc_[test, set, clear]_flags() for a VMA descriptor, e.g.: static int foo_mmap_prepare(struct vm_area_desc *desc) { ... vma_desc_set_flags(desc, VMA_SEQ_READ_BIT); vma_desc_clear_flags(desc, VMA_RAND_READ_BIT); ... if (vma_desc_test_flags(desc, VMA_SHARED_BIT) { ... } ... } With these helpers introduced, this series then updates all mmap_prepare users to make use of the vma_flags_t vm_area_desc->vma_flags field rather than the legacy vm_flags_t vm_area_desc->vm_flags field. In order to do so, several other related functions need to be updated, with separate patches for larger changes in hugetlbfs, secretmem and shmem before finally removing vm_area_desc->vm_flags altogether. This lays the foundations for future elimination of vm_flags_t and associated defines and functionality altogether in the long run, and elimination of the use of vm_flags_t in f_op->mmap() hooks in the near term as mmap_prepare replaces these. There is a useful synergy between the VMA flags and mmap_prepare work here as with this change in place, converting f_op->mmap() to f_op->mmap_prepare naturally also converts use of vm_flags_t to vma_flags_t in all drivers which declare mmap handlers. This accounts for the majority of the users of the legacy vm_flags_*() helpers and thus a large number of drivers which need to interact with VMA flags in general. This series also updates the userland VMA tests to account for the change, and adds unit tests for these helper functions to assert that they behave as expected. In order to faciliate this change in a sensible way, the series also separates out the VMA unit tests into - code that is duplicated from the kernel that should be kept in sync, code that is customised for test purposes and code that is stubbed out. We also separate out the VMA userland tests into separate files to make it easier to manage and to provide a sensible baseline for adding the userland tests for these helpers. This patch (of 13): We need to pass around these values and access them in a way that sparse does not allow, as __private implies noderef, i.e. disallowing dereference of the value, which manifests as sparse warnings even when passed around benignly. Link: https://lkml.kernel.org/r/cover.1769097829.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/64fa89f416f22a60ae74cfff8fd565e7677be192.1769097829.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Liam R. Howlett Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Damien Le Moal Cc: "Darrick J. Wong" Cc: Jarkko Sakkinen Cc: Yury Norov Cc: Chris Mason Signed-off-by: Andrew Morton commit a8700d42b0af3a1751f70d53ee90c97fb4dc50f2 Author: Liam R. Howlett Date: Wed Jan 21 11:49:46 2026 -0500 mm: use unmap_desc struct for freeing page tables Pass through the unmap_desc to free_pgtables() because it almost has everything necessary and is already on the stack. Updates testing code as necessary. No functional changes intended. [Liam.Howlett@oracle.com: fix up unmap desc use on exit_mmap()] Link: https://lkml.kernel.org/r/20260210214214.364856-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20260121164946.2093480-12-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Cc: Suren Baghdasaryan Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: Pedro Falcato Cc: SeongJae Park Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2314fe9ba5e6cd1bf731ca7243f6aac9dc112490 Author: Liam R. Howlett Date: Wed Jan 21 11:49:45 2026 -0500 mm/vma: use unmap_region() in vms_clear_ptes() There is no need to open code the vms_clear_ptes() now that unmap_desc struct is used. Link: https://lkml.kernel.org/r/20260121164946.2093480-11-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: Pedro Falcato Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0df5a8d3948da979b8ab811a692b34635e1b146d Author: Liam R. Howlett Date: Wed Jan 21 11:49:44 2026 -0500 mm/vma: use unmap_desc in exit_mmap() and vms_clear_ptes() Convert vms_clear_ptes() to use unmap_desc to call unmap_vmas() instead of the large argument list. The UNMAP_STATE() cannot be used because the vma iterator in the vms does not point to the correct maple state (mas_detach), and the tree_end will be set incorrectly. Setting up the arguments manually avoids setting the struct up incorrectly and doing extra work to get the correct pagetable range. exit_mmap() also calls unmap_vmas() with many arguments. Using the unmap_all_init() function to set the unmap descriptor for all vmas makes this a bit easier to read. Update to the vma test code is necessary to ensure testing continues to function. No functional changes intended. Link: https://lkml.kernel.org/r/20260121164946.2093480-10-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: Pedro Falcato Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5b6626a76a81fdf54abb33da0bbb061d830e9821 Author: Liam R. Howlett Date: Wed Jan 21 11:49:43 2026 -0500 mm: introduce unmap_desc struct to reduce function arguments The unmap_region code uses a number of arguments that could use better documentation. With the addition of a descriptor for unmap (called unmap_desc), the arguments can be more self-documenting and increase the descriptions within the declaration. No functional change intended Link: https://lkml.kernel.org/r/20260121164946.2093480-9-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 43873af772f8138c5cb4b76dde9c26339e89be3b Author: Liam R. Howlett Date: Wed Jan 21 11:49:42 2026 -0500 mm: change dup_mmap() recovery When the dup_mmap() fails during the vma duplication or setup, don't write the XA_ZERO entry in the vma tree. Instead, destroy the tree and free the new resources, leaving an empty vma tree. Using XA_ZERO introduced races where the vma could be found between dup_mmap() dropping all locks and exit_mmap() taking the locks. The race can occur because the mm can be reached through the other trees via successfully copied vmas and other methods such as the swapoff code. XA_ZERO was marking the location to stop vma removal and pagetable freeing. The newly created arguments to the unmap_vmas() and free_pgtables() serve this function. Replacing the XA_ZERO entry use with the new argument list also means the checks for xa_is_zero() are no longer necessary so these are also removed. Note that dup_mmap() now cleans up when ALL vmas are successfully copied, but the dup_mmap() fails to completely set up some other aspect of the duplication. Link: https://lkml.kernel.org/r/20260121164946.2093480-8-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Suren Baghdasaryan Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: SeongJae Park Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 243de0c0dc04df4483796869704598dfa567f2e4 Author: Liam R. Howlett Date: Wed Jan 21 11:49:41 2026 -0500 mm/vma: add page table limit to unmap_region() The unmap_region() calls need to pass through the page table limit for a future patch. No functional changes intended. Link: https://lkml.kernel.org/r/20260121164946.2093480-7-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit eda8c5e776220ce9c869f5c714ccef90c6e1966b Author: Liam R. Howlett Date: Wed Jan 21 11:49:40 2026 -0500 mm/memory: add tree limit to free_pgtables() The ceiling and tree search limit need to be different arguments for the future change in the failed fork attempt. The ceiling and floor variables are not very descriptive, so change them to pg_start/pg_end. Adding a new variable for the vma_end to the function as it will differ from the pg_end in the later patches in the series. Add a kernel doc about the free_pgtables() function. Test code also updated. No functional changes intended. Link: https://lkml.kernel.org/r/20260121164946.2093480-6-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 23bd03a9a20410d8a1a7d44ef4954ed00190fb41 Author: Liam R. Howlett Date: Wed Jan 21 11:49:39 2026 -0500 mm/vma: add limits to unmap_region() for vmas Add a limit to the vma search instead of using the start and end of the one passed in. No functional changes intended. Link: https://lkml.kernel.org/r/20260121164946.2093480-5-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Suren Baghdasaryan Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: SeongJae Park Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d6d13e2ad81ae6edd28ee040755184868a3fb183 Author: Liam R. Howlett Date: Wed Jan 21 11:49:38 2026 -0500 mm/mmap: abstract vma clean up from exit_mmap() Create the new function tear_down_vmas() to remove a range of vmas. exit_mmap() will be removing all the vmas. This is necessary for future patches. No functional changes intended. Link: https://lkml.kernel.org/r/20260121164946.2093480-4-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Reviewed-by: David Hildenbrand Reviewed-by: Pedro Falcato Reviewed-by: Suren Baghdasaryan Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: SeongJae Park Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 95725acc3cd839afee8320591dbd968770196210 Author: Liam R. Howlett Date: Wed Jan 21 11:49:37 2026 -0500 mm/mmap: move exit_mmap() trace point Move the trace point later in the function so that it is not skipped in the event of a failed fork. Link: https://lkml.kernel.org/r/20260121164946.2093480-3-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Acked-by: Chris Li Reviewed-by: Lorenzo Stoakes Reviewed-by: David Hildenbrand Reviewed-by: Pedro Falcato Reviewed-by: Suren Baghdasaryan Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: SeongJae Park Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit bed76bec3111c956a9756643d759d5c7a2193b37 Author: Liam R. Howlett Date: Wed Jan 21 11:49:36 2026 -0500 mm: relocate the page table ceiling and floor definitions Patch series " Remove XA_ZERO from error recovery of dup_mmap()", v3. It is possible that the dup_mmap() call fails on allocating or setting up a vma after the maple tree of the oldmm is copied. Today, that failure point is marked by inserting an XA_ZERO entry over the failure point so that the exact location does not need to be communicated through to exit_mmap(). However, a race exists in the tear down process because the dup_mmap() drops the mmap lock before exit_mmap() can remove the partially set up vma tree. This means that other tasks may get to the mm tree and find the invalid vma pointer (since it's an XA_ZERO entry), even though the mm is marked as MMF_OOM_SKIP and MMF_UNSTABLE. To remove the race fully, the tree must be cleaned up before dropping the lock. This is accomplished by extracting the vma cleanup in exit_mmap() and changing the required functions to pass through the vma search limit. Any other tree modifications would require extra cycles which should be spent on freeing memory. This does run the risk of increasing the possibility of finding no vmas (which is already possible!) in code that isn't careful. The final four patches are to address the excessive argument lists being passed between the functions. Using the struct unmap_desc also allows some special-case code to be removed in favour of the struct setup differences. This patch (of 11): pgtables.h defines a fallback for ceiling and floor of the page tables within the CONFIG_MMU section. Moving the definitions to outside the CONFIG_MMU allows for using them in generic code. [akpm@linux-foundation.org: remove stray newline, per SeongJae] Link: https://lkml.kernel.org/r/20260121164946.2093480-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20260121164946.2093480-2-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Suggested-by: Lorenzo Stoakes Suggested-by: SeongJae Park Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Jann Horn Cc: Kairui Song Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nhat Pham Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3f54ef56fd4540142d2d9a7e7cf0b70dd221c1e1 Author: Ankur Arora Date: Wed Jan 28 10:59:43 2026 -0800 mm: folio_zero_user: open code range computation in folio_zero_user() riscv64-gcc-linux-gnu (v8.5) reports a compile time assert in: r[2] = DEFINE_RANGE(clamp_t(s64, fault_idx - radius, pg.start, pg.end), clamp_t(s64, fault_idx + radius, pg.start, pg.end)); where it decides that pg.start > pg.end in: clamp_t(s64, fault_idx + radius, pg.start, pg.end)); where pg comes from: const struct range pg = DEFINE_RANGE(0, folio_nr_pages(folio) - 1); That does not seem like it could be true. Even for pg.start == pg.end, we would need folio_test_large() to evaluate to false at compile time: static inline unsigned long folio_nr_pages(const struct folio *folio) { if (!folio_test_large(folio)) return 1; return folio_large_nr_pages(folio); } Workaround by open coding the range computation. Also, simplify the type declarations for the relevant variables. [ankur.a.arora@oracle.com: remove unneeded cast, per David] Link: https://lkml.kernel.org/r/20260206223801.2617497-1-ankur.a.arora@oracle.com Link: https://lkml.kernel.org/r/20260206223801.2617497-1-ankur.a.arora@oracle.com Link: https://lkml.kernel.org/r/20260128185943.2397128-1-ankur.a.arora@oracle.com Fixes: 93552c9a3350 ("mm: folio_zero_user: cache neighbouring pages") Signed-off-by: Ankur Arora Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601240453.QCjgGdJa-lkp@intel.com/ Acked-by: David Hildenbrand (Arm) Cc: Andy Lutomirski Cc: "Borislav Petkov (AMD)" Cc: Boris Ostrovsky Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Konrad Rzessutek Wilk Cc: Lance Yang Cc: Li Zhe Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit 7ec9ecf217f8e565577bde8a47915a51491ef3a3 Author: Bing Jiao Date: Wed Jan 14 20:53:03 2026 +0000 mm/vmscan: select the closest preferred node in demote_folio_list() The preferred demotion node (migration_target_control.nid) should be the one closest to the source node to minimize migration latency. Currently, a discrepancy exists where demote_folio_list() randomly selects an allowed node if the preferred node from next_demotion_node() is not set in mems_effective. To address it, update next_demotion_node() to select a preferred target against allowed nodes; and to return the closest demotion target if all preferred nodes are not in mems_effective via next_demotion_node(). It ensures that the preferred demotion target is consistently the closest available node to the source node. [akpm@linux-foundation.org: fix comment typo, per Shakeel] Link: https://lkml.kernel.org/r/20260114205305.2869796-3-bingjiao@google.com Signed-off-by: Bing Jiao Acked-by: Shakeel Butt Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Gregory Price Cc: Johannes Weiner Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Vlastimil Babka Cc: Waiman Long Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 1aceed565ff172fc0331dd1d5e7e65139b711139 Author: Bing Jiao Date: Wed Jan 14 20:53:02 2026 +0000 mm/vmscan: fix demotion targets checks in reclaim/demotion Patch series "mm/vmscan: fix demotion targets checks in reclaim/demotion", v9. This patch series addresses two issues in demote_folio_list(), can_demote(), and next_demotion_node() in reclaim/demotion. 1. demote_folio_list() and can_demote() do not correctly check demotion target against cpuset.mems_effective, which will cause (a) pages to be demoted to not-allowed nodes and (b) pages fail demotion even if the system still has allowed demotion nodes. Patch 1 fixes this bug by updating cpuset_node_allowed() and mem_cgroup_node_allowed() to return effective_mems, allowing directly logic-and operation against demotion targets. 2. next_demotion_node() returns a preferred demotion target, but it does not check the node against allowed nodes. Patch 2 ensures that next_demotion_node() filters against the allowed node mask and selects the closest demotion target to the source node. This patch (of 2): Fix two bugs in demote_folio_list() and can_demote() due to incorrect demotion target checks against cpuset.mems_effective in reclaim/demotion. Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim") introduces the cpuset.mems_effective check and applies it to can_demote(). However: 1. It does not apply this check in demote_folio_list(), which leads to situations where pages are demoted to nodes that are explicitly excluded from the task's cpuset.mems. 2. It checks only the nodes in the immediate next demotion hierarchy and does not check all allowed demotion targets in can_demote(). This can cause pages to never be demoted if the nodes in the next demotion hierarchy are not set in mems_effective. These bugs break resource isolation provided by cpuset.mems. This is visible from userspace because pages can either fail to be demoted entirely or are demoted to nodes that are not allowed in multi-tier memory systems. To address these bugs, update cpuset_node_allowed() and mem_cgroup_node_allowed() to return effective_mems, allowing directly logic-and operation against demotion targets. Also update can_demote() and demote_folio_list() accordingly. Bug 1 reproduction: Assume a system with 4 nodes, where nodes 0-1 are top-tier and nodes 2-3 are far-tier memory. All nodes have equal capacity. Test script: echo 1 > /sys/kernel/mm/numa/demotion_enabled mkdir /sys/fs/cgroup/test echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control echo "0-2" > /sys/fs/cgroup/test/cpuset.mems echo $$ > /sys/fs/cgroup/test/cgroup.procs swapoff -a # Expectation: Should respect node 0-2 limit. # Observation: Node 3 shows significant allocation (MemFree drops) stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1 Bug 2 reproduction: Assume a system with 6 nodes, where nodes 0-2 are top-tier, node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes. All nodes have equal capacity. Test script: echo 1 > /sys/kernel/mm/numa/demotion_enabled mkdir /sys/fs/cgroup/test echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems echo $$ > /sys/fs/cgroup/test/cgroup.procs swapoff -a # Expectation: Pages are demoted to Nodes 4-5 # Observation: No pages are demoted before oom. stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2 Link: https://lkml.kernel.org/r/20260114205305.2869796-1-bingjiao@google.com Link: https://lkml.kernel.org/r/20260114205305.2869796-2-bingjiao@google.com Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim") Signed-off-by: Bing Jiao Acked-by: Shakeel Butt Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Gregory Price Cc: Johannes Weiner Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Vlastimil Babka Cc: Waiman Long Cc: Wei Xu Cc: Yuanchu Xie Cc: Signed-off-by: Andrew Morton commit 61dc9f776705d6db6847c101b98fa4f0e9eb6fa3 Author: Andrii Nakryiko Date: Tue Feb 10 11:27:38 2026 -0800 procfs: fix possible double mmput() in do_procmap_query() When user provides incorrectly sized buffer for build ID for PROCMAP_QUERY we return with -ENAMETOOLONG error. After recent changes this condition happens later, after we unlocked mmap_lock/per-VMA lock and did mmput(), so original goto out is now wrong and will double-mmput() mm_struct. Fix by jumping further to clean up only vm_file and name_buf. Link: https://lkml.kernel.org/r/20260210192738.3041609-1-andrii@kernel.org Fixes: b5cbacd7f86f ("procfs: avoid fetching build ID while holding VMA lock") Signed-off-by: Andrii Nakryiko Reported-by: Ruikai Peng Reported-by: Thomas Gleixner Tested-by: Thomas Gleixner Reviewed-by: Shakeel Butt Reported-by: syzbot+237b5b985b78c1da9600@syzkaller.appspotmail.com Cc: Ruikai Peng Closes: https://lkml.kernel.org/r/CAFD3drOJANTZPuyiqMdqpiRwOKnHwv5QgMNZghCDr-WxdiHvMg@mail.gmail.com Closes: https://lore.kernel.org/all/698aaf3c.050a0220.3b3015.0088.GAE@google.com/T/#u Cc: Signed-off-by: Andrew Morton commit 338ad1e84d15078a9ae46d7dd7466329ae0bfa61 Author: Harry Yoo Date: Mon Feb 9 15:26:39 2026 +0900 mm/page_alloc: skip debug_check_no_{obj,locks}_freed with FPI_TRYLOCK When CONFIG_DEBUG_OBJECTS_FREE is enabled, debug_check_no_{obj,locks}_freed() functions are called. Since both of them spin on a lock, they are not safe to be called if the FPI_TRYLOCK flag is specified. This leads to a lockdep splat: ================================ WARNING: inconsistent lock state 6.19.0-rc5-slab-for-next+ #326 Tainted: G N -------------------------------- inconsistent {INITIAL USE} -> {IN-NMI} usage. kunit_try_catch/9046 [HC2[2]:SC0[0]:HE0:SE1] takes: ffffffff84ed6bf8 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_check_no_obj_freed+0xe0/0x300 {INITIAL USE} state was registered at: lock_acquire+0xd9/0x2f0 _raw_spin_lock_irqsave+0x4c/0x80 __debug_object_init+0x9d/0x1f0 debug_object_init+0x34/0x50 __init_work+0x28/0x40 init_cgroup_housekeeping+0x151/0x210 init_cgroup_root+0x3d/0x140 cgroup_init_early+0x30/0x240 start_kernel+0x3e/0xcd0 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0xf3/0x140 common_startup_64+0x13e/0x148 irq event stamp: 2998 hardirqs last enabled at (2997): [] exc_nmi+0x11a/0x240 hardirqs last disabled at (2998): [] sysvec_irq_work+0x11/0x110 softirqs last enabled at (1416): [] __irq_exit_rcu+0x132/0x1c0 softirqs last disabled at (1303): [] __irq_exit_rcu+0x132/0x1c0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&obj_hash[i].lock); lock(&obj_hash[i].lock); *** DEADLOCK *** Rename free_pages_prepare() to __free_pages_prepare(), add an fpi_t parameter, and skip those checks if FPI_TRYLOCK is set. To keep the fpi_t definition in mm/page_alloc.c, add a wrapper function free_pages_prepare() that always passes FPI_NONE and use it in mm/compaction.c. Link: https://lkml.kernel.org/r/20260209062639.16577-1-harry.yoo@oracle.com Fixes: 8c57b687e833 ("mm, bpf: Introduce free_pages_nolock()") Signed-off-by: Harry Yoo Reviewed-by: Vlastimil Babka Acked-by: Zi Yan Cc: Alexei Starovoitov Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Sebastian Andrzej Siewior Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit 1d3f9bb4c8af70304d19c22e30f5d16a2d589bb5 Author: Joshua Hahn Date: Fri Jan 16 15:40:36 2026 -0500 mm/hugetlb: restore failed global reservations to subpool Commit a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool") fixed an underflow error for hstate->resv_huge_pages caused by incorrectly attributing globally requested pages to the subpool's reservation. Unfortunately, this fix also introduced the opposite problem, which would leave spool->used_hpages elevated if the globally requested pages could not be acquired. This is because while a subpool's reserve pages only accounts for what is requested and allocated from the subpool, its "used" counter keeps track of what is consumed in total, both from the subpool and globally. Thus, we need to adjust spool->used_hpages in the other direction, and make sure that globally requested pages are uncharged from the subpool's used counter. Each failed allocation attempt increments the used_hpages counter by how many pages were requested from the global pool. Ultimately, this renders the subpool unusable, as used_hpages approaches the max limit. The issue can be reproduced as follows: 1. Allocate 4 hugetlb pages 2. Create a hugetlb mount with max=4, min=2 3. Consume 2 pages globally 4. Request 3 pages from the subpool (2 from subpool + 1 from global) 4.1 hugepage_subpool_get_pages(spool, 3) succeeds. used_hpages += 3 4.2 hugetlb_acct_memory(h, 1) fails: no global pages left used_hpages -= 2 5. Subpool now has used_hpages = 1, despite not being able to successfully allocate any hugepages. It believes it can now only allocate 3 more hugepages, not 4. With each failed allocation attempt incrementing the used counter, the subpool eventually reaches a point where its used counter equals its max counter. At that point, any future allocations that try to allocate hugeTLB pages from the subpool will fail, despite the subpool not having any of its hugeTLB pages consumed by any user. Once this happens, there is no way to make the subpool usable again, since there is no way to decrement the used counter as no process is really consuming the hugeTLB pages. The underflow issue that the original commit fixes still remains fixed as well. Without this fix, used_hpages would keep on leaking if hugetlb_acct_memory() fails. Link: https://lkml.kernel.org/r/20260116204037.2270096-1-joshua.hahnjy@gmail.com Fixes: a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool") Signed-off-by: Joshua Hahn Acked-by: Usama Arif Cc: David Hildenbrand Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Ma Wupeng Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Waiman Long Cc: Signed-off-by: Andrew Morton commit 041c16acbafbdd8c089cc077c78e060322dde18c Merge: e99785a923d585 795663b4d160ba Author: Linus Torvalds Date: Thu Feb 12 15:07:50 2026 -0800 Merge tag 'for-7.0/io_uring-zcrx-large-buffers-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring large rx buffer support from Jens Axboe: "Now that the networking updates are upstream, here's the support for large buffers for zcrx. Using larger (bigger than 4K) rx buffers can increase the effiency of zcrx. For example, it's been shown that using 32K buffers can decrease CPU usage by ~30% compared to 4K buffers" * tag 'for-7.0/io_uring-zcrx-large-buffers-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/zcrx: implement large rx buffer support commit e99785a923d585174a71ea9c081bee708184862e Merge: 582a1ef360a05b a9ba6733c7f109 Author: Linus Torvalds Date: Thu Feb 12 14:47:35 2026 -0800 Merge tag 'libnvdimm-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Ira Weiny: "A kmap conversion and a bug fix this go around: - drivers/nvdimm: Use local kmaps - nvdimm: virtio_pmem: serialize flush requests" * tag 'libnvdimm-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: virtio_pmem: serialize flush requests drivers/nvdimm: Use local kmaps commit 582a1ef360a05bff4350bbf6e383f61d26b804f0 Merge: f75c03a761b737 6ea8a206108fe8 Author: Linus Torvalds Date: Thu Feb 12 14:31:02 2026 -0800 Merge tag 'trace-rtla-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull RTLA updates from Steven Rostedt: - Remove unused function declarations Some functions were removed in recent code consolidation 6.18, but their prototypes were not removed from headers. Remove them. - Set stop threshold after enabling instances Prefer recording samples without stopping on them on the start of tracing to stopping on samples that are never recorded. This fixes flakiness of some RTLA tests and unifies behavior of sample collection between tracefs mode and BPF mode. - Consolidate usage help message implementation RTLA tools (osnoise-top, osnoise-hist, timerlat-top, timerlat-hist) each implement usage help individually. Move common logic between them into a new function to reduce code duplication. - Add BPF actions feature Add option --bpf-action to attach a BPF program (passed as filename of its ELF representation) to be executed via BPF tail call at latency threshold. - Consolidate command line option parsing Each RTLA tool implements the parsing of command line options individually. Now that we have a common structure for parameters, unify the parsing of those options common among all four tools into one function. - De-duplicate cgroup common code Two functions in utils.c, setting cgroup for comm and setting cgroup for pid, duplicate code for constructing the cgroup path. Extract it to a new helper function. - String and error handling fixes and cleanups There were several instances of unsafe string and error handling that could cause invalid memory access; fix them. Also, remove a few unused headers, update .gitignore, and deduplicate code. * tag 'trace-rtla-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (30 commits) rtla: Fix parse_cpu_set() bug introduced by strtoi() rtla: Fix parse_cpu_set() return value documentation rtla: Ensure null termination after read operations in utils.c rtla: Make stop_tracing variable volatile rtla: Add generated output files to gitignore rtla: Fix NULL pointer dereference in actions_parse rtla: Remove unused headers rtla: Remove redundant memset after calloc rtla: Use standard exit codes for result enum rtla: Replace atoi() with a robust strtoi() rtla: Introduce for_each_action() helper tools/rtla: Deduplicate cgroup path opening code tools/rtla: Consolidate -H/--house-keeping option parsing tools/rtla: Consolidate -P/--priority option parsing tools/rtla: Consolidate -e/--event option parsing tools/rtla: Consolidate -d/--duration option parsing tools/rtla: Consolidate -D/--debug option parsing tools/rtla: Consolidate -C/--cgroup option parsing tools/rtla: Consolidate -c/--cpus option parsing tools/rtla: Add common_parse_options() ... commit f75c03a761b737c4ee94c17f154967261f00ab4d Merge: a67594c977234b 403faa575738a7 Author: Linus Torvalds Date: Thu Feb 12 14:08:49 2026 -0800 Merge tag 'trace-rv-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verifier updates from Steven Rostedt: - Refactor da_monitor to minimize macros Complete refactor of da_monitor.h to reduce reliance on macros generating functions. Use generic static functions and uses the preprocessor only when strictly necessary (e.g. for tracepoint handlers). The change essentially relies on functions with generic names (e.g. da_handle) instead of monitor-specific as well adding the need to define constant (e.g. MONITOR_NAME, MONITOR_TYPE) before including the header rather than calling macros that would define functions. Also adapt monitors and documentation accordingly. - Cleanup DA code generation scripts Clean up functions in dot2c removing reimplementations of trivial library functions (__buff_to_string) and removing some other unused intermediate steps. - Annotate functions with types in the rvgen python scripts - Remove superfluous assignments and cleanup generated code The rvgen scripts generate a superfluous assignment to 0 for enum variables and don't add commas to the last elements, which is against the kernel coding standards. Change the generation process for a better compliance and slightly simpler logic. - Remove superfluous declarations from generated code The monitor container source files contained a declaration and a definition for the rv_monitor variable. The former is superfluous and was removed. - Fix reference to outdated documentation s/da_monitor_synthesis.rst/monitor_synthesis.rst in comment in da_monitor.h * tag 'trace-rv-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rv: Fix documentation reference in da_monitor.h verification/rvgen: Remove unused variable declaration from containers verification/dot2c: Remove superfluous enum assignment and add last comma verification/dot2c: Remove __buff_to_string() and cleanup verification/rvgen: Annotate DA functions with types verification/rvgen: Adapt dot2k and templates after refactoring da_monitor.h Documentation/rv: Adapt documentation after da_monitor refactoring rv: Cleanup da_monitor after refactor rv: Refactor da_monitor to minimise macros commit a67594c977234b0ad6887202740e9e8b9821473a Merge: 8c0901b6f9c807 0dfffa5479d626 Author: Linus Torvalds Date: Thu Feb 12 14:04:43 2026 -0800 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC updates from Stafford Horne: "The main focus for this series has been to improve OpenRISC kernel out-of-the-box support for FPGA dev boards. - Add device tree configurations for De0 Nano single and multicore configurations - Fix bug in OpenRISC SMP preventing the kernel from running on FPGA boards, due to IPIs not being unmasked on secondary CPUs in some configurations - Pick up a fix from Brian Masney defining the nop() macro to fix build failures on OpenRISC for drivers using it" * tag 'for-linus' of https://github.com/openrisc/linux: openrisc: define arch-specific version of nop() openrisc: dts: Add de0 nano multicore config and devicetree openrisc: dts: Split simple smp dts to dts and dtsi openrisc: Fix IPIs on simple multicore systems openrisc: dts: Add de0 nano config and devicetree commit 8c0901b6f9c807a6aa33dccedc548bf10c17a85c Merge: 136114e0abf030 6363844fdbbb76 Author: Linus Torvalds Date: Thu Feb 12 14:01:38 2026 -0800 Merge tag 'configfs-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux Pull configfs updates from Andreas Hindborg: - Switch the configfs rust bindings to use c string literals provided by the compiler, rather than a macro - A follow up on constifying `configfs_item_operations`, applying the change to the configfs sample * tag 'configfs-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux: samples: configfs: Constify struct configfs_item_operations and configfs_group_operations rust: configfs: replace `kernel::c_str!` with C-Strings commit 048714d9df73a724d3f84b587f1110963e32f9b3 Author: David Carlier Date: Thu Feb 12 20:35:19 2026 +0000 tools/sched_ext: scx_userland: fix restart and stats thread lifecycle bugs Fix three issues in scx_userland's restart path: - exit_req is not reset on restart, causing sched_main_loop() to exit immediately without doing any scheduling work. - stats_printer thread handle is local to spawn_stats_thread(), making it impossible to join from main(). Promote it to file scope. - The stats thread continues reading skel->bss after the skeleton is destroyed on restart, causing a use-after-free. Join the stats thread before destroying the skeleton to ensure it has exited. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit dbf0108347bdb5d4ccef8910555b16c1f1a505f8 Author: Ian Rogers Date: Mon Feb 9 12:22:08 2026 -0800 perf test script: Add python script testing support Basic coverage of python script support from `perf script`. Committer testing: $ perf test 'perf script python' 107: perf script python tests : Ok $ perf test -vv 'perf script python' 107: perf script python tests: --- start --- test child forked, pid 595537 Testing event: sched:sched_switch perf script python test [Skipped: failed to record sched:sched_switch] Testing event: task-clock Generating python script... generated Python script: /tmp/__perf_test_script.J4rWj.py Executing python script... perf script python test [Success: task-clock triggered param_dict] ---- end(0) ---- 107: perf script python tests : Ok $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Yujie Liu Signed-off-by: Arnaldo Carvalho de Melo commit 2273697781d27c6ac033cdca7b5f5f5ad12e28f9 Author: Ian Rogers Date: Mon Feb 9 12:22:07 2026 -0800 perf test script: Add perl script testing support Basic coverage of perl script support from `perf script`. This is disabled by default and so the test will most normally skip. Committer testing: $ perf test 'perf script perl' 106: perf script perl tests : Skip $ perf test -vv 'perf script perl' 106: perf script perl tests: --- start --- test child forked, pid 578323 perf script perl test [Skipped: no libperl support] ---- end(-2) ---- 106: perf script perl tests : Skip $ perf check feature libperl libperl: [ OFF ] # HAVE_LIBPERL_SUPPORT ( tip: Deprecated, use LIBPERL=1 and install perl-ExtUtils-Embed/libperl-dev to build with it ) $ Install perl-ExtUtils-Embed, build with LIBPERL=1, rebuild: $ perf check feature libperl libperl: [ on ] # HAVE_LIBPERL_SUPPORT $ perf test 'perf script perl' 106: perf script perl tests : Ok $ perf test -vv 'perf script perl' 106: perf script perl tests: --- start --- test child forked, pid 588206 Testing event: sched:sched_switch perf script perl test [Skipped: failed to record sched:sched_switch] Testing event: task-clock Generating perl script... generated Perl script: /tmp/__perf_test_script.RpMn5.pl Executing perl script... perf script perl test [Success: task-clock triggered $VAR1] ---- end(0) ---- 106: perf script perl tests : Ok $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Yujie Liu Signed-off-by: Arnaldo Carvalho de Melo commit 22ca2f7f32cc783b57bc1223b84d6f5ba3e5d1e2 Author: Ian Rogers Date: Mon Feb 9 12:22:06 2026 -0800 perf script: Allow the generated script to be a path Allow the script generated by "perf script -g " to be a file path and the language determined by the file extension. This is useful in testing so that the generated script file can be written to a test directory. Committer testing: $ perf record ls a.a ls: cannot access 'a.a': No such file or directory [ perf record: Woken up 2 times to write data ] [ perf record: Captured and wrote 0.003 MB perf.data (7 samples) ] $ perf script -g python generated Python script: perf-script.py $ perf script -g myscript.py generated Python script: myscript.py $ diff -u perf-script.py myscript.py $ tail myscript.py def trace_unhandled(event_name, context, event_fields_dict, perf_sample_dict): print(get_dict_as_string(event_fields_dict)) print('Sample: {'+get_dict_as_string(perf_sample_dict['sample'], ', ')+'}') def print_header(event_name, cpu, secs, nsecs, pid, comm): print("%-20s %5u %05u.%09u %8u %-20s " % \ (event_name, cpu, secs, nsecs, pid, comm), end="") def get_dict_as_string(a_dict, delimiter=' '): return delimiter.join(['%s=%s'%(k,str(v))for k,v in sorted(a_dict.items())]) $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Yujie Liu Signed-off-by: Arnaldo Carvalho de Melo commit 9083ce531a1f7fb5186be934f42d884de34698da Author: Ian Rogers Date: Tue Feb 10 17:52:42 2026 -0800 perf test: perf data --to-ctf testing If babeltrace is detected check that --to-ctf functions with a data file and in pipe mode. Committer testing: $ perf test 'perf data convert --to-ctf' 124: 'perf data convert --to-ctf' command test : Ok $ perf test -vv 'perf data convert --to-ctf' 124: 'perf data convert --to-ctf' command test: --- start --- test child forked, pid 556008 libbabeltrace: [ on ] # HAVE_LIBBABELTRACE_SUPPORT Testing Perf Data Conversion Command to CTF (File input) [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.021 MB /tmp/__perf_test.perf.data.9TxzZ (115 samples) ] [ perf data convert: Converted '/tmp/__perf_test.perf.data.9TxzZ' into CTF data '/tmp/__perf_test.ctf.f5EkS' ] [ perf data convert: Converted and wrote 0.012 MB (115 samples) ] Perf Data Converter Command to CTF (File input) [SUCCESS] Testing Perf Data Conversion Command to CTF (Pipe mode) [ perf record: Woken up 2 times to write data ] [ perf record: Captured and wrote 0.047 MB - ] Failed to setup all events. [ perf data convert: Converted '/tmp/__perf_test.perf.data.9TxzZ' into CTF data '/tmp/__perf_test.ctf.f5EkS' ] [ perf data convert: Converted and wrote 0.000 MB (0 samples) ] Perf Data Converter Command to CTF (Pipe mode) [SUCCESS] Unexpected signal in main ---- end(0) ---- 124: 'perf data convert --to-ctf' command test : Ok $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Derek Foreman Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit fc4577b52a891da3828af52c1e1c7167b9dcd4dc Author: Ian Rogers Date: Tue Feb 10 17:52:41 2026 -0800 perf test: Test pipe mode with data conversion --to-json Add pipe mode test for json data conversion. Tidy up exit and cleanup code. Committer testing: $ perf test 'perf data convert --to-json' 124: 'perf data convert --to-json' command test : Ok $ perf test -vv 'perf data convert --to-json' 124: 'perf data convert --to-json' command test: --- start --- test child forked, pid 548738 Testing Perf Data Conversion Command to JSON [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.020 MB /tmp/__perf_test.perf.data.krxvl (104 samples) ] [ perf data convert: Converted '/tmp/__perf_test.perf.data.krxvl' into JSON data '/tmp/__perf_test.output.json.0z60p' ] [ perf data convert: Converted and wrote 0.075 MB (104 samples) ] Perf Data Converter Command to JSON [SUCCESS] Validating Perf Data Converted JSON file The file contains valid JSON format [SUCCESS] Testing Perf Data Conversion Command to JSON (Pipe mode) [ perf record: Woken up 2 times to write data ] [ perf record: Captured and wrote 0.046 MB - ] [ perf data convert: Converted '-' into JSON data '/tmp/__perf_test.output.json.0z60p' ] [ perf data convert: Converted and wrote 0.081 MB (110 samples) ] Perf Data Converter Command to JSON (Pipe mode) [SUCCESS] Validating Perf Data Converted JSON file The file contains valid JSON format [SUCCESS] ---- end(0) ---- 124: 'perf data convert --to-json' command test : Ok $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Derek Foreman Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 5b92fc082c835bebfa94f790e428b8c039afc457 Author: Ian Rogers Date: Tue Feb 10 17:52:40 2026 -0800 perf json: Pipe mode --to-ctf support In pipe mode the environment may not be fully initialized so be robust to fields being NULL. Add default handling of attr events, use the feature events to populate the ctf writer environment. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Derek Foreman Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 6db2f7c67b2804bc13fa385ff4e462fc3b366f8f Author: Ian Rogers Date: Tue Feb 10 17:52:39 2026 -0800 perf json: Pipe mode --to-json support In pipe mode the environment may not be fully initialized so be robust to fields being NULL. Add default handling of feature and attr events. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Derek Foreman Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 8772598b7801a2bb235bd35a858017e0fb939c38 Author: Ian Rogers Date: Tue Feb 10 17:52:38 2026 -0800 perf check: Add libbabeltrace to the listed features This enables scripts to more easily determine if `perf data --to-ctf` is supported. Committer testing: $ perf check feature libbabeltrace libbabeltrace: [ on ] # HAVE_LIBBABELTRACE_SUPPORT $ perf check feature -q libbabeltrace && echo have libbabeltrace support have libbabeltrace support $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Derek Foreman Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 9eb1760f846a38ea4ef1e5e177a2a0415e34c267 Author: hupu Date: Tue Dec 23 16:43:34 2025 +0800 perf build: Allow passing extra Clang flags via EXTRA_BPF_FLAGS Add support for EXTRA_BPF_FLAGS in the eBPF skeleton build, allowing users to pass additional clang options such as --sysroot or custom include paths when cross-compiling perf. This is primarily intended for cross-build scenarios where the default host include paths do not match the target kernel version. Example usage: make perf ARCH="arm64" EXTRA_BPF_FLAGS="--sysroot=..." Reviewed-by: Namhyung Kim Signed-off-by: hupu Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Bill Wendling Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Mark Rutland Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit adc1284bae3cfd25df785d55b900a8778ad79366 Author: Arnaldo Carvalho de Melo Date: Wed Feb 11 09:46:22 2026 -0300 perf test data_type_profiling.sh: Skip just the Rust tests if code_with_type workload is missing Namhyung suggested skipping only the rust tests when the code_with_type 'perf test' workload is not built into perf, do it so that we can continue to test the C based workloads: With rust: root@number:/# perf test -vv "data type" 83: perf data type profiling tests: --- start --- test child forked, pid 2645245 Basic Rust perf annotate test Basic annotate test [Success] Pipe Rust perf annotate test Pipe annotate test [Success] Basic C perf annotate test Basic annotate test [Success] Pipe C perf annotate test Pipe annotate test [Success] ---- end(0) ---- 83: perf data type profiling tests : Ok root@number:/# Without: root@number:/# perf test "data type" 83: perf data type profiling tests : Ok root@number:/# perf test -vv "data type" 83: perf data type profiling tests: --- start --- test child forked, pid 2634759 Basic Rust perf annotate test Skip: code_with_type workload not built in 'perf test' Pipe Rust perf annotate test Skip: code_with_type workload not built in 'perf test' Basic C perf annotate test Basic annotate test [Success] Pipe C perf annotate test Pipe annotate test [Success] ---- end(0) ---- 83: perf data type profiling tests : Ok root@number:/# Suggested-by: Namhyung Kim Cc: Dmitrii Dolgov <9erthalion6@gmail.com> Cc: Miguel Ojeda Signed-off-by: Arnaldo Carvalho de Melo commit 804490c3eb26098b60c5e858fa20c0e6f2c2c1d8 Author: Dmitrii Dolgov <9erthalion6@gmail.com> Date: Wed Feb 11 10:58:01 2026 +0100 tools build: Fix feature test for rust compiler Currently a dummy rust code is compiled to detect if the rust feature could be enabled. It turns out that in this case rust emits a dependency file without any external references: /perf/feature/test-rust.d: test-rust.rs /perf/feature/test-rust.bin: test-rust.rs test-rust.rs: This can lead to a situation, when rustc was removed after a successful build, but the build process still thinks it's there and the feature is enabled on subsequent runs. Instead simply check the compiler presence to detect the feature, as suggested by Arnaldo. This way no actual test-rust.bin will be created, meaning the feature check will not be cached and always performed. That's exactly what we want, and the overhead of doing this every time is minimal. Tested with multiple rounds of install/remove of the rust package. Reported-by: Arnaldo Carvalho de Melo Suggested-by: Arnaldo Carvalho de Melo Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Tested-by: Arnaldo Carvalho de Melo Cc: Ian Rogers Cc: Miguel Ojeda Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 1a6c45969a85d1be43dbbf0705aef4bc8eb515a8 Author: Ian Rogers Date: Tue Feb 10 21:38:27 2026 -0800 perf libunwind: Fix calls to thread__e_machine() Add the missing 'e_flags' option to fix the build. Fixes: 4e66527f8859a661 ("perf thread: Add optional e_flags output argument to thread__e_machine") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit fd1fa48b935f22c7d99713bf33846e14a6bb6ab9 Author: Christian König Date: Tue Jan 20 12:57:21 2026 +0100 drm/amdgpu: lock both VM and BO in amdgpu_gem_object_open The VM was not locked in the past since we initially only cleared the linked list element and not added it to any VM state. But this has changed quite some time ago, we just never realized this problem because the VM state lock was masking it. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit abde491143e4e12eecc41337910aace4e8d59603 Author: Srinivasan Shanmugam Date: Fri Feb 6 20:49:23 2026 +0530 drm/amd/display: Fix out-of-bounds stream encoder index v3 eng_id can be negative and that stream_enc_regs[] can be indexed out of bounds. eng_id is used directly as an index into stream_enc_regs[], which has only 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can access memory past the end of the array. Add a bounds check using ARRAY_SIZE() before using eng_id as an index. The unsigned cast also rejects negative values. This avoids out-of-bounds access. Fixes the below smatch error: dcn*_resource.c: stream_encoder_create() may index stream_enc_regs[eng_id] out of bounds (size 5). drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c 1246 static struct stream_encoder *dcn35_stream_encoder_create( 1247 enum engine_id eng_id, 1248 struct dc_context *ctx) 1249 { ... 1255 1256 /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */ 1257 if (eng_id <= ENGINE_ID_DIGF) { ENGINE_ID_DIGF is 5. should <= be dc_bios, 1283 eng_id, vpg, afmt, --> 1284 &stream_enc_regs[eng_id], ^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array. ... 1287 return &enc1->base; 1288 } v2: use explicit bounds check as suggested by Roman/Dan; avoid unsigned int cast v3: The compiler already knows how to compare the two values, so the cast (int) is not needed. (Roman) Fixes: 2728e9c7c842 ("drm/amd/display: add DC changes for DCN351") Reported-by: Dan Carpenter Cc: Harry Wentland Cc: Mario Limonciello Cc: Alex Hung Cc: Aurabindo Pillai Cc: ChiaHsuan Chung Cc: Roman Li Signed-off-by: Srinivasan Shanmugam Reviewed-by: Roman Li Signed-off-by: Alex Deucher commit 8446c747370ab31a3ae0177227f0de3e65c8815c Author: Siwei He Date: Mon Feb 9 16:13:20 2026 -0500 drm/amdkfd: Fix APU to use GTT, not VRAM for MQD Add a check in mqd_on_vram. If the device prefers GTT, it returns false Fixes: d4a814f400d4 ("drm/amdkfd: Move gfx9.4.3 and gfx 9.5 MQD to HBM") Signed-off-by: Siwei He Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 5e9aec4ea350db868e38f901fa19bb1d70c7a6ed Author: Mangesh Gadre Date: Tue Jan 27 18:00:59 2026 +0800 drm/amdgpu:Add psp v13_0_15 ip block Add support for psp v13_0_15 ip block Signed-off-by: Mangesh Gadre Reviewed-by: Asad Kamal Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 57d00816c6a9c152f01b65bb7b3662f4d03ccd09 Author: Alex Deucher Date: Tue Feb 10 16:53:08 2026 -0500 drm/amdgpu: set family for GC 11.5.4 Set the family for GC 11.5.4 Fixes: 47ae1f938d12 ("drm/amdgpu: add support for GC IP version 11.5.4") Cc: Tim Huang Cc: Pratik Vishwakarma Cc: Roman Li Reviewed-by: Tim Huang Signed-off-by: Alex Deucher commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 Author: decce6 Date: Tue Feb 10 07:24:01 2026 +0000 drm/amdgpu: Add HAINAN clock adjustment This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from 850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This patch is for amdgpu. Signed-off-by: decce6 Signed-off-by: Alex Deucher commit 908d318f23d6b5d625bea093c5fc056238cdb7ff Author: decce6 Date: Tue Feb 10 07:26:00 2026 +0000 drm/radeon: Add HAINAN clock adjustment This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from 850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This patch is for radeon. Signed-off-by: decce6 Signed-off-by: Alex Deucher commit f38bb9b0928638c09fefb26d9d22745bfbfc7586 Author: Pratik Vishwakarma Date: Wed Feb 11 08:35:30 2026 +0000 drm/amd/swsmu: Move IP specific functions Move SMU v15_0_0 specific functions to IP file - smu_v15_0_0_set_default_dpm_tables and - smu_v15_0_0_update_table Signed-off-by: Pratik Vishwakarma Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 3774289f525cba0f33610a390bd6a28bb636b637 Author: ChenXiaoSong Date: Thu Jan 22 13:24:02 2026 +0800 smb/client: move NT_STATUS_MORE_ENTRIES It is an NTSTATUS value, not a Win32 error code. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 617a5d2473dc043dcd7f2b84b28ce7a9f8a06587 Author: ChenXiaoSong Date: Thu Jan 22 13:24:01 2026 +0800 smb/client: rename to NT_ERROR_INVALID_DATATYPE See MS-ERREF 2.2 ERROR_INVALID_DATATYPE. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit fa34d0a5703367b1979afdf6c08ddd2cb8a4b896 Author: ChenXiaoSong Date: Thu Jan 22 13:24:00 2026 +0800 smb/client: rename to NT_STATUS_SOME_NOT_MAPPED See MS-ERREF 2.3.1 STATUS_SOME_NOT_MAPPED. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 4da735c48a27af32b444f34fcdc18441eb3f9b24 Author: ChenXiaoSong Date: Thu Jan 22 13:23:59 2026 +0800 smb/client: map NT_STATUS_PRIVILEGE_NOT_HELD See MS-CIFS 2.2.2.4 STATUS_PRIVILEGE_NOT_HELD. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 3e5f083428607baea80bbbd7dfce6769c288efa3 Author: ChenXiaoSong Date: Thu Jan 22 13:23:58 2026 +0800 smb/client: map NT_STATUS_MORE_PROCESSING_REQUIRED See MS-CIFS 2.2.2.4 STATUS_MORE_PROCESSING_REQUIRED. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit e4424687fc6d866c7e0dca979d9d362ec8cbc71a Author: ChenXiaoSong Date: Thu Jan 22 13:23:57 2026 +0800 smb/client: map NT_STATUS_BUFFER_OVERFLOW See MS-CIFS 2.2.2.4 STATUS_BUFFER_OVERFLOW. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit ba39063ca3ee885af62bdde2c184b8295bf4bf12 Author: ChenXiaoSong Date: Thu Jan 22 13:23:56 2026 +0800 smb/client: map NT_STATUS_NOTIFY_ENUM_DIR See MS-CIFS 2.2.2.4 STATUS_NOTIFY_ENUM_DIR. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 66dc58bdbd7c1897d87c06fee6e0f176c85190a0 Author: Chen Ni Date: Wed Feb 11 12:46:44 2026 +0800 cifs: SMB1 split: Remove duplicate include of cifs_debug.h Remove duplicate inclusion of cifs_debug.h in smb1transport.c to clean up redundant code. Signed-off-by: Chen Ni Signed-off-by: Steve French commit 72f4d48034864b93700d1d23fc418d90fa28d7ae Author: Paulo Alcantara Date: Wed Feb 11 01:10:07 2026 -0300 smb: client: fix regression with mount options parsing After commit 1ef15fbe6771 ("cifs: client: enforce consistent handling of multichannel and max_channels"), invalid mount options started to be ignored, allowing cifs.ko to proceed with the mount instead of baling out. The problem was related to smb3_handle_conflicting_options() being called even when an invalid parameter had been parsed, overwriting the return value of vfs_parse_fs_string() in smb3_fs_context_parse_monolithic(). Fix this by calling smb3_handle_conflicting_options() only when a valid mount option has been passed. Reproducer: $ mount.cifs //srv/share /mnt -o ${opts} $ mount -o remount,foo,${opts} /mnt # must fail Fixes: 1ef15fbe6771 ("cifs: client: enforce consistent handling of multichannel and max_channels") Reported-by: Xiaoli Feng Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit b18fc0ab837381c1a6ef28386602cd888f2d9edf Author: Pierre-Eric Pelloux-Prayer Date: Mon Feb 9 18:54:45 2026 +0100 drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify Invalidating a dmabuf will impact other users of the shared BO. In the scenario where process A moves the BO, it needs to inform process B about the move and process B will need to update its page table. The commit fixes a synchronisation bug caused by the use of the ticket: it made amdgpu_vm_handle_moved behave as if updating the page table immediately was correct but in this case it's not. An example is the following scenario, with 2 GPUs and glxgears running on GPU0 and Xorg running on GPU1, on a system where P2P PCI isn't supported: glxgears: export linear buffer from GPU0 and import using GPU1 submit frame rendering to GPU0 submit tiled->linear blit Xorg: copy of linear buffer The sequence of jobs would be: drm_sched_job_run # GPU0, frame rendering drm_sched_job_queue # GPU0, blit drm_sched_job_done # GPU0, frame rendering drm_sched_job_run # GPU0, blit move linear buffer for GPU1 access # amdgpu_dma_buf_move_notify -> update pt # GPU0 It this point the blit job on GPU0 is still running and would likely produce a page fault. Cc: stable@vger.kernel.org Fixes: a448cb003edc ("drm/amdgpu: implement amdgpu_gem_prime_move_notify v2") Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 9aca641143cec1b25e76f54fc49187b17393c12f Author: Lijo Lazar Date: Fri Feb 6 19:13:23 2026 +0530 drm/amdgpu: Move xgmi status to interface header These definitions are used by user APIs. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 044f8d3b1fac6ac89c560f61415000e6bdab3a03 Author: Gangliang Xie Date: Mon Feb 9 17:32:00 2026 +0800 drm/amdgpu: return when ras table checksum is error end the function flow when ras table checksum is error Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Reviewed-by: Kent Russell Signed-off-by: Alex Deucher commit 3ee1c72606bd2842f0f377fd4b118362af0323ae Author: Ce Sun Date: Tue Feb 10 15:32:01 2026 +0800 drm/amdgpu: Adjust usleep_range in fence wait Tune the sleep interval in the PSP fence wait loop from 10-100us to 60-100us.This adjustment results in an overall wait window of 1.2s (60us * 20000 iterations) to 2 seconds (100us * 20000 iterations), which guarantees that we can retrieve the correct fence value Signed-off-by: Ce Sun Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit cde3894904cf7820e8518f9df716ba50e91513fd Author: Pratik Vishwakarma Date: Wed Feb 4 02:30:42 2026 +0000 drm/amd/smu: Fix User mode stable P-states SMU15 SMU 15_0_0 exports only soft limits for CLKs Use correct messages Signed-off-by: Pratik Vishwakarma Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 33ed922d24d0c73bdb51b2ddf8f2de8b42ffb015 Author: Pratik Vishwakarma Date: Wed Jan 28 10:12:44 2026 +0000 drm/amd: Add CG/PG flags for GC 11.5.4 Enable GFXOff for GC 11.5.4 Signed-off-by: Pratik Vishwakarma Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 39a96f126d43e504be54230ff13834277b543802 Author: Pratik Vishwakarma Date: Wed Jan 28 10:10:36 2026 +0000 drm/amdgpu: enable mode2 reset for SMU IP v15.0.0 Set the default reset method to mode2 for SMU 15.0.0. Signed-off-by: Kanala Ramalingeswara Reddy Signed-off-by: Pratik Vishwakarma Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 782baa76ee46a9772b76b5df6d96e4645e362f07 Author: Pratik Vishwakarma Date: Wed Jan 28 10:03:18 2026 +0000 drm/amd: Drop MALL Not supported on SMU 15_0_0 Signed-off-by: Pratik Vishwakarma Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit c6948604eba672b63ff82d70f39238f4288e9e21 Author: Pratik Vishwakarma Date: Fri Jan 9 12:15:47 2026 +0000 drm/amdgpu: Drop unsupported function drop set_driver_table_location Signed-off-by: Pratik Vishwakarma Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 4d632161e921b44c0b65561e26c6d74ae0dd5e0b Author: Pratik Vishwakarma Date: Thu Jan 8 08:49:06 2026 +0000 drm/amdgpu: Fix is_dpm_running Use multi args for get_enabled_mask to fix is_dpm_running Signed-off-by: Pratik Vishwakarma Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit f4011253c2287dab6517839c7f7ff8d178400bdb Author: Pratik Vishwakarma Date: Thu Jan 8 08:46:53 2026 +0000 drm/amdgpu: Fix set_default_dpm_tables Use smu_v15_0_0_update_table instead of common api Signed-off-by: Pratik Vishwakarma Acked-by: Lijo Lazar Signed-off-by: Alex Deucher commit a0562828d14410bc9b63c80ffb770e1ca7a7b27d Author: Pratik Vishwakarma Date: Thu Jan 8 09:05:30 2026 +0000 drm/admgpu: Update metrics_table for SMU15 Use multi param based get op for metrics_table Signed-off-by: Pratik Vishwakarma Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit ce1598f018ef7fd65f6e6a5b36a34dbf71aef6c8 Author: Pratik Vishwakarma Date: Thu Jan 8 09:01:02 2026 +0000 drm/amdgpu: Add support for update_table for SMU15 Add update_table for SMU 15_0_0 Signed-off-by: Pratik Vishwakarma Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 5cc934e089fd70f69e089b0620a83386c99fbcf8 Author: Pratik Vishwakarma Date: Wed Jan 28 03:52:03 2026 +0000 drm/amd/swsmu: Add new param regs for SMU15 Some SMU messages have changed to multi reg read/write Initialize during smu_early_init Signed-off-by: Pratik Vishwakarma Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit e98bb71e246cd18c9718aba70718e845b6d134e8 Author: Pratik Vishwakarma Date: Mon Nov 24 04:40:21 2025 +0000 drm/amdgpu: Load TA ucode for PSP 15_0_0 TOC and TA both are required Signed-off-by: Pratik Vishwakarma Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit d76c66c6ad83994181967d7427385aab4c009ae0 Author: Kenneth Feng Date: Thu Jan 22 18:04:01 2026 +0800 drm/amd/pm: send unload command to smu during modprobe -r amdgpu Send unload command to smu during modprobe -r amdgpu for smu 13/14. 1. This can fix the high voltage/temperatue issue after driver is unloaded. 2. Reloading driver could fail but with the debug port based mode1 reset during driver is reloaded, it is good and safe. Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 29b1b0b06defd4dcbb8af246270a9ad8686b89ed Author: Kenneth Feng Date: Thu Jan 22 18:00:27 2026 +0800 drm/amd/pm: use debug port for mode1 reset request on smu 13&14 use debug port for mode1 reset request so fw can handle mode1 reset even when it is stuck. Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 41af6215cdbcecd12920f211239479027904abf3 Author: Timur Kristóf Date: Sun Jan 18 15:57:41 2026 +0100 drm/amd/display: Reject cursor plane on DCE when scaled differently than primary Currently DCE doesn't support the overlay cursor, so the dm_crtc_get_cursor_mode() function returns DM_CURSOR_NATIVE_MODE unconditionally. The outcome is that it doesn't check for the conditions that would necessitate the overlay cursor, meaning that it doesn't reject cases where the native cursor mode isn't supported on DCE. Remove the early return from dm_crtc_get_cursor_mode() for DCE and instead let it perform the necessary checks and return DM_CURSOR_OVERLAY_MODE. Add a later check that rejects when DM_CURSOR_OVERLAY_MODE would be used with DCE. Fixes: 1b04dcca4fb1 ("drm/amd/display: Introduce overlay cursor mode") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4600 Suggested-by: Leo Li Signed-off-by: Timur Kristóf Reviewed-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit f5a8292aab5be0f52b656ac393df4c26edac8e90 Author: Yang Wang Date: Wed Feb 4 01:38:23 2026 -0500 drm/amd/pm: use sysfs_streq for string matching in amdgpu_pm The driver uses strncmp() to compare sysfs attribute strings, which does not handle trailing newlines and lacks NULL safety. sysfs_streq() is the recommended function for sysfs string equality checks in the kernel, providing safer and more correct behavior. replace strncmp() with sysfs_streq() in drivers/gpu/drm/amd/pm/amdgpu_pm.c Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 5a19302cab5cec7ae7f1a60c619951e6c17d8742 Author: Srinivasan Shanmugam Date: Fri Feb 6 21:18:11 2026 +0530 drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int and checked bits by shifting with watch_id. If a very large watch_id is passed from userspace, it can be converted to a negative value. This can cause invalid shifts and may access memory outside the watch_points array. drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 Fix this by checking that watch_id is within MAX_WATCH_ADDRESSES before using it. Also use BIT(watch_id) to test and clear bits safely. This keeps the behavior unchanged for valid watch IDs and avoids undefined behavior for invalid ones. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448 kfd_dbg_trap_clear_dev_address_watch() error: buffer overflow 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c 433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd, 434 uint32_t watch_id) 435 { 436 int r; 437 438 if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id)) kfd_dbg_owns_dev_watch_id() doesn't check for negative values so if watch_id is larger than INT_MAX it leads to a buffer overflow. (Negative shifts are undefined). 439 return -EINVAL; 440 441 if (!pdd->dev->kfd->shared_resources.enable_mes) { 442 r = debug_lock_and_unmap(pdd->dev->dqm); 443 if (r) 444 return r; 445 } 446 447 amdgpu_gfx_off_ctrl(pdd->dev->adev, false); --> 448 pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch( 449 pdd->dev->adev, 450 watch_id); v2: (as per, Jonathan Kim) - Add early watch_id >= MAX_WATCH_ADDRESSES validation in the set path to match the clear path. - Drop the redundant bounds check in kfd_dbg_owns_dev_watch_id(). Fixes: e0f85f4690d0 ("drm/amdkfd: add debug set and clear address watch points operation") Reported-by: Dan Carpenter Cc: Jonathan Kim Cc: Felix Kuehling Cc: Alex Deucher Cc: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Jonathan Kim Signed-off-by: Alex Deucher commit ba038065655c45728be346d0b174a6da08d8a5c5 Author: Srinivasan Shanmugam Date: Fri Feb 6 19:53:05 2026 +0530 drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path amdgpu_ib_schedule() returns early after calling amdgpu_ring_undo(). This skips the common free_fence cleanup path. Other error paths were already changed to use goto free_fence, but this one was missed. Change the early return to goto free_fence so all error paths clean up the same way. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c:232 amdgpu_ib_schedule() warn: missing unwind goto? drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c 124 int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned int num_ibs, 125 struct amdgpu_ib *ibs, struct amdgpu_job *job, 126 struct dma_fence **f) 127 { ... 224 225 if (ring->funcs->insert_start) 226 ring->funcs->insert_start(ring); 227 228 if (job) { 229 r = amdgpu_vm_flush(ring, job, need_pipe_sync); 230 if (r) { 231 amdgpu_ring_undo(ring); --> 232 return r; The patch changed the other error paths to goto free_fence but this one was accidentally skipped. 233 } 234 } 235 236 amdgpu_ring_ib_begin(ring); ... 338 339 free_fence: 340 if (!job) 341 kfree(af); 342 return r; 343 } Fixes: f903b85ed0f1 ("drm/amdgpu: fix possible fence leaks from job structure") Reported-by: Dan Carpenter Cc: Alex Deucher Cc: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 226a40c06a183abaeb7529a4f54d6c203bd14407 Author: Srinivasan Shanmugam Date: Fri Feb 6 20:06:19 2026 +0530 drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hpd_init() may see connectors without a valid dc_link. The code already checks dc_link for the polling decision, but later unconditionally dereferences it when setting up HPD interrupts. Assign dc_link early and skip connectors where it is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init() error: we previously assumed 'dc_link' could be null (see line 931) drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c 923 /* 924 * Analog connectors may be hot-plugged unlike other connector 925 * types that don't support HPD. Only poll analog connectors. 926 */ 927 use_polling |= 928 amdgpu_dm_connector->dc_link && ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id); 930 931 dc_link = amdgpu_dm_connector->dc_link; dc_link assigned here. 932 933 /* 934 * Get a base driver irq reference for hpd ints for the lifetime 935 * of dm. Note that only hpd interrupt types are registered with 936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on 937 * hpd_rx isn't available. DM currently controls hpd_rx 938 * explicitly with dc_interrupt_set() 939 */ --> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) { ^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here. 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1; 942 /* 943 * TODO: There's a mismatch between mode_info.num_hpd 944 * and what bios reports as the # of connectors with hpd Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Cc: Timur Kristóf Cc: Harry Wentland Cc: Mario Limonciello Cc: Alex Hung Cc: Aurabindo Pillai Cc: ChiaHsuan Chung Cc: Roman Li Reported-by: Dan Carpenter Signed-off-by: Srinivasan Shanmugam Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit 1778a64f9bea4173f8eb3767d6f385c51fd09bf8 Author: Taimur Hassan Date: Fri Jan 30 18:35:15 2026 -0500 drm/amd/display: Promote DC to 3.2.369 This version brings along following update: -Fix system resume lag issue -Correct hubp GfxVersion verification -Add parse all extension blocks for VSDB -Increase DCN35 SR enter/exit latency -Refactor virtual directory reorganize encoder and hwss files -Set enable_legacy_fast_update to false for DCN36 -Have dm_atomic_state context aligned with dc_state current -Avoid updating surface with the same surface under MPO Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Tom Chung Signed-off-by: Alex Deucher commit e8c7156240a00fc3f13107dcd66aa5b51640cccb Author: Taimur Hassan Date: Fri Jan 30 16:29:05 2026 -0500 drm/amd/display: [FW Promotion] Release 0.1.46.0 Add some struct member and enum for panel replay Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Tom Chung Signed-off-by: Alex Deucher commit 0f2620c48640e6635270d54d2cd9d724e5a1338a Author: Alex Hung Date: Wed Jan 7 17:31:37 2026 -0700 drm/amd/display: Fix the incorrect type in dml_print [Why & How] soc->max_outstanding_reqs is a dml_uint_t, not a dml_float_t. Reviewed-by: Austin Zheng Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Tom Chung Signed-off-by: Alex Deucher commit 7d9ec9dc20ecdb1661f4538cd9112cd3d6a5f15a Author: Clay King Date: Fri Jan 30 11:40:06 2026 -0500 drm/amd/display: bypass post csc for additional color spaces in dal [Why] For RGB BT2020 full and limited color spaces, overlay adjustments were applied twice (once by MM and once by DAL). This results in incorrect colours and a noticeable difference between mpo and non-mpo cases. [How] Add RGB BT2020 full and limited color spaces to list that bypasses post csc adjustment. Reviewed-by: Aric Cyr Signed-off-by: Clay King Signed-off-by: Tom Chung Signed-off-by: Alex Deucher commit 6246c12f52c389342358c3039475ef822921dcae Author: Nicholas Carbones Date: Wed Jan 28 12:28:54 2026 -0500 drm/amd/display: Revert "Migrate DCCG register access from hwseq to dccg component." [Why & How] This reverts commit 949adb4789fe3c24eea01d9c2efe94ab92694a0d, which causes regressions related to HDCP when resuming from S3. Reviewed-by: Joshua Aberback Signed-off-by: Nicholas Carbones Signed-off-by: Tom Chung Signed-off-by: Alex Deucher commit 3303aa64e7a646bd0f17d447b42ad3615c3b0101 Author: Nicholas Carbones Date: Wed Jan 28 15:52:46 2026 -0500 drm/amd/display: Correct hubp GfxVersion verification [Why] DcGfxBase case was not accounted for in hubp program tiling functions, causing tiling corruption on PNP. [How] Add handling for DcGfxBase so that tiling gets properly cleared. Reviewed-by: Charlene Liu Signed-off-by: Nicholas Carbones Signed-off-by: Tom Chung Signed-off-by: Alex Deucher commit 6386a0bcdb7e4c20943d3983520ebc22f041a226 Author: Muaaz Nisar Date: Wed Jan 21 14:25:38 2026 -0500 Revert "drm/amd/display: mouse event trigger to boost RR when idle" This reverts commit ba448f9ed62cf5a89603a738e6de91fc6c42ab35. It cause some regression. Reviewed-by: Sreeja Golui Signed-off-by: Muaaz Nisar Signed-off-by: Tom Chung Signed-off-by: Alex Deucher commit 0faccfa9ca8e9688f106c961972b885f7eb86941 Author: Ray Wu Date: Mon Jan 26 15:55:18 2026 +0800 drm/amd/display: Parse all extension blocks for VSDB [Why] VSDB parsing loop only searched within the first extension block. If the VSDB was located in a subsequent extension block, it would not be found. [How] Calculate the total length of all extension blocks (EDID_LENGTH * edid->extensions) and use that as the loop boundary, allowing the parser to search through all available extension blocks. Reviewed-by: Tom Chung Signed-off-by: Ray Wu Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 136114e0abf03005e182d75761ab694648e6d388 Merge: 4cff5c05e076d2 0dddf20b4fd4af Author: Linus Torvalds Date: Thu Feb 12 12:13:01 2026 -0800 Merge tag 'mm-nonmm-stable-2026-02-12-10-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - "ocfs2: give ocfs2 the ability to reclaim suballocator free bg" saves disk space by teaching ocfs2 to reclaim suballocator block group space (Heming Zhao) - "Add ARRAY_END(), and use it to fix off-by-one bugs" adds the ARRAY_END() macro and uses it in various places (Alejandro Colomar) - "vmcoreinfo: support VMCOREINFO_BYTES larger than PAGE_SIZE" makes the vmcore code future-safe, if VMCOREINFO_BYTES ever exceeds the page size (Pnina Feder) - "kallsyms: Prevent invalid access when showing module buildid" cleans up kallsyms code related to module buildid and fixes an invalid access crash when printing backtraces (Petr Mladek) - "Address page fault in ima_restore_measurement_list()" fixes a kexec-related crash that can occur when booting the second-stage kernel on x86 (Harshit Mogalapalli) - "kho: ABI headers and Documentation updates" updates the kexec handover ABI documentation (Mike Rapoport) - "Align atomic storage" adds the __aligned attribute to atomic_t and atomic64_t definitions to get natural alignment of both types on csky, m68k, microblaze, nios2, openrisc and sh (Finn Thain) - "kho: clean up page initialization logic" simplifies the page initialization logic in kho_restore_page() (Pratyush Yadav) - "Unload linux/kernel.h" moves several things out of kernel.h and into more appropriate places (Yury Norov) - "don't abuse task_struct.group_leader" removes the usage of ->group_leader when it is "obviously unnecessary" (Oleg Nesterov) - "list private v2 & luo flb" adds some infrastructure improvements to the live update orchestrator (Pasha Tatashin) * tag 'mm-nonmm-stable-2026-02-12-10-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (107 commits) watchdog/hardlockup: simplify perf event probe and remove per-cpu dependency procfs: fix missing RCU protection when reading real_parent in do_task_stat() watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() kcsan, compiler_types: avoid duplicate type issues in BPF Type Format kho: fix doc for kho_restore_pages() tests/liveupdate: add in-kernel liveupdate test liveupdate: luo_flb: introduce File-Lifecycle-Bound global state liveupdate: luo_file: Use private list list: add kunit test for private list primitives list: add primitives for private list manipulations delayacct: fix uapi timespec64 definition panic: add panic_force_cpu= parameter to redirect panic to a specific CPU netclassid: use thread_group_leader(p) in update_classid_task() RDMA/umem: don't abuse current->group_leader drm/pan*: don't abuse current->group_leader drm/amd: kill the outdated "Only the pthreads threading model is supported" checks drm/amdgpu: don't abuse current->group_leader android/binder: use same_thread_group(proc->tsk, current) in binder_mmap() android/binder: don't abuse current->group_leader kho: skip memoryless NUMA nodes when reserving scratch areas ... commit 4bff89bad90cff5b8422813f659317637d0a1994 Author: Roman Li Date: Fri Jan 23 17:00:06 2026 -0500 drm/amd/display: Make GPIO HPD path conditional [Why] Avoid unnecessary GPIO configuration attempts on dcn that doesn't support it. [How] Conditionally use GPIO HPD detection or rely on hw encoder path. Reviewed-by: Charlene Liu Signed-off-by: Roman Li Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 318917e1d8ecc89f820f4fabf79935f4fed718cd Author: Leo Li Date: Mon Nov 3 11:14:59 2025 -0500 drm/amd/display: Increase DCN35 SR enter/exit latency [Why & How] On Framework laptops with DDR5 modules, underflow can be observed. It's unclear why it only occurs on specific desktop contents. However, increasing enter/exit latencies by 3us seems to resolve it. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4463 Reviewed-by: Nicholas Kazlauskas Signed-off-by: Leo Li Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 4d687d06c3409e4e041c65645eab10520bd78afe Author: Vitaly Prosyak Date: Thu Feb 5 17:31:24 2026 -0500 drm/amd/display: guard NULL manual-trigger callback in cursor programming KASAN reports a NULL instruction fetch (RIP=0x0) from dc_stream_program_cursor_position(): BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Call Trace: dc_stream_program_cursor_position+0x344/0x920 [amdgpu] amdgpu_dm_atomic_commit_tail+... [ +1.041013] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ +0.000027] #PF: supervisor instruction fetch in kernel mode [ +0.000013] #PF: error_code(0x0010) - not-present page [ +0.000012] PGD 0 P4D 0 [ +0.000017] Oops: Oops: 0010 [#1] SMP KASAN NOPTI [ +0.000017] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G E 6.18.0+ #3 PREEMPT(voluntary) [ +0.000023] Tainted: [E]=UNSIGNED_MODULE [ +0.000010] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000016] Workqueue: events drm_mode_rmfb_work_fn [ +0.000022] RIP: 0010:0x0 [ +0.000017] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ +0.000015] RSP: 0018:ffffc9000017f4c8 EFLAGS: 00010246 [ +0.000016] RAX: 0000000000000000 RBX: ffff88810afdda80 RCX: 1ffff110457000d1 [ +0.000014] RDX: 1ffffffff87b75bd RSI: 0000000000000000 RDI: ffff88810afdda80 [ +0.000014] RBP: ffffc9000017f538 R08: 0000000000000000 R09: ffff88822b800690 [ +0.000013] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffc3dbac20 [ +0.000014] R13: 0000000000000000 R14: ffff88811ab80000 R15: dffffc0000000000 [ +0.000014] FS: 0000000000000000(0000) GS:ffff888434599000(0000) knlGS:0000000000000000 [ +0.000015] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000013] CR2: ffffffffffffffd6 CR3: 000000010ee88000 CR4: 0000000000350ef0 [ +0.000014] Call Trace: [ +0.000010] [ +0.000010] dc_stream_program_cursor_position+0x344/0x920 [amdgpu] [ +0.001086] ? __pfx_mutex_lock+0x10/0x10 [ +0.000015] ? unwind_next_frame+0x18b/0xa70 [ +0.000019] amdgpu_dm_atomic_commit_tail+0x1124/0xfa20 [amdgpu] [ +0.001040] ? ret_from_fork_asm+0x1a/0x30 [ +0.000018] ? filter_irq_stacks+0x90/0xa0 [ +0.000022] ? __pfx_amdgpu_dm_atomic_commit_tail+0x10/0x10 [amdgpu] [ +0.001058] ? kasan_save_track+0x18/0x70 [ +0.000015] ? kasan_save_alloc_info+0x37/0x60 [ +0.000015] ? __kasan_kmalloc+0xc3/0xd0 [ +0.000013] ? __kmalloc_cache_noprof+0x1aa/0x600 [ +0.000016] ? drm_atomic_helper_setup_commit+0x788/0x1450 [ +0.000017] ? drm_atomic_helper_commit+0x7e/0x290 [ +0.000014] ? drm_atomic_commit+0x205/0x2e0 [ +0.000015] ? process_one_work+0x629/0xf80 [ +0.000016] ? worker_thread+0x87f/0x1570 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_check_write+0x14/0x30 [ +0.000014] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? _raw_spin_lock_irq+0x8a/0xf0 [ +0.000015] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ +0.000016] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_write+0x14/0x30 [ +0.000014] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __wait_for_common+0x204/0x460 [ +0.000015] ? sched_clock_noinstr+0x9/0x10 [ +0.000014] ? __pfx_schedule_timeout+0x10/0x10 [ +0.000014] ? local_clock_noinstr+0xe/0xd0 [ +0.000015] ? __pfx___wait_for_common+0x10/0x10 [ +0.000014] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __wait_for_common+0x204/0x460 [ +0.000014] ? __pfx_schedule_timeout+0x10/0x10 [ +0.000015] ? __kasan_kmalloc+0xc3/0xd0 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? wait_for_completion_timeout+0x1d/0x30 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? drm_crtc_commit_wait+0x32/0x180 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? drm_atomic_helper_wait_for_dependencies+0x46a/0x800 [ +0.000019] commit_tail+0x231/0x510 [ +0.000017] drm_atomic_helper_commit+0x219/0x290 [ +0.000015] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ +0.000016] drm_atomic_commit+0x205/0x2e0 [ +0.000014] ? __pfx_drm_atomic_commit+0x10/0x10 [ +0.000013] ? __pfx_drm_connector_free+0x10/0x10 [ +0.000014] ? __pfx___drm_printfn_info+0x10/0x10 [ +0.000017] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? drm_atomic_set_crtc_for_connector+0x49e/0x660 [ +0.000015] ? drm_atomic_set_fb_for_plane+0x155/0x290 [ +0.000015] drm_framebuffer_remove+0xa9b/0x1240 [ +0.000014] ? finish_task_switch.isra.0+0x15a/0x840 [ +0.000015] ? __switch_to+0x385/0xda0 [ +0.000015] ? srso_safe_ret+0x1/0x20 [ +0.000013] ? __pfx_drm_framebuffer_remove+0x10/0x10 [ +0.000016] ? kasan_print_address_stack_frame+0x221/0x280 [ +0.000015] drm_mode_rmfb_work_fn+0x14b/0x240 [ +0.000015] process_one_work+0x629/0xf80 [ +0.000012] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_write+0x14/0x30 [ +0.000019] worker_thread+0x87f/0x1570 [ +0.000013] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000014] ? __pfx_try_to_wake_up+0x10/0x10 [ +0.000017] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? kasan_print_address_stack_frame+0x227/0x280 [ +0.000017] ? __pfx_worker_thread+0x10/0x10 [ +0.000014] kthread+0x396/0x830 [ +0.000013] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ +0.000015] ? __pfx_kthread+0x10/0x10 [ +0.000012] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_write+0x14/0x30 [ +0.000014] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? recalc_sigpending+0x180/0x210 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __pfx_kthread+0x10/0x10 [ +0.000014] ret_from_fork+0x31c/0x3e0 [ +0.000014] ? __pfx_kthread+0x10/0x10 [ +0.000013] ret_from_fork_asm+0x1a/0x30 [ +0.000019] [ +0.000010] Modules linked in: rfcomm(E) cmac(E) algif_hash(E) algif_skcipher(E) af_alg(E) snd_seq_dummy(E) snd_hrtimer(E) qrtr(E) xt_MASQUERADE(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) xt_mark(E) xt_tcpudp(E) nft_compat(E) nf_tables(E) x_tables(E) bnep(E) snd_hda_codec_alc882(E) snd_hda_codec_atihdmi(E) snd_hda_codec_realtek_lib(E) snd_hda_codec_hdmi(E) snd_hda_codec_generic(E) iwlmvm(E) snd_hda_intel(E) binfmt_misc(E) snd_hda_codec(E) snd_hda_core(E) mac80211(E) snd_intel_dspcfg(E) snd_intel_sdw_acpi(E) snd_hwdep(E) snd_pcm(E) libarc4(E) snd_seq_midi(E) snd_seq_midi_event(E) snd_rawmidi(E) amd_atl(E) intel_rapl_msr(E) snd_seq(E) intel_rapl_common(E) iwlwifi(E) jc42(E) snd_seq_device(E) btusb(E) snd_timer(E) btmtk(E) btrtl(E) edac_mce_amd(E) eeepc_wmi(E) polyval_clmulni(E) btbcm(E) ghash_clmulni_intel(E) asus_wmi(E) ee1004(E) platform_profile(E) btintel(E) snd(E) nls_iso8859_1(E) aesni_intel(E) soundcore(E) i2c_piix4(E) cfg80211(E) sparse_keymap(E) wmi_bmof(E) bluetooth(E) k10temp(E) rapl(E) [ +0.000300] i2c_smbus(E) ccp(E) joydev(E) input_leds(E) gpio_amdpt(E) mac_hid(E) sch_fq_codel(E) msr(E) parport_pc(E) ppdev(E) lp(E) parport(E) efi_pstore(E) nfnetlink(E) dmi_sysfs(E) autofs4(E) cdc_ether(E) usbnet(E) amdgpu(E) amdxcp(E) hid_generic(E) i2c_algo_bit(E) drm_ttm_helper(E) ttm(E) drm_exec(E) drm_panel_backlight_quirks(E) gpu_sched(E) drm_suballoc_helper(E) video(E) drm_buddy(E) usbhid(E) drm_display_helper(E) r8152(E) hid(E) mii(E) cec(E) ahci(E) rc_core(E) igc(E) libahci(E) wmi(E) [ +0.000294] CR2: 0000000000000000 [ +0.000013] ---[ end trace 0000000000000000 ]--- The crash happens when we unconditionally call into the timing generator manual trigger hook: pipe_ctx->stream_res.tg->funcs->program_manual_trigger(...) On some configurations the timing generator (tg), its funcs table, or the program_manual_trigger callback can be NULL. Guard all of these before calling the hook. If the first pipe matching the stream cannot trigger, keep scanning to find another matching pipe with a valid hook. The issue was originally found on Vg20/DCE 12.1 Mario successfully tested on Polaris 11/DCE 11.2 Cc: Aurabindo Pillai Cc: Alexander Deucher Cc: Christian Koenig Fixes: ba448f9ed62c ("drm/amd/display: mouse event trigger to boost RR when idle") Suggested-by: Aurabindo Pillai Signed-off-by: Vitaly Prosyak Reviewed-by: Aurabindo Pillai Reviewed-and-tested-by: Mario Kleiner Signed-off-by: Alex Deucher commit 4a9c9882153a31818f25ef860e62d227f106e93f Author: Peichen Huang Date: Mon Jan 26 11:56:28 2026 +0800 drm/amd/display: use enum value for panel replay setting [WHY & HOW] use enum value for Panel Replay setting. Reviewed-by: Robin Chen Signed-off-by: Peichen Huang Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9156bf442ee56c0f883aa4c81af9c8471eef6846 Author: Bhuvanachandra Pinninti Date: Wed Jan 21 16:05:00 2026 +0530 drm/amd/display: Refactor virtual directory reorganize encoder and hwss files. [why] Virtual encoders & hwss were grouped in a separate directory, not aligned with dio and link component structure. [how] Moved virtual_link_encoder and virtual_stream_encoder to dc/dio/virtual/. Moved virtual_link_hwss to dc/link/hwss/ and renamed to link_hwss_virtual. Removed dc/virtual/ directory. Updated all includes and build files (Makefiles) Reviewed-by: Nicholas Kazlauskas Signed-off-by: Bhuvanachandra Pinninti Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d0728aee5090853d0b9982757f5fb1b13e2e2b27 Author: YiLing Chen Date: Tue Jan 27 13:32:40 2026 +0800 drm/amd/display: set enable_legacy_fast_update to false for DCN36 [Why/How] Align the default value of the flag with DCN35/351. Reviewed-by: Nicholas Kazlauskas Signed-off-by: YiLing Chen Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d2ca311a832098423261d19f8b9d8e2fc745073f Author: Leon Huang Date: Tue Jan 20 16:04:09 2026 +0800 drm/amd/display: Check frame skip capability in Sink side [Why&How] Frame skip capability is described in AMD VSDB in EDID. Need to retrieve the cap and determine fr.skipping mode enablement Reviewed-by: ChunTao Tso Signed-off-by: Leon Huang Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c Author: Wayne Lin Date: Fri Jan 23 14:47:01 2026 +0800 drm/amd/display: Avoid updating surface with the same surface under MPO [Why & How] Although it's dummy updates of surface update for committing stream updates, we should not have dummy_updates[j].surface all indicating to the same surface under multiple surfaces case. Otherwise, copy_surface_update_to_plane() in update_planes_and_stream_state() will update to the same surface only. Reviewed-by: Harry Wentland Signed-off-by: Wayne Lin Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 64c94cd9be2e188ed07efeafa6a109bce638c967 Author: Tom Chung Date: Tue Jan 20 18:10:31 2026 +0800 drm/amd/display: Fix system resume lag issue [Why] System will try to apply idle power optimizations setting during system resume. But system power state is still in D3 state, and it will cause the idle power optimizations command not actually to be sent to DMUB and cause some platforms to go into IPS. [How] Set power state to D0 first before calling the dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false) Reviewed-by: Nicholas Kazlauskas Signed-off-by: Tom Chung Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 34b11d0a7530ac374f889f4559f5dd85be86670e Author: Asad Kamal Date: Fri Feb 6 16:32:31 2026 +0800 drm/amd/pm: Use U64 for accumulation counter Use U64 for accumulation counter in gpu metrics for smu_v13_0_6 and smu_v13_0_12 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit ea06598e23f18005ff320e16f141e40a0c392d81 Author: Asad Kamal Date: Fri Feb 6 14:23:59 2026 +0800 drm/amd/pm: Add acc counter & fw timestamp to xcp metrics Add accumulation counter and firmware timestamp to partition metrics for smu_v13_0_6 & smu_v13_0_12 v2: Use U64 for accumulation counter (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 4cff5c05e076d2ee4e34122aa956b84a2eaac587 Merge: 541c43310e85db fb4ddf2085115e Author: Linus Torvalds Date: Thu Feb 12 11:32:37 2026 -0800 Merge tag 'mm-stable-2026-02-11-19-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "powerpc/64s: do not re-activate batched TLB flush" makes arch_{enter|leave}_lazy_mmu_mode() nest properly (Alexander Gordeev) It adds a generic enter/leave layer and switches architectures to use it. Various hacks were removed in the process. - "zram: introduce compressed data writeback" implements data compression for zram writeback (Richard Chang and Sergey Senozhatsky) - "mm: folio_zero_user: clear page ranges" adds clearing of contiguous page ranges for hugepages. Large improvements during demand faulting are demonstrated (David Hildenbrand) - "memcg cleanups" tidies up some memcg code (Chen Ridong) - "mm/damon: introduce {,max_}nr_snapshots and tracepoint for damos stats" improves DAMOS stat's provided information, deterministic control, and readability (SeongJae Park) - "selftests/mm: hugetlb cgroup charging: robustness fixes" fixes a few issues in the hugetlb cgroup charging selftests (Li Wang) - "Fix va_high_addr_switch.sh test failure - again" addresses several issues in the va_high_addr_switch test (Chunyu Hu) - "mm/damon/tests/core-kunit: extend existing test scenarios" improves the KUnit test coverage for DAMON (Shu Anzai) - "mm/khugepaged: fix dirty page handling for MADV_COLLAPSE" fixes a glitch in khugepaged which was causing madvise(MADV_COLLAPSE) to transiently return -EAGAIN (Shivank Garg) - "arch, mm: consolidate hugetlb early reservation" reworks and consolidates a pile of straggly code related to reservation of hugetlb memory from bootmem and creation of CMA areas for hugetlb (Mike Rapoport) - "mm: clean up anon_vma implementation" cleans up the anon_vma implementation in various ways (Lorenzo Stoakes) - "tweaks for __alloc_pages_slowpath()" does a little streamlining of the page allocator's slowpath code (Vlastimil Babka) - "memcg: separate private and public ID namespaces" cleans up the memcg ID code and prevents the internal-only private IDs from being exposed to userspace (Shakeel Butt) - "mm: hugetlb: allocate frozen gigantic folio" cleans up the allocation of frozen folios and avoids some atomic refcount operations (Kefeng Wang) - "mm/damon: advance DAMOS-based LRU sorting" improves DAMOS's movement of memory betewwn the active and inactive LRUs and adds auto-tuning of the ratio-based quotas and of monitoring intervals (SeongJae Park) - "Support page table check on PowerPC" makes CONFIG_PAGE_TABLE_CHECK_ENFORCED work on powerpc (Andrew Donnellan) - "nodemask: align nodes_and{,not} with underlying bitmap ops" makes nodes_and() and nodes_andnot() propagate the return values from the underlying bit operations, enabling some cleanup in calling code (Yury Norov) - "mm/damon: hide kdamond and kdamond_lock from API callers" cleans up some DAMON internal interfaces (SeongJae Park) - "mm/khugepaged: cleanups and scan limit fix" does some cleanup work in khupaged and fixes a scan limit accounting issue (Shivank Garg) - "mm: balloon infrastructure cleanups" goes to town on the balloon infrastructure and its page migration function. Mainly cleanups, also some locking simplification (David Hildenbrand) - "mm/vmscan: add tracepoint and reason for kswapd_failures reset" adds additional tracepoints to the page reclaim code (Jiayuan Chen) - "Replace wq users and add WQ_PERCPU to alloc_workqueue() users" is part of Marco's kernel-wide migration from the legacy workqueue APIs over to the preferred unbound workqueues (Marco Crivellari) - "Various mm kselftests improvements/fixes" provides various unrelated improvements/fixes for the mm kselftests (Kevin Brodsky) - "mm: accelerate gigantic folio allocation" greatly speeds up gigantic folio allocation, mainly by avoiding unnecessary work in pfn_range_valid_contig() (Kefeng Wang) - "selftests/damon: improve leak detection and wss estimation reliability" improves the reliability of two of the DAMON selftests (SeongJae Park) - "mm/damon: cleanup kdamond, damon_call(), damos filter and DAMON_MIN_REGION" does some cleanup work in the core DAMON code (SeongJae Park) - "Docs/mm/damon: update intro, modules, maintainer profile, and misc" performs maintenance work on the DAMON documentation (SeongJae Park) - "mm: add and use vma_assert_stabilised() helper" refactors and cleans up the core VMA code. The main aim here is to be able to use the mmap write lock's lockdep state to perform various assertions regarding the locking which the VMA code requires (Lorenzo Stoakes) - "mm, swap: swap table phase II: unify swapin use" removes some old swap code (swap cache bypassing and swap synchronization) which wasn't working very well. Various other cleanups and simplifications were made. The end result is a 20% speedup in one benchmark (Kairui Song) - "enable PT_RECLAIM on more 64-bit architectures" makes PT_RECLAIM available on 64-bit alpha, loongarch, mips, parisc, and um. Various cleanups were performed along the way (Qi Zheng) * tag 'mm-stable-2026-02-11-19-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (325 commits) mm/memory: handle non-split locks correctly in zap_empty_pte_table() mm: move pte table reclaim code to memory.c mm: make PT_RECLAIM depends on MMU_GATHER_RCU_TABLE_FREE mm: convert __HAVE_ARCH_TLB_REMOVE_TABLE to CONFIG_HAVE_ARCH_TLB_REMOVE_TABLE config um: mm: enable MMU_GATHER_RCU_TABLE_FREE parisc: mm: enable MMU_GATHER_RCU_TABLE_FREE mips: mm: enable MMU_GATHER_RCU_TABLE_FREE LoongArch: mm: enable MMU_GATHER_RCU_TABLE_FREE alpha: mm: enable MMU_GATHER_RCU_TABLE_FREE mm: change mm/pt_reclaim.c to use asm/tlb.h instead of asm-generic/tlb.h mm/damon/stat: remove __read_mostly from memory_idle_ms_percentiles zsmalloc: make common caches global mm: add SPDX id lines to some mm source files mm/zswap: use %pe to print error pointers mm/vmscan: use %pe to print error pointers mm/readahead: fix typo in comment mm: khugepaged: fix NR_FILE_PAGES and NR_SHMEM in collapse_file() mm: refactor vma_map_pages to use vm_insert_pages mm/damon: unify address range representation with damon_addr_range mm/cma: replace snprintf with strscpy in cma_new_area ... commit 541c43310e85dbf35368b43b720c6724bc8ad8ec Merge: a8ed22870f5304 18a777eee28938 Author: Linus Torvalds Date: Thu Feb 12 10:57:57 2026 -0800 Merge tag 'fs_for_v6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull quota and isofs updates from Jan Kara: - a fix for quotactl livelock during filesystem freezing - a small improvement for isofs - a documentation fix for ext2 * tag 'fs_for_v6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: isofs: support full length file names (255 instead of 253) quota: fix livelock between quotactl and freeze_super doc : fix a broken link in ext2.rst commit a8ed22870f5304a6ac64f694572cafc12801a9cf Merge: 997f9640c9238b 74bd284537b344 Author: Linus Torvalds Date: Thu Feb 12 10:52:46 2026 -0800 Merge tag 'fsnotify_for_v6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "A set of fixes to shutdown fsnotify subsystem before invalidating dcache thus addressing some nasty possible races" * tag 'fsnotify_for_v6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: Shutdown fsnotify before destroying sb's dcache fsnotify: Use connector list for destroying inode marks fsnotify: Track inode connectors for a superblock commit 997f9640c9238b991b6c8abf5420b37bbba5d867 Merge: 5903c871e21498 433fbcac9ebe49 Author: Linus Torvalds Date: Thu Feb 12 10:41:34 2026 -0800 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity updates from Eric Biggers: "fsverity cleanups, speedup, and memory usage optimization from Christoph Hellwig: - Move some logic into common code - Fix btrfs to reject truncates of fsverity files - Improve the readahead implementation - Store each inode's fsverity_info in a hash table instead of using a pointer in the filesystem-specific part of the inode. This optimizes for memory usage in the usual case where most files don't have fsverity enabled. - Look up the fsverity_info fewer times during verification, to amortize the hash table overhead" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fsverity: remove inode from fsverity_verification_ctx fsverity: use a hashtable to find the fsverity_info btrfs: consolidate fsverity_info lookup f2fs: consolidate fsverity_info lookup ext4: consolidate fsverity_info lookup fs: consolidate fsverity_info lookup in buffer.c fsverity: push out fsverity_info lookup fsverity: deconstify the inode pointer in struct fsverity_info fsverity: kick off hash readahead at data I/O submission time ext4: move ->read_folio and ->readahead to readpage.c readahead: push invalidate_lock out of page_cache_ra_unbounded fsverity: don't issue readahead for non-ENOENT errors from __filemap_get_folio fsverity: start consolidating pagecache code fsverity: pass struct file to ->write_merkle_tree_block f2fs: don't build the fsverity work handler for !CONFIG_FS_VERITY ext4: don't build the fsverity work handler for !CONFIG_FS_VERITY fs,fsverity: clear out fsverity_info from common code fs,fsverity: reject size changes on fsverity files in setattr_prepare commit 5903c871e21498405d11c5699d06becd12acda24 Merge: 178574549e4217 4f5e8e6f012349 Author: Linus Torvalds Date: Thu Feb 12 10:19:58 2026 -0800 Merge tag 'ext4_for_linus-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "New features and improvements for the ext4 file system - Avoid unnecessary cache invalidation in the extent status cache (es_cache) when adding extents to be cached in the es_cache and we are not changing the extent tree - Add a sysfs parameter, err_report_sec, to control how frequently to log a warning message that file system inconsistency has been detected (Previously we logged the warning message every 24 hours) - Avoid unnecessary forced ordered writes when appending to a file when delayed allocation is enabled - Defer splitting unwritten extents to I/O completion to improve write performance of concurrent direct I/O writes to multiple files - Refactor and add kunit tests to the extent splitting and conversion code paths Various Bug Fixes: - Fix a panic when the debugging DOUBLE_CHECK macro is defined - Avoid using fast commit for rare and complex file system operations to make fast commit easier to reason about. This can also avoid some corner cases that could result in file system inconsistency if there is a crash between the fast commit before a subsequent full commit - Fix memory leaks in error paths - Fix a false positive reports caused when running stress tests using mixed huge-page workloads caused by a race between page migration and bitmap updates - Fix a potential recursion into file system reclaim when evicting an inode when fast commit is enabled - Fix a warning caused by a potential double decrement to the dirty clusters counter when executing FS_IOC_SHUTDOWN when running a stress test - Enable mballoc optimized scanning regardless whether the inode is using indirect blocks or extent trees to map blocks" * tag 'ext4_for_linus-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (45 commits) et4: allow zeroout when doing written to unwritten split ext4: refactor split and convert extents ext4: refactor zeroout path and handle all cases ext4: propagate flags to ext4_convert_unwritten_extents_endio() ext4: propagate flags to convert_initialized_extent() ext4: add extent status cache support to kunit tests ext4: kunit tests for higher level extent manipulation functions ext4: kunit tests for extent splitting and conversion ext4: use optimized mballoc scanning regardless of inode format ext4: always allocate blocks only from groups inode can use ext4: fix dirtyclusters double decrement on fs shutdown ext4: fast commit: make s_fc_lock reclaim-safe ext4: fix e4b bitmap inconsistency reports ext4: remove redundant NULL check after __GFP_NOFAIL ext4: remove EXT4_GET_BLOCKS_IO_CREATE_EXT ext4: simplify the mapping query logic in ext4_iomap_begin() ext4: remove unused unwritten parameter in ext4_dio_write_iter() ext4: remove useless ext4_iomap_overwrite_ops ext4: avoid starting handle when dio writing an unwritten extent ext4: don't split extent before submitting I/O ... commit 178574549e421755dbe1e4721e20ca6c10af4900 Merge: cf559d90111400 7833570dae8330 Author: Linus Torvalds Date: Thu Feb 12 09:30:56 2026 -0800 Merge tag 'jfs-7.0' of github.com:kleikamp/linux-shaggy Pull jfs updates from Dave Kleikamp: "Just a handful of minor jfs fixes" * tag 'jfs-7.0' of github.com:kleikamp/linux-shaggy: jfs: avoid -Wtautological-constant-out-of-range-compare warning jfs: Add missing set_freezable() for freezable kthread jfs: nlink overflow in jfs_rename commit 988369d236e46e6bc68d2616fbc008aa6b06a454 Author: David Carlier Date: Wed Feb 11 21:30:27 2026 +0000 tools/sched_ext: scx_central: fix sched_setaffinity() call with the set size The cpu set is dynamically allocated for nr_cpu_ids using CPU_ALLOC(), so the size passed to sched_setaffinity() should be CPU_ALLOC_SIZE() rather than sizeof(cpu_set_t). Valgrind flagged this as accessing unaddressable bytes past the allocation. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit 11fece49e956ef97318177f5af15a84317594244 Author: David Carlier Date: Wed Feb 11 21:52:13 2026 +0000 tools/sched_ext: scx_flatcg: zero-initialize stats counter array The local cnts array in read_stats() is not initialized before being accumulated into per-CPU stats, which may lead to reading garbage values. Zero it out with memset alongside the existing stats array initialization. Signed-off-by: David Carlier Signed-off-by: Tejun Heo commit 5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1 Author: Qingye Zhao Date: Wed Feb 11 09:24:04 2026 +0000 cgroup: fix race between task migration and iteration When a task is migrated out of a css_set, cgroup_migrate_add_task() first moves it from cset->tasks to cset->mg_tasks via: list_move_tail(&task->cg_list, &cset->mg_tasks); If a css_task_iter currently has it->task_pos pointing to this task, css_set_move_task() calls css_task_iter_skip() to keep the iterator valid. However, since the task has already been moved to ->mg_tasks, the iterator is advanced relative to the mg_tasks list instead of the original tasks list. As a result, remaining tasks on cset->tasks, as well as tasks queued on cset->mg_tasks, can be skipped by iteration. Fix this by calling css_set_skip_task_iters() before unlinking task->cg_list from cset->tasks. This advances all active iterators to the next task on cset->tasks, so iteration continues correctly even when a task is concurrently being migrated. This race is hard to hit in practice without instrumentation, but it can be reproduced by artificially slowing down cgroup_procs_show(). For example, on an Android device a temporary /sys/kernel/cgroup/cgroup_test knob can be added to inject a delay into cgroup_procs_show(), and then: 1) Spawn three long-running tasks (PIDs 101, 102, 103). 2) Create a test cgroup and move the tasks into it. 3) Enable a large delay via /sys/kernel/cgroup/cgroup_test. 4) In one shell, read cgroup.procs from the test cgroup. 5) Within the delay window, in another shell migrate PID 102 by writing it to a different cgroup.procs file. Under this setup, cgroup.procs can intermittently show only PID 101 while skipping PID 103. Once the migration completes, reading the file again shows all tasks as expected. Note that this change does not allow removing the existing css_set_skip_task_iters() call in css_set_move_task(). The new call in cgroup_migrate_add_task() only handles iterators that are racing with migration while the task is still on cset->tasks. Iterators may also start after the task has been moved to cset->mg_tasks. If we dropped css_set_skip_task_iters() from css_set_move_task(), such iterators could keep task_pos pointing to a migrating task, causing css_task_iter_advance() to malfunction on the destination css_set, up to and including crashes or infinite loops. The race window between migration and iteration is very small, and css_task_iter is not on a hot path. In the worst case, when an iterator is positioned on the first thread of the migrating process, cgroup_migrate_add_task() may have to skip multiple tasks via css_set_skip_task_iters(). However, this only happens when migration and iteration actually race, so the performance impact is negligible compared to the correctness fix provided here. Fixes: b636fd38dc40 ("cgroup: Implement css_task_iter_skip()") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: Qingye Zhao Reviewed-by: Michal Koutný Signed-off-by: Tejun Heo commit e5f72cb9cea599dc9f5a9b80a33560a1d06f01cc Author: Kai-Heng Feng Date: Tue Feb 10 22:20:57 2026 +0800 PCI: Validate window resource type in pbus_select_window_for_type() After ebe091ad81e1 ("PCI: Use pbus_select_window_for_type() during IO window sizing") and ae88d0b9c57f ("PCI: Use pbus_select_window_for_type() during mem window sizing"), many bridge windows can't get resources assigned: pci 0006:05:00.0: bridge window [??? 0x00001000-0x00001fff flags 0x20080000]: can't assign; no space pci 0006:05:00.0: bridge window [??? 0x00001000-0x00001fff flags 0x20080000]: failed to assign Those commits replace find_bus_resource_of_type() with pbus_select_window_for_type(), and the latter lacks resource type validation. Add the resource type validation back to pbus_select_window_for_type() to match the original behavior. Fixes: 74afce3dfcba ("PCI: Add bridge window selection functions") Link: https://bugzilla.kernel.org/show_bug.cgi?id=221072 Signed-off-by: Kai-Heng Feng Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20260210142058.82701-1-kaihengf@nvidia.com commit cf559d9011140087abf84b34871849ee8e305bca Merge: d53f4d93f3d686 9e835108a9ae1c Author: Linus Torvalds Date: Thu Feb 12 08:57:31 2026 -0800 Merge tag 'for-linus-7.0-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: - Fixes for string handling in orangefs-debugfs.c and xattr.c (Thorsten Blum) * tag 'for-linus-7.0-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: fs/orangefs: Replace deprecated strcpy with memcpy + strscpy orangefs: Replace deprecated strcpy with strscpy commit d53f4d93f3d686fd64513abb3977c9116bbfdaf8 Merge: 2831fa8b8bcf10 8f7df60fe063b6 Author: Linus Torvalds Date: Thu Feb 12 08:31:12 2026 -0800 Merge tag 'v7.0-rc-part1-ksmbd-and-smbdirect-fixes' of git://git.samba.org/ksmbd Pull smb server and smbdirect updates from Steve French: - Fix tcp connection leak - Fix potential use after free when freeing multichannel - Fix locking problem in showing channel list - Locking improvement for tree connection - Fix infinite loop when signing errors - Add /proc interface for monitoring server state - Fixes to avoid mixing iWarp and InfiniBand/RoCEv1/RoCEv2 port ranges used for smbdirect - Fixes for smbdirect credit handling problems, these make the connections more reliable * tag 'v7.0-rc-part1-ksmbd-and-smbdirect-fixes' of git://git.samba.org/ksmbd: (32 commits) ksmbd: fix non-IPv6 build ksmbd: convert tree_conns_lock to rw_semaphore ksmbd: fix missing chann_lock while iterating session channel list ksmbd: add chann_lock to protect ksmbd_chann_list xarray smb: server: correct value for smb_direct_max_fragmented_recv_size smb: client: correct value for smbd_max_fragmented_recv_size smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() ksmbd: add procfs interface for runtime monitoring and statistics ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths smb: server: make use of rdma_restrict_node_type() smb: client: make use of rdma_restrict_node_type() RDMA/core: introduce rdma_restrict_node_type() smb: client: let send_done handle a completion without IB_SEND_SIGNALED smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() smb: client: fix last send credit problem causing disconnects smb: client: make use of smbdirect_socket.send_io.bcredits smb: client: use smbdirect_send_batch processing smb: client: introduce and use smbd_{alloc, free}_send_io() smb: client: split out smbd_ib_post_send() smb: client: port and use the wait_for_credits logic used by server ... commit 68b4fe32d73789dea23e356f468de67c8367ef8f Author: Josh Poimboeuf Date: Tue Feb 10 13:45:22 2026 -0800 kbuild: Add objtool to top-level clean target Objtool is an integral part of the build, make sure it gets cleaned by "make clean" and "make mrproper". Fixes: 442f04c34a1a ("objtool: Add tool to perform compile-time stack metadata validation") Reported-by: Jens Remus Closes: https://lore.kernel.org/15f2af3b-be33-46fc-b972-6b8e7e0aa52e@linux.ibm.com Signed-off-by: Josh Poimboeuf Tested-by: Jens Remus Link: https://patch.msgid.link/968faf2ed30fa8b3519f79f01a1ecfe7929553e5.1770759919.git.jpoimboe@kernel.org [nathan: use Closes: instead of Link: per checkpatch.pl] Signed-off-by: Nathan Chancellor commit df989b01b5f97dae8f9869cfacbda1308f2182c1 Merge: 05f7e89ab97315 d8ad80a85b9664 Author: Nathan Chancellor Date: Thu Feb 12 11:28:27 2026 -0500 Merge 7.0 Kbuild changes into kbuild-fixes kbuild-fixes needs to be based on 6.19 to apply some fixes for 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") which landed in 6.19-rc1 but the new material of 7.0 needs fixes merged as well. Signed-off-by: Nathan Chancellor commit 2831fa8b8bcf1083f9526aa0c41fafb0796cf874 Merge: 37a93dd5c49b5f e939bd675634fd Author: Linus Torvalds Date: Thu Feb 12 08:23:53 2026 -0800 Merge tag 'nfsd-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "Neil Brown and Jeff Layton contributed a dynamic thread pool sizing mechanism for NFSD. The sunrpc layer now tracks minimum and maximum thread counts per pool, and NFSD adjusts running thread counts based on workload: idle threads exit after a timeout when the pool exceeds its minimum, and new threads spawn automatically when all threads are busy. Administrators control this behavior via the nfsdctl netlink interface. Rick Macklem, FreeBSD NFS maintainer, generously contributed server- side support for the POSIX ACL extension to NFSv4, as specified in draft-ietf-nfsv4-posix-acls. This extension allows NFSv4 clients to get and set POSIX access and default ACLs using native NFSv4 operations, eliminating the need for sideband protocols. The feature is gated by a Kconfig option since the IETF draft has not yet been ratified. Chuck Lever delivered numerous improvements to the xdrgen tool. Error reporting now covers parsing, AST transformation, and invalid declarations. Generated enum decoders validate incoming values against valid enumerator lists. New features include pass-through line support for embedding C directives in XDR specifications, 16-bit integer types, and program number definitions. Several code generation issues were also addressed. When an administrator revokes NFSv4 state for a filesystem via the unlock_fs interface, ongoing async COPY operations referencing that filesystem are now cancelled, with CB_OFFLOAD callbacks notifying affected clients. The remaining patches in this pull request are clean-ups and minor optimizations. Sincere thanks to all contributors, reviewers, testers, and bug reporters who participated in the v7.0 NFSD development cycle" * tag 'nfsd-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (45 commits) NFSD: Add POSIX ACL file attributes to SUPPATTR bitmasks NFSD: Add POSIX draft ACL support to the NFSv4 SETATTR operation NFSD: Add support for POSIX draft ACLs for file creation NFSD: Add support for XDR decoding POSIX draft ACLs NFSD: Refactor nfsd_setattr()'s ACL error reporting NFSD: Do not allow NFSv4 (N)VERIFY to check POSIX ACL attributes NFSD: Add nfsd4_encode_fattr4_posix_access_acl NFSD: Add nfsd4_encode_fattr4_posix_default_acl NFSD: Add nfsd4_encode_fattr4_acl_trueform_scope NFSD: Add nfsd4_encode_fattr4_acl_trueform Add RPC language definition of NFSv4 POSIX ACL extension NFSD: Add a Kconfig setting to enable support for NFSv4 POSIX ACLs xdrgen: Implement pass-through lines in specifications nfsd: cancel async COPY operations when admin revokes filesystem state nfsd: add controls to set the minimum number of threads per pool nfsd: adjust number of running nfsd threads based on activity sunrpc: allow svc_recv() to return -ETIMEDOUT and -EBUSY sunrpc: split new thread creation into a separate function sunrpc: introduce the concept of a minimum number of threads per pool sunrpc: track the max number of requested threads in a pool ... commit b660b13d4c6379ca6360f24aaef8c5807fefd237 Author: Ralf Lici Date: Fri Jan 30 18:32:50 2026 +0100 ovpn: fix VPN TX bytes counting In ovpn_net_xmit, after GSO segmentation and segment processing, the first segment on the list is used to increment VPN TX statistics, which fails to account for any subsequent segments in the chain. Fix this by accumulating the length of every segment that successfully passes skb_share_check into a tx_bytes variable. This ensures the peer statistics accurately reflect the total data volume sent, regardless of whether the original packet was segmented. Fixes: 04ca14955f9a ("ovpn: store tunnel and transport statistics") Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca Signed-off-by: Antonio Quartulli commit a5ec7baa44ea3a1d6aa0ca31c0ad82edf9affe41 Author: Ralf Lici Date: Fri Jan 30 18:32:49 2026 +0100 ovpn: fix possible use-after-free in ovpn_net_xmit When building the skb_list in ovpn_net_xmit, skb_share_check will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations: - peer lookup, - skb_dst_drop (even though all segments produced by skb_gso_segment will have a dst attached), - ovpn_peer_stats_increment_tx. Fix this by moving the peer lookup and skb_dst_drop before segmentation so that the original skb is still valid when used. Return early if all segments fail skb_share_check and the list ends up empty. Also switch ovpn_peer_stats_increment_tx to use skb_list.next; the next patch fixes the stats logic. Fixes: 08857b5ec5d9 ("ovpn: implement basic TX path (UDP)") Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca Signed-off-by: Antonio Quartulli commit 93686c472eb7b09a51b97a096449e7092fefcd1f Author: Ralf Lici Date: Fri Jan 30 18:32:48 2026 +0100 ovpn: set sk_user_data before overriding callbacks During initialization, we override socket callbacks and set sk_user_data to an ovpn_socket instance. Currently, these two operations are decoupled: callbacks are overridden before sk_user_data is set. While existing callbacks perform safety checks for NULL or non-ovpn sk_user_data, this condition causes a "half-formed" state where valid packets arriving during attachment trigger error logs (e.g., "invoked on non ovpn socket"). Set sk_user_data before overriding the callbacks so that it can be accessed safely from them. Since we already check that the socket has no sk_user_data before setting it, this remains safe even if an interrupt accesses the socket after sk_user_data is set but before the callbacks are overridden. This also requires initializing all protocol-specific fields (such as tcp_tx_work and peer links) before calling ovpn_socket_attach, ensuring the ovpn_socket is fully formed before it becomes visible to any callback. Fixes: f6226ae7a0cd ("ovpn: introduce the ovpn_socket object") Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca Signed-off-by: Antonio Quartulli commit c7d54dafa042cf379859dba265fe5afef6fa8770 Author: Kuppuswamy Sathyanarayanan Date: Wed Feb 11 14:34:01 2026 -0800 powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check On partitioned systems, multiple TPMI instances may exist per package, but RAPL registers are only valid on one instance since RAPL has package-scope control. Other instances return invalid versions during domain parsing, which is expected behavior on such systems. Currently this generates a firmware bug warning: intel_rapl_tpmi: [Firmware Bug]: Invalid version Remove the FW_BUG tag, downgrade to pr_debug(), and update the message to clarify that invalid versions are expected on partitioned systems where only one instance can be valid. Fixes: 9eef7f9da928 ("powercap: intel_rapl: Introduce RAPL TPMI interface driver") Reported-by: Zhang Rui Signed-off-by: Kuppuswamy Sathyanarayanan Reviewed-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260211223401.1575776-1-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit c1f57406672ba6644ebc437b70a139115b68a0dc Author: William Hansen-Baird Date: Wed Jan 21 19:04:34 2026 -0500 exfat: add blank line after declarations Add a blank line after variable declarations in fatent.c and file.c. This improves readability and makes code style more consistent across the exfat subsystem. Signed-off-by: William Hansen-Baird Signed-off-by: Namjae Jeon commit 5e37a4577f95d93903c5754c6bac921ac39b557e Author: William Hansen-Baird Date: Wed Jan 21 19:04:33 2026 -0500 exfat: remove unnecessary else after return statement Else-branch is unnecessary after return statement in if-branch. Remove to enhance readability and reduce indentation. Signed-off-by: William Hansen-Baird Signed-off-by: Namjae Jeon commit 9276e330c17b6c926bdc5da90cbc58d6c4f26298 Author: Chi Zhiling Date: Wed Jan 14 20:18:08 2026 +0800 exfat: support multi-cluster for exfat_get_cluster This patch introduces a count parameter to exfat_get_cluster, which serves as an input parameter for the caller to specify the desired number of clusters, and as an output parameter to store the length of consecutive clusters. This patch can improve read performance by reducing the number of get_block calls in sequential read scenarios. speacially in small cluster size. According to my test data, the performance improvement is approximately 10% when read FAT_CHAIN file with 512 bytes of cluster size. 454 MB/s -> 511 MB/s Suggested-by: Yuezhang Mo Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 9fb696a10a6735a15a0d2b4370419702e99818d0 Author: Chi Zhiling Date: Wed Jan 14 20:17:58 2026 +0800 exfat: return the start of next cache in exfat_cache_lookup Change exfat_cache_lookup to return the cluster number of the last cluster before the next cache (i.e., the end of the current cache range) or the given 'end' if there is no next cache. This allows the caller to know whether the next cluster after the current cache is cached. The function signature is changed to accept an 'end' parameter, which is the upper bound of the search range. The function now stops early if it finds a cache that starts within the current cache's tail, meaning caches are contiguous. The return value is the cluster number at which the next cache starts (minus one) or the original 'end' if no next cache is found. The new behavior is illustrated as follows: cache: [ccccccc-------ccccccccc] search: [..................] return: ^ Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 8c6bdce0e91425ca5e84f52819b7cf0e024fb129 Author: Chi Zhiling Date: Wed Jan 14 20:17:47 2026 +0800 exfat: tweak cluster cache to support zero offset The current cache mechanism does not support reading clusters starting from a file offset of zero. This patch enables that feature in preparation for subsequent reads of contiguous clusters from offset zero. 1. support finding clusters with zero offset. 2. allow clusters with zero offset to be cached. Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 256694b22d017edcc8a0ce82a8e40742b074d509 Author: Chi Zhiling Date: Wed Jan 14 20:12:46 2026 +0800 exfat: support multi-cluster for exfat_map_cluster This patch introduces a parameter 'count' to support fetching multiple clusters in exfat_map_cluster. The returned 'count' indicates the number of consecutive clusters, or 0 when the input cluster offset is past EOF. And the 'count' is also an input parameter for the caller to specify the required number of clusters. Only NO_FAT_CHAIN files enable multi-cluster fetching in this patch. After this patch, the time proportion of exfat_get_block has decreased, The performance data is as follows: Cluster size: 512 bytes Sequential read of a 30GB NO_FAT_CHAIN file: 2.4GB/s -> 2.5 GB/s proportion of exfat_get_block: 10.8% -> 0.02% Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 88a936b7a918e4f37296524d355505128c961d9c Author: Chi Zhiling Date: Wed Jan 14 20:12:45 2026 +0800 exfat: remove handling of non-file types in exfat_map_cluster Yuezhang said: "exfat_map_cluster() is only used for files. The code in this 'else' block is never executed and can be cleaned up." Suggested-by: Yuezhang Mo Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 6d0b7f873bbd153f6ce26a87ffa32238693e36a0 Author: Chi Zhiling Date: Wed Jan 14 20:12:44 2026 +0800 exfat: reuse cache to improve exfat_get_cluster Since exfat_ent_get supports cache buffer head, we can use this option to reduce sb_bread calls when fetching consecutive entries. Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit afb6ffa33dab9622f7502c081b17dbc9bc9a97d0 Author: Chi Zhiling Date: Wed Jan 14 20:12:43 2026 +0800 exfat: reduce the number of parameters for exfat_get_cluster() Remove parameter 'fclus' and 'allow_eof': - The fclus parameter is changed to a local variable as it is not needed to be returned. - The passed allow_eof parameter was always 1, remove it and the associated error handling. Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 5dc72a518137941852fc57b3cde97ff243791e57 Author: Chi Zhiling Date: Wed Jan 14 20:12:42 2026 +0800 exfat: remove the unreachable warning for cache miss cases The cache_id remains unchanged on a cache miss; its value is always exactly what was set by cache_init. Therefore, checking this value again is meaningless. Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 2e21557d5422a24e0c2c12455ae8b9f10045e3d5 Author: Chi Zhiling Date: Wed Jan 14 20:12:41 2026 +0800 exfat: remove the check for infinite cluster chain loop The infinite cluster chain loop check is not work because the loop will terminate when fclus reaches the parameter cluster, and the parameter cluster value is never greater than ei->valid_size. The following relationship holds: 'fclus' < 'cluster' ≤ ei->valid_size ≤ sb->num_clusters The check would only be triggered if a cluster number greater than sb->num_clusters is passed, but no caller currently does this. Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 5e205c484b1feb3297f78351f3866cb60afe004b Author: Chi Zhiling Date: Wed Jan 14 20:12:40 2026 +0800 exfat: improve exfat_find_last_cluster Since exfat_ent_get support cache buffer head, let's apply it to exfat_find_last_cluster. Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 06805f4c57840c6957b1c2064d3b453e66e943ab Author: Chi Zhiling Date: Wed Jan 14 20:12:39 2026 +0800 exfat: improve exfat_count_num_clusters Since exfat_ent_get support cache buffer head, let's apply it to exfat_count_num_clusters. Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 5cf0288f0da3ad1422690f9602149f023abffe9b Author: Chi Zhiling Date: Wed Jan 14 20:12:38 2026 +0800 exfat: support reuse buffer head for exfat_ent_get This patch is part 2 of cached buffer head for exfat_ent_get, it introduces an argument for exfat_ent_get, and make sure this routine releases buffer head refcount when any error return. Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 967288e9a6f2ca88cf7d004d87bb3aa9db64fbe2 Author: Chi Zhiling Date: Wed Jan 14 20:12:37 2026 +0800 exfat: add cache option for __exfat_ent_get When multiple entries are obtained consecutively, these entries are mostly stored adjacent to each other. this patch introduces a "last" parameter to cache the last opened buffer head, and reuse it when possible, which reduces the number of sb_bread() calls. When the passed parameter "last" is NULL, it means cache option is disabled, the behavior unchanged as it was. Signed-off-by: Chi Zhiling Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 0914882bdda645e10cf536b474631e1a023b67c0 Author: Yuling Dong Date: Thu Jan 15 13:05:23 2026 +0800 exfat: reduce unnecessary writes during mmap write During mmap write, exfat_page_mkwrite() currently extends valid_size to the end of the VMA range. For a large mapping, this can push valid_size far beyond the page that actually triggered the fault, resulting in unnecessary writes. valid_size only needs to extend to the end of the page being written. Signed-off-by: Yuling Dong Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 8ffe56b104c5a9cdb88e3c7b2d84fa70d8866e64 Author: Haotian Zhang Date: Fri Dec 5 09:59:04 2025 +0800 exfat: improve error code handling in exfat_find_empty_entry() Change the type of 'ret' from unsigned int to int in exfat_find_empty_entry(). Although the implicit type conversion (int -> unsigned int -> int) does not cause actual bugs in practice, using int directly is more appropriate for storing error codes returned by exfat_alloc_cluster(). This improves code clarity and consistency with standard error handling practices. Signed-off-by: Haotian Zhang Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit e243cdd87b911ce9968b62e4ab2b680dfadc4341 Author: Bjorn Andersson Date: Wed Feb 11 21:37:14 2026 -0600 regulator: core: Remove regulator supply_name length limit When creating the regulator object, associated with a consumer device, the supply_name is string formatted into a statically sized buffer on the stack, then strdup()'ed onto the heap. Not only is the dance on the stack unnecessary, but when the device's name is long we might not fit the constructed supply_name in the fixed 64 byte buffer on the stack. One such case can be seen on the Qualcomm Rb3Gen2 board, where we find a PCIe controller, with a PCIe switch, with a USB controller, with a USB hub, consuming a regulator. In this example the dev->kobj.name itself is 62 characters long. Drop the temporary buffer on the stack and kasprintf() the string directly on the heap, both to simplify the code, and to remove the length limitation. Signed-off-by: Bjorn Andersson Link: https://patch.msgid.link/20260211-regulator-supply-name-length-v1-1-3875541c1576@oss.qualcomm.com Signed-off-by: Mark Brown commit b82fa9b0c26eeb2fde6017f7de2c3c544484efef Author: Alexandre Ferrieux Date: Wed Feb 11 11:27:32 2026 +0100 ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init The aw88261_dev_reg_update() function sets the Awinic registers in a rather nonuniform way: - most registers get directly overwritten from the firmware blob - but a handful of them need more delicate logic to preserve some bits from their current value, according to a register- specific mask For the latter, the logic is basically NEW = (OLD & MASK) | (VAL & ~MASK) However, the ~MASK value is hand-computed, and in the specific case of the SYSCTRL register, in a buggy way. This patch restores the proper ~MASK value. Fixes: 028a2ae25691 ("ASoC: codecs: Add aw88261 amplifier driver") Signed-off-by: Alexandre Ferrieux Link: https://patch.msgid.link/20260211-aw88261-fwname-v1-1-e24e833a019d@fairphone.com Signed-off-by: Mark Brown commit 42a9a5c25615aa1206f893695016a556b345ba85 Author: Shengjiu Wang Date: Wed Feb 11 18:10:09 2026 +0800 ASoC: dt-bindings: asahi-kasei,ak5558: Reference common DAI properties Reference the dai-common.yaml schema to allow '#sound-dai-cells' and "sound-name-prefix' to be used because asahi-kasei,ak5558 is codec DAI. Signed-off-by: Shengjiu Wang Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260211101009.2895296-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 56eb0c0ed345da7815274aa821a8546a073d7e97 Author: Sean V Kelley Date: Wed Feb 11 21:22:54 2026 +0000 ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe(). However, send_pcc_cmd() and acpi_get_psd_map() still iterate over all possible CPUs. In acpi_get_psd_map(), encountering an offline CPU returns -EFAULT, causing cppc_cpufreq initialization to fail. This breaks systems booted with "nosmt" or "nosmt=force". Fix by using for_each_online_cpu() in both functions. Fixes: 80b8286aeec0 ("ACPI / CPPC: support for batching CPPC requests") Signed-off-by: Sean V Kelley Link: https://patch.msgid.link/20260211212254.30190-1-skelley@nvidia.com Signed-off-by: Rafael J. Wysocki commit a8c975302868c716afef0f50467bebbd069a35b8 Author: Yauhen Kharuzhy Date: Thu Feb 12 00:22:42 2026 +0200 ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 The PWM2 on YB1-X90 tablets is used for keyboard backlight control but it is disabled in the ACPI DSDT table. Add it to the override_status_ids list to allow keyboard function control driver (drivers/platform/x86/lenovo/yogabook.c) to use it. Signed-off-by: Yauhen Kharuzhy Link: https://patch.msgid.link/20260211222242.4101162-1-jekhor@gmail.com Signed-off-by: Rafael J. Wysocki commit 453daece381e60df20da16c49ccc6a9bc5c6515a Author: Chaitanya Kulkarni Date: Wed Feb 11 12:44:38 2026 -0800 block: change return type to void Now that all the callers of __blkdev_issue_discard() have been changed to ignore its return value, change its return type from int to void. Signed-off-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 38d12f15c4772b5383b1249b2afb0d206a430f0f Author: Chaitanya Kulkarni Date: Wed Feb 11 12:44:37 2026 -0800 nvmet: ignore discard return value __blkdev_issue_discard() always returns 0, making the error checking in nvmet_bdev_discard_range() dead code. Kill the function nvmet_bdev_discard_range() and call __blkdev_issue_discard() directly from nvmet_bdev_execute_discard(), since no error handling is needed anymore for __blkdev_issue_discard() call. Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit 699fcfb6cb80a9df67fd2086a1c930d196d709f2 Author: Chaitanya Kulkarni Date: Wed Feb 11 12:44:36 2026 -0800 md: ignore discard return value __blkdev_issue_discard() always returns 0, making all error checking at call sites dead code. Simplify md to only check !discard_bio by ignoring the __blkdev_issue_discard() value. Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit 81e7223b1a2d63b655ee72577c8579f968d037e3 Author: Chaitanya Kulkarni Date: Wed Feb 11 12:49:44 2026 -0800 block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova When dma_iova_link() fails partway through mapping a request's bvec list, the function breaks out of the loop without cleaning up already mapped segments. Similarly, if dma_iova_sync() fails after linking all segments, no cleanup is performed. This leaves partial IOVA mappings in place. The completion path attempts to unmap the full expected size via dma_iova_destroy() or nvme_unmap_data(), but only a partial size was actually mapped, leading to incorrect unmap operations. Add an out_unlink error path that calls dma_iova_destroy() to clean up partial mappings before returning failure. The dma_iova_destroy() function handles both partial unlink and IOVA space freeing. It correctly handles the mapped_len == 0 case (first dma_iova_link() failure) by only freeing the IOVA allocation without attempting to unmap. Signed-off-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 5991bfa3f88ec8d67fa3f552c19c39ff37a4e67b Author: Jens Axboe Date: Thu Feb 12 04:07:41 2026 -0700 block: fix folio leak in bio_iov_iter_bounce_read() If iov_iter_extract_bvecs() returns an error or zero bytes extracted, then the folio allocated is leaked on return. Ensure it's put before returning. Fixes: 8dd5e7c75d7b ("block: add helpers to bounce buffer an iov_iter into bios") Signed-off-by: Jens Axboe commit 5a36d2bda9c8303a46a52beafcb0711eff8d6a42 Author: 胡连勤 Date: Thu Feb 12 04:20:36 2026 +0000 ALSA: usb-audio: Add iface reset and delay quirk for GHW-123P Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: New USB device found, idVendor=0020, idProduct=0b21 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: GHW-123P usb 1-1: Manufacturer: Generic usb 1-1: SerialNumber: 20210726905926 Signed-off-by: Lianqin Hu Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/TYUPR06MB62176831E47899AB98902012D260A@TYUPR06MB6217.apcprd06.prod.outlook.com commit 57b85fd53fccfdf14ce7b36d919c31aa752255f8 Author: Kaushlendra Kumar Date: Fri Jan 9 08:55:49 2026 +0530 drm/i915/acpi: free _DSM package when no connectors acpi_evaluate_dsm_typed() returns an ACPI package in pkg. When pkg->package.count == 0, we returned without freeing pkg, leaking memory. Free pkg before returning on the empty case. Signed-off-by: Kaushlendra Kumar Fixes: 337d7a1621c7 ("drm/i915: Fix invalid access to ACPI _DSM objects") Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260109032549.1826303-1-kaushlendra.kumar@intel.com Signed-off-by: Jani Nikula (cherry picked from commit c0a27a0ca8a34e96d08bb05a2c5d5ccf63fb8dc0) Signed-off-by: Joonas Lahtinen commit fe26ae6ac8b88fcdac5036b557c129a17fe520d2 Author: Imre Deak Date: Mon Feb 9 15:38:16 2026 +0200 drm/i915/dp: Fix pipe BPP clamping due to HDR The pipe BPP value shouldn't be set outside of the source's / sink's valid pipe BPP range, ensure this when increasing the minimum pipe BPP value to 30 due to HDR. While at it debug print if the HDR mode was requested for a connector by setting the corresponding HDR connector property. This indicates if the requested HDR mode could not be enabled, since the selected pipe BPP is below 30, due to a sink capability or link BW limit. v2: - Also handle the case where the sink could support the target 30 BPP only in DSC mode due to a BW limit, but the sink doesn't support DSC or 30 BPP as a DSC input BPP. (Chaitanya) - Debug print the connector's HDR mode in the link config dump, to indicate if a BPP >= 30 required by HDR couldn't be reached. (Ankit) - Add Closes: trailer. (Ankit) - Don't print the 30 BPP-outside of valid BPP range debug message if the min BPP is already > 30 (and so a target BPP >= 30 required for HDR is ensured). Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7052 Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15503 Fixes: ba49a4643cf53 ("drm/i915/dp: Set min_bpp limit to 30 in HDR mode") Cc: Chaitanya Kumar Borah Cc: # v6.18+ Reviewed-by: Ankit Nautiyal # v1 Reviewed-by: Chaitanya Kumar Borah Signed-off-by: Imre Deak Link: https://patch.msgid.link/20260209133817.395823-1-imre.deak@intel.com (cherry picked from commit 08b7ef16b6a03e8c966e286ee1ac608a6ffb3d4a) Signed-off-by: Joonas Lahtinen commit d7d95207caf41a8b5a595ed257cb4ce69726d3d7 Author: Jens Axboe Date: Wed Feb 11 19:47:38 2026 -0700 io_uring: use the right type for creds iteration In io_ring_ctx_wait_and_kill(), struct creds *creds is used to iterate and prune credentials. But the correct type is struct cred. This doesn't matter as the variable isn't used at all, only the index is used. But it's confusing using a type that isn't valid, so fix it up. Signed-off-by: Jens Axboe commit 37a93dd5c49b5fda807fd204edf2547c3493319c Merge: 098b6e44cbaa2d 83310d613382f7 Author: Linus Torvalds Date: Wed Feb 11 19:31:52 2026 -0800 Merge tag 'net-next-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Paolo Abeni: "Core & protocols: - A significant effort all around the stack to guide the compiler to make the right choice when inlining code, to avoid unneeded calls for small helper and stack canary overhead in the fast-path. This generates better and faster code with very small or no text size increases, as in many cases the call generated more code than the actual inlined helper. - Extend AccECN implementation so that is now functionally complete, also allow the user-space enabling it on a per network namespace basis. - Add support for memory providers with large (above 4K) rx buffer. Paired with hw-gro, larger rx buffer sizes reduce the number of buffers traversing the stack, dincreasing single stream CPU usage by up to ~30%. - Do not add HBH header to Big TCP GSO packets. This simplifies the RX path, the TX path and the NIC drivers, and is possible because user-space taps can now interpret correctly such packets without the HBH hint. - Allow IPv6 routes to be configured with a gateway address that is resolved out of a different interface than the one specified, aligning IPv6 to IPv4 behavior. - Multi-queue aware sch_cake. This makes it possible to scale the rate shaper of sch_cake across multiple CPUs, while still enforcing a single global rate on the interface. - Add support for the nbcon (new buffer console) infrastructure to netconsole, enabling lock-free, priority-based console operations that are safer in crash scenarios. - Improve the TCP ipv6 output path to cache the flow information, saving cpu cycles, reducing cache line misses and stack use. - Improve netfilter packet tracker to resolve clashes for most protocols, avoiding unneeded drops on rare occasions. - Add IP6IP6 tunneling acceleration to the flowtable infrastructure. - Reduce tcp socket size by one cache line. - Notify neighbour changes atomically, avoiding inconsistencies between the notification sequence and the actual states sequence. - Add vsock namespace support, allowing complete isolation of vsocks across different network namespaces. - Improve xsk generic performances with cache-alignment-oriented optimizations. - Support netconsole automatic target recovery, allowing netconsole to reestablish targets when underlying low-level interface comes back online. Driver API: - Support for switching the working mode (automatic vs manual) of a DPLL device via netlink. - Introduce PHY ports representation to expose multiple front-facing media ports over a single MAC. - Introduce "rx-polarity" and "tx-polarity" device tree properties, to generalize polarity inversion requirements for differential signaling. - Add helper to create, prepare and enable managed clocks. Device drivers: - Add Huawei hinic3 PF etherner driver. - Add DWMAC glue driver for Motorcomm YT6801 PCIe ethernet controller. - Add ethernet driver for MaxLinear MxL862xx switches - Remove parallel-port Ethernet driver. - Convert existing driver timestamp configuration reporting to hwtstamp_get and remove legacy ioctl(). - Convert existing drivers to .get_rx_ring_count(), simplifing the RX ring count retrieval. Also remove the legacy fallback path. - Ethernet high-speed NICs: - Broadcom (bnxt, bng): - bnxt: add FW interface update to support FEC stats histogram and NVRAM defragmentation - bng: add TSO and H/W GRO support - nVidia/Mellanox (mlx5): - improve latency of channel restart operations, reducing the used H/W resources - add TSO support for UDP over GRE over VLAN - add flow counters support for hardware steering (HWS) rules - use a static memory area to store headers for H/W GRO, leading to 12% RX tput improvement - Intel (100G, ice, idpf): - ice: reorganizes layout of Tx and Rx rings for cacheline locality and utilizes __cacheline_group* macros on the new layouts - ice: introduces Synchronous Ethernet (SyncE) support - Meta (fbnic): - adds debugfs for firmware mailbox and tx/rx rings vectors - Ethernet virtual: - geneve: introduce GRO/GSO support for double UDP encapsulation - Ethernet NICs consumer, and embedded: - Synopsys (stmmac): - some code refactoring and cleanups - RealTek (r8169): - add support for RTL8127ATF (10G Fiber SFP) - add dash and LTR support - Airoha: - AN8811HB 2.5 Gbps phy support - Freescale (fec): - add XDP zero-copy support - Thunderbolt: - add get link setting support to allow bonding - Renesas: - add support for RZ/G3L GBETH SoC - Ethernet switches: - Maxlinear: - support R(G)MII slow rate configuration - add support for Intel GSW150 - Motorcomm (yt921x): - add DCB/QoS support - TI: - icssm-prueth: support bridging (STP/RSTP) via the switchdev framework - Ethernet PHYs: - Realtek: - enable SGMII and 2500Base-X in-band auto-negotiation - simplify and reunify C22/C45 drivers - Micrel: convert bindings to DT schema - CAN: - move skb headroom content into skb extensions, making CAN metadata access more robust - CAN drivers: - rcar_canfd: - add support for FD-only mode - add support for the RZ/T2H SoC - sja1000: cleanup the CAN state handling - WiFi: - implement EPPKE/802.1X over auth frames support - split up drop reasons better, removing generic RX_DROP - additional FTM capabilities: 6 GHz support, supported number of spatial streams and supported number of LTF repetitions - better mac80211 iterators to enumerate resources - initial UHR (Wi-Fi 8) support for cfg80211/mac80211 - WiFi drivers: - Qualcomm/Atheros: - ath11k: support for Channel Frequency Response measurement - ath12k: a significant driver refactor to support multi-wiphy devices and and pave the way for future device support in the same driver (rather than splitting to ath13k) - ath12k: support for the QCC2072 chipset - Intel: - iwlwifi: partial Neighbor Awareness Networking (NAN) support - iwlwifi: initial support for U-NII-9 and IEEE 802.11bn - RealTek (rtw89): - preparations for RTL8922DE support - Bluetooth: - implement setsockopt(BT_PHY) to set the connection packet type/PHY - set link_policy on incoming ACL connections - Bluetooth drivers: - btusb: add support for MediaTek7920, Realtek RTL8761BU and 8851BE - btqca: add WCN6855 firmware priority selection feature" * tag 'net-next-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1254 commits) bnge/bng_re: Add a new HSI net: macb: Fix tx/rx malfunction after phy link down and up af_unix: Fix memleak of newsk in unix_stream_connect(). net: ti: icssg-prueth: Add optional dependency on HSR net: dsa: add basic initial driver for MxL862xx switches net: mdio: add unlocked mdiodev C45 bus accessors net: dsa: add tag format for MxL862xx switches dt-bindings: net: dsa: add MaxLinear MxL862xx selftests: drivers: net: hw: Modify toeplitz.c to poll for packets octeontx2-pf: Unregister devlink on probe failure net: renesas: rswitch: fix forwarding offload statemachine ionic: Rate limit unknown xcvr type messages tcp: inet6_csk_xmit() optimization tcp: populate inet->cork.fl.u.ip6 in tcp_v6_syn_recv_sock() tcp: populate inet->cork.fl.u.ip6 in tcp_v6_connect() ipv6: inet6_csk_xmit() and inet6_csk_update_pmtu() use inet->cork.fl.u.ip6 ipv6: use inet->cork.fl.u.ip6 and np->final in ip6_datagram_dst_update() ipv6: use np->final in inet6_sk_rebuild_header() ipv6: add daddr/final storage in struct ipv6_pinfo net: stmmac: qcom-ethqos: fix qcom_ethqos_serdes_powerup() ... commit f4d0668b38d8784f33a9a36c72ed5d0078247538 Author: Jens Axboe Date: Wed Feb 11 15:12:13 2026 -0700 io_uring/openclose: fix io_pipe_fixed() slot tracking for specific slots __io_fixed_fd_install() returns 0 on success for non-alloc mode (specific slot), not the slot index. io_pipe_fixed() used this return value directly as the slot index in fds[], which can cause the reported values returned via copy_to_user() to be incorrect, or the error path operating on the incorrect direct descriptor. Fix by computing the actual 0-based slot index (slot - 1) for specific slot mode, while preserving the existing behavior for auto-alloc mode where __io_fixed_fd_install() already returns the allocated index. Cc: stable@vger.kernel.org Fixes: 53db8a71ecb4 ("io_uring: add support for IORING_OP_PIPE") Signed-off-by: Jens Axboe commit fa4820b893843f7ad5e1b5c446a92426c5c946ce Author: Haoyang LIU Date: Tue Feb 10 23:39:02 2026 +0800 tracing: Fix indentation of return statement in print_trace_fmt() The return statement inside the nested if block in print_trace_fmt() is not properly indented, making the code structure unclear. This was flagged by smatch as a warning. Add proper indentation to the return statement to match the kernel coding style and improve readability. Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260210153903.8041-1-tttturtleruss@gmail.com Signed-off-by: Haoyang LIU Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit bbdaa8c17cae18b977f4509911d7a390aa8a6597 Author: Maurizio Lombardi Date: Wed Feb 11 17:30:28 2026 +0100 nvme: fix memory leak in quirks_param_set() When loading the nvme module, if the 'quirks' parameter is specified via both the kernel command line (e.g., nvme.quirks=...) and the modprobe command line (e.g., modprobe nvme quirks=...), the quirks_param_set() callback is invoked twice. Currently, in the double-invocation scenario, the second call overwrites the nvme_pci_quirk_list pointer, causing the memory allocated in the first call to leak. Fix this by freeing the existing list before assigning the new one. Fixes: b4247c8317c5 ("nvme: add support for dynamic quirk configuration via module parameter") Reviewed-by: Daniel Wagner Reviewed-by: Christoph Hellwig Signed-off-by: Maurizio Lombardi Signed-off-by: Keith Busch commit 098b6e44cbaa2d526d06af90c862d13fb414a0ec Merge: c6e62d002b7f06 a16f91f80735e6 Author: Linus Torvalds Date: Wed Feb 11 18:27:08 2026 -0800 Merge tag 'devicetree-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT core: - Sync dtc/libfdt with upstream v1.7.2-62-ga26ef6400bd8 - Add a for_each_compatible_node_scoped() loop and convert users in cpufreq, dmaengine, clk, cdx, powerpc and Arm - Simplify of/platform.c with scoped loop helpers - Add fw_devlink tracking for "mmc-pwrseq" - Optimize fw_devlink callback code size for pinctrl-N properties - Replace strcmp_suffix() with strends() DT bindings: - Support building single binding targets - Convert google,goldfish-fb, cznic,turris-mox-rwtm, ti,prm-inst - Add bindings for Freescale AVIC, Realtek RTD1xxx system controllers, Microchip 25AA010A EEPROM, OnSemi FIN3385, IEI WT61P803 PUZZLE, Delta Electronics DPS-800-AB power supply, Infineon IR35221 Digital Multi-phase Controller, Infineon PXE1610 Digital Dual Output 6+1 VR12.5 & VR13 CPU Controller, socionext,uniphier-smpctrl, and xlnx,zynqmp-firmware - Lots of trivial binding fixes to address warnings in DTS files. These are mostly for arm64 platforms which is getting closer to be warning free. Some public shaming has helped. - Fix I2C bus node names in examples - Drop obsolete brcm,vulcan-soc binding - Drop unreferenced binding headers" * tag 'devicetree-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (60 commits) dt-bindings: interrupt-controller: Add compatiblie string fsl,imx(1|25|27|31|35)-avic dt-bindings: soc: imx: add fsl,aips and fsl,emi compatible strings dt-bindings: display: bridge: lt8912b: Drop reset gpio requirement dt-bindings: firmware: fsl,scu: Mark multi-channel MU layouts as deprecated cpufreq: s5pv210: Simplify with scoped for each OF child loop dmaengine: fsl_raid: Simplify with scoped for each OF child loop clk: imx: imx31: Simplify with scoped for each OF child loop clk: imx: imx27: Simplify with scoped for each OF child loop cdx: Use mutex guard to simplify error handling cdx: Simplify with scoped for each OF child loop powerpc/wii: Simplify with scoped for each OF child loop powerpc/fsp2: Simplify with scoped for each OF child loop ARM: exynos: Simplify with scoped for each OF child loop ARM: at91: Simplify with scoped for each OF child loop of: Add for_each_compatible_node_scoped() helper dt-bindings: Fix emails with spaces or missing brackets scripts/dtc: Update to upstream version v1.7.2-62-ga26ef6400bd8 dt-bindings: crypto: inside-secure,safexcel: Mandate only ring IRQs dt-bindings: crypto: inside-secure,safexcel: Add SoC compatibles of: reserved_mem: Fix placement of __free() annotation ... commit c6e62d002b7f0613f02d8707c80f2a7bd66808a0 Merge: 1c2b4a4c2bcb95 ba268514ea14b4 Author: Linus Torvalds Date: Wed Feb 11 17:43:59 2026 -0800 Merge tag 'driver-core-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "Bus: - Ensure bus->match() is consistently called with the device lock held - Improve type safety of bus_find_device_by_acpi_dev() Devtmpfs: - Parse 'devtmpfs.mount=' boot parameter with kstrtoint() instead of simple_strtoul() - Avoid sparse warning by making devtmpfs_context_ops static IOMMU: - Do not register the qcom_smmu_tbu_driver in arm_smmu_device_probe() MAINTAINERS: - Add the new driver-core mailing list (driver-core@lists.linux.dev) to all relevant entries - Add missing tree location for "FIRMWARE LOADER (request_firmware)" - Add driver-model documentation to the "DRIVER CORE" entry - Add missing driver-core maintainers to the "AUXILIARY BUS" entry Misc: - Change return type of attribute_container_register() to void; it has always been infallible - Do not export sysfs_change_owner(), sysfs_file_change_owner() and device_change_owner() - Move devres_for_each_res() from the public devres header to drivers/base/base.h - Do not use a static struct device for the faux bus; allocate it dynamically Revocable: - Patches for the revocable synchronization primitive have been scheduled for v7.0-rc1, but have been reverted as they need some more refinement Rust: - Device: - Support dev_printk on all device types, not just the core Device struct; remove now-redundant .as_ref() calls in dev_* print calls - Devres: - Introduce an internal reference count in Devres to avoid a deadlock condition in case of (indirect) nesting - DMA: - Allow drivers to tune the maximum DMA segment size via dma_set_max_seg_size() - I/O: - Introduce the concept of generic I/O backends to handle different kinds of device shared memory through a common interface. This enables higher-level concepts such as register abstractions, I/O slices, and field projections to be built generically on top. In a first step, introduce the Io, IoCapable, and IoKnownSize trait hierarchy for sharing a common interface supporting offset validation and bound-checking logic between I/O backends. - Refactor MMIO to use the common I/O backend infrastructure - Misc: - Add __rust_helper annotations to C helpers for inlining into Rust code - Use "kernel vertical" style for imports - Replace kernel::c_str! with C string literals - Update ARef imports to use sync::aref - Use pin_init::zeroed() for struct auxiliary_device_id and debugfs file_operations initialization - Use LKMM atomic types in debugfs doc-tests - Various minor comment and documentation fixes - PCI: - Implement PCI configuration space accessors using the common I/O backend infrastructure - Document pci::Bar device endianness assumptions - SoC: - Abstractions for struct soc_device and struct soc_device_attribute - Sample driver for soc::Device" * tag 'driver-core-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (79 commits) rust: devres: fix race condition due to nesting rust: dma: add missing __rust_helper annotations samples: rust: pci: Remove some additional `.as_ref()` for `dev_*` print Revert "revocable: Revocable resource management" Revert "revocable: Add Kunit test cases" Revert "selftests: revocable: Add kselftest cases" driver core: remove device_change_owner() export sysfs: remove exports of sysfs_*change_owner() driver core: disable revocable code from build revocable: Add KUnit test for concurrent access revocable: fix SRCU index corruption by requiring caller-provided storage revocable: Add KUnit test for provider lifetime races revocable: Fix races in revocable_alloc() using RCU driver core: fix inverted "locked" suffix of driver_match_device() rust: io: move MIN_SIZE and io_addr_assert to IoKnownSize rust: pci: re-export ConfigSpace rust: dma: allow drivers to tune max segment size gpu: tyr: remove redundant `.as_ref()` for `dev_*` print rust: auxiliary: use `pin_init::zeroed()` for device ID rust: debugfs: use pin_init::zeroed() for file_operations ... commit 1c2b4a4c2bcb950f182eeeb33d94b565607608cf Merge: 61e629596fabd7 dff645f564c383 Author: Linus Torvalds Date: Wed Feb 11 17:20:38 2026 -0800 Merge tag 'pci-v7.0-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI updates from Bjorn Helgaas: "Enumeration: - Don't try to enable Extended Tags on VFs since that bit is Reserved and causes misleading log messages (Håkon Bugge) - Initialize Endpoint Read Completion Boundary to match Root Port, regardless of ACPI _HPX (Håkon Bugge) - Apply _HPX PCIe Setting Record only to AER configuration, and only when OS owns PCIe hotplug but not AER, to avoid clobbering Extended Tag and Relaxed Ordering settings (Håkon Bugge) Resource management: - Move CardBus code to setup-cardbus.c and only build it when CONFIG_CARDBUS is set (Ilpo Järvinen) - Fix bridge window alignment with optional resources, where additional alignment requirement was previously lost (Ilpo Järvinen) - Stop over-estimating bridge window size since they are now assigned without any gaps between them (Ilpo Järvinen) - Increase resource MAX_IORES_LEVEL to avoid /proc/iomem flattening for nested bridges and endpoints (Ilpo Järvinen) - Add pbus_mem_size_optional() to handle sizes of optional resources (SR-IOV VF BARs, expansion ROMs, bridge windows) (Ilpo Järvinen) - Don't claim disabled bridge windows to avoid spurious claim failures (Ilpo Järvinen) Driver binding: - Fix device reference leak in pcie_port_remove_service() (Uwe Kleine-König) - Move pcie_port_bus_match() and pcie_port_bus_type to PCIe-specific portdrv.c (Uwe Kleine-König) - Convert portdrv to use pcie_port_bus_type.probe() and .remove() callbacks so .probe() and .remove() can eventually be removed from struct device_driver (Uwe Kleine-König) Error handling: - Clear stale errors on reporting agents upon probe so they don't look like recent errors (Lukas Wunner) - Add generic RAS tracepoint for hotplug events (Shuai Xue) - Add RAS tracepoint for link speed changes (Shuai Xue) Power management: - Avoid redundant delay on transition from D3hot to D3cold if the device was already in D3hot (Brian Norris) - Prevent runtime suspend until devices are fully initialized to avoid saving incompletely configured device state (Brian Norris) Power control: - Add power_on/off callbacks with generic signature to pwrseq, tc9563, and slot drivers so they can be used by pwrctrl core (Manivannan Sadhasivam) - Add PCIe M.2 connector support to the slot pwrctrl driver (Manivannan Sadhasivam) - Switch to pwrctrl interfaces to create, destroy, and power on/off devices, calling them from host controller drivers instead of the PCI core (Manivannan Sadhasivam) - Drop qcom .assert_perst() callbacks since this is now done by the controller driver instead of the pwrctrl driver (Manivannan Sadhasivam) Virtualization: - Remove an incorrect unlock in pci_slot_trylock() error handling (Jinhui Guo) - Lock the bridge device for slot reset (Keith Busch) - Enable ACS after IOMMU configuration on OF platforms so ACS is enabled an all devices; previously the first device enumerated (typically a Root Port) didn't have ACS enabled (Manivannan Sadhasivam) - Disable ACS Source Validation for IDT 0x80b5 and 0x8090 switches to work around hardware erratum; previously ACS SV was only temporarily disabled, which worked for enumeration but not after reset (Manivannan Sadhasivam) Peer-to-peer DMA: - Release per-CPU pgmap ref when vm_insert_page() fails to avoid hang when removing the PCI device (Hou Tao) - Remove incorrect p2pmem_alloc_mmap() warning about page refcount (Hou Tao) Endpoint framework: - Add configfs sub-groups synchronously to avoid NULL pointer dereference when racing with removal (Liu Song) - Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy) ASPEED PCIe controller driver: - Add ASPEED Root Complex DT binding and driver (Jacky Chou) Freescale i.MX6 PCIe controller driver: - Add DT binding and driver support for an optional external refclock in addition to the refclock from the internal PLL (Richard Zhu) - Fix CLKREQ# control so host asserts it during enumeration and Endpoints can use it afterwards to exit the L1.2 link state (Richard Zhu) NVIDIA Tegra PCIe controller driver: - Export irq_domain_free_irqs() to allow PCI/MSI drivers that tear down MSI domains to be built as modules (Aaron Kling) - Allow pci-tegra to be built as a module (Aaron Kling) NVIDIA Tegra194 PCIe controller driver: - Relax Kconfig so tegra194 can be built for platforms beyond Tegra194 (Vidya Sagar) Qualcomm PCIe controller driver: - Merge SC8180x DT binding into SM8150 (Krzysztof Kozlowski) - Move SDX55, SDM845, QCS404, IPQ5018, IPQ6018, IPQ8074 Gen3, IPQ8074, IPQ4019, IPQ9574, APQ8064, MSM8996, APQ8084 to dedicated schema (Krzysztof Kozlowski) - Add DT binding and driver support for SA8255p Endpoint being configured by firmware (Mrinmay Sarkar) - Parse PERST# from all PCIe bridge nodes for future platforms that will have PERST# in Switch Downstream Ports as well as in Root Ports (Manivannan Sadhasivam) Renesas RZ/G3S PCIe controller driver: - Use pci_generic_config_write() since the writability provided by the custom wrapper is unnecessary (Claudiu Beznea) SOPHGO PCIe controller driver: - Disable ASPM L0s and L1 on Sophgo 2044 PCIe Root Ports (Inochi Amaoto) Synopsys DesignWare PCIe controller driver: - Extend PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP() to return a pointer to the preceding Capability, to allow removal of Capabilities that are advertised but not fully implemented (Qiang Yu) - Remove MSI and MSI-X Capabilities in platforms that can't support them, so the PCI core automatically falls back to INTx (Qiang Yu) - Add ASPM L1.1 and L1.2 Substates context to debugfs ltssm_status for drivers that support this (Shawn Lin) - Skip PME_Turn_Off broadcast and L2/L3 transition during suspend if link is not up to avoid an unnecessary timeout (Manivannan Sadhasivam) - Revert dw-rockchip, qcom, and DWC core changes that used link-up IRQs to trigger enumeration instead of waiting for link to be up because the PCI core doesn't allocate bus number space for hierarchies that might be attached (Niklas Cassel) - Make endpoint iATU entry for MSI permanent instead of programming it dynamically, which is slow and racy with respect to other concurrent traffic, e.g., eDMA (Koichiro Den) - Use iMSI-RX MSI target address when possible to fix endpoints using 32-bit MSI (Shawn Lin) - Allow DWC host controller driver probe to continue if device is not found or found but inactive; only fail when there's an error with the link (Manivannan Sadhasivam) - For controllers like NXP i.MX6QP and i.MX7D, where LTSSM registers are not accessible after PME_Turn_Off, simply wait 10ms instead of polling for L2/L3 Ready (Richard Zhu) - Use multiple iATU entries to map large bridge windows and DMA ranges when necessary instead of failing (Samuel Holland) - Add EPC dynamic_inbound_mapping feature bit for Endpoint Controllers that can update BAR inbound address translation without requiring EPF driver to clear/reset the BAR first, and advertise it for DWC-based Endpoints (Koichiro Den) - Add EPC subrange_mapping feature bit for Endpoint Controllers that can map multiple independent inbound regions in a single BAR, implement subrange mapping, advertise it for DWC-based Endpoints, and add Endpoint selftests for it (Koichiro Den) - Make resizable BARs work for Endpoint multi-PF configurations; previously it only worked for PF 0 (Aksh Garg) - Fix Endpoint non-PF 0 support for BAR configuration, ATU mappings, and Address Match Mode (Aksh Garg) - Set up iATU when ECAM is enabled; previously IO and MEM outbound windows weren't programmed, and ECAM-related iATU entries weren't restored after suspend/resume, so config accesses failed (Krishna Chaitanya Chundru) Miscellaneous: - Use system_percpu_wq and WQ_PERCPU to explicitly request per-CPU work so WQ_UNBOUND can eventually be removed (Marco Crivellari)" * tag 'pci-v7.0-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (176 commits) PCI/bwctrl: Disable BW controller on Intel P45 using a quirk PCI: Disable ACS SV for IDT 0x8090 switch PCI: Disable ACS SV for IDT 0x80b5 switch PCI: Cache ACS Capabilities register PCI: Enable ACS after configuring IOMMU for OF platforms PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] PCI: Add ACS quirk for Qualcomm Hamoa & Glymur PCI: Use device_lock_assert() to verify device lock is held PCI: Use lockdep_assert_held(pci_bus_sem) to verify lock is held PCI: Fix pci_slot_lock () device locking PCI: Fix pci_slot_trylock() error handling PCI: Mark Nvidia GB10 to avoid bus reset PCI: Mark ASM1164 SATA controller to avoid bus reset PCI: host-generic: Avoid reporting incorrect 'missing reg property' error PCI/PME: Replace RMW of Root Status register with direct write PCI/AER: Clear stale errors on reporting agents upon probe PCI: Don't claim disabled bridge windows PCI: rzg3s-host: Fix device node reference leak in rzg3s_pcie_host_parse_port() PCI: dwc: Fix missing iATU setup when ECAM is enabled PCI: dwc: Clean up iATU index usage in dw_pcie_iatu_setup() ... commit 61e629596fabd7f60cc3748a603703c5d9b58428 Merge: 1e0ea4dff0f46a 218b16992a37ea Author: Linus Torvalds Date: Wed Feb 11 17:04:21 2026 -0800 Merge tag 'for-7.0/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - dm-verity: - various optimizations and fixes related to forward error correction - add a .dm-verity keyring - dm-integrity: fix bugs with growing a device in bitmap mode - dm-mpath: - fix leaking fake timeout requests - fix UAF bug caused by stale rq->bio - fix minor bugs in device creation - dm-core: - fix a bug related to blkg association - avoid unnecessary blk-crypto work on invalid keys - dm-bufio: - dm-bufio cleanup and optimization (reducing hash table lookups) - various other minor fixes and cleanups * tag 'for-7.0/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (35 commits) dm mpath: make pg_init_delay_msecs settable Revert "dm: fix a race condition in retrieve_deps" dm mpath: Add missing dm_put_device when failing to get scsi dh name dm vdo encodings: clean up header and version functions dm: use bio_clone_blkg_association dm: fix excessive blk-crypto operations for invalid keys dm-verity: fix section mismatch error dm-unstripe: fix mapping bug when there are multiple targets in a table dm-integrity: fix recalculation in bitmap mode dm-bufio: avoid redundant buffer_tree lookups dm-bufio: merge cache_put() into cache_put_and_wake() selftests: add dm-verity keyring selftests dm-verity: add dm-verity keyring dm: clear cloned request bio pointer when last clone bio completes dm-verity: fix up various workqueue-related comments dm-verity: switch to bio_advance_iter_single() dm-verity: consolidate the BH and normal work structs dm: add WQ_PERCPU to alloc_workqueue users dm-integrity: fix a typo in the code for write/discard race dm: use READ_ONCE in dm_blk_report_zones ... commit 1e0ea4dff0f46a3575b6882941dc7331c232d72c Merge: c22e26bd0906e9 ad095636604604 Author: Linus Torvalds Date: Wed Feb 11 16:36:08 2026 -0800 Merge tag 'iommu-updates-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: "Core changes: - Rust bindings for IO-pgtable code - IOMMU page allocation debugging support - Disable ATS during PCI resets Intel VT-d changes: - Skip dev-iotlb flush for inaccessible PCIe device - Flush cache for PASID table before using it - Use right invalidation method for SVA and NESTED domains - Ensure atomicity in context and PASID entry updates AMD-Vi changes: - Support for nested translations - Other minor improvements ARM-SMMU-v2 changes: - Configure SoC-specific prefetcher settings for Qualcomm's "MDSS" ARM-SMMU-v3 changes: - Improve CMDQ locking fairness for pathetically small queue sizes - Remove tracking of the IAS as this is only relevant for AArch32 and was causing C_BAD_STE errors - Add device-tree support for NVIDIA's CMDQV extension - Allow some hitless transitions for the 'MEV' and 'EATS' STE fields - Don't disable ATS for nested S1-bypass nested domains - Additions to the kunit selftests" * tag 'iommu-updates-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (54 commits) iommupt: Always add IOVA range to iotlb_gather in gather_range_pages() iommu/amd: serialize sequence allocation under concurrent TLB invalidations iommu/amd: Fix type of type parameter to amd_iommufd_hw_info() iommu/arm-smmu-v3: Do not set disable_ats unless vSTE is Translate iommu/arm-smmu-v3-test: Add nested s1bypass/s1dssbypass coverage iommu/arm-smmu-v3: Mark EATS_TRANS safe when computing the update sequence iommu/arm-smmu-v3: Mark STE MEV safe when computing the update sequence iommu/arm-smmu-v3: Add update_safe bits to fix STE update sequence iommu/arm-smmu-v3: Add device-tree support for CMDQV driver iommu/tegra241-cmdqv: Decouple driver from ACPI iommu/arm-smmu-qcom: Restore ACTLR settings for MDSS on sa8775p iommu/vt-d: Fix race condition during PASID entry replacement iommu/vt-d: Clear Present bit before tearing down context entry iommu/vt-d: Clear Present bit before tearing down PASID entry iommu/vt-d: Flush piotlb for SVM and Nested domain iommu/vt-d: Flush cache for PASID table before using it iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode rust: iommu: fix `srctree` link warning rust: iommu: fix Rust formatting ... commit c22e26bd0906e9c8325462993f01adb16b8ea2c0 Merge: d0e91e401e3195 e265b330b93e3a Author: Linus Torvalds Date: Wed Feb 11 15:57:08 2026 -0800 Merge tag 'landlock-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock updates from Mickaël Salaün: - extend Landlock to enforce restrictions on a whole process, similarly to the seccomp's TSYNC flag - refactor data structures to simplify code and improve performance - add documentation to cover missing parts * tag 'landlock-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: mailmap: Add entry for Mickaël Salaün landlock: Transpose the layer masks data structure landlock: Add access_mask_subset() helper selftests/landlock: Add filesystem access benchmark landlock: Document audit blocker field format landlock: Add errata documentation section landlock: Add backwards compatibility for restrict flags landlock: Refactor TCP socket type check landlock: Minor reword of docs for TCP access rights landlock: Document LANDLOCK_RESTRICT_SELF_TSYNC selftests/landlock: Add LANDLOCK_RESTRICT_SELF_TSYNC tests landlock: Multithreading support for landlock_restrict_self() commit d0e91e401e31959154b6518c29d130b1973e3785 Merge: 146fa666d89f23 0496fc9cdc384f Author: Linus Torvalds Date: Wed Feb 11 15:53:00 2026 -0800 Merge tag 'integrity-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Just two bug fixes: IMA's detecting scripts (bprm_creds_for_exec), and calculating the EVM HMAC" * tag 'integrity-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec() commit 146fa666d89f233b87f1cdc7b9bce34c61b45cbd Merge: db9571a66156bf 33d589ed60ae43 Author: Linus Torvalds Date: Wed Feb 11 15:47:37 2026 -0800 Merge tag 'Smack-for-7.0' of https://github.com/cschaufler/smack-next Pull smack updates from Casey Schaufler: "Two improvements to the code for setting the CIPSO Domain Of Interpretation (DOI), a seldom used feature, and a formatting change" * tag 'Smack-for-7.0' of https://github.com/cschaufler/smack-next: smack: /smack/doi: accept previously used values smack: /smack/doi must be > 0 security: smack: fix indentation in smack_access.c commit db9571a66156bfbc0273e66e5c77923869bda547 Merge: 148f95f75c5139 9abbecf408cba0 Author: Linus Torvalds Date: Wed Feb 11 14:36:47 2026 -0800 Merge tag 'printk-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Check all mandatory callbacks when registering nbcon consoles - Fix some compiler warnings * tag 'printk-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: vsnprintf: drop __printf() attributes on binary printing functions printf: convert test_hashed into macro printk: nbcon: Check for device_{lock,unlock} callbacks commit a6bded921ed35f21b3f6bd8e629bf488499ca442 Author: Jens Axboe Date: Wed Feb 11 15:12:03 2026 -0700 io_uring/filetable: clamp alloc_hint to the configured alloc range Explicit fixed file install/remove operations on slots outside the configured alloc range can corrupt alloc_hint via io_file_bitmap_set() and io_file_bitmap_clear(), which unconditionally update alloc_hint to the bit position. This causes subsequent auto-allocations to fall outside the configured range. For example, if the alloc range is [10, 20) and a file is removed at slot 2, alloc_hint gets set to 2. The next auto-alloc then starts searching from slot 2, potentially returning a slot below the range. Fix this by clamping alloc_hint to [file_alloc_start, file_alloc_end) at the top of io_file_bitmap_get() before starting the search. Cc: stable@vger.kernel.org Fixes: 6e73dffbb93c ("io_uring: let to set a range for file slot allocation") Signed-off-by: Jens Axboe commit 148f95f75c513936d466bcc7e6bf73298da2212b Merge: 41f1a08645abb5 815c8e35511d0b Author: Linus Torvalds Date: Wed Feb 11 14:12:50 2026 -0800 Merge tag 'slab-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - The percpu sheaves caching layer was introduced as opt-in in 6.18 and now we enable it for all caches and remove the previous cpu (partial) slab caching mechanism. Besides the lower locking overhead and much more likely fastpath when freeing, this removes the rather complicated code related to the cpu slab lockless fastpaths (using this_cpu_try_cmpxchg128/64) and all its complications for PREEMPT_RT or kmalloc_nolock(). The lockless slab freelist+counters update operation using try_cmpxchg128/64 remains and is crucial for freeing remote NUMA objects, and to allow flushing objects from sheaves to slabs mostly without the node list_lock (Vlastimil Babka) - Eliminate slabobj_ext metadata overhead when possible. Instead of using kmalloc() to allocate the array for memcg and/or allocation profiling tag pointers, use leftover space in a slab or per-object padding due to alignment (Harry Yoo) - Various followup improvements to the above (Hao Li) * tag 'slab-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: (39 commits) slub: let need_slab_obj_exts() return false if SLAB_NO_OBJ_EXT is set mm/slab: only allow SLAB_OBJ_EXT_IN_OBJ for unmergeable caches mm/slab: place slabobj_ext metadata in unused space within s->size mm/slab: move [__]ksize and slab_ksize() to mm/slub.c mm/slab: save memory by allocating slabobj_ext array from leftover mm/memcontrol,alloc_tag: handle slabobj_ext access under KASAN poison mm/slab: use stride to access slabobj_ext mm/slab: abstract slabobj_ext access via new slab_obj_ext() helper ext4: specify the free pointer offset for ext4_inode_cache mm/slab: allow specifying free pointer offset when using constructor mm/slab: use unsigned long for orig_size to ensure proper metadata align slub: clarify object field layout comments mm/slab: avoid allocating slabobj_ext array from its own slab slub: avoid list_lock contention from __refill_objects_any() mm/slub: cleanup and repurpose some stat items mm/slub: remove DEACTIVATE_TO_* stat items slab: remove frozen slab checks from __slab_free() slab: update overview comments slab: refill sheaves from all nodes slab: remove unused PREEMPT_RT specific macros ... commit 41f1a08645abb5ef7d2a3ed8835c747334878774 Merge: 38ef046544aad8 d8ad80a85b9664 Author: Linus Torvalds Date: Wed Feb 11 13:40:35 2026 -0800 Merge tag 'kbuild-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild/Kconfig updates from Nathan Chancellor: "Kbuild: - Drop '*_probe' pattern from modpost section check allowlist, which hid legitimate warnings (Johan Hovold) - Disable -Wtype-limits altogether, instead of enabling at W=2 (Vincent Mailhol) - Improve UAPI testing to skip testing headers that require a libc when CONFIG_CC_CAN_LINK is not set, opening up testing of headers with no libc dependencies to more environments (Thomas Weißschuh) - Update gendwarfksyms documentation with required dependencies (Jihan LIN) - Reject invalid LLVM= values to avoid unintentionally falling back to system toolchain (Thomas Weißschuh) - Add a script to help run the kernel build process in a container for consistent environments and testing (Guillaume Tucker) - Simplify kallsyms by getting rid of the relative base (Ard Biesheuvel) - Performance and usability improvements to scripts/make_fit.py (Simon Glass) - Minor various clean ups and fixes Kconfig: - Move XPM icons to individual files, clearing up GTK deprecation warnings (Rostislav Krasny) - Support depends on FOO if BAR as syntactic sugar for depends on FOO || !BAR (Nicolas Pitre, Graham Roff) - Refactor merge_config.sh to use awk over shell/sed/grep, dramatically speeding up processing large number of config fragments (Anders Roxell, Mikko Rapeli)" * tag 'kbuild-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (39 commits) kbuild: remove dependency of run-command on config scripts/make_fit: Compress dtbs in parallel scripts/make_fit: Support a few more parallel compressors kbuild: Support a FIT_EXTRA_ARGS environment variable scripts/make_fit: Move dtb processing into a function scripts/make_fit: Support an initial ramdisk scripts/make_fit: Speed up operation rust: kconfig: Don't require RUST_IS_AVAILABLE for rustc-option MAINTAINERS: Add scripts/install.sh into Kbuild entry modpost: Amend ppc64 save/restfpr symnames for -Os build MIPS: tools: relocs: Ship a definition of R_MIPS_PC32 streamline_config.pl: remove superfluous exclamation mark kbuild: dummy-tools: Add python3 scripts: kconfig: merge_config.sh: warn on duplicate input files scripts: kconfig: merge_config.sh: use awk in checks too scripts: kconfig: merge_config.sh: refactor from shell/sed/grep to awk kallsyms: Get rid of kallsyms relative base mips: Add support for PC32 relocations in vmlinux Documentation: dev-tools: add container.rst page scripts: add tool to run containerized builds ... commit 38ef046544aad88de3b520f38fa3eed2c44dc0a8 Merge: ff661eeee26038 4544e9c4ec9a59 Author: Linus Torvalds Date: Wed Feb 11 13:35:24 2026 -0800 Merge tag 'sched_ext-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext updates from Tejun Heo: - Move C example schedulers back from the external scx repo to tools/sched_ext as the authoritative source. scx_userland and scx_pair are returning while scx_sdt (BPF arena-based task data management) is new. These schedulers will be dropped from the external repo. - Improve error reporting by adding scx_bpf_error() calls when DSQ creation fails across all in-tree schedulers - Avoid redundant irq_work_queue() calls in destroy_dsq() by only queueing when llist_add() indicates an empty list - Fix flaky init_enable_count selftest by properly synchronizing pre-forked children using a pipe instead of sleep() * tag 'sched_ext-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: selftests/sched_ext: Fix init_enable_count flakiness tools/sched_ext: Fix data header access during free in scx_sdt tools/sched_ext: Add error logging for dsq creation failures in remaining schedulers tools/sched_ext: add arena based scheduler tools/sched_ext: add scx_pair scheduler tools/sched_ext: add scx_userland scheduler sched_ext: Add error logging for dsq creation failures sched_ext: Avoid multiple irq_work_queue() calls in destroy_dsq() commit ff661eeee26038f15ed9dd33c91809632e11d9eb Merge: 9bdc64892dcce7 8b1f3c54f930c3 Author: Linus Torvalds Date: Wed Feb 11 13:20:50 2026 -0800 Merge tag 'cgroup-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - cpuset changes: - Continue separating v1 and v2 implementations by moving more v1-specific logic into cpuset-v1.c - Improve partition handling. Sibling partitions are no longer invalidated on cpuset.cpus conflict, cpuset.cpus changes no longer fail in v2, and effective_xcpus computation is made consistent - Fix partition effective CPUs overlap that caused a warning on cpuset removal when sibling partitions shared CPUs - Increase the maximum cgroup subsystem count from 16 to 32 to accommodate future subsystem additions - Misc cleanups and selftest improvements including switching to css_is_online() helper, removing dead code and stale documentation references, using lockdep_assert_cpuset_lock_held() consistently, and adding polling helpers for asynchronously updated cgroup statistics * tag 'cgroup-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (21 commits) cpuset: fix overlap of partition effective CPUs cgroup: increase maximum subsystem count from 16 to 32 cgroup: Remove stale cpu.rt.max reference from documentation cpuset: replace direct lockdep_assert_held() with lockdep_assert_cpuset_lock_held() cgroup/cpuset: Move the v1 empty cpus/mems check to cpuset1_validate_change() cgroup/cpuset: Don't invalidate sibling partitions on cpuset.cpus conflict cgroup/cpuset: Don't fail cpuset.cpus change in v2 cgroup/cpuset: Consistently compute effective_xcpus in update_cpumasks_hier() cgroup/cpuset: Streamline rm_siblings_excl_cpus() cpuset: remove dead code in cpuset-v1.c cpuset: remove v1-specific code from generate_sched_domains cpuset: separate generate_sched_domains for v1 and v2 cpuset: move update_domain_attr_tree to cpuset_v1.c cpuset: add cpuset1_init helper for v1 initialization cpuset: add cpuset1_online_css helper for v1-specific operations cpuset: add lockdep_assert_cpuset_lock_held helper cpuset: Remove unnecessary checks in rebuild_sched_domains_locked cgroup: switch to css_is_online() helper selftests: cgroup: Replace sleep with cg_read_key_long_poll() for waiting on nr_dying_descendants selftests: cgroup: make test_memcg_sock robust against delayed sock stats ... commit 9bdc64892dcce732d55b2c07d80b36a6c3e1b5f4 Merge: 1e83ccd5921a61 9cb8b0f2895607 Author: Linus Torvalds Date: Wed Feb 11 13:13:32 2026 -0800 Merge tag 'wq-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - Rework the rescuer to process work items one-by-one instead of slurping all pending work items in a single pass. As there is only one rescuer per workqueue, a single long-blocking work item could cause high latency for all tasks queued behind it, even after memory pressure is relieved and regular kworkers become available to service them. - Add CONFIG_BOOTPARAM_WQ_STALL_PANIC build-time option and workqueue.panic_on_stall_time parameter for time-based stall panic, giving systems more control over workqueue stall handling. - Replace BUG_ON() with panic() in the stall panic path for clearer intent and more informative output. * tag 'wq-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: replace BUG_ON with panic in panic_on_wq_watchdog workqueue: add time-based panic for stalls workqueue: add CONFIG_BOOTPARAM_WQ_STALL_PANIC option workqueue: Process extra works in rescuer on memory pressure workqueue: Process rescuer work items one-by-one using a cursor workqueue: Make send_mayday() take a PWQ argument directly commit 1e83ccd5921a610ef409a7d4e56db27822b4ea39 Author: Thomas Gleixner Date: Tue Feb 10 17:20:51 2026 +0100 sched/mmcid: Don't assume CID is CPU owned on mode switch Shinichiro reported a KASAN UAF, which is actually an out of bounds access in the MMCID management code. CPU0 CPU1 T1 runs in userspace T0: fork(T4) -> Switch to per CPU CID mode fixup() set MM_CID_TRANSIT on T1/CPU1 T4 exit() T3 exit() T2 exit() T1 exit() switch to per task mode ---> Out of bounds access. As T1 has not scheduled after T0 set the TRANSIT bit, it exits with the TRANSIT bit set. sched_mm_cid_remove_user() clears the TRANSIT bit in the task and drops the CID, but it does not touch the per CPU storage. That's functionally correct because a CID is only owned by the CPU when the ONCPU bit is set, which is mutually exclusive with the TRANSIT flag. Now sched_mm_cid_exit() assumes that the CID is CPU owned because the prior mode was per CPU. It invokes mm_drop_cid_on_cpu() which clears the not set ONCPU bit and then invokes clear_bit() with an insanely large bit number because TRANSIT is set (bit 29). Prevent that by actually validating that the CID is CPU owned in mm_drop_cid_on_cpu(). Fixes: 007d84287c74 ("sched/mmcid: Drop per CPU CID immediately when switching to per task mode") Reported-by: Shinichiro Kawasaki Signed-off-by: Thomas Gleixner Tested-by: Shinichiro Kawasaki Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/aYsZrixn9b6s_2zL@shinmob Reviewed-by: Mathieu Desnoyers Signed-off-by: Linus Torvalds commit 939faf71cf7ca9ab3d1bd2912ac0e203d4d7156a Merge: b7ef56a07672e0 2f5db9b4002470 Author: Linus Torvalds Date: Wed Feb 11 12:55:44 2026 -0800 Merge tag 'drm-next-2026-02-11' of https://gitlab.freedesktop.org/drm/kernel Pull drm updates from Dave Airlie: "Highlights: - amdgpu support for lots of new IP blocks which means newer GPUs - xe has a lot of SR-IOV and SVM improvements - lots of intel display refactoring across i915/xe - msm has more support for gen8 platforms - Given up on kgdb/kms integration, it's too hard on modern hw core: - drop kgdb support - replace system workqueue with percpu - account for property blobs in memcg - MAINTAINERS updates for xe + buddy rust: - Fix documentation for Registration constructors - Use pin_init::zeroed() for fops initialization - Annotate DRM helpers with __rust_helper - Improve safety documentation for gem::Object::new() - Update AlwaysRefCounted imports - mm: Prevent integer overflow in page_align() atomic: - add drm_device pointer to drm_private_obj - introduce gamma/degamma LUT size check buddy: - fix free_trees memory leak - prevent BUG_ON bridge: - introduce drm_bridge_unplug/enter/exit - add connector argument to .hpd_notify - lots of recounting conversions - convert rockchip inno hdmi to bridge - lontium-lt9611uxc: switch to HDMI audio helpers - dw-hdmi-qp: add support for HPD-less setups - Algoltek AG6311 support panels: - edp: CSW MNE007QB3-1, AUO B140HAN06.4, AUO B140QAX01.H - st75751: add SPI support - Sitronix ST7920, Samsung LTL106HL02 - LG LH546WF1-ED01, HannStar HSD156J - BOE NV130WUM-T08 - Innolux G150XGE-L05 - Anbernic RG-DS dma-buf: - improve sg_table debugging - add tracepoints - call clear_page instead of memset - start to introduce cgroup memory accounting in heaps - remove sysfs stats dma-fence: - add new helpers dp: - mst: avoid oob access with vcpi=0 hdmi: - limit infoframes exposure to userspace gem: - reduce page table overhead with THP - fix leak in drm_gem_get_unmapped_area gpuvm: - API sanitation for rust bindings sched: - introduce new helpers panic: - report invalid panic modes - add kunit tests i915/xe display: - Expose sharpness only if num_scalers is >= 2 - Add initial Xe3P_LPD for NVL - BMG FBC support - Add MTL+ platforms to support dpll framework _ fix DIMM_S DRM decoding on ICL - Return to using AUX interrupts - PSR/Panel replay refactoring - use consolidation HDMI tables - Xe3_LPD CD2X dividier changes xe: - vfio: add vfio_pci for intel GPU - multi queue support - dynamic pagemaps and multi-device SVM - expose temp attribs in hwmon - NO_COMPRESSION bo flag - expose MERT OA unit - sysfs survivability refactor - SRIOV PF: add MERT support - enable SR-IOV VF migration - Enable I2C/NVM on Crescent Island - Xe3p page reclaimation support - introduce SRIOV scheduler groups - add SoC remappt support in system controller - insert compiler barriers in GuC code - define NVL GuC firmware - handle GT resume failure - fix drm scheduler layering violations - enable GSC loading and PXP for PTL - disable GuC Power DCC strategy on PTL - unregister drm device on probe error i915: - move to kernel standard fault injection - bump recommended GuC version for DG2 and MTL amdgpu: - SMUIO 15.x, PSP 15.x support - IH 6.1.1/7.1 support - MMHUB 3.4/4.2 support - GC 11.5.4/12.1 support - SDMA 6.1.4/7.1/7.11.4 support - JPEG 5.3 support - UserQ updates - GC 9 gfx queue reset support - TTM memory ops parallelization - convert legacy logging to new helpers - DC analog fixes amdkfd: - GC 11.5.4/12.1 suppport - SDMA 6.1.4/7.1 support - per context support - increase kfd process hash table - Reserved SDMA rework radeon: - convert legacy logging to new helpers - use devm for i2c adapters msm: - GPU - Document a612/RGMU dt bindings - UBWC 6.0 support (for A840 / Kaanapali) - a225 support - DPU: - Switch to use virtual planes by default - Fix DSI CMD panels on DPU 3.x - Rewrite format handling to remove intermediate representation - Fix watchdog on DPU 8.x+ - Fix TE / Vsync source setting on DPU 8.x+ - Add 3D_Mux on SC7280 - Kaanapali platform support - Fix UBWC register programming - Make RM reserve DSPP-enabled mixers for CRTCs with LMs - Gamma correction support - DP: - Enable support for eDP 1.4+ link rate tables - Fix MDSS1 DP indices on SA8775P, making them to work - Fix msm_dp_ctrl_config_msa() to work with LLVM 20 - DSI: - Document QCS8300 as compatible with SA8775P - Kaanapali platform support - DSI PHY: - switch to divider_determine_rate() - MDP5: - Drop support for MSM8998, SDM660 and SDM630 (switch over to DPU) - MDSS: - Kaanapali platform support - Fixed UBWC register programming nova-core: - Prepare for Turing support. This includes parsing and handling Turing-specific firmware headers and sections as well as a Turing Falcon HAL implementation - Get rid of the Result> anti-pattern - Relocate initializer-specific code into the appropriate initializer - Use CStr::from_bytes_until_nul() to remove custom helpers - Improve handling of unexpected firmware values - Clean up redundant debug prints - Replace c_str!() with native Rust C-string literals - Update nova-core task list nova: - Align GEM object size to system page size tyr: - Use generated uAPI bindings for GpuInfo - Replace manual sleeps with read_poll_timeout() - Replace c_str!() with native Rust C-string literals - Suppress warnings for unread fields - Fix incorrect register name in print statement nouveau: - fix big page table support races in PTE management - improve reclocking on tegra 186+ amdxdna: - fix suspend race conditions - improve handling of zero tail pointers - fix cu_idx overwritten during command setup - enable hardware context priority - remove NPU2 support - update message buffer allocation requirements - update firmware version check ast: - support imported cursor buffers - big endian fixes etnaviv: - add PPU flop reset support imagination: - add AM62P support - introduce hw version checks ivpu: - implement warm boot flow panfrost: - add bo sync ioctl - add GPU_PM_RT support for RZ/G3E SoC panthor: - add bo sync ioctl - enable timestamp propagation - scheduler robustness improvements - VM termination fixes - huge page support rockchip: - RK3368 HDMI Support - get rid of atomic_check fixups - RK3506 support - RK3576/RK3588 improved HPD handling rz-du: - RZ/V2H(P) MIPI-DSI Support v3d: - fix DMA segment size - convert to new logging helpers mediatek: - move DP training to hotplug thread - convert logging to new helpers - add support for HS speed DSI - Genio 510/700/1200-EVK, Radxa NIO-12L HDMI support atmel-hlcdc: - switch to drmm resource - support nomodeset - use newer helpers hisilicon: - fix various DP bugs renesas: - fix kernel panic on reboot exynos: - fix vidi_connection_ioctl using wrong device - fix vidi_connection deref user ptr - fix concurrency regression with vidi_context vkms: - add configfs support for display configuration * tag 'drm-next-2026-02-11' of https://gitlab.freedesktop.org/drm/kernel: (1610 commits) drm/xe/pm: Disable D3Cold for BMG only on specific platforms drm/xe: Fix kerneldoc for xe_tlb_inval_job_alloc_dep drm/xe: Fix kerneldoc for xe_gt_tlb_inval_init_early drm/xe: Fix kerneldoc for xe_migrate_exec_queue drm/xe/query: Fix topology query pointer advance drm/xe/guc: Fix kernel-doc warning in GuC scheduler ABI header drm/xe/guc: Fix CFI violation in debugfs access. accel/amdxdna: Move RPM resume into job run function accel/amdxdna: Fix incorrect DPM level after suspend/resume nouveau/vmm: start tracking if the LPT PTE is valid. (v6) nouveau/vmm: increase size of vmm pte tracker struct to u32 (v2) nouveau/vmm: rewrite pte tracker using a struct and bitfields. accel/amdxdna: Fix incorrect error code returned for failed chain command accel/amdxdna: Remove hardware context status drm/bridge: imx8qxp-pixel-combiner: Fix bailout for imx8qxp_pc_bridge_probe() drm/panel: ilitek-ili9882t: Remove duplicate initializers in tianma_il79900a_dsc drm/i915/display: fix the pixel normalization handling for xe3p_lpd drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free drm/exynos: vidi: fix to avoid directly dereferencing user pointer drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() ... commit e91f8c5305b92b63c8bac315f95c535d5c1e8fec Author: Rafael J. Wysocki Date: Sun Feb 8 15:13:26 2026 +0100 ACPI: button: Call device_init_wakeup() earlier during probe Calling device_init_wakeup() after installing a notify handler in which wakeup events are signaled may cause a wakeup event to be missed if the device is probed right before a system suspend. To avoid this, move the device_init_wakeup() call in acpi_button_probe() before the notify handler installation and add a corresponding cleanup to the error path. Also carry out wakeup cleanup for the button in acpi_button_remove() because after that point the notify handler will not run for it and wakeup events coming from it will not be signaled. Fixes: 0d51157dfaac ("ACPI: button: Eliminate the driver notify callback") Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12854922.O9o76ZdvQC@rafael.j.wysocki commit abbdf22e0a8f23207cedf9065512620971794ff5 Author: Rafael J. Wysocki Date: Fri Feb 6 22:28:12 2026 +0100 ACPI: battery: Drop redundant check from acpi_battery_notify() The battery pointer check against NULL in acpi_battery_notify() is redundant because the value of that pointer is the one passed to acpi_dev_install_notify_handler() in acpi_battery_probe() as the last argument which is not NULL. Drop the redundant check. No intentional functional impact. Closes: https://lore.kernel.org/linux-acpi/aYXvS1h3Bxf_5sCj@stanley.mountain/ Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5981321.DvuYhMxLoT@rafael.j.wysocki commit b7ef56a07672e0d7ebe71c9d9b45f959f0c2f8e8 Merge: d061251387903e c824345288d11e Author: Linus Torvalds Date: Wed Feb 11 12:20:25 2026 -0800 Merge tag 'media/v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - Add support for GMSL1 and GMSL‑coax modules (PCI mgb4) - Add driver for TI VIP - AV1 – first kernel support (pixel‑format, decoder, transcoder) - Three new camera‑sensor drivers (os05b10, s5k3m5, s5kjn1) - Synopsys CSI‑2 receiver driver - Verisilicon & rkvdec – major fixes and enhancements - IPU6 (and 7) fixes and preparation for metadata - omap3isp: v4l2-compliance updates - Fix DVB streaming, drop wait_prepare/finish (dvb/vb2) * tag 'media/v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (307 commits) media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer media: uvcvideo: Fix allocation for small frame sizes media: uvcvideo: Return queued buffers on start_streaming() failure media: uvcvideo: Create an ID namespace for streaming output terminals media: rkvdec: Add HEVC support for the VDPU383 variant media: rkvdec: Add HEVC support for the VDPU381 variant media: rkvdec: Add H264 support for the VDPU383 variant media: rkvdec: Add H264 support for the VDPU381 variant media: rkvdec: Disable multicore support media: rkvdec: Enable all clocks without naming them media: rkvdec: Support per-variant interrupt handler media: rkvdec: Add RCB and SRAM support media: rkvdec: Add variant specific coded formats list media: rkvdec: Move hevc functions to common file media: rkvdec: Move h264 functions to common file media: rkvdec: Use structs to represent the HW RPS media: rkvdec: Move cabac tables to their own source file media: rkvdec: Switch to using structs instead of writel media: visl: Add HEVC short and long term RPS sets media: v4l2-ctrls: Add hevc_ext_sps_[ls]t_rps controls ... commit bd9635c4d6728a9f58f6545f1c8a0a5335aeaa30 Author: Wang Jiayue Date: Fri Feb 6 17:23:17 2026 +0800 PM: sleep: wakeirq: Update outdated documentation comments The comments claiming that dev_pm_*wake_irq*() helpers must be called with dev->power.lock held and only from rpm_suspend/resume paths are not accurate any mote, since pm_runtime_force_suspend/resume() call them locklessly. Update the comments to match the code. Reported-by: Gui-Dong Han Closes: https://lore.kernel.org/all/CAJZ5v0jN9fU9NdWqc-+F5hiSEP4JkR=_qcdGzzHtk1i5tvCDbQ@mail.gmail.com/ Fixes: c46a0d5ae4f9 ("PM: runtime: Extend support for wakeirq for force_suspend|resume") Signed-off-by: Wang Jiayue [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260206092317.148885-1-akaieurus@gmail.com Signed-off-by: Rafael J. Wysocki commit c900e33e30e9d32fe8cfc89202ee339f9a66aabc Author: Artem Bityutskiy Date: Thu Feb 5 12:53:54 2026 +0000 Documentation: PM: Document intel_idle.table command line option Add the 'intel_idle.table' command line option description to the intel_idle document in admin-guide. Signed-off-by: Artem Bityutskiy [ rjw: Subject adjustment, changelog edits] Link: https://patch.msgid.link/20260205125354.632891-1-artem.bityutskiy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 525e0064f3d81764277036036932e873608a47af Author: Kuppuswamy Sathyanarayanan Date: Mon Feb 9 15:43:10 2026 -0800 powercap: intel_rapl: Expose all package CPUs in PMU cpumask Currently, the RAPL PMU cpumask only includes one CPU per package (typically the lead_cpu) for both MSR and TPMI interfaces. This forces tools to pin their operations to that specific CPU, even though package-scoped registers are readable from any CPU within the package. Change the cpumask to include all online CPUs in each package. This allows tools like perf and turbostat to read RAPL events from any CPU in the package without requiring special handling to find and use the designated lead_cpu. The change refactors get_pmu_cpu() into set_pmu_cpumask() which populates the cpumask with all CPUs belonging to each RAPL package instead of returning a single CPU. This improves flexibility for userspace tools while maintaining correctness since package-scoped RAPL MSRs are architecturally accessible from any CPU in the package. Signed-off-by: Kuppuswamy Sathyanarayanan Tested-by: Furquim Ulisses Reviewed-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260209234310.1440722-3-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 7537bae8b6eb635583e0e6260f61d13ddbd52087 Author: Kuppuswamy Sathyanarayanan Date: Mon Feb 9 15:43:09 2026 -0800 powercap: intel_rapl: Remove incorrect CPU check in PMU context The RAPL MSR read path incorrectly validates CPU context when called from the PMU subsystem: if (atomic) { if (unlikely(smp_processor_id() != cpu)) return -EIO; rdmsrq(ra->reg.msr, ra->value); } This check fails for package-scoped MSRs like RAPL energy counters, which are readable from any CPU within the package. The perf tool avoids hitting this check by validating against /sys/bus/event_source/devices/power/cpumask before opening events. However, turbostat does not perform this validation and may attempt reads from non-lead CPUs, causing the check to fail and return zero power values. Since package-scoped MSRs are architecturally accessible from any CPU in the package, remove the CPU matching check. Also rename 'atomic' to 'pmu_ctx' to clarify this indicates PMU context where rdmsrq() can be used directly instead of rdmsrl_safe_on_cpu(). Fixes: 748d6ba43afd ("powercap: intel_rapl: Enable MSR-based RAPL PMU support") Signed-off-by: Kuppuswamy Sathyanarayanan Tested-by: Furquim Ulisses Reviewed-by: Srinivas Pandruvada Link: https://patch.msgid.link/20260209234310.1440722-2-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 15176b818e048ccf6ef4b96db34eda7b7e98938a Author: Kaushlendra Kumar Date: Wed Feb 11 08:23:15 2026 +0000 thermal: int340x: Fix sysfs group leak on DLVR registration failure When DLVR sysfs group creation fails in proc_thermal_rfim_add(), the function returns immediately without cleaning up the FIVR group that may have been created earlier. Add proper error unwinding to remove the FIVR group before returning failure. Signed-off-by: Kaushlendra Kumar Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com Signed-off-by: Rafael J. Wysocki commit d061251387903e8502843ac983553f0b2e098ef8 Merge: 0d6dd4738dbcc3 dd03dd60e8cdd5 Author: Linus Torvalds Date: Wed Feb 11 11:43:00 2026 -0800 Merge tag 'sound-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "It's been relatively calm for a new era; majority of changes are for ASoC, mostly device-specific changes, while there are a bit of cleanups in core stuff. A few SPI API and regmap updates are included to be used by sound drivers, too. Core: - A few trivial cleanups about __free() and runtime PM macros - Convert to new snd_seq_bus binding ASoC: - Generic SDCA support for reporting jack events - Continuing platform support, cleanup and feature improvements for AMD, Intel, Qualcomm and SOF code - Platform description improvements for the Cirrus drivers - Support for NXP i.MX952, Realtek RT1320 and RT5575, and Sophogo CV1800B HD- and USB-audio: - Many quirks as usual" * tag 'sound-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (341 commits) ALSA: usb-audio: Add DSD support for iBasso DC04U ALSA: mixer: oss: Add card disconnect checkpoints ASoC: SOF: ipc4-control: Set correct error code in refresh_bytes_control ASoC: SOF: Intel: select CONFIG_SND_HDA_EXT_CORE from SND_SOC_SOF_HDA_COMMON ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio ASoC: amd: maintainer information ALSA: ctxfi: Add quirk for SE-300PCIE variant (160b:0102) ALSA: hda/generic: fix typos in comments ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 ASoC: fsl_asrc_dma: allocate memory from dma device ASoC: fsl_asrc: Add support for i.MX952 platform ASoC: fsl_asrc_m2m: Add option to start ASRC before DMA device for M2M ASoC: dt-bindings: fsl,imx-asrc: Add support for i.MX952 platform ALSA: oss: delete self assignment ASoC: rockchip: spdif: Convert to FIELD_PREP ASoC: rockchip: spdif: Fill IEC958 CS info per params ASoC: rockchip: spdif: Add support for format S32_LE ASoC: rockchip: spdif: Add support for set mclk rate ASoC: rockchip: spdif: Swap PCM and DAI component registration order ... commit 0d6dd4738dbcc32b60c0c0c1388d41e171b76845 Merge: a31980dba7b957 6b617317e5bc95 Author: Linus Torvalds Date: Wed Feb 11 11:32:06 2026 -0800 Merge tag 'firewire-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: - Refactor page allocation dedicated to 1394 OHCI IR/IT/AR DMA contexts Although 1394 OHCI specification does not impose any restriction on the memory size dedicated to these DMA contexts, 1394 OHCI PCI driver allocates pages for convenience when mapping them into either kernel space or userspace VMA. The driver previously used dma_alloc_pages() for both page allocation and mapping creation, even though this kernel API is rarely used. Following discussions questioning the page-oriented kernel API in the DMA layer, the driver has been refactored to avoid using this API. In addition, the use of private members in the allocated pages has been removed following long-standing concern. - Allocate variable-sized buffer for isochronous context header 1394 OHCI PCI driver previously allocated a single page for isochronous context header. As a result, the buffer size for the header was fixed to PAGE_SIZE, which imposed a limitation on IEC 61883-1/6 packet streaming engine. Consequently, the ALSA PCM devices provided by drivers for audio and music units in IEEE 1394 bus were constrained in the maximum size of buffer period (64 ms in most cases). This limitation is resolved by dynamically allocating the header buffer with an arbitrary size. * tag 'firewire-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: ALSA: firewire: remove PCM buffer size constraint from isoc context header firewire: core: add fw_iso_context_create() variant with header storage size firewire: core: provide isoc header buffer size outside card driver firewire: ohci: allocate isoc context header by kvmalloc() firewire: core: add flags member for isochronous context structure firewire: ohci: use cleanup helper for isoc context header allocation firewire: ohci: code refactoring to use union for isoc multiple channel state firewire: ohci: refactor isoc single-channel state using a union firewire: core: add function variants for isochronous context creation firewire: ohci: fix index of pages for dma address to 1394 OHCI IT context firewire: ohci: stop using page private to store DMA mapping address firewire: ohci: split page allocation from dma mapping firewire: ohci: use MAX macro to guarantee minimum count of pages for AR contexts firewire: core: stop using page private to store DMA mapping address firewire: core: use common kernel API to allocate and release a batch of pages firewire: core: code refactoring with cleanup function for isoc pages firewire: core: use mutex instead of spinlock for client isochronous context firewire: core: move private function declaration from public header to internal header commit a31980dba7b957df21fd99d158dd0be516825676 Merge: 532355a7561036 33312c4d5ed815 Author: Linus Torvalds Date: Wed Feb 11 11:28:10 2026 -0800 Merge tag 'hid-for-linus-2026020901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - global switch of HID drivers to use pm_*ptr instead of #ifdef CONFIG_PM* (Bastien Nocera) - support for new firmware handling in intel-ish-hid (Vishnu Sankar) - support for HID output reports in the Quicki2c in intel-thc (Even Xu) - solidify register configuration updates in intel-thc (Even Xu) - Support for Rock band 4 PS4 and PS5 guitars (Rosalie Wanders) - fn lock and WMI fan control handling improvements in certain Asus models (ROG, ProArt P16) (Ionut Nechita, Connor Belli) - fix for potential NULL pointer dereference during warm reset in intel-ish-hid (Ryan Lin) - fix for potential NULL pointer derefence in probe error paths in hid-pl (Oliver Neukum) - various other small assorted fixes and new device ID additions / device-specific quirks * tag 'hid-for-linus-2026020901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (41 commits) HID: sony: add dongle device IDs for CRKD Gibson SG HID: Intel-thc-hid: Intel-thc: Fix wrong register fields updating HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients HID: logitech-hidpp: Add support for Logitech K980 HID: logitech-dj: Differentiate "invalid device index" error HID: sony: Use pm_ptr instead of #ifdef CONFIG_PM HID: wacom: Use pm_ptr instead of #ifdef CONFIG_PM HID: uclogic: Use pm_ptr instead of #ifdef CONFIG_PM HID: hid-sensor-hub: Use pm_ptr instead of #ifdef CONFIG_PM HID: picolcd_core: Use pm_ptr instead of #ifdef CONFIG_PM HID: nintendo: Use pm_ptr instead of #ifdef CONFIG_PM HID: logitech-dj: Use pm_ptr instead of #ifdef CONFIG_PM HID: lenovo: Use pm_ptr instead of #ifdef CONFIG_PM HID: asus: Use pm_ptr instead of #ifdef CONFIG_PM HID: appletb-kbd: Use pm_ptr instead of #ifdef CONFIG_PM HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM HID: multitouch: add eGalaxTouch EXC3188 support HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK HID: sony: add support for bluetooth Rock Band 4 PS4 guitars HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() ... commit 532355a756103639816068b89f73cc7789b16275 Merge: d70178215211a7 9e33c1dba22431 Author: Linus Torvalds Date: Wed Feb 11 11:00:19 2026 -0800 Merge tag 'hwmon-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New PMBus drivers: - HiTRON HAC300S power supply - Monolithic MP5926 Hot-Swap Controller - STEF48H28 hot-swap controller Support for new chips in existing drivers - Support for Pro WS TRX50-SAGE WIFI A and ROG MAXIMUS X HERO (asus-ec-sensors) - Support for Dell OptiPlex 7080 (dell-smm) - Support for F81968 (f71882fg) - Support for Micro PC 2 (gpd-fan) - New customer ID for ASRock Z590 Taichi (nct6683) - Support for ASUS Pro WS WRX90E-SAGE SE (nct6775) - Support for SHT85 (sht3x) - Support for P3T1035 and P3T2030 (tmp108) Bug fixes: - Revert "fix" for UAF which didn't fix a UAF but introduced a race condition resulting in a NULL pointer crash (ibmpex) - Fix failure to instantiate driver if the chip is configured for VID mode (pmbus/mpq8785) - Use READ/WRITE_ONCE to avoid compiler optimization induced race (max16065) - Resource leak fixes (nct7363, emc2305) Other notable changes: - Support for temperature limit thresholds (cros_ec) - Add TjMax for Silvermont through Tremont Atoms (coretemp) Various other minor improvements" * tag 'hwmon-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (42 commits) hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification Revert "hwmon: (ibmpex) fix use-after-free in high/low store" hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race hwmon: (nct6775) use sysfs_emit instead of sprintf hwmon: pmbus: fix table in STEF48H28 documentation hwmon: Add support for HiTRON HAC300S PSU dt-bindings: trivial-devices: Add hitron,hac300s hwmon: (cros_ec) Add support for temperature thresholds hwmon: (cros_ec) Move temperature channel params to a macro hwmon: (cros_ec) Add support for fan target speed hwmon: (cros_ec) Split up supported features in the documentation hwmon: (tmp108) Add P3T1035 and P3T2030 support hwmon: (tmp108) Add support for P3T1035 and P3T2030 dt-bindings: hwmon: ti,tmp108: Add P3T1035,P3T2030 hwmon: pmbus: add support for STEF48H28 dt-bindings: hwmon: add STEF48H28 hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child hwmon: (gpd-fan) add support for Micro PC 2 hwmon: (coretemp) Add TjMax for Silvermont through Tremont Atoms ... commit d70178215211a7c73ecabeb55eeb0f8ef002bcab Merge: 893ace4df0f96b af9b4a56f0000f Author: Linus Torvalds Date: Wed Feb 11 10:53:39 2026 -0800 Merge tag 'gpio-updates-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "There are two new drivers and some changes to GPIO core but mostly just GPIO driver updates across a wide array of files, adding support for new models as well as various refactoring changes. Nothing controversial and everything has spent a good measure of time in linux-next. GPIOLIB core: - shrink the GPIO bus driver stub code - rework software node support for "undefined" software nodes - provide and use devm_fwnode_gpiod_get_optional() - only compile the OF quirk for MT2701 when needed New drivers: - add the GPIO driver for ROHM bd72720 - add the gpio-line-mux driver providing 1-to-many mapping for a single real GPIO Driver changes: - refactor gpio-pca9570: use lock guard, add missing headers, use devres consistently - add support for a new model (G7 Aspeed sgpiom) to the aspeed-sgpio driver along with some prerequisite refactoring - use device_get_match_data() where applicable and save some lines - add support for more models to gpio-cadence - add the compatible property to reset-gpio and use it in shared GPIO management - drop unnecessary use of irqd_get_trigger_type() in gpio-max77759 - add support for a new variant to gpio-pca953x - extend build coverage with COMPILE_TEST for more drivers - constify configfs structures in gpio-sim and gpio-virtuser - add support for the K3 SoC to gpio-spacemit - implement the missing .get_direction() callback in gpio-max77620 - add support for Tegra264 to gpio-tegra186 - drop unneeded MODULE_ALIAS() from gpio-menz127 DT bindings: - document support for the opencores GPIO controller in gpio-mmio - document new variants for gpio-pca953x Documentation: - extensively describe interrupt source detection for gpio-pca953x and add more models to the list of supported variants" * tag 'gpio-updates-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (59 commits) gpio: tegra186: Add support for Tegra264 dt-bindings: gpio: Add Tegra264 support gpio: spacemit-k1: Use PDR for pin direction, not SDR/CDR gpio: max77620: Implement .get_direction() callback gpio: aspeed-sgpio: Support G7 Aspeed sgpiom controller dt-bindings: gpio: aspeed,sgpio: Support ast2700 gpio: aspeed-sgpio: Convert IRQ functions to use llops callbacks gpio: aspeed-sgpio: Create llops to handle hardware access gpio: aspeed-sgpio: Remove unused bank name field gpio: aspeed-sgpio: Change the macro to support deferred probe regulator: bd71815: switch to devm_fwnode_gpiod_get_optional gpiolib: introduce devm_fwnode_gpiod_get_optional() wrapper gpio: mmio: Add compatible for opencores GPIO dt-bindings: gpio-mmio: Correct opencores GPIO gpio: pca9570: use lock guards gpio: pca9570: Don't use "proxy" headers gpio: pca9570: Use devm_mutex_init() for mutex initialization MAINTAINERS: Add ROHM BD72720 PMIC power: supply: bd71828-power: Support ROHM BD72720 power: supply: bd71828: Support wider register addresses ... commit 893ace4df0f96b8ad066651453e0519d4ffe35ca Merge: c371f62da7982f ecfcae7885f105 Author: Linus Torvalds Date: Wed Feb 11 10:45:11 2026 -0800 Merge tag 'pwrseq-updates-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing updates from Bartosz Golaszewski: "One new driver and support for more models added to the existing qcom-wcn driver as well as some minor tweaks and fixes. New drivers: - add the power sequencing driver for PCIe M.2 connectors Driver improvements: - use device_get_match_data() where applicable - add support for the WCN39xx family of models to pwrseq-qcom-wcn Fixes: - fix a locking issue in pwrseq core - fix retval check in pwrseq-qcom-wcn" * tag 'pwrseq-updates-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: qcom-wcn: fix error path for VDDIO handling power: sequencing: fix missing state_lock in pwrseq_power_on() error path power: sequencing: Add the Power Sequencing driver for the PCIe M.2 connectors dt-bindings: connector: Add PCIe M.2 Mechanical Key M connector power: sequencing: qcom-wcn: add support for WCN39xx regulator: dt-bindings: qcom,wcn3990-pmu: describe PMUs on WCN39xx power: sequencing: qcom-wcn: use device_get_match_data() commit cfdde144ae455b8612a756fe7419d57c9b7833c1 Author: Sam Edwards Date: Sun Jan 25 18:30:55 2026 -0800 ceph: assert loop invariants in ceph_writepages_start() If `locked_pages` is zero, the page array must not be allocated: ceph_process_folio_batch() uses `locked_pages` to decide when to allocate `pages`, and redundant allocations trigger ceph_allocate_page_array()'s BUG_ON(), resulting in a worker oops (and writeback stall) or even a kernel panic. Consequently, the main loop in ceph_writepages_start() assumes that the lifetime of `pages` is confined to a single iteration. This expectation is currently not clear enough, as evidenced by the recent patch which fixed an oops caused by `pages` persisting into the next loop iteration: - "ceph: do not propagate page array emplacement errors as batch errors" Use an explicit BUG_ON() at the top of the loop to assert the loop's preexisting expectation that `pages` is cleaned up by the previous iteration. Because this is closely tied to `locked_pages`, also make it the previous iteration's responsibility to guarantee its reset, and verify with a second new BUG_ON() instead of handling (and masking) failures to do so. This patch does not change invariants, behavior, or failure modes. The added BUG_ON() lines catch conditions that would already trigger oops, but do so earlier for easier debugging and programmer clarity. Signed-off-by: Sam Edwards Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit c371f62da7982ff4f19484a131db7a255538ad00 Merge: e86dda7bde8801 9321f9d27fbaf6 Author: Linus Torvalds Date: Wed Feb 11 09:52:33 2026 -0800 Merge tag 'pwm/for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm updates from Uwe Kleine-König: "There are a few patches adapting to changes in Rust land which seems to be the norm since there is a pwm driver written in Rust. Other than that just a few cleanups and a single fix for the tiehrpwm driver that came in too late for making it into v6.19. Thanks to Andy Shevchenko, Bartosz Golaszewski, Daniel Almeida and Michal Wilczynski for reviews in this cycle, and to Alice Ryhl, Ben Zong-You Xie, Gokul Praveen, Kari Argillander, Markus Probst, Raag Jadav, Shankari Anand, Tamir Duberstein and Vladimir Zapolskiy for code contributions" * tag 'pwm/for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: Remove redundant check in pwm_ops_check() pwm: tiehrpwm: Enable pwmchip's parent device before setting configuration pwm: Update MAINTAINER entry rust: pwm: Add __rust_helper to helpers rust: pwm: Simplify to_result call sites and unsafe blocks rust: pwm: Fix potential memory leak on init error dt-bindings: pwm: nxp,lpc32xx-pwm: Specify clocks property as mandatory pwm: th1520: Replace `kernel::c_str!` with C-Strings pwm: dwc: Use size macro pwm: Emit native configuration in /sys/kernel/debug/pwm rust: pwm: Add UnregisteredChip wrapper around Chip rust: pwm: Update ARef and AlwaysRefCounted imports to use sync::aref commit b1195183ed42f1522fae3fe44ebee3af437aa000 Merge: bf2c3138ae3694 e3372ffb5f9e2d Author: Paolo Bonzini Date: Wed Feb 11 18:52:27 2026 +0100 Merge tag 'kvm-s390-next-7.0-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD - gmap rewrite: completely new memory management for kvm/s390 - vSIE improvement - maintainership change for s390 vfio-pci - small quality of life improvement for protected guests commit bf2c3138ae3694d4687cbe451c774c288ae2ad06 Merge: 1b13885edf0a55 d374b89edbb9a8 Author: Paolo Bonzini Date: Mon Feb 9 19:35:16 2026 +0100 Merge tag 'kvm-x86-pmu-6.20' of https://github.com/kvm-x86/linux into HEAD KVM mediated PMU support for 6.20 Add support for mediated PMUs, where KVM gives the guest full ownership of PMU hardware (contexted switched around the fastpath run loop) and allows direct access to data MSRs and PMCs (restricted by the vPMU model), but intercepts access to control registers, e.g. to enforce event filtering and to prevent the guest from profiling sensitive host state. To keep overall complexity reasonable, mediated PMU usage is all or nothing for a given instance of KVM (controlled via module param). The Mediated PMU is disabled default, partly to maintain backwards compatilibity for existing setup, partly because there are tradeoffs when running with a mediated PMU that may be non-starters for some use cases, e.g. the host loses the ability to profile guests with mediated PMUs, the fastpath run loop is also a blind spot, entry/exit transitions are more expensive, etc. Versus the emulated PMU, where KVM is "just another perf user", the mediated PMU delivers more accurate profiling and monitoring (no risk of contention and thus dropped events), with significantly less overhead (fewer exits and faster emulation/programming of event selectors) E.g. when running Specint-2017 on a single-socket Sapphire Rapids with 56 cores and no-SMT, and using perf from within the guest: Perf command: a. basic-sampling: perf record -F 1000 -e 6-instructions -a --overwrite b. multiplex-sampling: perf record -F 1000 -e 10-instructions -a --overwrite Guest performance overhead: --------------------------------------------------------------------------- | Test case | emulated vPMU | all passthrough | passthrough with | | | | | event filters | --------------------------------------------------------------------------- | basic-sampling | 33.62% | 4.24% | 6.21% | --------------------------------------------------------------------------- | multiplex-sampling | 79.32% | 7.34% | 10.45% | --------------------------------------------------------------------------- commit 1b13885edf0a55a451a26d5fa53e7877b31debb5 Merge: 9123c5f956b1fb ac4f869c563018 Author: Paolo Bonzini Date: Mon Feb 9 19:33:30 2026 +0100 Merge tag 'kvm-x86-apic-6.20' of https://github.com/kvm-x86/linux into HEAD KVM x86 APIC-ish changes for 6.20 - Fix a benign bug where KVM could use the wrong memslots (ignored SMM) when creating a vCPU-specific mapping of guest memory. - Clean up KVM's handling of marking mapped vCPU pages dirty. - Drop a pile of *ancient* sanity checks hidden behind in KVM's unused ASSERT() macro, most of which could be trivially triggered by the guest and/or user, and all of which were useless. - Fold "struct dest_map" into its sole user, "struct rtc_status", to make it more obvious what the weird parameter is used for, and to allow burying the RTC shenanigans behind CONFIG_KVM_IOAPIC=y. - Bury all of ioapic.h and KVM_IRQCHIP_KERNEL behind CONFIG_KVM_IOAPIC=y. - Add a regression test for recent APICv update fixes. - Rework KVM's handling of VMCS updates while L2 is active to temporarily switch to vmcs01 instead of deferring the update until the next nested VM-Exit. The deferred updates approach directly contributed to several bugs, was proving to be a maintenance burden due to the difficulty in auditing the correctness of deferred updates, and was polluting "struct nested_vmx" with a growing pile of booleans. - Handle "hardware APIC ISR", a.k.a. SVI, updates in kvm_apic_update_apicv() to consolidate the updates, and to co-locate SVI updates with the updates for KVM's own cache of ISR information. - Drop a dead function declaration. commit 9123c5f956b1fbedd63821eb528ece55ddd0e49c Merge: 54f15ebfc61ee8 2a62345b30529e Author: Paolo Bonzini Date: Mon Feb 9 19:08:17 2026 +0100 Merge tag 'kvm-x86-gmem-6.20' of https://github.com/kvm-x86/linux into HEAD KVM guest_memfd changes for 6.20 - Remove kvm_gmem_populate()'s preparation tracking and half-baked hugepage handling, and instead rely on SNP (the only user of the tracking) to do its own tracking via the RMP. - Retroactively document and enforce (for SNP) that KVM_SEV_SNP_LAUNCH_UPDATE and KVM_TDX_INIT_MEM_REGION require the source page to be 4KiB aligned, to avoid non-trivial complexity for a non-existent usecase (and because in-place conversion simply can't support unaligned sources). - When populating guest_memfd memory, GUP the source page in common code and pass the refcounted page to the vendor callback, instead of letting vendor code do the heavy lifting. Doing so avoids a looming deadlock bug with in-place due an AB-BA conflict betwee mmap_lock and guest_memfd's filemap invalidate lock. commit 54f15ebfc61ee8499a97f2dbfc18b1b13fdcb524 Merge: 9e03b7caf4e65f 376e2f8cca2816 Author: Paolo Bonzini Date: Mon Feb 9 19:05:42 2026 +0100 Merge tag 'kvm-riscv-6.20-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.20 - Fixes for issues discoverd by KVM API fuzzing in kvm_riscv_aia_imsic_has_attr(), kvm_riscv_aia_imsic_rw_attr(), and kvm_riscv_vcpu_aia_imsic_update() - Allow Zalasr, Zilsd and Zclsd extensions for Guest/VM - Add riscv vm satp modes in KVM selftests - Transparent huge page support for G-stage - Adjust the number of available guest irq files based on MMIO register sizes in DeviceTree or ACPI commit e86dda7bde8801d32ffe7d1570fe173cab14d1ba Merge: f6c42489fedfa4 5af56f30c4fcba Author: Linus Torvalds Date: Wed Feb 11 09:43:43 2026 -0800 Merge tag 'spi-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "The highlight here is that David Lechner has added support for multi-lane SPI devices. Unlike the existing dual/quad SPI support this is for devices (typically ADCs/DACs) which support multiple independent data streams over multiple data lanes, instead of sending one data stream N times as fast they simultaneously transfer N different data streams. This is very similar to the case where multiple devices are grouped together but in this case it's a single device in a way that's visible to software. Otherwise there's been quite a bit of work on existing drivers, both cleanup and feature improvement, and a reasonable collection of new drivers. - Support for multi-lane SPI devices - Preparatory work for some memory mapped flash improvements that will happen in the MTD subsystem - Several conversions to fwnode APIs - A bunch of cleanup and hardening work on the ST drivers - Support for DMA mode on Renesas RZV2H and i.MX target mode - Support for ATCSPI200, AXIADO AX300, NXP XPI and Renesas RZ/N1" * tag 'spi-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (108 commits) spi: tools: Add include folder to .gitignore spi: cadence-qspi: Add support for the Renesas RZ/N1 controller spi: cadence-qspi: Kill cqspi_jh7110_clk_init spi: dt-bindings: cdns,qspi-nor: Add Renesas RZ/N1D400 to the list spi: geni-qcom: Add target abort support spi: geni-qcom: Drop unused msg parameter from timeout handlers spi: geni-qcom: Fix abort sequence execution for serial engine errors spi: geni-qcom: Improve target mode allocation by using proper allocation functions spi: xilinx: use device property accessors. dt-bindings: spi: Add binding for Faraday FTSSP010 spi: axi-spi-engine: support SPI_MULTI_LANE_MODE_STRIPE spi: dt-bindings: adi,axi-spi-engine: add multi-lane support spi: Documentation: add page on multi-lane support spi: add multi_lane_mode field to struct spi_transfer spi: support controllers with multiple data lanes spi: dt-bindings: add spi-{tx,rx}-lane-map properties spi: dt-bindings: change spi-{rx,tx}-bus-width to arrays spi: dw: Remove not-going-to-be-supported code for Baikal SoC spi: cadence-qspi: Use a default value for cdns,fifo-width spi: cadence-qspi: Make sure write protection is disabled ... commit f6c42489fedfa42ba79bd17c49cf81c69ff39f8a Merge: d5cbd9f332c70b 914809c666d6c9 Author: Linus Torvalds Date: Wed Feb 11 09:40:12 2026 -0800 Merge tag 'regulator-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "There's a bunch of new drivers here, plus a lot of hardening for the supply resolution code which allow us to support systems where we have two PMICs each of which has regulators supplied by the other. This did work a long time ago but got broken as part of improved integration with the device model, it's fairly rare so nobody noticed. - Improvements for supply handling from André Draszik to allow systems with two PMICs with supply/consumer relationships in both directions to instantiate. - New drivers for Maxim MAX776750, Realtek RT8902, Samsung S2MPG11, Texas Instuments TPS65185. This have also pulls in some MFD updates which are build dependencies for the Samsung S2MPG11 support" * tag 'regulator-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (42 commits) regulator: s2mps11: more descriptive gpio consumer name regulator: s2mps11: add S2MPG11 regulator regulator: s2mps11: refactor S2MPG10 regulator macros for S2MPG11 reuse regulator: s2mps11: refactor S2MPG10 ::set_voltage_time() for S2MPG11 reuse regulator: s2mps11: add S2MPG10 regulator regulator: s2mps11: refactor handling of external rail control regulator: s2mps11: update node parsing (allow -supply properties) regulator: s2mps11: place constants on right side of comparison tests regulator: s2mps11: use dev_err_probe() where appropriate regulator: s2mps11: drop two needless variable initialisations regulator: add REGULATOR_LINEAR_VRANGE macro regulator: dt-bindings: add s2mpg11-pmic regulators regulator: dt-bindings: add s2mpg10-pmic regulators dt-bindings: firmware: google,gs101-acpm-ipc: convert regulators to lowercase mfd: sec: Add support for S2MPG11 PMIC via ACPM mfd: sec: s2mpg10: Reorder regulators for better probe performance dt-bindings: mfd: Add samsung,s2mpg11-pmic dt-bindings: mfd: samsung,s2mpg10-pmic: Link to its regulators dt-bindings: mfd: samsung,s2mps11: Split s2mpg10-pmic into separate file mfd: sec: Drop now unused struct sec_pmic_dev::irq_data ... commit 5b88af7113feba2f0ae3402bb57cb5c94eea7dc3 Author: Stefan Hajnoczi Date: Tue Feb 10 11:36:17 2026 -0500 block: allow IOC_PR_READ_* ioctls with BLK_OPEN_READ The recently added IOC_PR_READ_* ioctls require the same BLK_OPEN_WRITE permission as the older persistent reservation ioctls. This has the drawback that udev triggers when the file descriptor is closed, resulting in unnecessary activity like scanning partitions even though these read-only ioctls do not modify the device. Change IOC_PR_READ_KEYS and IOC_PR_READ_RESERVATION to require BLK_OPEN_READ. This prevents unnecessary activity every time `blkpr --read-keys` or `blkpr --read-reservation` is invoked by shell scripts, for example. It is safe to reduce the permission requirement from BLK_OPEN_WRITE to BLK_OPEN_READ since these two ioctls do not modify the persistent reservation state. Userspace cannot use the information fetched by these ioctls to make changes to the device unless it later opens the device with BLK_OPEN_WRITE. Fixes: 3e2cb9ee76c2 ("block: add IOC_PR_READ_RESERVATION ioctl") Fixes: 22a1ffea5f80 ("block: add IOC_PR_READ_KEYS ioctl") Cc: Christoph Hellwig Cc: Martin Wilck Cc: Benjamin Marzinski Suggested-by: Hannes Reinecke Signed-off-by: Stefan Hajnoczi Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 2ebc8d600fb907fa6b1e7095c0b6d84fc47e91ea Author: Christoph Böhmwalder Date: Thu Feb 5 18:39:29 2026 +0100 drbd: always set BLK_FEAT_STABLE_WRITES DRBD requires stable pages because it may read the same bio data multiple times for local disk I/O and network transmission, and in some cases for calculating checksums. The BLK_FEAT_STABLE_WRITES flag is set when the device is first created, but blk_set_stacking_limits() clears it whenever a backing device is attached. In some cases the flag may be inherited from the backing device, but we want it to be enabled at all times. Unconditionally re-enable BLK_FEAT_STABLE_WRITES in drbd_reconsider_queue_parameters() after the queue parameter negotiations. Also, document why we want this flag enabled in the first place. Fixes: 1a02f3a73f8c ("block: move the stable_writes flag to queue_limits") Signed-off-by: Christoph Böhmwalder Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit d5cbd9f332c70be9589201474b9477baf9b5a24d Merge: be653d2d1f4352 4651c87b008392 Author: Linus Torvalds Date: Wed Feb 11 09:23:13 2026 -0800 Merge tag 'regmap-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "The main change here is the implementation of a mechanism for generating register defaults via a callback rather than with a table in the driver. This is useful for devices where there are large ranges of registers with the same or generated values, it allows us to have a small amount of code instead of a larger amount of default data" * tag 'regmap-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regcache: Demote defaults readback from HW to debug print regmap: add KUnit coverage for reg_default_cb callback regmap: Add reg_default_cb callback for flat cache defaults regmap: Enable REGMAP when REGMAP_SLIMBUS is enabled commit be653d2d1f435218cf4b7abad96b42a20ce28451 Merge: 192c0159402e6b 520e345dfdab89 Author: Linus Torvalds Date: Wed Feb 11 09:19:47 2026 -0800 Merge tag 'chrome-platform-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "New cros_ec_lightbar features: - Report the number of exposed LED segments via sysfs - Support large sequence of program to be transmitted Fixes: - Don't touch fwnode_handle::dev which is a private field - Fix wrong assignment for response size in cros_ec_lightbar Cleanups: - Use acpi_get_local_u64_address() helper" * tag 'chrome-platform-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: lightbar: Use flexible array member platform/chrome: lightbar: Fix lightbar_program_ex alignment platform/chrome: lightbar: Add support for large sequence platform/chrome: lightbar: Report number of segments platform/chrome: cros_ec_lightbar: Fix response size initialization platform/chrome: cros_typec_switch: Use acpi_get_local_u64_address() platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev commit fa589acaac08f1877185b5eb22d0985664536101 Author: Sam Edwards Date: Sun Jan 25 18:30:54 2026 -0800 ceph: remove error return from ceph_process_folio_batch() Following an earlier commit, ceph_process_folio_batch() no longer returns errors because the writeback loop cannot handle them. Since this function already indicates failure to lock any pages by leaving `ceph_wbc.locked_pages == 0`, and the writeback loop has no way to handle abandonment of a locked batch, change the return type of ceph_process_folio_batch() to `void` and remove the pathological goto in the writeback loop. The lack of a return code emphasizes that ceph_process_folio_batch() is designed to be abort-free: that is, once it commits a folio for writeback, it will not later abandon it or propagate an error for that folio. Any future changes requiring "abort" logic should follow this invariant by cleaning up its array and resetting ceph_wbc.locked_pages appropriately. Signed-off-by: Sam Edwards Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit cac190c7674fea71620d754ffcdaaeed7c551dbc Author: Sam Edwards Date: Sun Jan 25 18:30:53 2026 -0800 ceph: fix write storm on fscrypted files CephFS stores file data across multiple RADOS objects. An object is the atomic unit of storage, so the writeback code must clean only folios that belong to the same object with each OSD request. CephFS also supports RAID0-style striping of file contents: if enabled, each object stores multiple unbroken "stripe units" covering different portions of the file; if disabled, a "stripe unit" is simply the whole object. The stripe unit is (usually) reported as the inode's block size. Though the writeback logic could, in principle, lock all dirty folios belonging to the same object, its current design is to lock only a single stripe unit at a time. Ever since this code was first written, it has determined this size by checking the inode's block size. However, the relatively-new fscrypt support needed to reduce the block size for encrypted inodes to the crypto block size (see 'fixes' commit), which causes an unnecessarily high number of write operations (~1024x as many, with 4MiB objects) and correspondingly degraded performance. Fix this (and clarify intent) by using i_layout.stripe_unit directly in ceph_define_write_size() so that encrypted inodes are written back with the same number of operations as if they were unencrypted. This patch depends on the preceding commit ("ceph: do not propagate page array emplacement errors as batch errors") for correctness. While it applies cleanly on its own, applying it alone will introduce a regression. This dependency is only relevant for kernels where ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") has been applied; stable kernels without that commit are unaffected. Cc: stable@vger.kernel.org Fixes: 94af0470924c ("ceph: add some fscrypt guardrails") Signed-off-by: Sam Edwards Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 707104682e3c163f7c14cdd6b07a3e95fb374759 Author: Sam Edwards Date: Sun Jan 25 18:30:52 2026 -0800 ceph: do not propagate page array emplacement errors as batch errors When fscrypt is enabled, move_dirty_folio_in_page_array() may fail because it needs to allocate bounce buffers to store the encrypted versions of each folio. Each folio beyond the first allocates its bounce buffer with GFP_NOWAIT. Failures are common (and expected) under this allocation mode; they should flush (not abort) the batch. However, ceph_process_folio_batch() uses the same `rc` variable for its own return code and for capturing the return codes of its routine calls; failing to reset `rc` back to 0 results in the error being propagated out to the main writeback loop, which cannot actually tolerate any errors here: once `ceph_wbc.pages` is allocated, it must be passed to ceph_submit_write() to be freed. If it survives until the next iteration (e.g. due to the goto being followed), ceph_allocate_page_array()'s BUG_ON() will oops the worker. Note that this failure mode is currently masked due to another bug (addressed next in this series) that prevents multiple encrypted folios from being selected for the same write. For now, just reset `rc` when redirtying the folio to prevent errors in move_dirty_folio_in_page_array() from propagating. Note that move_dirty_folio_in_page_array() is careful never to return errors on the first folio, so there is no need to check for that. After this change, ceph_process_folio_batch() no longer returns errors; its only remaining failure indicator is `locked_pages == 0`, which the caller already handles correctly. Cc: stable@vger.kernel.org Fixes: ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") Signed-off-by: Sam Edwards Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 804c4a2209bcf6ed4c45386f033e4d0f7c5bfda5 Author: Masami Hiramatsu (Google) Date: Tue Feb 10 17:43:43 2026 +0900 tracing: Reset last_boot_info if ring buffer is reset Commit 32dc0042528d ("tracing: Reset last-boot buffers when reading out all cpu buffers") resets the last_boot_info when user read out all data via trace_pipe* files. But it is not reset when user resets the buffer from other files. (e.g. write `trace` file) Reset it when the corresponding ring buffer is reset too. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Link: https://patch.msgid.link/177071302364.2293046.17895165659153977720.stgit@mhiramat.tok.corp.google.com Fixes: 32dc0042528d ("tracing: Reset last-boot buffers when reading out all cpu buffers") Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit f844282deed7481cf2f813933229261e27306551 Author: Masami Hiramatsu (Google) Date: Tue Feb 10 17:43:36 2026 +0900 tracing: Fix to set write permission to per-cpu buffer_size_kb Since the per-cpu buffer_size_kb file is writable for changing per-cpu ring buffer size, the file should have the write access permission. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Link: https://patch.msgid.link/177071301597.2293046.11683339475076917920.stgit@mhiramat.tok.corp.google.com Fixes: 21ccc9cd7211 ("tracing: Disable "other" permission bits in the tracefs files") Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 83310d613382f74070fc8b402f3f6c2af8439ead Merge: 42d1c54d624886 bf9cf80cab81e3 Author: Paolo Abeni Date: Wed Feb 11 15:14:35 2026 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Merge in late fixes in preparation for the net-next PR. Signed-off-by: Paolo Abeni commit 42d1c54d624886ae46dbab89ed6b2088434ca088 Author: Vikas Gupta Date: Sun Feb 8 22:59:25 2026 +0530 bnge/bng_re: Add a new HSI The HSI is shared between the firmware and the driver and is automatically generated. Add a new HSI for the BNGE driver. The current HSI refers to BNXT, which will become incompatible with ThorUltra devices as the BNGE driver adds more features. The BNGE driver will not use the HSI located in the bnxt folder. Also, add an HSI for ThorUltra RoCE driver. Changes in v3: - Fix in bng_roce_hsi.h reported by Jakub (AI review) https://lore.kernel.org/netdev/20260207051422.4181717-1-kuba@kernel.org/ - Add an entry in MAINTAINERS Signed-off-by: Vikas Gupta Signed-off-by: Siva Reddy Kallam Reviewed-by: Bhargava Chenna Marreddy Link: https://patch.msgid.link/20260208172925.1861255-1-vikas.gupta@broadcom.com Signed-off-by: Paolo Abeni commit bf9cf80cab81e39701861a42877a28295ade266f Author: Kevin Hao Date: Sun Feb 8 16:45:52 2026 +0800 net: macb: Fix tx/rx malfunction after phy link down and up In commit 99537d5c476c ("net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()"), the mog_init_rings() callback was moved from macb_mac_link_up() to macb_open() to resolve a deadlock issue. However, this change introduced a tx/rx malfunction following phy link down and up events. The issue arises from a mismatch between the software queue->tx_head, queue->tx_tail, queue->rx_prepared_head, and queue->rx_tail values and the hardware's internal tx/rx queue pointers. According to the Zynq UltraScale TRM [1], when tx/rx is disabled, the internal tx queue pointer resets to the value in the tx queue base address register, while the internal rx queue pointer remains unchanged. The following is quoted from the Zynq UltraScale TRM: When transmit is disabled, with bit [3] of the network control register set low, the transmit-buffer queue pointer resets to point to the address indicated by the transmit-buffer queue base address register. Disabling receive does not have the same effect on the receive-buffer queue pointer. Additionally, there is no need to reset the RBQP and TBQP registers in a phy event callback. Therefore, move macb_init_buffers() to macb_open(). In a phy link up event, the only required action is to reset the tx software head and tail pointers to align with the hardware's behavior. [1] https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm Fixes: 99537d5c476c ("net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()") Signed-off-by: Kevin Hao Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260208-macb-init-ring-v1-1-939a32c14635@gmail.com Signed-off-by: Paolo Abeni commit 6884028cd7f275f8bcb854a347265cb1fb0e4bea Author: Kuniyuki Iwashima Date: Sat Feb 7 23:22:34 2026 +0000 af_unix: Fix memleak of newsk in unix_stream_connect(). When prepare_peercred() fails in unix_stream_connect(), unix_release_sock() is not called for newsk, and the memory is leaked. Let's move prepare_peercred() before unix_create1(). Fixes: fd0a109a0f6b ("net, pidfs: prepare for handing out pidfds for reaped sk->sk_peer_pid") Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260207232236.2557549-1-kuniyu@google.com Signed-off-by: Paolo Abeni commit e3998b6e90f875f19bf758053d79ccfd41880173 Author: Kevin Hao Date: Sat Feb 7 14:21:46 2026 +0800 net: ti: icssg-prueth: Add optional dependency on HSR Commit 95540ad6747c ("net: ti: icssg-prueth: Add support for HSR frame forward offload") introduced support for offloading HSR frame forwarding, which relies on functions such as is_hsr_master() provided by the HSR module. Although HSR provides stubs for configurations with HSR disabled, this driver still requires an optional dependency on HSR. Otherwise, build failures will occur when icssg-prueth is built-in while HSR is configured as a module. ld.lld: error: undefined symbol: is_hsr_master >>> referenced by icssg_prueth.c:710 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:710) >>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(icssg_prueth_hsr_del_mcast) in archive vmlinux.a >>> referenced by icssg_prueth.c:681 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:681) >>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(icssg_prueth_hsr_add_mcast) in archive vmlinux.a >>> referenced by icssg_prueth.c:1812 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:1812) >>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(prueth_netdevice_event) in archive vmlinux.a ld.lld: error: undefined symbol: hsr_get_port_ndev >>> referenced by icssg_prueth.c:712 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:712) >>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(icssg_prueth_hsr_del_mcast) in archive vmlinux.a >>> referenced by icssg_prueth.c:712 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:712) >>> drivers/net/etherneteth_hsr_del_mcast) in archive vmlinux.a >>> referenced by icssg_prueth.c:683 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:683) >>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(icssg_prueth_hsr_add_mcast) in archive vmlinux.a >>> referenced 1 more times Fixes: 95540ad6747c ("net: ti: icssg-prueth: Add support for HSR frame forward offload") Signed-off-by: Kevin Hao Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260207-icssg-dep-v3-1-8c47c1937f81@gmail.com Signed-off-by: Paolo Abeni commit e265b330b93e3a3f9ff5256451d4f09b5f89b239 Author: Mickaël Salaün Date: Sat Feb 7 12:11:35 2026 +0100 mailmap: Add entry for Mickaël Salaün My Microsoft address is no longer used. Add a mailmap entry to reflect that. Cc: Günther Noack Cc: James Morris Reviewed-by: Paul Moore Link: https://lore.kernel.org/r/20260207111136.577249-1-mic@digikod.net Signed-off-by: Mickaël Salaün commit 1abee69a95c609cd0470bcfd9750157ab7b217a7 Merge: ccb3272666989e 23794bec1cb606 Author: Paolo Abeni Date: Wed Feb 11 11:28:00 2026 +0100 Merge branch 'net-dsa-initial-support-for-maxlinear-mxl862xx-switches' Daniel Golle says: ==================== net: dsa: initial support for MaxLinear MxL862xx switches This series adds very basic DSA support for the MaxLinear MxL86252 (5x 2500Base-T PHYs) and MxL86282 (8x 2500Base-T PHYs) switches. In addition to the 2.5G TP ports both switches also come with two SerDes interfaces which can be used either to connect external PHYs or SFP cages, or as CPU port when using the switch with this DSA driver. MxL862xx integrates a firmware running on an embedded processor (based on Zephyr RTOS). Host interaction uses a simple netlink-like API transported over MDIO/MMD. This series includes only what's needed to pass traffic between user ports and the CPU port: relayed MDIO to internal PHYs, basic port enable/disable, and CPU-port special tagging. The SerDes interface of the CPU port is automatically configured by the switch after reset using a board-specific configuration stored together with the firmware in the flash chip attached to the switch, so no action is needed from the driver to setup the interface mode of the CPU port. Also MAC settings of the PHY ports are automatically configured, which means the driver works fine with phylink_mac_ops being all no-op stubs. Multiple follow up series will bring support for setting up the other SerDes PCS interface (ie. not used for the CPU port), bridge, VLAN, ... offloading, and support for using an 802.1Q-based special tag instead of the proprietary 8-byte tag. ==================== Link: https://patch.msgid.link/cover.1770433307.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 23794bec1cb606fee9e4876f0e86f592e1301f58 Author: Daniel Golle Date: Sat Feb 7 03:07:27 2026 +0000 net: dsa: add basic initial driver for MxL862xx switches Add very basic DSA driver for MaxLinear's MxL862xx switches. In contrast to previous MaxLinear switches the MxL862xx has a built-in processor that runs a sophisticated firmware based on Zephyr RTOS. Interaction between the host and the switch hence is organized using a software API of that firmware rather than accessing hardware registers directly. Add descriptions of the most basic firmware API calls to access the built-in MDIO bus hosting the 2.5GE PHYs, basic port control as well as setting up the CPU port. Implement a very basic DSA driver using that API which is sufficient to get packets flowing between the user ports and the CPU port. The firmware offers all features one would expect from a modern switch hardware, they are going to be added one by one in follow-up patch series. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/ccde07e8cf33d8ae243000013b57cfaa2695e0a9.1770433307.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit b405b26d8d27fbb09c6ce2e7cc0eada9a63136b6 Author: Daniel Golle Date: Sat Feb 7 03:07:18 2026 +0000 net: mdio: add unlocked mdiodev C45 bus accessors Add helper inline functions __mdiodev_c45_read() and __mdiodev_c45_write(), which are the C45 equivalents of the existing __mdiodev_read() and __mdiodev_write() added by commit e6a45700e7e1 ("net: mdio: add unlocked mdiobus and mdiodev bus accessors") Signed-off-by: Daniel Golle Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/8d1d55949a75a871d2a3b90e421de4bd58d77685.1770433307.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 85ee98742902735d65ef3a8e14e16870490e5f2f Author: Daniel Golle Date: Sat Feb 7 03:07:11 2026 +0000 net: dsa: add tag format for MxL862xx switches Add proprietary special tag format for the MaxLinear MXL862xx family of switches. While using the same Ethertype as MaxLinear's GSW1xx switches, the actual tag format differs significantly, hence we need a dedicated tag driver for that. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/c64e6ddb6c93a4fac39f9ab9b2d8bf551a2b118d.1770433307.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 4ccc9851355ff050ddde5a956fe8407958bc9e1a Author: Daniel Golle Date: Sat Feb 7 03:07:04 2026 +0000 dt-bindings: net: dsa: add MaxLinear MxL862xx Add documentation and an example for MaxLinear MxL86282 and MxL86252 switches. Signed-off-by: Daniel Golle Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/22a6a3c8c15b932ff4b7d0cd8863939f06a0c2b4.1770433307.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit ccb3272666989effd24a3354696e4cc5dea80661 Author: Dimitri Daskalakis Date: Fri Feb 6 17:30:18 2026 -0800 selftests: drivers: net: hw: Modify toeplitz.c to poll for packets Prior to this the receiver would sleep for the configured timeout, then attempt to receive as many packets as possible. This would result in a large burst of packets, and we don't necessarily need that many samples. The tests now run faster. Before ok 12 toeplitz.test.rps_udp_ipv6 # Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0 real 0m54.792s user 0m12.486s sys 0m10.887s After ok 12 toeplitz.test.rps_udp_ipv6 # Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0 real 0m36.892s user 0m4.203s sys 0m8.314s Signed-off-by: Jakub Kicinski Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260207013018.551347-1-dimitri.daskalakis1@gmail.com [pabeni@redhat.com: whitespaces fixes] Signed-off-by: Paolo Abeni commit 9abbecf408cba09d73d14f044e1bc12ab7776da0 Merge: 7a2c1b27cd6b85 b07829d546c831 Author: Petr Mladek Date: Wed Feb 11 10:14:35 2026 +0100 Merge branch 'for-6.20' into for-linus commit 908ef80e31e4d3bd953a0088fe57640cd9ae7b3e Author: Baojun Xu Date: Wed Feb 11 11:09:46 2026 +0800 ALSA: hda/tas2781: Ignore reset check for SPI device In the SPI driver probe, the device should be in the default state, so the device status check is not necessary. It should be forced to do the firmware download as I2C device. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20260211030946.2330-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit 3a6b7dc431aab90744e973254604855e654294ae Author: Lewis Mason Date: Tue Feb 10 23:13:37 2026 +0000 ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG) The Samsung Galaxy Book3 Pro 360 NP965QFG (subsystem ID 0x144d:0xc1cb) uses the same Realtek ALC298 codec and amplifier configuration as the NP960QFG (0x144d:0xc1ca). Apply the same ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS fixup to enable the internal speakers. Cc: stable@vger.kernel.org Signed-off-by: Lewis Mason Link: https://patch.msgid.link/20260210231337.7265-1-lewis@ocuru.co.uk Signed-off-by: Takashi Iwai commit 405d59fdd2038a65790eaad8c1013d37a2af6561 Author: Eric Naim Date: Tue Feb 10 17:34:02 2026 +0800 ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023) Fixes microphone detection when a headset is connected to the audio jack using the ALC256. Cc: stable@vger.kernel.org Signed-off-by: Eric Naim Link: https://patch.msgid.link/20260210093403.21514-1-dnaim@cachyos.org Signed-off-by: Takashi Iwai commit 943f3b8bfbf297cf74392b50a7108ce1fe4cbd8c Author: Hariprasad Kelam Date: Fri Feb 6 23:56:45 2026 +0530 octeontx2-pf: Unregister devlink on probe failure When probe fails after devlink registration, the missing devlink unregister call causing a memory leak. Fixes: 2da489432747 ("octeontx2-pf: devlink params support to set mcam entry count") Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20260206182645.4032737-1-hkelam@marvell.com Signed-off-by: Paolo Abeni commit e9a5073a98d940837cbb95e71eed1f28f48e7b30 Author: Michael Dege Date: Fri Feb 6 14:41:53 2026 +0100 net: renesas: rswitch: fix forwarding offload statemachine A change of the port state of one port, caused the state of another port to change. This behvior was unintended. Fixes: b7502b1043de ("net: renesas: rswitch: add offloading for L2 switching") Signed-off-by: Michael Dege Link: https://patch.msgid.link/20260206-fix-offloading-statemachine-v3-1-07bfba07d03e@renesas.com Signed-off-by: Paolo Abeni commit b777b5e09eabeefc6ba80f4296366a4742701103 Author: Eric Dumazet Date: Tue Feb 10 17:02:25 2026 +0000 time/jiffies: Inline jiffies_to_msecs() and jiffies_to_usecs() For common cases (HZ=100, 250 or 1000), these helpers are at most one multiply, so there is no point calling a tiny function. Keep them out of line for HZ=300 and others. This saves cycles in TCP fast path, among other things. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/8 grow/shrink: 25/89 up/down: 530/-3474 (-2944) ... nla_put_msecs 193 - -193 message_stats_print 2131 920 -1211 Total: Before=25365208, After=25362264, chg -0.01% Signed-off-by: Eric Dumazet Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260210170226.57209-1-edumazet@google.com commit 192c0159402e6bfbe13de6f8379546943297783d Merge: 8ad8d24d962804 e2071f9ce42b69 Author: Linus Torvalds Date: Tue Feb 10 21:46:12 2026 -0800 Merge tag 'powerpc-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates for 7.0 - Implement masked user access - Add bpf support for internal only per-CPU instructions and inline the bpf_get_smp_processor_id() and bpf_get_current_task() functions - Fix pSeries MSI-X allocation failure when quota is exceeded - Fix recursive pci_lock_rescan_remove locking in EEH event handling - Support tailcalls with subprogs & BPF exceptions on 64bit - Extend "trusted" keys to support the PowerVM Key Wrapping Module (PKWM) Thanks to Abhishek Dubey, Christophe Leroy, Gaurav Batra, Guangshuo Li, Jarkko Sakkinen, Mahesh Salgaonkar, Mimi Zohar, Miquel Sabaté Solà, Nam Cao, Narayana Murty N, Nayna Jain, Nilay Shroff, Puranjay Mohan, Saket Kumar Bhaskar, Sourabh Jain, Srish Srinivasan, and Venkat Rao Bagalkote. * tag 'powerpc-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (27 commits) powerpc/pseries: plpks: export plpks_wrapping_is_supported docs: trusted-encryped: add PKWM as a new trust source keys/trusted_keys: establish PKWM as a trusted source pseries/plpks: add HCALLs for PowerVM Key Wrapping Module pseries/plpks: expose PowerVM wrapping features via the sysfs powerpc/pseries: move the PLPKS config inside its own sysfs directory pseries/plpks: fix kernel-doc comment inconsistencies powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() powerpc: kgdb: Remove OUTBUFMAX constant powerpc64/bpf: Additional NVR handling for bpf_throw powerpc64/bpf: Support exceptions powerpc64/bpf: Add arch_bpf_stack_walk() for BPF JIT powerpc64/bpf: Avoid tailcall restore from trampoline powerpc64/bpf: Support tailcalls with subprogs powerpc64/bpf: Moving tail_call_cnt to bottom of frame powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling powerpc/pseries: Fix MSI-X allocation failure when quota is exceeded powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory powerpc64/bpf: Inline bpf_get_smp_processor_id() and bpf_get_current_task/_btf() powerpc64/bpf: Support internal-only MOV instruction to resolve per-CPU addrs ... commit 8ad8d24d962804d3c54b5b7542c4cb7cd6bacb3b Merge: 6589b3d76db2d6 1651d69443c3a5 Author: Linus Torvalds Date: Tue Feb 10 21:42:10 2026 -0800 Merge tag 'parisc-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: - Fix device reference leak in error path - Check if system provides a 64-bit free running platform counter - Minor fixes in debug code * tag 'parisc-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: lba_pci: Add debug code to show IO and PA ranges parisc: Detect 64-bit free running platform counter parisc: Fix minor printk issues in iosapic debug code parisc: Enhance debug code for PAT firmware parisc: Add PDC PAT call to get free running 64-bit counter parisc: Fix module path output in qemu tables parisc: Export model name for MPE/ix parisc: Prevent interrupts during reboot parisc: Print hardware IDs as 4 digit hex strings parisc: kernel: replace kfree() with put_device() in create_tree_node() commit 6589b3d76db2d6adbf8f2084c303fb24252a0dc6 Merge: 60dc45dde44e0b f51d34065de4f2 Author: Linus Torvalds Date: Tue Feb 10 21:11:08 2026 -0800 Merge tag 'soc-dt-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC devicetree updates from Arnd Bergmann: "There are a handful of new SoCs this time, all of these are more or less related to chips in a wider family: - SpacemiT Key Stone K3 is an 8-core risc-v chip, and the first widely available RVA23 implementation. Note that this is entirely unrelated with the similarly named Texas Instruments K3 chip family that follwed the TI Keystone2 SoC. - The Realtek Kent family of SoCs contains three chip models rtd1501s, rtd1861b and rtd1920s, and is related to their earlier Set-top-box and NAS products such as rtd1619, but is built on newer Arm Cortex-A78 cores. - The Qualcomm Milos family includes the Snapdragon 7s Gen 3 (SM7635) mobile phone SoC built around Armv9 Kryo cores of the Arm Cortex-A720 generation. This one is used in the Fairphone Gen 6 - Qualcomm Kaanapali is a new SoC based around eight high performance Oryon CPU cores - NXP i.MX8QP and i.MX952 are both feature reduced versions of chips we already support, i.e. the i.MX8QM and i.MX952, with fewer CPU cores and I/O interfaces. As part of a cleanup, a number of SoC specific devicetree files got removed because they did not have a single board using the .dtsi files and they were never compile tested as a result: Samsung s3c6400, ST spear320s, ST stm32mp21xc/stm32mp23xc/stm32mp25xc, Renesas r8a779m0/r8a779m2/r8a779m4/r8a779m6/r8a779m7/r8a779m8/r8a779mb/ r9a07g044c1/r9a07g044l1/r9a07g054l1/r9a09g047e37, and TI am3703/am3715. All of these could be restored easily if a new board gets merged. Broadcom/Cavium/Marvell ThunderX2 gets removed along with its only machine, as all remaining users are assumed to be using ACPI based firmware. A relatively small number of 43 boards get added this time, and almost all of them for arm64. Aside from the reference boards for the newly added SoCs, this includes: - Three server boards use 32-bit ASpeed BMCs - One more reference board for 32-bit Microchip LAN9668 - 64-bit Arm single-board computers based on Amlogic s905y4, CIX sky1, NXP ls1028a/imx8mn/imx8mp/imx91/imx93/imx95, Qualcomm qcs6490/qrb2210 and Rockchip rk3568/rk3588s - Carrier board for SOMs using Intel agilex5, Marvell Armada 7020, NXP iMX8QP, Mediatek mt8370/mt8390 and rockchip rk3588 - Two mobile phones using Snapdragon 845 - A gaming device and a NAS box, both based on Rockchips rk356x On top of the newly added boards and SoCs, there is a lot of background activity going into cleanups, in particular towards getting a warning-free dtc build, and the usual work on adding support for more hardware on the previously added machines" * tag 'soc-dt-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (757 commits) dt-bindings: intel: Add Agilex eMMC support arm64: dts: socfpga: agilex: add emmc support arm64: dts: intel: agilex5: Add simple-bus node on top of dma controller node ARM: dts: socfpga: fix dtbs_check warning for fpga-region ARM: dts: socfpga: add #address-cells and #size-cells for sram node dt-bindings: altera: document syscon as fallback for sys-mgr arm64: dts: altera: Use lowercase hex dt-bindings: arm: altera: combine Intel's SoCFPGA into altera.yaml arm64: dts: socfpga: agilex5: Add IOMMUS property for ethernet nodes arm64: dts: socfpga: agilex5: add support for modular board dt-bindings: intel: Add Agilex5 SoCFPGA modular board arm64: dts: socfpga: agilex5: Add dma-coherent property arm64: dts: realtek: Add Kent SoC and EVB device trees dt-bindings: arm: realtek: Add Kent Soc family compatibles ARM: dts: samsung: Drop s3c6400.dtsi ARM: dts: nuvoton: Minor whitespace cleanup MAINTAINERS: Add Falcon DB arm64: dts: a7k: add COM Express boards ARM: dts: microchip: Drop usb_a9g20-dab-mmx.dtsi arm64: dts: rockchip: Fix rk3588 PCIe range mappings ... commit 60dc45dde44e0b5c433d8db574daf86b59eb6dc3 Merge: bdbddf72a2ab1c 16868b35b915a8 Author: Linus Torvalds Date: Tue Feb 10 21:03:14 2026 -0800 Merge tag 'soc-arm-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull arm platform SoC code updates from Arnd Bergmann: "These are mainly code cleanups, dropping some unneeded code, plus a reference counting leak fix" * tag 'soc-arm-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: at91: remove unnecessary of_platform_default_populate calls ARM: at91: Move PM init functions to .init_late hook ARM: omap1: drop unused Kconfig symbol ARM: omap2: Fix reference count leaks in omap_control_init() commit cdb1634de3bf197c0d86487d1fb84c128a79cc7c Author: Eric Joyner Date: Fri Feb 6 14:46:51 2026 -0800 ionic: Rate limit unknown xcvr type messages Running ethtool repeatedly with a transceiver unknown to the driver or firmware will cause the driver to spam the kernel logs with "unknown xcvr type" messages which can distract from real issues; and this isn't interesting information outside of debugging. Fix this by rate limiting the output so that there are still notifications but not so many that they flood the log. Using dev_dbg_once() would reduce the number of messages further, but this would miss the case where a different unknown transceiver type is plugged in, and its status is requested. Fixes: 4d03e00a2140 ("ionic: Add initial ethtool support") Signed-off-by: Eric Joyner Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260206224651.1491-1-eric.joyner@amd.com Signed-off-by: Jakub Kicinski commit 70f1fbee85a4ee1c4d9278dff30b51f16e1d99db Merge: 792aaea994537d 97d7ae6e14c80e Author: Jakub Kicinski Date: Tue Feb 10 20:57:52 2026 -0800 Merge branch 'ipv6-tcp-no-longer-rebuild-fl6-at-each-transmit' Eric Dumazet says: ==================== ipv6: tcp: no longer rebuild fl6 at each transmit TCP v6 spends a good amount of time rebuilding a fresh fl6 at each transmit in inet6_csk_xmit()/inet6_csk_route_socket(). TCP v4 caches the information in inet->cork.fl.u.ip4 instead. This series changes TCP v6 to behave the same, saving cpu cycles and reducing cache line misses and stack use. ==================== Link: https://patch.msgid.link/20260206173426.1638518-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 97d7ae6e14c80ec0c2558d24d818212590f2d64f Author: Eric Dumazet Date: Fri Feb 6 17:34:26 2026 +0000 tcp: inet6_csk_xmit() optimization After prior patches, inet6_csk_xmit() can reuse inet->cork.fl.u.ip6 if __sk_dst_check() returns a valid dst. Otherwise call inet6_csk_route_socket() to refresh inet->cork.fl.u.ip6 content and get a new dst. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260206173426.1638518-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit a6eee39cc2b95db3ae8ec92120f50aa899eb6652 Author: Eric Dumazet Date: Fri Feb 6 17:34:25 2026 +0000 tcp: populate inet->cork.fl.u.ip6 in tcp_v6_syn_recv_sock() As explained in commit 85d05e281712 ("ipv6: change inet6_sk_rebuild_header() to use inet->cork.fl.u.ip6"): TCP v6 spends a good amount of time rebuilding a fresh fl6 at each transmit in inet6_csk_xmit()/inet6_csk_route_socket(). TCP v4 caches the information in inet->cork.fl.u.ip4 instead. After this patch, passive TCP ipv6 flows have correctly initialized inet->cork.fl.u.ip6 structure. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260206173426.1638518-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 19bdb267f733ac92dcf5cf126bfcec1f9281c8c5 Author: Eric Dumazet Date: Fri Feb 6 17:34:24 2026 +0000 tcp: populate inet->cork.fl.u.ip6 in tcp_v6_connect() Instead of using private @fl6 and @final variables use respectively inet->cork.fl.u.ip6 and np->final. As explained in commit 85d05e281712 ("ipv6: change inet6_sk_rebuild_header() to use inet->cork.fl.u.ip6"): TCP v6 spends a good amount of time rebuilding a fresh fl6 at each transmit in inet6_csk_xmit()/inet6_csk_route_socket(). TCP v4 caches the information in inet->cork.fl.u.ip4 instead. After this patch, active TCP ipv6 flows have correctly initialized inet->cork.fl.u.ip6 structure. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260206173426.1638518-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 969a20198bd686ebff18879fc214e4fd71b0ed71 Author: Eric Dumazet Date: Fri Feb 6 17:34:23 2026 +0000 ipv6: inet6_csk_xmit() and inet6_csk_update_pmtu() use inet->cork.fl.u.ip6 Convert inet6_csk_route_socket() to use np->final instead of an automatic variable to get rid of a stack canary. Convert inet6_csk_xmit() and inet6_csk_update_pmtu() to use inet->cork.fl.u.ip6 instead of @fl6 automatic variable. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260206173426.1638518-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4e6c91cf60f25ac3490bbf4d387c09ffc369aa7a Author: Eric Dumazet Date: Fri Feb 6 17:34:22 2026 +0000 ipv6: use inet->cork.fl.u.ip6 and np->final in ip6_datagram_dst_update() Get rid of @fl6 and &final variables in ip6_datagram_dst_update(). Use instead inet->cork.fl.u.ip6 and np->final so that a stack canary is no longer needed. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260206173426.1638518-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3d3f075e80f201b5ce3446beccb0d7dfd72078f5 Author: Eric Dumazet Date: Fri Feb 6 17:34:21 2026 +0000 ipv6: use np->final in inet6_sk_rebuild_header() Instead of using an automatic variable, use np->final to get rid of the stack canary in inet6_sk_rebuild_header(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260206173426.1638518-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 03ff0cb1a9269a12c648e69e8b6ae6c2a723977c Author: Eric Dumazet Date: Fri Feb 6 17:34:20 2026 +0000 ipv6: add daddr/final storage in struct ipv6_pinfo After commit b409a7f7176b ("ipv6: colocate inet6_cork in inet_cork_full") we have room in ipv6_pinfo to hold daddr/final in case they need to be populated in fl6_update_dst() calls. This will allow stack canary removal in IPv6 tx fast paths. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260206173426.1638518-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit bdbddf72a2ab1cfea699959795d70df3931eefe7 Merge: f7fae9b4d38f0c cfd00b7e26c833 Author: Linus Torvalds Date: Tue Feb 10 20:45:30 2026 -0800 Merge tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "There are are a number of to firmware drivers, in particular the TEE subsystem: - a bus callback for TEE firmware that device drivers can register to - sysfs support for tee firmware information - minor updates to platform specific TEE drivers for AMD, NXP, Qualcomm and the generic optee driver - ARM SCMI firmware refactoring to improve the protocol discover among other fixes and cleanups - ARM FF-A firmware interoperability improvements The reset controller and memory controller subsystems gain support for additional hardware platforms from Mediatek, Renesas, NXP, Canaan and SpacemiT. Most of the other changes are for random drivers/soc code. Among a number of cleanups and newly added hardware support, including: - Mediatek MT8196 DVFS power management and mailbox support - Qualcomm SCM firmware and MDT loader refactoring, as part of the new Glymur platform support. - NXP i.MX9 System Manager firmware support for accessing the syslog - Minor updates for TI, Renesas, Samsung, Apple, Marvell and AMD SoCs" * tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (171 commits) bus: fsl-mc: fix an error handling in fsl_mc_device_add() reset: spacemit: Add SpacemiT K3 reset driver reset: spacemit: Extract common K1 reset code reset: Create subdirectory for SpacemiT drivers dt-bindings: soc: spacemit: Add K3 reset support and IDs reset: canaan: k230: drop OF dependency and enable by default reset: rzg2l-usbphy-ctrl: Add suspend/resume support reset: rzg2l-usbphy-ctrl: Propagate the return value of regmap_field_update_bits() reset: gpio: check the return value of gpiod_set_value_cansleep() reset: imx8mp-audiomix: Support i.MX8ULP SIM LPAV reset: imx8mp-audiomix: Extend the driver usage reset: imx8mp-audiomix: Switch to using regmap API reset: imx8mp-audiomix: Drop unneeded macros soc: fsl: qe: qe_ports_ic: Consolidate chained IRQ handler install/remove soc: mediatek: mtk-cmdq: Add mminfra_offset adjustment for DRAM addresses soc: mediatek: mtk-cmdq: Extend cmdq_pkt_write API for SoCs without subsys ID soc: mediatek: mtk-cmdq: Add pa_base parsing for hardware without subsys ID support soc: mediatek: mtk-cmdq: Add cmdq_get_mbox_priv() in cmdq_pkt_create() mailbox: mtk-cmdq: Add driver data to support for MT8196 mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction ... commit f7fae9b4d38f0c52489640c9688e529c4a58e1b6 Merge: 2b398c05625a15 6f3f1d83e511c8 Author: Linus Torvalds Date: Tue Feb 10 20:44:10 2026 -0800 Merge tag 'soc-defconfig-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "These are the usual updates, enabling mode newly merged device drivers for various Arm and RISC-V based platforms in the defconfig files. The Renesas and NXP defconfig files also get a refresh for modified Kconfig options" * tag 'soc-defconfig-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: riscv: defconfig: spacemit: k3: enable clock support ARM: defconfig: turn off CONFIG_EXPERT ARM: defconfig: move entries arm64: defconfig: Enable configurations for Kontron SMARC-sAM67 ARM: imx_v4_v5_defconfig: update for v6.19-rc1 arm64: defconfig: Enable Apple Silicon drivers arm64: select APPLE_PMGR_PWRSTATE for ARCH_APPLE arm64: defconfig: Enable Mediatek HDMIv2 driver ARM: shmobile: defconfig: Refresh for v6.19-rc1 arm64: defconfig: Enable PCIe for the Renesas RZ/G3S SoC arm64: defconfig: Enable RZ/G3E USB3 PHY driver arm64: defconfig: Enable EC drivers for Qualcomm-based laptops arm64: defconfig: Enable options for Qualcomm Milos SoC ARM: imx_v6_v7_defconfig: enable EPD regulator needed for Kobo Clara 2e ARM: imx_v6_v7_defconfig: Configure CONFIG_SND_SOC_FSL_ASOC_CARD as module ARM: multi_v7_defconfig: enable DA9052 and MC13XXX arm64: defconfig: enable clocks, interconnect and pinctrl for Qualcomm Kaanapali arm64: defconfig: Drop duplicate CONFIG_OMAP_USB2 entry arm64: defconfig: Enable missing AMD/Xilinx drivers commit 2b398c05625a158e24da00887bbba284e9dab0b0 Merge: 1ca28333e46498 adbbd9714f8058 Author: Linus Torvalds Date: Tue Feb 10 20:27:33 2026 -0800 Merge tag 'asm-generic-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic header updates from Arnd Bergmann: "A series from Thomas Weißschuh cleans up the UAPI header files to no longer contain any references to Kconfig symbols, as these make no sense in userspace. The build-time check for these was originally added by Sam Ravnborg in linux-2.6.28, and a later version started warning for all newly added CONFIG_* checks here but kept a list of known exceptions. With the last exceptions gone from that list, the warning is now unconditional in 'make headers_install'. John Garry contributed a cleanup of cpumask_of_node()" * tag 'asm-generic-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: scripts: headers_install.sh: Remove config leak ignore machinery x86/uapi: Stop leaking kconfig references to userspace nios2: uapi: Remove custom asm/swab.h from UAPI ARM: uapi: Drop PSR_ENDSTATE ARC: Always use SWAPE instructions for __arch_swab32() include/asm-generic/topology.h: Remove unused definition of cpumask_of_node() commit 792aaea994537daa78f31a86c948ccbefa8f4706 Merge: 3a4687366148a5 648946966a08e4 Author: Jakub Kicinski Date: Tue Feb 10 20:25:38 2026 -0800 Merge tag 'nf-next-26-02-06' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: updates for net-next The following patchset contains Netfilter updates for *net-next*: 1) Fix net-next-only use-after-free bug in nf_tables rbtree set: Expired elements cannot be released right away after unlink anymore because there is no guarantee that the binary-search blob is going to be updated. Spotted by syzkaller. 2) Fix esoteric bug in nf_queue with udp fraglist gro, broken since 6.11. Patch 3 adds extends the nfqueue selftest for this. 4) Use dedicated slab for flowtable entries, currently the -512 cache is used, which is wasteful. From Qingfang Deng. 5) Recent net-next update extended existing test for ip6ip6 tunnels, add the required /config entry. Test still passed by accident because the previous tests network setup gets re-used, so also update the test so it will fail in case the ip6ip6 tunnel interface cannot be added. 6) Fix 'nft get element mytable myset { 1.2.3.4 }' on big endian platforms, this was broken since code was added in v5.1. 7) Fix nf_tables counter reset support on 32bit platforms, where counter reset may cause huge values to appear due to wraparound. Broken since reset feature was added in v6.11. From Anders Grahn. 8-11) update nf_tables rbtree set type to detect partial operlaps. This will eventually speed up nftables userspace: at this time userspace does a netlink dump of the set content which slows down incremental updates on interval sets. From Pablo Neira Ayuso. * tag 'nf-next-26-02-06' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nft_set_rbtree: validate open interval overlap netfilter: nft_set_rbtree: validate element belonging to interval netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval netfilter: nft_counter: fix reset of counters on 32bit archs netfilter: nft_set_hash: fix get operation on big endian selftests: netfilter: add IPV6_TUNNEL to config netfilter: flowtable: dedicated slab for flow entry selftests: netfilter: nft_queue.sh: add udp fraglist gro test case netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation netfilter: nft_set_rbtree: don't gc elements on insert ==================== Link: https://patch.msgid.link/20260206153048.17570-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 3a4687366148a58017997a750f85631292c22b3e Author: Russell King (Oracle) Date: Fri Feb 6 17:19:21 2026 +0000 net: stmmac: qcom-ethqos: fix qcom_ethqos_serdes_powerup() Add cleanup for failure paths in qcom_ethqos_serdes_powerup(). This was missing calling phy_exit() and phy_power_off() at appropriate failure points. Signed-off-by: Russell King (Oracle) Reviewed-by: Vadim Fedorenko Tested-by: Mohd Ayaan Anwar Reviewed-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1voPUH-000000083ji-25FH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit dc010e1b4bb63d7b24854a3a332c97a78fad15d7 Author: Paolo Abeni Date: Fri Feb 6 18:14:36 2026 +0100 xfrm: reduce struct sec_path size The mentioned struct has an hole and uses unnecessary wide type to store MAC length and indexes of very small arrays. It's also embedded into the skb_extensions, and the latter, due to recent CAN changes, may exceeds the 192 bytes mark (3 cachelines on x86_64 arch) on some reasonable configurations. Reordering and the sec_path fields, shrinking xfrm_offload.orig_mac_len to 16 bits and xfrm_offload.{len,olen,verified_cnt} to u8, we can save 16 bytes and keep skb_extensions size under control. Before: struct sec_path { int len; int olen; int verified_cnt; /* XXX 4 bytes hole, try to pack */$ struct xfrm_state * xvec[6]; struct xfrm_offload ovec[1]; /* size: 88, cachelines: 2, members: 5 */ /* sum members: 84, holes: 1, sum holes: 4 */ /* last cacheline: 24 bytes */ }; After: struct sec_path { struct xfrm_state * xvec[6]; struct xfrm_offload ovec[1]; /* typedef u8 -> __u8 */ unsigned char len; /* typedef u8 -> __u8 */ unsigned char olen; /* typedef u8 -> __u8 */ unsigned char verified_cnt; /* size: 72, cachelines: 2, members: 5 */ /* padding: 1 */ /* last cacheline: 8 bytes */ }; Signed-off-by: Paolo Abeni Reviewed-by: Florian Westphal Reviewed-by: Steffen Klassert Link: https://patch.msgid.link/83846bd2e3fa08899bd0162e41bfadfec95e82ef.1770398071.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit e72d4c537f40bcefe2cac1276d35228e86074cab Merge: e5e2e4300228a5 b9355ad52b38b6 Author: Jakub Kicinski Date: Tue Feb 10 20:17:58 2026 -0800 Merge branch 'bnxt_en-add-rss-context-resource-check' Michael Chan says: ==================== bnxt_en: Add RSS context resource check Add missing logic to check that we have enough RSS contexts. This will make the recent change to increase the use of RSS contexts for a larger RSS indirection table more complete. ==================== Link: https://patch.msgid.link/20260207235118.1987301-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit b9355ad52b38b67a4e22f61b05d1b4381b7b1140 Author: Michael Chan Date: Sat Feb 7 15:51:18 2026 -0800 bnxt_en: Check RSS contexts in bnxt_need_reserve_rings() bnxt_need_reserve_rings() checks all resources except HW RSS contexts to determine if a new reservation is required. For completeness, add the check for HW RSS contexts. This makes the code more complete after the recent commit to increase the number of RSS contexts for a larger RSS indirection table: Fixes: 51b9d3f948b8 ("bnxt_en: Use a larger RSS indirection table on P5_PLUS chips") Reviewed-by: Kalesh AP Signed-off-by: Michael Chan Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260207235118.1987301-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 5a2f3aa2896f8162cf8349d525e97ce09cd712f5 Author: Michael Chan Date: Sat Feb 7 15:51:17 2026 -0800 bnxt_en: Refactor bnxt_need_reserve_rings() bnxt_need_reserve_rings() checks 6 ring resources against the reserved values to determine if a new reservation is needed. Factor out the code to collect the total resources into a new helper function bnxt_get_total_resources() to make the code cleaner and easier to read. Instead of individual scalar variables, use the struct bnxt_hw_rings to hold all the ring resources. Using the struct, hwr.cp replaces the nq variable and the chip specific hwr.cp_p5 replaces cp on newer chips. There is no change in behavior. This will make it easier to check the RSS context resource in the next patch. Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260207235118.1987301-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 1ca28333e464989113e518b452eaaccc79d865c8 Author: Linus Torvalds Date: Tue Feb 10 20:03:30 2026 -0800 x86: keep legacy generated vdso files around in .gitignore file Commit 93d73005bff4 ("x86/entry/vdso: Rename vdso_image_* to vdso*_image") updated the vdso .gitignore file with the new filenames, which is certainly not incorrect. However, while adding new generated names is obviously the right thing to do, you should *not* immediately remove the old filenames from the .gitignore file when things move around or get renamed, because people still have those old generated files in their build trees - and they haven't suddenly become valid files to commit to the repository just because they were moved or renamed. While it's mostly just a slight visual nuisance for 'git status' that can be fixed up with a clean build tree, it can become more serious than that: see for example commit 04a3389b3535 ("Remove stale generated 'genheaders' file"). That commit removed up a stale generated file that had been carelessly committed by a kernel developer because it wasn't properly ignored any more and thus showed up as a new file in their tree. Fixes: 93d73005bff4 ("x86/entry/vdso: Rename vdso_image_* to vdso*_image") Cc: Peter Anvin Cc: Dave Hansen Signed-off-by: Linus Torvalds commit e5e2e4300228a501b63cd4da13173371a40fea4b Author: Geliang Tang Date: Fri Feb 6 14:09:24 2026 +0100 mptcp: allow overridden write_space to be invoked Future extensions with psock will override their own sk->sk_write_space callback. This patch ensures that the overridden sk_write_space can be invoked by MPTCP. INDIRECT_CALL is used to keep the default path optimised. Note that sk->sk_write_space was never called directly with MPTCP sockets, so changing it to sk_stream_write_space in the init, and using it from mptcp_write_space() is not supposed to change the current behaviour. This patch is shared early to ease discussions around future RFC and avoid confusions with this "fix" that is needed for different future extensions. Suggested-by: Paolo Abeni Co-developed-by: Gang Yan Signed-off-by: Gang Yan Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260206-net-next-mptcp-write_space-override-v2-1-e0b12be818c6@kernel.org Signed-off-by: Jakub Kicinski commit 3def995c4ede842adf509c410e92d09a0cedc965 Author: Bo Sun Date: Fri Feb 6 21:09:24 2026 +0800 octeontx2-af: CGX: fix bitmap leaks The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap) are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit(). Unbinding and rebinding the driver therefore triggers kmemleak: unreferenced object (size 16): backtrace: rvu_alloc_bitmap cgx_probe Free both bitmaps during teardown. Fixes: e740003874ed ("octeontx2-af: Flow control resource management") Cc: stable@vger.kernel.org Signed-off-by: Bo Sun Reviewed-by: Vadim Fedorenko Reviewed-by: Jijie Shao Link: https://patch.msgid.link/20260206130925.1087588-2-bo@mboxify.com Signed-off-by: Jakub Kicinski commit 45a1b8cc6c0690d82f176ec9c3ca8ad0aa050511 Merge: 6f7e6393d1ce63 6b32c93560cb19 Author: Linus Torvalds Date: Tue Feb 10 19:52:18 2026 -0800 Merge tag 'x86_misc_for_7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Dave Hansen: "The usual smattering of x86/misc changes. The IPv6 patch in here surprised me in a couple of ways. First, the function it inlines is able to eat a lot more CPU time than I would have expected. Second, the inlining does not seem to bloat the kernel, at least in the configs folks have tested. - Inline x86-specific IPv6 checksum helper - Update IOMMU docs to use stable identifiers - Print unhashed pointers on fatal stack overflows" * tag 'x86_misc_for_7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/traps: Print unhashed pointers on stack overflow Documentation/x86: Update IOMMU spec references to use stable identifiers x86/lib: Inline csum_ipv6_magic() commit f2c7fdebf03986cd820028ab933afad670bfe8a2 Merge: ad1f18e985cb27 79ba362b43373d Author: Jakub Kicinski Date: Tue Feb 10 19:51:59 2026 -0800 Merge branch 'net-netconsole-convert-to-nbcon-console-infrastructure' Breno Leitao says: ==================== net: netconsole: convert to NBCON console infrastructure This series adds support for the nbcon (new buffer console) infrastructure to netconsole, enabling lock-free, priority-based console operations that are safer in crash scenarios. The implementation is introduced in three steps: 0) Extend printk to expose CPU and taskname (task->comm) where the printk originated from. (Thanks John and Petr for the support in getting this done) 1) Refactor the message fragmentation logic into a reusable helper function 2) Extend nbcon support to non-extended (basic) consoles using the same infrastructure. The initial discussion about it appeared a while ago in [1], in order to solve Mike's HARDIRQ-safe -> HARDIRQ-unsafe lock order warning, and the root cause is that some hosts were calling IRQ unsafe locks from inside console lock. At that time, we didn't have the CON_NBCON_ATOMIC_UNSAFE yet. John kindly implemented CON_NBCON_ATOMIC_UNSAFE in 187de7c212e5 ("printk: nbcon: Allow unsafe write_atomic() for panic"), and now we can implement netconsole on top of nbcon. Important to note that netconsole continues to call netpoll and the network TX helpers with interrupt disable, given the TX are called with target_list_lock. ==================== Link: https://patch.msgid.link/20260206-nbcon-v7-0-62bda69b1b41@debian.org Signed-off-by: Jakub Kicinski commit 79ba362b43373d19ce6c989b0498f7a67740ff6e Author: Breno Leitao Date: Fri Feb 6 04:45:32 2026 -0800 netconsole: Use printk context for CPU and task information Use the CPU and task name captured at printk() time from nbcon_write_context instead of querying the current execution context. This provides accurate information about where the message originated, rather than where netconsole happens to be running. For CPU, use wctxt->cpu instead of raw_smp_processor_id(). For taskname, use wctxt->comm directly which contains the task name captured at printk time. This change ensures netconsole outputs reflect the actual context that generated the log message, which is especially important when the console driver runs asynchronously in a dedicated thread. Reviewed-by: John Ogness Reviewed-by: Petr Mladek Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260206-nbcon-v7-4-62bda69b1b41@debian.org Signed-off-by: Jakub Kicinski commit 7eab73b18630e77a6433c6eab0abdd64b9dad85e Author: Breno Leitao Date: Fri Feb 6 04:45:31 2026 -0800 netconsole: convert to NBCON console infrastructure Convert netconsole from the legacy console API to the NBCON framework. NBCON provides threaded printing which unblocks printk()s and flushes in a thread, decoupling network TX from printk() when netconsole is in use. Since netconsole relies on the network stack which cannot safely operate from all atomic contexts, mark both consoles with CON_NBCON_ATOMIC_UNSAFE. (See discussion in [1]) CON_NBCON_ATOMIC_UNSAFE restricts write_atomic() usage to emergency scenarios (panic) where regular messages are sent in threaded mode. Implementation changes: - Unify write_ext_msg() and write_msg() into netconsole_write() - Add device_lock/device_unlock callbacks to manage target_list_lock - Use nbcon_enter_unsafe()/nbcon_exit_unsafe() around network operations. - If nbcon_enter_unsafe() fails, just return given netconsole lost the ownership of the console. - Set write_thread and write_atomic callbacks (both use same function) Link: https://lore.kernel.org/all/b2qps3uywhmjaym4mht2wpxul4yqtuuayeoq4iv4k3zf5wdgh3@tocu6c7mj4lt/ [1] Reviewed-by: John Ogness Reviewed-by: Petr Mladek Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260206-nbcon-v7-3-62bda69b1b41@debian.org Signed-off-by: Jakub Kicinski commit eaf35bc63be79bfd1c37e82bea4af7adc162455f Author: Breno Leitao Date: Fri Feb 6 04:45:30 2026 -0800 netconsole: extract message fragmentation into send_msg_udp() Extract the message fragmentation logic from write_msg() into a dedicated send_msg_udp() function. This improves code readability and prepares for future enhancements. The new send_msg_udp() function handles splitting messages that exceed MAX_PRINT_CHUNK into smaller fragments and sending them sequentially. This function is placed before send_ext_msg_udp() to maintain a logical ordering of related functions. No functional changes - this is purely a refactoring commit. Reviewed-by: Petr Mladek Reviewed-by: Simon Horman Reviewed-by: John Ogness Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260206-nbcon-v7-2-62bda69b1b41@debian.org Signed-off-by: Jakub Kicinski commit 60325c27d3cfe13466f6d6aa882b11bdd1c58cc8 Author: Breno Leitao Date: Fri Feb 6 04:45:29 2026 -0800 printk: Add execution context (task name/CPU) to printk_info Extend struct printk_info to include the task name, pid, and CPU number where printk messages originate. This information is captured at vprintk_store() time and propagated through printk_message to nbcon_write_context, making it available to nbcon console drivers. This is useful for consoles like netconsole that want to include execution context in their output, allowing correlation of messages with specific tasks and CPUs regardless of where the console driver actually runs. The feature is controlled by CONFIG_PRINTK_EXECUTION_CTX, which is automatically selected by CONFIG_NETCONSOLE_DYNAMIC. When disabled, the helper functions compile to no-ops with no overhead. Suggested-by: John Ogness Signed-off-by: Petr Mladek Reviewed-by: Petr Mladek Signed-off-by: Breno Leitao Reviewed-by: John Ogness Link: https://patch.msgid.link/20260206-nbcon-v7-1-62bda69b1b41@debian.org Signed-off-by: Jakub Kicinski commit 6f7e6393d1ce636bb7ec77a7fe7b77458fddf701 Merge: ca8f421ea0d3f1 ce9b1c10c3f1c7 Author: Linus Torvalds Date: Tue Feb 10 19:34:26 2026 -0800 Merge tag 'x86_entry_for_7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 entry code updates from Dave Hansen: "This is entirely composed of a set of long overdue VDSO cleanups. They makes the VDSO build much more logical and zap quite a bit of old cruft. It also results in a coveted net-code-removal diffstat" * tag 'x86_entry_for_7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/entry/vdso: Add vdso2c to .gitignore x86/entry/vdso32: Omit '.cfi_offset eflags' for LLVM < 16 MAINTAINERS: Adjust vdso file entry in INTEL SGX x86/entry/vdso/selftest: Update location of vgetrandom-chacha.S x86/entry/vdso: Fix filtering of vdso compiler flags x86/entry/vdso: Update the object paths for "make vdso_install" x86/entry/vdso32: When using int $0x80, use it directly x86/cpufeature: Replace X86_FEATURE_SYSENTER32 with X86_FEATURE_SYSFAST32 x86/vdso: Abstract out vdso system call internals x86/entry/vdso: Include GNU_PROPERTY and GNU_STACK PHDRs x86/entry/vdso32: Remove open-coded DWARF in sigreturn.S x86/entry/vdso32: Remove SYSCALL_ENTER_KERNEL macro in sigreturn.S x86/entry/vdso32: Don't rely on int80_landing_pad for adjusting ip x86/entry/vdso: Refactor the vdso build x86/entry/vdso: Move vdso2c to arch/x86/tools x86/entry/vdso: Rename vdso_image_* to vdso*_image commit ca8f421ea0d3f1d39f773e14f68f93c978e470ef Merge: 57cb845067e0bf 8c89d3ad309580 Author: Linus Torvalds Date: Tue Feb 10 19:19:06 2026 -0800 Merge tag 'x86_sev_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SEV updates from Borislav Petkov: - Make the SEV internal header really internal and carve out the SVSM-specific code into a separate compilation unit, along with other cleanups and fixups [ TLA translation service: 'SEV' is AMD's 'Secure Encrypted Virtualization' and SVSM is an ETLA ('Enhanced TLA') for 'Secure VM Service Module'. Some of us have trouble keeping track of this all and need all the help we can get ] * tag 'x86_sev_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Don't emit BSS_DECRYPTED section unless it is in use x86/sev: Use kfree_sensitive() when freeing a SNP message descriptor x86/sev: Rename sev_es_ghcb_handle_msr() to __vc_handle_msr() x86/sev: Carve out the SVSM code into a separate compilation unit x86/sev: Add internal header guards x86/sev: Move the internal header commit 57cb845067e0bf5d42af6bc570190bba3238660e Merge: 8cbd0d2b61b3c7 31911d3c394d65 Author: Linus Torvalds Date: Tue Feb 10 19:01:45 2026 -0800 Merge tag 'x86_paravirt_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 paravirt updates from Borislav Petkov: - A nice cleanup to the paravirt code containing a unification of the paravirt clock interface, taming the include hell by splitting the pv_ops structure and removing of a bunch of obsolete code (Juergen Gross) * tag 'x86_paravirt_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) x86/paravirt: Use XOR r32,r32 to clear register in pv_vcpu_is_preempted() x86/paravirt: Remove trailing semicolons from alternative asm templates x86/pvlocks: Move paravirt spinlock functions into own header x86/paravirt: Specify pv_ops array in paravirt macros x86/paravirt: Allow pv-calls outside paravirt.h objtool: Allow multiple pv_ops arrays x86/xen: Drop xen_mmu_ops x86/xen: Drop xen_cpu_ops x86/xen: Drop xen_irq_ops x86/paravirt: Move pv_native_*() prototypes to paravirt.c x86/paravirt: Introduce new paravirt-base.h header x86/paravirt: Move paravirt_sched_clock() related code into tsc.c x86/paravirt: Use common code for paravirt_steal_clock() riscv/paravirt: Use common code for paravirt_steal_clock() loongarch/paravirt: Use common code for paravirt_steal_clock() arm64/paravirt: Use common code for paravirt_steal_clock() arm/paravirt: Use common code for paravirt_steal_clock() sched: Move clock related paravirt code to kernel/sched paravirt: Remove asm/paravirt_api_clock.h x86/paravirt: Move thunk macros to paravirt_types.h ... commit 8cbd0d2b61b3c7b1068c3d97266c25d0b7f63469 Merge: 9fbb4810404a02 ac44a110c18ad7 Author: Linus Torvalds Date: Tue Feb 10 18:59:06 2026 -0800 Merge tag 'x86_microcode_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loader update from Borislav Petkov: - Since debugging the microcode loader makes sense on baremetal too (it was used in a guest only until now), extend it to be able to do that too * tag 'x86_microcode_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/AMD: Allow loader debugging to be enabled on baremetal too commit a16f91f80735e653b88370b840d5c771f2c175c5 Author: Frank Li Date: Tue Feb 10 17:12:14 2026 -0500 dt-bindings: interrupt-controller: Add compatiblie string fsl,imx(1|25|27|31|35)-avic Add compatiblie string fsl,imx(1|25|27|31|35)-avic for i.MX3 SoCs (over 15 years old). Signed-off-by: Frank Li Link: https://patch.msgid.link/20260210221215.1575844-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit 9fbb4810404a02e0081d43d5c6b0b4c9057e15d6 Merge: dcb49710189d10 53ed3d91a141f5 Author: Linus Torvalds Date: Tue Feb 10 18:43:03 2026 -0800 Merge tag 'x86_cleanups_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Borislav Petkov: - The usual set of cleanups and simplifications all over the tree * tag 'x86_cleanups_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/segment: Use MOVL when reading segment registers selftests/x86: Clean up sysret_rip coding style x86/mm: Hide mm_free_global_asid() definition under CONFIG_BROADCAST_TLB_FLUSH x86/crash: Use set_memory_p() instead of __set_memory_prot() x86/CPU/AMD: Simplify the spectral chicken fix x86/platform/olpc: Replace strcpy() with strscpy() in xo15_sci_add() x86/split_lock: Remove dead string when split_lock_detect=fatal commit dcb49710189d104d4edc07709615748dab61341b Merge: 75b2a603671f9b a8848c4b43ad00 Author: Linus Torvalds Date: Tue Feb 10 18:24:56 2026 -0800 Merge tag 'x86_cache_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: - Extend the resctrl machinery to support telemetry monitoring on Intel (Tony Luck) The practical usage of this is being able to tell how much energy or how much work can be attributed to a group of tasks tracked under a single idenitifier. Prepend this work with proper refactoring of resctrl domains handling code. * tag 'x86_cache_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits) x86,fs/resctrl: Update documentation for telemetry events x86/resctrl: Enable RDT_RESOURCE_PERF_PKG fs/resctrl: Move RMID initialization to first mount x86,fs/resctrl: Compute number of RMIDs as minimum across resources fs/resctrl: Move allocation/free of closid_num_dirty_rmid[] x86/resctrl: Handle number of RMIDs supported by RDT_RESOURCE_PERF_PKG x86/resctrl: Add energy/perf choices to rdt boot option x86,fs/resctrl: Handle domain creation/deletion for RDT_RESOURCE_PERF_PKG fs/resctrl: Refactor rmdir_mondata_subdir_allrdtgrp() fs/resctrl: Refactor mkdir_mondata_subdir() x86/resctrl: Read telemetry events x86/resctrl: Find and enable usable telemetry events x86,fs/resctrl: Add architectural event pointer x86,fs/resctrl: Fill in details of events for performance and energy GUIDs x86/resctrl: Discover hardware telemetry events fs/resctrl: Emphasize that L3 monitoring resource is required for summing domains x86,fs/resctrl: Add and initialize a resource for package scope monitoring x86,fs/resctrl: Add an architectural hook called for first mount x86,fs/resctrl: Support binary fixed point event counters x86,fs/resctrl: Handle events that can be read from any CPU ... commit 43185067c6fd55b548ecb648a69d9569fcf622b5 Author: Kuppuswamy Sathyanarayanan Date: Tue Feb 10 16:17:12 2026 -0800 configfs-tsm-report: tdx_guest: Increase Quote buffer size to 128KB Intel platforms are transitioning from traditional SGX-based attestation toward DICE-based attestation as part of a broader move toward open and standardized attestation models. DICE enables layered and extensible attestation, where evidence is accumulated across multiple boot stages. With SGX-based attestation, Quote sizes are typically under 8KB, as the payload consists primarily of Quote data and a small certificate bundle. Existing TDX guest code sizes the Quote buffer accordingly. DICE-based attestation produces significantly larger Quotes due to the inclusion of evidence (certificate chains) from multiple boot layers. The cumulative Quote size can reach approximately 100KB. Increase GET_QUOTE_BUF_SIZE to 128KB to ensure sufficient buffer capacity for DICE-based Quote payloads. Reviewed-by: Fang Peter Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20260211001712.1531955-4-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Dan Williams commit e2071f9ce42b6985a40feaf98d2f5f7ce0fca006 Author: Srish Srinivasan Date: Sun Feb 1 22:23:44 2026 +0530 powerpc/pseries: plpks: export plpks_wrapping_is_supported Building trusted-keys as a module fails modpost with: ERROR: modpost: "plpks_wrapping_is_supported" [security/keys/trusted-keys/ trusted.ko] undefined! Export plpks_wrapping_is_supported() so trusted-keys links cleanly This patch is intended to be applied on top of the earlier "Extend "trusted " keys to support a new trust source named the PowerVM Key Wrapping Module (PKWM)" series (v5). Link: https://lore.kernel.org/all/20260127145228.48320-1-ssrish@linux.ibm.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602010724.1g9hbLKv-lkp@intel.com/ Signed-off-by: Srish Srinivasan Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260201165344.950870-1-ssrish@linux.ibm.com commit 75b2a603671f9b649abe6b8e0d7662ea8c9f3c51 Merge: d1953aa3bc9237 4992ed7813c54f Author: Linus Torvalds Date: Tue Feb 10 18:23:47 2026 -0800 Merge tag 'x86_bugs_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 bug documentation update from Borislav Petkov: - Add EPERM to the possible PR_SET_SPECULATION_CTRL pr_ctl() error codes to "legitimize" it * tag 'x86_bugs_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation/x86: Fix PR_SET_SPECULATION_CTRL error codes commit d1953aa3bc92379be10b10b3bcceba1550bfbf6a Merge: 14c357c4add8b2 a4233c21e77375 Author: Linus Torvalds Date: Tue Feb 10 18:22:04 2026 -0800 Merge tag 'x86_alternatives_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 alternatives update from Borislav Petkov: - Reorganize the alternatives patching mechanism to patch a single location only once instead of multiple times as it was the case with the two or three alternative options macros * tag 'x86_alternatives_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/alternative: Patch a single alternative location only once x86/alternative: Use helper functions for patching alternatives commit 9342bf3d670b1b3d3cfc77a9dc1cd0d6574e5cc6 Author: Kuppuswamy Sathyanarayanan Date: Tue Feb 10 16:17:11 2026 -0800 configfs-tsm-report: Increase TSM_REPORT_OUTBLOB_MAX to 16MB Confidential Computing (CoCo) attestation is evolving toward standardized models such as DICE (Device Identifier Composition Engine) and Post-Quantum Cryptography (PQC), which rely on layered certificate chains and larger cryptographic signatures. A typical PQC certificate can range from 5KB to 15KB, and DICE-based architectures accumulate these certificates across multiple boot stages. In such configurations, the total attestation evidence can reach several megabytes, exceeding the current 32KB limit. Increase TSM_REPORT_OUTBLOB_MAX to 16MB to accommodate these larger certificate chains. This provides sufficient headroom to handle evolving requirements without requiring frequent updates to the limit. TSM_REPORT_OUTBLOB_MAX is used by the configfs read interface to cap the maximum allowed binary blob size for outblob, auxblob and manifestblob attributes. Hence, the per-open-file worst case memory allocation increases from 32KB to 16MB. Multiple concurrent readers multiply this cost (e.g., N readers of an M-byte blob incur NxM bytes of vmalloc-backed memory). However, allocations are performed on demand and remain proportional to the actual blob length, not the configured maximum. Reviewed-by: Fang Peter Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20260211001712.1531955-3-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Dan Williams commit 5f486958bfae4e2059a26b947661a60efedd092d Author: Kuppuswamy Sathyanarayanan Date: Tue Feb 10 16:17:10 2026 -0800 configfs-tsm-report: Document size limits for outblob attributes The configfs-tsm-report interface can fail with -EFBIG when the attestation report generated by a TSM provider exceeds internal maximums (TSM_REPORT_OUTBLOB_MAX). However, this error condition and its handling are not currently documented in the ABI. Userspace tools need to understand how to interpret various error conditions when reading attestation reports. Document that reads fail with -EFBIG when reports exceed size limits, with guidance on how to resolve them. Reviewed-by: Fang Peter Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20260211001712.1531955-2-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Dan Williams commit 14c357c4add8b2a213f291230c5bf485cffb9db6 Merge: 2619c62b7ef2f4 5b115dccdc8612 Author: Linus Torvalds Date: Tue Feb 10 18:14:36 2026 -0800 Merge tag 'edac_updates_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - Remove two drivers for obsolete hardware: i82443bxgx_edac and r82600_edac - Add support for Intel Amston Lake and Panther Lake-H SoCs to igen6_edac - The usual amount of fixes and cleanups * tag 'edac_updates_for_v7.0_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/r82600: Remove this obsolete driver EDAC/i82443bxgx: Remove driver that has been marked broken since 2007 EDAC/amd64: Avoid a -Wformat-security warning RAS/AMD/ATL: Remove an unneeded semicolon EDAC/igen6: Add more Intel Panther Lake-H SoCs support EDAC/igen6: Make masks of {MCHBAR, TOM, TOUUD, ECC_ERROR_LOG} configurable EDAC/igen6: Add two Intel Amston Lake SoCs support EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() commit 2619c62b7ef2f463bcbbb34af122689c09855c23 Merge: f1c538ca810077 d441e38a2c8782 Author: Linus Torvalds Date: Tue Feb 10 17:39:08 2026 -0800 Merge tag 'x86-irq-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 irq updates from Thomas Gleixner: "Trivial cleanups for the posted MSI interrupt handling" * tag 'x86-irq-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/irq_remapping: Sanitize posted_msi_supported() x86/irq: Cleanup posted MSI code commit f1c538ca8100776c089b4a682202bea1332a8cb3 Merge: 353a7e8a690585 546e9289c74f60 Author: Linus Torvalds Date: Tue Feb 10 17:02:23 2026 -0800 Merge tag 'timers-vdso-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull VDSO updates from Thomas Gleixner: - Provide the missing 64-bit variant of clock_getres() This allows the extension of CONFIG_COMPAT_32BIT_TIME to the vDSO and finally the removal of 32-bit time types from the kernel and UAPI. - Remove the useless and broken getcpu_cache from the VDSO The intention was to provide a trivial way to retrieve the CPU number from the VDSO, but as the VDSO data is per process there is no way to make it work. - Switch get/put_unaligned() from packed struct to memcpy() The packed struct violates strict aliasing rules which requires to pass -fno-strict-aliasing to the compiler. As this are scalar values __builtin_memcpy() turns them into simple loads and stores - Use __typeof_unqual__() for __unqual_scalar_typeof() The get/put_unaligned() changes triggered a new sparse warning when __beNN types are used with get/put_unaligned() as sparse builds add a special 'bitwise' attribute to them which prevents sparse to evaluate the Generic in __unqual_scalar_typeof(). Newer sparse versions support __typeof_unqual__() which avoids the problem, but requires a recent sparse install. So this adds a sanity check to sparse builds, which validates that sparse is available and capable of handling it. - Force inline __cvdso_clock_getres_common() Compilers sometimes un-inline agressively, which results in function call overhead and problems with automatic stack variable initialization. Interestingly enough the force inlining results in smaller code than the un-inlined variant produced by GCC when optimizing for size. * tag 'timers-vdso-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: vdso/gettimeofday: Force inlining of __cvdso_clock_getres_common() x86/percpu: Make CONFIG_USE_X86_SEG_SUPPORT work with sparse compiler: Use __typeof_unqual__() for __unqual_scalar_typeof() powerpc/vdso: Provide clock_getres_time64() tools headers: Remove unneeded ignoring of warnings in unaligned.h tools headers: Update the linux/unaligned.h copy with the kernel sources vdso: Switch get/put_unaligned() from packed struct to memcpy() parisc: Inline a type punning version of get_unaligned_le32() vdso: Remove struct getcpu_cache MIPS: vdso: Provide getres_time64() for 32-bit ABIs arm64: vdso32: Provide clock_getres_time64() ARM: VDSO: Provide clock_getres_time64() ARM: VDSO: Patch out __vdso_clock_getres() if unavailable x86/vdso: Provide clock_getres_time64() for x86-32 selftests: vDSO: vdso_test_abi: Add test for clock_getres_time64() selftests: vDSO: vdso_test_abi: Use UAPI system call numbers selftests: vDSO: vdso_config: Add configurations for clock_getres_time64() vdso: Add prototype for __vdso_clock_getres_time64() commit 353a7e8a69058591c3ec40028063af798b698559 Merge: 48295ab42dae91 24989330fb9918 Author: Linus Torvalds Date: Tue Feb 10 16:41:59 2026 -0800 Merge tag 'timers-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer core updates from Thomas Gleixner: - Inline timecounter_cyc2time() as that is now used in the networking hotpath. Inlining it significantly improves performance. - Optimize the tick dependency check in case that the tracepoint is disabled, which improves the hotpath performance in the tick management code, which is a hotpath on transitions in and out of idle. - The usual cleanups and improvements * tag 'timers-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time/kunit: Document handling of negative years of is_leap() tick/nohz: Optimize check_tick_dependency() with early return time/sched_clock: Use ACCESS_PRIVATE() to evaluate hrtimer::function hrtimer: Drop _tv64() helpers hrtimer: Remove public definition of HIGH_RES_NSEC hrtimer: Remove unused resolution constants time/timecounter: Inline timecounter_cyc2time() commit 48295ab42dae91b6903221adf1c316f08ffa5e09 Merge: 3381d7b2b3dd01 7eaf8e32de5f4e Author: Linus Torvalds Date: Tue Feb 10 16:37:54 2026 -0800 Merge tag 'timers-clocksource-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull clocksource updates from Thomas Gleixner: "A rather small set of boring cleanups, fixes and improvements" * tag 'timers-clocksource-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/drivers/mips-gic-timer: Move GIC timer to request_percpu_irq() clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock. clocksource/drivers/armada-370-xp: Fix dead link to timer binding clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF clocksource/drivers/sh_tmu: Always leave device running after probe commit 3381d7b2b3dd012d366b9ba9339f98d54bea69fd Merge: dc855b77719fe4 cb9b6f9d2be6bd Author: Linus Torvalds Date: Tue Feb 10 16:30:29 2026 -0800 Merge tag 'irq-msi-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull MSI updates from Thomas Gleixner: "Updates for the [PCI] MSI subsystem: - Add interrupt redirection infrastructure Some PCI controllers use a single demultiplexing interrupt for the MSI interrupts of subordinate devices. This prevents setting the interrupt affinity of device interrupts, which causes device interrupts to be delivered to a single CPU. That obviously is counterproductive for multi-queue devices and interrupt balancing. To work around this limitation the new infrastructure installs a dummy irq_set_affinity() callback which captures the affinity mask and picks a redirection target CPU out of the mask. When the PCI controller demultiplexes the interrupts it invokes a new handling function in the core, which either runs the interrupt handler in the context of the target CPU or delegates it to irq_work on the target CPU. - Utilize the interrupt redirection mechanism in the PCI DWC host controller driver. This allows affinity control for the subordinate device MSI interrupts instead of being randomly executed on the CPU which runs the demultiplex handler. - Replace the binary 64-bit MSI flag with a DMA mask Some PCI devices have PCI_MSI_FLAGS_64BIT in the MSI capability, but implement less than 64 address bits. This breaks on platforms where such a device is assigned an MSI address higher than what's supported. With the binary 64-bit flag there is no other choice than disabling 64-bit MSI support which leaves the device disfunctional. By using a DMA mask the address limit of a device can be described correctly which provides support for the above scenario. - Make use of the DMA mask based address limit in the hda/intel and radeon drivers to enable them on affected platforms - The usual small cleanups and improvements" * tag 'irq-msi-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: ALSA: hda/intel: Make MSI address limit based on the device DMA limit drm/radeon: Make MSI address limit based on the device DMA limit PCI/MSI: Check the device specific address mask in msi_verify_entries() PCI/MSI: Convert the boolean no_64bit_msi flag to a DMA address mask genirq/redirect: Prevent writing MSI message on affinity change PCI/MSI: Unmap MSI-X region on error genirq: Update effective affinity for redirected interrupts PCI: dwc: Enable MSI affinity support PCI: dwc: Code cleanup genirq: Add interrupt redirection infrastructure genirq/msi: Correct kernel-doc in commit dc855b77719fe452d670cae2cf64da1eb51f16cc Merge: 66bbe4a8ed73f1 6054b10c328813 Author: Linus Torvalds Date: Tue Feb 10 14:01:40 2026 -0800 Merge tag 'irq-drivers-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq chip driver updates from Thomas Gleixner: - Add support for the Renesas RZ/V2N SoC - Add a new driver for the Renesas RZ/[TN]2H SoCs - Preserve the register state of the RISCV APLIC interrupt controller accross suspend/resume - Reinitialize the RISCV IMSIC registers after suspend/resume - Make the various Loongson interrupt chip drivers 32/64-bit aware - Handle the number of hardware interrupts in the SIFIVE PLIC driver correctly The hardware interrupt 0 is reserved which resulted in inconsistent accounting. That went unnoticed as the off by one is only noticable when the number of device interrupts is a multiple of 32 - The usual device tree updates, cleanups and improvements all over the place * tag 'irq-drivers-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits) irqchip/gic-v5: Fix spelling mistake "ouside" -> "outside" dt-bindings: interrupt-controller: sifive,plic: Clarify the riscv,ndev meaning in PLIC irqchip/sifive-plic: Handle number of hardware interrupts correctly irqchip/aspeed-scu-ic: Remove unused variable mask irqchip/ti-sci-intr: Allow parsing interrupt-types per-line dt-bindings: interrupt-controller: ti,sci-intr: Per-line interrupt-types irqchip/renesas-rzv2h: Add suspend/resume support irqchip/aslint-sswi: Fix error check of of_io_request_and_map() result irqchip: Allow LoongArch irqchip drivers on both 32BIT/64BIT irqchip/loongson-pch-pic: Adjust irqchip driver for 32BIT/64BIT irqchip/loongson-pch-msi: Adjust irqchip driver for 32BIT/64BIT irqchip/loongson-htvec: Adjust irqchip driver for 32BIT/64BIT irqchip/loongson-eiointc: Adjust irqchip driver for 32BIT/64BIT irqchip/loongson-liointc: Adjust irqchip driver for 32BIT/64BIT irqchip/loongarch-avec: Adjust irqchip driver for 32BIT/64BIT irqchip/riscv-aplic: Preserve APLIC states across suspend/resume irqchip/riscv-imsic: Add a CPU pm notifier to restore the IMSIC on exit arm64: dts: renesas: r9a09g087: Add ICU support arm64: dts: renesas: r9a09g077: Add ICU support irqchip: Add RZ/{T2H,N2H} Interrupt Controller (ICU) driver ... commit 66bbe4a8ed73f1187a4271c58f0ea30f42debe0d Merge: 4e21e585b65b2d 2dfc417414c6ee Author: Linus Torvalds Date: Tue Feb 10 13:39:37 2026 -0800 Merge tag 'irq-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq core updates from Thomas Gleixner: "Updates for the interrupt core subsystem: - Remove the interrupt timing infrastructure This was added seven years ago to be used for power management purposes, but that integration never happened. - Clean up the remaining setup_percpu_irq() users The memory allocator is available when interrupts can be requested so there is not need for static irq_action. Move the remaining users to request_percpu_irq() and delete the historical cruft. - Warn when interrupt flag inconsistencies are detected in request*_irq(). Inconsistent flags can lead to hard to diagnose malfunction. The fallout of this new warning has been addressed in next and the fixes are coming in via the maintainer trees and the tip irq/cleanup pull requests. - Invoke affinity notifier when CPU hotplug breaks affinity Otherwise the code using the notifier misses the affinity change and operates on stale information. - The usual cleanups and improvements" * tag 'irq-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq/proc: Replace snprintf with strscpy in register_handler_proc genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask genirq: Move clear of kstat_irqs to free_desc() genirq: Warn about using IRQF_ONESHOT without a threaded handler irqdomain: Fix up const problem in irq_domain_set_name() genirq: Remove setup_percpu_irq() clocksource/drivers/mips-gic-timer: Move GIC timer to request_percpu_irq() MIPS: Move IP27 timer to request_percpu_irq() MIPS: Move IP30 timer to request_percpu_irq() genirq: Remove __request_percpu_irq() helper genirq: Remove IRQ timing tracking infrastructure commit 4e21e585b65b2d47f7ccb95120e7bb37a08d7d0e Merge: a4d963b9d6eead ef92b98f5f6758 Author: Linus Torvalds Date: Tue Feb 10 13:22:50 2026 -0800 Merge tag 'irq-cleanups-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq cleanups from Thomas Gleixner: "A series of treewide cleanups to ensure interrupt request consistency. - Add the missing IRQF_COND_ONESHOT flag to devm_request_irq() This is inconsistent vs request_irq() and causes the same issues which where addressed with the introduction of this flag - Cleanup IRQF_ONESHOT and IRQF_NO_THREAD usage Quite some drivers have inconsistent interrupt request flags related to interrupt threading namely IRQF_ONESHOT and IRQF_NO_THREAD. This leads to warnings and/or malfunction when forced interrupt threading is enabled. - Remove stub primary (hard interrupt) handlers A bunch of drivers implement a stub primary (hard interrupt) handler which just returns IRQ_WAKE_THREAD. The same functionality is provided by the core code when the primary handler argument of request_thread_irq() is set to NULL" * tag 'irq-cleanups-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: media: pci: mg4b: Use IRQF_NO_THREAD mfd: wm8350-core: Use IRQF_ONESHOT thermal/qcom/lmh: Replace IRQF_ONESHOT with IRQF_NO_THREAD rtc: amlogic-a4: Remove IRQF_ONESHOT usb: typec: fusb302: Remove IRQF_ONESHOT EDAC/altera: Remove IRQF_ONESHOT char: tpm: cr50: Remove IRQF_ONESHOT ARM: versatile: Remove IRQF_ONESHOT scsi: efct: Use IRQF_ONESHOT and default primary handler Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler bus: fsl-mc: Use default primary handler mailbox: bcm-ferxrm-mailbox: Use default primary handler iommu/amd: Use core's primary handler and set IRQF_ONESHOT platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). commit a4d963b9d6eead4cbd4b702832acf2921189a692 Merge: b490d2a83f5daf ac059ae422d7d0 Author: Linus Torvalds Date: Tue Feb 10 13:21:11 2026 -0800 Merge tag 'x86-platform-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform update from Ingo MolnarL - x86/hyperv: Fix smp_ops build failure on UP kernels (Ingo Molnar) * tag 'x86-platform-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/hyperv: Fix smp_ops build failure on UP kernels commit b490d2a83f5daf0c2c928a3efa865bae8e705cf8 Merge: 3516cadc70a742 f8c7600d468bdb Author: Linus Torvalds Date: Tue Feb 10 13:17:58 2026 -0800 Merge tag 'x86-cpu-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu updates from Ingo Molnar: - CPU model updates (Andrew Cooper): - amd: Correct the microcode table for Zenbleed - amd: Use ZEN_MODEL_STEP_UCODE() for erratum_1386_microcode[] - Drop vestigial PBE logic in AMD/Hygon/Centaur/Cyrix - tsx: Set default TSX mode to auto (Nikolay Borisov) - Drop unused Kconfig symbol X86_P6_NOP (Randy Dunlap) * tag 'x86-cpu-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tsx: Set default TSX mode to auto x86/cpu: Drop unused Kconfig symbol X86_P6_NOP x86/cpu: Drop vestigial PBE logic in AMD/Hygon/Centaur/Cyrix x86/cpu/amd: Use ZEN_MODEL_STEP_UCODE() for erratum_1386_microcode[] x86/cpu/amd: Correct the microcode table for Zenbleed commit 3516cadc70a742ab2a08b17d3176d242945bd12d Merge: 5668a64622cf23 9bad74127f0ae8 Author: Linus Torvalds Date: Tue Feb 10 13:16:09 2026 -0800 Merge tag 'x86-apic-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 APIC update from Ingo Molnar: - Inline __x2apic_send_IPI_dest() (Eric Dumazet) * tag 'x86-apic-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Inline __x2apic_send_IPI_dest() commit 5668a64622cf238ea954ea71cf2bed60967dba16 Merge: 36ae1c45b2cede 2a11e1479ef075 Author: Linus Torvalds Date: Tue Feb 10 13:12:54 2026 -0800 Merge tag 'x86-boot-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86/boot updates from Ingo Molnar: - x86/acpi: Add acpi=spcr to use SPCR-provided default console (Shenghao Yang) - x86/acpi/boot: Correct the acpi_is_processor_usable() check again (Yazen Ghannam) - Refresh the x86 memory map (e820 table) handling code, and make the printouts a bit more informative (Ingo Molnar) * tag 'x86-boot-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits) x86/acpi: Add acpi=spcr to use SPCR-provided default console x86/boot/e820: Use symbols for literals x86/boot/e820: Make sure e820_search_gap() finds all gaps x86/boot/e820: Simplify the e820__range_remove() API x86/boot/e820: Remove e820__range_remove()'s unused return parameter x86/boot/e820: Simplify append_e820_table() and remove restriction on single-entry tables x86/boot/e820: Standardize __init/__initdata tag placement x86/boot/e820: Simplify & clarify __e820__range_add() a bit x86/boot/e820: Rename gap_start/gap_size to max_gap_start/max_gap_start in e820_search_gap() et al x86/boot/e820: Change e820_search_gap() to search for the highest-address PCI gap x86/boot/e820: Clean up e820__setup_pci_gap()/e820_search_gap() a bit x86/boot/e820: Change struct e820_table::nr_entries type from __u32 to u32 x86/boot/e820: Standardize e820 table index variable types under 'u32' x86/boot/e820: Standardize e820 table index variable names under 'idx' x86/boot/e820: Remove unnecessary header inclusions x86/boot/e820: Clean up __refdata use a bit x86/boot/e820: Clean up __e820__range_add() a bit x86/boot/e820: Improve e820_print_type() messages x86/boot/e820: Clean up confusing and self-contradictory verbiage around E820 related resource allocations x86/boot/e820: Remove pointless early_panic() indirection ... commit 52190933c37a96164b271f3f30c16099d9eb8c09 Author: Chao Yu Date: Wed Feb 4 11:05:01 2026 +0800 f2fs: sysfs: introduce critical_task_priority This patch introduces /sys/fs/f2fs//critical_task_priority, w/ this new sysfs interface, we can tune priority of f2fs_ckpt thread and f2fs_gc thread. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 36ae1c45b2cede43ab2fc679b450060bbf119f1b Merge: 0923fd0419a1a2 e34881c84c255b Author: Linus Torvalds Date: Tue Feb 10 12:50:10 2026 -0800 Merge tag 'sched-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Scheduler Kconfig space updates: - Further consolidate configurable preemption modes (Peter Zijlstra) Reduce the number of architectures that are allowed to offer PREEMPT_NONE and PREEMPT_VOLUNTARY, reducing the number of preemption models from four to just two: 'full' and 'lazy' on up-to-date architectures (arm64, loongarch, powerpc, riscv, s390, x86). None and voluntary are only available as legacy features on platforms that don't implement lazy preemption yet, or which don't even support preemption. The goal is to eventually remove cond_resched() and voluntary preemption altogether. RSEQ based 'scheduler time slice extension' support (Thomas Gleixner and Peter Zijlstra): This allows a thread to request a time slice extension when it enters a critical section to avoid contention on a resource when the thread is scheduled out inside of the critical section. - Add fields and constants for time slice extension - Provide static branch for time slice extensions - Add statistics for time slice extensions - Add prctl() to enable time slice extensions - Implement sys_rseq_slice_yield() - Implement syscall entry work for time slice extensions - Implement time slice extension enforcement timer - Reset slice extension when scheduled - Implement rseq_grant_slice_extension() - entry: Hook up rseq time slice extension - selftests: Implement time slice extension test - Allow registering RSEQ with slice extension - Move slice_ext_nsec to debugfs - Lower default slice extension - selftests/rseq: Add rseq slice histogram script Scheduler performance/scalability improvements: - Update rq->avg_idle when a task is moved to an idle CPU, which improves the scalability of various workloads (Shubhang Kaushik) - Reorder fields in 'struct rq' for better caching (Blake Jones) - Fair scheduler SMP NOHZ balancing code speedups (Shrikanth Hegde): - Move checking for nohz cpus after time check - Change likelyhood of nohz.nr_cpus - Remove nohz.nr_cpus and use weight of cpumask instead - Avoid false sharing for sched_clock_irqtime (Wangyang Guo) - Cleanups (Yury Norov): - Drop useless cpumask_empty() in find_energy_efficient_cpu() - Simplify task_numa_find_cpu() - Use cpumask_weight_and() in sched_balance_find_dst_group() DL scheduler updates: - Add a deadline server for sched_ext tasks (by Andrea Righi and Joel Fernandes, with fixes by Peter Zijlstra) RT scheduler updates: - Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang) Entry code updates and performance improvements (Jinjie Ruan) This is part of the scheduler tree in this cycle due to inter- dependencies with the RSEQ based time slice extension work: - Remove unused syscall argument from syscall_trace_enter() - Rework syscall_exit_to_user_mode_work() for architecture reuse - Add arch_ptrace_report_syscall_entry/exit() - Inline syscall_exit_work() and syscall_trace_enter() Scheduler core updates (Peter Zijlstra): - Rework sched_class::wakeup_preempt() and rq_modified_*() - Avoid rq->lock bouncing in sched_balance_newidle() - Rename rcu_dereference_check_sched_domain() => rcu_dereference_sched_domain() - : Add the __signed_scalar_typeof() helper Fair scheduler updates/refactoring (Peter Zijlstra and Ingo Molnar): - Fold the sched_avg update - Change rcu_dereference_check_sched_domain() to rcu-sched - Switch to rcu_dereference_all() - Remove superfluous rcu_read_lock() - Limit hrtick work - Join two #ifdef CONFIG_FAIR_GROUP_SCHED blocks - Clean up comments in 'struct cfs_rq' - Separate se->vlag from se->vprot - Rename cfs_rq::avg_load to cfs_rq::sum_weight - Rename cfs_rq::avg_vruntime to ::sum_w_vruntime & helper functions - Introduce and use the vruntime_cmp() and vruntime_op() wrappers for wrapped-signed aritmetics - Sort out 'blocked_load*' namespace noise Scheduler debugging code updates: - Export hidden tracepoints to modules (Gabriele Monaco) - Convert copy_from_user() + kstrtouint() to kstrtouint_from_user() (Fushuai Wang) - Add assertions to QUEUE_CLASS (Peter Zijlstra) - hrtimer: Fix tracing oddity (Thomas Gleixner) Misc fixes and cleanups: - Re-evaluate scheduling when migrating queued tasks out of throttled cgroups (Zicheng Qu) - Remove task_struct->faults_disabled_mapping (Christoph Hellwig) - Fix math notation errors in avg_vruntime comment (Zhan Xusheng) - sched/cpufreq: Use %pe format for PTR_ERR() printing (zenghongling)" * tag 'sched-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (64 commits) sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups sched/cpufreq: Use %pe format for PTR_ERR() printing sched/rt: Skip currently executing CPU in rto_next_cpu() sched/clock: Avoid false sharing for sched_clock_irqtime selftests/sched_ext: Add test for DL server total_bw consistency selftests/sched_ext: Add test for sched_ext dl_server sched/debug: Fix dl_server (re)start conditions sched/debug: Add support to change sched_ext server params sched_ext: Add a DL server for sched_ext tasks sched/debug: Stop and start server based on if it was active sched/debug: Fix updating of ppos on server write ops sched/deadline: Clear the defer params entry: Inline syscall_exit_work() and syscall_trace_enter() entry: Add arch_ptrace_report_syscall_entry/exit() entry: Rework syscall_exit_to_user_mode_work() for architecture reuse entry: Remove unused syscall argument from syscall_trace_enter() sched: remove task_struct->faults_disabled_mapping sched: Update rq->avg_idle when a task is moved to an idle CPU selftests/rseq: Add rseq slice histogram script hrtimer: Fix trace oddity ... commit 0923fd0419a1a2c8846e15deacac11b619e996d9 Merge: 4d84667627c4ff 7a562d5d2396c9 Author: Linus Torvalds Date: Tue Feb 10 12:28:44 2026 -0800 Merge tag 'locking-core-2026-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Lock debugging: - Implement compiler-driven static analysis locking context checking, using the upcoming Clang 22 compiler's context analysis features (Marco Elver) We removed Sparse context analysis support, because prior to removal even a defconfig kernel produced 1,700+ context tracking Sparse warnings, the overwhelming majority of which are false positives. On an allmodconfig kernel the number of false positive context tracking Sparse warnings grows to over 5,200... On the plus side of the balance actual locking bugs found by Sparse context analysis is also rather ... sparse: I found only 3 such commits in the last 3 years. So the rate of false positives and the maintenance overhead is rather high and there appears to be no active policy in place to achieve a zero-warnings baseline to move the annotations & fixers to developers who introduce new code. Clang context analysis is more complete and more aggressive in trying to find bugs, at least in principle. Plus it has a different model to enabling it: it's enabled subsystem by subsystem, which results in zero warnings on all relevant kernel builds (as far as our testing managed to cover it). Which allowed us to enable it by default, similar to other compiler warnings, with the expectation that there are no warnings going forward. This enforces a zero-warnings baseline on clang-22+ builds (Which are still limited in distribution, admittedly) Hopefully the Clang approach can lead to a more maintainable zero-warnings status quo and policy, with more and more subsystems and drivers enabling the feature. Context tracking can be enabled for all kernel code via WARN_CONTEXT_ANALYSIS_ALL=y (default disabled), but this will generate a lot of false positives. ( Having said that, Sparse support could still be added back, if anyone is interested - the removal patch is still relatively straightforward to revert at this stage. ) Rust integration updates: (Alice Ryhl, Fujita Tomonori, Boqun Feng) - Add support for Atomic and replace most Rust native AtomicBool usages with Atomic - Clean up LockClassKey and improve its documentation - Add missing Send and Sync trait implementation for SetOnce - Make ARef Unpin as it is supposed to be - Add __rust_helper to a few Rust helpers as a preparation for helper LTO - Inline various lock related functions to avoid additional function calls WW mutexes: - Extend ww_mutex tests and other test-ww_mutex updates (John Stultz) Misc fixes and cleanups: - rcu: Mark lockdep_assert_rcu_helper() __always_inline (Arnd Bergmann) - locking/local_lock: Include more missing headers (Peter Zijlstra) - seqlock: fix scoped_seqlock_read kernel-doc (Randy Dunlap) - rust: sync: Replace `kernel::c_str!` with C-Strings (Tamir Duberstein)" * tag 'locking-core-2026-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (90 commits) locking/rwlock: Fix write_trylock_irqsave() with CONFIG_INLINE_WRITE_TRYLOCK rcu: Mark lockdep_assert_rcu_helper() __always_inline compiler-context-analysis: Remove __assume_ctx_lock from initializers tomoyo: Use scoped init guard crypto: Use scoped init guard kcov: Use scoped init guard compiler-context-analysis: Introduce scoped init guards cleanup: Make __DEFINE_LOCK_GUARD handle commas in initializers seqlock: fix scoped_seqlock_read kernel-doc tools: Update context analysis macros in compiler_types.h rust: sync: Replace `kernel::c_str!` with C-Strings rust: sync: Inline various lock related methods rust: helpers: Move #define __rust_helper out of atomic.c rust: wait: Add __rust_helper to helpers rust: time: Add __rust_helper to helpers rust: task: Add __rust_helper to helpers rust: sync: Add __rust_helper to helpers rust: refcount: Add __rust_helper to helpers rust: rcu: Add __rust_helper to helpers rust: processor: Add __rust_helper to helpers ... commit 4d84667627c4ff70826b349c449bbaf63b9af4e5 Merge: a9aabb3b839aba 7db06e329af30d Author: Linus Torvalds Date: Tue Feb 10 12:00:46 2026 -0800 Merge tag 'perf-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull performance event updates from Ingo Molnar: "x86 PMU driver updates: - Add support for the core PMU for Intel Diamond Rapids (DMR) CPUs (Dapeng Mi) Compared to previous iterations of the Intel PMU code, there's been a lot of changes, which center around three main areas: - Introduce the OFF-MODULE RESPONSE (OMR) facility to replace the Off-Core Response (OCR) facility - New PEBS data source encoding layout - Support the new "RDPMC user disable" feature - Likewise, a large series adds uncore PMU support for Intel Diamond Rapids (DMR) CPUs (Zide Chen) This centers around these four main areas: - DMR may have two Integrated I/O and Memory Hub (IMH) dies, separate from the compute tile (CBB) dies. Each CBB and each IMH die has its own discovery domain. - Unlike prior CPUs that retrieve the global discovery table portal exclusively via PCI or MSR, DMR uses PCI for IMH PMON discovery and MSR for CBB PMON discovery. - DMR introduces several new PMON types: SCA, HAMVF, D2D_ULA, UBR, PCIE4, CRS, CPC, ITC, OTC, CMS, and PCIE6. - IIO free-running counters in DMR are MMIO-based, unlike SPR. - Also add support for Add missing PMON units for Intel Panther Lake, and support Nova Lake (NVL), which largely maps to Panther Lake. (Zide Chen) - KVM integration: Add support for mediated vPMUs (by Kan Liang and Sean Christopherson, with fixes and cleanups by Peter Zijlstra, Sandipan Das and Mingwei Zhang) - Add Intel cstate driver to support for Wildcat Lake (WCL) CPUs, which are a low-power variant of Panther Lake (Zide Chen) - Add core, cstate and MSR PMU support for the Airmont NP Intel CPU (aka MaxLinear Lightning Mountain), which maps to the existing Airmont code (Martin Schiller) Performance enhancements: - Speed up kexec shutdown by avoiding unnecessary cross CPU calls (Jan H. Schönherr) - Fix slow perf_event_task_exit() with LBR callstacks (Namhyung Kim) User-space stack unwinding support: - Various cleanups and refactorings in preparation to generalize the unwinding code for other architectures (Jens Remus) Uprobes updates: - Transition from kmap_atomic to kmap_local_page (Keke Ming) - Fix incorrect lockdep condition in filter_chain() (Breno Leitao) - Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov) Misc fixes and cleanups: - s390: Remove kvm_types.h from Kbuild (Randy Dunlap) - x86/intel/uncore: Convert comma to semicolon (Chen Ni) - x86/uncore: Clean up const mismatch (Greg Kroah-Hartman) - x86/ibs: Fix typo in dc_l2tlb_miss comment (Xiang-Bin Shi)" * tag 'perf-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits) s390: remove kvm_types.h from Kbuild uprobes: Fix incorrect lockdep condition in filter_chain() x86/ibs: Fix typo in dc_l2tlb_miss comment x86/uprobes: Fix XOL allocation failure for 32-bit tasks perf/x86/intel/uncore: Convert comma to semicolon perf/x86/intel: Add support for rdpmc user disable feature perf/x86: Use macros to replace magic numbers in attr_rdpmc perf/x86/intel: Add core PMU support for Novalake perf/x86/intel: Add support for PEBS memory auxiliary info field in NVL perf/x86/intel: Add core PMU support for DMR perf/x86/intel: Add support for PEBS memory auxiliary info field in DMR perf/x86/intel: Support the 4 new OMR MSRs introduced in DMR and NVL perf/core: Fix slow perf_event_task_exit() with LBR callstacks perf/core: Speed up kexec shutdown by avoiding unnecessary cross CPU calls uprobes: use kmap_local_page() for temporary page mappings arm/uprobes: use kmap_local_page() in arch_uprobe_copy_ixol() mips/uprobes: use kmap_local_page() in arch_uprobe_copy_ixol() arm64/uprobes: use kmap_local_page() in arch_uprobe_copy_ixol() riscv/uprobes: use kmap_local_page() in arch_uprobe_copy_ixol() perf/x86/intel/uncore: Add Nova Lake support ... commit a9aabb3b839aba094ed80861054993785c61462c Merge: f144367d012929 b8d687c7eeb52d Author: Linus Torvalds Date: Tue Feb 10 11:53:01 2026 -0800 Merge tag 'rust-6.20-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rust updates from Miguel Ojeda: "Toolchain and infrastructure: - Add '__rust_helper' annotation to the C helpers This is needed to inline these helpers into Rust code - Remove imports available via the prelude, treewide This was possible thanks to a new lint in Klint that Gary has implemented -- more Klint-related changes, including initial upstream support, are coming - Deduplicate pin-init flags 'kernel' crate: - Add support for calling a function exactly once with the new 'do_once_lite!' macro (and 'OnceLite' type) Based on this, add 'pr_*_once!' macros to print only once - Add 'impl_flags!' macro for defining common bitflags operations: impl_flags!( /// Represents multiple permissions. #[derive(Debug, Clone, Default, Copy, PartialEq, Eq)] pub struct Permissions(u32); /// Represents a single permission. #[derive(Debug, Clone, Copy, PartialEq, Eq)] pub enum Permission { /// Read permission. Read = 1 << 0, /// Write permission. Write = 1 << 1, /// Execute permission. Execute = 1 << 2, } ); let mut f: Permissions = Permission::Read | Permission::Write; assert!(f.contains(Permission::Read)); assert!(!f.contains(Permission::Execute)); f |= Permission::Execute; assert!(f.contains(Permission::Execute)); let f2: Permissions = Permission::Write | Permission::Execute; assert!((f ^ f2).contains(Permission::Read)); assert!(!(f ^ f2).contains(Permission::Write)); - 'bug' module: support 'CONFIG_DEBUG_BUGVERBOSE_DETAILED' in the 'warn_on!' macro in order to show the evaluated condition alongside the file path: ------------[ cut here ]------------ WARNING: [val == 1] linux/samples/rust/rust_minimal.rs:27 at ... Modules linked in: rust_minimal(+) - Add safety module with 'unsafe_precondition_assert!' macro, currently a wrapper for 'debug_assert!', intended to mark the validation of safety preconditions where possible: /// # Safety /// /// The caller must ensure that `index` is less than `N`. unsafe fn set_unchecked(&mut self, index: usize, value: T) { unsafe_precondition_assert!( index < N, "set_unchecked() requires index ({index}) < N ({N})" ); ... } - Add instructions to 'build_assert!' documentation requesting to always inline functions when used with function arguments - 'ptr' module: replace 'build_assert!' with a 'const' one - 'rbtree' module: reduce unsafe blocks on pointer derefs - 'transmute' module: implement 'FromBytes' and 'AsBytes' for inhabited ZSTs, and use it in Nova - More treewide replacements of 'c_str!' with C string literals 'macros' crate: - Rewrite most procedural macros ('module!', 'concat_idents!', '#[export]', '#[vtable]', '#[kunit_tests]') to use the 'syn' parsing library which we introduced last cycle, with better diagnostics This also allows to support '#[cfg]' properly in the '#[vtable]' macro, to support arbitrary types in 'module!' macro (not just an identifier) and to remove several custom parsing helpers we had - Use 'quote!' from the recently vendored 'quote' library and remove our custom one The vendored one also allows us to avoid quoting '"' and '{}' inside the template anymore and editors can now highlight it. In addition, it improves robustness as it eliminates the need for string quoting and escaping - Use 'pin_init::zeroed()' to simplify KUnit code 'pin-init' crate: - Rewrite all procedural macros ('[pin_]init!', '#[pin_data]', '#[pinned_drop]', 'derive([Maybe]Zeroable)') to use the 'syn' parsing library which we introduced last cycle, with better diagnostics - Implement 'InPlaceWrite' for '&'static mut MaybeUninit'. This enables users to use external allocation mechanisms such as 'static_cell' - Support tuple structs in 'derive([Maybe]Zeroable)' - Support attributes on fields in '[pin_]init!' (such as '#[cfg(...)]') - Add a '#[default_error()]' attribute to '[pin_]init!' to override the default error (when no '? Error' is specified) - Support packed structs in '[pin_]init!' with '#[disable_initialized_field_access]' - Remove 'try_[pin_]init!' in favor of merging their feature with '[pin_]init!'. Update the kernel's own 'try_[pin_]init!' macros to use the 'default_error' attribute - Correct 'T: Sized' bounds to 'T: ?Sized' in the generated 'PinnedDrop' check by '#[pin_data]' Documentation: - Conclude the Rust experiment MAINTAINERS: - Add "RUST [RUST-ANALYZER]" entry for the rust-analyzer support. Tamir and Jesung will take care of it. They have both been active around it for a while. The new tree will flow through the Rust one - Add Gary as maintainer for "RUST [PIN-INIT]" - Update Boqun and Tamir emails to their kernel.org accounts And a few other cleanups and improvements" * tag 'rust-6.20-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (59 commits) rust: safety: introduce `unsafe_precondition_assert!` macro rust: add `impl_flags!` macro for defining common bitflag operations rust: print: Add pr_*_once macros rust: bug: Support DEBUG_BUGVERBOSE_DETAILED option rust: print: Add support for calling a function exactly once rust: kbuild: deduplicate pin-init flags gpu: nova-core: remove imports available via prelude rust: clk: replace `kernel::c_str!` with C-Strings MAINTAINERS: Update my email address to @kernel.org rust: macros: support `#[cfg]` properly in `#[vtable]` macro. rust: kunit: use `pin_init::zeroed` instead of custom null value rust: macros: rearrange `#[doc(hidden)]` in `module!` macro rust: macros: allow arbitrary types to be used in `module!` macro rust: macros: convert `#[kunit_tests]` macro to use `syn` rust: macros: convert `concat_idents!` to use `syn` rust: macros: convert `#[export]` to use `syn` rust: macros: use `quote!` for `module!` macro rust: macros: use `syn` to parse `module!` macro rust: macros: convert `#[vtable]` macro to use `syn` rust: macros: use `quote!` from vendored crate ... commit f144367d012929326f15a399394a9a8be4f98acb Merge: f17b474e36647c 6711069dd72fcb Author: Linus Torvalds Date: Tue Feb 10 11:39:45 2026 -0800 Merge tag 'bitmap-for-6.20' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: - more rust helpers (Alice) - more bitops tests (Ryota) - FIND_NTH_BIT() uninitialized variable fix (Lee Yongjun) - random cleanups (Andy, H. Peter) * tag 'bitmap-for-6.20' of https://github.com/norov/linux: lib/tests: extend KUnit test for bitops with more cases bitops: Add more files to the MAINTAINERS lib/find_bit: fix uninitialized variable use in FIND_NTH_BIT lib/tests: add KUnit test for bitops rust: cpumask: add __rust_helper to helpers rust: bitops: add __rust_helper to helpers rust: bitmap: add __rust_helper to helpers linux/bitfield.h: replace __auto_type with auto commit f17b474e36647c23801ef8fdaf2255ab66dd2973 Merge: a7423e6ea2f8f6 db975debcb8c4c Author: Linus Torvalds Date: Tue Feb 10 11:26:21 2026 -0800 Merge tag 'bpf-next-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Alexei Starovoitov: - Support associating BPF program with struct_ops (Amery Hung) - Switch BPF local storage to rqspinlock and remove recursion detection counters which were causing false positives (Amery Hung) - Fix live registers marking for indirect jumps (Anton Protopopov) - Introduce execution context detection BPF helpers (Changwoo Min) - Improve verifier precision for 32bit sign extension pattern (Cupertino Miranda) - Optimize BTF type lookup by sorting vmlinux BTF and doing binary search (Donglin Peng) - Allow states pruning for misc/invalid slots in iterator loops (Eduard Zingerman) - In preparation for ASAN support in BPF arenas teach libbpf to move global BPF variables to the end of the region and enable arena kfuncs while holding locks (Emil Tsalapatis) - Introduce support for implicit arguments in kfuncs and migrate a number of them to new API. This is a prerequisite for cgroup sub-schedulers in sched-ext (Ihor Solodrai) - Fix incorrect copied_seq calculation in sockmap (Jiayuan Chen) - Fix ORC stack unwind from kprobe_multi (Jiri Olsa) - Speed up fentry attach by using single ftrace direct ops in BPF trampolines (Jiri Olsa) - Require frozen map for calculating map hash (KP Singh) - Fix lock entry creation in TAS fallback in rqspinlock (Kumar Kartikeya Dwivedi) - Allow user space to select cpu in lookup/update operations on per-cpu array and hash maps (Leon Hwang) - Make kfuncs return trusted pointers by default (Matt Bobrowski) - Introduce "fsession" support where single BPF program is executed upon entry and exit from traced kernel function (Menglong Dong) - Allow bpf_timer and bpf_wq use in all programs types (Mykyta Yatsenko, Andrii Nakryiko, Kumar Kartikeya Dwivedi, Alexei Starovoitov) - Make KF_TRUSTED_ARGS the default for all kfuncs and clean up their definition across the tree (Puranjay Mohan) - Allow BPF arena calls from non-sleepable context (Puranjay Mohan) - Improve register id comparison logic in the verifier and extend linked registers with negative offsets (Puranjay Mohan) - In preparation for BPF-OOM introduce kfuncs to access memcg events (Roman Gushchin) - Use CFI compatible destructor kfunc type (Sami Tolvanen) - Add bitwise tracking for BPF_END in the verifier (Tianci Cao) - Add range tracking for BPF_DIV and BPF_MOD in the verifier (Yazhou Tang) - Make BPF selftests work with 64k page size (Yonghong Song) * tag 'bpf-next-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (268 commits) selftests/bpf: Fix outdated test on storage->smap selftests/bpf: Choose another percpu variable in bpf for btf_dump test selftests/bpf: Remove test_task_storage_map_stress_lookup selftests/bpf: Update task_local_storage/task_storage_nodeadlock test selftests/bpf: Update task_local_storage/recursion test selftests/bpf: Update sk_storage_omem_uncharge test bpf: Switch to bpf_selem_unlink_nofail in bpf_local_storage_{map_free, destroy} bpf: Support lockless unlink when freeing map or local storage bpf: Prepare for bpf_selem_unlink_nofail() bpf: Remove unused percpu counter from bpf_local_storage_map_free bpf: Remove cgroup local storage percpu counter bpf: Remove task local storage percpu counter bpf: Change local_storage->lock and b->lock to rqspinlock bpf: Convert bpf_selem_unlink to failable bpf: Convert bpf_selem_link_map to failable bpf: Convert bpf_selem_unlink_map to failable bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage selftests/xsk: fix number of Tx frags in invalid packet selftests/xsk: properly handle batch ending in the middle of a packet bpf: Prevent reentrance into call_rcu_tasks_trace() ... commit 9f16d96e1222391a6b996a1b676bec14fb91e3b2 Author: Ziyi Guo Date: Tue Feb 10 18:57:14 2026 +0000 ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() This reverts commit f51424872760 ("ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()"). The original patch attempted to acquire the card->controls_rwsem lock in fsl_xcvr_mode_put(). However, this function is called from the upper ALSA core function snd_ctl_elem_write(), which already holds the write lock on controls_rwsem for the whole put operation. So there is no need to simply hold the lock for fsl_xcvr_activate_ctl() again. Acquiring the read lock while holding the write lock in the same thread results in a deadlock and a hung task, as reported by Alexander Stein. Fixes: f51424872760 ("ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()") Reported-by: Alexander Stein Closes: https://lore.kernel.org/linux-sound/5056506.GXAFRqVoOG@steina-w/ Signed-off-by: Ziyi Guo Link: https://patch.msgid.link/20260210185714.556385-1-n7l8m4@u.northwestern.edu Signed-off-by: Mark Brown commit f14c94d21f3ffcd6652217c2c74a26b6ba9ad741 Merge: 5578da7d957fba 05f7e89ab97315 Author: Mark Brown Date: Tue Feb 10 19:23:02 2026 +0000 ASoC: Merge up release We need to fix some commits that went into the final release. commit 8f7df60fe063b6b8f039af1042a4b99214347dd1 Author: Arnd Bergmann Date: Tue Feb 10 23:30:00 2026 +0900 ksmbd: fix non-IPv6 build The newly added procfs code fails to build when CONFIG_IPv6 is disabled: fs/smb/server/connection.c: In function 'proc_show_clients': fs/smb/server/connection.c:47:58: error: 'struct ksmbd_conn' has no member named 'inet6_addr'; did you mean 'inet_addr'? 47 | seq_printf(m, "%-20pI6c", &conn->inet6_addr); | ^~~~~~~~~~ | inet_addr make[7]: *** [scripts/Makefile.build:279: fs/smb/server/connection.o] Error 1 fs/smb/server/mgmt/user_session.c: In function 'show_proc_sessions': fs/smb/server/mgmt/user_session.c:215:65: error: 'struct ksmbd_conn' has no member named 'inet6_addr'; did you mean 'inet_addr'? 215 | seq_printf(m, " %-40pI6c", &chan->conn->inet6_addr); | ^~~~~~~~~~ | inet_addr Rearrange the condition to allow adding a simple preprocessor conditional. Fixes: b38f99c1217a ("ksmbd: add procfs interface for runtime monitoring and statistics") Signed-off-by: Arnd Bergmann Acked-by: Namjae Jeon Signed-off-by: Steve French commit a7423e6ea2f8f6f453de79213c26f7a36c86d9a2 Merge: b63c9072034857 b68758e6f43071 Author: Linus Torvalds Date: Tue Feb 10 09:49:18 2026 -0800 Merge tag 'modules-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Sami Tolvanen: "Module signing: - Remove SHA-1 support for signing modules. SHA-1 is no longer considered secure for signatures due to vulnerabilities that can lead to hash collisions. None of the major distributions use SHA-1 anymore, and the kernel has defaulted to SHA-512 since v6.11. Note that loading SHA-1 signed modules is still supported. - Update scripts/sign-file to use only the OpenSSL CMS API for signing. As SHA-1 support is gone, we can drop the legacy PKCS#7 API which was limited to SHA-1. This also cleans up support for legacy OpenSSL versions. Cleanups and fixes: - Use system_dfl_wq instead of the per-cpu system_wq following the ongoing workqueue API refactoring. - Avoid open-coded kvrealloc() in module decompression logic by using the standard helper. - Improve section annotations by replacing the custom __modinit with __init_or_module and removing several unused __INIT*_OR_MODULE macros. - Fix kernel-doc warnings in include/linux/moduleparam.h. - Ensure set_module_sig_enforced is only declared when module signing is enabled. - Fix gendwarfksyms build failures on 32-bit hosts. MAINTAINERS: - Update the module subsystem entry to reflect the maintainer rotation and update the git repository link" * tag 'modules-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: modules: moduleparam.h: fix kernel-doc comments module: Only declare set_module_sig_enforced when CONFIG_MODULE_SIG=y module/decompress: Avoid open-coded kvrealloc() gendwarfksyms: Fix build on 32-bit hosts sign-file: Use only the OpenSSL CMS API for signing module: Remove SHA-1 support for module signing module: replace use of system_wq with system_dfl_wq params: Replace __modinit with __init_or_module module: Remove unused __INIT*_OR_MODULE macros MAINTAINERS: Update module subsystem maintainers and repository commit b63c90720348578631cda74285958c3ad3169ce9 Merge: 958f7fb68c6be4 965e9a2cf23b06 Author: Linus Torvalds Date: Tue Feb 10 09:32:30 2026 -0800 Merge tag 'keys-next-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull keys update from David Howells: "This adds support for ML-DSA signatures in X.509 certificates and PKCS#7/CMS messages, thereby allowing this algorithm to be used for signing modules, kexec'able binaries, wifi regulatory data, etc.. This requires OpenSSL-3.5 at a minimum and preferably OpenSSL-4 (so that it can avoid the use of CMS signedAttrs - but that version is not cut yet). certs/Kconfig does a check to hide the signing options if OpenSSL does not list the algorithm as being available" * tag 'keys-next-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: pkcs7: Change a pr_warn() to pr_warn_once() pkcs7: Allow authenticatedAttributes for ML-DSA modsign: Enable ML-DSA module signing pkcs7, x509: Add ML-DSA support pkcs7: Allow the signing algo to do whatever digestion it wants itself pkcs7, x509: Rename ->digest to ->m x509: Separately calculate sha256 for blacklist crypto: Add ML-DSA crypto_sig support commit 958f7fb68c6be4e2d9dcb5bf31bfe746f6744aa3 Merge: 85f24b0ace9aa7 bdc5071d7f7bb8 Author: Linus Torvalds Date: Tue Feb 10 09:11:21 2026 -0800 Merge tag 'kmalloc_obj-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull kmalloc_obj updates from Kees Cook: "Introduce the kmalloc_obj* family of APIs for switching to type-based kmalloc allocations, away from purely size-based allocations. Discussed on lkml, with you, and at Linux Plumbers. It's been in -next for the entire dev cycle. Before the merge window closes, I'd like to send the treewide change (generated from the Coccinelle script included here), which mechanically converts almost 20k callsites from kmalloc* to kmalloc_obj*: 8007 files changed, 19980 insertions(+), 20838 deletions(-) This change needed fixes for mismatched types (since now the return type from allocations is a pointer to the requested type, not "void *"), and I've been fixing these over the last 4 releases. These fixes have mostly been trivial mismatches with const qualifiers or accidentally identical sizes (e.g. same object size: "struct kvec" vs "struct iovec", or differing pointers to pointers), but I did catch one case of too-small allocation. Summary: - Introduce kmalloc_obj*() family of type-based allocator APIs - checkpatch: Suggest kmalloc_obj family for sizeof allocations - coccinelle: Add kmalloc_objs conversion script" * tag 'kmalloc_obj-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: coccinelle: Add kmalloc_objs conversion script slab: Introduce kmalloc_flex() and family compiler_types: Introduce __flex_counter() and family checkpatch: Suggest kmalloc_obj family for sizeof allocations slab: Introduce kmalloc_obj() and family commit 85f24b0ace9aa79142f632fc3ccc730a8d2a4a28 Merge: bffce9b427b37e 44dd7cfbd1db51 Author: Linus Torvalds Date: Tue Feb 10 08:54:13 2026 -0800 Merge tag 'hardening-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: "Mostly small cleanups and various scattered annotations and flex array warning fixes that we reviewed by unlanded in other trees. Introduces new annotation for expanding counted_by to pointer members, now that compiler behavior between GCC and Clang has been normalized. - Various missed __counted_by annotations (Thorsten Blum) - Various missed -Wflex-array-member-not-at-end fixes (Gustavo A. R. Silva) - Avoid leftover tempfiles for interrupted compile-time FORTIFY tests (Nicolas Schier) - Remove non-existant CONFIG_UBSAN_REPORT_FULL from docs (Stefan Wiehler) - fortify: Use C arithmetic not FIELD_xxx() in FORTIFY_REASON defines (David Laight) - Add __counted_by_ptr attribute, tests, and first user (Bill Wendling, Kees Cook) - Update MAINTAINERS file to make hardening section not include pstore" * tag 'hardening-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: MAINTAINERS: pstore: Remove L: entry nfp: tls: Avoid -Wflex-array-member-not-at-end warnings carl9170: Avoid -Wflex-array-member-not-at-end warning coredump: Use __counted_by_ptr for struct core_name::corename lkdtm/bugs: Add __counted_by_ptr() test PTR_BOUNDS compiler_types.h: Attributes: Add __counted_by_ptr macro fortify: Cleanup temp file also on non-successful exit fortify: Rename temporary file to match ignore pattern fortify: Use C arithmetic not FIELD_xxx() in FORTIFY_REASON defines ecryptfs: Annotate struct ecryptfs_message with __counted_by fs/xattr: Annotate struct simple_xattr with __counted_by crypto: af_alg - Annotate struct af_alg_iv with __counted_by Kconfig.ubsan: Remove CONFIG_UBSAN_REPORT_FULL from documentation drm/nouveau: fifo: Avoid -Wflex-array-member-not-at-end warning commit bffce9b427b37e2f54416a695ec5d7f030ba610f Merge: eecb03b0f9b209 5669645c052f23 Author: Linus Torvalds Date: Tue Feb 10 08:52:41 2026 -0800 Merge tag 'pstore-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: - Catch unlikely NULL return from vmap() (Ruipeng Qi) - Handle corner case of past incomplete buffer fills causing heap overflow (Sai Ritvik Tanksalkar) * tag 'pstore-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: fix buffer overflow in persistent_ram_save_old() pstore: ram_core: fix incorrect success return when vmap() fails commit eecb03b0f9b209e8947e11ab4d8898d801a2d5fa Merge: 1562b1fb7e17c1 46a03ea50b5f38 Author: Linus Torvalds Date: Tue Feb 10 08:50:19 2026 -0800 Merge tag 'execve-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve update from Kees Cook: - drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville) * tag 'execve-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: fs/tests: exec: drop duplicate bprm_stack_limits test vectors commit 1562b1fb7e17c1b3addb15e125c718b2be7f5512 Author: Kees Cook Date: Fri Feb 6 19:49:54 2026 -0800 crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly The existing allocation of scatterlists in omap_crypto_copy_sg_lists() was allocating an array of scatterlist pointers, not scatterlist objects, resulting in a 4x too small allocation. Use sizeof(*new_sg) to get the correct object size. Fixes: 74ed87e7e7f7 ("crypto: omap - add base support library for common routines") Signed-off-by: Kees Cook Acked-by: Herbert Xu Signed-off-by: Linus Torvalds commit 08df88fa142f3ba298bf0f7840fa9187e2fb5956 Merge: 13d83ea9d81ddc 0ce90934c0a6ba Author: Linus Torvalds Date: Tue Feb 10 08:36:42 2026 -0800 Merge tag 'v7.0-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto update from Herbert Xu: "API: - Fix race condition in hwrng core by using RCU Algorithms: - Allow authenc(sha224,rfc3686) in fips mode - Add test vectors for authenc(hmac(sha384),cbc(aes)) - Add test vectors for authenc(hmac(sha224),cbc(aes)) - Add test vectors for authenc(hmac(md5),cbc(des3_ede)) - Add lz4 support in hisi_zip - Only allow clear key use during self-test in s390/{phmac,paes} Drivers: - Set rng quality to 900 in airoha - Add gcm(aes) support for AMD/Xilinx Versal device - Allow tfms to share device in hisilicon/trng" * tag 'v7.0-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (100 commits) crypto: img-hash - Use unregister_ahashes in img_{un}register_algs crypto: testmgr - Add test vectors for authenc(hmac(md5),cbc(des3_ede)) crypto: cesa - Simplify return statement in mv_cesa_dequeue_req_locked crypto: testmgr - Add test vectors for authenc(hmac(sha224),cbc(aes)) crypto: testmgr - Add test vectors for authenc(hmac(sha384),cbc(aes)) hwrng: core - use RCU and work_struct to fix race condition crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() crypto: xilinx - Fix inconsistant indentation crypto: rng - Use unregister_rngs in register_rngs crypto: atmel - Use unregister_{aeads,ahashes,skciphers} hwrng: optee - simplify OP-TEE context match crypto: ccp - Add sysfs attribute for boot integrity dt-bindings: crypto: atmel,at91sam9g46-sha: add microchip,lan9691-sha dt-bindings: crypto: atmel,at91sam9g46-aes: add microchip,lan9691-aes dt-bindings: crypto: qcom,inline-crypto-engine: document the Milos ICE crypto: caam - fix netdev memory leak in dpaa2_caam_probe crypto: hisilicon/qm - increase wait time for mailbox crypto: hisilicon/qm - obtain the mailbox configuration at one time crypto: hisilicon/qm - remove unnecessary code in qm_mb_write() crypto: hisilicon/qm - move the barrier before writing to the mailbox register ... commit 13d83ea9d81ddcb08b46377dcc9de6e5df1248d1 Merge: 35149653ee29d9 ffd42b6d0420c4 Author: Linus Torvalds Date: Tue Feb 10 08:31:09 2026 -0800 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: - Add support for verifying ML-DSA signatures. ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is a recently-standardized post-quantum (quantum-resistant) signature algorithm. It was known as Dilithium pre-standardization. The first use case in the kernel will be module signing. But there are also other users of RSA and ECDSA signatures in the kernel that might want to upgrade to ML-DSA eventually. - Improve the AES library: - Make the AES key expansion and single block encryption and decryption functions use the architecture-optimized AES code. Enable these optimizations by default. - Support preparing an AES key for encryption-only, using about half as much memory as a bidirectional key. - Replace the existing two generic implementations of AES with a single one. - Simplify how Adiantum message hashing is implemented. Remove the "nhpoly1305" crypto_shash in favor of direct lib/crypto/ support for NH hashing, and enable optimizations by default. * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (53 commits) lib/crypto: mldsa: Clarify the documentation for mldsa_verify() slightly lib/crypto: aes: Drop 'volatile' from aes_sbox and aes_inv_sbox lib/crypto: aes: Remove old AES en/decryption functions lib/crypto: aesgcm: Use new AES library API lib/crypto: aescfb: Use new AES library API crypto: omap - Use new AES library API crypto: inside-secure - Use new AES library API crypto: drbg - Use new AES library API crypto: crypto4xx - Use new AES library API crypto: chelsio - Use new AES library API crypto: ccp - Use new AES library API crypto: x86/aes-gcm - Use new AES library API crypto: arm64/ghash - Use new AES library API crypto: arm/ghash - Use new AES library API staging: rtl8723bs: core: Use new AES library API net: phy: mscc: macsec: Use new AES library API chelsio: Use new AES library API Bluetooth: SMP: Use new AES library API crypto: x86/aes - Remove the superseded AES-NI crypto_cipher lib/crypto: x86/aes: Add AES-NI optimization ... commit 35149653ee29d925ea0c2b5ca0eacf0af32be34f Author: Linus Torvalds Date: Tue Feb 10 08:23:13 2026 -0800 smb client: Add generated file to gitignore file The smb client code recently started generating the error mapping table from a common header, but didn't tell git about it, so then git ends up thinking maybe it should be committed. Let's fix that. Fixes: c527e13a7a66 ("cifs: Autogenerate SMB2 error mapping table") Signed-off-by: Linus Torvalds commit 720452a6d0fdc94ec3301f31ea10b43102eaeeef Author: Thomas Bogendoerfer Date: Tue Feb 10 16:48:59 2026 +0100 Revert "clk: microchip: core: allow driver to be compiled with COMPILE_TEST" This reverts commit 026d70dcfe5de1543bb8edb8e50d22dc16863e6b. Signed-off-by: Thomas Bogendoerfer commit df136764e86e4d271133359e2ecd2b6717cc5040 Author: Thomas Bogendoerfer Date: Tue Feb 10 16:48:51 2026 +0100 Revert "clk: microchip: fix typo in reference to a config option" This reverts commit a6ab150deb4b740334721d18e02ad400a9d888f5. Signed-off-by: Thomas Bogendoerfer commit 65b691f84dba54a446518c51b25d3d4f1739dec5 Author: Günther Noack Date: Fri Feb 6 16:11:55 2026 +0100 landlock: Transpose the layer masks data structure The layer masks data structure tracks the requested but unfulfilled access rights during an operation's security check. It stores one bit for each combination of access right and layer index. If the bit is set, that access right is not granted (yet) in the given layer and we have to traverse the path further upwards to grant it. Previously, the layer masks were stored as arrays mapping from access right indices to layer_mask_t. The layer_mask_t value then indicates all layers in which the given access right is still (tentatively) denied. This patch introduces struct layer_access_masks instead: This struct contains an array with the access_mask_t of each (tentatively) denied access right in that layer. The hypothesis of this patch is that this simplifies the code enough so that the resulting code will run faster: * We can use bitwise operations in multiple places where we previously looped over bits individually with macros. (Should require less branch speculation and lends itself to better loop unrolling.) * Code is ~75 lines smaller. Other noteworthy changes: * In no_more_access(), call a new helper function may_refer(), which only solves the asymmetric case. Previously, the code interleaved the checks for the two symmetric cases in RENAME_EXCHANGE. It feels that the code is clearer when renames without RENAME_EXCHANGE are more obviously the normal case. Tradeoffs: This change improves performance, at a slight size increase to the layer masks data structure. This fixes the size of the data structure at 32 bytes for all types of access rights. (64, once we introduce a 17th filesystem access right). For filesystem access rights, at the moment, the data structure has the same size as before, but once we introduce the 17th filesystem access right, it will double in size (from 32 to 64 bytes), as access_mask_t grows from 16 to 32 bit [1]. Link: https://lore.kernel.org/all/20260120.haeCh4li9Vae@digikod.net/ [1] Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260206151154.97915-5-gnoack3000@gmail.com [mic: Cosmetic fixes, moved struct layer_access_masks definition] Signed-off-by: Mickaël Salaün commit 45f2a2926b2187d1b08132d2728af50785b007a7 Author: Günther Noack Date: Fri Feb 6 16:11:54 2026 +0100 landlock: Add access_mask_subset() helper This helper function checks whether an access_mask_t has a subset of the bits enabled than another one. This expresses the intent a bit smoother in the code and does not cost us anything when it gets inlined. Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260206151154.97915-4-gnoack3000@gmail.com [mic: Improve subject] Signed-off-by: Mickaël Salaün commit 9adbe8935152c511c1e43a47d69f44f0e969afc8 Author: Günther Noack Date: Fri Feb 6 16:11:53 2026 +0100 selftests/landlock: Add filesystem access benchmark fs_bench benchmarks the performance of Landlock's path walk by exercising it in a scenario that amplifies Landlock's overhead: * Create a large number of nested directories * Enforce a Landlock policy in which a rule is associated with each of these subdirectories * Benchmark openat() applied to the deepest directory, forcing Landlock to walk the entire path. Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260206151154.97915-3-gnoack3000@gmail.com [mic: Fix missing mode with O_CREAT, improve text consistency, sort includes] Signed-off-by: Mickaël Salaün commit 5a5203a45b063a594e89a2aeaf9e4923893a5b4c Author: Rong Zhang Date: Sun Feb 8 01:23:27 2026 +0800 platform/x86: lenovo-wmi-{capdata,other}: Fix HWMON channel visibility The LWMI_SUPP_MAY_{GET,SET} macros are fundamentally broken. When I introduced them, I meant to check LWMI_SUPP_VALID *and* the corresponding bits for get/set capabilities. However, `supported & LWMI_SUPP_MAY_{GET,SET}' means *or*, so it accidentally passes the check when LWMI_SUPP_VALID is set. Fix them by only including the corresponding get/set bit without LWMI_SUPP_VALID. Meanwhile, rename them to LWMI_SUPP_{GET,SET} to make them less confusing. Fixes: 67d9a39ce85f ("platform/x86: lenovo-wmi-capdata: Wire up Fan Test Data") Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20260207172327.80111-1-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9e33c1dba22431bea9b2bf48adf56859e52fc7ec Author: Carl Lee Date: Tue Feb 10 15:26:34 2026 +0800 hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification When MPQ8785 reports VOUT_MODE as VID mode, mpq8785_identify() configures the driver for direct mode. The subsequent pmbus_identify_common() check then fails due to a mismatch between the reported mode and the configured mode, causing device initialization to fail. Override the reported VOUT_MODE to direct mode to keep the driver configuration consistent with the reported mode and allow successful device initialization. This does not change how voltages are interpreted, but avoids a false identification failure caused by mismatched mode handling. Fixes: f20b4a931130c ("hwmon: Add driver for MPS MPQ8785 Synchronous Step-Down Converter") Signed-off-by: Carl Lee Link: https://lore.kernel.org/r/20260210-dt-bindings-hwmon-pmbus-mpq8785-add-mpq8786-support-v3-1-84636ccfe76f@amd.com Signed-off-by: Guenter Roeck commit 8bde3e395a85017f12af2b0ba5c3684f5af9c006 Author: Guenter Roeck Date: Sat Feb 7 08:12:25 2026 -0800 Revert "hwmon: (ibmpex) fix use-after-free in high/low store" This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d. Jean Delvare points out that the patch does not completely fix the reported problem, that it in fact introduces a (new) race condition, and that it may actually not be needed in the first place. Various AI reviews agree. Specific and relevant AI feedback: " This reordering sets the driver data to NULL before removing the sensor attributes in the loop below. ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but does not check if it is NULL before dereferencing it to access data->sensors[]. If a userspace process reads a sensor file (like temp1_input) while this delete function is running, could it race with the dev_set_drvdata(..., NULL) call here and crash in ibmpex_show_sensor()? Would it be safer to keep the original order where device_remove_file() is called before clearing the driver data? device_remove_file() should wait for any active sysfs callbacks to complete, which might already prevent the use-after-free this patch intends to fix. " Revert the offending patch. If it can be shown that the originally reported alleged race condition does indeed exist, it can always be re-introduced with a complete fix. Reported-by: Jean Delvare Closes: https://lore.kernel.org/linux-hwmon/20260121095342.73e723cb@endymion/ Cc: Jean Delvare Cc: Junrui Luo Fixes: 6946c726c3f4 ("hwmon: (ibmpex) fix use-after-free in high/low store") Reviewed-by: Jean Delvare Signed-off-by: Guenter Roeck commit 3a23b80dd72de245d931394381fea6a573935c9f Merge: 36bd7d5deef936 484e834d53cffa Author: Paolo Abeni Date: Tue Feb 10 15:58:04 2026 +0100 Merge branch 'disable-interrupts-and-ensure-dbell-updation' Vimlesh Kumar says: ==================== disable interrupts and ensure dbell updation Disable per ring interrupts when netdev goes down and ensure dbell BADDR updation for both PFs and VFs by adding wait and check for updated value. Resending based on discussion with reviewer. ==================== Link: https://patch.msgid.link/20260206111510.1045092-1-vimleshk@marvell.com Signed-off-by: Paolo Abeni commit 484e834d53cffa91c311631271f83130cf6e9e7c Author: Vimlesh Kumar Date: Fri Feb 6 11:15:08 2026 +0000 octeon_ep_vf: ensure dbell BADDR updation Make sure the OUT DBELL base address reflects the latest values written to it. Fix: Add a wait until the OUT DBELL base address register is updated with the DMA ring descriptor address, and modify the setup_oq function to properly handle failures. Fixes: 2c0c32c72be29 ("octeon_ep_vf: add hardware configuration APIs") Signed-off-by: Sathesh Edara Signed-off-by: Shinas Rasheed Signed-off-by: Vimlesh Kumar Link: https://patch.msgid.link/20260206111510.1045092-4-vimleshk@marvell.com Signed-off-by: Paolo Abeni commit ce8fe3fc4f99efd872120301c0f72f2e90ab9769 Author: Vimlesh Kumar Date: Fri Feb 6 11:15:07 2026 +0000 octeon_ep: ensure dbell BADDR updation Make sure the OUT DBELL base address reflects the latest values written to it. Fix: Add a wait until the OUT DBELL base address register is updated with the DMA ring descriptor address, and modify the setup_oq function to properly handle failures. Fixes: 0807dc76f3bf5 ("octeon_ep: support Octeon CN10K devices") Signed-off-by: Sathesh Edara Signed-off-by: Shinas Rasheed Signed-off-by: Vimlesh Kumar Link: https://patch.msgid.link/20260206111510.1045092-3-vimleshk@marvell.com Signed-off-by: Paolo Abeni commit 73e6ffa37cebee152c07c5f2b8bc70fd2899ea6e Author: Vimlesh Kumar Date: Fri Feb 6 11:15:06 2026 +0000 octeon_ep: disable per ring interrupts Disable the MSI-X per ring interrupt for every PF ring when PF netdev goes down. Fixes: 1f2c2d0cee023 ("octeon_ep: add hardware configuration APIs") Signed-off-by: Sathesh Edara Signed-off-by: Shinas Rasheed Signed-off-by: Vimlesh Kumar Link: https://patch.msgid.link/20260206111510.1045092-2-vimleshk@marvell.com Signed-off-by: Paolo Abeni commit ad1f18e985cb2758c60f644c8fbc92a97bb6d2ba Author: Simon Horman Date: Fri Feb 6 11:18:51 2026 +0000 net/mlx5e: remove declarations of mlx5e_shampo_{fill_umr,dealloc_hd} These functions were recently removed by commit 24cf78c73831 ("net/mlx5e: SHAMPO, Switch to header memcpy"), however, their declarations were left behind. This patch removes those declarations. Flagged by review-prompts while I was exercising Orc mode locally. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Joe Damato Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260206-shampo-v1-1-75b20c6657e5@kernel.org Signed-off-by: Paolo Abeni commit 36bd7d5deef936c4e1e3cd341598140e5c14c1d3 Author: Thomas Fourier Date: Fri Feb 6 09:53:33 2026 +0100 net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() The priv->rx_buffer and priv->tx_buffer are alloc'd together as contiguous buffers in uhdlc_init() but freed as two buffers in uhdlc_memclean(). Change the cleanup to only call dma_free_coherent() once on the whole buffer. Reviewed-by: Christophe Leroy (CS GROUP) Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC") Cc: Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20260206085334.21195-2-fourier.thomas@gmail.com Signed-off-by: Paolo Abeni commit c22ba07c827f2ac84573ac788383a8e1eafe21bc Author: Vladimir Oltean Date: Fri Feb 6 15:54:21 2026 +0800 net: dsa: eliminate local type for tc policers David Yang is saying that struct flow_action_entry in include/net/flow_offload.h has gained new fields and DSA's struct dsa_mall_policer_tc_entry, derived from that, isn't keeping up. This structure is passed to drivers and they are completely oblivious to the values of fields they don't see. This has happened before, and almost always the solution was to make the DSA layer thinner and use the upstream data structures. Here, the reason why we didn't do that is because struct flow_action_entry :: police is an anonymous structure. That is easily enough fixable, just name those fields "struct flow_action_police" and reference them from DSA. Make the according transformations to the two users (sja1105 and felix): "rate_bytes_per_sec" -> "rate_bytes_ps". Signed-off-by: Vladimir Oltean Co-developed-by: David Yang Signed-off-by: David Yang Link: https://patch.msgid.link/20260206075427.44733-1-mmyangfl@gmail.com Signed-off-by: Paolo Abeni commit 308e7e4d0a846359685f40aade023aee7b27284c Author: Jiayuan Chen Date: Fri Feb 6 15:44:44 2026 +0800 serial: caif: fix use-after-free in caif_serial ldisc_close() There is a use-after-free bug in caif_serial where handle_tx() may access ser->tty after the tty has been freed. The race condition occurs between ldisc_close() and packet transmission: CPU 0 (close) CPU 1 (xmit) ------------- ------------ ldisc_close() tty_kref_put(ser->tty) [tty may be freed here] <-- race window --> caif_xmit() handle_tx() tty = ser->tty // dangling ptr tty->ops->write() // UAF! schedule_work() ser_release() unregister_netdevice() The root cause is that tty_kref_put() is called in ldisc_close() while the network device is still active and can receive packets. Since ser and tty have a 1:1 binding relationship with consistent lifecycles (ser is allocated in ldisc_open and freed in ser_release via unregister_netdevice, and each ser binds exactly one tty), we can safely defer the tty reference release to ser_release() where the network device is unregistered. Fix this by moving tty_kref_put() from ldisc_close() to ser_release(), after unregister_netdevice(). This ensures the tty reference is held as long as the network device exists, preventing the UAF. Note: We save ser->tty before unregister_netdevice() because ser is embedded in netdev's private data and will be freed along with netdev (needs_free_netdev = true). How to reproduce: Add mdelay(500) at the beginning of ldisc_close() to widen the race window, then run the reproducer program [1]. Note: There is a separate deadloop issue in handle_tx() when using PORT_UNKNOWN serial ports (e.g., /dev/ttyS3 in QEMU without proper serial backend). This deadloop exists even without this patch, and is likely caused by inconsistency between uart_write_room() and uart_write() in serial core. It has been addressed in a separate patch [2]. KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in handle_tx+0x5d1/0x620 Read of size 1 at addr ffff8881131e1490 by task caif_uaf_trigge/9929 Call Trace: dump_stack_lvl+0x10e/0x1f0 print_report+0xd0/0x630 kasan_report+0xe4/0x120 handle_tx+0x5d1/0x620 dev_hard_start_xmit+0x9d/0x6c0 __dev_queue_xmit+0x6e2/0x4410 packet_xmit+0x243/0x360 packet_sendmsg+0x26cf/0x5500 __sys_sendto+0x4a3/0x520 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0xc9/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f615df2c0d7 Allocated by task 9930: Freed by task 64: Last potentially related work creation: The buggy address belongs to the object at ffff8881131e1000 which belongs to the cache kmalloc-cg-2k of size 2048 The buggy address is located 1168 bytes inside of freed 2048-byte region [ffff8881131e1000, ffff8881131e1800) The buggy address belongs to the physical page: page_owner tracks the page as allocated page last free pid 9778 tgid 9778 stack trace: Memory state around the buggy address: ffff8881131e1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881131e1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8881131e1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881131e1500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881131e1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [1]: https://gist.github.com/mrpre/f683f244544f7b11e7fa87df9e6c2eeb [2]: https://lore.kernel.org/linux-serial/20260204074327.226165-1-jiayuan.chen@linux.dev/T/#u Reported-by: syzbot+827272712bd6d12c79a4@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a4a7550611e234f5@google.com/T/ Fixes: 56e0ef527b18 ("drivers/net: caif: fix wrong rtnl_is_locked() usage") Reviewed-by: Greg Kroah-Hartman Signed-off-by: Jiayuan Chen Reviewed-by: Jijie Shao Link: https://patch.msgid.link/20260206074450.154267-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit fef0e649f8b42bdffe4a916dd46e1b1e9ad2f207 Author: Felix Gu Date: Fri Jan 30 00:21:19 2026 +0800 drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() The logicvc_drm_config_parse() function calls of_get_child_by_name() to find the "layers" node but fails to release the reference, leading to a device node reference leak. Fix this by using the __free(device_node) cleanup attribute to automatic release the reference when the variable goes out of scope. Fixes: efeeaefe9be5 ("drm: Add support for the LogiCVC display controller") Signed-off-by: Felix Gu Reviewed-by: Luca Ceresoli Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20260130-logicvc_drm-v1-1-04366463750c@gmail.com Signed-off-by: Luca Ceresoli commit d01103fdcb871fd83fd06ef5803d576507c6a801 Author: Ethan Nelson-Moore Date: Thu Feb 5 23:17:14 2026 -0800 net: ethernet: marvell: skge: remove incorrect conflicting PCI ID The ID 1186:4302 is matched by both r8169 and skge. The same device ID should not be in more than one driver, because in that case, which driver is used is unpredictable. I downloaded the latest drivers for all hardware revisions of the D-Link DGE-530T from D-Link's website, and the only drivers which contain this ID are Realtek drivers. Therefore, remove this device ID from skge. In the kernel bug report which requested addition of this device ID, someone created a patch to add the ID to skge. Then, it was pointed out that this device is an "r8169 in disguise", and a patch was created to add it to r8169. Somehow, both of these patches got merged. See the link below. Link: https://bugzilla.kernel.org/show_bug.cgi?id=38862 Fixes: c074304c2bcf ("add pci-id for DGE-530T") Cc: stable@vger.kernel.org Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260206071724.15268-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni commit 81b84de32bb27ae1ae2eb9acf0420e9d0d14bf00 Author: Jiayuan Chen Date: Fri Feb 6 13:02:19 2026 +0800 xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path icmp_route_lookup() performs multiple route lookups to find a suitable route for sending ICMP error messages, with special handling for XFRM (IPsec) policies. The lookup sequence is: 1. First, lookup output route for ICMP reply (dst = original src) 2. Pass through xfrm_lookup() for policy check 3. If blocked (-EPERM) or dst is not local, enter "reverse path" 4. In reverse path, call xfrm_decode_session_reverse() to get fl4_dec which reverses the original packet's flow (saddr<->daddr swapped) 5. If fl4_dec.saddr is local (we are the original destination), use __ip_route_output_key() for output route lookup 6. If fl4_dec.saddr is NOT local (we are a forwarding node), use ip_route_input() to simulate the reverse packet's input path 7. Finally, pass rt2 through xfrm_lookup() with XFRM_LOOKUP_ICMP flag The bug occurs in step 6: ip_route_input() is called with fl4_dec.daddr (original packet's source) as destination. If this address becomes local between the initial check and ip_route_input() call (e.g., due to concurrent "ip addr add"), ip_route_input() returns a LOCAL route with dst.output set to ip_rt_bug. This route is then used for ICMP output, causing dst_output() to call ip_rt_bug(), triggering a WARN_ON: ------------[ cut here ]------------ WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x21/0x30, CPU#1 Call Trace: ip_push_pending_frames+0x202/0x240 icmp_push_reply+0x30d/0x430 __icmp_send+0x1149/0x24f0 ip_options_compile+0xa2/0xd0 ip_rcv_finish_core+0x829/0x1950 ip_rcv+0x2d7/0x420 __netif_receive_skb_one_core+0x185/0x1f0 netif_receive_skb+0x90/0x450 tun_get_user+0x3413/0x3fb0 tun_chr_write_iter+0xe4/0x220 ... Fix this by checking rt2->rt_type after ip_route_input(). If it's RTN_LOCAL, the route cannot be used for output, so treat it as an error. The reproducer requires kernel modification to widen the race window, making it unsuitable as a selftest. It is available at: https://gist.github.com/mrpre/eae853b72ac6a750f5d45d64ddac1e81 Reported-by: syzbot+e738404dcd14b620923c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000b1060905eada8881@google.com/T/ Closes: https://lore.kernel.org/r/20260128090523.356953-1-jiayuan.chen@linux.dev Fixes: 8b7817f3a959 ("[IPSEC]: Add ICMP host relookup support") Signed-off-by: Jiayuan Chen Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260206050220.59642-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit 1a4b0c999101b2532723f9bd9818b70ffa7580f4 Author: Adam Ford Date: Mon Feb 9 23:37:04 2026 -0600 regulator: mt6363: Fix interrmittent timeout Sometimes, the mt6363 regulator would fail to initialize and return with a TIMEOUT error, so add an extra instruction to wake up the bus before issuing the commands. Fixes: 3c36965df808 ("regulator: Add support for MediaTek MT6363 SPMI PMIC Regulators") Signed-off-by: Adam Ford Link: https://patch.msgid.link/20260210053708.17239-4-aford173@gmail.com Signed-off-by: Mark Brown commit 5578da7d957fbaf91f6c39ba2363c2d2e4273183 Author: Jack Yu Date: Tue Feb 10 15:43:35 2026 +0800 ASoC: rt721-sdca: Fix issue of fail to detect OMTP jack type Add related HP-JD settings to fix issue of fail to detect OMTP jack type. Signed-off-by: Jack Yu Link: https://patch.msgid.link/20260210074335.2337830-1-jack.yu@realtek.com Signed-off-by: Mark Brown commit 86dbebfb9053cd8626ee7c0297e991ce4843bd3f Merge: 4f65ee7e0cbfd6 7ac5dddef5168b Author: Paolo Abeni Date: Tue Feb 10 13:40:52 2026 +0100 Merge branch 'net-ftgmac100-various-probe-cleanups' Jacky Chou says: ==================== net: ftgmac100: Various probe cleanups The probe function of the ftgmac100 is rather complex, due to the way it has evolved over time, dealing with poor DT descriptions, and new variants of the MAC. Make use of DT match data to identify the MAC variant, rather than looking at the compatible string all the time. Make use of devm_ calls to simplify cleanup. This indirectly fixes inconsistent goto label names. Always probe the MDIO bus, when it exists. This simplifies the logic a bit. Move code into helpers to simply probe. Signed-off-by: Andrew Lunn Signed-off-by: Jacky Chou ==================== Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-0-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 7ac5dddef5168b13e490402802f7628d012f477d Author: Jacky Chou Date: Fri Feb 6 11:17:55 2026 +0800 net: ftgmac100: Use devm_mdiobus_alloc/devm_of_mdiobus_register Make use of devm_ methods to allocate and register mdiobus to simplify cleanup. Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-15-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 201dddf68899581f0339617f1da98b2b38a3b4a8 Author: Andrew Lunn Date: Fri Feb 6 11:17:54 2026 +0800 net: ftgmac100: Fix wrong netif_napi_del in release netif_napi_add() is called in open. There is a symmetric call to netif_napi_del() in stop. Remove to wrong call to netif_napi_del() in release. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-14-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 96b4887a718ca6750762f7f5cc2e6f5c8a1f97f9 Author: Andrew Lunn Date: Fri Feb 6 11:17:53 2026 +0800 net: ftgmac100: Simplify condition on HW arbitration The MAC ID is sufficient to indicate this is a ast2600. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-13-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 0855b43d8218bffbe187c73b679e96625897f4cb Author: Andrew Lunn Date: Fri Feb 6 11:17:52 2026 +0800 net: ftgmac100: Remove redundant PHY_POLL When an MDIO bus is allocated, the irqs for each PHY are set to polling. Remove the redundant code in the MAC driver which does the same. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-12-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 20248a719dc8e0095b31291dcfc6380f5a7b10b2 Author: Andrew Lunn Date: Fri Feb 6 11:17:51 2026 +0800 net: ftgmac100: Move DT probe into a helper By moving all the DT probe code into a helper, the complex if else if else structure can be simplified. No functional change intended. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-11-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 3e523741aae7d7835bd7f64eedfe44d3e1c64f4d Author: Andrew Lunn Date: Fri Feb 6 11:17:50 2026 +0800 net: ftgmac100: Simplify legacy MDIO setup There are old device trees which place the PHY nodes directly in the MAC nodes, rather than within an MDIO container node. The probe logic indicates that the use of NCSI and the legacy placement of PHYs is mutually exclusive. Hence priv->use_ncsi cannot be true, so there is no reason to set it false. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-10-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit efeb214411730dbbd7271bd0ad71823dec525289 Author: Andrew Lunn Date: Fri Feb 6 11:17:49 2026 +0800 net: ftgmac100: Always register the MDIO bus when it exists Both the Aspeed 2400 and 2500 and the original faraday version of the MAC have MDIO bus controllers as part of the MAC. Since it exists, always registering it makes the code simpler, and causes no harm. If there is no mdio node in device tree, of_mdiobus_register() will fall back to mdiobus_register(), making it safe. AST2600 uses an external MDIO controller and does not have an embedded MDIO bus in the MAC. For such configurations, the legacy MII probe path must not be entered without a registered mii_bus. Add an explicit check to fail gracefully when no MDIO bus is present, preventing a NULL pointer dereference while keeping the intended behavior for platforms without embedded MDIO. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-9-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 7535d70ba0e73ae66df2636cc49bc6396f23520a Author: Andrew Lunn Date: Fri Feb 6 11:17:48 2026 +0800 net: ftgmac100: Move NCSI probe code into a helper To help reduce the complexity of the probe function, move the NCSI probe code into a helper. The refactoring results in improved cleanup of the fixed PHY in error paths. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-8-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit d1d8392883bf2e7fdbd308cc1c986ad5072493e4 Author: Andrew Lunn Date: Fri Feb 6 11:17:47 2026 +0800 net: ftgmac100: Simplify error handling for ftgmac100_initial_mac ftgmac100_initial_mac() does not allocate any resources. All resources by the probe function up until this call point use devm_ methods. So just return the error code rather than use a goto. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-7-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 4659ccedf22b77f20d7e0cea68655b39675c434f Author: Andrew Lunn Date: Fri Feb 6 11:17:46 2026 +0800 net: ftgmac100: Use devm_clk_get_enabled Make use of devm_ methods to request and enable clocks to simplify cleanup. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-6-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 67127f88c80bb10535d2fded8e57375269f2e2a9 Author: Andrew Lunn Date: Fri Feb 6 11:17:45 2026 +0800 net: ftgmac100: Use devm_request_memory_region/devm_ioremap Make use of devm_ methods to request and remap the device memory to simplify cleanup. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-5-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit f4bef838a4556c58f242e281eeb1d4fc11b442d3 Author: Andrew Lunn Date: Fri Feb 6 11:17:44 2026 +0800 net: ftgmac100: Use devm_alloc_etherdev() Make use of devm_alloc_etherdev() to simplify cleanup. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-4-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 9b42f74808de733d378d963a8d2cc0a7d0b0eecb Author: Andrew Lunn Date: Fri Feb 6 11:17:43 2026 +0800 net: ftgmac100: Replace all of_device_is_compatible() Now that the priv structure includes the MAC ID, make use of it instead of the more expensive of_device_is_compatible(). Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-3-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 41fbe5aa50863f8d64ba4d7ec376a1c870325137 Author: Andrew Lunn Date: Fri Feb 6 11:17:42 2026 +0800 net: ftgmac100: Add match data containing MAC ID The driver supports 4 different versions of the FTGMAC core. Extend the compatible matching to include match data, which indicates the version of the MAC. Default to the initial Faraday device if DT is not being used. Lookup the match data early in probe to keep error handing simple. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-2-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 03a2aba50b2c0f703638c90bf2ac9dc149ecab2c Author: Andrew Lunn Date: Fri Feb 6 11:17:41 2026 +0800 net: ftgmac100: List all compatibles As a step towards cleanup the probe function, list each compatible the driver supports. Signed-off-by: Andrew Lunn Reviewed-by: Simon Horman Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-1-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni commit 5d1ab659fb93eed85d6d8b2937013360157032f4 Author: Ian Rogers Date: Mon Feb 9 22:03:59 2026 -0800 perf stat: Add no-affinity flag Add flag that disables affinity behavior. Using sched_setaffinity() to place a perf thread on a CPU can avoid certain interprocessor interrupts but may introduce a delay due to the scheduling, particularly on loaded machines. Add a command line option to disable the behavior. This behavior is less present in other tools like `perf record`, as it uses a ring buffer and doesn't make repeated system calls. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andres Freund Cc: Dapeng Mi Cc: Dr. David Alan Gilbert Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Yang Li Signed-off-by: Arnaldo Carvalho de Melo commit d484361550ebdc4da77ea16f6cb08badde33e799 Author: Ian Rogers Date: Mon Feb 9 22:03:58 2026 -0800 perf evlist: Reduce affinity use and move into iterator, fix no affinity The evlist__for_each_cpu iterator will call sched_setaffitinity when moving between CPUs to avoid IPIs. If only 1 IPI is saved then this may be unprofitable as the delay to get scheduled may be considerable. This may be particularly true if reading an event group in `perf stat` in interval mode. Move the affinity handling completely into the iterator so that a single evlist__use_affinity can determine whether CPU affinities will be used. For `perf record` the change is minimal as the dummy event and the real event will always make the use of affinities the thing to do. In `perf stat`, tool events are ignored and affinities only used if >1 event on the same CPU occur. Determining if affinities are useful is done by evlist__use_affinity which tests per-event whether the event's PMU benefits from affinity use - it is assumed only perf event using PMUs do. Fix a bug where when there are no affinities that the CPU map iterator may reference a CPU not present in the initial evsel. Fix by making the iterator and non-iterator code common. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andres Freund Cc: Dapeng Mi Cc: Dr. David Alan Gilbert Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Yang Li Signed-off-by: Arnaldo Carvalho de Melo commit 47172912c9933103bc2c68627b1dafd9058d035e Author: Ian Rogers Date: Mon Feb 9 22:03:57 2026 -0800 perf evlist: Missing TPEBS close in evlist__close() The libperf evsel close won't close TPEBS events properly. Add a test to do this. The libperf close routine is used in evlist__close() for affinity reasons. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andres Freund Cc: Dapeng Mi Cc: Dr. David Alan Gilbert Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Yang Li Signed-off-by: Arnaldo Carvalho de Melo commit ff8548172f63288b5c2b0fda5a4a4be294f610f1 Author: Ian Rogers Date: Mon Feb 9 22:03:56 2026 -0800 perf evlist: Special map propagation for tool events that read on 1 CPU Tool events like duration_time don't need a perf_cpu_map that contains all online CPUs. Having such a perf_cpu_map causes overheads when iterating between events for CPU affinity. During parsing mark events that just read on a single CPU map index as such, then during map propagation set up the evsel's CPUs and thereby the evlists accordingly. The setting cannot be done early in parsing as user CPUs are only fully known when evlist__create_maps is called. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Andres Freund Cc: Dapeng Mi Cc: Dr. David Alan Gilbert Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Yang Li Signed-off-by: Arnaldo Carvalho de Melo commit 63b320aaac08ba267268ec21a195ce3c82dcb8ab Author: Ian Rogers Date: Mon Feb 9 22:03:55 2026 -0800 perf stat-shadow: In prepare_metric fix guard on reading NULL perf_stat_evsel The aggr value is setup to always be non-null creating a redundant guard for reading from it. Switch to using the perf_stat_evsel (ps) and narrow the scope of aggr so that it is known valid when used. Fixes: 3d65f6445fd93e3e ("perf stat-shadow: Read tool events directly") Reported-by: Andres Freund Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Dapeng Mi Cc: Dr. David Alan Gilbert Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Yang Li Signed-off-by: Arnaldo Carvalho de Melo commit bc105a8918fd8458ec3a5b947018b0f8059da529 Author: Ian Rogers Date: Mon Feb 9 22:03:54 2026 -0800 Revert "perf tool_pmu: More accurately set the cpus for tool events" This reverts commit d8d8a0b3603a9a8fa207cf9e4f292e81dc5d1008. The setting of a user CPU map can cause an empty intersection when combined with CPU 0 and the event removed. This later triggers a segv in the stat-shadow logic. Let's put back a full online CPU map for now by reverting this patch. Closes: https://lore.kernel.org/linux-perf-users/cgja46br2smmznxs7kbeabs6zgv3b4olfqgh2fdp5mxk2yom4v@w6jjgov6hdi6/ Reported-by: Andres Freund Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Dapeng Mi Cc: Dr. David Alan Gilbert Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Thomas Richter Cc: Yang Li Signed-off-by: Arnaldo Carvalho de Melo commit 1f12fb138de81e63c1140689257548966cfb88a3 Author: Dmitry Dolgov <9erthalion6@gmail.com> Date: Tue Feb 10 11:02:56 2026 +0100 tools build: Emit dependencies file for test-rust.bin Test it first by having rust installed, then removing it and building again. Fixes: 6a32fa5ccd33da5d ("tools build: Add a feature test for rust compiler") Signed-off-by: Dmitry Dolgov <9erthalion6@gmail.com> Signed-off-by: Arnaldo Carvalho de Melo commit 84a654f786414a74a15a7b61929d1ced06687310 Author: Dmitrii Dolgov <9erthalion6@gmail.com> Date: Tue Feb 10 09:01:18 2026 -0300 tools build: Make test-rust.bin be removed by the 'clean' target test-rust.bin is missing from the list of FILES, and thus is not removed by the clean target. This could lead to a false feature detection, since the binary stays there. Fix it. Fixes: 6a32fa5ccd33da5d ("tools build: Add a feature test for rust compiler") Tested-by: Arnaldo Carvalho de Melo Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Signed-off-by: Arnaldo Carvalho de Melo commit fd3634312a04f336dcbfb481060219f0cd320738 Author: Thomas Gleixner Date: Sat Feb 7 14:27:05 2026 +0100 debugobject: Make it work with deferred page initialization - again debugobjects uses __GFP_HIGH for allocations as it might be invoked within locked regions. That worked perfectly fine until v6.18. It still works correctly when deferred page initialization is disabled and works by chance when no page allocation is required before deferred page initialization has completed. Since v6.18 allocations w/o a reclaim flag cause new_slab() to end up in alloc_frozen_pages_nolock_noprof(), which returns early when deferred page initialization has not yet completed. As the deferred page initialization takes quite a while the debugobject pool is depleted and debugobjects are disabled. This can be worked around when PREEMPT_COUNT is enabled as that allows debugobjects to add __GFP_KSWAPD_RECLAIM to the GFP flags when the context is preemtible. When PREEMPT_COUNT is disabled the context is unknown and the reclaim bit can't be set because the caller might hold locks which might deadlock in the allocator. In preemptible context the reclaim bit is harmless and not a performance issue as that's usually invoked from slow path initialization context. That makes debugobjects depend on PREEMPT_COUNT || !DEFERRED_STRUCT_PAGE_INIT. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Signed-off-by: Thomas Gleixner Tested-by: Sebastian Andrzej Siewior Acked-by: Alexei Starovoitov Acked-by: Vlastimil Babka Link: https://patch.msgid.link/87pl6gznti.ffs@tglx commit 0efc331d78b043b9d8477c64e279058062d36a0b Author: Pavel Begunkov Date: Mon Feb 9 14:31:22 2026 +0000 io_uring/rsrc: replace reg buffer bit field with flags I'll need a flag in the registered buffer struct for dmabuf work, and it'll be more convenient to have a flags field rather than bit fields, especially for io_mapped_ubuf initialisation. We might want to add more flags in the future as well. For example, it might be useful for debugging and potentially optimisations to split out a flag indicating the shape of the buffer to gate iov_iter_advance() walks vs bit/mask arithmetics. It can also be combined with the direction mask field. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 417d029dc412c1028bce3d4685700332c0539a95 Author: Pavel Begunkov Date: Thu Feb 5 18:04:43 2026 +0000 io_uring/zcrx: improve types for size calculation Make sure io_import_umem() promotes the type to long before calculating the area size. While the area size is capped at 1GB by io_validate_user_buf_range() and fits into an "int", it's still too error prone. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 8c5d17834ec104d0abd1bda52fbc04e647fab274 Author: René Rebe Date: Thu Feb 5 17:09:59 2026 +0100 net: sunhme: Fix sbus regression Commit cc216e4b44ce ("net: sunhme: Switch SBUS to devres") changed explicit sized of_ioremap with BMAC_REG_SIZEs to devm_platform_ioremap_resource mapping all the resource. However, this does not work on my Sun Ultra 2 with SBUS HMEs: hme f0072f38: error -EBUSY: can't request region for resource [mem 0x1ffe8c07000-0x1ffe8c0701f] hme f0072f38: Cannot map TCVR registers. hme f0072f38: probe with driver hme failed with error -16 hme f007ab44: error -EBUSY: can't request region for resource [mem 0x1ff28c07000-0x1ff28c0701f] hme f007ab44: Cannot map TCVR registers. hme f007ab44: probe with driver hme failed with error -16 Turns out the open-firmware resources overlap, at least on this machines and PROM version: hexdump /proc/device-tree/sbus@1f,0/SUNW,hme@2,8c00000/reg: 00 00 00 02 08 c0 00 00 00 00 01 08 00 00 00 02 08 c0 20 00 00 00 20 00 00 00 00 02 08 c0 40 00 00 00 20 00 00 00 00 02 08 c0 60 00 00 00 20 00 00 00 00 02 08 c0 70 00 00 00 00 20 And the driver previously explicitly mapped way smaller mmio regions: /proc/iomem: 1ff28c00000-1ff28c00107 : HME Global Regs 1ff28c02000-1ff28c02033 : HME TX Regs 1ff28c04000-1ff28c0401f : HME RX Regs 1ff28c06000-1ff28c0635f : HME BIGMAC Regs 1ff28c07000-1ff28c0701f : HME Tranceiver Regs Quirk this specific issue by truncating the previous resource to not overlap into the TCVR registers. Fixes: cc216e4b44ce ("net: sunhme: Switch SBUS to devres") Signed-off-by: René Rebe Reviewed-by: Sean Anderson Link: https://patch.msgid.link/20260205.170959.89574674688839340.rene@exactco.de Signed-off-by: Paolo Abeni commit 92860256402cce9fa6268763365f5333a56c1428 Author: Binbin Zhou Date: Tue Feb 10 19:31:33 2026 +0800 LoongArch: dts: loongson-2k1000: Add nand controller support The module is supported, enable it. Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit 4fd5ca0f2c626f59f131c62df1dba9ccf39f074d Author: Binbin Zhou Date: Tue Feb 10 19:31:21 2026 +0800 LoongArch: dts: loongson-2k0500: Add nand controller support The module is supported, enable it. Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit 4fdb5dd8aeba3a6b5ffc9c66fd0c8528fd835065 Author: Hengqi Chen Date: Tue Feb 10 19:31:18 2026 +0800 LoongArch: BPF: Implement bpf_addr_space_cast instruction LLVM generates bpf_addr_space_cast instruction while translating pointers between native (zero) address space and __attribute__((address_space(N))). The addr_space=0 is reserved as bpf_arena address space. rY = addr_space_cast(rX, 0, 1) is processed by the verifier and converted to normal 32-bit move: wX = wY rY = addr_space_cast(rX, 1, 0) has to be converted by JIT. With this, the following test cases passed: $ ./test_progs -a arena_htab,arena_list,arena_strsearch,verifier_arena,verifier_arena_large #4/1 arena_htab/arena_htab_llvm:OK #4/2 arena_htab/arena_htab_asm:OK #4 arena_htab:OK #5/1 arena_list/arena_list_1:OK #5/2 arena_list/arena_list_1000:OK #5 arena_list:OK #7/1 arena_strsearch/arena_strsearch:OK #7 arena_strsearch:OK #507/1 verifier_arena/basic_alloc1:OK #507/2 verifier_arena/basic_alloc2:OK #507/3 verifier_arena/basic_alloc3:OK #507/4 verifier_arena/basic_reserve1:OK #507/5 verifier_arena/basic_reserve2:OK #507/6 verifier_arena/reserve_twice:OK #507/7 verifier_arena/reserve_invalid_region:OK #507/8 verifier_arena/iter_maps1:OK #507/9 verifier_arena/iter_maps2:OK #507/10 verifier_arena/iter_maps3:OK #507 verifier_arena:OK #508/1 verifier_arena_large/big_alloc1:OK #508/2 verifier_arena_large/access_reserved:OK #508/3 verifier_arena_large/request_partially_reserved:OK #508/4 verifier_arena_large/free_reserved:OK #508/5 verifier_arena_large/big_alloc2:OK #508 verifier_arena_large:OK Summary: 5/20 PASSED, 0 SKIPPED, 0 FAILED Acked-by: Tiezhu Yang Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit ef54c517a9376b188da06b5e1ed556129c4280be Author: Hengqi Chen Date: Tue Feb 10 19:31:18 2026 +0800 LoongArch: BPF: Implement PROBE_MEM32 pseudo instructions Add support for `{LDX,STX,ST} | PROBE_MEM32 | {B,H,W,DW}` instructions. They are similar to PROBE_MEM instructions with the following differences: * PROBE_MEM32 supports store. * PROBE_MEM32 relies on the verifier to clear upper 32-bit of the src/dst register * PROBE_MEM32 adds 64-bit kern_vm_start address (which is stored in S6 in the prologue). Due to bpf_arena constructions such S6 + reg + off16 access is guaranteed to be within arena virtual range, so no address check at run-time. * S6 is a free callee-saved register, so it is used to store arena_vm_start * PROBE_MEM32 allows ST and STX. If they fault the store is a nop. When LDX faults the destination register is zeroed. To support these on LoongArch, we employ the t2/t3 registers to store the intermediate results of reg_arena + src/dst reg and use the t2/t3 registers as the new src/dst reg. This allows us to reuse most of the existing code. Acked-by: Tiezhu Yang Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 4ab17e762b34c847478f694932c4cd4b1ac2c343 Author: Hengqi Chen Date: Tue Feb 10 19:31:17 2026 +0800 LoongArch: BPF: Use BPF prog pack allocator Use bpf_jit_binary_pack_alloc() for BPF JIT binaries. The BPF prog pack allocator creates a pair of RW and RX buffers. The BPF JIT writes the program into the RW buffer. When the JIT is done, the program is copied to the final RX buffer with bpf_jit_binary_pack_finalize(). Acked-by: Tiezhu Yang Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit f5db714646c0a90842f7c09cda72b7844a46a179 Author: Carlos López Date: Tue Feb 10 19:31:17 2026 +0800 LoongArch: Use IS_ERR_PCPU() macro for KGDB In commit a759e37fb467 ("err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros"), specialized macros were added to check an error within a __percpu pointer, so use them instead of manually casting with __force, like all other users of register_wide_hw_breakpoint(). Signed-off-by: Carlos López Signed-off-by: Huacai Chen commit 5ec5ac4ca27e4daa234540ac32f9fc5219377d53 Author: Tiezhu Yang Date: Tue Feb 10 19:31:17 2026 +0800 LoongArch: Rework KASAN initialization for PTW-enabled systems kasan_init_generic() indicates that kasan is fully initialized, so it should be put at end of kasan_init(). Otherwise bringing up the primary CPU failed when CONFIG_KASAN is set on PTW-enabled systems, here are the call chains: kernel_entry() start_kernel() setup_arch() kasan_init() kasan_init_generic() The reason is PTW-enabled systems have speculative accesses which means memory accesses to the shadow memory after kasan_init() may be executed by hardware before. However, accessing shadow memory is safe only after kasan fully initialized because kasan_init() uses a temporary PGD table until we have populated all levels of shadow page tables and writen the PGD register. Moving kasan_init_generic() later can defer the occasion of kasan_enabled(), so as to avoid speculative accesses on shadow pages. After moving kasan_init_generic() to the end, kasan_init() can no longer call kasan_mem_to_shadow() for shadow address conversion because it will always return kasan_early_shadow_page. On the other hand, we should keep the current logic of kasan_mem_to_shadow() for both the early and final stage because there may be instrumentation before kasan_init(). To solve this, we factor out a new mem_to_shadow() function from current kasan_mem_to_shadow() for the shadow address conversion in kasan_init(). Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 7cb37af61f09c9cfd90c43c9275307c16320cbf2 Author: Tiezhu Yang Date: Tue Feb 10 19:31:17 2026 +0800 LoongArch: Disable instrumentation for setup_ptwalker() According to Documentation/dev-tools/kasan.rst, software KASAN modes use compiler instrumentation to insert validity checks. Such instrumentation might be incompatible with some parts of the kernel, and therefore needs to be disabled, just use the attribute __no_sanitize_address to disable instrumentation for the low level function setup_ptwalker(). Otherwise bringing up the secondary CPUs failed when CONFIG_KASAN is set (especially when PTW is enabled), here are the call chains: smpboot_entry() start_secondary() cpu_probe() per_cpu_trap_init() tlb_init() setup_tlb_handler() setup_ptwalker() The reason is the PGD registers are configured in setup_ptwalker(), but KASAN instrumentation may cause TLB exceptions before that. Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 0e6f596d6ac635e80bb265d587b2287ef8fa1cd6 Author: Tiezhu Yang Date: Tue Feb 10 19:31:14 2026 +0800 LoongArch: Remove some extern variables in source files There are declarations of the variable "eentry", "pcpu_handlers[]" and "exception_handlers[]" in asm/setup.h, the source files already include this header file directly or indirectly, so no need to declare them in the source files, just remove the code. Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 70b0faae3590c628a98a627a10e5d211310169d4 Author: Tiezhu Yang Date: Tue Feb 10 19:31:13 2026 +0800 LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT After commit 88fd2b70120d ("LoongArch: Fix sleeping in atomic context for PREEMPT_RT"), it should guard percpu handler under !CONFIG_PREEMPT_RT to avoid redundant operations. Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 055c7e75190e0be43037bd663a3f6aced194416e Author: Tiezhu Yang Date: Tue Feb 10 19:31:13 2026 +0800 LoongArch: Handle percpu handler address for ORC unwinder After commit 4cd641a79e69 ("LoongArch: Remove unnecessary checks for ORC unwinder"), the system can not boot normally under some configs (such as enable KASAN), there are many error messages "cannot find unwind pc". The kernel boots normally with the defconfig, so no problem found out at the first time. Here is one way to reproduce: cd linux make mrproper defconfig -j"$(nproc)" scripts/config -e KASAN make olddefconfig all -j"$(nproc)" sudo make modules_install sudo make install sudo reboot The address that can not unwind is not a valid kernel address which is between "pcpu_handlers[cpu]" and "pcpu_handlers[cpu] + vec_sz" due to the code of eentry was copied to the new area of pcpu_handlers[cpu] in setup_tlb_handler(), handle this special case to get the valid address to unwind normally. Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 77403a06d845db1caf9a6b0867b43e9dd8de8e4a Author: Tiezhu Yang Date: Tue Feb 10 19:31:13 2026 +0800 LoongArch: Use %px to print unmodified unwinding address Currently, use %p to prevent leaking information about the kernel memory layout when printing the PC address, but the kernel log messages are not useful to debug problem if bt_address() returns 0. Given that the type of "pc" variable is unsigned long, it should use %px to print the unmodified unwinding address. Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 2172d6ebac9372eb01fe4505a53e18cb061e103b Author: Huacai Chen Date: Tue Feb 10 19:31:13 2026 +0800 LoongArch: Prefer top-down allocation after arch_mem_init() Currently we use bottom-up allocation after sparse_init(), the reason is sparse_init() need a lot of memory, and bottom-up allocation may exhaust precious low memory (below 4GB). On the other hand, SWIOTLB and CMA need low memories for DMA32, so swiotlb_init() and dma_contiguous_reserve() need bottom-up allocation. Since swiotlb_init() and dma_contiguous_reserve() are both called in arch_mem_init(), we no longer need bottom-up allocation after that. So we set the allocation policy to top-down at the end of arch_mem_init(), in order to avoid later memory allocations (such as KASAN) exhaust low memory. This solve at least two problems: 1. Some buggy BIOSes use 0xfd000000~0xfe000000 for secondary CPUs, but didn't reserve this range, which causes smpboot failures. 2. Some DMA32 devices, such as Loongson-DRM and OHCI, cannot work with KASAN enabled. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit 009ee0c96416ecd0c568af72ee37965e06bde460 Author: Huacai Chen Date: Tue Feb 10 19:31:13 2026 +0800 LoongArch: Add HOTPLUG_SMT implementation For benchmarking or debugging purpose, we usually want to control SMT via boot parameter and sysfs knobs. So add HOTPLUG_SMT implementation. 1. Boot parameters: nosmt: Disable SMT, can be enabled via sysfs knobs. nosmt=force: Disable SMT, cannot be enabled via sysfs knobs. 2. Runtime sysfs controls: Write "on", "off", "forceoff" or the number of SMT threads (1, 2, ...) to /sys/devices/system/cpu/smt/control. Signed-off-by: Huacai Chen commit 94b0c831eda778ae9e4f2164a8b3de485d8977bb Author: John Garry Date: Tue Feb 10 19:31:12 2026 +0800 LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which is a valid index - so add a check for this. Cc: stable@vger.kernel.org Signed-off-by: John Garry Signed-off-by: Huacai Chen commit abca6583a2aa00ed856907d86446ae527442a754 Author: Lain "Fearyncess" Yang Date: Tue Feb 10 19:31:12 2026 +0800 LoongArch: Wire up memfd_secret system call LoongArch supports ARCH_HAS_SET_DIRECT_MAP, therefore wire up the memfd_secret system call, which just depends on it. Acked-by: Arnd Bergmann Acked-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand (Red Hat) Signed-off-by: Lain "Fearyncess" Yang Signed-off-by: Huacai Chen commit 52c1dbf4cb8e9c1df2a911bc8938efaeff51dfbb Author: George Guo Date: Tue Feb 10 19:31:12 2026 +0800 LoongArch: Replace seq_printf() with seq_puts() for simple strings Fix warnings like: "Prefer seq_puts to seq_printf" by checkpatch.pl. Replace seq_printf() calls with seq_puts() in show_cpuinfo() when outputting simple constant strings without format specifiers. This improves performance slightly as seq_puts() avoids parsing the format string. Signed-off-by: George Guo Signed-off-by: Huacai Chen commit f0e4b1b6e295299f5c9c79ad546dedbdf7132f45 Author: George Guo Date: Tue Feb 10 19:31:12 2026 +0800 LoongArch: Add 128-bit atomic cmpxchg support Implement 128-bit atomic compare-and-exchange using LoongArch's LL.D/SC.Q instructions. At the same time, this fix the BPF scheduler test failures (scx_central and scx_qmap) caused by kmalloc_nolock_noprof() returning NULL, due to missing 128-bit atomics. The NULL returns lead to -ENOMEM errors during scheduler initialization, causing test cases to fail. Verified by testing with the scx_qmap scheduler (located in tools/sched_ext/). Building with `make` and running ./tools/sched_ext/build/bin/scx_qmap. Link: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=5fb750e8a9ae Acked-by: Hengqi Chen Tested-by: Hengqi Chen Co-developed-by:: Xi Ruoyao Signed-off-by: Xi Ruoyao Signed-off-by: George Guo Signed-off-by: Huacai Chen commit 48543c4283e76d561d11b9955222b1a3054abdb9 Author: George Guo Date: Tue Feb 10 19:31:06 2026 +0800 LoongArch: Add detection for SC.Q support Check the CPUCFG2_SCQ bit to determine if the current CPU supports the SC.Q instruction. Reviewed-by: Hengqi Chen Tested-by: Hengqi Chen Co-developed-by: Yangyang Lian Signed-off-by: Yangyang Lian Signed-off-by: George Guo Signed-off-by: Huacai Chen commit 07d5798aadfa922af1f81bf7fe4a1746a7e6d184 Author: Huacai Chen Date: Tue Feb 10 19:31:06 2026 +0800 LoongArch: Select HAVE_CMPXCHG_LOCAL in Kconfig LoongArch has already implemented cmpxchg_local(), this_cpu_cmpxchg() and similar functions, so select HAVE_CMPXCHG_LOCAL in Kconfig to avoid incurring the overhead of local_irq_save()/local_irq_restore() for page state helpers in mm/vmstat.c. Signed-off-by: Huacai Chen commit e3372ffb5f9e2dda3da259b768aab6271672b90d Author: Steffen Eiden Date: Mon Feb 9 16:29:25 2026 +0100 KVM: s390: Increase permitted SE header size to 1 MiB Relax the maximum allowed Secure Execution (SE) header size from 8 KiB to 1 MiB. This allows individual secure guest images to run on a wider range of physical machines. Signed-off-by: Steffen Eiden Reviewed-by: Janosch Frank Reviewed-by: Claudio Imbrenda Signed-off-by: Claudio Imbrenda commit 46aa186a08d87ce834c7bb68e46dc84bac1995c1 Author: Eric Farman Date: Mon Feb 2 15:45:57 2026 +0100 MAINTAINERS: Replace backup for s390 vfio-pci Farhan has been doing a masterful job coming on in the s390 PCI space, and my own attention has been lacking. Let's make MAINTAINERS reflect reality. Signed-off-by: Eric Farman Acked-by: Alex Williamson Acked-by: Farhan Ali Acked-by: Matthew Rosato Acked-by: Christian Borntraeger Signed-off-by: Claudio Imbrenda commit 4f65ee7e0cbfd6ff4db88a60a08bb10f1fdc4ecc Merge: 310d80b0f88a58 b3dabced355e17 Author: Paolo Abeni Date: Tue Feb 10 12:02:31 2026 +0100 Merge branch 'hsr-implement-more-robust-duplicate-discard-algorithm' Felix Maurer says: ==================== hsr: Implement more robust duplicate discard algorithm The duplicate discard algorithms for PRP and HSR do not work reliably with certain link faults. Especially with packet loss on one link, the duplicate discard algorithms drop valid packets. For a more thorough description see patches 4 (for PRP) and 6 (for HSR). This patchset replaces the current algorithms (based on a drop window for PRP and highest seen sequence number for HSR) with a single new one that tracks the received sequence numbers individually (descriptions again in patches 4 and 6). The changes will lead to higher memory usage and more work to do for each packet. But I argue that this is an acceptable trade-off to make for a more robust PRP and HSR behavior with faulty links. After all, both protocols are to be used in environments where redundancy is needed and people are willing to setup special network topologies to achieve that. Some more reasoning on the overhead and expected scale of the deployment from the RFC discussion: > As for the expected scale, there are two dimensions: the number of nodes > in the network and the data rate with which they send. > > The number of nodes in the network affect the memory usage because each > node now has the block buffer. For PRP that's 64 blocks * 32 byte = > 2kbyte for each node in the node table. A PRP network doesn't have an > explicit limit for the number of nodes. However, the whole network is a > single layer-2 segment which shouldn't grow too large anyways. Even if > one really tries to put 1000 nodes into the PRP network, the memory > overhead (2Mbyte) is acceptable in my opinion. > > For HSR, the blocks would be larger because we need to track the > sequence numbers per port. I expect 64 blocks * 80 byte = 5kbyte per > node in the node table. There is no explicit limit for the size of an > HSR ring either. But I expect them to be of limited size because the > forwarding delays add up throughout the ring. I've seen vendors limiting > the ring size to 50 nodes with 100Mbit/s links and 300 with 1Gbit/s > links. In both cases I consider the memory overhead acceptable. > > The data rates are harder to reason about. In general, the data rates > for HSR and PRP are limited because too high packet rates would lead to > very fast re-use of the 16bit sequence numbers. The IEC 62439-3:2021 > mentions 100Mbit/s links and 1Gbit/s links. I don't expect HSR or PRP > networks to scale out to, e.g., 10Gbit/s links with the current > specification as this would mean that sequence numbers could repeat as > often as every ~4ms. The default constants in the IEC standard, which we > also use, are oriented at a 100Mbit/s network. > > In my tests with veth pairs, the CPU overhead didn't lead to > significantly lower data rates. The main factor limiting the data rate > at the moment, I assume, is the per-node spinlock that is taken for each > received packet. IMHO, there is a lot more to gain in terms of CPU > overhead from making this lock smaller or getting rid of it, than we > loose with the more accurate duplicate discard algorithm in this patchset. > > The CPU overhead of the algorithm benefits from the fact that in high > packet rate scenarios (where it really matters) many packets will have > sequence numbers in already initialized blocks. These packets just have > additionally: one xarray lookup, one comparison, and one bit setting. If > a block needs to be initialized (once every 128 packets plus their 128 > duplicates if all sequence numbers are seen), we will have: one > xa_erase, a bunch of memory writes, and one xa_store. > > In theory, all packets could end up in the slow path if a node sends > every 128th packet to us. If this is sent from a well behaving node, the > packet rate wouldn't be an issue anymore, though. Signed-off-by: Felix Maurer ==================== Link: https://patch.msgid.link/cover.1770299429.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit b3dabced355e17e16bc3ac7cde67a944cd83a1b9 Author: Felix Maurer Date: Thu Feb 5 14:57:35 2026 +0100 MAINTAINERS: Assign hsr selftests to HSR Despite the HSR subsystem being orphaned at the moment due to the original maintainer being unreachable for a while, assign the selftests to the subsystem for the future. Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/f4a356b96f5e0c99d9db3984ea62596c99a97469.1770299429.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit bbbd531faa18b778a9129938d2c8db6c33c106ab Author: Felix Maurer Date: Thu Feb 5 14:57:34 2026 +0100 selftests: hsr: Add more link fault tests for HSR Run the packet loss and reordering tests also for both HSR versions. Now they can be removed from the hsr_ping tests completely. The timeout needs to be increased because there are 15 link fault test cases now, with each of them taking 5-6sec for the test and at most 5sec for the HSR node tables to get merged and we also want some room to make the test runs stable. Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/eb6f667d3804ce63d86f0ee3fbc0e0ac9e1a209a.1770299429.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit aae9d6b616b5e4ad8bbb82aa3661baa1522684d2 Author: Felix Maurer Date: Thu Feb 5 14:57:33 2026 +0100 hsr: Implement more robust duplicate discard for HSR The HSR duplicate discard algorithm had even more basic problems than the described for PRP in the previous patch. It relied only on the last received sequence number to decide if a new frame should be forwarded to any port. This does not work correctly in any case where frames are received out of order. The linked bug report claims that this can even happen with perfectly fine links due to the order in which incoming frames are processed (which can be unexpected on multi-core systems). The issue also occasionally shows up in the HSR selftests. The main reason is that the sequence number that was last forwarded to the master port may have skipped a number which will in turn never be delivered to the host. As the problem (we accidentally skip over a sequence number that has not been received but will be received in the future) is similar to PRP, we can apply a similar solution. The duplicate discard algorithm based on the "sparse bitmap" works well for HSR if it is extended to track one bitmap for each port (A, B, master, interlink). To do this, change the sequence number blocks to contain a flexible array member as the last member that can keep chunks for as many bitmaps as we need. This design makes it easy to reuse the same algorithm in a potential PRP RedBox implementation. The duplicate discard algorithm functions are modified to deal with sequence number blocks of different sizes and to correctly use the array of bitmap chunks. There is a notable speciality for HSR: the port type has a special port type NONE with value 0. This leads to the number of port types being 5 instead of actually 4. To save memory, remove the NONE port from the bitmap (by subtracting 1) when setting up the block buffer and when accessing the bitmap chunks in the array. Removing the old algorithm allows us to get rid of a few fields that are not needed any more: time_out and seq_out for each port. We can also remove some functions that were only necessary for the previous duplicate discard algorithm. The removal of seq_out is possible despite its previous usage in hsr_register_frame_in: it was used to prevent updates to time_in when "invalid" sequence numbers were received. With the new duplicate discard algorithm, time_in has no relevance for the expiry of sequence numbers anymore. They will expire based on the timestamps in the sequence number blocks after at most 400ms. There is no need that a node "re-registers" to "resume communication": after 400ms, all sequence numbers are accepted again. Also, according to the IEC 62439-3:2021, all nodes are supposed to send no traffic for 500ms after boot to lead exactly to this expiry of seen sequence numbers. time_in is still used for pruning nodes from the node table after no traffic has been received for 60sec. Pruning is only needed if the node is really gone and has not been sending any traffic for that period. seq_out was also used to report the last incoming sequence number from a node through netlink. I am not sure how useful this value is to userspace at all, but added getting it from the sequence number blocks. This number can be outdated after node merging until a new block has been added. Update the KUnit test for the PRP duplicate discard so that the node allocation matches and expectations on the removed fields are removed. Reported-by: Yoann Congal Closes: https://lore.kernel.org/netdev/7d221a07-8358-4c0b-a09c-3b029c052245@smile.fr/ Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/36dc3bc5bdb7e68b70bb5ef86f53ca95a3f35418.1770299429.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit 8908c3c8cef437d8d2ad41f9b23f4305029d1782 Author: Felix Maurer Date: Thu Feb 5 14:57:32 2026 +0100 selftests: hsr: Add tests for more link faults with PRP Add tests where one link has different rates of packet loss or reorders packets. PRP should still be able to recover from these link faults and show no packet loss. However, it is acceptable to receive some level of duplicate packets. This matches the current specification (IEC 62439-3:2021) of the duplicate discard algorithm that requires it to be "designed such that it never rejects a legitimate frame, while occasional acceptance of a duplicate can be tolerated." The rate of acceptable duplicates in this test is intentionally high (10%) to make the test stable, the values I observed in the worst test cases (20% loss) are around 5% duplicates. The duplicates occur because of the 10ms ping interval in the test. As blocks expire after 400ms based on the timestamp of the first received sequence number in the block, every approx. 40th will lead to a new, clean block being used where the sequence number hasn't been seen before. As this occurs on both nodes in the test (for requests and replies), we observe around 20 duplicate frames. Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/7b36506d3a80e53786fe56526cf6046c74dfeee1.1770299429.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit 415e6367512bf8faca93eaaf46fbe23d841b4509 Author: Felix Maurer Date: Thu Feb 5 14:57:31 2026 +0100 hsr: Implement more robust duplicate discard for PRP The PRP duplicate discard algorithm does not work reliably with certain link faults. Especially with packet loss on one link, the duplicate discard algorithm drops valid packets which leads to packet loss on the PRP interface where the link fault should in theory be perfectly recoverable by PRP. This happens because the algorithm opens the drop window on the lossy link, covering received and lost sequence numbers. If the other, non-lossy link receives the duplicate for a lost frame, it is within the drop window of the lossy link and therefore dropped. Since IEC 62439-3:2012, a node has one sequence number counter for frames it sends, instead of one sequence number counter for each destination. Therefore, a node can not expect to receive contiguous sequence numbers from a sender. A missing sequence number can be totally normal (if the sender intermittently communicates with another node) or mean a frame was lost. The algorithm, as previously implemented in commit 05fd00e5e7b1 ("net: hsr: Fix PRP duplicate detection"), was part of IEC 62439-3:2010 (HSRv0/PRPv0) but was removed with IEC 62439-3:2012 (HSRv1/PRPv1). Since that, no algorithm is specified but up to implementers. It should be "designed such that it never rejects a legitimate frame, while occasional acceptance of a duplicate can be tolerated" (IEC 62439-3:2021). For the duplicate discard algorithm, this means that 1) we need to track the sequence numbers individually to account for non-contiguous sequence numbers, and 2) we should always err on the side of accepting a duplicate than dropping a valid frame. The idea of the new algorithm is to store the seen sequence numbers in a bitmap. To keep the size of the bitmap in control, we store it as a "sparse bitmap" where the bitmap is split into blocks and not all blocks exist at the same time. The sparse bitmap is implemented using an xarray that keeps the references to the individual blocks and a backing ring buffer that stores the actual blocks. New blocks are initialized in the buffer and added to the xarray as needed when new frames arrive. Existing blocks are removed in two conditions: 1. The block found for an arriving sequence number is old and therefore not relevant to the duplicate discard algorithm anymore, i.e., it has been added more than the entry forget time ago. In this case, the block is removed from the xarray and marked as forgotten (by setting its timestamp to 0). 2. Space is needed in the ring buffer for a new block. In this case, the block is removed from the xarray, if it hasn't already been forgotten (by 1.). Afterwards, the new block is initialized in its place. This has the nice property that we can reliably track sequence numbers on low traffic situations (where they expire based on their timestamp) and more quickly forget sequence numbers in high traffic situations before they potentially wrap over and repeat before they are expired. When nodes are merged, the blocks are merged as well. The timestamp of a merged block is set to the minimum of the two timestamps to never keep around a seen sequence number for too long. The bitmaps are or'd to mark all seen sequence numbers as seen. All of this still happens under seq_out_lock, to prevent concurrent access to the blocks. The KUnit test for the algorithm is updated as well. The updates are done in a way to match the original intends pretty closely. Currently, there is much knowledge about the actual algorithm baked into the tests (especially the expectations) which may need some redesign in the future. Reported-by: Steffen Lindner Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Tested-by: Steffen Lindner Link: https://patch.msgid.link/8ce15a996099df2df5b700969a39e7df400e8dbb.1770299429.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit ca4a09a950d27909a16cebe512544bb01b8ce2e5 Author: Felix Maurer Date: Thu Feb 5 14:57:30 2026 +0100 selftests: hsr: Add tests for faulty links Add a test case that can support different types of faulty links for all protocol versions (HSRv0, HSRv1, PRPv1). It starts with a baseline with fully functional links. The first faulty case is one link being cut during the ping. This test uses a different function for ping that sends more packets in shorter intervals to stress the duplicate detection algorithms a bit more and allow for future tests with other link faults (packet loss, reordering, etc.). As the link fault tests now cover the cut link for HSR and PRP, it can be removed from the hsr_ping test. Note that the removed cut link test did not really test the fault because do_ping_long takes about 1sec while the link is only cut after a 3sec sleep. Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/dad52276e2c349ecb96168bef7e3001bf7becc81.1770299429.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit 776b64ba12e7e2be393b3df07979c825fed47931 Author: Felix Maurer Date: Thu Feb 5 14:57:29 2026 +0100 selftests: hsr: Check duplicates on HSR with VLAN Previously the hsr_ping test only checked that all nodes in a VLAN are reachable (using do_ping). Update the test to also check that there is no packet loss and no duplicate packets by running the same tests for VLANs as without VLANs (including using do_ping_long). This also adds tests for IPv6 over VLAN. To unify the test code, the topology without VLANs now uses IP addresses from dead:beef:0::/64 to align with the 100.64.0.0/24 range for IPv4. Error messages are updated across the board to make it easier to find what actually failed. Also update the VLAN test to only run in VLAN 2, as there is no need to check if ping really works with VLAN IDs 2, 3, 4, and 5. This lowers the number of long ping tests on VLANs to keep the overall test runtime in bounds. It's still necessary to bump the test timeout a bit, though: a ping long tests takes 1sec, do_ping_tests performs 12 of them, do_link_problem_tests 6, and the VLAN tests again 12. With some buffer for setup and waiting and for two protocol versions, 90sec timeout seems reasonable. Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/e3ded0e2547b5f720524b62fabeb96debc579697.1770299429.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit c01a6c700fd54dd775020a8ddfe69dedeaca73cc Author: Felix Maurer Date: Thu Feb 5 14:57:28 2026 +0100 selftests: hsr: Add ping test for PRP Add a selftest for PRP that performs a basic ping test on IPv4 and IPv6, over the plain PRP interface and a VLAN interface, similar to the existing ping test for HSR. The test first checks reachability of the other node, then checks for no loss and no duplicates. Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/4a342189e842d7308d037da72af566729ee75834.1770299429.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit 3673dd3c7dc1f37baf0448164d323d7c7a44d1da Merge: 87caaeef799503 84f90ab5d3e859 Author: Christian Brauner Date: Thu Jan 29 15:57:40 2026 +0100 Merge patch series "Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers"" Commit 006568ab4c5c ("pid: Add a judgment for ns null in pid_nr_ns") already added the ns != NULL check in pid_nr_ns(), so we can remove the same check from __task_pid_nr_ns(). * patches from https://patch.msgid.link/20251015123550.GA9447@redhat.com: pid: introduce task_ppid_vnr() helper Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers" Link: https://patch.msgid.link/20251015123550.GA9447@redhat.com Signed-off-by: Christian Brauner commit 84f90ab5d3e859cced1d7b080adc4ea562ca2eaa Author: Oleg Nesterov Date: Wed Oct 15 14:36:33 2025 +0200 pid: introduce task_ppid_vnr() helper Cosmetic change. Unlike all other similar helpers task_ppid_nr_ns() doesn't have a _vnr() version; add one for consistency. Signed-off-by: Oleg Nesterov Link: https://patch.msgid.link/20251015123633.GB9456@redhat.com Signed-off-by: Christian Brauner commit 27125df9a5d3b4cfd03bce3a8ec405a368cc9aae Author: Harry Yoo Date: Tue Feb 10 13:46:42 2026 +0900 mm/slab: drop the OBJEXTS_NOSPIN_ALLOC flag from enum objext_flags OBJEXTS_NOSPIN_ALLOC was used to remember whether a slabobj_ext vector was allocated via kmalloc_nolock(), so that free_slab_obj_exts() could call kfree_nolock() instead of kfree(). Now that kfree() supports freeing kmalloc_nolock() objects, this flag is no longer needed. Instead, pass the allow_spin parameter down to free_slab_obj_exts() to determine whether kfree_nolock() or kfree() should be called in the free path, and free one bit in enum objext_flags. Acked-by: Alexei Starovoitov Signed-off-by: Harry Yoo Reviewed-by: Hao Li Link: https://patch.msgid.link/20260210044642.139482-3-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 87caaeef79950377b616f3ba2265a82742cb9583 Author: Mateusz Guzik Date: Tue Jan 20 19:45:39 2026 +0100 pidfs: implement ino allocation without the pidmap lock This paves the way for scalable PID allocation later. The 32 bit variant merely takes a spinlock for simplicity, the 64 bit variant uses a scalable scheme. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20260120184539.1480930-1-mjguzik@gmail.com Co-developed-by: Christian Brauner Signed-off-by: Christian Brauner commit 1cf2e88e0651dbd5fb7f5651c32d617de759b855 Author: Oleg Nesterov Date: Wed Oct 15 14:36:13 2025 +0200 Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers" This reverts commit abdfd4948e45c51b19162cf8b3f5003f8f53c9b9. The changelog in this commit explains why it is not easy to avoid ns == NULL when the caller is exiting, but pid_vnr() is equally unsafe in this case. However, commit 006568ab4c5c ("pid: Add a judgment for ns null in pid_nr_ns") already added the ns != NULL check in pid_nr_ns(), so we can remove the same check from __task_pid_nr_ns(). Signed-off-by: Oleg Nesterov Link: https://patch.msgid.link/20251015123613.GA9456@redhat.com Signed-off-by: Christian Brauner commit c4d6d7829817f762dfdce829ffd0c14ea3bad7fe Author: Harry Yoo Date: Tue Feb 10 13:46:41 2026 +0900 mm/slab: allow freeing kmalloc_nolock()'d objects using kfree[_rcu]() Slab objects that are allocated with kmalloc_nolock() must be freed using kfree_nolock() because only a subset of alloc hooks are called, since kmalloc_nolock() can't spin on a lock during allocation. This imposes a limitation: such objects cannot be freed with kfree_rcu(), forcing users to work around this limitation by calling call_rcu() with a callback that frees the object using kfree_nolock(). Remove this limitation by teaching kmemleak to gracefully ignore cases when kmemleak_free() or kmemleak_ignore() is called without a prior kmemleak_alloc(). Unlike kmemleak, kfence already handles this case, because, due to its design, only a subset of allocations are served from kfence. With this change, kfree() and kfree_rcu() can be used to free objects that are allocated using kmalloc_nolock(). Suggested-by: Alexei Starovoitov Acked-by: Alexei Starovoitov Reviewed-by: Catalin Marinas Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260210044642.139482-2-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 03aef0602f22f30aab0e42e7f3169b0a5920c461 Author: Mateusz Guzik Date: Tue Jan 20 21:48:20 2026 +0100 pid: reorder fields in pid_namespace to reduce false sharing alloc_pid() loads pid_cachep, level and pid_max prior to taking the lock. It dirties idr and pid_allocated with the lock. Some of these fields share the cacheline as is, split them up. No change in the size of the struct. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20260120204820.1497002-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 802182490445f6bcf5de0e0518fb967c2afb6da1 Author: Christian Brauner Date: Tue Jan 20 15:52:35 2026 +0100 pidfs: convert rb-tree to rhashtable Mateusz reported performance penalties [1] during task creation because pidfs uses pidmap_lock to add elements into the rbtree. Switch to an rhashtable to have separate fine-grained locking and to decouple from pidmap_lock moving all heavy manipulations outside of it. Convert the pidfs inode-to-pid mapping from an rb-tree with seqcount protection to an rhashtable. This removes the global pidmap_lock contention from pidfs_ino_get_pid() lookups and allows the hashtable insert to happen outside the pidmap_lock. pidfs_add_pid() is split. pidfs_prepare_pid() allocates inode number and initializes pid fields and is called inside pidmap_lock. pidfs_add_pid() inserts pid into rhashtable and is called outside pidmap_lock. Insertion into the rhashtable can fail and memory allocation may happen so we need to drop the spinlock. To guard against accidently opening an already reaped task pidfs_ino_get_pid() uses additional checks beyond pid_vnr(). If pid->attr is PIDFS_PID_DEAD or NULL the pid either never had a pidfd or it already went through pidfs_exit() aka the process as already reaped. If pid->attr is valid check PIDFS_ATTR_BIT_EXIT to figure out whether the task has exited. This slightly changes visibility semantics: pidfd creation is denied after pidfs_exit() runs, which is just before the pid number is removed from the via free_pid(). That should not be an issue though. Link: https://lore.kernel.org/20251206131955.780557-1-mjguzik@gmail.com [1] Link: https://patch.msgid.link/20260120-work-pidfs-rhashtable-v2-1-d593c4d0f576@kernel.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit a344860211f5c07dc6358758e42ff70f97b364a9 Author: Tim Bird Date: Sat Jan 17 13:27:59 2026 -0700 ipc: Add SPDX license id to mqueue.c Add GPL-2.0 license id to file, replacing reference to GPL in the header comment. Signed-off-by: Tim Bird Link: https://patch.msgid.link/20260117202759.692347-1-tim.bird@sony.com Signed-off-by: Christian Brauner commit f8f296ea1c61ce98a03dd9ede370adb864c4cde3 Author: Claudio Imbrenda Date: Fri Feb 6 15:35:53 2026 +0100 KVM: s390: vsie: Fix race in acquire_gmap_shadow() The shadow gmap returned by gmap_create_shadow() could get dropped before taking the gmap->children_lock. This meant that the shadow gmap was sometimes being used while its reference count was 0. Fix this by taking the additional reference inside gmap_create_shadow() while still holding gmap->children_lock, instead of afterwards. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Reviewed-by: Christoph Schlameuss Signed-off-by: Claudio Imbrenda commit b6ab71a27c50942cfc10d12ca3f3c0cfb1634d19 Author: Claudio Imbrenda Date: Fri Feb 6 15:35:52 2026 +0100 KVM: s390: vsie: Fix race in walk_guest_tables() It is possible that walk_guest_tables() is called on a shadow gmap that has been removed already, in which case its parent will be NULL. In such case, return -EAGAIN and let the callers deal with it. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Acked-by: Janosch Frank Reviewed-by: Christoph Schlameuss Signed-off-by: Claudio Imbrenda commit 898885477e0fa23d2e42b65bcb7c250215ecac37 Author: Claudio Imbrenda Date: Fri Feb 6 15:35:51 2026 +0100 KVM: s390: Use guest address to mark guest page dirty Stop using the userspace address to mark the guest page dirty. mark_page_dirty() expects a guest frame number, but was being passed a host virtual frame number. When slot == NULL, mark_page_dirty_in_slot() does nothing and does not complain. This means that in some circumstances the dirtiness of the guest page might have been lost. Fix by adding two fields in struct kvm_s390_adapter_int to keep the guest addressses, and use those for mark_page_dirty(). Fixes: f65470661f36 ("KVM: s390/interrupt: do not pin adapter interrupt pages") Reviewed-by: Steffen Eiden Reviewed-by: Janosch Frank Reviewed-by: Christoph Schlameuss Signed-off-by: Claudio Imbrenda commit ae88a5d2f29b69819dc7b04086734439d074a643 Author: Jiayuan Chen Date: Thu Feb 5 17:54:51 2026 +0800 net: atm: fix crash due to unvalidated vcc pointer in sigd_send() Reproducer available at [1]. The ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc pointer from msg->vcc and uses it directly without any validation. This pointer comes from userspace via sendmsg() and can be arbitrarily forged: int fd = socket(AF_ATMSVC, SOCK_DGRAM, 0); ioctl(fd, ATMSIGD_CTRL); // become ATM signaling daemon struct msghdr msg = { .msg_iov = &iov, ... }; *(unsigned long *)(buf + 4) = 0xdeadbeef; // fake vcc pointer sendmsg(fd, &msg, 0); // kernel dereferences 0xdeadbeef In normal operation, the kernel sends the vcc pointer to the signaling daemon via sigd_enq() when processing operations like connect(), bind(), or listen(). The daemon is expected to return the same pointer when responding. However, a malicious daemon can send arbitrary pointer values. Fix this by introducing find_get_vcc() which validates the pointer by searching through vcc_hash (similar to how sigd_close() iterates over all VCCs), and acquires a reference via sock_hold() if found. Since struct atm_vcc embeds struct sock as its first member, they share the same lifetime. Therefore using sock_hold/sock_put is sufficient to keep the vcc alive while it is being used. Note that there may be a race with sigd_close() which could mark the vcc with various flags (e.g., ATM_VF_RELEASED) after find_get_vcc() returns. However, sock_hold() guarantees the memory remains valid, so this race only affects the logical state, not memory safety. [1]: https://gist.github.com/mrpre/1ba5949c45529c511152e2f4c755b0f3 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+1f22cb1769f249df9fa0@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69039850.a70a0220.5b2ed.005d.GAE@google.com/T/ Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260205095501.131890-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit c431b00ca6afc5da3133636ecc34ee7edd38d6cc Author: Miguel Ojeda Date: Fri Feb 6 21:43:36 2026 +0100 objtool/rust: add one more `noreturn` Rust function `objtool` with Rust 1.84.0 reports: rust/kernel.o: error: objtool: _RNvXNtNtCsaRPFapPOzLs_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix14from_str_radix() falls through to next function _RNvXNtNtCsaRPFapPOzLs_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix16from_u64_negated() This is very similar to commit c18f35e49049 ("objtool/rust: add one more `noreturn` Rust function"), which added `from_ascii_radix_panic` for Rust 1.86.0, except that Rust 1.84.0 ends up needing `from_str_radix_panic`. Thus add it to the list to fix the warning. Cc: FUJITA Tomonori Fixes: 51d9ee90ea90 ("rust: str: add radix prefixed integer parsing functions") Reported-by: Alice Ryhl Link: https://rust-for-linux.zulipchat.com/#narrow/channel/291565/topic/x/with/572427627 Tested-by: Alice Ryhl Link: https://patch.msgid.link/20260206204336.38462-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 310d80b0f88a5847b6e17ceb1c2844740cc3bf35 Merge: d82cb7b7ec4211 25eb3058eb70af Author: Paolo Abeni Date: Tue Feb 10 10:58:22 2026 +0100 Merge branch 'net-fec-improve-xdp-copy-mode-and-add-af_xdp-zero-copy-support' Wei Fang says: ==================== net: fec: improve XDP copy mode and add AF_XDP zero-copy support This patch set optimizes the XDP copy mode logic as follows. 1. Separate the processing of RX XDP frames from fec_enet_rx_queue(), and adds a separate function fec_enet_rx_queue_xdp() for handling XDP frames. 2. For TX XDP packets, using the batch sending method to avoid frequent MMIO writes. 3. Use the switch statement to check the tx_buf type instead of the if...else... statement, making the cleanup logic of TX BD ring cleared and more efficient. We compared the performance of XDP copy mode before and after applying this patch set, and the results show that the performance has improved. Before applying this patch set. root@imx93evk:~# ./xdp-bench tx eth0 Summary 396,868 rx/s 0 err,drop/s Summary 396,024 rx/s 0 err,drop/s root@imx93evk:~# ./xdp-bench drop eth0 Summary 684,781 rx/s 0 err/s Summary 675,746 rx/s 0 err/s root@imx93evk:~# ./xdp-bench pass eth0 Summary 208,552 rx/s 0 err,drop/s Summary 208,654 rx/s 0 err,drop/s root@imx93evk:~# ./xdp-bench redirect eth0 eth0 eth0->eth0 311,210 rx/s 0 err,drop/s 311,208 xmit/s eth0->eth0 310,808 rx/s 0 err,drop/s 310,809 xmit/s After applying this patch set. root@imx93evk:~# ./xdp-bench tx eth0 Summary 425,778 rx/s 0 err,drop/s Summary 426,042 rx/s 0 err,drop/s root@imx93evk:~# ./xdp-bench drop eth0 Summary 698,351 rx/s 0 err/s Summary 701,882 rx/s 0 err/s root@imx93evk:~# ./xdp-bench pass eth0 Summary 210,348 rx/s 0 err,drop/s Summary 210,016 rx/s 0 err,drop/s root@imx93evk:~# ./xdp-bench redirect eth0 eth0 eth0->eth0 354,407 rx/s 0 err,drop/s 354,401 xmit/s eth0->eth0 350,381 rx/s 0 err,drop/s 350,389 xmit/s This patch set also addes the AF_XDP zero-copy support, and we tested the performance on i.MX93 platform with xdpsock tool. The following is the performance comparison of copy mode and zero-copy mode. It can be seen that the performance of zero-copy mode is better than that of copy mode. 1. MAC swap L2 forwarding 1.1 Zero-copy mode root@imx93evk:~# ./xdpsock -i eth0 -l -z sock0@eth0:0 l2fwd xdp-drv pps pkts 1.00 rx 414715 415455 tx 414715 415455 1.2 Copy mode root@imx93evk:~# ./xdpsock -i eth0 -l -c sock0@eth0:0 l2fwd xdp-drv pps pkts 1.00 rx 356396 356609 tx 356396 356609 2. TX only 2.1 Zero-copy mode root@imx93evk:~# ./xdpsock -i eth0 -t -s 64 -z sock0@eth0:0 txonly xdp-drv pps pkts 1.00 rx 0 0 tx 1119573 1126720 2.2 Copy mode root@imx93evk:~# ./xdpsock -i eth0 -t -s 64 -c sock0@eth0:0 txonly xdp-drv pps pkts 1.00 rx 0 0 tx 406864 407616 ==================== Link: https://patch.msgid.link/20260205085742.2685134-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 25eb3058eb70af15dc5c9710e859e2708d3babd2 Author: Wei Fang Date: Thu Feb 5 16:57:42 2026 +0800 net: fec: add AF_XDP zero-copy support This patch adds AF_XDP zero-copy support for both TX and RX on the FEC driver. It introduces new functions for XSK buffer allocation, RX/TX queue processing in zero-copy mode, and XSK pool setup/teardown. For RX, fec_alloc_rxq_buffers_zc() is added to allocate RX buffers from XSK pool. And fec_enet_rx_queue_xsk() is used to process the frames from the RX queue which is bound to the AF_XDP socket. Similar to the copy mode, the zero-copy mode also supports XDP_TX, XDP_PASS, XDP_DROP and XDP_REDIRECT actions. In addition, fec_enet_xsk_tx_xmit() is similar to fec_enet_xdp_tx_xmit() and is used to handle XDP_TX action in zero-copy mode. For TX, there are two cases, one is the frames from the AF_XDP socket, so fec_enet_xsk_xmit() is added to directly transmit the frames from the socket and the buffer type is marked as FEC_TXBUF_T_XSK_XMIT. The other one is the frames from the RX queue (XDP_TX action), the buffer type is marked as FEC_TXBUF_T_XSK_TX. Therefore, fec_enet_tx_queue() could correctly clean the TX queue base on the buffer type. Also, some tests have been done on the i.MX93-EVK board with the xdpsock tool, the following are the results. Env: i.MX93 connects to a packet generator, the link speed is 1Gbps, and flow-control is off. The RX packet size is 64 bytes including FCS. Only one RX queue (CPU) is used to receive frames. 1. MAC swap L2 forwarding 1.1 Zero-copy mode root@imx93evk:~# ./xdpsock -i eth0 -l -z sock0@eth0:0 l2fwd xdp-drv pps pkts 1.00 rx 414715 415455 tx 414715 415455 1.2 Copy mode root@imx93evk:~# ./xdpsock -i eth0 -l -c sock0@eth0:0 l2fwd xdp-drv pps pkts 1.00 rx 356396 356609 tx 356396 356609 2. TX only 2.1 Zero-copy mode root@imx93evk:~# ./xdpsock -i eth0 -t -s 64 -z sock0@eth0:0 txonly xdp-drv pps pkts 1.00 rx 0 0 tx 1119573 1126720 2.2 Copy mode root@imx93evk:~# ./xdpsock -i eth0 -t -s 64 -c sock0@eth0:0 txonly xdp-drv pps pkts 1.00 rx 0 0 tx 406864 407616 Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260205085742.2685134-16-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit fee723a48cbe630c0e16ba3e6bca13569946a21c Author: Wei Fang Date: Thu Feb 5 16:57:41 2026 +0800 net: fec: improve fec_enet_tx_queue() To support AF_XDP zero-copy mode in the subsequent patch, the following adjustments have been made to fec_tx_queue(). 1. Change the parameters of fec_tx_queue(). 2. Some variables are initialized at the time of declaration, and the order of local variables is updated to follow the reverse xmas tree style. 3. Remove the variable xdpf and add the variable tx_buf. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205085742.2685134-15-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit a2ae70c0efe4eebc6dd5b96fcfbea913403768a3 Author: Wei Fang Date: Thu Feb 5 16:57:40 2026 +0800 net: fec: add fec_alloc_rxq_buffers_pp() to allocate buffers from page pool Currently, the buffers of RX queue are allocated from the page pool. In the subsequent patches to support XDP zero copy, the RX buffers will be allocated from the UMEM. Therefore, extract fec_alloc_rxq_buffers_pp() from fec_enet_alloc_rxq_buffers() and we will add another helper to allocate RX buffers from UMEM for the XDP zero copy mode. In addition, fec_alloc_rxq_buffers_pp() only initializes bdp->bufaddr and does not initialize other fields of bdp, because these will be initialized in fec_enet_bd_init(). Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260205085742.2685134-14-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit edd393153ef0711e75fa0d1574306c31533e1d08 Author: Wei Fang Date: Thu Feb 5 16:57:39 2026 +0800 net: fec: move xdp_rxq_info* APIs out of fec_enet_create_page_pool() Extract fec_xdp_rxq_info_reg() from fec_enet_create_page_pool() and move it out of fec_enet_create_page_pool(), so that it can be reused in the subsequent patches to support XDP zero copy mode. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260205085742.2685134-13-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 6729b24c1c2fa9b5a3f650a602c5063aec9be8ba Author: Wei Fang Date: Thu Feb 5 16:57:38 2026 +0800 net: fec: remove the size parameter from fec_enet_create_page_pool() Remove the size parameter from fec_enet_create_page_pool(), since rxq->bd.ring_size already contains this information. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205085742.2685134-12-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 8492e4f1959c02c4ab7062699350c392cdfa543f Author: Wei Fang Date: Thu Feb 5 16:57:37 2026 +0800 net: fec: use switch statement to check the type of tx_buf The tx_buf has three types: FEC_TXBUF_T_SKB, FEC_TXBUF_T_XDP_NDO and FEC_TXBUF_T_XDP_TX. Currently, the driver uses 'if...else...' statements to check the type and perform the corresponding processing. This is very detrimental to future expansion. To support AF_XDP zero-copy mode, two new types will be added in the future, continuing to use 'if...else...' would be a very bad coding style. So the 'if...else...' statements in the current driver are replaced with switch statements. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260205085742.2685134-11-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 2dcc93475559168a7d3ccffcc35d79f19416782b Author: Wei Fang Date: Thu Feb 5 16:57:36 2026 +0800 net: fec: remove unnecessary NULL pointer check when clearing TX BD ring The tx_buf pointer will not NULL when its type is FEC_TXBUF_T_XDP_NDO or FEC_TXBUF_T_XDP_TX. If the type is FEC_TXBUF_T_SKB, dev_kfree_skb_any() will do NULL pointer check. So it is unnecessary to do NULL pointer check in fec_enet_bd_init() and fec_enet_tx_queue(). Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205085742.2685134-10-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 2ff7a7d3928bd8bd524d153b84061dc0eba216c2 Author: Wei Fang Date: Thu Feb 5 16:57:35 2026 +0800 net: fec: transmit XDP frames in bulk Currently, the driver writes the ENET_TDAR register for every XDP frame to trigger transmit start. Frequent MMIO writes consume more CPU cycles and may reduce XDP TX performance, so transmit XDP frames in bulk. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205085742.2685134-9-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 8a3344bb734f4eaef889cdb027cf6303e2bd681b Author: Wei Fang Date: Thu Feb 5 16:57:34 2026 +0800 net: fec: add tx_qid parameter to fec_enet_xdp_tx_xmit() Remove fec_enet_xdp_get_tx_queue() from fec_enet_xdp_tx_xmit() and add the tx_qid parameter to it. Then, calculate the TX queue ID for XDP_TX frames in fec_enet_rx_queue_xdp(). This way, the TX queue ID only needs to be calculated once for XDP_TX frames during each NAPI polling. And since the number of RX queues and TX queues in FEC is generally equal, the RX queue ID can be directly used as the TX queue ID. In exceptional cases, fec_enet_xdp_get_tx_queue() is used to calculate the TX queue ID. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260205085742.2685134-8-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 5ff3d3ddcdbed8eeacf8a2eb66a51465a8651f4d Author: Wei Fang Date: Thu Feb 5 16:57:33 2026 +0800 net: fec: add fec_enet_rx_queue_xdp() for XDP path Currently, the processing of XDP path packets and protocol stack packets are both mixed in fec_enet_rx_queue(), which makes the logic somewhat confusing and debugging more difficult. Furthermore, some logic is not needed by each other. Such as the kernel path does not need to call xdp_init_buff(), XDP path does not support swap_buffer(), because fec_enet_bpf() returns "-EOPNOTSUPP" for those platforms which need swap_buffer()), and so on. This prevents XDP from achieving its maximum performance. Therefore, XDP path packets processing has been separated from fec_enet_rx_queue() by adding the fec_enet_rx_queue_xdp() function to optimize XDP path logic and improve XDP performance. The XDP performance on the iMX93 platform was compared before and after applying this patch. Detailed results are as follows and we can see the performance has been improved. Env: i.MX93, packet size 64 bytes including FCS, only single core and RX BD ring are used to receive packets, flow-control is off. Before the patch is applied: xdp-bench tx eth0 Summary 396,868 rx/s 0 err,drop/s Summary 396,024 rx/s 0 err,drop/s xdp-bench drop eth0 Summary 684,781 rx/s 0 err/s Summary 675,746 rx/s 0 err/s xdp-bench pass eth0 Summary 208,552 rx/s 0 err,drop/s Summary 208,654 rx/s 0 err,drop/s xdp-bench redirect eth0 eth0 eth0->eth0 311,210 rx/s 0 err,drop/s 311,208 xmit/s eth0->eth0 310,808 rx/s 0 err,drop/s 310,809 xmit/s After the patch is applied: xdp-bench tx eth0 Summary 409,975 rx/s 0 err,drop/s Summary 411,073 rx/s 0 err,drop/s xdp-bench drop eth0 Summary 700,681 rx/s 0 err/s Summary 698,102 rx/s 0 err/s xdp-bench pass eth0 Summary 211,356 rx/s 0 err,drop/s Summary 210,629 rx/s 0 err,drop/s xdp-bench redirect eth0 eth0 eth0->eth0 320,351 rx/s 0 err,drop/s 320,348 xmit/s eth0->eth0 318,988 rx/s 0 err,drop/s 318,988 xmit/s Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260205085742.2685134-7-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit bc609f97b140c555c4788adedb7fa9dc77e75a27 Author: Wei Fang Date: Thu Feb 5 16:57:32 2026 +0800 net: fec: improve fec_enet_rx_queue() This patch has made the following adjustments to fec_enet_rx_queue(). 1. The function parameters are modified to maintain the same style as subsequently added XDP-related interfaces. 2. Some variables are initialized at the time of declaration, and the order of local variables is updated to follow the reverse xmas tree style. 3. Replace variable cbd_bufaddr with dma. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205085742.2685134-6-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 54a6e86ba4ffd3c816186d366770ae23a99245f1 Author: Wei Fang Date: Thu Feb 5 16:57:31 2026 +0800 net: fec: add fec_build_skb() to build a skb Extract the helper fec_build_skb() from fec_enet_rx_queue(), so that the code for building a skb is centralized in fec_build_skb(), which makes the code of fec_enet_rx_queue() more concise and readable. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205085742.2685134-5-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 385d19b56761b9a1c8eac8c94606854a01e9142f Author: Wei Fang Date: Thu Feb 5 16:57:30 2026 +0800 net: fec: add rx_shift to indicate the extra bytes padded in front of RX frame The FEC of some platforms supports RX FIFO shift-16, it means the actual frame data starts at bit 16 of the first word read from RX FIFO aligning the Ethernet payload on a 32-bit boundary. The MAC writes two additional bytes in front of each frame received into the RX FIFO. Currently, the fec_enet_rx_queue() updates the data_start, sub_len and the rx_bytes statistics by checking whether FEC_QUIRK_HAS_RACC is set. This makes the code less concise, so rx_shift is added to represent the number of extra bytes padded in front of the RX frame. Furthermore, when adding separate RX handling functions for XDP copy mode and zero copy mode in the future, it will no longer be necessary to check FEC_QUIRK_HAS_RACC to update the corresponding variables. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205085742.2685134-4-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit ff306e9a1963ffd5c8b800eb86213f88fac8dd3b Author: Wei Fang Date: Thu Feb 5 16:57:29 2026 +0800 net: fec: add fec_rx_error_check() to check RX errors Extract fec_rx_error_check() from fec_enet_rx_queue(), this helper is used to check RX errors. And it will be used in XDP and XDP zero copy paths in subsequent patches. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205085742.2685134-3-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit c8d4ad91765c451ba6bdbd08d71b6639b42c3b3e Author: Wei Fang Date: Thu Feb 5 16:57:28 2026 +0800 net: fec: add fec_txq_trigger_xmit() helper Currently, the workaround for FEC_QUIRK_ERR007885 has three call sites, so add the helper fec_txq_trigger_xmit() to make the code more concise and reusable. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205085742.2685134-2-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit a1e244a9f177894969c6cd5ebbc6d72c19fc4a7a Author: Harry Yoo Date: Tue Feb 10 17:19:00 2026 +0900 mm/slab: use prandom if !allow_spin When CONFIG_SLAB_FREELIST_RANDOM is enabled and get_random_u32() is called in an NMI context, lockdep complains because it acquires a local_lock: ================================ WARNING: inconsistent lock state 6.19.0-rc5-slab-for-next+ #325 Tainted: G N -------------------------------- inconsistent {INITIAL USE} -> {IN-NMI} usage. kunit_try_catch/8312 [HC2[2]:SC0[0]:HE0:SE1] takes: ffff88a02ec49cc0 (batched_entropy_u32.lock){-.-.}-{3:3}, at: get_random_u32+0x7f/0x2e0 {INITIAL USE} state was registered at: lock_acquire+0xd9/0x2f0 get_random_u32+0x93/0x2e0 __get_random_u32_below+0x17/0x70 cache_random_seq_create+0x121/0x1c0 init_cache_random_seq+0x5d/0x110 do_kmem_cache_create+0x1e0/0xa30 __kmem_cache_create_args+0x4ec/0x830 create_kmalloc_caches+0xe6/0x130 kmem_cache_init+0x1b1/0x660 mm_core_init+0x1d8/0x4b0 start_kernel+0x620/0xcd0 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0xf3/0x140 common_startup_64+0x13e/0x148 irq event stamp: 76 hardirqs last enabled at (75): [] exc_nmi+0x11a/0x240 hardirqs last disabled at (76): [] sysvec_irq_work+0x11/0x110 softirqs last enabled at (0): [] copy_process+0xc7a/0x2350 softirqs last disabled at (0): [<0000000000000000>] 0x0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(batched_entropy_u32.lock); lock(batched_entropy_u32.lock); *** DEADLOCK *** Fix this by using pseudo-random number generator if !allow_spin. This means kmalloc_nolock() users won't get truly random numbers, but there is not much we can do about it. Note that an NMI handler might interrupt prandom_u32_state() and change the random state, but that's safe. Link: https://lore.kernel.org/all/0c33bdee-6de8-4d9f-92ca-4f72c1b6fb9f@suse.cz Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Cc: stable@vger.kernel.org Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260210081900.329447-3-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 144080a5823b2dbd635acb6decf7ab23182664f3 Author: Harry Yoo Date: Tue Feb 10 17:18:59 2026 +0900 mm/slab: do not access current->mems_allowed_seq if !allow_spin Lockdep complains when get_from_any_partial() is called in an NMI context, because current->mems_allowed_seq is seqcount_spinlock_t and not NMI-safe: ================================ WARNING: inconsistent lock state 6.19.0-rc5-kfree-rcu+ #315 Tainted: G N -------------------------------- inconsistent {INITIAL USE} -> {IN-NMI} usage. kunit_try_catch/9989 [HC1[1]:SC0[0]:HE0:SE1] takes: ffff889085799820 (&____s->seqcount#3){.-.-}-{0:0}, at: ___slab_alloc+0x58f/0xc00 {INITIAL USE} state was registered at: lock_acquire+0x185/0x320 kernel_init_freeable+0x391/0x1150 kernel_init+0x1f/0x220 ret_from_fork+0x736/0x8f0 ret_from_fork_asm+0x1a/0x30 irq event stamp: 56 hardirqs last enabled at (55): [] _raw_spin_unlock_irq+0x27/0x70 hardirqs last disabled at (56): [] __schedule+0x2a8a/0x6630 softirqs last enabled at (0): [] copy_process+0x1dc1/0x6a10 softirqs last disabled at (0): [<0000000000000000>] 0x0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&____s->seqcount#3); lock(&____s->seqcount#3); *** DEADLOCK *** According to Documentation/locking/seqlock.rst, seqcount_t is not NMI-safe and seqcount_latch_t should be used when read path can interrupt the write-side critical section. In this case, do not access current->mems_allowed_seq and avoid retry. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Cc: stable@vger.kernel.org Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260210081900.329447-2-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit d82cb7b7ec421196d7823a5d8e0bced9a85c1d11 Author: Ethan Nelson-Moore Date: Wed Feb 4 23:06:31 2026 -0800 net: arcnet: com20020-pci: use module_pci_driver The only thing this driver's init/exit functions do is call pci_register/unregister_driver, and in the case of the init function, print an unnecessary message. Replace them with module_pci_driver to simplify the code. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260205070632.37516-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni commit f743435f988cb0cf1f521035aee857851b25e06d Author: Colin Lord Date: Mon Feb 9 23:48:10 2026 -0800 tracing: Fix false sharing in hwlat get_sample() The get_sample() function in the hwlat tracer assumes the caller holds hwlat_data.lock, but this is not actually happening. The result is unprotected data access to hwlat_data, and in per-cpu mode can result in false sharing which may show up as false positive latency events. The specific case of false sharing observed was primarily between hwlat_data.sample_width and hwlat_data.count. These are separated by just 8B and are therefore likely to share a cache line. When one thread modifies count, the cache line is in a modified state so when other threads read sample_width in the main latency detection loop, they fetch the modified cache line. On some systems, the fetch itself may be slow enough to count as a latency event, which could set up a self reinforcing cycle of latency events as each event increments count which then causes more latency events, continuing the cycle. The other result of the unprotected data access is that hwlat_data.count can end up with duplicate or missed values, which was observed on some systems in testing. Convert hwlat_data.count to atomic64_t so it can be safely modified without locking, and prevent false sharing by pulling sample_width into a local variable. One system this was tested on was a dual socket server with 32 CPUs on each numa node. With settings of 1us threshold, 1000us width, and 2000us window, this change reduced the number of latency events from 500 per second down to approximately 1 event per minute. Some machines tested did not exhibit measurable latency from the false sharing. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com Signed-off-by: Colin Lord Signed-off-by: Steven Rostedt (Google) commit 0a9be83e57de0d0ca8ca4ec610bc344f17a8e5e7 Author: Miguel Ojeda Date: Fri Feb 6 21:45:35 2026 +0100 rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 Custom target specifications are unstable, but starting with Rust 1.95.0, `rustc` requires to explicitly pass `-Zunstable-options` to use them [1]: error: error loading target specification: custom targets are unstable and require `-Zunstable-options` | = help: run `rustc --print target-list` for a list of built-in targets David (Rust compiler team lead), writes: "We're destabilising custom targets to allow us to move forward with build-std without accidentally exposing functionality that we'd like to revisit prior to committing to. I'll start a thread on Zulip to discuss with the RfL team how we can come up with an alternative for them." Thus pass it. Cc: David Wood Cc: Wesley Wiser Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://github.com/rust-lang/rust/pull/151534 [1] Reviewed-by: Gary Guo Tested-by: Gary Guo Link: https://patch.msgid.link/20260206204535.39431-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 815c8e35511d0b9a214e9f644983fe477af9d5cb Merge: 98e99fc4ad4b30 40fd0acc45d067 Author: Vlastimil Babka Date: Sun Feb 8 19:17:42 2026 +0100 Merge branch 'slab/for-7.0/sheaves' into slab/for-next Merge series "slab: replace cpu (partial) slabs with sheaves". The percpu sheaves caching layer was introduced as opt-in but the goal was to eventually move all caches to them. This is the next step, enabling sheaves for all caches (except the two bootstrap ones) and then removing the per cpu (partial) slabs and lots of associated code. Besides the lower locking overhead and much more likely fastpath when freeing, this removes the rather complicated code related to the cpu slab lockless fastpaths (using this_cpu_try_cmpxchg128/64) and all its complications for PREEMPT_RT or kmalloc_nolock(). The lockless slab freelist+counters update operation using try_cmpxchg128/64 remains and is crucial for freeing remote NUMA objects and to allow flushing objects from sheaves to slabs mostly without the node list_lock. Link: https://lore.kernel.org/all/20260123-sheaves-for-all-v4-0-041323d506f7@suse.cz/ commit 30827969b03e7745dd199dca48847604d99b70b3 Merge: 71e1eab8d246c2 a046d6fc54d461 Author: Paolo Abeni Date: Tue Feb 10 09:09:31 2026 +0100 Merge branch 'net-dsa-mxl-gsw1xx-setup-polarities-and-validate-chip' Daniel Golle says: ==================== net: dsa: mxl-gsw1xx: setup polarities and validate chip Now that common PHY properties make it easy to configure the SerDes RX and TX polarities, use that for the SGMII/1000Base-X/2500Base-X port of the MaxLinear GSW1xx switches. Also, validate hardware in probe() function to make sure the switch is actually present and MDIO communication works properly. ==================== Link: https://patch.msgid.link/cover.1769916962.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit a046d6fc54d46168f69cf4d4a35f714594d205b8 Author: Daniel Golle Date: Sun Feb 1 03:42:18 2026 +0000 net: dsa: mxl-gsw1xx: validate chip ID No check for actually present hardware is being performed in the probe function of the mxl-gsw1xx switch driver. So even if the switch isn't present at the configured MDIO bus address the driver wrongly tells the user that a "GSWIP version 0 mod 0" was found, outputting errors about PHY capabilities not matching. Read and validate the chip MANU_ID and PNUM_ID registers and output information while probing, but return an error and abort probing in case the hardware is not actually present. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/3194d3d3bb0b51f08755d392e1fdf7bb6dc49608.1769916962.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit ffd034ac0912bb09c3d8e0fb30f3aedbdc0f25b4 Author: Daniel Golle Date: Sun Feb 1 03:42:00 2026 +0000 net: dsa: mxl-gsw1xx: configure SerDes port polarities Configure SerDes (port 4) RX and TX polarities using the newly introduced generic properties. The polarities are described at the port level which equals the polarities of the external pins of the chip. Note that the RX lane is inverted internally and the vendor driver simply always sets bit GSW1XX_SGMII_PHY_RX0_CFG2_INVERT unconditionally to end up with the correct (ie. as documented in datasheets) polarity at the external pins. In this sense, PHY_POLARITY_NORMAL denotes normal polarity for pins as documented for the MRQFN 105-pin package (GSW120, GSW125, GSW140, GSW141 and GSW145 all use the same package and have identical pin layouts except for TP port 2 and 3 being N/C on GSW12x): pin B18 (TX0_P) positive signal of the differential SGMII data output pair pin B19 (TX0_M) negative signal of the differential SGMII data output pair pin B20 (RX0_P) positive signal of the differential SGMII data input pair pin B21 (RX0_M) negative signal of the differential SGMII data input pair Signed-off-by: Daniel Golle Link: https://patch.msgid.link/8bf79b3476e23673fceffbe2bc9d6abc13d132e5.1769916962.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 431b777762d7373dd5bb2874b806eae4e0ff1f6d Author: Daniel Golle Date: Sun Feb 1 03:41:53 2026 +0000 dt-bindings: net: dsa: lantiq,gswip: reference common PHY properties Reference the common PHY properties so RX and TX SerDes lane polarity of the SGMII/1000Base-X/2500Base-X port can be configured. Signed-off-by: Daniel Golle Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/f556ef8be75e37a2f864b9d905a78962bbe76d18.1769916962.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit ab2e361ca97a42b7af8be1d273646b30d3b75bf3 Author: Rakesh Kota Date: Mon Feb 9 18:53:37 2026 +0530 dt-bindings: input: qcom,pm8941-pwrkey: Document PMM8654AU Add compatible strings for PMM8654AU power key and resin support. These blocks are compatible with PMK8350, so use that as the fallback. Signed-off-by: Rakesh Kota Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260209-add_pwrkey_and_resin-v2-2-f944d87b9a93@oss.qualcomm.com Signed-off-by: Dmitry Torokhov commit 71e1eab8d246c27b6e7e2917e8d0e6866977a627 Merge: 57be33f85e369c c61a375315c037 Author: Jakub Kicinski Date: Mon Feb 9 21:08:39 2026 -0800 Merge branch 'net-stats-tools-driver-tests-for-hw-gro' Jakub Kicinski says: ==================== net: stats, tools, driver tests for HW GRO [part] Add miscellaneous pieces related to production use of HW-GRO: - report standard stats from drivers (bnxt included here, Gal recently posted patches for mlx5 which is great) - CLI tool for calculating HW GRO savings / effectiveness ==================== Link: https://patch.msgid.link/20260207003509.3927744-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c61a375315c0374134b9ad883f0c64c982c2016b Author: Jakub Kicinski Date: Fri Feb 6 16:35:03 2026 -0800 tools: ynltool: add qstats analysis for HW-GRO efficiency / savings Extend ynltool to compute HW GRO savings metric - how many packets has HW GRO been able to save the kernel from seeing. Note that this definition does not actually take into account whether the segments were or weren't eligible for HW GRO. If a machine is receiving all-UDP traffic - new metric will show HW-GRO savings of 0%. Conversely since the super-packet still counts as a received packet, savings of 100% is not achievable. Perfect HW-GRO on a machine with 4k MTU and 64kB super-frames would show ~93.75% savings. With 1.5k MTU we may see up to ~97.8% savings (if my math is right). Example after 10 sec of iperf on a freshly booted machine with 1.5k MTU: $ ynltool qstats show eth0 rx-packets: 40681280 rx-bytes: 61575208437 rx-alloc-fail: 0 rx-hw-gro-packets: 1225133 rx-hw-gro-wire-packets: 40656633 $ ynltool qstats hw-gro eth0: 96.9% savings None of the NICs I have access to can report "missed" HW-GRO opportunities so computing a true "effectiveness" metric is not possible. One could also argue that effectiveness metric is inferior in environments where we control both senders and receivers, the savings metrics will capture both regressions in receiver's HW GRO effectiveness but also regressions in senders sending smaller TSO trains. And we care about both. The main downside is that it's hard to tell at a glance how well the NIC is doing because the savings will be dependent on traffic patterns. Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260207003509.3927744-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5374c334d64f8e1dfc4aadcbcd3a1090fbe39acb Author: Jakub Kicinski Date: Fri Feb 6 16:35:02 2026 -0800 tools: ynltool: factor out qstat dumping The logic to open a socket and dump the queues is the same across sub-commands. Factor it out, we'll need it again. No functional changes intended. Reviewed-by: Petr Machata Link: https://patch.msgid.link/20260207003509.3927744-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a7fc1a488f09f0fbf727fe3ca5b017e7657f152d Author: Jakub Kicinski Date: Fri Feb 6 16:35:01 2026 -0800 eth: bnxt: gather and report HW-GRO stats Count and report HW-GRO stats as seen by the kernel. The device stats for GRO seem to not reflect the reality, perhaps they count sessions which did not actually result in any aggregation. Also they count wire packets, so we have to count super-frames, anyway. Reviewed-by: Michael Chan Link: https://patch.msgid.link/20260207003509.3927744-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 72c395024dac5e215136cbff793455f065603b06 Merge: 0c61526621ec19 0a83293322fde6 Author: Linus Torvalds Date: Mon Feb 9 20:53:18 2026 -0800 Merge tag 'docs-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux Pull documentation updates from Jonathan Corbet: "A slightly calmer cycle for docs this time around, though there is still a fair amount going on, including: - Some signs of life on the long-moribund Japanese translation - Documentation on policies around the use of generative tools for patch submissions, and a separate document intended for consumption by generative tools - The completion of the move of the documentation tools to tools/docs. For now we're leaving a /scripts/kernel-doc symlink behind to avoid breaking scripts - Ongoing build-system work includes the incorporation of documentation in Python code, better support for documenting variables, and lots of improvements and fixes - Automatic linking of man-page references -- cat(1), for example -- to the online pages in the HTML build ...and the usual array of typo fixes and such" * tag 'docs-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: (107 commits) doc: development-process: add notice on testing tools: sphinx-build-wrapper: improve its help message docs: sphinx-build-wrapper: allow -v override -q docs: kdoc: Fix pdfdocs build for tools docs: ja_JP: process: translate 'Obtain a current source tree' docs: fix 're-use' -> 'reuse' in documentation docs: ioctl-number: fix a typo in ioctl-number.rst docs: filesystems: ensure proc pid substitutable is complete docs: automarkup.py: Skip common English words as C identifiers Documentation: use a source-read extension for the index link boilerplate docs: parse_features: make documentation more consistent docs: add parse_features module documentation docs: jobserver: do some documentation improvements docs: add jobserver module documentation docs: kabi: helpers: add documentation for each "enum" value docs: kabi: helpers: add helper for debug bits 7 and 8 docs: kabi: system_symbols: end docstring phrases with a dot docs: python: abi_regex: do some improvements at documentation docs: python: abi_parser: do some improvements at documentation docs: add kabi modules documentation ... commit 0c61526621ec1916527d6f6226d8a466340cca22 Merge: 33120a2f8fc47f c5a8f13f1e476c Author: Linus Torvalds Date: Mon Feb 9 20:49:19 2026 -0800 Merge tag 'efi-next-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Quirk the broken EFI framebuffer geometry on the Valve Steam Deck - Capture the EDID information of the primary display also on non-x86 EFI systems when booting via the EFI stub. * tag 'efi-next-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: Support EDID information sysfb: Move edid_info into sysfb_primary_display sysfb: Pass sysfb_primary_display to devices sysfb: Replace screen_info with sysfb_primary_display sysfb: Add struct sysfb_display_info efi: sysfb_efi: Reduce number of references to global screen_info efi: earlycon: Reduce number of references to global screen_info efi: sysfb_efi: Fix efidrmfb and simpledrmfb on Valve Steam Deck efi: sysfb_efi: Convert swap width and height quirk to a callback efi: sysfb_efi: Fix lfb_linelength calculation when applying quirks efi: sysfb_efi: Replace open coded swap with the macro commit 33120a2f8fc47f388506b7df1209bd5ac85dd584 Merge: 45bf4bc87c4685 c307b6dc9c4f68 Author: Linus Torvalds Date: Mon Feb 9 20:38:27 2026 -0800 Merge tag 'for-linus-7.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - fix running as Xen PVH guest in 32-bit mode without PAE - fix PV device handling for suspend/resume when running as a Xen guest - clean up workqueue usage - fix the Xen balloon driver for PVH dom0 - introduce the possibility to use hypercalls for console messages in unprivileged guests - enable Xen dom0 use of virtio devices in nested virtualization setups - simplify the xen-mcelog driver * tag 'for-linus-7.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xenbus: Rename helpers to freeze/thaw/restore xenbus: Use .freeze/.thaw to handle xenbus devices xen/mcelog: simplify MCE_GETCLEAR_FLAGS using xchg() xen/balloon: improve accuracy of initial balloon target for dom0 Partial revert "x86/xen: fix balloon target initialization for PVH dom0" xen: introduce xen_console_io option xen/virtio: Don't use grant-dma-ops when running as Dom0 x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set xen: privcmd: WQ_PERCPU added to alloc_workqueue users xen/events: replace use of system_wq with system_percpu_wq commit 45bf4bc87c46856c5cf4ac39a0c25c83ccbf3209 Merge: 9f722cb7304f63 36c0de02575ce5 Author: Linus Torvalds Date: Mon Feb 9 20:28:45 2026 -0800 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Will Deacon: "There's a little less than normal, probably due to LPC & Christmas/New Year meaning that a few series weren't quite ready or reviewed in time. It's still useful across the board, despite the only real feature being support for the LS64 feature enabling 64-byte atomic accesses to endpoints that support it. ACPI: - Add interrupt signalling support to the AGDI handler - Add Catalin and myself to the arm64 ACPI MAINTAINERS entry CPU features: - Drop Kconfig options for PAN and LSE (these are detected at runtime) - Add support for 64-byte single-copy atomic instructions (LS64/LS64V) - Reduce MTE overhead when executing in the kernel on Ampere CPUs - Ensure POR_EL0 value exposed via ptrace is up-to-date - Fix error handling on GCS allocation failure CPU frequency: - Add CPU hotplug support to the FIE setup in the AMU driver Entry code: - Minor optimisations and cleanups to the syscall entry path - Preparatory rework for moving to the generic syscall entry code Hardware errata: - Work around Spectre-BHB on TSV110 processors - Work around broken CMO propagation on some systems with the SI-L1 interconnect Miscellaneous: - Disable branch profiling for arch/arm64/ to avoid issues with noinstr - Minor fixes and cleanups (kexec + ubsan, WARN_ONCE() instead of WARN_ON(), reduction of boolean expression) - Fix custom __READ_ONCE() implementation for LTO builds when operating on non-atomic types Perf and PMUs: - Support for CMN-600AE - Be stricter about supported hardware in the CMN driver - Support for DSU-110 and DSU-120 - Support for the cycles event in the DSU driver (alongside the dedicated cycles counter) - Use IRQF_NO_THREAD instead of IRQF_ONESHOT in the cxlpmu driver - Use !bitmap_empty() as a faster alternative to bitmap_weight() - Fix SPE error handling when failing to resume profiling Selftests: - Add support for the FORCE_TARGETS option to the arm64 kselftests - Avoid nolibc-specific my_syscall() function - Add basic test for the LS64 HWCAP - Extend fp-pidbench to cover additional workload patterns" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (43 commits) perf/arm-cmn: Reject unsupported hardware configurations perf: arm_spe: Properly set hw.state on failures arm64/gcs: Fix error handling in arch_set_shadow_stack_status() arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y arm64: poe: fix stale POR_EL0 values for ptrace kselftest/arm64: Raise default number of loops in fp-pidbench kselftest/arm64: Add a no-SVE loop after SVE in fp-pidbench perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD arm64: mte: Set TCMA1 whenever MTE is present in the kernel arm64/ptrace: Return early for ptrace_report_syscall_entry() error arm64/ptrace: Split report_syscall() arm64: Remove unused _TIF_WORK_MASK kselftest/arm64: Add missing file in .gitignore arm64: errata: Workaround for SI L1 downstream coherency issue kselftest/arm64: Add HWCAP test for FEAT_LS64 arm64: Add support for FEAT_{LS64, LS64_V} KVM: arm64: Enable FEAT_{LS64, LS64_V} in the supported guest arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 KVM: arm64: Handle DABT caused by LS64* instructions on unsupported memory KVM: arm64: Add documentation for KVM_EXIT_ARM_LDST64B ... commit 9f722cb7304f63d8be7164c15ebc278f54d14357 Merge: 7e3a1e0cccbf6d dd5712f3379cfe Author: Linus Torvalds Date: Mon Feb 9 20:22:26 2026 -0800 Merge tag 'alpha-for-v7.0-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha Pull alpha update from Magnus Lindholm: - alpha: fix user-space corruption during memory compaction * tag 'alpha-for-v7.0-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha: alpha: fix user-space corruption during memory compaction commit 7e3a1e0cccbf6d9bcc05e2710f53a480639cf81d Merge: b33c3b84045e88 d844152d85cfcc Author: Linus Torvalds Date: Mon Feb 9 20:20:17 2026 -0800 Merge tag 'sparc-for-7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc Pull sparc updates from Andreas Larsson: - Hardcode uapi ioctls.h TC* constants to not rely upon struct termio that has been dropped by glibc - Fix bug for fork/clone and add support for clone3 - Add ARCH_HAS_CC_CAN_LINK - API choice improvements and cleanup of unused variables * tag 'sparc-for-7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc: sparc: remove unused variable strtab sparc64: fix unused variable warning sparc: don't reference obsolete termio struct for TC* constants sparc: vio: Replace snprintf with strscpy in vio_create_one sparc: Add architecture support for clone3 sparc: Synchronize user stack on fork and clone sparc: Implement ARCH_HAS_CC_CAN_LINK commit b33c3b84045e880d8a7596f260860038c71cf393 Merge: c48953d81972bf cb39cf99d88e8f Author: Linus Torvalds Date: Mon Feb 9 20:18:59 2026 -0800 Merge tag 'm68k-for-v7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Add missing put_device() in the NuBus driver - Replace vsprintf() with vsnprintf() on Sun-3 * tag 'm68k-for-v7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: sun3: Replace vsprintf() with bounded vsnprintf() nubus: Call put_device() in bus initialization error path commit c48953d81972bfe16a9e3551883992aa6efe541a Merge: 861ea34546dcde 5ae76830c76cf3 Author: Linus Torvalds Date: Mon Feb 9 20:17:03 2026 -0800 Merge tag 's390-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Heiko Carstens: - Drop support for outdated 3590/3592 and 3480 tape devices, and limit support to virtualized 3490E types devices - Implement exception based WARN() and WARN_ONCE() similar to x86 - Slightly optimize preempt primitives like __preempt_count_add() and __preempt_count_dec_and_test() - A couple of small fixes and improvements * tag 's390-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (35 commits) s390/tape: Consolidate tape config options and modules s390/cio: Fix device lifecycle handling in css_alloc_subchannel() s390/tape: Rename tape_34xx.c to tape_3490.c s390/tape: Cleanup sense data analysis and error handling s390/tape: Remove 3480 tape device type s390/tape: Remove unused command definitions s390/tape: Remove special block id handling s390/tape: Remove tape load display support s390/tape: Remove support for 3590/3592 models s390/kexec: Emit an error message when cmdline is too long s390/configs: Enable BLK_DEV_NULL_BLK as module s390: Document s390 stackprotector support s390/perf: Disable register readout on sampling events s390/Kconfig: Define non-zero ILLEGAL_POINTER_VALUE s390/bug: Prevent tail-call optimization s390/bug: Skip __WARN_trap() in call traces s390/bug: Implement WARN_ONCE() s390/bug: Implement __WARN_printf() s390/traps: Copy monitor code to pt_regs s390/bug: Introduce and use monitor code macro ... commit 861ea34546dcde8600878d5e7f746795f22fc818 Merge: d16738a4e79e55 a5f00be9b3b07d Author: Linus Torvalds Date: Mon Feb 9 20:15:14 2026 -0800 Merge tag 'nolibc-20260206-for-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc Pull nolibc updates from Thomas Weißschuh: - All time-related functionality uses 64-bit timestamps for y2038 compatibility - fread() and fskeek() support - ptrace() support - Addition of libc-test to the regular kselftests - Smaller cleanups and fixes to the code and build system * tag 'nolibc-20260206-for-7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: (25 commits) tools/nolibc: Add a simple test for writing to a FILE and reading it back tools/nolibc: Add fseek() to stdio.h tools/nolibc: Add fread() to stdio.h selftests/nolibc: also test libc-test through regular selftest framework selftests/nolibc: scope custom flags to the nolibc-test target selftests/nolibc: try to read from stdin in readv_zero test selftests/nolibc: always build sparc32 tests with -mcpu=v8 tools/nolibc: align sys_vfork() with sys_fork() selftests/nolibc: drop NOLIBC_SYSROOT=0 logic selftests/nolibc: add static assertions around time types handling tools/nolibc: add __nolibc_static_assert() tools/nolibc: add compiler version detection macros tools/nolibc: remove time conversions selftests/nolibc: test compatibility of nolibc and kernel time types tools/nolibc: always use 64-bit time types tools/nolibc: use custom structs timespec and timeval tools/nolibc/select: avoid libgcc 64-bit multiplications tools/nolibc/gettimeofday: avoid libgcc 64-bit divisions tools/nolibc: prefer explicit 64-bit time-related system calls tools/nolibc/time: drop invocation of gettimeofday system call ... commit d16738a4e79e55b2c3c9ff4fb7b74a4a24723515 Merge: 0506158ac7363a fa39ec4f89f263 Author: Linus Torvalds Date: Mon Feb 9 19:57:30 2026 -0800 Merge tag 'kthread-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks Pull kthread updates from Frederic Weisbecker: "The kthread code provides an infrastructure which manages the preferred affinity of unbound kthreads (node or custom cpumask) against housekeeping (CPU isolation) constraints and CPU hotplug events. One crucial missing piece is the handling of cpuset: when an isolated partition is created, deleted, or its CPUs updated, all the unbound kthreads in the top cpuset become indifferently affine to _all_ the non-isolated CPUs, possibly breaking their preferred affinity along the way. Solve this with performing the kthreads affinity update from cpuset to the kthreads consolidated relevant code instead so that preferred affinities are honoured and applied against the updated cpuset isolated partitions. The dispatch of the new isolated cpumasks to timers, workqueues and kthreads is performed by housekeeping, as per the nice Tejun's suggestion. As a welcome side effect, HK_TYPE_DOMAIN then integrates both the set from boot defined domain isolation (through isolcpus=) and cpuset isolated partitions. Housekeeping cpumasks are now modifiable with a specific RCU based synchronization. A big step toward making nohz_full= also mutable through cpuset in the future" * tag 'kthread-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks: (33 commits) doc: Add housekeeping documentation kthread: Document kthread_affine_preferred() kthread: Comment on the purpose and placement of kthread_affine_node() call kthread: Honour kthreads preferred affinity after cpuset changes sched/arm64: Move fallback task cpumask to HK_TYPE_DOMAIN sched: Switch the fallback task allowed cpumask to HK_TYPE_DOMAIN kthread: Rely on HK_TYPE_DOMAIN for preferred affinity management kthread: Include kthreadd to the managed affinity list kthread: Include unbound kthreads in the managed affinity list kthread: Refine naming of affinity related fields PCI: Remove superfluous HK_TYPE_WQ check sched/isolation: Remove HK_TYPE_TICK test from cpu_is_isolated() cpuset: Remove cpuset_cpu_is_isolated() timers/migration: Remove superfluous cpuset isolation test cpuset: Propagate cpuset isolation update to timers through housekeeping cpuset: Propagate cpuset isolation update to workqueue through housekeeping PCI: Flush PCI probe workqueue on cpuset isolated partition change sched/isolation: Flush vmstat workqueues on cpuset isolated partition change sched/isolation: Flush memcg workqueues on cpuset isolated partition change cpuset: Update HK_TYPE_DOMAIN cpumask from cpuset ... commit 0506158ac7363a70f0deb49f71d26ccb57e55990 Merge: 9b1b3dcd28c271 8035d70cf85e86 Author: Linus Torvalds Date: Mon Feb 9 19:33:44 2026 -0800 Merge tag 'thermal-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These add support for "slow" (long-term trend) workload type hints to the Intel int340x thermal driver and selftests (and enable it for Panther Lake), add support for MT8196 along with DT bindings and for MT7987 to the Mediatek LVTS thermal driver, add support for RZ/T2H and RZ/N2H along with DT bindings to the Renesas rzg3e thermal driver, add support for the Panther Lake, Wildcat Lake and Nova Lake processors to the intel_tcc_cooling driver, fix bugs, make some cosmetic changes including code cleanups and library function substitutions, and update documentation. Specifics: - Add Panther Lake, Wildcat Lake and Nova Lake processor IDs to the list of supported processors in the intel_tcc_cooling thermal driver (Srinivas Pandruvada) - Drop unnecessary explicit driver data clearing on removal from the intel_pch_thermal driver (Kaushlendra Kumar) - Add support for "slow" workload type hints to the int340x processor_thermal driver and enable it on the Panther Lake platform (Srinivas Pandruvada) - Use sysfs_emit{_at}() in sysfs show functions in Intel thermal drivers (Thorsten Blum) - Update the x86_pkg_temp_thermal driver to handle THERMAL_TEMP_INVALID that can be passed to it via sysfs as expected (Rafael Wysocki) - Drop a redundant local variable from the intel_tcc_cooling thermal driver and fix a kerneldoc comment typo in the TCC library (Sumeet Pawnikar) - Fix CFLAGS and LDFLAGS in the pkg-config libthermal template (Romain Gantois) - Support multiple temp to raw conversion functions in the Mediatek LVTS thermal driver and add MT8196 and MT6991 support to it (Laura Nao) - Add Mediatek LVTS driver support for MT7987 (Frank Wunderlich) - Use the existing HZ_PER_MHZ macro on STM32 (Andy Shevchenko) - Use the existing clamp() macro on BCM2835 (Thorsten Blum) - Make the reset line optional in order to support new Renesas SoCs where it is not available and add support for RZ/T2H and RZ/N2H to the rzg3e thermal driver (Cosmin Tanislav) - Document RZ/V2N TSU in the r9a09g047-tsu DT bindings (Ovidiu Panait) - Fix all kernel-doc warnings in the internal thermal core header file (Randy Dunlap) - Fix a device node reference leak in thermal_of_cm_lookup() (Felix Gu) - Replace some old-style library function calls with ones that are currently recommended in several places in the thermal core and debugfs code (Sumeet Pawnikar, Thorsten Blum) * tag 'thermal-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (34 commits) drivers: thermal: intel: tcc_cooling: Drop redundant local variable thermal/of: Fix reference leak in thermal_of_cm_lookup() thermal: core: thermal_core.h: fix all kernel-doc warnings thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature thermal: renesas: rzg3e: add support for RZ/T2H and RZ/N2H dt-bindings: thermal: r9a09g047-tsu: document RZ/T2H and RZ/N2H thermal: renesas: rzg3e: make calibration value retrieval per-chip thermal: renesas: rzg3e: make min and max temperature per-chip thermal: renesas: rzg3e: make reset optional dt-bindings: thermal: r9a09g047-tsu: Document RZ/V2N TSU thermal/drivers/broadcom: Use clamp to simplify bcm2835_thermal_temp2adc thermal/drivers/stm32: Use predefined HZ_PER_MHZ instead of a custom one thermal/drivers/mediatek/lvts_thermal: Add mt7987 support dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for MT7987 dt-bindings: nvmem: mediatek: efuse: Add support for MT8196 thermal/drivers/mediatek/lvts_thermal: Add MT8196 support thermal/drivers/mediatek/lvts: Support MSR offset for 16-bit calibration data thermal/drivers/mediatek/lvts: Add support for ATP mode thermal/drivers/mediatek/lvts: Add lvts_temp_to_raw variant thermal/drivers/mediatek/lvts: Add platform ops to support alternative conversion logic ... commit daa0b901f8319414cf9f56237f15240b95e4b1b2 Author: Yang Xiuwei Date: Tue Feb 10 10:34:32 2026 +0800 io_uring/tctx: avoid modifying loop variable in io_ring_add_registered_file Use a separate 'idx' variable to store the result of array_index_nospec() instead of modifying the loop variable 'offset' directly. This improves code clarity by separating the logical index from the sanitized index used for array access. No functional change intended. Signed-off-by: Yang Xiuwei Signed-off-by: Jens Axboe commit 7cb3a68376da0bc0afab8157223cb479c97de9ff Author: Caleb Sander Mateos Date: Fri Feb 6 14:58:04 2026 -0700 io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check io_uring_sanitise_params() already rejects flags that include both IORING_SETUP_SQPOLL and IORING_SETUP_DEFER_TASKRUN. So it's unnecessary to check IORING_SETUP_SQPOLL in io_uring_create() when IORING_SETUP_DEFER_TASKRUN has already been checked. Drop the !(ctx->flags & IORING_SETUP_SQPOLL) check for the task_complete case. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 55d43aab478db869f57281e947020605f9ff6b16 Author: Frank Li Date: Sat Jan 31 20:19:13 2026 -0500 dt-bindings: soc: imx: add fsl,aips and fsl,emi compatible strings Add the fsl,aips and fsl,emi compatible strings for legacy i.MX3 SoCs (over 15 years old). Signed-off-by: Frank Li Link: https://patch.msgid.link/20260201011913.2419626-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit eb83cb510979f6b47da7f14c0ee42cbeb746534c Author: Dominik Haller Date: Fri Jan 30 12:58:15 2026 -0800 dt-bindings: display: bridge: lt8912b: Drop reset gpio requirement Drop the gpio reset from the list of required properties. The bridge works fine with a reset not managed by Linux. In the driver itself the gpio is already flagged as optional. Signed-off-by: Dominik Haller Link: https://patch.msgid.link/20260130205820.83189-6-d.haller@phytec.de Signed-off-by: Rob Herring (Arm) commit 9b1b3dcd28c271fc8c4a87e81860f3a34b6d29b7 Merge: d84e173311c4f0 0f64b6acb0e145 Author: Linus Torvalds Date: Mon Feb 9 19:00:42 2026 -0800 Merge tag 'pm-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "By the number of commits, cpufreq is the leading party (again) and the most visible change there is the removal of the omap-cpufreq driver that has not been used for a long time (good riddance). There are also quite a few changes in the cppc_cpufreq driver, mostly related to fixing its frequency invariance engine in the case when the CPPC registers used by it are not in PCC. In addition to that, support for AM62L3 is added to the ti-cpufreq driver and the cpufreq-dt-platdev list is updated for some platforms. The remaining cpufreq changes are assorted fixes and cleanups. Next up is cpuidle and the changes there are dominated by intel_idle driver updates, mostly related to the new command line facility allowing users to adjust the list of C-states used by the driver. There are also a few updates of cpuidle governors, including two menu governor fixes and some refinements of the teo governor, and a MAINTAINERS update adding Christian Loehle as a cpuidle reviewer. [Thanks for stepping up Christian!] The most significant update related to system suspend and hibernation is the one to stop freezing the PM runtime workqueue during system PM transitions which allows some deadlocks to be avoided. There is also a fix for possible concurrent bit field updates in the core device suspend code and a few other minor fixes. Apart from the above, several drivers are updated to discard the return value of pm_runtime_put() which is going to be converted to a void function as soon as everybody stops using its return value, PL4 support for Ice Lake is added to the Intel RAPL power capping driver, and there are assorted cleanups, documentation fixes, and some cpupower utility improvements. Specifics: - Remove the unused omap-cpufreq driver (Andreas Kemnade) - Optimize error handling code in cpufreq_boost_trigger_state() and make cpufreq_boost_trigger_state() return -EOPNOTSUPP if no policy supports boost (Lifeng Zheng) - Update cpufreq-dt-platdev list for tegra, qcom, TI (Aaron Kling, Dhruva Gole, and Konrad Dybcio) - Minor improvements to the cpufreq and cpumask rust implementation (Alexandre Courbot, Alice Ryhl, Tamir Duberstein, and Yilin Chen) - Add support for AM62L3 SoC to the ti-cpufreq driver (Dhruva Gole) - Update arch_freq_scale in the CPPC cpufreq driver's frequency invariance engine (FIE) in scheduler ticks if the related CPPC registers are not in PCC (Jie Zhan) - Assorted minor cleanups and improvements in ARM cpufreq drivers (Juan Martinez, Felix Gu, Luca Weiss, and Sergey Shtylyov) - Add generic helpers for sysfs show/store to cppc_cpufreq (Sumit Gupta) - Make the scaling_setspeed cpufreq sysfs attribute return the actual requested frequency to avoid confusion (Pengjie Zhang) - Simplify the idle CPU time granularity test in the ondemand cpufreq governor (Frederic Weisbecker) - Enable asym capacity in intel_pstate only when CPU SMT is not possible (Yaxiong Tian) - Update the description of rate_limit_us default value in cpufreq documentation (Yaxiong Tian) - Add a command line option to adjust the C-states table in the intel_idle driver, remove the 'preferred_cstates' module parameter from it, add C-states validation to it and clean it up (Artem Bityutskiy) - Make the menu cpuidle governor always check the time till the closest timer event when the scheduler tick has been stopped to prevent it from mistakenly selecting the deepest available idle state (Rafael Wysocki) - Update the teo cpuidle governor to avoid making suboptimal decisions in certain corner cases and generally improve idle state selection accuracy (Rafael Wysocki) - Remove an unlikely() annotation on the early-return condition in menu_select() that leads to branch misprediction 100% of the time on systems with only 1 idle state enabled, like ARM64 servers (Breno Leitao) - Add Christian Loehle to MAINTAINERS as a cpuidle reviewer (Christian Loehle) - Stop flagging the PM runtime workqueue as freezable to avoid system suspend and resume deadlocks in subsystems that assume asynchronous runtime PM to work during system-wide PM transitions (Rafael Wysocki) - Drop redundant NULL pointer checks before acomp_request_free() from the hibernation code handling image saving (Rafael Wysocki) - Update wakeup_sources_walk_start() to handle empty lists of wakeup sources as appropriate (Samuel Wu) - Make dev_pm_clear_wake_irq() check the power.wakeirq value under power.lock to avoid race conditions (Gui-Dong Han) - Avoid bit field races related to power.work_in_progress in the core device suspend code (Xuewen Yan) - Make several drivers discard pm_runtime_put() return value in preparation for converting that function to a void one (Rafael Wysocki) - Add PL4 support for Ice Lake to the Intel RAPL power capping driver (Daniel Tang) - Replace sprintf() with sysfs_emit() in power capping sysfs show functions (Sumeet Pawnikar) - Make dev_pm_opp_get_level() return value match the documentation after a previous update of the latter (Aleks Todorov) - Use scoped for each OF child loop in the OPP code (Krzysztof Kozlowski) - Fix a bug in an example code snippet and correct typos in the energy model management documentation (Patrick Little) - Fix miscellaneous problems in cpupower (Kaushlendra Kumar): * idle_monitor: Fix incorrect value logged after stop * Fix inverted APERF capability check * Use strcspn() to strip trailing newline * Reset errno before strtoull() * Show C0 in idle-info dump - Improve cpupower installation procedure by making the systemd step optional and allowing users to disable the installation of systemd's unit file (João Marcos Costa)" * tag 'pm-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (65 commits) PM: sleep: core: Avoid bit field races related to work_in_progress PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races cpufreq: Documentation: Update description of rate_limit_us default value cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible PM: wakeup: Handle empty list in wakeup_sources_walk_start() PM: EM: Documentation: Fix bug in example code snippet Documentation: Fix typos in energy model documentation cpuidle: governors: teo: Refine intercepts-based idle state lookup cpuidle: governors: teo: Adjust the classification of wakeup events cpufreq: ondemand: Simplify idle cputime granularity test cpufreq: userspace: make scaling_setspeed return the actual requested frequency PM: hibernate: Drop NULL pointer checks before acomp_request_free() cpufreq: CPPC: Add generic helpers for sysfs show/store cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() cpufreq: ti-cpufreq: add support for AM62L3 SoC cpufreq: dt-platdev: Add ti,am62l3 to blocklist cpufreq/amd-pstate: Add comment explaining nominal_perf usage for performance policy cpufreq: scmi: correct SCMI explanation cpufreq: dt-platdev: Block the driver from probing on more QC platforms rust: cpumask: rename methods of Cpumask for clarity and consistency ... commit d84e173311c4f0b0300755e6445f3224d252eeed Merge: 4adc13ed7c281c dfa5dc3ad3b15a Author: Linus Torvalds Date: Mon Feb 9 18:42:47 2026 -0800 Merge tag 'acpi-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "This one is significantly larger than previous ACPI support pull requests because several significant updates have coincided in it. First, there is a routine ACPICA code update, to upstream version 20251212, but this time it covers new ACPI 6.6 material that has not been covered yet. Among other things, it includes definitions of a few new ACPI tables and updates of some others, like the GICv5 MADT structures and ARM IORT IWB node definitions that are used for adding GICv5 ACPI probing on ARM (that technically is IRQ subsystem material, but it depends on the ACPICA changes, so it is included here). The latter alone adds a few hundred lines of new code. Second, there is an update of ACPI _OSC handling including a fix that prevents failures from occurring in some corner cases due to careless handling of _OSC error bits. On top of that, the "system resource" ACPI device objects with the PNP0C01 and PNP0C02 are now going to be handled by the ACPI core device enumeration code instead of handing them over to the legacy PNP system driver which causes device enumeration issues to occur. Some of those issues have been worked around in device drivers and elsewhere and those workarounds should not be necessary any more, so they are going away. Moreover, the time has come to convert all "core ACPI" device drivers that were still using struct acpi_driver objects for device binding into proper platform drivers that use struct platform_driver for this purpose. These updates are accompanied by some requisite core ACPI device enumeration code changes. Next, there are ACPI APEI updates, including changes to avoid excess overhead in the NMI handler and in SEA on the ARM side, changes to unify ACPI-based HW error tracing and logging, and changes to prevent APEI code from reaching out of its allocated memory. There are also some ACPI power management updates, mostly related to the ACPI cpuidle support in the processor driver, suspend-to-idle handling on systems with ACPI support and to ACPI PM of devices. In addition to the above, bugs are fixed and the code is cleaned up in assorted places all over. Specifics: - Update the ACPICA code in the kernel to upstream version 20251212 which includes the following changes: * Add support for new ACPI table DTPR (Michal Camacho Romero) * Release objects with acpi_ut_delete_object_desc() (Zilin Guan) * Add UUIDs for Microsoft fan extensions and UUIDs associated with TPM 2.0 devices (Armin Wolf) * Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov) * Add KEYP ACPI table definition (Dave Jiang) * Add support for the Microsoft display mux _OSI string (Armin Wolf) * Add definitions for the IOVT ACPI table (Xianglai Li) * Abort AML bytecode execution on AML_FATAL_OP (Armin Wolf) * Include all fields in subtable type1 for PPTT (Ben Horgan) * Add GICv5 MADT structures and Arm IORT IWB node definitions (Jose Marinho) * Update Parameter Block structure for RAS2 and add a new flag in Memory Affinity Structure for SRAT (Pawel Chmielewski) * Add _VDM (Voltage Domain) object (Pawel Chmielewski) - Add support for GICv5 ACPI probing on ARM which is based on the GICv5 MADT structures and ARM IORT IWB node definitions recently added to ACPICA (Lorenzo Pieralisi) - Rework ACPI PM notification setup for PCI root buses and modify the ACPI PM setup for devices to register wakeup source objects under physical (that is, PCI, platform, etc.) devices instead of doing that under their ACPI companions (Rafael Wysocki) - Adjust debug messages regarding postponed ACPI PM printed during system resume to be more accurate (Rafael Wysocki) - Remove dead code from lps0_device_attach() (Gergo Koteles) - Start to invoke Microsoft Function 9 (Turn On Display) of the Low- Power S0 Idle (LPS0) _DSM in the suspend-to-idle resume flow on systems with ACPI LPS0 support to address a functional issue on Lenovo Yoga Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to resume after suspend (Jakob Riemenschneider) - Add sysfs attribute cid for exposing _CID lists under ACPI device objects (Rafael Wysocki) - Replace sprintf() with sysfs_emit() in all of the core ACPI sysfs interface code (Sumeet Pawnikar) - Use acpi_get_local_u64_address() in the code implementing ACPI support for PCI to evaluate _ADR instead of evaluating that object directly (Andy Shevchenko) - Add JWIPC JVC9100 to irq1_level_low_skip_override[] to unbreak serial IRQs on that system (Ai Chao) - Fix handling of _OSC errors in acpi_run_osc() to avoid failures on systems where _OSC error bits are set even though the _OSC return buffer contains acknowledged feature bits (Rafael Wysocki) - Clean up and rearrange \_SB._OSC handling for general platform features and USB4 features to avoid code duplication and unnecessary memory management overhead (Rafael Wysocki) - Make the ACPI core device enumeration code handle PNP0C01 and PNP0C02 ("system resource") device objects directly instead of letting the legacy PNP system driver handle them to avoid device enumeration issues on systems where PNP0C02 is present in the _CID list under ACPI device objects with a _HID matching a proper device driver in Linux (Rafael Wysocki) - Drop workarounds for the known device enumeration issues related to _CID lists containing PNP0C02 (Rafael Wysocki) - Drop outdated comment regarding removed function in the ACPI-based device enumeration code (Julia Lawall) - Make PRP0001 device matching work as expected for ACPI device objects using it as a _HID for board development and similar purposes (Kartik Rajput) - Use async schedule function in acpi_scan_clear_dep_fn() to avoid races with user space initialization on some systems (Yicong Yang) - Add a piece of documentation explaining why binding drivers directly to ACPI device objects is not a good idea in general and why it is desirable to convert drivers doing so into proper platform drivers that use struct platform_driver for device binding (Rafael Wysocki) - Convert multiple "core ACPI" drivers, including the NFIT ACPI device driver, the generic ACPI button drivers, the generic ACPI thermal zone driver, the ACPI hardware event device (HED) driver, the ACPI EC driver, the ACPI SMBUS HC driver, the ACPI Smart Battery Subsystem (SBS) driver, and the ACPI backlight (video) driver to proper platform drivers that use struct platform_driver for device binding (Rafael Wysocki) - Use acpi_get_local_u64_address() in the ACPI backlight (video) driver to evaluate _ADR instead of evaluating that object directly (Andy Shevchenko) - Convert the generic ACPI battery driver to a proper platform driver using struct platform_driver for device binding (Rafael Wysocki) - Fix incorrect charging status when current is zero in the generic ACPI battery driver (Ata İlhan Köktürk) - Use LIST_HEAD() for initializing a stack-allocated list in the generic ACPI watchdog device driver (Can Peng) - Rework the ACPI idle driver initialization to register it directly from the common initialization code instead of doing that from a CPU hotplug "online" callback and clean it up (Huisong Li, Rafael Wysocki) - Fix a possible NULL pointer dereference in acpi_processor_errata_piix4() (Tuo Li) - Make read-only array non_mmio_desc[] static const (Colin Ian King) - Prevent the APEI GHES support code on ARM from accessing memory out of bounds or going past the ARM processor CPER record buffer (Mauro Carvalho Chehab) - Prevent cper_print_fw_err() from dumping the entire memory on systems with defective firmware (Mauro Carvalho Chehab) - Improve ghes_notify_nmi() status check to avoid unnecessary overhead in the NMI handler by carrying out all of the requisite preparations and the NMI registration time (Tony Luck) - Refactor the GHES driver by extracting common functionality into reusable helper functions to reduce code duplication and improve the ghes_notify_sea() status check in analogy with the previous ghes_notify_nmi() status check improvement (Shuai Xue) - Make ELOG and GHES log and trace consistently and support the CPER CXL protocol analogously (Fabio De Francesco) - Disable KASAN instrumentation in the APEI GHES driver when compile testing with clang < 18 (Nathan Chancellor) - Let ghes_edac be the preferred driver to load on __ZX__ and _BYO_ systems by extending the platform detection list in the APEI GHES driver (Tony W Wang-oc) - Clean up cppc_perf_caps and cppc_perf_ctrls structs and rename EPP constants for clarity in the ACPI CPPC library (Sumit Gupta)" * tag 'acpi-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (117 commits) ACPI: battery: fix incorrect charging status when current is zero ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) ACPI: APEI: GHES: Add ghes_edac support for __ZX__ and _BYO_ systems ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18 ACPI: sysfs: Replace sprintf() with sysfs_emit() ACPI: CPPC: Rename EPP constants for clarity ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe() ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_dev() to void ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_states() to void irqchip/gic-v5: Add ACPI IWB probing irqchip/gic-v5: Add ACPI ITS probing irqchip/gic-v5: Add ACPI IRS probing irqchip/gic-v5: Split IRS probing into OF and generic portions PCI/MSI: Make the pci_msi_map_rid_ctlr_node() interface firmware agnostic irqdomain: Add parent field to struct irqchip_fwid ACPI: PCI: simplify code with acpi_get_local_u64_address() ACPI: video: simplify code with acpi_get_local_u64_address() ACPI: PM: Adjust messages regarding postponed ACPI PM ... commit 4adc13ed7c281c16152a700e47b65d17de07321a Merge: 0c00ed308d0559 3373503df025ab Author: Linus Torvalds Date: Mon Feb 9 18:14:52 2026 -0800 Merge tag 'for-7.0/block-stable-pages-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull bounce buffer dio for stable pages from Jens Axboe: "This adds support for bounce buffering of dio for stable pages. This was all done by Christoph. In his words: This series tries to address the problem that under I/O pages can be modified during direct I/O, even when the device or file system require stable pages during I/O to calculate checksums, parity or data operations. It does so by adding block layer helpers to bounce buffer an iov_iter into a bio, then wires that up in iomap and ultimately XFS. The reason that the file system even needs to know about it, is because reads need a user context to copy the data back, and the infrastructure to defer ioends to a workqueue currently sits in XFS. I'm going to look into moving that into ioend and enabling it for other file systems. Additionally btrfs already has it's own infrastructure for this, and actually an urgent need to bounce buffer, so this should be useful there and could be wire up easily. In fact the idea comes from patches by Qu that did this in btrfs. This patch fixes all but one xfstests failures on T10 PI capable devices (generic/095 seems to have issues with a mix of mmap and splice still, I'm looking into that separately), and make qemu VMs running Windows, or Linux with swap enabled fine on an XFS file on a device using PI. Performance numbers on my (not exactly state of the art) NVMe PI test setup: Sequential reads using io_uring, QD=16. Bandwidth and CPU usage (usr/sys): | size | zero copy | bounce | +------+--------------------------+--------------------------+ | 4k | 1316MiB/s (12.65/55.40%) | 1081MiB/s (11.76/49.78%) | | 64K | 3370MiB/s ( 5.46/18.20%) | 3365MiB/s ( 4.47/15.68%) | | 1M | 3401MiB/s ( 0.76/23.05%) | 3400MiB/s ( 0.80/09.06%) | +------+--------------------------+--------------------------+ Sequential writes using io_uring, QD=16. Bandwidth and CPU usage (usr/sys): | size | zero copy | bounce | +------+--------------------------+--------------------------+ | 4k | 882MiB/s (11.83/33.88%) | 750MiB/s (10.53/34.08%) | | 64K | 2009MiB/s ( 7.33/15.80%) | 2007MiB/s ( 7.47/24.71%) | | 1M | 1992MiB/s ( 7.26/ 9.13%) | 1992MiB/s ( 9.21/19.11%) | +------+--------------------------+--------------------------+ Note that the 64k read numbers look really odd to me for the baseline zero copy case, but are reproducible over many repeated runs. The bounce read numbers should further improve when moving the PI validation to the file system and removing the double context switch, which I have patches for that will sent out soon" * tag 'for-7.0/block-stable-pages-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: xfs: use bounce buffering direct I/O when the device requires stable pages iomap: add a flag to bounce buffer direct I/O iomap: support ioends for direct reads iomap: rename IOMAP_DIO_DIRTY to IOMAP_DIO_USER_BACKED iomap: free the bio before completing the dio iomap: share code between iomap_dio_bio_end_io and iomap_finish_ioend_direct iomap: split out the per-bio logic from iomap_dio_bio_iter iomap: simplify iomap_dio_bio_iter iomap: fix submission side handling of completion side errors block: add helpers to bounce buffer an iov_iter into bios block: remove bio_release_page iov_iter: extract a iov_iter_extract_bvecs helper from bio code block: open code bio_add_page and fix handling of mismatching P2P ranges block: refactor get_contig_folio_len block: add a BIO_MAX_SIZE constant and use it commit 0c00ed308d0559fc216be0442a3df124e9e13533 Merge: 591beb0e3a0325 72f4d6fca699a1 Author: Linus Torvalds Date: Mon Feb 9 17:57:21 2026 -0800 Merge tag 'for-7.0/block-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block updates from Jens Axboe: - Support for batch request processing for ublk, improving the efficiency of the kernel/ublk server communication. This can yield nice 7-12% performance improvements - Support for integrity data for ublk - Various other ublk improvements and additions, including a ton of selftests additions and updated - Move the handling of blk-crypto software fallback from below the block layer to above it. This reduces the complexity of dealing with bio splitting - Series fixing a number of potential deadlocks in blk-mq related to the queue usage counter and writeback throttling and rq-qos debugfs handling - Add an async_depth queue attribute, to resolve a performance regression that's been around for a qhilw related to the scheduler depth handling - Only use task_work for IOPOLL completions on NVMe, if it is necessary to do so. An earlier fix for an issue resulted in all these completions being punted to task_work, to guarantee that completions were only run for a given io_uring ring when it was local to that ring. With the new changes, we can detect if it's necessary to use task_work or not, and avoid it if possible. - rnbd fixes: - Fix refcount underflow in device unmap path - Handle PREFLUSH and NOUNMAP flags properly in protocol - Fix server-side bi_size for special IOs - Zero response buffer before use - Fix trace format for flags - Add .release to rnbd_dev_ktype - MD pull requests via Yu Kuai - Fix raid5_run() to return error when log_init() fails - Fix IO hang with degraded array with llbitmap - Fix percpu_ref not resurrected on suspend timeout in llbitmap - Fix GPF in write_page caused by resize race - Fix NULL pointer dereference in process_metadata_update - Fix hang when stopping arrays with metadata through dm-raid - Fix any_working flag handling in raid10_sync_request - Refactor sync/recovery code path, improve error handling for badblocks, and remove unused recovery_disabled field - Consolidate mddev boolean fields into mddev_flags - Use mempool to allocate stripe_request_ctx and make sure max_sectors is not less than io_opt in raid5 - Fix return value of mddev_trylock - Fix memory leak in raid1_run() - Add Li Nan as mdraid reviewer - Move phys_vec definitions to the kernel types, mostly in preparation for some VFIO and RDMA changes - Improve the speed for secure erase for some devices - Various little rust updates - Various other minor fixes, improvements, and cleanups * tag 'for-7.0/block-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (162 commits) blk-mq: ABI/sysfs-block: fix docs build warnings selftests: ublk: organize test directories by test ID block: decouple secure erase size limit from discard size limit block: remove redundant kill_bdev() call in set_blocksize() blk-mq: add documentation for new queue attribute async_dpeth block, bfq: convert to use request_queue->async_depth mq-deadline: covert to use request_queue->async_depth kyber: covert to use request_queue->async_depth blk-mq: add a new queue sysfs attribute async_depth blk-mq: factor out a helper blk_mq_limit_depth() blk-mq-sched: unify elevators checking for async requests block: convert nr_requests to unsigned int block: don't use strcpy to copy blockdev name blk-mq-debugfs: warn about possible deadlock blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() blk-mq-debugfs: remove blk_mq_debugfs_unregister_rqos() blk-mq-debugfs: make blk_mq_debugfs_register_rqos() static blk-rq-qos: fix possible debugfs_mutex deadlock blk-mq-debugfs: factor out a helper to register debugfs for all rq_qos blk-wbt: fix possible deadlock to nest pcpu_alloc_mutex under q_usage_counter ... commit 591beb0e3a03258ef9c01893a5209845799a7c33 Merge: f5d4feed174ce9 ed82f35b926b2e Author: Linus Torvalds Date: Mon Feb 9 17:31:17 2026 -0800 Merge tag 'io_uring-bpf-restrictions.4-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring bpf filters from Jens Axboe: "This adds support for both cBPF filters for io_uring, as well as task inherited restrictions and filters. seccomp and io_uring don't play along nicely, as most of the interesting data to filter on resides somewhat out-of-band, in the submission queue ring. As a result, things like containers and systemd that apply seccomp filters, can't filter io_uring operations. That leaves them with just one choice if filtering is critical - filter the actual io_uring_setup(2) system call to simply disallow io_uring. That's rather unfortunate, and has limited us because of it. io_uring already has some filtering support. It requires the ring to be setup in a disabled state, and then a filter set can be applied. This filter set is completely bi-modal - an opcode is either enabled or it's not. Once a filter set is registered, the ring can be enabled. This is very restrictive, and it's not useful at all to systemd or containers which really want both broader and more specific control. This first adds support for cBPF filters for opcodes, which enables tighter control over what exactly a specific opcode may do. As examples, specific support is added for IORING_OP_OPENAT/OPENAT2, allowing filtering on resolve flags. And another example is added for IORING_OP_SOCKET, allowing filtering on domain/type/protocol. These are both common use cases. cBPF was chosen rather than eBPF, because the latter is often restricted in containers as well. These filters are run post the init phase of the request, which allows filters to even dip into data that is being passed in struct in user memory, as the init side of requests make that data stable by bringing it into the kernel. This allows filtering without needing to copy this data twice, or have filters etc know about the exact layout of the user data. The filters get the already copied and sanitized data passed. On top of that support is added for per-task filters, meaning that any ring created with a task that has a per-task filter will get those filters applied when it's created. These filters are inherited across fork as well. Once a filter has been registered, any further added filters may only further restrict what operations are permitted. Filters cannot change the return value of an operation, they can only permit or deny it based on the contents" * tag 'io_uring-bpf-restrictions.4-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: allow registration of per-task restrictions io_uring: add task fork hook io_uring/bpf_filter: add ref counts to struct io_bpf_filter io_uring/bpf_filter: cache lookup table in ctx->bpf_filters io_uring/bpf_filter: allow filtering on contents of struct open_how io_uring/net: allow filtering on IORING_OP_SOCKET data io_uring: add support for BPF filtering for opcode restrictions commit f5d4feed174ce9fb3c42886a3c36038fd5a43e25 Merge: 26c9342bb761e4 442ae406603a94 Author: Linus Torvalds Date: Mon Feb 9 17:22:00 2026 -0800 Merge tag 'for-7.0/io_uring-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring updates from Jens Axboe: - Clean up the IORING_SETUP_R_DISABLED and submitter task checking, mostly just in preparation for relaxing the locking for SINGLE_ISSUER in the future. - Improve IOPOLL by using a doubly linked list to manage completions. Previously it was singly listed, which meant that to complete request N in the chain 0..N-1 had to have completed first. With a doubly linked list we can complete whatever request completes in that order, rather than need to wait for a consecutive range to be available. This reduces latencies. - Improve the restriction setup and checking. Mostly in preparation for adding further features on top of that. Coming in a separate pull request. - Split out task_work and wait handling into separate files. These are mostly nicely abstracted already, but still remained in the io_uring.c file which is on the larger side. - Use GFP_KERNEL_ACCOUNT in a few more spots, where appropriate. - Ensure even the idle io-wq worker exits if a task no longer has any rings open. - Add support for a non-circular submission queue. By default, the SQ ring keeps moving around, even if only a few entries are used for each submission. This can be wasteful in terms of cachelines. If IORING_SETUP_SQ_REWIND is set for the ring when created, each submission will start at offset 0 instead of where we last left off doing submissions. - Various little cleanups * tag 'for-7.0/io_uring-20260206' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (30 commits) io_uring/kbuf: fix memory leak if io_buffer_add_list fails io_uring: Add SPDX id lines to remaining source files io_uring: allow io-wq workers to exit when unused io_uring/io-wq: add exit-on-idle state io_uring/net: don't continue send bundle if poll was required for retry io_uring/rsrc: use GFP_KERNEL_ACCOUNT consistently io_uring/futex: use GFP_KERNEL_ACCOUNT for futex data allocation io_uring/io-wq: handle !sysctl_hung_task_timeout_secs io_uring: fix bad indentation for setup flags if statement io_uring/rsrc: take unsigned index in io_rsrc_node_lookup() io_uring: introduce non-circular SQ io_uring: split out CQ waiting code into wait.c io_uring: split out task work code into tw.c io_uring/io-wq: don't trigger hung task for syzbot craziness io_uring: add IO_URING_EXIT_WAIT_MAX definition io_uring/sync: validate passed in offset io_uring/eventfd: remove unused ctx->evfd_last_cq_tail member io_uring/timeout: annotate data race in io_flush_timeouts() io_uring/uring_cmd: explicitly disallow cancelations for IOPOLL io_uring: fix IOPOLL with passthrough I/O ... commit 26c9342bb761e463774a64fb6210b4f95f5bc035 Merge: 8a5203c630c67d 0787a93baa1aab Author: Linus Torvalds Date: Mon Feb 9 16:58:28 2026 -0800 Merge tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs 'struct filename' updates from Al Viro: "[Mostly] sanitize struct filename handling" * tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (68 commits) sysfs(2): fs_index() argument is _not_ a pathname alpha: switch osf_mount() to strndup_user() ksmbd: use CLASS(filename_kernel) mqueue: switch to CLASS(filename) user_statfs(): switch to CLASS(filename) statx: switch to CLASS(filename_maybe_null) quotactl_block(): switch to CLASS(filename) chroot(2): switch to CLASS(filename) move_mount(2): switch to CLASS(filename_maybe_null) namei.c: switch user pathname imports to CLASS(filename{,_flags}) namei.c: convert getname_kernel() callers to CLASS(filename_kernel) do_f{chmod,chown,access}at(): use CLASS(filename_uflags) do_readlinkat(): switch to CLASS(filename_flags) do_sys_truncate(): switch to CLASS(filename) do_utimes_path(): switch to CLASS(filename_uflags) chdir(2): unspaghettify a bit... do_fchownat(): unspaghettify a bit... fspick(2): use CLASS(filename_flags) name_to_handle_at(): use CLASS(filename_uflags) vfs_open_tree(): use CLASS(filename_uflags) ... commit b4bade506b18eb2e5e34ac84f915d7ee6156d4e2 Author: Steven Rostedt Date: Mon Feb 9 19:46:31 2026 -0500 tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection The tracing_max_latency shouldn't be limited if CONFIG_FSNOTIFY is defined or not and it was moved out of that protection to be always available with CONFIG_TRACER_MAX_TRACE. All was moved out except the dentry descriptor for it (d_max_latency) and it failed to build on some configs. Move that out of the CONFIG_FSNOTIFY protection too. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260209194631.788bfc85@fedora Fixes: ba73713da50e ("tracing: Clean up use of trace_create_maxlat_file()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602092133.fTdojd95-lkp@intel.com/ Signed-off-by: Steven Rostedt (Google) commit 8a5203c630c67d578975ff237413f5e0b5000af8 Merge: af23fd93fcb27a 95080648ed52c6 Author: Linus Torvalds Date: Mon Feb 9 16:46:51 2026 -0800 Merge tag 'v7.0-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - multichannel improvements, including making add channel async at mount time - fix potential double free in open path - retry fixes - locking improvements - fix potential directory lease races - cleanup patches for client headers - patches to better split out SMB1 code - minor cleanup of structs for gcc 14 warnings - error handling improvements * tag 'v7.0-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: (74 commits) cifs: Fix the copyright banner on smb1maperror.c smb: common: add header guards to fs/smb/common/smb2status.h smb: client: Avoid a dozen -Wflex-array-member-not-at-end warnings smb/client: remove useless comment in mapping_table_ERRSRV smb/client: remove some literal NT error codes from ntstatus_to_dos_map smb/client: add NT_STATUS_VOLUME_NOT_UPGRADED smb/client: add NT_STATUS_NO_USER_KEYS smb/client: add NT_STATUS_WRONG_EFS smb/client: add NT_STATUS_NO_EFS smb/client: add NT_STATUS_NO_RECOVERY_POLICY smb/client: add NT_STATUS_RANGE_NOT_FOUND smb/client: add NT_STATUS_DECRYPTION_FAILED smb/client: add NT_STATUS_ENCRYPTION_FAILED smb/client: add NT_STATUS_DIRECTORY_IS_A_REPARSE_POINT smb/client: add NT_STATUS_VOLUME_DISMOUNTED smb/client: add NT_STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT smb/client: add NT_STATUS_VARIABLE_NOT_FOUND smb/client: rename ERRinvlevel to ERRunknownlevel smb/client: add NT_STATUS_OS2_INVALID_LEVEL smb/client: map NT_STATUS_INVALID_INFO_CLASS to ERRbadpipe ... commit af23fd93fcb27a19764759c9238ef0bf5bd8370f Merge: 7141433fbed290 2c3a0b730012ef Author: Linus Torvalds Date: Mon Feb 9 16:40:43 2026 -0800 Merge tag 'dlm-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This includes several minor code cleanups, and one notable fix for recovery of in-progress lock conversions which would lead to a the convert operation never completing" * tag 'dlm-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: dlm: Avoid -Wflex-array-member-not-at-end warning fs/dlm/dir: remove unuse variable count_match dlm: Constify struct configfs_item_operations and configfs_group_operations fs/dlm: use list_add_tail() instead of open-coding list insertion dlm: validate length in dlm_search_rsb_tree dlm: fix recovery pending middle conversion commit 7141433fbed290f4dd42008d3102db2363275035 Merge: 56feb532bb927a e411d74cc5ba29 Author: Linus Torvalds Date: Mon Feb 9 16:29:57 2026 -0800 Merge tag 'gfs2-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Prevent rename() from failing with -ESTALE when there are locking conflicts and retry the operation instead - Don't fail when fiemap triggers a page fault (xfstest generic/742) - Fix another locking request cancellation bug - Minor other fixes and cleanups * tag 'gfs2-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: fiemap page fault fix gfs2: fix memory leaks in gfs2_fill_super error path gfs2: Fix use-after-free in iomap inline data write path gfs2: Fix slab-use-after-free in qd_put gfs2: Introduce glock_{type,number,sbd} helpers gfs2: gfs2_glock_hold cleanup gfs: Use fixed GL_GLOCK_MIN_HOLD time gfs2: Fix gfs2_log_get_bio argument type gfs2: gfs2_chain_bio start sector fix gfs2: Initialize bio->bi_opf early gfs2: Rename gfs2_log_submit_{bio -> write} gfs2: Do not cancel internal demote requests gfs2: run_queue cleanup gfs2: Retries missing in gfs2_{rename,exchange} gfs2: glock cancelation flag fix commit 56feb532bb927ae1c26726e2e7c0de95f54a3d67 Merge: 3893854000a818 e33839b514a8af Author: Linus Torvalds Date: Mon Feb 9 16:11:27 2026 -0800 Merge tag 'xfs-merge-7.0' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Carlos Maiolino: "This contains several improvements to zoned device support, performance improvements for the parent pointers, and a new health monitoring feature. There are some improvements in the journaling code too but no behavior change expected. Last but not least, some code refactoring and bug fixes are also included in this series" * tag 'xfs-merge-7.0' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (67 commits) xfs: add sysfs stats for zoned GC xfs: give the defer_relog stat a xs_ prefix xfs: add zone reset error injection xfs: refactor zone reset handling xfs: don't mark all discard issued by zoned GC as sync xfs: allow setting errortags at mount time xfs: use WRITE_ONCE/READ_ONCE for m_errortag xfs: move the guts of XFS_ERRORTAG_DELAY out of line xfs: don't validate error tags in the I/O path xfs: allocate m_errortag early xfs: fix the errno sign for the xfs_errortag_{add,clearall} stubs xfs: validate log record version against superblock log version xfs: fix spacing style issues in xfs_alloc.c xfs: remove xfs_zone_gc_space_available xfs: use a seprate member to track space availabe in the GC scatch buffer xfs: check for deleted cursors when revalidating two btrees xfs: fix UAF in xchk_btree_check_block_owner xfs: check return value of xchk_scrub_create_subord xfs: only call xf{array,blob}_destroy if we have a valid pointer xfs: get rid of the xchk_xfile_*_descr calls ... commit 3893854000a81897a1a332ec50931f74761fbf71 Merge: 4fb7d86fbef0e2 1caf50ce4af096 Author: Linus Torvalds Date: Mon Feb 9 16:08:40 2026 -0800 Merge tag 'erofs-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "In this cycle, inode page cache sharing among filesystems on the same machine is now supported, which is particularly useful for high-density hosts running tens of thousands of containers. In addition, we fully isolate the EROFS core on-disk format from other optional encoded layouts since the core on-disk part is designed to be simple, effective, and secure. Users can use the core format to build unique golden immutable images and import their filesystem trees directly from raw block devices via DMA, page-mapped DAX devices, and/or file-backed mounts without having to worry about unnecessary intrinsic consistency issues found in other generic filesystems by design. However, the full vision is still working in progress and will spend more time to achieve final goals. There are other improvements and bug fixes as usual, as listed below: - Support inode page cache sharing among filesystems - Formally separate optional encoded (aka compressed) inode layouts (and the implementations) from the EROFS core on-disk aligned plain format for future zero-trust security usage - Improve performance by caching the fact that an inode does not have a POSIX ACL - Improve LZ4 decompression error reporting - Enable LZMA by default and promote DEFLATE and Zstandard algorithms out of EXPERIMENTAL status - Switch to inode_set_cached_link() to cache symlink lengths - random bugfixes and minor cleanups" * tag 'erofs-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: (31 commits) erofs: fix UAF issue for file-backed mounts w/ directio option erofs: update compression algorithm status erofs: fix inline data read failure for ztailpacking pclusters erofs: avoid some unnecessary #ifdefs erofs: handle end of filesystem properly for file-backed mounts erofs: separate plain and compressed filesystems formally erofs: use inode_set_cached_link() erofs: mark inodes without acls in erofs_read_inode() erofs: implement .fadvise for page cache share erofs: support compressed inodes for page cache share erofs: support unencoded inodes for page cache share erofs: pass inode to trace_erofs_read_folio erofs: introduce the page cache share feature erofs: using domain_id in the safer way erofs: add erofs_inode_set_aops helper to set the aops erofs: support user-defined fingerprint name erofs: decouple `struct erofs_anon_fs_type` fs: Export alloc_empty_backing_file erofs: tidy up erofs_init_inode_xattrs() erofs: add missing documentation about `directio` mount option ... commit 4fb7d86fbef0e294f4bb6bc46930c5789d332dc7 Merge: d10a88ce165157 ebebb04baefdac Author: Linus Torvalds Date: Mon Feb 9 16:00:21 2026 -0800 Merge tag 'hfs-v7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs Pull hfs/hfsplus updates from Viacheslav Dubeyko: "This pull request contains several fixes of syzbot reported issues and HFS+ fixes of xfstests failures. - fix an issue reported by syzbot triggering BUG_ON() in the case of corrupted superblock, replacing the BUG_ON()s with proper error handling (Jori Koolstra) - fix memory leaks in the mount logic of HFS/HFS+ file systems. When HFS/HFS+ were converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info (Mehdi Ben Hadj Khelifa) - fix hfs_bnode_create() by returning ERR_PTR(-EEXIST) instead of the node pointer when it's already hashed. This avoids a double unload_nls() on mount failure (suggested by Shardul Bankar) - set inode's mode as regular file for system inodes (Tetsuo Handa) The rest fix failures in generic/020, generic/037, generic/062, generic/480, and generic/498 xfstests for the case of HFS+ file system. Currently, only 30 xfstests' test-cases experience failures for HFS+ file system (initially, it was around 100 failed xfstests)" * tag 'hfs-v7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs: hfsplus: avoid double unload_nls() on mount failure hfsplus: fix warning issue in inode.c hfsplus: fix generic/062 xfstests failure hfsplus: fix generic/037 xfstests failure hfsplus: pretend special inodes as regular files hfsplus: return error when node already exists in hfs_bnode_create hfs: Replace BUG_ON with error handling for CNID count checks hfsplus: fix generic/020 xfstests failure hfsplus: fix volume corruption issue for generic/498 hfsplus: fix volume corruption issue for generic/480 hfsplus: ensure sb->s_fs_info is always cleaned up hfs: ensure sb->s_fs_info is always cleaned up commit d10a88ce1651578c0948fbf26d7aaff298b486b2 Merge: 8912c2fd5830e9 6fd8a09f48d6fe Author: Linus Torvalds Date: Mon Feb 9 15:55:41 2026 -0800 Merge tag 'nilfs2-v7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2 Pull nilfs2 updates from Viacheslav Dubeyko: - Fix potential block overflow that cause system hang When executing the FITRIM command, an underflow can occur in the calculation of nblocks. This ultimately leads to the block layer function __blkdev_issue_discard() taking an excessively long time to process the bio chain, and the ns_segctor_sem lock remains held for a long period. This prevents other tasks from acquiring the ns_segctor_sem lock, resulting in a hang reported by syzbot (Edward Adam Davis) - Fix missing struct keywords in nilfs2_api.h kernel-doc (Ryusuke Konishi) - Convert nilfs_super_block to kernel-doc Eliminate 40+ kernel-doc warnings in nilfs2_ondisk.h by converting all of the struct member comments to kernel-doc comments (Randy Dunlap) * tag 'nilfs2-v7.0-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2: nilfs2: fix missing struct keywords in nilfs2_api.h kernel-doc nilfs2: convert nilfs_super_block to kernel-doc nilfs2: Fix potential block overflow that cause system hang commit 31b9028c77dc279d720412013e95b279b1385aed Author: Namjae Jeon Date: Mon Feb 9 21:33:44 2026 +0900 ksmbd: convert tree_conns_lock to rw_semaphore Converts tree_conns_lock to an rw_semaphore to allow sleeping while the lock is held. Additionally, it simplifies the locking logic in ksmbd_tree_conn_session_logoff() and introduces __ksmbd_tree_conn_disconnect() to avoid redundant locking. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 0080608706b37c199c3c2c22bfadac9e75b223a4 Author: Namjae Jeon Date: Mon Feb 9 21:01:01 2026 +0900 ksmbd: fix missing chann_lock while iterating session channel list Add chann_lock while iterating ksmbd_chann_list in show_proc_session() and show_proc_sessions(). This will prevents a race condition with concurrent channel list modifications. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 8912c2fd5830e976c0deaeb0b2a458ce6b4718c7 Merge: b29a7a8eee6a1c 161ab30da6899f Author: Linus Torvalds Date: Mon Feb 9 15:45:21 2026 -0800 Merge tag 'for-6.20-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "User visible changes, feature updates: - when using block size > page size, enable direct IO - fallback to buffered IO if the data profile has duplication, workaround to avoid checksum mismatches on block group profiles with redundancy, real direct IO is possible on single or RAID0 - redo export of zoned statistics, moved from sysfs to /proc/pid/mountstats due to size limitations of the former Experimental features: - remove offload checksum tunable, intended to find best way to do it but since we've switched to offload to thread for everything we don't need it anymore - initial support for remap-tree feature, a translation layer of logical block addresses that allow changes without moving/rewriting blocks to do eg. relocation, or other changes that require COW Notable fixes: - automatic removal of accidentally leftover chunks when free-space-tree is enabled since mkfs.btrfs v6.16.1 - zoned mode: - do not try to append to conventional zones when RAID is mixing zoned and conventional drives - fixup write pointers when mixing zoned and conventional on DUP/RAID* profiles - when using squota, relax deletion rules for qgroups with 0 members to allow easier recovery from accounting bugs, also add more checks to detect bad accounting - fix periodic reclaim scanning, properly check boundary conditions not to trigger it unexpectedly or miss the time to run it - trim: - continue after first error - change reporting to the first detected error - add more cancellation points - reduce contention of big device lock that can block other operations when there's lots of trimmed space - when chunk allocation is forced (needs experimental build) fix transaction abort when unexpected space layout is detected Core: - switch to crypto library API for checksumming, removed module dependencies, pointer indirections, etc. - error handling improvements - adjust how and where transaction commit or abort are done and are maybe not necessary - minor compression optimization to skip single block ranges - improve how compression folios are handled - new and updated selftests - cleanups, refactoring: - auto-freeing and other automatic variable cleanup conversion - structure size optimizations - condition annotations" * tag 'for-6.20-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (137 commits) btrfs: get rid of compressed_bio::compressed_folios[] btrfs: get rid of compressed_folios[] usage for encoded writes btrfs: get rid of compressed_folios[] usage for compressed read btrfs: remove the old btrfs_compress_folios() infrastructure btrfs: switch to btrfs_compress_bio() interface for compressed writes btrfs: introduce btrfs_compress_bio() helper btrfs: zlib: introduce zlib_compress_bio() helper btrfs: zstd: introduce zstd_compress_bio() helper btrfs: lzo: introduce lzo_compress_bio() helper btrfs: zoned: factor out the zone loading part into a testable function btrfs: add cleanup function for btrfs_free_chunk_map btrfs: tests: add cleanup functions for test specific functions btrfs: raid56: fix memory leak of btrfs_raid_bio::stripe_uptodate_bitmap btrfs: tests: add unit tests for pending extent walking functions btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation btrfs: fix transaction commit blocking during trim of unallocated space btrfs: handle user interrupt properly in btrfs_trim_fs() btrfs: preserve first error in btrfs_trim_fs() btrfs: continue trimming remaining devices on failure btrfs: do not BUG_ON() in btrfs_remove_block_group() ... commit b29a7a8eee6a1ca974aaf053c0ffed1173d279c2 Author: Arnd Bergmann Date: Tue Dec 23 22:54:03 2025 +0100 fs: fuse: fix max() of incompatible types The 'max()' value of a 'long long' and an 'unsigned int' is problematic if the former is negative: In function 'fuse_wr_pages', inlined from 'fuse_perform_write' at fs/fuse/file.c:1347:27: include/linux/compiler_types.h:652:45: error: call to '__compiletime_assert_390' declared with attribute error: min(((pos + len - 1) >> 12) - (pos >> 12) + 1, max_pages) signedness error 652 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^ Use a temporary variable to make it clearer what is going on here. Fixes: 0f5bb0cfb0b4 ("fs: use min() or umin() instead of min_t()") Signed-off-by: Arnd Bergmann Signed-off-by: Linus Torvalds commit 9e355113f02be17db573d579515dee63621b7c8b Merge: 3304b3fedddfb1 6cbfdf89470ef3 Author: Linus Torvalds Date: Mon Feb 9 15:13:05 2026 -0800 Merge tag 'vfs-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "This contains a mix of VFS cleanups, performance improvements, API fixes, documentation, and a deprecation notice. Scalability and performance: - Rework pid allocation to only take pidmap_lock once instead of twice during alloc_pid(), improving thread creation/teardown throughput by 10-16% depending on false-sharing luck. Pad the namespace refcount to reduce false-sharing - Track file lock presence via a flag in ->i_opflags instead of reading ->i_flctx, avoiding false-sharing with ->i_readcount on open/close hot paths. Measured 4-16% improvement on 24-core open-in-a-loop benchmarks - Use a consume fence in locks_inode_context() to match the store-release/load-consume idiom, eliminating a hardware fence on some architectures - Annotate cdev_lock with __cacheline_aligned_in_smp to prevent false-sharing - Remove a redundant DCACHE_MANAGED_DENTRY check in __follow_mount_rcu() that never fires since the caller already verifies it, eliminating a 100% mispredicted branch - Fix a 100% mispredicted likely() in devcgroup_inode_permission() that became wrong after a prior code reorder Bug fixes and correctness: - Make insert_inode_locked() wait for inode destruction instead of skipping, fixing a corner case where two matching inodes could exist in the hash - Move f_mode initialization before file_ref_init() in alloc_file() to respect the SLAB_TYPESAFE_BY_RCU ordering contract - Add a WARN_ON_ONCE guard in try_to_free_buffers() for folios with no buffers attached, preventing a null pointer dereference when AS_RELEASE_ALWAYS is set but no release_folio op exists - Fix select restart_block to store end_time as timespec64, avoiding truncation of tv_sec on 32-bit architectures - Make dump_inode() use get_kernel_nofault() to safely access inode and superblock fields, matching the dump_mapping() pattern API modernization: - Make posix_acl_to_xattr() allocate the buffer internally since every single caller was doing it anyway. Reduces boilerplate and unnecessary error checking across ~15 filesystems - Replace deprecated simple_strtoul() with kstrtoul() for the ihash_entries, dhash_entries, mhash_entries, and mphash_entries boot parameters, adding proper error handling - Convert chardev code to use guard(mutex) and __free(kfree) cleanup patterns - Replace min_t() with min() or umin() in VFS code to avoid silently truncating unsigned long to unsigned int - Gate LOOKUP_RCU assertions behind CONFIG_DEBUG_VFS since callers already check the flag Deprecation: - Begin deprecating legacy BSD process accounting (acct(2)). The interface has numerous footguns and better alternatives exist (eBPF) Documentation: - Fix and complete kernel-doc for struct export_operations, removing duplicated documentation between ReST and source - Fix kernel-doc warnings for __start_dirop() and ilookup5_nowait() Testing: - Add a kunit test for initramfs cpio handling of entries with filesize > PATH_MAX Misc: - Add missing include in fs_struct.c" * tag 'vfs-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits) posix_acl: make posix_acl_to_xattr() alloc the buffer fs: make insert_inode_locked() wait for inode destruction initramfs_test: kunit test for cpio.filesize > PATH_MAX fs: improve dump_inode() to safely access inode fields fs: add for 'init_fs' docs: exportfs: Use source code struct documentation fs: move initializing f_mode before file_ref_init() exportfs: Complete kernel-doc for struct export_operations exportfs: Mark struct export_operations functions at kernel-doc exportfs: Fix kernel-doc output for get_name() acct(2): begin the deprecation of legacy BSD process accounting device_cgroup: remove branch hint after code refactor VFS: fix __start_dirop() kernel-doc warnings fs: Describe @isnew parameter in ilookup5_nowait() fs/namei: Remove redundant DCACHE_MANAGED_DENTRY check in __follow_mount_rcu fs: only assert on LOOKUP_RCU when built with CONFIG_DEBUG_VFS select: store end_time as timespec64 in restart block chardev: Switch to guard(mutex) and __free(kfree) namespace: Replace simple_strtoul with kstrtoul to parse boot params dcache: Replace simple_strtoul with kstrtoul in set_dhash_entries ... commit 3304b3fedddfb1357c7f9e25526b5a7899ee1f13 Merge: 157d3d6efd5a58 aa35dd5cbc060b Author: Linus Torvalds Date: Mon Feb 9 15:08:16 2026 -0800 Merge tag 'vfs-7.0-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs iomap updates from Christian Brauner: - Erofs page cache sharing preliminaries: Plumb a void *private parameter through iomap_read_folio() and iomap_readahead() into iomap_iter->private, matching iomap DIO. Erofs uses this to replace a bogus kmap_to_page() call, as preparatory work for page cache sharing. - Fix for invalid folio access: Fix an invalid folio access when a folio without iomap_folio_state is fully submitted to the IO helper — the helper may call folio_end_read() at any time, so ctx->cur_folio must be invalidated after full submission. * tag 'vfs-7.0-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: fix invalid folio access after folio_end_read() erofs: hold read context in iomap_iter if needed iomap: stash iomap read ctx in the private field of iomap_iter commit 157d3d6efd5a58466d90be3a134f9667486fe6f9 Merge: 8113b3998d5c96 1bce1a664ac25d Author: Linus Torvalds Date: Mon Feb 9 14:43:47 2026 -0800 Merge tag 'vfs-7.0-rc1.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs mount updates from Christian Brauner: - statmount: accept fd as a parameter Extend struct mnt_id_req with a file descriptor field and a new STATMOUNT_BY_FD flag. When set, statmount() returns mount information for the mount the fd resides on — including detached mounts (unmounted via umount2(MNT_DETACH)). For detached mounts the STATMOUNT_MNT_POINT and STATMOUNT_MNT_NS_ID mask bits are cleared since neither is meaningful. The capability check is skipped for STATMOUNT_BY_FD since holding an fd already implies prior access to the mount and equivalent information is available through fstatfs() and /proc/pid/mountinfo without privilege. Includes comprehensive selftests covering both attached and detached mount cases. - fs: Remove internal old mount API code (1 patch) Now that every in-tree filesystem has been converted to the new mount API, remove all the legacy shim code in fs_context.c that handled unconverted filesystems. This deletes ~280 lines including legacy_init_fs_context(), the legacy_fs_context struct, and associated wrappers. The mount(2) syscall path for userspace remains untouched. Documentation references to the legacy callbacks are cleaned up. - mount: add OPEN_TREE_NAMESPACE to open_tree() Container runtimes currently use CLONE_NEWNS to copy the caller's entire mount namespace — only to then pivot_root() and recursively unmount everything they just copied. With large mount tables and thousands of parallel container launches this creates significant contention on the namespace semaphore. OPEN_TREE_NAMESPACE copies only the specified mount tree (like OPEN_TREE_CLONE) but returns a mount namespace fd instead of a detached mount fd. The new namespace contains the copied tree mounted on top of a clone of the real rootfs. This functions as a combined unshare(CLONE_NEWNS) + pivot_root() in a single syscall. Works with user namespaces: an unshare(CLONE_NEWUSER) followed by OPEN_TREE_NAMESPACE creates a mount namespace owned by the new user namespace. Mount namespace file mounts are excluded from the copy to prevent cycles. Includes ~1000 lines of selftests" * tag 'vfs-7.0-rc1.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/open_tree: add OPEN_TREE_NAMESPACE tests mount: add OPEN_TREE_NAMESPACE fs: Remove internal old mount API code selftests: statmount: tests for STATMOUNT_BY_FD statmount: accept fd as a parameter statmount: permission check should return EPERM commit 18be4ca5cb4e5a86833de97d331f5bc14a6c5a6d Author: Feng Jiang Date: Sun Jan 25 21:09:58 2026 -0700 riscv: lib: optimize strlen loop efficiency Optimize the generic strlen implementation by using a pre-decrement pointer. This reduces the loop body from 4 instructions to 3 and eliminates the unconditional jump ('j'). Old loop (4 instructions, 2 branches): 1: lbu t0, 0(t1); beqz t0, 2f; addi t1, t1, 1; j 1b New loop (3 instructions, 1 branch): 1: addi t1, t1, 1; lbu t0, 0(t1); bnez t0, 1b This change improves execution efficiency and reduces branch pressure for systems without the Zbb extension. Signed-off-by: Feng Jiang Link: https://patch.msgid.link/20251218032614.57356-1-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit 098921ec6818291d98bd3a4002c9dfbe2e75aac2 Author: Thomas Weißschuh Date: Sun Jan 25 21:09:57 2026 -0700 selftests: riscv: vstate_exec_nolibc: Use the regular prctl() function The my_syscall*() macros are internal implementation details of nolibc. Now that nolibc has a normal prctl() function, use that. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260117-nolibc-mysyscall-riscv-v1-1-0ae1ae3513e9@weissschuh.net Signed-off-by: Paul Walmsley commit 849f05ae1ea6e1ff621243dce27fe455fdc9d0ff Author: Sergey Matyukevich Date: Sun Jan 25 21:09:57 2026 -0700 selftests: riscv: verify ptrace accepts valid vector csr values Add a test to v_ptrace test suite to verify that ptrace accepts the valid input combinations of vector csr registers. Use kselftest fixture variants to create multiple inputs for the test. The test simulates a debug scenario with three breakpoints: 0. init: let the tracee set up its initial vector configuration 1. 1st bp: modify the tracee's vector csr registers from the debugger - resume the tracee to execute a block without vector instructions 2. 2nd bp: read back the tracees's vector csr registers from the debugger - compare with values set by the debugger - resume the tracee to execute a block with vector instructions 3. 3rd bp: read back the tracess's vector csr registers again - compare with values set by the debugger The last check helps to confirm that ptrace validation check for vector csr registers input values works properly and maintains an accurate view of the tracee's vector context in debugger. Signed-off-by: Sergey Matyukevich Tested-by: Andy Chiu Link: https://patch.msgid.link/20251214163537.1054292-10-geomatsi@gmail.com [pjw@kernel.org: cleaned up a checkpatch issue] Signed-off-by: Paul Walmsley commit 30eb191c895b086c21fc04c5c1482cb1bb0f3caf Author: Sergey Matyukevich Date: Sun Jan 25 21:09:57 2026 -0700 selftests: riscv: verify ptrace rejects invalid vector csr inputs Add a test to v_ptrace test suite to verify that ptrace rejects the invalid input combinations of vector csr registers. Use kselftest fixture variants to create multiple invalid inputs for the test. Signed-off-by: Sergey Matyukevich Tested-by: Andy Chiu Link: https://patch.msgid.link/20251214163537.1054292-9-geomatsi@gmail.com [pjw@kernel.org: cleaned up some checkpatch issues] Signed-off-by: Paul Walmsley commit 3789d5eecd5ae01149d0ef5ba70e8120da2f55db Author: Sergey Matyukevich Date: Sun Jan 25 21:09:57 2026 -0700 selftests: riscv: verify syscalls discard vector context Add a test to v_ptrace test suite to verify that vector csr registers are clobbered on syscalls. Signed-off-by: Sergey Matyukevich Reviewed-by: Andy Chiu Tested-by: Andy Chiu Link: https://patch.msgid.link/20251214163537.1054292-8-geomatsi@gmail.com [pjw@kernel.org: cleaned up a checkpatch issue] Signed-off-by: Paul Walmsley commit 66d03044891df63c82b18ae1da07bc4bc077ae48 Author: Sergey Matyukevich Date: Sun Jan 25 21:09:57 2026 -0700 selftests: riscv: verify initial vector state with ptrace Add a test case that attaches to a traced process immediately after its first executed vector instructions to verify the initial vector context. Signed-off-by: Sergey Matyukevich Reviewed-by: Andy Chiu Tested-by: Andy Chiu Link: https://patch.msgid.link/20251214163537.1054292-7-geomatsi@gmail.com Signed-off-by: Paul Walmsley commit 600f72ded8c877be95322ce806d23345ea5e89bc Author: Sergey Matyukevich Date: Sun Jan 25 21:09:57 2026 -0700 selftests: riscv: test ptrace vector interface Add a test case to check ptrace behavior in the case when vector extension is supported by the system, but vector context is not yet enabled for the traced process. Signed-off-by: Sergey Matyukevich Reviewed-by: Andy Chiu Tested-by: Andy Chiu Link: https://patch.msgid.link/20251214163537.1054292-6-geomatsi@gmail.com [pjw@kernel.org: dropped duplicate sys/wait.h include] Signed-off-by: Paul Walmsley commit f4be988f5b547dc4b305c15a078a52cdde76a8f5 Author: Sergey Matyukevich Date: Sun Jan 25 21:09:57 2026 -0700 riscv: ptrace: validate input vector csr registers Add strict validation for vector csr registers when setting them via ptrace: - reject attempts to set reserved bits or invalid field combinations - enforce strict VL checks against calculated VLMAX values Vector specs 0.7.1 and 1.0 allow normal applications to set candidate VL values and read back the hardware-adjusted results, see section 6 for details. Disallow such flexibility in vector ptrace operations and strictly enforce valid VL input. The traced process may not update its saved vector context if no vector instructions execute between breakpoints. So the purpose of the strict ptrace approach is to make sure that debuggers maintain an accurate view of the tracee's vector context across multiple halt/resume debug cycles. Signed-off-by: Sergey Matyukevich Reviewed-by: Andy Chiu Tested-by: Andy Chiu Link: https://patch.msgid.link/20251214163537.1054292-5-geomatsi@gmail.com Signed-off-by: Paul Walmsley commit fd515e037efb3b6300eace247e14ab2bc7e38db5 Author: Sergey Matyukevich Date: Sun Jan 25 21:09:57 2026 -0700 riscv: csr: define vtype register elements Define masks and shifts for vtype CSR according to the vector specs: - v0.7.1 used in early T-Head cores, known as xtheadvector in the kernel - v1.0 Signed-off-by: Sergey Matyukevich Reviewed-by: Andy Chiu Tested-by: Andy Chiu Link: https://patch.msgid.link/20251214163537.1054292-4-geomatsi@gmail.com Signed-off-by: Paul Walmsley commit ef3ff40346db8476a9ef7269fc9d1837e7243c40 Author: Sergey Matyukevich Date: Sun Jan 25 21:09:56 2026 -0700 riscv: vector: init vector context with proper vlenb The vstate in thread_struct is zeroed when the vector context is initialized. That includes read-only register vlenb, which holds the vector register length in bytes. Zeroed state persists until mstatus.VS becomes 'dirty' and a context switch saves the actual hardware values. This can expose the zero vlenb value to the user-space in early debug scenarios, e.g. when ptrace attaches to a traced process early, before any vector instruction except the first one was executed. Fix this by specifying proper vlenb on vector context init. Signed-off-by: Sergey Matyukevich Reviewed-by: Andy Chiu Tested-by: Andy Chiu Link: https://patch.msgid.link/20251214163537.1054292-3-geomatsi@gmail.com Signed-off-by: Paul Walmsley commit 8113b3998d5c96aca885b967e6aa47e428ebc632 Merge: c84bb79f70c634 6ea258d1f6895c Author: Linus Torvalds Date: Mon Feb 9 14:25:37 2026 -0800 Merge tag 'vfs-7.0-rc1.atomic_open' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs atomic_open updates from Christian Brauner: "Allow knfsd to use atomic_open() While knfsd offers combined exclusive create and open results to clients, on some filesystems those results are not atomic. The separate vfs_create() + vfs_open() sequence in dentry_create() can produce races and unexpected errors. For example, open O_CREAT with mode 0 will succeed in creating the file but return -EACCES from vfs_open(). Additionally, network filesystems benefit from reducing remote round-trip operations by using a single atomic_open() call. Teach dentry_create() -- whose sole caller is knfsd -- to use atomic_open() for filesystems that support it" * tag 'vfs-7.0-rc1.atomic_open' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs/namei: fix kernel-doc markup for dentry_create VFS/knfsd: Teach dentry_create() to use atomic_open() VFS: Prepare atomic_open() for dentry_create() VFS: move dentry_create() from fs/open.c to fs/namei.c commit c84bb79f70c634a95929f21c14340ab2078d7977 Merge: 7e01a69f5c4f2a 313c47f4fe4d07 Author: Linus Torvalds Date: Mon Feb 9 13:41:34 2026 -0800 Merge tag 'vfs-7.0-rc1.nullfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs nullfs update from Christian Brauner: "Add a completely catatonic minimal pseudo filesystem called "nullfs" and make pivot_root() work in the initramfs. Currently pivot_root() does not work on the real rootfs because it cannot be unmounted. Userspace has to recursively delete initramfs contents manually before continuing boot, using the fragile switch_root sequence (overmount + chroot). Add nullfs, a minimal immutable filesystem that serves as the true root of the mount hierarchy. The mutable rootfs (tmpfs/ramfs) is mounted on top of it. This allows userspace to simply: chdir(new_root); pivot_root(".", "."); umount2(".", MNT_DETACH); without the traditional switch_root workarounds. systemd already handles this correctly. It tries pivot_root() first and falls back to MS_MOVE only when that fails. This also means rootfs mounts in unprivileged namespaces no longer need MNT_LOCKED, since the immutable nullfs guarantees nothing can be revealed by unmounting the covering mount. nullfs is a single-instance filesystem (get_tree_single()) marked SB_NOUSER | SB_I_NOEXEC | SB_I_NODEV with an immutable empty root directory. This means sooner or later it can be used to overmount other directories to hide their contents without any additional protection needed. We enable it unconditionally. If we see any real regression we'll hide it behind a boot option. nullfs has extensions beyond this in the future. It will serve as a concept to support the creation of completely empty mount namespaces - which is work coming up in the next cycle" * tag 'vfs-7.0-rc1.nullfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: use nullfs unconditionally as the real rootfs docs: mention nullfs fs: add immutable rootfs fs: add init_pivot_root() fs: ensure that internal tmpfs mount gets mount id zero commit dd2fdc3504592d85e549c523b054898a036a6afe Author: Daniel Hodges Date: Fri Feb 6 15:41:46 2026 -0500 SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path Commit 5940d1cf9f42 ("SUNRPC: Rebalance a kref in auth_gss.c") added a kref_get(&gss_auth->kref) call to balance the gss_put_auth() done in gss_release_msg(), but forgot to add a corresponding kref_put() on the error path when kstrdup_const() fails. If service_name is non-NULL and kstrdup_const() fails, the function jumps to err_put_pipe_version which calls put_pipe_version() and kfree(gss_msg), but never releases the gss_auth reference. This leads to a kref leak where the gss_auth structure is never freed. Add a forward declaration for gss_free_callback() and call kref_put() in the err_put_pipe_version error path to properly release the reference taken earlier. Fixes: 5940d1cf9f42 ("SUNRPC: Rebalance a kref in auth_gss.c") Cc: stable@vger.kernel.org Signed-off-by: Daniel Hodges Signed-off-by: Anna Schumaker commit 7e01a69f5c4f2a6af2d4cd1cc46d48efdeb98230 Merge: 6124fa45e2d919 8c97a6ddc95690 Author: Linus Torvalds Date: Mon Feb 9 13:38:07 2026 -0800 Merge tag 'vfs-7.0-rc1.minix' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull minix update from Christian Brauner: "Consolidate and strengthen superblock validation in minix_check_superblock() The minix filesystem driver does not validate several superblock fields before using them during mount, allowing a crafted filesystem image to trigger out-of-bounds accesses (reported by syzbot)" * tag 'vfs-7.0-rc1.minix' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: minix: Add required sanity checking to minix_check_superblock() commit 6124fa45e2d919eeb9fc2d6675f5824b44e344b0 Merge: dd466ea0029961 f97f020075e83d Author: Linus Torvalds Date: Mon Feb 9 13:05:35 2026 -0800 Merge tag 'vfs-7.0-rc1.btrfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs updates for btrfs from Christian Brauner: "This contains some changes for btrfs that are taken to the vfs tree to stop duplicating VFS code for subvolume/snapshot dentry Btrfs has carried private copies of the VFS may_delete() and may_create() functions in fs/btrfs/ioctl.c for permission checks during subvolume creation and snapshot destruction. These copies have drifted out of sync with the VFS originals — btrfs_may_delete() is missing the uid/gid validity check and btrfs_may_create() is missing the audit_inode_child() call. Export the VFS functions as may_{create,delete}_dentry() and switch btrfs to use them, removing ~70 lines of duplicated code" * tag 'vfs-7.0-rc1.btrfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: btrfs: use may_create_dentry() in btrfs_mksubvol() btrfs: use may_delete_dentry() in btrfs_ioctl_snap_destroy() fs: export may_create() as may_create_dentry() fs: export may_delete() as may_delete_dentry() commit dd466ea0029961ee0ee6e8e468faa1506275c8a9 Merge: aa2a0fcd4c7b98 347b7042fb26be Author: Linus Torvalds Date: Mon Feb 9 12:21:37 2026 -0800 Merge tag 'vfs-7.0-rc1.fserror' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs error reporting updates from Christian Brauner: "This contains the changes to support generic I/O error reporting. Filesystems currently have no standard mechanism for reporting metadata corruption and file I/O errors to userspace via fsnotify. Each filesystem (xfs, ext4, erofs, f2fs, etc.) privately defines EFSCORRUPTED, and error reporting to fanotify is inconsistent or absent entirely. This introduces a generic fserror infrastructure built around struct super_block that gives filesystems a standard way to queue metadata and file I/O error reports for delivery to fsnotify. Errors are queued via mempools and queue_work to avoid holding filesystem locks in the notification path; unmount waits for pending events to drain. A new super_operations::report_error callback lets filesystem drivers respond to file I/O errors themselves (to be used by an upcoming XFS self-healing patchset). On the uapi side, EFSCORRUPTED and EUCLEAN are promoted from private per-filesystem definitions to canonical errno.h values across all architectures" * tag 'vfs-7.0-rc1.fserror' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: ext4: convert to new fserror helpers xfs: translate fsdax media errors into file "data lost" errors when convenient xfs: report fs metadata errors via fsnotify iomap: report file I/O errors to the VFS fs: report filesystem and file I/O errors to fsnotify uapi: promote EFSCORRUPTED and EUCLEAN to errno.h commit aa2a0fcd4c7b9801be32482755a450a80a3c36a2 Merge: 74554251dfc937 056a96e65f3e2a Author: Linus Torvalds Date: Mon Feb 9 11:59:07 2026 -0800 Merge tag 'vfs-7.0-rc1.leases' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs lease updates from Christian Brauner: "This contains updates for lease support to require filesystems to explicitly opt-in to lease support Currently kernel_setlease() falls through to generic_setlease() when a a filesystem does not define ->setlease(), silently granting lease support to every filesystem regardless of whether it is prepared for it. This is a poor default: most filesystems never intended to support leases, and the silent fallthrough makes it impossible to distinguish "supports leases" from "never thought about it". This inverts the default. It adds explicit .setlease = generic_setlease; assignments to every in-tree filesystem that should retain lease support, then changes kernel_setlease() to return -EINVAL when ->setlease is NULL. With the new default in place, simple_nosetlease() is redundant and is removed along with all references to it" * tag 'vfs-7.0-rc1.leases' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (25 commits) fuse: add setlease file operation fs: remove simple_nosetlease() filelock: default to returning -EINVAL when ->setlease operation is NULL xfs: add setlease file operation ufs: add setlease file operation udf: add setlease file operation tmpfs: add setlease file operation squashfs: add setlease file operation overlayfs: add setlease file operation orangefs: add setlease file operation ocfs2: add setlease file operation ntfs3: add setlease file operation nilfs2: add setlease file operation jfs: add setlease file operation jffs2: add setlease file operation gfs2: add a setlease file operation fat: add setlease file operation f2fs: add setlease file operation exfat: add setlease file operation ext4: add setlease file operation ... commit 6c5c07bc85890a8eadcad484d9bbaa239ca8e623 Author: Amitabh Srivastava Date: Thu Feb 5 17:25:41 2026 +0530 docs: process: maintainer-pgp-guide: update kernel.org docs link Update http link to the documentation about how to add a kernel.org UID to the maintainer's key. Add missing SPDX-License-Identifier to fix a checkpatch warning. Signed-off-by: Amitabh Srivastava Reviewed-by: Konstantin Ryabitsev Signed-off-by: Jonathan Corbet Message-ID: <20260205115554.7795-1-amitabh@amidevlab.com> commit b211a30690f8263b79f30b6b1770ffe216fa378c Author: Randy Dunlap Date: Thu Feb 5 22:54:40 2026 -0800 docs: kdoc_parser: allow __exit in function prototypes Handle functions that are marked with __exit to prevent warnings: Documentation/networking/iucv:35: ../net/iucv/iucv.c:1918: WARNING: Error in declarator or parameters Invalid C declaration: Expecting "(" in parameters. [error at 12] void __exit iucv_exit (void) ------------^ Signed-off-by: Randy Dunlap Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <20260206065440.2412185-1-rdunlap@infradead.org> commit 74554251dfc9374ebf1a9dfc54d6745d56bb9265 Merge: 996812c453cafa 77ef2c3ff5916d Author: Linus Torvalds Date: Mon Feb 9 11:25:01 2026 -0800 Merge tag 'vfs-7.0-rc1.nonblocking_timestamps' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs timestamp updates from Christian Brauner: "This contains the changes to support non-blocking timestamp updates. Since commit 66fa3cedf16a ("fs: Add async write file modification handling") file_update_time_flags() unconditionally returns -EAGAIN when any timestamp needs updating and IOCB_NOWAIT is set. This makes non-blocking direct writes impossible on file systems with granular enough timestamps, which in practice means all of them. This reworks the timestamp update path to propagate IOCB_NOWAIT through ->update_time so that file systems which can update timestamps without blocking are no longer penalized. With that groundwork in place, the core change passes IOCB_NOWAIT into ->update_time and returns -EAGAIN only when the file system indicates it would block. XFS implements non-blocking timestamp updates by using the new ->sync_lazytime and open-coding generic_update_time without the S_NOWAIT check, since the lazytime path through the generic helpers can never block in XFS" * tag 'vfs-7.0-rc1.nonblocking_timestamps' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: xfs: enable non-blocking timestamp updates xfs: implement ->sync_lazytime fs: refactor file_update_time_flags fs: add support for non-blocking timestamp updates fs: add a ->sync_lazytime method fs: factor out a sync_lazytime helper fs: refactor ->update_time handling fat: cleanup the flags for fat_truncate_time nfs: split nfs_update_timestamps fs: allow error returns from generic_update_time fs: remove inode_update_time commit 1075e8e826b27aac92925c44d6d3c794e4d2ce0b Author: Chen Ni Date: Tue Feb 3 09:09:40 2026 +0800 nfs: nfs4proc: Convert comma to semicolon Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker commit afb24505ff6583eb5150b4a54086188494d25c28 Author: Chenguang Zhao Date: Mon Dec 8 16:53:48 2025 +0800 SUNRPC: Change list definition method The LIST_HEAD macro can both define a linked list and initialize it in one step. To simplify code, we replace the separate operations of linked list definition and manual initialization with the LIST_HEAD macro. Signed-off-by: Chenguang Zhao Reviewed-by: Chuck Lever Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker commit 728bea264883031c377fcc9c465b650dbfd1bbf5 Author: Ben Dooks Date: Tue Jan 6 17:37:45 2026 +0000 sunrpc: rpc_debug and others are defined even if CONFIG_SUNRPC_DEBUG unset The rpc_debug, nfs_debug, nfsd_debug and nlm_debug are exported even if CONFIG_SUNRPC_DEBUG is not set. This means that the debug header should also define these to remove the following sparse warnings: net/sunrpc/sysctl.c:29:17: warning: symbol 'rpc_debug' was not declared. Should it be static? net/sunrpc/sysctl.c:32:17: warning: symbol 'nfs_debug' was not declared. Should it be static? net/sunrpc/sysctl.c:35:17: warning: symbol 'nfsd_debug' was not declared. Should it be static? net/sunrpc/sysctl.c:38:17: warning: symbol 'nlm_debug' was not declared. Should it be static? Signed-off-by: Ben Dooks Signed-off-by: Anna Schumaker commit 996812c453cafa042f2e674738dbf8fa495661f3 Merge: 4b6c6bc6fab516 ef12d0573a7f5e Author: Linus Torvalds Date: Mon Feb 9 11:03:25 2026 -0800 Merge tag 'vfs-7.0-rc1.initrd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs initrd removal from Christian Brauner: "Remove the deprecated linuxrc-based initrd code path and related dead code. The linuxrc initrd path was deprecated in 2020 and this series completes its removal. If we see real-life regressions we'll revert. The core change removes handle_initrd() and init_linuxrc() — the entire flow that ran /linuxrc from an initrd, pivoted roots, and handed off to the real root filesystem. With that gone, initrd_load() becomes void (no longer short-circuits prepare_namespace()), rd_load_image() is simplified to always load /initrd.image instead of taking a path, and rd_load_disk() is deleted. The /proc/sys/kernel/real-root-dev sysctl and its backing variable are removed since they only existed for linuxrc to communicate the real root device back to the kernel. The no-op load_ramdisk= and prompt_ramdisk= parameters are dropped, and noinitrd and ramdisk_start= gain deprecation warnings. Initramfs is entirely unaffected. The non-linuxrc initrd path (root=/dev/ram0) is preserved but now carries a deprecation warning targeting January 2027 removal" * tag 'vfs-7.0-rc1.initrd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: init: remove /proc/sys/kernel/real-root-dev initrd: remove deprecated code path (linuxrc) init: remove deprecated "load_ramdisk" and "prompt_ramdisk" command line parameters commit 3d012b8614ee020666f3dd15af9f65dc487e3f5f Author: Thomas Richter Date: Mon Feb 9 16:32:56 2026 +0100 perf test: Fix test case perftool-testsuite_report for s390 Test case perftool-testsuite_report fails on s390 for some time now. Root cause is a time out which is too tight for large s390 machines. The time out value addr2line_timeout_ms is per default set to 1 second. This is the maximum time the function read_addr2line_record() waits for a reply from the forked off tool addr2line, which is started as a child in interactive mode. It reads stdin (an address in hexadecimal) and replies on stdout with function name, file name and line number. This might take more than one second. However one second is not always enough and the reply from addr2line tool is not received. Function read_addr2line_record() fails and emits a warning, which is not expected by the test case. It fails. Output before: # perf test -F 133 -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file ================== [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.087 MB \ /tmp/perftool-testsuite_report.FHz/perf_report/perf.data.1 \ (207 samples) ] ================== -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file ## [ PASS ] ## perf_report :: setup SUMMARY -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/ 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/ vmlinux: could not read first record" Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/ 6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/ vmlinux: could not read first record" -- [ FAIL ] -- perf_report :: test_basic :: basic execution (output regexp parsing) .... 133: perftool-testsuite_report : FAILED! Output after: # ./perf test -F 133 -- [ PASS ] -- perf_report :: setup :: prepare the perf.data file ================== [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.087 MB \ /tmp/perftool-testsuite_report.Mlp/perf_report/perf.data.1 (188 samples) ] ================== -- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file ## [ PASS ] ## perf_report :: setup SUMMARY -- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped -- [ PASS ] -- perf_report :: test_basic :: basic execution -- [ PASS ] -- perf_report :: test_basic :: number of samples -- [ PASS ] -- perf_report :: test_basic :: header -- [ PASS ] -- perf_report :: test_basic :: header timestamp -- [ PASS ] -- perf_report :: test_basic :: show CPU utilization -- [ PASS ] -- perf_report :: test_basic :: pid -- [ PASS ] -- perf_report :: test_basic :: non-existing symbol -- [ PASS ] -- perf_report :: test_basic :: symbol filter -- [ PASS ] -- perf_report :: test_basic :: latency header -- [ PASS ] -- perf_report :: test_basic :: default report for latency profile -- [ PASS ] -- perf_report :: test_basic :: latency report for latency profile -- [ PASS ] -- perf_report :: test_basic :: parallelism histogram ## [ PASS ] ## perf_report :: test_basic SUMMARY 133: perftool-testsuite_report : Ok # Fixes: 257046a36750a6db ("perf srcline: Fallback between addr2line implementations") Reviewed-by: Jan Polensky Signed-off-by: Thomas Richter Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Ian Rogers Cc: linux-s390@vger.kernel.org Cc: Namhyung Kim Cc: Sumanth Korikkar Cc: Vasily Gorbik Signed-off-by: Arnaldo Carvalho de Melo commit bdc5071d7f7bb82589737741e9bf19820ceb7a6a Author: Kees Cook Date: Wed Dec 3 15:30:35 2025 -0800 coccinelle: Add kmalloc_objs conversion script Finds and converts sized kmalloc-family of allocations into the typed kmalloc_obj-family of allocations. Link: https://patch.msgid.link/20251203233036.3212363-5-kees@kernel.org Signed-off-by: Kees Cook commit 2a400eeba40b4cf1fb28f78f41bf73a898b00d06 Author: Arnaldo Carvalho de Melo Date: Mon Feb 9 10:58:44 2026 -0300 perf test code_with_type.sh: Skip test if rust wasn't available at build time $ perf test 'perf data type profiling tests' 83: perf data type profiling tests : Skip $ perf test -vv 'perf data type profiling tests' 83: perf data type profiling tests: --- start --- test child forked, pid 977213 Skip: code_with_type workload not built in 'perf test' ---- end(-2) ---- 83: perf data type profiling tests : Skip $ Cc: Dmitrii Dolgov <9erthalion6@gmail.com> Signed-off-by: Arnaldo Carvalho de Melo commit 4b6c6bc6fab51684cc129f91211734f87db6b065 Merge: 6252e917b9006d 5334fc280735dc Author: Linus Torvalds Date: Mon Feb 9 10:41:56 2026 -0800 Merge tag 'vfs-7.0-rc1.rust' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs rust updates from Christian Brauner: "Allow inlining C helpers into Rust when using LTO: Add the __rust_helper annotation to all VFS-related Rust helper functions. Currently, C helpers cannot be inlined into Rust code even under LTO because LLVM detects slightly different codegen options between the C and Rust compilation units (differing null-pointer-check flags, builtin lists, and target feature strings). The __rust_helper macro is the first step toward fixing this: it is currently #defined to nothing, but a follow-up series will change it to __always_inline when compiling with LTO (while keeping it empty for bindgen, which ignores inline functions). This picks up the VFS portion (fs, pid_namespace, poll) of a larger tree-wide series" * tag 'vfs-7.0-rc1.rust' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: rust: poll: add __rust_helper to helpers rust: pid_namespace: add __rust_helper to helpers rust: fs: add __rust_helper to helpers commit e29a3e61eef6b6c2e60bc1872e9da3bcdbc46c17 Author: Sergey Shtylyov Date: Mon Dec 8 23:15:04 2025 +0300 NFSv4: limit lease period in nfs4_set_lease_period() In nfs4_set_lease_period(), the passed 32-bit lease period in seconds is multiplied by HZ -- that might overflow before being implicitly cast to *unsigned long* (32/64-bit type), while initializing the lease variable. Cap the lease period at MAX_LEASE_PERIOD (#define'd to 1 hour for now), before multipying to avoid such overflow... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Signed-off-by: Sergey Shtylyov Suggested-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 3d57c44e918012db1f901d50bc9195a8812ad602 Author: Sergey Shtylyov Date: Mon Dec 8 23:15:03 2025 +0300 NFSv4: pass lease period in seconds to nfs4_set_lease_period() There's no need to multiply the lease period by HZ at all the call sites of nfs4_set_lease_period() -- it makes more sense to do that only once, inside that function, by passing to it lease period as 32-bit # of seconds instead of 32/64-bit *unsigned long* # of jiffies... Signed-off-by: Sergey Shtylyov Signed-off-by: Anna Schumaker commit fdc0396b3cc05dc9b678627af23c3fdc7dbe930e Author: Stephen Smalley Date: Wed Dec 3 14:57:28 2025 -0500 nfs: unify security_inode_listsecurity() calls commit 243fea134633 ("NFSv4.2: fix listxattr to return selinux security label") introduced a direct call to security_inode_listsecurity() in nfs4_listxattr(). However, nfs4_listxattr() already indirectly called security_inode_listsecurity() via nfs4_listxattr_nfs4_label() if CONFIG_NFS_V4_SECURITY_LABEL is enabled and the server has the NFS_CAP_SECURITY_LABEL capability enabled. This duplication was fixed by commit 9acb237deff7 ("NFSv4.2: another fix for listxattr") by making the second call conditional on NFS_CAP_SECURITY_LABEL not being set by the server. However, the combination of the two changes effectively makes one call to security_inode_listsecurity() in every case - which is the desired behavior since getxattr() always returns a security xattr even if it has to synthesize one. Further, the two different calls produce different xattr name ordering between security.* and user.* xattr names. Unify the two separate calls into a single call and get rid of nfs4_listxattr_nfs4_label() altogether. Link: https://lore.kernel.org/selinux/CAEjxPJ6e8z__=MP5NfdUxkOMQ=EnUFSjWFofP4YPwHqK=Ki5nw@mail.gmail.com/ Signed-off-by: Stephen Smalley Signed-off-by: Anna Schumaker commit 42e7c876b182da65723700f6bc507a8aecb10d3b Author: Sagi Grimberg Date: Sat Dec 27 12:46:29 2025 +0200 fs/nfs: Fix readdir slow-start regression Commit 580f236737d1 ("NFS: Adjust the amount of readahead performed by NFS readdir") reduces the amount of readahead names caching done by the client. The downside of this approach is READDIR now may suffer from a slow-start issue, where initially it will fetch names that fit in a single page, then in 2, 4, 8 until the maximum supported transfer size (usually 1M). This patch tries to take a balanced approach between mitigating the slow-start issue still maintaining some efficiency gains. Fixes: 580f236737d1 ("NFS: Adjust the amount of readahead performed by NFS readdir") Signed-off-by: Sagi Grimberg Signed-off-by: Anna Schumaker commit 6252e917b9006dfa2f3d884fe0dbaf3e676c4108 Merge: bcc8fd3e1573c5 ea64aa57d596c4 Author: Linus Torvalds Date: Mon Feb 9 10:38:05 2026 -0800 Merge tag 'selinux-pr-20260203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Add support for SELinux based access control of BPF tokens We worked with the BPF devs to add the necessary LSM hooks when the BPF token code was first introduced, but it took us a bit longer to add the SELinux wiring and support. In order to preserve existing token-unaware SELinux policies, the new code is gated by the new "bpf_token_perms" policy capability. Additional details regarding the new permissions, and behaviors can be found in the associated commit. - Remove a BUG() from the SELinux capability code We now perform a similar check during compile time so we can safely remove the BUG() call. * tag 'selinux-pr-20260203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: drop the BUG() in cred_has_capability() selinux: fix a capabilities parsing typo in selinux_bpf_token_capable() selinux: add support for BPF token access control selinux: move the selinux_blob_sizes struct commit 1d3ffe6233b1b6e8697f5027b9441ce70385c997 Author: Dmitrii Dolgov <9erthalion6@gmail.com> Date: Mon Feb 9 15:05:32 2026 +0100 perf tests workload: Formatting for code_with_type.rs One part of the rust code for code_with_type workload wasn't properly formatted. Pass it through rustfmt to fix that. Closes: https://lore.kernel.org/oe-kbuild-all/202602091357.oyRv6hgQ-lkp@intel.com/ Reported-by: kernel test robot Reviewed-by: Ian Rogers Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Cc: Miguel Ojeda Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit bcc8fd3e1573c502edc0cb61abea0e113a761799 Merge: 698749164aa53c 472711068fa950 Author: Linus Torvalds Date: Mon Feb 9 10:16:48 2026 -0800 Merge tag 'lsm-pr-20260203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: - Unify the security_inode_listsecurity() calls in NFSv4 While looking at security_inode_listsecurity() with an eye towards improving the interface, we realized that the NFSv4 code was making multiple calls to the LSM hook that could be consolidated into one. - Mark the LSM static branch keys as static - this helps resolve some sparse warnings - Add __rust_helper annotations to the LSM and cred wrapper functions - Remove the unsused set_security_override_from_ctx() function - Minor fixes to some of the LSM kdoc comment blocks * tag 'lsm-pr-20260203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: make keys for static branch static cred: remove unused set_security_override_from_ctx() rust: security: add __rust_helper to helpers rust: cred: add __rust_helper to helpers nfs: unify security_inode_listsecurity() calls lsm: fix kernel-doc struct member names commit 698749164aa53cc313248efd2dc1c25dcf25c99c Merge: 37b4fbf8dbdfb6 76489955c6d4a0 Author: Linus Torvalds Date: Mon Feb 9 10:13:03 2026 -0800 Merge tag 'audit-pr-20260203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: - Improve the NETFILTER_PKT audit records Add source and destination ports to the NETFILTER_PKT audit records while also consolidating a lot of the code into a new, singular audit_log_nf_skb() function. This new approach to structuring the NETFILTER_PKT record generation should eliminate some unnecessary overhead when audit is not built into the kernel. - Update the audit syscall classifier code Add the listxattrat(), getxattrat(), and fchmodat2() syscall to the audit code which classifies syscalls into categories of operations, e.g. "read" or "change attributes". - Move the syscall classifier declarations into audit_arch.h Shuffle around some header file declarations to resolve some sparse warnings. * tag 'audit-pr-20260203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: move the compat_xxx_class[] extern declarations to audit_arch.h audit: add missing syscalls to read class audit: include source and destination ports to NETFILTER_PKT audit: add audit_log_nf_skb helper function audit: add fchmodat2() to change attributes class commit 37b4fbf8dbdfb694f2972d1bd7fcd36304a520dd Merge: 2f81bdbdb3aa3f 3e91b44c93ad28 Author: Linus Torvalds Date: Mon Feb 9 10:11:28 2026 -0800 Merge tag 'tpmdd-next-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen. * tag 'tpmdd-next-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: st33zp24: Fix missing cleanup on get_burstcount() error tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure commit 2f81bdbdb3aa3fccd9b5420df5674730c40af554 Merge: ef852baaf6a735 ed318b3fb4ab31 Author: Linus Torvalds Date: Mon Feb 9 10:06:44 2026 -0800 Merge tag 'i3c/for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "Subsystem: - add sysfs entry and attribute for Device NACK Retry count Drivers: - dw: Device NACK Retry configuration knob - mipi-i3c-hci: support multi-bus instances, runtime PM, and suspend - renesas: suspend/resume support" * tag 'i3c/for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (52 commits) i3c: dw-i3c-master: fix SIR reject bit mapping for dynamic addresses i3c: dw-i3c-master: convert spinlock usage to scoped guards i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() i3c: mipi-i3c-hci-pci: Add System Suspend support i3c: mipi-i3c-hci: Add optional System Suspend support i3c: master: Add i3c_master_do_daa_ext() for post-hibernation address recovery i3c: dw: Initialize spinlock to avoid upsetting lockdep i3c: mipi-i3c-hci-pci: Add Runtime PM support i3c: mipi-i3c-hci: Add optional Runtime PM support i3c: master: Introduce optional Runtime PM support i3c: mipi-i3c-hci: Factor out master dynamic address setting into helper i3c: mipi-i3c-hci: Allow core re-initialization for Runtime PM support i3c: mipi-i3c-hci: Factor out core initialization into helper i3c: mipi-i3c-hci: Factor out IO mode setting into helper i3c: mipi-i3c-hci: Factor out software reset into helper i3c: mipi-i3c-hci: Add PIO suspend and resume support i3c: mipi-i3c-hci: Refactor PIO register initialization i3c: mipi-i3c-hci: Add DMA suspend and resume support i3c: mipi-i3c-hci: Extract ring initialization from hci_dma_init() i3c: mipi-i3c-hci: Introduce helper to restore DAT ... commit 9e03b7caf4e65f5a5841dfed540fdcc3ff061734 Merge: 4215ee0d7bb535 6517dfbcc918f9 Author: Paolo Bonzini Date: Mon Feb 9 18:53:47 2026 +0100 Merge tag 'kvm-x86-misc-6.20' of https://github.com/kvm-x86/linux into HEAD KVM x86 misc changes for 6.20 - Disallow changing the virtual CPU model if L2 is active, for all the same reasons KVM disallows change the model after the first KVM_RUN. - Fix a bug where KVM would incorrectly reject host accesses to PV MSRs that were advertised as supported to userspace when running with KVM_CAP_ENFORCE_PV_FEATURE_CPUID enabled. - Fix a bug where KVM would attempt to read protect guest state (CR3) when configuring an async #PF entry. - Fail the build if EXPORT_SYMBOL_GPL or EXPORT_SYMBOL is used in KVM (for x86 only) to enforce usage of EXPORT_SYMBOL_FOR_KVM_INTERNAL. Explicitly allow the few exports that are intended for external usage. - Ignore -EBUSY when checking nested events after a vCPU exits blocking as the WARN is user-triggerable, and because exiting to userspace on -EBUSY does more harm than good in pretty much every situation. - Throw in the towel and drop the WARN on INIT/SIPI being blocked when vCPU is in Wait-For-SIPI, as playing whack-a-mole with syzkaller turned out to be an unwinnable game. - Add support for new Intel instructions that don't require anything beyond enumerating feature flags to userspace. - Grab SRCU when reading PDPTRs in KVM_GET_SREGS2. - Add WARNs to guard against modifying KVM's CPU caps outside of the intended setup flow, as nested VMX in particular is sensitive to unexpected changes in KVM's golden configuration. - Add a quirk to allow userspace to opt-in to actually suppress EOI broadcasts when the suppression feature is enabled by the guest (currently limited to split IRQCHIP, i.e. userspace I/O APIC). Sadly, simply fixing KVM to honor Suppress EOI Broadcasts isn't an option as some userspaces have come to rely on KVM's buggy behavior (KVM advertises Supress EOI Broadcast irrespective of whether or not userspace I/O APIC supports Directed EOIs). - Minor cleanups. commit 4215ee0d7bb5358882375c84d3cd0488bb5813b2 Merge: 687603fb2bf120 20c3c4108d58f8 Author: Paolo Bonzini Date: Mon Feb 9 18:51:37 2026 +0100 Merge tag 'kvm-x86-svm-6.20' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.20 - Drop a user-triggerable WARN on nested_svm_load_cr3() failure. - Add support for virtualizing ERAPS. Note, correct virtualization of ERAPS relies on an upcoming, publicly announced change in the APM to reduce the set of conditions where hardware (i.e. KVM) *must* flush the RAP. - Ignore nSVM intercepts for instructions that are not supported according to L1's virtual CPU model. - Add support for expedited writes to the fast MMIO bus, a la VMX's fastpath for EPT Misconfig. - Don't set GIF when clearing EFER.SVME, as GIF exists independently of SVM, and allow userspace to restore nested state with GIF=0. - Treat exit_code as an unsigned 64-bit value through all of KVM. - Add support for fetching SNP certificates from userspace. - Fix a bug where KVM would use vmcb02 instead of vmcb01 when emulating VMLOAD or VMSAVE on behalf of L2. - Misc fixes and cleanups. commit 687603fb2bf1205d6f7028e30848434e3b126a7a Merge: a0c468eda4386c c0d6b8bbbced66 Author: Paolo Bonzini Date: Mon Feb 9 18:50:04 2026 +0100 Merge tag 'kvm-x86-vmx-6.20' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 6.20 - Fix an SGX bug where KVM would incorrectly try to handle EPCM #PFs by always relecting EPCM #PFs back into the guest. KVM doesn't shadow EPCM entries, and so EPCM violations cannot be due to KVM interference, and can't be resolved by KVM. - Fix a bug where KVM would register its posted interrupt wakeup handler even if loading kvm-intel.ko ultimately failed. - Disallow access to vmcb12 fields that aren't fully supported, mostly to avoid weirdness and complexity for FRED and other features, where KVM wants enable VMCS shadowing for fields that conditionally exist. - Print out the "bad" offsets and values if kvm-intel.ko refuses to load (or refuses to online a CPU) due to a VMCS config mismatch. commit ef852baaf6a73551cfaa0d082477b50d842b79b8 Merge: 5c40222af1689d ed062c41dfda2d Author: Linus Torvalds Date: Mon Feb 9 09:46:26 2026 -0800 Merge tag 'rcu.release.v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU updates from Boqun Feng: - RCU Tasks Trace: Re-implement RCU tasks trace in term of SRCU-fast, not only more than 500 lines of code are saved because of the reimplementation, a new set of API, rcu_read_{,un}lock_tasks_trace(), becomes possible as well. Compared to the previous rcu_read_{,un}lock_trace(), the new API avoid the task_struct accesses thanks to the SRCU-fast semantics. As a result, the old rcu_read{,un}lock_trace() API is now deprecated. - RCU Torture Test: - Multiple improvements on kvm-series.sh (parallel run and progress showing metrics) - Add context checks to rcu_torture_timer() - Make config2csv.sh properly handle comments in .boot files - Include commit discription in testid.txt - Miscellaneous RCU changes: - Reduce synchronize_rcu() latency by reporting GP kthread's CPU QS early - Use suitable gfp_flags for the init_srcu_struct_nodes() - Fix rcu_read_unlock() deadloop due to softirq - Correctly compute probability to invoke ->exp_current() in rcutorture - Make expedited RCU CPU stall warnings detect stall-end races - RCU nocb: - Remove unnecessary WakeOvfIsDeferred wake path and callback overload handling - Extract nocb_defer_wakeup_cancel() helper * tag 'rcu.release.v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (25 commits) rcu/nocb: Extract nocb_defer_wakeup_cancel() helper rcu/nocb: Remove dead callback overload handling rcu/nocb: Remove unnecessary WakeOvfIsDeferred wake path rcu: Reduce synchronize_rcu() latency by reporting GP kthread's CPU QS early srcu: Use suitable gfp_flags for the init_srcu_struct_nodes() rcu: Fix rcu_read_unlock() deadloop due to softirq rcutorture: Correctly compute probability to invoke ->exp_current() rcu: Make expedited RCU CPU stall warnings detect stall-end races rcutorture: Add --kill-previous option to terminate previous kvm.sh runs rcutorture: Prevent concurrent kvm.sh runs on same source tree torture: Include commit discription in testid.txt torture: Make config2csv.sh properly handle comments in .boot files torture: Make kvm-series.sh give run numbers and totals torture: Make kvm-series.sh give build numbers and totals torture: Parallelize kvm-series.sh guest-OS execution rcutorture: Add context checks to rcu_torture_timer() rcutorture: Test rcu_tasks_trace_expedite_current() srcu: Create an rcu_tasks_trace_expedite_current() function checkpatch: Deprecate rcu_read_{,un}lock_trace() rcu: Update Requirements.rst for RCU Tasks Trace ... commit 5c40222af1689d89966c4b60e79852d6bc13416a Merge: 7d726a34d68597 6d6ad32e22f028 Author: Linus Torvalds Date: Mon Feb 9 09:42:21 2026 -0800 Merge tag 'linux_kselftest-next-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: "resctrl test: - fix division by zero error on Hygon - fix non-contiguous CBM check for Hygon - define CPU vendor IDs as bits to match usage - add CPU vendor detection for Hygon misc: - coredeump test: use __builtin_trap() instead of a null pointer - anon_inode: replace null pointers with empty arrays - kublk: include message in _Static_assert for C11 compatibility - run_kselftest.sh: add `--skip` argument option - pidfd: fix typo in comment" * tag 'linux_kselftest-next-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/pidfd: fix typo in comment selftests/run_kselftest.sh: Add `--skip` argument option selftests/resctrl: Fix non-contiguous CBM check for Hygon selftests/resctrl: Add CPU vendor detection for Hygon selftests/resctrl: Define CPU vendor IDs as bits to match usage selftests/resctrl: Fix a division by zero error on Hygon kselftest/kublk: include message in _Static_assert for C11 compatibility kselftest/anon_inode: replace null pointers with empty arrays kselftest/coredump: use __builtin_trap() instead of null pointer commit a0c468eda4386c67082973d21d811fd777a798ed Merge: 549006326978fb a91cc48246605a Author: Paolo Bonzini Date: Mon Feb 9 18:38:54 2026 +0100 Merge tag 'kvm-x86-selftests-6.20' of https://github.com/kvm-x86/linux into HEAD KVM selftests changes for 6.20 - Add a regression test for TPR<=>CR8 synchronization and IRQ masking. - Overhaul selftest's MMU infrastructure to genericize stage-2 MMU support, and extend x86's infrastructure to support EPT and NPT (for L2 guests). - Extend several nested VMX tests to also cover nested SVM. - Add a selftest for nested VMLOAD/VMSAVE. - Rework the nested dirty log test, originally added as a regression test for PML where KVM logged L2 GPAs instead of L1 GPAs, to improve test coverage and to hopefully make the test easier to understand and maintain. commit 7d726a34d68597899a43001dd2bc1aeac7801008 Merge: 5b785b83c2414f db0c35ca36526f Author: Linus Torvalds Date: Mon Feb 9 09:37:55 2026 -0800 Merge tag 'linux_kselftest-kunit-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: "kunit: - add __rust_helper to helpers - fix up const mismatch in many assert functions - fix up const mismatch in test_list_sort - protect KUNIT_BINARY_STR_ASSERTION against ERR_PTR values - respect KBUILD_OUTPUT env variable by default - add bash completion kunit tool: - add test for nested test result reporting - do not overwrite test status based on subtest counts - add 32-bit big endian ARM configuration to qemu_configs - rename test_data_path() to _test_data_path() - do not rely on implicit working directory change" * tag 'linux_kselftest-kunit-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: add bash completion kunit: tool: test: Don't rely on implicit working directory change kunit: tool: test: Rename test_data_path() to _test_data_path() kunit: qemu_configs: Add 32-bit big endian ARM configuration kunit: tool: Don't overwrite test status based on subtest counts kunit: tool: Add test for nested test result reporting kunit: respect KBUILD_OUTPUT env variable by default kunit: Protect KUNIT_BINARY_STR_ASSERTION against ERR_PTR values test_list_sort: fix up const mismatch kunit: fix up const mis-match in many assert functions rust: kunit: add __rust_helper to helpers commit 5b785b83c2414f2e09927ab6c8b82e3985081dc6 Merge: 05f7e89ab97315 693142d4d761dd Author: Linus Torvalds Date: Mon Feb 9 09:32:33 2026 -0800 Merge tag 'auxdisplay-v6.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay Pull auxdisplay updates from Andy Shevchenko: - A good refactoring of arm-charlcd to use modern kernel APIs * tag 'auxdisplay-v6.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay: auxdisplay: max6959: Replace slab.h with device/devres.h auxdisplay: arm-charlcd: Remove redundant ternary operators auxdisplay: arm-charlcd: Join string literals back auxdisplay: arm-charlcd: Use readl_poll_timeout auxdisplay: arm-charlcd: Don't use "proxy" headers auxdisplay: arm-charlcd: drop of_match_ptr() auxdisplay: arm-charlcd: Remove unneeded info message auxdisplay: arm-charlcd: convert to use device managed APIs auxdisplay: arm-charlcd: fix release_mem_region() size commit ebcff9dacaf2c1418f8bc927388186d7d3674603 Author: Arnd Bergmann Date: Mon Feb 2 23:48:07 2026 +0100 vduse: avoid adding implicit padding The vduse_iova_range_v2 and vduse_iotlb_entry_v2 structures are both defined in a way that adds implicit padding and is incompatible between i386 and x86_64 userspace because of the different structure alignment requirements. Building the header with -Wpadded shows these new warnings: vduse.h:305:1: error: padding struct size to alignment boundary with 4 bytes [-Werror=padded] vduse.h:374:1: error: padding struct size to alignment boundary with 4 bytes [-Werror=padded] Change the amount of padding in these two structures to align them to 64 bit words and avoid those problems. Since the v1 vduse_iotlb_entry already has an inconsistent size, do not attempt to reuse the structure but rather list the members indiviudally, with a fixed amount of padding. Fixes: 079212f6877e ("vduse: add vq group asid support") Signed-off-by: Arnd Bergmann Signed-off-by: Michael S. Tsirkin Message-Id: <20260202224835.559538-1-arnd@kernel.org> commit 549006326978fbf66d9db2953cb1e4fb5487da65 Merge: c14f646638ddf6 6316366129d288 Author: Paolo Bonzini Date: Mon Feb 9 18:18:19 2026 +0100 Merge tag 'kvmarm-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 7.0 - Add support for FEAT_IDST, allowing ID registers that are not implemented to be reported as a normal trap rather than as an UNDEF exception. - Add sanitisation of the VTCR_EL2 register, fixing a number of UXN/PXN/XN bugs in the process. - Full handling of RESx bits, instead of only RES0, and resulting in SCTLR_EL2 being added to the list of sanitised registers. - More pKVM fixes for features that are not supposed to be exposed to guests. - Make sure that MTE being disabled on the pKVM host doesn't give it the ability to attack the hypervisor. - Allow pKVM's host stage-2 mappings to use the Force Write Back version of the memory attributes by using the "pass-through' encoding. - Fix trapping of ICC_DIR_EL1 on GICv5 hosts emulating GICv3 for the guest. - Preliminary work for guest GICv5 support. - A bunch of debugfs fixes, removing pointless custom iterators stored in guest data structures. - A small set of FPSIMD cleanups. - Selftest fixes addressing the incorrect alignment of page allocation. - Other assorted low-impact fixes and spelling fixes. commit c14f646638ddf647e080d4755e9a008dc9db03e7 Merge: 05f7e89ab97315 2d94a3f7088b69 Author: Paolo Bonzini Date: Mon Feb 9 18:17:01 2026 +0100 Merge tag 'loongarch-kvm-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v6.20 1. Add more CPUCFG mask bits. 2. Improve feature detection. 3. Add FPU/LBT delay load support. 4. Set default return value in KVM IO bus ops. 5. Add paravirt preempt feature support. 6. Add KVM steal time test case for tools/selftests. commit dd03dd60e8cdd5ef0f0cbc18276c45009bcc51f4 Merge: fe7cd89f0e29f0 f8f774913b4b59 Author: Takashi Iwai Date: Mon Feb 9 17:39:11 2026 +0100 Merge tag 'asoc-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v7.0 This release is almost all abut driers, there's very little core work here, although some of that driver work is in more generic areas like SDCA and SOF: - Generic SDCA support for reporting jack events. - Continuing platform support, cleanup and feature improements for the AMD, Intel, Qualcomm and SOF code. - Platform description improvements for the Cirrus drivers. - Support for NXP i.MX952, Realtek RT1320 and RT5575, and Sophogo CV1800B. We also pulled in one small SPI API update and some more substantial regmap work (cache description improvements) for use in drivers. commit 33312c4d5ed81506d477bc55981fca0654cb7120 Merge: e2ec6d67e4a53d ff7ed83beab92d Author: Jiri Kosina Date: Mon Feb 9 17:37:58 2026 +0100 Merge branch 'for-6.20/pm_ptr-v3' into for-linus - Use pm_*ptr instead of #ifdef CONFIG_PM* (Bastien Nocera) commit e2ec6d67e4a53d61398d9a37e5160b7a272d744a Merge: 9f2975f1bff07d e01a029654f7fb Author: Jiri Kosina Date: Mon Feb 9 17:37:12 2026 +0100 Merge branch 'for-6.20/pidff' into for-linus - solidify trigger handling in hid-pidff (Tomasz Pakuła) commit 9f2975f1bff07dc68e26f2f3ddc5c48047b2f5c3 Merge: 05bc4583b89122 6761f9ccd62476 Author: Jiri Kosina Date: Mon Feb 9 17:36:30 2026 +0100 Merge branch 'for-6.20/intel-thc' into for-linus - support for HID output reports in the Quicki2c (Even Xu) commit 05bc4583b89122dadd099ad15d275465b37af9a4 Merge: 9be2c22b0b3ce9 698362f1f4644a Author: Jiri Kosina Date: Mon Feb 9 17:35:21 2026 +0100 Merge branch 'for-6.20/intel-ish' into for-linus - support for new firmware handling in intel-ish-hid (Vishnu Sankar) commit 9be2c22b0b3ce964ffc77601696d096d8e4992e6 Merge: ec496f77b4c110 b8e5fdf0bd022c Author: Jiri Kosina Date: Mon Feb 9 17:34:17 2026 +0100 Merge branch 'for-6.20/elecom' into for-linus - support for new model of "Elecom Huge" trackball (David Phillips) commit ec496f77b4c11036cc835d6f045fb5e5ef1e6530 Merge: 984d6f361d1948 ae40ace015be44 Author: Jiri Kosina Date: Mon Feb 9 17:33:26 2026 +0100 Merge branch 'for-6.20/sony' into for-linus - Support for Rock band 4 PS4 and PS5 guitars (Rosalie Wanders) commit 984d6f361d19486fcd8fc13d29112fe73123f482 Merge: e4aa247d94a045 f631011e36b87b Author: Jiri Kosina Date: Mon Feb 9 17:32:14 2026 +0100 Merge branch 'for-6.20/asus' into for-linus - Support for WMI (Fn+F5) fan control for Asus ROG laptops (Ionut Nechita) - fn-lock support for Asus ProArt P16 (Connor Belli) commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 Author: Konstantin Komarov Date: Mon Feb 9 16:07:32 2026 +0100 fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() When ntfs_read_run_nb_ra() is invoked with run == NULL the code later assumes run is valid and may call run_get_entry(NULL, ...), and also uses clen/idx without initializing them. Smatch reported uninitialized variable warnings and this can lead to undefined behaviour. This patch fixes it. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/ Signed-off-by: Konstantin Komarov commit fe7cd89f0e29f0852316857b4861309f9b891370 Author: Qihang Guo Date: Mon Feb 9 18:04:18 2026 +0800 ALSA: usb-audio: Add DSD support for iBasso DC04U Vendor ID 0x0661 is assigned to Hamamatsu Photonics K.K., but is used by iBasso for iBasso DC04U (0x0661:0x0883), which supports native DSD playback. This patch adds QUIRK_FLAG_DSD_RAW for iBasso DC04U, enabling native DSD playback (DSD_U32_BE). The change has been verified on Arch Linux using mpd and pw-cat. Signed-off-by: Qihang Guo Link: https://patch.msgid.link/TYYPR01MB14098529E0BD900921BE6F42CF465A@TYYPR01MB14098.jpnprd01.prod.outlook.com Signed-off-by: Takashi Iwai commit 4f3a06cc57976cafa8c6f716646be6c79a99e485 Author: Namjae Jeon Date: Mon Feb 9 10:43:19 2026 +0900 ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del). Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase accesses. Cc: stable@vger.kernel.org Reported-by: Igor Stepansky Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3f5dfa472ea6771c821ee0bb10dee7de41ef6021 Author: Arnaldo Carvalho de Melo Date: Mon Feb 9 10:58:44 2026 -0300 tools build: Fix rust feature detection Features in FEATURE_TESTS_BASIC will be set as being available if test-all.c builds, so since the rust test isn't included in test-all.c, we can't have 'rust' in there, remove it from FEATURE_TESTS_BASIC and use feature-check so that it tries to build test-rust.bin, doing the actual feature detection. On a system lacking a rust compiler: Makefile.config:1158: Rust is not found. Test workloads with rust are disabled. Auto-detecting system features: ... libdw: [ on ] ... glibc: [ on ] ... libelf: [ on ] ... libnuma: [ on ] ... numa_num_possible_cpus: [ on ] ... libpython: [ on ] ... libcapstone: [ on ] ... llvm-perf: [ on ] ... zlib: [ on ] ... lzma: [ on ] ... bpf: [ on ] ... libaio: [ on ] ... libzstd: [ on ] ... libopenssl: [ on ] ... rust: [ OFF ] $ cat /tmp/build/perf-tools-next/feature/test-rust.make.output /bin/sh: line 1: rustc: command not found $ file /tmp/build/perf-tools-next/feature/test-rust.bin /tmp/build/perf-tools-next/feature/test-rust.bin: cannot open `/tmp/build/perf-tools-next/feature/test-rust.bin' (No such file or directory) $ $ perf -vv | grep RUST rust: [ OFF ] # HAVE_RUST_SUPPORT $ And after installing it: ... rust: [ on ] $ cat /tmp/build/perf-tools-next/feature/test-rust.make.output $ file /tmp/build/perf-tools-next/feature/test-rust.bin /tmp/build/perf-tools-next/feature/test-rust.bin: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=9c416edf673ee3705b97bae893a99a6fcf1ee258, for GNU/Linux 3.2.0, with debug_info, not stripped $ $ perf -vv | grep RUST rust: [ on ] # HAVE_RUST_SUPPORT $ Fixes: 6a32fa5ccd33da5d ("tools build: Add a feature test for rust compiler") Cc: Dmitrii Dolgov <9erthalion6@gmail.com> Signed-off-by: Arnaldo Carvalho de Melo commit 95080648ed52c6b97153ad989252576a3c070036 Author: David Howells Date: Mon Feb 9 14:07:05 2026 +0000 cifs: Fix the copyright banner on smb1maperror.c Fix the copyright banner on smb1maperror.c to be the same as netmisc.c. Signed-off-by: David Howells Signed-off-by: Steve French commit 561f60dfd1c10acaaf81bf523de2fe1ff39e2645 Author: Thomas Weissschuh Date: Fri Feb 6 15:11:29 2026 +0100 ARM: 9470/1: Handle BE8 vs BE32 in ARCH_CC_CAN_LINK ARM big-endian has two different binary formats. BE8 and the older BE32. They are incompatible with each other. Handle those when evaluating ARCH_CC_CAN_LINK by using the respective configuration of the kernel itself. Fixes: 3df8585afd9b ("ARM: 9469/1: Implement ARCH_HAS_CC_CAN_LINK") Signed-off-by: Thomas Weißschuh Signed-off-by: Russell King (Oracle) commit 510e7261a7bcd6232e90f0b6b9f93303bdd29f8a Author: Ankit Nautiyal Date: Fri Dec 26 10:03:59 2025 +0530 drm/i915/quirks: Fix device id for QUIRK_EDP_LIMIT_RATE_HBR2 entry Update the device ID for Dell XPS 13 7390 2-in-1 in the quirk `QUIRK_EDP_LIMIT_RATE_HBR2` entry. The previous ID (0x8a12) was incorrect; the correct ID is 0x8a52. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/5969 Fixes: 21c586d9233a ("drm/i915/dp: Add device specific quirk to limit eDP rate to HBR2") Cc: Jani Nikula Cc: Ville Syrjälä Cc: Ankit Nautiyal Cc: # v6.18+ Signed-off-by: Ankit Nautiyal Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20251226043359.2553-1-ankit.k.nautiyal@intel.com (cherry picked from commit c7c30c4093cc11ff66672471f12599a555708343) Signed-off-by: Joonas Lahtinen commit 5b115dccdc8612cd892c41354e63fd5b23d56c51 Merge: 1795dc528c13c4 c816ba1dcd931b 0923a618a78fe4 Author: Borislav Petkov (AMD) Date: Mon Feb 9 13:49:36 2026 +0100 Merge remote-tracking branches 'ras/edac-drivers', 'ras/edac-misc' and 'ras/edac-amd-atl' into edac-updates * ras/edac-drivers: EDAC/r82600: Remove this obsolete driver EDAC/i82443bxgx: Remove driver that has been marked broken since 2007 EDAC/igen6: Add more Intel Panther Lake-H SoCs support EDAC/igen6: Make masks of {MCHBAR, TOM, TOUUD, ECC_ERROR_LOG} configurable EDAC/igen6: Add two Intel Amston Lake SoCs support EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() * ras/edac-misc: EDAC/amd64: Avoid a -Wformat-security warning * ras/edac-amd-atl: RAS/AMD/ATL: Remove an unneeded semicolon Signed-off-by: Borislav Petkov (AMD) commit 084d5d44418148662365eced3e126ad1a81ee3e2 Author: Takashi Iwai Date: Mon Feb 9 13:12:11 2026 +0100 ALSA: mixer: oss: Add card disconnect checkpoints ALSA OSS mixer layer calls the kcontrol ops rather individually, and pending calls might be not always caught at disconnecting the device. For avoiding the potential UAF scenarios, add sanity checks of the card disconnection at each entry point of OSS mixer accesses. The rwsem is taken just before that check, hence the rest context should be covered by that properly. Link: https://patch.msgid.link/20260209121212.171430-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 5af56f30c4fcbade4a92f94dadfea517d1db9703 Author: Francesco Lavra Date: Mon Feb 9 10:50:01 2026 +0100 spi: tools: Add include folder to .gitignore The Makefile for the SPI tools creates an include/linux/spi folder and some symlinks inside it. After running `make -C spi/tools`, this folder shows up as untracked in the git status. Add the above folder to the .gitignore file. Fixes: f325b73dc4db ("spi: tools: move to tools buildsystem") Signed-off-by: Francesco Lavra Link: https://patch.msgid.link/20260209095001.556495-1-flavra@baylibre.com Signed-off-by: Mark Brown commit f8f774913b4b599169381073f6674e20976e5529 Author: Peter Ujfalusi Date: Mon Feb 9 14:02:39 2026 +0200 ASoC: SOF: ipc4-control: Set correct error code in refresh_bytes_control Return -EINVAL in case the scontrol contains more data than the amount of space available for it to store in sof_ipc4_refresh_bytes_control(). Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-sound/aYXvFr-LVHVJSvS7@stanley.mountain/ Fixes: 2a28b5240f2b ("ASoC: SOF: ipc4-control: Add support for generic bytes control") Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260209120239.6066-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 3a7dbc729e42b95f1a82806a11128c1926ab26d8 Author: Arnd Bergmann Date: Mon Feb 9 08:08:38 2026 +0100 ASoC: SOF: Intel: select CONFIG_SND_HDA_EXT_CORE from SND_SOC_SOF_HDA_COMMON The _hda_dsp_stream_put() function now depends on the snd_hdac_ext_stream_release() interface from SND_HDA_EXT_CORE: x86_64-linux-ld: vmlinux.o: in function `_hda_dsp_stream_put': hda-stream.c:(.text+0xfac605): undefined reference to `snd_hdac_ext_stream_release' Select this symbol the same way the other users do. Fixes: 89e1d632bb29 ("ASoC: SOF: Intel: add hda_dsp_stream_pair_get/put helpers") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260209070901.857700-1-arnd@kernel.org Signed-off-by: Mark Brown commit 1afafbaf749d8e8ec53f8e38efdc731131902b5b Author: Antoine Lassagne Date: Mon Feb 9 13:27:16 2026 +0100 firmware/dmi: Include product_family info to modalias Some platforms rely on modalias to customize configuration, the product family helps to identify the hardware. Add product_family to modalias for better utilization. This patch mimics commit e26f023e01ef ("firmware/dmi: Include product_sku info to modalias") that did the same for product_sku, and commit f97a2103f1a7 ("firmware: dmi: Move product_sku info to the end of the modalias") that fixed regressions caused by the added field not being in the end of the list. Signed-off-by: Antoine Lassagne Signed-off-by: Jean Delvare commit 305ff6b3a03c230d3c07b61457e961406d979693 Author: ethanwu Date: Thu Sep 25 18:42:06 2025 +0800 ceph: supply snapshot context in ceph_uninline_data() The ceph_uninline_data function was missing proper snapshot context handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate snapshot context, which could lead to unnecessary object clone. Reproducer: ../src/vstart.sh --new -x --localhost --bluestore // turn on cephfs inline data ./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it // allow fs_a client to take snapshot ./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a' // mount cephfs with fuse, since kernel cephfs doesn't support inline write ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/ // bump snapshot seq mkdir /mnt/mycephfs/.snap/snap1 echo "foo" > /mnt/mycephfs/test // umount and mount it again using kernel cephfs client umount /mnt/mycephfs mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf echo "bar" >> /mnt/mycephfs/test ./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000 will see this object does unnecessary clone 1000000000a.00000000 (seq:2): cloneid snaps size overlap 2 2 4 [] head - 8 but it's expected to see 10000000000.00000000 (seq:2): cloneid snaps size overlap head - 8 since there's no snapshot between these 2 writes clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't pass snap context so object is created with snap seq 0, but later data writeback is equipped with snapshot context. snap.seq(1) > object snap seq(0), so osd does object clone. This fix properly acquiring the snapshot context before performing write operations. Signed-off-by: ethanwu Reviewed-by: Viacheslav Dubeyko Tested-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit f16bd3fa74a2084ee7e16a8a2be7e7399b970907 Author: ethanwu Date: Thu Sep 25 18:42:05 2025 +0800 ceph: supply snapshot context in ceph_zero_partial_object() The ceph_zero_partial_object function was missing proper snapshot context for its OSD write operations, which could lead to data inconsistencies in snapshots. Reproducer: ../src/vstart.sh --new -x --localhost --bluestore ./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a' mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf dd if=/dev/urandom of=/mnt/mycephfs/foo bs=64K count=1 mkdir /mnt/mycephfs/.snap/snap1 md5sum /mnt/mycephfs/.snap/snap1/foo fallocate -p -o 0 -l 4096 /mnt/mycephfs/foo echo 3 > /proc/sys/vm/drop/caches md5sum /mnt/mycephfs/.snap/snap1/foo # get different md5sum!! Cc: stable@vger.kernel.org Fixes: ad7a60de882ac ("ceph: punch hole support") Signed-off-by: ethanwu Reviewed-by: Viacheslav Dubeyko Tested-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 0bce126ab7e5719ead2f9144057b83bd285b1b23 Author: Thomas Weißschuh Date: Fri Jan 9 11:08:49 2026 +0100 MIPS: Implement ARCH_HAS_CC_CAN_LINK The generic CC_CAN_LINK detection does not handle different byte orders or ABIs. This may lead to userprogs which are not actually runnable on the target kernel. Use architecture-specific logic supporting byte orders instead. Modern 64-bit toolchains default to a n32 libc, which are not supported by all kernel configurations, as MIPS32_N32 is optional. On 64-bit, test for a n32 ABI libc first and fall back to o64 and o32 if necessary. Link: https://lore.kernel.org/lkml/20260105100507-14db55e3-aa71-48bf-a6ac-33b186bd082f@linutronix.de/ Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Bogendoerfer commit e93bb4b76cfefb302534246e892c7667491cb8cc Author: Jiaxun Yang Date: Thu Feb 5 10:08:42 2026 +0000 MIPS: rb532: Fix MMIO UART resource registration Since commit 6e690d54cfa8 ("serial: 8250: fix return error code in serial8250_request_std_resource()"), registering an 8250 MMIO port without mapbase no longer works, as the resource range is derived from mapbase/mapsize. Populate mapbase and mapsize accordingly. Also drop ugly membase KSEG1 pointer and set UPF_IOREMAP instead, letting the 8250 core perform the ioremap. Fixes: 6e690d54cfa8 ("serial: 8250: fix return error code in serial8250_request_std_resource()") Cc: stable@vger.kernel.org Reported-by: Waldemar Brodkorb Link: https://lore.kernel.org/linux-mips/aX-d0ShTplHKZT33@waldemar-brodkorb.de/ Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit 30bfc2d6a1132a89a5f1c3b96c59cf3e4d076ea3 Author: Yao Zi Date: Thu Feb 5 15:56:44 2026 +0000 MIPS: Work around LLVM bug when gp is used as global register variable On MIPS, __current_thread_info is defined as global register variable locating in $gp, and is simply assigned with new address during kernel relocation. This however is broken with LLVM, which always restores $gp if it finds $gp is clobbered in any form, including when intentionally through a global register variable. This is against GCC's documentation[1], which requires a callee-saved register used as global register variable not to be restored if it's clobbered. As a result, $gp will continue to point to the unrelocated kernel after the epilog of relocate_kernel(), leading to an early crash in init_idle, [ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000000000, epc == ffffffff81afada8, ra == ffffffff81afad90 [ 0.000000] Oops[#1]: [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Tainted: G W 6.19.0-rc5-00262-gd3eeb99bbc99-dirty #188 VOLUNTARY [ 0.000000] Tainted: [W]=WARN [ 0.000000] Hardware name: loongson,loongson64v-4core-virtio [ 0.000000] $ 0 : 0000000000000000 0000000000000000 0000000000000001 0000000000000000 [ 0.000000] $ 4 : ffffffff80b80ec0 ffffffff80b53d48 0000000000000000 00000000000f4240 [ 0.000000] $ 8 : 0000000000000100 ffffffff81d82f80 ffffffff81d82f80 0000000000000001 [ 0.000000] $12 : 0000000000000000 ffffffff81776f58 00000000000005da 0000000000000002 [ 0.000000] $16 : ffffffff80b80e40 0000000000000000 ffffffff80b81614 9800000005dfbe80 [ 0.000000] $20 : 00000000540000e0 ffffffff81980000 0000000000000000 ffffffff80f81c80 [ 0.000000] $24 : 0000000000000a26 ffffffff8114fb90 [ 0.000000] $28 : ffffffff80b50000 ffffffff80b53d40 0000000000000000 ffffffff81afad90 [ 0.000000] Hi : 0000000000000000 [ 0.000000] Lo : 0000000000000000 [ 0.000000] epc : ffffffff81afada8 init_idle+0x130/0x270 [ 0.000000] ra : ffffffff81afad90 init_idle+0x118/0x270 [ 0.000000] Status: 540000e2 KX SX UX KERNEL EXL [ 0.000000] Cause : 00000008 (ExcCode 02) [ 0.000000] BadVA : 0000000000000000 [ 0.000000] PrId : 00006305 (ICT Loongson-3) [ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000) [ 0.000000] Stack : 9800000005dfbf00 ffffffff8178e950 0000000000000000 0000000000000000 [ 0.000000] 0000000000000000 ffffffff81970000 000000000000003f ffffffff810a6528 [ 0.000000] 0000000000000001 9800000005dfbe80 9800000005dfbf00 ffffffff81980000 [ 0.000000] ffffffff810a6450 ffffffff81afb6c0 0000000000000000 ffffffff810a2258 [ 0.000000] ffffffff81d82ec8 ffffffff8198d010 ffffffff81b67e80 ffffffff8197dd98 [ 0.000000] ffffffff81d81c80 ffffffff81930000 0000000000000040 0000000000000000 [ 0.000000] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 0.000000] 0000000000000000 000000000000009e ffffffff9fc01000 0000000000000000 [ 0.000000] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 0.000000] 0000000000000000 ffffffff81ae86dc ffffffff81b3c741 0000000000000002 [ 0.000000] ... [ 0.000000] Call Trace: [ 0.000000] [] init_idle+0x130/0x270 [ 0.000000] [] sched_init+0x5c8/0x6c0 [ 0.000000] [] start_kernel+0x27c/0x7a8 This bug has been reported to LLVM[2] and affects version from (at least) 18 to 21. Let's work around this by using inline assembly to assign $gp before a fix is widely available. Cc: stable@vger.kernel.org Link: https://gcc.gnu.org/onlinedocs/gcc-15.2.0/gcc/Global-Register-Variables.html # [1] Link: https://github.com/llvm/llvm-project/issues/176546 # [2] Signed-off-by: Yao Zi Acked-by: Nathan Chancellor Signed-off-by: Thomas Bogendoerfer commit 8356b4b1103b8c970648c94bab724aa30e42d869 Author: Ilya Dryomov Date: Sat Jul 12 17:11:55 2025 +0200 libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing The existing approach where ceph_x_challenge_blob is encrypted with the client's secret key and then the digest derived from the ciphertext is used for the test doesn't work with CEPH_CRYPTO_AES256KRB5 because the confounder randomizes the ciphertext: the client and the server get two different ciphertexts and therefore two different digests. msgr1 signatures are affected the same way: a digest derived from the ciphertext for the message's "sigblock" is what becomes a signature and the two sides disagree on the expected value. For CEPH_CRYPTO_AES256KRB5 (and potential future encryption schemes), switch to HMAC-SHA256 function keyed in the same way as the existing encryption. For CEPH_CRYPTO_AES, everything is preserved as is. Signed-off-by: Ilya Dryomov commit b7cc142dbafeaf6c053284ca9121b9f70b6d6d06 Author: Ilya Dryomov Date: Mon Dec 22 20:41:27 2025 +0100 libceph: add support for CEPH_CRYPTO_AES256KRB5 This is based on AES256-CTS-HMAC384-192 crypto algorithm per RFC 8009 (i.e. Kerberos 5, hence the name) with custom-defined key usage numbers. The implementation allows a given key to have/be linked to between one and three usage numbers. The existing CEPH_CRYPTO_AES remains in place and unchanged. The usage_slot parameter that needed to be added to ceph_crypt() and its wrappers is simply ignored there. Signed-off-by: Ilya Dryomov commit 6cec0b61aacce4da5125b21c718189f0dc11eb51 Author: Ilya Dryomov Date: Mon Dec 22 19:44:24 2025 +0100 libceph: introduce ceph_crypto_key_prepare() In preparation for bringing in a new encryption scheme/key type, decouple decoding or cloning the key from allocating required crypto API objects and setting them up. The rationale is that a) in some cases a shallow clone is sufficient and b) ceph_crypto_key_prepare() may grow additional parameters that would be inconvenient to provide at the point the key is originally decoded. Signed-off-by: Ilya Dryomov commit 0ee8bccf7396d50726c9c8dd3135fb64a9fe8426 Author: Ilya Dryomov Date: Sat Jul 5 11:28:21 2025 +0200 libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() - introduce the notion of a data offset for ceph_x_encrypt_offset() to allow for e.g. confounder to be prepended before the encryption header in the future. For CEPH_CRYPTO_AES, the data offset is 0 (i.e. nothing is prepended). - adjust ceph_x_encrypt_buflen() accordingly and make it account for PKCS#7 padding that is used by CEPH_CRYPTO_AES precisely instead of just always adding 16. Signed-off-by: Ilya Dryomov commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf Author: Ilya Dryomov Date: Fri Jul 4 16:30:50 2025 +0200 libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn't provide much value since a smaller than needed key is just as invalid as no key -- this has to be handled elsewhere anyway. Signed-off-by: Ilya Dryomov commit c1f221c1be6f641506d647297062ce5d21d03867 Author: Konstantin Komarov Date: Mon Feb 9 10:51:38 2026 +0100 fs/ntfs3: add fall-through between switch labels Add fall-through to fix the warning in ntfs_fs_parse_param(). Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602041402.uojBz5QY-lkp@intel.com/ Signed-off-by: Konstantin Komarov commit ecfcae7885f105b29898ff71d3cb70abd56ef96e Author: Dmitry Baryshkov Date: Sat Feb 7 12:28:52 2026 +0200 power: sequencing: qcom-wcn: fix error path for VDDIO handling In case getting VDDIO regulator returned an error, WCN power sequencing driver passes ret to dev_err_probe() as the error code, however it is known that ret is 0 at this point. Pass PTR_ERR(ctx->vddio) instead. Fixes: 0eb85f468ef5 ("power: sequencing: qcom-wcn: add support for WCN39xx") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/aYXvQxKqmjP_sdCd@stanley.mountain/ Signed-off-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260207-fix-wcn39xx-v1-1-df0606108ce2@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 4efa91a28576054aae0e6dad9cba8fed8293aef8 Author: Tetsuo Handa Date: Fri Jan 30 19:42:47 2026 +0900 xfrm: always flush state and policy upon NETDEV_UNREGISTER event syzbot is reporting that "struct xfrm_state" refcount is leaking. unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2 ref_tracker: netdev@ffff888052f24618 has 1/1 users at __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline] netdev_tracker_alloc include/linux/netdevice.h:4412 [inline] xfrm_dev_state_add+0x3a5/0x1080 net/xfrm/xfrm_device.c:316 xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline] xfrm_add_sa+0x34ff/0x5fa0 net/xfrm/xfrm_user.c:1022 xfrm_user_rcv_msg+0x58e/0xc00 net/xfrm/xfrm_user.c:3507 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2550 xfrm_netlink_rcv+0x71/0x90 net/xfrm/xfrm_user.c:3529 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa5d/0xc30 net/socket.c:2592 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2646 __sys_sendmsg+0x16d/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This is because commit d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") implemented xfrm_dev_unregister() as no-op despite xfrm_dev_state_add() from xfrm_state_construct() acquires a reference to "struct net_device". I guess that that commit expected that NETDEV_DOWN event is fired before NETDEV_UNREGISTER event fires, and also assumed that xfrm_dev_state_add() is called only if (dev->features & NETIF_F_HW_ESP) != 0. Sabrina Dubroca identified steps to reproduce the same symptoms as below. echo 0 > /sys/bus/netdevsim/new_device dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/) ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \ spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 \ offload crypto dev $dev dir out ethtool -K $dev esp-hw-offload off echo 0 > /sys/bus/netdevsim/del_device Like these steps indicate, the NETIF_F_HW_ESP bit can be cleared after xfrm_dev_state_add() acquired a reference to "struct net_device". Also, xfrm_dev_state_add() does not check for the NETIF_F_HW_ESP bit when acquiring a reference to "struct net_device". Commit 03891f820c21 ("xfrm: handle NETDEV_UNREGISTER for xfrm device") re-introduced the NETDEV_UNREGISTER event to xfrm_dev_event(), but that commit for unknown reason chose to share xfrm_dev_down() between the NETDEV_DOWN event and the NETDEV_UNREGISTER event. I guess that that commit missed the behavior in the previous paragraph. Therefore, we need to re-introduce xfrm_dev_unregister() in order to release the reference to "struct net_device" by unconditionally flushing state and policy. Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Cc: Sabrina Dubroca Signed-off-by: Tetsuo Handa Signed-off-by: Steffen Klassert commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 Author: Lianqin Hu Date: Mon Feb 9 08:38:29 2026 +0000 ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio Setting up the interface when suspended/resumeing fail on this card. Adding a reset and delay quirk will eliminate this problem. usb 1-1: New USB device found, idVendor=001f, idProduct=0b21 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: AB13X USB Audio usb 1-1: Manufacturer: Generic usb 1-1: SerialNumber: 20210926172016 Signed-off-by: Lianqin Hu Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com Signed-off-by: Takashi Iwai commit d6c58f4eb3d00a695f5a610ea780cad322ec714e Author: Yishai Hadas Date: Sun Feb 1 16:34:06 2026 +0200 RDMA/mlx5: Implement DMABUF export ops Enable p2pdma on the mlx5 PCI device to allow DMABUF-based peer-to-peer DMA mappings. Add implementation of the mmap_get_pfns and pgoff_to_mmap_entry device operations required for DMABUF support in the mlx5 RDMA driver. The pgoff_to_mmap_entry operation converts a page offset to the corresponding rdma_user_mmap_entry by extracting the command and index from the offset and looking it up in the ucontext's mmap_xa. The mmap_get_pfns operation retrieves the physical address and length from the mmap entry and obtains the p2pdma provider for the underlying PCI device, which is needed for peer-to-peer DMA operations with DMABUFs. Signed-off-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260201-dmabuf-export-v3-3-da238b614fe3@nvidia.com Signed-off-by: Leon Romanovsky commit 0ac6f4056c4a257f4b230b910e3e6fee6c6fc9b9 Author: Yishai Hadas Date: Sun Feb 1 16:34:05 2026 +0200 RDMA/uverbs: Add DMABUF object type and operations Expose DMABUF functionality to userspace through the uverbs interface, enabling InfiniBand/RDMA devices to export PCI based memory regions (e.g. device memory) as DMABUF file descriptors. This allows zero-copy sharing of RDMA memory with other subsystems that support the dma-buf framework. A new UVERBS_OBJECT_DMABUF object type and allocation method were introduced. During allocation, uverbs invokes the driver to supply the rdma_user_mmap_entry associated with the given page offset (pgoff). Based on the returned rdma_user_mmap_entry, uverbs requests the driver to provide the corresponding physical-memory details as well as the driver’s PCI provider information. Using this information, dma_buf_export() is called; if it succeeds, uobj->object is set to the underlying file pointer returned by the dma-buf framework. The file descriptor number follows the standard uverbs allocation flow, but the file pointer comes from the dma-buf subsystem, including its own fops and private data. When an mmap entry is removed, uverbs iterates over its associated DMABUFs, marks them as revoked, and calls dma_buf_move_notify() so that their importers are notified. The same procedure applies during the disassociate flow; final cleanup occurs when the application closes the file. Signed-off-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260201-dmabuf-export-v3-2-da238b614fe3@nvidia.com Signed-off-by: Leon Romanovsky commit 9ad95a0f2b75a788325249f341694e0343facf7b Author: Yishai Hadas Date: Sun Feb 1 16:34:04 2026 +0200 RDMA/uverbs: Support external FD uobjects Add support for uobjects that wrap externally allocated file descriptors (FDs). In this mode, the FD number still follows the standard uverbs allocation flow, but the file pointer is allocated externally and has its own fops and private data. As a result, alloc_begin_fd_uobject() must handle cases where fd_type->fops is NULL, and both alloc_commit_fd_uobject() and alloc_abort_fd_uobject() must account for whether filp->private_data exists, since it is populated outside the standard uverbs flow. Signed-off-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260201-dmabuf-export-v3-1-da238b614fe3@nvidia.com Signed-off-by: Leon Romanovsky commit 06fddc7a1961241309ab9e18324514032b1e4763 Merge: 14ab3da122bd18 b703b31ea8cd22 Author: Leon Romanovsky Date: Sun Feb 8 23:47:13 2026 -0500 Merge tag 'common_phys_vec_via_vfio' into HEAD * Reuse common phys_vec, phase out dma_buf_phys_vec Signed-off-by: Alex Williamson * tag 'common_phys_vec_via_vfio': types: reuse common phys_vec type instead of DMABUF open‑coded variant types: move phys_vec definition to common header nvme-pci: Use size_t for length fields to handle larger sizes commit cc40f19a30144b50e7fa648578c15d92176a146f Author: Stefan Metzmacher Date: Tue Feb 3 16:20:12 2026 +0100 smb: common: add header guards to fs/smb/common/smb2status.h This will allow it to be included multiple times without problems, that's needed for the smbdirect move to common code. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b4ae8266a744927cd06f21326e169d2289e30434 Author: Gustavo A. R. Silva Date: Mon Nov 10 20:48:55 2025 +0900 smb: client: Avoid a dozen -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration to the end of the corresponding structure. Notice that struct smb2_file_all_info is a flexible structure, this is a structure that contains a flexible-array member. Fix the following warnings: 12 fs/smb/client/cached_dir.h:51:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Signed-off-by: Steve French commit fbcdc61e7846ca0a000f88910ea53a7bbaa12a73 Author: Huiwen He Date: Wed Jan 21 19:49:12 2026 +0800 smb/client: remove useless comment in mapping_table_ERRSRV These array elements have already been defined. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit be9fc9033a0a57143583d4277fd4f3fc6ba4905e Author: Huiwen He Date: Wed Jan 21 19:49:11 2026 +0800 smb/client: remove some literal NT error codes from ntstatus_to_dos_map When an NT error code is not in ntstatus_to_dos_map, ntstatus_to_dos() will return the default ERRHRD and ERRGENERAL. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 199e7a1a2ed920cde204ba05cbe1a3483184b5ed Author: Huiwen He Date: Wed Jan 21 19:49:10 2026 +0800 smb/client: add NT_STATUS_VOLUME_NOT_UPGRADED See MS-ERREf 2.3.1 STATUS_VOLUME_NOT_UPGRADED. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 0bf7e53fec6118552ab3fb43dfc76b0e65be85fe Author: Huiwen He Date: Wed Jan 21 19:49:09 2026 +0800 smb/client: add NT_STATUS_NO_USER_KEYS See MS-ERREf 2.3.1 STATUS_NO_USER_KEYS. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit ded739a08228385f48cbbffdfc965888a608c63e Author: Huiwen He Date: Wed Jan 21 19:49:08 2026 +0800 smb/client: add NT_STATUS_WRONG_EFS See MS-ERREf 2.3.1 STATUS_WRONG_EFS. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 3988b5675296f2e6b062fa27600ed6417cb80349 Author: Huiwen He Date: Wed Jan 21 19:49:07 2026 +0800 smb/client: add NT_STATUS_NO_EFS See MS-ERREf 2.3.1 STATUS_NO_EFS. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 2ef4f6b46f3c6b10cbe2eac24fcac217e18b88ae Author: Huiwen He Date: Wed Jan 21 19:49:06 2026 +0800 smb/client: add NT_STATUS_NO_RECOVERY_POLICY See MS-ERREf 2.3.1 STATUS_NO_RECOVERY_POLICY. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 47b84c745ba0640ebf805f241d9b5f530c177f99 Author: Huiwen He Date: Wed Jan 21 19:49:05 2026 +0800 smb/client: add NT_STATUS_RANGE_NOT_FOUND See MS-ERREf 2.3.1 STATUS_RANGE_NOT_FOUND. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit fbf88e79c53ea255bf5e01d684c3d3e53a7bd9b3 Author: Huiwen He Date: Wed Jan 21 19:49:04 2026 +0800 smb/client: add NT_STATUS_DECRYPTION_FAILED See MS-ERREf 2.3.1 STATUS_DECRYPTION_FAILED. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 2ed0cdab5fccf5ecadb2b23baa8525e8aa97e9b6 Author: Huiwen He Date: Wed Jan 21 19:49:03 2026 +0800 smb/client: add NT_STATUS_ENCRYPTION_FAILED See MS-ERREf 2.3.1 STATUS_ENCRYPTION_FAILED. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 096be720249314e41f91a649b9fb500e0c6dc026 Author: Huiwen He Date: Wed Jan 21 19:49:02 2026 +0800 smb/client: add NT_STATUS_DIRECTORY_IS_A_REPARSE_POINT See MS-ERREf 2.3.1 STATUS_DIRECTORY_IS_A_REPARSE_POINT. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 7982ddb7af9b44149226df2a89aa22c5f92583f3 Author: Huiwen He Date: Wed Jan 21 19:49:01 2026 +0800 smb/client: add NT_STATUS_VOLUME_DISMOUNTED See MS-ERREf 2.3.1 STATUS_VOLUME_DISMOUNTED. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 563318fa6dccb0dcbaa7bb36d0e30a3e67b61b68 Author: Huiwen He Date: Wed Jan 21 19:49:00 2026 +0800 smb/client: add NT_STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT See MS-ERREf 2.3.1 STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 29aaf48e24b768fa3b3c400391ee113078206e6f Author: Huiwen He Date: Wed Jan 21 19:48:59 2026 +0800 smb/client: add NT_STATUS_VARIABLE_NOT_FOUND See MS-ERREf 2.3.1 STATUS_VARIABLE_NOT_FOUND. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit ac635d68bac8a25a4b65670add8d50ec0b6cdf33 Author: Huiwen He Date: Wed Jan 21 19:48:58 2026 +0800 smb/client: rename ERRinvlevel to ERRunknownlevel See MS-CIFS 2.2.2.4 ERRunknownlevel. Keep the name consistent with the documentation. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit cd55c6e31189c3a8436bb073c54668da08ba9e54 Author: Huiwen He Date: Wed Jan 21 19:48:57 2026 +0800 smb/client: add NT_STATUS_OS2_INVALID_LEVEL See MS-CIFS 2.2.2.4 STATUS_OS2_INVALID_LEVEL. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit b0a22915942f67a04b980fd96114dc0f65879d6a Author: Huiwen He Date: Wed Jan 21 19:48:56 2026 +0800 smb/client: map NT_STATUS_INVALID_INFO_CLASS to ERRbadpipe See MS-CIFS 2.2.2.4 STATUS_INVALID_INFO_CLASS. Signed-off-by: Huiwen He Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 480afcb19b61385dfe64840d87c355293a5fa698 Author: ChenXiaoSong Date: Sun Jan 18 17:13:13 2026 +0800 smb/client: introduce KUnit test to check search result of smb2_error_map_table The KUnit test are executed when cifs.ko is loaded. Just like `fs/ext4/mballoc.c` includes `fs/ext4/mballoc-test.c`. `smb2maperror.c` also includes `smb2maperror_test.c`, allowing KUnit tests to access any functions and variables in `smb2maperror.c`. The maperror_test_check_search() checks whether all elements can be correctly found in the array. Suggested-by: David Howells Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 75563adbb91d9d199b33f8b9a2fe4e9cafea6a69 Author: ChenXiaoSong Date: Tue Dec 23 17:24:40 2025 +0800 smb/client: use bsearch() to find target in smb2_error_map_table The smb2_error_map_table array currently has 1740 elements. When searching for the last element, the original loop-based search method requires 1740 comparisons, while binary search algorithm requires only 10 comparisons. Suggested-by: David Howells Signed-off-by: ChenXiaoSong Reviewed-by: David Howells Link: https://lore.kernel.org/linux-cifs/20260106071507.1420900-5-chenxiaosong.chenxiaosong@linux.dev/ Signed-off-by: David Howells Signed-off-by: Steve French commit 453382f15b0e9b74fc83d364ffa68fa5e4806485 Author: ChenXiaoSong Date: Wed Dec 24 09:33:28 2025 +0800 smb/client: check whether smb2_error_map_table is sorted in ascending order Although the array is sorted at build time, verify the ordering again when cifs.ko is loaded to avoid potential regressions introduced by future script changes. Suggested-by: David Howells Signed-off-by: ChenXiaoSong Reviewed-by: David Howells Link: https://lore.kernel.org/linux-cifs/20260106071507.1420900-4-chenxiaosong.chenxiaosong@linux.dev/ Signed-off-by: David Howells Signed-off-by: Steve French commit c527e13a7a6628176655d70ff166f0f594a77984 Author: David Howells Date: Tue Dec 23 00:05:34 2025 +0000 cifs: Autogenerate SMB2 error mapping table Autogenerate the SMB2 status to error code mapping table, from the smb2status.h common header, sorting it by NT status code so that it can be searched by binary chopping. This also reduces the number of places this list is duplicated in the source. Signed-off-by: David Howells cc: Steve French cc: ChenXiaoSong cc: linux-cifs@vger.kernel.org Signed-off-by: ChenXiaoSong Reviewed-by: David Howells Link: https://lore.kernel.org/linux-cifs/20260106071507.1420900-3-chenxiaosong.chenxiaosong@linux.dev/ Signed-off-by: Steve French commit 164cacd0ba380604253b96dc312c85366147e3f7 Author: Stefan Metzmacher Date: Thu Feb 5 17:14:15 2026 +0100 smb: server: correct value for smb_direct_max_fragmented_recv_size We should make it clear that we use this strange value instead of hiding it in same code flow. Note this value is mainly ignored currently, as we do the calculation again with the negotiated max_recv_size in smb_direct_prepare(). So this is only a cosmetic change in order to avoid confusion. In future we may change the logic and adjust the number of recv buffers instead of the max_fragmented_recv_size. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 4a93d1ee2d0206970b6eb13fbffe07938cd95948 Author: Stefan Metzmacher Date: Thu Feb 5 17:14:14 2026 +0100 smb: client: correct value for smbd_max_fragmented_recv_size When we download a file without rdma offload or get a large directly enumeration from the server, the server might want to send up to smbd_max_fragmented_recv_size bytes, but if it is too large all our recv buffers might already be moved to the recv_io.reassembly.list and we're no longer able to grant recv credits. The maximum fragmented upper-layer payload receive size supported Assume max_payload_per_credit is smbd_max_receive_size - 24 = 1340 The maximum number would be smbd_receive_credit_max * max_payload_per_credit 1340 * 255 = 341700 (0x536C4) The minimum value from the spec is 131072 (0x20000) For now we use the logic we used in ksmbd before: (1364 * 255) / 2 = 173910 (0x2A756) Fixes: 03bee01d6215 ("CIFS: SMBD: Add SMB Direct protocol initial values and constants") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 77ffbcac4e569566d0092d5f22627dfc0896b553 Author: Henrique Carvalho Date: Wed Feb 4 20:06:43 2026 -0300 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter. Replace free_transport() with ksmbd_tcp_disconnect(). Fixes: 0d0d4680db22e ("ksmbd: add max connections parameter") Cc: stable@vger.kernel.org Signed-off-by: Henrique Carvalho Acked-by: Namjae Jeon Signed-off-by: Steve French commit b38f99c1217ae04753340f0fdcd8f35bf56841dc Author: Bahubali B Gumaji Date: Thu Feb 5 09:08:35 2026 +0900 ksmbd: add procfs interface for runtime monitoring and statistics This patch introduces a /proc filesystem interface to ksmbd, providing visibility into the internal state of the SMB server. This allows administrators and developers to monitor active connections, user sessions, and opened files in real-time without relying on external tools or heavy debugging. Key changes include: - Connection Monitoring (/proc/fs/ksmbd/clients): Displays a list of active network connections, including client IP addresses, SMB dialects, credits, and last active timestamps. - Session Management (/proc/fs/ksmbd/sessions/): Adds a global sessions file to list all authenticated users and their session IDs. - Creates individual session entries (e.g., /proc/fs/ksmbd/sessions/) detailing capabilities (DFS, Multi-channel, etc.), signing/encryption algorithms, and connected tree shares. - File Tracking (/proc/fs/ksmbd/files): Shows all currently opened files across the server, including tree IDs, process IDs (PID), access modes (daccess/saccess), and oplock/lease states. - Statistics & Counters: Implements internal counters for global server metrics, such as the number of tree connections, total sessions, and processed read/write bytes. Signed-off-by: Hyunchul Lee Signed-off-by: Bahubali B Gumaji Signed-off-by: Sang-Soo Lee Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 010eb01ce23b34b50531448b0da391c7f05a72af Author: Namjae Jeon Date: Sat Jan 24 10:55:46 2026 +0900 ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths The problem occurs when a signed request fails smb2 signature verification check. In __process_request(), if check_sign_req() returns an error, set_smb2_rsp_status(work, STATUS_ACCESS_DENIED) is called. set_smb2_rsp_status() set work->next_smb2_rcv_hdr_off as zero. By resetting next_smb2_rcv_hdr_off to zero, the pointer to the next command in the chain is lost. Consequently, is_chained_smb2_message() continues to point to the same request header instead of advancing. If the header's NextCommand field is non-zero, the function returns true, causing __handle_ksmbd_work() to repeatedly process the same failed request in an infinite loop. This results in the kernel log being flooded with "bad smb2 signature" messages and high CPU usage. This patch fixes the issue by changing the return value from SERVER_HANDLER_CONTINUE to SERVER_HANDLER_ABORT. This ensures that the processing loop terminates immediately rather than attempting to continue from an invalidated offset. Reported-by: tianshuo han Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit c4f1fe47b106e9200cbb1b8951bd75f036d53bd3 Author: Steven Rostedt Date: Sun Feb 8 13:38:35 2026 -0500 tracing: Better separate SNAPSHOT and MAX_TRACE options The latency tracers (scheduler, irqsoff, etc) were created when tracing was first added. These tracers required a "snapshot" buffer that was the same size as the ring buffer being written to. When a new max latency was hit, the main ring buffer would swap with the snapshot buffer so that the trace leading up to the latency would be saved in the snapshot buffer (The snapshot buffer is never written to directly and the data within it can be viewed without fear of being overwritten). Later, a new feature was added to allow snapshots to be taken by user space or even event triggers. This created a "snapshot" file that allowed users to trigger a snapshot from user space to save the current trace. The config for this new feature (CONFIG_TRACER_SNAPSHOT) would select the latency tracer config (CONFIG_TRACER_MAX_LATENCY) as it would need all the functionality from it as it already existed. But this was incorrect. As the snapshot feature is really what the latency tracers need and not the other way around. Have CONFIG_TRACER_MAX_TRACE select CONFIG_TRACER_SNAPSHOT where the tracers that needs the max latency buffer selects the TRACE_MAX_TRACE which will then select TRACER_SNAPSHOT. Also, go through trace.c and trace.h and make the code that only needs the TRACER_MAX_TRACE protected by that and the code that always requires the snapshot to be protected by TRACER_SNAPSHOT. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208183856.767870992@kernel.org Signed-off-by: Steven Rostedt (Google) commit e4c1a09afbe2f02fc66b5ccbc96aa3a7109f9b79 Author: Steven Rostedt Date: Sun Feb 8 13:38:34 2026 -0500 tracing: Add tracer_uses_snapshot() helper to remove #ifdefs Instead of having #ifdef CONFIG_TRACER_MAX_TRACE around every access to the struct tracer's use_max_tr field, add a helper function for that access and if CONFIG_TRACER_MAX_TRACE is not configured it just returns false. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208183856.599390238@kernel.org Signed-off-by: Steven Rostedt (Google) commit 694b3f6fe0b6c86ff75e94302708f5a718027297 Author: Steven Rostedt Date: Sun Feb 8 13:38:33 2026 -0500 tracing: Rename trace_array field max_buffer to snapshot_buffer When tracing was first added, there were latency tracers that would take a snapshot of the current trace when a new max latency was hit. This snapshot buffer was called "max_buffer". Since then, a snapshot feature was added that allowed user space or event triggers to trigger a snapshot of the current buffer using the same max_buffer of the trace_array. As this snapshot buffer now has a more generic use case, calling it "max_buffer" is confusing. Rename it to snapshot_buffer. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208183856.428446729@kernel.org Signed-off-by: Steven Rostedt (Google) commit 98021e37d694ddc48f45b690045df013054fd69c Author: Steven Rostedt Date: Sat Feb 7 22:24:27 2026 -0500 tracing: Move pid filtering into trace_pid.c The trace.c file was a dumping ground for most tracing code. Start organizing it better by moving various functions out into their own files. Move the PID filtering functions from trace.c into its own trace_pid.c file. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032450.998330662@kernel.org Signed-off-by: Steven Rostedt (Google) commit 27931ee8f45415db3a10586f9d5b6f77ef7d7d84 Author: Steven Rostedt Date: Sat Feb 7 22:24:26 2026 -0500 tracing: Move trace_printk functions out of trace.c and into trace_printk.c The file trace.c has become a catchall for most things tracing. Start making it smaller by breaking out various aspects into their own files. Move the functions associated to the trace_printk operations out of trace.c and into trace_printk.c. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032450.828744197@kernel.org Signed-off-by: Steven Rostedt (Google) commit af1eea12ad24f62d65714c5318841894278a7aaa Author: Steven Rostedt Date: Sat Feb 7 22:24:25 2026 -0500 tracing: Use system_state in trace_printk_init_buffers() The function trace_printk_init_buffers() is used to expand tha trace_printk buffers when trace_printk() is used within the kernel or in modules. On kernel boot up, it holds off from starting the sched switch cmdline recorder, but will start it immediately when it is added by a module. Currently it uses a trick to see if the global_trace buffer has been allocated or not to know if it was called by module load or not. But this is more of a hack, and can not be used when this code is moved out of trace.c. Instead simply look at the system_state and if it is running then it is know that it could only be called by module load. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032450.660237094@kernel.org Signed-off-by: Steven Rostedt (Google) commit f377912b3dd71312cbf9eaf2c60263cb6e7cba59 Author: Steven Rostedt Date: Sat Feb 7 22:24:24 2026 -0500 tracing: Have trace_printk functions use flags instead of using global_trace The trace.c file has become a dumping ground for all tracing code and has become quite large. In order to move the trace_printk functions out of it these functions can not access global_trace directly, as that is something that needs to stay static in trace.c. Instead of testing the trace_array tr pointer to &global_trace, test the tr->flags to see if TRACE_ARRAY_FL_GLOBAL set. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032450.491116245@kernel.org Signed-off-by: Steven Rostedt (Google) commit 93c88d06accdeceee4fbd243b084d3749bcd96d7 Author: Steven Rostedt Date: Sat Feb 7 22:24:23 2026 -0500 tracing: Make tracing_update_buffers() take NULL for global_trace The trace.c file has become a dumping ground for all tracing code and has become quite large. In order to move the trace_printk functions out of it these functions can not access global_trace directly, as that is something that needs to stay static in trace.c. Have tracing_update_buffers() take NULL for its trace_array to denote it should work on the global_trace top level trace_array allows that function to be used outside of trace.c and still update the global_trace trace_array. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032450.318864210@kernel.org Signed-off-by: Steven Rostedt (Google) commit 1c53d781d42541adc5ba76b4f843a3ff382e01fb Author: Steven Rostedt Date: Sat Feb 7 22:24:22 2026 -0500 tracing: Make printk_trace global for tracing system The printk_trace is used to determine which trace_array trace_printk() writes to. By making it a global variable among the tracing subsystem it will allow the trace_printk functions to be moved out of trace.c and still have direct access to that variable. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032450.144525891@kernel.org Signed-off-by: Steven Rostedt (Google) commit 3e6c8f80e5ddd0644e509547c61366a2c09117b0 Author: Steven Rostedt Date: Sat Feb 7 22:24:21 2026 -0500 tracing: Move ftrace_trace_stack() out of trace.c and into trace.h The file trace.c has become a catchall for most things tracing. Start making it smaller by breaking out various aspects into their own files. Make ftrace_trace_stack() into a static inline that tests if stack tracing is enabled and if so to call __ftrace_trace_stack() to do the stack trace. This keeps the test inlined in the fast paths and only does the function call if stack tracing is enabled. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032449.974218132@kernel.org Signed-off-by: Steven Rostedt (Google) commit 0e730bc067e7a790d61344dbf6d9dfdce7f99ea3 Author: Steven Rostedt Date: Sat Feb 7 22:24:20 2026 -0500 tracing: Move __trace_buffer_{un}lock_*() functions to trace.h The file trace.c has become a catchall for most things tracing. Start making it smaller by breaking out various aspects into their own files. Move the __always_inline functions __trace_buffer_lock_reserve(), __trace_buffer_unlock_commit() and trace_event_setup() into trace.h. The trace.c file will be split up and these functions will be used in more than one of these files. As they are already __always_inline they can easily be moved into the trace.h header file. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032449.813550600@kernel.org Signed-off-by: Steven Rostedt (Google) commit a4f77ffc8eb6247ad00c53d297a145e47594ce76 Author: Steven Rostedt Date: Sat Feb 7 22:24:19 2026 -0500 tracing: Make tracing_selftest_running global to the tracing subsystem The file trace.c has become a catchall for most things tracing. Start making it smaller by breaking out various aspects into their own files. Make the variable tracing_selftest_running global so that it can be used by other files in the tracing subsystem and trace.c can be split up. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032449.648932796@kernel.org Signed-off-by: Steven Rostedt (Google) commit 64dee86ad7de3d59bae041e0d8f80ef89ddc4cf6 Author: Steven Rostedt Date: Sat Feb 7 22:24:18 2026 -0500 tracing: Make tracing_disabled global for tracing system The tracing_disabled variable is set to one on boot up to prevent some parts of tracing to access the tracing infrastructure before it is set up. It also can be set after boot if an anomaly is discovered. It is currently a static variable in trace.c and can be accessed via a function call trace_is_disabled(). There's really no reason to use a function call as the tracing subsystem should be able to access it directly. By making the variable accessed directly, code can be moved out of trace.c without adding overhead of a function call to see if tracing is disabled or not. Make tracing_disabled global and remove the tracing_is_disabled() helper function. Also add some "unlikely()"s around tracing_disabled where it's checked in hot paths. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260208032449.483690153@kernel.org Signed-off-by: Steven Rostedt (Google) commit ba73713da50e5c24499ca8941171593466ea34f7 Author: Steven Rostedt Date: Sat Feb 7 19:11:01 2026 -0500 tracing: Clean up use of trace_create_maxlat_file() In trace.c, the function trace_create_maxlat_file() is defined behind the #ifdef CONFIG_TRACER_MAX_TRACE block. The #else part defines it as: #define trace_create_maxlat_file(tr, d_tracer) \ trace_create_file("tracing_max_latency", TRACE_MODE_WRITE, \ d_tracer, tr, &tracing_max_lat_fops) But the one place that it it used has: #ifdef CONFIG_TRACER_MAX_TRACE trace_create_maxlat_file(tr, d_tracer); #endif Which is pointless and also wrong! It only gets created when both CONFIG_TRACE_MAX_TRACE and CONFIG_FS_NOTIFY is defined, but the file itself should not be dependent on CONFIG_FS_NOTIFY. Always create that file when TRACE_MAX_TRACE is defined regardless if FS_NOTIFY is or is not. Cc: Mathieu Desnoyers Acked-by: Masami Hiramatsu (Google) Link: https://patch.msgid.link/20260207191101.0e014abd@robin Signed-off-by: Steven Rostedt (Google) commit 326669faf3cbfda31b2203f0a66aa87812062e5f Author: Steven Rostedt Date: Fri Feb 6 14:37:52 2026 -0500 tracing: Move tracing_set_filter_buffering() into trace_events_hist.c The function tracing_set_filter_buffering() is only used in trace_events_hist.c. Move it to that file and make it static. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20260206195936.617080218@kernel.org Signed-off-by: Steven Rostedt (Google) commit c8b039c3e3763281c867489a926c52716337da59 Author: Steven Rostedt Date: Fri Feb 6 10:13:51 2026 -0500 tracing: Have all triggers expect a file parameter When the triggers were first created, they may not have had a file parameter passed to them and things needed to be done generically. But today, all triggers have a file parameter passed to them. Remove the generic code and add a "if (WARN_ON_ONCE(!file))" to each trigger. Cc: Mathieu Desnoyers Acked-by: Masami Hiramatsu (Google) Reviewed-by: Tom Zanussi Link: https://patch.msgid.link/20260206101351.609d8906@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit 6711069dd72fcbafe010fb16be504364e5ced190 Author: Ryota Sakamoto Date: Fri Jan 23 00:40:41 2026 +0900 lib/tests: extend KUnit test for bitops with more cases Extend a KUnit test suite for the bitops API to cover more APIs from include/asm-generic/bitops/instrumented-atomic.h. - change_bit() - test_and_set_bit() - test_and_clear_bit() - test_and_change_bit() Verified on x86_64, i386, and arm64 architectures. Sample KUnit output: KTAP version 1 # Subtest: test_change_bit ok 1 BITOPS_4 ok 2 BITOPS_7 ok 3 BITOPS_11 ok 4 BITOPS_31 ok 5 BITOPS_88 # test_change_bit: pass:5 fail:0 skip:0 total:5 ok 2 test_change_bit KTAP version 1 # Subtest: test_test_and_set_bit_test_and_clear_bit ok 1 BITOPS_4 ok 2 BITOPS_7 ok 3 BITOPS_11 ok 4 BITOPS_31 ok 5 BITOPS_88 # test_test_and_set_bit_test_and_clear_bit: pass:5 fail:0 skip:0 total:5 ok 3 test_test_and_set_bit_test_and_clear_bit KTAP version 1 # Subtest: test_test_and_change_bit ok 1 BITOPS_4 ok 2 BITOPS_7 ok 3 BITOPS_11 ok 4 BITOPS_31 ok 5 BITOPS_88 # test_test_and_change_bit: pass:5 fail:0 skip:0 total:5 ok 4 test_test_and_change_bit Signed-off-by: Ryota Sakamoto Signed-off-by: Yury Norov commit 9d6f6764939f9594d2de24ab3b2701d6ee592c0a Author: Andy Shevchenko Date: Thu Jan 22 11:31:08 2026 +0100 bitops: Add more files to the MAINTAINERS It seems we have at least one more file to be added to the MAINTAINERS that corresponds to bit operations. Signed-off-by: Andy Shevchenko Signed-off-by: Yury Norov commit 92010ab6dbacc0e0f3566d92a84ff00a939e7fd4 Author: Lee Yongjun Date: Tue Jan 20 22:18:27 2026 +0900 lib/find_bit: fix uninitialized variable use in FIND_NTH_BIT In the FIND_NTH_BIT macro, if the 'size' parameter is 0, both the loop conditions and the modulo condition are not met. Consequently, the 'tmp' variable remains uninitialized before being used in the 'found' label. This results in the following smatch errors: lib/find_bit.c:164 __find_nth_bit() error: uninitialized symbol 'tmp'. lib/find_bit.c:171 __find_nth_and_bit() error: uninitialized symbol 'tmp'. lib/find_bit.c:178 __find_nth_andnot_bit() error: uninitialized symbol 'tmp'. lib/find_bit.c:187 __find_nth_and_andnot_bit() error: uninitialized symbol 'tmp'. Initialize 'tmp' to 0 to ensure that fns() operates on a zeroed value (no bits set) when size is 0, preventing the use of garbage values. [Yury: size == 0 is generally a sign of error on client side, and in this case, any returned value is OK because the returned value would be greater than 'size'. Applying the patch to reduce the checker noise.] Signed-off-by: Lee Yongjun Signed-off-by: Yury Norov commit 4101b3b571701cdf1081b2f96124b1daaeaebbf1 Author: Ryota Sakamoto Date: Sun Jan 11 02:38:07 2026 +0900 lib/tests: add KUnit test for bitops Add a KUnit test suite for the bitops API. The existing 'lib/test_bitops.c' is preserved as-is because it contains ad-hoc micro-benchmarks 'test_fns' and is intended to ensure no compiler warnings from C=1 sparse checker or -Wextra compilations. Introduce 'lib/tests/bitops_kunit.c' for functional regression testing. It ports the test logic and data patterns from 'lib/test_bitops.c' to KUnit, verifying correct behavior across various input patterns and architecture-specific edge cases using isolated stack-allocated bitmaps. The following test logic has been ported from test_bitops_startup() in lib/test_bitops.c: - set_bit() / clear_bit() / find_first_bit() validation -> test_set_bit_clear_bit() - get_count_order() validation -> test_get_count_order() - get_count_order_long() validation -> test_get_count_order_long() Also improve the find_first_bit() test to check the full bitmap length (BITOPS_LENGTH) instead of omitting the last bit, ensuring the bitmap is completely empty after cleanup. Verified on x86_64, i386, and arm64 architectures. Sample KUnit output: KTAP version 1 # Subtest: bitops # module: bitops_kunit 1..3 KTAP version 1 # Subtest: test_set_bit_clear_bit ok 1 BITOPS_4 ok 2 BITOPS_7 ok 3 BITOPS_11 ok 4 BITOPS_31 ok 5 BITOPS_88 # test_set_bit_clear_bit: pass:5 fail:0 skip:0 total:5 ok 1 test_set_bit_clear_bit KTAP version 1 # Subtest: test_get_count_order ok 1 0x00000003 ok 2 0x00000004 ok 3 0x00001fff ok 4 0x00002000 ok 5 0x50000000 ok 6 0x80000000 ok 7 0x80003000 # test_get_count_order: pass:7 fail:0 skip:0 total:7 ok 2 test_get_count_order KTAP version 1 # Subtest: test_get_count_order_long ok 1 0x0000000300000000 ok 2 0x0000000400000000 ok 3 0x00001fff00000000 ok 4 0x0000200000000000 ok 5 0x5000000000000000 ok 6 0x8000000000000000 ok 7 0x8000300000000000 # test_get_count_order_long: pass:7 fail:0 skip:0 total:7 ok 3 test_get_count_order_long [Yury: trim Kconfig help message] CC: Jesse Brandeburg CC: Wei Yang Signed-off-by: Ryota Sakamoto Signed-off-by: Yury Norov commit 214220e7fa3aa8f7108dd8d1bf4ed6a84d3540ff Author: Stefan Metzmacher Date: Wed Jan 21 21:07:13 2026 +0100 smb: server: make use of rdma_restrict_node_type() For smbdirect it required to use different ports depending on the RDMA protocol. E.g. for iWarp 5445 is needed (as tcp port 445 already used by the raw tcp transport for SMB), while InfiniBand, RoCEv1 and RoCEv2 use port 445, as they use an independent port range (even for RoCEv2, which uses udp port 4791 itself). Currently ksmbd is not able to function correctly at all if the system has iWarp (RDMA_NODE_RNIC) interface(s) and any InfiniBand, RoCEv1 and/or RoCEv2 interface(s) at the same time. Now we do a wildcard listen on port 5445 only for iWarp devices and another wildcard listen on port 445 of any InfiniBand, RoCEv1 and/or RoCEv2 devices. The wildcard listeners also work if there is no device of the requested node_type, this is the same logic as we had before, but before we had to decide between port 5445 or 445 and now both are possible at the same time. Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-rdma@vger.kernel.org Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 07e0b72eb05319761266719ffc78ba1d58749964 Author: Stefan Metzmacher Date: Wed Jan 21 21:07:12 2026 +0100 smb: client: make use of rdma_restrict_node_type() For smbdirect it required to use different ports depending on the RDMA protocol. E.g. for iWarp 5445 is needed (as tcp port 445 already used by the raw tcp transport for SMB), while InfiniBand, RoCEv1 and RoCEv2 use port 445, as they use an independent port range (even for RoCEv2, which uses udp port 4791 itself). And cifs.ko uses 5445 with a fallback to 445, which means depending on the available interfaces, it tries 5445 in the RoCE range or may tries iWarp with 445 as a fallback. This leads to strange error messages and strange network captures. To avoid these problems they will be able to use rdma_restrict_node_type(RDMA_NODE_RNIC) before trying port 5445 and rdma_restrict_node_type(RDMA_NODE_IB_CA) before trying port 445. It means we'll get early -ENODEV early from rdma_resolve_addr() without any network traffic and timeouts. Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-rdma@vger.kernel.org Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a760e80e90f5decb5045fd925bd842697c757e3c Author: Stefan Metzmacher Date: Wed Jan 21 21:07:11 2026 +0100 RDMA/core: introduce rdma_restrict_node_type() For smbdirect it required to use different ports depending on the RDMA protocol. E.g. for iWarp 5445 is needed (as tcp port 445 already used by the raw tcp transport for SMB), while InfiniBand, RoCEv1 and RoCEv2 use port 445, as they use an independent port range (even for RoCEv2, which uses udp port 4791 itself). Currently ksmbd is not able to function correctly at all if the system has iWarp (RDMA_NODE_RNIC) interface(s) and any InfiniBand, RoCEv1 and/or RoCEv2 interface(s) at the same time. And cifs.ko uses 5445 with a fallback to 445, which means depending on the available interfaces, it tries 5445 in the RoCE range or may tries iWarp with 445 as a fallback. This leads to strange error messages and strange network captures. To avoid these problems they will be able to use rdma_restrict_node_type(RDMA_NODE_RNIC) before trying port 5445 and rdma_restrict_node_type(RDMA_NODE_IB_CA) before trying port 445. It means we'll get early -ENODEV early from rdma_resolve_addr() without any network traffic and timeouts. This is designed to be called before calling any of rdma_bind_addr(), rdma_resolve_addr() or rdma_listen(). Cc: Jason Gunthorpe Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-rdma@vger.kernel.org Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Leon Romanovsky Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit cf74fcdc43b322b6188a0750b5ee79e38be6d078 Author: Stefan Metzmacher Date: Thu Jan 22 18:17:00 2026 +0100 smb: client: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_send_batch processing we likely have requests without IB_SEND_SIGNALED, which will be destroyed in the final request that has IB_SEND_SIGNALED set. If the connection is broken all requests are signaled even without explicit IB_SEND_SIGNALED. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5b1c6149657af840a02885135c700ab42e6aa322 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:59 2026 +0100 smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() The server has similar logic and it makes sure that request->wr is used instead of a stack struct ib_send_wr send_wr. This makes sure send_done can see request->wr.send_flags as the next commit will check for IB_SEND_SIGNALED Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 93ac432274e1361b4f6cd69e7c5d9b3ac21e13f5 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:58 2026 +0100 smb: client: fix last send credit problem causing disconnects When we are about to use the last send credit that was granted to us by the peer, we need to wait until we are ourself able to grant at least one credit to the peer. Otherwise it might not be possible for the peer to grant more credits. The following sections in MS-SMBD are related to this: 3.1.5.1 Sending Upper Layer Messages ... If Connection.SendCredits is 1 and the CreditsGranted field of the message is 0, stop processing. ... 3.1.5.9 Managing Credits Prior to Sending ... If Connection.ReceiveCredits is zero, or if Connection.SendCredits is one and the Connection.SendQueue is not empty, the sender MUST allocate and post at least one receive of size Connection.MaxReceiveSize and MUST increment Connection.ReceiveCredits by the number allocated and posted. If no receives are posted, the processing MUST return a value of zero to indicate to the caller that no Send message can be currently performed. ... This is a similar logic as we have in the server. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 21538121efe6c8c5b51c742fa02cbe820bc48714 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:57 2026 +0100 smb: client: make use of smbdirect_socket.send_io.bcredits It turns out that our code will corrupt the stream of reassabled data transfer messages when we trigger an immendiate (empty) send. In order to fix this we'll have a single 'batch' credit per connection. And code getting that credit is free to use as much messages until remaining_length reaches 0, then the batch credit it given back and the next logical send can happen. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2c1ac39ce9cd4112f406775c626eef7f3eb4c481 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:56 2026 +0100 smb: client: use smbdirect_send_batch processing This will allow us to use similar logic as we have in the server soon, so that we can share common code later. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit dc77da0373529d43175984b390106be2d8f03609 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:55 2026 +0100 smb: client: introduce and use smbd_{alloc, free}_send_io() This is basically a copy of smb_direct_{alloc,free}_sendmsg() in the server, with just using ib_dma_unmap_page() in all cases, which is the same as ib_dma_unmap_single(). We'll use this logic in common code in future. (I basically backported it from my branch that as already has everything in common). Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit bf30515caec590316e0d08208e4252eed4c160df Author: Stefan Metzmacher Date: Thu Jan 22 18:16:54 2026 +0100 smb: client: split out smbd_ib_post_send() This is like smb_direct_post_send() in the server and will simplify porting the smbdirect_send_batch and credit related logic from the server. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit bb848d205f7ac0141af52a5acb6dd116d9b71177 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:53 2026 +0100 smb: client: port and use the wait_for_credits logic used by server This simplifies the logic and prepares the use of smbdirect_send_batch in order to make sure all messages in a multi fragment send are grouped together. We'll add the smbdirect_send_batch processin in a later patch. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8bfe3fd33f36b987c8200b112646732b5f5cd8b3 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:52 2026 +0100 smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() If we reach this the connection is already broken as smbd_post_send() already called smbd_disconnect_rdma_connection(). This will also simplify further changes. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 6858531e5e8d68828eec349989cefce3f45a487f Author: Stefan Metzmacher Date: Thu Jan 22 18:16:51 2026 +0100 smb: client: remove pointless sc->recv_io.credits.count rollback We either reach this code path before we call new_credits = manage_credits_prior_sending(sc), which means new_credits is still 0 or the connection is already broken as smbd_post_send() already called smbd_disconnect_rdma_connection(). This will also simplify further changes. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit bf1656e12a9db2add716c7fb57b56967f69599fa Author: Stefan Metzmacher Date: Thu Jan 22 18:16:50 2026 +0100 smb: client: let smbd_post_send() make use of request->wr We don't need a stack variable in addition. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit defb3c05fee94b296eebe05aaea16d2664b00252 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:49 2026 +0100 smb: client: let recv_done() queue a refill when the peer is low on credits In captures I saw that Windows was granting 191 credits in a batch when its peer posted a lot of messages. We are asking for a credit target of 255 and 191 is 252*3/4. So we also use that logic in order to fill the recv buffers available to the peer. Fixes: 02548c477a90 ("smb: client: queue post_recv_credits_work also if the peer raises the credit target") Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9911b1ed187a770a43950bf51f340ad4b7beecba Author: Stefan Metzmacher Date: Thu Jan 22 18:16:48 2026 +0100 smb: client: make use of smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between receiving the incoming recv at the hardware and processing the completion in the 'recv_done' functions we likely have a window where we grant credits, which don't really exist. So we better have a decicated counter for the available credits, which will be incremented when we posted new recv buffers and drained when we grant the credits to the peer. Fixes: 5fb9b459b368 ("smb: client: count the number of posted recv_io messages in order to calculated credits") Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9da82dc73cb03e85d716a2609364572367a5ff47 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:47 2026 +0100 smb: server: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_send_batch processing we likely have requests without IB_SEND_SIGNALED, which will be destroyed in the final request that has IB_SEND_SIGNALED set. If the connection is broken all requests are signaled even without explicit IB_SEND_SIGNALED. Cc: # 6.18.x Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8cf2bbac6281434065f5f3aeab19c9c08ff755a2 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:46 2026 +0100 smb: server: fix last send credit problem causing disconnects When we are about to use the last send credit that was granted to us by the peer, we need to wait until we are ourself able to grant at least one credit to the peer. Otherwise it might not be possible for the peer to grant more credits. The following sections in MS-SMBD are related to this: 3.1.5.1 Sending Upper Layer Messages ... If Connection.SendCredits is 1 and the CreditsGranted field of the message is 0, stop processing. ... 3.1.5.9 Managing Credits Prior to Sending ... If Connection.ReceiveCredits is zero, or if Connection.SendCredits is one and the Connection.SendQueue is not empty, the sender MUST allocate and post at least one receive of size Connection.MaxReceiveSize and MUST increment Connection.ReceiveCredits by the number allocated and posted. If no receives are posted, the processing MUST return a value of zero to indicate to the caller that no Send message can be currently performed. ... This problem was found by running this on Windows 2025 against ksmbd with required smb signing: 'frametest.exe -r 4k -t 20 -n 2000' after 'frametest.exe -w 4k -t 20 -n 2000'. Link: https://lore.kernel.org/linux-cifs/b58fa352-2386-4145-b42e-9b4b1d484e17@samba.org/ Cc: # 6.18.x Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 34abd408c8ba24d7c97bd02ba874d8c714f49db1 Author: Stefan Metzmacher Date: Thu Jan 22 18:16:45 2026 +0100 smb: server: make use of smbdirect_socket.send_io.bcredits It turns out that our code will corrupt the stream of reassabled data transfer messages when we trigger an immendiate (empty) send. In order to fix this we'll have a single 'batch' credit per connection. And code getting that credit is free to use as much messages until remaining_length reaches 0, then the batch credit it given back and the next logical send can happen. Cc: # 6.18.x Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8106978d400cc88a99fb94927afe8fec7391ca3e Author: Stefan Metzmacher Date: Thu Jan 22 18:16:44 2026 +0100 smb: server: let recv_done() queue a refill when the peer is low on credits In captures I saw that Windows was granting 191 credits in a batch when its peer posted a lot of messages. We are asking for a credit target of 255 and 191 is 252*3/4. So we also use that logic in order to fill the recv buffers available to the peer. Fixes: a7eef6144c97 ("smb: server: queue post_recv_credits_work in put_recvmsg() and avoid count_avail_recvmsg") Cc: # 6.18.x Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 26ad87a2cfb8c1384620d1693a166ed87303046e Author: Stefan Metzmacher Date: Thu Jan 22 18:16:43 2026 +0100 smb: server: make use of smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between receiving the incoming recv at the hardware and processing the completion in the 'recv_done' functions we likely have a window where we grant credits, which don't really exist. So we better have a decicated counter for the available credits, which will be incremented when we posted new recv buffers and drained when we grant the credits to the peer. This fixes regression Namjae reported with the 6.18 release. Fixes: 89b021a72663 ("smb: server: manage recv credits by counting posted recv_io and granted credits") Cc: # 6.18.x Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8e94268b21c8235d430ce1aa6dc0b15952744b9b Author: Stefan Metzmacher Date: Thu Jan 22 18:16:42 2026 +0100 smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* It turns out that our code will corrupt the stream of reassabled data transfer messages when we trigger an immendiate (empty) send. In order to fix this we'll have a single 'batch' credit per connection. And code getting that credit is free to use as much messages until remaining_length reaches 0, then the batch credit it given back and the next logical send can happen. Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6e3c5052f9686192e178806e017b7377155f4bab Author: Stefan Metzmacher Date: Thu Jan 22 18:16:41 2026 +0100 smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between receiving the incoming recv at the hardware and processing the completion in the 'recv_done' functions we likely have a window where we grant credits, which don't really exist. So we better have a decicated counter for the available credits, which will be incremented when we posted new recv buffers and drained when we grant the credits to the peer. Fixes: 5fb9b459b368 ("smb: client: count the number of posted recv_io messages in order to calculated credits") Fixes: 89b021a72663 ("smb: server: manage recv credits by counting posted recv_io and granted credits") Cc: # 6.18.x Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 10dfb0738a9d383575614b5d4389953cb97e1841 Author: David Howells Date: Tue Dec 23 00:04:01 2025 +0000 cifs: Label SMB2 statuses with errors Label the SMB2 status entries with error codes as a prelude to autogenerating the mapping table. This was done with the following script: #!/usr/bin/perl -w use strict; my @error_mapping_table = (); my %statuses = (); # # Read the status list # my $f = "fs/smb/common/smb2status.h"; open FILE, "<$f" || die $f; my @contents = ; close FILE || die; my $l = 0; foreach (@contents) { $l++; if (m!^#define\s*([A-Za-z0-9_]+)\s+cpu_to_le32[(]([0-9a-fA-Fx]+)[)]!) { my $status = $1; my $code = $2; my $s; next if ($status =~ /^STATUS_SEVERITY/); if (exists($statuses{$status})) { print("$f:$l: Duplicate declaration of ", $s->{status}, "\n"); } else { my %_s = ( status => $status, code => hex($code) ); $statuses{$status} = \%_s; } } } # # Read the SMB2 status => error mapping table # $f = "fs/smb/client/smb2maperror.c"; open(MFILE, "<$f") || die $f; my @maperror = ; close MFILE || die; my $parse = 0; my $acc = ""; $l = 0; foreach my $line (@maperror) { chomp $line; $l++; if ($parse == 0 && $line =~ /^static const struct status_to_posix_error smb2_error_map_table/) { $parse = 1; next; } last if ($parse >= 1 && $line =~ /^[}];/); if ($parse == 1) { if ($line =~ /[\t][{].*[}],/) { $acc = $line; $parse = 3; } elsif ($line =~ /[\t][{].*/) { $acc = $line; $parse = 2; next; } elsif ($line =~ m!^\s*/[*].*[*]/!) { next; } else { die "smb2maperror.c:$l: unparseable mapping element\n"; } } if ($parse == 2) { if ($line =~ /.*[}],/) { $acc .= $line; $parse = 3; } else { $acc .= $line; } } if ($parse == 3) { $acc =~ s/\s+//g; if ($acc =~ m/[{](.*)[}]/) { $acc = $1; } else { die "'$acc'"; } my ($status, $error, $string) = split(/,/, $acc); if (exists($statuses{$status})) { my $s = $statuses{$status}; if (exists($s->{error})) { print("$f:$l: Dup mapping entry $status\n"); } $s->{error} = $error; #print $s->{code}, " => ", $error, "\n"; } else { print STDERR "$f:$l: Unknown status $status\n"; } $acc = ""; $parse = 1; } } # # Sort the error table by STATUS_* value # my @order = (); foreach my $status (keys(%statuses)) { my $s = $statuses{$status}; push @order, $s; unless (exists($s->{code})) { print("Unknown code for ", $s->{status}, "\n") } else { #print("Code for ", $s->{status}, " is ", $s->{code}, "\n"); } } @order = sort( { $a->{code} <=> $b->{code} } @order); foreach my $s (@order) { my $status = $s->{status}; my $error = $s->{error}; my $code = $s->{code}; my $pad = " "; if (length($status) < 32) { my $n = 32 - length($status); $pad = "\t" x ((($n-1) / 8) + 1); } #printf("#define %s%scpu_to_le32(0x%08x) // -%s\n", $status, $pad, $code, $error); #printf("\t%s%s= 0x%08x, // -%s\n", $status, $pad, $code, $error); } # # Decorate the definitions # my @output = (); for (my $i = 0; $i <= $#contents; $i++) { my $line = $contents[$i]; if ($line =~ m!^#define\s*([A-Za-z0-9_]+)\s+cpu_to_le32[(]([0-9a-fA-Fx]+)[)]!) { my $status = $1; my $code = $2; if ($status =~ /^STATUS_SEVERITY/) { push @output, $line; next; } my $pad = " "; if (length($status) < 40) { my $n = 40 - length($status); $pad = "\t" x ((($n-1) / 8) + 1); } my $s = $statuses{$1}; my $error = "EIO"; if (exists($s->{error})) { $error = $s->{error}; } else { if (!$s->{code}) { print "ZERO ", $status, "\n"; $error = "0"; } else { $error = "-EIO"; } } #my $rev = "#define " . $status . $pad . "_S(" . $2 . ", " . $error . ")\n"; my $rev = "#define " . $status . $pad . "cpu_to_le32(" . $2 . ") // " . $error . "\n"; push @output, $rev; } else { push @output, $line; } } open FILE, ">fs/smb/common/smb2status.h" || die; print FILE @output; close FILE || die; Signed-off-by: David Howells cc: Steve French cc: ChenXiaoSong cc: linux-cifs@vger.kernel.org Signed-off-by: ChenXiaoSong Reviewed-by: David Howells Link: https://lore.kernel.org/linux-cifs/20260106071507.1420900-2-chenxiaosong.chenxiaosong@linux.dev/ Signed-off-by: Steve French commit c9ce93ef27a1f4dd403d5222365f3cfe1c55c03a Author: David Howells Date: Wed Dec 17 21:23:56 2025 +0000 cifs: SMB1 split: Make BCC accessors conditional Make the BCC accessor functions conditional. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 88f7d7e32d9e086ba87c6b04a9ba57f3f41268bd Author: David Howells Date: Wed Dec 17 17:41:38 2025 +0000 cifs: SMB1 split: connect.c Split SMB1-specific connection management stuff to smb1ops.c and move CIFSTCon() to cifssmb.c. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit dec5a519e60e0ac3d273e441478ab7520d6dc3e5 Author: David Howells Date: Wed Dec 17 16:14:36 2025 +0000 cifs: SMB1 split: sess.c Split SMB1-specific session setup stuff into smb1session.c. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit b6fe92377670a2789a44c9eec19e3cc6579b71d0 Author: David Howells Date: Wed Dec 17 15:34:08 2025 +0000 cifs: SMB1 split: cifsencrypt.c Split SMB1-specific message signing into smb1encrypt.c. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 6fb4e46d2fd129ce09691b90666c3e3feed7b277 Author: David Howells Date: Wed Dec 17 15:25:59 2025 +0000 cifs: SMB1 split: netmisc.c Split a variety of bits from netmisc.c into other places, notably the error table into smb1maperror.c. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 3739f6d2986b77d27e7c7b34121cc7047acfffa4 Author: David Howells Date: Wed Dec 17 15:22:19 2025 +0000 cifs: SMB1 split: misc.c Split SMB1 bits from misc.c to smb1misc.c. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit e5ac3ff6c6e7ea3bd0859edb80b9241135fe10c0 Author: David Howells Date: Wed Dec 17 12:53:23 2025 +0000 cifs: SMB1 split: cifs_debug.c Split SMB1 bits from cifs_debug.c to smb1debug.c. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit c23e0ce2ae76a47b3207770c6f17e50527f0d4b3 Author: David Howells Date: Wed Dec 17 15:14:22 2025 +0000 cifs: SMB1 split: Move inline funcs Move some SMB1-specific inline funcs to smb1proto.h. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 1e6f98f3e8b2f580e8a4666f77909d8122703b83 Author: David Howells Date: Wed Dec 17 15:44:07 2025 +0000 cifs: Fix cifs_dump_mids() to call ->dump_detail Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit fee3181757c1c4ea883fecc38a4e6079b200b726 Author: David Howells Date: Wed Dec 17 17:47:22 2025 +0000 cifs: SMB1 split: Don't return smb_hdr from cifs_{,small_}buf_get() Return void* rather than struct smb_hdr* from from cifs_buf_get() and cifs_small_buf_get() as SMB2/3 shouldn't be accessing smb_hdr. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit efbe45cc035deb2ac6648b4fb8267241f3563efd Author: David Howells Date: Wed Dec 17 15:09:39 2025 +0000 cifs: SMB1 split: Move BCC access functions Move the BCC access functions to smb1proto.h as they're only applicable to SMB1. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 8a848efd482be65d488e888f96812d8729ea64ea Author: David Howells Date: Wed Dec 17 15:03:25 2025 +0000 cifs: SMB1 split: Adjust #includes Adjust the #include set after the removal of the SMB1 protocol defs from cifspdu.h. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit ed1e53796f51c27f743f9f2677e58a47e85c3ff0 Author: David Howells Date: Wed Dec 17 13:22:00 2025 +0000 cifs: SMB1 split: Split SMB1 protocol defs into smb1pdu.h Split SMB1 protocol defs into smb1pdu.h. This should perhaps go in the common/ directory. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit a7c7f35bcf0943ba85ab14bafbfbcbc3a30ad402 Author: David Howells Date: Wed Dec 17 22:06:22 2025 +0000 cifs: SMB1 split: Add some #includes Add some #includes to make sure things continue to compile as splitting occurs. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 282432612aa7678859a0545f9619de74aa7b9102 Author: David Howells Date: Thu Sep 11 14:09:17 2025 +0100 cifs: SMB1 split: Move some SMB1 received PDU checking bits to smb1transport.c Move some SMB1 received checking bits to smb1transport.c from misc.c so that they're with the rest of the receive handling code. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit bae7afc4b4ece8f2461a2132ad684dd850b6cb66 Author: David Howells Date: Wed Sep 10 08:47:09 2025 +0100 cifs: SMB1 split: Move some SMB1 receive bits to smb1transport.c Move some SMB1 receive bits to smb1transport.c from smb1ops.c where they're mixed in with unrelated code to do with encoding, decoding and processing PDUs. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 645427b7a6c59e0074df29bf939aec2e9d6f2819 Author: David Howells Date: Wed Dec 17 09:42:22 2025 +0000 cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h Separate out SMB1 declarations scriptedly into smb1proto.h. Script below: #!/usr/bin/perl -w use strict; unless (@ARGV) { die "Usage: $0 [ ...]\n"; } # Data tracking my %funcs = (); # Func name => { func prototype } my %headers = (); # Header filename => { header content } my %c_files = (); # C filename => { ordered func list, header pref } my %cmarkers = (); # C filename marker => { header filename it's in } # Parse state my $pathname = "-"; my $lineno = 0; sub error(@) { print STDERR $pathname, ":", $lineno, ": ", @_, "\n"; exit(1); } sub pad($) { # Reindent the function arguments to line the arguments up with the char # after the opening bracket on the func argument list my ($lines) = @_; return $lines if ($#{$lines} <= 0); my $has_empty = 0; for (my $i = 0; $i <= $#{$lines}; $i++) { $lines->[$i] =~ s/^[ \t]+//; $has_empty = 1 if ($lines->[$i] eq ""); } if ($has_empty) { my @clean = grep /.+/, @{$lines}; $lines = \@clean; } my $indlen = index($lines->[0], "("); return $lines if ($indlen < 0); my $indent = ""; $indlen++; $indent .= "\t" x ($indlen / 8); $indent .= " " x ($indlen % 8); my @padded = (); my $acc = ""; my $len = -$indlen; for (my $i = 0; $i <= $#{$lines}; $i++) { my $argument = $lines->[$i]; my $arglen = length($argument); my $last = ($i == $#{$lines} ? 1 : 0); if ($i == 0 || $i == 1) { $acc .= $argument; $acc .= ";" if ($last); $len += $arglen + $last; next; } if (!$acc) { $acc = $indent . $argument; $acc .= ";" if ($last); $len += $arglen + $last; next; } if ($indlen + $len + 1 + $arglen + $last > 79) { push @padded, $acc; $acc = $indent . $argument; $acc .= ";" if ($last); $len = $arglen + $last; next; } $acc .= " " . $argument; $acc .= ";" if ($last); $len += 1 + $arglen + $last; } push @padded, $acc if ($acc); return \@padded; } sub earliest(@) { my $ret = -1; foreach (@_) { $ret = $_ if ($ret < 0 || ($_ >= 0 && $_ < $ret)); } return $ret; } foreach my $file (@ARGV) { # Open the file for reading. next if $file =~ /trace[.]h$/; next if $file =~ /smbdirect[.][ch]$/; open my $fh, "<$file" or die "Could not open file '$file'"; $pathname = $file; $lineno = 0; my $filename; my @file_content = (); my @copy = (); my $state = 0; my $qual = ""; my $type = ""; my $funcname = ""; my @funcdef = (); my $bracket = 0; my $comment = 0; my $smb1 = 0; my $header = 0; my $inline = 0; my $file_marker = ""; my $config = ""; my $c_file = 0; $filename = $pathname; $filename =~ s!.*/!!; if ($file =~ m!.h$!) { my %new_h_file = ( path => $pathname, fname => $filename, content => [], ); $header = \%new_h_file; $headers{$filename} = \%new_h_file; } elsif ($file =~ m!.c$!) { my %new_c_file = ( path => $pathname, fname => $filename, funcs => [], ); $c_file = \%new_c_file; $c_files{$filename} = \%new_c_file; } else { warn("Ignoring unexpected file $file\n"); next; } $smb1 = 1 if ($file =~ m!/smb1ops.c|/cifssmb.c|/cifstransport.c!); foreach my $line (<$fh>) { $lineno++; chomp($line); push @copy, $line; if (!$line) { # Blank line push @file_content, @copy; @copy = (); next; } # Handle continuation or end of block comment. Look for C file # prototype insertion point markers. if ($comment) { if ($line =~ m![*]/!) { if ($comment == 2 && $file_marker) { $cmarkers{$file_marker} = $file_marker; push @copy, "#C_MARKER " . $file_marker; $file_marker = 0; } $comment = 0; } else { $comment++; if ($comment == 2 && $line =~ m! [*] ([a-z][a-z_0-9]*[.][c])$!) { $file_marker = $1; print("Found file marker ", $file_marker, " in ", $filename, "\n"); } } push @file_content, @copy; @copy = (); next; } # Check cpp directives, particularly looking for SMB1 bits if ($line =~ /^[#]/) { if ($header) { if ($line =~ /ifdef.*(CONFIG_[A-Z0-9_])/) { error("multiconfig") if $config; $config = $1; $smb1++ if ($config eq "CONFIG_CIFS_ALLOW_INSECURE_LEGACY"); } elsif ($line =~ /endif/) { $smb1-- if ($config eq "CONFIG_CIFS_ALLOW_INSECURE_LEGACY"); $config = ""; } } push @file_content, @copy; @copy = (); next; } # Exclude interference in finding func names and return types if ($line =~ /^[{]/ || $line =~ /##/ || $line =~ /^[_a-z0-9A-Z]+:$/ || # goto label $line =~ /^do [{]/ || $line =~ m!^//!) { push @file_content, @copy; @copy = (); next; } # Start of a block comment if ($line =~ m!^/[*]!) { $comment = 1 unless ($line =~ m![*]/!); push @file_content, @copy; @copy = (); next; } # End of a braced section, such as a function implementation if ($line =~ /^[}]/) { $type = ""; $qual = ""; $funcname = ""; @funcdef = (); push @file_content, @copy; @copy = (); next; } if ($line =~ /^typedef/) { $type = ""; $qual = ""; $funcname = ""; @funcdef = (); push @file_content, @copy; @copy = (); next; } # Extract function qualifiers. There may be multiple of these in more # or less any order. Some of them cause the func to be skipped (e.g. inline). if ($line =~ /^(static|extern|inline|noinline|noinline_for_stack|__always_inline)\W/ || $line =~ /^(static|extern|inline|noinline|noinline_for_stack|__always_inline)$/) { error("Unexpected qualifier '$1'") if ($state != 0); while ($line =~ /^(static|extern|inline|noinline|noinline_for_stack|__always_inline)\W/ || $line =~ /^(static|extern|inline|noinline|noinline_for_stack|__always_inline)$/) { $qual .= " " if ($qual); $qual .= $1; $inline = 1 if ($1 eq "inline"); $inline = 1 if ($1 eq "__always_inline"); $line = substr($line, length($1)); $line =~ s/^\s+//; } } if ($state == 0) { # Extract what we assume to be the return type if ($line =~ /^\s/) { push @file_content, @copy; @copy = (); next; } while ($line =~ /^(unsigned|signed|bool|char|short|int|long|void|const|volatile|(struct|union|enum)\s+[_a-zA-Z][_a-zA-Z0-9]*|[*]|__init|__exit|__le16|__le32|__le64|__be16|__be32|__be64)/) { $type .= " " if $type; $type .= $1; $line = substr($line, length($1)); $line =~ s/^\s+//; } if ($line =~ /^struct [{]/) { # Ignore structure definitions $type = ""; $qual = ""; $funcname = ""; @funcdef = (); push @file_content, @copy; @copy = (); next; } if (index($line, "=") >= 0) { # Ignore assignments $type = ""; $qual = ""; $funcname = ""; @funcdef = ""; push @file_content, @copy; @copy = (); next; } # Try and extract a function's type and name while ($line =~ /(^[_a-zA-Z][_a-zA-Z0-9]*)/) { my $name = $1; $line = substr($line, length($name)); next if ($line =~ /^[{]/); $line =~ s/^\s+//; my $ch = substr($line, 0, 1); last if ($ch eq "[" || $ch eq ";"); # Global variables if ($ch eq "(") { # Found the function name $state = 1; $line = substr($line, 1); $funcname = $name; my $tmp = $qual . $type . " " . $funcname . "("; $tmp =~ s/[*] /*/; push @funcdef, $tmp; $bracket = 1; last; } if ($type) { last if (index($line, ";") >= 0 && index($line, "(") == -1); error("Unexpected name '$name' after '$type'"); } $type .= " " if $type; $type .= $name; if ($line =~ /^(\s*[*]+)/) { my $ptr = $1; $type .= $ptr; $line = substr($line, length($ptr)); } } } # Try and extract a function's argument list my $from = 0; if ($state == 1) { while (1) { my $o = index($line, "(", $from); my $c = index($line, ")", $from); my $m = index($line, ",", $from); my $b = earliest($o, $c, $m); if ($b < 0) { push @funcdef, $line unless ($line eq ""); last; } my $ch = substr($line, $b, 1); # Push the arguments separately on to the list if ($ch eq ",") { push @funcdef, substr($line, 0, $b + 1); $line = substr($line, $b + 1); $from = 0; } elsif ($ch eq "(") { # Handle brackets in the argument list (e.g. function # pointers) $bracket++; $from = $b + 1; } elsif ($ch eq ")") { $bracket--; if ($bracket == 0) { push @funcdef, substr($line, 0, $b + 1); $line = substr($line, $b + 1); $state = 2; last; } $from = $b + 1; } } } if ($state == 2) { $inline = 1 if ($qual =~ /inline/); #print("QUAL $qual $type $funcname $inline ", $#funcdef, "\n"); if (!$header && $qual !~ /static/ && $funcname ne "__acquires" && $funcname ne "__releases" && $funcname ne "module_init" && $funcname ne "module_exit" && $funcname ne "module_param" && $funcname ne "module_param_call" && $funcname ne "PROC_FILE_DEFINE" && $funcname !~ /MODULE_/ && $funcname !~ /DEFINE_/) { # Okay, we appear to have a function implementation my $func; my $dup = 0; if (exists($funcs{$funcname})) { $func = $funcs{$funcname}; if (exists $func->{body}) { print("dup $funcname\n"); $dup = 1; } } else { my %new_func = ( name => $funcname, cond => "", legacy => 0, ); $func = \%new_func; $funcs{$funcname} = $func; $func->{body} = pad(\@funcdef); } $func->{body} = pad(\@funcdef); $func->{legacy} = 1 if $smb1; if ($funcname eq "cifs_inval_name_dfs_link_error") { $func->{cond} = "#ifdef CONFIG_CIFS_DFS_UPCALL"; } elsif ($funcname eq "cifs_listxattr") { $func->{cond} = "#ifdef CONFIG_CIFS_XATTR"; } push @{$c_file->{funcs}}, $func unless $dup; } elsif (!$header || $inline) { # Ignore inline function implementations and other weirdies push @file_content, @copy; } elsif ($header && !$inline) { push @file_content, "#FUNCPROTO " . $funcname; my $func; if (exists($funcs{$funcname})) { $func = $funcs{$funcname}; $func->{lineno} = $lineno; $func->{pathname} = $pathname; } else { my %new_func = ( name => $funcname, cond => "", lineno => $lineno, pathname => $pathname, legacy => 0, ); $func = \%new_func; $funcs{$funcname} = $func; } $func->{legacy} = 1 if $smb1; } @funcdef = (); $type = ""; $qual = ""; $funcname = ""; $inline = 0; $state = 0; @copy = (); } if ($line =~ /;/) { $type = ""; $qual = ""; $funcname = ""; @funcdef = (); $state = 0; push @file_content, @copy; @copy = (); } } close($fh); if ($header) { $header->{content} = \@file_content; } } sub write_header($) { my ($header) = @_; my $path = $header->{path}; my $legacy = 0; $legacy = 1 if ($path =~ m!smb1proto[.]h!); my @output = (); foreach my $line (@{$header->{content}}) { if ($line =~ "^[#]C_MARKER (.*)") { my $file_marker = $cmarkers{$1}; my $c_file = $c_files{$file_marker}; print("Found $line\n"); foreach my $func (@{$c_file->{funcs}}) { print("func ", $func->{name}, "\n"); push @output, @{$func->{body}}; } next; } elsif ($line =~ "^[#]FUNCPROTO ([_a-zA-Z0-9]+)") { my $funcname = $1; my $func = $funcs{$funcname}; if (!$func->{body}) { print($func->{pathname}, ":", $func->{lineno}, ": '", $funcname, "' dead prototype\n"); next; } if ($func->{legacy} == $legacy) { #push @output, $line; push @output, @{$func->{body}}; } } else { push @output, $line; } } open my $fh, ">$path" or die "Could not open file '$path' for writing"; foreach my $f (@output) { print($fh $f, "\n") or die $path; } close($fh) or die $path; } foreach my $h (keys(%headers)) { write_header($headers{$h}); } Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 86c666506ea2c42649879eeac7f29e7bedef2f23 Author: David Howells Date: Wed Dec 17 09:54:35 2025 +0000 cifs: SMB1 split: Create smb1proto.h for SMB1 declarations Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit b09eab52b307df58a36f34d047378053a2e13e13 Author: David Howells Date: Wed Dec 17 16:10:05 2025 +0000 cifs: SMB1 split: Rename cifstransport.c Rename cifstransport.c to smb1transport.c in order to give consistent names SMB1-specific files. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 657f6f9aff6c3ea8160f52fcadd352ae16c638f3 Author: David Howells Date: Thu Dec 11 11:50:51 2025 +0000 cifs: Scripted clean up fs/smb/client/ntlmssp.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit a90ef3f4bad3d8ab6e8eec86d4cb952dc900432a Author: David Howells Date: Thu Dec 11 11:50:51 2025 +0000 cifs: Scripted clean up fs/smb/client/reparse.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 1e009e3346db230787685a3989fd9c346fb412fb Author: David Howells Date: Thu Dec 11 11:50:51 2025 +0000 cifs: Scripted clean up fs/smb/client/smb2proto.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 7e335c003e18e9154dec1ba409f99f903f99cbac Author: David Howells Date: Thu Dec 11 11:50:51 2025 +0000 cifs: Scripted clean up fs/smb/client/cifs_debug.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 4f8a3a1dfb06407f4d00f005c31fc595d5830a0f Author: David Howells Date: Thu Dec 11 11:50:50 2025 +0000 cifs: Scripted clean up fs/smb/client/cifs_swn.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit cfda5641476b67acdca16a0b5ab0d8572b3e5ecb Author: David Howells Date: Thu Dec 11 11:50:50 2025 +0000 cifs: Scripted clean up fs/smb/client/compress.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit c63510dd2099109d50d2473ba5134c984063ac30 Author: David Howells Date: Thu Dec 11 11:50:49 2025 +0000 cifs: Scripted clean up fs/smb/client/cifs_spnego.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 047e504766a357ab751f76ccdec7a2e824e75e6d Author: David Howells Date: Thu Dec 11 11:50:49 2025 +0000 cifs: Scripted clean up fs/smb/client/fs_context.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit bc3de356aae666de5d8b5131545be87cf7754431 Author: David Howells Date: Thu Dec 11 11:50:49 2025 +0000 cifs: Scripted clean up fs/smb/client/fscache.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 481acb91ec98ea8ecabb8537688fc2e39113a7cb Author: David Howells Date: Thu Dec 11 11:50:49 2025 +0000 cifs: Scripted clean up fs/smb/client/cifsglob.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 4fce89252cf12f5bc8d7ef57869d2966d7fdfe06 Author: David Howells Date: Thu Dec 11 11:50:48 2025 +0000 cifs: Scripted clean up fs/smb/client/dns_resolve.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit fcc9f8cc812db02ab9c9fd41143c66d659dfc40c Author: David Howells Date: Thu Dec 11 11:50:48 2025 +0000 cifs: Scripted clean up fs/smb/client/dfs_cache.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit eb7e2a47a08d26fb142665229ebb609e97ed5b25 Author: David Howells Date: Thu Dec 11 11:50:47 2025 +0000 cifs: Scripted clean up fs/smb/client/cifsfs.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 88b0fe67e61e064aa04397970e60d685425fed48 Author: David Howells Date: Thu Dec 11 11:50:46 2025 +0000 cifs: Scripted clean up fs/smb/client/netlink.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 696ca7d95658224ba807813101d0d5714d1d8aa4 Author: David Howells Date: Thu Dec 11 11:50:46 2025 +0000 cifs: Scripted clean up fs/smb/client/cifs_unicode.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 8b9e581297b76692f1e94d3f291ce2b59a13191d Author: David Howells Date: Thu Dec 11 11:50:45 2025 +0000 cifs: Scripted clean up fs/smb/client/cifsproto.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 62e2d29bf08ffa6f572eeb952bcd3e677eb3c666 Author: David Howells Date: Thu Dec 11 11:50:45 2025 +0000 cifs: Scripted clean up fs/smb/client/dfs.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit c9dd4ea5f9daf130ccbbd5e78853ca6a4234f158 Author: David Howells Date: Thu Dec 11 11:50:44 2025 +0000 cifs: Scripted clean up fs/smb/client/cached_dir.h Remove externs, correct argument names and reformat declarations. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-kernel@vger.kernel.org Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 518a5cb988a304a49f0d5c46460028787aefe50d Author: Henrique Carvalho Date: Mon Jan 19 13:42:13 2026 -0300 smb: client: add multichannel async work for CONFIG_CIFS_DFS_UPCALL=n Multichannel support is independent of DFS configuration. Extend the async multichannel setup to non-DFS cifs.ko. Reviewed-by: Shyam Prasad N Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 556bb341f9f2ead773f52ae466296ea0a9c927f8 Author: Henrique Carvalho Date: Mon Jan 19 13:42:12 2026 -0300 smb: client: introduce multichannel async work during mount Mounts can experience large delays when servers advertise interfaces that are unreachable from the client. To fix this, decouple channel addition from the synchronous mount path by introducing struct mchan_mount and running channel setup as background work. Reviewed-by: Shyam Prasad N Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 Author: Henrique Carvalho Date: Mon Jan 19 14:54:44 2026 -0300 smb: client: prevent races in ->query_interfaces() It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating iface_last_update under iface_lock. Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 Author: Henrique Carvalho Date: Mon Jan 19 14:54:45 2026 -0300 smb: client: add proper locking around ses->iface_last_update There is a missing ses->iface_lock in cifs_setup_session, around ses->iface_last_update. Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit ec306600d5ba7148c9dbf8f5a8f1f5c1a044a241 Author: Henrique Carvalho Date: Tue Jan 27 13:01:28 2026 -0300 smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields. Cc: stable@vger.kernel.org Fixes: ebe98f1447bbc ("cifs: enable caching of directories for which a lease is held") Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 96c4af418586ee9a6aab61738644366426e05316 Author: Shyam Prasad N Date: Sun Feb 1 00:21:13 2026 +0530 cifs: Fix locking usage for tcon fields We used to use the cifs_tcp_ses_lock to protect a lot of objects that are not just the server, ses or tcon lists. We later introduced srv_lock, ses_lock and tc_lock to protect fields within the corresponding structs. This was done to provide a more granular protection and avoid unnecessary serialization. There were still a couple of uses of cifs_tcp_ses_lock to provide tcon fields. In this patch, I've replaced them with tc_lock. Cc: stable@vger.kernel.org Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 037ddbcc107acbf3e45e7f5841a92ceb87001ee3 Author: Shyam Prasad N Date: Sun Feb 1 00:21:12 2026 +0530 cifs: Corrections to lock ordering notes There were a couple of discrepencies in lock ordering for the locks that were specified in the lock ordering notes. Did an analysis of the current codebase (using LLM) and found two pairs whose ordering in these notes were wrong. It also found one lock that was recently removed, and a few locks that weren't documented here before. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 2c1238a7477a2e76a49161937fc20a04c74dbd76 Author: Shyam Prasad N Date: Sat Jan 31 14:03:06 2026 +0530 cifs: make retry logic in read/write path consistent with other paths Today in most other code paths in cifs.ko, the decision of whether to retry a command depends on two mount options: retrans and hard. However, the read/write code paths diverged from this and would only retry if the error returned was -EAGAIN. However, there are other replayable errors in cifs.ko, for which is_replayable_errors helper was written. This change makes read/write codepaths consistent with other code-paths. This change also does the following: 1. The SMB2 read/write code diverged significantly (presumably since they were changed during netfs refactor at different times). This changes the response verification logic to be consistent. 2. Moves the netfs tracepoints to slightly different locations in order to make debugging easier. Cc: David Howells Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit a5ca32d031bbba5160e1f555aabb75a3f40f918d Author: Shyam Prasad N Date: Sat Jan 31 14:03:05 2026 +0530 netfs: avoid double increment of retry_count in subreq This change fixes the instance of double incrementing of retry_count. The increment of this count already happens when netfs_reissue_write gets called. Incrementing this value before is not necessary. Fixes: 4acb665cf4f3 ("netfs: Work around recursion by abandoning retry if nothing read") Acked-by: David Howells Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 82e8885bd7633a36ee9050e6d7f348a4155eed5f Author: Shyam Prasad N Date: Sat Jan 31 14:03:04 2026 +0530 netfs: when subreq is marked for retry, do not check if it faced an error The *_subreq_terminated functions today only process the NEED_RETRY flag when the subreq was successful or failed with EAGAIN error. However, there could be other retriable errors for network filesystems. Avoid this by processing the NEED_RETRY irrespective of the error code faced by the subreq. If it was specifically marked for retry, the error code must not matter. Acked-by: David Howells Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 16d480ed4990ed5aefb99c111dd14131a338e3c9 Author: Shyam Prasad N Date: Sat Jan 31 14:03:03 2026 +0530 cifs: on replayable errors back-off before replay, not after On replayable errors, we call smb2_should_replays that does these things today: 1. decide if we need to replay the command again 2. sleep to back-off the failed request 3. update the next sleep value We will not be able to use this for async requests, when this is processed in callbacks (as this will be called in cifsd threads that should not sleep in response processing). Modify the behaviour by taking the sleep out of smb2_should_replay and performing the sleep for back-off just before actually performing the replay. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit ebbbc4bfad4cb355d17c671223d0814ee3ef4eda Author: Paulo Alcantara Date: Thu Feb 5 13:19:52 2026 -0300 smb: client: fix potential UAF and double free in smb2_open_file() Zero out @err_iov and @err_buftype before retrying SMB2_open() to prevent an UAF bug if @data != NULL, otherwise a double free. Fixes: e3a43633023e ("smb/client: fix memory leak in smb2_open_file()") Reported-by: David Howells Closes: https://lore.kernel.org/r/2892312.1770306653@warthog.procyon.org.uk Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Reviewed-by: ChenXiaoSong Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 335047109d7d488bf5ad32a4076e1a011994cd0e Author: Dmitrii Dolgov <9erthalion6@gmail.com> Date: Sun Feb 8 13:22:26 2026 +0100 perf tests: Test annotate with data type profiling and C Exercise the annotate command with data type profiling feature with C. For that extend the existing data type profiling shell test to profile the datasym workload, then annotate the result expecting to see some data structures from the C code. Committer testing: root@number:~# perf test 'perf data type profiling tests' 83: perf data type profiling tests : Ok root@number:~# perf test -vv 'perf data type profiling tests' 83: perf data type profiling tests: --- start --- test child forked, pid 125028 Basic Rust perf annotate test Basic annotate test [Success] Pipe Rust perf annotate test Pipe annotate test [Success] Basic C perf annotate test Basic annotate test [Success] Pipe C perf annotate test Pipe annotate test [Success] ---- end(0) ---- 83: perf data type profiling tests : Ok root@number:~# Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Tested-by: Arnaldo Carvalho de Melo Cc: Ian Rogers Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit f60a5c22967b845d5319d4f447cb28190021795c Author: Dmitrii Dolgov <9erthalion6@gmail.com> Date: Sun Feb 8 13:22:25 2026 +0100 perf tests: Test annotate with data type profiling and rust Exercise the annotate command with data type profiling feature on the rust runtime. For that add a new shell test, which will profile the code_with_type workload, then annotate the result expecting to see some data structures from the rust code. Committer testing: root@number:~# perf test 'perf data type profiling tests' 83: perf data type profiling tests : Ok root@number:~# perf test -v 'perf data type profiling tests' 83: perf data type profiling tests : Ok root@number:~# perf test -vv 'perf data type profiling tests' 83: perf data type profiling tests: --- start --- test child forked, pid 111044 Basic perf annotate test Basic annotate test [Success] Pipe perf annotate test Pipe annotate test [Success] ---- end(0) ---- 83: perf data type profiling tests : Ok root@number:~# Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Tested-by: Arnaldo Carvalho de Melo Cc: Ian Rogers Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 2e05bb52a12d3cdb81f3b6f5de5cb3905d383552 Author: Dmitrii Dolgov <9erthalion6@gmail.com> Date: Sun Feb 8 13:22:24 2026 +0100 perf test workload: Add code_with_type test workload The purpose of the workload is to gather samples of rust runtime. To achieve that it has a dummy rust library linked with it. Per recommendations for such scenarios [1], the rust library is statically linked. An example: $ perf record perf test -w code_with_type [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.160 MB perf.data (4074 samples) ] $ perf report --stdio --dso perf -s srcfile,srcline 45.16% ub_checks.rs ub_checks.rs:72 6.72% code_with_type.rs code_with_type.rs:15 6.64% range.rs range.rs:767 4.26% code_with_type.rs code_with_type.rs:21 4.23% range.rs range.rs:0 3.99% code_with_type.rs code_with_type.rs:16 [...] [1]: https://doc.rust-lang.org/reference/linkage.html#mixed-rust-and-foreign-codebases Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Tested-by: Arnaldo Carvalho de Melo Cc: Ian Rogers Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 77d31948a88368f1e8516cb74614ab2e0340e840 Author: Vijendar Mukunda Date: Sat Feb 7 11:53:51 2026 +0530 ASoC: amd: maintainer information Update MAINTAINERS file for AMD ASoC drivers. Signed-off-by: Vijendar Mukunda Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260207062433.1465232-1-Vijendar.Mukunda@amd.com commit efdc383d1cc28d45cbf5a23b5ffa997010aaacb4 Author: Carlos Song Date: Fri Jan 23 18:54:58 2026 +0800 i2c: imx-lpi2c: fix SMBus block read NACK after byte count The LPI2C controller sends a NACK at the end of a receive command unless another receive command is already queued in MTDR. During SMBus block reads, this causes the controller to NACK immediately after receiving the block length byte, aborting the transfer before the data bytes are read. Fix this by queueing a second receive command as soon as the block length byte is received, keeping MTDR non-empty and ensuring continuous ACKs. The initial receive command reads the block length, and the subsequent command reads the remaining data bytes according to the reported length. Fixes: a55fa9d0e42e ("i2c: imx-lpi2c: add low power i2c bus driver") Signed-off-by: Carlos Song Cc: # v4.10+ Reviewed-by: Frank Li Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260123105459.3448822-1-carlos.song@nxp.com Signed-off-by: Wolfram Sang commit 86f17f37a1fb4121229a76e6b9888072aadc334a Merge: 3a92733e052753 51db05283f7c9c Author: Takashi Iwai Date: Sun Feb 8 17:38:37 2026 +0100 Merge branch 'for-linus' into for-next Pull 6.19-devel branch. Signed-off-by: Takashi Iwai commit 3a92733e052753d87fdd56bd6f621f969be28447 Author: Harin Lee Date: Sun Feb 8 22:30:01 2026 +0900 ALSA: ctxfi: Add quirk for SE-300PCIE variant (160b:0102) Add quirk for the Onkyo SE-300PCIE variant with PCI subsystem ID (160b:0102). This variant (OK0011) was found in the official Windows driver packages. Also, reorder entries and fix the indentation to maintain consistency. Signed-off-by: Harin Lee Link: https://patch.msgid.link/20260208133001.680550-1-me@harin.net Signed-off-by: Takashi Iwai commit 6a32fa5ccd33da5d187ec6e78f3b45683399ab66 Author: Dmitrii Dolgov <9erthalion6@gmail.com> Date: Sun Feb 8 13:22:23 2026 +0100 tools build: Add a feature test for rust compiler Add a feature test to identify if the rust compiler is available, so that perf could build rust based worloads based on that. Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> Cc: Ian Rogers Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit ff9aeb6bd14dbc70651971c81e81fa8269c3101a Author: Ian Rogers Date: Sat Feb 7 21:54:55 2026 -0800 perf test parse-metric: Ensure aggregate counts appear to have run Commit bb5a920b90991279 ("perf stat: Ensure metrics are displayed even with failed events") with failed events") made it so that counters which weren't enabled in the kernel were handled as NaN in metrics. This caused the "Parse and process metrics" test to start failing as it wasn't putting a non-zero value in these variables. Add arbitrary values of 1 to fix the test. Fixes: bb5a920b90991279 ("perf stat: Ensure metrics are displayed even with failed events") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Chun-Tse Shao Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Yang Li Signed-off-by: Arnaldo Carvalho de Melo commit c60ee958d625998422ff833ec0de0dcafc1165fa Author: Ian Rogers Date: Sat Feb 7 15:04:52 2026 -0800 perf test record.sh: Fix shellcheck warning Add quotes to avoid the following warning: ``` In tests/shell/record.sh line 264: [ $(uname -m) = "s390x" ] && { ^---------^ SC2046 (warning): Quote this to prevent word splitting. For more information: https://www.shellcheck.net/wiki/SC2046 -- Quote this to prevent word splitt... ``` Fixes: c73a56ed3c97ae65 ("perf test: Fix test case Leader sampling on s390") Signed-off-by: Ian Rogers Cc: Namhyung Kim Cc: Thomas Richter Signed-off-by: Arnaldo Carvalho de Melo commit f5183ee97bd67b3dd3cc6fb2fc97f2a6d3e36458 Author: Pedro Amarante Date: Sat Feb 7 21:24:39 2026 -0800 ALSA: hda/generic: fix typos in comments Fix 'ony' -> 'only' and 'evalute' -> 'evaluate' in code comments. Signed-off-by: Pedro Amarante Link: https://patch.msgid.link/20260208052439.11498-1-ppedrolia@gmail.com Signed-off-by: Takashi Iwai commit ac1ff574bbc09a6c90f4fe8f9e6b8d66c983064c Author: Illia Barbashyn <04baril@gmail.com> Date: Sat Feb 7 23:19:37 2026 +0100 ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx The mute and mic-mute LEDs on HP ENVY x360 Convertible 15-es0xxx (PCI SSID 103c:88b3) do not work with the current driver. This model requires a combination of COEFBIT and GPIO fixups to correctly control the LEDs. Introduce a new fixup function alc245_fixup_hp_envy_x360_mute_led and add a quirk to apply it. Signed-off-by: Illia Barbashyn <04baril@gmail.com> Link: https://patch.msgid.link/20260207221955.24132-1-04baril@gmail.com Signed-off-by: Takashi Iwai commit 0dddf20b4fd4afd59767acc144ad4da60259f21f Author: Qiliang Yuan Date: Wed Jan 28 21:26:14 2026 -0500 watchdog/hardlockup: simplify perf event probe and remove per-cpu dependency Simplify the hardlockup detector's probe path and remove its implicit dependency on pinned per-cpu execution. Refactor hardlockup_detector_event_create() to be stateless. Return the created perf_event pointer to the caller instead of directly modifying the per-cpu 'watchdog_ev' variable. This allows the probe path to safely manage a temporary event without the risk of leaving stale pointers should task migration occur. Link: https://lkml.kernel.org/r/20260129022629.2201331-1-realwujing@gmail.com Signed-off-by: Shouxin Sun Signed-off-by: Junnan Zhang Signed-off-by: Qiliang Yuan Signed-off-by: Qiliang Yuan Reviewed-by: Douglas Anderson Cc: Jinchao Wang Cc: Ingo Molnar Cc: Li Huafei Cc: Song Liu Cc: Thorsten Blum Cc: Wang Jinchao Cc: Yicong Yang Signed-off-by: Andrew Morton commit 76149d53502cf17ef3ae454ff384551236fba867 Author: Jinliang Zheng Date: Wed Jan 28 16:30:07 2026 +0800 procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng Acked-by: Oleg Nesterov Cc: David Hildenbrand Cc: Ingo Molnar Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: ruippan Cc: Usama Arif Signed-off-by: Andrew Morton commit cafe4074a7221dca2fa954dd1ab0cf99b6318e23 Author: Shengming Hu Date: Mon Jan 19 21:59:05 2026 +0800 watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() cpustat_tail indexes cpustat_util[], which is a NUM_SAMPLE_PERIODS-sized ring buffer. need_counting_irqs() currently wraps the index using NUM_HARDIRQ_REPORT, which only happens to match NUM_SAMPLE_PERIODS. Use NUM_SAMPLE_PERIODS for the wrap to keep the ring math correct even if the NUM_HARDIRQ_REPORT or NUM_SAMPLE_PERIODS changes. Link: https://lkml.kernel.org/r/tencent_7068189CB6D6689EB353F3D17BF5A5311A07@qq.com Fixes: e9a9292e2368 ("watchdog/softlockup: Report the most frequent interrupts") Signed-off-by: Shengming Hu Reviewed-by: Petr Mladek Cc: Ingo Molnar Cc: Mark Brown Cc: Thomas Gleixner Cc: Zhang Run Cc: Signed-off-by: Andrew Morton commit 9dc052234da736f7749f19ab6936342ec7dbe3ac Author: Alan Maguire Date: Fri Jan 16 09:17:30 2026 +0000 kcsan, compiler_types: avoid duplicate type issues in BPF Type Format Enabling KCSAN is causing a large number of duplicate types in BTF for core kernel structs like task_struct [1]. This is due to the definition in include/linux/compiler_types.h `#ifdef __SANITIZE_THREAD__ ... `#define __data_racy volatile .. `#else ... `#define __data_racy ... `#endif Because some objects in the kernel are compiled without KCSAN flags (KCSAN_SANITIZE) we sometimes get the empty __data_racy annotation for objects; as a result we get multiple conflicting representations of the associated structs in DWARF, and these lead to multiple instances of core kernel types in BTF since they cannot be deduplicated due to the additional modifier in some instances. Moving the __data_racy definition under CONFIG_KCSAN avoids this problem, since the volatile modifier will be present for both KCSAN and KCSAN_SANITIZE objects in a CONFIG_KCSAN=y kernel. Link: https://lkml.kernel.org/r/20260116091730.324322-1-alan.maguire@oracle.com Fixes: 31f605a308e6 ("kcsan, compiler_types: Introduce __data_racy type qualifier") Signed-off-by: Alan Maguire Reported-by: Nilay Shroff Tested-by: Nilay Shroff Suggested-by: Marco Elver Reviewed-by: Marco Elver Acked-by: Yonghong Song Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Bart van Assche Cc: Daniel Borkman Cc: Eduard Zingerman Cc: Hao Luo Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Jason A. Donenfeld Cc: Jiri Olsa Cc: John Fastabend Cc: Kees Cook Cc: KP Singh Cc: Martin KaFai Lau Cc: Miguel Ojeda Cc: Naman Jain Cc: Nathan Chancellor Cc: "Paul E . McKenney" Cc: Peter Zijlstra Cc: Stanislav Fomichev Cc: Uros Bizjak Cc: Signed-off-by: Andrew Morton commit 0758293d5dc88a45b910f46a0c7558bf6b09e01d Author: Tycho Andersen (AMD) Date: Fri Jan 23 12:05:06 2026 -0700 kho: fix doc for kho_restore_pages() This function returns NULL if kho_restore_page() returns NULL, which happens in a couple of corner cases. It never returns an error code. Link: https://lkml.kernel.org/r/20260123190506.1058669-1-tycho@kernel.org Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit f653ff7af96951faa69c68665d44bed80702544f Author: Pasha Tatashin Date: Thu Dec 18 10:57:52 2025 -0500 tests/liveupdate: add in-kernel liveupdate test Introduce an in-kernel test module to validate the core logic of the Live Update Orchestrator's File-Lifecycle-Bound feature. This provides a low-level, controlled environment to test FLB registration and callback invocation without requiring userspace interaction or actual kexec reboots. The test is enabled by the CONFIG_LIVEUPDATE_TEST Kconfig option. Link: https://lkml.kernel.org/r/20251218155752.3045808-6-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Cc: Alexander Graf Cc: David Gow Cc: David Matlack Cc: David Rientjes Cc: Jonathan Corbet Cc: Kees Cook Cc: Mike Rapoport Cc: Petr Mladek Cc: Pratyush Yadav Cc: Samiullah Khawaja Cc: Tamir Duberstein Signed-off-by: Andrew Morton commit cab056f2aae7250af50e503b81a80dfc567a1acd Author: Pasha Tatashin Date: Thu Dec 18 10:57:51 2025 -0500 liveupdate: luo_flb: introduce File-Lifecycle-Bound global state Introduce a mechanism for managing global kernel state whose lifecycle is tied to the preservation of one or more files. This is necessary for subsystems where multiple preserved file descriptors depend on a single, shared underlying resource. An example is HugeTLB, where multiple file descriptors such as memfd and guest_memfd may rely on the state of a single HugeTLB subsystem. Preserving this state for each individual file would be redundant and incorrect. The state should be preserved only once when the first file is preserved, and restored/finished only once the last file is handled. This patch introduces File-Lifecycle-Bound (FLB) objects to solve this problem. An FLB is a global, reference-counted object with a defined set of operations: - A file handler (struct liveupdate_file_handler) declares a dependency on one or more FLBs via a new registration function, liveupdate_register_flb(). - When the first file depending on an FLB is preserved, the FLB's .preserve() callback is invoked to save the shared global state. The reference count is then incremented for each subsequent file. - Conversely, when the last file is unpreserved (before reboot) or finished (after reboot), the FLB's .unpreserve() or .finish() callback is invoked to clean up the global resource. The implementation includes: - A new set of ABI definitions (luo_flb_ser, luo_flb_head_ser) and a corresponding FDT node (luo-flb) to serialize the state of all active FLBs and pass them via Kexec Handover. - Core logic in luo_flb.c to manage FLB registration, reference counting, and the invocation of lifecycle callbacks. - An API (liveupdate_flb_get/_incoming/_outgoing) for other kernel subsystems to safely access the live object managed by an FLB, both before and after the live update. This framework provides the necessary infrastructure for more complex subsystems like IOMMU, VFIO, and KVM to integrate with the Live Update Orchestrator. Link: https://lkml.kernel.org/r/20251218155752.3045808-5-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Cc: Alexander Graf Cc: David Gow Cc: David Matlack Cc: David Rientjes Cc: Jonathan Corbet Cc: Kees Cook Cc: Mike Rapoport Cc: Petr Mladek Cc: Pratyush Yadav Cc: Samiullah Khawaja Cc: Tamir Duberstein Signed-off-by: Andrew Morton commit 6845645eef81da64b916743e3f8d696ec1fb0a13 Author: Pasha Tatashin Date: Thu Dec 18 10:57:50 2025 -0500 liveupdate: luo_file: Use private list Switch LUO to use the private list iterators. Link: https://lkml.kernel.org/r/20251218155752.3045808-4-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Cc: Alexander Graf Cc: David Gow Cc: David Matlack Cc: David Rientjes Cc: Jonathan Corbet Cc: Kees Cook Cc: Mike Rapoport Cc: Petr Mladek Cc: Pratyush Yadav Cc: Samiullah Khawaja Cc: Tamir Duberstein Signed-off-by: Andrew Morton commit 66bd8501ceb4782b10dfa009085d9b3f4efecad6 Author: Pasha Tatashin Date: Thu Dec 18 10:57:49 2025 -0500 list: add kunit test for private list primitives Add a KUnit test suite for the new private list primitives. The test defines a struct with a __private list_head and exercises every macro defined in . This ensures that the macros correctly handle the ACCESS_PRIVATE() abstraction and compile without warnings when acting on private members, verifying that qualifiers are stripped and offsets are calculated correctly. Link: https://lkml.kernel.org/r/20251218155752.3045808-3-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: David Gow Cc: Alexander Graf Cc: David Matlack Cc: David Rientjes Cc: Jonathan Corbet Cc: Kees Cook Cc: Mike Rapoport Cc: Petr Mladek Cc: Pratyush Yadav Cc: Samiullah Khawaja Cc: Tamir Duberstein Signed-off-by: Andrew Morton commit 989b3c5af63ecb1cbaf1598fe3f79865538bc1ea Author: Pasha Tatashin Date: Thu Dec 18 10:57:48 2025 -0500 list: add primitives for private list manipulations Patch series "list private v2 & luo flb", v9. This series introduces two connected infrastructure improvements: a new API for handling private linked lists, and the "File-Lifecycle-Bound" (FLB) mechanism for the Live Update Orchestrator. 1. Private List Primitives (patches 1-3) Recently, Linux introduced the ability to mark structure members as __private and access them via ACCESS_PRIVATE(). This enforces better encapsulation by ensuring internal details are only accessible by the owning subsystem. However, struct list_head is frequently used as an internal linkage mechanism within these private sections. The standard macros in do not support ACCESS_PRIVATE() natively. Consequently, subsystems using private lists are forced to implement ad-hoc workarounds or local iterator macros. This series adds , providing a set of primitives identical to those in but designed for private list heads. It also includes a KUnit test suite to verify that the macros correctly handle pointer offsets and qualifiers. 2. This series adds FLB (patches 4-5) support to Live Update that also internally uses private lists. FLB allows global kernel state (such as IOMMU domains or HugeTLB state) to be preserved once, shared across multiple file descriptors, and restored when needed. This is necessary for subsystems where multiple preserved file descriptors depend on a single, shared underlying resource. Preserving this state for each individual file would be redundant and incorrect. FLB uses reference counting tied to the lifecycle of preserved files. The state is preserved when the first file depending on it is preserved, and restored or cleaned up only when the last file is handled. This patch (of 5): Linux recently added an ability to add private members to structs (i.e. __private) and access them via ACCESS_PRIVATE(). This ensures that those members are only accessible by the subsystem which owns the struct type, and not to the object owner. However, struct list_head often needs to be placed into the private section to be manipulated privately by the subsystem. Add macros to support private list manipulations in . [akpm@linux-foundation.org: fix kerneldoc] Link: https://lkml.kernel.org/r/20251218155752.3045808-1-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20251218155752.3045808-2-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Cc: Alexander Graf Cc: David Gow Cc: David Matlack Cc: David Rientjes Cc: Jonathan Corbet Cc: Kees Cook Cc: Mike Rapoport Cc: Petr Mladek Cc: Pratyush Yadav Cc: Samiullah Khawaja Cc: Tamir Duberstein Signed-off-by: Andrew Morton commit 90079798f1d748e97c74e23736491543577b8aee Author: Arnd Bergmann Date: Mon Feb 2 10:59:00 2026 +0100 delayacct: fix uapi timespec64 definition The custom definition of 'struct timespec64' is incompatible with both the kernel's internal definition and the glibc type, at least on big-endian targets that have the tv_nsec field in a different place, and the definition clashes with any userspace that also defines a timespec64 structure. Running the header check with -Wpadding enabled produces this output that warns about the incorrect padding: usr/include/linux/taskstats.h:25:1: error: padding struct size to alignment boundary with 4 bytes [-Werror=padded] Remove the hack and instead use the regular __kernel_timespec type that is meant to be used in uapi definitions. Link: https://lkml.kernel.org/r/20260202095906.1344100-1-arnd@kernel.org Fixes: 29b63f6eff0e ("delayacct: add timestamp of delay max") Signed-off-by: Arnd Bergmann Cc: Fan Yu Cc: Jonathan Corbet Cc: xu xin Cc: Yang Yang Cc: Balbir Singh Cc: Jiang Kun Signed-off-by: Andrew Morton commit d8ad80a85b96649a6ef30976762660245ae61a25 Author: Thomas Weißschuh Date: Thu Feb 5 21:49:58 2026 +0100 kbuild: remove dependency of run-command on config The run-command target does not always require a kernel configuration to be present. Drop the dependency so it can be executed without one. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20260205-kbuild-run-command-v1-1-b8cbbc3db270@weissschuh.net Signed-off-by: Nathan Chancellor commit 007be4327e443d79c9dd9e56dc16c36f6395d208 Author: Gui-Dong Han Date: Tue Feb 3 20:14:43 2026 +0800 hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race Simply copying shared data to a local variable cannot prevent data races. The compiler is allowed to optimize away the local copy and re-read the shared memory, causing a Time-of-Check Time-of-Use (TOCTOU) issue if the data changes between the check and the usage. To enforce the use of the local variable, use READ_ONCE() when reading the shared data and WRITE_ONCE() when updating it. Apply these macros to the three identified locations (curr_sense, adc, and fault) where local variables are used for error validation, ensuring the value remains consistent. Reported-by: Ben Hutchings Closes: https://lore.kernel.org/all/6fe17868327207e8b850cf9f88b7dc58b2021f73.camel@decadent.org.uk/ Fixes: f5bae2642e3d ("hwmon: Driver for MAX16065 System Manager and compatibles") Fixes: b8d5acdcf525 ("hwmon: (max16065) Use local variable to avoid TOCTOU") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20260203121443.5482-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit ddb2325ed1e1219316bff8f8126be297aedba6b6 Author: Filippo Muscherà Date: Sun Feb 1 21:27:21 2026 +0100 hwmon: (nct6775) use sysfs_emit instead of sprintf Replace sprintf() with sysfs_emit() in sysfs 'show' functions. sysfs_emit() is preferred because it automatically handles the buffer size and PAGE_SIZE boundary checks, preventing potential buffer overflows. This aligns the legacy code with the new functions in the driver that already utilize sysfs_emit. Signed-off-by: Filippo Muscherà Link: https://lore.kernel.org/r/20260201202721.3871-1-filippo.muschera@gmail.com Signed-off-by: Guenter Roeck commit eaeb29ce7c4aecd9652797ee99e90f1523f3fc24 Author: Randy Dunlap Date: Tue Jan 27 16:22:00 2026 -0800 hwmon: pmbus: fix table in STEF48H28 documentation "make htmldocs" reports build errors/warnings: Documentation/hwmon/stef48h28.rst:45: ERROR: Missing matching underline for section title overline. ========================================================= in1_label "vin". in1_input Measured voltage. From READ_VIN register. [docutils] Documentation/hwmon/stef48h28.rst:73: WARNING: Title underline too short. temp2_input Measured temperature. From READ_TEMPERATURE_2 register. ========================================================= [docutils] Fix the table overline/underline line lengths and convert it to a 2-column table. Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20260128002200.1665941-1-rdunlap@infradead.org Signed-off-by: Guenter Roeck commit 669cf162f7a133099c7dc5db96f8283c98e73f1d Author: Vasileios Amoiridis Date: Mon Jan 19 20:08:06 2026 +0100 hwmon: Add support for HiTRON HAC300S PSU Add Support for HiTRON HAC300S PSU. This is a AC/DC hot-swappable CompactPCI Serial Dual output active current sharing switching power supply with a 312W rating. Signed-off-by: Vasileios Amoiridis Link: https://lore.kernel.org/r/20260119190806.35276-3-vassilisamir@gmail.com [groeck: Fix whitespace / alignment problems; return -ENODATA from hac300s_read_byte_data() if the PMBus core can handle the operation] Signed-off-by: Guenter Roeck commit 438921da7b795018d832b40955d47a42d0d53e4d Author: Vasileios Amoiridis Date: Mon Jan 19 20:08:05 2026 +0100 dt-bindings: trivial-devices: Add hitron,hac300s Add HiTRON HAC300S PSU to trivial devices since it is simple PMBUS capable device. Since this is the first supported device from this vendor, document its name to the vendor-prefixes.yaml file as well. Signed-off-by: Vasileios Amoiridis Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260119190806.35276-2-vassilisamir@gmail.com Signed-off-by: Guenter Roeck commit afa7c56ec447315ab38182bb9c185d8ea712c3ad Author: Thomas Weißschuh Date: Sun Jan 18 10:45:58 2026 +0100 hwmon: (cros_ec) Add support for temperature thresholds Implement reading temperature thresholds through EC_CMD_THERMAL_GET_THRESHOLD/EC_CMD_THERMAL_SET_THRESHOLD. Thresholds are mapped as follows between the EC and hwmon: hwmon_temp_max - EC_TEMP_THRESH_WARN hwmon_temp_crit - EC_TEMP_THRESH_HIGH hwmon_temp_emergency - EC_TEMP_THRESH_HALT Signed-off-by: Thomas Weißschuh Reviewed-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260118-cros_ec-hwmon-pwm-v2-4-77eb1709b031@weissschuh.net [groeck: Rearrange code to no longer use unreachable() since that causes a hiccup with some versions of gcc and objtool] Signed-off-by: Guenter Roeck commit 9cb8b0f289560728dbb8b88158e7a957e2e90a14 Author: Breno Leitao Date: Fri Feb 6 03:18:02 2026 -0800 workqueue: replace BUG_ON with panic in panic_on_wq_watchdog Replace BUG_ON() with panic() in panic_on_wq_watchdog(). This is not a bug condition but a deliberate forced panic requested by the user via module parameters to crash the system for debugging purposes. Using panic() instead of BUG_ON() makes this intent clearer and provides more informative output about which threshold was exceeded and the actual values, making it easier to diagnose the stall condition from crash dumps. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit f84c9dd34e8dce3fb42598344da711573b383626 Author: Breno Leitao Date: Fri Feb 6 03:18:01 2026 -0800 workqueue: add time-based panic for stalls Add a new module parameter 'panic_on_stall_time' that triggers a panic when a workqueue stall persists for longer than the specified duration in seconds. Unlike 'panic_on_stall' which counts accumulated stall events, this parameter triggers based on the duration of a single continuous stall. This is useful for catching truly stuck workqueues rather than accumulating transient stalls. Usage: workqueue.panic_on_stall_time=120 This would panic if any workqueue pool has been stalled for 120 seconds or more. The stall duration is measured from the workqueue last progress (poll_ts) which accounts for legitimate system stalls. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 319e3ff5ed7bc16a9932423159b1665418a1a9a0 Author: Bera Yüzlü Date: Sat Feb 7 17:02:05 2026 +0300 staging: rtl8723bs: refactor ODM_SetIQCbyRFpath to reduce duplication Refactor ODM_SetIQCbyRFpath to remove duplicated PHY_SetBBReg() calls and improve readability. The original implementation duplicated the same PHY_SetBBReg() calls for both RF paths (S0 / S1) with only the path index changing. This reduces code duplication, makes the intent clearer and eases future maintenance. No functional change intended: register keys/values and the selection logic remain the same. Signed-off-by: Bera Yüzlü Link: https://patch.msgid.link/aYdF3QYfFHYk3Lpe@BERA.localdomain Signed-off-by: Greg Kroah-Hartman commit 11c6c251fa9fa78c834c864639b42a53a8b2064e Author: Tan Kai Zhe Date: Sat Feb 7 14:13:13 2026 +0800 staging: rtl8723bs: rename CamelCase function Set_MSR to set_msr Adhere to Linux kernel coding style. Reported by checkpatch: CHECK: Avoid CamelCase: Signed-off-by: Tan Kai Zhe Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260207061313.20103-1-kaizhetan@yahoo.com Signed-off-by: Greg Kroah-Hartman commit bad0520ee2b755769a06f439d590882e4adf24da Author: Tan Kai Zhe Date: Fri Feb 6 08:18:33 2026 +0800 staging: rtl8723bs: remove unnecessary blank lines in rtw_io.c Adhere to Linux kernel coding style. Reported by checkpatch: CHECK: Blank lines aren't necessary before a close brace '}' Signed-off-by: Tan Kai Zhe Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260206001833.16857-1-kaizhetan@yahoo.com Signed-off-by: Greg Kroah-Hartman commit a20463de5166e6d1b66150c7702f3557a0bc71d4 Author: Haroen Tmimi Date: Thu Feb 5 15:51:59 2026 +0100 staging: rtl8723bs: remove stale TODO item regarding %pM The TODO list asks to "find codes that can use %pM and %Nph formatting". A grep of the driver directory shows that no manual MAC address formatting (using "%02x:%02x:..) remains in the code, thus all instances appear to have been converted to use "%pM". Remove the stale entry from the TODO list. Signed-off-by: Haroen Tmimi Link: https://patch.msgid.link/20260205145159.185981-1-tmimiharoen@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0dced5c061bb9064e6ead08d75ac7ad6ce95e885 Author: Minu Jin Date: Wed Feb 4 22:13:47 2026 +0900 staging: rtl8723bs: remove unused allocation wrapper functions Remove the custom memory allocation wrapper functions and macros from osdep_service.c and osdep_service.h as they are no longer used. Signed-off-by: Minu Jin Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260204131347.3515949-6-s9430939@naver.com Signed-off-by: Greg Kroah-Hartman commit 9fe6f146a3b24e0c8232f817f19d364084d24745 Author: Minu Jin Date: Wed Feb 4 22:13:46 2026 +0900 staging: rtl8723bs: use standard skb allocation APIs Replace custom wrappers rtw_skb_alloc() and rtw_skb_copy() with standard kernel APIs __dev_alloc_skb() and skb_copy(). About GFP Flags: - GFP_ATOMIC is used for allocations in atomic contexts such as spinlock-protected sections, tasklets, and timer handlers. - GFP_KERNEL is used for process contexts where sleeping is allowed. Signed-off-by: Minu Jin Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260204131347.3515949-5-s9430939@naver.com Signed-off-by: Greg Kroah-Hartman commit 980cd426a25747daf8ed25e2a1904b2d26ffbb3d Author: Minu Jin Date: Wed Feb 4 22:13:45 2026 +0900 staging: rtl8723bs: replace rtw_zmalloc() with kzalloc() Replace the wrapper function rtw_zmalloc() with standard kzalloc(). Use kzalloc() for rtw_malloc() calls that were followed by manual zero initialization. About GFP Flags: - GFP_ATOMIC is used for allocations in atomic contexts such as spinlock-protected sections, tasklets, and timer handlers. - GFP_KERNEL is used for process contexts where sleeping is allowed. Additionally, use array_size() and size_add() to prevent potential integer overflows during allocation size calculation. Signed-off-by: Minu Jin Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260204131347.3515949-4-s9430939@naver.com Signed-off-by: Greg Kroah-Hartman commit 9577f3b3332b499202ce533cb0e25e2ea58abc9e Author: Minu Jin Date: Wed Feb 4 22:13:44 2026 +0900 staging: rtl8723bs: replace rtw_malloc() with kmalloc() Replace the wrapper function rtw_malloc() with standard kmalloc(). Call sites were reviewed to use appropriate GFP flags (GFP_KERNEL or GFP_ATOMIC) based on the execution context. About GFP Flags: - GFP_ATOMIC is used for allocations in atomic contexts such as spinlock-protected sections, tasklets, and timer handlers. - GFP_KERNEL is used for process contexts where sleeping is allowed. Also, convert error return codes from -1 to -ENOMEM where appropriate. Signed-off-by: Minu Jin Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260204131347.3515949-3-s9430939@naver.com Signed-off-by: Greg Kroah-Hartman commit 5ed9ef2703adafbbc02258de76c07fa604a354de Author: Minu Jin Date: Wed Feb 4 22:13:43 2026 +0900 staging: rtl8723bs: introduce kmemdup() where applicable Replace memory allocation followed by memcpy() with kmemdup() to simplify the code and improve readability. About GFP Flags: - GFP_ATOMIC is used for allocations in atomic contexts such as spinlock-protected sections, tasklets, and timer handlers. - GFP_KERNEL is used for process contexts where sleeping is allowed. Specifically, in OnAssocReq(), GFP_ATOMIC is used because the allocation is performed while holding a spin lock. Signed-off-by: Minu Jin Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260204131347.3515949-2-s9430939@naver.com Signed-off-by: Greg Kroah-Hartman commit ab67d4c6d5d33f408df9a43d0fa94f54a32995a8 Author: Christine Ramacha Date: Wed Feb 4 14:50:43 2026 +0000 staging: sm750fb: Clean up variable names Variables in sm750_accel.c follow a mix of camelCase convention and Hungarian shorthands. Rename it to adhere to kernel's snake_case naming convention and improve readability. Signed-off-by: Christine Ramacha Link: https://patch.msgid.link/20260204145107.5521-1-christine.rv4573@gmail.com Signed-off-by: Greg Kroah-Hartman commit 41460a19654c32d39fd0e3a3671cd8d4b7b8479f Author: Ethan Tidmore Date: Mon Feb 2 14:54:29 2026 -0600 staging: rtl8723bs: fix null dereference in find_network The variable pwlan has the possibility of being NULL when passed into rtw_free_network_nolock() which would later dereference the variable. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Cc: stable@vger.kernel.org Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260202205429.20181-1-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 17d2ff404153a616b4b9426a46021c199fe69568 Author: Archit Anant Date: Fri Jan 30 13:21:13 2026 +0530 staging: rtl8723bs: use unaligned access macros in rtw_security.c The driver defines custom functions secmicgetuint32() and secmicputuint32() to handle little-endian byte-to-integer conversion. This is redundant as the kernel provides optimized standard macros for this purpose in . Replace the custom implementations with get_unaligned_le32() and put_unaligned_le32() and delete the now-unused local functions. Signed-off-by: Archit Anant Reviewed-by: Ethan Tidmore Link: https://patch.msgid.link/20260130075113.34666-1-architanant5@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1585cf83e98db32463e5d54161b06a5f01fe9976 Author: Takashi Iwai Date: Sat Feb 7 14:13:17 2026 +0100 ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 It was reported that we need the same quirk for HP ZBook Studio G4 (SSID 103c:826b) as other HP models to make the mute-LED working. Cc: Link: https://lore.kernel.org/64d78753-b9ff-4c64-8920-64d8d31cd20c@gmail.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=221002 Link: https://patch.msgid.link/20260207131324.2428030-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 02df7c635bd3463abcd92414e32a2cb906089e72 Author: Minu Jin Date: Sun Feb 1 02:11:53 2026 +0900 staging: rtl8723bs: fix potential race in expire_timeout_chk The expire_timeout_chk function currently do lock and unlock inside the loop before calling rtw_free_stainfo(). This can be risky as the list might be changed when the lock is briefly released. To fix this, move expired sta_info entries into a local free_list while holding the lock, and then perform the actual freeing after the lock is released. Signed-off-by: Minu Jin Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260131171153.3729458-1-s9430939@naver.com Signed-off-by: Greg Kroah-Hartman commit 8ae0398e70d9d64309708471cf7747097a5f755e Author: Luka Gejak Date: Fri Jan 30 19:56:58 2026 +0100 staging: rtl8723bs: remove dead debugging code in rtw_mlme_ext.c Remove the unused local variable 'pattrib' and the unreachable 'if (0)' debug block in OnAction_sa_query to clean up the driver code. Signed-off-by: Luka Gejak Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260130185658.207785-6-lukagejak5@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3db124820614e0ce66def7dc86458fc70330be69 Author: Luka Gejak Date: Fri Jan 30 19:56:57 2026 +0100 staging: rtl8723bs: modernize hex output in rtw_report_sec_ie Replace the manual hex-printing loop with the standard kernel '%*ph' format string. This simplifies the code and uses modern logging practices. Signed-off-by: Luka Gejak Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260130185658.207785-5-lukagejak5@gmail.com Signed-off-by: Greg Kroah-Hartman commit 908c03bf95eb8977afd4fdf5a5338fd1077968e4 Author: Luka Gejak Date: Fri Jan 30 19:56:56 2026 +0100 staging: rtl8723bs: fix spacing around operators Fix coding style issues by adding missing spaces around operators. Signed-off-by: Luka Gejak Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260130185658.207785-4-lukagejak5@gmail.com Signed-off-by: Greg Kroah-Hartman commit 01e28097a0a8c79be02d1abe27dfa16138994e2c Author: Luka Gejak Date: Fri Jan 30 19:56:55 2026 +0100 staging: rtl8723bs: rename u1bTmp to val Rename the variable u1bTmp to val to remove Hungarian notation. This improves readability and aligns the code with kernel naming standards. Signed-off-by: Luka Gejak Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260130185658.207785-3-lukagejak5@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7de30d5d76aa614777a02a9807d29ed65b0704a0 Author: Ethan Tidmore Date: Sat Jan 31 15:21:28 2026 -0600 staging: rtl8723bs: remove unused private debug counters The driver maintains a private `struct debug_priv` embedded within `struct dvobj_priv` to track various error counters (e.g., suspend errors, alloc failures, RX drops). These counters are incremented in various files but the data is never read or exposed to userspace. Remove the unused `debug_priv` structure definition, the instance in `dvobj_priv`, and all associated increment operations across the driver to clean up the code. This also removes the following helper functions which were used solely to update these counters: - rtw_reset_rx_info() - recv_indicatepkts_pkt_loss_cnt() Signed-off-by: Ethan Tidmore Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260131212128.25548-1-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit c41ac3530710e9d49e0ddd5e6f338407f6d4ab00 Author: Samasth Norway Ananda Date: Thu Jan 29 16:16:41 2026 -0800 staging: rtl8723bs: remove thread wraper functions and add IS_ERR() check The rtl8723b_start_thread() and rtl8723b_stop_thread() functions are wrappers that are only called from one place each. Remove these wrapper functions and inline the thread handling directly in rtw_start_drv_threads() and rtw_stop_drv_threads(). This also fixes a bug where kthread_run() was not checked for errors using IS_ERR(). kthread_run() returns ERR_PTR(-ENOMEM) on failure, not NULL. Without this check, the SdioXmitThread pointer could contain an error value, causing issues when rtw_stop_drv_threads() later attempts to use it. The inlined code now follows the same pattern as xmitThread and cmdThread in rtw_start_drv_threads(), with proper IS_ERR() checking. Suggested-by: Greg Kroah-Hartman Signed-off-by: Samasth Norway Ananda Link: https://patch.msgid.link/20260130001641.17941-4-samasth.norway.ananda@oracle.com Signed-off-by: Greg Kroah-Hartman commit 4dba9d6c691327f06276619ae97bab8aa48b2dbe Author: Samasth Norway Ananda Date: Thu Jan 29 16:16:39 2026 -0800 staging: rtl8723bs: fix firmware memory leak on error After successfully calling request_firmware(), if the firmware size check fails or if kmemdup() fails, the code jumps to the exit label without calling release_firmware(), causing a memory leak. Call release_firmware() directly in each error path before jumping to cleanup label. Signed-off-by: Samasth Norway Ananda Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260130001641.17941-2-samasth.norway.ananda@oracle.com Signed-off-by: Greg Kroah-Hartman commit a6fe09b40b610ca0d459fdc53524cc923df0d2e1 Author: Siwanan Bungtong Date: Fri Jan 30 05:17:19 2026 +0700 staging: rtl8723bs: remove unnecessary parentheses Remove redundant parentheses around 'address of' expressions to comply with kernel coding style. Signed-off-by: Siwanan Bungtong Link: https://patch.msgid.link/20260129221719.943285-1-horstaufmental@gmail.com Signed-off-by: Greg Kroah-Hartman commit c42727601a4f83441baf5d21770c9196d3795824 Author: Colin Ian King Date: Thu Jan 29 16:10:58 2026 +0000 staging: rtl8723bs: remove redundant check on status The check on status can be removed because all previous assignments on status are followed by a goto statement that bypasses the status check. This minor issue was detected with Coverity Scan static analysis. Remove the redundant check and some empty lines. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20260129161058.197372-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman commit 500cf758c865fb6fb8c1f70e6b020729928647c1 Author: Mahad Ibrahim Date: Thu Jan 29 21:04:26 2026 +0500 staging: rtl8723bs: standardize comment style in HAL The kernel coding style for comments requires a single space after the "/*". Currently, many files in HAL contain two spaces after the "/*", or use irregular indentation. The modified files also suffer from this. Fix line comment style inconsistencies by removing additional space after "/*" to adhere to kernel coding standards. Signed-off-by: Mahad Ibrahim Link: https://patch.msgid.link/20260129160426.13737-6-mahad.ibrahim.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit d4f0c3edccddc0af112714f73c35a58892d31b03 Author: Mahad Ibrahim Date: Thu Jan 29 21:04:25 2026 +0500 staging: rtl8723bs: fix line length check Fix checkpatch.pl check regarding: - Line length of X exceeds 100 columns Redistribute comments to multiple lines to adhere to kernel coding standards. Signed-off-by: Mahad Ibrahim Link: https://patch.msgid.link/20260129160426.13737-5-mahad.ibrahim.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit ce154efc0463707ecac422750f6ecf0fb199f97b Author: Mahad Ibrahim Date: Thu Jan 29 21:04:24 2026 +0500 staging: rtl8723bs: fix missing blank line after declaration Fix checkpatch.pl warning regarding: - Missing a blank line after declarations Adhere to kernel coding standards by adding a blank line after variable declaration. Signed-off-by: Mahad Ibrahim Link: https://patch.msgid.link/20260129160426.13737-4-mahad.ibrahim.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit d868ba303275e6454f38f71799d4e0c26fe786b2 Author: Mahad Ibrahim Date: Thu Jan 29 21:04:23 2026 +0500 staging: rtl8723bs: fix multiple blank line check Fix checkpatch.pl check regarding: - Please don't use multiple blank lines Remove multiple blank lines to adhere to kernel coding standards. Signed-off-by: Mahad Ibrahim Link: https://patch.msgid.link/20260129160426.13737-3-mahad.ibrahim.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2a9fa972e3082343e0bb103bb272b7c604fa303a Author: Mahad Ibrahim Date: Thu Jan 29 21:04:22 2026 +0500 staging: rtl8723bs: fix open parenthesis alignment Fix checkpatch.pl check regarding: - Lines should not end with a '(' Collapse the multi-line function signature of CheckPositive() into a single line to adhere to kernel coding standards. Signed-off-by: Mahad Ibrahim Link: https://patch.msgid.link/20260129160426.13737-2-mahad.ibrahim.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit 54911107352dfe04b56828dd9f81fd570c1b76b0 Author: Minu Jin Date: Thu Feb 5 11:16:20 2026 +0900 staging: most: video: fix potential race in list iteration There is a pattern in the loops where the lock is dropped to call a specific function and then re-acquired. The list can be exposed during this short gap, creating a potential race condition. This patch fixes the problem by replacing the list head with a local free list using list_replace_init(), instead of using the lock/unlock pattern in the loop. Signed-off-by: Minu Jin Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260205021620.1165137-1-s9430939@naver.com Signed-off-by: Greg Kroah-Hartman commit ad3521dc9c2f9b369f57de1bbcc14f85458a3828 Author: Tanjim Kamal Date: Wed Jan 28 17:38:59 2026 +0600 staging: rtl8723bs: constify _action_public_str array This array is never modified. Add a second const to make the array itself be placed in read-only .rodata instead of just the strings it points to. Fix a WARNING issued by scripts/checkpatch.pl. Signed-off-by: Tanjim Kamal Reviewed-by: Ethan Tidmore Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260128113900.44852-1-tanjimkamal1@gmail.com Signed-off-by: Greg Kroah-Hartman commit 11f4e5250241529198c96da37a5258ee3e9dfe7f Author: Louis Lesniak Date: Wed Jan 28 16:44:07 2026 +0100 staging: rtl8723bs: remove unnecessary braces Remove braces from single statement if blocks to adhere to the Linux kernel coding style. Signed-off-by: Louis Lesniak Link: https://patch.msgid.link/20260128154407.42421-1-louis.lesniak2@gmail.com Signed-off-by: Greg Kroah-Hartman commit b59f9bc5f372390157bff6a00a288cebb2c543af Author: Minu Jin Date: Wed Jan 28 00:38:10 2026 +0900 staging: rtl8723bs: clean up _rtw_pktfile_read() Clean up the function by changing 'uint' to 'unsigned int' to comply with the kernel coding style, as suggested by Andy Shevchenko. Signed-off-by: Minu Jin Link: https://patch.msgid.link/20260127153811.1592900-3-s9430939@naver.com Signed-off-by: Greg Kroah-Hartman commit bc4df274dca66a8f534feff5d3e1881f3c9b9bf6 Author: Minu Jin Date: Wed Jan 28 00:38:09 2026 +0900 staging: rtl8723bs: update _rtw_pktfile_read() to return error codes The function _rtw_pktfile_read() currently returns a uint and clamps the requested read length if it exceeds the remaining data. This behavior makes it impossible to propagate error codes from internal calls like skb_copy_bits() and leads to incomplete data processing. This patch updates the function to: 1. Return -EINVAL if the remaining data is less than the requested length, ensuring callers always get the full amount of data they expect. 2. Propagate the negative error code from skb_copy_bits(). 3. Change the return type from uint to int to support these error codes. To avoid breaking git bisect, this patch also updates all call sites (set_qos, update_attrib, and rtw_xmitframe_coalesce) in the same commit. By doing so, the error-producing function and its error-handling callers remain in sync, preventing runtime failures at this commit point. Signed-off-by: Minu Jin Link: https://patch.msgid.link/20260127153811.1592900-2-s9430939@naver.com Signed-off-by: Greg Kroah-Hartman commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 Author: Carl Lee Date: Thu Feb 5 19:11:39 2026 +0800 nfc: nxp-nci: remove interrupt trigger type For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and active high, not edge-triggered. Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail to trigger correctly. Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured via Device Tree. Signed-off-by: Carl Lee Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com Signed-off-by: Jakub Kicinski commit 6d2f142b1e4b203387a92519d9d2e34752a79dbb Author: Jian Shen Date: Thu Feb 5 20:17:19 2026 +0800 net: hns3: fix double free issue for tx spare buffer In hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure is created for rollback. However, the tx_spare pointer in the original ring handle is incorrectly left pointing to the old backup memory. Later, if memory allocation fails in hns3_init_all_ring() during the setup, the error path attempts to free all newly allocated rings. Since tx_spare contains a stale (non-NULL) pointer from the backup, it is mistaken for a newly allocated buffer and is erroneously freed, leading to a double-free of the backup memory. The root cause is that the tx_spare field was not cleared after its value was saved in tmp_rings, leaving a dangling pointer. Fix this by setting tx_spare to NULL in the original ring structure when the creation of the new `tx_spare` fails. This ensures the error cleanup path only frees genuinely newly allocated buffers. Fixes: 907676b130711 ("net: hns3: use tx bounce buffer for small packets") Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260205121719.3285730-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 1fdad81d880349756414b1a7d4e2a8bdf52664e6 Merge: 5826eec8710c21 35f66ce900370e Author: Jakub Kicinski Date: Fri Feb 6 20:48:35 2026 -0800 Merge branch 'big-tcp-without-hbh-in-ipv6' Alice Mikityanska says: ==================== BIG TCP without HBH in IPv6 Resubmitting after the grace period. This series is part 1 of "BIG TCP for UDP tunnels". Due to the number of patches, I'm splitting it into two logical parts: * Remove hop-by-hop header for BIG TCP IPv6 to align with BIG TCP IPv4. * Fix up things that prevent BIG TCP from working with UDP tunnels. The current BIG TCP IPv6 code inserts a hop-by-hop extension header with 32-bit length of the packet. When the packet is encapsulated, and either the outer or the inner protocol is IPv6, or both are IPv6, there will be 1 or 2 HBH headers that need to be dealt with. The issues that arise: 1. The drivers don't strip it, and they'd all need to know the structure of each tunnel protocol in order to strip it correctly, also taking into account all combinations of IPv4/IPv6 inner/outer protocols. 2. Even if (1) is implemented, it would be an additional performance penalty per aggregated packet. 3. The skb_gso_validate_network_len check is skipped in ip6_finish_output_gso when IP6SKB_FAKEJUMBO is set, but it seems that it would make sense to do the actual validation, just taking into account the length of the HBH header. When the support for tunnels is added, it becomes trickier, because there may be one or two HBH headers, depending on whether it's IPv6 in IPv6 or not. At the same time, having an HBH header to store the 32-bit length is not strictly necessary, as BIG TCP IPv4 doesn't do anything like this and just restores the length from skb->len. The same thing can be done for BIG TCP IPv6. Removing HBH from BIG TCP would allow to simplify the implementation significantly, and align it with BIG TCP IPv4, which has been a long-standing goal. ==================== Link: https://patch.msgid.link/20260205133925.526371-1-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 35f66ce900370ed0eab6553977adc0a2fb9cccfb Author: Alice Mikityanska Date: Thu Feb 5 15:39:25 2026 +0200 net/ipv6: Remove HBH helpers Now that the HBH jumbo helpers are not used by any driver or GSO, remove them altogether. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-13-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 28df1c69271cf826235a3e0f1ec083cc313fafe8 Author: Alice Mikityanska Date: Thu Feb 5 15:39:24 2026 +0200 bng_en: Remove jumbo_remove step from TX path Now that the kernel doesn't insert HBH for BIG TCP IPv6 packets, remove unnecessary steps from the bng_en TX path, that used to check and remove HBH. Signed-off-by: Alice Mikityanska Link: https://patch.msgid.link/20260205133925.526371-12-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit c0165fcb8d9f444817843964027ed191d85d66c4 Author: Alice Mikityanska Date: Thu Feb 5 15:39:23 2026 +0200 net: mana: Remove jumbo_remove step from TX path Now that the kernel doesn't insert HBH for BIG TCP IPv6 packets, remove unnecessary steps from the mana TX path, that used to check and remove HBH. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-11-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 275da93ce2b8fa2f82da1e8785d6f1930670ef88 Author: Alice Mikityanska Date: Thu Feb 5 15:39:22 2026 +0200 gve: Remove jumbo_remove step from TX path Now that the kernel doesn't insert HBH for BIG TCP IPv6 packets, remove unnecessary steps from the gve TX path, that used to check and remove HBH. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-10-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 3f1bff1d7fd2458c40147275c91650f7f1b4a7a2 Author: Alice Mikityanska Date: Thu Feb 5 15:39:21 2026 +0200 bnxt_en: Remove jumbo_remove step from TX path Now that the kernel doesn't insert HBH for BIG TCP IPv6 packets, remove unnecessary steps from the bnxt_en TX path, that used to check and remove HBH. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Reviewed-by: Michael Chan Link: https://patch.msgid.link/20260205133925.526371-9-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 8b76102c5e00d1f090e0c31d17b060c76d8fa859 Author: Alice Mikityanska Date: Thu Feb 5 15:39:20 2026 +0200 ice: Remove jumbo_remove step from TX path Now that the kernel doesn't insert HBH for BIG TCP IPv6 packets, remove unnecessary steps from the ice TX path, that used to check and remove HBH. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-8-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 94379a588037de77b823c325d8848d3be7d801f6 Author: Alice Mikityanska Date: Thu Feb 5 15:39:19 2026 +0200 net/mlx4: Remove jumbo_remove step from TX path Now that the kernel doesn't insert HBH for BIG TCP IPv6 packets, remove unnecessary steps from the mlx4 TX path, that used to check and remove HBH. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-7-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit bda5896e469c0f3b878c65df7b28baadd08281da Author: Alice Mikityanska Date: Thu Feb 5 15:39:18 2026 +0200 net/mlx5e: Remove jumbo_remove step from TX path Now that the kernel doesn't insert HBH for BIG TCP IPv6 packets, remove unnecessary steps from the mlx5e and mlx5i TX path, that used to check and remove HBH. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-6-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 1676ebba391dee944988ce3de1c23e038a3121d3 Author: Alice Mikityanska Date: Thu Feb 5 15:39:17 2026 +0200 net/ipv6: Remove jumbo_remove step from TX path Now that the kernel doesn't insert HBH for BIG TCP IPv6 packets, remove unnecessary steps from the GSO TX path, that used to check and remove HBH. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-5-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 81be30c1f5f2bffda1f04c0efd0746af10b9643a Author: Alice Mikityanska Date: Thu Feb 5 15:39:16 2026 +0200 net/ipv6: Drop HBH for BIG TCP on RX side Complementary to the previous commit, stop inserting HBH when building BIG TCP GRO SKBs. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-4-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 741d069aa488866ae8425f87ad270ed3815ccaac Author: Alice Mikityanska Date: Thu Feb 5 15:39:15 2026 +0200 net/ipv6: Drop HBH for BIG TCP on TX side BIG TCP IPv6 inserts a hop-by-hop extension header to indicate the real IPv6 payload length when it doesn't fit into the 16-bit field in the IPv6 header itself. While it helps tools parse the packet, it also requires every driver that supports TSO and BIG TCP to remove this 8-byte extension header. It might not sound that bad until we try to apply it to tunneled traffic. Currently, the drivers don't attempt to strip HBH if skb->encapsulation = 1. Moreover, trying to do so would require dissecting different tunnel protocols and making corresponding adjustments on case-by-case basis, which would slow down the fastpath (potentially also requiring adjusting checksums in outer headers). At the same time, BIG TCP IPv4 doesn't insert any extra headers and just calculates the payload length from skb->len, significantly simplifying implementing BIG TCP for tunnels. Stop inserting HBH when building BIG TCP GSO SKBs. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-3-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit b2936b4fd56294e49d6c8e9152ea6c4982757c7d Author: Alice Mikityanska Date: Thu Feb 5 15:39:14 2026 +0200 net/ipv6: Introduce payload_len helpers The next commits will transition away from using the hop-by-hop extension header to encode packet length for BIG TCP. Add wrappers around ip6->payload_len that return the actual value if it's non-zero, and calculate it from skb->len if payload_len is set to zero (and a symmetrical setter). The new helpers are used wherever the surrounding code supports the hop-by-hop jumbo header for BIG TCP IPv6, or the corresponding IPv4 code uses skb_ip_totlen (e.g., in include/net/netfilter/nf_tables_ipv6.h). No behavioral change in this commit. Signed-off-by: Alice Mikityanska Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260205133925.526371-2-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski commit 5826eec8710c214f02f253c165d66a230f5a86c3 Merge: a14d9317904559 85a9aaac4a38a7 Author: Jakub Kicinski Date: Fri Feb 6 20:44:24 2026 -0800 Merge branch 'dpll-zl3073x-include-current-frequency-in-supported-frequencies-list' Ivan Vecera says: ==================== dpll: zl3073x: Include current frequency in supported frequencies list This series ensures that the current operating frequency of a DPLL pin is always reported in its supported frequencies list. Problem: When a ZL3073x DPLL pin is registered, its supported frequencies are read from the firmware node's "supported-frequencies-hz" property. However, if the firmware node is missing, or doesn't include the current operating frequency, the pin reports a frequency that isn't in its supported list. This inconsistency can confuse userspace tools that expect the current frequency to be among the supported values. Solution: Always include the current pin frequency as the first entry in the supported frequencies list, followed by any additional frequencies from the firmware node (with duplicates filtered out). Patch 1 refactors the output pin frequency calculation into a reusable helper function zl3073x_dev_output_pin_freq_get(), which mirrors the existing zl3073x_dev_ref_freq_get() for input pins. Patch 2 modifies zl3073x_pin_props_get() to obtain the current frequency early and place it at index 0 of the supported frequencies array, ensuring it is always present regardless of firmware node contents. ==================== Link: https://patch.msgid.link/20260205154350.3180465-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 85a9aaac4a38a7ce68f30bd7678fca4e8c687fe2 Author: Ivan Vecera Date: Thu Feb 5 16:43:50 2026 +0100 dpll: zl3073x: Include current frequency in supported frequencies list Ensure the current pin frequency is always present in the list of supported frequencies reported to userspace. Previously, if the firmware node was missing or didn't include the current operating frequency in the supported-frequencies-hz property, the pin would report a frequency that wasn't in its supported list. Get the current frequency early in zl3073x_pin_props_get(): - For input pins: use zl3073x_dev_ref_freq_get() - For output pins: use zl3073x_dev_output_pin_freq_get() Place the current frequency at index 0 of the supported frequencies array, then append frequencies from the firmware node (if present), skipping any duplicate of the current frequency. Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260205154350.3180465-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 24e4336a87f5c51263535201218889b5f324511f Author: Ivan Vecera Date: Thu Feb 5 16:43:49 2026 +0100 dpll: zl3073x: Add output pin frequency helper Introduce zl3073x_dev_output_pin_freq_get() helper function to compute the output pin frequency based on synthesizer frequency, output divisor, and signal format. For N-div signal formats, the N-pin frequency is additionally divided by esync_n_period. Add zl3073x_out_is_ndiv() helper to check if an output is configured in N-div mode (2_NDIV or 2_NDIV_INV signal formats). Refactor zl3073x_dpll_output_pin_frequency_get() callback to use the new helper, reducing code duplication and enabling reuse of the frequency calculation logic in other contexts. This is a preparatory change for adding current frequency to the supported frequencies list in pin properties. Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260205154350.3180465-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 5d41f95f5d0bd9db02f3f16a649d0631f71e9fdb Author: Ivan Vecera Date: Thu Feb 5 19:10:55 2026 +0100 dpll: zl3073x: Fix output pin phase adjustment sign The output pin phase adjustment functions incorrectly negate the phase compensation value. Per the ZL3073x datasheet, the output phase compensation register is simply a signed two's complement integer where: - Positive values move the phase later in time - Negative values move the phase earlier in time No negation is required. The erroneous negation caused phase adjustments to be applied in the wrong direction. Note that input pin phase adjustment correctly uses negation because the hardware has an inverted convention for input references (positive moves phase earlier, negative moves phase later). Fixes: 6287262f761e ("dpll: zl3073x: Add support to adjust phase") Signed-off-by: Ivan Vecera Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260205181055.129768-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 7237d23d2e58367852e05da3a522ee422f2aa7d4 Merge: ee9241524b4682 53e553369167d3 Author: Jakub Kicinski Date: Fri Feb 6 20:35:10 2026 -0800 Merge branch 'mptcp-misc-fixes-for-v6-19-rc8' Matthieu Baerts says: ==================== mptcp: misc fixes for v6.19-rc8 Here are various unrelated fixes: - Patch 1: when removing an MPTCP in-kernel PM endpoint, always mark the corresponding ID as "available". Syzbot found a corner case where it is not marked as such. A fix for up to v5.10. - Patch 2: Linked to the previous patch, the variable name was confusing and was probably partly responsible for the issue fixed by patch 1. No "Fixes" tag: no need to backport that for the moment, but better to avoid confusion now. - Patch 3: fix all existing kdoc warnings linked to MPTCP code. No "Fixes" tag: they were there for a while, and not considered as important to backport. - Patch 4: silence a compiler (false-positive) warning in the selftests. No "Fixes" tag: it is a false-positive warning, only seen with some versions. ==================== Link: https://patch.msgid.link/20260205-net-mptcp-misc-fixes-6-19-rc8-v2-0-c2720ce75c34@kernel.org Signed-off-by: Jakub Kicinski commit 53e553369167d361bdd550d194122ac7cdb00f3c Author: Matthieu Baerts (NGI0) Date: Thu Feb 5 18:34:24 2026 +0100 selftests: mptcp: connect: fix maybe-uninitialize warn This warning can be seen with GCC 15.2: mptcp_connect.c: In function ‘main_loop’: mptcp_connect.c:1422:37: warning: ‘peer’ may be used uninitialized [-Wmaybe-uninitialized] 1422 | if (connect(fd, peer->ai_addr, peer->ai_addrlen)) | ~~~~^~~~~~~~~ mptcp_connect.c:1377:26: note: ‘peer’ was declared here 1377 | struct addrinfo *peer; | ^~~~ This variable is set in sock_connect_mptcp() in some conditions. If not, this helper returns an error, and the program stops. So this is a false positive, but better removing it by initialising peer to NULL. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260205-net-mptcp-misc-fixes-6-19-rc8-v2-4-c2720ce75c34@kernel.org Signed-off-by: Jakub Kicinski commit 136f1e168f4941021565f8c10ff4bb81b1f13f2c Author: Matthieu Baerts (NGI0) Date: Thu Feb 5 18:34:23 2026 +0100 mptcp: fix kdoc warnings The following warnings were visible: $ ./scripts/kernel-doc -Wall -none \ net/mptcp/ include/net/mptcp.h include/uapi/linux/mptcp*.h \ include/trace/events/mptcp.h Warning: net/mptcp/token.c:108 No description found for return value of 'mptcp_token_new_request' Warning: net/mptcp/token.c:151 No description found for return value of 'mptcp_token_new_connect' Warning: net/mptcp/token.c:246 No description found for return value of 'mptcp_token_get_sock' Warning: net/mptcp/token.c:298 No description found for return value of 'mptcp_token_iter_next' Warning: net/mptcp/protocol.c:4431 No description found for return value of 'mptcp_splice_read' Warning: include/uapi/linux/mptcp_pm.h:13 missing initial short description on line: * enum mptcp_event_type Address all of them: either by using the 'Return:' keyword, or by adding a missing initial short description. The MPTCP CI will soon report issues with kdoc to avoid introducing new issues and being flagged by the Netdev CI. Reviewed-by: Geliang Tang Reviewed-by: Randy Dunlap Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260205-net-mptcp-misc-fixes-6-19-rc8-v2-3-c2720ce75c34@kernel.org Signed-off-by: Jakub Kicinski commit 364a7084df9f6f1f9383c0c90bb68f9fa49447cd Author: Matthieu Baerts (NGI0) Date: Thu Feb 5 18:34:22 2026 +0100 mptcp: pm: in-kernel: clarify mptcp_pm_remove_anno_addr() The variable 'ret' was used, but it was not cleared what it was, and probably led to an issue [1]. Rename it to 'announced' to avoid confusions. While at it, remove the returned value of the helper: it is only used in one place, and the returned value is not used. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/606 [1] Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260205-net-mptcp-misc-fixes-6-19-rc8-v2-2-c2720ce75c34@kernel.org Signed-off-by: Jakub Kicinski commit d191101dee25567c2af3b28565f45346c33d65f5 Author: Matthieu Baerts (NGI0) Date: Thu Feb 5 18:34:21 2026 +0100 mptcp: pm: in-kernel: always set ID as avail when rm endp Syzkaller managed to find a combination of actions that was generating this warning: WARNING: net/mptcp/pm_kernel.c:1074 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1074 [inline], CPU#1: syz.7.48/2535 WARNING: net/mptcp/pm_kernel.c:1074 at mptcp_pm_nl_fullmesh net/mptcp/pm_kernel.c:1446 [inline], CPU#1: syz.7.48/2535 WARNING: net/mptcp/pm_kernel.c:1074 at mptcp_pm_nl_set_flags_all net/mptcp/pm_kernel.c:1474 [inline], CPU#1: syz.7.48/2535 WARNING: net/mptcp/pm_kernel.c:1074 at mptcp_pm_nl_set_flags+0x5de/0x640 net/mptcp/pm_kernel.c:1538, CPU#1: syz.7.48/2535 Modules linked in: CPU: 1 UID: 0 PID: 2535 Comm: syz.7.48 Not tainted 6.18.0-03987-gea5f5e676cf5 #17 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 25.10 PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_kernel.c:1074 [inline] RIP: 0010:mptcp_pm_nl_fullmesh net/mptcp/pm_kernel.c:1446 [inline] RIP: 0010:mptcp_pm_nl_set_flags_all net/mptcp/pm_kernel.c:1474 [inline] RIP: 0010:mptcp_pm_nl_set_flags+0x5de/0x640 net/mptcp/pm_kernel.c:1538 Code: 89 c7 e8 c5 8c 73 fe e9 f7 fd ff ff 49 83 ef 80 e8 b7 8c 73 fe 4c 89 ff be 03 00 00 00 e8 4a 29 e3 fe eb ac e8 a3 8c 73 fe 90 <0f> 0b 90 e9 3d ff ff ff e8 95 8c 73 fe b8 a1 ff ff ff eb 1a e8 89 RSP: 0018:ffffc9001535b820 EFLAGS: 00010287 netdevsim0: tun_chr_ioctl cmd 1074025677 RAX: ffffffff82da294d RBX: 0000000000000001 RCX: 0000000000080000 RDX: ffffc900096d0000 RSI: 00000000000006d6 RDI: 00000000000006d7 netdevsim0: linktype set to 823 RBP: ffff88802cdb2240 R08: 00000000000104ae R09: ffffffffffffffff R10: ffffffff82da27d4 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88801246d8c0 R14: ffffc9001535b8b8 R15: ffff88802cdb1800 FS: 00007fc6ac5a76c0(0000) GS:ffff8880f90c8000(0000) knlGS:0000000000000000 netlink: 'syz.3.50': attribute type 5 has an invalid length. CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 netlink: 1232 bytes leftover after parsing attributes in process `syz.3.50'. CR2: 0000200000010000 CR3: 0000000025b1a000 CR4: 0000000000350ef0 Call Trace: mptcp_pm_set_flags net/mptcp/pm_netlink.c:277 [inline] mptcp_pm_nl_set_flags_doit+0x1d7/0x210 net/mptcp/pm_netlink.c:282 genl_family_rcv_msg_doit+0x117/0x180 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x3a8/0x3f0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x16d/0x240 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x3e9/0x4c0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x4ab/0x5b0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0xc9/0xf0 net/socket.c:733 ____sys_sendmsg+0x272/0x3b0 net/socket.c:2608 ___sys_sendmsg+0x2de/0x320 net/socket.c:2662 __sys_sendmsg net/socket.c:2694 [inline] __do_sys_sendmsg net/socket.c:2699 [inline] __se_sys_sendmsg net/socket.c:2697 [inline] __x64_sys_sendmsg+0x110/0x1a0 net/socket.c:2697 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xed/0x360 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc6adb66f6d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc6ac5a6ff8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fc6addf5fa0 RCX: 00007fc6adb66f6d RDX: 0000000000048084 RSI: 00002000000002c0 RDI: 000000000000000e RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 netlink: 'syz.5.51': attribute type 2 has an invalid length. R13: 00007fff25e91fe0 R14: 00007fc6ac5a7ce4 R15: 00007fff25e920d7 The actions that caused that seem to be: - Create an MPTCP endpoint for address A without any flags - Create a new MPTCP connection from address A - Remove the MPTCP endpoint: the corresponding subflows will be removed - Recreate the endpoint with the same ID, but with the subflow flag - Change the same endpoint to add the fullmesh flag In this case, msk->pm.local_addr_used has been kept to 0 as expected, but the corresponding bit in msk->pm.id_avail_bitmap was still unset after having removed the endpoint, causing the splat later on. When removing an endpoint, the corresponding endpoint ID was only marked as available for "signal" types with an announced address, plus all "subflow" types, but not the other types like an endpoint corresponding to the initial subflow. In these cases, re-creating an endpoint with the same ID didn't signal/create anything. Here, adding the fullmesh flag was creating the splat when calling __mark_subflow_endp_available() from mptcp_pm_nl_fullmesh(), because msk->pm.local_addr_used was set to 0 while the ID was marked as used. To fix this issue, the corresponding bit in msk->pm.id_avail_bitmap can always be set as available when removing an MPTCP in-kernel endpoint. In other words, moving the call to __set_bit() to do it in all cases, except for "subflow" types where this bit is handled in a dedicated helper. Note: instead of adding a new spin_(un)lock_bh that would be taken in all cases, do all the actions requiring the spin lock under the same block. This modification potentially fixes another issue reported by syzbot, see [1]. But without a reproducer or more details about what exactly happened before, it is hard to confirm. Fixes: e255683c06df ("mptcp: pm: re-using ID of unused removed ADD_ADDR") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/606 Reported-by: syzbot+f56f7d56e2c6e11a01b6@syzkaller.appspotmail.com Closes: https://lore.kernel.org/68fcfc4a.050a0220.346f24.02fb.GAE@google.com [1] Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260205-net-mptcp-misc-fixes-6-19-rc8-v2-1-c2720ce75c34@kernel.org Signed-off-by: Jakub Kicinski commit a14d9317904559a6948946de05bf9fb6f2a34fba Author: Eric Dumazet Date: Thu Feb 5 21:19:09 2026 +0000 ipv6: do not use skb_header_pointer() in icmpv6_filter() Prefer pskb_may_pull() to avoid a stack canary in raw6_local_deliver(). Note: skb->head can change, hence we reload ip6h pointer in ipv6_raw_deliver() $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-86 (-86) Function old new delta raw6_local_deliver 780 694 -86 Total: Before=24889784, After=24889698, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260205211909.4115285-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b6e2db0ed9b9c219ff6d4d23f7436dbb47e5d7f1 Author: Kevin Hao Date: Thu Feb 5 14:25:09 2026 +0800 net: ti: icssg: Remove dedicated workqueue for ndo_set_rx_mode callback Currently, both the icssg-prueth and icssg-prueth-sr1 drivers create a dedicated 'emac->cmd_wq' workqueue. In the icssg-prueth-sr1 driver, this workqueue is not utilized at all. In the icssg-prueth driver, the workqueue is only used to execute the actual processing of ndo_set_rx_mode. However, creating a dedicated workqueue for such a simple use case is unnecessary. To simplify the code, switch to using the system default workqueue instead. Signed-off-by: Kevin Hao Tested-by: Meghana Malladi Reviewed-by: MD Danish Anwar Link: https://patch.msgid.link/20260205-icssg-prueth-workqueue-v2-1-cf5cf97efb37@gmail.com Signed-off-by: Jakub Kicinski commit a35b6e4863d8289bdf4d5d5758abef6cebd210a8 Author: Eric Dumazet Date: Thu Feb 5 16:43:29 2026 +0000 tcp: inline tcp_filter() This helper is already (auto)inlined from IPv4 TCP stack. Make it an inline function to benefit IPv6 as well. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 1/0 up/down: 30/-49 (-19) Function old new delta tcp_v6_rcv 3448 3478 +30 __pfx_tcp_filter 16 - -16 tcp_filter 33 - -33 Total: Before=24891904, After=24891885, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260205164329.3401481-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb Author: Arnd Bergmann Date: Thu Feb 5 17:28:09 2026 +0100 myri10ge: avoid uninitialized variable use While compile testing on less common architectures, I noticed that gcc-10 on s390 finds a bug that all other configurations seem to miss: drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list': drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized] 391 | buf->data0 = htonl(data->data0); | ^~ drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized] 392 | buf->data1 = htonl(data->data1); | ^~ drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings': drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized] 392 | buf->data1 = htonl(data->data1); drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here 1939 | struct myri10ge_cmd cmd; | ^~~ drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized] 393 | buf->data2 = htonl(data->data2); drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here 1939 | struct myri10ge_cmd cmd; It would be nice to understand how to make other compilers catch this as well, but for the moment I'll just shut up the warning by fixing the undefined behavior in this driver. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 2d593cf146706b9a5fc6d8107859e02a8bb17a43 Author: Arnd Bergmann Date: Thu Feb 5 17:13:48 2026 +0100 hinic3: select CONFIG_DIMLIB The driver started using dimlib but fails to select the corresponding symbol, which results in a link failure: x86_64-linux-ld: drivers/net/ethernet/huawei/hinic3/hinic3_irq.o: in function `hinic3_poll': hinic3_irq.c:(.text+0x179): undefined reference to `net_dim' x86_64-linux-ld: drivers/net/ethernet/huawei/hinic3/hinic3_irq.o: in function `hinic3_rx_dim_work': hinic3_irq.c:(.text+0x1fb): undefined reference to `net_dim_get_rx_moderation' Fixes: b35a6fd37a00 ("hinic3: Add adaptive IRQ coalescing with DIM") Signed-off-by: Arnd Bergmann Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260205161530.1308504-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit abf981bb8de6185b2ac80ebc40224d5028e4f8b4 Author: Oliver Hartkopp Date: Thu Feb 5 15:44:05 2026 +0100 net: skb: allow up to 8 skb extension ids The skb extension ids range from 0 .. 7 to fit their bits as flags into a single byte. The ids are automatically enumnerated in enum skb_ext_id in skbuff.h, where SKB_EXT_NUM is defined as the last value. When having 8 skb extension ids (0 .. 7), SKB_EXT_NUM becomes 8 which is a valid value for SKB_EXT_NUM. Fixes: 96ea3a1e2d31 ("can: add CAN skb extension infrastructure") Link: https://lore.kernel.org/netdev/aXoMqaA7b2CqJZNA@strlen.de/ Reviewed-by: Florian Westphal Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260205-skb_ext-v1-1-9ba992ccee8b@hartkopp.net Signed-off-by: Jakub Kicinski commit dddb0198c2a887c2eba1a8b0113b46b648163048 Author: Alok Tiwari Date: Thu Feb 5 01:19:55 2026 -0800 net: marvell: prestera: fix FEC error message for SFP ports In prestera_ethtool_set_fecparam(), the error message is opposite of the condition checking PRESTERA_PORT_TCVR_SFP. FEC configuration is not allowed on SFP ports, but the message says "non-SFP ports", which does not match the condition. However, FEC may be required depending on the transceiver, cable, or mode, and firmware already validates invalid combinations. Remove the SFP transceiver check and let firmware handle validation. Signed-off-by: Alok Tiwari Acked-by: Elad Nachman Link: https://patch.msgid.link/20260205091958.231413-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 2214aab26811c77a15fc1d28bf3112a07b8c8d85 Author: Eric Dumazet Date: Wed Feb 4 19:00:34 2026 +0000 net_sched: sch_fq: rework fq_gc() to avoid stack canary Using kmem_cache_free_bulk() in fq_gc() was not optimal. 1) It needs an array. 2) It is only saving cpu cycles for large batches. The automatic array forces a stack canary, which is expensive. In practice fq_gc was finding zero, one or two flows at most per round. Remove the array, use kmem_cache_free(). This makes fq_enqueue() smaller and faster. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-79 (-79) Function old new delta fq_enqueue 1629 1550 -79 Total: Before=24886583, After=24886504, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260204190034.76277-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7acee67a6bce02e0af8a4bf7b412e2164d5a48e9 Author: Qiliang Yuan Date: Wed Feb 4 02:48:42 2026 -0500 netns: optimize netns cleaning by batching unhash_nsid calls Currently, unhash_nsid() scans the entire system for each netns being killed, leading to O(L_dying_net * M_alive_net * N_id) complexity, as __peernet2id() also performs a linear search in the IDR. Optimize this to O(M_alive_net * N_id) by batching unhash operations. Move unhash_nsid() out of the per-netns loop in cleanup_net() to perform a single-pass traversal over survivor namespaces. Identify dying peers by an 'is_dying' flag, which is set under net_rwsem write lock after the netns is removed from the global list. This batches the unhashing work and eliminates the O(L_dying_net) multiplier. To minimize the impact on struct net size, 'is_dying' is placed in an existing hole after 'hash_mix' in struct net. Use a restartable idr_get_next() loop for iteration. This avoids the unsafe modification issue inherent to idr_for_each() callbacks and allows dropping the nsid_lock to safely call sleepy rtnl_net_notifyid(). Clean up redundant nsid_lock and simplify the destruction loop now that unhashing is centralized. Signed-off-by: Qiliang Yuan Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260204074854.3506916-1-realwujing@gmail.com Signed-off-by: Jakub Kicinski commit 0ce90934c0a6baac053029ad28566536ae50d604 Author: Thorsten Blum Date: Sun Feb 1 18:56:33 2026 +0100 crypto: img-hash - Use unregister_ahashes in img_{un}register_algs Replace the for loops with calls to crypto_unregister_ahashes(). In img_register_algs(), return 'err' immediately and remove the goto statement to simplify the error handling code. Convert img_unregister_algs() to a void function since its return value is never used. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit dc8f3d9ae804e8bb47dd49b051fe8b303db3b95c Author: Aleksander Jan Bajkowski Date: Sun Feb 1 12:27:08 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(md5),cbc(des3_ede)) Test vector was generated using a software implementation and then double checked using a hardware implementation on NXP P2020 (talitos). The encryption part is identical to authenc(hmac(sha1),cbc(des3_ede)), only HMAC is different. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit 5669645c052f235726a85f443769b6fc02f66762 Author: Sai Ritvik Tanksalkar Date: Sun Feb 1 13:22:40 2026 +0000 pstore/ram: fix buffer overflow in persistent_ram_save_old() persistent_ram_save_old() can be called multiple times for the same persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz for PSTORE_TYPE_DMESG records). Currently, the function only allocates prz->old_log when it is NULL, but it unconditionally updates prz->old_log_size to the current buffer size and then performs memcpy_fromio() using this new size. If the buffer size has grown since the first allocation (which can happen across different kernel boot cycles), this leads to: 1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls 2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer using the incorrect (larger) old_log_size The KASAN splat would look similar to: BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x... Read of size N at addr ... by task ... The conditions are likely extremely hard to hit: 0. Crash with a ramoops write of less-than-record-max-size bytes. 1. Reboot: ramoops registers, pstore_get_records(0) reads old crash, allocates old_log with size X 2. Crash handler registered, timer started (if pstore_update_ms >= 0) 3. Oops happens (non-fatal, system continues) 4. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X) 5. pstore_new_entry = 1, pstore_timer_kick() called 6. System continues running (not a panic oops) 7. Timer fires after pstore_update_ms milliseconds 8. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1) 9. ramoops_get_next_prz() → persistent_ram_save_old() 10. buffer_size() returns Y, but old_log is X bytes 11. Y > X: memcpy_fromio() overflows heap Requirements: - a prior crash record exists that did not fill the record size (almost impossible since the crash handler writes as much as it can possibly fit into the record, capped by max record size and the kmsg buffer almost always exceeds the max record size) - pstore_update_ms >= 0 (disabled by default) - Non-fatal oops (system survives) Free and reallocate the buffer when the new size differs from the previously allocated size. This ensures old_log always has sufficient space for the data being copied. Fixes: 201e4aca5aa1 ("pstore/ram: Should update old dmesg buffer before reading") Signed-off-by: Sai Ritvik Tanksalkar Link: https://patch.msgid.link/20260201132240.2948732-1-stanksal@purdue.edu Signed-off-by: Kees Cook commit 05363abc7625cf18c96e67f50673cd07f11da5e9 Author: Ruipeng Qi Date: Tue Feb 3 10:03:58 2026 +0800 pstore: ram_core: fix incorrect success return when vmap() fails In persistent_ram_vmap(), vmap() may return NULL on failure. If offset is non-zero, adding offset_in_page(start) causes the function to return a non-NULL pointer even though the mapping failed. persistent_ram_buffer_map() therefore incorrectly returns success. Subsequent access to prz->buffer may dereference an invalid address and cause crashes. Add proper NULL checking for vmap() failures. Signed-off-by: Ruipeng Qi Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com Signed-off-by: Kees Cook commit 079a015b5a630a87632f5585247d1ff7fd80086b Author: Danny Kaehn Date: Tue Jan 27 08:47:48 2026 -0600 dt-bindings: i2c: Add CP2112 HID USB to SMBus Bridge This is a USB HID device which includes an I2C controller and 8 GPIO pins. The binding allows describing the chip's gpio and i2c controller in DT, with the i2c controller being bound to a subnode named "i2c". This is intended to be used in configurations where the CP2112 is permanently connected in hardware. Signed-off-by: Danny Kaehn Reviewed-by: Rob Herring (Arm) Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260127-cp2112-dt-v13-1-6448ddd4bf22@plexus.com commit 76b70625615f6e82add8b9354508e081fff3686a Author: Filippo Muscherà Date: Mon Feb 2 14:13:04 2026 +0100 i2c: amd8111: switch to devm_ functions Use devm_kzalloc() to manage the memory allocation of the smbus structure and devm_request_region() to manage the I/O port region. This simplifies the error handling paths in the probe function by removing manual cleanup and allows for the removal of the explicit cleanup in the remove function. Signed-off-by: Filippo Muscherà Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260202131304.8524-2-filippo.muschera@gmail.com commit f6dd64d61aba6d038434ce17e05fdcd4b67e4076 Author: Filippo Muscherà Date: Mon Feb 2 14:13:03 2026 +0100 i2c: amd8111: Remove spaces in MODULE_* macros Remove space between function name and open parenthesis in MODULE_DEVICE_TABLE and MODULE_AUTHOR to comply with kernel coding style. Signed-off-by: Filippo Muscherà Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260202131304.8524-1-filippo.muschera@gmail.com commit ba268514ea14b44570030e8ed2aef92a38679e85 Author: Danilo Krummrich Date: Thu Feb 5 23:25:15 2026 +0100 rust: devres: fix race condition due to nesting Commit f5d3ef25d238 ("rust: devres: get rid of Devres' inner Arc") did attempt to optimize away the internal reference count of Devres. However, without an internal reference count, we can't support cases where Devres is indirectly nested, resulting into a deadlock. Such indirect nesting easily happens in the following way: A registration object (which is guarded by devres) hold a reference count of an object that holds a device resource guarded by devres itself. For instance a drm::Registration holds a reference of a drm::Device. The drm::Device itself holds a device resource in its private data. When the drm::Registration is dropped by devres, and it happens that it did hold the last reference count of the drm::Device, it also drops the device resource, which is guarded by devres itself. Thus, resulting into a deadlock in the Devres destructor of the device resource, as in the following backtrace. sysrq: Show Blocked State task:rmmod state:D stack:0 pid:1331 tgid:1331 ppid:1330 task_flags:0x400100 flags:0x00000010 Call trace: __switch_to+0x190/0x294 (T) __schedule+0x878/0xf10 schedule+0x4c/0xcc schedule_timeout+0x44/0x118 wait_for_common+0xc0/0x18c wait_for_completion+0x18/0x24 _RINvNtCs4gKlGRWyJ5S_4core3ptr13drop_in_placeINtNtNtCsgzhNYVB7wSz_6kernel4sync3arc3ArcINtNtBN_6devres6DevresmEEECsRdyc7Hyps3_15rust_driver_pci+0x68/0xe8 [rust_driver_pci] _RINvNvNtCsgzhNYVB7wSz_6kernel6devres16register_foreign8callbackINtNtCs4gKlGRWyJ5S_4core3pin3PinINtNtNtB6_5alloc4kbox3BoxINtNtNtB6_4sync3arc3ArcINtB4_6DevresmEENtNtB1A_9allocator7KmallocEEECsRdyc7Hyps3_15rust_driver_pci+0x34/0xc8 [rust_driver_pci] devm_action_release+0x14/0x20 devres_release_all+0xb8/0x118 device_release_driver_internal+0x1c4/0x28c driver_detach+0x94/0xd4 bus_remove_driver+0xdc/0x11c driver_unregister+0x34/0x58 pci_unregister_driver+0x20/0x80 __arm64_sys_delete_module+0x1d8/0x254 invoke_syscall+0x40/0xcc el0_svc_common+0x8c/0xd8 do_el0_svc+0x1c/0x28 el0_svc+0x54/0x1d4 el0t_64_sync_handler+0x84/0x12c el0t_64_sync+0x198/0x19c In order to fix this, re-introduce the internal reference count. Reported-by: Boris Brezillon Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/.E2.9C.94.20Deadlock.20caused.20by.20nested.20Devres/with/571242651 Reported-by: Markus Probst Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/.E2.9C.94.20Devres.20inside.20Devres.20stuck.20on.20cleanup/with/571239721 Reported-by: Alice Ryhl Closes: https://gitlab.freedesktop.org/panfrost/linux/-/merge_requests/56#note_3282757 Fixes: f5d3ef25d238 ("rust: devres: get rid of Devres' inner Arc") Reviewed-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Tested-by: Boris Brezillon Link: https://patch.msgid.link/20260205222529.91465-1-dakr@kernel.org [ Call clone() prior to devm_add_action(). - Danilo ] Signed-off-by: Danilo Krummrich commit fb4ddf2085115ed28dedc427d9491707b476bbfe Author: David Hildenbrand (Red Hat) Date: Mon Jan 19 23:07:08 2026 +0100 mm/memory: handle non-split locks correctly in zap_empty_pte_table() While we handle pte_lockptr() == pmd_lockptr() correctly in zap_pte_table_if_empty(), we don't handle it in zap_empty_pte_table(), making the spin_trylock() always fail and forcing us onto the slow path. So let's handle the scenario where pte_lockptr() == pmd_lockptr() better, which can only happen if CONFIG_SPLIT_PTE_PTLOCKS is not set. This is only relevant once we unlock CONFIG_PT_RECLAIM on architectures that are not x86-64. Link: https://lkml.kernel.org/r/20260119220708.3438514-3-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Qi Zheng Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4c640eb4181cf8de74c8b9e7c9cf16bf8d26b73e Author: David Hildenbrand (Red Hat) Date: Mon Jan 19 23:07:07 2026 +0100 mm: move pte table reclaim code to memory.c Some cleanups for PT table reclaim code, triggered by a false-positive warning we might start to see soon after we unlocked pt-reclaim on architectures besides x86-64. This patch (of 2): The pte-table reclaim code is only called from memory.c, while zapping pages, and it better also stays that way in the long run. If we ever have to call it from other files, we should expose proper high-level helpers for zapping if the existing helpers are not good enough. So, let's move the code over (it's not a lot) and slightly clean it up a bit by: - Renaming the functions. - Dropping the "Check if it is empty PTE page" comment, which is now self-explaining given the function name. - Making zap_pte_table_if_empty() return whether zapping worked so the caller can free it. - Adding a comment in pte_table_reclaim_possible(). - Inlining free_pte() in the last remaining user. - In zap_empty_pte_table(), switch from pmdp_get_lcokless() to pmd_clear(), we are holding the PMD PT lock. By moving the code over, compilers can also easily figure out when zap_empty_pte_table() does not initialize the pmdval variable, avoiding false-positive warnings about the variable possibly not being initialized. Link: https://lkml.kernel.org/r/20260119220708.3438514-1-david@kernel.org Link: https://lkml.kernel.org/r/20260119220708.3438514-2-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Qi Zheng Cc: Liam Howlett Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9c8c02df3f8742f6db927e787ab971fd0b5ac08a Author: Qi Zheng Date: Tue Jan 27 20:13:01 2026 +0800 mm: make PT_RECLAIM depends on MMU_GATHER_RCU_TABLE_FREE The PT_RECLAIM can work on all architectures that support MMU_GATHER_RCU_TABLE_FREE, except for those that have selected HAVE_ARCH_TLB_REMOVE_TABLE,so make PT_RECLAIM depends on MMU_GATHER_RCU_TABLE_FREE && !HAVE_ARCH_TLB_REMOVE_TABLE. BTW, change PT_RECLAIM to be enabled by default, since nobody should want to turn it off. Link: https://lkml.kernel.org/r/83b034810935a9ff18e425b085e065bb0acb28f3.1769515122.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: David Hildenbrand (Red Hat) Cc: Andreas Larsson Cc: "Aneesh Kumar K.V" Cc: Anton Ivanov Cc: Borislav Petkov Cc: Dave Hansen Cc: Dev Jain Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Johannes Berg Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Richard Henderson Cc: Richard Weinberger Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Wei Yang Cc: Will Deacon Signed-off-by: Andrew Morton commit 086498aed3f68febb58df7e6141962942abb8944 Author: Qi Zheng Date: Tue Jan 27 20:13:00 2026 +0800 mm: convert __HAVE_ARCH_TLB_REMOVE_TABLE to CONFIG_HAVE_ARCH_TLB_REMOVE_TABLE config For architectures that define __HAVE_ARCH_TLB_REMOVE_TABLE, the page tables at the pmd/pud level are generally not of struct ptdesc type, and do not have pt_rcu_head member, thus these architectures cannot support PT_RECLAIM. In preparation for enabling PT_RECLAIM on more architectures, convert __HAVE_ARCH_TLB_REMOVE_TABLE to CONFIG_HAVE_ARCH_TLB_REMOVE_TABLE config, so that we can make conditional judgments in Kconfig. Link: https://lkml.kernel.org/r/5ebfa3d4b56e63c6906bda5eccaa9f7194d3a86b.1769515122.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: David Hildenbrand (Arm) Tested-by: Andreas Larsson [sparc, UP&SMP] Acked-by: Andreas Larsson [sparc] Cc: "Aneesh Kumar K.V" Cc: Anton Ivanov Cc: Borislav Petkov Cc: Dave Hansen Cc: Dev Jain Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Johannes Berg Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Richard Henderson Cc: Richard Weinberger Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Wei Yang Cc: Will Deacon Signed-off-by: Andrew Morton commit 6578ab0a5cc7228214a5455f5c479b2fa0fb7d74 Author: Qi Zheng Date: Tue Jan 27 20:12:59 2026 +0800 um: mm: enable MMU_GATHER_RCU_TABLE_FREE On a 64-bit system, madvise(MADV_DONTNEED) may cause a large number of empty PTE page table pages (such as 100GB+). To resolve this problem, first enable MMU_GATHER_RCU_TABLE_FREE to prepare for enabling the PT_RECLAIM feature, which resolves this problem. Link: https://lkml.kernel.org/r/e2217546504668b8a87a39eb0e378839339a1bb4.1769515122.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Cc: Richard Weinberger Cc: Anton Ivanov Cc: Johannes Berg Cc: Andreas Larsson Cc: "Aneesh Kumar K.V" Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Richard Henderson Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Wei Yang Cc: Will Deacon Signed-off-by: Andrew Morton commit 46231ba5f4e13d1a922c6cbd0d987539dbaa330b Author: Qi Zheng Date: Tue Jan 27 20:12:58 2026 +0800 parisc: mm: enable MMU_GATHER_RCU_TABLE_FREE On a 64-bit system, madvise(MADV_DONTNEED) may cause a large number of empty PTE page table pages (such as 100GB+). To resolve this problem, first enable MMU_GATHER_RCU_TABLE_FREE to prepare for enabling the PT_RECLAIM feature, which resolves this problem. Link: https://lkml.kernel.org/r/b827939046dbc94bc7c585cdbed8522baab75b15.1769515122.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: Andreas Larsson Cc: "Aneesh Kumar K.V" Cc: Anton Ivanov Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Richard Henderson Cc: Richard Weinberger Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Wei Yang Cc: Will Deacon Signed-off-by: Andrew Morton commit 6c8e95805dba19a28cdef25e28ac27afae1870f4 Author: Qi Zheng Date: Tue Jan 27 20:12:57 2026 +0800 mips: mm: enable MMU_GATHER_RCU_TABLE_FREE On a 64-bit system, madvise(MADV_DONTNEED) may cause a large number of empty PTE page table pages (such as 100GB+). To resolve this problem, first enable MMU_GATHER_RCU_TABLE_FREE to prepare for enabling the PT_RECLAIM feature, which resolves this problem. Link: https://lkml.kernel.org/r/0d17f00a724f77aaca2da7c847acd490c3a47571.1769515122.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Cc: Thomas Bogendoerfer Cc: Andreas Larsson Cc: "Aneesh Kumar K.V" Cc: Anton Ivanov Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Johannes Berg Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Richard Henderson Cc: Richard Weinberger Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Wei Yang Cc: Will Deacon Signed-off-by: Andrew Morton commit a5b981e63edb5f606f109b39f6ded2a332ec5aed Author: Qi Zheng Date: Tue Jan 27 20:12:56 2026 +0800 LoongArch: mm: enable MMU_GATHER_RCU_TABLE_FREE On a 64-bit system, madvise(MADV_DONTNEED) may cause a large number of empty PTE page table pages (such as 100GB+). To resolve this problem, first enable MMU_GATHER_RCU_TABLE_FREE to prepare for enabling the PT_RECLAIM feature, which resolves this problem. Link: https://lkml.kernel.org/r/bd1b11bc1a13686aeba81a40194f87b369d62661.1769515122.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Cc: Huacai Chen Cc: WANG Xuerui Cc: Andreas Larsson Cc: "Aneesh Kumar K.V" Cc: Anton Ivanov Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Johannes Berg Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Richard Henderson Cc: Richard Weinberger Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Signed-off-by: Andrew Morton commit 44b079583f7d44ff7c7d88479b4398fe284834bf Author: Qi Zheng Date: Tue Jan 27 20:12:55 2026 +0800 alpha: mm: enable MMU_GATHER_RCU_TABLE_FREE On a 64-bit system, madvise(MADV_DONTNEED) may cause a large number of empty PTE page table pages (such as 100GB+). To resolve this problem, first enable MMU_GATHER_RCU_TABLE_FREE to prepare for enabling the PT_RECLAIM feature, which resolves this problem. Link: https://lkml.kernel.org/r/3380f40a89b73c488202c85f9a8abf99fb08543b.1769515122.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: Magnus Lindholm [alpha] Cc: Richard Henderson Cc: Matt Turner Cc: Andreas Larsson Cc: "Aneesh Kumar K.V" Cc: Anton Ivanov Cc: Borislav Petkov Cc: Dave Hansen Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Helge Deller Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: "James E.J. Bottomley" Cc: Johannes Berg Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Richard Weinberger Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: WANG Xuerui Cc: Wei Yang Cc: Will Deacon Signed-off-by: Andrew Morton commit d8b65654b16f0cab24f1c46f9aed5562a8513da6 Author: Qi Zheng Date: Tue Jan 27 20:12:54 2026 +0800 mm: change mm/pt_reclaim.c to use asm/tlb.h instead of asm-generic/tlb.h Patch series "enable PT_RECLAIM on more 64-bit architectures", v4. This series aims to enable PT_RECLAIM on more 64-bit architectures. On a 64-bit system, madvise(MADV_DONTNEED) may cause a large number of empty PTE page table pages (such as 100GB+). To resolve this problem, we need to enable PT_RECLAIM, which depends on MMU_GATHER_RCU_TABLE_FREE. For these architectures that define its own __tlb_remove_table(), since their page tables are not of type struct ptdesc, they cannot be supported PT_RECLAIM. Therefore, this series first enables MMU_GATHER_RCU_TABLE_FREE on all 64-bit architectures, then converts __HAVE_ARCH_TLB_REMOVE_TABLE to CONFIG_HAVE_ARCH_TLB_REMOVE_TABLE config, and finally makes PT_RECLAIM depend on MMU_GATHER_RCU_TABLE_FREE && !HAVE_ARCH_TLB_REMOVE_TABLE. This way, PT_RECLAIM can be enabled by default on most 64-bit architectures. Of course, this will also be enabled on some 32-bit architectures that already support MMU_GATHER_RCU_TABLE_FREE. That's fine, PT_RECLAIM works well on all 32-bit architectures as well. Although the benefit isn't significant, there's still memory that can be reclaimed. Perhaps PT_RECLAIM can be enabled on all 32-bit architectures in the future. This patch (of 8): Generally, the asm/tlb.h will include asm-generic/tlb.h, so change mm/pt_reclaim.c to use asm/tlb.h instead of asm-generic/tlb.h. This is a preparation for enabling CONFIG_PT_RECLAIM on other architectures, such as alpha. Link: https://lkml.kernel.org/r/cover.1769515122.git.zhengqi.arch@bytedance.com Link: https://lkml.kernel.org/r/befca537d10c6bf8d531b1ee0a8af1e3b31352b0.1769515122.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: David Hildenbrand (Red Hat) Cc: Andreas Larsson Cc: "Aneesh Kumar K.V" Cc: Borislav Petkov Cc: Dave Hansen Cc: Dev Jain Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Cc: Anton Ivanov Cc: Helge Deller Cc: Huacai Chen Cc: "James E.J. Bottomley" Cc: Johannes Berg Cc: Matt Turner Cc: Richard Henderson Cc: Richard Weinberger Cc: Thomas Bogendoerfer Cc: WANG Xuerui Signed-off-by: Andrew Morton commit 06f5ff36e418bc72c758730e7256b1b8ac04e6b4 Author: Li RongQing Date: Fri Jan 30 03:56:03 2026 -0500 mm/damon/stat: remove __read_mostly from memory_idle_ms_percentiles The 'memory_idle_ms_percentiles' array in DAMON_STAT is updated frequently by the kernel to reflect the latest idle time statistics. Marking it as '__read_mostly' is inappropriate for data that is regularly written to, as it can lead to cache pollution in the read-mostly section. Remove the '__read_mostly' annotation to accurately reflect the variable's usage pattern. Link: https://lkml.kernel.org/r/20260130085603.1814-1-lirongqing@baidu.com Signed-off-by: Li RongQing Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 3881b00a2cead778d070f72aa534f0ed589fb4c3 Author: Sergey Senozhatsky Date: Sat Jan 17 11:54:05 2026 +0900 zsmalloc: make common caches global Currently, zsmalloc creates kmem_cache of handles and zspages for each pool, which may be suboptimal from the memory usage point of view (extra internal fragmentation per pool). Systems that create multiple zsmalloc pools may benefit from shared common zsmalloc caches. Make handles and zspages kmem caches global. The memory savings depend on particular setup and data patterns and can be found via slabinfo. Link: https://lkml.kernel.org/r/20260117025406.799428-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Nhat Pham Reviewed-by: Yosry Ahmed Cc: Brian Geffon Cc: Johannes Weiner Cc: Minchan Kim Signed-off-by: Andrew Morton commit ef24e0aa078fa4965c6e925209780a32b325c0d8 Author: Tim Bird Date: Wed Feb 4 14:31:01 2026 -0700 mm: add SPDX id lines to some mm source files Some of the memory management source files are missing SPDX-License-Identifier lines. Add appropriate IDs to these files (mostly GPL-2.0, but one LGPL-2.1). Link: https://lkml.kernel.org/r/20260204213101.1754183-1-tim.bird@sony.com Signed-off-by: Tim Bird Signed-off-by: Andrew Morton commit c69ca4e992e3fd08d3d9fb9e498cb11d1c3e21c7 Author: Sahil Chandna Date: Thu Feb 5 00:24:08 2026 +0530 mm/zswap: use %pe to print error pointers Use the %pe printk format specifier to report error pointers directly instead of printing PTR_ERR() as a long value. This improves clarity, produces more readable error messages. This instance was flagged by the Coccinelle script (misc/ptr_err_to_pe.cocci) as an opportunity to adopt %pe. Found by: make coccicheck MODE=report M=mm/ No functional change intended. Link: https://lkml.kernel.org/r/581a26f22fb4c6ce04aeb7ee0d703fe64454ac7f.1770230135.git.chandna.sahil@gmail.com Signed-off-by: Sahil Chandna Acked-by: Yosry Ahmed Acked-by: Nhat Pham Acked-by: David Hildenbrand (Red Hat) Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 4a8eabc6e4c7fec44570e9e70d464fea076633c9 Author: Sahil Chandna Date: Thu Feb 5 00:24:07 2026 +0530 mm/vmscan: use %pe to print error pointers Use the %pe printk format specifier to report error pointers directly instead of printing PTR_ERR() as a long value. This improves clarity, produces more readable error messages. This instance was flagged by the Coccinelle script (misc/ptr_err_to_pe.cocci) as an opportunity to adopt %pe. Found by: make coccicheck MODE=report M=mm/ No functional change intended Link: https://lkml.kernel.org/r/80a6643657a60e75ddf48b4869b3e7fdc101f855.1770230135.git.chandna.sahil@gmail.com Signed-off-by: Sahil Chandna Acked-by: David Hildenbrand (Red Hat) Reviewed-by: SeongJae Park Cc: Nhat Pham Cc: Yosry Ahmed Signed-off-by: Andrew Morton commit ad1e0c44a41562cb4f17ba3b6818b19a32702198 Author: Wilson Zeng Date: Tue Jan 27 23:25:35 2026 +0800 mm/readahead: fix typo in comment Fix a typo in a comment: max_readhead -> max_readahead. Link: https://lkml.kernel.org/r/20260127152535.321951-1-cheng20011202@gmail.com Signed-off-by: Wilson Zeng Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 4188b2592ff646b2c7eacfb9327dc6977187ceab Author: Shakeel Butt Date: Thu Jan 29 20:29:25 2026 -0800 mm: khugepaged: fix NR_FILE_PAGES and NR_SHMEM in collapse_file() In META's fleet, we observed high-level cgroups showing zero file memcg stats while their descendants had non-zero values. Investigation using drgn revealed that these parent cgroups actually had negative file stats, aggregated from their children. This issue became more frequent after deploying thp-always more widely, pointing to a correlation with THP file collapsing. The root cause is that collapse_file() assumes old folios and the new THP belong to the same node and memcg. When this assumption breaks, stats become skewed. The bug affects not just memcg stats but also per-numa stats, and not just NR_FILE_PAGES but also NR_SHMEM. The assumption breaks in scenarios such as: 1. Small folios allocated on one node while the THP gets allocated on a different node. 2. A package downloader running in one cgroup populates the page cache, while a job in a different cgroup executes the downloaded binary. 3. A file shared between processes in different cgroups, where one process faults in the pages and khugepaged (or madvise(COLLAPSE)) collapses them on behalf of the other. Fix the accounting by explicitly incrementing stats for the new THP and decrementing stats for the old folios being replaced. Link: https://lkml.kernel.org/r/20260130042925.2797946-1-shakeel.butt@linux.dev Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Shakeel Butt Reviewed-by: Baolin Wang Reviewed-by: Dev Jain Reviewed-by: Barry Song Acked-by: Johannes Weiner Reviewed-by: Kiryl Shutsemau Acked-by: David Hildenbrand (arm) Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Nico Pache Cc: Rik van Riel Cc: Ryan Roberts Cc: Song Liu Cc: Usama Arif Cc: Zi Yan Signed-off-by: Andrew Morton commit cc5cbf37ceac49d446aa9f1e888d35c3a3353616 Author: Justin Green Date: Wed Jan 28 17:56:47 2026 -0500 mm: refactor vma_map_pages to use vm_insert_pages vma_map_pages currently calls vm_insert_page on each individual page in the mapping, which creates significant overhead because we are repeatedly spinlocking. Instead, we should batch insert pages using vm_insert_pages, which amortizes the cost of the spinlock. Tested through watching hardware accelerated video on a MTK ChromeOS device. This particular path maps both a V4L2 buffer and a GEM allocated buffer into userspace and converts the contents from one pixel format to another. Both vb2_mmap() and mtk_gem_object_mmap() exercise this pathway. Link: https://lkml.kernel.org/r/20260128225648.2938636-1-greenjustin@chromium.org Signed-off-by: Justin Green Acked-by: Brian Geffon Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Arjun Roy Cc: David Hildenbrand Cc: David Rientjes Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9a2791e748e5e658abcf3a4ab7fc76ef02cd66c5 Author: Enze Li Date: Thu Jan 29 18:08:45 2026 +0800 mm/damon: unify address range representation with damon_addr_range Currently, DAMON defines two identical structures for representing address ranges: damon_system_ram_region and damon_addr_range. Both structures share the same semantic interpretation of a half-open interval [start, end), where the start address is inclusive and the end address is exclusive. This duplication adds unnecessary redundancy and increases maintenance overhead. This patch replaces all uses of damon_system_ram_region with the more generic damon_addr_range structure, ensuring a unified type representation for address ranges within the DAMON subsystem. The change simplifies the codebase, improves readability, and avoids potential inconsistencies in future modifications. Link: https://lkml.kernel.org/r/20260129100845.281734-1-lienze@kylinos.cn Signed-off-by: Enze Li Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit ad789a85b1633ea84ad8ccf625588d6416877e69 Author: Thorsten Blum Date: Mon Jan 26 18:45:15 2026 +0100 mm/cma: replace snprintf with strscpy in cma_new_area Replace snprintf("%s", ...) with the faster and more direct strscpy(). Link: https://lkml.kernel.org/r/20260126174516.236968-1-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Andrew Morton Reviewed-by: SeongJae Park Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e2c3b6b21c77f72e5e36a076594eb56c714fce0c Author: Yosry Ahmed Date: Wed Jan 21 01:36:15 2026 +0000 mm: zswap: use SG list decompression APIs from zsmalloc Use the new zs_obj_read_sg_*() APIs in zswap_decompress(), instead of zs_obj_read_*() APIs returning a linear address. The SG list is passed directly to the crypto API, simplifying the logic and dropping the workaround that copies highmem addresses to a buffer. The crypto API should internally linearize the SG list if needed. This avoids the memcpy() in zsmalloc for objects spanning multiple pages, although an equivalent operation will be done internally by acomp/scomp. However, in the future compression algorithms could support handling discontiguous SG lists, completely eliminating the copying for spanning objects. Zsmalloc fills an SG list up to 2 entries in size, so change the input SG list to fit 2 entries. Update the incompressible entries path to use memcpy_from_sglist() to copy the data to the folio. Opportunistically set dlen to PAGE_SIZE in the same code path (rather that at the top of the function) to make it clearer. Drop the goto in zswap_compress() as the code now is not simple enough for an if-else statement instead. Rename 'decomp_ret' to 'ret' and reuse it to keep the intermediate return value of crypto_acomp_decompress() to keep line lengths manageable. No functional change intended. Link: https://lkml.kernel.org/r/20260121013615.2906368-1-yosry.ahmed@linux.dev Signed-off-by: Yosry Ahmed Acked-by: Nhat Pham Cc: Chengming Zhou Cc: Herbert Xu Cc: Johannes Weiner Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton commit 1651d69443c3a5fc12f1dee1229d526e7af9020a Author: Helge Deller Date: Sat Feb 7 00:29:11 2026 +0100 parisc: lba_pci: Add debug code to show IO and PA ranges Add more code to debug the PAT PDC firmware. Signed-off-by: Helge Deller commit 62c544bc108caa4ce68bfb9864a2500c4480ff56 Author: Helge Deller Date: Fri Feb 6 21:59:56 2026 +0100 parisc: Detect 64-bit free running platform counter Signed-off-by: Helge Deller commit e3217ddf29cb2fe7c9c12978aac89ee1651599f1 Author: Helge Deller Date: Fri Feb 6 21:52:01 2026 +0100 parisc: Fix minor printk issues in iosapic debug code Signed-off-by: Helge Deller commit db7e826030dc6775b862468476c1fd08b10f0799 Author: Helge Deller Date: Fri Feb 6 21:39:15 2026 +0100 parisc: Enhance debug code for PAT firmware Enhance output when running PAT firmware, which is helpful when developing the QEMU emulator. The added code is behind an ifdef, so no performance overhead for normal kernels. Signed-off-by: Helge Deller commit 0b3b90a0f971e4289367f172cfc36c934741b209 Author: Helge Deller Date: Fri Feb 6 21:26:40 2026 +0100 parisc: Add PDC PAT call to get free running 64-bit counter PDC PAT defines this optional function. Testing on my C8000 workstation and a rp3440 server did not indicate that they provide such counter. Nevertheless, add the function since we should try to use such a counter if it's available. In Qemu it should be simple to add it. Signed-off-by: Helge Deller commit 5ff7842103f60b29b9907d25b371f65d5b40bbe4 Author: Helge Deller Date: Wed Jan 28 15:20:25 2026 +0100 parisc: Fix module path output in qemu tables Signed-off-by: Helge Deller commit 97cb9150ff2dd8bc87726a04045f1b3eda6f52b3 Author: Helge Deller Date: Wed Jan 28 13:31:31 2026 +0100 parisc: Export model name for MPE/ix Signed-off-by: Helge Deller commit 35ac5a728c878594f2ea6c43b57652a16be3c968 Author: Helge Deller Date: Tue Jan 27 17:58:55 2026 +0100 parisc: Prevent interrupts during reboot Signed-off-by: Helge Deller commit ba74652c30606f22e4db44cb0164ab567486abdb Author: Helge Deller Date: Tue Jan 13 19:52:08 2026 +0100 parisc: Print hardware IDs as 4 digit hex strings The hardware IDs are 32-bit unsigned integers, so print them as 4-digit hex numbers. Additionally fix some whitespace glitches. Signed-off-by: Helge Deller commit dcf69599c47f29ce0a99117eb3f9ddcd2c4e78b6 Author: Haoxiang Li Date: Fri Dec 19 21:19:26 2025 +0800 parisc: kernel: replace kfree() with put_device() in create_tree_node() If device_register() fails, put_device() is the correct way to drop the device reference. Found by code review. Fixes: 1070c9655b90 ("[PA-RISC] Fix must_check warnings in drivers.c") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Signed-off-by: Helge Deller commit ebebb04baefdace1e0dc17f7779e5549063ca592 Author: Shardul Bankar Date: Wed Feb 4 22:34:40 2026 +0530 hfsplus: avoid double unload_nls() on mount failure The recent commit "hfsplus: ensure sb->s_fs_info is always cleaned up" [1] introduced a custom ->kill_sb() handler (hfsplus_kill_super) that cleans up the s_fs_info structure (including the NLS table) on superblock destruction. However, the error handling path in hfsplus_fill_super() still calls unload_nls() before returning an error. Since the VFS layer calls ->kill_sb() when fill_super fails, this results in unload_nls() being called twice for the same sbi->nls pointer: once in hfsplus_fill_super() and again in hfsplus_kill_super() (via delayed_free). Remove the explicit unload_nls() call from the error path in hfsplus_fill_super() to rely solely on the cleanup in ->kill_sb(). [1] https://lore.kernel.org/r/20251201222843.82310-3-mehdi.benhadjkhelifa@gmail.com/ Reported-by: Al Viro Link: https://lore.kernel.org/r/20260203043806.GF3183987@ZenIV/ Signed-off-by: Shardul Bankar Link: https://lore.kernel.org/r/20260204170440.1337261-1-shardul.b@mpiricsoftware.com Signed-off-by: Viacheslav Dubeyko commit dff645f564c38332502140f3ef643f659114c45f Merge: 522a46affdceda 94cf23f6b7c3d6 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:53 2026 -0600 Merge branch 'pci/misc' - Fix documentation typos (Shawn Lin) - Add struct p2pdma_provider kernel doc (Leon Romanovsky) - Remove useless devres WARN_ON() (Philipp Stanner) * pci/misc: PCI: Remove useless WARN_ON() from devres PCI/P2PDMA: Add missing struct p2pdma_provider documentation Documentation: PCI: Fix typos in msi-howto.rst commit 522a46affdceda863df9bf652119f463f480479d Merge: f4e40035d7e7cf 57833f84f6f596 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:52 2026 -0600 Merge branch 'pci/controller/misc' - Add rcar-host OF Kconfig dependency to avoid objtool no-cfi warning (Nathan Chancellor) * pci/controller/misc: PCI: rcar-host: Add OF Kconfig dependency to avoid objtool no-cfi warning commit f4e40035d7e7cfdc9ad5e921378fa34561808488 Merge: bf1676e9721405 f42b3c053b1554 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:52 2026 -0600 Merge branch 'pci/controller/xilinx' - Fix IRQ domain leak when MSI allocation fails (Haotian Zhang) * pci/controller/xilinx: PCI: xilinx: Fix INTx IRQ domain leak in error paths commit bf1676e9721405cd266037788030f4073892795e Merge: 5b4e5be1ccb41b 6b5e2f70a95c1f Author: Bjorn Helgaas Date: Fri Feb 6 17:09:51 2026 -0600 Merge branch 'pci/controller/tegra194' - Relax Kconfig so tegra194 can be built for platforms beyond Tegra194 (Vidya Sagar) * pci/controller/tegra194: PCI: dwc: tegra194: Broaden architecture dependency commit 5b4e5be1ccb41b1ba3a252a4736f298ef7bd5dec Merge: 751776ffaeaf80 aac5ba6acc79b3 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:50 2026 -0600 Merge branch 'pci/controller/tegra' - Export irq_domain_free_irqs() to allow PCI/MSI drivers that tear down MSI domains to be built as modules (Aaron Kling) - Export tegra_cpuidle_pcie_irqs_in_use(), which disables Tegra CC6 while PCI IRQs are in use, so pci-tegra can be built as a module (Aaron Kling) - Allow pci-tegra to be built as a module (Aaron Kling) * pci/controller/tegra: PCI: tegra: Allow building as a module cpuidle: tegra: Export tegra_cpuidle_pcie_irqs_in_use() irqdomain: Export irq_domain_free_irqs() commit 751776ffaeaf8054bcc7e19065bd2e5babec24a1 Merge: 7e4d2a0dae7106 e43e2aa557040b Author: Bjorn Helgaas Date: Fri Feb 6 17:09:50 2026 -0600 Merge branch 'pci/controller/rzg3s-host' - Use pci_generic_config_write(), not custom wrapper, since we don't need the writability provided by the wrapper (Claudiu Beznea) - Drop lock around RZG3S_PCI_MSIRS and RZG3S_PCI_PINTRCVIS updates since they are RW1C registers (Claudiu Beznea) - Fix a device node reference leak in rzg3s_pcie_host_parse_port() (Felix Gu) * pci/controller/rzg3s-host: PCI: rzg3s-host: Fix device node reference leak in rzg3s_pcie_host_parse_port() PCI: rzg3s-host: Drop the lock on RZG3S_PCI_MSIRS and RZG3S_PCI_PINTRCVIS PCI: rzg3s-host: Use pci_generic_config_write() for the root bus commit 7e4d2a0dae71065415fd04559b7a402ab12c1a0a Merge: d13a9ea1974473 05a75df4182e30 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:49 2026 -0600 Merge branch 'pci/controller/plda-starfive' - Use regulator APIs to control the 3v3 power supply of PCIe slots (Hal Feng) * pci/controller/plda-starfive: PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots commit d13a9ea1974473da0b53aa47c45fe9f1aab377d8 Merge: 7d24571321b5ac 7f0cdcddf8bef1 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:49 2026 -0600 Merge branch 'pci/controller/mediatek' - Fix IRQ domain leak when MSI allocation fails (Haotian Zhang) * pci/controller/mediatek: PCI: mediatek: Fix IRQ domain leak when MSI allocation fails commit 7d24571321b5acdd086203ee80818d7d80651ad2 Merge: 5457880be10a57 3a11167d918a0b Author: Bjorn Helgaas Date: Fri Feb 6 17:09:48 2026 -0600 Merge branch 'pci/controller/generic' - Reword 'reg' property error message to account for both missing and malformed properties (Jess) * pci/controller/generic: PCI: host-generic: Avoid reporting incorrect 'missing reg property' error commit 5457880be10a5749e63ca05a2958d02048c57c90 Merge: 42e8a4ef13dc97 613f3255a35a95 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:48 2026 -0600 Merge branch 'pci/controller/dwc-sophgo' - Disable L0s and L1 on Sophgo 2044 PCIe Root Ports (Inochi Amaoto) * pci/controller/dwc-sophgo: PCI: sophgo: Disable L0s and L1 on Sophgo 2044 PCIe Root Ports commit 42e8a4ef13dc9715ed06acb39e6973468061c89e Merge: a1dd5e7a30c163 b5d712e5b87fc5 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:47 2026 -0600 Merge branch 'pci/controller/dwc-rockchip' - Disable unused BAR 0 and BAR 1 for Root Port (Shawn Lin) * pci/controller/dwc-rockchip: PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port commit a1dd5e7a30c163467622ed02e260e4928f3faf41 Merge: 9b2e9baa9fd497 5b026a9e714d33 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:47 2026 -0600 Merge branch 'pci/controller/dwc-qcom-ep' - Add DT binding and driver support for SA8255p Endpoint being managed by firmware (Mrinmay Sarkar) * pci/controller/dwc-qcom-ep: PCI: qcom-ep: Add support for firmware-managed PCIe Endpoint dt-bindings: PCI: qcom,sa8255p-pcie-ep: Document firmware managed PCIe endpoint commit 9b2e9baa9fd497235b6e1c791f12fdbe7957b48a Merge: d375df113c91fe 8d8db7dbf21810 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:46 2026 -0600 Merge branch 'pci/controller/dwc-qcom' - Parse PERST# from all PCIe bridge nodes for future platforms that will have PERST# in Switch Downstream Ports as well as in Root Ports (Manivannan Sadhasivam) - Rename qcom PERST# assert/deassert helpers, e.g., qcom_ep_reset_assert(), to avoid confusion with Endpoint interfaces (Manivannan Sadhasivam) * pci/controller/dwc-qcom: PCI: qcom: Rename PERST# assert/deassert helpers for uniformity PCI: qcom: Parse PERST# from all PCIe bridge nodes # Conflicts: # drivers/pci/controller/dwc/pcie-qcom.c commit d375df113c91fee62968af63c2c49f9571c3b6c4 Merge: 62dea8718b7a7f b79e0875fe8144 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:36 2026 -0600 Merge branch 'pci/controller/dwc-nxp-s32g' * pci/controller/dwc-nxp-s32g: PCI: s32g: Skip Root Port removal during success commit 62dea8718b7a7f6fc9b1408dd1f863f95191fbb6 Merge: 93c398be499a5f a152a90f539095 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:35 2026 -0600 Merge branch 'pci/controller/dwc-imx6' - Add DT binding and driver support for an optional external refclock in addition to the refclock from the internal PLL (Richard Zhu) - Apply i.MX95 ERR051586 erratum workaround (release CLKREQ# so endpoint can assert it when required) during resume (Richard Zhu) - Enable i.MX95 REFCLK by overriding CLKREQ# so it's driven by default (Richard Zhu) - Clear CLKREQ# override if link is up and DT says 'supports-clkreq' so endpoints can use CLKREQ# to exit the L1.2 state (Richard Zhu) * pci/controller/dwc-imx6: PCI: imx6: Clear CLKREQ# override if 'supports-clkreq' DT property is available PCI: imx6: Add CLKREQ# override to enable REFCLK for i.MX95 PCIe PCI: dwc: Invoke post_init in dw_pcie_resume_noirq() PCI: imx6: Add external reference clock input mode support dt-bindings: PCI: pci-imx6: Add external reference clock input dt-bindings: PCI: dwc: Add external reference clock input commit 93c398be499a5fcc3367f793fe3709cd3d13b6f9 Merge: cb3ca564682a0a 43d324eeb08c3d Author: Bjorn Helgaas Date: Fri Feb 6 17:09:34 2026 -0600 Merge branch 'pci/controller/dwc' - Extend PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP() to return a pointer to the preceding Capability (Qiang Yu) - Add dw_pcie_remove_capability() and dw_pcie_remove_ext_capability() to remove Capabilities that are advertised but not fully implemented (Qiang Yu) - Remove MSI and MSI-X Capabilities for DWC controllers in platforms that can't support them, so we automatically fall back to INTx (Qiang Yu) - Remove MSI-X and DPC Capabilities for Qualcomm platforms that advertise but don't support them (Qiang Yu) - Remove duplicate dw_pcie_ep_hide_ext_capability() function and replace with dw_pcie_remove_ext_capability() (Qiang Yu) - Add ASPM L1.1 and L1.2 Substates context to debugfs ltssm_status for drivers that support this (Shawn Lin) - Skip PME_Turn_Off broadcast and L2/L3 transition during suspend if link is not up to avoid an unnecessary timeout (Manivannan Sadhasivam) - Revert dw-rockchip, qcom, and DWC core changes that used link-up IRQs to trigger enumeration instead of waiting for link to be up because the PCI core doesn't allocate bus number space for hierarchies that might be attached (Niklas Cassel) - Make endpoint iATU entry for MSI permanent instead of programming it dynamically, which is slow and racy with respect to other concurrent traffic, e.g., eDMA (Koichiro Den) - Use iMSI-RX MSI target address when possible to fix endpoints using 32-bit MSI (Shawn Lin) - Make dw_pcie_ltssm_status_string() available and use it for logging errors in dw_pcie_wait_for_link() (Manivannan Sadhasivam) - Return -ENODEV when dw_pcie_wait_for_link() finds no devices, -EIO for device present but inactive, -ETIMEDOUT for other failures, so callers can handle these cases differently (Manivannan Sadhasivam) - Allow DWC host controller driver probe to continue if device is not found or found but inactive; only fail when there's an error with the link (Manivannan Sadhasivam) - For controllers like NXP i.MX6QP and i.MX7D, where LTSSM registers are not accessible after PME_Turn_Off, simply wait 10ms instead of polling for L2/L3 Ready (Richard Zhu) - Use multiple iATU entries to map large bridge windows and DMA ranges when necessary instead of failing (Samuel Holland) - Rename struct dw_pcie_rp.has_msi_ctrl to .use_imsi_rx for clarity (Qiang Yu) - Add EPC dynamic_inbound_mapping feature bit for Endpoint Controllers that can update BAR inbound address translation without requiring EPF driver to clear/reset the BAR first, and advertise it for DWC-based Endpoints (Koichiro Den) - Add EPC subrange_mapping feature bit for Endpoint Controllers that can map multiple independent inbound regions in a single BAR, implement subrange mapping, advertise it for DWC-based Endpoints, and add Endpoint selftests for it (Koichiro Den) - Allow overriding default BAR sizes for pci-epf-test (Niklas Cassel) - Make resizable BARs work for Endpoint multi-PF configurations; previously it only worked for PF 0 (Aksh Garg) - Fix Endpoint non-PF 0 support for BAR configuration, ATU mappings, and Address Match Mode (Aksh Garg) - Fix issues with outbound iATU index assignment that caused iATU index to be out of bounds (Niklas Cassel) - Clean up iATU index tracking to be consistent (Niklas Cassel) - Set up iATU when ECAM is enabled; previously IO and MEM outbound windows weren't programmed, and ECAM-related iATU entries weren't restored after suspend/resume, so config accesses failed (Krishna Chaitanya Chundru) * pci/controller/dwc: PCI: dwc: Fix missing iATU setup when ECAM is enabled PCI: dwc: Clean up iATU index usage in dw_pcie_iatu_setup() PCI: dwc: Fix msg_atu_index assignment PCI: dwc: ep: Add comment explaining controller level PTM access in multi PF setup PCI: dwc: ep: Add per-PF BAR and inbound ATU mapping support PCI: dwc: ep: Fix resizable BAR support for multi-PF configurations PCI: endpoint: pci-epf-test: Allow overriding default BAR sizes selftests: pci_endpoint: Add BAR subrange mapping test case misc: pci_endpoint_test: Add BAR subrange mapping test case PCI: endpoint: pci-epf-test: Add BAR subrange mapping test support Documentation: PCI: endpoint: Clarify pci_epc_set_bar() usage PCI: dwc: ep: Support BAR subrange inbound mapping via Address Match Mode iATU PCI: dwc: Advertise dynamic inbound mapping support PCI: endpoint: Add BAR subrange mapping support PCI: endpoint: Add dynamic_inbound_mapping EPC feature PCI: dwc: Rename dw_pcie_rp::has_msi_ctrl to dw_pcie_rp::use_imsi_rx for clarity PCI: dwc: Fix grammar and formatting for comment in dw_pcie_remove_ext_capability() PCI: dwc: Use multiple iATU windows for mapping large bridge windows and DMA ranges PCI: dwc: Remove duplicate dw_pcie_ep_hide_ext_capability() function PCI: dwc: Skip waiting for L2/L3 Ready if dw_pcie_rp::skip_l23_wait is true PCI: dwc: Fail dw_pcie_host_init() if dw_pcie_wait_for_link() returns -ETIMEDOUT PCI: dwc: Rework the error print of dw_pcie_wait_for_link() PCI: dwc: Rename and move ltssm_status_string() to pcie-designware.c PCI: dwc: Return -EIO from dw_pcie_wait_for_link() if device is not active PCI: dwc: Return -ENODEV from dw_pcie_wait_for_link() if device is not found PCI: dwc: Use cfg0_base as iMSI-RX target address to support 32-bit MSI devices PCI: dwc: ep: Cache MSI outbound iATU mapping Revert "PCI: dwc: Don't wait for link up if driver can detect Link Up event" Revert "PCI: qcom: Enumerate endpoints based on Link up event in 'global_irq' interrupt" Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" Revert "PCI: qcom: Don't wait for link if we can detect Link Up" Revert "PCI: dw-rockchip: Enumerate endpoints based on dll_link_up IRQ" Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up" PCI: dwc: Skip PME_Turn_Off broadcast and L2/L3 transition during suspend if link is not up PCI: dw-rockchip: Change get_ltssm() to provide L1 Substates info PCI: dwc: Add L1 Substates context to ltssm_status of debugfs PCI: qcom: Remove DPC Extended Capability PCI: qcom: Remove MSI-X Capability for Root Ports PCI: dwc: Remove MSI/MSIX capability for Root Port if iMSI-RX is used as MSI controller PCI: dwc: Add new APIs to remove standard and extended Capability PCI: Add preceding capability position support in PCI_FIND_NEXT_*_CAP macros commit cb3ca564682a0a02a9f95b7b22ad434a7389daaf Merge: 9a82173951206a 4b361b1e92be25 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:34 2026 -0600 Merge branch 'pci/controller/cadence-j721e' - Add config guards to fix build error when sg2042 is a module but j721e is built-in (Siddharth Vadapalli) * pci/controller/cadence-j721e: PCI: j721e: Add config guards for Cadence Host and Endpoint library APIs commit 9a82173951206abde13d93ed3cbd670fba8945da Merge: a8a811cb3cf404 0297dce758a021 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:33 2026 -0600 Merge branch 'pci/controller/cadence' - Fix cdns_pcie_host_dma_ranges_cmp() to prevent possible invalid sort order (Ian Rogers) * pci/controller/cadence: PCI: cadence: Avoid signed 64-bit truncation and invalid sort commit a8a811cb3cf4044af971ae21d633841542ca36fa Merge: 10973851fc9d20 e5c2061442dda7 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:33 2026 -0600 Merge branch 'pci/controller/aspeed' - Add ASPEED Root Complex DT binding and driver (Jacky Chou) * pci/controller/aspeed: MAINTAINERS: Add ASPEED PCIe RC driver PCI: aspeed: Add ASPEED PCIe RC driver PCI: Add FMT, TYPE and CPL status definition for TLP header dt-bindings: PCI: Add ASPEED PCIe RC support commit 10973851fc9d20347b137b42dca94562c5f1b314 Merge: 0bf920768e062e e74887035fba99 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:32 2026 -0600 Merge branch 'pci/dt-bindings' - Update socionext,uniphier-pcie binding pcie_intc name to 'legacy-interrupt-controller' to match .dts files (Rob Herring) - Merge SC8180x binding into SM8150 (Krzysztof Kozlowski) - Move SDX55, SDM845, QCS404, IPQ5018, IPQ6018, IPQ8074 Gen3, IPQ8074, IPQ4019, IPQ9574, APQ8064, MSM8996, APQ8084 to dedicated schema (Krzysztof Kozlowski) - Add MT7981 compatible to mediatek-pcie-gen3 binding (Sjoerd Simons) - Document Loongson msi-parent property (Yao Zi) - Add Glymur compatible to qcom,pcie-x1e80100 binding (Prudhvi Yarlagadda) * pci/dt-bindings: dt-bindings: PCI: qcom: Document the Glymur PCIe Controller dt-bindings: PCI: loongson: Document msi-parent property dt-bindings: PCI: mediatek-gen3: Add MT7981 PCIe compatible dt-bindings: PCI: qcom,pcie-apq8084: Move APQ8084 to dedicated schema dt-bindings: PCI: qcom,pcie-msm8996: Move MSM8996 to dedicated schema dt-bindings: PCI: qcom,pcie-apq8064: Move APQ8064 to dedicated schema dt-bindings: PCI: qcom,pcie-ipq9574: Move IPQ9574 to dedicated schema dt-bindings: PCI: qcom,pcie-ipq4019: Move IPQ4019 to dedicated schema dt-bindings: PCI: qcom,pcie-ipq8074: Move IPQ8074 to dedicated schema dt-bindings: PCI: qcom,pcie-ipq6018: Move IPQ6018 and IPQ8074 Gen3 to dedicated schema dt-bindings: PCI: qcom,pcie-ipq5018: Move IPQ5018 to dedicated schema dt-bindings: PCI: qcom,pcie-qcs404: Move QCS404 to dedicated schema dt-bindings: PCI: qcom,pcie-sdm845: Move SDM845 to dedicated schema dt-bindings: PCI: qcom,pcie-sdx55: Move SDX55 to dedicated schema dt-bindings: PCI: qcom,pcie-sm8150: Merge SC8180x into SM8150 dt-bindings: PCI: socionext,uniphier-pcie: Fix interrupt controller node name commit 0bf920768e062e98e209f06e0d3b2e552173e2b8 Merge: 2095b9dd2eb7a9 03f336a869b3a3 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:32 2026 -0600 Merge branch 'pci/workqueue' - Add WQ_PERCPU to alloc_workqueue() users (Marco Crivellari) - Replace use of system_wq with system_percpu_wq (Marco Crivellari) - Check for failure of alloc_workqueue() to avoid NULL pointer dereferences (Haotian Zhang) * pci/workqueue: PCI: endpoint: Add missing NULL check for alloc_workqueue() PCI: endpoint: Replace use of system_wq with system_percpu_wq PCI: Add WQ_PERCPU to alloc_workqueue() users # Conflicts: # drivers/pci/endpoint/pci-ep-cfs.c commit 2095b9dd2eb7a944619d49653adff95238586270 Merge: 401b356520f403 b5f88a3947055e Author: Bjorn Helgaas Date: Fri Feb 6 17:09:26 2026 -0600 Merge branch 'pci/virtualization' - Mark ASM1164 SATA controller to avoid bus reset since it fails to train the Link after reset (Alex Williamson) - Mark Nvidia GB10 Root Ports to avoid bus reset since they may fail to retrain the link after reset (Johnny-CC Chang) - Add lockdep and other lock assertions (Ilpo Järvinen) - Add ACS quirk for Qualcomm Hamoa & Glymur, which provides ACS-like features but doesn't advertise an ACS Capability (Krishna Chaitanya Chundru) - Add ACS quirk for Pericom PI7C9X2G404 switches, which fail under load when P2P Redirect Request is enabled (Nicolas Cavallari) - Remove an incorrect unlock in pci_slot_trylock() error handling (Jinhui Guo) - Lock the bridge device for slot reset (Keith Busch) - Enable ACS after IOMMU configuration on OF platforms so ACS is enabled an all devices; previously the first device enumeration (typically a Root Port) was omitted (Manivannan Sadhasivam) - Disable ACS Source Validation for IDT 0x80b5 and 0x8090 switches to work around hardware erratum; previously ACS SV was temporarily disabled, which worked for enumeration but not after reset (Manivannan Sadhasivam) * pci/virtualization: PCI: Disable ACS SV for IDT 0x8090 switch PCI: Disable ACS SV for IDT 0x80b5 switch PCI: Cache ACS Capabilities register PCI: Enable ACS after configuring IOMMU for OF platforms PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] PCI: Add ACS quirk for Qualcomm Hamoa & Glymur PCI: Use device_lock_assert() to verify device lock is held PCI: Use lockdep_assert_held(pci_bus_sem) to verify lock is held PCI: Fix pci_slot_lock () device locking PCI: Fix pci_slot_trylock() error handling PCI: Mark Nvidia GB10 to avoid bus reset PCI: Mark ASM1164 SATA controller to avoid bus reset commit 401b356520f403a6ce8627c1eb74ffd13d38f8d3 Merge: 73b4779864b1e6 8236fc613d44e5 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:26 2026 -0600 Merge branch 'pci/trace' - Add generic RAS tracepoint for hotplug events (Shuai Xue) - Add RAS tracepoint for link speed changes (Shuai Xue) * pci/trace: Documentation: tracing: Add PCI tracepoint documentation PCI: trace: Add RAS tracepoint to monitor link speed changes PCI: trace: Add generic RAS tracepoint for hotplug event commit 73b4779864b1e6adad015d14047ae63b88ef9c4c Merge: bf37448d9b7793 2ecc1bf14e2fda Author: Bjorn Helgaas Date: Fri Feb 6 17:09:25 2026 -0600 Merge branch 'pci/resource' - Build zero-sized resources when a BAR is larger than 4G but pci_bus_addr_t or resource_size_t can't represent 64-bit addresses (Ilpo Järvinen) - Fix bridge window alignment with optional resources, where we previously lost the additional alignment requirement (Ilpo Järvinen) - Stop over-estimating bridge window size since we now assign them without any gaps between them (Ilpo Järvinen) - Increase resource MAX_IORES_LEVEL to avoid /proc/iomem flattening for nested bridges and endpoints (Ilpo Järvinen) - Remove old_size limit from bridge window sizing (Ilpo Järvinen) - Push realloc check into pbus_size_mem() to simplify callers (Ilpo Järvinen) - Pass bridge window resource to pbus_size_mem() to avoid looking it up again (Ilpo Järvinen) - Use res_to_dev_res() instead of open-coding the same search (Ilpo Järvinen) - Add pci_resource_is_bridge_win() helper (Ilpo Järvinen) - Add more logging of resource assignment (Ilpo Järvinen) - Add pbus_mem_size_optional() to handle sizes of optional resources (SR-IOV VF BARs, expansion ROMs, bridge windows) (Ilpo Järvinen) - Move CardBus code to setup-cardbus.c and only build it when CONFIG_CARDBUS is set (Ilpo Järvinen) - Use scnprintf() instead of sprintf() (Ilpo Järvinen) - Add pbus_validate_busn() for Bus Number validation (Ilpo Järvinen) - Don't claim disabled bridge windows to avoid spurious claim failures (Ilpo Järvinen) * pci/resource: PCI: Don't claim disabled bridge windows PCI: Move CardBus bridge scanning to setup-cardbus.c PCI: Add pbus_validate_busn() for Bus Number validation PCI: Add dword #defines for Bus Number + Secondary Latency Timer PCI: Use scnprintf() instead of sprintf() PCI: Handle CardBus-specific params in setup-cardbus.c PCI: Separate CardBus setup & build it only with CONFIG_CARDBUS PCI: Add 'pci' prefix to struct pci_dev_resource handling functions PCI: Use resource_assigned() in setup-bus.c algorithm resource: Mark res given to resource_assigned() as const PCI: Add pbus_mem_size_optional() to handle optional sizes PCI: Check invalid align earlier in pbus_size_mem() PCI: Log reset and restore of resources PCI: Add pci_resource_is_bridge_win() PCI: Fetch dev_res to local var in __assign_resources_sorted() PCI: Use res_to_dev_res() in reassign_resources_sorted() PCI: Pass bridge window resource to pbus_size_mem() PCI: Push realloc check into pbus_size_mem() PCI: Remove old_size limit from bridge window sizing resource: Increase MAX_IORES_LEVEL to 8 PCI: Stop over-estimating bridge window size PCI: Rewrite bridge window head alignment function PCI: Fix bridge window alignment with optional resources PCI: Use resource_set_range() that correctly sets ->end commit bf37448d9b7793544904ccf21e5844b6ff4af3c0 Merge: 65a5ac66cd975d 9db826206f9b7c Author: Bjorn Helgaas Date: Fri Feb 6 17:09:24 2026 -0600 Merge branch 'pci/pwrctrl' - Rename pwrseq, tc9563, and slot driver structs, variables, and functions for consistency (Bjorn Helgaas) - Add power_on/off callbacks with generic signature to pwrseq, tc9563, and slot drivers so they can be used by pwrctrl core (Manivannan Sadhasivam) - Add interfaces to create and destroy pwrctrl devices (Krishna Chaitanya Chundru) - Add interfaces to power devices on and off (Manivannan Sadhasivam) - Switch to pwrctrl interfaces to create, destroy, and power on/off devices, calling them from host controller drivers instead of the PCI core (Manivannan Sadhasivam) - Drop qcom .assert_perst() callbacks since this is now done by the controller driver instead of the pwrctrl driver (Manivannan Sadhasivam) - Add PCIe M.2 connector support to the slot pwrctrl driver (Manivannan Sadhasivam) - Create pwrctrl devices for devicetree PCIe M.2 connector nodes (Manivannan Sadhasivam) * pci/pwrctrl: PCI/pwrctrl: Create pwrctrl device if graph port is found PCI/pwrctrl: Add PCIe M.2 connector support PCI: Drop the assert_perst() callback PCI: qcom: Drop the assert_perst() callbacks PCI/pwrctrl: Switch to pwrctrl create, power on/off, destroy APIs PCI/pwrctrl: Add APIs to power on/off pwrctrl devices PCI/pwrctrl: Add APIs to create, destroy pwrctrl devices PCI/pwrctrl: Add 'struct pci_pwrctrl::power_{on/off}' callbacks PCI/pwrctrl: pwrseq: Factor out power on/off code to helpers PCI/pwrctrl: slot: Factor out power on/off code to helpers PCI/pwrctrl: tc9563: Rename private struct and pointers for consistency PCI/pwrctrl: tc9563: Add local variables to reduce repetition PCI/pwrctrl: tc9563: Clean up whitespace PCI/pwrctrl: tc9563: Use put_device() instead of i2c_put_adapter() PCI/pwrctrl: slot: Rename private struct and pointers for consistency PCI/pwrctrl: pwrseq: Rename private struct and pointers for consistency # Conflicts: # drivers/pci/bus.c commit 65a5ac66cd975d61e674f5633755e68c432888be Merge: 077557d13f092e 62171369cf1779 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:19 2026 -0600 Merge branch 'pci/ptm' - Fix leaks of ptm_debugfs in pcie_ptm_create_debugfs() and pcie_ptm_destroy_debugfs() (Aadityarangan Shridhar Iyengar) * pci/ptm: PCI/PTM: Fix pcie_ptm_create_debugfs() memory leak commit 077557d13f092ebef03f39ba7940e76fce1fd82a Merge: 85fdfc522afd2e cba202aa355d2c Author: Bjorn Helgaas Date: Fri Feb 6 17:09:18 2026 -0600 Merge branch 'pci/portdrv' - Drop device reference unconditionally in pcie_port_remove_service() to fix resource leak (Uwe Kleine-König) - Remove empty pcie_port_shutdown_service() callback (Uwe Kleine-König) - Remove unnecessary bus_type check in pcie_port_bus_match() (Uwe Kleine-König) - Move pcie_port_bus_match() and pcie_port_bus_type to PCIe-specific portdrv.c (Uwe Kleine-König) - Remove unnecessary dev and dev->driver checks in portdrv .probe() and .remove() (Uwe Kleine-König) - Take advantage of pcie_port_bus_type.probe() and .remove() instead of assigning them for each portdrv service driver (Uwe Kleine-König) * pci/portdrv: PCI/portdrv: Use bus-type functions PCI/portdrv: Don't check for valid device and driver in bus callbacks PCI/portdrv: Move pcie_port_bus_type to pcie source file PCI/portdrv: Don't check for the driver's and device's bus PCI/portdrv: Drop empty shutdown callback PCI/portdrv: Fix potential resource leak commit 85fdfc522afd2e81921656853b5f23a1f22984f5 Merge: 26cc2bd5aa8208 51c0996dadaea2 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:18 2026 -0600 Merge branch 'pci/pm' - Avoid redundant delay on transition from D3hot to D3cold if the device was already in D3hot (Brian Norris) - Prevent runtime suspend until devices are fully initialized to avoid saving incompletely configured device state (Brian Norris) * pci/pm: PCI/PM: Prevent runtime suspend until devices are fully initialized PCI/PM: Avoid redundant delays on D3hot->D3cold commit 26cc2bd5aa82085e82ca3cd7e1298d9128248c19 Merge: 1cb15d2054064b 83014d82a1100a Author: Bjorn Helgaas Date: Fri Feb 6 17:09:17 2026 -0600 Merge branch 'pci/p2pdma' - Release per-CPU pgmap ref when vm_insert_page() fails so we don't hang when removing the PCI device (Hou Tao) - Remove incorrect p2pmem_alloc_mmap() warning about page refcount (Hou Tao) - Reset page reference count when page mapping fails (Alistair Popple) * pci/p2pdma: PCI/P2PDMA: Reset page reference count when page mapping fails PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning condition PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails commit 1cb15d2054064b554e31993fe72b9e93233cb10a Merge: a89fdcb98ac826 a5338e365c4559 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:17 2026 -0600 Merge branch 'pci/iov' * pci/iov: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" commit a89fdcb98ac82675879f43b9dfe69ba16be01255 Merge: 2304eeaf2fcad2 550a190494a0d3 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:16 2026 -0600 Merge branch 'pci/iommu' - Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150, where VGA and USB are behind a PCIe-to-PCI bridge and share the same StreamID (Nirmoy Das) * pci/iommu: PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 PCI: Add ASPEED vendor ID to pci_ids.h commit 2304eeaf2fcad24449002f9e1f24f6573305dc48 Merge: 4021a9df0a08b8 699722468a0fca Author: Bjorn Helgaas Date: Fri Feb 6 17:09:15 2026 -0600 Merge branch 'pci/enumeration' - Skip enabling ExtTag on VFs since that bit is Reserved and causes misleading log messages (Håkon Bugge) - Mark 3ware-9650SA Root Port Extended Tags as broken since 9650SA can't handle 8-bit tags (Jörg Wedekind) - Release domain number from the correct IDA when a PCI host bridge has no parent device (Sergey Shtylyov) - Initialize endpoint Read Completion Boundary to match Root Port, regardless of ACPI _HPX (Håkon Bugge) - Apply _HPX PCIe Setting Record only to AER configuration, and only when OS owns PCIe hotplug but not AER, to avoid clobbering Extended Tag and Relaxed Ordering settings (Håkon Bugge) - Clear PCIe Root Status register with a write, not a read/modify/write (Lukas Wunner) * pci/enumeration: PCI/PME: Replace RMW of Root Status register with direct write PCI/ACPI: Restrict program_hpx_type2() to AER bits PCI: Initialize RCB from pci_configure_device() PCI: Check parent for NULL in of_pci_bus_release_domain_nr() PCI: Mark 3ware-9650SA Root Port Extended Tags as broken PCI: Do not attempt to set ExtTag for VFs commit 4021a9df0a08b8495b38f0ddc778ee4ee8d99ab1 Merge: 7ac2359cf1063d 8754dd7639ab0f Author: Bjorn Helgaas Date: Fri Feb 6 17:09:15 2026 -0600 Merge branch 'pci/endpoint' - Fix ntb/vntb copy & paste errors (Baruch Siach) - Add configfs sub-groups synchronously to avoid NULL pointer dereference when racing with removal (Liu Song) - Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy) * pci/endpoint: PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions PCI: endpoint: Avoid creating sub-groups asynchronously Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors commit 7ac2359cf1063de8f3d241aaa871b14a81999bc9 Merge: 88632421689766 46a9f70e93ef73 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:14 2026 -0600 Merge branch 'pci/bwctrl' - Disable bwctrl on Intel P45 to avoid a boot hang (Ilpo Järvinen) * pci/bwctrl: PCI/bwctrl: Disable BW controller on Intel P45 using a quirk commit 88632421689766f394fe69513e5a4d7c31d36caa Merge: 8f0b4cce4481fb e242d09b58e869 Author: Bjorn Helgaas Date: Fri Feb 6 17:09:14 2026 -0600 Merge branch 'pci/aer' - Clear stale errors on reporting agents upon probe so they don't look like recent errors (Lukas Wunner) * pci/aer: PCI/AER: Clear stale errors on reporting agents upon probe commit 46a9f70e93ef73860d1dbbec75ef840031f8f30a Author: Ilpo Järvinen Date: Fri Jan 16 15:15:12 2026 +0200 PCI/bwctrl: Disable BW controller on Intel P45 using a quirk The commit 665745f27487 ("PCI/bwctrl: Re-add BW notification portdrv as PCIe BW controller") was found to lead to a boot hang on a Intel P45 system. Testing without setting Link Bandwidth Management Interrupt Enable (LBMIE) and Link Autonomous Bandwidth Interrupt Enable (LABIE) (PCIe r7.0, sec 7.5.3.7) in bwctrl allowed system to come up. P45 is a very old chipset and supports only up to gen2 PCIe, so not having bwctrl does not seem a huge deficiency. Add no_bw_notif in struct pci_dev and quirk Intel P45 Root Port with it. Reported-by: Adam Stylinski Link: https://lore.kernel.org/linux-pci/aUCt1tHhm_-XIVvi@eggsbenedict/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Adam Stylinski Link: https://patch.msgid.link/20260116131513.2359-1-ilpo.jarvinen@linux.intel.com commit b5f88a3947055e4ef8c04222ec75950d2fdfa79f Author: Manivannan Sadhasivam Date: Fri Jan 2 21:04:50 2026 +0530 PCI: Disable ACS SV for IDT 0x8090 switch The IDT switch with Device ID 0x8090 used in the ARM Juno R2 development board incorrectly raises an ACS Source Validation error on Completions for Config Read Requests, even though PCIe r7.0, sec 6.12.1.1, says that Completions are never affected by ACS Source Validation. This is already handled by the pci_disable_broken_acs_cap() quirk for the IDT 0x80b5 switch. Extend the quirk for the 0x8090 device too. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Marek Szyprowski Tested-by: Naresh Kamboju Link: https://patch.msgid.link/20260102-pci_acs-v3-4-72280b94d288@oss.qualcomm.com commit b26d7fb4a53e671a95b282b4f3922e79dfb1470d Author: Manivannan Sadhasivam Date: Fri Jan 2 21:04:49 2026 +0530 PCI: Disable ACS SV for IDT 0x80b5 switch Some IDT switches incorrectly flag an ACS Source Validation error on completions for config read requests before they have captured the bus number from a previous config write, even though PCIe r7.0, sec 6.12.1.1, says that completions are never affected by ACS Source Validation. The previous workaround, aa667c6408d2 ("PCI: Workaround IDT switch ACS Source Validation erratum"), temporarily disabled ACS SV during enumeration. This was effective but didn't cover the time after switch reset, when it may lose the captured bus number. Avoid the issue by preventing use of ACS SV altogether for these switches by calling pci_disable_broken_acs_cap() from pci_acs_init() and remove the previous workaround in pci_bus_read_dev_vendor_id(). Removal of ACS SV for these switches means they no longer enforce everything in REQ_ACS_FLAGS, so downstream devices are not isolated from each other and the iommu_group may include more devices. Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log, retain specific erratum details] Signed-off-by: Bjorn Helgaas Tested-by: Marek Szyprowski Tested-by: Naresh Kamboju Link: https://patch.msgid.link/20260102-pci_acs-v3-3-72280b94d288@oss.qualcomm.com commit 8f05a5f6745ccc9ff784736608c5a38edb09acc8 Author: Manivannan Sadhasivam Date: Fri Jan 2 21:04:48 2026 +0530 PCI: Cache ACS Capabilities register The ACS Capability register is read-only. Cache it to allow quirks to override it and to avoid re-reading it. Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Tested-by: Marek Szyprowski Tested-by: Naresh Kamboju Link: https://patch.msgid.link/20260102-pci_acs-v3-2-72280b94d288@oss.qualcomm.com commit c41e2fb67e26b04d919257875fa954aa5f6e392e Author: Manivannan Sadhasivam Date: Fri Jan 2 21:04:47 2026 +0530 PCI: Enable ACS after configuring IOMMU for OF platforms Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets 'pci_acs_enable' to request that ACS be enabled for any devices enumerated in the future. OF platforms called pci_enable_acs() for the first device before of_iommu_configure() called pci_request_acs(), so ACS was never enabled for that device (typically a Root Port). Call pci_enable_acs() later, from pci_dma_configure(), after of_dma_configure() has had a chance to call pci_request_acs(). Here's the call path, showing the move of pci_enable_acs() from pci_acs_init() to pci_dma_configure(), where it always happens after pci_request_acs(): pci_device_add pci_init_capabilities pci_acs_init - pci_enable_acs - if (pci_acs_enable) <-- previous test - ... device_add bus_notify(BUS_NOTIFY_ADD_DEVICE) iommu_bus_notifier iommu_probe_device iommu_init_device dev->bus->dma_configure pci_dma_configure # pci_bus_type.dma_configure of_dma_configure of_iommu_configure pci_request_acs pci_acs_enable = 1 <-- set + pci_enable_acs + if (pci_acs_enable) <-- new test + ... bus_probe_device device_initial_probe ... really_probe dev->bus->dma_configure pci_dma_configure # pci_bus_type.dma_configure ... pci_enable_acs Note that we will now call pci_enable_acs() twice for every device, first from the iommu_probe_device() path and again from the really_probe() path. Presumably that's not an issue since we also call dev->bus->dma_configure() twice. For the ACPI platforms, pci_request_acs() is called during ACPI initialization time itself, independent of the IOMMU framework. Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Tested-by: Marek Szyprowski Tested-by: Naresh Kamboju Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com commit 5907a90551e9f7968781f3a6ab8684458959beb3 Author: Nicolas Cavallari Date: Mon Jan 19 17:08:33 2026 +0100 PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] 12d8:b404 is apparently another PCI ID for Pericom PI7C9X2G404 (as identified by the chip silkscreen and lspci). It is also affected by the PI7C9X2G errata (e.g. a network card attached to it fails under load when P2P Redirect Request is enabled), so apply the same quirk to this PCI ID too. PCI bridge [0604]: Pericom Semiconductor PI7C9X2G404 EV/SV PCIe2 4-Port/4-Lane Packet Switch [12d8:b404] (rev 01) Fixes: acd61ffb2f16 ("PCI: Add ACS quirk for Pericom PI7C9X2G switches") Closes: https://lore.kernel.org/all/a1d926f0-4cb5-4877-a4df-617902648d80@green-communications.fr/ Signed-off-by: Nicolas Cavallari Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260119160915.26456-1-nicolas.cavallari@green-communications.fr commit 44d2f70b1fd72c339c72983fcffa181beae3e113 Author: Krishna Chaitanya Chundru Date: Fri Jan 9 13:53:32 2026 +0530 PCI: Add ACS quirk for Qualcomm Hamoa & Glymur The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability, but they do provide ACS-like features to disable peer transactions and validate bus numbers in requests. Add an ACS quirk for Hamoa & Glymur. Signed-off-by: Krishna Chaitanya Chundru Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com commit f06e0ad226fdb875cfd6278882ef28fe817283c5 Author: Ilpo Järvinen Date: Fri Jan 16 14:57:41 2026 +0200 PCI: Use device_lock_assert() to verify device lock is held Multiple function comments say the function should be called with device_lock held. Check that by calling device_lock_assert(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260116125742.1890-3-ilpo.jarvinen@linux.intel.com commit 183c291caa34cc1e721a571058a3f972c5b35122 Author: Ilpo Järvinen Date: Fri Jan 16 14:57:40 2026 +0200 PCI: Use lockdep_assert_held(pci_bus_sem) to verify lock is held The function comment for pci_bus_max_d3cold_delay() declares pci_bus_sem must be held while calling the function which can be automatically checked. Add lockdep_assert_held(pci_bus_sem) to confirm pci_bus_sem is held. Also mark the comment line with Context prefix. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260116125742.1890-2-ilpo.jarvinen@linux.intel.com commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf Author: Keith Busch Date: Fri Jan 30 08:59:51 2026 -0800 PCI: Fix pci_slot_lock () device locking Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to prevent warnings like: pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0 Take and release the lock for the bridge providing the slot for the lock/trylock and unlock routines. Signed-off-by: Keith Busch Signed-off-by: Bjorn Helgaas Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com commit 9368d1ee62829b08aa31836b3ca003803caf0b72 Author: Jinhui Guo Date: Fri Dec 12 22:55:28 2025 +0800 PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com] Fixes: a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") Signed-off-by: Jinhui Guo Signed-off-by: Bjorn Helgaas Reviewed-by: Dan Williams Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251212145528.2555-1-guojinhui.liam@bytedance.com commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 Author: Johnny-CC Chang Date: Thu Nov 13 16:44:06 2025 +0800 PCI: Mark Nvidia GB10 to avoid bus reset After asserting Secondary Bus Reset to downstream devices via a GB10 Root Port, the link may not retrain correctly, e.g., the link may retrain with a lower lane count or config accesses to downstream devices may fail. Prevent use of Secondary Bus Reset for devices below GB10. Signed-off-by: Johnny-CC Chang [bhelgaas: drop pci_ids.h update (only used once), update commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com commit beb2f81792a8a619e5122b6b24a374861309c54b Author: Alex Williamson Date: Thu Jan 8 17:02:08 2026 -0700 PCI: Mark ASM1164 SATA controller to avoid bus reset User forums report issues when assigning ASM1164 SATA controllers to VMs, especially in configurations with multiple controllers. Logs show the device fails to retrain after bus reset. Reports suggest this is an issue across multiple platforms. The device indicates support for PM reset, therefore the device still has a viable function level reset mechanism. The reporting user confirms the device is well behaved in this use case with bus reset disabled. Reported-by: Patrick Bianchi Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/ Signed-off-by: Alex Williamson Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com commit db975debcb8c4cd367a78811bc1ba84c83f854bd Merge: b8c89f5cc2037b 97b859b5ed04db Author: Martin KaFai Lau Date: Fri Feb 6 12:01:25 2026 -0800 Merge branch 'remove-task-and-cgroup-local-storage-percpu-counters' Amery Hung says: ==================== Remove task and cgroup local storage percpu counters * Motivation * The goal of this patchset is to make bpf syscalls and helpers updating task and cgroup local storage more robust by removing percpu counters in them. Task local storage and cgroup storage each employs a percpu counter to prevent deadlock caused by recursion. Since the underlying bpf local storage takes spinlocks in various operations, bpf programs running recursively may try to take a spinlock which is already taken. For example, when a tracing bpf program called recursively during bpf_task_storage_get(..., F_CREATE) tries to call bpf_task_storage_get(..., F_CREATE) again, it will cause AA deadlock if the percpu variable is not in place. However, sometimes, the percpu counter may cause bpf syscalls or helpers to return errors spuriously, as soon as another threads is also updating the local storage or the local storage map. Ideally, the two threads could have taken turn to take the locks and perform their jobs respectively. However, due to the percpu counter, the syscalls and helpers can return -EBUSY even if one of them does not run recursively in another one. All it takes for this to happen is if the two threads run on the same CPU. This happened when BPF-CI ran the selftest of task local data. Since CI runs the test on VM with 2 CPUs, bpf_task_storage_get(..., F_CREATE) can easily fail. The failure mode is not good for users as they need to add retry logic in user space or bpf programs to avoid it. Even with retry, there is no guaranteed upper bound of the loop for a success call. Therefore, this patchset seeks to remove the percpu counter and makes the related bpf syscalls and helpers more reliable, while still make sure recursion deadlock will not happen, with the help of resilient queued spinlock (rqspinlock). * Implementation * To remove the percpu counter without introducing deadlock, bpf_local_storage is refactored by changing the locks from raw_spin_lock to rqspinlock, which prevents deadlock with deadlock detection and a timeout mechanism. The refactor basically repalces the locks with rqspinlock and propagates errors returned by the locking function to BPF helpers or syscalls. bpf_selem_unlink_nofail() is introduced to handle rqspinlock errors in two lock acquiring functions that cannot fail, bpf_local_storage_destroy() and bpf_local_storage_map_free() (i.e., local storage is being freed by the subsystem or the map is being freed). The high level idea is to bitfiel and atomic operation to track who is referencing an selem when any locks cannot be acquired. Additional care is needed to make sure special fields are freed and owner memory are uncharged safely and correctly. If not familiar with local storage, the last section briefly describe the locks and structure of local storage. It also shows the abbreviation used in the rest of the letter. * Test * Task and cgroup local storage selftests have already covered deadlock caused by recursion. Patch 14 updates the expected result of task local storage selftests as task local storage bpf helpers can now run on the same CPU as they don't cause deadlock. * Benchmark * ./bench -p 1 local-storage-create --storage-type \ --batch-size <16,32,64> The benchmark is a microbenchmark stress-testing how fast local storage can be created. After swicthing to rqspinlock and bpf_unlink_selem_nofail(), socket local storage creation speed has a ~5% gain. For task local storage, the number remains the same. Socket local storage batch creation speed creation speed diff --------------- ---- ------------------ ---- Before 16 134.371 ± 0.884k/s 3.12 kmallocs/create 32 133.032 ± 3.405k/s 3.12 kmallocs/create 64 133.494 ± 0.862k/s 3.12 kmallocs/create After 16 140.778 ± 1.306k/s 3.12 kmallocs/create +4.8% 32 140.550 ± 2.058k/s 3.11 kmallocs/create +5.7% 64 139.311 ± 0.911k/s 3.13 kmallocs/create +4.4% Task local storage batch creation speed creation speed diff --------------- ---- ------------------ ---- Before 16 25.301 ± 0.089k/s 2.43 kmallocs/create 32 23.797 ± 0.106k/s 2.51 kmallocs/create 64 23.251 ± 0.187k/s 2.51 kmallocs/create After 16 25.307 ± 0.080k/s 2.45 kmallocs/create +0.0% 32 23.889 ± 0.089k/s 2.46 kmallocs/create +0.0% 64 23.230 ± 0.113k/s 2.63 kmallocs/create -0.1% * Patchset organization * Patch 1-4 convert local storage internal helpers to failable. Patch 5 changes the locks to rqspinlock and propagate the error returned from raw_res_spin_lock_irqsave() to BPF heleprs and syscalls. Patch 6-8 remove percpu counters in task and cgroup local storage. Patch 9-11 address the unlikely rqspinlock errors by switching to bpf_selem_unlink_nofail() in map_free() and destroy(). Patch 12-17 update selftests. * Appendix: local storage internal * There are two locks in bpf_local_storage due to the ownership model as illustrated in the figure below. A map value, which consists of a pointer to the map and the data, is a bpf_local_storage_map_data (sdata) stored in a bpf_local_storage_elem (selem). A selem belongs to a bpf_local_storage and bpf_local_storage_map at the same time. bpf_local_storage::lock (lock_storage->lock in short) protects the list in a bpf_local_storage and bpf_local_storage_map_bucket::lock (b->lock) protects the hash bucket in a bpf_local_storage_map. task_struct ┌ task1 ───────┐ bpf_local_storage │ *bpf_storage │---->┌─────────┐ └──────────────┘<----│ *owner │ bpf_local_storage_elem │ *cache[16] (selem) selem │ *smap │ ┌──────────┐ ┌──────────┐ │ list │------->│ snode │<------->│ snode │ │ lock │ ┌---->│ map_node │<--┐ ┌-->│ map_node │ └─────────┘ │ │ sdata = │ │ │ │ sdata = │ task_struct │ │ {&mapA,} │ │ │ │ {&mapB,} │ ┌ task2 ───────┐ bpf_local_storage └──────────┘ │ │ └──────────┘ │ *bpf_storage │---->┌─────────┐ │ │ │ └──────────────┘<----│ *owner │ │ │ │ │ *cache[16] │ selem │ │ selem │ *smap │ │ ┌──────────┐ │ │ ┌──────────┐ │ list │--│---->│ snode │<--│-│-->│ snode │ │ lock │ │ ┌-->│ map_node │ └-│-->│ map_node │ └─────────┘ │ │ │ sdata = │ │ │ sdata = │ bpf_local_storage_map │ │ │ {&mapB,} │ │ │ {&mapA,} │ (smap) │ │ └──────────┘ │ └──────────┘ ┌ mapA ───────┐ │ │ │ │ bpf_map map │ bpf_local_storage_map_bucket │ │ *buckets │---->┌ b[0] ┐ │ │ │ └─────────────┘ │ list │------┘ │ │ │ lock │ │ │ └──────┘ │ │ smap ... │ │ ┌ mapB ───────┐ │ │ │ bpf_map map │ bpf_local_storage_map_bucket │ │ *buckets │---->┌ b[0] ┐ │ │ └─────────────┘ │ list │--------┘ │ │ lock │ │ └──────┘ │ ┌ b[1] ┐ │ │ list │-----------------------------┘ │ lock │ └──────┘ ... * Changelog * v6 -> v7 - Minor comment and commit msg tweaks - Patch 9: Remove unused "owner" (kernel test robot) - Patch 13: Update comments in task_ls_recursion.c (AI) Link: https://lore.kernel.org/bpf/20260205070208.186382-1-ameryhung@gmail.com/ v5 -> v6 - Redo benchmark - Patch 9: Remove storage->smap as it is not used any more - Patch 17: Remove storage->smap check in selftests - Patch 10, 11: Pass reuse_now = true to bpf_selem_free() and bpf_local_storage_free() to allow faster memory reclaim (Martin) - Patch 10: Use bitfield instead of refcount to track selem state to be more precise, which removes the possibility map_free missing an selem (Martin) - Patch 10: Allow map_free() to free local_storage and drop the change in bpf_local_storage_map_update() (Martin) - Patch 11: Simplify destroy() by not deferring work as an owner is unlikely to have too many maps that stalls RCU (Martin) Link: https://lore.kernel.org/bpf/20260201175050.468601-1-ameryhung@gmail.com/ v4 -> v5 - Patch 1: Fix incorrect bucket calculation (AI) - Patch 3: Fix memory leak in bpf_sk_storage_clone() (AI) - Patch 5: Fix memory leak in bpf_local_storage_update() (AI) - Fix typo/comment/commit msg (AI) - Patch 10: Replace smp_rmb() with smp_mb(). smp_rmb does not imply acquire semantics Link: https://lore.kernel.org/bpf/20260131050920.2574084-1-ameryhung@gmail.com/ v3 -> v4 - Add performance numbers - Avoid stale element when calling bpf_local_storage_map_free() by allowing it to unlink selem from local_storage->list and uncharge memory. Block destroy() from returning when pending map_free() are uncharging - Fix an -EAGAIN bug in bpf_local_storage_update() as map_free() now does not free local storage - Fix possible double-free of selem by ensuring an selem is only processed once for each caller (Kumar) - Fix possible inifinite loop in bpf_selem_unlink_nofail() when iterating b->list by replacing while loop with hlist_for_each_entry_rcu - Fix unsafe iteration in destroy() by iterating local_storage->list using hlist_for_each_entry_rcu - Fix UAF due to clearing storage_owner after destroy(). Flip the order to fix it - Misc clean-up suggested by Martin Link: https://lore.kernel.org/bpf/20251218175628.1460321-1-ameryhung@gmail.com/ v2 -> v3 - Rebase to bpf-next where BPF memory allocator is replaced with kmalloc_nolock() - Revert to selecting bucket based on selem - Introduce bpf_selem_unlink_lockless() to allow unlinking and freeing selem without taking locks Link: https://lore.kernel.org/bpf/20251002225356.1505480-1-ameryhung@gmail.com/ v1 -> v2 - Rebase to bpf-next - Select bucket based on local_storage instead of selem (Martin) - Simplify bpf_selem_unlink (Martin) - Change handling of rqspinlock errors in bpf_local_storage_destroy() and bpf_local_storage_map_free(). Retry instead of WARN_ON. Link: https://lore.kernel.org/bpf/20250729182550.185356-1-ameryhung@gmail.com/ ==================== Link: https://patch.msgid.link/20260205222916.1788211-1-ameryhung@gmail.com Signed-off-by: Martin KaFai Lau commit 97b859b5ed04dbbe99be19895d8498009a19553f Author: Amery Hung Date: Thu Feb 5 14:29:15 2026 -0800 selftests/bpf: Fix outdated test on storage->smap bpf_local_storage_free() already does not rely on local_storage->smap since switching to kmalloc_nolock(). As local_storage->smap is removed, fix the outdated test by dropping the local_storage->smap check. Keep the second map in task local storage map test to test that multiple elements can be added to the storage similar to sk storage test. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-18-ameryhung@gmail.com commit cdce7b0848f6f2be4c6d7dbf243244981d315f6f Author: Amery Hung Date: Thu Feb 5 14:29:14 2026 -0800 selftests/bpf: Choose another percpu variable in bpf for btf_dump test bpf_cgrp_storage_busy has been removed. Use bpf_bprintf_nest_level instead. This percpu variable is also in the bpf subsystem so that if it is removed in the future, BPF-CI will catch this type of CI- breaking change. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-17-ameryhung@gmail.com commit e02cf06b85f8ae337c86db1bad5a0fd54c7bd301 Author: Amery Hung Date: Thu Feb 5 14:29:13 2026 -0800 selftests/bpf: Remove test_task_storage_map_stress_lookup Remove a test in test_maps that checks if the updating of the percpu counter in task local storage map is preemption safe as the percpu counter is now removed. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-16-ameryhung@gmail.com commit 902a79b6389ff39fd736c6fd1581ded1372adbf5 Author: Amery Hung Date: Thu Feb 5 14:29:12 2026 -0800 selftests/bpf: Update task_local_storage/task_storage_nodeadlock test Adjust the error code we are checking against as bpf_task_storage_delete() now returns -EDEADLK or -ETIMEDOUT when deadlock happens. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-15-ameryhung@gmail.com commit e4772031d1053e7640e3094834916ee2605f288f Author: Amery Hung Date: Thu Feb 5 14:29:11 2026 -0800 selftests/bpf: Update task_local_storage/recursion test Update the expected result of the selftest as recursion of task local storage syscall and helpers have been relaxed. Now that the percpu counter is removed, task local storage helpers, bpf_task_storage_get() and bpf_task_storage_delete() can now run on the same CPU at the same time unless they cause deadlock. Note that since there is no percpu counter preventing recursion in task local storage helpers, bpf_trampoline now catches the recursion of on_update as reported by recursion_misses. on_enter: tp_btf/sys_enter on_update: fentry/bpf_local_storage_update Old behavior New behavior ____________ ____________ on_enter on_enter bpf_task_storage_get(&map_a) bpf_task_storage_get(&map_a) bpf_task_storage_trylock succeed bpf_local_storage_update(&map_a) bpf_local_storage_update(&map_a) on_update on_update bpf_task_storage_get(&map_a) bpf_task_storage_get(&map_a) bpf_task_storage_trylock fail on_update::misses++ (1) return NULL create and return map_a::ptr map_a::ptr += 1 (1) bpf_task_storage_delete(&map_a) return 0 bpf_task_storage_get(&map_b) bpf_task_storage_get(&map_b) bpf_task_storage_trylock fail on_update::misses++ (2) return NULL create and return map_b::ptr map_b::ptr += 1 (1) create and return map_a::ptr create and return map_a::ptr map_a::ptr = 200 map_a::ptr = 200 bpf_task_storage_get(&map_b) bpf_task_storage_get(&map_b) bpf_task_storage_trylock succeed lockless lookup succeed bpf_local_storage_update(&map_b) return map_b::ptr on_update bpf_task_storage_get(&map_a) bpf_task_storage_trylock fail lockless lookup succeed return map_a::ptr map_a::ptr += 1 (201) bpf_task_storage_delete(&map_a) bpf_task_storage_trylock fail return -EBUSY nr_del_errs++ (1) bpf_task_storage_get(&map_b) bpf_task_storage_trylock fail return NULL create and return ptr map_b::ptr = 100 Expected result: map_a::ptr = 201 map_a::ptr = 200 map_b::ptr = 100 map_b::ptr = 1 nr_del_err = 1 nr_del_err = 0 on_update::recursion_misses = 0 on_update::recursion_misses = 2 On_enter::recursion_misses = 0 on_enter::recursion_misses = 0 Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-14-ameryhung@gmail.com commit d652f425d5e332125d358a92158a840084061107 Author: Amery Hung Date: Thu Feb 5 14:29:10 2026 -0800 selftests/bpf: Update sk_storage_omem_uncharge test Check sk_omem_alloc when the caller of bpf_local_storage_destroy() returns. bpf_local_storage_destroy() now returns the memory to uncharge to the caller instead of directly uncharge. Therefore, in the sk_storage_omem_uncharge, check sk_omem_alloc when bpf_sk_storage_free() returns instead of bpf_local_storage_destroy(). Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-13-ameryhung@gmail.com commit 0be08389c7f2f9db0194ee666d2e4870886e6ffb Author: Amery Hung Date: Thu Feb 5 14:29:09 2026 -0800 bpf: Switch to bpf_selem_unlink_nofail in bpf_local_storage_{map_free, destroy} Take care of rqspinlock error in bpf_local_storage_{map_free, destroy}() properly by switching to bpf_selem_unlink_nofail(). Both functions iterate their own RCU-protected list of selems and call bpf_selem_unlink_nofail(). In map_free(), to prevent infinite loop when both map_free() and destroy() fail to remove a selem from b->list (extremely unlikely), switch to hlist_for_each_entry_rcu(). In destroy(), also switch to hlist_for_each_entry_rcu() since we no longer iterate local_storage->list under local_storage->lock. bpf_selem_unlink() now becomes dedicated to helpers and syscalls paths so reuse_now should always be false. Remove it from the argument and hardcode it. Acked-by: Alexei Starovoitov Co-developed-by: Martin KaFai Lau Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-12-ameryhung@gmail.com commit 5d800f87d0a5ea1b156c47a4b9fd128479335153 Author: Amery Hung Date: Thu Feb 5 14:29:08 2026 -0800 bpf: Support lockless unlink when freeing map or local storage Introduce bpf_selem_unlink_nofail() to properly handle errors returned from rqspinlock in bpf_local_storage_map_free() and bpf_local_storage_destroy() where the operation must succeeds. The idea of bpf_selem_unlink_nofail() is to allow an selem to be partially linked and use atomic operation on a bit field, selem->state, to determine when and who can free the selem if any unlink under lock fails. An selem initially is fully linked to a map and a local storage. Under normal circumstances, bpf_selem_unlink_nofail() will be able to grab locks and unlink a selem from map and local storage in sequeunce, just like bpf_selem_unlink(), and then free it after an RCU grace period. However, if any of the lock attempts fails, it will only clear SDATA(selem)->smap or selem->local_storage depending on the caller and set SELEM_MAP_UNLINKED or SELEM_STORAGE_UNLINKED according to the caller. Then, after both map_free() and destroy() see the selem and the state becomes SELEM_UNLINKED, one of two racing caller can succeed in cmpxchg the state from SELEM_UNLINKED to SELEM_TOFREE, ensuring no double free or memory leak. To make sure bpf_obj_free_fields() is done only once and when map is still present, it is called when unlinking an selem from b->list under b->lock. To make sure uncharging memory is done only when the owner is still present in map_free(), block destroy() from returning until there is no pending map_free(). Since smap may not be valid in destroy(), bpf_selem_unlink_nofail() skips bpf_selem_unlink_storage_nolock_misc() when called from destroy(). This is okay as bpf_local_storage_destroy() will return the remaining amount of memory charge tracked by mem_charge to the owner to uncharge. It is also safe to skip clearing local_storage->owner and owner_storage as the owner is being freed and no users or bpf programs should be able to reference the owner and using local_storage. Finally, access of selem, SDATA(selem)->smap and selem->local_storage are racy. Callers will protect these fields with RCU. Acked-by: Alexei Starovoitov Co-developed-by: Martin KaFai Lau Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-11-ameryhung@gmail.com commit 3a11167d918a0b727239cedc7bb83f2329bcc49f Author: Jess Date: Tue Jan 20 13:44:44 2026 +1300 PCI: host-generic: Avoid reporting incorrect 'missing reg property' error When pci_host_common_ecam_create() calls of_address_to_resource(), it assumes all errors are due to a missing "reg" property in the device tree node, when they may be due to a malformed "reg" property. This can manifest when running the qemu "virt" board with a 32-bit kernel and `highmem=on` and leads to the very confusing error message: pci-host-generic 4010000000.pcie: host bridge /pcie@10000000 ranges: pci-host-generic 4010000000.pcie: IO 0x003eff0000..0x003effffff -> 0x0000000000 pci-host-generic 4010000000.pcie: MEM 0x0010000000..0x003efeffff -> 0x0010000000 pci-host-generic 4010000000.pcie: MEM 0x8000000000..0xffffffffff -> 0x8000000000 pci-host-generic 4010000000.pcie: missing "reg" property pci-host-generic 4010000000.pcie: probe with driver pci-host-generic failed with error -75 Make the error message more generic. Link: https://www.qemu.org/docs/master/system/arm/virt.html Signed-off-by: Jess Signed-off-by: Bjorn Helgaas Acked-by: Will Deacon Link: https://patch.msgid.link/20260120004444.191093-1-jess@jessie.cafe commit 699722468a0fca8b1b9ce1ffe2532171ddcaff95 Author: Lukas Wunner Date: Sun Oct 26 17:57:57 2025 +0100 PCI/PME: Replace RMW of Root Status register with direct write As of PCIe r7.0, the Root Status register contains a single writeable bit (PME Status, type RW1C) and otherwise just read-only bits and RsvdZ bits (which software must write as zero, PCIe r7.0 sec 7.4). Thus, when clearing the PME Status bit, there's no need to perform a read-modify-write of the register. Instead, the bit can be written directly. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/39f87c99f6c44be3c0371c79e454e6fde7be0d4d.1761497583.git.lukas@wunner.de commit c8be3da14718f1e732afcb61e8ee5b78e8d93808 Author: Amery Hung Date: Thu Feb 5 14:29:07 2026 -0800 bpf: Prepare for bpf_selem_unlink_nofail() The next patch will introduce bpf_selem_unlink_nofail() to handle rqspinlock errors. bpf_selem_unlink_nofail() will allow an selem to be partially unlinked from map or local storage. Save memory allocation method in selem so that later an selem can be correctly freed even when SDATA(selem)->smap is init to NULL. In addition, keep track of memory charge to the owner in local storage so that later bpf_selem_unlink_nofail() can return the correct memory charge to the owner. Updating local_storage->mem_charge is protected by local_storage->lock. Finally, extract miscellaneous tasks performed when unlinking an selem from local_storage into bpf_selem_unlink_storage_nolock_misc(). It will be reused by bpf_selem_unlink_nofail(). This patch also takes the chance to remove local_storage->smap, which is no longer used since commit f484f4a3e058 ("bpf: Replace bpf memory allocator with kmalloc_nolock() in local storage"). Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-10-ameryhung@gmail.com commit 3417dffb58331d1e7e4f3e30ec95cc0f8114ff10 Author: Amery Hung Date: Thu Feb 5 14:29:06 2026 -0800 bpf: Remove unused percpu counter from bpf_local_storage_map_free Percpu locks have been removed from cgroup and task local storage. Now that all local storage no longer use percpu variables as locks preventing recursion, there is no need to pass them to bpf_local_storage_map_free(). Remove the argument from the function. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-9-ameryhung@gmail.com commit 5254de7b9607dd341795cd693185f719a9e7298a Author: Amery Hung Date: Thu Feb 5 14:29:05 2026 -0800 bpf: Remove cgroup local storage percpu counter The percpu counter in cgroup local storage is no longer needed as the underlying bpf_local_storage can now handle deadlock with the help of rqspinlock. Remove the percpu counter and related migrate_{disable, enable}. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-8-ameryhung@gmail.com commit 4a98c2efa613f0b01bc3aa0acb8c3ff7ae29b6f9 Author: Amery Hung Date: Thu Feb 5 14:29:04 2026 -0800 bpf: Remove task local storage percpu counter The percpu counter in task local storage is no longer needed as the underlying bpf_local_storage can now handle deadlock with the help of rqspinlock. Remove the percpu counter and related migrate_{disable, enable}. Since the percpu counter is removed, merge back bpf_task_storage_get() and bpf_task_storage_get_recur(). This will allow the bpf syscalls and helpers to run concurrently on the same CPU, removing the spurious -EBUSY error. bpf_task_storage_get(..., F_CREATE) will now always succeed with enough free memory unless being called recursively. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-7-ameryhung@gmail.com commit 8dabe34b9d5b1135b084268396ed2267107e64c1 Author: Amery Hung Date: Thu Feb 5 14:29:03 2026 -0800 bpf: Change local_storage->lock and b->lock to rqspinlock Change bpf_local_storage::lock and bpf_local_storage_map_bucket::lock from raw_spin_lock to rqspinlock. Finally, propagate errors from raw_res_spin_lock_irqsave() to syscall return or BPF helper return. In bpf_local_storage_destroy(), ignore return from raw_res_spin_lock_irqsave() for now. A later patch will correctly handle errors correctly in bpf_local_storage_destroy() so that it can unlink selems even when failing to acquire locks. For __bpf_local_storage_map_cache(), instead of handling the error, skip updating the cache. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-6-ameryhung@gmail.com commit 403e935f915896243ff93f9a2ff44e5bb6619032 Author: Amery Hung Date: Thu Feb 5 14:29:02 2026 -0800 bpf: Convert bpf_selem_unlink to failable To prepare changing both bpf_local_storage_map_bucket::lock and bpf_local_storage::lock to rqspinlock, convert bpf_selem_unlink() to failable. It still always succeeds and returns 0 until the change happens. No functional change. Open code bpf_selem_unlink_storage() in the only caller, bpf_selem_unlink(), since unlink_map and unlink_storage must be done together after all the necessary locks are acquired. For bpf_local_storage_map_free(), ignore the return from bpf_selem_unlink() for now. A later patch will allow it to unlink selems even when failing to acquire locks. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-5-ameryhung@gmail.com commit fd103ffc57c9a3b8b76bc852ffae5eb630a6ded4 Author: Amery Hung Date: Thu Feb 5 14:29:01 2026 -0800 bpf: Convert bpf_selem_link_map to failable To prepare for changing bpf_local_storage_map_bucket::lock to rqspinlock, convert bpf_selem_link_map() to failable. It still always succeeds and returns 0 until the change happens. No functional change. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-4-ameryhung@gmail.com commit 1b7e0cae85accc9e728004511193e995cd040300 Author: Amery Hung Date: Thu Feb 5 14:29:00 2026 -0800 bpf: Convert bpf_selem_unlink_map to failable To prepare for changing bpf_local_storage_map_bucket::lock to rqspinlock, convert bpf_selem_unlink_map() to failable. It still always succeeds and returns 0 for now. Since some operations updating local storage cannot fail in the middle, open-code bpf_selem_unlink_map() to take the b->lock before the operation. There are two such locations: - bpf_local_storage_alloc() The first selem will be unlinked from smap if cmpxchg owner_storage_ptr fails, which should not fail. Therefore, hold b->lock when linking until allocation complete. Helpers that assume b->lock is held by callers are introduced: bpf_selem_link_map_nolock() and bpf_selem_unlink_map_nolock(). - bpf_local_storage_update() The three step update process: link_map(new_selem), link_storage(new_selem), and unlink_map(old_selem) should not fail in the middle. In bpf_selem_unlink(), bpf_selem_unlink_map() and bpf_selem_unlink_storage() should either all succeed or fail as a whole instead of failing in the middle. So, return if unlink_map() failed. Remove the selem_linked_to_map_lockless() check as an selem in the common paths (not bpf_local_storage_map_free() or bpf_local_storage_destroy()), will be unlinked under b->lock and local_storage->lock and therefore no other threads can unlink the selem from map at the same time. In bpf_local_storage_destroy(), ignore the return of bpf_selem_unlink_map() for now. A later patch will allow bpf_local_storage_destroy() to unlink selems even when failing to acquire locks. Note that while this patch removes all callers of selem_linked_to_map(), a later patch that introduces bpf_selem_unlink_nofail() will use it again. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-3-ameryhung@gmail.com commit 0ccef7079ea8d5f7b896b14be7e400022ff240c6 Author: Amery Hung Date: Thu Feb 5 14:28:59 2026 -0800 bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage A later bpf_local_storage refactor will acquire all locks before performing any update. To simplified the number of locks needed to take in bpf_local_storage_map_update(), determine the bucket based on the local_storage an selem belongs to instead of the selem pointer. Currently, when a new selem needs to be created to replace the old selem in bpf_local_storage_map_update(), locks of both buckets need to be acquired to prevent racing. This can be simplified if the two selem belongs to the same bucket so that only one bucket needs to be locked. Therefore, instead of hashing selem, hashing the local_storage pointer the selem belongs. Performance wise, this is slightly better as update now requires locking one bucket. It should not change the level of contention on one bucket as the pointers to local storages of selems in a map are just as unique as pointers to selems. Acked-by: Alexei Starovoitov Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260205222916.1788211-2-ameryhung@gmail.com commit e242d09b58e869f86071b7889acace4cff215935 Author: Lukas Wunner Date: Sun Jan 25 10:25:51 2026 +0100 PCI/AER: Clear stale errors on reporting agents upon probe Correctable and Uncorrectable Error Status Registers on reporting agents are cleared upon PCI device enumeration in pci_aer_init() to flush past events. They're cleared again when an error is handled by the AER driver. If an agent reports a new error after pci_aer_init() and before the AER driver has probed on the corresponding Root Port or Root Complex Event Collector, that error is not handled by the AER driver: It clears the Root Error Status Register on probe, but neglects to re-clear the Correctable and Uncorrectable Error Status Registers on reporting agents. The error will eventually be reported when another error occurs. Which is irritating because to an end user it appears as if the earlier error has just happened. Amend the AER driver to clear stale errors on reporting agents upon probe. Skip reporting agents which have not invoked pci_aer_init() yet to avoid using an uninitialized pdev->aer_cap. They're recognizable by the error bits in the Device Control register still being clear. Reporting agents may execute pci_aer_init() after the AER driver has probed, particularly when devices are hotplugged or removed/rescanned via sysfs. For this reason, it continues to be necessary that pci_aer_init() clears Correctable and Uncorrectable Error Status Registers. Reported-by: Lucas Van # off-list Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Tested-by: Lucas Van Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de commit 2ecc1bf14e2fdaff78bd1b8e7ed3dba336a3fad5 Author: Ilpo Järvinen Date: Tue Feb 3 19:21:38 2026 +0200 PCI: Don't claim disabled bridge windows The commit 8278c6914306 ("PCI: Preserve bridge window resource type flags") changed bridge window resource behavior such that flags are no longer zero if the bridge window is not valid or is disabled (mainly to preserve the type flags for later use). If a bridge window has its limit smaller than base address, pci_read_bridge_*() sets both IORESOURCE_UNSET and IORESOURCE_DISABLED to indicate the bridge window exists but is not valid with the current base and limit configuration. The code in pci_claim_bridge_resources() still depends on the old behavior of checking validity of the bridge window solely based on !r->flags, whereas after 8278c6914306, also IORESOURCE_DISABLED may indicate bridge window addresses are not valid. While pci_claim_resource() does check IORESOURCE_UNSET, pci_claim_bridge_resource() attempts to clip the resource if pci_claim_resource() fails, which is not correct for bridge window resources that are not valid. As pci_bus_clip_resource() performs clipping regardless of flags and then clears IORESOURCE_UNSET, it should not be called unless the resource is valid. The problem is visible in this log: pci 0000:20:00.0: PCI bridge to [bus 21] pci 0000:20:00.0: bridge window [io size 0x0000 disabled]: can't claim; no address assigned pci 0000:20:00.0: [io 0x0000-0xffffffffffffffff disabled] clipped to [io 0x0000-0xffff disabled] Add IORESOURCE_DISABLED check in pci_claim_bridge_resources() to only claim bridge windows that appear to have a valid configuration. Fixes: 8278c6914306 ("PCI: Preserve bridge window resource type flags") Reported-by: Sizhe Liu Link: https://lore.kernel.org/all/20260203023545.2753811-1-liusizhe5@huawei.com Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/4d9228d6-a230-6ddf-e300-fbf42d523863@linux.intel.com commit 36a1b0061a584430277861fe5d8bd107aef26137 Author: Ian Rogers Date: Tue Feb 3 08:43:23 2026 -0800 perf build: Reduce pmu-events related copying and mkdirs When building to an output directory the previous code would remove files and then copy the source files over. Each source file copy would have a rule to make its directory. All JSON for every architecture was considered a source file. This led to unnecessary copying as a file would be deleted and then the same file copied again, unnecessary directory making, and copying of files not used in the build. A side-effect would be a lot of build messages. This change makes it so that all computed output files are created and then compared to all files in the OUTPUT directory. By filtering out the files that would be copied, unnecessary files can be determined and then deleted - note, this is a phony target which would remake the pmu-events.c if always depended upon, and so the dependency is conditional on there being files to remove. This has some overhead as the $(OUTPUT)/pmu-events is "find" over rather than just "rm -fr", but the savings from unnecessary copying, etc. should make up for this new make overhead. The copy target just does copying but has a dependency on the directory it needs being built, avoiding repetitive mkdirs. The source files for copying only consider the JEVENTS_ARCH unless the JEVENTS_ARCH is all. The metric JSON is only generated if appropriate, rather than always being generated and jevents.py deciding whether or not to use the files. The mypy and pylint targets are fixed as variable names had changed but the rules not updated. The line count of a build with "make -C tools/perf O=/tmp/perf clean all" prior to this change was 2181 lines, after this change it is 1596 lines. This is a reduction of 585 lines or about 27%. The generated pmu-events.c for JEVENTS_ARCH "x86" and "all" were validated as being identical after this change. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 96ca4caf9066f5ebd35b561a521af588a8eb0215 Author: Ioana Ciornei Date: Wed Feb 4 12:09:12 2026 +0200 vfio/fsl-mc: add myself as maintainer Add myself as maintainer of the vfio/fsl-mc driver. The driver is still highly in use on Layerscape DPAA2 SoCs. Signed-off-by: Ioana Ciornei Link: https://lore.kernel.org/r/20260204100913.3197966-1-ioana.ciornei@nxp.com Signed-off-by: Alex Williamson commit a55d4bbbe64494bb92b32402018efb2ffc44d796 Author: Ted Logan Date: Mon Feb 2 17:23:53 2026 -0800 vfio: selftests: only build tests on arm64 and x86_64 Only build vfio self-tests on arm64 and x86_64; these are the only architectures where the vfio self-tests are run. Addresses compiler warnings for format and conversions on i386. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601211830.aBEjmEFD-lkp@intel.com/ Signed-off-by: Ted Logan Reviewed-by: David Matlack Link: https://lore.kernel.org/r/20260202-vfio-selftest-only-64bit-v2-1-9c3ebb37f0f4@fb.com Signed-off-by: Alex Williamson commit e43e2aa557040bbcc5de0eaa1c59ee3ae9e31793 Author: Felix Gu Date: Wed Feb 4 00:46:24 2026 +0800 PCI: rzg3s-host: Fix device node reference leak in rzg3s_pcie_host_parse_port() In rzg3s_pcie_host_parse_port(), of_get_next_child() returns a device node with an incremented reference count that must be released with of_node_put(). The current code fails to call of_node_put() which causes a reference leak. Use the __free(device_node) attribute to ensure automatic cleanup when the variable goes out of scope. Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver") Signed-off-by: Felix Gu Signed-off-by: Bjorn Helgaas Tested-by: Claudiu Beznea Reviewed-by: Claudiu Beznea Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260204-rzg3s-v1-1-142bc81c3312@gmail.com commit 4479884d1fe4d0746a59fb86eaf925478092e7ed Author: Tycho Andersen (AMD) Date: Thu Feb 5 09:32:50 2026 -0700 perf lock contention: fix segfault in `lock contention -b/--use-bpf` When run on a kernel without BTF info, perf crashes: libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled? libbpf: failed to find valid kernel BTF Program received signal SIGSEGV, Segmentation fault. 0x00005555556915b7 in btf.type_cnt () (gdb) bt #0 0x00005555556915b7 in btf.type_cnt () #1 0x0000555555691fbc in btf_find_by_name_kind () #2 0x00005555556920d0 in btf.find_by_name_kind () #3 0x00005555558a1b7c in init_numa_data (con=0x7fffffffd0a0) at util/bpf_lock_contention.c:125 #4 0x00005555558a264b in lock_contention_prepare (con=0x7fffffffd0a0) at util/bpf_lock_contention.c:313 #5 0x0000555555620702 in __cmd_contention (argc=0, argv=0x7fffffffea10) at builtin-lock.c:2084 #6 0x0000555555622c8d in cmd_lock (argc=0, argv=0x7fffffffea10) at builtin-lock.c:2755 #7 0x0000555555651451 in run_builtin (p=0x555556104f00 , argc=3, argv=0x7fffffffea10) at perf.c:349 #8 0x00005555556516ed in handle_internal_command (argc=3, argv=0x7fffffffea10) at perf.c:401 #9 0x000055555565184e in run_argv (argcp=0x7fffffffe7fc, argv=0x7fffffffe7f0) at perf.c:445 #10 0x0000555555651b9f in main (argc=3, argv=0x7fffffffea10) at perf.c:553 Check if btf loading failed, and don't do anything with it in init_numa_data(). This leads to the following error message, instead of just a crash: libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled? libbpf: failed to find valid kernel BTF libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled? libbpf: failed to find valid kernel BTF libbpf: Error loading vmlinux BTF: -ESRCH libbpf: failed to load BPF skeleton 'lock_contention_bpf': -ESRCH Failed to load lock-contention BPF skeleton lock contention BPF setup failed Signed-off-by: Tycho Andersen (AMD) Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Chun-Tse Shao Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: K Prateek Nayak Cc: Mark Rutland Cc: Peter Zijlstra Cc: Ravi Bangoria Signed-off-by: Arnaldo Carvalho de Melo commit 920c5570a67549956eb4e6922eb1ed5e32169a0d Author: Ricky Ringler Date: Thu Jan 29 00:42:27 2026 +0000 perf sort: Replace static cacheline size with sysconf cacheline size Testing: - Built perf - Executed perf mem record and report Committer notes: This addresses a TODO and improves the situation where record and report/c2c are performed on the same machine or in machines with the same cacheline size, but the proper way is to store the cacheline size in the perf.data header at 'record' time and then use it at post processing time. Signed-off-by: Ricky Ringler Cc: Ingo Molnar Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20260129004223.26799-1-ricky.ringler@proton.me Signed-off-by: Arnaldo Carvalho de Melo commit c73a56ed3c97ae6571c2c50e6bc8772b1cee42e0 Author: Thomas Richter Date: Fri Nov 28 10:11:39 2025 +0100 perf test: Fix test case Leader sampling on s390 The subtest 'Leader sampling' some time fails on s390. - for z/VM guest: Disable the test for z/VM guest. There is no CPU Measurement facility to run the test successfully. - for LPAR: Use correct event names. A detailed analysis follows here: Now to the debugging and investigation: 1. With command perf record -e '{cycles,cycles}:S' -- .... the first cycles event starts sampling. On s390 this sets up sampling with a frequency of 4000 Hz. This translates to hardware sample rate of 1377000 instructions per micro-second to meet a frequency of 4000 HZ. 2. With first event cycles now sampling into a hardware buffer, an interrupt is triggered each time a sampling buffer gets full. The interrupt handler is then invoked and debug output shows the processing of samples. The size of one hardware sample is 32 bytes. With an interrupt triggered when the hardware buffer page of 4KB gets full, the interrupt handler processes 128 samples. (This is taken from s390 specific fast debug data gathering) 2025-11-07 14:35:51.977248 000003ffe013cbfa \ perf_event_count_update event->count 0x0 count 0x1502e8 2025-11-07 14:35:51.977248 000003ffe013cbfa \ perf_event_count_update event->count 0x1502e8 count 0x1502e8 2025-11-07 14:35:51.977248 000003ffe013cbfa \ perf_event_count_update event->count 0x2a05d0 count 0x1502e8 2025-11-07 14:35:51.977252 000003ffe013cbfa \ perf_event_count_update event->count 0x3f08b8 count 0x1502e8 2025-11-07 14:35:51.977252 000003ffe013cbfa \ perf_event_count_update event->count 0x540ba0 count 0x1502e8 2025-11-07 14:35:51.977253 000003ffe013cbfa \ perf_event_count_update event->count 0x690e88 count 0x1502e8 2025-11-07 14:35:51.977254 000003ffe013cbfa \ perf_event_count_update event->count 0x7e1170 count 0x1502e8 2025-11-07 14:35:51.977254 000003ffe013cbfa \ perf_event_count_update event->count 0x931458 count 0x1502e8 2025-11-07 14:35:51.977254 000003ffe013cbfa \ perf_event_count_update event->count 0xa81740 count 0x1502e8 3. The value is constantly increasing by the number of instructions executed to generate a sample entry. This is the first line of the pairs of lines. count 0x1502e8 --> 1377000 # perf script | grep 1377000 | wc -l 214 # perf script | wc -l 428 # That is 428 lines in total, and half of the lines contain value 1377000. 4. The second event cycles is opened against the counting PMU, which is an independent PMU and is not interrupt driven. Once enabled it runs in the background and keeps running, incrementing silently about 400+ counters. The counter values are read via assembly instructions. This second counter PMU's read call back function is called when the interrupt handler of the sampling facility processes each sample. The function call sequence is: perf_event_overflow() +--> __perf_event_overflow() +--> __perf_event_output() +--> perf_output_sample() +--> perf_output_read() +--> perf_output_read_group() for_each_sibling_event(sub, leader) { values[n++] = perf_event_count(sub, self); printk("%s sub %p values %#lx\n", __func__, sub, values[n-1]); } The last function perf_event_count() is invoked on the second event cylces *on* the counting PMU. An added printk statement shows the following lines in the dmesg output: # dmesg|grep perf_output_read_group |head -10 [ 332.368620] perf_output_read_group sub 00000000d80b7c1f values 0x3a80917 (1) [ 332.368624] perf_output_read_group sub 00000000d80b7c1f values 0x3a86c7f (2) [ 332.368627] perf_output_read_group sub 00000000d80b7c1f values 0x3a89c15 (3) [ 332.368629] perf_output_read_group sub 00000000d80b7c1f values 0x3a8c895 (4) [ 332.368631] perf_output_read_group sub 00000000d80b7c1f values 0x3a8f569 (5) [ 332.368633] perf_output_read_group sub 00000000d80b7c1f values 0x3a9204b [ 332.368635] perf_output_read_group sub 00000000d80b7c1f values 0x3a94790 [ 332.368637] perf_output_read_group sub 00000000d80b7c1f values 0x3a9704b [ 332.368638] perf_output_read_group sub 00000000d80b7c1f values 0x3a99888 # This correlates with the output of # perf report -D | grep 'id 00000000000000'|head -10 ..... id 0000000000000006, value 00000000001502e8, lost 0 ..... id 000000000000000e, value 0000000003a80917, lost 0 --> line (1) above ..... id 0000000000000006, value 00000000002a05d0, lost 0 ..... id 000000000000000e, value 0000000003a86c7f, lost 0 --> line (2) above ..... id 0000000000000006, value 00000000003f08b8, lost 0 ..... id 000000000000000e, value 0000000003a89c15, lost 0 --> line (3) above ..... id 0000000000000006, value 0000000000540ba0, lost 0 ..... id 000000000000000e, value 0000000003a8c895, lost 0 --> line (4) above ..... id 0000000000000006, value 0000000000690e88, lost 0 ..... id 000000000000000e, value 0000000003a8f569, lost 0 --> line (5) above Summary: - Above command starts the CPU sampling facility, with runs interrupt driven when a 4KB page is full. An interrupt processes the 128 samples and calls eventually perf_output_read_group() for each sample to save it in the event's ring buffer. - At that time the CPU counting facility is invoked to read the value of the event cycles. This value is saved as the second value in the sample_read structure. - The first and odd lines in the perf script output displays the period value between 2 samples being created by hardware. It is the number of instructions executes before the hardware writes a sample. - The second and even lines in the perf script output displays the number of CPU cycles needed to process each sample and save it in the event's ring buffer. These 2 different values can never be identical on s390. Since event leader sampling is not possible on s390 the perf tool will return EOPNOTSUPP soon. Perpare the test case for that. Suggested-by: James Clark Reviewed-by: Jan Polensky Signed-off-by: Thomas Richter Tested-by: Jan Polensky Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Namhyung Kim Cc: Sumanth Korikkar Cc: Vasily Gorbik Signed-off-by: Arnaldo Carvalho de Melo commit 64ea7a4620008652c7f72065ae61efbde7af3ea0 Author: Namhyung Kim Date: Thu Feb 5 17:27:43 2026 -0800 perf annotate: Fix register usage in data type profiling On data type profiling, it tried to match register name with a partial string. For example, it allowed to match with "%rbp)" or "%rdi,8)". But with recent change in the area, it doesn't match anymore and break the data type profiling. Let's pass the correct register name by removing the unwanted part. Add arch__dwarf_regnum() to handle it in a single place. Closes: 7d3n23li6drroxrdlpxn7ixehdeszkjdftah3zyngjl2qs22ef@yelcjv53v42o Reported-by: Dmitry Dolgov <9erthalion6@gmail.com> Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit bb5a920b9099127915706fdd23eb540c9a69c338 Author: Chun-Tse Shao Date: Tue Feb 3 15:06:22 2026 -0800 perf stat: Ensure metrics are displayed even with failed events Currently, `perf stat` skips or hides metrics when the underlying hardware events cannot be counted (e.g., due to insufficient permissions or unsupported events). In `--metric-only` mode, this often results in missing columns or blank spaces, making the output difficult to parse. Modify the logic to ensure metrics are consistently displayed by propagating NAN (Not a Number) through the expression evaluator. Specifically: 1. Update `prepare_metric()` in stat-shadow.c to treat uncounted events (where `run == 0`) as NAN. This leverages the existing math in expr.y to propagate NAN through metric expressions. 2. Remove the early return in the display logic's `printout()` function that was previously skipping metrics in `--metric-only` mode for failed events. l 3. Simplify `perf_stat__skip_metric_event()` to no longer depend on event runtime. Tested: 1. `perf all metrics test` did not crash while paranoid is 2. 2. Multiple combinations with `CPUs_utilized` while paranoid is 2. $ ./perf stat -M CPUs_utilized -a -- sleep 1 Performance counter stats for 'system wide': msec cpu-clock:u # nan CPUs CPUs_utilized 1,006,356,120 duration_time 1.004375550 seconds time elapsed $ ./perf stat -M CPUs_utilized -a -j -- sleep 1 {"counter-value" : "", "unit" : "msec", "event" : "cpu-clock:u", "event-runtime" : 0, "pcnt-running" : 100.00, "metric-value" : "nan", "metric-unit" : "CPUs CPUs_utilized"} {"counter-value" : "1006642462.000000", "unit" : "", "event" : "duration_time", "event-runtime" : 1, "pcnt-running" : 100.00} $ ./perf stat -M CPUs_utilized -a --metric-only -- sleep 1 Performance counter stats for 'system wide': CPUs CPUs_utilized nan 1.004424652 seconds time elapsed $ ./perf stat -M CPUs_utilized -a --metric-only -j -- sleep 1 {"CPUs CPUs_utilized" : "none"} Reviewed-by: Ian Rogers Signed-off-by: Chun-Tse Shao Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Yang Li Signed-off-by: Arnaldo Carvalho de Melo commit 446c595dc0dd1759e56a7d736752d65361e13753 Author: Ian Rogers Date: Thu Feb 5 12:56:22 2026 -0800 perf test addr2line_inlines: Ensure inline information shows on LBR leaves Expand the addr2line inline function testing to also run for an LBR callchain, skipping if LBR support isn't present. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Dapeng Mi Cc: Dmitriy Vyukov Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Krzysztof Łopatowski Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Signed-off-by: Arnaldo Carvalho de Melo commit 04f81f45b432feab13a169a82a032987e948b1a6 Author: Ian Rogers Date: Thu Feb 5 12:56:21 2026 -0800 perf callchain lbr: Make the leaf IP that of the sample The current IP of a leaf function when reported from a perf record with "--call-graph lbr" is the "to" field of the LBR branch stack record. The sample for the event being recorded may be further into the function and there may be inlining information associated with it. Rather than use the branch stack "to" field in this case switch to the callchain appending the sample->ip and thereby allowing the inline information to show. Before this change: ``` $ perf record --call-graph lbr perf test -w inlineloop ... $ perf script --fields +srcline ... perf-inlineloop 467586 4649.344493: 950905 cpu_core/cycles/P: 55dfda2829c0 parent+0x0 (perf) inlineloop.c:31 55dfda282a96 inlineloop+0x86 (perf) inlineloop.c:47 55dfda236420 run_workload+0x59 (perf) builtin-test.c:715 55dfda236b03 cmd_test+0x413 (perf) builtin-test.c:825 ... ``` After this change: ``` $ perf record --call-graph lbr perf test -w inlineloop ... $ perf script --fields +srcline ... perf-inlineloop 529703 11878.680815: 950905 cpu_core/cycles/P: 555ce86be9e6 leaf+0x26 inlineloop.c:20 (inlined) 555ce86be9e6 middle+0x26 inlineloop.c:27 (inlined) 555ce86be9e6 parent+0x26 (perf) inlineloop.c:32 555ce86bea96 inlineloop+0x86 (perf) inlineloop.c:47 555ce8672420 run_workload+0x59 (perf) builtin-test.c:715 555ce8672b03 cmd_test+0x413 (perf) builtin-test.c:825 ... ``` Reviewed-by: Andi Kleen Signed-off-by: Ian Rogers Acked-by: Dapeng Mi Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Dmitriy Vyukov Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Krzysztof Łopatowski Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Signed-off-by: Arnaldo Carvalho de Melo commit a724a8fce5e25b45b2146abea61d22d6634dde59 Author: Leo Yan Date: Fri Feb 6 11:00:20 2026 +0000 perf kvm stat: Fix build error Since commit ceea279f9376 ("perf kvm stat: Remove use of the arch directory"), a native build on Arm64 machine reports: util/kvm-stat-arch/kvm-stat-x86.c:7:10: fatal error: asm/svm.h: No such file or directory 7 | #include | ^~~~~~~~~~~ compilation terminated. The build fails to find x86's asm headers when building for Arm64. Fix this by including asm headers with relative path instead. Fixes: ceea279f9376 ("perf kvm stat: Remove use of the arch directory") Signed-off-by: Leo Yan Link: https://lore.kernel.org/r/20260206-perf_fix_kvm_stat_error-v1-1-ad40115876be@arm.com Cc: Ian Rogers Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: James Clark Cc: Arnaldo Carvalho de Melo Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 2cdfe39dc9447a09c568da1b6351c70b770dd923 Author: Yaxiong Tian Date: Wed Feb 4 09:54:01 2026 +0800 tracing/kprobes: Skip setup_boot_kprobe_events() when no cmdline event When the 'kprobe_event=' kernel command-line parameter is not provided, there is no need to execute setup_boot_kprobe_events(). This change optimizes the initialization function init_kprobe_trace() by skipping unnecessary work and effectively prevents potential blocking that could arise from contention on the event_mutex lock in subsequent operations. Link: https://patch.msgid.link/20260204015401.163748-1-tianyaxiong@kylinos.cn Acked-by: Masami Hiramatsu (Google) Signed-off-by: Yaxiong Tian Signed-off-by: Steven Rostedt (Google) commit 0c2580a8094693578afa9b6cbcee406cf131920e Author: Yaxiong Tian Date: Wed Feb 4 09:53:53 2026 +0800 blktrace: Make init_blk_tracer() asynchronous The init_blk_tracer() function causes significant boot delay as it waits for the trace_event_sem lock held by trace_event_update_all(). Specifically, its child function register_trace_event() requires this lock, which is occupied for an extended period during boot. To resolve this, the execution of primary init_blk_tracer() is moved to the trace_init_wq workqueue, allowing it to run asynchronously, and prevent blocking the main boot thread. Link: https://patch.msgid.link/20260204015353.163331-1-tianyaxiong@kylinos.cn Acked-by: Masami Hiramatsu (Google) Signed-off-by: Yaxiong Tian Signed-off-by: Steven Rostedt (Google) commit 1c48f7ab72a8c9d6419622931e622e5247e979f5 Author: Yaxiong Tian Date: Wed Feb 4 09:53:44 2026 +0800 tracing: Rename `eval_map_wq` and allow other parts of tracing use it The eval_map_work_func() function, though queued in eval_map_wq, holds the trace_event_sem read-write lock for a long time during kernel boot. This causes blocking issues for other functions. Rename eval_map_wq to trace_init_wq and make it global, thereby allowing other parts of tracing to schedule work on this queue asynchronously and avoiding blockage of the main boot thread. Link: https://patch.msgid.link/20260204015344.162818-1-tianyaxiong@kylinos.cn Suggested-by: Steven Rostedt Acked-by: Masami Hiramatsu (Google) Signed-off-by: Yaxiong Tian Signed-off-by: Steven Rostedt (Google) commit 0528a348b04b327a4611e29589beb4c9ae81304a Author: Felix Gu Date: Sat Jan 31 01:49:09 2026 +0800 cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() In ax45mp_cache_init(), of_find_matching_node() returns a device node with an incremented reference count that must be released with of_node_put(). The current code fails to call of_node_put() which causes a reference leak. Use the __free(device_node) attribute to ensure automatic cleanup when the variable goes out of scope. Fixes: d34599bcd2e4 ("cache: Add L2 cache management for Andes AX45MP RISC-V core") Signed-off-by: Felix Gu Signed-off-by: Conor Dooley commit 3c85234b979af71cb9db5eb976ea08a468415767 Author: Felix Gu Date: Sat Jan 31 01:13:45 2026 +0800 cache: starfive: fix device node leak in starlink_cache_init() of_find_matching_node() returns a device_node with refcount incremented. Use __free(device_node) attribute to automatically call of_node_put() when the variable goes out of scope, preventing the refcount leak. Fixes: cabff60ca77d ("cache: Add StarFive StarLink cache management") Signed-off-by: Felix Gu Reviewed-by: Jonathan Cameron Signed-off-by: Conor Dooley commit ff4b6bf7eef4f5b921eed78f2816abcc55bcdd68 Author: Conor Dooley Date: Wed Jan 28 20:50:33 2026 +0000 riscv: dts: microchip: add can resets to mpfs The can IP on PolarFire SoC requires the use of the blocks reset during normal operation, and the property is therefore required by the binding, causing a warning on the m100pfsevp board where it is default enabled: mpfs-m100pfsevp.dtb: can@2010c000 (microchip,mpfs-can): 'resets' is a required property Add the reset to both can nodes. Signed-off-by: Conor Dooley commit 66fb10bc5c25c83ab268be0390863dd4299d063c Author: Dirk Behme Date: Mon Jan 26 08:17:38 2026 +0100 rust: dma: add missing __rust_helper annotations The commit d8932355f8c5 ("rust: dma: add helpers for architectures without CONFIG_HAS_DMA") missed adding the __rust_helper annotations. Add them. Reported-by: Gary Guo Closes: https://lore.kernel.org/rust-for-linux/DFW4F5OSDO7A.TBUOX6RCN8G7@garyguo.net/ Signed-off-by: Dirk Behme Reviewed-by: Gary Guo Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260126071738.1670967-1-dirk.behme@de.bosch.com [ Fix minor checkpatch.pl warning. - Danilo ] Signed-off-by: Danilo Krummrich commit 408e4f9408ec5e4dfec4a3adc8b411b046f85a8e Author: Dirk Behme Date: Mon Feb 2 07:40:01 2026 +0100 samples: rust: pci: Remove some additional `.as_ref()` for `dev_*` print The commit 600de1c008b2 ("rust: pci: remove redundant `.as_ref()` for `dev_*` print") removed `.as_ref()` for `dev_*` prints. Nearly at the same time the commit e62e48adf76c ("sample: rust: pci: add tests for config space routines") was merged. Which missed this removal, then. Signed-off-by: Dirk Behme Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260202064001.176787-1-dirk.behme@de.bosch.com Signed-off-by: Danilo Krummrich commit b8c89f5cc2037b1902d680d169332fda71a0d38e Merge: 1ace9bac1ad2bc 88af9fefed412e Author: Alexei Starovoitov Date: Fri Feb 6 09:36:36 2026 -0800 Merge branch 'fix-some-corner-cases-in-xskxceiver' Larysa Zaremba says: ==================== Fix some corner cases in xskxceiver While working on XDP and AF_XDP support for ixgbevf driver, I came across two distinct problems that caused tests to fail when they shouldn't have. ==================== Link: https://patch.msgid.link/20260203155103.2305816-1-larysa.zaremba@intel.com Signed-off-by: Alexei Starovoitov commit 88af9fefed412e4bea9a1a771cbe6fe347fa3507 Author: Larysa Zaremba Date: Tue Feb 3 16:50:58 2026 +0100 selftests/xsk: fix number of Tx frags in invalid packet The issue occurs in TOO_MANY_FRAGS test case when xdp_zc_max_segs is set to an odd number. TOO_MANY_FRAGS test case contains an invalid packet consisting of (xdp_zc_max_segs) frags. Every frag, even the last one has XDP_PKT_CONTD flag set. This packet is expected to be dropped. After that, there is a valid linear packet, which is expected to be received back. Once (xdp_zc_max_segs) is an odd number, the last packet cannot be received, if packet forwarding between Rx and Tx interfaces relies on the ethernet header, e.g. checks for ETH_P_LOOPBACK. Packet is malformed, if all traffic is looped. Turns out, sending function processes multiple invalid frags as if they were in 2-frag packets. So once the invalid mbuf packet contains an odd number of those, the valid packet after gets paired with the previous invalid descriptor, and hence does not get an ethernet header generated, so it is either dropped or malformed. Make invalid packets in verbatim mode always have only a single frag. For such packets, number of frags is otherwise meaningless, as descriptor flags are pre-configured in verbatim mode and packet data is not generated for invalid descriptors. Fixes: 697604492b64 ("selftests/xsk: add invalid descriptor test for multi-buffer") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Link: https://lore.kernel.org/r/20260203155103.2305816-3-larysa.zaremba@intel.com Signed-off-by: Alexei Starovoitov commit 42e41b2a0afa04ca49ee2725aadf90ccb058ed28 Author: Larysa Zaremba Date: Tue Feb 3 16:50:57 2026 +0100 selftests/xsk: properly handle batch ending in the middle of a packet Referenced commit reduced the scope of the variable pkt, so now it has to be reinitialized via pkt_stream_get_next_rx_pkt(), which also increments some counters. When the packet is interrupted by the batch ending, pkt stream therefore proceeds to the next packet, while xsk ring still contains the previous one, this results in a pkt_nb mismatch. Decrement the affected counters when packet is interrupted. Fixes: 8913e653e9b8 ("selftests/xsk: Iterate over all the sockets in the receive pkts function") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Link: https://lore.kernel.org/r/20260203155103.2305816-2-larysa.zaremba@intel.com Signed-off-by: Alexei Starovoitov commit b010c782341b79edbeb80706360b772db908daa6 Author: Shengjiu Wang Date: Fri Feb 6 09:48:05 2026 +0800 ASoC: fsl_asrc_dma: allocate memory from dma device The dma-coherent property is used to indicate a device is capable of coherent DMA operations. On i.MX952, one of EDMA devices support such feature, in order to support the EDMA device, the memory needs to be allocated from the DMA device. Make this driver to support both non dma-coherent and dma-coherent dma engine. Remove dma coerce_mask_and coherent() because DMA provider already set it according to its capability. Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260206014805.3897764-5-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 6a8c6f5587337eceb387812b6f47bc16c125b883 Author: Shengjiu Wang Date: Fri Feb 6 09:48:04 2026 +0800 ASoC: fsl_asrc: Add support for i.MX952 platform Add a compatible string, clock mapping table and enable the option 'start_before_dma' to support ASRC on the i.MX952 platform. The clock mapping table is to map the clock sources on i.MX952 to the clock ids in the driver, the clock ids are for all the clock sources on all supported platforms. Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Reviewed-by: Frank Li Link: https://patch.msgid.link/20260206014805.3897764-4-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 83447a38ba9abac52bc110566d3e117753899f69 Author: Shengjiu Wang Date: Fri Feb 6 09:48:03 2026 +0800 ASoC: fsl_asrc_m2m: Add option to start ASRC before DMA device for M2M There is a limitation on i.MX952 that dma request is not cleared at the end of conversion with dma slave mode. Which causes sample is dropped from the input fifo on the second time if dma is triggered before the client device and EDMA may copy wrong data from output fifo as the output fifo is not ready in the beginning. The solution is to trigger asrc before dma on i.MX952, and add delay to wait output data is generated then start the EDMA for output, otherwise the m2m function has noise issues. So add an option to start ASRC first for M2M before ASRC is enabled on i.MX952. Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Reviewed-by: Frank Li Link: https://patch.msgid.link/20260206014805.3897764-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 37bb773b4a5a5107b92beda3447a7c6c0cfc1237 Author: Shengjiu Wang Date: Fri Feb 6 09:48:02 2026 +0800 ASoC: dt-bindings: fsl,imx-asrc: Add support for i.MX952 platform Add new compatible string 'fsl,imx952-asrc' for i.MX952 platform, below are the differences that make this ASRC not fallback compatible with other platforms. 1) There is a power domain on i.MX952 for the wakeupmix system where ASRC is in. But it is enabled by default, ASRC device don't need to enable it, so it is optional for i.MX952. 2) The clock sources of ASRC are different on i.MX952. 3) There is a limitation on i.MX952 that DMA request is not cleared at the end of conversion with dma slave mode. Which causes sample is dropped from the input fifo on the second time if DMA is triggered before the client device and DMA may copy wrong data from output fifo as the output fifo is not ready in the beginning. So there is specially handling in the driver. Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20260206014805.3897764-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit c3bb3295637cc9bf514f690941ca9a385bf30113 Author: Corey Minyard Date: Fri Feb 6 10:33:52 2026 -0600 ipmi:si: Use a long timeout when the BMC is misbehaving If the driver goes into HOSED state, don't reset the timeout to the short timeout in the timeout handler. Reported-by: Igor Raits Closes: https://lore.kernel.org/linux-acpi/CAK8fFZ58fidGUCHi5WFX0uoTPzveUUDzT=k=AAm4yWo3bAuCFg@mail.gmail.com/ Fixes: bc3a9d217755 ("ipmi:si: Gracefully handle if the BMC is non-functional") Cc: stable@vger.kernel.org # 4.18 Signed-off-by: Corey Minyard commit de4b09abf088ba0a6a0bebb8b618fd29b9ce5c35 Author: Samasth Norway Ananda Date: Tue Jan 27 19:18:12 2026 -0800 landlock: Document audit blocker field format Add comprehensive documentation for the ``blockers`` field format in AUDIT_LANDLOCK_ACCESS records, including all possible prefixes (fs., net., scope.) and their meanings. Also fix a typo and update the documentation date to reflect these changes. Signed-off-by: Samasth Norway Ananda Link: https://lore.kernel.org/r/20260128031814.2945394-4-samasth.norway.ananda@oracle.com Signed-off-by: Mickaël Salaün commit fe72ce6710cba088b67e3279de87d7341fafc357 Author: Samasth Norway Ananda Date: Tue Jan 27 19:18:11 2026 -0800 landlock: Add errata documentation section Add errata section with code examples for querying errata and a warning that most applications should not check errata. Use kernel-doc directives to include errata descriptions from the header files instead of manual links. Also enhance existing DOC sections in security/landlock/errata/abi-*.h files with Impact sections, and update the code comment in syscalls.c to remind developers to update errata documentation when applicable. This addresses the gap where the kernel implements errata tracking but provides no user-facing documentation on how to use it, while improving the existing technical documentation in-place rather than duplicating it. Signed-off-by: Samasth Norway Ananda Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260128031814.2945394-3-samasth.norway.ananda@oracle.com [mic: Cosmetic fix] Signed-off-by: Mickaël Salaün commit 6100f2904e0ea1f2c832ab6e93573fae47d3b13e Author: Samasth Norway Ananda Date: Tue Jan 27 19:18:10 2026 -0800 landlock: Add backwards compatibility for restrict flags Add backwards compatibility handling for the restrict flags introduced in ABI version 7. This is shown as a separate code block (similar to the ruleset_attr handling in the switch statement) because restrict flags are passed to landlock_restrict_self() rather than being part of the ruleset attributes. Also fix misleading description of the /usr rule which incorrectly stated it "only allow[s] reading" when the code actually allows both reading and executing (LANDLOCK_ACCESS_FS_EXECUTE is included in allowed_access). Signed-off-by: Samasth Norway Ananda Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20260128031814.2945394-2-samasth.norway.ananda@oracle.com [mic: Rebased and fixed conflict] Signed-off-by: Mickaël Salaün commit d90ba69e3335aba96c25a0ea7d46c5c115cd4756 Author: Matthieu Buffet Date: Fri Dec 12 17:36:58 2025 +0100 landlock: Refactor TCP socket type check Move the socket type check earlier, so that we will later be able to add elseifs for other types. Ordering of checks (socket is of a type we enforce restrictions on) / (current creds have Landlock restrictions) should not change anything. Signed-off-by: Matthieu Buffet Link: https://lore.kernel.org/r/20251212163704.142301-3-matthieu@buffet.re Signed-off-by: Mickaël Salaün commit bbb6f53e905ca119f99ccab8496f8921d9db9c50 Author: Matthieu Buffet Date: Fri Dec 12 17:36:57 2025 +0100 landlock: Minor reword of docs for TCP access rights - Move ABI requirement next to each access right to prepare adding more access rights; - Mention the possibility to remove the random component of a socket's ephemeral port choice within the netns-wide ephemeral port range, since it allows choosing the "random" ephemeral port. Signed-off-by: Matthieu Buffet Link: https://lore.kernel.org/r/20251212163704.142301-2-matthieu@buffet.re Signed-off-by: Mickaël Salaün commit 39508405f6e6c8ce8a0f4bf93b344610d9051043 Author: Günther Noack Date: Thu Nov 27 12:51:36 2025 +0100 landlock: Document LANDLOCK_RESTRICT_SELF_TSYNC Add documentation for LANDLOCK_RESTRICT_SELF_TSYNC. It does not need to go into the main example, but it has a section in the ABI compatibility notes. In the HTML rendering, the main reference is the system call documentation, which is included from the landlock.h header file. Cc: Andrew G. Morgan Cc: John Johansen Cc: Paul Moore Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20251127115136.3064948-4-gnoack@google.com [mic: Update date] Signed-off-by: Mickaël Salaün commit 50c058e3eafe31a5197d4cffb599f2f5f165d4eb Author: Günther Noack Date: Thu Nov 27 12:51:35 2025 +0100 selftests/landlock: Add LANDLOCK_RESTRICT_SELF_TSYNC tests Exercise various scenarios where Landlock domains are enforced across all of a processes' threads. Test coverage for security/landlock is 91.6% of 2130 lines according to LLVM 21. Cc: Andrew G. Morgan Cc: John Johansen Cc: Paul Moore Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20251127115136.3064948-3-gnoack@google.com [mic: Fix subject, use EXPECT_EQ(close()), make helpers static, add test coverage] Signed-off-by: Mickaël Salaün commit 42fc7e6543f6d17d2cf9ed3e5021f103a3d11182 Author: Günther Noack Date: Thu Nov 27 12:51:34 2025 +0100 landlock: Multithreading support for landlock_restrict_self() Introduce the LANDLOCK_RESTRICT_SELF_TSYNC flag. With this flag, a given Landlock ruleset is applied to all threads of the calling process, instead of only the current one. Without this flag, multithreaded userspace programs currently resort to using the nptl(7)/libpsx hack for multithreaded policy enforcement, which is also used by libcap and for setuid(2). Using this userspace-based scheme, the threads of a process enforce the same Landlock policy, but the resulting Landlock domains are still separate. The domains being separate causes multiple problems: * When using Landlock's "scoped" access rights, the domain identity is used to determine whether an operation is permitted. As a result, when using LANLDOCK_SCOPE_SIGNAL, signaling between sibling threads stops working. This is a problem for programming languages and frameworks which are inherently multithreaded (e.g. Go). * In audit logging, the domains of separate threads in a process will get logged with different domain IDs, even when they are based on the same ruleset FD, which might confuse users. Cc: Andrew G. Morgan Cc: John Johansen Cc: Paul Moore Suggested-by: Jann Horn Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20251127115136.3064948-2-gnoack@google.com [mic: Fix restrict_self_flags test, clean up Makefile, allign comments, reduce local variable scope, add missing includes] Closes: https://github.com/landlock-lsm/linux/issues/2 Signed-off-by: Mickaël Salaün commit 52c9ee202edd21d0599ac3b5a6fe1da2a2f053e5 Author: Corey Minyard Date: Fri Feb 6 09:59:32 2026 -0600 ipmi:si: Handle waiting messages when BMC failure detected If a BMC failure is detected, the current message is returned with an error. However, if there was a waiting message, it would not be handled. Add a check for the waiting message after handling the current message. Suggested-by: Guenter Roeck Reported-by: Rafael J. Wysocki Closes: https://lore.kernel.org/linux-acpi/CAK8fFZ58fidGUCHi5WFX0uoTPzveUUDzT=k=AAm4yWo3bAuCFg@mail.gmail.com/ Fixes: bc3a9d217755 ("ipmi:si: Gracefully handle if the BMC is non-functional") Cc: stable@vger.kernel.org # 4.18 Signed-off-by: Corey Minyard commit 3ddfbfbc78ac1d3d9e95098fb6a32b57b8a0dcae Author: John Garry Date: Thu Feb 5 17:11:14 2026 +0000 nvme: correct comment about nvme_ns_remove() The comment in nvme_mpath_remove_disk() references nvme_remove_ns(), which should be nvme_ns_remove(). Reviewed-by: Christoph Hellwig Signed-off-by: John Garry Signed-off-by: Keith Busch commit 63059500b124254c2630b2f8c46cb3555e726f52 Author: John Garry Date: Thu Feb 5 17:11:15 2026 +0000 nvme: stop setting namespace gendisk device driver data Since commit 1f4137e882c6 ("nvme: move passthrough logging attribute to head"), we stopped using the namespace to hold the passthrough logging enabled attribute. There is now nowhere now which looks up the gendisk dev driver data, so stop setting it. Incidentally, it would have been better to set this before adding the disk. Reviewed-by: Christoph Hellwig Signed-off-by: John Garry Signed-off-by: Keith Busch commit e5e66adfe45a6480d96b4e40edc05883915f44b2 Author: Dapeng Mi Date: Tue Feb 3 10:43:56 2026 +0800 perf regs: Remove __weak attributive arch_sdt_arg_parse_op() function In line with the previous patch, the __weak arch_sdt_arg_parse_op() function is removed. Architectural-specific implementations in the arch/ directory are now converted into sub-functions within the util/perf-regs-arch/ directory. The perf_sdt_arg_parse_op() function will call these sub-functions based on the EM_HOST. This change enables cross-architecture calls to arch_sdt_arg_parse_op(). No functional changes are intended. Suggested-by: Ian Rogers Reviewed-by: Ian Rogers Signed-off-by: Dapeng Mi Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Guo Ren Cc: Ingo Molnar Cc: James Clark Cc: John Garry Cc: Mike Leach Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Will Deacon Cc: Xudong Hao Cc: Zide Chen [ Fixed up somme fuzz with powerpc and x86 Build files wrt removing perf_regs.o ] Signed-off-by: Arnaldo Carvalho de Melo commit 16dccbb84203196dab2e578b27c3c8f549ebff66 Author: Dapeng Mi Date: Tue Feb 3 10:43:55 2026 +0800 perf regs: Remove __weak attributive arch__xxx_reg_mask() functions Currently, some architecture-specific perf-regs functions, such as arch__intr_reg_mask() and arch__user_reg_mask(), are defined with the __weak attribute. This approach ensures that only functions matching the architecture of the build/run host are compiled and executed, reducing build time and binary size. However, this __weak attribute restricts these functions to be called only on the same architecture, preventing cross-architecture functionality. For example, a perf.data file captured on x86 cannot be parsed on an ARM platform. To address this limitation, this patch removes the __weak attribute from these perf-regs functions. The architecture-specific code is moved from the arch/ directory to the util/perf-regs-arch/ directory. The appropriate architectural functions are then called based on the EM_HOST. No functional changes are intended. Suggested-by: Ian Rogers Reviewed-by: Ian Rogers Signed-off-by: Dapeng Mi Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Guo Ren Cc: Ingo Molnar Cc: James Clark Cc: John Garry Cc: Mike Leach Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Will Deacon Cc: Xudong Hao Cc: Zide Chen [ Fixed up somme fuzz with s390 and riscv Build files wrt removing perf_regs.o ] Signed-off-by: Arnaldo Carvalho de Melo commit e716e69cf67bb45c49653b884f88d8e97f454f50 Author: Dapeng Mi Date: Tue Feb 3 10:43:54 2026 +0800 perf arch: Update arch headers to use relative UAPI paths The architectural specific headers perf_regs.h currently rely on the host architecture's 'asm/perf_regs.h'. This can lead to compilation inconsistencies or failures when including and building perf for a target architecture that differs from the host's architecture. Explicitly point to the UAPI headers within the tools source tree using relative paths. This ensures that perf is always built against the intended architecture. No functional changes are intended. Reviewed-by: Ian Rogers Signed-off-by: Dapeng Mi Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Guo Ren Cc: Ingo Molnar Cc: James Clark Cc: John Garry Cc: Mike Leach Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Will Deacon Cc: Xudong Hao Cc: Zide Chen Signed-off-by: Arnaldo Carvalho de Melo commit c2e28ae2946f473d6c340ebbeac0cf87be46d582 Author: Dapeng Mi Date: Tue Feb 3 10:43:53 2026 +0800 perf regs: Fix abort for "-I" or "--user-regs" options Fix an issue where the `perf` tool aborts unexpectedly when running the following command: ``` perf record -e cycles -I -- true Usage: perf record [] [] or: perf record [] -- [] -I, --intr-regs[=] sample selected machine registers on interrupt, use '-I?' to list register names ``` The usage of the `-I` or `--user-regs` options without specifying any registers should default to sampling all general-purpose registers. However, this currently causes an abnormal termination. The issue was introduced by commit 3d06db9bad1a ("perf regs: Refactor use of arch__sample_reg_masks() to perf_reg_name()"). This patch resolves the problem, ensuring that the `-I` or `--user-regs` options work as intended without causing an abort. Fixes: 3d06db9bad1ad8e6 ("perf regs: Refactor use of arch__sample_reg_masks() to perf_reg_name()") Reviewed-by: Ian Rogers Signed-off-by: Dapeng Mi Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Guo Ren Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: John Garry Cc: linux-arm-kernel@lists.infradead.org Cc: linux-csky@vger.kernel.org Cc: linux-riscv@lists.infradead.org Cc: Mike Leach Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Will Deacon Cc: Xudong Hao Cc: Zide Chen Signed-off-by: Arnaldo Carvalho de Melo commit 21bab791346e5b7902a04709231c0642ff6d69bc Author: Johan Hovold Date: Wed Feb 4 15:28:49 2026 +0100 Revert "revocable: Revocable resource management" This reverts commit 62eb557580eb2177cf16c3fd2b6efadff297b29a. The revocable implementation uses two separate abstractions, struct revocable_provider and struct revocable, in order to store the SRCU read lock index which must be passed unaltered to srcu_read_unlock() in the same context when a resource is no longer needed. With the merged revocable API, multiple threads could however share the same struct revocable and therefore potentially overwrite the SRCU index of another thread which can cause the SRCU synchronisation in revocable_provider_revoke() to never complete. [1] An example revocable conversion of the gpiolib code also turned out to be fundamentally flawed and could lead to use-after-free. [2] An attempt to address both issues was quickly put together and merged, but revocable is still fundamentally broken. [3] Specifically, the latest design relies on RCU for storing a pointer to the revocable provider, but since the resource can be shared by value (e.g. as in the now reverted selftests) this does not work at all and can also lead to use-after-free: static void revocable_provider_release(struct kref *kref) { struct revocable_provider *rp = container_of(kref, struct revocable_provider, kref); cleanup_srcu_struct(&rp->srcu); kfree_rcu(rp, rcu); } void revocable_provider_revoke(struct revocable_provider __rcu **rp_ptr) { struct revocable_provider *rp; rp = rcu_replace_pointer(*rp_ptr, NULL, 1); ... kref_put(&rp->kref, revocable_provider_release); } int revocable_init(struct revocable_provider __rcu *_rp, struct revocable *rev) { struct revocable_provider *rp; ... scoped_guard(rcu) { rp = rcu_dereference(_rp); if (!rp) return -ENODEV; if (!kref_get_unless_zero(&rp->kref)) return -ENODEV; } ... } producer: priv->rp = revocable_provider_alloc(&priv->res); // pass priv->rp by value to consumer revocable_provider_revoke(&priv->rp); consumer: struct revocable_provider __rcu *rp = filp->private_data; struct revocable *rev; revocable_init(rp, &rev); as _rp would still be non-NULL in revocable_init() regardless of whether the producer has revoked the resource and set its pointer to NULL. Essentially revocable still relies on having a pointer to reference counted driver data which holds the revocable provider, which makes all the RCU protection unnecessary along with most of the current revocable design and implementation. As the above shows, and as has been pointed out repeatedly elsewhere, these kind of issues are not something that should be addressed incrementally. [4] Revert the revocable implementation until a redesign has been proposed and evaluated properly. Link: https://lore.kernel.org/all/20260124170535.11756-4-johan@kernel.org/ [1] Link: https://lore.kernel.org/all/aXT45B6vLf9R3Pbf@hovoldconsulting.com/ [2] Link: https://lore.kernel.org/all/20260129143733.45618-1-tzungbi@kernel.org/ [3] Link: https://lore.kernel.org/all/aXobzoeooJqxMkEj@hovoldconsulting.com/ [4] Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260204142849.22055-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7149ce34dd48886b3f69153c7f5533dd3fd5f47e Author: Johan Hovold Date: Wed Feb 4 15:28:48 2026 +0100 Revert "revocable: Add Kunit test cases" This reverts commit cd7693419bb5abd91ad2f407dab69c480e417a61. The new revocable functionality is fundamentally broken and at a minimum needs to be redesigned. Drop the revocable Kunit tests to allow the implementation to be reverted. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260204142849.22055-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 379a5aad4e8ce7bd0b1600c03ae0c9a28f66a183 Author: Johan Hovold Date: Wed Feb 4 15:28:47 2026 +0100 Revert "selftests: revocable: Add kselftest cases" This reverts commit 9d4502fef00fa7a798d3c0806d4da4466a7ffc6f. The new revocable functionality is fundamentally broken and at a minimum needs to be redesigned. Drop the revocable selftests to allow the implementation to be reverted. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260204142849.22055-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit cee275edcdb1acfdc8270f80e96f30750b633220 Author: Ian Rogers Date: Thu Feb 5 10:36:03 2026 -0800 perf metricgroup: Don't early exit if no CPUID table exists The failure to find a table of metrics with a CPUID shouldn't early exit as the metric code will now also consider the default table. When searching for a metric or metric group, pmu_metrics_table__for_each_metric() considers all tables and so the caller doesn't need to switch the table to do this. Fixes: c7adeb0974f18da4 ("perf jevents: Add set of common metrics based on default ones") Reviewed-by: Leo Yan Signed-off-by: Ian Rogers Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit f637bb2eedc01aa533f2b1e57b6abd8ca864fea8 Author: Ian Rogers Date: Thu Feb 5 10:36:02 2026 -0800 perf tests: build-test coverage for NO_JEVENTS=1 Leo reported 'perf stat' being broken and this highlighted that the 'make NO_JEVENTS=1' variant is missing from 'make -C tools/perf build-test', add it. Closes: https://lore.kernel.org/linux-perf-users/20260205175250.GC3529712@e132581.arm.com/ Reported-by: Leo Yan Reviewed-by: Leo Yan Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 1d9622c3c1c12e317b0d3a16a26ea17090435d61 Author: Ian Rogers Date: Tue Feb 3 20:26:29 2026 -0800 perf tests: Additional 'perf stat' tests Recently 'perf stat' regressed in per CPU mode [1]. Let's expand test coverage to catch the same breakage again as well as to test the repeat, pid, detailed and no aggregation options. [1] https://lore.kernel.org/linux-perf-users/cgja46br2smmznxs7kbeabs6zgv3b4olfqgh2fdp5mxk2yom4v@w6jjgov6hdi6/ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andres Freund Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Richter Signed-off-by: Arnaldo Carvalho de Melo commit a108a6a4b9e8d81f6be0c0f8b93d3fbd57d2359e Author: Leo Yan Date: Wed Feb 4 14:26:15 2026 +0000 perf record: Make logs more readable for event open failures Since commit ee27476fa3004f83 ("perf record: Skip don't fail for events that don't open"), if a user does not have permission to access a PMU event, perf reports: perf record -e cs_etm// -C 3 -- ls Error: Failure to open event 'cs_etm//u' on PMU 'cs_etm' which will be removed. No fallback found for 'cs_etm//u' for error 13 Error: Failure to open event 'dummy:u' on PMU 'software' which will be removed. No fallback found for 'dummy:u' for error 13 Error: Failure to open any events for recording. The log is not very helpful, as no clear indication of what "error 13" means or how to address the issue. This commit restores evsel__open_strerror() to generate a readable error message and print it out: perf record -e cs_etm// -C 3 -- ls Error: Failure to open event 'cs_etm//' on PMU 'cs_etm' which will be removed. Access to performance monitoring and observability operations is limited. Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open access to performance monitoring and observability operations for processes without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability. More information can be found at 'Perf events and tool security' document: https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html perf_event_paranoid setting is 1: -1: Allow use of (almost) all events by all users Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK >= 0: Disallow raw and ftrace function tracepoint access >= 1: Disallow CPU event access >= 2: Disallow kernel profiling To make the adjusted perf_event_paranoid setting permanent preserve it in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = ) Error: Failure to open event 'dummy:u' on PMU 'software' which will be removed. Access to performance monitoring and observability operations is limited. Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open access to performance monitoring and observability operations for processes without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability. More information can be found at 'Perf events and tool security' document: https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html perf_event_paranoid setting is 1: -1: Allow use of (almost) all events by all users Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK >= 0: Disallow raw and ftrace function tracepoint access >= 1: Disallow CPU event access >= 2: Disallow kernel profiling To make the adjusted perf_event_paranoid setting permanent preserve it in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = ) Error: Failure to open any events for recording. Reviewed-by: Ian Rogers Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit da87d45b195148d670ab995367d52aa9e8a9a1fa Author: Andrei Kuchynski Date: Fri Feb 6 11:57:54 2026 +0000 usb: typec: ucsi: Add Thunderbolt alternate mode support Introduce support for Thunderbolt (TBT) alternate mode to the UCSI driver. This allows the driver to manage the entry and exit of TBT altmode by providing the necessary typec_altmode_ops. ucsi_altmode_update_active() is invoked when the Connector Partner Changed bit is set in the GET_CONNECTOR_STATUS data. This ensures that the alternate mode's active state is synchronized with the current mode the connector is operating in. Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260206115754.828954-1-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit ed82f35b926b2e505c14b7006473614b8f58b4f4 Author: Jens Axboe Date: Thu Jan 8 10:18:31 2026 -0700 io_uring: allow registration of per-task restrictions Currently io_uring supports restricting operations on a per-ring basis. To use those, the ring must be setup in a disabled state by setting IORING_SETUP_R_DISABLED. Then restrictions can be set for the ring, and the ring can then be enabled. This commit adds support for IORING_REGISTER_RESTRICTIONS with ring_fd == -1, like the other "blind" register opcodes which work on the task rather than a specific ring. This allows registration of the same kind of restrictions as can been done on a specific ring, but with the task itself. Once done, any ring created will inherit these restrictions. If a restriction filter is registered with a task, then it's inherited on fork for its children. Children may only further restrict operations, not extend them. Inheriting restrictions include both the classic IORING_REGISTER_RESTRICTIONS based restrictions, as well as the BPF filters that have been registered with the task via IORING_REGISTER_BPF_FILTER. Signed-off-by: Jens Axboe commit 9fd99788f3e5a129908c242bb29946077ca46611 Author: Jens Axboe Date: Fri Jan 16 15:28:58 2026 -0700 io_uring: add task fork hook Called when copy_process() is called to copy state to a new child. Right now this is just a stub, but will be used shortly to properly handle fork'ing of task based io_uring restrictions. Reviewed-by: Christian Brauner (Microsoft) Signed-off-by: Jens Axboe commit 6c7860aa28b81b7e909b8d2072ed76fa22db6eda Author: Dan Carpenter Date: Fri Feb 6 16:38:54 2026 +0300 mtd: spi-nor: hisi-sfc: fix refcounting bug in hisi_spi_nor_register_all() This was converted to a _scoped() loop but this of_node_put() was accidentally left behind which is a double free. Fixes: aa8cb72c2018 ("mtd: spi-nor: hisi-sfc: Simplify with scoped for each OF child loop") Signed-off-by: Dan Carpenter Reviewed-by: Pratyush Yadav Signed-off-by: Miquel Raynal commit d844152d85cfcc7d2ef9430a25882604c12da279 Author: Alex Shi Date: Thu Feb 5 21:39:59 2026 +0800 sparc: remove unused variable strtab The commit 1b35a57b1c178 ("sparc32: Kill off software 32-bit multiply/divide routines") removed the last usage of strtab in funtion module_frob_arch_sections Therefore, it can be removed now. Reported-by: kernel test robot Cc: sparclinux@vger.kernel.org Cc: David S. Miller Cc: Andreas Larsson Signed-off-by: Alex Shi Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 9796ba918e58f170df5cff337be316a2f7cf1e58 Author: Alex Shi Date: Thu Feb 5 21:39:07 2026 +0800 sparc64: fix unused variable warning arch/sparc/mm/init_64.c: In function 'arch_hugetlb_valid_size': arch/sparc/mm/init_64.c:361:24: warning: variable 'hv_pgsz_idx' set but not used [-Wunused-but-set-variable] 361 | unsigned short hv_pgsz_idx; | ^~~~~~~~~~~ Reported-by: kernel test robot Cc: sparclinux@vger.kernel.org CC: Nitin Gupta Cc: Andreas Larsson Cc: David S. Miller Signed-off-by: Alex Shi Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit be0bccffcde3308150d2a90e55fc10e249098909 Author: Sam James Date: Wed Feb 4 13:40:29 2026 +0000 sparc: don't reference obsolete termio struct for TC* constants Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros"). glibc-2.42 drops the legacy termio struct, but the ioctls.h header still defines some TC* constants in terms of termio (via sizeof). Hardcode the values instead. This fixes building Python for example, which falls over like: ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' Link: https://bugs.gentoo.org/961769 Link: https://bugs.gentoo.org/962600 Signed-off-by: Sam James Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 674fb053e95d63b4810142c3a2fa357353014d29 Author: Thorsten Blum Date: Sat Jan 31 23:44:11 2026 +0100 sparc: vio: Replace snprintf with strscpy in vio_create_one Replace snprintf("%s", ...) with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 2153b2e8917b73e9e7fae8963f03b8e60bd8f5ff Author: Ludwig Rydberg Date: Mon Jan 19 15:47:53 2026 +0100 sparc: Add architecture support for clone3 Add support for the clone3 system call to the SPARC architectures. The implementation follows the pattern of the original clone syscall. However, instead of explicitly calling kernel_clone, the clone3 handler calls the generic sys_clone3 handler in kernel/fork. In case no stack is provided, the parents stack is reused. The return value convention for clone3 follows the regular kernel return value convention (in contrast to the original clone/fork on SPARC). Closes: https://github.com/sparclinux/issues/issues/10 Signed-off-by: Ludwig Rydberg Acked-by: Arnd Bergmann Reviewed-by: Andreas Larsson Tested-by: Andreas Larsson Tested-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20260119144753.27945-3-ludwig.rydberg@gaisler.com Signed-off-by: Andreas Larsson commit e38eba3b77878ada327a572a41596a3b0b44e522 Author: Andreas Larsson Date: Mon Jan 19 15:47:52 2026 +0100 sparc: Synchronize user stack on fork and clone Flush all uncommitted user windows before calling the generic syscall handlers for clone, fork, and vfork. Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the arch-specific syscall wrappers for these syscalls will attempt to flush all windows (including user windows). In the window overflow trap handlers on both SPARC{32|64}, if the window can't be stored (i.e due to MMU related faults) the routine backups the user window and increments a thread counter (wsaved). By adding a synchronization point after the flush attempt, when fault handling is enabled, any uncommitted user windows will be flushed. Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394 Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/ Signed-off-by: Andreas Larsson Signed-off-by: Ludwig Rydberg Tested-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com Signed-off-by: Andreas Larsson commit ee1afacc356c84bba4b89e0655ffdcfa84d4f714 Author: Dan Carpenter Date: Fri Feb 6 16:41:47 2026 +0300 ALSA: oss: delete self assignment No need to assign "uctl" to itself. Delete it. Fixes: 55f98ece9939 ("ALSA: oss: Relax __free() variable declarations") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aYXvm2YoV2yRimhk@stanley.mountain Signed-off-by: Takashi Iwai commit 376e2f8cca2816c489a9196e65cc904d1a907fd2 Author: Xu Lu Date: Sun Jan 4 21:34:57 2026 +0800 irqchip/riscv-imsic: Adjust the number of available guest irq files Currently, KVM assumes the minimum of implemented HGEIE bits and "BIT(gc->guest_index_bits) - 1" as the number of guest files available across all CPUs. This will not work when CPUs have different number of guest files because KVM may incorrectly allocate a guest file on a CPU with fewer guest files. To address above, during initialization, calculate the number of available guest interrupt files according to MMIO resources and constrain the number of guest interrupt files that can be allocated by KVM. Signed-off-by: Xu Lu Reviewed-by: Nutty Liu Reviewed-by: Anup Patel Acked-by: Thomas Gleixner Link: https://lore.kernel.org/r/20260104133457.57742-1-luxu.kernel@bytedance.com Signed-off-by: Anup Patel commit ed7ae7a34bea06f81270866dfbe619a22518666b Author: Jessica Liu Date: Thu Nov 27 16:51:37 2025 +0800 RISC-V: KVM: Transparent huge page support Use block mapping if backed by a THP, as implemented in architectures like ARM and x86_64. Signed-off-by: Jessica Liu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251127165137780QbUOVPKPAfWSGAFl5qtRy@zte.com.cn Signed-off-by: Anup Patel commit 671995ff4c308fc1adf01727df670c83434ffb5a Author: Xu Lu Date: Mon Oct 20 12:29:04 2025 +0800 RISC-V: KVM: selftests: Add Zalasr extensions to get-reg-list test The KVM RISC-V allows Zalasr extensions for Guest/VM so add this extension to get-reg-list test. Signed-off-by: Xu Lu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251020042904.32096-1-luxu.kernel@bytedance.com Signed-off-by: Anup Patel commit 655d330c058f4e16de46d5c9b203008c630b59c8 Author: Xu Lu Date: Mon Oct 20 12:24:56 2025 +0800 RISC-V: KVM: Allow Zalasr extensions for Guest/VM Extend the KVM ISA extension ONE_REG interface to allow KVM user space to detect and enable Zalasr extensions for Guest/VM. Signed-off-by: Xu Lu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251020042457.30915-5-luxu.kernel@bytedance.com Signed-off-by: Anup Patel commit 39ad809dd2579d9b7400bbc50a5b95d84527b75e Author: Wu Fei Date: Wed Nov 5 23:14:26 2025 +0800 KVM: riscv: selftests: Add riscv vm satp modes Current vm modes cannot represent riscv guest modes precisely, here add all 9 combinations of P(56,40,41) x V(57,48,39). Also the default vm mode is detected on runtime instead of hardcoded one, which might not be supported on specific machine. Signed-off-by: Wu Fei Reviewed-by: Andrew Jones Reviewed-by: Nutty Liu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251105151442.28767-1-wu.fei9@sanechips.com.cn Signed-off-by: Anup Patel commit ab2a7b7b6b8831348646688345c3209cdaee5d46 Author: Pincheng Wang Date: Wed Aug 27 00:29:39 2025 +0800 KVM: riscv: selftests: add Zilsd and Zclsd extension to get-reg-list test The KVM RISC-V allows Zilsd and Zclsd extensions for Guest/VM so add this extension to get-reg-list test. Signed-off-by: Pincheng Wang Reviewed-by: Nutty Liu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20250826162939.1494021-6-pincheng.plct@isrc.iscas.ac.cn Signed-off-by: Anup Patel commit f326e846ff89c82083c09fa495457442c252983e Author: Pincheng Wang Date: Wed Aug 27 00:29:38 2025 +0800 riscv: KVM: allow Zilsd and Zclsd extensions for Guest/VM Extend the KVM ISA extension ONE_REG interface to allow KVM user space to detect and enable Zilsd and Zclsd extensions for Guest/VM. Signed-off-by: Pincheng Wang Reviewed-by: Nutty Liu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20250826162939.1494021-5-pincheng.plct@isrc.iscas.ac.cn Signed-off-by: Anup Patel commit 003b9dae53ae795930c54945e0b0a41bbd527b44 Author: Jiakai Xu Date: Tue Jan 27 08:43:13 2026 +0000 RISC-V: KVM: Skip IMSIC update if vCPU IMSIC state is not initialized kvm_riscv_vcpu_aia_imsic_update() assumes that the vCPU IMSIC state has already been initialized and unconditionally accesses imsic->vsfile_lock. However, in fuzzed ioctl sequences, the AIA device may be initialized at the VM level while the per-vCPU IMSIC state is still NULL. This leads to invalid access when entering the vCPU run loop before IMSIC initialization has completed. The crash manifests as: Unable to handle kernel paging request at virtual address dfffffff00000006 ... kvm_riscv_vcpu_aia_imsic_update arch/riscv/kvm/aia_imsic.c:801 kvm_riscv_vcpu_aia_update arch/riscv/kvm/aia_device.c:493 kvm_arch_vcpu_ioctl_run arch/riscv/kvm/vcpu.c:927 ... Add a guard to skip the IMSIC update path when imsic_state is NULL. This allows the vCPU run loop to continue safely. This issue was discovered during fuzzing of RISC-V KVM code. Fixes: db8b7e97d6137a ("RISC-V: KVM: Add in-kernel virtualization of AIA IMSIC") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260127084313.3496485-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit aeb1d17d1af5924f7357d7204a293bd8fc06ea13 Author: Jiakai Xu Date: Tue Jan 27 07:22:19 2026 +0000 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() Add a null pointer check for imsic_state before dereferencing it in kvm_riscv_aia_imsic_rw_attr(). While the function checks that the vcpu exists, it doesn't verify that the vcpu's imsic_state has been initialized, leading to a null pointer dereference when accessed. The crash manifests as: Unable to handle kernel paging request at virtual address dfffffff00000006 ... kvm_riscv_aia_imsic_rw_attr+0x2d8/0x854 arch/riscv/kvm/aia_imsic.c:958 aia_set_attr+0x2ee/0x1726 arch/riscv/kvm/aia_device.c:354 kvm_device_ioctl_attr virt/kvm/kvm_main.c:4744 [inline] kvm_device_ioctl+0x296/0x374 virt/kvm/kvm_main.c:4761 vfs_ioctl fs/ioctl.c:51 [inline] ... The fix adds a check to return -ENODEV if imsic_state is NULL and moves isel assignment after imsic_state NULL check. Fixes: 5463091a51cfaa ("RISC-V: KVM: Expose IMSIC registers as attributes of AIA irqchip") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260127072219.3366607-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 11366ead4f1412befea660777576c89a1bac0c1e Author: Jiakai Xu Date: Sun Jan 25 14:33:44 2026 +0000 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() Add a null pointer check for imsic_state before dereferencing it in kvm_riscv_aia_imsic_has_attr(). While the function checks that the vcpu exists, it doesn't verify that the vcpu's imsic_state has been initialized, leading to a null pointer dereference when accessed. This issue was discovered during fuzzing of RISC-V KVM code. The crash occurs when userspace calls KVM_HAS_DEVICE_ATTR ioctl on an AIA IMSIC device before the IMSIC state has been fully initialized for a vcpu. The crash manifests as: Unable to handle kernel paging request at virtual address dfffffff00000001 ... epc : kvm_riscv_aia_imsic_has_attr+0x464/0x50e arch/riscv/kvm/aia_imsic.c:998 ... kvm_riscv_aia_imsic_has_attr+0x464/0x50e arch/riscv/kvm/aia_imsic.c:998 aia_has_attr+0x128/0x2bc arch/riscv/kvm/aia_device.c:471 kvm_device_ioctl_attr virt/kvm/kvm_main.c:4722 [inline] kvm_device_ioctl+0x296/0x374 virt/kvm/kvm_main.c:4739 ... The fix adds a check to return -ENODEV if imsic_state is NULL, which is consistent with other error handling in the function and prevents the null pointer dereference. Fixes: 5463091a51cf ("RISC-V: KVM: Expose IMSIC registers as attributes of AIA irqchip") Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Reviewed-by: Nutty Liu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260125143344.2515451-1-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel commit 1c0180cd42839fe7a60a61412b7c28cd43553c6b Author: Qiang Ma Date: Mon Dec 29 15:25:30 2025 +0800 RISC-V: KVM: Remove unnecessary 'ret' assignment If execution reaches "ret = 0" assignment in kvm_riscv_vcpu_pmu_event_info() then it means kvm_vcpu_write_guest() returned 0 hence ret is already zero and does not need to be assigned 0. Fixes: e309fd113b9f ("RISC-V: KVM: Implement get event info function") Signed-off-by: Qiang Ma Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251229072530.3075496-1-maqianga@uniontech.com Signed-off-by: Anup Patel commit 3df8585afd9b340dc789b20f1101593961fc7e9e Author: Thomas Weissschuh Date: Tue Feb 3 08:11:48 2026 +0100 ARM: 9469/1: Implement ARCH_HAS_CC_CAN_LINK The generic CC_CAN_LINK detection does not handle different byte orders. This may lead to userprogs which are not actually runnable on the target kernel. Use architecture-specific logic supporting byte orders instead. Signed-off-by: Thomas Weißschuh Signed-off-by: Russell King (Oracle) commit 869056dbbd636f8f256b695f39c102eb3ce2edd0 Author: Amir Goldstein Date: Tue Jan 20 15:58:31 2026 +0100 ovl: relax requirement for uuid=off,index=on uuid=off,index=on required that all upper/lower directories are on the same filesystem. Relax the requirement so that only all the lower directories need to be on the same filesystem. Reported-by: André Almeida Link: https://lore.kernel.org/r/20260114-tonyk-get_disk_uuid-v1-3-e6a319e25d57@igalia.com/ Signed-off-by: Amir Goldstein commit 648946966a08e4cb1a71619e3d1b12bd7642de7b Author: Pablo Neira Ayuso Date: Fri Feb 6 13:33:46 2026 +0100 netfilter: nft_set_rbtree: validate open interval overlap Open intervals do not have an end element, in particular an open interval at the end of the set is hard to validate because of it is lacking the end element, and interval validation relies on such end element to perform the checks. This patch adds a new flag field to struct nft_set_elem, this is not an issue because this is a temporary object that is allocated in the stack from the insert/deactivate path. This flag field is used to specify that this is the last element in this add/delete command. The last flag is used, in combination with the start element cookie, to check if there is a partial overlap, eg. Already exists: 255.255.255.0-255.255.255.254 Add interval: 255.255.255.0-255.255.255.255 ~~~~~~~~~~~~~ start element overlap Basically, the idea is to check for an existing end element in the set if there is an overlap with an existing start element. However, the last open interval can come in any position in the add command, the corner case can get a bit more complicated: Already exists: 255.255.255.0-255.255.255.254 Add intervals: 255.255.255.0-255.255.255.255,255.255.255.0-255.255.255.254 ~~~~~~~~~~~~~ start element overlap To catch this overlap, annotate that the new start element is a possible overlap, then report the overlap if the next element is another start element that confirms that previous element in an open interval at the end of the set. For deletions, do not update the start cookie when deleting an open interval, otherwise this can trigger spurious EEXIST when adding new elements. Unfortunately, there is no NFT_SET_ELEM_INTERVAL_OPEN flag which would make easier to detect open interval overlaps. Fixes: 7c84d41416d8 ("netfilter: nft_set_rbtree: Detect partial overlaps on insertion") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 782f2688128eca6d05a48be1c247f68d86afc168 Author: Pablo Neira Ayuso Date: Fri Feb 6 13:33:45 2026 +0100 netfilter: nft_set_rbtree: validate element belonging to interval The existing partial overlap detection does not check if the elements belong to the interval, eg. add element inet x y { 1.1.1.1-2.2.2.2, 4.4.4.4-5.5.5.5 } add element inet x y { 1.1.1.1-5.5.5.5 } => this should fail: ENOENT Similar situation occurs with deletions: add element inet x y { 1.1.1.1-2.2.2.2, 4.4.4.4-5.5.5.5} delete element inet x y { 1.1.1.1-5.5.5.5 } => this should fail: ENOENT This currently works via mitigation by nft in userspace, which is performing the overlap detection before sending the elements to the kernel. This requires a previous netlink dump of the set content which slows down incremental updates on interval sets, because a netlink set content dump is needed. This patch extends the existing overlap detection to track the most recent start element that already exists. The pointer to the existing start element is stored as a cookie (no pointer dereference is ever possible). If the end element is added and it already exists, then check that the existing end element is adjacent to the already existing start element. Similar logic applies to element deactivation. This patch also annotates the timestamp to identify if start cookie comes from an older batch, in such case reset it. Otherwise, a failing create element command leaves the start cookie in place, resulting in bogus error reporting. There is still a few more corner cases of overlap detection related to the open interval that are addressed in follow up patches. This is address an early design mistake where an interval is expressed as two elements, using the NFT_SET_ELEM_INTERVAL_END flag, instead of the more recent NFTA_SET_ELEM_KEY_END attribute that pipapo already uses. Fixes: 7c84d41416d8 ("netfilter: nft_set_rbtree: Detect partial overlaps on insertion") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 4780ec142cbb24b794129d3080eee5cac2943ffc Author: Pablo Neira Ayuso Date: Fri Feb 6 13:33:44 2026 +0100 netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous set checks on start elements for this reason. However, it is possible to add intervals that overlap to this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A C Restore the check on overlapping start elements to report an overlap. Fixes: c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 7f9203f41aae8eea74fba6a3370da41332eabcda Author: Pablo Neira Ayuso Date: Fri Feb 6 13:33:43 2026 +0100 netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval Userspace adds a non-matching null element to the kernel for historical reasons. This null element is added when the set is populated with elements. Inclusion of this element is conditional, therefore, userspace needs to dump the set content to check for its presence. If the NLM_F_CREATE flag is turned on, this becomes an issue because kernel bogusly reports EEXIST. Add special case to ignore NLM_F_CREATE in this case, therefore, re-adding the nul-element never fails. Fixes: c016c7e45ddf ("netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 1e13f27e0675552161ab1778be9a23a636dde8a7 Author: Anders Grahn Date: Tue Feb 3 14:48:30 2026 +0100 netfilter: nft_counter: fix reset of counters on 32bit archs nft_counter_reset() calls u64_stats_add() with a negative value to reset the counter. This will work on 64bit archs, hence the negative value added will wrap as a 64bit value which then can wrap the stat counter as well. On 32bit archs, the added negative value will wrap as a 32bit value and _not_ wrapping the stat counter properly. In most cases, this would just lead to a very large 32bit value being added to the stat counter. Fix by introducing u64_stats_sub(). Fixes: 4a1d3acd6ea8 ("netfilter: nft_counter: Use u64_stats_t for statistic.") Signed-off-by: Anders Grahn Signed-off-by: Florian Westphal commit 2f635adbe2642d398a0be3ab245accd2987be0c3 Author: Florian Westphal Date: Tue Jan 27 20:13:45 2026 +0100 netfilter: nft_set_hash: fix get operation on big endian tests/shell/testcases/packetpath/set_match_nomatch_hash_fast fails on big endian with: Error: Could not process rule: No such file or directory reset element ip test s { 244.147.90.126 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Fatal: Cannot fetch element "244.147.90.126" ... because the wrong bucket is searched, jhash() and jhash1_word are not interchangeable on big endian. Fixes: 3b02b0adc242 ("netfilter: nft_set_hash: fix lookups with fixed size hash on big endian") Signed-off-by: Florian Westphal commit 1d79ae50e310092182a0a8450292ee1c2f99efcf Author: Florian Westphal Date: Fri Jan 30 19:21:51 2026 +0100 selftests: netfilter: add IPV6_TUNNEL to config The script now requires IPV6 tunnel support, enable this. This should have caught by CI, but as the config option is missing, the tunnel interface isn't added. This results in an error cascade that ends with "route change default" failure. That in turn means the "ipv6 tunnel" test re-uses the previous test setup so the "ip6ip6" test passes and script returns 0. Make sure to catch such bugs, set ret=1 if device cannot be added and delete the old default route before installing the new one. After this change, IPV6_TUNNEL=n kernel builds fail with the expected FAIL: flow offload for ns1/ns2 with IP6IP6 tunnel ... while builds with IPV6_TUNNEL=m pass as before. Fixes: 5e5180352193 ("selftests: netfilter: nft_flowtable.sh: Add IP6IP6 flowtable selftest") Acked-by: Lorenzo Bianconi Signed-off-by: Florian Westphal commit 2a441a9aacaa79695e9d005af30fdd5186d773fb Author: Qingfang Deng Date: Fri Jan 30 15:22:07 2026 +0800 netfilter: flowtable: dedicated slab for flow entry The size of `struct flow_offload` has grown beyond 256 bytes on 64-bit kernels (currently 280 bytes) because of the `flow_offload_tunnel` member added recently. So kmalloc() allocates from the kmalloc-512 slab, causing significant memory waste per entry. Introduce a dedicated slab cache for flow entries to reduce memory footprint. Results in a reduction from 512 bytes to 320 bytes per entry on x86_64 kernels. Signed-off-by: Qingfang Deng Signed-off-by: Florian Westphal commit 59ecffa3995e70a675beeb870f0b3a28470428de Author: Florian Westphal Date: Wed Jan 21 22:52:59 2026 +0100 selftests: netfilter: nft_queue.sh: add udp fraglist gro test case Without the preceding patch, this fails with: FAIL: test_udp_gro_ct: Expected udp conntrack entry FAIL: test_udp_gro_ct: Expected software segmentation to occur, had 10 and 0 Signed-off-by: Florian Westphal commit 207b3ebacb6113acaaec0d171d5307032c690004 Author: Florian Westphal Date: Thu Nov 20 17:17:06 2025 +0100 netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation Ulrich reports a regression with nfqueue: If an application did not set the 'F_GSO' capability flag and a gso packet with an unconfirmed nf_conn entry is received all packets are now dropped instead of queued, because the check happens after skb_gso_segment(). In that case, we did have exclusive ownership of the skb and its associated conntrack entry. The elevated use count is due to skb_clone happening via skb_gso_segment(). Move the check so that its peformed vs. the aggregated packet. Then, annotate the individual segments except the first one so we can do a 2nd check at reinject time. For the normal case, where userspace does in-order reinjects, this avoids packet drops: first reinjected segment continues traversal and confirms entry, remaining segments observe the confirmed entry. While at it, simplify nf_ct_drop_unconfirmed(): We only care about unconfirmed entries with a refcnt > 1, there is no need to special-case dying entries. This only happens with UDP. With TCP, the only unconfirmed packet will be the TCP SYN, those aren't aggregated by GRO. Next patch adds a udpgro test case to cover this scenario. Reported-by: Ulrich Weber Fixes: 7d8dc1c7be8d ("netfilter: nf_queue: drop packets with cloned unconfirmed conntracks") Signed-off-by: Florian Westphal commit 35f83a75529a829b0939708b003652f7b4f3df9a Author: Florian Westphal Date: Wed Jan 28 15:06:21 2026 +0100 netfilter: nft_set_rbtree: don't gc elements on insert During insertion we can queue up expired elements for garbage collection. In case of later abort, the commit hook will never be called. Packet path and 'get' requests will find free'd elements in the binary search blob: nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline] nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133 __inline_bsearch include/linux/bsearch.h:15 [inline] bsearch+0x50/0xc0 lib/bsearch.c:33 nft_rbtree_get+0x16b/0x400 net/netfilter/nft_set_rbtree.c:169 nft_setelem_get net/netfilter/nf_tables_api.c:6495 [inline] nft_get_set_elem+0x420/0xaa0 net/netfilter/nf_tables_api.c:6543 nf_tables_getsetelem+0x448/0x5e0 net/netfilter/nf_tables_api.c:6632 nfnetlink_rcv_msg+0x8ae/0x12c0 net/netfilter/nfnetlink.c:290 Also, when we insert an element that triggers -EEXIST, and that insertion happens to also zap a timed-out entry, we end up with same issue: Neither commit nor abort hook is called. Fix this by removing gc api usage during insertion. The blamed commit also removes concurrency of the rbtree with the packet path, so we can now safely rb_erase() the element and move it to a new expired list that can be reaped in the commit hook before building the next blob iteration. This also avoids the need to rebuild the blob in the abort path: Expired elements seen during insertion attempts are kept around until a transaction passes. Reported-by: syzbot+d417922a3e7935517ef6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d417922a3e7935517ef6 Fixes: 7e43e0a1141d ("netfilter: nft_set_rbtree: translate rbtree to array for binary search") Signed-off-by: Florian Westphal commit 9c5a40f2922a5a6d6b42e7b3d4c8e253918c07a1 Author: Conor Dooley Date: Tue Feb 3 16:17:07 2026 +0000 pinctrl: generic: move function to amlogic-am4 driver pinconf_generic_dt_node_to_map_pinmux() is not actually a generic function, and really belongs in the amlogic-am4 driver. There are three reasons why. First, and least, of the reasons is that this function behaves differently to the other dt_node_to_map functions in a way that is not obvious from a first glance. This difference stems for the devicetree properties that the function is intended for use with, and how they are typically used. The other generic dt_node_to_map functions support platforms where the pins, groups and functions are described statically in the driver and require a function that will produce a mapping from dt nodes to these pre-established descriptions. No other code in the driver is require to be executed at runtime. pinconf_generic_dt_node_to_map_pinmux() on the other hand is intended for use with the pinmux property, where groups and functions are determined entirely from the devicetree. As a result, there are no statically defined groups and functions in the driver for this function to perform a mapping to. Other drivers that use the pinmux property (e.g. the k1) their dt_node_to_map function creates the groups and functions as the devicetree is parsed. Instead of that, pinconf_generic_dt_node_to_map_pinmux() requires that the devicetree is parsed twice, once by it and once at probe, so that the driver dynamically creates the groups and functions before the dt_node_to_map callback is executed. I don't believe this double parsing requirement is how developers would expect this to work and is not necessary given there are drivers that do not have this behaviour. Secondly and thirdly, the function bakes in some assumptions that only really match the amlogic platform about how the devicetree is constructed. These, to me, are problematic for something that claims to be generic. The other dt_node_to_map implementations accept a being called for either a node containing pin configuration properties or a node containing child nodes that each contain the configuration properties. IOW, they support the following two devicetree configurations: | cfg { | label: group { | pinmux = ; | config-item1; | }; | }; | label: cfg { | group1 { | pinmux = ; | config-item2; | }; | group2 { | pinmux = ; | config-item1; | }; | }; pinconf_generic_dt_node_to_map_pinmux() only supports the latter. The other assumption about devicetree configuration that the function makes is that the labeled node's parent is a "function node". The amlogic driver uses these "function nodes" to create the functions at probe time, and pinconf_generic_dt_node_to_map_pinmux() finds the parent of the node it is operating on's name as part of the mapping. IOW, it requires that the devicetree look like: | pinctrl@bla { | | func-foo { | label: group-default { | pinmuxes = ; | }; | }; | }; and couldn't be used if the nodes containing the pinmux and configuration properties are children of the pinctrl node itself: | pinctrl@bla { | | label: group-default { | pinmuxes = ; | }; | }; These final two reasons are mainly why I believe this is not suitable as a generic function, and should be moved into the driver that is the sole user and originator of the "generic" function. Signed-off-by: Conor Dooley Acked-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 6e544d87488505db8524e39e7bd1930bc6b85a6b Author: Andy Shevchenko Date: Wed Feb 4 09:01:22 2026 +0100 pinctrl: intel: Align Copyright note with corporate guidelines The Copyright note must follow the Copyright (C) Intel Corporation template, where (C) is always capitalised and either a single year or a range. Update the Intel pin control drivers to follow. Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Linus Walleij commit cd966e406b2aa08b76949cdd4e57458f4afe38b0 Author: Thorsten Blum Date: Sat Jan 31 22:42:47 2026 +0100 crypto: cesa - Simplify return statement in mv_cesa_dequeue_req_locked Return the result of calling crypto_dequeue_request() directly and remove the local return variable. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit a22d48cbe55814061d46db2f87090ba5e36aaf7f Author: Aleksander Jan Bajkowski Date: Sat Jan 31 18:43:03 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(sha224),cbc(aes)) Test vectors were generated starting from existing CBC(AES) test vectors (RFC3602, NIST SP800-38A) and adding HMAC(SHA224) computed with Python script. Then, the results were double-checked on Mediatek MT7981 (safexcel) and NXP P2020 (talitos). Both platforms pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit 030218dedee2628ea3f035d71431e1b7c4191cfb Author: Aleksander Jan Bajkowski Date: Sat Jan 31 18:38:47 2026 +0100 crypto: testmgr - Add test vectors for authenc(hmac(sha384),cbc(aes)) Test vectors were generated starting from existing CBC(AES) test vectors (RFC3602, NIST SP800-38A) and adding HMAC(SHA384) computed with Python script. Then, the results were double-checked on Mediatek MT7981 (safexcel) and NXP P2020 (talitos). Both platforms pass self-tests. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit cc2f39d6ac48e6e3cb2d6240bc0d6df839dd0828 Author: Lianjie Wang Date: Fri Jan 30 06:50:16 2026 +0900 hwrng: core - use RCU and work_struct to fix race condition Currently, hwrng_fill is not cleared until the hwrng_fillfn() thread exits. Since hwrng_unregister() reads hwrng_fill outside the rng_mutex lock, a concurrent hwrng_unregister() may call kthread_stop() again on the same task. Additionally, if hwrng_unregister() is called immediately after hwrng_register(), the stopped thread may have never been executed. Thus, hwrng_fill remains dirty even after hwrng_unregister() returns. In this case, subsequent calls to hwrng_register() will fail to start new threads, and hwrng_unregister() will call kthread_stop() on the same freed task. In both cases, a use-after-free occurs: refcount_t: addition on 0; use-after-free. WARNING: ... at lib/refcount.c:25 refcount_warn_saturate+0xec/0x1c0 Call Trace: kthread_stop+0x181/0x360 hwrng_unregister+0x288/0x380 virtrng_remove+0xe3/0x200 This patch fixes the race by protecting the global hwrng_fill pointer inside the rng_mutex lock, so that hwrng_fillfn() thread is stopped only once, and calls to kthread_run() and kthread_stop() are serialized with the lock held. To avoid deadlock in hwrng_fillfn() while being stopped with the lock held, we convert current_rng to RCU, so that get_current_rng() can read current_rng without holding the lock. To remove the lock from put_rng(), we also delay the actual cleanup into a work_struct. Since get_current_rng() no longer returns ERR_PTR values, the IS_ERR() checks are removed from its callers. With hwrng_fill protected by the rng_mutex lock, hwrng_fillfn() can no longer clear hwrng_fill itself. Therefore, if hwrng_fillfn() returns directly after current_rng is dropped, kthread_stop() would be called on a freed task_struct later. To fix this, hwrng_fillfn() calls schedule() now to keep the task alive until being stopped. The kthread_stop() call is also moved from hwrng_unregister() to drop_current_rng(), ensuring kthread_stop() is called on all possible paths where current_rng becomes NULL, so that the thread would not wait forever. Fixes: be4000bc4644 ("hwrng: create filler thread") Suggested-by: Herbert Xu Signed-off-by: Lianjie Wang Signed-off-by: Herbert Xu commit ccb679fdae2e62ed92fd9acb25ed809c0226fcc6 Author: Zilin Guan Date: Thu Jan 29 15:10:16 2026 +0000 crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() The starfive_aes_aead_do_one_req() function allocates rctx->adata with kzalloc() but fails to free it if sg_copy_to_buffer() or starfive_aes_hw_init() fails, which lead to memory leaks. Since rctx->adata is unconditionally freed after the write_adata operations, ensure consistent cleanup by freeing the allocation in these earlier error paths as well. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 7467147ef9bf ("crypto: starfive - Use dma for aes requests") Signed-off-by: Zilin Guan Signed-off-by: Herbert Xu commit cd576c831e86f48f7cdc7a658d6596fe7be46ae2 Author: Harsh Jain Date: Tue Jan 27 12:31:55 2026 +0530 crypto: xilinx - Fix inconsistant indentation Fix smatch inconsistant code warning. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601251908.baMDVVgW-lkp@intel.com/ Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 8b3ad41479b07d2b677f14a91358aaf804f740c3 Author: Thorsten Blum Date: Mon Jan 26 18:50:18 2026 +0100 crypto: rng - Use unregister_rngs in register_rngs Replace the for loop with a call to crypto_unregister_rngs(). Return 'ret' immediately and remove the goto statement to simplify the error handling code. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 2ffc1ef4e826f0c3274f9ff5eb42bc70a5571afd Author: Thorsten Blum Date: Mon Jan 26 18:47:03 2026 +0100 crypto: atmel - Use unregister_{aeads,ahashes,skciphers} Replace multiple for loops with calls to crypto_unregister_aeads(), crypto_unregister_ahashes(), and crypto_unregister_skciphers(). Remove the definition of atmel_tdes_unregister_algs() because it is equivalent to calling crypto_unregister_skciphers() directly, and the function parameter 'struct atmel_tdes_dev *' is unused anyway. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 3cd3059af122faa3cc58dddacbc86d46e654c757 Author: Rouven Czerwinski Date: Mon Jan 26 11:11:25 2026 +0100 hwrng: optee - simplify OP-TEE context match Simplify the TEE implementor ID match by returning the boolean expression directly instead of going through an if/else. Signed-off-by: Rouven Czerwinski Signed-off-by: Herbert Xu commit f7ab71f178d56447e5efb55b65436feb68662f8f Author: Arnd Bergmann Date: Fri Feb 6 10:17:30 2026 +0100 KVM: s390: Add explicit padding to struct kvm_s390_keyop The newly added structure causes a warning about implied padding: ./usr/include/linux/kvm.h:1247:1: error: padding struct size to alignment boundary with 6 bytes [-Werror=padded] The padding can lead to leaking kernel data and ABI incompatibilies when used on x86. Neither of these is a problem in this specific patch, but it's best to avoid it and use explicit padding fields in general. Fixes: 0ee4ddc1647b ("KVM: s390: Storage key manipulation IOCTL") Signed-off-by: Arnd Bergmann Reviewed-by: Claudio Imbrenda Signed-off-by: Claudio Imbrenda commit 90f7520b76fab89852287d78ed7919a647c68c1d Author: Mario Limonciello Date: Thu Jan 22 21:34:53 2026 -0600 crypto: ccp - Add sysfs attribute for boot integrity The boot integrity attribute represents that the CPU or APU is used for the hardware root of trust in the boot process. This bit only represents the CPU/APU and some vendors have other hardware root of trust implementations specific to their designs. Link: https://github.com/fwupd/fwupd/pull/9825 Reviewed-by: Mark Pearson Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu commit b3f9d6e491fda73c319547881b78cdd2a222b293 Author: Jan Remmet Date: Fri Feb 6 09:34:31 2026 +0100 usb: typec: hd3ss3220: Check if regulator needs to be switched Check regulator state as peripheral and detach can disable vbus. Without this check we will try to disable the regulator twice if we disconnect host and then connect as device. Fixes: 27fbc19e52b9 ("usb: typec: hd3ss3220: Enable VBUS based on role state") Signed-off-by: Jan Remmet Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260206-wip-jremmet-hd3ss3220_vbus_split-v4-1-ee5b4e402187@phytec.de Signed-off-by: Greg Kroah-Hartman commit ad095636604604b3574c1920260b1360c25ced6f Merge: 02f9d76a76adb5 a45dd34663025c c3b1edea3791fa 9e249c48412828 b48ca920613858 Author: Joerg Roedel Date: Fri Feb 6 11:10:40 2026 +0100 Merge branches 'fixes', 'arm/smmu/updates', 'intel/vt-d', 'amd/amd-vi' and 'core' into next commit 98e99fc4ad4b30dd28c09ba19686ec583af345b4 Author: Hao Li Date: Thu Feb 5 20:07:23 2026 +0800 slub: let need_slab_obj_exts() return false if SLAB_NO_OBJ_EXT is set SLAB_NO_OBJ_EXT is set for boot caches, but need_slab_obj_exts() doesn't check this flag. We should return false unconditionally when SLAB_NO_OBJ_EXT is set. Signed-off-by: Hao Li Acked-by: Harry Yoo Link: https://patch.msgid.link/20260205120709.425719-1-hao.li@linux.dev Signed-off-by: Vlastimil Babka commit b07829d546c83134629591f02c5348d57cea0c1e Author: Arnd Bergmann Date: Wed Feb 4 14:26:23 2026 +0100 vsnprintf: drop __printf() attributes on binary printing functions The printf() format attributes are applied inconsistently for the binary printf helpers, which causes warnings for the bpf_trace code using them from functions that pass down format strings: kernel/trace/bpf_trace.c: In function '____bpf_trace_printk': kernel/trace/bpf_trace.c:377:9: error: function '____bpf_trace_printk' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format] 377 | ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt, data.bin_args); | ^~~ This can be addressed either by annotating all five callers in bpf code, or by removing the annotations on the callees that were added by Andy Shevchenko last year. As Alexei Starovoitov points out, there are no callers in C code that would benefit from the __printf attributes, the only users are in BPF code or in the do_trace_printk() helper that already checks the arguments. Drop all three of these annotations, reverting the earlierl commits that added these, in order to get a clean build with -Wsuggest-attribute=format. Fixes: 6b2c1e30ad68 ("seq_file: Mark binary printing functions with __printf() attribute") Fixes: 7bf819aa992f ("vsnprintf: Mark binary printing functions with __printf() attribute") Link: https://lore.kernel.org/all/CAADnVQK3eZp3yp35OUx8j1UBsQFhgsn5-4VReqAJ=68PaaKYmg@mail.gmail.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512061640.9hKTnB8p-lkp@intel.com/ Suggested-by: Alexei Starovoitov Acked-by: Alexei Starovoitov Signed-off-by: Arnd Bergmann Acked-by: Petr Mladek Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260204132643.1302967-1-arnd@kernel.org Signed-off-by: Petr Mladek commit e82269e7cb93a2d33368418be4ee56015b4adc27 Author: Md Sadre Alam Date: Fri Feb 6 14:07:52 2026 +0530 mtd: spinand: fix NULL pointer dereference in spinand_support_vendor_ops() The spinand_support_vendor_ops() helper unconditionally dereferences info->vendor_ops. For chips that do not define vendor_ops, this pointer is NULL, leading to a kernel panic during probe: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Add a guard to return early when vendor_ops is NULL. This prevents the crash and allows SPI NAND devices without vendor-specific operations to be probed correctly. Fixes: fbc7538782f8 ("mtd: spinand: List vendor specific operations and make sure they are supported") Cc: stable@vger.kernel.org Signed-off-by: Md Sadre Alam Signed-off-by: Miquel Raynal commit 1caf50ce4af096d0280d59a31abdd85703cd995c Author: Chao Yu Date: Fri Feb 6 06:30:05 2026 +0800 erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 [ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180 [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 [ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 [ 9.270083][ T3222] filemap_read_folio+0x60/0x120 [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 [ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554 [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c [ 9.270142][ T3222] do_page_fault+0x178/0x88c [ 9.270167][ T3222] do_translation_fault+0x38/0x54 [ 9.270183][ T3222] do_mem_abort+0x54/0xac [ 9.270208][ T3222] el0_da+0x44/0x7c [ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4 [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 EROFS may encounter above panic when enabling file-backed mount w/ directio mount option, the root cause is it may suffer UAF in below race condition: - z_erofs_read_folio wq s_dio_done_wq - z_erofs_runqueue - erofs_fileio_submit_bio - erofs_fileio_rq_submit - vfs_iocb_iter_read - ext4_file_read_iter - ext4_dio_read_iter - iomap_dio_rw : bio was submitted and return -EIOCBQUEUED - dio_aio_complete_work - dio_complete - dio->iocb->ki_complete (erofs_fileio_ki_complete()) - kfree(rq) : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). - file_accessed : access NULL file point Introduce a reference count in struct erofs_fileio_rq, and initialize it as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will decrease reference count, the last one decreasing the reference count to zero will free rq. Cc: stable@kernel.org Fixes: fb176750266a ("erofs: add file-backed mount support") Fixes: 6422cde1b0d5 ("erofs: use buffered I/O for file-backed mounts by default") Signed-off-by: Chao Yu Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 2e7577cd5ddc1f86d1b6c48caf3cfa87dbb14e34 Author: Li RongQing Date: Thu Feb 5 04:40:10 2026 -0500 mshv: fix SRCU protection in irqfd resampler ack handler Replace hlist_for_each_entry_rcu() with hlist_for_each_entry_srcu() in mshv_irqfd_resampler_ack() to correctly handle SRCU-protected linked list traversal. The function uses SRCU (sleepable RCU) synchronization via partition->pt_irq_srcu, but was incorrectly using the RCU variant for list iteration. This could lead to race conditions when the list is modified concurrently. Also add srcu_read_lock_held() assertion as required by hlist_for_each_entry_srcu() to ensure we're in the proper read-side critical section. Fixes: 621191d709b14 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Li RongQing Reviewed-by: Anirudh Rayabharam (Microsoft) Acked-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit 51515bfc29ed5971d4f0a98243bdc1c93fadb102 Author: Mukesh R Date: Wed Feb 4 12:23:28 2026 -0800 mshv: make field names descriptive in a header struct When struct fields use very common names like "pages" or "type", it makes it difficult to find uses of these fields with tools like grep, cscope, etc when the struct is in a header file included in many places. Add prefix mreg_ to some fields in struct mshv_mem_region to make it easier to find them. There is no functional change. Signed-off-by: Mukesh R Signed-off-by: Wei Liu commit ee9241524b4682a34ed4b66d8c68c33304810b93 Author: Raju Rangoju Date: Wed Feb 4 20:30:20 2026 +0530 amd-xgbe: do not select NET_SELFTESTS when INET is disabled AMD_XGBE currently selects NET_SELFTESTS unconditionally. Since select does not honor dependencies, this can force-enable NET_SELFTESTS even when INET is disabled (e.g. INET=n randconfig builds). Fixes build issue when INET is disabled. Fixes: 862a64c83faf ("amd-xgbe: introduce support ethtool selftest") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602030920.SWN7cwzT-lkp@intel.com/ Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260204150020.883639-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 2f5db9b4002470ea19380326c5a390647c56e780 Merge: 3c5ab2407aaa11 666c654a5ae409 Author: Dave Airlie Date: Fri Feb 6 13:02:38 2026 +1000 Merge tag 'drm-xe-next-fixes-2026-02-05' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next - Fix CFI violation in debugfs access (Daniele) - Kernel-doc fixes (Chaitanya, Shuicheng) - Disable D3Cold for BMG only on specific platforms (Karthik) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aYStaLZVJWwKCDZt@intel.com commit 3c5ab2407aaa116d5c3c7b0fa8dab395ecf24aec Merge: 1099b651ae4d1d 69674c1c704c01 Author: Dave Airlie Date: Fri Feb 6 12:52:08 2026 +1000 Merge tag 'drm-misc-next-fixes-2026-02-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Several fixes for amdxdna around PM handling, error reporting and memory safety, a compilation fix for ilitek-ili9882t, a NULL pointer dereference fix for imx8qxp-pixel-combiner and several PTE fixes for nouveau Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260205-refreshing-natural-vole-4c73af@houat commit 11a7d5c18af1b3922d06ddb37950a264854f0030 Merge: c9efde1e537bae 9d724b34fbe13b Author: Jakub Kicinski Date: Thu Feb 5 18:51:22 2026 -0800 Merge branch 'net-cpsw_new-fix-multiple-issues-in-the-cpsw_probe-error-path' Kevin Hao says: ==================== net: cpsw_new: Fix multiple issues in the cpsw_probe() error path These two patches address duplicate or unnecessary netdev unregistration in the cpsw_probe() error handling path. ==================== Link: https://patch.msgid.link/20260205-cpsw-error-path-v1-0-6e58bae6b299@gmail.com Signed-off-by: Jakub Kicinski commit 9d724b34fbe13b71865ad0906a4be97571f19cf5 Author: Kevin Hao Date: Thu Feb 5 10:47:03 2026 +0800 net: cpsw_new: Fix potential unregister of netdev that has not been registered yet If an error occurs during register_netdev() for the first MAC in cpsw_register_ports(), even though cpsw->slaves[0].ndev is set to NULL, cpsw->slaves[1].ndev would remain unchanged. This could later cause cpsw_unregister_ports() to attempt unregistering the second MAC. To address this, add a check for ndev->reg_state before calling unregister_netdev(). With this change, setting cpsw->slaves[i].ndev to NULL becomes unnecessary and can be removed accordingly. Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac") Signed-off-by: Kevin Hao Cc: stable@vger.kernel.org Reviewed-by: Alexander Sverdlin Link: https://patch.msgid.link/20260205-cpsw-error-path-v1-2-6e58bae6b299@gmail.com Signed-off-by: Jakub Kicinski commit 62db84b7efa63b78aed9fdbdae90f198771be94c Author: Kevin Hao Date: Thu Feb 5 10:47:02 2026 +0800 net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path The current error handling in cpsw_probe() has two issues: - cpsw_unregister_ports() may be called before cpsw_register_ports() has been executed. - cpsw_unregister_ports() is already invoked within cpsw_register_ports() in case of a register_netdev() failure, but the error path would call it again. Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac") Signed-off-by: Kevin Hao Cc: stable@vger.kernel.org Reviewed-by: Alexander Sverdlin Link: https://patch.msgid.link/20260205-cpsw-error-path-v1-1-6e58bae6b299@gmail.com Signed-off-by: Jakub Kicinski commit c9efde1e537baed7648a94022b43836a348a074f Author: Votokina Victoria Date: Tue Feb 3 14:31:57 2026 +0300 nfc: hci: shdlc: Stop timers and work before freeing context llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active. Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races. Stop all SHDLC timers and cancel sm_work synchronously before purging the queues and freeing the context. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4a61cd6687fc ("NFC: Add an shdlc llc module to llc core") Signed-off-by: Votokina Victoria Link: https://patch.msgid.link/20260203113158.2008723-1-Victoria.Votokina@kaspersky.com Signed-off-by: Jakub Kicinski commit 24cf78c738318f3d2b961a1ab4b3faf1eca860d7 Author: Dragos Tatulea Date: Wed Feb 4 22:03:45 2026 +0200 net/mlx5e: SHAMPO, Switch to header memcpy Previously the HW-GRO code was using a separate page_pool for the header buffer. The pages of the header buffer were replenished via UMR. This mechanism has some drawbacks: - Reference counting on the page_pool page frags is not cheap. - UMRs have HW overhead for updating and also for access. Especially for the KLM type which was previously used. - UMR code for headers is complex. This patch switches to using a static memory area (static MTT MKEY) for the header buffer and does a header memcpy. This happens only once per GRO session. The SKB is allocated from the per-cpu NAPI SKB cache. Performance numbers for x86: +---------------------------------------------------------+ | Test | Baseline | Header Copy | Change | |---------------------+------------+-------------+--------| | iperf3 oncpu | 59.5 Gbps | 64.00 Gbps | 7 % | | iperf3 offcpu | 102.5 Gbps | 104.20 Gbps | 2 % | | kperf oncpu | 115.0 Gbps | 130.00 Gbps | 12 % | | XDP_DROP (skb mode) | 3.9 Mpps | 3.9 Mpps | 0 % | +---------------------------------------------------------+ Notes on test: - System: Intel(R) Xeon(R) Platinum 8380 CPU @ 2.30GHz - oncpu: NAPI and application running on same CPU - offcpu: NAPI and application running on different CPUs - MTU: 1500 - iperf3 tests are single stream, 60s with IPv6 (for slightly larger headers) - kperf version [1] [1] git://git.kernel.dk/kperf.git Suggested-by: Eric Dumazet Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260204200345.1724098-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 215b53099b60da274fd0f8292fa92edf2a32aaf0 Author: Yael Chemla Date: Wed Feb 4 21:43:24 2026 +0200 net/mlx5: Fix 1600G link mode enum naming Rename TAUI/TBASE to GAUI/GBASE in 1600G link mode identifier and its usage in ethtool and link-info tables. Reported-by: Dawid Osuchowski Signed-off-by: Yael Chemla Reviewed-by: Shahar Shitrit Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Reviewed-by: Dawid Osuchowski Reported-by: Dawid Osuchowski Signed-off-by: Yael Chemla Reviewed-by: Leon Romanovsky Link: https://patch.msgid.link/20260204194324.1723534-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e1aa5ef892fb4fa9014a25e87b64b97347919d37 Author: Huacai Chen Date: Tue Feb 3 14:29:01 2026 +0800 net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz Current clk_csr_i setting of Loongson STMMAC (including LS7A1000/2000 and LS2K1000/2000/3000) are copy & paste from other drivers. In fact, Loongson STMMAC use 125MHz clocks and need 62 freq division to within 2.5MHz, meeting most PHY MDC requirement. So fix by setting clk_csr_i to 100-150MHz, otherwise some PHYs may link fail. Cc: stable@vger.kernel.org Fixes: 30bba69d7db40e7 ("stmmac: pci: Add dwmac support for Loongson") Signed-off-by: Hongliang Wang Signed-off-by: Huacai Chen Link: https://patch.msgid.link/20260203062901.2158236-1-chenhuacai@loongson.cn Signed-off-by: Jakub Kicinski commit 2d94a3f7088b69ae25e27fb98d7f1ef572c843f9 Author: Bibo Mao Date: Fri Feb 6 09:28:01 2026 +0800 KVM: LoongArch: selftests: Add steal time test case LoongArch KVM supports steal time accounting now, here add steal time test case on LoongArch. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 872d277a1e2f8a8b83dc9f21151af9cb64e8f1ce Author: Bibo Mao Date: Fri Feb 6 09:28:01 2026 +0800 LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side Function vcpu_is_preempted() is used to check whether vCPU is preempted or not. Here add the implementation with vcpu_is_preempted() when option CONFIG_PARAVIRT is enabled. Acked-by: Juergen Gross Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 9b486cdd032a90032c6b567ea723595205ca2626 Author: Bibo Mao Date: Fri Feb 6 09:28:01 2026 +0800 LoongArch: KVM: Add paravirt preempt feature in hypervisor side Feature KVM_FEATURE_PREEMPT is added to show whether vCPU is preempted or not. It is to help guest OS scheduling or lock checking etc. Here add KVM_FEATURE_PREEMPT feature and use one byte as preempted flag in the steal time structure. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 2faec60a4858bd7fe1bc1419963c6bf030e85706 Author: Bibo Mao Date: Fri Feb 6 09:28:00 2026 +0800 LoongArch: KVM: Set default return value in KVM IO bus ops When in-kernel irqchip is enabled, its register area is registered in the KVM IO bus list with API kvm_io_bus_register_dev(). In MMIO/IOCSR register access emulation, kvm_io_bus_read()/kvm_io_bus_write() is called firstly. If it returns 0, it means that the in-kernel irqchip handles the emulation already, else it returns to user-mode VMM and lets VMM emulate the register access. Once in-kernel irqchip is enabled, it should return 0 if the address is within range of the registered KVM IO bus. It should not return to user-mode VMM since VMM does not know how to handle it, and irqchip is handled in kernel already. Here set default return value with 0 in KVM IO bus operations. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 382c38c9ec94fe87ffd6c9b456fa8ce67943cf1b Author: Bibo Mao Date: Fri Feb 6 09:28:00 2026 +0800 LoongArch: KVM: Add FPU/LBT delay load support FPU/LBT are lazy enabled with KVM hypervisor. After FPU/LBT enabled and loaded, vCPU can be preempted and FPU/LBT will be lost again, there will be unnecessary FPU/LBT exceptions, load and store stuff. Here delay the FPU/LBT load until the guest entry. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit b1388a9598fbe77b193cbb8368eed46e982212c5 Author: Bibo Mao Date: Fri Feb 6 09:27:47 2026 +0800 LoongArch: KVM: Move LBT capability check in exception handler Like FPU exception handler, check LBT capability in the LBT exception handler rather than function kvm_own_lbt(). Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 37da26e0e8396def86ff4ca70ece0a5f5619dbd4 Author: Bibo Mao Date: Fri Feb 6 09:27:47 2026 +0800 LoongArch: KVM: Move LASX capability check in exception handler Like FPU exception handler, check LASX capability in the LASX exception handler rather than function kvm_own_lasx(). Since LASX capability in the function kvm_guest_has_lasx() implies FPU and LSX capability, only checking kvm_guest_has_lasx() is OK here. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 89b5dc53971328934fcb6a68bf75e4b76fc59ef0 Author: Bibo Mao Date: Fri Feb 6 09:27:47 2026 +0800 LoongArch: KVM: Move LSX capability check in exception handler Like FPU exception handler, check LSX capability in the LSX exception handler rather than function kvm_own_lsx(). Since LSX capability in the function kvm_guest_has_lsx() implies FPU capability, only checking kvm_guest_has_lsx() is OK here. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit c5cb12b81a0bddbff0f963662f18747b6d633592 Author: Bibo Mao Date: Fri Feb 6 09:27:46 2026 +0800 LoongArch: KVM: Handle LOONGARCH_CSR_IPR during vCPU context switch Register LOONGARCH_CSR_IPR is interrupt priority setting for nested interrupt handling. Though LoongArch Linux AVEC driver does not use this register, KVM hypervisor needs to save and restore this it during vCPU context switch. Because Linux AVEC driver may use this register in future, or other OS may use it. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit c2f94dafe197961f266fef8946d39df66a9750f4 Author: Bibo Mao Date: Fri Feb 6 09:27:46 2026 +0800 LoongArch: KVM: Check VM msgint feature during interrupt handling During message interrupt handling and relative CSR registers saving and restore, it is better to check VM msgint feature rather than host msgint feature, because VM may disable this feature even if host supports this. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 31966edb9a5d70b6a842da3ac7e5602df10bb4c2 Author: Bibo Mao Date: Fri Feb 6 09:27:46 2026 +0800 LoongArch: KVM: Add msgint registers in kvm_init_gcsr_flag() Add flag HW_GCSR with msgint registers in function kvm_init_gcsr_flag(). Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 82db90bf461b0cfbb9457a2e721a781c14512e37 Author: Bibo Mao Date: Fri Feb 6 09:27:46 2026 +0800 LoongArch: KVM: Move feature detection in kvm_vm_init_features() VM feature detection is sparsed in function kvm_vm_init_features() and kvm_vm_feature_has_attr(). Here move all the features detection in function kvm_vm_init_features(), and there is only feature checking in function kvm_vm_feature_has_attr(). Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit de0c51370b7dca71825c5e3e4099ebc353a0df1a Author: Bibo Mao Date: Fri Feb 6 09:27:46 2026 +0800 LoongArch: KVM: Add more CPUCFG mask bits With new CPU cores there are more features supported which are indicated in CPUCFG2 bits 24:30 and CPUCFG3 bits 17:23. The KVM hypervisor cannot enable or disable (most of) these features and there is no KVM exception when instructions of these features are executed in guest mode. Here add more CPUCFG mask support with LA664 CPU type. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 1099b651ae4d1de129adc073a657c03c94ef3d22 Merge: 3cc9398a9ea69b 3e28a67a85f9b5 Author: Dave Airlie Date: Fri Feb 6 10:59:00 2026 +1000 Merge tag 'drm-intel-next-fixes-2026-02-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Fix the pixel normalization handling for xe3p_lpd display Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/aYROngKfyUIyoQW0@jlahtine-mobl commit be8d4567609d417a5ecc8d67db441c0445722f54 Merge: 6516169fa7f611 a40236feb62ccb Author: Mark Brown Date: Thu Feb 5 23:13:44 2026 +0000 spi: cadence-qspi: Add Renesas RZ/N1 support Merge series from "Miquel Raynal (Schneider Electric)" : This series adds support for the QSPI controller available on Renesas RZ/N1S and RZ/N1D SoC. It has been tested with a custom board (see last SPI patch for details), but has been tested by Wolfram (thank you!) on the DB board. Link: https://lore.kernel.org/linux-devicetree/20260116114852.52948-2-wsa+renesas@sang-engineering.com/ Adding support for this SoC required a few adaptations to the Cadence QSPI driver which have already been merged (except one regarding clocks handling). This series contains the remaining patches, the ones actually adding support for the RZ/N1 flavour. commit dacaa439fa3ac8780847392342d886f14ad1b765 Merge: 5209af4db05914 d94ea902462ac3 Author: Mark Brown Date: Thu Feb 5 22:52:13 2026 +0000 ASoC: rockchip: spdif: Cleanups and port features Merge series from Sebastian Reichel : I'm currently working on DisplayPort audio support for the Rockchip RK3588/RK3576 SoCs, which preferrably use S/PDIF as DAI source. Apparently the upstream Rockchip S/PDIF driver is lacking a couple of features right now, which are necessary to get things going (i.e. setting the sysclk from the machine driver). I found the missing bits in Rockchip's 6.1 BSP kernel and ported them over. This series effectly brings the mainline kernel on-par with the BSP driver, but also contains a couple of cleanup patches of my own to bring the driver to the modern age. commit 5209af4db0591452477b17ef2718734c18483476 Merge: 84faa91585fa22 6f220440399afb Author: Mark Brown Date: Thu Feb 5 22:41:22 2026 +0000 ASoC: cs35l56: More support for new Dell laptops Merge series from Richard Fitzgerald : Some new Dell models use spare pins on the amp as a binary integer value to indicate the speaker type. The driver must use this to select the correct firmware files for the hardware. Patch #1 is the new support. The other patches are for KUnit testing. commit 5028a24aa89a2c91b44964191ee8184e5f5c8cb2 Author: Kent Russell Date: Tue Feb 3 09:48:23 2026 -0500 drm/amdgpu: Send applicable RMA CPERs at end of RAS init Firmware and monitoring tools may not be ready to receive a CPER when we read the bad pages, so send the CPERs at the end of RAS initialization to ensure that the FW is ready to receive and process the CPER. This removes the previous CPER submission that was added during bad page load, and sends both in-band and out-of-band at the same time. Signed-off-by: Kent Russell Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit f7afda7fcd169a9168695247d07ad94cf7b9798f Author: Mario Limonciello Date: Thu Feb 5 10:42:54 2026 -0600 drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() The commit 6a23e7b4332c ("drm/amd: Clean up kfd node on surprise disconnect") introduced early KFD cleanup when drm_dev_is_unplugged() returns true. However, this causes hangs during normal module unload (rmmod amdgpu). The issue occurs because drm_dev_unplug() is called in amdgpu_pci_remove() for all removal scenarios, not just surprise disconnects. This was done intentionally in commit 39934d3ed572 ("Revert "drm/amdgpu: TA unload messages are not actually sent to psp when amdgpu is uninstalled"") to fix IGT PCI software unplug test failures. As a result, drm_dev_is_unplugged() returns true even during normal module unload, triggering the early KFD cleanup inappropriately. The correct check should distinguish between: - Actual surprise disconnect (eGPU unplugged): pci_dev_is_disconnected() returns true - Normal module unload (rmmod): pci_dev_is_disconnected() returns false Replace drm_dev_is_unplugged() with pci_dev_is_disconnected() to ensure the early cleanup only happens during true hardware disconnect events. Cc: stable@vger.kernel.org Reported-by: Cal Peake Closes: https://lore.kernel.org/all/b0c22deb-c0fa-3343-33cf-fd9a77d7db99@absolutedigital.net/ Fixes: 6a23e7b4332c ("drm/amd: Clean up kfd node on surprise disconnect") Acked-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 6952255ed97914abbf86fc3f92c9918945b885b8 Author: Alex Deucher Date: Fri Jan 30 11:19:49 2026 -0500 drm/amdgpu: re-add the bad job to the pending list for ring resets Returning DRM_GPU_SCHED_STAT_NO_HANG causes the scheduler to add the bad job back the pending list. We've already set the errors on the fence and killed the bad job at this point so it's the correct behavior. Acked-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Alex Deucher commit 5cc7bbd9f1b74d9fe2f7ac08d6ba0477e8d2d65f Author: Victor Zhao Date: Wed Feb 4 23:15:04 2026 +0800 drm/amdgpu: avoid sdma ring reset in sriov sdma ring reset is not supported in SRIOV. kfd driver does not check reset mask, and could queue sdma ring reset during unmap_queues_cpsch. Avoid the ring reset for sriov. Signed-off-by: Victor Zhao Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit f025a2b8d93358467b8e8f4b3a617e88c5f02fab Author: Sunil Khatri Date: Tue Feb 3 12:09:05 2026 +0530 drm/amdgpu: clean up the amdgpu_cs_parser_bos In low memory conditions, kmalloc can fail. In such conditions unlock the mutex for a clean exit. We do not need to amdgpu_bo_list_put as it's been handled in the amdgpu_cs_parser_fini. Fixes: 737da5363cc0 ("drm/amdgpu: update the functions to use amdgpu version of hmm") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202602030017.7E0xShmH-lkp@intel.com/ Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3b948dd0366a0b64c02e4ed1aefdf7825942e803 Author: Philip Yang Date: Tue Jan 27 13:52:33 2026 -0500 drm/amdgpu: Use 5-level paging if gmc support 57-bit VA Regardless if CPU enable 5-level paging, GPU vm use 5-level paging if gmc init with 57-bit address space support, because ARM64 4-level paging support 48-bit VA, x86 and GPU 4-level paging support 47-bit VA, require 5-level paging on GPU to support ARM64. NPA address space 52-bit mapping on NPA GPU VM require 5-level paging. Debugger trap get device snapshot expect LDS and Scratch base, limit above 57-bit, which is set only for 5-level paging. Signed-off-by: Philip Yang Reviewed-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.19.x commit ff205dc95a897b4b8c093b665702e83bffd04dc9 Author: Melissa Wen Date: Tue Dec 9 12:09:06 2025 -0300 drm/amd/display: expose plane blend LUT in HW with MCM Since commit 39923050615cd ("drm/amd/display: Clear DPP 3DLUT Cap") there is a flag in the mpc_color_caps that indicates the pre-blend usage of MPC color caps. Do the same as commit 9e5d4a5e27c6 ("drm/amd/display: Use mpc.preblend flag to indicate preblend") and use the mpc.preblend flag to expose plane blend LUT/TF properties on AMD display driver. CC: Matthew Schwartz Signed-off-by: Melissa Wen Tested-by: Matthew Schwartz Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 39fc2bc4da0082c226cbee331f0a5d44db3997da Author: Yifan Zhang Date: Mon Feb 2 13:17:39 2026 +0800 drm/amdgpu: Protect GPU register accesses in powergated state in some paths Ungate GPU CG/PG in device_fini_hw and device_halt to protect GPU register accesses, e.g. GC registers are accessed in amdgpu_irq_disable_all() and amdgpu_fence_driver_hw_fini(). Signed-off-by: Yifan Zhang Acked-by: Alex Deucher Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8a70a26c9f34baea6c3199a9862ddaff4554a96d Author: Sunday Clement Date: Mon Feb 2 12:41:39 2026 -0500 drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation. Signed-off-by: Sunday Clement Reviewed-by: Alexander Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 56423871e9eef1dd069bddef895207fa5ce275fe Author: Alex Deucher Date: Tue Feb 3 11:53:51 2026 -0500 drm/amdgpu/sdma6: enable queue resets unconditionally There is no firmware version dependency. This also enables sdma queue resets on all SDMA 6.x based chips. Fixes: 59fd50b8663b ("drm/amdgpu: Add sysfs interface for sdma reset mask") Cc: Jesse Zhang Reviewed-by: Jesse.Zhang Signed-off-by: Alex Deucher commit 314d30ad50622fc0d70da71509f9dff21545be14 Author: Alex Deucher Date: Tue Feb 3 11:52:46 2026 -0500 drm/amdgpu/sdma5.2: enable queue resets unconditionally There is no firmware version dependency. This also enables sdma queue resets on all SDMA 5.2.x based chips. Fixes: 59fd50b8663b ("drm/amdgpu: Add sysfs interface for sdma reset mask") Cc: Jesse Zhang Reviewed-by: Jesse.Zhang Signed-off-by: Alex Deucher commit 46a2cb7d24f21132e970cab52359210c3f5ea3c6 Author: Alex Deucher Date: Tue Feb 3 11:51:45 2026 -0500 drm/amdgpu/sdma5: enable queue resets unconditionally There is no firmware version dependency. Fixes: 59fd50b8663b ("drm/amdgpu: Add sysfs interface for sdma reset mask") Cc: Jesse Zhang Reviewed-by: Jesse.Zhang Signed-off-by: Alex Deucher commit ee41e5b63c8210525c936ee637a2c8d185ce873c Author: Zilin Guan Date: Thu Jan 29 08:35:15 2026 +0000 drm/amdgpu: Fix memory leak in amdgpu_ras_init() When amdgpu_nbio_ras_sw_init() fails in amdgpu_ras_init(), the function returns directly without freeing the allocated con structure, leading to a memory leak. Fix this by jumping to the release_con label to properly clean up the allocated memory before returning the error code. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: fdc94d3a8c88 ("drm/amdgpu: Rework pcie_bif ras sw_init") Reviewed-by: Tao Zhou Signed-off-by: Zilin Guan Signed-off-by: Alex Deucher commit 0c44d61945c4a80775292d96460aa2f22e62f86c Author: Zilin Guan Date: Thu Jan 29 09:05:42 2026 +0000 drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() amdgpu_discovery_get_nps_info() internally allocates memory for ranges using kvcalloc(), which may use vmalloc() for large allocation. Using kfree() to release vmalloc memory will lead to a memory corruption. Use kvfree() to safely handle both kmalloc and vmalloc allocations. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: b194d21b9bcc ("drm/amdgpu: Use NPS ranges from discovery table") Reviewed-by: Lijo Lazar Signed-off-by: Zilin Guan Signed-off-by: Alex Deucher commit c9be63d565789b56ca7b0197e2cb78a3671f95a8 Author: Zilin Guan Date: Thu Jan 29 09:25:32 2026 +0000 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() In amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM, the function returns directly without releasing the allocated xcc_info, resulting in a memory leak. Fix this by ensuring that xcc_info is properly freed in the error paths. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 4d5275ab0b18 ("drm/amdgpu: Add parsing of acpi xcc objects") Reviewed-by: Lijo Lazar Signed-off-by: Zilin Guan Signed-off-by: Alex Deucher commit c40c94693c87e092fea94fe8cbd751d216511793 Author: Stanley.Yang Date: Fri Jan 23 19:58:29 2026 +0800 drm/amd/ras: statistic xgmi training error count Report xgmi training error uncorrectable error count. Signed-off-by: Stanley.Yang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit c89477ad79446867394360b29bb801010fc3ff22 Author: Eric Dumazet Date: Tue Feb 3 19:25:09 2026 +0000 inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST") pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner "man 7 raw" states: A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets. Make sure we drop these malicious packets. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Yizhou Zhao Link: https://lore.kernel.org/netdev/20251109134600.292125-1-zhaoyz24@mails.tsinghua.edu.cn/ Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260203192509.682208-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6a65c0cb0ff20b3cbc5f1c87b37dd22cdde14a1c Author: Daniel Hodges Date: Tue Feb 3 09:56:21 2026 -0500 tipc: fix RCU dereference race in tipc_aead_users_dec() tipc_aead_users_dec() calls rcu_dereference(aead) twice: once to store in 'tmp' for the NULL check, and again inside the atomic_add_unless() call. Use the already-dereferenced 'tmp' pointer consistently, matching the correct pattern used in tipc_aead_users_inc() and tipc_aead_users_set(). Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Cc: stable@vger.kernel.org Reviewed-by: Eric Dumazet Signed-off-by: Daniel Hodges Link: https://patch.msgid.link/20260203145621.17399-1-git@danielhodges.dev Signed-off-by: Jakub Kicinski commit 48dec8d88af96039a4a17b8c2f148f2a4066e195 Author: Thomas Bogendoerfer Date: Tue Feb 3 15:11:52 2026 +0100 bonding: only set speed/duplex to unknown, if getting speed failed bond_update_speed_duplex() first set speed/duplex to unknown and then asks slave driver for current speed/duplex. Since getting speed/duplex might take longer there is a race, where this false state is visible by /proc/net/bonding. With commit 691b2bf14946 ("bonding: update port speed when getting bond speed") this race gets more visible, if user space is calling ethtool on a regular base. Fix this by only setting speed/duplex to unknown, if link speed is really unknown/unusable. Fixes: 98f41f694f46 ("bonding:update speed/duplex for NETDEV_CHANGE") Signed-off-by: Thomas Bogendoerfer Acked-by: Jay Vosburgh Reviewed-by: Nikolay Aleksandrov Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260203141153.51581-1-tbogendoerfer@suse.de Signed-off-by: Jakub Kicinski commit 2d2d574309e3ae84ee794869a5da8b4c38753a94 Author: Anshumali Gaur Date: Tue Feb 3 10:37:01 2026 +0530 octeontx2-af: Fix PF driver crash with kexec kernel booting During a kexec reboot the hardware is not power-cycled, so AF state from the old kernel can persist into the new kernel. When AF and PF drivers are built as modules, the PF driver may probe before AF reinitializes the hardware. The PF driver treats the RVUM block revision as an indication that AF initialization is complete. If this value is left uncleared at shutdown, PF may incorrectly assume AF is ready and access stale hardware state, leading to a crash. Clear the RVUM block revision during AF shutdown to avoid PF mis-detecting AF readiness after kexec. Fixes: 54494aa5d1e6 ("octeontx2-af: Add Marvell OcteonTX2 RVU AF driver") Signed-off-by: Anshumali Gaur Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260203050701.2616685-1-agaur@marvell.com Signed-off-by: Jakub Kicinski commit 1ace9bac1ad2bc6a0a70baaa16d22b7e783e88c5 Author: Alexei Starovoitov Date: Thu Feb 5 11:02:33 2026 -0800 bpf: Prevent reentrance into call_rcu_tasks_trace() call_rcu_tasks_trace() is not safe from in_nmi() and not reentrant. To prevent deadlock on raw_spin_lock_rcu_node(rtpcp) or memory corruption defer to irq_work when IRQs are disabled. call_rcu_tasks_generic() protects itself with local_irq_save(). Note when bpf_async_cb->refcnt drops to zero it's safe to reuse bpf_async_cb->worker for a different irq_work callback, since bpf_async_schedule_op() -> irq_work_queue(&cb->worker); is only called when refcnt >= 1. Fixes: 1bfbc267ec91 ("bpf: Enable bpf_timer and bpf_wq in any context") Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260205190233.912-1-alexei.starovoitov@gmail.com commit d94ea902462ac39846d878aa67b78408727e0674 Author: Sebastian Reichel Date: Tue Feb 3 17:46:32 2026 +0100 ASoC: rockchip: spdif: Convert to FIELD_PREP Convert the driver to use FIELD_PREP to increase readability. This also fixes an issue that the SDPIF_CFGR_VDW_MASK was wrong, which didn't have any effects as the only user in the driver updates the other bits at the same time. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-10-4412016cf577@collabora.com Signed-off-by: Mark Brown commit 07a791020be9b190d4a57b5ee823ede1e98df493 Author: Sugar Zhang Date: Tue Feb 3 17:46:31 2026 +0100 ASoC: rockchip: spdif: Fill IEC958 CS info per params Add support to fill IEC958 channel status information. Signed-off-by: Sugar Zhang Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-9-4412016cf577@collabora.com Signed-off-by: Mark Brown commit c43ec509019842c0b836e858dc486c216b51b087 Author: Sugar Zhang Date: Tue Feb 3 17:46:30 2026 +0100 ASoC: rockchip: spdif: Add support for format S32_LE Treat 32 bit sample width as if it was 24 bits using only the 24 most significant bits. [I've merged the channel-swapping fix from Zohn Ni into Sugar Zhang's patch introducing the problem in the first place] Co-developed-by: Zohn Ni Signed-off-by: Zohn Ni Signed-off-by: Sugar Zhang Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-8-4412016cf577@collabora.com Signed-off-by: Mark Brown commit 298082783a0d6d07109f8ce09ab410a1de12876d Author: Sugar Zhang Date: Tue Feb 3 17:46:29 2026 +0100 ASoC: rockchip: spdif: Add support for set mclk rate Allow setting the mclk rate from the machine driver. Signed-off-by: Sugar Zhang Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-7-4412016cf577@collabora.com Signed-off-by: Mark Brown commit 7bdde9a2fd6577e18cd99e4f0e71e466ba626e77 Author: Sugar Zhang Date: Tue Feb 3 17:46:28 2026 +0100 ASoC: rockchip: spdif: Swap PCM and DAI component registration order PCM should be registered before the DAI component, as the second one triggers snd_soc_try_rebind_card. Signed-off-by: Sugar Zhang Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-6-4412016cf577@collabora.com Signed-off-by: Mark Brown commit 72bcc223032cb71e640e466eb644537e369959a5 Author: Sugar Zhang Date: Tue Feb 3 17:46:27 2026 +0100 ASoC: rockchip: spdif: Improve sample rate support The hardware supports all sample rates up to 192kHz. Signed-off-by: Sugar Zhang Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-5-4412016cf577@collabora.com Signed-off-by: Mark Brown commit 730b0af2748a74528e0ad25f2bcd3272e96db10a Author: Sebastian Reichel Date: Tue Feb 3 17:46:26 2026 +0100 ASoC: rockchip: spdif: Use dev_err_probe Cleanup the probe routine a little bit by using dev_err_probe instead of dev_err. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-4-4412016cf577@collabora.com Signed-off-by: Mark Brown commit 7e2de68e4dbaee65864b0c5972e1b03037243632 Author: Sebastian Reichel Date: Tue Feb 3 17:46:25 2026 +0100 ASoC: rockchip: spdif: Fully convert to device managed resources This driver mixes device managed resources with unmanaged ones and (as a lot of them do) gets the order wrong resulting in potential race condition problems at module removal time. Let's go to full device managed resources to cleanup the code and get rid of the potential race condition. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-3-4412016cf577@collabora.com Signed-off-by: Mark Brown commit 45df1f66b99340e1d6e90501f1e938400a3e9768 Author: Sebastian Reichel Date: Tue Feb 3 17:46:24 2026 +0100 ASoC: rockchip: spdif: Move DT compatible table Move rk_spdif_match DT compatible table to the usual place before the platform-driver struct definition and drop the useless of_match_ptr(), since it is fine to reference the DT id table even when OF support is disabled (which makes the driver useless anyways). Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-2-4412016cf577@collabora.com Signed-off-by: Mark Brown commit 27b5096ef0f3a78441128b993f0353a77f2f5f53 Author: Sebastian Reichel Date: Tue Feb 3 17:46:23 2026 +0100 ASoC: rockchip: spdif: Use device_get_match_data() Use device_get_match_data(), so that the probe routine does not directly reference the of_match_table. This allows moving the table at the end of the file where most recent drivers have it. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20260203-rockchip-spdif-cleanup-and-bsp-sync-v2-1-4412016cf577@collabora.com Signed-off-by: Mark Brown commit a40236feb62ccbf2b36d288550a483122b3205e5 Author: Miquel Raynal (Schneider Electric) Date: Thu Feb 5 19:09:50 2026 +0100 spi: cadence-qspi: Add support for the Renesas RZ/N1 controller Renesas RZ/N1 QSPI controllers embed a modified version of the Cadence IP with the following settings: - a limited bus clock range - no DTR support - no DMA - no useful interrupt flag - only direct accesses (no INDAC mode) - write protection The controller has been tested by running the SPI NOR check list with a custom RZ/N1D400 based board mounted with a Spansion s25fl128s1 quad SPI. Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Link: https://patch.msgid.link/20260205-schneider-6-19-rc1-qspi-v5-3-843632b3c674@bootlin.com Signed-off-by: Mark Brown commit 324ecc7788c2e21d0d9197a8c015ff75382122d9 Author: Miquel Raynal (Schneider Electric) Date: Thu Feb 5 19:09:49 2026 +0100 spi: cadence-qspi: Kill cqspi_jh7110_clk_init This controller can be fed by either a main "ref" clock, or three clocks ("ref" again, "ahb", "apb"). In practice, it is likely that all controllers have the same inputs, but a single clock feeds the three interfaces (ref is used for controlling the external interface, ahb/apb the internal ones). Handling these clocks is in no way SoC specific, only the number of expected clocks may change. Plus, we will soon be adding another controller requiring an AHB and an APB clock as well, so it is time to align the whole clock handling. Furthermore, the use of the cqspi_jh7110_clk_init() helper, which specifically grabs and enables the "ahb" and "apb" clocks, is a bit convoluted: - only the JH7110 compatible provides the ->jh7110_clk_init() callback, - in the probe, if the above callback is set in the driver data, the driver does not call the callback (!) but instead calls the helper directly (?), - in the helper, the is_jh7110 boolean is set. This logic does not make sense. Instead: - in the probe, set the is_jh7110 boolean based on the compatible, - collect all available clocks with the "bulk" helper, - enable the extra clocks if they are available, - kill the SoC specific cqspi_jh7110_clk_init() helper. This also allows to group the clock handling instead of depending on the driver data pointer, which further simplifies the error path and the remove callback. Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Link: https://patch.msgid.link/20260205-schneider-6-19-rc1-qspi-v5-2-843632b3c674@bootlin.com Signed-off-by: Mark Brown commit 2b97f5cd1a956a9ac948ec57775600158988dadd Author: Miquel Raynal (Schneider Electric) Date: Thu Feb 5 19:09:48 2026 +0100 spi: dt-bindings: cdns,qspi-nor: Add Renesas RZ/N1D400 to the list Add support for the Renesas RZ/N1D400 QSPI controller. This SoC is identified in the bindings with its other name: r9a06g032. It is part of the RZ/N1 family, which contains a "D" and a "S" variant. IPs in this SoC are typically described using 2 compatibles: the SoC specific compatible and the family compatible. The original Cadence IP compatible is dropped because it is unusable on its own. Indirect accesses are not supported by this flavour of the Cadence IP, which means several properties have no meaning in the scope of the Renesas compatible. Let's make sure they are no longer expected nor mandatory. Tested-by: Wolfram Sang Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal (Schneider Electric) Link: https://patch.msgid.link/20260205-schneider-6-19-rc1-qspi-v5-1-843632b3c674@bootlin.com Signed-off-by: Mark Brown commit 442ae406603a94f1a263654494f425302ceb0445 Author: Jens Axboe Date: Thu Feb 5 08:38:20 2026 -0700 io_uring/kbuf: fix memory leak if io_buffer_add_list fails io_register_pbuf_ring() ignores the return value of io_buffer_add_list(), which can fail if xa_store() returns an error (e.g., -ENOMEM). When this happens, the function returns 0 (success) to the caller, but the io_buffer_list structure is neither added to the xarray nor freed. In practice this requires failure injection to hit, hence not a real issue. But it should get fixed up none the less. Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Jens Axboe commit 1e06dbfdfb851170b243d6498e442b449324c664 Author: Andrea Scian Date: Wed Feb 4 18:41:45 2026 +0100 mtd: rawnand: pl353: Add message about ECC mode This just add some information on kernel log about the selected ECC Signed-off-by: Andrea Scian Signed-off-by: Miquel Raynal commit 89b831ebdaca0df4ca3b226f7e7a1d1db1629060 Author: Andrea Scian Date: Wed Feb 4 18:41:44 2026 +0100 mtd: rawnand: pl353: Fix software ECC support We need to set also write_page_raw in ecc structure to allow choosing SW ECC instead of HW one, otherwise write operation fail. Fixes: 08d8c62164a322 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller") Signed-off-by: Andrea Scian Cc: stable@kernel.org Signed-off-by: Miquel Raynal commit a182a62ff77f705f7dd3d98cf05cb3d03751a8f0 Merge: a90f6dcefca6d5 8fdb05de0e2db8 Author: Jakub Kicinski Date: Thu Jan 22 20:13:25 2026 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.19-rc9). No adjacent changes, conflicts: drivers/net/ethernet/spacemit/k1_emac.c 3125fc1701694 ("net: spacemit: k1-emac: fix jumbo frame support") f66086798f91f ("net: spacemit: Remove broken flow control support") https://lore.kernel.org/aYIysFIE9ooavWia@sirena.org.uk Signed-off-by: Jakub Kicinski commit 5023ca80f9589295cb60735016e39fc5cc714243 Author: Ian Forbes Date: Tue Jan 13 11:53:57 2026 -0600 drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer becoming an out parameter. The error path when the lookup failed was not changed to reflect this change and the code continued to return the PTR_ERR of the now uninitialized pointer. This could cause the vmw_translate_ptr functions to return success when they actually failed causing further uninitialized and OOB accesses. Reported-by: Kuzey Arda Bulut Fixes: a309c7194e8a ("drm/vmwgfx: Remove rcu locks from user resources") Signed-off-by: Ian Forbes Reviewed-by: Zack Rusin Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20260113175357.129285-1-ian.forbes@broadcom.com commit 922f9dec5d19df4cfbb7070275e5c131d10c80f3 Author: Ian Forbes Date: Fri Jan 9 09:51:39 2026 -0600 drm/vmwgfx: Set a unique ID for each submitted command buffer These IDs are logged by the Hypervisor when debug logging is enabled. Having the IDs in the log makes it much easier to see when command buffers start and finish. They can also be used by logging/tracing in the Guest to help correlate between Guest and Hypervisor logs. Signed-off-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20260109155139.3259493-1-ian.forbes@broadcom.com commit 211ecfaaef186ee5230a77d054cdec7fbfc6724a Author: Brad Spengler Date: Wed Jan 7 12:12:36 2026 -0500 drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release The kref_put() call uses (void *)kvfree as the release callback, which is incorrect. kref_put() expects a function with signature void (*release)(struct kref *), but kvfree has signature void (*)(const void *). Calling through an incompatible function pointer is undefined behavior. The code only worked by accident because ref_count is the first member of vmw_bo_dirty, making the kref pointer equal to the struct pointer. Fix this by adding a proper release callback that uses container_of() to retrieve the containing structure before freeing. Fixes: c1962742ffff ("drm/vmwgfx: Use kref in vmw_bo_dirty") Signed-off-by: Brad Spengler Signed-off-by: Zack Rusin Cc: Ian Forbes Link: https://patch.msgid.link/20260107171236.3573118-1-zack.rusin@broadcom.com commit a90f6dcefca6d5ad765435b3188a3a440ed193a1 Author: Davide Caratti Date: Wed Feb 4 17:02:31 2026 +0100 net/sched: don't use dynamic lockdep keys with clsact/ingress/noqueue Currently we are registering one dynamic lockdep key for each allocated qdisc, to avoid false deadlock reports when mirred (or TC eBPF) redirects packets to another device while the root lock is acquired [1]. Since dynamic keys are a limited resource, we can save them at least for qdiscs that are not meant to acquire the root lock in the traffic path, or to carry traffic at all, like: - clsact - ingress - noqueue Don't register dynamic keys for the above schedulers, so that we hit MAX_LOCKDEP_KEYS later in our tests. [1] https://github.com/multipath-tcp/mptcp_net-next/issues/451 Changes in v2: - change ordering of spin_lock_init() vs. lockdep_register_key() (Jakub Kicinski) Signed-off-by: Davide Caratti Link: https://patch.msgid.link/94448f7fa7c4f52d2ce416a4895ec87d456d7417.1770220576.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 84faa91585fa22a161763f2fe8f84a602a196c87 Author: Ziyi Guo Date: Thu Feb 5 05:24:29 2026 +0000 ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe imx_rpmsg_probe() calls snd_soc_find_dai() without holding client_mutex. However, snd_soc_find_dai() has lockdep_assert_held(&client_mutex) indicating callers must hold this lock, as the function iterates over the global component list. All other callers of snd_soc_find_dai() either hold client_mutex via the snd_soc_bind_card() path or use the snd_soc_find_dai_with_mutex() wrapper. Use snd_soc_find_dai_with_mutex() instead to fix the missing lock protection. Signed-off-by: Ziyi Guo Reviewed-by: Frank Li Link: https://patch.msgid.link/20260205052429.4046903-1-n7l8m4@u.northwestern.edu Signed-off-by: Mark Brown commit 7e7fcfb0798a038b31fa3825734b5194c46b3e86 Author: Russell King (Oracle) Date: Wed Feb 4 10:37:59 2026 +0000 net: stmmac: imx: fix iMX93 register definitions When looking at the iMX93 documentation, the definitions in the driver do not correspond with the documentation, which makes the driver confusing. The driver, for example, re-uses a definition for bit 0 for two different registers, where this bit have completely different purposes. Fix this by renaming the second register, and adding a definition that reflects the true purpose of bit 0 in the first register (EQOS enable.) Replace MX93_GPR_ENET_QOS_INTF_MODE_MASK with MX93_GPR_ENET_QOS_ENABLE and MX93_GPR_ENET_QOS_INTF_SEL_MASK as MX93_GPR_ENET_QOS_INTF_MODE_MASK is not a register field. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vnaGl-00000007i9f-0ZMw@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 85d05e28171240ae357a085dc689b91e0ff44f50 Author: Eric Dumazet Date: Wed Feb 4 16:30:34 2026 +0000 ipv6: change inet6_sk_rebuild_header() to use inet->cork.fl.u.ip6 TCP v6 spends a good amount of time rebuilding a fresh fl6 at each transmit in inet6_csk_xmit()/inet6_csk_route_socket(). TCP v4 caches the information in inet->cork.fl.u.ip4 instead. This patch is a first step converting IPv6 to the same strategy: Before this patch inet6_sk_rebuild_header() only validated/rebuilt a dst. Automatic variable @fl6 content was lost. After this patch inet6_sk_rebuild_header() also initializes inet->cork.fl.u.ip6, which can be reused in the future. This makes inet6_sk_rebuild_header() very similar to inet_sk_rebuild_header(). Also remove the EXPORT_SYMBOL_GPL(), inet6_sk_rebuild_header() is not called from any module. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260204163035.4123817-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 047c5265ec8b0ee6648211cc4ab671b48f5e87d1 Merge: 77dc4a72b0f170 22c1264415ef0d Author: Jakub Kicinski Date: Thu Feb 5 09:23:08 2026 -0800 Merge branch 'tcp-remove-net-core-request_sock-c-and-no-longer-inline-__reqsk_free' Eric Dumazet says: ==================== tcp: remove net/core/request_sock.c and no longer inline __reqsk_free() After DCCP removal, net/core/request_sock.c makes no more sense. Move reqsk_queue_alloc() and reqsk_fastopen_remove() to TCP files. Then put __reqsk_free() out of line to save ~2 Kbytes of text. ==================== Link: https://patch.msgid.link/20260204055147.1682705-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 22c1264415ef0d4564dd74e3de66e1895d3f7bc0 Author: Eric Dumazet Date: Wed Feb 4 05:51:47 2026 +0000 tcp: move __reqsk_free() out of line Inlining __reqsk_free() is overkill, let's reclaim 2 Kbytes of text. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 2/4 grow/shrink: 2/14 up/down: 225/-2338 (-2113) Function old new delta __reqsk_free - 114 +114 sock_edemux 18 82 +64 inet_csk_listen_start 233 264 +31 __pfx___reqsk_free - 16 +16 __pfx_reqsk_queue_alloc 16 - -16 __pfx_reqsk_free 16 - -16 reqsk_queue_alloc 46 - -46 tcp_req_err 272 177 -95 reqsk_fastopen_remove 348 253 -95 cookie_bpf_check 157 62 -95 cookie_tcp_reqsk_alloc 387 290 -97 cookie_v4_check 1568 1465 -103 reqsk_free 105 - -105 cookie_v6_check 1519 1412 -107 sock_gen_put 187 78 -109 sock_pfree 212 82 -130 tcp_try_fastopen 1818 1683 -135 tcp_v4_rcv 3478 3294 -184 reqsk_put 306 90 -216 tcp_get_cookie_sock 551 318 -233 tcp_v6_rcv 3404 3141 -263 tcp_conn_request 2677 2384 -293 Total: Before=24887415, After=24885302, chg -0.01% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260204055147.1682705-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7d2064eb731716f34677fb2627a4a1b5cd1f14ce Author: Eric Dumazet Date: Wed Feb 4 05:51:46 2026 +0000 net: get rid of net/core/request_sock.c After DCCP removal, this file was not needed any more. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260204055147.1682705-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit a90765c6f60317fe28a4cd2cdc7b13f97ed6e12f Author: Eric Dumazet Date: Wed Feb 4 05:51:45 2026 +0000 tcp: move reqsk_fastopen_remove to net/ipv4/tcp_fastopen.c This function belongs to TCP stack, not to net/core/request_sock.c We get rid of the now empty request_sock.c n the following patch. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260204055147.1682705-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit d5c539155431cfb93d3ea8080649ea093102a490 Author: Eric Dumazet Date: Wed Feb 4 05:51:44 2026 +0000 inet: move reqsk_queue_alloc() to net/ipv4/inet_connection_sock.c Only called once from inet_csk_listen_start(), it can be static. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260204055147.1682705-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 77dc4a72b0f1704a1e4e0ecd58a57d9e02a685c8 Merge: 7a4cd71fa4514c b10d56b0db3ae9 Author: Jakub Kicinski Date: Thu Feb 5 09:20:48 2026 -0800 Merge branch 'net-stmmac-rk-final-cleanups-part' Russell King says: ==================== net: stmmac: rk: final cleanups part This is the last part of my current dwmac-rk cleanups. ==================== Link: https://patch.msgid.link/aYMN2gZMfLPKuukG@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b10d56b0db3ae9fa61b0b39c13e854a6bdae800d Author: Russell King (Oracle) Date: Wed Feb 4 09:14:43 2026 +0000 net: stmmac: rk: rk3506, rk3528 and rk3588 have rmii_mode in clock register rk3506, rk3528 and rk3588 have the rmii_mode bit in the clock GRF register rather than the gmac GRF register. Provide a mask for this field in the clock register, and convert these SoCs to use this. Add the necessary code in rk_gmac_powerup() to write this field. This allows us to get rid of these SoCs set_to_rmii() function. As such, we need to mark these SoCs as supporting RMII mode. Signed-off-by: Russell King (Oracle) Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner #px30,rk3328,rk3568,rk3588 Link: https://patch.msgid.link/E1vnYyB-00000007hpF-1dwK@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5c1fc7cb81dfed0c84ae19b1022d8ca977bd6f5d Author: Russell King (Oracle) Date: Wed Feb 4 09:14:38 2026 +0000 net: stmmac: rk: use rk_encode_wm16() for clock selection Use rk_encode_wm16() for RMII clock gating control, and also for the io_clksel bit used to select the transmit clock between CRU-derived and IO-derived clock sources. Both of these were configured via the "set_clock_selection" method in the SoC specific operations, but there is no requirement to change the io_clksel except when enabling clocks. It is also possible that we don't need to ungate the RMII clock if we are operating in RGMII mode, but this commit makes no change there. Split up the configuration of these as separate functions, and remove the set_clock_selection() method. Since these clocking bits are in the same register that we call the "speed" register, move the logic for writing that register into rk_write_speed_grf_reg(). Signed-off-by: Russell King (Oracle) Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner #px30,rk3328,rk3568,rk3588 Link: https://patch.msgid.link/E1vnYy6-00000007hp9-1AJM@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d7d92037cbd82ac6581ef9c97f14d2432f921fba Author: Russell King (Oracle) Date: Wed Feb 4 09:14:33 2026 +0000 net: stmmac: rk: rk3528: gmac0 only supports RMII RK3528 gmac0 dtsi contains: gmac0: ethernet@ffbd0000 { phy-handle = <&rmii0_phy>; phy-mode = "rmii"; mdio0: mdio { rmii0_phy: ethernet-phy@2 { phy-is-integrated; }; }; }; This follows the same pattern as rk3328, where this gmac instance only supports RMII. Disable RGMII in phylink's supported_interfaces mask for this gmac instance. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Reviewed-by: Heiko Stuebner Link: https://patch.msgid.link/E1vnYy1-00000007hp3-0hKm@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f365541bf7b6a32759c32c047df4ea80ff1cab86 Author: Russell King (Oracle) Date: Wed Feb 4 09:14:28 2026 +0000 net: stmmac: rk: rk3328: gmac2phy only supports RMII As detailed in a previous commit ("net: stmmac: rk: convert rk3328 to use bsp_priv->id") rk3328 gmac2phy only supports RMII, whereas gmac2io supports both RMII and RGMII. Clear supports_rgmii for gmac2phy. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner #px30,rk3328 gmac2io,rk3568,rk3588 Link: https://patch.msgid.link/E1vnYxw-00000007hox-0DqH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a9d4aff670eda7ab76a35d509d3586f253ea0e5f Author: Russell King (Oracle) Date: Wed Feb 4 09:14:22 2026 +0000 net: stmmac: rk: replace empty set_to_rmii() with supports_rmii Rather than providing a now-empty set_to_rmii() method to indicate that RMII is supported, switch to setting ops->supports_rmii instead. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner #px30,rk3328,rk3568,rk3588 Link: https://patch.msgid.link/E1vnYxq-00000007hor-3yXt@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d323769d64f21865ea2a9132aea0da7c6badc479 Author: Russell King (Oracle) Date: Wed Feb 4 09:14:17 2026 +0000 net: stmmac: rk: introduce flags indicating support for RGMII/RMII Introduce two boolean flags into struct rk_priv_data indicating whether RGMII and/or RMII is supported for this instance. Use these to configure the supported_interfaces mask for phylink, validate the interface mode. Initialise these from equivalent flags in the rk_gmac_ops or depending on the presence of the ops->set_to_rgmii and ops->set_to_mii methods. Finally, make ops->set_to_* optional. This will allow us to get rid of empty set_to_rmii() methods. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Reviewed-by: Heiko Stuebner Tested-by: Heiko Stuebner #px30,rk3328,rk3568,rk3588 Link: https://patch.msgid.link/E1vnYxl-00000007hol-3XiH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 Author: Andreas Gruenbacher Date: Thu Feb 5 15:52:57 2026 +0100 gfs2: fiemap page fault fix In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode glock. This can lead to recursive glock taking if the fiemap buffer is memory mapped to the same inode and accessing it triggers a page fault. Fix by disabling page faults for iomap_fiemap() and faulting in the buffer by hand if necessary. Fixes xfstest generic/742. Signed-off-by: Andreas Gruenbacher commit 6f220440399afba29165e0597fa2c3aa836191d7 Author: Richard Fitzgerald Date: Thu Feb 5 16:48:38 2026 +0000 ASoC: cs35l56: KUnit tests for parsing and using onchip GPIOs Add KUnit test cases for: - cs35l56_process_xu_properties() which reads the onchip GPIO definitions. - cs35l56_set_fw_name() calls functions to configure and set the GPIOs. - cs35l56_set_fw_name() saves the ID value in cs35l56_priv.speaker_id. - cs35l56_set_fw_name() does not overwrite a speaker ID that was already found some other way. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260205164838.1611295-4-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 9bca0f05cea49ad11b464672ccdf6efd6a814a45 Author: Richard Fitzgerald Date: Thu Feb 5 16:48:37 2026 +0000 ASoC: cs35l56-shared: KUnit tests for onchip speaker ID gpios Add KUnit testing of: cs35l56_check_and_save_onchip_spkid_gpios() cs35l56_configure_onchip_spkid_pads() cs35l56_read_onchip_spkid() The test consists of: - A mock regmap that simulates the pad and pin config registers. - Parameterization of the pin list, pulls list, a simulated value for each pin and the speaker ID value that this should produce. - A self-test of the simulated pin and GPIO registers. - A test that the value returned by cs35l56_read_onchip_spkid() is correct. - A test that the pin pull-up/down are set correctly by cs35l56_configure_onchip_spkid_pads() - A test that cs35l56_configure_onchip_spkid_pads() and cs35l56_read_onchip_spkid(0 return the expected values if cs35l56_base->num_onchip_spkid_gpios == 0. - A test that cs35l56_check_and_save_onchip_spkid_gpios() saves the configuration. - A test that cs35l56_check_and_save_onchip_spkid_gpios() rejects illegal GPIO numbers. - A test that cs35l56_check_and_save_onchip_spkid_gpios() rejects illegal pull types. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260205164838.1611295-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 4d1e3e2c404dc30e039d81ba7396c8bb82ade991 Author: Richard Fitzgerald Date: Thu Feb 5 16:48:36 2026 +0000 ASoC: cs35l56: Support for reading speaker ID from on-chip GPIOs Add support for using the state of pins on the amplifier to indicate the type of speaker fitted. Previously, where there were alternate speaker vendors, this was indicated using host CPU GPIOs. Some new Dell models use spare pins on the CS35L63 as GPIOs for the speaker ID detection. Cirrus-specific SDCA Disco properties provide a list of the pins to be used, and pull-up/down settings for the pads. This list is ordered, MSbit to LSbit. The code to set the firmware filename has been modified to check for using chip pins for speaker ID. The entire block of code to set firmware name has been moved out of cs35l56_component_probe() into its own function to make it easier to KUnit test. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260205164838.1611295-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit a2c86aa621c22f2a7e26c654f936d65cfff0aa91 Author: KP Singh Date: Thu Feb 5 08:07:55 2026 +0100 bpf: Require frozen map for calculating map hash Currently, bpf_map_get_info_by_fd calculates and caches the hash of the map regardless of the map's frozen state. This leads to a TOCTOU bug where userspace can call BPF_OBJ_GET_INFO_BY_FD to cache the hash and then modify the map contents before freezing. Therefore, a trusted loader can be tricked into verifying the stale hash while loading the modified contents. Fix this by returning -EPERM if the map is not frozen when the hash is requested. This ensures the hash is only generated for the final, immutable state of the map. Fixes: ea2e6467ac36 ("bpf: Return hashes of maps in BPF_OBJ_GET_INFO_BY_FD") Reported-by: Toshi Piazza Signed-off-by: KP Singh Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260205070755.695776-1-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit ea1535e28bb3773fc0b3cbd1f3842b808016990c Author: KP Singh Date: Thu Feb 5 07:38:07 2026 +0100 bpf: Limit bpf program signature size Practical BPF signatures are significantly smaller than KMALLOC_MAX_CACHE_SIZE Allowing larger sizes opens the door for abuse by passing excessive size values and forcing the kernel into expensive allocation paths (via kmalloc_large or vmalloc). Fixes: 349271568303 ("bpf: Implement signature verification for BPF programs") Reported-by: Chris Mason Signed-off-by: KP Singh Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260205063807.690823-1-kpsingh@kernel.org Signed-off-by: Alexei Starovoitov commit e5b250214aa402e079de566e10f6e01223fd26bd Author: Svyatoslav Ryhel Date: Mon Feb 2 10:05:26 2026 +0200 usb: phy: tegra: parametrize PORTSC1 register offset The PORTSC1 register has a different offset in Tegra20 compared to Tegra30+, yet they share a crucial set of registers required for HSIC functionality. Reflect this register offset change in the SoC config. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Link: https://patch.msgid.link/20260202080526.23487-5-clamor95@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8dc7ab65bd15e3c774f60ca073158bcb9a26ee5b Author: Svyatoslav Ryhel Date: Mon Feb 2 10:05:25 2026 +0200 usb: phy: tegra: parametrize HSIC PTS value The parallel transceiver select used in HSIC mode differs on Tegra20, where it uses the UTMI value (0), whereas Tegra30+ uses a dedicated HSIC value. Reflect this in the SoC config. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Link: https://patch.msgid.link/20260202080526.23487-4-clamor95@gmail.com Signed-off-by: Greg Kroah-Hartman commit a7abf50d3bbd8b8e79259e47a2a76953ccd903e3 Author: Svyatoslav Ryhel Date: Mon Feb 2 10:05:24 2026 +0200 usb: phy: tegra: return error value from utmi_wait_register Return exact error value from utmi_wait_register during HSIC power on. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Link: https://patch.msgid.link/20260202080526.23487-3-clamor95@gmail.com Signed-off-by: Greg Kroah-Hartman commit aacad391440ecc4f25e8d2db0d944a74fd874dd2 Author: Svyatoslav Ryhel Date: Mon Feb 2 10:05:23 2026 +0200 usb: phy: tegra: cosmetic fixes Change TEGRA_USB_HOSTPC1_DEVLC_PTS_HSIC to its literal value instead of using the BIT macro, as it is an enumeration. Correct the spelling in the comment and rename uhsic_registers_shift to uhsic_registers_offset. These changes are cosmetic and do not affect code behavior. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Link: https://patch.msgid.link/20260202080526.23487-2-clamor95@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8ccfe3ac901af9d4539f8ccc91b62f3a34a4ad9c Author: Tommaso Merciai Date: Thu Jan 29 17:54:05 2026 +0100 dt-bindings: usb: renesas,usbhs: Add RZ/G3E SoC support Document the Renesas USBHS controller found on the Renesas RZ/G3E SoC. The USBHS block on RZ/G3E is functionally identical to the one found on the RZ/G2L family, so no driver changes are needed. The existing "renesas,rzg2l-usbhs" fallback compatible will continue to be used for handling this IP. Acked-by: Conor Dooley Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260129165412.557643-1-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit a52e4f2dff413b58c7200e89bb6540bd995e1269 Author: Jisheng Zhang Date: Thu Jan 29 10:15:34 2026 +0800 usb: dwc2: fix resume failure if dr_mode is host commit 13b1f8e25bfd1 ("usb: dwc2: Force mode optimizations") removed the dwc2_force_mode(hsotg, true) in dwc2_force_dr_mode() if dr_mode is host. But this brings a bug: the controller fails to resume back as host, further debugging shows that the controller is resumed as peripheral. The reason is dwc2_force_dr_mode() missed the host mode forcing, and when resuming from s2ram, GINTSTS is 0 by default, dwc2_is_device_mode in dwc2_resume() misreads this as the controller is in peripheral mode. Fix the resume failure by adding back the dwc2_force_mode(hsotg, true). Then an obvious question is: why this bug hasn't been observed and fixed for about six years? There are two resons: most dwc2 platforms set the dr_mode as otg; Some platforms don't have suspend & resume support yet. Fixes: 13b1f8e25bfd1 ("usb: dwc2: Force mode optimizations") Cc: stable Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20260129021534.10411-1-jszhang@kernel.org Signed-off-by: Greg Kroah-Hartman commit 87e4b043b98a1d269be0b812f383881abee0ca45 Author: Thomas Richard (TI) Date: Fri Jan 30 11:05:45 2026 +0100 usb: cdns3: fix role switching during resume If the role change while we are suspended, the cdns3 driver switches to the new mode during resume. However, switching to host mode in this context causes a NULL pointer dereference. The host role's start() operation registers a xhci-hcd device, but its probe is deferred while we are in the resume path. The host role's resume() operation assumes the xhci-hcd device is already probed, which is not the case, leading to the dereference. Since the start() operation of the new role is already called, the resume operation can be skipped. So skip the resume operation for the new role if a role switch occurs during resume. Once the resume sequence is complete, the xhci-hcd device can be probed in case of host mode. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208 Mem abort info: ... Data abort info: ... [0000000000000208] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted 6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT Hardware name: Texas Instruments J7200 EVM (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usb_hcd_is_primary_hcd+0x0/0x1c lr : cdns_host_resume+0x24/0x5c ... Call trace: usb_hcd_is_primary_hcd+0x0/0x1c (P) cdns_resume+0x6c/0xbc cdns3_controller_resume.isra.0+0xe8/0x17c cdns3_plat_resume+0x18/0x24 platform_pm_resume+0x2c/0x68 dpm_run_callback+0x90/0x248 device_resume+0x100/0x24c dpm_resume+0x190/0x2ec dpm_resume_end+0x18/0x34 suspend_devices_and_enter+0x2b0/0xa44 pm_suspend+0x16c/0x5fc state_store+0x80/0xec kobj_attr_store+0x18/0x2c sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x130/0x1dc vfs_write+0x240/0x370 ksys_write+0x70/0x108 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x10c el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0x108 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401) ---[ end trace 0000000000000000 ]--- Cc: stable Fixes: 2cf2581cd229 ("usb: cdns3: add power lost support for system resume") Signed-off-by: Thomas Richard (TI) Acked-by: Peter Chen Link: https://patch.msgid.link/20260130-usb-cdns3-fix-role-switching-during-resume-v1-1-44c456852b52@bootlin.com Signed-off-by: Greg Kroah-Hartman commit 54aaa3b387c2f580a99dc86a9cc2eb6dfaf599a7 Author: Prashanth K Date: Wed Feb 4 11:11:55 2026 +0530 usb: dwc3: gadget: Move vbus draw to workqueue context Currently dwc3_gadget_vbus_draw() can be called from atomic context, which in turn invokes power-supply-core APIs. And some these PMIC APIs have operations that may sleep, leading to kernel panic. Fix this by moving the vbus_draw into a workqueue context. Fixes: 99288de36020 ("usb: dwc3: add an alternate path in vbus_draw callback") Cc: stable Tested-by: Samuel Wu Acked-by: Thinh Nguyen Signed-off-by: Prashanth K Link: https://patch.msgid.link/20260204054155.3063825-1-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 3c4ae63073d84abee5d81ce46d86a94e9dae9c89 Author: Johan Hovold Date: Thu Nov 27 14:47:02 2025 +0100 mux: mmio: fix regmap leak on probe failure The mmio regmap that may be allocated during probe is never freed. Switch to using the device managed allocator so that the regmap is released on probe failures (e.g. probe deferral) and on driver unbind. Fixes: 61de83fd8256 ("mux: mmio: Do not use syscon helper to build regmap") Cc: stable@vger.kernel.org # 6.16 Cc: Andrew Davis Signed-off-by: Johan Hovold Acked-by: Andrew Davis Link: https://patch.msgid.link/20251127134702.1915-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6dbc394fa51dfa43ed648fb95045ace57596b6f5 Merge: 917ad8a6655c2b 509f403f3ccec1 Author: Greg Kroah-Hartman Date: Thu Feb 5 17:06:32 2026 +0100 Merge tag 'usb-serial-6.20-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB serial device ids for 6.20-rc1 Here are some new modem device ids for 6.20-rc1. Everything has been in linux-next with no reported issues. * tag 'usb-serial-6.20-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Telit FN920C04 RNDIS compositions commit 917ad8a6655c2bb925d11ce3128a595aa2c00c3e Merge: 0a06917432a762 062191adfde0b1 Author: Greg Kroah-Hartman Date: Thu Feb 5 17:05:32 2026 +0100 Merge tag 'thunderbolt-for-v6.20-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v6.20 merge window This includes following USB4/Thunderbolt changes for the v6.20 merge window: - Tiny documentation update - Switch to use tb_warn() when logging path activation failures. Both have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.20-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Log path activation failures without WARN backtraces docs: admin-guide: thunderbolt: Replace ifconfig with ip commit 8f96d37e88712dea86c5aa3463e48ed0bd915c8e Merge: 4df29fb5bcebee 9e51d1da5b245c Author: Greg Kroah-Hartman Date: Thu Feb 5 17:02:30 2026 +0100 Merge tag 'socfpga_firmware_update_for_v6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-next Dinh writes: SoCFPGA firmware update for v6.20 - Delete stray tabs in stratix10-svc * tag 'socfpga_firmware_update_for_v6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: firmware: stratix10-svc: Delete some stray tabs commit f55ae0bfa00e446ea751d09f468daeafc303e03f Author: Greg Kroah-Hartman Date: Thu Feb 5 14:09:43 2026 +0100 driver core: remove device_change_owner() export The function, device_change_owner() is exported for modules to use, but there are no in-kernel users of it, so remove the export to prevent out-of-tree code from thinking this is a safe function to call. Reviewed-by: Danilo Krummrich Reviewed-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/2026020543-molar-childcare-af20@gregkh Signed-off-by: Greg Kroah-Hartman commit d79ff2d612022548b09c3427c69263bedf7f16df Author: Greg Kroah-Hartman Date: Thu Feb 5 14:09:42 2026 +0100 sysfs: remove exports of sysfs_*change_owner() Both sysfs_change_owner() and sysfs_file_change_owner() are exported to modules, but there are no in-kernel module users, so remove the exports so that crazy out-of-tree drivers don't get the impression that it is safe to call these functions at all. Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Reported-by: Lee Jones Reviewed-by: Lee Jones Link: https://patch.msgid.link/2026020541-energize-graduate-981a@gregkh Signed-off-by: Greg Kroah-Hartman commit 965e9a2cf23b066d8bdeb690dff9cd7089c5f667 Author: David Howells Date: Thu Feb 5 13:02:41 2026 +0000 pkcs7: Change a pr_warn() to pr_warn_once() Only display the "PKCS7: Waived invalid module sig (has authattrs)" once. Suggested-by: Lenny Szubowicz Signed-off-by: David Howells Tested-by: Lenny Szubowicz cc: Lukas Wunner cc: Ignat Korchagin cc: Jarkko Sakkinen cc: Stephan Mueller cc: Eric Biggers cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org commit 7bb8c40f5ad88392bbabb719ebfd5e3354ce0428 Author: Maurizio Lombardi Date: Wed Feb 4 11:55:55 2026 +0100 nvme: add support for dynamic quirk configuration via module parameter Introduce support for enabling or disabling specific NVMe quirks at module load time through the `quirks` module parameter. This mechanism allows users to apply known quirks dynamically based on the device's PCI vendor and device IDs, without requiring to add hardcoded entries in the driver and recompiling the kernel. While the generic PCI new_id sysfs interface exists for dynamic configuration, it is insufficient for scenarios where the system fails to boot (for example, this has been reported to happen because of the bogus_nid quirk). The new_id attribute is writable only after the system has booted and sysfs is mounted. The `quirks` parameter accepts a list of quirk specifications separated by a '-' character in the following format: ::[-::-..] Each quirk is represented by its name and can be prefixed with `^` to indicate that the quirk should be disabled; quirk names are separated by a ',' character. Example: enable BOGUS_NID and BROKEN_MSI, disable DEALLOCATE_ZEROES: $ modprobe nvme quirks=7170:2210:bogus_nid,broken_msi,^deallocate_zeroes Tested-by: Daniel Wagner Reviewed-by: Christoph Hellwig Signed-off-by: Maurizio Lombardi Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit 7a4cd71fa4514cd85df39b3cf99da8142660cdcd Author: Eric Dumazet Date: Wed Feb 4 05:30:23 2026 +0000 net: add vlan_get_protocol_offset_inline() helper skb_protocol() is bloated, and forces slow stack canaries in many fast paths. Add vlan_get_protocol_offset_inline() which deals with the non-vlan common cases. __vlan_get_protocol_offset() is now out of line. It returns a vlan_type_depth struct to avoid stack canaries in callers. struct vlan_type_depth { __be16 type; u16 depth; }; $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 0/22 up/down: 0/-6320 (-6320) Function old new delta vlan_get_protocol_dgram 61 59 -2 __pfx_skb_protocol 16 - -16 __vlan_get_protocol_offset 307 273 -34 tap_get_user 1374 1207 -167 ip_md_tunnel_xmit 1625 1452 -173 tap_sendmsg 940 753 -187 netif_skb_features 1079 866 -213 netem_enqueue 3017 2800 -217 vlan_parse_protocol 271 50 -221 tso_start 567 344 -223 fq_dequeue 1908 1685 -223 skb_network_protocol 434 205 -229 ip6_tnl_xmit 2639 2409 -230 br_dev_queue_push_xmit 474 236 -238 skb_protocol 258 - -258 packet_parse_headers 621 357 -264 __ip6_tnl_rcv 1306 1039 -267 skb_csum_hwoffload_help 515 224 -291 ip_tunnel_xmit 2635 2339 -296 sch_frag_xmit_hook 1582 1233 -349 bpf_skb_ecn_set_ce 868 457 -411 IP6_ECN_decapsulate 1297 768 -529 ip_tunnel_rcv 2121 1489 -632 ipip6_rcv 2572 1922 -650 Total: Before=24892803, After=24886483, chg -0.03% Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260204053023.1622775-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 770e112634e73349abb5b021ff9735dc18a4f176 Author: David Yang Date: Wed Feb 4 13:28:35 2026 +0800 flow_offload: add const qualifiers to function arguments Some functions do not modify the pointed-to data, but lack const qualifiers. Add const qualifiers to the arguments of flow_rule_match_has_control_flags() and flow_cls_offload_flow_rule(). Signed-off-by: David Yang Link: https://patch.msgid.link/20260204052839.198602-1-mmyangfl@gmail.com Signed-off-by: Paolo Abeni commit 651f71248a01231c54c5dc3bac4cec989dba1a6d Merge: 0e6c95c9882913 ad1df4f2d591e1 Author: Paolo Abeni Date: Thu Feb 5 15:57:48 2026 +0100 Merge branch 'dpll-core-improvements-and-ice-e825-c-synce-support' Ivan Vecera says: ==================== dpll: Core improvements and ice E825-C SyncE support This series introduces Synchronous Ethernet (SyncE) support for the Intel E825-C Ethernet controller. Unlike previous generations where DPLL connections were implicitly assumed, the E825-C architecture relies on the platform firmware (ACPI) to describe the physical connections between the Ethernet controller and external DPLLs (such as the ZL3073x). To accommodate this, the series extends the DPLL subsystem to support firmware node (fwnode) associations, asynchronous discovery via notifiers, and dynamic pin management. Additionally, a significant refactor of the DPLL reference counting logic is included to ensure robustness and debuggability. DPLL Core Extensions: * Firmware Node Association: Pins can now be associated with a struct fwnode_handle after allocation via dpll_pin_fwnode_set(). This allows drivers to link pin objects with their corresponding DT/ACPI nodes. * Asynchronous Notifiers: A raw notifier chain is added to the DPLL core. This allows the Ethernet driver to subscribe to events and react when the platform DPLL driver registers the parent pins, resolving probe ordering dependencies. * Dynamic Indexing: Drivers can now request DPLL_PIN_IDX_UNSPEC to have the core automatically allocate a unique pin index. Reference Counting & Debugging: * Refactor: The reference counting logic in the core is consolidated. Internal list management helpers now automatically handle hold/put operations, removing fragile open-coded logic in the registration paths. * Reference Tracking: A new Kconfig option DPLL_REFCNT_TRACKER is added. This allows developers to instrument and debug reference leaks by recording stack traces for every get/put operation. Driver Updates: * zl3073x: Updated to associate pins with fwnode handles using the new setter and support the 'mux' pin type. * ice: Implements the E825-C specific hardware configuration for SyncE (CGU registers). It utilizes the new notifier and fwnode APIs to dynamically discover and attach to the platform DPLLs. Patch Summary: Patch 1: DPLL Core (fwnode association). Patch 2: Driver zl3073x (Set fwnode). Patch 3-4: DPLL Core (Notifiers and dynamic IDs). Patch 5: Driver zl3073x (Mux type). Patch 6: DPLL Core (Refcount refactor). Patch 7-8: Refcount tracking infrastructure and driver updates. Patch 9: Driver ice (E825-C SyncE logic). ==================== Link: https://patch.msgid.link/20260203174002.705176-1-ivecera@redhat.com Signed-off-by: Paolo Abeni commit ad1df4f2d591e167bc64b8a7ce6328a2735e3d58 Author: Arkadiusz Kubalewski Date: Tue Feb 3 18:40:02 2026 +0100 ice: dpll: Support E825-C SyncE and dynamic pin discovery Implement SyncE support for the E825-C Ethernet controller using the DPLL subsystem. Unlike E810, the E825-C architecture relies on platform firmware (ACPI) to describe connections between the NIC's recovered clock outputs and external DPLL inputs. Implement the following mechanisms to support this architecture: 1. Discovery Mechanism: The driver parses the 'dpll-pins' and 'dpll-pin names' firmware properties to identify the external DPLL pins (parents) corresponding to its RCLK outputs ("rclk0", "rclk1"). It uses fwnode_dpll_pin_find() to locate these parent pins in the DPLL core. 2. Asynchronous Registration: Since the platform DPLL driver (e.g. zl3073x) may probe independently of the network driver, utilize the DPLL notifier chain The driver listens for DPLL_PIN_CREATED events to detect when the parent MUX pins become available, then registers its own Recovered Clock (RCLK) pins as children of those parents. 3. Hardware Configuration: Implement the specific register access logic for E825-C CGU (Clock Generation Unit) registers (R10, R11). This includes configuring the bypass MUXes and clock dividers required to drive SyncE signals. 4. Split Initialization: Refactor `ice_dpll_init()` to separate the static initialization path of E810 from the dynamic, firmware-driven path required for E825-C. Reviewed-by: Aleksandr Loktionov Co-developed-by: Ivan Vecera Signed-off-by: Ivan Vecera Co-developed-by: Grzegorz Nitka Signed-off-by: Grzegorz Nitka Signed-off-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20260203174002.705176-10-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 085ca5d2017116ce3102eafa760ee8eb91fb1eeb Author: Ivan Vecera Date: Tue Feb 3 18:40:01 2026 +0100 drivers: Add support for DPLL reference count tracking Update existing DPLL drivers to utilize the DPLL reference count tracking infrastructure. Add dpll_tracker fields to the drivers' internal device and pin structures. Pass pointers to these trackers when calling dpll_device_get/put() and dpll_pin_get/put(). This allows developers to inspect the specific references held by this driver via debugfs when CONFIG_DPLL_REFCNT_TRACKER is enabled, aiding in the debugging of resource leaks. Reviewed-by: Aleksandr Loktionov Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20260203174002.705176-9-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 3c0da1030c58b0f1ee4d8ef4722466f8ce734a53 Author: Ivan Vecera Date: Tue Feb 3 18:40:00 2026 +0100 dpll: Add reference count tracking support Add support for the REF_TRACKER infrastructure to the DPLL subsystem. When enabled, this allows developers to track and debug reference counting leaks or imbalances for dpll_device and dpll_pin objects. It records stack traces for every get/put operation and exposes this information via debugfs at: /sys/kernel/debug/ref_tracker/dpll_device_* /sys/kernel/debug/ref_tracker/dpll_pin_* The following API changes are made to support this: 1. dpll_device_get() / dpll_device_put() now accept a 'dpll_tracker *' (which is a typedef to 'struct ref_tracker *' when enabled, or an empty struct otherwise). 2. dpll_pin_get() / dpll_pin_put() and fwnode_dpll_pin_find() similarly accept the tracker argument. 3. Internal registration structures now hold a tracker to associate the reference held by the registration with the specific owner. All existing in-tree drivers (ice, mlx5, ptp_ocp, zl3073x) are updated to pass NULL for the new tracker argument, maintaining current behavior while enabling future debugging capabilities. Reviewed-by: Aleksandr Loktionov Co-developed-by: Petr Oros Signed-off-by: Petr Oros Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20260203174002.705176-8-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 729f5e0153bda8c0423fb7c5795865b6b77ca050 Author: Ivan Vecera Date: Tue Feb 3 18:39:59 2026 +0100 dpll: Enhance and consolidate reference counting logic Refactor the reference counting mechanism for DPLL devices and pins to improve consistency and prevent potential lifetime issues. Introduce internal helpers __dpll_{device,pin}_{hold,put}() to centralize reference management. Update the internal XArray reference helpers (dpll_xa_ref_*) to automatically grab a reference to the target object when it is added to a list, and release it when removed. This ensures that objects linked internally (e.g., pins referenced by parent pins) are properly kept alive without relying on the caller to manually manage the count. Consequently, remove the now redundant manual `refcount_inc/dec` calls in dpll_pin_on_pin_{,un}register()`, as ownership is now correctly handled by the dpll_xa_ref_* functions. Additionally, ensure that dpll_device_{,un}register()` takes/releases a reference to the device, ensuring the device object remains valid for the duration of its registration. Reviewed-by: Aleksandr Loktionov Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20260203174002.705176-7-ivecera@redhat.com Signed-off-by: Paolo Abeni commit fdad05ed4ec23b8de23c0037cea9aedbdc9cd24b Author: Ivan Vecera Date: Tue Feb 3 18:39:58 2026 +0100 dpll: zl3073x: Add support for mux pin type Add parsing for the "mux" string in the 'connection-type' pin property mapping it to DPLL_PIN_TYPE_MUX. Recognizing this type in the driver allows these pins to be taken as parent pins for pin-on-pin pins coming from different modules (e.g. network drivers). Reviewed-by: Aleksandr Loktionov Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20260203174002.705176-6-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 711696b3e168cea4165e7b7f051f3f442a347430 Author: Ivan Vecera Date: Tue Feb 3 18:39:57 2026 +0100 dpll: Support dynamic pin index allocation Allow drivers to register DPLL pins without manually specifying a pin index. Currently, drivers must provide a unique pin index when calling dpll_pin_get(). This works well for hardware-mapped pins but creates friction for drivers handling virtual pins or those without a strict hardware indexing scheme. Introduce DPLL_PIN_IDX_UNSPEC (U32_MAX). When a driver passes this value as the pin index: 1. The core allocates a unique index using an IDA 2. The allocated index is mapped to a range starting above `INT_MAX` This separation ensures that dynamically allocated indices never collide with standard driver-provided hardware indices, which are assumed to be within the `0` to `INT_MAX` range. The index is automatically freed when the pin is released in dpll_pin_put(). Reviewed-by: Aleksandr Loktionov Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20260203174002.705176-5-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 2be467588d6bc6ec5988fc254e62a44b865912a0 Author: Petr Oros Date: Tue Feb 3 18:39:56 2026 +0100 dpll: Add notifier chain for dpll events Currently, the DPLL subsystem reports events (creation, deletion, changes) to userspace via Netlink. However, there is no mechanism for other kernel components to be notified of these events directly. Add a raw notifier chain to the DPLL core protected by dpll_lock. This allows other kernel subsystems or drivers to register callbacks and receive notifications when DPLL devices or pins are created, deleted, or modified. Define the following: - Registration helpers: {,un}register_dpll_notifier() - Event types: DPLL_DEVICE_CREATED, DPLL_PIN_CREATED, etc. - Context structures: dpll_{device,pin}_notifier_info to pass relevant data to the listeners. The notification chain is invoked alongside the existing Netlink event generation to ensure in-kernel listeners are kept in sync with the subsystem state. Reviewed-by: Vadim Fedorenko Co-developed-by: Ivan Vecera Signed-off-by: Ivan Vecera Signed-off-by: Petr Oros Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20260203174002.705176-4-ivecera@redhat.com Signed-off-by: Paolo Abeni commit e6dc7727b6083a6bb76a5ba874e040034cd33b47 Author: Ivan Vecera Date: Tue Feb 3 18:39:55 2026 +0100 dpll: zl3073x: Associate pin with fwnode handle Associate the registered DPLL pin with its firmware node by calling dpll_pin_fwnode_set(). This links the created pin object to its corresponding DT/ACPI node in the DPLL core. Consequently, this enables consumer drivers (such as network drivers) to locate and request this specific pin using the fwnode_dpll_pin_find() helper. Reviewed-by: Aleksandr Loktionov Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20260203174002.705176-3-ivecera@redhat.com Signed-off-by: Paolo Abeni commit d0f4771e2befbe8de3a16a564c6bbd1d5502cec3 Author: Ivan Vecera Date: Tue Feb 3 18:39:54 2026 +0100 dpll: Allow associating dpll pin with a firmware node Extend the DPLL core to support associating a DPLL pin with a firmware node. This association is required to allow other subsystems (such as network drivers) to locate and request specific DPLL pins defined in the Device Tree or ACPI. * Add a .fwnode field to the struct dpll_pin * Introduce dpll_pin_fwnode_set() helper to allow the provider driver to associate a pin with a fwnode after the pin has been allocated * Introduce fwnode_dpll_pin_find() helper to allow consumers to search for a registered DPLL pin using its associated fwnode handle * Ensure the fwnode reference is properly released in dpll_pin_put() Reviewed-by: Aleksandr Loktionov Reviewed-by: Vadim Fedorenko Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20260203174002.705176-2-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 0e6c95c9882913ba88417f035f5a9f343afd5db0 Author: Moshe Shemesh Date: Tue Feb 3 12:24:02 2026 +0200 net/mlx5: Support devlink port state for host PF Add support for devlink port function state get/set operations for the host physical function (PF). Until now, mlx5 only allowed state get/set for subfunctions (SFs) ports. This change enables an administrator with eSwitch manager privileges to query or modify the host PF’s function state, allowing it to be explicitly inactivated or activated. While inactivated, the administrator can modify the functions attributes, such as enable/disable roce. $ devlink port show pci/0000:03:00.0/196608 pci/0000:03:00.0/196608: type eth netdev eth1 flavour pcipf controller 1 pfnum 0 external true splittable false function: hw_addr a0:88:c2:45:17:7c state active opstate attached roce enable max_io_eqs 120 $ devlink port function set pci/0000:03:00.0/196608 state inactive $ devlink port show pci/0000:03:00.0/196608 pci/0000:03:00.0/196608: type eth netdev eth1 flavour pcipf controller 1 pfnum 0 external true splittable false function: hw_addr a0:88:c2:45:17:7c state inactive opstate detached roce enable max_io_eqs 120 Signed-off-by: Moshe Shemesh Reviewed-by: Mark Bloch Reviewed-by: Parav Pandit Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260203102402.1712218-1-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit dfa5dc3ad3b15a519101f134ed76c068526004e4 Merge: 2b0181a52fcbeb 57d5287b7eb334 Author: Rafael J. Wysocki Date: Thu Feb 5 15:17:54 2026 +0100 Merge branch 'acpi-apei' Merge ACPI APEI support updates for 6.20-rc1/7.0-rc1: - Make read-only array non_mmio_desc[] static const (Colin Ian King) - Prevent the APEI GHES support code on ARM from accessing memory out of bounds or going past the ARM processor CPER record buffer (Mauro Carvalho Chehab) - Prevent cper_print_fw_err() from dumping the entire memory on systems with defective firmware (Mauro Carvalho Chehab) - Improve ghes_notify_nmi() status check to avoid unnecessary overhead in the NMI handler by carrying out all of the requisite preparations and the NMI registration time (Tony Luck) - Refactor the GHES driver by extracting common functionality into reusable helper functions to reduce code duplication and improve the ghes_notify_sea() status check in analogy with the previous ghes_notify_nmi() status check improvement (Shuai Xue) - Make ELOG and GHES log and trace consistently and support the CPER CXL protocol analogously (Fabio De Francesco) - Disable KASAN instrumentation in the APEI GHES driver when compile testing with clang < 18 (Nathan Chancellor) - Let ghes_edac be the preferred driver to load on __ZX__ and _BYO_ systems by extending the platform detection list in the APEI GHES driver (Tony W Wang-oc) * acpi-apei: ACPI: APEI: GHES: Add ghes_edac support for __ZX__ and _BYO_ systems ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18 ACPI: extlog: Trace CPER CXL Protocol Error Section ACPI: APEI: GHES: Add helper to copy CPER CXL protocol error info to work struct ACPI: APEI: GHES: Add helper for CPER CXL protocol errors checks ACPI: extlog: Trace CPER PCI Express Error Section ACPI: extlog: Trace CPER Non-standard Section Body ACPI: APEI: GHES: Improve ghes_notify_sea() status check ACPI: APEI: GHES: Extract helper functions for error status handling ACPI: APEI: GHES: Improve ghes_notify_nmi() status check EFI/CPER: don't dump the entire memory region APEI/GHES: ensure that won't go past CPER allocated record EFI/CPER: don't go past the ARM processor CPER record buffer APEI/GHES: ARM processor Error: don't go past allocated memory ACPI: APEI: EINJ: make read-only array non_mmio_desc static const commit 2b0181a52fcbeba25c6b2d701236231b19499861 Merge: 1a91d4e27d67d8 cac173bea57d62 Author: Rafael J. Wysocki Date: Thu Feb 5 15:09:30 2026 +0100 Merge branch 'acpi-processor' Merge ACPI processor driver changes for 6.20-rc1/7.0-rc1: - Rework the ACPI idle driver initialization to register it directly from the common initialization code instead of doing that from a CPU hotplug "online" callback and clean it up (Huisong Li, Rafael Wysocki) - Fix a possible NULL pointer dereference in acpi_processor_errata_piix4() (Tuo Li) * acpi-processor: ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe() ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_dev() to void ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_states() to void ACPI: processor: idle: Add debug log for states with invalid entry methods ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() ACPI: processor: Do not expose global variable acpi_idle_driver ACPI: processor: idle: Rearrange declarations in header file ACPI: processor: idle: Redefine two functions as void ACPI: processor: Update cpuidle driver check in __acpi_processor_start() ACPI: processor: Remove unused empty stubs of some functions ACPI: processor: idle: Optimize ACPI idle driver registration commit 1a91d4e27d67d87673a0f2c1f90a98ae67b89885 Merge: 7c8b81f594b8a1 bb1256e0ddc7e9 b0c8ac52da5a1c Author: Rafael J. Wysocki Date: Thu Feb 5 15:03:47 2026 +0100 Merge branches 'acpi-battery' and 'acpi-misc' Merge ACPI battery driver changes and a generic ACPI watchdog device driver change for 6.20-rc1/7.0-rc1: - Convert the generic ACPI battery driver to a proper platform driver using struct platform_driver for device binding (Rafael Wysocki) - Fix incorrect charging status when current is zero in the generic ACPI battery driver (Ata İlhan Köktürk) - Use LIST_HEAD() for initializing a stack-allocated list in the generic ACPI watchdog device driver (Can Peng) * acpi-battery: ACPI: battery: fix incorrect charging status when current is zero ACPI: battery: Convert the driver to a platform one ACPI: battery: Reduce code duplication related to cleanup ACPI: battery: Adjust event notification routine * acpi-misc: ACPI: acpi_watchdog: use LIST_HEAD for stack-allocated list commit 72f4d6fca699a1e35b39c5e5dacac2926d254135 Author: Randy Dunlap Date: Wed Feb 4 23:29:03 2026 -0800 blk-mq: ABI/sysfs-block: fix docs build warnings Clean up the async_depth documentation: - insert blank lines before and after lists where needed - convert verb tense in a few places - make lines fit within 80 characters Documentation/ABI/stable/sysfs-block:612: ERROR: Unexpected indentation. [docutils] Documentation/ABI/stable/sysfs-block:612: ERROR: Unexpected indentation. [docutils] Documentation/ABI/stable/sysfs-block:612: ERROR: Unexpected indentation. [docutils] Fixes: 2c04718edcd5 ("blk-mq: add documentation for new queue attribute async_dpeth") Signed-off-by: Randy Dunlap Signed-off-by: Jens Axboe commit 7c8b81f594b8a19e14a937be1e04ac199defa9c2 Merge: 4322612283fc73 5315c0ddbefe41 Author: Rafael J. Wysocki Date: Thu Feb 5 14:47:50 2026 +0100 Merge branch 'acpi-driver' Merge updates of drivers handling devices defined in the ACPI specification and other generic devices with ACPI interfaces for 6.20-rc1/7.0-rc1: - Add a piece of documentation explaining why binding drivers directly to ACPI device objects is not a good idea in general and why it is desirable to convert drivers doing so into proper platform drivers that use struct platform_driver for device binding (Rafael Wysocki) - Convert multiple "core ACPI" drivers, including the NFIT ACPI device driver, the generic ACPI button drivers, the generic ACPI thermal zone driver, the ACPI hardware event device (HED) driver, the ACPI EC driver, the ACPI SMBUS HC driver, the ACPI Smart Battery Subsystem (SBS) driver, and the ACPI backlight (video) driver to proper platform drivers that use struct platform_driver for device binding (Rafael Wysocki) - Use acpi_get_local_u64_address() in the ACPI backlight (video) driver to evaluate _ADR instead of evaluating that object directly (Andy Shevchenko) * acpi-driver: (25 commits) ACPI: video: simplify code with acpi_get_local_u64_address() ACPI: scan: Clean up after recent changes ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM ACPI: Documentation: driver-api: Disapprove of using ACPI drivers ACPI: video: Convert the driver to a platform one ACPI: video: Adjust event notification routine ACPI: scan: Register platform devices for backlight device objects ACPI: SBS: Convert the driver to a platform one ACPI: SMBUS HC: Convert the driver to a platform one ACPI: EC: Convert the driver to a platform one ACPI: EC: Register a platform device for ECDT EC ACPI: HED: Convert the driver to a platform one ACPI: thermal: Rework system suspend and resume handling ACPI: thermal: Convert the driver to a platform one ACPI: thermal: Adjust event notification routine ACPI: scan: Register platform devices for thermal zones ACPI: scan: Do not mark button ACPI devices as wakeup-capable ACPI: scan: Do not bind ACPI drivers to fixed event buttons ACPI: tiny-power-button: Convert the driver to a platform one ... commit 8c5d862fcb2116ebf5ce762a82db827a38a7d8ee Author: Masami Hiramatsu (Google) Date: Thu Feb 5 09:46:35 2026 +0900 bootconfig: Check the parsed output of the good examples Check whether the parsed output of the good example configs are the same as expected. Link: https://lore.kernel.org/all/177025239529.14982.12913754615993262263.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) Tested-by: Steven Rostedt (Google) commit 1cadf2819bc91ab5cb060ec3ce473bae30c9e52d Author: Masami Hiramatsu (Google) Date: Thu Feb 5 09:46:25 2026 +0900 bootconfig: Terminate value search if it hits a newline Terminate the value search for a key if it hits a newline and make the value empty. When we pass a bootconfig with an empty value terminated by the newline, like below:: foo = bar = value Current bootconfig interprets it as a single entry:: foo = "bar = value"; The Documentation/admin-guide/bootconfig.rst defines the value itself is terminated by newline: The value has to be terminated by semi-colon (``;``) or newline (``\n``). but it does not define when the value search is terminated. This changes the behavior to be more line-oriented, so that it is clearer in how it works. - The value search of key-value pair will be terminated by a comment or newline. - The value search of an array will continue beyond comments and newlines. Thus, with this update, the above example is interpreted as:: foo = ""; bar = "value"; And the below example will cause a syntax error because "bar" is expected as a key but it has ','. foo = bar, buz According to this change, one wrong example config is updated. Link: https://lore.kernel.org/all/177025238503.14982.17059549076175612447.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Julius Werner commit 666c654a5ae4090a3402ac14f399283934ea8104 Author: Karthik Poosa Date: Fri Jan 23 23:02:38 2026 +0530 drm/xe/pm: Disable D3Cold for BMG only on specific platforms Restrict D3Cold disablement for BMG to unsupported NUC platforms, instead of disabling it on all platforms. Signed-off-by: Karthik Poosa Fixes: 3e331a6715ee ("drm/xe/pm: Temporarily disable D3Cold on BMG") Link: https://patch.msgid.link/20260123173238.1642383-1-karthik.poosa@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi (cherry picked from commit 39125eaf8863ab09d70c4b493f58639b08d5a897) Signed-off-by: Rodrigo Vivi commit 51cedb93da116e36490d66d9d034a3e071a604ce Author: Shuicheng Lin Date: Thu Jan 29 23:38:38 2026 +0000 drm/xe: Fix kerneldoc for xe_tlb_inval_job_alloc_dep Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_tlb_inval_job.c:210 expecting prototype for xe_tlb_inval_alloc_dep(). Prototype was for xe_tlb_inval_job_alloc_dep() instead" Fixes: 15366239e2130 ("drm/xe: Decouple TLB invalidations from GT") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129233834.419977-8-shuicheng.lin@intel.com (cherry picked from commit 9f9c117ac566cb567dd56cc5b7564c45653f7a2a) Signed-off-by: Rodrigo Vivi commit 904b2e5063af17087aa30edc6b11933d2d8cf01f Author: Shuicheng Lin Date: Thu Jan 29 23:38:37 2026 +0000 drm/xe: Fix kerneldoc for xe_gt_tlb_inval_init_early Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_tlb_inval.c:136 expecting prototype for xe_gt_tlb_inval_init(). Prototype was for xe_gt_tlb_inval_init_early() instead" v2: add () for the function. (Michal) Fixes: db16f9d90c1d9 ("drm/xe: Split TLB invalidation code in frontend and backend") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129233834.419977-7-shuicheng.lin@intel.com (cherry picked from commit 0651dbb9d6a72e99569576fbec4681fd8160d161) Signed-off-by: Rodrigo Vivi commit 5d5ef6954979509fdf2fcdc74837be67b8192afb Author: Shuicheng Lin Date: Thu Jan 29 23:38:36 2026 +0000 drm/xe: Fix kerneldoc for xe_migrate_exec_queue Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_migrate.c:1262 expecting prototype for xe_get_migrate_exec_queue(). Prototype was for xe_migrate_exec_queue() instead" Fixes: 916ee4704a865 ("drm/xe/vf: Register CCS read/write contexts with Guc") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129233834.419977-6-shuicheng.lin@intel.com (cherry picked from commit 9fd8da717934f05125b9ba6782622c459a368dc0) Signed-off-by: Rodrigo Vivi commit 8b52d9ba085f0e1fee30aa4d1e4948494047b5fe Author: Shuicheng Lin Date: Fri Jan 30 04:39:08 2026 +0000 drm/xe/query: Fix topology query pointer advance The topology query helper advanced the user pointer by the size of the pointer, not the size of the structure. This can misalign the output blob and corrupt the following mask. Fix the increment to use sizeof(*topo). There is no issue currently, as sizeof(*topo) happens to be equal to sizeof(topo) on 64-bit systems (both evaluate to 8 bytes). Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Shuicheng Lin Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260130043907.465128-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper (cherry picked from commit c2a6859138e7f73ad904be17dd7d1da6cc7f06b3) Signed-off-by: Rodrigo Vivi commit 628299518894a41c95ffbe465f80b8ce36830007 Author: Chaitanya Kumar Borah Date: Fri Jan 30 19:22:10 2026 +0530 drm/xe/guc: Fix kernel-doc warning in GuC scheduler ABI header The GuC scheduler ABI header contains a file-level comment that is not intended to document a kernel-doc symbol. Using kernel-doc comment syntax (/** */) triggers kernel-doc warnings. With "-Werror", this causes the build to fail. Convert the comment to a regular block comment. HDRTEST drivers/gpu/drm/xe/abi/guc_scheduler_abi.h Warning: drivers/gpu/drm/xe/abi/guc_scheduler_abi.h:11 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst * Generic defines required for registration with and submissions to the GuC 1 warnings as errors make[6]: *** [drivers/gpu/drm/xe/Makefile:377: drivers/gpu/drm/xe/abi/guc_scheduler_abi.hdrtest] Error 3 make[5]: *** [scripts/Makefile.build:544: drivers/gpu/drm/xe] Error 2 make[4]: *** [scripts/Makefile.build:544: drivers/gpu/drm] Error 2 make[3]: *** [scripts/Makefile.build:544: drivers/gpu] Error 2 make[2]: *** [scripts/Makefile.build:544: drivers] Error 2 make[1]: *** [/home/kbuild2/kernel/Makefile:2088: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 v2: - Add Fixes tag (Daniele) Fixes: b0c5cf4f5917 ("drm/gt/guc: extract scheduler-related defines from guc_fwif.h") Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Shuicheng Lin Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Daniele Ceraolo Spurio Link: https://patch.msgid.link/20260130135210.2659200-1-chaitanya.kumar.borah@intel.com (cherry picked from commit f89dbe14a0c8854b7aaf960dd842c10698b3ff19) Signed-off-by: Rodrigo Vivi commit 6e035abf98b05fd7f11d111f20f0377e0a0d68c3 Author: Daniele Ceraolo Spurio Date: Thu Jan 29 10:25:48 2026 -0800 drm/xe/guc: Fix CFI violation in debugfs access. xe_guc_print_info is void-returning, but the function pointer it is assigned to expects an int-returning function, leading to the following CFI error: [ 206.873690] CFI failure at guc_debugfs_show+0xa1/0xf0 [xe] (target: xe_guc_print_info+0x0/0x370 [xe]; expected type: 0xbe3bc66a) Fix this by updating xe_guc_print_info to return an integer. Fixes: e15826bb3c2c ("drm/xe/guc: Refactor GuC debugfs initialization") Signed-off-by: Daniele Ceraolo Spurio Cc: Michal Wajdeczko Cc: George D Sworo Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129182547.32899-2-daniele.ceraolospurio@intel.com (cherry picked from commit dd8ea2f2ab71b98887fdc426b0651dbb1d1ea760) Signed-off-by: Rodrigo Vivi commit 43d324eeb08c3dd9fff7eb9a2c617afd3b96e65c Author: Krishna Chaitanya Chundru Date: Tue Jan 27 16:10:41 2026 +0100 PCI: dwc: Fix missing iATU setup when ECAM is enabled When ECAM is enabled, the driver skipped calling dw_pcie_iatu_setup() before configuring ECAM iATU entries. This left IO and MEM outbound windows unprogrammed, resulting in broken IO transactions. Additionally, dw_pcie_config_ecam_iatu() was only called during host initialization, so ECAM-related iATU entries were not restored after suspend/resume, leading to failures in configuration space access To resolve these issues, move the ECAM iATU configuration to dw_pcie_iatu_setup(), and invoke dw_pcie_iatu_setup() when ECAM is enabled. Furthermore, add error checks in dw_pcie_prog_outbound_atu() and dw_pcie_prog_inbound_atu() such that an error is returned if the caller is trying to program an iATU that is outside the number of iATUs supported by the controller. Fixes: f6fd357f7afb ("PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature'") Reported-by: Maciej W. Rozycki Closes: https://lore.kernel.org/all/alpine.DEB.2.21.2511280256260.36486@angie.orcam.me.uk/ Signed-off-by: Krishna Chaitanya Chundru Co-developed-by: Niklas Cassel Signed-off-by: Niklas Cassel [mani: used imperative tone] Signed-off-by: Manivannan Sadhasivam Tested-by: Maciej W. Rozycki Reviewed-by: Damien Le Moal Reviewed-by: Hans Zhang Reviewed-by: Frank Li Cc: stable+noautosel@kernel.org # depends on Clean up iATU index usage in dw_pcie_iatu_setup() Link: https://patch.msgid.link/20260127151038.1484881-8-cassel@kernel.org commit b5dab9b38da0a05949458276dde9227c38aa1b39 Author: Niklas Cassel Date: Tue Jan 27 16:10:40 2026 +0100 PCI: dwc: Clean up iATU index usage in dw_pcie_iatu_setup() The current iATU index usage in dw_pcie_iatu_setup() is a mess. For outbound address translation the index is incremented before usage. For inbound address translation the index is incremented after usage. Incrementing the index after usage make much more sense, and make the index usage consistent for both outbound and inbound address translation. Most likely, the overly complicated logic for the outbound address translation is because the iATU at index 0 is reserved for CFG IOs (dw_pcie_other_conf_map_bus()), however, we should be able to use the exact same logic for the indexing of the outbound and inbound iATUs. (Only the starting index should be different.) Create two new variables ob_iatu_index and ib_iatu_index, which makes it more clear from the name itself that it is a zeroes based index, and only increment the index if the iATU configuration call succeeded. Since we always check if there is an index available immediately before programming the iATU, we can remove the useless "ranges exceed outbound iATU size" warnings, as the code is already unreachable. For the same reason, we can also remove the useless breaks outside of the while loops. No functional changes intended. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Tested-by: Maciej W. Rozycki Reviewed-by: Damien Le Moal Reviewed-by: Hans Zhang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260127151038.1484881-7-cassel@kernel.org commit 58fbf08935d9c4396417e5887df89a4e681fa7e3 Author: Niklas Cassel Date: Tue Jan 27 16:10:39 2026 +0100 PCI: dwc: Fix msg_atu_index assignment When dw_pcie_iatu_setup() configures outbound address translation for both type PCIE_ATU_TYPE_MEM and PCIE_ATU_TYPE_IO, the iATU index to use is incremented before calling dw_pcie_prog_outbound_atu(). However for msg_atu_index, the index is not incremented before use, causing the iATU index to be the same as the last configured iATU index, which means that it will incorrectly use the same iATU index that is already in use, breaking outbound address translation. In total there are three problems with this code: -It assigns msg_atu_index the same index that was used for the last outbound address translation window, rather than incrementing the index before assignment. -The index should only be incremented (and msg_atu_index assigned) if the use_atu_msg feature is actually requested/in use (pp->use_atu_msg is set). -If the use_atu_msg feature is requested/in use, and there are no outbound iATUs available, the code should return an error, as otherwise when this this feature is used, it will use an iATU index that is out of bounds. Fixes: e1a4ec1a9520 ("PCI: dwc: Add generic MSG TLP support for sending PME_Turn_Off when system suspend") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Tested-by: Maciej W. Rozycki Reviewed-by: Damien Le Moal Reviewed-by: Hans Zhang Reviewed-by: Frank Li Reviewed-by: Shawn Lin Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260127151038.1484881-6-cassel@kernel.org commit 14ab3da122bd18920ad57428f6cf4fade8385142 Author: YunJe Shin Date: Wed Feb 4 18:24:57 2026 +0900 RDMA/siw: Fix potential NULL pointer dereference in header processing If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check more_ddp_segs when rx_fpdu is present. KASAN splat: [ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50 Fixes: 8b6a361b8c48 ("rdma/siw: receive path") Signed-off-by: YunJe Shin Link: https://patch.msgid.link/20260204092546.489842-1-ioerts@kookmin.ac.kr Acked-by: Bernard Metzler Signed-off-by: Leon Romanovsky commit 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2 Author: YunJe Shin Date: Tue Feb 3 19:06:21 2026 +0900 RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 Fixes: 2be8e3ee8efd ("IB/umad: Add P_Key index support") Signed-off-by: YunJe Shin Link: https://patch.msgid.link/20260203100628.1215408-1-ioerts@kookmin.ac.kr Signed-off-by: Leon Romanovsky commit 4322612283fc735432d544631f90a498593f4560 Merge: ed0afd1e04e3bf 7cf28b3797a81b Author: Rafael J. Wysocki Date: Thu Feb 5 13:16:10 2026 +0100 Merge branch 'acpi-bus' Merge ACPI support updates related to _OSC evaluation, the handling of "system resource" device objects, and ACPI-based device enumeration for 6.20-rc1/7.0-rc1: - Fix handling of _OSC errors in acpi_run_osc() to avoid failures on systems where _OSC error bits are set even though the _OSC return buffer contains acknowledged feature bits (Rafael Wysocki) - Clean up and rearrange \_SB._OSC handling for general platform features and USB4 features to avoid code duplication and unnecessary memory management overhead (Rafael Wysocki) - Make the ACPI core device enumeration code handle PNP0C01 and PNP0C02 ("system resource") device objects directly instead of letting the legacy PNP system driver handle them to avoid device enumeration issues on systems where PNP0C02 is present in the _CID list under ACPI device objects with a _HID matching a proper device driver in Linux (Rafael Wysocki) - Drop workarounds for the known device enumeration issues related to _CID lists containing PNP0C02 (Rafael Wysocki) - Drop outdated comment regarding removed function in the ACPI-based device enumeration code (Julia Lawall) - Make PRP0001 device matching work as expected for ACPI device objects using it as a _HID for board development and similar purposes (Kartik Rajput) - Use async schedule function in acpi_scan_clear_dep_fn() to avoid races with user space initialization on some systems (Yicong Yang) * acpi-bus: ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() ACPI: bus: Align acpi_device_get_match_data() with driver match order ACPI: scan: Drop outdated comment regarding removed function ACPI: scan: Use resource_type() for resource type checking ACPI: bus: Fix typo under sizeof() in acpi_run_osc() ACPI: bus: Adjust acpi_osc_handshake() parameter list ACPI: bus: Rework the handling of \_SB._OSC USB4 features ACPI: bus: Adjust feature mask creation for \_SB._OSC ACPI: bus: Rework the handling of \_SB._OSC platform features ACPI: bus: Rename label and use ACPI_FREE() in acpi_run_osc() ACPI: bus: Split _OSC error processing out of acpi_run_osc() ACPI: bus: Split _OSC evaluation out of acpi_run_osc() ACPI: bus: Rework printing debug messages on _OSC errors ACPI: bus: Fix handling of _OSC errors in acpi_run_osc() ACPI: PNP: Drop acpi_nonpnp_device_ids[] platform/x86/intel/vbtn: Stop creating a platform device platform/x86/intel/hid: Stop creating a platform device ACPI: PNP: Drop PNP0C01 and PNP0C02 from acpi_pnp_device_ids[] commit 5ae76830c76cf38708399245606e4e07a33fe51c Author: Jan Höppner Date: Wed Feb 4 16:30:40 2026 +0100 s390/tape: Consolidate tape config options and modules The tape device driver only supports 3490E devices on Virtual Tape Server (VTS). There is no point in keeping separated options and modules for different device types and general hardware support. Consolidate the tape config option into a single option, which enables the complete tape support with one singular module called 'tape_s390'. The corresponding module entry points are adapted and consolidate in tape_init() and tape_exit() respectively in tape_core.c The current module author and descriptions of the individual tape modules are outdated and haven't been changed for quite some time. Change it to a more generic description that is in line with the corresponding supported s390 architecture for the single tape module. Signed-off-by: Jan Höppner Signed-off-by: Heiko Carstens commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 Author: Salah Triki Date: Fri Jan 30 21:47:59 2026 +0100 s390/cio: Fix device lifecycle handling in css_alloc_subchannel() `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki Reviewed-by: Vineeth Vijayan Signed-off-by: Heiko Carstens commit ed0afd1e04e3bf9cc33172410f609ccd621051b2 Merge: 04cd14ff02d618 229ecbaac6b31f 785632d8264856 ed0a1ac2aa936a ba6ded26dffe51 Author: Rafael J. Wysocki Date: Thu Feb 5 12:49:43 2026 +0100 Merge branches 'acpi-pm', 'acpi-sysfs', 'acpi-pci' and 'acpi-resource' Merge ACPI power management updates, ACPI sysfs interface updates, an ACPI support update related to PCI, and an ACPI device resources management update for 6.20-rc1/7.0-rc1: - Rework ACPI PM notification setup for PCI root buses and modify the ACPI PM setup for devices to register wakeup source objects under physical (that is, PCI, platform, etc.) devices instead of doing that under their ACPI companions (Rafael Wysocki) - Adjust debug messages regarding postponed ACPI PM printed during system resume to be more accurate (Rafael Wysocki) - Remove dead code from lps0_device_attach() (Gergo Koteles) - Start to invoke Microsoft Function 9 (Turn On Display) of the Low- Power S0 Idle (LPS0) _DSM in the suspend-to-idle resume flow on systems with ACPI LPS0 support to address a functional issue on Lenovo Yoga Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to resume after suspend (Jakob Riemenschneider) - Add sysfs attribute cid for exposing _CID lists under ACPI device objects (Rafael Wysocki) - Replace sprintf() with sysfs_emit() in all of the core ACPI sysfs interface code (Sumeet Pawnikar) - Use acpi_get_local_u64_address() in the code implementing ACPI support for PCI to evaluate _ADR instead of evaluating that object directly (Andy Shevchenko) - Add JWIPC JVC9100 to irq1_level_low_skip_override[] to unbreak serial IRQs on that system (Ai Chao) * acpi-pm: ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) ACPI: PM: Adjust messages regarding postponed ACPI PM ACPI: x86: s2idle: Remove dead code in lps0_device_attach() ACPI: PM: Register wakeup sources under physical devices ACPI: PCI: PM: Rework root bus notification setup * acpi-sysfs: ACPI: sysfs: Replace sprintf() with sysfs_emit() ACPI: sysfs: Add device cid attribute for exposing _CID lists * acpi-pci: ACPI: PCI: simplify code with acpi_get_local_u64_address() * acpi-resource: ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] commit 04cd14ff02d618e42be21f4b7ab3822c10ce97df Merge: 0e8ac1d3be35e5 05bff3419adaa2 Author: Rafael J. Wysocki Date: Thu Feb 5 12:42:18 2026 +0100 Merge branch 'acpi-irq' Merge ARM-related irq subsystem changes based on the recent ACPICA updates for 6.20-rc1/7.0-rc1: - Add support for GICv5 ACPI probing on ARM which is based on the GICv5 MADT structures and ARM IORT IWB node definitions recently added to ACPICA (Lorenzo Pieralisi) * acpi-irq: irqchip/gic-v5: Add ACPI IWB probing irqchip/gic-v5: Add ACPI ITS probing irqchip/gic-v5: Add ACPI IRS probing irqchip/gic-v5: Split IRS probing into OF and generic portions PCI/MSI: Make the pci_msi_map_rid_ctlr_node() interface firmware agnostic irqdomain: Add parent field to struct irqchip_fwid commit 0e8ac1d3be35e51e38c263f3b46f91fb79c51e22 Merge: 83e2908c1d425a e8f614dabd2238 Author: Rafael J. Wysocki Date: Thu Feb 5 12:40:25 2026 +0100 Merge branch 'acpica' Merge ACPICA changes for 6.20-rc1/7.0-rc1: - Update the ACPICA code in the kernel to upstream version 20251212 which includes the following changes: * Add support for new ACPI table DTPR (Michal Camacho Romero) * Release objects with acpi_ut_delete_object_desc() (Zilin Guan) * Add UUIDs for Microsoft fan extensions and UUIDs associated with TPM 2.0 devices (Armin Wolf) * Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov) * Add KEYP ACPI table definition (Dave Jiang) * Add support for the Microsoft display mux _OSI string (Armin Wolf) * Add definitions for the IOVT ACPI table (Xianglai Li) * Abort AML bytecode execution on AML_FATAL_OP (Armin Wolf) * Include all fields in subtable type1 for PPTT (Ben Horgan) * Add GICv5 MADT structures and Arm IORT IWB node definitions (Jose Marinho) * Update Parameter Block structure for RAS2 and add a new flag in Memory Affinity Structure for SRAT (Pawel Chmielewski) * Add _VDM (Voltage Domain) object (Pawel Chmielewski) * acpica: (26 commits) ACPICA: Refactor for TPR Base/Limit registers bitmasks ACPICA: Replace TPRn Base and Limit registers ACPICA: Logfile: Changes for version 20251212 ACPICA: Align comments in TPRn-related structures ACPICA: Cleanup comments and DTPR Table handle functions ACPICA: Verify DTPR and TPR Instance buffer pointers ACPICA: Fix Segmentation Fault error related to DTPR ACPICA: Create auxiliary ACPI_TPR_AUX_SR structure for iASL compiler ACPICA: ACPI 6.6: Add _VDM (Voltage Domain) object ACPICA: actbl3.h: ACPI 6.6: SRAT: New flag in Memory Affinity Structure ACPICA: actbl2.h: ACPI 6.6: RAS2: Update Parameter Block structure ACPICA: Add Arm IORT IWB node definitions ACPICA: Add GICv5 MADT structures ACPICA: Fix asltests using the Fatal() opcode ACPICA: ACPI 6.4: PPTT: include all fields in subtable type1 ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP ACPICA: Define DTPR structure related info tables and data template ACPICA: Add DTPR table support for the ASL compiler ACPICA: iASL: Add definitions for the IOVT table ACPICA: Add support for the Microsoft display mux _OSI string ... commit 021718d2cc1a2df2f53b06968fa89280199371bd Merge: 0cbcc0fdce2b90 3ffecc14ec7ee8 Author: Paolo Abeni Date: Thu Feb 5 11:59:00 2026 +0100 Merge branch 'move-can-skb-headroom-content-to-skb-extensions' Oliver Hartkopp says: ==================== move CAN skb headroom content to skb extensions CAN bus related skbuffs (ETH_P_CAN/ETH_P_CANFD/ETH_P_CANXL) simply contain CAN frame structs for CAN CC/FD/XL of skb->len length at skb->data. Those CAN skbs do not have network/mac/transport headers nor other such references for encapsulated protocols like ethernet/IP protocols. To store data for CAN specific use-cases all CAN bus related skbuffs are created with a 16 byte private skb headroom (struct can_skb_priv). Using the skb headroom and accessing skb->head for this private data led to several problems in the past likely due to "The struct can_skb_priv business is highly unconventional for the networking stack." [1] This patch set aims to remove the unconventional skb headroom usage for CAN bus related skbuffs and use the common skb extensions instead. [1] https://lore.kernel.org/linux-can/20260104074222.29e660ac@kernel.org/ - v1: https://patch.msgid.link/20260125201601.5018-1-socketcan@hartkopp.net - v2: https://lore.kernel.org/linux-can/20260128-can-skb-ext-v2-0-fe64aa152c8a@pengutronix.de/ - v4: https://lore.kernel.org/netdev/20260128-can_skb_ext-v1-0-330f60fd5d7e@hartkopp.net/ - v5: https://patch.msgid.link/20260129-can_skb_ext-v5-0-21252fdc8900@hartkopp.net - v6: https://patch.msgid.link/20260130-can_skb_ext-v6-0-8fceafab7f26@hartkopp.net - v7: https://patch.msgid.link/20260131-can_skb_ext-v7-0-dd0f8f84a83d@hartkopp.net Signed-off-by: Oliver Hartkopp ==================== Link: https://patch.msgid.link/20260201-can_skb_ext-v8-0-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni commit 3ffecc14ec7ee8eb941e50c0076798a042924c62 Author: Oliver Hartkopp Date: Sun Feb 1 15:33:21 2026 +0100 can: gw: use can_gw_hops instead of sk_buff::csum_start As CAN skbs don't use IP checksums the skb->csum_start variable was used to store the can-gw CAN frame time-to-live counter together with skb->ip_summed set to CHECKSUM_UNNECESSARY. Remove the 'hack' using the skb->csum_start variable and move the content to can_skb_ext::can_gw_hops of the CAN skb extensions. The module parameter 'max_hops' has been reduced to a single byte to fit can_skb_ext::can_gw_hops as the maximum value to be stored is 6. Signed-off-by: Marc Kleine-Budde Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260201-can_skb_ext-v8-6-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni commit 9f10374bb024593a611e6845847f0444841a231b Author: Oliver Hartkopp Date: Sun Feb 1 15:33:20 2026 +0100 can: remove private CAN skb headroom infrastructure This patch removes struct can_skb_priv which was stored at skb->head and the can_skb_reserve() helper which was used to shift skb->head. Signed-off-by: Marc Kleine-Budde Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260201-can_skb_ext-v8-5-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni commit d2d9179751e6d876ed20483ce703ddd8e919101f Author: Oliver Hartkopp Date: Sun Feb 1 15:33:19 2026 +0100 can: move frame_len to CAN skb extensions The can_skb_priv::frame_len variable is used to cache a previous calculated CAN frame length to be passed to BQL queueing disciplines. Move the can_skb_priv::frame_len content to can_skb_ext::can_framelen. Signed-off-by: Marc Kleine-Budde Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260201-can_skb_ext-v8-4-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni commit 5a9229dbb48deb78ee1d20ccbd6453cfbf2a4a61 Author: Oliver Hartkopp Date: Sun Feb 1 15:33:18 2026 +0100 can: move ifindex to CAN skb extensions When routing CAN frames over different CAN interfaces the interface index skb->iif is overwritten with every single hop. To prevent sending a CAN frame back to its originating (first) incoming CAN interface another ifindex variable is needed, which was stored in can_skb_priv::ifindex. Move the can_skb_priv::ifindex content to can_skb_ext::can_iif. Signed-off-by: Marc Kleine-Budde Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260201-can_skb_ext-v8-3-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni commit 96ea3a1e2d317e7ecb6b65dc65c9dd917905a6a8 Author: Oliver Hartkopp Date: Sun Feb 1 15:33:17 2026 +0100 can: add CAN skb extension infrastructure To remove the private CAN bus skb headroom infrastructure 8 bytes need to be stored in the skb. The skb extensions are a common pattern and an easy and efficient way to hold private data travelling along with the skb. We only need the skb_ext_add() and skb_ext_find() functions to allocate and access CAN specific content as the skb helpers to copy/clone/free skbs automatically take care of skb extensions and their final removal. This patch introduces the complete CAN skb extensions infrastructure: - add struct can_skb_ext in new file include/net/can.h - add include/net/can.h in MAINTAINERS - add SKB_EXT_CAN to skbuff.c and skbuff.h - select SKB_EXTENSIONS in Kconfig when CONFIG_CAN is enabled - check for existing CAN skb extensions in can_rcv() in af_can.c - add CAN skb extensions allocation at every skb_alloc() location - duplicate the skb extensions if cloning outgoing skbs (framelen/gw_hops) - introduce can_skb_ext_add() and can_skb_ext_find() helpers The patch also corrects an indention issue in the original code from 2018: Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602010426.PnGrYAk3-lkp@intel.com/ Signed-off-by: Marc Kleine-Budde Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260201-can_skb_ext-v8-2-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni commit d4fb6514ff8ed6912a71294e6b66a5d59ee88007 Author: Oliver Hartkopp Date: Sun Feb 1 15:33:16 2026 +0100 can: use skb hash instead of private variable in headroom The can_skb_priv::skbcnt variable is used to identify CAN skbs in the RX path analogue to the skb->hash. As the skb hash is not filled in CAN skbs move the private skbcnt value to skb->hash and set skb->sw_hash accordingly. The skb->hash is a value used for RPS to identify skbs. Use it as intended. Signed-off-by: Marc Kleine-Budde Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260201-can_skb_ext-v8-1-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni commit 9eb9f7c304f7a17fd5e3bfa462a36e77dbf2a3e4 Author: Artem Shimko Date: Fri Jan 30 14:10:37 2026 +0300 i2c: designware-platdrv: fix cleanup on probe failure Simplify the error handling in dw_i2c_plat_probe() by consolidating cleanup operations directly in the error path instead of using a goto label. This eliminates the goto statement, makes the error handling more transparent, and reduces code indirection while maintaining identical cleanup behavior on probe failure. Signed-off-by: Artem Shimko Acked-by: Mika Westerberg Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260130111039.874548-3-a.shimko.dev@gmail.com commit 78821a753fc911a64b5bccc44cb13fd7203aea13 Author: Artem Shimko Date: Fri Jan 30 14:10:36 2026 +0300 i2c: designware-platdrv: simplify reset control The current implementation uses separate calls to acquire and deassert reset control, requiring manual error handling for the deassertion operation. This can be simplified using the dedicated devm function that combines both operations. Replace devm_reset_control_get_optional_exclusive() with devm_reset_control_get_optional_exclusive_deasserted(), which handles both reset acquisition and deassertion in a single call as well as reset_control_put() which is called automatically on driver detach. This eliminates the need for explicit deassertion and its associated error checking while maintaining the same functional behavior through automatic resource management. Signed-off-by: Artem Shimko Acked-by: Mika Westerberg Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260130111039.874548-2-a.shimko.dev@gmail.com commit 0cbcc0fdce2b90a83a8a77b04c6f8da3d22fc591 Author: Cong Wang Date: Fri Jan 30 13:20:21 2026 -0800 MAINTAINERS: Remove myself from TC maintainers Recently TC maintainer Jamal intentionally a broke reasonable use case: https://lore.kernel.org/netdev/aG10rqwjX6elG1Gx@pop-os.localdomain/ Although I tried my best to help by: 1) Strongly objecting this breakage from the very beginning 2) Reverting it and offering a much better solution 3) Offering Jamal for video chat on 8 Jul 2025 and 26 Nov 2025 None of them worked. So it makes no sense for me to continue caring about this subsystem. Most importantly, intentionally breaking reasonable use cases is against my moral, I don't want to get ashamed. Thanks for the opportunity! Signed-off-by: Cong Wang Link: https://patch.msgid.link/20260130212021.46610-1-xiyou.wangcong@gmail.com Signed-off-by: Paolo Abeni commit 8f2fb72fd17eecd5a47c73ce7e228d157e613b80 Author: Gao Xiang Date: Wed Feb 4 17:37:31 2026 +0800 erofs: update compression algorithm status The following changes are proposed in the upcoming Linux 7.0: - Enable LZMA support by default, as it's already in use by Fedora 42/43 and some Android vendors for minimal filesystem sizes; - Promote DEFLATE and Zstandard out of EXPERIMENTAL status, given that they have been landed and well-tested for over a year and are already ready for general use. Signed-off-by: Gao Xiang commit c134a40f86efb8d6b5a949ef70e06d5752209be5 Author: Gao Xiang Date: Tue Feb 3 16:25:36 2026 +0800 erofs: fix inline data read failure for ztailpacking pclusters Compressed folios for ztailpacking pclusters must be valid before adding these pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster() may assume they are already valid and then trigger a NULL pointer dereference. It is somewhat hard to reproduce because the inline data is in the same block as the tail of the compressed indexes, which are usually read just before. However, it may still happen if a fatal signal arrives while read_mapping_folio() is running, as shown below: erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 ... pc : z_erofs_decompress_queue+0x4c8/0xa14 lr : z_erofs_decompress_queue+0x160/0xa14 sp : ffffffc08b3eb3a0 x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000 x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001 x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700 x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098 x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004 x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9 x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: z_erofs_decompress_queue+0x4c8/0xa14 z_erofs_runqueue+0x908/0x97c z_erofs_read_folio+0x128/0x228 filemap_read_folio+0x68/0x128 filemap_get_pages+0x44c/0x8b4 filemap_read+0x12c/0x5b8 generic_file_read_iter+0x4c/0x15c do_iter_readv_writev+0x188/0x1e0 vfs_iter_read+0xac/0x1a4 backing_file_read_iter+0x170/0x34c ovl_read_iter+0xf0/0x140 vfs_read+0x28c/0x344 ksys_read+0x80/0xf0 __arm64_sys_read+0x24/0x34 invoke_syscall+0x60/0x114 el0_svc_common+0x88/0xe4 do_el0_svc+0x24/0x30 el0_svc+0x40/0xa8 el0t_64_sync_handler+0x70/0xbc el0t_64_sync+0x1bc/0x1c0 Fix this by reading the inline data before allocating and adding the pclusters to the I/O chains. Fixes: cecf864d3d76 ("erofs: support inline data decompression") Reported-by: Zhiguo Niu Reviewed-and-tested-by: Zhiguo Niu Signed-off-by: Gao Xiang commit 6316366129d2885fae07c2774f4b7ae0a45fb55d Merge: 1df3f01ebfb9e7 0c4762e26879ac Author: Marc Zyngier Date: Thu Feb 5 09:17:58 2026 +0000 Merge branch kvm-arm64/misc-6.20 into kvmarm-master/next * kvm-arm64/misc-6.20: : . : Misc KVM/arm64 changes for 6.20 : : - Trivial FPSIMD cleanups : : - Calculate hyp VA size only once, avoiding potential mapping issues when : VA bits is smaller than expected : : - Silence sparse warning for the HYP stack base : : - Fix error checking when handling FFA_VERSION : : - Add missing trap configuration for DBGWCR15_EL1 : : - Don't try to deal with nested S2 when NV isn't enabled for a guest : : - Various spelling fixes : . KVM: arm64: nv: Avoid NV stage-2 code when NV is not supported KVM: arm64: Fix various comments KVM: arm64: nv: Add trap config for DBGWCR<15>_EL1 KVM: arm64: Fix error checking for FFA_VERSION KVM: arm64: Fix missing include KVM: arm64: Calculate hyp VA size only once KVM: arm64: Remove ISB after writing FPEXC32_EL2 KVM: arm64: Shuffle KVM_HOST_DATA_FLAG_* indices KVM: arm64: Fix comment in fpsimd_lazy_switch_to_host() Signed-off-by: Marc Zyngier commit 1df3f01ebfb9e7d00fd10711fe9e98b25e01e59a Merge: 3ef5ba663a33aa edba407843340c Author: Marc Zyngier Date: Thu Feb 5 09:17:48 2026 +0000 Merge branch kvm-arm64/resx into kvmarm-master/next * kvm-arm64/resx: : . : Add infrastructure to deal with the full gamut of RESx bits : for NV. As a result, it is now possible to have the expected : semantics for some bits such as SCTLR_EL2.SPAN. : . KVM: arm64: Add debugfs file dumping computed RESx values KVM: arm64: Add sanitisation to SCTLR_EL2 KVM: arm64: Remove all traces of HCR_EL2.MIOCNCE KVM: arm64: Remove all traces of FEAT_TME KVM: arm64: Simplify handling of full register invalid constraint KVM: arm64: Get rid of FIXED_VALUE altogether KVM: arm64: Simplify handling of HCR_EL2.E2H RESx KVM: arm64: Move RESx into individual register descriptors KVM: arm64: Add RES1_WHEN_E2Hx constraints as configuration flags KVM: arm64: Add REQUIRES_E2H1 constraint as configuration flags KVM: arm64: Simplify FIXED_VALUE handling KVM: arm64: Convert HCR_EL2.RW to AS_RES1 KVM: arm64: Correctly handle SCTLR_EL1 RES1 bits for unsupported features KVM: arm64: Allow RES1 bits to be inferred from configuration KVM: arm64: Inherit RESx bits from FGT register descriptors KVM: arm64: Extend unified RESx handling to runtime sanitisation KVM: arm64: Introduce data structure tracking both RES0 and RES1 bits KVM: arm64: Introduce standalone FGU computing primitive KVM: arm64: Remove duplicate configuration for SCTLR_EL1.{EE,E0E} arm64: Convert SCTLR_EL2 to sysreg infrastructure Signed-off-by: Marc Zyngier commit 3ef5ba663a33aa3da901117acd3555ca582341f0 Merge: 47e89febd3f5cf fb21cb08566ebe Author: Marc Zyngier Date: Thu Feb 5 09:17:44 2026 +0000 Merge branch kvm-arm64/debugfs-fixes into kvmarm-master/next * kvm-arm64/debugfs-fixes: : . : Cleanup of the debugfs iterator, which are way more complicated : than they ought to be, courtesy of Fuad Tabba. From the cover letter: : : "This series refactors the debugfs implementations for `idregs` and : `vgic-state` to use standard `seq_file` iterator patterns. : : The existing implementations relied on storing iterator state within : global VM structures (`kvm_arch` and `vgic_dist`). This approach : prevented concurrent reads of the debugfs files (returning -EBUSY) and : created improper dependencies between transient file operations and : long-lived VM state." : . KVM: arm64: Use standard seq_file iterator for vgic-debug debugfs KVM: arm64: Reimplement vgic-debug XArray iteration KVM: arm64: Use standard seq_file iterator for idregs debugfs Signed-off-by: Marc Zyngier commit 47e89febd3f5cf52b672f0841b42ac67610ef87a Merge: 1c880ea3efd77c 3227c3a89d65fe Author: Marc Zyngier Date: Thu Feb 5 09:17:30 2026 +0000 Merge branch kvm-arm64/gicv5-prologue into kvmarm-master/next * kvm-arm64/gicv5-prologue: : . : Prologue to GICv5 support, courtesy of Sascha Bischoff. : : This is preliminary work that sets the scene for the full-blow : support. : . irqchip/gic-v5: Check if impl is virt capable KVM: arm64: gic: Set vgic_model before initing private IRQs arm64/sysreg: Drop ICH_HFGRTR_EL2.ICC_HAPR_EL1 and make RES1 KVM: arm64: gic-v3: Switch vGIC-v3 to use generated ICH_VMCR_EL2 Signed-off-by: Marc Zyngier commit 1c880ea3efd77ce1a3e16aeb617fdd76d28e197a Merge: 26e013b3fc7e3a 28e505d81766dc Author: Marc Zyngier Date: Thu Feb 5 09:17:04 2026 +0000 Merge branch kvm-arm64/gicv3-tdir-fixes into kvmarm-master/next * kvm-arm64/gicv3-tdir-fixes: : . : Address two trapping-related issues when running legacy (i.e. GICv3) : guests on GICv5 hosts, courtesy of Sascha Bischoff. : . KVM: arm64: Correct test for ICH_HCR_EL2_TDIR cap for GICv5 hosts KVM: arm64: gic: Enable GICv3 CPUIF trapping on GICv5 hosts if required Signed-off-by: Marc Zyngier commit 26e013b3fc7e3a3f31c54d1064702594e8ef9a6c Merge: 183ac2b2ad5a55 65d00e37b17f46 Author: Marc Zyngier Date: Thu Feb 5 09:16:42 2026 +0000 Merge branch kvm-arm64/fwb-for-all into kvmarm-master/next * kvm-arm64/fwb-for-all: : . : Allow pKVM's host stage-2 mappings to use the Force Write Back version : of the memory attributes by using the "pass-through' encoding. : : This avoids having two separate encodings for S2 on a given platform. : . KVM: arm64: Simplify PAGE_S2_MEMATTR KVM: arm64: Kill KVM_PGTABLE_S2_NOFWB KVM: arm64: Switch pKVM host S2 over to KVM_PGTABLE_S2_AS_S1 KVM: arm64: Add KVM_PGTABLE_S2_AS_S1 flag arm64: Add MT_S2{,_FWB}_AS_S1 encodings Signed-off-by: Marc Zyngier commit 183ac2b2ad5a558a749df5656c1f1df691c7c328 Merge: c983b3e276859e 230b080623fec2 Author: Marc Zyngier Date: Thu Feb 5 09:16:31 2026 +0000 Merge branch kvm-arm64/pkvm-no-mte into kvmarm-master/next * kvm-arm64/pkvm-no-mte: : . : pKVM updates preventing the host from using MTE-related system : sysrem registers when the feature is disabled from the kernel : command-line (arm64.nomte), courtesy of Fuad Taba. : : From the cover letter: : : "If MTE is supported by the hardware (and is enabled at EL3), it remains : available to lower exception levels by default. Disabling it in the host : kernel (e.g., via 'arm64.nomte') only stops the kernel from advertising : the feature; it does not physically disable MTE in the hardware. : : The ability to disable MTE in the host kernel is used by some systems, : such as Android, so that the physical memory otherwise used as tag : storage can be used for other things (i.e. treated just like the rest of : memory). In this scenario, a malicious host could still access tags in : pages donated to a guest using MTE instructions (e.g., STG and LDG), : bypassing the kernel's configuration." : . KVM: arm64: Use kvm_has_mte() in pKVM trap initialization KVM: arm64: Inject UNDEF when accessing MTE sysregs with MTE disabled KVM: arm64: Trap MTE access and discovery when MTE is disabled KVM: arm64: Remove dead code resetting HCR_EL2 for pKVM Signed-off-by: Marc Zyngier commit 42fcb213e58a7da33d5d2d7517b4e521025c68c3 Author: Qingfang Deng Date: Thu Jan 29 09:29:02 2026 +0800 ppp: enable TX scatter-gather PPP channels using chan->direct_xmit prepend the PPP header to a skb and call dev_queue_xmit() directly. In this mode the skb does not need to be linear, but the PPP netdevice currently does not advertise scatter-gather features, causing unnecessary linearization and preventing GSO. Enable NETIF_F_SG and NETIF_F_FRAGLIST on PPP devices. In case a linear buffer is required (PPP compression, multilink, and channels without direct_xmit), call skb_linearize() explicitly. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20260129012902.941-1-dqfext@gmail.com Signed-off-by: Paolo Abeni commit edba407843340c4b66134fce6c54a007c1ac83a2 Author: Marc Zyngier Date: Mon Feb 2 18:43:29 2026 +0000 KVM: arm64: Add debugfs file dumping computed RESx values Computing RESx values is hard. Verifying that they are correct is harder. Add a debugfs file called "resx" that will dump all the RESx values for a given VM. I found it useful, maybe you will too. Co-developed-by: Fuad Tabba Signed-off-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-21-maz@kernel.org Signed-off-by: Marc Zyngier commit e8ef27900c6a8c0727dcf62d4112d08c5046d33e Author: Marc Zyngier Date: Mon Feb 2 18:43:28 2026 +0000 KVM: arm64: Add sanitisation to SCTLR_EL2 Sanitise SCTLR_EL2 the usual way. The most important aspect of this is that we benefit from SCTLR_EL2.SPAN being RES1 when HCR_EL2.E2H==0. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-20-maz@kernel.org Signed-off-by: Marc Zyngier commit fb40cb15e8ad1e7511966a953de0f409aaae4398 Author: Marc Zyngier Date: Mon Feb 2 18:43:27 2026 +0000 KVM: arm64: Remove all traces of HCR_EL2.MIOCNCE MIOCNCE had the potential to eat your data, and also was never implemented by anyone. It's been retrospectively removed from the architecture, and we're happy to follow that lead. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-19-maz@kernel.org Signed-off-by: Marc Zyngier commit d65bf6e317e7bb13612bd94e01c5a11b6fc67e9d Author: Marc Zyngier Date: Mon Feb 2 18:43:26 2026 +0000 KVM: arm64: Remove all traces of FEAT_TME FEAT_TME has been dropped from the architecture. Retrospectively. I'm sure someone is crying somewhere, but most of us won't. Clean-up time. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-18-maz@kernel.org Signed-off-by: Marc Zyngier commit d784cfe697abdfd53f332d39d0cffcf03cbcafaa Author: Marc Zyngier Date: Mon Feb 2 18:43:25 2026 +0000 KVM: arm64: Simplify handling of full register invalid constraint Now that we embed the RESx bits in the register description, it becomes easier to deal with registers that are simply not valid, as their existence is not satisfied by the configuration (SCTLR2_ELx without FEAT_SCTLR2, for example). Such registers essentially become RES0 for any bit that wasn't already advertised as RESx. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-17-maz@kernel.org Signed-off-by: Marc Zyngier commit ab1f377b4c930e8d117cc461bd64d5866fc6aab8 Author: Marc Zyngier Date: Mon Feb 2 18:43:24 2026 +0000 KVM: arm64: Get rid of FIXED_VALUE altogether We have now killed every occurrences of FIXED_VALUE, and we can therefore drop the whole infrastructure. Good riddance. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-16-maz@kernel.org Signed-off-by: Marc Zyngier commit f01e3429cf0e4b1ab20c9d51ebfa0d8514d8fe4d Author: Marc Zyngier Date: Mon Feb 2 18:43:23 2026 +0000 KVM: arm64: Simplify handling of HCR_EL2.E2H RESx Now that we can link the RESx behaviour with the value of HCR_EL2.E2H, we can trivially express the tautological constraint that makes E2H a reserved value at all times. Fun, isn't it? Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-15-maz@kernel.org Signed-off-by: Marc Zyngier commit d2f629aa75bef1c346f17ca195271582dafc6f3b Author: Marc Zyngier Date: Mon Feb 2 18:43:22 2026 +0000 KVM: arm64: Move RESx into individual register descriptors Instead of hacking the RES1 bits at runtime, move them into the register descriptors. This makes it significantly nicer. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-14-maz@kernel.org Signed-off-by: Marc Zyngier commit d406fcb2030e3efe2c5a7f043028cb3727f522d8 Author: Marc Zyngier Date: Mon Feb 2 18:43:21 2026 +0000 KVM: arm64: Add RES1_WHEN_E2Hx constraints as configuration flags "Thanks" to VHE, SCTLR_EL2 radically changes shape depending on the value of HCR_EL2.E2H, as a lot of the bits that didn't have much meaning with E2H=0 start impacting EL0 with E2H=1. This has a direct impact on the RESx behaviour of these bits, and we need a way to express them. For this purpose, introduce two new constaints that, when the controlling feature is not present, force the field to RES1 depending on the value of E2H. Note that RES0 is still implicit, This allows diverging RESx values depending on the value of E2H, something that is required by a bunch of SCTLR_EL2 bits. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-13-maz@kernel.org Signed-off-by: Marc Zyngier commit ad90512f12fef5506d1f72cdfbd720eb701eab8c Author: Marc Zyngier Date: Mon Feb 2 18:43:20 2026 +0000 KVM: arm64: Add REQUIRES_E2H1 constraint as configuration flags A bunch of EL2 configuration are very similar to their EL1 counterpart, with the added constraint that HCR_EL2.E2H being 1. For us, this means HCR_EL2.E2H being RES1, which is something we can statically evaluate. Add a REQUIRES_E2H1 constraint, which allows us to express conditions in a much simpler way (without extra code). Existing occurrences are converted, before we add a lot more. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-12-maz@kernel.org Signed-off-by: Marc Zyngier commit 8d94458263bb2d44d8ba461327a1e18c05cfc453 Author: Marc Zyngier Date: Mon Feb 2 18:43:19 2026 +0000 KVM: arm64: Simplify FIXED_VALUE handling The FIXED_VALUE qualifier (mostly used for HCR_EL2) is pointlessly complicated, as it tries to piggy-back on the previous RES0 handling while being done in a different phase, on different data. Instead, make it an integral part of the RESx computation, and allow it to directly set RESx bits. This is much easier to understand. It also paves the way for some additional changes to that will allow the full removal of the FIXED_VALUE handling. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-11-maz@kernel.org Signed-off-by: Marc Zyngier commit fb86207bdc5bf4d5743eab78d6babbecda6c2609 Author: Marc Zyngier Date: Mon Feb 2 18:43:18 2026 +0000 KVM: arm64: Convert HCR_EL2.RW to AS_RES1 Now that we have the AS_RES1 constraint, it becomes trivial to express the HCR_EL2.RW behaviour. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-10-maz@kernel.org Signed-off-by: Marc Zyngier commit c27b8b7aabefb8ef226c3dfbc86ef7df6a9958c2 Author: Marc Zyngier Date: Mon Feb 2 18:43:17 2026 +0000 KVM: arm64: Correctly handle SCTLR_EL1 RES1 bits for unsupported features A bunch of SCTLR_EL1 bits must be set to RES1 when the controlling feature is not present. Add the AS_RES1 qualifier where needed. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-9-maz@kernel.org Signed-off-by: Marc Zyngier commit 459fc4e77e1ac932e47cb4a6d1a01b3be79fd41c Author: Marc Zyngier Date: Mon Feb 2 18:43:16 2026 +0000 KVM: arm64: Allow RES1 bits to be inferred from configuration So far, when a bit field is tied to an unsupported feature, we set it as RES0. This is almost correct, but there are a few exceptions where the bits become RES1. Add a AS_RES1 qualifier that instruct the RESx computing code to simply do that. Reviewed-by: Joey Gouly Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-8-maz@kernel.org Signed-off-by: Marc Zyngier commit 3989ed41848346ea887bff5d53e3657be42b609c Author: Yao Zi Date: Mon Feb 2 04:53:22 2026 +0000 MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI When booting from LEFI firmware, the devicetree is chosen by matching bridge type and CPU PRID. However, serials on Loongson devices may not have the same clock frequency across different boards. For example, CPU UARTs found on Loongson 3A4000 is supplied by the system clock, which may be either 25MHz or 100MHz. Luckily, LEFI firmware interface provides information about UART address and corresponding clock frequency. Let's fixup clock-frequency properties for serials after FDT selection by matching FDT nodes with addresses provided by firmware. Signed-off-by: Yao Zi Reviewed-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit 32ec465103527ede09b640cd0ab0636dc58827fb Author: Rong Zhang Date: Sun Feb 1 05:32:59 2026 +0800 MIPS: Loongson2ef: Use pcibios_align_resource() to block io range Loongson2ef reserves io range below 0x4000 (LOONGSON_PCI_IO_START) while ISA-mode only IDE controller on the south bridge still has a hard dependency on ISA IO ports. The reservation was done by lifting loongson_pci_io_resource.start onto 0x4000. Prior to commit ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()"), the arch specific pcibios_enable_resources() did not check if the resources were claimed, which diverges from what PCI core checks, effectively hiding the fact that IDE IO resources were not properly within the resource tree. After starting to use pcibios_enable_resources() from PCI core, enabling IDE controller fails: pata_cs5536 0000:00:0e.2: BAR 0 [io 0x01f0-0x01f7]: not claimed; can't enable device pata_cs5536 0000:00:0e.2: probe with driver pata_cs5536 failed with error -22 MIPS PCI code already has support for enforcing lower bounds using PCIBIOS_MIN_IO in pcibios_align_resource() without altering the IO window start address itself. Make Loongson2ef PCI code use PCIBIOS_MIN_IO too. Fixes: ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()") Cc: stable@vger.kernel.org Tested-by: Beiyan Yun Tested-by: Yao Zi Signed-off-by: Rong Zhang Acked-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit 6a00c043af07492502ba7a2263ddc4cdb01b66a7 Author: Rong Zhang Date: Sun Feb 1 05:32:58 2026 +0800 MIPS: Loongson2ef: Register PCI controller in early stage We are about to set loongson_pci_io_resource.start to 0 and adopt PCIBIOS_MIN_IO. As the first step, PCI controller needs to be registered in early stage to make it the root of other resources (e.g., i8259) and prevent resource conflicts. Register it in plat_mem_setup() instead of arch_initcall(). Fixes: ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()") Cc: stable@vger.kernel.org Tested-by: Beiyan Yun Tested-by: Yao Zi Signed-off-by: Rong Zhang Acked-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit bbea27636e660df907ebf0d36e3dfca5c77cfbc0 Author: Marc Zyngier Date: Mon Feb 2 18:43:15 2026 +0000 KVM: arm64: Inherit RESx bits from FGT register descriptors The FGT registers have their computed RESx bits stashed in specific descriptors, which we can easily use when computing the masks used for the guest. This removes a bit of boilerplate code. Reviewed-by: Joey Gouly Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-7-maz@kernel.org Signed-off-by: Marc Zyngier commit f9d58956423844237e18a758dc0f1b2cf6480042 Author: Marc Zyngier Date: Mon Feb 2 18:43:14 2026 +0000 KVM: arm64: Extend unified RESx handling to runtime sanitisation Add a new helper to retrieve the RESx values for a given system register, and use it for the runtime sanitisation. This results in slightly better code generation for a fairly hot path in the hypervisor, and additionally covers all sanitised registers in all conditions, not just the VNCR-based ones. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-6-maz@kernel.org Signed-off-by: Marc Zyngier commit 0879478913dd671b0aed1e3960c4b35fb8546ab4 Author: Marc Zyngier Date: Mon Feb 2 18:43:13 2026 +0000 KVM: arm64: Introduce data structure tracking both RES0 and RES1 bits We have so far mostly tracked RES0 bits, but only made a few attempts at being just as strict for RES1 bits (probably because they are both rarer and harder to handle). Start scratching the surface by introducing a data structure tracking RES0 and RES1 bits at the same time. Note that contrary to the usual idiom, this structure is mostly passed around by value -- the ABI handles it nicely, and the resulting code is much nicer. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-5-maz@kernel.org Signed-off-by: Marc Zyngier commit a3c92001812358c35c55c844c1e0d9de8caf13fe Author: Marc Zyngier Date: Mon Feb 2 18:43:12 2026 +0000 KVM: arm64: Introduce standalone FGU computing primitive Computing the FGU bits is made oddly complicated, as we use the RES0 helper instead of using a specific abstraction. Introduce such an abstraction, which is going to make things significantly simpler in the future. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-4-maz@kernel.org Signed-off-by: Marc Zyngier commit 4faf52106de73cdd1f34752afd60b256721e97b5 Author: Marc Zyngier Date: Mon Feb 2 18:43:11 2026 +0000 KVM: arm64: Remove duplicate configuration for SCTLR_EL1.{EE,E0E} We already have specific constraints for SCTLR_EL1.{EE,E0E}, and making them depend on FEAT_AA64EL1 is just buggy. Fixes: 6bd4a274b026e ("KVM: arm64: Convert SCTLR_EL1 to config-driven sanitisation") Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-3-maz@kernel.org Signed-off-by: Marc Zyngier commit 0a35bd285f43c26ccec33872fc6bb679069eaea8 Author: Marc Zyngier Date: Mon Feb 2 18:43:10 2026 +0000 arm64: Convert SCTLR_EL2 to sysreg infrastructure Convert SCTLR_EL2 to the sysreg infrastructure, as per the 2025-12_rel revision of the Registers.json file. Note that we slightly deviate from the above, as we stick to the ARM ARM M.a definition of SCTLR_EL2[9], which is RES0, in order to avoid dragging the POE2 definitions... Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260202184329.2724080-2-maz@kernel.org Signed-off-by: Marc Zyngier commit a6ab150deb4b740334721d18e02ad400a9d888f5 Author: Lukas Bulwahn Date: Tue Feb 3 10:01:01 2026 +0100 clk: microchip: fix typo in reference to a config option Commit 026d70dcfe5d ("clk: microchip: core: allow driver to be compiled with COMPILE_TEST") introduces a typo when referring to a config option in an ifdef directive. Fix this typo. Fixes: 026d70dcfe5d ("clk: microchip: core: allow driver to be compiled with COMPILE_TEST") Signed-off-by: Lukas Bulwahn Reviewed-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit 7a562d5d2396c9c78fbbced7ae81bcfcfa0fde3f Author: Marco Elver Date: Tue Feb 3 23:50:10 2026 +0100 locking/rwlock: Fix write_trylock_irqsave() with CONFIG_INLINE_WRITE_TRYLOCK Move _raw_write_trylock_irqsave() after the _raw_write_trylock macro to ensure it uses the inlined version, fixing a linker error when inlining is enabled. This is the case on s390: >> ld.lld: error: undefined symbol: _raw_write_trylock >>> referenced by rwlock_api_smp.h:48 (include/linux/rwlock_api_smp.h:48) >>> lib/test_context-analysis.o:(test_write_trylock_extra) in archive vmlinux.a >>> referenced by rwlock_api_smp.h:48 (include/linux/rwlock_api_smp.h:48) >>> lib/test_context-analysis.o:(test_write_trylock_extra) in archive vmlinux.a Closes: https://lore.kernel.org/oe-kbuild-all/202602032101.dbxRfsWO-lkp@intel.com/ Reported-by: kernel test robot Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260203225114.3493538-1-elver@google.com commit 7db06e329af30dcb170a6782c1714217ad65033d Author: Randy Dunlap Date: Tue Feb 3 10:42:04 2026 -0800 s390: remove kvm_types.h from Kbuild kvm_types.h is mandatory in include/asm-generic/Kbuild so having it in another Kbuild file causes a warning. Remove it from the arch/ Kbuild file to fix the warning. ../scripts/Makefile.asm-headers:39: redundant generic-y found in ../arch/s390/include/asm/Kbuild: kvm_types.h Signed-off-by: Randy Dunlap Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260203184204.1329414-1-rdunlap@infradead.org commit 3e5aa52b45c73470092f00d219e947f32cce340c Author: Alexei Lazar Date: Tue Feb 3 09:30:21 2026 +0200 net/mlx5e: Extend TC max ratelimit using max_bw_value_msb The per-TC rate limit was restricted to 255 Gbps due to the 8-bit max_bw_value field in the QETC register. This limit is insufficient for newer, higher-bandwidth NICs. Extend the rate limit by using the full 16-bit max_bw_value field. This allows the finer 100Mbps granularity to be used for rates up to ~6.5 Tbps, instead of switching to 1Gbps granularity at higher rates. The extended range is only used when the device advertises support via the qetcr_qshr_max_bw_val_msb capability bit in the QCAM register. Signed-off-by: Alexei Lazar Reviewed-by: Dragos Tatulea Reviewed-by: Gal Pressman Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260203073021.1710806-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 23fb09db9e7474a31b2ceb639c9a0ea6bc08f80e Merge: 14eb64db8ff07b 09e6960e843586 Author: Jakub Kicinski Date: Wed Feb 4 21:16:09 2026 -0800 Merge branch 'net-mlx5e-rx-datapath-enhancements' Tariq Toukan says: ==================== net/mlx5e: RX datapath enhancements This series by Dragos introduces multiple RX datapath enhancements to the mlx5e driver. First patch adds SW handling for oversized packets in non-linear SKB mode. Second patch adds a reclaim mechanism to mitigate memory allocation failures with memory providers. ==================== Link: https://patch.msgid.link/20260203072130.1710255-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 09e6960e843586315ddf3222daa217244688e76d Author: Dragos Tatulea Date: Tue Feb 3 09:21:30 2026 +0200 net/mlx5e: SHAMPO, Improve allocation recovery When memory providers are used, there is a disconnect between the page_pool size and the available memory in the provider. This means that the page_pool can run out of memory if the user didn't provision a large enough buffer. Under these conditions, mlx5 gets stuck trying to allocate new buffers without being able to release existing buffers. This happens due to the optimization introduced in commit 4c2a13236807 ("net/mlx5e: RX, Defer page release in striding rq for better recycling") which delays WQE releases to increase the chance of page_pool direct recycling. The optimization was developed before memory providers existed and this circumstance was not considered. This patch unblocks the queue by reclaiming pages from WQEs that can be freed and doing a one-shot retry. A WQE can be freed when: 1) All its strides have been consumed (WQE is no longer in linked list). 2) The WQE pages/netmems have not been previously released. This reclaim mechanism is useful for regular pages as well. Note that provisioning memory that can't fill even one MPWQE (64 4K pages) will still render the queue unusable. Same when the application doesn't release its buffers for various reasons. Or a combination of the two: a very small buffer is provisioned, application releases buffers in bulk, bulk size never reached => queue is stuck. Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260203072130.1710255-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 7ed7a576f20a8c60bbd4335e57776f3ad5812577 Author: Dragos Tatulea Date: Tue Feb 3 09:21:29 2026 +0200 net/mlx5e: RX, Drop oversized packets in non-linear mode Currently the driver has an inconsistent behaviour between modes when it comes to oversized packets that are not dropped through the physical MTU check in HW. This can happen for Multi Host configurations where each port has a different MTU. Current behavior: 1) Striding RQ in linear mode drops the packet in SW and counts it with oversize_pkts_sw_drop. 2) Striding RQ in non-linear mode allows it like a normal packet. 3) Legacy RQ can't receive oversized packets by design: the RX WQE uses MTU sized packet buffers. This inconsistency is not a violation of the netdev policy [1] but it is better to be consistent across modes. This patch aligns (2) with (1) and (3). One exception is added for LRO: don't drop the oversized packet if it is an LRO packet. As now rq->hw_mtu always needs to be updated during the MTU change flow, drop the reset avoidance optimization from mlx5e_change_mtu(). Extract the CQE LRO segments reading into a helper function as it is used twice now. [1] Documentation/networking/netdevices.rst#L205 Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260203072130.1710255-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 14eb64db8ff07b58a35b98375f446d9e20765674 Author: Russell King (Oracle) Date: Tue Feb 3 16:50:41 2026 +0000 net: stmmac: remove support for lpi_intr_o The dwmac databook for v3.74a states that lpi_intr_o is a sideband signal which should be used to ungate the application clock, and this signal is synchronous to the receive clock. The receive clock can run at 2.5, 25 or 125MHz depending on the media speed, and can stop under the control of the link partner. This means that the time it takes to clear is dependent on the negotiated media speed, and thus can be 8, 40, or 400ns after reading the LPI control and status register. It has been observed with some aggressive link partners, this clock can stop while lpi_intr_o is still asserted, meaning that the signal remains asserted for an indefinite period that the local system has no direct control over. The LPI interrupts will still be signalled through the main interrupt path in any case, and this path is not dependent on the receive clock. This, since we do not gate the application clock, and the chances of adding clock gating in the future are slim due to the clocks being ill-defined, lpi_intr_o serves no useful purpose. Remove the code which requests the interrupt, and all associated code. Reported-by: Ovidiu Panait Tested-by: Ovidiu Panait # Renesas RZ/V2H board Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vnJbt-00000007YYN-28nm@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 15dd03dfeb1ca0c851092628d397233370fa8367 Merge: 677bd4bf5c685d 61aaa625371440 Author: Jakub Kicinski Date: Wed Feb 4 20:51:41 2026 -0800 Merge branch 'net-stmmac-fix-serdes-power-methods' Russell King says: ==================== net: stmmac: fix serdes power methods The stmmac serdes powerup/powerdown methods are not guaranteed to be called in a balancing fashion, but these are used to call the generic PHY subsystem's phy_power_up() and phy_power_down() methods which do require balanced calls. This series addresses this by making the stmmac serdes methods balanced. ==================== Link: https://patch.msgid.link/aYHHWm5UkD1JVa7D@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 61aaa625371440938b55d703501f8820018f737e Author: Russell King (Oracle) Date: Tue Feb 3 10:01:29 2026 +0000 net: stmmac: move serdes power methods to stmmac_[open|release]() Move the SerDes power up and down calls for the non-"after linkup" case out of __stmmac_open() and __stmmac_release() into the stmmac_open() and stmmac_release() methods, which means the SerDes will only change power state on administrative changes or suspend/ resume, not while changing the interface MTU. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vnDDt-00000007XxF-3uUK@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3019a1333e667ee7e1b6f7a236b5b4f81782870c Author: Russell King (Oracle) Date: Tue Feb 3 10:01:24 2026 +0000 net: stmmac: add missing serdes power down in error paths The open path is missing cleanup of a successful serdes power up if stmmac_hw_setup() or stmmac_request_irq() fails. stmmac_resume() is also missing cleanup of the serdes power up if stmmac_hw_setup() fails. Add the missing cleanups. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vnDDo-00000007Xx9-3RZ8@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9bfcf5460b70161c161ee7041c5bb2ee6a82a219 Author: Russell King (Oracle) Date: Tue Feb 3 10:01:19 2026 +0000 net: stmmac: add state tracking for legacy serdes power state Avoid calling the serdes_powerdown() method if we have not had a preceeding successful call to the serdes_powerup() method. This avoids unbalancing refcounted resources that may be used in the these platform glue serdes methods. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vnDDj-00000007Xx3-2xZ0@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3302126a9b2bf587aa8335c5de6bc2369aae5c46 Author: Russell King (Oracle) Date: Tue Feb 3 10:01:14 2026 +0000 net: stmmac: add wrappers for serdes_power[up|down]() methods Add wrappers for the serdes_power[up|down]() methods and update all call sites. This will allow us to add state tracking. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vnDDe-00000007Xww-2VUU@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 677bd4bf5c685d98d9a8ab74cc02bd17c996a4ef Merge: acd21dd2da1988 9d27a0fb122f19 Author: Jakub Kicinski Date: Wed Feb 4 20:46:40 2026 -0800 Merge branch 'net-rds-rds-tcp-protocol-and-extension-improvements' Allison Henderson says: ==================== net/rds: RDS-TCP protocol and extension improvements This is subset 3 of the larger RDS-TCP patch series I posted last Oct. The greater series aims to correct multiple rds-tcp issues that can cause dropped or out of sequence messages. I've broken it down into smaller sets to make reviews more manageable. In this set, we introduce extension headers for byte accounting and fix several RDS/TCP protocol issues including message preservation during connection transitions and multipath lane handling. The entire set can be viewed in the rfc here: https://lore.kernel.org/netdev/20251022191715.157755-1-achender@kernel.org/ ==================== Link: https://patch.msgid.link/20260203055723.1085751-1-achender@kernel.org Signed-off-by: Jakub Kicinski commit 9d27a0fb122f19b6d01d02f4b4f429ca28811ace Author: Gerd Rausch Date: Mon Feb 2 22:57:23 2026 -0700 net/rds: Trigger rds_send_ping() more than once Even though a peer may have already received a non-zero value for "RDS_EXTHDR_NPATHS" from a node in the past, the current peer may not. Therefore it is important to initiate another rds_send_ping() after a re-connect to any peer: It is unknown at that time if we're still talking to the same instance of RDS kernel modules on the other side. Otherwise, the peer may just operate on a single lane ("c_npaths == 0"), not knowing that more lanes are available. However, if "c_with_sport_idx" is supported, we also need to check that the connection we accepted on lane#0 meets the proper source port modulo requirement, as we fan out: Since the exchange of "RDS_EXTHDR_NPATHS" and "RDS_EXTHDR_SPORT_IDX" is asynchronous, initially we have no choice but to accept an incoming connection (via "accept") in the first slot ("cp_index == 0") for backwards compatibility. But that very connection may have come from a different lane with "cp_index != 0", since the peer thought that we already understood and handled "c_with_sport_idx" properly, as indicated by a previous exchange before a module was reloaded. In short: If a module gets reloaded, we recover from that, but do *not* allow a downgrade to support fewer lanes. Downgrades would require us to merge messages from separate lanes, which is rather tricky with the current RDS design. Each lane has its own sequence number space and all messages would need to be re-sequenced as we merge, all while handling "RDS_FLAG_RETRANSMITTED" and "cp_retrans" properly. Signed-off-by: Gerd Rausch Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260203055723.1085751-9-achender@kernel.org Signed-off-by: Jakub Kicinski commit a1f53d5fb6b2e4c81b438ea41f5f16482d084e08 Author: Gerd Rausch Date: Mon Feb 2 22:57:22 2026 -0700 net/rds: Use the first lane until RDS_EXTHDR_NPATHS arrives Instead of just blocking the sender until "c_npaths" is known (it gets updated upon the receipt of a MPRDS PONG message), simply use the first lane (cp_index#0). But just using the first lane isn't enough. As soon as we enqueue messages on a different lane, we'd run the risk of out-of-order delivery of RDS messages. Earlier messages enqueued on "cp_index == 0" could be delivered later than more recent messages enqueued on "cp_index > 0", mostly because of possible head of line blocking issues causing the first lane to be slower. To avoid that, we simply take a snapshot of "cp_next_tx_seq" at the time we're about to fan-out to more lanes. Then we delay the transmission of messages enqueued on other lanes with "cp_index > 0" until cp_index#0 caught up with the delivery of new messages (from "cp_send_queue") as well as in-flight messages (from "cp_retrans") that haven't been acknowledged yet by the receiver. We also add a new counter "mprds_catchup_tx0_retries" to keep track of how many times "rds_send_xmit" had to suspend activities, because it was waiting for the first lane to catch up. Signed-off-by: Gerd Rausch Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260203055723.1085751-8-achender@kernel.org Signed-off-by: Jakub Kicinski commit 9d30ad8a8bc0569ac833427094d18df46fb439e6 Author: Allison Henderson Date: Mon Feb 2 22:57:21 2026 -0700 net/rds: Update struct rds_statistics to use u64 instead of uint64_t Quick clean up to avoid checkpatch errors when adding members to this struct (Prefer kernel type 'u64' over 'uint64_t'). No functional changes added. Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260203055723.1085751-7-achender@kernel.org Signed-off-by: Jakub Kicinski commit b89fc7c2523b2b0750d91840f4e52521270d70ed Author: Håkon Bugge Date: Mon Feb 2 22:57:20 2026 -0700 net/rds: Clear reconnect pending bit When canceling the reconnect worker, care must be taken to reset the reconnect-pending bit. If the reconnect worker has not yet been scheduled before it is canceled, the reconnect-pending bit will stay on forever. Signed-off-by: Håkon Bugge Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org Signed-off-by: Jakub Kicinski commit aa0cd656f03209733d941f0d27b4e68db4443a07 Author: Gerd Rausch Date: Mon Feb 2 22:57:19 2026 -0700 net/rds: Kick-start TCP receiver after accept In cases where the server (the node with the higher IP-address) in an RDS/TCP connection is overwhelmed it is possible that the socket that was just accepted is chock-full of messages, up to the limit of what the socket receive buffer permits. Subsequently, "rds_tcp_data_ready" won't be called anymore, because there is no more space to receive additional messages. Nor was it called prior to the point of calling "rds_tcp_set_callbacks", because the "sk_data_ready" pointer didn't even point to "rds_tcp_data_ready" yet. We fix this by simply kick-starting the receive-worker for all cases where the socket state is neither "TCP_CLOSE_WAIT" nor "TCP_CLOSE". Signed-off-by: Gerd Rausch Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260203055723.1085751-5-achender@kernel.org Signed-off-by: Jakub Kicinski commit 826c1004d4aea60ee3f97de9eb25f8c489965c97 Author: Gerd Rausch Date: Mon Feb 2 22:57:18 2026 -0700 net/rds: rds_tcp_conn_path_shutdown must not discard messages RDS/TCP differs from RDS/RDMA in that message acknowledgment is done based on TCP sequence numbers: As soon as the last byte of a message has been acknowledged by the TCP stack of a peer, rds_tcp_write_space() goes on to discard prior messages from the send queue. Which is fine, for as long as the receiver never throws any messages away. The dequeuing of messages in RDS/TCP is done either from the "sk_data_ready" callback pointing to rds_tcp_data_ready() (the most common case), or from the receive worker pointing to rds_tcp_recv_path() which is called for as long as the connection is "RDS_CONN_UP". However, as soon as rds_conn_path_drop() is called for whatever reason, including "DR_USER_RESET", "cp_state" transitions to "RDS_CONN_ERROR", and rds_tcp_restore_callbacks() ends up restoring the callbacks and thereby disabling message receipt. So messages already acknowledged to the sender were dropped. Furthermore, the "->shutdown" callback was always called with an invalid parameter ("RCV_SHUTDOWN | SEND_SHUTDOWN == 3"), instead of the correct pre-increment value ("SHUT_RDWR == 2"). inet_shutdown() returns "-EINVAL" in such cases, rendering this call a NOOP. So we change rds_tcp_conn_path_shutdown() to do the proper "->shutdown(SHUT_WR)" call in order to signal EOF to the peer and make it transition to "TCP_CLOSE_WAIT" (RFC 793). This should make the peer also enter rds_tcp_conn_path_shutdown() and do the same. This allows us to dequeue all messages already received and acknowledged to the peer. We do so, until we know that the receive queue no longer has data (skb_queue_empty()) and that we couldn't have any data in flight anymore, because the socket transitioned to any of the states "CLOSING", "TIME_WAIT", "CLOSE_WAIT", "LAST_ACK", or "CLOSE" (RFC 793). However, if we do just that, we suddenly see duplicate RDS messages being delivered to the application. So what gives? Turns out that with MPRDS and its multitude of backend connections, retransmitted messages ("RDS_FLAG_RETRANSMITTED") can outrace the dequeuing of their original counterparts. And the duplicate check implemented in rds_recv_local() only discards duplicates if flag "RDS_FLAG_RETRANSMITTED" is set. Rather curious, because a duplicate is a duplicate; it shouldn't matter which copy is looked at and delivered first. To avoid this entire situation, we simply make the sender discard messages from the send-queue right from within rds_tcp_conn_path_shutdown(). Just like rds_tcp_write_space() would have done, were it called in time or still called. This makes sure that we no longer have messages that we know the receiver already dequeued sitting in our send-queue, and therefore avoid the entire "RDS_FLAG_RETRANSMITTED" fiasco. Now we got rid of the duplicate RDS message delivery, but we still run into cases where RDS messages are dropped. This time it is due to the delayed setting of the socket-callbacks in rds_tcp_accept_one() via either rds_tcp_reset_callbacks() or rds_tcp_set_callbacks(). By the time rds_tcp_accept_one() gets there, the socket may already have transitioned into state "TCP_CLOSE_WAIT", but rds_tcp_state_change() was never called. Subsequently, "->shutdown(SHUT_WR)" did not happen either. So the peer ends up getting stuck in state "TCP_FIN_WAIT2". We fix that by checking for states "TCP_CLOSE_WAIT", "TCP_LAST_ACK", or "TCP_CLOSE" and drop the freshly accepted socket in that case. This problem is observable by running "rds-stress --reset" frequently on either of the two sides of a RDS connection, or both while other "rds-stress" processes are exchanging data. Those "rds-stress" processes reported out-of-sequence errors, with the expected sequence number being smaller than the one actually received (due to the dropped messages). Signed-off-by: Gerd Rausch Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260203055723.1085751-4-achender@kernel.org Signed-off-by: Jakub Kicinski commit a20a6992558fa7c19a03c76bea4a793ccaef8505 Author: Gerd Rausch Date: Mon Feb 2 22:57:17 2026 -0700 net/rds: Encode cp_index in TCP source port Upon "sendmsg", RDS/TCP selects a backend connection based on a hash calculated from the source-port ("RDS_MPATH_HASH"). However, "rds_tcp_accept_one" accepts connections in the order they arrive, which is non-deterministic. Therefore the mapping of the sender's "cp->cp_index" to that of the receiver changes if the backend connections are dropped and reconnected. However, connection state that's preserved across reconnects (e.g. "cp_next_rx_seq") relies on that sender<->receiver mapping to never change. So we make sure that client and server of the TCP connection have the exact same "cp->cp_index" across reconnects by encoding "cp->cp_index" in the lower three bits of the client's TCP source port. A new extension "RDS_EXTHDR_SPORT_IDX" is introduced, that allows the server to tell the difference between clients that do the "cp->cp_index" encoding, and legacy clients that pick source ports randomly. Signed-off-by: Gerd Rausch Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260203055723.1085751-3-achender@kernel.org Signed-off-by: Jakub Kicinski commit 46f257ee6904125e6336d63f0694ff4c491cfbf7 Author: Shamir Rabinovitch Date: Mon Feb 2 22:57:16 2026 -0700 net/rds: new extension header: rdma bytes Introduce a new extension header type RDSV3_EXTHDR_RDMA_BYTES for an RDMA initiator to exchange rdma byte counts to its target. Currently, RDMA operations cannot precisely account how many bytes a peer just transferred via RDMA, which limits per-connection statistics and future policy (e.g., monitoring or rate/cgroup accounting of RDMA traffic). In this patch we expand rds_message_add_extension to accept multiple extensions, and add new flag to RDS header: RDS_FLAG_EXTHDR_EXTENSION, along with a new extension to RDS header: rds_ext_header_rdma_bytes. Signed-off-by: Shamir Rabinovitch Signed-off-by: Guangyu Sun Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260203055723.1085751-2-achender@kernel.org Signed-off-by: Jakub Kicinski commit acd21dd2da198875e0cf73f08b18c9bbf8b87d8c Author: Eric Dumazet Date: Tue Feb 3 21:47:16 2026 +0000 net_sched: sch_fq: tweak unlikely() hints in fq_dequeue() After 076433bd78d7 ("net_sched: sch_fq: add fast path for mostly idle qdisc") we need to remove one unlikely() because q->internal holds all the fast path packets. skb = fq_peek(&q->internal); if (unlikely(skb)) { q->internal.qlen--; Calling INET_ECN_set_ce() is very unlikely. These changes allow fq_dequeue_skb() to be (auto)inlined, thus making fq_dequeue() faster. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux add/remove: 2/2 grow/shrink: 0/1 up/down: 283/-269 (14) Function old new delta INET_ECN_set_ce - 267 +267 __pfx_INET_ECN_set_ce - 16 +16 __pfx_fq_dequeue_skb 16 - -16 fq_dequeue_skb 103 - -103 fq_dequeue 1685 1535 -150 Total: Before=24886569, After=24886583, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260203214716.880853-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit f8a062b25586675dd82620735387063a838aa71f Author: Marco Crivellari Date: Wed Dec 24 16:50:06 2025 +0100 ovpn: Replace use of system_wq with system_percpu_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Antonio Quartulli Link: https://patch.msgid.link/20251224155006.114824-1-marco.crivellari@suse.com Signed-off-by: Jakub Kicinski commit a34b0e4e21d6be3c3d620aa7f9dfbf0e9550c19e Author: Randy Dunlap Date: Mon Feb 2 23:52:48 2026 -0800 net/iucv: clean up iucv kernel-doc warnings Fix numerous (many) kernel-doc warnings in iucv.[ch]: - convert function documentation comments to a common (kernel-doc) look, even for static functions (without "/**") - use matching parameter and parameter description names - use better wording in function descriptions (Jakub & AI) - remove duplicate kernel-doc comments from the header file (Jakub) Examples: Warning: include/net/iucv/iucv.h:210 missing initial short description on line: * iucv_unregister Warning: include/net/iucv/iucv.h:216 function parameter 'handle' not described in 'iucv_unregister' Warning: include/net/iucv/iucv.h:467 function parameter 'answer' not described in 'iucv_message_send2way' Warning: net/iucv/iucv.c:727 missing initial short description on line: * iucv_cleanup_queue Build-tested with both "make htmldocs" and "make ARCH=s390 defconfig all". Signed-off-by: Randy Dunlap Reviewed-by: Alexandra Winter Link: https://patch.msgid.link/20260203075248.1177869-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 42a940ef18455eafa2de7cf5fffe7abeba43e250 Author: Huacai Chen Date: Tue Feb 3 14:26:58 2026 +0800 net: stmmac: Fix typo from clk_scr_i to clk_csr_i In include/linux/stmmac.h clk_csr_i is spelled as clk_scr_i by mistake, so correct the typo. Signed-off-by: Huacai Chen Reviewed-by: Yanteng Si Link: https://patch.msgid.link/20260203062658.2156653-1-chenhuacai@loongson.cn Signed-off-by: Jakub Kicinski commit 309dd9942155c090b774cec29c5982922fece446 Author: Eric Dumazet Date: Tue Feb 3 05:09:32 2026 +0000 tcp: split tcp_check_space() in two parts tcp_check_space() is fat and not inlined. Move its slow path in (out of line) __tcp_check_space() and make tcp_check_space() an inline function for better TCP performance. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 2/2 grow/shrink: 4/0 up/down: 708/-582 (126) Function old new delta __tcp_check_space - 521 +521 tcp_rcv_established 1860 1916 +56 tcp_rcv_state_process 3342 3384 +42 tcp_event_new_data_sent 248 286 +38 tcp_data_snd_check 71 106 +35 __pfx___tcp_check_space - 16 +16 __pfx_tcp_check_space 16 - -16 tcp_check_space 566 - -566 Total: Before=24896373, After=24896499, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260203050932.3522221-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7c1db78ff75f936e566f23af0e38ee4568a6af6b Author: Eric Dumazet Date: Tue Feb 3 04:51:10 2026 +0000 tcp: move tcp_rbtree_insert() to tcp_output.c tcp_rbtree_insert() is primarily used from tcp_output.c In tcp_input.c, only (slow path) tcp_collapse() uses it. Move it to tcp_output.c to allow its (auto)inlining to improve TCP tx fast path. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 4/1 up/down: 445/-115 (330) Function old new delta tcp_connect 4277 4478 +201 tcp_event_new_data_sent 162 248 +86 tcp_send_synack 780 862 +82 tcp_fragment 1185 1261 +76 tcp_collapse 1524 1409 -115 Total: Before=24896043, After=24896373, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260203045110.3499713-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 59b5e7f47c7c956a5e88a00953f351b4fbfa360d Author: Eric Dumazet Date: Tue Feb 3 04:42:26 2026 +0000 tcp: use __skb_push() in __tcp_transmit_skb() We trust MAX_TCP_HEADER to be large enough. Using the inlined version of skb_push() trades 8 bytes of text for better performance of TCP TX fast path. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 1/0 up/down: 8/0 (8) Function old new delta __tcp_transmit_skb 3181 3189 +8 Total: Before=24896035, After=24896043, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260203044226.3489941-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 333225e1e9ead7b06e5363389403bdac72ba3046 Merge: e07d0d30939990 9825fa8f499052 Author: Jakub Kicinski Date: Wed Feb 4 20:31:04 2026 -0800 Merge tag 'wireless-next-2026-02-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Some more changes, including pulls from drivers: - ath drivers: small features/cleanups - rtw drivers: mostly refactoring for rtw89 RTL8922DE support - mac80211: use hrtimers for CAC to avoid too long delays - cfg80211/mac80211: some initial UHR (Wi-Fi 8) support * tag 'wireless-next-2026-02-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (59 commits) wifi: brcmsmac: phy: Remove unreachable error handling code wifi: mac80211: Add eMLSR/eMLMR action frame parsing support wifi: mac80211: add initial UHR support wifi: cfg80211: add initial UHR support wifi: ieee80211: add some initial UHR definitions wifi: mac80211: use wiphy_hrtimer_work for CAC timeout wifi: mac80211: correct ieee80211-{s1g/eht}.h include guard comments wifi: ath12k: clear stale link mapping of ahvif->links_map wifi: ath12k: Add support TX hardware queue stats wifi: ath12k: Add support RX PDEV stats wifi: ath12k: Fix index decrement when array_len is zero wifi: ath12k: support OBSS PD configuration for AP mode wifi: ath12k: add WMI support for spatial reuse parameter configuration dt-bindings: net: wireless: ath11k-pci: deprecate 'firmware-name' property wifi: ath11k: add usecase firmware handling based on device compatible wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() wifi: ath10k: snoc: support powering on the device via pwrseq wifi: rtw89: pci: warn if SPS OCP happens for RTL8922DE wifi: rtw89: pci: restore LDO setting after device resume ... ==================== Link: https://patch.msgid.link/20260204121143.181112-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 5d3ae80b4dc43d1c49f5ab6e9835ae5fc9ac5d37 Author: Ming Lei Date: Sun Feb 1 11:10:44 2026 +0800 selftests: ublk: organize test directories by test ID Set UBLK_TEST_DIR to ${TMPDIR:-./ublktest-dir}/${TID}.XXXXXX to create per-test subdirectories organized by test ID. This makes it easier to identify and debug specific test runs. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit ee81212f74a57c5d2b56cf504f40d528dac6faaf Author: Luke Wang Date: Wed Feb 4 11:40:02 2026 +0800 block: decouple secure erase size limit from discard size limit Secure erase should use max_secure_erase_sectors instead of being limited by max_discard_sectors. Separate the handling of REQ_OP_SECURE_ERASE from REQ_OP_DISCARD to allow each operation to use its own size limit. Signed-off-by: Luke Wang Reviewed-by: Ulf Hansson Signed-off-by: Jens Axboe commit e07d0d30939990da377672ef49ca09763b4fbc79 Merge: e25dbf561e03c0 4dca8d0030c706 Author: Jakub Kicinski Date: Wed Feb 4 18:45:34 2026 -0800 Merge branch 'mptcp-misc-features-for-v6-20-7-0' Matthieu Baerts says: ==================== mptcp: misc. features for v6.20/7.0 This series contains a few independent new features, and small fixes for net-next: - Patches 1-2: two small fixes linked to the MPTCP receive buffer that are not urgent, requiring code that has been recently changed, and is needed for the next patch. Because we are at the end of the cycle, it seems easier to send them to net-next, instead of dealing with conflicts between net and net-next. - Patch 3: a refactoring to simplify the code around MPTCP DRS. - Patch 4: a new trace event for MPTCP to help debugging receive buffer auto-tuning issues. - Patch 5: align internal MPTCP PM structure with NL specs, just to manipulate the same thing. - Patch 6: convert some min_t(int, ...) to min(): cleaner, and to avoid future warnings. - Patch 7: [removed] - Patch 8: sort all #include in MPTCP Diag tool in the selftests to prevent future potential conflicts and ease the reading. - Patches 9-11: improve the MPTCP Join selftest by waiting for an event instead of a "random" sleep. - Patches 12-14: some small cleanups in the selftests, seen while working on the previous patches. - Patch 15: avoid marking subtests as skipped while still validating most checks when executing the last MPTCP selftests on older kernels. ==================== Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-0-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit 4dca8d0030c7060efc1a89c98c1f03acd483bb77 Author: Matthieu Baerts (NGI0) Date: Tue Feb 3 19:41:31 2026 +0100 selftests: mptcp: join: no SKIP mark for group checks When executing the last MPTCP selftests on older kernels, this output is printed: # 001 no JOIN # join Rx [SKIP] # join Tx [SKIP] # fallback [SKIP] In fact, behind each line, a few counters are checked, and likely not all of them have been skipped because the they are not available on these kernels. Instead, "new" and unsupported counters for these groups are now ignored, and [ OK ] will be printed instead of [SKIP]. Note that on the MPTCP CI, when validating the dev versions, any unsupported counter will cause the tests to fail. So this is safe not to print 'SKIP' for these group checks. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-15-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit ae68da495ae90314e14a09e4d390cced93d3fbd4 Author: Matthieu Baerts (NGI0) Date: Tue Feb 3 19:41:30 2026 +0100 selftests: mptcp: connect cleanup TFO setup To the TFO, only the file descriptor is needed, the family is not. Also, the error can be handled the same way when 'sendto()' or 'connect()' are used. Only the printed error message is different. This avoids a bit of confusions. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-14-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit 79d5069cfbec40bf79bd4bd15060aa200448e1ae Author: Matthieu Baerts (NGI0) Date: Tue Feb 3 19:41:29 2026 +0100 selftests: mptcp: join: avoid declaring i if not used A few loops were declaring 'i', but this variable was not used. To avoid confusions, use '_' instead: it is more explicit to mark that this variable is not needed. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-13-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit 91453a62e5ecb81614187e19dcb4bd2955d07e5e Author: Matthieu Baerts (NGI0) Date: Tue Feb 3 19:41:28 2026 +0100 selftests: mptcp: join chk_stale_nr: avoid dup stats nstat outputs are already printed when calling 'fail_test', no need to do it again. While at it, no need to use the dump_stats variable, print the extra stats directly. And use 'ip -n $ns' instead of 'ip netns exec $ns', shorter and clearer. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-12-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit 62c0774f0f1876a2321cbe89fa6068fc4057a3e6 Author: Matthieu Baerts (NGI0) Date: Tue Feb 3 19:41:27 2026 +0100 selftests: mptcp: join: userspace: wait for new events Instead of waiting for a random amount of time (1 second), wait for an event to be received on the other side. To do that, when an address is announced (userspace_pm_add_addr), the ANNOUNCED is expected. When a new subflow is created (userspace_pm_add_sf), the SUB_ESTABLISHED event is expected. With this, the tests can finish quicker. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-11-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit ab8b64ca3af30658ed04293b00ada9b65f45cc59 Author: Matthieu Baerts (NGI0) Date: Tue Feb 3 19:41:26 2026 +0100 selftests: mptcp: join: fix wait_mpj helper It looks like most of the time, this helper was simply waiting a bit more than one second: the previous MPJoin counter was often already at the expected value. So at the end, it was just checking 10 times for the MPJoin counter to change, but it was not happening. For the tests, that was time, it was just waiting longer for nothing. Instead, use 'wait_mpj' with the expected counter: in the tests, the MPJ counter can easily be predicted. While at it, stop passing the netns as argument: here the received MPJoin ACK is checked, which happens on the server side. If later on, this needs to be checked on the client side, the helper can be adapted for this case, but better avoid confusions now if it is not needed. While at it, stop using 'i' for the variable if it is not used. With this, the tests can finish quicker. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-10-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit 32207bed0547b0294302f2a4fe63571fff91a85e Author: Matthieu Baerts (NGI0) Date: Tue Feb 3 19:41:25 2026 +0100 selftests: mptcp: join: wait for estab event instead of MPJ 'wait_mpj' was used just after having created a background connection, but before creating new subflows. So no MPJ were sent. The intention was to wait for the connection to be established, which was the same as doing a simple sleep with a "random" value. Instead, wait for an "established" event. With this, the tests can finish quicker. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-9-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit f7f4e8e9448c5c142a3f0b74cec961818a565878 Author: Matthieu Baerts (NGI0) Date: Tue Feb 3 19:41:24 2026 +0100 selftests: mptcp: diag: sort all #include This file is the only one from this directory not to have all these header inclusions sorted by type and alphabetical order. Adapt them, to ease the reading, prevent conflicts during potential future backport modifying these lines, and also to avoid having UAPI header inclusions before libc ones, see [1]. Link: https://lore.kernel.org/20260120-uapi-sockaddr-v2-1-63c319111cf6@linutronix.de Reviewed-by: Thomas Weißschuh Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-8-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit b582090005d5c66bfdb73a85b91ddb42a868aff6 Author: David Laight Date: Tue Feb 3 19:41:22 2026 +0100 mptcp: Change some dubious min_t(int, ...) to min() There are two: min_t(int, xxx, mptcp_wnd_end(msk) - msk->snd_nxt); Both mptcp_wnd_end(msk) and msk->snd_nxt are u64, their difference (aka the window size) might be limited to 32 bits - but that isn't knowable from this code. So checks being added to min_t() detect the potential discard of significant bits. Provided the 'avail_size' and return of mptcp_check_allowed_size() are changed to an unsigned type (size_t matches the type the caller uses) both min_t() can be changed to min(). Signed-off-by: David Laight Reviewed-by: Matthieu Baerts (NGI0) [ wrapped too long lines when declaring mptcp_check_allowed_size() ] Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-6-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit d7e712b66f9b3da11e7f523228409af6d56237cb Author: Matthieu Baerts (NGI0) Date: Tue Feb 3 19:41:21 2026 +0100 mptcp: pm: align endpoint flags size with the NL specs The MPTCP Netlink specs describe the 'flags' as a u32 type. Internally, a u8 type was used. Using a u8 is currently fine, because only the 5 first bits are used. But there is also no reason not to be aligns with the specs, and to stick to a u8. Especially because there is a whole of 3 bytes after in both mptcp_pm_local and mptcp_pm_addr_entry structures. Also, setting it to a u32 will allow future flags, just in case. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-5-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit 2002286e68c964d25826943d77edcf95cf38d6e1 Author: Paolo Abeni Date: Tue Feb 3 19:41:20 2026 +0100 trace: mptcp: add mptcp_rcvbuf_grow tracepoint Similar to tcp, provide a new tracepoint to better understand mptcp_rcv_space_adjust() behavior, which presents many artifacts. Note that the used format string is so long that I preferred wrap it, contrary to guidance for quoted strings. Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-4-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit 5c4dcc52c68ac39ab77b30022fb421a25fdcdf19 Author: Paolo Abeni Date: Tue Feb 3 19:41:19 2026 +0100 mptcp: consolidate rcv space init MPTCP uses several calls of the mptcp_rcv_space_init() helper to initialize the receive space, with a catch-up call in mptcp_rcv_space_adjust(). Drop all the other strictly not needed invocations and move constant fields initialization at socket init/reset time. This removes a bit of complexity from mptcp DRS code. No functional changes intended. Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-3-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit 70274765fef555af92a1532d5bd5450c691fca9d Author: Paolo Abeni Date: Tue Feb 3 19:41:18 2026 +0100 mptcp: fix receive space timestamp initialization MPTCP initialize the receive buffer stamp in mptcp_rcv_space_init(), using the provided subflow stamp. Such helper is invoked in several places; for passive sockets, space init happened at clone time. In such scenario, MPTCP ends-up accesses the subflow stamp before its initialization, leading to quite randomic timing for the first receive buffer auto-tune event, as the timestamp for newly created subflow is not refreshed there. Fix the issue moving the stamp initialization out of the mentioned helper, at the data transfer start, and always using a fresh timestamp. Fixes: 013e3179dbd2 ("mptcp: fix rcv space initialization") Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-2-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit 6b329393502e5857662b851a13f947209c588587 Author: Paolo Abeni Date: Tue Feb 3 19:41:17 2026 +0100 mptcp: do not account for OoO in mptcp_rcvbuf_grow() MPTCP-level OoOs are physiological when multiple subflows are active concurrently and will not cause retransmissions nor are caused by drops. Accounting for them in mptcp_rcvbuf_grow() causes the rcvbuf slowly drifting towards tcp_rmem[2]. Remove such accounting. Note that subflows will still account for TCP-level OoO when the MPTCP-level rcvbuf is propagated. This also closes a subtle and very unlikely race condition with rcvspace init; active sockets with user-space holding the msk-level socket lock, could complete such initialization in the receive callback, after that the first OoO data reaches the rcvbuf and potentially triggering a divide by zero Oops. Fixes: e118cdc34dd1 ("mptcp: rcvbuf auto-tuning improvement") Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260203-net-next-mptcp-misc-feat-6-20-v1-1-31ec8bfc56d1@kernel.org Signed-off-by: Jakub Kicinski commit e25dbf561e03c0c5e36228e3b8b784392819ce85 Author: Arnd Bergmann Date: Tue Feb 3 17:34:00 2026 +0100 vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 The gcc-16.0.1 snapshot produces a false-positive warning that turns into a build failure with CONFIG_WERROR: In file included from arch/x86/include/asm/string.h:6, from net/vmw_vsock/vmci_transport.c:10: In function 'vmci_transport_packet_init', inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2: arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull] 150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) | ^~~~~~~~~~~~~~~~~~~~~~~~~ net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); | ^~~~~~ arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy' net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy' 164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait)); | ^~~~~~ This seems relatively harmless, and it so far the only instance of this warning I have found. The __vmci_transport_send_control_pkt function is called either with wait=NULL or with one of the type values that pass 'wait' into memcpy() here, but not from the same caller. Replacing the memcpy with a struct assignment is otherwise the same but avoids the warning. Signed-off-by: Arnd Bergmann Reviewed-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Reviewed-by: Bryan Tan Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit d2adcbdae5f6d4da445f32ea61f21fdd146670d9 Author: Biju Das Date: Tue Feb 3 10:45:38 2026 +0000 dt-bindings: net: renesas,rzv2h-gbeth: Document Renesas RZ/G3L RMII{tx,rx} clocks As per the RZ/G3L Hardware manual, CPG_CLKON_ETH register bits{12,13} are to control the RMII{tx, rx} clocks. Document the rmii{tx.rx} clocks for RZ/G3L SoC. Signed-off-by: Biju Das Acked-by: Conor Dooley Link: https://patch.msgid.link/20260203104541.264759-1-biju.das.jz@bp.renesas.com Signed-off-by: Jakub Kicinski commit d713ed0f102b69d052366fe2017f11b955bc63ea Merge: f70f835fbd8492 0d958803954339 Author: Jakub Kicinski Date: Wed Feb 4 18:17:57 2026 -0800 Merge branch 's32g-use-a-syscon-for-gpr' Dan Carpenter says: ==================== s32g: Use a syscon for GPR The s32g devices have a GPR register region which holds a number of miscellaneous registers. Currently only the stmmac/dwmac-s32.c uses anything from there and we just add a line to the device tree to access that GMAC_0_CTRL_STS register: reg = <0x4033c000 0x2000>, /* gmac IP */ <0x4007c004 0x4>; /* GMAC_0_CTRL_STS */ I have included the whole list of registers below. We still have to maintain backwards compatibility to this format, of course, but it would be better to access these registers through a syscon. Putting all the registers together is more organized and shows how the hardware actually is implemented. Secondly, in some versions of this chipset those registers can only be accessed via SCMI. It's relatively straight forward to handle this by writing a syscon driver and registering it with of_syscon_register_regmap() but it's complicated to deal with if the registers aren't grouped together. Here is the whole list of registers in the GPR region Starting from 0x4007C000 0 Software-Triggered Faults (SW_NCF) 4 GMAC Control (GMAC_0_CTRL_STS) 28 CMU Status 1 (CMU_STATUS_REG1) 2C CMUs Status 2 (CMU_STATUS_REG2) 30 FCCU EOUT Override Clear (FCCU_EOUT_OVERRIDE_CLEAR_REG) 38 SRC POR Control (SRC_POR_CTRL_REG) 54 GPR21 (GPR21) 5C GPR23 (GPR23) 60 GPR24 Register (GPR24) CC Debug Control (DEBUG_CONTROL) F0 Timestamp Control (TIMESTAMP_CONTROL_REGISTER) F4 FlexRay OS Tick Input Select (FLEXRAY_OS_TICK_INPUT_SELECT_REG) FC GPR63 Register (GPR63) Starting from 0x4007CA00 0 Coherency Enable for PFE Ports (PFE_COH_EN) 4 PFE EMAC Interface Mode (PFE_EMACX_INTF_SEL) 20 PFE EMACX Power Control (PFE_PWR_CTRL) 28 Error Injection on Cortex-M7 AHB and AXI Pipe (CM7_TCM_AHB_SLICE) 2C Error Injection AHBP Gasket Cortex-M7 (ERROR_INJECTION_AHBP_GASKET_CM7) 40 LLCE Subsystem Status (LLCE_STAT) 44 LLCE Power Control (LLCE_CTRL) 48 DDR Urgent Control (DDR_URGENT_CTRL) 4C FTM Global Load Control (FLXTIM_CTRL) 50 FTM LDOK Status (FLXTIM_STAT) 54 Top CMU Status (CMU_STAT) 58 Accelerator NoC No Pending Trans Status (NOC_NOPEND_TRANS) 90 SerDes RD/WD Toggle Control (PCIE_TOGGLE) 94 SerDes Toggle Done Status (PCIE_TOGGLEDONE_STAT) E0 Generic Control 0 (GENCTRL0) E4 Generic Control 1 (GENCTRL1) F0 Generic Status 0 (GENSTAT0) FC Cortex-M7 AXI Parity Error and AHBP Gasket Error Alarm (CM7_AXI_AHBP_GASKET_ERROR_ALARM) Starting from 4007C800 4 GPR01 Register (GPR01) 30 GPR12 Register (GPR12) 58 GPR22 Register (GPR22) 70 GPR28 Register (GPR28) 74 GPR29 Register (GPR29) Starting from 4007CB00 4 WKUP Pad Pullup/Pulldown Select (WKUP_PUS) ==================== Link: https://patch.msgid.link/cover.1769764941.git.dan.carpenter@linaro.org Signed-off-by: Jakub Kicinski commit 0d958803954339acbde220865c6c4241d2abf406 Author: Dan Carpenter Date: Fri Jan 30 16:19:47 2026 +0300 dt-bindings: net: nxp,s32-dwmac: Use the GPR syscon The S32 chipsets have a GPR region which has a miscellaneous registers including the GMAC_0_CTRL_STS register. Originally, this code accessed that register in a sort of ad-hoc way, but it's cleaner to use a syscon interface to access these registers. We still need to maintain the old method of accessing the GMAC register but using a syscon will let us access other registers more cleanly. Signed-off-by: Dan Carpenter Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/3b75e950b2f8faecd1a9fa757e7eb7b42ace838f.1769764941.git.dan.carpenter@linaro.org Signed-off-by: Jakub Kicinski commit b0eeeb1b70c0b2e1118fec7c28ffb0e21fe98688 Author: Dan Carpenter Date: Fri Jan 30 16:19:41 2026 +0300 net: stmmac: s32: use a syscon for S32_PHY_INTF_SEL_RGMII On the s32 chipsets the GMAC_0_CTRL_STS register is in GPR region. Originally, accessing this register was done in a sort of ad-hoc way, but we want to use the syscon interface to do it. This is a little bit ugly because we have to maintain backwards compatibility to the old device trees so we have to support both ways to access this register. Signed-off-by: Dan Carpenter Reviewed-by: Jan Petrous (OSS) Link: https://patch.msgid.link/b6b60d03344d070b2b4db7f0f00527f166e594e0.1769764941.git.dan.carpenter@linaro.org Signed-off-by: Jakub Kicinski commit 75cd3beb64d0977009e3d1a2d0c03715d3e5e156 Merge: 6e951a9b1af5dc 5000a097f82c76 Author: Alexei Starovoitov Date: Wed Feb 4 18:14:26 2026 -0800 Merge branch 'fix-for-bpf_wq-retry-loop-during-free' Kumar Kartikeya Dwivedi says: ==================== Fix for bpf_wq retry loop during free Small fix and improvement to ensure cancel_work() can handle the case where wq callback is running, and doesn't lead to call_rcu_tasks_trace() repeatedly after failing cancel_work, if wq callback is not pending. ==================== Link: https://patch.msgid.link/20260205003853.527571-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 5000a097f82c7695b7760c5b67c95f0eab4d209b Author: Kumar Kartikeya Dwivedi Date: Wed Feb 4 16:38:53 2026 -0800 bpf: Reset prog callback in bpf_async_cancel_and_free() Replace prog and callback in bpf_async_cb after removing visibility of bpf_async_cb in bpf_async_cancel_and_free() to increase the chances the scheduled async callbacks short-circuit execution and exit early, and not starting a RCU tasks trace section. This improves the overall time spent in running the wq selftest. Suggested-by: Alexei Starovoitov Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260205003853.527571-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 81502d7f20bf862b706f5174979bed88d3ab82b3 Author: Kumar Kartikeya Dwivedi Date: Wed Feb 4 16:38:52 2026 -0800 bpf: Check for running wq callback when freeing bpf_async_cb When freeing a bpf_async_cb in bpf_async_cb_rcu_tasks_trace_free(), in case the wq callback is not scheduled, doing cancel_work() currently returns false and leads to retry of RCU tasks trace grace period. If the callback is never scheduled, we keep retrying indefinitely and don't put the prog reference. Since the only race we care about here is against a potentially running wq callback in the first grace period, it should finish by the second grace period, hence check work_busy() result to detect presence of running wq callback if it's not pending, otherwise free the object immediately without retrying. Reasoning behind the check and its correctness with racing wq callback invocation: cancel_work is supposed to be synchronized, hence calling it first and getting false would mean that work is definitely not pending, at this point, either the work is not scheduled at all or already running, or we race and it already finished by the time we checked for it using work_busy(). In case it is running, we synchronize using pool->lock to check the current work running there, if we match, it means we extend the wait by another grace period using retry = true, otherwise either the work already finished running or was never scheduled, so we can free the bpf_async_cb right away. Fixes: 1bfbc267ec91 ("bpf: Enable bpf_timer and bpf_wq in any context") Reported-by: Alexei Starovoitov Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260205003853.527571-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit f70f835fbd84921b096ac9d3c060f23f4fa1f395 Merge: 9a9424c756feee eca327ae9aa6ce Author: Jakub Kicinski Date: Wed Feb 4 18:12:03 2026 -0800 Merge branch 'stp-rstp-switch-support-for-pru-icssm-ethernet-driver' Parvathi Pudi says: ==================== STP/RSTP SWITCH support for PRU-ICSSM Ethernet driver The DUAL-EMAC patch series for Megabit Industrial Communication Sub-system (ICSSM), which provides the foundational support for Ethernet functionality over PRU-ICSS on the TI SOCs (AM335x, AM437x, and AM57x), was merged into net-next recently [1]. This patch series enhances the PRU-ICSSM Ethernet driver to support bridge (STP/RSTP) SWITCH mode, which has been implemented using the "switchdev" framework and interacts with the "mstp daemon" for STP and RSTP management in userspace. When the SWITCH mode is enabled, forwarding of Ethernet packets using either the traditional store-and-forward mechanism or via cut-through is offloaded to the two PRU based Ethernet interfaces available within the ICSSM. The firmware running on the PRU inspects the bridge port states and performs necessary checks before forwarding a packet. This improves the overall system performance and significantly reduces the packet forwarding latency. Protocol switching from Dual-EMAC to bridge (STP/RSTP) SWITCH mode can be done as follows. Assuming eth2 and eth3 are the two physical ports of the ICSS2 instance: >> brctl addbr br0 >> ip maddr add 01:80:c2:00:00:00 dev br0 >> ip link set dev br0 address $(cat /sys/class/net/eth2/address) >> brctl addif br0 eth2 >> brctl addif br0 eth3 >> mstpd >> brctl stp br0 on >> mstpctl setforcevers br0 rstp >> ip link set dev br0 up To revert back to the default dual EMAC mode, the steps are as follows: >> ip link set dev br0 down >> brctl delif br0 eth2 >> brctl delif br0 eth3 >> brctl delbr br0 The patches presented in this series have gone through the patch verification tools and no warnings or errors are reported. ==================== Link: https://patch.msgid.link/20260130124559.1182780-1-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit eca327ae9aa6ce0b13449d0f07b62f16f8444065 Author: Roger Quadros Date: Fri Jan 30 18:13:45 2026 +0530 net: ti: icssm-prueth: Add support for ICSSM RSTP switch Add support for RSTP switch mode by enhancing the existing ICSSM dual EMAC driver with switchdev support. Enable the PRU-ICSSM to operate in switch mode, with the 2 PRU ports acting as external ports and the host acting as an internal port. Packets received from the PRU ports will be forwarded to the host (store and forward mode) and also to the other PRU port (either using store and forward mode or via cut-through mode). Packets coming from the host will be transmitted either from one or both of the PRU ports (depending on the FDB decision). By default, the dual EMAC firmware will be loaded in the PRU-ICSS subsystem. To configure the PRU-ICSS to operate as a switch, a different firmware must to be loaded. Signed-off-by: Roger Quadros Signed-off-by: Andrew F. Davis Signed-off-by: Basharath Hussain Khaja Signed-off-by: Parvathi Pudi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260130124559.1182780-4-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit eea65b87493e1fcf9397e0f1d8cecb7d379e051b Author: Roger Quadros Date: Fri Jan 30 18:13:44 2026 +0530 net: ti: icssm-prueth: Add switchdev support for icssm_prueth driver Add support for offloading the RSTP switch feature to the PRU-ICSS subsystem by adding switchdev support. PRU-ICSS is capable of operating in RSTP switch mode with two external ports and one host port. PRUETH driver and firmware interface support will be added into icssm_prueth in the subsequent commits. Signed-off-by: Roger Quadros Signed-off-by: Andrew F. Davis Signed-off-by: Basharath Hussain Khaja Signed-off-by: Parvathi Pudi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260130124559.1182780-3-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit 4c8566a12f14c1d13bfb2c32469c06c94a60d25e Author: Roger Quadros Date: Fri Jan 30 18:13:43 2026 +0530 net: ti: icssm-prueth: Add helper functions to configure and maintain FDB Introduce helper functions to configure and maintain Forwarding Database (FDB) tables to aid with the switch mode feature for PRU-ICSS ports. The PRU-ICSS FDB is maintained such that it is always in sync with the Linux bridge driver FDB. The FDB is used by the driver to determine whether to flood a packet, received from the user plane, to both ports or direct it to a specific port using the flags in the FDB table entry. The FDB is implemented in two main components: the Index table and the MAC Address table. Adding, deleting, and maintaining entries are handled by the PRUETH driver. There are two types of entries: Dynamic: created from the received packets and are subject to aging. Static: created by the user and these entries never age out. 8-bit hash value obtained using the source MAC address is used to identify the index to the Index/Hash table. A bucket-based approach is used to collate source MAC addresses with the same hash value. The Index/Hash table holds the bucket index (16-bit value) and the number of entries in the bucket with the same hash value (16-bit value). This table can hold up to 256 entries, with each entry consuming 4 bytes of memory. The bucket index value points to the MAC address table indicating the start of MAC addresses having the same hash values. Each entry in the MAC Address table consists of: 1. 6 bytes of the MAC address, 2. 2-byte aging time, and 3. 1-byte each for port information and flags respectively. When a new entry is added to the FDB, the hash value is calculated using an XOR operation on the 6-byte MAC address. The result is used as an index into the Hash/Index table to check if any entries exist. If no entries are present, the first available empty slot in the MAC Address table is allocated to insert this MAC address. If entries with the same hash value are already present, the new MAC address entry is added to the MAC Address table in such a way that it ensures all entries are grouped together and sorted in ascending MAC address order. This approach helps efficiently manage FDB entries. Signed-off-by: Roger Quadros Signed-off-by: Andrew F. Davis Signed-off-by: Basharath Hussain Khaja Signed-off-by: Parvathi Pudi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260130124559.1182780-2-parvathi@couthit.com Signed-off-by: Jakub Kicinski commit fef1f756155c30511397bbcd9d55640ab2e44d99 Author: Harshit Mogalapalli Date: Sat Jan 10 11:53:36 2026 -0800 ASoC: cs4271: Fix resource leak in cs4271_soc_resume() Smatch detects this resource leak: sound/soc/codecs/cs4271.c:548 cs4271_soc_resume() warn: 'cs4271->clk' from clk_prepare_enable() not released on lines: 540,546. Instead of direct returns, unprepare the clock and disable regulators on the error paths. Fixes: cf6bf51b5325 ("ASoC: cs4271: Add support for the external mclk") Fixes: 9a397f473657 ("ASoC: cs4271: add regulator consumer support") Signed-off-by: Harshit Mogalapalli Reviewed-by: Charles Keepax Acked-by: Herve Codina Reviewed-by: Alexander Sverdlin Link: https://patch.msgid.link/20260110195337.2522347-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Mark Brown commit dc8384d85c034b3c3912ec7fc43784da5b884c27 Merge: 6f0fce21ba2d2e 6c52fda42066a8 Author: Mark Brown Date: Thu Feb 5 00:45:16 2026 +0000 ASoC: SOF: Support for echoref (virtual DAI) Merge series from Peter Ujfalusi : The series adds support for echo reference functionality by allowing the capturing of playback audio right before it leaves the DSP. For this to work correctly we need a virtual DAI that is also connected to the echo reference capture device and in absence of playback a signal generator generates silence to allow the capture to run. When the real playback starts, application will start to receive the playback audio to be usable for echo reference. commit 6f0fce21ba2d2e5ae3cdfb6133f14e92916f7a96 Merge: 7c2280e5392359 9db327083f7e0d Author: Mark Brown Date: Thu Feb 5 00:45:12 2026 +0000 ASoC: ti: davinci-mcasp: Add asynchronous mode Merge series from Sen Wang : This series adds asynchronous mode support to the McASP driver, which enables independent configuration of bitclocks, frame sync, and audio configurations between tx(playback) and rx(record). And achieves simultaneous playback & record using different audio configurations. It also adds two clean up patches to the McASP driver that disambiguate and simplifies the logic which avoids the async enhancement from being too convoluted to review and analyze. The implementation is based on vendor documentation and patches tested in both SK-AM62P-LP (sync mode, McASP slave) and AM62D-EVM (async mode, McASP master, rx & tx has different TDM configs). Testing verifies async mode functionality while maintaining backward compatibility with the default sync mode. Bootlog and Async mode tests on AM62D-EVM: [0] [0]: https://gist.github.com/SenWang125/f31f9172b186d414695e37c8b9ef127d commit 7c2280e53923596c6aea330bce15070d8d6a9ee2 Merge: 55137f5a68b5e8 812ff1baa76408 Author: Mark Brown Date: Thu Feb 5 00:45:07 2026 +0000 Minor SDCA Fixes Merge series from Charles Keepax : A bit of a mixed bag of minor misc fixes, improve handling of volatile SDCA Controls, make some minor bug fixes to jack detect, improve the cache syncing by adding some more defaults, and improve some FDL error messages. commit 914809c666d6c96d130da4755daa5bb0a57f0e12 Merge: 20c4701b75a3d6 fe8429a2717fc0 Author: Mark Brown Date: Thu Feb 5 00:07:58 2026 +0000 Samsung S2MPG10 regulator and S2MPG11 PMIC drivers Merge series from André Draszik : This series extends the existing S2MPG10 PMIC driver to add support for the regulators, and adds new S2MPG11 core and regulator drivers. The patches are kept together in one series, due to S2MPG11 and its regulators being very similar to S2MPG10. The Samsung S2MPG11 PMIC is a Power Management IC for mobile applications with buck converters, various LDOs, power meters, and additional GPIO interfaces. It typically complements an S2MPG10 PMIC in a main/sub configuration as the sub-PMIC and both are used on the Google Pixel 6 and 6 Pro (oriole / raven). A DT update for Oriole / Raven to enable these is required which I will send out separately. commit 6e951a9b1af5dc063dfe9e17ca433be099527c43 Merge: b2821311abbd05 47fcf4dc0a346d Author: Alexei Starovoitov Date: Wed Feb 4 13:35:29 2026 -0800 Merge branch 'bpf-improve-linked-register-tracking' Puranjay Mohan says: ==================== bpf: Improve linked register tracking V3: https://lore.kernel.org/all/20260203222643.994713-1-puranjay@kernel.org/ Changes in v3->v4: - Add a call to reg_bounds_sync() in sync_linked_regs() to sync bounds after alu op. - Add a __sink(path[0]); in the C selftest so compiler doesn't say "error: variable 'path' set but not used" V2: https://lore.kernel.org/all/20260113152529.3217648-1-puranjay@kernel.org/ Changes in v2->v3: - Added another selftest showing a real usage pattern - Rebased on bpf-next/master v1: https://lore.kernel.org/bpf/20260107203941.1063754-1-puranjay@kernel.org/ Changes in v1->v2: - Add support for alu32 operations in linked register tracking (Alexei) - Squash the selftest fix with the first patch (Eduard) - Add more selftests to detect edge cases This series extends the BPF verifier's linked register tracking to handle negative offsets, BPF_SUB operations, and alu32 operations, enabling better bounds propagation for common arithmetic patterns. The verifier previously only tracked positive constant deltas between linked registers using BPF_ADD. This meant patterns using negative offsets or subtraction couldn't benefit from bounds propagation: void alu32_negative_offset(void) { volatile char path[5]; volatile int offset = bpf_get_prandom_u32(); int off = offset; if (off >= 5 && off < 10) path[off - 5] = '.'; } this gets compiled to: 0000000000000478 : 143: call 0x7 144: *(u32 *)(r10 - 0xc) = w0 145: w1 = *(u32 *)(r10 - 0xc) 146: w2 = w1 // w2 and w1 share the same id 147: w2 += -0x5 // verifier knows w1 = w2 + 5 148: if w2 > 0x4 goto +0x5 // in fall-through: verifier knows w2 ∈ [0,4] => w1 ∈ [5, 9] 149: r2 = r10 150: r2 += -0x5 // r2 = fp - 5 151: r2 += r1 // r2 = fp - 5 + r1 (∈ [5, 9]) => r2 ∈ [fp, fp + 4] 152: w1 = 0x2e 153: *(u8 *)(r2 - 0x5) = w1 // r2 ∈ [fp, fp + 4] => r2 - 5 ∈ [fp - 5, fp - 1] : 154: exit After the changes, the verifier could link 32-bit scalars and also supported -ve offsets for linking: 146: w2 = w1 147: w2 += -0x5 It allowed the verifier to correctly propagate bounds, without the changes in this patchset, verifier would reject this program with: invalid unbounded variable-offset write to stack R2 This program has been added as a selftest in the second patch. Veristat comparison on programs from sched_ext, selftests, and some meta internal programs: Scx Progs File Program Verdict (A) Verdict (B) Verdict (DIFF) Insns (A) Insns (B) Insns (DIFF) ----------------- ---------------- ----------- ----------- -------------- --------- --------- ------------- scx_layered.bpf.o layered_runnable success success MATCH 5674 6077 +403 (+7.10%) FB Progs File Program Verdict (A) Verdict (B) Verdict (DIFF) Insns (A) Insns (B) Insns (DIFF) ------------ ---------------- ----------- ----------- -------------- --------- --------- ----------------- bpf232.bpf.o layered_dump success success MATCH 1151 1218 +67 (+5.82%) bpf257.bpf.o layered_runnable success success MATCH 5743 6143 +400 (+6.97%) bpf252.bpf.o layered_runnable success success MATCH 5677 6075 +398 (+7.01%) bpf227.bpf.o layered_dump success success MATCH 915 982 +67 (+7.32%) bpf239.bpf.o layered_runnable success success MATCH 5459 5861 +402 (+7.36%) bpf246.bpf.o layered_runnable success success MATCH 5562 6008 +446 (+8.02%) bpf229.bpf.o layered_runnable success success MATCH 2559 3011 +452 (+17.66%) bpf231.bpf.o layered_runnable success success MATCH 2559 3011 +452 (+17.66%) bpf234.bpf.o layered_runnable success success MATCH 2549 3001 +452 (+17.73%) bpf019.bpf.o do_sendmsg success success MATCH 124823 153523 +28700 (+22.99%) bpf019.bpf.o do_parse success success MATCH 124809 153509 +28700 (+23.00%) bpf227.bpf.o layered_runnable success success MATCH 1915 2356 +441 (+23.03%) bpf228.bpf.o layered_runnable success success MATCH 1700 2152 +452 (+26.59%) bpf232.bpf.o layered_runnable success success MATCH 1499 1951 +452 (+30.15%) bpf312.bpf.o mount_exit success success MATCH 19253 62883 +43630 (+226.61%) bpf312.bpf.o umount_exit success success MATCH 19253 62883 +43630 (+226.61%) bpf311.bpf.o mount_exit success success MATCH 19226 62863 +43637 (+226.97%) bpf311.bpf.o umount_exit success success MATCH 19226 62863 +43637 (+226.97%) The above four programs have specific patters that make the verifier explore a lot more states: for (; depth < MAX_DIR_DEPTH; depth++) { const unsigned char* name = BPF_CORE_READ(dentry, d_name.name); if (offset >= MAX_PATH_LEN - MAX_DIR_LEN) { return depth; } int len = bpf_probe_read_kernel_str(&path[offset], MAX_DIR_LEN, name); offset += len; if (len == MAX_DIR_LEN) { if (offset - 2 < MAX_PATH_LEN) { // <---- (a) path[offset - 2] = '.'; } if (offset - 3 < MAX_PATH_LEN) { // <---- (b) path[offset - 3] = '.'; } if (offset - 4 < MAX_PATH_LEN) { // <---- (c) path[offset - 4] = '.'; } } } When at some depth == N false branches of conditions (a), (b) and (c) are scheduled for verification, constraints for offset at depth == N+1 are: 1. offset >= MAX_PATH_LEN + 2 2. offset >= MAX_PATH_LEN + 3 3. offset >= MAX_PATH_LEN + 4 (visited before others) And after offset += len it becomes: 1. offset >= MAX_PATH_LEN - 4093 2. offset >= MAX_PATH_LEN - 4092 3. offset >= MAX_PATH_LEN - 4091 (visited before others) Because of the DFS states exploration logic, the states above are visited in order 3, 2, 1; 3 is not a subset of 2 and 1 is not a subset of 2, so pruning logic does not kick in. Previously this was not a problem, because range for offset was not propagated through the statements (a), (b), (c). As the root cause of this regression is understood, this is not a blocker for this change. Selftest Progs File Program Verdict (A) Verdict (B) Verdict (DIFF) Insns (A) Insns (B) Insns (DIFF) ---------------------------------- ------------------------ ----------- ----------- -------------- --------- --------- -------------- linked_list_peek.bpf.o list_peek success success MATCH 152 88 -64 (-42.11%) verifier_iterating_callbacks.bpf.o cond_break2 success success MATCH 110 88 -22 (-20.00%) These are the added selftests that failed earlier but are passing now: verifier_linked_scalars.bpf.o alu32_negative_offset failure success MISMATCH 11 13 +2 (+18.18%) verifier_linked_scalars.bpf.o scalars_alu32_big_offset failure success MISMATCH 7 10 +3 (+42.86%) verifier_linked_scalars.bpf.o scalars_neg_alu32_add failure success MISMATCH 7 10 +3 (+42.86%) verifier_linked_scalars.bpf.o scalars_neg_alu32_sub failure success MISMATCH 7 10 +3 (+42.86%) verifier_linked_scalars.bpf.o scalars_neg failure success MISMATCH 7 10 +3 (+42.86%) verifier_linked_scalars.bpf.o scalars_neg_sub failure success MISMATCH 7 10 +3 (+42.86%) verifier_linked_scalars.bpf.o scalars_sub_neg_imm failure success MISMATCH 7 10 +3 (+42.86%) iters.bpf.o iter_obfuscate_counter success success MATCH 83 119 +36 (+43.37%) bpf_cubic.bpf.o bpf_cubic_acked success success MATCH 243 430 +187 (+76.95%) ==================== Link: https://patch.msgid.link/20260204151741.2678118-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 47fcf4dc0a346dd0b873a679c547d6848bd85a37 Author: Puranjay Mohan Date: Wed Feb 4 07:17:38 2026 -0800 selftests/bpf: Add tests for improved linked register tracking Add tests for linked register tracking with negative offsets, BPF_SUB, and alu32. These test for all edge cases like overflows, etc. Signed-off-by: Puranjay Mohan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260204151741.2678118-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 7a433e519364c3c19643e5c857f4fbfaebec441c Author: Puranjay Mohan Date: Wed Feb 4 07:17:37 2026 -0800 bpf: Support negative offsets, BPF_SUB, and alu32 for linked register tracking Previously, the verifier only tracked positive constant deltas between linked registers using BPF_ADD. This limitation meant patterns like: r1 = r0; r1 += -4; if r1 s>= 0 goto l0_%=; // r1 >= 0 implies r0 >= 4 // verifier couldn't propagate bounds back to r0 if r0 != 0 goto l0_%=; r0 /= 0; // Verifier thinks this is reachable l0_%=: Similar limitation exists for 32-bit registers. With this change, the verifier can now track negative deltas in reg->off enabling bound propagation for the above pattern. For alu32, we make sure the destination register has the upper 32 bits as 0s before creating the link. BPF_ADD_CONST is split into BPF_ADD_CONST64 and BPF_ADD_CONST32, the latter is used in case of alu32 and sync_linked_regs uses this to zext the result if known_reg has this flag. Signed-off-by: Puranjay Mohan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260204151741.2678118-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit b2821311abbd05d3340ad7f09fe89f088572b682 Merge: 4af526698b15ec 56415363e02f0f Author: Alexei Starovoitov Date: Wed Feb 4 13:22:40 2026 -0800 Merge branch 'bpf-add-bitwise-tracking-for-bpf_end' Tianci Cao says: ==================== bpf: Add bitwise tracking for BPF_END Add bitwise tracking (tnum analysis) for BPF_END (`bswap(16|32|64)`, `be(16|32|64)`, `le(16|32|64)`) operations. Please see commit log of 1/2 for more details. v3: - Resend to fix a version control error in v2. - The rest of the changes are identical to v2. v2 (incorrect): https://lore.kernel.org/bpf/20260204091146.52447-1-ziye@zju.edu.cn/ - Refactored selftests using BSWAP_RANGE_TEST macro to eliminate code duplication and improve maintainability. (Eduard) - Simplified test names. (Eduard) - Reduced excessive comments in test cases. (Eduard) - Added more comments to explain BPF_END's special handling of zext_32_to_64. v1: https://lore.kernel.org/bpf/20260202133536.66207-1-ziye@zju.edu.cn/ ==================== Link: https://patch.msgid.link/20260204111503.77871-1-ziye@zju.edu.cn Signed-off-by: Alexei Starovoitov commit 56415363e02f0f561ecc5bda6a4318438f888b43 Author: Tianci Cao Date: Wed Feb 4 19:15:03 2026 +0800 selftests/bpf: Add tests for BPF_END bitwise tracking Now BPF_END has bitwise tracking support. This patch adds selftests to cover various cases of BPF_END (`bswap(16|32|64)`, `be(16|32|64)`, `le(16|32|64)`) with bitwise propagation. This patch is based on existing `verifier_bswap.c`, and add several types of new tests: 1. Unconditional byte swap operations: - bswap16/bswap32/bswap64 with unknown bytes 2. Endian conversion operations (architecture-aware): - be16/be32/be64: convert to big-endian * on little-endian: do swap * on big-endian: truncation (16/32-bit) or no-op (64-bit) - le16/le32/le64: convert to little-endian * on big-endian: do swap * on little-endian: truncation (16/32-bit) or no-op (64-bit) Each test simulates realistic networking scenarios where a value is masked with unknown bits (e.g., var_off=(0x0; 0x3f00), range=[0,0x3f00]), then byte-swapped, and the verifier must prove the result stays within expected bounds. Specifically, these selftests are based on dead code elimination: If the BPF verifier can precisely track bitwise through byte swap operations, it can prune the trap path (invalid memory access) that should be unreachable, allowing the program to pass verification. If bitwise tracking is incorrect, the verifier cannot prove the trap is unreachable, causing verification failure. The tests use preprocessor conditionals (#ifdef __BYTE_ORDER__) to verify correct behavior on both little-endian and big-endian architectures, and require Clang 18+ for bswap instruction support. Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Co-developed-by: Yazhou Tang Signed-off-by: Yazhou Tang Signed-off-by: Tianci Cao Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260204111503.77871-3-ziye@zju.edu.cn Signed-off-by: Alexei Starovoitov commit 9d21199842247ab05c675fb9b6c6ca393a5c0024 Author: Tianci Cao Date: Wed Feb 4 19:15:02 2026 +0800 bpf: Add bitwise tracking for BPF_END This patch implements bitwise tracking (tnum analysis) for BPF_END (byte swap) operation. Currently, the BPF verifier does not track value for BPF_END operation, treating the result as completely unknown. This limits the verifier's ability to prove safety of programs that perform endianness conversions, which are common in networking code. For example, the following code pattern for port number validation: int test(struct pt_regs *ctx) { __u64 x = bpf_get_prandom_u32(); x &= 0x3f00; // Range: [0, 0x3f00], var_off: (0x0; 0x3f00) x = bswap16(x); // Should swap to range [0, 0x3f], var_off: (0x0; 0x3f) if (x > 0x3f) goto trap; return 0; trap: return *(u64 *)NULL; // Should be unreachable } Currently generates verifier output: 1: (54) w0 &= 16128 ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=16128,var_off=(0x0; 0x3f00)) 2: (d7) r0 = bswap16 r0 ; R0=scalar() 3: (25) if r0 > 0x3f goto pc+2 ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=63,var_off=(0x0; 0x3f)) Without this patch, even though the verifier knows `x` has certain bits set, after bswap16, it loses all tracking information and treats port as having a completely unknown value [0, 65535]. According to the BPF instruction set[1], there are 3 kinds of BPF_END: 1. `bswap(16|32|64)`: opcode=0xd7 (BPF_END | BPF_ALU64 | BPF_TO_LE) - do unconditional swap 2. `le(16|32|64)`: opcode=0xd4 (BPF_END | BPF_ALU | BPF_TO_LE) - on big-endian: do swap - on little-endian: truncation (16/32-bit) or no-op (64-bit) 3. `be(16|32|64)`: opcode=0xdc (BPF_END | BPF_ALU | BPF_TO_BE) - on little-endian: do swap - on big-endian: truncation (16/32-bit) or no-op (64-bit) Since BPF_END operations are inherently bit-wise permutations, tnum (bitwise tracking) offers the most efficient and precise mechanism for value analysis. By implementing `tnum_bswap16`, `tnum_bswap32`, and `tnum_bswap64`, we can derive exact `var_off` values concisely, directly reflecting the bit-level changes. Here is the overview of changes: 1. In `tnum_bswap(16|32|64)` (kernel/bpf/tnum.c): Call `swab(16|32|64)` function on the value and mask of `var_off`, and do truncation for 16/32-bit cases. 2. In `adjust_scalar_min_max_vals` (kernel/bpf/verifier.c): Call helper function `scalar_byte_swap`. - Only do byte swap when * alu64 (unconditional swap) OR * switching between big-endian and little-endian machines. - If need do byte swap: * Firstly call `tnum_bswap(16|32|64)` to update `var_off`. * Then reset the bound since byte swap scrambles the range. - For 16/32-bit cases, truncate dst register to match the swapped size. This enables better verification of networking code that frequently uses byte swaps for protocol processing, reducing false positive rejections. [1] https://www.kernel.org/doc/Documentation/bpf/standardization/instruction-set.rst Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Co-developed-by: Yazhou Tang Signed-off-by: Yazhou Tang Signed-off-by: Tianci Cao Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260204111503.77871-2-ziye@zju.edu.cn Signed-off-by: Alexei Starovoitov commit 4af526698b15ec6cb3c8ad8085335b1d55692f00 Merge: 5e6e1dc43a2176 6e65cf81accf90 Author: Andrii Nakryiko Date: Wed Feb 4 13:12:51 2026 -0800 Merge branch 'bpf-fix-conditions-when-timer-wq-can-be-called' Alexei Starovoitov says: ==================== bpf: Fix conditions when timer/wq can be called From: Alexei Starovoitov v2->v3: - Add missing refcount_put - Detect recursion of indiviual async_cb v2: https://lore.kernel.org/bpf/20260204040834.22263-4-alexei.starovoitov@gmail.com/ v1->v2: - Add a recursion check v1: https://lore.kernel.org/bpf/20260204030927.171-1-alexei.starovoitov@gmail.com/ ==================== Link: https://patch.msgid.link/20260204055147.54960-1-alexei.starovoitov@gmail.com Signed-off-by: Andrii Nakryiko commit 6e65cf81accf908d2480739b85dba4731048290d Author: Alexei Starovoitov Date: Tue Feb 3 21:51:47 2026 -0800 selftests/bpf: Strengthen timer_start_deadlock test Strengthen timer_start_deadlock test and check for recursion now Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260204055147.54960-5-alexei.starovoitov@gmail.com commit 64873307e888505ccc45ef049dccdcfef42d2f54 Author: Alexei Starovoitov Date: Tue Feb 3 21:51:46 2026 -0800 bpf: Add a recursion check to prevent loops in bpf_timer Do not schedule timer/wq operation on a cpu that is in irq_work callback that is processing async_cmds queue. Otherwise the following loop is possible: bpf_timer_start() -> bpf_async_schedule_op() -> irq_work_queue(). irqrestore -> bpf_async_irq_worker() -> tracepoint -> bpf_timer_start(). Fixes: 1bfbc267ec91 ("bpf: Enable bpf_timer and bpf_wq in any context") Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260204055147.54960-4-alexei.starovoitov@gmail.com commit 67ee5ad27d5101be4e9e8980c0734a0423bfd0a7 Author: Alexei Starovoitov Date: Tue Feb 3 21:51:45 2026 -0800 selftests/bpf: Add a testcase for deadlock avoidance Add a testcase that checks that deadlock avoidance is working as expected. Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260204055147.54960-3-alexei.starovoitov@gmail.com commit 7d49635e3775da946e536bc81ab55b2bca6b791d Author: Alexei Starovoitov Date: Tue Feb 3 21:51:44 2026 -0800 bpf: Tighten conditions when timer/wq can be called synchronously Though hrtimer_start/cancel() inlines all of the smaller helpers in hrtimer.c and only call timerqueue_add/del() from lib/timerqueue.c where everything is not traceable and not kprobe-able (because all files in lib/ are not traceable), there are tracepoints within hrtimer that are called with locks held. Therefore prevent the deadlock by tightening conditions when timer/wq can be called synchronously. hrtimer/wq are using raw_spin_lock_irqsave(), so irqs_disabled() is enough. Fixes: 1bfbc267ec91 ("bpf: Enable bpf_timer and bpf_wq in any context") Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260204055147.54960-2-alexei.starovoitov@gmail.com commit 69674c1c704c0199ca7a3947f3cdcd575973175d Author: Lizhi Hou Date: Wed Feb 4 09:11:17 2026 -0800 accel/amdxdna: Move RPM resume into job run function Currently, amdxdna_pm_resume_get() is called during job creation, and amdxdna_pm_suspend_put() is called when the hardware notifies job completion. If a job is canceled before it is run, no hardware completion notification is generated, resulting in an unbalanced runtime PM resume/suspend pair. Fix this by moving amdxdna_pm_resume_get() to the job run path, ensuring runtime PM is only resumed for jobs that are actually executed. Fixes: 063db451832b ("accel/amdxdna: Enhance runtime power management") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260204171118.3165607-1-lizhi.hou@amd.com commit d19d963d2a4acb5bbf03e25733ba565a7f6e1422 Author: Lizhi Hou Date: Wed Feb 4 09:10:48 2026 -0800 accel/amdxdna: Fix incorrect DPM level after suspend/resume The suspend routine sets the DPM level to 0, which unintentionally overwrites the previously saved DPM level. As a result, the device always resumes with DPM level 0 instead of restoring the original value. Fix this by ensuring the suspend path does not overwrite the saved DPM level, allowing the correct DPM level to be restored during resume. Fixes: f4d7b8a6bc8c ("accel/amdxdna: Enhance power management settings") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260204171048.3165580-1-lizhi.hou@amd.com commit a9c7a1a292794e15fefe20a664898d57f685ced7 Author: Len Brown Date: Tue Feb 3 19:34:45 2026 -0600 tools/power turbostat: Remove redundant newlines from err(3) strings err(3) supplies a newline at the end of the string. No need to end err(3) strings with '\n'. Signed-off-by: Len Brown commit b991074a5144d740ae3812a54e138aaaaf12dc7a Author: Len Brown Date: Tue Feb 3 19:30:49 2026 -0600 tools/power turbostat: Allow more use of is_hybrid flag The "is_hybrid" is set and used only in !quiet mode. Make it valid in both quiet and !quiet mode to allow more uses. Signed-off-by: Len Brown commit 041e975937123ee22a7925e468ab73b8a8991767 Author: Len Brown Date: Sat Jan 24 22:39:02 2026 -0600 tools/power turbostat: Rename "LLCkRPS" column to "LLCMRPS" The purpose of the LLC References per Second LLC column is to qualify the significance of the LLC%hit column. If RPS is high, then the hit rate matters. If RPS is low, then the hit rate is not significant. Remove unnecessary and distracting precision in the RPS column by dividing my a million rather than by a thousand. Signed-off-by: Len Brown commit 785953cf6e63aa5a9fcdfa9577b1411e0281c4bc Author: Len Brown Date: Wed Dec 10 13:33:29 2025 -0500 tools/power turbostat.8: Document the "--force" option Starting in turbostat v2025.01.14, turbostat refused to run on unsupported hardware, pointing to "RUN THE LATEST VERSION" on turbostat(8). At that time, turbostat supported and advertised the "--force" parameter to run anyway (with unsupported results). Also document "--force" on turbostat.8. Signed-off-by: Len Brown commit d0f7093ad5e4aa37405da2669bca1a62d22b7025 Author: Len Brown Date: Mon Dec 8 10:01:04 2025 -0500 tools/power turbostat: Harden against unexpected values Divide-by-zero resulted if LLC references == 0 Pull the percentage division into pct() to centralize sanity checks there. Fixes: 8808292799b0 ("tools/power turbostat: Print "nan" for out of range percentages") Signed-off-by: Len Brown commit 61764831d5b148a9f3afe7ac35089e5908c92a81 Author: Len Brown Date: Fri Dec 5 12:24:20 2025 -0500 tools/power turbostat: Dump hypervisor name Sometimes useful to know which hypervisor is running beneath us... Signed-off-by: Len Brown commit 00b9e2a7fa671e960f8d708b06fb6b4b87ffec15 Author: Len Brown Date: Fri Dec 5 11:38:27 2025 -0500 tools/power turbostat: Dump CPUID.1.ECX[31] (Hypervisor) Both Intel and AMD use CPUID.1.ECX[31] to distinguish between hypervisor and real hardware. Indicate "HV" or "No-HV" accordingly. Signed-off-by: Len Brown commit bd1b6608d7640aa8b1f1afa831331df7c13184ad Author: Len Brown Date: Fri Dec 5 11:26:40 2025 -0500 tools/power turbostat: Dump CPUID(1) consistently with CPUID(6) We dumped selected CPUID(1) features using a format that showed '-' for a missing feature. Not so friendly to parse a bunch of dashes when features are missing... For CPUID(1) adopt the format we used for CPUID(6): 'No-FEATURE' means that 'FEATURE' is not present. Signed-off-by: Len Brown commit 16cc8f249c702b7cbb4c2c2be7cd8f4fdd5d1d0c Author: Len Brown Date: Wed Feb 4 14:41:53 2026 -0600 tools/power turbostat: AMD: msr offset 0x611 read failed: Input/output error Turbostat exits during RAPL probe with: turbostat: cpu0: msr offset 0x611 read failed: Input/output error A binary with this bug can be used successfully with the option "--no-msr" Fix this regression by trusting the static AMD RAPL MSR offset. Fixes: 19476a592bf2 ("tools/power turbostat: Validate RAPL MSRs for AWS Nitro Hypervisor") Signed-off-by: Len Brown commit ae40ace015be442837934c5028a8eba7fe3cd98f Author: Rosalie Wanders Date: Fri Jan 30 07:57:51 2026 +0100 HID: sony: add dongle device IDs for CRKD Gibson SG This patch adds the dongle device IDs for the CRKD Gibson SG Signed-off-by: Rosalie Wanders Signed-off-by: Jiri Kosina commit 0f64b6acb0e14559daf1de7be5dbcee3874512aa Merge: 931688a44a2b1a 56f79097105712 Author: Rafael J. Wysocki Date: Wed Feb 4 21:16:12 2026 +0100 Merge branch 'pm-tools' Merge cpupower utility updates for 6.20-rc1/7.0-rc1: - Fix miscellaneous problems in cpupower (Kaushlendra Kumar): * idle_monitor: Fix incorrect value logged after stop * Fix inverted APERF capability check * Use strcspn() to strip trailing newline * Reset errno before strtoull() * Show C0 in idle-info dump - Improve cpupower installation procedure by making the systemd step optional and allowing users to disable the installation of systemd's unit file (João Marcos Costa) * pm-tools: cpupower: make systemd unit installation optional tools/power cpupower: Show C0 in idle-info dump tools/power cpupower: Reset errno before strtoull() tools/cpupower: Use strcspn() to strip trailing newline tools/cpupower: Fix inverted APERF capability check cpupower: idle_monitor: fix incorrect value logged after stop commit 931688a44a2b1a115cfaa229accb255f890196f3 Merge: 073dcc02837030 54b3cd55a515c7 e121ed77c1451b 1c7442d10b031a Author: Rafael J. Wysocki Date: Wed Feb 4 21:06:22 2026 +0100 Merge branches 'pm-powercap', 'pm-opp' and 'pm-em' Merge power capping updates, OPP (operating performance points) updates and energy model management documentation updates for 6.20-rc1/7.0-rc1: - Add PL4 support for Ice Lake to the Intel RAPL power capping driver (Daniel Tang) - Replace sprintf() with sysfs_emit() in power capping sysfs show functions (Sumeet Pawnikar) - Make dev_pm_opp_get_level() return value match the documentation after a previous update of the latter (Aleks Todorov) - Use scoped for each OF child loop in the OPP code (Krzysztof Kozlowski) - Fix a bug in an example code snippet and correct typos in the energy model management documentation (Patrick Little) * pm-powercap: powercap: intel_rapl: Add PL4 support for Ice Lake powercap: Replace sprintf() with sysfs_emit() in sysfs show functions * pm-opp: OPP: Return correct value in dev_pm_opp_get_level OPP: of: Simplify with scoped for each OF child loop * pm-em: PM: EM: Documentation: Fix bug in example code snippet Documentation: Fix typos in energy model documentation commit d19512f5abb198daf29da877f6a02c667a95c03d Author: Dave Airlie Date: Wed Feb 4 13:00:07 2026 +1000 nouveau/vmm: start tracking if the LPT PTE is valid. (v6) When NVK enabled large pages userspace tests were seeing fault reports at a valid address. There was a case where an address moving from 64k page to 4k pages could expose a race between unmapping the 4k page, mapping the 64k page and unref the 4k pages. Unref 4k pages would cause the dual-page table handling to always set the LPTE entry to SPARSE or INVALID, but if we'd mapped a valid LPTE in the meantime, it would get trashed. Keep track of when a valid LPTE has been referenced, and don't reset in that case. This adds an lpte valid tracker and lpte reference count. Whenever an lpte is referenced, it gets made valid and the ref count increases, whenever it gets unreference the refcount is tracked. Link: https://gitlab.freedesktop.org/mesa/mesa/-/issues/14610 Reviewed-by: Mary Guillemard Tested-by: Mary Guillemard Tested-by: Mel Henning Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260204030208.2313241-4-airlied@gmail.com commit 9dc983a85eb9b546bbe2ef3f2345e338aa655789 Author: Dave Airlie Date: Wed Feb 4 13:00:06 2026 +1000 nouveau/vmm: increase size of vmm pte tracker struct to u32 (v2) We need to tracker large counts of spte than previously due to unref getting delayed sometimes. This doesn't fix LPT tracking yet, it just creates space for it. Reviewed-by: Mary Guillemard Tested-by: Mary Guillemard Tested-by: Mel Henning Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260204030208.2313241-3-airlied@gmail.com commit c4d53e567d3b6f6211d013e6c5c3672b26a49845 Author: Dave Airlie Date: Wed Feb 4 13:00:05 2026 +1000 nouveau/vmm: rewrite pte tracker using a struct and bitfields. I want to increase the counters here and start tracking LPTs as well as there are certain situations where userspace with mixed page sizes can cause ref/unrefs to live longer so need better reference counting. This should be entirely non-functional. Reviewed-by: Mary Guillemard Tested-by: Mary Guillemard Tested-by: Mel Henning Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260204030208.2313241-2-airlied@gmail.com commit 073dcc0283703035cd4e6bf6aa11fbc63b8a9ca5 Merge: c233403593f55c 75e8635832a2e4 Author: Rafael J. Wysocki Date: Wed Feb 4 21:03:18 2026 +0100 Merge branch 'pm-runtime' Merge updates related to runtime PM for 6.20-rc1/7.0-rc1: - Make several drivers discard pm_runtime_put() return value in preparation for converting that function to a void one (Rafael Wysocki) * pm-runtime: drm: Discard pm_runtime_put() return value genirq/chip: Change irq_chip_pm_put() return type to void scsi: ufs: core: Discard pm_runtime_put() return values platform/chrome: cros_hps_i2c: Discard pm_runtime_put() return value coresight: Discard pm_runtime_put() return values hwspinlock: omap: Discard pm_runtime_put() return value watchdog: rzv2h_wdt: Discard pm_runtime_put() return value watchdog: rz: Discard pm_runtime_put() return values media: ccs: Discard pm_runtime_put() return value drm/imagination: Discard pm_runtime_put() return value USB: core: Discard pm_runtime_put() return value commit c233403593f55c5211c0806d9869508490f218c7 Merge: 6d367141eb68ce 0491f3f9f664e7 Author: Rafael J. Wysocki Date: Wed Feb 4 20:52:09 2026 +0100 Merge branch 'pm-sleep' Merge updates related to system suspend and hibernation for 6.20-rc1/7.0-rc1: - Stop flagging the PM runtime workqueue as freezable to avoid system suspend and resume deadlocks in subsystems that assume asynchronous runtime PM to work during system-wide PM transitions (Rafael Wysocki) - Drop redundant NULL pointer checks before acomp_request_free() from the hibernation code handling image saving (Rafael Wysocki) - Update wakeup_sources_walk_start() to handle empty lists of wakeup sources as appropriate (Samuel Wu) - Make dev_pm_clear_wake_irq() check the power.wakeirq value under power.lock to avoid race conditions (Gui-Dong Han) - Avoid bit field races related to power.work_in_progress in the core device suspend code (Xuewen Yan) * pm-sleep: PM: sleep: core: Avoid bit field races related to work_in_progress PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races PM: wakeup: Handle empty list in wakeup_sources_walk_start() PM: hibernate: Drop NULL pointer checks before acomp_request_free() PM: sleep: Do not flag runtime PM workqueue as freezable commit 6d367141eb68ced4d1e1fc97e97c59be1daa3085 Merge: 3bd1cde3dffbb2 a971f984b8455d Author: Rafael J. Wysocki Date: Wed Feb 4 20:34:26 2026 +0100 Merge branch 'pm-cpuidle' Merge cpuidle updates for 6.20-rc1/7.0-rc1: - Add a command line option to adjust the C-states table in the intel_idle driver, remove the 'preferred_cstates' module parameter from it, add C-states validation to it and clean it up (Artem Bityutskiy) - Make the menu cpuidle governor always check the time till the closest timer event when the scheduler tick has been stopped to prevent it from mistakenly selecting the deepest available idle state (Rafael Wysocki) - Update the teo cpuidle governor to avoid making suboptimal decisions in certain corner cases and generally improve idle state selection accuracy (Rafael Wysocki) - Remove an unlikely() annotation on the early-return condition in menu_select() that leads to branch misprediction 100% of the time on systems with only 1 idle state enabled, like ARM64 servers (Breno Leitao) - Add Christian Loehle to MAINTAINERS as a cpuidle reviewer (Christian Loehle) * pm-cpuidle: cpuidle: governors: teo: Refine intercepts-based idle state lookup cpuidle: governors: teo: Adjust the classification of wakeup events cpuidle: governors: teo: Refine tick_intercepts vs total events check cpuidle: governors: teo: Avoid fake intercepts produced by tick cpuidle: governors: teo: Avoid selecting states with zero-size bins cpuidle: governors: menu: Always check timers with tick stopped MAINTAINERS: Add myself as cpuidle reviewer cpuidle: menu: Remove incorrect unlikely() annotation intel_idle: Add C-states validation intel_idle: Add cmdline option to adjust C-states table intel_idle: Initialize sysfs after cpuidle driver initialization intel_idle: Remove the 'preferred_cstates' parameter intel_idle: Remove unused driver version constant commit 433fbcac9ebe491b518b21c7305fba9a748c7d2c Author: Eric Biggers Date: Mon Feb 2 13:33:39 2026 -0800 fsverity: remove inode from fsverity_verification_ctx This field is no longer used, so remove it. Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260202213339.143683-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit f77f281b61183a5c0b87e6a4d101c70bd32c1c79 Author: Christoph Hellwig Date: Mon Feb 2 07:06:40 2026 +0100 fsverity: use a hashtable to find the fsverity_info Use the kernel's resizable hash table (rhashtable) to find the fsverity_info. This way file systems that want to support fsverity don't have to bloat every inode in the system with an extra pointer. The trade-off is that looking up the fsverity_info is a bit more expensive now, but the main operations are still dominated by I/O and hashing overhead. The rhashtable implementations requires no external synchronization, and the _fast versions of the APIs provide the RCU critical sections required by the implementation. Because struct fsverity_info is only removed on inode eviction and does not contain a reference count, there is no need for an extended critical section to grab a reference or validate the object state. The file open path uses rhashtable_lookup_get_insert_fast, which can either find an existing object for the hash key or insert a new one in a single atomic operation, so that concurrent opens never instantiate duplicate fsverity_info structure. FS_IOC_ENABLE_VERITY must already be synchronized by a combination of i_rwsem and file system flags and uses rhashtable_lookup_insert_fast, which errors out on an existing object for the hash key as an additional safety check. Because insertion into the hash table now happens before S_VERITY is set, fsverity just becomes a barrier and a flag check and doesn't have to look up the fsverity_info at all, so there is only a single lookup per ->read_folio or ->readahead invocation. For btrfs there is an additional one for each bio completion, while for ext4 and f2fs the fsverity_info is stored in the per-I/O context and reused for the completion workqueue. Signed-off-by: Christoph Hellwig Reviewed-by: "Darrick J. Wong" Link: https://lore.kernel.org/r/20260202060754.270269-12-hch@lst.de [EB: folded in fix for missing fsverity_free_info()] Signed-off-by: Eric Biggers commit b0160e4501bb3572d9ef6e4f8edf758193ee37aa Author: Christoph Hellwig Date: Mon Feb 2 07:06:39 2026 +0100 btrfs: consolidate fsverity_info lookup Look up the fsverity_info once in btrfs_do_readpage, and then use it for all operations performed there, and do the same in end_folio_read for all folios processed there. The latter is also changed to derive the inode from the btrfs_bio - while bbio->inode is optional, it is always set for buffered reads. This amortizes the lookup better once it becomes less efficient. Signed-off-by: Christoph Hellwig Acked-by: David Sterba Link: https://lore.kernel.org/r/20260202060754.270269-11-hch@lst.de Signed-off-by: Eric Biggers commit 45dcb3ac9832650e5fdc2046cc7cdb97cebbb888 Author: Christoph Hellwig Date: Mon Feb 2 07:06:38 2026 +0100 f2fs: consolidate fsverity_info lookup Look up the fsverity_info once in f2fs_mpage_readpages, and then use it for the readahead, local verification of holes and pass it along to the I/O completion workqueue in struct bio_post_read_ctx. Do the same thing in f2fs_get_read_data_folio for reads that come from garbage collection and other background activities. This amortizes the lookup better once it becomes less efficient. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260202060754.270269-10-hch@lst.de Signed-off-by: Eric Biggers commit d0b57f0962adcc2a92947a9fd9b86216b5322797 Author: Christoph Hellwig Date: Mon Feb 2 07:06:37 2026 +0100 ext4: consolidate fsverity_info lookup Look up the fsverity_info once in ext4_mpage_readpages, and then use it for the readahead, local verification of holes and pass it along to the I/O completion workqueue in struct bio_post_read_ctx. This amortizes the lookup better once it becomes less efficient. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Reviewed-by: "Darrick J. Wong" Link: https://lore.kernel.org/r/20260202060754.270269-9-hch@lst.de Signed-off-by: Eric Biggers commit a9ba6733c7f1096c4506bf4e34a546e07242df74 Author: Li Chen Date: Tue Feb 3 10:13:51 2026 +0800 nvdimm: virtio_pmem: serialize flush requests Under heavy concurrent flush traffic, virtio-pmem can overflow its request virtqueue (req_vq): virtqueue_add_sgs() starts returning -ENOSPC and the driver logs "no free slots in the virtqueue". Shortly after that the device enters VIRTIO_CONFIG_S_NEEDS_RESET and flush requests fail with "virtio pmem device needs a reset". Serialize virtio_pmem_flush() with a per-device mutex so only one flush request is in-flight at a time. This prevents req_vq descriptor overflow under high concurrency. Reproducer (guest with virtio-pmem): - mkfs.ext4 -F /dev/pmem0 - mount -t ext4 -o dax,noatime /dev/pmem0 /mnt/bench - fio: ioengine=io_uring rw=randwrite bs=4k iodepth=64 numjobs=64 direct=1 fsync=1 runtime=30s time_based=1 - dmesg: "no free slots in the virtqueue" "virtio pmem device needs a reset" Fixes: 6e84200c0a29 ("virtio-pmem: Add virtio pmem driver") Signed-off-by: Li Chen Acked-by: Pankaj Gupta Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260203021353.121091-1-me@linux.beauty Signed-off-by: Ira Weiny commit 5145b277309f3818e2db507f525d19ac3b910922 Author: Kommula Shiva Shankar Date: Fri Jan 2 12:27:03 2026 +0530 vhost: fix caching attributes of MMIO regions by setting them explicitly Explicitly set non-cached caching attributes for MMIO regions. Default write-back mode can cause CPU to cache device memory, causing invalid reads and unpredictable behavior. Invalid read and write issues were observed on ARM64 when mapping the notification area to userspace via mmap. Signed-off-by: Kommula Shiva Shankar Acked-by: Jason Wang Reviewed-by: Jason Gunthorpe Signed-off-by: Michael S. Tsirkin Message-Id: <20260102065703.656255-1-kshankar@marvell.com> commit 503ef41e88080fb2d2399173e34d26e59567fb5e Author: Cindy Lu Date: Mon Jan 26 17:45:38 2026 +0800 vdpa/mlx5: update MAC address handling in mlx5_vdpa_set_attr() Improve MAC address handling in mlx5_vdpa_set_attr() to ensure that old MAC entries are properly removed from the MPFS table before adding a new one. The new MAC address is then added to both the MPFS and VLAN tables. This change fixes an issue where the updated MAC address would not take effect until QEMU was rebooted. Signed-off-by: Cindy Lu Reviewed-by: Dragos Tatulea Signed-off-by: Michael S. Tsirkin Message-Id: <20260126094848.9601-4-lulu@redhat.com> commit 2f61e6eda7a793bca4df6efea95815375e122f3a Author: Cindy Lu Date: Mon Jan 26 17:45:37 2026 +0800 vdpa/mlx5: reuse common function for MAC address updates Factor out MAC address update logic and reuse it from handle_ctrl_mac(). This ensures that old MAC entries are removed from the MPFS table before adding a new one and that the forwarding rules are updated accordingly. If updating the flow table fails, the original MAC and rules are restored as much as possible to keep the software and hardware state consistent. Signed-off-by: Cindy Lu Reviewed-by: Dragos Tatulea Signed-off-by: Michael S. Tsirkin Message-Id: <20260126094848.9601-3-lulu@redhat.com> commit 719d959274da85eb0e1eb448dd807b1c435c19a1 Author: Cindy Lu Date: Mon Jan 26 17:45:36 2026 +0800 vdpa/mlx5: update mlx_features with driver state check Add logic in mlx5_vdpa_set_attr() to ensure the VIRTIO_NET_F_MAC feature bit is properly set only when the device is not yet in the DRIVER_OK (running) state. This makes the MAC address visible in the output of: vdpa dev config show -jp when the device is created without an initial MAC address. Signed-off-by: Cindy Lu Reviewed-by: Dragos Tatulea Signed-off-by: Michael S. Tsirkin Message-Id: <20260126094848.9601-2-lulu@redhat.com> commit 8035d70cf85e86f36f5eb1e07b243f300a936b8b Merge: 74dd4d1f4c7d2e 9eb9c350bc553f Author: Rafael J. Wysocki Date: Wed Feb 4 19:34:57 2026 +0100 Merge branch 'thermal-intel' Merge updates of Intel thermal drivers for 6.20/7.0: - Add Panther Lake, Wildcat Lake and Nova Lake processor IDs to the list of supported processors in the intel_tcc_cooling thermal driver (Srinivas Pandruvada) - Drop unnecessary explicit driver data clearing on removal from the intel_pch_thermal driver (Kaushlendra Kumar) - Add support for "slow" workload type hints to the int340x processor_thermal driver and enable it on the Panther Lake platform (Srinivas Pandruvada) - Use sysfs_emit{_at}() in sysfs show functions in Intel thermal drivers (Thorsten Blum) - Update the x86_pkg_temp_thermal driver to handle THERMAL_TEMP_INVALID that can be passed to it via sysfs as expected (Rafael Wysocki) - Drop a redundant local variable from the intel_tcc_cooling thermal driver and fix a kerneldoc comment typo in the TCC library (Sumeet Pawnikar) * thermal-intel: drivers: thermal: intel: tcc_cooling: Drop redundant local variable thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature thermal: intel: Use sysfs_emit() in a sysfs show function thermal: intel: fix typo "nagative" in comment for cpu argument thermal: intel: int340x: Use sysfs_emit{_at}() in sysfs show functions thermal: intel: selftests: workload_hint: Support slow workload hints thermal: int340x: processor_thermal: Enable slow workload type hints thermal: intel: intel_pch_thermal: Drop explicit driver data clearing thermal: intel: intel_tcc_cooling: Add CPU models in the support list commit 9db327083f7e0da702e2ec0169f8a34f3576f371 Author: Sen Wang Date: Mon Feb 2 18:37:03 2026 -0600 ASoC: ti: davinci-mcasp: Add asynchronous mode support McASP has dedicated clock & frame sync registers for both transmit and receive. Currently McASP driver only supports synchronous behavior and couples both TX & RX settings. Add logic that enables asynchronous mode via ti,async-mode property. In async mode, playback & record can be done simultaneously with different audio configurations (tdm slots, tdm width, audio bit depth). Note the ability to have different tx/rx DSP formats (i2s, dsp_a, etc.), while possible in hardware, remains to be a gap as it require changes to the corresponding machine driver interface. Existing IIS (sync mode) and DIT mode logic remains mostly unchanged. Exceptions are IIS mode logic that previously assumed sync mode, which has now been made aware of the distinction. And shared logic across all modes also now checks for McASP tx/rx-specific driver attributes. Those attributes have been populated according to the original extent, ensuring no divergence in functionality. Constraints no longer applicable for async mode are skipped. Clock selection options have also been added to include rx/tx-only clk_ids, exposing independent configuration via the machine driver as well. Note that asynchronous mode is not applicable for McASP in DIT mode, which is a transmitter-only mode to interface w/ self-clocking formats. Signed-off-by: Sen Wang Acked-by: Peter Ujfalusi Tested-by: Paresh Bhagat Link: https://patch.msgid.link/20260203003703.2334443-5-sen@ti.com Signed-off-by: Mark Brown commit 016efcaa470cdbc658df46d968d875f6a1cf9a78 Author: Sen Wang Date: Mon Feb 2 18:37:02 2026 -0600 ASoC: ti: davinci-mcasp: Streamline pdir behavior across rx & tx streams Simplify the mcasp_set_clk_pdir caller convention in start/stop stream function, to make it so that set_clk_pdir gets called regardless when stream starts and also disables when stream ends. Functionality-wise, everything remains the same as the previously skipped calls are now either correctly configured (when McASP is SND_SOC_DAIFMT_BP_FC - pdir needs to be enabled) or called with a bitmask of zero (when McASP is SND_SOC_DAIFMT_BC_FC - pdir gets disabled). On brief regarding McASP Clock and Frame sync configurations, refer to [0]. [0]:TRM Section 12.1.1.4.2 https://www.ti.com/lit/ug/sprujd4a/sprujd4a.pdf Signed-off-by: Sen Wang Acked-by: Peter Ujfalusi Tested-by: Paresh Bhagat Link: https://patch.msgid.link/20260203003703.2334443-4-sen@ti.com Signed-off-by: Mark Brown commit e683cb088fdcbdc86fc30008319312cc0bb80226 Author: Sen Wang Date: Mon Feb 2 18:37:01 2026 -0600 ASoC: ti: davinci-mcasp: Disambiguate mcasp_is_synchronous function The current mcasp_is_synchronous() function does more than what it proclaims, it also checks if McASP is a frame producer. Therefore split the original function into two separate ones and replace all occurrences with the new equivalent logic. Signed-off-by: Sen Wang Acked-by: Peter Ujfalusi Tested-by: Paresh Bhagat Link: https://patch.msgid.link/20260203003703.2334443-3-sen@ti.com Signed-off-by: Mark Brown commit f1ef70a4a32042984d29b8d02bdf6167474373af Author: Sen Wang Date: Mon Feb 2 18:37:00 2026 -0600 ASoC: dt-bindings: davinci-mcasp: Add properties for asynchronous mode McASP supports the independent configuration of TX & RX clk and frame sync registers. By default, the driver is configured in synchronous mode where RX clock generator is disabled and it uses transmit clock signals as bit clock and frame sync. Therefore add optional properties needed for asynchronous mode. Add ti,async-mode boolean binding to provide a way to decouple the default behavior and allows for independent TX & RX clocking. Add tdm-slots-rx uint32 binding to provide an alternative hardware specifier stating the number of RX serializers. The existing property tdm-slots will still dictate number of TX serializers, and RX if tdm-slots-rx isn't given for backwards compatibility. Add auxclk-fs-ratio-rx which allows to specify the ratio just for RX. The driver can be supplied with two different ratios (auxclk-fs-ratio and auxclk-fs-ratio-rx in tandem) and achieve two different sampling rates for tx & rx. Signed-off-by: Sen Wang Acked-by: Peter Ujfalusi Tested-by: Paresh Bhagat Link: https://patch.msgid.link/20260203003703.2334443-2-sen@ti.com Signed-off-by: Mark Brown commit 5e6e1dc43a217624087ce45bafd20ac2cfb3c190 Author: Donglin Peng Date: Mon Feb 2 20:01:14 2026 +0800 resolve_btfids: Refactor the sort_btf_by_name function Preserve original relative order of anonymous or same-named types to improve the consistency. No functional changes. Signed-off-by: Donglin Peng Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260202120114.3707141-1-dolinux.peng@gmail.com commit 63fbf275fa9f18f7020fb8acf54fa107e51d0f23 Merge: 0da3050bdded5f 208f432406b7ed Author: Dave Jiang Date: Wed Feb 4 10:53:33 2026 -0700 Merge branch 'for-7.0/cxl-prm-translation' into cxl-for-next Add support for normalized CXL address translation through ACPI PRM method to support AMD Zen5 platforms. Including a conventions doc that explains how the translation is implemented and for future implementations that need such setup to comply with the current implementation method. cxl: Disable HPA/SPA translation handlers for Normalized Addressing cxl/region: Factor out code into cxl_region_setup_poison() cxl/atl: Lock decoders that need address translation cxl: Enable AMD Zen5 address translation using ACPI PRMT cxl/acpi: Prepare use of EFI runtime services cxl: Introduce callback for HPA address ranges translation cxl/region: Use region data to get the root decoder cxl/region: Add @hpa_range argument to function cxl_calc_interleave_pos() cxl/region: Separate region parameter setup and region construction cxl: Simplify cxl_root_ops allocation and handling cxl/region: Store HPA range in struct cxl_region cxl/region: Store root decoder in struct cxl_region cxl/region: Rename misleading variable name @hpa to @hpa_range Documentation/driver-api/cxl: ACPI PRM Address Translation Support and AMD Zen5 enablement cxl, doc: Moving conventions in separate files cxl, doc: Remove isonum.txt inclusion commit 6516169fa7f6110ce42a5958c921255f2d0968bc Author: Praveen Talari Date: Wed Feb 4 21:58:54 2026 +0530 spi: geni-qcom: Add target abort support SPI target mode currently lacks a mechanism to gracefully abort ongoing transfers when the client or core needs to cancel active transactions. Implement spi_geni_target_abort() to handle aborting SPI target operations when the client and core want to cancel ongoing transfers. This provides a mechanism for graceful termination of active SPI transactions in target mode. Signed-off-by: Praveen Talari Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260204162854.1206323-5-praveen.talari@oss.qualcomm.com Signed-off-by: Mark Brown commit 9934383f98c91d8dfdf16d0e980431041c2d17ee Author: Praveen Talari Date: Wed Feb 4 21:58:53 2026 +0530 spi: geni-qcom: Drop unused msg parameter from timeout handlers The timeout helpers (handle_se_timeout() and handle_gpi_timeout()) took a 'struct spi_message *msg' that was never used. Remove this parameter and adjust the callers to simplify the interfaces. Signed-off-by: Praveen Talari Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260204162854.1206323-4-praveen.talari@oss.qualcomm.com Signed-off-by: Mark Brown commit 96e041647bb0f9d92f95df1d69cb7442d7408b79 Author: Praveen Talari Date: Wed Feb 4 21:58:52 2026 +0530 spi: geni-qcom: Fix abort sequence execution for serial engine errors The driver currently skips the abort sequence for target mode when serial engine errors occur. This leads to improper error recovery as the serial engine may remain in an undefined state without proper cleanup, potentially causing subsequent operations to fail or behave unpredictably. Fix this by ensuring the abort sequence and DMA reset always execute during error recovery, as both are required for proper serial engine error handling. Co-developed-by: Konrad Dybcio Signed-off-by: Konrad Dybcio Signed-off-by: Praveen Talari Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260204162854.1206323-3-praveen.talari@oss.qualcomm.com Signed-off-by: Mark Brown commit 50464497b5874b7c2f3ab991cec81e916d40743c Author: Praveen Talari Date: Wed Feb 4 21:58:51 2026 +0530 spi: geni-qcom: Improve target mode allocation by using proper allocation functions The current implementation always allocates a host controller and sets the target flag later when the "spi-slave" device tree property is present. This approach is suboptimal as it doesn't utilize the dedicated allocation functions designed for target mode. Use devm_spi_alloc_target() when "spi-slave" device tree property is present, otherwise use devm_spi_alloc_host(). This replaces the previous approach of always allocating a host controller and setting target flag later. Signed-off-by: Praveen Talari Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20260204162854.1206323-2-praveen.talari@oss.qualcomm.com Signed-off-by: Mark Brown commit 78a16058e4250daff763c14c3ee76e7830b4fb2e Merge: b28dac3fc99bb6 c26b098bf42c71 Author: Martin KaFai Lau Date: Wed Feb 4 09:35:06 2026 -0800 Merge branch 'bpf-misc-changes-around-af_unix' Kuniyuki Iwashima says: ==================== bpf: Misc changes around AF_UNIX. Patch 1 adapts sk_is_XXX() helpers in __cgroup_bpf_run_filter_sock_addr(). Patch 2 removes an unnecessary sk_fullsock() in bpf_skc_to_unix_sock(). ==================== Link: https://patch.msgid.link/20260203213442.682838-1-kuniyu@google.com Signed-off-by: Martin KaFai Lau commit c26b098bf42c71111ca976ce330ea5c66b9a5d8e Author: Kuniyuki Iwashima Date: Tue Feb 3 21:30:07 2026 +0000 bpf: Don't check sk_fullsock() in bpf_skc_to_unix_sock(). AF_UNIX does not use TCP_NEW_SYN_RECV nor TCP_TIME_WAIT and checking sk->sk_family is sufficient. Let's remove sk_fullsock() and use sk_is_unix() in bpf_skc_to_unix_sock(). Acked-by: Stanislav Fomichev Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260203213442.682838-3-kuniyu@google.com commit f06581392e9d56ac86d8fcc29c0931441ee82f4a Author: Kuniyuki Iwashima Date: Tue Feb 3 21:30:06 2026 +0000 bpf: Use sk_is_inet() and sk_is_unix() in __cgroup_bpf_run_filter_sock_addr(). sk->sk_family should be read with READ_ONCE() in __cgroup_bpf_run_filter_sock_addr() due to IPV6_ADDRFORM. Also, the comment there is a bit stale since commit 859051dd165e ("bpf: Implement cgroup sockaddr hooks for unix sockets"), and the kdoc has the same comment. Let's use sk_is_inet() and sk_is_unix() and remove the comment. Acked-by: Stanislav Fomichev Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260203213442.682838-2-kuniyu@google.com commit ab736ed52e3409b58a4888715e4425b6e8ac444f Author: Frank Li Date: Thu Jan 29 23:20:39 2026 -0500 dmaengine: add Frank Li as reviewer Frank Li maintains the Freescale eDMA driver, has worked on DW eDMA improvements, and actively helps review DMA-related code. Signed-off-by: Frank Li Link: https://patch.msgid.link/20260130042039.1842939-1-Frank.Li@nxp.com Signed-off-by: Vinod Koul commit 876cbb60227fcfbcfcabf458eee5bc52cf5fbac0 Author: Pankaj Patil Date: Wed Dec 31 19:01:14 2025 +0530 dt-bindings: dma: qcom,gpi: Update max interrupts lines to 16 Update interrupt maxItems to 16 from 13 per GPI instance to support Glymur, Qualcomm's latest gen SoC Signed-off-by: Pankaj Patil Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251231133114.2752822-1-pankaj.patil@oss.qualcomm.com Signed-off-by: Vinod Koul commit 666c53e94c1d0bf0bdf14c49505ece9ddbe725bc Author: Jared Kangas Date: Tue Jan 13 11:46:50 2026 -0800 dmaengine: fsl-edma: don't explicitly disable clocks in .remove() The clocks in fsl_edma_engine::muxclk are allocated and enabled with devm_clk_get_enabled(), which automatically cleans these resources up, but these clocks are also manually disabled in fsl_edma_remove(). This causes warnings on driver removal for each clock: edma_module already disabled WARNING: CPU: 0 PID: 418 at drivers/clk/clk.c:1200 clk_core_disable+0x198/0x1c8 [...] Call trace: clk_core_disable+0x198/0x1c8 (P) clk_disable+0x34/0x58 fsl_edma_remove+0x74/0xe8 [fsl_edma] [...] ---[ end trace 0000000000000000 ]--- edma_module already unprepared WARNING: CPU: 0 PID: 418 at drivers/clk/clk.c:1059 clk_core_unprepare+0x1f8/0x220 [...] Call trace: clk_core_unprepare+0x1f8/0x220 (P) clk_unprepare+0x34/0x58 fsl_edma_remove+0x7c/0xe8 [fsl_edma] [...] ---[ end trace 0000000000000000 ]--- Fix these warnings by removing the unnecessary fsl_disable_clocks() call in fsl_edma_remove(). Fixes: a9903de3aa16 ("dmaengine: fsl-edma: refactor using devm_clk_get_enabled") Signed-off-by: Jared Kangas Reviewed-by: Frank Li Link: https://patch.msgid.link/20260113-fsl-edma-clock-removal-v1-1-2025b49e7bcc@redhat.com Signed-off-by: Vinod Koul commit d4d78dd43cecaeaadb24e78927a4d6fda7d1f1d9 Author: Yang Xiuwei Date: Tue Jan 6 10:42:57 2026 +0800 block: remove redundant kill_bdev() call in set_blocksize() The second kill_bdev() call in set_blocksize() is redundant as the first call already clears all buffers and pagecache, and locks prevent new pagecache creation between the calls. Signed-off-by: Yang Xiuwei Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 208f432406b7ed446c061d68cc73efd85b575d3f Author: Robert Richter Date: Wed Jan 14 17:48:29 2026 +0100 cxl: Disable HPA/SPA translation handlers for Normalized Addressing The root decoder provides the callbacks hpa_to_spa and spa_to_hpa to perform Host Physical Address (HPA) and System Physical Address translations, respectively. The callbacks are required to convert addresses when HPA != SPA. XOR interleaving depends on this mechanism, and the necessary handlers are implemented. The translation handlers are used for poison injection (trace_cxl_poison, cxl_poison_inject_fops) and error handling (cxl_event_trace_record). In AMD Zen5 systems with Normalized Addressing, endpoint addresses are not SPAs, and translation handlers are required for these features to function correctly. Now, as ACPI PRM translation could be expensive in tracing or error handling code paths, do not yet enable translations to avoid its intensive use. Instead, disable those features which are used only for debugging and enhanced logging. Introduce the flag CXL_REGION_F_NORMALIZED_ADDRESSING that indicates Normalized Addressing for a region and use it to disable poison injection and DPA to HPA conversion. Note: Dropped unused CXL_DECODER_F_MASK macro. [dj: Fix commit log CXL_REGION_F_NORM_ADDR to CXL_REGION_F_NORMALIZED_ADDRESSING ] Reviewed-by: Alison Schofield Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260114164837.1076338-14-rrichter@amd.com Signed-off-by: Dave Jiang commit d1c9ba46d6c36ff8d5b5f83ae28eae4132e46988 Author: Robert Richter Date: Wed Jan 14 17:48:28 2026 +0100 cxl/region: Factor out code into cxl_region_setup_poison() Poison injection setup code is embedded in cxl_region_probe(). For improved encapsulation, readability, and maintainability, factor out code into function cxl_region_setup_poison(). This patch is a prerequisite to disable poison by region offset for Normalized Addressing. No functional changes. Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260114164837.1076338-13-rrichter@amd.com Signed-off-by: Dave Jiang commit a2e794895089c1356b7687e8df1fa7d224d40bb6 Author: Robert Richter Date: Wed Jan 14 17:48:27 2026 +0100 cxl/atl: Lock decoders that need address translation The current kernel implementation does not support endpoint setup with Normalized Addressing. It only translates an endpoint's DPA to the SPA range of the host bridge. Therefore, the endpoint address range cannot be determined, making a non-auto setup impossible. If a decoder requires address translation, reprogramming should be disabled and the decoder locked. The BIOS, however, provides all the necessary address translation data, which the kernel can use to reconfigure endpoint decoders with normalized addresses. Locking the decoders in the BIOS would prevent a capable kernel (or other operating systems) from shutting down auto-generated regions and managing resources dynamically. Reviewed-by: Gregory Price Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Tested-by: Gregory Price Signed-off-by: Robert Richter Reviewed-by: Dave Jiang > --- Link: https://patch.msgid.link/20260114164837.1076338-12-rrichter@amd.com Signed-off-by: Dave Jiang commit af74daf91652f15b82560bb93850d2ec8bbfa976 Author: Robert Richter Date: Tue Jan 27 11:12:31 2026 -0700 cxl: Enable AMD Zen5 address translation using ACPI PRMT Add AMD Zen5 support for address translation. Zen5 systems may be configured to use 'Normalized addresses'. Then, host physical addresses (HPA) are different from their system physical addresses (SPA). The endpoint has its own physical address space and an incoming HPA is already converted to the device's physical address (DPA). Thus it has interleaving disabled and CXL endpoints are programmed passthrough (DPA == HPA). Host Physical Addresses (HPAs) need to be translated from the endpoint to its CXL host bridge, esp. to identify the endpoint's root decoder and region's address range. ACPI Platform Runtime Mechanism (PRM) provides a handler to translate the DPA to its SPA. This is documented in: AMD Family 1Ah Models 00h–0Fh and Models 10h–1Fh ACPI v6.5 Porting Guide, Publication # 58088 https://www.amd.com/en/search/documentation/hub.html With Normalized Addressing this PRM handler must be used to translate an HPA of an endpoint to its SPA. Do the following to implement AMD Zen5 address translation: Introduce a new file core/atl.c to handle ACPI PRM specific address translation code. Naming is loosely related to the kernel's AMD Address Translation Library (CONFIG_AMD_ATL) but implementation does not depend on it, nor it is vendor specific. Use Kbuild and Kconfig options respectively to enable the code depending on architecture and platform options. AMD Zen5 systems support the ACPI PRM CXL Address Translation firmware call (see ACPI v6.5 Porting Guide, Address Translation - CXL DPA to System Physical Address). Firmware enables the PRM handler if the platform has address translation implemented. Check firmware and kernel support of ACPI PRM using the specific GUID. On success enable address translation by setting up the earlier introduced root port callback, see function cxl_prm_setup_translation(). Setup is done in cxl_setup_prm_address_translation(), it is the only function that needs to be exported. For low level PRM firmware calls, use the ACPI framework. Identify the region's interleaving ways by inspecting the address ranges. Also determine the interleaving granularity using the address translation callback. Note that the position of the chunk from one interleaving block to the next may vary and thus cannot be considered constant. Address offsets larger than the interleaving block size cannot be used to calculate the granularity. Thus, probe the granularity using address translation for various HPAs in the same interleaving block. [ dj: Add atl.o build to cxl_test ] Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Gregory Price Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260114164837.1076338-11-rrichter@amd.com Signed-off-by: Dave Jiang commit 52940a34a85bc8a17a095f6fae80c33a18c1f7ec Author: Claudio Imbrenda Date: Wed Feb 4 16:02:58 2026 +0100 KVM: s390: selftests: Add selftest for the KVM_S390_KEYOP ioctl This test allows to test the various storage key handling functions. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 0ee4ddc1647b8b3b9e7a94d798a1774a764428c1 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:57 2026 +0100 KVM: s390: Storage key manipulation IOCTL Add a new IOCTL to allow userspace to manipulate storage keys directly. This will make it easier to write selftests related to storage keys. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 0fdd5c18a99cc89e829243f9f8561b37b7ebc4fc Author: Claudio Imbrenda Date: Wed Feb 4 16:02:56 2026 +0100 KVM: s390: Enable 1M pages for gmap While userspace is allowed to have pages of any size, the new gmap would always use 4k pages to back the guest. Enable 1M pages for gmap. This allows 1M pages to be used to back a guest when userspace is using 1M pages for the corresponding addresses (e.g. THP or hugetlbfs). Remove the limitation that disallowed having nested guests and hugepages at the same time. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 728b0e21b473ad8097185fb85ce2b9ab1ddf4ef7 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:55 2026 +0100 KVM: S390: Remove PGSTE code from linux/s390 mm Remove the PGSTE config option. Remove all code from linux/s390 mm that involves PGSTEs. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit cec38587a9e395576fb54ee9e077b037a50d9335 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:54 2026 +0100 KVM: s390: Remove gmap from s390/mm Remove the now unused include/asm/gmap.h and mm/gmap.c files. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit e38c884df92119d96f652d51f82661dd2fc0b885 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:53 2026 +0100 KVM: s390: Switch to new gmap Switch KVM/s390 to use the new gmap code. Remove includes to and include "gmap.h" instead; fix all the existing users of the old gmap functions to use the new ones instead. Fix guest storage key access functions to work with the new gmap. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit d29a29a9e1a3d24cdb867ae2adc487f1a67e6225 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:52 2026 +0100 KVM: s390: Storage key functions refactoring Refactor some storage key functions to improve readability. Introduce helper functions that will be used in the next patches. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit cc50f105fde083801d0644c8678bc984c6e83a3b Author: Claudio Imbrenda Date: Wed Feb 4 16:02:51 2026 +0100 KVM: s390: Stop using CONFIG_PGSTE Switch to using IS_ENABLED(CONFIG_KVM) instead of CONFIG_PGSTE, since the latter will be removed soon. Many CONFIG_PGSTE are left behind, because they will be removed completely in upcoming patches. The ones replaced here are mostly the ones that will stay. Reviewed-by: Steffen Eiden Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit e5f98a6899bd4bd0d99cb21777bd361fbb873838 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:50 2026 +0100 KVM: s390: Add some helper functions needed for vSIE Implement gmap_protect_asce_top_level(), which was a stub. This function was a stub due to cross dependencies with other patches. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit e907ae5301338e7c1109311bbb3449fd9bd5d1ca Author: Claudio Imbrenda Date: Wed Feb 4 16:02:49 2026 +0100 KVM: s390: Add helper functions for fault handling Add some helper functions for handling multiple guest faults at the same time. This will be needed for VSIE, where a nested guest access also needs to access all the page tables that map it. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit a2c17f9270cc3f1c55c35e8b1d151f41d75b40f5 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:48 2026 +0100 KVM: s390: New gmap code New gmap (guest map) code. This new gmap code will only be used by KVM. This will replace the existing gmap. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 7b368470e1a406cdb0fab3ea1a5a8ebffb5ad91e Author: Claudio Imbrenda Date: Wed Feb 4 16:02:47 2026 +0100 KVM: s390: KVM page table management functions: CMMA Add page table management functions to be used for KVM guest (gmap) page tables. This patch adds functions to handle CMMA and the ESSA instruction. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 94fd9b16cc678ad440425b6fc4d1d505556fb29f Author: Claudio Imbrenda Date: Wed Feb 4 16:02:46 2026 +0100 KVM: s390: KVM page table management functions: lifecycle management Add page table management functions to be used for KVM guest (gmap) page tables. This patch adds functions to handle memslot creation and destruction, additional per-pagetable data stored in the PGSTEs, mapping physical addresses into the gmap, and marking address ranges as prefix. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 8e03e8316eb242af307d1c789d09f1a1457cf9a3 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:45 2026 +0100 KVM: s390: KVM page table management functions: storage keys Add page table management functions to be used for KVM guest (gmap) page tables. This patch adds functions related to storage key handling. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 2db149a0a6c5e81473298e57e762240901764a94 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:44 2026 +0100 KVM: s390: KVM page table management functions: walks Add page table management functions to be used for KVM guest (gmap) page tables. This patch adds functions to walk to specific table entries, or to perform actions on a range of entries. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 589071eaaa8f8459d24584d54fbe6db5a0be27a5 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:43 2026 +0100 KVM: s390: KVM page table management functions: clear and replace Add page table management functions to be used for KVM guest (gmap) page tables. This patch adds functions to clear, replace or exchange DAT table entries. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 12f2f61a9e1a3e54f57432c0f9d63ba7299993e1 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:42 2026 +0100 KVM: s390: KVM page table management functions: allocation Add page table management functions to be used for KVM guest (gmap) page tables. This patch adds the boilerplate and functions for the allocation and deallocation of DAT tables. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 5a74e3d934171fe54115d1f504d1a34382ff1aab Author: Claudio Imbrenda Date: Wed Feb 4 16:02:41 2026 +0100 KVM: s390: KVM-specific bitfields and helper functions Add KVM-s390 specific bitfields and helper functions to manipulate DAT tables. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 2f71db5eb9f8340ee58ae4b4faa6279b3a7f4a0e Author: Claudio Imbrenda Date: Wed Feb 4 16:02:40 2026 +0100 KVM: s390: Rename some functions in gaccess.c Rename some functions in gaccess.c to add a _gva or _gpa suffix to indicate whether the function accepts a virtual or a guest-absolute address. This makes it easier to understand the code. Reviewed-by: Steffen Eiden Reviewed-by: Christoph Schlameuss Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit a2f2798fa6d18d91766b19a4896bd9fd0654d730 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:39 2026 +0100 KVM: s390: Enable KVM_GENERIC_MMU_NOTIFIER Enable KVM_GENERIC_MMU_NOTIFIER, for now with empty placeholder callbacks. Also enable KVM_MMU_LOCKLESS_AGING and define KVM_HAVE_MMU_RWLOCK. Acked-by: Christian Borntraeger Reviewed-by: Steffen Eiden Reviewed-by: Christoph Schlameuss Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit f0e1ca6cc32fd3b1616409354da2637e21ff9a6f Author: Claudio Imbrenda Date: Wed Feb 4 16:02:38 2026 +0100 KVM: s390: vsie: Pass gmap explicitly as parameter Pass the gmap explicitly as parameter, instead of just using vsie_page->gmap. This will be used in upcoming patches. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 850103b0ce6de85aec3a8722c2f48c20d822b10c Author: Claudio Imbrenda Date: Wed Feb 4 16:02:37 2026 +0100 s390/mm: Warn if uv_convert_from_secure_pte() fails If uv_convert_from_secure_pte() fails, the page becomes unusable by the host. The failure can only occour in case of hardware malfunction or a serious KVM bug. When the unusable page is reused, the system can have issues and hang. Print a warning to aid debugging such unlikely scenarios. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 3ddee7e651661a2c3cbe12bb36215a64295f8b01 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:36 2026 +0100 KVM: s390: Export two functions Export __make_folio_secure() and s390_wiggle_split_folio(), as they will be needed to be used by KVM. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit cf3ce3d69d56bd3ef2bc5f6b500ebc5181637161 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:35 2026 +0100 KVM: s390: Introduce import_lock Introduce import_lock to avoid future races when converting pages to secure. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit c98175b7917fa81cd499b1527c4a57fd7d36711e Author: Claudio Imbrenda Date: Wed Feb 4 16:02:34 2026 +0100 KVM: s390: Add gmap_helper_set_unused() Add gmap_helper_set_unused() to mark userspace ptes as unused. Core mm code will use that information to discard unused pages instead of attempting to swap them. Reviewed-by: Nico Boehr Tested-by: Nico Boehr Acked-by: Christoph Schlameuss Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 4dadf64d9b75916081a55f9fbdc70e33be8d3ead Author: Claudio Imbrenda Date: Wed Feb 4 16:02:33 2026 +0100 s390: Move sske_frame() to a header Move the sske_frame() function to asm/pgtable.h, so it can be used in other modules too. Opportunistically convert the .insn opcode specification to the appropriate mnemonic. Reviewed-by: Christian Borntraeger Reviewed-by: Steffen Eiden Reviewed-by: Christoph Schlameuss Reviewed-by: Nina Schoetterl-Glausch Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 21401ce497062400f24cdd268c62fd47d126dd2e Author: Claudio Imbrenda Date: Wed Feb 4 16:02:32 2026 +0100 s390: Make UV folio operations work on whole folio uv_destroy_folio() and uv_convert_from_secure_folio() should work on all pages in the folio, not just the first one. This was fine until now, but it will become a problem with upcoming patches. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 013bf0f57e12b7cbed3ec28739b49606c3b1c054 Author: Claudio Imbrenda Date: Wed Feb 4 16:02:31 2026 +0100 KVM: s390: Add P bit in table entry bitfields, move union vaddress Add P bit in hardware definition of region 3 and segment table entries. Move union vaddress from kvm/gaccess.c to asm/dat_bits.h Reviewed-by: Christian Borntraeger Reviewed-by: Steffen Eiden Reviewed-by: Christoph Schlameuss Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit 05664e002129f5404c9d066844ef04a2223bcfea Author: Claudio Imbrenda Date: Wed Feb 4 16:02:30 2026 +0100 KVM: s390: Refactor pgste lock and unlock functions Move the pgste lock and unlock functions back into mm/pgtable.c and duplicate them in mm/gmap_helpers.c to avoid function name collisions later on. Acked-by: Heiko Carstens Signed-off-by: Claudio Imbrenda commit eddfdab4de202b8781fc0719c2e4790db84f9453 Author: Nihal Kumar Gupta Date: Thu Jan 22 00:01:38 2026 +0530 dt-bindings: i2c: qcom-cci: Document qcs8300 compatible The three instances of CCI found on the QCS8300 are functionally the same as on a number of existing Qualcomm SoCs. Introduce a new SoC-specific compatible string "qcom,qcs8300-cci" with a common fallback. Signed-off-by: Nihal Kumar Gupta Signed-off-by: Vikram Sharma Reviewed-by: Bryan O'Donoghue Acked-by: Rob Herring (Arm) Reviewed-by: Vladimir Zapolskiy Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260121183142.1867199-2-quic_nihalkum@quicinc.com commit dbeea86fecef7cf2b93aded4525d74f6277376ef Author: Brian Masney Date: Thu Jan 8 16:16:43 2026 -0500 phy: ti: phy-j721e-wiz: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: 27287e3b52b5 ("phy: ti: phy-j721e-wiz: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney Link: https://patch.msgid.link/20260108-clk-divider-round-rate-v1-25-535a3ed73bf3@redhat.com Signed-off-by: Vinod Koul commit 7878306d182a1750583a325a29e5ccab9ce0235b Author: Charan Pedumuru Date: Fri Jan 23 15:39:04 2026 +0000 dt-bindings: phy: ti,control-phy-otghs: convert to DT schema Convert TI OMAP Control PHY binding to DT schema. Reviewed-by: Rob Herring (Arm) Signed-off-by: Charan Pedumuru Link: https://patch.msgid.link/20260123-ti-phy-v4-3-b557e2c46e6f@gmail.com Signed-off-by: Vinod Koul commit 62c9ff8fc20d23c0dc36be1330734fdafb3e8585 Author: Charan Pedumuru Date: Fri Jan 23 15:39:03 2026 +0000 dt-bindings: phy: ti,phy-usb3: convert to DT schema Convert TI PIPE3 PHY binding to DT schema. Changes during conversion: - Define a new pattern 'pcie-phy' to match nodes defined in DT. - Drop obsolete "id" property from the schema. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260123-ti-phy-v4-2-b557e2c46e6f@gmail.com Signed-off-by: Vinod Koul commit eeca25fe13a2f690f659a6b43ebbb270b073a6c4 Author: Jon Hunter Date: Mon Feb 2 15:33:14 2026 +0000 phy: tegra: xusb: Remove unused powered_on variable Commit bbf711682cd5 ("phy: tegra: xusb: Add Tegra186 support") added the variable 'powered_on' to the structure 'tegra_xusb_usb2_lane' but it has never been used. Therefore, remove this unused variable. Signed-off-by: Jon Hunter Reviewed-by: Mikko Perttunen Link: https://patch.msgid.link/20260202153314.1634145-1-jonathanh@nvidia.com Signed-off-by: Vinod Koul commit 3a03a0e47cf2e0ec7ce7ca9e0bf4c59ec537ad09 Author: Arnd Bergmann Date: Mon Feb 2 10:51:14 2026 +0100 phy: renesas: rcar-gen3-usb2: add regulator dependency The driver start registering a regulator, but can still be enabled even when it is unable to call into the regulator subsystem: aarch64-linux-ld: drivers/phy/renesas/phy-rcar-gen3-usb2.o: in function `rcar_gen3_phy_usb2_probe': phy-rcar-gen3-usb2.c:(.text+0x2884): undefined reference to `devm_regulator_register' Add a Kconfig dependency to avoid this configuration. Fixes: b6d7dd157763 ("phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control") Signed-off-by: Arnd Bergmann Tested-by: Tommaso Merciai Link: https://patch.msgid.link/20260202095118.1233046-1-arnd@kernel.org Signed-off-by: Vinod Koul commit 8a13968460004d21dd0ca457b06fccfdfdfafd6c Author: Arnd Bergmann Date: Mon Feb 2 10:56:52 2026 +0100 phy: GOOGLE_USB: add TYPEC dependency With CONFIG_TYPEC=m, this driver cannot be built-in: arm-linux-gnueabi/bin/arm-linux-gnueabi-ld: drivers/phy/phy-google-usb.o: in function `google_usb_phy_remove': phy-google-usb.c:(.text+0x24): undefined reference to `typec_switch_unregister' Add CONFIG_TYPEC as a hard dependency here to force a clean build. In theory, compile-testing with CONFIG_TYPEC=n would also work, but that seems pointless. Fixes: cbce66669c82 ("phy: Add Google Tensor SoC USB PHY driver") Signed-off-by: Arnd Bergmann Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260202095655.1289973-1-arnd@kernel.org Signed-off-by: Vinod Koul commit 3ddcd24b4d8454b2b9b2d013a0d61986ae8bbbe7 Author: Vladimir Oltean Date: Fri Jan 23 13:06:00 2026 +0200 phy: enter drivers/phy/Makefile even without CONFIG_GENERIC_PHY Kconfig option CONFIG_PHY_COMMON_PROPS, which builds drivers/phy/phy-common-props.c, was intended to be selectable independently of CONFIG_GENERIC_PHY. Yet it lives in drivers/phy/, which is entered by the Makefile only if CONFIG_GENERIC_PHY is set. Allow the Makefile to enter one level deeper, but stop at drivers/phy/ if CONFIG_GENERIC_PHY is unselected (i.e. do not enter vendor folders). The other stuff from drivers/phy/Makefile except for CONFIG_PHY_COMMON_PROPS, like CONFIG_PHY_NXP_PTN3222, all depends on CONFIG_GENERIC_PHY. Fixes: e7556b59ba65 ("phy: add phy_get_rx_polarity() and phy_get_tx_polarity()") Closes: https://lore.kernel.org/lkml/43ea0202-891d-4582-980b-5cb557b41114@linux.ibm.com/ Reported-by: Venkat Rao Bagalkote Debugged-by: Christophe Leroy (CS GROUP) Signed-off-by: Vladimir Oltean Reviewed-by: Christophe Leroy (CS GROUP) Tested-by: Venkat Rao Bagalkote Link: https://patch.msgid.link/20260123110600.3118561-1-vladimir.oltean@nxp.com Signed-off-by: Vinod Koul commit 6054b10c328813e88bca31ac0d02eaff06057db0 Author: Colin Ian King Date: Tue Feb 3 21:07:35 2026 +0000 irqchip/gic-v5: Fix spelling mistake "ouside" -> "outside" There is a spelling mistake in a pr_err message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Thomas Gleixner Reviewed-by: Jonathan Cameron Acked-by: Lorenzo Pieralisi Link: https://patch.msgid.link/20260203210735.5036-1-colin.i.king@gmail.com commit ccd18ce290726053faff75b6fc3e541301ac99f9 Author: Tim Bird Date: Tue Feb 3 16:46:24 2026 -0700 io_uring: Add SPDX id lines to remaining source files Some io_uring files are missing SPDX-License-Identifier lines. Add lines with GPL-2.0 license IDs to these files. Signed-off-by: Tim Bird Signed-off-by: Jens Axboe commit 812ff1baa764080ba37bb0729e0c23c0e869b542 Author: Charles Keepax Date: Wed Feb 4 12:59:43 2026 +0000 ASoC: SDCA: Limit values user can write to Selected Mode Prevent the user from both updating the Selected Mode control whilst the jack is not present, and from writing values that don't correspond to a valid jack type (Unknown, in progress, etc.). Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260204125944.1134011-7-ckeepax@opensource.cirrus.com Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 02d851b46b366b69dfe0842ab45313d8a4d6c960 Author: Charles Keepax Date: Wed Feb 4 12:59:42 2026 +0000 ASoC: SDCA: Add regmap defaults for specification defined values Some of the SDCA Controls have a defined reset value in the specification. Update the parsing to add these specification defined values into the regmap defaults array. This will reduce the number of registers that are synchronised on a cache sync. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260204125944.1134011-6-ckeepax@opensource.cirrus.com Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit cc2f22a61ad66fda7e50339f9ec33720694e0b20 Author: Charles Keepax Date: Wed Feb 4 12:59:41 2026 +0000 ASoC: SDCA: Rearrange FDL file messages It is helpful to have something in the log showing which firmware file was loaded by the driver. Update the existing FDL disk file debug statement to just note that a disk file rather than ACPI file was used, and add a new info printk that prints out the details of the loaded file regardless of where that file came from. Likewise, sometimes it is useful to get a message if the file-sets list is missing, although this isn't technically an error so make it a debug. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260204125944.1134011-5-ckeepax@opensource.cirrus.com Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit d7730c44b7dddbc5063505ce9e0c21d8bf298368 Author: Charles Keepax Date: Wed Feb 4 12:59:40 2026 +0000 ASoC: SDCA: Still process most of the jack detect if control is missing DAPM creates its controls very late in the card creation, so there is no call into the driver after the controls are created. This means the jack IRQs can't be guaranteed to be registered after the ALSA controls are available. If a jack IRQ is received before the controls are available, currently the driver does not update the Selected Mode as it is required by the specification to do. If the ALSA controls are not available update the Selected Mode directly rather than going through the ALSA control. The ALSA control should pick up the state once it is created. Fixes: b9ab3b618241 ("ASoC: SDCA: Add some initial IRQ handlers") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260204125944.1134011-4-ckeepax@opensource.cirrus.com Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 9fad74b79e5ff353fe156c4b685cceffa5afdb1d Author: Charles Keepax Date: Wed Feb 4 12:59:39 2026 +0000 ASoC: SDCA: Handle volatile controls correctly There are very few volatile controls in SDCA that are exported as ALSA controls, typically Detected Mode is the only common one. However, the current code does not resume the device when these ALSA controls are accessed, which will result in the read/write failing. Add a new wrapper specifically for volatile controls that will do the required pm_runtime operations before accessing the register. Fixes: c3ca24e3fcb6 ("ASoC: SDCA: Create ALSA controls from DisCo") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260204125944.1134011-3-ckeepax@opensource.cirrus.com Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit b27b57f85fe3f0eca479556ac55bc9cbd1a5685a Author: Charles Keepax Date: Wed Feb 4 12:59:38 2026 +0000 ASoC: SDCA: Remove outdated todo comment Support for -cn- properties has already been added, however the TODO comment noting this feature was required was not removed. Remove the now redundant comment. Fixes: 50a479527ef01 ("ASoC: SDCA: Add support for -cn- value properties") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260204125944.1134011-2-ckeepax@opensource.cirrus.com Reviewed-by: Pierre-Louis Bossart Signed-off-by: Mark Brown commit 55137f5a68b5e888504ad36d07221cd749bb8956 Author: Shenghao Ding Date: Mon Feb 2 18:27:56 2026 +0800 ASoC: tas2781: Put three different calibrated data solution into the same data structure TAS2781 driver supports three solutions of calibrated data. The first is from the driver itself: driver reads the calibrated files directly during probe; The second is from user space: during init of audio hal, the audio hal will pass the calibrated data via kcontrol interface. Driver will store this data in "struct calidata" for use. The third is from UEFI, mainly used in hda device. These three solutions save the calibrated data into different data structures. It is time to put them together into "struct calidata" for use. Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20260202102757.532-1-shenghao-ding@ti.com Signed-off-by: Mark Brown commit e50de21fd7ce54d34a461d5f5ba6331271be57fb Author: Chancel Liu Date: Mon Feb 2 19:56:22 2026 +0900 ASoC: dt-bindings: fsl_rpmsg: Add compatible string for i.MX952 Add compatible string "fsl,imx952-rpmsg-audio" for i.MX952 platform, which is backward compatible with i.MX95. Set it to fall back to "fsl,imx95-rpmsg-audio". Signed-off-by: Chancel Liu Link: https://patch.msgid.link/20260202105622.39772-3-chancel.liu@nxp.com Signed-off-by: Mark Brown commit 19e45247288574d7875c2bfd3c9d3f4f61fd9d92 Author: Chancel Liu Date: Mon Feb 2 19:56:21 2026 +0900 ASoC: dt-bindings: fsl_rpmsg: Add compatible string for i.MX94 Add compatible string "fsl,imx94-rpmsg-audio" for i.MX94 platform, which is backward compatible with i.MX95. Set it to fall back to "fsl,imx95-rpmsg-audio". Signed-off-by: Chancel Liu Link: https://patch.msgid.link/20260202105622.39772-2-chancel.liu@nxp.com Signed-off-by: Mark Brown commit fe8429a2717fc01082502b0adf680a50b230eff7 Author: André Draszik Date: Thu Jan 22 15:43:47 2026 +0000 regulator: s2mps11: more descriptive gpio consumer name Currently, GPIOs claimed by this driver for external rail control all show up with "s2mps11-regulator" as consumer, which is not very informative. Switch to using the regulator name via desc->name instead, using the device name as fallback. Reviewed-by: Bartosz Golaszewski Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-20-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 979dd8da76eb98b212f4e8cafc3c4019cfa3d93d Author: André Draszik Date: Thu Jan 22 15:43:46 2026 +0000 regulator: s2mps11: add S2MPG11 regulator The S2MPG11 PMIC is a Power Management IC for mobile applications with buck converters, various LDOs, power meters, and additional GPIO interfaces. It typically complements an S2MPG10 PMIC in a main/sub configuration as the sub-PMIC. It has 12 buck, 1 buck-boost, and 15 LDO rails. Several of these can either be controlled via software (register writes) or via external signals, in particular by: * input pins connected to a main processor's: * GPIO pins * other pins that are e.g. firmware- or power-domain-controlled without explicit driver intervention * a combination of input pins and register writes. Control via input pins allows PMIC rails to be controlled by firmware, e.g. during standby/suspend or as part of power domain handling where otherwise that would not be possible. Additionally toggling a pin is faster than register writes, and it also allows the PMIC to ensure that any necessary timing requirements between rails are respected automatically if multiple rails are to be enabled or disabled quasi simultaneously. This commit implements support for all these rails and control combination. Note1: For an externally controlled rail, the regulator_ops provide an empty ::enable() and no ::disable() implementations, even though Linux can not enable the rail and one might think ::enable could be NULL. Without ops->enable(), the regulator core will assume enabling such a rail failed, though, and in turn never add a reference to its parent (supplier) rail. Once a different (Linux-controlled) sibling (consumer) rail on that same parent rail gets disabled, the parent gets disabled (cutting power to the externally controlled rail although it should stay on), and the system will misbehave. Note2: While external control via input pins appears to exist on other versions of this PMIC, there is more flexibility in this version, in particular there is a selection of input pins to choose from for each rail (which must therefore be configured accordingly if in use), whereas other versions don't have this flexibility. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-19-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 102dd11fc98261675a0664de1466616d7dad8d91 Author: André Draszik Date: Thu Jan 22 15:43:45 2026 +0000 regulator: s2mps11: refactor S2MPG10 regulator macros for S2MPG11 reuse Rails in the S2MPG11 share a very similar set of properties with S2MPG10 with slight differences. Update the existing macros to allow reuse by the upcoming S2MPG11 driver. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-18-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 8f23cfbe4463c3de2e552aed106e179c0c932b6e Author: André Draszik Date: Thu Jan 22 15:43:44 2026 +0000 regulator: s2mps11: refactor S2MPG10 ::set_voltage_time() for S2MPG11 reuse The upcoming S2MPG11 support needs a similar, but different version of ::set_voltage_time(). For S2MPG10, the downwards and upwards ramps for a rail are at different offsets at the same bit positions, while for S2MPG11 the ramps are at the same offset at different bit positions. Refactor the existing version slightly to allow reuse. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-17-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit a2b8b9f33ce30ab51b33b52dc52e55d6930b9a02 Author: André Draszik Date: Thu Jan 22 15:43:43 2026 +0000 regulator: s2mps11: add S2MPG10 regulator The S2MPG10 PMIC is a Power Management IC for mobile applications with buck converters, various LDOs, power meters, RTC, clock outputs, and additional GPIO interfaces. It has 10 buck and 31 LDO rails. Several of these can either be controlled via software (register writes) or via external signals, in particular by: * one out of several input pins connected to a main processor's: * GPIO pins * other pins that are e.g. firmware- or power-domain-controlled without explicit driver intervention * a combination of input pins and register writes. Control via input pins allows PMIC rails to be controlled by firmware, e.g. during standby/suspend, or as part of power domain handling where otherwise that would not be possible. Additionally toggling a pin is faster than register writes, and it also allows the PMIC to ensure that any necessary timing requirements between rails are respected automatically if multiple rails are to be enabled or disabled quasi simultaneously. This commit implements support for all these rails and control combinations. Additional data needs to be stored for each regulator, e.g. the input pin for external control, or a rail-specific ramp-rate for when enabling a buck-rail. Therefore, probe() is updated slightly to make that possible. Note1: For an externally controlled rail, the regulator_ops provide an empty ::enable() and no ::disable() implementations, even though Linux can not enable the rail and one might think ::enable could be NULL. Without ops->enable(), the regulator core will assume enabling such a rail failed, though, and in turn never add a reference to its parent (supplier) rail. Once a different (Linux-controlled) sibling (consumer) rail on that same parent rail gets disabled, the parent gets disabled (cutting power to the externally controlled rail although it should stay on), and the system will misbehave. Note2: While external control via input pins appears to exist on other versions of this PMIC, there is more flexibility in this version, in particular there is a selection of input pins to choose from for each rail (which must therefore be configured accordingly if in use), whereas other versions don't have this flexibility. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-16-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 0042c880e43c54c9bf19c24a72e54eeea37995e3 Author: André Draszik Date: Thu Jan 22 15:43:42 2026 +0000 regulator: s2mps11: refactor handling of external rail control Refactor s2mps14_pmic_enable_ext_control() and s2mps11_of_parse_cb() slightly as a preparation for adding S2MPG10 and S2MPG11 support, as both of those PMICs also support control of rails via GPIOs. This also includes the following to avoid further updates in follow-up commits: * On S2MPG10 and S2MPG11, external rail control can be via GPIO or via non-GPIO signals, hence passing a GPIO is allowed to be optional. This avoids inappropriate verbose driver messages. * Prepare to allow use of standard DT property name 'enable-gpios' for newer platforms instead of vendor-specific 'samsung,ext-control'. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-15-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 5b3c95739d674794730fbf3c678206f302609d27 Author: André Draszik Date: Thu Jan 22 15:43:41 2026 +0000 regulator: s2mps11: update node parsing (allow -supply properties) For the upcoming S2MPG10 and S2MPG11 support, we need to be able to parse -supply properties in the PMIC's DT node. This currently doesn't work, because the code here currently points the regulator core at each individual regulator sub-node, and therefore the regulator core is unable to find the -supply properties. Update the code to simply let the regulator core handle all the parsing by adding the ::of_match and ::regulators_node members to all existing regulator descriptions, by adding ::of_parse_cb() to those regulators which support the vendor-specific samsung,ext-control-gpios to parse it (S2MPS14), and by dropping the explicit call to of_regulator_match(). Configuring the PMIC to respect the external control GPIOs via s2mps14_pmic_enable_ext_control() is left outside ::of_parse_cb() because the regulator core ignores errors other than -EPROBE_DEFER from that callback, while the code currently fails probe on register write errors and I believe it should stay that way. The driver can now avoid the devm_gpiod_unhinge() dance due to simpler error handling of GPIO descriptor acquisition. This change also has the advantage of reducing runtime memory consumption by quite a bit as the driver doesn't need to allocate a 'struct of_regulator_match' and a 'struct gpio_desc *' for each regulator for all PMICs as the regulator core does that. This saves 40+8 bytes on arm64 for each individual regulator on all supported PMICs (even on non-S2MPS14 due to currently unnecessarily allocating the extra memory unconditionally). With the upcoming S2MPG10 and S2MPG11 support, this amounts to 1640+328 and 1120+224 bytes respectively. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-14-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 223cefd021fa6ef5687159836871907aa3084fe2 Author: André Draszik Date: Thu Jan 22 15:43:40 2026 +0000 regulator: s2mps11: place constants on right side of comparison tests For the lines being changed, checkpatch reports: WARNING: Comparisons should place the constant on the right side of the test Update the code accordingly. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-13-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 6430d65d7b74712e9ff60e270687d66265dad6f2 Author: André Draszik Date: Thu Jan 22 15:43:39 2026 +0000 regulator: s2mps11: use dev_err_probe() where appropriate dev_err_probe() exists to simplify code and harmonise error messages, there's no reason not to use it here. While at it, harmonise some error messages to add regulator name and ID like in other messages in this driver, and update messages to be more similar to other child-drivers of this PMIC (e.g. RTC). Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-12-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 0809d3dcc0dd8f597adbcd4d881063eb1b437987 Author: André Draszik Date: Thu Jan 22 15:43:38 2026 +0000 regulator: s2mps11: drop two needless variable initialisations The initialisations being removed are needless, as both variables are being assigned values unconditionally further down. Additionally, doing this eager init here might lead to preventing the compiler from issuing a warning if a future code change actually forgets to assign a useful value in some code path. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-11-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 7d33c0a4c6a3356db2b2f599820baf75d3753d44 Author: André Draszik Date: Thu Jan 22 15:43:37 2026 +0000 regulator: add REGULATOR_LINEAR_VRANGE macro REGULATOR_LINEAR_VRANGE is similar to REGULATOR_LINEAR_RANGE, but allows a more natural declaration of a voltage range for a regulator, in that it expects the minimum and maximum values as voltages rather than as selectors. Using voltages arguably makes this macro easier to use by drivers and code using it can become easier to read compared to REGULATOR_LINEAR_RANGE. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-10-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 030158c0528d1cbfbe9eebed09bad604f6135734 Author: André Draszik Date: Thu Jan 22 15:43:30 2026 +0000 regulator: dt-bindings: add s2mpg11-pmic regulators The S2MPG11 PMIC is a Power Management IC for mobile applications with buck converters, various LDOs, power meters, NTC thermistor inputs, and additional GPIO interfaces. It typically complements an S2MPG10 PMIC in a main/sub configuration as the sub-PMIC. S2MPG11 has 12 buck, 1 buck-boost, and 15 LDO rails. Several of these can either be controlled via software (register writes) or via external signals, in particular by: * one out of several input pins connected to a main processor's: * GPIO pins * other pins that are e.g. firmware- or power-domain-controlled without explicit driver intervention * a combination of input pins and register writes. Control via input pins allows PMIC rails to be controlled by firmware, e.g. during standby/suspend, or as part of power domain handling where otherwise that would not be possible. Additionally toggling a pin is faster than register writes, and it also allows the PMIC to ensure that any necessary timing requirements between rails are respected automatically if multiple rails are to be enabled or disabled quasi simultaneously. While external control via input pins appears to exist on other versions of this PMIC, there is more flexibility in this version, in particular there is a selection of input pins to choose from for each rail (which must therefore be configured accordingly if in use), whereas other versions don't have this flexibility. Add documentation related to the regulator (buck & ldo) parts like devicetree definitions, regulator naming patterns, and additional properties. Since S2MPG11 is typically used as the sub-PMIC together with an S2MPG10 as the main-PMIC, the datasheet and the binding both suffix the rails with an 's'. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-3-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 71bc6adae4102550717a8eeaa21d3f76f5149ac6 Author: André Draszik Date: Thu Jan 22 15:43:29 2026 +0000 regulator: dt-bindings: add s2mpg10-pmic regulators The S2MPG10 PMIC is a Power Management IC for mobile applications with buck converters, various LDOs, power meters, RTC, clock outputs, and additional GPIO interfaces. It has 10 buck and 31 LDO rails. Several of these can either be controlled via software (register writes) or via external signals, in particular by: * one out of several input pins connected to a main processor's: * GPIO pins * other pins that are e.g. firmware- or power-domain-controlled without explicit driver intervention * a combination of input pins and register writes. Control via input pins allows PMIC rails to be controlled by firmware, e.g. during standby/suspend, or as part of power domain handling where otherwise that would not be possible. Additionally toggling a pin is faster than register writes, and it also allows the PMIC to ensure that any necessary timing requirements between rails are respected automatically if multiple rails are to be enabled or disabled quasi simultaneously. While external control via input pins appears to exist on other versions of this PMIC, there is more flexibility in this version, in particular there is a selection of input pins to choose from for each rail (which must therefore be configured accordingly if in use), whereas other versions don't have this flexibility. Add documentation related to the regulator (buck & ldo) parts like devicetree definitions, regulator naming patterns, and additional properties. S2MPG10 is typically used as the main-PMIC together with an S2MPG11 PMIC in a main/sub configuration, hence the datasheet and the binding both suffix the rails with an 'm'. Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-2-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit e4691f356b2c24467eadc8b20f267e9e046f74cd Author: André Draszik Date: Thu Jan 22 15:43:28 2026 +0000 dt-bindings: firmware: google,gs101-acpm-ipc: convert regulators to lowercase Using lowercase for the buck and ldo nodenames is preferred, as evidenced e.g. in [1]. Convert the example here to lowercase before we add any bindings describing the s2mpg1x regulators that will enforce the spelling. Link: https://lore.kernel.org/all/20250223-mysterious-infrared-civet-e5bcbf@krzk-bin/ [1] Acked-by: Rob Herring (Arm) Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-1-3b1f9831fffd@linaro.org Signed-off-by: Mark Brown commit 6c52fda42066a87b76fd140e027280907071dd8a Author: Ranjani Sridharan Date: Wed Feb 4 10:18:33 2026 +0200 ASoC: SOF: Intel: hda: Add a virtual CPU DAI Add a virtual CPU DAI for loopback capture for echo reference implementation. We can't use the snd-soc-dummy-dai because it is already used for the bluetooth DAI link. Signed-off-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Liam Girdwood Reviewed-by: Mateusz Redzynia Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-11-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 16c589567a956d46a7c1363af3f64de3d420af20 Author: Ranjani Sridharan Date: Wed Feb 4 10:18:32 2026 +0200 ASoC: SOF: Intel: hda: Fix NULL pointer dereference If there's a mismatch between the DAI links in the machine driver and the topology, it is possible that the playback/capture widget is not set, especially in the case of loopback capture for echo reference where we use the dummy DAI link. Return the error when the widget is not set to avoid a null pointer dereference like below when the topology is broken. RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common] Signed-off-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Liam Girdwood Reviewed-by: Mateusz Redzynia Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit c4b37c21c75de7b37a3d839fa3dff63464caad1e Author: Ranjani Sridharan Date: Wed Feb 4 10:18:31 2026 +0200 ASoC: SOF: sof-audio: Add support for loopback capture An example of a DAI-less loopback pipeline would be the echo reference capture in the speaker playback path. This pipeline is set up as follows: Host(Playback) -> mixin -> mixout -> gain -> module-copier -> DAI | V Host(Capture) <- Process module <- virtual DAI In the above example, the virtual DAI exploits the concept of an aggregated DAI (one with a non-zero DAI ID) in topology to enable this pipeline to work with DPCM. A virtual DAI is a DAI widget with a non-zero DAI ID and hence is skipped when traversing the list of DAPM widgets during widget prepare/set/up/free/unprepare. The process module in the above pipeline generates 0's that are captured by the echo reference PCM. When the playback path is active, the process module acts as a passthrough module to allow the playback samples to be passthrough to the capture host. In order for these pipelines to work properly, the logic for setting/preparing/freeing/unpreparing the widgets needs to be amended to make sure that only the widgets that are in the pipeline in the same direction as the PCM being started are set up. For example, when the playback PCM is started, the capture pipeline widgets also show up in the list of connected DAPM widgets but they shouldn't be set up yet because the echo reference capture PCM hasn't been started yet. Alternatively, when the echo reference capture PCM is started, the playback pipeline widgets should not be setup. Finally, the last step needed to put this all together is the set the routes for widgets connecting the playback and the capture pipelines when both are active. Signed-off-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-9-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 74b11b22b5942a1a9b65c39b8ba6642a6e1ff5d0 Author: Ranjani Sridharan Date: Wed Feb 4 10:18:30 2026 +0200 ASoC: SOF: sof-audio: Traverse paths with aggregated DAI widgets Aggregated DAI widgets exist in topology for representation and are not actually initialized in the firmware. But in preparation for using this as a virtual DAI for loopback capture, make sure that we can traverse the path from an aggregated DAI widget to the host widget. Signed-off-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-8-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 42d0f8695db59b74e7e7db0c851e480362a8fdca Author: Ranjani Sridharan Date: Wed Feb 4 10:18:29 2026 +0200 ASoC: SOF: ipc4-topology: Add support for process modules with no input pins A tone generator module can be a type of processing module with no input pins. Adjust the logic to set the reference params for selecting output format and the basecfg format based on the output format. Signed-off-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-7-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 15a55ec2f8b956d6aa0dd948c907e13db7978c6e Author: Ranjani Sridharan Date: Wed Feb 4 10:18:28 2026 +0200 ASoC: SOF: ipc4-topology: Add new tokens for pipeline direction Parse the pipeline direction from topology. The direction_valid token is required for backward-compatibility with older topologies that may not have the direction set for pipelines. This will be used when setting up pipelines to check if a pipeline is in the same direction as the requested params and skip those in the opposite direction like in the case of echo reference capture pipelines during playback. Signed-off-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-6-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit e614fce9fea62dddf298550a61cb11abd5d84a02 Author: Ranjani Sridharan Date: Wed Feb 4 10:18:27 2026 +0200 ASoC: Intel: sof_sdw: Add a DAI link for loopback capture Add a DAI link for loopback capture as the last link to make sure the other DAI link ID's remain unaffected. It serves as a dummy DAI link to enable echo reference capture in the SDW topologies which do not have an actual backend capture DAI. Signed-off-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit af0bc3ac9a9e830cb52b718ecb237c4e76a466be Author: Ranjani Sridharan Date: Wed Feb 4 10:18:26 2026 +0200 uapi: sound: sof: tokens: Add missing token for KCPS Align with the firmware and add the missing token for pipeline kcps. Signed-off-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit f462697680aa15c55f642168d6694d996f8ae940 Author: Ranjani Sridharan Date: Wed Feb 4 10:18:25 2026 +0200 ASoC: SOF: pcm: Split up widget prepare and setup Widgets are set up in 2 steps, first ipc_prepare followed by the actual IPC sent to the DSP to set up the widget. Split these 2 steps to do the ipc_prepare during hw_params and the setting up in the prepare callback. This will allow for future modifications to pipeline set up to be split up between the FE and BE DAI prepare ops. Signed-off-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 236d5e66b54b8052f7f4ae2ef2aa174e85c04a2f Author: Ranjani Sridharan Date: Wed Feb 4 10:18:24 2026 +0200 ASoC: SOF: sof-audio: Add a new op in struct sof_ipc_tplg_ops Add a new host_config op in struct sof_ipc_tplg_ops and define it for IPC4. This will be used to configure the host widget during prepare after a suspend/resume or after an xrun. Signed-off-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 845776177cf3b75be4e27213425f25dcb630d817 Author: Soham Metha Date: Mon Jan 26 16:43:09 2026 +0530 dt-bindings: mfd: da9055: Fix dead link to codec binding The simple audio codec bindings were consolidated into trivial-codec.yaml by commit 4acbfcf11cbe ("ASoC: dt-bindings: consolidate simple audio codec to trivial-codec.yaml"). Update the DA9055 binding documentation to reference the new trivial-codec.yaml location. Signed-off-by: Soham Metha Link: https://patch.msgid.link/20260126111309.22097-1-sohammetha01@gmail.com Signed-off-by: Lee Jones commit 0491f3f9f664e7e0131eb4d2a8b19c49562e5c64 Author: Xuewen Yan Date: Wed Feb 4 13:25:09 2026 +0100 PM: sleep: core: Avoid bit field races related to work_in_progress In all of the system suspend transition phases, the async processing of a device may be carried out in parallel with power.work_in_progress updates for the device's parent or suppliers and if it touches bit fields from the same group (for example, power.must_resume or power.wakeup_path), bit field corruption is possible. To avoid that, turn work_in_progress in struct dev_pm_info into a proper bool field and relocate it to save space. Fixes: aa7a9275ab81 ("PM: sleep: Suspend async parents after suspending children") Fixes: 443046d1ad66 ("PM: sleep: Make suspend of devices more asynchronous") Signed-off-by: Xuewen Yan Closes: https://lore.kernel.org/linux-pm/20260203063459.12808-1-xuewen.yan@unisoc.com/ Cc: All applicable [ rjw: Added subject and changelog ] Link: https://patch.msgid.link/CAB8ipk_VX2VPm706Jwa1=8NSA7_btWL2ieXmBgHr2JcULEP76g@mail.gmail.com Signed-off-by: Rafael J. Wysocki commit 831813bd23d31e8db6a72084718dbc1eb31dbaf6 Author: Raymond Hackley Date: Wed Dec 24 10:10:48 2025 +0000 dt-bindings: input: touchscreen: imagis: allow linux,keycodes for ist3038 Imagis IST3038 provides touch keys. Allow linux,keycodes for ist3038. Signed-off-by: Raymond Hackley Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251224100941.3356201-1-raymondhackley@protonmail.com Signed-off-by: Dmitry Torokhov commit ff4a46c278ac6a4b3f39be1492a4568b6dcc6105 Author: Linus Walleij Date: Tue Feb 3 11:23:01 2026 +0100 ata: pata_ftide010: Fix some DMA timings The FTIDE010 has been missing some timing settings since its inception, since the upstream OpenWrt patch was missing these. The community has since come up with the appropriate timings. Fixes: be4e456ed3a5 ("ata: Add driver for Faraday Technology FTIDE010") Cc: stable@vger.kernel.org Signed-off-by: Linus Walleij Signed-off-by: Niklas Cassel commit dcf0470aa399e59ba9e13c7de87a60c8743a358a Merge: bb6a3c2db281c7 330d1deb410fe7 Author: Mark Brown Date: Wed Feb 4 11:18:54 2026 +0000 ASoC: SOF: Intel: reserve link DMA for sdw bpt stream Merge series from Bard Liao : Currently, hda_sdw_bpt_dma_prepare() get a HDA stream and use the link DMA but doesn't reserve it. It works fine because we assume the SwoundWire BPT will not run with audio streams simultaneously. Create and use the new helpers to reserve the link DMA and allow running BPT and audio stream simultaneously. Pierre adds: For the record this solution has two issues not documented in any commit message: a) this will not work in 'dspless' mode, where the link DMA is not enabled. That's probably fine given that no one used that mode in production, but that's a software restriction that you will not be able to undo. b) this raise the question of how bandwidth will be managed. The premise of BPT is that it uses all the bus bandwidth to guarantee predictable firmware download times. If the available bandwidth is restricted by other audio streams, then mechanically the startup latency will be increased and vary - or you will have to run the bus at a higher frequency to provision enough bandwidth for BPT but that means higher power consumption. Or you will have to change the bus clock dynamically which is possible at the hardware level for SDCA parts but not legacy ones. I am not going to lay on the tracks for this low-level set of changes, but you'll have to address the b) opens for future contributions. commit 702273a0ea7bf01e7ed18914cb8767714a325412 Author: Petri Karhula Date: Fri Dec 5 12:19:48 2025 +0000 mfd: cgbc: Add support for backlight The Board Controller has control for display backlight. Add backlight cell for the cgbc-backlight driver which adds support for backlight brightness control. Signed-off-by: Petri Karhula Reviewed-by: Thomas Richard Link: https://patch.msgid.link/20251205-cgbc-backlight-v6-2-e4175b0bf406@novatron.fi Signed-off-by: Lee Jones commit b2c87f5e98cd88095dbc6802197526703d5e4e48 Author: Rob Herring (Arm) Date: Wed Jan 21 17:57:45 2026 -0600 dt-bindings: leds: Convert ti,lm3697 to DT schema Convert the TI LM3697 LED driver binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260121235746.370607-1-robh@kernel.org Signed-off-by: Lee Jones commit 3a17ba6557e28d5d99b7e3cad31f22ad28a36cc2 Author: André Draszik Date: Thu Jan 22 15:43:36 2026 +0000 mfd: sec: Add support for S2MPG11 PMIC via ACPM Add support for Samsung's S2MPG11 PMIC, which is a Power Management IC for mobile applications with buck converters, various LDOs, power meters, NTC thermistor inputs, and additional GPIO interfaces. It typically complements an S2MPG10 PMIC in a main/sub configuration as the sub-PMIC. Like S2MPG10, communication is not via I2C, but via the Samsung ACPM firmware. While at it, we can also switch to asynchronous probe, which helps with probe performance, as the drivers for s2mpg10 and s2mpg11 can probe in parallel. Note: The firmware uses the ACPM channel ID and the Speedy channel ID to select the PMIC address. Since these are firmware properties, they can not be retrieved from DT, but instead are deducted from the compatible for now. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-9-3b1f9831fffd@linaro.org Signed-off-by: Lee Jones commit fa72a842734272e295e6804df75131acde2d6e2d Author: André Draszik Date: Thu Jan 22 15:43:35 2026 +0000 mfd: sec: s2mpg10: Reorder regulators for better probe performance Bucks can reasonably be supplies for LDOs, but not the other way around. Since rail registration is going to be ordered by 'enum s2mpg10_regulators', it makes sense to specify bucks first, so that during LDO registration it is more likely that the corresponding supply is known already. This can improve probe speed, as no unnecessary deferrals and retries are required anymore. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-8-3b1f9831fffd@linaro.org Signed-off-by: Lee Jones commit bfacd34f8f34edc70c5c7a5fea46fd3c9ec35a5c Author: André Draszik Date: Thu Jan 22 15:43:33 2026 +0000 dt-bindings: mfd: Add samsung,s2mpg11-pmic The Samsung S2MPG11 PMIC is similar to the existing S2MPG10 PMIC supported by this binding, but still differs enough from it to justify a separate binding. It is a Power Management IC for mobile applications with buck converters, various LDOs, power meters, NTC thermistor inputs, and additional GPIO interfaces and typically complements an S2MPG10 PMIC in a main/sub configuration as the sub-PMIC. Like S2MPG10, communication is via the Samsung ACPM firmware and it therefore needs to be a child of the ACPM firmware node. Add the PMIC, the regulators node, and the supply inputs of the regulator rails, with the supply names matching the datasheet. Note: S2MPG11 is typically used as the sub-PMIC together with an S2MPG10 PMIC in a main/sub configuration, hence the datasheet and the binding both suffix the supplies with an 's'. Signed-off-by: André Draszik Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-6-3b1f9831fffd@linaro.org Signed-off-by: Lee Jones commit b356595f8bf4d22646e7800f6b85f63d42de1f31 Author: André Draszik Date: Thu Jan 22 15:43:32 2026 +0000 dt-bindings: mfd: samsung,s2mpg10-pmic: Link to its regulators Update the regulators node to link to the correct and expected samsung,s2mpg10-regulators binding, in order to describe the regulators available on this PMIC. Additionally, describe the supply inputs of the regulator rails, with the supply names matching the datasheet. While at it, update the description and example slightly. Note: S2MPG10 is typically used as the main-PMIC together with an S2MPG11 PMIC in a main/sub configuration, hence the datasheet and the binding both suffix the supplies with an 'm'. Signed-off-by: André Draszik Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-5-3b1f9831fffd@linaro.org Signed-off-by: Lee Jones commit 189ccdc7e8a9b5634b99ad0052749ac4c5442f89 Author: André Draszik Date: Thu Jan 22 15:43:31 2026 +0000 dt-bindings: mfd: samsung,s2mps11: Split s2mpg10-pmic into separate file The samsung,s2mpg10-pmic binding is going to acquire various additional properties. To avoid making the common samsung,s2mps11 binding file too complicated due to additional nesting, split s2mpg10 out into its own file. As a side-effect, the oneOf for the interrupts is not required anymore, as the required: node is at the top-level now. Signed-off-by: André Draszik Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260122-s2mpg1x-regulators-v7-4-3b1f9831fffd@linaro.org Signed-off-by: Lee Jones commit e1dccb485c2876ac1318f36ccc0155416c633a48 Author: Ziyi Guo Date: Fri Jan 30 18:26:51 2026 +0000 power: sequencing: fix missing state_lock in pwrseq_power_on() error path pwrseq_power_on() calls pwrseq_unit_disable() when the post_enable callback fails. However, this call is outside the scoped_guard(mutex, &pwrseq->state_lock) block that ends. pwrseq_unit_disable() has lockdep_assert_held(&pwrseq->state_lock), which will fail when called from this error path. Add the scoped_guard block to cover the post_enable callback and its error handling to ensure the lock is held when pwrseq_unit_disable() is called. Signed-off-by: Ziyi Guo Link: https://patch.msgid.link/20260130182651.1576579-1-n7l8m4@u.northwestern.edu Signed-off-by: Bartosz Golaszewski commit 83333aa97441ba7ce32b91e8a007c72d316a1c67 Author: Barnabás Czémán Date: Fri Jan 16 08:07:36 2026 +0100 backlight: qcom-wled: Change PM8950 WLED configurations PMI8950 WLED needs same configurations as PMI8994 WLED. Fixes: 10258bf4534b ("backlight: qcom-wled: Add PMI8950 compatible") Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20260116-pmi8950-wled-v3-4-e6c93de84079@mainlining.org Signed-off-by: Lee Jones commit b2df6cf10d5242bfef2cc957d83738ccb560ed9f Author: Barnabás Czémán Date: Fri Jan 16 08:07:35 2026 +0100 dt-bindings: backlight: qcom-wled: Document ovp values for PMI8950 Document ovp values supported by wled found in PMI8950. Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20260116-pmi8950-wled-v3-3-e6c93de84079@mainlining.org Signed-off-by: Lee Jones commit f29f972a6e7e3f187ea4d89b98a76c1981ca4d53 Author: Barnabás Czémán Date: Fri Jan 16 08:07:34 2026 +0100 backlight: qcom-wled: Support ovp values for PMI8994 WLED4 found in PMI8994 supports different ovp values. Fixes: 6fc632d3e3e0 ("video: backlight: qcom-wled: Add PMI8994 compatible") Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20260116-pmi8950-wled-v3-2-e6c93de84079@mainlining.org Signed-off-by: Lee Jones commit 02031064bb8f387d81988a8abb211f1366d87582 Author: Barnabás Czémán Date: Fri Jan 16 08:07:33 2026 +0100 dt-bindings: backlight: qcom-wled: Document ovp values for PMI8994 Document ovp values supported by wled found in PMI8994. Signed-off-by: Barnabás Czémán Reviewed-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20260116-pmi8950-wled-v3-1-e6c93de84079@mainlining.org Signed-off-by: Lee Jones commit 889588d750506d86ba16ae3b968b5ffc5937d5f8 Author: Yangyu Chen Date: Wed Feb 4 01:21:48 2026 +0800 dt-bindings: interrupt-controller: sifive,plic: Clarify the riscv,ndev meaning in PLIC In PLIC, interrupt source 0 is reserved and should not be used. Therefore, the valid interrupt sources are from 1 to riscv,ndev inclusive. Update the documentation to clarify this point. [ tglx: Fixup subject prefix ] Signed-off-by: Yangyu Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/tencent_720A4669773B1EE15EC720869C35C2F0490A@qq.com commit 42e025b719c128bdf8ff88584589a1e4a2448c81 Author: Thomas Gleixner Date: Tue Feb 3 20:16:12 2026 +0100 irqchip/sifive-plic: Handle number of hardware interrupts correctly The driver is handling the number of hardware interrupts inconsistently. The reason is that the firmware enumerates the maximum number of device interrupts, but the actual number of hardware interrupts is one more because hardware interrupt 0 is reserved. There are two loop variants where this matters: 1) Iterating over the device interrupts for (irq = 1; irq < total_irqs; irq++) 2) Iterating over the number of interrupt register groups for (grp = 0; grp < irq_groups; grp++) The current code stores the number of device interrupts and that requires to write the loops as: 1) for (irq = 1; irq <= device_irqs; irq++) 2) for (grp = 0; grp < DIV_ROUND_UP(device_irqs + 1); grp++) But the code gets it wrong all over the place. Just fixing up the conditions and off by ones is not a sustainable solution as the next changes will reintroduce the same bugs over and over. Sanitize it by storing the total number of hardware interrupts during probe and precalculating the number of groups. To future proof it mark priv::total_irqs __private, provide a correct iterator macro and adjust the code to this. Marking it private allows sparse (C=1 build) to catch direct access to this member: drivers/irqchip/irq-sifive-plic.c:270:9: warning: dereference of noderef expression That should prevent at least the most obvious future damage in that area. Fixes: e80f0b6a2cf3 ("irqchip/irq-sifive-plic: Add syscore callbacks for hibernation") Reported-by: Yangyu Chen Signed-off-by: Thomas Gleixner Tested-by: Yangyu Chen Link: https://patch.msgid.link/87ikcd36i9.ffs@tglx commit c7dd343a37567e650c263d4c068418b0bb82bf79 Author: Lukas Timmermann Date: Sun Jan 18 17:50:10 2026 +0100 leds: as3668: Driver for the ams Osram 4-channel i2c LED driver Since there were no existing drivers for the AS3668 or related devices, a new driver was introduced in a separate file. Similar devices were reviewed, but none shared enough characteristics to justify code reuse. As a result, this driver is written specifically for the AS3668. Signed-off-by: Lukas Timmermann Link: https://patch.msgid.link/20260118165010.902086-3-linux@timmermann.space Signed-off-by: Lee Jones commit 9339608652a26541e946ce2b435e273dbc3f02f6 Author: Lukas Timmermann Date: Sun Jan 18 17:50:09 2026 +0100 dt-bindings: leds: Add new as3668 support The bindings are incomplete, as the GPIO/Audio Input pin is still undocumented. The hardware used for testing this patch series does not allow modification, so the mentioned pin has been omitted. Signed-off-by: Lukas Timmermann Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260118165010.902086-2-linux@timmermann.space Signed-off-by: Lee Jones commit 444bb79e8964eeced6f896ee2541368c34d82694 Author: Nam Tran Date: Thu Jan 15 23:10:13 2026 +0700 docs: leds: Document TI LP5812 LED driver The driver provides sysfs interfaces to control and configure the LP5812 device and its LED channels. The documentation describes the chip's capabilities, sysfs interface, and usage examples. Signed-off-by: Nam Tran Link: https://patch.msgid.link/20260115161013.40706-3-trannamatk@gmail.com Signed-off-by: Lee Jones commit a0309dc699bc6434e3d269539e346f91f17036b8 Author: Nam Tran Date: Thu Jan 15 23:10:12 2026 +0700 leds: Add basic support for TI/National Semiconductor LP5812 LED Driver The LP5812 is a 4x3 matrix RGB LED driver with an autonomous animation engine and time-cross-multiplexing (TCM) support for up to 12 LEDs or 4 RGB LEDs. Each LED can be configured through the related registers to realize vivid and fancy lighting effects. This patch adds minimal driver support for the LP5812, implementing only the essential functionality: I2C communication with the device, LED registration, brightness control in manual mode, and basic sysfs interfaces for LED configuration and fault monitoring. Signed-off-by: Nam Tran Link: https://patch.msgid.link/20260115161013.40706-2-trannamatk@gmail.com Signed-off-by: Lee Jones commit f42033b5ce8c79c5db645916c9a72ee3e10cecfa Author: Haotian Zhang Date: Fri Jan 9 01:51:33 2026 +0800 leds: qcom-lpg: Check the return value of regmap_bulk_write() The lpg_lut_store() function currently ignores the return value of regmap_bulk_write() and always returns 0. This can cause hardware write failures to go undetected, leading the caller to believe LUT programming succeeded when it may have failed. Check the return value of regmap_bulk_write() in lpg_lut_store and return the error to the caller on failure. Fixes: 24e2d05d1b68 ("leds: Add driver for Qualcomm LPG") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20260108175133.638-1-vulab@iscas.ac.cn Signed-off-by: Lee Jones commit ec924cd7b78ee2d46da306e4e95faf4b155dc94b Author: Jishnu Prakash Date: Mon Dec 15 16:41:05 2025 +0530 dt-bindings: leds: qcom,spmi-flash-led: Add PMH0101 compatible Document compatible for PMH0101 Torch and Flash LED controller. Signed-off-by: Jingyi Wang Signed-off-by: Jishnu Prakash Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251215-knp-pmic-leds-v3-2-5e583f68b0e5@oss.qualcomm.com Signed-off-by: Lee Jones commit 5574b9323f9ca62749514ecb23c6fd40354e8b45 Author: Jishnu Prakash Date: Mon Dec 15 16:41:04 2025 +0530 dt-bindings: leds: leds-qcom-lpg: Add support for PMH0101 PWM Add support for PMH0101 PWM modules which are compatible with the PM8350c PWM modules. Signed-off-by: Jingyi Wang Signed-off-by: Jishnu Prakash Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251215-knp-pmic-leds-v3-1-5e583f68b0e5@oss.qualcomm.com Signed-off-by: Lee Jones commit 39de6f07b940c19ba4f981fa078381aa63206569 Author: J. Neuschäfer Date: Thu Jan 1 18:19:26 2026 +0100 dt-bindings: leds: Allow differently named multicolor LEDs In some cases, for example when using multiple instances of leds-group-multicolor, a board may have multiple multi-leds which can't be distinguished by unit address. In such cases it should be possible to name them differently, for example multi-led-0 and multi-led-1. This patch adds another node name pattern to leds-class-multicolor.yaml to allow such names. Signed-off-by: J. Neuschäfer Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260101-multi-led-v3-1-e29ca8dedd37@posteo.net Signed-off-by: Lee Jones commit 207a693835d48f92994fc23d8c3e4f131acbb73a Author: Krzysztof Kozlowski Date: Wed Dec 24 13:45:22 2025 +0100 leds: lp55xx: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251224124521.208635-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Lee Jones commit 2fe4df9fa931812fdfa6624944adf269db7fad96 Author: Nam Tran Date: Sun Dec 21 11:19:48 2025 +0700 dt-bindings: leds: add TI/National Semiconductor LP5812 LED Driver The LP5812 is a 4x3 RGB LED driver with an autonomous animation engine and time-cross-multiplexing (TCM) support for up to 12 LEDs or 4 RGB LEDs. It supports both analog (256 levels) and PWM (8-bit) dimming, including exponential PWM for smooth brightness control. Reviewed-by: Rob Herring (Arm) Signed-off-by: Nam Tran Link: https://patch.msgid.link/20251221041950.4631-2-trannamatk@gmail.com Signed-off-by: Lee Jones commit a18983b95a61b093847b3ec37a5ac9c29ff6257d Author: Daniel Mack Date: Fri Dec 19 16:45:21 2025 +0100 leds: is31f132xx: Add support for is31fl3293 This chip supports 3 LED channels with 4096 possible PWM values. Extend the driver to support this variant: * Make brightness steps configurable per device type * Handle dual-register brightness updates * Allow to specify values to write into the PWM update register * Add custom init and shutdown function for 3293 variant * Init registers after parsing DT properties Signed-off-by: Daniel Mack Link: https://patch.msgid.link/20251219154521.643312-4-daniel@zonque.org Signed-off-by: Lee Jones commit 6f1bc4534f2144c8b1acc448b3c4441a6096095c Author: Daniel Mack Date: Fri Dec 19 16:45:20 2025 +0100 leds: is31f132xx: Re-order code to remove forward declarations Move the chipdef structs after the functions they reference so that forward declarations become unnecessary. Signed-off-by: Daniel Mack Link: https://patch.msgid.link/20251219154521.643312-3-daniel@zonque.org Signed-off-by: Lee Jones commit a26ace8d8a620837c838d038e3301222bc9f7144 Author: Daniel Mack Date: Fri Dec 19 16:45:19 2025 +0100 dt-bindings: leds: Add issi,is31fl3293 to leds-is31fl32xx This variant supports 3 channels with 4096 brightness steps. Signed-off-by: Daniel Mack Acked-by: Conor Dooley Link: https://patch.msgid.link/20251219154521.643312-2-daniel@zonque.org Signed-off-by: Lee Jones commit f4b830a5371914239756b0599e5dc9d4c328e387 Author: Duje Mihanović Date: Wed Dec 17 19:14:23 2025 +0100 leds: expresswire: Fix chip state breakage It is possible to put the KTD2801 chip in an unknown/undefined state by changing the brightness very rapidly (for example, with a brightness slider). When this happens, the brightness is stuck on max and cannot be changed until the chip is power cycled. Fix this by disabling interrupts while talking to the chip. While at it, make expresswire_power_off() use fsleep() and also unexport some functions meant to be internal. Fixes: 1368d06dd2c9 ("leds: Introduce ExpressWire library") Tested-by: Karel Balej Signed-off-by: Duje Mihanović Link: https://patch.msgid.link/20251217-expresswire-fix-v2-1-4a02b10acd96@dujemihanovic.xyz Signed-off-by: Lee Jones commit 2f35fee943435b5b1a3e403c7fb9bd19727754d8 Author: Harry Yoo Date: Tue Jan 27 19:31:51 2026 +0900 mm/slab: only allow SLAB_OBJ_EXT_IN_OBJ for unmergeable caches While SLAB_OBJ_EXT_IN_OBJ allows to reduce memory overhead to account slab objects, it prevents slab merging because merging can change the metadata layout. As pointed out Vlastimil Babka, disabling merging solely for this memory optimization may not be a net win, because disabling slab merging tends to increase overall memory usage. Restrict SLAB_OBJ_EXT_IN_OBJ to caches that are already unmergeable for other reasons (e.g., those with constructors or SLAB_TYPESAFE_BY_RCU). Suggested-by: Vlastimil Babka Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260127103151.21883-3-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit a77d6d338685025cbf84f6e3abd92a8e59a4d894 Author: Harry Yoo Date: Tue Jan 13 15:18:45 2026 +0900 mm/slab: place slabobj_ext metadata in unused space within s->size When a cache has high s->align value and s->object_size is not aligned to it, each object ends up with some unused space because of alignment. If this wasted space is big enough, we can use it to store the slabobj_ext metadata instead of wasting it. On my system, this happens with caches like kmem_cache, mm_struct, pid, task_struct, sighand_cache, xfs_inode, and others. To place the slabobj_ext metadata within each object, the existing slab_obj_ext() logic can still be used by setting: - slab->obj_exts = slab_address(slab) + (slabobj_ext offset) - stride = s->size slab_obj_ext() doesn't need know where the metadata is stored, so this method works without adding extra overhead to slab_obj_ext(). A good example benefiting from this optimization is xfs_inode (object_size: 992, align: 64). To measure memory savings, 2 millions of files were created on XFS. [ MEMCG=y, MEM_ALLOC_PROFILING=n ] Before patch (creating ~2.64M directories on xfs): Slab: 5175976 kB SReclaimable: 3837524 kB SUnreclaim: 1338452 kB After patch (creating ~2.64M directories on xfs): Slab: 5152912 kB SReclaimable: 3838568 kB SUnreclaim: 1314344 kB (-23.54 MiB) Enjoy the memory savings! Suggested-by: Vlastimil Babka Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260113061845.159790-10-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit fab0694646d75d5b03e9898ffb85899fb23320ea Author: Harry Yoo Date: Tue Jan 13 15:18:44 2026 +0900 mm/slab: move [__]ksize and slab_ksize() to mm/slub.c To access SLUB's internal implementation details beyond cache flags in ksize(), move __ksize(), ksize(), and slab_ksize() to mm/slub.c. [vbabka@suse.cz: also make __ksize() static and move its kerneldoc to ksize() ] Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260113061845.159790-9-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 70089d018807506e8a6acd03eede33a0619ec417 Author: Harry Yoo Date: Tue Jan 13 15:18:43 2026 +0900 mm/slab: save memory by allocating slabobj_ext array from leftover The leftover space in a slab is always smaller than s->size, and kmem caches for large objects that are not power-of-two sizes tend to have a greater amount of leftover space per slab. In some cases, the leftover space is larger than the size of the slabobj_ext array for the slab. An excellent example of such a cache is ext4_inode_cache. On my system, the object size is 1136, with a preferred order of 3, 28 objects per slab, and 960 bytes of leftover space per slab. Since the size of the slabobj_ext array is only 224 bytes (w/o mem profiling) or 448 bytes (w/ mem profiling) per slab, the entire array fits within the leftover space. Allocate the slabobj_exts array from this unused space instead of using kcalloc() when it is large enough. The array is allocated from unused space only when creating new slabs, and it doesn't try to utilize unused space if alloc_slab_obj_exts() is called after slab creation because implementing lazy allocation involves more expensive synchronization. The implementation and evaluation of lazy allocation from unused space is left as future-work. As pointed by Vlastimil Babka [1], it could be beneficial when a slab cache without SLAB_ACCOUNT can be created, and some of the allocations from the cache use __GFP_ACCOUNT. For example, xarray does that. To avoid unnecessary overhead when MEMCG (with SLAB_ACCOUNT) and MEM_ALLOC_PROFILING are not used for the cache, allocate the slabobj_ext array only when either of them is enabled on slab allocation. [ MEMCG=y, MEM_ALLOC_PROFILING=n ] Before patch (creating ~2.64M directories on ext4): Slab: 4747880 kB SReclaimable: 4169652 kB SUnreclaim: 578228 kB After patch (creating ~2.64M directories on ext4): Slab: 4724020 kB SReclaimable: 4169188 kB SUnreclaim: 554832 kB (-22.84 MiB) Enjoy the memory savings! Link: https://lore.kernel.org/linux-mm/48029aab-20ea-4d90-bfd1-255592b2018e@suse.cz [1] Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260113061845.159790-8-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 4b1530f89c28dfbc3ec10b0cb860ec11e4538dbe Author: Harry Yoo Date: Tue Jan 13 15:18:42 2026 +0900 mm/memcontrol,alloc_tag: handle slabobj_ext access under KASAN poison In the near future, slabobj_ext may reside outside the allocated slab object range within a slab, which could be reported as an out-of-bounds access by KASAN. As suggested by Andrey Konovalov [1], explicitly disable KASAN and KMSAN checks when accessing slabobj_ext within slab allocator, memory profiling, and memory cgroup code. While an alternative approach could be to unpoison slabobj_ext, out-of-bounds accesses outside the slab allocator are generally more common. Move metadata_access_enable()/disable() helpers to mm/slab.h so that it can be used outside mm/slub.c. However, as suggested by Suren Baghdasaryan [2], instead of calling them directly from mm code (which is more prone to errors), change users to access slabobj_ext via get/put APIs: - Users should call get_slab_obj_exts() to access slabobj_metadata and call put_slab_obj_exts() when it's done. - From now on, accessing it outside the section covered by get_slab_obj_exts() ~ put_slab_obj_exts() is illegal. This ensures that accesses to slabobj_ext metadata won't be reported as access violations. Call kasan_reset_tag() in slab_obj_ext() before returning the address to prevent SW or HW tag-based KASAN from reporting false positives. Suggested-by: Andrey Konovalov Suggested-by: Suren Baghdasaryan Link: https://lore.kernel.org/linux-mm/CA+fCnZezoWn40BaS3cgmCeLwjT+5AndzcQLc=wH3BjMCu6_YCw@mail.gmail.com [1] Link: https://lore.kernel.org/linux-mm/CAJuCfpG=Lb4WhYuPkSpdNO4Ehtjm1YcEEK0OM=3g9i=LxmpHSQ@mail.gmail.com [2] Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260113061845.159790-7-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 7a8e71bc619d34c7607adef0e368d10421b7d4f6 Author: Harry Yoo Date: Tue Jan 13 15:18:41 2026 +0900 mm/slab: use stride to access slabobj_ext Use a configurable stride value when accessing slab object extension metadata instead of assuming a fixed sizeof(struct slabobj_ext). Store stride value in free bits of slab->counters field. This allows for flexibility in cases where the extension is embedded within slab objects. Since these free bits exist only on 64-bit, any future optimizations that need to change stride value cannot be enabled on 32-bit architectures. Suggested-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260113061845.159790-6-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 52f1ca8a459a73cf423a0b71b59f0b950e522cab Author: Harry Yoo Date: Tue Jan 13 15:18:40 2026 +0900 mm/slab: abstract slabobj_ext access via new slab_obj_ext() helper Currently, the slab allocator assumes that slab->obj_exts is a pointer to an array of struct slabobj_ext objects. However, to support storage methods where struct slabobj_ext is embedded within objects, the slab allocator should not make this assumption. Instead of directly dereferencing the slabobj_exts array, abstract access to struct slabobj_ext via helper functions. Introduce a new API slabobj_ext metadata access: slab_obj_ext(slab, obj_exts, index) - returns the pointer to struct slabobj_ext element at the given index. Directly dereferencing the return value of slab_obj_exts() is no longer allowed. Instead, slab_obj_ext() must always be used to access individual struct slabobj_ext objects. Convert all users to use these APIs. No functional changes intended. Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260113061845.159790-5-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 43d9bb4236fd1dd2e4646bee7f556542eefa422a Author: Harry Yoo Date: Tue Jan 13 15:18:39 2026 +0900 ext4: specify the free pointer offset for ext4_inode_cache Convert ext4_inode_cache to use the kmem_cache_args interface and specify a free pointer offset. Since ext4_inode_cache uses a constructor, the free pointer would be placed after the object to prevent overwriting fields used by the constructor. However, some fields such as ->i_flags are not used by the constructor and can safely be repurposed for the free pointer. Specify the free pointer offset at i_flags to reduce the object size. Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260113061845.159790-4-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit a13b68d79d5caa5ec0d34b4c0fb2dedf3259fc32 Author: Harry Yoo Date: Tue Jan 13 15:18:38 2026 +0900 mm/slab: allow specifying free pointer offset when using constructor When a slab cache has a constructor, the free pointer is placed after the object because certain fields must not be overwritten even after the object is freed. However, some fields that the constructor does not initialize can safely be overwritten after free. Allow specifying the free pointer offset within the object, reducing the overall object size when some fields can be reused for the free pointer. Adjust the document accordingly. Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260113061845.159790-3-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit b85f369b81aed457acbea4ad3314218254a72fd2 Author: Harry Yoo Date: Tue Jan 13 15:18:37 2026 +0900 mm/slab: use unsigned long for orig_size to ensure proper metadata align When both KASAN and SLAB_STORE_USER are enabled, accesses to struct kasan_alloc_meta fields can be misaligned on 64-bit architectures. This occurs because orig_size is currently defined as unsigned int, which only guarantees 4-byte alignment. When struct kasan_alloc_meta is placed after orig_size, it may end up at a 4-byte boundary rather than the required 8-byte boundary on 64-bit systems. Note that 64-bit architectures without HAVE_EFFICIENT_UNALIGNED_ACCESS are assumed to require 64-bit accesses to be 64-bit aligned. See HAVE_64BIT_ALIGNED_ACCESS and commit adab66b71abf ("Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"") for more details. Change orig_size from unsigned int to unsigned long to ensure proper alignment for any subsequent metadata. This should not waste additional memory because kmalloc objects are already aligned to at least ARCH_KMALLOC_MINALIGN. Closes: https://lore.kernel.org/all/aPrLF0OUK651M4dk@hyeyoo Suggested-by: Andrey Ryabinin Cc: stable@vger.kernel.org Fixes: 6edf2576a6cc ("mm/slub: enable debugging memory wasting of kmalloc") Signed-off-by: Harry Yoo Closes: https://lore.kernel.org/all/aPrLF0OUK651M4dk@hyeyoo/ Link: https://patch.msgid.link/20260113061845.159790-2-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 9346ee2b53936758afe49519318865dd7c2b1843 Author: Hao Li Date: Mon Dec 29 20:24:39 2025 +0800 slub: clarify object field layout comments The comments above check_pad_bytes() document the field layout of a single object. Rewrite them to improve clarity and precision. Also update an outdated comment in calculate_sizes(). Suggested-by: Harry Yoo Acked-by: Harry Yoo Signed-off-by: Hao Li Link: https://patch.msgid.link/20251229122415.192377-1-hao.li@linux.dev Signed-off-by: Vlastimil Babka commit 280ea9c3154b2af7d841f992c9fc79e9d6534e03 Author: Harry Yoo Date: Mon Jan 26 21:57:14 2026 +0900 mm/slab: avoid allocating slabobj_ext array from its own slab When allocating slabobj_ext array in alloc_slab_obj_exts(), the array can be allocated from the same slab we're allocating the array for. This led to obj_exts_in_slab() incorrectly returning true [1], although the array is not allocated from wasted space of the slab. Vlastimil Babka observed that this problem should be fixed even when ignoring its incompatibility with obj_exts_in_slab(), because it creates slabs that are never freed as there is always at least one allocated object. To avoid this, use the next kmalloc size or large kmalloc when the array can be allocated from the same cache we're allocating the array for. In case of random kmalloc caches, there are multiple kmalloc caches for the same size and the cache is selected based on the caller address. Because it is fragile to ensure the same caller address is passed to kmalloc_slab(), kmalloc_noprof(), and kmalloc_node_noprof(), bump the size to (s->object_size + 1) when the sizes are equal, instead of directly comparing the kmem_cache pointers. Note that this doesn't happen when memory allocation profiling is disabled, as when the allocation of the array is triggered by memory cgroup (KMALLOC_CGROUP), the array is allocated from KMALLOC_NORMAL. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202601231457.f7b31e09-lkp@intel.com [1] Cc: stable@vger.kernel.org Fixes: 4b8736964640 ("mm/slab: add allocation accounting into slab allocation and free paths") Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260126125714.88008-1-harry.yoo@oracle.com Reviewed-by: Hao Li Signed-off-by: Vlastimil Babka commit c5048ddee936ca5ce0aeb79172ce512130779d31 Author: Greg Kroah-Hartman Date: Tue Feb 3 13:30:37 2026 +0100 driver core: disable revocable code from build The revocable code is still under active discussion, and there is no in-kernel users of it. So disable it from the build for now so that no one suffers from it being present in the tree, yet leave it in the source tree so that others can easily test it by reverting this commit and building off of it for future releases. Acked-by: Danilo Krummrich Link: https://patch.msgid.link/2026020307-rimmed-dreamy-5a67@gregkh Reviewed-by: Tzung-Bi Shih Signed-off-by: Greg Kroah-Hartman commit cfd00b7e26c8331e3bb0f03ca770888866c15ff4 Merge: 1b65492f45c2ec 52f527d0916bcd Author: Arnd Bergmann Date: Wed Feb 4 08:41:48 2026 +0100 Merge tag 'soc_fsl-6.20-1' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux into soc/drivers FSL SOC Changes for 6.20 Freescale Management Complex: - Convert fsl-mc bus to bus callbacks - Fix a use-after-free - Drop redundant error messages - Fix ressources release on some error path Freescale QUICC Engine: - Add an interrupt controller for IO Ports - Use scoped for-each OF child loop * tag 'soc_fsl-6.20-1' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux: bus: fsl-mc: fix an error handling in fsl_mc_device_add() soc: fsl: qe: qe_ports_ic: Consolidate chained IRQ handler install/remove dt-bindings: soc: fsl: qe: Add an interrupt controller for QUICC Engine Ports soc: fsl: qe: Add an interrupt controller for QUICC Engine Ports soc: fsl: qe: Simplify with scoped for each OF child loop bus: fsl-mc: fix use-after-free in driver_override_show() bus: fsl-mc: Convert to bus callbacks bus: fsl-mc: Drop error message in probe function Signed-off-by: Arnd Bergmann commit f51d34065de4f29fd237276a49cad06ac7356a55 Merge: 0a82d3d40716a4 4d904af4d6ce29 Author: Arnd Bergmann Date: Wed Feb 4 08:39:08 2026 +0100 Merge tag 'socfpga_dts_updates_for_v6.20_v3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt SoCFPGA DTS updates for v6.20, version 3 - dt-bindings updates: - Add intel,socfpga-agilex5-socdk-modular for the Agilex5 mod board - Add intel,socfpga-agilex-emmc for the Agilex eMMC daughter board - Move entries in intel,socfpga.yaml into altera.yaml - Add syscon as a fallback for sys-mgr - Add dma-cohrerent property for Agilex5 NAND and DMA - Add support for the Agilex5 modular board - Add IOMMUS property for ethernet nodes for Agilex5 - Use lowercase hex for dts files - Add #address-cells and #size-cells for sram - Fix dtbs_check warning for fpga-region - Move dma controller node for Agilex5 under simple-bus - Add support for the Agilex eMMC daughter board * tag 'socfpga_dts_updates_for_v6.20_v3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: dt-bindings: intel: Add Agilex eMMC support arm64: dts: socfpga: agilex: add emmc support arm64: dts: intel: agilex5: Add simple-bus node on top of dma controller node ARM: dts: socfpga: fix dtbs_check warning for fpga-region ARM: dts: socfpga: add #address-cells and #size-cells for sram node dt-bindings: altera: document syscon as fallback for sys-mgr arm64: dts: altera: Use lowercase hex dt-bindings: arm: altera: combine Intel's SoCFPGA into altera.yaml arm64: dts: socfpga: agilex5: Add IOMMUS property for ethernet nodes arm64: dts: socfpga: agilex5: add support for modular board dt-bindings: intel: Add Agilex5 SoCFPGA modular board arm64: dts: socfpga: agilex5: Add dma-coherent property Signed-off-by: Arnd Bergmann commit 01d098dcfdd433862dec89c8b4f9c6372211fe73 Merge: f8a9c11000e52a 9872dae6102eb4 Author: Heiko Carstens Date: Wed Feb 4 08:32:01 2026 +0100 Merge branch 'tape-devices' Jan Höppner says: ==================== Quite a lot of the tape device driver code is outdated as devices and storage systems supported by that code aren't supported by IBM anymore for a long time. Especially physical tape devices are not supported or used directly anymore. The only tape storage system supported by IBM is the Virtual Tape Server (VTS) family with TS7700 systems [1]. Host systems will only talk to VTS and are presented with the virtualized 3490E tape device type only. VTS can and still uses tape libraries with physical 3592 cartridges as storage backends (e.g. TS4500). However, these are never seen by any host. The general goal/idea for the tape device driver is to only support VTS from now on. This series gets rid of old outdated code that is not relevant to VTS. There is probably quite a bit more that could be cleaned up or could be improved. However, this is a first run to cleanup the code base and somewhat reduce maintenance burden. [1] https://www.ibm.com/products/ts7700 [2] https://www.ibm.com/products/ts4500 ==================== Signed-off-by: Heiko Carstens commit 9872dae6102eb4d8c3cde83ded9df0d60f4e67d0 Author: Jan Höppner Date: Mon Feb 2 14:48:45 2026 +0100 s390/tape: Rename tape_34xx.c to tape_3490.c The driver now exclusively supports 3490 tape devices, given support for 3480 tape devices has been removed. Update the device driver name, its source file name, and change any occurrences of "34xx/34XX" to "3490" in the source code and comments. Signed-off-by: Jan Höppner Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit 13391069bdc2a1df83a51dc5c4bf12ada1c6bab6 Author: Jan Höppner Date: Mon Feb 2 14:48:44 2026 +0100 s390/tape: Cleanup sense data analysis and error handling Quite a few Error Recovery Action (ERA) codes and sense data entries are not relevant anymore for the Virtual Tape Server (VTS) and are not being used by VTS. Most of them were relevant for actual physical errors when a tape cartridge got stuck or a tape didn't rewind properly for example. Remove these codes from the sense data analysis as it's dead code anyway. Signed-off-by: Jan Höppner Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit 4b6852d764b7794e1b624dc71771b008716cde34 Author: Jan Höppner Date: Mon Feb 2 14:48:43 2026 +0100 s390/tape: Remove 3480 tape device type The only supported device type by the Virtual Tape Server is 3490. The 3480 device type was an old physical tape model and doesn't exist anymore. Remove 3480 from the list and any mention of it. Signed-off-by: Jan Höppner Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit 516fbb4852457d3d3f3623a91bd5b2d95c4f070b Author: Jan Höppner Date: Mon Feb 2 14:48:42 2026 +0100 s390/tape: Remove unused command definitions Quite a few command definitions are either not used or don't exist for 3490 tape devices on Virtual Tape Servers (VTS). Cleanup the list, which makes it easier to understand what commands are actually implemented by the driver. The lists below outline the exact reason for the removal. Description for existing commands are adapted to reflect the removal of support for old device types. The following commands don't exist in VTS for 3490 devices and are unused: INVALID_00 0x00 DIAG_MODE_SET 0x0B FORCE_STREAM_CNT 0xEB LOOP_WRITE_TO_READ 0x8B MODE_SET_C3 0xC3 MODE_SET_CB 0xCB MODE_SET_D3 0xD3 NEW_MODE_SET 0xEB RELEASE 0xD4 REQ_TRK_IN_ERROR 0x1B RESERVE 0xF4 SET_DIAGNOSE 0x4B The following command definitions are not used: CONTROL_ACCESS 0xE3 PERF_SUBSYS_FUNC 0x77 READ_BACKWARD 0x0C READ_BUFFER 0x12 READ_BUFF_LOG 0x24 READ_CONFIG_DATA 0xFA READ_DEV_CHAR 0x64 READ_MESSAGE_ID 0x4E READ_SUBSYS_DATA 0x3E SENSE_GROUP_ID 0x34 SENSE_ID 0xE4 SET_GROUP_ID 0xAF SET_INTERFACE_ID 0x73 SET_TAPE_WRITE_IMMED 0xC3 SUSPEND 0x5B SYNC 0x43 Signed-off-by: Jan Höppner Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit 28da74c2943972168976d58ef5a1dc2b5493e890 Author: Jan Höppner Date: Mon Feb 2 14:48:41 2026 +0100 s390/tape: Remove special block id handling For real 3490 tape models a logical block was composed of a direction bit (wrap), a segment number, a format mode, and a logical block number. This is represented in a 4byte identifier. The Virtual Tape Server (VTS) emulates 3490 tape devices and uses a stripped block id format where bit 0-9 of the 4byte identifier are always 0. Bit 10-31 represent the logical block number. All tapes use the 3480-2 XF format, which was defined via TAPE34XX_FMT_3480_2_XF but never used. There is also no special handling required anymore as this is the only format being used. Since VTS doesn't require any special handling of block ids and format, corresponding code is removed. Signed-off-by: Jan Höppner Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit effcf3df282ba66e60718cefd08c6a3ed57d9dd3 Author: Jan Höppner Date: Mon Feb 2 14:48:40 2026 +0100 s390/tape: Remove tape load display support The LOAD_DISPLAY (LDD) X'9F' is still accepted by the Virtual Tape Server (VTS) but does not perform any action. Remove all functions and definitions related to this command. The tape_34xx_ioctl() function is also removed as it was mainly used to handle additional ioctl functionality. LOAD_DISPLAY was the only left case. All other ioctls are handled in tapechar_ioctl(). With LOAD_DISPLAY, the remaining definitions in asm/tape390.h are gone. Delete the file. Signed-off-by: Jan Höppner Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit c03b6ef74c2b48a0f544f27c7354d5200ab6569c Author: Jan Höppner Date: Mon Feb 2 14:48:39 2026 +0100 s390/tape: Remove support for 3590/3592 models Physical 3590/3592 tape models are not supported anymore for a very long time. The Virtual Tape Server (VTS) emulates and presents only 3490E models to the host. This is the only supported model and storage server. Remove the entire code base for 3590/3592 models as it can be considered dead code for quite some time already. Signed-off-by: Jan Höppner Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit afefdb2bc94571f0f9297dc129b2069942a70f4b Author: Michael Kelley Date: Mon Feb 2 08:48:39 2026 -0800 x86/hyperv: Update comment in hyperv_cleanup() The comment in hyperv_cleanup() became out-of-date as a result of commit c8ed0812646e ("x86/hyperv: Use direct call to hypercall-page"). Update the comment. No code or functional change. Signed-off-by: Michael Kelley Signed-off-by: Wei Liu commit 2b4246153e2184e3a3b4edc8cc35337d7a2455a6 Author: Carlos López Date: Thu Jan 22 12:41:31 2026 +0100 mshv: clear eventfd counter on irqfd shutdown While unhooking from the irqfd waitqueue, clear the internal eventfd counter by using eventfd_ctx_remove_wait_queue() instead of remove_wait_queue(), preventing potential spurious interrupts. This removes the need to store a pointer into the workqueue, as the eventfd already keeps track of it. This mimicks what other similar subsystems do on their equivalent paths with their irqfds (KVM, Xen, ACRN support, etc). Signed-off-by: Carlos López Signed-off-by: Wei Liu commit 5ed8cbcaccc0e0ed90e03dac153d01d5b13f6724 Author: Michael Kelley Date: Mon Jan 19 07:59:37 2026 -0800 x86/hyperv: Use memremap()/memunmap() instead of ioremap_cache()/iounmap() When running with a paravisor and SEV-SNP, the GHCB page is provided by the paravisor instead of being allocated by Linux. The provided page is normal memory, but is outside of the physical address space seen by Linux. As such it cannot be accessed via the kernel's direct map, and must be explicitly mapped to a kernel virtual address. Current code uses ioremap_cache() and iounmap() to map and unmap the page. These functions are for use on I/O address space that may not behave as normal memory, so they generate or expect addresses with the __iomem attribute. For normal memory, the preferred functions are memremap() and memunmap(), which operate similarly but without __iomem. At the time of the original work on CoCo VMs on Hyper-V, memremap() did not support creating a decrypted mapping, so ioremap_cache() was used instead, since I/O address space is always mapped decrypted. memremap() has since been enhanced to allow decrypted mappings, so replace ioremap_cache() with memremap() when mapping the GHCB page. Similarly, replace iounmap() with memunmap(). As a side benefit, the replacement cleans up 'sparse' warnings about __iomem mismatches. The replacement is done to use the correct functions as long-term goodness and to clean up the sparse warnings. No runtime bugs are fixed. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202311111925.iPGGJik4-lkp@intel.com/ Signed-off-by: Michael Kelley Signed-off-by: Wei Liu commit 0236e75df4d0802a23e3c8d794dbce329cd34a60 Author: Michael Kelley Date: Sun Jan 18 19:34:35 2026 -0800 Drivers: hv: Use memremap()/memunmap() instead of ioremap_cache()/iounmap() When running with a paravisor or in the root partition, the SynIC event and message pages are provided by the paravisor or hypervisor respectively, instead of being allocated by Linux. The provided pages are normal memory, but are outside of the physical address space seen by Linux. As such they cannot be accessed via the kernel's direct map, and must be explicitly mapped to a kernel virtual address. Current code uses ioremap_cache() and iounmap() to map and unmap the pages. These functions are for use on I/O address space that may not behave as normal memory, so they generate or expect addresses with the __iomem attribute. For normal memory, the preferred functions are memremap() and memunmap(), which operate similarly but without __iomem. At the time of the original work on CoCo VMs on Hyper-V, memremap() did not support creating a decrypted mapping, so ioremap_cache() was used instead, since I/O address space is always mapped decrypted. memremap() has since been enhanced to allow decrypted mappings, so replace ioremap_cache() with memremap() when mapping the event and message pages. Similarly, replace iounmap() with memunmap(). As a side benefit, the replacement cleans up 'sparse' warnings about __iomem mismatches. The replacement is done to use the correct functions as long-term goodness and to clean up the sparse warnings. No runtime bugs are fixed. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601170445.JtZQwndW-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202512150359.fMdmbddk-lkp@intel.com/ Signed-off-by: Michael Kelley Signed-off-by: Wei Liu commit c3a6ae7ea2d3f507cbddb5818ccc65b9d84d6dc7 Author: Mukesh R Date: Tue Feb 3 17:58:00 2026 -0800 x86/hyperv: Move hv crash init after hypercall pg setup hv_root_crash_init() is not setting up the hypervisor crash collection for baremetal cases because when it's called, hypervisor page is not setup. Fix is simple, just move the crash init call after the hypercall page setup. Signed-off-by: Mukesh Rathor Signed-off-by: Wei Liu commit 93f039fe7a775007d7602c34d51b570f4a382bd7 Author: Ethan Nelson-Moore Date: Fri Jan 30 18:00:17 2026 -0800 PCI: hv: remove unnecessary module_init/exit functions The pci-hyperv-intf driver has unnecessary empty module_init and module_exit functions. Remove them. Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore Signed-off-by: Wei Liu commit ff225ba9ad71c4c5f900b9aa1b757adafcfb449d Author: Nuno Das Neves Date: Wed Jan 28 10:11:46 2026 -0800 mshv: Add debugfs to view hypervisor statistics Introduce a debugfs interface to expose root and child partition stats when running with mshv_root. Create a debugfs directory "mshv" containing 'stats' files organized by type and id. A stats file contains a number of counters depending on its type. e.g. an excerpt from a VP stats file: TotalRunTime : 1997602722 HypervisorRunTime : 649671371 RemoteNodeRunTime : 0 NormalizedRunTime : 1997602721 IdealCpu : 0 HypercallsCount : 1708169 HypercallsTime : 111914774 PageInvalidationsCount : 0 PageInvalidationsTime : 0 On a root partition with some active child partitions, the entire directory structure may look like: mshv/ stats # hypervisor stats lp/ # logical processors 0/ # LP id stats # LP 0 stats 1/ 2/ 3/ partition/ # partition stats 1/ # root partition id stats # root partition stats vp/ # root virtual processors 0/ # root VP id stats # root VP 0 stats 1/ 2/ 3/ 42/ # child partition id stats # child partition stats vp/ # child VPs 0/ # child VP id stats # child VP 0 stats 1/ 43/ 55/ On L1VH, some stats are not present as it does not own the hardware like the root partition does: - The hypervisor and lp stats are not present - L1VH's partition directory is named "self" because it can't get its own id - Some of L1VH's partition and VP stats fields are not populated, because it can't map its own HV_STATS_AREA_PARENT page. Co-developed-by: Stanislav Kinsburskii Signed-off-by: Stanislav Kinsburskii Co-developed-by: Praveen K Paladugu Signed-off-by: Praveen K Paladugu Co-developed-by: Mukesh Rathor Signed-off-by: Mukesh Rathor Co-developed-by: Purna Pavan Chandra Aekkaladevi Signed-off-by: Purna Pavan Chandra Aekkaladevi Co-developed-by: Jinank Jain Signed-off-by: Jinank Jain Signed-off-by: Nuno Das Neves Reviewed-by: Stanislav Kinsburskii Acked-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit c23271b636db45156933d0c55c49109766f12f5a Author: Nuno Das Neves Date: Wed Jan 28 10:11:45 2026 -0800 mshv: Add data for printing stats page counters Introduce mshv_debugfs_counters.c, containing static data corresponding to HV_*_COUNTER enums in the hypervisor source. Defining the enum members as an array instead makes more sense, since it will be iterated over to print counter information to debugfs. Include hypervisor, logical processor, partition, and virtual processor counters. Signed-off-by: Nuno Das Neves Acked-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit df40f32c87be64c96ee974573968592e147a4ded Author: Nuno Das Neves Date: Wed Jan 28 10:11:44 2026 -0800 mshv: Update hv_stats_page definitions hv_stats_page belongs in hvhdk.h, move it there. It does not require a union to access the data for different counters, just use a single u64 array for simplicity and to match the Windows definitions. While at it, correct the ARM64 value for VpRootDispatchThreadBlocked. Signed-off-by: Nuno Das Neves Acked-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit c527c7aee28f266423afff872df7bff4fad3e084 Author: Stanislav Kinsburskii Date: Wed Jan 28 10:11:43 2026 -0800 mshv: Always map child vp stats pages regardless of scheduler type Currently vp->vp_stats_pages is only used by the root scheduler for fast interrupt injection. Soon, vp_stats_pages will also be needed for exposing child VP stats to userspace via debugfs. Mapping the pages a second time to a different address causes an error on L1VH. Remove the scheduler requirement and always map the vp stats pages. Signed-off-by: Stanislav Kinsburskii Signed-off-by: Nuno Das Neves Acked-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 1ba923d8cd837ec6ee33525f60f84daaaa26d4e9 Author: Stanislav Kinsburskii Date: Wed Jan 28 10:11:42 2026 -0800 mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h These functions are currently only used to map child partition VP stats, on root partition. However, they will soon be used on L1VH, and also used for mapping the host's own VP stats. Introduce a helper is_l1vh_parent() to determine whether we are mapping our own VP stats. In this case, do not attempt to map the PARENT area. Note this is a different case than mapping PARENT on an older hypervisor where it is not available at all, so must be handled separately. On unmap, pass the stats pages since on L1VH the kernel allocates them and they must be freed in hv_unmap_stats_page(). Signed-off-by: Stanislav Kinsburskii Signed-off-by: Nuno Das Neves Acked-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 2de4516aa8f726946eadb9831c610b7aeb5bc682 Author: Stanislav Kinsburskii Date: Wed Jan 28 10:11:41 2026 -0800 mshv: Use typed hv_stats_page pointers Refactor all relevant functions to use struct hv_stats_page pointers instead of void pointers for stats page mapping and unmapping thus improving type safety and code clarity across the Hyper-V stats mapping APIs. Signed-off-by: Stanislav Kinsburskii Signed-off-by: Nuno Das Neves Acked-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 7538b80e5a4b473b73428d13b3a47ceaad9a8a7c Author: Purna Pavan Chandra Aekkaladevi Date: Wed Jan 28 10:11:40 2026 -0800 mshv: Ignore second stats page map result failure Older versions of the hypervisor do not have a concept of separate SELF and PARENT stats areas. In this case, mapping the HV_STATS_AREA_SELF page is sufficient - it's the only page and it contains all available stats. Mapping HV_STATS_AREA_PARENT returns HV_STATUS_INVALID_PARAMETER which currently causes module init to fail on older hypevisor versions. Detect this case and gracefully fall back to populating stats_pages[HV_STATS_AREA_PARENT] with the already-mapped SELF page. Add comments to clarify the behavior, including a clarification of why this isn't needed for hv_call_map_stats_page2() which always supports PARENT and SELF areas. Signed-off-by: Purna Pavan Chandra Aekkaladevi Signed-off-by: Nuno Das Neves Reviewed-by: Stanislav Kinsburskii Acked-by: Stanislav Kinsburskii Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 8d1294d4b54464a6b826709c871878c80e3c219e Author: Michael Kelley Date: Thu Jan 29 07:51:54 2026 -0800 mshv: Use EPOLLIN and EPOLLHUP instead of POLLIN and POLLHUP mshv code currently uses the POLLIN and POLLHUP flags. Starting with commit a9a08845e9acb ("vfs: do bulk POLL* -> EPOLL* replacement") the intent is to use the EPOLL* versions throughout the kernel. The comment at the top of mshv_eventfd.c describes it as being inspired by the KVM implementation, which was changed by the above mentioned commit in 2018 to use EPOLL*. mshv_eventfd.c is much newer than 2018 and there's no statement as to why it must use the POLL* versions. So change it to use the EPOLL* versions. This change also resolves a 'sparse' warning. No functional change, and the generated code is the same. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601220948.MUTO60W4-lkp@intel.com/ Signed-off-by: Michael Kelley Reviewed-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit 956efd32f9e5d258a82c086e5c18a4f5abdd10c4 Author: Mukesh R Date: Wed Feb 4 06:11:38 2026 +0000 x86/hyperv: fix a compiler warning in hv_crash.c Fix a compiler warning that status is defined by not used. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512301641.FC6OAbGM-lkp@intel.com/ Signed-off-by: Mukesh R Signed-off-by: Wei Liu commit 754cf84504ea7dad1e9439b93f8729409ef2c2f2 Author: Michael Kelley Date: Sun Jan 18 09:02:45 2026 -0800 mshv: Fix compiler warning about cast converting incompatible function type In mshv_vtl_sint_ioctl_pause_msg_stream(), the reference to function mshv_vtl_synic_mask_vmbus_sint() is cast to type smp_call_func_t. The cast generates a compiler warning because the function signature of mshv_vtl_synic_mask_vmbus_sint() doesn't match smp_call_func_t. There's no actual bug here because the mis-matched function signatures are compatible at runtime. Nonetheless, eliminate the compiler warning by changing the function signature of mshv_vtl_synic_mask_vmbus_sint() to match what on_each_cpu() expects. Remove the cast because it is then no longer necessary. No functional change. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601170352.qbh3EKH5-lkp@intel.com/ Signed-off-by: Michael Kelley Reviewed-by: Naman Jain Signed-off-by: Wei Liu commit 90fb0a25f6543d2403dcd82e6f0bece92fa7f54c Author: Michael Kelley Date: Sun Jan 11 09:00:34 2026 -0800 PCI: hv: Remove unused field pci_bus in struct hv_pcibus_device Field pci_bus in struct hv_pcibus_device is unused since commit 418cb6c8e051 ("PCI: hv: Generify PCI probing"). Remove it. No functional change. Signed-off-by: Michael Kelley Reviewed-by: Easwar Hariharan Reviewed-by: Prasanna Kumar T S M Reviewed-by: Srivatsa S. Bhat (Microsoft) Signed-off-by: Wei Liu commit 7fbabe8f07e41e0bfdecf50e2308440961dceb93 Merge: 8f0b4cce4481fb 012e012e4917da Author: Stephen Boyd Date: Tue Feb 3 21:41:51 2026 -0800 Merge tag 'qcom-clk-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: - Convert clock dividers from round_rate() to determine_rate() - Add support for global, tcsr, rpmh, display, gpu, camera, and video clock controllers for Kaanapali - Add support for camera clock controller for SM8750 - Fix the SDCC RCGs to use shared_floor_ops across a variety of platforms - Add support for global clock controller on MSM8940 and SDM439 * tag 'qcom-clk-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (49 commits) clk: qcom: sm8750: Constify 'qcom_cc_desc' in SM8750 camcc clk: qcom: gfx3d: add parent to parent request map clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src clk: qcom: dispcc-sdm845: Enable parents for pixel clocks clk: qcom: regmap-divider: convert from divider_round_rate() to divider_determine_rate() clk: qcom: regmap-divider: convert from divider_ro_round_rate() to divider_ro_determine_rate() clk: qcom: alpha-pll: convert from divider_round_rate() to divider_determine_rate() clk: qcom: Add support for GPUCC and GXCLK for Kaanapali clk: qcom: Add support for VideoCC driver for Kaanapali clk: qcom: camcc: Add support for camera clock controller for Kaanapali clk: qcom: dispcc: Add support for display clock controller Kaanapali clk: qcom: clk-alpha-pll: Add support for controlling Pongo EKO_T PLL clk: qcom: clk-alpha-pll: Update the PLL support for cal_l clk: qcom: camcc: Add camera clock controller driver for SM8750 SoC clk: qcom: clk-alpha-pll: Add support for controlling Rivian PLL dt-bindings: clock: qcom: document the Kaanapali GPU Clock Controller dt-bindings: clock: qcom: Add Kaanapali video clock controller dt-bindings: clock: qcom: Add support for CAMCC for Kaanapali dt-bindings: clock: qcom: document Kaanapali DISPCC clock controller dt-bindings: clock: qcom: Add camera clock controller for SM8750 SoC ... commit 5f35b48a0daa799ee6346f7b6b4fe433d6565280 Author: Jammy Huang Date: Fri Oct 3 09:58:45 2025 +0800 clk: aspeed: Add reset for HACE/VIDEO Add mappings of reset per hw's definition. Signed-off-by: Jammy Huang Signed-off-by: Stephen Boyd commit 2ad2d0e291ac6f4ffc66dce11c09ccc6dd968a9b Author: Jammy Huang Date: Fri Oct 3 09:58:44 2025 +0800 dt-bindings: clock: aspeed: Add VIDEO reset definition ASPEED clock controller provides a couple of resets. Add the define of video to allow referring to it. Signed-off-by: Jammy Huang Acked-by: Conor Dooley Signed-off-by: Stephen Boyd commit fdc1eb624ddc2876079ce30218eed971b7953280 Author: Ryan Chen Date: Wed Dec 24 13:37:24 2025 +0800 clk: aspeed: add AST2700 clock driver Add AST2700 clock controller driver and also use axiliary device framework register the reset controller driver. Due to clock and reset using the same register region. Signed-off-by: Ryan Chen Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 122c157c4808f79bfe2d1786b59479fead43ad92 Author: Ryan Chen Date: Wed Dec 24 13:37:23 2025 +0800 MAINTAINERS: Add entry for ASPEED clock drivers. Add support entry for ASPEED clock drivers. Signed-off-by: Ryan Chen Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 03b3faa12c25140d00f9dca4ed44a6184600d9d8 Author: Ryan Chen Date: Wed Dec 24 13:37:22 2025 +0800 clk: aspeed: Move the existing ASPEED clk drivers into aspeed subdirectory. Prepare for long-term maintenance and future additions by introducing a dedicated drivers/clk/aspeed/ subdirectory for ASPEED clock drivers. Move the existing ASPEED clock drivers into the new drivers/clk/aspeed/ subdirectory. No functional change, file move only. Signed-off-by: Ryan Chen Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 448b50b5cf12b7df254cae1d7ba3746e1acfc683 Author: Stephen Boyd Date: Wed Jan 28 11:01:34 2026 -0800 Revert "clk: Respect CLK_OPS_PARENT_ENABLE during recalc" This reverts commit 669917676e93fca5ea3c66fc9539830312bec58e. It's been shown to cause problems on i.MX and STM32 platforms where the board doesn't boot. In one case, a clk with CLK_IS_CRITICAL and CLK_OPS_PARENT_ENABLE is being registered causing the parent to be enabled, the rate recalculated, and then the parent is disabled causing the critical clk being registered to stop clocking. A fix for that would be to calculate the rate of the clk after enabling the critical clk itself, but that wouldn't fix another problem where a clk with CLK_OPS_PARENT_ENABLE is registered before the parent is registered. In this case the hardware access in the clk_ops::recalc_rate() function would fail if the parent is disabled. There are even more problems exposed by this patch because it introduces logic that disables clks earlier in system boot than has existed previously. Historically we've not disabled clks until late init (clk_disable_unused) under the assumption that clks have been registered enough to have a consistent view of the clk tree. The clk_disable_unused logic doesn't work very well though, leading to quite a few devices booting with clk_ignore_unused on the kernel command line. Long story short, disabling clks during clk registration is full of pitfalls. Revert this commit until a proper solution can be found. Reported-by: Alexander Stein Closes: https://lore.kernel.org/r/6239343.lOV4Wx5bFT@steina-w Reported-by: Mark Brown Closes: https://lore.kernel.org/r/036da7ce-6487-4a6e-9b15-97c6d3bcdcec@sirena.org.uk Cc: Nicolas Frattaroli Cc: Brian Masney Cc: AngeloGioacchino Del Regno Cc: Chen-Yu Tsai Tested-by: Peng Fan Tested-by: Alexander Stein Reviewed-by: Brian Masney Tested-by: Mark Brown Signed-off-by: Stephen Boyd commit 520e345dfdab89aed4a0ad98d5ec35086661a11a Author: Gwendal Grignou Date: Tue Feb 3 19:48:48 2026 -0800 platform/chrome: lightbar: Use flexible array member Variable arrays should be defined as [], not [0], otherwise the kernel complains: memcpy : detected field-spanning write (size 9) of single field "param->set_program_ex.data" at drivers/platform/chrome/cros_ec_lightbar.c:603 (size 0) Fixes: 9600b8bdbfe4 ("platform/chrome: lightbar: Add support for large sequence") Signed-off-by: Gwendal Grignou Link: https://lore.kernel.org/r/20260204034848.697033-1-gwendal@google.com Signed-off-by: Tzung-Bi Shih commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 Author: Ethan Nelson-Moore Date: Mon Feb 2 17:39:09 2026 -0800 net: usb: sr9700: remove code to drive nonexistent multicast filter Several registers referenced in this driver's source code do not actually exist (they are not writable and read as zero in my testing). They exist in this driver because it originated as a copy of the dm9601 driver. Notably, these include the multicast filter registers - this causes the driver to not support multicast packets correctly. Remove the multicast filter code and register definitions. Instead, set the chip to receive all multicast filter packets when any multicast addresses are in the list. Reviewed-by: Simon Horman (from v1) Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 61e94cbdf8220915c033ec5f07977a2de1b1d790 Author: Ethan Nelson-Moore Date: Mon Feb 2 17:34:55 2026 -0800 net: usb: introduce usbnet_mii_ioctl helper function Many USB network drivers use identical code to pass ioctl requests on to the MII layer. Reduce code duplication by refactoring this code into a helper function. Reviewed-by: Vadim Fedorenko (v1) Reviewed-by: Andrew Lunn (v3) Signed-off-by: Ethan Nelson-Moore Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260203013517.26170-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit e9a1a28af9d2da3f3e6a489f6a9fbfba8fb9fa1a Merge: 6dfa3df797bbea 9c2f568eb23603 Author: Jakub Kicinski Date: Tue Feb 3 19:35:40 2026 -0800 Merge branch 'net-ethernet-renesas-rcar_gen4_ptp-hide-private-data' Niklas Söderlund says: ==================== net: ethernet: renesas: rcar_gen4_ptp: Hide private data The R-Car Gen4 PTP module started out as an exclusive feature of a single driver, but have since been extended to cover both R-Car Switch and TSN driver implementations on Gen4. The feature have already been extended to be built as its own module with an interface exposed thru a local header file. The header file however also exposes the modules private data structure. The two existing users have already started to poke at members of the struct. The exposed private data being manipulated by users makes refactoring and future rework hard as the interface for the module becomes to chaotic. This small series aims to create two helpers to hide the private data. This is done as a small preparation before a third, new, users of the Gen4 PTP will be added in a follow up series. ==================== Link: https://patch.msgid.link/20260201183745.1075399-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 9c2f568eb236032071b73666ccd7715ddacc1fca Author: Niklas Söderlund Date: Sun Feb 1 19:37:45 2026 +0100 net: ethernet: renesas: rcar_gen4_ptp: Hide private data from users The Gen4 PTP helper module is already used by RTSN and RSWITCH to support PTP clocks and will be used by RAVB too. Hide the Gen4 PTP private data structure to make sure none of the users poke at it. This will be more important for RAVB use-cases as more then one RAVB device will need to cooperate using one PTP clock source. Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20260201183745.1075399-5-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 5640afa0583d581320d649c4c137bd265607a56a Author: Niklas Söderlund Date: Sun Feb 1 19:37:44 2026 +0100 net: ethernet: renesas: rcar_gen4_ptp: Add helper to read time Instead of accessing the Gen4 PTP specific structure directly in drivers add a helper to read the time. This is done in preparation to completely hide the Gen4 PTP specific structure from users. Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20260201183745.1075399-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 9afe65e7e7d727966d8b6f022cd13ae34e12cc55 Author: Niklas Söderlund Date: Sun Feb 1 19:37:43 2026 +0100 net: ethernet: renesas: rcar_gen4_ptp: Add helper to get clock index Instead of accessing the Gen4 PTP specific structure directly in drivers add a helper to read the clock index. This is done in preparation to completely hide the Gen4 PTP specific structure from users. Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20260201183745.1075399-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 642377346a4e657eaab99f83fd4db2c8c15a5fdd Author: Niklas Söderlund Date: Sun Feb 1 19:37:42 2026 +0100 net: ethernet: renesas: rcar_gen4_ptp: Move address assignment Instead of accessing the Gen4 PTP specific structure directly in drivers move the device address assignment into the preparation call. This is done in preparation to completely hide the Gen4 PTP specific structure from users. Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20260201183745.1075399-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 1982257570b84dc33753d536dd969fd357a014e9 Author: Colin Ian King Date: Thu Jan 29 15:53:32 2026 +0000 scsi: csiostor: Fix dereference of null pointer rn The error exit path when rn is NULL ends up deferencing the null pointer rn via the use of the macro CSIO_INC_STATS. Fix this by adding a new error return path label after the use of the macro to avoid the deference. Fixes: a3667aaed569 ("[SCSI] csiostor: Chelsio FCoE offload driver") Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20260129155332.196338-1-colin.i.king@gmail.com Signed-off-by: Martin K. Petersen commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 Author: Arnd Bergmann Date: Tue Feb 3 17:33:15 2026 +0100 scsi: buslogic: Reduce stack usage Some randconfig builds run into excessive stack usage with gcc-14 or higher, which use __attribute__((cold)) where earlier versions did not do that: drivers/scsi/BusLogic.c: In function 'blogic_init': drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] The problem is that a lot of code gets inlined into blogic_init() here. Two functions stick out, but they are a bit different: - blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel stack, which is a problem in combination with other functions that also do. Marking this one as noinline means that the stack slots get get reused between function calls - blogic_reportconfig() has a few large variables, but whenever it is not inlined into its caller, the compiler is actually smart enough to reuse stack slots for these automatically, so marking it as noinline saves most of the stack space by itself. The combination of both of these should avoid the problem entirely. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org Signed-off-by: Martin K. Petersen commit ffd42b6d0420c4be97cc28fd1bb5f4c29e286e98 Author: Eric Biggers Date: Mon Feb 2 14:15:52 2026 -0800 lib/crypto: mldsa: Clarify the documentation for mldsa_verify() slightly mldsa_verify() implements ML-DSA.Verify with ctx='', so document this more explicitly. Remove the one-liner comment above mldsa_verify() which was somewhat misleading. Reviewed-by: David Howells Link: https://lore.kernel.org/r/20260202221552.174341-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit bbb8d98fb4536594cb104fd630ea0f7dce3771d6 Author: Arnd Bergmann Date: Mon Feb 2 10:50:18 2026 +0100 scsi: ufs: host: mediatek: Require CONFIG_PM The added print statement from a recent fix causes the driver to fail building when CONFIG_PM is disabled: drivers/ufs/host/ufs-mediatek.c: In function 'ufs_mtk_resume': drivers/ufs/host/ufs-mediatek.c:1890:40: error: 'struct dev_pm_info' has no member named 'request' 1890 | hba->dev->power.request, It seems unlikely that the driver can work at all without CONFIG_PM, so just add a dependency and remove the existing ifdef checks, rather than adding another ifdef. Fixes: 15ef3f5aa822 ("scsi: ufs: host: mediatek: Enhance recovery on resume failure") Signed-off-by: Arnd Bergmann Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20260202095052.1232703-1-arnd@kernel.org Signed-off-by: Martin K. Petersen commit 9672ed3de7d772ceddd713c769c05e832fc69bae Author: Keita Morisaki Date: Mon Feb 2 11:45:26 2026 +0900 scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event The ufs_mtk_clk_scale() trace event currently stores the address of the name string directly via __field(const char *, name). This pointer may become invalid after the module is unloaded, causing page faults when the trace buffer is subsequently accessed. This can occur because the MediaTek UFS driver can be configured as a loadable module (tristate in Kconfig), meaning the name string passed to the trace event may reside in module memory that becomes invalid after module unload. Fix this by using __string() and __assign_str() to copy the string contents into the ring buffer instead of storing the pointer. This ensures the trace data remains valid regardless of module state. This change increases the memory usage for each ftrace entry by a few bytes (clock names are typically 7-15 characters like "ufs_sel" or "ufs_sel_max_src") compared to storing an 8-byte pointer. Note that this change does not affect anything unless all of the following conditions are met: - CONFIG_SCSI_UFS_MEDIATEK is enabled - ftrace tracing is enabled - The ufs_mtk_clk_scale event is enabled in ftrace Signed-off-by: Keita Morisaki Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260202024526.122515-1-keita.morisaki@tier4.jp Signed-off-by: Martin K. Petersen commit 41b37312bd9722af77ec7817ccf22d7a4880c289 Author: Zilin Guan Date: Sat Jan 31 09:36:41 2026 +0000 scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() pqi_report_phys_luns() fails to release the rpl_list buffer when encountering an unsupported data format or when the allocation for rpl_16byte_wwid_list fails. These early returns bypass the cleanup logic, leading to memory leaks. Consolidate the error handling by adding an out_free_rpl_list label and use goto statements to ensure rpl_list is consistently freed on failure. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 28ca6d876c5a ("scsi: smartpqi: Add extended report physical LUNs") Signed-off-by: Zilin Guan Tested-by: Don Brace Acked-by: Don Brace Link: https://patch.msgid.link/20260131093641.1008117-1-zilin@seu.edu.cn Signed-off-by: Martin K. Petersen commit 21a16f0f02263db5a1bc4739036abca698b8808f Author: Guixin Liu Date: Fri Jan 30 16:02:07 2026 +0800 scsi: mpi3mr: Make driver probing asynchronous Speed up the boot process by using the asynchronous probing feature supported by the kernel. Set the PROBE_PREFER_ASYNCHRONOUS flag in the device_driver structure so that the driver core probes in parallel. Signed-off-by: Guixin Liu Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260130080207.90053-1-kanie@linux.alibaba.com Signed-off-by: Martin K. Petersen commit 6dfa3df797bbea7ae2527c21eaff58de5ae8c580 Author: David Corvaglia Date: Mon Feb 2 19:09:41 2026 +0000 net: bridge: use sysfs_emit instead of sprintf Replace sprintf with sysfs_emit in sysfs show() methods as outlined in Documentation/filesystems/sysfs.rst. sysfs_emit is preferred to sprintf in sysfs show() methods as it is safer with buffer handling. Signed-off-by: David Corvaglia Acked-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/0100019c1fc2bcc3-bc9ca2f1-22d7-4250-8441-91e4af57117b-000000@email.amazonses.com Signed-off-by: Jakub Kicinski commit f8ef441811ec413717f188f63d99182f30f0f08e Author: Thomas Yen Date: Fri Jan 30 00:51:51 2026 +0800 scsi: ufs: core: Flush exception handling work when RPM level is zero Ensure that the exception event handling work is explicitly flushed during suspend when the runtime power management level is set to UFS_PM_LVL_0. When the RPM level is zero, the device power mode and link state both remain active. Previously, the UFS core driver bypassed flushing exception event handling jobs in this configuration. This created a race condition where the driver could attempt to access the host controller to handle an exception after the system had already entered a deep power-down state, resulting in a system crash. Explicitly flush this work and disable auto BKOPs before the suspend callback proceeds. This guarantees that pending exception tasks complete and prevents illegal hardware access during the power-down sequence. Fixes: 57d104c153d3 ("ufs: add UFS power management support") Signed-off-by: Thomas Yen Cc: Stable Tree Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260129165156.956601-1-thomasyen@google.com Signed-off-by: Martin K. Petersen commit 1384a81e54fa73b852a6ec2593f2e29cbcf57747 Author: Alok Tiwari Date: Sun Feb 1 19:38:43 2026 -0800 bng_en: fix misleading error message for generic firmware version The devlink info_get handler incorrectly reports "roce firmware" when populating the generic firmware version field. Update the error message to correctly describe the failing operation. Signed-off-by: Alok Tiwari Reviewed-by: Vikas Gupta Link: https://patch.msgid.link/20260202033848.22993-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 6b157b408d0c7d125e4d7c62e11e7d9376a5d150 Author: Corey Minyard Date: Fri Jan 16 17:22:01 2026 -0600 ipmi:ls2k: Make ipmi_ls2k_platform_driver static No need for it to be global. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601170753.3zDBerGP-lkp@intel.com/ Signed-off-by: Corey Minyard commit 9f235ccecd03c436cb1683eac16b12f119e54aa9 Author: Matt Johnston Date: Tue Jan 13 17:41:34 2026 +0800 ipmi: ipmb: initialise event handler read bytes IPMB doesn't use i2c reads, but the handler needs to set a value. Otherwise an i2c read will return an uninitialised value from the bus driver. Fixes: 63c4eb347164 ("ipmi:ipmb: Add initial support for IPMI over IPMB") Signed-off-by: Matt Johnston Message-ID: <20260113-ipmb-read-init-v1-1-a9cbce7b94e3@codeconstruct.com.au> Signed-off-by: Corey Minyard commit 1d90e6c1a56f6ab83e5c9d30ded19e7ac8155713 Author: Corey Minyard Date: Tue Jan 27 07:35:02 2026 -0600 ipmi: Consolidate the run to completion checking for xmit msgs lock It made things hard to read, move the check to a function. Signed-off-by: Corey Minyard Reviewed-by: Breno Leitao commit 594c11d0e1d445f580898a2b8c850f2e3f099368 Author: Corey Minyard Date: Tue Jan 27 07:22:35 2026 -0600 ipmi: Fix use-after-free and list corruption on sender error The analysis from Breno: When the SMI sender returns an error, smi_work() delivers an error response but then jumps back to restart without cleaning up properly: 1. intf->curr_msg is not cleared, so no new message is pulled 2. newmsg still points to the message, causing sender() to be called again with the same message 3. If sender() fails again, deliver_err_response() is called with the same recv_msg that was already queued for delivery This causes list_add corruption ("list_add double add") because the recv_msg is added to the user_msgs list twice. Subsequently, the corrupted list leads to use-after-free when the memory is freed and reused, and eventually a NULL pointer dereference when accessing recv_msg->done. The buggy sequence: sender() fails -> deliver_err_response(recv_msg) // recv_msg queued for delivery -> goto restart // curr_msg not cleared! sender() fails again (same message!) -> deliver_err_response(recv_msg) // tries to queue same recv_msg -> LIST CORRUPTION Fix this by freeing the message and setting it to NULL on a send error. Also, always free the newmsg on a send error, otherwise it will leak. Reported-by: Breno Leitao Closes: https://lore.kernel.org/lkml/20260127-ipmi-v1-0-ba5cc90f516f@debian.org/ Fixes: 9cf93a8fa9513 ("ipmi: Allow an SMI sender to return an error") Cc: stable@vger.kernel.org # 4.18 Reviewed-by: Breno Leitao Signed-off-by: Corey Minyard commit 1508301d4a47212faec673d63359241146993acf Author: Sebastian Andrzej Siewior Date: Fri Jan 23 12:36:53 2026 +0100 scsi: efct: Use IRQF_ONESHOT and default primary handler There is no added value in efct_intr_msix() compared to irq_default_primary_handler(). Using a threaded interrupt without a dedicated primary handler mandates the IRQF_ONESHOT flag to mask the interrupt source while the threaded handler is active. Otherwise the interrupt can fire again before the threaded handler had a chance to run. Use the default primary interrupt handler by specifying NULL and set IRQF_ONESHOT so the interrupt source is masked until the secondary handler is done. Cc: Ram Vegesna Cc: James E.J. Bottomley Cc: Martin K. Petersen Cc: linux-scsi@vger.kernel.org Cc: target-devel@vger.kernel.org Fixes: 4df84e846624 ("scsi: elx: efct: Driver initialization routines") Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260123113708.416727-8-bigeasy@linutronix.de Signed-off-by: Martin K. Petersen commit 39451ebcf7fe19f21c65b39b03fbfb90c3d1a350 Author: Peng Fan Date: Tue Jan 27 07:06:00 2026 +0800 dt-bindings: firmware: fsl,scu: Mark multi-channel MU layouts as deprecated The SCU MU driver has already supported the simple and efficient single-TX and single-RX channel layout since 2021. The older multi-channel MU configurations (tx0..tx3 and rx0..rx3) are less efficient in practice and not needed. Mark these legacy mbox-names and mboxes tuple layouts as deprecated in the binding schema. The driver continues to support them for backward compatibility in case firmware publishes the legacy properties. The example section is updated accordingly to demonstrate the recommended layout. Signed-off-by: Peng Fan Reviewed-by: Frank Li Link: https://patch.msgid.link/20260127-scu-v2-1-03f3aaa56e1b@nxp.com Signed-off-by: Rob Herring (Arm) commit a91b99fa779a2097f147b6a2a05fa7a6207013c7 Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:55 2026 +0100 cpufreq: s5pv210: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Note that there is another part of code using "np" variable, so scoped loop should not shadow it. Acked-by: Viresh Kumar Reviewed-by: Jonathan Cameron Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-11-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 69c8cbb4bac450b262e148e4687d507a256871b8 Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:54 2026 +0100 dmaengine: fsl_raid: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Reviewed-by: Jonathan Cameron Acked-by: Vinod Koul Reviewed-by: Frank Li Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-10-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 122b6c28c0d604b5939402a8ccbd0627fcc74136 Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:53 2026 +0100 clk: imx: imx31: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Reviewed-by: Peng Fan Reviewed-by: Jonathan Cameron Acked-by: Abel Vesa Reviewed-by: Frank Li Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-9-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit f82fa1d592021642b89977f77b4c3fc6eb9404ce Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:52 2026 +0100 clk: imx: imx27: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Reviewed-by: Peng Fan Reviewed-by: Jonathan Cameron Acked-by: Abel Vesa Reviewed-by: Frank Li Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-8-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 3bf312f30bdafd8ac40c995a34bbbf35681d6a4b Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:51 2026 +0100 cdx: Use mutex guard to simplify error handling Mutex guard allows to drop one goto/break in error handling and the less expected code of assigning -EINVAL to unsigned size_t count variable. Suggested-by: Jonathan Cameron Signed-off-by: Krzysztof Kozlowski Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-7-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 2ff81fe310167349ea17c8b2b1d8fb2bc2d755ae Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:50 2026 +0100 cdx: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-6-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 9572933b5692470340dcf7df9a1bff07b41525fa Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:49 2026 +0100 powerpc/wii: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Reviewed-by: Jonathan Cameron Signed-off-by: Krzysztof Kozlowski Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-5-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit e0af14088e25564e9a37ca40964e555546f22295 Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:48 2026 +0100 powerpc/fsp2: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Reviewed-by: Jonathan Cameron Signed-off-by: Krzysztof Kozlowski Reviewed-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-4-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 1adce508e946075bd62883f2003013bae2082a51 Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:47 2026 +0100 ARM: exynos: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Reviewed-by: Jonathan Cameron Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-3-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 9d4ba117ecb3cb6fa907cc8273c73c5c03f19cb6 Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:46 2026 +0100 ARM: at91: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Acked-by: Nicolas Ferre Reviewed-by: Jonathan Cameron Signed-off-by: Krzysztof Kozlowski Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-2-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 620097c6c070fb01259b5fcab915065ce746e5a1 Author: Krzysztof Kozlowski Date: Fri Jan 9 17:57:45 2026 +0100 of: Add for_each_compatible_node_scoped() helper Just like looping through children and available children, add a scoped helper for for_each_compatible_node() so error paths can drop of_node_put() leading to simpler code. Suggested-by: Jonathan Cameron Reviewed-by: Jonathan Cameron Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260109-of-for-each-compatible-scoped-v3-1-c22fa2c0749a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit c75afcb4a8e708747534d8b88a1bcd912cdf9223 Author: Rob Herring (Arm) Date: Mon Jan 26 10:47:22 2026 -0600 dt-bindings: Fix emails with spaces or missing brackets Fix email addresses with spaces or missing brackets. A pending dtschema meta-schema change will check for these. Acked-by: Manivannan Sadhasivam Acked-by: Dmitry Torokhov Acked-by: Guenter Roeck Link: https://patch.msgid.link/20260126164724.2832009-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit dfe057874b34cb42b20474811398e0c79f472ebe Author: Rob Herring (Arm) Date: Wed Jan 21 12:49:42 2026 -0600 scripts/dtc: Update to upstream version v1.7.2-62-ga26ef6400bd8 This adds the following commits from upstream: a26ef6400bd8 Restore phandle references from __fixups__ node 05c524db44ff Restore phandle references from __local_fixups__ node db65a3a3f4f0 Restore labels from __symbols__ node 64330c682cac Improve type guessing when compiling to dts format cbb48690c697 Set DTSF_PLUGIN if needed when compiling from dtb ef3b1baf6370 Emit /plugin/ when compiling to .dts with DTSF_PLUGIN set 7c78c8542d73 Added empty node name check 14dd76b96732 fdtdump: Change FDT_PROP prob handling to ease future addition 9a1c801a1a3c Fix discarded const qualifiers 194ac9422ac9 libfdt: fdt_get_name: Add can_assume(VALID_DTB) check 39cae0bd0031 libfdt: Improve size savings in FDT_RO_PROBE slightly b12692473298 libfdt: libfdt_internal.h correct final comment in ASSUME block 7f3184a6c550 libfdt: Remove old MacOS strnlen workaround 9197f1ccd95c checks: Do not check overlays for alias paths e1284ee5dc20 livetree: Add only new data to fixup nodes instead of complete regeneration cba90ce82064 checks: Remove check for graph child addresses 763c6ab4189c livetree: Simplify append_to_property() 739403f22242 libfdt: Drop including string.h from libfdt_internal.h 1c6c51e51b29 Consider drive letters when checking for absolute paths on Windows. 617f3d9b60f7 ci: Add Cirrus CI configuration for FreeBSD testing 04f948e83fef ci: Add GitLab CI configuration for Linux builds e89680263137 ci: Tweaks to GitHub Actions setup 2ad738722b79 build: Add FreeBSD and non-GNU linker compatibility 4132ac08ba95 libfdt: Document most remaining functions 33e66ec845b8 tests: Add compatibility with uutils a0dd7b608102 fdtput: Use strtol() in preference to sscanf() 5b71660724d7 tests: Work around limitation in FreeBSD's printf(1) The graph_child_address check has been removed from upstream. Drop it from the makefiles. Signed-off-by: Rob Herring (Arm) commit e2bafe4d1b72e6cd06ed9c0921cb3cce674db351 Author: AngeloGioacchino Del Regno Date: Mon Jan 12 15:55:56 2026 +0100 dt-bindings: crypto: inside-secure,safexcel: Mandate only ring IRQs Not all IP implementations of EIP97 and EIP197 have the EIP and MEM interrupts hooked up to the SoC, and those are not required for functionality as status for both can be polled (and anyway there's even no real need to poll, but that's another story). As an example of this, the MediaTek MT7986A and MT7986B SoCs do not have those two interrupts hooked up to their irq controlller. For this reason, make the EIP and MEM interrupt optional on the mediatek,mt7986-crypto. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260112145558.54644-3-angelogioacchino.delregno@collabora.com Signed-off-by: Rob Herring (Arm) commit ad0cfd9985c5bbca63aba42685e6b9c0eb3cae61 Author: AngeloGioacchino Del Regno Date: Mon Jan 12 15:55:55 2026 +0100 dt-bindings: crypto: inside-secure,safexcel: Add SoC compatibles Add SoC specific compatibles for the SafeXcel crypto engine, including one for the EIP197B used by Marvell Armada CP110 and and two for the EIP97IES used by Marvell Armada 3700 and by MediaTek MT7986. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260112145558.54644-2-angelogioacchino.delregno@collabora.com Signed-off-by: Rob Herring (Arm) commit 5dff92a7bde9a8ef3b709f65e347cb1c33260cf4 Author: Gregory CLEMENT Date: Wed Jan 7 14:04:52 2026 +0100 of: reserved_mem: Fix placement of __free() annotation The __free() annotation was incorrectly placed before the variable name instead of after it, which resulted in the following checkpatch errors: ERROR: need consistent spacing around '*' (ctx:WxV) + struct device_node __free(device_node) *target = of_parse_phandle(np, "memory-region", idx); ^ WARNING: function definition argument 'idx' should also have an identifier name + struct device_node __free(device_node) *target = of_parse_phandle(np, "memory-region", idx); As part of this cleanup, also remove the useless return statement flagged by checkpatch. Signed-off-by: Gregory CLEMENT Link: https://patch.msgid.link/20260107-mtd-memregion-v3-1-f9fc9107b992@bootlin.com Signed-off-by: Rob Herring (Arm) commit 0365adafdb9bb9f7b5dc6793a8db3854beac0a94 Author: Marek Vasut Date: Wed Jan 21 09:53:20 2026 +0100 dt-bindings: display/lvds-codec: Document OnSemi FIN3385 Add compatible string for OnSemi FIN3385, a FlatLink LVDS transmitter. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260121085347.10368-2-marex@nabladev.com Signed-off-by: Rob Herring (Arm) commit ec2ff23bf501b651e896143e3c7c0ca91b292c4a Author: Marek Vasut Date: Wed Jan 21 09:53:19 2026 +0100 dt-bindings: eeprom: at25: Document Microchip 25AA010A The Microchip 25AA010A is a 1 Kbit SPI EEPROM with 16 Byte page. Product page is at https://www.microchip.com/en-us/product/25AA010A Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260121085347.10368-1-marex@nabladev.com Signed-off-by: Rob Herring (Arm) commit febfd49a8cbde615804fb6614e5bd4fa6bf44fe7 Author: Geert Uytterhoeven Date: Mon Jan 12 17:02:40 2026 +0100 dt-bindings: display: bridge: nxp,tda998x: Add missing clocks Some TDA998x variants (e.g. TDA19988) have an OSC_IN pin, to connect an external oscillator circuit or clock source. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/2b66577296583a6787f770f0eb13c42a6b50768b.1768233569.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit 9dace5e4e2a3a8d162c0136e7b822f91cb9b8ea6 Author: Andreas Kemnade Date: Tue Jan 20 19:54:23 2026 +0100 dt-bindings: omap: ti,prm-inst: Convert to DT schema Convert prm-inst binding to DT schema. Use the closest matching standard node name in the example. Signed-off-by: Andreas Kemnade Link: https://patch.msgid.link/20260120-prm-inst-v2-1-a025873cee27@kemnade.info Signed-off-by: Rob Herring (Arm) commit 554fb141654e555a51386b4d5855aa7a7a4a4a44 Author: Nauman Sabir Date: Fri Jan 16 00:00:58 2026 +0100 dt-bindings: display: mediatek: Fix typo 'hardwares' to 'hardware' Fix incorrect plural form of the uncountable noun 'hardware' in the MediaTek DP binding description. Signed-off-by: Nauman Sabir Link: https://patch.msgid.link/20260115230058.7704-1-officialnaumansabir@gmail.com Signed-off-by: Rob Herring (Arm) commit c0238bbba7c5a45afbfe61a31c3ba322f744feb0 Author: Rob Herring (Arm) Date: Mon Dec 15 15:26:21 2025 -0600 dt-bindings: mfd: Add Realtek RTD1xxx system controllers The Realtek system controllers are already in use with only generic '"syscon", "simple-mfd"' compatibles and are missing specific compatibles as required. Add a schema with specific compatibles. The labels used in .dts files serve as the basis for the names. It's doubtful the child nodes upstream are complete and I don't have documentation, so the specific child nodes aren't documented here. Of the ones in use, bindings already exist for them. Link: https://patch.msgid.link/20251215212624.3319681-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit dde77e6dc960969db3d756b802f5260ced9b9f1a Author: Krzysztof Kozlowski Date: Fri Jan 16 18:29:16 2026 +0100 dt-bindings: mediatek: Replace Tinghan Shen in maintainers Emails to Tinghan Shen bounce permanently with "550 Relaying mail to tinghan.shen@mediatek.com is not allowed (in reply to RCPT TO command)", so switch to AngeloGioacchino Del Regno - Mediatek SoC platform maintainer. Signed-off-by: Krzysztof Kozlowski Acked-by: Mathieu Poirier Link: https://patch.msgid.link/20260116172915.99811-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit aa135288890cf18367eaefb221841fd97da74471 Author: Krzysztof Kozlowski Date: Wed Jan 14 09:13:23 2026 +0100 dt-bindings: Fix I2C bus node names in examples I2C bus node names are expected to be just "i2c", if there is just one such node in given example. Replace remaining bad examples with scripted: git grep -l '\si2c[0-9] {' Documentation/devicetree/ | xargs sed -i -e 's/i2c[0-9] {/i2c {/' Suggested-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Reviewed-by: Laurent Pinchart Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20260114081322.53411-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit d897a50e0c8720d1f987caadae056c7f4c7aa266 Author: Kuan-Wei Chiu Date: Tue Jan 13 09:26:02 2026 +0000 dt-bindings: display: google,goldfish-fb: Convert to DT schema Convert the Android Goldfish Framebuffer binding to DT schema format. Update the example node name to 'display' to comply with generic node naming standards. Signed-off-by: Kuan-Wei Chiu Link: https://patch.msgid.link/20260113092602.3197681-7-visitorckw@gmail.com Signed-off-by: Rob Herring (Arm) commit d80c9abe02fd18b8cc3b7802cf7ee6de55c76d96 Author: Marek Vasut Date: Wed Jan 7 22:35:21 2026 +0100 dt-bindings: display: bridge: tc358867: mark port 0 and 1 configuration as valid Current binding document enforces presence of either port@0 (DSI in) or port@1 (DPI IN/OUT), with port@2 (DP out) being optional. This bridge is capable of DSI->DP, DPI->DP and DPI->DP, it is therefore perfectly valid to have both port@0 and port@1 described in the DT, because this is fairy standard DPI->DP configuration of this bridge. Replace oneOf with anyOf to cover this configuration. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260107213546.505137-1-marex@nabladev.com Signed-off-by: Rob Herring (Arm) commit 04657c4060ef43c43821ace3d11e0ec12863fcd7 Author: Francesco Valla Date: Sat Jan 10 16:27:59 2026 +0100 of: property: fw_devlink: Add support for "mmc-pwrseq" Add support for parsing MMC power sequencing (pwrseq) binding so that fw_devlink can enforce the dependency. Signed-off-by: Francesco Valla Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/20260110-mmc-pwrseq-v1-1-73de9d6456f4@valla.it Signed-off-by: Rob Herring (Arm) commit 1638b8a34e1e2f89e923ca62ede78c1a4719d1da Author: Krzysztof Kozlowski Date: Wed Jan 7 14:22:49 2026 +0100 docs: dt: submitting-patches: Document prefixes for SCSI and UFS Devicetree bindings patches going through SCSI/UFS trees also use reversed subject prefix. Cc: Martin K. Petersen Cc: linux-scsi@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260107132248.47877-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 8aa2f0ac08d3b207ba54e98698c9d696b86452a7 Author: Marek Vasut Date: Tue Jan 6 02:22:20 2026 +0100 dt-bindings: display: bridge: ldb: Add check for reg and reg-names Make "reg" property mandatory for all LDB devices and "reg-names" mandatory for i.MX8MP and i.MX93 which have two "reg" values. The i.MX6SX has only one "reg" value so the "reg-names" property there is optional and not needed. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260106012236.295834-1-marek.vasut@mailbox.org Signed-off-by: Rob Herring (Arm) commit d93380833165df8f3f74500bffa65eb76028a88a Author: Luka Kovacic Date: Tue Aug 24 14:44:32 2021 +0200 dt-bindings: Add IEI vendor prefix and IEI WT61P803 PUZZLE driver bindings Add the IEI WT61P803 PUZZLE Device Tree bindings for MFD, HWMON and LED drivers. A new vendor prefix is also added accordingly for IEI Integration Corp. Signed-off-by: Luka Kovacic Signed-off-by: Pavo Banicevic Cc: Luka Perkov Cc: Robert Marko Reviewed-by: Rob Herring Link: https://patch.msgid.link/20210824124438.14519-2-luka.kovacic@sartura.hr [robh: fix warnings from current tools] Signed-off-by: Rob Herring (Arm) commit 949c38ad4b9b41f8ef81bbad00e979b27ff918a5 Author: Rob Herring (Arm) Date: Mon Jan 5 15:12:54 2026 -0600 dt-bindings: trivial-devices: Add some more undocumented devices Add a few trivial devices which are already in use in Nuvoton and ASpeed DTS files. Link: https://patch.msgid.link/20260105211255.3431856-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit b96b485755ca0e12e3981f14b789315fb41713ee Author: Rasmus Villemoes Date: Fri Dec 19 13:18:11 2025 +0100 of: property: stop creating callback for each pinctrl-N property While not a lot in the grand scheme of things, this eliminates 8*2 pointless function calls for almost every property present in the device tree (the exception are the few properties that were already matched). It also seems to reduce .text by about 1.5K - why gcc decides to inline parse_prop_cells() in every instantiation I don't know. Signed-off-by: Rasmus Villemoes Link: https://patch.msgid.link/20251219121811.390988-1-linux@rasmusvillemoes.dk [robh: Drop the commit msg comment that >9 doesn't work as it would] Signed-off-by: Rob Herring (Arm) commit d289cb7fcefe41a54d8f9c6d0e0947f5f82b15c6 Author: Tuo Li Date: Mon Jan 5 15:14:38 2026 +0800 of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() This function first duplicates p1 and p2 into new, and then checks whether the duplication succeeds. However, if the duplication fails (e.g., kzalloc() returns NULL in __of_prop_dup()), new will be NULL but is still dereferenced in __of_prop_free(). To ensure that the unit test continues to run even when duplication fails, add a NULL check before calling __of_prop_free(). Fixes: 1c5e3d9bf33b ("of: Add a helper to free property struct") Signed-off-by: Tuo Li Link: https://patch.msgid.link/20260105071438.156186-1-islituo@gmail.com Signed-off-by: Rob Herring (Arm) commit 5872df37c4ade93df81dd46020eef0e254cf7fb7 Author: Binbin Zhou Date: Sun Jan 4 14:41:49 2026 +0800 dt-bindings: interrupt-controller: loongson,pch-pic: Document address-cells The Loongson PCH interrupt controller can be referenced in interrupt-map properties (e.g. in arch/loongarch/boot/dts/loongson-2k2000.dtsi), thus the nodes should have address-cells property. Signed-off-by: Binbin Zhou Link: https://patch.msgid.link/e531084ee65a695ec08d0f559caec067877fb9a5.1767505859.git.zhoubinbin@loongson.cn Signed-off-by: Rob Herring (Arm) commit 3efe078d9d49ad121bac602ae25d92c2ffac3029 Author: Binbin Zhou Date: Sun Jan 4 14:41:12 2026 +0800 dt-bindings: interrupt-controller: loongson,eiointc: Document address-cells The Loongson Extend I/O interrupt controller can be referenced in interrupt-map properties (e.g. in arch/loongarch/boot/dts/loongson-2k0500.dtsi), thus the nodes should have address-cells property. Signed-off-by: Binbin Zhou Link: https://patch.msgid.link/3e903541d37432c88c27272094420b03418a607d.1767505859.git.zhoubinbin@loongson.cn Signed-off-by: Rob Herring (Arm) commit 08a953754a3b981024e9cf5a4201be6e858c77e4 Author: Binbin Zhou Date: Sun Jan 4 14:41:13 2026 +0800 dt-bindings: interrupt-controller: loongson,liointc: Document address-cells The Loongson local I/O interrupt controller can be referenced in interrupt-map properties (e.g. in arch/loongarch/boot/dts/loongson-2k1000.dtsi), thus the nodes should have address-cells property. Signed-off-by: Binbin Zhou Link: https://patch.msgid.link/fb3811b6bc387aa23adfc0aaf9a0a31c2d468e79.1767505859.git.zhoubinbin@loongson.cn Signed-off-by: Rob Herring (Arm) commit ec47eb49a332481d2e2947e75751f66560d2e7e2 Author: Rob Herring (Arm) Date: Tue Dec 16 15:15:55 2025 -0600 dt-bindings: power: syscon-poweroff: Allow "reg" property Similar to "syscon-reset", allow using the standard "reg" property rather than "offset". Link: https://patch.msgid.link/20251216211556.3047726-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit e03a631628db59b0fb7a4563594ed745c7adc2d8 Author: Rob Herring (Arm) Date: Mon Dec 15 15:26:47 2025 -0600 dt-bindings: reset: syscon-reboot: Allow both 'reg' and 'offset' For compatibility, it is necessary to support both 'reg' and 'offset' at the same time. Link: https://patch.msgid.link/20251215212648.3320333-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 16f47ecae157a62490c68e2697462cc13c247d25 Author: Krzysztof Kozlowski Date: Wed Dec 31 13:09:27 2025 +0100 of/platform: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251231120926.66185-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 4ed31b0c4c583bd4ff1c3b38243c5eaf27ca1174 Author: Krzysztof Kozlowski Date: Fri Dec 19 08:40:36 2025 +0100 dt-bindings: mediatek: Drop inactive MandyJH Liu There are no emails from MandyJH Liu, no reviews [1] of these bindings, so clearly no maintenance is happening here. Switch to Mediatek SoC maintainers. Cc: MandyJH Liu Link: https://lore.kernel.org/all/?q=f%3Amandyjh.liu%40mediatek.com [1] Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251219074035.13001-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 515f85d0e7c209b2cda58edeeaa1eb4ba4982b4c Author: Rob Herring (Arm) Date: Mon Dec 15 15:30:21 2025 -0600 dt-bindings: arm: Drop obsolete brcm,vulcan-soc binding The Cavium ThunderX2 aka Broadcom Vulcan doesn't use DT, but ACPI, so drop the SoC binding. Link: https://patch.msgid.link/20251215213022.3325133-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 91c6a33175ed0c78f51bc23caecadde324e36a9a Author: Rob Herring (Arm) Date: Mon Dec 15 15:27:08 2025 -0600 dt-bindings: net: brcm,amac: Allow "dma-coherent" property The Broadcom AMAC controller is DMA coherent on some platforms, so allow the dma-coherent property. Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251215212709.3320889-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit df7358ab881f16e061efedc695a33e370f318fbc Author: Rob Herring (Arm) Date: Mon Dec 15 15:35:14 2025 -0600 dt-bindings: raspberrypi,bcm2835-firmware: Add 'power' and gpio-hog nodes Add missing child nodes for the RaspberryPi firmware. The firmware implements a power domain provider in a 'power' node. GPIO hog nodes are also already in use. Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251215213513.3331128-2-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 62fedca4ff8afd526bb02d8f08e8e1a7da01b073 Author: Rob Herring (Arm) Date: Mon Dec 15 15:25:43 2025 -0600 dt-bindings: firmware: Convert cznic,turris-mox-rwtm to DT schema Convert the CZ.NIC Turris Mox rWTM firmware binding to DT schema format. Add the "marvell,armada-3700-rwtm-firmware" compatible which was not documented. Link: https://patch.msgid.link/20251215212545.3318816-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit d7d41a6bae2421241214396a680602cfa0749ffc Author: Bartosz Golaszewski Date: Wed Dec 17 14:43:08 2025 +0100 of: replace strcmp_suffix() with strends() string.h now provides strends() which fulfills the same role as the locally implemented strcmp_suffix(). Use it in of/property.c. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20251217134308.33839-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 6c4de79bc4daa3f5bc93627cd7b725bd78b82539 Author: Rob Herring (Arm) Date: Mon Dec 15 15:25:32 2025 -0600 dt-bindings: trivial-devices: Add socionext,uniphier-smpctrl The "socionext,uniphier-smpctrl" binding is just a "compatible" and "reg" entry, so add it to trivial-devices.yaml. Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251215212532.3318546-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 26dfe3a6d9a9ca055d5c8a2a40e1838ef09aff5e Author: Ronak Jain Date: Fri Dec 12 02:05:42 2025 -0800 dt-bindings: firmware: xilinx: Add conditional pinctrl schema Updates the Device Tree bindings for Xilinx firmware by introducing conditional schema references for the pinctrl node. Previously, the pinctrl node directly referenced xlnx,zynqmp-pinctrl.yaml. However, this patch modifies the schema to conditionally apply the correct pinctrl schema based on the compatible property. Specifically: - If compatible contains "xlnx,zynqmp-pinctrl", reference xlnx,zynqmp-pinctrl.yaml. - If compatible contains "xlnx,versal-pinctrl", reference xlnx,versal-pinctrl.yaml. Additionally, an example entry for "xlnx,versal-pinctrl" has been added under the examples section. Signed-off-by: Ronak Jain Link: https://patch.msgid.link/20251212100542.2756757-3-ronak.jain@amd.com Signed-off-by: Rob Herring (Arm) commit 93fb82ec340953da264e1d5e3a274d4aa71f34a0 Author: Ronak Jain Date: Fri Dec 12 02:05:41 2025 -0800 dt-bindings: firmware: xilinx: Add xlnx,zynqmp-firmware compatible The absence of a compatible property caused dt_binding_check to skip the zynqmp_firmware node. To address this, add "xlnx,zynqmp-firmware" to the compatible property in the example section for the zynqmp_firmware node. Signed-off-by: Ronak Jain Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251212100542.2756757-2-ronak.jain@amd.com Signed-off-by: Rob Herring (Arm) commit ff7e082ea40d70b7613e8db2cb11e3555ebcc546 Author: Rob Herring (Arm) Date: Fri Dec 12 17:11:52 2025 -0600 dt-bindings: Remove unused includes Remove includes which are not referenced by either DTS files or drivers. There's a few more which are new, so they are excluded for now. Reviewed-by: Linus Walleij Acked-by: Mark Brown Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251212231203.727227-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 180547ebd86cdb089f657c0666de8853a2d1571c Author: Rob Herring (Arm) Date: Mon Dec 15 15:26:59 2025 -0600 dt-bindings: bus: stm32mp25-rifsc: Allow 2 size cells There are users already with 2 size cells, and there's no reason to not support that. Reviewed-by: Gatien Chevallier Link: https://patch.msgid.link/20251215212700.3320634-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 533db14fdfe38539358568be782b7817155f95c0 Author: Rob Herring (Arm) Date: Mon Dec 15 15:29:14 2025 -0600 dt-bindings: arm: vexpress-config: Update clock and regulator node names The clock and regulator node names were updated to use standard node names, but the binding wasn't updated. Reviewed-by: Sudeep Holla Link: https://patch.msgid.link/20251215212914.3323741-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit ddd77dd055bdd61424ea429569ee8343c47eeb68 Author: Rob Herring (Arm) Date: Mon Dec 15 15:29:32 2025 -0600 dt-bindings: arm,vexpress-juno: Allow interrupt-map properties in bus node Allow interrupt-map properties which are already used in the bus node. Reviewed-by: Sudeep Holla Link: https://patch.msgid.link/20251215212932.3324144-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 417bc40dc1807f10a41a88f56750c665b9cd0f6a Author: Rob Herring (Arm) Date: Mon Dec 15 12:34:55 2025 -0600 MAINTAINERS: Add Makefile.dtb* to DT maintainers Since the DT related parts of kbuild are now split out to separate makefiles, list them in the DT maintainer section so they don't fall thru the cracks. Acked-by: Nathan Chancellor Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251215191421.3137362-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 4d0538dd5d7e21b4615fbc81424b0fae0b12a9fb Author: Bart Van Assche Date: Fri Jan 16 10:07:51 2026 -0800 scsi: ufs: core: Use a host-wide tagset in SDB mode In single-doorbell (SDB) mode there is only a single request queue. Hence, it doesn't matter whether or not the SCSI host tagset is configured as host-wide. Configure the host tagset as host-wide in SDB mode because this enables a simplification of the hot path. Signed-off-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260116180800.3085233-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit bb23f167f32591e712b74333b8d2fe1ff143bf5d Merge: 667539f6dce27a 5031e35f349914 Author: Jakub Kicinski Date: Tue Feb 3 18:01:47 2026 -0800 Merge branch 'net-stmmac-rk-cleanups-v3-mode-and-speed-for-most' Russell King says: ==================== net: stmmac: rk: cleanups v3: mode and speed for most Third installment in the rk cleanups, this converts the interface mode and speed configuration for most RK SoCs. ==================== Link: https://patch.msgid.link/aYB2cKRu3DQh6yXK@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5031e35f3499141641b648c0a5e94381b38544e9 Author: Russell King (Oracle) Date: Mon Feb 2 10:04:41 2026 +0000 net: stmmac: rk: convert px30 Use rk_set_clk_mac_speed() rather than px30 specific function for configuring RMII clock. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vmqnR-00000007VDE-2fM1@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3cf4dfa7b040980d16b249a9eed7185971763a0f Author: Russell King (Oracle) Date: Mon Feb 2 10:04:36 2026 +0000 net: stmmac: rk: remove need for ->set_speed() method As we can detect whether the SoC provides the parameters necessary for rk_set_reg_speed(), we don't need to have explicit calls to this. Instead, we can move the contents of this function to rk_set_clk_tx_rate(). This remsoves all the .set_speed() implementations that merely go on to invoke rk_set_reg_speed(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vmqnM-00000007VD8-1xWo@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 33c5c9473a232de46548cb1c6db77e5b2eff5b8e Author: Russell King (Oracle) Date: Mon Feb 2 10:04:31 2026 +0000 net: stmmac: rk: use rk_encode_wm16() for RMII clock The RMII clock is a single bit, which is set for 100M and clear for 10M. Move this out of struct rk_reg_speed_data (which gets rid of this structure) into the struct rk_clock_fields as the bitmask for this bit. This gets rid of the per-SoC variability in the calls to rk_set_reg_speed(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vmqnH-00000007VCz-1WmP@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4dc66f93b419fbd69b98f338d237056c73df22ac Author: Russell King (Oracle) Date: Mon Feb 2 10:04:26 2026 +0000 net: stmmac: rk: use rk_encode_wm16() for RMII speed The RMII speed configuration is encoded as a single bit, which is set for 100M and clean for 10M. Provide the bitfield definition in struct rk_clock_fields, moving it out of struct rk_reg_speed_data's rmii_10 and rmii_100 initialisers. Update rk_set_reg_speed() to handle the new definition location of this bit. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vmqnC-00000007VCt-0oRg@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b9544c128c30037da87dfc2993b1b1795e1c14b5 Author: Russell King (Oracle) Date: Mon Feb 2 10:04:21 2026 +0000 net: stmmac: rk: use rk_encode_wm16() for RGMII clocks As all of the RGMII clock selection bitfields (gmii_clk_sel) use the same encoding, parameterise this by providing the bitfield mask in the BSP private data. This is the last user of GRF_FIELD_CONST(), so remove that definition as well. One additional change is for RK3328 - as only gmac2io supports RGMII, only initialise the mask for this instance. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vmqn7-00000007VCn-0OZA@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0c8107dbe72043c51886bb973fb5197b6f6641bc Author: Russell King (Oracle) Date: Mon Feb 2 10:04:15 2026 +0000 net: stmmac: rk: remove rk3528 RMII clock initialisation There is no need to pre-initialise the rk3528 RMII clock when selecting RMII mode on gmac0. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vmqn1-00000007VCh-47Sv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 8e4b4004e84720a151695b024ad4904e19bfd758 Author: Russell King (Oracle) Date: Mon Feb 2 10:04:10 2026 +0000 net: stmmac: rk: convert rk3588 to rk_set_reg_speed() Update rk_set_reg_speed() to use either the grf or php_grf regmap depending on the SoC's requirements and convert rk3588, removing its custom code. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vmqmw-00000007VCb-3glG@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 82d1df4b414332e4f1fa668300e80c7d67bbeb76 Author: Russell King (Oracle) Date: Mon Feb 2 10:04:05 2026 +0000 net: stmmac: rk: move speed GRF register offset to private data Move the speed/clocking related GRF register offset into the driver private data, convert rk_set_reg_speed() to use it and initialise this member either from the corresponding member in struct rk_gmac_ops, or the SoC specific initialisation function. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vmqmr-00000007VCV-3Cz8@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 600fe01e947af664f2ec385cecd7e8033e098e4d Author: Russell King (Oracle) Date: Mon Feb 2 10:04:00 2026 +0000 net: stmmac: rk: convert rk3588 to mask-based interface mode config rk3588 has a quirk compared to the other Rockchip implementations in that the interface mode configuration register is in the php_grf regmap rather than the grf regmap. Add a flag to indicate this, and a separate function to write to the appropriate regmap. This allows rk3588 to be converted. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vmqmm-00000007VCP-2XZc@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 31d28d062aa85422d6cd1225d415a30ff7fc2872 Author: Russell King (Oracle) Date: Mon Feb 2 10:03:55 2026 +0000 net: stmmac: rk: convert to mask-based interface mode configuration The majority of Rockchip implementations require three common pieces of information to configure the PHY interface mode: - The grf register offset for configuring the GMAC phy_intf_sel field and the RMII mode bit. - The bitfield in this register for the GMAC's phy_intf_sel. - The bit position for RMII mode but clear for RGMII mode. Introduce members for this information into struct rk_priv_data and struct rk_gmac_ops, which will be used to pre-initialise the struct rk_priv_data members. We describe the register contents using bitfields, even for those that are a single bit for consistency. As each register comprises of two halves, where the upper half enables changing the bit state in the lower half, we can describe these bitfields using a 16-bit data type, and provide rk_encode_wm16() to generate the actual register values from the field mask and field value. We are unable to use the FIELD_PREP_WM16() macros for this as these require the field mask to be a constant. Add code to rk_gmac_powerup() to get the phy_intf_sel value, validating that the resulting mode is either RMII or RGMII. No other modes are supported by any of the Rockchip SoCs supported by this driver. If either of the bitfield mask values are populated in struct rk_priv_data, use these to generate the register contents, and write the resulting value to the specified GRF register. Convert many Rockchip implementations to use this new infrastructure. For those where there is a single GMAC instance, it is merely a case of filling in the new members of struct rk_gmac_ops. For those with multiple instances, one or more of these members depends on the GMAC instance, so setup of the members in struct rk_gmac has to be done via the .init method of struct rk_gmac_ops. The corresponding code is removed from the set_to_rgmii() and set_to_rmii() implementations. Since the member name documents the purpose of the field that is being initialised, providing preprocessor macros to define the bitfields is deemed to be less than useful given the massive size of this driver. The existing mechanisms remain behind for those SoCs that can not be converted to this scheme. Signed-off-by: Russell King (Oracle) v2: disable clocks on failure Link: https://patch.msgid.link/E1vmqmh-00000007VCJ-1xns@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 46a03ea50b5f380bdb99178b8f90b39c6ba1f528 Author: Titouan Ameline de Cadeville Date: Tue Feb 3 18:59:50 2026 +0100 fs/tests: exec: drop duplicate bprm_stack_limits test vectors Remove duplicate entries from the bprm_stack_limits KUnit test vector table. The duplicates do not add coverage and only increase test size. Signed-off-by: Titouan Ameline de Cadeville Fixes: 60371f43e56b ("exec: Add KUnit test for bprm_stack_limits()") Link: https://patch.msgid.link/20260203175950.43710-1-titouan.ameline@gmail.com Signed-off-by: Kees Cook commit f35e16ec2ae964badf350cb6d4de6d81c6f3804d Author: Andy Shevchenko Date: Thu Jan 29 11:34:38 2026 +0100 i2c: designware: Remove dead code in AMD ISP case The I²C bus shared with P-Unit is Intel only thing as far as I know. The AMD ISP driver has no relationship with P-Unit. Remove dead code that seems copied without much thinking. Signed-off-by: Andy Shevchenko Reviewed-by: Pratap Nirujogi Acked-by: Mika Westerberg Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260129103439.187478-1-andriy.shevchenko@linux.intel.com commit 5600722460880a16343484fbf5f90b02ff644719 Author: Benoît Monin Date: Fri Jan 30 16:52:31 2026 +0100 i2c: designware: Support of controller with IC_EMPTYFIFO_HOLD_MASTER disabled If IC_EMPTYFIFO_HOLD_MASTER_EN parameter is 0, "Stop" and "Repeated Start" bits in command register do not exist, thus it is impossible to send several consecutive write messages in a single hardware batch. The existing implementation worked with such configuration incorrectly: all consecutive write messages are joined into a single message without any Start/Stop or Repeated Start conditions. For example, the following command: i2ctransfer -y 0 w1@0x55 0x00 w1@0x55 0x01 does the same as i2ctransfer -y 0 w2@0x55 0x00 0x01 In i2c_dw_msg_is_valid(), we ensure that we do not have such sequence of messages requiring a RESTART, aborting the transfer on controller that cannot emit them explicitly. This behavior is activated by compatible entries because the state of the IC_EMPTYFIFO_HOLD_MASTER_EN parameter cannot be detected at runtime. The new flag emptyfifo_hold_master reflects the state of the parameter, it is set to true for all controllers except those found in Mobileye SoCs. For now, the controllers in Mobileye SoCs are the only ones known to need the workaround. The behavior of the driver is left unmodified for other controllers. There is another possible problem with this controller configuration: When the CPU is putting commands to the FIFO, this process must not be interrupted because if FIFO buffer gets empty, the controller finishes the I2C transaction and generates STOP condition on the bus. If we continue writing the remainder of the message to the FIFO, the controller will start emitting a new transaction with those data. This turns a single message into multiple I2C transactions. To protect against FIFO underrun, two changes are done: First we flag the interrupt with IRQF_NO_THREAD, to prevent it from running in a thread on PREEMPT-RT kernel. This ensures that we are not interrupted when filling the FIFO as it is very time-senstive. For example, being preempted after writing a single byte in the FIFO with a 1MHz bus gives us only 18µs before an underrun. DMA would allow us to keep the interrupt threaded but it is not available on Mobileye SoC for I2C. Second in i2c_dw_process_transfer(), we abort if a STOP is detected while a read or a write is in progress. This can occur when processing a message larger than the FIFO. In that case the message is processed in parts, and rely on the TX EMPTY interrupt to refill the FIFO when it gets below a threshold. If servicing this interrupt is delayed for too long, it can trigger a FIFO underrun, thus an unwanted STOP. Originally-by: Dmitry Guzman Signed-off-by: Benoît Monin Acked-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260130-i2c-dw-v6-3-08ca1e9ece07@bootlin.com commit 4a5aa00980131c2de520e6fe3fae9b8fe16f93a5 Author: Benoît Monin Date: Fri Jan 30 16:52:30 2026 +0100 i2c: designware: Use runtime PM macro for auto-cleanup Simplify runtime PM handling in i2c_dw_xfer_common() by using the pm_runtime_active_auto_try guard. This adds the proper handling for runtime PM resume errors and allows us to get rid of the done and done_nolock labels. Also use the dedicated PM_RUNTIME macros in amd_i2c_dw_xfer_quirk() instead of ACQUIRE()/ACQUIRE_ERR(). Signed-off-by: Benoît Monin Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260130-i2c-dw-v6-2-08ca1e9ece07@bootlin.com commit 470f1a71e60cf94202c66c96a658944b58beac45 Author: Benoît Monin Date: Fri Jan 30 16:52:29 2026 +0100 i2c: designware: Implement I2C_M_STOP support Add the support of the I2C_M_STOP flag in i2c_msg by splitting i2c_dw_xfer() in two: __i2c_dw_xfer_one_part() for the core transfer logic and i2c_dw_xfer() for handling the high-level transaction management. In detail __i2c_dw_xfer_one_part() starts a transaction and wait for its completion, either with a STOP on the bus or an error. i2c_dw_xfer() loops over the messages to search for the I2C_M_STOP flag and calls __i2c_dw_xfer_one_part() for each part of the messages up to a STOP or the end of the messages array. i2c_dw_xfer() takes care of runtime PM and holds the hardware lock on the bus while calling __i2c_dw_xfer_one_part(), this allows grouping multiple accesses to device that support a STOP in a transaction when done via i2c_dev I2C_RDWR ioctl. Also, now that we have a lookup of the messages in i2c_dw_xfer() prior to each transaction, we use it to make sure the messages are valid for the transaction, via a new function i2c_dw_msg_is_valid(). We check that the target address does not change before starting the transaction instead of aborting the transfer while it is happening, as it was done in i2c_dw_xfer_msg(). The target address can only be changed after an I2C_M_STOP flag, i.e after a STOP on the i2c bus. The I2C_FUNC_PROTOCOL_MANGLING flag is added to the list of functionalities supported by the controller, except for the AMD NAVI i2c controller which uses its own xfer() function and is left untouched. Signed-off-by: Benoît Monin Acked-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260130-i2c-dw-v6-1-08ca1e9ece07@bootlin.com commit b28dac3fc99bb6f1d0b029f1b742a96e7bc797d6 Merge: f11f7cf90ee09d b135beb07758a8 Author: Andrii Nakryiko Date: Tue Feb 3 16:58:48 2026 -0800 Merge branch 'bpf-avoid-locks-in-bpf_timer-and-bpf_wq' Alexei Starovoitov says: ==================== bpf: Avoid locks in bpf_timer and bpf_wq From: Alexei Starovoitov This series reworks implementation of BPF timer and workqueue APIs to make them usable from any context. Signed-off-by: Alexei Starovoitov Signed-off-by: Mykyta Yatsenko Changes in v9: - Different approach for patches 1 and 3: - s/EBUSY/ENOENT/ when refcnt==0 to match existing - drop latch, use refcnt and kmalloc_nolock() instead - address race between timer/wq_start and delete_elem, add a test - Link to v8: https://lore.kernel.org/bpf/20260127-timer_nolock-v8-0-5a29a9571059@meta.com/ Changes in v8: - Return -EBUSY in bpf_async_read_op() if last_seq is failed to be set - In bpf_async_cancel_and_free() drop bpf_async_cb ref after calling bpf_async_process() - Link to v7: https://lore.kernel.org/r/20260122-timer_nolock-v7-0-04a45c55c2e2@meta.com Changes in v7: - Addressed Andrii's review points from the previous version - nothing very significang. - Added NMI stress tests for bpf_timer - hit few verifier failing checks and removed them. - Address sparse warning in the bpf_async_update_prog_callback() - Link to v6: https://lore.kernel.org/r/20260120-timer_nolock-v6-0-670ffdd787b4@meta.com Changes in v6: - Reworked destruction and refcnt use: - On cancel_and_free() set last_seq to BPF_ASYNC_DESTROY value, drop map's reference - In irq work callback, atomically switch DESTROY to DESTROYED, cancel timer/wq - Free bpf_async_cb on refcnt going to 0. - Link to v5: https://lore.kernel.org/r/20260115-timer_nolock-v5-0-15e3aef2703d@meta.com Changes in v5: - Extracted lock-free algorithm for updating cb->prog and cb->callback_fn into a function bpf_async_update_prog_callback(), added a new commit and introduces this function and uses it in __bpf_async_set_callback(), bpf_timer_cancel() and bpf_async_cancel_and_free(). This allows to move the change into the separate commit without breaking correctness. - Handle NULL prog in bpf_async_update_prog_callback(). - Link to v4: https://lore.kernel.org/r/20260114-timer_nolock-v4-0-fa6355f51fa7@meta.com Changes in v4: - Handle irq_work_queue failures in both schedule and cancel_and_free paths: introduced bpf_async_refcnt_dec_cleanup() that decrements refcnt and makes sure if last reference is put, there is at least one irq_work scheduled to execute final cleanup. - Additional refcnt inc/dec in set_callback() + rcu lock to make sure cleanup is not running at the same time as set_callback(). - Added READ_ONCE where it was needed. - Squash 'bpf: Refactor __bpf_async_set_callback()' commit into 'bpf: Add lock-free cell for NMI-safe async operations' - Removed mpmc_cell, use seqcount_latch_t instead. - Link to v3: https://lore.kernel.org/r/20260107-timer_nolock-v3-0-740d3ec3e5f9@meta.com Changes in v3: - Major rework - Introduce mpmc_cell, allowing concurrent writes and reads - Implement irq_work deferring - Adding selftests - Introduces bpf_timer_cancel_async kfunc - Link to v2: https://lore.kernel.org/r/20251105-timer_nolock-v2-0-32698db08bfa@meta.com Changes in v2: - Move refcnt initialization and put (from cancel_and_free()) from patch 5 into the patch 4, so that patch 4 has more clear and full implementation and use of refcnt - Link to v1: https://lore.kernel.org/r/20251031-timer_nolock-v1-0-b064ae403bfb@meta.com ==================== Link: https://patch.msgid.link/20260201025403.66625-1-alexei.starovoitov@gmail.com Signed-off-by: Andrii Nakryiko commit b135beb07758a854160e5421b6f4d5bde72e0da6 Author: Alexei Starovoitov Date: Sat Jan 31 18:54:03 2026 -0800 selftests/bpf: Add a test to stress bpf_timer_start and map_delete race Add a test to stress bpf_timer_start and map_delete race Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260201025403.66625-10-alexei.starovoitov@gmail.com commit 3f7a8415209eeca4b1fda2a57f9d7ec49413e2eb Author: Mykyta Yatsenko Date: Sat Jan 31 18:54:02 2026 -0800 selftests/bpf: Removed obsolete tests Now bpf_timer can be used in tracepoints, so these tests are no longer relevant. Signed-off-by: Mykyta Yatsenko Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260201025403.66625-9-alexei.starovoitov@gmail.com commit 083c5a4babad4af89dd07e2cc5f7004343d4c1f0 Author: Mykyta Yatsenko Date: Sat Jan 31 18:54:01 2026 -0800 selftests/bpf: Add timer stress test in NMI context Add stress tests for BPF timers that run in NMI context using perf_event programs attached to PERF_COUNT_HW_CPU_CYCLES. The tests cover three scenarios: - nmi_race: Tests concurrent timer start and async cancel operations - nmi_update: Tests updating a map element (effectively deleting and inserting new for array map) from within a timer callback - nmi_cancel: Tests timer self-cancellation attempt. A common test_common() helper is used to share timer setup logic across all test modes. The tests spawn multiple threads in a child process to generate perf events, which trigger the BPF programs in NMI context. Hit counters verify that the NMI code paths were actually exercised. Signed-off-by: Mykyta Yatsenko Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260201025403.66625-8-alexei.starovoitov@gmail.com commit fe9d205cec8ccdd13171a056257101374306e802 Author: Mykyta Yatsenko Date: Sat Jan 31 18:54:00 2026 -0800 selftests/bpf: Verify bpf_timer_cancel_async works Add test that verifies that bpf_timer_cancel_async works: can cancel callback successfully. Signed-off-by: Mykyta Yatsenko Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260201025403.66625-7-alexei.starovoitov@gmail.com commit d02fdd7195ca24005e36a6f7efed41f9c0ca7f72 Author: Mykyta Yatsenko Date: Sat Jan 31 18:53:59 2026 -0800 selftests/bpf: Add stress test for timer async cancel Extend BPF timer selftest to run stress test for async cancel. Signed-off-by: Mykyta Yatsenko Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260201025403.66625-6-alexei.starovoitov@gmail.com commit 10653c0dd86812981a9cf7112f0711f9f1f153a8 Author: Mykyta Yatsenko Date: Sat Jan 31 18:53:58 2026 -0800 selftests/bpf: Refactor timer selftests Refactor timer selftests, extracting stress test into a separate test. This makes it easier to debug test failures and allows to extend. Signed-off-by: Mykyta Yatsenko Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260201025403.66625-5-alexei.starovoitov@gmail.com commit a7e172aa4ca276d12fe87ffddff9cbd2d95ea51c Author: Alexei Starovoitov Date: Sat Jan 31 18:53:57 2026 -0800 bpf: Introduce bpf_timer_cancel_async() kfunc Introduce bpf_timer_cancel_async() that wraps hrtimer_try_to_cancel() and executes it either synchronously or defers to irq_work. Co-developed-by: Mykyta Yatsenko Signed-off-by: Mykyta Yatsenko Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260201025403.66625-4-alexei.starovoitov@gmail.com commit 19bd300e22c2be7df838fc4ea41b4e20ccd5c20f Author: Mykyta Yatsenko Date: Sat Jan 31 18:53:56 2026 -0800 bpf: Add verifier support for bpf_timer argument in kfuncs Extend the verifier to recognize struct bpf_timer as a valid kfunc argument type. Previously, bpf_timer was only supported in BPF helpers. This prepares for adding timer-related kfuncs in subsequent patches. Signed-off-by: Mykyta Yatsenko Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260201025403.66625-3-alexei.starovoitov@gmail.com commit 1bfbc267ec915e58c3723a2237bf067f0c4dffa8 Author: Alexei Starovoitov Date: Sat Jan 31 18:53:55 2026 -0800 bpf: Enable bpf_timer and bpf_wq in any context Refactor bpf_timer and bpf_wq to allow calling them from any context: - add refcnt to bpf_async_cb - map_delete_elem or map_free will drop refcnt to zero via bpf_async_cancel_and_free() - once refcnt is zero timer/wq_start is not allowed to make sure that callback cannot rearm itself - if in_hardirq defer to start/cancel operations to irq_work Co-developed-by: Mykyta Yatsenko Signed-off-by: Mykyta Yatsenko Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/bpf/20260201025403.66625-2-alexei.starovoitov@gmail.com commit 3c6248937fb9fe5cfb29aa8813e18c50095e4db7 Author: Konstantin Komarov Date: Fri Jan 30 16:35:35 2026 +0100 fs/ntfs3: allow explicit boolean acl/prealloc mount options This patch improves mount option parsing by allowing explicit boolean values for acl and prealloc. Previously those options were exposed only as presence/absence flags. Signed-off-by: Konstantin Komarov commit c7c88b20cd4226af0c9fbdb365fb6f221501c7da Author: Simon Glass Date: Tue Jan 6 09:27:36 2026 -0700 scripts/make_fit: Compress dtbs in parallel When there are 1500 device tree files it takes quite a while to compress them. Do it in parallel. Signed-off-by: Simon Glass Link: https://patch.msgid.link/20260106162738.2605574-7-sjg@chromium.org Signed-off-by: Nathan Chancellor commit fcdcf22a34b0768471d6c834254ef041e3d9c3dc Author: Simon Glass Date: Tue Jan 6 09:27:35 2026 -0700 scripts/make_fit: Support a few more parallel compressors Add support for pbzip2, xz and plzip which can compress in parallel. This speeds up the ramdisk compression. Signed-off-by: Simon Glass Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20260106162738.2605574-6-sjg@chromium.org Signed-off-by: Nathan Chancellor commit 9a329df6e004190ce7422cc040c09374efa34289 Author: Simon Glass Date: Tue Jan 6 09:27:34 2026 -0700 kbuild: Support a FIT_EXTRA_ARGS environment variable In some cases it is useful to be able to pass additional flags to the make_fit.py script. For example, since ramdisks are typically large, passing -E to use external data can be helpful. Add a new FIT_EXTRA_ARGS variable for this. Signed-off-by: Simon Glass Reviewed-by: Nicolas Schier Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/20260106162738.2605574-5-sjg@chromium.org Signed-off-by: Nathan Chancellor commit 873c2836982e1f7389d487afca4cc42ed373ba4b Author: Simon Glass Date: Tue Jan 6 09:27:33 2026 -0700 scripts/make_fit: Move dtb processing into a function Since build_fit() is getting quite long, move the dtb processing into a separate function. Change the double quotes in the write() call to single, to match the rest of the script. Signed-off-by: Simon Glass Reviewed-by: Nicolas Schier Reviewed-by: Ahmad Fatoum Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260106162738.2605574-4-sjg@chromium.org Signed-off-by: Nathan Chancellor commit 26428e7dd6a51e328776dd333f613445d1951658 Author: Simon Glass Date: Tue Jan 6 09:27:32 2026 -0700 scripts/make_fit: Support an initial ramdisk FIT (Flat Image Tree) allows a ramdisk to be included in each configuration. Add support for this to the script. This feature is not available via 'make image.fit' since the ramdisk likely needs to be built separately anyway, e.g. using modules from the kernel build. Future work may provide support for doing that. Note that the uncompressed size is not correct when a ramdisk is used, since it is too expensive to decompress the ramdisk. Signed-off-by: Simon Glass Reviewed-by: Nicolas Schier Reviewed-by: Ahmad Fatoum Link: https://patch.msgid.link/20260106162738.2605574-3-sjg@chromium.org Signed-off-by: Nathan Chancellor commit 621fd65adc825b69a59367b97a7c2aa73e382909 Author: Simon Glass Date: Tue Jan 6 09:27:31 2026 -0700 scripts/make_fit: Speed up operation The kernel is likely at least 16MB so we may as well use that as a step size when reallocating space for the FIT in memory. Pack the FIT at the end, so there is no wasted space. This reduces the time to pack by an order of magnitude, or so. Signed-off-by: Simon Glass Reviewed-by: Nicolas Schier Reviewed-by: Ahmad Fatoum Tested-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260106162738.2605574-2-sjg@chromium.org Signed-off-by: Nathan Chancellor commit e3c3a5d25dc090c237ec768fdded96e9184fe2ae Author: Aksh Garg Date: Fri Jan 30 17:25:16 2026 +0530 PCI: dwc: ep: Add comment explaining controller level PTM access in multi PF setup PCIe r6.0, section 7.9.15 requires PTM capability in exactly one function to control all PTM-capable functions. This makes PTM registers controller level rather than per-function. Add a comment explaining why PTM capability registers are accessed using the standard DBI accessors instead of func_no indexed per-function accessors. Suggested-by: Niklas Cassel Signed-off-by: Aksh Garg Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260130115516.515082-4-a-garg7@ti.com commit 72cb5ed2a5c6d87f71a409347f7d3b228fee6bee Author: Aksh Garg Date: Fri Jan 30 17:25:15 2026 +0530 PCI: dwc: ep: Add per-PF BAR and inbound ATU mapping support The commit 24ede430fa49 ("PCI: designware-ep: Add multiple PFs support for DWC") added support for multiple PFs in the DWC driver, but the implementation was incomplete. It did not properly support MSI/MSI-X, as well as BAR and inbound ATU mapping for multiple PFs. The MSI/MSI-X issue was later fixed by commit 47a062609a30 ("PCI: designware-ep: Modify MSI and MSIX CAP way of finding") by introducing a per-PF struct dw_pcie_ep_func. However, even with both commits, the multiple PF support in the driver remains broken because BAR configuration and ATU mappings are managed globally in struct dw_pcie_ep, meaning all PFs share the same BAR-to-ATU mapping table. This causes one PF's EPF to overwrite the address translation of another PF's EPF in the internal ATU region, creating conflicts when multiple physical functions attempt to configure their BARs independently. The commit cfbc98dbf44d ("PCI: dwc: ep: Support BAR subrange inbound mapping via Address Match Mode iATU") later introduced Address Match Mode support, which suffers from the same multi-PF conflict issue. Fix this by moving the required members from struct dw_pcie_ep to struct dw_pcie_ep_func, similar to what commit 47a062609a30 ("PCI: designware-ep: Modify MSI and MSIX CAP way of finding") did for MSI/MSI-X capability support, to allow proper multi-function endpoint operation, where each PF can configure its BARs and corresponding internal ATU region without interfering with other PFs. Fixes: 24ede430fa49 ("PCI: designware-ep: Add multiple PFs support for DWC") Fixes: cc839bef7727 ("PCI: dwc: ep: Support BAR subrange inbound mapping via Address Match Mode iATU") Signed-off-by: Aksh Garg Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260130115516.515082-3-a-garg7@ti.com commit f2445d6f264c64e90b5094d4e8ed33f30cfb7fc4 Author: Matthew Maurer Date: Tue Sep 9 18:14:20 2025 +0000 rust: kconfig: Don't require RUST_IS_AVAILABLE for rustc-option The final version of this macro does not fail in the absence of an invokable `$(RUSTC)`, so we don't need to be careful not to invoke it. Link: https://lore.kernel.org/all/CAGSQo01mQfcU1EiW53be1hcts0c1p-HQAab_HBk6VcVmhq3n2Q@mail.gmail.com/ Signed-off-by: Matthew Maurer Link: https://patch.msgid.link/20250909-docrem-v1-1-dcc69059a5cb@google.com Signed-off-by: Nathan Chancellor commit 1f77593d304e734890bc66bcb2b723c181c698f5 Author: Tiezhu Yang Date: Tue Jan 20 20:37:28 2026 +0800 MAINTAINERS: Add scripts/install.sh into Kbuild entry The common installation code is in scripts/install.sh, add it into Kbuild entry to reflect the reality. With this updated entry, folks running get_maintainer.pl on patches that touch scripts/install.sh will know to send it to linux-kbuild@ as well. Signed-off-by: Tiezhu Yang Link: https://patch.msgid.link/20260120123730.30487-2-yangtiezhu@loongson.cn [nathan: Alphabetize entry] Signed-off-by: Nathan Chancellor commit 3cd9763ce4ad999d015cf0734e6b968cead95077 Author: René Rebe Date: Sun Nov 23 13:13:30 2025 +0100 modpost: Amend ppc64 save/restfpr symnames for -Os build Building a size optimized ppc64 kernel (-Os), gcc emits more FP save/restore symbols, that the linker generates on demand into the .sfpr section. Explicitly allow-list those in scripts/mod/modpost.c, too. They are needed for the amdgpu in-kernel floating point support. MODPOST Module.symvers ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many) Signed-off-by: René Rebe Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de Signed-off-by: Nathan Chancellor commit d6e04d2e675fefcb24cc8ba3b72a4adf98dabdb2 Author: Lijo Lazar Date: Fri Jan 30 15:44:28 2026 +0530 drm/amd/pm: Remove buffer allocation in SMUv13.0.6 No longer required to allocate temporary buffer while fetching metrcis, instead, use metrics table cache data directly. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 8980be03b3f9a4b58197ef95d3b37efa41a25331 Author: Lijo Lazar Date: Thu Jan 22 12:11:49 2026 +0530 drm/amdgpu: Skip vcn poison irq release on VF VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid call trace during deinitialization. [ 71.913601] [drm] clean up the vf2pf work item [ 71.915088] ------------[ cut here ]------------ [ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu] [ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd [ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu [ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014 [ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu] [ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 <0f> 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00 [ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246 [ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000 [ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000 [ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000 [ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000 [ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0 [ 71.915800] PKRU: 55555554 [ 71.915802] Call Trace: [ 71.915805] [ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu] Signed-off-by: Lijo Lazar Reviewed-by: Mangesh Gadre Signed-off-by: Alex Deucher commit 1714dcc4c2c53e41190896eba263ed6328bcf415 Author: Melissa Wen Date: Fri Jan 16 12:50:49 2026 -0300 drm/amd/display: remove assert around dpp_base replacement There is nothing wrong if in_shaper_func type is DISTRIBUTED POINTS. Remove the assert placed for a TODO to avoid misinterpretations. Signed-off-by: Melissa Wen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 0274a54897f356f9c78767c4a2a5863f7dde90c6 Author: Melissa Wen Date: Mon Dec 8 22:44:15 2025 -0100 drm/amd/display: extend delta clamping logic to CM3 LUT helper Commit 27fc10d1095f ("drm/amd/display: Fix the delta clamping for shaper LUT") fixed banding when using plane shaper LUT in DCN10 CM helper. The problem is also present in DCN30 CM helper, fix banding by extending the same bug delta clamping fix to CM3. Signed-off-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 5006505b19a2119e71c008044d59f6d753c858b9 Author: Melissa Wen Date: Thu Jan 22 12:20:29 2026 -0300 drm/amd/display: fix wrong color value mapping on MCM shaper LUT Some shimmer/colorful points appears when using the steamOS color pipeline for HDR on gaming with DCN32. These points look like black values being wrongly mapped to red/blue/green values. It was caused because the number of hw points in regular LUTs and in a shaper LUT was treated as the same. DCN3+ regular LUTs have 257 bases and implicit deltas (i.e. HW calculates them), but shaper LUT is a special case: it has 256 bases and 256 deltas, as in DCN1-2 regular LUTs, and outputs 14-bit values. Fix that by setting by decreasing in 1 the number of HW points computed in the LUT segmentation so that shaper LUT (i.e. fixpoint == true) keeps the same DCN10 CM logic and regular LUTs go with `hw_points + 1`. CC: Krunoslav Kovac Fixes: 4d5fd3d08ea9 ("drm/amd/display: PQ tail accuracy") Signed-off-by: Melissa Wen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 6ba60345f45eaf7cb4f89105d26083a4b9fd1cba Author: Harish Kasiviswanathan Date: Fri Jan 9 15:26:36 2026 -0500 drm/amdgpu: Fix double deletion of validate_list If amdgpu_amdkfd_gpuvm_free_memory_of_gpu() fails after kgd_mem is removed from validate_list, the mem handle still lingers in the KFD idr. This means when process is terminated, kfd_process_free_outstanding_kfd_bos() will call amdgpu_amdkfd_gpuvm_free_memory_of_gpu() again resulting in double deletion. To avoid this - (a) Check if list is empty before deleting it (b) Rearragne amdgpu_amdkfd_gpuvm_free_memory_of_gpu() such that it can be safely called again if it returns failure the first time. Signed-off-by: Harish Kasiviswanathan Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 08b1eb621cc32819b7958a15cff10016b03b7aff Author: Andrew Martin Date: Tue Nov 11 16:43:45 2025 -0500 drm/amdgpu: Ignored various return code The return code of a non void function should not be ignored. In cases where we do not care, the code needs to suppress it. Signed-off-by: Andrew Martin Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit c6fa06fc4c78ed6658bc77d41ceaca0c0121da48 Author: Jinzhou Su Date: Wed Jan 21 16:27:46 2026 +0800 drm/amdgpu/psp_v15_0_8: Add get ras capability Add get ras capability for psp 15.0.8. v2:Remove APU type check and IP version check. Signed-off-by: Jinzhou Su Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit da8c276035494e86f2cfda7afd92c3202c4c0997 Author: Lijo Lazar Date: Mon Jan 19 18:32:19 2026 +0530 drm/amd/pm: Add default feature number definition The number of default features could be different from the actual width of the bitmap. Use a different definition for it. Also increase the max width of bitmap to 128. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 7b88453a476c9770c094c1f596e0b9fee208e65b Author: Lijo Lazar Date: Mon Jan 19 16:04:06 2026 +0530 drm/amd/pm: Change get_enabled_mask signature Use smu_feature_bits instead of uint64_t pointer and operate on feature bits. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit e37fb0f818386d2c91474e1aee29fbf692fa08a3 Author: Lijo Lazar Date: Mon Jan 19 14:37:34 2026 +0530 drm/amd/pm: Use feature bits data structure Feature bits are not necessarily restricted to 64-bits. Use smu_feature_bits data structure to represent feature mask for checking DPM status. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 97a9689300eb2b393ba5efc17c8e5db835917080 Author: Bert Karwatzki Date: Sun Feb 1 01:24:45 2026 +0100 Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" This reverts commit 7294863a6f01248d72b61d38478978d638641bee. This commit was erroneously applied again after commit 0ab5d711ec74 ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") removed it, leading to very hard to debug crashes, when used with a system with two AMD GPUs of which only one supports ASPM. Link: https://lore.kernel.org/linux-acpi/20251006120944.7880-1-spasswolf@web.de/ Link: https://github.com/acpica/acpica/issues/1060 Fixes: 0ab5d711ec74 ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") Signed-off-by: Bert Karwatzki Reviewed-by: Christian König Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 500449eb7008a1e60fd748b4c9d4c2b000cb88c7 Author: Stanley.Yang Date: Tue Jan 20 19:19:08 2026 +0800 drm/amdgpu: statistic xgmi training error count Report xgmi training error uncorrectable error count. Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 4a0f94dfef34745a380a93b3a764d82e0ff840f4 Author: Taimur Hassan Date: Fri Jan 23 22:39:10 2026 -0500 drm/amd/display: Promote DC to 3.2.368 This version brings along following fixes: - Migrate DCCG register access from hwseq to dccg component. - Add lpddr5 handling to dml2.1 - Correct external pr fsm control - Make DCN35 OTG disable w/a reusable - Make DSC FGCG a DSC block level function - Make some DCN35 DCCG symbols reusable - Fix writeback on DCN 3.2+ - Fix IGT link training failure on Replay panel - Fix system resume lag issue - Add oem panel config for new features - Fix IGT ILR link training failure on Replay panel - Fix a NULL pointer dereference in dcn20_hwseq.c - Add Gfx Base Case For Linear Tiling Handling - Migrate DIO registers access from hwseq to dio component. - Match expected data types - Add CRC 32-bit mode support for DCN3.6+ - Init DMUB DPIA Only for APU - DIO memory leak fix. - Add Handling for gfxversion DcGfxBase Acked-by: ChiaHsuan Chung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 7c1ed3dc6769119e55473650cebacdb0ad8d0edb Author: Taimur Hassan Date: Fri Jan 23 17:13:14 2026 -0500 drm/amd/display: [FW Promotion] Release 0.1.45.0 Add new enum definition for panel replay ml activity options. Acked-by: ChiaHsuan Chung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 2e193f5b1b4f638b47a177a6b4686cbb5cf75065 Author: Nicholas Carbones Date: Wed Jan 7 09:42:27 2026 -0500 drm/amd/display: Add Handling for gfxversion DcGfxBase [Why] There is no way to set tiling in dml in the case that gfxversion is DcGfxBase. [How] Where tiling is updated based on Gfx, add case for DcGfxBase and set tiling to dml2_sw_linear. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Carbones Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 22bd5f691665b3d427d21db077698d580a5e5266 Author: Bhuvanachandra Pinninti Date: Fri Jan 23 16:13:01 2026 +0530 drm/amd/display: DIO memory leak fix. [why] Allocated memory for dcn10_dio but not freed in dcn401_resource. [how] Add kfree for it in dcn401_resource. Reviewed-by: Aric Cyr Signed-off-by: Bhuvanachandra Pinninti Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 1e5a335e2436a263cdc5c27ea7bbb0aa8137346a Author: Fangzhi Zuo Date: Wed Jan 21 14:24:37 2026 -0500 drm/amd/display: Init DMUB DPIA Only for APU [why & how] 1. There is no need to init dpia in dgpu 2. Add additional dpia flags a. dpia hpd dynamic control b. consolidated dpia link training to dp c. dynamic bw allocation support Reviewed-by: Roman Li Signed-off-by: Fangzhi Zuo Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 1a77ecec8b35258c45b6963698e5dc378c67ef32 Author: Chenyu Chen Date: Thu Jan 22 17:19:07 2026 +0800 drm/amd/display: Add CRC 32-bit mode support for DCN3.6+ [Why] DCN 3.6+ hardware supports CRC-32 polynomial in addition to the legacy CRC-16. Enable 32-bit CRC values per color component for improvement of precision in display validation. [How] When userspace sets crc_poly_mode (0=CRC-16, 1=CRC-32) via the debugfs interface, the value is stored in dm_irq_params.crc_poly_mode. When CRC source configuration triggers amdgpu_dm_crtc_configure_crc_source(), crc_poly_mode is retrieved from dm_irq_params and passed to dc_stream_configure_crc(). In the DC layer, dc_stream_configure_crc() sets crc_poly_mode into the crc_params structure and passes it to optc35_configure_crc(). If the hardware supports the OTG_CRC_POLY_SEL register, the register is programmed to select CRC-16 or CRC-32 polynomial. When reading CRC values, optc35_get_crc() checks whether CRC32 register masks are available. If present, it reads 32-bit CRC values from OTG_CRC0/1_DATA_R32/G32/B32 registers; otherwise, it falls back to reading 16-bit CRC values from legacy OTG_CRC0/1_DATA_RG/B registers. Reviewed-by: ChiaHsuan Chung Signed-off-by: Chenyu Chen Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0b39cb143d214fac7e30696ac1c53fad563fbb1a Author: Zheng Austin Date: Mon Jan 19 17:46:39 2026 -0500 drm/amd/display: Match expected data types [Why/How] Data types should match what is expected. Update/cast data accordingly. Also change ASSERT to use DML_ASSERT instead Reviewed-by: Dillon Varone Signed-off-by: Zheng Austin Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit b82f0759346617b2cb84d8cc2d4a179795d4efd0 Author: Bhuvanachandra Pinninti Date: Thu Jan 8 18:37:57 2026 +0530 drm/amd/display: Migrate DIO registers access from hwseq to dio component. [why] Direct DIO registers access in hwseq layer was creating register conflicts. [how] Migrated DIO registers from hwseq to dio component. Reviewed-by: Jun Lei Signed-off-by: Bhuvanachandra Pinninti Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c2d2ccc85faf8cc6934d50c18e43097eb453ade2 Author: Mario Limonciello Date: Thu Jan 29 13:47:22 2026 -0600 drm/amd: Set minimum version for set_hw_resource_1 on gfx11 to 0x52 commit f81cd793119e ("drm/amd/amdgpu: Fix MES init sequence") caused a dependency on new enough MES firmware to use amdgpu. This was fixed on most gfx11 and gfx12 hardware with commit 0180e0a5dd5c ("drm/amdgpu/mes: add compatibility checks for set_hw_resource_1"), but this left out that GC 11.0.4 had breakage at MES 0x51. Bump the requirement to 0x52 instead. Reported-by: danijel@nausys.com Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4576 Fixes: f81cd793119e ("drm/amd/amdgpu: Fix MES init sequence") Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 08a01ec306dbd0e096be8ee0cebb0e6a3b5fa413 Author: Nicholas Carbones Date: Tue Jan 6 17:35:51 2026 -0500 drm/amd/display: Add Gfx Base Case For Linear Tiling Handling [Why] Post-driver cases always use linear tiling yet there is no dedicated Gfx handling for this condition. [How] Add DcGfxBase/DalGfxBase to gfx version enums and set tiling to linear when it is used. Also, enforce the use of proper tiling format as tiling information is used. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Carbones Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 9d6bd60695806782bec8562ab73aefafce067f05 Author: Wenjing Liu Date: Tue Jan 20 22:40:07 2026 +0000 drm/amd/display: Fix a NULL pointer dereference in dcn20_hwseq.c [why] hws->funcs.dccg_init is accessed without checking if it is NULL, which may lead to a NULL pointer dereference. [how] Add a NULL check before calling dccg_init. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Wenjing Liu Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit e121ccca8a4a5dd6fb5d395de6ef31ebfce7fb38 Author: Ray Wu Date: Tue Jan 20 16:55:43 2026 +0800 drm/amd/display: Fix IGT ILR link training failure on Replay panel [Why & How] Fix the IGT ilr_link-training-configs test failure by directly using the supported link rates from DPCD. Reviewed-by: ChiaHsuan Chung Signed-off-by: Ray Wu Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0054d5a57a98c1a6783ffd9c8b7ceda8f8bb46d1 Author: Ian Chen Date: Wed Dec 3 16:59:07 2025 +0800 drm/amd/display: Add oem panel config for new features [WHAT] Add oem panel config for below features: - CACP_v2 - Adaptive VariBright - Replay_FrameSkipping - Replay_teamsOpt - Ramless Idle Opt Reviewed-by: Robin Chen Signed-off-by: Ian Chen Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit bb4099c7d90043673c8089ae1dce0d6c7d393f13 Author: Ray Wu Date: Tue Jan 20 16:29:38 2026 +0800 drm/amd/display: Fix IGT link training failure on Replay panel [Why] IGT link-training-configs test fails to set the link rate on Replay panels because some link rate types are not supported in debugfs. As a result, debugfs treats these link rates as invalid, causing the IGT test to fail. [How] Add missing link rate types to resolve this issue. Reviewed-by: ChiaHsuan Chung Signed-off-by: Ray Wu Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 9ef84a307582a92ef055ef0bd3db10fd8ac75960 Author: Alex Hung Date: Wed Jan 14 17:20:31 2026 -0700 drm/amd/display: Fix writeback on DCN 3.2+ [WHAT] 1. Set no scaling for writeback as they are hardcoded in DCN3.2+. 2. Set no fast plane update for writeback commits. Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 2ac80621e0efcc145f15a05a60f185d26290c4bd Author: Nicholas Kazlauskas Date: Fri Jan 16 16:49:46 2026 -0500 drm/amd/display: Make some DCN35 DCCG symbols non-static In order to have few DCN35 functions be leveraged for future ASIC implementations. Expose them to the dcn35_dccg.h header. Reviewed-by: Ovidiu Bunea Signed-off-by: Nicholas Kazlauskas Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit b8285d2ee73758386252cc3a67839bc463dfa1cc Author: Nicholas Kazlauskas Date: Wed Jan 14 14:55:38 2026 -0500 drm/amd/display: Make DSC FGCG a DSC block level function [Why] FGCG shouldn't be called at the DC resource level as part of DSC creation because dc_create is intended for SW init, not HW init, and register access is not guaranteed to work at this phase. [How] Add a set_fgcg function at the DSC interface level. Existing ASIC can continue using the function in DC resource to retain current compatibility but further development should favor calling the function pointer during init_hw (if it exists). Reviewed-by: Dillon Varone Signed-off-by: Nicholas Kazlauskas Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8488fb054ea8a603921fe0a05bfc2bd43e64c5bc Author: Nicholas Kazlauskas Date: Mon Jan 19 16:09:50 2026 -0500 drm/amd/display: Make DCN35 OTG disable w/a reusable The logic for the OTG disable workaround is particularly complex and should be leveraged going forward instead of reimplementing and maintaining it for multiple ASIC. Reviewed-by: Ovidiu Bunea Signed-off-by: Nicholas Kazlauskas Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 9a42510d6bc75324f1636f8e654d31ff08257a9a Author: Peichen Huang Date: Fri Jan 9 17:04:25 2026 +0800 drm/amd/display: External panel replay fsm control [WHY] To correctly control external panel replay fsm. [HOW] 1. External panel replay is 1-A option only now. 2. Update cursor update and dirty rects commands for external panel replay support. 3. Add external panel replay support flag in dc. Reviewed-by: Robin Chen Signed-off-by: Peichen Huang Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit eee8227dd18868bb16dbf72e2ab11d1a9008b874 Author: Dmytro Laktyushkin Date: Fri Jan 16 22:17:15 2026 -0500 drm/amd/display: Add lpddr5 handling to dml2.1 [Why & How] Memory bandwidth calculations work differently than for ddr. Add lpddr5 handling. Reviewed-by: Charlene Liu Signed-off-by: Dmytro Laktyushkin Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 949adb4789fe3c24eea01d9c2efe94ab92694a0d Author: Bhuvanachandra Pinninti Date: Wed Dec 17 18:50:11 2025 +0530 drm/amd/display: Migrate DCCG register access from hwseq to dccg component. [why] Direct DCCG register access in hwseq layer was creating register conflicts. [how] Migrated DCCG registers from hwseq to dccg component. Reviewed-by: Martin Leung Signed-off-by: Bhuvanachandra Pinninti Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 31b153315b8702d0249aa44d83d9fbf42c5c7a79 Author: Perry Yuan Date: Wed Jan 28 13:54:31 2026 +0800 drm/amdgpu: ensure no_hw_access is visible before MMIO Add a full memory barrier after clearing no_hw_access in amdgpu_device_mode1_reset() so subsequent PCI state restore access cannot observe stale state on other CPUs. Fixes: 7edb503fe4b6 ("drm/amd/pm: Disable MMIO access during SMU Mode 1 reset") Signed-off-by: Perry Yuan Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 5c9ecd8e6437cd55a38ea4f1e1d19cee8e226cb8 Author: Gui-Dong Han Date: Tue Feb 3 11:19:43 2026 +0800 PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races dev_pm_clear_wake_irq() currently uses a dangerous pattern where dev->power.wakeirq is read and checked for NULL outside the lock. If two callers invoke this function concurrently, both might see a valid pointer and proceed. This could result in a double-free when the second caller acquires the lock and tries to release the same object. Address this by removing the lockless check of dev->power.wakeirq. Instead, acquire dev->power.lock immediately to ensure the check and the subsequent operations are atomic. If dev->power.wakeirq is NULL under the lock, simply unlock and return. This guarantees that concurrent calls cannot race to free the same object. Based on a quick scan of current users, I did not find an actual bug as drivers seem to rely on their own synchronization. However, since asynchronous usage patterns exist (e.g., in drivers/net/wireless/ti/wlcore), I believe a race is theoretically possible if the API is used less carefully in the future. This change hardens the API to be robust against such cases. Fixes: 4990d4fe327b ("PM / Wakeirq: Add automated device wake IRQ handling") Signed-off-by: Gui-Dong Han Link: https://patch.msgid.link/20260203031943.1924-1-hanguidong02@gmail.com Signed-off-by: Rafael J. Wysocki commit 3bd1cde3dffbb29764453201e19c17053557a520 Author: Yaxiong Tian Date: Tue Feb 3 17:35:01 2026 +0800 cpufreq: Documentation: Update description of rate_limit_us default value Due to commit 37c6dccd6837 ("cpufreq: Remove LATENCY_MULTIPLIER") updating the acquisition logic of cpufreq_policy_transition_delay_us(), the original description of 2 ms has become inaccurate. Therefore, update the description of the default value for rate_limit_us from 2ms to 1ms. Signed-off-by: Yaxiong Tian [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260203093501.1138721-1-tianyaxiong@kylinos.cn Signed-off-by: Rafael J. Wysocki commit 1fedbb589448bee9f20bb2ed9c850d1d2cf9963c Author: Yaxiong Tian Date: Tue Feb 3 10:48:52 2026 +0800 cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible According to the description in the intel_pstate.rst documentation, Capacity-Aware Scheduling and Energy-Aware Scheduling are only supported on a hybrid processor without SMT. Previously, the system used sched_smt_active() for judgment, which is not a strict condition because users can switch it on or off via /sys at any time. This could lead to incorrect driver settings in certain scenarios. For example, on a CPU that supports SMT, a user can disable SMT via the nosmt parameter to enable asym capacity, and then re-enable SMT via /sys. In such cases, some settings in the driver would no longer be correct. To address this issue, replace sched_smt_active() with cpu_smt_possible(), and only enable asym capacity when CPU SMT is not possible. Fixes: 929ebc93ccaa ("cpufreq: intel_pstate: Set asymmetric CPU capacity on hybrid systems") Signed-off-by: Yaxiong Tian [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260203024852.301066-1-tianyaxiong@kylinos.cn Signed-off-by: Rafael J. Wysocki commit 4cc4ace709860c37f7f8019e950380a4694eb101 Author: Abdurrahman Hussain Date: Tue Feb 3 01:55:12 2026 +0000 spi: xilinx: use device property accessors. Switch to device property accessors. Signed-off-by: Abdurrahman Hussain Link: https://patch.msgid.link/20260203-spi-xilinx-v4-1-42f7c326061b@nexthop.ai Signed-off-by: Mark Brown commit 84cb36da81413c2dff805150b9f4db1524460269 Author: Ian Rogers Date: Tue Feb 3 10:26:40 2026 -0800 perf thread: Don't require machine to compute the e_machine The machine can be calculated from a thread via its maps. Don't require the machine argument to simplify callers and also to delay computing the machine until a little later. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Andrew Jones Cc: Anubhav Shelat Cc: Anup Patel Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Dmitriy Vyukov Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Quan Zhou Cc: Shimin Guo Cc: Swapnil Sapkal Cc: Thomas Falcon Cc: Will Deacon Cc: Yunseong Kim Signed-off-by: Arnaldo Carvalho de Melo commit c4f4392264b45d53ec6e4d21b6f7d947953ddf45 Author: Ian Rogers Date: Tue Feb 3 10:26:39 2026 -0800 perf header: Add e_machine/e_flags to the header Add 64-bits of feature data to record the ELF machine and flags. This allows readers to initialize based on the data. For example, `perf kvm stat` wants to initialize based on the kind of data to be read, but at initialization time there are no threads to base this data upon and using the host means cross platform support won't work. The values in the perf_env also act as a cache for these within the session. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Andrew Jones Cc: Anubhav Shelat Cc: Anup Patel Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Dmitriy Vyukov Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Quan Zhou Cc: Shimin Guo Cc: Swapnil Sapkal Cc: Thomas Falcon Cc: Will Deacon Cc: Yunseong Kim Signed-off-by: Arnaldo Carvalho de Melo commit 07ad6f31b6745caab701ebd5d914217cd10f5b7a Author: Ian Rogers Date: Tue Feb 3 10:26:38 2026 -0800 perf session: Add e_flags to the e_machine helper Allow e_flags as well as e_machine to be computed using the e_machine helper. This isn't currently used, the argument is always NULL, but it will be used for a new header feature. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Andrew Jones Cc: Anubhav Shelat Cc: Anup Patel Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Dmitriy Vyukov Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Quan Zhou Cc: Shimin Guo Cc: Swapnil Sapkal Cc: Thomas Falcon Cc: Will Deacon Cc: Yunseong Kim Signed-off-by: Arnaldo Carvalho de Melo commit 43af548436775557b79aee32b30e4f020d51fbe6 Author: Ian Rogers Date: Tue Feb 3 10:26:37 2026 -0800 perf kvm: Wire up e_machine Pass the e_machine to the kvm functions so that they aren't just wired to EM_HOST. In the case of a session move some setup until the session is created. As the session isn't fully running the default EM_HOST is returned as no e_machine can be found in a running machine. This is, however, some marginal progress to cross platform support. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Andrew Jones Cc: Anubhav Shelat Cc: Anup Patel Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Dmitriy Vyukov Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Quan Zhou Cc: Shimin Guo Cc: Swapnil Sapkal Cc: Thomas Falcon Cc: Will Deacon Cc: Yunseong Kim Signed-off-by: Arnaldo Carvalho de Melo commit ceea279f93760767c0e654341829334a1c881a08 Author: Ian Rogers Date: Tue Feb 3 10:26:36 2026 -0800 perf kvm stat: Remove use of the arch directory `perf kvm stat` supports record and report options. By using the arch directory a report for a different machine type cannot be supported. Move the kvm-stat code out of the arch directory and into util/kvm-stat-arch following the pattern of perf-regs and dwarf-regs. Avoid duplicate symbols by renaming functions to have the architecture name within them. For global variables, wrap them in an architecture specific function. Selecting the architecture to use with `perf kvm stat` is selected by EM_HOST, ie no different than before the change. Later the ELF machine can be determined from the session or a header feature (ie EM_HOST at the time of the record). The build and #define HAVE_KVM_STAT_SUPPORT is now redundant so remove across Makefiles and in the build. Opportunistically constify architectural structs and arrays. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Andrew Jones Cc: Anubhav Shelat Cc: Anup Patel Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Dmitriy Vyukov Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Quan Zhou Cc: Shimin Guo Cc: Swapnil Sapkal Cc: Thomas Falcon Cc: Will Deacon Cc: Yunseong Kim Signed-off-by: Arnaldo Carvalho de Melo commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 Author: Ian Rogers Date: Mon Feb 2 22:09:18 2026 -0800 libperf build: Always place libperf includes first When building tools/perf the CFLAGS can contain a directory for the installed headers. As the headers may be being installed while building libperf.a this can cause headers to be partially installed and found in the include path while building an object file for libperf.a. The installed header may reference other installed headers that are missing given the partial nature of the install and then the build fails with a missing header file. Avoid this by ensuring the libperf source headers are always first in the CFLAGS. Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit d2ac7e4418dd2db7c512a658eb5b3d93650baacd Author: Ian Rogers Date: Sat Jan 31 12:02:19 2026 -0800 perf test kvm: Add stat live testing Ensure the `perf kvm stat live -p ..` has some basic functionality. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Andrew Jones Cc: Anubhav Shelat Cc: Anup Patel Cc: Athira Rajeev Cc: Blake Jones Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Dmitriy Vyukov Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Kan Liang Cc: Leo Yan Cc: Mike Leach Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Quan Zhou Cc: Shimin Guo Cc: Swapnil Sapkal Cc: Thomas Falcon Cc: Will Deacon Cc: Yunseong Kim Signed-off-by: Arnaldo Carvalho de Melo commit 8ed5a41afd0ef8db995a4f90668e73075b1cf940 Merge: 756b7b8d0a7be7 51e8ce3630878f Author: Wolfram Sang Date: Tue Feb 3 21:53:38 2026 +0100 Merge tag 'i2c-host-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v6.20 - amd-mp2, designware, mlxbf, rtl9300, spacemit, tegra: cleanups - designware: use a dedicated algorithm for AMD Navi - designware: replace magic numbers with named constants - designware: replace min_t() with min() to avoid u8 truncation - designware: refactor core to enable mode switching - imx-lpi2c: add runtime PM support for IRQ and clock handling - lan9691-i2c: add new driver - rtl9300: use OF helpers directly and avoid fwnode handling - spacemit: add bus reset support - units: add HZ_PER_GHZ and use it in several i2c drivers commit 36c0de02575ce59dfd879eb4ef63d53a68bbf9ce Author: Robin Murphy Date: Tue Feb 3 14:07:29 2026 +0000 perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models (at least with a warning), and unknown revisions of those which we do know, as although things do frequently change between releases, typically enough remains the same to be somewhat useful for at least some basic bringup checks. However, we also make assumptions of the maximum supported sizes and numbers of things in various places, and there's no guarantee that something new might not be bigger and lead to nasty array overflows. Make sure we only try to run on things that actually match our assumptions and so will not risk memory corruption. We have at least always failed on completely unknown node types, so update that error message for clarity and consistency too. Cc: stable@vger.kernel.org Fixes: 7819e05a0dce ("perf/arm-cmn: Revamp model detection") Reviewed-by: Ilkka Koskinen Signed-off-by: Robin Murphy Signed-off-by: Will Deacon commit 283182c1c239f6873d1a50e9e710c1a699f2256b Author: Leo Yan Date: Tue Feb 3 14:40:43 2026 +0000 perf: arm_spe: Properly set hw.state on failures When arm_spe_pmu_next_off() fails to calculate a valid limit, it returns zero to indicate that tracing should not start. However, the caller arm_spe_perf_aux_output_begin() does not propagate this failure by updating hwc->state, cause the error to be silently ignored by upper layers. Because hwc->state remains zero after a failure, arm_spe_pmu_start() continues to programs filter registers unnecessarily. The driver still reports success to the perf core, so the core assumes the SPE event was enabled and proceeds to enable other events. This breaks event group semantics: SPE is already stopped while other events in the same group are enabled. Fix this by updating arm_spe_perf_aux_output_begin() to return a status code indicating success (0) or failure (-EIO). Both the interrupt handler and arm_spe_pmu_start() check the return value and call arm_spe_pmu_stop() to set PERF_HES_STOPPED in hwc->state. In the interrupt handler, the period (e.g., period_left) needs to be updated, so PERF_EF_UPDATE is passed to arm_spe_pmu_stop(). When the error occurs during event start, the trace unit is not yet enabled, so a flag '0' is used to drain buffer and update state only. Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") Signed-off-by: Leo Yan Signed-off-by: Will Deacon commit 32d572e39031920691abfada68cdb19ad44b4eeb Author: Breno Leitao Date: Tue Feb 3 09:01:17 2026 -0800 workqueue: add CONFIG_BOOTPARAM_WQ_STALL_PANIC option Add a kernel config option to set the default value of workqueue.panic_on_stall, similar to CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC, CONFIG_BOOTPARAM_HARDLOCKUP_PANIC and CONFIG_BOOTPARAM_HUNG_TASK_PANIC. This allows setting the number of workqueue stalls before triggering a kernel panic at build time, which is useful for high-availability systems that need consistent panic-on-stall, in other words, those servers which run with CONFIG_BOOTPARAM_*_PANIC=y already. The default remains 0 (disabled). Setting it to 1 will panic on the first stall, and higher values will panic after that many stall warnings. The value can still be overridden at runtime via the workqueue.panic_on_stall boot parameter or sysfs. Signed-off-by: Breno Leitao Signed-off-by: Tejun Heo commit 750817a7c41de083ca5d73052e97bb7b67d7c394 Author: Lizhi Hou Date: Tue Feb 3 10:40:37 2026 -0800 accel/amdxdna: Fix incorrect error code returned for failed chain command The driver currently returns an incorrect error code when a chain command fails. In this case, ERT_CMD_STATE_ERROR is expected to be reported for failed chain commands. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Maciej Falkowski Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260203184037.2751889-1-lizhi.hou@amd.com commit f11f7cf90ee09dbcf76413818063ffc38ed2d9fe Merge: f941479a709a53 4d99137eea48b1 Author: Alexei Starovoitov Date: Tue Feb 3 10:41:17 2026 -0800 Merge branch 'bpf-add-bpf_stream_print_stack-kfunc' Emil Tsalapatis says: ==================== bpf: Add bpf_stream_print_stack kfunc Add a new bpf_stream_print_stack kfunc for printing a BPF program stack into a BPF stream. Update the verifier to allow the new kfunc to be called with BPF spinlocks held, along with bpf_stream_vprintk. Patchset spun out of the larger libarena + ASAN patchset. (https://lore.kernel.org/bpf/20260127181610.86376-1-emil@etsalapatis.com/) Changeset: - Update bpf_stream_print_stack to take stream_id arg (Kumar) - Added selftest for the bpf_stream_print_stack - Add selftest for calling the streams kfuncs under lock v2->v1: (https://lore.kernel.org/bpf/20260202193311.446717-1-emil@etsalapatis.com/) - Updated Signed-off-by to be consistent with past submissions - Updated From email to be consistent with Signed-off-by Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Emil Tsalapatis ==================== Link: https://patch.msgid.link/20260203180424.14057-1-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 4d99137eea48b18387d8d17443e28d124177ab7b Author: Emil Tsalapatis Date: Tue Feb 3 13:04:24 2026 -0500 selftests/bpf: Add selftests for stream functions under lock Add a selftest to ensure BPF stream functions can now be called while holding a lock. Signed-off-by: Emil Tsalapatis Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260203180424.14057-5-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 9ddfa24e16747da8d98464b4285ee66e37ddc5c0 Author: Emil Tsalapatis Date: Tue Feb 3 13:04:23 2026 -0500 bpf: Allow BPF stream kfuncs while holding a lock The BPF stream kfuncs bpf_stream_vprintk and bpf_stream_print_stack do not sleep and so are safe to call while holding a lock. Amend the verifier to allow that. Signed-off-by: Emil Tsalapatis Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260203180424.14057-4-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 954fa97e215ea8fb1fe70d117d25875f3d3938ea Author: Emil Tsalapatis Date: Tue Feb 3 13:04:22 2026 -0500 selftests/bpf: Add selftests for bpf_stream_print_stack Add selftests for the new bpf_stream_print_stack kfunc. Signed-off-by: Emil Tsalapatis Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260203180424.14057-3-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 63328bb23f2693fe36e8bcdb972c6040e84d16e4 Author: Emil Tsalapatis Date: Tue Feb 3 13:04:21 2026 -0500 bpf: Add bpf_stream_print_stack stack dumping kfunc Add a new kfunc called bpf_stream_print_stack to be used by programs that need to print out their current BPF stack. The kfunc is essentially a wrapper around the existing bpf_stream_dump_stack functionality used to generate stack traces for error events like may_goto violations and BPF-side arena page faults. Signed-off-by: Emil Tsalapatis Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260203180424.14057-2-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit f941479a709a534911715cb08d3d71c7074882bd Merge: d95d76aa772bf9 f6ef5584ccb568 Author: Alexei Starovoitov Date: Tue Feb 3 10:30:50 2026 -0800 Merge branch 'bpf-verifier-improve-state-pruning-for-scalar-registers' Puranjay Mohan says: ==================== bpf: Improve state pruning for scalar registers V2: https://lore.kernel.org/all/20260203022229.1630849-1-puranjay@kernel.org/ Changes in V3: - Fix spelling mistakes in commit logs (AI) - Fix an incorrect comment in the selftest added in patch 5 (AI) - Improve the title of patch 5 V1: https://lore.kernel.org/all/20260202104414.3103323-1-puranjay@kernel.org/ Changes in V2: - Collected acked by Eduard - Removed some unnecessary comments - Added a selftest for id=0 equivalence in Patch 5 This series improves BPF verifier state pruning by relaxing scalar ID equivalence requirements. Scalar register IDs are used to track relationships between registers for bounds propagation. However, once an ID becomes "singular" (only one register/stack slot carries it), it can no longer participate in bounds propagation and becomes stale. These stale IDs can prevent pruning of otherwise equivalent states. The series addresses this in four patches: Patch 1: Assign IDs on stack fills to ensure stack slots have IDs before being read into registers, preparing for the singular ID clearing in patch 2. Patch 2: Clear IDs that appear only once before caching, as they cannot contribute to bounds propagation. Patch 3: Relax maybe_widen_reg() to only compare value-tracking fields (bounds, tnum, var_off) rather than also requiring ID matches. Two scalars with identical value constraints but different IDs represent the same abstract value and don't need widening. Patch 4: Relax scalar ID equivalence in state comparison by treating rold->id == 0 as "independent". If the old state didn't rely on ID relationships for a register, any linking in the current state only adds constraints and is safe to accept for pruning. Patch 5: Add a selftest to show the exact case being handled by Patch 4 I ran veristat on BPF programs from sched_ext, meta's internal programs, and on selftest programs, showing programs with insn diff > 5%: Scx Progs File Program States (A) States (B) States (DIFF) Insns (A) Insns (B) Insns (DIFF) ------------------ ------------------- ---------- ---------- ------------- --------- --------- --------------- scx_rusty.bpf.o rusty_set_cpumask 320 230 -90 (-28.12%) 4478 3259 -1219 (-27.22%) scx_bpfland.bpf.o bpfland_select_cpu 55 49 -6 (-10.91%) 691 618 -73 (-10.56%) scx_beerland.bpf.o beerland_select_cpu 27 25 -2 (-7.41%) 320 295 -25 (-7.81%) scx_p2dq.bpf.o p2dq_init 265 250 -15 (-5.66%) 3423 3233 -190 (-5.55%) scx_layered.bpf.o layered_enqueue 1461 1386 -75 (-5.13%) 14541 13792 -749 (-5.15%) FB Progs File Program States (A) States (B) States (DIFF) Insns (A) Insns (B) Insns (DIFF) ------------ ------------------- ---------- ---------- -------------- --------- --------- --------------- bpf007.bpf.o bpfj_free 1726 1342 -384 (-22.25%) 25671 19096 -6575 (-25.61%) bpf041.bpf.o armr_net_block_init 22373 20411 -1962 (-8.77%) 651697 602873 -48824 (-7.49%) bpf227.bpf.o layered_quiescent 28 26 -2 (-7.14%) 365 340 -25 (-6.85%) bpf248.bpf.o p2dq_init 263 248 -15 (-5.70%) 3370 3159 -211 (-6.26%) bpf254.bpf.o p2dq_init 263 248 -15 (-5.70%) 3388 3177 -211 (-6.23%) bpf241.bpf.o p2dq_init 264 249 -15 (-5.68%) 3428 3240 -188 (-5.48%) bpf230.bpf.o p2dq_init 287 271 -16 (-5.57%) 3666 3431 -235 (-6.41%) bpf251.bpf.o lavd_cpu_offline 321 316 -5 (-1.56%) 6221 5891 -330 (-5.30%) bpf251.bpf.o lavd_cpu_online 321 316 -5 (-1.56%) 6219 5889 -330 (-5.31%) Selftest Progs File Program States (A) States (B) States (DIFF) Insns (A) Insns (B) Insns (DIFF) ---------------------------------- ----------------- ---------- ---------- ------------- --------- --------- --------------- verifier_iterating_callbacks.bpf.o test2 4 2 -2 (-50.00%) 29 18 -11 (-37.93%) verifier_iterating_callbacks.bpf.o test3 4 2 -2 (-50.00%) 31 19 -12 (-38.71%) strobemeta_bpf_loop.bpf.o on_event 318 221 -97 (-30.50%) 3938 2755 -1183 (-30.04%) bpf_qdisc_fq.bpf.o bpf_fq_dequeue 133 105 -28 (-21.05%) 1686 1385 -301 (-17.85%) iters.bpf.o delayed_read_mark 6 5 -1 (-16.67%) 60 46 -14 (-23.33%) arena_strsearch.bpf.o arena_strsearch 107 106 -1 (-0.93%) 1394 1258 -136 (-9.76%) ==================== Link: https://patch.msgid.link/20260203165102.2302462-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit f6ef5584ccb5683542abb38461970e969b580fba Author: Puranjay Mohan Date: Tue Feb 3 08:51:01 2026 -0800 selftests/bpf: Add a test for ids=0 to verifier_scalar_ids test Test that two registers with their id=0 (unlinked) in the cached state can be mapped to a single id (linked) in the current state. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20260203165102.2302462-6-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit b0388bafa4949bd30af7b3be5ee415f2a25ac014 Author: Puranjay Mohan Date: Tue Feb 3 08:51:00 2026 -0800 bpf: Relax scalar id equivalence for state pruning Scalar register IDs are used by the verifier to track relationships between registers and enable bounds propagation across those relationships. Once an ID becomes singular (i.e. only a single register/stack slot carries it), it can no longer contribute to bounds propagation and effectively becomes stale. The previous commit makes the verifier clear such ids before caching the state. When comparing the current and cached states for pruning, these stale IDs can cause technically equivalent states to be considered different and thus prevent pruning. For example, in the selftest added in the next commit, two registers - r6 and r7 are not linked to any other registers and get cached with id=0, in the current state, they are both linked to each other with id=A. Before this commit, check_scalar_ids would give temporary ids to r6 and r7 (say tid1 and tid2) and then check_ids() would map tid1->A, and when it would see tid2->A, it would not consider these state equivalent. Relax scalar ID equivalence by treating rold->id == 0 as "independent": if the old state did not rely on any ID relationships for a register, then any ID/linking present in the current state only adds constraints and is always safe to accept for pruning. Implement this by returning true immediately in check_scalar_ids() when old_id == 0. Maintain correctness for the opposite direction (old_id != 0 && cur_id == 0) by still allocating a temporary ID for cur_id == 0. This avoids incorrectly allowing multiple independent current registers (id==0) to satisfy a single linked old ID during mapping. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20260203165102.2302462-5-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit a24d6f955d4f68a98daa905a7dd090675a50eca8 Author: Puranjay Mohan Date: Tue Feb 3 08:50:59 2026 -0800 bpf: Relax maybe_widen_reg() constraints The maybe_widen_reg() function widens imprecise scalar registers to unknown when their values differ between the cached and current states. Previously, it used regs_exact() which also compared register IDs via check_ids(), requiring registers to have matching IDs (or mapped IDs) to be considered exact. For scalar widening purposes, what matters is whether the value tracking (bounds, tnum, var_off) is the same, not whether the IDs match. Two scalars with identical value constraints but different IDs represent the same abstract value and don't need to be widened. Introduce scalars_exact_for_widen() that only compares the value-tracking portion of bpf_reg_state (fields before 'id'). This allows the verifier to preserve more scalar value information during state merging when IDs differ but actual tracked values are identical, reducing unnecessary widening and potentially improving verification precision. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20260203165102.2302462-4-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit b2a0aa3a87396483b468b7c81be2fddb29171d74 Author: Puranjay Mohan Date: Tue Feb 3 08:50:58 2026 -0800 bpf: Clear singular ids for scalars in is_state_visited() The verifier assigns ids to scalar registers/stack slots when they are linked through a mov or stack spill/fill instruction. These ids are later used to propagate newly found bounds from one register to all registers that share the same id. The verifier also compares the ids of these registers in current state and cached state when making pruning decisions. When an ID becomes singular (i.e., only a single register or stack slot has that ID), it can no longer participate in bounds propagation. During comparisons between current and cached states for pruning decisions, however, such stale IDs can prevent pruning of otherwise equivalent states. Find and clear all singular ids before caching a state in is_state_visited(). struct bpf_idset which is currently unused has been repurposed for this use case. Acked-by: Eduard Zingerman Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20260203165102.2302462-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 3cd5c890652ba1f0682adc291b5446245259b692 Author: Puranjay Mohan Date: Tue Feb 3 08:50:57 2026 -0800 bpf: Let the verifier assign ids on stack fills The next commit will allow clearing of scalar ids if no other register/stack slot has that id. This is because if only one register has a unique id, it can't participate in bounds propagation and is equivalent to having no id. But if the id of a stack slot is cleared by clear_singular_ids() in the next commit, reading that stack slot into a register will not establish a link because the stack slot's id is cleared. This can happen in a situation where a register is spilled and later loses its id due to a multiply operation (for example) and then the stack slot's id becomes singular and can be cleared. Make sure that scalar stack slots have an id before we read them into a register. Acked-by: Eduard Zingerman Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20260203165102.2302462-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 7be03eae1fdb690dff8f102a7306ca61b55a810c Author: Robert Richter Date: Wed Jan 14 17:48:25 2026 +0100 cxl/acpi: Prepare use of EFI runtime services In order to use EFI runtime services, esp. ACPI PRM which uses the efi_rts_wq workqueue, initialize EFI before CXL ACPI. There is a subsys_initcall order dependency if driver is builtin: subsys_initcall(cxl_acpi_init); subsys_initcall(efisubsys_init); Prevent the efi_rts_wq workqueue being used by cxl_acpi_init() before its allocation. Use subsys_initcall_sync(cxl_acpi_init) to always run efisubsys_init() first. Reported-by: Gregory Price Tested-by: Joshua Hahn Reviewed-by: Joshua Hahn Reviewed-by: Gregory Price Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Gregory Price Signed-off-by: Robert Richter Reviewed-by: Dave Jiang > --- Link: https://patch.msgid.link/20260114164837.1076338-10-rrichter@amd.com Signed-off-by: Dave Jiang commit a31af41115b0f7021a86f5439cb8720b93314f91 Author: Robert Richter Date: Wed Jan 14 17:48:24 2026 +0100 cxl: Introduce callback for HPA address ranges translation Introduce a callback to translate an endpoint's HPA range to the address range of the root port which is the System Physical Address (SPA) range used by a region. The callback can be set if a platform needs to handle address translation. The callback is attached to the root port. An endpoint's root port can easily be determined in the PCI hierarchy without any CXL specific knowledge. This allows the early use of address translation for CXL enumeration. Address translation is esp. needed for the detection of the root decoders. Thus, the callback is embedded in struct cxl_root_ops instead of struct cxl_rd_ops. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Tested-by: Gregory Price Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260114164837.1076338-9-rrichter@amd.com Signed-off-by: Dave Jiang commit d01149bbe76d81d360ed24853d5247fcaad873e4 Author: Robert Richter Date: Wed Jan 14 17:48:23 2026 +0100 cxl/region: Use region data to get the root decoder To find a region's root decoder, the endpoint's HPA range is used to search the matching decoder by its range. With address translation the endpoint decoder's range is in a different address space and thus cannot be used to determine the root decoder. The region parameters are encapsulated within struct cxl_region_context and may include the translated Host Physical Address (HPA) range. Use this context to identify the root decoder rather than relying on the endpoint. Modify cxl_find_root_decoder() and add the region context as parameter. Rename this function to get_cxl_root_decoder() as a counterpart to put_cxl_root_decoder(). Simplify the implementation by removing function cxl_port_find_switch_decode(). The function is unnecessary because it is not referenced or utilized elsewhere in the code. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Tested-by: Gregory Price Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260114164837.1076338-8-rrichter@amd.com Signed-off-by: Dave Jiang commit 1fd6c38fc5e18a9904bc1bd447bb4c2708f0292d Author: Robert Richter Date: Wed Jan 14 17:48:22 2026 +0100 cxl/region: Add @hpa_range argument to function cxl_calc_interleave_pos() cxl_calc_interleave_pos() uses the endpoint decoder's HPA range to determine its interleaving position. This requires the endpoint decoders to be an SPA, which is not the case for systems that need address translation. Add a separate @hpa_range argument to function cxl_calc_interleave_pos() to specify the address range. Now it is possible to pass the SPA translated address range of an endpoint decoder to function cxl_calc_interleave_pos(). Refactor only, no functional changes. Patch is a prerequisite to implement address translation. Reviewed-by: Gregory Price Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Tested-by: Gregory Price Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260114164837.1076338-7-rrichter@amd.com Signed-off-by: Dave Jiang commit bc01fd5019faa14f4253de6f6abcae6d957c3a12 Author: Robert Richter Date: Wed Jan 14 17:48:21 2026 +0100 cxl/region: Separate region parameter setup and region construction To construct a region, the region parameters such as address range and interleaving config need to be determined. This is done while constructing the region by inspecting the endpoint decoder configuration. The endpoint decoder is passed as a function argument. With address translation the endpoint decoder data is no longer sufficient to extract the region parameters as some of the information is obtained using other methods such as using firmware calls. In a first step, separate code to determine the region parameters from the region construction. Temporarily store all the data to create the region in the new struct cxl_region_context. Once the region data is determined and struct cxl_region_context is filled, construct the region. Patch is a prerequisite to implement address translation. The code separation helps to later extend it to determine region parameters using other methods as needed, esp. to support address translation. Reviewed-by: Gregory Price Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Tested-by: Gregory Price Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260114164837.1076338-6-rrichter@amd.com Signed-off-by: Dave Jiang commit 3e422caa40d0d4bf25ece6e82418ce642d56524a Author: Robert Richter Date: Wed Jan 14 17:48:20 2026 +0100 cxl: Simplify cxl_root_ops allocation and handling A root port's callback handlers are collected in struct cxl_root_ops. The structure is dynamically allocated, though it contains only a single pointer in it. This also requires to check two pointers to check for the existance of a callback. Simplify the allocation, release and handler check by embedding the ops statically in struct cxl_root. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260114164837.1076338-5-rrichter@amd.com Signed-off-by: Dave Jiang commit 98ceb1a42dab91c6dcf95d1d424cba61b0f9bc5c Author: Robert Richter Date: Wed Jan 14 17:48:19 2026 +0100 cxl/region: Store HPA range in struct cxl_region Each region has a known host physical address (HPA) range it is assigned to. Endpoint decoders assigned to a region share the same HPA range. The region's address range is the system's physical address (SPA) range. Endpoint decoders in systems that need address translation use HPAs which are not SPAs. To make the SPA range accessible to the endpoint decoders, store and track the region's SPA range in struct cxl_region. Introduce the @hpa_range member to the struct. Now, the SPA range of an endpoint decoder can be determined based on its assigned region. Patch is a prerequisite to implement address translation which uses struct cxl_region to store all relevant region and interleaving parameters. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Gregory Price Reviewed-by: Alison Schofield Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260114164837.1076338-4-rrichter@amd.com Signed-off-by: Dave Jiang commit 4fe82279580d10ba63c1461ff404f2c6c82ff1d5 Author: Robert Richter Date: Wed Jan 14 17:48:18 2026 +0100 cxl/region: Store root decoder in struct cxl_region A region is always bound to a root decoder. The region's associated root decoder is often needed. Add it to struct cxl_region. This simplifies the code by removing dynamic lookups and the root decoder argument from the function argument list where possible. Patch is a prerequisite to implement address translation which uses struct cxl_region to store all relevant region and interleaving parameters. It changes the argument list of __construct_region() in preparation of adding a context argument. Additionally the arg list of cxl_region_attach_position() is simplified and the use of to_cxl_root_decoder() removed, which always reconstructs and checks the pointer. The pointer never changes and is frequently used. Code becomes more readable as this amphazises the binding between both objects. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Gregory Price Reviewed-by: Alison Schofield Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260114164837.1076338-3-rrichter@amd.com Signed-off-by: Dave Jiang commit df8b57c34b47e0acbe1133ca58ac75ec3c56771f Author: Robert Richter Date: Wed Jan 14 17:48:17 2026 +0100 cxl/region: Rename misleading variable name @hpa to @hpa_range @hpa is actually a @hpa_range, rename variables accordingly. Reviewed-by: Gregory Price Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260114164837.1076338-2-rrichter@amd.com Signed-off-by: Dave Jiang commit 0692afe940e0959dd2fa74539622f16cf3709433 Author: Robert Richter Date: Tue Feb 3 18:36:00 2026 +0100 Documentation/driver-api/cxl: ACPI PRM Address Translation Support and AMD Zen5 enablement This adds a convention document for the following patch series: cxl: ACPI PRM Address Translation Support and AMD Zen5 enablement Version 7 and later: https://lore.kernel.org/linux-cxl/20251114213931.30754-1-rrichter@amd.com/ Link: https://lore.kernel.org/linux-cxl/20251114213931.30754-1-rrichter@amd.com/ Reviewed-by: Gregory Price Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Dan Williams Acked-by: Dan Williams Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260203173604.1440334-3-rrichter@amd.com Signed-off-by: Dave Jiang commit e6efbd2995c1c14fbf53e2b63056eeeb30b034b1 Author: Robert Richter Date: Tue Feb 3 18:35:59 2026 +0100 cxl, doc: Moving conventions in separate files Moving conventions in separate files. Cc: Jonathan Corbet Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260203173604.1440334-2-rrichter@amd.com Signed-off-by: Dave Jiang commit 72971184a1eed005b48babe226673d5496bcd959 Author: Robert Richter Date: Tue Feb 3 18:35:58 2026 +0100 cxl, doc: Remove isonum.txt inclusion This patch removes the line to include:: . From Jon: "This include has been cargo-culted around the docs...the only real use of it is to write |copy| rather than ©, but these docs don't even do that. It can be taken out." Cc: Jonathan Corbet Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260203173604.1440334-1-rrichter@amd.com Signed-off-by: Dave Jiang commit b853007fdcdd64b49601a993c2b30c28279ae15d Author: Lizhi Hou Date: Mon Feb 2 13:24:50 2026 -0800 accel/amdxdna: Remove hardware context status One newly supported command does not require hardware context configuration to be performed upfront. As a result, checking hardware context status causes this command to fail incorrectly. Remove hardware context status handling entirely. For other commands, if userspace submits a request without configuring the hardware context first, the firmware will report an error or time out as appropriate. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260202212450.2681273-1-lizhi.hou@amd.com commit 26aa5295010ffaebcf8f1991c53fa7cf2ee1b20d Author: Peng Fan Date: Thu Jan 29 09:44:48 2026 +0800 remoteproc: imx_rproc: Fix invalid loaded resource table detection imx_rproc_elf_find_loaded_rsc_table() may incorrectly report a loaded resource table even when the current firmware does not provide one. When the device tree contains a "rsc-table" entry, priv->rsc_table is non-NULL and denotes where a resource table would be located if one is present in memory. However, when the current firmware has no resource table, rproc->table_ptr is NULL. The function still returns priv->rsc_table, and the remoteproc core interprets this as a valid loaded resource table. Fix this by returning NULL from imx_rproc_elf_find_loaded_rsc_table() when there is no resource table for the current firmware (i.e. when rproc->table_ptr is NULL). This aligns the function's semantics with the remoteproc core: a loaded resource table is only reported when a valid table_ptr exists. With this change, starting firmware without a resource table no longer triggers a crash. Fixes: e954a1bd1610 ("remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table") Cc: stable@vger.kernel.org Signed-off-by: Peng Fan Acked-by: Daniel Baluta Link: https://lore.kernel.org/r/20260129-imx-rproc-fix-v3-1-fc4e41e6e750@nxp.com Signed-off-by: Mathieu Poirier commit 2e171ab29f916455a49274a2042bac4a4b35570e Author: Pnina Feder Date: Thu Jan 22 12:24:57 2026 +0200 panic: add panic_force_cpu= parameter to redirect panic to a specific CPU Some platforms require panic handling to execute on a specific CPU for crash dump to work reliably. This can be due to firmware limitations, interrupt routing constraints, or platform-specific requirements where only a single CPU is able to safely enter the crash kernel. Add the panic_force_cpu= kernel command-line parameter to redirect panic execution to a designated CPU. When the parameter is provided, the CPU that initially triggers panic forwards the panic context to the target CPU via IPI, which then proceeds with the normal panic and kexec flow. The IPI delivery is implemented as a weak function (panic_smp_redirect_cpu) so architectures with NMI support can override it for more reliable delivery. If the specified CPU is invalid, offline, or a panic is already in progress on another CPU, the redirection is skipped and panic continues on the current CPU. [pnina.feder@mobileye.com: fix unused variable warning] Link: https://lkml.kernel.org/r/20260126122618.2967950-1-pnina.feder@mobileye.com Link: https://lkml.kernel.org/r/20260122102457.1154599-1-pnina.feder@mobileye.com Signed-off-by: Pnina Feder Reviewed-by: Petr Mladek Cc: Baoquan He Cc: Ingo Molnar Cc: Jonathan Corbet Cc: Mel Gorman Cc: Peter Zijlstra Cc: Sergey Senozhatsky Cc: Steven Rostedt Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit f3951e93d4fe9cc85128dc38915877ff6ef633db Author: Oleg Nesterov Date: Sun Jan 25 17:08:00 2026 +0100 netclassid: use thread_group_leader(p) in update_classid_task() Cleanup and preparation to simplify planned future changes. Link: https://lkml.kernel.org/r/aXY_4NSP094-Cf-2@redhat.com Signed-off-by: Oleg Nesterov Cc: Alice Ryhl Cc: Boris Brezillon Cc: Christan König Cc: David S. Miller Cc: Eric Dumazet Cc: Felix Kuehling Cc: Jakub Kicinski Cc: Leon Romanovsky Cc: Paolo Abeni Cc: Simon Horman Cc: Steven Price Signed-off-by: Andrew Morton commit 6fd390e2bccfd82e6e2932acb21299938f8981bb Author: Oleg Nesterov Date: Sun Jan 25 17:07:52 2026 +0100 RDMA/umem: don't abuse current->group_leader Cleanup and preparation to simplify the next changes. Use current->tgid instead of current->group_leader->pid. Link: https://lkml.kernel.org/r/aXY_2JIhCeGAYC0r@redhat.com Signed-off-by: Oleg Nesterov Acked-by: Leon Romanovsky Cc: Alice Ryhl Cc: Boris Brezillon Cc: Christan König Cc: David S. Miller Cc: Eric Dumazet Cc: Felix Kuehling Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Steven Price Signed-off-by: Andrew Morton commit 05f8f36d0b836006a1f7a7d233789c8c80ea89df Author: Oleg Nesterov Date: Sun Jan 25 17:07:44 2026 +0100 drm/pan*: don't abuse current->group_leader Cleanup and preparation to simplify the next changes. Use current->tgid instead of current->group_leader->pid. Link: https://lkml.kernel.org/r/aXY_0MrQBZWKbbmA@redhat.com Signed-off-by: Oleg Nesterov Acked-by: Boris Brezillon Acked-by: Steven Price Cc: Alice Ryhl Cc: Christan König Cc: David S. Miller Cc: Eric Dumazet Cc: Felix Kuehling Cc: Jakub Kicinski Cc: Leon Romanovsky Cc: Paolo Abeni Cc: Simon Horman Signed-off-by: Andrew Morton commit a87da7a9fa7b5c39b01d7fa30415c9211e775f2e Author: Oleg Nesterov Date: Sun Jan 25 17:07:36 2026 +0100 drm/amd: kill the outdated "Only the pthreads threading model is supported" checks Nowadays task->group_leader->mm != task->mm is only possible if a) task is not a group leader and b) task->group_leader->mm == NULL because task->group_leader has already exited using sys_exit(). I don't think that drm/amd tries to detect/nack this case. Link: https://lkml.kernel.org/r/aXY_yLVHd63UlWtm@redhat.com Signed-off-by: Oleg Nesterov Reviewed-by: Christan König Acked-by: Felix Kuehling Cc: Alice Ryhl Cc: Boris Brezillon Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Leon Romanovsky Cc: Paolo Abeni Cc: Simon Horman Cc: Steven Price Signed-off-by: Andrew Morton commit 7d08e0916a59e006c262dcd2f7168d0336c80265 Author: Oleg Nesterov Date: Sun Jan 25 17:07:28 2026 +0100 drm/amdgpu: don't abuse current->group_leader Cleanup and preparation to simplify the next changes. - Use current->tgid instead of current->group_leader->pid - Use get_task_pid(current, PIDTYPE_TGID) instead of get_task_pid(current->group_leader, PIDTYPE_PID) Link: https://lkml.kernel.org/r/aXY_wKewzV5lCa5I@redhat.com Signed-off-by: Oleg Nesterov Acked-by: Felix Kuehling Cc: Alice Ryhl Cc: Boris Brezillon Cc: Christan König Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Leon Romanovsky Cc: Paolo Abeni Cc: Simon Horman Cc: Steven Price Signed-off-by: Andrew Morton commit a170919d1b670f531f31192bef4dff08be636a7c Author: Oleg Nesterov Date: Sun Jan 25 17:07:20 2026 +0100 android/binder: use same_thread_group(proc->tsk, current) in binder_mmap() With or without this change the checked condition can be falsely true if proc->tsk execs, but this is fine: binder_alloc_mmap_handler() checks vma->vm_mm == alloc->mm. Link: https://lkml.kernel.org/r/aXY_uPYyUg4rwNOg@redhat.com Signed-off-by: Oleg Nesterov Reviewed-by: Alice Ryhl Cc: Boris Brezillon Cc: Christan König Cc: David S. Miller Cc: Eric Dumazet Cc: Felix Kuehling Cc: Jakub Kicinski Cc: Leon Romanovsky Cc: Paolo Abeni Cc: Simon Horman Cc: Steven Price Signed-off-by: Andrew Morton commit 33caa19f4b318378bf54692b30724f442c981dad Author: Oleg Nesterov Date: Sun Jan 25 17:07:11 2026 +0100 android/binder: don't abuse current->group_leader Patch series "don't abuse task_struct.group_leader", v2. This series removes the usage of ->group_leader when it is "obviously unnecessary". I am going to move ->group_leader from task_struct to signal_struct or at least add the new task_group_leader() helper. So I will send more tree-wide changes on top of this series. This patch (of 7): Cleanup and preparation to simplify the next changes. - Use current->tgid instead of current->group_leader->pid - Use the value returned by get_task_struct() to initialize proc->tsk Link: https://lkml.kernel.org/r/aXY_h8i78n6yD9JY@redhat.com Link: https://lkml.kernel.org/r/aXY_ryGDwdygl1Tv@redhat.com Signed-off-by: Oleg Nesterov Reviewed-by: Alice Ryhl Cc: Boris Brezillon Cc: Christan König Cc: David S. Miller Cc: Eric Dumazet Cc: Felix Kuehling Cc: Jakub Kicinski Cc: Leon Romanovsky Cc: Paolo Abeni Cc: Simon Horman Cc: Steven Price Signed-off-by: Andrew Morton commit 0f8a217670b6e3c28afff5cdf5985190633f62e1 Author: Chen Ni Date: Mon Feb 2 09:36:33 2026 +0800 mtd: spinand: winbond: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Signed-off-by: Miquel Raynal commit 875382759298650c96192bf2c12e2d1e4575de92 Author: Khairul Anuar Romli Date: Sat Jan 31 11:26:11 2026 -0600 dt-bindings: mtd: cdns,hp-nfc: Add dma-coherent property The Cadence HP NAND Flash Controller on supports DMA transactions through a coherent interconnect. In previous generations SoC (Stratix10 and Agilex) the interconnect was non-coherent, hence there is no need for dma-coherent property to be presence. In Agilex 5, the architecture has changed. It introduced a coherent interconnect that supports cache-coherent DMA. Signed-off-by: Khairul Anuar Romli Reviewed-by: Rob Herring (Arm) Signed-off-by: Dinh Nguyen Signed-off-by: Miquel Raynal commit fe6d29b082d49df336ebb92226a3c004ae9e3222 Author: Liu Ying Date: Fri Jan 23 17:22:17 2026 +0800 drm/bridge: imx8qxp-pixel-combiner: Fix bailout for imx8qxp_pc_bridge_probe() In case the channel0 is unavailable and bailing out from free_child is needed when we fail to add a DRM bridge for the available channel1, pointer pc->ch[0] in the bailout path would be NULL and it would be dereferenced as pc->ch[0]->bridge.next_bridge. Fix this by checking pc->ch[0] before dereferencing it. Fixes: ae754f049ce1 ("drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge") Fixes: 99764593528f ("drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API") Signed-off-by: Liu Ying Reviewed-by: Luca Ceresoli Reviewed-by: Frank Li Link: https://patch.msgid.link/20260123-imx8qxp-drm-bridge-fixes-v1-3-8bb85ada5866@nxp.com Signed-off-by: Luca Ceresoli commit 2c04718edcd5e1ac8fed9a0f8d0620e8bc94014d Author: Yu Kuai Date: Tue Feb 3 16:19:49 2026 +0800 blk-mq: add documentation for new queue attribute async_dpeth Explain the attribute and the default value in different case. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 2110858c5178176d0d535b7762b20cb9c0d03146 Author: Yu Kuai Date: Tue Feb 3 16:19:48 2026 +0800 block, bfq: convert to use request_queue->async_depth The default limits is unchanged, and user can configure async_depth now. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 988bb1b9ededab9aed83df8c1f5be0232b71ded3 Author: Yu Kuai Date: Tue Feb 3 16:19:47 2026 +0800 mq-deadline: covert to use request_queue->async_depth In downstream kernel, we test with mq-deadline with many fio workloads, and we found a performance regression after commit 39823b47bbd4 ("block/mq-deadline: Fix the tag reservation code") with following test: [global] rw=randread direct=1 ramp_time=1 ioengine=libaio iodepth=1024 numjobs=24 bs=1024k group_reporting=1 runtime=60 [job1] filename=/dev/sda Root cause is that mq-deadline now support configuring async_depth, although the default value is nr_request, however the minimal value is 1, hence min_shallow_depth is set to 1, causing wake_batch to be 1. For consequence, sbitmap_queue will be waken up after each IO instead of 8 IO. In this test case, sda is HDD and max_sectors is 128k, hence each submitted 1M io will be splited into 8 sequential 128k requests, however due to there are 24 jobs and total tags are exhausted, the 8 requests are unlikely to be dispatched sequentially, and changing wake_batch to 1 will make this much worse, accounting blktrace D stage, the percentage of sequential io is decreased from 8% to 0.8%. Fix this problem by converting to request_queue->async_depth, where min_shallow_depth is set each time async_depth is updated. Noted elevator attribute async_depth is now removed, queue attribute with the same name is used instead. Fixes: 39823b47bbd4 ("block/mq-deadline: Fix the tag reservation code") Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit 8cbe62f4d8c37b74947569c7b874848f39f09a22 Author: Yu Kuai Date: Tue Feb 3 16:19:46 2026 +0800 kyber: covert to use request_queue->async_depth Instead of the internal async_depth, remove kqd->async_depth and related helpers. Noted elevator attribute async_depth is now removed, queue attribute with the same name is used instead. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit f98afe4f31bb8b07fea318606c08030c2049587e Author: Yu Kuai Date: Tue Feb 3 16:19:45 2026 +0800 blk-mq: add a new queue sysfs attribute async_depth Add a new field async_depth to request_queue and related APIs, this is currently not used, following patches will convert elevators to use this instead of internal async_depth. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit cf02d7d41b064af3e2c3a3a1ea9042a5b565b0d8 Author: Yu Kuai Date: Tue Feb 3 16:19:44 2026 +0800 blk-mq: factor out a helper blk_mq_limit_depth() There are no functional changes, just make code cleaner. Signed-off-by: Yu Kuai Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 1db61b0afdd7e8aa9289c423fdff002603b520b5 Author: Yu Kuai Date: Tue Feb 3 16:19:43 2026 +0800 blk-mq-sched: unify elevators checking for async requests bfq and mq-deadline consider sync writes as async requests and only reserve tags for sync reads by async_depth, however, kyber doesn't consider sync writes as async requests for now. Consider the case there are lots of dirty pages, and user use fsync to flush dirty pages. In this case sched_tags can be exhausted by sync writes and sync reads can stuck waiting for tag. Hence let kyber follow what mq-deadline and bfq did, and unify async requests checking for all elevators. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 9fc7900b14727d39457bd3724f26e6e3faca3efd Author: Yu Kuai Date: Tue Feb 3 16:19:42 2026 +0800 block: convert nr_requests to unsigned int This value represents the number of requests for elevator tags, or drivers tags if elevator is none. The max value for elevator tags is 2048, and in drivers at most 16 bits is used for tag. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit b5c9bcde61b8cabf3b4194902374e62b8c8a4d41 Author: Ian Rogers Date: Fri Jan 30 15:34:37 2026 -0800 perf capstone: Support for dlopen-ing libcapstone.so If perf is built with LIBCAPSTONE_DLOPEN=1, support dlopen-ing libcapstone.so and then calling the necessary functions by looking them up using dlsym. The types come from capstone.h which means the libcapstone feature check needs to pass, and NO_CAPSTONE=1 hasn't been defined. This will cause the definition of HAVE_LIBCAPSTONE_SUPPORT. Earlier versions of this code tried to declare the necessary capstone.h constants and structs, but they weren't stable and caused breakages across libcapstone releases. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 169343cc8ff2bd59758760d867bd26adae866a2b Author: Ian Rogers Date: Fri Jan 30 15:35:39 2026 -0800 perf build: Remove NO_LIBCAP that controls nothing Using libcap was removed in commit e25ebda78e230283 ("perf cap: Tidy up and improve capability testing") and improve capability testing"), however, some build documentation and a use of the NO_LIBCAP=1 were lingering. Remove these left over bits. Fixes: e25ebda78e230283 ("perf cap: Tidy up and improve capability testing") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit e3474301824926ecce1d45f2ede7ecdda9a35840 Author: Samuel Dionne-Riel Date: Mon Feb 2 20:01:33 2026 -0500 ALSA: hda/realtek: Add quirk for Minisforum V3 SE First, adding a generic quirk for Bass speaker DAC avoidance. This pattern (re-routing the bass speakers off of a DAC without volume control) seems common enough that having a "model" to match against and quickly use to verify may be worthwhile. The alc285_fixup_thinkpad_x1_gen7 routing was selected, amongst the different options, as it should allow tuning the ratio between both speaker set. The routing was verified using `hda-verb`, and picking either 0x00 or 0x01. Either routing made the volume of the bass speakers controllable. hda-verb /dev/snd/hwC1D0 0x17 SET_CONNECT_SEL 0x01 This likely will apply for the Minisforum V3, though there isn't a lot of information to confirm whether or not the identifiers are the same. This was verified on the Minisforum V3 SE, and the root cause (the bass speakers routing) was found out by using pink noise, and playing with the mixers. Signed-off-by: Samuel Dionne-Riel Link: https://patch.msgid.link/20260203010132.1981419-2-samuel@dionne-riel.com Signed-off-by: Takashi Iwai commit fa39ec4f89f2637ed1cdbcde3656825951787668 Author: Frederic Weisbecker Date: Thu Jul 17 17:58:27 2025 +0200 doc: Add housekeeping documentation Signed-off-by: Frederic Weisbecker Acked-by: Waiman Long Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Waiman Long commit d279138a2788ac22cff23710b2d4a3ebd160c09d Author: Frederic Weisbecker Date: Tue Aug 26 17:16:48 2025 +0200 kthread: Document kthread_affine_preferred() The documentation of this new API has been overlooked during its introduction. Fill the gap. Signed-off-by: Frederic Weisbecker Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Waiman Long commit 60ba9c38b9316efa3eb1c8a927bee6f8a4f101a5 Author: Frederic Weisbecker Date: Wed Jun 18 16:52:04 2025 +0200 kthread: Comment on the purpose and placement of kthread_affine_node() call It may not appear obvious why kthread_affine_node() is not called before the kthread creation completion instead of after the first wake-up. The reason is that kthread_affine_node() applies a default affinity behaviour that only takes place if no affinity preference have already been passed by the kthread creation call site. Add a comment to clarify that. Reported-by: Peter Zijlstra Signed-off-by: Frederic Weisbecker Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit e894f633980804a528a2d6996c4ea651df631632 Author: Frederic Weisbecker Date: Wed Jun 4 14:02:40 2025 +0200 kthread: Honour kthreads preferred affinity after cpuset changes When cpuset isolated partitions get updated, unbound kthreads get indifferently affine to all non isolated CPUs, regardless of their individual affinity preferences. For example kswapd is a per-node kthread that prefers to be affine to the node it refers to. Whenever an isolated partition is created, updated or deleted, kswapd's node affinity is going to be broken if any CPU in the related node is not isolated because kswapd will be affine globally. Fix this with letting the consolidated kthread managed affinity code do the affinity update on behalf of cpuset. Signed-off-by: Frederic Weisbecker Reviewed-by: Waiman Long Cc: Michal Koutný Cc: Ingo Molnar Cc: Johannes Weiner Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: cgroups@vger.kernel.org commit 79c0abaf06fca6e715cf792daed580542fc4a2c4 Author: Frederic Weisbecker Date: Thu Jul 24 23:38:48 2025 +0200 sched/arm64: Move fallback task cpumask to HK_TYPE_DOMAIN When none of the allowed CPUs of a task are online, it gets migrated to the fallback cpumask which is all the non nohz_full CPUs. However just like nohz_full CPUs, domain isolated CPUs don't want to be disturbed by tasks that have lost their CPU affinities. And since nohz_full rely on domain isolation to work correctly, the housekeeping mask of domain isolated CPUs should always be a subset of the housekeeping mask of nohz_full CPUs (there can be CPUs that are domain isolated but not nohz_full, OTOH there shouldn't be nohz_full CPUs that are not domain isolated): HK_TYPE_DOMAIN & HK_TYPE_KERNEL_NOISE == HK_TYPE_DOMAIN Therefore use HK_TYPE_DOMAIN as the appropriate fallback target for tasks. Note that cpuset isolated partitions are not supported on those systems and may result in undefined behaviour. Signed-off-by: Frederic Weisbecker Reviewed-by: Waiman Long Acked-by: Will Deacon Tested-by: Will Deacon Cc: Catalin Marinas Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Waiman Long Cc: Catalin Marinas Cc: linux-arm-kernel@lists.infradead.org commit bf5b0c27fad2626789624deea10f43da499ad740 Author: Frederic Weisbecker Date: Tue Jun 3 21:15:32 2025 +0200 sched: Switch the fallback task allowed cpumask to HK_TYPE_DOMAIN Tasks that have all their allowed CPUs offline don't want their affinity to fallback on either nohz_full CPUs or on domain isolated CPUs. And since nohz_full implies domain isolation, checking the latter is enough to verify both. Therefore exclude domain isolation from fallback task affinity. Signed-off-by: Frederic Weisbecker Acked-by: Waiman Long Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: Catalin Marinas Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org commit 041ee6f3727a5efdc497d0363ab5ffbd98a2c77c Author: Frederic Weisbecker Date: Mon Jun 2 21:21:55 2025 +0200 kthread: Rely on HK_TYPE_DOMAIN for preferred affinity management Unbound kthreads want to run neither on nohz_full CPUs nor on domain isolated CPUs. And since nohz_full implies domain isolation, checking the latter is enough to verify both. Therefore exclude kthreads from domain isolation. Signed-off-by: Frederic Weisbecker Reviewed-by: Waiman Long Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit 92a734606e901cf7af239e3bd3cfb0c3a11d7b5e Author: Frederic Weisbecker Date: Tue Jun 3 16:41:56 2025 +0200 kthread: Include kthreadd to the managed affinity list The unbound kthreads affinity management performed by cpuset is going to be imported to the kthread core code for consolidation purposes. Treat kthreadd just like any other kthread. Signed-off-by: Frederic Weisbecker Reviewed-by: Waiman Long Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit 5564c12385b7a6a2991e31017d12fcef96fa830a Author: Frederic Weisbecker Date: Tue Jun 3 15:30:32 2025 +0200 kthread: Include unbound kthreads in the managed affinity list The managed affinity list currently contains only unbound kthreads that have affinity preferences. Unbound kthreads globally affine by default are outside of the list because their affinity is automatically managed by the scheduler (through the fallback housekeeping mask) and by cpuset. However in order to preserve the preferred affinity of kthreads, cpuset will delegate the isolated partition update propagation to the housekeeping and kthread code. Prepare for that with including all unbound kthreads in the managed affinity list. Signed-off-by: Frederic Weisbecker Reviewed-by: Waiman Long Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit 012fef0e4859d1ffb41f5f7d72b3c61068829e6b Author: Frederic Weisbecker Date: Mon May 12 11:37:11 2025 +0200 kthread: Refine naming of affinity related fields The kthreads preferred affinity related fields use "hotplug" as the base of their naming because the affinity management was initially deemed to deal with CPU hotplug. The scope of this role is going to broaden now and also deal with cpuset isolated partition updates. Switch the naming accordingly. Signed-off-by: Frederic Weisbecker Acked-by: Waiman Long Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit 2f803980988884213de1f1bea0c9dde380d3db84 Author: Frederic Weisbecker Date: Wed Jul 16 16:18:24 2025 +0200 PCI: Remove superfluous HK_TYPE_WQ check It doesn't make sense to use nohz_full without also isolating the related CPUs from the domain topology, either through the use of isolcpus= or cpuset isolated partitions. And now HK_TYPE_DOMAIN includes all kinds of domain isolated CPUs. This means that HK_TYPE_DOMAIN should always be a subset of HK_TYPE_KERNEL_NOISE (of which HK_TYPE_WQ is only an alias). Therefore sane configurations verify: HK_TYPE_KERNEL_NOISE & HK_TYPE_DOMAIN == HK_TYPE_DOMAIN Simplify the PCI probe target election accordingly. Signed-off-by: Frederic Weisbecker Acked-by: Bjorn Helgaas Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: linux-pci@vger.kernel.org commit 1c3329df409b9b50517bf4a1399ed793d277a20c Author: Frederic Weisbecker Date: Mon Jun 2 12:32:32 2025 +0200 sched/isolation: Remove HK_TYPE_TICK test from cpu_is_isolated() It doesn't make sense to use nohz_full without also isolating the related CPUs from the domain topology, either through the use of isolcpus= or cpuset isolated partitions. And now HK_TYPE_DOMAIN includes all kinds of domain isolated CPUs. This means that HK_TYPE_DOMAIN should always be a subset of HK_TYPE_KERNEL_NOISE (of which HK_TYPE_TICK is only an alias). Therefore if a CPU is not HK_TYPE_DOMAIN, it shouldn't be HK_TYPE_KERNEL_NOISE either. Testing the former is then enough. Simplify cpu_is_isolated() accordingly. Signed-off-by: Frederic Weisbecker Acked-by: Waiman Long Cc: Ingo Molnar Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit 6440966067dc078f7b46942b3e2cb5d1035fc0b9 Author: Frederic Weisbecker Date: Wed May 28 18:21:32 2025 +0200 cpuset: Remove cpuset_cpu_is_isolated() The set of cpuset isolated CPUs is now included in HK_TYPE_DOMAIN housekeeping cpumask. There is no usecase left interested in just checking what is isolated by cpuset and not by the isolcpus= kernel boot parameter. Signed-off-by: Frederic Weisbecker Reviewed-by: Waiman Long Cc: "Michal Koutný" Cc: Johannes Weiner Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: cgroups@vger.kernel.org commit 0947d018cf574b6c19d64aa3f67ecd0a5add9e31 Author: Frederic Weisbecker Date: Mon Dec 22 16:22:56 2025 +0100 timers/migration: Remove superfluous cpuset isolation test Cpuset isolated partitions are now included in HK_TYPE_DOMAIN. Testing if a CPU is part of an isolated partition alone is now useless. Remove the superflous test. Signed-off-by: Frederic Weisbecker Reviewed-by: Waiman Long commit f5c145ae4f26c25b853f059f1aa14a46f4e9f1ab Author: Frederic Weisbecker Date: Mon Dec 22 00:55:49 2025 +0100 cpuset: Propagate cpuset isolation update to timers through housekeeping Until now, cpuset would propagate isolated partition changes to timer migration so that unbound timers don't get migrated to isolated CPUs. Since housekeeping now centralizes, synchronize and propagates isolation cpumask changes, perform the work from that subsystem for consolidation and consistency purposes. Signed-off-by: Frederic Weisbecker commit 23f09dcc0a0fa3b4e48516bdea1c90223dfb3d6c Author: Frederic Weisbecker Date: Wed May 28 18:19:23 2025 +0200 cpuset: Propagate cpuset isolation update to workqueue through housekeeping Until now, cpuset would propagate isolated partition changes to workqueues so that unbound workers get properly reaffined. Since housekeeping now centralizes, synchronize and propagates isolation cpumask changes, perform the work from that subsystem for consolidation and consistency purposes. For simplification purpose, the target function is adapted to take the new housekeeping mask instead of the isolated mask. Suggested-by: Tejun Heo Signed-off-by: Frederic Weisbecker Reviewed-by: Waiman Long Acked-by: Tejun Heo Cc: "Michal Koutný" Cc: Ingo Molnar Cc: Johannes Weiner Cc: Lai Jiangshan Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: cgroups@vger.kernel.org commit 29b306c44eb5eefdfa02d6ba1205f479f82fb088 Author: Frederic Weisbecker Date: Tue Sep 30 15:21:33 2025 +0200 PCI: Flush PCI probe workqueue on cpuset isolated partition change The HK_TYPE_DOMAIN housekeeping cpumask is now modifiable at runtime. In order to synchronize against PCI probe works and make sure that no asynchronous probing is still pending or executing on a newly isolated CPU, the housekeeping subsystem must flush the PCI probe works. However the PCI probe works can't be flushed easily since they are queued to the main per-CPU workqueue pool. Solve this with creating a PCI probe-specific pool and provide and use the appropriate flushing API. Signed-off-by: Frederic Weisbecker Acked-by: Bjorn Helgaas Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: linux-pci@vger.kernel.org commit ce84ad5e994aea5d41ff47135a71439ad4f54005 Author: Frederic Weisbecker Date: Fri Jun 13 14:48:31 2025 +0200 sched/isolation: Flush vmstat workqueues on cpuset isolated partition change The HK_TYPE_DOMAIN housekeeping cpumask is now modifiable at runtime. In order to synchronize against vmstat workqueue to make sure that no asynchronous vmstat work is still pending or executing on a newly made isolated CPU, the housekeeping susbsystem must flush the vmstat workqueues. This involves flushing the whole mm_percpu_wq workqueue, shared with LRU drain, introducing here a welcome side effect. Signed-off-by: Frederic Weisbecker Cc: Andrew Morton Cc: Ingo Molnar Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: linux-mm@kvack.org commit b7eb4edcc3b5cd7ffdcbd56fa7a12de41b39424d Author: Frederic Weisbecker Date: Thu Jun 12 15:36:16 2025 +0200 sched/isolation: Flush memcg workqueues on cpuset isolated partition change The HK_TYPE_DOMAIN housekeeping cpumask is now modifiable at runtime. In order to synchronize against memcg workqueue to make sure that no asynchronous draining is still pending or executing on a newly made isolated CPU, the housekeeping susbsystem must flush the memcg workqueues. However the memcg workqueues can't be flushed easily since they are queued to the main per-CPU workqueue pool. Solve this with creating a memcg specific pool and provide and use the appropriate flushing API. Acked-by: Shakeel Butt Signed-off-by: Frederic Weisbecker Cc: Andrew Morton Cc: Ingo Molnar Cc: Johannes Weiner Cc: Marco Crivellari Cc: Michal Hocko Cc: Muchun Song Cc: Peter Zijlstra Cc: Roman Gushchin Cc: Shakeel Butt Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: cgroups@vger.kernel.org Cc: linux-mm@kvack.org commit 03ff7351016983653bab5b38e58529d0e38a28cf Author: Frederic Weisbecker Date: Wed May 28 18:05:32 2025 +0200 cpuset: Update HK_TYPE_DOMAIN cpumask from cpuset Until now, HK_TYPE_DOMAIN used to only include boot defined isolated CPUs passed through isolcpus= boot option. Users interested in also knowing the runtime defined isolated CPUs through cpuset must use different APIs: cpuset_cpu_is_isolated(), cpu_is_isolated(), etc... There are many drawbacks to that approach: 1) Most interested subsystems want to know about all isolated CPUs, not just those defined on boot time. 2) cpuset_cpu_is_isolated() / cpu_is_isolated() are not synchronized with concurrent cpuset changes. 3) Further cpuset modifications are not propagated to subsystems Solve 1) and 2) and centralize all isolated CPUs within the HK_TYPE_DOMAIN housekeeping cpumask. Subsystems can rely on RCU to synchronize against concurrent changes. The propagation mentioned in 3) will be handled in further patches. [Chen Ridong: Fix cpu_hotplug_lock deadlock and use correct static branch API] Signed-off-by: Frederic Weisbecker Reviewed-by: Waiman Long Reviewed-by: Chen Ridong Signed-off-by: Chen Ridong Cc: "Michal Koutný" Cc: Ingo Molnar Cc: Johannes Weiner Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: cgroups@vger.kernel.org commit 27c3a5967f054ab666704cb28f2aeb18ca07cab7 Author: Frederic Weisbecker Date: Tue May 27 15:36:03 2025 +0200 sched/isolation: Convert housekeeping cpumasks to rcu pointers HK_TYPE_DOMAIN's cpumask will soon be made modifiable by cpuset. A synchronization mechanism is then needed to synchronize the updates with the housekeeping cpumask readers. Turn the housekeeping cpumasks into RCU pointers. Once a housekeeping cpumask will be modified, the update side will wait for an RCU grace period and propagate the change to interested subsystem when deemed necessary. Signed-off-by: Frederic Weisbecker Cc: Ingo Molnar Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit a7e546354d9c534dc045ce0cf9ff05d81351a751 Author: Frederic Weisbecker Date: Tue May 27 15:35:14 2025 +0200 cpuset: Provide lockdep check for cpuset lock held cpuset modifies partitions, including isolated, while holding the cpuset mutex. This means that holding the cpuset mutex is safe to synchronize against housekeeping cpumask changes. Provide a lockdep check to validate that. Signed-off-by: Frederic Weisbecker Cc: "Michal Koutný" Cc: Johannes Weiner Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: cgroups@vger.kernel.org Cc: linux-kernel@vger.kernel.org commit 622c508bcf4852ad56ae37bf6f08e9a4e6aa95b2 Author: Frederic Weisbecker Date: Tue May 27 15:33:01 2025 +0200 cpu: Provide lockdep check for CPU hotplug lock write-held cpuset modifies partitions, including isolated, while holding the cpu hotplug lock read-held. This means that write-holding the CPU hotplug lock is safe to synchronize against housekeeping cpumask changes. Provide a lockdep check to validate that. Signed-off-by: Frederic Weisbecker Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Waiman Long Cc: linux-kernel@vger.kernel.org commit b5de34ed87f39fc3f6eb7e7df543317e7efb94a8 Author: Frederic Weisbecker Date: Tue Dec 23 15:12:46 2025 +0100 timers/migration: Prevent from lockdep false positive warning Testing housekeeping_cpu() will soon require that either the RCU "lock" is held or the cpuset mutex. When CPUs get isolated through cpuset, the change is propagated to timer migration such that isolation is also performed from the migration tree. However that propagation is done using workqueue which tests if the target is actually isolated before proceeding. Lockdep doesn't know that the workqueue caller holds cpuset mutex and that it waits for the work, making the housekeeping cpumask read safe. Shut down the future warning by removing this test. It is unecessary beyond hotplug, the workqueue is already targeted towards isolated CPUs. Signed-off-by: Frederic Weisbecker Cc: Gabriele Monaco commit 53c2f9d1b1151a853542b224d78169f68f919ef1 Author: Frederic Weisbecker Date: Thu May 15 16:50:04 2025 +0200 block: Protect against concurrent isolated cpuset change The block subsystem prevents running the workqueue to isolated CPUs, including those defined by cpuset isolated partitions. Since HK_TYPE_DOMAIN will soon contain both and be subject to runtime modifications, synchronize against housekeeping using the relevant lock. For full support of cpuset changes, the block subsystem may need to propagate changes to isolated cpumask through the workqueue in the future. Signed-off-by: Frederic Weisbecker Acked-by: Jens Axboe Cc: Jens Axboe Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: linux-block@vger.kernel.org commit 662ff1aac85480690b16fc429bef7114120cdfdd Author: Frederic Weisbecker Date: Thu May 15 16:28:38 2025 +0200 net: Keep ignoring isolated cpuset change RPS cpumask can be overriden through sysfs/syctl. The boot defined isolated CPUs are then excluded from that cpumask. However HK_TYPE_DOMAIN will soon integrate cpuset isolated CPUs updates and the RPS infrastructure needs more thoughts to be able to propagate such changes and synchronize against them. Keep handling only what was passed through "isolcpus=" for now. Signed-off-by: Frederic Weisbecker Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Marco Crivellari Cc: Michal Hocko Cc: Paolo Abeni Cc: Peter Zijlstra Cc: Simon Horman Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: netdev@vger.kernel.org commit 4a062d33cd0f04a8f0dace86de8ce996a329dede Author: Frederic Weisbecker Date: Wed May 14 16:35:11 2025 +0200 driver core: cpu: Convert /sys/devices/system/cpu/isolated to use HK_TYPE_DOMAIN_BOOT Make sure /sys/devices/system/cpu/isolated only prints what was passed through the isolcpus= parameter before HK_TYPE_DOMAIN will also integrate cpuset isolated partitions. Signed-off-by: Frederic Weisbecker Cc: Danilo Krummrich Cc: Greg Kroah-Hartman Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Rafael J. Wysocki Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit 0f4dfdc17b3c6bf055d5d60cb0c465c09addf04e Author: Frederic Weisbecker Date: Wed May 28 14:18:24 2025 +0200 cpuset: Convert boot_hk_cpus to use HK_TYPE_DOMAIN_BOOT boot_hk_cpus is an ad-hoc copy of HK_TYPE_DOMAIN_BOOT. Remove it and use the official version. Signed-off-by: Frederic Weisbecker Reviewed-by: Phil Auld Reviewed-by: Chen Ridong Reviewed-by: Waiman Long Cc: Johannes Weiner Cc: Marco Crivellari Cc: Michal Hocko Cc: Michal Koutny Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: cgroups@vger.kernel.org commit 4fca0e550d506e1c95504c2d9247bc92bf621bf6 Author: Frederic Weisbecker Date: Mon May 26 13:06:21 2025 +0200 sched/isolation: Save boot defined domain flags HK_TYPE_DOMAIN will soon integrate not only boot defined isolcpus= CPUs but also cpuset isolated partitions. Housekeeping still needs a way to record what was initially passed to isolcpus= in order to keep these CPUs isolated after a cpuset isolated partition is modified or destroyed while containing some of them. Create a new HK_TYPE_DOMAIN_BOOT to keep track of those. Signed-off-by: Frederic Weisbecker Reviewed-by: Phil Auld Reviewed-by: Waiman Long Cc: Ingo Molnar Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit 69e227e45069d613767c3dbd5d6a5570a2dddba8 Author: Frederic Weisbecker Date: Thu May 15 17:25:07 2025 +0200 mm: vmstat: Prepare to protect against concurrent isolated cpuset change The HK_TYPE_DOMAIN housekeeping cpumask will soon be made modifiable at runtime. In order to synchronize against vmstat workqueue to make sure that no asynchronous vmstat work is pending or executing on a newly made isolated CPU, target and queue a vmstat work under the same RCU read side critical section. Whenever housekeeping will update the HK_TYPE_DOMAIN cpumask, a vmstat workqueue flush will also be issued in a further change to make sure that no work remains pending after a CPU has been made isolated. Acked-by: Michal Hocko Signed-off-by: Frederic Weisbecker Cc: Andrew Morton Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long Cc: linux-mm@kvack.org commit 2d05068610a336e0ddc7b090e34b6d9932e6fd90 Author: Frederic Weisbecker Date: Thu May 15 17:10:51 2025 +0200 memcg: Prepare to protect against concurrent isolated cpuset change The HK_TYPE_DOMAIN housekeeping cpumask will soon be made modifiable at runtime. In order to synchronize against memcg workqueue to make sure that no asynchronous draining is pending or executing on a newly made isolated CPU, target and queue a drain work under the same RCU critical section. Whenever housekeeping will update the HK_TYPE_DOMAIN cpumask, a memcg workqueue flush will also be issued in a further change to make sure that no work remains pending after a CPU has been made isolated. Acked-by: Michal Hocko Signed-off-by: Frederic Weisbecker Cc: Andrew Morton Cc: Johannes Weiner Cc: Marco Crivellari Cc: Muchun Song Cc: Peter Zijlstra Cc: Roman Gushchin Cc: Shakeel Butt Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit dedfae78f00960d703badc500422d10e1f12b2bc Author: Mateusz Guzik Date: Tue Feb 3 14:00:31 2026 +0100 fs: add porting notes about readlink_copy() Calling convention has changed in ea382199071931d1 ("vfs: support caching symlink lengths in inodes") Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20260203130032.315177-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit ee4784a83fb21a2d16ebfdf8877fa6f6a1129150 Author: Johannes Thumshirn Date: Tue Feb 3 12:35:28 2026 +0100 block: don't use strcpy to copy blockdev name 0-day bot flagged the use of strcpy() in blk_trace_setup(), because the source buffer can theoretically be bigger than the destination buffer. While none of the current callers pass a string bigger than BLKTRACE_BDEV_SIZE, use strscpy() to prevent eventual future misuse and silence the checker warnings. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202602020718.GUEIRyG9-lkp@intel.com/ Fixes: 113cbd62824a ("blktrace: pass blk_user_trace2 to setup functions") Signed-off-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 667539f6dce27aa7db0a711375f94e14e714a698 Merge: 72163a19093193 f85d9c45f1d48a Author: Paolo Abeni Date: Tue Feb 3 15:13:30 2026 +0100 Merge branch 'accecn-protocol-case-handling-series' Chia-Yu Chang says: ==================== AccECN protocol case handling series Plesae find the v13 AccECN case handling patch series, which covers several excpetional case handling of Accurate ECN spec (RFC9768), adds new identifiers to be used by CC modules, adds ecn_delta into rate_sample, and keeps the ACE counter for computation, etc. This patch series is part of the full AccECN patch series, which is at https://github.com/L4STeam/linux-net-next/commits/upstream_l4steam/ --- Chia-Yu Chang (13): selftests/net: gro: add self-test for TCP CWR flag tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers tcp: disable RFC3168 fallback identifier for CC modules tcp: accecn: handle unexpected AccECN negotiation feedback tcp: accecn: retransmit downgraded SYN in AccECN negotiation tcp: add TCP_SYNACK_RETRANS synack_type tcp: accecn: retransmit SYN/ACK without AccECN option or non-AccECN SYN/ACK tcp: accecn: unset ECT if receive or send ACE=0 in AccECN negotiaion tcp: accecn: fallback outgoing half link to non-AccECN tcp: accecn: detect loss ACK w/ AccECN option and add TCP_ACCECN_OPTION_PERSIST tcp: accecn: add tcpi_ecn_mode and tcpi_option2 in tcp_info tcp: accecn: enable AccECN selftests/net: packetdrill: add TCP Accurate ECN cases Ilpo Järvinen (2): tcp: try to avoid safer when ACKs are thinned gro: flushing when CWR is set negatively affects AccECN Documentation/networking/ip-sysctl.rst | 4 +- .../networking/net_cachelines/tcp_sock.rst | 1 + include/linux/tcp.h | 4 +- include/net/inet_ecn.h | 20 +++- include/net/tcp.h | 32 +++++- include/net/tcp_ecn.h | 103 ++++++++++++------ include/uapi/linux/tcp.h | 26 ++++- net/ipv4/inet_connection_sock.c | 3 + net/ipv4/sysctl_net_ipv4.c | 4 +- net/ipv4/tcp.c | 10 ++ net/ipv4/tcp_cong.c | 5 +- net/ipv4/tcp_input.c | 40 ++++++- net/ipv4/tcp_minisocks.c | 43 +++++--- net/ipv4/tcp_offload.c | 3 +- net/ipv4/tcp_output.c | 34 ++++-- net/ipv4/tcp_timer.c | 3 + tools/testing/selftests/drivers/net/gro.c | 81 ++++++++++---- tools/testing/selftests/drivers/net/gro.py | 3 +- .../tcp_accecn_2nd_data_as_first.pkt | 24 ++++ .../tcp_accecn_2nd_data_as_first_connect.pkt | 30 +++++ .../tcp_accecn_3rd_ack_after_synack_rxmt.pkt | 19 ++++ ..._accecn_3rd_ack_ce_updates_received_ce.pkt | 18 +++ .../tcp_accecn_3rd_ack_lost_data_ce.pkt | 22 ++++ .../net/packetdrill/tcp_accecn_3rd_dups.pkt | 26 +++++ .../tcp_accecn_acc_ecn_disabled.pkt | 13 +++ .../tcp_accecn_accecn_then_notecn_syn.pkt | 28 +++++ .../tcp_accecn_accecn_to_rfc3168.pkt | 18 +++ .../tcp_accecn_client_accecn_options_drop.pkt | 34 ++++++ .../tcp_accecn_client_accecn_options_lost.pkt | 38 +++++++ .../tcp_accecn_clientside_disabled.pkt | 12 ++ ...cecn_close_local_close_then_remote_fin.pkt | 25 +++++ .../tcp_accecn_delivered_2ndlargeack.pkt | 25 +++++ ..._accecn_delivered_falseoverflow_detect.pkt | 31 ++++++ .../tcp_accecn_delivered_largeack.pkt | 24 ++++ .../tcp_accecn_delivered_largeack2.pkt | 25 +++++ .../tcp_accecn_delivered_maxack.pkt | 25 +++++ .../tcp_accecn_delivered_updates.pkt | 70 ++++++++++++ .../net/packetdrill/tcp_accecn_ecn3.pkt | 12 ++ .../tcp_accecn_ecn_field_updates_opt.pkt | 35 ++++++ .../packetdrill/tcp_accecn_ipflags_drop.pkt | 14 +++ .../tcp_accecn_listen_opt_drop.pkt | 16 +++ .../tcp_accecn_multiple_syn_ack_drop.pkt | 28 +++++ .../tcp_accecn_multiple_syn_drop.pkt | 18 +++ .../tcp_accecn_negotiation_bleach.pkt | 23 ++++ .../tcp_accecn_negotiation_connect.pkt | 23 ++++ .../tcp_accecn_negotiation_listen.pkt | 26 +++++ .../tcp_accecn_negotiation_noopt_connect.pkt | 23 ++++ .../tcp_accecn_negotiation_optenable.pkt | 23 ++++ .../tcp_accecn_no_ecn_after_accecn.pkt | 20 ++++ .../net/packetdrill/tcp_accecn_noopt.pkt | 27 +++++ .../net/packetdrill/tcp_accecn_noprogress.pkt | 27 +++++ .../tcp_accecn_notecn_then_accecn_syn.pkt | 28 +++++ .../tcp_accecn_rfc3168_to_fallback.pkt | 18 +++ .../tcp_accecn_rfc3168_to_rfc3168.pkt | 18 +++ .../tcp_accecn_sack_space_grab.pkt | 28 +++++ .../tcp_accecn_sack_space_grab_with_ts.pkt | 39 +++++++ ...tcp_accecn_serverside_accecn_disabled1.pkt | 20 ++++ ...tcp_accecn_serverside_accecn_disabled2.pkt | 20 ++++ .../tcp_accecn_serverside_broken.pkt | 19 ++++ .../tcp_accecn_serverside_ecn_disabled.pkt | 19 ++++ .../tcp_accecn_serverside_only.pkt | 18 +++ ...n_syn_ace_flags_acked_after_retransmit.pkt | 18 +++ .../tcp_accecn_syn_ace_flags_drop.pkt | 16 +++ ...n_ack_ace_flags_acked_after_retransmit.pkt | 27 +++++ .../tcp_accecn_syn_ack_ace_flags_drop.pkt | 26 +++++ .../net/packetdrill/tcp_accecn_syn_ce.pkt | 13 +++ .../net/packetdrill/tcp_accecn_syn_ect0.pkt | 13 +++ .../net/packetdrill/tcp_accecn_syn_ect1.pkt | 13 +++ .../net/packetdrill/tcp_accecn_synack_ce.pkt | 27 +++++ ..._accecn_synack_ce_updates_delivered_ce.pkt | 22 ++++ .../packetdrill/tcp_accecn_synack_ect0.pkt | 24 ++++ .../packetdrill/tcp_accecn_synack_ect1.pkt | 24 ++++ .../packetdrill/tcp_accecn_synack_rexmit.pkt | 15 +++ .../packetdrill/tcp_accecn_synack_rxmt.pkt | 25 +++++ .../packetdrill/tcp_accecn_tsnoprogress.pkt | 26 +++++ .../net/packetdrill/tcp_accecn_tsprogress.pkt | 25 +++++ 76 files changed, 1680 insertions(+), 102 deletions(-) create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_2nd_data_as_first.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_2nd_data_as_first_connect.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_3rd_ack_after_synack_rxmt.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_3rd_ack_ce_updates_received_ce.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_3rd_ack_lost_data_ce.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_3rd_dups.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_acc_ecn_disabled.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_accecn_then_notecn_syn.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_accecn_to_rfc3168.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_client_accecn_options_drop.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_client_accecn_options_lost.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_clientside_disabled.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_close_local_close_then_remote_fin.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_delivered_2ndlargeack.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_delivered_falseoverflow_detect.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_delivered_largeack.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_delivered_largeack2.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_delivered_maxack.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_delivered_updates.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_ecn3.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_ecn_field_updates_opt.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_ipflags_drop.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_listen_opt_drop.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_multiple_syn_ack_drop.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_multiple_syn_drop.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_negotiation_bleach.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_negotiation_connect.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_negotiation_listen.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_negotiation_noopt_connect.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_negotiation_optenable.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_no_ecn_after_accecn.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_noopt.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_noprogress.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_notecn_then_accecn_syn.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_rfc3168_to_fallback.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_rfc3168_to_rfc3168.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_sack_space_grab.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_sack_space_grab_with_ts.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_serverside_accecn_disabled1.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_serverside_accecn_disabled2.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_serverside_broken.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_serverside_ecn_disabled.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_serverside_only.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_syn_ace_flags_acked_after_retransmit.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_syn_ace_flags_drop.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_syn_ack_ace_flags_acked_after_retransmit.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_syn_ack_ace_flags_drop.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_syn_ce.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_syn_ect0.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_syn_ect1.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_synack_ce.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_synack_ce_updates_delivered_ce.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_synack_ect0.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_synack_ect1.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_synack_rexmit.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_synack_rxmt.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_tsnoprogress.pkt create mode 100644 tools/testing/selftests/net/packetdrill/tcp_accecn_tsprogress.pkt ==================== Link: https://patch.msgid.link/20260131222515.8485-1-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit f85d9c45f1d48a146f37cfd3d244aac4157ea390 Author: Chia-Yu Chang Date: Sat Jan 31 23:25:15 2026 +0100 selftests/net: packetdrill: add TCP Accurate ECN cases Linux Accurate ECN test sets using ACE counters and AccECN options to cover several scenarios: Connection teardown, different ACK conditions, counter wrapping, SACK space grabbing, fallback schemes, negotiation retransmission/reorder/loss, AccECN option drop/loss, different handshake reflectors, data with marking, and different sysctl values. The packetdrill used is commit cbe405666c9c8698ac1e72f5e8ffc551216dfa56 of repo: https://github.com/minuscat/packetdrill/tree/upstream_accecn. And corresponding patches are sent to google/packetdrill email list. Signed-off-by: Chia-Yu Chang Co-developed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen Co-developed-by: Neal Cardwell Signed-off-by: Neal Cardwell Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-16-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 8ae3e8e6ceedfb3cf74ca18169c942e073586a39 Author: Chia-Yu Chang Date: Sat Jan 31 23:25:14 2026 +0100 tcp: accecn: enable AccECN Enable Accurate ECN negotiation and request for incoming and outgoing connection by setting sysctl_tcp_ecn: +==============+===========================================+ | | Highest ECN variant (Accurate ECN, ECN, | | tcp_ecn | or no ECN) to be negotiated & requested | | +---------------------+---------------------+ | | Incoming connection | Outgoing connection | +==============+=====================+=====================+ | 0 | No ECN | No ECN | | 1 | ECN | ECN | | 2 | ECN | No ECN | +--------------+---------------------+---------------------+ | 3 | Accurate ECN | Accurate ECN | | 4 | Accurate ECN | ECN | | 5 | Accurate ECN | No ECN | +==============+=====================+=====================+ Refer Documentation/networking/ip-sysctl.rst for more details. Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-15-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 4fa4ac5e584841c0f9b01c2f7dd0c2e3caa8bca0 Author: Chia-Yu Chang Date: Sat Jan 31 23:25:13 2026 +0100 tcp: accecn: add tcpi_ecn_mode and tcpi_option2 in tcp_info Add 2-bit tcpi_ecn_mode feild within tcp_info to indicate which ECN mode is negotiated: ECN_MODE_DISABLED, ECN_MODE_RFC3168, ECN_MODE_ACCECN, or ECN_MODE_PENDING. This is done by utilizing available bits from tcpi_accecn_opt_seen (reduced from 16 bits to 2 bits) and tcpi_accecn_fail_mode (reduced from 16 bits to 4 bits). Also, an extra 24-bit tcpi_options2 field is identified to represent newer options and connection features, as all 8 bits of tcpi_options field have been used. Signed-off-by: Chia-Yu Chang Co-developed-by: Neal Cardwell Signed-off-by: Neal Cardwell Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-14-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 1247fb19cafee6f9fa350ae378e4e1e9965cc253 Author: Chia-Yu Chang Date: Sat Jan 31 23:25:12 2026 +0100 tcp: accecn: detect loss ACK w/ AccECN option and add TCP_ACCECN_OPTION_PERSIST Detect spurious retransmission of a previously sent ACK carrying the AccECN option after the second retransmission. Since this might be caused by the middlebox dropping ACK with options it does not recognize, disable the sending of the AccECN option in all subsequent ACKs. This patch follows Section 3.2.3.2.2 of AccECN spec (RFC9768), and a new field (accecn_opt_sent_w_dsack) is added to indicate that an AccECN option was sent with duplicate SACK info. Also, a new AccECN option sending mode is added to tcp_ecn_option sysctl: (TCP_ECN_OPTION_PERSIST), which ignores the AccECN fallback policy and persistently sends AccECN option once it fits into TCP option space. Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-13-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 2ed661248e2b920f53db61ddfc74bc68ed10c83d Author: Chia-Yu Chang Date: Sat Jan 31 23:25:11 2026 +0100 tcp: accecn: fallback outgoing half link to non-AccECN According to Section 3.2.2.1 of AccECN spec (RFC9768), if the Server is in AccECN mode and in SYN-RCVD state, and if it receives a value of zero on a pure ACK with SYN=0 and no SACK blocks, for the rest of the connection the Server MUST NOT set ECT on outgoing packets and MUST NOT respond to AccECN feedback. Nonetheless, as a Data Receiver it MUST NOT disable AccECN feedback. Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-12-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 4024081feb87fb11ac7bd36d8c397ccdd81ed302 Author: Chia-Yu Chang Date: Sat Jan 31 23:25:10 2026 +0100 tcp: accecn: unset ECT if receive or send ACE=0 in AccECN negotiaion Based on specification: https://tools.ietf.org/id/draft-ietf-tcpm-accurate-ecn-28.txt Based on Section 3.1.5 of AccECN spec (RFC9768), a TCP Server in AccECN mode MUST NOT set ECT on any packet for the rest of the connection, if it has received or sent at least one valid SYN or Acceptable SYN/ACK with (AE,CWR,ECE) = (0,0,0) during the handshake. In addition, a host in AccECN mode that is feeding back the IP-ECN field on a SYN or SYN/ACK MUST feed back the IP-ECN field on the latest valid SYN or acceptable SYN/ACK to arrive. Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-11-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit f326f1f17f3772dae4b37360c639ed6b76fe6354 Author: Chia-Yu Chang Date: Sat Jan 31 23:25:09 2026 +0100 tcp: accecn: retransmit SYN/ACK without AccECN option or non-AccECN SYN/ACK For Accurate ECN, the first SYN/ACK sent by the TCP server shall set the ACE flag (Table 1 of RFC9768) and the AccECN option to complete the capability negotiation. However, if the TCP server needs to retransmit such a SYN/ACK (for example, because it did not receive an ACK acknowledging its SYN/ACK, or received a second SYN requesting AccECN support), the TCP server retransmits the SYN/ACK without the AccECN option. This is because the SYN/ACK may be lost due to congestion, or a middlebox may block the AccECN option. Furthermore, if this retransmission also times out, to expedite connection establishment, the TCP server should retransmit the SYN/ACK with (AE,CWR,ECE) = (0,0,0) and without the AccECN option, while maintaining AccECN feedback mode. This complies with Section 3.2.3.2.2 of the AccECN spec RFC9768. Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-10-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit f1eaea5585e4d193e007d671f0916f4371c72c0b Author: Chia-Yu Chang Date: Sat Jan 31 23:25:08 2026 +0100 tcp: add TCP_SYNACK_RETRANS synack_type Before this patch, retransmitted SYN/ACK did not have a specific synack_type; however, the upcoming patch needs to distinguish between retransmitted and non-retransmitted SYN/ACK for AccECN negotiation to transmit the fallback SYN/ACK during AccECN negotiation. Therefore, this patch introduces a new synack_type (TCP_SYNACK_RETRANS). Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-9-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 3ae62b8b4a4848f745d5ed12f10056cb4e4c81f0 Author: Chia-Yu Chang Date: Sat Jan 31 23:25:07 2026 +0100 tcp: accecn: retransmit downgraded SYN in AccECN negotiation Based on AccECN spec (RFC9768) Section 3.1.4.1, if the sender of an AccECN SYN (the TCP Client) times out before receiving the SYN/ACK, it SHOULD attempt to negotiate the use of AccECN at least one more time by continuing to set all three TCP ECN flags (AE,CWR,ECE) = (1,1,1) on the first retransmitted SYN (using the usual retransmission time-outs). If this first retransmission also fails to be acknowledged, in deployment scenarios where AccECN path traversal might be problematic, the TCP Client SHOULD send subsequent retransmissions of the SYN with the three TCP-ECN flags cleared (AE,CWR,ECE) = (0,0,0). Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-8-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit c5ff6b83715919767f181f13e992b5055812a194 Author: Chia-Yu Chang Date: Sat Jan 31 23:25:06 2026 +0100 tcp: accecn: handle unexpected AccECN negotiation feedback According to Sections 3.1.2 and 3.1.3 of AccECN spec (RFC9768). In Section 3.1.2, it says an AccECN implementation has no need to recognize or support the Server response labelled 'Nonce' or ECN-nonce feedback more generally, as RFC 3540 has been reclassified as Historic. AccECN is compatible with alternative ECN feedback integrity approaches to the nonce. The SYN/ACK labelled 'Nonce' with (AE,CWR,ECE) = (1,0,1) is reserved for future use. A TCP Client (A) that receives such a SYN/ACK follows the procedure for forward compatibility given in Section 3.1.3. Then in Section 3.1.3, it says if a TCP Client has sent a SYN requesting AccECN feedback with (AE,CWR,ECE) = (1,1,1) then receives a SYN/ACK with the currently reserved combination (AE,CWR,ECE) = (1,0,1) but it does not have logic specific to such a combination, the Client MUST enable AccECN mode as if the SYN/ACK onfirmed that the Server supported AccECN and as if it fed back that the IP-ECN field on the SYN had arrived unchanged. Fixes: 3cae34274c79 ("tcp: accecn: AccECN negotiation"). Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-7-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit e68c28f22f46ecfdec3656ae785dd8ccbb4d557d Author: Chia-Yu Chang Date: Sat Jan 31 23:25:05 2026 +0100 tcp: disable RFC3168 fallback identifier for CC modules When AccECN is not successfully negociated for a TCP flow, it defaults fallback to classic ECN (RFC3168). However, L4S service will fallback to non-ECN. This patch enables congestion control module to control whether it should not fallback to classic ECN after unsuccessful AccECN negotiation. A new CA module flag (TCP_CONG_NO_FALLBACK_RFC3168) identifies this behavior expected by the CA. Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-6-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 100f946b8d44b64bc0b8a8c30d283105031c0a77 Author: Chia-Yu Chang Date: Sat Jan 31 23:25:04 2026 +0100 tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers Two flags for congestion control (CC) module are added in this patch related to AccECN negotiation. First, a new flag (TCP_CONG_NEEDS_ACCECN) defines that the CC expects to negotiate AccECN functionality using the ECE, CWR and AE flags in the TCP header. Second, during ECN negotiation, ECT(0) in the IP header is used. This patch enables CC to control whether ECT(0) or ECT(1) should be used on a per-segment basis. A new flag (TCP_CONG_ECT_1_NEGOTIATION) defines the expected ECT value in the IP header by the CA when not-yet initialized for the connection. The detailed AccECN negotiaotn can be found in IETF RFC9768. Co-developed-by: Olivier Tilmans Signed-off-by: Olivier Tilmans Signed-off-by: Ilpo Järvinen Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-5-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 6f74bc8b6e8d0e8218c1342682dadb156603d13e Author: Chia-Yu Chang Date: Sat Jan 31 23:25:03 2026 +0100 selftests/net: gro: add self-test for TCP CWR flag Currently, GRO does not flush packets when the CWR bit is set. A corresponding self-test is being added, in which the CWR flag is set for two consecutive packets, but the first packet with the CWR flag set will not be flushed immediately. +===================+==========+===============+===========+ | Packet id | CWR flag | Payload | Flushing? | +===================+==========+===============+===========+ | 0 | 0 | PAYLOAD_LEN | 0 | | ... | 0 | PAYLOAD_LEN | 1 | +-------------------+----------+---------------+-----------+ | NUM_PACKETS/2 - 1 | 1 | payload_len | 0 | | NUM_PACKETS/2 | 1 | payload_len | 1 | +-------------------+----------+---------------+-----------+ | ... | 0 | PAYLOAD_LEN | 0 | | NUM_PACKETS | 0 | PAYLOAD_LEN | 1 | +===================+==========+===============+===========+ Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-4-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit ab4c8b6f7fcbca7644487e08e76e4e224414bca5 Author: Ilpo Järvinen Date: Sat Jan 31 23:25:02 2026 +0100 gro: flushing when CWR is set negatively affects AccECN As AccECN may keep CWR bit asserted due to different interpretation of the bit, flushing with GRO because of CWR may effectively disable GRO until AccECN counter field changes such that CWR-bit becomes 0. There is no harm done from not immediately forwarding the CWR'ed segment with RFC3168 ECN. Signed-off-by: Ilpo Järvinen Signed-off-by: Chia-Yu Chang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-3-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 7885ce0147401d5f6908ad4da660334031d836b7 Author: Ilpo Järvinen Date: Sat Jan 31 23:25:01 2026 +0100 tcp: try to avoid safer when ACKs are thinned Add newly acked pkts EWMA. When ACK thinning occurs, select between safer and unsafe cep delta in AccECN processing based on it. If the packets ACKed per ACK tends to be large, don't conservatively assume ACE field overflow. This patch uses the existing 2-byte holes in the rx group for new u16 variables withtout creating more holes. Below are the pahole outcomes before and after this patch: [BEFORE THIS PATCH] struct tcp_sock { [...] u32 delivered_ecn_bytes[3]; /* 2744 12 */ /* XXX 4 bytes hole, try to pack */ [...] __cacheline_group_end__tcp_sock_write_rx[0]; /* 2816 0 */ [...] /* size: 3264, cachelines: 51, members: 177 */ } [AFTER THIS PATCH] struct tcp_sock { [...] u32 delivered_ecn_bytes[3]; /* 2744 12 */ u16 pkts_acked_ewma; /* 2756 2 */ /* XXX 2 bytes hole, try to pack */ [...] __cacheline_group_end__tcp_sock_write_rx[0]; /* 2816 0 */ [...] /* size: 3264, cachelines: 51, members: 178 */ } Signed-off-by: Ilpo Järvinen Co-developed-by: Chia-Yu Chang Signed-off-by: Chia-Yu Chang Acked-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131222515.8485-2-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Paolo Abeni commit 72163a19093193e71755d8a2f26b2fdde6aea671 Merge: 4906859dff656f d5f778353fd443 Author: Paolo Abeni Date: Tue Feb 3 15:09:32 2026 +0100 Merge branch 'net-dsa-yt921x-add-dcb-qos-support' David Yang says: ==================== net: dsa: yt921x: Add DCB/QoS support This series add DCB/QoS support to the driver. v5: https://lore.kernel.org/r/20260128215202.2244266-1-mmyangfl@gmail.com v4: https://lore.kernel.org/r/20260127020847.1482724-1-mmyangfl@gmail.com v3: https://lore.kernel.org/r/20260125001328.3784006-1-mmyangfl@gmail.com v2: https://lore.kernel.org/r/20260122194233.2777550-1-mmyangfl@gmail.com v1: https://lore.kernel.org/r/20260119185935.2072685-1-mmyangfl@gmail.com ==================== Link: https://patch.msgid.link/20260131021854.3405036-1-mmyangfl@gmail.com Signed-off-by: Paolo Abeni commit d5f778353fd443efd55069b93f3cd0447cfb9276 Author: David Yang Date: Sat Jan 31 10:18:51 2026 +0800 net: dsa: yt921x: Add DCB/QoS support Set up global DSCP/PCP priority mappings and add related DCB methods. Signed-off-by: David Yang Link: https://patch.msgid.link/20260131021854.3405036-6-mmyangfl@gmail.com Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 95e6bcab3c08e8a717c253631a14cd1a5e46eb8a Author: David Yang Date: Sat Jan 31 10:18:50 2026 +0800 net: dsa: yt921x: Refactor yt921x_chip_setup() yt921x_chip_setup() is already pretty long, and is going to become longer. Split it into parts. Signed-off-by: David Yang Link: https://patch.msgid.link/20260131021854.3405036-5-mmyangfl@gmail.com Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 75b85703fd48bc63fcc91bf9206f71c4a2c592ec Author: David Yang Date: Sat Jan 31 10:18:49 2026 +0800 net: dsa: yt921x: Refactor VLAN awareness setting Create a helper function to centralize the logic for enabling and disabling VLAN awareness on a port. Signed-off-by: David Yang Link: https://patch.msgid.link/20260131021854.3405036-4-mmyangfl@gmail.com Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 8cdb2cc9a11b589b564bd0fc72e524e1be69e967 Author: David Yang Date: Sat Jan 31 10:18:48 2026 +0800 net: dsa: tag_yt921x: add priority support Required by DCB/QoS support of the switch driver, since the rx packets will have non-zero priorities. Signed-off-by: David Yang Link: https://patch.msgid.link/20260131021854.3405036-3-mmyangfl@gmail.com Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit a63daf73a5870d73929546a525fca3b3fc08fece Author: David Yang Date: Sat Jan 31 10:18:47 2026 +0800 net: dsa: tag_yt921x: clarify priority and code fields Packet priority is part of the tag, and the priority and code fields are used by tx and rx. Make revisions to reflect the facts. Signed-off-by: David Yang Link: https://patch.msgid.link/20260131021854.3405036-2-mmyangfl@gmail.com Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 4c9d53794bcfd3db45103269696b019d5ef09d41 Author: Linus Walleij Date: Tue Feb 3 11:04:51 2026 +0100 dt-bindings: spi: Add binding for Faraday FTSSP010 This adds a binding for the Faraday FTSSP010 SSP controller, a pretty straight-forward syncronous serial port and SPI controller. The bindings are submitted separately because the one device that has this is using it in a "nonstandard way" with regards to the electronics, and does not make it possible to develop or test a proper driver. However we want to be able to add this resource to the device trees and it's not complex. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260203-gemini-ssp-bindings-v1-1-6d85c9c72371@kernel.org Signed-off-by: Mark Brown commit bb6a3c2db281c7d5aaa79b2a6fa00bcd10c0bb8f Author: Mac Chiang Date: Tue Feb 3 17:59:23 2026 +0800 ASoC: SOF: Intel: hda: add SDCA property check If SDCA property is not present in the DisCo table, assume it is present. This allows DAI links to be created from codec_info_list instead of being skipped. Signed-off-by: Mac Chiang Reviewed-by: Liam Girdwood Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260203095923.3741674-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 754b3dade5ddbfd849e6ca9864cef45ce34cd7f6 Author: Mac Chiang Date: Tue Feb 3 18:00:27 2026 +0800 ASoC: Intel: soc-acpi-intel-ptl-match: drop rt721 related match tables Use functional topologies to support all RT721-related topology and amplifier combinations, e.g. sof-ptl-rt721.tplg, sof-ptl-rt721-l3-rt1320-l3.tplg. If these entries are not removed, they will all use the sof-ptl-rt721.tplg. Signed-off-by: Mac Chiang Reviewed-by: Liam Girdwood Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260203100027.3741754-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 023dfedec1478d506ba42d45f7993578fe38fa11 Author: Bard Liao Date: Tue Feb 3 19:15:45 2026 +0800 ASoC: SOF: Intel: allow module parameter override BT link to 0 The existing code test if (bt_link_mask_override) to overwrite the BT link mask. This doesn't allow user to disable the BT link mask. User may want to disable the BT link when it is detected by the NHLT. Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20260203111545.3742255-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 330d1deb410fe75f7f79bd1e5025f2827365eb83 Author: Bard Liao Date: Tue Feb 3 19:40:27 2026 +0800 ASoC: SOF: Intel: hda-sdw-bpt: support simultaneous audio and BPT streams Currently the SoundWire BPT stream uses the paired link DMA but not reserve it. It works without any issue because we assume the SoundWire BPT will not run with audio streams simultaneously. To support simultaneous audio and BPT streams, we need to use the hda_dma_prepare/cleanup helpers to reserve the pair link host DMA. Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260203114027.3742558-4-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 8834ae896bfe10f239d49adb9cc76bb6a57c431c Author: Bard Liao Date: Tue Feb 3 19:40:26 2026 +0800 ASoC: SOF: Intel: add hda_dma_prepare/cleanup helpers SoundWire BPT stream needs to use link and host DMAs. Thus we need helpers to prepare and cleanup the link and host DMAs. Currently the SoundWire BPT stream uses hda_cl_prepare/cleanup helpers. It works fine because we assume the SwoundWire BPT will not run with audio streams simultaneously. The new helpers are copied from hda_cl_prepare/cleanup and add a flag to reserve the paired host and link DMAs. The new helpers will be used by both code loader and SoundWire BPT. Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260203114027.3742558-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 89e1d632bb29e0915d801629d4a842ff609514e2 Author: Bard Liao Date: Tue Feb 3 19:40:25 2026 +0800 ASoC: SOF: Intel: add hda_dsp_stream_pair_get/put helpers Currently, hda_dsp_stream_get/put are used to get/put the host dma. However, we may want to use a hda stream that both host and link dma are available. Add helper to find the hda stream and reserve/release it. Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260203114027.3742558-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit b48ca920613858b477f75946907e72c74570af05 Author: Yu Zhang Date: Tue Feb 3 16:29:34 2026 +0800 iommupt: Always add IOVA range to iotlb_gather in gather_range_pages() Add current (iova, len) to the iotlb gather, regardless of the setting of PT_FEAT_FLUSH_RANGE or PT_FEAT_FLUSH_RANGE_NO_GAPS. In gather_range_pages(), the current IOVA range is only added to iotlb_gather when PT_FEAT_FLUSH_RANGE is set. Yet a virtual IOMMU with NpCache uses only PT_FEAT_FLUSH_RANGE_NO_GAPS. In that case, iotlb_gather will stay empty (start=ULONG_MAX, end=0) after initialization, and the current (iova, len) will not be added to the iotlb_gather, causing subsequent iommu_iotlb_sync() to perform IOTLB invalidation with wrong parameters (e.g., amd_iommu_iotlb_sync() computes size from gather->end - gather->start + 1, leading to an invalid range). The disjoint check and sync for PT_FEAT_FLUSH_RANGE_NO_GAPS remain unchanged: when the new range is disjoint from the existing gather, we still sync first and then add the new range, so semantics for NO_GAPS are preserved. Fixes: 7c53f4238aa8 ("iommupt: Add unmap_pages op") Cc: stable@vger.kernel.org Reviewed-by: Jason Gunthorpe Signed-off-by: Yu Zhang Signed-off-by: Joerg Roedel commit 9e249c48412828e807afddc21527eb734dc9bd3d Author: Ankit Soni Date: Thu Jan 22 15:30:38 2026 +0000 iommu/amd: serialize sequence allocation under concurrent TLB invalidations With concurrent TLB invalidations, completion wait randomly gets timed out because cmd_sem_val was incremented outside the IOMMU spinlock, allowing CMD_COMPL_WAIT commands to be queued out of sequence and breaking the ordering assumption in wait_on_sem(). Move the cmd_sem_val increment under iommu->lock so completion sequence allocation is serialized with command queuing. And remove the unnecessary return. Fixes: d2a0cac10597 ("iommu/amd: move wait_on_sem() out of spinlock") Tested-by: Srikanth Aithal Reported-by: Srikanth Aithal Signed-off-by: Ankit Soni Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel commit b79e0875fe8144fcb09e4fc1cf386cb3b2262480 Author: Vincent Guittot Date: Mon Feb 2 16:10:50 2026 +0100 PCI: s32g: Skip Root Port removal during success Currently, s32g_pcie_parse_ports() exercises the 'err_port' path even during the success case. This results in ports getting deleted after successful parsing of Root Ports. Hence, skip the removal of Root Ports during success. Fixes: 5cbc7d3e316e ("PCI: s32g: Add NXP S32G PCIe controller driver (RC)") Signed-off-by: Vincent Guittot [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260202151050.1446165-1-vincent.guittot@linaro.org commit 1b51bd761599b84e963d9cb510e7c7d8fbf9d1ee Author: John Johansen Date: Tue Feb 3 04:47:32 2026 -0800 apparmor: fix cast in format string DEBUG statement if debugging is enabled the DEBUG statement will fail do to a bad fat fingered cast. Fixes: 102ada7ca37ed ("apparmor: fix fmt string type error in process_strs_entry") Signed-off-by: John Johansen commit 9825fa8f49905275acef6c8e7fcd017d04616311 Author: Ingyu Jang Date: Sun Feb 1 02:23:55 2026 +0900 wifi: brcmsmac: phy: Remove unreachable error handling code wlc_phy_txpwr_srom_read_lcnphy() in wlc_phy_attach_lcnphy() always returns true, making the error handling code unreachable. Change the function's return type to void and remove the dead code, similar to the cleanup done for wlc_phy_txpwr_srom_read_nphy() in commit 47f0e32ffe4e ("wifi: brcmsmac: phy: Remove unreachable code"). Signed-off-by: Ingyu Jang Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260131172355.3367673-1-ingyujang25@korea.ac.kr Signed-off-by: Johannes Berg commit 4df29fb5bcebeea28b29386dec18355949512ca1 Author: Alice Ryhl Date: Wed Jan 28 09:12:07 2026 +0000 rust_binder: return p from rust_binder_transaction_target_node() Somehow this got changed to NULL when I ported this to upstream it. No idea how that happened. Reported-by: Carlos Llamas Closes: https://lore.kernel.org/r/aXkEiC1sGOGfDuzI@google.com Fixes: c1ea31205edf ("rust_binder: add binder_transaction tracepoint") Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Link: https://patch.msgid.link/20260128-binder-fix-target-node-null-v1-1-78d198ef55a5@google.com Signed-off-by: Greg Kroah-Hartman commit 9caa30dada9e8ec9b1b09cf95e6d1a806c86d101 Author: Shankari Anand Date: Sat Jan 3 01:57:11 2026 +0530 drivers: android: binder: Update ARef imports from sync::aref Update call sites in binder files to import `ARef` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Acked-by: Alice Ryhl Link: https://patch.msgid.link/20260102202714.184223-2-shankari.ak0208@gmail.com Signed-off-by: Greg Kroah-Hartman commit 38ac9179a79d81ab1db3807ddd6c03fab29eb19b Author: Shivam Kalra Date: Fri Jan 30 23:58:23 2026 +0530 rust_binder: fix needless borrow in context.rs Clippy warns about a needless borrow in context.rs: error: this expression creates a reference which is immediately dereferenced by the compiler --> drivers/android/binder/context.rs:141:18 | 141 | func(&proc); | ^^^^^ help: change this to: `proc` Remove the unnecessary borrow to satisfy clippy and improve code cleanliness. No functional change. Signed-off-by: Shivam Kalra Acked-by: Alice Ryhl Link: https://patch.msgid.link/20260130182842.217821-1-shivamklr@cock.li Signed-off-by: Greg Kroah-Hartman commit f8a9c11000e52a8e59f15e49edaf5a2857705f9a Author: Vasily Gorbik Date: Tue Feb 3 10:18:03 2026 +0100 s390/kexec: Emit an error message when cmdline is too long Currently, if the command line passed to kexec_file_load() exceeds the supported limit of the kernel being kexec'd, -EINVAL is returned to userspace, which is consistent across architectures. Since -EINVAL is not specific to this case, the kexec tool cannot provide a specific reason for the failure. Many architectures emit an error message in this case. Add a similar error message, including the effective limit, since the command line length is configurable. Acked-by: Alexander Gordeev Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit b8555fbc16311346ccf332010898c6307ec145c3 Author: Halil Pasic Date: Mon Feb 2 15:40:47 2026 +0100 s390/configs: Enable BLK_DEV_NULL_BLK as module Enable BLK_DEV_NULL_BLK as module in defconfig and debug_defconfig, so the Null Test Block Device Driver can be easily used for testing purposes. Signed-off-by: Halil Pasic Signed-off-by: Heiko Carstens commit cab7d81de304bd33ac41d2f0fb0d1721b08b7f88 Author: Heiko Carstens Date: Tue Jan 27 14:59:49 2026 +0100 s390: Document s390 stackprotector support Recently [1] s390 got stackprotector support. Document this. [1] commit f5730d44e05e ("s390: Add stackprotector support") Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 4906859dff656f52c8953c0a91a607b97877bbc4 Merge: fae1c659d7bd56 3051419f3d1a8f Author: Paolo Abeni Date: Tue Feb 3 12:46:57 2026 +0100 Merge branch 'net-phy-remove-modalias-based-mdio-device-bus-matching' Heiner Kallweit says: ==================== net: phy: remove modalias-based MDIO device bus matching modalias-based MDIO device bus matching has only one user (dsa-loop), where we can replace modalias-based matching with a simple custom match function. This, and first patch of the series, lay the foundation for removing modalias-based matching. ==================== Link: https://patch.msgid.link/d9543e7d-23e1-4dba-a6b3-35dcd6a35dec@gmail.com Signed-off-by: Paolo Abeni commit 3051419f3d1a8f694e3eaec3d54153bc243231a9 Author: Heiner Kallweit Date: Sat Jan 31 18:40:00 2026 +0100 net: phy: remove modalias-based mdio bus matching Last user dsa_loop has been migrated away from modalias-based matching, so we can remove this feature now. It was the only user of MDIO_NAME_SIZE, so remove also this constant. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/ce1c6df0-4785-4b28-8322-32dc6bceea18@gmail.com Signed-off-by: Paolo Abeni commit 5fddafbb92e036cc768a9c93fc74f5c24e1e4a2c Author: Heiner Kallweit Date: Sat Jan 31 18:38:56 2026 +0100 net: dsa: loop: remove MDIO device modalias This change is a prerequisite for removing the MDIO device modalias, as dsa_loop is the only user. Switch from modalias to a custom bus match function. Signed-off-by: Heiner Kallweit Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean Link: https://patch.msgid.link/15a4318f-50b5-4df5-874e-e387ee070a9d@gmail.com Signed-off-by: Paolo Abeni commit f7aa2ef10c0ed2cb7d25bf27a55cb6eb215ab921 Author: Heiner Kallweit Date: Sat Jan 31 18:37:15 2026 +0100 net: ethernet: adi: make name member of struct adin1110_cfg a pointer Primary reason for this change is to remove the misuse of MDIO_NAME_SIZE here, so that this constant can be removed in a follow-up patch. Use case here is simply a chip name w/o any relationship to a MDIO device. Also there's no need to reserve a longer char array, so make the name a pointer. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/61bc14fa-eed3-43b6-ae40-b98063e81578@gmail.com Signed-off-by: Paolo Abeni commit 988357628c2c84e891f5992c4f5cfb31fb3bd27b Author: Tzung-Bi Shih Date: Thu Jan 29 14:37:33 2026 +0000 revocable: Add KUnit test for concurrent access Add a test case to verify correct synchronization between concurrent readers and a revocation. The test setup involves: 1. Consumer 1 enters the critical section (SRCU read lock) and verifies access to the resource. 2. Provider attempts to revoke the resource. This should block until Consumer 1 releases the lock. 3. Consumer 2 attempts to enter the critical section while revocation is pending. It should see the resource as revoked (NULL). 4. Consumer 1 exits, allowing the revocation to complete. This ensures that the SRCU mechanism correctly enforces grace periods and that new readers are properly prevented from accessing the resource once revocation has begun. A way to run the test: $ ./tools/testing/kunit/kunit.py run \ --kconfig_add CONFIG_REVOCABLE_KUNIT_TEST=y \ --kconfig_add CONFIG_PROVE_LOCKING=y \ --kconfig_add CONFIG_DEBUG_KERNEL=y \ --kconfig_add CONFIG_DEBUG_INFO=y \ --kconfig_add CONFIG_DEBUG_INFO_DWARF5=y \ --kconfig_add CONFIG_KASAN=y \ --kconfig_add CONFIG_DETECT_HUNG_TASK=y \ --kconfig_add CONFIG_DEFAULT_HUNG_TASK_TIMEOUT="10" \ --arch=x86_64 --raw_output=all \ revocable_test Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260129143733.45618-5-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman commit 377563ce0653031de8d530e8b2f590d13349e29c Author: Tzung-Bi Shih Date: Thu Jan 29 14:37:32 2026 +0000 revocable: fix SRCU index corruption by requiring caller-provided storage The struct revocable handle stores the SRCU read-side index (idx) for the duration of a resource access. If multiple threads share the same struct revocable instance, they race on writing to the idx field, corrupting the SRCU state and potentially causing unsafe unlocks. Refactor the API to replace revocable_alloc()/revocable_free() with revocable_init()/revocable_deinit(). This change requires the caller to provide the storage for struct revocable. By moving storage ownership to the caller, the API ensures that concurrent users maintain their own private idx storage, eliminating the race condition. Reported-by: Johan Hovold Closes: https://lore.kernel.org/all/20260124170535.11756-4-johan@kernel.org/ Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260129143733.45618-4-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman commit a243f7fb11fe67c59c5df079384b123e58edb814 Author: Tzung-Bi Shih Date: Thu Jan 29 14:37:31 2026 +0000 revocable: Add KUnit test for provider lifetime races Add a test to verify that revocable_alloc() correctly handles race conditions where the provider is being released. The test covers three scenarios: 1. Allocating from a NULL provider. 2. Allocating from a provider that has been detached (pointer is NULL). 3. Allocating from a provider that is in the process of destruction (refcount is 0), simulating a race between revocable_alloc() and revocable_provider_release(). A way to run the test: $ ./tools/testing/kunit/kunit.py run \ --kconfig_add CONFIG_REVOCABLE_KUNIT_TEST=y \ --kconfig_add CONFIG_PROVE_LOCKING=y \ --kconfig_add CONFIG_DEBUG_KERNEL=y \ --kconfig_add CONFIG_DEBUG_INFO=y \ --kconfig_add CONFIG_DEBUG_INFO_DWARF5=y \ --kconfig_add CONFIG_KASAN=y \ --kconfig_add CONFIG_DETECT_HUNG_TASK=y \ --kconfig_add CONFIG_DEFAULT_HUNG_TASK_TIMEOUT="10" \ --arch=x86_64 --raw_output=all \ revocable_test Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260129143733.45618-3-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4d7dc4d1a62dbb22b1178dddeeb7a22d0272df77 Author: Tzung-Bi Shih Date: Thu Jan 29 14:37:30 2026 +0000 revocable: Fix races in revocable_alloc() using RCU There are two race conditions when allocating a revocable instance: 1. After a struct revocable_provider is revoked, the caller might still hold a dangling pointer to it. A subsequent call to revocable_alloc() can trigger a use-after-free. 2. If revocable_provider_release() runs concurrently with revocable_alloc(), the memory of struct revocable_provider can be accessed during or after kfree(). To fix these: - Manage the lifetime of struct revocable_provider using RCU. Annotate pointers to it with __rcu and use kfree_rcu() for deallocation. - Update revocable_alloc() to safely acquire a reference using RCU primitives. - Update revocable_provider_revoke() to take a double pointer (`**rp`). It atomically NULLs out the caller's pointer before starting revocation. This prevents the caller from holding a dangling pointer. - Drop devm_revocable_provider_alloc(). The devm-managed model cannot support the required double-pointer semantic for safe pointer nulling. Reported-by: Johan Hovold Closes: https://lore.kernel.org/all/aXdy-b3GOJkzGqYo@hovoldconsulting.com/ Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260129143733.45618-2-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman commit ad9cb48b2bd8b26d0a74bb8c16aaa4d6ec9a498a Author: Micah Ostrow Date: Tue Jan 27 12:17:35 2026 -0600 Input: apbps2 - fix comment style and typos Capitalize comment starts to match kernel coding style. Fix spelling: "reciever" -> "receiver" Fix grammar: "it's" (contraction of "it is") -> "its" (possessive) Remove uncertainty from "Clear error bits?" comment. Compile tested only. Signed-off-by: Micah Ostrow Link: https://patch.msgid.link/20260127181735.57132-1-bluefox9516@gmail.com Signed-off-by: Dmitry Torokhov commit e34881c84c255bc300f24d9fe685324be20da3d1 Author: Zicheng Qu Date: Fri Jan 30 08:34:38 2026 +0000 sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups Consider the following sequence on a CPU configured with nohz_full: 1) A task P runs in cgroup A, and cgroup A becomes throttled due to CFS bandwidth control. The gse (cgroup A) where the task P attached is dequeued and the CPU switches to idle. 2) Before cgroup A is unthrottled, task P is migrated from cgroup A to another cgroup B (not throttled). During sched_move_task(), the task P is observed as queued but not running, and therefore no resched_curr() is triggered. 3) Since the CPU is nohz_full, it remains in do_idle() waiting for an explicit scheduling event, i.e., resched_curr(). 4) For kernel <= 5.10: Later, cgroup A is unthrottled. However, the task P has already been migrated out of cgroup A, so unthrottle_cfs_rq() may observe load_weight == 0 and return early without resched_curr() called. For kernel >= 6.6: The unthrottling path normally triggers `resched_curr()` almost cases even when no runnable tasks remain in the unthrottled cgroup, preventing the idle stall described above. However, if cgroup A is removed before it gets unthrottled, the unthrottling path for cgroup A is never executed. In a result, no `resched_curr()` can be called. 5) At this point, the task P is runnable in cgroup B (not throttled), but the CPU remains in do_idle() with no pending reschedule point. The system stays in this state until an unrelated event (e.g. a new task wakeup or any cases) that can trigger a resched_curr() breaks the nohz_full idle state, and then the task P finally gets scheduled. The root cause is that sched_move_task() may classify the task as only queued, not running, and therefore fails to trigger a resched_curr(), while the later unthrottling path no longer has visibility of the migrated task. Preserve the existing behavior for running tasks by issuing resched_curr(), and explicitly invoke check_preempt_curr() for tasks that were queued at the time of migration. This ensures that runnable tasks are reconsidered for scheduling even when nohz_full suppresses periodic ticks. Fixes: 29f59db3a74b ("sched: group-scheduler core") Signed-off-by: Zicheng Qu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Reviewed-by: Aaron Lu Tested-by: Aaron Lu Link: https://patch.msgid.link/20260130083438.1122457-1-quzicheng@huawei.com commit 742fe830b7d9c01b5c36add9f664a5267caca4f5 Author: zenghongling Date: Tue Jan 20 16:33:33 2026 +0800 sched/cpufreq: Use %pe format for PTR_ERR() printing Use %pe format specifier for printing PTR_ERR() error values to make error messages more readable. Found by Coccinelle: ./cpufreq_schedutil.c:685:49-56: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: zenghongling Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260120083333.148385-1-zenghongling@kylinos.cn commit 94894c9c477e53bcea052e075c53f89df3d2a33e Author: Chen Jinghuang Date: Thu Jan 22 01:25:33 2026 +0000 sched/rt: Skip currently executing CPU in rto_next_cpu() CPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound RT task, and a CFS task stuck in kernel space. When other CPUs switch from RT to non-RT tasks, RT load balancing (LB) is triggered; with HAVE_RT_PUSH_IPI enabled, they send IPIs to CPU0 to drive the execution of rto_push_irq_work_func. During push_rt_task on CPU0, if next_task->prio < rq->donor->prio, resched_curr() sets NEED_RESCHED and after the push operation completes, CPU0 calls rto_next_cpu(). Since only CPU0 is overloaded in this scenario, rto_next_cpu() should ideally return -1 (no further IPI needed). However, multiple CPUs invoking tell_cpu_to_push() during LB increments rd->rto_loop_next. Even when rd->rto_cpu is set to -1, the mismatch between rd->rto_loop and rd->rto_loop_next forces rto_next_cpu() to restart its search from -1. With CPU0 remaining overloaded (satisfying rt_nr_migratory && rt_nr_total > 1), it gets reselected, causing CPU0 to queue irq_work to itself and send self-IPIs repeatedly. As long as CPU0 stays overloaded and other CPUs run pull_rt_tasks(), it falls into an infinite self-IPI loop, which triggers a CPU hardlockup due to continuous self-interrupts. The trigging scenario is as follows: cpu0 cpu1 cpu2 pull_rt_task tell_cpu_to_push <------------irq_work_queue_on rto_push_irq_work_func push_rt_task resched_curr(rq) pull_rt_task rto_next_cpu tell_cpu_to_push <-------------------------- atomic_inc(rto_loop_next) rd->rto_loop != next rto_next_cpu irq_work_queue_on rto_push_irq_work_func Fix redundant self-IPI by filtering the initiating CPU in rto_next_cpu(). This solution has been verified to effectively eliminate spurious self-IPIs and prevent CPU hardlockup scenarios. Fixes: 4bdced5c9a29 ("sched/rt: Simplify the IPI based RT balancing logic") Suggested-by: Steven Rostedt (Google) Suggested-by: K Prateek Nayak Signed-off-by: Chen Jinghuang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Steven Rostedt (Google) Reviewed-by: Valentin Schneider Link: https://patch.msgid.link/20260122012533.673768-1-chenjinghuang2@huawei.com commit 505da6689305b1103e9a8ab6636c6a7cf74cd5b1 Author: Wangyang Guo Date: Tue Jan 27 15:25:09 2026 +0800 sched/clock: Avoid false sharing for sched_clock_irqtime Read-mostly sched_clock_irqtime may share the same cacheline with frequently updated nohz struct. Make it as static_key to avoid false sharing issue. The only user of disable_sched_clock_irqtime() is tsc_.*mark_unstable() which may be invoked under atomic context and require a workqueue to disable static_key. But both of them calls clear_sched_clock_stable() just before doing disable_sched_clock_irqtime(). We can reuse "sched_clock_work" to also disable sched_clock_irqtime(). One additional case need to handle is if the tsc is marked unstable before late_initcall() phase, sched_clock_work will not be invoked and sched_clock_irqtime will stay enabled although clock is unstable: tsc_init() enable_sched_clock_irqtime() # irqtime accounting is enabled here ... if (unsynchronized_tsc()) # true mark_tsc_unstable() clear_sched_clock_stable() __sched_clock_stable_early = 0; ... if (static_key_count(&sched_clock_running.key) == 2) # Only happens at sched_clock_init_late() __clear_sched_clock_stable(); # Never executed ... # late_initcall() phase sched_clock_init_late() if (__sched_clock_stable_early) # Already false __set_sched_clock_stable(); # sched_clock is never marked stable # TSC unstable, but sched_clock_work won't run to disable irqtime So we need to disable_sched_clock_irqtime() in sched_clock_init_late() if clock is unstable. Reported-by: Benjamin Lei Suggested-by: K Prateek Nayak Suggested-by: Peter Zijlstra Suggested-by: Shrikanth Hegde Signed-off-by: Wangyang Guo Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Reviewed-by: Tim Chen Reviewed-by: Tianyou Li Reviewed-by: Shrikanth Hegde Tested-by: K Prateek Nayak Link: https://patch.msgid.link/20260127072509.2627346-1-wangyang.guo@intel.com commit dd6a37e8faa723c680cb8615efa5b042691b927f Author: Joel Fernandes Date: Mon Jan 26 10:59:05 2026 +0100 selftests/sched_ext: Add test for DL server total_bw consistency Add a new kselftest to verify that the total_bw value in /sys/kernel/debug/sched/debug remains consistent across all CPUs under different sched_ext BPF program states: 1. Before a BPF scheduler is loaded 2. While a BPF scheduler is loaded and active 3. After a BPF scheduler is unloaded The test runs CPU stress threads to ensure DL server bandwidth values stabilize before checking consistency. This helps catch potential issues with DL server bandwidth accounting during sched_ext transitions. Co-developed-by: Andrea Righi Signed-off-by: Andrea Righi Signed-off-by: Joel Fernandes Signed-off-by: Peter Zijlstra (Intel) Tested-by: Christian Loehle Link: https://patch.msgid.link/20260126100050.3854740-8-arighi@nvidia.com commit be621a76341caa911ff98175114ff072618d7d4a Author: Andrea Righi Date: Mon Jan 26 10:59:04 2026 +0100 selftests/sched_ext: Add test for sched_ext dl_server Add a selftest to validate the correct behavior of the deadline server for the ext_sched_class. Co-developed-by: Joel Fernandes Signed-off-by: Joel Fernandes Signed-off-by: Andrea Righi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Emil Tsalapatis Tested-by: Christian Loehle Link: https://patch.msgid.link/20260126100050.3854740-7-arighi@nvidia.com commit 5a40a9bb56d455e7548ba4b6d7787918323cbaf0 Author: Peter Zijlstra Date: Tue Feb 3 11:05:12 2026 +0100 sched/debug: Fix dl_server (re)start conditions There are two problems with sched_server_write_common() that can cause the dl_server to malfunction upon attempting to change the parameters: 1) when, after having disabled the dl_server by setting runtime=0, it is enabled again while tasks are already enqueued. In this case is_active would still be 0 and dl_server_start() would not be called. 2) when dl_server_apply_params() would fail, runtime is not applied and does not reflect the new state. Instead have dl_server_start() check its actual dl_runtime, and have sched_server_write_common() unconditionally (re)start the dl_server. It will automatically stop if there isn't anything to do, so spurious activation is harmless -- while failing to start it is a problem. While there, move the printk out of the locked region and make it symmetric, also printing on enable. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260203103407.GK1282955@noisy.programming.kicks-ass.net commit 76d12132ba459ab929cb66eb2030c666aacdb69a Author: Joel Fernandes Date: Mon Jan 26 10:59:03 2026 +0100 sched/debug: Add support to change sched_ext server params When a sched_ext server is loaded, tasks in the fair class are automatically moved to the sched_ext class. Add support to modify the ext server parameters similar to how the fair server parameters are modified. Re-use common code between ext and fair servers as needed. Co-developed-by: Andrea Righi Signed-off-by: Andrea Righi Signed-off-by: Joel Fernandes Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Juri Lelli Tested-by: Christian Loehle Link: https://patch.msgid.link/20260126100050.3854740-6-arighi@nvidia.com commit cd959a3562050d1c676be37f1d256a96cb067868 Author: Andrea Righi Date: Mon Jan 26 10:59:02 2026 +0100 sched_ext: Add a DL server for sched_ext tasks sched_ext currently suffers starvation due to RT. The same workload when converted to EXT can get zero runtime if RT is 100% running, causing EXT processes to stall. Fix it by adding a DL server for EXT. A kselftest is also included later to confirm that both DL servers are functioning correctly: # ./runner -t rt_stall ===== START ===== TEST: rt_stall DESCRIPTION: Verify that RT tasks cannot stall SCHED_EXT tasks OUTPUT: TAP version 13 1..1 # Runtime of FAIR task (PID 1511) is 0.250000 seconds # Runtime of RT task (PID 1512) is 4.750000 seconds # FAIR task got 5.00% of total runtime ok 1 PASS: FAIR task got more than 4.00% of runtime TAP version 13 1..1 # Runtime of EXT task (PID 1514) is 0.250000 seconds # Runtime of RT task (PID 1515) is 4.750000 seconds # EXT task got 5.00% of total runtime ok 2 PASS: EXT task got more than 4.00% of runtime TAP version 13 1..1 # Runtime of FAIR task (PID 1517) is 0.250000 seconds # Runtime of RT task (PID 1518) is 4.750000 seconds # FAIR task got 5.00% of total runtime ok 3 PASS: FAIR task got more than 4.00% of runtime TAP version 13 1..1 # Runtime of EXT task (PID 1521) is 0.250000 seconds # Runtime of RT task (PID 1522) is 4.750000 seconds # EXT task got 5.00% of total runtime ok 4 PASS: EXT task got more than 4.00% of runtime ok 1 rt_stall # ===== END ===== Co-developed-by: Joel Fernandes Signed-off-by: Joel Fernandes Signed-off-by: Andrea Righi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Juri Lelli Tested-by: Christian Loehle Link: https://patch.msgid.link/20260126100050.3854740-5-arighi@nvidia.com commit 68ec89d0e99156803bdea3c986c0198624e40ea2 Author: Joel Fernandes Date: Mon Jan 26 10:59:01 2026 +0100 sched/debug: Stop and start server based on if it was active Currently the DL server interface for applying parameters checks CFS-internals to identify if the server is active. This is error-prone and makes it difficult when adding new servers in the future. Fix it, by using dl_server_active() which is also used by the DL server code to determine if the DL server was started. Signed-off-by: Joel Fernandes Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Juri Lelli Reviewed-by: Andrea Righi Acked-by: Tejun Heo Tested-by: Christian Loehle Link: https://patch.msgid.link/20260126100050.3854740-4-arighi@nvidia.com commit 6080fb211672aec6ce8f2f5a2e0b4eae736f2027 Author: Joel Fernandes Date: Mon Jan 26 10:59:00 2026 +0100 sched/debug: Fix updating of ppos on server write ops Updating "ppos" on error conditions does not make much sense. The pattern is to return the error code directly without modifying the position, or modify the position on success and return the number of bytes written. Since on success, the return value of apply is 0, there is no point in modifying ppos either. Fix it by removing all this and just returning error code or number of bytes written on success. Signed-off-by: Joel Fernandes Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Juri Lelli Reviewed-by: Andrea Righi Acked-by: Tejun Heo Tested-by: Christian Loehle Link: https://patch.msgid.link/20260126100050.3854740-3-arighi@nvidia.com commit 3cb3b27693bf30defb16aa096158a3b24583b8d2 Author: Joel Fernandes Date: Mon Jan 26 10:58:59 2026 +0100 sched/deadline: Clear the defer params The defer params were not cleared in __dl_clear_params. Clear them. Without this is some of my test cases are flaking and the DL timer is not starting correctly AFAICS. Fixes: a110a81c52a9 ("sched/deadline: Deferrable dl server") Signed-off-by: Joel Fernandes Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Andrea Righi Acked-by: Juri Lelli Tested-by: Christian Loehle Link: https://patch.msgid.link/20260126100050.3854740-2-arighi@nvidia.com commit 3e4067169c573fba9dd8f77480f3a6e9c723b507 Merge: 5c4378b7b0e1f4 18f7fcd5e69a04 Author: Peter Zijlstra Date: Tue Feb 3 12:04:13 2026 +0100 Merge branch 'v6.19-rc8' Update to avoid conflicts with /urgent patches. Signed-off-by: Peter Zijlstra commit da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102 Author: Deepanshu Kartikey Date: Tue Feb 3 07:50:33 2026 +0530 gfs2: fix memory leaks in gfs2_fill_super error path Fix two memory leaks in the gfs2_fill_super() error handling path when transitioning a filesystem to read-write mode fails. First leak: kthread objects (thread_struct, task_struct, etc.) When gfs2_freeze_lock_shared() fails after init_threads() succeeds, the created kernel threads (logd and quotad) are never destroyed. This occurs because the fail_per_node label doesn't call gfs2_destroy_threads(). Second leak: quota bitmap buffer (8192 bytes) When gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but before other operations complete, the allocated quota bitmap is never freed. The fix moves thread cleanup to the fail_per_node label to handle all error paths uniformly. gfs2_destroy_threads() is safe to call unconditionally as it checks for NULL pointers. Quota cleanup is added in gfs2_make_fs_rw() to properly handle the withdrawal case where quota initialization succeeds but the filesystem is then withdrawn. Thread leak backtrace (gfs2_freeze_lock_shared failure): unreferenced object 0xffff88801d7bca80 (size 4480): copy_process+0x3a1/0x4670 kernel/fork.c:2422 kernel_clone+0xf3/0x6e0 kernel/fork.c:2779 kthread_create_on_node+0x100/0x150 kernel/kthread.c:478 init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611 gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265 Quota leak backtrace (gfs2_make_fs_rw failure): unreferenced object 0xffff88812de7c000 (size 8192): gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409 gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149 gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275 Reported-by: syzbot+aac438d7a1c44071e04b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=aac438d7a1c44071e04b Fixes: 6c7410f44961 ("gfs2: gfs2_freeze_lock_shared cleanup") Fixes: b66f723bb552 ("gfs2: Improve gfs2_make_fs_rw error handling") Link: https://lore.kernel.org/all/20260131062509.77974-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey Signed-off-by: Andreas Gruenbacher commit 53c998527ffa60f9deda8974a11ad39790684159 Author: Breno Leitao Date: Mon Feb 2 10:32:51 2026 -0800 arm64/gcs: Fix error handling in arch_set_shadow_stack_status() alloc_gcs() returns an error-encoded pointer on failure, which comes from do_mmap(), not NULL. The current NULL check fails to detect errors, which could lead to using an invalid GCS address. Use IS_ERR_VALUE() to properly detect errors, consistent with the check in gcs_alloc_thread_stack(). Fixes: b57180c75c7e ("arm64/gcs: Implement shadow stack prctl() interface") Reviewed-by: Mark Brown Signed-off-by: Breno Leitao Signed-off-by: Will Deacon commit 45c0a8a70253ab97e676b9791891e389a531664b Author: Nathan Chancellor Date: Wed Jan 14 13:43:31 2026 -0700 drm/panel: ilitek-ili9882t: Remove duplicate initializers in tianma_il79900a_dsc Clang warns (or errors with CONFIG_WERROR=y / W=e): drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:95:16: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides] 95 | .vbr_enable = 0, | ^ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:90:16: note: previous initialization is here 90 | .vbr_enable = false, | ^~~~~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:97:19: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides] 97 | .rc_model_size = DSC_RC_MODEL_SIZE_CONST, | ^~~~~~~~~~~~~~~~~~~~~~~ include/drm/display/drm_dsc.h:22:38: note: expanded from macro 'DSC_RC_MODEL_SIZE_CONST' 22 | #define DSC_RC_MODEL_SIZE_CONST 8192 | ^~~~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:91:19: note: previous initialization is here 91 | .rc_model_size = DSC_RC_MODEL_SIZE_CONST, | ^~~~~~~~~~~~~~~~~~~~~~~ include/drm/display/drm_dsc.h:22:38: note: expanded from macro 'DSC_RC_MODEL_SIZE_CONST' 22 | #define DSC_RC_MODEL_SIZE_CONST 8192 | ^~~~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:132:25: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides] 132 | .initial_scale_value = 32, | ^~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:126:25: note: previous initialization is here 126 | .initial_scale_value = 32, | ^~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:133:20: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides] 133 | .nfl_bpg_offset = 3511, | ^~~~ drivers/gpu/drm/panel/panel-ilitek-ili9882t.c:108:20: note: previous initialization is here 108 | .nfl_bpg_offset = 1402, | ^~~~ GCC would warn about this in the same manner but its version, -Woverride-init, is disabled for a normal kernel build in scripts/Makefile.warn. For clang, -Wextra in drivers/gpu/drm/Makefile turns it back but GCC respects turning it off earlier in the command line. Of all the duplicate fields in the initializer, only nfl_bpg_offset is a different value. Clear up the duplicate initializers, keeping the 'false' value for .vbr_enable, as it is bool, and the second value for .nfl_bpg_offset, assuming it is the correct one since it was the one tested in the original change. Fixes: 65ce1f5834e9 ("drm/panel: ilitek-ili9882t: Switch Tianma TL121BVMS07 to DSC 120Hz mode") Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20260114-panel-ilitek-ili9882t-fix-override-init-v1-1-1d69a2b096df@kernel.org Signed-off-by: Maxime Ripard commit ef92b98f5f6758a049898b53aa30476010db04fa Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:40 2026 +0100 media: pci: mg4b: Use IRQF_NO_THREAD The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke other interrupt handlers and this supposed to happen from hard interrupt context. Use IRQF_NO_THREAD to forbid forced-threading. Fixes: 0ab13674a9bd1 ("media: pci: mgb4: Added Digiteq Automotive MGB4 driver") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128095540.863589-21-bigeasy@linutronix.de commit 161ab30da6899f31f8128cec7c833e99fa4d06d2 Author: Qu Wenruo Date: Thu Jan 29 13:53:46 2026 +1030 btrfs: get rid of compressed_bio::compressed_folios[] Now there is no one utilizing that member, we can safely remove it along with compressed_bio::nr_folios member. The size is reduced from 352 to 336 bytes on x86_64. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit e1bc83f8b157689e5de4f651b6fbb9dcdccd33c1 Author: Qu Wenruo Date: Thu Jan 29 13:53:45 2026 +1030 btrfs: get rid of compressed_folios[] usage for encoded writes Currently only encoded writes utilized btrfs_submit_compressed_write(), which utilized compressed_bio::compressed_folios[] array. Change the only call site to call the new helper, btrfs_alloc_compressed_write(), to allocate a compressed bio, then queue needed folios into that bio, and finally call btrfs_submit_compressed_write() to submit the compressed bio. This change has one hidden benefit, previously we used btrfs_alloc_folio_array() for the folios of btrfs_submit_compressed_read(), which doesn't utilize the compression page pool for bs == ps cases. Now we call btrfs_alloc_compr_folio() which will benefit from the page pool. The other obvious benefit is that we no longer need to allocate an array to hold all those folios, thus one less error path. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit dafcfa1c8e377a3d8e2e1d72a76435b57ed1ac7d Author: Qu Wenruo Date: Thu Jan 29 13:53:44 2026 +1030 btrfs: get rid of compressed_folios[] usage for compressed read Currently btrfs_submit_compressed_read() still uses compressed_bio::compressed_folios[] array. Change it to allocate each folio and queue them into the compressed bio so that we do not need to allocate that array. Considering how small each compressed read bio is (less than 128KiB), we do not benefit that much from btrfs_alloc_folio_array() anyway, while we may benefit more from btrfs_alloc_compr_folio() by using the global folio pool. So changing from btrfs_alloc_folio_array() to btrfs_alloc_compr_folio() in a loop should still be fine. This removes one error path, and paves the way to completely remove compressed_folios[] array. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 26902be0cd0997b34ef13593e35ef3501a3c70b5 Author: Qu Wenruo Date: Thu Jan 29 13:53:43 2026 +1030 btrfs: remove the old btrfs_compress_folios() infrastructure Since it's been replaced by btrfs_compress_bio(), remove all involved functions. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6f706f34fc4cc0ce180c293f9e793302fa00e4d8 Author: Qu Wenruo Date: Thu Jan 29 13:53:42 2026 +1030 btrfs: switch to btrfs_compress_bio() interface for compressed writes This switch has the following benefits: - A single structure to handle all compression No more extra members like compressed_folios[] nor compress_type, all those members. This means the structure of async_extent is much smaller. - Simpler error handling A single cleanup_compressed_bio() will handle everything, no extra compressed_folios[] array to bother. Some extra notes: - Compressed folios releasing Now we go bio_for_each_folio_all() loop to release the folios of the bio. This will work for both the old compressed_folios[] array and the new pure bio method. For old compressed_folios[], all folios of that array is queued into the bio, thus releasing the folios from the bio is the same as releasing each folio of that array. We just need to be sure no double releasing from the array and bio. For the new pure bio method, that array is NULL, just usual folio releasing of the bio. The only extra note is for end_bbio_compressed_read(), as the folios are allocated using btrfs_alloc_folio_array(), thus the folios should only be released by regular folio_put(), not btrfs_free_compr_folio(). - Rounding up the bio to block size We cannot simply increase bi_size, as that will not increase the length of the last bvec. Thus we have to properly add the last part into the bio. This will be done by the helper, round_up_last_block(). The reason we do not round those bios up at compression time is to get the unaligned compressed size, so that they can be utilized for inline extents. If we round the bios up at *_compress_bio(), then every compressed bio will be larger than or equal to one fs block, resulting no inline compressed extent. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit c51173271d528561706a2ce3bacd4f6232f4375b Author: Qu Wenruo Date: Thu Jan 29 13:53:41 2026 +1030 btrfs: introduce btrfs_compress_bio() helper The helper will allocate a new compressed_bio, do the compression, and return it to the caller. This greatly simplifies the compression path, as we no longer need to allocate a folio array thus no extra error path, furthermore the compressed bio structure can be utilized for submission with very minor modifications (like rounding up the bi_size and populate the bi_sector). Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3d74a7556fbab89a3e78f514cf39d3413b9963d1 Author: Qu Wenruo Date: Thu Jan 29 13:53:40 2026 +1030 btrfs: zlib: introduce zlib_compress_bio() helper The new helper has the following enhancements against the existing zlib_compress_folios() - Much smaller parameter list No more shared IN/OUT members, no need to pre-allocate a compressed_folios[] array. Just a workspace and compressed_bio pointer, everything we need can be extracted from that @cb pointer. - Ready-to-be-submitted compressed bio Although the caller still needs to do some common works like rounding up and zeroing the tailing part of the last fs block. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit bba959655ac5665f3ad2fc244c98da48d2ae4c17 Author: Qu Wenruo Date: Thu Jan 29 13:53:39 2026 +1030 btrfs: zstd: introduce zstd_compress_bio() helper The new helper has the following enhancements against the existing zstd_compress_folios() - Much smaller parameter list No more shared IN/OUT members, no need to pre-allocate a compressed_folios[] array. Just a workspace and compressed_bio pointer, everything we need can be extracted from that @cb pointer. - Ready-to-be-submitted compressed bio Although the caller still needs to do some common works like rounding up and zeroing the tailing part of the last fs block. Overall the workflow is the same as zstd_compress_folios(), but with some minor changes: - @start/@len is now constant For the current input file offset, use @start + @tot_in instead. The original change of @start and @len makes it pretty hard to know what value we're really comparing to. - No more @cur_len It's only utilized when switching input buffer. Directly use btrfs_calc_input_length() instead. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3be8a788eed3f7f30f32d69f50d648ba2c458f21 Author: Qu Wenruo Date: Thu Jan 29 13:53:38 2026 +1030 btrfs: lzo: introduce lzo_compress_bio() helper The new helper has the following enhancements against the existing lzo_compress_folios() - Much smaller parameter list No more shared IN/OUT members, no need to pre-allocate a compressed_folios[] array. Just a workspace list header and a compressed_bio pointer. Everything else can be fetched from that @cb pointer. - Read-to-be-submitted compressed bio Although the caller still needs to do some common works like rounding up and zeroing the tailing part of the last fs block. Some workloads are specific to lZO that is not needed with other multi-run compression interfaces: - Need to write a LZO header or segment header Use the new write_and_queue_folio() helper to do the bio_add_folio() call and folio switching. - Need to update the LZO header after compression is done Use bio_first_folio_all() to grab the first folio and update the header. - Extra corner case of error handling This can happen when we have queued part of a folio and hit an error. In that case those folios will be released by the bio. Thus we can only release the folio that has no queued part. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit e8f6130419d7a8b1384135a9e23d008c3fc01dad Author: Naohiro Aota Date: Mon Jan 26 14:49:52 2026 +0900 btrfs: zoned: factor out the zone loading part into a testable function Separate btrfs_load_block_group_* calling path into a function, so that it can be an entry point of unit test. Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit e564cd2511750a634f916ae406d1f6ff84e53d0d Author: Naohiro Aota Date: Mon Jan 26 14:49:51 2026 +0900 btrfs: add cleanup function for btrfs_free_chunk_map Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit 392431cf9c2140b4356597f506f3e1e324e2ccfc Author: Naohiro Aota Date: Mon Jan 26 14:49:50 2026 +0900 btrfs: tests: add cleanup functions for test specific functions Add auto-cleanup helper functions for btrfs_free_dummy_fs_info and btrfs_free_dummy_block_group. Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit a56a70f8d20752c8be032ac03f7e8684dccdeb58 Author: Filipe Manana Date: Fri Jan 30 17:06:45 2026 +0000 btrfs: raid56: fix memory leak of btrfs_raid_bio::stripe_uptodate_bitmap We allocate the bitmap but we never free it in free_raid_bio_pointers(). Fix this by adding a bitmap_free() call against the stripe_uptodate_bitmap of a raid bio. Fixes: 1810350b04ef ("btrfs: raid56: move sector_ptr::uptodate into a dedicated bitmap") Reported-by: Christoph Hellwig Link: https://lore.kernel.org/linux-btrfs/20260126045315.GA31641@lst.de/ Reviewed-by: Qu Wenruo Tested-by: Christoph Hellwig Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5341c98450df7cf8dacc907a80e3362f3155c847 Author: Boris Burkov Date: Thu Jan 29 16:11:22 2026 -0800 btrfs: tests: add unit tests for pending extent walking functions I ran into another sort of trivial bug in v1 of the patch and concluded that these functions really ought to be unit tested. These two functions form the core of searching the chunk allocation pending extent bitmap and have relatively easily definable semantics, so unit testing them can help ensure the correctness of chunk allocation. I also made a minor unrelated fix in volumes.h to properly forward declare btrfs_space_info. Because of the order of the includes in the new test, this was actually hitting a latent build warning. Note: This is an early example for me of a commit authored in part by an AI agent, so I wanted to more clear about what I did. I defined a trivial test and explained the set of tests I wanted to the agent and it produced the large set of test cases seen here. I then checked each test case to make sure it matched the description and simplified the constants and numbers until they looked reasonable to me. I then checked the looping logic to make sure it made sense to the original spirit of the trivial test. Finally, carefully combed over all the lines it wrote to loop over the tests it generated to make sure they followed our code style guide. Assisted-by: Claude:claude-opus-4-5 Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit b14c5e04bd0f722ed631845599d52d03fcae1bc1 Author: Boris Burkov Date: Thu Jan 29 16:11:21 2026 -0800 btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation I have been observing a number of systems aborting at insert_dev_extents() in btrfs_create_pending_block_groups(). The following is a sample stack trace of such an abort coming from forced chunk allocation (typically behind CONFIG_BTRFS_EXPERIMENTAL) but this can theoretically happen to any DUP chunk allocation. [81.801] ------------[ cut here ]------------ [81.801] BTRFS: Transaction aborted (error -17) [81.801] WARNING: fs/btrfs/block-group.c:2876 at btrfs_create_pending_block_groups+0x721/0x770 [btrfs], CPU#1: bash/319 [81.802] Modules linked in: virtio_net btrfs xor zstd_compress raid6_pq null_blk [81.803] CPU: 1 UID: 0 PID: 319 Comm: bash Kdump: loaded Not tainted 6.19.0-rc6+ #319 NONE [81.803] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 [81.804] RIP: 0010:btrfs_create_pending_block_groups+0x723/0x770 [btrfs] [81.806] RSP: 0018:ffffa36241a6bce8 EFLAGS: 00010282 [81.806] RAX: 000000000000000d RBX: ffff8e699921e400 RCX: 0000000000000000 [81.807] RDX: 0000000002040001 RSI: 00000000ffffffef RDI: ffffffffc0608bf0 [81.807] RBP: 00000000ffffffef R08: ffff8e69830f6000 R09: 0000000000000007 [81.808] R10: ffff8e699921e5e8 R11: 0000000000000000 R12: ffff8e6999228000 [81.808] R13: ffff8e6984d82000 R14: ffff8e69966a69c0 R15: ffff8e69aa47b000 [81.809] FS: 00007fec6bdd9740(0000) GS:ffff8e6b1b379000(0000) knlGS:0000000000000000 [81.809] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [81.810] CR2: 00005604833670f0 CR3: 0000000116679000 CR4: 00000000000006f0 [81.810] Call Trace: [81.810] [81.810] __btrfs_end_transaction+0x3e/0x2b0 [btrfs] [81.811] btrfs_force_chunk_alloc_store+0xcd/0x140 [btrfs] [81.811] kernfs_fop_write_iter+0x15f/0x240 [81.812] vfs_write+0x264/0x500 [81.812] ksys_write+0x6c/0xe0 [81.812] do_syscall_64+0x66/0x770 [81.812] entry_SYSCALL_64_after_hwframe+0x76/0x7e [81.813] RIP: 0033:0x7fec6be66197 [81.814] RSP: 002b:00007fffb159dd30 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [81.815] RAX: ffffffffffffffda RBX: 00007fec6bdd9740 RCX: 00007fec6be66197 [81.815] RDX: 0000000000000002 RSI: 0000560483374f80 RDI: 0000000000000001 [81.816] RBP: 0000560483374f80 R08: 0000000000000000 R09: 0000000000000000 [81.816] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 [81.817] R13: 00007fec6bfb85c0 R14: 00007fec6bfb5ee0 R15: 00005604833729c0 [81.817] [81.817] irq event stamp: 20039 [81.818] hardirqs last enabled at (20047): [] __up_console_sem+0x52/0x60 [81.818] hardirqs last disabled at (20056): [] __up_console_sem+0x37/0x60 [81.819] softirqs last enabled at (19470): [] __irq_exit_rcu+0x96/0xc0 [81.819] softirqs last disabled at (19463): [] __irq_exit_rcu+0x96/0xc0 [81.820] ---[ end trace 0000000000000000 ]--- [81.820] BTRFS: error (device dm-7 state A) in btrfs_create_pending_block_groups:2876: errno=-17 Object already exists Inspecting these aborts with drgn, I observed a pattern of overlapping chunk_maps. Note how stripe 1 of the first chunk overlaps in physical address with stripe 0 of the second chunk. Physical Start Physical End Length Logical Type Stripe ---------------------------------------------------------------------------------------------------- 0x0000000102500000 0x0000000142500000 1.0G 0x0000000641d00000 META|DUP 0/2 0x0000000142500000 0x0000000182500000 1.0G 0x0000000641d00000 META|DUP 1/2 0x0000000142500000 0x0000000182500000 1.0G 0x0000000601d00000 META|DUP 0/2 0x0000000182500000 0x00000001c2500000 1.0G 0x0000000601d00000 META|DUP 1/2 Now how could this possibly happen? All chunk allocation is protected by the chunk_mutex so racing allocations should see a consistent view of the CHUNK_ALLOCATED bit in the chunk allocation extent-io-tree (device->alloc_state as set by chunk_map_device_set_bits()) The tree itself is protected by a spin lock, and clearing/setting the bits is always protected by fs_info->mapping_tree_lock, so no race is apparent. It turns out that there is a subtle bug in the logic regarding chunk allocations that have happened in the current transaction, known as "pending extents". The chunk allocation as defined in find_free_dev_extent() is a loop which searches the commit root of the dev_root and looks for gaps between DEV_EXTENT items. For those gaps, it then checks alloc_state bitmap for any pending extents and adjusts the hole that it finds accordingly. However, the logic in that adjustment assumes that the first pending extent is the only one in that range. e.g., given a layout with two non-consecutive pending extents in a hole passed to dev_extent_hole_check() via *hole_start and *hole_size: |----pending A----| real hole |----pending B----| | candidate hole | *hole_start *hole_start + *hole_size the code incorrectly returns a "hole" from the end of pending extent A until the passed in hole end, failing to account for pending B. However, it is not entirely obvious that it is actually possible to produce such a layout. I was able to reproduce it, but with some contortions: I continued to use the force chunk allocation sysfs file and I introduced a long delay (10 seconds) into the start of the cleaner thread. I also prevented the unused bgs cleaning logic from ever deleting metadata bgs. These help make it easier to deterministically produce the condition but shouldn't really matter if you imagine the conditions happening by race/luck. Allocations/frees can happen concurrently with the cleaner thread preparing to process an unused extent and both create some used chunks with an unused chunk interleaved, all during one transaction. Then btrfs_delete_unused_bgs() sees the unused one and clears it, leaving a range with several pending chunk allocations and a gap in the middle. The basic idea is that the unused_bgs cleanup work happens on a worker so if we allocate 3 block groups in one transaction, then the cleaner work kicked off by the previous transaction comes through and deletes the middle one of the 3, then the commit root shows no dev extents and we have the bad pattern in the extent-io-tree. One final consideration is that the code happens to loop to the next hole if there are no more extents at all, so we need one more dev extent way past the area we are working in. Something like the following demonstrates the technique: # push the BG frontier out to 20G fallocate -l 20G $mnt/foo # allocate one more that will prevent the "no more dev extents" luck fallocate -l 1G $mnt/sticky # sync sync # clear out the allocation area rm $mnt/foo sync _cleaner # let everything quiesce sleep 20 sync # dev tree should have one bg 20G out and the rest at the beginning.. # sort of like an empty FS but with a random sticky chunk. # kick off the cleaner in the background, remember it will sleep 10s # before doing interesting work _cleaner & sleep 3 # create 3 trivial block groups, all empty, all immediately marked as unused. echo 1 > "$(_btrfs_sysfs_space_info $dev metadata)/force_chunk_alloc" echo 1 > "$(_btrfs_sysfs_space_info $dev data)/force_chunk_alloc" echo 1 > "$(_btrfs_sysfs_space_info $dev metadata)/force_chunk_alloc" # let the cleaner thread definitely finish, it will remove the data bg sleep 10 # this allocation sees the non-consecutive pending metadata chunks with # data chunk gap of 1G and allocates a 2G extent in that hole. ENOSPC! echo 1 > "$(_btrfs_sysfs_space_info $dev metadata)/force_chunk_alloc" As for the fix, it is not that obvious. I could not see a trivial way to do it even by adding backup loops into find_free_dev_extent(), so I opted to change the semantics of dev_extent_hole_check() to not stop looping until it finds a sufficiently big hole. For clarity, this also required changing the helper function contains_pending_extent() into two new helpers which find the first pending extent and the first suitable hole in a range. I attempted to clean up the documentation and range calculations to be as consistent and clear as possible for the future. I also looked at the zoned case and concluded that the loop there is different and not to be unified with this one. As far as I can tell, the zoned check will only further constrain the hole so looping back to find more holes is acceptable. Though given that zoned really only appends, I find it highly unlikely that it is susceptible to this bug. Fixes: 1b9845081633 ("Btrfs: fix find_free_dev_extent() malfunction in case device tree has hole") Reported-by: Dimitrios Apostolou Closes: https://lore.kernel.org/linux-btrfs/q7760374-q1p4-029o-5149-26p28421s468@tzk.arg/ Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit b291ad4458df8311626dfa0a089918f6a542d6bc Author: jinbaohong Date: Wed Jan 28 07:06:41 2026 +0000 btrfs: fix transaction commit blocking during trim of unallocated space When trimming unallocated space, btrfs_trim_fs() holds the device_list_mutex for the entire duration while iterating through all devices. On large filesystems with significant unallocated space, this operation can take minutes to hours on large storage systems. This causes a problem because btrfs_run_dev_stats(), which is called during transaction commit, also requires device_list_mutex: btrfs_trim_fs() mutex_lock(&fs_devices->device_list_mutex) list_for_each_entry(device, ...) btrfs_trim_free_extents(device) mutex_unlock(&fs_devices->device_list_mutex) commit_transaction() btrfs_run_dev_stats() mutex_lock(&fs_devices->device_list_mutex) // blocked! ... While trim is running, all transaction commits are blocked waiting for the mutex. Fix this by refactoring btrfs_trim_free_extents() to process devices in bounded chunks (up to 2GB per iteration) and release device_list_mutex between chunks. Signed-off-by: robbieko Signed-off-by: jinbaohong Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 Author: jinbaohong Date: Wed Jan 28 07:06:40 2026 +0000 btrfs: handle user interrupt properly in btrfs_trim_fs() When a fatal signal is pending or the process is freezing, btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS. Currently this is treated as a regular error: the loops continue to the next iteration and count it as a block group or device failure. Instead, break out of the loops immediately and return -ERESTARTSYS to userspace without counting it as a failure. Also skip the device loop entirely if the block group loop was interrupted. Reviewed-by: Qu Wenruo Signed-off-by: Robbie Ko Signed-off-by: jinbaohong Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1cc4ada4182fadb82837831cabf1027bff0322d7 Author: jinbaohong Date: Wed Jan 28 07:06:39 2026 +0000 btrfs: preserve first error in btrfs_trim_fs() When multiple block groups or devices fail during trim, preserve the first error encountered rather than the last one. The first error is typically more useful for debugging as it represents the original failure, while subsequent errors may be cascading effects. Signed-off-by: Robbie Ko Signed-off-by: jinbaohong Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 912d1c6680bdb40b72b1b9204706f32b6eb842c3 Author: jinbaohong Date: Wed Jan 28 07:06:38 2026 +0000 btrfs: continue trimming remaining devices on failure Commit 93bba24d4b5a ("btrfs: Enhance btrfs_trim_fs function to handle error better") intended to make device trimming continue even if one device fails, tracking failures and reporting them at the end. However, it used 'break' instead of 'continue', causing the loop to exit on the first device failure. Fix this by replacing 'break' with 'continue'. Fixes: 93bba24d4b5a ("btrfs: Enhance btrfs_trim_fs function to handle error better") CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Qu Wenruo Signed-off-by: Robbie Ko Signed-off-by: jinbaohong Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 719dc4b75561f7f11ff42ccf8401fcac72d3804f Author: Filipe Manana Date: Fri Jan 23 10:05:12 2026 +0000 btrfs: do not BUG_ON() in btrfs_remove_block_group() There's no need to BUG_ON(), we can just abort the transaction and return an error. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6f926597f9837577f5ada47eaa764fea4a2ca9a3 Author: Filipe Manana Date: Fri Jan 23 09:49:57 2026 +0000 btrfs: abort transaction on error in btrfs_remove_block_group() When btrfs_remove_block_group() fails we abort the transaction in its single caller (btrfs_remove_chunk()). This makes it harder to find out where exactly the failure happened, as several steps inside btrfs_remove_block_group() can fail. So make btrfs_remove_block_group() abort the transaction whenever an error happens, instead of aborting in its caller. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3a1f4264daed4b419c325a7fe35e756cada3cf82 Author: Boris Burkov Date: Mon Dec 22 16:15:44 2025 -0800 btrfs: fix block_group_tree dirty_list corruption When the incompat flag EXTENT_TREE_V2 is set, we unconditionally add the block group tree to the switch_commits list before calling switch_commit_roots, as we do for the tree root and the chunk root. However, the block group tree uses normal root dirty tracking and in any transaction that does an allocation and dirties a block group, the block group root will already be linked to a list by the dirty_list field and this use of list_add_tail() is invalid and corrupts the prev/next members of block_group_root->dirty_list. This is apparent on a subsequent list_del on the prev if we enable CONFIG_DEBUG_LIST: [32.1571] ------------[ cut here ]------------ [32.1572] list_del corruption. next->prev should beffff958890202538, but was ffff9588992bd538. (next=ffff958890201538) [32.1575] WARNING: lib/list_debug.c:65 at 0x0, CPU#3: sync/607 [32.1583] CPU: 3 UID: 0 PID: 607 Comm: sync Not tainted 6.18.0 #24PREEMPT(none) [32.1585] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS1.17.0-4.fc41 04/01/2014 [32.1587] RIP: 0010:__list_del_entry_valid_or_report+0x108/0x120 [32.1593] RSP: 0018:ffffaa288287fdd0 EFLAGS: 00010202 [32.1594] RAX: 0000000000000001 RBX: ffff95889326e800 RCX:ffff958890201538 [32.1596] RDX: ffff9588992bd538 RSI: ffff958890202538 RDI:ffffffff82a41e00 [32.1597] RBP: ffff958890202538 R08: ffffffff828fc1e8 R09:00000000ffffefff [32.1599] R10: ffffffff8288c200 R11: ffffffff828e4200 R12:ffff958890201538 [32.1601] R13: ffff95889326e958 R14: ffff958895c24000 R15:ffff958890202538 [32.1603] FS: 00007f0c28eb5740(0000) GS:ffff958af2bd2000(0000)knlGS:0000000000000000 [32.1605] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [32.1607] CR2: 00007f0c28e8a3cc CR3: 0000000109942005 CR4:0000000000370ef0 [32.1609] Call Trace: [32.1610] [32.1611] switch_commit_roots+0x82/0x1d0 [btrfs] [32.1615] btrfs_commit_transaction+0x968/0x1550 [btrfs] [32.1618] ? btrfs_attach_transaction_barrier+0x23/0x60 [btrfs] [32.1621] __iterate_supers+0xe8/0x190 [32.1622] ? __pfx_sync_fs_one_sb+0x10/0x10 [32.1623] ksys_sync+0x63/0xb0 [32.1624] __do_sys_sync+0xe/0x20 [32.1625] do_syscall_64+0x73/0x450 [32.1626] entry_SYSCALL_64_after_hwframe+0x76/0x7e [32.1627] RIP: 0033:0x7f0c28d05d2b [32.1632] RSP: 002b:00007ffc9d988048 EFLAGS: 00000246 ORIG_RAX:00000000000000a2 [32.1634] RAX: ffffffffffffffda RBX: 00007ffc9d988228 RCX:00007f0c28d05d2b [32.1636] RDX: 00007f0c28e02301 RSI: 00007ffc9d989b21 RDI:00007f0c28dba90d [32.1637] RBP: 0000000000000001 R08: 0000000000000001 R09:0000000000000000 [32.1639] R10: 0000000000000000 R11: 0000000000000246 R12:000055b96572cb80 [32.1641] R13: 000055b96572b19f R14: 00007f0c28dfa434 R15:000055b96572b034 [32.1643] [32.1644] irq event stamp: 0 [32.1644] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [32.1646] hardirqs last disabled at (0): []copy_process+0xb37/0x2260 [32.1648] softirqs last enabled at (0): []copy_process+0xb37/0x2260 [32.1650] softirqs last disabled at (0): [<0000000000000000>] 0x0 [32.1652] ---[ end trace 0000000000000000 ]--- Furthermore, this list corruption eventually (when we happen to add a new block group) results in getting the switch_commits and dirty_cowonly_roots lists mixed up and attempting to call update_root on the tree root which can't be found in the tree root, resulting in a transaction abort: [87.8269] BTRFS critical (device nvme1n1): unable to find root key (1 0 0) in tree 1 [87.8272] ------------[ cut here ]------------ [87.8274] BTRFS: Transaction aborted (error -117) [87.8275] WARNING: fs/btrfs/root-tree.c:153 at 0x0, CPU#4: sync/703 [87.8285] CPU: 4 UID: 0 PID: 703 Comm: sync Not tainted 6.18.0 #25 PREEMPT(none) [87.8287] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-4.fc41 04/01/2014 [87.8289] RIP: 0010:btrfs_update_root+0x296/0x790 [btrfs] [87.8295] RSP: 0018:ffffa58d035dfd60 EFLAGS: 00010282 [87.8297] RAX: ffff9a59126ddb68 RBX: ffff9a59126dc000 RCX: 0000000000000000 [87.8299] RDX: 0000000000000000 RSI: 00000000ffffff8b RDI: ffffffffc0b28270 [87.8301] RBP: ffff9a5904aec000 R08: 0000000000000000 R09: 00000000ffffefff [87.8303] R10: ffffffff9ac8c200 R11: ffffffff9ace4200 R12: 0000000000000001 [87.8305] R13: ffff9a59041740e8 R14: ffff9a5904aec1f7 R15: ffff9a590fdefaf0 [87.8307] FS: 00007f54cde6b740(0000) GS:ffff9a5b5a81c000(0000) knlGS:0000000000000000 [87.8309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [87.8310] CR2: 00007f54cde403cc CR3: 0000000112902004 CR4: 0000000000370ef0 [87.8312] Call Trace: [87.8313] [87.8314] ? _raw_spin_unlock+0x23/0x40 [87.8315] commit_cowonly_roots+0x1ad/0x250 [btrfs] [87.8317] ? btrfs_commit_transaction+0x79b/0x1560 [btrfs] [87.8320] btrfs_commit_transaction+0x8aa/0x1560 [btrfs] [87.8322] ? btrfs_attach_transaction_barrier+0x23/0x60 [btrfs] [87.8325] __iterate_supers+0xf1/0x170 [87.8326] ? __pfx_sync_fs_one_sb+0x10/0x10 [87.8327] ksys_sync+0x63/0xb0 [87.8328] __do_sys_sync+0xe/0x20 [87.8329] do_syscall_64+0x73/0x450 [87.8330] entry_SYSCALL_64_after_hwframe+0x76/0x7e [87.8331] RIP: 0033:0x7f54cdd05d2b [87.8336] RSP: 002b:00007fff1b58ff78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2 [87.8338] RAX: ffffffffffffffda RBX: 00007fff1b590158 RCX: 00007f54cdd05d2b [87.8340] RDX: 00007f54cde02301 RSI: 00007fff1b592b66 RDI: 00007f54cddba90d [87.8342] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [87.8344] R10: 0000000000000000 R11: 0000000000000246 R12: 000055e07ca96b80 [87.8346] R13: 000055e07ca9519f R14: 00007f54cddfa434 R15: 000055e07ca95034 [87.8348] [87.8348] irq event stamp: 0 [87.8349] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [87.8351] hardirqs last disabled at (0): [] copy_process+0xb37/0x21e0 [87.8353] softirqs last enabled at (0): [] copy_process+0xb37/0x21e0 [87.8355] softirqs last disabled at (0): [<0000000000000000>] 0x0 [87.8357] ---[ end trace 0000000000000000 ]--- [87.8358] BTRFS: error (device nvme1n1 state A) in btrfs_update_root:153: errno=-117 Filesystem corrupted [87.8360] BTRFS info (device nvme1n1 state EA): forced readonly [87.8362] BTRFS warning (device nvme1n1 state EA): Skipping commit of aborted transaction. [87.8364] BTRFS: error (device nvme1n1 state EA) in cleanup_transaction:2037: errno=-117 Filesystem corrupted Since the block group tree was pulled out of the extent tree and uses normal root dirty tracking, remove the offending extra list_add. This fixes the list corruption and the resulting fs corruption. Fixes: 14033b08a029 ("btrfs: don't save block group root into super block") Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit c757edbef980d4e5d70749d3c98e00279af58b96 Author: Johannes Thumshirn Date: Mon Jan 26 09:05:24 2026 +0100 btrfs: fix copying the flags of btrfs_bio after split When a btrfs_bio gets split, only 'bbio->csum_search_commit_root' gets copied to the new btrfs_bio, all the other flags don't. When a bio is split in btrfs_submit_chunk(), btrfs_split_bio() creates the new split bio via btrfs_bio_init() which zeroes the struct with memset. Looking at btrfs_split_bio(), it copies csum_search_commit_root from the original but does not copy can_use_append. After the split, the code does: bbio = split; bio = &bbio->bio; This means the split bio (with can_use_append = false) gets submitted, not the original. In btrfs_submit_dev_bio(), the condition: if (btrfs_bio(bio)->can_use_append && btrfs_dev_is_sequential(...)) Will be false for the split bio even when writing to a sequential zone. Does the split bio need to inherit can_use_append from the original? The old code used a local variable use_append which persisted across the split. Copy the rest of the flags as well. Link: https://lore.kernel.org/linux-btrfs/20260125132120.2525146-1-clm@meta.com/ Reported-by: Chris Mason Reviewed-by: Qu Wenruo Reviewed-by: Boris Burkov Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3fe608dbac8c3d714472fab424bf522f39a3f60b Author: Johannes Thumshirn Date: Fri Jan 23 09:14:44 2026 +0100 btrfs: zoned: use local fs_info variable in btrfs_load_block_group_dup() btrfs_load_block_group_dup() has a local pointer to fs_info, yet the error prints dereference fs_info from the block_group. Use local fs_info variable to make the code more uniform. Reviewed-by: Daniel Vacek Reviewed-by: Qu Wenruo Reviewed-by: Naohiro Aota Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 52ee9965d09b2c56a027613db30d1fb20d623861 Author: Naohiro Aota Date: Fri Jan 23 21:41:36 2026 +0900 btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10 When a block group is composed of a sequential write zone and a conventional zone, we recover the (pseudo) write pointer of the conventional zone using the end of the last allocated position. However, if the last extent in a block group is removed, the last extent position will be smaller than the other real write pointer position. Then, that will cause an error due to mismatch of the write pointers. We can fixup this case by moving the alloc_offset to the corresponding write pointer position. Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit e2d848649e64de39fc1b9c64002629b4daa1105d Author: Naohiro Aota Date: Fri Jan 23 21:41:35 2026 +0900 btrfs: zoned: fixup last alloc pointer after extent removal for DUP When a block group is composed of a sequential write zone and a conventional zone, we recover the (pseudo) write pointer of the conventional zone using the end of the last allocated position. However, if the last extent in a block group is removed, the last extent position will be smaller than the other real write pointer position. Then, that will cause an error due to mismatch of the write pointers. We can fixup this case by moving the alloc_offset to the corresponding write pointer position. Fixes: c0d90a79e8e6 ("btrfs: zoned: fix alloc_offset calculation for partly conventional block groups") CC: stable@vger.kernel.org # 6.16+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit dda3ec9ee6b3e120603bff1b798f25b51e54ac5d Author: Naohiro Aota Date: Wed Dec 17 20:14:04 2025 +0900 btrfs: zoned: fixup last alloc pointer after extent removal for RAID1 When a block group is composed of a sequential write zone and a conventional zone, we recover the (pseudo) write pointer of the conventional zone using the end of the last allocated position. However, if the last extent in a block group is removed, the last extent position will be smaller than the other real write pointer position. Then, that will cause an error due to mismatch of the write pointers. We can fixup this case by moving the alloc_offset to the corresponding write pointer position. Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 3f8982543dae28159cec5fad33c1b3f5cd12314b Author: Filipe Manana Date: Tue Jan 20 20:07:32 2026 +0000 btrfs: remove out label in btrfs_wait_for_commit() There is no point in having the label since all it does is return the value in the 'ret' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5eb01bf4a9407e8d825ac9ee5b5a1ef2c1972e61 Author: Filipe Manana Date: Tue Jan 20 20:06:57 2026 +0000 btrfs: remove out label in btrfs_init_space_info() There is no point in having the label since all it does is return the value in the 'ret' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cefef3cc128076813a7ba5cf34f80130dce3f0a2 Author: Filipe Manana Date: Tue Jan 20 20:06:20 2026 +0000 btrfs: remove out label in btrfs_check_rw_degradable() There is no point in having the label since all it does is return the value in the 'ret' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 61fb7f04ee06e6c7e113a490af1a057f958f1d05 Author: Filipe Manana Date: Tue Jan 20 20:05:43 2026 +0000 btrfs: remove out label in finish_verity() There is no point in having the label since all it does is return the value in the 'ret' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6329592ca65222183aaebb377b8a828ecf85e55f Author: Filipe Manana Date: Tue Jan 20 20:05:02 2026 +0000 btrfs: remove out label in scrub_find_fill_first_stripe() There is no point in having the label since all it does is return the value in the 'ret' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 55807025a63fc727527cea790792e08c08e2e3c4 Author: Filipe Manana Date: Tue Jan 20 20:04:26 2026 +0000 btrfs: remove out label in lzo_decompress() There is no point in having the label since all it does is return the value in the 'ret' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 610ff1c9df5499aed83d6a1ca2e9e9a2aefecc13 Author: Filipe Manana Date: Tue Jan 20 20:03:45 2026 +0000 btrfs: remove out label in btrfs_mark_extent_written() There is no point in having the label since all it does is return the value in the 'ret' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cc27540dd09571938cf8e9c80a311b403ac073c4 Author: Filipe Manana Date: Tue Jan 20 20:02:51 2026 +0000 btrfs: remove out label in btrfs_csum_file_blocks() There is no point in having the label since all it does is return the value in the 'ret' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit bb09b9a4917cb5f040dbce66c236c9adae2eeaea Author: Filipe Manana Date: Tue Jan 20 20:01:31 2026 +0000 btrfs: remove out_failed label in find_lock_delalloc_range() There is no point in having the label since all it does is return the value in the 'found' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2efcd25a7638dd217e2fea01107416e24a2d1935 Author: Filipe Manana Date: Tue Jan 20 19:59:13 2026 +0000 btrfs: remove out label in load_extent_tree_free() There is no point in having the label since all it does is return the value in the 'ret' variable. Instead make every goto return directly and remove the label. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1038614e8f2c045561db0cf2b064a0e5cb909a1c Author: Filipe Manana Date: Tue Jan 20 19:58:06 2026 +0000 btrfs: remove pointless out labels from uuid-tree.c Some functions (btrfs_uuid_iter_rem() and btrfs_check_uuid_tree_entry()) have an 'out' label that does nothing but return, making it pointless. Simplify this by removing the label and returning instead of gotos plus setting the 'ret' variable. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 47c9dbc791e0bfb4ed6b0ce866f9fc848db39e6c Author: Filipe Manana Date: Tue Jan 20 19:55:54 2026 +0000 btrfs: remove pointless out labels from inode.c Some functions (insert_inline_extent() and insert_reserved_file_extent()) have an 'out' label that does nothing but return, making it pointless. Simplify this by removing the label and returning instead of gotos plus setting the 'ret' variable. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 46099eaef3716ea31557c5312ee69460b0c57c0c Author: Filipe Manana Date: Tue Jan 20 19:54:00 2026 +0000 btrfs: remove pointless out labels from free-space-cache.c Some functions (update_cache_item(), find_free_space(), trim_bitmaps(), btrfs_remove_free_space() and cleanup_free_space_cache_v1()) have an 'out' label that does nothing but return, making it pointless. Simplify this by removing the label and returning instead of gotos plus setting the 'ret' variable. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ea8f9210050136bdd14f5e32b04cd01c8bd5c0ca Author: Filipe Manana Date: Tue Jan 20 19:52:10 2026 +0000 btrfs: remove pointless out labels from extent-tree.c Some functions (lookup_extent_data_ref(), __btrfs_mod_ref() and btrfs_free_tree_block()) have an 'out' label that does nothing but return, making it pointless. Simplify this by removing the label and returning instead of gotos plus setting the 'ret' variable. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3ca4f9d0963e80435c7b69e2a8fd2b683085a3e6 Author: Filipe Manana Date: Tue Jan 20 19:50:03 2026 +0000 btrfs: remove pointless out labels from disk-io.c Some functions (btrfs_validate_extent_buffer() and btrfs_start_pre_rw_mount()) have an 'out' label that does nothing but return, making it pointless. Simplify this by removing the label and returning instead of gotos plus setting the 'ret' variable. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b3acb158ea1a2c9deb1bbff8360001a6a179dc9b Author: Filipe Manana Date: Tue Jan 20 19:48:33 2026 +0000 btrfs: remove pointless out labels from qgroup.c Some functions (__del_qgroup_relation() and qgroup_trace_new_subtree_blocks()) have an 'out' label that does nothing but return, making it pointless. Simplify this by removing the label and returning instead of gotos plus setting the 'ret' variable. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ccba88cb6ac0f936c0adcaf4c1a213086c7f3457 Author: Filipe Manana Date: Tue Jan 20 11:29:02 2026 +0000 btrfs: remove pointless out labels from send.c Some functions (process_extent(), process_recorded_refs_if_needed(), changed_inode(), compare_refs() and changed_cb()) have an 'out' label that does nothing but return, making it pointless. Simplify this by removing the label and returning instead of gotos plus setting the 'ret' variable. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 01f93271ed0218937bd6386d6d6deccd92621a38 Author: Filipe Manana Date: Tue Jan 20 11:25:31 2026 +0000 btrfs: remove pointless out labels from ioctl.c Some functions (__btrfs_ioctl_snap_create(), btrfs_ioctl_subvol_setflags() and copy_to_sk()) have an 'out' label that does nothing but return, making it pointless. Simplify this by removing the label and returning instead of gotos plus setting up the 'ret' variable. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 51b1fcf71c88c3c89e7dcf07869c5de837b1f428 Author: Filipe Manana Date: Tue Jan 20 19:35:23 2026 +0000 btrfs: qgroup: return correct error when deleting qgroup relation item If we fail to delete the second qgroup relation item, we end up returning success or -ENOENT in case the first item does not exist, instead of returning the error from the second item deletion. Fixes: 73798c465b66 ("btrfs: qgroup: Try our best to delete qgroup relations") Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8ad2f2edc82b8ffde54eab36a677cfb3be2236e1 Author: David Sterba Date: Fri Jan 9 18:17:43 2026 +0100 btrfs: pass btrfs_fs_info to btrfs_first_delayed_node() As the delayed root is now in the fs_info we can pass it to btrfs_first_delayed_node(). Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 2891539a26899f7cc5c281ce7060a1a8b3631a74 Author: David Sterba Date: Fri Jan 9 18:17:42 2026 +0100 btrfs: don't use local variables for fs_info->delayed_root In all cases the delayed_root is used once in a function, we don't need to use a local variable for that. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 86523d8d2f3ad16e865a0a47e725d6b2cf36fc78 Author: David Sterba Date: Fri Jan 9 18:17:41 2026 +0100 btrfs: reorder members in btrfs_delayed_root for better packing There are two unnecessary 4B holes in btrfs_delayed_root; struct btrfs_delayed_root { spinlock_t lock; /* 0 4 */ /* XXX 4 bytes hole, try to pack */ struct list_head node_list; /* 8 16 */ struct list_head prepare_list; /* 24 16 */ atomic_t items; /* 40 4 */ atomic_t items_seq; /* 44 4 */ int nodes; /* 48 4 */ /* XXX 4 bytes hole, try to pack */ wait_queue_head_t wait; /* 56 24 */ /* size: 80, cachelines: 2, members: 7 */ /* sum members: 72, holes: 2, sum holes: 8 */ /* last cacheline: 16 bytes */ }; Reordering 'nodes' after 'lock' reduces size by 8B, to 72 on release config. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit c8bafc8d6a78bdc484749816668d6f415d008fe8 Author: David Sterba Date: Fri Jan 9 18:17:40 2026 +0100 btrfs: embed delayed root to struct btrfs_fs_info The fs_info::delayed_root is allocated dynamically but there's only one instance per filesystem so we can embed it into the fs_info itself. The two object have the same lifetime and delayed roots are always present so we don't need to allocate it on demand from slab. There's still some space left in fs_info until the 4K so there won't be an spill over to next page on release config (size grows from 3880 to 3952). In case we want to shrink fs_info there are still holes to fill or we can separate other non-core or optional structures if needed. Link: https://lore.kernel.org/all/cover.1767979013.git.dsterba@suse.com/ Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 71e545d4e33f97258bf7416c132b10a6c1234255 Author: Qu Wenruo Date: Thu Jan 22 09:38:00 2026 +1030 btrfs: add strict extent map alignment checks Currently we do not check the alignment of extent_map structure. The reasons are the inode and extent-map tests use unaligned values for start offsets and lengths. Thankfully those legacy problems are properly addressed by previous patches, now we can finally put the alignment checks into validate_extent_map(). Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 385c65f8274b8caff75102474c4c9e8a95e6ec4c Author: Qu Wenruo Date: Thu Jan 22 09:37:59 2026 +1030 btrfs: tests: prepare extent map tests for strict alignment checks Currently the extent map self tests have the following points that will cause false alerts for the incoming strict extent map alignment checks: - Incorrect inlined extent map size Which is not following what the kernel is doing for inlined extents, as btrfs_extent_item_to_extent_map() always uses the fs block size as the length, not the ram_bytes. Fix it by using SZ_4K as extent map's length. - Incorrect btrfs_fs_info::sectorsize As we always use PAGE_SIZE, which can be values larger than 4K. Meanwhile all the immediate numbers used are based on 4K fs block size in the test case. Fix it by using fixed SZ_4K fs block size when allocating the dummy btrfs_fs_info. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit d77b90cfe08f4cf20dbbc255f8ef13bee831be63 Author: Qu Wenruo Date: Thu Jan 22 09:37:58 2026 +1030 btrfs: tests: remove invalid file extent map tests In the inode self tests, there are several problems: - Invalid file extents E.g. hole range [4K, 4K + 4) is completely invalid. Only inlined extent maps can have an unaligned ram_bytes, and even for that case, the generated extent map will use sectorsize as em->len. - Unaligned hole after inlined extent The kernel never does this by itself, the current btrfs_get_extent() will only return a single inlined extent map that covers the first block. - Incorrect numbers in the comment E.g. 12291 no matter if you add or dec 1, is not aligned to 4K. The properly number for 12K is 12288, I don't know why there is even a diff of 3, and this completely doesn't match the extent map we inserted later. - Hard-to-modify sequence in setup_file_extents() If some unfortunate person, just like me, needs to modify setup_file_extents(), good luck not screwing up the file offset. Fix them by: - Remove invalid unaligned extent maps This mostly means remove the [4K, 4K + 4) hole case. The remaining ones are already properly aligned. This slightly changes the on-disk data extent allocation, with that removed, the regular extents at [4K, 8K) and [8K , 12K) can be merged. So also add a 4K gap between those two data extents to prevent em merge. - Remove the implied hole after an inlined extent Just like what the kernel is doing for inlined extents in the real world. - Update the commit using proper numbers with 'K' suffixes Since there is no unaligned range except the first inlined one, we can always use numbers with 'K' suffixes, which is way more easier to read, and will always be aligned to 1024 at least. - Add comments in setup_file_extents() So that we're clear about the file offset for each test file extent. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 571e75f4c0dba42e57496015987285ed4380d041 Author: Filipe Manana Date: Wed Jan 21 16:35:56 2026 +0000 btrfs: unfold transaction aborts in btrfs_finish_one_ordered() We have a single transaction abort that can be caused either by a failure from a call to btrfs_mark_extent_written(), if we are dealing with a write to a prealloc extent, or otherwise from a call to insert_ordered_extent_file_extent(). So when the transaction abort happens we can not know for sure which case failed. Unfold the aborts so that it's clear in case of a failure. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a8bec25e014eab671ec8a25b03d391cad3e55230 Author: Filipe Manana Date: Wed Jan 21 20:48:35 2026 +0000 btrfs: deal with missing root in sample_block_group_extent_item() In case the root does not exists, which is unexpected, btrfs_extent_root() returns NULL, but we ignore that and so if it happens we can trigger a NULL pointer dereference later. So verify if we found the root and log an error message in case it's missing. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 79d51b5c7a2c64f3420ff632df67a76bf01a46ed Author: Filipe Manana Date: Wed Jan 21 20:42:53 2026 +0000 btrfs: remove bogus root search condition in sample_block_group_extent_item() There's no need to pass the maximum between the block group's start offset and BTRFS_SUPER_INFO_OFFSET (64K) since we can't have any block groups allocated in the first megabyte, as that's reserved space. Furthermore, even if we could, the correct thing to do was to pass the block group's start offset anyway - and that's precisely what we do for block groups that happen to contain superblock mirror (the range for the super block is never marked as free and it's marked as dirty in the fs_info->excluded_extents io tree). So simplify this and get rid of that maximum expression. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7c2830f00c3e086292c1ee9f27b61efaf8e76c9a Author: Qu Wenruo Date: Sat Nov 1 10:22:16 2025 +1030 btrfs: fallback to buffered IO if the data profile has duplication [BACKGROUND] Inspired by a recent kernel bug report, which is related to direct IO buffer modification during writeback, that leads to contents mismatch of different RAID1 mirrors. [CAUSE AND PROBLEMS] The root cause is exactly the same explained in commit 968f19c5b1b7 ("btrfs: always fallback to buffered write if the inode requires checksum"), that we can not trust direct IO buffer which can be modified halfway during writeback. Unlike data checksum verification, if this happened on inodes without data checksum but has the data has extra mirrors, it will lead to stealth data mismatch on different mirrors. This will be way harder to detect without data checksum. Furthermore for RAID56, we can even have data without checksum and data with checksum mixed inside the same full stripe. In that case if the direct IO buffer got changed halfway for the nodatasum part, the data with checksum immediately lost its ability to recover, e.g.: " " = Good old data or parity calculated using good old data "X" = Data modified during writeback 0 32K 64K Data 1 | | Has csum Data 2 |XXXXXXXXXXXXXXXX | No csum Parity | | In above case, the parity is calculated using data 1 (has csum, from page cache, won't change during writeback), and old data 2 (has no csum, direct IO write). After parity is calculated, but before submission to the storage, direct IO buffer of data 2 is modified, causing the range [0, 32K) of data 2 has a different content. Now all data is submitted to the storage, and the fs got fully synced. Then the device of data 1 is lost, has to be rebuilt from data 2 and parity. But since the data 2 has some modified data, and the parity is calculated using old data, the recovered data is no the same for data 1, causing data checksum mismatch. [FIX] Fix the problem by checking the data allocation profile. If our data allocation profile is either RAID0 or SINGLE, we can allow true zero-copy direct IO and the end user is fully responsible for any race. However this is not going to fix all situations, as it's still possible to race with balance where the fs got a new data profile after the data allocation profile check. But this fix should still greatly reduce the window of the original bug. Link: https://bugzilla.kernel.org/show_bug.cgi?id=99171 Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 954f3217f60277ea035d747275df0ec5c68ad65c Author: Filipe Manana Date: Tue Jan 20 12:09:20 2026 +0000 btrfs: assert block group is locked in btrfs_use_block_group_size_class() It's supposed to be called with the block group locked, in order to read and set its size_class member, so assert it's locked. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0bf63d385f2c6e8bcf9133b35decbffe80ed7da9 Author: Filipe Manana Date: Tue Jan 20 12:02:23 2026 +0000 btrfs: don't pass block group argument to load_block_group_size_class() There's no need to pass the block group since we can extract it from the given caching control structure. Same goes for its helper function sample_block_group_extent_item(). Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e46a9f84bfe8f3662b3ae8ad183d6067888b5469 Author: Filipe Manana Date: Tue Jan 20 11:55:14 2026 +0000 btrfs: allocate path on stack in load_block_group_size_class() Instead of allocating and freeing a path in every iteration of load_block_group_size_class(), through its helper function sample_block_group_extent_item(), allocate the path in the former and pass it to the later. The path is allocated on stack since it's short and we are in a workqueue context so there's not much stack usage. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 17078525e5be48381a35068535feb9adb36635f3 Author: Filipe Manana Date: Tue Jan 20 11:42:43 2026 +0000 btrfs: make load_block_group_size_class() return void There's no point in returning anything since determining and setting a size class for a block group is an optimization, not something critical. The only caller of load_block_group_size_class() (the caching thread) does not do anything with the return value anyway, exactly because having a size class is just an optimization and it can always be set later when adding reserved bytes to a block group (btrfs_add_reserved_bytes()). Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1914b94231e98280de4ec3a7f10e7abfd928c649 Author: Qu Wenruo Date: Tue Jan 20 10:30:10 2026 +1030 btrfs: zstd: use folio_iter to handle zstd_decompress_bio() Currently zstd_decompress_bio() is using compressed_bio->compressed_folios[] array to grab each compressed folio. However cb->compressed_folios[] is just a pointer to each folio of the compressed bio, meaning we can just replace the compressed_folios[] array by just grabbing the folio inside the compressed bio. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 20c993134e105368b9165cb9af8d8c1c2ac59a2d Author: Qu Wenruo Date: Tue Jan 20 10:30:09 2026 +1030 btrfs: zlib: use folio_iter to handle zlib_decompress_bio() Currently zlib_decompress_bio() is using compressed_bio->compressed_folios[] array to grab each compressed folio. However cb->compressed_folios[] is just a pointer to each folio of the compressed bio, meaning we can just replace the compressed_folios[] array by just grabbing the folio inside the compressed bio. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 37cc07cab7dc311f2b7aeaaa7598face53eddcab Author: Qu Wenruo Date: Tue Jan 20 10:30:08 2026 +1030 btrfs: lzo: use folio_iter to handle lzo_decompress_bio() Currently lzo_decompress_bio() is using compressed_bio->compressed_folios[] array to grab each compressed folio. This is making the code much easier to read, as we only need to maintain a single iterator, @cur_in, and can easily grab any random folio using @cur_in >> min_folio_shift as an index. However lzo_decompress_bio() itself is ensured to only advance to the next folio at one time, and compressed_folios[] is just a pointer to each folio of the compressed bio, thus we have no real random access requirement for lzo_decompress_bio(). Replace the compressed_folios[] access by a helper, get_current_folio(), which uses folio_iter and an external folio counter to properly switch the folio when needed. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4b7ecd0984e34262430b9db7efbfaf293b4b4d3c Author: Sun YangKai Date: Wed Jan 14 11:47:03 2026 +0800 btrfs: consolidate reclaim readiness checks in btrfs_should_reclaim() Move the filesystem state validation from btrfs_reclaim_bgs_work() into btrfs_should_reclaim() to centralize the reclaim eligibility logic. Since it is the only caller of btrfs_should_reclaim(), there's no functional change. Reviewed-by: Boris Burkov Reviewed-by: Johannes Thumshirn Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 19eff93dc738e8afaa59cb374b44bb5a162e6c2d Author: Sun YangKai Date: Wed Jan 14 11:47:02 2026 +0800 btrfs: fix periodic reclaim condition Problems with current implementation: 1. reclaimable_bytes is signed while chunk_sz is unsigned, causing negative reclaimable_bytes to trigger reclaim unexpectedly 2. The "space must be freed between scans" assumption breaks the two-scan requirement: first scan marks block groups, second scan reclaims them. Without the second scan, no reclamation occurs. Instead, track actual reclaim progress: pause reclaim when block groups will be reclaimed, and resume only when progress is made. This ensures reclaim continues until no further progress can be made. And resume periodic reclaim when there's enough free space. And we take care if reclaim is making any progress now, so it's unnecessary to set periodic_reclaim_ready to false when failed to reclaim a block group. Fixes: 813d4c6422516 ("btrfs: prevent pathological periodic reclaim loops") CC: stable@vger.kernel.org # 6.12+ Suggested-by: Boris Burkov Reviewed-by: Boris Burkov Signed-off-by: Sun YangKai Signed-off-by: David Sterba commit de62f138f95eacd71121d9fdc4815cb90a56ccbd Author: Johannes Thumshirn Date: Tue Jan 20 09:19:46 2026 +0100 btrfs: don't pass io_ctl to __btrfs_write_out_cache() There's no need to pass both the block_group and block_group::io_ctl to __btrfs_write_out_cache(). Remove passing io_ctl to __btrfs_write_out_cache() and dereference it inside __btrfs_write_out_cache(). Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit ea7ab405c55b6ac4b5c3e61ef37cf697067e3c71 Author: Filipe Manana Date: Fri Jan 16 10:57:00 2026 +0000 btrfs: use the btrfs_extent_map_end() helper everywhere We have a helper to calculate an extent map's exclusive end offset, but we only use it in some places. Update every site that open codes the calculation to use the helper. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4ac81c381102bebf09a47946b343d70ed455c646 Author: Filipe Manana Date: Fri Jan 16 10:24:06 2026 +0000 btrfs: use the btrfs_block_group_end() helper everywhere We have a helper to calculate a block group's exclusive end offset, but we only use it in some places. Update every site that open codes the calculation to use the helper. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 57a4a863cda8b02dc0d46a36ec5cd5f86993b7aa Author: Johannes Thumshirn Date: Mon Jan 19 08:17:50 2026 +0100 btrfs: remove bogus NULL checks in __btrfs_write_out_cache() Dan reported a new smatch warning in free-space-cache.c: New smatch warnings: fs/btrfs/free-space-cache.c:1207 write_pinned_extent_entries() warn: variable dereferenced before check 'block_group' (see line 1203) But the check if the block_group pointer is NULL is bogus, because to get to this point block_group::io_ctl has already been dereferenced further up the call-chain when calling __btrfs_write_out_cache() from btrfs_write_out_cache(). Remove the bogus checks for block_group == NULL in __btrfs_write_out_cache() and it's siblings. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601170636.WsePMV5H-lkp@intel.com/ Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2aef934b56b3ae07c292831cf9bf6bafcaaa005e Author: Mark Harmstone Date: Wed Jan 7 14:09:17 2026 +0000 btrfs: populate fully_remapped_bgs_list on mount Add a function btrfs_populate_fully_remapped_bgs_list() which gets called on mount, which looks for fully remapped block groups (i.e. identity_remap_count == 0) which haven't yet had their chunk stripes and device extents removed. This happens when a filesystem is unmounted while async discard has not yet finished, as otherwise the data range occupied by the chunk stripes would be permanently unusable. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 7cddbb4339d4be16aa5341e3a27e63c34d2c4e0d Author: Mark Harmstone Date: Wed Jan 7 14:09:16 2026 +0000 btrfs: handle discarding fully-remapped block groups Discard normally works by iterating over the free-space entries of a block group. This doesn't work for fully-remapped block groups, as we removed their free-space entries when we started relocation. For sync discard, call btrfs_discard_extent() when we commit the transaction in which the last identity remap was removed. For async discard, add a new function btrfs_trim_fully_remapped_block_group() to be called by the discard worker, which iterates over the block group's range using the normal async discard rules. Once we reach the end, remove the chunk's stripes and device extents to get back its free space. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 81e5a4551c32b454468f5aa3fe45dabb6bccb854 Author: Mark Harmstone Date: Wed Jan 7 14:09:15 2026 +0000 btrfs: allow balancing remap tree Balancing the METADATA_REMAP chunk, i.e. the chunk in which the remap tree lives, is a special case. We can't use the remap tree itself for this, as then we'd have no way to boostrap it on mount. And we can't use the pre-remap tree code for this as it relies on walking the extent tree, and we're not creating backrefs for METADATA_REMAP chunks. So instead, if a balance would relocate any METADATA_REMAP block groups, mark those block groups as readonly and COW every leaf of the remap tree. There's more sophisticated ways of doing this, such as only COWing nodes within a block group that's to be relocated, but they're fiddly and with lots of edge cases. Plus it's not anticipated that a) the number of METADATA_REMAP chunks is going to be particularly large, or b) that users will want to only relocate some of these chunks - the main use case here is to unbreak RAID conversion and device removal. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit a645372e7e40be088828ad99aa9a6c68f83ef00d Author: Mark Harmstone Date: Wed Jan 7 14:09:14 2026 +0000 btrfs: add do_remap parameter to btrfs_discard_extent() btrfs_discard_extent() can be called either when an extent is removed or from walking the free-space tree. With a remapped block group these two things are no longer equivalent: the extent's addresses are remapped, while the free-space tree exclusively uses underlying addresses. Add a do_remap parameter to btrfs_discard_extent() and btrfs_map_discard(), saying whether or not the address needs to be run through the remap tree first. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit fd6594b1446cc753450bad8d0da6288da1ad7b96 Author: Mark Harmstone Date: Wed Jan 7 14:09:13 2026 +0000 btrfs: replace identity remaps with actual remaps when doing relocations Add a function do_remap_tree_reloc(), which does the actual work of doing a relocation using the remap tree. In a loop we call do_remap_reloc_trans(), which searches for the first identity remap for the block group. We call btrfs_reserve_extent() to find space elsewhere for it, and read the data into memory and write it to the new location. We then carve out the identity remap and replace it with an actual remap, which points to the new location in which to look. Once the last identity remap has been removed we call last_identity_remap_gone(), which, as with deletions, removes the chunk's stripes and device extents. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit bbea42dfb91f6901243958c83f26bbbd3a4a85fa Author: Mark Harmstone Date: Wed Jan 7 14:09:12 2026 +0000 btrfs: move existing remaps before relocating block group If when relocating a block group we find that `remap_bytes` > 0 in its block group item, that means that it has been the destination block group for another that has been remapped. We need to search the remap tree for any remap backrefs within this range, and move the data to a third block group. This is because otherwise btrfs_translate_remap() could end up following an unbounded chain of remaps, which would only get worse over time. We only relocate one block group at a time, so `remap_bytes` will only ever go down while we are doing this. Once we're finished we set the REMAPPED flag on the block group, which will permanently prevent any other data from being moved to within it. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit b56f35560b82e7f8d79aa9ee72720b06639a473c Author: Mark Harmstone Date: Wed Jan 7 14:09:11 2026 +0000 btrfs: handle setting up relocation of block group with remap-tree Handle the preliminary work for relocating a block group in a filesystem with the remap-tree flag set. If the block group is SYSTEM btrfs_relocate_block_group() proceeds as it does already, as bootstrapping issues mean that these block groups have to be processed the existing way. Similarly with METADATA_REMAP blocks, which are dealt with in a later patch. Otherwise we walk the free-space tree for the block group in question, recording any holes. These get converted into identity remaps and placed in the remap tree, and the block group's REMAPPED flag is set. From now on no new allocations are possible within this block group, and any I/O to it will be funnelled through btrfs_translate_remap(). We store the number of identity remaps in `identity_remap_count`, so that we know when we've removed the last one and the block group is fully remapped. The change in btrfs_read_roots() is because data relocations no longer rely on the data reloc tree as a hidden subvolume in which to do snapshots. (Thanks to Sun YangKai for his suggestions.) Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 979e1dc3d69e4c825eec05d05d9567b251f6ec23 Author: Mark Harmstone Date: Wed Jan 7 14:09:10 2026 +0000 btrfs: handle deletions from remapped block group Handle the case where we free an extent from a block group that has the REMAPPED flag set. Because the remap tree is orthogonal to the extent tree, for data this may be within any number of identity remaps or actual remaps. If we're freeing a metadata node, this will be wholly inside one or the other. btrfs_remove_extent_from_remap_tree() searches the remap tree for the remaps that cover the range in question, then calls remove_range_from_remap_tree() for each one, to punch a hole in the remap and adjust the free-space tree. For an identity remap, remove_range_from_remap_tree() will adjust the block group's `identity_remap_count` if this changes. If it reaches zero we mark the block group as fully remapped. For an identity remap, remove_range_from_remap_tree() will adjust the block group's `identity_remap_count` if this changes. If it reaches zero we mark the block group as fully remapped. Fully remapped block groups have their chunk stripes removed and their device extents freed, which makes the disk space available again to the chunk allocator. This happens asynchronously: in the cleaner thread for sync discard and nodiscard, and (in a later patch) in the discard worker for async discard. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 18ba649928711539dd124b4bf7682696b3f2e4a8 Author: Mark Harmstone Date: Wed Jan 7 14:09:09 2026 +0000 btrfs: redirect I/O for remapped block groups Change btrfs_map_block() so that if the block group has the REMAPPED flag set, we call btrfs_translate_remap() to obtain a new address. btrfs_translate_remap() searches the remap tree for a range corresponding to the logical address passed to btrfs_map_block(). If it is within an identity remap, this part of the block group hasn't yet been relocated, and so we use the existing address. If it is within an actual remap, we subtract the start of the remap range and add the address of its destination, contained in the item's payload. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 8620da16fb6be1fd9906374fa1c763a10c6918df Author: Mark Harmstone Date: Wed Jan 7 14:09:08 2026 +0000 btrfs: allow mounting filesystems with remap-tree incompat flag If we encounter a filesystem with the remap-tree incompat flag set, validate its compatibility with the other flags, and load the remap tree using the values that have been added to the superblock. The remap-tree feature depends on the free-space-tree, but no-holes and block-group-tree have been made dependencies to reduce the testing matrix. Similarly I'm not aware of any reason why mixed-bg and zoned would be incompatible with remap-tree, but this is blocked for the time being until it can be fully tested. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 7977011460cffc6f5a0cd830584c832c4aa07076 Author: Mark Harmstone Date: Wed Jan 7 14:09:07 2026 +0000 btrfs: add extended version of struct block_group_item Add a struct btrfs_block_group_item_v2, which is used in the block group tree if the remap-tree incompat flag is set. This adds two new fields to the block group item: `remap_bytes` and `identity_remap_count`. `remap_bytes` records the amount of data that's physically within this block group, but nominally in another, remapped block group. This is necessary because this data will need to be moved first if this block group is itself relocated. If `remap_bytes` > 0, this is an indicator to the relocation thread that it will need to search the remap-tree for backrefs. A block group must also have `remap_bytes` == 0 before it can be dropped. `identity_remap_count` records how many identity remap items are located in the remap tree for this block group. When relocation is begun for this block group, this is set to the number of holes in the free-space tree for this range. As identity remaps are converted into actual remaps by the relocation process, this number is decreased. Once it reaches 0, either because of relocation or because extents have been deleted, the block group has been fully remapped and its chunk's device extents are removed. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit bf8ff4b9f0aa3f9e49779c8d3edbdc11caa5cd05 Author: Mark Harmstone Date: Wed Jan 7 14:09:06 2026 +0000 btrfs: rename struct btrfs_block_group field commit_used to last_used Rename the field commit_used in struct btrfs_block_group to last_used, for clarity and consistency with the similar fields we're about to add. It's not obvious that commit_flags means "flags as of the last commit" rather than "flags related to a commit". Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit efcab3176eb28427177c6319e128b41efd03ffdd Author: Mark Harmstone Date: Wed Jan 7 14:09:05 2026 +0000 btrfs: don't add metadata items for the remap tree to the extent tree There is the following potential problem with the remap tree and delayed refs: * Remapped extent freed in a delayed ref, which removes an entry from the remap tree * Remap tree now small enough to fit in a single leaf * Corruption as we now have a level-0 block with a level-1 metadata item in the extent tree One solution to this would be to rework the remap tree code so that it operates via delayed refs. But as we're hoping to remove cow-only metadata items in the future anyway, change things so that the remap tree doesn't have any entries in the extent tree. This also has the benefit of reducing write amplification. We also make it so that the clear_cache mount option is a no-op, as with the extent tree v2, as the free-space tree can no longer be recreated from the extent tree. Finally disable relocating the remap tree itself, which is added back in a later patch. As it is we would get corruption as the traditional relocation method walks the extent tree, and we're removing its metadata items. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 76377db18a8fb96511b09643e407fe3f9b0a9357 Author: Mark Harmstone Date: Wed Jan 7 14:09:04 2026 +0000 btrfs: remove remapped block groups from the free-space-tree No new allocations can be done from block groups that have the REMAPPED flag set, so there's no value in their having entries in the free-space tree. Prevent a search through the free-space tree being scheduled for such a block group, and prevent any additions to the in-memory free-space tree. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit c3d6dda60c9da79a108592b14560e326384dbf4e Author: Mark Harmstone Date: Wed Jan 7 14:09:03 2026 +0000 btrfs: allow remapped chunks to have zero stripes When a chunk has been fully remapped, we are going to set its num_stripes to 0, as it will no longer represent a physical location on disk. Change tree-checker to allow for this, and fix read_one_chunk() to avoid a divide by zero. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Signed-off-by: David Sterba commit 0b4d29fa98ca1a49c4498353253f857573871ba0 Author: Mark Harmstone Date: Wed Jan 7 14:09:02 2026 +0000 btrfs: add METADATA_REMAP chunk type Add a new METADATA_REMAP chunk type, which is a metadata chunk that holds the remap tree. This is needed for bootstrapping purposes: the remap tree can't itself be remapped, and must be relocated the existing way, by COWing every leaf. The remap tree can't go in the SYSTEM chunk as space there is limited, because a copy of the chunk item gets placed in the superblock. The changes in fs/btrfs/volumes.h are because we're adding a new block group type bit after the profile bits, and so can no longer rely on the const_ilog2 trick. The sizing to 32MB per chunk, matching the SYSTEM chunk, is an estimate here, we can adjust it later if it proves to be too big or too small. This works out to be ~500,000 remap items, which for a 4KB block size covers ~2GB of remapped data in the worst case and ~500TB in the best case. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit ef6a31d035a1000071dc4846aebd02ad081db9e4 Author: Mark Harmstone Date: Wed Jan 7 14:09:01 2026 +0000 btrfs: add definitions and constants for remap-tree Add an incompat flag for the new remap-tree feature, and the constants and definitions needed to support it. Reviewed-by: Boris Burkov Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit c208aa0ef655bb9a3c379510802cadd0df512f0a Author: Filipe Manana Date: Thu Jan 15 21:17:35 2026 +0000 btrfs: add and use helper to compute the available space for a block group We have currently three places that compute how much available space a block group has. Add a helper function for this and use it in those places. Reviewed-by: Boris Burkov Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b322fa5ff1320430d9a8349cb57770a47399b690 Author: Filipe Manana Date: Tue Jan 13 16:42:57 2026 +0000 btrfs: tag as unlikely error handling in run_one_delayed_ref() We don't expect to get errors unless we have a corrupted fs, bad RAM or a bug. So tag the error handling as unlikely. This slightly reduces the module's text size on x86_64 using gcc 14.2.0-19 from Debian. Before this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1939458 172512 15592 2127562 2076ca fs/btrfs/btrfs.ko After this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1939398 172512 15592 2127502 20768e fs/btrfs/btrfs.ko Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 271cbe76354e83e56f8d81acad2dba1adb17a896 Author: Filipe Manana Date: Tue Jan 13 16:39:00 2026 +0000 btrfs: remove unnecessary else branch in run_one_delayed_ref() There is no need for an else branch to deal with an unexpected delayed ref type. We can just change the previous branch to deal with this by checking if the ref type is not BTRFS_EXTENT_OWNER_REF_KEY, since that branch is useless as it only sets 'ret' to zero when it's already zero. So merge the two branches. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c7d1d4ff56744074e005771aff193b927392d51f Author: Filipe Manana Date: Tue Jan 13 16:37:26 2026 +0000 btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() There is no need to BUG(), we can just return an error and log an error message. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 23d4f616cb879de3ffea9f686ac60b44740beacb Author: jinbaohong Date: Wed Jan 14 01:18:15 2026 +0000 btrfs: use READA_FORWARD_ALWAYS for device extent verification btrfs_verify_dev_extents() iterates through the entire device tree during mount to verify dev extents against chunks. Since this function scans the whole tree, READA_FORWARD_ALWAYS is more appropriate than READA_FORWARD. While the device tree is typically small (a few hundred KB even for multi-TB filesystems), using the correct readahead mode for full-tree iteration is more consistent with the intended usage. Signed-off-by: robbieko Signed-off-by: jinbaohong Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4681dbcfdc33d6627193425222819577a89857cc Author: Qu Wenruo Date: Sat Jan 10 10:08:28 2026 +1030 btrfs: shrink the size of btrfs_device There are two main causes of holes inside btrfs_device: - The single bytes member of last_flush_error Not only it's a single byte member, but we never really care about the exact error number. - The @devt member Which is placed between two u64 members. Shrink the size of btrfs_device by: - Use a single bit flag for flush error Use BTRFS_DEV_STATE_FLUSH_FAILED so that we no longer need that dedicated member. - Move @devt to the hole after dev_stat_values[] This reduces the size of btrfs_device from 528 to exact 512 bytes for x86_64. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8ecf596ed822d481d1ad0bb589a7d5b9a7e82898 Author: Filipe Manana Date: Fri Jan 9 12:09:18 2026 +0000 btrfs: update comment for delalloc flush and oe wait in btrfs_clone_files() Make the comment more detailed about why we need to flush delalloc and wait for ordered extent completion before attempting to invalidate the page cache. Reviewed-by: Qu Wenruo Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit ae23fee41b36a39f8e163580fe273ca3f88f2413 Author: Qu Wenruo Date: Thu Jan 8 14:31:03 2026 +1030 btrfs: remove experimental offload csum mode The offload csum mode was introduced to allow developers to compare the performance of generating checksum for data writes at different timings: - During btrfs_submit_chunk() This is the most common one, if any of the following condition is met we go this path: * The csum is fast For now it's CRC32C and xxhash. * It's a synchronous write * Zoned - Delay the checksum generation to a workqueue However since commit dd57c78aec39 ("btrfs: introduce btrfs_bio::async_csum") we no longer need to bother any of them. As if it's an experimental build, async checksum generation at the background will be faster anyway. And if not an experimental build, we won't even have the offload csum mode support. Considering the async csum will be the new default, let's remove the offload csum mode code. There will be no impact to end users, and offload csum mode is still under experimental features. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit e582f22030a7a59d4d0bb2881371df259d4a2ecd Author: David Sterba Date: Tue Jan 6 13:30:28 2026 +0100 btrfs: split btrfs_fs_closing() and change return type to bool There are two tests in btrfs_fs_closing() but checking the BTRFS_FS_CLOSING_DONE bit is done only in one place load_extent_tree_free(). As this is an inline we can reduce size of the generated code. The types can be also changed to bool as this becomes a simple condition. text data bss dec hex filename 1674006 146704 15560 1836270 1c04ee pre/btrfs.ko 1673772 146704 15560 1836036 1c0404 post/btrfs.ko DELTA: -234 Reviewed-by: Filipe Manana Signed-off-by: David Sterba commit 59615e2c1f63dfd65f74c166e803873d3362e51a Author: Qu Wenruo Date: Tue Jan 6 13:20:30 2026 +1030 btrfs: reject single block sized compression early Currently for an inode that needs compression, even if there is a delalloc range that is single fs block sized and can not be inlined, we will still go through the compression path. Then inside compress_file_range(), we have one extra check to reject single block sized range, and fall back to regular uncompressed write. This rejection is in fact a little too late, we have already allocated memory to async_chunk, delayed the submission, just to fallback to the same uncompressed write. Change the behavior to reject such cases earlier at inode_need_compress(), so for such single block sized range we won't even bother trying to go through compress path. And since the inline small block check is inside inode_need_compress() and compress_file_range() also calls that function, we no longer need a dedicate check inside compress_file_range(). Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit d6f6109fe4b32878df8a5d4143a055ea680b1f84 Author: Julia Lawall Date: Tue Dec 30 17:32:45 2025 +0100 btrfs: update outdated comment in __add_block_group_free_space() The function add_block_group_free_space() was renamed btrfs_add_block_group_free_space() by commit 6fc5ef782988 ("btrfs: add btrfs prefix to free space tree exported functions"). Update the comment accordingly. Do some reorganization of the next few lines to keep the comment within 80 characters. Signed-off-by: Julia Lawall Reviewed-by: David Sterba Signed-off-by: David Sterba commit d1a020a8d72731b80a01e1abdb8ff965ee278f69 Author: Qu Wenruo Date: Sat Dec 20 13:07:40 2025 +1030 btrfs: add mount time auto fix for orphan fst entries [BUG] Before btrfs-progs v6.16.1 release, mkfs.btrfs can leave free space tree entries for deleted chunks: # mkfs.btrfs -f -O fst $dev # btrfs ins dump-tree -t chunk $dev btrfs-progs v6.16 chunk tree leaf 22036480 items 4 free space 15781 generation 8 owner CHUNK_TREE leaf 22036480 flags 0x1(WRITTEN) backref revision 1 item 0 key (DEV_ITEMS DEV_ITEM 1) itemoff 16185 itemsize 98 item 1 key (FIRST_CHUNK_TREE CHUNK_ITEM 13631488) itemoff 16105 itemsize 80 ^^^ The first chunk is at 13631488 item 2 key (FIRST_CHUNK_TREE CHUNK_ITEM 22020096) itemoff 15993 itemsize 112 item 3 key (FIRST_CHUNK_TREE CHUNK_ITEM 30408704) itemoff 15881 itemsize 112 # btrfs ins dump-tree -t free-space-tree $dev btrfs-progs v6.16 free space tree key (FREE_SPACE_TREE ROOT_ITEM 0) leaf 30556160 items 13 free space 15918 generation 8 owner FREE_SPACE_TREE leaf 30556160 flags 0x1(WRITTEN) backref revision 1 item 0 key (1048576 FREE_SPACE_INFO 4194304) itemoff 16275 itemsize 8 free space info extent count 1 flags 0 item 1 key (1048576 FREE_SPACE_EXTENT 4194304) itemoff 16275 itemsize 0 free space extent item 2 key (5242880 FREE_SPACE_INFO 8388608) itemoff 16267 itemsize 8 free space info extent count 1 flags 0 item 3 key (5242880 FREE_SPACE_EXTENT 8388608) itemoff 16267 itemsize 0 free space extent ^^^ Above 4 items are all before the first chunk. item 4 key (13631488 FREE_SPACE_INFO 8388608) itemoff 16259 itemsize 8 free space info extent count 1 flags 0 item 5 key (13631488 FREE_SPACE_EXTENT 8388608) itemoff 16259 itemsize 0 free space extent ... This can trigger btrfs check errors. [CAUSE] It's a bug in free space tree implementation of btrfs-progs, which doesn't delete involved fst entries for the to-be-deleted chunk/block group. [ENHANCEMENT] The mostly common fix is to clear the space cache and rebuild it, but that requires a ro->rw remount which may not be possible for rootfs, and also relies on users to use "clear_cache" mount option manually. Here introduce a kernel fix for it, which will delete any entries that is before the first block group automatically at the first RW mount. For filesystems without such problem, the overhead is just a single tree search and no modification to the free space tree, thus the overhead should be minimal. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit fdb945f6659374c9628509517901d49035b0e984 Author: Zhen Ni Date: Fri Dec 19 15:36:49 2025 +0800 btrfs: simplify check for zoned NODATASUM writes in btrfs_submit_chunk() This function already dereferences 'inode' multiple times earlier, making the additional NULL check at line 840 redundant since the function would have crashed already if inode were NULL. After commit 81cea6cd7041 ("btrfs: remove btrfs_bio::fs_info by extracting it from btrfs_bio::inode"), the btrfs_bio::inode field is mandatory for all btrfs_bio allocations and is guaranteed to be non-NULL. Simplify the condition for allocating dummy checksums for zoned NODATASUM data by removing the unnecessary 'inode &&' check. Reviewed-by: Johannes Thumshirn Signed-off-by: Zhen Ni Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8d206b0c21ef9b230627ff742170130912a1db3a Author: Filipe Manana Date: Wed Dec 17 15:53:59 2025 +0000 btrfs: avoid transaction commit on error in insert_balance_item() There's no point in committing the transaction if we failed to insert the balance item, since we haven't done anything else after we started/joined the transaction. Also stop using two variables for tracking the return value and use only 'ret'. Reviewed-by: Daniel Vacek Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7d7608cc9ad8acc0d03dd85175558cb2cd634f86 Author: Filipe Manana Date: Wed Dec 17 13:15:42 2025 +0000 btrfs: move unlikely checks around btrfs_is_shutdown() into the helper Instead of surrounding every caller of btrfs_is_shutdown() with unlikely, move the unlikely into the helper itself, like we do in other places in btrfs and is common in the kernel outside btrfs too. Also make the fs_info argument of btrfs_is_shutdown() const. On a x86_84 box using gcc 14.2.0-19 from Debian, this resulted in a slight reduction of the module's text size. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1939044 172568 15592 2127204 207564 fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1938876 172568 15592 2127036 2074bc fs/btrfs/btrfs.ko Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 858f32937c8ad5519c5daa9d5498963fe0bd0139 Author: Filipe Manana Date: Wed Dec 17 13:04:21 2025 +0000 btrfs: tag as unlikely error conditions in the transaction commit path Errors are unexpected during the transaction commit path, and when they happen we abort the transaction (by calling cleanup_transaction() under the label 'cleanup_transaction' in btrfs_commit_transaction()). So mark every error check in the transaction commit path as unlikely, to hint the compiler so that it can possibly generate better code, and make it clear for a reader about being unexpected. On a x86_84 box using gcc 14.2.0-19 from Debian, this resulted in a slight reduction of the module's text size. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1939476 172568 15592 2127636 207714 fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1939044 172568 15592 2127204 207564 fs/btrfs/btrfs.ko Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4cdb457a23751a1debebbf7d010300fe4eff47a8 Author: Zhen Ni Date: Thu Dec 18 11:30:37 2025 +0800 btrfs: remove unreachable return after btrfs_backref_panic() in btrfs_backref_finish_upper_links() The return statement after btrfs_backref_panic() is unreachable since btrfs_backref_panic() calls BUG() which never returns. Remove the return to unify it with the other calls to btrfs_backref_panic(). Signed-off-by: Zhen Ni Reviewed-by: David Sterba Signed-off-by: David Sterba commit c28214bde6da6e05554a0e5b6375b7b65f98cdbf Author: Qu Wenruo Date: Mon Dec 15 19:18:43 2025 +1030 btrfs: refactor the main loop of cow_file_range() Currently inside the main loop of cow_file_range(), we do the following sequence: - Reserve an extent - Lock the IO tree range - Create an IO extent map - Create an ordered extent Every step will need extra steps to do cleanup in the following order: - Drop the newly created extent map - Unlock extent range and cleanup the involved folios - Free the reserved extent However currently the error handling is done inconsistently: - Extent map drop is handled in a dedicated tag Out of the main loop, make it much harder to track. - The extent unlock and folios cleanup is done separately The extent is unlocked through btrfs_unlock_extent(), then extent_clear_unlock_delalloc() again in a dedicated tag. Meanwhile all other callsites (compression/encoded/nocow) all just call extent_clear_unlock_delalloc() to handle unlock and folio clean up in one go. - Reserved extent freeing is handled in a dedicated tag Out of the main loop, make it much harder to track. - Error handling of btrfs_reloc_clone_csums() is relying out-of-loop tags This is due to the special requirement to finish ordered extents to handle the metadata reserved space. Enhance the error handling and align the behavior by: - Introduce a dedicated cow_one_range() helper Which do the reserve/lock/allocation in the helper. And also handle the errors inside the helper. No more dedicated tags out of the main loop. - Use a single extent_clear_unlock_delalloc() to unlock and cleanup folios - Move the btrfs_reloc_clone_csums() error handling into the new helper Thankfully it's not that complex compared to other cases. And since we're here, also reduce the width of the following local variables to u32: - cur_alloc_size - min_alloc_size Each allocation won't go beyond 128M, thus u32 is more than enough. - blocksize The maximum is 64K, no need for u64. Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9da49784ae9fff59b6056d8a4018d95a16f9915b Author: Johannes Thumshirn Date: Wed Dec 17 14:41:39 2025 +0100 btrfs: zoned: print block-group type for zoned statistics When printing the zoned statistics, also include the block-group type in the block-group listing output. The updated output looks as follows: device /dev/vda mounted on /mnt with fstype btrfs zoned statistics: active block-groups: 9 reclaimable: 0 unused: 2 need reclaim: false data relocation block-group: 3221225472 active zones: start: 1073741824, wp: 268419072 used: 268419072, reserved: 0, unusable: 0 (DATA) start: 1342177280, wp: 0 used: 0, reserved: 0, unusable: 0 (DATA) start: 1610612736, wp: 81920 used: 16384, reserved: 16384, unusable: 49152 (SYSTEM) start: 1879048192, wp: 2031616 used: 1458176, reserved: 65536, unusable: 507904 (METADATA) start: 2147483648, wp: 268419072 used: 268419072, reserved: 0, unusable: 0 (DATA) start: 2415919104, wp: 268419072 used: 268419072, reserved: 0, unusable: 0 (DATA) start: 2684354560, wp: 268419072 used: 268419072, reserved: 0, unusable: 0 (DATA) start: 2952790016, wp: 65536 used: 65536, reserved: 0, unusable: 0 (DATA) start: 3221225472, wp: 0 used: 0, reserved: 0, unusable: 0 (DATA) Reviewed-by: Filipe Manana Reviewed-by: Naohiro Aota Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2ef2e97fe74e937a246681713434ca16d8e5552e Author: Johannes Thumshirn Date: Wed Dec 17 14:41:38 2025 +0100 btrfs: move space_info_flag_to_str() to space-info.h Move space_info_flag_to_str() to space-info.h and as it now isn't static to space-info.c any more prefix it with 'btrfs_'. This way it can be re-used in other places. Reviewed-by: Filipe Manana Reviewed-by: Naohiro Aota Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6a5ac228d4ad05c250de0bf06713d81bfb70c714 Author: Johannes Thumshirn Date: Wed Dec 17 14:41:37 2025 +0100 btrfs: zoned: show statistics about zoned filesystems in mountstats Add statistics output to /proc//mountstats for zoned BTRFS, similar to the zoned statistics from XFS in mountstats. The output for /proc//mountstats on an example filesystem will be as follows: device /dev/vda mounted on /mnt with fstype btrfs zoned statistics: active block-groups: 7 reclaimable: 0 unused: 5 need reclaim: false data relocation block-group: 1342177280 active zones: start: 1073741824, wp: 268419072 used: 0, reserved: 268419072, unusable: 0 start: 1342177280, wp: 0 used: 0, reserved: 0, unusable: 0 start: 1610612736, wp: 49152 used: 16384, reserved: 16384, unusable: 16384 start: 1879048192, wp: 950272 used: 131072, reserved: 622592, unusable: 196608 start: 2147483648, wp: 212238336 used: 0, reserved: 212238336, unusable: 0 start: 2415919104, wp: 0 used: 0, reserved: 0, unusable: 0 start: 2684354560, wp: 0 used: 0, reserved: 0, unusable: 0 Reviewed-by: Naohiro Aota Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 68d4ece9c30e966ebb92798ea54a7777daff384b Author: Filipe Manana Date: Tue Dec 16 16:27:57 2025 +0000 btrfs: don't call btrfs_handle_fs_error() in btrfs_commit_transaction() There's no need to call btrfs_handle_fs_error() as we are inside a transaction and if we get an error we jump to the 'scrub_continue' label and end up calling cleanup_transaction(), which aborts the transaction. This is odd given that we have a transaction handle and that in the transaction commit path any error makes us abort the transaction and it's the only place that calls btrfs_handle_fs_error(). Remove the btrfs_handle_fs_error() call and replace it with an error message so that if it happens we know what went wrong during the transaction commit. Also annotate the condition in the if statement with 'unlikely' since this is not expected to happen. We've been wanting to remove btrfs_handle_fs_error(), so this removes one user that does not even needs it. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d15a190d9efd59398ff08133238268784090066d Author: Filipe Manana Date: Tue Dec 16 16:01:01 2025 +0000 btrfs: don't call btrfs_handle_fs_error() in qgroup_account_snapshot() There's no need to call btrfs_handle_fs_error() as we are inside a transaction and we propagate the error returned from btrfs_write_and_wait_transaction() to the caller and it ends going up the call chain to btrfs_commit_transaction() (returned by the call to create_pending_snapshots()), where we jump to the 'unlock_reloc' label and end up calling cleanup_transaction(), which aborts the transaction. This is odd given that we have a transaction handle and that in the transaction commit path any error makes us abort the transaction and, besides another place inside btrfs_commit_transaction(), it's the only place that calls btrfs_handle_fs_error(). Remove the btrfs_handle_fs_error() call and replace it with an error message so that if it happens we know what went wrong during the transaction commit. Also annotate the condition in the if statement with 'unlikely' since this is not expected to happen. We've been wanting to remove btrfs_handle_fs_error(), so this removes one user that does not even need it. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c9b640cefac04112f63637b13d7ce9fbeecd6fb0 Author: Filipe Manana Date: Tue Dec 16 12:41:16 2025 +0000 btrfs: don't call btrfs_handle_fs_error() after failure to delete orphan item In btrfs_find_orphan_roots() we don't need to call btrfs_handle_fs_error() if we fail to delete the orphan item for the current root. This is because we haven't done anything yet regarding the current root and previous iterations of the loop dealt with other roots, so there's nothing we need to undo. Instead log an error message and return the error to the caller, which will result either in a mount failure or remount failure (the only contexts it's called from). Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8bc612906f2f77279c159242d0413a8a44aec126 Author: Filipe Manana Date: Tue Dec 16 12:31:11 2025 +0000 btrfs: don't call btrfs_handle_fs_error() after failure to join transaction In btrfs_find_orphan_roots() we don't need to call btrfs_handle_fs_error() if we fail to join a transaction. This is because we haven't done anything yet regarding the current root and previous iterations of the loop dealt with other roots, so there's nothing we need to undo. Instead log an error message and return the error to the caller, which will result either in a mount failure or remount failure (the only contexts it's called from). Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 19231903711e412dd2fe383dac0e48e5919bba4b Author: Filipe Manana Date: Tue Dec 16 12:02:18 2025 +0000 btrfs: remove redundant path release in btrfs_find_orphan_roots() There's no need to release the path in the if branch used when the root does not exists since we released the path before the call to btrfs_get_fs_root(). So remove that redundant btrfs_release_path() call. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8670a25ecb2fbc35d4e58f8f522e7d5b735d6778 Author: Filipe Manana Date: Tue Dec 16 11:56:04 2025 +0000 btrfs: use single return variable in btrfs_find_orphan_roots() We use both 'ret' and 'err' which is a pattern that generates confusion and resulted in subtle bugs in the past. Remove 'err' and use only 'ret'. Also move simplify the error flow by directly returning from the function instead of breaking of the loop, since there are no resources to cleanup after the loop. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cb73493cae906a7d6668b0e8077eb3a4ef0b2926 Author: Filipe Manana Date: Tue Dec 16 15:51:47 2025 +0000 btrfs: avoid transaction commit on error in del_balance_item() There's no point in committing the transaction if we failed to delete the item, since we haven't done anything before. Also stop using two variables for tracking the return value and use only 'ret'. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6d0f25cdd8e3248ee6e4899722d610083fe5aa6d Author: Filipe Manana Date: Fri Dec 12 17:22:36 2025 +0000 btrfs: update stale comment in __cow_file_range_inline() We mention that the reserved data space is page size aligned but that's not true anymore, as it's sector size aligned instead. In commit 0bb067ca64e3 ("btrfs: fix the qgroup data free range for inline data extents") we updated the amount passed to btrfs_qgroup_free_data() from page size to sector size, but forgot to update the comment. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3d47c0c8b57073b1389dd9c53291d81eb8951e18 Author: Filipe Manana Date: Mon Dec 15 18:36:32 2025 +0000 btrfs: remove duplicated root key setup in btrfs_create_tree() There's no need for an on stack key to define the root's key as we have already defined the key in the root itself. So remove the stack variable and use the key in the root. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4273db18a84ea3042b67864939e69b79eca50235 Author: Johannes Thumshirn Date: Mon Dec 15 11:38:18 2025 +0100 btrfs: zoned: re-flow prepare_allocation_zoned() Re-flow prepare allocation zoned to make it a bit more readable by returning early and removing unnecessary indentations. This patch does not change any functionality. Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3dcdcb7177632559e9392e755636a60e33e867b0 Author: Qu Wenruo Date: Tue Dec 9 07:55:03 2025 +1030 btrfs: shrink the size of btrfs_bio This is done by: - Shrink the size of btrfs_bio::mirror_num From 32 bits unsigned int to u16. Normally btrfs mirror number is either 0 (all profiles), 1 (all profiles), 2 (DUP/RAID1/RAID10/RAID5), 3 (RAID1C3) or 4 (RAID1C4). But for RAID6 the mirror number can go as large as the number of devices of that chunk. Currently the limit for number of devices for a data chunk is BTRFS_MAX_DEVS(), which is around 500 for the default 16K nodesize. And if going the max 64K nodesize, we can have a little over 2000 devices for a chunk. Although I'd argue it's way overkilled, we don't reject such cases yet thus u8 is not going to cut it, and have to use u16 (max out at 64K). - Use bit fields for boolean members Although it's not always safe for racy call sites, those members are safe. * csum_search_commit_root * is_scrub Those two are set immediately after bbio allocation and no more writes after allocation, thus they are very safe. * async_csum * can_use_append Those two are set for each split range, and after that there is no writes into those two members in different threads, thus they are also safe. And there are spaces for 4 more bits before increasing the size of btrfs_bio again, which should be future proof enough. - Reorder the structure members Now we always put the largest member first (after the huge 120 bytes union), making it easier to fill any holes. This reduce the size of btrfs_bio by 8 bytes, from 312 bytes to 304 bytes. Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit d6ee3fa8b31c42bb808c92177a24d051a509eb42 Author: David Sterba Date: Tue Dec 9 18:10:32 2025 +0100 btrfs: remove ASSERT compatibility for gcc < 8.x The minimum gcc version is 8 since 118c40b7b50340 ("kbuild: require gcc-8 and binutils-2.30"), the workaround for missing __VA_OPT__ support is not needed. Signed-off-by: David Sterba commit 01c8634c695d199de4a4669c5d684bbec148e71b Author: David Sterba Date: Tue Dec 9 18:10:31 2025 +0100 btrfs: pass level to _btrfs_printk() to avoid parsing level from string There's code in _btrfs_printk() to parse the message level from the input string so we can augment the message with the level description for better visibility in the logs. The parsing code has evolved over time, see commits: - 40f7828b36e3b9 ("btrfs: better handle btrfs_printk() defaults") - 262c5e86fec7cf ("printk/btrfs: handle more message headers") - 533574c6bc30cf ("btrfs: use printk_get_level and printk_skip_level, add __printf, fix fallout") - 4da35113426d16 ("btrfs: add varargs to btrfs_error") As we are using the specific level helpers everywhere we can simply pass the message level so we don't have to parse it. The proper printk() message header is created as KERN_SOH + "level". Signed-off-by: David Sterba commit c53d61e24086fc7893fa03b148f930c08bd3cd77 Author: David Sterba Date: Tue Dec 9 18:10:30 2025 +0100 btrfs: simplify internal btrfs_printk helpers The printk() can be compiled out depending on CONFIG_PRINTK, this is reflected in our helpers. The indirection is provided by btrfs_printk() used in the ratelimited and RCU wrapper macros. Drop the btrfs_printk() helper and define the ratelimit and RCU helpers directly when CONFIG_PRINTK is undefined. This will allow further changes to the _btrfs_printk() interface (which is internal), any message in other code should use the level-specific helpers. Signed-off-by: David Sterba commit a464ed9834d76e0709c55b2c763063751d0f35df Author: Johannes Thumshirn Date: Wed Dec 10 06:39:32 2025 +0100 btrfs: rename btrfs_create_block_group_cache to btrfs_create_block_group struct btrfs_block_group used to be called struct btrfs_block_group_cache but got renamed to btrfs_block_group with commit 32da5386d9a4 ("btrfs: rename btrfs_block_group_cache"). Rename btrfs_create_block_group_cache() to btrfs_create_block_group() to reflect that change. Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4b117be65ff41efae3694df449b9badb4e9d142e Author: David Sterba Date: Tue Dec 9 20:06:49 2025 +0100 btrfs: merge setting ret and return ret In many places we have pattern: ret = ...; return ret; This can be simplified to a direct return, removing 'ret' if not otherwise needed. The places in self tests are not converted so we can add more test cases without changing surrounding code (extent-map-tests.c:test_case_4()). Signed-off-by: David Sterba commit d7a5d511c098ed3e67912272c938627f04a1a9ad Author: Massimiliano Pellizzer Date: Thu Dec 4 22:09:59 2025 +0100 btrfs: remove dead assignment in prepare_one_folio() In prepare_one_folio(), ret is initialized to 0 at declaration, and in an error path we assign ret = 0 before jumping to the again label to retry the operation. However, ret is immediately overwritten by ret = set_folio_extent_mapped(folio) after the again label. Both assignments are never observed by any code path, therefore they can be safely removed. Signed-off-by: Massimiliano Pellizzer Reviewed-by: David Sterba Signed-off-by: David Sterba commit e6698b34fab33867ef3faeeea6feb165f31aae24 Author: Qu Wenruo Date: Wed Dec 10 19:02:34 2025 +1030 btrfs: replace for_each_set_bit() with for_each_set_bitmap() Inside extent_io.c, there are several simple call sites doing things like: for_each_set_bit(bit, bitmap, bitmap_size) { /* handle one fs block */ } The workload includes: - set_bit() Inside extent_writepage_io(). This can be replaced with a bitmap_set(). - btrfs_folio_set_lock() - btrfs_mark_ordered_io_finished() Inside writepage_delalloc(). Instead of calling it multiple times, we can pass a range into the function with one call. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 44820d80026e0b509007d41c83d42f1213ee8589 Author: Qu Wenruo Date: Wed Dec 10 19:02:33 2025 +1030 btrfs: concentrate the error handling of submit_one_sector() Currently submit_one_sector() has only one failure path from btrfs_get_extent(). However the error handling is split into two parts, one inside submit_one_sector(), which clears the dirty flag and finishes the writeback for the fs block. The other part is to submit any remaining bio inside bio_ctrl and mark the ordered extent finished for the fs block. There is no special reason that we must split the error handling, let's just concentrate all the error handling into submit_one_sector(). Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3970da5c3ba0993eba8b83c63726f61ef97e3ae7 Author: Qu Wenruo Date: Thu Dec 11 16:55:23 2025 +1030 btrfs: search for larger extent maps inside btrfs_do_readpage() [CORNER CASE] If we have the following file extents layout, btrfs_get_extent() can return a smaller hole during read, and cause unnecessary extra tree searches: item 6 key (257 EXTENT_DATA 0) itemoff 15810 itemsize 53 generation 9 type 1 (regular) extent data disk byte 13631488 nr 4096 extent data offset 0 nr 4096 ram 4096 extent compression 0 (none) item 7 key (257 EXTENT_DATA 32768) itemoff 15757 itemsize 53 generation 9 type 1 (regular) extent data disk byte 13635584 nr 4096 extent data offset 0 nr 4096 ram 4096 extent compression 0 (none) In above case, range [0, 4K) and [32K, 36K) are regular extents, and there is a hole in range [4K, 32K), and the fs has "no-holes" feature, meaning the hole will not have a file extent item. [INEFFICIENCY] Assume the system has 4K page size, and we're doing readahead for range [4K, 32K), no large folio yet. btrfs_readahead() for range [4K, 32K) |- btrfs_do_readpage() for folio 4K | |- get_extent_map() for range [4K, 8K) | |- btrfs_get_extent() for range [4K, 8K) | We hit item 6, then for the next item 7. | At this stage we know range [4K, 32K) is a hole. | But our search range is only [4K, 8K), not reaching 32K, thus | we go into not_found: tag, returning a hole em for [4K, 8K). | |- btrfs_do_readpage() for folio 8K | |- get_extent_map() for range [8K, 12K) | |- btrfs_get_extent() for range [8K, 12K) | We hit the same item 6, and then item 7. | But still we goto not_found tag, inserting a new hole em, | which will be merged with previous one. | | [ Repeat the same btrfs_get_extent() calls until the end ] So we're calling btrfs_get_extent() again and again, just for a different part of the same hole range [4K, 32K). [ENHANCEMENT] Make btrfs_do_readpage() to search for a larger extent map if readahead is involved. For btrfs_readahead() we have bio_ctrl::ractl set, and lock extents for the whole readahead range. If we find bio_ctrl::ractl is set, we can use that end range as extent map search end, this allows btrfs_get_extent() to return a much larger hole, thus reduce the need to call btrfs_get_extent() again and again. btrfs_readahead() for range [4K, 32K) |- btrfs_do_readpage() for folio 4K | |- get_extent_map() for range [4K, 32K) | |- btrfs_get_extent() for range [4K, 32K) | We hit item 6, then for the next item 7. | At this stage we know range [4K, 32K) is a hole. | So the hole em for range [4K, 32K) is returned. | |- btrfs_do_readpage() for folio 8K | |- get_extent_map() for range [8K, 32K) | The cached hole em range [4K, 32K) covers the range, | and reuse that em. | | [ Repeat the same btrfs_get_extent() calls until the end ] Now we only call btrfs_get_extent() once for the whole range [4K, 32K), other than the old 8 times. Such change will reduce the overhead of reading large holes a little. For current experimental build (with larger folios) on aarch64, there will be a tiny but consistent ~1% improvement reading a large hole file: Reading a 1GiB sparse file (all hole) using xfs_io, with 64K block size, the result is the time needed to read the whole file, reported from xfs_io. 32 runs, experimental build (with large folios). 64K page size, 4K fs block size. - Avg before: 0.20823 s - Avg after: 0.20635 s - Diff: -0.9% Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit fab0c0f03cfd0dfe793889e3374ebc68ecf18889 Author: Qu Wenruo Date: Wed Nov 26 08:20:21 2025 +1030 btrfs: introduce BTRFS_PATH_AUTO_RELEASE() helper There are already several bugs with on-stack btrfs_path involved, even it is already a little safer than btrfs_path pointers (only leaks the extent buffers, not the btrfs_path structure itself) - Patch "btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe()" - Patch "btrfs: fix a potential path leak in print_data_reloc_error()" Thus there is a real need to apply auto release for those on-stack paths. Introduces a new macro, BTRFS_PATH_AUTO_RELEASE() which defines one on-stack btrfs_path structure, initialize it all to 0, then call btrfs_release_path() on it when exiting the scope. This applies to current 3 on-stack path usages: - defrag_get_extent() in defrag.c - print_data_reloc_error() in inode.c There is a special case where we want to release the path early before the time consuming iterate_extent_inodes() call, thus that manual early release is kept as is, with an extra comment added. - scrub_radi56_parity_stripe() in scrub.c Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit ddea91780fecd349eb4b2c4036bfbf1ab5f75321 Author: Qu Wenruo Date: Mon Dec 8 07:43:58 2025 +1030 btrfs: enable direct IO for bs > ps cases Previously direct IO was disabled if the fs block size was larger than the page size, the reasons are: - Iomap direct IO can split the range ignoring the fs block alignment Which could trigger the bio size check from btrfs_submit_bio(). - The buffer is only ensured to be contiguous in user space memory The underlying physical memory is not ensured to be contiguous, and that can cause problems for the checksum generation/verification and RAID56 handling. However the above problems are solved by the following upstream commits: - 001397f5ef49 ("iomap: add IOMAP_DIO_FSBLOCK_ALIGNED flag") Which added an extra flag that can be utilized by the fs to ensure the bio submitted by iomap is always aligned to fs block size. - ec20799064c8 ("btrfs: enable encoded read/write/send for bs > ps cases") - 8870dbeedcf9 ("btrfs: raid56: enable bs > ps support") Which makes btrfs to handle bios that are not backed by large folios but still are aligned to fs block size. As the commits have been merged we can enable direct IO support for bs > ps cases. Reviewed-by: Neal Gompa Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit fe11ac191ce0ad910f6fda0c628bcff19fcff47d Author: Eric Biggers Date: Thu Dec 4 23:04:54 2025 -0800 btrfs: switch to library APIs for checksums Make btrfs use the library APIs instead of crypto_shash, for all checksum computations. This has many benefits: - Allows future checksum types, e.g. XXH3 or CRC64, to be more easily supported. Only a library API will be needed, not crypto_shash too. - Eliminates the overhead of the generic crypto layer, including an indirect call for every function call and other API overhead. A microbenchmark of btrfs_check_read_bio() with crc32c checksums shows a speedup from 658 cycles to 608 cycles per 4096-byte block. - Decreases the stack usage of btrfs by reducing the size of checksum contexts from 384 bytes to 240 bytes, and by eliminating the need for some functions to declare a checksum context at all. - Increases reliability. The library functions always succeed and return void. In contrast, crypto_shash can fail and return errors. Also, the library functions are guaranteed to be available when btrfs is loaded; there's no longer any need to use module softdeps to try to work around the crypto modules sometimes not being loaded. - Fixes a bug where blake2b checksums didn't work on kernels booted with fips=1. Since btrfs checksums are for integrity only, it's fine for them to use non-FIPS-approved algorithms. Note that with having to handle 4 algorithms instead of just 1-2, this commit does result in a slightly positive diffstat. That being said, this wouldn't have been the case if btrfs had actually checked for errors from crypto_shash, which technically it should have been doing. Reviewed-by: Ard Biesheuvel Reviewed-by: Neal Gompa Signed-off-by: Eric Biggers Reviewed-by: David Sterba Signed-off-by: David Sterba commit b39b26e017c7889181cb84032e22bef72e81cf29 Author: Johannes Thumshirn Date: Thu Dec 4 13:42:23 2025 +0100 btrfs: zoned: don't zone append to conventional zone In case of a zoned RAID, it can happen that a data write is targeting a sequential write required zone and a conventional zone. In this case the bio will be marked as REQ_OP_ZONE_APPEND but for the conventional zone, this needs to be REQ_OP_WRITE. The setting of REQ_OP_ZONE_APPEND is deferred to the last possible time in btrfs_submit_dev_bio(), but the decision if we can use zone append is cached in btrfs_bio. CC: Naohiro Aota Fixes: e9b9b911e03c ("btrfs: add raid stripe tree to features enabled with debug config") Reviewed-by: Christoph Hellwig Reviewed-by: Naohiro Aota Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit adb0af40fe89fd42f1ef277bf60d9cfa7c2ae472 Author: Boris Burkov Date: Mon Dec 1 15:35:02 2025 -0800 btrfs: relax squota parent qgroup deletion rule Currently, with squotas, we do not allow removing a parent qgroup with no members if it still has usage accounted to it. This makes it really difficult to recover from accounting bugs, as we have no good way of getting back to 0 usage. Instead, allow deletion (it's safe at 0 members..) while still warning about the inconsistency by adding a squota parent check. Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 9c46bcda5f347febdbb4d117fb21a37ffcec5fa4 Author: Boris Burkov Date: Mon Dec 1 15:33:49 2025 -0800 btrfs: check squota parent usage on membership change We could have detected the quick inherit bug more directly if we had an extra warning about squota hierarchy consistency while modifying the hierarchy. In squotas, the parent usage always simply adds up to the sum of its children, so we can just check for that when changing membership and detect more accounting bugs. Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit a5eb9024368dac8cc6b317c1577c6348e5334243 Author: Sun YangKai Date: Sat Nov 22 14:00:44 2025 +0800 btrfs: simplify boolean argument for btrfs_inc_ref()/btrfs_dec_ref() Replace open-coded if/else blocks with the boolean directly and introduce local const bool variables, making the code shorter and easier to read. Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8bfee251b7f5e54437e893c6daa964caded8a860 Author: Sun YangKai Date: Sat Nov 22 14:00:43 2025 +0800 btrfs: use true/false for boolean parameters in btrfs_inc_ref()/btrfs_dec_ref() Replace integer literals 0/1 with true/false when calling btrfs_inc_ref() and btrfs_dec_ref() to make the code self-documenting and avoid mixing bool/integer types. Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 53e83031494715482d11d3e1394058a10d96f486 Author: Sun YangKai Date: Mon Nov 24 11:53:05 2025 +0800 btrfs: update comment for visit_node_for_delete() Drop the obsolete @refs parameter from the comment so the argument list matches the current function signature after commit f8c4d59de23c9 ("btrfs: drop unused parameter refs from visit_node_for_delete()"). Reviewed-by: Johannes Thumshirn Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 87abe931fbc349d13407a3dd61e6e9a899389141 Author: Yao Zi Date: Mon Feb 2 04:16:10 2026 +0000 MIPS: tools: relocs: Ship a definition of R_MIPS_PC32 R_MIPS_PC32 is a GNU extension, its definition is available in glibc only since 2.39 (released in 2024), and not available in musl libc yet. Provide our own definition for R_MIPS_PC32 and use it if necessary to fix relocs tool building on musl and older glibc systems. Fixes: ff79d31eb536 ("mips: Add support for PC32 relocations in vmlinux") Signed-off-by: Yao Zi Link: https://patch.msgid.link/20260202041610.61389-1-me@ziyao.cc Signed-off-by: Nathan Chancellor commit 72043cf7f100cbd031981a726e31f4b20935902c Author: Diego Viola Date: Mon Feb 2 02:45:41 2026 -0300 streamline_config.pl: remove superfluous exclamation mark In order to make the output cleaner and more consistent with other scripts. Signed-off-by: Diego Viola Link: https://patch.msgid.link/20260202054541.17399-1-diego.viola@gmail.com Signed-off-by: Nathan Chancellor commit fae1c659d7bd5640012be21b5b5d6490b83c0df8 Merge: 43af6628f3f69d 29903edf04c25e Author: Jakub Kicinski Date: Mon Feb 2 20:05:51 2026 -0800 Merge branch 'devlink-and-mlx5-support-cross-function-rate-scheduling' Tariq Toukan says: ==================== devlink and mlx5: Support cross-function rate scheduling [part] Apply trivial cleanups from the series to make it smaller. ==================== Link: https://patch.msgid.link/20260128112544.1661250-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 29903edf04c25e63ba1475801fb7038d76c5054b Author: Cosmin Ratiu Date: Wed Jan 28 13:25:35 2026 +0200 devlink: Refactor devlink_rate_nodes_check devlink_rate_nodes_check() was used to verify there are no devlink rate nodes created when switching the esw mode. Rate management code is about to become more complex, so refactor this function: - remove unused param 'mode'. - add a new 'rate_filter' param. - rename to devlink_rates_check(). - expose devlink_rate_is_node() to be used as a rate filter. This makes it more usable from multiple places, so use it from those places as well. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260128112544.1661250-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 0061b5199d7c81076181a64529f7a799ebb89399 Author: Cosmin Ratiu Date: Wed Jan 28 13:25:33 2026 +0200 devlink: Reverse locking order for nested instances Commit [1] defined the locking expectations for nested devlink instances: the nested-in devlink instance lock needs to be acquired before the nested devlink instance lock. The code handling devlink rels was architected with that assumption in mind. There are no actual users of double locking yet but that is about to change in the upcoming patches in the series. Code operating on nested devlink instances will require also obtaining the nested-in instance lock, but such code may already be called from a variety of places with the nested devlink instance lock. Then, there's no way to acquire the nested-in lock other than making sure that all callers acquire it first. Reversing the nested lock order allows incrementally acquiring the nested-in instance lock when needed (perhaps even a chain of locks up to the root) without affecting any caller. The only affected use of nesting is devlink_nl_nested_fill(), which iterates over nested devlink instances with the RCU lock, without locking them, so there's no possibility of deadlock. So this commit just updates a comment regarding the nested locks. [1] commit c137743bce02b ("devlink: introduce object and nested devlink relationship infra") Signed-off-by: Cosmin Ratiu Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260128112544.1661250-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit c7c707cbaa5ed277836364da4033e141ff985678 Author: Ferry Meng Date: Mon Feb 2 11:09:09 2026 +0800 erofs: avoid some unnecessary #ifdefs They can either be removed or replaced with IS_ENABLED(). Signed-off-by: Ferry Meng Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 43af6628f3f69d7011d3fd6e0ef40246a7471d41 Merge: fbc73cbb777b58 69a586e8866b0c Author: Jakub Kicinski Date: Mon Feb 2 19:16:05 2026 -0800 Merge branch 'net-stmmac-pcs-preparation' Russell King says: ==================== net: stmmac: pcs preparation These three patches prepare for the PCS changes, which, subject to Qualcomm testing, should be coming in the next cycle. ==================== Link: https://patch.msgid.link/aXyRlFw7ZuhRPiKo@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 69a586e8866b0c49cfc5592da50d67b3cbfa45f4 Author: Russell King (Oracle) Date: Fri Jan 30 11:10:36 2026 +0000 net: stmmac: handle integrated PCS phy_intf_sel separately The dwmac core has no support for SGMII without using its integrated PCS. Thus, PHY_INTF_SEL_SGMII is only supported when this block is present, and it makes no sense for stmmac_get_phy_intf_sel() to decode this. None of the platform glue users that use stmmac_get_phy_intf_sel() directly accept PHY_INTF_SEL_SGMII as a valid mode. Check whether a PCS will be used by the driver for the interface mode, and if it is the integrated PCS, query the integrated PCS for the phy_intf_sel_i value to use. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vlmOa-00000006zvB-1fIe@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit eb4a1fda2c2fc72a86a724030cfc519565486d04 Author: Russell King (Oracle) Date: Fri Jan 30 11:10:31 2026 +0000 net: stmmac: move most PCS register definitions to stmmac_pcs.c Move most of the PCS register offset definitions to stmmac_pcs.c. Since stmmac_pcs.c only ever passes zero into the register offset macros, remove that ability, making them simple constant integer definitions. Add appropriate descriptions of the registers, pointing out their similarity with their IEEE 802.3 counterparts. Make use of the BMSR definitions for the GMAC_AN_STATUS register and remove the driver private versions. Note that BMSR_LSTATUS is non-low-latching, unlike it's 802.3z counterpart. Signed-off-by: Russell King (Oracle) Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vlmOV-00000006zv5-1CwO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 83957d6cae5b93849babf75f112bdc069871dc34 Author: Russell King (Oracle) Date: Fri Jan 30 11:10:26 2026 +0000 net: stmmac: clear half-duplex caps where unsupported Where a core supports hardware features, but does not indicate support for half-duplex, clear phylink's half-duplex 1G, 100M and 10M capability bits to disallow half-duplex operation and advertisement of these link modes. This will avoid the need for special code in the PCS driver to do this based on the ESTATUS register bits, as the support in the PCS is dependent on the same synthesis choice as the MAC core. Signed-off-by: Russell King (Oracle) Tested-by: Maxime Chevallier Reviewed-by: Maxime Chevallier Tested-by: Mohd Ayaan Anwar Link: https://patch.msgid.link/E1vlmOQ-00000006zuz-0ffN@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit fbc73cbb777b58fce41d24bdac9a739a1eac079a Merge: 84b86025f6d784 1ba377008420a6 Author: Jakub Kicinski Date: Mon Feb 2 19:12:19 2026 -0800 Merge branch 'add-support-for-renesas-rz-g3l-gbeth' Biju Das says: ==================== Add support for Renesas RZ/G3L GBETH From: Biju Das The Renesas RZ/G3L GBETH IP uses Synopsys DesignWare MAC version 5.30 compared to other Renesas SoC such as RZ/V2H that use MAC version 5.20. The RZ/G3L GBETH requires an extra clock compared to RZ/G3E and has pps interrupts. Document the Renesas RZ/G3L GBETH IP in bindings and add support for the RZ/G3L GBETH in dwmac-renesas-gbeth glue driver. ==================== Link: https://patch.msgid.link/20260131161250.5047-1-biju.das.jz@bp.renesas.com Signed-off-by: Jakub Kicinski commit 1ba377008420a63ba2cdbb3f5d1f9d30591f6c52 Author: Biju Das Date: Sat Jan 31 16:12:43 2026 +0000 net: stmmac: dwmac-renesas-gbeth: Add support for RZ/G3L SoC Compared to other Renesas GBETH stmmac glue drivers, RZ/G3L GBETH IP use the version Synopsys DesignWare MAC (version 5.30). It has an extra clock compared to RZ/V2H and has ptp_pps_o interrupts. Add support for RZ/G3L GBETH by reusing device data of RZ/V2H and can be extended to add other functionalities later. Reviewed-by: Russell King (Oracle) Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Link: https://patch.msgid.link/20260131161250.5047-3-biju.das.jz@bp.renesas.com Signed-off-by: Jakub Kicinski commit 3ac2aa31b489eb4e0e820757f336aa1ad41ed0e2 Author: Biju Das Date: Sat Jan 31 16:12:42 2026 +0000 dt-bindings: net: renesas,rzv2h-gbeth: Document Renesas RZ/G3L SoC Add device tree binding support for the Gigabit Ethernet (GBETH) IP on Renesas RZ/G3L SoC. This SoC uses different Synopsys DesignWare MAC version 5.30 compared to RZ/G3E. RZ/G3L requires an extra clock compared to RZ/G3E and has pps interrupts. Add a new compatible string "renesas,r9a08g046-gbeth" for RZ/G3L SoC and update the schema to handle hardware differences between SoC variants. Extend the base snps,dwmac.yaml schema to accommodate the PPS interrupts. Acked-by: Conor Dooley Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Link: https://patch.msgid.link/20260131161250.5047-2-biju.das.jz@bp.renesas.com Signed-off-by: Jakub Kicinski commit bc804a8d7e865ef47fb7edcaf5e77d18bf444ebc Author: Gao Xiang Date: Fri Jan 30 15:54:22 2026 +0800 erofs: handle end of filesystem properly for file-backed mounts I/O requests beyond the end of the filesystem should be zeroed out, similar to loopback devices and that is what we expect. Fixes: ce63cb62d794 ("erofs: support unencoded inodes for fileio") Signed-off-by: Gao Xiang commit 7cef3c8341940febf75db6c25199cd83fb74d52f Author: Gao Xiang Date: Thu Jan 29 10:41:25 2026 +0800 erofs: separate plain and compressed filesystems formally The EROFS on-disk format uses a tiny, plain metadata design that prioritizes performance and minimizes complex inconsistencies against common writable disk filesystems (almost all serious metadata inconsistency cannot happen in well-designed immutable filesystems like EROFS). EROFS deliberately avoids artificial design flaws to eliminate serious security risks from untrusted remote sources by design, although human-made implementation bugs can still happen sometimes. Currently, there is no strict check to prevent compressed inodes, especially LZ4-compressed inodes, from being read in plain filesystems. Starting with erofs-utils 1.0 and Linux 5.3, LZ4_0PADDING sb feature is automatically enabled for LZ4-compressed EROFS images to support in-place decompression. Furthermore, since Linux 5.4 LTS is no longer supported, we no longer need to handle ancient LZ4-compressed EROFS images generated by erofs-utils prior to 1.0. To formally distinguish different filesystem types for improved security: - Use the presence of LZ4_0PADDING or a non-zero `dsb->u1.lz4_max_distance` as a marker for compressed filesystems containing LZ4-compressed inodes only; - For other algorithms, use `dsb->u1.available_compr_algs` bitmap. Note: LZ4_0PADDING has been supported since Linux 5.4 (the first formal kernel version), so exposing it via sysfs is no longer necessary and is now deprecated (but remain it for five more years until 2031): `dsb->u1` has been strictly non-zero for all EROFS images containing compressed inodes starting with erofs-utils v1.3 and it is actually a much better marker for compressed filesystems. Signed-off-by: Gao Xiang commit 72558e2bed272b5ca8771ba14390160c876207f4 Author: Gao Xiang Date: Tue Feb 3 10:31:00 2026 +0800 erofs: use inode_set_cached_link() Symlink lengths are now cached in in-memory inodes directly so that readlink can be sped up. Signed-off-by: Gao Xiang commit 4d904af4d6ce29b9240ebecd35e31458d08cd577 Author: Ng Tze Yee Date: Fri Jan 30 09:46:57 2026 -0600 dt-bindings: intel: Add Agilex eMMC support Agilex devkit support a separate eMMC daughter card. Document Agilex eMMC daughter board compatible. [dinguyen] becauce of patch 1cb8486ac5f3 ("dt-bindings: arm: altera: combine Intel's SoCFPGA into altera.yaml"), I moved the change to altera.yaml file. Acked-by: Krzysztof Kozlowski Signed-off-by: Ng Tze Yee Signed-off-by: Dinh Nguyen commit d95d76aa772bf94df353b015b1cb38303d4a415d Author: Thorsten Blum Date: Sun Feb 1 22:52:48 2026 +0100 bpf: Replace snprintf("%s") with strscpy Replace snprintf("%s") with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20260201215247.677121-2-thorsten.blum@linux.dev Signed-off-by: Alexei Starovoitov commit d55493f6d2dae3a8e8b50fe82e947781a7735c51 Author: Gwendal Grignou Date: Mon Feb 2 02:06:21 2026 -0800 platform/chrome: lightbar: Fix lightbar_program_ex alignment Make sure sub-command of lightbar command starts with a 8bit parameter to ensure alignment. Fixes: 9600b8bdbfe4 ("platform/chrome: lightbar: Add support for large sequence") Signed-off-by: Gwendal Grignou Link: https://lore.kernel.org/r/20260202100621.3608437-1-gwendal@google.com Signed-off-by: Tzung-Bi Shih commit 84b86025f6d7844a208c53702c31b1d41aafe2c4 Merge: 74ad1dfe2335df 2f2dc84645fb25 Author: Jakub Kicinski Date: Mon Feb 2 18:15:35 2026 -0800 Merge branch 'mptcp-implement-read_sock-and-splice_read' Matthieu Baerts says: ==================== mptcp: implement .read_sock and .splice_read This series is a preparation work for future in-kernel MPTCP sockets usage. Here, two interfaces are implemented: read_sock and splice_read. As a result of this series, splice() with MPTCP sockets -- which was already supported -- is now improved. - Patches 1-2: .read_sock implementation - Patches 3-4: .splice_read implementation - Patches 5-6: validate splice() support with MPTCP sockets. ==================== Link: https://patch.msgid.link/20260130-net-next-mptcp-splice-v2-0-31332ba70d7f@kernel.org Signed-off-by: Jakub Kicinski commit 2f2dc84645fb25960a0f52aff4d754fce43edea4 Author: Geliang Tang Date: Fri Jan 30 20:24:29 2026 +0100 selftests: mptcp: connect: cover splice mode The "splice" alternate mode for mptcp_connect.sh/.c is available now, this patch adds mptcp_connect_splice.sh to test it in the MPTCP CI by default. Note that this mode is also supported by stable kernel versions, but optimised in this patch series. Suggested-by: Matthieu Baerts Signed-off-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260130-net-next-mptcp-splice-v2-6-31332ba70d7f@kernel.org Signed-off-by: Jakub Kicinski commit 6a059c6bfb557a8c72634d761d78463a6e224547 Author: Geliang Tang Date: Fri Jan 30 20:24:28 2026 +0100 selftests: mptcp: add splice io mode This patch adds a new 'splice' io mode for mptcp_connect to test the newly added read_sock() and splice_read() functions of MPTCP. do_splice() efficiently transfers data directly between two file descriptors (infd and outfd) without copying to userspace, using Linux's splice() system call. Usage: ./mptcp_connect.sh -m splice Signed-off-by: Geliang Tang Reviewed-by: Mat Martineau Co-developed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260130-net-next-mptcp-splice-v2-5-31332ba70d7f@kernel.org Signed-off-by: Jakub Kicinski commit 22f3bd9bf8e850e2b365ad65916ef5aadc79bb61 Author: Geliang Tang Date: Fri Jan 30 20:24:27 2026 +0100 mptcp: implement .splice_read This patch implements .splice_read interface of mptcp struct proto_ops as mptcp_splice_read() with reference to tcp_splice_read(). Corresponding to __tcp_splice_read(), __mptcp_splice_read() is defined, invoking mptcp_read_sock() instead of tcp_read_sock(). mptcp_splice_read() is almost the same as tcp_splice_read(), except for sock_rps_record_flow(). Signed-off-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260130-net-next-mptcp-splice-v2-4-31332ba70d7f@kernel.org Signed-off-by: Jakub Kicinski commit 2d85088d467ffbfa4377881be050937e3f0304bc Author: Geliang Tang Date: Fri Jan 30 20:24:26 2026 +0100 tcp: export tcp_splice_state Export struct tcp_splice_state and tcp_splice_data_recv() in net/tcp.h so that they can be used by MPTCP in the next patch. Suggested-by: Paolo Abeni Signed-off-by: Geliang Tang Acked-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260130-net-next-mptcp-splice-v2-3-31332ba70d7f@kernel.org Signed-off-by: Jakub Kicinski commit 250d9766a984a45f05893a496df6b682c105fbbc Author: Geliang Tang Date: Fri Jan 30 20:24:25 2026 +0100 mptcp: implement .read_sock Current in-kernel TCP sockets -- i.e. from nvme_tcp_try_recv() -- need to call .read_sock interface of struct proto_ops, but it's not implemented in MPTCP. This patch implements it with reference to __tcp_read_sock() and __mptcp_recvmsg_mskq(). Corresponding to tcp_recv_skb(), a new helper for MPTCP named mptcp_recv_skb() is added to peek a skb from sk->sk_receive_queue. Compared with __mptcp_recvmsg_mskq(), mptcp_read_sock() uses sk->sk_rcvbuf as the max read length. The LISTEN status is checked before the while loop, and mptcp_recv_skb() and mptcp_cleanup_rbuf() are invoked after the loop. In the loop, all flags checks for __mptcp_recvmsg_mskq() are removed. Reviewed-by: Hannes Reinecke Signed-off-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260130-net-next-mptcp-splice-v2-2-31332ba70d7f@kernel.org Signed-off-by: Jakub Kicinski commit 436510df0cafb1bc36f12e92e0e76599be28d8f4 Author: Geliang Tang Date: Fri Jan 30 20:24:24 2026 +0100 mptcp: add eat_recv_skb helper This patch extracts the free skb related code in __mptcp_recvmsg_mskq() into a new helper mptcp_eat_recv_skb(). This new helper will be used in the next patch. Signed-off-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260130-net-next-mptcp-splice-v2-1-31332ba70d7f@kernel.org Signed-off-by: Jakub Kicinski commit 74ad1dfe2335df7c1fd36139261c2fba6bcaea40 Merge: 8755aae4aa7569 562f59fe32914a Author: Jakub Kicinski Date: Mon Feb 2 18:06:02 2026 -0800 Merge branch 'ptp-vmclock-add-vm-generation-counter-and-acpi-notification' Takahiro Itazuri says: ==================== ptp: vmclock: Add VM generation counter and ACPI notification Similarly to live migration, starting a VM from some serialized state (aka snapshot) is an event which calls for adjusting guest clocks, hence a hypervisor should increase the disruption_marker before resuming the VM vCPUs, letting the guest know. However, loading a snapshot, is slightly different than live migration, especially since we can start multiple VMs from the same serialized state. Apart from adjusting clocks, the guest needs to take additional action during such events, e.g. recreate UUIDs, reset network adapters/connections, reseed entropy pools, etc. These actions are not necessary during live migration. This calls for a differentiation between the two triggering events. We differentiate between the two events via an extra field in the vmclock_abi, called vm_generation_counter. Whereas hypervisors should increase the disruption marker in both cases, they should only increase vm_generation_counter when a snapshot is loaded in a VM (not during live migration). Additionally, we attach an ACPI notification to VMClock. Implementing the notification is optional for the device. VMClock device will declare that it implements the notification by setting VMCLOCK_FLAG_NOTIFICATION_PRESENT bit in vmclock_abi flags. Hypervisors that implement the notification must send an ACPI notification every time seq_count changes to an even number. The driver will propagate these notifications to userspace via the poll() interface. ==================== Link: https://patch.msgid.link/20260130173704.12575-1-itazur@amazon.com Signed-off-by: Jakub Kicinski commit 562f59fe32914a10af8554634866bd0b56257060 Author: David Woodhouse Date: Fri Jan 30 17:36:06 2026 +0000 ptp: ptp_vmclock: return TAI not UTC To output UTC would involve complex calculations about whether the time elapsed since the reference time has crossed the end of the month when a leap second takes effect. I've prototyped that, but it made me sad. Much better to report TAI, which is what PHCs should do anyway. And much much simpler. Signed-off-by: David Woodhouse Signed-off-by: Babis Chalios Tested-by: Takahiro Itazuri Link: https://patch.msgid.link/20260130173704.12575-8-itazur@amazon.com Signed-off-by: Jakub Kicinski commit ac1e7404924cb4a1ab2993e64151e2ad2f461ab3 Author: David Woodhouse Date: Fri Jan 30 17:36:05 2026 +0000 ptp: ptp_vmclock: remove dependency on CONFIG_ACPI Now that we added device tree support we can remove dependency on CONFIG_ACPI. Signed-off-by: David Woodhouse Signed-off-by: Babis Chalios Tested-by: Takahiro Itazuri Link: https://patch.msgid.link/20260130173704.12575-7-itazur@amazon.com Signed-off-by: Jakub Kicinski commit ed4d23ed469ca14d47670c0384f6ae6c4ff060a5 Author: David Woodhouse Date: Fri Jan 30 17:36:04 2026 +0000 ptp: ptp_vmclock: add 'VMCLOCK' to ACPI device match As we finalised the spec, we spotted that vmgenid actually says that the _HID is supposed to be hypervisor-specific. Although in the 13 years since the original vmgenid doc was published, nobody seems to have cared about using _HID to distinguish between implementations on different hypervisors, and we only ever use the _CID. For consistency, match the _CID of "VMCLOCK" too. Signed-off-by: David Woodhouse Signed-off-by: Babis Chalios Tested-by: Takahiro Itazuri Link: https://patch.msgid.link/20260130173704.12575-6-itazur@amazon.com Signed-off-by: Jakub Kicinski commit ddc867d0b5db6f6692a059126f69672e74bf5f02 Author: David Woodhouse Date: Fri Jan 30 17:36:03 2026 +0000 ptp: ptp_vmclock: Add device tree support Add device tree support to the ptp_vmclock driver, allowing it to probe via device tree in addition to ACPI. Handle optional interrupt for clock disruption notifications, mirroring the ACPI notification behaviour. Although the interrupt is marked as 'optional' in the DT bindings, if the device *advertises* the VMCLOCK_FLAG_NOTIFICATION_ABSENT then it *should* have an interrupt. The driver will refuse to initialize if not. Signed-off-by: David Woodhouse Signed-off-by: Babis Chalios Signed-off-by: Takahiro Itazuri Tested-by: Takahiro Itazuri Link: https://patch.msgid.link/20260130173704.12575-5-itazur@amazon.com Signed-off-by: Jakub Kicinski commit 1d5a66045afa68226667b3607654064cb8269f8c Author: David Woodhouse Date: Fri Jan 30 17:36:02 2026 +0000 dt-bindings: ptp: Add amazon,vmclock The vmclock device provides a PTP clock source and precise timekeeping across live migration and snapshot/restore operations. The binding has a required memory region containing the vmclock_abi structure and an optional interrupt for clock disruption notifications. The full spec is at https://uapi-group.org/specifications/specs/vmclock/ Signed-off-by: David Woodhouse Signed-off-by: Babis Chalios Reviewed-by: Krzysztof Kozlowski Tested-by: Takahiro Itazuri Link: https://patch.msgid.link/20260130173704.12575-4-itazur@amazon.com Signed-off-by: Jakub Kicinski commit 3b1526ddb25452385b52f2588b655f524a57070b Author: Babis Chalios Date: Fri Jan 30 17:36:01 2026 +0000 ptp: vmclock: support device notifications Add optional support for device notifications in VMClock. When supported, the hypervisor will send a device notification every time it updates the seq_count to a new even value. Moreover, add support for poll() in VMClock as a means to propagate this notification to user space. poll() will return a POLLIN event to listeners every time seq_count changes to a value different than the one last seen (since open() or last read()/pread()). This means that when poll() returns a POLLIN event, listeners need to use read() to observe what has changed and update the reader's view of seq_count. In other words, after a poll() returned, all subsequent calls to poll() will immediately return with a POLLIN event until the listener calls read(). The device advertises support for the notification mechanism by setting flag VMCLOCK_FLAG_NOTIFICATION_PRESENT in vmclock_abi flags field. If the flag is not present the driver won't setup the ACPI notification handler and poll() will always immediately return POLLHUP. Signed-off-by: Babis Chalios Signed-off-by: David Woodhouse Signed-off-by: Takahiro Itazuri Reviewed-by: David Woodhouse Tested-by: Takahiro Itazuri Link: https://patch.msgid.link/20260130173704.12575-3-itazur@amazon.com Signed-off-by: Jakub Kicinski commit 3495064b6d65a669b409cfe1241db4f3c540251a Author: Babis Chalios Date: Fri Jan 30 17:36:00 2026 +0000 ptp: vmclock: add vm generation counter Similar to live migration, loading a VM from some saved state (aka snapshot) is also an event that calls for clock adjustments in the guest. However, guests might want to take more actions as a response to such events, e.g. as discarding UUIDs, resetting network connections, reseeding entropy pools, etc. These are actions that guests don't typically take during live migration, so add a new field in the vmclock_abi called vm_generation_counter which informs the guest about such events. Hypervisor advertises support for vm_generation_counter through the VMCLOCK_FLAG_VM_GEN_COUNTER_PRESENT flag. Users need to check the presence of this bit in vmclock_abi flags field before using this flag. Signed-off-by: Babis Chalios Signed-off-by: David Woodhouse Reviewed-by: David Woodhouse Tested-by: Takahiro Itazur Link: https://patch.msgid.link/20260130173704.12575-2-itazur@amazon.com Signed-off-by: Jakub Kicinski commit 8755aae4aa7569f079135a0590dbd0f7adcfacf4 Merge: e0221553436b1c b409a7f7176bb8 Author: Jakub Kicinski Date: Mon Feb 2 17:49:31 2026 -0800 Merge branch 'ipv6-misc-changes-in-output-path' Eric Dumazet says: ==================== ipv6: misc changes in output path Small optimizations mostly in ip6_xmit() path. TX performance increases by about 3 %. Patches 5-7: add dst4_mtu() and dst6_mtu() to save space. Last patch colocates inet6_cork in inet_cork_full. This series reduces kernel size by 494 bytes on x86_64: scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 4/2 grow/shrink: 9/23 up/down: 665/-1159 (-494) Function old new delta ip6_finish_output_gso_slowpath_drop - 197 +197 ip6_xmit 1452 1595 +143 do_ipv6_getsockopt 2855 2950 +95 kzalloc_noprof - 55 +55 ip4ip6_err 918 955 +37 __icmp_send 1499 1532 +33 do_ip_getsockopt 2573 2605 +32 __ip6_append_data 4109 4137 +28 __pfx_kzalloc_noprof - 16 +16 __pfx_ip6_finish_output_gso_slowpath_drop - 16 +16 ipmr_prepare_xmit 1232 1238 +6 ip6_forward 1905 1909 +4 ip6_cork_release 108 111 +3 ipv6_push_nfrag_opts 489 486 -3 ipv6_push_frag_opts 90 87 -3 ip6_finish_output2 1446 1437 -9 ip6_tnl_xmit 2639 2627 -12 ip6_default_advmss 176 160 -16 __ip6_rt_update_pmtu 1087 1071 -16 tcp_v6_syn_recv_sock 1715 1696 -19 tcp_v4_syn_recv_sock 1107 1088 -19 __ip_make_skb 1339 1320 -19 ip_setup_cork 406 385 -21 ip6_setup_cork 732 710 -22 rawv6_push_pending_frames 581 556 -25 ip6_push_pending_frames 184 157 -27 udpv6_splice_eof 203 170 -33 ip6_flush_pending_frames 220 183 -37 ip6_append_data 349 312 -37 udp_v6_push_pending_frames 155 115 -40 sit_tunnel_xmit 1957 1914 -43 __pfx_dst_mtu 64 - -64 tcp_v4_mtu_reduced 289 220 -69 tcp_v6_mtu_reduced 209 139 -70 ip6_make_skb 574 484 -90 ip6_finish_output 827 697 -130 dst_mtu 160 - -160 fib6_nh_mtu_change 511 336 -175 Total: Before=22584400, After=22583906, chg -0.00% ==================== Link: https://patch.msgid.link/20260130210303.3888261-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b409a7f7176bb8fc0002b8592d14b11ebe481b1d Author: Eric Dumazet Date: Fri Jan 30 21:03:03 2026 +0000 ipv6: colocate inet6_cork in inet_cork_full All inet6_cork users also use one inet_cork_full. Reduce number of parameters and increase data locality. This saves ~275 bytes of code on x86_64. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260130210303.3888261-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit fe8570186f100b6cc499b2f7705946baf1388cde Author: Eric Dumazet Date: Fri Jan 30 21:03:02 2026 +0000 ipv4: use dst4_mtu() instead of dst_mtu() When we expect an IPv4 dst, use dst4_mtu() instead of dst_mtu() to save some code space. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260130210303.3888261-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit b40f0130a23b6bab8b359e158a40af81f11f14be Author: Eric Dumazet Date: Fri Jan 30 21:03:01 2026 +0000 ipv6: use dst6_mtu() instead of dst_mtu() When we expect an IPv6 dst, use dst6_mtu() instead of dst_mtu() to save some code space. Due to current dst6_mtu() implementation, only convert users in IPv6 stack. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260130210303.3888261-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8776c4ef3ab22b95f55713f00a7a576e6402507d Author: Eric Dumazet Date: Fri Jan 30 21:03:00 2026 +0000 inet: add dst4_mtu() and dst6_mtu() helpers With CONFIG_MITIGATION_RETPOLINE=y dst_mtu() is a bit fat, because it is generic. Indeed, clang does not always inline it. Add dst4_mtu() and dst6_mtu() helpers for callers that expect either ipv4_mtu() or ip6_mtu() to be called. These helpers are always inlined. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260130210303.3888261-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 94a150bf14af35e67c2ae9ca4650bfed42a9bc11 Author: Eric Dumazet Date: Fri Jan 30 21:02:59 2026 +0000 ipv6: use SKB_DROP_REASON_PKT_TOO_BIG in ip6_xmit() When a too big packet is dropped, use SKB_DROP_REASON_PKT_TOO_BIG. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260130210303.3888261-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit b5b1b676a30bfa045755cd7d8c782b9b498dac0d Author: Eric Dumazet Date: Fri Jan 30 21:02:58 2026 +0000 ipv6: use __skb_push() in ip6_xmit() ip6_xmit() makes sure there is enough headroom in the skb, it can uses __skb_push() instead of the out-of-line skb_push(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260130210303.3888261-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2855e4925416c5900a9c6cece11f4a2e56bf6e63 Author: Eric Dumazet Date: Fri Jan 30 21:02:57 2026 +0000 ipv6: add some unlikely()/likely() clauses in ip6_output.c 1) daddr is unlikely a multicast in ip6_finish_output2(). 2) ip6_finish_output_gso_slowpath_drop() should not be called often. 3) ip6_fragment() should not be called often. 4) opt is unlikely to be set. 5) ip6_xmit() and ip6_forward() mostly sends not too big packets. 6) Most __ip6_make_skb() calls are for UDP packets, not ICMPV6 ones. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260130210303.3888261-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1bc46dd209667346c5aa56c351995e7c260696d0 Author: Eric Dumazet Date: Fri Jan 30 21:02:56 2026 +0000 ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts() With CONFIG_STACKPROTECTOR_STRONG=y, it is better to avoid passing a pointer to an automatic variable. Change these exported functions to return 'u8 proto' instead of void. - ipv6_push_nfrag_opts() - ipv6_push_frag_opts() For instance, replace ipv6_push_frag_opts(skb, opt, &proto); with: proto = ipv6_push_frag_opts(skb, opt, proto); Note that even after this change, ip6_xmit() has to use a stack canary because of @first_hop variable. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260130210303.3888261-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit e0221553436b1c49a14ae251d95ea2e19c5b5a14 Author: Ethan Nelson-Moore Date: Fri Jan 30 16:42:56 2026 -0800 net: remove unnecessary module_init/exit functions Many network drivers have unnecessary empty module_init and module_exit functions. Remove them (including some that just print a message). Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore Acked-by: Marc Kleine-Budde Acked-by: Michael Grzeschik Reviewed-by: Ido Schimmel Acked-by: Ping-Ke Shih Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260131004327.18112-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 14e6cf8474e15f5599de2be7b66226138c0a9fc2 Author: Ethan Nelson-Moore Date: Fri Jan 30 18:24:30 2026 -0800 net: ethernet: use module_pci_driver; remove useless driver versions The module version is useless, and the only thing these drivers' init routines did besides pci_register_driver was to print the driver name and/or version. Acked-by: Francois Romieu (epic100) Reviewed-by: Simon Horman (epic100, sis900) Reviewed-by: Sai Krishna (epic100) Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260131022441.56274-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit dc9fd14bd75967d039262d73189fdd123edc5dce Author: Eric Dumazet Date: Fri Jan 30 16:02:53 2026 +0000 net: add a debug check in __skb_push() Add the following check, to detect bugs sooner for CONFIG_DEBUG_NET=y builds. DEBUG_NET_WARN_ON_ONCE(skb->data < skb->head); Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260130160253.2936789-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 87ef8c26ae40bbac8515f239cc02c3e08916ef4d Merge: 82f35bec11bd40 3d0721cfcf57a6 Author: Jakub Kicinski Date: Mon Feb 2 17:19:55 2026 -0800 Merge branch 'net-phy-dp83867-always-program-r-sgmii-enable-bits' Sean Anderson says: ==================== net: phy: dp83867: Always program R/SGMII enable bits The hardware designers at my company neglected to read the datasheet for this PHY and did not add appropriate resistors to configure it for SGMII. Add support for configuring the it based on phy-mode instead of relying on the resistors for a suitable default. ==================== Link: https://patch.msgid.link/20260129171205.3868605-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski commit 3d0721cfcf57a65518c4fded1712882f05c33642 Author: Sean Anderson Date: Thu Jan 29 12:12:05 2026 -0500 net: phy: dp83867: Always program R/SGMII enable bits If the board designers have neglected to populate the appropriate resistors on the strapping pins then the phy may default to the wrong interface mode. Enable/disable the RGMII/SGMII enable bits as necessary to select the correct interface. The dp83867 strapping pins have four levels and typically configure two features at once. LED_0 controls both port mirroring and whether SGMII is enabled. If it is pulled to VDDIO, both port mirroring and SGMII will be enabled. For variants of the dp83867 that do not support SGMII, this will prevent data from being transferred. As we now explicitly set the SGMII and RGMII enable bits, we do not need to detect whether SGMII has been inadvertently enabled. Signed-off-by: Sean Anderson Link: https://patch.msgid.link/20260129171205.3868605-3-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski commit d700b2a440518b087af2808b7db9ab091ed53a4a Author: Sean Anderson Date: Thu Jan 29 12:12:04 2026 -0500 net: phy: dp83867: Program TX FIFO for all interfaces All supported interfaces use the TX FIFO register at least some of the time, so there's no point in checking the interface. Retain the check for the RX FIFO level since it is only used by SGMII. Signed-off-by: Sean Anderson Link: https://patch.msgid.link/20260129171205.3868605-2-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski commit f6ae956dfb3402bf6d5726080c2999f107bb5dd2 Author: Christoph Hellwig Date: Mon Feb 2 07:06:36 2026 +0100 fs: consolidate fsverity_info lookup in buffer.c Look up the fsverity_info once in end_buffer_async_read_io, and then pass it along to the I/O completion workqueue in struct postprocess_bh_ctx. This amortizes the lookup better once it becomes less efficient. Signed-off-by: Christoph Hellwig Reviewed-by: "Darrick J. Wong" Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20260202060754.270269-8-hch@lst.de Signed-off-by: Eric Biggers commit 47bc2ac9b63da87362ce890543d8d955e0ccc36a Author: Christoph Hellwig Date: Mon Feb 2 07:06:35 2026 +0100 fsverity: push out fsverity_info lookup Pass a struct fsverity_info to the verification and readahead helpers, and push the lookup into the callers. Right now this is a very dumb almost mechanic move that open codes a lot of fsverity_info_addr() calls in the file systems. The subsequent patches will clean this up. This prepares for reducing the number of fsverity_info lookups, which will allow to amortize them better when using a more expensive lookup method. Signed-off-by: Christoph Hellwig Reviewed-by: "Darrick J. Wong" Acked-by: David Sterba # btrfs Link: https://lore.kernel.org/r/20260202060754.270269-7-hch@lst.de Signed-off-by: Eric Biggers commit 7e36e044958da7d2cbff391dcfda405f5472ae1d Author: Christoph Hellwig Date: Mon Feb 2 07:06:34 2026 +0100 fsverity: deconstify the inode pointer in struct fsverity_info A lot of file system code expects a non-const inode pointer. Dropping the const qualifier here allows using the inode pointer in verify_data_block and prepares for further argument reductions. Signed-off-by: Christoph Hellwig Reviewed-by: "Darrick J. Wong" Link: https://lore.kernel.org/r/20260202060754.270269-6-hch@lst.de Signed-off-by: Eric Biggers commit f1a6cf44b344b1ac2cefb387779e3002be237a7e Author: Christoph Hellwig Date: Mon Feb 2 07:06:33 2026 +0100 fsverity: kick off hash readahead at data I/O submission time Currently all reads of the fsverity hashes are kicked off from the data I/O completion handler, leading to needlessly dependent I/O. This is worked around a bit by performing readahead on the level 0 nodes, but still fairly ineffective. Switch to a model where the ->read_folio and ->readahead methods instead kick off explicit readahead of the fsverity hashed so they are usually available at I/O completion time. For 64k sequential reads on my test VM this improves read performance from 2.4GB/s - 2.6GB/s to 3.5GB/s - 3.9GB/s. The improvements for random reads are likely to be even bigger. Signed-off-by: Christoph Hellwig Acked-by: David Sterba # btrfs Link: https://lore.kernel.org/r/20260202060754.270269-5-hch@lst.de Signed-off-by: Eric Biggers commit 314b652b7e7ad335fa20b693c8878a4850dae098 Author: Christoph Hellwig Date: Mon Feb 2 07:06:32 2026 +0100 ext4: move ->read_folio and ->readahead to readpage.c Keep all the read into pagecache code in a single file. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Acked-by: Theodore Ts'o Link: https://lore.kernel.org/r/20260202060754.270269-4-hch@lst.de Signed-off-by: Eric Biggers commit 82f35bec11bd404d2cfd615877747e5989d29edf Author: Eric Dumazet Date: Fri Jan 30 19:19:06 2026 +0000 net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out() Extend the RCU section a bit so that we can use the safer skb_dst_dev_rcu() helper. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260130191906.3781856-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 61cef6454cfbb9fcdbe41401fb53895f86603081 Author: Joe Damato Date: Fri Jan 30 16:30:41 2026 -0800 bnxt_en: Allow ntuple filters for drops It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action support for ntuple"), bnxt gained support for ntuple filters for packet drops. However, support for this does not seem to work in recent kernels or against net-next: % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 rmgr: Cannot insert RX class rule: Operation not supported Cannot insert classification rule The issue is that the existing code uses ethtool_get_flow_spec_ring_vf, which will return a non-zero value if the ring_cookie is set to RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return -EOPNOTSUPP because it thinks the user is trying to set an ntuple filter for a vf. Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC. After this patch, ntuple filters for drops can be added: % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 Added rule with ID 0 % ethtool -n eth0 44 RX rings available Total 1 rules Filter: 0 Rule Type: UDP over IPv4 Src IP addr: 1.1.1.1 mask: 0.0.0.0 Dest IP addr: 0.0.0.0 mask: 255.255.255.255 TOS: 0x0 mask: 0xff Src port: 0 mask: 0xffff Dest port: 0 mask: 0xffff Action: Drop Reviewed-by: Michael Chan Signed-off-by: Joe Damato Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to Signed-off-by: Jakub Kicinski commit 71a58ec6672fbb7ae9f1b4a8ee1b5c352af93c0d Author: Jakub Kicinski Date: Sat Jan 31 12:30:29 2026 -0800 tools: ynl: cli: make the output compact Make the default (non-JSON) output more compact. Looking at RSS context dumps is pretty much impossible without this, because default print shows the indirection table with line per entry: 'indir': [0, 1, 2, ... And indirection tables have 100-200 entries each. The compact output is far more readable: 'indir': [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20260131203029.1173492-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ba9c5611f0888f143ff5faf28a73eac6ea20eaaf Author: Jakub Kicinski Date: Sat Jan 31 14:54:54 2026 -0800 docs: networking: mention that RSS table should be 4x the queue count Spell out the recommendation that the RSS table should be 4x the queue count to avoid traffic imbalance. Include minor rephrasing and removal of the explicit 128 entry example since a 128 entry table is inadequate on modern machines. Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260131225454.1225151-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9e3d4dae98325928f842192359521ca0a2e5408e Author: Jakub Kicinski Date: Sat Jan 31 14:54:53 2026 -0800 selftests: drv-net: rss: validate min RSS table size Add a test which checks that the RSS table is at least 4x the max queue count supported by the device. The original RSS spec from Microsoft stated that the RSS indirection table should be 2 to 8 times the CPU count, presumably assuming queue per CPU. If the CPU count is not a power of two, however, a power-of-2 table 2x larger than queue count results in a 33% traffic imbalance. Validate that the indirection table is at least 4x the queue count. This lowers the imbalance to 16% which empirically appears to be more acceptable to memcache-like workloads. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260131225454.1225151-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fd102acfd362de60a941d24f0836278d839b9391 Author: Chukun Pan Date: Sun Feb 1 18:00:01 2026 +0800 net: spacemit: display phy driver information Print the PHY driver used and interrupt status after connection. Signed-off-by: Chukun Pan Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260201100001.33102-1-amadeus@jmu.edu.cn Signed-off-by: Jakub Kicinski commit b079e4e628c8866340cafedca9f7451dfc8fa263 Author: Peng Fan Date: Mon Dec 22 15:06:33 2025 +0800 clk: Disable KUNIT_UML_PCI commit 031cdd3bc3f3 ("kunit: Enable PCI on UML without triggering WARN()") enables KUNIT_UML_PCI, but clk driver could not work with it. Deselect KUNIT_UML_PCI to avoid the failure. Dump as below: WARNING: CPU: 0 PID: 227 at lib/logic_iomem.c:141 __raw_readl+0xac/0xe0 CPU: 0 UID: 0 PID: 227 Comm: kunit_try_catch Tainted: G Tainted: [N]=TEST Stack: a0883d00 00000001 00000000 ffffff00 603ef142 60044832 6002598b 00000000 00000000 600211b3 00000001 00000000 Call Trace: [<6032534c>] ? __raw_readl+0xac/0xe0 [<60044832>] ? dump_stack_lvl+0x57/0x73 [<6002598b>] ? _printk+0x0/0x61 [<600211b3>] ? __warn.cold+0x61/0xeb [<600212cc>] ? warn_slowpath_fmt+0x8f/0x9c [<6002123d>] ? warn_slowpath_fmt+0x0/0x9c [<6032534c>] ? __raw_readl+0xac/0xe0 [<6002123d>] ? warn_slowpath_fmt+0x0/0x9c [<6029e2ad>] ? clk_gate_endisable+0xcd/0x110 [<6029e315>] ? clk_gate_enable+0x15/0x20 [<6028795e>] ? clk_core_enable+0x6e/0xf0 [<60289f1f>] ? clk_enable+0x4f/0xa0 [<602a06af>] ? clk_gate_test_enable+0xbf/0x360 [<60053df9>] ? os_nsecs+0x29/0x40 [<600cd300>] ? ktime_get_ts64+0x0/0x130 [<600816c0>] ? to_kthread+0x0/0x50 [<602507bb>] ? kunit_try_run_case+0x7b/0x100 [<600816c0>] ? to_kthread+0x0/0x50 [<60252aa0>] ? kunit_generic_run_threadfn_adapter+0x0/0x30 [<60252ab2>] ? kunit_generic_run_threadfn_adapter+0x12/0x30 [<60082091>] ? kthread+0xf1/0x270 [<60047591>] ? new_thread_handler+0x41/0x60 ---[ end trace 0000000000000000 ]--- Reviewed-by: Thomas Weißschuh Signed-off-by: Peng Fan Signed-off-by: Stephen Boyd commit 3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9 Author: Alper Ak Date: Fri Dec 26 15:09:27 2025 +0300 tpm: st33zp24: Fix missing cleanup on get_burstcount() error get_burstcount() can return -EBUSY on timeout. When this happens, st33zp24_send() returns directly without releasing the locality acquired earlier. Use goto out_err to ensure proper cleanup when get_burstcount() fails. Fixes: bf38b8710892 ("tpm/tpm_i2c_stm_st33: Split tpm_i2c_tpm_st33 in 2 layers (core + phy)") Signed-off-by: Alper Ak Signed-off-by: Jarkko Sakkinen commit bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713 Author: Alper Ak Date: Fri Dec 26 13:23:38 2025 +0300 tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure get_burstcount() can return -EBUSY on timeout. When this happens, the function returns directly without releasing the locality that was acquired at the beginning of tpm_tis_i2c_send(). Use goto out_err to ensure proper cleanup when get_burstcount() fails. Fixes: aad628c1d91a ("char/tpm: Add new driver for Infineon I2C TIS TPM") Signed-off-by: Alper Ak Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 341d72ebc2303670936713f5004a2825edc4e7ea Author: Marek Vasut Date: Tue Oct 14 12:46:03 2025 +0200 dt-bindings: clk: rs9: Fix DIF pattern match The pattern match [0-19] is incorrect and does not cover range of 0..19, use pattern 1?[0-9] to cover range 0..19 instead. Update the example to validate all parts of the pattern match and prevent such failures in the future. Fixes: 26c1bc67aa2f ("dt-bindings: clk: rs9: Add Renesas 9-series I2C PCIe clock generator") Signed-off-by: Marek Vasut Reviewed-by: Conor Dooley Signed-off-by: Stephen Boyd commit 37eb3349a34f98fc22dd6f6be0b28c24cfa66aa6 Author: Geert Uytterhoeven Date: Wed Jan 21 12:03:11 2026 +0100 clk: rs9: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas 9-series PCIe clock generator driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 5ec820fc28d0b8a0f3890d476b1976f20e8343cc Author: Marek Vasut Date: Thu Jan 22 00:26:38 2026 +0100 clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 The 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure there are 8 slots for those newly registered clk_hw pointers, else there is going to be out of bounds write when pointers 4..7 are set into struct rs9_driver_data .clk_dif[4..7] field. Since there are other structure members past this struct clk_hw pointer array, writing to .clk_dif[4..7] fields corrupts both the struct rs9_driver_data content and data around it, sometimes without crashing the kernel. However, the kernel does surely crash when the driver is unbound or during suspend. Fix this, increase the struct clk_hw pointer array size to the maximum output count of 9FGV0841, which is the biggest chip that is supported by this driver. Cc: stable@vger.kernel.org Fixes: f0e5e1800204 ("clk: rs9: Add support for 9FGV0841") Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/CAMuHMdVyQpOBT+Ho+mXY07fndFN9bKJdaaWGn91WOFnnYErLyg@mail.gmail.com Signed-off-by: Marek Vasut Signed-off-by: Stephen Boyd commit ca3299dc3d6d9791c7e4a9bb7474150e66a525fe Author: Akari Tsuyukusa Date: Sun Jan 11 14:30:24 2026 +0900 pinctrl: mediatek: remove unused drv_offset field The 'drv_offset' member in 'struct mtk_pinctrl_devdata' has been unused since the driver's inception. Drive strength control for MediaTek pinctrl drivers is actually configured via 'pin_drv_grp', making this specific offset field redundant. Remove the unused field from the common 'mtk_pinctrl_devdata' structure and its corresponding initialization in the mt8365 driver to clean up the code and avoid confusion. Signed-off-by: Akari Tsuyukusa Signed-off-by: Linus Walleij commit d8c128fb6c2277d95f3f6a4ce28b82c8370031f6 Author: Jiayu Du Date: Sun Dec 28 23:49:47 2025 +0800 pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree When probing the k230 pinctrl driver, the kernel triggers a NULL pointer dereference. The crash trace showed: [ 0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068 [ 0.740737] ... [ 0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc In k230_pinctrl_parse_functions(), we attempt to retrieve the device pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized after k230_pinctrl_parse_dt() completes. At the time of DT parsing, info->pctl_dev is still NULL, leading to the invalid dereference of info->pctl_dev->dev. Use the already available device pointer from platform_device instead of accessing through uninitialized pctl_dev. Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register") Signed-off-by: Jiayu Du Signed-off-by: Linus Walleij commit 353353309b0f7afa407df29e455f9d15b5acc296 Author: Wei Li Date: Tue Jan 20 08:07:35 2026 +0000 pinctrl: single: fix refcount leak in pcs_add_gpio_func() of_parse_phandle_with_args() returns a device_node pointer with refcount incremented in gpiospec.np. The loop iterates through all phandles but never releases the reference, causing a refcount leak on each iteration. Add of_node_put() calls to release the reference after extracting the needed arguments and on the error path when devm_kzalloc() fails. This bug was detected by our static analysis tool and verified by my code review. Fixes: a1a277eb76b3 ("pinctrl: single: create new gpio function range") Signed-off-by: Wei Li Signed-off-by: Linus Walleij commit e56aa18eba32fb68ac5e19e44670010095bb189c Author: Felix Gu Date: Wed Jan 28 02:23:12 2026 +0800 pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpers of_parse_phandle_with_fixed_args() increments the reference count of the returned device node, so it must be explicitly released using of_node_put() after use. Fix the reference leak in aml_bank_pins() and aml_bank_number() by adding the missing of_node_put() calls. Fixes: 6e9be3abb78c ("pinctrl: Add driver support for Amlogic SoCs") Signed-off-by: Felix Gu Reviewed-by: Xianwei Zhao Signed-off-by: Linus Walleij commit eabf273c8466af3f033473c2d2267a6ea7946d57 Author: Luca Weiss Date: Wed Jan 28 12:22:28 2026 +0100 pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition The i2s2_data function is available on both gpio12 and gpio13. Fix the groups definition. Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Linus Walleij commit b789889f11391b27d0d50023955af596ef32f374 Author: Andy Shevchenko Date: Tue Jan 27 11:32:08 2026 +0100 pinctrl: core: Remove duplicate error messages pinctrl_claim_hogs() is covered to report any error via message. Since that it's not needed in the callers. Signed-off-by: Andy Shevchenko Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 74ac08a77b4e77f2a9f3e9ac5f1386cecc95686c Author: Andy Shevchenko Date: Tue Jan 27 11:32:07 2026 +0100 pinctrl: core: Simplify devm_pinctrl_*() Use devm_add_action_or_reset() instead of devres_alloc() and devres_add(), which works the same. This will simplify the code. There is no functional changes. Signed-off-by: Andy Shevchenko Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 17926aa1b62c6ddb1e2ddbda8b2ac46913c5311c Author: Andy Shevchenko Date: Tue Jan 27 11:32:06 2026 +0100 pinctrl: core: Remove unused devm_pinctrl_unregister() There are no users, drop it for good. Signed-off-by: Andy Shevchenko Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 0a4614fe85ef130ab3769afdf9d174cc9e645dea Author: Yixun Lan Date: Fri Jan 30 19:22:15 2026 +0800 dt-bindings: pinctrl: spacemit: fix drive-strength check warning The problem is that one value from drive-strength may match to more than two different enum groups which lead to DT complaint, switch to use 'anyOf' to fix this kind warning. Fixes: c3efac0592f8 ("dt-bindings: pinctrl: spacemit: convert drive strength to schema format") Signed-off-by: Yixun Lan Acked-by: Conor Dooley Reported-by: Conor Dooley Signed-off-by: Linus Walleij commit ea9975c221151b9541458b2038593f5863889ee9 Author: Conor Dooley Date: Fri Jan 30 23:55:30 2026 +0000 pinctrl: fix kismet issues with GENERIC_PINCTRL lkp reported that GENERIC_PINCTRL can be select when its dependencies are not. Swap the "depends on" out for "select", as is used in other parts of the pinctrl core that are expected to be selected by drivers. Fixes: 43722575e5cd ("pinctrl: add generic functions + pins mapper") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601271725.gqlQ8Jl7-lkp@intel.com/ Signed-off-by: Conor Dooley Reviewed-by: Arnd Bergmann Signed-off-by: Linus Walleij commit d83039b5dc3daca93ea8202678d95fc48cb0a120 Merge: 0f625fc2def8f3 8232e6079ae6f8 Author: Mark Brown Date: Mon Feb 2 23:31:48 2026 +0000 ASoC: es8328: error handling and resume fixes Merge series from Hsieh Hung-En : This series fixes some issues and improves robustness in the es8328 driver. commit 0f625fc2def8f36561444d16847206982f39f726 Merge: c1b835eefb7887 ddd9bf2212ab80 Author: Mark Brown Date: Mon Feb 2 23:31:44 2026 +0000 ASoC: amd: acp: Add ACP7.0 match entries for Cirrus Merge series from Simon Trimmer : This patch series adds a number of ACP7.0 match table entries that are being used in customer products. Some of the configurations are very similar so the series begins with renaming and sorting the existing structures so that the end result is easier to manage. commit c1b835eefb7887266ac39573054a224a8e32207f Merge: 8a066a81ee0c1b a145cfd0ffe7bd Author: Mark Brown Date: Mon Feb 2 23:31:39 2026 +0000 Anbernic RG-DS AW87391 Speaker Amps Merge series from Chris Morgan : Add support for the Anbernic RG-DS Speaker Amplifiers. The Anbernic RG-DS uses two AW87391 ICs at 0x58 and 0x5B on i2c2. However, the manufacturer did not provide a firmware file, only a sequence of register writes to each device to enable and disable them. Add support for this *specific* configuration in the AW87390 driver. Since we are relying on a device specific sequence I am using a device specific compatible string. This driver does not currently support the aw87391 for any other device as I have none to test with valid firmware. Attempts to create firmware with the AwinicSCPv4 have not been successful. commit 8ea39d960c9f890e9213cdcfcbe4b3f281acd12f Merge: da0a672268b342 0ec5ed7c95d1ba Author: Mark Brown Date: Mon Feb 2 22:03:20 2026 +0000 spi: add multi-lane support Merge series from David Lechner : This series is adding support for SPI controllers and peripherals that have multiple SPI data lanes (data lanes being independent sets of SDI/SDO lines, each with their own serializer/deserializer). This series covers this specific use case: +--------------+ +---------+ | SPI | | SPI | | Controller | | ADC | | | | | | CS0 |--->| CS | | SCLK |--->| SCLK | | SDO |--->| SDI | | SDI0 |<---| SDOA | | SDI1 |<---| SDOB | | SDI2 |<---| SDOC | | SDI3 |<---| SDOD | +--------------+ +--------+ The ADC is a simultaneous sampling ADC that can convert 4 samples at the same time. It has 4 data output lines (SDOA-D) that each contain the data of one of the 4 channels. So it requires a SPI controller with 4 separate deserializers in order to receive all of the information at the same time. This should also work for the use case in [1] as well. (Some of the patches in this series were already submitted there). In that case the SPI controller is used kind of like it is two separate SPI controllers, each with its own chip select, clock, and data lines. [1]: https://lore.kernel.org/linux-spi/20250616220054.3968946-1-sean.anderson@linux.dev/ The DT bindings are a fairly straight-forward mapping of which pins on the peripheral are connected to which pins on the controller. The SPI core code parses this and makes the information available to drivers. When a peripheral driver sees that multiple data lanes are wired up, it can chose to use them when sending messages. The SPI message API is a bit higher-level than just specifying the number of data lines for a SPI transfer though. I did some research on other SPI controllers that have this feature. They tend to be the kind meant for connecting to two flash memory chips at the same time but can be used more generically as well. They generally have the option to either use one lane at a time (Sean's use case), or can mirror the same data on multiple lanes (no users of this yet) or can perform striping of a single data FIFO/DMA stream to/from the two lanes (our use case). For now, the API assumes that if you want to do mirror/striping, then you want to use all available data lanes. Otherwise, it just uses the first data lane for "normal" SPI transfers. commit 8a066a81ee0c1b6cdbd81393536c3b2d19ccef25 Author: Cédric Bellegarde Date: Fri Jan 2 22:52:25 2026 +0100 ASoC: qcom: q6asm: drop DSP responses for closed data streams 'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses after closing")' attempted to ignore DSP responses arriving after a stream had been closed. However, those responses were still handled, causing lockups. Fix this by unconditionally dropping all DSP responses associated with closed data streams. Signed-off-by: Cédric Bellegarde Link: https://patch.msgid.link/20260102215225.609166-1-cedric.bellegarde@adishatz.org Signed-off-by: Mark Brown commit 090c8844e5d454a898183ec4a7be8a75681ed262 Author: Ethan Nelson-Moore Date: Fri Jan 30 18:01:10 2026 -0800 ASoC: wcd-mbhc-v2: remove unnecessary module_init/exit functions The wcd-mbhc-v2 driver has unnecessary empty module_init and module_exit functions. Remove them. Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260131020111.46108-1-enelsonmoore@gmail.com Signed-off-by: Mark Brown commit 451c3a0356099483218535aed17fcf94ab5764a3 Author: Arnd Bergmann Date: Mon Feb 2 10:55:01 2026 +0100 rcu: Mark lockdep_assert_rcu_helper() __always_inline There are some configurations in which lockdep_assert_rcu_helper() ends up not being inlined, for some reason. This leads to a link failure because now the caller tries to pass a nonexistant __ctx_lock_RCU structure: ld: lib/test_context-analysis.o: in function `test_rcu_assert_variants': test_context-analysis.c:(.text+0x275c): undefined reference to `RCU' ld: test_context-analysis.c:(.text+0x276c): undefined reference to `RCU_BH' ld: test_context-analysis.c:(.text+0x2774): undefined reference to `RCU_SCHED' I saw this in one out of many 32-bit arm builds using gcc-15.2, but it probably happens in others as well. Mark this function as __always_inline to fix the build. Fixes: fe00f6e84621 ("rcu: Support Clang's context analysis") Signed-off-by: Arnd Bergmann Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Paul E. McKenney Link: https://patch.msgid.link/20260202095507.1237440-1-arnd@kernel.org commit a56a38fd9196fc89401e498d70b7aa9c9679fa6e Author: Breno Leitao Date: Wed Jan 28 10:16:11 2026 -0800 uprobes: Fix incorrect lockdep condition in filter_chain() The list_for_each_entry_rcu() in filter_chain() uses rcu_read_lock_trace_held() as the lockdep condition, but the function holds consumer_rwsem, not the RCU trace lock. This gives me the following output when running with some locking debug option enabled: kernel/events/uprobes.c:1141 RCU-list traversed in non-reader section!! filter_chain register_for_each_vma uprobe_unregister_nosync __probe_event_disable Remove the incorrect lockdep condition since the rwsem provides sufficient protection for the list traversal. Fixes: cc01bd044e6a ("uprobes: travers uprobe's consumer list locklessly under SRCU protection") Signed-off-by: Breno Leitao Signed-off-by: Peter Zijlstra (Intel) Acked-by: Oleg Nesterov Acked-by: Andrii Nakryiko Acked-by: Masami Hiramatsu (Google) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260128-uprobe_rcu-v2-1-994ea6d32730@debian.org commit 171efc70097a9f5f207461bed03478a1b0a3dfa6 Author: Xiang-Bin Shi Date: Fri Jan 23 15:57:19 2026 +0800 x86/ibs: Fix typo in dc_l2tlb_miss comment The comment for dc_l2tlb_miss incorrectly describes it as a "hit". This contradicts the field name and the actual bit definition. Fix the comment to correctly describe it as a "miss". Signed-off-by: Xiang-Bin Shi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260123075719.160734-1-eric91102091@gmail.com commit 7833570dae833028337bb53b7f389825b910c100 Author: Arnd Bergmann Date: Mon Feb 2 21:43:45 2026 +0100 jfs: avoid -Wtautological-constant-out-of-range-compare warning A recent change for the range check started triggering a clang warning: fs/jfs/jfs_dtree.c:2906:31: error: result of comparison of constant 128 with expression of type 's8' (aka 'signed char') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 2906 | if (stbl[i] < 0 || stbl[i] >= DTPAGEMAXSLOT) { | ~~~~~~~ ^ ~~~~~~~~~~~~~ fs/jfs/jfs_dtree.c:3111:30: error: result of comparison of constant 128 with expression of type 's8' (aka 'signed char') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 3111 | if (stbl[0] < 0 || stbl[0] >= DTPAGEMAXSLOT) { | ~~~~~~~ ^ ~~~~~~~~~~~~~ Both the old and the new check were useless, but the previous version apparently did not lead to the warning. Remove the extraneous range check for simplicity. Fixes: cafc6679824a ("jfs: replace hardcoded magic number with DTPAGEMAXSLOT constant") Signed-off-by: Arnd Bergmann Signed-off-by: Dave Kleikamp commit 75ce02f4bc9a8b8350b6b1b01872467b0cc960cc Author: Samuel Wu Date: Fri Jan 23 17:21:29 2026 -0800 PM: wakeup: Handle empty list in wakeup_sources_walk_start() In the case of an empty wakeup_sources list, wakeup_sources_walk_start() will return an invalid but non-NULL address. This also affects wrappers of the aforementioned function, like for_each_wakeup_source(). Update wakeup_sources_walk_start() to return NULL in case of an empty list. Fixes: b4941adb24c0 ("PM: wakeup: Add routine to help fetch wakeup source object.") Signed-off-by: Samuel Wu [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260124012133.2451708-2-wusamuel@google.com Signed-off-by: Rafael J. Wysocki commit b244c89a70b306e5a91852e00fd8cdd289714505 Author: Christoph Hellwig Date: Mon Feb 2 07:06:31 2026 +0100 readahead: push invalidate_lock out of page_cache_ra_unbounded Require the invalidate_lock to be held over calls to page_cache_ra_unbounded instead of acquiring it in this function. This prepares for calling page_cache_ra_unbounded from ->readahead for fsverity read-ahead. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20260202060754.270269-3-hch@lst.de Signed-off-by: Eric Biggers commit 4544e9c4ec9a5955a37fdd8204a3d98106f97ab7 Author: Tejun Heo Date: Mon Feb 2 09:40:22 2026 -1000 selftests/sched_ext: Fix init_enable_count flakiness The init_enable_count test is flaky. The test forks 1024 children before attaching the scheduler to verify that existing tasks get ops.init_task() called. The children were using sleep(1) before exiting. 7900aa699c34 ("sched_ext: Fix cgroup exit ordering by moving sched_ext_free() to finish_task_switch()") changed when tasks are removed from scx_tasks - previously when the task_struct was freed, now immediately in finish_task_switch() when the task dies. Before the commit, pre-forked children would linger on scx_tasks until freed regardless of when they exited, so the scheduler would always see them during iteration. The sleep(1) was unnecessary. After the commit, children are removed as soon as they die. The sleep(1) masks the problem in most cases but the test becomes flaky depending on timing. Fix by synchronizing properly using a pipe. All children block on read() and the parent signals them to exit by closing the write end after attaching the scheduler. The children are auto-reaped so there's no need to wait on them. Reported-by: Ihor Solodrai Cc: David Vernet Cc: Andrea Righi Cc: Changwoo Min Cc: Emil Tsalapatis Signed-off-by: Tejun Heo commit 23eec9fd64b2889286f31340371d67babfe54155 Author: Christoph Hellwig Date: Mon Feb 2 07:06:30 2026 +0100 fsverity: don't issue readahead for non-ENOENT errors from __filemap_get_folio Issuing more reads on errors is not a good idea, especially when the most common error here is -ENOMEM. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20260202060754.270269-2-hch@lst.de Signed-off-by: Eric Biggers commit f08e7edbe2ab9134ce23b21c019867fff855ebfd Merge: 8f0b4cce4481fb ec8c1f35b5aa7a Author: Stephen Boyd Date: Mon Feb 2 10:57:51 2026 -0800 Merge tag 'clk-microchip-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip Pull Microchip clk driver updates from Claudiu Beznea: - clean up microchip/clk-core.c to: -- fix a sparse warning related to multiple initializations of pic32_sclk_ops.determine_rate() -- correct the return values of roclk_get_parent() and sclk_get_parent() -- drop an unused include header - adjust the PolarFire driver Kconfig section as the driver is now used by non-PolarFire devices - update the documentation for the Microchip PIC64GX SoC clock controller * tag 'clk-microchip-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: dt-bindings: clock: mpfs-clkcfg: Add pic64gx compatibility dt-bindings: clock: mpfs-ccc: Add pic64gx compatibility clk: microchip: drop POLARFIRE from ARCH_MICROCHIP_POLARFIRE clk: microchip: core: remove unused include asm/traps.h clk: microchip: core: correct return value on *_get_parent() clk: microchip: core: remove duplicate determine_rate on pic32_sclk_ops commit 2fa598ae9799646145a8bd5281ebef92228b9028 Merge: 8f0b4cce4481fb a8d722f03923b1 Author: Stephen Boyd Date: Mon Feb 2 11:03:30 2026 -0800 Merge tag 'v6.20-rockchip-clk-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull a Rockchip clk driver update from Heiko Stuebner: Additional check for an error pointer and not only for NULL when a gatelink is added. * tag 'v6.20-rockchip-clk-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: Fix error pointer check after rockchip_clk_register_gate_link() commit 5248d8474e594d156bee1ed10339cc16e207a28b Author: Olga Kornievskaia Date: Mon Jan 26 14:15:39 2026 -0500 pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN It is possible to have a task get stuck on waiting on the NFS_LAYOUT_DRAIN in the following scenario 1. cpu a: waiter test NFS_LAYOUT_DRAIN (1) and plh_outstanding (1) 2. cpu b: atomic_dec_and_test() -> clear bit -> wake up 3. cpu c: sets NFS_LAYOUT_DRAIN again 4. cpu a: calls wait_on_bit() sleeps forever. To expand on this we have say 2 outstanding pnfs write IO that get ESTALE which causes both to call pnfs_destroy_layout() and set the NFS_LAYOUT_DRAIN bit but the 1st one doesn't call the pnfs_put_layout_hdr() yet (as that would prevent the 2nd ESTALE write from trying to call pnfs_destroy_layout()). If the 1st ESTALE write is the one that initially sets the NFS_LAYOUT_DRAIN so that new IO on this file initiates new LAYOUTGET. Another new write would find NFS_LAYOUT_DRAIN set and phl_outstanding>0 (step 1) and would wait_on_bit(). LAYOUTGET completes doing step 2. Now, the 2nd of ESTALE writes is calling pnfs_destory_layout() and set the NFS_LAYOUT_DRAIN bit (step 3). Finally, the waiting write wakes up to check the bit and goes back to sleep. The problem revolves around the fact that if NFS_LAYOUT_INVALID_STID was already set, it should not do the work of pnfs_mark_layout_stateid_invalid(), thus NFS_LAYOUT_DRAIN will not be set more than once for an invalid layout. Suggested-by: Trond Myklebust Fixes: 880265c77ac4 ("pNFS: Avoid a live lock condition in pnfs_update_layout()") Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit 0a83293322fde69f1fb4722bd3c79c2d52eef436 Author: Dmitry Antipov Date: Fri Jan 23 10:15:23 2026 +0300 doc: development-process: add notice on testing Add testing notice to "Before creating patches" section. Suggested-by: Andy Shevchenko Signed-off-by: Dmitry Antipov Acked-by: Randy Dunlap Acked-by: Andy Shevchenko Signed-off-by: Jonathan Corbet Message-ID: <20260123071523.1392729-1-dmantipov@yandex.ru> commit 91db696adea4d76017b1e1f45915a5cbf04e8da3 Author: David Howells Date: Mon Jan 26 11:46:58 2026 +0000 pkcs7: Allow authenticatedAttributes for ML-DSA Allow the rejection of authenticatedAttributes in PKCS#7 (signedAttrs in CMS) to be waived in the kernel config for ML-DSA when used for module signing. This reflects the issue that openssl < 4.0 cannot do this and openssl-4 has not yet been released. This does not permit RSA, ECDSA or ECRDSA to be so waived (behaviour unchanged). Signed-off-by: David Howells cc: Lukas Wunner cc: Ignat Korchagin cc: Jarkko Sakkinen cc: Stephan Mueller cc: Eric Biggers cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org commit 64e4882c8228b07c57e75f510b8c5d7ff46e4edc Author: Mauro Carvalho Chehab Date: Tue Jan 27 09:03:34 2026 +0100 tools: sphinx-build-wrapper: improve its help message Besides the parameters that are passed via command line arguments, the wrapper's behavior is affected by several environment variables. Document that. While here, use __doc__ for its description. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit b09cc1ddde9707ef62d2dd1070a1c99556ed7d76 Author: Mauro Carvalho Chehab Date: Tue Jan 27 09:03:33 2026 +0100 docs: sphinx-build-wrapper: allow -v override -q Documentation builds were using "-q" for a long time, but sometimes it is nice to see the Sphinx progress, without increasing build verbosity - which would also turn on kernel-doc verbosity. Instead of doing that, let's parse the sphinx-build already-existing -v: each time it is used, it increases the verbosity level. With that, if the default is to use -q, a single -v will disable quiet mode. Passing more -v will keep increasing its verbosity. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <38b24e97a3cbd2def418359a8e69b1b087a945ad.1769500383.git.mchehab+huawei@kernel.org> commit 98f51c466aebdb5afa7cb7d54aa7eb9f04b468ee Author: Mauro Carvalho Chehab Date: Tue Jan 27 09:03:32 2026 +0100 docs: kdoc: Fix pdfdocs build for tools the "\1" inside a docstring requires proper scaping to not be considered a hex character and break the build. Reported-by: Akira Yokosawa Closes: https://lore.kernel.org/linux-doc/63e99049-cc72-4156-83af-414fdde34312@gmail.com/ Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <2fff8ef1d0d64e8b68f15f5c07613f302d773855.1769500383.git.mchehab+huawei@kernel.org> commit 0ad9a71933e73c8a2af101d28e9a1dc35bae02d5 Author: David Howells Date: Mon Oct 6 08:35:51 2025 +0100 modsign: Enable ML-DSA module signing Allow ML-DSA module signing to be enabled. Note that OpenSSL's CMS_*() function suite does not, as of OpenSSL-3.6, support the use of CMS_NOATTR with ML-DSA, so the prohibition against using signedAttrs with module signing has to be removed. The selected digest then applies only to the algorithm used to calculate the digest stored in the messageDigest attribute. The OpenSSL development branch has patches applied that fix this[1], but it appears that that will only be available in OpenSSL-4. [1] https://github.com/openssl/openssl/pull/28923 sign-file won't set CMS_NOATTR if openssl is earlier than v4, resulting in the use of signed attributes. The ML-DSA algorithm takes the raw data to be signed without regard to what digest algorithm is specified in the CMS message. The CMS specified digest algorithm is ignored unless signedAttrs are used; in such a case, only SHA512 is permitted. Signed-off-by: David Howells cc: Jarkko Sakkinen cc: Eric Biggers cc: Lukas Wunner cc: Ignat Korchagin cc: Stephan Mueller cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org commit 12ea2cff02f8d5b8b480acb6e215ccb41107e154 Author: Akiyoshi Kurita Date: Tue Jan 27 22:01:55 2026 +0900 docs: ja_JP: process: translate 'Obtain a current source tree' Translate the "Obtain a current source tree" section in Documentation/translations/ja_JP/process/submitting-patches.rst. Signed-off-by: Akiyoshi Kurita Reviewed-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Message-ID: <20260127130155.16935-1-weibu@redadmin.org> commit 19dd0cc36a52d0d121d7854cbb9b00d6d4dcad0a Merge: 0d95280a2d54eb 2c1ba9c2adf0fd Author: Johannes Berg Date: Mon Feb 2 17:55:04 2026 +0100 Merge tag 'ath-next-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.20/v7.0 (#3) A set of small features and cleanups for the next merge window. ================== Signed-off-by: Johannes Berg commit 78a00cac1e962aacfe67ffa0ce295e709e0e6c5b Author: Rhys Tumelty Date: Wed Jan 28 22:02:31 2026 +0000 docs: fix 're-use' -> 'reuse' in documentation Signed-off-by: Rhys Tumelty Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260128220233.179439-1-rhys@tumelty.co.uk> commit 1482f61ccd984440529d0d37002bc66378be88bb Author: Gabriel Whigham Date: Thu Jan 29 22:21:31 2026 -0600 docs: ioctl-number: fix a typo in ioctl-number.rst "userspace" was misspelled as "userpace". Signed-off-by: Gabriel Whigham Signed-off-by: Jonathan Corbet Message-ID: <20260130042131.51975-1-gabewhigham@gmail.com> commit c0f612f8bc34d10ab154b6c4662aeeb602bd9cd7 Author: Thomas Böhler Date: Sat Jan 31 12:57:26 2026 +0100 docs: filesystems: ensure proc pid substitutable is complete The entry in proc.rst for 3.14 is missing the closing ">" of the "pid" field for the ksm_stat file. Add this for both the table of contents and the actual header for the "ksm_stat" file. Acked-by: Randy Dunlap Signed-off-by: Thomas Böhler Signed-off-by: Jonathan Corbet Message-ID: <20260131-ksm_stat-v2-1-a8fea12d604e@wiredspace.de> commit 0da3050bdded5f121aaca6b5247ea50681d7129e Merge: 63050be0bfe0b2 2d2b3fe002797c Author: Dave Jiang Date: Mon Feb 2 09:39:41 2026 -0700 Merge branch 'for-7.0/cxl-aer-prep' into cxl-for-next Fixup and refactor downstream port enumeration to prepare for CXL port protocol error handling. Main motivation is to move endpoint component register mapping to a port object. cxl/port: Unify endpoint and switch port lookup cxl/port: Move endpoint component register management to cxl_port cxl/port: Map Port RAS registers cxl/port: Move dport RAS setup to dport add time cxl/port: Move dport probe operations to a driver event cxl/port: Move decoder setup before dport creation cxl/port: Cleanup dport removal with a devres group cxl/port: Reduce number of @dport variables in cxl_port_add_dport() cxl/port: Cleanup handling of the nr_dports 0 -> 1 transition commit b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d Author: Ming Lei Date: Sat Jan 31 22:48:08 2026 +0800 nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue. This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime"). Cc: Keith Busch Fixes: 03b3bcd319b3 ("nvme: fix admin request_queue lifetime"). Reported-and-tested-by: Yi Zhang Closes: https://lore.kernel.org/linux-block/CAHj4cs9wv3SdPo+N01Fw2SHBYDs9tj2M_e1-GdQOkRy=DsBB1w@mail.gmail.com/ Signed-off-by: Ming Lei Signed-off-by: Keith Busch commit 9991bbc6d5e8fdfa0b1bcfeebf4637e8fd764bd8 Merge: 96657eb5ab7e23 0713b26190addf Author: Greg Kroah-Hartman Date: Mon Feb 2 17:08:30 2026 +0100 Merge tag 'iio-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO: New device support, features and cleanup for the 6.20/7.0 cycle. Slightly messier than normal unfortunately due to some conflicts and build config bugs related to I3C drivers. One last minute Kconfig fix right at the top after a linux-next report. I've simplified the Kconfig and made it match other instances in the kernel so that should be safe enough despite short soak time in front of build bots. Merge of an immutable branch from I3C to get some stubs that were missing and caused build issues with dual I2C / I3C drivers. This also brought in a drop of some deprecated interfaces so there is also one patch to update a new driver to not use those. We are having another go at using cleanup.h magic with the IIO mode claim functions after backing out last try at this. This time we have wrappers around the new ACQUIRE() and ACQUIRE_ERR() macros. Having been burnt once, we will be taking it a bit more slowly this time wrt to wide adoption of these! Thanks in particular to Kurt for taking on this core IIO work. New Device Support ================== adi,ad18113 - New driver to support the AD18113 amplifier - an interesting device due to the external bypass paths where we need to describe what gain those paths have in DT. Longer term it will be interesting to see if this simplistic description is enough for real deployments. adi,ad4062 - New driver for the AD4060 and AD4052 SAR ADCs including trigger, event and GPIO controller support. Follow up patch replaced use of some deprecated I3C interfaces prior to the I3C immutable branch merge as that includes dropping them. adi,ad4134 - New driver for the AD4134 24bit 4 channel simultaneous sampling ADC. adi,ad7768-1, - Add support for the ADAQ767-1, ADAQ7768-1 and ADAQ7769-1 ADCs after some rework to enable the driver to support multiple device types. adi,ad9467 - Add support for the similar ad9211 ADC to this existing driver. - Make the selection of 2s comp mode explicit for normal operation and switch to offset binary when entering calibration mode. honeywell,abp2 - New driver to support this huge family (100+) of board mount pressure and temperature sensors. maxim,max22007 - New drier for this 4 channel DAC. memsic,mmc5633 - New driver for this I2C/I3C magnetometer. Follow on patches fixed up issues related to single driver supporting both bus types. microchip,mcp747feb02 - New driver for the Microchip MCP47F(E/V)B(0/1/2)1, MCP47F(E/V)B(0/1/2)2, MCP47F(E/V)B(0/1/2)4 and MCP47F(E/V)B(0/1/2)8 buffered voltage output DACs. nxp,sar-adc - New driver support ADCs found on s32g2 and s32g3 platforms. ti,ads1018 - New drier for the ADS1018 and ADS1118 SPI ADCs. ti,ads131m02 - New driver supporting ADS131M(02/03/04/06/08)24-bit simultaneous sampling ADCs. Features ======== iio-core - New IIO_DEV_ACQUIRE_DIRECT_MODE() / IIO_DEV_ACQUIRE_FAILED() + equivalents for the much rarer case where the mode needs pinning whether or not it is in direct mode. These use the ACQUIRE() / ACQUIRE_ERR() infrastructure underneath to provide both simple checks on whether we got the requested mode and to provide scope based release. Applied in a few initial drivers. adi,ad9467 - Support calibbias control adi,adf4377 - Add support to act as a clock provider. adi,adxl380 - Support low power 1KHz sampling frequency mode. Required rework of how events and filters were configured, plus applying of constraints when in this mode. rf-digital,rfd77402 - Add interrupt support as alternative to polling for completion. st,lsm6dsx - Tap event detection (after considerable driver rework) Cleanup and Minor Fixes ======================= More minor cleanup such as typos, white space etc not called out except where they were applied to a lot of drivers. Various drivers. - Use of dev_err_probe() to cleanup error handling. - Introduce local struct device and struct device_node variables to reduce duplication of getting them from containing structs. - Ensure uses of iio_trigger_generic_data_rdy_poll() set IRQF_NO_THREAD as that function calls non threaded child interrupt handlers. - Replace IRQF_ONESHOT in not thread interrupt handlers with IRQF_NO_THREAD to ensure they run as intended. Drop one unnecessary case. iio-sw-device/trigger. - Constify configs_group_operations structures. iio-buffer-dma / buffer-dma-engine - Use lockdep_assert_held() to replace WARN_ON() to check lock is correctly held. - Make use of cleanup.h magic to simplify various code paths. - Make iio_dma_buffer_init() return void rather than always success. adi,ad7766 - Replace custom interrupt handler with iio_trigger_generic_data_rdy_poll() adi,ad9832 - Drop legacy platform_data support. adi,ade9000 - Add a maintainer entry. adi,adt7316 - Move to EXPORT_GPL_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() so the compiler can cleanly drop unused pm structures and callbacks. adi,adxl345 - Relax build constraint vs the driver that is in input so both may be built as modules and selection made at runtime. adi,adxl380 - Make sure we don't read tail entries in the hardware fifo if a partial new scan has been written. - Move to a single larger regmap_noinc_read() to read the hardware fifo. aspeed,ast2600 - Add missing interrupts property to DT binding. bosch,bmi270_i2c - Add missing MODULE_DEVICE_TABLE() macros so auto probing of modules can work. bosch,smi330 - Drop duplicate assignment of IIO_TYPE in smi330_read_avail() - Use new common field_get() and field_prep() helpers to replace local version. honeywell,mprls0025pa Fixes delayed to merge window as late in cycle and we didn't want to delay the rest of the series. - Allow Kconfig selection of specific bus sub-drivers rather than tying that to the buses themselves being supported. - Zero spi_transfer structure to avoid chance of unintentionally set fields effecting transfer. - Fix a potential timing violation wrt to the chip select to first clock edge timing. - As recent driver, take risk inherent in dropping interrupt direction from driver as that should be set by firmware. - Fix wrong reported number of data bits for channel. - Fix a pressure channel calculation bug. - Rework to allow embedding the tx buffer in the iio_priv() structure rather than requiring separate allocation. - Move the buffer clearing to the shared core bringing it into affect for SPI as well as I2C. - Stricter checks for status byte. - Greatly simplify the measurement sequence. - Add a copyright entry to reflect Petre's continued work on this driver. intersil,isl29018 - Switch from spritnf to sysfs_emit_at() to make it clear overflow can't occur. invensense,icm42600 - Allow sysfs access to temperature when buffered capture in use as it does not impact other sensor data paths. invensense,itg3200 - Check unused return value in read_raw() callback. men,z188 - Drop now duplicated module alias. rf-digital,rfd77402 - Add DT binding doc and explicit of_device_id table. - Poll for timeout with times as on datasheet, then replace opencoded version with read_poll_timeout(). sensiron,scd4x - Add missing timestamp channel. The code to push it to the buffer was there but there was no way to turn it on. vti,sca3000 - Fix resource leak if iio_device_register() fails. * tag 'iio-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (144 commits) iio: magn: mmc5633: Fix Kconfig for combination of I3C as module and driver builtin iio: sca3000: Fix a resource leak in sca3000_probe() iio: proximity: rfd77402: Add interrupt handling support iio: proximity: rfd77402: Document device private data structure iio: proximity: rfd77402: Use devm-managed mutex initialization iio: proximity: rfd77402: Use kernel helper for result polling iio: proximity: rfd77402: Align polling timeout with datasheet iio: cros_ec: Allow enabling/disabling calibration mode iio: frequency: ad9523: correct kernel-doc bad line warning iio: buffer: buffer_impl.h: fix kernel-doc warnings iio: gyro: itg3200: Fix unchecked return value in read_raw MAINTAINERS: add entry for ADE9000 driver iio: accel: sca3000: remove unused last_timestamp field iio: accel: adxl372: remove unused int2_bitmask field iio: adc: ad7766: Use iio_trigger_generic_data_rdy_poll() iio: magnetometer: Remove IRQF_ONESHOT iio: Replace IRQF_ONESHOT with IRQF_NO_THREAD iio: Use IRQF_NO_THREAD iio: dac: Add MAX22007 DAC driver support dt-bindings: iio: dac: Add max22007 ... commit 0a1fc2f301529ac75aec0ce80d5ab9d9e4dc4b16 Author: Daniel Hodges Date: Sat Jan 31 19:08:40 2026 -0800 nvme-fabrics: use kfree_sensitive() for DHCHAP secrets The DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) contain authentication key material for NVMe-oF. Use kfree_sensitive() instead of kfree() in nvmf_free_options() to ensure secrets are zeroed before the memory is freed, preventing recovery from freed pages. Reviewed-by: Christoph Hellwig Signed-off-by: Daniel Hodges Signed-off-by: Keith Busch commit 6b95cc562de2889a9333843dda073ba875f9e808 Author: Jiri Olsa Date: Mon Feb 2 08:58:49 2026 +0100 ftrace: Fix direct_functions leak in update_ftrace_direct_del Alexei reported memory leak in update_ftrace_direct_del. We miss cleanup of the replaced direct_functions in the success path in update_ftrace_direct_del, adding that. Fixes: 8d2c1233f371 ("ftrace: Add update_ftrace_direct_del function") Reported-by: Alexei Starovoitov Closes: https://lore.kernel.org/bpf/aX_BxG5EJTJdCMT9@krava/T/#m7c13f5a95f862ed7ab78e905fbb678d635306a0c Signed-off-by: Jiri Olsa Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20260202075849.1684369-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 2e06d54ea9a25e2925a31eb5410af0f16baa8f19 Author: Emil Tsalapatis Date: Sun Feb 1 19:42:08 2026 -0500 tools/sched_ext: Fix data header access during free in scx_sdt Fix a pointer arithmetic error in scx_sdt during freeing that causes the allocator to use the wrong memory address for the allocation's data header. Fixes: 36929ebd17ae ("tools/sched_ext: add arena based scheduler") Signed-off-by: Emil Tsalapatis Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 2d2b3fe002797c8de2c71236662593bf36de834d Author: Dan Williams Date: Fri Jan 30 16:04:03 2026 -0800 cxl/port: Unify endpoint and switch port lookup In support of generic CXL protocol error handling across various 'struct cxl_port' types, update find_cxl_port_by_uport() to retrieve endpoint CXL port companions from endpoint PCIe device instances. The end result is that upstream switch ports and endpoint ports can share error handling and eventually delete the misplaced cxl_error_handlers from the cxl_pci class driver. Reviewed-by: Terry Bowman Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Terry Bowman Signed-off-by: Dan Williams Link: https://patch.msgid.link/20260131000403.2135324-10-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit dab7162d0ae782295c2c2cff4bb386ee6ae5d566 Author: Dan Williams Date: Fri Jan 30 16:04:02 2026 -0800 cxl/port: Move endpoint component register management to cxl_port In preparation for generic protocol error handling across CXL endpoints, whether they be memory expander class devices or accelerators, drop the endpoint component management from cxl_dev_state. Organize all CXL port component management through the common cxl_port driver. Note that the end game is that drivers/cxl/core/ras.c loses all dependencies on a 'struct cxl_dev_state' parameter and operates only on port resources. The removal of component register mapping from cxl_pci is an incremental step towards that. Reviewed-by: Terry Bowman Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Terry Bowman Signed-off-by: Dan Williams Link: https://patch.msgid.link/20260131000403.2135324-9-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit ef1df6cf69785ec6c949ecfa92c49cfc5e237576 Author: Terry Bowman Date: Fri Jan 30 16:04:01 2026 -0800 cxl/port: Map Port RAS registers In preparation for CXL VH (Virtual Host) topology protocol error handling, add RAS capability registered mapping for all ports in a CXL VH topology. This includes the RAS capabilities of Switch Upstream Ports, Switch Downstream Ports, Host Bridge Ports ("upstream"), and Root Ports ("downstream") Update cxl_port_add_dport() to map the upstream RAS capability on first 'dport' attach. Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Co-developed-by: Dan Williams Signed-off-by: Dan Williams Tested-by: Terry Bowman Link: https://patch.msgid.link/20260131000403.2135324-8-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 7f5ff740ce0bcde242dafcc3f9bb3cbe6b5b8f3a Author: Dan Williams Date: Fri Jan 30 16:04:00 2026 -0800 cxl/port: Move dport RAS setup to dport add time Towards the end goal of making all CXL RAS capability handling uniform across host bridge ports, upstream switch ports, and endpoint ports, move dport RAS setup. Move it to cxl_switch_port_probe() context for switch / VH dports (via cxl_port_add_dport()) and cxl_endpoint_port_probe() context for an RCH dport. Rename the RAS setup helper to devm_cxl_dport_ras_setup() for symmetry with devm_cxl_switch_port_decoders_setup(). Only the RCH version needs to be exported and the cxl_test mocking can be deleted with a dev_is_pci() check on the dport_dev. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Terry Bowman Signed-off-by: Dan Williams Link: https://patch.msgid.link/20260131000403.2135324-7-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 0c4762e26879acc101790269382f230f22fd6905 Author: Fuad Tabba Date: Mon Feb 2 15:22:53 2026 +0000 KVM: arm64: nv: Avoid NV stage-2 code when NV is not supported The NV stage-2 manipulation functions kvm_nested_s2_unmap(), kvm_nested_s2_wp(), and others, are being called for any stage-2 manipulation regardless of whether nested virtualization is supported or enabled for the VM. For protected KVM (pKVM), `struct kvm_pgtable` uses the `pkvm_mappings` member of the union. This member aliases `ia_bits`, which is used by the non-protected NV code paths. Attempting to read `pgt->ia_bits` in these functions results in treating protected mapping pointers or state values as bit-shift amounts. This triggers a UBSAN shift-out-of-bounds error: UBSAN: shift-out-of-bounds in arch/arm64/kvm/nested.c:1127:34 shift exponent 174565952 is too large for 64-bit type 'unsigned long' Call trace: __ubsan_handle_shift_out_of_bounds+0x28c/0x2c0 kvm_nested_s2_unmap+0x228/0x248 kvm_arch_flush_shadow_memslot+0x98/0xc0 kvm_set_memslot+0x248/0xce0 Since pKVM and NV are mutually exclusive, prevent entry into these NV handling functions if the VM has not allocated any nested MMUs (i.e., `kvm->arch.nested_mmus_size` is 0). Fixes: 7270cc9157f47 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers") Suggested-by: Marc Zyngier Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260202152310.113467-1-tabba@google.com Signed-off-by: Marc Zyngier commit 3864cb60dad5a6c1bd9f444740cf541a1d8cda99 Author: Dan Williams Date: Fri Jan 30 16:03:59 2026 -0800 cxl/port: Move dport probe operations to a driver event In preparation for adding more register setup to the cxl_port_add_dport() path (for RAS register mapping), move the dport creation event to a driver callback. This achieves two goals, it puts driver operations logically where they belong, in a driver, and it obviates the gymnastics of DECLARE_TESTABLE() which just makes a mess of grepping for CXL symbols. In other words, a driver callback is less of an ongoing maintenance burden than this DECLARE_TESTABLE arrangement that does not scale and diminishes the grep-ability of the codebase. cxl_port_add_dport() moves mostly unmodified from drivers/cxl/core/port.c. The only deliberate change is that it now assumes that the device_lock is held on entry and the driver is attached (just like cxl_port_probe()). Reviewed-by: Terry Bowman Tested-by: Terry Bowman Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Dan Williams Link: https://patch.msgid.link/20260131000403.2135324-6-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 86e756715db22cd79a9726c22644415c46b6b149 Author: Dan Williams Date: Fri Jan 30 16:03:58 2026 -0800 cxl/port: Move decoder setup before dport creation There are port setup actions that run on first dport arrival, and there are setup actions that run per dport. RAS register setup is a future additional setup action to run per-port (once the first dport arrives), and each dport also has RAS registers to map. Before adding that, flip the order of "first dport" and "per-dport" actions. This makes allocation symmetric with teardown, "first dport" actions unwind after last dport removed. It also allows for using a devres group to collect the unrelated decoder, RAS, and dport setup actions into one group release action. The new cxl_port_open_group() collects "first dport" and "per-dport" into one group that can be released on any failure. This group's lifetime only needs to span the short duration of cxl_port_add_dport() to cleanup all potential damage from failing to add a dport. Contrast that to the "dport" devres group that is called upon to destruct fully formed dport objects. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Terry Bowman Signed-off-by: Dan Williams Link: https://patch.msgid.link/20260131000403.2135324-5-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit afa2bdba1ee28e21f30fe5391b0273b58b32e0d3 Author: Dan Williams Date: Fri Jan 30 16:03:57 2026 -0800 cxl/port: Cleanup dport removal with a devres group In preparation for adding more setup actions like RAS register mapping, introduce a devres group to collect all the dport creation / registration actions. This replaces the maintenance tedium of open coding several devm_release_action() calls in del_dport(). Tested-by: Terry Bowman Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260131000403.2135324-4-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 83ccbaf1a1075ded82329d27de01d3b2681986ec Author: Dan Williams Date: Fri Jan 30 16:03:56 2026 -0800 cxl/port: Reduce number of @dport variables in cxl_port_add_dport() In preparation for refactoring cxl_port_add_dport() to add RAS register setup, cleanup the number of dport variables with a dport_exists() helper. Kill the @dport needed to check for duplicates, rename @new_dport to @dport. Reported-by: Jonathan Cameron Closes: http://lore.kernel.org/20260116150119.00003bbd@huawei.com Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Terry Bowman Signed-off-by: Dan Williams Link: https://patch.msgid.link/20260131000403.2135324-3-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 47fec713d97fb6b823026f723435b58af541bd8d Author: Dan Williams Date: Fri Jan 30 16:03:55 2026 -0800 cxl/port: Cleanup handling of the nr_dports 0 -> 1 transition There are multiple setup actions that can occur for a switch port after it is known that it has at least one active downstream link. That work is currently split between __devm_cxl_add_dport(), the add_dport() helper, and cxl_port_add_dport() where decoder setup occurs. Clean this up by moving all @dport object setup responsibilities into add_dport() and all port effects into cxl_port_add_dport(). add_dport() handles taking a reference on @dport->dport_dev, and cxl_port_add_dport() grows the awareness to setup the port component registers. This removes an awkward open-coded xa_erase() from the middle of __devm_cxl_add_dport() and instead tasks cxl_port_add_dport() with calling the common @dport destruction path if anything goes wrong. After this @port->nr_dports is always the count of @dports in the @port->dports xarray, and cxl_dport_remove() is symmetric with add_dport(). With ->nr_dports now reliably tracking the number of dports the use of ida_is_empty() can be dropped. Recall that the ida is only cleared on "release" of decoder objects, and release can be arbitrarily delayed past unregistration. Lastly port->component_reg_phys is no longer reset to CXL_RESOURCE_NONE post setup, no reason is seen to carry that forward. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Tested-by: Terry Bowman Signed-off-by: Dan Williams Link: https://patch.msgid.link/20260131000403.2135324-2-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit bb0c99e08ab9aa6d04b40cb63c72db9950d51749 Author: Marco Elver Date: Fri Jan 30 14:28:24 2026 +0100 arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y The implementation of __READ_ONCE() under CONFIG_LTO=y incorrectly qualified the fallback "once" access for types larger than 8 bytes, which are not atomic but should still happen "once" and suppress common compiler optimizations. The cast `volatile typeof(__x)` applied the volatile qualifier to the pointer type itself rather than the pointee. This created a volatile pointer to a non-volatile type, which violated __READ_ONCE() semantics. Fix this by casting to `volatile typeof(*__x) *`. With a defconfig + LTO + debug options build, we see the following functions to be affected: xen_manage_runstate_time (884 -> 944 bytes) xen_steal_clock (248 -> 340 bytes) ^-- use __READ_ONCE() to load vcpu_runstate_info structs Fixes: e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y") Cc: stable@vger.kernel.org Reviewed-by: Boqun Feng Signed-off-by: Marco Elver Tested-by: David Laight Signed-off-by: Will Deacon commit 2c3a0b730012ef87aaaf35243e1fbe9880666f7c Author: Gustavo A. R. Silva Date: Mon Sep 22 16:20:47 2025 +0200 dlm: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration to the end of the corresponding structure. Notice that `struct dlm_message` is a flexible structure, this is a structure that contains a flexible-array member. Fix the following warning: fs/dlm/dlm_internal.h:609:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Signed-off-by: David Teigland commit 91214661489467f8452d34edbf257488d85176e4 Author: Li Chen Date: Mon Feb 2 22:37:54 2026 +0800 io_uring: allow io-wq workers to exit when unused io_uring keeps a per-task io-wq around, even when the task no longer has any io_uring instances. If the task previously used io_uring for file I/O, this can leave an unrelated iou-wrk-* worker thread behind after the last io_uring instance is gone. When the last io_uring ctx is removed from the task context, mark the io-wq exit-on-idle so workers can go away. Clear the flag on subsequent io_uring usage. Signed-off-by: Li Chen Signed-off-by: Jens Axboe commit 38aa434ab9335ce2d178b7538cdf01d60b2014c3 Author: Li Chen Date: Mon Feb 2 22:37:53 2026 +0800 io_uring/io-wq: add exit-on-idle state io-wq uses an idle timeout to shrink the pool, but keeps the last worker around indefinitely to avoid churn. For tasks that used io_uring for file I/O and then stop using io_uring, this can leave an iou-wrk-* thread behind even after all io_uring instances are gone. This is unnecessary overhead and also gets in the way of process checkpoint/restore. Add an exit-on-idle state that makes all io-wq workers exit as soon as they become idle, and provide io_wq_set_exit_on_idle() to toggle it. Signed-off-by: Li Chen Signed-off-by: Jens Axboe commit 65d466b6298470ce21ab21ebfdb51309d515737d Author: Yu Kuai Date: Mon Feb 2 16:05:23 2026 +0800 blk-mq-debugfs: warn about possible deadlock Creating new debugfs entries can trigger fs reclaim, hence we can't do this with queue frozen, meanwhile, other locks that can be held while queue is frozen should not be held as well. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Reviewed-by: Ming Lei Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd Author: Yu Kuai Date: Mon Feb 2 16:05:22 2026 +0800 blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while creating debugfs entries for hctxs. Hence add debugfs_mutex there, it's safe because queue is not frozen. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Reviewed-by: Ming Lei Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 5ae4b12ee6422a816efca4ede8411e4d5503b5ac Author: Yu Kuai Date: Mon Feb 2 16:05:21 2026 +0800 blk-mq-debugfs: remove blk_mq_debugfs_unregister_rqos() Because this helper is only used by iocost and iolatency, while they don't have debugfs entries. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Reviewed-by: Ming Lei Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 70bafa5e31ff979c4c38ac9838cc960a32c04f49 Author: Yu Kuai Date: Mon Feb 2 16:05:20 2026 +0800 blk-mq-debugfs: make blk_mq_debugfs_register_rqos() static Because it's only used inside blk-mq-debugfs.c now. Reviewed-by: Nilay Shroff Signed-off-by: Yu Kuai Reviewed-by: Ming Lei Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 3c17a346ffc613615f48c6f1ed30cdf328bab805 Author: Yu Kuai Date: Mon Feb 2 16:05:19 2026 +0800 blk-rq-qos: fix possible debugfs_mutex deadlock Currently rq-qos debugfs entries are created from rq_qos_add(), while rq_qos_add() can be called while queue is still frozen. This can deadlock because creating new entries can trigger fs reclaim. Fix this problem by delaying creating rq-qos debugfs entries after queue is unfrozen. - For wbt, 1) it can be initialized by default, fix it by calling new helper after wbt_init() from wbt_init_enable_default(); 2) it can be initialized by sysfs, fix it by calling new helper after queue is unfrozen from wbt_set_lat(). - For iocost and iolatency, they can only be initialized by blkcg configuration, however, they don't have debugfs entries for now, hence they are not handled yet. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Reviewed-by: Ming Lei Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 3f0bea9f3b9e7d9bdc3794103575168ef007d309 Author: Yu Kuai Date: Mon Feb 2 16:05:18 2026 +0800 blk-mq-debugfs: factor out a helper to register debugfs for all rq_qos There is already a helper blk_mq_debugfs_register_rqos() to register one rqos, however this helper is called synchronously when the rqos is created with queue frozen. Prepare to fix possible deadlock to create blk-mq debugfs entries while queue is still frozen. Reviewed-by: Ming Lei Reviewed-by: Nilay Shroff Signed-off-by: Yu Kuai Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 41afaeeda5099d9cd07eaa7dc6c3d20c6f1dd9e9 Author: Yu Kuai Date: Mon Feb 2 16:05:17 2026 +0800 blk-wbt: fix possible deadlock to nest pcpu_alloc_mutex under q_usage_counter If wbt is disabled by default and user configures wbt by sysfs, queue will be frozen first and then pcpu_alloc_mutex will be held in blk_stat_alloc_callback(). Fix this problem by allocating memory first before queue frozen. Signed-off-by: Yu Kuai Reviewed-by: Nilay Shroff Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 2751b90051a0211ed7c78f26eb2a9b7038804b9b Author: Yu Kuai Date: Mon Feb 2 16:05:16 2026 +0800 blk-wbt: factor out a helper wbt_set_lat() To move implementation details inside blk-wbt.c, prepare to fix possible deadlock to call wbt_init() while queue is frozen in the next patch. Reviewed-by: Ming Lei Reviewed-by: Nilay Shroff Signed-off-by: Yu Kuai Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 06564bae93d024e346c49304dfb4e2aaa68cf620 Author: Ondrej Kozina Date: Fri Jan 30 17:33:52 2026 +0100 sed-opal: ignore locking ranges array when not enabling SUM. The locking ranges count and the array items are always ignored unless Single User Mode (SUM) is requested in the activate method. It is useless to enforce limits of unused array in the non-SUM case. Signed-off-by: Ondrej Kozina Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 229f4125746a520b42bde1005c22fe27117f57f5 Merge: 5314d25afbc44d b36844f7d11e1f Author: Jens Axboe Date: Mon Feb 2 07:03:23 2026 -0700 Merge tag 'md-7.0-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into for-7.0/block Pull MD fixes from Yu Kuai: "Bug Fixes: - Fix return value of mddev_trylock (Xiao Ni) - Fix memory leak in raid1_run() (Zilin Guan) Maintainers: - Add Li Nan as mdraid reviewer (Li Nan)" * tag 'md-7.0-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: MAINTAINERS: Add Li Nan as md/raid reviewer md: fix return value of mddev_trylock md/raid1: fix memory leak in raid1_run() commit e4aa247d94a04574297a8bc9fabbede0dcba1ab6 Author: Even Xu Date: Mon Feb 2 11:01:44 2026 +0800 HID: Intel-thc-hid: Intel-thc: Fix wrong register fields updating Clear the target bit fields in register before setting new values. This ensures proper field updates by removing any existing bits that might interfere with the new configuration. Fixes: 22da60f0304b ("HID: Intel-thc-hid: Intel-thc: Introduce interrupt delay control") Fixes: 45e92a093099 ("HID: Intel-thc-hid: Intel-thc: Introduce max input size control") Signed-off-by: Even Xu Tested-by: Rui Zhang Signed-off-by: Jiri Kosina commit 42e3aac65c1c9eb36cdee0d8312a326196e0822f Author: Kalesh AP Date: Mon Feb 2 19:04:13 2026 +0530 IB/core: Extend rate limit support for RC QPs Broadcom devices supports setting the rate limit while changing RC QP state from INIT to RTR, RTR to RTS and RTS to RTS. Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20260202133413.3182578-6-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Damodharam Ammepalli Signed-off-by: Leon Romanovsky commit cae42d97d94e9c9803554ca6d577297a2270d471 Author: Kalesh AP Date: Mon Feb 2 19:04:12 2026 +0530 RDMA/mlx5: Support rate limit only for Raw Packet QP mlx5 based hardware supports rate limiting only on Raw ethernet QPs. Added an explicit check to fail the operation on any other QP types. The rate limit support has been enahanced in the stack for RC QPs too. Compile tested only. CC: Leon Romanovsky Signed-off-by: Kalesh AP Signed-off-by: Selvin Xavier Link: https://patch.msgid.link/20260202133413.3182578-5-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 949e7c062d3769d9522e8a4abe080fb92ddd61bf Author: Kalesh AP Date: Mon Feb 2 19:04:11 2026 +0530 RDMA/bnxt_re: Report QP rate limit in debugfs Update QP info debugfs hook to report the rate limit applied on the QP. 0 means unlimited. Signed-off-by: Damodharam Ammepalli Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20260202133413.3182578-4-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 13edc7d4e0aa4abb5d50a062b61b9bffb01b0327 Author: Kalesh AP Date: Mon Feb 2 19:04:10 2026 +0530 RDMA/bnxt_re: Report packet pacing capabilities when querying device Enable the support to report packet pacing capabilities from kernel to user space. Packet pacing allows to limit the rate to any number between the maximum and minimum. The capabilities are exposed to user space through query_device. The following capabilities are reported: 1. The maximum and minimum rate limit in kbps. 2. Bitmap showing which QP types support rate limit. Signed-off-by: Damodharam Ammepalli Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20260202133413.3182578-3-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Anantha Prabhu Signed-off-by: Leon Romanovsky commit e72d45d274d8edd8c1c365444403a02147f484a6 Author: Kalesh AP Date: Mon Feb 2 19:04:09 2026 +0530 RDMA/bnxt_re: Add support for QP rate limiting Broadcom P7 chips supports applying rate limit to RC QPs. It allows adjust shaper rate values during the INIT -> RTR, RTR -> RTS, RTS -> RTS state changes or after QP transitions to RTR or RTS. Signed-off-by: Damodharam Ammepalli Reviewed-by: Hongguang Gao Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20260202133413.3182578-2-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 56f7db581ee73af53cd512e00a6261a025bf1d58 Author: Ryan Lin Date: Fri Jan 30 13:34:56 2026 +0800 HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients During a warm reset flow, the cl->device pointer may be NULL if the reset occurs while clients are still being enumerated. Accessing cl->device->reference_count without a NULL check leads to a kernel panic. This issue was identified during multi-unit warm reboot stress clycles. Add a defensive NULL check for cl->device to ensure stability under such intensive testing conditions. KASAN: null-ptr-deref in range [0000000000000000-0000000000000007] Workqueue: ish_fw_update_wq fw_reset_work_fn Call Trace: ishtp_bus_remove_all_clients+0xbe/0x130 [intel_ishtp] ishtp_reset_handler+0x85/0x1a0 [intel_ishtp] fw_reset_work_fn+0x8a/0xc0 [intel_ish_ipc] Fixes: 3703f53b99e4a ("HID: intel_ish-hid: ISH Transport layer") Signed-off-by: Ryan Lin Signed-off-by: Jiri Kosina commit ddd9bf2212ab80bb90fa986cd987c671de53bd44 Author: Simon Trimmer Date: Tue Jan 27 17:34:49 2026 +0000 ASoC: amd: acp: Add ACP7.0 match entries for Cirrus Logic parts This adds some match entries for a few system configurations: cs42l45 link 1 UID 0 cs35l63 link 0 UID 0 cs35l63 link 0 UID 2 cs35l63 link 0 UID 4 cs35l63 link 0 UID 6 cs42l45 link 0 UID 0 cs35l63 link 1 UID 0 cs35l63 link 1 UID 1 cs42l45 link 0 UID 0 cs35l63 link 1 UID 1 cs35l63 link 1 UID 3 cs42l45 link 1 UID 0 cs35l63 link 0 UID 0 cs35l63 link 0 UID 1 cs35l63 link 0 UID 0 cs35l63 link 0 UID 2 cs35l63 link 0 UID 4 cs35l63 link 0 UID 6 cs42l43 link 0 UID 1 cs42l43b link 0 UID 1 cs42l45 link 0 UID 0 cs42l45 link 1 UID 0 Signed-off-by: Simon Trimmer Reviewed-by: Maciej Strozek Link: https://patch.msgid.link/6cac5670fd5bc14201d925584251d75e59307431.1769534442.git.simont@opensource.cirrus.com Signed-off-by: Mark Brown commit 3de9cf4782492b19c9d8bdac309462027e18ab43 Author: Simon Trimmer Date: Tue Jan 27 17:34:48 2026 +0000 ASoC: amd: acp: Sort Cirrus Logic match entries In preparation for adding more match entries sort the ones that are present. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/0a756390dfb7e928246d0f35c611f175e1311e55.1769534442.git.simont@opensource.cirrus.com Signed-off-by: Mark Brown commit 5eb3fc48d37157fd83315bcbb5693269fc497fb7 Author: Simon Trimmer Date: Tue Jan 27 17:34:47 2026 +0000 ASoC: amd: acp: Rename Cirrus Logic component match entries to include link and uid In preparation for having similar matches with multiple UIDs on the same bus rename the match entries to include the bus link and device uid numbers in their name using the lNuN convention. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/f8f7fab5131ea6080421812dcce3e9ffc5b936e0.1769534442.git.simont@opensource.cirrus.com Signed-off-by: Mark Brown commit 9ba734901cfd67d1b2101cce803a62d422e81b67 Author: Simon Trimmer Date: Tue Jan 27 17:34:46 2026 +0000 ASoC: amd: acp: Sort match table into most specific first Match tables should be sorted so that more complex combinations of device matches are before simpler combinations, with the single device matches at the end. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/50c385a7f64ccd75cabf49eddbc0ec6fe13f3252.1769534442.git.simont@opensource.cirrus.com Signed-off-by: Mark Brown commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 Author: Hsieh Hung-En Date: Sat Jan 31 00:00:17 2026 +0800 ASoC: es8328: Add error unwind in resume Handle failures in the resume path by unwinding previously enabled resources. If enabling regulators or syncing the regcache fails, disable regulators and unprepare the clock to avoid leaking resources and leaving the device in a partially resumed state. Signed-off-by: Hsieh Hung-En Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com Signed-off-by: Mark Brown commit 9917d99f44231b531a1c704bbbd58059e78c2f59 Author: Hsieh Hung-En Date: Sat Jan 31 00:00:16 2026 +0800 ASoC: es8328: Use cached regmap on resume Use the regmap stored in the driver private data when restoring the register cache on resume, instead of looking it up from the device. This keeps the resume path consistent with the regmap instance used by the driver and avoids relying on a separate dev_get_regmap() lookup. Signed-off-by: Hsieh Hung-En Link: https://patch.msgid.link/20260130160017.2630-5-hungen3108@gmail.com Signed-off-by: Mark Brown commit 3570e8eef217e60178d23eb490a34d64249bee45 Author: Hsieh Hung-En Date: Sat Jan 31 00:00:15 2026 +0800 ASoC: es8328: Check errors in set_dai_fmt() Check and propagate return values from snd_soc_component_update_bits() in es8328_set_dai_fmt(). This avoids silent failures when register updates fail and ensures the DAI format is not left in an inconsistent state. Signed-off-by: Hsieh Hung-En Link: https://patch.msgid.link/20260130160017.2630-4-hungen3108@gmail.com Signed-off-by: Mark Brown commit 0801a03a317b4848ca8c10a98f9b84028b7c8fc6 Author: Hsieh Hung-En Date: Sat Jan 31 00:00:14 2026 +0800 ASoC: es8328: Propagate errors in set_bias_level() Register writes and updates in set_bias_level() ignored return values, potentially masking I/O failures during bias level transitions. Check and propagate errors from component register writes and updates. Signed-off-by: Hsieh Hung-En Link: https://patch.msgid.link/20260130160017.2630-3-hungen3108@gmail.com Signed-off-by: Mark Brown commit 4c6b74d58766ce7cd66ae8e14babf877039adef6 Author: Hsieh Hung-En Date: Sat Jan 31 00:00:13 2026 +0800 ASoC: es8328: Fix DAC deemphasis control handling The DAC deemphasis control updated the hardware before updating the cached state, causing the previous setting to be applied. Update the cached deemphasis state first and then apply the setting. Also check and propagate errors from es8328_set_deemph() in hw_params(). Signed-off-by: Hsieh Hung-En Link: https://patch.msgid.link/20260130160017.2630-2-hungen3108@gmail.com Signed-off-by: Mark Brown commit af4fe07a9d963a72438ade96cf090e84b3399d0c Author: Bastien Nocera Date: Sun Jan 25 13:12:02 2026 +0100 HID: logitech-hidpp: Add support for Logitech K980 Add support for the solar-charging Logitech K980 keyboard, over Bluetooth. Bolt traffic doesn't get routed through logitech-dj, so this code isn't triggered when Bolt is used. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit 4c6a83fc2f3061108828fbd2c59bdd89d9dd54e7 Author: Bastien Nocera Date: Sun Jan 25 13:12:01 2026 +0100 HID: logitech-dj: Differentiate "invalid device index" error We had 2 codepaths throwing the "invalid device index" error, but one of them was about the index not matching the receiver, so change the error to "invalid receiver index". Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit b36844f7d11e1f322d1e48a828c5bfb4a0ecabd1 Author: Li Nan Date: Mon Feb 2 16:32:03 2026 +0800 MAINTAINERS: Add Li Nan as md/raid reviewer I've long contributed to and reviewed the md/raid subsystem. I've fixed many bugs and done code refactors, with dozens of patches merged. I now volunteer to work as a reviewer for this subsystem. Link: https://lore.kernel.org/linux-raid/20260202083203.3017096-1-linan666@huaweicloud.com Signed-off-by: Li Nan Signed-off-by: Yu Kuai commit a145cfd0ffe7bd7d61ce25839cec737c449b0d2c Author: Chris Morgan Date: Wed Jan 28 11:46:07 2026 -0600 ASoC: codecs: aw87390: Add Anbernic RG-DS amp driver Add support for Anbernic's RG-DS audio amplifiers, powered by Awinic AW87391 amplifier ICs. These chips typically require an init sequence provided by firmware, but the manufacturer did not provide firmware in this case. As a result we had to hard-code the init sequence and use a device specific binding (rather than a binding just for the aw87391). Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20260128174608.1498-3-macroalpha82@gmail.com Signed-off-by: Mark Brown commit c26d6cdade6c2a96049f24fac64a8e3734188703 Author: Chris Morgan Date: Wed Jan 28 11:46:06 2026 -0600 ASoC: dt-bindings: aw87390: Add Anbernic RG-DS Amplifier Add a binding for the Anbernic RG-DS Amplifier, which is an Awinic aw87391 audio amplifier. This manufacturer did not provide firmware so we have to use a list of init commands instead, requiring device specific functionality rather than generic aw87391 functionality. Signed-off-by: Chris Morgan Acked-by: Conor Dooley Link: https://patch.msgid.link/20260128174608.1498-2-macroalpha82@gmail.com Signed-off-by: Mark Brown commit 9058798652c8bc0584ed1fb0766a1015046c06e8 Author: John Johansen Date: Mon Feb 2 04:12:02 2026 -0800 apparmor: fix aa_label to return state from compount and component match aa-label_match is not correctly returning the state in all cases. The only reason this didn't cause a error is that all callers currently ignore the return value. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602020631.wXgZosyU-lkp@intel.com/ Fixes: a4c9efa4dbad6 ("apparmor: make label_match return a consistent value") Signed-off-by: John Johansen commit 102ada7ca37ed8358bd70c6f8e6475ebacf6f76d Author: John Johansen Date: Mon Feb 2 03:45:21 2026 -0800 apparmor: fix fmt string type error in process_strs_entry pointer subtraction has a type of int when using clang on hexagon, microblaze (and possibly other archs). We know the subtraction is postive so cast the expression to unsigned long to match what is in the fmt string. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602021429.CcmWkR9K-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202602021427.PvvDjgyL-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202602021510.JPzX5zKb-lkp@intel.com/ Fixes: c140dcd1246bf ("apparmor: make str table more generic and be able to have multiple entries") Signed-off-by: John Johansen commit 0ec5ed7c95d1ba6a74491928ff38abb351dbed36 Author: David Lechner Date: Fri Jan 23 14:37:30 2026 -0600 spi: axi-spi-engine: support SPI_MULTI_LANE_MODE_STRIPE Add support for SPI_MULTI_LANE_MODE_STRIPE to the AXI SPI engine driver. The v2.0.0 version of the AXI SPI Engine IP core supports multiple lanes. This can be used with SPI_MULTI_LANE_MODE_STRIPE to support reading from simultaneous sampling ADCs that have a separate SDO line for each analog channel. This allows reading all channels at the same time to increase throughput. Reviewed-by: Marcelo Schmitt Reviewed-by: Jonathan Cameron Signed-off-by: David Lechner Link: https://patch.msgid.link/20260123-spi-add-multi-bus-support-v6-7-12af183c06eb@baylibre.com Signed-off-by: Mark Brown commit 2e706f86a5aa94702694774efb7d8b151c6d724f Author: David Lechner Date: Fri Jan 23 14:37:29 2026 -0600 spi: dt-bindings: adi,axi-spi-engine: add multi-lane support Extend the ADI AXI SPI engine binding for multiple data lanes. This SPI controller has a capability to read multiple data words at the same time (e.g. for use with simultaneous sampling ADCs). The current FPGA implementation can support up to 8 data lanes at a time (depending on a compile-time configuration option). Reviewed-by: Rob Herring (Arm) Reviewed-by: Jonathan Cameron Signed-off-by: David Lechner Link: https://patch.msgid.link/20260123-spi-add-multi-bus-support-v6-6-12af183c06eb@baylibre.com Signed-off-by: Mark Brown commit 05c3bd745bb065223201824f0044455558541bdc Author: David Lechner Date: Fri Jan 23 14:37:28 2026 -0600 spi: Documentation: add page on multi-lane support Add a new page to Documentation/spi/ describing how multi-lane SPI support works. This is uncommon functionality so it deserves its own documentation page. Reviewed-by: Marcelo Schmitt Signed-off-by: David Lechner Link: https://patch.msgid.link/20260123-spi-add-multi-bus-support-v6-5-12af183c06eb@baylibre.com Signed-off-by: Mark Brown commit 5621a7bc851658ea2f8e015060f8bb5d27739b06 Author: David Lechner Date: Fri Jan 23 14:37:27 2026 -0600 spi: add multi_lane_mode field to struct spi_transfer Add a new multi_lane_mode field to struct spi_transfer to allow peripherals that support multiple SPI lanes to be used with a single SPI controller. This requires both the peripheral and the controller to have multiple serializers connected to separate data lanes. It could also be used with a single controller and multiple peripherals that are functioning as a single logical device (similar to parallel memories). Acked-by: Nuno Sá Acked-by: Marcelo Schmitt Reviewed-by: Jonathan Cameron Signed-off-by: David Lechner Link: https://patch.msgid.link/20260123-spi-add-multi-bus-support-v6-4-12af183c06eb@baylibre.com Signed-off-by: Mark Brown commit 002d561f89c3a61ee17d38070e48ea4eb1243732 Author: David Lechner Date: Fri Jan 23 14:37:26 2026 -0600 spi: support controllers with multiple data lanes Add support for SPI controllers with multiple physical SPI data lanes. (A data lane in this context means lines connected to a serializer, so a controller with two data lanes would have two serializers in a single controller). This is common in the type of controller that can be used with parallel flash memories, but can be used for general purpose SPI as well. To indicate support, a controller just needs to set ctlr->num_data_lanes to something greater than 1. Peripherals indicate which lane they are connected to via device tree (ACPI support can be added if needed). The spi-{tx,rx}-bus-width DT properties can now be arrays. The length of the array indicates the number of data lanes, and each element indicates the bus width of that lane. For now, we restrict all lanes to have the same bus width to keep things simple. Support for an optional controller lane mapping property is also implemented. Signed-off-by: David Lechner Link: https://patch.msgid.link/20260123-spi-add-multi-bus-support-v6-3-12af183c06eb@baylibre.com Signed-off-by: Mark Brown commit 31eab8425110b933dd7c818809cb4ffa3b2c6d82 Author: David Lechner Date: Fri Jan 23 14:37:25 2026 -0600 spi: dt-bindings: add spi-{tx,rx}-lane-map properties Add spi-tx-lane-map and spi-rx-lane-map properties to the SPI peripheral device tree binding. These properties allow specifying the mapping of peripheral data lanes to controller data lanes. This is needed e.g. when some lanes are skipped on the controller side so that the controller can correctly route data to/from the peripheral. Reviewed-by: Rob Herring (Arm) Reviewed-by: Jonathan Cameron Signed-off-by: David Lechner Link: https://patch.msgid.link/20260123-spi-add-multi-bus-support-v6-2-12af183c06eb@baylibre.com Signed-off-by: Mark Brown commit 37bb4033e48b8a0ddee66fd77f9e12a9a930681b Author: David Lechner Date: Fri Jan 23 14:37:24 2026 -0600 spi: dt-bindings: change spi-{rx,tx}-bus-width to arrays Change spi-rx-bus-width and spi-tx-bus-width properties from single uint32 values to arrays of uint32 values. This allows describing SPI peripherals connected to controllers that have multiple data lanes for receiving or transmitting two or more words in parallel. Each index in the array corresponds to a physical data lane (one or more wires depending on the bus width). Additional mapping properties will be needed in cases where a lane on the controller or peripheral is skipped. Bindings that make use of this property are updated in the same commit to avoid validation errors. The adi,ad4030 binding can now better describe the chips multi-lane capabilities, so that binding is refined and gets a new example. Converting from single uint32 to array of uint32 does not break .dts/ .dtb files since there is no difference between specifying a single uint32 value and an array with a single uint32 value in devicetree. Reviewed-by: Rob Herring (Arm) Reviewed-by: Marcelo Schmitt Reviewed-by: Jonathan Cameron Signed-off-by: David Lechner Link: https://patch.msgid.link/20260123-spi-add-multi-bus-support-v6-1-12af183c06eb@baylibre.com Signed-off-by: Mark Brown commit 742048f2e128c06d0ef89ffc334519cb8e991f66 Author: Arnd Bergmann Date: Mon Feb 2 10:53:50 2026 +0100 ASoC: fsl_sai: add IMX_SCMI_MISC_DRV dependency The sai driver now links against the SCMI code directly, causing a link failure when that is in a loadable module: aarch64-linux-ld: sound/soc/fsl/fsl_sai.o: in function `fsl_sai_probe': fsl_sai.c:(.text+0x1fe4): undefined reference to `scmi_imx_misc_ctrl_set' Move the dependency from SND_SOC_FSL_MQS to SND_SOC_FSL_SAI. The MQS driver depends on the SAI one, so it still gets the same dependency indirectly. All other drivers that select the SAI symbol need the same dependency in turn, though that could probably get replaced with a 'depends on SND_SOC_FSL_SAI' to keep it simpler. Fixes: 19b08fd23b20 ("ASoC: fsl_sai: Add AUDMIX mode support on i.MX952") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260202095353.1233963-1-arnd@kernel.org Signed-off-by: Mark Brown commit cad9720dd7e4dcdaec8e854fb2c1d1d45fd6dbad Author: Arnd Bergmann Date: Mon Feb 2 10:53:14 2026 +0100 ASoC: sophgo: fix 64-bit division build failure cv1800b_adc_setbclk_div() does four 64-bit divisions in a row, which is rather inefficient on 32-bit systems, and using the plain division causes a build failure as a result: ERROR: modpost: "__aeabi_uldivmod" [sound/soc/sophgo/cv1800b-sound-adc.ko] undefined! Consolidate those into a single division using the div_u64() macro. Fixes: 4cf8752a03e6 ("ASoC: sophgo: add CV1800B internal ADC codec driver") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260202095323.1233553-1-arnd@kernel.org Signed-off-by: Mark Brown commit 1db63f6af17945aed7497ce34a5648add0c1b6d9 Author: Arnd Bergmann Date: Mon Feb 2 10:54:12 2026 +0100 ASoC: rt5575: fix SPI dependency The rt5575 driver fails to link when SPI support is in a loadable module but the codec is built-in: x86_64-linux-ld: vmlinux.o: in function `rt5575_i2c_probe': rt5575.c:(.text+0x9792ce): undefined reference to `rt5575_spi_get_device' rt5575.c:(.text+0x979332): undefined reference to `rt5575_spi_fw_load' Change the symbol in to a 'bool' and add a dependency that rules out the broken configuration. Fixes: 420739112e95 ("ASoC: rt5575: Add the codec driver for the ALC5575") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260202095432.1234133-1-arnd@kernel.org Signed-off-by: Mark Brown commit 3734b9463bd4fb5ac350842db55e2e0ccbf1b7a5 Author: John Johansen Date: Mon Feb 2 03:37:18 2026 -0800 apparmor: fix kernel-doc comments for inview subns was renamed inview to better reflect the function of the flag. Unfortunately the kernel-doc was not properly updated in 2 places. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602020737.vGCZFds1-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202602021427.PvvDjgyL-lkp@intel.com/ Fixes: 796c146fa6c82 ("apparmor: split xxx_in_ns into its two separate semantic use cases") Signed-off-by: John Johansen commit 3e28a67a85f9b569066f6dfcddadb39294c0c9d4 Author: Vinod Govindapillai Date: Fri Jan 30 11:59:19 2026 +0200 drm/i915/display: fix the pixel normalization handling for xe3p_lpd Pixel normalizer is enabled with normalization factor as 1.0 for FP16 formats in order to support FBC for those formats in xe3p_lpd. Previously pixel normalizer gets disabled during the plane disable routine. But there could be plane format settings without explicitly calling the plane disable in-between and we could endup keeping the pixel normalizer enabled for formats which we don't require that. This is causing crc mismatches in yuv formats and FIFO underruns in planar formats like NV12. Fix this by updating the pixel normalizer configuration based on the pixel formats explicitly during the plane settings arm calls itself - enable it for FP16 and disable it for other formats in HDR capable planes. v2: avoid redundant pixel normalization setting updates v3: moved the normalization factor definition to intel_fbc.c and some updates to comments v4: simplified the pixel normalizer setting handling Fixes: 5298eea7ed20 ("drm/i915/xe3p_lpd: use pixel normalizer for fp16 formats for FBC") Signed-off-by: Vinod Govindapillai Reviewed-by: Uma Shankar Link: https://patch.msgid.link/20260130095919.107805-1-vinod.govindapillai@intel.com (cherry picked from commit c0dc68f4e2aa7eddb9ec6d95931f9576d8fe7334) Signed-off-by: Joonas Lahtinen commit 24989330fb99189cf9ec4accef6ac81c7b1c31f7 Author: Mark Brown Date: Fri Jan 30 19:48:35 2026 +0000 time/kunit: Document handling of negative years of is_leap() The code local is_leap() helper was tried to be replaced by the RTC is_leap_year() function. Unfortunately the two aren't exactly equivalent, as the kunit variant uses a signed value for the year and the RTC an unsigned one. Since the KUnit tests cover a 16000 year range around the epoch they use year values that are very comfortably negative and hence get mishandled when passed into is_leap_year(). The change was reverted, so add a comment which prevents further attempts to do so. [ tglx: Adapted to the revert ] Signed-off-by: Mark Brown Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260130-kunit-fix-leap-year-v1-1-92ddf55dffd7@kernel.org commit df9ac55abd18628bd8cff687ea043660532a3654 Author: Georgia Garcia Date: Thu Jan 29 15:58:45 2026 -0300 apparmor: fix invalid deref of rawdata when export_binary is unset If the export_binary parameter is disabled on runtime, profiles that were loaded before that will still have their rawdata stored in apparmorfs, with a symbolic link to the rawdata on the policy directory. When one of those profiles are replaced, the rawdata is set to NULL, but when trying to resolve the symbolic links to rawdata for that profile, it will try to dereference profile->rawdata->name when profile->rawdata is now NULL causing an oops. Fix it by checking if rawdata is set. [ 168.653080] BUG: kernel NULL pointer dereference, address: 0000000000000088 [ 168.657420] #PF: supervisor read access in kernel mode [ 168.660619] #PF: error_code(0x0000) - not-present page [ 168.663613] PGD 0 P4D 0 [ 168.665450] Oops: Oops: 0000 [#1] SMP NOPTI [ 168.667836] CPU: 1 UID: 0 PID: 1729 Comm: ls Not tainted 6.19.0-rc7+ #3 PREEMPT(voluntary) [ 168.672308] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.679327] RIP: 0010:rawdata_get_link_base.isra.0+0x23/0x330 [ 168.682768] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 55 d0 48 85 ff 0f 84 e3 01 00 00 <48> 83 3c 25 88 00 00 00 00 0f 84 d4 01 00 00 49 89 f6 49 89 cc e8 [ 168.689818] RSP: 0018:ffffcdcb8200fb80 EFLAGS: 00010282 [ 168.690871] RAX: ffffffffaee74ec0 RBX: 0000000000000000 RCX: ffffffffb0120158 [ 168.692251] RDX: ffffcdcb8200fbe0 RSI: ffff88c187c9fa80 RDI: ffff88c186c98a80 [ 168.693593] RBP: ffffcdcb8200fbc0 R08: 0000000000000000 R09: 0000000000000000 [ 168.694941] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88c186c98a80 [ 168.696289] R13: 00007fff005aaa20 R14: 0000000000000080 R15: ffff88c188f4fce0 [ 168.697637] FS: 0000790e81c58280(0000) GS:ffff88c20a957000(0000) knlGS:0000000000000000 [ 168.699227] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 168.700349] CR2: 0000000000000088 CR3: 000000012fd3e000 CR4: 0000000000350ef0 [ 168.701696] Call Trace: [ 168.702325] [ 168.702995] rawdata_get_link_data+0x1c/0x30 [ 168.704145] vfs_readlink+0xd4/0x160 [ 168.705152] do_readlinkat+0x114/0x180 [ 168.706214] __x64_sys_readlink+0x1e/0x30 [ 168.708653] x64_sys_call+0x1d77/0x26b0 [ 168.709525] do_syscall_64+0x81/0x500 [ 168.710348] ? do_statx+0x72/0xb0 [ 168.711109] ? putname+0x3e/0x80 [ 168.711845] ? __x64_sys_statx+0xb7/0x100 [ 168.712711] ? x64_sys_call+0x10fc/0x26b0 [ 168.713577] ? do_syscall_64+0xbf/0x500 [ 168.714412] ? do_user_addr_fault+0x1d2/0x8d0 [ 168.715404] ? irqentry_exit+0xb2/0x740 [ 168.716359] ? exc_page_fault+0x90/0x1b0 [ 168.717307] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 1180b4c757aab ("apparmor: fix dangling symlinks to policy rawdata after replacement") Signed-off-by: Georgia Garcia Signed-off-by: John Johansen commit fb21cb08566ebed91d5c876db5c013cc8af83b89 Author: Fuad Tabba Date: Mon Feb 2 08:57:21 2026 +0000 KVM: arm64: Use standard seq_file iterator for vgic-debug debugfs The current implementation uses `vgic_state_iter` in `struct vgic_dist` to track the sequence position. This effectively makes the iterator shared across all open file descriptors for the VM. This approach has significant drawbacks: - It enforces mutual exclusion, preventing concurrent reads of the debugfs file (returning -EBUSY). - It relies on storing transient iterator state in the long-lived VM structure (`vgic_dist`). Refactor the implementation to use the standard `seq_file` iterator. Instead of storing state in `kvm_arch`, rely on the `pos` argument passed to the `start` and `next` callbacks, which tracks the logical index specific to the file descriptor. This change enables concurrent access and eliminates the `vgic_state_iter` field from `struct vgic_dist`. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260202085721.3954942-4-tabba@google.com Signed-off-by: Marc Zyngier commit 5ab24969705a9adadbc1d3cff4c1c15df174eafb Author: Fuad Tabba Date: Mon Feb 2 08:57:20 2026 +0000 KVM: arm64: Reimplement vgic-debug XArray iteration The vgic-debug interface implementation uses XArray marks (`LPI_XA_MARK_DEBUG_ITER`) to "snapshot" LPIs at the start of iteration. This modifies global state for a read-only operation and complicates reference counting, leading to leaks if iteration is aborted or fails. Reimplement the iterator to use dynamic iteration logic: - Remove `lpi_idx` from `struct vgic_state_iter`. - Replace the XArray marking mechanism with dynamic iteration using `xa_find_after(..., XA_PRESENT)`. - Wrap XArray traversals in `rcu_read_lock()`/`rcu_read_unlock()` to ensure safety against concurrent modifications (e.g., LPI unmapping). - Handle potential races where an LPI is removed during iteration by gracefully skipping it in `show()`, rather than warning. - Remove the unused `LPI_XA_MARK_DEBUG_ITER` definition. This simplifies the lifecycle management of the iterator and prevents resource leaks associated with the marking mechanism, and paves the way for using a standard seq_file iterator. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260202085721.3954942-3-tabba@google.com Signed-off-by: Marc Zyngier commit dcd79ed450934421158d81600f1be4c2e2af20bf Author: Fuad Tabba Date: Mon Feb 2 08:57:19 2026 +0000 KVM: arm64: Use standard seq_file iterator for idregs debugfs The current implementation uses `idreg_debugfs_iter` in `struct kvm_arch` to track the sequence position. This effectively makes the iterator shared across all open file descriptors for the VM. This approach has significant drawbacks: - It enforces mutual exclusion, preventing concurrent reads of the debugfs file (returning -EBUSY). - It relies on storing transient iterator state in the long-lived VM structure (`kvm_arch`). - The use of `u8` for the iterator index imposes an implicit limit of 255 registers. While not currently exceeded, this is fragile against future architectural growth. Switching to `loff_t` eliminates this overflow risk. Refactor the implementation to use the standard `seq_file` iterator. Instead of storing state in `kvm_arch`, rely on the `pos` argument passed to the `start` and `next` callbacks, which tracks the logical index specific to the file descriptor. This change enables concurrent access and eliminates the `idreg_debugfs_iter` field from `struct kvm_arch`. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260202085721.3954942-2-tabba@google.com Signed-off-by: Marc Zyngier commit 0d95280a2d54ebd3d38adc4ff67808009798978c Author: Lorenzo Bianconi Date: Thu Jan 29 14:15:46 2026 +0100 wifi: mac80211: Add eMLSR/eMLMR action frame parsing support Introduce support in AP mode for parsing of the Operating Mode Notification frame sent by the client to enable/disable MLO eMLSR or eMLMR if supported by both the AP and the client. Add drv_set_eml_op_mode mac80211 callback in order to configure underlay driver with eMLSR/eMLMR info. Tested-by: Christian Marangi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260129-mac80211-emlsr-v4-1-14bdadf57380@kernel.org Signed-off-by: Johannes Berg commit a1085114715ee9980405d6856276c5e88339cee7 Author: Johannes Berg Date: Fri Jan 30 16:21:07 2026 +0100 wifi: mac80211: add initial UHR support Add support for making UHR connections and accepting AP stations with UHR support. Link: https://patch.msgid.link/20260130164259.7185980484eb.Ieec940b58dbf8115dab7e1e24cb5513f52c8cb2f@changeid Signed-off-by: Johannes Berg commit 072e6f7f416f5d17be71000b31fb108651ad360d Author: Johannes Berg Date: Fri Jan 30 16:21:06 2026 +0100 wifi: cfg80211: add initial UHR support Add initial support for making UHR connections (or suppressing that), adding UHR capable stations on the AP side, encoding and decoding UHR MCSes (except rate calculation for the new MCSes 17, 19, 20 and 23) as well as regulatory support. Link: https://patch.msgid.link/20260130164259.54cc12fbb307.I26126bebd83c7ab17e99827489f946ceabb3521f@changeid Signed-off-by: Johannes Berg commit a7cb50156e8206562b001b3bb625045a0ee0f651 Author: Johannes Berg Date: Fri Jan 30 16:21:05 2026 +0100 wifi: ieee80211: add some initial UHR definitions This is based on Draft P802.11bn_D1.2, but that's still very incomplete, so don't handle a number of things and make some local decisions such as using 40 bits for MAC capabilities and 8 bits for PHY capabilities. Link: https://patch.msgid.link/20260130164259.b28c9456ff94.I5b11fb0345a933bf497fd802aecc72932d58dd68@changeid Signed-off-by: Johannes Berg commit 8067937fe0ded7054d72fd31f75fd788795d40cd Merge: ba90a7af74a563 4c1552473acf03 Author: Johannes Berg Date: Mon Feb 2 10:09:31 2026 +0100 Merge tag 'rtw-next-2026-01-30' of https://github.com/pkshih/rtw Pink-Ke Shih says: ================== rtw-next patches for -next Mainly refactor flow for preparation of rtw89 RTL8922DE. Others are random fixes and refinements. ================== Signed-off-by: Johannes Berg commit ba90a7af74a56326f4ff774674ff4f510dcddee1 Author: Amith A Date: Fri Jan 30 09:25:11 2026 +0530 wifi: mac80211: use wiphy_hrtimer_work for CAC timeout Prior initiating communication in a DFS channel, there should be a monitoring of RADAR in that channel for a minimum of 600 seconds if it is a Weather RADAR channel and 60 seconds for other DFS channels. This Channel Availability Check(CAC) is currently implemented by scheduling a work item for execution with a delay equal to an appropriate timeout. But this work item is observed to take more delay than specified (4-5 seconds in regular DFS channels and 25-30 seconds in Weather RADAR channels). Even though this delay is expected in case of delayed work queue as there is no guarantee that the work will be scheduled exactly after the specified delay, a delay of more than 20 seconds is too much for the AP to be in non-operational state. Recently commit 7ceba45a6658 ("wifi: cfg80211: add an hrtimer based delayed work item") added an infrastructure to overcome this issue by supporting high resolution timers for mac80211 delayed work, which do not have this timeout latency. Switch the CAC timeout to use this infrastructure, so the CAC completion handling is triggered with tighter timing and reduced latency. Signed-off-by: Amith A Link: https://patch.msgid.link/20260130035511.2328713-1-amith.a@oss.qualcomm.com [fix delay handling] Signed-off-by: Johannes Berg commit c3e92c7868fd1cade43a6fbc7e1d839ec1e9f264 Author: Lachlan Hodges Date: Fri Jan 30 11:53:19 2026 +1100 wifi: mac80211: correct ieee80211-{s1g/eht}.h include guard comments After the split of ieee80211.h some include guard comments weren't updated, update them to their new file names. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20260130005319.70019-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit ab89060fbc92edd6e852bf0f533f29140afabe0e Author: Luca Boccassi Date: Tue Jan 27 22:51:37 2026 +0000 pidfs: return -EREMOTE when PIDFD_GET_INFO is called on another ns Currently it is not possible to distinguish between the case where a process has already exited and the case where a process is in a different namespace, as both return -ESRCH. glibc's pidfd_getpid() procfs-based implementation returns -EREMOTE in the latter, so that distinguishing the two is possible, as the fdinfo in procfs will list '0' as the PID in that case: https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/pidfd_getpid.c;h=860829cf07da2267484299ccb02861822c0d07b4;hb=HEAD#l121 Change the error code so that the kernel also returns -EREMOTE in that case. Fixes: 7477d7dce48a ("pidfs: allow to retrieve exit information") Signed-off-by: Luca Boccassi Link: https://patch.msgid.link/20260127225209.2293342-1-luca.boccassi@gmail.com Signed-off-by: Christian Brauner commit 05c8de4f09b08e97c6ecb190dcec0e68b167cb03 Author: Xiao Ni Date: Tue Jan 27 15:39:27 2026 +0800 md: fix return value of mddev_trylock A return value of 0 is treaded as successful lock acquisition. In fact, a return value of 1 means getting the lock successfully. Link: https://lore.kernel.org/linux-raid/20260127073951.17248-1-xni@redhat.com Fixes: 9e59d609763f ("md: call del_gendisk in control path") Reported-by: Bart Van Assche Closes: https://lore.kernel.org/linux-raid/20250611073108.25463-1-xni@redhat.com/T/#mfa369ef5faa4aa58e13e6d9fdb88aecd862b8f2f Signed-off-by: Xiao Ni Reviewed-by: Bart Van Assche Reviewed-by: Li Nan Signed-off-by: Yu Kuai commit 6abc7d5dcf0ee0f85e16e41c87fbd06231f28753 Author: Zilin Guan Date: Mon Jan 26 07:15:33 2026 +0000 md/raid1: fix memory leak in raid1_run() raid1_run() calls setup_conf() which registers a thread via md_register_thread(). If raid1_set_limits() fails, the previously registered thread is not unregistered, resulting in a memory leak of the md_thread structure and the thread resource itself. Add md_unregister_thread() to the error path to properly cleanup the thread, which aligns with the error handling logic of other paths in this function. Compile tested only. Issue found using a prototype static analysis tool and code review. Link: https://lore.kernel.org/linux-raid/20260126071533.606263-1-zilin@seu.edu.cn Fixes: 97894f7d3c29 ("md/raid1: use the atomic queue limit update APIs") Signed-off-by: Zilin Guan Reviewed-by: Li Nan Signed-off-by: Yu Kuai commit 0a4524bc69882a4ddb235bb6b279597721bda197 Author: Leon Romanovsky Date: Tue Jan 27 14:49:23 2026 +0200 xfrm: skip templates check for packet offload tunnel mode In packet offload, hardware is responsible to check templates. The result of its operation is forwarded through secpath by relevant drivers. That secpath is actually removed in __xfrm_policy_check2(). In case packet is forwarded, this secpath is reset in RX, but pushed again to TX where policy is rechecked again against dummy secpath in xfrm_policy_ok(). Such situation causes to unexpected XfrmInTmplMismatch increase. As a solution, simply skip template mismatch check. Fixes: 600258d555f0 ("xfrm: delete intermediate secpath entry in packet offload mode") Signed-off-by: Leon Romanovsky Reviewed-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit b8d687c7eeb52d0353ac27c4f71594a2e6aa365f Author: Ritvik Gupta Date: Wed Oct 8 03:20:28 2025 +0530 rust: safety: introduce `unsafe_precondition_assert!` macro Introduce a new `safety` module containing `unsafe_precondition_assert!` macro. It is a wrapper around `debug_assert!`, intended for validating preconditions of unsafe function. When `CONFIG_RUST_DEBUG_ASSERTIONS` flag is enabled, this macro performs runtime checks to ensure that the preconditions for unsafe function hold. Otherwise, the macro is a no-op. Suggested-by: Miguel Ojeda Link: https://github.com/Rust-for-Linux/linux/issues/1162 Link: https://rust-for-linux.zulipchat.com/#narrow/channel/291566-Library/topic/.60unsafe_precondition_assert.60.20macro/with/528457452 Signed-off-by: Ritvik Gupta Reviewed-by: Benno Lossin Link: https://patch.msgid.link/20251007215034.213779-1-ritvikfoss@gmail.com [ Added trailing periods, intra-doc link, "a" in "is a no-op" and `()` to function reference. Removed plural in assertion message and title of macro. Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 0e62e4f3e56cf6c44926db2ee82ff29b4a28ac03 Author: Filipe Xavier Date: Sat Jan 17 07:41:25 2026 -0300 rust: add `impl_flags!` macro for defining common bitflag operations We have seen a proliferation of `mod_whatever::foo::Flags` being defined with essentially the same implementation for `BitAnd`, `BitOr`, `.contains()` etc. This macro aims to bring a solution for this, allowing to generate these methods for user-defined structs. With some use cases in KMS and upcoming GPU drivers. Link: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/We.20really.20need.20a.20common.20.60Flags.60.20type Suggested-by: Daniel Almeida Suggested-by: Lyude Paul Reviewed-by: Daniel Almeida Reviewed-by: Lyude Paul Tested-by: Andreas Hindborg Reviewed-by: Andreas Hindborg Signed-off-by: Filipe Xavier Link: https://patch.msgid.link/20260117-feat-add-bitmask-macro-v9-1-45ea1f00f846@gmail.com [ Implemented missing `BitXorAssign<$flag> for $flags`. Sorted `impl`s. Removed prelude addition for now -- I asked the team and they also felt it wasn't needed. We can always add it later on if needed. Fixed intra-doc link (by removing the sentence since it was superfluous anyway). Simplified `empty()` title. Reworded commit slightly. Added docs to enum variants in example to avoid 'missing_docs' lint when used in actual code. - Miguel ] Signed-off-by: Miguel Ojeda commit 1799d8abeabc68ec05679292aaf6cba93b343c05 Author: Jiayuan Chen Date: Tue Jan 27 19:38:44 2026 +0800 xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable source address (returns -EADDRNOTAVAIL), saddr->in6 is left uninitialized, but xfrm6_get_saddr() still returns 0 (success). This causes the caller xfrm_tmpl_resolve_one() to use the uninitialized address in xfrm_state_find(), triggering KMSAN warning: ===================================================== BUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940 xfrm_state_find+0x2424/0xa940 xfrm_resolve_and_create_bundle+0x906/0x5a20 xfrm_lookup_with_ifid+0xcc0/0x3770 xfrm_lookup_route+0x63/0x2b0 ip_route_output_flow+0x1ce/0x270 udp_sendmsg+0x2ce1/0x3400 inet_sendmsg+0x1ef/0x2a0 __sock_sendmsg+0x278/0x3d0 __sys_sendto+0x593/0x720 __x64_sys_sendto+0x130/0x200 x64_sys_call+0x332b/0x3e70 do_syscall_64+0xd3/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable tmp.i.i created at: xfrm_resolve_and_create_bundle+0x3e3/0x5a20 xfrm_lookup_with_ifid+0xcc0/0x3770 ===================================================== Fix by checking the return value of ipv6_dev_get_saddr() and propagating the error. Fixes: a1e59abf8249 ("[XFRM]: Fix wildcard as tunnel source") Reported-by: syzbot+e136d86d34b42399a8b1@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68bf1024.a70a0220.7a912.02c2.GAE@google.com/T/ Signed-off-by: Jiayuan Chen Signed-off-by: Jiayuan Chen Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit c307b6dc9c4f68d00524ec10899cdf21466b5c1e Author: Jason Andryuk Date: Wed Nov 19 17:47:30 2025 -0500 xenbus: Rename helpers to freeze/thaw/restore Rename the xenbus helpers called from the .freeze, .thaw, and .restore pm ops to have matching names. Signed-off-by: Jason Andryuk Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20251119224731.61497-3-jason.andryuk@amd.com> commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb Author: Jason Andryuk Date: Wed Nov 19 17:47:29 2025 -0500 xenbus: Use .freeze/.thaw to handle xenbus devices The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming from s3 or s2idle disconnects its PV devices during resume. The backends are not expecting this and do not reconnect. b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/ resume/chkpt") changed xen_suspend()/do_suspend() from PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the suspend/resume callbacks remained. .freeze/restore are used with hiberation where Linux restarts in a new place in the future. .suspend/resume are useful for runtime power management for the duration of a boot. The current behavior of the callbacks works for an xl save/restore or live migration where the domain is restored/migrated to a new location and connecting to a not-already-connected backend. Change xenbus_pm_ops to use .freeze/thaw/restore and drop the .suspend/resume hook. This matches the use in drivers/xen/manage.c for save/restore and live migration. With .suspend/resume empty, PV devices are left connected during s2idle and s3, so PV devices are not changed and work after resume. Signed-off-by: Jason Andryuk Acked-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com> commit c74a1a68a990e940b798000a7ec30db191c039ec Author: Uros Bizjak Date: Thu Jan 22 15:17:07 2026 +0100 xen/mcelog: simplify MCE_GETCLEAR_FLAGS using xchg() The MCE_GETCLEAR_FLAGS ioctl retrieves xen_mcelog.flags while atomically clearing it. This was previously implemented using a cmpxchg() loop. Replace the cmpxchg() loop with a single xchg(), which provides the same atomic get-and-clear semantics, avoids retry spinning under contention, and simplifies the code. The code on x86_64 improves from: 186: 8b 15 00 00 00 00 mov 0x0(%rip),%edx 18c: 89 d0 mov %edx,%eax 18e: f0 0f b1 0d 00 00 00 lock cmpxchg %ecx,0x0(%rip) 195: 00 196: 39 c2 cmp %eax,%edx 198: 75 ec jne 186 <...> to just: 186: 87 05 00 00 00 00 xchg %eax,0x0(%rip) No functional change intended. Signed-off-by: Uros Bizjak Cc: Juergen Gross Cc: Stefano Stabellini Cc: Oleksandr Tyshchenko Reviewed-by: Andrew Cooper Reviewed-by: Jan Beulich Signed-off-by: Juergen Gross Message-ID: <20260122141754.116129-1-ubizjak@gmail.com> commit b13cd24c15d74f6dfcddf0d53ae6efb58d3f0461 Author: Roger Pau Monne Date: Wed Jan 28 12:05:09 2026 +0100 xen/balloon: improve accuracy of initial balloon target for dom0 The dom0 balloon target set by the toolstack is the value returned by XENMEM_current_reservation. Do the same in the kernel balloon driver and set the current allocation to the value returned by XENMEM_current_reservation. On my test system this causes the kernel balloon driver target to exactly match the value set by the toolstack in xenstore. Note this approach can be used by both PV and PVH dom0s, as the toolstack always uses XENMEM_current_reservation to set the initial target regardless of the dom0 type. Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260128110510.46425-3-roger.pau@citrix.com> commit 0949c646d64697428ff6257d52efa5093566868d Author: Roger Pau Monne Date: Wed Jan 28 12:05:08 2026 +0100 Partial revert "x86/xen: fix balloon target initialization for PVH dom0" This partially reverts commit 87af633689ce16ddb166c80f32b120e50b1295de so the current memory target for PV guests is still fetched from start_info->nr_pages, which matches exactly what the toolstack sets the initial memory target to. Using get_num_physpages() is possible on PV also, but needs adjusting to take into account the ISA hole and the PFN at 0 not considered usable memory despite being populated, and hence would need extra adjustments. Instead of carrying those extra adjustments switch back to the previous code. That leaves Linux with a difference in how current memory target is obtained for HVM vs PV, but that's better than adding extra logic just for PV. However if switching to start_info->nr_pages for PV domains we need to differentiate between released pages (freed back to the hypervisor) as opposed to pages in the physmap which are not populated to start with. Introduce a new xen_unpopulated_pages to account for papges that have never been populated, and hence in the PV case don't need subtracting. Fixes: 87af633689ce ("x86/xen: fix balloon target initialization for PVH dom0") Reported-by: James Dingwall Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260128110510.46425-2-roger.pau@citrix.com> commit 82ef60ec084b2ea418c50fca2c8776fb8ec27067 Author: Ethan Nelson-Moore Date: Fri Jan 30 19:28:11 2026 -0800 ata: pata_cypress: fix typo in error message An error message in the pata_cypress driver has a typo "mome" for "mode". Fix it. Signed-off-by: Ethan Nelson-Moore Signed-off-by: Damien Le Moal commit 3c4d783f6922e47fc31528c3ed6a240612c4ce15 Author: Ethan Nelson-Moore Date: Fri Jan 30 16:47:30 2026 -0800 ata: pata_legacy: remove VLB support This significantly reduces the complexity of the pata_legacy driver. The VLB bus is very obsolete and last appeared on P5 Pentium-era hardware. Support for it has been removed from other drivers, and it is highly unlikely anyone is using it with modern Linux kernels. Some of these chips were integrated on motherboards, but they seem to have all been 486-era boards, which are equally obsolete. Signed-off-by: Ethan Nelson-Moore Signed-off-by: Damien Le Moal commit 3cc9398a9ea69b77de01b370463b706c354e52fb Merge: a60f627cf4ab47 52b330799e2d6f Author: Dave Airlie Date: Mon Feb 2 11:17:06 2026 +1000 Merge tag 'exynos-drm-next-for-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next Fix three regressions . Fix a regression where vidi_connection_ioctl() used the wrong device to look up the vidi context. It stores the vidi device in exynos_drm_private and uses it in ioctl(), preventing invalid pointer access and related bugs. . Fix a security regression where vidi_connection_ioctl() directly dereferenced a user pointer for EDID data. It copies EDID from user space with copy_from_user() into kernel memory before use, preventing arbitrary kernel memory access. . Fix a concurrency regression where vidi_context members related to EDID memory were accessed without locking. It protects alloc/free and state updates with ctx->lock, preventing race conditions and use-after-free bugs. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patch.msgid.link/20260201143939.27074-1-inki.dae@samsung.com commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 Author: Otto Pflüger Date: Sat Jan 10 16:43:38 2026 +0100 mailbox: sprd: mask interrupts that are not handled To reduce the amount of spurious interrupts, disable the interrupts that are not handled in this driver. Signed-off-by: Otto Pflüger Signed-off-by: Jassi Brar commit c6ff944003cf1b7be9ef5c9d868a42114bc6e867 Author: Otto Pflüger Date: Sat Jan 10 16:43:37 2026 +0100 mailbox: sprd: add support for mailbox revision 2 Newer Unisoc SoCs such as UMS9230 include a new revision of the mailbox IP with support for up to 16 channels. Since the new revision has a similar register layout and many parts have remained unchanged, make the driver support both revisions. Signed-off-by: Otto Pflüger Signed-off-by: Jassi Brar commit c77661d60d4223bf2ff10d409beb0c3b2021183b Author: Otto Pflüger Date: Sat Jan 10 16:43:36 2026 +0100 mailbox: sprd: clear delivery flag before handling TX done If there are any pending messages in the mailbox queue, they are sent as soon as a TX done event arrives from the driver. This may trigger a new delivery interrupt while the previous one is still being handled. If the delivery status is cleared after this, the interrupt is lost. To prevent this from happening, clear the delivery status immediately after checking it and before any new messages are sent. Signed-off-by: Otto Pflüger Signed-off-by: Jassi Brar commit 0856aed508878c6208cf17c75361317287101b3d Author: Otto Pflüger Date: Sat Jan 10 16:43:35 2026 +0100 dt-bindings: mailbox: sprd: add compatible for UMS9230 Add a compatible string for the mailbox controller found in the UMS9230 SoC. Signed-off-by: Otto Pflüger Acked-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit fa84883d44422208b45869a67c0265234fdce1f0 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:24 2026 +0100 mailbox: bcm-ferxrm-mailbox: Use default primary handler request_threaded_irq() is invoked with a primary and a secondary handler and no flags are passed. The primary handler is the same as irq_default_primary_handler() so there is no need to have an identical copy. The lack of the IRQF_ONESHOT can be dangerous because the interrupt source is not masked while the threaded handler is active. This means, especially on LEVEL typed interrupt lines, the interrupt can fire again before the threaded handler had a chance to run. Use the default primary interrupt handler by specifying NULL and set IRQF_ONESHOT so the interrupt source is masked until the secondary handler is done. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Jassi Brar commit 60436eb0d618717c7f51eae2e4e9245abeae349c Author: Peng Fan Date: Wed Jan 28 20:32:10 2026 +0800 mailbox: Remove mailbox_client.h from controller drivers mailbox_client.h should be used by mailbox consumer drivers, not mailbox controller (provider) drivers. The affected drivers do not use any mailbox client APIs, so the include can be safely removed. Signed-off-by: Peng Fan Reviewed-by: Sudeep Holla Signed-off-by: Jassi Brar commit a5338e365c4559d7b4d7356116b0eb95b12e08d5 Author: Niklas Schnelle Date: Tue Dec 16 23:14:03 2025 +0100 PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF removal inside sriov_del_vfs() and concurrent hot unplug by taking the PCI rescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock was also taken in sriov_add_vfs() to protect addition of VFs. This approach however causes deadlock on trying to remove PFs with SR-IOV enabled because PFs disable SR-IOV during removal and this removal happens under the PCI rescan/remove lock. So the original fix had to be reverted. Instead of taking the PCI rescan/remove lock in sriov_add_vfs() and sriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs hotplug higher up in the callchain by taking the lock in sriov_numvfs_store() before calling into the driver's sriov_configure() callback. Fixes: 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") Reported-by: Benjamin Block Signed-off-by: Niklas Schnelle Signed-off-by: Bjorn Helgaas Reviewed-by: Benjamin Block Reviewed-by: Gerd Bayer Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251216-revert_sriov_lock-v3-2-dac4925a7621@linux.ibm.com commit 2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a Author: Niklas Schnelle Date: Tue Dec 16 23:14:02 2025 +0100 Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" This reverts commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"), which causes a deadlock by recursively taking pci_rescan_remove_lock when sriov_del_vfs() is called as part of pci_stop_and_remove_bus_device(). For example with the following sequence of commands: $ echo > /sys/bus/pci/devices//sriov_numvfs $ echo 1 > /sys/bus/pci/devices//remove A trimmed trace of the deadlock on a mlx5 device is as below: zsh/5715 is trying to acquire lock: 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140 but task is already holding lock: 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80 ... Call Trace: [<00000259778c4f90>] dump_stack_lvl+0xc0/0x110 [<00000259779c844e>] print_deadlock_bug+0x31e/0x330 [<00000259779c1908>] __lock_acquire+0x16c8/0x32f0 [<00000259779bffac>] lock_acquire+0x14c/0x350 [<00000259789643a6>] __mutex_lock_common+0xe6/0x1520 [<000002597896413c>] mutex_lock_nested+0x3c/0x50 [<00000259784a07e4>] sriov_disable+0x34/0x140 [<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core] [<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core] [<00000259784857fc>] pci_device_remove+0x3c/0xa0 [<000002597851012e>] device_release_driver_internal+0x18e/0x280 [<000002597847ae22>] pci_stop_bus_device+0x82/0xa0 [<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80 [<00000259784972c2>] remove_store+0x72/0x90 [<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200 [<0000025977d7241c>] vfs_write+0x24c/0x300 [<0000025977d72696>] ksys_write+0x86/0x110 [<000002597895b61c>] __do_syscall+0x14c/0x400 [<000002597896e0ee>] system_call+0x6e/0x90 This alone is not a complete fix as it restores the issue the cited commit tried to solve. A new fix will be provided as a follow on. Fixes: 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") Reported-by: Benjamin Block Signed-off-by: Niklas Schnelle Signed-off-by: Bjorn Helgaas Reviewed-by: Benjamin Block Acked-by: Gerd Bayer Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251216-revert_sriov_lock-v3-1-dac4925a7621@linux.ibm.com commit 289b14592cefe95f7d0ef334873c12b96ce3824f Author: Danilo Krummrich Date: Sat Jan 31 02:42:07 2026 +0100 driver core: fix inverted "locked" suffix of driver_match_device() In the current implementation driver_match_device() expects the device lock to be held, while driver_match_device_locked() acquires the device lock. By convention it should be the other way around, hence swap the name of both functions. Fixes: dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") Reviewed-by: Greg Kroah-Hartman Reviewed-by: Gui-Dong Han Link: https://patch.msgid.link/20260131014211.12841-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 726c262060252e13d5805f9acc382fb9f081ba07 Author: Alexandre Courbot Date: Fri Jan 30 22:32:46 2026 +0900 rust: io: move MIN_SIZE and io_addr_assert to IoKnownSize `MIN_SIZE` and `io_addr_assert` are only ever used for IO types which implement `IoKnownSize` and do not make sense for types that don't. It looks like they should have been there since the beginning, so move them while the code is still fresh. Also update `IoKnownSize`'s documentation since it is not just a marker trait anymore. Fixes: 121d87b28e1d ("rust: io: separate generic I/O helpers from MMIO implementation") Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20260130-io-min-size-v1-1-65a546e3104d@nvidia.com [ Fix typo in commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit 72bfbe50ffbf36937c77b39e19143aabdb69b080 Author: Zijing Zhang Date: Sat Jan 31 16:42:17 2026 +0000 rust: pci: re-export ConfigSpace Re-export ConfigSpace, such that users can refer to the type as kernel::pci::ConfigSpace, rather than kernel::pci::io::ConfigSpace. Fixes: 4dc0bacb1d3c ("rust: pci: add config space read/write support") Reported-by: Gary Guo Closes: https://lore.kernel.org/rust-for-linux/DG2D5ONS18FE.TC7K3O8V8SU1@garyguo.net/ Reviewed-by: Alexandre Courbot Signed-off-by: Zijing Zhang Link: https://patch.msgid.link/995384df9224283fab185b5e06f519506fff1873.1769877524.git.zijing.zhang@ry.rs [ Slightly reworded commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit 2f53da43b20389b78ecfdb30f6349753acecb59e Author: Ryota Sakamoto Date: Sun Jan 25 19:05:48 2026 +0900 apparmor: add .kunitconfig Add .kunitconfig file to the AppArmor directory to enable easy execution of KUnit tests. AppArmor tests (CONFIG_SECURITY_APPARMOR_KUNIT_TEST) depend on CONFIG_SECURITY_APPARMOR which also depends on CONFIG_SECURITY and CONFIG_NET. Without explicitly enabling these configs in the .kunitconfig, developers will need to specify config manually. With the .kunitconfig, developers can run the tests: $ ./tools/testing/kunit/kunit.py run --kunitconfig security/apparmor Signed-off-by: Ryota Sakamoto Signed-off-by: John Johansen commit a60f627cf4ab474aebf15f62c55eadabab9780da Merge: 502d2d8e01c893 0a6d6ed694d72b Author: Dave Airlie Date: Mon Feb 2 05:45:12 2026 +1000 Merge tag 'amd-drm-next-6.20-2026-01-30' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.20-2026-01-30: amdgpu: - Misc cleanups - SMU 13 fixes - SMU 14 fixes - GPUVM fault filter fix - USB4 fixes - DC FP guard fixes - Powergating fix - JPEG ring reset fix - RAS fixes - Xclk fix for soc21 APUs - Fix COND_EXEC handling for GC 11 - UserQ fixes - MQD size alignment fixes - SMU feature interface cleanup - GC 10-12 KGQ init fixes - GC 11-12 KGQ reset fixes amdkfd: - Fix device snapshot reporting - GC 12.1 trap handler fixes - MQD size alignment fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260130183257.28879-1-alexander.deucher@amd.com commit bd4f0822f4ecd98285208e3322ad23c2ead0c878 Author: zhidao su Date: Fri Jan 30 18:55:11 2026 +0800 tools/sched_ext: Add error logging for dsq creation failures in remaining schedulers Add scx_bpf_error() calls when scx_bpf_create_dsq() fails in the remaining schedulers to improve debuggability: - scx_simple.bpf.c: simple_init() - scx_sdt.bpf.c: sdt_init() - scx_cpu0.bpf.c: cpu0_init() - scx_flatcg.bpf.c: fcg_init() This follows the same pattern established in commit 2f8d489897ae ("sched_ext: Add error logging for dsq creation failures") for other schedulers and ensures consistent error reporting across all schedulers. Signed-off-by: zhidao su Signed-off-by: Tejun Heo commit 0713b26190addfa3a774b386c8658952ef9f7faf Author: Jonathan Cameron Date: Sat Jan 31 12:19:05 2026 +0000 iio: magn: mmc5633: Fix Kconfig for combination of I3C as module and driver builtin Fix based on similar fix in: commit 83b645ee43f7 ("hwmon: tmp108: fix I3C dependency") Note to keep things simple I'm now requiring I2C. That can probably be relaxed in future, but I want to reduce the test set of builds for now given this is blocker for the main IIO pull request. Fixes: e559c8641460 ("iio: magn: mmc5633: Ensure REGMAP_I2C / I3C not build if I2C / I3C is not.") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601310904.DueZdiuY-lkp@intel.com/ Signed-off-by: Jonathan Cameron Reviewed-by: Frank Li commit 8b1f3c54f930c3aeda0b5bad97bc317fc80267fd Author: Chen Ridong Date: Thu Jan 29 06:45:16 2026 +0000 cpuset: fix overlap of partition effective CPUs A warning was detect: WARNING: kernel/cgroup/cpuset.c:825 at rebuild_sched_domains_locked Modules linked in: CPU: 12 UID: 0 PID: 681 Comm: rmdir 6.19.0-rc6-next-20260121+ RIP: 0010:rebuild_sched_domains_locked+0x309/0x4b0 RSP: 0018:ffffc900019bbd28 EFLAGS: 00000202 RAX: ffff888104413508 RBX: 0000000000000008 RCX: ffff888104413510 RDX: ffff888109b5f400 RSI: 000000000000ffcf RDI: 0000000000000001 RBP: 0000000000000002 R08: ffff888104413508 R09: 0000000000000002 R10: ffff888104413508 R11: 0000000000000001 R12: ffff888104413500 R13: 0000000000000002 R14: ffffc900019bbd78 R15: 0000000000000000 FS: 00007fe274b8d740(0000) GS:ffff8881b6b3c000(0000) knlGS: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe274c98b50 CR3: 00000001047a9000 CR4: 00000000000006f0 Call Trace: update_prstate+0x1c7/0x580 cpuset_css_killed+0x2f/0x50 kill_css+0x32/0x180 cgroup_destroy_locked+0xa7/0x200 cgroup_rmdir+0x28/0x100 kernfs_iop_rmdir+0x4c/0x80 vfs_rmdir+0x12c/0x280 filename_rmdir+0x19e/0x200 __x64_sys_rmdir+0x23/0x40 do_syscall_64+0x6b/0x390 It can be reproduced by steps: # cd /sys/fs/cgroup/ # mkdir A1 # mkdir B1 # mkdir C1 # echo 1-3 > A1/cpuset.cpus # echo root > A1/cpuset.cpus.partition # echo 3-5 > B1/cpuset.cpus # echo root > B1/cpuset.cpus.partition # echo 6 > C1/cpuset.cpus # echo root > C1/cpuset.cpus.partition # rmdir A1/ # rmdir C1/ Both A1 and B1 were initially configured with CPU 3, which was exclusively assigned to A1's partition. When A1 was removed, CPU 3 was returned to the root pool. However, B1 incorrectly regained access to CPU 3 when update_cpumasks_hier was triggered during C1's removal, which also updated sibling configurations. The update_sibling_cpumasks function was called to synchronize siblings' effective CPUs due to changes in their parent's effective CPUs. However, parent effective CPU changes should not affect partition-effective CPUs. To fix this issue, update_cpumasks_hier should only be invoked when the sibling is not a valid partition in the update_sibling_cpumasks. Fixes: 2a3602030d80 ("cgroup/cpuset: Don't invalidate sibling partitions on cpuset.cpus conflict") Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 553b4999cbe231b5011cb8db05a3092dec168aca Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:35 2026 +0100 mfd: wm8350-core: Use IRQF_ONESHOT Using a threaded interrupt without a dedicated primary handler mandates the IRQF_ONESHOT flag to mask the interrupt source while the threaded handler is active. Otherwise the interrupt can fire again before the threaded handler had a chance to run. Mark explained that this should not happen with this hardware since it is a slow irqchip which is behind an I2C/ SPI bus but the IRQ-core will refuse to accept such a handler. Set IRQF_ONESHOT so the interrupt source is masked until the secondary handler is done. Fixes: 1c6c69525b40e ("genirq: Reject bogus threaded irq requests") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Reviewed-by: Charles Keepax Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260128095540.863589-16-bigeasy@linutronix.de commit 781b391557a74f6630d46a0813b389a8ca30b6c8 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:33 2026 +0100 thermal/qcom/lmh: Replace IRQF_ONESHOT with IRQF_NO_THREAD Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also prevents force-threading of the primary handler and the irq-core will warn about this. The intention here was probably to not allow forced-threading. Replace IRQF_ONESHOT with IRQF_NO_THREAD. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128095540.863589-14-bigeasy@linutronix.de commit 18d28446231390e4ea3634fb16200865df2c6506 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:32 2026 +0100 rtc: amlogic-a4: Remove IRQF_ONESHOT Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also prevents force-threading of the primary handler and the irq-core will warn about this. Remove IRQF_ONESHOT from irqflags. Fixes: c89ac9182ee29 ("rtc: support for the Amlogic on-chip RTC") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Reviewed-by: Xianwei Zhao Link: https://patch.msgid.link/20260128095540.863589-13-bigeasy@linutronix.de commit a7fb84ea70aae9a92a842932206e70ed1b3c7007 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:31 2026 +0100 usb: typec: fusb302: Remove IRQF_ONESHOT Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also prevents force-threading of the primary handler and the irq-core will warn about this. Remove IRQF_ONESHOT from irqflags. Fixes: 309b6341d5570 ("usb: typec: fusb302: Revert incorrect threaded irq fix") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Acked-by: Greg Kroah-Hartman Acked-by: Heikki Krogerus Link: https://patch.msgid.link/20260128095540.863589-12-bigeasy@linutronix.de commit 5c858d6c66304b4c7579582ec5235f02d43578ea Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:30 2026 +0100 EDAC/altera: Remove IRQF_ONESHOT Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also prevents force-threading of the primary handler and the irq-core will warn about this. Remove IRQF_ONESHOT from irqflags. Fixes: a29d64a45eed1 ("EDAC, altera: Add IRQ Flags to disable IRQ while handling") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128095540.863589-11-bigeasy@linutronix.de commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:29 2026 +0100 char: tpm: cr50: Remove IRQF_ONESHOT Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also prevents force-threading of the primary handler and the irq-core will warn about this. Remove IRQF_ONESHOT from irqflags. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Reviewed-by: Jarkko Sakkinen Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de commit a82bf786500a011c0ecc63ce1511b7fc471137cd Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:28 2026 +0100 ARM: versatile: Remove IRQF_ONESHOT Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. Revert adding IRQF_ONESHOT to irqflags. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Acked-by: Sudeep Holla Acked-by: Linus Walleij Link: https://patch.msgid.link/20260128095540.863589-9-bigeasy@linutronix.de commit bd81f07e9a27c341cd7e72be95eb0b7cf3910926 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:27 2026 +0100 scsi: efct: Use IRQF_ONESHOT and default primary handler There is no added value in efct_intr_msix() compared to irq_default_primary_handler(). Using a threaded interrupt without a dedicated primary handler mandates the IRQF_ONESHOT flag to mask the interrupt source while the threaded handler is active. Otherwise the interrupt can fire again before the threaded handler had a chance to run. Use the default primary interrupt handler by specifying NULL and set IRQF_ONESHOT so the interrupt source is masked until the secondary handler is done. Fixes: 4df84e8466242 ("scsi: elx: efct: Driver initialization routines") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128095540.863589-8-bigeasy@linutronix.de commit 28abed6569c87eab9071ab56c64433c2f0d9ce51 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:26 2026 +0100 Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler There is no added value in btintel_pcie_msix_isr() compared to irq_default_primary_handler(). Using a threaded interrupt without a dedicated primary handler mandates the IRQF_ONESHOT flag to mask the interrupt source while the threaded handler is active. Otherwise the interrupt can fire again before the threaded handler had a chance to run. Use the default primary interrupt handler by specifying NULL and set IRQF_ONESHOT so the interrupt source is masked until the secondary handler is done. Fixes: c2b636b3f788d ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128095540.863589-7-bigeasy@linutronix.de commit 29d4ff55fe9866be7afa3669ff54da0e4bfd5fb8 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:25 2026 +0100 bus: fsl-mc: Use default primary handler There is no added value in dprc_irq0_handler() compared to irq_default_primary_handler(). Use the default primary interrupt handler by specifying NULL. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Reviewed-by: Ioana Ciornei Link: https://patch.msgid.link/20260128095540.863589-6-bigeasy@linutronix.de commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:24 2026 +0100 mailbox: bcm-ferxrm-mailbox: Use default primary handler request_threaded_irq() is invoked with a primary and a secondary handler and no flags are passed. The primary handler is the same as irq_default_primary_handler() so there is no need to have an identical copy. The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt source is not masked while the threaded handler is active. This means, especially on LEVEL typed interrupt lines, the interrupt can fire again before the threaded handler had a chance to run. Use the default primary interrupt handler by specifying NULL and set IRQF_ONESHOT so the interrupt source is masked until the secondary handler is done. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de commit 5bfcdccb4d18d3909b7f87942be67fd6bdc00c1d Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:23 2026 +0100 iommu/amd: Use core's primary handler and set IRQF_ONESHOT request_threaded_irq() is invoked with a primary and a secondary handler and no flags are passed. The primary handler is the same as irq_default_primary_handler() so there is no need to have an identical copy. The lack of the IRQF_ONESHOT can be dangerous because the interrupt source is not masked while the threaded handler is active. This means, especially on LEVEL typed interrupt lines, the interrupt can fire again before the threaded handler had a chance to run. Use the default primary interrupt handler by specifying NULL and set IRQF_ONESHOT so the interrupt source is masked until the secondary handler is done. Fixes: 72fe00f01f9a3 ("x86/amd-iommu: Use threaded interupt handler") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128095540.863589-4-bigeasy@linutronix.de commit f6bc712877f24dc89bdfd7bdbf1a32f3b9960b34 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:22 2026 +0100 platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt cannot fire (again) while its handler is running. The flag also prevents force-threading of the primary handler and the irq-core will warn about this. The flag was added to match the flag on the shared handler which uses a threaded handler and therefore IRQF_ONESHOT. This is no longer needed because devm_request_irq() now passes IRQF_COND_ONESHOT for this case. Revert adding IRQF_ONESHOT to irqflags. Fixes: 8f812373d1958 ("platform/x86: intel: int0002_vgpio: Pass IRQF_ONESHOT to request_irq()") Reported-by: Borah, Chaitanya Kumar Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Reviewed-by: Hans de Goede Acked-by: Ilpo Järvinen Link: https://patch.msgid.link/20260128095540.863589-3-bigeasy@linutronix.de Closes: https://lore.kernel.org/all/555f1c56-0f74-41bf-8bd2-6217e0aab0c6@intel.com commit 943b052ded21feb84f293d40b06af3181cd0d0d7 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:21 2026 +0100 genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). The flag IRQF_COND_ONESHOT was already force-added to request_irq() because the ACPI SCI interrupt handler is using the IRQF_ONESHOT flag which breaks all shared handlers. devm_request_irq() needs the same change since some users, such as int0002_vgpio, are using this function instead. Add IRQF_COND_ONESHOT to the flags passed to devm_request_irq(). Fixes: c37927a203fa2 ("genirq: Set IRQF_COND_ONESHOT in request_irq()") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128095540.863589-2-bigeasy@linutronix.de commit 5eab8c588bf37b7eb498f23a2ac3fb135c258e17 Author: Chen Ridong Date: Sat Jan 31 03:05:09 2026 +0000 cgroup: increase maximum subsystem count from 16 to 32 The current cgroup subsystem limit of 16 is insufficient, as the number of existing subsystems has already reached this limit. When adding a new subsystem that is not yet in the mainline kernel, building with `make allmodconfig` requires first bypassing the `BUILD_BUG_ON(CGROUP_SUBSYS_COUNT > 16)` restriction to allow compilation to succeed. However, the kernel still fails to boot afterward. This patch increases the maximum number of supported cgroup subsystems from 16 to 32, providing enough room for future subsystem additions. Signed-off-by: Chen Ridong Acked-by: Waiman Long Tested-by: JP Kobryn Acked-by: JP Kobryn Signed-off-by: Tejun Heo commit e1f94662d759411fb7da3e4e662ec588c268e1a5 Author: Thomas Gleixner Date: Sun Feb 1 16:38:36 2026 +0100 irqchip/aspeed-scu-ic: Remove unused variable mask The kernel test robot reports: drivers/irqchip/irq-aspeed-scu-ic.c:107:27: warning: variable 'mask' set but not used 107 | unsigned int sts, mask; Remove the leftover. Fixes: b2a0c13f8b4f ("irqchip/aspeed-scu-ic: Add support for AST2700 SCU interrupt controllers") Reported-by: kernel test robot Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/874io0h3sz.ffs@tglx Closes: https://lore.kernel.org/oe-kbuild-all/202602010957.9uuKqUkG-lkp@intel.com/ commit 52b330799e2d6f825ae2bb74662ec1b10eb954bb Author: Jeongjun Park Date: Mon Jan 19 17:25:53 2026 +0900 drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Exynos Virtual Display driver performs memory alloc/free operations without lock protection, which easily causes concurrency problem. For example, use-after-free can occur in race scenario like this: ``` CPU0 CPU1 CPU2 ---- ---- ---- vidi_connection_ioctl() if (vidi->connection) // true drm_edid = drm_edid_alloc(); // alloc drm_edid ... ctx->raw_edid = drm_edid; ... drm_mode_getconnector() drm_helper_probe_single_connector_modes() vidi_get_modes() if (ctx->raw_edid) // true drm_edid_dup(ctx->raw_edid); if (!drm_edid) // false ... vidi_connection_ioctl() if (vidi->connection) // false drm_edid_free(ctx->raw_edid); // free drm_edid ... drm_edid_alloc(drm_edid->edid) kmemdup(edid); // UAF!! ... ``` To prevent these vulns, at least in vidi_context, member variables related to memory alloc/free should be protected with ctx->lock. Cc: Signed-off-by: Jeongjun Park Signed-off-by: Inki Dae commit d4c98c077c7fb2dfdece7d605e694b5ea2665085 Author: Jeongjun Park Date: Mon Jan 19 17:25:52 2026 +0900 drm/exynos: vidi: fix to avoid directly dereferencing user pointer In vidi_connection_ioctl(), vidi->edid(user pointer) is directly dereferenced in the kernel. This allows arbitrary kernel memory access from the user space, so instead of directly accessing the user pointer in the kernel, we should modify it to copy edid to kernel memory using copy_from_user() and use it. Cc: Signed-off-by: Jeongjun Park Signed-off-by: Inki Dae commit d3968a0d85b211e197f2f4f06268a7031079e0d0 Author: Jeongjun Park Date: Mon Jan 19 17:25:51 2026 +0900 drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to obtain a struct vidi_context pointer. However, drm_dev->dev is the exynos-drm master device, and the driver_data contained therein is not the vidi component device, but a completely different device. This can lead to various bugs, ranging from null pointer dereferences and garbage value accesses to, in unlucky cases, out-of-bounds errors, use-after-free errors, and more. To resolve this issue, we need to store/delete the vidi device pointer in exynos_drm_private->vidi_dev during bind/unbind, and then read this exynos_drm_private->vidi_dev within ioctl() to obtain the correct struct vidi_context pointer. Cc: Signed-off-by: Jeongjun Park Signed-off-by: Inki Dae commit e5b0cfa32b1c3e7f153373bfdc20ccdd3c342de2 Author: Leon Romanovsky Date: Wed Jan 28 11:55:25 2026 +0200 MAINTAINERS: Drop RDMA files from Hyper-V section MAINTAINERS entries are organized by subsystem ownership, and the RDMA files belong under drivers/infiniband. Remove the overly broad mana_ib entries from the Hyper-V section, and instead add the Hyper-V mailing list to CC on mana_ib patches. This makes get_maintainer.pl behave more sensibly when running it on mana_ib patches. Fixes: 428ca2d4c6aa ("MAINTAINERS: Add Long Li as a Hyper-V maintainer") Link: https://patch.msgid.link/20260128-get-maintainers-fix-v1-1-fc5e58ce9f02@nvidia.com Reviewed-by: Long Li Signed-off-by: Leon Romanovsky commit 9eb9c350bc553fae5d77d698192198087ca47c64 Author: Sumeet Pawnikar Date: Sat Jan 31 20:46:15 2026 +0530 drivers: thermal: intel: tcc_cooling: Drop redundant local variable Simplify the error path by directly returning PTR_ERR(tcc_cdev) instead of storing it in an intermediate variable ret which can be dropped then because it is only used for that. Also remove an uneeded empty line before the declaration of local variable err. Signed-off-by: Sumeet Pawnikar [ rjw: Dropped unneeded changes, rewrote changelog, adjusted subject ] Link: https://patch.msgid.link/20260131151615.6230-1-sumeet4linux@gmail.com Signed-off-by: Rafael J. Wysocki commit bb1256e0ddc7e9e406164319769b9f8d8389f056 Author: Ata İlhan Köktürk Date: Thu Jan 29 17:48:56 2026 +0300 ACPI: battery: fix incorrect charging status when current is zero On some laptops, such as the Huawei Matebook series, the embedded controller continues to report "Charging" status even when the charge threshold is reached and no current is being drawn. This incorrect reporting prevents the system from switching to battery power profiles, leading to significantly higher power (e.g., 18W instead of 7W during browsing) and missed remaining battery time estimation. Validate the "Charging" state by checking if rate_now is zero. If the hardware reports charging but the current is zero, report "Not Charging" to user space. Signed-off-by: Ata İlhan Köktürk [ rjw: Whitespace fix, braces added to an inner if (), new comment rewrite ] [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260129144856.43058-1-atailhan2006@gmail.com Signed-off-by: Rafael J. Wysocki commit 58b604dfc7bb753f91bc0ccd3fa705e14e6edfb4 Author: Yi Liu Date: Thu Jan 29 17:49:00 2026 +0800 RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc Since wqe_size in ib_uverbs_unmarshall_recv() is user-provided and already validated, but can still be large, add __GFP_NOWARN to suppress memory allocation warnings for large sizes, consistent with the similar fix in ib_uverbs_post_send(). Fixes: 67cdb40ca444 ("[IB] uverbs: Implement more commands") Signed-off-by: Yi Liu Link: https://patch.msgid.link/20260129094900.3517706-1-liuy22@mails.tsinghua.edu.cn Signed-off-by: Leon Romanovsky commit ed8a4ef29da3821ee3155d3b1925fa67fc92aae2 Author: Dmitry Torokhov Date: Fri Aug 15 12:43:47 2025 -0700 Input: gpio_keys - fall back to platform_get_irq() for interrupt-only keys To allow transitioning away from gpio-keys platform data attempt to retrieve IRQ for interrupt-only keys using platform_get_irq_optional() if interrupt is not specified in platform data. Signed-off-by: Dmitry Torokhov commit 427b2535f51342de3156babc6bdc3f3b7dd2c707 Author: Evangelos Petrongonas Date: Tue Jan 20 17:59:11 2026 +0000 kho: skip memoryless NUMA nodes when reserving scratch areas kho_reserve_scratch() iterates over all online NUMA nodes to allocate per-node scratch memory. On systems with memoryless NUMA nodes (nodes that have CPUs but no memory), memblock_alloc_range_nid() fails because there is no memory available on that node. This causes KHO initialization to fail and kho_enable to be set to false. Some ARM64 systems have NUMA topologies where certain nodes contain only CPUs without any associated memory. These configurations are valid and should not prevent KHO from functioning. Fix this by only counting nodes that have memory (N_MEMORY state) and skip memoryless nodes in the per-node scratch allocation loop. Link: https://lkml.kernel.org/r/20260120175913.34368-1-epetron@amazon.de Fixes: 3dc92c311498 ("kexec: add Kexec HandOver (KHO) generation helpers"). Signed-off-by: Evangelos Petrongonas Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Cc: Alexander Graf Cc: Signed-off-by: Andrew Morton commit 96a54b8ffc8c4567c32fe0b6996669f1132b026d Author: Vasily Gorbik Date: Mon Jan 26 12:20:46 2026 +0100 crash_dump: fix dm_crypt keys locking and ref leak crash_load_dm_crypt_keys() reads dm-crypt volume keys from the user keyring. It uses user_key_payload_locked() without holding key->sem, which makes lockdep complain when kexec_file_load() assembles the crash image: ============================= WARNING: suspicious RCU usage ----------------------------- ./include/keys/user-type.h:53 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by kexec/4875. stack backtrace: Call Trace: dump_stack_lvl+0x5d/0x80 lockdep_rcu_suspicious.cold+0x4e/0x96 crash_load_dm_crypt_keys+0x314/0x390 bzImage64_load+0x116/0x9a0 ? __lock_acquire+0x464/0x1ba0 __do_sys_kexec_file_load+0x26a/0x4f0 do_syscall_64+0xbd/0x430 entry_SYSCALL_64_after_hwframe+0x77/0x7f In addition, the key returned by request_key() is never key_put()'d, leaking a key reference on each load attempt. Take key->sem while copying the payload and drop the key reference afterwards. Link: https://lkml.kernel.org/r/patch.git-2d4d76083a5c.your-ad-here.call-01769426386-ext-2560@work.hours Fixes: 479e58549b0f ("crash_dump: store dm crypt keys in kdump reserved memory") Signed-off-by: Vasily Gorbik Cc: Baoquan He Cc: Coiby Xu Cc: Dave Young Cc: Vivek Goyal Cc: Signed-off-by: Andrew Morton commit b50634c5e84a7a57c20b03e367a43f1b63b7ea23 Author: Mike Rapoport (Microsoft) Date: Thu Jan 22 14:17:57 2026 +0200 kho: cleanup error handling in kho_populate() * use dedicated labels for error handling instead of checking if a pointer is not null to decide if it should be unmapped * drop assignment of values to err that are only used to print a numeric error code, there are pr_warn()s for each failure already so printing a numeric error code in the next line does not add anything useful Link: https://lkml.kernel.org/r/20260122121757.575987-1-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Mike Rapoport Signed-off-by: Andrew Morton commit 0895a000e4fff9e950a7894210db45973e485c35 Author: Ondrej Mosnacek Date: Thu Jan 22 15:07:45 2026 +0100 ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() The user.* sysctls implement the ctl_table_root::permissions hook and they override the file access mode based on the CAP_SYS_RESOURCE capability (at most rwx if capable, at most r-- if not). The capability is being checked unconditionally, so if an LSM denies the capability, an audit record may be logged even when access is in fact granted. Given the logic in the set_permissions() function in kernel/ucount.c and the unfortunate way the permission checking is implemented, it doesn't seem viable to avoid false positive denials by deferring the capability check. Thus, do the same as in net_ctl_permissions() (net/sysctl_net.c) - switch from ns_capable() to ns_capable_noaudit(), so that the check never logs an audit record. Link: https://lkml.kernel.org/r/20260122140745.239428-1-omosnace@redhat.com Fixes: dbec28460a89 ("userns: Add per user namespace sysctls.") Signed-off-by: Ondrej Mosnacek Reviewed-by: Paul Moore Acked-by: Serge Hallyn Cc: Eric Biederman Cc: Alexey Gladkov Signed-off-by: Andrew Morton commit 8924336531e21b187d724b5fdf5277269c9ec22c Author: Ondrej Mosnacek Date: Thu Jan 22 15:13:03 2026 +0100 ipc: don't audit capability check in ipc_permissions() The IPC sysctls implement the ctl_table_root::permissions hook and they override the file access mode based on the CAP_CHECKPOINT_RESTORE capability, which is being checked regardless of whether any access is actually denied or not, so if an LSM denies the capability, an audit record may be logged even when access is in fact granted. It wouldn't be viable to restructure the sysctl permission logic to only check the capability when the access would be actually denied if it's not granted. Thus, do the same as in net_ctl_permissions() (net/sysctl_net.c) - switch from ns_capable() to ns_capable_noaudit(), so that the check never emits an audit record. Link: https://lkml.kernel.org/r/20260122141303.241133-1-omosnace@redhat.com Fixes: 0889f44e2810 ("ipc: Check permissions for checkpoint_restart sysctls at open time") Signed-off-by: Ondrej Mosnacek Acked-by: Alexey Gladkov Acked-by: Serge Hallyn Cc: Eric Biederman Cc: Paul Moore Signed-off-by: Andrew Morton commit 480e1d5c64bb14441f79f2eb9421d5e26f91ea3d Author: Li Chen Date: Tue Jan 20 20:40:04 2026 +0800 kexec: derive purgatory entry from symbol kexec_load_purgatory() derives image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable sections with overlapping sh_addr, the entrypoint check can match more than once and trigger a WARN. Derive the entry section from the purgatory_start symbol when present and compute image->start from its final placement. Keep the existing e_entry fallback for purgatories that do not expose the symbol. WARNING: kernel/kexec_file.c:1009 at kexec_load_purgatory+0x395/0x3c0, CPU#10: kexec/1784 Call Trace: bzImage64_load+0x133/0xa00 __do_sys_kexec_file_load+0x2b3/0x5c0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e [me@linux.beauty: move helper to avoid forward declaration, per Baoquan] Link: https://lkml.kernel.org/r/20260128043511.316860-1-me@linux.beauty Link: https://lkml.kernel.org/r/20260120124005.148381-1-me@linux.beauty Fixes: 8652d44f466a ("kexec: support purgatories with .text.hot sections") Signed-off-by: Li Chen Acked-by: Baoquan He Cc: Alexander Graf Cc: Eric Biggers Cc: Li Chen Cc: Philipp Rudo Cc: Ricardo Ribalda Delgado Cc: Ross Zwisler Cc: Sourabh Jain Cc: Steven Rostedt Cc: Signed-off-by: Andrew Morton commit 5138c936c2c82c9be8883921854bc6f7e1177d8c Author: Heming Zhao Date: Wed Dec 10 09:57:24 2025 +0800 ocfs2: fix reflink preserve cleanup issue commit c06c303832ec ("ocfs2: fix xattr array entry __counted_by error") doesn't handle all cases and the cleanup job for preserved xattr entries still has bug: - the 'last' pointer should be shifted by one unit after cleanup an array entry. - current code logic doesn't cleanup the first entry when xh_count is 1. Note, commit c06c303832ec is also a bug fix for 0fe9b66c65f3. Link: https://lkml.kernel.org/r/20251210015725.8409-2-heming.zhao@suse.com Fixes: 0fe9b66c65f3 ("ocfs2: Add preserve to reflink.") Signed-off-by: Heming Zhao Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit 666183dcdd9ad3b8156a1df7f204f728f720380f Author: Haoxiang Li Date: Wed Jan 21 09:35:08 2026 +0800 rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() When idtab allocation fails, net is not registered with rio_add_net() yet, so kfree(net) is sufficient to release the memory. Set mport->net to NULL to avoid dangling pointer. Link: https://lkml.kernel.org/r/20260121013508.195836-1-lihaoxiang@isrc.iscas.ac.cn Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Haoxiang Li Reviewed-by: Andrew Morton Cc: Alexandre Bounine Cc: Matt Porter Cc: Signed-off-by: Andrew Morton commit 503efe850c7463a1e59df133b84461ef53c0361f Author: Wang Yaxin Date: Mon Jan 19 10:02:41 2026 +0800 delayacct: add timestamp of delay max Problem ======= Commit 658eb5ab916d ("delayacct: add delay max to record delay peak") introduced the delay max for getdelays, which records abnormal latency peaks and helps us understand the magnitude of such delays. However, the peak latency value alone is insufficient for effective root cause analysis. Without the precise timestamp of when the peak occurred, we still lack the critical context needed to correlate it with other system events. Solution ======== To address this, we need to additionally record a precise timestamp when the maximum latency occurs. By correlating this timestamp with system logs and monitoring metrics, we can identify processes with abnormal resource usage at the same moment, which can help us to pinpoint root causes. Use Case ======== bash-4.4# ./getdelays -d -t 227 print delayacct stats ON TGID 227 CPU count real total virtual total delay total delay average delay max delay min delay max timestamp 46 188000000 192348334 4098012 0.089ms 0.429260ms 0.051205ms 2026-01-15T15:06:58 IO count delay total delay average delay max delay min delay max timestamp 0 0 0.000ms 0.000000ms 0.000000ms N/A SWAP count delay total delay average delay max delay min delay max timestamp 0 0 0.000ms 0.000000ms 0.000000ms N/A RECLAIM count delay total delay average delay max delay min delay max timestamp 0 0 0.000ms 0.000000ms 0.000000ms N/A THRAS HING count delay total delay average delay max delay min delay max timestamp 0 0 0.000ms 0.000000ms 0.000000ms N/A COMPACT count delay total delay average delay max delay min delay max timestamp 0 0 0.000ms 0.000000ms 0.000000ms N/A WPCOPY count delay total delay average delay max delay min delay max timestamp 182 19413338 0.107ms 0.547353ms 0.022462ms 2026-01-15T15:05:24 IRQ count delay total delay average delay max delay min delay max timestamp 0 0 0.000ms 0.000000ms 0.000000ms N/A Link: https://lkml.kernel.org/r/20260119100241520gWubW8-5QfhSf9gjqcc_E@zte.com.cn Signed-off-by: Wang Yaxin Cc: Fan Yu Cc: Jonathan Corbet Cc: xu xin Cc: Yang Yang Signed-off-by: Andrew Morton commit cc20650a096370469919be0eb3b041fc5aa47b39 Author: Eric Dumazet Date: Sat Jan 17 08:34:47 2026 +0000 scripts/bloat-o-meter: ignore __noinstr_text_start __noinstr_text_start is adding noise to the script, ignore it. For instance using __always_inline on __skb_incr_checksum_unnecessary and CC=clang build. Before this patch, __noinstr_text_start can show up and confuse us. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 3/0 up/down: 212/-206 (6) Function old new delta tcp6_gro_complete 208 283 +75 tcp4_gro_complete 376 449 +73 __noinstr_text_start 3536 3600 +64 __pfx___skb_incr_checksum_unnecessary 32 - -32 __skb_incr_checksum_unnecessary 174 - -174 Total: Before=25509464, After=25509470, chg +0.00% After this patch we have a more precise result. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 2/0 up/down: 148/-206 (-58) Function old new delta tcp6_gro_complete 208 283 +75 tcp4_gro_complete 376 449 +73 __pfx___skb_incr_checksum_unnecessary 32 - -32 __skb_incr_checksum_unnecessary 174 - -174 Total: Before=25505928, After=25505870, chg -0.00% Link: https://lkml.kernel.org/r/20260117083448.3877418-1-edumazet@google.com Signed-off-by: Eric Dumazet Signed-off-by: Andrew Morton commit bec261fec6d41318e414c4064f2b67c6db628acd Author: Yury Norov Date: Thu Jan 15 23:25:09 2026 -0500 tracing: move tracing declarations from kernel.h to a dedicated header Tracing is a half of the kernel.h in terms of LOCs, although it's a self-consistent part. It is intended for quick debugging purposes and isn't used by the normal tracing utilities. Move it to a separate header. If someone needs to just throw a trace_printk() in their driver, they will not have to pull all the heavy tracing machinery. This is a pure move. Link: https://lkml.kernel.org/r/20260116042510.241009-7-ynorov@nvidia.com Signed-off-by: Yury Norov Acked-by: Steven Rostedt Reviewed-by: Andy Shevchenko Reviewed-by: Joel Fernandes Cc: Aaron Tomlin Cc: Andi Shyti Cc: Christophe Leroy (CS GROUP) Cc: Greg Kroah-Hartman Cc: Jani Nikula Cc: Petr Pavlu Cc: Randy Dunlap Signed-off-by: Andrew Morton commit 86e685ff364394b477cd1c476029480a2a1960c5 Author: Steven Rostedt Date: Thu Jan 15 23:25:08 2026 -0500 tracing: remove size parameter in __trace_puts() The __trace_puts() function takes a string pointer and the size of the string itself. All users currently simply pass in the strlen() of the string it is also passing in. There's no reason to pass in the size. Instead have the __trace_puts() function do the strlen() within the function itself. This fixes a header recursion issue where using strlen() in the macro calling __trace_puts() requires adding #include in order to use strlen(). Removing the use of strlen() from the header fixes the recursion issue. Link: https://lore.kernel.org/all/aUN8Hm377C5A0ILX@yury/ Link: https://lkml.kernel.org/r/20260116042510.241009-6-ynorov@nvidia.com Signed-off-by: Steven Rostedt (Google) Signed-off-by: Yury Norov Reviewed-by: Andy Shevchenko Reviewed-by: Joel Fernandes Cc: Aaron Tomlin Cc: Andi Shyti Cc: Christophe Leroy (CS GROUP) Cc: Greg Kroah-Hartman Cc: Jani Nikula Cc: Petr Pavlu Cc: Randy Dunlap Signed-off-by: Andrew Morton commit 269586d68994ca307ded058255e243692e3bf753 Author: Yury Norov Date: Thu Jan 15 23:25:07 2026 -0500 kernel.h: include linux/instruction_pointer.h explicitly In preparation for decoupling linux/instruction_pointer.h and linux/kernel.h, include instruction_pointer.h explicitly where needed. Link: https://lkml.kernel.org/r/20260116042510.241009-5-ynorov@nvidia.com Signed-off-by: Yury Norov Reviewed-by: Andy Shevchenko Reviewed-by: Joel Fernandes Cc: Aaron Tomlin Cc: Andi Shyti Cc: Christophe Leroy (CS GROUP) Cc: Greg Kroah-Hartman Cc: Jani Nikula Cc: Petr Pavlu Cc: Randy Dunlap Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 90ddd39b881df74b14918cee031154f6ddb7af33 Author: Yury Norov Date: Thu Jan 15 23:25:06 2026 -0500 kernel.h: move VERIFY_OCTAL_PERMISSIONS() to sysfs.h The macro is related to sysfs, but is defined in kernel.h. Move it to the proper header, and unload the generic kernel.h. Now that the macro is removed from kernel.h, linux/moduleparam.h is decoupled, and kernel.h inclusion can be removed. Link: https://lkml.kernel.org/r/20260116042510.241009-4-ynorov@nvidia.com Signed-off-by: Yury Norov Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Andy Shevchenko Reviewed-by: Petr Pavlu Acked-by: Greg Kroah-Hartman Reviewed-by: Joel Fernandes Cc: Aaron Tomlin Cc: Andi Shyti Cc: Christophe Leroy (CS GROUP) Cc: Jani Nikula Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 25b66674b1036c1eb3069bf62329a9c60850d782 Author: Yury Norov Date: Thu Jan 15 23:25:05 2026 -0500 moduleparam: include required headers explicitly The following patch drops moduleparam.h dependency on kernel.h. In preparation to it, list all the required headers explicitly. Link: https://lkml.kernel.org/r/20260116042510.241009-3-ynorov@nvidia.com Signed-off-by: Yury Norov Suggested-by: Petr Pavlu Reviewed-by: Petr Pavlu Reviewed-by: Andy Shevchenko Reviewed-by: Joel Fernandes Cc: Aaron Tomlin Cc: Andi Shyti Cc: Christophe Leroy (CS GROUP) Cc: Greg Kroah-Hartman Cc: Jani Nikula Cc: Randy Dunlap Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit f2e0abdc88ce68cdba0a66ccc05a3e96b688a2c7 Author: Yury Norov Date: Thu Jan 15 23:25:04 2026 -0500 kernel.h: drop STACK_MAGIC macro Patch series "Unload linux/kernel.h", v5. kernel.h hosts declarations that can be placed better. This series decouples kernel.h with some explicit and implicit dependencies; also, moves tracing functionality to a new independent header. This patch (of 6): The macro was introduced in 1994, v1.0.4, for stacks protection. Since that, people found better ways to protect stacks, and now the macro is only used by i915 selftests. Move it to a local header and drop from the kernel.h. Link: https://lkml.kernel.org/r/20260116042510.241009-1-ynorov@nvidia.com Link: https://lkml.kernel.org/r/20260116042510.241009-2-ynorov@nvidia.com Signed-off-by: Yury Norov Reviewed-by: Andy Shevchenko Acked-by: Randy Dunlap Acked-by: Jani Nikula Reviewed-by: Christophe Leroy (CS GROUP) Reviewed-by: Aaron Tomlin Reviewed-by: Andi Shyti Reviewed-by: Joel Fernandes Cc: Greg Kroah-Hartman Cc: Petr Pavlu Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit e8d899d301346a5591c9d1af06c3c9b3501cf84b Author: Nathan Chancellor Date: Fri Jan 16 16:26:27 2026 -0700 compiler-clang.h: require LLVM 19.1.0 or higher for __typeof_unqual__ When building the kernel using a version of LLVM between llvmorg-19-init (the first commit of the LLVM 19 development cycle) and the change in LLVM that actually added __typeof_unqual__ for all C modes [1], which might happen during a bisect of LLVM, there is a build failure: In file included from arch/x86/kernel/asm-offsets.c:9: In file included from include/linux/crypto.h:15: In file included from include/linux/completion.h:12: In file included from include/linux/swait.h:7: In file included from include/linux/spinlock.h:56: In file included from include/linux/preempt.h:79: arch/x86/include/asm/preempt.h:61:2: error: call to undeclared function '__typeof_unqual__'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 61 | raw_cpu_and_4(__preempt_count, ~PREEMPT_NEED_RESCHED); | ^ arch/x86/include/asm/percpu.h:478:36: note: expanded from macro 'raw_cpu_and_4' 478 | #define raw_cpu_and_4(pcp, val) percpu_binary_op(4, , "and", (pcp), val) | ^ arch/x86/include/asm/percpu.h:210:3: note: expanded from macro 'percpu_binary_op' 210 | TYPEOF_UNQUAL(_var) pto_tmp__; \ | ^ include/linux/compiler.h:248:29: note: expanded from macro 'TYPEOF_UNQUAL' 248 | # define TYPEOF_UNQUAL(exp) __typeof_unqual__(exp) | ^ The current logic of CC_HAS_TYPEOF_UNQUAL just checks for a major version of 19 but half of the 19 development cycle did not have support for __typeof_unqual__. Harden the logic of CC_HAS_TYPEOF_UNQUAL to avoid this error by only using __typeof_unqual__ with a released version of LLVM 19, which is greater than or equal to 19.1.0 with LLVM's versioning scheme that matches GCC's [2]. Link: https://github.com/llvm/llvm-project/commit/cc308f60d41744b5920ec2e2e5b25e1273c8704b [1] Link: https://github.com/llvm/llvm-project/commit/4532617ae420056bf32f6403dde07fb99d276a49 [2] Link: https://lkml.kernel.org/r/20260116-require-llvm-19-1-for-typeof_unqual-v1-1-3b9a4a4b212b@kernel.org Fixes: ac053946f5c4 ("compiler.h: introduce TYPEOF_UNQUAL() macro") Signed-off-by: Nathan Chancellor Cc: Bill Wendling Cc: Justin Stitt Cc: Uros Bizjak Cc: Signed-off-by: Andrew Morton commit 8f1081892d6218d23bf8afb4246217c41f5a9b21 Author: Pratyush Yadav Date: Fri Jan 16 11:22:15 2026 +0000 kho: simplify page initialization in kho_restore_page() When restoring a page (from kho_restore_pages()) or folio (from kho_restore_folio()), KHO must initialize the struct page. The initialization differs slightly depending on if a folio is requested or a set of 0-order pages is requested. Conceptually, it is quite simple to understand. When restoring 0-order pages, each page gets a refcount of 1 and that's it. When restoring a folio, head page gets a refcount of 1 and tail pages get 0. kho_restore_page() tries to combine the two separate initialization flow into one piece of code. While it works fine, it is more complicated to read than it needs to be. Make the code simpler by splitting the two initalization paths into two separate functions. This improves readability by clearly showing how each type must be initialized. Link: https://lkml.kernel.org/r/20260116112217.915803-3-pratyush@kernel.org Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Cc: Alexander Graf Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 840fe43d371fc59ef2da6b6bb88a4d480eed9a38 Author: Pratyush Yadav Date: Fri Jan 16 11:22:14 2026 +0000 kho: use unsigned long for nr_pages Patch series "kho: clean up page initialization logic", v2. This series simplifies the page initialization logic in kho_restore_page(). It was originally only a single patch [0], but on Pasha's suggestion, I added another patch to use unsigned long for nr_pages. Technically speaking, the patches aren't related and can be applied independently, but bundling them together since patch 2 relies on 1 and it is easier to manage them this way. This patch (of 2): With 4k pages, a 32-bit nr_pages can span up to 16 TiB. While it is a lot, there exist systems with terabytes of RAM. gup is also moving to using long for nr_pages. Use unsigned long and make KHO future-proof. Link: https://lkml.kernel.org/r/20260116112217.915803-1-pratyush@kernel.org Link: https://lkml.kernel.org/r/20260116112217.915803-2-pratyush@kernel.org Signed-off-by: Pratyush Yadav Suggested-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Cc: Alexander Graf Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 931d5c36c7369b65adb9e3d197a8d3a8a913db8c Author: Joe Perches Date: Fri Jan 16 09:42:52 2026 -0800 checkpatch: add an invalid patch separator test Some versions of tools that apply patches incorrectly allow lines that start with 3 dashes and have additional content on the same line. Checkpatch will now emit an ERROR on these lines and optionally convert those lines from dashes to equals with --fix. Link: https://lkml.kernel.org/r/6ec1ed08328340db42655287afd5fa4067316b11.camel@perches.com Signed-off-by: Joe Perches Suggested-by: Ian Rogers Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Kuan-Wei Chiu Cc: Lukas Bulwahn Cc: Namhyung kim Cc: Stehen Rothwell Signed-off-by: Andrew Morton commit 2eec08ff09a416bf04b5716850da73a5084d0500 Merge: 6ca9de3600f482 bd58782995a2e6 Author: Andrew Morton Date: Sat Jan 31 16:12:21 2026 -0800 Merge branch 'mm-hotfixes-stable' into mm-nonmm-stable to pick up changes required to merge "kho: use unsigned long for nr_pages". commit 50c7f34c5c7403a12003c6759f6f6ca9a5a10872 Author: Kairui Song Date: Sat Dec 20 03:43:48 2025 +0800 mm, swap: remove no longer needed _swap_info_get There are now only two users of _swap_info_get after consolidating these callers, folio_free_swap and swp_swapcount. folio_free_swap already holds the folio lock, and the folio must be in the swap cache, _swap_info_get is redundant. For swp_swapcount, it should use get_swap_device instead. get_swap_device increases the device ref count, which is actually a bit safer. The only current use is smap walking, and the performance change here is tiny. And after these changes, _swap_info_get is no longer used, so we can safely remove it. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-19-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit d3852f9692b8a6af7566f92f7432ee5067c6be15 Author: Kairui Song Date: Sat Dec 20 03:43:47 2025 +0800 mm, swap: drop the SWAP_HAS_CACHE flag Now, the swap cache is managed by the swap table. All swap cache users are checking the swap table directly to check the swap cache state. SWAP_HAS_CACHE is now just a temporary pin before the first increase from 0 to 1 of a slot's swap count (swap_dup_entries) after swap allocation (folio_alloc_swap), or before the final free of slots pinned by folio in swap cache (put_swap_folio). Drop these two usages. For the first dup, SWAP_HAS_CACHE pinning was hard to kill because it used to have multiple meanings, more than just "a slot is cached". We have just simplified that and defined that the first dup is always done with folio locked in swap cache (folio_dup_swap), so stop checking the SWAP_HAS_CACHE bit and just check the swap cache (swap table) directly, and add a WARN if a swap entry's count is being increased for the first time while the folio is not in swap cache. As for freeing, just let the swap cache free all swap entries of a folio that have a swap count of zero directly upon folio removal. We have also just cleaned up batch freeing to check the swap cache usage using the swap table: a slot with swap cache in the swap table will not be freed until its cache is gone, and no SWAP_HAS_CACHE bit is involved anymore. And besides, the removal of a folio and freeing of the slots are being done in the same critical section now, which should improve the performance. After these two changes, SWAP_HAS_CACHE no longer has any users. Swap cache synchronization is also done by the swap table directly, so using SWAP_HAS_CACHE to pin a slot before adding the cache is also no longer needed. Remove all related logic and helpers. swap_map is now only used for tracking the count, so all swap_map users can just read it directly, ignoring the swap_count helper, which was previously used to filter out the SWAP_HAS_CACHE bit. The idea of dropping SWAP_HAS_CACHE and using the swap table directly was initially from Chris's idea of merging all the metadata usage of all swaps into one place. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-18-8862a265a033@tencent.com Signed-off-by: Kairui Song Suggested-by: Chris Li Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit e1c5c6be3ca7294f0d49d685e3ff929c7c496cbd Author: Kairui Song Date: Sat Dec 20 03:43:46 2025 +0800 mm, swap: clean up and improve swap entries freeing There are a few problems with the current freeing of swap entries. When freeing a set of swap entries directly (swap_put_entries_direct, typically from zapping the page table), it scans the whole swap region multiple times. First, it scans the whole region to check if it can be batch freed and if there is any cached folio. Then do a batch free only if the whole region's swap count equals 1. And if any entry is cached, even if only one, it will have to walk the whole region again to clean up the cache. And if any entry is not in a consistent status with other entries, it will fall back to order 0 freeing. For example, if only one of them is cached, the batch free will fall back. And the current batch freeing workflow relies on the swap map's SWAP_HAS_CACHE bit for both continuous checking and batch freeing, which isn't compatible with the swap table design. Tidy this up, introduce a new cluster scoped helper for all swap entry freeing job. It will batch frees all continuous entries, and just start a new batch if any inconsistent entry is found. This may improve the batch size when the clusters are fragmented. This should also be more robust with more sanity checks, and make it clear that a slot pinned by swap cache will be cleared upon cache reclaim. And the cache reclaim scan is also now limited to each cluster. If a cluster has any clean swap cache left after putting the swap count, reclaim the cluster only instead of the whole region. And since a folio's entries are always in the same cluster, putting swap entries from a folio can also use the new helper directly. This should be both an optimization and a cleanup, and the new helper is adapted to the swap table. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-17-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit 4984d746c80e888a89342d03e2b1ef20f804dff0 Author: Kairui Song Date: Sat Dec 20 03:43:45 2025 +0800 mm, swap: check swap table directly for checking cache Instead of looking at the swap map, check swap table directly to tell if a swap slot is cached. Prepares for the removal of SWAP_HAS_CACHE. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-16-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit 270f095179ff15b7c72f25dd6720dcab3d15cc9b Author: Kairui Song Date: Sat Dec 20 03:43:44 2025 +0800 mm, swap: add folio to swap cache directly on allocation The allocator uses SWAP_HAS_CACHE to pin a swap slot upon allocation. SWAP_HAS_CACHE is being deprecated as it caused a lot of confusion. This pinning usage here can be dropped by adding the folio to swap cache directly on allocation. All swap allocations are folio-based now (except for hibernation), so the swap allocator can always take the folio as the parameter. And now both swap cache (swap table) and swap map are protected by the cluster lock, scanning the map and inserting the folio can be done in the same critical section. This eliminates the time window that a slot is pinned by SWAP_HAS_CACHE, but it has no cache, and avoids touching the lock multiple times. This is both a cleanup and an optimization. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-15-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit 36976159140bc288c3752a9b799090a49f1a8b62 Author: Kairui Song Date: Sat Dec 20 03:43:43 2025 +0800 mm, swap: cleanup swap entry management workflow The current swap entry allocation/freeing workflow has never had a clear definition. This makes it hard to debug or add new optimizations. This commit introduces a proper definition of how swap entries would be allocated and freed. Now, most operations are folio based, so they will never exceed one swap cluster, and we now have a cleaner border between swap and the rest of mm, making it much easier to follow and debug, especially with new added sanity checks. Also making more optimization possible. Swap entry will be mostly freed and free with a folio bound. The folio lock will be useful for resolving many swap related races. Now swap allocation (except hibernation) always starts with a folio in the swap cache, and gets duped/freed protected by the folio lock: - folio_alloc_swap() - The only allocation entry point now. Context: The folio must be locked. This allocates one or a set of continuous swap slots for a folio and binds them to the folio by adding the folio to the swap cache. The swap slots' swap count start with zero value. - folio_dup_swap() - Increase the swap count of one or more entries. Context: The folio must be locked and in the swap cache. For now, the caller still has to lock the new swap entry owner (e.g., PTL). This increases the ref count of swap entries allocated to a folio. Newly allocated swap slots' count has to be increased by this helper as the folio got unmapped (and swap entries got installed). - folio_put_swap() - Decrease the swap count of one or more entries. Context: The folio must be locked and in the swap cache. For now, the caller still has to lock the new swap entry owner (e.g., PTL). This decreases the ref count of swap entries allocated to a folio. Typically, swapin will decrease the swap count as the folio got installed back and the swap entry got uninstalled This won't remove the folio from the swap cache and free the slot. Lazy freeing of swap cache is helpful for reducing IO. There is already a folio_free_swap() for immediate cache reclaim. This part could be further optimized later. The above locking constraints could be further relaxed when the swap table is fully implemented. Currently dup still needs the caller to lock the swap entry container (e.g. PTL), or a concurrent zap may underflow the swap count. Some swap users need to interact with swap count without involving folio (e.g. forking/zapping the page table or mapping truncate without swapin). In such cases, the caller has to ensure there is no race condition on whatever owns the swap count and use the below helpers: - swap_put_entries_direct() - Decrease the swap count directly. Context: The caller must lock whatever is referencing the slots to avoid a race. Typically the page table zapping or shmem mapping truncate will need to free swap slots directly. If a slot is cached (has a folio bound), this will also try to release the swap cache. - swap_dup_entry_direct() - Increase the swap count directly. Context: The caller must lock whatever is referencing the entries to avoid race, and the entries must already have a swap count > 1. Typically, forking will need to copy the page table and hence needs to increase the swap count of the entries in the table. The page table is locked while referencing the swap entries, so the entries all have a swap count > 1 and can't be freed. Hibernation subsystem is a bit different, so two special wrappers are here: - swap_alloc_hibernation_slot() - Allocate one entry from one device. - swap_free_hibernation_slot() - Free one entry allocated by the above helper. All hibernation entries are exclusive to the hibernation subsystem and should not interact with ordinary swap routines. By separating the workflows, it will be possible to bind folio more tightly with swap cache and get rid of the SWAP_HAS_CACHE as a temporary pin. This commit should not introduce any behavior change [kasong@tencent.com: fix leak, per Chris Mason. Remove WARN_ON, per Lai Yi] Link: https://lkml.kernel.org/r/CAMgjq7AUz10uETVm8ozDWcB3XohkOqf0i33KGrAquvEVvfp5cg@mail.gmail.com [ryncsn@gmail.com: fix KSM copy pages for swapoff, per Chris] Link: https://lkml.kernel.org/r/aXxkANcET3l2Xu6J@KASONG-MC4 Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-14-8862a265a033@tencent.com Signed-off-by: Kairui Song Signed-off-by: Kairui Song Acked-by: Rafael J. Wysocki (Intel) Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Cc: Chris Mason Cc: Chris Mason Cc: Lai Yi Signed-off-by: Andrew Morton commit de85024b34839e9c476b6f93c3104e920bd9d270 Author: Kairui Song Date: Sat Dec 20 03:43:42 2025 +0800 mm, swap: remove workaround for unsynchronized swap map cache state Remove the "skip if exists" check from commit a65b0e7607ccb ("zswap: make shrinking memcg-aware"). It was needed because there is a tiny time window between setting the SWAP_HAS_CACHE bit and actually adding the folio to the swap cache. If a user is trying to add the folio into the swap cache but another user was interrupted after setting SWAP_HAS_CACHE but hasn't added the folio to the swap cache yet, it might lead to a deadlock. We have moved the bit setting to the same critical section as adding the folio, so this is no longer needed. Remove it and clean it up. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-13-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit 2732acda82c93475c5986e1a5640004a5d4f9c3e Author: Kairui Song Date: Sat Dec 20 03:43:41 2025 +0800 mm, swap: use swap cache as the swap in synchronize layer Current swap in synchronization mostly uses the swap_map's SWAP_HAS_CACHE bit. Whoever sets the bit first does the actual work to swap in a folio. This has been causing many issues as it's just a poor implementation of a bit lock. Raced users have no idea what is pinning a slot, so it has to loop with a schedule_timeout_uninterruptible(1), which is ugly and causes long-tailing or other performance issues. Besides, the abuse of SWAP_HAS_CACHE has been causing many other troubles for synchronization or maintenance. This is the first step to remove this bit completely. Now all swap in paths are using the swap cache, and both the swap cache and swap map are protected by the cluster lock. So we can just resolve the swap synchronization with the swap cache layer directly using the cluster lock and folio lock. Whoever inserts a folio in the swap cache first does the swap in work. And because folios are locked during swap operations, other raced swap operations will just wait on the folio lock. The SWAP_HAS_CACHE will be removed in later commit. For now, we still set it for some remaining users. But now we do the bit setting and swap cache folio adding in the same critical section, after swap cache is ready. No one will have to spin on the SWAP_HAS_CACHE bit anymore. This both simplifies the logic and should improve the performance, eliminating issues like the one solved in commit 01626a1823024 ("mm: avoid unconditional one-tick sleep when swapcache_prepare fails"), or the "skip_if_exists" from commit a65b0e7607ccb ("zswap: make shrinking memcg-aware"), which will be removed very soon. [kasong@tencent.com: fix cgroup v1 accounting issue] Link: https://lkml.kernel.org/r/CAMgjq7CGUnzOVG7uSaYjzw9wD7w2dSKOHprJfaEp4CcGLgE3iw@mail.gmail.com Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-12-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit 78d6a12dd91a84b0d7e31110b1ea7f4b6a0f8d65 Author: Kairui Song Date: Sat Dec 20 03:43:40 2025 +0800 mm, swap: split locked entry duplicating into a standalone helper No feature change, split the common logic into a stand alone helper to be reused later. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-11-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit cda2504c51eba2364472de2d6fff4a7fb797d018 Author: Kairui Song Date: Sat Dec 20 03:43:39 2025 +0800 mm, swap: consolidate cluster reclaim and usability check Swap cluster cache reclaim requires releasing the lock, so the cluster may become unusable after the reclaim. To prepare for checking swap cache using the swap table directly, consolidate the swap cluster reclaim and the check logic. We will want to avoid touching the cluster's data completely with the swap table, to avoid RCU overhead here. And by moving the cluster usable check into the reclaim helper, it will also help avoid a redundant scan of the slots if the cluster is no longer usable, and we will want to avoid touching the cluster. Also, adjust it very slightly while at it: always scan the whole region during reclaim, don't skip slots covered by a reclaimed folio. Because the reclaim is lockless, it's possible that new cache lands at any time. And for allocation, we want all caches to be reclaimed to avoid fragmentation. Besides, if the scan offset is not aligned with the size of the reclaimed folio, we might skip some existing cache and fail the reclaim unexpectedly. There should be no observable behavior change. It might slightly improve the fragmentation issue or performance. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-10-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit f7ad377a9222a3e873cd20fd6fccf1a6f7f1347e Author: Kairui Song Date: Sat Dec 20 03:43:38 2025 +0800 mm, swap: swap entry of a bad slot should not be considered as swapped out When checking if a swap entry is swapped out, we simply check if the bitwise result of the count value is larger than 0. But SWAP_MAP_BAD will also be considered as a swao count value larger than 0. SWAP_MAP_BAD being considered as a count value larger than 0 is useful for the swap allocator: they will be seen as a used slot, so the allocator will skip them. But for the swapped out check, this isn't correct. There is currently no observable issue. The swapped out check is only useful for readahead and folio swapped-out status check. For readahead, the swap cache layer will abort upon checking and updating the swap map. For the folio swapped out status check, the swap allocator will never allocate an entry of bad slots to folio, so that part is fine too. The worst that could happen now is redundant allocation/freeing of folios and waste CPU time. This also makes it easier to get rid of swap map checking and update during folio insertion in the swap cache layer. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-9-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit bc617c990eae4259cd5014d596477cbe0d596417 Author: Nhat Pham Date: Sat Dec 20 03:43:37 2025 +0800 mm/shmem, swap: remove SWAP_MAP_SHMEM The SWAP_MAP_SHMEM state was introduced in the commit aaa468653b4a ("swap_info: note SWAP_MAP_SHMEM"), to quickly determine if a swap entry belongs to shmem during swapoff. However, swapoff has since been rewritten in the commit b56a2d8af914 ("mm: rid swapoff of quadratic complexity"). Now having swap count == SWAP_MAP_SHMEM value is basically the same as having swap count == 1, and swap_shmem_alloc() behaves analogously to swap_duplicate(). The only difference of note is that swap_shmem_alloc() does not check for -ENOMEM returned from __swap_duplicate(), but it is OK because shmem never re-duplicates any swap entry it owns. This will stil be safe if we use (batched) swap_duplicate() instead. This commit adds swap_duplicate_nr(), the batched variant of swap_duplicate(), and removes the SWAP_MAP_SHMEM state and the associated swap_shmem_alloc() helper to simplify the state machine (both mentally and in terms of actual code). We will also have an extra state/special value that can be repurposed (for swap entries that never gets re-duplicated). Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-8-8862a265a033@tencent.com Signed-off-by: Kairui Song Signed-off-by: Nhat Pham Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit c246d236b18befdfeb82ce2a01e23d45cb5eeea6 Author: Kairui Song Date: Sat Dec 20 03:57:51 2025 +0800 mm/shmem: never bypass the swap cache for SWP_SYNCHRONOUS_IO Now the overhead of the swap cache is trivial to none, bypassing the swap cache is no longer a good optimization. We have removed the cache bypass swapin for anon memory, now do the same for shmem. Many helpers and functions can be dropped now. The performance may slightly drop because of the co-existence and double update of swap_map and swap table, and this problem will be improved very soon in later commits by dropping the swap_map update partially: Swapin of 24 GB file with tmpfs with transparent_hugepage_tmpfs=within_size and ZRAM, 3 test runs on my machine: Before: After this commit: After this series: 5.99s 6.29s 6.08s And later swap table phases will drop the swap_map completely to avoid overhead and reduce memory usage. Link: https://lkml.kernel.org/r/20251219195751.61328-1-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Signed-off-by: Andrew Morton commit 4b34f1d82c6549837b2061096dea249e881a4495 Author: Kairui Song Date: Sat Dec 20 03:43:35 2025 +0800 mm, swap: free the swap cache after folio is mapped Currently, we remove the folio from the swap cache and free the swap cache before mapping the PTE. To reduce repeated faults due to parallel swapins of the same PTE, change it to remove the folio from the swap cache after it is mapped. So new faults from the swap PTE will be much more likely to see the folio in the swap cache and wait on it. This does not eliminate all swapin races: an ongoing swapin fault may still see an empty swap cache. That's harmless, as the PTE is changed before the swap cache is cleared, so it will just return and not trigger any repeated faults. This does help to reduce the chance. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-6-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit 6aeec9a1a3222dc497066dfa63a0517e43493d77 Author: Kairui Song Date: Sat Dec 20 03:43:34 2025 +0800 mm, swap: simplify the code and reduce indention Now swap cache is always used, multiple swap cache checks are no longer useful, remove them and reduce the code indention. No behavior change. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-5-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit ab08be8dc96a217ad3ab7d6518bcad43444f78b3 Author: Kairui Song Date: Sat Dec 20 03:43:33 2025 +0800 mm, swap: always try to free swap cache for SWP_SYNCHRONOUS_IO devices Now SWP_SYNCHRONOUS_IO devices are also using swap cache. One side effect is that a folio may stay in swap cache for a longer time due to lazy freeing (vm_swap_full()). This can help save some CPU / IO if folios are being swapped out very frequently right after swapin, hence improving the performance. But the long pinning of swap slots also increases the fragmentation rate of the swap device significantly, and currently, all in-tree SWP_SYNCHRONOUS_IO devices are RAM disks, so it also causes the backing memory to be pinned, increasing the memory pressure. So drop the swap cache immediately for SWP_SYNCHRONOUS_IO devices after swapin finishes. Swap cache has served its role as a synchronization layer to prevent any parallel swap-in from wasting CPU or memory allocation, and the redundant IO is not a major concern for SWP_SYNCHRONOUS_IO devices. Worth noting, without this patch, this series so far can provide a ~30% performance gain for certain workloads like MySQL or kernel compilation, but causes significant regression or OOM when under extreme global pressure. With this patch, we still have a nice performance gain for most workloads, and without introducing any observable regressions. This is a hint that further optimization can be done based on the new unified swapin with swap cache, but for now, just keep the behaviour consistent with before. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-4-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit f1879e8a0c601de78a356016e216241b43de9208 Author: Kairui Song Date: Sat Dec 20 03:43:32 2025 +0800 mm, swap: never bypass the swap cache even for SWP_SYNCHRONOUS_IO Now the overhead of the swap cache is trivial. Bypassing the swap cache is no longer a valid optimization. So unify the swapin path using the swap cache. This changes the swap in behavior in two observable ways. Readahead is now always disabled for SWP_SYNCHRONOUS_IO devices, which is a huge win for some workloads: We used to rely on `SWP_SYNCHRONOUS_IO && __swap_count(entry) == 1` as the indicator to bypass both the swap cache and readahead, the swap count check made bypassing ineffective in many cases, and it's not a good indicator. The limitation existed because the current swap design made it hard to decouple readahead bypassing and swap cache bypassing. We do want to always bypass readahead for SWP_SYNCHRONOUS_IO devices, but bypassing swap cache at the same time will cause repeated IO and memory overhead. Now that swap cache bypassing is gone, this swap count check can be dropped. The second thing here is that this enabled large swapin for all swap entries on SWP_SYNCHRONOUS_IO devices. Previously, the large swap in is also coupled with swap cache bypassing, and so the swap count checking also makes large swapin less effective. Now this is also improved. We will always have large swapin supported for all SWP_SYNCHRONOUS_IO cases. And to catch potential issues with large swapin, especially with page exclusiveness and swap cache, more debug sanity checks and comments are added. But overall, the code is simpler. And new helper and routines will be used by other components in later commits too. And now it's possible to rely on the swap cache layer for resolving synchronization issues, which will also be done by a later commit. Worth mentioning that for a large folio workload, this may cause more serious thrashing. This isn't a problem with this commit, but a generic large folio issue. For a 4K workload, this commit increases the performance. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-3-8862a265a033@tencent.com Signed-off-by: Kairui Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Barry Song Cc: Chris Li Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit 84eedc747b53da0b0327a5612afaab6ef85b7011 Author: Kairui Song Date: Sat Dec 20 03:43:31 2025 +0800 mm, swap: split swap cache preparation loop into a standalone helper To prepare for the removal of swap cache bypass swapin, introduce a new helper that accepts an allocated and charged fresh folio, prepares the folio, the swap map, and then adds the folio to the swap cache. This doesn't change how swap cache works yet, we are still depending on the SWAP_HAS_CACHE in the swap map for synchronization. But all synchronization hacks are now all in this single helper. No feature change. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-2-8862a265a033@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Reviewed-by: Barry Song Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Nhat Pham Cc: Rafael J. Wysocki (Intel) Cc: Yosry Ahmed Cc: Deepanshu Kartikey Cc: Johannes Weiner Cc: Kairui Song Signed-off-by: Andrew Morton commit d7cf0d54f21087dea8ec5901ffb482b0ab38a42d Author: Kairui Song Date: Sat Dec 20 03:43:30 2025 +0800 mm, swap: rename __read_swap_cache_async to swap_cache_alloc_folio Patch series "mm, swap: swap table phase II: unify swapin use", v5. This series removes the SWP_SYNCHRONOUS_IO swap cache bypass swapin code and special swap flag bits including SWAP_HAS_CACHE, along with many historical issues. The performance is about ~20% better for some workloads, like Redis with persistence. This also cleans up the code to prepare for later phases, some patches are from a previously posted series. Swap cache bypassing and swap synchronization in general had many issues. Some are solved as workarounds, and some are still there [1]. To resolve them in a clean way, one good solution is to always use swap cache as the synchronization layer [2]. So we have to remove the swap cache bypass swap-in path first. It wasn't very doable due to performance issues, but now combined with the swap table, removing the swap cache bypass path will instead improve the performance, there is no reason to keep it. Now we can rework the swap entry and cache synchronization following the new design. Swap cache synchronization was heavily relying on SWAP_HAS_CACHE, which is the cause of many issues. By dropping the usage of special swap map bits and related workarounds, we get a cleaner code base and prepare for merging the swap count into the swap table in the next step. And swap_map is now only used for swap count, so in the next phase, swap_map can be merged into the swap table, which will clean up more things and start to reduce the static memory usage. Removal of swap_cgroup_ctrl is also doable, but needs to be done after we also simplify the allocation of swapin folios: always use the new swap_cache_alloc_folio helper so the accounting will also be managed by the swap layer by then. Test results: Redis / Valkey bench: ===================== Testing on a ARM64 VM 1.5G memory: Server: valkey-server --maxmemory 2560M Client: redis-benchmark -r 3000000 -n 3000000 -d 1024 -c 12 -P 32 -t get no persistence with BGSAVE Before: 460475.84 RPS 311591.19 RPS After: 451943.34 RPS (-1.9%) 371379.06 RPS (+19.2%) Testing on a x86_64 VM with 4G memory (system components takes about 2G): Server: Client: redis-benchmark -r 3000000 -n 3000000 -d 1024 -c 12 -P 32 -t get no persistence with BGSAVE Before: 306044.38 RPS 102745.88 RPS After: 309645.44 RPS (+1.2%) 125313.28 RPS (+22.0%) The performance is a lot better when persistence is applied. This should apply to many other workloads that involve sharing memory and COW. A slight performance drop was observed for the ARM64 Redis test: We are still using swap_map to track the swap count, which is causing redundant cache and CPU overhead and is not very performance-friendly for some arches. This will be improved once we merge the swap map into the swap table (as already demonstrated previously [3]). vm-scabiity =========== usemem --init-time -O -y -x -n 32 1536M (16G memory, global pressure, simulated PMEM as swap), average result of 6 test run: Before: After: System time: 282.22s 283.47s Sum Throughput: 5677.35 MB/s 5688.78 MB/s Single process Throughput: 176.41 MB/s 176.23 MB/s Free latency: 518477.96 us 521488.06 us Which is almost identical. Build kernel test: ================== Test using ZRAM as SWAP, make -j48, defconfig, on a x86_64 VM with 4G RAM, under global pressure, avg of 32 test run: Before After: System time: 1379.91s 1364.22s (-0.11%) Test using ZSWAP with NVME SWAP, make -j48, defconfig, on a x86_64 VM with 4G RAM, under global pressure, avg of 32 test run: Before After: System time: 1822.52s 1803.33s (-0.11%) Which is almost identical. MySQL: ====== sysbench /usr/share/sysbench/oltp_read_only.lua --tables=16 --table-size=1000000 --threads=96 --time=600 (using ZRAM as SWAP, in a 512M memory cgroup, buffer pool set to 3G, 3 test run and 180s warm up). Before: 318162.18 qps After: 318512.01 qps (+0.01%) In conclusion, the result is looking better or identical for most cases, and it's especially better for workloads with swap count > 1 on SYNC_IO devices, about ~20% gain in above test. Next phases will start to merge swap count into swap table and reduce memory usage. One more gain here is that we now have better support for THP swapin. Previously, the THP swapin was bound with swap cache bypassing, which only works for single-mapped folios. Removing the bypassing path also enabled THP swapin for all folios. The THP swapin is still limited to SYNC_IO devices, the limitation can be removed later. This may cause more serious THP thrashing for certain workloads, but that's not an issue caused by this series, it's a common THP issue we should resolve separately. This patch (of 19): __read_swap_cache_async is widely used to allocate and ensure a folio is in swapcache, or get the folio if a folio is already there. It's not async, and it's not doing any read. Rename it to better present its usage, and prepare to be reworked as part of new swap cache APIs. Also, add some comments for the function. Worth noting that the skip_if_exists argument is an long existing workaround that will be dropped soon. Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-0-8862a265a033@tencent.com Link: https://lkml.kernel.org/r/20251220-swap-table-p2-v5-1-8862a265a033@tencent.com Link: https://lore.kernel.org/linux-mm/CAMgjq7D5qoFEK9Omvd5_Zqs6M+TEoG03+2i_mhuP5CQPSOPrmQ@mail.gmail.com/ [1] Link: https://lore.kernel.org/linux-mm/20240326185032.72159-1-ryncsn@gmail.com/ [2] Link: https://lore.kernel.org/linux-mm/20250514201729.48420-1-ryncsn@gmail.com/ [3] Signed-off-by: Kairui Song Reviewed-by: Yosry Ahmed Acked-by: Chris Li Reviewed-by: Barry Song Reviewed-by: Nhat Pham Reviewed-by: Baoquan He Cc: Baolin Wang Cc: Rafael J. Wysocki (Intel) Cc: Deepanshu Kartikey Cc: Johannes Weiner Signed-off-by: Andrew Morton commit 6ce964c02f1cb49b4dbb76507948c004d5a0b4fe Author: Mark Brown Date: Fri Jan 23 22:39:24 2026 +0000 selftests/mm: have the harness run each test category separately At present the mm selftests are integrated into the kselftest harness by having it run run_vmtest.sh and letting it pick it's default set of tests to invoke, rather than by telling the kselftest framework about each test program individually as is more standard. This has some unfortunate interactions with the kselftest harness: - If any of the tests hangs the harness will kill the entire mm selftests run rather than just the individual test, meaning no further tests get run. - The timeout applied by the harness is applied to the whole run rather than an individual test which frequently leads to the suite not being completed in production testing. Deploy a crude but effective mitigation for these issues by telling the kselftest framework to run each of the test categories that run_vmtests.sh has separately. Since kselftest really wants to run test programs this is done by providing a trivial wrapper script for each categorty that invokes run_vmtest.sh, this is not a thing of great elegence but it is clear and simple. Since run_vmtests.sh is doing runtime support detection, scenario enumeration and setup for many of the tests we can't consistently tell the framework about the individual test programs. This has the side effect of reordering the tests, hopefully the testing is not overly sensitive to this. Link: https://lkml.kernel.org/r/20260123-selftests-mm-run-suites-separately-v2-1-3e934edacbfa@kernel.org Signed-off-by: Mark Brown Reviewed-by: Lorenzo Stoakes Cc: David Hildenbrand Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit a4818a8beb158f719581352f80d5b88f938f5457 Author: Dennis Zhou Date: Fri Jan 23 12:55:35 2026 -0800 percpu: add double free check to pcpu_free_area() Percpu memory provides access via offsets into the percpu address space. Offsets are essentially fixed for the lifetime of a chunk and therefore require all users be good samaritans. If a user improperly handles the lifetime of the percpu object, it can result in corruption in a couple of ways: - immediate double free - breaks percpu metadata accounting - free after subsequent allocation - corruption due to multiple owner problem (either prior owner still writes or future allocation happens) - potential for oops if the percpu pages are reclaimed as the subsequent allocation isn't pinning the pages down - can lead to page->private pointers pointing to freed chunks Sebastian noticed that if this happens, none of the memory debugging facilities add additional information [1]. This patch aims to catch invalid free scenarios within valid chunks. To better guard free_percpu(), we can either add a magic number or some tracking facility to the percpu subsystem in a separate patch. The invalid free check in pcpu_free_area() validates that the allocation's starting bit is set in both alloc_map and bound_map. The alloc_map bit test ensures the area is allocated while the bound_map bit test checks we are freeing from the beginning of an allocation. We choose not to check the validity of the offset as that is encoded in page->private being a valid chunk. pcpu_stats_area_dealloc() is moved later to only be on the happy path so stats are only updated on valid frees. Link: https://lkml.kernel.org/r/20260123205535.35267-1-dennis@kernel.org Link: https://lore.kernel.org/lkml/20260119074813.ecAFsGaT@linutronix.de/ [1] Signed-off-by: Dennis Zhou Cc: Sebastian Andrzej Siewior Cc: Chistoph Lameter Cc: Christoph Lameter Cc: Dennis Zhou Cc: Tejun Heo Signed-off-by: Andrew Morton commit 46ba5a01180c6308abc8827f5e6b3d3d435d06b2 Author: Li Zhe Date: Thu Jan 22 11:50:02 2026 +0800 hugetlb: increase hugepage reservations when using node-specific "hugepages=" cmdline Commit 3dfd02c90037 ("hugetlb: increase number of reserving hugepages via cmdline") raised the number of hugepages that can be reserved through the boot-time "hugepages=" parameter for the non-node-specific case, but left the node-specific form of the same parameter unchanged. This patch extends the same optimization to node-specific reservations. When HugeTLB vmemmap optimization (HVO) is enabled and a node cannot satisfy the requested hugepages, the code first releases ordinary struct-page memory of hugepages obtained from the buddy allocator, allowing their struct-page memory to be reclaimed and reused for additional hugepage reservations on that node. This is particularly beneficial for configurations that require identical, large per-node hugepage reservations. On a four-node, 384 GB x86 VM, the patch raises the attainable 2 MiB hugepage reservation from under 374 GB to more than 379 GB. Link: https://lkml.kernel.org/r/20260122035002.79958-1-lizhe.67@bytedance.com Signed-off-by: Li Zhe Reviewed-by: Muchun Song Acked-by: Oscar Salvador Cc: David Hildenbrand Signed-off-by: Andrew Morton commit 292ded180bfa2d04b26789842296a83e809b31bb Author: Maninder Singh Date: Thu Jan 22 09:45:56 2026 +0530 kasan: remove unnecessary sync argument from start_report() commit 7ce0ea19d50e ("kasan: switch kunit tests to console tracepoints") removed use of sync variable, thus removing that extra argument also. Link: https://lkml.kernel.org/r/20260122041556.341868-1-maninder1.s@samsung.com Signed-off-by: Maninder Singh Acked-by: Andrey Ryabinin Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Dmitriy Vyukov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 57fdfd64238ee4ff9b2cf62d61714d94dd6ebc3d Author: zenghongling Date: Tue Jan 20 17:49:32 2026 +0800 mm/pagewalk: use min() to simplify the code Use the min() macro to simplify the function and improve its readability. [akpm@linux-foundation.org: add newline, per Lorenzo] Link: https://lkml.kernel.org/r/20260120094932.183697-1-zenghongling@kylinos.cn Signed-off-by: zenghongling Acked-by: David Hildenbrand (Red Hat) Cc: Hongling Zeng Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 17fd82c3abe03c1e202959bb1a7c4ab448b36bef Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:20 2026 +0000 mm/vma: add and use vma_assert_stabilised() Sometimes we wish to assert that a VMA is stable, that is - the VMA cannot be changed underneath us. This will be the case if EITHER the VMA lock or the mmap lock is held. In order to do so, we introduce a new assert vma_assert_stabilised() - this will make a lockdep assert if lockdep is enabled AND the VMA is read-locked. Currently lockdep tracking for VMA write locks is not implemented, so it suffices to check in this case that we have either an mmap read or write semaphore held. Note that because the VMA lock uses the non-standard vmlock_dep_map naming convention, we cannot use lockdep_assert_is_write_held() so have to open code this ourselves via lockdep-asserting that lock_is_held_type(&vma->vmlock_dep_map, 0). We have to be careful here - for instance when merging a VMA, we use the mmap write lock to stabilise the examination of adjacent VMAs which might be simultaneously VMA read-locked whilst being faulted in. If we were to assert VMA read lock using lockdep we would encounter an incorrect lockdep assert. Also, we have to be careful about asserting mmap locks are held - if we try to address the above issue by first checking whether mmap lock is held and if so asserting it via lockdep, we may find that we were raced by another thread acquiring an mmap read lock simultaneously that either we don't own (and thus can be released any time - so we are not stable) or was indeed released since we last checked. So to deal with these complexities we end up with either a precise (if lockdep is enabled) or imprecise (if not) approach - in the first instance we assert the lock is held using lockdep and thus whether we own it. If we do own it, then the check is complete, otherwise we must check for the VMA read lock being held (VMA write lock implies mmap write lock so the mmap lock suffices for this). If lockdep is not enabled we simply check if the mmap lock is held and risk a false negative (i.e. not asserting when we should do). There are a couple places in the kernel where we already do this stabliisation check - the anon_vma_name() helper in mm/madvise.c and vma_flag_set_atomic() in include/linux/mm.h, which we update to use vma_assert_stabilised(). This change abstracts these into vma_assert_stabilised(), uses lockdep if possible, and avoids a duplicate check of whether the mmap lock is held. This is also self-documenting and lays the foundations for further VMA stability checks in the code. The only functional change here is adding the lockdep check. Link: https://lkml.kernel.org/r/6c9e64bb2b56ddb6f806fde9237f8a00cb3a776b.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Cc: Boqun Feng Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Waiman Long Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 256c11937de0039253ee36ed7d1cabc852beae54 Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:19 2026 +0000 mm/vma: update vma_assert_locked() to use lockdep We can use lockdep to avoid unnecessary work here, otherwise update the code to logically evaluate all pertinent cases and share code with vma_assert_write_locked(). Make it clear here that we treat the VMA being detached at this point as a bug, this was only implicit before. Additionally, abstract references to vma->vmlock_dep_map by introducing a macro helper __vma_lockdep_map() which accesses this field if lockdep is enabled. Since lock_is_held() is specified as an extern function if lockdep is disabled, we can simply have __vma_lockdep_map() defined as NULL in this case, and then use IS_ENABLED(CONFIG_LOCKDEP) to avoid ugly ifdeffery. [lorenzo.stoakes@oracle.com: add helper macro __vma_lockdep_map(), per Vlastimil] Link: https://lkml.kernel.org/r/7c4b722e-604b-4b20-8e33-03d2f8d55407@lucifer.local Link: https://lkml.kernel.org/r/538762f079cc4fa76ff8bf30a8a9525a09961451.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Vlastimil Babka Cc: Boqun Feng Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Waiman Long Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 22f7639f2f030e58cb55ad8438c77dfcea951fc3 Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:18 2026 +0000 mm/vma: improve and document __is_vma_write_locked() We don't actually need to return an output parameter providing mm sequence number, rather we can separate that out into another function - __vma_raw_mm_seqnum() - and have any callers which need to obtain that invoke that instead. The access to the raw sequence number requires that we hold the exclusive mmap lock such that we know we can't race vma_end_write_all(), so move the assert to __vma_raw_mm_seqnum() to make this requirement clear. Also while we're here, convert all of the VM_BUG_ON_VMA()'s to VM_WARN_ON_ONCE_VMA()'s in line with the convention that we do not invoke oopses when we can avoid it. [lorenzo.stoakes@oracle.com: minor tweaks, per Vlastimil] Link: https://lkml.kernel.org/r/3fa89c13-232d-4eee-86cc-96caa75c2c67@lucifer.local Link: https://lkml.kernel.org/r/ef6c415c2d2c03f529dca124ccaed66bc2f60edc.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Cc: Boqun Feng Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Vlastimil Babka Cc: Waiman Long Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit e28e575af956c4c3089b443e87be91a6ff7af355 Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:17 2026 +0000 mm/vma: introduce helper struct + thread through exclusive lock fns It is confusing to have __vma_start_exclude_readers() return 0, 1 or an error (but only when waiting for readers in TASK_KILLABLE state), and having the return value be stored in a stack variable called 'locked' is further confusion. More generally, we are doing a lot of rather finnicky things during the acquisition of a state in which readers are excluded and moving out of this state, including tracking whether we are detached or not or whether an error occurred. We are implementing logic in __vma_start_exclude_readers() that effectively acts as if 'if one caller calls us do X, if another then do Y', which is very confusing from a control flow perspective. Introducing the shared helper object state helps us avoid this, as we can now handle the 'an error arose but we're detached' condition correctly in both callers - a warning if not detaching, and treating the situation as if no error arose in the case of a VMA detaching. This also acts to help document what's going on and allows us to add some more logical debug asserts. Also update vma_mark_detached() to add a guard clause for the likely 'already detached' state (given we hold the mmap write lock), and add a comment about ephemeral VMA read lock reference count increments to clarify why we are entering/exiting an exclusive locked state here. Finally, separate vma_mark_detached() into its fast-path component and make it inline, then place the slow path for excluding readers in mmap_lock.c. No functional change intended. [akpm@linux-foundation.org: fix function naming in comments, add comment per Vlastimil per Lorenzo] Link: https://lkml.kernel.org/r/7d3084d596c84da10dd374130a5055deba6439c0.1769198904.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/7d3084d596c84da10dd374130a5055deba6439c0.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Cc: Boqun Feng Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Vlastimil Babka Cc: Waiman Long Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 28f590f35da8435f75e2aee51431c6c1b8d91f54 Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:16 2026 +0000 mm/vma: clean up __vma_enter/exit_locked() These functions are very confusing indeed. 'Entering' a lock could be interpreted as acquiring it, but this is not what these functions are interacting with. Equally they don't indicate at all what kind of lock we are 'entering' or 'exiting'. Finally they are misleading as we invoke these functions when we already hold a write lock to detach a VMA. These functions are explicitly simply 'entering' and 'exiting' a state in which we hold the EXCLUSIVE lock in order that we can either mark the VMA as being write-locked, or mark the VMA detached. Rename the functions accordingly, and also update __vma_end_exclude_readers() to return detached state with a __must_check directive, as it is simply clumsy to pass an output pointer here to detached state and inconsistent vs. __vma_start_exclude_readers(). Finally, remove the unnecessary 'inline' directives. No functional change intended. Link: https://lkml.kernel.org/r/33273be9389712347d69987c408ca7436f0c1b22.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Cc: Boqun Feng Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Waiman Long Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit e5aeb75dc4049d92f6ad0da23cc6b22ffcbb9d39 Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:15 2026 +0000 mm/vma: de-duplicate __vma_enter_locked() error path We're doing precisely the same thing that __vma_exit_locked() does, so de-duplicate this code and keep the refcount primitive in one place. No functional change intended. Link: https://lkml.kernel.org/r/c9759b593f6a158e984fa87abe2c3cbd368ef825.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Vlastimil Babka Cc: Boqun Feng Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Waiman Long Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 1f2e7efc3ee9b32095d5a331d1f8672623f311bf Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:14 2026 +0000 mm/vma: add+use vma lockdep acquire/release defines The code is littered with inscrutable and duplicative lockdep incantations, replace these with defines which explain what is going on and add commentary to explain what we're doing. If lockdep is disabled these become no-ops. We must use defines so _RET_IP_ remains meaningful. These are self-documenting and aid readability of the code. Additionally, instead of using the confusing rwsem_*() form for something that is emphatically not an rwsem, we instead explicitly use lock_[acquired, release]_shared/exclusive() lockdep invocations since we are doing something rather custom here and these make more sense to use. No functional change intended. Link: https://lkml.kernel.org/r/fdae72441949ecf3b4a0ed3510da803e881bb153.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Vlastimil Babka Reviewed-by: Sebastian Andrzej Siewior Cc: Boqun Feng Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Waiman Long Signed-off-by: Andrew Morton commit 180355d4cfbd25f370e2e0912877a36aa350ff64 Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:13 2026 +0000 mm/vma: rename is_vma_write_only(), separate out shared refcount put The is_vma_writer_only() function is misnamed - this isn't determining if there is only a write lock, as it checks for the presence of the VM_REFCNT_EXCLUDE_READERS_FLAG. Really, it is checking to see whether readers are excluded, with a possibility of a false positive in the case of a detachment (there we expect the vma->vm_refcnt to eventually be set to VM_REFCNT_EXCLUDE_READERS_FLAG, whereas for an attached VMA we expect it to eventually be set to VM_REFCNT_EXCLUDE_READERS_FLAG + 1). Rename the function accordingly. Relatedly, we use a __refcount_dec_and_test() primitive directly in vma_refcount_put(), using the old value to determine what the reference count ought to be after the operation is complete (ignoring racing reference count adjustments). Wrap this into a __vma_refcount_put_return() function, which we can then utilise in vma_mark_detached() and thus keep the refcount primitive usage abstracted. This function, as the name implies, returns the value after the reference count has been updated. This reduces duplication in the two invocations of this function. Also adjust comments, removing duplicative comments covered elsewhere and adding more to aid understanding. No functional change intended. Link: https://lkml.kernel.org/r/32053580bff460eb1092ef780b526cefeb748bad.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Cc: Boqun Feng Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Waiman Long Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit ef4c0cea1e15dc6b1b5b9bb72fa4605b14f2125e Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:12 2026 +0000 mm/vma: document possible vma->vm_refcnt values and reference comment The possible vma->vm_refcnt values are confusing and vague, explain in detail what these can be in a comment describing the vma->vm_refcnt field and reference this comment in various places that read/write this field. No functional change intended. [akpm@linux-foundation.org: fix typo, per Suren] Link: https://lkml.kernel.org/r/d462e7678c6cc7461f94e5b26c776547d80a67e8.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Cc: Boqun Feng Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Waiman Long Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 25faccd69977d9a72739fd425040c2a1c2d67e46 Author: Lorenzo Stoakes Date: Fri Jan 23 20:12:11 2026 +0000 mm/vma: rename VMA_LOCK_OFFSET to VM_REFCNT_EXCLUDE_READERS_FLAG Patch series "mm: add and use vma_assert_stabilised() helper", v4. This series first introduces a series of refactorings, intended to significantly improve readability and abstraction of the code. Sometimes we wish to assert that a VMA is stable, that is - the VMA cannot be changed underneath us. This will be the case if EITHER the VMA lock or the mmap lock is held. We already open-code this in two places - anon_vma_name() in mm/madvise.c and vma_flag_set_atomic() in include/linux/mm.h. This series adds vma_assert_stablised() which abstract this can be used in these callsites instead. This implementation uses lockdep where possible - that is VMA read locks - which correctly track read lock acquisition/release via: vma_start_read() -> rwsem_acquire_read() vma_start_read_locked() -> vma_start_read_locked_nested() -> rwsem_acquire_read() And: vma_end_read() -> vma_refcount_put() -> rwsem_release() We don't track the VMA locks using lockdep for VMA write locks, however these are predicated upon mmap write locks whose lockdep state we do track, and additionally vma_assert_stabillised() asserts this check if VMA read lock is not held, so we get lockdep coverage in this case also. We also add extensive comments to describe what we're doing. There's some tricky stuff around mmap locking and stabilisation races that we have to be careful of that I describe in the patch introducing vma_assert_stabilised(). This change also lays the foundation for future series to add this assert in further places where we wish to make it clear that we rely upon a stabilised VMA. The motivation for this change was precisely this. This patch (of 10): The VMA_LOCK_OFFSET value encodes a flag which vma->vm_refcnt is set to in order to indicate that a VMA is in the process of having VMA read-locks excluded in __vma_enter_locked() (that is, first checking if there are any VMA read locks held, and if there are, waiting on them to be released). This happens when a VMA write lock is being established, or a VMA is being marked detached and discovers that the VMA reference count is elevated due to read-locks temporarily elevating the reference count only to discover a VMA write lock is in place. The naming does not convey any of this, so rename VMA_LOCK_OFFSET to VM_REFCNT_EXCLUDE_READERS_FLAG (with a sensible new prefix to differentiate from the newly introduced VMA_*_BIT flags). Also rename VMA_REF_LIMIT to VM_REFCNT_LIMIT to make this consistent also. Update comments to reflect this. No functional change intended. Link: https://lkml.kernel.org/r/817bd763e5fe35f23e01347996f9007e6eb88460.1769198904.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Vlastimil Babka Reviewed-by: Liam R. Howlett Cc: Boqun Feng Cc: Michal Hocko Cc: Mike Rapoport Cc: Shakeel Butt Cc: Waiman Long Cc: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton commit 4c8f08d9939efcac4b82f3a4b6ee0d800a3f2da2 Author: SeongJae Park Date: Sun Jan 18 10:02:59 2026 -0800 Docs/mm/damon/maintainer-profile: remove damon-tests/perf suggestion The DAMON performance tests [1] use PARSEC 3.0 as its major test workloads. But the official web site for PARSEC 3.0 has gone, so there is no easy way to get the benchmark. Mainly due to the fact, DAMON performance tests are difficult to run, and effectively broken. Do not request running it for now. Instead, suggest running any benchmarks or real world workloads that make sense for performance changes. [1] https://github.com/damonitor/damon-tests/tree/master/perf Link: https://lkml.kernel.org/r/20260118180305.70023-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b71e496f815a3bc6e8907a9b495e61e431631794 Author: SeongJae Park Date: Sun Jan 18 10:02:58 2026 -0800 Docs/mm/damon/maintainer-profile: fix wrong MAITNAINERS section name Commit 9044cbe50a70 ("MAINTAINERS: rename DAMON section") renamed the section for DAMON from "DATA ACCESS MONITOR" to "DAMON". But the commit forgot updating the name on the maintainer-profile document. Update. Link: https://lkml.kernel.org/r/20260118180305.70023-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 652fd06d20da688d6c37cb33efc38a249fce11a3 Author: SeongJae Park Date: Sun Jan 18 10:02:57 2026 -0800 Docs/admin-guide/mm/damon/usage: update stats update process for refresh_ms DAMOS stats on sysfs was only manually updated. Recent addition of 'refresh_ms' knob enabled periodic and automated updates of the stats. The document for stats update process is not updated for the change, however. Update. Link: https://lkml.kernel.org/r/20260118180305.70023-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e7df7a0bfc9090f83e9a2f40905bdfc58097330d Author: SeongJae Park Date: Sun Jan 18 10:02:56 2026 -0800 Docs/admin-guide/mm/damon/usage: introduce DAMON modules at the beginning DAMON usage document provides a list of available DAMON interfaces with brief introduction at the beginning of the doc. The list is missing DAMON modules for special purposes, while it is one of the major suggested interfaces. Add an item for those to the list. Link: https://lkml.kernel.org/r/20260118180305.70023-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 83cefa8d7e7a598d17cb0330d47db42486cf5bc7 Author: SeongJae Park Date: Sun Jan 18 10:02:55 2026 -0800 Docs/mm/damon/design: add reference to DAMON_STAT usage Design document's special-purpose DAMON modules section is providing the list of links to the usage documents of existing DAMON modules. It is missing the link for DAMON_STAT, though. Add the missed link. Link: https://lkml.kernel.org/r/20260118180305.70023-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 63464f5b850755c8f6d0896838778b2140c5896a Author: SeongJae Park Date: Sun Jan 18 10:02:54 2026 -0800 Docs/mm/damon/design: document DAMON sample modules People sometimes get confused about the purposes of DAMON special-purpose modules and sample modules. Clarify those on the design document by adding a section describing their existence and purposes. Link: https://lkml.kernel.org/r/20260118180305.70023-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit feb6241209b741b726d447da19c019ebc6235ef9 Author: SeongJae Park Date: Sun Jan 18 10:02:53 2026 -0800 Docs/mm/damon/design: link repology instead of Fedora package The document is introducing Fedora as one way to get DAMON user-space tool (damo) from OS-providing packaging system. Linux distros more than Fedora are providing damo with their packaging systems, though. Replace the Fedora part with the repology.org page that shows damo packaging status for multiple Linux distros. Link: https://lkml.kernel.org/r/20260118180305.70023-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 32d11b3208971e6ca29ff574dddf25f0d180aed8 Author: SeongJae Park Date: Sun Jan 18 10:02:52 2026 -0800 Docs/mm/damon/index: simplify the intro Patch series "Docs/mm/damon: update intro, modules, maintainer profile, and misc". Update DAMON documentations for wordsmithing, clarifications, and miscellaneous outdated things with eight patches. Patch 1 simplifies the brief introduction of DAMON. Patch 2 updates DAMON user-space tool packaged distros information on design doc to include not only Fedora, but refer to repology. Three following patches update design and usage documents for clarifying DAMON sample modules purposes (patch 3), and outdated information about usages of DAMON modules (patches 4 and 5). Final three patches update usage and maintainer-profile for sysfs refresh_ms feature behavior (patch 6), synchronize DAMON MAINTAINERS section name (patch 7), and broken damon-tests performance tests (patch 8). This patch (of 8): The intro is a bit verbose and redundant. Simplify it by replacing details with more links to the design docs, and refining the design points list. Link: https://lkml.kernel.org/r/20260118180305.70023-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260118180305.70023-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b94c317903ee5222c0b61ca3066ace3bddbac64c Author: Taeyang Kim Date: Sat Jan 17 19:14:28 2026 +0900 mm: update kernel-doc for __swap_cache_clear_shadow() The kernel-doc comment referred to swap_cache_clear_shadow(), but the actual function name is __swap_cache_clear_shadow(). Update the comment to match the function name. Link: https://lkml.kernel.org/r/20260117101428.113154-1-maainnewkin59@gmail.com Signed-off-by: Taeyang Kim Reviewed-by: Andrew Morton Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kairui Song Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit cc1db8dff8e751ec3ab352483de366b7f23aefe2 Author: SeongJae Park Date: Sat Jan 17 09:52:55 2026 -0800 mm/damon: rename min_sz_region of damon_ctx to min_region_sz 'min_sz_region' field of 'struct damon_ctx' represents the minimum size of each DAMON region for the context. 'struct damos_access_pattern' has a field of the same name. It confuses readers and makes 'grep' less optimal for them. Rename it to 'min_region_sz'. Link: https://lkml.kernel.org/r/20260117175256.82826-9-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit dfb1b0c9dc0d61e422905640e1e7334b3cf6f384 Author: SeongJae Park Date: Sat Jan 17 09:52:54 2026 -0800 mm/damon: rename DAMON_MIN_REGION to DAMON_MIN_REGION_SZ The macro is for the default minimum size of each DAMON region. There was a case that a reader was confused if it is the minimum number of total DAMON regions, which is set on damon_attrs->min_nr_regions. Make the name more explicit. Link: https://lkml.kernel.org/r/20260117175256.82826-8-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 52c5d3ee8a64ebbbd53f6090bb42ea268247a314 Author: SeongJae Park Date: Sat Jan 17 09:52:53 2026 -0800 mm/damon/core: rename damos_filter_out() to damos_core_filter_out() DAMOS filters are processed on the core layer and operations layer, depending on their types. damos_filter_out() in core.c, which is for only core layer handled filters, can confuse the fact. Rename it to damos_core_filter_out(), to be more explicit about the fact. Link: https://lkml.kernel.org/r/20260117175256.82826-7-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 177c8a272968b6bcdbcc8589a72e3eaa32f975d0 Author: SeongJae Park Date: Sat Jan 17 09:52:52 2026 -0800 mm/damon: document damon_call_control->dealloc_on_cancel repeat behavior damon_call_control->dealloc_on_cancel works only when ->repeat is true. But the behavior is not clearly documented. DAMON API callers can understand the behavior only after reading kdamond_call() code. Document the behavior on the kernel-doc comment of damon_call_control. Link: https://lkml.kernel.org/r/20260117175256.82826-6-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit ebc4734ad2219aaf76c497a6c94a98a2bcdaebc1 Author: SeongJae Park Date: Sat Jan 17 09:52:51 2026 -0800 mm/damon/core: process damon_call_control requests on a local list kdamond_call() handles damon_call() requests on the ->call_controls list of damon_ctx, which is shared with damon_call() callers. To protect the list from concurrent accesses while letting the callback function independent of the call_controls_lock, the function does complicated locking operations. For each damon_call_control object on the list, the function removes the control object from the list under locking, invoke the callback of the control object without locking, and then puts the control object back to the list if needed, under locking. It is complicated, and can contend the locks more frequently with other DAMON API caller threads as the number of concurrent callback requests increases. Contention overhead is not a big deal, but the increased race opportunity can make headaches. Simplify the locking sequence by moving all damon_call_control objects from the shared list to a local list at once under the single lock protection, processing the callback requests without locking, and adding back repeat mode controls to the shared list again at once again, again under the single lock protection. This change makes the number of locking in kdamond_call() be always two, regardless of the number of the queued requests. Link: https://lkml.kernel.org/r/20260117175256.82826-5-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 69714a74c19f5ae8b21e25558d62d893d48a3f18 Author: SeongJae Park Date: Sat Jan 17 09:52:50 2026 -0800 mm/damon/core: cancel damos_walk() before damon_ctx->kdamond reset damos_walk() request is canceled after damon_ctx->kdamond is reset. This can make weird situations where damon_is_running() returns false but the DAMON context has the damos_walk() request linked. There was a similar situation for damon_call() requests handling [1], which _was_ able to cause a racy use-after-free bug. Unlike the case of damon_call(), because damos_walk() is always synchronously handled and allows only single request at time, there is no such problematic race cases. But, keeping it as is could stem another subtle race condition bug in future. Avoid that by cancelling the requests before the ->kdamond reset. Note that this change also makes all damon_ctx dependent resource cleanups consistently done before the damon_ctx->kdamond reset. Link: https://lkml.kernel.org/r/20260117175256.82826-4-sj@kernel.org Link: https://lore.kernel.org/20251230014532.47563-1-sj@kernel.org [1] Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 1736047a4e9606f11e044431dfe61516e3a7600b Author: SeongJae Park Date: Sat Jan 17 09:52:49 2026 -0800 mm/damon/core: cleanup targets and regions at once on kdamond termination When kdamond terminates, it destroys the regions of the context first, and the targets of the context just before the kdamond main function returns. Because regions are linked inside targets, doing them separately is only inefficient and looks weird. A more serious problem is that the cleanup of the targets is done after damon_ctx->kdamond reset, which is the event that lets DAMON API callers know the kdamond is no longer actively running. That is, some DAMON targets could still exist while kdamond is not running. There are no real problems from this, but this implicit fact could cause subtle racy issues in future. Destroy targets and regions at one. Adding contexts on how the code has evolved in the way. Doing only regions destruction was because putting pids of the targets were done on DAMON API callers. Commit 7114bc5e01cf ("mm/damon/core: add cleanup_target() ops callback") moved the role to be done via operations set on each target destruction. Hence it removed the reason to do only regions cleanup. Commit 3a69f1635769 ("mm/damon/core: destroy targets when kdamond_fn() finish") therefore further destructed targets on kdamond termination time. It was still separated from regions destruction because damon_operations->cleanup() may do additional targets cleanup. Placing the targets destruction after damon_ctx->kdamond reset was just an unnecessary decision of the commit. The previous commit removed damon_operations->cleanup(), so there is no more reason to do destructions of regions and targets separately. Link: https://lkml.kernel.org/r/20260117175256.82826-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 50962b16c0d63725fa73f0a5b4b831f740cf7208 Author: SeongJae Park Date: Sat Jan 17 09:52:48 2026 -0800 mm/damon: remove damon_operations->cleanup() Patch series "mm/damon: cleanup kdamond, damon_call(), damos filter and DAMON_MIN_REGION". Do miscellaneous code cleanups for improving readability. First three patches cleanup kdamond termination process, by removing unused operation set cleanup callback (patch 1) and moving damon_ctx specific resource cleanups on kdamond termination to synchronization-easy place (patches 2 and 3). Next two patches touch damon_call() infrastructure, by refactoring kdamond_call() function to do less and simpler locking operations (patch 4), and documenting when dealloc_on_free does work (patch 5). Final three patches rename things for clear uses of those. Those rename damos_filter_out() to be more explicit about the fact that it is only for core-handled filters (patch 6), DAMON_MIN_REGION macro to be more explicit it is not about number of regions but size of each region (patch 7), and damon_ctx->min_sz_region to be different from damos_access_patern->min_sz_region (patch 8), so that those are not confusing and easy to grep. This patch (of 8): damon_operations->cleanup() was added for a case that an operation set implementation requires additional cleanups. But no such implementation exists at the moment. Remove it. Link: https://lkml.kernel.org/r/20260117175256.82826-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260117175256.82826-2-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 6f06f86a6f219037a7617e3044e1c2120798320e Author: SeongJae Park Date: Fri Jan 16 18:07:28 2026 -0800 selftests/damon/wss_estimation: deduplicate failed samples output When the test fails, it shows whole sampled working set size measurements. The purpose is showing the distribution of the measured values, to let the tester know if it was just intermittent failure. Multiple same values on the output are therefore unnecessary. It was not a big deal since the test was failing only once in the past. But the test can now fail multiple times with increased working set size, until it passes or the working set size reaches a limit. Hence the noisy output can be quite long and annoying. Print only the deduplicated distribution information. Link: https://lkml.kernel.org/r/20260117020731.226785-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 57525e596bdbf2cb125df8b45902530f219ba444 Author: SeongJae Park Date: Fri Jan 16 18:07:27 2026 -0800 selftests/damon/wss_estimation: ensure number of collected wss DAMON selftest for working set size estimation collects DAMON's working set size measurements of the running artificial memory access generator program until the program is finished. Depending on how quickly the program finishes, and how quickly DAMON starts, the number of collected working set size measurements may vary, and make the test results unreliable. Ensure it collects 40 measurements by using the repeat mode of the artificial memory access generator program, and finish the measurements only after the desired number of collections are made. Link: https://lkml.kernel.org/r/20260117020731.226785-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 514d1bcb58e0ef93fafa4f9c3035d604a4219867 Author: SeongJae Park Date: Fri Jan 16 18:07:26 2026 -0800 selftests/damon/access_memory: add repeat mode 'access_memory' is an artificial memory access generator program that is used for a few DAMON selftests. It accesses a given number of regions one by one only once, and exits. Depending on systems, the test workload may exit faster than expected, making the tests unreliable. For reliable control of the artificial memory access pattern, add a mode to make it repeat running. Link: https://lkml.kernel.org/r/20260117020731.226785-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 891d206e27dc1a684e460b079d2b53e17135d693 Author: SeongJae Park Date: Fri Jan 16 18:07:25 2026 -0800 selftests/damon/wss_estimation: test for up to 160 MiB working set size DAMON reads and writes Accessed bits of page tables without manual TLB flush for two reasons. First, it minimizes the overhead. Second, real systems that need DAMON are expected to be memory intensive enough to cause periodic TLB flushes. For test setups that use small test workloads, however, the system's TLB could be big enough to cover whole or most accesses of the test workload. In this case, no page table walk happens and DAMON cannot show any access from the test workload. The test workload for DAMON's working set size estimation selftest is such a case. It accesses only 10 MiB working set, and it turned out there are test setups that have TLBs large enough to cover the 10 MiB data accesses. As a result, the test fails depending on the test machine. Make it more reliable by trying larger working sets up to 160 MiB when it fails. Link: https://lkml.kernel.org/r/20260117020731.226785-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 94a62284ede0250e48c886416041ad65907ee917 Author: SeongJae Park Date: Fri Jan 16 18:07:24 2026 -0800 selftests/damon/sysfs_memcg_path_leak.sh: use kmemleak Patch series "selftests/damon: improve leak detection and wss estimation reliability". Two DAMON selftets, namely 'sysfs_memcg_leak' and 'sysfs_update_schemes_tried_regions_wss_estimation' frequently show intermittent failures due to their unreliable leak detection and working set size estimation. Make those more reliable. This patch (of 5): sysfs_memcg_path_leak.sh determines if the memory leak has happened by seeing if Slab size on /proc/meminfo increases more than expected after an action. Depending on the system and background workloads, the reasonable expectation varies. For the reason, the test frequently shows intermittent failures. Use kmemleak, which is much more reliable and correct, instead. Link: https://lkml.kernel.org/r/20260117020731.226785-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260117020731.226785-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit dd2c6ec24fca9235ccd1b9bfd382d0ddb419e41a Author: Lorenzo Stoakes Date: Fri Jan 16 13:20:53 2026 +0000 selftests/mm: remove virtual_address_range test This self test is asserting internal implementation details and is highly vulnerable to internal kernel changes as a result. It is currently failing locally from at least v6.17, and it seems that it may have been failing for longer in many configurations/hardware as it skips if e.g. CONFIG_ANON_VMA_NAME is not specified. With these skips and the fact that run_vmtests.sh won't run the tests in certain configurations it is likely we have simply missed this test being broken in CI for a long while. I have tried multiple versions of these tests and am unable to find a working bisect as previous versions of the test fail also. The tests are essentially mmap()'ing a series of mappings with no hint and asserting what the get_unmapped_area*() functions will come up with, with seemingly few checks for what other mappings may already be in place. It then appears to be mmap()'ing with a hint, and making a series of similar assertions about the internal implementation details of the hinting logic. Commit 0ef3783d7558 ("selftests/mm: add support to test 4PB VA on PPC64"), commit 3bd6137220bb ("selftests/mm: virtual_address_range: avoid reading from VM_IO mappings"), and especially commit a005145b9c96 ("selftests/mm: virtual_address_range: mmap() without PROT_WRITE") are good examples of the whack-a-mole nature of maintaining this test. The last commit there being particularly pertinent as it was accounting for an internal implementation detail change that really should have no bearing on self-tests, that is commit e93d2521b27f ("x86/vdso: Split virtual clock pages into dedicated mapping"). The purpose of the mm self-tests are to assert attributes about the API exposed to users, and to ensure that expectations are met. This test is emphatically not doing this, rather making a series of assumptions about internal implementation details and asserting them. It therefore, sadly, seems that the best course is to remove this test altogether. Link: https://lkml.kernel.org/r/20260116132053.857887-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: SeongJae Park Cc: David Hildenbrand Cc: Liam Howlett Cc: Mark Brown Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ae85e5610813c9904ea4a111bf47edd1940ebf63 Author: Kefeng Wang Date: Mon Jan 12 23:09:54 2026 +0800 mm: hugetlb_cma: mark hugetlb_cma{_only} as __ro_after_init hugetlb_cma and hugetlb_cma_only are initialized once during init and never changed. Link: https://lkml.kernel.org/r/20260112150954.1802953-6-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Zi Yan Acked-by: Muchun Song Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d925730734e9e936146b7ba691aa02f1b60f2c61 Author: Kefeng Wang Date: Mon Jan 12 23:09:53 2026 +0800 mm: hugetlb_cma: optimize hugetlb_cma_alloc_frozen_folio() Check hugetlb_cma_size which helps to avoid unnecessary gfp check or nodemask traversal. Link: https://lkml.kernel.org/r/20260112150954.1802953-5-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5a74b9f1dc3d75635ca8918e53664d5d2ee0fff5 Author: Kefeng Wang Date: Mon Jan 12 23:09:52 2026 +0800 mm: hugetlb: optimize replace_free_hugepage_folios() If no free hugepage folios are available, there is no need to perform any replacement operations. Additionally, gigantic folios should not be replaced under any circumstances. Therefore, we only check for the presence of non-gigantic folios, also adding the gigantic folio check to avoid accidental replacement. To optimize performance, we skip unnecessary iterations over pfn for compound pages and high-order buddy pages to save processing time. A simple test on machine with 114G free memory, allocate 120 * 1G HugeTLB folios(104 successfully returned), time echo 120 > /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages Before: 0m0.602s After: 0m0.431s [wangkefeng.wang@huawei.com: v2] Link: https://lkml.kernel.org/r/20260114135512.2159799-1-wangkefeng.wang@huawei.com [akpm@linux-foundation.org: use single-return-point style, tweak comment] Link: https://lkml.kernel.org/r/20260112150954.1802953-4-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 9a8e0c31b3121df8ed193437b59969adabc7e721 Author: Kefeng Wang Date: Mon Jan 12 23:09:51 2026 +0800 mm: page_alloc: optimize pfn_range_valid_contig() The alloc_contig_pages() spends a significant amount of time within pfn_range_valid_contig(). - set_max_huge_pages - 99.98% alloc_pool_huge_folio only_alloc_fresh_hugetlb_folio.isra.0 - alloc_contig_frozen_pages_noprof - 87.00% pfn_range_valid_contig pfn_to_online_page - 12.91% alloc_contig_frozen_range_noprof 4.51% replace_free_hugepage_folios - 4.02% prep_new_page prep_compound_page - 2.98% undo_isolate_page_range - 2.79% unset_migratetype_isolate - 2.75% __move_freepages_block_isolate 2.71% __move_freepages_block - 0.98% start_isolate_page_range 0.66% set_migratetype_isolate To optimize this process, use the new helper page_is_unmovable() to avoid more unnecessary iterations for compound pages, such as THP not on LRU, and high-order buddy pages, which significantly improving the efficiency of contiguous memory allocation. A simple test on machine with 114G free memory, allocate 120 * 1G HugeTLB folios(104 successfully returned), time echo 120 > /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages Before: 0m3.605s After: 0m0.602s Link: https://lkml.kernel.org/r/20260112150954.1802953-3-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: Oscar Salvador Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Sidhartha Kumar Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit c83109e95c9d78e41b39e65b6490e511f4b8fba2 Author: Kefeng Wang Date: Mon Jan 12 23:09:50 2026 +0800 mm: page_isolation: introduce page_is_unmovable() Patch series "mm: accelerate gigantic folio allocation". Optimize pfn_range_valid_contig() and replace_free_hugepage_folios() in alloc_contig_frozen_pages() to speed up gigantic folio allocation. The allocation time for 120*1G folios drops from 3.605s to 0.431s. This patch (of 5): Factor out the check if a page is unmovable into a new helper, and will be reused in the following patch. No functional change intended, the minor changes are as follows, 1) Avoid unnecessary calls by checking CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION 2) Directly call PageCompound since PageTransCompound may be dropped 3) Using folio_test_hugetlb() Link: https://lkml.kernel.org/r/20260112150954.1802953-1-wangkefeng.wang@huawei.com Link: https://lkml.kernel.org/r/20260112150954.1802953-2-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: Zi Yan Reviewed-by: Oscar Salvador Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Sidhartha Kumar Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit fde8353121aa304ee88542f011dd5dc83ced47e4 Author: Kevin Brodsky Date: Thu Jan 22 17:02:24 2026 +0000 selftests/mm: report SKIP in pfnmap if a check fails pfnmap currently checks the target file in FIXTURE_SETUP(pfnmap), meaning once for every test, and skips the test if any check fails. The target file is the same for every test so this is a little overkill. More importantly, this approach means that the whole suite will report PASS even if all the tests are skipped because kernel configuration (e.g. CONFIG_STRICT_DEVMEM=y) prevented /dev/mem from being mapped, for instance. Let's ensure that KSFT_SKIP is returned as exit code if any check fails by performing the checks in pfnmap_init(), run once. That function also takes care of finding the offset of the pages to be mapped and saves it in a global. The file is now opened only once and the fd saved in a global, but it is still mapped/unmapped for every test, as some of them modify the mapping. Link: https://lkml.kernel.org/r/20260122170224.4056513-10-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Jason Gunthorpe Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Paolo Abeni Cc: Ryan Roberts Cc: SeongJae Park Cc: Shuah Khan Cc: Usama Anjum Cc: wang lian Cc: Yunsheng Lin Signed-off-by: Andrew Morton commit 148e5879532f835118e00c3040acef077b57721a Author: Kevin Brodsky Date: Thu Jan 22 17:02:23 2026 +0000 selftests/mm: fix exit code in pagemap_ioctl Make sure pagemap_ioctl exits with an appropriate value: * If the tests are run, call ksft_finished() to report the right status instead of reporting PASS unconditionally. * Report SKIP if userfaultfd isn't available (in line with other tests) * Report FAIL if we failed to open /proc/self/pagemap, as this file has been added a long time ago and doesn't depend on any CONFIG option (returning -EINVAL from main() is meaningless) Link: https://lkml.kernel.org/r/20260122170224.4056513-9-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Reviewed-by: Ryan Roberts Reviewed-by: Mark Brown Acked-by: David Hildenbrand (Red Hat) Acked-by: SeongJae Park Reviewed-by: wang lian Reviewed-by: Dev Jain Cc: Usama Anjum Cc: Jason Gunthorpe Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Paolo Abeni Cc: Shuah Khan Cc: Yunsheng Lin Signed-off-by: Andrew Morton commit 7e938f00b00319510ae097e20b7487dfa578d53f Author: Kevin Brodsky Date: Thu Jan 22 17:02:22 2026 +0000 selftests/mm: fix faulting-in code in pagemap_ioctl test One of the pagemap_ioctl tests attempts to fault in pages by memcpy()'ing them to an unused buffer. This probably worked originally, but since commit 46036188ea1f ("selftests/mm: build with -O2") the compiler is free to optimise away that unused buffer and the memcpy() with it. As a result there might not be any resident page in the mapping and the test may fail. We don't need to copy all that memory anyway. Just fault in every page. While at it also make sure to compute the number of pages once using simple integer arithmetic instead of ceilf() and implicit conversions. Link: https://lkml.kernel.org/r/20260122170224.4056513-8-kevin.brodsky@arm.com Fixes: 46036188ea1f ("selftests/mm: build with -O2") Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Dev Jain Reviewed-by: Muhammad Usama Anjum Cc: Jason Gunthorpe Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Paolo Abeni Cc: Ryan Roberts Cc: SeongJae Park Cc: Shuah Khan Cc: wang lian Cc: Yunsheng Lin Signed-off-by: Andrew Morton commit dd2b4e04c09808ff921e3460a608537d1a94595d Author: Kevin Brodsky Date: Thu Jan 22 17:02:21 2026 +0000 selftests/mm: introduce helper to read every page FORCE_READ(*addr) ensures that the compiler will emit a load from addr. Several tests need to trigger such a load for a range of pages, ensuring that every page is faulted in, if it wasn't already. Introduce a new helper force_read_pages() that does exactly that and replace existing loops with a call to it. The step size (regular/huge page size) is preserved for all loops, except in split_huge_page_test. Reading every byte is unnecessary; we now read every huge page, matching the following call to check_huge_file(). Link: https://lkml.kernel.org/r/20260122170224.4056513-7-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Reviewed-by: Dev Jain Reviewed-by: Muhammad Usama Anjum Acked-by: David Hildenbrand (Red Hat) Cc: Jason Gunthorpe Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Paolo Abeni Cc: Ryan Roberts Cc: SeongJae Park Cc: Shuah Khan Cc: wang lian Cc: Yunsheng Lin Signed-off-by: Andrew Morton commit 20d3fac43608a1d7ef71991935abc4456baa1da7 Author: Kevin Brodsky Date: Thu Jan 22 17:02:20 2026 +0000 selftests/mm: check that FORCE_READ() succeeded Many cow tests rely on FORCE_READ() to populate pages. Introduce a helper to make sure that the pages are actually populated, and fail otherwise. Link: https://lkml.kernel.org/r/20260122170224.4056513-6-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Suggested-by: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Jason Gunthorpe Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Paolo Abeni Cc: Ryan Roberts Cc: SeongJae Park Cc: Shuah Khan Cc: Usama Anjum Cc: wang lian Cc: Yunsheng Lin Signed-off-by: Andrew Morton commit bce1dabd310e87fefe0645fec9ba98b84d37e418 Author: Kevin Brodsky Date: Thu Jan 22 17:02:19 2026 +0000 selftests/mm: fix usage of FORCE_READ() in cow tests Commit 5bbc2b785e63 ("selftests/mm: fix FORCE_READ to read input value correctly") modified FORCE_READ() to take a value instead of a pointer. It also changed most of the call sites accordingly, but missed many of them in cow.c. In those cases, we ended up with the pointer itself being read, not the memory it points to. No failure occurred as a result, so it looks like the tests work just fine without faulting in. However, the huge_zeropage tests explicitly check that pages are populated, so those became skipped. Convert all the remaining FORCE_READ() to fault in the mapped page, as was originally intended. This allows the huge_zeropage tests to run again (3 tests in total). Link: https://lkml.kernel.org/r/20260122170224.4056513-5-kevin.brodsky@arm.com Fixes: 5bbc2b785e63 ("selftests/mm: fix FORCE_READ to read input value correctly") Signed-off-by: Kevin Brodsky Acked-by: SeongJae Park Reviewed-by: wang lian Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Dev Jain Cc: Jason Gunthorpe Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Paolo Abeni Cc: Ryan Roberts Cc: Shuah Khan Cc: Usama Anjum Cc: Yunsheng Lin Signed-off-by: Andrew Morton commit 7f532d19c8be76ad2fcd7ab6b0c9eb618f70966b Author: Kevin Brodsky Date: Thu Jan 22 17:02:18 2026 +0000 selftests/mm: pass down full CC and CFLAGS to check_config.sh check_config.sh checks that liburing is available by running the compiler provided as its first argument. This makes two assumptions: 1. CC consists of only one word 2. No extra flag is required Unfortunately, there are many situations where these assumptions don't hold. For instance: - When using Clang, CC consists of multiple words - When cross-compiling, extra flags may be required to allow the compiler to find headers Remove these assumptions by passing down CC and CFLAGS as-is from the Makefile, so that the same command line is used as when actually building the tests. Link: https://lkml.kernel.org/r/20260122170224.4056513-4-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Reviewed-by: Mark Brown Acked-by: David Hildenbrand (Red Hat) Cc: Jason Gunthorpe Cc: John Hubbard Cc: Dev Jain Cc: Lorenzo Stoakes Cc: Paolo Abeni Cc: Ryan Roberts Cc: SeongJae Park Cc: Shuah Khan Cc: Usama Anjum Cc: wang lian Cc: Yunsheng Lin Signed-off-by: Andrew Morton commit 1821be740d2e9329805cafa368e476064fde0789 Author: Kevin Brodsky Date: Thu Jan 22 17:02:17 2026 +0000 selftests/mm: remove flaky header check Commit 96ed62ea0298 ("mm: page_frag: fix a compile error when kernel is not compiled") introduced a check to avoid attempting to build the page_frag module if is missing. Unfortunately this check only works if KDIR points to /lib/modules/... or an in-tree kernel build. It always fails if KDIR points to an out-of-tree build (i.e. when the kernel was built with O=... make) because only generated headers are present under $KDIR/include/ in that case. A recent commit switched KDIR to default to the kernel's build directory, so that check is no longer justified. Link: https://lkml.kernel.org/r/20260122170224.4056513-3-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Reviewed-by: Mark Brown Cc: Paolo Abeni Cc: Yunsheng Lin Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Ryan Roberts Cc: SeongJae Park Cc: Shuah Khan Cc: Usama Anjum Cc: wang lian Signed-off-by: Andrew Morton commit 4ac76c51709dff01b285a2d8afea80ca7ae66d28 Author: Kevin Brodsky Date: Thu Jan 22 17:02:16 2026 +0000 selftests/mm: default KDIR to build directory Patch series "Various mm kselftests improvements/fixes", v3. Various improvements/fixes for the mm kselftests: - Patch 1-3 extend support for more build configurations: out-of-tree $KDIR, cross-compilation, etc. - Patch 4-7 fix issues related to faulting in pages, introducing a new helper for that purpose. - Patch 8 fixes the value returned by pagemap_ioctl (PASS was always returned, which explains why the issue fixed in patch 6 went unnoticed). - Patch 9 improves the exit code of pfnmap. Net results: - 1 test no longer fails (patch 7) - 3 tests are no longer skipped (patch 4) - More accurate return values for whole suites (patch 8, 9) - Extra tests are more likely to be built (patch 1-3) This patch (of 9): KDIR currently defaults to the running kernel's modules directory when building the page_frag module. The underlying assumption is that most users build the kselftests in order to run them against the system they're built on. This assumption seems questionable, and there is no guarantee that the module can actually be built against the running kernel. Switch the default value of KDIR to the kernel's build directory, i.e. $(O) if O= or KBUILD_OUTPUT= is used, and the source directory otherwise. This seems like the least surprising option: the test module is built against the kernel that has been previously built. Note: we can't use $(top_srcdir) in mm/Makefile because it is only defined once lib.mk is included. Link: https://lkml.kernel.org/r/20260122170224.4056513-1-kevin.brodsky@arm.com Link: https://lkml.kernel.org/r/20260122170224.4056513-2-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Cc: David Hildenbrand Cc: Dev Jain Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Ryan Roberts Cc: Shuah Khan Cc: Jason Gunthorpe Cc: John Hubbard Cc: Paolo Abeni Cc: SeongJae Park Cc: Usama Anjum Cc: wang lian Cc: Yunsheng Lin Signed-off-by: Andrew Morton commit 3a64d5b82eccc0dc629d43cde791a2c19bd67dfc Author: Kevin Brodsky Date: Thu Dec 18 10:05:40 2025 +0000 sparc/mm: export symbols for lazy_mmu_mode KUnit tests The lazy_mmu_mode KUnit tests call lazy_mmu_mode_{enable,disable}. These tests may be built as a module, and because of inlining this means that arch_{enter,flush,leave}_lazy_mmu_mode need to be exported. [akpm@linux-foundation.org: remove mm/tests/lazy_mmu_mode_kunit.c comment, per Kevin] Link: https://lkml.kernel.org/r/20251218100541.2667405-1-kevin.brodsky@arm.com Fixes: ee628d9cc8d5 ("mm: add basic tests for lazy_mmu") Signed-off-by: Kevin Brodsky Acked-by: Andreas Larsson Signed-off-by: Andrew Morton commit ed0a826ce3025832c8d8b79924fd638f75b62bb7 Author: Marco Crivellari Date: Tue Jan 13 12:46:30 2026 +0100 mm: add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn't explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. [akpm@linux-foundation.org: fix mm/slub.c] [akpm@linux-foundation.org: fix kmem_cache_init_late() properly, per Sebastian] Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://lkml.kernel.org/r/20260113114630.152942-4-marco.crivellari@suse.com Signed-off-by: Marco Crivellari Suggested-by: Tejun Heo Reviewed-by: Sebastian Andrzej Siewior Reviewed-by: Frederic Weisbecker Cc: Alexander Potapenko Cc: David Hildenbrand Cc: Dmitry Vyukov Cc: Johannes Weiner Cc: Lai jiangshan Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Marco Elver Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 73b2162126ff0b811929f700cec9475622c9cb11 Author: Marco Crivellari Date: Tue Jan 13 12:46:29 2026 +0100 mm: replace use of system_wq with system_percpu_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://lkml.kernel.org/r/20260113114630.152942-3-marco.crivellari@suse.com Signed-off-by: Marco Crivellari Suggested-by: Tejun Heo Reviewed-by: Sebastian Andrzej Siewior Reviewed-by: Frederic Weisbecker Cc: Alexander Potapenko Cc: David Hildenbrand Cc: Dmitry Vyukov Cc: Johannes Weiner Cc: Lai jiangshan Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Marco Elver Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0bcbd7cf6596826cfb0ca653f47fb9e9410b3f2e Author: Marco Crivellari Date: Tue Jan 13 12:46:28 2026 +0100 mm: replace use of system_unbound_wq with system_dfl_wq Patch series "Replace wq users and add WQ_PERCPU to alloc_workqueue() users", v2. This series continues the effort to refactor the Workqueue API. No behavior changes are introduced by this series. === Recent changes to the WQ API === The following, address the recent changes in the Workqueue API: - commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") - commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The old workqueues will be removed in a future release cycle and unbound will become the implicit default. === Introduced Changes by this series === 1) [P 1-2] Replace use of system_wq and system_unbound_wq Workqueue users converted to the better named new workqueues: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. 2) [P 3] add WQ_PERCPU to remaining alloc_workqueue() users With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. WQ_UNBOUND will be removed in future. For more information: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ This patch (of 3): This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Link: https://lkml.kernel.org/r/20260113114630.152942-1-marco.crivellari@suse.com Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://lkml.kernel.org/r/20260113114630.152942-2-marco.crivellari@suse.com Signed-off-by: Marco Crivellari Suggested-by: Tejun Heo Reviewed-by: Sebastian Andrzej Siewior Reviewed-by: Frederic Weisbecker Cc: Alexander Potapenko Cc: David Hildenbrand Cc: Dmitry Vyukov Cc: Johannes Weiner Cc: Lai jiangshan Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Marco Elver Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 824b8c96c421e677cf0fe6f69939ff0082665a34 Author: Joshua Hahn Date: Fri Jan 16 14:27:16 2026 -0500 mm/hugetlb: enforce brace style Documentation/process/coding-style.rst explicitly notes that if only one branch of a conditional statement is a single statement, braces should be used in both branches. Enforce this in mm/hugetlb.c. While add it, fix the indentation for vma_end_reservation. No functional change intended. Link: https://lkml.kernel.org/r/20260116192717.1600049-2-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn Acked-by: David Hildenbrand (Red Hat) Reviewed-by: SeongJae Park Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit a1c655f554441561bf4b256dc75d977a1433753c Author: Joshua Hahn Date: Fri Jan 16 14:27:15 2026 -0500 mm/hugetlb: remove unnecessary if condition if (map_chg) is always true, since it is nested in another if statement which checks for map_chg == MAP_CHG_NEEDED, which is equal to 1. if (unlikely(map_chg == MAP_CHG_NEEDED && retval == 0)) { ... if (map_chg) { ... } } Remove the check, un-indent, and collapse the function call for readability. No functional change intended. Link: https://lkml.kernel.org/r/20260116192717.1600049-1-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn Acked-by: David Hildenbrand (Red Hat) Reviewed-by: SeongJae Park Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 94350fe6cad77b46c3dcb8c96543bef7647efbc0 Author: William Tambe Date: Thu Dec 11 12:38:19 2025 -0800 mm/highmem: fix __kmap_to_page() build error This changes fixes following build error which is a miss from ef6e06b2ef87 ("highmem: fix kmap_to_page() for kmap_local_page() addresses"). mm/highmem.c:184:66: error: 'pteval' undeclared (first use in this function); did you mean 'pte_val'? 184 | idx = arch_kmap_local_map_idx(i, pte_pfn(pteval)); In __kmap_to_page(), pteval is used but does not exist in the function. (akpm: affects xtensa only) Link: https://lkml.kernel.org/r/SJ0PR07MB86317E00EC0C59DA60935FDCD18DA@SJ0PR07MB8631.namprd07.prod.outlook.com Fixes: ef6e06b2ef87 ("highmem: fix kmap_to_page() for kmap_local_page() addresses") Signed-off-by: William Tambe Reviewed-by: Max Filippov Cc: Chris Zankel Cc: Max Filippov Cc: Signed-off-by: Andrew Morton commit a45088376d8a847a5e3b1982fcfceb41644e3b1d Author: Jiayuan Chen Date: Tue Jan 20 10:43:49 2026 +0800 mm/vmscan: add tracepoint and reason for kswapd_failures reset Currently, kswapd_failures is reset in multiple places (kswapd, direct reclaim, PCP freeing, memory-tiers), but there's no way to trace when and why it was reset, making it difficult to debug memory reclaim issues. This patch: 1. Introduce kswapd_clear_hopeless() as a wrapper function to centralize kswapd_failures reset logic. 2. Introduce kswapd_test_hopeless() to encapsulate hopeless node checks, replacing all open-coded kswapd_failures comparisons. 3. Add kswapd_clear_hopeless_reason enum to distinguish reset sources: - KSWAPD_CLEAR_HOPELESS_KSWAPD: reset from kswapd context - KSWAPD_CLEAR_HOPELESS_DIRECT: reset from direct reclaim - KSWAPD_CLEAR_HOPELESS_PCP: reset from PCP page freeing - KSWAPD_CLEAR_HOPELESS_OTHER: reset from other paths 4. Add tracepoints for better observability: - mm_vmscan_kswapd_clear_hopeless: traces each reset with reason - mm_vmscan_kswapd_reclaim_fail: traces each kswapd reclaim failure Test results: $ trace-cmd record -e vmscan:mm_vmscan_kswapd_clear_hopeless -e vmscan:mm_vmscan_kswapd_reclaim_fail $ # generate memory pressure $ trace-cmd report cpus=4 kswapd0-71 [000] 27.216563: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=1 kswapd0-71 [000] 27.217169: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=2 kswapd0-71 [000] 27.217764: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=3 kswapd0-71 [000] 27.218353: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=4 kswapd0-71 [000] 27.218993: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=5 kswapd0-71 [000] 27.219744: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=6 kswapd0-71 [000] 27.220488: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=7 kswapd0-71 [000] 27.221206: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=8 kswapd0-71 [000] 27.221806: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=9 kswapd0-71 [000] 27.222634: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=10 kswapd0-71 [000] 27.223286: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=11 kswapd0-71 [000] 27.223894: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=12 kswapd0-71 [000] 27.224712: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=13 kswapd0-71 [000] 27.225424: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=14 kswapd0-71 [000] 27.226082: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=15 kswapd0-71 [000] 27.226810: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=16 kswapd1-72 [002] 27.386869: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=1 kswapd1-72 [002] 27.387435: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=2 kswapd1-72 [002] 27.388016: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=3 kswapd1-72 [002] 27.388586: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=4 kswapd1-72 [002] 27.389155: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=5 kswapd1-72 [002] 27.389723: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=6 kswapd1-72 [002] 27.390292: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=7 kswapd1-72 [002] 27.392364: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=8 kswapd1-72 [002] 27.392934: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=9 kswapd1-72 [002] 27.393504: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=10 kswapd1-72 [002] 27.394073: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=11 kswapd1-72 [002] 27.394899: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=12 kswapd1-72 [002] 27.395472: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=13 kswapd1-72 [002] 27.396055: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=14 kswapd1-72 [002] 27.396628: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=15 kswapd1-72 [002] 27.397199: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=16 kworker/u18:0-40 [002] 27.410151: mm_vmscan_kswapd_clear_hopeless: nid=0 reason=DIRECT kswapd0-71 [000] 27.439454: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=1 kswapd0-71 [000] 27.440048: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=2 kswapd0-71 [000] 27.440634: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=3 kswapd0-71 [000] 27.441211: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=4 kswapd0-71 [000] 27.441787: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=5 kswapd0-71 [000] 27.442363: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=6 kswapd0-71 [000] 27.443030: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=7 kswapd0-71 [000] 27.443725: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=8 kswapd0-71 [000] 27.444315: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=9 kswapd0-71 [000] 27.444898: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=10 kswapd0-71 [000] 27.445476: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=11 kswapd0-71 [000] 27.446053: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=12 kswapd0-71 [000] 27.446646: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=13 kswapd0-71 [000] 27.447230: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=14 kswapd0-71 [000] 27.447812: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=15 kswapd0-71 [000] 27.448391: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=16 ann-423 [003] 28.028285: mm_vmscan_kswapd_clear_hopeless: nid=0 reason=PCP Link: https://lkml.kernel.org/r/20260120024402.387576-3-jiayuan.chen@linux.dev Signed-off-by: Jiayuan Chen Signed-off-by: Jiayuan Chen Acked-by: Shakeel Butt Suggested-by: Johannes Weiner Reviewed-by: Steven Rostedt (Google) [tracing] Cc: Axel Rasmussen Cc: Brendan Jackman Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit dc9fe9b7056a44ad65715def880e7d91d32c047f Author: Jiayuan Chen Date: Tue Jan 20 10:43:48 2026 +0800 mm/vmscan: mitigate spurious kswapd_failures reset from direct reclaim Patch series "mm/vmscan: add tracepoint and reason for kswapd_failures reset", v4. Currently, kswapd_failures is reset in multiple places (kswapd, direct reclaim, PCP freeing, memory-tiers), but there's no way to trace when and why it was reset, making it difficult to debug memory reclaim issues. This patch: 1. Introduce kswapd_clear_hopeless() as a wrapper function to centralize kswapd_failures reset logic. 2. Introduce kswapd_test_hopeless() to encapsulate hopeless node checks, replacing all open-coded kswapd_failures comparisons. 3. Add kswapd_clear_hopeless_reason enum to distinguish reset sources: - KSWAPD_CLEAR_HOPELESS_KSWAPD: reset from kswapd context - KSWAPD_CLEAR_HOPELESS_DIRECT: reset from direct reclaim - KSWAPD_CLEAR_HOPELESS_PCP: reset from PCP page freeing - KSWAPD_CLEAR_HOPELESS_OTHER: reset from other paths 4. Add tracepoints for better observability: - mm_vmscan_kswapd_clear_hopeless: traces each reset with reason - mm_vmscan_kswapd_reclaim_fail: traces each kswapd reclaim failure Test results: $ trace-cmd record -e vmscan:mm_vmscan_kswapd_clear_hopeless -e vmscan:mm_vmscan_kswapd_reclaim_fail $ # generate memory pressure $ trace-cmd report cpus=4 kswapd0-71 [000] 27.216563: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=1 kswapd0-71 [000] 27.217169: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=2 kswapd0-71 [000] 27.217764: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=3 kswapd0-71 [000] 27.218353: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=4 kswapd0-71 [000] 27.218993: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=5 kswapd0-71 [000] 27.219744: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=6 kswapd0-71 [000] 27.220488: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=7 kswapd0-71 [000] 27.221206: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=8 kswapd0-71 [000] 27.221806: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=9 kswapd0-71 [000] 27.222634: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=10 kswapd0-71 [000] 27.223286: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=11 kswapd0-71 [000] 27.223894: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=12 kswapd0-71 [000] 27.224712: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=13 kswapd0-71 [000] 27.225424: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=14 kswapd0-71 [000] 27.226082: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=15 kswapd0-71 [000] 27.226810: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=16 kswapd1-72 [002] 27.386869: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=1 kswapd1-72 [002] 27.387435: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=2 kswapd1-72 [002] 27.388016: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=3 kswapd1-72 [002] 27.388586: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=4 kswapd1-72 [002] 27.389155: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=5 kswapd1-72 [002] 27.389723: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=6 kswapd1-72 [002] 27.390292: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=7 kswapd1-72 [002] 27.392364: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=8 kswapd1-72 [002] 27.392934: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=9 kswapd1-72 [002] 27.393504: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=10 kswapd1-72 [002] 27.394073: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=11 kswapd1-72 [002] 27.394899: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=12 kswapd1-72 [002] 27.395472: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=13 kswapd1-72 [002] 27.396055: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=14 kswapd1-72 [002] 27.396628: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=15 kswapd1-72 [002] 27.397199: mm_vmscan_kswapd_reclaim_fail: nid=1 failures=16 kworker/u18:0-40 [002] 27.410151: mm_vmscan_kswapd_clear_hopeless: nid=0 reason=DIRECT kswapd0-71 [000] 27.439454: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=1 kswapd0-71 [000] 27.440048: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=2 kswapd0-71 [000] 27.440634: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=3 kswapd0-71 [000] 27.441211: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=4 kswapd0-71 [000] 27.441787: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=5 kswapd0-71 [000] 27.442363: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=6 kswapd0-71 [000] 27.443030: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=7 kswapd0-71 [000] 27.443725: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=8 kswapd0-71 [000] 27.444315: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=9 kswapd0-71 [000] 27.444898: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=10 kswapd0-71 [000] 27.445476: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=11 kswapd0-71 [000] 27.446053: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=12 kswapd0-71 [000] 27.446646: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=13 kswapd0-71 [000] 27.447230: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=14 kswapd0-71 [000] 27.447812: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=15 kswapd0-71 [000] 27.448391: mm_vmscan_kswapd_reclaim_fail: nid=0 failures=16 ann-423 [003] 28.028285: mm_vmscan_kswapd_clear_hopeless: nid=0 reason=PCP This patch (of 2): When kswapd fails to reclaim memory, kswapd_failures is incremented. Once it reaches MAX_RECLAIM_RETRIES, kswapd stops running to avoid futile reclaim attempts. However, any successful direct reclaim unconditionally resets kswapd_failures to 0, which can cause problems. We observed an issue in production on a multi-NUMA system where a process allocated large amounts of anonymous pages on a single NUMA node, causing its watermark to drop below high and evicting most file pages: $ numastat -m Per-node system memory usage (in MBs): Node 0 Node 1 Total --------------- --------------- --------------- MemTotal 128222.19 127983.91 256206.11 MemFree 1414.48 1432.80 2847.29 MemUsed 126807.71 126551.11 252358.82 SwapCached 0.00 0.00 0.00 Active 29017.91 25554.57 54572.48 Inactive 92749.06 95377.00 188126.06 Active(anon) 28998.96 23356.47 52355.43 Inactive(anon) 92685.27 87466.11 180151.39 Active(file) 18.95 2198.10 2217.05 Inactive(file) 63.79 7910.89 7974.68 With swap disabled, only file pages can be reclaimed. When kswapd is woken (e.g., via wake_all_kswapds()), it runs continuously but cannot raise free memory above the high watermark since reclaimable file pages are insufficient. Normally, kswapd would eventually stop after kswapd_failures reaches MAX_RECLAIM_RETRIES. However, containers on this machine have memory.high set in their cgroup. Business processes continuously trigger the high limit, causing frequent direct reclaim that keeps resetting kswapd_failures to 0. This prevents kswapd from ever stopping. The key insight is that direct reclaim triggered by cgroup memory.high performs aggressive scanning to throttle the allocating process. With sufficiently aggressive scanning, even hot pages will eventually be reclaimed, making direct reclaim "successful" at freeing some memory. However, this success does not mean the node has reached a balanced state - the freed memory may still be insufficient to bring free pages above the high watermark. Unconditionally resetting kswapd_failures in this case keeps kswapd alive indefinitely. The result is that kswapd runs endlessly. Unlike direct reclaim which only reclaims from the allocating cgroup, kswapd scans the entire node's memory. This causes hot file pages from all workloads on the node to be evicted, not just those from the cgroup triggering memory.high. These pages constantly refault, generating sustained heavy IO READ pressure across the entire system. Fix this by only resetting kswapd_failures when the node is actually balanced. This allows both kswapd and direct reclaim to clear kswapd_failures upon successful reclaim, but only when the reclaim actually resolves the memory pressure (i.e., the node becomes balanced). Link: https://lkml.kernel.org/r/20260120024402.387576-1-jiayuan.chen@linux.dev Link: https://lkml.kernel.org/r/20260120024402.387576-2-jiayuan.chen@linux.dev Signed-off-by: Jiayuan Chen Signed-off-by: Jiayuan Chen Acked-by: Shakeel Butt Cc: Axel Rasmussen Cc: Brendan Jackman Cc: David Hildenbrand Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 5898aa8f9a0b42fe1f65c7364010ab15ec5c38bf Author: Mathieu Desnoyers Date: Wed Jan 14 09:36:42 2026 -0500 mm: fix OOM killer inaccuracy on large many-core systems Use the precise, albeit slower, precise RSS counter sums for the OOM killer task selection and console dumps. The approximated value is too imprecise on large many-core systems. The following rss tracking issues were noted by Sweet Tea Dorminy [1], which lead to picking wrong tasks as OOM kill target: Recently, several internal services had an RSS usage regression as part of a kernel upgrade. Previously, they were on a pre-6.2 kernel and were able to read RSS statistics in a backup watchdog process to monitor and decide if they'd overrun their memory budget. Now, however, a representative service with five threads, expected to use about a hundred MB of memory, on a 250-cpu machine had memory usage tens of megabytes different from the expected amount -- this constituted a significant percentage of inaccuracy, causing the watchdog to act. This was a result of commit f1a7941243c1 ("mm: convert mm's rss stats into percpu_counter") [1]. Previously, the memory error was bounded by 64*nr_threads pages, a very livable megabyte. Now, however, as a result of scheduler decisions moving the threads around the CPUs, the memory error could be as large as a gigabyte. This is a really tremendous inaccuracy for any few-threaded program on a large machine and impedes monitoring significantly. These stat counters are also used to make OOM killing decisions, so this additional inaccuracy could make a big difference in OOM situations -- either resulting in the wrong process being killed, or in less memory being returned from an OOM-kill than expected. Here is a (possibly incomplete) list of the prior approaches that were used or proposed, along with their downside: 1) Per-thread rss tracking: large error on many-thread processes. 2) Per-CPU counters: up to 12% slower for short-lived processes and 9% increased system time in make test workloads [1]. Moreover, the inaccuracy increases with O(n^2) with the number of CPUs. 3) Per-NUMA-node counters: requires atomics on fast-path (overhead), error is high with systems that have lots of NUMA nodes (32 times the number of NUMA nodes). commit 82241a83cd15 ("mm: fix the inaccurate memory statistics issue for users") introduced get_mm_counter_sum() for precise proc memory status queries for some proc files. The simple fix proposed here is to do the precise per-cpu counters sum every time a counter value needs to be read. This applies to the OOM killer task selection, oom task console dumps (printk). This change increases the latency introduced when the OOM killer executes in favor of doing a more precise OOM target task selection. Effectively, the OOM killer iterates on all tasks, for all relevant page types, for which the precise sum iterates on all possible CPUs. As a reference, here is the execution time of the OOM killer before/after the change: AMD EPYC 9654 96-Core (2 sockets) Within a KVM, configured with 256 logical cpus. | before | after | ----------------------------------|----------|----------| nr_processes=40 | 0.3 ms | 0.5 ms | nr_processes=10000 | 3.0 ms | 80.0 ms | Link: https://lkml.kernel.org/r/20260114143642.47333-1-mathieu.desnoyers@efficios.com Fixes: f1a7941243c1 ("mm: convert mm's rss stats into percpu_counter") Link: https://lore.kernel.org/lkml/20250331223516.7810-2-sweettea-kernel@dorminy.me/ # [1] Signed-off-by: Mathieu Desnoyers Suggested-by: Michal Hocko Acked-by: Michal Hocko Reviewed-by: Baolin Wang Acked-by: Vlastimil Babka Cc: "Paul E. McKenney" Cc: Steven Rostedt Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Dennis Zhou Cc: Tejun Heo Cc: Christoph Lameter Cc: Martin Liu Cc: David Rientjes Cc: Shakeel Butt Cc: SeongJae Park Cc: Michal Hocko Cc: Johannes Weiner Cc: Sweet Tea Dorminy Cc: Lorenzo Stoakes Cc: "Liam R . Howlett" Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Christian Brauner Cc: Wei Yang Cc: David Hildenbrand Cc: Miaohe Lin Cc: Al Viro Cc: Yu Zhao Cc: Roman Gushchin Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Aboorva Devarajan Signed-off-by: Andrew Morton commit 77bcee8d4015a1191e1e3f5c5c51589086493ab0 Author: Ran Xiaokai Date: Thu Jan 15 03:15:36 2026 +0000 alloc_tag: fix rw permission issue when handling boot parameter Boot parameters prefixed with "sysctl." are processed during the final stage of system initialization via kernel_init()-> do_sysctl_args(). When CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled, the sysctl.vm.mem_profiling entry is not writable and will cause a warning. Before run_init_process(), system initialization executes in kernel thread context. Use current->mm to distinguish sysctl writes during do_sysctl_args() from user-space triggered ones. And when the proc_handler is from do_sysctl_args(), always return success because the same value was already set by setup_early_mem_profiling() and this eliminates a permission denied warning. Link: https://lkml.kernel.org/r/20260115031536.164254-1-ranxiaokai627@163.com Signed-off-by: Ran Xiaokai Suggested-by: Suren Baghdasaryan Acked-by: Suren Baghdasaryan Cc: Kent Overstreet Signed-off-by: Andrew Morton commit d468d8f86d80383e52ab6cf59e916b9f5578d46a Author: Manish Kumar Date: Fri Jan 16 01:01:00 2026 +0530 mm: drop filename from page_alloc.c header comment The file name in the header comment is redundant and not useful, as the location is already known from the path. Remove it to align with kernel coding style. No functional change. Link: https://lkml.kernel.org/r/20260115193100.116109-1-manish1588@gmail.com Signed-off-by: Manish Kumar Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 6efc548d8a08ae918020225e16d040ce3903bff7 Author: Sergey Senozhatsky Date: Thu Jan 15 17:08:07 2026 +0900 zram: rename init_lock to dev_lock init_lock has completely outgrown its initial purpose and is no longer used only to "prevent concurrent execution of device init" as the stale comment suggests. The scope of this lock is much bigger now. These days this lock (rw_semaphore) controls how a task owns the corresponding zram device: either in shared mode or in exclusive mode. All zram device attribute writes should own the device in exclusive mode, which synchronizes these tasks and prevents, for example, concurrent execution of recompression and writeback. All zram device attribute reads should own the device in shared mode. Rename the lock to dev_lock to better reflect its current purpose. Link: https://lkml.kernel.org/r/20260115080807.3957860-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Andrew Morton Cc: Brian Geffon Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit c0f609f799212e8ae0086b83a24ac616e0cd5696 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:32 2026 +0100 MAINTAINERS: move memory balloon infrastructure to "MEMORY MANAGEMENT - BALLOON" Nowadays, there is nothing virtio-balloon specific anymore about these files, the basic infrastructure is used by multiple memory balloon drivers. For now we'll route it through Andrew's tree, maybe in some future it makes sense to route this through a separate tree. Link: https://lkml.kernel.org/r/20260119230133.3551867-25-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Acked-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michael S. Tsirkin Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 1421758055ca6028d3b758914863f38d434bf36b Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:31 2026 +0100 mm: rename CONFIG_MEMORY_BALLOON -> CONFIG_BALLOON Let's make it consistent with the naming of the files but also with the naming of CONFIG_BALLOON_MIGRATION. While at it, add a "/* CONFIG_BALLOON */". Link: https://lkml.kernel.org/r/20260119230133.3551867-24-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit cd8e95d80bc29b3c72288bd31e845b11755ef6a5 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:30 2026 +0100 mm: rename CONFIG_BALLOON_COMPACTION to CONFIG_BALLOON_MIGRATION While compaction depends on migration, the other direction is not the case. So let's make it clearer that this is all about migration of balloon pages. Adjust all comments/docs in the core to talk about "migration" instead of "compaction". While at it add some "/* CONFIG_BALLOON_MIGRATION */". Link: https://lkml.kernel.org/r/20260119230133.3551867-23-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 7cf3318a25877c0908e450919f7e1517908e24f1 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:29 2026 +0100 mm/kconfig: make BALLOON_COMPACTION depend on MIGRATION Migration support for balloon memory depends on MIGRATION not COMPACTION. Compaction is simply another user of page migration. The last dependency on compaction.c was effectively removed with commit 3d388584d599 ("mm: convert "movable" flag in page->mapping to a page flag"). Ever since, everything for handling movable_ops page migration resides in core migration code. So let's change the dependency and adjust the description + help text. We'll rename BALLOON_COMPACTION separately next. Link: https://lkml.kernel.org/r/20260119230133.3551867-22-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 25b48b4cdf912f70998336b861a4bf767ee3d332 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:28 2026 +0100 mm: rename balloon_compaction.(c|h) to balloon.(c|h) Even without CONFIG_BALLOON_COMPACTION this infrastructure implements basic list and page management for a memory balloon. Link: https://lkml.kernel.org/r/20260119230133.3551867-21-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit a3db9e136ce1996d528dd4fc8d1d2bae7f8bef09 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:27 2026 +0100 mm/vmscan: drop inclusion of balloon_compaction.h Before commit b1123ea6d3b3 ("mm: balloon: use general non-lru movable page feature"), the include was required because of isolated_balloon_page(). It's no longer required, so let's remove it. Link: https://lkml.kernel.org/r/20260119230133.3551867-20-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 92ec9260d53b245d3266f74ecc66d8ea47aaec3d Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:26 2026 +0100 mm/balloon_compaction: remove "extern" from functions Adding "extern" to functions is frowned-upon. Let's just get rid of it for all functions here. Link: https://lkml.kernel.org/r/20260119230133.3551867-19-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit eee00d04142172c07466ab1192d1dccc6d5a2f87 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:25 2026 +0100 mm/balloon_compaction: mark remaining functions for having proper kerneldoc Looks like all we are missing for proper kerneldoc is another "*". Link: https://lkml.kernel.org/r/20260119230133.3551867-18-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 631eb2282630dc0cccd8284c4ea37e29d17d1f48 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:24 2026 +0100 mm/balloon_compaction: assert that the balloon_pages_lock is held Let's add some sanity checks for holding the balloon_pages_lock when we're effectively inflating/deflating a page. Link: https://lkml.kernel.org/r/20260119230133.3551867-17-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 03d6a2f68419b808d51ba39c84aedd6e9a6a92d8 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:23 2026 +0100 mm/balloon_compaction: move internal helpers to balloon_compaction.c Let's move the helpers that are not required by drivers anymore. While at it, drop the doc of balloon_page_device() as it is trivial. [david@kernel.org: move balloon_page_device() under CONFIG_BALLOON_COMPACTION] Link: https://lkml.kernel.org/r/27f0adf1-54c1-4d99-8b7f-fd45574e7f41@kernel.org Link: https://lkml.kernel.org/r/20260119230133.3551867-16-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 9d792ef33e40c8511b00a38e5e2e63f20bd2d815 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:22 2026 +0100 mm/balloon_compaction: fold balloon_mapping_gfp_mask() into balloon_page_alloc() Let's just remove balloon_mapping_gfp_mask(). Link: https://lkml.kernel.org/r/20260119230133.3551867-15-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 0fa3e9a48bafde8aa5a5b994b05396e9b86ce156 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:21 2026 +0100 mm/balloon_compaction: remove balloon_page_push/pop() Let's remove these helpers as they are unused now. Link: https://lkml.kernel.org/r/20260119230133.3551867-14-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit f7e15373143aba99a6ec51dc4db7187bff6c9a0a Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:20 2026 +0100 drivers/virtio/virtio_balloon: stop using balloon_page_push/pop() Let's stop using these functions so we can remove them. They look like belonging to the balloon API for managing the device balloon list when really they are just simple helpers only used by virtio-balloon. Let's just inline them and switch to a proper list_for_each_entry_safe(). Link: https://lkml.kernel.org/r/20260119230133.3551867-13-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit aa974cbf949e94c79b46a0053d40229bc634f9be Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:19 2026 +0100 mm/balloon_compaction: drop fs.h include from balloon_compaction.h Ever since commit 68f2736a8583 ("mm: Convert all PageMovable users to movable_operations") we no longer store an inode in balloon_dev_info, so we can stop including "fs.h". Link: https://lkml.kernel.org/r/20260119230133.3551867-12-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit ddc50a97bef1e34c096bf3f0dc9590d7f570ed7b Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:18 2026 +0100 mm/balloon_compaction: make balloon_mops static There is no need to expose this anymore, so let's just make it static. Link: https://lkml.kernel.org/r/20260119230133.3551867-11-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit a3fafdd3896719923f7055b6d7f10f6ee1950d8b Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:17 2026 +0100 mm/balloon_compaction: remove dependency on page lock Let's stop using the page lock in balloon code and instead use only the balloon_device_lock. As soon as we set the PG_movable_ops flag, we might now get isolation callbacks for that page as we are no longer holding the page lock. In there, we'll simply synchronize using the balloon_device_lock. So in balloon_page_isolate() lookup the balloon_dev_info through page->private under balloon_device_lock. It's crucial that we update page->private under the balloon_device_lock, so the isolation callback can properly deal with concurrent deflation. Consequently, make sure that balloon_page_finalize() is called under balloon_device_lock as we remove a page from the list and clear page->private. balloon_page_insert() is already called with the balloon_device_lock held. Note that the core will still lock the pages, for example in isolate_movable_ops_page(). The lock is there still relevant for handling the PageMovableOpsIsolated flag, but that can be later changed to use an atomic test-and-set instead, or moved into the movable_ops backends. Link: https://lkml.kernel.org/r/20260119230133.3551867-10-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 8202313e3dfa9bdeb73427b564cfe2bfd02e4807 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:16 2026 +0100 mm/balloon_compaction: use a device-independent balloon (list) lock In order to remove the dependency on the page lock for balloon pages, we need a lock that is independent of the page. It's crucial that we can handle the scenario where balloon deflation (clearing page->private) can race with page isolation (using page->private to obtain the balloon_dev_info where the lock currently resides). The current lock in balloon_dev_info is therefore not suitable. Fortunately, we never really have more than a single balloon device per VM, so we can just keep it simple and use a static lock to protect all balloon devices. Based on this change we will remove the dependency on the page lock next. Link: https://lkml.kernel.org/r/20260119230133.3551867-9-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit c33b47c334f933d846cadf7c2cff24433e5b3bb0 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:15 2026 +0100 vmw_balloon: stop using the balloon_dev_info lock Let's not piggy-back on the existing lock and use a separate lock for the huge page list. Now that we use a separate lock, there is no need to disable interrupts, so use the non-irqsave variants. We only required the irqsave variants because of the balloon device lock. This is a preparation for changing the locking used to protect balloon_dev_info. While at it, talk about "page migration" instead of "page compaction". We'll change that in core code soon as well. Link: https://lkml.kernel.org/r/20260119230133.3551867-8-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit a00de9ba30aa71fe68ab45a9d2df595a7c39dd74 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:14 2026 +0100 mm/balloon_compaction: centralize adjust_managed_page_count() handling Let's centralize it, by allowing for the driver to enable this handling through a new flag (bool for now) in the balloon device info. Note that we now adjust the counter when adding/removing a page into the balloon list: when removing a page to deflate it, it will now happen before the driver communicated with hypervisor, not afterwards. This shouldn't make a difference in practice. Link: https://lkml.kernel.org/r/20260119230133.3551867-7-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Acked-by: Liam R. Howlett Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 1258460bd31ed6e0d504adeaf9df7e6c1b348d14 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:13 2026 +0100 mm/balloon_compaction: centralize basic page migration handling Let's update the balloon page references, the balloon page list, the BALLOON_MIGRATE counter and the isolated-pages counter in balloon_page_migrate(), after letting the balloon->migratepage() callback deal with the actual inflation+deflation. Note that we now perform the balloon list modifications outside of any implementation-specific locks: which is fine, there is nothing special about these page actions that the lock would be protecting. The old page is already no longer in the list (isolated) and the new page is not yet in the list. Let's use -ENOENT to communicate the special "inflation of new page failed after already deflating the old page" to balloon_page_migrate() so it can handle it accordingly. While at it, rename balloon->b_dev_info to make it match the other functions. Also, drop the comment above balloon_page_migrate(), which seems unnecessary. Link: https://lkml.kernel.org/r/20260119230133.3551867-6-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 6af05dfe9af7df4756494e460289fc9a9d2fc531 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:12 2026 +0100 mm/balloon_compaction: improve comments for WARN_ON_ONCE(!b_dev_info) Let's clarify a bit by extending the comments. Link: https://lkml.kernel.org/r/20260119230133.3551867-5-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michael S. Tsirkin Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 5b3342cbf0f4493fa955675df79f9d10ab778662 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:11 2026 +0100 powerpc/pseries/cmm: remove cmm_balloon_compaction_init() Now that there is not a lot of logic left, let's just inline setting up the migration function. To avoid #ifdef in the caller we can instead use IS_ENABLED() and make the compiler happy by only providing the function declaration. Now that the function is gone, drop the "out_balloon_compaction" label. Note that before commit 68f2736a8583 ("mm: Convert all PageMovable users to movable_operations") we actually had to undo something, now not anymore. Link: https://lkml.kernel.org/r/20260119230133.3551867-4-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit d2346b09c51574fd6c281e3b8092116df1e42f81 Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:10 2026 +0100 vmw_balloon: remove vmballoon_compaction_init() Now that there is not a lot of logic left, let's just inline setting up the migration function and drop all these excessive comments that are not really required (or true) anymore. To avoid #ifdef in the caller we can instead use IS_ENABLED() and make the compiler happy by only providing the function declaration. Link: https://lkml.kernel.org/r/20260119230133.3551867-3-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 6e31add91a10e3804f020ec4e87cb9c3b2b6c3ec Author: David Hildenbrand (Red Hat) Date: Tue Jan 20 00:01:09 2026 +0100 vmw_balloon: adjust BALLOON_DEFLATE when deflating while migrating Patch series "mm: balloon infrastructure cleanups", v3. I started with wanting to remove the dependency of the balloon infrastructure on the page lock, but ended up performing various other cleanups, some of which I had on my todo list for years. This series heavily cleans up and simplifies our balloon infrastructure, including our balloon page migration functionality. With this series, we no longer make use of the page lock for PageOffline pages as part of the balloon infrastructure (preparing for memdescs where PageOffline pages won't have any such lock), and simplifies migration handling such that refcounting can more easily be adjusted later (long-term focus is for PageOffline pages to not have a refcount either). Plenty of related cleanups. This patch (of 24): When we're effectively deflating the balloon while migrating a page because inflating the new page failed, we're not adjusting BALLOON_DEFLATE. Let's do that. This is a preparation for factoring out this handling to the core code, making it work in a similar way first. As this (deflating while migrating because of inflation error) is a corner case that I don't really expect to happen in practice and the stats are not that crucial, this likely doesn't classify as a fix. Link: https://lkml.kernel.org/r/20260119230133.3551867-1-david@kernel.org Link: https://lkml.kernel.org/r/20260119230133.3551867-2-david@kernel.org Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: SeongJae Park Reviewed-by: Lorenzo Stoakes Acked-by: Michael S. Tsirkin Cc: Christophe Leroy Cc: Eugenio Pérez Cc: Greg Kroah-Hartman Cc: Jason Wang Cc: Jerrin Shaji George Cc: Jonathan Corbet Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: Zi Yan Signed-off-by: Andrew Morton commit 9c284c91b08e9a669e9e9657814be9ff49310fa2 Author: Shivank Garg Date: Sun Jan 18 19:23:01 2026 +0000 mm/khugepaged: make khugepaged_collapse_control static The global variable 'khugepaged_collapse_control' is not used outside of mm/khugepaged.c. Make it static to limit its scope. Link: https://lkml.kernel.org/r/20260118192253.9263-14-shivankg@amd.com Signed-off-by: Shivank Garg Reviewed-by: Wei Yang Reviewed-by: Zi Yan Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Anshuman Khandual Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Barry Song Cc: Lance Yang Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Nico Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 40bd4ff090685746459b05f59f00049ff58493e8 Author: Shivank Garg Date: Sun Jan 18 19:22:59 2026 +0000 mm/khugepaged: use enum scan_result for result variables and return types Convert result variables and return types from int to enum scan_result throughout khugepaged code. This improves type safety and code clarity by making the intent explicit. No functional change. Link: https://lkml.kernel.org/r/20260118192253.9263-12-shivankg@amd.com Signed-off-by: Shivank Garg Reviewed-by: Zi Yan Acked-by: David Hildenbrand (Red Hat) Tested-by: Nico Pache Reviewed-by: Nico Pache Reviewed-by: Dev Jain Cc: Anshuman Khandual Cc: Baolin Wang Cc: Barry Song Cc: Lance Yang Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Ryan Roberts Cc: Wei Yang Signed-off-by: Andrew Morton commit 3ab981c1fca08721a2cc100d4e097d4e0c9e149b Author: Shivank Garg Date: Sun Jan 18 19:22:57 2026 +0000 mm/khugepaged: change collapse_pte_mapped_thp() to return void The only external caller of collapse_pte_mapped_thp() is uprobe, which ignores the return value. Change the external API to return void to simplify the interface. Introduce try_collapse_pte_mapped_thp() for internal use that preserves the return value. This prepares for future patch that will convert the return type to use enum scan_result. Link: https://lkml.kernel.org/r/20260118192253.9263-10-shivankg@amd.com Signed-off-by: Shivank Garg Suggested-by: David Hildenbrand (Red Hat) Acked-by: Lance Yang Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Zi Yan Tested-by: Nico Pache Reviewed-by: Nico Pache Cc: Anshuman Khandual Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Ryan Roberts Cc: Wei Yang Signed-off-by: Andrew Morton commit 7832e4d583ee7c6a7907731c568ca40b160d8a5e Author: Shivank Garg Date: Sun Jan 18 19:22:53 2026 +0000 mm/khugepaged: remove unnecessary goto 'skip' label Patch series "mm/khugepaged: cleanups and scan limit fix", v3. This series contains several cleanups for mm/khugepaged.c to improve code readability and type safety, and one functional fix to ensure khugepaged_scan_mm_slot() correctly accounts for small VMAs towards scan limit. This patch (of 4): Replace goto skip with actual logic for better code readability. No functional change. Link: https://lkml.kernel.org/r/20260118192253.9263-4-shivankg@amd.com Link: https://lkml.kernel.org/r/20260118192253.9263-6-shivankg@amd.com Signed-off-by: Shivank Garg Reviewed-by: Liam R. Howlett Reviewed-by: Zi Yan Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lance Yang Tested-by: Nico Pache Reviewed-by: Nico Pache Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Barry Song Cc: Lorenzo Stoakes Cc: Ryan Roberts Cc: Anshuman Khandual Cc: Wei Yang Signed-off-by: Andrew Morton commit f84b65b045f186b8fbaa32e090688ef3282b56c3 Merge: 6fe0e6d599a6bb bd58782995a2e6 Author: Andrew Morton Date: Sat Jan 31 14:20:03 2026 -0800 Merge branch 'mm-hotfixes-stable' into mm-stable to pick up "mm/shmem, swap: fix race of truncate and swap entry split", needed for merging "mm, swap: cleanup swap entry management workflow". commit 5314d25afbc44d0449fa2519d2c9d7f3c319f74c Author: Ming Lei Date: Sun Feb 1 00:23:40 2026 +0800 selftests: ublk: improve I/O ordering test with bpftrace Remove test_generic_01.sh since block layer may reorder I/O, making the test prone to false positives. Apply the improvements to test_generic_02.sh instead, which supposes for covering ublk dispatch io order. Rework test_generic_02 to verify that ublk dispatch doesn't reorder I/O by comparing request start order with completion order using bpftrace. The bpftrace script now: - Tracks each request's start sequence number in a map keyed by sector - On completion, verifies the request's start order matches expected completion order - Reports any out-of-order completions detected The test script: - Wait bpftrace BEGIN code block is run - Pins fio to CPU 0 for deterministic behavior - Uses block_io_start and block_rq_complete tracepoints - Checks bpftrace output for reordering errors Reported-and-tested-by: Alexander Atanasov Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit d9a36ab302b1c90d8f03a3b13538b8676eb6ed3b Author: Ming Lei Date: Sun Feb 1 00:23:39 2026 +0800 selftests: ublk: reorganize tests into integrity and recover groups Move integrity-focused tests into new 'integrity' group: - test_null_04.sh -> test_integrity_01.sh - test_loop_08.sh -> test_integrity_02.sh Move recovery-focused tests into new 'recover' group: - test_generic_04.sh -> test_recover_01.sh - test_generic_05.sh -> test_recover_02.sh - test_generic_11.sh -> test_recover_03.sh - test_generic_14.sh -> test_recover_04.sh Update Makefile to reflect the reorganization. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 56a08b87f9f2a763cb5546f83b78ebe1e96260af Author: Ming Lei Date: Sun Feb 1 00:23:38 2026 +0800 selftests: ublk: increase timeouts for parallel test execution When running tests in parallel with high JOBS count (e.g., JOBS=64), the existing timeouts can be insufficient due to system load: - Increase state wait loops from 20/50 to 100 iterations in _recover_ublk_dev(), __ublk_quiesce_dev(), and __ublk_kill_daemon() to handle slower state transitions under heavy load - Add --timeout=20 to udevadm settle calls to prevent indefinite hangs when udev event queue is overwhelmed by rapid device creation/deletion Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 64406dd2f69fe27921c7bf06088871c002cf6186 Author: Ming Lei Date: Sun Feb 1 00:23:37 2026 +0800 selftests: ublk: add _ublk_sleep helper for parallel execution Add _ublk_sleep() helper function that uses different sleep times depending on whether tests run in parallel or sequential mode. Usage: _ublk_sleep Export JOBS variable from Makefile so test scripts can detect parallel execution, and use _ublk_sleep in test_part_02.sh to handle the partition scan delay (1s normal, 5s parallel). Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit b6bbc3bec19efd557f888d78865b627b80b37a32 Author: Ming Lei Date: Sun Feb 1 00:23:36 2026 +0800 selftests: ublk: add group-based test targets Add convenient Makefile targets for running specific test groups: - run_generic, run_batch, run_null, run_loop, run_stripe, run_stress, etc. - run_all for running all tests Test groups are auto-detected from TEST_PROGS using pattern matching (test__.sh -> group), and targets are generated dynamically using define/eval templates. Supports parallel execution via JOBS variable: - JOBS=1 (default): sequential with kselftest TAP output - JOBS>1: parallel execution with xargs -P Usage examples: make run_null # Sequential execution make run_stress JOBS=4 # Parallel with 4 jobs make run_all JOBS=8 # Run all tests with 8 parallel jobs With JOBS=8, running time of `make run_all` is reduced to 2m2s from 6m5s in my test VM. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 2021e6109de3e97adfce262c40a657ff206ef495 Author: Ming Lei Date: Sun Feb 1 00:23:35 2026 +0800 selftests: ublk: track created devices for per-test cleanup Track device IDs in UBLK_DEVS array when created. Update _cleanup_test() to only delete devices created by this test instead of using 'del -a' which removes all devices. This prepares for running tests concurrently where each test should only clean up its own devices. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 92734a4f3a7a5449b0c7d0160ba658a2b665c31b Author: Ming Lei Date: Sun Feb 1 00:23:34 2026 +0800 selftests: ublk: add _ublk_del_dev helper function Add _ublk_del_dev() to delete a specific ublk device by ID and use it in all test scripts instead of calling UBLK_PROG directly. Also remove unused _remove_ublk_devices() function. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 842b6520e579b8bd7d6ea09937e1fb7729cce1c5 Author: Ming Lei Date: Sun Feb 1 00:23:33 2026 +0800 selftests: ublk: refactor test_loop_08 into separate functions Encapsulate each test case in its own function for better organization and maintainability: - _setup_device(): device and backfile initialization - _test_fill_and_verify(): initial data population - _test_corrupted_reftag(): reftag corruption detection test - _test_corrupted_data(): data corruption detection test - _test_bad_apptag(): apptag mismatch detection test Also fix temp file creation to use ${UBLK_TEST_DIR}/fio_err_XXXXX instead of creating in current directory. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 5af302a15a1d628a025a78892001fe8afea90c60 Author: Ming Lei Date: Sun Feb 1 00:23:32 2026 +0800 selftests: ublk: simplify UBLK_TEST_DIR handling Remove intermediate TDIR variable and set UBLK_TEST_DIR directly in _prep_test(). Remove default initialization since the directory is created dynamically when tests run. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 4bebb99140c7b6ee6d894c40557f938804fa8693 Merge: f0b5b3d6b56f87 7f10da2133b18b Author: Alexei Starovoitov Date: Sat Jan 31 13:51:04 2026 -0800 Merge branch 'bpf-arm64-add-fsession-support' Leon Hwang says: ==================== Similar to commit 98770bd4e6df ("bpf,x86: add fsession support for x86_64"), add fsession support on arm64. Patch #1 adds bpf_jit_supports_fsession() to prevent fsession loading on architectures that do not implement fsession support. Patch #2 implements fsession support in the arm64 BPF JIT trampoline. Patch #3 enables the relevant selftests on arm64, including get_func_ip, and get_func_args. All enabled tests pass on arm64: cd tools/testing/selftests/bpf ./test_progs -t fsession #136/1 fsession_test/fsession_test:OK #136/2 fsession_test/fsession_reattach:OK #136/3 fsession_test/fsession_cookie:OK #136 fsession_test:OK Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED ./test_progs -t get_func #138 get_func_args_test:OK #139 get_func_ip_test:OK Summary: 2/0 PASSED, 0 SKIPPED, 0 FAILED Changes: v4 -> v5: * Address comment from Alexei: * Rename helper bpf_link_prog_session_cookie() to bpf_prog_calls_session_cookie(). * v4: https://lore.kernel.org/bpf/20260129154953.66915-1-leon.hwang@linux.dev/ v3 -> v4: * Add a log when !bpf_jit_supports_fsession() in patch #1 (per AI). * v3: https://lore.kernel.org/bpf/20260129142536.48637-1-leon.hwang@linux.dev/ v2 -> v3: * Fix typo in subject and patch message of patch #1 (per AI and Chris). * Collect Acked-by, and Tested-by from Puranjay, thanks. * v2: https://lore.kernel.org/bpf/20260128150112.8873-1-leon.hwang@linux.dev/ v1 -> v2: * Add bpf_jit_supports_fsession(). * v1: https://lore.kernel.org/bpf/20260127163344.92819-1-leon.hwang@linux.dev/ ==================== Link: https://patch.msgid.link/20260131144950.16294-1-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 7f10da2133b18b0f1bc02d58671883537e212279 Author: Leon Hwang Date: Sat Jan 31 22:49:50 2026 +0800 selftests/bpf: Enable get_func_args and get_func_ip tests on arm64 Allow get_func_args, and get_func_ip fsession selftests to run on arm64. Acked-by: Puranjay Mohan Tested-by: Puranjay Mohan Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260131144950.16294-4-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit e3aa56b3ac175bccb8fe60d652a3df2ea6a68a1e Author: Leon Hwang Date: Sat Jan 31 22:49:49 2026 +0800 bpf, arm64: Add fsession support Implement fsession support in the arm64 BPF JIT trampoline. Extend the trampoline stack layout to store function metadata and session cookies, and pass the appropriate metadata to fentry and fexit programs. This mirrors the existing x86 behavior and enables session cookies on arm64. Acked-by: Puranjay Mohan Tested-by: Puranjay Mohan Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260131144950.16294-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 8798902f2b8bcae6f90229a1a1496b48ddda2972 Author: Leon Hwang Date: Sat Jan 31 22:49:48 2026 +0800 bpf: Add bpf_jit_supports_fsession() The added fsession does not prevent running on those architectures, that haven't added fsession support. For example, try to run fsession tests on arm64: test_fsession_basic:PASS:fsession_test__open_and_load 0 nsec test_fsession_basic:PASS:fsession_attach 0 nsec check_result:FAIL:test_run_opts err unexpected error: -14 (errno 14) In order to prevent such errors, add bpf_jit_supports_fsession() to guard those architectures. Fixes: 2d419c44658f ("bpf: add fsession support") Acked-by: Puranjay Mohan Tested-by: Puranjay Mohan Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260131144950.16294-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit f0b5b3d6b56f8717e255406366d81bbcd3631660 Author: Paul Chaignon Date: Sat Jan 31 17:09:02 2026 +0100 selftests/bpf: Test access from RO map from xdp_store_bytes This new test simply checks that helper bpf_xdp_store_bytes can successfully read from a read-only map. Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/4fdb934a713b2d7cf133288c77f6cfefe9856440.1769875479.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 6557f1565d779851c4db9c488c49c05a47a6e72f Author: Paul Chaignon Date: Sat Jan 31 17:08:37 2026 +0100 bpf: Fix bpf_xdp_store_bytes proto for read-only arg While making some maps in Cilium read-only from the BPF side, we noticed that the bpf_xdp_store_bytes proto is incorrect. In particular, the verifier was throwing the following error: ; ret = ctx_store_bytes(ctx, l3_off + offsetof(struct iphdr, saddr), &nat->address, 4, 0); 635: (79) r1 = *(u64 *)(r10 -144) ; R1=ctx() R10=fp0 fp-144=ctx() 636: (b4) w2 = 26 ; R2=26 637: (b4) w4 = 4 ; R4=4 638: (b4) w5 = 0 ; R5=0 639: (85) call bpf_xdp_store_bytes#190 write into map forbidden, value_size=6 off=0 size=4 nat comes from a BPF_F_RDONLY_PROG map, so R3 is a PTR_TO_MAP_VALUE. The verifier checks the helper's memory access to R3 in check_mem_size_reg, as it reaches ARG_CONST_SIZE argument. The third argument has expected type ARG_PTR_TO_UNINIT_MEM, which includes the MEM_WRITE flag. The verifier thus checks for a BPF_WRITE access on R3. Given R3 points to a read-only map, the check fails. Conversely, ARG_PTR_TO_UNINIT_MEM can also lead to the helper reading from uninitialized memory. This patch simply fixes the expected argument type to match that of bpf_skb_store_bytes. Fixes: 3f364222d032 ("net: xdp: introduce bpf_xdp_pointer utility routine") Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/9fa3c9f72d806e82541071c4df88b8cba28ad6a9.1769875479.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit a22f57757f7e88c890499265c383ecb32900b645 Merge: df31a6b0a3057e 173eb9a902d1d9 Author: Jakub Kicinski Date: Sat Jan 31 12:59:48 2026 -0800 Merge tag 'linux-can-next-for-6.20-20260131' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2026-01-31 This first 2 patches are by Biju Das, target the rcar_canfd driver and add support for FD-only mode. Lad Prabhakar's patches, also for the rcar_canfd driver add support for the RZ/T2H SoC. The last 2 patches are by Michael Tretter and me, target the sja1000 driver and clean up the CAN state handling. * tag 'linux-can-next-for-6.20-20260131' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: sja1000: sja1000_err(): use error counter for error state can: sja1000: sja1000_err(): make use of sja1000_get_berr_counter() to read error counters can: rcar_canfd: Add RZ/T2H support dt-bindings: can: renesas,rcar-canfd: Document RZ/T2H and RZ/N2H SoCs dt-bindings: can: renesas,rcar-canfd: Document RZ/V2H(P) and RZ/V2N SoCs dt-bindings: can: renesas,rcar-canfd: Specify reset-names can: rcar_canfd: Add support for FD-Only mode dt-bindings: can: renesas,rcar-canfd: Document renesas,fd-only property ==================== Link: https://patch.msgid.link/20260131101512.1958907-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 11c5802d28dd71fffb4df0720eafe840a953dc92 Author: Thomas Weißschuh Date: Sun Jan 18 10:45:57 2026 +0100 hwmon: (cros_ec) Move temperature channel params to a macro An upcoming change will add more channel parameters. This leads to a lot of churn and very long lines. Use a macro to encapsulate all of the shared values. Signed-off-by: Thomas Weißschuh Reviewed-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260118-cros_ec-hwmon-pwm-v2-3-77eb1709b031@weissschuh.net Signed-off-by: Guenter Roeck commit bd7a455aee3b98aaa36f7d71c66c7a823a6131a0 Author: Thomas Weißschuh Date: Sun Jan 18 10:45:56 2026 +0100 hwmon: (cros_ec) Add support for fan target speed Use EC_CMD_PWM_GET_FAN_TARGET_RPM to retrieve the target fan speed. The EC only supports this for the first fan. Signed-off-by: Thomas Weißschuh Reviewed-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260118-cros_ec-hwmon-pwm-v2-2-77eb1709b031@weissschuh.net Signed-off-by: Guenter Roeck commit 18ccf48656e010838075fd00caa6d93d3f95d106 Author: Thomas Weißschuh Date: Sun Jan 18 10:45:55 2026 +0100 hwmon: (cros_ec) Split up supported features in the documentation The wall of text of supported features is hard to read and messy to extend. Split it into a definition list with an explanations for each supported feature. Signed-off-by: Thomas Weißschuh Reviewed-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260118-cros_ec-hwmon-pwm-v2-1-77eb1709b031@weissschuh.net Signed-off-by: Guenter Roeck commit 51521432e94b9baec8792db8089d7ac255ae51bc Author: Mayank Mahajan Date: Mon Jan 19 09:34:59 2026 +0530 hwmon: (tmp108) Add P3T1035 and P3T2030 support Update the hwmon driver documentation for sensors: P3T1035 and P3T2030. Signed-off-by: Mayank Mahajan Link: https://lore.kernel.org/r/20260119040459.2898998-3-mayankmahajan.x@nxp.com Signed-off-by: Guenter Roeck commit 72037c41283479f1d93ff005befe4603b83983b0 Author: Mayank Mahajan Date: Mon Jan 19 09:34:58 2026 +0530 hwmon: (tmp108) Add support for P3T1035 and P3T2030 Add support for the P3T1035 & P3T2030 temperature sensor. While mostly compatible with the TMP108, P3T1035 uses an 8-bit configuration register instead of the 16-bit layout used by TMP108. Updated driver to handle this difference during configuration read/write. Signed-off-by: Mayank Mahajan Link: https://lore.kernel.org/r/20260119040459.2898998-2-mayankmahajan.x@nxp.com [groeck: Reordered include files to retain alphabetic order] Signed-off-by: Guenter Roeck commit 9f3f040f7b4a662e726008ace659aecc0a1b94ee Author: Mayank Mahajan Date: Mon Jan 19 09:34:57 2026 +0530 dt-bindings: hwmon: ti,tmp108: Add P3T1035,P3T2030 Document the NXP P3T1035 and P3T2030 compatibles in TMP108. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Mayank Mahajan Link: https://lore.kernel.org/r/20260119040459.2898998-1-mayankmahajan.x@nxp.com Signed-off-by: Guenter Roeck commit 64824861ebd77706e58017c84292753dfc8f2d0c Author: Charles Hsu Date: Mon Jan 26 14:37:12 2026 +0800 hwmon: pmbus: add support for STEF48H28 Add support for STEF48H28 hot-swap controller. Signed-off-by: Charles Hsu Link: https://lore.kernel.org/r/20260126063712.1049025-2-hsu.yungteng@gmail.com Signed-off-by: Guenter Roeck commit 418a1828caf318113c82069355aab2c7b6d4f544 Author: Charles Hsu Date: Mon Jan 26 14:37:11 2026 +0800 dt-bindings: hwmon: add STEF48H28 Add device tree bindings for the hot-swap controller STEF48H28. Signed-off-by: Charles Hsu Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20260126063712.1049025-1-hsu.yungteng@gmail.com Signed-off-by: Guenter Roeck commit 4923bbff0bcffe488b3aa76829c829bd15b02585 Author: Felix Gu Date: Thu Jan 15 21:54:15 2026 +0800 hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In nct7363_present_pwm_fanin, it does not release the reference, causing a resource leak. Signed-off-by: Felix Gu Link: https://lore.kernel.org/r/tencent_9717645269E4C07D3D131F52201E12E5E10A@qq.com Signed-off-by: Guenter Roeck commit 2954ce672b7623478c1cfeb69e6a6e4042a3656e Author: Felix Gu Date: Thu Jan 15 21:51:48 2026 +0800 hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In emc2305_of_parse_pwm_child, it does not release the reference, causing a resource leak. Signed-off-by: Felix Gu Link: https://lore.kernel.org/r/tencent_738BA80BBF28F3440301EEE6F9E470165105@qq.com Signed-off-by: Guenter Roeck commit 13bf63b9314034d54b521d83ad6a04142695d1a0 Author: Cryolitia PukNgae Date: Mon Dec 22 18:51:39 2025 +0800 hwmon: (gpd-fan) add support for Micro PC 2 GPD Micro PC 2 is a mobile productivity device with 7-inch screen and abundant ports.[1] Link: https://www.gpd.hk/gpdmicropc2345345345 #1 Co-developed-by: kylon <3252255+kylon@users.noreply.github.com> Signed-off-by: kylon <3252255+kylon@users.noreply.github.com> Tested-by: kylon <3252255+kylon@users.noreply.github.com> Link: https://github.com/Cryolitia/gpd-fan-driver/pull/23 Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20251222-mpc2-v1-1-695d8d351cc1@uniontech.com Signed-off-by: Guenter Roeck commit bcd5120ad454c7c5824de1869dc76d62abe8dd0c Author: Laveesh Bansal Date: Tue Jan 6 15:54:26 2026 +0000 hwmon: (coretemp) Add TjMax for Silvermont through Tremont Atoms Add fallback TjMax values for Intel Atom processors based on Silvermont, Airmont, Goldmont, and Tremont microarchitectures. These processors support MSR_IA32_TEMPERATURE_TARGET for reading TjMax directly, so these table entries serve as fallback values only when the MSR read fails (e.g., in some virtualization scenarios). Added processors and TjMax values: - INTEL_ATOM_SILVERMONT (0x37, Bay Trail): - Stepping 9 (E38xx embedded): 110C - Other steppings (Z37xx tablet): 90C Stepping identified from Intel E3800 Specification Update. - INTEL_ATOM_SILVERMONT_MID (0x4a, Merrifield): 90C - INTEL_ATOM_SILVERMONT_MID2 (0x5a, Moorefield): 90C - INTEL_ATOM_AIRMONT (0x4c, Cherry Trail): 90C - INTEL_ATOM_GOLDMONT (0x5c, Apollo Lake): 105C - INTEL_ATOM_GOLDMONT_PLUS (0x7a, Gemini Lake): 105C - INTEL_ATOM_TREMONT (0x96, Elkhart Lake): 105C - INTEL_ATOM_TREMONT_L (0x9c, Jasper Lake): 105C Not included (MSR reads work reliably, server/specialized chips): - INTEL_ATOM_SILVERMONT_D (Avoton): Server, Tcase 97C - INTEL_ATOM_GOLDMONT_D (Denverton): Server, Tcase 82C - INTEL_ATOM_AIRMONT_NP (Lightning Mountain): Network processor - INTEL_ATOM_TREMONT_D (Jacobsville): Server - INTEL_ATOM_GRACEMONT (Alder Lake-N): Very new, MSR works Reference: Intel datasheets and ARK processor specifications - Z3600/Z3700 datasheet: https://www.intel.com/content/dam/www/public/us/en/documents/datasheets/atom-z36xxx-z37xxx-datasheet-vol-1.pdf - E3845 ARK: https://www.intel.com/content/www/us/en/products/sku/78475/intel-atom-processor-e3845-2m-cache-1-91-ghz/specifications.html - E3800 Spec Update: https://community.intel.com/cipcp26785/attachments/cipcp26785/embedded-atom-processors/4708/1/600834-329901-intel-atom-processor-e3800-product-family-su-rev015.pdf Signed-off-by: Laveesh Bansal Link: https://lore.kernel.org/r/20260106155426.547872-3-laveeshb@laveeshbansal.com Signed-off-by: Guenter Roeck commit f6702aa05acc8986c87ed4c14f70ca1d9f5ab998 Author: Laveesh Bansal Date: Tue Jan 6 15:54:25 2026 +0000 Documentation: hwmon: coretemp: Update supported CPUs and TjMax values Update the coretemp documentation to reflect current driver capabilities: - Extend the supported CPU model list to include Atom processors from Bonnell through Jasper Lake, maintaining the original format with model numbers and adding X86_FEATURE_DTHERM as the actual detection mechanism. Added models: 0x37 (Bay Trail), 0x4a (Merrifield), 0x4c (Cherry Trail), 0x5a (Moorefield), 0x5c (Apollo Lake), 0x7a (Gemini Lake), 0x96 (Elkhart Lake), 0x9c (Jasper Lake) - Update the description to note that per-package temperature sensing is available on Sandy Bridge and all newer processors - Clarify that TjMax is read from MSR_IA32_TEMPERATURE_TARGET on modern CPUs (Nehalem and newer) - Add TjMax values for newer Atom processor families to Appendix A: - 22nm Silvermont/Bay Trail: E38xx at 110C, Z37xx at 90C - 22nm Silvermont/Moorefield: Z35xx at 90C - 14nm Airmont/Cherry Trail: Z8xxx at 90C - 14nm Goldmont/Apollo Lake: 105C - 14nm Goldmont Plus/Gemini Lake: 105C - 10nm Tremont/Elkhart Lake: 105C - 10nm Tremont/Jasper Lake: 105C TjMax values obtained from Intel ARK and official datasheets: - E3845: https://www.intel.com/content/www/us/en/products/sku/78475/intel-atom-processor-e3845-2m-cache-1-91-ghz/specifications.html - Z3600/Z3700: https://www.intel.com/content/dam/www/public/us/en/documents/datasheets/atom-z36xxx-z37xxx-datasheet-vol-1.pdf Signed-off-by: Laveesh Bansal Link: https://lore.kernel.org/r/20260106155426.547872-2-laveeshb@laveeshbansal.com Signed-off-by: Guenter Roeck commit 75cf411b02a7afe19dc473b4d3b3cec8680f7b14 Author: Rob Herring (Arm) Date: Fri Jan 9 16:40:28 2026 +1030 dt-bindings: hwmon: Convert aspeed,ast2400-pwm-tacho to DT schema Convert the ASpeed fan controller binding to DT schema format. The '#size-cells' value is 0 rather 1. Some users define more that 8 fan nodes where 2 fans share a PWM. The driver seems to let the 2nd fan just overwrite the 1st one. That also creates some addressing errors in the DT (duplicate addresses and wrong unit-addresses). Signed-off-by: Rob Herring (Arm) Acked-by: Guenter Roeck Signed-off-by: Andrew Jeffery Link: https://lore.kernel.org/r/20260109-dev-dt-warnings-hwmon-v1-1-f2a84cdb0e1b@codeconstruct.com.au Signed-off-by: Guenter Roeck commit c0fa7879c9850bd4597740a79d4fac5ebfcf69cc Author: Anj Duvnjak Date: Tue Dec 23 09:09:42 2025 +1100 hwmon: (nct6683) Add customer ID for ASRock Z590 Taichi Add support for customer ID 0x1621 found on ASRock Z590 Taichi boards using the Nuvoton NCT6686D embedded controller. This allows the driver to instantiate without requiring the force=1 module parameter. Tested on two separate ASRock Z590 Taichi boards, both with EC firmware version 1.0 build 01/25/21. Signed-off-by: Anj Duvnjak Link: https://lore.kernel.org/r/20251222220942.10762-1-avian@extremenerds.net Signed-off-by: Guenter Roeck commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 Author: Ji-Ze Hong (Peter Hong) Date: Tue Dec 23 13:10:40 2025 +0800 hwmon: (f71882fg) Add F81968 support Add hardware monitoring support for the Fintek F81968 Super I/O chip. It is fully compatible with F81866. Several products share compatibility with the F81866. To better distinguish between them, ensure that the Product ID is displayed when the device is probed. Signed-off-by: Ji-Ze Hong (Peter Hong) Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw Signed-off-by: Guenter Roeck commit 6846757d4c851eb8693bbbfc2cde55d291ba1d29 Author: Krzysztof Kozlowski Date: Wed Dec 24 12:07:05 2025 +0100 hwmon: (nct7363) Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251224110702.61746-6-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Guenter Roeck commit 0689522a92292ca057f26e99f39781c3cb26f483 Author: Krzysztof Kozlowski Date: Wed Dec 24 12:07:04 2025 +0100 hwmon: (max6639) Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251224110702.61746-5-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Guenter Roeck commit bfd0103be5d85751fc8b7c6c8c7553d71022efe0 Author: Krzysztof Kozlowski Date: Wed Dec 24 12:07:03 2025 +0100 hwmon: (emc2305) Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251224110702.61746-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Guenter Roeck commit d4168cb6ae4f77779c8ceb1edf15b8eae95bdf7f Author: Szymon Wilczek Date: Sat Dec 20 18:30:41 2025 +0100 hwmon: (acpi_power_meter) Replace deprecated strcpy() with strscpy() strcpy() performs no bounds checking on the destination buffer, which could result in linear overflows beyond the end of the buffer. Although the source strings here are compile-time constants that fit within the destination buffers, using strscpy() is the preferred approach as it provides bounds checking and aligns with the kernel's deprecated API guidelines. This change converts the remaining strcpy() calls to strscpy(), matching the pattern already used throughout other ACPI drivers in drivers/acpi/*.c. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy Signed-off-by: Szymon Wilczek Reviewed-by: lihuisong@huawei.com Link: https://lore.kernel.org/r/20251220173041.377376-1-szymonwilczek@gmx.com Signed-off-by: Guenter Roeck commit 246167b17c14e8a5142368ac6457e81622055e0a Author: Denis Pauk Date: Wed Dec 31 17:53:14 2025 +0200 hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's no use of it because of resource conflict with WMI method. Add the board to the WMI monitoring list. Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk Tested-by: Marcus Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com Signed-off-by: Guenter Roeck commit 194e725cc792322f9e140d0f62c2ff4077f94efc Author: Jai Kith Date: Sat Jan 3 09:57:31 2026 +0100 hwmon: (asus-ec-sensors) Add VRM temperature for Pro WS WRX90E-SAGE SE Add VRM_E (0x33) and VRM_W (0x34) temperature sensor definitions to sensors_family_amd_wrx_90 and enable them in the board config. Signed-off-by: Jai Kith Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20260103085740.10644-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit a9c4ac630c8a38a0496c2b54cf27b318d38ab6e6 Author: Wensheng Wang Date: Tue Jan 6 14:13:48 2026 +0800 hwmon: (mp2925) Add vid offset for vid mode In vid mode, the mp2925 vout telemetry has 49 vid step offset, add vid offset for this. Signed-off-by: Wensheng Wang Link: https://lore.kernel.org/r/20260106061348.170509-1-wenswang@yeah.net Signed-off-by: Guenter Roeck commit 46c3e87a79179454f741f797c274dd25f5c6125e Author: Armin Wolf Date: Sun Jan 4 01:06:10 2026 +0100 hwmon: (dell-smm) Add support for Dell OptiPlex 7080 The Dell OptiPlex 7080 supports the legacy SMM interface for reading sensors and performing fan control. Whitelist this machine so that this driver loads automatically. Closes: https://github.com/Wer-Wolf/i8kutils/issues/16 Signed-off-by: Armin Wolf Acked-by: Pali Rohár Link: https://lore.kernel.org/r/20260104000654.6406-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit ca2cf35544926dd668b28f63a5babb8dc36a26d6 Author: Yuxi Wang Date: Fri Dec 19 13:54:13 2025 +0800 hwmon: (pmbus) Add mp5926 driver Add support for mps mp5926. Signed-off-by: Yuxi Wang Link: https://lore.kernel.org/r/20251219055413.1661-3-Yuxi.Wang@monolithicpower.com [groeck: Use consistent comment style, and use return value from dev_err_probe()] Signed-off-by: Guenter Roeck commit d491cd8e1e35f9837e3f1db8d8beb374842cb53e Author: Yuxi Wang Date: Fri Dec 19 13:54:12 2025 +0800 dt-bindings: hwmon: Add mps mp5926 driver bindings Add a device tree bindings for mp5926 device. Acked-by: Rob Herring (Arm) Signed-off-by: Yuxi Wang Link: https://lore.kernel.org/r/20251219055413.1661-2-Yuxi.Wang@monolithicpower.com Signed-off-by: Guenter Roeck commit 141d3002521609991bc016c79ed05f10a0189e8d Author: Kari Argillander Date: Fri Dec 19 17:48:15 2025 +0200 hwmon: Use sysfs_emit in show function callbacks Use sysfs_emit() over sprintf() to prevent potential overflows. In hwmon_attr_show() that is totally impossible but looking other places many still use sysfs_emit(). Also according Documentation/filesystems/sysfs.rst code should use sysfs_emit(). Signed-off-by: Kari Argillander Link: https://lore.kernel.org/r/20251219-hwmon-fixes-v1-2-21b29097ea3b@gmail.com Signed-off-by: Guenter Roeck commit aa8126b914a767ccacaad53596193d4b97abcd58 Author: Kari Argillander Date: Fri Dec 19 17:48:14 2025 +0200 hwmon: Fix wrong return errno in *sanitize_name() Currently if user of *sanitize_name() function gives nullptr for name they get's ENOMEM. Logically it should be EINVAL. Signed-off-by: Kari Argillander Link: https://lore.kernel.org/r/20251219-hwmon-fixes-v1-1-21b29097ea3b@gmail.com Signed-off-by: Guenter Roeck commit 9ef5c1065cd12e2288c2185f88da5cffce0a4623 Author: Vaibhav Gupta Date: Tue Dec 16 18:13:59 2025 +0000 hwmon: (fam15h_power) Use generic power management Switch to the generic PCI power management framework and remove legacy .resume() callback. With the generic framework, the standard PCI related work like: - pci_save/restore_state() - pci_enable/disable_device() - pci_set_power_state() is handled by the PCI core and this driver should implement only device specific operations in its respective callback function. Signed-off-by: Vaibhav Gupta Link: https://lore.kernel.org/r/20251216181401.598273-1-vaibhavgupta40@gmail.com Signed-off-by: Guenter Roeck commit bc5da9886ad0241cd57b780bac9e6e9350947110 Author: Robert Marko Date: Mon Dec 15 17:35:32 2025 +0100 dt-bindings: hwmon: sparx5: add microchip,lan9691-temp Document LAN969x hwmon temperature sensor compatible. Signed-off-by: Robert Marko Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20251215163820.1584926-15-robert.marko@sartura.hr Signed-off-by: Guenter Roeck commit 1fe80112e4a151d3184a702412b7be0bcd819dab Author: Antoni Pokusinski Date: Thu Dec 11 19:58:42 2025 +0100 hwmon: (sht3x) add support for SHT85 SHT85 is a temperature and humidity sensor with the same interface as SHT3x. Signed-off-by: Antoni Pokusinski Link: https://lore.kernel.org/r/20251211185842.66084-1-apokusinski01@gmail.com Signed-off-by: Guenter Roeck commit af7e57d444141ac9e77b57296d59c3e965c4c4fa Author: Robert McIntyre Date: Sat Dec 13 21:03:43 2025 +0100 hwmon: (asus-ec-sensors) add Pro WS TRX50-SAGE WIFI A Adding support for Pro WS TRX50-SAGE WIFI A, which is identical sensors-wise to Pro WS TRX50-SAGE WIFI Signed-off-by: Robert McIntyre Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20251213200531.259435-4-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 7da5daed35a995530001aece286663932da7f8ae Author: Reis Holmes Date: Sat Dec 13 21:03:42 2025 +0100 hwmon: (asus-ec-sensors) add ROG MAXIMUS X HERO Add support for ROG MAXIMUS X HERO. The support is incomplete because the second EC, which provides part of the data, is inaccessible via the kernel ec module. Signed-off-by: Reis Holmes Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20251213200531.259435-3-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit d0a0960602f780362ea974c80650d87bcf13726a Author: Gui-Dong Han Date: Wed Dec 3 01:55:36 2025 +0800 hwmon: submitting-patches: Explain race conditions caused by calculations in macros The current documentation advises against calculations in macros primarily to avoid code obfuscation. It misses the risk of concurrency issues. Add a note explaining that macros evaluating arguments multiple times can lead to race conditions when accessing shared data. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251202175536.12774-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit 8c89d3ad3095808ac130c535ad7ed3d1344d5986 Author: Ard Biesheuvel Date: Thu Jan 8 09:25:29 2026 +0000 x86/sev: Don't emit BSS_DECRYPTED section unless it is in use The BSS_DECRYPTED section that gets emitted into .bss will be empty if CONFIG_AMD_MEM_ENCRYPT is not defined. However, due to the fact that it is injected into .bss rather than emitted as a separate section, the 2 MiB alignment that it specifies is still taken into account unconditionally, pushing .bss out to the next 2 MiB boundary, leaving a gap that is never freed. So only emit a non-empty BSS_DECRYPTED section if it is going to be used. In that case, it would still be nice to free the padding, but that is left for later. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260108092526.28586-23-ardb@kernel.org commit 491af20b3c6d5baedb96357d4b12232ae490cbe7 Author: Caleb Sander Mateos Date: Fri Jan 30 08:25:30 2026 -0700 ublk: remove "can't touch 'ublk_io' any more" comments The struct ublk_io is in fact accessed in __ublk_complete_rq() after the comment. But it's not racy to access the ublk_io between clearing its UBLK_IO_FLAG_OWNED_BY_SRV flag and completing the request, as no other thread can use the ublk_io in the meantime. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 2feca79ef8df5505b87c00812b9ba263b92c64ed Author: Alexander Atanasov Date: Fri Jan 30 00:19:58 2026 +0800 selftests: ublk: move test temp files into a sub directory Create and use a temporary directory for the files created during test runs. If TMPDIR environment variable is set use it as a base for the temporary directory path. TMPDIR=/mnt/scratch make run_tests and TMPDIR=/mnt/scratch ./test_generic_01.sh will place test directory under /mnt/scratch Signed-off-by: Alexander Atanasov Signed-off-by: Jens Axboe commit 4e0d293af9e37c735aec574c1e69ed71f81f94b2 Author: Alexander Atanasov Date: Fri Jan 30 00:19:57 2026 +0800 selftests: ublk: mark each test start and end time in dmesg Log test start and end time in dmesg, so generated log messages during the test run can be linked to specific test from the test suite. (switch to `date +%F %T`) Signed-off-by: Alexander Atanasov Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 76334de7da404c385e18efb3640ed60ca77a899f Author: Ming Lei Date: Fri Jan 30 00:19:56 2026 +0800 selftests: ublk: disable partition scan for integrity tests The null target doesn't handle IO, so disable partition scan to avoid IO failures caused by integrity verification during the kernel's partition table read. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 130975353b1548d76aa9790a4ac7e74bd2a37221 Author: Ming Lei Date: Fri Jan 30 00:19:55 2026 +0800 selftests: ublk: refactor test_null_04 into separate functions Encapsulate each test case in its own function that creates the device, runs checks, and deletes only that device. This avoids calling _cleanup_test multiple times. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 7a30d3dfea4a455d1109d5258fe332f2157071ba Author: Ming Lei Date: Fri Jan 30 00:19:54 2026 +0800 selftests: ublk: rename test_generic_15 to test_part_02 This test exercises partition scanning behavior, so move it to the test_part_* group for consistency. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit e07a2039b6d4ae3acf8ae39b86be449b7fa18d4a Author: Ming Lei Date: Fri Jan 30 00:19:53 2026 +0800 selftests: ublk: add selftest for UBLK_F_NO_AUTO_PART_SCAN Add test_part_01.sh to test the UBLK_F_NO_AUTO_PART_SCAN feature flag which allows suppressing automatic partition scanning during device startup while still allowing manual partition probing. The test verifies: - Normal behavior: partitions are auto-detected without the flag - With flag: partitions are not auto-detected during START_DEV - Manual scan: blockdev --rereadpt works with the flag Also update kublk tool to support --no_auto_part_scan option and recognize the feature flag. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 3a4d8bed0b47543b2dfce0b1d714b40d68ff2f7e Author: Ming Lei Date: Fri Jan 30 00:19:52 2026 +0800 selftests: ublk: derive TID automatically from script name Add automatic TID derivation in test_common.sh based on the script filename. The TID is extracted by stripping the "test_" prefix and ".sh" suffix from the script name (e.g., test_loop_01.sh -> loop_01). This removes the need for each test script to manually define TID, reducing boilerplate and preventing potential mismatches between the script name and TID. Scripts can still override TID after sourcing test_common.sh if needed. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 8443e2087e7002fa25984faad6bbf5f63b280645 Author: Ming Lei Date: Fri Jan 30 00:19:51 2026 +0800 ublk: add UBLK_F_NO_AUTO_PART_SCAN feature flag Add a new feature flag UBLK_F_NO_AUTO_PART_SCAN to allow users to suppress automatic partition scanning when starting a ublk device. This is useful for some cases in which user don't want to scan partitions. Users still can manually trigger partition scanning later when appropriate using standard tools (e.g., partprobe, blockdev --rereadpt). Reported-by: Yoav Cohen Link: https://lore.kernel.org/linux-block/DM4PR12MB63280C5637917C071C2F0D65A9A8A@DM4PR12MB6328.namprd12.prod.outlook.com/ Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 66d3af8d5d678d221776a1886baec8d78293592c Author: Ming Lei Date: Fri Jan 30 00:19:50 2026 +0800 ublk: check list membership before cancelling batch fetch command Add !list_empty(&fcmd->node) check in ublk_batch_cancel_cmd() to ensure the fcmd hasn't already been removed from the list. Once an fcmd is removed from the list, it's considered claimed by whoever removed it and will be freed by that path. Meantime switch to list_del_init() for deleting it from list. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 373df2c0255da77f0842368708afce771e1330ca Author: Caleb Sander Mateos Date: Fri Jan 30 10:14:14 2026 -0700 ublk: drop ublk_ctrl_start_recovery() header argument ublk_ctrl_start_recovery() only uses its const struct ublksrv_ctrl_cmd * header argument to log the dev_id. But this value is already available in struct ublk_device's ub_number field. So log ub_number instead and drop the unused header argument. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit ed9f54cc1e335096733aed03c2a46de3d58922ed Author: Caleb Sander Mateos Date: Fri Jan 30 10:14:13 2026 -0700 ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd struct ublksrv_ctrl_cmd is part of the io_uring_sqe, which may lie in userspace-mapped memory. It's racy to access its fields with normal loads, as userspace may write to them concurrently. Use READ_ONCE() to copy the ublksrv_ctrl_cmd from the io_uring_sqe to the stack. Use the local copy in place of the one in the io_uring_sqe. Fixes: 87213b0d847c ("ublk: allow non-blocking ctrl cmds in IO_URING_F_NONBLOCK issue") Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit da7e4b75e50c087d2031a92f6646eb90f7045a67 Author: Govindarajulu Varadarajan Date: Fri Jan 30 10:14:12 2026 -0700 ublk: Validate SQE128 flag before accessing the cmd ublk_ctrl_cmd_dump() accesses (header *)sqe->cmd before IO_URING_F_SQE128 flag check. This could cause out of boundary memory access. Move the SQE128 flag check earlier in ublk_ctrl_uring_cmd() to return -EINVAL immediately if the flag is not set. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Govindarajulu Varadarajan Reviewed-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 012ea376a5948b025f260aa45d2a6ec5d96674ea Author: Thomas Weissschuh Date: Wed Jan 7 10:56:33 2026 +0100 ARM: 9467/1: mm: Don't use %pK through printk Restricted pointers ("%pK") were never meant to be used through printk(). They can acquire sleeping locks in atomic contexts. Switch to %px over the more secure %p as this usage is a debugging aid, gated behind CONFIG_DEBUG_VIRTUAL and used by WARN(). Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ Signed-off-by: Thomas Weißschuh Signed-off-by: Russell King (Oracle) commit cda0cbfdeefe7690370595f72be277de0ad7b096 Merge: c7fbf8d9b808ff f4e72ad7c161d6 Author: Alexei Starovoitov Date: Fri Jan 30 21:13:48 2026 -0800 Merge branch 'bpf-unify-special-map-field-validation-in-verifier' Mykyta Yatsenko says: ==================== The BPF verifier validates pointers to special map fields (timers, workqueues, task_work) through separate functions that share nearly identical logic. This creates code duplication because of the inconsistent data structure layout in struct bpf_call_arg_meta struct bpf_kfunc_call_arg_meta. This series contains 2 commits: 1. Introduces struct bpf_map_desc to provide a unified representation for map pointer and uid tracking. Previously, bpf_call_arg_meta used separate map_ptr and map_uid fields while bpf_kfunc_call_arg_metaused an anonymous inline struct. This inconsistency made it harder to share validation code between the two paths. 2. Consolidates the validation logic for BPF_TIMER, BPF_WORKQUEUE, and BPF_TASK_WORK field types into a single check_map_field_pointer() function. This eliminates process_wq_func() and process_task_work_func() entirely, and simplifies process_timer_func() to just the PREEMPT_RT check before calling the unified validation. The result is fewer lines of code with clearer structure for future maintenance. Signed-off-by: Mykyta Yatsenko Changes in v2: - Added Signed-off-by to the top commit. - Link to v1: https://lore.kernel.org/r/20260129-verif_special_fields-v1-0-d310b7f146c8@meta.com ==================== Link: https://patch.msgid.link/20260130-verif_special_fields-v2-0-2c59e637da7d@meta.com Signed-off-by: Alexei Starovoitov commit f4e72ad7c161d6ee1466b42ce0acc5c4eb6164dd Author: Mykyta Yatsenko Date: Fri Jan 30 20:42:11 2026 +0000 bpf: Consolidate special map field validation in verifier Consolidate all logic for verifying special map fields in the single function check_map_field_pointer(). Acked-by: Eduard Zingerman Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260130-verif_special_fields-v2-2-2c59e637da7d@meta.com Signed-off-by: Alexei Starovoitov commit 98c4fd2963cb2bc5eae22b5365e6bbf3a5cd0f14 Author: Mykyta Yatsenko Date: Fri Jan 30 20:42:10 2026 +0000 bpf: Introduce struct bpf_map_desc in verifier Introduce struct bpf_map_desc to hold bpf_map pointer and map uid. Use this struct in both bpf_call_arg_meta and bpf_kfunc_call_arg_meta instead of having different representations: - bpf_call_arg_meta had separate map_ptr and map_uid fields - bpf_kfunc_call_arg_meta had an anonymous inline struct This unifies the map fields layout across both metadata structures, making the code more consistent and preparing for further refactoring of map field pointer validation. Acked-by: Eduard Zingerman Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260130-verif_special_fields-v2-1-2c59e637da7d@meta.com Signed-off-by: Alexei Starovoitov commit bc367775f60214312befa33f101b31fe74bba48a Author: Chao Yu Date: Fri Jan 30 21:28:09 2026 +0800 f2fs: introduce trace_f2fs_priority_update This patch introduces two new tracepoints for debug purpose. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 07de55cbf5762cb4a7e9e0db7aba5c10c8cfe079 Author: Chao Yu Date: Fri Jan 30 21:28:08 2026 +0800 f2fs: fix lock priority inversion issue If userspace thread has held f2fs rw semaphore, due to its low priority, it could be runnable or preempted state for long time, during the time, it will block high priority thread which is trying to grab the same rw semaphore, e.g. cp_rwsem, io_rwsem... To fix such issue, let's detect thread's priority when it tries to grab f2fs_rwsem lock, if the priority is lower than a priority threshold, let's uplift the priority before it enters into critical region of lock, and restore the priority after it leaves from critical region. Meanwhile, introducing two new sysfs nodes: - /sys/fs/f2fs//adjust_lock_priority, it is used to control whether the functionality is enable or not. ========== ================== Flag_Value Flag_Description ========== ================== 0x00000000 Disabled (default) 0x00000001 cp_rwsem 0x00000002 node_change 0x00000004 node_write 0x00000008 gc_lock 0x00000010 cp_global 0x00000020 io_rwsem ========== ================== - /sys/fs/f2fs//lock_duration_priority, it is used to control priority threshold. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d860974a7e38d35e9e2c4dc8a9f4223b38b6ad99 Author: Yeongjin Gil Date: Thu Jan 22 19:45:27 2026 +0900 f2fs: optimize f2fs_overwrite_io() for f2fs_iomap_begin When overwriting already allocated blocks, f2fs_iomap_begin() calls f2fs_overwrite_io() to check block mappings. However, f2fs_overwrite_io() iterates through all mapped blocks in the range, which can be inefficient for fragmented files with large I/O requests. This patch optimizes f2fs_overwrite_io() by adding a 'check_first' parameter and introducing __f2fs_overwrite_io() helper. When called from f2fs_iomap_begin(), we only check the first mapping to determine if the range is already allocated, which is sufficient for setting map.m_may_create. This optimization significantly reduces the number of f2fs_map_blocks() calls in f2fs_overwrite_io() when called from f2fs_iomap_begin(), especially for fragmented files with large I/O requests. Cc: stable@kernel.org Fixes: 351bc761338d ("f2fs: optimize f2fs DIO overwrites") Reviewed-by: Sungjong Seo Reviewed-by: Sunmin Jeong Signed-off-by: Yeongjin Gil Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit df31a6b0a3057e66994ad6ccf5d95b9b9514f033 Author: D. Wythe Date: Wed Jan 28 13:54:52 2026 +0800 Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into an SMC socket by modifying the underlying `struct file`, dentry, and inode in-place, which violates core VFS invariants that assume these structures are immutable for an open file, creating a risk of use after free errors and general system instability. Given the severity of this design flaw and the fact that cleaner alternatives (e.g., LD_PRELOAD, BPF) exist for legacy application transparency, the correct course of action is to remove this feature entirely. Fixes: d7cd421da9da ("net/smc: Introduce TCP ULP support") Link: https://lore.kernel.org/netdev/Yus1SycZxcd+wHwz@ZenIV/ Reported-by: Al Viro Signed-off-by: D. Wythe Reviewed-by: Tony Lu Reviewed-by: Dust Li Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260128055452.98251-1-alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 82fff3b055d498bde37104eab219be25af3ddbe9 Author: Ethan Nelson-Moore Date: Thu Jan 29 00:09:04 2026 -0800 net: ax25: remove plumbing for never-implemented DAMA Master support The AX25_DAMA_MASTER option has been unimplemented and marked broken ever since it was introduced in 2007 in commit 954b2e7f4c37 ("[NET] AX.25 Kconfig and docs updates and fixes"). At this point, it is very unlikely it will be implemented. Remove it. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260129080908.44710-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 64ae90a81aa4a5e51d0b4c2e836778ef40295651 Author: Robert Marko Date: Thu Jan 15 12:37:30 2026 +0100 dt-bindings: crypto: atmel,at91sam9g46-sha: add microchip,lan9691-sha Document Microchip LAN969x SHA compatible. Signed-off-by: Robert Marko Acked-by: Conor Dooley Reviewed-by: Claudiu Beznea Signed-off-by: Herbert Xu commit 7f39ea40d4afc578bdd54b526fb1ba3ab2973c6a Author: Robert Marko Date: Thu Jan 15 12:37:29 2026 +0100 dt-bindings: crypto: atmel,at91sam9g46-aes: add microchip,lan9691-aes Document Microchip LAN969x AES compatible. Signed-off-by: Robert Marko Acked-by: Conor Dooley Reviewed-by: Claudiu Beznea Signed-off-by: Herbert Xu commit 85faec1e8555596e24e2556e5790dd6b3948a321 Author: Luca Weiss Date: Mon Jan 12 14:53:14 2026 +0100 dt-bindings: crypto: qcom,inline-crypto-engine: document the Milos ICE Document the Inline Crypto Engine (ICE) on the Milos SoC. Acked-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Signed-off-by: Herbert Xu commit 7d43252b3060b0ba4a192dce5dba85a3f39ffe39 Author: Jianpeng Chang Date: Tue Jan 20 09:55:24 2026 +0800 crypto: caam - fix netdev memory leak in dpaa2_caam_probe When commit 0e1a4d427f58 ("crypto: caam: Unembed net_dev structure in dpaa2") converted embedded net_device to dynamically allocated pointers, it added cleanup in dpaa2_dpseci_disable() but missed adding cleanup in dpaa2_dpseci_free() for error paths. This causes memory leaks when dpaa2_dpseci_dpio_setup() fails during probe due to DPIO devices not being ready yet. The kernel's deferred probe mechanism handles the retry successfully, but the netdevs allocated during the failed probe attempt are never freed, resulting in kmemleak reports showing multiple leaked netdev-related allocations all traced back to dpaa2_caam_probe(). Fix this by preserving the CPU mask of allocated netdevs during setup and using it for cleanup in dpaa2_dpseci_free(). This approach ensures that only the CPUs that actually had netdevs allocated will be cleaned up, avoiding potential issues with CPU hotplug scenarios. Fixes: 0e1a4d427f58 ("crypto: caam: Unembed net_dev structure in dpaa2") Signed-off-by: Jianpeng Chang Reviewed-by: Breno Leitao Signed-off-by: Herbert Xu commit 6d0de6014b98c5051bb3427e97db7c62d9454f89 Author: Weili Qian Date: Sat Jan 17 18:18:06 2026 +0800 crypto: hisilicon/qm - increase wait time for mailbox The device requires more time to process queue stop and function stop mailbox commands compared to other mailbox commands . In the current driver, the mailbox processing wait time for queue stop and function stop is less than the device timeout, which may cause the driver to incorrectly assume that the mailbox processing has failed. Therefore, the driver wait time for queue stop and function stop should be set to be greater than the device timeout. And PF and VF communication relies on mailbox, the communication wait time should also be modified. Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 3296992ffc4362fff6e8fb979090b4638f50e066 Author: Weili Qian Date: Sat Jan 17 18:18:05 2026 +0800 crypto: hisilicon/qm - obtain the mailbox configuration at one time The malibox needs to be triggered by a 128bit atomic operation. The reason is that the PF and VFs of the device share the mmio memory of the mailbox, and the mutex cannot lock mailbox operations in different functions, especially when passing through VFs to virtual machines. Currently, the write operation to the mailbox is already a 128-bit atomic write. The read operation also needs to be modified to a 128-bit atomic read. Since there is no general 128-bit IO memory access API in the current ARM64 architecture, and the stp and ldp instructions do not guarantee atomic access to device memory, they cannot be extracted as a general API. Therefore, the 128-bit atomic read and write operations need to be implemented in the driver. Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit fc8ae11b84458673a3000ab3caa9617d849fc260 Author: Weili Qian Date: Sat Jan 17 18:18:04 2026 +0800 crypto: hisilicon/qm - remove unnecessary code in qm_mb_write() Since the HiSilicon accelerator is used only on the ARM64 architectures, the implementations for other architectures are not needed, so remove the unnecessary code. Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit ebf35d8f9368816c930f5d70783a72716fab5e19 Author: Chenghai Huang Date: Sat Jan 17 18:18:03 2026 +0800 crypto: hisilicon/qm - move the barrier before writing to the mailbox register Before sending the data via the mailbox to the hardware, to ensure that the data accessed by the hardware is the most up-to-date, a write barrier should be added before writing to the mailbox register. The current memory barrier is placed after writing to the register, the barrier order should be modified to be before writing to the register. Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 3d3135057ff567d5c09fff4c9ef6391a684e8042 Author: Weili Qian Date: Sat Jan 17 15:18:21 2026 +0800 crypto: hisilicon/trng - support tfms sharing the device Since the number of devices is limited, and the number of tfms may exceed the number of devices, to ensure that tfms can be successfully allocated, support tfms sharing the same device. Fixes: e4d9d10ef4be ("crypto: hisilicon/trng - add support for PRNG") Signed-off-by: Weili Qian Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit ea377793f41989e425498f50ec0c76c70567c1ae Author: Chenghai Huang Date: Sat Jan 17 10:34:35 2026 +0800 crypto: hisilicon/zip - add lz4 algorithm for hisi_zip Add the "hisi-lz4-acomp" algorithm by the crypto acomp. When the 8th bit of the capability register is 1, the lz4 algorithm will register to crypto acomp, and the window length is configured to 16K by default. Since the "hisi-lz4-acomp" currently only support compression direction, decompression is completed by the soft lz4 algorithm. Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 9d58d22f367f6fc08f949b1ba9625e56414be92a Author: Harald Freudenberger Date: Thu Jan 15 13:00:26 2026 +0100 crypto: s390/paes - Refuse clear key material by default This patch exploits the new xflag PKEY_XFLAG_NOCLEARKEY from the pkey layer. So now by default all the paes algorithms refuse the use of clear key material ("clear key tokens") in the setkey function with -EINVAL. With a new kernel module parameter "clrkey" this behavior can be controlled. By default clrkey is 'N' but for testing purpose on module load a true value (1, 'Y') may be given to accept clear key tokens. Note that during selftest clear keys are always used and thus the xflag PKEY_XFLAG_NOCLEARKEY is NOT set as long as the algorithm is in a larval state indicated by crypto_skcipher_tested() returning false. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Reviewed-by: Ingo Franzki Signed-off-by: Herbert Xu commit 452770a4fafcdb2d80bb793a91aec9ff84769fdc Author: Harald Freudenberger Date: Thu Jan 15 13:00:25 2026 +0100 crypto: s390/phmac - Refuse clear key material by default This patch exploits the new xflag PKEY_XFLAG_NOCLEARKEY from the pkey layer. So now by default the phmac refuses the use of clear key material ("clear key tokens") in the setkey function with -EINVAL. With a new kernel module parameter "clrkey" this behavior can be controlled. By default clrkey is 'N' but for testing purpose on module load a true value (1, 'Y') may be given to accept clear key tokens. Note that during selftest clear keys are always used and thus the xflag PKEY_XFLAG_NOCLEARKEY is NOT set as long as the algorithm is in a larval state indicated by crypto_ahash_tested() returning false. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Reviewed-by: Ingo Franzki Signed-off-by: Herbert Xu commit 2dfca611197e4ac0fcca03dc82594bab38464964 Author: Harald Freudenberger Date: Thu Jan 15 13:00:24 2026 +0100 s390/pkey: Support new xflag PKEY_XFLAG_NOCLEARKEY Introduce a new xflag PKEY_XFLAG_NOCLEARKEY which when given refuses the conversion of "clear key tokens" to protected key material. Some algorithms (PAES, PHMAC) have the need to construct "clear key tokens" to be used during selftest. But in general these algorithms should only support clear key material for testing purpose. So now the algorithm implementation can signal via xflag PKEY_XFLAG_NOCLEARKEY that a conversion of clear key material to protected key is not acceptable and thus the pkey layer (usually one of the handler modules) refuses clear key material with -EINVAL. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Reviewed-by: Ingo Franzki Signed-off-by: Herbert Xu commit cf0840cc7f578c21e64810ef85e838d44d275d9c Author: Harald Freudenberger Date: Thu Jan 15 13:00:23 2026 +0100 crypto: skcipher - Add new helper function crypto_skcipher_tested Add a new helper function crypto_skcipher_tested() which evaluates the CRYPTO_ALG_TESTED flag from the tfm base cra_flags field. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Reviewed-by: Ingo Franzki Signed-off-by: Herbert Xu commit 9c5582db77199f8fbcf45e531198df5b97d5ee7f Author: Thorsten Blum Date: Tue Jan 13 09:31:28 2026 +0100 crypto: stm32 - Replace min_t(size_t) with just min() In most cases, min_t(size_t) and explicit casting are unnecessary because the values ->hw_blocksize, ->payload_{in,out}, and ->header_in are already of type 'size_t'. Use the simpler min() macro instead. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit f42116458d01e9bb8586613063028ab8c7070856 Author: Bibo Mao Date: Tue Jan 13 11:05:56 2026 +0800 crypto: virtio - Replace package id with numa node id With multiple virtio crypto devices supported with different NUMA nodes, when crypto session is created, it will search virtio crypto device with the same numa node of current CPU. Here API topology_physical_package_id() is replaced with cpu_to_node() since package id is physical concept, and one package id have multiple memory numa id. Signed-off-by: Bibo Mao Acked-by: Michael S. Tsirkin Signed-off-by: Herbert Xu commit 14f86a1155cca1176abf55987b2fce7f7fcb2455 Author: Bibo Mao Date: Tue Jan 13 11:05:55 2026 +0800 crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req With function virtio_crypto_skcipher_crypt_req(), there is already virtqueue_kick() call with spinlock held in function __virtio_crypto_skcipher_do_req(). Remove duplicated virtqueue_kick() function call here. Fixes: d79b5d0bbf2e ("crypto: virtio - support crypto engine framework") Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: Herbert Xu commit b505047ffc8057555900d2d3a005d033e6967382 Author: Bibo Mao Date: Tue Jan 13 11:05:54 2026 +0800 crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this: virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well. Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet") Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: Herbert Xu commit eec90ea4ef946d40d82286878477d8becb7cb450 Merge: db2733d4c435e0 209111d694ddd7 Author: Jakub Kicinski Date: Fri Jan 30 18:27:02 2026 -0800 Merge branch 'net-wwan-add-nmea-port-type-support' Slark Xiao says: ==================== net: wwan: add NMEA port type support The series introduces a long discussed NMEA port type support for the WWAN subsystem. There are two goals. From the WWAN driver perspective, NMEA exported as any other port type (e.g. AT, MBIM, QMI, etc.). From user space software perspective, the exported chardev belongs to the GNSS class what makes it easy to distinguish desired port and the WWAN device common to both NMEA and control (AT, MBIM, etc.) ports makes it easy to locate a control port for the GNSS receiver activation. Done by exporting the NMEA port via the GNSS subsystem with the WWAN core acting as proxy between the WWAN modem driver and the GNSS subsystem. The series starts from a cleanup patch. Then three patches prepares the WWAN core for the proxy style operation. Followed by a patch introding a new WWNA port type, integration with the GNSS subsystem and demux. The series ends with a couple of patches that introduce emulated EMEA port to the WWAN HW simulator. The series is the product of the discussion with Loic about the pros and cons of possible models and implementation. Also Muhammad and Slark did a great job defining the problem, sharing the code and pushing me to finish the implementation. Daniele has caught an issue on driver unloading and suggested an investigation direction. What was concluded by Loic. Many thanks. ==================== Link: https://patch.msgid.link/20260126062158.308598-1-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 209111d694ddd7d04961e43a3abeb626cc587b16 Author: Slark Xiao Date: Mon Jan 26 14:21:58 2026 +0800 net: wwan: mhi_wwan_ctrl: Add NMEA channel support For MHI WWAN device, we need a match between NMEA channel and WWAN_PORT_NMEA type. Then the GNSS subsystem could create the gnss device succssfully. Signed-off-by: Slark Xiao Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20260126062158.308598-9-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 193985d1e447d20dc4225550fa8ff24d340a535e Author: Sergey Ryazanov Date: Mon Jan 26 14:21:57 2026 +0800 net: wwan: hwsim: support NMEA port emulation Support NMEA port emulation for the WWAN core GNSS port testing purpose. Emulator produces pair of GGA + RMC sentences every second what should be enough to fool gpsd into believing it is working with a NMEA GNSS receiver. If the GNSS system is enabled then one NMEA port will be created automatically for the simulated WWAN device. Manual NMEA port creation is not supported at the moment. Signed-off-by: Sergey Ryazanov Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20260126062158.308598-8-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit f5b8065e1f1be0e630a009f4c183805683c8fe88 Author: Sergey Ryazanov Date: Mon Jan 26 14:21:56 2026 +0800 net: wwan: hwsim: refactor to support more port types Just introduced WWAN NMEA port type needs a testing option. The WWAN HW simulator was developed with the AT port type in mind and cannot be easily extended. Refactor it now to make it capable to support more port types. No big functional changes, mostly renaming with a little code rearrangement. Signed-off-by: Sergey Ryazanov Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20260126062158.308598-7-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 5b2e294e0cd1380886db700b5b2907a68adab5c7 Author: Sergey Ryazanov Date: Mon Jan 26 14:21:55 2026 +0800 net: wwan: add NMEA port support Many WWAN modems come with embedded GNSS receiver inside and have a dedicated port to output geopositioning data. On the one hand, the GNSS receiver has little in common with WWAN modem and just shares a host interface and should be exported using the GNSS subsystem. On the other hand, GNSS receiver is not automatically activated and needs a generic WWAN control port (AT, MBIM, etc.) to be turned on. And a user space software needs extra information to find the control port. Introduce the new type of WWAN port - NMEA. When driver asks to register a NMEA port, the core allocates common parent WWAN device as usual, but exports the NMEA port via the GNSS subsystem and acts as a proxy between the device driver and the GNSS subsystem. From the WWAN device driver perspective, a NMEA port is registered as a regular WWAN port without any difference. And the driver interacts only with the WWAN core. From the user space perspective, the NMEA port is a GNSS device which parent can be used to enumerate and select the proper control port for the GNSS receiver management. CC: Slark Xiao CC: Muhammad Nuzaihan CC: Qiang Yu CC: Manivannan Sadhasivam CC: Johan Hovold Suggested-by: Loic Poulain Signed-off-by: Sergey Ryazanov Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20260126062158.308598-6-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 0868ea3471101aaf4d6498ac73b42bc975820303 Author: Sergey Ryazanov Date: Mon Jan 26 14:21:54 2026 +0800 net: wwan: core: split port unregister and stop Upcoming GNSS (NMEA) port type support requires exporting it via the GNSS subsystem. On another hand, we still need to do basic WWAN core work: call the port stop operation, purge queues, release the parent WWAN device, etc. To reuse as much code as possible, split the port unregistering function into the deregistration of a regular WWAN port device, and the common port tearing down code. In order to keep more code generic, break the device_unregister() call into device_del() and put_device(), which release the port memory uniformly. Signed-off-by: Sergey Ryazanov Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20260126062158.308598-5-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit dccd23a673ca09505b53fe10bccdd0421ad6cf80 Author: Sergey Ryazanov Date: Mon Jan 26 14:21:53 2026 +0800 net: wwan: core: split port creation and registration Upcoming GNSS (NMEA) port type support requires exporting it via the GNSS subsystem. On another hand, we still need to do basic WWAN core work: find or allocate the WWAN device, make it the port parent, etc. To reuse as much code as possible, split the port creation function into the registration of a regular WWAN port device, and basic port struct initialization. To be able to use put_device() uniformly, break the device_register() call into device_initialize() and device_add() and call device initialization earlier. While at it, fix a minor number leak upon WWAN port registration failure. Signed-off-by: Sergey Ryazanov Link: https://patch.msgid.link/20260126062158.308598-4-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit b9879ba78dca3da61448b52751551da2bb52469c Author: Sergey Ryazanov Date: Mon Jan 26 14:21:52 2026 +0800 net: wwan: core: explicit WWAN device reference counting We need information about existing WWAN device children since we remove the device after removing the last child. Previously, we tracked users implicitly by checking whether ops was registered and existence of a child device of the wwan_class class. Upcoming GNSS (NMEA) port type support breaks this approach by introducing a child device of the gnss_class class. And a modem driver can easily trigger a kernel Oops by removing regular (e.g., MBIM, AT) ports first and then removing a GNSS port. The WWAN device will be unregistered on removal of a last regular WWAN port. And subsequent GNSS port removal will cause NULL pointer dereference in simple_recursive_removal(). In order to support ports of classes other than wwan_class, switch to explicit references counting. Introduce a dedicated counter to the WWAN device struct, increment it on every wwan_create_dev() call, decrement on wwan_remove_dev(), and actually unregister the WWAN device when there are no more references. Run tested with wwan_hwsim with NMEA support patches applied and different port removing sequences. Reported-by: Daniele Palmas Closes: https://lore.kernel.org/netdev/CAGRyCJE28yf-rrfkFbzu44ygLEvoUM7fecK1vnrghjG_e9UaRA@mail.gmail.com/ Suggested-by: Loic Poulain Signed-off-by: Sergey Ryazanov Link: https://patch.msgid.link/20260126062158.308598-3-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit d95c5aa45231400f9ecfd4b2cbf093e7c7accd8b Author: Sergey Ryazanov Date: Mon Jan 26 14:21:51 2026 +0800 net: wwan: core: remove unused port_id field It was used initially for a port id allocation, then removed, and then accidently introduced again, but it is still unused. Drop it again to keep code clean. Signed-off-by: Sergey Ryazanov Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20260126062158.308598-2-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit db2733d4c435e09832b5d664b4472d012868886f Merge: 44ecaff55282ed df04373b0dab39 Author: Jakub Kicinski Date: Fri Jan 30 17:57:17 2026 -0800 Merge branch 'eth-fbnic-add-debugfs-for-mbx-and-tx-rx' Mike Marciniszyn says: ==================== eth fbnic: Add debugfs for mbx and tx/rx This patches adds debugfs read of the firmware mailbox tx/rx and of the tx/rx rings for each napi vector. ==================== Link: https://patch.msgid.link/20260127200644.11640-1-mike.marciniszyn@gmail.com Signed-off-by: Jakub Kicinski commit df04373b0dab3985769773e011eb61264a4055a3 Author: Mike Marciniszyn (Meta) Date: Tue Jan 27 15:06:44 2026 -0500 eth fbnic: Add debugfs hooks for tx/rx rings Add debugfs hooks to display tx/rx rings for each napi vector. Note that the cloning mechanism in fbnic_ethtool.c for configuration changes protects against concurrency issues with simultaneous config changes along with debugs ring accesses. The configuration switch builds up the new configuration offline, takes the current config down, which removes the debugfs nv files, and switches to the new configuration. The new configuration is brought up which brings the debugfs files back on top of the new configuration rings. The interaction with fbnic_queue_stop() and fbnic_queue_start() will similarly delete and add the files for the indicated vector. Signed-off-by: Mike Marciniszyn (Meta) Link: https://patch.msgid.link/20260127200644.11640-3-mike.marciniszyn@gmail.com Signed-off-by: Jakub Kicinski commit ac7b803c2dd57938cbf1e9a3ada23471925a5d46 Author: Mike Marciniszyn (Meta) Date: Tue Jan 27 15:06:43 2026 -0500 eth fbnic: Add debugfs hooks for firmware mailbox This patch adds reporting the Rx and Tx information interfacing with the firmware. The result of reading fbnic/fw_mbx is: Rx Rdy: 1 Head: 11 Tail: 10 Idx Len E Addr F H Raw ---------------------------------- 00 4096 0 000101fea000 0 1 1000000101fea001 01 4096 0 000101feb000 0 1 1000000101feb001 . . . 15 4096 0 000101fe9000 0 1 1000000101fe9001 Tx Rdy: 1 Head: 4 Tail: 4 Idx Len E Addr F H Raw ---------------------------------- 00 0004 1 00010321b000 1 1 000440010321b003 01 0004 1 00010228d000 1 1 000440010228d003 . . . 15 0004 1 00010321b000 1 1 000440010321b003 Signed-off-by: Mike Marciniszyn (Meta) Link: https://patch.msgid.link/20260127200644.11640-2-mike.marciniszyn@gmail.com Signed-off-by: Jakub Kicinski commit 44ecaff55282ed89f9ea94036563249961bf2343 Author: Ethan Nelson-Moore Date: Wed Jan 28 20:23:01 2026 -0800 net: usb: remove unnecessary get_drvinfo code and driver versions Many USB network drivers define get_drvinfo functions which add no value over usbnet_get_drvinfo, only setting the driver name and version. usbnet_get_drvinfo automatically sets the driver name, and separate driver versions are now frowned upon in the kernel. Remove all driver versions and replace these get_drvinfo functions with references to usbnet_get_drvinfo where possible. Where that is not possible, remove unnecessary code to set the driver name. Also remove two unnecessary initializations from aqc111_get_drvinfo, an inaccurate comment in pegasus.c, and an unused macro in catc.c. Reviewed-by: Andrew Lunn Reviewed-by: Andy Shevchenko Reviewed-by: Peter Korsgaard (for dm9601.c) Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260129042435.13395-2-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 96e1c895b5ecb759ac2bbf72cb0d0ddf3634114f Author: Simon Horman Date: Thu Jan 29 17:35:03 2026 +0000 net: stmmac: spelling corrections Correct spelling as flagged by codespell. Signed-off-by: Simon Horman Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260129-stmmac-spell-v1-1-c7df9a96e482@kernel.org Signed-off-by: Jakub Kicinski commit 43dc088c19a60200e85c0da58d76c10094236fdd Author: Raju Rangoju Date: Thu Jan 29 16:45:20 2026 +0530 amd-xgbe: add support for rx alignment errors Add the support to read the rx alignment errors and update them in the standard rtnl_link_stats64 structure. Signed-off-by: Raju Rangoju Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260129111520.1567097-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 820990d66577de2afeed41f26250ba4fd8a59ca7 Author: Mahdi Faramarzpour Date: Thu Jan 29 12:08:06 2026 +0330 udp: add drop count for packets in udp_prod_queue This commit adds SNMP drop count increment for the packets in per NUMA queues which were introduced in commit b650bf0977d3 ("udp: remove busylock and add per NUMA queues"). note that SNMP counters are incremented currently by the caller for skb. And that these skbs on the intermediate queue cannot be counted there so need similar logic in their error path. Signed-off-by: Mahdi Faramarzpour Reviewed-by: Willem de Bruijn Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260129083806.204752-1-mahdifrmx@gmail.com Signed-off-by: Jakub Kicinski commit ed9b70040d7b22552f1392bed529ef0861f2a25c Author: Eric Dumazet Date: Thu Jan 29 15:34:58 2026 +0000 tcp: reduce tcp sockets size by one cache line By default, when a kmem_cache is created with SLAB_TYPESAFE_BY_RCU, slub has to use extra storage for the freelist pointer after each object, because slub assumes that any bit in the object can be used by RCU readers. Because proto_register() is also using SLAB_HWCACHE_ALIGN, this forces slub to use one extra cache line per object. We can instead put the slub freelist anywhere in the object, granted the concurrent RCU readers are not supposed to use the pointer value. Add a new (struct sock)sk_freeptr field, in an union with sk_rcu: No RCU readers would need to look at sk_rcu, which is only used at free phase. Tested: grep . /sys/kernel/slab/TCP/{object_size,slab_size,objs_per_slab} grep . /sys/kernel/slab/TCPv6/{object_size,slab_size,objs_per_slab} Before: /sys/kernel/slab/TCP/object_size:2368 /sys/kernel/slab/TCP/slab_size:2432 /sys/kernel/slab/TCP/objs_per_slab:13 /sys/kernel/slab/TCPv6/object_size:2496 /sys/kernel/slab/TCPv6/slab_size:2560 /sys/kernel/slab/TCPv6/objs_per_slab:12 After this patch, we can pack one more TCPv6 object per slab, and object_size == slab_size. /sys/kernel/slab/TCP/object_size:2368 /sys/kernel/slab/TCP/slab_size:2368 /sys/kernel/slab/TCP/objs_per_slab:13 /sys/kernel/slab/TCPv6/object_size:2496 /sys/kernel/slab/TCPv6/slab_size:2496 /sys/kernel/slab/TCPv6/objs_per_slab:13 Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260129153458.4163797-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit cb9b6f9d2be6bda1b0117b147df40f982ce06888 Author: Vivian Wang Date: Thu Jan 29 09:56:09 2026 +0800 ALSA: hda/intel: Make MSI address limit based on the device DMA limit The hda/intel driver restricts the MSI message address for devices which do not advertise full 64-bit DMA address space support to 32-bit due to the former restrictions of the PCI/MSI code which only allowed either 32-bit or a full 64-bit address range. This does not work on platforms which have a MSI doorbell address above the 32-bit boundary but do not support the full 64 bit address range. The PCI/MSI core converted this binary decision to a DMA_BIT_MASK() based decision, which allows to describe the device limitations precisely. Convert the driver to provide the exact DMA address limitations to the PCI/MSI core. That allows devices which do not support the full 64-bit address space to work on platforms which have a MSI doorbell address above the 32-bit limit as long as it is within the hardware's addressable range. [ tglx: Massage changelog ] Signed-off-by: Vivian Wang Signed-off-by: Thomas Gleixner Acked-by: Takashi Iwai Link: https://patch.msgid.link/20260129-pci-msi-addr-mask-v4-4-70da998f2750@iscas.ac.cn commit 617562bbe12df796fc21df5fbf262eadf083a90f Author: Vivian Wang Date: Thu Jan 29 09:56:08 2026 +0800 drm/radeon: Make MSI address limit based on the device DMA limit The radeon driver restricts the MSI message address for devices older than the BONAIR generation to 32-bit MSI addresses due to the former restrictions of the PCI/MSI code which only allowed either 32-bit or full 64-bit address range. This does not work on platforms which have a MSI doorbell address above the 32-bit boundary but do not support the full 64 bit address range. The PCI/MSI core converted this binary decision to a DMA_BIT_MASK() based decision, which allows to describe the device limitations precisely. Convert the driver to provide the exact DMA address limitations to the PCI/MSI core. That allows devices which do not support the full 64-bit address space to work on platforms which have a MSI doorbell address above the 32-bit limit as long as it is within the hardware's addressable range. [ tglx: Massage changelog ] Signed-off-by: Vivian Wang Signed-off-by: Thomas Gleixner Reviewed-by: Christian König Link: https://patch.msgid.link/20260129-pci-msi-addr-mask-v4-3-70da998f2750@iscas.ac.cn commit 52f0d862f595a2fa18ef44532619a080c24fe4cb Author: Vivian Wang Date: Thu Jan 29 09:56:07 2026 +0800 PCI/MSI: Check the device specific address mask in msi_verify_entries() Instead of a 32-bit/64-bit dichotomy, check the MSI address against the device specific address mask. This allows platforms with an MSI doorbell address above the 32-bit limit to work with devices without full 64-bit MSI address support, as long as the doorbell is within the addressable range of the device. [ tglx: Massaged changelog ] Signed-off-by: Vivian Wang Signed-off-by: Thomas Gleixner Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/20260129-pci-msi-addr-mask-v4-2-70da998f2750@iscas.ac.cn commit 386ced19e9a348e8131d20f009e692fa8fcc4568 Author: Vivian Wang Date: Thu Jan 29 09:56:06 2026 +0800 PCI/MSI: Convert the boolean no_64bit_msi flag to a DMA address mask Some PCI devices have PCI_MSI_FLAGS_64BIT in the MSI capability, but implement less than 64 address bits. This breaks on platforms where such a device is assigned an MSI address higher than what's supported. Currently, no_64bit_msi bit is set for these devices, meaning that only 32-bit MSI addresses are allowed for them. However, on some platforms the MSI doorbell address is above the 32-bit limit but within the addressable range of the device. As a first step to enable MSI on those combinations of devices and platforms, convert the boolean no_64bit_msi flag to a DMA mask and fixup the affected usage sites: - no_64bit_msi = 1 -> msi_addr_mask = DMA_BIT_MASK(32) - no_64bit_msi = 0 -> msi_addr_mask = DMA_BIT_MASK(64) - if (no_64bit_msi) -> if (msi_addr_mask < DMA_BIT_MASK(64)) Since no values other than DMA_BIT_MASK(32) and DMA_BIT_MASK(64) are used, this is functionally equivalent. This prepares for changing the binary decision between 32 and 64 bit to a DMA mask based decision which allows to support systems which have a DMA address space less than 64bit but a MSI doorbell address above the 32-bit limit. [ tglx: Massaged changelog ] Signed-off-by: Vivian Wang Signed-off-by: Thomas Gleixner Reviewed-by: Brett Creeley # ionic Reviewed-by: Thomas Gleixner Acked-by: Takashi Iwai # sound Link: https://patch.msgid.link/20260129-pci-msi-addr-mask-v4-1-70da998f2750@iscas.ac.cn commit 8eeb611b3d16241559bbf81ae5d938368c87818c Author: Lorenz Brun Date: Tue Dec 23 13:57:26 2025 +0100 rtc: s35390a: implement nvmem support This RTC has one "free" register which can be used to store arbitrary data. Expose it as a nvmem resource in Linux. Signed-off-by: Lorenz Brun Link: https://patch.msgid.link/20251223125728.346073-1-lorenz@monogon.tech Signed-off-by: Alexandre Belloni commit 770a54accf80fa6b68df0753eb0c527a4ecf5402 Author: Binbin Zhou Date: Sat Jan 17 10:26:50 2026 +0800 rtc: loongson: Add Loongson-2K0300 support The Loongson-2K0300's rtc hardware design is similar to that of the Loongson-1B, but it does not support the alarm feature. Introduce `LOONGSON_RTC_ALARM_WORKAROUND`, which indicates a chip that does not support the alarm feature, and rewrite the related logic in `loongson_rtc_alarm_setting()`. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://patch.msgid.link/abff68dda2fe6a6601a9e58b31e278d941297fce.1768616276.git.zhoubinbin@loongson.cn Signed-off-by: Alexandre Belloni commit 5d4899d4859f812290bf2fc458a517781fe6eeca Author: Binbin Zhou Date: Sat Jan 17 10:26:49 2026 +0800 dt-bindings: rtc: loongson: Document Loongson-2K0300 compatible Add "loongson,ls2k0300-rtc" dedicated compatible to represent the RTC interface of the Loongson-2K0300 chip. Its hardware design is similar to that of the Loongson-1B, but it does not support the alarm feature. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Acked-by: Conor Dooley Link: https://patch.msgid.link/0c6a4fd221b5bf05f06cae9bb543a5bf7ea59f57.1768616276.git.zhoubinbin@loongson.cn Signed-off-by: Alexandre Belloni commit da9934a6583adc40ac0c9cc21e7419617ad985fd Author: Binbin Zhou Date: Sat Jan 17 10:26:48 2026 +0800 dt-bindings: rtc: loongson: Correct Loongson-1C interrupts property The `interrupts` property indicates an RTC alarm interrupt, which is required for RTCs that support the alarm feature, which is not supported by the Loongson-1C RTC. We exclude it for a more accurate description. Changing the `allowed` property is ABI-breaking behavior, but throughout the existing Loongson DTS{i}, the description of the RTC nodes conforms to the modified bingding rules. Thus, the existing Loongson DTS{i} will not be affected. Fixes: 487ef32caebe ("dt-bindings: rtc: Split loongson,ls2x-rtc into SoC-based compatibles") Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Acked-by: Conor Dooley Link: https://patch.msgid.link/b6295c907410f6708115cba4df0959ee6629f8a5.1768616276.git.zhoubinbin@loongson.cn Signed-off-by: Alexandre Belloni commit f3ac75cfacc66f48523e730646dbbc2f19844799 Author: Ovidiu Panait Date: Sun Jan 25 19:27:03 2026 +0000 dt-bindings: rtc: renesas,rz-rtca3: Add RZ/V2N support The Renesas RZ/V2N (r9a09g056) RTC is identical to the RZ/V2H (r9a09g057) variant. Add the compatible string for RZ/V2N and extend the existing RZ/V2H reset configuration to cover both variants. Signed-off-by: Ovidiu Panait Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260125192706.27099-4-ovidiu.panait.rb@renesas.com Signed-off-by: Alexandre Belloni commit ed318b3fb4ab317c533d38d160326fa5d7569497 Author: Adrian Ng Ho Yin Date: Tue Jan 27 10:05:07 2026 +0800 i3c: dw-i3c-master: fix SIR reject bit mapping for dynamic addresses The IBI_SIR_REQ_REJECT register is a 32-bit bitmap indexed by the dynamic address of each I3C slave. The DesignWare controller derives the bit index by folding the 7-bit dynamic address into a 5-bit value, using the sum of the lower 5 bits and the upper 2 bits, modulo 32. The current implementation incorrectly uses the device table index when updating the SIR reject mask, which can result in rejecting or accepting IBIs for the wrong device. Compute the SIR reject bit index directly from the dynamic address, as defined by the controller specification, and use it consistently when updating the reject mask. Signed-off-by: Adrian Ng Ho Yin Reviewed-by: Frank Li Link: https://patch.msgid.link/d4ad8161e604156c60327060ad3d339ebf18fe4f.1769479330.git.adrianhoyin.ng@altera.com Signed-off-by: Alexandre Belloni commit c7311aa4a71ebbf6e86e3173e04afbad233a3937 Author: Adrian Ng Ho Yin Date: Tue Jan 27 10:05:06 2026 +0800 i3c: dw-i3c-master: convert spinlock usage to scoped guards Convert dw-i3c-master to use scoped spinlock guards in place of open-coded spin_lock_irqsave()/spin_unlock_irqrestore() pairs to ensure locks are always safely released on scope exit. Signed-off-by: Adrian Ng Ho Yin Reviewed-by: Frank Li Link: https://patch.msgid.link/79020c006c15dda9d057946530f16cfb4650d450.1769479330.git.adrianhoyin.ng@altera.com Signed-off-by: Alexandre Belloni commit 2537089413514caaa9a5fdeeac3a34d45100f747 Author: Zilin Guan Date: Mon Jan 26 08:11:21 2026 +0000 i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() The dw_i3c_master_i2c_xfers() function allocates memory for the xfer structure using dw_i3c_master_alloc_xfer(). If pm_runtime_resume_and_get() fails, the function returns without freeing the allocated xfer, resulting in a memory leak. Add a dw_i3c_master_free_xfer() call to the error path to ensure the allocated memory is properly freed. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 62fe9d06f570 ("i3c: dw: Add power management support") Signed-off-by: Zilin Guan Reviewed-by: Frank Li Link: https://patch.msgid.link/20260126081121.644099-1-zilin@seu.edu.cn Signed-off-by: Alexandre Belloni commit 4280197d154cae1d1d5acb54484da26da04eac32 Author: Adrian Hunter Date: Fri Jan 23 08:33:25 2026 +0200 i3c: mipi-i3c-hci-pci: Add System Suspend support Assign the driver PM operations pointer, which is necessary for the PCI subsystem to put the device into a low power state. Refer to pci_pm_suspend_noirq() which bails out if the pointer is NULL, before it has the opportunity to call pci_prepare_to_sleep(). No other actions are necessary as the mipi-i3c-hci driver takes care of controller state. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260123063325.8210-4-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit c3357bdd9be9cd9e34e46fe100e1d425503d4acf Author: Adrian Hunter Date: Fri Jan 23 08:33:24 2026 +0200 i3c: mipi-i3c-hci: Add optional System Suspend support Add system suspend callbacks. Implement them by forcing runtime PM. Consequently bail out if Runtime PM is not allowed. On resume from System Suspend (suspend to RAM), rerun Dynamic Address Assignment to restore addresses for devices that may have lost power. On resume from System Hibernation (suspend to disk), use the new i3c_master_do_daa_ext() helper with 'rstdaa' set to true, which additionally handles the case where devices are assigned different dynamic addresses after a hibernation boot. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260123063325.8210-3-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit c481ef12e713fb7c292d04f53b3532ac0804ab3d Author: Adrian Hunter Date: Fri Jan 23 08:33:23 2026 +0200 i3c: master: Add i3c_master_do_daa_ext() for post-hibernation address recovery After system hibernation, I3C Dynamic Addresses may be reassigned at boot and no longer match the values recorded before suspend. Introduce i3c_master_do_daa_ext() to handle this situation. The restore procedure is straightforward: issue a Reset Dynamic Address Assignment (RSTDAA), then run the standard DAA sequence. The existing DAA logic already supports detecting and updating devices whose dynamic addresses differ from previously known values. Refactor the DAA path by introducing a shared helper used by both the normal i3c_master_do_daa() path and the new extended restore function, and correct the kernel-doc in the process. Export i3c_master_do_daa_ext() so that master drivers can invoke it from their PM restore callbacks. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260123063325.8210-2-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit b58eaa4761ab02fc38c39d674a6bcdd55e00f388 Author: Fredrik Markstrom Date: Fri Jan 16 15:29:42 2026 +0100 i3c: dw: Initialize spinlock to avoid upsetting lockdep The devs_lock spinlock introduced when adding support for ibi:s was never initialized. Fixes: e389b1d72a624 ("i3c: dw: Add support for in-band interrupts") Suggested-by: Jani Nurminen Signed-off-by: Fredrik Markstrom Reviewed-by: Ivar Holmqvist Link: https://patch.msgid.link/20260116-i3c_dw_initialize_spinlock-v3-1-cf707b6ed75f@est.tech Signed-off-by: Alexandre Belloni commit 4039fbedcbcb022704ff45533aa7860ce036ee6b Author: Christoph Hellwig Date: Wed Jan 28 05:46:09 2026 +0100 NFS: fix delayed delegation return handling Rework this code that was totally busted at least as of my most recent changes. Introduce a separate list for delayed delegations so that they can't get lost and don't clutter up the returns list. Add a missing spin_unlock in the helper marking it as a regular pending return. Fixes: 0ebe655bd033 ("NFS: add a separate delegation return list") Reported-by: Chris Mason Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 94b88865109c0ea10e5ba562a793673b4fb37113 Author: Christoph Hellwig Date: Wed Jan 28 05:46:08 2026 +0100 NFS: simplify error handling in nfs_end_delegation_return Drop the pointless delegation->lock held over setting multiple atomic bits in different structures, and use separate labels for the delay vs abort cases. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit f7550318b29f754dabfb2f1db535ffe77e6d4446 Author: Christoph Hellwig Date: Wed Jan 28 05:46:07 2026 +0100 NFS: fold nfs_abort_delegation_return into nfs_end_delegation_return This will allow to simplify the error handling flow. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 438c3e47c2e5edfde3ab01443345b4c5e5f2fb55 Author: Christoph Hellwig Date: Wed Jan 28 05:46:06 2026 +0100 NFS: remove the delegation == NULL check in nfs_end_delegation_return All callers now pass a non-NULL delegation. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 2bd7ebcf9bff7ece7a0c3cfa38191d77b4383658 Author: Christoph Hellwig Date: Wed Jan 28 05:46:05 2026 +0100 NFS: use bool for the issync argument to nfs_end_delegation_return Replace the integer used as boolean with a bool type, and tidy up the prototype and top of function comment. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit b1cb730e847d9766b7fb416e623454a5cba57dc4 Author: Christoph Hellwig Date: Wed Jan 28 05:46:04 2026 +0100 NFS: return void from ->return_delegation The caller doesn't check the return value, so drop it. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit d37272c62a08b5fc74bedf7b560f794a84b7cdf1 Author: Christoph Hellwig Date: Wed Jan 28 05:46:03 2026 +0100 NFS: return void from nfs4_inode_make_writeable None of the callers checks the return value, so drop it. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 12bdf471e374b34cb0e48b29bb9eb9127ed26fc5 Author: Matti Vaittinen Date: Thu Jan 15 12:19:04 2026 +0200 power: supply: bd71828: Use dev_err_probe() The driver uses separate error printing and error returning at probe() for locations where the error value is hard-coded and can't be EPROBE_DEFER. This helps to omit the extra return value check which is done in dev_err_probe(). Using the dev_err_probe() has some other benefits besides handling the -EPROBE_DEFER though, like standardizing the print for error numbers. Some believe thes outweigh the benefit of skipping the extra check. Use dev_err_probe() consistently in the bd71828 power-supply probe. Signed-off-by: Matti Vaittinen Link: https://patch.msgid.link/aWi_GG74sZRfajA_@mva-rohm Signed-off-by: Sebastian Reichel commit c7fbf8d9b808ff3774474be6313b79ea684c61a9 Merge: cd77618c418254 4173b494d93a80 Author: Andrii Nakryiko Date: Fri Jan 30 13:40:09 2026 -0800 Merge branch 'x86-fgraph-bpf-fix-orc-stack-unwind-from-kprobe_multi' Jiri Olsa says: ==================== x86/fgraph,bpf: Fix ORC stack unwind from kprobe_multi hi, Mahe reported missing function from stack trace on top of kprobe multi program. It turned out the latest fix [1] needs some more fixing. v2 changes: - keep the unwind same as for kprobes, attached function is part of entry probe stacktrace, not kretprobe [Steven] - several change in trigger bench [Andrii] - added selftests for standard kprobes and fentry/fexit probes [Andrii] Note I'll try to add similar stacktrace adjustment for fentry/fexit in separate patchset to not complicate this change. thanks, jirka [1] https://lore.kernel.org/bpf/20251104215405.168643-1-jolsa@kernel.org/ --- ==================== Link: https://patch.msgid.link/20260126211837.472802-1-jolsa@kernel.org Signed-off-by: Andrii Nakryiko commit 4173b494d93a8057d3ed23e65853cd76b647f870 Author: Jiri Olsa Date: Mon Jan 26 22:18:37 2026 +0100 selftests/bpf: Allow to benchmark trigger with stacktrace Adding support to call bpf_get_stackid helper from trigger programs, so far added for kprobe multi. Adding the --stacktrace/-g option to enable it. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260126211837.472802-7-jolsa@kernel.org commit e5d532be4a3b0d1f0a9210c0da2c04a6b4605904 Author: Jiri Olsa Date: Mon Jan 26 22:18:36 2026 +0100 selftests/bpf: Add stacktrace ips test for fentry/fexit Adding test that attaches fentry/fexitand verifies the ORC stacktrace matches expected functions. The test is only for ORC unwinder to keep it simple. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260126211837.472802-6-jolsa@kernel.org commit 7373f97e868ad01fc73de8e7b71834eeba25d4f1 Author: Jiri Olsa Date: Mon Jan 26 22:18:35 2026 +0100 selftests/bpf: Add stacktrace ips test for kprobe/kretprobe Adding test that attaches kprobe/kretprobe and verifies the ORC stacktrace matches expected functions. The test is only for ORC unwinder to keep it simple. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260126211837.472802-5-jolsa@kernel.org commit 0207f94971e72a13380e28022c86da147e8e090f Author: Jiri Olsa Date: Mon Jan 26 22:18:34 2026 +0100 selftests/bpf: Fix kprobe multi stacktrace_ips test We now include the attached function in the stack trace, fixing the test accordingly. Fixes: c9e208fa93cd ("selftests/bpf: Add stacktrace ips test for kprobe_multi/kretprobe_multi") Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260126211837.472802-4-jolsa@kernel.org commit aea251799998aa1b78eacdfb308f18ea114ea5b3 Author: Jiri Olsa Date: Mon Jan 26 22:18:33 2026 +0100 x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path Mahe reported missing function from stack trace on top of kprobe multi program. The missing function is the very first one in the stacktrace, the one that the bpf program is attached to. # bpftrace -e 'kprobe:__x64_sys_newuname* { print(kstack)}' Attaching 1 probe... do_syscall_64+134 entry_SYSCALL_64_after_hwframe+118 ('*' is used for kprobe_multi attachment) The reason is that the previous change (the Fixes commit) fixed stack unwind for tracepoint, but removed attached function address from the stack trace on top of kprobe multi programs, which I also overlooked in the related test (check following patch). The tracepoint and kprobe_multi have different stack setup, but use same unwind path. I think it's better to keep the previous change, which fixed tracepoint unwind and instead change the kprobe multi unwind as explained below. The bpf program stack unwind calls perf_callchain_kernel for kernel portion and it follows two unwind paths based on X86_EFLAGS_FIXED bit in pt_regs.flags. When the bit set we unwind from stack represented by pt_regs argument, otherwise we unwind currently executed stack up to 'first_frame' boundary. The 'first_frame' value is taken from regs.rsp value, but ftrace_caller and ftrace_regs_caller (ftrace trampoline) functions set the regs.rsp to the previous stack frame, so we skip the attached function entry. If we switch kprobe_multi unwind to use the X86_EFLAGS_FIXED bit, we set the start of the unwind to the attached function address. As another benefit we also cut extra unwind cycles needed to reach the 'first_frame' boundary. The speedup can be measured with trigger bench for kprobe_multi program and stacktrace support. - trigger bench with stacktrace on current code: kprobe-multi : 0.810 ± 0.001M/s kretprobe-multi: 0.808 ± 0.001M/s - and with the fix: kprobe-multi : 1.264 ± 0.001M/s kretprobe-multi: 1.401 ± 0.002M/s With the fix, the entry probe stacktrace: # bpftrace -e 'kprobe:__x64_sys_newuname* { print(kstack)}' Attaching 1 probe... __x64_sys_newuname+9 do_syscall_64+134 entry_SYSCALL_64_after_hwframe+118 The return probe skips the attached function, because it's no longer on the stack at the point of the unwind and this way is the same how standard kretprobe works. # bpftrace -e 'kretprobe:__x64_sys_newuname* { print(kstack)}' Attaching 1 probe... do_syscall_64+134 entry_SYSCALL_64_after_hwframe+118 Fixes: 6d08340d1e35 ("Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"") Reported-by: Mahe Tardy Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20260126211837.472802-3-jolsa@kernel.org commit 8bc11700e0d23d4fdb7d8d5a73b2e95de427cabc Author: Jiri Olsa Date: Mon Jan 26 22:18:32 2026 +0100 x86/fgraph: Fix return_to_handler regs.rsp value The previous change (Fixes commit) messed up the rsp register value, which is wrong because it's already adjusted with FRAME_SIZE, we need the original rsp value. This change does not affect fprobe current kernel unwind, the !perf_hw_regs path perf_callchain_kernel: if (perf_hw_regs(regs)) { if (perf_callchain_store(entry, regs->ip)) return; unwind_start(&state, current, regs, NULL); } else { unwind_start(&state, current, NULL, (void *)regs->sp); } which uses pt_regs.sp as first_frame boundary (FRAME_SIZE shift makes no difference, unwind stil stops at the right frame). This change fixes the other path when we want to unwind directly from pt_regs sp/fp/ip state, which is coming in following change. Fixes: 20a0bc10272f ("x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe") Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20260126211837.472802-2-jolsa@kernel.org commit cb3aa2b540b0116caa900ea644d785cc583feed5 Merge: 4c3f02f843999a e39951f8ad5006 Author: Sebastian Reichel Date: Fri Jan 30 22:38:57 2026 +0100 Merge tag 'ib-mfd-clk-gpio-power-regulator-rtc-v6.20' into psy-next Merge immutable branch between MFD, Clk, GPIO, Power, Regulator and RTC due for the v6.20 merge window to apply further cleanups on top of the BD72720 power-supply driver contained in this branch. Signed-off-by: Sebastian Reichel commit 6517dfbcc918f970a928d9dc17586904bac06893 Author: Khushit Shah Date: Fri Jan 23 12:56:25 2026 +0000 KVM: x86: Add x2APIC "features" to control EOI broadcast suppression Add two flags for KVM_CAP_X2APIC_API to allow userspace to control support for Suppress EOI Broadcasts when using a split IRQCHIP (I/O APIC emulated by userspace), which KVM completely mishandles. When x2APIC support was first added, KVM incorrectly advertised and "enabled" Suppress EOI Broadcast, without fully supporting the I/O APIC side of the equation, i.e. without adding directed EOI to KVM's in-kernel I/O APIC. That flaw was carried over to split IRQCHIP support, i.e. KVM advertised support for Suppress EOI Broadcasts irrespective of whether or not the userspace I/O APIC implementation supported directed EOIs. Even worse, KVM didn't actually suppress EOI broadcasts, i.e. userspace VMMs without support for directed EOI came to rely on the "spurious" broadcasts. KVM "fixed" the in-kernel I/O APIC implementation by completely disabling support for Suppress EOI Broadcasts in commit 0bcc3fb95b97 ("KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use"), but didn't do anything to remedy userspace I/O APIC implementations. KVM's bogus handling of Suppress EOI Broadcast is problematic when the guest relies on interrupts being masked in the I/O APIC until well after the initial local APIC EOI. E.g. Windows with Credential Guard enabled handles interrupts in the following order: 1. Interrupt for L2 arrives. 2. L1 APIC EOIs the interrupt. 3. L1 resumes L2 and injects the interrupt. 4. L2 EOIs after servicing. 5. L1 performs the I/O APIC EOI. Because KVM EOIs the I/O APIC at step #2, the guest can get an interrupt storm, e.g. if the IRQ line is still asserted and userspace reacts to the EOI by re-injecting the IRQ, because the guest doesn't de-assert the line until step #4, and doesn't expect the interrupt to be re-enabled until step #5. Unfortunately, simply "fixing" the bug isn't an option, as KVM has no way of knowing if the userspace I/O APIC supports directed EOIs, i.e. suppressing EOI broadcasts would result in interrupts being stuck masked in the userspace I/O APIC due to step #5 being ignored by userspace. And fully disabling support for Suppress EOI Broadcast is also undesirable, as picking up the fix would require a guest reboot, *and* more importantly would change the virtual CPU model exposed to the guest without any buy-in from userspace. Add KVM_X2APIC_ENABLE_SUPPRESS_EOI_BROADCAST and KVM_X2APIC_DISABLE_SUPPRESS_EOI_BROADCAST flags to allow userspace to explicitly enable or disable support for Suppress EOI Broadcasts. This gives userspace control over the virtual CPU model exposed to the guest, as KVM should never have enabled support for Suppress EOI Broadcast without userspace opt-in. Not setting either flag will result in legacy quirky behavior for backward compatibility. Disallow fully enabling SUPPRESS_EOI_BROADCAST when using an in-kernel I/O APIC, as KVM's history/support is just as tragic. E.g. it's not clear that commit c806a6ad35bf ("KVM: x86: call irq notifiers with directed EOI") was entirely correct, i.e. it may have simply papered over the lack of Directed EOI emulation in the I/O APIC. Note, Suppress EOI Broadcasts is defined only in Intel's SDM, not in AMD's APM. But the bit is writable on some AMD CPUs, e.g. Turin, and KVM's ABI is to support Directed EOI (KVM's name) irrespective of guest CPU vendor. Fixes: 7543a635aa09 ("KVM: x86: Add KVM exit for IOAPIC EOIs") Closes: https://lore.kernel.org/kvm/7D497EF1-607D-4D37-98E7-DAF95F099342@nutanix.com Cc: stable@vger.kernel.org Suggested-by: David Woodhouse Signed-off-by: Khushit Shah Link: https://patch.msgid.link/20260123125657.3384063-1-khushit.shah@nutanix.com [sean: clean up minor formatting goofs and fix a comment typo] Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson commit 3f2757dbf32a31cef738a983bde6ecd2641484c0 Author: Sean Christopherson Date: Tue Jan 27 17:43:09 2026 -0800 KVM: x86: Harden against unexpected adjustments to kvm_cpu_caps Add a flag to track when KVM is actively configuring its CPU caps, and WARN if a cap is set or cleared if KVM isn't in its configuration stage. Modifying CPU caps after {svm,vmx}_set_cpu_caps() can be fatal to KVM, as vendor setup code expects the CPU caps to be frozen at that point, e.g. will do additional configuration based on the caps. Rename kvm_set_cpu_caps() to kvm_initialize_cpu_caps() to pair with the new "finalize", and to make it more obvious that KVM's CPU caps aren't fully configured within the function. Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Link: https://patch.msgid.link/20260128014310.3255561-3-seanjc@google.com Signed-off-by: Sean Christopherson commit c0d6b8bbbced660e9c2efe079e2b2cb34b27d97f Author: Sean Christopherson Date: Tue Jan 27 17:43:10 2026 -0800 KVM: VMX: Print out "bad" offsets+value on VMCS config mismatch When kvm-intel.ko refuses to load due to a mismatched VMCS config, print all mismatching offsets+values to make it easier to debug goofs during development, and to make it at least feasible to triage failures that occur during production. E.g. if a physical core is flaky or is running with the "wrong" microcode patch loaded, then a CPU can get a legitimate mismatch even without KVM bugs. Print the mismatches as 32-bit values as a compromise between hand coding every field (to provide precise information) and printing individual bytes (requires more effort to deduce the mismatch bit(s)). All fields in the VMCS config are either 32-bit or 64-bit values, i.e. in many cases, printing 32-bit values will be 100% precise, and in the others it's close enough, especially when considering that MSR values are split into EDX:EAX anyways. E.g. on mismatch CET entry/exit controls, KVM will print: kvm_intel: VMCS config on CPU 0 doesn't match reference config: Offset 76 REF = 0x107fffff, CPU0 = 0x007fffff, mismatch = 0x10000000 Offset 84 REF = 0x0010f3ff, CPU0 = 0x0000f3ff, mismatch = 0x00100000 Opportunistically tweak the wording on the initial error message to say "mismatch" instead of "inconsistent", as the VMCS config itself isn't inconsistent, and the wording conflates the cross-CPU compatibility check with the error_on_inconsistent_vmcs_config knob that treats inconsistent VMCS configurations as errors (e.g. if a CPU supports CET entry controls but no CET exit controls). Cc: Jim Mattson Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Link: https://patch.msgid.link/20260128014310.3255561-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 56534673cea7f00d96a64deb58057298fe9f192e Author: Ionut Nechita (Sunlight Linux) Date: Wed Jan 28 09:45:43 2026 +0200 tick/nohz: Optimize check_tick_dependency() with early return There is no point in iterating through individual tick dependency bits when the tick_stop tracepoint is disabled, which is the common case. When the trace point is disabled, return immediately based on the atomic value being zero or non-zero, skipping the per-bit evaluation. This optimization improves the hot path performance of tick dependency checks across all contexts (idle and non-idle), not just nohz_full CPUs. Suggested-by: Thomas Gleixner Signed-off-by: Ionut Nechita (Sunlight Linux) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128074558.15433-3-sunlightlinux@gmail.com commit cd77618c418254b827f2a807b4c27b97088fdb52 Author: Changwoo Min Date: Fri Jan 30 11:18:43 2026 +0900 selftests/bpf: Make bpf get_preempt_count() work for v6.14+ kernels Recent x86 kernels export __preempt_count as a ksym, while some old kernels between v6.1 and v6.14 expose the preemption counter via pcpu_hot.preempt_count. The existing selftest helper unconditionally dereferenced __preempt_count, which breaks BPF program loading on such old kernels. Make the x86 preemption count lookup version-agnostic by: - Marking __preempt_count and pcpu_hot as weak ksyms. - Introducing a BTF-described pcpu_hot___local layout with preserve_access_index. - Selecting the appropriate access path at runtime using ksym availability and bpf_ksym_exists() and bpf_core_field_exists(). This allows a single BPF binary to run correctly across kernel versions (e.g., v6.18 vs. v6.13) without relying on compile-time version checks. Signed-off-by: Changwoo Min Link: https://lore.kernel.org/r/20260130021843.154885-1-changwoo@igalia.com Signed-off-by: Alexei Starovoitov commit b18a761ca0f6ef7c07b0ae5cee28315a0c5478a8 Merge: 95dbe214b910fc 15ac1adf0f84a9 Author: Alexei Starovoitov Date: Fri Jan 30 12:17:48 2026 -0800 Merge branch 'bpf-tail-calls-in-sleepable-programs' Jiri Olsa says: ==================== this patchset allows sleepable programs to use tail calls. At the moment we need to have separate sleepable uprobe program to retrieve user space data and pass it to complex program with tail calls. It'd be great if the program with tail calls could be sleepable and do the data retrieval directly. ==================== Link: https://patch.msgid.link/20260130081208.1130204-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 15ac1adf0f84a90605121fbe4a6238b24c865f92 Author: Jiri Olsa Date: Fri Jan 30 09:12:08 2026 +0100 selftests/bpf: Add test for sleepable program tailcalls Adding test that makes sure we can't mix sleepable and non-sleepable bpf programs in the BPF_MAP_TYPE_PROG_ARRAY map and that we can do tail call in the sleepable program. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260130081208.1130204-3-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 0f0c332992b8a5d2ae7b611b94c4e02ef8d54b97 Author: Jiri Olsa Date: Fri Jan 30 09:12:07 2026 +0100 bpf: Allow sleepable programs to use tail calls Allowing sleepable programs to use tail calls. Making sure we can't mix sleepable and non-sleepable bpf programs in tail call map (BPF_MAP_TYPE_PROG_ARRAY) and allowing it to be used in sleepable programs. Sleepable programs can be preempted and sleep which might bring new source of race conditions, but both direct and indirect tail calls should not be affected. Direct tail calls work by patching direct jump to callee into bpf caller program, so no problem there. We atomically switch from nop to jump instruction. Indirect tail call reads the callee from the map and then jumps to it. The callee bpf program can't disappear (be released) from the caller, because it is executed under rcu lock (rcu_read_lock_trace). Signed-off-by: Jiri Olsa Acked-by: Leon Hwang Link: https://lore.kernel.org/r/20260130081208.1130204-2-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 4c3f02f843999a590f4481791f59a2f9a7f34fe4 Author: Kuan-Wei Chiu Date: Tue Jan 13 09:26:00 2026 +0000 dt-bindings: power: supply: google,goldfish-battery: Convert to DT schema Convert the Android Goldfish Battery binding to DT schema format. Move the file to the power/supply directory to match the subsystem. Update the example node name to 'battery' to comply with generic node naming standards. Signed-off-by: Kuan-Wei Chiu Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260113092602.3197681-5-visitorckw@gmail.com Signed-off-by: Sebastian Reichel commit c655f45480637aee326b5bd96488d35ab90db2b0 Author: Val Packett Date: Tue Jan 20 20:57:58 2026 -0300 power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer On the Dell Latitude 7455, the firmware uses "LiP" with a lowercase 'i' for the battery chemistry type, but only all-uppercase "LIP" was being recognized. Add the CamelCase variant to the check to fix the "Unknown battery technology" warning. Fixes: 202ac22b8e2e ("power: supply: qcom_battmgr: Add lithium-polymer entry") Signed-off-by: Val Packett Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260120235831.479038-1-val@packett.cool Signed-off-by: Sebastian Reichel commit 3db37475d78ed0c2857f289a535dd44b045a904a Author: Waqar Hameed Date: Fri Jan 23 09:55:43 2026 +0100 power: supply: wm97xx: Use devm_power_supply_register() Instead of handling the registration manually, use the automatic `devres` variant `devm_power_supply_register()`. This is less error prone and cleaner. Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/b0b366d302f0605c8555dd68ed32973959f133bb.1769158280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel commit 72db889394d89ffde61e7438f0cdfc0135c9da48 Author: Waqar Hameed Date: Fri Jan 23 09:55:43 2026 +0100 power: supply: wm97xx: Use devm_kcalloc() Instead of handling the memory allocation manually, use the automatic `devres` variant `devm_kcalloc()`. This is less error prone and eliminates the `goto`-path. Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/5ac93f5b0fa417bb5d9e93b9302a18f2c04d4077.1769158280.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel commit 23067259919663580c6f81801847cfc7bd54fd1f Author: Waqar Hameed Date: Fri Jan 23 11:24:20 2026 +0100 power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `extcon` handle, means that the `extcon` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interrupt can fire just _after_ the `extcon` handle has been freed, *but* just _before_ the corresponding unregistration of the IRQ handler has run. This will lead to the IRQ handler calling `extcon_set_state_sync()` with a freed `extcon` handle. Which usually crashes the system or otherwise silently corrupts the memory... Fix this racy use-after-free by making sure the IRQ is requested _after_ the registration of the `extcon` handle. Fixes: f8d7a3d21160 ("power: supply: Add driver for pm8916 lbc") Signed-off-by: Waqar Hameed Reviewed-by: Nikita Travkin Link: https://patch.msgid.link/e2a4cd2fcd42b6cd97d856c17c097289a2aed393.1769163273.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel commit 84dd57fb0359500092f1101409ca32091731490d Author: Zishun Yi Date: Fri Jan 30 01:10:22 2026 +0800 accel/amdxdna: Fix memory leak in amdxdna_ubuf_map The amdxdna_ubuf_map() function allocates memory for sg and internal sg table structures, but it fails to free them if subsequent operations (sg_alloc_table_from_pages or dma_map_sgtable) fail. Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer") Signed-off-by: Zishun Yi Reviewed-by: Lizhi Hou Reviewed-by: Min Ma Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260129171022.68578-1-zishun.yi.dev@gmail.com commit f1370241fe8045702bc9d0812b996791f0500f1b Author: Lizhi Hou Date: Thu Jan 29 16:32:55 2026 -0800 accel/amdxdna: Stop job scheduling across aie2_release_resource() Running jobs on a hardware context while it is in the process of releasing resources can lead to use-after-free and crashes. Fix this by stopping job scheduling before calling aie2_release_resource() and restarting it after the release completes. Additionally, aie2_sched_job_run() now checks whether the hardware context is still active. Fixes: 4fd6ca90fc7f ("accel/amdxdna: Refactor hardware context destroy routine") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260130003255.2083255-1-lizhi.hou@amd.com commit a9162439ad792afcddc04718408ec1380b7a5f63 Author: Lizhi Hou Date: Tue Jan 27 16:23:56 2026 -0800 accel/amdxdna: Hold mm structure across iommu_sva_unbind_device() Some tests trigger a crash in iommu_sva_unbind_device() due to accessing iommu_mm after the associated mm structure has been freed. Fix this by taking an explicit reference to the mm structure after successfully binding the device, and releasing it only after the device is unbound. This ensures the mm remains valid for the entire SVA bind/unbind lifetime. Fixes: be462c97b7df ("accel/amdxdna: Add hardware context") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260128002356.1858122-1-lizhi.hou@amd.com commit 562357a6310f79e45844c3e980d410a1e8e02ce6 Author: Emanuele Ghidoli Date: Fri Jan 30 08:11:35 2026 +0100 power: reset: tdx-ec-poweroff: fix restart During testing, restart occasionally failed on Toradex modules. The issue was traced to an interaction between the EC-based reset/poweroff handler and the PSCI restart handler. While the embedded controller is resetting or powering off the module, the PSCI code may still be invoked, triggering an I2C transaction to the PMIC. This can leave the PMIC I2C in a frozen state. Add a delay after issuing the EC reset or power-off command to give the controller time to complete the operation and avoid falling back to another restart/poweroff provider. Also print an error message if sending the command to the embedded controller fails. Fixes: 18672fe12367 ("power: reset: add Toradex Embedded Controller") Cc: stable@vger.kernel.org Signed-off-by: Emanuele Ghidoli Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/20260130071208.1184239-1-ghidoliemanuele@gmail.com Signed-off-by: Sebastian Reichel commit 1c7442d10b031ace1b7f4902af48bdca465ca25f Author: Patrick Little Date: Wed Jan 28 16:33:12 2026 -0600 PM: EM: Documentation: Fix bug in example code snippet A semicolon was mistakenly placed at the end of 'if' statements. If example is copied as-is, it would lead to the subsequent return being executed unconditionally, which is incorrect, and the rest of the function would never be reached. Signed-off-by: Patrick Little Acked-by: Randy Dunlap [ rjw: Subject adjustment ] Link: https://patch.msgid.link/20260128-documentation-fix-grammar-v1-2-39238dc471f9@gmail.com Signed-off-by: Rafael J. Wysocki commit e79eec6ca1f5a3dbd804b73fd313b3fe455df4f3 Author: Patrick Little Date: Wed Jan 28 16:33:11 2026 -0600 Documentation: Fix typos in energy model documentation Fix typos in documentation related to energy model management. Signed-off-by: Patrick Little Acked-by: Randy Dunlap [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260128-documentation-fix-grammar-v1-1-39238dc471f9@gmail.com Signed-off-by: Rafael J. Wysocki commit a971f984b8455db0ef23910442029cdad53bc459 Author: Rafael J. Wysocki Date: Thu Jan 29 21:51:11 2026 +0100 cpuidle: governors: teo: Refine intercepts-based idle state lookup There are cases in which decisions made by the teo governor are arguably overly conservative. For instance, suppose that there are 4 idle states and the values of the intercepts metric for the first 3 of them are 400, 250, and 251, respectively. If the total sum computed in teo_update() is 1000, the governor will select idle state 1 (provided that all idle states are enabled and the scheduler tick has not been stopped) although arguably idle state 0 would be a better choice because the likelihood of getting an idle duration below the target residency of idle state 1 is greater than the likelihood of getting an idle duration between the target residency of idle state 1 and the target residency of idle state 2. To address this, refine the candidate idle state lookup based on intercepts to start at the state with the maximum intercepts metric, below the deepest enabled one, to avoid the cases in which the search may stop before reaching that state. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle [ rjw: Fixed typo "intercetps" in new comments (3 places) ] Link: https://patch.msgid.link/2417298.ElGaqSPkdT@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit f36de72673ad80c9931c0b411df0d6ef184f6c22 Author: Rafael J. Wysocki Date: Thu Jan 29 21:49:12 2026 +0100 cpuidle: governors: teo: Adjust the classification of wakeup events If differences between target residency values of adjacent idle states of a given CPU are relatively large, the corresponding idle state bins used by the teo governors are large either and the rule by which hits are distinguished from intercepts is inaccurate. Namely, by that rule, a wakeup event is classified as a hit if the sleep length (the time till the closest timer other than the tick) and the measured idle duration, adjusted for the entered idle state exit latency, fall into the same idle state bin. However, if that bin is large enough, the actual difference between the sleep length and the measured idle duration may be significant. It may in fact be significantly greater than the analogous difference for an event where the sleep length and the measured idle duration fall into different bins. For this reason, amend the rule in question with a check that will only allow a wakeup event to be counted as a hit if the sleep length is less than the "raw" measured idle duration (which means that the wakeup appears to have occurred after the anticipated timer event). Otherwise, the event will be counted as an intercept. Also update the documentation part explaining the difference between "hits" and "intercepts" to take the above change into account. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/5093379.31r3eYUQgx@rafael.j.wysocki commit 9abf79c8d7b40db0e5a34aa8c744ea60ff9a3fcf Author: Håkon Bugge Date: Thu Jan 29 18:52:33 2026 +0100 PCI/ACPI: Restrict program_hpx_type2() to AER bits Previously program_hpx_type2() applied PCIe settings unconditionally, which could incorrectly change bits like Extended Tag Field Enable and Enable Relaxed Ordering. When _HPX was added to ACPI r3.0, the intent of the PCIe Setting Record (Type 2) in sec 6.2.7.3 was to configure AER registers when the OS does not own the AER Capability: The PCI Express setting record contains ... [the AER] Uncorrectable Error Mask, Uncorrectable Error Severity, Correctable Error Mask ... to be used when configuring registers in the Advanced Error Reporting Extended Capability Structure ... OSPM [1] will only evaluate _HPX with Setting Record – Type 2 if OSPM is not controlling the PCI Express Advanced Error Reporting capability. ACPI r3.0b, sec 6.2.7.3, added more AER registers, including registers in the PCIe Capability with AER-related bits, and the restriction that the OS use this only when it owns PCIe native hotplug: ... when configuring PCI Express registers in the Advanced Error Reporting Extended Capability Structure *or PCI Express Capability Structure* ... An OS that has assumed ownership of native hot plug but does not ... have ownership of the AER register set must use ... the Type 2 record to program the AER registers ... However, since the Type 2 record also includes register bits that have functions other than AER, the OS must ignore values ... that are not applicable. Restrict program_hpx_type2() to only the intended purpose: - Apply settings only when OS owns PCIe native hotplug but not AER, - Only touch the AER-related bits (Error Reporting Enables) in Device Control - Don't touch Link Control at all, since nothing there seems AER-related, but log _HPX settings for debugging purposes Note that Read Completion Boundary is now configured elsewhere, since it is unrelated to _HPX. [1] Operating System-directed configuration and Power Management Fixes: 40abb96c51bb ("[PATCH] pciehp: Fix programming hotplug parameters") Signed-off-by: Håkon Bugge Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260129175237.727059-3-haakon.bugge@oracle.com commit 1a6845aaa6de81f95959b380b45de8f10d6a8502 Author: Håkon Bugge Date: Thu Jan 29 18:52:32 2026 +0100 PCI: Initialize RCB from pci_configure_device() Commit e42010d8207f ("PCI: Set Read Completion Boundary to 128 iff Root Port supports it (_HPX)") worked around a bogus _HPX type 2 record, which caused program_hpx_type2() to set the RCB in an endpoint even though the Root Port did not have the RCB bit set. e42010d8207f fixed that by setting the RCB in the endpoint only when it was set in the Root Port. In retrospect, program_hpx_type2() is intended for AER-related settings, and the RCB should be configured elsewhere so it doesn't depend on the presence or contents of an _HPX record. Explicitly program the RCB from pci_configure_device() so it matches the Root Port's RCB. The Root Port may not be visible to virtualized guests; in that case, leave RCB alone. Fixes: e42010d8207f ("PCI: Set Read Completion Boundary to 128 iff Root Port supports it (_HPX)") Signed-off-by: Håkon Bugge Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260129175237.727059-2-haakon.bugge@oracle.com commit 43d67ec26b329f8aea34ba9dff23d69b84a8e564 Author: Aksh Garg Date: Fri Jan 30 17:25:14 2026 +0530 PCI: dwc: ep: Fix resizable BAR support for multi-PF configurations The resizable BAR support added by the commit 3a3d4cabe681 ("PCI: dwc: ep: Allow EPF drivers to configure the size of Resizable BARs") incorrectly configures the resizable BARs only for the first Physical Function (PF0) in EP mode. The resizable BAR configuration functions use generic dw_pcie_*_dbi() operations instead of physical function specific dw_pcie_ep_*_dbi() operations. This causes resizable BAR configuration to always target PF0 regardless of the requested function number. Additionally, dw_pcie_ep_init_non_sticky_registers() only initializes resizable BAR registers for PF0, leaving other PFs unconfigured during the execution of this function. Fix this by using physical function specific configuration space access operations throughout the resizable BAR code path and initializing registers for all the physical functions that support resizable BARs. Fixes: 3a3d4cabe681 ("PCI: dwc: ep: Allow EPF drivers to configure the size of Resizable BARs") Signed-off-by: Aksh Garg [mani: added stable tag] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260130115516.515082-2-a-garg7@ti.com commit ffcc4850a16133d8db0f11ee6dde319201800451 Author: Niklas Cassel Date: Fri Jan 30 12:30:39 2026 +0100 PCI: endpoint: pci-epf-test: Allow overriding default BAR sizes Add bar{0,1,2,3,4,5}_size attributes in configfs, so that the user is not restricted to run pci-epf-test with the hardcoded BAR size values defined in pci-epf-test.c. This code is shamelessly more or less copy pasted from pci-epf-vntb.c Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Koichiro Den Reviewed-by: Damien Le Moal Reviewed-by: Frank Li Link: https://patch.msgid.link/20260130113038.2143947-2-cassel@kernel.org commit 91b76f1059b60f453b51877f29f0e35693737383 Author: Daeho Jeong Date: Mon Jan 26 14:28:01 2026 -0800 f2fs: fix incomplete block usage in compact SSA summaries In a previous commit, a bug was introduced where compact SSA summaries failed to utilize the entire block space in non-4KB block size configurations, leading to inefficient space management. This patch fixes the calculation logic to ensure that compact SSA summaries can fully occupy the block regardless of the block size. Reported-by: Chris Mason Fixes: e48e16f3e37f ("f2fs: support non-4KB block size without packed_ssa feature") Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7537db24806fdc3d3ec4fef53babdc22c9219e75 Author: Anna Schumaker Date: Thu Dec 4 15:44:33 2025 -0500 NFS: Merge CONFIG_NFS_V4_1 with CONFIG_NFS_V4 Compiling the NFSv4 module without any minorversion support doesn't make much sense, so this patch sets NFS v4.1 as the default, always enabled NFS version allowing us to replace all the CONFIG_NFS_V4_1s scattered throughout the code with CONFIG_NFS_V4. Signed-off-by: Anna Schumaker commit 4e0269352534715915aae3fb84dd4d3bb3ff3738 Author: Anna Schumaker Date: Fri Nov 21 14:53:50 2025 -0500 NFS: Add a way to disable NFS v4.0 via KConfig I introduce NFS4_MIN_MINOR_VERSION as a parallel to NFS4_MAX_MINOR_VERSION to check if NFS v4.0 has been compiled in and return an appropriate error if not. Signed-off-by: Anna Schumaker commit 9c54afc10611638cca9997f472283985b9ca8e42 Author: Anna Schumaker Date: Thu Nov 20 15:14:30 2025 -0500 NFS: Move sequence slot operations into minorversion operations At the same time, I move the NFS v4.0 functions into nfs40proc.c to keep v4.0 features together in their own files. Signed-off-by: Anna Schumaker commit 211891374353c91f9aa4bb8cfca5d681b990f3d6 Author: Anna Schumaker Date: Thu Nov 20 16:55:09 2025 -0500 NFS: Pass a struct nfs_client to nfs4_init_sequence() No functional change in this patch. This just makes the next patch where I introduce "sequence slot operations" simpler. Signed-off-by: Anna Schumaker commit 424a3a71b8059cdb8e755bac35c29184a4ef4482 Author: Anna Schumaker Date: Fri Nov 14 16:03:41 2025 -0500 NFS: Move NFS v4.0 pathdown recovery into nfs40client.c Signed-off-by: Anna Schumaker commit 214359fe1689999048809cf752a997847d538dc6 Author: Anna Schumaker Date: Fri Nov 14 15:15:19 2025 -0500 NFS: Move nfs40_init_client into nfs40client.c Signed-off-by: Anna Schumaker commit c695ac2d60f495a50aa2aceb4fdeb587e1008f65 Author: Anna Schumaker Date: Fri Nov 14 14:48:36 2025 -0500 NFS: Move nfs40_shutdown_client into nfs40client.c Signed-off-by: Anna Schumaker commit c30493d8c517e6138c9ba303a9b6484c8f0bd744 Author: Anna Schumaker Date: Fri Nov 14 14:35:38 2025 -0500 NFS: Make the various NFS v4.0 operations static again They don't need to be visible outside of nfs40proc.c anymore now that the minor version ops have been moved over. Signed-off-by: Anna Schumaker commit 0cba208fb979509721031d2469b31c45140e3063 Author: Anna Schumaker Date: Fri Nov 14 14:26:36 2025 -0500 NFS: Move the NFS v4.0 minor version ops into nfs40proc.c Signed-off-by: Anna Schumaker commit b6ee9a9ba7a506d69171d637c1eab42a479c4c6c Author: Anna Schumaker Date: Thu Nov 13 17:11:55 2025 -0500 NFS: Split out the nfs40_mig_recovery_ops to nfs40proc.c Signed-off-by: Anna Schumaker commit 963707b122ac22b03e9c0e54137045c139271ff1 Author: Anna Schumaker Date: Thu Nov 13 15:15:29 2025 -0500 NFS: Split out the nfs40_state_renewal_ops into nfs40proc.c Signed-off-by: Anna Schumaker commit 0e854d761e2bc316b810296c493d479fef92b2c6 Author: Anna Schumaker Date: Thu Nov 13 13:17:59 2025 -0500 NFS: Split out the nfs40_nograce_recovery_ops into nfs40proc.c Signed-off-by: Anna Schumaker commit c96c05fcfe395e93f738d924dfd40571ca4302ca Author: Anna Schumaker Date: Thu Nov 13 11:10:17 2025 -0500 NFS: Split out the nfs40_reboot_recovery_ops into nfs40client.c Signed-off-by: Anna Schumaker commit e5e45ea615a13edac86d6f84bbd5fc1c5d532a10 Author: Anna Schumaker Date: Fri Nov 7 16:30:51 2025 -0500 NFS: Move nfs40_call_sync_ops into nfs40proc.c This is the first step in extracting NFS v4.0 into its own set of files that can be disabled through Kconfig. Signed-off-by: Anna Schumaker commit 63050be0bfe0b280cce5d701b31940fd84858609 Merge: 3f7938b1aec7f0 7b6f9d9b1ea05c Author: Dave Jiang Date: Fri Jan 30 09:06:01 2026 -0700 Merge branch 'for-7.0/cxl-misc' into cxl-for-next cxl: Fix premature commit_end increment on decoder commit failure commit 96657eb5ab7e231f6333a3fbc674c0451f13f7f1 Merge: 370fdb9825f365 0e841d1d561376 Author: Greg Kroah-Hartman Date: Fri Jan 30 16:46:45 2026 +0100 Merge tag 'icc-6.20-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.20 This pull request contains the interconnect changes for the 6.20-rc1 merge window. The core and driver changes are listed below. Core changes: - Add KUnit tests for core functionality Driver changes: - New driver for MediaTek MT8196 EMI - MediaTek driver fixes - Support for Glymur BWMONs - QCS8300 driver topology fix - Misc cleanups Signed-off-by: Georgi Djakov * tag 'icc-6.20-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: qcom: msm8974: drop duplicated RPM_BUS_{MASTER,SLAVE}_REQ defines interconnect: qcom: smd-rpm: drop duplicated QCOM_RPM_SMD_KEY_RATE define dt-bindings: interconnect: qcom-bwmon: Document Glymur BWMONs interconnect: qcom: qcs8300: fix the num_links for nsp icc node interconnect: Add kunit tests for core functionality dt-bindings: interconnect: qcom,qcs615-rpmh: Drop IPA interconnects interconnect: mediatek: Aggregate bandwidth with saturating add interconnect: mediatek: Don't hijack parent device interconnect: mediatek: Add support for MediaTek MT8196 EMI ICC dt-bindings: interconnect: mt8183-emi: Add support for MT8196 EMI commit adbbd9714f8058730f93c8df5c5bf1679456424b Author: Thomas Weißschuh Date: Wed Jan 14 08:28:17 2026 +0100 scripts: headers_install.sh: Remove config leak ignore machinery There are no entries left to ignore and none should be added again. Remove the now unused logic. Signed-off-by: Thomas Weißschuh Signed-off-by: Arnd Bergmann commit e356da60144bcd06bf2880999f67a6415a7499d5 Author: Thomas Weißschuh Date: Wed Jan 14 08:28:16 2026 +0100 x86/uapi: Stop leaking kconfig references to userspace UAPI headers are not supposed to leak references to kconfig symbols. These won't be set when building userspace. Hide the kconfig reference behind 'if defined(__KERNEL__)', so it will be stripped by headers_install.sh. The result for userspace will be the same, but the exceptions in headers_install.sh can also be removed. Signed-off-by: Thomas Weißschuh Signed-off-by: Arnd Bergmann commit 9b21aa9f038184aa49f894e663957933507718d1 Author: Thomas Weißschuh Date: Wed Jan 14 08:28:15 2026 +0100 nios2: uapi: Remove custom asm/swab.h from UAPI UAPI headers are not supposed to leak references to kconfig symbols. They are undefined there in any case. As all actual definitions of this header are guarded behind a kconfig symbol, for userspace the header is always identical to its asm-generic variant. Make the custom UAPI header a kernel-internal one, so the leaks of kconfig symbols are fixed and userspace will instead use asm-generic/swab.h directly. Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/lkml/93c55086-931a-4282-a94c-de4954047fa9@app.fastmail.com/ Signed-off-by: Thomas Weißschuh Signed-off-by: Arnd Bergmann commit 49d7819aa9b0b494d140ae28789b1190acdb9032 Author: Thomas Weißschuh Date: Wed Jan 14 08:28:14 2026 +0100 ARM: uapi: Drop PSR_ENDSTATE The symbol PSR_ENDSTATE is pointless for userspace. Drop it from the UAPI headers and instead inline it into the only two callers. As as side-effect, remove a leak of an internal kconfig symbol through the UAPI headers. Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/lkml/d2ad12f2-3d65-4bef-890c-65d78a33d790@app.fastmail.com/ Signed-off-by: Thomas Weißschuh Signed-off-by: Arnd Bergmann commit b4171fd0b091072f403b66bf05d01051d4bd94d9 Author: Thomas Weißschuh Date: Wed Jan 14 08:28:13 2026 +0100 ARC: Always use SWAPE instructions for __arch_swab32() Since commit 67a697e7576 ("ARC: retire ARC750 support") all supported CPUs have the 'swape' instruction. Always use the implementation of __arch_swabe() which uses 'swape'. ARCH_USE_BUILTIN_BSWAP can not be used as that results on libcalls on -mcpu=arc700. As as side-effect, remove a leak of an internal kconfig symbol through the UAPI headers. Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/lkml/0ae2688a-5a22-405b-adaf-9b5ad712b245@app.fastmail.com/ Suggested-by: Vineet Gupta Link: https://lore.kernel.org/lkml/a033a402-e3c5-4982-9fff-b6a4c55817ae@kernel.org/ Signed-off-by: Thomas Weißschuh Signed-off-by: Arnd Bergmann commit 95cc767d6f54e48629b593edc2ccbd154ec65d95 Author: Ng Tze Yee Date: Sun Jan 25 22:42:05 2026 -0800 arm64: dts: socfpga: agilex: add emmc support The Agilex devkit supports a separate eMMC daughter card. The eMMC daughter card replaces the SDMMC slot that is on the default daughter card and thus requires a separate board dts file. Signed-off-by: Ng Tze Yee Signed-off-by: Dinh Nguyen commit 02b75ece53bb6e7b75b987d5728949451d1dc8a9 Author: Steven Rostedt Date: Fri Jan 30 10:37:45 2026 -0500 tracing: Add kerneldoc to trace_event_buffer_reserve() Add a appropriate kerneldoc to trace_event_buffer_reserve() to make it easier to understand how that function is used. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260130103745.1126e4af@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit eed444d02585b426645532166ede3e2427db901d Author: John Garry Date: Wed Jan 7 09:40:04 2026 +0000 include/asm-generic/topology.h: Remove unused definition of cpumask_of_node() The definition of cpumask_of_node() in question is guarded by conflicting CONFIG_NUMA and !CONFIG_NUMA checks, so remove it. Signed-off-by: John Garry Signed-off-by: Arnd Bergmann commit a46023d5616ed3ed781e56ca93400eb9490e3646 Author: Steven Rostedt Date: Mon Jan 26 18:11:48 2026 -0500 tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast The current use of guard(preempt_notrace)() within __DECLARE_TRACE() to protect invocation of __DO_TRACE_CALL() means that BPF programs attached to tracepoints are non-preemptible. This is unhelpful in real-time systems, whose users apparently wish to use BPF while also achieving low latencies. (Who knew?) One option would be to use preemptible RCU, but this introduces many opportunities for infinite recursion, which many consider to be counterproductive, especially given the relatively small stacks provided by the Linux kernel. These opportunities could be shut down by sufficiently energetic duplication of code, but this sort of thing is considered impolite in some circles. Therefore, use the shiny new SRCU-fast API, which provides somewhat faster readers than those of preemptible RCU, at least on Paul E. McKenney's laptop, where task_struct access is more expensive than access to per-CPU variables. And SRCU-fast provides way faster readers than does SRCU, courtesy of being able to avoid the read-side use of smp_mb(). Also, it is quite straightforward to create srcu_read_{,un}lock_fast_notrace() functions. Link: https://lore.kernel.org/all/20250613152218.1924093-1-bigeasy@linutronix.de/ Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Sebastian Andrzej Siewior Cc: Alexei Starovoitov Link: https://patch.msgid.link/20260126231256.499701982@kernel.org Co-developed-by: Paul E. McKenney Signed-off-by: Paul E. McKenney Signed-off-by: Steven Rostedt (Google) commit a77cb6a8676672ee08c9f1feff4215575e06357b Author: Paul E. McKenney Date: Thu Jan 29 17:30:44 2026 -0800 srcu: Fix warning to permit SRCU-fast readers in NMI handlers SRCU-fast is designed to be used in NMI handlers, even going so far as to use atomic operations for architectures supporting NMIs but not providing NMI-safe per-CPU atomic operations. However, the WARN_ON_ONCE() in __srcu_check_read_flavor() complains if SRCU-fast is used in an NMI handler. This commit therefore modifies that WARN_ON_ONCE() to avoid such complaints. Reported-by: Steven Rostedt Signed-off-by: Paul E. McKenney Tested-by: Steven Rostedt Cc: Andrii Nakryiko Cc: Boqun Feng Cc: Alexei Starovoitov Cc: Peter Zijlstra Cc: bpf@vger.kernel.org Link: https://patch.msgid.link/8232efe8-a7a3-446c-af0b-19f9b523b4f7@paulmck-laptop Signed-off-by: Steven Rostedt (Google) commit f7d327654b886a768fb3baa5b43d151b63e2d4ff Author: Steven Rostedt Date: Mon Jan 26 18:11:47 2026 -0500 bpf: Have __bpf_trace_run() use rcu_read_lock_dont_migrate() In order to switch the protection of tracepoint callbacks from preempt_disable() to srcu_read_lock_fast() the BPF callback from tracepoints needs to have migration prevention as the BPF programs expect to stay on the same CPU as they execute. Put together the RCU protection with migration prevention and use rcu_read_lock_dont_migrate() in __bpf_trace_run(). This will allow tracepoints callbacks to be preemptible. Link: https://lore.kernel.org/all/CAADnVQKvY026HSFGOsavJppm3-Ajm-VsLzY-OeFUe+BaKMRnDg@mail.gmail.com/ Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: "Paul E. McKenney" Cc: Sebastian Andrzej Siewior Cc: Alexei Starovoitov Link: https://patch.msgid.link/20260126231256.335034877@kernel.org Suggested-by: Alexei Starovoitov Signed-off-by: Steven Rostedt (Google) commit 16718274ee75d24a21b10ebc8998c48cc14a656a Author: Steven Rostedt Date: Mon Jan 26 18:11:46 2026 -0500 tracing: perf: Have perf tracepoint callbacks always disable preemption In preparation to convert protection of tracepoints from being protected by a preempt disabled section to being protected by SRCU, have all the perf callbacks disable preemption as perf expects preemption to be disabled when processing tracepoints. While at it, convert the perf system call callback preempt_disable() to a guard(preempt). Link: https://lore.kernel.org/all/20250613152218.1924093-1-bigeasy@linutronix.de/ Link: https://patch.msgid.link/20260108220550.2f6638f3@fedora Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: "Paul E. McKenney" Cc: Sebastian Andrzej Siewior Cc: Alexei Starovoitov Link: https://patch.msgid.link/20260126231256.174621257@kernel.org Signed-off-by: Steven Rostedt (Google) commit 4e6e93dfd501a16650806e7a39aa7b5203867276 Author: Khairul Anuar Romli Date: Mon Dec 29 11:49:02 2025 +0800 arm64: dts: intel: agilex5: Add simple-bus node on top of dma controller node Move dma-controller node under simple-bus node to allow bus node specific property able to be properly defined. This is require to fulfill Agilex5 bus limitation that is limited to 40-addressable-bit. Update the compatible string for the DMA controller nodes in the Agilex5 device tree from the generic "snps,axi-dma-1.01a" to the platform-specific "altr,agilex5-axi-dma". Add fallback capability to ensure driver is able to initialize properly. This change enables the use of platform-specific features and constraints in the driver, such as setting a 40-bit DMA addressable mask through dma-ranges, which is required for Agilex5. It also aligns with the updated device tree bindings and driver support for this compatible string. Signed-off-by: Khairul Anuar Romli Signed-off-by: Dinh Nguyen commit e0f489a52a1a5f9a9ce745feec95d0b517b8d6e9 Author: Dinh Nguyen Date: Sat Dec 27 16:14:08 2025 -0600 ARM: dts: socfpga: fix dtbs_check warning for fpga-region soc (simple-bus): base_fpga_region: 'ranges' is a required property from schema $id: http://devicetree.org/schemas/simple-bus.yaml base_fpga_region (fpga-region): $nodename:0: 'base_fpga_region' does not match '^fpga-region(@.*|-([0-9]|[1-9][0-9]+))?$' from schema $id: http://devicetree.org/schemas/fpga/fpga-region.yaml Signed-off-by: Dinh Nguyen commit 6ba5f9b4241b83dd57fe20a63fd66b6273aa95b1 Author: Dinh Nguyen Date: Fri Dec 26 15:31:16 2025 -0600 ARM: dts: socfpga: add #address-cells and #size-cells for sram node Add #address-cells and #size-cells for sram node to fix below DTB_CHECK warnings: socfpga_arria5_socdk.dtb: sram@ffff0000 (mmio-sram): '#size-cells' is a required property from schema $id: http://devicetree.org/schemas/sram/sram.yaml Signed-off-by: Dinh Nguyen commit 42918d28cb47f1907daa843a68c2abb801f57761 Author: Dinh Nguyen Date: Fri Dec 26 07:05:40 2025 -0600 dt-bindings: altera: document syscon as fallback for sys-mgr For 32-bit Altera SoCFPGA parts, the sys-mgr uses the syscon as a fallback. This change addresses this warning from dtbs_check: sysmgr@ffd08000 (altr,sys-mgr): compatible: 'oneOf' conditional failed, one must be fixed: ['altr,sys-mgr', 'syscon'] is too long 'altr,sys-mgr-s10' was expected 'altr,sys-mgr' was expected from schema $id: http://devicetree.org/schemas/soc/altera/altr,sys-mgr.yaml Acked-by: Krzysztof Kozlowski Signed-off-by: Dinh Nguyen commit 5acb925409e2f089e6e25212ae64d13dea6b464a Author: Krzysztof Kozlowski Date: Tue Dec 23 16:24:45 2025 +0100 arm64: dts: altera: Use lowercase hex The DTS code coding style expects lowercase hex for values and unit addresses. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Dinh Nguyen commit 1cb8486ac5f3adc0a4f38e8b59962c2314fc2ca5 Author: Dinh Nguyen Date: Wed Dec 10 21:59:39 2025 -0600 dt-bindings: arm: altera: combine Intel's SoCFPGA into altera.yaml For all SoCFPGA platforms, whether it has the "intel" or "altr" vendor prefix are referring to the same business unit that is responsible for the platform. And now that Altera has spun off to be a separate corporate entity from Intel, it would make sense to have the device bindings documentation in the same file. Move the Intel AgileX board binding documentations into the same file that contains the Altera ones. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dinh Nguyen commit 67c1d7894766d3a503e6c48c729f17a9a9dea32c Author: Nazim Amirul Date: Wed Dec 3 18:29:00 2025 -0800 arm64: dts: socfpga: agilex5: Add IOMMUS property for ethernet nodes To enable SMMU integration, populate the iommus property to the ethernet device-tree node. Signed-off-by: Nazim Amirul Signed-off-by: Dinh Nguyen commit ebb6a68a4857107f3574ef058f2b83f3288d0d08 Author: Niravkumar L Rabara Date: Tue Dec 2 18:16:52 2025 +0800 arm64: dts: socfpga: agilex5: add support for modular board The Agilex5 Modular board consists of a compute module (Agilex5 SoCFPGA) attached to a carrier board that provides PCIe and additional system interfaces. Signed-off-by: Niravkumar L Rabara Signed-off-by: Dinh Nguyen commit 2bd42d859b093e3a4c71258767c3cac298265993 Author: Niravkumar L Rabara Date: Tue Dec 2 18:16:51 2025 +0800 dt-bindings: intel: Add Agilex5 SoCFPGA modular board Add compatible for Agilex5 SoCFPGA modular board. Signed-off-by: Niravkumar L Rabara Acked-by: Krzysztof Kozlowski Signed-off-by: Dinh Nguyen commit 8c4caab05ff162e2dd9b66a72a21d9605fb143cf Author: Khairul Anuar Romli Date: Wed Dec 3 07:47:35 2025 +0800 arm64: dts: socfpga: agilex5: Add dma-coherent property Add the `dma-coherent` property to these device nodes to inform the kernel and DMA subsystem that the devices support hardware-managed cache coherence. Changes: - Add `dma-coherent` to `cdns,hp-nfc` - Add `dma-coherent` to both `snps,axi-dma-1.01a` instances (dmac0, dmac1) This aligns the Agilex5 device tree with the coherent DMA-capable devices accordingly. Signed-off-by: Khairul Anuar Romli Signed-off-by: Dinh Nguyen commit 2c1ba9c2adf0fda96eaaebd8799268a7506a8fc9 Author: Aaradhana Sahu Date: Tue Jan 27 09:04:00 2026 +0530 wifi: ath12k: clear stale link mapping of ahvif->links_map When an arvif is initialized in non-AP STA mode but MLO connection preparation fails before the arvif is created (arvif->is_created remains false), the error path attempts to delete all links. However, link deletion only executes when arvif->is_created is true. As a result, ahvif retains a stale entry of arvif that is initialized but not created. When a new arvif is initialized with the same link id, this stale mapping triggers the following WARN_ON. WARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k], CPU#3: wpa_supplicant/275 Call trace: ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k] (P) drv_change_vif_links+0xbc/0x1a4 [mac80211] ieee80211_vif_update_links+0x54c/0x6a0 [mac80211] ieee80211_vif_set_links+0x40/0x70 [mac80211] ieee80211_prep_connection+0x84/0x450 [mac80211] ieee80211_mgd_auth+0x200/0x480 [mac80211] ieee80211_auth+0x14/0x20 [mac80211] cfg80211_mlme_auth+0x90/0xf0 [cfg80211] nl80211_authenticate+0x32c/0x380 [cfg80211] genl_family_rcv_msg_doit+0xc8/0x134 Fix this issue by unassigning the link vif and clearing ahvif->links_map if arvif is only initialized but not created. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Fixes: 81e4be30544e ("wifi: ath12k: handle link removal in change_vif_links()") Signed-off-by: Aaradhana Sahu Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260127033400.1721220-1-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 05e810c8cffb3e96f6b967c9a57c34d4a6a6347e Author: Aaradhana Sahu Date: Fri Jan 23 12:42:53 2026 +0530 wifi: ath12k: Add support TX hardware queue stats Add support to request and receive TX hardware queue stats using HTT stats type 3. This stats type reports MPDU mac id and hardware queue information, including xretry, BAR, RTS, CTS, self, and QoS-null counts, along with underrun, flush, and filter counters. Sample output: ------------- echo 3 >/sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats_type cat /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats HTT_TX_HWQ_STATS_CMN_TLV: mac_id = 0 hwq_id = 0 xretry = 0 underrun_cnt = 0 flush_cnt = 0 filt_cnt = 0 null_mpdu_bmap = 0 user_ack_failure = 379 ack_tlv_proc = 0 sched_id_proc = 0 null_mpdu_tx_count = 0 mpdu_bmap_not_recvd = 0 num_bar = 0 rts = 0 cts2self = 0 qos_null = 0 mpdu_tried_cnt = 379 mpdu_queued_cnt = 379 mpdu_ack_fail_cnt = 0 mpdu_filt_cnt = 0 false_mpdu_ack_count = 0 txq_timeout = 0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Signed-off-by: Aaradhana Sahu Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260123071253.2202644-4-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit f20de310882d3c9b0a051b30dc39d0b640cc9cbc Author: Aaradhana Sahu Date: Fri Jan 23 12:42:52 2026 +0530 wifi: ath12k: Add support RX PDEV stats Add support to request and receive RX pdev firmware stats using HTT stats type 2. This stats type reports PPDU and MPDU counters, firmware ring and buffer statistics, and RX suspend and resume counts. Note: Currently, firmware on mobile-centric chipsets do not maintain these statistics, so a query will not return any information. Sample output: ------------- echo 2 >/sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats_type cat /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats HTT_RX_PDEV_FW_STATS_TLV: mac_id = 0 ppdu_recvd = 1522 mpdu_cnt_fcs_ok = 1522 mpdu_cnt_fcs_err = 0 ... fw_ring_mpdu_ind = 1522 fw_ring_mgmt_subtype = 0:0, 1:0, 2:0, 3:0, 4:21, 5:0, 6:0, 7:0, 8:1501, 9:0, 10:0, 11:0, 12:0, 13:0, 14:0, 15:0 fw_ring_ctrl_subtype = 0:0, 1:0, 2:0, 3:0, 4:0, 5:0, 6:0, 7:0, 8:0, 9:0, 10:0, 11:0, 12:0, 13:0, 14:0, 15:0 fw_ring_mcast_data_msdu = 0 fw_pkt_buf_ring_refill_cnt = 1567 fw_pkt_buf_ring_empty_cnt = 1 ... rx_suspend_cnt = 4 rx_suspend_fail_cnt = 0 rx_resume_cnt = 4 rx_resume_fail_cnt = 0 rx_ring_switch_cnt = 0 rx_ring_restore_cnt = 0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Aaradhana Sahu Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260123071253.2202644-3-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit e4763898bb1325dbb3792961b6d607b5c6452d64 Author: Aaradhana Sahu Date: Fri Jan 23 12:42:51 2026 +0530 wifi: ath12k: Fix index decrement when array_len is zero Currently, print_array_to_buf_index() decrements index unconditionally. This may lead to invalid buffer access when array_len is zero. Fix this by decrementing index only when array_len is non-zero. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: adf6df963c03 ("wifi: ath12k: Add support to parse requested stats_type") Signed-off-by: Aaradhana Sahu Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260123071253.2202644-2-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7b789ea390457d5751ae5b1ede81ca8564a618d1 Author: Wei Zhang Date: Thu Jan 22 22:48:17 2026 -0800 wifi: ath12k: support OBSS PD configuration for AP mode Configure HE OBSS PD for spatial reuse in ath12k based on mac80211 HE SPR parameters in AP mode. This adds a pdev-level helper that programs SRG/non-SRG OBSS PD thresholds, per-AC enablement, SR prohibit control, and SRG/non-SRG BSS color and partial BSSID bitmaps via WMI. Replace the previous vdev-level OBSS SPR command usage with the new pdev-level configuration path, allowing firmware to apply HE spatial reuse behavior according to the HE SPR/OBSS PD settings provided by mac80211. Tested-on: WCN7850 hw2.0 PCI WLAN.IOE_HMT.1.1-00011-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Tested-on: QCN9274 hw2.0 WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Wei Zhang Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260123064817.364047-3-wei.zhang@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 6dbd496a170b62c7ac56a0cb3aaf170b3ecbb515 Author: Wei Zhang Date: Thu Jan 22 22:48:16 2026 -0800 wifi: ath12k: add WMI support for spatial reuse parameter configuration Add WMI support for configuring SRG and non-SRG OBSS PD bitmaps at the pdev level. The new commands allow the host to set BSS color bitmaps, partial BSSID bitmaps, and the corresponding enable masks used for SRG/non-SRG OBSS PD processing. Introduce new WMI command IDs, TLV tags, a service flag (WMI_TLV_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT), and a bitmap payload structure required by these commands. These additions are needed to support HE Spatial Reuse and firmware-managed OBSS PD behavior. The APIs introduced in this patch will be utilized in an upcoming patch. Tested-on: WCN7850 hw2.0 PCI WLAN.IOE_HMT.1.1-00011-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Tested-on: QCN9274 hw2.0 WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Wei Zhang Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260123064817.364047-2-wei.zhang@oss.qualcomm.com Signed-off-by: Jeff Johnson commit adce4fa499611c1c6eaf19d6fb0305ec0731d06f Author: Miaoqing Pan Date: Wed Jan 21 17:50:55 2026 +0800 dt-bindings: net: wireless: ath11k-pci: deprecate 'firmware-name' property The firmware-name property was originally introduced to allow end-users and integrators to select use-case-specific firmware for the WCN6855. However, specifying firmware for an M.2 WLAN module in the Device Tree is not appropriate. Instead, this functionality will be handled within the ath11k driver. Therefore, the firmware-name property is now deprecated. Acked-by: Rob Herring (Arm) Signed-off-by: Miaoqing Pan Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260121095055.3683957-3-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit c386a2b1068910538e87ef1cf2fc938ebf7e218f Author: Miaoqing Pan Date: Wed Jan 21 17:50:54 2026 +0800 wifi: ath11k: add usecase firmware handling based on device compatible For M.2 WLAN chips, there is no suitable DTS node to specify the firmware-name property. In addition, assigning firmware for the M.2 PCIe interface causes chips that do not use usecase specific firmware to fail. Therefore, abandoning the approach of specifying firmware in DTS. As an alternative, propose a static lookup table mapping device compatible to firmware names. Currently, only WCN6855 HW2.1 requires this. However, support for the firmware-name property is retained to keep the ABI backwards compatible. For details on usecase specific firmware, see: https://lore.kernel.org/all/20250522013444.1301330-3-miaoqing.pan@oss.qualcomm.com/. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 Fixes: edbbc647c4f3 ("wifi: ath11k: support usercase-specific firmware overrides") Signed-off-by: Miaoqing Pan Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260121095055.3683957-2-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit e55ac348089e579fc224569c7bd90340bf2439f9 Author: Ziyi Guo Date: Fri Jan 23 04:58:22 2026 +0000 wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() ath10k_sdio_fw_crashed_dump() calls ath10k_coredump_new() which requires ar->dump_mutex to be held, as indicated by lockdep_assert_held() in that function. However, the SDIO implementation does not acquire this lock, unlike the PCI and SNOC implementations which properly hold the mutex. Additionally, ar->stats.fw_crash_counter is documented as protected by ar->data_lock in core.h, but the SDIO implementation modifies it without holding this spinlock. Add the missing mutex_lock()/mutex_unlock() around the coredump operations, and add spin_lock_bh()/spin_unlock_bh() around the fw_crash_counter increment, following the pattern used in ath10k_pci_fw_dump_work() and ath10k_snoc_fw_crashed_dump(). Fixes: 3c45f21af84e ("ath10k: sdio: add firmware coredump support") Signed-off-by: Ziyi Guo Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260123045822.2221549-1-n7l8m4@u.northwestern.edu Signed-off-by: Jeff Johnson commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d Author: Ziyi Guo Date: Fri Jan 23 17:56:11 2026 +0000 wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to assert that ar->data_lock should be held by the caller, but neither ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock before calling this function. The field arsta->peer_ps_state is documented as protected by ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable, ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock. Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update, and remove the lockdep_assert_held() to be aligned with new locking, following the pattern used by other WMI event handlers in the driver. Signed-off-by: Ziyi Guo Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu [removed excess blank line] Signed-off-by: Jeff Johnson commit afcf3ec615c918dd71139e7ca2f4812ceea48cd7 Author: Dmitry Baryshkov Date: Mon Jan 19 19:07:57 2026 +0200 wifi: ath10k: snoc: support powering on the device via pwrseq The WCN39xx family of WiFi/BT chips incorporates a simple PMU, spreading voltages over internal rails. Implement support for using powersequencer for this family of ATH10k devices in addition to using regulators. Reviewed-by: Bartosz Golaszewski Signed-off-by: Dmitry Baryshkov Link: https://patch.msgid.link/20260119-wcn3990-pwrctl-v3-3-948df19f5ec2@oss.qualcomm.com Signed-off-by: Jeff Johnson commit da562d92e6755c00cd67845a8dbfb908dac51a9c Author: Damien Le Moal Date: Fri Jan 30 15:28:45 2026 +0900 block: introduce bdev_rot() Introduce the helper function bdev_rot() to test if a block device is a rotational one. The existing function bdev_nonrot() which tests for the opposite condition is redefined using this new helper. This avoids the double negation (operator and name) that appears when testing if a block device is a rotational device, thus making the code a little easier to read. Call sites of bdev_nonrot() in the block layer are updated to use this new helper. Remaining users in other subsystems are left unchanged for now. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 5c4378b7b0e1f45cf38e77db9305ee2c7bf88002 Merge: 377521af034108 31c9387d0d84bc Author: Thomas Gleixner Date: Fri Jan 30 15:40:05 2026 +0100 Merge branch 'core/entry' into sched/core Pull the entry update to avoid merge conflicts with the time slice extension changes. Signed-off-by: Thomas Gleixner commit 31c9387d0d84bc1d643a0c30155b6d92d05c92fc Author: Jinjie Ruan Date: Wed Jan 28 11:19:33 2026 +0800 entry: Inline syscall_exit_work() and syscall_trace_enter() After switching ARM64 to the generic entry code, a syscall_exit_work() appeared as a profiling hotspot because it is not inlined. Inlining both syscall_trace_enter() and syscall_exit_work() provides a performance gain when any of the work items is enabled. With audit enabled this results in a ~4% performance gain for perf bench basic syscall on a kunpeng920 system: | Metric | Baseline | Inlined | Change | | ---------- | ----------- | ----------- | ------ | | Total time | 2.353 [sec] | 2.264 [sec] | ↓3.8% | | usecs/op | 0.235374 | 0.226472 | ↓3.8% | | ops/sec | 4,248,588 | 4,415,554 | ↑3.9% | Small gains can be observed on x86 as well, though the generated code optimizes for the work case, which is counterproductive for high performance scenarios where such entry/exit work is usually avoided. Avoid this by marking the work check in syscall_enter_from_user_mode_work() unlikely, which is what the corresponding check in the exit path does already. [ tglx: Massage changelog and add the unlikely() ] Signed-off-by: Jinjie Ruan Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128031934.3906955-14-ruanjinjie@huawei.com commit 578b21fd3ab2d9901ce40ed802e428a41a40610d Author: Jinjie Ruan Date: Wed Jan 28 11:19:30 2026 +0800 entry: Add arch_ptrace_report_syscall_entry/exit() ARM64 requires a architecture specific ptrace wrapper as it needs to save and restore scratch registers. Provide arch_ptrace_report_syscall_entry/exit() wrappers which fall back to ptrace_report_syscall_entry/exit() if the architecture does not provide them. No functional change intended. [ tglx: Massaged changelog and comments ] Suggested-by: Mark Rutland Suggested-by: Thomas Gleixner Signed-off-by: Jinjie Ruan Signed-off-by: Thomas Gleixner Reviewed-by: Kevin Brodsky Link: https://patch.msgid.link/20260128031934.3906955-11-ruanjinjie@huawei.com commit e1647100c22eb718e9833211722cbb78e339047c Author: Jinjie Ruan Date: Wed Jan 28 11:19:29 2026 +0800 entry: Rework syscall_exit_to_user_mode_work() for architecture reuse syscall_exit_to_user_mode_work() invokes local_irq_disable_exit_to_user() and syscall_exit_to_user_mode_prepare() after handling pending syscall exit work. The conversion of ARM64 to the generic entry code requires this to be split up, so move the invocations of local_irq_disable_exit_to_user() and syscall_exit_to_user_mode_prepare() into the only caller. No functional change intended. [ tglx: Massaged changelog and comments ] Signed-off-by: Jinjie Ruan Signed-off-by: Thomas Gleixner Reviewed-by: Kevin Brodsky Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/20260128031934.3906955-10-ruanjinjie@huawei.com commit 03150a9f84b328f5c724b8ed9ff8600c2d7e2d7b Author: Jinjie Ruan Date: Wed Jan 28 11:19:21 2026 +0800 entry: Remove unused syscall argument from syscall_trace_enter() The 'syscall' argument of syscall_trace_enter() is immediately overwritten before any real use and serves only as a local variable, so drop the parameter. No functional change intended. Signed-off-by: Jinjie Ruan Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260128031934.3906955-2-ruanjinjie@huawei.com commit e4ec36bf7bc7023e1d207b1277755b0da381f20f Author: Icenowy Zheng Date: Fri Jan 2 23:52:43 2026 +0800 MIPS: Loongson64: dts: fix phy-related definition of LS7A GMAC Currently the LS7A GMAC device tree node lacks a proper phy-handle property pointing to the PHY node. In addition, the phy-mode property specifies "rgmii" without any internal delay information, which means the board trace needs to add 2ns delay to the RGMII data lines; but that isn't known to happen on any Loongson board. The ACPI-based initialization codepath, which is used on LoongArch-based 3A5000 + 7A1000 hardwares, specifies "rgmii-id" phy mode, which should be the one we are using. Add the lacking phy-handle property and set proper phy-mode. Tested on a LS3A4000_7A1000_NUC_BOARD_V2.1 board with YT8521S PHY. Signed-off-by: Icenowy Zheng Reviewed-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit 026d70dcfe5de1543bb8edb8e50d22dc16863e6b Author: Brian Masney Date: Mon Jan 12 17:48:10 2026 -0500 clk: microchip: core: allow driver to be compiled with COMPILE_TEST This driver currently only supports builds against a PIC32 target. To avoid future breakage in the future, let's update the Kconfig and the driver so that it can be built with CONFIG_COMPILE_TEST enabled. Note that with the existing asm calls is not how I'd want to do this today if this was a new driver, however I don't have access to this hardware. To avoid any breakage, let's keep the existing behavior. Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit 89ace0736208de07577ecc16962927930baf4e7d Author: Brian Masney Date: Mon Jan 12 17:48:09 2026 -0500 MIPS: drop unused pic32.h header All users of the MIPS pic32.h asm header have been migrated to linux/platform_data/pic32.h, so let's go ahead and drop the unused asm variant. Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit 5aa5879eeebbef9cea33b3ca127d713a293d75d0 Author: Brian Masney Date: Mon Jan 12 17:48:08 2026 -0500 watchdog: pic32-wdt: update include to use pic32.h from platform_data Use the linux/platform_data/pic32.h include instead of asm/mach-pic32/pic32.h so that the asm variant can be dropped. This is in preparation for allowing some drivers to be compiled on other architectures with COMPILE_TEST enabled. Acked-by: Guenter Roeck Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit 0f8a61ca78d65e470eaf0d1c01f28d53ab56d0a7 Author: Brian Masney Date: Mon Jan 12 17:48:07 2026 -0500 watchdog: pic32-dmt: update include to use pic32.h from platform_data Use the linux/platform_data/pic32.h include instead of asm/mach-pic32/pic32.h so that the asm variant can be dropped. This is in preparation for allowing some drivers to be compiled on other architectures with COMPILE_TEST enabled. Acked-by: Guenter Roeck Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit 24cad1a22848bb7cece0000e443c368e205b551f Author: Brian Masney Date: Mon Jan 12 17:48:06 2026 -0500 serial: pic32_uart: update include to use pic32.h from platform_data Use the linux/platform_data/pic32.h include instead of asm/mach-pic32/pic32.h so that the asm variant can be dropped. This is in preparation for allowing some drivers to be compiled on other architectures with COMPILE_TEST enabled. Signed-off-by: Brian Masney Reviewed-by: Jiri Slaby Signed-off-by: Thomas Bogendoerfer commit ed65ae9f6c6b030e0a5912b7a88ca02f57cbc43e Author: Brian Masney Date: Mon Jan 12 17:48:05 2026 -0500 rtc: pic32: update include to use pic32.h from platform_data Use the linux/platform_data/pic32.h include instead of asm/mach-pic32/pic32.h so that the asm variant can be dropped. This is in preparation for allowing some drivers to be compiled on other architectures with COMPILE_TEST enabled. Acked-by: Alexandre Belloni Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit b8694faa1a0fa848cb0a593ab2d7723868277926 Author: Brian Masney Date: Mon Jan 12 17:48:04 2026 -0500 pinctrl: pic32: update include to use pic32.h from platform_data Use the linux/platform_data/pic32.h include instead of asm/mach-pic32/pic32.h so that the asm variant can be dropped. This is in preparation for allowing some drivers to be compiled on other architectures with COMPILE_TEST enabled. Acked-by: Linus Walleij Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit d6618d277c1a8740ca37b8e4d4a35075e75a7c40 Author: Brian Masney Date: Mon Jan 12 17:48:03 2026 -0500 mmc: sdhci-pic32: update include to use pic32.h from platform_data Use the linux/platform_data/pic32.h include instead of asm/mach-pic32/pic32.h so that the asm variant can be dropped. This is in preparation for allowing some drivers to be compiled on other architectures with COMPILE_TEST enabled. Signed-off-by: Brian Masney Acked-by: Adrian Hunter Acked-by: Ulf Hansson Signed-off-by: Thomas Bogendoerfer commit 06e6f8112bc618101f242f77e45986ddbb11217f Author: Brian Masney Date: Mon Jan 12 17:48:02 2026 -0500 irqchip/irq-pic32-evic: update include to use pic32.h from platform_data Use the linux/platform_data/pic32.h include instead of asm/mach-pic32/pic32.h so that the asm variant can be dropped. This is in preparation for allowing some drivers to be compiled on other architectures with COMPILE_TEST enabled. Signed-off-by: Brian Masney Acked-by: Thomas Gleixner Signed-off-by: Thomas Bogendoerfer commit 07caa83edd9a98d24769c1648b482b03839602ed Author: Brian Masney Date: Mon Jan 12 17:48:01 2026 -0500 clk: microchip: core: update include to use pic32.h from platform_data Use the linux/platform_data/pic32.h include instead of asm/mach-pic32/pic32.h so that the asm variant can be dropped. This is in preparation for allowing some drivers to be compiled on other architectures with COMPILE_TEST enabled. Signed-off-by: Brian Masney Acked-by: Claudiu Beznea Signed-off-by: Thomas Bogendoerfer commit 77485091b61399df20fad8b2fdf3e8cac3530bb1 Author: Brian Masney Date: Mon Jan 12 17:48:00 2026 -0500 MIPS: update include to use pic32.h from platform_data Use the linux/platform_data/pic32.h include instead of asm/mach-pic32/pic32.h so that the asm variant can be dropped. This is in preparation for allowing some drivers to be compiled on other architectures with COMPILE_TEST enabled. Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit d1c7ad04413717c0f61db33404a1592f0dd26f4f Author: Brian Masney Date: Mon Jan 12 17:47:59 2026 -0500 MAINTAINERS: add include/linux/platform_data/pic32.h to MIPS entry Add the file include/linux/platform_data/pic32.h to the MIPS maintainer entry. Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit d095d2dbcc8df60ede1674e28ce0f0a478d37535 Author: Brian Masney Date: Mon Jan 12 17:47:58 2026 -0500 MIPS: copy pic32.h header file from asm/mach-pic32/ to include/platform-data/ There are currently some pic32 MIPS drivers that are in tree, and are only configured to be compiled on the pic32 platform. There's a risk of breaking some of these drivers when migrating drivers away from legacy APIs. It happened to me with a pic32 clk driver. Let's go ahead and copy the MIPS pic32.h header to include/linux/platform_data/, and make a minor update to allow compiling this on other architectures. This will make it easier, and cleaner to enable COMPILE_TEST for some of these pic32 drivers. The asm variant of the header file will be dropped once all drivers have been updated. Link: https://lore.kernel.org/linux-clk/CABx5tq+eOocJ41X-GSgkGy6S+s+Am1yCS099wqP695NtwALTmg@mail.gmail.com/T/ Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit 3391d097cda8f803c062fb6326f0736a3379e2f9 Author: Brian Masney Date: Mon Jan 12 17:47:57 2026 -0500 MIPS: pic32: drop unused include linux/io.h from pic32.h The linux/io.h include is not used, so let's drop it from pic32.h. Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit 18635a70801cdd5635c7a82e0acb4c5075f74a91 Author: Brian Masney Date: Mon Jan 12 17:47:56 2026 -0500 MIPS: pic32: include linux/types.h on pic32.h The pic32.h header file currently includes linux/io.h, however that header is not actually used. The only header that's needed by this C file is linux/types.h. Let's include it so that linux/io.h can be dropped. Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit 4f82eef99abf7a1c1e718303b24bdb8b490e5a26 Author: Brian Masney Date: Mon Jan 12 17:47:55 2026 -0500 MIPS: pic32: include linux/io.h header on several files The pic32.h header includes linux/io.h, however nothing from that include file is directly used by pic32.h. Several C files that include pic32.h indirectly depend on linux/io.h, so let's go ahead and add the missing include so that linux/io.h can be dropped from pic32.h. Signed-off-by: Brian Masney Signed-off-by: Thomas Bogendoerfer commit d463fc5ca1ace0b2e8bb764df04fc12ecd6f8e2b Author: Randy Dunlap Date: Sun Dec 28 11:04:43 2025 -0800 mips: LOONGSON32: drop a dangling Kconfig symbol CPU_HAS_LOAD_STORE_LR is not used anywhere in the kernel sources, so drop it. Fixes: 85c4354076ca ("MIPS: loongson32: Switch to generic core") Signed-off-by: Randy Dunlap Reviewed-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 Author: John Garry Date: Wed Jan 7 09:40:06 2026 +0000 MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which is a valid index - so add a check for this. Signed-off-by: John Garry Reviewed-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer commit b4af7d194dc879353829f3c56988a68fbba1fbdd Author: David LaPorte Date: Thu Jan 29 17:33:22 2026 -0800 mtd: spinand: Disable continuous read during probe Macronix serial NAND devices with continuous read support do not clear the configuration register on soft reset and lack a hardware reset pin. When continuous read is interrupted (e.g., during reboot), the feature remains enabled at the device level. With continuous read enabled, the OOB area becomes inaccessible and all reads are instead directed to the main area. As a result, during partition allocation as part of MTD device registration, the first two bytes of the main area for the master block are read and indicate that the block is bad. This process repeats for every subsequent block for the partition. All reads and writes that reference the BBT find no good blocks and fail. The only paths for recovery from this state are triggering the continuous read feature by way of raw MTD reads or through a NAND device power drain. Disable continuous read explicitly during spinand probe to ensure quiescent feature state. Fixes: 631cfdd0520d ("mtd: spi-nand: Add continuous read support") Cc: stable@vger.kernel.org Signed-off-by: David LaPorte Reviewed-by: Gunnar Kudrjavets Reviewed-by: Mikhail Kshevetskiy Signed-off-by: Miquel Raynal commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e Author: Chen Ni Date: Fri Jan 30 17:19:04 2026 +0800 ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() The devm_gpiod_get_optional() function may return an error pointer (ERR_PTR) in case of a genuine failure during GPIO acquisition, not just NULL which indicates the legitimate absence of an optional GPIO. Add an IS_ERR() check after the function call to catch such errors and propagate them to the probe function, ensuring the driver fails to load safely rather than proceeding with an invalid pointer. Signed-off-by: Chen Ni Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit 1795dc528c13c4cb731c6db2322d0c995c997fa4 Author: Ethan Nelson-Moore Date: Thu Jan 29 21:26:23 2026 -0800 EDAC/r82600: Remove this obsolete driver This driver supports the Radisys 82600 embedded chipset, which was used with Pentium III-era CPUs. It is highly unlikely that it is still used. Besides its own documentation, the only information I was able to find about the R82600, after looking through many pages of Google results, was that it was used in a Nokia 2G GSM base station. The original author said: "This was after Bluesmoke (watch was out-of-tree), and was pay of the first set of in tree edac drivers (a fresh design as far as I remember). This particular driver did apparently get used by Akamai quite heavily and widely  but all ancient history now. The Radisys r82600 edac driver  r82600_edac.c was closely related hardware from the same era, and can probably go too (although being embedded hardware, it's possible its production lifespan was considerably longer). Tim." Mail is https://lore.kernel.org/r/01BCCA37-F6A2-458B-BFE7-99C7724CDDEA@buttersideup.com but lkml drops html mail so quoting the relevant info here too. [ bp: Massage and extend commit message. ] Signed-off-by: Ethan Nelson-Moore Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260130052633.13119-1-enelsonmoore@gmail.com commit faddeb848305e79db89ee0479bb0e33380656321 Author: Deepanshu Kartikey Date: Fri Jan 30 14:51:34 2026 +0530 gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This causes a use-after-free when iomap_write_end_inline() later attempts to write to the inline data area. The bug sequence: 1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode metadata into dibh 2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode) 3. Calls release_metapath() which calls brelse(dibh), dropping refcount to 0 4. kswapd reclaims the page (~39ms later in the syzbot report) 5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data 6. KASAN detects use-after-free write to freed memory Fix by storing dibh in iomap->private and incrementing its refcount with get_bh() in gfs2_iomap_begin(). The buffer is then properly released in gfs2_iomap_end() after the inline write completes, ensuring the page stays alive for the entire iomap operation. Note: A C reproducer is not available for this issue. The fix is based on analysis of the KASAN report and code review showing the buffer head is freed before use. [agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid leaks in gfs2_iomap_get() and gfs2_iomap_alloc().] Reported-by: syzbot+ea1cd4aa4d1e98458a55@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ea1cd4aa4d1e98458a55 Fixes: d0a22a4b03b8 ("gfs2: Fix iomap write page reclaim deadlock") Signed-off-by: Deepanshu Kartikey Signed-off-by: Andreas Gruenbacher commit 8bbdeb7a25b4cd3d829136a2e12982b8ee7d7991 Author: David Howells Date: Fri Oct 17 08:46:43 2025 +0100 pkcs7, x509: Add ML-DSA support Add support for ML-DSA keys and signatures to the CMS/PKCS#7 and X.509 implementations. ML-DSA-44, -65 and -87 are all supported. For X.509 certificates, the TBSCertificate is required to be signed directly; for CMS, direct signing of the data is preferred, though use of SHA512 (and only that) as an intermediate hash of the content is permitted with signedAttrs. Signed-off-by: David Howells cc: Lukas Wunner cc: Ignat Korchagin cc: Stephan Mueller cc: Eric Biggers cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org commit f3eccecd782dbaf33d5ad0d1fd22ea277300acdb Author: David Howells Date: Wed Jan 21 12:41:42 2026 +0000 pkcs7: Allow the signing algo to do whatever digestion it wants itself Allow the data to be verified in a PKCS#7 or CMS message to be passed directly to an asymmetric cipher algorithm (e.g. ML-DSA) if it wants to do whatever passes for hashing/digestion itself. The normal digestion of the data is then skipped as that would be ignored unless another signed info in the message has some other algorithm that needs it. The 'data to be verified' may be the content of the PKCS#7 message or it will be the authenticatedAttributes (signedAttrs if CMS), modified, if those are present. This is done by: (1) Make ->m and ->m_size point to the data to be verified rather than making public_key_verify_signature() access the data directly. This is so that keyctl(KEYCTL_PKEY_VERIFY) will still work. (2) Add a flag, ->algo_takes_data, to indicate that the verification algorithm wants to access the data to be verified directly rather than having it digested first. (3) If the PKCS#7 message has authenticatedAttributes (or CMS signedAttrs), then the digest contained therein will be validated as now, and the modified attrs blob will either be digested or assigned to ->m as appropriate. (4) If present, always copy and modify the authenticatedAttributes (or signedAttrs) then digest that in one go rather than calling the shash update twice (once for the tag and once for the rest). (5) For ML-DSA, point ->m to the TBSCertificate instead of digesting it and using the digest. Note that whilst ML-DSA does allow for an "external mu", CMS doesn't yet have that standardised. Signed-off-by: David Howells cc: Lukas Wunner cc: Ignat Korchagin cc: Stephan Mueller cc: Eric Biggers cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org commit f728074f1f577565c97e465652c3d4afb0964013 Author: David Howells Date: Mon Jan 26 09:49:24 2026 +0000 pkcs7, x509: Rename ->digest to ->m Rename ->digest and ->digest_len to ->m and ->m_size to represent the input to the signature verification algorithm, reflecting that ->digest may no longer actually *be* a digest. Signed-off-by: David Howells Reviewed-by: Jarkko Sakkinen cc: Lukas Wunner cc: Ignat Korchagin cc: Stephan Mueller cc: Eric Biggers cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org commit 2c62068ac86bdd917a12eef49ba82ec8b091208b Author: David Howells Date: Wed Jan 21 13:33:37 2026 +0000 x509: Separately calculate sha256 for blacklist Calculate the SHA256 hash for blacklisting purposes independently of the signature hash (which may be something other than SHA256). This is necessary because when ML-DSA is used, no digest is calculated. Note that this represents a change of behaviour in that the hash used for the blacklist check would previously have been whatever digest was used for, say, RSA-based signatures. It may be that this is inadvisable. Signed-off-by: David Howells Reviewed-by: Jarkko Sakkinen cc: Lukas Wunner cc: Ignat Korchagin cc: Stephan Mueller cc: Eric Biggers cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org commit 3227c3a89d65fe7482312b7b27038d9ebd86f210 Author: Sascha Bischoff Date: Wed Jan 28 18:07:33 2026 +0000 irqchip/gic-v5: Check if impl is virt capable Now that there is support for creating a GICv5-based guest with KVM, check that the hardware itself supports virtualisation, skipping the setting of struct gic_kvm_info if not. Note: If native GICv5 virt is not supported, then nor is FEAT_GCIE_LEGACY, so we are able to skip altogether. Signed-off-by: Sascha Bischoff Reviewed-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260128175919.3828384-33-sascha.bischoff@arm.com [maz: cosmetic changes] Signed-off-by: Marc Zyngier commit 9435c1e1431003e23aa34ef8e46c30d09c3dbcb5 Author: Sascha Bischoff Date: Wed Jan 28 18:00:52 2026 +0000 KVM: arm64: gic: Set vgic_model before initing private IRQs Different GIC types require the private IRQs to be initialised differently. GICv5 is the culprit as it supports both a different number of private IRQs, and all of these are PPIs (there are no SGIs). Moreover, as GICv5 uses the top bits of the interrupt ID to encode the type, the intid also needs to computed differently. Up until now, the GIC model has been set after initialising the private IRQs for a VCPU. Move this earlier to ensure that the GIC model is available when configuring the private IRQs. While we're at it, also move the setting of the in_kernel flag and implementation revision to keep them grouped together as before. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260128175919.3828384-7-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit b583177aafe3ca753ddd3624c8731a93d0cd0b37 Author: Sascha Bischoff Date: Wed Jan 28 18:00:06 2026 +0000 arm64/sysreg: Drop ICH_HFGRTR_EL2.ICC_HAPR_EL1 and make RES1 The GICv5 architecture is dropping the ICC_HAPR_EL1 and ICV_HAPR_EL1 system registers. These registers were never added to the sysregs, but the traps for them were. Drop the trap bit from the ICH_HFGRTR_EL2 and make it Res1 as per the upcoming GICv5 spec change. Additionally, update the EL2 setup code to not attempt to set that bit. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260128175919.3828384-4-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 4a03431b742b4edc24fe1a14d355de1df6d80f86 Author: Sascha Bischoff Date: Wed Jan 28 17:59:50 2026 +0000 KVM: arm64: gic-v3: Switch vGIC-v3 to use generated ICH_VMCR_EL2 The VGIC-v3 code relied on hand-written definitions for the ICH_VMCR_EL2 register. This register, and the associated fields, is now generated as part of the sysreg framework. Move to using the generated definitions instead of the hand-written ones. There are no functional changes as part of this change. Signed-off-by: Sascha Bischoff Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260128175919.3828384-3-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 9321f9d27fbaf6c4f32772fc2620961a0c492135 Author: Ben Zong-You Xie Date: Thu Jan 29 14:43:34 2026 +0800 pwm: Remove redundant check in pwm_ops_check() ops->write_waveform is already known to be non-NULL so there is no need to check it a second time. The superflous check was introduced in commit 17e40c25158f ("pwm: New abstraction for PWM waveforms"). Signed-off-by: Ben Zong-You Xie Link: https://patch.msgid.link/20260129-fix-pwm-ops-check-v1-1-6f0b7952c875@andestech.com Signed-off-by: Uwe Kleine-König commit 82a32eacbacc6f7e372f98999e5ee1ee0dd7462d Author: Zenghui Yu (Huawei) Date: Wed Jan 28 15:52:08 2026 +0800 KVM: arm64: Fix various comments Use tab instead of whitespaces, as well as 2 minor typo fixes. Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260128075208.23024-1-zenghui.yu@linux.dev Signed-off-by: Marc Zyngier commit 9d46e83a72392a644604458448a72d7c45977f0f Author: Zenghui Yu (Huawei) Date: Fri Jan 30 17:44:35 2026 +0800 KVM: arm64: nv: Add trap config for DBGWCR<15>_EL1 Seems that it was missed when MDCR_EL2 was first added to the trap forwarding infrastructure. Add it back. Fixes: cb31632c4452 ("KVM: arm64: nv: Add trap forwarding for MDCR_EL2") Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260130094435.39942-1-zenghui.yu@linux.dev Signed-off-by: Marc Zyngier commit e33839b514a8af27ba03f9f2a414d154aa980320 Author: Christoph Hellwig Date: Fri Jan 30 06:19:26 2026 +0100 xfs: add sysfs stats for zoned GC Add counters of read, write and zone_reset operations as well as GC written bytes to sysfs. This way they can be easily used for monitoring tools and test cases. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit edf6078212c366459d3c70833290579b200128b1 Author: Christoph Hellwig Date: Fri Jan 30 06:19:25 2026 +0100 xfs: give the defer_relog stat a xs_ prefix Make this counter naming consistent with all the others. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 41374ae69ec3a910950d3888f444f80678c6f308 Author: Christoph Hellwig Date: Fri Jan 30 06:19:24 2026 +0100 xfs: add zone reset error injection Add a new errortag to test that zone reset errors are handled correctly. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Hans Holmberg Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 06873dbd940dea955b30efb0b59212f1c858f6d9 Author: Christoph Hellwig Date: Fri Jan 30 06:19:23 2026 +0100 xfs: refactor zone reset handling Include the actual bio submission in the common zone reset handler to share more code and prepare for adding error injection for zone reset. Note the I plan to refactor the block layer submit_bio_wait and bio_await_chain code in the next merge window to remove some of the code duplication added here. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Hans Holmberg Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 32ae9b893a1dc341274ffabd3cdcc63134f36060 Author: Christoph Hellwig Date: Fri Jan 30 06:19:22 2026 +0100 xfs: don't mark all discard issued by zoned GC as sync Discard are not usually sync when issued from zoned garbage collection, so drop the REQ_SYNC flag. Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection") Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Hans Holmberg Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 2d263debd7f1df2091efb4c06eda02ab04b68562 Author: Christoph Hellwig Date: Fri Jan 30 06:19:21 2026 +0100 xfs: allow setting errortags at mount time Add an errortag mount option that enables an errortag with the default injection frequency. This allows injecting errors into the mount process instead of just on live file systems, and thus test mount error handling. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 4d8f42466a3ba2342b876822ff0582a49e174c9b Author: Christoph Hellwig Date: Fri Jan 30 06:19:20 2026 +0100 xfs: use WRITE_ONCE/READ_ONCE for m_errortag There is no synchronization for updating m_errortag, which is fine as it's just a debug tool. It would still be nice to fully avoid the theoretical case of torn values, so use WRITE_ONCE and READ_ONCE to access the members. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e2d62bfd99b6b79d7c5a4c543c2d84049f01f24f Author: Christoph Hellwig Date: Fri Jan 30 06:19:19 2026 +0100 xfs: move the guts of XFS_ERRORTAG_DELAY out of line Mirror what is done for the more common XFS_ERRORTAG_TEST version, and also only look at the error tag value once now that we can easily have a local variable. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit b8862a09d8256a9037293f1da3b4617b21de26f1 Author: Christoph Hellwig Date: Fri Jan 30 06:19:18 2026 +0100 xfs: don't validate error tags in the I/O path We can trust XFS developers enough to not pass random stuff to XFS_ERROR_TEST/DELAY. Open code the validity check in xfs_errortag_add, which is the only place that receives unvalidated error tag values from user space, and drop the now pointless xfs_errortag_enabled helper. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 394969e2f9d11427ce493e171949958122dc11ee Author: Christoph Hellwig Date: Fri Jan 30 06:19:17 2026 +0100 xfs: allocate m_errortag early Ensure the mount structure always has a valid m_errortag for debug builds. This removes the NULL checking from the runtime code, and prepares for allowing to set errortags from mount. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 9a228d141536a91bf9e48a21b37ebb0f8eea8273 Author: Christoph Hellwig Date: Fri Jan 30 06:19:16 2026 +0100 xfs: fix the errno sign for the xfs_errortag_{add,clearall} stubs All errno values should be negative in the kernel. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 44b9553c3dd043f14903d8ae5d4e7a9797c6d92e Author: Raphael Pinsonneault-Thibeault Date: Thu Jan 29 13:50:21 2026 -0500 xfs: validate log record version against superblock log version Syzbot creates a fuzzed record where xfs_has_logv2() but the xlog_rec_header h_version != XLOG_VERSION_2. This causes a KASAN: slab-out-of-bounds read in xlog_do_recovery_pass() -> xlog_recover_process() -> xlog_cksum(). Fix by adding a check to xlog_valid_rec_header() to abort journal recovery if the xlog_rec_header h_version does not match the super block log version. A file system with a version 2 log will only ever set XLOG_VERSION_2 in its headers (and v1 will only ever set V_1), so if there is any mismatch, either the journal or the superblock has been corrupted and therefore we abort processing with a -EFSCORRUPTED error immediately. Also, refactor the structure of the validity checks for better readability. At the default error level (LOW), XFS_IS_CORRUPT() emits the condition that failed, the file and line number it is located at, then dumps the stack. This gives us everything we need to know about the failure if we do a single validity check per XFS_IS_CORRUPT(). Reported-by: syzbot+9f6d080dece587cfdd4c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9f6d080dece587cfdd4c Tested-by: syzbot+9f6d080dece587cfdd4c@syzkaller.appspotmail.com Fixes: 45cf976008dd ("xfs: fix log recovery buffer allocation for the legacy h_size fixup") Signed-off-by: Raphael Pinsonneault-Thibeault Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 9600b8bdbfe48bb51865be743450160577d2bae2 Author: Gwendal Grignou Date: Fri Jan 30 00:13:51 2026 -0800 platform/chrome: lightbar: Add support for large sequence Current sequences are limited to 192 bytes. Increase support to whatever the EC support. If the sequence is too long, the EC will return an OVERFLOW error. Test: Check sending a large sequence is received by the EC. Signed-off-by: Gwendal Grignou Link: https://lore.kernel.org/r/20260130081351.487517-2-gwendal@google.com Signed-off-by: Tzung-Bi Shih commit 2d8251d98ce0be96d79aec708aa70cab2b4f6f17 Author: Gwendal Grignou Date: Fri Jan 30 00:13:50 2026 -0800 platform/chrome: lightbar: Report number of segments Add attribue `num_segments` to return the number of exposed LED segments in the lightbar. It can be smaller than the number of physical leds in the lightbar. Test: Check the attribute is present and returns a value when read. Signed-off-by: Gwendal Grignou Link: https://lore.kernel.org/r/20260130081351.487517-1-gwendal@google.com Signed-off-by: Tzung-Bi Shih commit 0ceeadc7b53a041d89d5843f6bf0ccb7c98b0b4f Author: Aleksander Jan Bajkowski Date: Sun Jan 11 14:20:32 2026 +0100 crypto: inside-secure/eip93 - unregister only available algorithm EIP93 has an options register. This register indicates which crypto algorithms are implemented in silicon. Supported algorithms are registered on this basis. Unregister algorithms on the same basis. Currently, all algorithms are unregistered, even those not supported by HW. This results in panic on platforms that don't have all options implemented in silicon. Fixes: 9739f5f93b78 ("crypto: eip93 - Add Inside Secure SafeXcel EIP-93 crypto engine support") Signed-off-by: Aleksander Jan Bajkowski Acked-by: Antoine Tenart Signed-off-by: Herbert Xu commit d5abcc33ee76bc26d58b39dc1a097e43a99dd438 Author: Ella Ma Date: Fri Jan 9 16:17:24 2026 +0100 crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the kmalloc-family functions, with the `__cleanup(kfree)` attribute will make the address of the local variable, rather than the address returned by kmalloc, passed to kfree directly and lead to a crash due to invalid deallocation of stack address. According to other places in the repo, the correct usage should be `__free(kfree)`. The code coincidentally compiled because the parameter type `void *` of kfree is compatible with the desired type `struct { ... } **`. Fixes: a71475582ada ("crypto: ccp - reduce stack usage in ccp_run_aes_gcm_cmd") Signed-off-by: Ella Ma Acked-by: Tom Lendacky Signed-off-by: Herbert Xu commit da166801d6f5c24376115e7eb1fd33da2eb834de Author: Thorsten Blum Date: Fri Jan 9 15:20:36 2026 +0100 crypto: stm32 - Remove unnecessary checks before calling memcpy memcpy() can be safely called with size 0, which is a no-op. Remove the unnecessary checks before calling memcpy(). Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 279b837c1f752c2f261c46a2ae6f56ce3159ecea Author: Thorsten Blum Date: Fri Jan 9 13:36:40 2026 +0100 crypto: omap - Use sysfs_emit in sysfs show functions Replace sprintf() with sysfs_emit() in sysfs show functions. sysfs_emit() is preferred to format sysfs output as it provides better bounds checking. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit ec0dd36dbf8b0b209e63d0cd795451fa2203c736 Author: Tzung-Bi Shih Date: Fri Jan 30 04:03:35 2026 +0000 platform/chrome: cros_ec_lightbar: Fix response size initialization Commit 1e7913ff5f9f ("platform/chrome: cros_ec_lightbar: Reduce ligthbar get version command") meant to set smaller values for both request and response sizes. However, it incorrectly assigned the response size to the `result` field instead of `insize`. Fix it. Reported-by: Gwendal Grignou Closes: https://lore.kernel.org/chrome-platform/CAMHSBOVrrYaB=1nEqZk09VkczCrj=6B-P8Fe29TpPdSDgT2CCQ@mail.gmail.com Fixes: 1e7913ff5f9f ("platform/chrome: cros_ec_lightbar: Reduce ligthbar get version command") Link: https://lore.kernel.org/r/20260130040335.361997-1-tzungbi@kernel.org Reviewed-by: Gwendal Grignou Signed-off-by: Tzung-Bi Shih commit 2dfc417414c6eea4e167b2f46283cded846c531a Author: Thorsten Blum Date: Tue Jan 27 23:49:49 2026 +0100 genirq/proc: Replace snprintf with strscpy in register_handler_proc Replace snprintf("%s", ...) with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260127224949.441391-2-thorsten.blum@linux.dev commit 4c1552473acf03cad828884b4e1c90b97a89b265 Author: Ping-Ke Shih Date: Tue Jan 27 16:50:36 2026 +0800 wifi: rtw89: pci: warn if SPS OCP happens for RTL8922DE SPS OCP (over current protection) is a mechanism to cut off power to protect hardware. When this happens, raise an interrupt to signal driver, which prints out a message to note hardware status. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260127085036.44060-7-pkshih@realtek.com commit af1e82232b988f8fc6d635c60609765e49221a64 Author: Dian-Syuan Yang Date: Tue Jan 27 16:50:35 2026 +0800 wifi: rtw89: pci: restore LDO setting after device resume The LDO (Low Dropout Regulator) setting is missing after suspend/resume in some platforms, and it will cause card loss. Therefore, reconfigure this setting to avoid it. Signed-off-by: Dian-Syuan Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com commit 2258f2770e19d645eaa343135a67b595b1e7eddd Author: Ping-Ke Shih Date: Tue Jan 27 16:50:34 2026 +0800 wifi: rtw89: mac: set MU group membership and position to registers The WiFi 7 chips use different registers to configure MU group for beamforming. Define specific registers and refactor the common flow. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260127085036.44060-5-pkshih@realtek.com commit 734bb61782d4d7a7d3d4e11bbd1d2eb958c10551 Author: Chih-Kang Chang Date: Tue Jan 27 16:50:33 2026 +0800 wifi: rtw89: wow: disable interrupt before swapping FW for 8922D Except for the 8852A, 8852B, 8851B, 8852BT, all subsequent chips use HAXIDMA. Therefore, interrupts need to be disabled before swapping firmware to avoid unexpected SER. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260127085036.44060-4-pkshih@realtek.com commit 6792fcf6a69128be0ee4aec51f08e9e960a3fc70 Author: Zong-Zhe Yang Date: Tue Jan 27 16:50:32 2026 +0800 wifi: rtw89: debug: tweak Wi-Fi 7 SER L0/L1 simulation methods SER (system error recovery) L0/L1 simulation has two kinds of methods. How to choose them depends on FW features. But, Wi-Fi 7 misused them. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260127085036.44060-3-pkshih@realtek.com commit 9e1e967b4dbeb316bdffa3a6ccf14b1d6cc977ca Author: Zong-Zhe Yang Date: Tue Jan 27 16:50:31 2026 +0800 wifi: rtw89: debug: rename mac/ctrl error to L0/L1 error Sync Realtek terms on SER (system error recovery) simulation. No logic is changed. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260127085036.44060-2-pkshih@realtek.com commit 08afcc38a64cec3d6065b90391afebfde686a69a Merge: 966f79ce6f6b3d 46c40f938f5f15 Author: Miguel Ojeda Date: Fri Jan 30 05:25:30 2026 +0100 Merge patch series "Add support for print exactly once" Tomonori writes: "This adds the Rust equivalent of the C's DO_ONCE_LITE and pr_*_once macros. A proposal for this feature was made in the past [1], but it didn't reach consensus on the implementation and wasn't merged. Unlike the previous proposal, this implements the C's DO_ONCE_LITE mechanism using a single atomic variable. While it would be possible to implement the feature entirely as a Rust macro, the functionality that can be implemented as regular functions has been extracted and implemented as the OnceLite struct for better code readability. To make it clear that this feature is intended solely for print-related functionality (just like in C), the implementation is placed in print.rs. If an equivalent of std::sync::Once is needed in the future, it should be based on SetOnce rather than OnceLite. Unlike std::sync::Once and SetOnce, OnceLite only manages two states: incomplete and complete. The do_once_lite macro places the OnceLite object in the .data..once section, which may be zeroed by memset at any time. While this means tear reads might happen, OnceLite only manages two states (zero and non-zero), so no actual problem occurs in practice. OnceLite currently uses Atomic, but may be changed to use Atomic [2] when it becomes available." Link: https://lore.kernel.org/rust-for-linux/20241126-pr_once_macros-v4-0-410b8ca9643e@tuta.io/ [1] Link: https://lore.kernel.org/rust-for-linux/20251115050305.3872412-1-fujita.tomonori@gmail.com/ [2] Link: https://patch.msgid.link/20251117002452.4068692-1-fujita.tomonori@gmail.com Signed-off-by: Miguel Ojeda commit 46c40f938f5f15e0a3ecfdd0feba485f8feaff92 Author: FUJITA Tomonori Date: Mon Nov 17 09:24:52 2025 +0900 rust: print: Add pr_*_once macros Add Rust version of pr_[emerg|alert|crit|err|warn|notice|info]_once macros, which print a message only once. Reviewed-by: Alice Ryhl Signed-off-by: FUJITA Tomonori Link: https://patch.msgid.link/20251117002452.4068692-3-fujita.tomonori@gmail.com [ Added prefix to title. Fixed typo. - Miguel ] Signed-off-by: Miguel Ojeda commit 966f79ce6f6b3d138b69cacc3cdcbb5001141b4d Author: FUJITA Tomonori Date: Thu Jan 8 10:33:50 2026 +0900 rust: bug: Support DEBUG_BUGVERBOSE_DETAILED option Make warn_on() support DEBUG_BUGVERBOSE_DETAILED option, which was introduced by the commit aec58b48517c ("bugs/core: Extend __WARN_FLAGS() with the 'cond_str' parameter"). When the option is enabled, WARN splats now show the evaluated warn_on() condition alongside the file path, e.g.: ------------[ cut here ]------------ WARNING: [val == 1] linux/samples/rust/rust_minimal.rs:27 at _RNvXCsk7t4azzUqHP_12rust_minimalNtB2_11RustMinimalNtCs8pcx3n4 Modules linked in: rust_minimal(+) Signed-off-by: FUJITA Tomonori Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260108013350.2880613-1-fujita.tomonori@gmail.com Signed-off-by: Miguel Ojeda commit e600425708148e952adce496ac9e9def79264c8a Author: FUJITA Tomonori Date: Mon Nov 17 09:24:51 2025 +0900 rust: print: Add support for calling a function exactly once Add the Rust equivalent of the kernel's `DO_ONCE_LITE` macro. While it would be possible to implement the feature entirely as a Rust macro, the functionality that can be implemented as regular functions has been extracted and implemented as the `OnceLite` struct for better code maintainability. Signed-off-by: FUJITA Tomonori Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Link: https://patch.msgid.link/20251117002452.4068692-2-fujita.tomonori@gmail.com [ Added prefix to title. - Miguel ] Signed-off-by: Miguel Ojeda commit 1d72a02d65a733ad124bacc2db3fb90fa81a612b Author: Nayna Jain Date: Tue Jan 27 20:22:28 2026 +0530 docs: trusted-encryped: add PKWM as a new trust source Update Documentation/security/keys/trusted-encrypted.rst and Documentation/ admin-guide/kernel-parameters.txt with PowerVM Key Wrapping Module (PKWM) as a new trust source Signed-off-by: Nayna Jain Signed-off-by: Srish Srinivasan Tested-by: Nayna Jain Reviewed-by: Mimi Zohar Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260127145228.48320-7-ssrish@linux.ibm.com commit c99fcb0d735bdb6f06dfe6eb7134d5d988d32dae Author: Srish Srinivasan Date: Tue Jan 27 20:22:27 2026 +0530 keys/trusted_keys: establish PKWM as a trusted source The wrapping key does not exist by default and is generated by the hypervisor as a part of PKWM initialization. This key is then persisted by the hypervisor and is used to wrap trusted keys. These are variable length symmetric keys, which in the case of PowerVM Key Wrapping Module (PKWM) are generated using the kernel RNG. PKWM can be used as a trust source through the following example keyctl commands: keyctl add trusted my_trusted_key "new 32" @u Use the wrap_flags command option to set the secure boot requirement for the wrapping request through the following keyctl commands case1: no secure boot requirement. (default) keyctl usage: keyctl add trusted my_trusted_key "new 32" @u OR keyctl add trusted my_trusted_key "new 32 wrap_flags=0x00" @u case2: secure boot required to in either audit or enforce mode. set bit 0 keyctl usage: keyctl add trusted my_trusted_key "new 32 wrap_flags=0x01" @u case3: secure boot required to be in enforce mode. set bit 1 keyctl usage: keyctl add trusted my_trusted_key "new 32 wrap_flags=0x02" @u NOTE: -> Setting the secure boot requirement is NOT a must. -> Only either of the secure boot requirement options should be set. Not both. -> All the other bits are required to be not set. -> Set the kernel parameter trusted.source=pkwm to choose PKWM as the backend for trusted keys implementation. -> CONFIG_PSERIES_PLPKS must be enabled to build PKWM. Add PKWM, which is a combination of IBM PowerVM and Power LPAR Platform KeyStore, as a new trust source for trusted keys. Signed-off-by: Srish Srinivasan Tested-by: Nayna Jain Reviewed-by: Mimi Zohar Reviewed-by: Nayna Jain Reviewed-by: Jarkko Sakkinen Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260127145228.48320-6-ssrish@linux.ibm.com commit 133aa79e211d2572c5c9b9671461a55d50bebda8 Author: Srish Srinivasan Date: Tue Jan 27 20:22:26 2026 +0530 pseries/plpks: add HCALLs for PowerVM Key Wrapping Module The hypervisor generated wrapping key is an AES-GCM-256 symmetric key which is stored in a non-volatile, secure, and encrypted storage called the Power LPAR Platform KeyStore. It has policy based protections that prevent it from being read out or exposed to the user. Implement H_PKS_GEN_KEY, H_PKS_WRAP_OBJECT, and H_PKS_UNWRAP_OBJECT HCALLs to enable using the PowerVM Key Wrapping Module (PKWM) as a new trust source for trusted keys. Disallow H_PKS_READ_OBJECT, H_PKS_SIGNED_UPDATE, and H_PKS_WRITE_OBJECT for objects with the 'wrapping key' policy set. Capture the availability status for the H_PKS_WRAP_OBJECT interface. Signed-off-by: Srish Srinivasan Tested-by: Nayna Jain Reviewed-by: Nayna Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260127145228.48320-5-ssrish@linux.ibm.com commit 447eb1d5ef00f7da918221ed690cac980385d993 Author: Srish Srinivasan Date: Tue Jan 27 20:22:25 2026 +0530 pseries/plpks: expose PowerVM wrapping features via the sysfs Starting with Power11, PowerVM supports a new feature called "Key Wrapping" that protects user secrets by wrapping them using a hypervisor generated wrapping key. The status of this feature can be read by the H_PKS_GET_CONFIG HCALL. Expose the Power LPAR Platform KeyStore (PLPKS) wrapping features config via the sysfs file /sys/firmware/plpks/config/wrapping_features. Signed-off-by: Srish Srinivasan Tested-by: Nayna Jain Reviewed-by: Nayna Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260127145228.48320-4-ssrish@linux.ibm.com commit 40850c909fcf2a66237dea6b96c8e12003cf6d43 Author: Srish Srinivasan Date: Tue Jan 27 20:22:24 2026 +0530 powerpc/pseries: move the PLPKS config inside its own sysfs directory The /sys/firmware/secvar/config directory represents Power LPAR Platform KeyStore (PLPKS) configuration properties such as max_object_size, signed_ update_algorithms, supported_policies, total_size, used_space, and version. These attributes describe the PLPKS, and not the secure boot variables (secvars). Create /sys/firmware/plpks directory and move the PLPKS config inside this directory. For backwards compatibility, create a soft link from the secvar sysfs directory to this config and emit a warning stating that the older sysfs path has been deprecated. Separate out the plpks specific documentation from secvar. Signed-off-by: Srish Srinivasan Tested-by: Nayna Jain Reviewed-by: Mimi Zohar Reviewed-by: Nayna Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260127145228.48320-3-ssrish@linux.ibm.com commit 88372ad4b060a283a475f0ebc31451c9059ebaa5 Author: Srish Srinivasan Date: Tue Jan 27 20:22:23 2026 +0530 pseries/plpks: fix kernel-doc comment inconsistencies Fix issues with comments for all the applicable functions to be consistent with kernel-doc format. Move them before the function definition as opposed to the function prototype. Signed-off-by: Srish Srinivasan Tested-by: Nayna Jain Reviewed-by: Nayna Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260127145228.48320-2-ssrish@linux.ibm.com commit 6ad42b24413630199cb9f35d073f71768788f8dc Merge: 86a8e8e0ddbc3d c2effd12c96d4b Author: Jakub Kicinski Date: Thu Jan 29 19:49:58 2026 -0800 Merge branch 'bng_en-enhancements-for-rx-and-tx-datapath' Bhargava Marreddy says: ==================== bng_en: enhancements for RX and TX datapath This series enhances the bng_en driver by adding: 1. Tx support (standard + TSO) 2. Rx support (standard + LRO/TPA) ==================== Link: https://patch.msgid.link/20260128185623.26559-1-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit c2effd12c96d4b4a5fe11c0b4bcf3d781654b657 Author: Bhargava Marreddy Date: Thu Jan 29 00:26:23 2026 +0530 bng_en: Add support for TPA events Enable TPA functionality in the VNIC and add functions to handle TPA events, which help in processing LRO/GRO. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20260128185623.26559-9-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 58165c99324e0590c7eb0e3addffd3bd5ca18780 Author: Bhargava Marreddy Date: Thu Jan 29 00:26:22 2026 +0530 bng_en: Add TPA related functions Add the functions to handle TPA events in RX path. This helps the next patch enable TPA functionality. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20260128185623.26559-8-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit c858ac8735ae6b5808a0655d72e0753edbe6b5ac Author: Bhargava Marreddy Date: Thu Jan 29 00:26:21 2026 +0530 bng_en: Add support to handle AGG events Add AGG event handling in the RX path to receive packet data on AGG rings. This enables Jumbo and HDS functionality. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20260128185623.26559-7-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 5deaeae186b4e3b2e2f1dd16f6279873424935aa Author: Bhargava Marreddy Date: Thu Jan 29 00:26:20 2026 +0530 bng_en: Add ndo_features_check support Implement ndo_features_check to validate hardware constraints per-packet: - Disable SG if nr_frags exceeds hardware limit. - Disable GSO if packet/fragment length exceeds supported maximum. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Ajit Kumar Khaparde Reviewed-by: Rahul Gupta Link: https://patch.msgid.link/20260128185623.26559-6-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit bd5ad9c052c855c0c8a0e98f5405a22f5887b298 Author: Bhargava Marreddy Date: Thu Jan 29 00:26:19 2026 +0530 bng_en: Add TX support Add functions to support xmit along with TSO/GSO. Also, add functions to handle TX completion events in the NAPI context. This commit introduces the fundamental transmit data path Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Reviewed-by: Ajit Kumar Khaparde Reviewed-by: Rahul Gupta Link: https://patch.msgid.link/20260128185623.26559-5-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 23cfc4e8e149012a137aba13f25667f311d4e670 Author: Bhargava Marreddy Date: Thu Jan 29 00:26:18 2026 +0530 bng_en: Handle an HWRM completion request Since the HWRM completion for a sent request lands on the NQ, add functions to handle the HWRM completion event. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20260128185623.26559-4-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 4d6a60057c34b7db611905d5a65ef2e6a36ec731 Author: Bhargava Marreddy Date: Thu Jan 29 00:26:17 2026 +0530 bng_en: Add RX support Add support to receive packet using NAPI, build and deliver the skb to stack. With help of meta data available in completions, fill the appropriate information in skb. Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Reviewed-by: Ajit Kumar Khaparde Reviewed-by: Rahul Gupta Link: https://patch.msgid.link/20260128185623.26559-3-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 705c7933d9981e690790edc48cc50889e47163d4 Author: Bhargava Marreddy Date: Thu Jan 29 00:26:16 2026 +0530 bng_en: Extend bnge_set_ring_params() for rx-copybreak Add rx-copybreak support in bnge_set_ring_params() Signed-off-by: Bhargava Marreddy Reviewed-by: Vikas Gupta Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20260128185623.26559-2-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski commit 86a8e8e0ddbc3d14c799536eb888180b84d002f3 Author: Marek Behún Date: Wed Jan 28 18:00:44 2026 +0100 net: sfp: add quirk for Lantech 8330-265D Similar to Lantech 8330-262D-E, the Lantech 8330-265D also reports 2500MBd instead of 3125MBd. Also, all 8330-265D report normal RX_LOS in EEPROM, but some signal inverted RX_LOS. We therefore need to ignore RX_LOS on these modules. Signed-off-by: Marek Behún Link: https://patch.msgid.link/20260128170044.15576-1-kabel@kernel.org Signed-off-by: Jakub Kicinski commit 988719c5eafd4a6cfdd1a0a607cc2ae537433dd4 Author: Geetha sowjanya Date: Wed Jan 28 07:54:48 2026 +0530 octeontx2-pf: cn10k/cn20k: Update count_eot in NPA_LF_AURA_BATCH_FREE0 This patch updates the count_eot calculation for CN20K devices. Where the count_eot feild extended to 2 bits, while maintaining CN10K compatibility where only bit 0 is used. Signed-off-by: Geetha sowjanya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260128022448.4402-1-gakula@marvell.com Signed-off-by: Jakub Kicinski commit 303c1a66a22068517793284524dd1d24b7316d1b Merge: 6f1769ec5892ac c30e188bd2a886 Author: Jakub Kicinski Date: Thu Jan 29 19:17:42 2026 -0800 Merge tag 'wireless-next-2026-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Another fairly large set of changes, notably: - cfg80211/mac80211 - most of EPPKE/802.1X over auth frames support - additional FTM capabilities - split up drop reasons better, removing generic RX_DROP - NAN cleanups/fixes - ath11k: - support for Channel Frequency Response measurement - ath12k: - support for the QCC2072 chipset - iwlwifi: - partial NAN support - UNII-9 support - some UHR/802.11bn FW APIs - remove most of MLO/EHT from iwlmvm (such devices use iwlmld) - rtw89: - preparations for RTL8922DE support * tag 'wireless-next-2026-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (184 commits) wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() wifi: mac80211: use u64_stats_t with u64_stats_sync properly wifi: p54: Fix memory leak in p54_beacon_update() wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as LPI mode wifi: rtw88: sdio: Migrate to use sdio specific shutdown function wifi: rsi: sdio: Migrate to use sdio specific shutdown function sdio: Provide a bustype shutdown function wifi: nl80211/cfg80211: support operating as RSTA in PMSR FTM request wifi: nl80211/cfg80211: add negotiated burst period to FTM result wifi: nl80211/cfg80211: clarify periodic FTM parameters for non-EDCA based ranging wifi: nl80211/cfg80211: add new FTM capabilities wifi: iwlwifi: rename struct iwl_mcc_allowed_ap_type_cmd::offset_map wifi: iwlwifi: mvm: Remove link_id from time_events wifi: iwlwifi: mld: change cluster_id type to u8 array wifi: iwlwifi: support V13 of iwl_lari_config_change_cmd wifi: iwlwifi: split bios_value_u32 to separate the header wifi: iwlwifi: uefi: cache the DSM functions wifi: iwlwifi: acpi: cache the DSM functions wifi: iwlwifi: mvm: Cleanup MLO code ... ==================== Link: https://patch.msgid.link/20260129110136.176980-39-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 6f1769ec5892ac41d82e820d94dcdc68e904aa99 Merge: 3cf48c04966e19 0a55766b771143 Author: Jakub Kicinski Date: Thu Jan 29 19:15:48 2026 -0800 Merge branch 'airoha-an8811hb-2-5-gbps-phy-support' Bjørn Mork says: ==================== Airoha AN8811HB 2.5 Gbps phy support The RFC patch posted earlier has been split into a series based on the feedback received: 1/3: preparing the EN8811H driver for maximum reuse 2/3: adding support for the new AN8811HB hardware 3/3: adding (optional) clock driver for AN8811HB Patch 3/3 is not required for a functional device. It is included here for full feature parity between the EN8811H and AN8811HB drivers. The AN8811HB phy requires new firmware, which is now available with the 20260110 release of linux-firmware, ==================== Link: https://patch.msgid.link/20260127125547.1475164-1-bjorn@mork.no Signed-off-by: Jakub Kicinski commit 0a55766b7711437a188419febd2e8002fb57b00e Author: Bjørn Mork Date: Tue Jan 27 13:55:47 2026 +0100 net: phy: air_en8811h: Add clk provider for an8811hb Implement clk provider driver so we can disable the clock output when it isn't needed. This helps to reduce EMF noise Signed-off-by: Bjørn Mork Link: https://patch.msgid.link/20260127125547.1475164-4-bjorn@mork.no Signed-off-by: Jakub Kicinski commit 5afda1d734ededaed5edc5c5c148ae57b9ddd27b Author: Bjørn Mork Date: Tue Jan 27 13:55:46 2026 +0100 net: phy: air_en8811h: add Airoha AN8811HB support The Airoha AN8811HB is mostly compatible with the EN8811H, adding 10Base-T support and reducing power consumption. This driver is based on the air_an8811hb v0.0.4 out-of-tree driver written by "Lucien.Jheng " Firmware is available in linux-firmware. The driver has been tested with firmware version 25110702 Signed-off-by: Bjørn Mork Link: https://patch.msgid.link/20260127125547.1475164-3-bjorn@mork.no Signed-off-by: Jakub Kicinski commit 28693bceee97935facabd9d96c9f497f12327dc5 Author: Bjørn Mork Date: Tue Jan 27 13:55:45 2026 +0100 net: phy: air_en8811h: factor out shareable code Create reusable helpers in preparation for the AN8811HB support. Signed-off-by: Bjørn Mork Link: https://patch.msgid.link/20260127125547.1475164-2-bjorn@mork.no Signed-off-by: Jakub Kicinski commit 502d2d8e01c8930afd42363d543ed11298cbe34a Merge: 8fbe215d3764ae 96c2c72b817d70 Author: Dave Airlie Date: Fri Jan 30 13:02:34 2026 +1000 Merge tag 'drm-xe-next-fixes-2026-01-29' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next - Reduce LRC timestamp stuck message on VFs to notice (Brost) - Disable GuC Power DCC strategy on PTL (Vinay) - Unregister drm device on probe error (Lin) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aXuyrtsnlAOmj_OB@intel.com commit 8fbe215d3764aedebdde92ed88cf64ae681276f8 Merge: 608fb0a78c42ee db7e7ea838c916 Author: Dave Airlie Date: Fri Jan 30 12:54:03 2026 +1000 Merge tag 'drm-misc-next-fixes-2026-01-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Two fixes for NULL pointer dereference in imx8 following the bridge refcounting conversions, and one for the bridge connector following the HDMI audio reworks. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260129-efficient-jerboa-of-ecstasy-822832@houat commit ad5f2e2908c9b79a86529281a48e94d644d43dc7 Author: Caleb Sander Mateos Date: Wed Jan 28 13:56:34 2026 -0700 ublk: restore auto buf unregister refcount optimization Commit 1ceeedb59749 ("ublk: optimize UBLK_IO_UNREGISTER_IO_BUF on daemon task") optimized ublk request buffer unregistration to use a non-atomic reference count decrement when performed on the ublk_io's daemon task. The optimization applied to auto buffer unregistration, which happens as part of handling UBLK_IO_COMMIT_AND_FETCH_REQ on the daemon task. However, commit b749965edda8 ("ublk: remove ublk_commit_and_fetch()") reordered the ublk_sub_req_ref() for the completed request before the io_buffer_unregister_bvec() call. As a result, task_registered_buffers is already 0 when io_buffer_unregister_bvec() calls ublk_io_release() and the non-atomic refcount optimization doesn't apply. Move the io_buffer_unregister_bvec() call back to before ublk_need_complete_req() to restore the reference counting optimization. Signed-off-by: Caleb Sander Mateos Fixes: b749965edda8 ("ublk: remove ublk_commit_and_fetch()") Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 3cf48c04966e1945de6c89bc9c0746ace2e7ddec Author: Jakub Kicinski Date: Wed Jan 28 11:32:58 2026 -0800 eth: bnxt: make sure we populate the qcfg defaults on old FW/HW The driver now depends on the core to tell it what the rx page size should be for the agg ring. We must populate the ndo_default_qcfg callback even if we don't support any queue ops. This fixes: Oops: divide error: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN RIP: 0010:bnxt_alloc_rx_page_pool (drivers/net/ethernet/broadcom/bnxt/bnxt.c:3852) with fw version 225.1.109.0. Link: https://lore.kernel.org/20250421222827.283737-20-kuba@kernel.org Fixes: f96e1b35779e ("eth: bnxt: support qcfg provided rx page size") Reviewed-by: Michael Chan Link: https://patch.msgid.link/20260128193258.125274-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b9332f297cda726804c645f11b77286f3e3fb066 Merge: b1cd687e3e387a 2da903d0a84a68 Author: Jakub Kicinski Date: Thu Jan 29 18:50:11 2026 -0800 Merge branch 'net-hinic3-fix-code-styles' Fan Gong says: ==================== net: hinic3: Fix code styles This patchset provides 4 code styles fixes: Remove empty lines between error handling. Remove defensive txq_num check. Use array_size instead of multiplying. SQ use SQ_CTXT_PREF_CI_HI to improve readability. ==================== Link: https://patch.msgid.link/cover.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit 2da903d0a84a68f7e898fea2c6876de0086601cc Author: Fan Gong Date: Thu Jan 29 12:01:11 2026 +0800 hinic3: RQ use RQ_CTXT_PREF_CI_HI instead of SQ_CTXT_PREF_CI_HI Separate the CTX_PREF_CI_HI of rq and sq to improve readability. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/7b34bf318c64398f34048c823c15b2eec5a679bc.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit afb81efc971ec88e51a32689ed422615ad1e852c Author: Fan Gong Date: Thu Jan 29 12:01:10 2026 +0800 hinic3: Use array_size instead of multiplying Since commit 17fcb3dc12bb ("hinic3: module initialization and tx/rx logic") use "size * sizeof(u64)" in hinic3_feature_nego. Use array_size instead of multiplying can make it clearer. Link: https://lore.kernel.org/netdev/20250911123120.GG30363@horms.kernel.org/ Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Reviewed-by: Joe Damato Link: https://patch.msgid.link/b7d6d384ccc0bd4c0d3e7af1f90901d589cbd0b1.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit 34bef6a4960f7761bcf8bb8ef8cd6d0041ae0c69 Author: Fan Gong Date: Thu Jan 29 12:01:09 2026 +0800 hinic3: Remove defensive txq_num check Since commit 1f3838b84a63 ("hinic3: Add Rss function") nic_dev->num_txqs cannot be zero in hinic3_alloc_txqs(). So remove the check for this case. Link: https://lore.kernel.org/netdev/20250902180843.5ba05bf2@kernel.org/ Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/c23daa9b79fa731c1caaec9b8245f6b2c4994afb.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit 738ff2d2f50221905c346b969aecc2fbaa5decaf Author: Fan Gong Date: Thu Jan 29 12:01:08 2026 +0800 hinic3: Fix code Style(remove empty lines between error handling) According to previous review comment, fix code style of removing empty lines between the actions on the error handling path to make it more idiomatic in the merged code. Link: https://lore.kernel.org/netdev/20250902180937.4c8d9eb3@kernel.org/ Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/ccff2ae7abe91bb3618ded9bb5ef2dc9cb243d22.1769656467.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit 73c12f209462d1712c5f55f3021a1b65b2e084c3 Author: Masami Hiramatsu (Google) Date: Fri Jan 30 00:48:23 2026 +0900 kprobes: Use dedicated kthread for kprobe optimizer Instead of using generic workqueue, use a dedicated kthread for optimizing kprobes, because it can wait (sleep) for a long time inside the process by synchronize_rcu_task(). This means other works can be stopped until it finishes. Link: https://lore.kernel.org/all/176970170302.114949.5175231591310436910.stgit@devnote2/ Suggested-by: Steven Rostedt Signed-off-by: Masami Hiramatsu (Google) commit b1cd687e3e387aafde03ae3d862ef44410131ae4 Author: Eric Dumazet Date: Wed Jan 28 18:55:47 2026 +0000 ipv6: optimize fl6_update_dst() fl6_update_dst() is called for every TCP (and others) transmit, and is a nop for common cases. Split it in two parts : 1) fl6_update_dst() inline helper, small and fast. 2) __fl6_update_dst() for the exception, out of line. Small size increase to get better TX performance. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 2/2 grow/shrink: 8/0 up/down: 296/-125 (171) Function old new delta __fl6_update_dst - 104 +104 rawv6_sendmsg 2244 2284 +40 udpv6_sendmsg 3013 3043 +30 tcp_v6_connect 1514 1534 +20 cookie_v6_check 1501 1519 +18 ip6_datagram_dst_update 673 690 +17 inet6_sk_rebuild_header 499 516 +17 inet6_csk_route_socket 507 524 +17 inet6_csk_route_req 343 360 +17 __pfx___fl6_update_dst - 16 +16 __pfx_fl6_update_dst 16 - -16 fl6_update_dst 109 - -109 Total: Before=22570304, After=22570475, chg +0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260128185548.3738781-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 Author: Geetha sowjanya Date: Tue Jan 27 18:21:47 2026 +0530 octeontx2-af: Workaround SQM/PSE stalls by disabling sticky NIX SQ manager sticky mode is known to cause stalls when multiple SQs share an SMQ and transmit concurrently. Additionally, PSE may deadlock on transitions between sticky and non-sticky transmissions. There is also a credit drop issue observed when certain condition clocks are gated. work around these hardware errata by: - Disabling SQM sticky operation: - Clear TM6 (bit 15) - Clear TM11 (bit 14) - Disabling sticky → non-sticky transition path that can deadlock PSE: - Clear TM5 (bit 23) - Preventing credit drops by keeping the control-flow clock enabled: - Set TM9 (bit 21) These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this configuration the SQM/PSE maintain forward progress under load without credit loss, at the cost of disabling sticky optimizations. Signed-off-by: Geetha sowjanya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com Signed-off-by: Jakub Kicinski commit 7b85c77585409f76609c817b760db60f3bf8fd33 Author: Nimrod Oren Date: Wed Jan 28 11:02:17 2026 +0200 selftests: drv-net: rss_flow_label: skip unsupported devices The test_rss_flow_label_6only test case fails on devices that do not support IPv6 flow label hashing. Make it skip neatly, consistent with the behavior of the test_rss_flow_label case. Reviewed-by: Gal Pressman Signed-off-by: Nimrod Oren Link: https://patch.msgid.link/20260128090217.663366-1-noren@nvidia.com Signed-off-by: Jakub Kicinski commit cff3e7c60ac720796f3483047544611d38683b9a Merge: 0e4d7df2f3b2e5 1639ba67bfb53e Author: Jakub Kicinski Date: Thu Jan 29 18:31:27 2026 -0800 Merge branch 'net-stmmac-rk-second-chunk-of-cleanups' Russell King says: ==================== net: stmmac: rk: second chunk of cleanups This series is a cut-down installment of the dwmac-rk cleanups, covering up to the point that the AI review had its first issue with the patches. Unfortunately, this means that we introduce ->init but do not add any users for it yet. That will be in the next round once this has got through AI review and merged. ==================== Link: https://patch.msgid.link/aXnrzIbZN-gaZTia@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1639ba67bfb53efe28ad2977025ff0566ddf0281 Author: Russell King (Oracle) Date: Wed Jan 28 10:58:49 2026 +0000 net: stmmac: rk: add SoC specific ->init() method Add a SoC specific init method. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vl3G5-00000006v3X-2zfD@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f7aaa6fb1193d8d5945605aab8c92e5752e9329b Author: Russell King (Oracle) Date: Wed Jan 28 10:58:44 2026 +0000 net: stmmac: rk: add GMAC_CLK_xx constants, simplify RGMII definitions All the definitions of the RGMII related xxx_GMAC_CLK_xxx definitions use the same field values to select the clock rate. Provide common definitions for these field values, passing them in to a single macro for each variant that generates the appropriate values for the speed register. No change to produced code on aarch64. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vl3G0-00000006v3R-2ZBc@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1c249fc1e19e1d84cd748f8b8d02d36480445078 Author: Russell King (Oracle) Date: Wed Jan 28 10:58:39 2026 +0000 net: stmmac: rk: fix missing reset_control_put() rk_gmac_setup() delves into the PHY's DT node to retrieve its reset control using of_reset_control_get(). However, it never releases it when the driver is removed. Add reset_control_put() to rk_gmac_exit() to clean this up. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Reviewed-by: Philipp Zabel Link: https://patch.msgid.link/E1vl3Fv-00000006v3L-215v@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0e4d7df2f3b2e59c1bccc09ea099b7a6c2dda886 Author: Russell King (Oracle) Date: Wed Jan 28 10:51:56 2026 +0000 net: phylink: fix NULL pointer deref in phylink_major_config() When a MAC driver returns a PCS for an interface mode, and then we attempt to switch to a different mode that doesn't require a PCS, this causes phylink to oops: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Mem abort info: ESR = 0x0000000096000044 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000137f96000 [0000000000000010] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000044 [#1] SMP Modules linked in: -- CPU: 1 UID: 0 PID: 55 Comm: kworker/u33:0 Not tainted 6.19.0-rc5-00581-g73cb8467a63e #1 PREEMPT Hardware name: Qualcomm Technologies, Inc. Lemans Ride Rev3 (DT) Workqueue: events_power_efficient phylink_resolve pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS +BTYPE=--) pc : phylink_major_config+0x408/0x948 lr : phylink_major_config+0x3fc/0x948 sp : ffff800080353c60 x29: ffff800080353cb0 x28: ffffb305068a8a00 x27: ffffb305068a8000 x26: ffff000080092100 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000001 x22: 0000000000000000 x21: ffffb3050555b3d0 x20: ffff800080353d10 x19: ffff0000b6059400 x18: 00000000ffffffff x17: 74756f2f79687020 x16: ffffb305045e4f18 x15: 6769666e6f632072 x14: 6f6a616d203a3168 x13: 782d657361623030 x12: ffffb305068c6a98 x11: 0000000000000583 x10: 0000000000000018 x9 : ffffb305068c6a98 x8 : 0000000100006583 x7 : 0000000000000000 x6 : ffff00008083cc40 x5 : ffff00008083cc40 x4 : 0000000000000001 x3 : 0000000000000001 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000b269e5a8 Call trace: phylink_major_config+0x408/0x948 (P) phylink_resolve+0x294/0x6e4 process_one_work+0x148/0x28c worker_thread+0x2d8/0x3d8 kthread+0x134/0x208 ret_from_fork+0x10/0x20 Code: d63f0020 f9400e60 b4000040 f900081f (f9000ad3) ---[ end trace 0000000000000000 ]--- This is caused by "pcs" being NULL when we attempt to execute: pcs->phylink = pl; Make this conditional on pcs being non-null. Fixes: 486dc391ef43 ("net: phylink: allow mac_select_pcs() to remove a PCS") Reported-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vl39Q-00000006utm-229h@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 08d8ba524c16ed22f3e9e5105422fb84eb79f17c Merge: d414ed34a8616b d9009f72ed8821 Author: Jakub Kicinski Date: Thu Jan 29 18:27:30 2026 -0800 Merge branch 'net-stmmac-report-active-phy-interface' Russell King says: ==================== net: stmmac: report active phy interface The original patch needs dwmac-thead fixed so the PHY_INTF* definitions do not clash. ==================== Link: https://patch.msgid.link/aXnpTy6XckPGcmg0@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d9009f72ed8821324b991b1c6d8a9e125d2ea706 Author: Russell King (Oracle) Date: Wed Jan 28 10:48:39 2026 +0000 net: stmmac: report active PHY interface Report the active PHY interface from the point of view of the dwmac hardware to the kernel log, where the core supports reading this. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1vl36F-00000006url-1fWA@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 88afa0dd655ce646a9345013615ebf2eea55b33c Author: Russell King (Oracle) Date: Wed Jan 28 10:48:34 2026 +0000 net: stmmac: thead: avoid conflicts with PHY_INTF_* definitions Avoid conflicts between stmmac PHY_INTF_* and GMAC_INTF_CTRL register definitions by replacing the PHY_ prefix with GMAC_. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vl36A-00000006urf-19ox@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d414ed34a8616bf4c1bcbec9bf67aff88a3b0c86 Author: Russell King (Oracle) Date: Wed Jan 28 10:52:29 2026 +0000 net: stmmac: qcom-ethqos: remove mac_base In commit 9b443e58a896 ("net: stmmac: qcom-ethqos: remove MAC_CTRL_REG modification"), ethqos->mac_base is only written, never read. Let's remove it. Reviewed-by: Andrew Lunn Tested-by: Mohd Ayaan Anwar Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vl39x-00000006uvc-0A3S@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 241b91d9680d3d8d08f2bf1a440001e602fd4845 Author: Alok Tiwari Date: Tue Jan 27 09:42:52 2026 -0800 octeontx2-pf: Fix header guard comment in otx2_devlink.h The closing #endif comment in otx2_devlink.h refers to RVU_DEVLINK_H, but the actual header guard is OTX2_DEVLINK_H. Fix the comment to match the correct header guard name. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260127174333.1247747-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit bc443c253fcdd2636e2a29fde3f749d39d479cf0 Author: Ivan Vecera Date: Mon Jan 26 17:22:51 2026 +0100 dpll: expose fractional frequency offset in ppt Currently, the dpll subsystem exports the fractional frequency offset (FFO) in parts per million (ppm). This granularity is insufficient for high-precision synchronization scenarios which often require parts per trillion (ppt) resolution. Add a new netlink attribute DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT to expose the FFO in ppt. Update the dpll netlink core to expect the driver-provided FFO value to be in ppt. To maintain backward compatibility with existing userspace tools, populate the legacy DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET attribute by dividing the new ppt value by 1,000,000. Update the zl3073x and mlx5 drivers to provide the FFO value in ppt: - zl3073x: adjust the fixed-point calculation to produce ppt (10^12) instead of ppm (10^6). - mlx5: scale the existing ppm value by 1,000,000. Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20260126162253.27890-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 608fb0a78c42ee61cb567f9b918ee109663854bb Merge: 15392f76405ecb ad3ebcc2d06875 Author: Dave Airlie Date: Fri Jan 30 12:03:25 2026 +1000 Merge tag 'drm-intel-next-fixes-2026-01-29' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Prevent u64 underflow in intel_fbc_stolen_end Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/aXsWGWjacEJ03rTs@jlahtine-mobl commit abbe94591e8864af3df5ba36b61fe8615b8ff990 Author: Tamir Duberstein Date: Tue Jan 27 08:55:50 2026 -0500 rust: kbuild: deduplicate pin-init flags Extract `pin_init{,_internal}-{cfgs,flags}` to reduce duplication. [ The new variables will be used later on to easily pass them to the `scripts/generate_rust_analyzer.py` script. - Miguel ] Acked-by: Benno Lossin Signed-off-by: Tamir Duberstein Link: https://patch.msgid.link/20260127-rust-analyzer-pin-init-duplication-v3-1-118c48c35e88@kernel.org [ Rebased. Moved new variables above. Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 9b89cea1119386480151a6ca2bfbab54ce569ba7 Author: Gary Guo Date: Fri Jan 23 17:19:40 2026 +0000 gpu: nova-core: remove imports available via prelude These imports are already in scope by importing `kernel::prelude::*` and does not need to be imported separately. Signed-off-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260123172007.136873-2-gary@garyguo.net Signed-off-by: Miguel Ojeda commit b3827c91cc9979fe04d99e016fb9c5f6260f29a0 Author: Andre Carvalho Date: Tue Jan 27 19:39:20 2026 +0000 netconsole: selftests: Move netconsole selftests to separate target This patch moves netconsole selftests from drivers/net to its own target in drivers/net/netconsole. This change helps saving some resources from CI since tests in drivers/net automatically run against real hardware which are not used by netconsole tests as they rely solely on netdevsim. lib_netcons.sh is kept under drivers/net/lib since it is also used by bonding selftests. Finally, drivers/net config remains unchanged as netpoll_basic.py requires netconsole (and does leverage real HW testing). Reviewed-by: Breno Leitao Signed-off-by: Andre Carvalho Link: https://patch.msgid.link/20260127-netcons-selftest-target-v2-1-f509ab65b3bc@gmail.com Signed-off-by: Jakub Kicinski commit a010fe8d869635fd15c1d5768ba6a2f48795fa36 Merge: 7227e984c36b6a 1cac38910ecb88 Author: Jakub Kicinski Date: Thu Jan 22 20:13:25 2026 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.19-rc8). No adjacent changes, conflicts: drivers/net/ethernet/spacemit/k1_emac.c 2c84959167d64 ("net: spacemit: Check for netif_carrier_ok() in emac_stats_update()") f66086798f91f ("net: spacemit: Remove broken flow control support") https://lore.kernel.org/aXjAqZA3iEWD_DGM@sirena.org.uk Signed-off-by: Jakub Kicinski commit 7227e984c36b6a95a23f079d01ec5224a5b0e796 Merge: e75e408dc524ba eba86d86eec842 Author: Jakub Kicinski Date: Thu Jan 29 17:22:35 2026 -0800 Merge tag 'for-net-next-2026-01-29' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: core: - L2CAP: Add support for setting BT_PHY - HCI: Add LE Channel Sounding HCI Command/event structures - hci_conn: Set link_policy on incoming ACL connections - MGMT: Add idle_timeout to configurable system parameters drivers: - btusb: Add support for MediaTek7920 0489:e158 - btusb: Add device ID for Realtek RTL8761BU - btusb: Reject autosuspend if discovery is active - btusb: Add new VID/PID for RTL8852CE - btusb: Add USB ID 0489:e112 for Realtek 8851BE - dt-bindings: qcom: Split to separate schema - btqca: Add WCN6855 firmware priority selection feature * tag 'for-net-next-2026-01-29' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (40 commits) Bluetooth: hci_qca: Enable HFP hardware offload for WCN6855 and WCN7850 Bluetooth: hci_qca: Refactor HFP hardware offload capability handling Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB Bluetooth: L2CAP: Fix not tracking outstanding TX ident Bluetooth: MGMT: Fix memory leak in set_ssp_complete Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work Bluetooth: btusb: Remove duplicate entry for 0x13d3/0x3618 Bluetooth: btusb: Add device ID for Realtek RTL8761BU Bluetooth: btintel: Remove unneeded CONFIG_PM* #ifdef's Bluetooth: btnxpuart: Remove unneeded CONFIG_PM ifdef Bluetooth: btusb: Add new VID/PID for RTL8852CE Bluetooth: btintel_pcie: Remove unnecessary check before kfree_skb() Bluetooth: btusb: Reject autosuspend if discovery is active Bluetooth: hci_core: Export hci_discovery_active Bluetooth: btusb: Use pm_ptr instead of #ifdef CONFIG_PM dt-bindings: bluetooth: qcom,wcn7850-bt: Deprecate old supplies dt-bindings: bluetooth: qcom,wcn7850-bt: Split to separate schema dt-bindings: bluetooth: qcom,wcn6855-bt: Deprecate old supplies dt-bindings: bluetooth: qcom,wcn6855-bt: Split to separate schema dt-bindings: bluetooth: qcom,wcn6750-bt: Deprecate old supplies ... ==================== Link: https://patch.msgid.link/20260129203610.963067-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 76c73cfde7988976474e58c16e14ec3372f8cdaf Author: Michal Suchanek Date: Wed Jan 21 11:57:57 2026 +0100 kbuild: dummy-tools: Add python3 DRM_MSM_VALIDATE_XML depends on a python feature. Add a dummy python interpreter to make it possible to configure this option with dummy tools. Fixes: b587f413ca47 ("drm/msm/gen_header: allow skipping the validation") Signed-off-by: Michal Suchanek Acked-by: Rob Clark Link: https://patch.msgid.link/20260121105801.1827-1-msuchanek@suse.de [nathan: Remove empty shell comment line] Signed-off-by: Nathan Chancellor commit 844590b439870c921fa0e11d412c300564391a18 Author: Tamir Duberstein Date: Mon Dec 22 13:16:59 2025 +0100 rust: clk: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Stephen Boyd Acked-by: Viresh Kumar Signed-off-by: Tamir Duberstein Reviewed-by: Daniel Almeida Link: https://patch.msgid.link/20251222-cstr-clk-v1-1-ef0687717aa1@gmail.com Signed-off-by: Miguel Ojeda commit 1e37f6f949b521935781b761414fe4ca0e9128c1 Author: Boqun Feng Date: Wed Jan 28 16:45:18 2026 -0800 MAINTAINERS: Update my email address to @kernel.org I had issues using my gmail account multiple times this week, hence switch to @kernel.org. Signed-off-by: Boqun Feng Reviewed-by: Paul E. McKenney Acked-by: Gary Guo Acked-by: Kunwu Chan Link: https://patch.msgid.link/20260129004520.62697-1-boqun@kernel.org [ Sorted alphabetically in mailmap. Removed Cc tag list. - Miguel ] Signed-off-by: Miguel Ojeda commit ce8ded2e61f47747e31eeefb44dc24a2160a7e32 Author: Stefano Stabellini Date: Thu Jan 29 15:03:48 2026 -0800 9p/xen: protect xen_9pfs_front_free against concurrent calls The xenwatch thread can race with other back-end change notifications and call xen_9pfs_front_free() twice, hitting the observed general protection fault due to a double-free. Guard the teardown path so only one caller can release the front-end state at a time, preventing the crash. This is a fix for the following double-free: [ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none) [ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150 [ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42 [ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246 [ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000 [ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000 [ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000 [ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68 [ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040 [ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000 [ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660 [ 27.052418] Call Trace: [ 27.052420] [ 27.052422] xen_9pfs_front_changed+0x5d5/0x720 [ 27.052426] ? xenbus_otherend_changed+0x72/0x140 [ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10 [ 27.052434] xenwatch_thread+0x94/0x1c0 [ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10 [ 27.052442] kthread+0xf8/0x240 [ 27.052445] ? __pfx_kthread+0x10/0x10 [ 27.052449] ? __pfx_kthread+0x10/0x10 [ 27.052452] ret_from_fork+0x16b/0x1a0 [ 27.052456] ? __pfx_kthread+0x10/0x10 [ 27.052459] ret_from_fork_asm+0x1a/0x30 [ 27.052463] [ 27.052465] Modules linked in: [ 27.052471] ---[ end trace 0000000000000000 ]--- Signed-off-by: Stefano Stabellini Message-ID: <20260129230348.2390470-1-stefano.stabellini@amd.com> Signed-off-by: Dominique Martinet commit c17b9046faf7d1f3b8bb992e4d53da873dc478fc Author: Koichiro Den Date: Sat Jan 24 23:50:12 2026 +0900 selftests: pci_endpoint: Add BAR subrange mapping test case Add BAR_SUBRANGE_TEST to the pci_endpoint kselftest suite. The test uses the PCITEST_BAR_SUBRANGE ioctl and will skip when the chosen BAR is disabled (-ENODATA), when the endpoint/controller does not support subrange mapping (-EOPNOTSUPP), or when the BAR is reserved for the test register space (-EBUSY). Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260124145012.2794108-9-den@valinux.co.jp commit 8cf82bb558517503a81f8e3c49914c0836360aa6 Author: Koichiro Den Date: Sat Jan 24 23:50:11 2026 +0900 misc: pci_endpoint_test: Add BAR subrange mapping test case Add a new PCITEST_BAR_SUBRANGE ioctl to exercise EPC BAR subrange mapping end-to-end. The test programs a simple 2-subrange layout on the endpoint (via pci-epf-test) and verifies that: - the endpoint-provided per-subrange signature bytes are observed at the expected PCIe BAR offsets, and - writes to each subrange are routed to the correct backing region (i.e. the submap order is applied rather than accidentally working due to an identity mapping). Return -EOPNOTSUPP when the endpoint does not advertise subrange mapping, -ENODATA when the BAR is disabled, and -EBUSY when the BAR is reserved for the test register space. Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260124145012.2794108-8-den@valinux.co.jp commit 6c5e6101423b0dbda417d92d1552a4e2c669a76c Author: Koichiro Den Date: Sat Jan 24 23:50:10 2026 +0900 PCI: endpoint: pci-epf-test: Add BAR subrange mapping test support Extend pci-epf-test so that pci_endpoint_test can exercise BAR subrange mapping end-to-end. Add BAR_SUBRANGE_SETUP/CLEAR commands that program (and tear down) a simple 2-subrange layout for a selected BAR. The endpoint deliberately permutes the physical backing regions (swap the halves) and writes a deterministic signature byte per subrange. This allows the RC to verify that the submap order is actually applied, not just that reads/writes work with an identity mapping. Advertise CAP_SUBRANGE_MAPPING only when the underlying EPC supports dynamic_inbound_mapping and subrange_mapping. Also bump the default BAR sizes (BAR0-4) to 128 KiB so that split subranges are large enough to satisfy common inbound-translation alignment constraints. E.g. for DWC EP, the default and maximum CX_ATU_MIN_REGION_SIZE is 64 kB, so 128 KiB is sufficient for DWC-based EP platforms for 2-subrange testing. Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260124145012.2794108-7-den@valinux.co.jp commit dd3ce1667a99d3ecfb1ad3b619140350796e01c0 Author: Koichiro Den Date: Sat Jan 24 23:50:09 2026 +0900 Documentation: PCI: endpoint: Clarify pci_epc_set_bar() usage The current documentation implies that pci_epc_set_bar() is only used before the host enumerates the endpoint. In practice, some Endpoint Controllers support calling pci_epc_set_bar() multiple times for the same BAR (without clearing it) in order to update inbound address translations after the host has programmed the BAR base address, which some Endpoint Functions such as vNTB already rely on. Add document text for that. Also document the expected call flow for BAR subrange mapping (pci_epf_bar.num_submap / pci_epf_bar.submap), which may require a second pci_epc_set_bar() call after the host has programmed the BAR base address. Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Reviewed-by: Frank Li Link: https://patch.msgid.link/20260124145012.2794108-6-den@valinux.co.jp commit cc839bef7727043a66004bba563492957ca3e531 Author: Koichiro Den Date: Sat Jan 24 23:50:08 2026 +0900 PCI: dwc: ep: Support BAR subrange inbound mapping via Address Match Mode iATU Extend dw_pcie_ep_set_bar() to support inbound mappings for BAR subranges using Address Match Mode IB iATU when pci_epf_bar.num_submap is non-zero. Rename the existing BAR-match helper into dw_pcie_ep_ib_atu_bar() and introduce dw_pcie_ep_ib_atu_addr() for Address Match Mode. When num_submap is non-zero, read the assigned BAR base address and program one inbound iATU window per subrange. Validate the submap array before programming: - each subrange is aligned to pci->region_align - subranges cover the whole BAR (no gaps and no overlaps) Track Address Match Mode mappings and tear them down on clear_bar() and on set_bar() error paths to avoid leaving half-programmed state or untranslated BAR holes. Advertise this capability by extending the common feature bit initializer macro (DWC_EPC_COMMON_FEATURES). This enables multiple inbound windows within a single BAR, which is useful on platforms where usable BARs are scarce but EPFs need multiple inbound regions. Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260124145012.2794108-5-den@valinux.co.jp commit 37f9d5026cd78fbe80a124edbbadab382b26545f Author: Thomas Gleixner Date: Tue Jan 27 22:30:16 2026 +0100 genirq/redirect: Prevent writing MSI message on affinity change The interrupts which are handled by the redirection infrastructure provide a irq_set_affinity() callback, which solely determines the target CPU for redirection via irq_work and und updates the effective affinity mask. Contrary to regular MSI interrupts this affinity setting does not change the underlying interrupt message as the message is only created at setup time to deliver to the demultiplexing interrupt. Therefore the message write in msi_domain_set_affinity() is a pointless exercise. In principle the write is harmless, but a Tegra system exposes a full system hang during suspend due to that write. It's unclear why the check for the PCI device state PCI_D0 in pci_msi_domain_write_msg(), which prevents the actual hardware access if a device is in powered down state, fails on this particular system, but that's a different problem which needs to be investigated by the Tegra experts. The irq_set_affinity() callback can advise msi_domain_set_affinity() not to write the MSI message by returning IRQ_SET_MASK_OK_DONE instead of IRQ_SET_MASK_OK. Do exactly that. Just to make it clear again: This is not a correctness issue of the redirection code as returning IRQ_SET_MASK_OK in that context is completely correct. From the core code point of view this is solely a optimization to avoid an redundant hardware write. As a byproduct it papers over the underlying problem on the Tegra platform, which fails to put the PCIe device[s] out of PCI_D0 despite the fact that the devices and busses have been shut down. The redirect infrastructure just unearthed the underlying issue, which is prone to happen in quite some other code paths which use the PCI_D0 check to prevent hardware access to powered down devices. This therefore has neither a 'Fixes:' nor a 'Closes:' tag associated as the underlying problem, which is outside the scope of the interrupt code, is still unresolved. Reported-by: Jon Hunter Signed-off-by: Thomas Gleixner Tested-by: Jon Hunter Link: https://lore.kernel.org/all/4e5b349c-6599-4871-9e3b-e10352ae0ca0@nvidia.com Link: https://patch.msgid.link/87tsw6aglz.ffs@tglx commit 12966116076f63b46f7118bb59f28a33cedc9f67 Merge: c0b4a4feeb4330 8e03e6ecc23537 Author: Linus Walleij Date: Thu Jan 29 23:32:57 2026 +0100 Merge tag 'intel-pinctrl-v6.20-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into devel intel-pinctrl for v6.20-2 * Remove duplicate error messages when registering pin control * Miscellaneous changes Signed-off-by: Linus Walleij commit 7eaf8e32de5f4ed4defda6fff81749041bb9d23f Merge: f8f9c1f4d0c7a6 a83f9c04be4e80 Author: Thomas Gleixner Date: Thu Jan 29 22:23:51 2026 +0100 Merge tag 'timers-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource Pull clocksource/events updates from Daniel Lezcano: - Always leave device running after probe in the sh TMU driver to overcome the locking validation scheme warning when the PREEMPT_RT is enabled (Niklas Söderlund) - Add missing Kconfig dependency on OF for the integrator AP (Bartosz Golaszewski) - Fix a dead link in timer bindings for the Armada 370XP (Soham Metha) - Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock (Stephen Eta Zhou) - Move GIC timer to use request_percpu_irq() instead of setup_percpu_irq() to allow the removal of the latter (Marc Zyngier) Link: https://patch.msgid.link/75b163aa-5098-4949-a539-ae1e59e3aaca@linaro.org commit c3cbc276c2a33b04fc78a86cdb2ddce094cb3614 Author: Longfang Liu Date: Thu Jan 22 10:02:05 2026 +0800 hisi_acc_vfio_pci: fix the queue parameter anomaly issue When the number of QPs initialized by the device, as read via vft, is zero, it indicates either an abnormal device configuration or an abnormal read result. Returning 0 directly in this case would allow the live migration operation to complete successfully, leading to incorrect parameter configuration after migration and preventing the service from recovering normal functionality. Therefore, in such situations, an error should be returned to roll back the live migration operation. Signed-off-by: Longfang Liu Link: https://lore.kernel.org/r/20260122020205.2884497-5-liulongfang@huawei.com Signed-off-by: Alex Williamson commit 8c6ac1730a977234dff74cc1753b4a953f59be7b Author: Longfang Liu Date: Thu Jan 22 10:02:04 2026 +0800 hisi_acc_vfio_pci: resolve duplicate migration states In special scenarios involving duplicate migrations, after the first migration is completed, if the original VF device is used again and then migrated to another destination, the state indicating data migration completion for the VF device is not reset. This results in the second migration to the destination being skipped without performing data migration. After the modification, it ensures that a complete data migration is performed after the subsequent migration. Signed-off-by: Longfang Liu Link: https://lore.kernel.org/r/20260122020205.2884497-4-liulongfang@huawei.com Signed-off-by: Alex Williamson commit 8be14dd48dfee0df91e511acceb4beeb2461a083 Author: Longfang Liu Date: Thu Jan 22 10:02:03 2026 +0800 hisi_acc_vfio_pci: update status after RAS error After a RAS error occurs on the accelerator device, the accelerator device will be reset. The live migration state will be abnormal after reset, and the original state needs to be restored during the reset process. Therefore, reset processing needs to be performed in a live migration scenario. Signed-off-by: Longfang Liu Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com Signed-off-by: Alex Williamson commit a22099ed7936f8e8dabbdbadd97d56047797116b Author: Weili Qian Date: Thu Jan 22 10:02:02 2026 +0800 hisi_acc_vfio_pci: fix VF reset timeout issue If device error occurs during live migration, qemu will reset the VF. At this time, VF reset and device reset are performed simultaneously. The VF reset will timeout. Therefore, the QM_RESETTING flag is used to ensure that VF reset and device reset are performed serially. Fixes: b0eed085903e ("hisi_acc_vfio_pci: Add support for VFIO live migration") Signed-off-by: Weili Qian Link: https://lore.kernel.org/r/20260122020205.2884497-2-liulongfang@huawei.com Signed-off-by: Alex Williamson commit 9db826206f9b7c3b5449848e79adea4756a1605a Author: Manivannan Sadhasivam Date: Wed Jan 28 21:07:16 2026 +0530 PCI/pwrctrl: Create pwrctrl device if graph port is found The devicetree node of the PCIe Root Port/Slot could have the graph port to link the PCIe M.2 connector node. Since the M.2 connectors are modeled as Power Sequencing devices, they need to be controlled by the pwrctrl driver like the Root Port/Slot supplies. Hence, create the pwrctrl device if the graph port is found in the node. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260128-pci-m2-v7-2-9b3a5fe3d244@oss.qualcomm.com commit 2719bd1ee1a1cd0535bc62e89b52822f2bbd14eb Author: Damien Le Moal Date: Thu Jan 29 16:27:15 2026 +0900 block: introduce blk_queue_rot() To check if a request queue is for a rotational device, a double negation is needed with the pattern "!blk_queue_nonrot(q)". Simplify this with the introduction of the helper blk_queue_rot() which tests if a requests queue limit has the BLK_FEAT_ROTATIONAL feature set. All call sites of blk_queue_nonrot() are modified to use blk_queue_rot() and blk_queue_nonrot() definition removed. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Nitesh Shetty Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 068f5b5ef5bf97e25568950f06ba32325bdc660b Author: Damien Le Moal Date: Thu Jan 29 16:27:14 2026 +0900 block: cleanup queue limit features definition Unwrap the definition of BLK_FEAT_ATOMIC_WRITES and renumber this feature to be sequential with BLK_FEAT_SKIP_TAGSET_QUIESCE. Signed-off-by: Damien Le Moal Reviewed-by: John Garry Reviewed-by: Nitesh Shetty Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 14b428cfba2d610c20cf0a5e00db10e95f4cbf88 Author: Viacheslav Dubeyko Date: Thu Jan 29 11:54:43 2026 -0800 hfsplus: fix warning issue in inode.c This patch fixes the sparse warning issue in inode.c by adding static to hfsplus_symlink_inode_operations and hfsplus_special_inode_operations declarations. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601291957.bunRsD8R-lkp@intel.com/ Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20260129195442.594884-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 1d9d5f5a5040ff9c8b7b22d54845b3a464286435 Author: Mikhail Kshevetskiy Date: Mon Jan 19 07:02:37 2026 +0300 mtd: spinand: add Foresee F35SQB002G flash support Add support of Foresee F35SQB002G spinand flash Signed-off-by: Mikhail Kshevetskiy Signed-off-by: Miquel Raynal commit 44a2f49b9bdc7e19413230d390ebf224054e6572 Author: Miquel Raynal Date: Fri Jan 9 18:18:25 2026 +0100 mtd: spinand: winbond: W35N octal DTR support Extend the support for the W35N chip family by supporting the ODTR bus interface. The chip is capable to run in this mode, which brings a significant performance improvement. 1S-8S-8S: # flash_speed /dev/mtd0 -c1 -d eraseblock write speed is 7529 KiB/s eraseblock read speed is 15058 KiB/s 8D-8D-8D: # flash_speed /dev/mtd0 -c1 -d eraseblock write speed is 9481 KiB/s eraseblock read speed is 23272 KiB/s This is +55% read speed and +26% write speed with the same hardware. Tests have been conducted with a TI AM62A7 using the Cadence quad SPI controller. Signed-off-by: Miquel Raynal commit 76b7dc76dd0e1af5a538e977e015ac95271b3b12 Author: Miquel Raynal Date: Fri Jan 9 18:18:24 2026 +0100 mtd: spinand: Add octal DTR support Create a new bus interface named ODTR for "octal DTR", which matches the following pattern: 8D-8D-8D. Add octal DTR support for all the existing core operations. Add a second set of templates for this bus interface. Give the possibility for drivers to register their read, write and update cache variants as well as their vendor specific operations. Check the SPI controller driver supports all the octal DTR commands that we might need before switching to the ODTR bus interface. Make the switch by calling ->configure_chip() with the ODTR parameter. Fallback in case this step fails. If someone ever attempts to suspend a chip in octal DTR mode, there are changes that it will loose its configuration at resume. Prevent any problem by explicitly switching back to SSDR while suspending. Note: there is a limitation in the current approach, page I/Os are not available as the dirmaps will be created for the ODTR bus interface if that option is supported and not switched back to SSDR during suspend. Switching them is possible but would be costly and would not bring anything as right after resuming we will switch again to ODTR. In case this capability is used for debug, developpers should mind to destroy and recreate suitable direct mappings. Finally, as a side effect, we increase the buffer for reading IDs to 6. No device at this point returns 6 bytes, but we support 5 bytes IDs, which means in octal DTR mode we have no other choice than reading an even number of bytes, hence 6. Signed-off-by: Miquel Raynal commit f636d9216146fe11de754bf78207352507fb3b91 Author: Miquel Raynal Date: Fri Jan 9 18:18:23 2026 +0100 mtd: spinand: Warn if using SSDR-only vendor commands in a non SSDR mode Both Macronix and Winbond have chip specific operations which are SSDR only. Trying to use them in an ODTR setup will fail and doing this is a pure software bug. Warn explicitly in this case. Signed-off-by: Miquel Raynal commit 0a331a1851aedd670b95a2d16c6a82496137378d Author: Miquel Raynal Date: Fri Jan 9 18:18:22 2026 +0100 mtd: spinand: Give the bus interface to the configuration helper The chip configuration hook is the one responsible to actually switch the switch between bus interfaces. It is natural to give it the bus interface we expect with a new parameter. For now the only value we can give is SSDR, but this is subject to change in the future, so add a bit of extra logic in the implementations of this callback to make sure both the core and the chip driver are aligned on the request. Signed-off-by: Miquel Raynal commit 8e7face6013997f9f74c83187d50c9a0cce52553 Author: Miquel Raynal Date: Fri Jan 9 18:18:21 2026 +0100 mtd: spinand: Propagate the bus interface across core helpers For now all drivers provide SSDR variants only. When we add support for ODTR modes, there will be a need to differentiate the type of variant we target as well as the need to check if we support one or the other type of operations. Pass this parameter to lower level helpers, which for now is unused, in order to simplify the patch introducing ODTR support. Signed-off-by: Miquel Raynal commit 20387f2fe509eba46ecf758da052786d7b1203fb Author: Miquel Raynal Date: Fri Jan 9 18:18:20 2026 +0100 mtd: spinand: Add support for setting a bus interface Create a bus interface enumeration, currently only containing the one we support: SSDR, for single SDR, so any operation whose command is sent over a single data line in SDR mode, ie. any operation matching 1S-XX-XX. The main spinand_device structure gets a new parameter to store this enumeration, for now unused. Of course it is set to SSDR during the SSDR templates initialization to further clarify the state we are in at the moment. This member is subject to be used to know in which bus configuration we and be updated by the core when we switch to faster mode(s). Signed-off-by: Miquel Raynal commit be0b86c648bf811237cc17e274e9f9488fccb772 Author: Miquel Raynal Date: Fri Jan 9 18:18:19 2026 +0100 mtd: spinand: Gather all the bus interface steps in one single function Writing the quad enable bit in one helper and doing the chip configuration in another does not make much sense from a bus interface setup point of view. Instead, let's create a broader helper which is going to be in charge of all the bus configuration steps at once. This will specifically allow to transition to octal DDR mode, and even fallback to quad (if suppoorted) or single mode otherwise. Signed-off-by: Miquel Raynal commit ef1ed296fb9d9246256e1b5b2cf2e86e85606ac3 Author: Miquel Raynal Date: Fri Jan 9 18:18:18 2026 +0100 mtd: spinand: winbond: Configure the IO mode after the dummy cycles When we will change the bus interface, the action that actually performs the transition is the IO mode register write. This means after the IO mode register write, we should use the new bus interface. But the ->configure_chip() hook itself is not responsible of making this change official, it is the caller that must act according to the return value. Reorganize this helper to first configure the dummy cycles before possibly switching to another bus interface. Signed-off-by: Miquel Raynal commit 57e1015cc9a96372f330195abe32a904ec8d1eab Author: Miquel Raynal Date: Fri Jan 9 18:18:17 2026 +0100 mtd: spinand: winbond: Rename IO_MODE register macro Suffix the macro name with *_REG to align with the rest of the driver. Signed-off-by: Miquel Raynal commit 1d98c6a77bcf1ce686aaf40a725cbb5683ee5735 Author: Miquel Raynal Date: Fri Jan 9 18:18:16 2026 +0100 mtd: spinand: winbond: Fix style Add a missing new line in the middle of the driver. Signed-off-by: Miquel Raynal commit da8f4891bcfad393a3217f1abfec1a927c963151 Author: Miquel Raynal Date: Fri Jan 9 18:18:15 2026 +0100 mtd: spinand: winbond: Register W35N vendor specific operation Provide the Winbond W35N specific "write VCR register" operation to let the core verify it is supported by the controller before using it. Signed-off-by: Miquel Raynal commit 62dce7e0fcd73a311786ef048b027aa841b9bc83 Author: Miquel Raynal Date: Fri Jan 9 18:18:14 2026 +0100 mtd: spinand: winbond: Register W25N vendor specific operation Provide the Winbond W25N specific "select target" operation to let the core verify it is supported by the controller before using it. Signed-off-by: Miquel Raynal commit 87ec7690973bbd8bb5ccfbbc5429485d06fe123e Author: Miquel Raynal Date: Fri Jan 9 18:18:13 2026 +0100 mtd: spinand: macronix: Register vendor specific operation Provide the Macronix specific "read ECC status register" operation so that the core can verify if it is supported by the controller before using it. Signed-off-by: Miquel Raynal commit fbc7538782f8e7df4737dcec7d854cf4d53bfc67 Author: Miquel Raynal Date: Fri Jan 9 18:18:12 2026 +0100 mtd: spinand: List vendor specific operations and make sure they are supported It is probably safe to expect that all SPI controller drivers will ever support all the most basic SPI NAND operations, such as write enable, register reads, page program, block erases, etc. However, what about vendor specific operations? So far nobody complained about it, but as we are about to introduce octal DTR support, and as none of the SPI NAND instruction set is defined in any standard, we must remain careful about these extra operations. One way to make sure we do not blindly get ourselves in strange situations with vendor commands failing silently is to make the check once for all, while probing the chip. However at this stage we have no such list, so let's add the necessary infrastructure to allow: - registering vendor operations, - checking they are actually supported when appropriate. Signed-off-by: Miquel Raynal commit 6ec7ace0127077d1caab6ca1fb0129da8eb5c1de Author: Miquel Raynal Date: Fri Jan 9 18:18:11 2026 +0100 mtd: spinand: winbond: Convert W35N specific operation to SPINAND_OP() Winbond W35N* chips require a vendor specific operation to write their VCR register (a configuration register, typically used for tuning the number of dummy cycles and switching to a different bus interface). Instead of defining this op only in the function that needs it, hiding it from the core, make it a proper define like all other spi-mem operations, and implement the necessary spinand_fill_*_op() helper to make the SPINAND_OP() macro work. This way we can use it from any function without any extra handling outside of this helper when we will convert the core to support octal DDR busses. Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit 44c9c1b45d50dcbce17c18adb4e79f394f127d57 Author: Miquel Raynal Date: Fri Jan 9 18:18:10 2026 +0100 mtd: spinand: winbond: Convert W25N specific operation to SPINAND_OP() Winbond W25N* chips require a vendor specific operation to select the target. Instead of defining this op only in the function that needs it, hiding it from the core, make it a proper define like all other spi-mem operations, and implement the necessary spinand_fill_*_op() helper to make the SPINAND_OP() macro work. This way we can use it from any function without any extra handling outside of this helper when we will convert the core to support octal DDR busses. Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit b347cdc89beb12e531ebbfda77c37c6446285a40 Author: Miquel Raynal Date: Fri Jan 9 18:18:09 2026 +0100 mtd: spinand: macronix: Convert vendor specific operation to SPINAND_OP() Macronix chips require a vendor specific operation to read the ECC status register. Instead of defining this op only in the function that needs it, hiding it from the core, make it a proper define like all other spi-mem operations, and implement the necessary spinand_fill_*_op() helper to make the SPINAND_OP() macro work. This way we can use it from any function without any extra handling outside of this helper when we will convert the core to support octal DDR busses. Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit 88b0e3584acb905c41252b7917013ecf7c0518bc Author: Miquel Raynal Date: Fri Jan 9 18:18:08 2026 +0100 mtd: spinand: Make use of the operation templates through SPINAND_OP() Create a SPINAND_OP() macro to which we give the name of the operation we want. This macro retrieves the correct operation template based on the current bus interface (currently only single SDR, will soon be extended to octal DTR) and fills it with the usual parameters. This macro makes the transition from calling directly the low-level macros into using the (bus interface dependent) templates very smooth. Use it in all places that can be trivially converted. At this stage there is no functional change expected, until octal DTR support gets added. Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit 408015023294958407925bc50cdd85718d12a335 Author: Miquel Raynal Date: Fri Jan 9 18:18:07 2026 +0100 mtd: spinand: Create an array of operation templates Currently, the SPI NAND core implementation directly calls macros to get the various operations in shape. These macros are specific to the bus interface, currently only supporting the single SDR interface (any command following the 1S-XX-XX pattern). Introducing support for other bus interfaces (such as octal DTR) would mean that every user of these macros should become aware of the current bus interface and act accordingly, picking up and adapting to the current configuration. This would add quite a bit of boilerplate, be repetitive as well as error prone in case we miss one occurrence. Instead, let's create a table with all SPI NAND memory operations that are currently supported. We initialize them with the same single SDR _OP macros as before. This opens the possibility for users of the individual macros to make use of these templates instead. This way, when we will add another bus interface, we can just switch to another set of templates and all users will magically fill in their spi_mem_op structures with the correct ops. The existing read, write and update cache variants are also moved in this template array, which is barely noticeable by callers as we also add a structure member pointing to it. Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit c0ba929cf7a960c796cc9946b3f79d8405e9b805 Author: Miquel Raynal Date: Fri Jan 9 18:18:06 2026 +0100 mtd: spinand: Decouple write enable and write disable operations In order to introduce templates for all operations and not only for page helpers (in order to introduce octal DDR support), decouple the WR_EN and WR_DIS operations into two separate macros. Adapt the callers accordingly. There is no functional change. Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit 7a5cd7610a4b4e9a2b660fad1e81bb9a79ae99b0 Author: Miquel Raynal Date: Fri Jan 9 18:18:05 2026 +0100 mtd: spinand: Use standard return values Replace -ENOTSUPP with -EOPNOTSUPP which is as relevant in this case but is standard. Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit d48db8ca47662f5f4e1b7e173687d853f017ae3a Author: Miquel Raynal Date: Fri Jan 9 18:18:04 2026 +0100 mtd: spinand: Remove stale definitions SPI NAND command values are directly included in the macros defining the ops. These are stale definitions, they are unused so drop them. Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit aab8a4c656379a6a1a4ca716f48118680560eaab Author: Miquel Raynal Date: Fri Jan 9 18:18:03 2026 +0100 mtd: spinand: Add missing check The update cache variant is mandatory, both read and write versions are being checked, but not this one. All chip drivers seem to implement this variant, so there should be no breakage. Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit a57b1f07d2d35843a7ada30c8cf9a215c0931868 Author: Miquel Raynal Date: Fri Jan 9 18:18:02 2026 +0100 mtd: spinand: Fix kernel doc The @data buffer is 5 bytes, not 4, it has been extended for the need of devices with an extra ID bytes. Fixes: 34a956739d29 ("mtd: spinand: Add support for 5-byte IDs") Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal commit 28c3edc43cb9ab6ebe43439d48a662a095409b03 Author: Miquel Raynal Date: Fri Jan 9 18:18:00 2026 +0100 spi: spi-mem: Create a repeated address operation In octal DTR mode addresses may either be long enough to cover at least two bytes (in which case the existing macro works), or otherwise for single byte addresses, the byte must also be duplicated and sent twice: on each front of the clock. Create a macro for this common case. Signed-off-by: Miquel Raynal commit 1ebbefb73ceba9c913ea42f44db1fe8e4d73cbc0 Merge: 5ec64aa7fef37c 8618271887ca10 Author: Miquel Raynal Date: Thu Jan 29 20:19:44 2026 +0100 Merge tag 'tags/spi-octal-dtr' into nand/next spi: Octal DTR support This series adds support for 8D-8D-8D in SPI NAND, which can already be leveraged without any SPI changes as controllers already have this support for some SPI NOR devices. Among the few spi-mem patches, they are needed for building the SPI NAND changes (especially the ODTR introduction at the end) and therefore an immutable tag will be needed for merging in the MTD tree (unless all the series goes through MTD directly ofc). commit 8a565e3ee1eccaf7570a1c107b68327ba1a68b84 Author: Linus Walleij Date: Thu Jan 29 00:55:09 2026 +0100 mtd: physmap-core: Prioritize ofparts for OF probe Place the ofparts before RedBoot partitions in the OF probe path: this makes it possible to override any existing RedBoot partitions with fixed-partitions which may be necessary, such as when you need to repartition the flash from Linux' point of view but not necessary from the bootloaders point of view. This happens when a device such as Raidsonic IB-4220-B has three partitions named "Kern", "Ramdisk" and "Application" that we want to merge into one for more efficient use of the flash memory in OpenWrt. Signed-off-by: Linus Walleij Signed-off-by: Miquel Raynal commit bcf8e207624d044a060ac4c6f9861f34ade41ca4 Author: Akhila YS Date: Wed Jan 28 15:36:12 2026 +0000 dt-bindings: mtd: mxic,multi-itfc-v009-nand-controller: convert to DT schema Convert Macronix Raw NAND Controller Device Tree binding to DT Schema. Signed-off-by: Akhila YS Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 7cce81df7d26d44123bd7620715c8349d96793d7 Author: Weigang He Date: Fri Jan 23 05:26:08 2026 +0000 mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() of_get_child_by_name() returns a node pointer with refcount incremented, which must be released with of_node_put() when done. However, in parse_fixed_partitions(), when dedicated is true (i.e., a "partitions" subnode was found), the ofpart_node obtained from of_get_child_by_name() is never released on any code path. Add of_node_put(ofpart_node) calls on all exit paths when dedicated is true to fix the reference count leak. This bug was detected by our static analysis tool. Fixes: 562b4e91d3b2 ("mtd: parsers: ofpart: fix parsing subpartitions") Signed-off-by: Weigang He Signed-off-by: Miquel Raynal commit 68cd8ef484521a01826735518f173c4ae3900eff Author: Akhila YS Date: Thu Jan 22 16:23:04 2026 +0000 dt-bindings: mtd: st,spear600-smi: convert to DT schema Convert STMicroelectronics SPEAr600 Serial Memory Interface (SMI) Controller binding to YAML format. Signed-off-by: Akhila YS Acked-by: Conor Dooley Signed-off-by: Miquel Raynal commit eba86d86eec8428bd743523ec76932838e0b30f7 Author: Mengshi Wu Date: Tue Jan 27 10:54:23 2026 +0800 Bluetooth: hci_qca: Enable HFP hardware offload for WCN6855 and WCN7850 Add QCA_CAP_HFP_HW_OFFLOAD capability flag to WCN6855 and WCN7850 device data structures to enable Hands-Free Profile (HFP) hardware offload support on these Qualcomm Bluetooth chipsets. Signed-off-by: Mengshi Wu Acked-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 22d893eec0d52fa97d25d3de248285648f26ef68 Author: Mengshi Wu Date: Tue Jan 27 10:54:22 2026 +0800 Bluetooth: hci_qca: Refactor HFP hardware offload capability handling Replace SoC-specific check with capability-based approach for HFP hardware offload configuration. Add QCA_CAP_HFP_HW_OFFLOAD capability flag and support_hfp_hw_offload field to qca_serdev structure. Add QCA_CAP_HFP_HW_OFFLOAD capability flag to QCA2066 device data structures. Reviewed-by: Dmitry Baryshkov Signed-off-by: Mengshi Wu Acked-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 6c0568b7741a346088fd6dfced2d871f7d481d06 Author: Zenm Chen Date: Thu Jan 29 10:28:19 2026 +0800 Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB Add USB ID 7392:e611 for Edimax EW-7611UXB which is RTL8851BU-based Wi-Fi + Bluetooth adapter. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below: T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=7392 ProdID=e611 Rev= 0.00 S: Manufacturer=Realtek S: Product=802.11ax WLAN Adapter S: SerialNumber=00e04c000001 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu_git E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org # 6.6.x Signed-off-by: Zenm Chen Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 6c3ea155e5ee3e56606233acde8309afda66d483 Author: Luiz Augusto von Dentz Date: Wed Jan 21 16:39:44 2026 -0500 Bluetooth: L2CAP: Fix not tracking outstanding TX ident This attempts to proper track outstanding request by using struct ida and allocating from it in l2cap_get_ident using ida_alloc_range which would reuse ids as they are free, then upon completion release the id using ida_free. This fixes the qualification test case L2CAP/COS/CED/BI-29-C which attempts to check if the host stack is able to work after 256 attempts to connect which requires Ident field to use the full range of possible values in order to pass the test. Link: https://github.com/bluez/bluez/issues/1829 Signed-off-by: Luiz Augusto von Dentz Reviewed-by: Paul Menzel commit 4db19bfd320f2124c820d3456aeae3953095ea8e Author: Jianpeng Chang Date: Wed Jan 21 13:29:26 2026 +0800 Bluetooth: MGMT: Fix memory leak in set_ssp_complete Fix memory leak in set_ssp_complete() where mgmt_pending_cmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmt_pending_foreach() calls with individual command handling but missed adding mgmt_pending_free() calls in both error and success paths of set_ssp_complete(). Other completion functions like set_le_complete() were fixed correctly in the same commit. This causes a memory leak of the mgmt_pending_cmd structure and its associated parameter data for each SSP command that completes. Add the missing mgmt_pending_free(cmd) calls in both code paths to fix the memory leak. Also fix the same issue in set_advertising_complete(). Fixes: 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") Signed-off-by: Jianpeng Chang Signed-off-by: Luiz Augusto von Dentz commit e6c0dc504e9504b4ce42632604cdbe326f961ad1 Author: Jia-Hong Su Date: Sun Jan 18 20:08:59 2026 +0800 Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv. The race condition is: CPU0 CPU1 ---- ---- hci_uart_set_proto() set_bit(HCI_UART_PROTO_INIT) hci_uart_register_dev() tty write wakeup hci_uart_tty_wakeup() hci_uart_tx_wakeup() schedule_work(&hu->write_work) proto->open(hu) // initializes hu->priv hci_uart_write_work() hci_uart_dequeue() proto->dequeue(hu) // accesses hu->priv (NULL!) Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled. Fixes: 5df5dafc171b ("Bluetooth: hci_uart: Fix another race during initialization") Link: https://lore.kernel.org/linux-bluetooth/6969764f.170a0220.2b9fc4.35a7@mx.google.com/ Signed-off-by: Jia-Hong Su Signed-off-by: Luiz Augusto von Dentz commit 890505e8effefcf21b0f2212099aa135042973d3 Author: Linmao Li Date: Wed Jan 21 10:52:20 2026 +0800 Bluetooth: btusb: Remove duplicate entry for 0x13d3/0x3618 The USB device ID 0x13d3/0x3618 is listed twice in the device table. Remove the duplicate entry and keep the one under the correct "Realtek 8852BT/8852BE-VT Bluetooth devices" section. Signed-off-by: Linmao Li Signed-off-by: Luiz Augusto von Dentz commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 Author: Jacopo Scannella Date: Tue Jan 20 10:13:04 2026 +0100 Bluetooth: btusb: Add device ID for Realtek RTL8761BU Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek RTL8761BU Bluetooth adapter. Reference: https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth Signed-off-by: Jacopo Scannella Signed-off-by: Luiz Augusto von Dentz commit 90c38d402c5c063aff23d96dbfb997defa1b1f2c Author: Bastien Nocera Date: Mon Jan 19 13:35:00 2026 +0100 Bluetooth: btintel: Remove unneeded CONFIG_PM* #ifdef's The functions are already disabled if CONFIG_PM or CONFIG_PM_SLEEP are disabled through the use of SET_SYSTEM_SLEEP_PM_OPS() and SET_RUNTIME_PM_OPS(). This increases build coverage and allows to drop a few #ifdef's. Signed-off-by: Bastien Nocera Signed-off-by: Luiz Augusto von Dentz commit 04a4c885fddf505872404f12ed9353fa4bc280c5 Author: Bastien Nocera Date: Mon Jan 19 13:34:59 2026 +0100 Bluetooth: btnxpuart: Remove unneeded CONFIG_PM ifdef The functions are already disabled through the use of pm_ptr() when CONFIG_PM is disabled, and will be removed from the final linked code as not needed. This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Reviewed-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b Author: Shell Chen Date: Wed Jan 14 15:03:35 2026 +1100 Bluetooth: btusb: Add new VID/PID for RTL8852CE Add VID:PID 13d3:3612 to the quirks_table. This ID pair is found in the Realtek RTL8852CE PCIe module in an ASUS TUF A14 2025 (FA401KM) laptop. Tested on aforementioned laptop. The device info from /sys/kernel/debug/usb/devices is listed as below. T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3612 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms Signed-off-by: Shell Chen Signed-off-by: Luiz Augusto von Dentz commit 1583ca8e85a4a96d250d9bc03d4533a326225ae8 Author: Chen Ni Date: Fri Jan 16 16:07:03 2026 +0800 Bluetooth: btintel_pcie: Remove unnecessary check before kfree_skb() The kfree_skb() function internally checks if the skb is NULL, so an explicit check before calling it is redundant and can be removed. Signed-off-by: Chen Ni Signed-off-by: Luiz Augusto von Dentz commit 312b09bbe9832799ff11c051060f78c9667d604a Author: Linmao Li Date: Fri Jan 9 10:05:38 2026 +0800 Bluetooth: btusb: Reject autosuspend if discovery is active If USB autosuspend occurs while discovery is active, the ongoing HCI operation may not complete successfully. On some devices, this can leave discovery.state stuck in DISCOVERY_FINDING. Signed-off-by: Linmao Li Signed-off-by: Luiz Augusto von Dentz commit 97eb023cd1616b06584dac77a16cb9ef3abf4491 Author: Linmao Li Date: Fri Jan 9 10:05:37 2026 +0800 Bluetooth: hci_core: Export hci_discovery_active Export hci_discovery_active() so it can be used by bluetooth drivers built as modules. Signed-off-by: Linmao Li Signed-off-by: Luiz Augusto von Dentz commit 56493c8166df7afff1da8f02bd7f6060df681f8b Author: Bastien Nocera Date: Mon Jan 12 11:51:13 2026 +0100 Bluetooth: btusb: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 9283a358cbc8fd93593699feda77f3ff05c77a64 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:49:08 2026 +0100 dt-bindings: bluetooth: qcom,wcn7850-bt: Deprecate old supplies Commit bd3f305886ad ("dt-bindings: bluetooth: qualcomm: describe the inputs from PMU for wcn7850") changed the binding to new description with a Power Management Unit (PMU), thus certain power-controller properties are considered deprecated and are part of that PMUs binding. Deprecate them to mark clearly that new PMU-based approach is preferred. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 04ff82107412b28cbc67adbd5cad8d10028faef3 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:49:07 2026 +0100 dt-bindings: bluetooth: qcom,wcn7850-bt: Split to separate schema One big Qualcomm Bluetooth schema is hardly manageable: it lists all possible properties (19 supplies). Split qcom,wcn7850-bt to separate bindings, so device schema will be easier to read/maintain and list only relevant properties. Re-shuffle few properties to alphabetical order while moving them and drop redundant enable-gpios description. This makes the source qualcomm-bluetooth.yaml binding empty, thus drop it making entire change a variant of file rename. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 6e62e4016ff58ce9f987abde572359728bae0f83 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:49:06 2026 +0100 dt-bindings: bluetooth: qcom,wcn6855-bt: Deprecate old supplies Commit 5f4f954bba12 ("dt-bindings: bluetooth: bring the HW description closer to reality for wcn6855") changed the binding to new description with a Power Management Unit (PMU), thus certain power-controller properties are considered deprecated and are part of that PMUs binding. Deprecate them to mark clearly that new PMU-based approach is preferred. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 1937250117d346e013f24b64c176c59b86bc2c06 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:49:05 2026 +0100 dt-bindings: bluetooth: qcom,wcn6855-bt: Split to separate schema One big Qualcomm Bluetooth schema is hardly manageable: it lists all possible properties (19 supplies). Split qcom,wcn6855-bt to separate bindings, so device schema will be easier to read/maintain and list only relevant properties. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit edd3240fd53ddf47873d9a3bccaf4b24d78fabb6 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:49:04 2026 +0100 dt-bindings: bluetooth: qcom,wcn6750-bt: Deprecate old supplies Commit cca4fe34979a ("dt-bindings: bluetooth: Utilize PMU abstraction for WCN6750") changed the binding to new description with a Power Management Unit (PMU), thus certain power-controller properties are considered deprecated and are part of that PMUs binding. Deprecate them to mark clearly that new PMU-based approach is preferred. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit af97be93b4da4631e1e7e3a99189d7b5866f5e44 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:49:03 2026 +0100 dt-bindings: bluetooth: qcom,wcn6750-bt: Split to separate schema One big Qualcomm Bluetooth schema is hardly manageable: it lists all possible properties (19 supplies). Split qcom,wcn6750-bt to separate bindings, so device schema will be easier to read/maintain and list only relevant properties. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 77f1835364c86a660b7d95b69c598d6373c4f13f Author: Krzysztof Kozlowski Date: Sun Jan 11 16:49:02 2026 +0100 dt-bindings: bluetooth: qcom,wcn3990-bt: Split to separate schema One big Qualcomm Bluetooth schema is hardly manageable: it lists all possible properties (19 supplies). Split qcom,wcn3990-bt to separate bindings, so device schema will be easier to read/maintain and list only relevant properties. This binding is very similar to qcom,wcn3950-bt, however devices have additional VDD_CH1 supply. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit dcf72cd989900d7f92a23d22db0a9ec3d1cc5eb1 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:49:01 2026 +0100 dt-bindings: bluetooth: qcom,wcn3950-bt: Split to separate schema One big Qualcomm Bluetooth schema is hardly manageable: it lists all possible properties (19 supplies). Split qcom,wcn3950-bt to separate bindings, so device schema will be easier to read/maintain and list only relevant properties. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit f7245901de8978d829f80b3d8e36ed9a8fd18049 Author: Sergey Shtylyov Date: Tue Jan 27 23:39:42 2026 +0300 PCI: Check parent for NULL in of_pci_bus_release_domain_nr() of_pci_bus_find_domain_nr() allows its parent parameter to be NULL but of_pci_bus_release_domain_nr() (that undoes its effect) doesn't -- that means it's going to blow up while calling of_get_pci_domain_nr() if the parent parameter indeed happens to be NULL. Add the missing NULL check. Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Fixes: c14f7ccc9f5d ("PCI: Assign PCI domain IDs by ida_alloc()") Signed-off-by: Sergey Shtylyov Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260127203944.28588-1-s.shtylyov@auroraos.dev commit 31a8753aa495d428acfd3468c73f18e1ac2cdc64 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:49:00 2026 +0100 dt-bindings: bluetooth: qcom,qca6390-bt: Split to separate schema One big Qualcomm Bluetooth schema is hardly manageable: it lists all possible properties (19 supplies). Split qcom,qca6390-bt to separate bindings, so device schema will be easier to read/maintain and list only relevant properties. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit e18c153d1fe4fe8567b904fd39355e4ffae69cc3 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:48:59 2026 +0100 dt-bindings: bluetooth: qcom,qca9377-bt: Split to separate schema One big Qualcomm Bluetooth schema is hardly manageable: it lists all possible properties (19 supplies). Split qcom,qca9377-bt to separate bindings, so device schema will be easier to read/maintain and list only relevant properties. Existing binding has incomplete and incorrect list of supplies (e.g. there is no VDD_XO) and Linux driver does not ask for any, thus keep this state unchanged. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 68f3769ce01631eb6710b811e2dc5d767b76c5b6 Author: Krzysztof Kozlowski Date: Sun Jan 11 16:48:58 2026 +0100 dt-bindings: bluetooth: qcom,qca2066-bt: Split to separate schema One big Qualcomm Bluetooth schema is hardly manageable: it lists all possible properties (19 supplies). Split common part and qcom,qca2066-bt to separate bindings, so each schema will be easier to read/maintain and list only relevant properties. The existing bindings do not mention interrupts, but am335x-sancloud-bbe-extended-wifi.dts already defines such. This issue is not being fixed here. Existing binding also did not mention any supplies (which do exist as confirmed in datasheet) and Linux driver does not ask for any, thus keep this state unchanged. Reviewed-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Signed-off-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit 0e2a6af81042e048bef1fddc70a022272d11ae84 Author: Luiz Augusto von Dentz Date: Mon Dec 22 14:36:45 2025 -0500 Bluetooth: Fix using PHYs bitfields as PHY value This renames the PHY fields in bt_iso_io_qos to PHYs (plural) since it represents a bitfield where multiple PHYs can be set and make the same change also to HCI_OP_LE_SET_CIG_PARAMS since both c_phy and p_phy fields are bitfields. This also fixes the assumption that hci_evt_le_cis_established PHYs fields are compatible with bt_iso_io_qos, they are not, the fields in hci_evt_le_cis_established represent just a single PHY value so they need to be converted to bitfield when set in bt_iso_io_qos. Signed-off-by: Luiz Augusto von Dentz commit e07094a51ad8faf98ea64320799ce550828e97cd Author: Techie Ernie Date: Wed Dec 24 11:31:29 2025 +0800 Bluetooth: btusb: Add USB ID 0489:e112 for Realtek 8851BE Add USB ID 0489:e112 for the Realtek 8851BE Bluetooth adapter. Without this entry, the device is not handled correctly by btusb and Bluetooth fails to initialise. Adding the ID enables proper Realtek initialization for Bluetooth to work on various motherboards using this Bluetooth adapter. The device identifies as: Bus 001 Device XXX: ID 0489:e112 Foxconn / Hon Hai Bluetooth Radio Tested on Realtek 8851BE. Bluetooth works after this change is made. Signed-off-by: Techie Ernie Signed-off-by: Luiz Augusto von Dentz commit 520257cff5edc57e3a940a45cec3de7c69d60913 Author: Shuai Zhang Date: Tue Jan 6 12:35:03 2026 +0800 Bluetooth: btqca: Add WCN6855 firmware priority selection feature Historically, WCN685x and QCA2066 shared the same firmware files. Now, changes are planned for the firmware that will make it incompatible with QCA2066, so a new firmware name is required for WCN685x. Test Steps: - Boot device - Check the BTFW loading status via dmesg Sanity pass and Test Log: QCA Downloading qca/wcnhpbftfw21.tlv Direct firmware load for qca/wcnhpbftfw21.tlv failed with error -2 QCA Downloading qca/hpbftfw21.tlv Reviewed-by: Dmitry Baryshkov Signed-off-by: Shuai Zhang Acked-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit ff3bb47ab4ca4f3bac5f680d63456353892b4500 Author: Shuai Zhang Date: Tue Jan 6 12:35:02 2026 +0800 Bluetooth: btqca: move WCN7850 workaround to the caller WCN7850 will first attempt to use ELF_TYPE_PATCH, and if that fails, it will fall back to TLV_TYPE_PATCH. To code uniformity, move WCN7850 workaround to the caller. Reviewed-by: Dmitry Baryshkov Signed-off-by: Shuai Zhang Acked-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 132c0779d4a2d08541519cf04783bca52c6ec85c Author: Luiz Augusto von Dentz Date: Wed Dec 17 10:50:51 2025 -0500 Bluetooth: L2CAP: Add support for setting BT_PHY This enables client to use setsockopt(BT_PHY) to set the connection packet type/PHY: Example setting BT_PHY_BR_1M_1SLOT: < HCI Command: Change Conne.. (0x01|0x000f) plen 4 Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) Packet type: 0x331e 2-DH1 may not be used 3-DH1 may not be used DM1 may be used DH1 may be used 2-DH3 may not be used 3-DH3 may not be used 2-DH5 may not be used 3-DH5 may not be used > HCI Event: Command Status (0x0f) plen 4 Change Connection Packet Type (0x01|0x000f) ncmd 1 Status: Success (0x00) > HCI Event: Connection Packet Typ.. (0x1d) plen 5 Status: Success (0x00) Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) Packet type: 0x331e 2-DH1 may not be used 3-DH1 may not be used DM1 may be used DH1 may be used 2-DH3 may not be used 3-DH3 may not be used 2-DH5 may not be used Example setting BT_PHY_LE_1M_TX and BT_PHY_LE_1M_RX: < HCI Command: LE Set PHY (0x08|0x0032) plen 7 Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) All PHYs preference: 0x00 TX PHYs preference: 0x01 LE 1M RX PHYs preference: 0x01 LE 1M PHY options preference: Reserved (0x0000) > HCI Event: Command Status (0x0f) plen 4 LE Set PHY (0x08|0x0032) ncmd 1 Status: Success (0x00) > HCI Event: LE Meta Event (0x3e) plen 6 LE PHY Update Complete (0x0c) Status: Success (0x00) Handle: 1 Address: 00:AA:01:01:00:00 (Intel Corporation) TX PHY: LE 1M (0x01) RX PHY: LE 1M (0x01) Signed-off-by: Luiz Augusto von Dentz commit fe05e3c0593fda2c476b359b012065a42dccdd71 Author: Naga Bhavani Akella Date: Wed Dec 17 16:55:23 2025 +0530 Bluetooth: hci_sync: Add LE Channel Sounding HCI Command/event structures 1. Implement LE Event Mask to include events required for LE Channel Sounding 2. Enable Channel Sounding feature bit in the LE Host Supported Features command 3. Define HCI command and event structures necessary for LE Channel Sounding functionality Signed-off-by: Naga Bhavani Akella Signed-off-by: Luiz Augusto von Dentz commit 48fea7d4b363cfc051d50639a135f8be5d0be7c2 Author: Stefan Sørensen Date: Tue Dec 16 10:20:11 2025 +0100 Bluetooth: mgmt: Add idle_timeout to configurable system parameters While the configurable system parameters allow controlling the SNIFF mode parameters, they do not include the idle_timeout parameter responsible for enabling SNIFF mode. Add the idle_timeout parameter to allow controlling the idle timeout of BR/EDR connections. Signed-off-by: Stefan Sørensen Signed-off-by: Luiz Augusto von Dentz commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d Author: Stefan Sørensen Date: Tue Dec 16 10:20:10 2025 +0100 Bluetooth: hci_conn: Set link_policy on incoming ACL connections The connection link policy is only set when establishing an outgoing ACL connection causing connection idle modes not to be available on incoming connections. Move the setting of the link policy to the creation of the connection so all ACL connection will use the link policy set on the HCI device. Signed-off-by: Stefan Sørensen Signed-off-by: Luiz Augusto von Dentz commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b Author: Stefan Sørensen Date: Tue Dec 16 10:20:09 2025 +0100 Bluetooth: hci_conn: use mod_delayed_work for active mode timeout hci_conn_enter_active_mode() uses queue_delayed_work() with the intention that the work will run after the given timeout. However, queue_delayed_work() does nothing if the work is already queued, so depending on the link policy we may end up putting the connection into idle mode every hdev->idle_timeout ms. Use mod_delayed_work() instead so the work is queued if not already queued, and the timeout is updated otherwise. Signed-off-by: Stefan Sørensen Signed-off-by: Luiz Augusto von Dentz commit 544a237adaaf95e8aff1964c6d2182a915a8692e Author: Uwe Kleine-König Date: Wed Dec 17 12:20:33 2025 +0100 Bluetooth: btmtksdio: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Uwe Kleine-König Signed-off-by: Luiz Augusto von Dentz commit 62b44ebc1f2c71db3ca2d4737c52e433f6f03038 Author: Harshit Mogalapalli Date: Tue Jan 27 22:49:49 2026 -0800 iio: sca3000: Fix a resource leak in sca3000_probe() spi->irq from request_threaded_irq() not released when iio_device_register() fails. Add an return value check and jump to a common error handler when iio_device_register() fails. Fixes: 9a4936dc89a3 ("staging:iio:accel:sca3000 Tidy up probe order to avoid a race.") Signed-off-by: Harshit Mogalapalli Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 502a5731d3538b9b00fc7edea3aaf378bf916b96 Author: Vaibhav Gupta Date: Wed Dec 10 23:21:09 2025 +0000 Bluetooth: hci_bcm4377: Use generic power management Switch to the generic PCI power management framework and remove legacy callbacks like .suspend() and .resume(). With the generic framework, the standard PCI related work like: - pci_save/restore_state() - pci_enable/disable_device() - pci_set_power_state() is handled by the PCI core and this driver should implement only hci_bcm4377 specific operations in its respective callback functions. Signed-off-by: Vaibhav Gupta Signed-off-by: Luiz Augusto von Dentz commit 2630bcc8343a9d2a38dc1793068e6754b3156811 Author: Bluecross Date: Wed Dec 10 23:22:25 2025 +0300 Bluetooth: btusb: Add support for MediaTek7920 0489:e158 Add support for MediaTek7920 0489:e158 /sys/kernel/debug/usb/devices reports for that device: T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e158 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Andrew Elatsev Signed-off-by: Luiz Augusto von Dentz commit 129d1ef3c5e60d51678e6359beaba85771a49e46 Author: Luiz Augusto von Dentz Date: Wed Dec 10 11:38:08 2025 -0500 Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs conn->le_{tx,rx}_phy is not actually a bitfield as it set by HCI_EV_LE_PHY_UPDATE_COMPLETE it is actually correspond to the current PHY in use not what is supported by the controller, so this introduces different fields (conn->le_{tx,rx}_def_phys) to track what PHYs are supported by the connection. Fixes: eab2404ba798 ("Bluetooth: Add BT_PHY socket option") Signed-off-by: Luiz Augusto von Dentz commit fce1a9244a0f85683be8530e623bc729f24c5067 Author: Shuai Zhang Date: Wed Dec 3 11:37:12 2025 +0800 Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT_EN is pulled up by hw On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw and cannot be controlled by the host. As a result, in case of a firmware crash, the host cannot trigger a cold reset. Instead, the BT controller performs a warm restart on its own, without reloading the firmware. This leads to the controller remaining in IBS_WAKE state, while the host expects it to be in sleep mode. The mismatch causes HCI reset commands to time out. Additionally, the driver does not clear internal flags QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence. If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag is not cleared, so only the first SSR generates a coredump. Tell the driver that the BT controller has undergone a proper restart sequence: - Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR. - Add a 50ms delay to allow the controller to complete its warm reset. - Reset tx_idle_timer to prevent the host from entering TX sleep mode. - Clear memcoredump_flag to allow multiple coredump captures. Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set, which indicates that BT_EN is defined in DTS and cannot be toggled. Refer to the comment in include/net/bluetooth/hci.h for details on HCI_QUIRK_NON_PERSISTENT_SETUP. Reviewed-by: Dmitry Baryshkov Signed-off-by: Shuai Zhang Signed-off-by: Luiz Augusto von Dentz commit 7b6f9d9b1ea05c9c22570126547c780e8c6c3f62 Author: Yuxiong Wang Date: Thu Jan 29 14:45:52 2026 +0800 cxl: Fix premature commit_end increment on decoder commit failure In cxl_decoder_commit(), commit_end is incremented before verifying whether the commit succeeded, and the CXL_DECODER_F_ENABLE bit in cxld->flags is only set after a successful commit. As a result, if the commit fails, commit_end has been incremented and cxld->reset() has no effect since the flag is not set, so commit_end remains incorrectly incremented. The inconsistency between commit_end and CXL_DECODER_F_ENABLE causes failure during subsequent either commit or reset operations. Fix this by incrementing commit_end only after confirming the commit succeeded. Also, remove the ineffective cxld->reset() call. According to CXL Spec r4.0 8.2.4.20.12 Committing Decoder Programming, since cxld_await_commit() has cleared the decoder commit bit on failure, no additional reset is required. [dj: Fixed commit log 80 char wrapping. ] [dj: Fix "Fixes" tag to correct hash length. ] [dj: Change spec to r4.0. ] Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") Signed-off-by: Yuxiong Wang Acked-by: Huang Ying Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260129064552.31180-1-yuxiong.wang@linux.alibaba.com Signed-off-by: Dave Jiang commit dc81be96a73a67d47da336497b888529c73d389b Author: Shrikant Raskar Date: Wed Jan 28 23:21:53 2026 +0530 iio: proximity: rfd77402: Add interrupt handling support Add interrupt handling support to enable event-driven data acquisition instead of continuous polling. This improves responsiveness, reduces CPU overhead, and supports low-power operation by allowing the system to remain idle until an interrupt occurs. Reviewed-by: Andy Shevchenko Signed-off-by: Shrikant Raskar Signed-off-by: Jonathan Cameron commit 53516b6fdec09cb202ebf52b841cb25599f93688 Author: Shrikant Raskar Date: Wed Jan 28 23:21:52 2026 +0530 iio: proximity: rfd77402: Document device private data structure Add kernel-doc style comments for struct rfd77402_data to describe the purpose of each member. Reviewed-by: Andy Shevchenko Signed-off-by: Shrikant Raskar Signed-off-by: Jonathan Cameron commit dff4bdff074e1f92874676bed57970d19e3a86bd Author: Shrikant Raskar Date: Wed Jan 28 23:21:51 2026 +0530 iio: proximity: rfd77402: Use devm-managed mutex initialization Use devm_mutex_init() to tie the mutex lifetime to the device and improve debugging when CONFIG_DEBUG_MUTEXES is enabled. Reviewed-by: Andy Shevchenko Signed-off-by: Shrikant Raskar Signed-off-by: Jonathan Cameron commit 51eedb3a323ae87872c4cb60cc6abed696b0a822 Author: Shrikant Raskar Date: Wed Jan 28 23:21:50 2026 +0530 iio: proximity: rfd77402: Use kernel helper for result polling Replace the manually written polling loop with read_poll_timeout(), the kernel's standard helper for waiting on hardware status.This makes the code easier to read. Move the polling logic into a dedicated helper function, as it will be reused by future updates. Reviewed-by: Andy Shevchenko Signed-off-by: Shrikant Raskar Signed-off-by: Jonathan Cameron commit 36bff1842330b3eddaf5a7977eb00a724fc42c27 Author: Shrikant Raskar Date: Wed Jan 28 23:21:49 2026 +0530 iio: proximity: rfd77402: Align polling timeout with datasheet Update the polling delay to use a 100 ms timeout, as specified in the RFD77402 datasheet. Signed-off-by: Shrikant Raskar Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 821ddd25fbe88ea60e9c35cfb76c2ddeb1ffae26 Author: Christoph Hellwig Date: Wed Jan 28 16:26:18 2026 +0100 fsverity: start consolidating pagecache code ext4 and f2fs are largely using the same code to read a page full of Merkle tree blocks from the page cache, and the upcoming xfs fsverity support would add another copy. Move the ext4 code to fs/verity/ and use it in f2fs as well. For f2fs this removes the previous f2fs-specific error injection, but otherwise the behavior remains unchanged. Signed-off-by: Christoph Hellwig Reviewed-by: Andrey Albershteyn Reviewed-by: Jan Kara Reviewed-by: "Darrick J. Wong" Link: https://lore.kernel.org/r/20260128152630.627409-7-hch@lst.de Signed-off-by: Eric Biggers commit ac09a30900d81ac10606f650e3c720cfafa37be0 Author: Christoph Hellwig Date: Wed Jan 28 16:26:17 2026 +0100 fsverity: pass struct file to ->write_merkle_tree_block This will make an iomap implementation of the method easier. Signed-off-by: Christoph Hellwig Reviewed-by: Andrey Albershteyn Reviewed-by: "Darrick J. Wong" Acked-by: David Sterba # btrfs Link: https://lore.kernel.org/r/20260128152630.627409-6-hch@lst.de Signed-off-by: Eric Biggers commit 6f9fae2f738c41c22ee90778ff8fc069de379472 Author: Christoph Hellwig Date: Wed Jan 28 16:26:16 2026 +0100 f2fs: don't build the fsverity work handler for !CONFIG_FS_VERITY Use IS_ENABLED to disable this code, leading to a slight size reduction: text data bss dec hex filename 25709 2412 24 28145 6df1 fs/f2fs/compress.o.old 25198 2252 24 27474 6b52 fs/f2fs/compress.o Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260128152630.627409-5-hch@lst.de Signed-off-by: Eric Biggers commit fb26616459098323eeda67b4f30786743191171b Author: Christoph Hellwig Date: Wed Jan 28 16:26:15 2026 +0100 ext4: don't build the fsverity work handler for !CONFIG_FS_VERITY Use IS_ENABLED to disable this code, leading to a slight size reduction: text data bss dec hex filename 4121 376 16 4513 11a1 fs/ext4/readpage.o.old 4030 328 16 4374 1116 fs/ext4/readpage.o Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Reviewed-by: "Darrick J. Wong" Link: https://lore.kernel.org/r/20260128152630.627409-4-hch@lst.de Signed-off-by: Eric Biggers commit 70098d932714e06894da3e46a0b8e7abbea9a961 Author: Christoph Hellwig Date: Wed Jan 28 16:26:14 2026 +0100 fs,fsverity: clear out fsverity_info from common code Free the fsverity_info directly in clear_inode instead of requiring file systems to handle it. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Reviewed-by: "Darrick J. Wong" Acked-by: David Sterba # btrfs Link: https://lore.kernel.org/r/20260128152630.627409-3-hch@lst.de Signed-off-by: Eric Biggers commit e9734653c523c744f03333ece6ae7a315187f05c Author: Christoph Hellwig Date: Wed Jan 28 16:26:13 2026 +0100 fs,fsverity: reject size changes on fsverity files in setattr_prepare Add the check to reject truncates of fsverity files directly to setattr_prepare instead of requiring the file system to handle it. Besides removing boilerplate code, this also fixes the complete lack of such check in btrfs. Fixes: 146054090b08 ("btrfs: initial fsverity support") Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Reviewed-by: "Darrick J. Wong" Link: https://lore.kernel.org/r/20260128152630.627409-2-hch@lst.de Signed-off-by: Eric Biggers commit 0077e9b985482e5c020468c6257f8508f68aa0b2 Author: Gwendal Grignou Date: Tue Jan 27 19:27:02 2026 -0800 iio: cros_ec: Allow enabling/disabling calibration mode 'calibrate' was a one-shot event sent to the sensor to calibrate itself. It is used on Bosch sensors (BMI160, BMA254). Light sensors work differently: They are first put in calibration mode, tests are run to collect information and calculate the calibration values to apply. Once done, the sensors are put back in normal mode. Accept boolean true and false (not just true) to enter/exit calibration state. Check "echo 0 > calibrate" is supported. Signed-off-by: Gwendal Grignou Reviewed-by: Nick Vaccaro Reviewed-by: Tzung-Bi Shih Signed-off-by: Jonathan Cameron commit 0a6d6ed694d72b66b0ed7a483d5effa01acd3951 Author: Alex Deucher Date: Wed Jan 28 23:05:50 2026 -0500 drm/amdgpu/gfx12: adjust KGQ reset sequence Kernel gfx queues do not need to be reinitialized or remapped after a reset. Align with gfx11. v2: preserve init and remap for MMIO case. Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit b340ff216fdabfe71ba0cdd47e9835a141d08e10 Author: Alex Deucher Date: Wed Jan 28 22:55:46 2026 -0500 drm/amdgpu/gfx11: adjust KGQ reset sequence Kernel gfx queues do not need to be reinitialized or remapped after a reset. This fixes queue reset failures on APUs. v2: preserve init and remap for MMIO case. Fixes: b3e9bfd86658 ("drm/amdgpu/gfx11: add ring reset callbacks") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4789 Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit a2918f958d3f677ea93c0ac257cb6ba69b7abb7c Author: Alex Deucher Date: Wed Jan 28 18:13:16 2026 -0500 drm/amdgpu/gfx12: fix wptr reset in KGQ init wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs. Reviewed-by: Timur Kristóf Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit 1f16866bdb1daed7a80ca79ae2837a9832a74fbc Author: Alex Deucher Date: Wed Jan 28 18:09:03 2026 -0500 drm/amdgpu/gfx11: fix wptr reset in KGQ init wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs. Reviewed-by: Timur Kristóf Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit e80b1d1aa1073230b6c25a1a72e88f37e425ccda Author: Alex Deucher Date: Wed Jan 28 20:51:08 2026 -0500 drm/amdgpu/gfx10: fix wptr reset in KGQ init wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs. Reviewed-by: Timur Kristóf Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit 2bddc36c121918a523132ee369a6c76da702748c Author: Lang Yu Date: Mon Jan 26 17:38:01 2026 +0800 drm/amdkfd: Use AMDGPU_MQD_SIZE_ALIGN in gfx11+ kfd mqd manager MES is enabled by default from gfx11+, use AMDGPU_MQD_SIZE_ALIGN unconditionally for gfx11+. Signed-off-by: Lang Yu Reviewed-by: David Belanger Reviewed-by: Hawking Zhang Reviewed-by: Mukul Joshi Signed-off-by: Alex Deucher commit 3aca6f835ba1635e49d9b76d2102b218643d276e Author: Lang Yu Date: Mon Jan 26 16:57:01 2026 +0800 drm/amdkfd: Adjust parameter of allocate_mqd Make allocate_mqd consistent with other callbacks. Prepare for next patch to use mqd_manager->mqd_size. Signed-off-by: Lang Yu Reviewed-by: David Belanger Reviewed-by: Hawking Zhang Reviewed-by: Mukul Joshi Signed-off-by: Alex Deucher commit a6a4dd519cbe1fdf1f33e2942356dcc9c7b4c682 Author: Lang Yu Date: Mon Jan 26 16:47:39 2026 +0800 drm/amdgpu: Use AMDGPU_MQD_SIZE_ALIGN in KGD Use AMDGPU_MQD_SIZE_ALIGN for both kernel and user queue. Signed-off-by: Lang Yu Reviewed-by: David Belanger Reviewed-by: Hawking Zhang Reviewed-by: Mukul Joshi Signed-off-by: Alex Deucher commit 0d9a49a2ce4738bb802cfc0c9ca5abdecd36e96e Author: Lijo Lazar Date: Mon Jan 19 12:19:40 2026 +0530 drm/amd/pm: Initialize allowed feature list Instead of returning feature bit mask of allowed features, initialize the allowed features in the callback implementation itself. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 156c0ab1de4e917b106deb63cd7583fa45d7ce29 Author: Lijo Lazar Date: Mon Jan 19 12:14:47 2026 +0530 drm/amd/pm: Remove unused logic in SMUv14.0.2 Remove commented and redundant logic in get_allowed_feature_mask implementation. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit c99d381d2dcece1cb18ae28706b12da271517dde Author: Lijo Lazar Date: Mon Jan 19 12:00:29 2026 +0530 drm/amd/pm: Add smu feature interface functions Instead of using bitmap operations, add wrapper interface functions to operate on smu features. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit f28b0a13865f85f216d4ac9ede75bbf8745a524f Author: Lijo Lazar Date: Fri Jan 16 12:07:39 2026 +0530 drm/amd/pm: Add smu feature bits data struct Add a bitmap struct to represent smu feature bits and functions to set/clear features. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 82a9ab369a6785499ad18453bb76b1128403122e Author: Lang Yu Date: Mon Jan 26 10:08:25 2026 +0800 drm/amdgpu: Add a helper macro to align mqd size MES FW uses address(mqd_addr + sizeof(struct mqd) + 3*sizeof(uint32_t)) as fence address and writes a 32 bit fence value to this address. Driver needs to allocate some extra memory(at least 4 DWs) in addition to sizeof(struct mqd) as mqd memory(limited to gfx/compute/sdma queue). For gfx11/12, sizeof(struct mqd) < PAGE_SIZE, KGD allocates mqd memory with PAGE_SIZE aligned works. For gfx12.1, sizeof(struct mqd) == PAGE_SIZE, it doesn't work. KFD mqd manager hardcodes mqd size to PAGE_SIZE/MQD_SIZE across different IP versions to solve this issue. To avoid hardcoding in differnet places and across different IP versions. Let's use AMDGPU_MQD_SIZE_ALIGN instead. It is used in two places. 1. mqd memory alloction 2. mqd stride handling for multi xcc config v2: Use AMDGPU_GPU_PAGE_ALIGN. (Mukul) Signed-off-by: Lang Yu Reviewed-by: David Belanger (v1) Reviewed-by: Hawking Zhang Reviewed-by: Mukul Joshi Signed-off-by: Alex Deucher commit 8079b87c02e531cc91601f72ea8336dd2262fdf1 Author: Jesse.Zhang Date: Wed Jan 28 11:35:57 2026 +0800 drm/amdgpu: validate user queue size constraints Add validation to ensure user queue sizes meet hardware requirements: - Size must be a power of two for efficient ring buffer wrapping - Size must be at least AMDGPU_GPU_PAGE_SIZE to prevent undersized allocations This prevents invalid configurations that could lead to GPU faults or unexpected behavior. Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 2693ca2e02793fde06ff9d64175aed6f144f2287 Author: Randy Dunlap Date: Tue Jan 27 22:25:37 2026 -0800 iio: frequency: ad9523: correct kernel-doc bad line warning Insert a "*" in the kernel-doc line to resolve a warning: Warning: include/linux/iio/frequency/ad9523.h:47 bad line: LSB = 1/2 of a period of the divider input clock. Signed-off-by: Randy Dunlap Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit bf870c97ce2b9b48f02184d317dab4cf5691ca0e Author: Randy Dunlap Date: Wed Jan 28 12:07:20 2026 -0800 iio: buffer: buffer_impl.h: fix kernel-doc warnings Resolve all kernel-doc warnings in buffer_impl.h: Warning: include/linux/iio/buffer_impl.h:172 struct member 'direction' not described in 'iio_buffer' Warning: include/linux/iio/buffer_impl.h:184 No description found for return value of 'iio_update_buffers' Also correct one typo (word order switch) and remove one stray space in a kernel-doc comment. Signed-off-by: Randy Dunlap Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 83b314e9c8824501e6fed7b313fdae9469da0d6f Author: Ethan Nelson-Moore Date: Thu Jan 29 00:29:27 2026 -0800 EDAC/i82443bxgx: Remove driver that has been marked broken since 2007 The history of this driver is pretty amusing. It was marked broken in 2007 in 28f96eeafc89 ("drivers/edac-new-i82443bxgz-mc-driver: mark as broken"). It was then fixed in 2008 in 53a2fe5804e8 ("edac: make i82443bxgx_edac coexist with intel_agp"), but the dependency on BROKEN was never removed. Given that this was never fixed in the last ~18 years, it is obvious there is no demand for this driver. Remove it and move the former maintainer to the CREDITS file. Signed-off-by: Ethan Nelson-Moore Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260129082937.48740-1-enelsonmoore@gmail.com commit b79b24f578cdb2d657db23e5fafe82c7e6a36b72 Author: Antoniu Miclaus Date: Thu Jan 29 17:01:45 2026 +0200 iio: gyro: itg3200: Fix unchecked return value in read_raw The return value from itg3200_read_reg_s16() is stored in ret but never checked. The function unconditionally returns IIO_VAL_INT, ignoring potential I2C read failures. This causes garbage data to be returned to userspace when the read fails, with no error reported. Add proper error checking to propagate the failure to callers. Fixes: 9dbf091da080 ("iio: gyro: Add itg3200") Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron commit 53f0a73f9ec7575d4e59dc8dc70e891979ee2014 Author: Antoniu Miclaus Date: Thu Jan 29 16:43:07 2026 +0200 MAINTAINERS: add entry for ADE9000 driver Add maintainer entry for the ADE9000 polyphase energy metering IC driver, including devicetree bindings and driver documentation. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit b3c78bc53630d14a5770451ede3a30e7052f3b8b Author: Amir Goldstein Date: Thu Jan 29 11:02:12 2026 +0100 nfsd: do not allow exporting of special kernel filesystems pidfs and nsfs recently gained support for encode/decode of file handles via name_to_handle_at(2)/open_by_handle_at(2). These special kernel filesystems have custom ->open() and ->permission() export methods, which nfsd does not respect and it was never meant to be used for exporting those filesystems by nfsd. Therefore, do not allow nfsd to export filesystems with custom ->open() or ->permission() methods. Fixes: b3caba8f7a34a ("pidfs: implement file handle support") Fixes: 5222470b2fbb3 ("nsfs: support file handles") Reviewed-by: Jeff Layton Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/20260129100212.49727-3-amir73il@gmail.com Reviewed-by: Chuck Lever Signed-off-by: Christian Brauner commit a39162f77f49b618df5a721a1e48d8b903280fbd Author: Amir Goldstein Date: Thu Jan 29 11:02:11 2026 +0100 exportfs: clarify the documentation of open()/permission() expotrfs ops pidfs and nsfs recently gained support for encode/decode of file handles via name_to_handle_at(2)/open_by_handle_at(2). These special kernel filesystems have custom ->open() and ->permission() export methods, which nfsd does not respect and it was never meant to be used for exporting those filesystems by nfsd. Update kernel-doc comments to express the fact the those methods are for open_by_handle(2) system only and not compatible with nfsd. Reviewed-by: Jeff Layton Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/20260129100212.49727-2-amir73il@gmail.com Reviewed-by: Chuck Lever Signed-off-by: Christian Brauner commit 3e55c3dc93fdbb1cc2ff436fa10996468288c28c Author: Antoniu Miclaus Date: Thu Jan 29 16:11:59 2026 +0200 iio: accel: sca3000: remove unused last_timestamp field Remove unused last_timestamp field from sca3000_state struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 3ec0a13ae21c68a34481dc2b128a9c064e26d22d Author: Antoniu Miclaus Date: Thu Jan 29 16:11:57 2026 +0200 iio: accel: adxl372: remove unused int2_bitmask field Remove unused int2_bitmask field from adxl372_state struct. The field is declared but never accessed in the driver. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit d07b24cc62abc63f47ff30d5d662c3b875797072 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:39 2026 +0100 iio: adc: ad7766: Use iio_trigger_generic_data_rdy_poll() ad7766_irq() is identical to iio_trigger_generic_data_rdy_poll(). Use iio_trigger_generic_data_rdy_poll() instead of ad7766_irq(). Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit a54e9440925e6617c98669066b4753c4cdcea8a0 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:38 2026 +0100 iio: magnetometer: Remove IRQF_ONESHOT Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also disallows force-threading of the primary handler and the irq-core will warn about this. The force-threading functionality is required on PREEMPT_RT because the handler is using locks with can sleep on PREEMPT_RT. Remove IRQF_ONESHOT from irqflags. Tested-by: Geert Uytterhoeven Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron commit ac9fabd578a03bfa0d599e3fcd9c4e106661e3d2 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:37 2026 +0100 iio: Replace IRQF_ONESHOT with IRQF_NO_THREAD Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also disallows force-threading of the primary handler and the irq-core will warn about this. The intention here was probably not allowing forced-threading for handlers such as iio_trigger_generic_data_rdy_poll() will intends to invoke hard-interrupt handlers. Replace IRQF_ONESHOT with IRQF_NO_THREAD. Reviewed-by: Andy Shevchenko Reviewed-by: Marcus Folkesson Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Jonathan Cameron commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:36 2026 +0100 iio: Use IRQF_NO_THREAD The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke other interrupt handler and this supposed to happen from within the hardirq. Use IRQF_NO_THREAD to forbid forced-threading. Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 96a77ec577d4117f13e2527c9a377d6ba637f5c0 Author: Svyatoslav Ryhel Date: Sun Jan 25 15:42:58 2026 +0200 dt-bindings: rtc: cpcap: convert to schema Convert RTC devicetree bindings for the Motorola CPCAP MFD from TXT to YAML format. This patch does not change any functionality; the bindings remain the same. Signed-off-by: Svyatoslav Ryhel Link: https://patch.msgid.link/20260125134302.45958-7-clamor95@gmail.com Signed-off-by: Alexandre Belloni commit 2254383176fc9f15ce54eabc849b36c874efd3aa Author: Tomas Melin Date: Thu Jan 22 13:53:49 2026 +0000 rtc: zynqmp: use dynamic max and min offset ranges Maximum and minimum offsets in ppb that can be handled are dependent on the rtc clock frequency and what can fit in the 16-bit register field. Reviewed-by: Harini T Tested-by: Harini T Signed-off-by: Tomas Melin Acked-by: Michal Simek Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-5-d4edb966b499@vaisala.com Signed-off-by: Alexandre Belloni commit 9f5af70268d679e710a65e5e1b4259789a848309 Author: Tomas Melin Date: Thu Jan 22 13:53:48 2026 +0000 rtc: zynqmp: rework set_offset set_offset was using remainder of do_div as tick_mult which resulted in wrong offset. Calibration value also assumed builtin calibration default. Update fract_offset to correctly calculate the value for negative offset and replace the for loop with division. Tested-by: Harini T Signed-off-by: Tomas Melin Reviewed-by: Harini T Acked-by: Michal Simek Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-4-d4edb966b499@vaisala.com Signed-off-by: Alexandre Belloni commit 0f9989443faec6ae8b8418ddf39f080c75a23c0d Author: Tomas Melin Date: Thu Jan 22 13:53:47 2026 +0000 rtc: zynqmp: rework read_offset read_offset() was using static frequency for determining the tick offset. It was also using remainder from do_div() operation as tick_mult value which caused the offset to be incorrect. At the same time, rework function to improve readability. It is worth noting, that due to rounding errors, the offset readback will differ slightly for positive and negative calibration values. Reviewed-by: Harini T Tested-by: Harini T Signed-off-by: Tomas Melin Acked-by: Michal Simek Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-3-d4edb966b499@vaisala.com Signed-off-by: Alexandre Belloni commit 83b9e5eb043710190f6461729fa2e05320a6594d Author: Tomas Melin Date: Thu Jan 22 13:53:46 2026 +0000 rtc: zynqmp: check calibration max value Enable check to not overflow the calibration max value. Reviewed-by: Harini T Tested-by: Harini T Signed-off-by: Tomas Melin Acked-by: Michal Simek Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-2-d4edb966b499@vaisala.com Signed-off-by: Alexandre Belloni commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 Author: Tomas Melin Date: Thu Jan 22 13:53:45 2026 +0000 rtc: zynqmp: correct frequency value Fix calibration value in case a clock reference is provided. The actual calibration value written into register is frequency - 1. Reviewed-by: Harini T Tested-by: Harini T Signed-off-by: Tomas Melin Acked-by: Michal Simek Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com Signed-off-by: Alexandre Belloni commit b1353865ce0fda5e8117ea3951869d24bbbc74f3 Merge: 40210c2b11a873 fa19d42cc79152 Author: Christian Brauner Date: Thu Jan 29 16:01:07 2026 +0100 Merge patch series "Add traces and file attributes for fs-verity" Andrey Albershteyn says: This two small patches grew from fs-verity XFS patchset. I think they're self-contained improvements which could go without XFS implementation. * patches from https://patch.msgid.link/20260126115658.27656-1-aalbersh@kernel.org: fsverity: add tracepoints fs: add FS_XFLAG_VERITY for fs-verity files Link: https://patch.msgid.link/20260126115658.27656-1-aalbersh@kernel.org Signed-off-by: Christian Brauner commit fa19d42cc7915226db416999866171a456dac657 Author: Andrey Albershteyn Date: Mon Jan 26 12:56:58 2026 +0100 fsverity: add tracepoints fs-verity previously had debug printk but it was removed. This patch adds trace points to similar places, as a better alternative. Signed-off-by: Andrey Albershteyn Reviewed-by: Darrick J. Wong [djwong: fix formatting] Signed-off-by: Darrick J. Wong Link: https://patch.msgid.link/20260126115658.27656-3-aalbersh@kernel.org Signed-off-by: Christian Brauner commit 0e6b7eae1fded85f94a357d6132f07d64c614cfa Author: Andrey Albershteyn Date: Mon Jan 26 12:56:57 2026 +0100 fs: add FS_XFLAG_VERITY for fs-verity files fs-verity introduced inode flag for inodes with enabled fs-verity on them. This patch adds FS_XFLAG_VERITY file attribute which can be retrieved with FS_IOC_FSGETXATTR ioctl() and file_getattr() syscall. This flag is read-only and can not be set with corresponding set ioctl() and file_setattr(). The FS_IOC_SETFLAGS requires file to be opened for writing which is not allowed for verity files. The FS_IOC_FSSETXATTR and file_setattr() clears this flag from the user input. As this is now common flag for both flag interfaces (flags/xflags) add it to overlapping flags list to exclude it from overwrite. Signed-off-by: Andrey Albershteyn Link: https://patch.msgid.link/20260126115658.27656-2-aalbersh@kernel.org Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit e939bd675634fd52d559b90e2cf58333e16afea8 Author: Chuck Lever Date: Fri Jan 9 11:21:42 2026 -0500 NFSD: Add POSIX ACL file attributes to SUPPATTR bitmasks Now that infrastructure for NFSv4 POSIX draft ACL has been added to NFSD, it should be safe to advertise support to NFS clients. NFSD_SUPPATTR_EXCLCREAT_WORD2 includes NFSv4.2-only attributes, but version filtering occurs via nfsd_suppattrs[] before this mask is applied, ensuring pre-4.2 clients never see unsupported attributes. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 318579c0935c2faf1cccbc6359b410ff2ca4b84a Author: Rick Macklem Date: Fri Jan 9 11:21:41 2026 -0500 NFSD: Add POSIX draft ACL support to the NFSv4 SETATTR operation The POSIX ACL extension to NFSv4 enables clients to set access and default ACLs via FATTR4_POSIX_ACCESS_ACL and FATTR4_POSIX_DEFAULT_ACL attributes. Integration of these attributes into SETATTR processing requires wiring them through the nfsd_attrs structure and ensuring proper cleanup on all code paths. This patch connects the na_pacl and na_dpacl fields in nfsd_attrs to the decoded ACL pointers from the NFSv4 SETATTR decoder. Ownership of these ACL references transfers to attrs immediately after initialization, with the decoder's pointers cleared to NULL. This transfer ensures nfsd_attrs_free() releases the ACLs on normal completion, while new error paths call posix_acl_release() directly when cleanup occurs before nfsd_attrs_free() runs. Early returns in the nfsd4_setattr() function gain conversions to goto statements that branch to proper cleanup handlers. Error paths before fh_want_write() branch to out_err for ACL release only; paths after fh_want_write() use the existing out label for full cleanup via nfsd_attrs_free(). The patch adds mutual exclusion between NFSv4 ACLs (sa_acl) and POSIX ACLs. Setting both types simultaneously returns nfserr_inval because these ACL models cannot coexist on the same file object. Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d2ca50606f5f0235d7780c1cd73b6614a5d07620 Author: Rick Macklem Date: Fri Jan 9 11:21:40 2026 -0500 NFSD: Add support for POSIX draft ACLs for file creation NFSv4.2 clients can specify POSIX draft ACLs when creating file objects via OPEN(CREATE) and CREATE operations. The previous patch added POSIX ACL support to the NFSv4 SETATTR operation for modifying existing objects, but file creation follows different code paths that also require POSIX ACL handling. This patch integrates POSIX ACL support into nfsd4_create() and nfsd4_create_file(). Ownership of the decoded ACL pointers (op_dpacl, op_pacl, cr_dpacl, cr_pacl) transfers to the nfsd_attrs structure immediately, with the original fields cleared to NULL. This transfer ensures nfsd_attrs_free() releases the ACLs upon completion while preventing double-free on error paths. Mutual exclusion between NFSv4 ACLs and POSIX ACLs is enforced: setting both op_acl and op_dpacl/op_pacl simultaneously returns nfserr_inval. Errors during ACL application clear the corresponding bits in the result bitmask (fattr->bmval), signaling partial completion to the client. Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5fc51dfc2eb160bd7ab3251ab1767cacf9c8bf05 Author: Rick Macklem Date: Fri Jan 9 11:21:39 2026 -0500 NFSD: Add support for XDR decoding POSIX draft ACLs The POSIX ACL extension to NFSv4 defines FATTR4_POSIX_ACCESS_ACL and FATTR4_POSIX_DEFAULT_ACL for setting access and default ACLs via CREATE, OPEN, and SETATTR operations. This patch adds the XDR decoders for those attributes. The nfsd4_decode_fattr4() function gains two additional parameters for receiving decoded POSIX ACLs. CREATE, OPEN, and SETATTR decoders pass pointers to these new parameters, enabling clients to set POSIX ACLs during object creation or modification. Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 345c4b7734e841d20a70a84deb13cb317c45d484 Author: Rick Macklem Date: Fri Jan 9 11:21:38 2026 -0500 NFSD: Refactor nfsd_setattr()'s ACL error reporting Support for FATTR4_POSIX_ACCESS_ACL and FATTR4_POSIX_DEFAULT_ACL attributes in subsequent patches allows clients to set both ACL types simultaneously during SETATTR and file creation. Each ACL type can succeed or fail independently, requiring the server to clear individual attribute bits in the reply bitmap when one fails while the other succeeds. The existing na_aclerr field cannot distinguish which ACL type encountered an error. Separate error fields (na_paclerr for access ACLs, na_dpaclerr for default ACLs) enable the server to report per-ACL-type failures accurately. This refactoring also adds validation previously absent: default ACL processing rejects non-directory targets with EINVAL and passes NULL to set_posix_acl() when a_count is zero to delete the ACL. Access ACL processing rejects zero a_count with EINVAL for ACL_SCOPE_FILE_SYSTEM semantics (the only scope currently supported). The changes preserve compatibility with existing NFSv4 ACL code. NFSv4 ACL conversion (nfs4_acl_nfsv4_to_posix()) never produces POSIX ACLs with a_count == 0, so the new validation logic only affects future POSIX ACL attribute handling. Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 9ac6fc0fabb72550846893a4f3cf8a8b701157d9 Author: Rick Macklem Date: Fri Jan 9 11:21:37 2026 -0500 NFSD: Do not allow NFSv4 (N)VERIFY to check POSIX ACL attributes Section 9.3 of draft-ietf-nfsv4-posix-acls-00 prohibits use of the POSIX ACL attributes with VERIFY and NVERIFY operations: the server MUST reply NFS4ERR_INVAL when a client attempts this. Beyond the protocol requirement, comparison of POSIX draft ACLs via (N)VERIFY presents an implementation challenge. Clients are not required to order the ACEs within a POSIX ACL in any particular way, making reliable attribute comparison impractical. Return nfserr_inval when the client requests FATTR4_POSIX_ACCESS_ACL or FATTR4_POSIX_DEFAULT_ACL in a VERIFY or NVERIFY operation. Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 97e9a9ec32231d75cc241f63ed6fd4cd210079a0 Author: Rick Macklem Date: Fri Jan 9 11:21:36 2026 -0500 NFSD: Add nfsd4_encode_fattr4_posix_access_acl The POSIX ACL extension to NFSv4 defines FATTR4_POSIX_ACCESS_ACL for retrieving the access ACL of a file or directory. This patch adds the XDR encoder for that attribute. The access ACL is retrieved via get_inode_acl(). If the filesystem provides no explicit access ACL, one is synthesized from the file mode via posix_acl_from_mode(). Each entry is encoded as a posixace4: tag type, permission bits, and principal name (empty for structural entries, resolved via idmapping for USER/GROUP entries). Unlike the default ACL encoder which applies only to directories, this encoder handles all inode types and ensures an access ACL is always available through mode-based synthesis when needed. Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5e62c904e4dcc0e53471edca6347cdbc20fd18f8 Author: Rick Macklem Date: Fri Jan 9 11:21:35 2026 -0500 NFSD: Add nfsd4_encode_fattr4_posix_default_acl The POSIX ACL extension to NFSv4 defines FATTR4_POSIX_DEFAULT_ACL for retrieving a directory's default ACL. This patch adds the XDR encoder for that attribute. For directories, the default ACL is retrieved via get_inode_acl() and each entry is encoded as a posixace4: tag type, permission bits, and principal name (empty for structural entries like USER_OBJ/GROUP_OBJ/MASK/OTHER, resolved via idmapping for USER/GROUP entries). Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 8093c31f2c959d6d92a33d9161d5e2c53d69720f Author: Rick Macklem Date: Fri Jan 9 11:21:34 2026 -0500 NFSD: Add nfsd4_encode_fattr4_acl_trueform_scope The FATTR4_ACL_TRUEFORM_SCOPE attribute indicates the granularity at which the ACL model can vary: per file object, per file system, or uniformly across the entire server. In Linux, the ACL model is determined by the SB_POSIXACL superblock flag, which applies uniformly to all files within a file system. Different exported file systems can have different ACL models, but individual files cannot differ from their containing file system. ACL_SCOPE_FILE_SYSTEM accurately reflects this behavior. Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4a639a727f36e2bf49204c106cedab0060cdd75d Author: Rick Macklem Date: Fri Jan 9 11:21:33 2026 -0500 NFSD: Add nfsd4_encode_fattr4_acl_trueform Mapping between NFSv4 ACLs and POSIX ACLs is semantically imprecise: a client that sets an NFSv4 ACL and reads it back may see a different ACL than it wrote. The proposed NFSv4 POSIX ACL extension introduces the FATTR4_ACL_TRUEFORM attribute, which reports whether a file object stores its access control permissions using NFSv4 ACLs or POSIX ACLs. A client aware of this extension can avoid lossy translation by requesting and setting ACLs in their native format. When NFSD is built with CONFIG_NFSD_V4_POSIX_ACLS, report ACL_MODEL_POSIX_DRAFT for file objects on file systems with the SB_POSIXACL flag set, and ACL_MODEL_NONE otherwise. Linux file systems do not store NFSv4 ACLs natively, so ACL_MODEL_NFS4 is never reported. Signed-off-by: Rick Macklem Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 91dc464fbed3a567cbbd12b41b24f89b905ad63d Author: Chuck Lever Date: Fri Jan 9 11:21:32 2026 -0500 Add RPC language definition of NFSv4 POSIX ACL extension The language definition was extracted from the new draft-ietf-nfsv4-posix-acls specification. This ensures good constant and type name alignment between the spec and the Linux kernel source code, and brings in some basic XDR utilities for handling NFSv4 POSIX draft ACLs. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit feb8a46b14d9dc927bbedd59b43da3a2c798d64a Author: Chuck Lever Date: Fri Jan 9 11:21:31 2026 -0500 NFSD: Add a Kconfig setting to enable support for NFSv4 POSIX ACLs A new IETF draft extends NFSv4.2 with POSIX ACL attributes: https://www.ietf.org/archive/id/draft-ietf-nfsv4-posix-acls-00.txt This draft has not yet been ratified. A build-time configuration option allows developers and distributors to decide whether to expose this experimental protocol extension to NFSv4 clients. The option is disabled by default to prevent unintended deployment of potentially unstable protocol features in production environments. This approach mirrors the existing NFSD_V4_DELEG_TIMESTAMPS option, which gates another experimental NFSv4 extension based on an unratified IETF draft. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6bc85baba4b08c787a8c9ba1bb0252a83e5c5603 Author: Chuck Lever Date: Fri Jan 9 11:21:30 2026 -0500 xdrgen: Implement pass-through lines in specifications XDR specification files can contain lines prefixed with '%' that pass through unchanged to generated output. Traditional rpcgen removes the '%' and emits the remainder verbatim, allowing direct insertion of C includes, pragma directives, or other language- specific content into the generated code. Until now, xdrgen silently discarded these lines during parsing. This prevented specifications from including necessary headers or preprocessor directives that might be required for the generated code to compile correctly. The grammar now captures pass-through lines instead of ignoring them. A new AST node type represents pass-through content, and the AST transformer strips the leading '%' character. Definition and source generators emit pass-through content in document order, preserving the original placement within the specification. This brings xdrgen closer to feature parity with traditional rpcgen while maintaining the existing document-order processing model. Existing generated xdrgen source code has been regenerated. Signed-off-by: Chuck Lever commit 40210c2b11a873ff64a812c2d2600f529f01a83e Author: Tamir Duberstein Date: Mon Dec 22 13:18:57 2025 +0100 rust: seq_file: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Link: https://patch.msgid.link/20251222-cstr-vfs-v1-1-18e3d327cbd7@gmail.com Acked-by: Danilo Krummrich Reviewed-by: Daniel Almeida Signed-off-by: Christian Brauner commit 74dd4d1f4c7d2e49bbeb1374f1ebea95d963eac0 Merge: a1fe789a96fe47 0061030929e2d0 Author: Rafael J. Wysocki Date: Thu Jan 29 15:30:03 2026 +0100 Merge tag 'thermal-v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal control updates for 6.20/7.0 from Daniel Lezcano: "- Fix CFLAGS and LDFLAGS in the pkg-config template fir the libthermal (Romain Gantois) - Support multiple temp to raw conversion functions for the Mediatek LVTS thermal driver and add the MT8196 and MT6991 support (Laura Nao) - Add support for the Mediatek LVTS driver for MT7987 (Frank Wunderlich) - Use the existing HZ_PER_MHZ macro on STM32 (Andy Shevchenko) - Use the existing clamp() macro in BCM2835 (Thorsten Blum) - Make the reset line optional in order to support new Renesas Soc where it is not available. Add the RZ/T2H and RZ/N2H suppport (Cosmin Tanislav)" * tag 'thermal-v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal: renesas: rzg3e: add support for RZ/T2H and RZ/N2H dt-bindings: thermal: r9a09g047-tsu: document RZ/T2H and RZ/N2H thermal: renesas: rzg3e: make calibration value retrieval per-chip thermal: renesas: rzg3e: make min and max temperature per-chip thermal: renesas: rzg3e: make reset optional dt-bindings: thermal: r9a09g047-tsu: Document RZ/V2N TSU thermal/drivers/broadcom: Use clamp to simplify bcm2835_thermal_temp2adc thermal/drivers/stm32: Use predefined HZ_PER_MHZ instead of a custom one thermal/drivers/mediatek/lvts_thermal: Add mt7987 support dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for MT7987 dt-bindings: nvmem: mediatek: efuse: Add support for MT8196 thermal/drivers/mediatek/lvts_thermal: Add MT8196 support thermal/drivers/mediatek/lvts: Support MSR offset for 16-bit calibration data thermal/drivers/mediatek/lvts: Add support for ATP mode thermal/drivers/mediatek/lvts: Add lvts_temp_to_raw variant thermal/drivers/mediatek/lvts: Add platform ops to support alternative conversion logic thermal/drivers/mediatek/lvts: Make number of calibration offsets configurable dt-bindings: thermal: mediatek: Add LVTS thermal controller support for MT8196 tools: lib: thermal: Correct CFLAGS and LDFLAGS in pkg-config template commit bbb758a6943e19c483ab752cf8220140b46cf22c Author: Boris Faure Date: Thu Jan 29 14:14:54 2026 +0000 ASoC: sdca: Fix missing regmap dependencies in Kconfig The SDCA modules failed to build with modpost errors: ERROR: modpost: "__devm_regmap_init_sdw" [sound/soc/sdca/snd-soc-sdca-class.ko] undefined! ERROR: modpost: "__devm_regmap_init_sdw_mbq" [sound/soc/sdca/snd-soc-sdca-class-function.ko] undefined! The issue occurs because: - sdca_class.c calls devm_regmap_init_sdw() which requires REGMAP_SOUNDWIRE - sdca_class_function.c calls devm_regmap_init_sdw_mbq_cfg() which requires REGMAP_SOUNDWIRE_MBQ However, the Kconfig didn't select these dependencies, causing the symbols to be unavailable when the SDCA modules are built. Fix this by adding: - select REGMAP_SOUNDWIRE to SND_SOC_SDCA_CLASS - select REGMAP_SOUNDWIRE_MBQ to SND_SOC_SDCA_CLASS_FUNCTION This ensures the required regmap drivers are enabled when building SDCA support. Configuration after fix: CONFIG_SND_SOC_SDCA_CLASS=m CONFIG_SND_SOC_SDCA_CLASS_FUNCTION=m CONFIG_REGMAP_SOUNDWIRE=m CONFIG_REGMAP_SOUNDWIRE_MBQ=m Signed-off-by: Boris Faure Link: https://patch.msgid.link/20260129141419.13843-1-boris@fau.re Signed-off-by: Mark Brown commit e75e408dc524ba32b3bd66e89d2ba1e337877bfa Merge: aba0138eb7d72f e19079adcd26a2 Author: Paolo Abeni Date: Thu Jan 29 14:56:13 2026 +0100 Merge tag 'nf-next-26-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: updates for net-next The following patchset contains Netfilter updates for *net-next*: Patches 1 to 4 add IP6IP6 tunneling acceleration to the flowtable infrastructure. Patch 5 extends test coverage for this. From Lorenzo Bianconi. Patch 6 removes a duplicated helper from xt_time extension, we can use an existing helper for this, from Jinjie Ruan. Patch 7 adds an rhashtable to nfnetink_queue to speed up out-of-order verdict processing. Before this list walk was required due to in-order design assumption. netfilter pull request nf-next-26-01-29 * tag 'nf-next-26-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nfnetlink_queue: optimize verdict lookup with hash table netfilter: xt_time: use is_leap_year() helper selftests: netfilter: nft_flowtable.sh: Add IP6IP6 flowtable selftest netfilter: flowtable: Add IP6IP6 tx sw acceleration netfilter: flowtable: Add IP6IP6 rx sw acceleration netfilter: Introduce tunnel metadata info in nf_flowtable_ctx struct netfilter: Add ctx pointer in nf_flow_skb_encap_protocol/nf_flow_ip4_tunnel_proto signature ==================== Link: https://patch.msgid.link/20260129105427.12494-1-fw@strlen.de Signed-off-by: Paolo Abeni commit 0921abdcbd1cbd6605ea425e85758bd4a19b9b32 Author: Ming Lei Date: Sat Jan 24 12:27:16 2026 +0800 ublk: document IO reference counting design Add comprehensive documentation for ublk's split reference counting model (io->ref + io->task_registered_buffers) above ublk_init_req_ref() given this model isn't very straightforward. Signed-off-by: Ming Lei Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit aa35dd5cbc060bc3e28ad22b1d76eefa3f024030 Author: Joanne Koong Date: Mon Jan 26 14:41:07 2026 -0800 iomap: fix invalid folio access after folio_end_read() If the folio does not have an iomap_folio_state (ifs) attached and the folio gets read in by the filesystem's IO helper, folio_end_read() will be called by the IO helper at any time. For this case, we cannot access the folio after dispatching it to the IO helper, eg subsequent accesses like if (ctx->cur_folio && offset_in_folio(ctx->cur_folio, iter->pos) == 0) { are incorrect. Fix these invalid accesses by invalidating ctx->cur_folio if all bytes of the folio have been read in by the IO helper. This allows us to also remove the +1 bias added for the ifs case. The bias was previously added to ensure that if all bytes are read in, the IO helper does not end the read on the folio until iomap has decremented the bias. Fixes: b2f35ac4146d ("iomap: add caller-provided callbacks for read and readahead") Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20260126224107.2182262-2-joannelkoong@gmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Christian Brauner commit fd5d8b65cfe76db197dce5fde184fd310fb4a26d Author: Chelsy Ratnawat Date: Wed Jan 28 06:31:50 2026 -0800 fs: dcache: fix typo in enum d_walk_ret comment Fix minor spelling and indentation errors in the documentation comments. Signed-off-by: Chelsy Ratnawat Link: https://patch.msgid.link/20260128143150.3674284-1-chelsyratnawat2001@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 76e9f683a53186775af1610b734b51383a17eb70 Merge: d4cfa05ac7f7fb b661d753ce2ee9 Author: Will Deacon Date: Thu Jan 29 12:05:49 2026 +0000 Merge branch 'for-next/selftests' into for-next/core * for-next/selftests: kselftest/arm64: Raise default number of loops in fp-pidbench kselftest/arm64: Add a no-SVE loop after SVE in fp-pidbench kselftest/arm64: Add missing file in .gitignore kselftest/arm64: Add HWCAP test for FEAT_LS64 kselftest/arm64: Use syscall() macro over nolibc my_syscall() kselftest/arm64: Support FORCE_TARGETS commit d4cfa05ac7f7fbd2d2a03beebef67ba596ca0520 Merge: c96f95bca1be4f ab26d9c85554c4 Author: Will Deacon Date: Thu Jan 29 12:05:45 2026 +0000 Merge branch 'for-next/perf' into for-next/core * for-next/perf: perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD perf/arm_dsu: Allow standard cycles events perf/arm_dsu: Support DSU-120 perf/arm_dsu: Support DSU-110 drivers: perf: use bitmap_empty() where appropriate perf/arm-cmn: Support CMN-600AE commit c96f95bca1be4f924b0433ed9e518c20c7c67de1 Merge: 2f8aed5e97fdde 53f45f045cbe89 Author: Will Deacon Date: Thu Jan 29 12:05:40 2026 +0000 Merge branch 'for-next/misc' into for-next/core * for-next/misc: arm64: mm: warn once for ioremap attempts on RAM mappings arm64: Disable branch profiling for all arm64 code arm64: kernel: initialize missing kexec_buf->random field arm64: simplify arch_uprobe_xol_was_trapped return commit 2f8aed5e97fdde7e295a8f0ff0d22a5f1d41b188 Merge: 3aa99d74c8495e 3fed7e0059f0af Author: Will Deacon Date: Thu Jan 29 12:05:33 2026 +0000 Merge branch 'for-next/errata' into for-next/core * for-next/errata: arm64: errata: Workaround for SI L1 downstream coherency issue commit 3aa99d74c8495e62516fb1f3e9b146c26a3206d3 Merge: c2581836ccfa85 a3386301667ed0 Author: Will Deacon Date: Thu Jan 29 12:05:30 2026 +0000 Merge branch 'for-next/entry' into for-next/core * for-next/entry: arm64/ptrace: Return early for ptrace_report_syscall_entry() error arm64/ptrace: Split report_syscall() arm64: Remove unused _TIF_WORK_MASK arm64: Avoid memcpy() for syscall_get_arguments() syscall.h: Remove unused SYSCALL_MAX_ARGS commit c2581836ccfa850b45c4e4e045a83d15563f2969 Merge: 86941154bc8398 747d5b6735caa0 Author: Will Deacon Date: Thu Jan 29 12:05:25 2026 +0000 Merge branch 'for-next/cpufreq' into for-next/core * for-next/cpufreq: arm64: topology: Do not warn on missing AMU in cpuhp_topology_online() arm64: topology: Handle AMU FIE setup on CPU hotplug cpufreq: Add new helper function returning cpufreq policy arm64: topology: Skip already covered CPUs when setting freq source commit 86941154bc8398d617b7a5c141fb545cad9ac4fc Merge: 3e42a4f5e0a1d9 1f3b950492db41 Author: Will Deacon Date: Thu Jan 29 12:05:19 2026 +0000 Merge branch 'for-next/cpufeature' into for-next/core * for-next/cpufeature: arm64: poe: fix stale POR_EL0 values for ptrace arm64: mte: Set TCMA1 whenever MTE is present in the kernel arm64: Add support for FEAT_{LS64, LS64_V} KVM: arm64: Enable FEAT_{LS64, LS64_V} in the supported guest arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 KVM: arm64: Handle DABT caused by LS64* instructions on unsupported memory KVM: arm64: Add documentation for KVM_EXIT_ARM_LDST64B KVM: arm64: Add exit to userspace on {LD,ST}64B* outside of memslots arm64: Unconditionally enable PAN support arm64: Unconditionally enable LSE support arm64: Add support for TSV110 Spectre-BHB mitigation commit 3e42a4f5e0a1d9d0f0ac3a7a9d1a889a2a830f12 Merge: 8f0b4cce4481fb f7d5e9e70302c0 Author: Will Deacon Date: Thu Jan 29 12:05:12 2026 +0000 Merge branch 'for-next/acpi' into for-next/core * for-next/acpi: ACPI: AGDI: Add interrupt signaling mode support MAINTAINERS: Update the maintainers for ARM64 ACPI commit da0a672268b34279aa999664860e6becc38f3f51 Author: Andy Shevchenko Date: Tue Jan 27 22:05:41 2026 +0100 spi: dw: Remove not-going-to-be-supported code for Baikal SoC As noticed in the discussion [1] the Baikal SoC and platforms are not going to be finalized, hence remove stale code. Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260127210541.4068379-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 1b65492f45c2ecb4590ccdf0fce35967531db2bf Merge: 1918a0d5746ec0 75fb63ae031211 Author: Arnd Bergmann Date: Thu Jan 29 11:25:29 2026 +0100 Merge tag 'v6.20-rockchip-drivers1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/drivers Two fixes for the default-settings code for the General-Register-Files, which sets system defaults for some settings like disabling the automatic jtag/sdmmc switching. One is a corrected register-offset and the other makes the code actually look for all matched GRF instances, which it didn't do before. * tag 'v6.20-rockchip-drivers1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: soc: rockchip: grf: Support multiple grf to be handled soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition Signed-off-by: Arnd Bergmann commit 1918a0d5746ec003e8f59c2ed77fb4d1611b9390 Merge: a393bda150789a a1a359e12a4226 Author: Arnd Bergmann Date: Thu Jan 29 11:23:06 2026 +0100 Merge tag 'mvebu-arm-6.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/drivers mvebu arm for 6.20 (part 1) Simplify Dove PMU OF child node iteration with scoped loops * tag 'mvebu-arm-6.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: soc: dove: pmu: Simplify with scoped for each OF child loop Signed-off-by: Arnd Bergmann commit 0a82d3d40716a4d71009fa89e9b218c360228abb Merge: 25ed1e98403c1d 53289af62b6681 Author: Arnd Bergmann Date: Thu Jan 29 11:13:45 2026 +0100 Merge tag 'ti-k3-dt-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device tree updates for v6.20 Generic Fixes/Cleanups: - Minor whitespace cleanup and lowercase hex formatting for consistency - Various DT schema warning fixes across multiple boards SoC Specific Features and Fixes: AM62P/J722S: - Add HSM M4F node for hardware security module support J784S4/J742S2/J721S2: - Add HSM M4F node for hardware security module support - Refactor watchdog instances for j784s4 - Move c71_3 node to appropriate order in device tree Board Specific Fixes: AM62: - phycore-som: Add bootphase tags to cpsw_mac_syscon and phy_gmii_sel AM62A: - phycore-som: Add bootphase tags to cpsw_mac_syscon and phy_gmii_sel AM62P: - Verdin: Fix SD regulator startup delay AM67A: - Kontron SA67: Fix CMA node and SD card regulator configuration AM69: - Aquila: Change main_spi0/2 chip select to GPIO mode - Aquila-clover: Change main_spi2 CS0 to GPIO mode - Aquila-dev/clover: Fix USB-C Sink PDO configuration * tag 'ti-k3-dt-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: dts: ti: k3-am67a-kontron-sa67-base: Fix SD card regulator arm64: dts: ti: k3-am67a-kontron-sa67-base: Fix CMA node arm64: dts: ti: k3-am62p-j722s-common-main: Add HSM M4F node arm64: dts: ti: k3-{j784s4-j742s2/j721s2}-mcu-wakeup: Add HSM M4F node arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order arm64: dts: ti: k3-am69-aquila-clover: Change main_spi2 CS0 to GPIO mode arm64: dts: ti: k3-am69-aquila: Change main_spi0/2 CS to GPIO mode arm64: dts: ti: Use lowercase hex arm64: dts: ti: Minor whitespace cleanup arm64: dts: ti: am62p-verdin: Fix SD regulator startup delay arm64: dts: ti: k3-am69-aquila-clover: Fix USB-C Sink PDO arm64: dts: ti: k3-am69-aquila-dev: Fix USB-C Sink PDO arm64: dts: ti: k3-am62(a)-phycore-som: Add bootphase tag to phy_gmii_sel arm64: dts: ti: k3-am62a-phycore-som: Add bootphase tag to cpsw_mac_syscon arm64: dts: ti: k3-am62-phycore-som: Add bootphase tag to cpsw_mac_syscon arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings arm64: dts: ti: k3-am642-phyboard-electra-x27-gpio1-spi1-uart3: Fix schema warnings arm64: dts: ti: k3-am642-phyboard-electra-peb-c-010: Fix icssg-prueth schema warning Signed-off-by: Arnd Bergmann commit 0ead3b72469e52ca02946b2e5b35fff38bfa061f Author: Shin Seong-jun Date: Sat Jan 24 00:04:32 2026 +0900 xfs: fix spacing style issues in xfs_alloc.c Fix checkpatch.pl errors regarding missing spaces around assignment operators in xfs_alloc_compute_diff() and xfs_alloc_fixup_trees(). Adhere to the Linux kernel coding style by ensuring spaces are placed around the assignment operator '='. Signed-off-by: Shin Seong-jun Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 7da4ebea8332e6b2fb15edc71e5443c15826af49 Author: Christoph Hellwig Date: Tue Jan 27 16:10:21 2026 +0100 xfs: remove xfs_zone_gc_space_available xfs_zone_gc_space_available only has one caller left, so fold it into that. Reorder the checks so that the cheaper scratch_available check is done first. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit c17a1c03493bee4e7882ac79a52b8150cb464e56 Author: Christoph Hellwig Date: Tue Jan 27 16:10:20 2026 +0100 xfs: use a seprate member to track space availabe in the GC scatch buffer When scratch_head wraps back to 0 and scratch_tail is also 0 because no I/O has completed yet, the ring buffer could be mistaken for empty. Fix this by introducing a separate scratch_available member in struct xfs_zone_gc_data. This actually ends up simplifying the code as well. Reported-by: Chris Mason Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit 8cdb04bd06c167461b357150b3ca46983eb70dc3 Author: Ilya Mamay Date: Sun Jan 25 21:09:56 2026 -0700 riscv: ptrace: return ENODATA for inactive vector extension Currently, ptrace returns EINVAL when the vector extension is supported but not yet activated for the traced process. This error code is not always appropriate since the ptrace arguments may be valid. Debug tools like gdbserver expect ENODATA when the requested register set is not active, e.g. see [1]. This expectation seems to be more appropriate, so modify the vector ptrace implementation to return: - EINVAL when V extension is not supported - ENODATA when V extension is supported but not active [1] https://github.com/bminor/binutils-gdb/blob/637f25e88675fa47e47f9cc5e2cf37384836b8a2/gdbserver/linux-low.cc#L5020 Signed-off-by: Ilya Mamay Signed-off-by: Sergey Matyukevich Reviewed-by: Andy Chiu Tested-by: Andy Chiu Link: https://patch.msgid.link/20251214163537.1054292-2-geomatsi@gmail.com Signed-off-by: Paul Walmsley commit d30c1683aaecb93d2ab95685dc4300a33d3cea7a Author: Deepak Gupta Date: Sun Jan 25 21:09:56 2026 -0700 kselftest/riscv: add kselftest for user mode CFI Add a kselftest for RISC-V control flow integrity implementation for user mode. There is not a lot going on in the kernel to enable landing pad for user mode. CFI selftests are intended to be compiled with a zicfilp and zicfiss enabled compiler. This kselftest simply checks if landing pads and shadow stacks for the process are enabled or not and executes ptrace selftests on CFI. The selftest then registers a SIGSEGV signal handler. Any control flow violations are reported as SIGSEGV with si_code = SEGV_CPERR. The test will fail on receiving any SEGV_CPERR. The shadow stack part has more changes in the kernel, and thus there are separate tests for that. - Exercise 'map_shadow_stack' syscall - 'fork' test to make sure COW works for shadow stack pages - gup tests Kernel uses FOLL_FORCE when access happens to memory via /proc//mem. Not breaking that for shadow stack. - signal test. Make sure signal delivery results in token creation on shadow stack and consumes (and verifies) token on sigreturn - shadow stack protection test. attempts to write using regular store instruction on shadow stack memory must result in access faults - ptrace test: adds landing pad violation, clears ELP and continues In case the toolchain doesn't support the CFI extension, the CFI kselftest won't be built. Test output =========== """ TAP version 13 1..5 This is to ensure shadow stack is indeed enabled and working This is to ensure shadow stack is indeed enabled and working ok 1 shstk fork test ok 2 map shadow stack syscall ok 3 shadow stack gup tests ok 4 shadow stack signal tests ok 5 memory protections of shadow stack memory """ Suggested-by: Charlie Jenkins Signed-off-by: Charlie Jenkins Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-28-b55691eacf4f@rivosinc.com [pjw@kernel.org: updated to apply; cleaned up patch description, code comments] Signed-off-by: Paul Walmsley commit c8350aa2ed7828175468696ae95f34a431342175 Author: Deepak Gupta Date: Sun Jan 25 21:09:56 2026 -0700 riscv: add documentation for shadow stack Add documentation on shadow stack for user mode on riscv and the kernel interfaces exposed for user tasks to enable it. Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-27-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up the documentation, patch description] Signed-off-by: Paul Walmsley commit f6eeb67b917238fe2295d27ef0c8fe2cab8de5b5 Author: Deepak Gupta Date: Sun Jan 25 21:09:56 2026 -0700 riscv: add documentation for landing pad / indirect branch tracking Add documentation on landing pad aka indirect branch tracking on riscv and the kernel interfaces exposed for user tasks to enable it. Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-26-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up the documentation] Signed-off-by: Paul Walmsley commit 22c1e263af2ac7dad3d2af258336318ee4c4a0ae Author: Deepak Gupta Date: Sun Jan 25 21:09:56 2026 -0700 riscv: create a Kconfig fragment for shadow stack and landing pad support This patch creates a Kconfig fragment for shadow stack support and landing pad instruction support. Shadow stack support and landing pad instruction support can be enabled by selecting 'CONFIG_RISCV_USER_CFI'. Selecting 'CONFIG_RISCV_USER_CFI' wires up the path to enumerate CPU support. If support exists, the kernel will support CPU-assisted user mode CFI. If CONFIG_RISCV_USER_CFI is selected, select 'ARCH_USES_HIGH_VMA_FLAGS', 'ARCH_HAS_USER_SHADOW_STACK' and 'DYNAMIC_SIGFRAME' for riscv. Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-25-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description, Kconfig text; added CONFIG_MMU exclusion] Signed-off-by: Paul Walmsley commit ccad8c1336b6511e3c7ca5c02f797b1fd2cf67e1 Author: Deepak Gupta Date: Sun Jan 25 21:09:56 2026 -0700 arch/riscv: add dual vdso creation logic and select vdso based on hw Shadow stack instructions are taken from the Zimop ISA extension, which is mandated on RVA23. Any userspace with shadow stack instructions in it will fault on hardware that doesn't have support for Zimop. Thus, a shadow stack-enabled userspace can't be run on hardware that doesn't support Zimop. It's not known how Linux userspace providers will respond to this kind of binary fragmentation. In order to keep kernel portable across different hardware, 'arch/riscv/kernel/vdso_cfi' is created which has Makefile logic to compile 'arch/riscv/kernel/vdso' sources with CFI flags, and 'arch/riscv/kernel/vdso.c' is modified to select the appropriate vdso depending on whether the underlying CPU implements the Zimop extension. Since the offset of vdso symbols will change due to having two different vdso binaries, there is added logic to include a new generated vdso offset header and dynamically select the offset (like for rt_sigreturn). Signed-off-by: Deepak Gupta Acked-by: Charles Mirabile Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-24-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description] Signed-off-by: Paul Walmsley commit 37f57bd3faeac92e898c3381355f4fd2b6a80901 Author: Jim Shu Date: Sun Jan 25 21:09:56 2026 -0700 arch/riscv: compile vdso with landing pad and shadow stack note User mode tasks compiled with Zicfilp may call indirectly into the vdso (like hwprobe indirect calls). Add support for compiling landing pads into the vdso. Landing pad instructions in the vdso will be no-ops for tasks which have not enabled landing pads. Furthermore, add support for the C sources of the vdso to be compiled with shadow stack and landing pads enabled as well. Landing pad and shadow stack instructions are emitted only when the VDSO_CFI cflags option is defined during compile. Signed-off-by: Jim Shu Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-23-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description, issues reported by checkpatch] Signed-off-by: Paul Walmsley commit 41213bf2ae6c936f51a79986b37f95da9ecbb970 Author: Deepak Gupta Date: Sun Jan 25 21:09:55 2026 -0700 riscv: enable kernel access to shadow stack memory via the FWFT SBI call The kernel has to perform shadow stack operations on the user shadow stack. During signal delivery and sigreturn, the shadow stack token must be created and validated respectively. Thus shadow stack access for the kernel must be enabled. In the future, when kernel shadow stacks are enabled, they must be enabled as early as possible for better coverage and to prevent any imbalance between the regular stack and the shadow stack. After 'relocate_enable_mmu' has completed, this is the earliest that it can be enabled. Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-22-b55691eacf4f@rivosinc.com [pjw@kernel.org: updated to apply; cleaned up commit message] Signed-off-by: Paul Walmsley commit c9b859c4d8f56c014b3d5fbd1bcfb916c34955a1 Author: Deepak Gupta Date: Sun Jan 25 21:09:55 2026 -0700 riscv: add kernel command line option to opt out of user CFI Add a kernel command line option to disable part or all of user CFI. User backward CFI and forward CFI can be controlled independently. The kernel command line parameter "riscv_nousercfi" can take the following values: - "all" : Disable forward and backward cfi both - "bcfi" : Disable backward cfi - "fcfi" : Disable forward cfi Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-21-b55691eacf4f@rivosinc.com [pjw@kernel.org: fixed warnings from checkpatch; cleaned up patch description, doc, printk text] Signed-off-by: Paul Walmsley commit 30c3099036a9544ec24e899abc8a81a7cc030f99 Author: Deepak Gupta Date: Sun Jan 25 21:09:55 2026 -0700 riscv/hwprobe: add zicfilp / zicfiss enumeration in hwprobe Add enumeration of the zicfilp and zicfiss extensions in the hwprobe syscall. Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-20-b55691eacf4f@rivosinc.com [pjw@kernel.org: updated to apply; extend into RISCV_HWPROBE_KEY_IMA_EXT_1; clean patch description] Signed-off-by: Paul Walmsley commit 462a94fb8ae8ba0d4d3901c7283b4af052ab8804 Author: Paul Walmsley Date: Sun Jan 25 21:09:55 2026 -0700 riscv: hwprobe: add support for RISCV_HWPROBE_KEY_IMA_EXT_1 We've run out of bits to describe RISC-V ISA extensions in our initial hwprobe key, RISCV_HWPROBE_KEY_IMA_EXT_0. So, let's add RISCV_HWPROBE_KEY_IMA_EXT_1, along with the framework to set the appropriate hwprobe tuple, and add testing for it. Based on a suggestion from Andrew Jones , also fix the documentation for RISCV_HWPROBE_KEY_IMA_EXT_0. Reviewed-by: Andrew Jones Signed-off-by: Paul Walmsley commit 2af7c9cf021c5dabe880b68e5cc22c618060d954 Author: Deepak Gupta Date: Sun Jan 25 21:09:55 2026 -0700 riscv/ptrace: expose riscv CFI status and state via ptrace and in core files Expose a new register type NT_RISCV_USER_CFI for risc-v CFI status and state. Intentionally, both landing pad and shadow stack status and state are rolled into the CFI state. Creating two different NT_RISCV_USER_XXX would not be useful and would waste a note type. Enabling, disabling and locking the CFI feature is not allowed via ptrace set interface. However, setting 'elp' state or setting shadow stack pointer are allowed via the ptrace set interface. It is expected that 'gdb' might need to fixup 'elp' state or 'shadow stack' pointer. Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-19-b55691eacf4f@rivosinc.com [pjw@kernel.org: updated to apply; cleaned patch description and comments; addressed checkpatch issues] Signed-off-by: Paul Walmsley commit 9d0e75e25e3be74828ffb7657992ce0f03352cc3 Author: Deepak Gupta Date: Sun Jan 25 21:09:55 2026 -0700 riscv/kernel: update __show_regs() to print shadow stack register Update __show_regs() to print the captured shadow stack pointer. On tasks where shadow stack is disabled, simply print 0. Signed-off-by: Deepak Gupta Reviewed-by: Alexandre Ghiti Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-18-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description] Signed-off-by: Paul Walmsley commit 66c9c713de597f9b40a319ebda4d3466ce2cdff0 Author: Deepak Gupta Date: Sun Jan 25 21:09:55 2026 -0700 riscv/signal: save and restore the shadow stack on a signal Save the shadow stack pointer in the sigcontext structure when delivering a signal. Restore the shadow stack pointer from sigcontext on sigreturn. As part of the save operation, the kernel uses the 'ssamoswap' instruction to save a snapshot of the current shadow stack on the shadow stack itself (this can be called a "save token"). During restore on sigreturn, the kernel retrieves the save token from the top of the shadow stack and validates it. This ensures that user mode can't arbitrarily pivot to any shadow stack address without having a token and thus provides a strong security assurance during the window between signal delivery and sigreturn. Use an ABI-compatible way of saving/restoring the shadow stack pointer into the signal stack. This follows the vector extension, where extra registers are placed in a form of extension header + extension body in the stack. The extension header indicates the size of the extra architectural states plus the size of header itself, and a magic identifier for the extension. Then, the extension body contains the new architectural states in the form defined by uapi. Signed-off-by: Andy Chiu Signed-off-by: Deepak Gupta Tested-by: Andreas Korb Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-17-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned patch description, code comments; resolved checkpatch warning] Signed-off-by: Paul Walmsley commit 9d42fc28fc178e5031eddc6f80df561fc586caf4 Author: Deepak Gupta Date: Sun Jan 25 21:09:54 2026 -0700 riscv/traps: Introduce software check exception and uprobe handling The Zicfiss and Zicfilp extensions introduce a new exception, the 'software check exception', in the privileged ISA, with cause code = 18. This patch implements support for software check exceptions. Additionally, the patch implements a CFI violation handler which checks the code in the xtval register. If xtval=2, the software check exception happened because of an indirect branch that didn't land on a 4 byte aligned PC or on a 'lpad' instruction, or the label value embedded in 'lpad' didn't match the label value set in the x7 register. If xtval=3, the software check exception happened due to a mismatch between the link register (x1 or x5) and the top of shadow stack (on execution of `sspopchk`). In case of a CFI violation, SIGSEGV is raised with code=SEGV_CPERR. SEGV_CPERR was introduced by the x86 shadow stack patches. To keep uprobes working, handle the uprobe event first before reporting the CFI violation in the software check exception handler. This is because, when the landing pad is activated, if the uprobe point is set at the lpad instruction at the beginning of a function, the system triggers a software check exception instead of an ebreak exception due to the exception priority. This would prevent uprobe from working. Reviewed-by: Zong Li Co-developed-by: Zong Li Signed-off-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-15-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up the patch description] Signed-off-by: Paul Walmsley commit 8a9e22d2ca5855263d6e3f83509eabf16d7b8a0a Author: Deepak Gupta Date: Sun Jan 25 21:09:54 2026 -0700 riscv: Implement indirect branch tracking prctls This patch adds a RISC-V implementation of the following prctls: PR_SET_INDIR_BR_LP_STATUS, PR_GET_INDIR_BR_LP_STATUS and PR_LOCK_INDIR_BR_LP_STATUS. Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-14-b55691eacf4f@rivosinc.com [pjw@kernel.org: clean up patch description] Signed-off-by: Paul Walmsley commit 5ca243f6e3c30b979a54a96b96df355dda2b4d0f Author: Deepak Gupta Date: Sun Jan 25 21:09:54 2026 -0700 prctl: add arch-agnostic prctl()s for indirect branch tracking Three architectures (x86, aarch64, riscv) have support for indirect branch tracking feature in a very similar fashion. On a very high level, indirect branch tracking is a CPU feature where CPU tracks branches which use a memory operand to transfer control. As part of this tracking, during an indirect branch, the CPU expects a landing pad instruction on the target PC, and if not found, the CPU raises some fault (architecture-dependent). x86 landing pad instr - 'ENDBRANCH' arch64 landing pad instr - 'BTI' riscv landing instr - 'lpad' Given that three major architectures have support for indirect branch tracking, this patch creates architecture-agnostic 'prctls' to allow userspace to control this feature. They are: - PR_GET_INDIR_BR_LP_STATUS: Get the current configured status for indirect branch tracking. - PR_SET_INDIR_BR_LP_STATUS: Set the configuration for indirect branch tracking. The following status options are allowed: - PR_INDIR_BR_LP_ENABLE: Enables indirect branch tracking on user thread. - PR_INDIR_BR_LP_DISABLE: Disables indirect branch tracking on user thread. - PR_LOCK_INDIR_BR_LP_STATUS: Locks configured status for indirect branch tracking for user thread. Reviewed-by: Mark Brown Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-13-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description, code comments] Signed-off-by: Paul Walmsley commit 61a0200211d31e20380c35d619960a40113da872 Author: Deepak Gupta Date: Sun Jan 25 21:09:54 2026 -0700 riscv: Implement arch-agnostic shadow stack prctls Implement an architecture-agnostic prctl() interface for setting and getting shadow stack status. The prctls implemented are PR_GET_SHADOW_STACK_STATUS, PR_SET_SHADOW_STACK_STATUS and PR_LOCK_SHADOW_STACK_STATUS. As part of PR_SET_SHADOW_STACK_STATUS/PR_GET_SHADOW_STACK_STATUS, only PR_SHADOW_STACK_ENABLE is implemented because RISCV allows each mode to write to their own shadow stack using 'sspush' or 'ssamoswap'. PR_LOCK_SHADOW_STACK_STATUS locks the current shadow stack enablement configuration. Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-12-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description] Signed-off-by: Paul Walmsley commit fd44a4a8551698757d0e7eeaa964735b471f7407 Author: Deepak Gupta Date: Sun Jan 25 21:09:54 2026 -0700 riscv/shstk: If needed allocate a new shadow stack on clone Userspace specifies CLONE_VM to share address space and spawn new thread. 'clone' allows userspace to specify a new stack for a new thread. However there is no way to specify a new shadow stack base address without changing the API. This patch allocates a new shadow stack whenever CLONE_VM is given. In case of CLONE_VFORK, the parent is suspended until the child finishes; thus the child can use the parent's shadow stack. In case of !CLONE_VM, COW kicks in because entire address space is copied from parent to child. 'clone3' is extensible and can provide mechanisms for specifying the shadow stack as an input parameter. This is not settled yet and is being extensively discussed on the mailing list. Once that's settled, this code should be adapted. Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-11-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description] Signed-off-by: Paul Walmsley commit 859b725579718ad1b66a81237df9d786f38679da Author: John Johansen Date: Wed Jan 21 01:09:11 2026 -0800 apparmor: cleanup remove unused percpu critical sections in buffer management There are two unused percpu critical sections in the buffer management code. These are remanents from when a more complex hold algorithm was used. Remove them, as they serve no purpose. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit 0b6a6b72b329c34a13a13908d5e8df9fb46eaa1f Author: John Johansen Date: Tue Jan 20 18:18:51 2026 -0800 apparmor: document the buffer hold, add an overflow guard The buffer hold is a measure of contention, but it is tracked per cpu where the lock is a globabl resource. On some systems (eg. real time) there is no guarantee that the code will be on the same cpu pre, and post spinlock acquisition, nor that the buffer will be put back to the same percpu cache when we are done with it. Because of this the hold value can move asynchronous to the buffers on the cache, meaning it is possible to underflow, and potentially in really pathelogical cases overflow. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit 640cf2f09575c9dc344b3f7be2498d31e3923ead Author: Zhengmian Hu Date: Mon Jan 19 19:03:07 2026 -0500 apparmor: avoid per-cpu hold underflow in aa_get_buffer When aa_get_buffer() pulls from the per-cpu list it unconditionally decrements cache->hold. If hold reaches 0 while count is still non-zero, the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a very long time, so aa_put_buffer() never returns buffers to the global list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max) allocations. Guard the decrement so hold never underflows. Fixes: ea9bae12d028 ("apparmor: cache buffers on percpu list if there is lock contention") Signed-off-by: Zhengmian Hu Signed-off-by: John Johansen commit 796c146fa6c8289afc9e18004c21bfe05c75a487 Author: John Johansen Date: Thu Dec 25 01:21:23 2025 -0800 apparmor: split xxx_in_ns into its two separate semantic use cases This patch doesn't change current functionality, it switches the two uses of the in_ns fns and macros into the two semantically different cases they are used for. xxx_in_scope for checking mediation interaction between profiles xxx_in_view to determine which profiles are visible.The scope will always be a subset of the view as profiles that can not see each other can not interact. The split can not be completely done for label_match because it has to distinct uses matching permission against label in scope, and checking if a transition to a profile is allowed. The transition to a profile can include profiles that are in view but not in scope, so retain this distinction as a parameter. While at the moment the two uses are very similar, in the future there will be additional differences. So make sure the semantics differences are present in the code. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit a4c9efa4dbad6dacad6e8b274e30e814c8353097 Author: John Johansen Date: Thu Nov 13 23:59:38 2025 -0800 apparmor: make label_match return a consistent value compound match is inconsistent in returning a state or an integer error this is problemati if the error is ever used as a state in the state machine Fixes: f1bd904175e81 ("apparmor: add the base fns() for domain labels") Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit b2e27be2948f2f8c38421cd554b5fc9383215648 Author: John Johansen Date: Fri Nov 14 00:14:36 2025 -0800 apparmor: remove apply_modes_to_perms from label_match The modes shouldn't be applied at the point of label match, it just results in them being applied multiple times. Instead they should be applied after which is already being done by all callers so it can just be dropped from label_match. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit 9f79b1cee91b3591a9b8fc0b3534ec966b8e463f Author: John Johansen Date: Sat Sep 13 20:49:11 2025 -0700 apparmor: fix fast path cache check for unix sockets The fast path cache check is incorrect forcing more slow path revalidations than necessary, because the unix logic check is inverted. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit 6ca56813f4a589f536adceb42882855d91fb1125 Author: John Johansen Date: Sun Nov 9 14:16:54 2025 -0800 apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and conditionally update the posix cpu timers when appropriate. Fixes: baa73d9e478ff ("posix-timers: Make them configurable") Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit acf2a94ac4734962742398bed0cde156baf48244 Author: John Johansen Date: Sat Nov 8 03:00:56 2025 -0800 apparmor: refactor/cleanup cred helper fns. aa_cred_raw_label() and cred_label() now do the same things so consolidate to cred_label() Document the crit section use and constraints better and refactor __begin_current_label_crit_section() into a base fn __begin_cred_crit_section() and a wrapper that calls the base with current cred. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit 1301b956190590ef7f64b321fd27c59907d9c271 Author: John Johansen Date: Sun Nov 2 01:36:57 2025 -0800 apparmor: fix label and profile debug macros The label and profile debug macros were not correctly pasting their var args. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit 4a134723f9f1ad2f3621566259db673350d19cb1 Author: John Johansen Date: Sat Sep 13 02:22:21 2025 -0700 apparmor: move check for aa_null file to cover all cases files with a dentry pointing aa_null.dentry where already rejected as part of file_inheritance. Unfortunately the check in common_file_perm() is insufficient to cover all cases causing unnecessary audit messages without the original files context. Eg. [ 442.886474] audit: type=1400 audit(1704822661.616:329): apparmor="DENIED" operation="file_inherit" class="file" namespace="root//lxd-juju-98527a-0_" profile="snap.lxd.activate" name="/apparmor/.null" pid=9525 comm="snap-exec" Further examples of this are in the logs of https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2120439 https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1952084 https://bugs.launchpad.net/snapd/+bug/2049099 These messages have no value and should not be sent to the logs. AppArmor was already filtering the out in some cases but the original patch did not catch all cases. Fix this by push the existing check down into two functions that should cover all cases. Link: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2122743 Fixes: 192ca6b55a86 ("apparmor: revalidate files during exec") Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit e16eee7895502bc3c07043169940b005d44bba8f Author: John Johansen Date: Sun Aug 3 22:07:52 2025 -0700 apparmor: guard against free routines being called with a NULL aa_free_data() and free_attachment() don't guard against having a NULL parameter passed to them. Fix this. Reviewed-by: Ryan Lee Signed-off-by: John Johansen commit 74b7105e53e80a4072bd3e1a50be7aa15e3f0a01 Author: Ryan Lee Date: Tue Jan 13 09:35:57 2026 -0800 apparmor: return -ENOMEM in unpack_perms_table upon alloc failure In policy_unpack.c:unpack_perms_table, the perms struct is allocated via kcalloc, with the position being reset if the allocation fails. However, the error path results in -EPROTO being retured instead of -ENOMEM. Fix this to return the correct error code. Reported-by: Zygmunt Krynicki Fixes: fd1b2b95a2117 ("apparmor: add the ability for policy to specify a permission table") Reviewed-by: Tyler Hicks Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit 9b829c0aa96e9385b1e9a308d3eb054b95fbeda2 Author: Ryan Lee Date: Wed Jan 7 11:47:02 2026 -0800 apparmor: account for in_atomic removal in common_file_perm If we are not in an atomic context in common_file_perm, then we don't have to use the atomic versions, resulting in improved performance outside of atomic contexts. Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit c3f27ccdb2dce3f0f2814574d06017f46c11fa29 Author: John Johansen Date: Sat Jan 17 23:40:03 2026 -0800 apparmor: drop in_atomic flag in common_mmap, and common_file_perm with the previous changes to mmap the in_atomic flag is now always false, so drop it. Suggested-by: Tyler Hicks Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit 48d5268e911abcf7674ec33c9b0b3e952be1175e Author: Ryan Lee Date: Wed Jan 7 11:48:54 2026 -0800 apparmor: fix boolean argument in apparmor_mmap_file The previous value of GFP_ATOMIC is an int and not a bool, potentially resulting in UB when being assigned to a bool. In addition, the mmap hook is called outside of locks (i.e. in a non-atomic context), so we can pass a fixed constant value of false instead to common_mmap. Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit 8d34e16f7f2b51f880957f2caadaae731ee28867 Author: Maxime Bélair Date: Mon Jul 21 16:46:44 2025 +0200 apparmor: userns: Add support for execpath in userns This new field allows reliable identification of the binary that triggered a denial since the existing field (comm) only gives the name of the binary, not its path. Thus comm doesn't work for binaries outside of $PATH or works unreliably when two binaries have the same name. Additionally comm can be modified by a program, for example, comm="(tor)" or comm=4143504920506F6C6C6572 (= ACPI Poller). Signed-off-by: Maxime Bélair Signed-off-by: John Johansen commit 3d28e2397af7a89ac3de33c686ed404cda59b5d5 Author: John Johansen Date: Tue Apr 1 15:51:41 2025 -0700 apparmor: add support loading per permission tagging Add support for the per permission tag index for a given permission set. This will be used by both meta-data tagging, to allow annotating accept states with context and debug information. As well as by rule tainting and triggers to specify the taint or trigger to be applied. Since these are low frequency ancillary data items they are stored in a tighter packed format to that allows for sharing and reuse of the strings between permissions and accept states. Reducing the amount of kernel memory use at the cost of having to go through a couple if index based indirections. The tags are just strings that has no meaning with out context. When used as meta-data for auditing and debugging its entirely information for userspace, but triggers, and tainting can be used to affect the domain. However they all exist in the same packed data set and can be shared between different uses. Signed-off-by: John Johansen commit a393bda150789ac81dd701d90c13ac19546abac5 Merge: 5b303a02072805 938ce3b1658265 Author: Arnd Bergmann Date: Thu Jan 29 10:24:16 2026 +0100 Merge tag 'reset-for-v6.20' of https://git.pengutronix.de/git/pza/linux into soc/drivers Reset controller updates for v6.20 * Add a compatible to the reset-gpio driver, suppress the sysfs bind attributes, and propagate GPIO API errors. * Add support for the i.MX8ULP SIM LPAV reset controller. * Add RZ/G3S USBPHY suspend/resume support. * Enable reset-k230 by default on ARCH_CANAAN * Add support for the SpacemiT K3 SoC reset controller. * Merge the 'spacemit-clkrst-v6.20-3' tag, shared with the clk tree, as a dependency for the SpacemiT changes. * tag 'reset-for-v6.20' of https://git.pengutronix.de/git/pza/linux: reset: spacemit: Add SpacemiT K3 reset driver reset: spacemit: Extract common K1 reset code reset: Create subdirectory for SpacemiT drivers dt-bindings: soc: spacemit: Add K3 reset support and IDs reset: canaan: k230: drop OF dependency and enable by default reset: rzg2l-usbphy-ctrl: Add suspend/resume support reset: rzg2l-usbphy-ctrl: Propagate the return value of regmap_field_update_bits() reset: gpio: check the return value of gpiod_set_value_cansleep() reset: imx8mp-audiomix: Support i.MX8ULP SIM LPAV reset: imx8mp-audiomix: Extend the driver usage reset: imx8mp-audiomix: Switch to using regmap API reset: imx8mp-audiomix: Drop unneeded macros reset: gpio: suppress bind attributes in sysfs clk: spacemit: k3: extract common header reset: spacemit: fix auxiliary device id clk: spacemit: prepare common ccu header reset: gpio: add the "compatible" property Signed-off-by: Arnd Bergmann commit c70772afd5cc93c28f83b53d33ce9fbcd8d015da Author: Deepak Gupta Date: Sun Jan 25 21:09:54 2026 -0700 riscv/mm: Implement map_shadow_stack() syscall As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for shadow stack memory since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. This patch implements this syscall for riscv. riscv doesn't require tokens to be setup by kernel because user mode can do that by itself. However to provide compatibility and portability with other architectues, user mode can specify token set flag. Signed-off-by: Deepak Gupta Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-10-b55691eacf4f@rivosinc.com Link: https://lore.kernel.org/linux-riscv/aXfRPJvoSsOW8AwM@debug.ba.rivosinc.com/ [pjw@kernel.org: added allocate_shadow_stack() fix per Deepak; fixed bug found by sparse] Signed-off-by: Paul Walmsley commit 5b303a02072805978544616a76d7e8fe15c41737 Merge: 8536b26e607866 9805f2cfc88301 Author: Arnd Bergmann Date: Thu Jan 29 10:13:55 2026 +0100 Merge tag 'memory-controller-drv-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers Memory controller drivers for v6.20 1. Mediatek SMI: Fix old struct device reference leaks during error paths and device unbinding. 2. Memory Devicetree bindings: refactor existing LPDDR bindings and add bindings for DDR4 SDRAM. These will be used for example in stm32mp257f-ev1 DTS. * tag 'memory-controller-drv-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: dt-bindings: memory: SDRAM channel: standardise node name dt-bindings: memory: add DDR4 channel compatible dt-bindings: memory: factorise LPDDR channel binding into SDRAM channel dt-bindings: memory: introduce DDR4 dt-bindings: memory: factorise LPDDR props into SDRAM props memory: mtk-smi: clean up device link creation memory: mtk-smi: fix device leak on larb probe memory: mtk-smi: fix device leaks on common probe Signed-off-by: Arnd Bergmann commit 8536b26e607866430a23c56e304cbf4abf57d50d Merge: 582ead4abe03e7 31fce0d2b13e6a Author: Arnd Bergmann Date: Thu Jan 29 10:13:23 2026 +0100 Merge tag 'amlogic-drivers-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/drivers Amlogic Drivers for v6.20: - add new SoC id for S905Y4 * tag 'amlogic-drivers-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: soc: amlogic: meson-gx-socinfo: add new SoC id for S905Y4 Signed-off-by: Arnd Bergmann commit 582ead4abe03e7805c3750b3998f7659a53a1b7f Merge: 35a53670ea20fa 3bd4edd67b034f Author: Arnd Bergmann Date: Thu Jan 29 10:11:41 2026 +0100 Merge tag 'omap-for-v6.20/drivers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/drivers drivers: bus & hwsplinlock updates for OMAP * tag 'omap-for-v6.20/drivers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: hwspinlock: omap: Handle devm_pm_runtime_enable() errors bus: omap-ocp2scp: enable compile testing bus: omap-ocp2scp: fix OF populate on driver rebind Signed-off-by: Arnd Bergmann commit 40fd0acc45d06709b3b1eea77e50e13f4145dff0 Author: Vlastimil Babka Date: Thu Jan 29 10:07:57 2026 +0100 slub: avoid list_lock contention from __refill_objects_any() Kernel test robot has reported a regression in the patch "slab: refill sheaves from all nodes". When taken in isolation like this, there is indeed a tradeoff - we prefer to use remote objects prior to allocating new local slabs. It is replicating a behavior that existed before sheaves for replenishing cpu (partial) slabs - now called get_from_any_partial() to allocate a single object. So the possibility of allocating remote objects is intended even if remote accesses are then slower. But the profiles in the report also suggested a contention on the list_lock spinlock. And that's something we can try to avoid without much tradeoff - if someone else has the spin_lock, it's more likely they are allocating from the node than freeing to it, so we can skip it even if it means allocating a new local slab - contributing to that lock's contention isn't worth it. It should not result in partial slabs accumulating on the remote node. Thus add an allow_spin parameter to __refill_objects_node() and get_partial_node_bulk() to make the attempts from __refill_objects_any() use only a trylock. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202601132136.77efd6d7-lkp@intel.com Link: https://patch.msgid.link/20260129-b4-refill_any_trylock-v1-1-de7420b25840@suse.cz Signed-off-by: Vlastimil Babka commit 35a53670ea20fafbc109cb3b149373f1bda1a25d Merge: b04d336f04cb2c 22ce09ce1af574 Author: Arnd Bergmann Date: Thu Jan 29 10:09:19 2026 +0100 Merge tag 'mtk-soc-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers MediaTek soc driver updates This adds: - A socinfo entry for the MT8371 Genio 520 SoC - Support for the Dynamic Voltage and Frequency Scaling Resource Controller (DVFSRC) version 4, found in the new MediaTek Kompanio Ultra (MT8196) SoC - Initial support for the CMDQ mailbox found in the MT8196. - A memory leak fix in the MediaTek SVS driver's debug ops. * tag 'mtk-soc-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: soc: mediatek: mtk-cmdq: Add mminfra_offset adjustment for DRAM addresses soc: mediatek: mtk-cmdq: Extend cmdq_pkt_write API for SoCs without subsys ID soc: mediatek: mtk-cmdq: Add pa_base parsing for hardware without subsys ID support soc: mediatek: mtk-cmdq: Add cmdq_get_mbox_priv() in cmdq_pkt_create() mailbox: mtk-cmdq: Add driver data to support for MT8196 mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction mailbox: mtk-cmdq: Add GCE hardware virtualization configuration mailbox: mtk-cmdq: Add cmdq private data to cmdq_pkt for generating instruction soc: mediatek: mtk-dvfsrc: Rework bandwidth calculations soc: mediatek: mtk-dvfsrc: Get and Enable DVFSRC clock soc: mediatek: mtk-dvfsrc: Add support for DVFSRCv4 and MT8196 soc: mediatek: mtk-dvfsrc: Write bandwidth to EMI DDR if present soc: mediatek: mtk-dvfsrc: Add a new callback for calc_dram_bw soc: mediatek: mtk-dvfsrc: Add and propagate DVFSRC bandwidth type soc: mediatek: mtk-dvfsrc: Change error check for DVFSRCv4 START cmd dt-bindings: soc: mediatek: dvfsrc: Document clock soc: mediatek: mtk-socinfo: Add entry for MT8371AV/AZA Genio 520 soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() Signed-off-by: Arnd Bergmann commit 53e8441bfcbce064dcd6e0122e271fdd5f340419 Merge: 9396bfdacb5aa2 9cf8ddb12a728a Author: Christian Brauner Date: Thu Jan 29 10:07:17 2026 +0100 Merge patch series "name_is_dot* cleanup" Amir Goldstein says: Following the syzbot ovl bug report and a fix by Qing Wang, I decided to follow up with a small vfs cleanup of some open coded version of checking "." and ".." name in readdir. The fix patch is applied at the start of this cleanup series to allow for easy backporting, but it is not an urgent fix so I don't think there is a need to fast track it. * patches from https://patch.msgid.link/20260128132406.23768-1-amir73il@gmail.com: ovl: use name_is_dot* helpers in readdir code fs: add helpers name_is_dot{,dot,_dotdot} ovl: Fix uninit-value in ovl_fill_real Link: https://patch.msgid.link/20260128132406.23768-1-amir73il@gmail.com Signed-off-by: Christian Brauner commit 9cf8ddb12a728a5b9d814dc2c12dfc0959539f9c Author: Amir Goldstein Date: Wed Jan 28 14:24:06 2026 +0100 ovl: use name_is_dot* helpers in readdir code Use the helpers in place of all the different open coded variants. This makes the code more readable and robust. Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/20260128132406.23768-4-amir73il@gmail.com Reviewed-by: Eric Biggers Signed-off-by: Christian Brauner commit b04d336f04cb2ce6663dee6368d5cebf6045e06c Merge: 733f0303c2a728 ba99035bf16ef0 Author: Arnd Bergmann Date: Thu Jan 29 10:08:29 2026 +0100 Merge tag 'apple-soc-drivers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/drivers Apple SoC driver updates for 6.20 - Add a poweroff function to the RTKit library which will be required for the first USB4/Thunderbolt series I hope to submit next cycle. * tag 'apple-soc-drivers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: soc: apple: rtkit: Add function to poweroff Signed-off-by: Arnd Bergmann commit 55fb177d3a0346106974749374ae2191ba250825 Author: Amir Goldstein Date: Wed Jan 28 14:24:05 2026 +0100 fs: add helpers name_is_dot{,dot,_dotdot} Rename the helper is_dot_dotdot() into the name_ namespace and add complementary helpers to check for dot and dotdot names individually. Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/20260128132406.23768-3-amir73il@gmail.com Reviewed-by: Eric Biggers Signed-off-by: Christian Brauner commit 1992330d90dd766fcf1730fd7bf2d6af65370ac4 Author: Qing Wang Date: Wed Jan 28 14:24:04 2026 +0100 ovl: Fix uninit-value in ovl_fill_real Syzbot reported a KMSAN uninit-value issue in ovl_fill_real. This iusse's call chain is: __do_sys_getdents64() -> iterate_dir() ... -> ext4_readdir() -> fscrypt_fname_alloc_buffer() // alloc -> fscrypt_fname_disk_to_usr // write without tail '\0' -> dir_emit() -> ovl_fill_real() // read by strcmp() The string is used to store the decrypted directory entry name for an encrypted inode. As shown in the call chain, fscrypt_fname_disk_to_usr() write it without null-terminate. However, ovl_fill_real() uses strcmp() to compare the name against "..", which assumes a null-terminated string and may trigger a KMSAN uninit-value warning when the buffer tail contains uninit data. Reported-by: syzbot+d130f98b2c265fae5297@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d130f98b2c265fae5297 Fixes: 4edb83bb1041 ("ovl: constant d_ino for non-merge dirs") Signed-off-by: Qing Wang Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/20260128132406.23768-2-amir73il@gmail.com Acked-by: Miklos Szeredi Reviewed-by: Eric Biggers Signed-off-by: Christian Brauner commit 16868b35b915a8a0fc810cd14b3b4927a5fb2213 Merge: 0294324427490e dc717e24deb4e6 Author: Arnd Bergmann Date: Thu Jan 29 10:06:54 2026 +0100 Merge tag 'omap-for-v6.20/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm ARM: omap: soc updates for v6.20 * tag 'omap-for-v6.20/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: omap1: drop unused Kconfig symbol ARM: omap2: Fix reference count leaks in omap_control_init() Signed-off-by: Arnd Bergmann commit 0294324427490ea8b715270baef6ffee76496b6c Merge: f8f9c1f4d0c7a6 0b0f7e6539a750 Author: Arnd Bergmann Date: Thu Jan 29 10:03:43 2026 +0100 Merge tag 'at91-soc-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/arm Microchip AT91 SoC updates for v6.20 This update includes: - drop the use of of_platform_default_populate() from the machine specific code, as it is already handled by the DT core * tag 'at91-soc-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: at91: remove unnecessary of_platform_default_populate calls ARM: at91: Move PM init functions to .init_late hook Signed-off-by: Arnd Bergmann commit e19079adcd26a25d7d3e586b1837493361fdf8b6 Author: Scott Mitchell Date: Fri Jan 23 14:09:30 2026 -0800 netfilter: nfnetlink_queue: optimize verdict lookup with hash table The current implementation uses a linear list to find queued packets by ID when processing verdicts from userspace. With large queue depths and out-of-order verdicting, this O(n) lookup becomes a significant bottleneck, causing userspace verdict processing to dominate CPU time. Replace the linear search with a hash table for O(1) average-case packet lookup by ID. A global rhashtable spanning all network namespaces attributes hash bucket memory to kernel but is subject to fixed upper bound. Signed-off-by: Scott Mitchell Signed-off-by: Florian Westphal commit 77fd1b4c6e084619beff1a55cb66e65c6a66615c Author: Jinjie Ruan Date: Fri Jan 23 16:10:51 2026 +0800 netfilter: xt_time: use is_leap_year() helper Use the is_leap_year() helper from rtc.h instead of writing it by hand Signed-off-by: Jinjie Ruan Reviewed-by: Simon Horman Signed-off-by: Florian Westphal commit 5e51803521938566bdf099501379a9bdbacb6066 Author: Lorenzo Bianconi Date: Thu Jan 22 18:46:17 2026 +0100 selftests: netfilter: nft_flowtable.sh: Add IP6IP6 flowtable selftest Similar to IPIP, introduce specific selftest for IP6IP6 flowtable SW acceleration in nft_flowtable.sh Signed-off-by: Lorenzo Bianconi Signed-off-by: Florian Westphal commit 93cf357fa797c867b05d7ee2e893608b65d982c1 Author: Lorenzo Bianconi Date: Thu Jan 22 18:46:16 2026 +0100 netfilter: flowtable: Add IP6IP6 tx sw acceleration Introduce sw acceleration for tx path of IP6IP6 tunnels relying on the netfilter flowtable infrastructure. IP6IP6 tx sw acceleration can be tested running the following scenario where the traffic is forwarded between two NICs (eth0 and eth1) and an IP6IP6 tunnel is used to access a remote site (using eth1 as the underlay device): ETH0 -- TUN0 <==> ETH1 -- [IP network] -- TUN1 (2001:db8:3::2) $ip addr show 6: eth0: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:00:22:33:11:55 brd ff:ff:ff:ff:ff:ff inet6 2001:db8:1::2/64 scope global nodad valid_lft forever preferred_lft forever 7: eth1: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:11:22:33:11:55 brd ff:ff:ff:ff:ff:ff inet6 2001:db8:2::1/64 scope global nodad valid_lft forever preferred_lft forever 8: tun0@NONE: mtu 1480 qdisc noqueue state UNKNOWN group default qlen 1000 link/tunnel6 2001:db8:2::1 peer 2001:db8:2::2 permaddr ce9c:2940:7dcc:: inet6 2002:db8:1::1/64 scope global nodad valid_lft forever preferred_lft forever $ip -6 route show 2001:db8:1::/64 dev eth0 proto kernel metric 256 pref medium 2001:db8:2::/64 dev eth1 proto kernel metric 256 pref medium 2002:db8:1::/64 dev tun0 proto kernel metric 256 pref medium default via 2002:db8:1::2 dev tun0 metric 1024 pref medium $nft list ruleset table inet filter { flowtable ft { hook ingress priority filter devices = { eth0, eth1 } } chain forward { type filter hook forward priority filter; policy accept; meta l4proto { tcp, udp } flow add @ft } } Reproducing the scenario described above using veths I got the following results: - TCP stream received from the IPIP tunnel: - net-next: (baseline) ~93Gbps - net-next + IP6IP6 flowtbale support: ~98Gbps Signed-off-by: Lorenzo Bianconi Signed-off-by: Florian Westphal commit d98103575dcdd3a730e0901ab457791a9ac6930c Author: Lorenzo Bianconi Date: Thu Jan 22 18:46:15 2026 +0100 netfilter: flowtable: Add IP6IP6 rx sw acceleration Introduce sw acceleration for rx path of IP6IP6 tunnels relying on the netfilter flowtable infrastructure. Subsequent patches will add sw acceleration for IP6IP6 tunnels tx path. IP6IP6 rx sw acceleration can be tested running the following scenario where the traffic is forwarded between two NICs (eth0 and eth1) and an IP6IP6 tunnel is used to access a remote site (using eth1 as the underlay device): ETH0 -- TUN0 <==> ETH1 -- [IP network] -- TUN1 (2001:db8:3::2) $ip addr show 6: eth0: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:00:22:33:11:55 brd ff:ff:ff:ff:ff:ff inet6 2001:db8:1::2/64 scope global nodad valid_lft forever preferred_lft forever 7: eth1: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:11:22:33:11:55 brd ff:ff:ff:ff:ff:ff inet6 2001:db8:2::1/64 scope global nodad valid_lft forever preferred_lft forever 8: tun0@NONE: mtu 1480 qdisc noqueue state UNKNOWN group default qlen 1000 link/tunnel6 2001:db8:2::1 peer 2001:db8:2::2 permaddr ce9c:2940:7dcc:: inet6 2002:db8:1::1/64 scope global nodad valid_lft forever preferred_lft forever $ip -6 route show 2001:db8:1::/64 dev eth0 proto kernel metric 256 pref medium 2001:db8:2::/64 dev eth1 proto kernel metric 256 pref medium 2002:db8:1::/64 dev tun0 proto kernel metric 256 pref medium default via 2002:db8:1::2 dev tun0 metric 1024 pref medium $nft list ruleset table inet filter { flowtable ft { hook ingress priority filter devices = { eth0, eth1 } } chain forward { type filter hook forward priority filter; policy accept; meta l4proto { tcp, udp } flow add @ft } } Reproducing the scenario described above using veths I got the following results: - TCP stream received from the IPIP tunnel: - net-next: (baseline) ~ 81Gbps - net-next + IP6IP6 flowtbale support: ~112Gbps Signed-off-by: Lorenzo Bianconi Signed-off-by: Florian Westphal commit c64436daf675a368f3d850b2fad26e2a654f43d1 Author: Lorenzo Bianconi Date: Thu Jan 22 18:46:14 2026 +0100 netfilter: Introduce tunnel metadata info in nf_flowtable_ctx struct Add tunnel hdr_size and tunnel proto fields in nf_flowtable_ctx struct in order to store IP tunnel header size and protocol used during IPIP and IP6IP6 tunnel sw offloading decapsulation and avoid recomputing them during tunnel header pop since this is constant for IPv6. Signed-off-by: Lorenzo Bianconi Signed-off-by: Florian Westphal commit baa501b12a484818631b154adb854d976b447b23 Author: Lorenzo Bianconi Date: Thu Jan 22 18:46:13 2026 +0100 netfilter: Add ctx pointer in nf_flow_skb_encap_protocol/nf_flow_ip4_tunnel_proto signature Rely on nf_flowtable_ctx struct pointer in nf_flow_ip4_tunnel_proto and nf_flow_skb_encap_protocol routine signature. This is a preliminary patch to introduce IP6IP6 flowtable acceleration since nf_flowtable_ctx will be used to store IP6IP6 tunnel info. Signed-off-by: Lorenzo Bianconi Signed-off-by: Florian Westphal commit 6f3f1d83e511c8dbf36021805070caf08498641e Merge: 574dc9ae4fefac 81841b41a8bcd0 Author: Arnd Bergmann Date: Thu Jan 29 09:31:18 2026 +0100 Merge tag 'mtk-defconfig-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/defconfig MediaTek defconfig updates This adds a single change, enabling to compile the MediaTek HDMIv2 driver as module. * tag 'mtk-defconfig-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: arm64: defconfig: Enable Mediatek HDMIv2 driver Signed-off-by: Arnd Bergmann commit af9b4a56f0000fb11057e204ddfb05d72ba4dba0 Author: Prathamesh Shete Date: Wed Jan 28 08:51:13 2026 +0000 gpio: tegra186: Add support for Tegra264 Extend the existing Tegra186 GPIO controller driver with support for the GPIO controller found on Tegra264. Use the "wakeup-parent" phandle from the GPIO device tree node to ensure the GPIO driver associates with the intended PMC device. Relying only on compatible-based lookup can select an unexpected PMC node, so fall back to compatible-based lookup when the phandle is not present. Signed-off-by: Prathamesh Shete Reviewed-by: Jon Hunter Acked-by: Thierry Reding Link: https://patch.msgid.link/20260128085114.1137725-2-pshete@nvidia.com Signed-off-by: Bartosz Golaszewski commit b565717e1d50078b8f13f3f796e707d24a6f3fdc Author: Prathamesh Shete Date: Wed Jan 28 08:51:12 2026 +0000 dt-bindings: gpio: Add Tegra264 support Extend the existing Tegra186 GPIO controller device tree bindings with support for the GPIO controller found on Tegra264. The number of pins is slightly different, but the programming model remains the same. Add a new header, include/dt-bindings/gpio/nvidia,tegra264-gpio.h, that defines port IDs as well as the TEGRA264_MAIN_GPIO() helper, both of which are used in conjunction to create a unique specifier for each pin. On Tegra, GPIO wake events are latched and routed via the PMC. Document the standard DT property, wakeup-parent, which is a phandle to the PMC interrupt controller that provides the parent wake interrupt domain for the GPIO controller. If the property is absent the driver falls back to a compatible-based lookup. Signed-off-by: Prathamesh Shete Acked-by: Thierry Reding Acked-by: Conor Dooley Link: https://patch.msgid.link/20260128085114.1137725-1-pshete@nvidia.com [Bartosz: fixed whitespace errors] Signed-off-by: Bartosz Golaszewski commit 6f1912181ddfcf851a6670b4fa9c7dfdaf3ed46d Author: Vlastimil Babka Date: Fri Jan 23 07:53:00 2026 +0100 mm/slub: cleanup and repurpose some stat items A number of stat items related to cpu slabs became unused, remove them. Two of those were ALLOC_FASTPATH and FREE_FASTPATH. But instead of removing those, use them instead of ALLOC_PCS and FREE_PCS, since sheaves are the new (and only) fastpaths, Remove the recently added _PCS variants instead. Change where FREE_SLOWPATH is counted so that it only counts freeing of objects by slab users that (for whatever reason) do not go to a percpu sheaf, and not all (including internal) callers of __slab_free(). Thus sheaf flushing (already counted by SHEAF_FLUSH) does not affect FREE_SLOWPATH anymore. This matches how ALLOC_SLOWPATH doesn't count sheaf refills (counted by SHEAF_REFILL). Reviewed-by: Hao Li Signed-off-by: Vlastimil Babka commit 574dc9ae4fefac2c2ea6ef1919810d4832ee9dcd Author: Yixun Lan Date: Wed Jan 28 19:57:42 2026 +0000 riscv: defconfig: spacemit: k3: enable clock support Enable the clock driver support for SpacemiT K3 SoC, configure it as built-in by default, but users should be able to change it as kernel module if needed. Signed-off-by: Yixun Lan Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20260128-sitter-crazily-184c1a7606db@spud Signed-off-by: Arnd Bergmann commit fb016a5ec70ea9c734bde73ef9e3e82e201f5ab5 Author: Vlastimil Babka Date: Fri Jan 23 07:52:59 2026 +0100 mm/slub: remove DEACTIVATE_TO_* stat items The cpu slabs and their deactivations were removed, so remove the unused stat items. Weirdly enough the values were also used to control __add_partial() adding to head or tail of the list, so replace that with a new enum add_mode, which is cleaner. Reviewed-by: Suren Baghdasaryan Reviewed-by: Hao Li Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit b16af1c81277dceb96812305b471296af9adf5d0 Author: Vlastimil Babka Date: Fri Jan 23 07:52:58 2026 +0100 slab: remove frozen slab checks from __slab_free() Currently slabs are only frozen after consistency checks failed. This can happen only in caches with debugging enabled, and those use free_to_partial_list() for freeing. The non-debug operation of __slab_free() can thus stop considering the frozen field, and we can remove the FREE_FROZEN stat. Reviewed-by: Suren Baghdasaryan Reviewed-by: Hao Li Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 0f7075bea8da3b01898712cfec49dd9a2f09be2f Author: Vlastimil Babka Date: Fri Jan 23 07:52:57 2026 +0100 slab: update overview comments The changes related to sheaves made the description of locking and other details outdated. Update it to reflect current state. Also add a new copyright line due to major changes. Reviewed-by: Suren Baghdasaryan Reviewed-by: Hao Li Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 46dea1744498a5b8864e21d0b769fd072a4e64bc Author: Vlastimil Babka Date: Fri Jan 23 07:52:56 2026 +0100 slab: refill sheaves from all nodes __refill_objects() currently only attempts to get partial slabs from the local node and then allocates new slab(s). Expand it to trying also other nodes while observing the remote node defrag ratio, similarly to get_any_partial(). This will prevent allocating new slabs on a node while other nodes have many free slabs. It does mean sheaves will contain non-local objects in that case. Allocations that care about specific node will still be served appropriately, but might get a slowpath allocation. Like get_any_partial() we do observe cpuset_zone_allowed(), although we might be refilling a sheaf that will be then used from a different allocation context. We can also use the resulting refill_objects() in __kmem_cache_alloc_bulk() for non-debug caches. This means kmem_cache_alloc_bulk() will get better performance when sheaves are exhausted. kmem_cache_alloc_bulk() cannot indicate a preferred node so it's compatible with sheaves refill in preferring the local node. Its users also have gfp flags that allow spinning, so document that as a requirement. Reviewed-by: Suren Baghdasaryan Reviewed-by: Hao Li Signed-off-by: Vlastimil Babka commit 6c2f307f30edbe2b18a35584f01854a27e375927 Author: Vlastimil Babka Date: Fri Jan 23 07:52:55 2026 +0100 slab: remove unused PREEMPT_RT specific macros The macros slub_get_cpu_ptr()/slub_put_cpu_ptr() are now unused, remove them. USE_LOCKLESS_FAST_PATH() has lost its true meaning with the code being removed. The only remaining usage is in fact testing whether we can assert irqs disabled, because spin_lock_irqsave() only does that on !RT. Test for CONFIG_PREEMPT_RT instead. Reviewed-by: Hao Li Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 32c894c7274b7ce901041ce6dceeca3ec1152205 Author: Vlastimil Babka Date: Fri Jan 23 07:52:54 2026 +0100 slab: remove struct kmem_cache_cpu The cpu slab is not used anymore for allocation or freeing, the remaining code is for flushing, but it's effectively dead. Remove the whole struct kmem_cache_cpu, the flushing code and other orphaned functions. The remaining used field of kmem_cache_cpu is the stat array with CONFIG_SLUB_STATS. Put it instead in a new struct kmem_cache_stats. In struct kmem_cache, the field is cpu_stats and placed near the end of the struct. Reviewed-by: Hao Li Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 073d5f156292201f1e49263a62dfa182eeee273f Author: Vlastimil Babka Date: Fri Jan 23 07:52:53 2026 +0100 slab: simplify kmalloc_nolock() The kmalloc_nolock() implementation has several complications and restrictions due to SLUB's cpu slab locking, lockless fastpath and PREEMPT_RT differences. With cpu slab usage removed, we can simplify things: - relax the PREEMPT_RT context checks as they were before commit 99a3e3a1cfc9 ("slab: fix kmalloc_nolock() context check for PREEMPT_RT") and also reference the explanation comment in the page allocator - the local_lock_cpu_slab() macros became unused, remove them - we no longer need to set up lockdep classes on PREEMPT_RT - we no longer need to annotate ___slab_alloc as NOKPROBE_SYMBOL since there's no lockless cpu freelist manipulation anymore - __slab_alloc_node() can be called from kmalloc_nolock_noprof() unconditionally. It can also no longer return EBUSY. But trylock failures can still happen so retry with the larger bucket if the allocation fails for any reason. Note that we still need __CMPXCHG_DOUBLE, because while it was removed we don't use cmpxchg16b on cpu freelist anymore, we still use it on slab freelist, and the alternative is slab_lock() which can be interrupted by a nmi. Clarify the comment to mention it specifically. Acked-by: Alexei Starovoitov Reviewed-by: Hao Li Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit ab2f752ac31c0a9e0a38d3dec1ec5d8c5f65f4da Author: Vlastimil Babka Date: Fri Jan 23 07:52:52 2026 +0100 slab: remove defer_deactivate_slab() There are no more cpu slabs so we don't need their deferred deactivation. The function is now only used from places where we allocate a new slab but then can't spin on node list_lock to put it on the partial list. Instead of the deferred action we can free it directly via __free_slab(), we just need to tell it to use _nolock() freeing of the underlying pages and take care of the accounting. Since free_frozen_pages_nolock() variant does not yet exist for code outside of the page allocator, create it as a trivial wrapper for __free_frozen_pages(..., FPI_TRYLOCK). Reviewed-by: Harry Yoo Reviewed-by: Hao Li Reviewed-by: Suren Baghdasaryan Acked-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka commit bdc9282f7809678db34e3d7e094b267a6bdd9dac Author: Vlastimil Babka Date: Fri Jan 23 07:52:51 2026 +0100 slab: remove the do_slab_free() fastpath We have removed cpu slab usage from allocation paths. Now remove do_slab_free() which was freeing objects to the cpu slab when the object belonged to it. Instead call __slab_free() directly, which was previously the fallback. This simplifies kfree_nolock() - when freeing to percpu sheaf fails, we can call defer_free() directly. Also remove functions that became unused. Reviewed-by: Harry Yoo Reviewed-by: Hao Li Reviewed-by: Suren Baghdasaryan Acked-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka commit e323b52cf00ffc3f5ac79420af7ab340b4576a5c Author: Vlastimil Babka Date: Fri Jan 23 07:52:50 2026 +0100 slab: remove SLUB_CPU_PARTIAL We have removed the partial slab usage from allocation paths. Now remove the whole config option and associated code. Reviewed-by: Harry Yoo Reviewed-by: Hao Li Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 17c38c88294d75506c67cae378c9e940d1ce55e3 Author: Vlastimil Babka Date: Fri Jan 23 07:52:49 2026 +0100 slab: remove cpu (partial) slabs usage from allocation paths We now rely on sheaves as the percpu caching layer and can refill them directly from partial or newly allocated slabs. Start removing the cpu (partial) slabs code, first from allocation paths. This means that any allocation not satisfied from percpu sheaves will end up in ___slab_alloc(), where we remove the usage of cpu (partial) slabs, so it will only perform get_partial() or new_slab(). In the latter case we reuse alloc_from_new_slab() (when we don't use the debug/tiny alloc_single_from_new_slab() variant). In get_partial_node() we used to return a slab for freezing as the cpu slab and to refill the partial slab. Now we only want to return a single object and leave the slab on the list (unless it became full). We can't simply reuse alloc_single_from_partial() as that assumes freeing uses free_to_partial_list(). Instead we need to use __slab_update_freelist() to work properly against a racing __slab_free(). To reflect the new purpose of get_partial() functions, rename them to get_from_partial(), get_from_partial_node(), and get_from_any_partial(). The rest of the changes is removing functions that no longer have any callers. Reviewed-by: Harry Yoo Reviewed-by: Hao Li Reviewed-by: Suren Baghdasaryan Acked-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka commit e0d53332ae7af30b7e47bab626395ea1f2c3912c Merge: b8b10118e98987 65428481cf6e17 Author: Arnd Bergmann Date: Thu Jan 29 09:28:20 2026 +0100 Merge tag 'ti-k3-config-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/defconfig TI K3 defconfig updates for v6.20 - Enable configurations for Kontron SMARC-sAM67 module support * tag 'ti-k3-config-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: defconfig: Enable configurations for Kontron SMARC-sAM67 Signed-off-by: Arnd Bergmann commit ed30c4adfc2b56909ca43fb5e4750a646928cbf4 Author: Vlastimil Babka Date: Fri Jan 23 07:52:48 2026 +0100 slab: add optimized sheaf refill from partial list At this point we have sheaves enabled for all caches, but their refill is done via __kmem_cache_alloc_bulk() which relies on cpu (partial) slabs - now a redundant caching layer that we are about to remove. The refill will thus be done from slabs on the node partial list. Introduce new functions that can do that in an optimized way as it's easier than modifying the __kmem_cache_alloc_bulk() call chain. Introduce struct partial_bulk_context, a variant of struct partial_context that can return a list of slabs from the partial list with the sum of free objects in them within the requested min and max. Introduce get_partial_node_bulk() that removes the slabs from freelist and returns them in the list. There is a racy read of slab->counters so make sure the non-atomic write in __update_freelist_slow() is not tearing. Introduce get_freelist_nofreeze() which grabs the freelist without freezing the slab. Introduce alloc_from_new_slab() which can allocate multiple objects from a newly allocated slab where we don't need to synchronize with freeing. In some aspects it's similar to alloc_single_from_new_slab() but assumes the cache is a non-debug one so it can avoid some actions. It supports the allow_spin parameter, which we always set true here, but the followup change will reuse the function in a context where it may be false. Introduce __refill_objects() that uses the functions above to fill an array of objects. It has to handle the possibility that the slabs will contain more objects that were requested, due to concurrent freeing of objects to those slabs. When no more slabs on partial lists are available, it will allocate new slabs. It is intended to be only used in context where spinning is allowed, so add a WARN_ON_ONCE check there. Finally, switch refill_sheaf() to use __refill_objects(). Sheaves are only refilled from contexts that allow spinning, or even blocking. Reviewed-by: Suren Baghdasaryan Reviewed-by: Hao Li Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 913ffd3a1bf5d154995c6cfab44994b07b3c103f Author: Vlastimil Babka Date: Fri Jan 23 07:52:47 2026 +0100 slab: handle kmalloc sheaves bootstrap Enable sheaves for kmalloc caches. For other types than KMALLOC_NORMAL, we can simply allow them in calculate_sizes() as they are created later than KMALLOC_NORMAL caches and can allocate sheaves and barns from those. For KMALLOC_NORMAL caches we perform additional step after first creating them without sheaves. Then bootstrap_cache_sheaves() simply allocates and initializes barns and sheaves and finally sets s->sheaf_capacity to make them actually used. Afterwards the only caches left without sheaves (unless SLUB_TINY or debugging is enabled) are kmem_cache and kmem_cache_node. These are only used when creating or destroying other kmem_caches. Thus they are not performance critical and we can simply leave it that way. Reviewed-by: Harry Yoo Reviewed-by: Hao Li Reviewed-by: Liam R. Howlett Signed-off-by: Vlastimil Babka commit f1427a1d64156bb88d84f364855c364af6f67a3b Author: Vlastimil Babka Date: Fri Jan 23 07:52:46 2026 +0100 slab: make percpu sheaves compatible with kmalloc_nolock()/kfree_nolock() Before we enable percpu sheaves for kmalloc caches, we need to make sure kmalloc_nolock() and kfree_nolock() will continue working properly and not spin when not allowed to. Percpu sheaves themselves use local_trylock() so they are already compatible. We just need to be careful with the barn->lock spin_lock. Pass a new allow_spin parameter where necessary to use spin_trylock_irqsave(). In kmalloc_nolock_noprof() we can now attempt alloc_from_pcs() safely, for now it will always fail until we enable sheaves for kmalloc caches next. Similarly in kfree_nolock() we can attempt free_to_pcs(). Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Reviewed-by: Hao Li Reviewed-by: Liam R. Howlett Signed-off-by: Vlastimil Babka commit f3421f8d154cc0906da145299c72f4a7f046ffde Author: Vlastimil Babka Date: Fri Jan 23 07:52:45 2026 +0100 slab: introduce percpu sheaves bootstrap Until now, kmem_cache->cpu_sheaves was !NULL only for caches with sheaves enabled. Since we want to enable them for almost all caches, it's suboptimal to test the pointer in the fast paths, so instead allocate it for all caches in do_kmem_cache_create(). Instead of testing the cpu_sheaves pointer to recognize caches (yet) without sheaves, test kmem_cache->sheaf_capacity for being 0, where needed, using a new cache_has_sheaves() helper. However, for the fast paths sake we also assume that the main sheaf always exists (pcs->main is !NULL), and during bootstrap we cannot allocate sheaves yet. Solve this by introducing a single static bootstrap_sheaf that's assigned as pcs->main during bootstrap. It has a size of 0, so during allocations, the fast path will find it's empty. Since the size of 0 matches sheaf_capacity of 0, the freeing fast paths will find it's "full". In the slow path handlers, we use cache_has_sheaves() to recognize that the cache doesn't (yet) have real sheaves, and fall back. Thus sharing the single bootstrap sheaf like this for multiple caches and cpus is safe. Reviewed-by: Harry Yoo Reviewed-by: Hao Li Reviewed-by: Liam R. Howlett Signed-off-by: Vlastimil Babka commit e47c897a29491ade20b27612fdd3107c39a07357 Author: Vlastimil Babka Date: Fri Jan 23 07:52:44 2026 +0100 slab: add sheaves to most caches In the first step to replace cpu (partial) slabs with sheaves, enable sheaves for almost all caches. Treat args->sheaf_capacity as a minimum, and calculate sheaf capacity with a formula that roughly follows the formula for number of objects in cpu partial slabs in set_cpu_partial(). This should achieve roughly similar contention on the barn spin lock as there's currently for node list_lock without sheaves, to make benchmarking results comparable. It can be further tuned later. Don't enable sheaves for bootstrap caches as that wouldn't work. In order to recognize them by SLAB_NO_OBJ_EXT, make sure the flag exists even for !CONFIG_SLAB_OBJ_EXT. This limitation will be lifted for kmalloc caches after the necessary bootstrapping changes. Also do not enable sheaves for SLAB_NOLEAKTRACE caches to avoid recursion with kmemleak tracking (thanks to Breno Leitao). Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Reviewed-by: Hao Li Tested-by: Breno Leitao Reviewed-by: Liam R. Howlett Tested-by: Zhao Liu Signed-off-by: Vlastimil Babka commit b8b10118e989872f18479608c8c99f82651dd78a Merge: 7c3ac7c10ce32d 42832d01c6114c Author: Arnd Bergmann Date: Thu Jan 29 09:16:24 2026 +0100 Merge tag 'imx-defconfig-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/defconfig i.MX defconfig changes for 6.20: - A couple of changes from Alexander Stein and Andreas Kemnade to enable SND_SOC_FSL_ASOC_CARD and REGULATOR_FP9931 in imx_v6_v7_defconfig - A change from Dmitry Baryshkov to enable DA9052 and MC13XXX in multi_v7_defconfig - A change from Josua Mayer to refresh imx_v4_v5_defconfig by removing stale options and adding missing ones * tag 'imx-defconfig-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: imx_v4_v5_defconfig: update for v6.19-rc1 ARM: imx_v6_v7_defconfig: enable EPD regulator needed for Kobo Clara 2e ARM: imx_v6_v7_defconfig: Configure CONFIG_SND_SOC_FSL_ASOC_CARD as module ARM: multi_v7_defconfig: enable DA9052 and MC13XXX Signed-off-by: Arnd Bergmann commit 7c3ac7c10ce32dc91a941632fa5c3bbd19ad0e16 Merge: 3b03f89dd297a5 9f262627a90c3a Author: Arnd Bergmann Date: Thu Jan 29 09:15:46 2026 +0100 Merge tag 'qcom-arm64-defconfig-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm Arm64 defconfig update for v6.20 Enable drivers needed to boot the Kaanapali and Milos platforms. Enable EC-drivers found on various Qualcomm-based laptops. * tag 'qcom-arm64-defconfig-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable EC drivers for Qualcomm-based laptops arm64: defconfig: Enable options for Qualcomm Milos SoC arm64: defconfig: enable clocks, interconnect and pinctrl for Qualcomm Kaanapali Signed-off-by: Arnd Bergmann commit 3b03f89dd297a518e64cbbf0b670bf8e05c700e5 Merge: ca36ef1bb44da7 43cb4847871970 Author: Arnd Bergmann Date: Thu Jan 29 09:09:26 2026 +0100 Merge tag 'xilinx-defconfig-for-6.20' of https://github.com/Xilinx/linux-xlnx into soc/defconfig arm64: Xilinx defconfig changes for 6.20 - Enable missing drivers by default * tag 'xilinx-defconfig-for-6.20' of https://github.com/Xilinx/linux-xlnx: arm64: defconfig: Drop duplicate CONFIG_OMAP_USB2 entry arm64: defconfig: Enable missing AMD/Xilinx drivers Signed-off-by: Arnd Bergmann commit ca36ef1bb44da7043a5cc52bb1cefeb968b91ba1 Merge: c741fc95571fee 8c7a1d258d88b5 Author: Arnd Bergmann Date: Thu Jan 29 09:07:40 2026 +0100 Merge tag 'apple-soc-defconfig-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/defconfig Apple SoC defconfig update for 6.20 - Enable most drivers required for Apple Silicon as module inside defconfig - Enable the power-domain driver when ARCH_APPLE and PM is selected since it's critical for booting these systems * tag 'apple-soc-defconfig-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: arm64: defconfig: Enable Apple Silicon drivers arm64: select APPLE_PMGR_PWRSTATE for ARCH_APPLE Signed-off-by: Arnd Bergmann commit c741fc95571fee824b1d99ac3a62cca41de489a1 Merge: 6d925df98181af 898a23193bd860 Author: Arnd Bergmann Date: Thu Jan 29 09:05:35 2026 +0100 Merge tag 'renesas-arm-defconfig-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/defconfig Renesas ARM defconfig updates for v6.20 - Enable support for the Renesas RZ/G3E USB3 PHY and RZ/G3S PCIe drivers in the ARM64 defconfig, - Refresh the ARM SH-Mobile defconfig for v6.19-rc1. * tag 'renesas-arm-defconfig-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: ARM: shmobile: defconfig: Refresh for v6.19-rc1 arm64: defconfig: Enable PCIe for the Renesas RZ/G3S SoC arm64: defconfig: Enable RZ/G3E USB3 PHY driver Signed-off-by: Arnd Bergmann commit 6d925df98181afa50e6a73689750054557a27c7e Author: Arnd Bergmann Date: Mon Jan 12 16:32:55 2026 +0100 ARM: defconfig: turn off CONFIG_EXPERT Since multi_v7_defconfig is meant to be the generic defconfig, many users are not going to be experts and it is counterintuitive to have CONFIG_EXPERT enabled. This change has a couple of side-effects: - CONFIG_NAMESPACES is enabled by default. This adds about 0.2% of .text, but is already enabled in many board specific configs, and apparently a requirement for systemd, so this seems like a useful change. - CONFIG_DEBUG_MEMORY_INIT is enabled now, adding a tiny bit of code in the inittext section - CONFIG_RFKILL, CONFIG_MEDIA_SUPPORT_FILTER and various CONFIG_HID driver defaults change, so these have to be listed explicitly to maintain the previous behavior - CONFIG_SERIAL_SH_SCI_NR_UARTS=20 changes to the default value of 18, which I understand to be sufficient for any buard, even if all UARTS are enabled at the same time Acked-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20260112153255.795553-2-arnd@kernel.org Signed-off-by: Arnd Bergmann commit ee1ab82ee032032a670a72dd7f330863f4426365 Author: Arnd Bergmann Date: Mon Jan 12 16:32:54 2026 +0100 ARM: defconfig: move entries Some Kconfig files got rearranged, so change the defconfig file to put everything back in the order used by 'make savedefconfig'. Link: https://lore.kernel.org/r/20260112153255.795553-1-arnd@kernel.org Signed-off-by: Arnd Bergmann commit 51ffeabe836bc45ea2f794f8ea5855fc0be8b9fb Author: Remi Pommarel Date: Fri Jan 23 15:48:08 2026 +0100 9p: Track 9P RPC waiting time as IO Use io_wait_event_killable() to ensure that time spent waiting for 9P RPC transactions is accounted as IO wait time. Signed-off-by: Remi Pommarel Message-ID: Signed-off-by: Dominique Martinet commit ca136b2553084120a1f864f14f4bc70f08cb6420 Author: Remi Pommarel Date: Fri Jan 23 15:48:07 2026 +0100 wait: Introduce io_wait_event_killable() Add io_wait_event_killable(), a variant of wait_event_killable() that uses io_schedule() instead of schedule(). This is to be used in situation where waiting time is to be accounted as IO wait time. Signed-off-by: Remi Pommarel Acked-by: Peter Zijlstra (Intel) Message-ID: <1b2870001ecd34fe6c05be2ddfefb3c798b11701.1769179462.git.repk@triplefau.lt> Signed-off-by: Dominique Martinet commit aba0138eb7d72fec755a985fae42a54b7ff147a8 Author: Ethan Nelson-Moore Date: Sun Jan 25 19:08:07 2026 -0800 net: ethernet: neterion: s2io: remove unused driver The s2io driver supports Exar (formerly Neterion and S2io) PCI-X 10 Gigabit Ethernet cards. Hardware supporting PCI-X has not been manufactured in years. On x86, it was quickly replaced by PCIe. While it stuck around longer on POWER hardware, the last POWER hardware to support it was POWER7, which is not supported by ppc64le Linux distributions. The last supported mainstream ppc64 Linux distribution was RHEL 7; while it is still supported under ELS, ELS is only available for x86 and IBM Z. It is possible to use many PCI-X cards in standard PCI slots (which are still available on new motherboards), but it does not make sense to do so for 10 Gigabit Ethernet because the maximum bandwidth of standard PCI is only 1067 Mbps. It is therefore highly unlikely that this driver is still being used. Remove the driver, and move the former maintainer to the CREDITS file (restoring credit for the vxge driver, which was removed in commit f05643a0f60b ("eth: remove neterion/vxge"). Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260126031352.22997-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 2f80b2797a63851a42328f98a5a61c951872e173 Author: Eric Dumazet Date: Tue Jan 27 21:12:03 2026 +0000 ipv6: remove __inet6_csk_dst_check() __inet6_csk_dst_check() is a very simple wrapper with no value, it is used only once. Directly use __sk_dst_check(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260127211203.1524339-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5fc90003de59b0f772a1654f5609fa5f87b4300f Author: Eric Dumazet Date: Tue Jan 27 17:48:06 2026 +0000 selftests: drv-net: toeplitz: accept bigger rss keys /proc/sys/net/core/netdev_rss_key got bigger (256 bytes instead of 52) Fixes: 37b0ea8fef56 ("net: expand NETDEV_RSS_KEY_LEN to 256 bytes") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260127174806.886561-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 70de46740b62b83198802bfe6682c5f865c25dc5 Author: Daniel Zahka Date: Tue Jan 27 08:30:55 2026 -0800 selftests: drv-net: psp: fix test flakes from racy connection close There is a bug in assoc_sk_only_mismatch() and assoc_sk_only_mismatch_tx() that creates a race condition which triggers test flakes in later test cases e.g. data_send_bad_key(). The problem is that the client uses the "conn clr" rpc to setup a data connection with psp_responder, but never uses a matching "data close" rpc. This creates a race condition where if the client can queue another data sock request, like in data_send_bad_key(), before the server can accept the old connection from the backlog we end up in a situation where we have two connections in the backlog: one for the closed connection we have received a FIN for, and one for the new PSP connection which is expecting to do key exchange. From there the server pops the closed connection from the backlog, but the data_send_bad_key() test case in psp.py hangs waiting to perform key exchange. The fix is to properly use _conn_close, which fill force the server to remove the closed connection from the backlog before sending the RPC ack to the client. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20260127-psp-flaky-test-v1-1-13403e390af3@gmail.com Signed-off-by: Jakub Kicinski commit 701b40f8bde1e9fd48591648d1ed028a31e2ad5f Author: Sebastian Andrzej Siewior Date: Tue Jan 27 14:53:34 2026 +0100 declance: Remove IRQF_ONESHOT Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also disallows force-threading of the primary handler and the irq-core will warn about this as of commit aef30c8d569c0 ("genirq: Warn about using IRQF_ONESHOT without a threaded handler"). The IRQF_ONESHOT flag was added in commit 0fabe1021f8bc ("MIPS: DECstation I/O ASIC DMA interrupt classes"). It moved clear_ioasic_dma_irq() from the driver into the irq-chip. For EOI interrupts the clear_ioasic_dma_irq() callback is now invoked as ->irq_eoi() which is invoked after the IRQ was handled while the interrupt is masked due to IRQF_ONESHOT. Without IRQF_ONESHOT it would be invoked while interrupt is unmasked (but interrupts are disabled). If it is *required* to invoke EOI-ack while the interrupt is masked (and not a misunderstanding) due to irq-chip cascading/ hierarchical reasons then using handle_fasteoi_mask_irq() as flow-handler would be the right way to do so. Remove IRQF_ONESHOT to irqflags. Cc: Andrew Lunn Signed-off-by: Sebastian Andrzej Siewior Acked-by: Maciej W. Rozycki Link: https://patch.msgid.link/20260127135334.qUEaYP9G@linutronix.de Signed-off-by: Jakub Kicinski commit 33c1c6d8a28a2761ac74b0380b2563cf546c2a3a Author: Guangshuo Li Date: Tue Sep 23 21:32:35 2025 +0800 powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() As kcalloc() may fail, check its return value to avoid a NULL pointer dereference when passing it to of_property_read_u32_array(). Fixes: 790a1662d3a26 ("powerpc/smp: Parse ibm,thread-groups with multiple properties") Cc: stable@vger.kernel.org Reviewed-by: Christophe Leroy Signed-off-by: Guangshuo Li Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250923133235.1862108-1-lgs201920130244@gmail.com commit 4acc549e800e1035475995b6b144040561115fa8 Author: Miquel Sabaté Solà Date: Mon Sep 15 16:18:08 2025 +0200 powerpc: kgdb: Remove OUTBUFMAX constant This constant was introduced in commit 17ce452f7ea3 ("kgdb, powerpc: arch specific powerpc kgdb support"), but it is no longer used anywhere in the source tree. Signed-off-by: Miquel Sabaté Solà Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250915141808.146695-1-mikisabate@gmail.com commit 11d45eee9f42f7d3f9c9f190a6f79e570d345fe2 Author: Abhishek Dubey Date: Sat Jan 24 13:22:23 2026 +0530 powerpc64/bpf: Additional NVR handling for bpf_throw The bpf_throw() function never returns, if it has clobbered any callee-saved register, those will remain clobbered. The prologue must take care of saving all callee-saved registers in the frame of exception boundary program. Later these additional non volatile registers R14-R25 along with other NVRs are restored back in the epilogue of exception callback. To achieve above objective, the frame size is determined dynamically to accommodate additional non volatile registers in exception boundary's frame. For non-exception boundary program, the frame size remains optimal. The additional instructions to save & restore r14-r25 registers are emitted only during exception boundary and exception callback program respectively. Signed-off-by: Abhishek Dubey Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260124075223.6033-7-adubey@linux.ibm.com commit c169930292f7f31a6e500803e6c5ffbb9d5e6e4b Author: Abhishek Dubey Date: Sat Jan 24 13:22:22 2026 +0530 powerpc64/bpf: Support exceptions The modified prologue/epilogue generation code now enables exception-callback to use the stack frame of the program marked as exception boundary, where callee saved registers are stored. As per ppc64 ABIv2 documentation[1], r14-r31 are callee saved registers. BPF programs on ppc64 already saves r26-r31 registers. Saving the remaining set of callee saved registers(r14-r25) is handled in the next patch. [1] https://ftp.rtems.org/pub/rtems/people/sebh/ABI64BitOpenPOWERv1.1_16July2015_pub.pdf Signed-off-by: Abhishek Dubey Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260124075223.6033-6-adubey@linux.ibm.com commit b1c24f089bcf23faa23397dfb5e05f82a8c6cf56 Author: Abhishek Dubey Date: Sat Jan 24 13:22:21 2026 +0530 powerpc64/bpf: Add arch_bpf_stack_walk() for BPF JIT This function is used by bpf_throw() to unwind the stack until frame of exception-boundary during BPF exception handling. This function is necessary to support BPF exceptions on PowerPC. Signed-off-by: Abhishek Dubey Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260124075223.6033-5-adubey@linux.ibm.com commit 88cb7f40344d8b81ecfc4709b5382a956739c272 Author: Abhishek Dubey Date: Sat Jan 24 13:22:20 2026 +0530 powerpc64/bpf: Avoid tailcall restore from trampoline Back propagation of tailcall count is no longer needed for powerpc64 due to use of reference, which updates the tailcall count in the tail_call_info field in the frame of the main program only. Back propagation is still required for 32-bit powerpc. Signed-off-by: Abhishek Dubey Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260124075223.6033-4-adubey@linux.ibm.com commit 2ed2d8f6fb3853daa536d79e0799cbac91fac9f5 Author: Abhishek Dubey Date: Sat Jan 24 13:22:19 2026 +0530 powerpc64/bpf: Support tailcalls with subprogs Enable tailcalls support in subprogs by passing tail call count as reference instead of value. The actual tailcall count is always maintained in the tailcall field present in the frame of main function (also called entry function). The tailcall field in the stack frame of subprogs contains reference to the tailcall field in the stack frame of main BPF program. Accordingly, rename tail_call_cnt field in the stack layout to tail_call_info. Signed-off-by: Abhishek Dubey Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260124075223.6033-3-adubey@linux.ibm.com commit 15513beeb673765c05cdd8e526ccee33906375cb Author: Abhishek Dubey Date: Sat Jan 24 13:22:18 2026 +0530 powerpc64/bpf: Moving tail_call_cnt to bottom of frame To support tailcalls in subprogs, tail_call_cnt needs to be on the BPF trampoline stack frame. In a regular BPF program or subprog stack frame, the position of tail_call_cnt is after the NVR save area (BPF_PPC_STACK_SAVE). To avoid complex logic in deducing offset for tail_call_cnt, it has to be kept at the same offset on the trampoline frame as well. But doing that wastes nearly all of BPF_PPC_STACK_SAVE bytes on the BPF trampoline stack frame as the NVR save area is not the same for BPF trampoline and regular BPF programs. Address this by moving tail_call_cnt to the bottom of the frame. This change avoids the need to account for BPF_PPC_STACK_SAVE bytes in the BPF trampoline stack frame when support for tailcalls in BPF subprogs is added later. Also, this change makes offset calculation of tail_call_cnt field simpler all across. Signed-off-by: Abhishek Dubey Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260124075223.6033-2-adubey@linux.ibm.com commit 56763311f60457e75549565c056accc6aa9a16a5 Merge: 5b71de34b7eaef 6080d525aba8a6 Author: Jakub Kicinski Date: Wed Jan 28 19:35:39 2026 -0800 Merge branch 'tcp-tcp_tx_timestamp-fix' Eric Dumazet says: ==================== tcp: tcp_tx_timestamp() fix Fix an old bug in tcp_tx_timestamp(). Add one corresponding packetdrill test. ==================== Link: https://patch.msgid.link/20260127123828.4098577-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6080d525aba8a6cab9fe4b841ca1fab48a2969c6 Author: Eric Dumazet Date: Tue Jan 27 12:38:28 2026 +0000 selftest: packetdrill: add tcp_timestamping_tcp_tx_timestamp_bug.pkt Test tcp_tx_timestamp() behavior after ("tcp: tcp_tx_timestamp() must look at the rtx queue"). Without the fix, this new test fails like this: tcp_timestamping_tcp_tx_timestamp_bug.pkt:55: runtime error in recvmsg call: Expected result 0 but got -1 with errno 11 (Resource temporarily unavailable) Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Link: https://patch.msgid.link/20260127123828.4098577-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 838eb9687691d29915797a885b861fd09353386e Author: Eric Dumazet Date: Tue Jan 27 12:38:27 2026 +0000 tcp: tcp_tx_timestamp() must look at the rtx queue tcp_tx_timestamp() is only called at the end of tcp_sendmsg_locked() before the final tcp_push(). By the time it is called, it is possible all the copied data has been sent already (transmit queue is empty). If this is the case, use the last skb in the rtx queue. Fixes: 75c119afe14f ("tcp: implement rb-tree based retransmit queue") Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Link: https://patch.msgid.link/20260127123828.4098577-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5b71de34b7eaef7e39a7c3c4b9f2fdad06462ebb Author: Kuniyuki Iwashima Date: Tue Jan 27 08:13:20 2026 +0000 ipv4: Use EXPORT_IPV6_MOD_GPL() for ip_fib_metrics_init(). ip_fib_metrics_init() is only called from fib_create_info() and ip6_route_info_create(). Let's use EXPORT_IPV6_MOD_GPL() instead. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260127081335.646666-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 6e84fc395e90465f1418f582a9f7d53c87ab010e Author: Kuniyuki Iwashima Date: Tue Jan 27 04:35:24 2026 +0000 ipv4: fib: Annotate access to struct fib_alias.fa_state. syzbot reported that struct fib_alias.fa_state can be modified locklessly by RCU readers. [0] Let's use READ_ONCE()/WRITE_ONCE() properly. [0]: BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0: fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline] fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565 fib_lookup include/net/ip_fib.h:390 [inline] ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 ip_route_output_key_hash net/ipv4/route.c:2705 [inline] __ip_route_output_key include/net/route.h:169 [inline] ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 __sys_sendmmsg+0x185/0x320 net/socket.c:2735 __do_sys_sendmmsg net/socket.c:2762 [inline] __se_sys_sendmmsg net/socket.c:2759 [inline] __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1: fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline] fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565 fib_lookup include/net/ip_fib.h:390 [inline] ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814 ip_route_output_key_hash net/ipv4/route.c:2705 [inline] __ip_route_output_key include/net/route.h:169 [inline] ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932 udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450 inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0x53a/0x600 net/socket.c:2592 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2646 __sys_sendmmsg+0x185/0x320 net/socket.c:2735 __do_sys_sendmmsg net/socket.c:2762 [inline] __se_sys_sendmmsg net/socket.c:2759 [inline] __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759 x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00 -> 0x01 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit c0f38f31367962635cf0e80cc7098aa68bfbf1ae Merge: 239f09e258b906 d5fb143dbe8d30 Author: Jakub Kicinski Date: Wed Jan 28 19:31:53 2026 -0800 Merge branch 'tcp-make-tcp_ack-faster' Eric Dumazet says: ==================== tcp: make tcp_ack() faster Move tcp_rack_update_reo_wnd() and tcp_rack_advance() to tcp_input.c to allow their (auto)inlining. No functional change in this series. ==================== Link: https://patch.msgid.link/20260127032147.3498272-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d5fb143dbe8d3050c9abcd390d65928e2a3e646e Author: Eric Dumazet Date: Tue Jan 27 03:21:47 2026 +0000 tcp: move tcp_rack_advance() to tcp_input.c tcp_rack_advance() is called from tcp_ack() and tcp_sacktag_one(). Moving it to tcp_input.c allows the compiler to inline it and save both space and cpu cycles in TCP fast path. $ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2 add/remove: 0/2 grow/shrink: 1/1 up/down: 98/-132 (-34) Function old new delta tcp_ack 5741 5839 +98 tcp_sacktag_one 407 395 -12 __pfx_tcp_rack_advance 16 - -16 tcp_rack_advance 104 - -104 Total: Before=22572680, After=22572646, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260127032147.3498272-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 629a68865abb40c120e3f6498b26a35c40590ea0 Author: Eric Dumazet Date: Tue Jan 27 03:21:46 2026 +0000 tcp: move tcp_rack_update_reo_wnd() to tcp_input.c tcp_rack_update_reo_wnd() is called only once from tcp_ack() Move it to tcp_input.c so that it can be inlined by the compiler to save space and cpu cycles. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 1/0 up/down: 110/-153 (-43) Function old new delta tcp_ack 5631 5741 +110 __pfx_tcp_rack_update_reo_wnd 16 - -16 tcp_rack_update_reo_wnd 137 - -137 Total: Before=22572723, After=22572680, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260127032147.3498272-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 773a7002131393ac22c6e7a3720e374f9e6016ca Author: Eric Dumazet Date: Tue Jan 27 03:21:45 2026 +0000 tcp: mark tcp_process_tlp_ack() as unlikely It is unlikely we have to call tcp_process_tlp_ack(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260127032147.3498272-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 95dbe214b910fc80f0627e1760305cc0f472ff9f Merge: 08a7491843224f 60d2c438c1bb70 Author: Alexei Starovoitov Date: Wed Jan 28 18:41:57 2026 -0800 Merge branch 'bpf-fix-verifier_bug_if-to-account-for-bpf_call' Luis Gerhorst says: ==================== bpf: Fix verifier_bug_if to account for BPF_CALL This fixes the verifier_bug_if() that runs on nospec_result to not trigger for BPF_CALL (bug reported by Hu, Mei, and Mu). See patch 1 for a full description and patch 2 for a test (based on the PoC from the report). While working on this I noticed two other problems: - nospec_result is currently ignored for BPF_CALL during patching, but it may be required if we assume the CPU may speculate into/out of functions. - Both the instruction patching for nospec and nospec_result erases the instruction aux information even thought it might be better to keep that. For nospec_result it may be fine as it is only applied to store instructions currently (except for when we decide to change the thing from above), but nospec may be set for arbitrary instructions and if these require rewrites they break. I assume these issues are better fixed separately, thus I decided to exclude them from this series. ==================== Link: https://patch.msgid.link/20260127115912.3026761-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 60d2c438c1bb705cdbf74ce8f12e6e141a4719b0 Author: Luis Gerhorst Date: Tue Jan 27 12:59:12 2026 +0100 bpf: Test nospec after dead stack write in helper Without the fix from the previous commit, the selftest fails: $ ./tools/testing/selftests/bpf/vmtest.sh -- \ ./test_progs -t verifier_unpriv [...] run_subtest:PASS:obj_open_mem 0 nsec libbpf: BTF loading error: -EPERM libbpf: Error loading .BTF into kernel: -EPERM. BTF is optional, ignoring. libbpf: prog 'unpriv_nospec_after_helper_stack_write': BPF program load failed: -EFAULT libbpf: prog 'unpriv_nospec_after_helper_stack_write': failed to load: -EFAULT libbpf: failed to load object 'verifier_unpriv' run_subtest:FAIL:unexpected_load_failure unexpected error: -14 (errno 14) VERIFIER LOG: ============= 0: R1=ctx() R10=fp0 0: (b7) r0 = 0 ; R0=P0 1: (55) if r0 != 0x1 goto pc+6 2: R0=Pscalar() R1=ctx() R10=fp0 2: (b7) r2 = 0 ; R2=P0 3: (bf) r3 = r10 ; R3=fp0 R10=fp0 4: (07) r3 += -16 ; R3=fp-16 5: (b7) r4 = 4 ; R4=P4 6: (b7) r5 = 0 ; R5=P0 7: (85) call bpf_skb_load_bytes_relative#68 verifier bug: speculation barrier after jump instruction may not have the desired effect (BPF_CLASS(insn->code) == BPF_JMP || BPF_CLASS(insn->code) == BPF_JMP32) processed 9 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 ============= [...] The test is based on the PoC from the report. Signed-off-by: Luis Gerhorst Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Reported-by: Dongliang Mu Link: https://lore.kernel.org/bpf/7678017d-b760-4053-a2d8-a6879b0dbeeb@hust.edu.cn/ Link: https://lore.kernel.org/r/20260127115912.3026761-3-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit cd3b6a3d49f8061d0c4c7e4226783051fe592ae7 Author: Luis Gerhorst Date: Tue Jan 27 12:59:11 2026 +0100 bpf: Fix verifier_bug_if to account for BPF_CALL The BPF verifier assumes `insn_aux->nospec_result` is only set for direct memory writes (e.g., `*(u32*)(r1+off) = r2`). However, the assertion fails to account for helper calls (e.g., `bpf_skb_load_bytes_relative`) that perform writes to stack memory. Make the check more precise to resolve this. The problem is that `BPF_CALL` instructions have `BPF_CLASS(insn->code) == BPF_JMP`, which triggers the warning check: - Helpers like `bpf_skb_load_bytes_relative` write to stack memory - `check_helper_call()` loops through `meta.access_size`, calling `check_mem_access(..., BPF_WRITE)` - `check_stack_write()` sets `insn_aux->nospec_result = 1` - Since `BPF_CALL` is encoded as `BPF_JMP | BPF_CALL`, the warning fires Execution flow: ``` 1. Drop capabilities → Enable Spectre mitigation 2. Load BPF program └─> do_check() ├─> check_cond_jmp_op() → Marks dead branch as speculative │ └─> push_stack(..., speculative=true) ├─> pop_stack() → state->speculative = 1 ├─> check_helper_call() → Processes helper in dead branch │ └─> check_mem_access(..., BPF_WRITE) │ └─> insn_aux->nospec_result = 1 └─> Checks: state->speculative && insn_aux->nospec_result └─> BPF_CLASS(insn->code) == BPF_JMP → WARNING ``` To fix the assert, it would be nice to be able to reuse bpf_insn_successors() here, but bpf_insn_successors()->cnt is not exactly what we want as it may also be 1 for BPF_JA. Instead, we could check opcode_info.can_jump, but then we would have to share the table between the functions. This would mean moving the table out of the function and adding bpf_opcode_info(). As the verifier_bug_if() only runs for insns with nospec_result set, the impact on verification time would likely still be negligible. However, I assume sharing bpf_opcode_info() between liveness.c and verifier.c will not be worth it. It seems as only adjust_jmp_off() could also be simplified using it, and there imm/off is touched. Thus it is maybe better to rely on exact opcode/class matching there. Therefore, to avoid this sharing only for a verifier_bug_if(), just check the opcode. This should now cover all opcodes for which can_jump in bpf_insn_successors() is true. Parts of the description and example are taken from the bug report. Fixes: dadb59104c64 ("bpf: Fix aux usage after do_check_insn()") Signed-off-by: Luis Gerhorst Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Reported-by: Dongliang Mu Closes: https://lore.kernel.org/bpf/7678017d-b760-4053-a2d8-a6879b0dbeeb@hust.edu.cn/ Link: https://lore.kernel.org/r/20260127115912.3026761-2-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 84c2344b0660cabe114ef889207f445def7996bd Author: Alice Ryhl Date: Tue Jan 27 08:30:01 2026 +0000 MAINTAINERS: add Rust files to STATIC BRANCH/CALL and TRACING I realized that these files were never listed in MAINTAINERS when they were added in commit ad37bcd965fd ("rust: add tracepoint support"). Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Josh Poimboeuf Cc: Jason Baron Cc: Ard Biesheuvel Link: https://patch.msgid.link/20260127-jump-label-rust-maintainers-v2-1-11b7c30b11d9@google.com Signed-off-by: Alice Ryhl Acked-by: Peter Zijlstra (Intel) Signed-off-by: Steven Rostedt (Google) commit 9df0e49c5b9b8d051529be9994e4f92f2d20be6f Author: Steven Rostedt Date: Mon Jan 26 13:00:37 2026 -0500 tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros The macros ENABLE_EVENT_STR and DISABLE_EVENT_STR were added to trace.h so that more than one file can have access to them, but was never removed from their original location. Remove the duplicates. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Tom Zanussi Link: https://patch.msgid.link/20260126130037.4ba201f9@gandalf.local.home Fixes: d0bad49bb0a09 ("tracing: Add enable_hist/disable_hist triggers") Signed-off-by: Steven Rostedt (Google) commit e62750b6ab4d57f6cf4ea1550de8d2e111adb675 Author: Steven Rostedt Date: Fri Jan 23 10:54:15 2026 -0500 tracing: Up the hist stacktrace size from 16 to 31 Recording stacktraces is very useful, but the size of 16 deep is very restrictive. For example, in seeing where tasks schedule out in a non running state, the following can be used: ~# cd /sys/kernel/tracing ~# echo 'hist:keys=common_stacktrace:vals=hitcount if prev_state & 3' > events/sched/sched_switch/trigger ~# cat events/sched/sched_switch/hist [..] { common_stacktrace: __schedule+0xdc0/0x1860 schedule+0x27/0xd0 schedule_timeout+0xb5/0x100 wait_for_completion+0x8a/0x140 xfs_buf_iowait+0x20/0xd0 [xfs] xfs_buf_read_map+0x103/0x250 [xfs] xfs_trans_read_buf_map+0x161/0x310 [xfs] xfs_btree_read_buf_block+0xa0/0x120 [xfs] xfs_btree_lookup_get_block+0xa3/0x1e0 [xfs] xfs_btree_lookup+0xea/0x530 [xfs] xfs_alloc_fixup_trees+0x72/0x570 [xfs] xfs_alloc_ag_vextent_size+0x67f/0x800 [xfs] xfs_alloc_vextent_iterate_ags.constprop.0+0x52/0x230 [xfs] xfs_alloc_vextent_start_ag+0x9d/0x1b0 [xfs] xfs_bmap_btalloc+0x2af/0x680 [xfs] xfs_bmapi_allocate+0xdb/0x2c0 [xfs] } hitcount: 1 [..] The above stops at 16 functions where knowing more would be useful. As the allocated storage for stacks is the same for strings, and that size is 256 bytes, there is a lot of space not being used for stacktraces. 16 * 8 = 128 Up the size to 31 (it requires the last slot to be zero, so it can't be 32). Also change the BUILD_BUG_ON() to allow the size of the stacktrace storage to be equal to the max size. One slot is used to hold the number of elements in the stack. BUILD_BUG_ON((HIST_STACKTRACE_DEPTH + 1) * sizeof(long) >= STR_VAR_LEN_MAX); Change that from ">=" to just ">", as now they are equal. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260123105415.2be26bf4@gandalf.local.home Reviewed-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit ef742dc5f8cd941bd7ad7dda132458909cb298d2 Author: Steven Rostedt Date: Thu Jan 22 20:45:26 2026 -0500 tracing: Remove notrace from trace_event_raw_event_synth() When debugging the synthetic events, being able to function trace its functions is very useful (now that CONFIG_FUNCTION_SELF_TRACING is available). For some reason trace_event_raw_event_synth() was marked as "notrace", which was totally unnecessary as all of the tracing directory had function tracing disabled until the recent FUNCTION_SELF_TRACING was added. Remove the notrace annotation from trace_event_raw_event_synth() as there's no reason to not trace it when tracing synthetic event functions. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260122204526.068a98c9@gandalf.local.home Acked-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit 45641096c9c3eb8213616df50beaa5f92b201876 Author: Steven Rostedt Date: Thu Jan 22 20:38:22 2026 -0500 tracing: Have hist_debug show what function a field uses When CONFIG_HIST_TRIGGERS_DEBUG is enabled, each trace event has a "hist_debug" file that explains the histogram internal data. This is very useful for debugging histograms. One bit of data that was missing from this file was what function a histogram field uses to process its data. The hist_field structure now has a fn_num that is used by a switch statement in hist_fn_call() to call a function directly (to avoid spectre mitigations). Instead of displaying that number, create a string array that maps to the histogram function enums so that the function for a field may be displayed: ~# cat /sys/kernel/tracing/events/sched/sched_switch/hist_debug [..] hist_data: 0000000043d62762 n_vals: 2 n_keys: 1 n_fields: 3 val fields: hist_data->fields[0]: flags: VAL: HIST_FIELD_FL_HITCOUNT type: u64 size: 8 is_signed: 0 function: hist_field_counter() hist_data->fields[1]: flags: HIST_FIELD_FL_VAR var.name: __arg_3921_2 var.idx (into tracing_map_elt.vars[]): 0 type: unsigned long[] size: 128 is_signed: 0 function: hist_field_nop() key fields: hist_data->fields[2]: flags: HIST_FIELD_FL_KEY ftrace_event_field name: prev_pid type: pid_t size: 8 is_signed: 1 function: hist_field_s32() The "function:" field above is added. Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260122203822.58df4d80@gandalf.local.home Reviewed-by: Tom Zanussi Tested-by: Tom Zanussi Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 65ce1155f9275990b9a80e743d503909740e75af Merge: 7ae4d097b752d7 77ee3ba5d4152f Author: Mark Brown Date: Thu Jan 29 00:24:48 2026 +0000 spi: cadence-qspi: Add Renesas RZ/N1 support Merge series from "Miquel Raynal (Schneider Electric)" : This series adds support for the QSPI controller available on Renesas RZ/N1S and RZ/N1D SoC. It has been tested with a custom board (see last SPI patch for details), but has been tested by Wolfram (thank you!) on the DB board. Link: https://lore.kernel.org/linux-devicetree/20260116114852.52948-2-wsa+renesas@sang-engineering.com/ Adding support for this SoC required a few adaptations in the Cadence QSPI driver. The bulk of the work is in the few last patches. Everything else is just misc style fixes and improvements which bothered me while I was wandering. In order to support all constraints, I sometimes used a new quirk (for the write protection feature and the "no indirect mode"), and sometimes used the compatible directly. The ones I thought might not be RZ/N1 specific have been implemented under the form of a quirk, in order to ease their reuse. The other adaptations, which I believe are more Renesas specific, have been handled using the compatible. This is all very arbitrary, and can be discussed. commit fc15f8a41e38d48937078643b31888f9d96f5afd Merge: 88340fc880cae6 9409d18bf7d58a Author: Mark Brown Date: Thu Jan 29 00:24:43 2026 +0000 regmap: reg_default_cb for flat cache defaults Merge series from "Sheetal ." : This series adds a reg_default_cb callback for REGCACHE_FLAT to provide defaults for registers not listed in reg_defaults. Defaults are loaded eagerly during regcache init and the callback can use writeable_reg to filter valid addresses and avoid holes. Tegra ASoC drivers set reg_default_cb and add writeable_reg filtering for AHUB RX holes to prevent invalid addresses from being marked valid. commit b8121b9cdce163cdf07f687dd9cac1182c5e6a21 Author: sunliming Date: Tue Jan 27 13:38:48 2026 +0800 tracing: kprobe-event: Return directly when trace kprobes is empty In enable_boot_kprobe_events(), it returns directly when trace kprobes is empty, thereby reducing the function's execution time. This function may otherwise wait for the event_mutex lock for tens of milliseconds on certain machines, which is unnecessary when trace kprobes is empty. Link: https://lore.kernel.org/all/20260127053848.108473-1-sunliming@linux.dev/ Signed-off-by: sunliming Signed-off-by: Masami Hiramatsu (Google) commit aef5078471294e7a7a2d6b9da4988a6a3b7aff54 Author: Viacheslav Dubeyko Date: Mon Jan 19 20:19:38 2026 -0800 hfsplus: fix generic/062 xfstests failure The xfstests' test-case generic/062 fails to execute correctly: FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc4+ #8 SMP PREEMPT_DYNAMIC Thu May 1 16:43:22 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/062 - output mismatch (see xfstests-dev/results//generic/062.out.bad) The generic/062 test tries to set and get xattrs for various types of objects (regular file, folder, block device, character device, pipe, etc) with the goal to check that xattr operations works correctly for all possible types of file system objects. But current HFS+ implementation somehow hasn't support of xattr operatioons for the case of block device, character device, and pipe objects. Also, it has not completely correct set of operations for the case symlinks. This patch implements proper declaration of xattrs operations hfsplus_special_inode_operations and hfsplus_symlink_inode_operations. Also, it slightly corrects the logic of hfsplus_listxattr() method. sudo ./check generic/062 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.19.0-rc1+ #59 SMP PREEMPT_DYNAMIC Mon Jan 19 16:26:21 PST 2026 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/062 20s ... 20s Ran: generic/062 Passed all 1 tests [1] https://github.com/hfs-linux-kernel/hfs-linux-kernel/issues/93 Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20260120041937.3450928-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 25ed1e98403c1d759ac2eeb999b4cf12f6accecf Merge: b095c27fc874ef 18649ffbb63bca Author: Arnd Bergmann Date: Wed Jan 28 23:34:33 2026 +0100 Merge tag 'riscv-dt-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt RISC-V Devicetrees for v6.20 (or v7.0) Anlogic: Minor change to the extension information, to add the "b" extension that's a catch-all for 3 of the extensions already in the dts. Starfive: Append the jh7110 compatible to jh7110s devicetrees, as that will enable OpenSBI etc to run without adding support for this minor variant. The "s" device differs from the non "s" device only in thermal limits and voltage/frequency characteristics. Microchip: Redo the mpfs clock setup yet again, to something approaching correct. The original binding conjured up for the platform was wildly inaccurate, and even with the original improvements, a bigger change to using syscons was required to support several peripherals that also inhabit the memory regions that the clocks lie in. The damage to the dts isn't that bad in the end, and of course the whole thing has been done in a backwards compatible manner, with the code changes being merged a cycle or two ago in the kernel and like a year ago in U-Boot (the only other user that I am aware of). Generic: Additions to extensions.yaml, mainly for things in the "rva23" profile that appear for the first time on the Spacemit K3 SoC. Signed-off-by: Conor Dooley * tag 'riscv-dt-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: anlogic: dr1v90: Add "b" ISA extension dt-bindings: riscv: extensions: Drop unnecessary select schema dt-bindings: riscv: Add Sha and its comprised extensions dt-bindings: riscv: Add Ssccptr, Sscounterenw, Sstvala, Sstvecd, Ssu64xl dt-bindings: riscv: Add descriptions for Za64rs, Ziccamoa, Ziccif, and Zicclsm dt-bindings: riscv: Add B ISA extension description dt-bindings: riscv: update ratified version of h, svinval, svnapot, svpbmt riscv: dts: starfive: Append JH-7110 SoC compatible to VisionFive 2 Lite eMMC board riscv: dts: starfive: Append JH-7110 SoC compatible to VisionFive 2 Lite board dt-bindings: riscv: starfive: Append JH-7110 SoC compatible to VisionFive 2 Lite board riscv: dts: microchip: convert clock and reset to use syscon riscv: dts: microchip: fix mailbox description Signed-off-by: Arnd Bergmann commit b095c27fc874ef5e26a025a0ddbdacfc3c94d663 Author: Yu-Chun Lin Date: Tue Jan 27 15:14:01 2026 +0800 arm64: dts: realtek: Add Kent SoC and EVB device trees Add Device Tree hierarchy for Realtek Kent SoC family: - kent.dtsi: base SoC layer - rtd.dtsi: SoC variant layer - rtd-.dtsi: board layer - rtd--.dts: board configuration layer Include RTD1501s Phantom EVB (8GB), RTD1861B Krypton EVB (8GB), and RTD1920s Smallville EVB (4GB). Signed-off-by: Yu-Chun Lin Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260127071530.25426-3-eleanor15x@gmail.com Signed-off-by: Arnd Bergmann commit d83bcab6842f01bad024056c3801c39f55e61f30 Author: Yu-Chun Lin Date: Tue Jan 27 15:14:00 2026 +0800 dt-bindings: arm: realtek: Add Kent Soc family compatibles Define compatible strings for Realtek RTD1501s, RTD1861b and RTD1920s. Additionally, convert legacy DTS-style comments to YAML description properties, following the pattern from the ARM bindings conversion series [1]. [1] https://lore.kernel.org/lkml/20200622125527.24207-2-afaerber@suse.de/ Acked-by: Conor Dooley Signed-off-by: Yu-Chun Lin Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260127071530.25426-2-eleanor15x@gmail.com Signed-off-by: Arnd Bergmann commit 08a7491843224f8b96518fbe70d9e48163046054 Author: Ihor Solodrai Date: Wed Jan 28 13:12:55 2026 -0800 bpftool: Fix dependencies for static build When building selftests/bpf with EXTRA_LDFLAGS=-static the follwoing error happens: LINK /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool /usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-dso_dlfcn.o): in function `dlfcn_globallookup': [...] /usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_expand_block': (.text+0xc64): undefined reference to `uncompress' /usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_compress_block': (.text+0xce4): undefined reference to `compress' collect2: error: ld returned 1 exit status make[1]: *** [Makefile:252: /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool] Error 1 make: *** [Makefile:327: /ws/linux/tools/testing/selftests/bpf/tools/sbin/bpftool] Error 2 make: *** Waiting for unfinished jobs.... This is caused by wrong order of dependencies in the Makefile. Fix it. Signed-off-by: Ihor Solodrai Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260128211255.376933-1-ihor.solodrai@linux.dev commit a554a25e66efea0b78fb3d24f4f19289e037c0dc Author: Frederic Weisbecker Date: Wed Jan 28 17:05:27 2026 +0100 cpufreq: ondemand: Simplify idle cputime granularity test cpufreq calls get_cpu_idle_time_us() just to know if idle cputime accounting has a nanoseconds granularity. Use the appropriate indicator instead to make that deduction. Signed-off-by: Frederic Weisbecker Link: https://patch.msgid.link/aXozx0PXutnm8ECX@localhost.localdomain Signed-off-by: Rafael J. Wysocki commit cc764d3bbd545d7d6f5f66ac678ffc522d75f0f9 Author: Pengjie Zhang Date: Fri Jan 16 17:46:23 2026 +0800 cpufreq: userspace: make scaling_setspeed return the actual requested frequency According to the Linux kernel ABI documentation for 'scaling_setspeed': "It returns the last frequency requested by the governor (in kHz) or can be written to in order to set a new frequency for the policy." However, the current implementation of show_speed() returns 'policy->cur'. 'policy->cur' represents the frequency after the driver has resolved the request against the hardware frequency table and applied policy limits (min/max). This creates a discrepancy between the documentation/user expectation and the actual code behavior. For instance: 1. User writes a value to 'scaling_setspeed' that is not in the OPP table (e.g., user asks for A, driver rounds it to B). 2. User reads 'scaling_setspeed'. 3. Code returns B ('policy->cur'). 4. User expects A (the "frequency requested"), but gets B. This patch changes show_speed() to return 'userspace->setspeed', which stores the actual value last requested by the user. This restores the read/write symmetry of the attribute and aligns the code with the ABI description. The effective frequency can still be observed via 'scaling_cur_freq' or 'cpuinfo_cur_freq', preserving the distinction between "what was requested" (setspeed) and "what is effective" (cur_freq). Signed-off-by: Pengjie Zhang Acked-by: Viresh Kumar Acked-by: lihuisong@huawei.com Link: https://patch.msgid.link/20260116094623.2980031-1-zhangpengjie2@huawei.com Signed-off-by: Rafael J. Wysocki commit b640d556a2b354863a9962747a01f67f31cbf4d8 Author: Mykyta Yatsenko Date: Wed Jan 28 19:05:51 2026 +0000 selftests/bpf: Remove xxd util dependency The verification signature header generation requires converting a binary certificate to a C array. Previously this only worked with xxd (part of vim-common package). As xxd may not be available on some systems building selftests, it makes sense to substitute it with more common utils: hexdump, wc, sed to generate equivalent C array output. Tested by generating header with both xxd and hexdump and comparing them. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Tested-by: Alan Maguire Link: https://lore.kernel.org/bpf/20260128190552.242335-1-mykyta.yatsenko5@gmail.com commit ba205ac3d6e83f56c4f824f23f1b4522cb844ff3 Author: Alex Deucher Date: Mon Jan 26 23:44:45 2026 -0500 drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() The EXEC_COUNT field must be > 0. In the gfx shadow handling we always emit a cond_exec packet after the gfx_shadow packet, but the EXEC_COUNT never gets patched. This leads to a hang when we try and reset queues on gfx11 APUs. Fixes: c68cbbfd54c6 ("drm/amdgpu: cleanup conditional execution") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4789 Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit 637fee3954d4bd509ea9d95ad1780fc174489860 Author: Alex Deucher Date: Fri Jan 16 17:33:05 2026 -0500 drm/amdgpu/soc21: fix xclk for APUs The reference clock is supposed to be 100Mhz, but it appears to actually be slightly lower (99.81Mhz). Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/14451 Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit 05762d9c7da1f7e8ec6c456f592a17390ad43ddd Author: Jay Cornwall Date: Wed Jan 21 15:25:09 2026 -0600 drm/amdkfd: gfx12.1 trap handler instruction fixup for VOP3PX A trap may occur in the middle of VOP3PX instruction co-issue. The PC would be restored incorrectly if left unmodified. Identify this case by examining the instruction opcode and rewind the PC 8 bytes if it occurs. Signed-off-by: Jay Cornwall Reviewed-by: Lancelot Six Reviewed-by: Vladimir Indic Cc: Shweta Khatri Signed-off-by: Alex Deucher commit 1197366cca89a4c44c541ddedb8ce8bf0757993d Author: Jinzhou Su Date: Wed Jan 21 16:42:11 2026 +0800 drm/amd/pm: Fix null pointer dereference issue If SMU is disabled, during RAS initialization, there will be null pointer dereference issue here. Signed-off-by: Jinzhou Su Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 1081c1649da989ef9cbc01ffa99babc190df6077 Author: Rafael J. Wysocki Date: Mon Jan 26 21:03:57 2026 +0100 PM: hibernate: Drop NULL pointer checks before acomp_request_free() Since acomp_request_free() checks its argument against NULL, the NULL pointer checks before calling it added by commit ("7966cf0ebe32 PM: hibernate: Fix crash when freeing invalid crypto compressor") are redundant, so drop them. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/6233709.lOV4Wx5bFT@rafael.j.wysocki commit a1fe789a96fe47733c133134fd264cb7ca832395 Author: Felix Gu Date: Sat Jan 24 03:06:40 2026 +0800 thermal/of: Fix reference leak in thermal_of_cm_lookup() In thermal_of_cm_lookup(), tr_np is obtained via of_parse_phandle(), but never released. Use the __free(device_node) cleanup attribute to automatically release the node and fix the leak. Fixes: 423de5b5bc5b ("thermal/of: Fix cdev lookup in thermal_of_should_bind()") Signed-off-by: Felix Gu Reviewed-by: Lukasz Luba [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260124-thermal_of-v1-1-54d3416948cf@gmail.com Signed-off-by: Rafael J. Wysocki commit 1e461784c30452ee8e2a00d42f6b3d73ada61521 Author: Randy Dunlap Date: Tue Jan 27 22:24:46 2026 -0800 thermal: core: thermal_core.h: fix all kernel-doc warnings Resolve all kernel-doc warnings in thermal_core.h: Warning: drivers/thermal/thermal_core.h:99 bad line: trip point. Warning: drivers/thermal/thermal_core.h:101 bad line: passive trip point. Warning: drivers/thermal/thermal_core.h:152 struct member 'trips_attribute_group' not described in 'thermal_zone_device' Warning: drivers/thermal/thermal_core.h:152 struct member 'debugfs' not described in 'thermal_zone_device' Warning: drivers/thermal/thermal_core.h:152 struct member 'user_thresholds' not described in 'thermal_zone_device' Signed-off-by: Randy Dunlap Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/20260128062446.402175-1-rdunlap@infradead.org Signed-off-by: Rafael J. Wysocki commit 7cf28b3797a81b616bb7eb3e90cf131afc452919 Author: Yicong Yang Date: Wed Jan 28 21:28:47 2026 +0800 ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() The device object rescan in acpi_scan_clear_dep_fn() is scheduled on a system workqueue which is not guaranteed to be finished before entering userspace. This may cause some key devices to be missing when userspace init task tries to find them. Two issues observed on RISCV platforms: - Kernel panic due to userspace init cannot have an opened console. The console device scanning is queued by acpi_scan_clear_dep_queue() and not finished by the time userspace init process running, thus by the time userspace init runs, no console is present. - Entering rescue shell due to the lack of root devices (PCIe nvme in our case). Same reason as above, the PCIe host bridge scanning is queued on a system workqueue and finished after init process runs. The reason is because both devices (console, PCIe host bridge) depend on riscv-aplic irqchip to serve their interrupts (console's wired interrupt and PCI's INTx interrupts). In order to keep the dependency, these devices are scanned and created after initializing riscv-aplic. The riscv-aplic is initialized in device_initcall() and a device scan work is queued via acpi_scan_clear_dep_queue(), which is close to the time userspace init process is run. Since system_dfl_wq is used in acpi_scan_clear_dep_queue() with no synchronization, the issues will happen if userspace init runs before these devices are ready. The solution is to wait for the queued work to complete before entering userspace init. One possible way would be to use a dedicated workqueue instead of system_dfl_wq, and explicitly flush it somewhere in the initcall stage before entering userspace. Another way is to use async_schedule_dev_nocall() for scanning these devices. It's designed for asynchronous initialization and will work in the same way as before because it's using a dedicated unbound workqueue as well, but the kernel init code calls async_synchronize_full() right before entering userspace init which will wait for the work to complete. Compared to a dedicated workqueue, the second approach is simpler because the async schedule framework takes care of all of the details. The ACPI code only needs to focus on its job. A dedicated workqueue for this could also be redundant because some platforms don't need acpi_scan_clear_dep_queue() for their device scanning. Signed-off-by: Yicong Yang [ rjw: Subject adjustment, changelog edits ] Link: https://patch.msgid.link/20260128132848.93638-1-yang.yicong@picoheart.com Signed-off-by: Rafael J. Wysocki commit 229ecbaac6b31f89c554b77eb407377a5eade7d4 Author: Jakob Riemenschneider Date: Tue Jan 27 21:01:21 2026 +0100 ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) Windows 11, version 22H2 introduced a new function index (Function 9) to the Microsoft LPS0 _DSM, titled "Turn On Display Notification". According to Microsoft documentation, this function signals to the system firmware that the OS intends to turn on the display when exiting Modern Standby. This allows the firmware to release Power Limits (PLx) earlier. Crucially, this patch fixes a functional issue observed on the Lenovo Yoga Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to resume after suspend. Investigation linked shows the EC on this device turns off these components during sleep but requires the Function 9 notification to wake them up again. This patch defines the new function index (ACPI_MS_TURN_ON_DISPLAY) and invokes it in acpi_s2idle_restore_early_lps0(). The execution order is updated to match the logic of an "intent" signal: 1. LPS0 Exit (Function 6) 2. Turn On Display Intent (Function 9) 3. Modern Standby Exit (Function 8) 4. Screen On (Function 4) Invoking Function 9 before the Modern Standby Exit ensures the firmware has time to restore power rails and functionality (like fans) before the software fully exits the sleep state. Link: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications#turn-on-display-notification-function-9 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220505 Suggested-by: Antheas Kapenekakis Signed-off-by: Jakob Riemenschneider Link: https://patch.msgid.link/20260127200121.1292216-1-riemenschneiderjakob@gmail.com Signed-off-by: Rafael J. Wysocki commit 77ee3ba5d4152f01ba4674b0e0ae51f8a51250bf Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:38 2026 +0100 spi: cadence-qspi: Use a default value for cdns,fifo-width Bindings expect 4 to be the default value for cdns,fifo-width. Said otherwise, if the property (which is not mandatory) is not provided, the OS, in order to comply with the bindings, should not error out and take 4 as default value. Comply with the bindings. This would have slighlty simplyfied my testing if it had been implemented correctly in the first place, but in practice it should have no impact on the existing boards using this controller, as they all set cdns,fifo-width to 4 explicitly in their upstream DTS. Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-13-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit 590f2430733f1302a78ac405370b8f01038adbf5 Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:37 2026 +0100 spi: cadence-qspi: Make sure write protection is disabled Renesas RZ/N1 QSPI controllers embed the Cadence IP with some modifications. For instance, they feature a write protection of the direct mapping at the controller level, with this feature all data writes to the AHB region are aborted. Despite the fact that the flag setting write protection is disabled by default, Bootloaders may (and actually do) set it, so mark this feature as being available with a specific flag to, if applicable, make sure it is disabled. Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-12-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit ae62e7cf6ab52cebc83feb0bcb374082eaabbf5e Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:36 2026 +0100 spi: cadence-qspi: Add a flag for controllers without indirect access support Renesas RZ/N1 QSPI controllers embed the Cadence IP with some limitations/simplifications. One of the is that only direct access is supported, none of the registers related to indirect writes are populated, so create a flag to avoid these accesses and make sure only direct accessors are called. Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-11-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit 612227b392eed94a3398dc03334a84a699a82276 Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:34 2026 +0100 spi: cadence-qspi: Try hard to disable the clocks In the remove path, we should try hard to perform all steps as we simply cannot fail. The "no runtime PM" quirk must only alter the state of the RPM core, but the clocks should still be disabled if that is possible. Move the disable call outside of the RPM quirk. Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-9-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit f18c8cfa4f1af2cf7d68d86989a7d6109acfa1bb Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:33 2026 +0100 spi: cadence-qspi: Fix probe error path and remove The probe has been modified by many different users, it is hard to track history, but for sure its current state is partially broken. One easy rule to follow is to drop/free/release the resources in the opposite order they have been queried. Fix the labels, the order for freeing the resources, and add the missing DMA channel step. Replicate these changes in the remove path as well. Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-8-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit bee085476d277e1f993cdec57e3c730f536594f0 Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:32 2026 +0100 spi: cadence-qspi: Make sure we filter out unsupported ops The Cadence driver does not support anything else than repeating the command opcode twice while in octal DTR mode. Make this clear by checking for this in the ->supports_op() hook. Reviewed-by: Pratyush Yadav Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-7-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit 453c5d60d896398c32854b683aff6d5b8386fa03 Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:31 2026 +0100 spi: cadence-qspi: Remove an useless operation Right above writing the register value back based on 'div' value, there is the following check: if (div > CQSPI_REG_CONFIG_BAUD_MASK) div = CQSPI_REG_CONFIG_BAUD_MASK; which means div does not need to be AND'ed against the bitfield mask. Remove this redundant operation. Reviewed-by: Pratyush Yadav Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-6-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit ec2da8bb0bc518ca5458d36de9aeec493ed5a790 Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:30 2026 +0100 spi: cadence-qspi: Fix ORing style and alignments These definitions do not follow the standard patterns. Alignments are incoherent and the logical OR symbols '|' are misplaced. Reorganize these definitions. There is no functional change. Acked-by: Pratyush Yadav Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-5-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit aac733a9663682387013350b4470a81344960f5d Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:29 2026 +0100 spi: cadence-qspi: Fix style and improve readability It took me several seconds to correctly understand this block. I understand the goal: showing that we are in the if, or in one of the two other cases. Improve the organization of the code to both improve readability and fix the style. Suggested-by: Pratyush Yadav Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-4-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit 9dfc9c1c830717686908e2c16867d8dfae5cf5e7 Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:28 2026 +0100 spi: cadence-qspi: Align definitions Fix alignment on the #defines. Reviewed-by: Pratyush Yadav Tested-by: Wolfram Sang Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-3-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit ade3f7f883723cca5e1c967e574680b410226566 Author: Miquel Raynal (Schneider Electric) Date: Thu Jan 22 16:13:26 2026 +0100 spi: dt-bindings: cdns,qspi-nor: Drop label in example The label is useless here. Plus, if there are several examples with the same label, we'll get very useless yet annoying warnings. Acked-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal (Schneider Electric) Tested-by: Santhosh Kumar K Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-1-f9c21419a3e6@bootlin.com Signed-off-by: Mark Brown commit 57d5287b7eb334e0b772be74d6ff9f2f22f0512c Author: Tony W Wang-oc Date: Wed Jan 28 10:52:16 2026 +0800 ACPI: APEI: GHES: Add ghes_edac support for __ZX__ and _BYO_ systems Let ghes_edac be the preferred driver to load on __ZX__ and _BYO_ systems by extending the platform detection list in ghes.c Signed-off-by: Tony W Wang-oc Tested-by: Lyle Li Acked-by: Borislav Petkov (AMD) [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260128025216.12564-1-TonyWWang-oc@zhaoxin.com Signed-off-by: Rafael J. Wysocki commit b584bfbd7ec417f257f651cc00a90c66e31dfbf1 Author: Nathan Chancellor Date: Wed Jan 14 16:27:11 2026 -0700 ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18 After a recent innocuous change to drivers/acpi/apei/ghes.c, building ARCH=arm64 allmodconfig with clang-17 or older (which has both CONFIG_KASAN=y and CONFIG_WERROR=y) fails with: drivers/acpi/apei/ghes.c:902:13: error: stack frame size (2768) exceeds limit (2048) in 'ghes_do_proc' [-Werror,-Wframe-larger-than] 902 | static void ghes_do_proc(struct ghes *ghes, | ^ A KASAN pass that removes unneeded stack instrumentation, enabled by default in clang-18 [1], drastically improves stack usage in this case. To avoid the warning in the common allmodconfig case when it can break the build, disable KASAN for ghes.o when compile testing with clang-17 and older. Disabling KASAN outright may hide legitimate runtime issues, so live with the warning in that case; the user can either increase the frame warning limit or disable -Werror, which they should probably do when debugging with KASAN anyways. Closes: https://github.com/ClangBuiltLinux/linux/issues/2148 Link: https://github.com/llvm/llvm-project/commit/51fbab134560ece663517bf1e8c2a30300d08f1a [1] Signed-off-by: Nathan Chancellor Cc: All applicable Link: https://patch.msgid.link/20260114-ghes-avoid-wflt-clang-older-than-18-v1-1-9c8248bfe4f4@kernel.org Signed-off-by: Rafael J. Wysocki commit 72ecf75c58116c0fe07e34ba4fff5020e55c9097 Author: Bibo Mao Date: Tue Jan 13 11:05:56 2026 +0800 crypto: virtio: Replace package id with numa node id With multiple virtio crypto devices supported with different NUMA nodes, when crypto session is created, it will search virtio crypto device with the same numa node of current CPU. Here API topology_physical_package_id() is replaced with cpu_to_node() since package id is physical concept, and one package id have multiple memory numa id. Signed-off-by: Bibo Mao Acked-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260113030556.3522533-4-maobibo@loongson.cn> commit a389d431053935366b88a8fbf271f1a564b9a44e Author: Bibo Mao Date: Tue Jan 13 11:05:55 2026 +0800 crypto: virtio: Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req With function virtio_crypto_skcipher_crypt_req(), there is already virtqueue_kick() call with spinlock held in function __virtio_crypto_skcipher_do_req(). Remove duplicated virtqueue_kick() function call here. Fixes: d79b5d0bbf2e ("crypto: virtio - support crypto engine framework") Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260113030556.3522533-3-maobibo@loongson.cn> commit af9a17d29ce9060664f56264bcc64b976fddd2b5 Author: Bibo Mao Date: Tue Jan 13 11:05:54 2026 +0800 crypto: virtio: Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this: virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well. Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet") Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20260113030556.3522533-2-maobibo@loongson.cn> commit 7a9dc249e750975fc5bdb44439eaed57243b709d Author: Eugenio Pérez Date: Mon Jan 19 15:33:06 2026 +0100 Documentation: Add documentation for VDUSE Address Space IDs Address Space IDs allows the VDUSE framework to support devices able to expose different virtqueues to different part of the drivers. For example, to let QEMU handle the net device control virtqueue, so QEMU always knows the state of the device like mac address or number of queues enabled, while leaving the dataplane passthrough to the guest intact. This enables live migration. Expands the VDUSE documentation to explain how to use the new ioctls or the new struct members of old ioctls. Acked-by: Jason Wang Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-14-eperezma@redhat.com> commit 12e0043d335f6c8badfe98f1d8f5e1910d430cf0 Author: Eugenio Pérez Date: Mon Jan 19 15:33:05 2026 +0100 vduse: bump version number Finalize the series by advertising VDUSE API v1 support to userspace. Now that all required infrastructure for v1 (ASIDs, VQ groups, update_iotlb_v2) is in place, VDUSE devices can opt in to the new features. Assume API version 0 if the VDUSE instance does not call VDUSE_GET_API_VERSION to maintain compatibility. Acked-by: Jason Wang Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-13-eperezma@redhat.com> commit 079212f6877e5d07308c8998a8fbc7539ca3f8f3 Author: Eugenio Pérez Date: Mon Jan 19 15:33:04 2026 +0100 vduse: add vq group asid support Add support for assigning Address Space Identifiers (ASIDs) to each VQ group. This enables mapping each group into a distinct memory space. The vq group to ASID association is protected by a rwlock now. But the mutex domain_lock keeps protecting the domains of all ASIDs, as some operations like the one related with the bounce buffer size still requires to lock all the ASIDs. Acked-by: Jason Wang Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-12-eperezma@redhat.com> commit f3dc3a8a3ea71d4758b0f63affceb18398cf79b8 Author: Eugenio Pérez Date: Mon Jan 19 15:33:03 2026 +0100 vduse: merge tree search logic of IOTLB_GET_FD and IOTLB_GET_INFO ioctls The next patch adds new ioctl with the ASID member per entry. Abstract these two so it can be build on top easily. Acked-by: Jason Wang Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-11-eperezma@redhat.com> commit 489d76520612abf9a4ede4344349105406c91a73 Author: Eugenio Pérez Date: Mon Jan 19 15:33:02 2026 +0100 vduse: take out allocations from vduse_dev_alloc_coherent The function vduse_dev_alloc_coherent will be called under rwlock in next patches. Make it out of the lock to avoid increasing its fail rate. Acked-by: Jason Wang Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-10-eperezma@redhat.com> commit 766e1749c0ef6a09651be9b8a8283d508c322b58 Author: Eugenio Pérez Date: Mon Jan 19 15:33:01 2026 +0100 vduse: remove unused vaddr parameter of vduse_domain_free_coherent We will modify the function in next patches so let's clean it first. Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-9-eperezma@redhat.com> commit 3e2ddda6f4cb9e25e2e0a24033e13e347d6ce952 Author: Eugenio Pérez Date: Mon Jan 19 15:33:00 2026 +0100 vduse: refactor vdpa_dev_add for goto err handling Next patches introduce more error paths in this function. Refactor it so they can be accommodated through gotos. Acked-by: Jason Wang Reviewed-by: Xie Yongji Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-8-eperezma@redhat.com> commit 3543b04a4ea3de78bdc420350d21c538efd6116c Author: Eugenio Pérez Date: Mon Jan 19 15:32:59 2026 +0100 vhost: forbid change vq groups ASID if DRIVER_OK is set Only vdpa_sim support it. Forbid this behaviour as there is no use for it right now, we can always enable it in the future with a feature flag. Acked-by: Jason Wang Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-7-eperezma@redhat.com> commit 0d215afdc8199ef9702567778bbc781449f48e50 Author: Eugenio Pérez Date: Mon Jan 19 15:32:58 2026 +0100 vdpa: document set_group_asid thread safety Document that the function races with the check of DRIVER_OK. Acked-by: Jason Wang Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-6-eperezma@redhat.com> commit 02e3f7ffe2906033da73b7c7ea8180b131d0cdbc Author: Eugenio Pérez Date: Mon Jan 19 15:32:57 2026 +0100 vduse: return internal vq group struct as map token Return the internal struct that represents the vq group as virtqueue map token, instead of the device. This allows the map functions to access the information per group. At this moment all the virtqueues share the same vq group, that only can point to ASID 0. This change prepares the infrastructure for actual per-group address space handling Acked-by: Jason Wang Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-5-eperezma@redhat.com> commit 9350a09afd086771b0612c7b7c9583e8a1568135 Author: Eugenio Pérez Date: Mon Jan 19 15:32:56 2026 +0100 vduse: add vq group support This allows separate the different virtqueues in groups that shares the same address space. Asking the VDUSE device for the groups of the vq at the beginning as they're needed for the DMA API. Allocating 3 vq groups as net is the device that need the most groups: * Dataplane (guest passthrough) * CVQ * Shadowed vrings. Future versions of the series can include dynamic allocation of the groups array so VDUSE can declare more groups. Acked-by: Jason Wang Reviewed-by: Xie Yongji Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-4-eperezma@redhat.com> commit a006ed4ecd4905b69402980ad7d4e5f31bf44953 Author: Eugenio Pérez Date: Mon Jan 19 15:32:55 2026 +0100 vduse: add v1 API definition This allows the kernel to detect whether the userspace VDUSE device supports the VQ group and ASID features. VDUSE devices that don't set the V1 API will not receive the new messages, and vdpa device will be created with only one vq group and asid. The next patches implement the new feature incrementally, only enabling the VDUSE device to set the V1 API version by the end of the series. Acked-by: Jason Wang Reviewed-by: Xie Yongji Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-3-eperezma@redhat.com> commit cd025c1e876b4e262e71398236a1550486a73ede Author: Eugenio Pérez Date: Mon Jan 19 15:32:54 2026 +0100 vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write. Cc: stable@vger.kernel.org Fixes: bda324fd037a ("vdpasim: control virtqueue support") Acked-by: Jason Wang Signed-off-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-Id: <20260119143306.1818855-2-eperezma@redhat.com> commit 74bc5f69bd3b7fa099fca67268f10532e3dae916 Author: Michael S. Tsirkin Date: Mon Jan 5 16:05:42 2026 -0500 checkpatch: special-case cacheline group macros Currently, cacheline group macros trigger checkpatch warnings. For example: $ ./scripts/checkpatch.pl -g ba7e025a6c84aed012421468d83639e5dae982b0 WARNING: Missing a blank line after declarations #58: FILE: drivers/gpio/gpio-virtio.c:32: + struct virtio_gpio_response res; + __dma_from_device_group_end(); $ ./scripts/checkpatch.pl -g 5d4cc87414c5d11345c4b11d61377d351b5c28a2 WARNING: Missing a blank line after declarations #267: FILE: include/net/sock.h:431: + int sk_rcvlowat; + __cacheline_group_end(sock_read_rx); But these are not actually statements - the following macros all expand to zero-length fields: __cacheline_group_begin() __cacheline_group_end() __cacheline_group_begin_aligned() __cacheline_group_end_aligned() __dma_from_device_group_begin() __dma_from_device_group_end() Add them to $declaration_macros so checkpatch recognizes this fact. Message-ID: Signed-off-by: Michael S. Tsirkin commit 1a266b6d9cfa42997f31942d1754ddf220ba7a1c Author: Michael S. Tsirkin Date: Mon Dec 29 18:58:05 2025 -0500 gpio: virtio: reorder fields to reduce struct padding Reorder struct virtio_gpio_line fields to place the DMA buffers (req/res) last. This eliminates the padding from aligning struct size on ARCH_DMA_MINALIGN. Acked-by: Viresh Kumar Message-ID: Acked-by: Bartosz Golaszewski Signed-off-by: Michael S. Tsirkin commit 29615fe3fb5015a96a14cfa43bd168034719ddeb Author: Michael S. Tsirkin Date: Tue Dec 30 08:04:15 2025 -0500 gpio: virtio: fix DMA alignment The res and ires buffers in struct virtio_gpio_line and struct vgpio_irq_line respectively are used for DMA_FROM_DEVICE via virtqueue_add_sgs(). However, within these structs, even though these elements are tagged as ____cacheline_aligned, adjacent struct elements can share DMA cachelines on platforms where ARCH_DMA_MINALIGN > L1_CACHE_BYTES (e.g., arm64 with 128-byte DMA alignment but 64-byte cache lines). The existing ____cacheline_aligned annotation aligns to L1_CACHE_BYTES which is not always sufficient for DMA alignment. For example, with L1_CACHE_BYTES = 32 and ARCH_DMA_MINALIGN = 128 - irq_lines[0].ires at offset 128 - irq_lines[1].type at offset 192 both in same 128-byte DMA cacheline [128-256) When the device writes to irq_lines[0].ires and the CPU concurrently modifies one of irq_lines[1].type/disabled/masked/queued flags, corruption can occur on non-cache-coherent platforms. Fix by using __dma_from_device_group_begin()/end() annotations on the DMA buffers. Drop ____cacheline_aligned - it's not required to isolate request and response, and keeping them would increase the memory cost. Acked-by: Viresh Kumar Message-ID: Acked-by: Bartosz Golaszewski Signed-off-by: Michael S. Tsirkin commit f9108dee782fe45318a2c9f007fb72ab370d476d Author: Michael S. Tsirkin Date: Mon Dec 29 18:58:05 2025 -0500 vsock/virtio: reorder fields to reduce padding Reorder struct virtio_vsock fields to place the DMA buffer (event_list) last. This eliminates the padding from aligning the struct size on ARCH_DMA_MINALIGN. Message-ID: Signed-off-by: Michael S. Tsirkin commit 012e012e4917da06b512a3074980c3091949befa Author: Krzysztof Kozlowski Date: Wed Jan 28 16:43:07 2026 +0100 clk: qcom: sm8750: Constify 'qcom_cc_desc' in SM8750 camcc 'struct qcom_cc_desc' is passed to qcom_cc_map() and qcom_cc_really_probe() only as pointer to const, so make the memory const for safety. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Taniya Das Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260128154306.133047-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b682b70d016f6aee20d91dcbaa319a932008a83a Author: Marco Elver Date: Mon Jan 19 10:05:56 2026 +0100 compiler-context-analysis: Remove __assume_ctx_lock from initializers Remove __assume_ctx_lock() from lock initializers. Implicitly asserting an active context during initialization caused false-positive double-lock errors when acquiring a lock immediately after its initialization. Moving forward, guarded member initialization must either: 1. Use guard(type_init)(&lock) or scoped_guard(type_init, ...). 2. Use context_unsafe() for simple initialization. Reported-by: Bart Van Assche Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/57062131-e79e-42c2-aa0b-8f931cb8cac2@acm.org/ Link: https://patch.msgid.link/20260119094029.1344361-7-elver@google.com commit 41539433b32d71aea9f7ada84dc6a8bd014ca50d Author: Marco Elver Date: Mon Jan 19 10:05:55 2026 +0100 tomoyo: Use scoped init guard Convert lock initialization to scoped guarded initialization where lock-guarded members are initialized in the same scope. This ensures the context analysis treats the context as active during member initialization. This is required to avoid errors once implicit context assertion is removed. Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260119094029.1344361-6-elver@google.com commit f39261f55b3ee58d85e96142763c25b945399b2f Author: Marco Elver Date: Mon Jan 19 10:05:54 2026 +0100 crypto: Use scoped init guard Convert lock initialization to scoped guarded initialization where lock-guarded members are initialized in the same scope. This ensures the context analysis treats the context as active during member initialization. This is required to avoid errors once implicit context assertion is removed. Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260119094029.1344361-5-elver@google.com commit b7be9442a3758a27a4b09b75ad79f3626b16ec3d Author: Marco Elver Date: Mon Jan 19 10:05:53 2026 +0100 kcov: Use scoped init guard Convert lock initialization to scoped guarded initialization where lock-guarded members are initialized in the same scope. This ensures the context analysis treats the context as active during member initialization. This is required to avoid errors once implicit context assertion is removed. Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260119094029.1344361-4-elver@google.com commit d084a73714f818ce509022e1aa9483cabf797c16 Author: Marco Elver Date: Mon Jan 19 10:05:52 2026 +0100 compiler-context-analysis: Introduce scoped init guards Add scoped init guard definitions for common synchronization primitives supported by context analysis. The scoped init guards treat the context as active within initialization scope of the underlying context lock, given initialization implies exclusive access to the underlying object. This allows initialization of guarded members without disabling context analysis, while documenting initialization from subsequent usage. The documentation is updated with the new recommendation. Where scoped init guards are not provided or cannot be implemented (ww_mutex omitted for lack of multi-arg guard initializers), the alternative is to just disable context analysis where guarded members are initialized. Suggested-by: Peter Zijlstra Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20251212095943.GM3911114@noisy.programming.kicks-ass.net/ Link: https://patch.msgid.link/20260119094029.1344361-3-elver@google.com commit 3b9ed30344a866f6f96896b3ce64303b9074682b Author: Marco Elver Date: Mon Jan 19 10:05:51 2026 +0100 cleanup: Make __DEFINE_LOCK_GUARD handle commas in initializers Initialization macros can expand to structure initializers containing commas, which when used as a "lock" function resulted in errors such as: >> include/linux/spinlock.h:582:56: error: too many arguments provided to function-like macro invocation 582 | DEFINE_LOCK_GUARD_1(raw_spinlock_init, raw_spinlock_t, raw_spin_lock_init(_T->lock), /* */) | ^ include/linux/spinlock.h:113:17: note: expanded from macro 'raw_spin_lock_init' 113 | do { *(lock) = __RAW_SPIN_LOCK_UNLOCKED(lock); } while (0) | ^ include/linux/spinlock_types_raw.h:70:19: note: expanded from macro '__RAW_SPIN_LOCK_UNLOCKED' 70 | (raw_spinlock_t) __RAW_SPIN_LOCK_INITIALIZER(lockname) | ^ include/linux/spinlock_types_raw.h:67:34: note: expanded from macro '__RAW_SPIN_LOCK_INITIALIZER' 67 | RAW_SPIN_DEP_MAP_INIT(lockname) } | ^ include/linux/cleanup.h:496:9: note: macro '__DEFINE_LOCK_GUARD_1' defined here 496 | #define __DEFINE_LOCK_GUARD_1(_name, _type, _lock) \ | ^ include/linux/spinlock.h:582:1: note: parentheses are required around macro argument containing braced initializer list 582 | DEFINE_LOCK_GUARD_1(raw_spinlock_init, raw_spinlock_t, raw_spin_lock_init(_T->lock), /* */) | ^ | ( include/linux/cleanup.h:558:60: note: expanded from macro 'DEFINE_LOCK_GUARD_1' 558 | __DEFINE_UNLOCK_GUARD(_name, _type, _unlock, __VA_ARGS__) \ | ^ Make __DEFINE_LOCK_GUARD_0 and __DEFINE_LOCK_GUARD_1 variadic so that __VA_ARGS__ captures everything. Reported-by: kernel test robot Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260119094029.1344361-2-elver@google.com commit ba225407f80ee28f42301002bd5fda8fffd85615 Merge: ae23bc81ddf7c1 424f6a3610965d Author: Andrii Nakryiko Date: Wed Jan 28 11:42:17 2026 -0800 Merge branch 'ftrace-bpf-use-single-direct-ops-for-bpf-trampolines' Jiri Olsa says: ==================== ftrace,bpf: Use single direct ops for bpf trampolines hi, while poking the multi-tracing interface I ended up with just one ftrace_ops object to attach all trampolines. This change allows to use less direct API calls during the attachment changes in the future code, so in effect speeding up the attachment. In current code we get a speed up from using just a single ftrace_ops object. - with current code: Performance counter stats for 'bpftrace -e fentry:vmlinux:ksys_* {} -c true': 6,364,157,902 cycles:k 828,728,902 cycles:u 1,064,803,824 instructions:u # 1.28 insn per cycle 23,797,500,067 instructions:k # 3.74 insn per cycle 4.416004987 seconds time elapsed 0.164121000 seconds user 1.289550000 seconds sys - with the fix: Performance counter stats for 'bpftrace -e fentry:vmlinux:ksys_* {} -c true': 6,535,857,905 cycles:k 810,809,429 cycles:u 1,064,594,027 instructions:u # 1.31 insn per cycle 23,962,552,894 instructions:k # 3.67 insn per cycle 1.666961239 seconds time elapsed 0.157412000 seconds user 1.283396000 seconds sys The speedup seems to be related to the fact that with single ftrace_ops object we don't call ftrace_shutdown anymore (we use ftrace_update_ops instead) and we skip the synchronize rcu calls (each ~100ms) at the end of that function. rfc: https://lore.kernel.org/bpf/20250729102813.1531457-1-jolsa@kernel.org/ v1: https://lore.kernel.org/bpf/20250923215147.1571952-1-jolsa@kernel.org/ v2: https://lore.kernel.org/bpf/20251113123750.2507435-1-jolsa@kernel.org/ v3: https://lore.kernel.org/bpf/20251120212402.466524-1-jolsa@kernel.org/ v4: https://lore.kernel.org/bpf/20251203082402.78816-1-jolsa@kernel.org/ v5: https://lore.kernel.org/bpf/20251215211402.353056-10-jolsa@kernel.org/ v6 changes: - rename add_hash_entry_direct to add_ftrace_hash_entry_direct [Steven] - factor hash_add/hash_sub [Steven] - add kerneldoc header for update_ftrace_direct_* functions [Steven] - few assorted smaller fixes [Steven] - added missing direct_ops wrappers for !CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS case [Steven] v5 changes: - do not export ftrace_hash object [Steven] - fix update_ftrace_direct_add new_filter_hash leak [ci] v4 changes: - rebased on top of bpf-next/master (with jmp attach changes) added patch 1 to deal with that - added extra checks for update_ftrace_direct_del/mod to address the ci bot review v3 changes: - rebased on top of bpf-next/master - fixed update_ftrace_direct_del cleanup path - added missing inline to update_ftrace_direct_* stubs v2 changes: - rebased on top fo bpf-next/master plus Song's livepatch fixes [1] - renamed the API functions [2] [Steven] - do not export the new api [Steven] - kept the original direct interface: I'm not sure if we want to melt both *_ftrace_direct and the new interface into single one. It's bit different in semantic (hence the name change as Steven suggested [2]) and I don't think the changes are not that big so we could easily keep both APIs. v1 changes: - make the change x86 specific, after discussing with Mark options for arm64 [Mark] thanks, jirka [1] https://lore.kernel.org/bpf/20251027175023.1521602-1-song@kernel.org/ [2] https://lore.kernel.org/bpf/20250924050415.4aefcb91@batman.local.home/ --- ==================== Link: https://patch.msgid.link/20251230145010.103439-1-jolsa@kernel.org Signed-off-by: Andrii Nakryiko commit 424f6a3610965d125634bc65c5d6d506582d4f7e Author: Jiri Olsa Date: Tue Dec 30 15:50:10 2025 +0100 bpf,x86: Use single ftrace_ops for direct calls Using single ftrace_ops for direct calls update instead of allocating ftrace_ops object for each trampoline. With single ftrace_ops object we can use update_ftrace_direct_* api that allows multiple ip sites updates on single ftrace_ops object. Adding HAVE_SINGLE_FTRACE_DIRECT_OPS config option to be enabled on each arch that supports this. At the moment we can enable this only on x86 arch, because arm relies on ftrace_ops object representing just single trampoline image (stored in ftrace_ops::direct_call). Archs that do not support this will continue to use *_ftrace_direct api. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20251230145010.103439-10-jolsa@kernel.org commit 956747efd82aa60e0ac3e6aef2b9a17adda6f3b1 Author: Jiri Olsa Date: Tue Dec 30 15:50:09 2025 +0100 ftrace: Factor ftrace_ops ops_func interface We are going to remove "ftrace_ops->private == bpf_trampoline" setup in following changes. Adding ip argument to ftrace_ops_func_t callback function, so we can use it to look up the trampoline. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20251230145010.103439-9-jolsa@kernel.org commit 7d0452497c292153e690652e6df218fead21185f Author: Jiri Olsa Date: Tue Dec 30 15:50:08 2025 +0100 bpf: Add trampoline ip hash table Following changes need to lookup trampoline based on its ip address, adding hash table for that. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251230145010.103439-8-jolsa@kernel.org commit e93672f770d72f4c33d1dd9fb0633f95948c0cc9 Author: Jiri Olsa Date: Tue Dec 30 15:50:07 2025 +0100 ftrace: Add update_ftrace_direct_mod function Adding update_ftrace_direct_mod function that modifies all entries (ip -> direct) provided in hash argument to direct ftrace ops and updates its attachments. The difference to current modify_ftrace_direct is: - hash argument that allows to modify multiple ip -> direct entries at once This change will allow us to have simple ftrace_ops for all bpf direct interface users in following changes. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20251230145010.103439-7-jolsa@kernel.org commit 8d2c1233f37149e4d1223d06ca7054a7f88c0a24 Author: Jiri Olsa Date: Tue Dec 30 15:50:06 2025 +0100 ftrace: Add update_ftrace_direct_del function Adding update_ftrace_direct_del function that removes all entries (ip -> addr) provided in hash argument to direct ftrace ops and updates its attachments. The difference to current unregister_ftrace_direct is - hash argument that allows to unregister multiple ip -> direct entries at once - we can call update_ftrace_direct_del multiple times on the same ftrace_ops object, becase we do not need to unregister all entries at once, we can do it gradualy with the help of ftrace_update_ops function This change will allow us to have simple ftrace_ops for all bpf direct interface users in following changes. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20251230145010.103439-6-jolsa@kernel.org commit 05dc5e9c1fe156fd9dddc4c2f81e8fc6c7e50eb5 Author: Jiri Olsa Date: Tue Dec 30 15:50:05 2025 +0100 ftrace: Add update_ftrace_direct_add function Adding update_ftrace_direct_add function that adds all entries (ip -> addr) provided in hash argument to direct ftrace ops and updates its attachments. The difference to current register_ftrace_direct is - hash argument that allows to register multiple ip -> direct entries at once - we can call update_ftrace_direct_add multiple times on the same ftrace_ops object, becase after first registration with register_ftrace_function_nolock, it uses ftrace_update_ops to update the ftrace_ops object This change will allow us to have simple ftrace_ops for all bpf direct interface users in following changes. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20251230145010.103439-5-jolsa@kernel.org commit 0e860d07c29d70205d5ad48456ac7a133ccfb293 Author: Jiri Olsa Date: Tue Dec 30 15:50:04 2025 +0100 ftrace: Export some of hash related functions We are going to use these functions in following changes. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20251230145010.103439-4-jolsa@kernel.org commit 676bfeae7bd55ca405670798711ac7c46b48655d Author: Jiri Olsa Date: Tue Dec 30 15:50:03 2025 +0100 ftrace: Make alloc_and_copy_ftrace_hash direct friendly Make alloc_and_copy_ftrace_hash to copy also direct address for each hash entry. Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20251230145010.103439-3-jolsa@kernel.org commit 4be42c92220128b3128854a2d6b0f0ad0bcedbdb Author: Jiri Olsa Date: Tue Dec 30 15:50:02 2025 +0100 ftrace,bpf: Remove FTRACE_OPS_FL_JMP ftrace_ops flag At the moment the we allow the jmp attach only for ftrace_ops that has FTRACE_OPS_FL_JMP set. This conflicts with following changes where we use single ftrace_ops object for all direct call sites, so all could be be attached via just call or jmp. We already limit the jmp attach support with config option and bit (LSB) set on the trampoline address. It turns out that's actually enough to limit the jmp attach for architecture and only for chosen addresses (with LSB bit set). Each user of register_ftrace_direct or modify_ftrace_direct can set the trampoline bit (LSB) to indicate it has to be attached by jmp. The bpf trampoline generation code uses trampoline flags to generate jmp-attach specific code and ftrace inner code uses the trampoline bit (LSB) to handle return from jmp attachment, so there's no harm to remove the FTRACE_OPS_FL_JMP bit. The fexit/fmodret performance stays the same (did not drop), current code: fentry : 77.904 ± 0.546M/s fexit : 62.430 ± 0.554M/s fmodret : 66.503 ± 0.902M/s with this change: fentry : 80.472 ± 0.061M/s fexit : 63.995 ± 0.127M/s fmodret : 67.362 ± 0.175M/s Fixes: 25e4e3565d45 ("ftrace: Introduce FTRACE_OPS_FL_JMP") Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Reviewed-by: Steven Rostedt (Google) Link: https://lore.kernel.org/bpf/20251230145010.103439-2-jolsa@kernel.org commit 88340fc880cae6a2953a366aa6ad0900fd9830da Author: Kuninori Morimoto Date: Wed Jan 28 02:19:00 2026 +0000 ASoC: soc-core: add lockdep_assert_held() at snd_soc_unregister_dai() snd_soc_register_dai() has lockdep_assert_held() (A), but snd_soc_unregister_dai() doesn't have lockdep_assert_held() (B). void snd_soc_unregister_dai(...) { (B) dev_dbg(...); list_del(...); } struct snd_soc_dai *snd_soc_register_dai(...) { ... (A) lockdep_assert_held(&client_mutex); ... } Both functions should be called with client_mutex lock. Add missing lockdep_assert_held() at snd_soc_unregister_dai(). Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87jyx21nu4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ff7ed83beab92d304f326a98c575c9fff7503f4c Author: Bastien Nocera Date: Tue Jan 13 10:24:59 2026 +0100 HID: sony: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit a864d16be15625df365a5945f566efc2e36f73c3 Author: Bastien Nocera Date: Tue Jan 13 10:24:58 2026 +0100 HID: wacom: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit d1de9bde979a62b3b331a801965d6e6fe8cbe17b Author: Bastien Nocera Date: Tue Jan 13 10:24:57 2026 +0100 HID: uclogic: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit b3e5bcffda372bea49555fef4e311687bed439bc Author: Bastien Nocera Date: Tue Jan 13 10:24:56 2026 +0100 HID: hid-sensor-hub: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit c9b66161ccf8ef39e28f6852838b881b205c6759 Author: Bastien Nocera Date: Tue Jan 13 10:24:55 2026 +0100 HID: picolcd_core: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit d7b7ce3dc616d78ee4be329fc17cac97fe08efb7 Author: Bastien Nocera Date: Tue Jan 13 10:24:54 2026 +0100 HID: nintendo: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit dcd2c3517807a438d9c22044c5570ac282e0cd8f Author: Bastien Nocera Date: Tue Jan 13 10:24:53 2026 +0100 HID: logitech-dj: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit 7e42d91c3b2eb959e1e9787ee808a1824aab0cb6 Author: Bastien Nocera Date: Tue Jan 13 10:24:52 2026 +0100 HID: lenovo: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit 72f3d4c50cfa8ff3f54d8ac6c2e15d1962091368 Author: Bastien Nocera Date: Tue Jan 13 10:24:51 2026 +0100 HID: asus: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit d7192e4dfa3603626aeea8c8c05ee8fd1e885a5d Author: Bastien Nocera Date: Tue Jan 13 10:24:50 2026 +0100 HID: appletb-kbd: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit 5e130f58629a2819c9d053507ad368160d25eb65 Author: Bastien Nocera Date: Tue Jan 13 10:24:49 2026 +0100 HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM This increases build coverage and allows to drop an #ifdef. Signed-off-by: Bastien Nocera Signed-off-by: Jiri Kosina commit e205952db7717557f71f22baa96589f0a56d83c5 Author: Ian Rogers Date: Tue Jan 27 10:45:06 2026 -0800 perf jevents: Validate that all names given an Event Validate they exist in a JSON file from one directory found from one directory above the model's JSON directory. This avoids broken fallback encodings being created. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 82e53e7ae09a054b00cf3afdddf7c378351cf3e0 Author: Ian Rogers Date: Tue Jan 27 10:45:05 2026 -0800 perf jevents: Add cycles breakdown metric for arm64/AMD/Intel Breakdown cycles to user, kernel and guest. Add a common_metrics.py file for such metrics. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit e74f72a7e21782332bb7b9541634199278f3461b Author: Ian Rogers Date: Tue Jan 27 10:45:04 2026 -0800 perf jevents: Add mesh bandwidth saturation metric for Intel Memory bandwidth saturation from CBOX/CHA events present in broadwellde, broadwellx, cascadelakex, haswellx, icelakex, skylakex and snowridgex. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 5dc81578ad77c298248a12de8b5e19923ef2c617 Author: Ian Rogers Date: Tue Jan 27 10:45:03 2026 -0800 perf jevents: Add upi_bw metric for Intel Break down UPI read and write bandwidth using uncore_upi counters. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 6ec3058e709cc63513bafe105bf48b512baabe04 Author: Ian Rogers Date: Tue Jan 27 10:45:02 2026 -0800 perf jevents: Add local/remote miss latency metrics for Intel Derive from CBOX/CHA occupancy and inserts the average latency as is provided in Intel's uncore performance monitoring reference. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 1fee2701a7d35fa7285479c5c2ee6c2d9bd99526 Author: Ian Rogers Date: Tue Jan 27 10:45:01 2026 -0800 perf jevents: Add C-State metrics from the PCU PMU for Intel Use occupancy events fixed in: https://lore.kernel.org/lkml/20240226201517.3540187-1-irogers@google.com/ Metrics are at the socket level referring to cores, not hyperthreads. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 2166b44be938420934181be34fe20deee6e46441 Author: Ian Rogers Date: Tue Jan 27 10:45:00 2026 -0800 perf jevents: Add dir breakdown metrics for Intel Breakdown directory hit, misses and requests. The implementation uses the M2M and CHA PMUs present in server models broadwellde, broadwellx cascadelakex, emeraldrapids, icelakex, sapphirerapids and skylakex. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit cde9c1a5d92520a874b333591ac29aef37b0c0cb Author: Ian Rogers Date: Tue Jan 27 10:44:59 2026 -0800 perf jevents: Add local/remote "mem" breakdown metrics for Intel Breakdown local and remote memory bandwidth, read and writes. The implementation uses the HA and CHA PMUs present in server models broadwellde, broadwellx cascadelakex, emeraldrapids, haswellx, icelakex, ivytown, sapphirerapids and skylakex. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 130f4245af99e140cc5dc93bdf8e59ffd9cc9d6f Author: Ian Rogers Date: Tue Jan 27 10:44:58 2026 -0800 perf jevents: Add mem_bw metric for Intel Break down memory bandwidth using uncore counters. For many models this matches the memory_bandwidth_* metrics, but these metrics aren't made available on all models. Add support for free running counters. Query the event JSON when determining which what events/counters are available. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 426b8442898de9afe256e3c415d272808d6b69fb Author: Ian Rogers Date: Tue Jan 27 10:44:57 2026 -0800 perf jevents: Add Miss Level Parallelism (MLP) metric for Intel Number of outstanding load misses per cycle. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit d666f0172ab306fa7b7af38499d51f4941460688 Author: Ian Rogers Date: Tue Jan 27 10:44:56 2026 -0800 perf jevents: Add FPU metrics for Intel Metrics break down of floating point operations. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 2f3d6ea05deca7c1c653e2e53d73ac5a81378d53 Author: Ian Rogers Date: Tue Jan 27 10:44:55 2026 -0800 perf jevents: Add context switch metrics for Intel Metrics break down context switches for different kinds of instruction. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 59341f4e171170d3e2be50047508569a57eee829 Author: Ian Rogers Date: Tue Jan 27 10:44:54 2026 -0800 perf jevents: Add ILP metrics for Intel Use the counter mask (cmask) to see how many cycles an instruction takes to retire. Present as a set of ILP metrics. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit d80edef23124baffa2cfd61a009933d03d982741 Author: Ian Rogers Date: Tue Jan 27 10:44:53 2026 -0800 perf jevents: Add load store breakdown metrics ldst for Intel Give breakdown of number of instructions. Use the counter mask (cmask) to show the number of cycles taken to retire the instructions. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 7413633e255cb02d59e9451e55fbe9e50310db18 Author: Ian Rogers Date: Tue Jan 27 10:44:52 2026 -0800 perf jevents: Add L2 metrics for Intel Give a breakdown of various L2 counters as metrics, including totals, reads, hardware prefetcher, RFO, code and evictions. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit cd1c6a487407a350970d1bea9d3e674f2a281179 Author: Ian Rogers Date: Tue Jan 27 10:44:51 2026 -0800 perf jevents: Add ports metric group giving utilization on Intel The ports metric group contains a metric for each port giving its utilization as a ratio of cycles. The metrics are created by looking for UOPS_DISPATCHED.PORT events. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 397fdb3a24435f55c4c675726d1b214954e7aa53 Author: Ian Rogers Date: Tue Jan 27 10:44:50 2026 -0800 perf jevents: Add software prefetch (swpf) metric group for Intel Add metrics that breakdown software prefetch instruction use. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 37d0b00a1ac85309e63700153049bc16fc446b19 Author: Ian Rogers Date: Tue Jan 27 10:44:49 2026 -0800 perf jevents: Add br metric group for branch statistics on Intel The br metric group for branches itself comprises metric groups for total, taken, conditional, fused and far metric groups using JSON events. Conditional taken and not taken metrics are specific to Icelake and later generations, so the presence of the event is used to determine whether the metric should exist. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 8c345f35003269eaceeb84b3b14588aeb2bae6f7 Author: Ian Rogers Date: Tue Jan 27 10:44:48 2026 -0800 perf jevents: Add tsx metric group for Intel models Allow duplicated metric to be dropped from JSON files. Detect when TSX is supported by a model by using the JSON events, use sysfs events at runtime as hypervisors, etc. may disable TSX. Add CheckPmu to metric to determine if which PMUs have been associated with the loaded events. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 7eb9fa417c0218fd4e3b8d18894d7b89c15fb8ba Author: Ian Rogers Date: Tue Jan 27 10:44:47 2026 -0800 perf jevents: Mark metrics with experimental events as experimental When metrics are made with experimental events it is desirable the metric description also carries this information in case of metric inaccuracies. Suggested-by: Perry Taylor Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 17d616b7d98dcc15561b83a7e1c78f304b8cea74 Author: Ian Rogers Date: Tue Jan 27 10:44:46 2026 -0800 perf jevents: Add smi metric group for Intel models Allow duplicated metric to be dropped from JSON files. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 61b7b2ef64f8c9cf48ae1b0bfe2ee0bcb9bb3181 Author: Ian Rogers Date: Tue Jan 27 10:44:45 2026 -0800 perf jevents: Add CheckPmu to see if a PMU is in loaded JSON events CheckPmu can be used to determine if hybrid events are present, allowing for hybrid conditional metrics/events/pmus to be premised on the JSON files rather than hard coded tables. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 1d519e5aa8ee025a13a822ed87fa6c9f249c63b1 Author: Ian Rogers Date: Tue Jan 27 10:44:44 2026 -0800 perf jevents: Add idle metric for Intel models Compute using the msr PMU the percentage of wallclock cycles where the CPUs are in a low power state. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit bab90b3b46cd74d5f562b0a7b2bef1222e8960af Author: Ian Rogers Date: Tue Jan 27 10:44:43 2026 -0800 perf jevents: Add RAPL metrics for all Intel models Add a 'cpu_power' metric group that computes the power consumption from RAPL events if they are present. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 3563030d4f77856bd0a32492fbe9edc3d36248ec Author: Ian Rogers Date: Tue Jan 27 10:44:42 2026 -0800 perf jevents: Add context switch metrics for AMD Metrics break down context switches for different kinds of instruction. Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit fb4c0581740d99029761f4ad84fc0dbc48913eea Author: Ian Rogers Date: Tue Jan 27 10:44:41 2026 -0800 perf jevents: Add load store breakdown metrics ldst for AMD Give breakdown of number of instructions. Use the counter mask (cmask) to show the number of cycles taken to retire the instructions. Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 5ecb1622d000dffb9245df8d264d9c1e7492874f Author: Ian Rogers Date: Tue Jan 27 10:44:40 2026 -0800 perf jevents: Add uncore l3 metric group for AMD Metrics use the amd_l3 PMU for access/miss/hit information. Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit c4108b9509f2cc1fab66c64c2de55ac4f9ee38b4 Author: Ian Rogers Date: Tue Jan 27 10:44:39 2026 -0800 perf jevents: Add dtlb metric group for AMD Add metrics that give an overview and details of the dtlb (zen1, zen2, zen3). Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit e596f329668ec2b5da6ac60fc87c035c5a337d1f Author: Ian Rogers Date: Tue Jan 27 10:44:38 2026 -0800 perf jevents: Add itlb metric group for AMD Add metrics that give an overview and details of the l1 itlb (zen1, zen2, zen3) and l2 itlb (all zens). Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 78067ae26815f8432f8648657ea14c0e3c4f93ad Author: Ian Rogers Date: Tue Jan 27 10:44:37 2026 -0800 perf jevents: Add br metric group for branch statistics on AMD The br metric group for branches itself comprises metric groups for total, taken, conditional, fused and far metric groups using JSON events. The lack of conditional events on anything but zen2 means this category is lacking on zen1, zen3 and zen4. Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 9c9efc7462487c85a269275655807631fba760fc Author: Ian Rogers Date: Tue Jan 27 10:44:36 2026 -0800 perf jevents: Add upc metric for uops per cycle for AMD The metric adjusts for whether or not SMT is on. Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 6da95e1834480f94f99afde0caabc63159eab64d Author: Ian Rogers Date: Tue Jan 27 10:44:35 2026 -0800 perf jevents: Add idle metric for AMD zen models Compute using the MSR PMU the percentage of wallclock cycles where the CPUs are in a low power state. Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit d10ae3a935e7fdc2b149d81e617069fcde9864e3 Author: Ian Rogers Date: Tue Jan 27 10:44:34 2026 -0800 perf jevents: Add RAPL event metric for AMD zen models Add power per second metrics based on RAPL. Reviewed-by: Sandipan Das Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 6bd6c5ef6c7ae35000179c9db8ecdbc3e9698d72 Author: Ian Rogers Date: Tue Jan 27 10:44:33 2026 -0800 perf jevents: Add load event JSON to verify and allow fallbacks Add a LoadEvents function that loads all event JSON files in a directory. In the Event constructor ensure all events are defined in the event JSON except for legacy events like "cycles". If the initial event isn't found then legacy_event1 is used, and if that isn't found legacy_event2 is used. This allows a single Event to have multiple event names as models will often rename the same event over time. If the event doesn't exist an exception is raised. So that references to metrics can be added, add the MetricRef class. This doesn't validate as an event name and so provides an escape hatch for metrics to refer to each other. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 19eab0efe72f02516b9f194a6ad10e7c83a009ae Author: Ian Rogers Date: Tue Jan 27 10:44:32 2026 -0800 perf jevents: Build support for generating metrics from python Generate extra-metrics.json and extra-metricgroups.json from python architecture specific scripts. The metrics themselves will be added in later patches. If a build takes place in tools/perf/ then extra-metrics.json and extra-metricgroups.json are generated in that directory and so added to .gitignore. If there is an OUTPUT directory then the tools/perf/pmu-events/arch files are copied to it so the generated extra-metrics.json and extra-metricgroups.json can be added/generated there. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Benjamin Gray Cc: Caleb Biggers Cc: Edward Baker Cc: Ingo Molnar Cc: James Clark Cc: Jing Zhang Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Sandipan Das Cc: Weilin Wang Cc: Xu Yang Signed-off-by: Arnaldo Carvalho de Melo commit 7a0ba3891104da77cfd1a16d41699e0fdf45603a Author: Leo Yan Date: Fri Jan 23 13:32:04 2026 +0000 perf: Remove redundant kernel.h include Now that the bitfield dependency is resolved, the explicit inclusion of kernel.h is no longer needed. Remove the redundant include. Signed-off-by: Leo Yan Cc: Ian Rogers Cc: James Clark Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit a537c0da168a08b0b6a7f7bd9e75f4cc8d45ff57 Author: Leo Yan Date: Fri Jan 23 13:32:03 2026 +0000 tools: Fix bitfield dependency failure A perf build failure was reported by Thomas Voegtle on stable kernel v6.6.120: CC tests/sample-parsing.o CC util/intel-pt-decoder/intel-pt-pkt-decoder.o CC util/perf-regs-arch/perf_regs_csky.o CC util/arm-spe-decoder/arm-spe-pkt-decoder.o CC util/perf-regs-arch/perf_regs_loongarch.o In file included from util/arm-spe-decoder/arm-spe-pkt-decoder.h:10, from util/arm-spe-decoder/arm-spe-pkt-decoder.c:14: /local/git/linux-stable-rc/tools/include/linux/bitfield.h: In function ‘le16_encode_bits’: /local/git/linux-stable-rc/tools/include/linux/bitfield.h:166:31: error: implicit declaration of function ‘cpu_to_le16’; did you mean ‘htole16’? [-Werror=implicit-function-declaration] ____MAKE_OP(le##size,u##size,cpu_to_le##size,le##size##_to_cpu) \ ^~~~~~~~~ /local/git/linux-stable-rc/tools/include/linux/bitfield.h:149:9: note: in definition of macro ‘____MAKE_OP’ return to((v & field_mask(field)) * field_multiplier(field)); \ ^~ /local/git/linux-stable-rc/tools/include/linux/bitfield.h:170:1: note: in expansion of macro ‘__MAKE_OP’ __MAKE_OP(16) Fix this by including linux/kernel.h, which provides the required definitions. The issue was not found on the mainline due to the relevant C files have included kernel.h. It'd be good to merge this change on mainline as well for robustness. Closes: https://lore.kernel.org/stable/3a44500b-d7c8-179f-61f6-e51cb50d3512@lio96.de/ Fixes: 64d86c03e1441742 ("perf arm-spe: Extend branch operations") Reported-by: Hamza Mahfooz Reported-by: Thomas Voegtle Signed-off-by: Leo Yan Cc: Greg Kroah-Hartman Cc: Ian Rogers Cc: James Clark Cc: Leo Yan Cc: Namhyung Kim To: Sasha Levin Cc: stable@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 34b0a58eef04a49376e4103efc5b09f1e33e594a Author: Swapnil Sapkal Date: Tue Jan 27 18:50:00 2026 +0000 perf sched stats: Fixes in man page Fix the incorrect description of the schedstats report. Also fix the spelling errors in man page. Fixes: 800af362d68945e5 ("perf sched stats: Add details in man page") Reviewed-by: Shrikanth Hegde Reported-by: Shrikanth Hegde Signed-off-by: Swapnil Sapkal Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anubhav Shelat Cc: Chen Yu Cc: Gautham Shenoy Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit f7dc49645346d9d47825b60c4557da6885d48037 Author: Swapnil Sapkal Date: Tue Jan 27 18:49:59 2026 +0000 perf sched stats: Define macro for SEP_LEN Define a macro for separator length of the line in perf sched stats report. Reviewed-by: Shrikanth Hegde Signed-off-by: Swapnil Sapkal Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anubhav Shelat Cc: Chen Yu Cc: Gautham Shenoy Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 7284dc7e19fab1ff425579cbb4721fff292ac70e Author: Swapnil Sapkal Date: Tue Jan 27 18:49:58 2026 +0000 perf sched stats: correct spelling of function name Replace store_schedtstat_cpu_diff() with store_schedstat_cpu_diff() Reviewed-by: Shrikanth Hegde Signed-off-by: Swapnil Sapkal Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anubhav Shelat Cc: Chen Yu Cc: Gautham Shenoy Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit b03b95b4d71edbb10bfb1588dc59cfea8d13796c Author: Swapnil Sapkal Date: Tue Jan 27 18:49:57 2026 +0000 perf sched stats: Add NULL check for cd_map In perf_sched__schedstat_live(), build_cpu_domain_map() returns the pointer to cpu_domain_map which can also be NULL. Add NULL check for the same to avoid NULL pointer dereference. Fixes: 00093b3133984ffe ("perf sched stats: Add support for live mode") Reviewed-by: Shrikanth Hegde Signed-off-by: Swapnil Sapkal Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anubhav Shelat Cc: Chen Yu Cc: Gautham Shenoy Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 05134d15375ce9fc57a91453999729d861efe9f9 Author: Swapnil Sapkal Date: Tue Jan 27 18:49:56 2026 +0000 perf util: Fix NULL check in cpumask_to_cpulist() The function cpumask_to_cpulist() allocates memory with calloc() and stores the result in 'bm', but then incorrectly checks 'cpumask' for NULL instead of 'bm'. This means that if the allocation fails, the function will dereference a NULL pointer when trying to access 'bm'. Fix the check to test the correct variable 'bm'. Fixes: d40c68a49f69c9bd ("perf header: Support CPU DOMAIN relation info") Reviewed-by: Shrikanth Hegde Signed-off-by: Swapnil Sapkal Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anubhav Shelat Cc: Chen Yu Cc: Gautham Shenoy Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 2a85bbaed06bec2b97dec15bb01cbdbf81dce3e3 Author: Swapnil Sapkal Date: Tue Jan 27 18:49:55 2026 +0000 perf header: Replace hardcoded max cpus by MAX_NR_CPUS cpumask and cpulist from cpu-domain header have hardcoded max_cpus value of 1024. Current systems have more cpus than this value. Replace it with MAX_NR_CPUS. Also define a macro to represent domain name length. Fixes: d40c68a49f69c9bd ("perf header: Support CPU DOMAIN relation info") Reported-by: Shrikanth Hegde Reviewed-by: Shrikanth Hegde Signed-off-by: Swapnil Sapkal Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anubhav Shelat Cc: Chen Yu Cc: Gautham Shenoy Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 4a1cf5ed51b1b6049d7771d2e77789b99dafc8ae Author: Sumit Gupta Date: Tue Jan 20 20:26:15 2026 +0530 cpufreq: CPPC: Add generic helpers for sysfs show/store Add generic helper functions for u64 sysfs attributes that follow the common pattern of calling CPPC get/set APIs: - cppc_cpufreq_sysfs_show_u64(): reads value and handles -EOPNOTSUPP - cppc_cpufreq_sysfs_store_u64(): parses input and calls set function Add CPPC_CPUFREQ_ATTR_RW_U64() macro to generate show/store functions using these helpers, reducing boilerplate for simple attributes. Convert auto_act_window and energy_performance_preference_val to use the new macro. No functional changes. Signed-off-by: Sumit Gupta Reviewed-by: Lifeng Zheng [ rjw: Retained empty code line after a conditional ] Link: https://patch.msgid.link/20260120145623.2959636-2-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit 2120005213ce4fdfc652e3f16e6ee20e85cfa4f6 Merge: a1f4991db6219e 4506cdf52a806b Author: Arnd Bergmann Date: Wed Jan 28 19:09:20 2026 +0100 Merge tag 'qcom-arm32-for-6.20-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Qualcomm Arm32 DeviceTree updated for v6.20 MSM8226 is switched to generic RPMPD_ indices, to allow dropping the duplicate platform-specific constants. On MSM8960 two additional GSBIs and I2C controllers are introduced. Accelerometer, Magnetometer, NFC and Light/Proximity sensors are then enabled on the Samsung Galaxy Express. * tag 'qcom-arm32-for-6.20-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: switch to RPMPD_* indices ARM: dts: qcom: msm8960: expressatt: Add Accelerometer ARM: dts: qcom: msm8960: expressatt: Add Magnetometer ARM: dts: qcom: msm8960: expressatt: Add NFC ARM: dts: qcom: msm8960: expressatt: Add Light/Proximity Sensor ARM: dts: qcom: msm8960: Add GSBI2 & GSBI7 Signed-off-by: Arnd Bergmann commit a1f4991db6219e82c3f5010e9c61a21e43a6789c Merge: 67fea39d2c769e 78c13dac18cf0e Author: Arnd Bergmann Date: Wed Jan 28 19:08:03 2026 +0100 Merge tag 'qcom-arm64-for-6.20-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Qualcomm Arm64 DeviceTree updates for v6.20 Enable ADSP FastRPC and add missing GPU memory regions on Agatti. Also add the missing GPU regions on SM6115. Describe the application subsystem watchdog on Hamoa and enable this in the EL2 configurations. Add the camera control interface (CCI) I2C controller on MSM8953, and describe the camera regulators and the camera EEPROM on Fairphone FP3. Specify clock frequency for the i2c4 bus on OnePlus 6, to silence the warnings about missing frequency definition. Add FastRPC and associated heap memory, as well as Coresight, on SM8750 Switch a variety of platforms to use the generic RPMPD_ constants, instead of target-specific duplicated, to allow us to drop these from the header files. Drop the invalid opp-shared on the QUP OPP table for Talos. * tag 'qcom-arm64-for-6.20-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions arm64: dts: qcom: sm8750: add ADSP fastrpc-compute-cb nodes arm64: dts: qcom: sm8750: add memory node for adsp fastrpc arm64: dts: qcom: switch to RPMPD_* indices arm64: dts: qcom: oneplus-enchilada: Specify i2c4 clock frequency arm64: dts: qcom: sm6350: Add clocks for aggre1 & aggre2 NoC arm64: dts: qcom: agatti: enable FastRPC on the ADSP arm64: qcom: dts: sm8750: add coresight nodes arm64: dts: qcom: talos: Drop opp-shared from QUP OPP table arm64: dts: qcom: x1-el2: Enable the APSS watchdog arm64: dts: qcom: hamoa: Add the APSS watchdog dt-bindings: watchdog: Document X1E80100 compatible arm64: dts: qcom: sdm632-fairphone-fp3: Enable CCI and add EEPROM arm64: dts: qcom: sdm632-fairphone-fp3: Add camera fixed regulators arm64: dts: qcom: msm8953: Add CCI nodes arm64: dts: qcom: msm8953: Re-sort tlmm pinctrl states Signed-off-by: Arnd Bergmann commit 67fea39d2c769e9f99b6c00e526afc3101553c2a Merge: a46cb1c79f6614 46c56b73716106 Author: Arnd Bergmann Date: Wed Jan 28 19:05:34 2026 +0100 Merge tag 'v6.20-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: Anberic RG-DS game console, Radxa CM3J module + baseboard for the Rpi CM4 IO board, QNAP TS133 from the RK3568 NAS series. 2 display outputs for the Lion board (old RK3368), TPS65185 pmic for the PineNote and fixes for the PCIe ranges on both RK356x and RK3588. These came quite late, so I wanted to give them the time till 6.20-rc1 and have them migrate to stable-kernels afterwards. The rest is small stuff on a number of boards wrt gpios and compatibles. * tag 'v6.20-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (25 commits) arm64: dts: rockchip: Fix rk3588 PCIe range mappings arm64: dts: rockchip: Fix rk356x PCIe range mappings arm64: dts: rockchip: Add Anbernic RG-DS dt-bindings: input: touchscreen: goodix: Add "panel" property dt-bindings: arm: rockchip: Add Anbernic RG-DS arm64: dts: rockchip: Explicitly request UFS reset pin on RK3576 arm64: dts: rockchip: Add TPS65185 for PineNote arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro arm64: dts: rockchip: Fix imx258 variant on pinephone pro arm64: dts: rockchip: Add the Video-Demo overlay for Lion Haikou arm64: dts: rockchip: Enable pwm1 on rk3368-lion-haikou arm64: dts: rockchip: Enable HDMI output on RK3368-Lion-Haikou arm64: dts: rockchip: Add HDMI node to RK3368 arm64: dts: rockchip: Use phandle for i2c_lvds_blc on rk3368-lion haikou arm64: dts: rockchip: Fix SD card support for RK3576 Nanopi R76s arm64: dts: rockchip: Fix SD card support for RK3576 EVB1 arm64: dts: rockchip: Add Radxa CM3J on RPi CM4 IO Board arm64: dts: rockchip: Add Radxa CM3J dt-bindings: arm: rockchip: Add Radxa CM3J on RPi CM4 IO Board arm64: dts: rockchip: Make eeprom read-only for Radxa ROCK 3C/5A/5C ... Signed-off-by: Arnd Bergmann commit a46cb1c79f66142c9840d86f6f79d2f96ebbcdda Merge: 72216ba36025b9 e546c69ac54e90 Author: Arnd Bergmann Date: Wed Jan 28 19:04:58 2026 +0100 Merge tag 'v6.20-rockchip-dts32-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt Removal of the obsolete mshc aliases from RK3036. * tag 'v6.20-rockchip-dts32-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: rk3036: remove mshc aliases Signed-off-by: Arnd Bergmann commit 72216ba36025b9cd723ef433fe3a629633f4f79b Merge: 2af1017ca68c24 01a08fd967301e Author: Arnd Bergmann Date: Wed Jan 28 18:58:33 2026 +0100 Merge tag 'cix-dt-binding-v6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt - Add OrangePi 6 Plus board * tag 'cix-dt-binding-v6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix: dt-bindings: arm: cix: add OrangePi 6 Plus board Signed-off-by: Arnd Bergmann commit 2af1017ca68c24d51669175818fd907d0fbebc3a Merge: 52c1a896a953b8 e9ed88a4ce42bf Author: Arnd Bergmann Date: Wed Jan 28 18:57:51 2026 +0100 Merge tag 'at91-dt-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt Microchip AT91 device tree updates for v6.20 This update includes: - update the SAMA7D65 flexcom nodes to add the missing i2c, spi, and usart child nodes; the flexcom child nodes were also updated with DMA properties - add basic support for the PCB8385 board, based on LAN966X SoC - drop usb_a9g20-dab-mmx.dtsi as it is not used anywhere in the tree * tag 'at91-dt-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: Drop usb_a9g20-dab-mmx.dtsi ARM: dts: Add support for pcb8385 dt-bindings: arm: at91: add lan966 pcb8385 board ARM: dts: microchip: sama7d65: add missing flexcom nodes ARM: dts: microchip: sama7d65: add fifo-size to usart ARM: dts: microchip: sama7d65: add dma properties to usart6 Signed-off-by: Arnd Bergmann commit 52c1a896a953b8d6281022f18778fcdea620744e Merge: d5f4e01e4cdb4d e39fadd6ef7b79 Author: Arnd Bergmann Date: Wed Jan 28 18:51:14 2026 +0100 Merge tag 'cix-dt-v6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt - add OrangePi 6 Plus board - one small improvement * tag 'cix-dt-v6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix: arm64: dts: cix: Add OrangePi 6 Plus board support arm64: dts: cix: Use lowercase hex Signed-off-by: Arnd Bergmann commit d5f4e01e4cdb4ddc0de9be105147b74749a64640 Merge: 17102e756d7df6 fcaf733ca526b6 Author: Arnd Bergmann Date: Wed Jan 28 18:48:15 2026 +0100 Merge tag 'mvebu-dt64-6.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/dt mvebu dt64 for 6.20 (part 1) Add support for Armada 7020 Express Type 7 CPU module board by Marvell, including: - COM Express CPU module and carrier board (Marvell DB-98CX85x0) - DDR4 memory, 1Gbit OOB Ethernet, 10G KR Ethernet, NAND/SPI flash, PCIe, SATA, USB, and UART interfaces Add SoC-specific compatibles for SafeXcel crypto engine on Armada 37xx and CP11x Fix regulator type from "regulator-gpio" to "regulator-fixed" where no GPIO control is present Add missing GPIO properties for "nxp,pca9536" on cn9131-cf-solidwan Fix and clean up pinctrl-names properties and typos Add missing "#phy-cells" to "usb-nop-xceiv" nodes MAINTAINERS: Add Falcon DB to the list of maintained Marvell Armada dts files * tag 'mvebu-dt64-6.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: MAINTAINERS: Add Falcon DB arm64: dts: a7k: add COM Express boards arm64: dts: marvell: Add SoC specific compatibles to SafeXcel crypto arm64: dts: marvell: change regulator-gpio to regulator-fixed arm64: dts: marvell: cn9131-cf-solidwan: Add missing GPIO properties on "nxp,pca9536" arm64: dts: marvell: Fix stray and typo "pinctrl-names" properties arm64: dts: marvell: Add missing "#phy-cells" to "usb-nop-xceiv" Signed-off-by: Arnd Bergmann commit 17102e756d7df6fc559876af12037b8a9582dab7 Merge: 16ea3c964e0a61 25556c12f4d3ed Author: Arnd Bergmann Date: Wed Jan 28 18:46:55 2026 +0100 Merge tag 'mtk-dts64-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt MediaTek ARM64 Device Tree updates This adds support for new boards and variants based on different already supported MediaTek SoCs, and improves support for current boards. In particular: - New machines: - Ezurio Tungsten 510 (MediaTek Genio 510 SoC) - Ezurio Tungsten 700 (MediaTek Genio 700 SoC) ...improvements for already supported SoCs and machines: - MT7981b gains support for PCI-Express, USB, Ethernet and for the "GED" WiFi HW offload - OpenWRT One board gains support for the same - MT8188/8195/8390/8395 gains support for the DPI1 interface and HDMI output from the SoC's HDMI Tx controller along with its HDMI PHY and DDC IPs, usable on a selection of boards that expose a HDMI connector, namely: - All MT8390 Genio EVK based boards - All MT8395 Genio EVK based boards - Radxa NIO-12L (MT8395) ...and dtbs_check warning fixes for many of the MTK devicetrees, including MT6795, MT7981, MT7986, MT7988, MT8173, MT8183, MT8186, MT8188, MT8192, and a dts coding style fix for Airoha EN7581-EVB. This also includes a fix for the new devicetree overlay warnings, adding dtbs with applied overlays for all of the devices having at least one overlay. * tag 'mtk-dts64-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: (47 commits) arm64: dts: mediatek: mt8192: Rename mt8192-afe-pcm to audio-controller dt-bindings: arm: mediatek: audsys: Support mt8192-audsys variant arm64: dts: mediatek: mt7988a: Fix PCI-Express T-PHY node address arm64: dts: mediatek: mt8186-evb: Add vproc fixed regulator arm64: dts: mediatek: mt7981b-openwrt-one: Add address/size cells to eth arm64: dts: mediatek: mt8183-kukui: Clean up IT6505 regulator supply arm64: dts: mediatek: mt7986a: Change compatible for SafeXcel crypto arm64: dts: mediatek: mt8173-evb: Add interrupts to DA9211 regulator arm64: dts: mediatek: mt6795-xperia-m5: Rename PMIC leds node arm64: dts: mediatek: mt6795: Fix issues in SCPSYS node arm64: dts: mediatek: mt6331: Fix VCAM IO regulator name arm64: dts: mediatek: mt6795-xperia-m5: Add UHS pins for MMC1 and 2 arm64: dts: mediatek: mt8192-asurada: Remove unused clock-stretch-ns arm64: dts: mediatek: mt8173-elm: Remove regulators from thermal node arm64: dts: mediatek: mt8173-elm: Fix dsi0 ports warning arm64: dts: mediatek: mt8173-elm: Fix bluetooth node name and reorder arm64: dts: mediatek: mt8183-pumpkin: Fix pinmux node names arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node arm64: dts: mediatek: mt7981b-openwrt-one: Remove useless cells from flash@0 arm64: dts: mediatek: mt8183-evb: Fix dtbs_check warnings ... Signed-off-by: Arnd Bergmann commit 16ea3c964e0a61f5ed869bcc1bec7e98f3e0d2cd Merge: d69af478d26756 76f88d2edd9f21 Author: Arnd Bergmann Date: Wed Jan 28 18:44:07 2026 +0100 Merge tag 'omap-for-v6.20/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt ARM: dts: OMAP updates for v6.20 * tag 'omap-for-v6.20/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: dts: omap: dra7: Remove bogus #syscon-cells property ARM: dts: ti/omap: omap*: fix watchdog node names ARM: dts: ti: Drop unused .dtsi ARM: dts: Drop am335x-base0033 devicetree ARM: dts: tps65910: Add gpio & interrupt properties ARM: dts: omap: enable panic-indicator option ARM: dts: ti/omap: omap4-epson-embt2ws: add powerbutton Signed-off-by: Arnd Bergmann commit d69af478d26756b7a1eee407eb202d1ac7aaccde Merge: 91e93edc63dfb9 f36e738549d483 Author: Arnd Bergmann Date: Wed Jan 28 18:42:44 2026 +0100 Merge tag 'sunxi-dt-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner device tree changes for 6.20 Not many changes this cycle. - The A523 family of SoCs gained support for SPI controllers. - Some cleanup of old ARM device tree files to fix DT binding validation errors. - D1 and A100 SoCs gained support for their LED controller. This was from a couple years ago. The driver made it in, but the DT patches were missed. - D1 and T113 SoCs gained support for the internal thermal sensor. * tag 'sunxi-dt-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: riscv: dts: allwinner: d1: Add CPU thermal sensor and zone ARM: dts: allwinner: Replace status "failed" with "fail" riscv: dts: allwinner: d1: Add RGB LEDs to boards riscv: dts: allwinner: d1: Add LED controller node arm64: dts: allwinner: a100: Add LED controller node ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property arm64: dts: allwinner: t527: orangepi-4a: Enable SPI-NOR flash arm64: dts: allwinner: sun55i: Add SPI controllers Signed-off-by: Arnd Bergmann commit 91e93edc63dfb9cd8fb7057dbdd35fadbf18f64f Merge: 3b2db85f48b470 5ea75722eaec22 Author: Arnd Bergmann Date: Wed Jan 28 18:42:09 2026 +0100 Merge tag 'amlogic-arm-dt-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM DT for v6.20: - drop iio-hwmon in favour of generic-adc-thermal * tag 'amlogic-arm-dt-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: ARM: dts: meson: drop iio-hwmon in favour of generic-adc-thermal Signed-off-by: Arnd Bergmann commit 3b2db85f48b4702775ab488408975e97f43f6fec Merge: 332a1ff4888cf0 854583f9992671 Author: Arnd Bergmann Date: Wed Jan 28 18:40:33 2026 +0100 Merge tag 'amlogic-arm64-dt-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM64 DT for v6.20: - Cleanups: - Use lowercase hex - Use hyphen in node names - move CPU OPP table and clock assignment to SoC.dtsi - drop useless assigned-clock-parents - MMC clock fixup across multiple families - Add type-c controller on Radxa Zero 2 and enable NPU - New board: - Khadas VIM1s based on Amlogic S4 * tag 'amlogic-arm64-dt-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: amlogic: meson-s4-s905y4-khadas-vim1s: enable SDIO interface arm64: dts: amlogic: add the type-c controller on Radxa Zero 2 arm64: dts: amlogic: meson-sm1-odroid: Eliminate Odroid HC4 power glitches during boot. arm64: dts: amlogic: meson-s4-s905y4-khadas-vim1s: enable eMMC storage arm64: dts: meson-s4-s905y4-khadas-vim1s: add initial device tree arm64: dts: meson-s4-aq222: update compatible string with s805x2 dt-bindings: arm: amlogic: introduce specific compatibles for S4 family arm64: dts: amlogic: Enable the npu node on Radxa Zero 2 arm64: dts: amlogic: g12: assign the MMC A signal clock arm64: dts: amlogic: g12: assign the MMC B and C signal clocks arm64: dts: amlogic: gx: assign the MMC signal clocks arm64: dts: amlogic: axg: assign the MMC signal clocks arm64: dts: amlogic: a1: align the mmc clock setup arm64: dts: amlogic: c3: assign the MMC signal clocks arm64: dts: amlogic: s4: fix mmc clock assignment arm64: dts: amlogic: s4: assign mmc b clock to 24MHz arm64: dts: amlogic: drop useless assigned-clock-parents arm64: dts: amlogic: move CPU OPP table and clock assignment to SoC.dtsi arm64: dts: amlogic: Use lowercase hex arm64: dts: amlogic: Use hyphen in node names Signed-off-by: Arnd Bergmann commit 332a1ff4888cf07b67d0bc10aa57fd25926bf34a Merge: c8f7de01d905a1 5164e95565d3fd Author: Arnd Bergmann Date: Wed Jan 28 18:39:38 2026 +0100 Merge tag 'spacemit-dt-for-6.20-1' of https://github.com/spacemit-com/linux into soc/dt RISC-V SpacemiT DT changes for 6.20 - Disable Ethernet PHY auto sleep mode - Add pinctrl IO power support - Add K3 Pico-ITX board - Add support for K3 SoC - Add DWC USB support - Add reset for eMMC(sdhci)/I2C - Add PCIe support - Support PMIC for Jupiter board * tag 'spacemit-dt-for-6.20-1' of https://github.com/spacemit-com/linux: riscv: dts: spacemit: Disable ETH PHY sleep mode for OrangePi riscv: dts: spacemit: pinctrl: update register and IO power riscv: dts: spacemit: add K3 Pico-ITX board support riscv: dts: spacemit: add initial support for K3 SoC dt-bindings: riscv: spacemit: add K3 and Pico-ITX board bindings dt-bindings: interrupt-controller: add SpacemiT K3 IMSIC dt-bindings: interrupt-controller: add SpacemiT K3 APLIC dt-bindings: timer: add SpacemiT K3 CLINT dt-bindings: riscv: add SpacemiT X100 CPU compatible riscv: dts: spacemit: k1: Add "b" ISA extension riscv: dts: spacemit: Enable USB3.0 on BananaPi-F3 riscv: dts: spacemit: Add DWC3 USB 3.0 controller node for K1 riscv: dts: spacemit: Add USB2 PHY node for K1 riscv: dts: spacemit: sdhci: add reset support riscv: dts: spacemit: add reset property riscv: dts: spacemit: PCIe and PHY-related updates riscv: dts: spacemit: Add a PCIe regulator riscv: dts: spacemit: Define the P1 PMIC regulators for Milk-V Jupiter riscv: dts: spacemit: Define fixed regulators for Milk-V Jupiter riscv: dts: spacemit: Enable i2c8 adapter for Milk-V Jupiter Signed-off-by: Arnd Bergmann commit c8f7de01d905a1a6b71853d4811dddcfe2de79be Merge: 9587fe49280ebb 024d8f4aa35970 Author: Arnd Bergmann Date: Wed Jan 28 18:36:56 2026 +0100 Merge tag 'samsung-dt64-6.20-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v6.20, part two Add DPU clock management unit nodes to Google GS101. * tag 'samsung-dt64-6.20-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos: gs101: add cmu_dpu and sysreg_dpu dt nodes dt-bindings: clock: google,gs101-clock: Add DPU clock management unit dt-bindings: clock: google,gs101-clock: fix alphanumeric ordering Signed-off-by: Arnd Bergmann commit 9587fe49280ebb57467a108a97b068ce3606abc4 Merge: b2a29633f489e1 a95e1d848972dd Author: Arnd Bergmann Date: Wed Jan 28 18:34:53 2026 +0100 Merge tag 'arm-soc/for-6.20/devicetree-arm64' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM64-based SoCs DT changes for 6.20, please pull the following: - Peter enables the RNG on 2712 (Raspberry Pi 5) - Stanimir adds the watchdog DT node on 2712 - Rob removes undocumneted nodes, reworks clock nodes, fixes the "simple-bus" node names, and cleans up additional properties and nodes for all Broadcom ARM64-based SoCs * tag 'arm-soc/for-6.20/devicetree-arm64' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: bcm4906-netgear-r8000p: Drop unnecessary "ranges" in partition node arm64: dts: broadcom: northstar2: Drop "arm,cci-400-pmu" fallback compatible arm64: dts: broadcom: northstar2: Drop QSPI "clock-names" arm64: dts: broadcom: northstar2: Drop unused and undocumented "brcm,pcie-ob-oarr-size" properties arm64: dts: broadcom: northstar2: Rework clock nodes arm64: dts: broadcom: ns2-svk: Use non-deprecated at25 properties arm64: dts: broadcom: Use preferred node names arm64: dts: broadcom: stingray: Move raid nodes out of bus arm64: dts: broadcom: stingray: Fix 'simple-bus' node names arm64: dts: broadcom: stingray: Rework clock nodes arm64: dts: broadcom: Remove unused and undocumented nodes arm64: dts: broadcom: bcm2712: Add watchdog DT node arm64: dts: broadcom: bcm2712: Enable RNG Signed-off-by: Arnd Bergmann commit b2a29633f489e161a2b2b61e57d029c4e032a8e4 Merge: 8f8f7bccda88ad 929dc5b3e06c54 Author: Arnd Bergmann Date: Wed Jan 28 18:27:08 2026 +0100 Merge tag 'arm-soc/for-6.20/devicetree' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM-based SoCs DT changes for 6.20, please pull the following: - Rob fixes the simple-bus node names in the BCM2711 .dtsi file * tag 'arm-soc/for-6.20/devicetree' of https://github.com/Broadcom/stblinux: ARM: dts: broadcom: bcm2711: Fix 'simple-bus' node names Signed-off-by: Arnd Bergmann commit 1f3b950492db411e6c30ee0076b61ef2694c100a Author: Joey Gouly Date: Tue Jan 27 13:39:26 2026 +0000 arm64: poe: fix stale POR_EL0 values for ptrace If a process wrote to POR_EL0 and then crashed before a context switch happened, the coredump would contain an incorrect value for POR_EL0. The value read in poe_get() would be a stale value left in thread.por_el0. Fix this by reading the value from the system register, if the target thread is the current thread. This matches what gcs/fpsimd do. Fixes: 175198199262 ("arm64/ptrace: add support for FEAT_POE") Reported-by: David Spickett Cc: stable@vger.kernel.org Signed-off-by: Joey Gouly Cc: Kevin Brodsky Cc: Mark Rutland Reviewed-by: Kevin Brodsky Acked-by: Mark Rutland Signed-off-by: Will Deacon commit 9cb64f61ec7a9034299807b1e562413329ddac5b Author: Manivannan Sadhasivam Date: Wed Jan 28 21:07:15 2026 +0530 PCI/pwrctrl: Add PCIe M.2 connector support Add support for handling PCIe M.2 connectors as Power Sequencing devices. These connectors are exposed as Power Sequencing devices as they often support multiple interfaces like PCIe/SATA, USB/UART to the host machine, and the interfaces may be driven by different client drivers at the same time. This driver handles the PCIe interface of these connectors. It first checks for the presence of the graph port in the Root Port node with the help of of_graph_is_present() API. If present, it acquires/powers ON the corresponding pwrseq device. Once the pwrseq device is powered ON, the driver will skip parsing the Root Port/Slot resources and register with the pwrctrl framework. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260128-pci-m2-v7-1-9b3a5fe3d244@oss.qualcomm.com commit 8f8f7bccda88adccabec7286f786f661cd6e6738 Merge: 1092e5c0d1f53b f16ae81b80ca4e Author: Arnd Bergmann Date: Wed Jan 28 17:11:37 2026 +0100 Merge tag 'riscv-sophgo-dt-for-v6.20' of https://github.com/sophgo/linux into soc/dt RISC-V/Sophgo Devicetrees for v6.20 Sophgo: For CV18xx serials: Update RX/TX FIFO size to fix the USB transfer issue. For SG2042: Optimize the DTS file format, including moving PLIC/CLINT nodes into cpu dtsi and sorting peripheral nodes by address. In addition, we also enable RTC for Pioneerbox. For SG2044: Add "b" ISA extension to fix dtbs_check warnings. Signed-off-by: Chen Wang * tag 'riscv-sophgo-dt-for-v6.20' of https://github.com/sophgo/linux: riscv: dts: sophgo: sg2044: Add "b" ISA extension riscv: dts: sophgo: fix the node order of SG2042 peripheral riscv: dts: sophgo: Move PLIC and CLINT node into CPU dtsi riscv: dts: sophgo: enable hardware clock (RTC) on the Milk-V Pioneer riscv: dts: sophgo: cv180x: fix USB dwc2 FIFO sizes Signed-off-by: Arnd Bergmann commit 1092e5c0d1f53bec6152d4ae149de3f4f97ecb20 Merge: 2ba042ca39dcb6 1636348aab6083 Author: Arnd Bergmann Date: Wed Jan 28 17:04:28 2026 +0100 Merge tag 'stm32-dt-for-v6.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt STM32 DT for v6.20, round 1 Highlights: ---------- - MCU: - Update/add Led support on ST boards. - MPU: - STM32MP13: - Add boot led and red led on ST DK board. - STMP32MP15: - Add boot led and red led on ST DK boards. - Add SPI1 sleep pinctrl group. - STM32MP23: - Add green ,orange and boot leds on ST boards. - Add SPI, I2C, DCMIPP and CSI instances to CLUSTER_PD power domain. - Enable analog-filter to all I2C instances. - STM32MP25: - Add green ,orange and boot leds on ST boards. - Add SPI, I2C, DCMIPP and CSI instances to CLUSTER_PD power domain. - Enable analog-filter to all I2C instances. - Add LPDDR/DDR channels to ST boards. * tag 'stm32-dt-for-v6.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: (31 commits) arm/arm64: dts: st: Drop unused .dtsi arm64: STM32: drop an undefined Kconfig symbol arm64: dts: st: Minor whitespace cleanup arm64: dts: st: Use hyphen in node names arm64: dts: st: add power-domain of dcmipp in stm32mp231.dtsi arm64: dts: st: add power-domain of dcmipp in stm32mp251.dtsi dt-bindings: media: st: dcmipp: add 'power-domains' property arm64: dts: st: add power-domain of csi in stm32mp231.dtsi arm64: dts: st: add power-domain of csi in stm32mp251.dtsi dt-bindings: media: st: csi: add 'power-domains' property ARM: dts: stm32: add spi1 sleep state pinctrl on stm32mp157c-ev1 arm64: dts: st: add DDR channel to stm32mp257f-ev1 board arm64: dts: st: add LPDDR channel to stm32mp257f-dk board arm64: dts: st: enable i2c analog-filter in stm32mp231.dtsi arm64: dts: st: enable i2c analog-filter in stm32mp251.dtsi arm64: dts: st: add power-domains in all i2c of stm32mp231.dtsi arm64: dts: st: add power-domains in all i2c of stm32mp251.dtsi dt-bindings: i2c: st,stm32-i2c: add 'power-domains' property arm64: dts: st: add power-domains in all spi of stm32mp231.dtsi arm64: dts: st: add power-domains in all spi of stm32mp251.dtsi ... Signed-off-by: Arnd Bergmann commit 2ba042ca39dcb653de2d8f12e1471a18673803cc Merge: 33dc81740d0f31 9bdfeed989b126 Author: Arnd Bergmann Date: Wed Jan 28 17:00:58 2026 +0100 Merge tag 'imx-dt64-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX arm64 device tree changes for 6.20: - New board support: i.MX8MP/i.MX91/i.MX93/i.MX95 FRDM, ifm VHIP4 EvalBoard, Apalis iMX8QP, TQ-Systems MBLS1028A/MBLS1028A-IND - A number of series from Alexander Stein improving lpcg indices description for tqma8xxs board, moving BMAN/QMAN buffers for tqmls1046a, refreshing tqma8mpql-mba8mpxl support a bit, adding HDMI audio support for tqma8mpql-mba8mp-ras314 etc. - A series from Chancel Liu adding various audio features for imx93-14x14-evk board - A series from Francesco Dolcini enabling hdmi_pai device for imx8mp-verdin and imx8mp-toradex-smarc - A couple of changes from Francesco Valla enabling more devices and correcting CAN transceiver gpio for imx93-11x11-frdm - A few changes from Frank Li adding DDR perf support for imx8qm, adding camera support for imx8mp-evk, enabling thermal support for i.MX91, etc. - A series from Haibo Chen adding flexcan support for imx943-evk and imx952-evk boards - A series from Krzysztof Kozlowski fixing up coding style issues - A couple of changes from Marek Vasut updating Data Modul i.MX8M Plus eDM SBC DT to rev.903, using GPU_CGC as core clock for GPU on i.MX95 - A series from Markus Niebel to clean up imx8mm-tqma8mqml board regulators - A couple of series from Peng Fan replacing xceiver-supply with phys for NXP EVK boards, improving imx952-evk board support - A series from Sebastian Krzyszkowiak to refresh imx8mq-librem5 support - A couple of series from Stefano Radaelli to improve imx93-var-som-symphony and imx8mp-var-som support - Other random changes for various boards * tag 'imx-dt64-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (104 commits) arm64: dts: freescale: imx95: Add support for i.MX95 15x15 FRDM board arm64: dts: imx91-11x11-frdm: fix CAN transceiver gpio arm64: dts: imx93-11x11-frdm: enable additional devices arm64: dts: imx93-11x11-frdm: Add MQS audio support arm64: dts: imx952-evk: Add nxp,ctrl-ids for scmi misc arm64: dts: imx952-evk: Add flexcan support arm64: dts: imx952-evk: Enable TPM[3,6] arm64: dts: imx952-evk: Enable wdog3 arm64: dts: imx952-evk: Enable USB[1,2] arm64: dts: imx952-evk: Enable SPI7 arm64: dts: imx952-evk: Enable UART5 arm64: dts: imx952-evk: Enable I2C[2,3,4,6,7] bus arm64: dts: imx952-evk: Change the usdhc1_200mhz drive strength to DSE4 arm64: dts: imx952: Add idle-states node arm64: dts: imx8mn: Add ifm VHIP4 EvalBoard v1 and v2 arm64: dts: imx8mn: Add SNVS LPGPR arm64: dts: imx8mq-librem5: Don't set mic-cfg for wm8962 arm64: dts: imx8mq-librem5: Set cap-power-off-card for usdhc2 arm64: dts: imx8mq-librem5: Limit uSDHC2 frequency to 50MHz arm64: dts: imx8mq-librem5: Enable SNVS RTC ... Signed-off-by: Arnd Bergmann commit 33dc81740d0f31d64b649a3cf017d04e695efe04 Merge: 1daa947cb29e4d b17171492e9897 Author: Arnd Bergmann Date: Wed Jan 28 17:00:08 2026 +0100 Merge tag 'imx-bindings-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX dt-bindgings changes for 6.20: - New board compatibles for i.MX93 11x11 FRDM, Apalis iMX8QP, i.MX91 FRDM, ifm VHIP4 EvalBoard v1 and v2, TQ-Systems MBLS1028A/MBLS1028A-IND, i.MX952 EVK, i.MX8MP FRDM - Add vendor prefix for ifm electronic gmbh - A couple of small changes for fsl,imx-gpc.yaml and tcg,tpm-tis-i2c.yaml * tag 'imx-bindings-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: dt-bindings: arm: fsl: Add compatible for i.MX95 15x15 FRDM board dt-bindings: arm: fsl: Document ifm VHIP4 EvalBoard v1 and v2 dt-bindings: vendor-prefixes: Document ifm electronic gmbh dt-bindings: arm: fsl: Add FRDM-IMX91 board dt-bindings: tpm: Add st,st33tphf2ei2c dt-bindings: arm: fsl: Add Apalis iMX8QP dt-bindings: arm: fsl: add i.MX952 EVK board dt-bindings: arm: fsl: add i.MX93 11x11 FRDM board dt-bindings: power: fsl,imx-gpc: Document address-cells dt-bindings: arm: fsl: Add i.MX8MP FRDM board dt-bindings: arm: fsl: add TQ-Systems boards MBLS1028A and MBLS1028A-IND Signed-off-by: Arnd Bergmann commit 1daa947cb29e4d48999daefd4dd0e06531d1f92f Merge: 21f3f6af42e38b d262d030baef28 Author: Arnd Bergmann Date: Wed Jan 28 16:56:11 2026 +0100 Merge tag 'tegra-for-6.20-dt-bindings-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt dt-bindings: Changes for v6.20-rc1 This series updates various DT bindings for Tegra architecture, primarily focusing on schema validation fixes and new feature documentation for Tegra234 and Tegra264 SoCs. Key changes include converting Tegra20 NAND bindings to YAML, and updating memory, DMA, and IOMMU definitions for Tegra264 (introducing CMDQV and DBB clock support). Additionally, it resolves legacy warnings for Tegra30/132 display and VI interfaces. * tag 'tegra-for-6.20-dt-bindings-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: display: tegra: document Tegra30 VI and VIP dt-bindings: display: tegra: document Tegra132 MIPI calibration device dt-bindings: mtd: nvidia,tegra20-nand: convert to DT schema dt-bindings: dma: Update ADMA bindings for tegra264 dt-bindings: iommu: Add NVIDIA Tegra CMDQV support dt-bindings: memory: tegra: Document DBB clock for Tegra264 dt-bindings: tegra: pmc: Update aotag as an optional aperture commit c71257394bc9c59ea727803f6e55e83fe63db74e Author: Beata Michalska Date: Wed Jan 28 14:53:20 2026 +0100 rust: dma: allow drivers to tune max segment size Make dma_set_max_seg_size() available to Rust so drivers can perform standard DMA setup steps. Signed-off-by: Beata Michalska Acked-by: Robin Murphy Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260128135320.689046-1-beata.michalska@arm.com Signed-off-by: Danilo Krummrich commit 7ae4d097b752d77c41dd26068d92ef34e9c66be9 Author: Marek Vasut Date: Tue Jan 27 23:23:22 2026 +0100 spi: spi-fsl-lpspi: Handle clock polarity and phase The LPSPI driver currently does not support setting SPI bus clock polarity and phase, add support for it. It is important to configure correct initial clock polarity and phase before the GPIO chipselect toggles, otherwise a chip attached to the bus might recognize the first change of clock signal as the first clock cycle and get confused. In order to set up the correct polarity and phase on the clock signal before the GPIO chipselects get configured by the SPI core, the controller has to be briefly brought up in fsl_lpspi_prepare_message(). The fsl_lpspi_prepare_message() behaves like a zero-length transfer which always uses PIO and never DMA, and which leaves the clock signal in the correct state at the end of such transfer, which happens before the GPIO chipselect toggles. Signed-off-by: Marek Vasut Reviewed-by: Frank Li Link: https://patch.msgid.link/20260127222353.1452003-1-marex@nabladev.com Signed-off-by: Mark Brown commit 3daab3112f039cf849f96764019b096bb0a39d04 Author: Chuck Lever Date: Wed Jan 7 19:40:11 2026 -0500 nfsd: cancel async COPY operations when admin revokes filesystem state Async COPY operations hold copy stateids that represent NFSv4 state. Thus, when the NFS server administrator revokes all NFSv4 state for a filesystem via the unlock_fs interface, ongoing async COPY operations referencing that filesystem must also be canceled. Each cancelled copy triggers a CB_OFFLOAD callback carrying the NFS4ERR_ADMIN_REVOKED status to notify the client that the server terminated the operation. The static drop_client() function is renamed to nfsd4_put_client() and exported. The function must be exported because both the new nfsd4_cancel_copy_by_sb() and the CB_OFFLOAD release callback in nfs4proc.c need to release client references. Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d8316b837c2ca5f92e781fa1575095c0132ae3c1 Author: Jeff Layton Date: Tue Jan 6 13:59:50 2026 -0500 nfsd: add controls to set the minimum number of threads per pool Add a new "min_threads" variable to the nfsd_net, along with the corresponding netlink interface, to set that value from userland. Pass that value to svc_set_pool_threads() and svc_set_num_threads(). Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 1c87a0c39a860e19eee41815737e38b2a035c040 Author: Jeff Layton Date: Tue Jan 6 13:59:49 2026 -0500 nfsd: adjust number of running nfsd threads based on activity nfsd() is changed to pass a timeout to svc_recv() when there is a min number of threads set, and to handle error returns from it: In the case of -ETIMEDOUT, if the service mutex can be taken (via trylock), the thread becomes an RQ_VICTIM so that it will exit, providing that the actual number of threads is above pool->sp_nrthrmin. In the case of -EBUSY, if the actual number of threads is below pool->sp_nrthrmax, it will attempt to start a new thread. This attempt is gated on a new SP_TASK_STARTING pool flag that serializes thread creation attempts within a pool, and further by mutex_trylock(). Neil says: "I think we want memory pressure to be able to push a thread into returning -ETIMEDOUT. That can come later." Signed-off-by: NeilBrown Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit a0022a38be1017fb302563eaee54ff904be48cea Author: Jeff Layton Date: Tue Jan 6 13:59:48 2026 -0500 sunrpc: allow svc_recv() to return -ETIMEDOUT and -EBUSY To dynamically adjust the thread count, nfsd requires some information about how busy things are. Change svc_recv() to take a timeout value, and then allow the wait for work to time out if it's set. If a timeout is not defined, then the schedule will be set to MAX_SCHEDULE_TIMEOUT. If the task waits for the full timeout, then have it return -ETIMEDOUT to the caller. If it wakes up, finds that there is more work and that no threads are available, then attempt to set SP_TASK_STARTING. If wasn't already set, have the task return -EBUSY to cue to the caller that the service could use more threads. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 7f221b340d16558919d963a2afed585d6a145fa4 Author: Jeff Layton Date: Tue Jan 6 13:59:47 2026 -0500 sunrpc: split new thread creation into a separate function Break out the part of svc_start_kthreads() that creates a thread into svc_new_thread(), as a new exported helper function. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 7ffc7ade2cb1138ea5d4ab55cb42c878d44165fb Author: Jeff Layton Date: Tue Jan 6 13:59:46 2026 -0500 sunrpc: introduce the concept of a minimum number of threads per pool Add a new pool->sp_nrthrmin field to track the minimum number of threads in a pool. Add min_threads parameters to both svc_set_num_threads() and svc_set_pool_threads(). If min_threads is non-zero and less than the max, svc_set_num_threads() will ensure that the number of running threads is between the min and the max. If the min is 0 or greater than the max, then it is ignored, and the maximum number of threads will be started, and never spun down. For now, the min_threads is always 0, but a later patch will pass the proper value through from nfsd. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 6cd60f4274b19327ebc5afa0c814b13379c34370 Author: Jeff Layton Date: Tue Jan 6 13:59:45 2026 -0500 sunrpc: track the max number of requested threads in a pool The kernel currently tracks the number of threads running in a pool in the "sp_nrthreads" field. In the future, where threads are dynamically spun up and down, it'll be necessary to keep track of the maximum number of requested threads separately from the actual number running. Add a pool->sp_nrthrmax parameter to track this. When userland changes the number of threads in a pool, update that value accordingly. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 2c01f0cf324bd7857c135fb26619dfba67b997a4 Author: Jeff Layton Date: Tue Jan 6 13:59:44 2026 -0500 sunrpc: remove special handling of NULL pool from svc_start/stop_kthreads() Now that svc_set_num_threads() handles distributing the threads among the available pools, remove the special handling of a NULL pool pointer from svc_start_kthreads() and svc_stop_kthreads(). Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit e344f872628e769874c8cf30ec9a554bd55c26a3 Author: Jeff Layton Date: Tue Jan 6 13:59:43 2026 -0500 sunrpc: split svc_set_num_threads() into two functions svc_set_num_threads() will set the number of running threads for a given pool. If the pool argument is set to NULL however, it will distribute the threads among all of the pools evenly. These divergent codepaths complicate the move to dynamic threading. Simplify the API by splitting these two cases into different helpers: Add a new svc_set_pool_threads() function that sets the number of threads in a single, given pool. Modify svc_set_num_threads() to distribute the threads evenly between all of the pools and then call svc_set_pool_threads() for each. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit ac30cd304347f2daeece6998bb5f0ae2db64e397 Author: John Garry Date: Wed Jan 28 08:26:23 2026 +0000 nvme: stop using AWUPF As described at [0], much of the atomic write parts of the specification are lacking. For now, there is nothing which we can do in software about the lack of a dedicated NVMe write atomic command. As for reading the atomic write limits, it is felt that the per-namespace values are mostly properly specified and it is assumed that they are properly implemented. The specification of NAWUPF is quite clear. However the specification of NABSPF is less clear. The lack of clarity in NABSPF comes from deciding whether NABSPF applies when NSABP is 0 - it is assumed that NSABPF does not apply when NSABP is 0. As for the per-controller AWUPF, how this value applies to shared namespaces is missing in the specification. Furthermore, the value is in terms of logical blocks, which is an NS entity. Since AWUPF is so poorly defined, stop using it already together. Hopefully this will force vendors to implement NAWUPF support always. Note that AWUPF not only effects atomic write support, but also the physical block size reported for the device. To help users know this restriction, log an info message per NS. [0] https://lore.kernel.org/linux-nvme/20250707141834.GA30198@lst.de/ Tested-by: Nilay Shroff Reviewed-by: Nilay Shroff Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Signed-off-by: John Garry Signed-off-by: Keith Busch commit 218b16992a37ea97b9e09b7659a25a864fb9976f Author: Benjamin Marzinski Date: Tue Jan 27 19:12:24 2026 -0500 dm mpath: make pg_init_delay_msecs settable "pg_init_delay_msecs X" can be passed as a feature in the multipath table and is used to set m->pg_init_delay_msecs in parse_features(). However, alloc_multipath_stage2(), which is called after parse_features(), resets m->pg_init_delay_msecs to its default value. Instead, set m->pg_init_delay_msecs in alloc_multipath(), which is called before parse_features(), to avoid overwriting a value passed in by the table. Signed-off-by: Benjamin Marzinski Cc: stable@vger.kernel.org commit 4550a71b179be9e2a17015c018b231a2daca2dd1 Author: Benjamin Marzinski Date: Tue Jan 27 19:12:23 2026 -0500 Revert "dm: fix a race condition in retrieve_deps" This reverts commit f6007dce0cd35d634d9be91ef3515a6385dcee16. Commit f6007dce0cd3 ("dm: fix a race condition in retrieve_deps") was added to fix a race between retrieving the list of dm table devices and multipath_message() modifying the list of table devices. But Commit a48f6b82c5c4 ("dm mpath: don't call dm_get_device in multipath_message") removed the call to dm_get_device() from multipath_message(). After that commit, the only calls to dm_get_device() and dm_put_device() are in target constructors and destructors, so the race with retrieve_deps() is no longer possible. Suggested-by: Martin Wilck Signed-off-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka commit 787bd63ee661b0148ce8e1fde92b7afddd85c446 Author: Benjamin Marzinski Date: Tue Jan 27 19:12:22 2026 -0500 dm mpath: Add missing dm_put_device when failing to get scsi dh name When commit fd81bc5cca8f ("scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name()") added code to fail parsing the path if scsi_dh_attached_handler_name() failed with -ENOMEM, it didn't clean up the reference to the path device that had just been taken. Fix this, and steamline the error paths of parse_path() a little. Fixes: fd81bc5cca8f ("scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name()") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka commit 5b0530bb16ec5af3cc96fc25891d6a860fd37a8c Author: Nathan Chancellor Date: Thu Jan 22 14:42:38 2026 -0700 iommu/amd: Fix type of type parameter to amd_iommufd_hw_info() When building with -Wincompatible-function-pointer-types-strict, a warning designed to catch kernel control flow integrity (kCFI) issues at build time, there is an instance around amd_iommufd_hw_info(): drivers/iommu/amd/iommu.c:3141:13: error: incompatible function pointer types initializing 'void *(*)(struct device *, u32 *, enum iommu_hw_info_type *)' (aka 'void *(*)(struct device *, unsigned int *, enum iommu_hw_info_type *)') with an expression of type 'void *(struct device *, u32 *, u32 *)' (aka 'void *(struct device *, unsigned int *, unsigned int *)') [-Werror,-Wincompatible-function-pointer-types-strict] 3141 | .hw_info = amd_iommufd_hw_info, | ^~~~~~~~~~~~~~~~~~~ While 'u32 *' and 'enum iommu_hw_info_type *' are ABI compatible, hence no regular warning from -Wincompatible-function-pointer-types, the mismatch will trigger a kCFI violation when amd_iommufd_hw_info() is called indirectly. Update the type parameter of amd_iommufd_hw_info() to be 'enum iommu_hw_info_type *' to match the prototype in 'struct iommu_ops', clearing up the warning and kCFI violation. Fixes: 7d8b06ecc45b ("iommu/amd: Add support for hw_info for iommu capability query") Signed-off-by: Nathan Chancellor Reviewed-by: Vasant Hegde Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit c0f1506f63546308e894469ceb0f1fadbdf9d2f9 Author: Koichiro Den Date: Sat Jan 24 23:50:07 2026 +0900 PCI: dwc: Advertise dynamic inbound mapping support The DesignWare EP core has supported updating the inbound iATU mapping for an already configured BAR (i.e. allowing pci_epc_set_bar() to be called again without a prior pci_epc_clear_bar()) since commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address"). Now that this capability is exposed via the dynamic_inbound_mapping EPC feature bit, set it for DWC-based EP glue drivers using a common initializer macro to avoid duplicating the same flag in each driver. Note that pci-layerscape-ep.c is untouched. It currently constructs the feature struct dynamically in ls_pcie_ep_init(). Once converted to a static feature definition, it will use DWC_EPC_COMMON_FEATURES as well. Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Reviewed-by: Frank Li Link: https://patch.msgid.link/20260124145012.2794108-4-den@valinux.co.jp commit 31fb95400451040050361e22ff480476964280f0 Author: Koichiro Den Date: Sat Jan 24 23:50:06 2026 +0900 PCI: endpoint: Add BAR subrange mapping support Some endpoint platforms have only a small number of usable BARs. At the same time, EPF drivers (e.g. vNTB) may need multiple independent inbound regions (control/scratchpad, one or more memory windows, and optionally MSI or other feature-related regions). Subrange mapping allows these to share a single BAR without consuming additional BARs that may not be available, or forcing a fragile layout by aggressively packing into a single contiguous memory range. Extend the PCI endpoint core to support mapping subranges within a BAR. Add an optional 'submap' field in struct pci_epf_bar so an endpoint function driver can request inbound mappings that fully cover the BAR. Introduce a new EPC feature bit, subrange_mapping, and reject submap requests from pci_epc_set_bar() unless the controller advertises both subrange_mapping and dynamic_inbound_mapping features. The submap array describes the complete BAR layout (no overlaps and no gaps are allowed to avoid exposing untranslated address ranges). This provides the generic infrastructure needed to map multiple logical regions into a single BAR at different offsets, without assuming a controller-specific inbound address translation mechanism. Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260124145012.2794108-3-den@valinux.co.jp commit 06a81c5940e46cc7bddee28f16bdd29a12a76344 Author: Koichiro Den Date: Sat Jan 24 23:50:05 2026 +0900 PCI: endpoint: Add dynamic_inbound_mapping EPC feature Introduce a new EPC feature bit (dynamic_inbound_mapping) that indicates whether an Endpoint Controller can update the inbound address translation for a BAR without requiring the EPF driver to clear/reset the BAR first. Endpoint Function drivers (e.g. vNTB) can use this information to decide whether it really is safe to call pci_epc_set_bar() multiple times to update inbound mappings for the BAR. Suggested-by: Niklas Cassel Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Reviewed-by: Frank Li Link: https://patch.msgid.link/20260124145012.2794108-2-den@valinux.co.jp commit 8e03e6ecc23537531ddae6488c9dd67546486a7b Author: Andy Shevchenko Date: Tue Jan 27 09:38:45 2026 +0100 pinctrl: tangier: Join tng_pinctrl_probe() into its wrapper There is no clear sign why we have tng_pinctrl_probe() in the first place when it has already been using managed calls. Join the function into its devm_tng_pinctrl_probe() wrapper. Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit ae15231c496b1e9eed47b15de43bdb9e8e226aeb Author: Andy Shevchenko Date: Wed Jan 28 13:45:06 2026 +0100 pinctrl: tangier: Remove duplicate error messages The pin control core is covered to report any error via message. Since that it's not needed in the callers. Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 8a924c6bd0169a22e7ba7a18319fb18ec56bc994 Author: Andy Shevchenko Date: Wed Jan 28 13:46:35 2026 +0100 pinctrl: lynxpoint: Remove duplicate error messages The pin control core is covered to report any error via message. Since that it's not needed in the callers. Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 04c15be5480f7f577f6b8dbe227946538ad7393c Author: Andy Shevchenko Date: Wed Jan 28 13:53:43 2026 +0100 pinctrl: cherryview: Remove duplicate error messages The pin control core is covered to report any error via message. Since that it's not needed in the callers. Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit bcdcd19e25d54730d458a1cf7518fbbab64e5699 Author: Andy Shevchenko Date: Wed Jan 28 13:51:28 2026 +0100 pinctrl: baytrail: Remove duplicate error messages The pin control core is covered to report any error via message. Since that it's not needed in the callers. Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit a887bcb4dc3e5050d889c2ac93b0b5282c83691e Author: Andy Shevchenko Date: Wed Jan 28 14:09:25 2026 +0100 pinctrl: intel: Remove duplicate error messages The pin control core is covered to report any error via message. Since that it's not needed in the callers. Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit b661d753ce2ee951558db1f2c7b97f32d9431966 Author: Mark Brown Date: Tue Jan 27 16:16:15 2026 +0000 kselftest/arm64: Raise default number of loops in fp-pidbench When fp-pidbench was originally written SVE hardware was not widely available so it was useful to run it in emulation and the default number of loops was set very low, running for less than a second on actual hardware. Now that SVE hardware is reasonably available it is very much less interesting to use emulation, bump the default number of loops up to even out a bit of the noise on real systems. On the machine I have to hand this now takes about 15s which is still a toy microbenchmark but perhaps a bit more useful. Signed-off-by: Mark Brown Signed-off-by: Will Deacon commit 96e004b4bdf9029d137a1b06de1606ff6e263ab8 Author: Mark Brown Date: Tue Jan 27 16:16:14 2026 +0000 kselftest/arm64: Add a no-SVE loop after SVE in fp-pidbench Some applications use SVE intermittently, one common case being where SVE is used during statup (eg, by ld.so) but then rarely if ever during the main application runtime. Add a repeat of the no SVE loop after we've done the SVE loops to fp-pidbench to capture results for that. Signed-off-by: Mark Brown Signed-off-by: Will Deacon commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:34 2026 +0100 perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also disallows force-threading of the primary handler and the irq-core will warn about this. The intention here was probably not allowing forced-threading. Replace IRQF_ONESHOT with IRQF_NO_THREAD. Reviewed-by: Jonathan Cameron Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Will Deacon commit eeeb4c9874bb7ad11d322156443b1d3ebfaaa1cf Author: Krishna Chomal Date: Wed Jan 21 23:58:58 2026 +0530 platform/x86: hp-wmi: Add EC offsets to read Victus S thermal profile The current implementation for Victus S thermal profiles only supports setting the profile. The driver was missing the logic to read the hardware state, meaning it would default to "Balanced" on driver load, overriding the currently active profile. Furthermore, the driver could not detect if the firmware reset the profile on a power source change. Statically store the known EC offsets for reading thermal profile in the new .ec_tp_offset field of struct thermal_profile_params. Implement platform_profile_victus_s_get_ec() to use this offset to read the real hardware state. Additionally, update the power source event notifier to use the actual hardware state when re-triggering CPU power limits actualization. Testing on HP Omen 16-wf1xxx (board ID 8C78) confirmed that the thermal profile is now persistent across driver loads and power source change events. Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20260121182858.66363-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a7c013f779530190d0c1e1aa5e7c8a61f0bd479e Merge: 99ba0fa10de0cc 779f6e3e1cef07 Author: Miguel Ojeda Date: Wed Jan 28 13:44:42 2026 +0100 Merge patch series "refactor Rust proc macros with `syn`" Gary writes: "This series converts Rust proc macros that we have to use `syn`, and replace the custom `quote!` macro that we have with the vendored `quote!` macro. The `pin-init` macros are not converted yet; Benno has a work in progress in converting them. They're however converted to use `quote` and `proc-macro2` crate so our custom `quote!` macro can be removed. Overall this improves the robustness of the macros as we have precise parsing of the AST rather than relying on heuristics to extract needed information from there. This is also a quality-of-life improvement to those using language servers (e.g. Rust analyzer) as the span information of the proc macros are now preserved which allows the "jump-to-definition" feature to work, even when used on completely custom macros such as `module!`. Miguel gave a very good explanation on why `syn` is a good idea in the patch series that introduced it [1], which I shall not repeat here." The `pin-init` rewrite was merged just before this one. Link: https://lore.kernel.org/rust-for-linux/20251124151837.2184382-1-ojeda@kernel.org/ [1] Link: https://patch.msgid.link/20260112170919.1888584-1-gary@kernel.org Signed-off-by: Miguel Ojeda commit 779f6e3e1cef07cb0c1241d483ed364e522bd280 Author: Gary Guo Date: Tue Jan 13 17:05:21 2026 +0000 rust: macros: support `#[cfg]` properly in `#[vtable]` macro. Currently, we generate `HAS_` constants as long as the definition exists in the source, regardless if it is cfg-ed out or not. Currently, uses of `#[cfg]` present in both trait and impl, so it is not a problem; however if only the impl side uses `#[cfg]` then `HAS_` constants will incorrectly be true while it shouldnt't. With `syn` support, we can now implement `#[cfg]` handling properly by propagating the `#[cfg]` attributes to the constants. Signed-off-by: Gary Guo Reviewed-by: Benno Lossin Link: https://patch.msgid.link/20260113170529.2240744-1-gary@kernel.org Signed-off-by: Miguel Ojeda commit be97f3c82021239476ce32cddde32948c597753e Author: Gary Guo Date: Mon Jan 12 17:07:22 2026 +0000 rust: kunit: use `pin_init::zeroed` instead of custom null value The last null element can be created (constly) using `pin_init::zeroed`, so prefer to use it instead of adding a custom way of building it. Reviewed-by: Tamir Duberstein Reviewed-by: Benno Lossin Signed-off-by: Gary Guo Reviewed-by: David Gow Link: https://patch.msgid.link/20260112170919.1888584-12-gary@kernel.org Signed-off-by: Miguel Ojeda commit d421fa4f73f59c512b30338a3453b62ed8fd9122 Author: Gary Guo Date: Mon Jan 12 17:07:21 2026 +0000 rust: macros: rearrange `#[doc(hidden)]` in `module!` macro This `#[doc(hidden)]` can just be applied on a module to hide anything within. Reviewed-by: Tamir Duberstein Reviewed-by: Benno Lossin Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260112170919.1888584-11-gary@kernel.org Signed-off-by: Miguel Ojeda commit 3d5731a6be6a43d8c90d766e1404502c44545241 Author: Gary Guo Date: Mon Jan 12 17:07:20 2026 +0000 rust: macros: allow arbitrary types to be used in `module!` macro Previously this only accepts an identifier, but now with `syn` it is easy to make it accepts any type. Reviewed-by: Benno Lossin Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260112170919.1888584-10-gary@kernel.org Signed-off-by: Miguel Ojeda commit c3b416e19eb38a6b8d9a30bc7df1361ac3244464 Author: Gary Guo Date: Mon Jan 12 17:07:19 2026 +0000 rust: macros: convert `#[kunit_tests]` macro to use `syn` Make use of `syn` to parse the module structurally and thus improve the robustness of parsing. String interpolation is avoided by generating tokens directly using `quote!`. Reviewed-by: Tamir Duberstein Signed-off-by: Gary Guo Reviewed-by: Benno Lossin Reviewed-by: David Gow Link: https://patch.msgid.link/20260112170919.1888584-9-gary@kernel.org [ Pass C string to match commit 6c37b6841a92 ("rust: kunit: replace `kernel::c_str!` with C-Strings"). - Miguel ] Signed-off-by: Miguel Ojeda commit 059417ea916f6d9cf80ebb3a09645856373d5ed5 Author: Oleksandr Shamray Date: Wed Jan 28 09:59:39 2026 +0200 platform: mellanox: mlx-platform: Add support DGX flavor of next-generation 800GB/s ethernet switch. This system is based on Nvidia SN5600 Spectrum-4 Based 64x800Gb/s ETH Switch System, with the following key changes: Key changes: 1. New system SKU: HI174. 2. Power Supply: PSU AC replaiced with PDB board (added pdb/pwr attributes). 3. CPLD: Update register map with new PDB related signals. Signed-off-by: Oleksandr Shamray Reviewed-by: Vadim Pasternak Link: https://patch.msgid.link/20260128075939.2704019-3-oleksandrs@nvidia.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dbf76f865842de70d7fd7edbbb482778d70ba47e Author: Oleksandr Shamray Date: Wed Jan 28 09:59:38 2026 +0200 platform: mellanox: mlx-platform: Add support for new Nvidia DGX system based on class VMOD0010 This system is based on Nvidia QM9700 64x400G QTM-2 switch, with the following key changes: Key changes: 1. New system SKU: HI73. 2. Power Supply: PSU AC replaiced with PDB board (added pdb/pwr attributes). 3. CPLD: Update register map with new PDB related signals. Signed-off-by: Oleksandr Shamray Reviewed-by: Vadim Pasternak Link: https://patch.msgid.link/20260128075939.2704019-2-oleksandrs@nvidia.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 52f527d0916bcdd7621a0c9e7e599b133294d495 Author: Haoxiang Li Date: Sat Jan 24 18:20:54 2026 +0800 bus: fsl-mc: fix an error handling in fsl_mc_device_add() In fsl_mc_device_add(), device_initialize() is called first. put_device() should be called to drop the reference if error occurs. And other resources would be released via put_device -> fsl_mc_device_release. So remove redundant kfree() in error handling path. Fixes: bbf9d17d9875 ("staging: fsl-mc: Freescale Management Complex (fsl-mc) bus driver") Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/b767348e-d89c-416e-acea-1ebbff3bea20@stanley.mountain/ Signed-off-by: Su Hui Suggested-by: Christophe Leroy (CS GROUP) Signed-off-by: Haoxiang Li Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20260124102054.1613093-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Christophe Leroy (CS GROUP) commit f46ebb910989a1db244f95bd1f937907591aa2ee Author: Thorsten Blum Date: Tue Jan 27 23:47:01 2026 +0100 block: Replace snprintf with strscpy in check_partition Replace snprintf("%s", ...) with the faster and more direct strscpy(). Signed-off-by: Thorsten Blum Signed-off-by: Jens Axboe commit 3373503df025ab6c9a8ad2ce6b7febd2eb3c99dc Author: Christoph Hellwig Date: Mon Jan 26 06:53:46 2026 +0100 xfs: use bounce buffering direct I/O when the device requires stable pages Fix direct I/O on devices that require stable pages by asking iomap to bounce buffer. To support this, ioends are used for direct reads in this case to provide a user context for copying data back from the bounce buffer. This fixes qemu when used on devices using T10 protection information and probably other cases like iSCSI using data digests. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit c9d114846b380fec1093b7bca91ee5a8cd7b575d Author: Christoph Hellwig Date: Mon Jan 26 06:53:45 2026 +0100 iomap: add a flag to bounce buffer direct I/O Add a new flag that request bounce buffering for direct I/O. This is needed to provide the stable pages requirement requested by devices that need to calculate checksums or parity over the data and allows file systems to properly work with things like T10 protection information. The implementation just calls out to the new bio bounce buffering helpers to allocate a bounce buffer, which is used for I/O and to copy to/from it. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit d969bd72cf6835a4c915b326feb92c7597a46d98 Author: Christoph Hellwig Date: Mon Jan 26 06:53:44 2026 +0100 iomap: support ioends for direct reads Support using the ioend structure to defer I/O completion for direct reads in addition to writes. This requires a check for the operation to not merge reads and writes in iomap_ioend_can_merge. This support will be used for bounce buffered direct I/O reads that need to copy data back to the user address space on read completion. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit c96b8b220271024c04289d6d9779dc2ccbd12be2 Author: Christoph Hellwig Date: Mon Jan 26 06:53:43 2026 +0100 iomap: rename IOMAP_DIO_DIRTY to IOMAP_DIO_USER_BACKED Match the more descriptive iov_iter terminology instead of encoding what we do with them for reads only. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 45cec0de6c8973660da279e44b24d37af49daeb6 Author: Christoph Hellwig Date: Mon Jan 26 06:53:42 2026 +0100 iomap: free the bio before completing the dio There are good arguments for processing the user completions ASAP vs. freeing resources ASAP, but freeing the bio first here removes potential use after free hazards when checking flags, and will simplify the upcoming bounce buffer support. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit e2fcff5bb4c48bf602082e5a1428ff7328f7558f Author: Christoph Hellwig Date: Mon Jan 26 06:53:41 2026 +0100 iomap: share code between iomap_dio_bio_end_io and iomap_finish_ioend_direct Refactor the two per-bio completion handlers to share common code using a new helper. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 2631c94602297090febd8f93d6f96d9d2045466d Author: Christoph Hellwig Date: Mon Jan 26 06:53:40 2026 +0100 iomap: split out the per-bio logic from iomap_dio_bio_iter Factor out a separate helper that builds and submits a single bio. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 6e7a6c80198ead08b11aa6cdc92e60a42fc5895f Author: Christoph Hellwig Date: Mon Jan 26 06:53:39 2026 +0100 iomap: simplify iomap_dio_bio_iter Use iov_iter_count to check if we need to continue as that just reads a field in the iov_iter, and only use bio_iov_vecs_to_alloc to calculate the actual number of vectors to allocate for the bio. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Signed-off-by: Jens Axboe commit 4ad357e39b2ecd5da7bcc7e840ee24d179593cd5 Author: Christoph Hellwig Date: Mon Jan 26 06:53:38 2026 +0100 iomap: fix submission side handling of completion side errors The "if (dio->error)" in iomap_dio_bio_iter exists to stop submitting more bios when a completion already return an error. Commit cfe057f7db1f ("iomap_dio_actor(): fix iov_iter bugs") made it revert the iov by "copied", which is very wrong given that we've already consumed that range and submitted a bio for it. Fixes: cfe057f7db1f ("iomap_dio_actor(): fix iov_iter bugs") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Signed-off-by: Jens Axboe commit 8dd5e7c75d7bb2635c7efd219ff20693fc24096a Author: Christoph Hellwig Date: Mon Jan 26 06:53:37 2026 +0100 block: add helpers to bounce buffer an iov_iter into bios Add helpers to implement bounce buffering of data into a bio to implement direct I/O for cases where direct user access is not possible because stable in-flight data is required. These are intended to be used as easily as bio_iov_iter_get_pages for the zero-copy path. The write side is trivial and just copies data into the bounce buffer. The read side is a lot more complex because it needs to perform the copy from the completion context, and without preserving the iov_iter through the call chain. It steals a trick from the integrity data user interface and uses the first vector in the bio for the bounce buffer data that is fed to the block I/O stack, and uses the others to record the user buffer fragments. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Tested-by: Anuj Gupta Reviewed-by: Martin K. Petersen Reviewed-by: Darrick J. Wong Signed-off-by: Jens Axboe commit 301f5356521ed90f72a67797156d75093aac786f Author: Christoph Hellwig Date: Mon Jan 26 06:53:36 2026 +0100 block: remove bio_release_page Merge bio_release_page into the only remaining caller. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 91b73c458182801a8c9cf6135335e064567d1013 Author: Christoph Hellwig Date: Mon Jan 26 06:53:35 2026 +0100 iov_iter: extract a iov_iter_extract_bvecs helper from bio code Massage __bio_iov_iter_get_pages so that it doesn't need the bio, and move it to lib/iov_iter.c so that it can be used by block code for other things than filling a bio and by other subsystems like netfs. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 12da89e8844ae16e86b75a32b34a4f0b0525f453 Author: Christoph Hellwig Date: Mon Jan 26 06:53:34 2026 +0100 block: open code bio_add_page and fix handling of mismatching P2P ranges bio_add_page fails to add data to the bio when mixing P2P with non-P2P ranges, or ranges that map to different P2P providers. In that case it will trigger that WARN_ON and return an error up the chain instead of simply starting a new bio as intended. Fix this by open coding bio_add_page and handling this case explicitly. While doing so, stop merging physical contiguous data that belongs to multiple folios. While this merge could lead to more efficient bio packing in some case, dropping will allow to remove handling of this corner case in other places and make the code more robust. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 4d77007d42fd4f44c2f5a1555603df53e16a1362 Author: Christoph Hellwig Date: Mon Jan 26 06:53:33 2026 +0100 block: refactor get_contig_folio_len Move all of the logic to find the contigous length inside a folio into get_contig_folio_len instead of keeping some of it in the caller. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Darrick J. Wong Tested-by: Anuj Gupta Reviewed-by: Martin K. Petersen Reviewed-by: Anuj Gupta Signed-off-by: Jens Axboe commit fa0bdd45d7e3703826ea75f5fe3359865d75c319 Author: Christoph Hellwig Date: Mon Jan 26 06:53:32 2026 +0100 block: add a BIO_MAX_SIZE constant and use it Currently the only constant for the maximum bio size is BIO_MAX_SECTORS, which is in units of 512-byte sectors, but a lot of user need a byte limit. Add a BIO_MAX_SIZE constant, redefine BIO_MAX_SECTORS in terms of it, and switch all bio-related uses of UINT_MAX for the maximum size to use the symbolic names instead. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Darrick J. Wong Reviewed-by: Anuj Gupta Reviewed-by: Johannes Thumshirn Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit 9409d18bf7d58ab716337749e28e2caba0d64cb0 Author: Sheetal Date: Fri Jan 23 15:23:45 2026 +0530 ASoC: tegra: set reg_default_cb callback Set reg_default_cb so REGCACHE_FLAT can supply zero defaults without large reg_defaults tables, simplifying cache initialization for zero-reset registers. Signed-off-by: Sheetal Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260123095346.1258556-4-sheetal@nvidia.com Signed-off-by: Mark Brown commit 0ba6286a71581aaf8413a55b9bd90ea3463fd23b Author: Sheetal Date: Fri Jan 23 15:23:43 2026 +0530 ASoC: tegra: Add AHUB writeable_reg for RX holes Add writeable_reg callbacks for Tegra210/186 AHUB RX registers so the flat cache only treats valid RX locations as writable, avoiding holes in the register map. Fixes: 16e1bcc2caf4 ("ASoC: tegra: Add Tegra210 based AHUB driver") Signed-off-by: Sheetal Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260123095346.1258556-2-sheetal@nvidia.com Signed-off-by: Mark Brown commit c46f7cb338ef2286cab84bae5247128f2d37923c Merge: 5d4ae0bffb6eea 4748bb49b66881 Author: Ilpo Järvinen Date: Wed Jan 28 14:03:40 2026 +0200 Merge branch 'platform-drivers-x86-asus-kbd' into for-next commit 4748bb49b66881f0177057bd22bb3bf8f2ba142c Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:44 2026 +0100 HID: asus: add support for the asus-wmi brightness handler If the asus-wmi brightness handler is available, send the keyboard brightness events to it instead of passing them to userspace. If it is not, fall back to sending them to it. Reviewed-by: Luke D. Jones Tested-by: Luke D. Jones Reviewed-by: Denis Benato Acked-by: Benjamin Tissoires Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260122075044.5070-12-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7525566abd360ca425e43dd3f7f09fa3445dae17 Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:43 2026 +0100 platform/x86: asus-wmi: add keyboard brightness event handler The keyboard brightness control of Asus WMI keyboards is handled in kernel, which leads to the shortcut going from brightness 0, to 1, to 2, and 3. However, for HID keyboards it is exposed as a key and handled by the user's desktop environment. For the toggle button, this means that brightness control becomes on/off. In addition, in the absence of a DE, the keyboard brightness does not work. Therefore, expose an event handler for the keyboard brightness control which can then be used by hid-asus. Since this handler is called from an interrupt context, defer the actual work to a workqueue. In the process, introduce ASUS_EV_MAX_BRIGHTNESS to hold the constant for maximum brightness since it is shared between hid-asus/asus-wmi. Reviewed-by: Luke D. Jones Tested-by: Luke D. Jones Acked-by: Benjamin Tissoires Reviewed-by: Denis Benato Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260122075044.5070-11-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d3133ccaf53694498b9827c5f9dbae52fc199d28 Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:42 2026 +0100 platform/x86: asus-wmi: remove unused keyboard backlight quirk The quirk for selecting whether keyboard backlight should be controlled by HID or WMI is not needed anymore, so remove the file containing it. Reviewed-by: Denis Benato Acked-by: Benjamin Tissoires Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260122075044.5070-10-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b34b5945a7694e4fc53f5912b3b93d2bb8fdc9de Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:41 2026 +0100 HID: asus: listen to the asus-wmi brightness device instead of creating one Some ROG laptops expose multiple interfaces for controlling the keyboard/RGB brightness. This creates a name conflict under asus::kbd_brightness, where the second device ends up being named asus::kbd_brightness_1 and they are both broken. Therefore, register a listener to the asus-wmi brightness device instead of creating a new one. Reviewed-by: Luke D. Jones Reviewed-by: Benjamin Tissoires Reviewed-by: Denis Benato Acked-by: Benjamin Tissoires Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260122075044.5070-9-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit fac55d29581fcd4c3b66b9c2b9f7995c459c0064 Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:40 2026 +0100 platform/x86: asus-wmi: Add support for multiple kbd led handlers Some devices, such as the Z13 have multiple Aura devices connected to them by USB. In addition, they might have a WMI interface for RGB. In Windows, Armoury Crate exposes a unified brightness slider for all of them, with 3 brightness levels. Therefore, to be synergistic in Linux, and support existing tooling such as UPower, allow adding listeners to the RGB device of the WMI interface. If WMI does not exist, lazy initialize the interface. Since hid-asus and asus-wmi can both interact with the led objects including from an atomic context, protect the brightness access with a spinlock and update the values from a workqueue. Use this workqueue to also process WMI keyboard events, so they are handled asynchronously. Acked-by: Benjamin Tissoires Signed-off-by: Antheas Kapenekakis Reviewed-by: Denis Benato Link: https://patch.msgid.link/20260122075044.5070-8-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4ac74ea68f6429512faf06a3365a2ba6b96d48d6 Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:39 2026 +0100 HID: asus: early return for ROG devices Some ROG devices have a new dynamic backlight interface for control by Windows. This interface does not create an ->input device, causing the kernel to print an error message and to eject it. In addition, ROG devices have proper HID names in their descriptors so renaming them is not necessary. Therefore, if a device is identified as ROG, early return from probe to skip renaming and ->input checks. Acked-by: Benjamin Tissoires Reviewed-by: Denis Benato Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260122075044.5070-7-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2b92b797a153258c9f17786c2ab28b568f5aadf3 Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:38 2026 +0100 HID: asus: move vendor initialization to probe ROG NKEY devices have multiple HID endpoints, around 3-4. One of those endpoints has a usage page of 0xff31, and is the one that emits keyboard shortcuts and controls RGB/backlight. Currently, this driver places the usage page check under asus_input_mapping and then inits backlight in asus_input_configured which is unnecessarily complicated and prevents probe from performing customizations on the vendor endpoint. Simplify the logic by introducing an is_vendor variable into probe that checks for usage page 0xff31. Then, use this variable to move backlight initialization into probe instead of asus_input_configured, and remove the backlight check from asus_input_mapping. Acked-by: Benjamin Tissoires Reviewed-by: Denis Benato Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260122075044.5070-6-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e82ae34af29e910c96d33c8b3a90c60e27f1625e Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:37 2026 +0100 HID: asus: fortify keyboard handshake Handshaking with an Asus device involves sending it a feature report with the string "ASUS Tech.Inc." and then reading it back to verify the handshake was successful, under the feature ID the interaction will take place. Currently, the driver only does the first part. Add the readback to verify the handshake was successful. As this could cause breakages, allow the verification to fail with a dmesg error until we verify all devices work with it (they seem to). Since the response is more than 16 bytes, increase the buffer size to 64 as well to avoid overflow errors. In addition, add the report ID to prints, to help identify failed handshakes. Reviewed-by: Benjamin Tissoires Reviewed-by: Denis Benato Acked-by: Benjamin Tissoires Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260122075044.5070-5-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6a293b6edb537baf201c5ceb3afdbff7f42e97c2 Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:36 2026 +0100 HID: asus: use same report_id in response Currently, asus_kbd_get_functions prods the device using feature report report_id, but then is hardcoded to check the response through FEATURE_KBD_REPORT_ID. This only works if report_id is that value (currently true). So, use report_id in the response as well to maintain functionality if that value changes in the future. Reviewed-by: Denis Benato Acked-by: Benjamin Tissoires Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260122075044.5070-4-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4ac51daa5078e1e4b27a9afdc64a3f5780ae3cfb Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:35 2026 +0100 HID: asus: initialize additional endpoints only for certain devices Currently, ID1/ID2 initializations are performed for all NKEY devices. However, ID1 initializations are only required for RGB control and are only supported for RGB capable devices. ID2 initializations are only required for initializing the Anime display endpoint which is only supported on devices with an Anime display. Both of these initializations are for functionality that is not present on this driver and are performed for devices which might not support them. At the same time, there are older NKEY devices that have only been tested with these initializations in the kernel and it is not possible to recheck them. There is a possibility that especially with the ID1 initialization, certain laptop models might have their shortcuts stop working (currently unproven). To avoid sending unnecessary commands, change to only initialize ID1/ID2 for those NKEY devices suspected to be problematic without them by introducing a quirk for them and replacing the NKEY quirk in the block that performs the inits with that. Therefore, new devices that do not need (and some do not support) these initializations will not have them performed. In addition, as these initializations might not be supported by the affected devices, change the function to not bail if they fail. Acked-by: Benjamin Tissoires Signed-off-by: Antheas Kapenekakis Reviewed-by: Denis Benato Link: https://patch.msgid.link/20260122075044.5070-3-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 56d1b33e644cca1bedffbc73d28778ed4ae30f64 Author: Antheas Kapenekakis Date: Thu Jan 22 08:50:34 2026 +0100 HID: asus: simplify RGB init sequence Currently, RGB initialization forks depending on whether a device is NKEY. However, in reality both initialization forks are the same, other than the NKEY initialization initializing the LED_REPORT_ID1, LED_REPORT_ID2 endpoints, and the non-NKEY initialization having a functionality check which is skipped for the NKEY path. Therefore, merge the if blocks, gate the ID1/ID2 initializations behind the NKEY quirk instead, and introduce the functionality check for NKEY devices (it is supported by them). There should be no functional change with this patch. Acked-by: Benjamin Tissoires Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260122075044.5070-2-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5c6808d10499f6c8a8d5ee948a22fc93814f6d66 Author: Andy Shevchenko Date: Wed Jan 28 10:57:48 2026 +0100 spi: dw: Remove duplicate error message devm_platform_ioremap_resource() prints an error message depending on the actual error. The caller doesn't need to repeat that. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260128095748.4156926-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit ab3f4f0c7f3aa050cd602cc32830e24ac4aaee97 Author: Shengjiu Wang Date: Wed Jan 28 10:59:55 2026 +0800 ASoC: wm8962: add .set_tdm_slot callback function The slot_width can be different with the params_width(), for example, DSP_A mode, slot_width = 32, but data format is S16_LE, if the word length is configured to be 16, there is no sound on the right speaker. So add .set_tdm_slot() callback function to configure the slot_width and update the word length according to slot_width in hw_params(). Signed-off-by: Shengjiu Wang Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260128025955.2562331-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 751ec6dd6773237bf480291ca894a696a2991c62 Merge: e540be7d56d740 04f7516ab70f7b Author: Mark Brown Date: Wed Jan 28 11:22:06 2026 +0000 spi: aspeed: Improve handling of shared SPI Merge series from Chin-Ting Kuo : This patch series improves handling of SPI controllers that are shared by spi-mem devices and other SPI peripherals. The primary goal of this series is to support non-spi-mem devices in the ASPEED FMC/SPI controller driver. It also addresses an issue in the spi-mem framework observed when different types of SPI devices operate concurrently on the same controller, ensuring that spi-mem operations are properly serialized. commit 5ee62b4a91137557ee4b09d1604f1dfd0b4344a8 Author: Chuck Lever Date: Tue Jan 27 19:54:00 2026 -0500 svcrdma: use bvec-based RDMA read/write API Convert svcrdma to the bvec-based RDMA API introduced earlier in this series. The bvec-based RDMA API eliminates the intermediate scatterlist conversion step, allowing direct DMA mapping from bio_vec arrays. This simplifies the svc_rdma_rw_ctxt structure by removing the chained SG table management. The structure retains an inline array approach similar to the previous scatterlist implementation: an inline bvec array sized to max_send_sge handles most I/O operations without additional allocation. Larger requests fall back to dynamic allocation. This preserves the allocation-free fast path for typical NFS operations while supporting arbitrarily large transfers. The bvec API handles all device types internally, including iWARP devices which require memory registration. No explicit fallback path is needed. Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260128005400.25147-6-cel@kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Leon Romanovsky commit afcae7d7b8a278a6c29e064f99e5bafd4ac1fb37 Author: Chuck Lever Date: Tue Jan 27 19:53:59 2026 -0500 RDMA/core: add rdma_rw_max_sge() helper for SQ sizing svc_rdma_accept() computes sc_sq_depth as the sum of rq_depth and the number of rdma_rw contexts (ctxts). This value is used to allocate the Send CQ and to initialize the sc_sq_avail credit pool. However, when the device uses memory registration for RDMA operations, rdma_rw_init_qp() inflates the QP's max_send_wr by a factor of three per context to account for REG and INV work requests. The Send CQ and credit pool remain sized for only one work request per context, causing Send Queue exhaustion under heavy NFS WRITE workloads. Introduce rdma_rw_max_sge() to compute the actual number of Send Queue entries required for a given number of rdma_rw contexts. Upper layer protocols call this helper before creating a Queue Pair so that their Send CQs and credit accounting match the QP's true capacity. Update svc_rdma_accept() to use rdma_rw_max_sge() when computing sc_sq_depth, ensuring the credit pool reflects the work requests that rdma_rw_init_qp() will reserve. Reviewed-by: Christoph Hellwig Fixes: 00bd1439f464 ("RDMA/rw: Support threshold for registration vs scattering to local pages") Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260128005400.25147-5-cel@kernel.org Signed-off-by: Leon Romanovsky commit bea28ac14cab25d79ea759138def79aa82e0b428 Author: Chuck Lever Date: Tue Jan 27 19:53:58 2026 -0500 RDMA/core: add MR support for bvec-based RDMA operations The bvec-based RDMA API currently returns -EOPNOTSUPP when Memory Region registration is required. This prevents iWARP devices from using the bvec path, since iWARP requires MR registration for RDMA READ operations. The force_mr debug parameter is also unusable with bvec input. Add rdma_rw_init_mr_wrs_bvec() to handle MR registration for bvec arrays. The approach creates a synthetic scatterlist populated with DMA addresses from the bvecs, then reuses the existing ib_map_mr_sg() infrastructure. This avoids driver changes while keeping the implementation small. The synthetic scatterlist is stored in the rdma_rw_ctx for cleanup. On destroy, the MRs are returned to the pool and the bvec DMA mappings are released using the stored addresses. Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260128005400.25147-4-cel@kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Leon Romanovsky commit 853e892076ba5666c81afbc86552e008280f9768 Author: Chuck Lever Date: Tue Jan 27 19:53:57 2026 -0500 RDMA/core: use IOVA-based DMA mapping for bvec RDMA operations The bvec RDMA API maps each bvec individually via dma_map_phys(), requiring an IOTLB sync for each mapping. For large I/O operations with many bvecs, this overhead becomes significant. The two-step IOVA API (dma_iova_try_alloc / dma_iova_link / dma_iova_sync) allocates a contiguous IOVA range upfront, links all physical pages without IOTLB syncs, then performs a single sync at the end. This reduces IOTLB flushes from O(n) to O(1). It also requires only a single output dma_addr_t compared to extra per-input element storage in struct scatterlist. Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260128005400.25147-3-cel@kernel.org Signed-off-by: Leon Romanovsky commit 5e541553588d493bd9317bc8a8c1ab85cbddc2c5 Author: Chuck Lever Date: Tue Jan 27 19:53:56 2026 -0500 RDMA/core: add bio_vec based RDMA read/write API The existing rdma_rw_ctx_init() API requires callers to construct a scatterlist, which is then DMA-mapped page by page. Callers that already have data in bio_vec form (such as the NVMe-oF target) must first convert to scatterlist, adding overhead and complexity. Introduce rdma_rw_ctx_init_bvec() and rdma_rw_ctx_destroy_bvec() to accept bio_vec arrays directly. The new helpers use dma_map_phys() for hardware RDMA devices and virtual addressing for software RDMA devices (rxe, siw), avoiding intermediate scatterlist construction. Memory registration (MR) path support is deferred to a follow-up series; callers requiring MR-based transfers (iWARP devices or force_mr=1) receive -EOPNOTSUPP and should use the scatterlist API. Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260128005400.25147-2-cel@kernel.org Signed-off-by: Leon Romanovsky commit ac059ae422d7d05ed9d62970a30fa3b95870b967 Author: Ingo Molnar Date: Wed Jan 28 11:35:20 2026 +0100 x86/hyperv: Fix smp_ops build failure on UP kernels CI testing found this build failure: arch/x86/hyperv/hv_crash.c:631:9: error: ‘smp_ops’ undeclared (first use in this function) And I bisected it back to the initial commit that enabled this feature: 77c860d2dbb72d1f3c6a2e882a07d19eca399db5 is the first bad commit commit 77c860d2dbb72d1f3c6a2e882a07d19eca399db5 (HEAD) Author: Mukesh Rathor Date: Mon Oct 6 15:42:08 2025 -0700 x86/hyperv: Enable build of hypervisor crashdump collection files Hyperv should probably be limited to SMP kernels, as nobody appears to be testing it on UP kernels. Until then, fix the smp_ops assumption. Build tested only. Fixes: 77c860d2dbb72 ("x86/hyperv: Enable build of hypervisor crashdump collection files") Cc: Mukesh Rathor Cc: Wei Liu Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit 959d2c356e32abde9c5b95c7e83236cded94251a Author: Carlos Bilbao Date: Tue Jan 27 17:44:46 2026 -0800 RDMA/irdma: Use kvzalloc for paged memory DMA address array Allocate array chunk->dmainfo.dmaaddrs using kvzalloc() to allow the allocation to fall back to vmalloc when contiguous memory is unavailable (instead of failing and logging page allocation warnings). Acked-by: Tatyana Nikolova Signed-off-by: Carlos Bilbao (Lambda) Link: https://patch.msgid.link/20260128014446.405247-1-carlos.bilbao@kernel.org Signed-off-by: Leon Romanovsky commit 1932db202c9326747c6046959284992ab4124bac Author: Sebastian Andrzej Siewior Date: Wed Jan 28 10:55:32 2026 +0100 rtc: amlogic-a4: Remove IRQF_ONESHOT Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also disallows force-threading of the primary handler and the irq-core will warn about this. Remove IRQF_ONESHOT from irqflags. Fixes: c89ac9182ee29 ("rtc: support for the Amlogic on-chip RTC") Reviewed-by: Xianwei Zhao Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260128095540.863589-13-bigeasy@linutronix.de Signed-off-by: Alexandre Belloni commit 87bf646921430e303176edc4eb07c30160361b73 Author: Li Zhijian Date: Tue Jan 20 15:44:37 2026 +0800 RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swapper/0/0 ... libsha1 [last unloaded: ip6_udp_tunnel] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G C 6.19.0-rc5-64k-v8+ #37 PREEMPT Tainted: [C]=CRAP Hardware name: Raspberry Pi 4 Model B Rev 1.2 Call trace: rxe_sched_task+0x1c8/0x238 [rdma_rxe] (P) retransmit_timer+0x130/0x188 [rdma_rxe] call_timer_fn+0x68/0x4d0 __run_timers+0x630/0x888 ... WARNING: drivers/infiniband/sw/rxe/rxe_task.c:38 at rxe_sched_task+0x1c0/0x238 [rdma_rxe], CPU#0: swapper/0/0 ... WARNING: drivers/infiniband/sw/rxe/rxe_task.c:111 at do_work+0x488/0x5c8 [rdma_rxe], CPU#3: kworker/u17:4/93400 ... refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x138/0x1a0, CPU#3: kworker/u17:4/93400 The issue is caused by a race condition between retransmit_timer() and rxe_destroy_qp, leading to the Queue Pair's (QP) reference count dropping to zero during timer handler execution. It seems this warning is harmless because rxe_qp_do_cleanup() will flush all pending timers and requests. Example of flow causing the issue: CPU0 CPU1 retransmit_timer() { spin_lock_irqsave rxe_destroy_qp() __rxe_cleanup() __rxe_put() // qp->ref_count decrease to 0 rxe_qp_do_cleanup() { if (qp->valid) { rxe_sched_task() { WARN_ON(rxe_read(task->qp) <= 0); } } spin_unlock_irqrestore } spin_lock_irqsave qp->valid = 0 spin_unlock_irqrestore } Ensure the QP's reference count is maintained and its validity is checked within the timer callbacks by adding calls to rxe_get(qp) and corresponding rxe_put(qp) after use. Signed-off-by: Li Zhijian Fixes: d94671632572 ("RDMA/rxe: Rewrite rxe_task.c") Link: https://patch.msgid.link/20260120074437.623018-1-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit aa7e37fd770bafaaf856ab77735296955b93e377 Author: Vivian Wang Date: Tue Jan 27 10:58:49 2026 +0800 gpio: spacemit-k1: Use PDR for pin direction, not SDR/CDR On the SpacemiT GPIO controller, the direction control register PDR is readable and writable [1]. Therefore, implement direction control by using PDR as dirout, and don't mark it as unreadable. The original implementation, using SDR as dirout and CDR as dirin, is not actually a supported configuration by gpio-mmio. The hardware supports changing the direction of some pins atomically by writing a value with the corresponding bits set to SDR (set as output) or to CDR (set as input). However, gpio-mmio does not actually handle this. Using only PDR as dirout to match the expectations of gpio-mmio. This also allows us to avoid clobbering potentially important GPIO direction configurations set by pre-Linux boot stages. Found while trying to add PCIe support to OrangePi RV2, where the regulator (controlled by GPIO 116) turns off on boot while some other GPIO pin in the same bank is touched, which is not desirable. Link: https://developer.spacemit.com/documentation?token=Rn9Kw3iFHirAMgkIpTAcV2Arnkf#18.4-gpio # [1] Fixes: d00553240ef8 ("gpio: spacemit: add support for K1 SoC") Signed-off-by: Vivian Wang Reviewed-by: Troy Mitchell Link: https://patch.msgid.link/20260127-gpio-spacemit-k1-pdr-v1-1-bb868a517dbc@iscas.ac.cn Signed-off-by: Bartosz Golaszewski commit 692243cac63195ba38512a86bdb47b9c3190716b Merge: c04ed39d85784a 55e03b8cbe2783 Author: Carlos Maiolino Date: Wed Jan 28 10:22:09 2026 +0100 Merge tag 'scrub-syzbot-fixes-7.0_2026-01-25' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux into xfs-7.0-merge xfs: syzbot fixes for online fsck [3/3] Fix various syzbot complaints about scrub that Jiaming Zhang found. With a bit of luck, this should all go splendidly. Signed-off-by: "Darrick J. Wong" Signed-off-by: Carlos Maiolino commit 9bfa52dac27a20b43bcb73e56dc45aba6b9aaff1 Author: Tamir Duberstein Date: Wed Jan 21 11:10:08 2026 -0500 printf: convert test_hashed into macro This allows the compiler to check the arguments against the __printf() attribute on __test(). This produces better diagnostics when incorrect inputs are passed. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512061600.89CKQ3ag-lkp@intel.com/ Signed-off-by: Tamir Duberstein Reviewed-by: Petr Mladek Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260121-printf-kunit-printf-attr-v3-1-4144f337ec8b@kernel.org Signed-off-by: Petr Mladek commit c04ed39d85784a68d565709db4b7246a701af731 Merge: 2744d7adb26228 eaec8aeff31d06 Author: Carlos Maiolino Date: Wed Jan 28 10:16:12 2026 +0100 Merge tag 'attr-pptr-speedup-7.0_2026-01-25' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux into xfs-7.0-merge xfs: improve shortform attr performance [2/3] Improve performance of the xattr (and parent pointer) code when the attr structure is in short format and we can therefore perform all updates in a single transaction. Avoiding the attr intent code brings a very nice speedup in those operations. With a bit of luck, this should all go splendidly. Signed-off-by: "Darrick J. Wong" Signed-off-by: Carlos Maiolino commit 2744d7adb2622864f2e4fb15cbc85aed3fbe1e8f Merge: 04a65666a69508 bd3138e8912c9d Author: Carlos Maiolino Date: Wed Jan 28 10:15:07 2026 +0100 Merge tag 'attr-leaf-freemap-fixes-7.0_2026-01-25' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux into xfs-7.0-merge xfs: fix problems in the attr leaf freemap code [1/3] Running generic/753 for hours revealed data corruption problems in the attr leaf block space management code. Under certain circumstances, freemap entries are left with zero size but a nonzero offset. If that offset happens to be the same offset as the end of the entries array during an attr set operation, the leaf entry table expansion will push the freemap record offset upwards without checking for overlap with any other freemap entries. If there happened to be a second freemap entry overlapping with the newly allocated leaf entry space, then the next attr set operation might find that space and overwrite the leaf entry, thereby corrupting the leaf block. Fix this by zeroing the freemap offset any time we set the size to zero. If a subsequent attr set operation finds no space in the freemap, it will compact the block and regenerate the freemaps. With a bit of luck, this should all go splendidly. Signed-off-by: "Darrick J. Wong" Signed-off-by: Carlos Maiolino commit 4c4ff6e38768f2431ed153f110f2d1fcce848af8 Author: Diogo Ivo Date: Tue Jan 27 18:52:42 2026 +0000 gpio: max77620: Implement .get_direction() callback Add support for reporting the current GPIO line direction by implementing the .get_direction() callback for the MAX77620 GPIO controller. Signed-off-by: Diogo Ivo Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260127-smaug-spi_flash-v1-1-5fd334415118@tecnico.ulisboa.pt Signed-off-by: Bartosz Golaszewski commit 04a65666a69508fa0022c7343026c5a3d41d166d Merge: a1ca658d649a4d b8accfd65d31f2 Author: Carlos Maiolino Date: Wed Jan 28 09:47:42 2026 +0100 Merge tag 'health-monitoring-7.0_2026-01-20' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux into xfs-7.0-merge xfs: autonomous self healing of filesystems [v7] This patchset builds new functionality to deliver live information about filesystem health events to userspace. This is done by creating an anonymous file that can be read() for events by userspace programs. Events are captured by hooking various parts of XFS and iomap so that metadata health failures, file I/O errors, and major changes in filesystem state (unmounts, shutdowns, etc.) can be observed by programs. When an event occurs, the hook functions queue an event object to each event anonfd for later processing. Programs must have CAP_SYS_ADMIN to open the anonfd and there's a maximum event lag to prevent resource overconsumption. The events themselves can be read() from the anonfd as C structs for the xfs_healer daemon. In userspace, we create a new daemon program that will read the event objects and initiate repairs automatically. This daemon is managed entirely by systemd and will not block unmounting of the filesystem unless repairs are ongoing. They are auto-started by a starter service that uses fanotify. This patchset depends on the new fserror code that Christian Brauner has tentatively accepted for Linux 7.0: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git/log/?h=vfs-7.0.fserror v7: more cleanups of the media verification ioctl, improve comments, and reuse the bio v6: fix pi-breaking bugs, make verify failures trigger health reports and filter bio status flags better v5: add verify-media ioctl, collapse small helper funcs with only one caller v4: drop multiple client support so we can make direct calls into healthmon instead of chasing pointers and doing indirect calls v3: drag out of rfc status With a bit of luck, this should all go splendidly. Conflicts: This merge required an update on files: - fs/xfs/xfs_healthmon.c - fs/xfs/xfs_verify_media.c Such change was required because a parallel developement changed XFS header file xfs.h naming to xfs_platform.h, so the merge required to update those includes in both files above Signed-off-by: "Darrick J. Wong" Signed-off-by: Carlos Maiolino commit 18a777eee28938a70a7fb103e37ff4ba56e5b673 Author: Shawn Landden Date: Tue Jan 27 09:05:52 2026 -0800 isofs: support full length file names (255 instead of 253) Linux file names are in principle limited only to PATH_MAX (which is 4096) but the code in get_rock_ridge_filename() limits them to 253 characters. As mentioned by Jan Kara, the Rockridge standard to ECMA119/ISO9660 has no limit of file name length, but this limits file names to the traditional 255 NAME_MAX value. Signed-off-by: Shawn Landden Link: https://patch.msgid.link/CA+49okq0ouJvAx0=txR_gyNKtZj55p3Zw4MB8jXZsGr4bEGjRA@mail.gmail.com Signed-off-by: Jan Kara commit f88a31308db6a856229150039b0f56d59696ed31 Author: Randy Dunlap Date: Fri Jan 23 10:37:49 2026 -0800 seqlock: fix scoped_seqlock_read kernel-doc Eliminate all kernel-doc warnings in seqlock.h: - correct the macro to have "()" immediately following the macro name - don't include the macro parameters in the short description (first line) - make the parameter names in the comments match the actual macro parameter names. - use "::" for the Example WARNING: include/linux/seqlock.h:1341 This comment starts with '/**', but isn't a kernel-doc comment. * scoped_seqlock_read (lock, ss_state) - execute the read side critical Documentation/locking/seqlock:242: include/linux/seqlock.h:1351: WARNING: Definition list ends without a blank line; unexpected unindent. [docutils] Warning: include/linux/seqlock.h:1357 function parameter '_seqlock' not described in 'scoped_seqlock_read' Warning: include/linux/seqlock.h:1357 function parameter '_target' not described in 'scoped_seqlock_read' Fixes: cc39f3872c08 ("seqlock: Introduce scoped_seqlock_read()") Signed-off-by: Randy Dunlap Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260123183749.3997533-1-rdunlap@infradead.org commit 944e3f7562c55fa37ebcdd58e5f60f296c81a854 Author: Marco Elver Date: Tue Jan 27 12:12:06 2026 +0100 tools: Update context analysis macros in compiler_types.h In sync with the main kernel headers, include a stub version of compiler-context-analysis.h in tools/include/linux/compiler_types.h and remove the sparse context tracking definitions. Since tools/ headers are generally self-contained, provide a standalone tools/include/linux/compiler-context-analysis.h with no-op stubs for now. Also clean up redundant stubs in tools/testing/shared/linux/kernel.h that are now redundant. This fixes build errors in tools/testing/radix-tree/ where headers from include/linux/ (like cleanup.h) are used directly and expect these macros to be defined: | cc -I../shared -I. -I../../include -I../../arch/x86/include -I../../../lib -g -Og -Wall -D_LGPL_SOURCE -fsanitize=address -fsanitize=undefined -c -o radix-tree.o radix-tree.c | In file included from ../shared/linux/cleanup.h:2, | from ../shared/linux/../../../../include/linux/idr.h:18, | from ../shared/linux/idr.h:5, | from radix-tree.c:18: | ../shared/linux/../../../../include/linux/idr.h: In function ‘class_idr_alloc_destructor’: | ../shared/linux/../../../../include/linux/cleanup.h:283:9: error: expected declaration specifiers before ‘__no_context_analysis’ | 283 | __no_context_analysis \ | | ^~~~~~~~~~~~~~~~~~~~~ Closes: https://lore.kernel.org/oe-lkp/202601261546.d7ae2447-lkp@intel.com Reported-by: kernel test robot Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Lorenzo Stoakes Tested-by: Lorenzo Stoakes Link: https://patch.msgid.link/20260127111428.3747328-1-elver@google.com commit e6de07249ef381b674f0d65adf9defcdab76b768 Author: Tamir Duberstein Date: Thu Jan 22 21:46:24 2026 -0800 rust: sync: Replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Signed-off-by: Tamir Duberstein Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260120-cstr-sync-again-v1-1-2a775a2a36fd@kernel.org Link: https://patch.msgid.link/20260123054624.8226-2-boqun.feng@gmail.com commit c0b4a4feeb43305a754893d8d9c6b2b5a52d45ac Author: Felix Gu Date: Tue Jan 27 01:30:07 2026 +0800 pinctrl: equilibrium: Fix device node reference leak in pinbank_init() When calling of_parse_phandle_with_fixed_args(), the caller is responsible to call of_node_put() to release the reference of device node. In pinbank_init(), the reference of the node obtained from the "gpio-ranges" property is never released, resulting in a reference count leak. Add the missing of_node_put() call to fix the leak. Fixes: 1948d5c51dba ("pinctrl: Add pinmux & GPIO controller driver for a new SoC") Signed-off-by: Felix Gu Acked-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 1729f7c67544b31569836f48f142e8f7c0952b26 Author: Gao Xiang Date: Wed Jan 28 11:54:08 2026 +0800 erofs: mark inodes without acls in erofs_read_inode() Similar to commit 91ef18b567da ("ext4: mark inodes without acls in __ext4_iget()"), the ACL state won't be read when the file owner performs a lookup, and the RCU fast path for lookups won't work because the ACL state remains unknown. If there are no extended attributes, or if the xattr filter indicates that no ACL xattr is present, call cache_no_acl() directly. Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit 7c746eb71fc3737340c32f44c31b111f74f5632c Author: Chaitanya Kulkarni Date: Mon Jan 12 15:19:28 2026 -0800 rnbd-clt: fix refcount underflow in device unmap path During device unmapping (triggered by module unload or explicit unmap), a refcount underflow occurs causing a use-after-free warning: [14747.574913] ------------[ cut here ]------------ [14747.574916] refcount_t: underflow; use-after-free. [14747.574917] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x55/0x90, CPU#9: kworker/9:1/378 [14747.574924] Modules linked in: rnbd_client(-) rtrs_client rnbd_server rtrs_server rtrs_core ... [14747.574998] CPU: 9 UID: 0 PID: 378 Comm: kworker/9:1 Tainted: G O N 6.19.0-rc3lblk-fnext+ #42 PREEMPT(voluntary) [14747.575005] Workqueue: rnbd_clt_wq unmap_device_work [rnbd_client] [14747.575010] RIP: 0010:refcount_warn_saturate+0x55/0x90 [14747.575037] Call Trace: [14747.575038] [14747.575038] rnbd_clt_unmap_device+0x170/0x1d0 [rnbd_client] [14747.575044] process_one_work+0x211/0x600 [14747.575052] worker_thread+0x184/0x330 [14747.575055] ? __pfx_worker_thread+0x10/0x10 [14747.575058] kthread+0x10d/0x250 [14747.575062] ? __pfx_kthread+0x10/0x10 [14747.575066] ret_from_fork+0x319/0x390 [14747.575069] ? __pfx_kthread+0x10/0x10 [14747.575072] ret_from_fork_asm+0x1a/0x30 [14747.575083] [14747.575096] ---[ end trace 0000000000000000 ]--- Befor this patch :- The bug is a double kobject_put() on dev->kobj during device cleanup. Kobject Lifecycle: kobject_init_and_add() sets kobj.kref = 1 (initialization) kobject_put() sets kobj.kref = 0 (should be called once) * Before this patch: rnbd_clt_unmap_device() rnbd_destroy_sysfs() kobject_del(&dev->kobj) [remove from sysfs] kobject_put(&dev->kobj) PUT #1 (WRONG!) kref: 1 to 0 rnbd_dev_release() kfree(dev) [DEVICE FREED!] rnbd_destroy_gen_disk() [use-after-free!] rnbd_clt_put_dev() refcount_dec_and_test(&dev->refcount) kobject_put(&dev->kobj) PUT #2 (UNDERFLOW!) kref: 0 to -1 [WARNING!] The first kobject_put() in rnbd_destroy_sysfs() prematurely frees the device via rnbd_dev_release(), then the second kobject_put() in rnbd_clt_put_dev() causes refcount underflow. * After this patch :- Remove kobject_put() from rnbd_destroy_sysfs(). This function should only remove sysfs visibility (kobject_del), not manage object lifetime. Call Graph (FIXED): rnbd_clt_unmap_device() rnbd_destroy_sysfs() kobject_del(&dev->kobj) [remove from sysfs only] [kref unchanged: 1] rnbd_destroy_gen_disk() [device still valid] rnbd_clt_put_dev() refcount_dec_and_test(&dev->refcount) kobject_put(&dev->kobj) ONLY PUT (CORRECT!) kref: 1 to 0 [BALANCED] rnbd_dev_release() kfree(dev) [CLEAN DESTRUCTION] This follows the kernel pattern where sysfs removal (kobject_del) is separate from object destruction (kobject_put). Fixes: 581cf833cac4 ("block: rnbd: add .release to rnbd_dev_ktype") Signed-off-by: Chaitanya Kulkarni Acked-by: Jack Wang Reviewed-by: Jack Wang Signed-off-by: Jens Axboe commit 806ae939c41e5da1d94a1e2b31f5702e96b6c3e3 Author: Jens Axboe Date: Tue Jan 27 21:01:41 2026 -0700 io_uring/net: don't continue send bundle if poll was required for retry If a send bundle has picked a bunch of buffers, then it needs to send all of those to be complete. This may require poll arming, if the send buffer ends up being full. Once a send bundle has been poll armed, no further bundles should be attempted. This allows a current bundle to complete even though it needs to go through polling to do so, but it will not allow another bundle to be started once that has happened. Ideally we would abort a bundle if it was only partially sent, but as some parts of it already went out on the wire, this obviously isn't feasible. Not continuing more bundle attempts post encountering a full socket buffer is the second best thing. Cc: stable@vger.kernel.org Fixes: a05d1f625c7a ("io_uring/net: support bundles for send") Signed-off-by: Jens Axboe commit 4651c87b0083925540f6c3d26a6c5b4868d7b884 Merge: 6ffdc7eb48bd22 70a65c53d22856 Author: Mark Brown Date: Wed Jan 28 03:48:12 2026 +0000 regmap: reg_default_cb for flat cache defaults Merge series from "Sheetal ." : This series adds a reg_default_cb callback for REGCACHE_FLAT to provide defaults for registers not listed in reg_defaults. Defaults are loaded eagerly during regcache init and the callback can use writeable_reg to filter valid addresses and avoid holes. commit 15392f76405ecb953216b437bed76ffa49cefb7b Merge: 205bd15619322a cea7b66a80412e Author: Dave Airlie Date: Wed Jan 28 13:35:17 2026 +1000 Merge tag 'drm-rust-next-2026-01-26' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-next DRM Rust changes for v7.0-rc1 DRM: - Fix documentation for Registration constructors. - Use pin_init::zeroed() for fops initialization. - Annotate DRM helpers with __rust_helper. - Improve safety documentation for gem::Object::new(). - Update AlwaysRefCounted imports. MM: - Prevent integer overflow in page_align(). Nova (Core): - Prepare for Turing support. This includes parsing and handling Turing-specific firmware headers and sections as well as a Turing Falcon HAL implementation. - Get rid of the Result> anti-pattern. - Relocate initializer-specific code into the appropriate initializer. - Use CStr::from_bytes_until_nul() to remove custom helpers. - Improve handling of unexpected firmware values. - Clean up redundant debug prints. - Replace c_str!() with native Rust C-string literals. - Update nova-core task list. Nova (DRM): - Align GEM object size to system page size. Tyr: - Use generated uAPI bindings for GpuInfo. - Replace manual sleeps with read_poll_timeout(). - Replace c_str!() with native Rust C-string literals. - Suppress warnings for unread fields. - Fix incorrect register name in print statement. Signed-off-by: Dave Airlie From: "Danilo Krummrich" Link: https://patch.msgid.link/DFYW1WV6DUCG.3K8V2DAVD1Q4A@kernel.org commit 071588136007482d70fd2667b827036bc60b1f8f Author: Ondrej Mosnacek Date: Thu Jan 22 15:13:03 2026 +0100 ipc: don't audit capability check in ipc_permissions() The IPC sysctls implement the ctl_table_root::permissions hook and they override the file access mode based on the CAP_CHECKPOINT_RESTORE capability, which is being checked regardless of whether any access is actually denied or not, so if an LSM denies the capability, an audit record may be logged even when access is in fact granted. It wouldn't be viable to restructure the sysctl permission logic to only check the capability when the access would be actually denied if it's not granted. Thus, do the same as in net_ctl_permissions() (net/sysctl_net.c) - switch from ns_capable() to ns_capable_noaudit(), so that the check never emits an audit record. Fixes: 0889f44e2810 ("ipc: Check permissions for checkpoint_restart sysctls at open time") Signed-off-by: Ondrej Mosnacek Acked-by: Alexey Gladkov Acked-by: Serge Hallyn Signed-off-by: Serge Hallyn commit 599b1b9fb967360bda5f8fa2c926d2519810fdfd Author: Zong-Zhe Yang Date: Fri Jan 23 09:39:57 2026 +0800 wifi: rtw89: regd: update regulatory map to R73-R54 Sync Realtek Channel Plan R73 and Realtek Regulatory R54. Configure 6 GHz field of Realtek regd for the following countries. PY NA BD ID VN TN GL GP YT EH Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-12-pkshih@realtek.com commit 5f93d611b33a05bd03d6843c8efe8cb6a1992620 Author: Ping-Ke Shih Date: Fri Jan 23 09:39:56 2026 +0800 wifi: rtw89: pci: validate release report content before using for RTL8922DE The commit 957eda596c76 ("wifi: rtw89: pci: validate sequence number of TX release report") does validation on existing chips, which somehow a release report of SKB becomes malformed. As no clear cause found, add rules ahead for RTL8922DE to avoid crash if it happens. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-11-pkshih@realtek.com commit 986aa89b7613266a279748c7f632e3c2d3b818f6 Author: Zong-Zhe Yang Date: Fri Jan 23 09:39:55 2026 +0800 wifi: rtw89: get designated link to replace link instance 0 Clean up some places where still to get link instance 0 directly. Since now MLSR switch is supported, it's not guaranteed to always run on link instance 0. So, prefer to get designated link in most cases. For now, the only exception is MCC (multi-channel concurrency) case. How to fill content of its H2C command depends on how to choose link instance, so cannot simply change it as above. Will handle MCC case separately afterwards. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-10-pkshih@realtek.com commit 3b85a8948f525713e6206a28884e1f4246dbf63f Author: Zong-Zhe Yang Date: Fri Jan 23 09:39:54 2026 +0800 wifi: rtw89: 8922a: configure FW version for SIM_SER_L0L1_BY_HALT_H2C After FW version 0.35.97.0, 8922A supports SIM_SER_L0L1_BY_HALT_H2C FW feature. It allows to simulate FW L0/L1 crash under PS mode. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-9-pkshih@realtek.com commit 69ed25f25faa46c683c194996e556e4ab1bca6da Author: Ping-Ke Shih Date: Fri Jan 23 09:39:53 2026 +0800 wifi: rtw89: phy: add PHY C2H event dummy handler for func 1-7 and 2-10 The two functions aren't implemented and hard necessary by driver. Implement dummy handler to avoid messages: rtw89_8922de 0000:03:00.0: PHY c2h class 1 func 7 not support rtw89_8922de 0000:03:00.0: PHY c2h class 2 func 10 not support Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-8-pkshih@realtek.com commit c938cb4862546ee1669b3af1318570744272ffd4 Author: Ping-Ke Shih Date: Fri Jan 23 09:39:52 2026 +0800 wifi: rtw89: fw: correct content of DACK H2C command The fields of command should be u8 instead of __le32. However, current firmware doesn't really use the data for now, so this mistake doesn't impact performance. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-7-pkshih@realtek.com commit 21344e7413778734988cfac9dd70a690bcbafdb9 Author: Ping-Ke Shih Date: Fri Jan 23 09:39:51 2026 +0800 wifi: rtw89: rfk: update RFK report format of IQK, DACK and TXGAPK The report formats of IQK, DACK and TXGAPK are changed. Update them accordingly. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-6-pkshih@realtek.com commit 571f945fb91bb678827e76e6bd91595eb6fab841 Author: Ping-Ke Shih Date: Fri Jan 23 09:39:50 2026 +0800 wifi: rtw89: rfk: add to print debug log of CIM3K Add calibration report of CIM3K, which does calibration in firmware and send a C2H event as debug purpose. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-5-pkshih@realtek.com commit 17b75fbf9c711546a466098d4951d3eaf5f51e09 Author: Ping-Ke Shih Date: Fri Jan 23 09:39:49 2026 +0800 wifi: rtw89: rfk: add firmware command to do CIM3K CIM is short for counter intermodulation products 3rd-order. Due to non-linearity in transmit path, need a calibration to yield performance for RF system. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-4-pkshih@realtek.com commit 9df3575ed2bb5474df2f9bb5735a9946c2d84579 Author: Ping-Ke Shih Date: Fri Jan 23 09:39:48 2026 +0800 wifi: rtw89: rfk: add to print debug log of TX IQK Add report format for TX IQK, which do calibration in firmware and send a C2H event as debug purpose. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-3-pkshih@realtek.com commit 205bd15619322a1429c1bf53831a284a12b25e2a Merge: 6704d98a4f48b7 50c4a49f7292b3 Author: Dave Airlie Date: Wed Jan 28 13:06:37 2026 +1000 Merge tag 'drm-msm-next-2026-01-23' of https://gitlab.freedesktop.org/drm/msm into drm-next Changes for v6.20 GPU: - Document a612/RGMU dt bindings - UBWC 6.0 support (for A840 / Kaanapali) - a225 support - Fixes DPU: - Switched to use virtual planes by default - Fixed DSI CMD panels on DPU 3.x - Rewrote format handling to remove intermediate representation - Fixed watchdog on DPU 8.x+ - Fixed TE / Vsync source setting on DPU 8.x+ - Added 3D_Mux on SC7280 - Kaanapali platform support - Fixed UBWC register programming - Made RM reserve DSPP-enabled mixers for CRTCs with LMs. - Gamma correction support DP: - Enabled support for eDP 1.4+ link rate tables - Fixed MDSS1 DP indices on SA8775P, making them to work - Fixed msm_dp_ctrl_config_msa() to work with LLVM 20 DSI: - Documented QCS8300 as compatible with SA8775P - Kaanapali platform support DSI PHY: - switched to divider_determine_rate() MDP5: - Dropped support for MSM8998, SDM660 and SDM630 (switched over to DPU) MDSS: - Kaanapali platform support - Fixed UBWC register programming Signed-off-by: Dave Airlie From: Rob Clark Link: https://patch.msgid.link/CACSVV03Sbeca93A+gGh-TKpzFYVabbkWVgPCCicG0_NQG+5Y2A@mail.gmail.com commit ebd8a1d736eed8818f3adb2f141bf9cadbd4ee9e Author: Ping-Ke Shih Date: Fri Jan 23 09:39:47 2026 +0800 wifi: rtw89: rfk: add firmware command to do TX IQK TX IQK is a RF calibration, which driver call this H2C command to trigger the calibration. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260123013957.16418-2-pkshih@realtek.com commit 6704d98a4f48b7424edc0f7ae2a06c0a8af02e2f Merge: 504f3cead6b049 63804fed149a67 Author: Dave Airlie Date: Wed Jan 28 12:44:28 2026 +1000 BackMerge tag 'v6.19-rc7' into drm-next Linux 6.19-rc7 This is needed for msm and rust trees. Signed-off-by: Dave Airlie commit ae23bc81ddf7c17b663c4ed1b21e35527b0a7131 Author: Guillaume Gonnet Date: Tue Jan 27 17:02:00 2026 +0100 bpf: Fix tcx/netkit detach permissions when prog fd isn't given This commit fixes a security issue where BPF_PROG_DETACH on tcx or netkit devices could be executed by any user when no program fd was provided, bypassing permission checks. The fix adds a capability check for CAP_NET_ADMIN or CAP_SYS_ADMIN in this case. Fixes: e420bed02507 ("bpf: Add fd-based tcx multi-prog infra with link support") Signed-off-by: Guillaume Gonnet Link: https://lore.kernel.org/r/20260127160200.10395-1-ggonnet.linux@gmail.com Signed-off-by: Alexei Starovoitov commit 239f09e258b906deced5c2a7c1ac8aed301b558b Author: Junjie Cao Date: Mon Jan 26 14:15:32 2026 +0800 selftests: ptp: treat unsupported PHC operations as skip Some PTP hardware clock (PHC) devices may return -EOPNOTSUPP for operations like settime, adjtime, or adjfreq. This commonly occurs with timestamp-only PHC implementations that don't support full clock control. For background, syzbot previously exposed a crash risk when PTP clock drivers lacked required callbacks[1]. Subsequent work[2] made callback presence a registration requirement. As a result, some drivers (like iwlwifi MVM/MLD[3]) now provide stub callbacks that return -EOPNOTSUPP for unsupported operations. When phc_ctl encounters such devices, the "Operation not supported" error should be treated as a skip (device limitation) rather than a test failure. This patch: - Adds [SKIP] output handling in log_test() - Detects "Operation not supported" from phc_ctl and returns ksft_skip - Returns ksft_skip if all tests are skipped, preventing false-positive results when testing timestamp-only PHC implementations Link: https://lore.kernel.org/netdev/20251028043216.1971292-1-junjie.cao@intel.com/ [1] Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dfb073d32cac [2] Link: https://lore.kernel.org/netdev/20251204123204.9316-1-ziyao@disroot.org/ [3] Signed-off-by: Junjie Cao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260126061532.12532-2-junjie.cao@intel.com Signed-off-by: Jakub Kicinski commit 166e664e702ed96b83df2a87c1ea2138a995b604 Author: Junjie Cao Date: Mon Jan 26 14:15:31 2026 +0800 selftests: ptp: use KSFT_SKIP exit code for skip scenarios The kselftest framework defines KSFT_SKIP=4 as the standard exit code for skipped tests. However, phc.sh currently uses a mix of 'exit 0' and 'exit 1' to indicate skip conditions, which can confuse test harnesses and CI systems. This patch introduces ksft_skip=4 variable and unifies all skip exit paths to use 'exit $ksft_skip', consistent with other selftests like net/lib.sh and net/fib_nexthops.sh. Signed-off-by: Junjie Cao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260126061532.12532-1-junjie.cao@intel.com Signed-off-by: Jakub Kicinski commit 15e9abc270551374193e16ef13d31fd643567fb7 Author: Ethan Nelson-Moore Date: Sun Jan 25 20:40:39 2026 -0800 net: usb: int51x1: use usbnet_cdc_update_filter The int51x1 driver uses the same requests as USB CDC to handle packet filtering, but provides its own definitions and function to handle it. The chip datasheet says the requests are CDC compliant. Replace this unnecessary code with a reference to usbnet_cdc_update_filter. Also fix the broken datasheet link and remove an empty comment. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260126044049.40359-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 36929ebd17ae66ed3acde9056a9daf611d81a2e5 Author: Emil Tsalapatis Date: Thu Jan 22 22:26:05 2026 -0500 tools/sched_ext: add arena based scheduler Add a scheduler that uses BPF arenas to manage task context data. Signed-off-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit f0262b102c7ce43f3744bdb0278ddf0d15bb1a71 Author: Emil Tsalapatis Date: Thu Jan 22 22:26:04 2026 -0500 tools/sched_ext: add scx_pair scheduler Add the scx_pair cgroup-based core scheduler. Cc: Tejun Heo Cc: David Vernet Signed-off-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit cc4448d0856d424e52b5f53b2592575598233eac Author: Emil Tsalapatis Date: Thu Jan 22 22:26:03 2026 -0500 tools/sched_ext: add scx_userland scheduler Add in the scx_userland scheduler that does vruntime-based scheduling in userspace code and communicates scheduling decisions to BPF by accessing and modifying globals through the skeleton. Cc: Tejun Heo Cc: David Vernet Signed-off-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit bbabce5d4d2d20e087fd0b02ca5a4e7d363edd10 Merge: 1f6b527baf6f45 13a4be41261f7a Author: Jakub Kicinski Date: Tue Jan 27 17:33:59 2026 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-26 (ice, idpf) For ice: Jake converts ring stats to utilize u64_stats APIs and performs some cleanups along the way. Alexander reorganizes layout of Tx and Rx rings for cacheline locality and utilizes __cacheline_group* macros on the new layouts. For idpf: YiFei Zhu adds support for BPF kfunc reporting of hardware Rx timestamps. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: idpf: export RX hardware timestamping information to XDP ice: reshuffle and group Rx and Tx queue fields by cachelines ice: convert all ring stats to u64_stats_t ice: shorten ring stat names and add accessors ice: use u64_stats API to access pkts/bytes in dim sample ice: remove ice_q_stats struct and use struct_group ice: pass pointer to ice_fetch_u64_stats_per_ring ==================== Link: https://patch.msgid.link/20260126224313.3847849-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1f6b527baf6f455b2502f6335aa28e129bbd3bf2 Author: Breno Leitao Date: Mon Jan 26 02:00:15 2026 -0800 ethtool: remove ETHTOOL_GRXRINGS fallback through get_rxnfc All drivers that need to report the RX ring count now implement the get_rx_ring_count callback directly. Remove the legacy fallback path that obtained this information by calling get_rxnfc with ETHTOOL_GRXRINGS. This simplifies the code and makes get_rx_ring_count the only way to retrieve the RX ring count. Note: ethtool_get_rx_ring_count() returns int to allow returning -EOPNOTSUPP, while the callback returns u32. The implicit conversion is safe since RX ring counts will not exceed INT_MAX while we are still alive. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260126-grxring_final-v1-1-0981cb24512e@debian.org Signed-off-by: Jakub Kicinski commit 88a95781332d27bb8328ad9b6dab22dba74afb0a Merge: d64f761dbfda3f 5b4015ad833c76 Author: Jakub Kicinski Date: Tue Jan 27 17:30:55 2026 -0800 Merge branch 'single-mss-length-in-udp-gso_partial' Gal Pressman says: ==================== Single MSS length in UDP GSO_PARTIAL This series addresses an inconsistency in how UDP GSO_PARTIAL handles the UDP header length field. Currently, when GSO_PARTIAL segmentation is used, the UDP header length contains the large MSS size, requiring drivers to manually adjust it before transmitting. This is inconsistent with how tunnel GSO_PARTIAL handles outer headers in UDP tunnels, where the length is set to the single segment size. This was originally suggested by Alexander Duyck back in 2018: https://lore.kernel.org/netdev/CAKgT0UcdnUWgr3KQ=RnLKigokkiUuYefmL-ePpDvJOBNpKScFA@mail.gmail.com/ The first patch fixes the core UDP offload code to set the UDP length field to the single segment size (gso_size + UDP header) instead of the large MSS size. This provides hardware with a proper template length value for final segmentation. The subsequent patches remove the now redundant UDP header length adjustments from the mlx5e and aquantia drivers, as the core code now handles this correctly. I couldn't find any other drivers that support UDP GSO_PARTIAL; idpf supports UDP segmentation, but it does not use GSO_PARTIAL. ==================== Link: https://patch.msgid.link/20260125121649.778086-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 5b4015ad833c7636a1e43eeb4047d0813fffe3f7 Author: Gal Pressman Date: Sun Jan 25 14:16:49 2026 +0200 net: aquantia: Remove redundant UDP length adjustment with GSO_PARTIAL GSO_PARTIAL now takes care of updating the UDP header length, remove the redundant assignment in aq_nic_map_skb(). Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260125121649.778086-4-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 8d2eda97f464d3fdbc8cfe469b78d2e7ab3792ff Author: Gal Pressman Date: Sun Jan 25 14:16:48 2026 +0200 net/mlx5e: Remove redundant UDP length adjustment with GSO_PARTIAL GSO_PARTIAL now takes care of updating the UDP header length, mlx5e_udp_gso_handle_tx_skb() is redundant, remove it. Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260125121649.778086-3-gal@nvidia.com Signed-off-by: Jakub Kicinski commit b10b446ce7ad912559e3af523aaa9f5f34a18c2e Author: Gal Pressman Date: Sun Jan 25 14:16:47 2026 +0200 udp: gso: Use single MSS length in UDP header for GSO_PARTIAL In GSO_PARTIAL segmentation, set the UDP length field to the single segment size (gso_size + UDP header) instead of the large MSS size. This provides hardware with a template length value for final segmentation, similar to how tunnel GSO_PARTIAL handles outer headers in UDP tunnels. This will remove the need to manually adjust the UDP header length in the drivers, as can be seen in subsequent patches. This was suggested by Alex in 2018: https://lore.kernel.org/netdev/CAKgT0UcdnUWgr3KQ=RnLKigokkiUuYefmL-ePpDvJOBNpKScFA@mail.gmail.com/ Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260125121649.778086-2-gal@nvidia.com Signed-off-by: Jakub Kicinski commit d64f761dbfda3f4eb7e5c14c1336677de20d5d6f Author: Russell King (Oracle) Date: Mon Jan 26 12:33:14 2026 +0000 net: stmmac: don't pass ioaddr to fix_soc_reset() method As the stmmac_priv struct is passed to the fix_soc_reset() method which has the ioaddr, there is no need to pass ioaddr separately. Pass just the stmmac_priv struct. Fix up the glues that use it. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vkLmM-00000005vE1-0nop@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 75ca86026b891c21d656dda38c3e7ae6a848b440 Merge: b4ee17729a11f1 8cf19b19dba881 Author: Mark Brown Date: Wed Jan 28 01:22:16 2026 +0000 ASoC: sophgo: add CV1800 I2S controllers support Merge series from "Anton D. Stavinskii" : This patch series adds basic audio support for Sophgo CV1800B, as used on boards such as the Milk-V Duo. The series introduces the I2S controller driver, the DAC and ADC codec drivers, corresponding DT bindings, and DTS updates to wire the components together. The implementation is based on vendor documentation and testing on real hardware. This series relies on recent fixes in the DesignWare AXI DMA support; in particular, correct operation depends on the DMA changes discussed at: https://lore.kernel.org/all/20251214224601.598358-1-inochiama@gmail.com/ The current driver implementation supports a fixed audio configuration of 48 kHz sample rate and only I2S protocol which is used in codecs. The series has been tested on the Milk-V Duo 256M board using the Sophgo SG2002 SoC. The implementation is expected to also work on Milk-V Duo and Milk-V Module boards based on the SG2000 SoC, as the audio and DMA blocks are closely related. Known hardware limitation: On CV1800B / SG2002, the I2S2 output pins cannot be enabled via pinctrl alone. Due to SoC design constraints, the output path becomes functional only after additional vendor-specific register programming. This series makes the limitation explicit and does not attempt to work around it implicitly via pinctrl or undocumented behavior. commit b4ee17729a11f13fbb15cd1fb54549642cd1c44c Merge: 1924bd68a0c06f af6d53db28e644 Author: Mark Brown Date: Wed Jan 28 00:37:54 2026 +0000 ASoC: capsuling struct snd_soc_dapm_context Merge series from Kuninori Morimoto : Now, all DAPM users are using function to handling it. We can capsuling it. This patchset moves struct snd_soc_dapm_context into soc-dapm.c, and remove un-used functions. Link: https://lore.kernel.org/r/87zf7jrx52.wl-kuninori.morimoto.gx@renesas.com commit 1924bd68a0c06f9f2c06cf35e60dfc55cdc34a91 Merge: ab2e3fa491734b c76d50b71e8986 Author: Mark Brown Date: Wed Jan 28 00:37:49 2026 +0000 ASoC: codec: Remove ak4641/pxa2xx-ac97 and convert to Merge series from "Peng Fan (OSS)" : The main goal is to convert drivers to use GPIO descriptors. While reading the code, I think it is time to remove ak4641 and pxa2xx-ac97 driver, more info could be found in commit log of each patch. Then only need to convert sound/arm/pxa2xx-ac97-lib.c to use GPIO descriptors. Not have hardware to test the pxa2xx ac97. commit ab2e3fa491734b655e1d37aee058fa7195174d74 Merge: 74823db9ba2e13 19b08fd23b2059 Author: Mark Brown Date: Wed Jan 28 00:37:45 2026 +0000 ASoC: fsl_audmix: Support the i.MX952 platform Merge series from Shengjiu Wang : Enable AUDMIX on i.MX952 platform, update dt binding document and driver. SAI is connected to AUDMIX, and the AUDMIX can be bypassed, so add 'fsl,sai-amix-mode' property in SAI binding document for this case. commit 297c9d96e3085116c5cde18170dba716a1f2591e Author: James Clark Date: Wed Jan 21 16:19:40 2026 +0000 perf jevents: Handle deleted JSONS in out of source builds Make the source folders a dependency for the generated folder root so that whenever a file is deleted from the source it will force a new fresh copy of all the JSON files and avoid stale deleted files. JSON_DIRS_OUTPUT_ROOT needs to be a dependency of LEGACY_CACHE_JSON so that the root folder doesn't get cleaned after the legacy JSON is generated. But this is a no-op with in-source builds as JSON_DIRS_OUTPUT_ROOT is unset. JSON_DIRS is added as a dependency of PMU_EVENTS_C which also forces a re-build for in source builds when JSON files are deleted. This could have also resulted in stale builds, but never a broken one. Closes: https://lore.kernel.org/linux-next/aW5XSAo88_LBPSYI@sirena.org.uk/ Fixes: 4bb55de4ff03db3e ("perf jevents: Support copying the source json files to OUTPUT") Reported-by: Mark Brown Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 612e4022c616eba66ed15e6b7a9924251e0298e8 Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 12:43:43 2026 -0300 perf strlist: Remove dont_dupstr logic, used only once Ian Rogers noticed that 678ed6b707e4b2db ("perf strlist: Don't write to const memory") breaks the 'Remove thread map' 'perf test' entry, because it keeps pointers to the temporary string introduced to avoid touching the const memory. This is because the thread_map__new_by_[pt]id_str() were the only methods using the slist->dont_dupstr knob to keep pointers to the original const string list, as it uses strtol to parse numbers and it stops at the comma. As this is the only case of dont_dupstr use, dupstr being the default, and it gets in the way of getting rid of the last const-correctness, remove this knob, with it: $ perf test 37 37: Remove thread map : Ok $ Fixes: 678ed6b707e4b2db ("perf strlist: Don't write to const memory") Reported-by: Ian Rogers Tested-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit a863b21b1e665d8fed0022c0175ffbdc5d94c06c Author: Gary Guo Date: Mon Jan 12 17:07:18 2026 +0000 rust: macros: convert `concat_idents!` to use `syn` This eliminates the need for `expect_punct` helper. Reviewed-by: Tamir Duberstein Reviewed-by: Benno Lossin Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260112170919.1888584-8-gary@kernel.org Signed-off-by: Miguel Ojeda commit 8db9164b7694612f6b72c56e865b60c0e67d944d Author: Gary Guo Date: Mon Jan 12 17:07:17 2026 +0000 rust: macros: convert `#[export]` to use `syn` This eliminates the custom `function_name` helper. Reviewed-by: Tamir Duberstein Reviewed-by: Benno Lossin Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260112170919.1888584-7-gary@kernel.org Signed-off-by: Miguel Ojeda commit 5f7045772037b33365fddb541b671ded6a6bded6 Author: Gary Guo Date: Mon Jan 12 17:07:16 2026 +0000 rust: macros: use `quote!` for `module!` macro This has no behavioural change, but is good for maintainability. With `quote!`, we're no longer using string templates, so we don't need to quote " and {} inside the template anymore. Further more, editors can now highlight the code template. This also improves the robustness as it eliminates the need for string quoting and escaping. Co-developed-by: Benno Lossin Signed-off-by: Benno Lossin Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260112170919.1888584-6-gary@kernel.org Signed-off-by: Miguel Ojeda commit c578ad703ae9a219aa4bdd13343cf5254541c5e3 Author: Gary Guo Date: Mon Jan 12 17:07:15 2026 +0000 rust: macros: use `syn` to parse `module!` macro With `syn` being available in the kernel, use it to parse the complex custom `module!` macro to replace existing helpers. Only parsing is changed in this commit, the code generation is untouched. This has the benefit of better error message when the macro is used incorrectly, as it can point to a concrete span on what's going wrong. For example, if a field is specified twice, previously it reads: error: proc macro panicked --> samples/rust/rust_minimal.rs:7:1 | 7 | / module! { 8 | | type: RustMinimal, 9 | | name: "rust_minimal", 10 | | author: "Rust for Linux Contributors", 11 | | description: "Rust minimal sample", 12 | | license: "GPL", 13 | | license: "GPL", 14 | | } | |_^ | = help: message: Duplicated key "license". Keys can only be specified once. now it reads: error: duplicated key "license". Keys can only be specified once. --> samples/rust/rust_minimal.rs:13:5 | 13 | license: "GPL", | ^^^^^^^ Reviewed-by: Tamir Duberstein Signed-off-by: Gary Guo Reviewed-by: Benno Lossin Link: https://patch.msgid.link/20260112170919.1888584-5-gary@kernel.org Signed-off-by: Miguel Ojeda commit 5f160950a5cdc36f222299905e09a72f67ebfcd4 Author: Gary Guo Date: Mon Jan 12 17:07:14 2026 +0000 rust: macros: convert `#[vtable]` macro to use `syn` `#[vtable]` is converted to use syn. This is more robust than the previous heuristic-based searching of defined methods and functions. When doing so, the trait and impl are split into two code paths as the types are distinct when parsed by `syn`. Reviewed-by: Tamir Duberstein Signed-off-by: Gary Guo Reviewed-by: Benno Lossin Link: https://patch.msgid.link/20260112170919.1888584-4-gary@kernel.org Signed-off-by: Miguel Ojeda commit f637bafe1ff15fa356c1e0576c32f077b9e6e46a Author: Gary Guo Date: Mon Jan 12 17:07:13 2026 +0000 rust: macros: use `quote!` from vendored crate With `quote` crate now vendored in the kernel, we can remove our custom `quote!` macro implementation and just rely on that crate instead. The `quote` crate uses types from the `proc-macro2` library so we also update to use that, and perform conversion in the top-level lib.rs. Clippy complains about unnecessary `.to_string()` as `proc-macro2` provides additional `PartialEq` impl, so they are removed. Reviewed-by: Tamir Duberstein Reviewed-by: Benno Lossin Signed-off-by: Gary Guo Acked-by: David Gow # for kunit Link: https://patch.msgid.link/20260112170919.1888584-3-gary@kernel.org Signed-off-by: Miguel Ojeda commit 3b721117fe150fc4d78628d78627f9b446930b44 Author: Ethan Nelson-Moore Date: Fri Jan 23 19:22:43 2026 -0800 net: usb: sr9700: replace magic numbers with register bit macros The first byte of the Rx frame is a copy of the Rx status register, so 0x40 corresponds to RSR_MF (meaning the frame is multicast). Replace 0x40 with RSR_MF for clarity. (All other bits of the RSR indicate errors. The fact that the driver ignores these errors will be fixed by a later patch.) The first byte of the status URB is a copy of the NSR, so 0x40 corresponds to NSR_LINKST. Replace 0x40 with NSR_LINKST for clarity. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Peter Korsgaard Link: https://patch.msgid.link/20260124032248.26807-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 90defad242fbfd47967f03ee3bb39f09427195c2 Merge: 62777c8015f3d8 9ddfabcc1ed884 Author: Jakub Kicinski Date: Tue Jan 27 15:47:44 2026 -0800 Merge branch 'remove-low-level-sha-1-functions' Eric Biggers says: ==================== Remove low-level SHA-1 functions This series updates net/ipv6/addrconf.c to use the regular SHA-1 functions, then removes sha1_init_raw() and sha1_transform(). (These were originally patches 25-26 of the series https://lore.kernel.org/linux-crypto/20250712232329.818226-1-ebiggers@kernel.org/ ) ==================== Link: https://patch.msgid.link/20260123051656.396371-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 9ddfabcc1ed884ef47bcca317e77596c797bef83 Author: Eric Biggers Date: Thu Jan 22 21:16:56 2026 -0800 lib/crypto: sha1: Remove low-level functions from API Now that there are no users of the low-level SHA-1 interface, remove it. Specifically: - Remove SHA1_DIGEST_WORDS (no longer used) - Remove sha1_init_raw() (no longer used) - Rename sha1_transform() to sha1_block_generic() and make it static - Move SHA1_WORKSPACE_WORDS into lib/crypto/sha1.c Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260123051656.396371-3-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 5023479627e3e85a97807f612bea2eddbf202e1d Author: Eric Biggers Date: Thu Jan 22 21:16:55 2026 -0800 ipv6: Switch to higher-level SHA-1 functions There's now a proper SHA-1 API that follows the usual conventions for hash function APIs: sha1_init(), sha1_update(), sha1_final(), sha1(). The only remaining user of the older low-level SHA-1 API, sha1_init_raw() and sha1_transform(), is ipv6_generate_stable_address(). I'd like to remove this older API, which is too low-level. Unfortunately, ipv6_generate_stable_address() does in fact skip the SHA-1 finalization for some reason. So the values it computes are not standard SHA-1 values, and it sort of does want the low-level API. Still, it's still possible to use the higher-level functions sha1_init() and sha1_update() to get the same result, provided that the resulting state is used directly, skipping sha1_final(). So, let's do that instead. This will allow removing the low-level API. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Acked-by: David Ahern Link: https://patch.msgid.link/20260123051656.396371-2-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 99ba0fa10de0cc0386ea61e6e5068a78a8394060 Merge: 74a862d251ad5f aeb5ecad5316f6 Author: Miguel Ojeda Date: Tue Jan 27 14:33:55 2026 +0100 Merge tag 'pin-init-v7.0' of https://github.com/Rust-for-Linux/linux into rust-next Pull pin-init updates from Benno Lossin: "Added: - Implement 'InPlaceWrite' for '&'static mut MaybeUninit'. This enables users to use external allocation mechanisms such as 'static_cell'. - Add Gary Guo as a Maintainer. Changed: - Rewrote all proc-macros ('[pin_]init!', '#[pin_data]', '#[pinned_drop]', 'derive([Maybe]Zeroable)'), using 'syn' with better diagnostics. - Support tuple structs in 'derive([Maybe]Zeroable)'. - Support attributes on fields in '[pin_]init!' (such as '#[cfg(...)]'). - Add a '#[default_error()]' attribute to '[pin_]init!' to override the default error (when no '? Error' is specified). - Support packed structs in '[pin_]init!' with '#[disable_initialized_field_access]'. Removed: - Remove 'try_[pin_]init!' in favor of merging their feature with '[pin_]init!'. Update the kernel's own 'try_[pin_]init!' macros to use the 'default_error' attribute. Fixed: - Correct 'T: Sized' bounds to 'T: ?Sized' in the generated 'PinnedDrop' check by '#[pin_data]'." * tag 'pin-init-v7.0' of https://github.com/Rust-for-Linux/linux: rust: pin-init: Implement `InPlaceWrite` for `&'static mut MaybeUninit` MAINTAINERS: add Gary Guo to pin-init rust: pin-init: internal: init: simplify Zeroable safety check rust: pin-init: internal: init: add escape hatch for referencing initialized fields rust: pin-init: internal: init: add support for attributes on initializer fields rust: init: use `#[default_error(err)]` for the initializer macros rust: pin-init: add `#[default_error()]` attribute to initializer macros rust: pin-init: rewrite the initializer macros using `syn` rust: pin-init: add `?Sized` bounds to traits in `#[pin_data]` macro rust: pin-init: rewrite `#[pin_data]` using `syn` rust: pin-init: rewrite the `#[pinned_drop]` attribute macro using `syn` rust: pin-init: rewrite `derive(Zeroable)` and `derive(MaybeZeroable)` using `syn` rust: pin-init: internal: add utility API for syn error handling rust: pin-init: add `syn` dependency and remove `proc-macro[2]` and `quote` workarounds rust: pin-init: allow the crate to refer to itself as `pin-init` in doc tests rust: pin-init: remove `try_` versions of the initializer macros commit e698127eb7249d6c70fa8f2bdba469c0e54f2e2b Author: Jonathan Kim Date: Wed Jul 23 10:07:28 2025 -0400 drm/amdkfd: add extended capabilities to device snapshot Add additional capabilities reporting. Signed-off-by: Jonathan Kim Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit e0d11bdb294cd1325eeccfec05e07d8c2534b43e Author: Kent Russell Date: Thu Jan 22 10:19:28 2026 -0500 drm/amdgpu: Send RMA CPER at bad page loading Some older builds weren't sending RMA CPERs when the bad page threshold was exceeded. Newer builds have resolved this, but there could be systems out there with bad page numbers higher than the threshold, that haven't sent out an RMA CPER. To be thorough and safe, send an RMA CPER when we load the table, if the threshold is met or exceeded, instead of waiting for the next UE to trigger the CPER. Signed-off-by: Kent Russell Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 91544c45fa6a165abde6f2363bb7ded5843ef840 Author: Jesse.Zhang Date: Tue Jan 27 15:01:27 2026 +0800 drm/amdgpu: Fix jpeg ring test order in vcn_v4_0_3 Fix the vcn reset sequence in vcn_v4_0_3_ring_reset() to restore JPEG power state and unlock the JPEG powergating mutex before running the JPEG ring post-reset helper. Fixes: d25c67fd9d6f ("drm/amdgpu/vcn4.0.3: rework reset handling") Reviewed-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 7a3fbdfd19ec5992c0fc2d0bd83888644f5f2f38 Author: Yang Wang Date: Tue Jan 27 11:07:07 2026 +0800 drm/amd/pm: fix race in power state check before mutex lock The power state check in amdgpu_dpm_set_powergating_by_smu() is done before acquiring the pm mutex, leading to a race condition where: 1. Thread A checks state and thinks no change is needed 2. Thread B acquires mutex and modifies the state 3. Thread A returns without updating state, causing inconsistency Fix this by moving the mutex lock before the power state check, ensuring atomicity of the state check and modification. Fixes: 6ee27ee27ba8 ("drm/amd/pm: avoid duplicate powergate/ungate setting") Signed-off-by: Yang Wang Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher commit 37e6349e9328feb600568144411c18e3c35e3077 Author: Taimur Hassan Date: Fri Jan 16 20:09:08 2026 -0500 drm/amd/display: Promote DC to 3.2.367 * Fw release 0.1.44.0 * Fixes for corruption on platforms older than DCN4x. * Bug fixes related to USB4 link training * Fixes related to FP guard * Debug helpers and other stability fixes. * Some refactors to improve code quality Signed-off-by: Taimur Hassan Signed-off-by: Aurabindo Pillai Reviewed-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0f2828150f7ab31a57fe3bce6c2d378103dab10a Author: Taimur Hassan Date: Fri Jan 16 17:25:23 2026 -0500 drm/amd/display: [FW Promotion] Release 0.1.44.0 * Panel Replay related features/bugfixes * BootCRC feature Signed-off-by: Taimur Hassan Signed-off-by: Aurabindo Pillai Reviewed-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 592c5b80110d5e9e50873b5364818cb6f401e26d Author: Bhuvanachandra Pinninti Date: Thu Jan 8 19:11:31 2026 +0530 drm/amd/display: Migrate HUBBUB register access from hwseq to hubbub component. [why] Direct HUBBUB register access in the hwseq layer was creating register conflicts. [how] Migrated HUBBUB registers from hwseq to the hubbub component. Reviewed-by: Martin Leung Signed-off-by: Bhuvanachandra Pinninti Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit ba448f9ed62cf5a89603a738e6de91fc6c42ab35 Author: Muaaz Nisar Date: Thu Dec 18 17:34:29 2025 -0500 drm/amd/display: mouse event trigger to boost RR when idle [WHY+HOW] Add trigger event to boost refresh rate on mouse movement. Reviewed-by: Jun Lei Signed-off-by: Muaaz Nisar Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5b8cfb0cebf93bd0f8b316084ce0589df8fd57ac Author: Michael Strauss Date: Thu Jan 15 11:07:53 2026 -0500 drm/amd/display: Add debug flag to override min dispclk [WHY] Enable dynamic ODM testing without needing a valid dispclk table [HOW] Create a debug flag to specify an override value for min dispclk Reviewed-by: Dmytro Laktyushkin Signed-off-by: Michael Strauss Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 15b1d7b77e9836ff4184093163174a1ef28bbdd7 Author: Zhongwei Date: Tue Jan 13 15:51:42 2026 +0800 drm/amd/display: avoid dig reg access timeout on usb4 link training fail [Why] When usb4 link training fails, the dpia sym clock will be disabled and SYMCLK source should be changed back to phy clock. In enable_streams, it is assumed that link training succeeded and will switch from refclk to phy clock. But phy clk here might not be on. Dig reg access timeout will occur. [How] When enable_stream is hit, check if link training failed for usb4. If it did, fall back to the ref clock to avoid reg access timeout. Reviewed-by: Wenjing Liu Signed-off-by: Zhongwei Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c37084e25f058b9e4c531ac6fc6f232533c566e8 Author: Wayne Lin Date: Tue Jan 6 15:46:49 2026 +0800 drm/amd/display: Remove unnecessary DC FP guard [Why & How] For dcn2x_fast_validate_bw(), not only populate_dml_pipes needs FP guard but also dml_get_voltage_level(). Remove unnecessary DC_FP_START/DC_FP_END guard in dcn20_fast_validate_bw and dcn21_fast_validate_bw. FP guard is already there before calling dcn2x_validate_bandwidth_fp(). Reviewed-by: ChiaHsuan (Tom) Chung Signed-off-by: Wayne Lin Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 26b5cf26885078c0173301a0c12304e17463ba10 Author: Charlene Liu Date: Mon Jan 12 17:53:51 2026 -0500 drm/amd/display: add setup_stereo for dcn4x or later [why] stereo_sync pin is removed, but we still support display stereo Reviewed-by: Ovidiu (Ovi) Bunea Signed-off-by: Charlene Liu Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 06fee4fba93112c198232c351ef4348614a94590 Author: Aurabindo Pillai Date: Sun Jan 11 12:20:51 2026 -0500 drm/amd/display: perform clear update flags for all DCN asics Existing version check that limits the sequence to clear update flags should be performed for all asics. Exclude DCE asics for now. Reviewed-by: Sun peng (Leo) Li Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 6cf32edb5d6307bb55764d9c6df0af4e73c415f2 Author: Wayne Lin Date: Mon Dec 22 16:30:35 2025 +0800 drm/amd/display: Enable bootcrc on FW side [Why] The bootcrc feature is controlled on the FW side. [How] Pass the control bits in boot options to FW. Reviewed-by: ChiaHsuan (Tom) Chung Signed-off-by: Wayne Lin Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 7cdb3d0367860d8e5a058b8658cf7ae85a4796d3 Author: Jack Chang Date: Fri Aug 1 11:54:01 2025 +0800 drm/amd/display: Add FR skipping CTS functions 1. To check whether Sink reaches maximum skipping number Reviewed-by: Robin Chen Signed-off-by: Jack Chang Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit bdad08670278829771626ea7b57c4db531e2544f Author: Matthew Stewart Date: Fri Jan 9 13:32:42 2026 -0500 drm/amd/display: Fix GFX12 family constant checks Using >=, <= for checking the family is not always correct. Reviewed-by: Aurabindo Pillai Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 4a421335842bb622cb8685e66e0e177d4bae5363 Author: Charlene Liu Date: Thu Jan 8 21:45:41 2026 -0500 drm/amd/display: Enable vstateup hook for DCN401 to be reused Add the hook to the DCN401 header file so that it can be reused in other files Reviewed-by: Leo Chen Signed-off-by: Charlene Liu Signed-off-by: Aurabindo Pillai Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 6ce8d536c80aa1f059e82184f0d1994436b1d526 Author: Jon Doron Date: Sat Dec 20 15:04:40 2025 +0200 drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove On APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and ih2 interrupt ring buffers are not initialized. This is by design, as these secondary IH rings are only available on discrete GPUs. See vega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when AMD_IS_APU is set. However, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to get the timestamp of the last interrupt entry. When retry faults are enabled on APUs (noretry=0), this function is called from the SVM page fault recovery path, resulting in a NULL pointer dereference when amdgpu_ih_decode_iv_ts_helper() attempts to access ih->ring[]. The crash manifests as: BUG: kernel NULL pointer dereference, address: 0000000000000004 RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu] Call Trace: amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu] svm_range_restore_pages+0xae5/0x11c0 [amdgpu] amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu] gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu] amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu] amdgpu_ih_process+0x84/0x100 [amdgpu] This issue was exposed by commit 1446226d32a4 ("drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1") which changed the default for Renoir APU from noretry=1 to noretry=0, enabling retry fault handling and thus exercising the buggy code path. Fix this by adding a check for ih1.ring_size before attempting to use it. Also restore the soft_ih support from commit dd299441654f ("drm/amdgpu: Rework retry fault removal"). This is needed if the hardware doesn't support secondary HW IH rings. v2: additional updates (Alex) Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3814 Fixes: dd299441654f ("drm/amdgpu: Rework retry fault removal") Reviewed-by: Timur Kristóf Reviewed-by: Philip Yang Signed-off-by: Jon Doron Signed-off-by: Alex Deucher commit 53868dd8774344051999c880115740da92f97feb Author: Yang Wang Date: Wed Jan 21 11:06:29 2026 +0800 drm/amd/pm: fix smu v14 soft clock frequency setting issue v1: resolve the issue where some freq frequencies cannot be set correctly due to insufficient floating-point precision. v2: patch this convert on 'max' value only. Signed-off-by: Yang Wang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 6194f60c707e3878e120adeb36997075664d8429 Author: Yang Wang Date: Wed Jan 21 11:04:06 2026 +0800 drm/amd/pm: fix smu v13 soft clock frequency setting issue v1: resolve the issue where some freq frequencies cannot be set correctly due to insufficient floating-point precision. v2: patch this convert on 'max' value only. Signed-off-by: Yang Wang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 1bf8b4642c5f511dd73653a25ed7cd0470118389 Author: Shaoyun Liu Date: Thu Jan 22 10:51:11 2026 -0500 drm/amd/include : Update MES v12 API header - SUSPEND Update SUSPEND API to support sdma queues. It's been supportted since 0x82 for gfx12 Signed-off-by: Shaoyun Liu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit dda702172dc26e080fe048b8f170eaccb8097c1a Author: Tvrtko Ursulin Date: Mon Jan 12 10:22:34 2026 +0000 drm/amdgpu: Simplify sorting of the bo list Sort function only cares about the sign so we can replace the conditionals with a single subtraction. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f7e06786512e730f750138b1221b6342bcf07859 Author: Tvrtko Ursulin Date: Mon Jan 12 10:22:33 2026 +0000 drm/amdgpu/mes: Remove idr leftovers v2 Commit cb17fff3a254 ("drm/amdgpu/mes: remove unused functions") removed most of the code using these IDRs but forgot to remove the struct members and init/destroy paths. There is also interrupt handling code in SDMA 5.0 and 5.2 which appears to be using it, but is is unreachable since nothing ever allocates the relevant IDR. We replace those with one time warnings just to avoid any functional difference, but it is also possible they should be removed. v2: also fix up gfx_v12_1.c and sdma_v7_1.c Signed-off-by: Tvrtko Ursulin References: cb17fff3a254 ("drm/amdgpu/mes: remove unused functions") Cc: Alex Deucher Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 5d413c735175fd3a862cd747b330d0097f74abce Author: Ilpo Järvinen Date: Fri Dec 19 19:40:36 2025 +0200 PCI: Move CardBus bridge scanning to setup-cardbus.c The PCI core's pci_scan_bridge_extend() contains convoluted logic specific to setting up bus numbers for legacy CardBus bridges. Extract the CardBus specific part out into setup-cardbus.c to make the core code cleaner and allow omitting CardBus bridge support from modern systems. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-24-ilpo.jarvinen@linux.intel.com commit 3cbb40c3d46415bff4ba4b75ccc96007217112f0 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:35 2025 +0200 PCI: Add pbus_validate_busn() for Bus Number validation pci_scan_bridge_extend() validates bus numbers but upcoming changes that separate CardBus code into own function need to call that the same validation. Thus, add pbus_validate_busn for validating the Bus Numbers. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-23-ilpo.jarvinen@linux.intel.com commit cad3337bb6c3a2ba2307d6a9061e752e15681d2b Author: Ilpo Järvinen Date: Fri Dec 19 19:40:33 2025 +0200 PCI: Add dword #defines for Bus Number + Secondary Latency Timer uapi/linux/pci_regs.h defines Primary/Secondary/Subordinate Bus Numbers and Secondary Latency Timer (PCIe r7.0, sec. 7.5.1.3) as byte register offsets, but in practice the code may read/write the entire dword. In the lack of #defines to handle the dword fields, the code ends up using literals which are not as easy to read. Add dword field masks for the Bus Number and Secondary Latency Timer fields and use them in probe.c. Signed-off-by: Ilpo Järvinen [bhelgaas: squash new #defines and uses together] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-21-ilpo.jarvinen@linux.intel.com Link: https://patch.msgid.link/20251219174036.16738-22-ilpo.jarvinen@linux.intel.com commit 3d71bc79eee1d436547edc81f50fcc0d607b356b Author: Ilpo Järvinen Date: Fri Dec 19 19:40:32 2025 +0200 PCI: Use scnprintf() instead of sprintf() Using sprintf() is deprecated as it does not do proper size checks. While the code in pci_scan_bridge_extend() is safe with respect to overwriting the destination buffer, use scnprintf() to not promote use of a deprecated sprint() (and allow eventually removing it from the kernel). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-20-ilpo.jarvinen@linux.intel.com commit 08b3af830a35b66e0d40975dbf02feacc5d2aaa2 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:31 2025 +0200 PCI: Handle CardBus-specific params in setup-cardbus.c Move CardBus window sizing parameters to setup-cardbus.c, which contains all the other CardBus code. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-19-ilpo.jarvinen@linux.intel.com commit fd29d4ea09baa54b87f7ec7278768d0db00382a8 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:30 2025 +0200 PCI: Separate CardBus setup & build it only with CONFIG_CARDBUS PCI bridge window setup code includes special code to handle CardBus bridges. CardBus has long since fallen out of favor and modern systems have no use for it. Move CardBus setup code to its own file and use existing CONFIG_CARDBUS to decide whether it should be built or not. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-18-ilpo.jarvinen@linux.intel.com commit b398665a5b71665542296378c5f4e42bf22c3e9a Author: Ilpo Järvinen Date: Fri Dec 19 19:40:29 2025 +0200 PCI: Add 'pci' prefix to struct pci_dev_resource handling functions setup-bus.c has static functions for handling struct pci_dev_resource related operation which have no prefixes. Add 'pci' prefixes to those function names as add_to_list() will be needed in another file by an upcoming change. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-17-ilpo.jarvinen@linux.intel.com commit 1a5de84c3ae62244e06b4f9f768c874035da837a Author: Ilpo Järvinen Date: Fri Dec 19 19:40:28 2025 +0200 PCI: Use resource_assigned() in setup-bus.c algorithm Many places in the resource fitting and assignment algorithm want to know if the resource is assigned into the resource tree or not. Convert open-coded ->parent checks to use resource_assigned(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-16-ilpo.jarvinen@linux.intel.com commit 2aa7c47a681f54b5cf4d98e13447be2ea5fb5af3 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:27 2025 +0200 resource: Mark res given to resource_assigned() as const The caller may hold a const struct resource which will trigger an unnecessary warning when calling resource_assigned() as it will not modify res in any way. Mark resource_assigned()'s struct resource *res parameter const to avoid the compiler warning. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-15-ilpo.jarvinen@linux.intel.com commit 6a5e64c75e82953e4d6b52bba30e2e281532b386 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:26 2025 +0200 PCI: Add pbus_mem_size_optional() to handle optional sizes The resource loop in pbus_size_mem() handles optional resources that are either fully optional (SR-IOV and disabled Expansion ROMs) or bridge windows that may be optional only for a part. The logic is a little inconsistent when it comes to a bridge window that has only optional children resources as it would be more natural to treat it similar to any fully optional resource. As resource size should be zero in that case, it shouldn't cause any bugs but it still seems useful to address the inconsistency. Place the optional size related code of pbus_size_mem() into pbus_mem_size_optional() and add a check in pci_resource_is_optional() for entirely optional bridge windows. Reorder the logic inside pbus_mem_size_optional() such that fully optional resources are handled the same irrespective of whether the resource is a bridge window or not. Additional motivation for this are the upcoming changes that add complexity to the optional sizing logic due to Resizable BAR awareness. The extra logic would exceed any reasonable indentation level if the optional sizing code is kept within the loop body. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-14-ilpo.jarvinen@linux.intel.com commit c10fe0c0e6977254e2b7d4fed18e71501c958d65 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:25 2025 +0200 PCI: Check invalid align earlier in pbus_size_mem() Check for invalid align before any bridge window sizing actions in pbus_size_mem() to avoid need to roll back any sizing calculations. Placing the check earlier will make it easier to add more optional size related calculations at where the SR-IOV logic currently is in pbus_size_mem(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-13-ilpo.jarvinen@linux.intel.com commit 9629f71722bb994f4b95088bc37a14f9aeaa5f90 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:24 2025 +0200 PCI: Log reset and restore of resources PCI resource fitting and assignment is complicated to track because it performs many actions without any logging. One of these is resource reset (zeroing the resource) and the restore during the multi-pass resource fitting algorithm. Resource reset does not play well with the other PCI code if the code later wants to reattempt assignment of that resource. Knowing that a resource was left in the reset state without a pairing restore is useful for understanding issues that show up as resource assignment failures. Add pci_dbg() to both reset and restore to be better able to track what's going on within the resource fitting algorithm. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-12-ilpo.jarvinen@linux.intel.com commit 5fa2f9fb34870f7e66d6d19dac50a6a13dd458e7 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:23 2025 +0200 PCI: Add pci_resource_is_bridge_win() Add pci_resource_is_bridge_win() helper to simplify checking if the resource is a bridge window. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-11-ilpo.jarvinen@linux.intel.com commit e112fbb26b66b183d9387017b29e5d0b62986eed Author: Ilpo Järvinen Date: Fri Dec 19 19:40:22 2025 +0200 PCI: Fetch dev_res to local var in __assign_resources_sorted() __assign_resources_sorted() calls get_res_add_size() and get_res_add_align(), each walking through the realloc_head list to relocate the corresponding pci_dev_resource entry. Fetch the pci_dev_resource entry into a local variable to avoid double walk. In addition, reverse logic to reduce indentation level. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-10-ilpo.jarvinen@linux.intel.com commit 4bee4fc0f4ee1086e498f9d197352237a0232598 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:21 2025 +0200 PCI: Use res_to_dev_res() in reassign_resources_sorted() reassign_resources_sorted() contains a search loop for a particular resource in the head list. res_to_dev_res() already implements the same search so use it instead. Drop unused found_match and dev_res variables. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-9-ilpo.jarvinen@linux.intel.com commit 5819403a0e5700342aad5c908a4a820950ccf89d Author: Ilpo Järvinen Date: Fri Dec 19 19:40:20 2025 +0200 PCI: Pass bridge window resource to pbus_size_mem() pbus_size_mem() inputs type and calculates bridge window resource within. Its caller (__pci_bus_size_bridges()) also has to look up the prefetchable window to determine if it exists or not to decide whether to call pbus_size_mem() twice or once. Change the interface such that the caller is responsible in providing the bridge window resource. Passing the resource directly avoids another lookup for the prefetchable window inside pbus_size_mem(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-8-ilpo.jarvinen@linux.intel.com commit d0c72d6e399e88691ae978f997bd72a9f1ccf129 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:19 2025 +0200 PCI: Push realloc check into pbus_size_mem() pbus_size_mem() and calculate_memsize() input both min_size and add_size. They are given the same value if realloc_head is NULL and min_size is 0 otherwise. Both are used in calculate_memsize() to enforce a lower bound to the size. The interface between __pci_bus_size_bridges() and the forementioned functions can be simplied by pushing the realloc check into pbus_size_mem(). There are only two possible cases: 1) when calculating size0, add_size parameter given to calculate_memsize() is always 0 which implies only min_size matters. 2) when calculating size1, realloc_head is not NULL which implies min_size=0 so only add_size matters. Drop min_size parameter from pbus_size_mem() and check realloc_head when calling calculate_memsize(). Drop add_size from calculate_memsize() and use only min_size within max() to enforce the lower bound. calculate_iosize() is a bit more complicated than calculate_memsize() and is therefore left as is, but pbus_size_io() can still input only min_size similar to pbus_size_mem(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-7-ilpo.jarvinen@linux.intel.com commit f909e3ee3ed1a44202f09ac7e637a0f9ec372225 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:18 2025 +0200 PCI: Remove old_size limit from bridge window sizing calculate_memsize() applies lower bound to the resource size before aligning the resource size making it impossible to shrink bridge window resources. I've not found any justification for this lower bound and nothing indicated it was to work around some HW issue. Prior to the commit 3baeae36039a ("PCI: Use pci_release_resource() instead of release_resource()"), releasing a bridge window during BAR resize resulted in clearing start and end address of the resource. Clearing addresses destroys the resource size as a side-effect, therefore nullifying the effect of the old size lower bound. After the commit 3baeae36039a ("PCI: Use pci_release_resource() instead of release_resource()"), BAR resize uses the aligned old size, which results in exceeding what fits into the parent window in some cases: xe 0030:03:00.0: [drm] Attempting to resize bar from 256MiB -> 16384MiB xe 0030:03:00.0: BAR 0 [mem 0x620c000000000-0x620c000ffffff 64bit]: releasing xe 0030:03:00.0: BAR 2 [mem 0x6200000000000-0x620000fffffff 64bit pref]: releasing pci 0030:02:01.0: bridge window [mem 0x6200000000000-0x620001fffffff 64bit pref]: releasing pci 0030:01:00.0: bridge window [mem 0x6200000000000-0x6203fbff0ffff 64bit pref]: releasing pci 0030:00:00.0: bridge window [mem 0x6200000000000-0x6203fbff0ffff 64bit pref]: was not released (still contains assigned resources) pci 0030:00:00.0: Assigned bridge window [mem 0x6200000000000-0x6203fbff0ffff 64bit pref] to [bus 01-04] free space at [mem 0x6200400000000-0x62007ffffffff 64bit pref] pci 0030:00:00.0: Assigned bridge window [mem 0x6200000000000-0x6203fbff0ffff 64bit pref] to [bus 01-04] cannot fit 0x4000000000 required for 0030:01:00.0 bridging to [bus 02-04] The old size of 0x6200000000000-0x6203fbff0ffff resource was used as the lower bound which results in 0x4000000000 size request due to alignment. That exceeds what can fit into the parent window. Since the lower bound never even was enforced fully because the resource addresses were cleared when the bridge window is released, remove the old_size lower bound entirely and trust the calculated bridge window size is enough. This same problem may occur on io window side but seems less likely to cause issues due to general difference in alignment. Removing the lower bound may have other unforeseen consequences in case of io window so it's better to leave it as -next material if no problem is reported related to io window sizing (BAR resize shouldn't touch io windows anyway). Fixes: 3baeae36039a ("PCI: Use pci_release_resource() instead of release_resource()") Reported-by: Simon Richter Link: https://lore.kernel.org/r/f9a8c975-f5d3-4dd2-988e-4371a1433a60@hogyros.de/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-6-ilpo.jarvinen@linux.intel.com commit 4326ab1806a52888d1cd076b9020677703e25545 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:17 2025 +0200 resource: Increase MAX_IORES_LEVEL to 8 While debugging a PCI resource allocation issue, the resources for many nested bridges and endpoints got flattened in /proc/iomem by MAX_IORES_LEVEL that is set to 5. This made the iomem output hard to read as the visual hierarchy cues were lost. Increase MAX_IORES_LEVEL to 8 to avoid flattening PCI topologies with nested bridges so aggressively (the case in the Link has the deepest resource at level 7 so 8 looks a reasonable limit). Link: https://bugzilla.kernel.org/show_bug.cgi?id=220775 Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251219174036.16738-5-ilpo.jarvinen@linux.intel.com commit 3958bf16e2fe1b1c95467e58694102122c951a31 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:16 2025 +0200 PCI: Stop over-estimating bridge window size New way to calculate the bridge window head alignment produces tight-fit, that is, it does not leave any gaps between the resources. Similarly, relaxed tail alignment does not leave extra tail room. Start to use bridge window calculation that does not over-estimate the size of the required window. pbus_upstream_space_available() can be removed. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Malte Schröder Link: https://patch.msgid.link/20251219174036.16738-4-ilpo.jarvinen@linux.intel.com commit e540be7d56d740144b1bd6f220b61ffe2f3830d4 Author: Geert Uytterhoeven Date: Tue Jan 27 20:08:31 2026 +0100 spi: SPI_AXIADO should depend on ARCH_AXIADO The Axiado DB-H SPI controller is only present on Axiado AX3000 SoCs. Hence add a dependency on ARCH_AXIADO, to prevent asking the user about this driver when configuring a kernel without Axiado SoC Family support. Fixes: e75a6b00ad7962a7 ("spi: axiado: Add driver for Axiado SPI DB controller") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/386273d50fb3c51cccdba4b3101a0705208abd4d.1769540444.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit ce9b1c10c3f1c723c3cc7b63aa8331fdb6c57a04 Author: Borislav Petkov (AMD) Date: Tue Jan 27 23:09:13 2026 +0100 x86/entry/vdso: Add vdso2c to .gitignore The commit a76108d05ee1 ("x86/entry/vdso: Move vdso2c to arch/x86/tools") moved vdso2c to arch/x86/tools/ and commit 93d73005bff4 ("x86/entry/vdso: Rename vdso_image_* to vdso*_image") renamed .so files but also dropped vdso2c from arch/x86/entry/vdso/.gitignore. It should've moved it to arch/x86/tools/.gitignore instead. Do that. Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260127221633.GAaXk5QcG8ILa1VWYR@fat_crate.local commit bc75c8e5071120e919beb39e69f0979cccfdf219 Author: Ilpo Järvinen Date: Fri Dec 19 19:40:15 2025 +0200 PCI: Rewrite bridge window head alignment function The calculation of bridge window head alignment is done by calculate_mem_align() [*]. With the default bridge window alignment, it is used for both head and tail alignment. The selected head alignment does not always result in tight-fitting resources (gap at d4f00000-d4ffffff): d4800000-dbffffff : PCI Bus 0000:06 d4800000-d48fffff : PCI Bus 0000:07 d4800000-d4803fff : 0000:07:00.0 d4800000-d4803fff : nvme d4900000-d49fffff : PCI Bus 0000:0a d4900000-d490ffff : 0000:0a:00.0 d4900000-d490ffff : r8169 d4910000-d4913fff : 0000:0a:00.0 d4a00000-d4cfffff : PCI Bus 0000:0b d4a00000-d4bfffff : 0000:0b:00.0 d4a00000-d4bfffff : 0000:0b:00.0 d4c00000-d4c07fff : 0000:0b:00.0 d4d00000-d4dfffff : PCI Bus 0000:15 d4d00000-d4d07fff : 0000:15:00.0 d4d00000-d4d07fff : xhci-hcd d4e00000-d4efffff : PCI Bus 0000:16 d4e00000-d4e7ffff : 0000:16:00.0 d4e80000-d4e803ff : 0000:16:00.0 d4e80000-d4e803ff : ahci d5000000-dbffffff : PCI Bus 0000:0c This has not caused problems (for years) with the default bridge window tail alignment that grossly over-estimates the required tail alignment leaving more tail room than necessary. With the introduction of relaxed tail alignment that leaves no extra tail room whatsoever, any gaps will immediately turn into assignment failures. Introduce head alignment calculation that ensures no gaps are left and apply the new approach when using relaxed alignment. We may want to consider using it for the normal alignment eventually, but as the first step, solve only the problem with the relaxed tail alignment. ([*] I don't understand the algorithm in calculate_mem_align().) Link: https://git.kernel.org/history/history/c/5d0a8965aea9 ("[PATCH] 2.5.14: New PCI allocation code (alpha, arm, parisc) [2/2]") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220775 Reported-by: Malte Schröder Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Malte Schröder Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251219174036.16738-3-ilpo.jarvinen@linux.intel.com commit 785632d82648569b1ce8f11854d0775b219e2706 Author: Sumeet Pawnikar Date: Mon Jan 26 15:09:49 2026 +0530 ACPI: sysfs: Replace sprintf() with sysfs_emit() Replace all sprintf() calls with sysfs_emit() in sysfs show functions. sysfs_emit() is preferred to sprintf() for formatting sysfs output as it provides better bounds checking and prevents potential buffer overflows. Signed-off-by: Sumeet Pawnikar [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260126093949.8910-1-sumeet4linux@gmail.com Signed-off-by: Rafael J. Wysocki commit 83e2908c1d425a6ef2e96457ad95b886b8ddfc48 Author: Sumit Gupta Date: Tue Jan 20 20:26:17 2026 +0530 ACPI: CPPC: Rename EPP constants for clarity Update EPP (Energy Performance Preference) constants for more clarity: - Add CPPC_EPP_PERFORMANCE_PREF (0x00) for performance preference. - Rename CPPC_ENERGY_PERF_MAX to CPPC_EPP_ENERGY_EFFICIENCY_PREF (0xFF) for energy efficiency. Signed-off-by: Sumit Gupta Reviewed-by: Lifeng Zheng [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260120145623.2959636-4-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit 7cb6f10ce3edc9b7bb543daafd72c396a96978ee Author: Sumit Gupta Date: Tue Jan 20 20:26:16 2026 +0530 ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs - Remove redundant energy_perf field from 'struct cppc_perf_caps' as the same is available in 'struct cppc_perf_ctrls' which is used. - Move the 'auto_sel' field from 'struct cppc_perf_caps' to 'struct cppc_perf_ctrls' as it represents a control register. Signed-off-by: Sumit Gupta Reviewed-by: Pierre Gondois Reviewed-by: Lifeng Zheng Link: https://patch.msgid.link/20260120145623.2959636-3-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki commit 8cf19b19dba8814ccc8b1179dabf28b7f8eefc22 Author: Anton D. Stavinskii Date: Tue Jan 27 23:08:20 2026 +0400 ASoC: sophgo: cv1800b: tidy Kconfig spacing Restore the empty line that was accidentally removed earlier Signed-off-by: Anton D. Stavinskii Link: https://patch.msgid.link/20260127-incremental-for-i2s-dvier-v2-2-5f66b841f63d@gmail.com Signed-off-by: Mark Brown commit a8e3e488293118b8fa5d5e7ca786ca25b954ce12 Author: Anton D. Stavinskii Date: Tue Jan 27 23:08:19 2026 +0400 ASoC: sophgo: cv1800b: document DAC overwrite handling Add comments to cv1800b_dac_mute() and its caller to explain how the overwrite mechanism works and why we force it off before playback. Signed-off-by: Anton D. Stavinskii Link: https://patch.msgid.link/20260127-incremental-for-i2s-dvier-v2-1-5f66b841f63d@gmail.com Signed-off-by: Mark Brown commit b2bc7c44ed1779fc9eaab9a186db0f0d01439622 Author: Jiasheng Jiang Date: Sat Jan 17 16:50:24 2026 +0000 fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'DeleteIndexEntryRoot' case of the 'do_action' function, the entry size ('esize') is retrieved from the log record without adequate bounds checking. Specifically, the code calculates the end of the entry ('e2') using: e2 = Add2Ptr(e1, esize); It then calculates the size for memmove using 'PtrOffset(e2, ...)', which subtracts the end pointer from the buffer limit. If 'esize' is maliciously large, 'e2' exceeds the used buffer size. This results in a negative offset which, when cast to size_t for memmove, interprets as a massive unsigned integer, leading to a heap buffer overflow. This commit adds a check to ensure that the entry size ('esize') strictly fits within the remaining used space of the index header before performing memory operations. Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Jiasheng Jiang Signed-off-by: Konstantin Komarov commit 62777c8015f3d86ab7853790192b24f0cee8a647 Merge: a18056a6c11cab a7ad67e9745d33 Author: Jakub Kicinski Date: Tue Jan 27 10:40:18 2026 -0800 Merge branch 'net-stmmac-rk-simplify-per-soc-configuration' Russell King says: ==================== net: stmmac: rk: simplify per-SoC configuration [part] ==================== Link: https://patch.msgid.link/aXdTi4ViCkhhXvFI@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a7ad67e9745d3347d98d70cbeea8e80a5f950e9e Author: Russell King (Oracle) Date: Mon Jan 26 11:45:18 2026 +0000 net: stmmac: rk: group MACPHY register offset and fields together Group the MACPHY register offsets and associated bitfields together to become self-documenting which definitions are associated with which register. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vkL1y-00000005usW-1TKX@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit cdb5fdfcf39607823491668bf699024595431d61 Author: Russell King (Oracle) Date: Mon Jan 26 11:45:13 2026 +0000 net: stmmac: rk: convert rk3328 to use bsp_priv->id rk3328 contains two GMAC instances - gmac2io and gmac2phy. While the gmac2io instance may be connected to an external PHY, the gmac2phy instance is permanently connected via RMII to an on-SoC integrated PHY. The driver currently tests for the gmac2phy instance by checking bsp_priv->integrated_phy (determined from the PHY's phy-is-integrated property) and sometimes that the interface mode is RMII. This works because the rk3328.dtsi has: gmac2phy: ethernet@ff550000 { compatible = "rockchip,rk3328-gmac"; phy-mode = "rmii"; phy-handle = <&phy>; mdio { phy: ethernet-phy@0 { phy-is-integrated; }; }; }; The driver contains a mechanism to look up the MMIO address in a table to determine bsp_priv->id, which is used for every other Rockchip device. Switch rk3328 to use this mechanism to determine bsp_priv->id and use that to select which GRF register is used for configuration, similarly to how the other Rockchip SoCs handle such differences. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vkL1t-00000005usQ-0vjt@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit af6eaf70189785c4b616c7bea75c1b46bb8498bc Author: Russell King (Oracle) Date: Mon Jan 26 11:45:08 2026 +0000 net: stmmac: rk: get rid of rk_phy_power_ctl() It is not worth having a common rk_phy_power_ctl() when the only difference is which regulator function is called. Also, passing true/false is non-descriptive. Split this function, moving the code appropriately into rk_phy_powerup() and rk_phy_powerdown(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vkL1o-00000005usJ-08hy@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a0094edaf4920689dd6c26cb14a929ae80e290a0 Author: Russell King (Oracle) Date: Mon Jan 26 11:45:02 2026 +0000 net: stmmac: rk: avoid phy_power_on() In https://lore.kernel.org/netdev/aDne1Ybuvbk0AwG0@shell.armlinux.org.uk/ I requested that a follow-up patch to change the name of dwmac-rk's phy_power_on() function, which clashes with the drivers/phy function of the same name. This can cause confusion when grepping for this function name, or when reviewing code. Thankfully, stmmac doesn't make use of drivers/phy which saves this from compile errors. However, as is the usual case when a request is made as part of a review, if the review leads to successful application of the patch the author doesn't bother following up with any such requests, and so the problem falls back onto the reviewer to address... so here is the solution. Rename dwmac-rk's function to rk_phy_power_ctl(), as the function both powers up and down. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vkL1i-00000005usD-3lhz@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e7f67c2be7877a3d44aa79b8d22eae8cb6e2c6d6 Author: Jens Axboe Date: Fri Jan 16 14:37:28 2026 -0700 io_uring/bpf_filter: add ref counts to struct io_bpf_filter In preparation for allowing inheritance of BPF filters and filter tables, add a reference count to the filter. This allows multiple tables to safely include the same filter. Reviewed-by: Christian Brauner Signed-off-by: Jens Axboe commit e7c30675a7fb79d94400987865a3bd620458ca1a Author: Jens Axboe Date: Sat Jan 17 08:27:23 2026 -0700 io_uring/bpf_filter: cache lookup table in ctx->bpf_filters Currently a few pointer dereferences need to be made to both check if BPF filters are installed, and then also to retrieve the actual filter for the opcode. Cache the table in ctx->bpf_filters to avoid that. Add a bit of debug info on ring exit to show if we ever got this wrong. Small risk of that given that the table is currently only updated in one spot, but once task forking is enabled, that will add one more spot. Reviewed-by: Christian Brauner Signed-off-by: Jens Axboe commit 8768770cf5d76d177fa2200e6957a372e61e06b5 Author: Jens Axboe Date: Mon Jan 19 15:59:54 2026 -0700 io_uring/bpf_filter: allow filtering on contents of struct open_how This adds custom filtering for IORING_OP_OPENAT and IORING_OP_OPENAT2, where the open_how flags, mode, and resolve can be checked by filters. Signed-off-by: Jens Axboe commit cff1c26b4223820431129696b45525e5928e6409 Author: Jens Axboe Date: Fri Jan 16 14:50:05 2026 -0700 io_uring/net: allow filtering on IORING_OP_SOCKET data Example population method for the BPF based opcode filtering. This exposes the socket family, type, and protocol to a registered BPF filter. This in turn enables the filter to make decisions based on what was passed in to the IORING_OP_SOCKET request type. Signed-off-by: Jens Axboe commit d42eb05e60fea31de49897d63a1d73f933303bd4 Author: Jens Axboe Date: Thu Jan 15 08:24:02 2026 -0700 io_uring: add support for BPF filtering for opcode restrictions Add support for loading classic BPF programs with io_uring to provide fine-grained filtering of SQE operations. Unlike IORING_REGISTER_RESTRICTIONS which only allows bitmap-based allow/deny of opcodes, BPF filters can inspect request attributes and make dynamic decisions. The filter is registered via IORING_REGISTER_BPF_FILTER with a struct io_uring_bpf: struct io_uring_bpf_filter { __u32 opcode; /* io_uring opcode to filter */ __u32 flags; __u32 filter_len; /* number of BPF instructions */ __u32 resv; __u64 filter_ptr; /* pointer to BPF filter */ __u64 resv2[5]; }; enum { IO_URING_BPF_CMD_FILTER = 1, }; struct io_uring_bpf { __u16 cmd_type; /* IO_URING_BPF_* values */ __u16 cmd_flags; /* none so far */ __u32 resv; union { struct io_uring_bpf_filter filter; }; }; and the filters get supplied a struct io_uring_bpf_ctx: struct io_uring_bpf_ctx { __u64 user_data; __u8 opcode; __u8 sqe_flags; __u8 pdu_size; __u8 pad[5]; }; where it's possible to filter on opcode and sqe_flags, with pdu_size indicating how much extra data is being passed in beyond the pad field. This will used for specific finer grained filtering inside an opcode. An example of that for sockets is in one of the following patches. Anything the opcode supports can end up in this struct, populated by the opcode itself, and hence can be filtered for. Filters have the following semantics: - Return 1 to allow the request - Return 0 to deny the request with -EACCES - Multiple filters can be stacked per opcode. All filters must return 1 for the opcode to be allowed. - Filters are evaluated in registration order (most recent first) The implementation uses classic BPF (cBPF) rather than eBPF for as that's required for containers, and since they can be used by any user in the system. Signed-off-by: Jens Axboe commit 6b8edfcd661b569f077cc1ea1f7463ec38547779 Author: wheatfox Date: Sun Jan 25 20:44:50 2026 +0800 docs: automarkup.py: Skip common English words as C identifiers The automarkup extension incorrectly recognizes common English words as C identifiers when they follow struct/union/enum/typedef keywords, causing normal text like "... (a simple) struct that" (in `workqueue.rst`) to be rendered as code blocks. This patch adds Skipidentifiers list to filter out these words. Signed-off-by: Yulong Han Signed-off-by: Jonathan Corbet Message-ID: <20260125124450.2005006-1-wheatfox17@icloud.com> commit 35538dba51b4a64f790aefdc6972772dc36b9826 Merge: 1456ebb291ddee 17e2ce02bf5669 Author: Alexei Starovoitov Date: Tue Jan 27 09:11:30 2026 -0800 Merge branch 'bpf-fix-fionread-and-copied_seq-issues' Jiayuan Chen says: ==================== bpf: Fix FIONREAD and copied_seq issues syzkaller reported a bug [1] where a socket using sockmap, after being unloaded, exposed incorrect copied_seq calculation. The selftest I provided can be used to reproduce the issue reported by syzkaller. TCP recvmsg seq # bug 2: copied E92C873, seq E68D125, rcvnxt E7CEB7C, fl 40 WARNING: CPU: 1 PID: 5997 at net/ipv4/tcp.c:2724 tcp_recvmsg_locked+0xb2f/0x2910 net/ipv4/tcp.c:2724 Call Trace: receive_fallback_to_copy net/ipv4/tcp.c:1968 [inline] tcp_zerocopy_receive+0x131a/0x2120 net/ipv4/tcp.c:2200 do_tcp_getsockopt+0xe28/0x26c0 net/ipv4/tcp.c:4713 tcp_getsockopt+0xdf/0x100 net/ipv4/tcp.c:4812 do_sock_getsockopt+0x34d/0x440 net/socket.c:2421 __sys_getsockopt+0x12f/0x260 net/socket.c:2450 __do_sys_getsockopt net/socket.c:2457 [inline] __se_sys_getsockopt net/socket.c:2454 [inline] __x64_sys_getsockopt+0xbd/0x160 net/socket.c:2454 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f A sockmap socket maintains its own receive queue (ingress_msg) which may contain data from either its own protocol stack or forwarded from other sockets. FD1:read() -- FD1->copied_seq++ | [read data] | [enqueue data] v [sockmap] -> ingress to self -> ingress_msg queue FD1 native stack ------> ^ -- FD1->rcv_nxt++ -> redirect to other | [enqueue data] | | | ingress to FD1 v ^ ... | [sockmap] FD2 native stack The issue occurs when reading from ingress_msg: we update tp->copied_seq by default, but if the data comes from other sockets (not the socket's own protocol stack), tcp->rcv_nxt remains unchanged. Later, when converting back to a native socket, reads may fail as copied_seq could be significantly larger than rcv_nxt. Additionally, FIONREAD calculation based on copied_seq and rcv_nxt is insufficient for sockmap sockets, requiring separate field tracking. [1] https://syzkaller.appspot.com/bug?extid=06dbd397158ec0ea4983 --- v7 -> v9: Address Jakub Sitnicki's feedback: - Remove sk_receive_queue check in tcp_bpf_ioctl, only report ingress_msg data length for FIONREAD - Minor nits fixes - Add Reviewed-by tag from John Fastabend - Fix ci error https://lore.kernel.org/bpf/20260113025121.197535-1-jiayuan.chen@linux.dev/ v5 -> v7: Some modifications suggested by Jakub Sitnicki, and added Reviewed-by tag. https://lore.kernel.org/bpf/20260106051458.279151-1-jiayuan.chen@linux.dev/ v1 -> v5: Use skmsg.sk instead of extending BPF_F_XXX macro and fix CI failure reported by CI v1: https://lore.kernel.org/bpf/20251117110736.293040-1-jiayuan.chen@linux.dev/ ==================== Link: https://patch.msgid.link/20260124113314.113584-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit 17e2ce02bf5669dfa659976e93d409228cba98f9 Author: Jiayuan Chen Date: Sat Jan 24 19:32:45 2026 +0800 selftests/bpf: Add tests for FIONREAD and copied_seq This commit adds two new test functions: one to reproduce the bug reported by syzkaller [1], and another to cover the calculation of copied_seq. The tests primarily involve installing and uninstalling sockmap on sockets, then reading data to verify proper functionality. Additionally, extend the do_test_sockmap_skb_verdict_fionread() function to support UDP FIONREAD testing. [1] https://syzkaller.appspot.com/bug?extid=06dbd397158ec0ea4983 Signed-off-by: Jiayuan Chen Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/r/20260124113314.113584-4-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit 929e30f9312514902133c45e51c79088421ab084 Author: Jiayuan Chen Date: Sat Jan 24 19:32:44 2026 +0800 bpf, sockmap: Fix FIONREAD for sockmap A socket using sockmap has its own independent receive queue: ingress_msg. This queue may contain data from its own protocol stack or from other sockets. Therefore, for sockmap, relying solely on copied_seq and rcv_nxt to calculate FIONREAD is not enough. This patch adds a new msg_tot_len field in the psock structure to record the data length in ingress_msg. Additionally, we implement new ioctl interfaces for TCP and UDP to intercept FIONREAD operations. Note that we intentionally do not include sk_receive_queue data in the FIONREAD result. Data in sk_receive_queue has not yet been processed by the BPF verdict program, and may be redirected to other sockets or dropped. Including it would create semantic ambiguity since this data may never be readable by the user. Unix and VSOCK sockets have similar issues, but fixing them is outside the scope of this patch as it would require more intrusive changes. Previous work by John Fastabend made some efforts towards FIONREAD support: commit e5c6de5fa025 ("bpf, sockmap: Incorrectly handling copied_seq") Although the current patch is based on the previous work by John Fastabend, it is acceptable for our Fixes tag to point to the same commit. FD1:read() -- FD1->copied_seq++ | [read data] | [enqueue data] v [sockmap] -> ingress to self -> ingress_msg queue FD1 native stack ------> ^ -- FD1->rcv_nxt++ -> redirect to other | [enqueue data] | | | ingress to FD1 v ^ ... | [sockmap] FD2 native stack Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") Signed-off-by: Jiayuan Chen Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/r/20260124113314.113584-3-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit b40cc5adaa80e1471095a62d78233b611d7a558c Author: Jiayuan Chen Date: Sat Jan 24 19:32:43 2026 +0800 bpf, sockmap: Fix incorrect copied_seq calculation A socket using sockmap has its own independent receive queue: ingress_msg. This queue may contain data from its own protocol stack or from other sockets. The issue is that when reading from ingress_msg, we update tp->copied_seq by default. However, if the data is not from its own protocol stack, tcp->rcv_nxt is not increased. Later, if we convert this socket to a native socket, reading from this socket may fail because copied_seq might be significantly larger than rcv_nxt. This fix also addresses the syzkaller-reported bug referenced in the Closes tag. This patch marks the skmsg objects in ingress_msg. When reading, we update copied_seq only if the data is from its own protocol stack. FD1:read() -- FD1->copied_seq++ | [read data] | [enqueue data] v [sockmap] -> ingress to self -> ingress_msg queue FD1 native stack ------> ^ -- FD1->rcv_nxt++ -> redirect to other | [enqueue data] | | | ingress to FD1 v ^ ... | [sockmap] FD2 native stack Closes: https://syzkaller.appspot.com/bug?extid=06dbd397158ec0ea4983 Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") Reviewed-by: Jakub Sitnicki Reviewed-by: John Fastabend Signed-off-by: Jiayuan Chen Link: https://lore.kernel.org/r/20260124113314.113584-2-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov commit 1456ebb291ddee67c9144c8f7f38a6dddcd32ed7 Author: Matt Bobrowski Date: Tue Jan 27 08:51:11 2026 +0000 selftests/bpf: cover BPF_CGROUP_ITER_CHILDREN control option Extend some of the existing CSS iterator selftests such that they cover the newly introduced BPF_CGROUP_ITER_CHILDREN iterator control option. Signed-off-by: Matt Bobrowski Link: https://lore.kernel.org/r/20260127085112.3608687-2-mattbobrowski@google.com Signed-off-by: Alexei Starovoitov commit 752b807028e63f1473b84eb1350e131eca5e5249 Author: Matt Bobrowski Date: Tue Jan 27 08:51:10 2026 +0000 bpf: add new BPF_CGROUP_ITER_CHILDREN control option Currently, the BPF cgroup iterator supports walking descendants in either pre-order (BPF_CGROUP_ITER_DESCENDANTS_PRE) or post-order (BPF_CGROUP_ITER_DESCENDANTS_POST). These modes perform an exhaustive depth-first search (DFS) of the hierarchy. In scenarios where a BPF program may need to inspect only the direct children of a given parent cgroup, a full DFS is unnecessarily expensive. This patch introduces a new BPF cgroup iterator control option, BPF_CGROUP_ITER_CHILDREN. This control option restricts the traversal to the immediate children of a specified parent cgroup, allowing for more targeted and efficient iteration, particularly when exhaustive depth-first search (DFS) traversal is not required. Signed-off-by: Matt Bobrowski Link: https://lore.kernel.org/r/20260127085112.3608687-1-mattbobrowski@google.com Signed-off-by: Alexei Starovoitov commit 4b038a9670154e8bb4832d80f0f2b68b1b812171 Author: Hao Li Date: Wed Dec 10 08:26:31 2025 +0800 slub: keep empty main sheaf as spare in __pcs_replace_empty_main() When __pcs_replace_empty_main() fails to obtain a full sheaf directly from the barn, it may either: - Refill an empty sheaf obtained via barn_get_empty_sheaf(), or - Allocate a brand new full sheaf via alloc_full_sheaf(). After reacquiring the per-CPU lock, if pcs->main is still empty and pcs->spare is NULL, the current code donates the empty main sheaf to the barn via barn_put_empty_sheaf() and installs the full sheaf as pcs->main, leaving pcs->spare unpopulated. Instead, keep the existing empty main sheaf locally as the spare: pcs->spare = pcs->main; pcs->main = full; This populates pcs->spare earlier, which can reduce future barn traffic. Suggested-by: Vlastimil Babka Signed-off-by: Hao Li Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka Tested-by: Zhao Liu commit d907bf434fcd64c9609aa2983574e7c1f28e5493 Author: Harry Yoo Date: Tue Jan 27 19:31:50 2026 +0900 mm/slab: factor out slab_args_unmergeable() slab_mergeable() determines whether a slab cache can be merged, but it should not be used when the cache is not fully created yet. Extract the pre-cache-creation mergeability checks into slab_args_unmergeable(), which evaluates kmem_cache_args, slab flags, and slab_nomerge to determine if a cache will be mergeable before it is created. Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20260127103151.21883-2-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit aff8518575715b8b902d64a4ad8dfa3e33381efa Author: Vlastimil Babka Date: Fri Jan 23 07:52:43 2026 +0100 mm/slab: make caches with sheaves mergeable Before enabling sheaves for all caches (with automatically determined capacity), their enablement should no longer prevent merging of caches. Limit this merge prevention only to caches that were created with a specific sheaf capacity, by adding the SLAB_NO_MERGE flag to them. Reviewed-by: Harry Yoo Reviewed-by: Liam R. Howlett Signed-off-by: Vlastimil Babka commit 8598351edc42f38d2a1eaed9abca39c98e7b0bbf Author: Vlastimil Babka Date: Fri Jan 23 07:52:42 2026 +0100 mm/slab: move and refactor __kmem_cache_alias() Move __kmem_cache_alias() to slab_common.c since it's called by __kmem_cache_create_args() and calls find_mergeable() that both are in this file. We can remove two slab.h declarations and make them static. Instead declare sysfs_slab_alias() from slub.c so that __kmem_cache_alias() can keep calling it. Add args parameter to __kmem_cache_alias() and find_mergeable() instead of align and ctor. With that we can also move the checks for usersize and sheaf_capacity there from __kmem_cache_create_args() and make the result more symmetric with slab_unmergeable(). No functional changes intended. Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett Signed-off-by: Vlastimil Babka commit b26e52c523ea871ef1cae6e3955418cfffe2117f Author: Vlastimil Babka Date: Fri Jan 23 07:52:41 2026 +0100 slab: add SLAB_CONSISTENCY_CHECKS to SLAB_NEVER_MERGE All the debug flags prevent merging, except SLAB_CONSISTENCY_CHECKS. This is suboptimal because this flag (like any debug flags) prevents the usage of any fastpaths, and thus affect performance of any aliased cache. Also the objects from an aliased cache than the one specified for debugging could also interfere with the debugging efforts. Fix this by adding the whole SLAB_DEBUG_FLAGS collection to SLAB_NEVER_MERGE instead of individual debug flags, so it now also includes SLAB_CONSISTENCY_CHECKS. Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit f8b4cd2dad097e4ea5aed3511f42b9eb771e7b19 Author: Harry Yoo Date: Fri Jan 23 07:52:40 2026 +0100 mm/slab: fix false lockdep warning in __kfree_rcu_sheaf() kvfree_call_rcu() can be called while holding a raw_spinlock_t. Since __kfree_rcu_sheaf() may acquire a spinlock_t (which becomes a sleeping lock on PREEMPT_RT) and violate lock nesting rules, kvfree_call_rcu() bypasses the sheaves layer entirely on PREEMPT_RT. However, lockdep still complains about acquiring spinlock_t while holding raw_spinlock_t, even on !PREEMPT_RT where spinlock_t is a spinning lock. This causes a false lockdep warning [1]: ============================= [ BUG: Invalid wait context ] 6.19.0-rc6-next-20260120 #21508 Not tainted ----------------------------- migration/1/23 is trying to lock: ffff8afd01054e98 (&barn->lock){..-.}-{3:3}, at: barn_get_empty_sheaf+0x1d/0xb0 other info that might help us debug this: context-{5:5} 3 locks held by migration/1/23: #0: ffff8afd01fd89a8 (&p->pi_lock){-.-.}-{2:2}, at: __balance_push_cpu_stop+0x3f/0x200 #1: ffffffff9f15c5c8 (rcu_read_lock){....}-{1:3}, at: cpuset_cpus_allowed_fallback+0x27/0x250 #2: ffff8afd1f470be0 ((local_lock_t *)&pcs->lock){+.+.}-{3:3}, at: __kfree_rcu_sheaf+0x52/0x3d0 stack backtrace: CPU: 1 UID: 0 PID: 23 Comm: migration/1 Not tainted 6.19.0-rc6-next-20260120 #21508 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Stopper: __balance_push_cpu_stop+0x0/0x200 <- balance_push+0x118/0x170 Call Trace: __dump_stack+0x22/0x30 dump_stack_lvl+0x60/0x80 dump_stack+0x19/0x24 __lock_acquire+0xd3a/0x28e0 ? __lock_acquire+0x5a9/0x28e0 ? __lock_acquire+0x5a9/0x28e0 ? barn_get_empty_sheaf+0x1d/0xb0 lock_acquire+0xc3/0x270 ? barn_get_empty_sheaf+0x1d/0xb0 ? __kfree_rcu_sheaf+0x52/0x3d0 _raw_spin_lock_irqsave+0x47/0x70 ? barn_get_empty_sheaf+0x1d/0xb0 barn_get_empty_sheaf+0x1d/0xb0 ? __kfree_rcu_sheaf+0x52/0x3d0 __kfree_rcu_sheaf+0x19f/0x3d0 kvfree_call_rcu+0xaf/0x390 set_cpus_allowed_force+0xc8/0xf0 [...] This wasn't triggered until sheaves were enabled for all slab caches, since kfree_rcu() wasn't being called with a raw spinlock held for caches with sheaves (vma, maple node). As suggested by Vlastimil Babka, fix this by using a lockdep map with LD_WAIT_CONFIG wait type to tell lockdep that acquiring spinlock_t is valid in this case, as those spinlocks won't be used on PREEMPT_RT. Note that kfree_rcu_sheaf_map should be acquired using _try() variant, otherwise the acquisition of the lockdep map itself will trigger an invalid wait context warning. Reported-by: Paul E. McKenney Closes: https://lore.kernel.org/linux-mm/c858b9af-2510-448b-9ab3-058f7b80dd42@paulmck-laptop [1] Fixes: ec66e0d59952 ("slab: add sheaf support for batching kfree_rcu() operations") Suggested-by: Vlastimil Babka Signed-off-by: Harry Yoo Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Vlastimil Babka commit b55b423e8518361124ff0a9e15df431b3682ee4f Author: Vlastimil Babka Date: Fri Jan 23 07:52:39 2026 +0100 mm/slab: add rcu_barrier() to kvfree_rcu_barrier_on_cache() After we submit the rcu_free sheaves to call_rcu() we need to make sure the rcu callbacks complete. kvfree_rcu_barrier() does that via flush_all_rcu_sheaves() but kvfree_rcu_barrier_on_cache() doesn't. Fix that. This currently causes no issues because the caches with sheaves we have are never destroyed. The problem flagged by kernel test robot was reported for a patch that enables sheaves for (almost) all caches, and occurred only with CONFIG_KASAN. Harry Yoo found the root cause [1]: It turns out the object freed by sheaf_flush_unused() was in KASAN percpu quarantine list (confirmed by dumping the list) by the time __kmem_cache_shutdown() returns an error. Quarantined objects are supposed to be flushed by kasan_cache_shutdown(), but things go wrong if the rcu callback (rcu_free_sheaf_nobarn()) is processed after kasan_cache_shutdown() finishes. That's why rcu_barrier() in __kmem_cache_shutdown() didn't help, because it's called after kasan_cache_shutdown(). Calling rcu_barrier() in kvfree_rcu_barrier_on_cache() guarantees that it'll be added to the quarantine list before kasan_cache_shutdown() is called. So it's a valid fix! [1] https://lore.kernel.org/all/aWd6f3jERlrB5yeF@hyeyoo/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202601121442.c530bed3-lkp@intel.com Fixes: 0f35040de593 ("mm/slab: introduce kvfree_rcu_barrier_on_cache() for cache destruction") Cc: stable@vger.kernel.org Reviewed-by: Harry Yoo Tested-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett Signed-off-by: Vlastimil Babka commit b2b2ce870651db659247f34636e6243b4547e8af Author: Gary Guo Date: Fri Jan 23 17:19:41 2026 +0000 block: rnull: remove imports available via prelude These imports are already in scope by importing `kernel::prelude::*` and does not need to be imported separately. Signed-off-by: Gary Guo Acked-by: Andreas Hindborg Signed-off-by: Jens Axboe commit 96c2c72b817d70e8d110e78b0162e044a0c41f9f Author: Shuicheng Lin Date: Fri Jan 9 21:10:42 2026 +0000 drm/xe: Unregister drm device on probe error Call drm_dev_unregister() when xe_device_probe() fails after successful drm_dev_register(). This ensures the DRM device is promptly unregistered before returning an error, avoiding leaving it registered on the failure path. Otherwise, there is warn message if xe_device_probe() is called again: " [ 207.322365] [drm:drm_minor_register] [ 207.322381] debugfs: '128' already exists in 'dri' [ 207.322432] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/renderD128' [ 207.322435] CPU: 5 UID: 0 PID: 10261 Comm: modprobe Tainted: G B W 6.19.0-rc2-lgci-xe-kernel+ #223 PREEMPT(voluntary) [ 207.322439] Tainted: [B]=BAD_PAGE, [W]=WARN [ 207.322440] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023 [ 207.322441] Call Trace: [ 207.322442] [ 207.322443] dump_stack_lvl+0xa0/0xc0 [ 207.322446] dump_stack+0x10/0x20 [ 207.322448] sysfs_warn_dup+0xd5/0x110 [ 207.322451] sysfs_create_dir_ns+0x1f6/0x280 [ 207.322453] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 207.322455] ? lock_acquire+0x1a4/0x2e0 [ 207.322458] ? __kasan_check_read+0x11/0x20 [ 207.322461] kobject_add_internal+0x28d/0x8e0 [ 207.322464] kobject_add+0x11f/0x1f0 [ 207.322465] ? lock_acquire+0x1a4/0x2e0 [ 207.322467] ? __pfx_kobject_add+0x10/0x10 [ 207.322469] ? __kasan_check_write+0x14/0x20 [ 207.322471] ? kobject_put+0x62/0x4a0 [ 207.322473] ? get_device_parent.isra.0+0x1bb/0x4c0 [ 207.322475] ? kobject_put+0x62/0x4a0 [ 207.322477] device_add+0x2d7/0x1500 [ 207.322479] ? __pfx_device_add+0x10/0x10 [ 207.322481] ? drm_debugfs_add_file+0xfa/0x170 [ 207.322483] ? drm_debugfs_add_files+0x82/0xd0 [ 207.322485] ? drm_debugfs_add_files+0x82/0xd0 [ 207.322487] drm_minor_register+0x10a/0x2d0 [ 207.322489] drm_dev_register+0x143/0x860 [ 207.322491] ? xe_configfs_get_psmi_enabled+0x12/0x90 [xe] [ 207.322667] xe_device_probe+0x185b/0x2c40 [xe] [ 207.322812] ? __pfx___drm_dev_dbg+0x10/0x10 [ 207.322815] ? add_dr+0x180/0x220 [ 207.322818] ? __pfx___drmm_mutex_release+0x10/0x10 [ 207.322821] ? __pfx_xe_device_probe+0x10/0x10 [xe] [ 207.322966] ? xe_pm_init_early+0x33a/0x410 [xe] [ 207.323136] xe_pci_probe+0x936/0x1250 [xe] [ 207.323298] ? lock_acquire+0x1a4/0x2e0 [ 207.323302] ? __pfx_xe_pci_probe+0x10/0x10 [xe] [ 207.323464] local_pci_probe+0xe6/0x1a0 [ 207.323468] pci_device_probe+0x523/0x840 [ 207.323470] ? __pfx_pci_device_probe+0x10/0x10 [ 207.323473] ? sysfs_do_create_link_sd.isra.0+0x8c/0x110 [ 207.323476] ? sysfs_create_link+0x48/0xc0 [ 207.323479] really_probe+0x1fd/0x8a0 ... " Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Shuicheng Lin Reviewed-by: Jonathan Cavitt Link: https://patch.msgid.link/20260109211041.2446012-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper (cherry picked from commit 60bfb8baf8f0d5b0d521744dfd01c880ce1a23f3) Signed-off-by: Rodrigo Vivi commit d5dc831eb36cac45c072145ecc45e193737e7814 Author: Vlastimil Babka Date: Wed Jan 21 07:57:10 2026 +0100 slab: replace cache_from_obj() with inline checks Eric Dumazet has noticed cache_from_obj() is not inlined with clang and suggested splitting it into two functions, where the smaller inlined one assumes the fastpath is !CONFIG_SLAB_FREELIST_HARDENED. However most distros enable it these days and so this would likely add a function call to the object free fastpaths. Instead take a step back and consider that cache_from_obj() is a relict from when memcgs created their separate kmem_cache copies, as the outdated comment in build_detached_freelist() reminds us. Meanwhile hardening/debugging had reused cache_from_obj() to validate that the freed object really belongs to a slab from the cache we think we are freeing from. In build_detached_freelist() simply remove this, because it did not handle the NULL result from cache_from_obj() failure properly, nor validate objects (for the NULL slab->slab_cache pointer) when called via kfree_bulk(). If anyone is motivated to implement it properly, it should be possible in a similar way to kmem_cache_free(). In kmem_cache_free(), do the hardening/debugging checks directly so they are inlined by definition and virt_to_slab(obj) is performed just once. In case they failed, call a newly introduced warn_free_bad_obj() that performs the warnings outside of the fastpath, and leak the object. As an intentional change, leak the object when slab->slab_cache differs from the cache given to kmem_cache_free(). Previously we would only leak when the object is not in a valid slab page or the slab->slab_cache pointer is NULL, and otherwise trust the slab->slab_cache over the kmem_cache_free() argument. But if those differ, it means something went wrong enough that it's best not to continue freeing. As a result the fastpath should be inlined in all configs and the warnings are moved away. Reported-by: Eric Dumazet Closes: https://lore.kernel.org/all/20260115130642.3419324-1-edumazet@google.com/ Reviewed-by: Harry Yoo Reviewed-by: Hao Li Acked-by: Eric Dumazet Signed-off-by: Vlastimil Babka commit ec8534021a71ebdea2ba565a2a147f2464e36356 Author: Matthew Sakai Date: Tue Jan 27 10:50:43 2026 -0500 dm vdo encodings: clean up header and version functions Make several header functions static. Also remove vdo_is_upgradable_version, which is unused. Signed-off-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 370fdb9825f3650f05f2eed735a9086b1090920c Author: Uwe Kleine-König Date: Tue Dec 9 12:40:37 2025 +0100 spi: fsi: Convert to fsi bus probe mechanism The fsi bus got a dedicated probe function. Make use of that. This fixes a runtime warning about the driver needing to be converted to the bus probe method. Signed-off-by: Uwe Kleine-König Acked-by: Mark Brown Acked-by: Eddie James Link: https://patch.msgid.link/fc2a758ef00844dd5bd614a25b36a4a38355d12d.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 1086210a464c8775afa310209006ddc63f8ecb85 Author: Uwe Kleine-König Date: Tue Dec 9 12:40:36 2025 +0100 i2c: fsi: Convert to fsi bus probe mechanism The fsi bus got a dedicated probe function. Make use of that. This fixes a runtime warning about the driver needing to be converted to the bus probe method. Signed-off-by: Uwe Kleine-König Reviewed-by: Andi Shyti Acked-by: Eddie James Link: https://patch.msgid.link/d8c27aed45bf3119c08c9772768d675ae2ccc0c3.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 0d295b19bd1e85b6a4e0b139125f37a76ce307cc Author: Uwe Kleine-König Date: Tue Dec 9 12:40:35 2025 +0100 fsi: scom: Convert to fsi bus probe mechanism The fsi bus got a dedicated probe function. Make use of that. This fixes a runtime warning about the driver needing to be converted to the bus probe method. Signed-off-by: Uwe Kleine-König Acked-by: Eddie James Link: https://patch.msgid.link/d02a22f2f5442dc03d1d803d1b8190bc89bc71d4.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 0cf9580a3ed8ccca9590bda8a173685e73c037af Author: Uwe Kleine-König Date: Tue Dec 9 12:40:34 2025 +0100 fsi: sbefifo: Convert to fsi bus probe mechanism The fsi bus got a dedicated probe function. Make use of that. This fixes a runtime warning about the driver needing to be converted to the bus probe method. Signed-off-by: Uwe Kleine-König Acked-by: Eddie James Link: https://patch.msgid.link/79dd5a9459f0719b7602165c89eb6fc24815f3b5.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 573e29c501684e2ecb0bf0554fc7e502c654d04f Author: Uwe Kleine-König Date: Tue Dec 9 12:40:33 2025 +0100 fsi: master: Convert to fsi bus probe mechanism The fsi bus got a dedicated probe function. Make use of that. This fixes a runtime warning about the driver needing to be converted to the bus probe method. Signed-off-by: Uwe Kleine-König Acked-by: Eddie James Link: https://patch.msgid.link/17686d71b4ad3f7ebb63e92453273095a5dd09ea.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit ec93d2ea3d777d20951ac29851342e096e8d4079 Author: Uwe Kleine-König Date: Tue Dec 9 12:40:32 2025 +0100 fsi: i2cr-scom: Convert to fsi bus probe mechanism The fsi bus got a dedicated probe and remove callback. Make use of them. This fixes a runtime warning about the driver needing to be converted to the bus methods. Signed-off-by: Uwe Kleine-König Acked-by: Eddie James Link: https://patch.msgid.link/694a7d077316c3e2883a8410eade67cd578ee556.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 69d4ca009005c14068fe358196c38281ec5ee316 Author: Uwe Kleine-König Date: Tue Dec 9 12:40:31 2025 +0100 fsi: Create bus specific probe and remove functions Introduce a bus specific probe and remove function. For now this only allows to get rid of a cast of the generic device to an fsi device in the drivers and changes the remove prototype to return void---a non-zero return value is ignored anyhow. The objective is to get rid of users of struct device callbacks .probe(), .remove() and .shutdown() to eventually remove these. Until all fsi drivers are converted this results in a runtime warning about the drivers needing an update because there is a bus probe function and a driver probe function. Signed-off-by: Uwe Kleine-König Acked-by: Eddie James Link: https://patch.msgid.link/3b53adb75a5ae7894736d46cb6eb85f5ef36520e.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 68cc6588b52359ff9b48516525b463551a4bb315 Author: Uwe Kleine-König Date: Tue Dec 9 12:40:30 2025 +0100 fsi: Make fsi_bus_type a private variable to the core There are no users of fsi_bus_type outside of fsi-core.c, so make that variable static, don't export it and drop the declaration from the public header file. As there is a usage of fsi_bus_type in fsi_create_device() the definition of that variable must happen further up in the file to not have to add a local declaration. Signed-off-by: Uwe Kleine-König Acked-by: Eddie James Link: https://patch.msgid.link/bfd83034dec04d5a6b01a234988377fc6224614d.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 605fdbaec14d3b95b1ad3a3289ced24bad0f4b2c Author: Uwe Kleine-König Date: Tue Dec 9 12:40:29 2025 +0100 spi: fsi: Drop assigning fsi bus Since commit FIXME ("fsi: Assign driver's bus in fsi_driver_register()") module_fsi_driver() cares about assigning the driver's bus member. Drop the explicit driver specific assignment. Signed-off-by: Uwe Kleine-König Acked-by: Mark Brown Acked-by: Eddie James Link: https://patch.msgid.link/279e26a6740f10d119be7ea01d4af596309b3bb4.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 76497839ee0b302f923099bc23aea3d1f027913d Author: Uwe Kleine-König Date: Tue Dec 9 12:40:28 2025 +0100 i2c: fsi: Drop assigning fsi bus Since commit FIXME ("fsi: Assign driver's bus in fsi_driver_register()") module_fsi_driver() cares about assigning the driver's bus member. Drop the explicit driver specific assignment. Signed-off-by: Uwe Kleine-König Reviewed-by: Andi Shyti Acked-by: Eddie James Link: https://patch.msgid.link/8a36a0dba809d3bfe225627fd178daece10ff6a5.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 18fa479b90c29a48481ee0aae98779278c51b96b Author: Uwe Kleine-König Date: Tue Dec 9 12:40:27 2025 +0100 fsi: Provide thin wrappers around dev_[gs]et_data() for fsi devices Similar to wrappers for other subsystems provide inline functions for fsi devices to store driver data. Signed-off-by: Uwe Kleine-König Acked-by: Eddie James Link: https://patch.msgid.link/5de7a7cbb30918b3503235130bd8aa1a9a63d71c.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 03db6a80b79ba0560ef882747b9282cd4eed37e0 Author: Uwe Kleine-König Date: Tue Dec 9 12:40:26 2025 +0100 fsi: Assign driver's bus in fsi_driver_register() Instead of letting each driver assign the bus, do it once in the fsi driver register function. Simplify the fsi drivers that are living in drivers/fsi accordingly. Once all fsi drivers dropped assigning the bus, fsi_bus_type can be made a static variable. Signed-off-by: Uwe Kleine-König Acked-by: Eddie James Link: https://patch.msgid.link/54804c2cd4d84a6b5fb679831122b6acdd36b168.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 94c37d42cb7ca362aee9633bec2dbeed787edf3e Author: Uwe Kleine-König Date: Tue Dec 9 12:40:25 2025 +0100 fsi: Make use of module_fsi_driver() All other fsi drivers already use this helper to reduce boilerplate. Catch up for the last two remaining ones. Signed-off-by: Uwe Kleine-König Acked-by: Eddie James Link: https://patch.msgid.link/602437dc213cbe35ee75d0d0a4b4a2c28859e3f9.1765279318.git.u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit cac173bea57d62c599f8717fde77b7824c6021ed Author: Huisong Li Date: Tue Jan 20 19:22:58 2026 +0800 ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe() Move the acpi_processor_ffh_lpi_probe() call from acpi_processor_setup_cpuidle_dev(), where its return value is ignored, to acpi_processor_get_power_info(), which can take the return value of that function into account in a meaningful way and generally is a more suitable place for calling it. Signed-off-by: Huisong Li [ rjw: Message adjustment, subject and changelog edits ] Link: https://patch.msgid.link/20260120112258.1595164-4-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit a7a9c877ba6baa1b67e0f67858309e5aba7f9047 Author: Huisong Li Date: Tue Jan 20 19:22:57 2026 +0800 ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_dev() to void The callers of acpi_processor_setup_cpuidle_dev() ignore its return value, so convert it to a void function. No intentional functional impact. Signed-off-by: Huisong Li [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260120112258.1595164-3-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit 182422c7356d6c6a5612b5e0339da28425c0c696 Author: Huisong Li Date: Tue Jan 20 19:22:56 2026 +0800 ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_states() to void Since all callers of acpi_processor_setup_cpuidle_states() ignore its return value and it simply passes the acpi_processor_setup_lpi_states() return value to its callers, convert both of these functions to void. No intentional functional impact. Signed-off-by: Huisong Li [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260120112258.1595164-2-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit 509f403f3ccec14188036212118651bf23599396 Author: Fabio Porcedda Date: Fri Jan 23 16:19:16 2026 +0100 USB: serial: option: add Telit FN920C04 RNDIS compositions Add the following compositions: 0x10a1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=d128dba9 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10a6: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a6 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=d128dba9 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10ab: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10ab Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=d128dba9 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org Signed-off-by: Fabio Porcedda Signed-off-by: Johan Hovold commit 3df1fd31f6fcf0ed87093bca510e38f2d643036f Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:49:23 2026 +0000 gpib: tnt4882: Unify *allocate_private usage Use the return value of tnt4882_allocate_private in calling code as early return value in case of error. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-28-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 9effb86530ee61fe953a8a5d2c052fdc01c5d755 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:49:19 2026 +0000 gpib: tnt4882: Unify *allocate_private return value Return -ENOMEM instead of -1 in tnt4882_allocate_private in case of memory allocation failure. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-27-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit a16ad9b68b10858fb69273ce2d01b03a930c180c Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:49:16 2026 +0000 gpib: tnt4882: Replace kmalloc/memset to kzalloc in *allocate_private Replace kmalloc/memset pair to kzalloc in tnt4882_allocate_private. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-26-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit c2a9f77c0e03622880405f5699010b4835d2d619 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:49:13 2026 +0000 gpib: pc2: Unify *allocate_private usage Use the return value of allocate_private in calling code as early return value in case of error. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-25-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 68de22e9947c87a39557376260d35c81e63d6c01 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:49:09 2026 +0000 gpib: pc2: Unify *allocate_private return value Return -ENOMEM instead of -1 in allocate_private in case of memory allocation failure. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-24-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 6e6dc3f7c08f17b2b146eeb49fc674fac8bc3b10 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:49:03 2026 +0000 gpib: pc2: Replace kmalloc/memset to kzalloc in *allocate_private Replace kmalloc/memset pair to kzalloc in allocate_private. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-23-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 78047416f80007b25062bd4791d98e24c0aaa687 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:59 2026 +0000 gpib: ni_usb: Fix the *allocate_private retval check Change if (retval < 0) return retval; into if (retval) return retval; as it is more fitting in this case. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-22-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 64900aa878fc6a5f2a017374f869890749c9382e Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:56 2026 +0000 gpib: ni_usb: Replace kmalloc/memset to kzalloc in *allocate_private Replace kmalloc/memset pair to kzalloc in ni_usb_allocate_private. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-21-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 11f1b16916222993cf54011541b12c80e6c909aa Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:51 2026 +0000 gpib: ines: Unify *allocate_private usage Use the return value of ines_allocate_private in calling code as early return value in case of error. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-20-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 24d4d06acb6f1433bfe814b40312e3d2d385a3b0 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:45 2026 +0000 gpib: ines: Unify *allocate_private return value Return -ENOMEM instead of -1 in ines_allocate_private in case of memory allocation failure. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-19-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit b3d3ab10b9b3919f4fd62b8eef4546e24f2d7bd2 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:39 2026 +0000 gpib: ines: Replace kmalloc/memset to kzalloc in *allocate_private Replace kmalloc/memset pair to kzalloc in ines_allocate_private. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-18-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 3f5d83160037ac9a055b8375f717a206497b847f Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:35 2026 +0000 gpib: hp_82341: Unify *allocate_private usage Use the return value of hp_82341_allocate_private in calling code as early return value in case of error. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-17-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit c0790b6c901e6f33aa7a6d6373bf77912fa75865 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:32 2026 +0000 gpib: hp_82335: Unify *allocate_private usage Use the return value of hp82335_allocate_private in calling code as early return value in case of error. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-16-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 0a1e9b99d83ae34955c909e3c5ffbaf3ad3028a5 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:28 2026 +0000 gpib: hp_82335: Unify *allocate_private return value Return -ENOMEM instead of -1 in hp82335_allocate_private in case of memory allocation failure. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-15-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 1dd1bc4d79431e3cb0b8581882bd4afa57443d12 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:24 2026 +0000 gpib: gpio: Unify *allocate_private usage Use the return value of allocate_private in calling code as early return value in case of error. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-14-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit ad161c8b12100cbe80980be03e03d324f7d45fc7 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:19 2026 +0000 gpib: gpio: Unify *allocate_private return value Return -ENOMEM instead of -1 in allocate_private in case of memory allocation failure. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-13-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit c47b98c47612a9fbe25d7331235b17a195e79f98 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:14 2026 +0000 gpib: fmh_gpib: Fix the *allocate_private retval check Change if (retval < 0) return retval; into if (retval) return retval; as it is more fitting in this case. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-12-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 578481c343fabbf8514ab866e5511b7685fdad93 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:09 2026 +0000 gpib: fmh_gpib: Replace kmalloc/memset to kzalloc in *allocate_private Replace kmalloc/memset pair to kzalloc in fmh_gpib_allocate_private. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-11-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit f9d2893ff9e8871bac046c569a794f47fba3bae4 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:05 2026 +0000 gpib: eastwood: Fix the *allocate_private retval check Change if (retval < 0) return retval; into if (retval) return retval; as it is more fitting in this case. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-10-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 59e2e6b5620f689ebc9967dda744d5f1d90180b1 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:03 2026 +0000 gpib: eastwood: Replace kmalloc/memset to kzalloc in *allocate_private Replace kmalloc/memset pair to kzalloc in fluke_allocate_private. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-9-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 908206d82e45f190d44ac6cdee70cd7676c757a1 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:48:00 2026 +0000 gpib: cec: Unify *allocate_private usage Use the return value of cec_allocate_private in calling code as early return value in case of error. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-8-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit b47077a4c03e50b14a03633773bf549cb2f0a38f Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:47:54 2026 +0000 gpib: cec: Unify *allocate_private return value Return -ENOMEM instead of -1 in cec_allocate_private in case of memory allocation failure. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-7-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 258dd4c7ddee78128f3229936044f8bdea8e2f08 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:47:49 2026 +0000 gpib: cec: Replace kmalloc/memset to kzalloc in *allocate_private Replace kmalloc/memset pair to kzalloc in cec_allocate_private. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-6-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 0ea001af4e169ff026c331b9e6eeb5cc09c07c3a Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:47:44 2026 +0000 gpib: cb7210: Unify *allocate_private usage Use the return value of cb7210_allocate_private in calling code as early return value in case of error. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-5-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 1ec138c8db699c5af354e230fbd73ab0aa3bbb72 Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:47:39 2026 +0000 gpib: cb7210: Replace kmalloc/memset to kzalloc in *allocate_private Replace kmalloc/memset pair to kzalloc in cb7210_allocate_private. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-4-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit 048b9f44350a7fd1e73cd22f5d1f00cc208609fe Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:47:35 2026 +0000 gpib: agilent_82357a: Fix the *allocate_private retval check Change if (retval < 0) return retval; into if (retval) return retval; as it is more fitting in this case. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-3-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit c9627831fb60300e4fe46467e8c36379c7c3313a Author: Dominik Karol Piątkowski Date: Fri Jan 16 17:47:30 2026 +0000 gpib: agilent_82350b: Unify *allocate_private usage Use the return value of agilent_82350b_allocate_private in calling code as early return value in case of error. Signed-off-by: Dominik Karol Piątkowski Link: https://patch.msgid.link/20260116174647.317256-2-dominik.karol.piatkowski@protonmail.com Signed-off-by: Greg Kroah-Hartman commit c86d39d6805474ab879c00ca6b938c6dd7e4d33f Author: Tim Bird Date: Sat Jan 17 13:00:38 2026 -0700 kernel: debug: Add SPDX license ids to kdb files Add GPL-2.0 license id to some files related to kdb and kgdb, replacing references to GPL or COPYING. These files were introduced into the kernel in 2008 and 2010. Signed-off-by: Tim Bird Signed-off-by: Greg Kroah-Hartman commit 62bb2054f9e84ec89c416d4558dbd574c54beddf Author: Patrick Wicki Date: Tue Jan 20 14:06:03 2026 +0100 eeprom: at25: expose JEDEC ID via sysfs Return the raw JEDEC ID bytes as returned by the RDID command, even for variations that have the bytes in reverse order. This way we can avoid ambiguity if the manufacturer ever releases a new chip that returns them according to standard. Signed-off-by: Patrick Wicki Reviewed-by: Alexander Sverdlin Tested-by: Alexander Sverdlin Link: https://patch.msgid.link/20260120130603.1066559-2-patrick@subset.ch Signed-off-by: Greg Kroah-Hartman commit 3fcd9a0fbb7dfbad3caa5057054d21b903157079 Author: Patrick Wicki Date: Tue Jan 20 14:06:02 2026 +0100 eeprom: at25: add support for Infineon Cypress QSN FRAMs Add support for Infineon Cypress CY15****QSN FRAM chips. Unlike the QN variants these chips have an 8 byte JEDEC ID. The layout of the serial number matches that of already supported chips like the CY15B204QN, so make the read-out unconditional. Tested with the CY15B204QSN. According to Infineon datasheets, all QSN variants appear to share a consistent pattern so the size should be correctly detected based on the density bits in the ID: CY15B201QSN: 0x00 00 00 00 06 82 54 40, density_id: 8: 1Mb CY15B102QSN: 0x00 00 00 00 06 82 51 48, density_id: 9: 2Mb CY15B204QSN: 0x00 00 00 00 06 82 54 50, density_id: 10: 4Mb CY15V108QSN: 0x00 00 00 00 06 82 52 58, density_id: 11: 8Mb Signed-off-by: Patrick Wicki Reviewed-by: Alexander Sverdlin Tested-by: Alexander Sverdlin Link: https://patch.msgid.link/20260120130603.1066559-1-patrick@subset.ch Signed-off-by: Greg Kroah-Hartman commit 79cb49ebb43ec39b4d9156e069fcc745ecbeedd0 Author: Henry Zhang Date: Mon Jan 26 15:17:07 2026 -0500 speakup: Clarify bleep_time unit is milliseconds The documentation had a TODO questioning whether the unit was in jiffies. The implementation in drivers/accessibility/speakup/main.c passes spk_bleep_time to msecs_to_jiffies(), confirming the unit is in milliseconds. Signed-off-by: Henry Zhang Reviewed-by: Samuel Thibault Link: https://patch.msgid.link/20260126201707.1297665-1-zeri@umich.edu Signed-off-by: Greg Kroah-Hartman commit 0bb23328ab6cab866eb096ae3714a295c6f67c0f Author: Ethan Nelson-Moore Date: Thu Jan 22 19:55:47 2026 -0800 pps: generators: remove broken pps_gen_parport driver This driver was introduced in January 2011 and has been marked BROKEN for almost its entire existence, since commit 95b90afec301 ("pps: make pps_gen_parport depend on BROKEN") in March 2011. It is unlikely anyone will fix the driver at this point. Signed-off-by: Ethan Nelson-Moore Acked-by: Rodolfo Giometti Link: https://patch.msgid.link/20260123035607.22340-1-enelsonmoore@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1814159b0d0a21bb05ab7b62d2defadfad84ef68 Author: Pawel Chmielewski Date: Fri Jan 16 18:52:50 2026 +0100 intel_th: pci: Add Nova Lake support Add support for the Trace Hub in Nova Lake-P/H/S and PCH. Signed-off-by: Pawel Chmielewski Reviewed-by: Alan Borzeszkowski Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Shishkin Link: https://patch.msgid.link/20260116175250.821002-3-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 89b0bb232a4c71eeb18f75bfd7aa1ae850025c87 Author: Pawel Chmielewski Date: Fri Jan 16 18:52:49 2026 +0100 intel_th: pci: Use PCI_DEVICE_DATA() for device entries Switch PCI_DEVICE() macro to PCI_DEVICE_DATA() to reduce the number of lines. Add a new header file for the defined names of the devices. Sort the entries in ascending order. Signed-off-by: Pawel Chmielewski Reviewed-by: Alan Borzeszkowski Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Shishkin Link: https://patch.msgid.link/20260116175250.821002-2-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit bc2e4bc952e26dd93b978588219044bd8b24237b Author: Jose Javier Rodriguez Barbarin Date: Fri Jan 16 12:21:41 2026 +0100 mcb: fix incorrect sanity check __mcb_register_driver() makes some sanity checks over mcb_driver to check if .probe and .remove callbacks are set. However, since commit 3bd13ae04ccc ("gpio: menz127: simplify error path and remove remove()") removed the .remove callback from menz127-gpio.c, not all mcb device drivers implement .remove callback. Remove .remove check to ensure all mcb device drivers can be loaded. Signed-off-by: Jose Javier Rodriguez Barbarin Fixes: 3bd13ae04ccc ("gpio: menz127: simplify error path and remove remove()") [ jth: added statement about menz127-gpio.c ] Signed-off-by: Johannes Thumshirn Link: https://patch.msgid.link/16fb55bd59d9c1d2ce2443f41d4dec2048f9a8ec.1768562302.git.jth@kernel.org Signed-off-by: Greg Kroah-Hartman commit be0801e530f76890ffa7cf35f58c327b55f972dd Author: Krzysztof Kozlowski Date: Fri Jan 16 17:09:42 2026 +0000 slimbus: qcom-ngd: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260116170942.733674-1-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2c198c272f9c9213b0fdf6b4a879f445c574f416 Author: Johan Hovold Date: Fri Jan 16 17:29:50 2026 +0100 most: core: fix leak on early registration failure A recent commit fixed a resource leak on early registration failures but for some reason left out the first error path which still leaks the resources associated with the interface. Fix up also the first error path so that the interface is always released on errors. Fixes: 1f4c9d8a1021 ("most: core: fix resource leak in most_register_interface error paths") Fixes: 723de0f9171e ("staging: most: remove device from interface structure") Cc: Christian Gromm Cc: Navaneeth K Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260116162950.21578-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0a06917432a762d6233f88963c0b53e48dbac6b4 Author: Prashanth K Date: Thu Jan 22 16:20:00 2026 +0530 usb: dwc3: Log dwc3 address in traces When multiple DWC3 controllers are being used, trace events from different instances get mixed up making debugging difficult as there's no way to distinguish which instance generated the trace. Use the register base address of dwc3 controller and append it to trace events, so that the source instance is clearly identifiable. Example trace output, before -> dwc3_event: event (00000101): Reset [U0] after -> dwc3_event: 0x000000000a600000: event (00000101): Reset [U0] Signed-off-by: Prashanth K Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260122105000.4126769-1-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 1132e90840abf3e7db11f1d28199e9fbc0b0e69e Author: Haotien Hsu Date: Sat Jan 24 01:31:21 2026 +0800 usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN The COREPLL_PWRDN bit in the BLCG register must be set when the XUSB device controller is powergated and cleared when it is unpowergated. If this bit is not explicitly controlled, the core PLL may remain in an incorrect power state across suspend/resume or ELPG transitions. Therefore, update the driver to explicitly control this bit during powergate transitions. Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller") Cc: stable Signed-off-by: Haotien Hsu Signed-off-by: Wayne Chang Link: https://patch.msgid.link/20260123173121.4093902-1-waynec@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 1d264b88aea94c41470fb3e02caf068053396c73 Author: Ethan Tidmore Date: Mon Jan 26 19:21:18 2026 -0600 staging: rtl8723bs: remove unused variable RFE_Type The variable RFE_Type is initialized but never read or used anywhere in the driver. Remove it to clean up dead code and fix a CamelCase warning. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260127012118.43037-9-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit c003c3789876fc8edcc4014eaf011fca6c8de986 Author: Ethan Tidmore Date: Mon Jan 26 19:21:17 2026 -0600 staging: rtl8723bs: remove unused variable bEn_RFE The variable bEn_RFE is initialized but never read or used anywhere in the driver. Remove it to clean up dead code and fix a CamelCase warning. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260127012118.43037-8-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 88773d6b322539b8fe7417418cb26ef056c3b207 Author: Ethan Tidmore Date: Mon Jan 26 19:21:16 2026 -0600 staging: rtl8723bs: remove unused variable AmplifierType_2G The variable AmplifierType_2G is declared in struct registry_priv but is never initialized or used within the driver. Remove it to clean up the code and fix a CamelCase warning. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260127012118.43037-7-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6af021ad7b19eb5e90724d56481ff4a3c6804094 Author: Ethan Tidmore Date: Mon Jan 26 19:21:15 2026 -0600 staging: rtl8723bs: remove unused variable TxBBSwing_2G The variable TxBBSwing_2G is initialized but never read or used anywhere in the driver. Remove it to clean up dead code and fix a CamelCase warning. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260127012118.43037-6-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7c347fbe211391808a947fca28a6a9af1914e443 Author: Ethan Tidmore Date: Mon Jan 26 19:21:14 2026 -0600 staging: rtl8723bs: rename RegPwrTblSel to reg_pwr_tbl_sel Rename RegPwrTblSel to reg_pwr_tbl_sel to avoid CamelCase. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260127012118.43037-5-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 43e165f7e0238c8f0bbb6f17a56e12e0143224b6 Author: Ethan Tidmore Date: Mon Jan 26 19:21:13 2026 -0600 staging: rtl8723bs: rename RegPowerBase to reg_power_base Rename RegPowerBase to reg_power_base to avoid CamelCase. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260127012118.43037-4-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit a3f440616a4236b6830427c4948f0b096ba102f5 Author: Ethan Tidmore Date: Mon Jan 26 19:21:12 2026 -0600 staging: rtl8723bs: rename RegEnableTxPowerByRate to reg_enable_tx_power_by_rate Rename RegEnableTxPowerByRate to reg_enable_tx_power_by_rate to avoid CamelCase. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260127012118.43037-3-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 00883ce1d48a8aecc6573d05ce8a44d4686948a9 Author: Ethan Tidmore Date: Mon Jan 26 19:21:11 2026 -0600 staging: rtl8723bs: rename RegEnableTxPowerLimit to reg_enable_tx_power_limit Rename RegEnableTxPowerLimit to reg_enable_tx_power_limit to avoid CamelCase. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260127012118.43037-2-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit cc34db609ff98c1d9709c3d48fa4f98450fab739 Author: Madhumitha Sundar Date: Tue Jan 27 12:11:48 2026 +0000 staging: sm750fb: rename initParm to init_parm The Linux kernel coding style prefers snake_case over CamelCase for variable names. Rename the 'initParm' member to 'init_parm' to comply with this standard. Signed-off-by: Madhumitha Sundar Link: https://patch.msgid.link/20260127121148.36632-1-madhuananda18@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2c1312898d0362c9b1fb5d42e049f3b12bb1cf54 Author: Michael Huang Date: Mon Jan 26 04:09:07 2026 -0800 staging: rtl8723bs: remove unnecessary boolean comparisons Remove explicit comparisons to true/false in boolean expressions to improve code readability and follow standard Linux kernel coding style. Signed-off-by: Michael Huang Link: https://patch.msgid.link/20260126120908.19563-1-tehsiu.huang@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6007fd46039d56a67024f92fffa262418509ce73 Author: Michael Huang Date: Sat Jan 24 15:15:57 2026 -0800 staging: rtl8723bs: use !ptr instead of ptr == NULL Simplify pointer null checks by using the "!ptr" convention instead of the more verbose "ptr == NULL" comparison. Signed-off-by: Michael Huang Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260124231557.18189-8-tehsiu.huang@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5747a86451836bbcd70b6ab61d7272d013690ff8 Author: Michael Huang Date: Sat Jan 24 15:15:56 2026 -0800 staging: rtl8723bs: remove unnecessary braces Remove braces from single-line conditional statements. Signed-off-by: Michael Huang Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260124231557.18189-7-tehsiu.huang@gmail.com Signed-off-by: Greg Kroah-Hartman commit d583b26c9e214baba6e6ec08dc2d00b950a2e46c Author: Michael Huang Date: Sat Jan 24 15:15:55 2026 -0800 staging: rtl8723bs: add missing space around operators Add required spaces around logical and assignment operators. Signed-off-by: Michael Huang Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260124231557.18189-6-tehsiu.huang@gmail.com Signed-off-by: Greg Kroah-Hartman commit 376208a26266de99383dd5476c9256721549c89a Author: Michael Huang Date: Sat Jan 24 15:15:54 2026 -0800 staging: rtl8723bs: Fix the line length exceeding 100 columns warning in the code Split lines that exceed the 100-character limit into multiple lines. This resolves checkpatch.pl warnings and improves the visual layout of the source code. Signed-off-by: Michael Huang Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260124231557.18189-5-tehsiu.huang@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7d57d549f3a37d48211bd3a043513eb06a401b9a Author: Michael Huang Date: Sat Jan 24 15:15:53 2026 -0800 staging: rtl8723bs: remove unnecessary new lines Removed the unnecessary new lines Signed-off-by: Michael Huang Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260124231557.18189-4-tehsiu.huang@gmail.com Signed-off-by: Greg Kroah-Hartman commit 34cce33793552d9ce67d6025f0bcc83b94e08565 Author: Michael Huang Date: Sat Jan 24 15:15:52 2026 -0800 staging: rtl8723bs: refactor comments to fix the line length warning for exceeding 100 columns Adjust the positioning and formatting of comments to align with the flattened code structure. This ensures comments remain relevant and clear following the logic refactoring. Signed-off-by: Michael Huang Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260124231557.18189-3-tehsiu.huang@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5b4e1312202914e70942e9a5f8b707ff938da8c8 Author: Michael Huang Date: Sat Jan 24 15:15:51 2026 -0800 staging: rtl8723bs: use continue statements to reduce indentation Refactor nested if-statements using "continue" statements. This flattens the logic, reduces deep indentation, and improves overall code readability. Signed-off-by: Michael Huang Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260124231557.18189-2-tehsiu.huang@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6905c31e2112f212f81613127bc9802851337a19 Author: Omer El Idrissi Date: Sun Jan 25 19:59:55 2026 +0100 staging: rtl8723bs: replace uint with unsigned int Replace non-standard uint type with explicit unsigned int to improve readability and conform to kernel coding style. Signed-off-by: Omer El Idrissi Link: https://patch.msgid.link/20260125185956.13882-1-omer.e.idrissi@gmail.com Signed-off-by: Greg Kroah-Hartman commit d85bef1599237298176c9fddfc250cc9ca92ec78 Author: Archit Anant Date: Sat Jan 24 23:11:49 2026 +0530 staging: greybus: remove completed GPIO conversion task from TODO The task to convert the Greybus subsystem to the GPIO descriptor interface has been completed. A grep of the directory confirms that no consumer drivers include or use the legacy integer based GPIO API (gpio_request, gpio_set_value, etc). Remove the stale entry from the TODO file. Signed-off-by: Archit Anant Link: https://patch.msgid.link/20260124174149.10314-1-architanant5@gmail.com Signed-off-by: Greg Kroah-Hartman commit 381a175bd1997f706b8279f2fc64ab9099db6969 Author: Ethan Tidmore Date: Fri Jan 23 19:33:50 2026 -0600 staging: rtl8723bs: rename add_RATid to add_ratid Rename add_RATid to add_ratid to align with kernel code style. Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260124013350.33769-1-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit 72000df579c7434b0e37b81a131328b0bafd0c86 Author: Geet Singhi Date: Sat Jan 24 02:29:05 2026 +0530 staging: axis-fifo: Fix indentation Check reported by checkpatch.pl CHECK: Alignment should match open parenthesis Signed-off-by: Geet Singhi Link: https://patch.msgid.link/20260123205905.37717-1-singhigeet1729@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3a0b68e30194e1a064fde8d7451fa90b4609d3ce Author: Ethan Tidmore Date: Fri Jan 23 13:11:50 2026 -0600 staging: most: dim2: replace macro with static function Replace unsafe macro with function to avoid side effects. Signed-off-by: Ethan Tidmore Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20260123191150.3281-1-ethantidmore06@gmail.com Signed-off-by: Greg Kroah-Hartman commit d15b4527e87c019b1743c014b2f668e4c7bfd3a5 Author: Archit Anant Date: Fri Jan 16 21:27:50 2026 +0530 staging: rtl8723bs: fix alignment to match open parenthesis Align arguments and conditions with the open parenthesis of the preceding line to comply with the Linux kernel coding style. Issue identified by checkpatch.pl. Signed-off-by: Archit Anant Link: https://patch.msgid.link/20260116155750.3173-3-architanant5@gmail.com Signed-off-by: Greg Kroah-Hartman commit d847f2e128c0da0944755175bd15a25408a03d59 Author: Archit Anant Date: Fri Jan 16 21:27:49 2026 +0530 staging: rtl8723bs: fix spacing around operators Add missing spaces around mathematical and logical operators (+, -, /, |, ?, :) and remove multiple spaces around operators to comply with the Linux kernel coding style. Issue identified by checkpatch.pl and review feedback. Signed-off-by: Archit Anant Link: https://patch.msgid.link/20260116155750.3173-2-architanant5@gmail.com Signed-off-by: Greg Kroah-Hartman commit 05bff3419adaa272713be4c07d287756a4b2c5f5 Author: Lorenzo Pieralisi Date: Thu Jan 15 10:50:52 2026 +0100 irqchip/gic-v5: Add ACPI IWB probing To probe an IWB in an ACPI based system it is required: - to implement the IORT functions handling the IWB IORT node and create functions to retrieve IWB firmware information - to augment the driver to match the DSDT ACPI "ARMH0003" device and retrieve the IWB wire and trigger mask from the GSI interrupt descriptor in the IWB msi_domain_ops.msi_translate() function Make the required driver changes to enable IWB probing in ACPI systems. The GICv5 GSI format requires special handling for IWB routed IRQs. Add IWB GSI detection to the top level driver gic_v5_get_gsi_domain_id() function so that the correct IRQ domain for a GSI can be detected by parsing the GSI and check whether it is an IWB-backed IRQ or not. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20260115-gicv5-host-acpi-v3-6-c13a9a150388@kernel.org Signed-off-by: Rafael J. Wysocki commit a97efa5ba594642b86fb6702f38ed0d18e3b0269 Author: Lorenzo Pieralisi Date: Thu Jan 15 10:50:51 2026 +0100 irqchip/gic-v5: Add ACPI ITS probing On ACPI ARM64 systems the GICv5 ITS configuration and translate frames are described in the MADT table. Refactor the current GICv5 ITS driver code to share common functions between ACPI and OF and implement ACPI probing in the GICv5 ITS driver. Add iort_msi_xlate() to map a device ID and retrieve an MSI controller fwnode node for ACPI systems and update pci_msi_map_rid_ctlr_node() to use it in its ACPI code path. Add the required functions to IORT code for deviceID retrieval and IRQ domain registration and look-up so that the GICv5 ITS driver in an ACPI based system can be successfully probed. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20260115-gicv5-host-acpi-v3-5-c13a9a150388@kernel.org Signed-off-by: Rafael J. Wysocki commit 35866efa52feaf48cc54a0745851a555654e1446 Author: Lorenzo Pieralisi Date: Thu Jan 15 10:50:50 2026 +0100 irqchip/gic-v5: Add ACPI IRS probing On ARM64 ACPI systems GICv5 IRSes are described in MADT sub-entries. Add the required plumbing to parse MADT IRS firmware table entries and probe the IRS components in ACPI. Augment the irqdomain_ops.translate() for PPI and SPI IRQs in order to provide support for their ACPI based firmware translation. Implement an irqchip ACPI based callback to initialize the global GSI domain upon an MADT IRS detection. The IRQCHIP_ACPI_DECLARE() entry in the top level GICv5 driver is only used to trigger the IRS probing (ie the global GSI domain is initialized once on the first call on multi-IRS systems); IRS probing takes place by calling acpi_table_parse_madt() in the IRS sub-driver, that probes all IRSes in sequence. Add a new ACPI interrupt model so that it can be detected at runtime and distinguished from previous GIC architecture models. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20260115-gicv5-host-acpi-v3-4-c13a9a150388@kernel.org Signed-off-by: Rafael J. Wysocki commit 1c406fcdf0b0b8d99b69b382252207fafc0529d7 Author: Lorenzo Pieralisi Date: Thu Jan 15 10:50:49 2026 +0100 irqchip/gic-v5: Split IRS probing into OF and generic portions Split the IRS driver code into OF specific and generic portions in order to pave the way for adding ACPI firmware bindings support. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20260115-gicv5-host-acpi-v3-3-c13a9a150388@kernel.org Signed-off-by: Rafael J. Wysocki commit a08df2fbba47be20b5769b054d9a19ddee567bdc Author: Lorenzo Pieralisi Date: Thu Jan 15 10:50:48 2026 +0100 PCI/MSI: Make the pci_msi_map_rid_ctlr_node() interface firmware agnostic To support booting with OF and ACPI seamlessly, GIC ITS parent code requires the PCI/MSI irqdomain layer to implement a function to retrieve an MSI controller fwnode and map an RID in a firmware agnostic way (ie pci_msi_map_rid_ctlr_node()). Convert pci_msi_map_rid_ctlr_node() to an OF agnostic interface (fwnode_handle based) and update the GIC ITS MSI parent code to reflect the pci_msi_map_rid_ctlr_node() change. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Acked-by: Bjorn Helgaas Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20260115-gicv5-host-acpi-v3-2-c13a9a150388@kernel.org Signed-off-by: Rafael J. Wysocki commit 0323897a88afd4ddb3d44cd6b1b33ccd6a4b76cb Author: Lorenzo Pieralisi Date: Thu Jan 15 10:50:47 2026 +0100 irqdomain: Add parent field to struct irqchip_fwid The GICv5 driver IRQ domain hierarchy requires adding a parent field to struct irqchip_fwid so that core code can reference a fwnode_handle parent for a given fwnode. Add a parent field to struct irqchip_fwid and update the related kernel API functions to initialize and handle it. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20260115-gicv5-host-acpi-v3-1-c13a9a150388@kernel.org Signed-off-by: Rafael J. Wysocki commit 8d9ad85dbf9bfe7f12e548e8f749b4c058d60bd1 Merge: 63804fed149a67 e8f614dabd2238 Author: Rafael J. Wysocki Date: Tue Jan 27 15:30:26 2026 +0100 Merge ACPICA material for 6.20 to satisfy dependencies commit a01745ccf7c41043c503546cae7ba7b0ff499d38 Author: Konstantin Taranov Date: Tue Jan 27 00:26:49 2026 -0800 RDMA/mana_ib: Add device‑memory support Introduce a basic DM implementation that enables creating and registering device memory, and using the associated memory keys for networking operations. Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/20260127082649.429018-1-kotaranov@linux.microsoft.com Signed-off-by: Leon Romanovsky commit 28e505d81766dcbe25c60d57ab9fc941cd3d38bf Author: Sascha Bischoff Date: Mon Dec 8 15:28:23 2025 +0000 KVM: arm64: Correct test for ICH_HCR_EL2_TDIR cap for GICv5 hosts The original order of checks in the ICH_HCR_EL2_TDIR test returned with false early in the case where the native GICv3 CPUIF was not present. The result was that on GICv5 hosts with legacy support - which do not have the GICv3 CPUIF - the test always returned false. Reshuffle the checks such that support for GICv5 legacy is checked prior to checking for the native GICv3 CPUIF. Signed-off-by: Sascha Bischoff Fixes: 2a28810cbb8b2 ("KVM: arm64: GICv3: Detect and work around the lack of ICV_DIR_EL1 trapping") Link: https://patch.msgid.link/20251208152724.3637157-4-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit da63758c1876d899031066a9d4b8050af767ceb8 Author: Sascha Bischoff Date: Mon Dec 8 15:28:22 2025 +0000 KVM: arm64: gic: Enable GICv3 CPUIF trapping on GICv5 hosts if required Factor out the enable (and printing of) the GICv3 CPUIF traps from the main GICv3 probe into a separate function. Call said function from the GICv5 probe for legacy support, ensuring that any required GICv3 CPUIF traps on GICv5 hosts will be correctly handled, rather than injecting an undef into the guest. Signed-off-by: Sascha Bischoff Link: https://patch.msgid.link/20251208152724.3637157-3-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit a18056a6c11cab562a77d16b5931f6fdf55e7ec9 Author: Eric Dumazet Date: Fri Jan 23 11:16:05 2026 +0000 tcp: move sk_forced_mem_schedule() to tcp.c TCP fast path can (auto)inline this helper, instead of (auto)inling it from tcp_send_fin(). No change of overall code size, but tcp_sendmsg() is faster. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 1/1 up/down: 141/-140 (1) Function old new delta tcp_stream_alloc_skb 216 357 +141 tcp_send_fin 688 548 -140 Total: Before=22236729, After=22236730, chg +0.00% BTW, we might change tcp_send_fin() to use tcp_stream_alloc_skb(). Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260123111605.4089200-1-edumazet@google.com Signed-off-by: Paolo Abeni commit e121ed77c1451b8594c991ddc8e23252c254d627 Merge: 63804fed149a67 0b7277e02dabba Author: Rafael J. Wysocki Date: Tue Jan 27 14:48:00 2026 +0100 Merge tag 'opp-updates-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull OPP updates for 7.0 from Viresh Kumar: "- Return correct value in dev_pm_opp_get_level (Aleks Todorov). - Use scoped for each OF child loop (Krzysztof Kozlowski)." * tag 'opp-updates-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: OPP: Return correct value in dev_pm_opp_get_level OPP: of: Simplify with scoped for each OF child loop commit b753c3204d7b0e9bef956b64425709a9c40246fe Merge: 39385cbd4222fa 0b7fbf9333fa46 Author: Rafael J. Wysocki Date: Tue Jan 27 14:46:28 2026 +0100 Merge tag 'cpufreq-arm-updates-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull CPUFreq Arm updates for 7.0 from Viresh Kumar: "- Update cpufreq-dt-platdev list for tegra, qcom, TI (Aaron Kling, Dhruva Gole, and Konrad Dybcio). - Minor improvements to the cpufreq / cpumask rust implementation (Alexandre Courbot, Alice Ryhl, Tamir Duberstein, and Yilin Chen). - Add support for AM62L3 SoC to ti-cpufreq driver (Dhruva Gole). - Update FIE arch_freq_scale in ticks for non-PCC regs (Jie Zhan). - Other minor cleanups / improvements (Felix Gu, Juan Martinez, Luca Weiss, and Sergey Shtylyov)." * tag 'cpufreq-arm-updates-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() cpufreq: ti-cpufreq: add support for AM62L3 SoC cpufreq: dt-platdev: Add ti,am62l3 to blocklist cpufreq/amd-pstate: Add comment explaining nominal_perf usage for performance policy cpufreq: scmi: correct SCMI explanation cpufreq: dt-platdev: Block the driver from probing on more QC platforms rust: cpumask: rename methods of Cpumask for clarity and consistency cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs cpufreq: CPPC: Factor out cppc_fie_kworker_init() ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() rust: cpufreq: replace `kernel::c_str!` with C-Strings cpufreq: Add Tegra186 and Tegra194 to cpufreq-dt-platdev blocklist dt-bindings: cpufreq: qcom-hw: document Milos CPUFREQ Hardware rust: cpufreq: add __rust_helper to helpers rust: cpufreq: always inline functions using build_assert with arguments commit 39385cbd4222fa37ac320c6368bf9d8a60fd47ef Merge: 1730daa3b425ea 80b49829ba1776 Author: Rafael J. Wysocki Date: Tue Jan 27 14:45:19 2026 +0100 Merge back earlier cpufreq material for 6.20 commit 0a15f43b92ddaa2fdb476891a12ac2e207c7fcd2 Author: Greg Kroah-Hartman Date: Tue Jan 27 13:58:21 2026 +0100 Revert "tty: tty_port: add workqueue to flip TTY buffer" This reverts commit d000422a46aad32217cf1be747eb61d641baae2f. It is reported by many to cause boot failures, so must be reverted. Cc: Xin Zhao Cc: Jiri Slaby Link: https://lore.kernel.org/r/d1942304-ee30-478d-90fb-279519f3ae81@samsung.com Reported-by: Marek Szyprowski Reported-by: Tommaso Merciai Reported-by: Geert Uytterhoeven Signed-off-by: Greg Kroah-Hartman commit c30e188bd2a886258be5facb970a804d8ef549b5 Merge: a410d3fb30d920 66af8ac52d10ea Author: Johannes Berg Date: Tue Jan 27 13:53:53 2026 +0100 Merge tag 'iwlwifi-next-2026-01-21' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi features. Notably: - Partial NAN support - without DATA - Initial UHR support - UNII-9 support - EHT code cleanup in iwlmvm ==================== Signed-off-by: Johannes Berg commit a410d3fb30d920f26b1fd1604db13f4213144bc1 Merge: e31fa691d0b1c0 d8e1f4a193101a Author: Johannes Berg Date: Tue Jan 27 13:52:23 2026 +0100 Merge tag 'ath-next-20260120' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.20 (#2) Highlights for some specific drivers include: ath11k: Add support for Channel Frequency Response measurement. ath12k: Add support for the QCC2072 chipset. And of course there is the usual set of cleanups and bug fixes across the entire family of "ath" drivers. ================== Signed-off-by: Johannes Berg commit b3eb755e2db07d85c30e8ff4043ffb9a14b4ece7 Author: Anton D. Stavinskii Date: Tue Jan 20 23:06:07 2026 +0400 ASoC: sophgo: add CV1800B internal DAC codec driver Codec DAI endpoint for TXDAC. The codec does only a few things - set up decimation - enable codec and I2S output - ensures the driver doesn't have dac overwrite enabled. (unmute the output) Signed-off-by: Anton D. Stavinskii Link: https://patch.msgid.link/20260120-cv1800b-i2s-driver-v4-5-6ef787dc6426@gmail.com Signed-off-by: Mark Brown commit 4cf8752a03e67b2927d137a47c4eca4d516b4838 Author: Anton D. Stavinskii Date: Tue Jan 20 23:06:06 2026 +0400 ASoC: sophgo: add CV1800B internal ADC codec driver Codec DAI endpoint for RXADC + basic controls. THe codec have basic volume control. Which is imlemented by lookup table for simplicity. The codec expects set_sysclk callback to adjust internal mclk divider. Signed-off-by: Anton D. Stavinskii Link: https://patch.msgid.link/20260120-cv1800b-i2s-driver-v4-4-6ef787dc6426@gmail.com Signed-off-by: Mark Brown commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 Author: Ziyi Guo Date: Sun Jan 25 19:40:39 2026 +0000 wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating that callers must hold this lock. All other callers of il_set_tx_power() properly acquire the mutex: - il_bg_scan_completed() acquires mutex at common.c:1683 - il_mac_config() acquires mutex at common.c:5006 - il3945_commit_rxon() and il4965_commit_rxon() are called via work queues that hold the mutex (like il4965_bg_alive_start) Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in the sysfs store function to fix the missing lock protection. Signed-off-by: Ziyi Guo Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu Signed-off-by: Johannes Berg commit c294aafe474bbbd7a7476773f56f6191742a39e1 Author: Anton D. Stavinskii Date: Tue Jan 20 23:06:05 2026 +0400 ASoC: dt-bindings: sophgo,cv1800b: add ADC/DAC codec Document the internal ADC and DAC audio codecs integrated in the Sophgo CV1800B SoC. Signed-off-by: Anton D. Stavinskii Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260120-cv1800b-i2s-driver-v4-3-6ef787dc6426@gmail.com Signed-off-by: Mark Brown commit ea0fb91c02c14748ae525dd547ede7b4a6535d09 Author: Anton D. Stavinskii Date: Tue Jan 20 23:06:04 2026 +0400 ASoC: sophgo: add CV1800B I2S/TDM controller driver The actual CPU DAI controller. The driver can be used with simple-audio-card. It respects fixed clock configuration from simple-audio-card. The card driver can request direction out, this will be interpreted as mclk out, the clock which can be used in other CPU or codecs. For example I2S3 generates clock for ADC. I2S was tested in S24_32 and S16 dual channel formats. Signed-off-by: Anton D. Stavinskii Link: https://patch.msgid.link/20260120-cv1800b-i2s-driver-v4-2-6ef787dc6426@gmail.com Signed-off-by: Mark Brown commit ad50e1f63873e5d1f2f421bbd11387a0a1d0ca54 Author: Anton D. Stavinskii Date: Tue Jan 20 23:06:03 2026 +0400 ASoC: dt-bindings: sophgo,cv1800b: add I2S/TDM controller There are 4 TDM controllers on the SoC. Each controller can receive or transmit data over DMA. The dma it self has 8 channels. Each channel can be connected only to a specific i2s node. But each of dma channel can have multiple purposes so in order to save dma channels the configurations allows to use tx and rx, only rx, only tx or none channels. I2S controller without channels can be useful in configuration where I2S is used as clock source only and doesn't produce any data. Signed-off-by: Anton D. Stavinskii Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260120-cv1800b-i2s-driver-v4-1-6ef787dc6426@gmail.com Signed-off-by: Mark Brown commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 Author: Ziyi Guo Date: Sun Jan 25 19:30:05 2026 +0000 wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() il3945_store_measurement() calls il3945_get_measurement() which internally calls il_send_cmd_sync() without holding il->mutex. However, il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that callers must hold this lock. Other sysfs store functions in the same file properly acquire the mutex: - il3945_store_flags() acquires mutex at 3945-mac.c:3110 - il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144 Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call in the sysfs store function to fix the missing lock protection. Signed-off-by: Ziyi Guo Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu Signed-off-by: Johannes Berg commit a8b6e3738c872d35f1cf7b3cd3ce67d86d38e7cf Author: Jisheng Zhang Date: Thu Jan 22 23:50:46 2026 +0800 spi: dw-mmio: support suspend/resume Add system wide suspend and resume support, the implementation is straightforward, just call spi_controller_suspend() then assert the reset and disable clks for suspend, enable clks and deassert reset then call spi_controller_resume() for resume. Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20260122155046.12848-1-jszhang@kernel.org Signed-off-by: Mark Brown commit db6a59cfcc9364dec501993690a320d916ae3904 Author: Jisheng Zhang Date: Thu Jan 22 23:51:19 2026 +0800 spi: cadence-xspi: support suspend/resume Add system wide suspend and resume support, the suspend hook implementation is straightforward, just call spi_controller_suspend() While the resume hook implementation is a bit complex, we need to redo something which is done during probe, such as enable the interrupts, setup clk and config the phy for mrvl hw overlay. Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20260122155119.12865-1-jszhang@kernel.org Signed-off-by: Mark Brown commit 04f7516ab70f7b82aae1d2830af2ee6f17f3fe98 Author: Chin-Ting Kuo Date: Tue Jan 20 20:30:05 2026 +0800 spi: aspeed: Add support for non-spi-mem devices The ASPEED FMC/SPI controller may be shared by spi-mem devices and other SPI peripherals that do not use the spi-mem framework. The driver currently assumes spi-mem semantics for all devices, while the controller also supports direct user mode access commonly used by non-spi-mem devices. This mismatch can result in incorrect behavior when different types of devices share the same controller. Therefore, a user mode based path for non-spi-mem devices is added by implementing the transfer_one() callback and wiring up prepare_message() and unprepare_message() so controller state is initialized and restored for user mode transfers. This allows non-spi-mem devices to operate correctly alongside spi-mem devices on a shared controller. This patch has been tested on: - AST2700 EVB + Infineon and ST SPI TPM device. - AST2x00 EVB + spidev_test utility and the output waveforms are verified with logic analyzer. - AST2x00 EVB + SPI NOR flash read/write regression. Signed-off-by: Chin-Ting Kuo Link: https://patch.msgid.link/20260120123005.1392071-3-chin-ting_kuo@aspeedtech.com Signed-off-by: Mark Brown commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 Author: Chin-Ting Kuo Date: Tue Jan 20 20:30:04 2026 +0800 spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end spi_mem_dirmap_create() may reconfigure controller-wide settings, which can interfere with concurrent transfers to other devices sharing the same SPI controller but using different chip selects. Wrap the ->dirmap_create() callback with spi_mem_access_start() and spi_mem_access_end() to serialize access and prevent cross-CS interference during dirmap creation. This patch has been verified on a setup where a SPI TPM is connected to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1 of the same controller. Without this patch, spi_mem_dirmap_create() for the SPI NOR flash interferes with ongoing SPI TPM data transfers, resulting in failure to create the TPM device. This was tested on an ASPEED AST2700 EVB. Signed-off-by: Chin-Ting Kuo Reviewed-by: Paul Menzel Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com Signed-off-by: Mark Brown commit 6ffdc7eb48bd2268c37c2accad454c043b9cc987 Author: Marek Vasut Date: Thu Jan 22 00:42:58 2026 +0100 regcache: Demote defaults readback from HW to debug print Since commit 632e04739c8f ("clk: rs9: Fix suspend/resume"), the clk-renesas-pcie-9series driver produces the following print in kernel log on boot: " clk-renesas-pcie-9series 8-0068: No cache defaults, reading back from HW " This is caused by the presence of .num_reg_defaults_raw in its struct regmap_config, without a matching .reg_defaults_raw table of built-in register default values. This configuration is valid, and causes the regcache code to read the default register settings from the hardware, which is a valid behavior for this particular chip. In fact, this configuration is more common than configuration with .reg_defaults_raw built-in register defaults. Do not warn about the read of default values being read from hardware, as that is too strong and seems unnecessary, turn the warning into a debug print. Suggested-by: Geert Uytterhoeven Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260121234309.178391-1-marek.vasut+renesas@mailbox.org Signed-off-by: Mark Brown commit 70a65c53d228562cf0c8ae0f38c847d2a5dd59e6 Author: Sheetal Date: Fri Jan 23 15:23:46 2026 +0530 regmap: add KUnit coverage for reg_default_cb callback Add a flat-cache KUnit test that verifies reg_defaults are honored while missing entries are populated via the reg_default_cb callback without hardware reads. This exercises the new callback path added for REGCACHE_FLAT defaults. Test: ./tools/testing/kunit/kunit.py run regmap Result: ======== reg_default_callback_populates_flat_cache ======== [PASSED] flat-default @0x0 [PASSED] flat-default fast I/O @0x0 [PASSED] flat-default @0x2001 ==== [PASSED] reg_default_callback_populates_flat_cache ==== Signed-off-by: Sheetal Link: https://patch.msgid.link/20260123095346.1258556-5-sheetal@nvidia.com Signed-off-by: Mark Brown commit dc65b1ed4bb34ab6235ff2cc6a917b9295c04c2c Author: Sheetal Date: Fri Jan 23 15:23:44 2026 +0530 regmap: Add reg_default_cb callback for flat cache defaults Commit e062bdfdd6ad ("regmap: warn users about uninitialized flat cache") warns when REGCACHE_FLAT is used without full defaults. This causes false positives on hardware where many registers reset to zero but are not listed in reg_defaults, forcing drivers to maintain large tables just to silence the warning. Add a reg_default_cb() hook so drivers can supply defaults for registers not present in reg_defaults when populating REGCACHE_FLAT. This keeps the warning quiet for known zero-reset registers without bloating tables. Provide a generic regmap_default_zero_cb() helper for drivers that need zero defaults. The hook is only used for REGCACHE_FLAT; the core does not check readable/writeable access, so drivers must provide readable_reg/ writeable_reg callbacks and handle holes in the register map. Signed-off-by: Sheetal Link: https://patch.msgid.link/20260123095346.1258556-3-sheetal@nvidia.com Signed-off-by: Mark Brown commit 74823db9ba2e13f3ec007b354759b3d8125e462c Author: Chen Ni Date: Tue Jan 27 11:32:50 2026 +0800 ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio Add check for the return value of devm_regmap_init_mmio() and return the error if it fails in order to catch the error. Signed-off-by: Chen Ni Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit 8ef73c0fbd1e15ead401a74e7114d8d4614a74cf Author: Chen Ni Date: Tue Jan 27 11:40:25 2026 +0800 ASoC: sun4i-spdif: Add missing check for devm_regmap_init_mmio Add check for the return value of devm_regmap_init_mmio() and return the error if it fails in order to catch the error. Signed-off-by: Chen Ni Link: https://patch.msgid.link/20260127034025.2044669-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit c76d50b71e898694c946993eb3c77f50efa97254 Author: Peng Fan Date: Thu Jan 22 20:45:00 2026 +0800 ASoC: ac97: Convert to GPIO descriptors of_gpio.h is deprecated, update the driver to use GPIO descriptors. - Use devm_gpiod_get to get GPIO descriptor, and set consumer name. Since the driver still pass the reset_gpio to pxa27x_configure_ac97reset, so use desc_to_gpio() to get it gpio id. Signed-off-by: Peng Fan Link: https://patch.msgid.link/20260122-sound-cleanup-v1-4-0a91901609b8@nxp.com Signed-off-by: Mark Brown commit be829277ef79aa626e952e17030d711bdb6c1eef Author: Peng Fan Date: Thu Jan 22 20:44:59 2026 +0800 ASoC: pxa2xx-ac97: Remove platform_data Since commit d6df7df7ae5a0 ("ARM: pxa: remove unused board files"), there has been no in-tree user to create the device with platform data. So remove them. Signed-off-by: Peng Fan Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260122-sound-cleanup-v1-3-0a91901609b8@nxp.com Signed-off-by: Mark Brown commit b094de7810f3c0340a3aebaf6b8fc60c81c0cf91 Author: Peng Fan Date: Thu Jan 22 20:44:58 2026 +0800 ASoC: codec: Remove pxa2xx-ac97.c With commit ce79f3a1ad5f ("ARM: pxa: prune unused device support") and commit 2548e6c76ebf ("ARM: pxa: pxa2xx-ac97-lib: use IRQ resource"), there is no 'pxa2xx-ac97' platform device created by machine level code, so this driver could be removed. Signed-off-by: Peng Fan Reviewed-by: Bartosz Golaszewski Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260122-sound-cleanup-v1-2-0a91901609b8@nxp.com Signed-off-by: Mark Brown commit d7e1f9e84af460c5f1e5352eda8f036000cfcf0a Author: Peng Fan Date: Thu Jan 22 20:44:57 2026 +0800 ASoC: codec: Remove ak4641 Since commit d6df7df7ae5a0 ("ARM: pxa: remove unused board files"), there has been no in-tree user of the AK4641 codec driver. The last user (HP iPAQ hx4700) was a non-DT PXA board file that instantiated the device via I2C board data; that code was removed as part of the PXA board-file purge. The AK4641 driver was introduced ~2011 and still probes only via the I2C device-ID table ('.id_table'), without an 'of_match_table', so there are no upstream Devicetree users to retain. With no in-tree users left, remove the driver. Signed-off-by: Peng Fan Reviewed-by: Bartosz Golaszewski Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260122-sound-cleanup-v1-1-0a91901609b8@nxp.com Signed-off-by: Mark Brown commit 95110e5736d054771c92d14b3b4a13ca6dead519 Author: David Yang Date: Sat Jan 24 04:38:40 2026 +0800 wifi: mac80211: use u64_stats_t with u64_stats_sync properly On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. Convert to u64_stats_t to ensure atomic operations. Signed-off-by: David Yang Link: https://patch.msgid.link/20260123203845.2915525-1-mmyangfl@gmail.com Signed-off-by: Johannes Berg commit 9b50d9c06c275419ac36de8b5a5dd1ed6b522770 Author: Zilin Guan Date: Thu Jan 22 08:59:45 2026 +0000 wifi: p54: Fix memory leak in p54_beacon_update() In p54_beacon_update(), beacon is allocated via ieee80211_beacon_get(). If p54_beacon_format_ie_tim() fails, the function returns immediately without freeing the allocated beacon skb, which would lead to a memory leak. Since no other references to this memory exist, it must be freed locally before returning the error. Fix this by freeing the buffer using dev_kfree_skb_any() in the error path. Note that this error path is unreachable in practice because mac80211 guarantees a minimum TIM length of 4 bytes for non-S1G devices. This change primarily serves to silence static analysis warnings and keep the error handling logic complete. Compile tested only. Issue found using a prototype static analysis tool and code review. Signed-off-by: Zilin Guan Acked-by: Christian Lamparter Link: https://patch.msgid.link/20260122085945.444955-1-zilin@seu.edu.cn Signed-off-by: Johannes Berg commit fd5bfcf430ea2fdbb3e78fd0b82ceb0ab02b72ee Author: Pagadala Yesu Anjaneyulu Date: Sun Jan 11 16:36:08 2026 +0200 wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as LPI mode Although value 4 (INDOOR_SP_AP_OLD) is deprecated in IEEE standards, existing APs may still use this control value. Since this value is based on the old specification, we cannot trust such APs implement proper power controls. Therefore, move IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD case from SP_AP to LPI_AP power type handling to prevent potential power limit violations. Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111163601.6b5a36d3601e.I1704ee575fd25edb0d56f48a0a3169b44ef72ad0@changeid Signed-off-by: Johannes Berg commit bad909507a4b55818612b24733279c473b3f1663 Author: Uwe Kleine-König Date: Mon Jan 12 16:46:59 2026 +0100 wifi: rtw88: sdio: Migrate to use sdio specific shutdown function This saves a cast in the driver. The motivation is stop using the callback .shutdown in rsi_driver.drv to make it possible to drop that. Signed-off-by: Uwe Kleine-König Acked-by: Ping-Ke Shih Link: https://patch.msgid.link/5a328658c20613068bbbfabd3d0e721b69b3d474.1768232321.git.u.kleine-koenig@baylibre.com Signed-off-by: Johannes Berg commit 0f789b37c14ac4f92cc75229b7159a29a747d92a Author: Uwe Kleine-König Date: Mon Jan 12 16:46:58 2026 +0100 wifi: rsi: sdio: Migrate to use sdio specific shutdown function This saves a cast in the driver. The motivation is stop using the callback .shutdown in rsi_driver.drv to make it possible to drop that. Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/2909323889b8ad4732ef6a8e05b5c40487a6c4bb.1768232321.git.u.kleine-koenig@baylibre.com Signed-off-by: Johannes Berg commit c5c57e56de55eff39e68c19edbe82f84104976db Author: Uwe Kleine-König Date: Mon Jan 12 16:46:57 2026 +0100 sdio: Provide a bustype shutdown function To prepare sdio drivers to migrate away from struct device_driver::shutdown (and then eventually remove that callback) create a serdev driver shutdown callback and migration code to keep the existing behaviour. Note this introduces a warning for each driver that isn't converted yet to that callback at register time. Signed-off-by: Uwe Kleine-König Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/397f45c2818f6632151f92b70e547262f373c3b6.1768232321.git.u.kleine-koenig@baylibre.com Signed-off-by: Johannes Berg commit 853800c746d38486673ef67f461b660a01d52716 Author: Avraham Stern Date: Sun Jan 11 19:03:51 2026 +0200 wifi: nl80211/cfg80211: support operating as RSTA in PMSR FTM request Add an option to operate as the RSTA in an FTM measurement request. When requested, the device will dwell on the requested channel until the peer starts the FTM negotiation. This option is only valid for trigger-based/non trigger-based measurement with LMR feedback which will allow the RSTA to receive the results of the measurement. Signed-off-by: Avraham Stern Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111190221.1f95fc0afab4.Iae2d32783b8e7c4a29089fec0f4c6bce94d303cc@changeid Signed-off-by: Johannes Berg commit cfd46d1c6f4bf232c5630b1cf5c8b317d38101c5 Author: Avraham Stern Date: Sun Jan 11 19:03:50 2026 +0200 wifi: nl80211/cfg80211: add negotiated burst period to FTM result The FTM result includes some of the periodic measurement negotiated parameters (like the burst duration and number of bursts), but it doesn't include the burst period. Add it to the FTM result notification. Signed-off-by: Avraham Stern Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111190221.e0778f86edef.I3c98c1933eb639963bc3ffdef81a8788b59f2188@changeid Signed-off-by: Johannes Berg commit 853ce6943c385be2f6cccf371080e592f2e08b0f Author: Avraham Stern Date: Sun Jan 11 19:03:49 2026 +0200 wifi: nl80211/cfg80211: clarify periodic FTM parameters for non-EDCA based ranging Periodic FTM request attributes are defined based on the periodic parameters used in EDCA-based ranging negotiation. However, non-EDCA based ranging (trigger-based/non-trigger-based) does not include periodic parameters in the negotiation protocol, even though upper layers may still request periodic measurements. Clarify the semantics of periodic ranging attributes when used with non-EDCA based ranging. Signed-off-by: Avraham Stern Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111190221.b89cb3f68e1a.I7a9d8c6d1c66c77f1b43120a841101c96c3f19ad@changeid Signed-off-by: Johannes Berg commit 86c6b6e4d187652d718915e15cf126f98e24e955 Author: Avraham Stern Date: Sun Jan 11 19:03:48 2026 +0200 wifi: nl80211/cfg80211: add new FTM capabilities Add new capabilities to the PMSR FTM capabilities list. The new capabilities include 6 GHz support, supported number of spatial streams and supported number of LTF repetitions. Signed-off-by: Avraham Stern Tested-by: Miriam Rachel Korenblit Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111190221.bf43785c18f6.Ic98cf9790ddee84bf88e5720b93c46c23af3c96c@changeid Signed-off-by: Johannes Berg commit 4778a04c1574babd8a79561d60cd5e243585ffaa Merge: 4c17c01c317a43 6a0fc0ea61bddc Author: Paolo Abeni Date: Tue Jan 27 13:32:35 2026 +0100 Merge branch 'extend-bit-width-in-the-flow-director-of-hns3-driver' Jijie Shao says: ==================== extend bit width in the flow director of HNS3 driver The bit widths of HCLGE_FD_AD_QID and HCLGE_FD_AD_COUNTER_NUM are increased to support higher specifications. Note: The hardware already supports the specifications. ==================== Link: https://patch.msgid.link/20260123094756.3718516-1-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 6a0fc0ea61bddc2909030b911e224963523b0cb7 Author: Jijie Shao Date: Fri Jan 23 17:47:56 2026 +0800 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits Currently, HCLGE_FD_AD_COUNTER_NUM has only 7 bits and supports a maximum of 127 counter_id. However, there are actually scenarios where the counter_id exceeds 127. This patch adds an additional bit to HCLGE_FD_AD_QID to ensure that counter_id greater than 127 are supported. Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20260123094756.3718516-3-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 878406d4d6ef85c37fab52074771cc916e532c16 Author: Jijie Shao Date: Fri Jan 23 17:47:55 2026 +0800 net: hns3: extend HCLGE_FD_AD_QID to 11 bits Currently, HCLGE_FD_AD_QID has only 10 bits and supports a maximum of 1023 queues. However, there are actually scenarios where the queue_id exceeds 1023. This patch adds an additional bit to HCLGE_FD_AD_QID to ensure that queue_id greater than 1023 are supported. Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 9b9d253908478f504297ac283c514e5953ddafa6 Author: Zilin Guan Date: Mon Jan 26 07:48:01 2026 +0000 RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler The UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function allocates memory for the device path using kobject_get_path(). If the length of the device path exceeds the output buffer length, the function returns -ENOSPC but does not free the allocated memory, resulting in a memory leak. Add a kfree() call to the error path to ensure the allocated memory is properly freed. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: ec7ad6530909 ("RDMA/mlx5: Introduce GET_DATA_DIRECT_SYSFS_PATH ioctl") Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20260126074801.627898-1-zilin@seu.edu.cn Signed-off-by: Leon Romanovsky commit 74a862d251ad5f57b58738cfe0192d807b1a0313 Merge: 196906d4acf104 c455f19bbe6104 Author: Miguel Ojeda Date: Tue Jan 27 12:30:33 2026 +0100 Merge tag 'rust-xarray-for-v6.20-v7.0' of https://github.com/Rust-for-Linux/linux into rust-next Pull XArray update from Andreas Hindborg: - Add '__rust_helper' to XArray abstraction C helpers. * tag 'rust-xarray-for-v6.20-v7.0' of https://github.com/Rust-for-Linux/linux: rust: xarray: add __rust_helper to helpers commit db7e7ea838c916ee4cdf26bee126fd36f58295dc Author: Liu Ying Date: Fri Jan 23 17:22:16 2026 +0800 drm/bridge: imx8qxp-pxl2dpi: Fix NULL pointer dereference in imx8qxp_pxl2dpi_bridge_destroy() Pointer bridge->driver_private in imx8qxp_pxl2dpi_bridge_destroy() is NULL when imx8qxp_pxl2dpi_bridge_probe() returns error, because the pointer is initialized only when imx8qxp_pxl2dpi_bridge_probe() returns 0. The NULL pointer would be set to pointer p2d and then NULL pointer p2d would be dereferenced. Fix this by returning early from imx8qxp_pxl2dpi_bridge_destroy() if !p2d is true. Fixes: 900699ba830f ("drm/bridge: imx8qxp-pxl2dpi: get/put the companion bridge") Signed-off-by: Liu Ying Reviewed-by: Luca Ceresoli Reviewed-by: Frank Li Link: https://patch.msgid.link/20260123-imx8qxp-drm-bridge-fixes-v1-2-8bb85ada5866@nxp.com Signed-off-by: Luca Ceresoli commit 852c68bf42965ee38b465d2d6f7b965eb0b5dc1d Author: Liu Ying Date: Fri Jan 23 17:22:15 2026 +0800 drm/bridge: imx8qxp-ldb: Fix NULL pointer dereference in imx8qxp_ldb_bridge_destroy() Pointer bridge->driver_private in imx8qxp_ldb_bridge_destroy() is NULL when a LDB channel is unavailable or imx8qxp_ldb_probe() returns error, because ldb_add_bridge_helper() is the last function called from imx8qxp_ldb_probe() and it doesn't initialize bridge->driver_private if a LDB channel is unavailable. The NULL pointer would be set to pointer ldb_ch and then NULL pointer ldb_ch would be dereferenced. Fix this by returning early from imx8qxp_ldb_bridge_destroy() if !ldb_ch is true. Fixes: 32529d384cea ("drm/bridge: imx8qxp-ldb: convert to of_drm_find_and_get_bridge()") Signed-off-by: Liu Ying Reviewed-by: Luca Ceresoli Reviewed-by: Frank Li Link: https://patch.msgid.link/20260123-imx8qxp-drm-bridge-fixes-v1-1-8bb85ada5866@nxp.com Signed-off-by: Luca Ceresoli commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 Author: Thomas Richter Date: Fri Jan 23 10:14:12 2026 +0100 s390/perf: Disable register readout on sampling events Running commands # ./perf record -IR0,R1 -a sleep 1 extracts and displays register value of general purpose register r1 and r0. However the value displayed of any register is random and does not reflect the register value recorded at the time of the sample interrupt. The sampling device driver on s390 creates a very large buffer for the hardware to store the samples. Only when that large buffer gets full an interrupt is generated and many hundreds of sample entries are processed and copied to the kernel ring buffer and eventually get copied to the perf tool. It is during the copy to the kernel ring buffer that each sample is processed (on s390) and at that time the register values are extracted. This is not the original goal, the register values should be read when the samples are created not when the samples are copied to the kernel ring buffer. Prevent this event from being installed in the first place and return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 0d453ba04044bb1b0df366d4a0a9098481f14621 Author: Gerd Bayer Date: Fri Jan 16 16:02:42 2026 +0100 s390/Kconfig: Define non-zero ILLEGAL_POINTER_VALUE Define CONFIG_ILLEGAL_POINTER_VALUE to the eye-catching non-zero value of 0xdead000000000000, consistent with other architectures. Assert at compile-time that the poison pointers that include/linux/poison.h defines based on this illegal pointer are beyond the largest useful virtual addresses. Also, assert at compile-time that the range of poison pointers per include/linux/poison.h (currently a range of less than 0x10000 addresses) does not overlap with the range used for address handles for s390's non-MIO PCI instructions. This enables s390 to track the DMA mappings by the network stack's page_pool that was introduced with [0]. Other functional changes are not intended. Other archictectures have introduced this for various other reasons with commit 5c178472af24 ("riscv: define ILLEGAL_POINTER_VALUE for 64bit") commit f6853eb561fb ("powerpc/64: Define ILLEGAL_POINTER_VALUE for 64-bit") commit bf0c4e047324 ("arm64: kconfig: Move LIST_POISON to a safe value") commit a29815a333c6 ("core, x86: make LIST_POISON less deadly") [0] https://lore.kernel.org/all/20250409-page-pool-track-dma-v9-0-6a9ef2e0cba8@redhat.com/ Reviewed-by: Niklas Schnelle Signed-off-by: Gerd Bayer Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 0875816a58d855d674305a7330c44d25ce27dca2 Merge: 88303fb68cc2e8 9f9d68c308cb63 Author: Heiko Carstens Date: Tue Jan 27 12:16:52 2026 +0100 Merge branch 'warn-exception' Heiko Carstens says: ==================== v2: - Use generic WARN() implementation in case of gcc-8, which avoids the need to raise the minimum gcc version to gcc-9 for (only) s390 - Add couple of additional ifdef guards to avoid compile errors and warnings v1 ([1]): Use the generic infrastructure introduced by Peter Zijlstra [2] to implement an exception based WARN() and WARN_ONCE() similar to x86. Due to some compiler oddities on s390 this requires to raise the minimum gcc version to 9. Maybe there are ways to avoid this, but I failed to find a working solution. Details are in the patch descriptions. Just posting this now to also get some compile bot testing, since I'm afraid there might be some compiler version / config option around where even this new approach breaks. Peter, since you were wondering: your generic infrastructure pieces work very nice. Looking at the x86 and s390 implementation: it might be possible to make things even more generic since both __WARN_printf(), and WARN_ONCE() are identical; it looks like only __WARN_print_arg() needs to be provided. [1] https://lore.kernel.org/all/20251209121701.1856271-1-hca@linux.ibm.com/ [2] https://lore.kernel.org/all/20251110114633.202485143@infradead.org/ ==================== Signed-off-by: Heiko Carstens commit 9f9d68c308cb63de67d35171925ce3875d076d4f Author: Heiko Carstens Date: Fri Jan 9 16:31:44 2026 +0100 s390/bug: Prevent tail-call optimization For the exception based __WARN_trap() implementation it is technically not necessary to prevent tail-call optimization, however it may be confusing to see warning messages like: WARNING: arch/s390/kernel/setup.c:1017 at foobar+0x2c/0x50, CPU#0: swapper/0/0 together with a disassembly of a different function caused by tail-call optimization for the __WARN_trap() call. Prevent that by adding an empty asm statement. This generates slightly worse code, but should hopefully avoid confusion. With this the output looks like: WARNING: arch/s390/kernel/setup.c:1017 at foobar+0x2c/0x50, CPU#0: swapper/0/0 ... Krnl PSW : 0704c00180000000 000003ffe0119788 (foobar+0x38/0x50) ... Krnl Code: 000003ffe0119776: e3e0f0980024 stg %r14,152(%r15) 000003ffe011977c: c02000b8992a larl %r2,000003ffe182c9d0 *000003ffe0119782: c0e5007270b7 brasl %r14,000003ffe0f678f0 >000003ffe0119788: ebeff0a00004 lmg %r14,%r15,160(%r15) 000003ffe011978e: 07fe bcr 15,%r14 000003ffe0119790: 47000700 bc 0,1792 000003ffe0119794: 0707 bcr 0,%r7 000003ffe0119796: 0707 bcr 0,%r7 Call Trace: [<000003ffe0119788>] foobar+0x38/0x50 [<000003ffe185bc2e>] arch_cpu_finalize_init+0x26/0x60 [<000003ffe185654c>] start_kernel+0x53c/0x5d8 [<000003ffe010002e>] startup_continue+0x2e/0x40 A better solution would be to replace or patch the branch instruction to __WARN_trap() with the monitor call instruction, similar to what is done for x86 [1]. However s390 does not support static_cond_calls(). Therefore use the simple approach for the time being. [1] commit 860238af7a33 ("x86_64/bug: Inline the UD1") Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 79996065cfa258de95c123ca9ed93754ab60d8c8 Author: Heiko Carstens Date: Fri Jan 9 16:31:43 2026 +0100 s390/bug: Skip __WARN_trap() in call traces In order to avoid rather pointless warning disassemblies of __WARN_trap() set the PSW address to the return address of the function which called __WARN_trap(). This is the address to which __WARN_trap() would return in any case. The result is a disassembly of the function which called __WARN_trap(), which is much more helpful. Before: WARNING: arch/s390/kernel/setup.c:1017 at foobar+0x2c/0x20, CPU#0: swapper/0/0 ... Krnl PSW : 0704c00180000000 000003ffe0f675f4 (__WARN_trap+0x4/0x10) ... Krnl Code: 000003ffe0f675ec: 0707 bcr 0,%r7 000003ffe0f675ee: 0707 bcr 0,%r7 *000003ffe0f675f0: af000001 mc 1,0 >000003ffe0f675f4: 07fe bcr 15,%r14 000003ffe0f675f6: 47000700 bc 0,1792 000003ffe0f675fa: 0707 bcr 0,%r7 000003ffe0f675fc: 0707 bcr 0,%r7 000003ffe0f675fe: 0707 bcr 0,%r7 Call Trace: [<000003ffe0f675f4>] __WARN_trap+0x4/0x10 [<000003ffe185bc2e>] arch_cpu_finalize_init+0x26/0x60 [<000003ffe185654c>] start_kernel+0x53c/0x5d8 [<000003ffe010002e>] startup_continue+0x2e/0x40 Afterwards: WARNING: arch/s390/kernel/setup.c:1017 at foobar+0x12/0x30, CPU#0: swapper/0/0 ... Krnl PSW : 0704c00180000000 000003ffe185bc2e (arch_cpu_finalize_init+0x26/0x60) ... Krnl Code: 000003ffe185bc1c: e3f0ff98ff71 lay %r15,-104(%r15) 000003ffe185bc22: e3e0f0980024 stg %r14,152(%r15) *000003ffe185bc28: c0e5ff45ed94 brasl %r14,000003ffe0119750 >000003ffe185bc2e: c0e5ffa052b9 brasl %r14,000003ffe0c661a0 000003ffe185bc34: c020fffe86d6 larl %r2,000003ffe182c9e0 000003ffe185bc3a: e548f0a80006 mvghi 168(%r15),6 000003ffe185bc40: e548f0a00005 mvghi 160(%r15),5 000003ffe185bc46: a7690004 lghi %r6,4 Call Trace: [<000003ffe185bc2e>] arch_cpu_finalize_init+0x26/0x60 [<000003ffe185654c>] start_kernel+0x53c/0x5d8 [<000003ffe010002e>] startup_continue+0x2e/0x40 Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 940cfea4270436edf515bf07d0a778eed6cec16d Author: Heiko Carstens Date: Fri Jan 9 16:31:42 2026 +0100 s390/bug: Implement WARN_ONCE() This is the s390 variant of commit 11bb4944f014 ("x86/bug: Implement WARN_ONCE()"). Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 04dabb4261c387318affbdb22c15c31138a989f5 Author: Heiko Carstens Date: Fri Jan 9 16:31:41 2026 +0100 s390/bug: Implement __WARN_printf() This is the s390 variant of commit 5b472b6e5bd9 ("x86_64/bug: Implement __WARN_printf()"). See the x86 commit for the general idea; there are only implementation details which are different. With the new exception based __WARN_printf() implementation the generated code for a simple WARN() is simplified. For example: void foo(int a) { WARN(a, "bar"); } Before this change the generated code looks like this: 0000000000000210 : 210: c0 04 00 00 00 00 jgnop 210 216: ec 26 00 06 00 7c cgijne %r2,0,222 21c: c0 f4 00 00 00 00 jg 21c 21e: R_390_PC32DBL __s390_indirect_jump_r14+0x2 222: eb ef f0 88 00 24 stmg %r14,%r15,136(%r15) 228: b9 04 00 ef lgr %r14,%r15 22c: e3 f0 ff e8 ff 71 lay %r15,-24(%r15) 232: e3 e0 f0 98 00 24 stg %r14,152(%r15) 238: c0 20 00 00 00 00 larl %r2,238 23a: R_390_PC32DBL .LC48+0x2 23e: c0 e5 00 00 00 00 brasl %r14,23e 240: R_390_PLT32DBL __warn_printk+0x2 244: af 00 00 00 mc 0,0 248: eb ef f0 a0 00 04 lmg %r14,%r15,160(%r15) 24e: c0 f4 00 00 00 00 jg 24e 250: R_390_PC32DBL __s390_indirect_jump_r14+0x2 With this change the generated code looks like this: 0000000000000210 : 210: c0 04 00 00 00 00 jgnop 210 216: ec 26 00 06 00 7c cgijne %r2,0,222 21c: c0 f4 00 00 00 00 jg 21c 21e: R_390_PC32DBL __s390_indirect_jump_r14+0x2 222: c0 20 00 00 00 00 larl %r2,222 224: R_390_PC32DBL __bug_table+0x2 228: c0 f4 00 00 00 00 jg 228 22a: R_390_PLT32DBL __WARN_trap+0x2 Downside is that the call trace now starts at __WARN_trap(): ------------[ cut here ]------------ bar WARNING: arch/s390/kernel/setup.c:1017 at 0x0, CPU#0: swapper/0/0 ... Krnl PSW : 0704c00180000000 000003ffe0f6a3b4 (__WARN_trap+0x4/0x10) ... Krnl Code: 000003ffe0f6a3ac: 0707 bcr 0,%r7 000003ffe0f6a3ae: 0707 bcr 0,%r7 *000003ffe0f6a3b0: af000001 mc 1,0 >000003ffe0f6a3b4: 07fe bcr 15,%r14 000003ffe0f6a3b6: 47000700 bc 0,1792 000003ffe0f6a3ba: 0707 bcr 0,%r7 000003ffe0f6a3bc: 0707 bcr 0,%r7 000003ffe0f6a3be: 0707 bcr 0,%r7 Call Trace: [<000003ffe0f6a3b4>] __WARN_trap+0x4/0x10 ([<000003ffe185a54c>] start_kernel+0x53c/0x5d8) [<000003ffe010002e>] startup_continue+0x2e/0x40 Which isn't too helpful. This can be addressed by just skipping __WARN_trap(), which will be addressed in a later patch. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit ee44f4e7ebb56f1a2a3aaed8b01ea052fc225680 Author: Heiko Carstens Date: Fri Jan 9 16:31:40 2026 +0100 s390/traps: Copy monitor code to pt_regs In case of a monitor call program check the CPU stores the monitor code to lowcore. Let the program check handler copy it to the pt_regs structure so it can be used by the monitor call exception handler. Instead of increasing the pt_regs size add a union which contains both orig_gpr2 and monitor_code, since orig_gpr2 is not used in case of a program check. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 8cbfd13601af7d71bb86c2ea686489a6f139c0ba Author: Heiko Carstens Date: Fri Jan 9 16:31:39 2026 +0100 s390/bug: Introduce and use monitor code macro The first operand address of the monitor call (mc) instruction is the monitor code. Currently the monitor code is ignored, but this will change. Therefore add and use MONCODE_BUG instead of a hardcoded zero. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 2b71b8ab971889edba278b71f1d3ff82cd42e175 Author: Heiko Carstens Date: Fri Jan 9 16:31:38 2026 +0100 s390/bug: Use BUG_FORMAT for DEBUG_BUGVERBOSE_DETAILED This is just the s390 variant of commit 4f1b701f24be ("x86/bug: Use BUG_FORMAT for DEBUG_BUGVERBOSE_DETAILED"). Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit e3abd056ffc9d6397766817eadbd4297632aceaf Author: Heiko Carstens Date: Fri Jan 9 16:31:37 2026 +0100 s390/bug: Convert to inline assembly with input operands Rewrite the bug inline assembly so it uses input operands again instead of pure macro replacements. This more or less reverts the conversion done when 'cond_str' support was added [1]. Reason for this is that the upcoming __WARN_printf() implementation requires an inline assembly with an output operand. At the same time input strings (format specifier and condition string) may contain the special '%' character. As soon as an inline assembly is specified to have input/output operands the '%' has a special meaning: e.g. converting the existing #define __BUG_FLAGS(cond_str, flags) \ asm_inline volatile(__stringify(ASM_BUG_FLAGS(cond_str, flags))); to #define __BUG_FLAGS(cond_str, flags) \ asm_inline volatile(__stringify(ASM_BUG_FLAGS(cond_str, flags))::); will result in a compile error as soon as 'cond_str' contains a '%' character: net/core/neighbour.c: In function ‘neigh_table_init’: ././include/linux/compiler_types.h:546:20: error: invalid 'asm': invalid %-code ... net/core/neighbour.c:1838:17: note: in expansion of macro ‘WARN_ON’ 1838 | WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN); | ^~~~~~~ Convert the code, use immediate operands, and also add comments similar to x86 which are emitted to the generated assembly file, which makes debugging much easier. Note: since gcc-8 does not support strings as immediate input operands, guard the new implementation with CC_HAS_ASM_IMMEDIATE_STRINGS and fallback to the generic non-exception based warning implementation for incompatible compilers. [1] 6584ff203aec ("bugs/s390: Use 'cond_str' in __EMIT_BUG()") Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit e5f3e67de587b8e876ca04d5bd021d751fe9c4d2 Author: Heiko Carstens Date: Fri Jan 9 16:31:36 2026 +0100 s390: Add CC_HAS_ASM_IMMEDIATE_STRINGS Upcoming changes to s390 specific inline assemblies require the usage of strings as immediate input operands. This works only with gcc-9 and newer compilers. With gcc-8 this leads to a compile error: void bar(void) { asm volatile("" :: "i" ("foo")); } Results in: In function 'bar': warning: asm operand 0 probably doesn't match constraints asm volatile("" :: "i" ("foo")); ^~~ error: impossible constraint in 'asm' Provide a CC_HAS_ASM_IMMEDIATE_STRINGS config option which allows to tell if the compiler supports strings as immediate input operands. Based on that conditional code can be provided. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 196906d4acf1048b4dbb0cb8dde81f0adb663f83 Author: Tamir Duberstein Date: Mon Jan 26 09:46:53 2026 -0500 MAINTAINERS: mailmap: update Tamir Duberstein's email address Update Tamir Duberstein's email address to `@kernel.org`. Signed-off-by: Tamir Duberstein Link: https://patch.msgid.link/20260126-tamird-kernel-org-v1-1-b390d329b0b9@kernel.org Signed-off-by: Miguel Ojeda commit a4e5927115f30a301f9939ed43e6a21a343e06ad Author: Carl Worth Date: Thu Jan 15 15:07:18 2026 -0800 arm64: mte: Set TCMA1 whenever MTE is present in the kernel Set the TCMA1 bit so that access to TTBR1 addresses with 0xf in their tag bits will be treated as tag unchecked. This is important to avoid unwanted tag checking on some systems. Specifically, SCTLR_EL1.TCF can be set to indicate that no tag check faults are desired. But the architecture doesn't guarantee that in this case the system won't still perform tag checks. Use TCMA1 to ensure that undesired tag checks are not performed. This bit was already set in the KASAN case. Adding it to the non-KASAN case prevents tag checking since all TTBR1 address will have a value of 0xf in their tag bits. This patch has been measured on an Ampere system to improve the following: * Eliminate over 98% of kernel-side tag checks during "perf bench futex hash", as measured with "perf stat". * Eliminate all MTE overhead (was previously a 25% performance penalty) from the Phoronix pts/memcached benchmark (1:10 Set:Get ration with 96 cores). Reported-by: Taehyun Noh Suggested-by: Catalin Marinas Signed-off-by: Carl Worth Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit 4c17c01c317a432382393b34cc9f65bf4ca310aa Merge: 099ca4121ea747 afe813fd89ecde Author: Paolo Abeni Date: Tue Jan 27 11:52:46 2026 +0100 Merge branch 'net-dsa-lantiq-add-support-for-intel-gsw150' Daniel Golle says: ==================== net: dsa: lantiq: add support for Intel GSW150 The Intel GSW150 Ethernet Switch (aka. Lantiq PEB7084) is the predecessor of MaxLinear's GSW1xx series of switches. It shares most features, but has a slightly different port layout and different MII interfaces. Adding support for this switch to the mxl-gsw1xx driver is quite trivial. ==================== Link: https://patch.msgid.link/cover.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit afe813fd89ecde068a5f972714c4abf896715167 Author: Daniel Golle Date: Thu Jan 22 16:39:30 2026 +0000 net: dsa: mxl-gsw1xx: add support for Intel GSW150 Add support for the Intel GSW150 (aka. Lantiq PEB7084) switch IC to the mxl-gsw1xx driver. This switch comes with 5 Gigabit Ethernet copper ports (Intel XWAY PHY11G (xRX v1.2 integrated) PHYs) as well as one GMII/RGMII and one RGMII port. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/c84cf94337bf1be30940841b338b6368468c6e17.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 99f465889a609fda6ec8fb5c50a8f8808ba28718 Author: Daniel Golle Date: Thu Jan 22 16:39:23 2026 +0000 net: dsa: mxl-gsw1xx: only setup SerDes PCS if it exists Older Intel GSW150 chip doesn't have a SGMII/1000Base-X/2500Base-X PCS. Prepare for supporting Intel GSW150 by skipping PCS reset and initialization in case no .mac_select_pcs operation is defined. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/fd46a821b1535751cd7b478a04a9ffe1e9d4d289.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 6d622840224967ca34587e293d550f3d931cc852 Author: Daniel Golle Date: Thu Jan 22 16:39:16 2026 +0000 net: dsa: lantiq: clean up phylink_get_caps switch statement Use case ranges for phylink_get_caps and remove the redundant "port N:" from the comments. Suggested-by: Vladimir Oltean Signed-off-by: Daniel Golle Link: https://patch.msgid.link/423daf99b3d60f510ff048a261c62d3de7d39321.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 338375118514f28f15a23046578d15fd8ba4c199 Author: Daniel Golle Date: Thu Jan 22 16:39:09 2026 +0000 net: dsa: lantiq: allow arbitrary MII registers The Lantiq GSWIP and MaxLinear GSW1xx drivers are currently relying on a hard-coded mapping of MII ports to their respective MII_CFG and MII_PCDU registers and only allow applying an offset to the port index. While this is sufficient for the currently supported hardware, the very similar Intel GSW150 (aka. Lantiq PEB7084) cannot be described using this arrangement. Introduce two arrays to specify the MII_CFG and MII_PCDU registers for each port, replacing the current bitmap used to safeguard MII ports as well as the port index offset. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/63fc01195196384f5e244a0ce9ec2ae3a6c08fe3.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit e7e354aa496b1ba33cf72e93ff10bf585705d15a Author: Daniel Golle Date: Thu Jan 22 16:38:53 2026 +0000 dt-bindings: net: dsa: lantiq,gswip: add Intel GSW150 Add compatible strings for the Intel GSW150 which is apparently identical or at least compatible with the Lantiq PEB7084 Ethernet switch IC. Signed-off-by: Daniel Golle Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/1dc62de5263e8536d5960b837bc5dad7b8f42fad.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit b6d6f017022fd45dc048c03d9233bba623af27ed Author: Daniel Golle Date: Thu Jan 22 16:38:45 2026 +0000 dt-bindings: net: dsa: lantiq,gswip: use correct node name Ethernet PHYs should use nodes named 'ethernet-phy@'. Rename the Ethernet PHY nodes in the example to comply. Signed-off-by: Daniel Golle Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/94f439aa17d7b51fb367877df4fb84c8c07c7ce4.1769099517.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit a3386301667ed03ba9baeb6a2629e726714cc9a7 Author: Jinjie Ruan Date: Mon Dec 22 19:47:24 2025 +0800 arm64/ptrace: Return early for ptrace_report_syscall_entry() error The generic entry abort the syscall_trace_enter() sequence if ptrace_report_syscall_entry() errors out, but arm64 not. When ptrace requests interception, it should prevent all subsequent system-call processing, including audit and seccomp. In preparation for moving arm64 over to the generic entry code, return early if ptrace_report_syscall_entry() encounters an error. Reviewed-by: Kevin Brodsky Signed-off-by: Jinjie Ruan Signed-off-by: Will Deacon commit 741a9000173a036526eb2374e1ba34c466754f1c Author: Jinjie Ruan Date: Mon Dec 22 19:47:23 2025 +0800 arm64/ptrace: Split report_syscall() The generic syscall entry code has the form: | syscall_trace_enter() | { | ptrace_report_syscall_entry() | } | | syscall_exit_work() | { | ptrace_report_syscall_exit() | } In preparation for moving arm64 over to the generic entry code, split report_syscall() to two separate enter and exit functions to align the structure of the arm64 code with syscall_trace_enter() and syscall_exit_work() from the generic entry code. No functional changes. Reviewed-by: Anshuman Khandual Reviewed-by: Kevin Brodsky Suggested-by: Mark Rutland Signed-off-by: Jinjie Ruan Signed-off-by: Will Deacon commit e7e7afdc7c141227f2ce29aca85969e050da1ab9 Author: Jinjie Ruan Date: Mon Dec 22 19:47:22 2025 +0800 arm64: Remove unused _TIF_WORK_MASK Since commit b3cf07851b6c ("arm64: entry: Switch to generic IRQ entry"), _TIF_WORK_MASK is never used, so remove it. Reviewed-by: Anshuman Khandual Reviewed-by: Kevin Brodsky Signed-off-by: Jinjie Ruan Signed-off-by: Will Deacon commit 274ea0f1687a849ded4f92d10e4c0e77f37740c9 Author: Billy Tsai Date: Fri Jan 23 17:26:31 2026 +0800 gpio: aspeed-sgpio: Support G7 Aspeed sgpiom controller In the 7th generation of the SoC from Aspeed, the control logic of the SGPIO controller has been updated to support per-pin control. Each pin now has its own 32-bit register, allowing for individual control of the pin's value, interrupt type, and other settings. Reviewed-by: Linus Walleij Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-6-69cfd1631400@aspeedtech.com Signed-off-by: Bartosz Golaszewski commit 149470018e678b8fd62225c01be67ce2f9b5b1f2 Author: Billy Tsai Date: Fri Jan 23 17:26:30 2026 +0800 dt-bindings: gpio: aspeed,sgpio: Support ast2700 The AST2700 is the 7th generation SoC from Aspeed, featuring two SGPIO master controllers: both with 256 serial inputs and outputs. Acked-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-5-69cfd1631400@aspeedtech.com Signed-off-by: Bartosz Golaszewski commit 43090d6993341b977ca66f4c72e776e99f7ba996 Author: Billy Tsai Date: Fri Jan 23 17:26:29 2026 +0800 gpio: aspeed-sgpio: Convert IRQ functions to use llops callbacks Update aspeed_sgpio_irq_handler() and aspeed_sgpio_setup_irqs() to use the llops callbacks for register access instead of direct iowrite32(). This creates a unified hardware access layer, which is essential for supporting SoCs with different register layouts like the AST2700. Additionally, change the loop bounds to use ngpio instead of the static ARRAY_SIZE(aspeed_sgpio_banks). This allows the driver to adapt to the actual number of supported pins on the running SoC. Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-4-69cfd1631400@aspeedtech.com Signed-off-by: Bartosz Golaszewski commit a3d37e0cccf530a1bad377b3503d6af757f532c4 Author: Billy Tsai Date: Fri Jan 23 17:26:28 2026 +0800 gpio: aspeed-sgpio: Create llops to handle hardware access Add low-level operations (llops) to abstract the register access for SGPIO registers. With this abstraction layer, the driver can separate the hardware and software logic, making it easier to extend the driver to support different hardware register layouts. The llops abstraction changes the programming semantics from bitmask-based writes to a value-based interface. Instead of passing a pre-shifted bitmask to the caller, the driver now passes: - the GPIO offset, and - the value to be set (0 or 1), and the llops helpers are responsible for deriving the correct register and bit position internally. As a result, assignments such as: type0 = 1; type1 = 1; type2 = 1; do not represent a behavioral change. They indicate that the bit corresponding to the given GPIO offset should be set, with the actual bit manipulation handled by llops. Reviewed-by: Linus Walleij Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-3-69cfd1631400@aspeedtech.com Signed-off-by: Bartosz Golaszewski commit 5928e0d1f66112b49869c83ed8f1cc9db3df69e5 Author: Billy Tsai Date: Fri Jan 23 17:26:27 2026 +0800 gpio: aspeed-sgpio: Remove unused bank name field Drops the names array from the bank struct and its initializers, as it is unused in the driver. Reviewed-by: Linus Walleij Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-2-69cfd1631400@aspeedtech.com Signed-off-by: Bartosz Golaszewski commit e18533b023ec7a33488bcf33140ce69bbba2894f Author: Billy Tsai Date: Fri Jan 23 17:26:26 2026 +0800 gpio: aspeed-sgpio: Change the macro to support deferred probe Use module_platform_driver() to replace module_platform_driver_probe(). The former utilizes platform_driver_register(), which allows the driver to defer probing when it doesn't acquire the necessary resources due to probe order. In contrast, the latter uses __platform_driver_probe(), which includes the comment "Note that this is incompatible with deferred probing." Since our SGPIO driver requires access to the clock resource, the former is more suitable. Reviewed-by: Linus Walleij Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com Signed-off-by: Bartosz Golaszewski commit ebd2f48dff6ae15bc1cbc7c7ae3c5fe10ad08087 Merge: a4cf8f97223d94 fc32c5725fbe11 Author: Linus Walleij Date: Tue Jan 27 10:53:41 2026 +0100 Merge tag 'intel-pinctrl-v6.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into devel intel-pinctrl for v6.20-1 * Add Nova Lake to the list of supported platforms by platform driver * Update Kconfig help text to clarify which drivers supports which platforms * Convert more Intel pin control drivers to use intel_gpio_add_pin_ranges() Signed-off-by: Linus Walleij commit 099ca4121ea747acc8a0d36852f2f477943f306d Merge: 3eef6c061f97ab b3b7b33264c69a Author: Paolo Abeni Date: Tue Jan 27 10:45:40 2026 +0100 Merge branch 'vsock-add-namespace-support-to-vhost-vsock-and-loopback' Bobby Eshleman says: ==================== vsock: add namespace support to vhost-vsock and loopback This series adds namespace support to vhost-vsock and loopback. It does not add namespaces to any of the other guest transports (virtio-vsock, hyperv, or vmci). The current revision supports two modes: local and global. Local mode is complete isolation of namespaces, while global mode is complete sharing between namespaces of CIDs (the original behavior). The mode is set using the parent namespace's /proc/sys/net/vsock/child_ns_mode and inherited when a new namespace is created. The mode of the current namespace can be queried by reading /proc/sys/net/vsock/ns_mode. The mode can not change after the namespace has been created. Modes are per-netns. This allows a system to configure namespaces independently (some may share CIDs, others are completely isolated). This also supports future possible mixed use cases, where there may be namespaces in global mode spinning up VMs while there are mixed mode namespaces that provide services to the VMs, but are not allowed to allocate from the global CID pool (this mode is not implemented in this series). Additionally, added tests for the new namespace features: tools/testing/selftests/vsock/vmtest.sh 1..25 ok 1 vm_server_host_client ok 2 vm_client_host_server ok 3 vm_loopback ok 4 ns_host_vsock_ns_mode_ok ok 5 ns_host_vsock_child_ns_mode_ok ok 6 ns_global_same_cid_fails ok 7 ns_local_same_cid_ok ok 8 ns_global_local_same_cid_ok ok 9 ns_local_global_same_cid_ok ok 10 ns_diff_global_host_connect_to_global_vm_ok ok 11 ns_diff_global_host_connect_to_local_vm_fails ok 12 ns_diff_global_vm_connect_to_global_host_ok ok 13 ns_diff_global_vm_connect_to_local_host_fails ok 14 ns_diff_local_host_connect_to_local_vm_fails ok 15 ns_diff_local_vm_connect_to_local_host_fails ok 16 ns_diff_global_to_local_loopback_local_fails ok 17 ns_diff_local_to_global_loopback_fails ok 18 ns_diff_local_to_local_loopback_fails ok 19 ns_diff_global_to_global_loopback_ok ok 20 ns_same_local_loopback_ok ok 21 ns_same_local_host_connect_to_local_vm_ok ok 22 ns_same_local_vm_connect_to_local_host_ok ok 23 ns_delete_vm_ok ok 24 ns_delete_host_ok ok 25 ns_delete_both_ok SUMMARY: PASS=25 SKIP=0 FAIL=0 Thanks again for everyone's help and reviews! Suggested-by: Sargun Dhillon Signed-off-by: Bobby Eshleman v15: https://lore.kernel.org/r/20260116-vsock-vmtest-v15-0-bbfd1a668548@meta.com v14: https://lore.kernel.org/r/20260112-vsock-vmtest-v14-0-a5c332db3e2b@meta.com v13: https://lore.kernel.org/all/20251223-vsock-vmtest-v13-0-9d6db8e7c80b@meta.com/ v12: https://lore.kernel.org/r/20251126-vsock-vmtest-v12-0-257ee21cd5de@meta.com v11: https://lore.kernel.org/r/20251120-vsock-vmtest-v11-0-55cbc80249a7@meta.com v10: https://lore.kernel.org/r/20251117-vsock-vmtest-v10-0-df08f165bf3e@meta.com v9: https://lore.kernel.org/all/20251111-vsock-vmtest-v9-0-852787a37bed@meta.com v8: https://lore.kernel.org/r/20251023-vsock-vmtest-v8-0-dea984d02bb0@meta.com v7: https://lore.kernel.org/r/20251021-vsock-vmtest-v7-0-0661b7b6f081@meta.com v6: https://lore.kernel.org/r/20250916-vsock-vmtest-v6-0-064d2eb0c89d@meta.com v5: https://lore.kernel.org/r/20250827-vsock-vmtest-v5-0-0ba580bede5b@meta.com v4: https://lore.kernel.org/r/20250805-vsock-vmtest-v4-0-059ec51ab111@meta.com v2: https://lore.kernel.org/kvm/20250312-vsock-netns-v2-0-84bffa1aa97a@gmail.com v1: https://lore.kernel.org/r/20200116172428.311437-1-sgarzare@redhat.com ==================== Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-0-2859a7512097@meta.com Signed-off-by: Paolo Abeni commit b3b7b33264c69a3a97723c31a14c7a19b2fce503 Author: Bobby Eshleman Date: Wed Jan 21 14:11:52 2026 -0800 selftests/vsock: add tests for namespace deletion Add tests that validate vsock sockets are resilient to deleting namespaces. The vsock sockets should still function normally. The function check_ns_delete_doesnt_break_connection() is added to re-use the step-by-step logic of 1) setup connections, 2) delete ns, 3) check that the connections are still ok. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-12-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 0424ee7c3a1721c099544f36580cf6dd1661856d Author: Bobby Eshleman Date: Wed Jan 21 14:11:51 2026 -0800 selftests/vsock: add tests for host <-> vm connectivity with namespaces Add tests to validate namespace correctness using vsock_test and socat. The vsock_test tool is used to validate expected success tests, but socat is used for expected failure tests. socat is used to ensure that connections are rejected outright instead of failing due to some other socket behavior (as tested in vsock_test). Additionally, socat is already required for tunneling TCP traffic from vsock_test. Using only one of the vsock_test tests like 'test_stream_client_close_client' would have yielded a similar result, but doing so wouldn't remove the socat dependency. Additionally, check for the dependency socat. socat needs special handling beyond just checking if it is on the path because it must be compiled with support for both vsock and unix. The function check_socat() checks that this support exists. Add more padding to test name printf strings because the tests added in this patch would otherwise overflow. Add vm_dmesg_* helpers to encapsulate checking dmesg for oops and warnings. Add ability to pass extra args to host-side vsock_test so that tests that cause false positives may be skipped with arg --skip. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-11-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 605caec5adc2956263a86b48eecfc52ee5c95dae Author: Bobby Eshleman Date: Wed Jan 21 14:11:50 2026 -0800 selftests/vsock: add namespace tests for CID collisions Add tests to verify CID collision rules across different vsock namespace modes. 1. Two VMs with the same CID cannot start in different global namespaces (ns_global_same_cid_fails) 2. Two VMs with the same CID can start in different local namespaces (ns_local_same_cid_ok) 3. VMs with the same CID can coexist when one is in a global namespace and another is in a local namespace (ns_global_local_same_cid_ok and ns_local_global_same_cid_ok) The tests ns_global_local_same_cid_ok and ns_local_global_same_cid_ok make sure that ordering does not matter. The tests use a shared helper function namespaces_can_boot_same_cid() that attempts to start two VMs with identical CIDs in the specified namespaces and verifies whether VM initialization failed or succeeded. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-10-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 06cf7895abf9080c050767c66b95d79d99e2c7e8 Author: Bobby Eshleman Date: Wed Jan 21 14:11:49 2026 -0800 selftests/vsock: add tests for proc sys vsock ns_mode Add tests for the /proc/sys/net/vsock/{ns_mode,child_ns_mode} interfaces. Namely, that they accept/report "global" and "local" strings and enforce their access policies. Start a convention of commenting the test name over the test description. Add test name comments over test descriptions that existed before this convention. Add a check_netns() function that checks if the test requires namespaces and if the current kernel supports namespaces. Skip tests that require namespaces if the system does not have namespace support. This patch is the first to add tests that do *not* re-use the same shared VM. For that reason, it adds a run_ns_tests() function to run these tests and filter out the shared VM tests. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-9-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 7418f3bb3aa289fbf52f93b551e79ba647371f51 Author: Bobby Eshleman Date: Wed Jan 21 14:11:48 2026 -0800 selftests/vsock: use ss to wait for listeners instead of /proc/net Replace /proc/net parsing with ss(8) for detecting listening sockets in wait_for_listener() functions and add support for TCP, VSOCK, and Unix socket protocols. The previous implementation parsed /proc/net/tcp using awk to detect listening sockets, but this approach could not support vsock because vsock does not export socket information to /proc/net/. Instead, use ss so that we can detect listeners on tcp, vsock, and unix. The protocol parameter is now required for all wait_for_listener family functions (wait_for_listener, vm_wait_for_listener, host_wait_for_listener) to explicitly specify which socket type to wait for. ss is added to the dependency check in check_deps(). Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-8-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 4e870ac81df7e9628bdc08ff6f957a42e80582ee Author: Bobby Eshleman Date: Wed Jan 21 14:11:47 2026 -0800 selftests/vsock: add vm_dmesg_{warn,oops}_count() helpers These functions are reused by the VM tests to collect and compare dmesg warnings and oops counts. The future VM-specific tests use them heavily. This patches relies on vm_ssh() already supporting namespaces. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-7-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit fd1b41725d585f29029b8d8610a155f26727c18e Author: Bobby Eshleman Date: Wed Jan 21 14:11:46 2026 -0800 selftests/vsock: prepare vm management helpers for namespaces Add namespace support to vm management, ssh helpers, and vsock_test wrapper functions. This enables running VMs and test helpers in specific namespaces, which is required for upcoming namespace isolation tests. The functions still work correctly within the init ns, though the caller must now pass "init_ns" explicitly. No functional changes for existing tests. All have been updated to pass "init_ns" explicitly. Affected functions (such as vm_start() and vm_ssh()) now wrap their commands with 'ip netns exec' when executing commands in non-init namespaces. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-6-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 423ec6383edba92e78abbb99a776147b3fe7b2ca Author: Bobby Eshleman Date: Wed Jan 21 14:11:45 2026 -0800 selftests/vsock: add namespace helpers to vmtest.sh Add functions for initializing namespaces with the different vsock NS modes. Callers can use add_namespaces() and del_namespaces() to create namespaces global0, global1, local0, and local1. The add_namespaces() function initializes global0, local0, etc... with their respective vsock NS mode by toggling child_ns_mode before creating the namespace. Remove namespaces upon exiting the program in cleanup(). This is unlikely to be needed for a healthy run, but it is useful for tests that are manually killed mid-test. This patch is in preparation for later namespace tests. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-5-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 873e7de9f9a3b67b08b380057b2c7828b0d78cae Author: Bobby Eshleman Date: Wed Jan 21 14:11:44 2026 -0800 selftests/vsock: increase timeout to 1200 Increase the timeout from 300s to 1200s. On a modern bare metal server my last run showed the new set of tests taking ~400s. Multiply by an (arbitrary) factor of three to account for slower/nested runners. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-4-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit a69686327e42912e87d1f4be23f54ce1eae4dbd2 Author: Bobby Eshleman Date: Wed Jan 21 14:11:43 2026 -0800 vsock: add netns support to virtio transports Add netns support to loopback and vhost. Keep netns disabled for virtio-vsock, but add necessary changes to comply with common API updates. This is the patch in the series when vhost-vsock namespaces actually come online. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-3-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit a6ae12a599e0f16bc01a38bcfe8d0278a26b5ee0 Author: Bobby Eshleman Date: Wed Jan 21 14:11:42 2026 -0800 virtio: set skb owner of virtio_transport_reset_no_sock() reply Associate reply packets with the sending socket. When vsock must reply with an RST packet and there exists a sending socket (e.g., for loopback), setting the skb owner to the socket correctly handles reference counting between the skb and sk (i.e., the sk stays alive until the skb is freed). This allows the net namespace to be used for socket lookups for the duration of the reply skb's lifetime, preventing race conditions between the namespace lifecycle and vsock socket search using the namespace pointer. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-2-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit eafb64f40ca49c79f0769aab25d0fae5c9d3becb Author: Bobby Eshleman Date: Wed Jan 21 14:11:41 2026 -0800 vsock: add netns to vsock core Add netns logic to vsock core. Additionally, modify transport hook prototypes to be used by later transport-specific patches (e.g., *_seqpacket_allow()). Namespaces are supported primarily by changing socket lookup functions (e.g., vsock_find_connected_socket()) to take into account the socket namespace and the namespace mode before considering a candidate socket a "match". This patch also introduces the sysctl /proc/sys/net/vsock/ns_mode to report the mode and /proc/sys/net/vsock/child_ns_mode to set the mode for new namespaces. Add netns functionality (initialization, passing to transports, procfs, etc...) to the af_vsock socket layer. Later patches that add netns support to transports depend on this patch. This patch changes the allocation of random ports for connectible vsocks in order to avoid leaking the random port range starting point to other namespaces. dgram_allow(), stream_allow(), and seqpacket_allow() callbacks are modified to take a vsk in order to perform logic on namespace modes. In future patches, the net will also be used for socket lookups in these functions. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-1-2859a7512097@meta.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit a4cf8f97223d94fc85735471a67f6935de5a4ac5 Author: Robert Marko Date: Thu Jan 15 12:37:31 2026 +0100 dt-bindings: pinctrl: pinctrl-microchip-sgpio: add LAN969x Document LAN969x compatibles for SGPIO. Signed-off-by: Robert Marko Acked-by: Conor Dooley Reviewed-by: Claudiu Beznea Signed-off-by: Linus Walleij commit 09b174f1a554d69b9f69f3c6c115db12c1f6d29d Author: Michael Tretter Date: Mon Jan 26 15:27:48 2026 +0100 regulator: bd71815: switch to devm_fwnode_gpiod_get_optional Use the devm_fwnode_gpiod_get_optional variant to simplify the error handling code. Reviewed-by: Matti Vaittinen Acked-by: Mark Brown Signed-off-by: Michael Tretter Link: https://lore.kernel.org/r/20260126-gpio-devm_fwnode_gpiod_get_optional-v2-2-ec34f8e35077@pengutronix.de Signed-off-by: Bartosz Golaszewski commit 364713741ca19b8f6a506d073af1deff5b2d124a Author: Stefan Kerkmann Date: Mon Jan 26 15:27:47 2026 +0100 gpiolib: introduce devm_fwnode_gpiod_get_optional() wrapper The helper makes it easier to handle optional GPIOs and simplifies the error handling code. Signed-off-by: Stefan Kerkmann Signed-off-by: Michael Tretter Reviewed-by: Matti Vaittinen Link: https://lore.kernel.org/r/20260126-gpio-devm_fwnode_gpiod_get_optional-v2-1-ec34f8e35077@pengutronix.de Signed-off-by: Bartosz Golaszewski commit b20d212f6ce96b23ef5feda7dd3897102bf116eb Author: Jens Emil Schulz Østergaard Date: Mon Jan 19 16:06:11 2026 +0100 pinctrl: ocelot: Extend support for lan9645xf family Extend pinctrl-ocelot driver to support the lan9645xf chip family. Reviewed-by: Steen Hegelund Reviewed-by: Daniel Machon Signed-off-by: Jens Emil Schulz Østergaard Signed-off-by: Linus Walleij commit 96bfeba89e633dfb043240645b2ddf4881c8ca6e Author: Jens Emil Schulz Østergaard Date: Mon Jan 19 16:06:10 2026 +0100 pinctrl: ocelot: Update alt mode reg addr calculation Lan9645x is the first chip supported by this driver where the pin stride is different from the alt mode stride. With 51 pins and up to 7 alt modes, we have stride = 2 and alt_mode_stride = 3. The current REG_ALT macro has the implicit assumption that these numbers are equal, so it does not work for lan9645x. The pin stride is the 'stride' variable in the driver. It is the size of certain register groups which depends on the number of pins supported by the device. Generally we have stride = DIV_ROUND_UP(npins, 32). E.g: GPIO_OUT_SET0 GPIO_OUT_SET1 ... GPIO_OUT_SETn The alt mode registers are further replicated by the number of bits necessary to represent the alt mode. For instance if we need 3 bits to represent the alt mode: GPIO_ALT0[0-2] GPIO_ALT1[0-2] To set alt mode 3 on pin 12, it is necessary to perform writes GPIO_ALT0[0] |= BIT(12) GPIO_ALT0[1] |= BIT(12) GPIO_ALT0[2] &= ~BIT(12) The stride and alt mode stride are used by the REG_ALT macro to calculate the alt mode register address for a given pin. This adds the option to specify n_alt_modes, which is used to set info->altm_stride. The default value is info->stride, to make sure existing devices are unaffected by this change. Reviewed-by: Steen Hegelund Reviewed-by: Daniel Machon Signed-off-by: Jens Emil Schulz Østergaard Reviewed-by: Alexandre Belloni Signed-off-by: Linus Walleij commit cb07e60ba4779e33a02c0e7041f829021b21dbcf Author: Jens Emil Schulz Østergaard Date: Mon Jan 19 16:06:09 2026 +0100 dt-bindings: pinctrl: ocelot: Add LAN9645x SoC support Add documentation for the compatibles designated for the following SKUs in the LAN9645x family: lan96455f lan96457f lan96459f with fallback a compatible for the smallest 5-ported SKUs lan96455f. Reviewed-by: Steen Hegelund Reviewed-by: Daniel Machon Signed-off-by: Jens Emil Schulz Østergaard Acked-by: Rob Herring (Arm) Signed-off-by: Linus Walleij commit 6da9f0cc2717158857f8b8b9369523d0d6770c07 Author: Shiji Yang Date: Sat Jan 17 11:04:37 2026 +0800 pinctrl: mediatek: enable ies_present flag for MT798x The MT798x series SoCs have IES regiter definitions. I think we must enable the ies_present flag to correctly configure the pin input mode. Signed-off-by: Shiji Yang Signed-off-by: Linus Walleij commit 7bb0dbf9fc403f65cff33c91ea266683e33b2f04 Author: Jegor van Opdorp Date: Tue Jan 27 09:15:41 2026 +0100 ALSA: usb-audio: add mixer support for Focusrite Forte Add mixer control support for the Focusrite Forte (USB ID 0x1235:0x8010), an older USB audio interface that predates the Scarlett 2nd generation. The Forte uses UAC2_CS_MEM (bRequest=0x03) for its input controls rather than the standard UAC2_CS_CUR (0x01) used by Scarlett devices. This patch adds Forte-specific control handlers that use the correct USB protocol. Features implemented: - Input source selection (Mic/Line/Inst) for both channels - High pass filter switch - 48V phantom power switch - Phase invert switch - Pad switch - Preamp gain control (0-42 range, ~0-75dB) - Matrix mixer controls (6 inputs x 4 outputs) - Output volume and mute controls The device is registered via mixer_quirks.c and uses the existing mixer_scarlett.c infrastructure with Forte-specific additions. Credit: This work builds on prior reverse-engineering by alastair-dm. Link: https://github.com/alastair-dm/forte-mixer/wiki Link: https://github.com/alastair-dm/forte-mixer Link: https://github.com/jopdorp/forte-mixer Signed-off-by: Jegor van Opdorp Link: https://patch.msgid.link/20260127081541.219669-1-jegorvanopdorp@gmail.com Signed-off-by: Takashi Iwai commit f2581ea2d9f30844c437e348a462027ea25c12e9 Author: gongqi <550230171hxy@gmail.com> Date: Thu Jan 22 23:55:01 2026 +0800 ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro The headset microphone on the MECHREVO Wujie 15X Pro requires the CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID (0x1d05:0x3012) to the quirk table. Signed-off-by: gongqi <550230171hxy@gmail.com> Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com Signed-off-by: Takashi Iwai commit e4808c60b1b1548631041c7db60da06b7d3a3662 Author: Shenghao Ding Date: Mon Jan 26 11:18:16 2026 +0800 ALSA: hda/tas2781: Add tas2781_hda::catlog_id init The default of tas2781_hda::catlog_id is DELL, which cause calibration data is not loaded in HP SPI-basded Laptop, because only HP laptop supports SPI-based TAS2781. Fixes: 9fa6a693ad8d ("ALSA: hda/tas2781: Remove tas2781_spi_fwlib.c and leverage SND_SOC_TAS2781_FMWLIB") Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20260126031816.1123-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit bfa514c4613b39e536d4a9dfbcb8eb8e68776343 Author: Thorsten Blum Date: Sun Jan 25 16:51:56 2026 +0100 ALSA: jack: Improve string handling in jack_kctl_name_gen If appending " Jack" is not necessary, replace snprintf("%s", ...) with the faster strscpy(). Additionally, rename 'need_cat' to the clearer 'append_suf', use local variables for the suffix and its length, remove the confusing comment, compare strncmp() to 0, and use 'size_t' for the 'size' function parameter. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20260125155159.98720-1-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit cc051fbd7f40226cc407558bc97c5099513e8657 Author: Damien Dagorn Date: Fri Jan 23 18:14:52 2026 +0100 ALSA: hda/realtek: fix LG Gram Style 14 speakers The LG Gram Style 14 (14Z90RS-G.AD77F, SSID 1854:0490) with Realtek ALC298 shows normal routing and volume changes, but internal speakers stay silent unless a userland HDA-verb workaround is applied. Add a dedicated quirk for the LG Gram Style 14 that programs the codec coefficient sequence used by the known workaround and enables the speaker amps only during playback. Tested-by: Damien Dagorn Signed-off-by: Damien Dagorn Link: https://lore.kernel.org/CAN59QMUhd4kHrkRoJA6VzEr2VKezN2yjHnANaQoZn2-Bnwe3bQ@mail.gmail.com Signed-off-by: Takashi Iwai commit 0b7fbf9333fa4699a53145bad8ce74ea986caa13 Author: Felix Gu Date: Wed Jan 21 23:32:06 2026 +0800 cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In scmi_cpu_domain_id(), it does not release the reference. Fixes: e336baa4193e ("cpufreq: scmi: Prepare to move OF parsing of domain-id to cpufreq") Signed-off-by: Felix Gu Signed-off-by: Viresh Kumar commit dea8bfea76e4bea9f727f777604d4053d7e9cd92 Author: Dhruva Gole Date: Tue Jan 20 17:17:31 2026 +0530 cpufreq: ti-cpufreq: add support for AM62L3 SoC Add CPUFreq support for the AM62L3 SoC with the appropriate AM62L3 speed grade constants according to the datasheet [1]. This follows the same architecture-specific implementation pattern as other TI SoCs in the AM6x family. While at it, also sort instances where the SOC family names were not sorted alphabetically. [1] https://www.ti.com/lit/pdf/SPRSPA1 Signed-off-by: Dhruva Gole Reviewed-by: Kendall Willis Signed-off-by: Viresh Kumar commit 945fc28a06a1d30315ca416167754e10208024a5 Author: Dhruva Gole Date: Tue Jan 20 17:17:30 2026 +0530 cpufreq: dt-platdev: Add ti,am62l3 to blocklist Add AM62L3 SoC to the dt-platdev blocklist to ensure proper handling of CPUFreq functionality. The AM62L3 will use its native TI CPUFreq driver implementation instead of the generic dt-platdev driver. This follows the same pattern as other TI SoCs like AM62A7, AM62D2, and AM62P5 which have been previously added to this blocklist. Reviewed-by: Kendall Willis Signed-off-by: Dhruva Gole Signed-off-by: Viresh Kumar commit 94dbce6c13cd7634f9bdb402248991c95a8c3d57 Author: Juan Martinez Date: Fri Jan 16 15:45:39 2026 -0600 cpufreq/amd-pstate: Add comment explaining nominal_perf usage for performance policy Add comment explaining why nominal_perf is used for MinPerf when the CPU frequency policy is set to CPUFREQ_POLICY_PERFORMANCE, rather than using highest_perf or lowest_nonlinear_perf. Signed-off-by: Juan Martinez Signed-off-by: Viresh Kumar commit 8c376f337a7e31c42949247e24eaad9a30d6c62c Author: Sergey Shtylyov Date: Tue Jan 13 22:33:30 2026 +0300 cpufreq: scmi: correct SCMI explanation SCMI stands for System Control and Management Interface, not System Control and Power Interface -- apparently, Sudeep Holla copied this line from his SCPI driver and then just forgot to update the acronym explanation... :-) Fixes: 99d6bdf33877 ("cpufreq: add support for CPU DVFS based on SCMI message protocol") Signed-off-by: Sergey Shtylyov Reviewed-by: Sudeep Holla Signed-off-by: Viresh Kumar commit 7b781899072c5701ef9538c365757ee9ab9c00bd Author: Konrad Dybcio Date: Tue Jan 13 16:25:35 2026 +0100 cpufreq: dt-platdev: Block the driver from probing on more QC platforms Add a number of QC platforms to the blocklist, they all use either the qcom-cpufreq-hw driver. Signed-off-by: Konrad Dybcio Signed-off-by: Viresh Kumar commit 11af6e102d31433e3084d6d6cdb2b2fe6c23d1a9 Author: Yilin Chen <1479826151@qq.com> Date: Mon Jan 12 16:00:47 2026 +0800 rust: cpumask: rename methods of Cpumask for clarity and consistency Rename `as_ref` and `as_mut_ref` to `from_raw` and `from_raw_mut` to align with the established naming convention for constructing types from raw pointers in the kernel's Rust codebase. Signed-off-by: Yilin Chen <1479826151@qq.com> Reviewed-by: Gary Guo Reviewed-by: Alice Ryhl Signed-off-by: Viresh Kumar commit 997c021abc6eb9cf7df39fa77fa5e666ad55e3a3 Author: Jie Zhan Date: Tue Dec 23 15:21:19 2025 +0800 cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs Currently, the CPPC Frequency Invariance Engine (FIE) is invoked from the scheduler tick but defers the update of arch_freq_scale to a separate thread because cppc_get_perf_ctrs() would sleep if the CPC regs are in PCC. However, this deferred update mechanism is unnecessary and introduces extra overhead for non-PCC register spaces (e.g. System Memory or FFH), where accessing the regs won't sleep and can be safely performed from the tick context. Furthermore, with the CPPC FIE registered, it throws repeated warnings of "cppc_scale_freq_workfn: failed to read perf counters" on our platform with the CPC regs in System Memory and a power-down idle state enabled. That's because the remote CPU can be in a power-down idle state, and reading its perf counters returns 0. Moving the FIE handling back to the scheduler tick process makes the CPU handle its own perf counters, so it won't be idle and the issue would be inherently solved. To address the above issues, update arch_freq_scale directly in ticks for non-PCC regs and keep the deferred update mechanism for PCC regs. Reviewed-by: Lifeng Zheng Reviewed-by: Pierre Gondois Signed-off-by: Jie Zhan Signed-off-by: Viresh Kumar commit 206b6612556398e717b1e293d96992d5ab2b8f32 Author: Jie Zhan Date: Tue Dec 23 15:21:18 2025 +0800 cpufreq: CPPC: Factor out cppc_fie_kworker_init() Factor out the CPPC FIE kworker init in cppc_freq_invariance_init() because it's a standalone procedure for use when the CPC regs are in PCC channels. Reviewed-by: Lifeng Zheng Reviewed-by: Pierre Gondois Signed-off-by: Jie Zhan Signed-off-by: Viresh Kumar commit f9cadb3d56912a70571fdd95f426b757557c465b Author: Jie Zhan Date: Tue Dec 23 15:21:17 2025 +0800 ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() Factor out cppc_perf_ctrs_in_pcc_cpu() for checking whether per-cpu CPC regs are defined in PCC channels, and export it out for further use. Reviewed-by: Lifeng Zheng Reviewed-by: Pierre Gondois Signed-off-by: Jie Zhan Acked-by: Rafael J. Wysocki (Intel) Signed-off-by: Viresh Kumar commit e05d9e5c8b754cc7d72acd896f5f7caf6b78a973 Author: Tamir Duberstein Date: Mon Dec 22 13:29:32 2025 +0100 rust: cpufreq: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Reviewed-by: Daniel Almeida Acked-by: Danilo Krummrich Signed-off-by: Viresh Kumar commit d6a6c58da38e4c4564e841faf3880769ff09936b Author: Aaron Kling Date: Thu Dec 18 15:39:52 2025 -0600 cpufreq: Add Tegra186 and Tegra194 to cpufreq-dt-platdev blocklist These have platform specific drivers. Signed-off-by: Aaron Kling Signed-off-by: Viresh Kumar commit e79cc7b5eba255fc0534212d25ee6142213d5314 Author: Luca Weiss Date: Wed Dec 10 10:43:25 2025 +0900 dt-bindings: cpufreq: qcom-hw: document Milos CPUFREQ Hardware Document the CPUFREQ Hardware on the Milos SoC. Acked-by: Rob Herring (Arm) Acked-by: Viresh Kumar Signed-off-by: Luca Weiss Signed-off-by: Viresh Kumar commit 9d84fd86d9ce26be72f1cf6839a9335005734d4f Author: Alice Ryhl Date: Tue Dec 2 19:37:35 2025 +0000 rust: cpufreq: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Signed-off-by: Alice Ryhl Reviewed-by: Boqun Feng Signed-off-by: Viresh Kumar commit 8c8b12a55614ea05953e8d695e700e6e1322a05d Author: Alexandre Courbot Date: Fri Nov 28 11:11:39 2025 +0900 rust: cpufreq: always inline functions using build_assert with arguments `build_assert` relies on the compiler to optimize out its error path. Functions using it with its arguments must thus always be inlined, otherwise the error path of `build_assert` might not be optimized out, triggering a build error. Signed-off-by: Alexandre Courbot Reviewed-by: Daniel Almeida Signed-off-by: Viresh Kumar commit 68abacb0686651dd3f0bbce2fa94b438afeb2fc4 Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 01:15:47 2026 -0300 perf jitdump: Constify variables storing the result of strchr() on const tables As newer glibcs will propagate the const attribute of the searched table to its return. Signed-off-by: Arnaldo Carvalho de Melo commit 8bf093acb3f1f07d846c86e32308f9f9954ed579 Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 01:15:47 2026 -0300 perf bpf-event: Constify variables storing the result of strchr() on const tables As newer glibcs will propagate the const attribute of the searched table to its return. Signed-off-by: Arnaldo Carvalho de Melo commit 79bba3a1834e7ba6c437674582cc9f3ae6fb638c Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 01:15:47 2026 -0300 perf demangle-java: Constify variables storing the result of strchr() on const tables As newer glibcs will propagate the const attribute of the searched table to its return. Signed-off-by: Arnaldo Carvalho de Melo commit 21c0bc9144834e39762dd6fddbb255ebb80cf079 Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 01:15:47 2026 -0300 perf time-utils: Constify variables storing the result of strchr() on const tables As newer glibcs will propagate the const attribute of the searched table to its return. Signed-off-by: Arnaldo Carvalho de Melo commit 0b7277e02dabba2a9921a7f4761ae6e627e7297a Author: Aleks Todorov Date: Fri Jan 23 14:03:44 2026 +0000 OPP: Return correct value in dev_pm_opp_get_level Commit 073d3d2ca7d4 ("OPP: Level zero is valid") modified the documentation for this function to indicate that errors should return a non-zero value to avoid colliding with the OPP level zero, however forgot to actually update the return. No in-tree kernel code depends on the error value being 0. Fixes: 073d3d2ca7d4 ("OPP: Level zero is valid") Signed-off-by: Aleks Todorov Signed-off-by: Viresh Kumar commit 0e14cb3b24f8f301cf6490a4493afc98321ed5bb Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 01:15:47 2026 -0300 perf units: Constify variables storing the result of strchr() on const tables As newer glibcs will propagate the const attribute of the searched table to its return. Signed-off-by: Arnaldo Carvalho de Melo commit 97b81df7225830c4db3c17ed1235d2f3eb613d3d Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 01:15:47 2026 -0300 perf trace-event: Constify variables storing the result of strchr() on const tables As newer glibcs will propagate the const attribute of the searched table to its return. Signed-off-by: Arnaldo Carvalho de Melo commit 0341eab66ba03a1f439db91f03bccd5b0a360842 Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 02:22:00 2026 -0300 perf tp_pmu: Address const-correctness errors in recent glibcs To avoid having more variables, just cast the const variable searched to non-const since the result will not be modified, its only later that that variable will be used to modify something, but then its non-const memory being modified, so using a cast is the cheapest thing here. Signed-off-by: Arnaldo Carvalho de Melo commit 0e47251e8cc438d5b59fcd86d27efade01976fe1 Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 02:15:30 2026 -0300 perf hwmon_pmu: Constify the variables returning bsearch() on const tables To address const-correctness errors on newer glibcs (-Werror=discarded-qualifiers). Signed-off-by: Arnaldo Carvalho de Melo commit f1321cce848c558fde4c0c6bcd5e53f3cefd3af2 Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 02:09:37 2026 -0300 perf session: Don't write to memory pointed to a const pointer Since it is freshly allocated just attribute it to a non-const pointer and then change it via that pointer. That way we avoid const-correctness warnings in recent glibc versions. Signed-off-by: Arnaldo Carvalho de Melo commit 678ed6b707e4b2db250f255d2f959322896dae65 Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 02:03:01 2026 -0300 perf strlist: Don't write to const memory Do a strdup to the list string and parse from it, free at the end. This is to deal with newer glibcs const-correctness. Signed-off-by: Arnaldo Carvalho de Melo commit b42868624c7d00206f77d19a6fbfea73a44ff6f2 Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 01:15:47 2026 -0300 perf metricgroup: Constify variables storing the result of strchr() on const tables As newer glibcs will propagate the const attribute of the searched table to its return. Signed-off-by: Arnaldo Carvalho de Melo commit 23262369e650c9995505eb4f69f16449467e6bfe Author: Arnaldo Carvalho de Melo Date: Tue Jan 27 01:15:47 2026 -0300 perf disasm: Constify variables storing the result of bsearch() on const tables As newer glibcs will propagate the const attribute of the searched table to its return. Signed-off-by: Arnaldo Carvalho de Melo commit 4b870f62c5079b48a6a19c852f4db5d2569a5239 Author: Ian Rogers Date: Mon Jan 26 14:05:50 2026 -0800 perf thread-stack: Switch thread_stack__init() to use e_machine The architecture type is used to set the retpoline state. Rather than use the arch string switch to using the ELF machine that's readily available within the thread. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Shimin Guo Cc: Yujie Liu Signed-off-by: Arnaldo Carvalho de Melo commit f33e7aa42ea79f2142f073df777c01125def45e5 Author: Ian Rogers Date: Mon Jan 26 14:05:49 2026 -0800 perf callchain: Switch callchain_param_setup from an arch to an e_machine Increase use of e_machine by replacing callchain_param_setup's arch argument to be an e_machine typically read from the session. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Shimin Guo Cc: Yujie Liu Signed-off-by: Arnaldo Carvalho de Melo commit 7ce6dfc603ed01044ebe58472a584d9995281ca2 Author: Ian Rogers Date: Mon Jan 26 14:05:48 2026 -0800 perf script: Fix script_fetch_insn for more than just x86 The script_fetch_insn code was only supported on natively running x86. Implement a crude elf_machine_max_instruction_length function and use to give an instruction length on more than just x86. Use the ELF machine to determine the length to use to support cross-architecture development. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Shimin Guo Cc: Yujie Liu [ Conditionally define EM_CSKY and EM_LOONGARCH for older distros ] Signed-off-by: Arnaldo Carvalho de Melo commit 0d56d9ca9febfb4338053fcf493c008616d5a61c Merge: 72a41750f1a35b cefcb9297fbdb6 Author: Jens Axboe Date: Mon Jan 26 21:08:10 2026 -0700 Merge tag 'md-7.0-20260127' of git://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into for-7.0/block Pull MD updates from Yu: "Bug Fixes: - Fix raid5_run() to return error when log_init() fails (Yu Kuai) - Fix IO hang with degraded array with llbitmap (Yu Kuai) - Fix percpu_ref not resurrected on suspend timeout in llbitmap (Yu Kuai) - Fix GPF in write_page caused by resize race (Jack Wang) - Fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) - Fix hang when stopping arrays with metadata through dm-raid (Heinz Mauelshagen) - Fix any_working flag handling in raid10_sync_request (Li Nan) Cleanups & Refactoring: - Refactor sync/recovery code path, improve error handling for badblocks, and remove unused recovery_disabled field (Li Nan) - Consolidate mddev boolean fields into mddev_flags (Yu Kuai) Improvements: - Use mempool to allocate stripe_request_ctx and make sure max_sectors is not less than io_opt in raid5 (Yu Kuai)" * tag 'md-7.0-20260127' of git://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: (23 commits) md raid: fix hang when stopping arrays with metadata through dm-raid md-cluster: fix NULL pointer dereference in process_metadata_update md/bitmap: fix GPF in write_page caused by resize race md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout md/raid5: fix IO hang with degraded array with llbitmap md: remove recovery_disabled md/raid10: cleanup skip handling in raid10_sync_request md/raid10: fix any_working flag handling in raid10_sync_request md: move finish_reshape to md_finish_sync() md: factor out sync completion update into helper md: remove MD_RECOVERY_ERROR handling and simplify resync_offset update md: update curr_resync_completed even when MD_RECOVERY_INTR is set md: mark rdev Faulty when badblocks setting fails md: break remaining operations on badblocks set failure in narrow_write_error md/raid1,raid10: support narrow_write_error when badblocks is disabled md: factor error handling out of md_done_sync into helper md/raid1: simplify uptodate handling in end_sync_write md/raid5: make sure max_sectors is not less than io_opt md/raid5: use mempool to allocate stripe_request_ctx md: merge mddev serialize_policy into mddev_flags ... commit 72a41750f1a35b46caa5bbd70df7b5d3ce4f4b0a Author: Keith Busch Date: Mon Jan 26 08:27:24 2026 -0800 block: remove bio_last_bvec_all There are no more callers of this function after commit f6b2d8b134b2413 ("btrfs: track the next file offset in struct btrfs_bio_ctrl"), so remove the function. Signed-off-by: Keith Busch Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit 6fe0e6d599a6bb4b65704285d40d4972423b7aaa Author: SeongJae Park Date: Thu Jan 15 07:20:45 2026 -0800 mm/damon: hide kdamond and kdamond_lock of damon_ctx There is no DAMON API caller that directly access 'kdamond' and 'kdamond_lock' fields of 'struct damon_ctx'. Keeping those exposed could only encourage creative but error-prone usages. Hide them from DAMON API callers by marking those as private fields. Link: https://lkml.kernel.org/r/20260115152047.68415-6-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 33402229d28d837ceb4c8bcebc96dc509d9203f9 Author: SeongJae Park Date: Thu Jan 15 07:20:44 2026 -0800 mm/damon/reclaim: use damon_kdamond_pid() DAMON_RECLAIM directly uses damon_ctx->kdamond field with manual synchronization using damon_ctx->kdamond_lock, to get the pid of the kdamond. Use a new dedicated function for the purpose, namely damon_kdamond_pid(), since that doesn't require manual and error-prone synchronization. Link: https://lkml.kernel.org/r/20260115152047.68415-5-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 306550f0a5817d271361aa010fd245a4b43af725 Author: SeongJae Park Date: Thu Jan 15 07:20:43 2026 -0800 mm/damon/lru_sort: use damon_kdamond_pid() DAMON_LRU_SORT directly uses damon_ctx->kdamond field with manual synchronization using damon_ctx->kdamond_lock, to get the pid of the kdamond. Use a new dedicated function for the purpose, namely damon_kdamond_pid(), since that doesn't require manual and error-prone synchronization. Link: https://lkml.kernel.org/r/20260115152047.68415-4-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit f54b51ce31976b35c5aac239a3b59687196d6b9d Author: SeongJae Park Date: Thu Jan 15 07:20:42 2026 -0800 mm/damon/sysfs: use damon_kdamond_pid() DAMON sysfs interface directly uses damon_ctx->kdamond field with manual synchronization using damon_ctx->kdamond_lock, to get the pid of the kdamond. Use a new dedicated function for the purpose, namely damon_kdamond_pid(), since that doesn't require manual and error-prone synchronization. Avoid use of kdamond_lock outside of the core. Link: https://lkml.kernel.org/r/20260115152047.68415-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 4262c53236977de3ceaa3bf2aefdf772c9b874dd Author: SeongJae Park Date: Thu Jan 15 07:20:41 2026 -0800 mm/damon/core: implement damon_kdamond_pid() Patch series "mm/damon: hide kdamond and kdamond_lock from API callers". 'kdamond' and 'kdamond_lock' fields initially exposed to DAMON API callers for flexible synchronization and use cases. As DAMON API became somewhat complicated compared to the early days, Keeping those exposed could only encourage the API callers to invent more creative but complicated and difficult-to-debug use cases. Fortunately DAMON API callers didn't invent that many creative use cases. There exist only two use cases of 'kdamond' and 'kdamond_lock'. Finding whether the kdamond is actively running, and getting the pid of the kdamond. For the first use case, a dedicated API function, namely 'damon_is_running()' is provided, and all DAMON API callers are using the function for the use case. Hence only the second use case is where the fields are directly being used by DAMON API callers. To prevent future invention of complicated and erroneous use cases of the fields, hide the fields from the API callers. For that, provide new dedicated DAMON API functions for the remaining use case, namely damon_kdamond_pid(), migrate DAMON API callers to use the new function, and mark the fields as private fields. This patch (of 5): 'kdamond' and 'kdamond_lock' are directly being used by DAMON API callers for getting the pid of the corresponding kdamond. To discourage invention of creative but complicated and erroneous new usages of the fields that require careful synchronization, implement a new API function that can simply be used without the manual synchronizations. Link: https://lkml.kernel.org/r/20260115152047.68415-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260115152047.68415-2-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 291487b753b132b382884726f45bc3ffa6ac902e Author: Yury Norov Date: Wed Jan 14 12:22:15 2026 -0500 cgroup: use nodes_and() output where appropriate Now that nodes_and() returns true if the result nodemask is not empty, drop useless nodes_intersects() in guarantee_online_mems() and nodes_empty() in update_nodemasks_hier(), which both are O(N). Link: https://lkml.kernel.org/r/20260114172217.861204-4-ynorov@nvidia.com Signed-off-by: Yury Norov Reviewed-by: Gregory Price Reviewed-by: Joshua Hahn Acked-by: Tejun Heo Cc: Alistair Popple Cc: Byungchul Park Cc: David Hildenbrand Cc: "Huang, Ying" Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathew Brost Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Rakie Kim Cc: Rasmus Villemoes Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Waiman Long Cc: Yury Norov (NVIDIA) Cc: Zi Yan Signed-off-by: Andrew Morton commit 386781df63cb4d847f21dc9452d251a6d63d89b2 Author: Yury Norov Date: Wed Jan 14 12:22:14 2026 -0500 mm: use nodes_and() return value to simplify client code establish_demotion_targets() and kernel_migrate_pages() call node_empty() immediately after calling nodes_and(). Now that nodes_and() return false if nodemask is empty, drop the latter. Link: https://lkml.kernel.org/r/20260114172217.861204-3-ynorov@nvidia.com Signed-off-by: Yury Norov Reviewed-by: Gregory Price Reviewed-by: Joshua Hahn Acked-by: Vlastimil Babka Acked-by: David Hildenbrand (Red Hat) Cc: Alistair Popple Cc: Byungchul Park Cc: "Huang, Ying" Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathew Brost Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Rakie Kim Cc: Rasmus Villemoes Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Waiman Long Cc: Yury Norov (NVIDIA) Cc: Zi Yan Signed-off-by: Andrew Morton commit cbc064e708b687cd2dbc2b788c473e2a34e10f7c Author: Yury Norov Date: Wed Jan 14 12:22:13 2026 -0500 nodemask: propagate boolean for nodes_and{,not} Patch series "nodemask: align nodes_and{,not} with underlying bitmap ops". nodes_and{,not} are void despite that underlying bitmap_and(,not) return boolean, true if the result bitmap is non-empty. Align nodemask API, and simplify client code. This patch (of 3): Bitmap functions bitmap_and{,not} return boolean depending on emptiness of the result bitmap. The corresponding nodemask helpers ignore the returned value. Propagate the underlying bitmaps result to nodemasks users, as it simplifies user code. Link: https://lkml.kernel.org/r/20260114172217.861204-1-ynorov@nvidia.com Link: https://lkml.kernel.org/r/20260114172217.861204-2-ynorov@nvidia.com Signed-off-by: Yury Norov Reviewed-by: Gregory Price Reviewed-by: Joshua Hahn Reviewed-by: David Hildenbrand (Red Hat) Cc: Alistair Popple Cc: Byungchul Park Cc: "Huang, Ying" Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathew Brost Cc: Michal Hocko Cc: Michal Koutný Cc: Mike Rapoport Cc: Rakie Kim Cc: Rasmus Villemoes Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Vlastimil Babka Cc: Waiman Long Cc: Yury Norov (NVIDIA) Cc: Zi Yan Signed-off-by: Andrew Morton commit 641d47d4c9635987f2329054b1395421716d3fee Author: Rohan McLure Date: Fri Dec 19 04:09:44 2025 +1100 powerpc/mm: support page table check On creation and clearing of a page table mapping, instrument such calls by invoking page_table_check_pte_set and page_table_check_pte_clear respectively. These calls serve as a sanity check against illegal mappings. Enable ARCH_SUPPORTS_PAGE_TABLE_CHECK on powerpc, except when HUGETLB_PAGE is enabled (powerpc has some weirdness in how it implements set_huge_pte_at(), which may require some further work). See also: riscv support in commit 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") arm64 in commit 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") x86_64 in commit d283d422c6c4 ("x86: mm: add x86_64 support for page table check") [ajd@linux.ibm.com: rebase, add additional instrumentation, misc fixes] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-12-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Signed-off-by: Andrew Donnellan Reviewed-by: Christophe Leroy Reviewed-by: Pasha Tatashin Acked-by: Madhavan Srinivasan Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Alistair Popple Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit 2360f523a49bdc021cda3cb32a6003193551e0fc Author: Rohan McLure Date: Fri Dec 19 04:09:43 2025 +1100 powerpc/mm: use set_pte_at_unchecked() for internal usages In the new set_ptes() API, set_pte_at() (a special case of set_ptes()) is intended to be instrumented by the page table check facility. There are however several other routines that constitute the API for setting page table entries, including set_pmd_at() among others. Such routines are themselves implemented in terms of set_ptes_at(). A future patch providing support for page table checking on powerpc must take care to avoid duplicate calls to page_table_check_p{te,md,ud}_set(). Allow for assignment of pte entries without instrumentation through the set_pte_at_unchecked() routine introduced in this patch. Cause API-facing routines that call set_pte_at() to instead call set_pte_at_unchecked(), which will remain uninstrumented by page table check. set_ptes() is itself implemented by calls to __set_pte_at(), so this eliminates redundant code. [ajd@linux.ibm.com: don't change to unchecked for early boot/kernel mappings] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-11-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Signed-off-by: Andrew Donnellan Acked-by: Madhavan Srinivasan Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Pasha Tatashin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit 2f5e576598c915db18b7ccd0003be52458959ce7 Author: Rohan McLure Date: Fri Dec 19 04:09:42 2025 +1100 powerpc/mm: implement *_user_accessible_page() for ptes Page table checking depends on architectures providing an implementation of p{te,md,ud}_user_accessible_page. With refactorisations made on powerpc/mm, the pte_access_permitted() and similar methods verify whether a userland page is accessible with the required permissions. Since page table checking is the only user of p{te,md,ud}_user_accessible_page(), implement these for all platforms, using some of the same preliminary checks taken by pte_access_permitted() on that platform. Since commit 8e9bd41e4ce1 ("powerpc/nohash: Replace pte_user() by pte_read()") pte_user() is no longer required to be present on all platforms as it may be equivalent to or implied by pte_read(). Hence implementations of pte_user_accessible_page() are specialised. [ajd@linux.ibm.com: rebase and clean up] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-10-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Signed-off-by: Andrew Donnellan Reviewed-by: Pasha Tatashin Acked-by: Madhavan Srinivasan Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit d79f9c9cf703d873849253f82fb9d6e1bd2b36f1 Author: Rohan McLure Date: Fri Dec 19 04:09:41 2025 +1100 mm: provide address parameter to p{te,md,ud}_user_accessible_page() On several powerpc platforms, a page table entry may not imply whether the relevant mapping is for userspace or kernelspace. Instead, such platforms infer this by the address which is being accessed. Add an additional address argument to each of these routines in order to provide support for page table check on powerpc. [ajd@linux.ibm.com: rebase on arm64 changes] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-9-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Signed-off-by: Andrew Donnellan Reviewed-by: Pasha Tatashin Acked-by: Ingo Molnar # x86 Acked-by: Alexandre Ghiti # riscv Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit d7b4b67eb6b37aef1723a69add88c9a7add81308 Author: Rohan McLure Date: Fri Dec 19 04:09:40 2025 +1100 mm/page_table_check: reinstate address parameter in [__]page_table_check_pte_clear() This reverts commit aa232204c468 ("mm/page_table_check: remove unused parameter in [__]page_table_check_pte_clear"). Reinstate previously unused parameters for the purpose of supporting powerpc platforms, as many do not encode user/kernel ownership of the page in the pte, but instead in the address of the access. [ajd@linux.ibm.com: rebase, fix additional occurrence and loop handling] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-8-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Signed-off-by: Andrew Donnellan Reviewed-by: Pasha Tatashin Acked-by: Ingo Molnar # x86 Acked-by: Alexandre Ghiti # riscv Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit 649ec9e3d03c4908ef51731cd7b422c4a3e2ccff Author: Rohan McLure Date: Fri Dec 19 04:09:39 2025 +1100 mm/page_table_check: reinstate address parameter in [__]page_table_check_pmd_clear() This reverts commit 1831414cd729 ("mm/page_table_check: remove unused parameter in [__]page_table_check_pmd_clear"). Reinstate previously unused parameters for the purpose of supporting powerpc platforms, as many do not encode user/kernel ownership of the page in the pte, but instead in the address of the access. [ajd@linux.ibm.com: rebase on arm64 changes] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-7-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Signed-off-by: Andrew Donnellan Reviewed-by: Pasha Tatashin Acked-by: Ingo Molnar # x86 Acked-by: Alexandre Ghiti # riscv Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit 2e6ac078ce5d6a9dc96cab861359faac508eb56d Author: Rohan McLure Date: Fri Dec 19 04:09:38 2025 +1100 mm/page_table_check: reinstate address parameter in [__]page_table_check_pud_clear() This reverts commit 931c38e16499 ("mm/page_table_check: remove unused parameter in [__]page_table_check_pud_clear"). Reinstate previously unused parameters for the purpose of supporting powerpc platforms, as many do not encode user/kernel ownership of the page in the pte, but instead in the address of the access. [ajd@linux.ibm.com: rebase on arm64 changes] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-6-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Signed-off-by: Andrew Donnellan Reviewed-by: Pasha Tatashin Acked-by: Ingo Molnar # x86 Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit 0a5ae4483177a621f5498c349d31f24b1ef10739 Author: Rohan McLure Date: Fri Dec 19 04:09:37 2025 +1100 mm/page_table_check: provide addr parameter to page_table_check_ptes_set() To provide support for powerpc platforms, provide an addr parameter to the __page_table_check_ptes_set() and page_table_check_ptes_set() routines. This parameter is needed on some powerpc platforms which do not encode whether a mapping is for user or kernel in the pte. On such platforms, this can be inferred from the addr parameter. [ajd@linux.ibm.com: rebase on arm64 + riscv changes, update commit message] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-5-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Reviewed-by: Pasha Tatashin Acked-by: Alexandre Ghiti # riscv Signed-off-by: Andrew Donnellan Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit 6e2d8f9fc4edcbf9f4dd953e1f41b0ff64867e5b Author: Rohan McLure Date: Fri Dec 19 04:09:36 2025 +1100 mm/page_table_check: reinstate address parameter in [__]page_table_check_pmd[s]_set() This reverts commit a3b837130b58 ("mm/page_table_check: remove unused parameter in [__]page_table_check_pmd_set"). Reinstate previously unused parameters for the purpose of supporting powerpc platforms, as many do not encode user/kernel ownership of the page in the pte, but instead in the address of the access. Apply this to __page_table_check_pmds_set(), page_table_check_pmd_set(), and the page_table_check_pmd_set() wrapper macro. [ajd@linux.ibm.com: rebase on arm64 + riscv changes, update commit message] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-4-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Signed-off-by: Andrew Donnellan Reviewed-by: Pasha Tatashin Acked-by: Ingo Molnar # x86 Acked-by: Alexandre Ghiti # riscv Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit c4a0c5ff85b7ca0d5fbd71888965f40e55295b19 Author: Rohan McLure Date: Fri Dec 19 04:09:35 2025 +1100 mm/page_table_check: reinstate address parameter in [__]page_table_check_pud[s]_set() This reverts commit 6d144436d954 ("mm/page_table_check: remove unused parameter in [__]page_table_check_pud_set"). Reinstate previously unused parameters for the purpose of supporting powerpc platforms, as many do not encode user/kernel ownership of the page in the pte, but instead in the address of the access. Apply this to __page_table_check_puds_set(), page_table_check_puds_set() and the page_table_check_pud_set() wrapper macro. [ajd@linux.ibm.com: rebase on riscv + arm64 changes, update commit message] Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-3-755bc151a50b@linux.ibm.com Signed-off-by: Rohan McLure Signed-off-by: Andrew Donnellan Reviewed-by: Pasha Tatashin Acked-by: Ingo Molnar # x86 Acked-by: Alexandre Ghiti # riscv Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit ee329c29fde849a8b541a836de742a454942589e Author: Andrew Donnellan Date: Fri Dec 19 04:09:34 2025 +1100 arm64/mm: add addr parameter to __ptep_get_and_clear_anysz() To provide support for page table check on powerpc, we need to reinstate the address parameter in several functions, including page_table_check_{pte,pmd,pud}_clear(). In preparation for this, add the addr parameter to arm64's __ptep_get_and_clear_anysz() and change its callsites accordingly. Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-2-755bc151a50b@linux.ibm.com Signed-off-by: Andrew Donnellan Reviewed-by: Pasha Tatashin Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Alistair Popple Cc: Christophe Leroy Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Ingo Molnar Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Rohan McLure Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Signed-off-by: Andrew Morton commit 9ac4941aceb027809cc32689a2944fa7a69388e4 Author: Andrew Donnellan Date: Fri Dec 19 04:09:33 2025 +1100 arm64/mm: add addr parameter to __set_ptes_anysz() Patch series "Support page table check on PowerPC", v18. Support page table check on PowerPC. Page table check tracks the usage of of page table entries at each level to ensure that anonymous mappings have at most one writable consumer, and likewise that file-backed mappings are not simultaneously also anonymous mappings. In order to support this infrastructure, a number of helpers or stubs must be defined or updated for all powerpc platforms. Additionally, we separate set_pte_at() and set_pte_at_unchecked(), to allow for internal, uninstrumented mappings. On some PowerPC platforms, implementing {pte,pmd,pud}_user_accessible_page() requires the address. We revert previous changes that removed the address parameter from various interfaces, and add it to some other interfaces, in order to allow this. For now, we don't allow page table check alongside HUGETLB_PAGE, due to the arch-specific complexity of set_huge_page_at(). (I'm sure I could figure this out, but I have to get this version on this list before I leave my job.) This series was initially written by Rohan McLure, who has left IBM and is no longer working on powerpc. This patch (of 18): To provide support for page table check on powerpc, we need to reinstate the address parameter in several functions, including page_table_check_{ptes,pmds,puds}_set(). In preparation for this, add the addr parameter to arm64's __set_ptes_anysz() and change its callsites accordingly. Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-0-755bc151a50b@linux.ibm.com Link: https://lkml.kernel.org/r/20251219-pgtable_check_v18rebase-v18-1-755bc151a50b@linux.ibm.com Signed-off-by: Andrew Donnellan Reviewed-by: Pasha Tatashin Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: "Christophe Leroy (CS GROUP)" Cc: David Hildenbrand Cc: Donet Tom Cc: Guo Weikang Cc: Jason Gunthorpe Cc: Kevin Brodsky Cc: Madhavan Srinivasan Cc: Magnus Lindholm Cc: "Matthew Wilcox (Oracle)" Cc: Michael Ellerman Cc: Nicholas Miehlbradt Cc: Nicholas Piggin Cc: Paul Mackerras Cc: Qi Zheng Cc: "Ritesh Harjani (IBM)" Cc: Sweet Tea Dorminy Cc: Thomas Huth Cc: "Vishal Moola (Oracle)" Cc: Zi Yan Cc: Alexandre Ghiti Cc: Christophe Leroy Cc: Ingo Molnar Cc: Rohan McLure Signed-off-by: Andrew Morton commit 832d95b5314eea558cf4cc9ca40db10122ce8f63 Author: Matthew Wilcox (Oracle) Date: Fri Jan 9 04:13:43 2026 +0000 migrate: replace RMP_ flags with TTU_ flags Instead of translating between RMP_ and TTU_ flags, remove the RMP_ flags and just use the TTU_ flag space; there's plenty available. Possibly we should rename these to RMAP_ flags, and maybe even pass them in through rmap_walk_arg, but that can be done later. Link: https://lkml.kernel.org/r/20260109041345.3863089-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: Jann Horn Cc: Joshua Hahn Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Brost Cc: Rakie Kim Cc: Rik van Riel Cc: Vlastimil Babka Cc: Ying Huang Signed-off-by: Andrew Morton commit 3d702678f57edc524f73a7865382ae304269f590 Author: Jinjiang Tu Date: Tue Dec 23 19:05:23 2025 +0800 mm/mempolicy: fix mpol_rebind_nodemask() for MPOL_F_NUMA_BALANCING commit bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") adds new flag MPOL_F_NUMA_BALANCING to enable NUMA balancing for MPOL_BIND memory policy. When the cpuset of tasks changes, the mempolicy of the task is rebound by mpol_rebind_nodemask(). When MPOL_F_STATIC_NODES and MPOL_F_RELATIVE_NODES are both not set, the behaviour of rebinding should be same whenever MPOL_F_NUMA_BALANCING is set or not. So, when an application calls set_mempolicy() with MPOL_F_NUMA_BALANCING set but both MPOL_F_STATIC_NODES and MPOL_F_RELATIVE_NODES cleared, mempolicy.w.cpuset_mems_allowed should be set to cpuset_current_mems_allowed nodemask. However, in current implementation, mpol_store_user_nodemask() wrongly returns true, causing mempolicy->w.user_nodemask to be incorrectly set to the user-specified nodemask. Later, when the cpuset of the application changes, mpol_rebind_nodemask() ends up rebinding based on the user-specified nodemask rather than the cpuset_mems_allowed nodemask as intended. I can reproduce with the following steps in qemu with 4 NUMA nodes: 1. echo '+cpuset' > /sys/fs/cgroup/cgroup.subtree_control 2. mkdir /sys/fs/cgroup/test 3. ./reproducer & 4. cat /proc/$pid/numa_maps, the task is bound to NUMA 1 5. echo $pid > /sys/fs/cgroup/test/cgroup.procs 6. cat /proc/$pid/numa_maps, the task is bound to NUMA 0 now. The reproducer code: int main() { struct bitmask *bmp; int ret; bmp = numa_parse_nodestring("1"); ret = set_mempolicy(MPOL_BIND | MPOL_F_NUMA_BALANCING, bmp->maskp, bmp->size + 1); if (ret < 0) { perror("Failed to call set_mempolicy"); exit(-1); } while (1); return 0; } If I call set_mempolicy() without MPOL_F_NUMA_BALANCING in the reproducer code. After step 5, the task is still bound to NUMA 1. To fix this, only set mempolicy->w.user_nodemask to the user-specified nodemask if MPOL_F_STATIC_NODES or MPOL_F_RELATIVE_NODES is present. Link: https://lkml.kernel.org/r/20260120011018.1256654-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20251223110523.1161421-1-tujinjiang@huawei.com Fixes: bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") Signed-off-by: Jinjiang Tu Reviewed-by: Gregory Price Reviewed-by: Huang Ying Acked-by: David Hildenbrand (Red Hat) Cc: Alistair Popple Cc: Byungchul Park Cc: Joshua Hahn Cc: Kefeng Wang Cc: Mathew Brost Cc: Mel Gorman Cc: Rakie Kim Cc: Zi Yan Signed-off-by: Andrew Morton commit dc2e4982cb018306f0699cd460a9033467f07be5 Author: Sergey Senozhatsky Date: Tue Jan 13 12:46:45 2026 +0900 zsmalloc: introduce SG-list based object read API Currently, zsmalloc performs address linearization on read (which sometimes requires memcpy() to a local buffer). Not all zsmalloc users need a linear address. For example, Crypto API supports SG-list, performing linearization under the hood, if needed. In addition, some compressors can have native SG-list support, completely avoiding the linearization step. Provide an SG-list based zsmalloc read API: - zs_obj_read_sg_begin() - zs_obj_read_sg_end() This API allows callers to obtain an SG representation of the object (one entry for objects that are contained in a single page and two entries for spanning objects), avoiding the need for a bounce buffer and memcpy. [senozhatsky@chromium.org: make zs_obj_read_sg_begin() return void, per Yosry] Link: https://lkml.kernel.org/r/20260117024900.792237-1-senozhatsky@chromium.org Link: https://lkml.kernel.org/r/20260113034645.2729998-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Acked-by: Herbert Xu Tested-by: Yosry Ahmed Cc: Herbert Xu Cc: Brian Geffon Cc: Johannes Weiner Cc: Minchan Kim Cc: Nhat Pham Signed-off-by: Andrew Morton commit 737dfe7d95263ae8e47e07a528e3676ffad6f59a Author: Alexander Potapenko Date: Tue Jan 13 10:11:51 2026 +0100 mm: kmsan: add test_uninit_page Test that pages allocated with alloc_page() are uninitialized by default. Link: https://lkml.kernel.org/r/20260113091151.4035013-2-glider@google.com Signed-off-by: Alexander Potapenko Cc: Dmitriy Vyukov Cc: Marco Elver Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 79ffad20ebc05eb4e5dc942cdedbfbf0796c18c9 Author: Alexander Potapenko Date: Tue Jan 13 10:11:50 2026 +0100 mm: kmsan: add tests for high-order page freeing Add regression tests to verify that KMSAN correctly poisons the full memory range when freeing pages. Specifically, verify that accessing the tail pages of a high-order non-compound allocation triggers a use-after-free report. This ensures that the fix "mm: kmsan: Fix poisoning of high-order non-compound pages" is working as expected. Also add a test for standard order-0 pages for completeness. Link: https://lore.kernel.org/all/20260104134348.3544298-1-ryan.roberts@arm.com/ Link: https://lkml.kernel.org/r/20260113091151.4035013-1-glider@google.com Signed-off-by: Alexander Potapenko Reviewed-by: Ryan Roberts Cc: Dmitriy Vyukov Cc: Dmitry Vyukov Cc: Marco Elver Signed-off-by: Andrew Morton commit ed581147a417940857eeea609229de0f5de5617f Author: SeongJae Park Date: Tue Jan 13 07:27:16 2026 -0800 Docs/admin-guide/mm/damon/lru_sort: document intervals autotuning Document a newly added DAMON_LRU_SORT module parameter for using monitoring intervals auto-tuning feature of DAMON. Link: https://lkml.kernel.org/r/20260113152717.70459-12-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: wang lian Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4bdd692291275eaaabe993e1c4a7b5b01cd6dc37 Author: SeongJae Park Date: Tue Jan 13 07:27:15 2026 -0800 mm/damon/lru_sort: add monitoring intervals auto-tuning parameter DAMON monitoring intervals tuning was crucial for every DAMON use case. Now there are a tuning guideline and an automated intervals tuning feature. DAMON_LRU_SORT is still using manual control of intervals. Add a module parameter for utilizing the auto-tuning feature with a suggested auto-tuning parameters. Link: https://lkml.kernel.org/r/20260113152717.70459-11-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: wang lian Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit cdfca22d15ca5f0f6b3ff33a23e1672dccc74eda Author: SeongJae Park Date: Tue Jan 13 07:27:14 2026 -0800 Docs/admin-guide/mm/damon/lru_sort: document active_mem_bp parameter Document a newly added DAMON_LRU_SORT parameter for doing auto-tuning aiming an active to inactive memory size ratio. Link: https://lkml.kernel.org/r/20260113152717.70459-10-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: wang lian Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 40d98d31cd7060228e03303c5c34ae7101020416 Author: SeongJae Park Date: Tue Jan 13 07:27:13 2026 -0800 mm/damon/lru_sort: support active:inactive memory ratio based auto-tuning Doing DAMOS_LRU_[DE]PRIO with DAMOS_QUOTA_[IN]ACTIVE_MEM_BP based quota auto-tuning can be easy and intuitive, compared to the manual [de]prioritization target access pattern thresholds tuning. For example, users can ask DAMON to "find hot/cold pages and activate/deactivate those aiming 50:50 active:inactive memory size." But DAMON_LRU_SORT has no interface to do that. Add a module parameter for setting the target ratio. [sj@kernel.org: add inactive mem ratio quota goal to cold_scheme] Link: https://lkml.kernel.org/r/20260114055308.79884-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260113152717.70459-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b36aefb866a12e2fbdc76f3cf0be4025b85dcb2c Author: SeongJae Park Date: Tue Jan 13 07:27:12 2026 -0800 Docs/admin-guide/mm/damon/lru_sort: document filter_young_pages Document the new DAMON_LRU_SORT parameter, filter_young_pages. It can be used to use page level access re-check for the LRU sorting. Link: https://lkml.kernel.org/r/20260113152717.70459-8-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: wang lian Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 303dbb1f08cfe844d095fe008bd4d04e89d447f1 Author: SeongJae Park Date: Tue Jan 13 07:27:11 2026 -0800 mm/damon/lru_sort: support young page filters DAMON monitors access patterns at the region level, and hence there could be some page level mismatches. A few hot pages could be located in cold regions, and vice versa. Young page filters can be useful for doing additional page level access checks before applying some DAMOS action. DAMON_LRU_SORT is not using young page filters, though. Add a parameter for using it. Link: https://lkml.kernel.org/r/20260113152717.70459-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 57d96d1ad2ccb29f0b8d67acd79e2f978bf165c4 Author: SeongJae Park Date: Tue Jan 13 07:27:10 2026 -0800 mm/damon/lru_sort: consider age for quota prioritization DAMON_LRU_SORT is doing under-quota access pattern based regions prioritization using only access frequency. Age of regions is another useful information for distinguishing hot and cold regions. Use it for prioritization, too. Link: https://lkml.kernel.org/r/20260113152717.70459-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 80820e69fd1b92288dceeffc0a337883abb5096a Author: SeongJae Park Date: Tue Jan 13 07:27:09 2026 -0800 mm/damon/paddr: activate DAMOS_LRU_PRIO targets instead of marking accessed DAMOS_LRU_DEPRIOD directly deactivates the pages, while DAMOS_LRU_PRIO calls folio_mark_accessed(), which does incremental activation. The incremental activation was assumed to be useful for making sure the pages of the hot memory region are really hot. After the introduction of DAMOS_LRU_PRIO, the young page filter has added. Users can use the young page filter to make sure the page is eligible to be activated. Meanwhile, the asymmetric behavior of DAMOS_LRU_[DE]PRIO can confuse users. Directly activate given pages for DAMOS_LRU_PRIO, to eliminate the unnecessary incremental activation steps, and be symmetric with DAMOS_LRU_DEPRIO for easier usages. Link: https://lkml.kernel.org/r/20260113152717.70459-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5022134c1b497ab33b5cbd4dc84ef32906b51759 Author: SeongJae Park Date: Tue Jan 13 07:27:08 2026 -0800 Docs/mm/damon/design: document DAMOS_QUOTA_[IN]ACTIVE_MEM_BP Update design document for newly added DAMOS_QUOTA_[IN]ACTIVE_MEM_BP metrics. Note that API document is automatically updated by kernel-doc comment, and the usage document points to the design document which uses keywords same to that for sysfs inputs. Hence updating only design document is sufficient. Link: https://lkml.kernel.org/r/20260113152717.70459-4-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: wang lian Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit fbec8a1e4fa4daf2611c9a3e3b29d03a73acbd0c Author: SeongJae Park Date: Tue Jan 13 07:27:07 2026 -0800 mm/damon/sysfs-schemes: support DAMOS_QUOTA_[IN]ACTIVE_MEM_BP Add support of DAMOS_QUOTA_[IN]ACTIVE_MEM_BP on DAMON sysfs interface. Users can use [in]active_mem_bp keyword input to the target_metric sysfs file to use the new DAMOS quota auto-tune target metrics. Link: https://lkml.kernel.org/r/20260113152717.70459-3-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: wang lian Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4835e2871321fd9cf5bc9702dded323e3e3fbc1a Author: SeongJae Park Date: Tue Jan 13 07:27:06 2026 -0800 mm/damon/core: introduce [in]active memory ratio damos quota goal metric Patch series "mm/damon: advance DAMOS-based LRU sorting". DAMOS_LRU_[DE]PRIO actions were added to DAMOS for more access-aware LRU lists sorting. For simple usage, a specialized kernel module, namely DAMON_LRU_SORT, has also been introduced. After the introduction of the module, DAMON got a few important new features, including the aim-based quota auto-tuning, age tracking, young page filter, and monitoring intervals auto-tuning. Meanwhile, DAMOS-based LRU sorting had no direct updates. Now we show some rooms to advance for DAMOS-based LRU sorting. Firstly, the aim-oriented quota auto-tuning can simplify the LRU sorting parameters tuning. But there is no good auto-tuning target metric for LRU sorting use case. Secondly, the behavior of DAMOS_LRU_[DE]PRIO are not very symmetric. DAMOS_LRU_DEPRIO directly moves the pages to inactive LRU list, while DAMOS_LRU_PRIO only marks the page as accessed, so that the page can not directly but only eventually moved to the active LRU list. Finally, DAMON_LRU_SORT users cannot utilize the modern features that can be useful for them, too. Improve the situation with the following changes. First, introduce a new DAMOS quota auto-tuning target metric for active:inactive memory size ratio. Since LRU sorting is a kind of balancing of active and inactive pages, the active:inactive memory size ratio can be intuitively set. Second, update DAMOS_LRU_[DE]PRIO behaviors to be more intuitive and symmetric, by letting them directly move the pages to [in]active LRU list. Third, update the DAMON_LRU_SORT module user interface to be able to fully utilize the modern features including the [in]active memory size ratio-based quota auto-tuning, young page filter, and monitoring intervals auto-tuning. With these changes, for example, users can now ask DAMON to "find hot/cold memory regions with auto-tuned monitoring intervals, do one more page level access check for found hot/cold memory, and move pages of those to active or inactive LRU lists accordingly, aiming X:Y active to inactive memory ratio." For example, if they know 30% of the memory is better to be protected from reclamation, 30:70 can be set as the target ratio. Test Results ------------ I ran DAMON_LRU_SORT with the features introduced by this series, on a real world server workload. For the active:inactive ratio goal, I set 50:50. I confirmed it achieves the target active:inactive ratio, without manual tuning of the monitoring intervals and the hot/coldness thresholds. The baseline system that was not running the DAMON_LRU_SORT was keeping active:inactive ratio of about 1:10. Note that the test didn't show a clear performance difference, though. I believe that was mainly because the workload was not very memory intensive. Also, whether the 50:50 target ratio was optimum is unclear. Nonetheless, the positive performance impact of the basic LRU sorting idea is already confirmed with the initial DAMON_LRU_SORT introduction patch series. The goal of this patch series is simplifying the parameters tuning of DAMOS-based LRU sorting, and the test confirmed the aimed goals are achieved. Patches Sequence ---------------- First three patches extend DAMOS quota auto-tuning to support [in]active memory ratio target metric type. Those (patches 1-3) introduce new metrics, implement DAMON sysfs support, and update the documentation, respectively. Following patch (patch 4) makes DAMOS_LRU_PRIO action to directly move target pages to active LRU list, instead of only marking them accessed. Following seven patches (patches 5-11) updates DAMON_LRU_SORT to support modern DAMON features. Patch 5 makes it uses not only access frequency but also age at under-quota regions prioritization. Patches 6-11 add the support for young page filtering, active:inactive memory ratio based quota auto-tuning, and monitoring intervals auto-tuning, with appropriate document updates. This patch (of 11): DAMOS_LRU_[DE]PRIO are DAMOS actions for making balance of active and inactive memory size. There is no appropriate DAMOS quota auto-tuning target metric for the use case. Add two new DAMOS quota goal metrics for the purpose, namely DAMOS_QUOTA_[IN]ACTIVE_MEM_BP. Those will represent the ratio of [in]active memory to total (inactive + active) memory. Hence, users will be able to ask DAMON to, for example, "find hot and cold memory, and move pages of those to active and inactive LRU lists, adjusting the hot/cold thresholds aiming 50:50 active:inactive memory ratio." Link: https://lkml.kernel.org/r/20260113152717.70459-1-sj@kernel.org Link: https://lkml.kernel.org/r/20260113152717.70459-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b19cb086043d30d3e74617f9971f68e7fd233c64 Author: Andrey Ryabinin Date: Tue Jan 13 20:15:16 2026 +0100 mm/kasan/kunit: extend vmalloc OOB tests to cover vrealloc() Extend the vmalloc_oob() test to validate OOB detection after resizing vmalloc allocations with vrealloc(). The test now verifies that KASAN correctly poisons and unpoisons vmalloc memory when allocations are shrunk and expanded, ensuring OOB accesses are reliably detected after each resize. [ryabinin.a.a@gmail.com: adjust vrealloc() size] Link: https://lkml.kernel.org/r/20260116132822.22227-1-ryabinin.a.a@gmail.com Link: https://lkml.kernel.org/r/20260113191516.31015-2-ryabinin.a.a@gmail.com Signed-off-by: Andrey Ryabinin Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Dmitriy Vyukov Cc: Maciej Żenczykowski Cc: Uladzislau Rezki Cc: Vincenzo Frascino Cc: Maciej Wieczor-Retman Signed-off-by: Andrew Morton commit d60769075013ec7933a715b5b1ac37eb77c33420 Author: Alice Ryhl Date: Wed Jan 7 15:16:42 2026 +0000 vmalloc: export vrealloc_node_align_noprof This symbol is used from the Nova driver, so it needs to be exported to avoid a build failure when building Nova as a module. ERROR: modpost: "vrealloc_node_align_noprof" [drivers/gpu/nova-core/nova_core.ko] undefined! ERROR: modpost: "vrealloc_node_align_noprof" [samples/rust/rust_dma.ko] undefined! This error is only triggered if helpers are inlined into Rust. Otherwise, Nova will call the exported symbol rust_helper_vrealloc_node_align() instead. There is no Fixes: tag as that feature is still WIP. I used non-GPL EXPORT_SYMBOL to match the rest of the file, but let me know if I should use EXPORT_SYMBOL_GPL. Link: https://lkml.kernel.org/r/20260107-export-vrealloc_node_align_noprof-v1-1-a581bec13054@google.com Signed-off-by: Alice Ryhl Reviewed-by: Danilo Krummrich Cc: Andreas Hindborg Cc: Björn Roy Baron Cc: Boqun Feng Cc: Gary Guo Cc: Miguel Ojeda Cc: Trevor Gross Cc: Uladzislau Rezki Signed-off-by: Andrew Morton commit 14f270761d3374db24c84630f2aa7a3c732fed4a Author: Kefeng Wang Date: Fri Jan 9 17:31:36 2026 +0800 mm: hugetlb: allocate frozen pages for gigantic allocation alloc_gigantic_folio() allocates a folio with refcount increated and then freeze it, convert to allocate a frozen folio to remove the atomic operation about folio refcount, and saving atomic operation during __update_and_free_hugetlb_folio() too. Besides, rename hugetlb_cma_{alloc,free}_folio(), alloc_gigantic_folio() and alloc_buddy_hugetlb_folio() with frozen which make them more self-explanatory. Link: https://lkml.kernel.org/r/20260109093136.1491549-7-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: Zi Yan Reviewed-by: Muchun Song Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Vlastimil Babka Cc: Claudiu Beznea Cc: Mark Brown Signed-off-by: Andrew Morton commit 9bda131c6093e9c4a8739e2eeb65ba4d5fbefc2f Author: Kefeng Wang Date: Fri Jan 9 17:31:35 2026 +0800 mm: cma: add cma_alloc_frozen{_compound}() Introduce cma_alloc_frozen{_compound}() helper to alloc pages without incrementing their refcount, then convert hugetlb cma to use the cma_alloc_frozen_compound() and cma_release_frozen() and remove the unused cma_{alloc,free}_folio(), also move the cma_validate_zones() into mm/internal.h since no outside user. The set_pages_refcounted() is only called to set non-compound pages after above changes, so remove the processing about PageHead. Link: https://lkml.kernel.org/r/20260109093136.1491549-6-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Vlastimil Babka Cc: Claudiu Beznea Cc: Mark Brown Signed-off-by: Andrew Morton commit e0c1326779cc1b8e3a9e30ae273b89202ed4c82c Author: Kefeng Wang Date: Fri Jan 9 17:31:34 2026 +0800 mm: page_alloc: add alloc_contig_frozen_{range,pages}() In order to allocate given range of pages or allocate compound pages without incrementing their refcount, adding two new helper alloc_contig_frozen_{range,pages}() which may be beneficial to some users (eg hugetlb). The new alloc_contig_{range,pages} only take !__GFP_COMP gfp now, and the free_contig_range() is refactored to only free non-compound pages, the only caller to free compound pages in cma_free_folio() is changed accordingly, and the free_contig_frozen_range() is provided to match the alloc_contig_frozen_range(), which is used to free frozen pages. Link: https://lkml.kernel.org/r/20260109093136.1491549-5-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: Zi Yan Reviewed-by: Sidhartha Kumar Cc: Brendan Jackman Cc: David Hildenbrand Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Oscar Salvador Cc: Vlastimil Babka Cc: Claudiu Beznea Cc: Mark Brown Signed-off-by: Andrew Morton commit 6c08cc64d194dc5cc3dfc785517098d3b161c05f Author: Kefeng Wang Date: Fri Jan 9 17:31:33 2026 +0800 mm: cma: kill cma_pages_valid() Kill cma_pages_valid() which only used in cma_release(), also cleanup code duplication between cma pages valid checking and cma memrange finding. Link: https://lkml.kernel.org/r/20260109093136.1491549-4-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: Jane Chu Reviewed-by: Zi Yan Reviewed-by: Muchun Song Acked-by: David Hildenbrand Cc: Brendan Jackman Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Cc: Sidhartha Kumar Cc: Vlastimil Babka Cc: Claudiu Beznea Cc: Mark Brown Signed-off-by: Andrew Morton commit a9deb800b89efb2050453f7178e73b1d8b124e0f Author: Kefeng Wang Date: Fri Jan 9 17:31:32 2026 +0800 mm: page_alloc: add __split_page() Factor out the splitting of non-compound page from make_alloc_exact() and split_page() into a new helper function __split_page(). While at it, convert the VM_BUG_ON_PAGE() into a VM_WARN_ON_PAGE(). Link: https://lkml.kernel.org/r/20260109093136.1491549-3-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: David Hildenbrand Acked-by: Muchun Song Reviewed-by: Zi Yan Reviewed-by: Sidhartha Kumar Cc: Brendan Jackman Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Cc: Vlastimil Babka Cc: Claudiu Beznea Cc: Mark Brown Signed-off-by: Andrew Morton commit 01152bd2e44d6bcecd3573d653221ba3944ed0f1 Author: Kefeng Wang Date: Fri Jan 9 17:31:31 2026 +0800 mm: debug_vm_pgtable: add debug_vm_pgtable_free_huge_page() Patch series "mm: hugetlb: allocate frozen gigantic folio", v6. Introduce alloc_contig_frozen_pages() and cma_alloc_frozen_compound() which avoid atomic operation about page refcount, and then convert to allocate frozen gigantic folio by the new helpers in hugetlb to cleanup the alloc_gigantic_folio(). This patch (of 6): Add a new helper to free huge page to be consistency to debug_vm_pgtable_alloc_huge_page(), and use HPAGE_PUD_ORDER instead of open-code. Also move the free_contig_range() under CONFIG_ALLOC_CONTIG since all caller are built with CONFIG_ALLOC_CONTIG. Link: https://lkml.kernel.org/r/20260109093136.1491549-2-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Muchun Song Reviewed-by: Sidhartha Kumar Cc: Brendan Jackman Cc: Jane Chu Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Cc: Vlastimil Babka Cc: Claudiu Beznea Cc: Mark Brown Signed-off-by: Andrew Morton commit 5747435e0fd474c24530ef1a6822f47e7d264b27 Author: Deepanshu Kartikey Date: Mon Jan 12 16:06:12 2026 +0530 mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node When CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during vmalloc cleanup triggers expensive stack unwinding that acquires RCU read locks. Processing a large purge_list without rescheduling can cause the task to hold CPU for extended periods (10+ seconds), leading to RCU stalls and potential OOM conditions. The issue manifests in purge_vmap_node() -> kasan_release_vmalloc_node() where iterating through hundreds or thousands of vmap_area entries and freeing their associated shadow pages causes: rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l ... task:kworker/0:17 state:R running task stack:28840 pid:6229 ... kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299 purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299 Each call to kasan_release_vmalloc() can free many pages, and with page_owner tracking, each free triggers save_stack() which performs stack unwinding under RCU read lock. Without yielding, this creates an unbounded RCU critical section. Add periodic cond_resched() calls within the loop to allow: - RCU grace periods to complete - Other tasks to run - Scheduler to preempt when needed The fix uses need_resched() for immediate response under load, with a batch count of 32 as a guaranteed upper bound to prevent worst-case stalls even under light load. Link: https://lkml.kernel.org/r/20260112103612.627247-1-kartikey406@gmail.com Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+d8d4c31d40f868eaea30@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d8d4c31d40f868eaea30 Link: https://lore.kernel.org/all/20260112084723.622910-1-kartikey406@gmail.com/T/ [v1] Suggested-by: Uladzislau Rezki Reviewed-by: Uladzislau Rezki (Sony) Cc: Hillf Danton Cc: Signed-off-by: Andrew Morton commit 5fd8391cb71982152785edc1e6f48a5c7dcadabc Author: Hou Wenlong Date: Mon Jan 12 20:24:29 2026 +0800 mm/early_ioremap: clean up the use of WARN() for debugging Using WARN() for debugging is strange when nothing is wrong, so replace WARN(early_ioremap_debug) with pr_warn() + dump_stack(). Link: https://lkml.kernel.org/r/d4470531ce0c03fd80f9a1be7e8d8ae1bc60fcd1.1768220636.git.houwenlong.hwl@antgroup.com Signed-off-by: Hou Wenlong Suggested-by: Mike Rapoport Acked-by: Mike Rapoport (Microsoft) Cc: David Hildenbrand Cc: Hou Wenlong Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0cc3197bdb7ff590dd7cc1622a7fac66c240bc75 Author: Hou Wenlong Date: Fri Jan 9 21:31:51 2026 +0800 mm/early_ioremap: print the starting physical address in __early_ioremap() The debug WARN() printing occurs after the while loop, so the 'phys_addr' reflects the last physical address rather than the actual starting physical address, which is not useful for debugging. To simplify, the WARN() statement could be moved up before the loop instead of introducing a new variable to record the original 'phys_addr' value. Additionally, swap the print order of 'slot_virt[slot]' and 'offset', as this will enhance output readability. Link: https://lkml.kernel.org/r/aa2d44c34f44c31b50285b7592ed4fd78d6f59ba.1767965415.git.houwenlong.hwl@antgroup.com Signed-off-by: Hou Wenlong Reviewed-by: Andrew Morton Reviewed-by: Mike Rapoport (Microsoft) Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 35520a712f9956657dfd0eaf4d9e873cd96ec43a Author: Aaron Yang Date: Wed Jan 7 17:30:38 2026 -0800 mm/damon/paddr: initialize 'folio' variables to NULL for clarity In damon_pa_mark_accessed_or_deactivate(), damon_pa_pageout(), damon_pa_migrate(), and damon_pa_stat(), the local variable 'folio' is declared but not initialized. Initialize 'folio' to NULL to improve code readability and maintainability. Link: https://patch.msgid.link/20260104013255.16962-1-yangqixiao@inspur.com Link: https://lkml.kernel.org/r/20260108013041.80601-1-sj@kernel.org Signed-off-by: Aaron Yang Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 19c4707b535a31dc8a6009afc249f36db7011ac3 Author: Yosry Ahmed Date: Wed Jan 7 14:21:45 2026 +0900 zsmalloc: simplify read begin/end logic zs_obj_read_begin() currently maps or copies the compressed object with the prefix handle for !ZsHugePage case. Make the logic clearer and more efficient by moving the offset of the object in the page after the prefix handle instead, only copying the actual object and avoiding the need to adjust the returned address to account for the prefix. Adjust the logic to detect spanning objects in zs_obj_read_end() accordingly, slightly simplifying it by avoiding the need to account for the handle in both the offset and the object size. Link: https://lkml.kernel.org/r/20260107052145.3586917-2-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Co-developed-by: Yosry Ahmed Signed-off-by: Yosry Ahmed Cc: Brian Geffon Cc: Chengming Zhou Cc: Jens Axboe Cc: Johannes Weiner Cc: Minchan Kim Cc: Nhat Pham Signed-off-by: Andrew Morton commit 0be909f114c4e82a4fe5964851af1ab8889dc76c Author: Sergey Senozhatsky Date: Wed Jan 7 14:21:44 2026 +0900 zsmalloc: use actual object size to detect spans Using class->size to detect spanning objects is not entirely correct, because some size classes can hold a range of object sizes of up to class->size bytes in length, due to size-classes merge. Such classes use padding for cases when actually written objects are smaller than class->size. zs_obj_read_begin() can incorrectly hit the slow path and perform memcpy of such objects, basically copying padding bytes. Instead of class->size zs_obj_read_begin() should use the actual compressed object length (both zram and zswap know it) so that it can correctly handle situations when a written object is small enough to fit into the first physical page. Link: https://lkml.kernel.org/r/20260107052145.3586917-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Yosry Ahmed [zsmalloc & zswap] Reviewed-by: Nhat Pham Cc: Brian Geffon Cc: Chengming Zhou Cc: Jens Axboe Cc: Johannes Weiner Cc: Minchan Kim Signed-off-by: Andrew Morton commit 95296536eb19c969e91684287cf3bfcb382221d3 Author: Shakeel Butt Date: Thu Dec 25 15:21:16 2025 -0800 memcg: rename mem_cgroup_ino() to mem_cgroup_id() Rename mem_cgroup_ino() to mem_cgroup_id() and mem_cgroup_get_from_ino() to mem_cgroup_get_from_id(). These functions now use cgroup IDs (from cgroup_id()) rather than inode numbers, so the names should reflect that. [shakeel.butt@linux.dev: replace ino with id, per SeongJae] Link: https://lkml.kernel.org/r/flkqanhyettp5uq22bjwg37rtmnpeg3mghznsylxcxxgaafpl4@nov2x7tagma7 [akpm@linux-foundation.org: build fix] Link: https://lkml.kernel.org/r/20251225232116.294540-9-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Reviewed-by: SeongJae Park Cc: Axel Rasmussen Cc: Dave Chinner Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 2202e3a8cb80da583670034ee33c995513708949 Author: Shakeel Butt Date: Thu Dec 25 15:21:15 2025 -0800 memcg: remove unused mem_cgroup_id() and mem_cgroup_from_id() Now that all callers have been converted to use either: - The private ID APIs (mem_cgroup_private_id/mem_cgroup_from_private_id) for internal kernel objects that outlive their cgroup - The public cgroup ID APIs (mem_cgroup_ino/mem_cgroup_get_from_ino) for external interfaces Remove the unused wrapper functions mem_cgroup_id() and mem_cgroup_from_id() along with their !CONFIG_MEMCG stubs. Link: https://lkml.kernel.org/r/20251225232116.294540-8-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Cc: Axel Rasmussen Cc: Dave Chinner Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: SeongJae Park Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 20ccbd89afe425eda2de48a9a701916d98c1f306 Author: Shakeel Butt Date: Thu Dec 25 15:21:14 2025 -0800 mm/vmscan: use cgroup ID instead of private memcg ID in lru_gen interface The LRU gen debugfs interface was using the internal private memcg ID which is meant for tracking kernel objects that outlive their cgroup. Switch to using the public cgroup ID instead. Link: https://lkml.kernel.org/r/20251225232116.294540-7-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Cc: Axel Rasmussen Cc: Dave Chinner Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: SeongJae Park Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 5866891a7ab1348686da70f70e925964d9227bf5 Author: Shakeel Butt Date: Thu Dec 25 15:21:13 2025 -0800 mm/damon: use cgroup ID instead of private memcg ID DAMON was using the internal private memcg ID which is meant for tracking kernel objects that outlive their cgroup. Switch to using the public cgroup ID instead. Link: https://lkml.kernel.org/r/20251225232116.294540-6-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Reviewed-by: SeongJae Park Acked-by: Michal Hocko Cc: Axel Rasmussen Cc: Dave Chinner Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit ea73e364716023b1a47d58b9f12e7c92f3b1e6a7 Author: Shakeel Butt Date: Thu Dec 25 15:21:12 2025 -0800 memcg: use cgroup_id() instead of cgroup_ino() for memcg ID Switch mem_cgroup_ino() from using cgroup_ino() to cgroup_id(). The cgroup_ino() returns the kernfs inode number while cgroup_id() returns the kernfs node ID. For 64-bit systems, they are the same. Also cgroup_get_from_id() expects 64-bit node ID which is called by mem_cgroup_get_from_ino(). Change the type from unsigned long to u64 to match cgroup_id()'s return type, and update the format specifiers accordingly. Note that the names mem_cgroup_ino() and mem_cgroup_get_from_ino() are now misnomers since they deal with cgroup IDs rather than inode numbers. A follow-up patch will rename them. Link: https://lkml.kernel.org/r/20251225232116.294540-5-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Cc: Axel Rasmussen Cc: Dave Chinner Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: SeongJae Park Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 510e12900298ca6dbc474f5f418b21532f2ad101 Author: Shakeel Butt Date: Thu Dec 25 15:21:11 2025 -0800 memcg: mem_cgroup_get_from_ino() returns NULL on error Change mem_cgroup_get_from_ino() to return NULL on error instead of ERR_PTR values. This simplifies the API: NULL indicates failure, and a valid pointer indicates success with a CSS reference held that the caller must release via mem_cgroup_put(). Link: https://lkml.kernel.org/r/20251225232116.294540-4-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Cc: Axel Rasmussen Cc: Dave Chinner Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: SeongJae Park Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 1d89d7fd592e2490cadd13c253d7b1b9f6116be8 Author: Shakeel Butt Date: Thu Dec 25 15:21:10 2025 -0800 memcg: expose mem_cgroup_ino() and mem_cgroup_get_from_ino() unconditionally Remove the CONFIG_SHRINKER_DEBUG guards around mem_cgroup_ino() and mem_cgroup_get_from_ino(). These APIs provide a way to get a memcg's cgroup inode number and to look up a memcg from an inode number respectively. Making these functions unconditionally available allows other in-kernel users to leverage them without requiring CONFIG_SHRINKER_DEBUG to be enabled. No functional change for existing users. Link: https://lkml.kernel.org/r/20251225232116.294540-3-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Cc: Axel Rasmussen Cc: Dave Chinner Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: SeongJae Park Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit e77786b4682e69336e3de3eaeb12ec994027f611 Author: Shakeel Butt Date: Thu Dec 25 15:21:09 2025 -0800 memcg: introduce private id API for in-kernel users Patch series "memcg: separate private and public ID namespaces". The memory cgroup subsystem maintains a private ID infrastructure that is decoupled from the cgroup IDs. This private ID system exists because some kernel objects (like swap entries and shadow entries in the workingset code) can outlive the cgroup they were associated with. The motivation is best described in commit 73f576c04b941 ("mm: memcontrol: fix cgroup creation failure after many small jobs"). Unfortunately, some in-kernel users (DAMON, LRU gen debugfs interface, shrinker debugfs) started exposing these private IDs to userspace. This is problematic because: 1. The private IDs are internal implementation details that could change 2. Userspace already has access to cgroup IDs through the cgroup filesystem 3. Using different ID namespaces in different interfaces is confusing This series cleans up the memcg ID infrastructure by: 1. Explicitly marking the private ID APIs with "private" in their names to make it clear they are for internal use only (swap/workingset) 2. Making the public cgroup ID APIs (mem_cgroup_id/mem_cgroup_get_from_id) unconditionally available 3. Converting DAMON, LRU gen, and shrinker debugfs interfaces to use the public cgroup IDs instead of the private IDs 4. Removing the now-unused wrapper functions and renaming the public APIs for clarity After this series: - mem_cgroup_private_id() / mem_cgroup_from_private_id() are used for internal kernel objects that outlive their cgroup (swap, workingset) - mem_cgroup_id() / mem_cgroup_get_from_id() return the public cgroup ID (from cgroup_id()) for use in userspace-facing interfaces This patch (of 8): The memory cgroup maintains a private ID infrastructure decoupled from the cgroup IDs for swapout records and shadow entries. The main motivation of this private ID infra is best described in the commit 73f576c04b941 ("mm: memcontrol: fix cgroup creation failure after many small jobs"). Unfortunately some users have started exposing these private IDs to the userspace where they should have used the cgroup IDs which are already exposed to the userspace. Let's rename the memcg ID APIs to explicitly mark them private. No functional change is intended. Link: https://lkml.kernel.org/r/20251225232116.294540-1-shakeel.butt@linux.dev Link: https://lkml.kernel.org/r/20251225232116.294540-2-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Cc: Axel Rasmussen Cc: Dave Chinner Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: SeongJae Park Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 2c4c3e29897d43c431b1cf9432fb66977f262ac2 Author: Vlastimil Babka Date: Tue Jan 6 12:52:38 2026 +0100 mm/page_alloc: simplify __alloc_pages_slowpath() flow The actions done before entering the main retry loop include waking up kswapds and an allocation attempt with the precise alloc_flags. Then in the loop we keep waking up kswapds, and we retry the allocation with flags potentially further adjusted by being allowed to use reserves (due to e.g. becoming an OOM killer victim). We can adjust the retry loop to keep only one instance of waking up kswapds and allocation attempt. Introduce the can_retry_reserves variable for retrying once when we become eligible for reserves. It is still useful not to evaluate reserve_flags immediately for the first allocation attempt, because it's better to first try succeed in a non-preferred zone above the min watermark before allocating immediately from the preferred zone below min watermark. Additionally move the cpuset update checks introduced by e05741fb10c3 ("mm/page_alloc.c: avoid infinite retries caused by cpuset race") further down the retry loop. It's enough to do the checks only before reaching any potentially infinite 'goto retry;' loop. There should be no meaningful functional changes. The change of exact moments the retry for reserves and cpuset updates are checked should not result in different outomes modulo races with concurrent allocator activity. Link: https://lkml.kernel.org/r/20260106-thp-thisnode-tweak-v3-3-f5d67c21a193@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Joshua Hahn Cc: Brendan Jackman Cc: David Hildenbrand (Red Hat) Cc: David Rientjes Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 53a9b4646f67c95df1775aa5f381cb7f42cae957 Author: Vlastimil Babka Date: Tue Jan 6 12:52:37 2026 +0100 mm/page_alloc: refactor the initial compaction handling The initial direct compaction done in some cases in __alloc_pages_slowpath() stands out from the main retry loop of reclaim + compaction. We can simplify this by instead skipping the initial reclaim attempt via a new local variable compact_first, and handle the compact_prority as necessary to match the original behavior. No functional change intended. Link: https://lkml.kernel.org/r/20260106-thp-thisnode-tweak-v3-2-f5d67c21a193@suse.cz Signed-off-by: Vlastimil Babka Suggested-by: Johannes Weiner Reviewed-by: Joshua Hahn Acked-by: Michal Hocko Cc: Brendan Jackman Cc: David Hildenbrand (Red Hat) Cc: David Rientjes Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 66987218154918a6341a3e3eeeee58110a69e0bb Author: Vlastimil Babka Date: Tue Jan 6 12:52:36 2026 +0100 mm/page_alloc: ignore the exact initial compaction result Patch series "tweaks for __alloc_pages_slowpath()", v3. This patch (of 3): For allocations that are of costly order and __GFP_NORETRY (and can perform compaction) we attempt direct compaction first. If that fails, we continue with a single round of direct reclaim+compaction (as for other __GFP_NORETRY allocations, except the compaction is of lower priority), with two exceptions that fail immediately: - __GFP_THISNODE is specified, to prevent zone_reclaim_mode-like behavior for e.g. THP page faults - compaction failed because it was deferred (i.e. has been failing recently so further attempts are not done for a while) or skipped, which means there are insufficient free base pages to defragment to begin with Upon closer inspection, the second condition has a somewhat flawed reasoning. If there are not enough base pages and reclaim could create them, we instead fail. When there are enough base pages and compaction has already ran and failed, we proceed and hope that reclaim and the subsequent compaction attempt will succeed. But it's unclear why they should and whether it will be as inexpensive as intended. It might make therefore more sense to just fail unconditionally after the initial compaction attempt. However that would change the semantics of __GFP_NORETRY to attempt reclaim at least once. Alternatively we can remove the compaction result checks and proceed with the single reclaim and (lower priority) compaction attempt, leaving only the __GFP_THISNODE exception for failing immediately. Link: https://lkml.kernel.org/r/20260106-thp-thisnode-tweak-v3-0-f5d67c21a193@suse.cz Link: https://lkml.kernel.org/r/20260106-thp-thisnode-tweak-v3-1-f5d67c21a193@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Michal Hocko Cc: Brendan Jackman Cc: David Hildenbrand (Red Hat) Cc: David Rientjes Cc: Johannes Weiner Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit d17f02417a337de0a0c6e763e938ee5e41a97c3d Author: Lorenzo Stoakes Date: Sun Jan 18 14:50:45 2026 +0000 mm/rmap: separate out fork-only logic on anon_vma_clone() Specify which operation is being performed to anon_vma_clone(), which allows us to do checks specific to each operation type, as well as to separate out and make clear that the anon_vma reuse logic is absolutely specific to fork only. This opens the door to further refactorings and refinements later as we have more information to work with. Link: https://lkml.kernel.org/r/cf7da7a2d973cdc72a1b80dd9a73260519e8fa9f.1768746221.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Harry Yoo Cc: Jann Horn Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Rik van Riel Cc: Shakeel Butt Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit bfc2b13b05a1343bb60a85d840fd8956731866c5 Author: Lorenzo Stoakes Date: Sun Jan 18 14:50:44 2026 +0000 mm/rmap: allocate anon_vma_chain objects unlocked when possible There is no reason to allocate the anon_vma_chain under the anon_vma write lock when cloning - we can in fact assign these to the destination VMA safely as we hold the exclusive mmap lock and therefore preclude anybody else accessing these fields. We only need take the anon_vma write lock when we link rbtree edges from the anon_vma to the newly established AVCs. This also allows us to eliminate the weird GFP_NOWAIT, GFP_KERNEL dance introduced in commit dd34739c03f2 ("mm: avoid anon_vma_chain allocation under anon_vma lock"), further simplifying this logic. This should reduce lock anon_vma contention, and clarifies exactly where the anon_vma lock is required. We cannot adjust __anon_vma_prepare() in the same way as this is only protected by VMA read lock, so we have to perform the allocation here under the anon_vma write lock and page_table_lock (to protect against racing threads), and we wish to retain the lock ordering. With this change we can simplify cleanup_partial_anon_vmas() even further - since we allocate AVC's without any lock taken and do not insert anything into the interval tree until after the allocations are tried, we can remove all logic pertaining to this and just free up AVC's only. Link: https://lkml.kernel.org/r/624bf1ac0bde4871fcfca2c8c8e294b6d8f7ae7b.1768746221.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Harry Yoo Cc: Jann Horn Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Rik van Riel Cc: Shakeel Butt Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 85f03a86318c4172bfda4484cdf588ebab5fa410 Author: Lorenzo Stoakes Date: Sun Jan 18 14:50:43 2026 +0000 mm/mmap_lock: add vma_is_attached() helper This makes it easy to explicitly check for VMA detachment, which is useful for things like asserts. Note that we intentionally do not allow this function to be available should CONFIG_PER_VMA_LOCK be set - this is because vma_assert_attached() and vma_assert_detached() are no-ops if !CONFIG_PER_VMA_LOCK, so there is no correct state for vma_is_attached() to be in if this configuration option is not specified. Therefore users elsewhere must invoke this function only after checking for CONFIG_PER_VMA_LOCK. We rework the assert functions to utilise this. Link: https://lkml.kernel.org/r/0172d3bf527ca54ba27d8bce8f8476095b241ac7.1768746221.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Harry Yoo Cc: Jann Horn Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Rik van Riel Cc: Shakeel Butt Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7549e3d20f1aa9a0b8c77f83144dde54ed6ab4fe Author: Lorenzo Stoakes Date: Sun Jan 18 14:50:42 2026 +0000 mm/rmap: make anon_vma functions internal The bulk of the anon_vma operations are only used by mm, so formalise this by putting the function prototypes and inlines in mm/internal.h. This allows us to make changes without having to worry about the rest of the kernel. Link: https://lkml.kernel.org/r/79ec933c3a9c8bf1f64dab253bbfdae8a01cb921.1768746221.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Harry Yoo Cc: Jann Horn Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Rik van Riel Cc: Shakeel Butt Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 53eb797ffc3abe30418b19777922b55fb339fc1f Author: Lorenzo Stoakes Date: Sun Jan 18 14:50:41 2026 +0000 mm/rmap: remove anon_vma_merge() function This function is confusing, we already have the concept of anon_vma merge to adjacent VMA's anon_vma's to increase probability of anon_vma compatibility and therefore VMA merge (see is_mergeable_anon_vma() etc.), as well as anon_vma reuse, along side the usual VMA merge logic. We can remove the anon_vma check as it is redundant - a merge would not have been permitted with removal if the anon_vma's were not the same (and in the case of an unfaulted/faulted merge, we would have already set the unfaulted VMA's anon_vma to vp->remove->anon_vma in dup_anon_vma()). Avoid overloading this term when we're very simply unlinking anon_vma state from a removed VMA upon merge. Link: https://lkml.kernel.org/r/56bbe45e309f7af197b1c4f94a9a0c8931ff2d29.1768746221.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Harry Yoo Cc: Jann Horn Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Rik van Riel Cc: Shakeel Butt Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 535f6b8df17d4350dc37b2635b52fa8ab964132c Author: Lorenzo Stoakes Date: Sun Jan 18 14:50:40 2026 +0000 mm/rmap: remove unnecessary root lock dance in anon_vma clone, unmap The root anon_vma of all anon_vma's linked to a VMA must by definition be the same - a VMA and all of its descendants/ancestors must exist in the same CoW chain. Commit bb4aa39676f7 ("mm: avoid repeated anon_vma lock/unlock sequences in anon_vma_clone()") introduced paranoid checking of the root anon_vma remaining the same throughout all AVC's in 2011. I think 15 years later we can safely assume that this is always the case. Additionally, since unfaulted VMAs being cloned from or unlinked are no-op's, we can simply lock the anon_vma's associated with this rather than doing any specific dance around this. This removes unnecessary checks and makes it clear that the root anon_vma is shared between all anon_vma's in a given VMA's anon_vma_chain. Link: https://lkml.kernel.org/r/838030d2f0772b99fa99ff4b4fd571353f14a1a9.1768746221.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Harry Yoo Cc: Jann Horn Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 69e945845585e415fe18afcddbca7cdd215ff3c7 Author: Lorenzo Stoakes Date: Sun Jan 18 14:50:39 2026 +0000 mm/rmap: skip unfaulted VMAs on anon_vma clone, unlink For both anon_vma_clone() and unlink_anon_vmas(), if the source VMA or the VMA to be linked are unfaulted (e.g. !vma->anon_vma), then the functions do nothing. Simply exit early in these cases. In the unlink_anon_vmas() case we can also remove a conditional that checks whether vma->anon_vma is set. Link: https://lkml.kernel.org/r/085a25f7528e1c8c687276e9b856e88dc8f105ca.1768746221.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Harry Yoo Cc: Jann Horn Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Rik van Riel Cc: Shakeel Butt Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 91901a441fa19d56bdc2c45b76f4165585af773b Author: Lorenzo Stoakes Date: Sun Jan 18 14:50:38 2026 +0000 mm/rmap: eliminate partial anon_vma tear-down in anon_vma_fork() We have spun a web of unnecessary headaches for ourselves in anon_vma_fork() with the introduction of the anon_vma reuse logic, as introduced by commit 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy"). When we clone anon_vma's linked to a VMA via vma->anon_vma_chain, we check each anon_vma for specific conditions, and if met we set vma->anon_vma to this anon_vma to indicate we will reuse it rather than allocating a new one. It triggers upon the first ancestor anon_vma found that possesses at most 1 child, and no active VMAs. This was implemented such that if you continually fork and free VMAs, you would achieve anon_vma reuse rather than continually allocating unnecessary new anon_vma's. This however brings an unfortunate situation should a memory allocation fail during this process. anon_vma_fork(): 1. Clones the anon_vma. 2. If no reuse (i.e. !vma->anon_vma), tries to allocate anon_vma, AVC. 3. If 2 fails, we are forced to unwind step 1 by invoking unlink_anon_vmas(vma). This means that we send a partially set up (i.e. invalid) VMA to unlink_anon_vmas(). Doing this is dangerous and confusing - it is reasonable for kernel developers to assume unlink_anon_vmas() is called on a correctly established vma, and thus confusion arises if logic is implemented there to account for invalid VMAs, and further development might introduce subtle bugs. It is especially problematic in the anon rmap implementation which is essentially a broken abstraction. The patch solves the issue by simply trying to allocate the anon_vma and AVC ahead of time - i.e. optimising for the usual case - and freeing them should reuse occur or an error arise in anon_vma_clone(). This is not egregious performance-wise, as this function is called on the fork path which already performs a great number of allocations, and thus it is already a slow-path in this respect. It is additionally not egregious in terms of memory usage - the allocations are too-small-to-fail anyway unless, for instance, a fatal signal may have arisen, and any OOM for such tiny allocations that may arise would indicate the system is under so much memory pressure that the associated process is not long for this world anyway. We also update anon_vma->num_active_vmas to 1 directly rather than incrementing the newly allocated anon_vma's active VMA count - this makes it clear that this detached anon_vma can have only 1 num_active_vma at this point. Finally we eliminate the out_error and out_error_free_anon_vma labels which makes the logic much easier to follow. We also correct a small comment typo. Link: https://lkml.kernel.org/r/9923da5f8b095dd1e8d677692dcaf95859de0ef5.1768746221.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Harry Yoo Cc: Jann Horn Cc: Liam R. Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 542eda1a832947e0c44c9432972788587aaca95f Author: Lorenzo Stoakes Date: Sun Jan 18 14:50:37 2026 +0000 mm/rmap: improve anon_vma_clone(), unlink_anon_vmas() comments, add asserts Patch series "mm: clean up anon_vma implementation", v3. The anon_vma logic is hugely confusing and, much like a bundle of wires entangled with one another, pulling on one thread seems only to lead to more entanglement elsewhere. There is a mish-mash of the core implementation, how that implementation is invoked, how helper functions are invoked and concepts such as adjacent anon_vma merge and anon_vma object reuse. This series tries to improve the situation somewhat. It starts by establishing some invariants in the core anon_vma_clone() and unlink_anon_vmas() functions, largely expressed via VM_WARN_ON_ONCE() asserts. These act as some form of self-documentation as to the conditions we find ourselves in when invoking these functions. We also add kdoc comments for anon_vma_clone() and unlink_anon_vmas(). We then update anon_vma_fork() to avoid passing a partially set up (and thus invalid) VMA to unlink_anon_vmas() - functions which are used both for partially set up and valid data types has historically been the source of a lot of confusion and bugs. We then makes use of the established known conditions to directly skip unfaulted VMAs (rather than implicitly via an empty vma->anon_vma_chain list). We remove the confusing anon_vma_merge() function (we already have a concept of anon_vma merge in that we merge anon_vma's that would otherwise be compatible except for attributes that mprotect() could change - which anon_vma_merge() has nothing to do with). We make the anon_vma functions internal to mm as they do not need to be used by any other part of the kernel, which allows for future abstraction without concern about this. We then reduce the time over which we hold the anon rmap lock in anon_vma_clone(), as it turns out we can allocate anon_vma_chain objects without holding this lock, since the objects are not yet accessible from the rmap. This should reduce anon_vma lock contention. This additionally allows us to remove a confusing GFP_NOWAIT, GFP_KERNEL allocation fallback strategy. Finally, we explicitly indicate which operation is being performed upon anon_vma_clone(), and separate out fork-only logic to make it very clear that anon_vma reuse only occurs on fork. This patch (of 9): Add kdoc comments and describe exactly what these functions are used for in detail, pointing out importantly that the anon_vma_clone() !dst->anon_vma && src->anon_vma dance is ONLY for fork. Both are confusing functions that will be refactored in a subsequent patch but the first stage is establishing documentation and some invariants. Add some basic CONFIG_DEBUG_VM asserts that help document expected state, specifically: anon_vma_clone() - mmap write lock held. - We do nothing if src VMA is not faulted. - The destination VMA has no anon_vma_chain yet. - We are always operating on the same active VMA (i.e. vma->anon_vma). - If not forking, must operate on the same mm_struct. unlink_anon_vmas() - mmap lock held (write lock except when freeing page tables). - That unfaulted VMAs are no-ops. We are presented with a special case when anon_vma_clone() fails to allocate memory, where we have a VMA with partially set up anon_vma state. Since we hold the exclusive mmap write lock, and since we are cloning from a source VMA which consequently can't also have its anon_vma state modified, we know no anon_vma referenced can be empty. This allows us to significantly simplify this case and just remove anon_vma_chain objects associated with the VMA, so we add a specific partial cleanup path for this scenario. This also allows us to drop the hack of setting vma->anon_vma to NULL before unlinking anon_vma state in this scenario. Link: https://lkml.kernel.org/r/cover.1768746221.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/8644e89369be0cc89d7ac57443dff9e822803c91.1768746221.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: Harry Yoo Cc: Jann Horn Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0bec75167d9c491a5a01c6ca85303a58c5b95165 Author: Greg Thelen Date: Thu Jan 1 14:55:51 2026 -0800 memcg-v1: remove folio_memcg_lock() doc reference Commit a29c0e4b2e86 ("memcg-v1: remove memcg move locking code") removed folio_memcg_lock(). Delete the final lingering documentation reference. Link: https://lkml.kernel.org/r/20260101225552.3423108-1-gthelen@google.com Fixes: a29c0e4b2e86 ("memcg-v1: remove memcg move locking code") Signed-off-by: Greg Thelen Acked-by: Shakeel Butt Acked-by: SeongJae Park Cc: Tejun Heo Cc: Johannes Weiner Cc: "Michal Koutný" Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 743758ccf8bede3e7c38f3f7d3f5131aa0a7b4a6 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:21:03 2026 +0200 Revert "mm/hugetlb: deal with multiple calls to hugetlb_bootmem_alloc" This reverts commit d58b2498200724e4f8c12d71a5953da03c8c8bdf. hugetlb_bootmem_alloc() is called only once, no need to check if it was called already at its entry. Other checks performed during HVO initialization are also no longer necessary because sparse_init() that calls hugetlb_vmemmap_init_early() and hugetlb_vmemmap_init_late() is always called after hugetlb_bootmem_alloc(). Link: https://lkml.kernel.org/r/20260111082105.290734-30-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Muchun Song Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 7a9c0bf0aec621bba6d224e8c08713cf2cbcca0f Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:21:02 2026 +0200 mm/hugetlb: drop hugetlb_cma_check() hugetlb_cma_check() was required when the ordering of hugetlb_cma_reserve() and hugetlb_bootmem_alloc() was architecture depended. Since hugetlb_cma_reserve() is always called before hugetlb_bootmem_alloc() there is no need to check whether hugetlb_cma_reserve() was already called. Drop unneeded hugetlb_cma_check() function. Link: https://lkml.kernel.org/r/20260111082105.290734-29-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Muchun Song Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 9fac145b6d3fe570277438f8d860eabf229dc545 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:21:01 2026 +0200 mm, arch: consolidate hugetlb CMA reservation Every architecture that supports hugetlb_cma command line parameter reserves CMA areas for hugetlb during setup_arch(). This obfuscates the ordering of hugetlb CMA initialization with respect to the rest initialization of the core MM. Introduce arch_hugetlb_cma_order() callback to allow architectures report the desired order-per-bit of CMA areas and provide a week implementation of arch_hugetlb_cma_order() for architectures that don't support hugetlb with CMA. Use this callback in hugetlb_cma_reserve() instead if passing the order as parameter and call hugetlb_cma_reserve() from mm_core_init_early() rather than have it spread over architecture specific code. Link: https://lkml.kernel.org/r/20260111082105.290734-28-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 6632314fddc4f5c9d3c1a6800fc2a62e6a5155e8 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:21:00 2026 +0200 x86: don't reserve hugetlb memory in setup_arch() Commit 665eaf313314 ("x86/setup: call hugetlb_bootmem_alloc early") added an early call to hugetlb_bootmem_alloc() to setup_arch() to allow HVO style pre-initialization of vmemmap on x86. With the ordering of hugetlb reservation vs memory map initialization sorted out in core MM this no longer needs to be an architecture specific quirk. Drop the call to hugetlb_bootmem_alloc() from x86::setup_arch(). Link: https://lkml.kernel.org/r/20260111082105.290734-27-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 5dea39496c681a2de1683cb808f525d6d7115753 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:59 2026 +0200 mips: drop paging_init() All three variants of paging_init() on MIPS are wrappers for pagetable_init(). Instead of having three identical wrappers, call pagetable_init() directly from setup_arch() and remove the unnecessary paging_init() functions. Link: https://lkml.kernel.org/r/20260111082105.290734-26-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 4267739cabb82da75780c4699fe8208821929944 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:58 2026 +0200 arch, mm: consolidate initialization of SPARSE memory model Every architecture calls sparse_init() during setup_arch() although the data structures created by sparse_init() are not used until the initialization of the core MM. Beside the code duplication, calling sparse_init() from architecture specific code causes ordering differences of vmemmap and HVO initialization on different architectures. Move the call to sparse_init() from architecture specific code to free_area_init() to ensure that vmemmap and HVO initialization order is always the same. Link: https://lkml.kernel.org/r/20260111082105.290734-25-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit d49004c5f0c140bb83c87fab46dcf449cf00eb24 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:57 2026 +0200 arch, mm: consolidate initialization of nodes, zones and memory map To initialize node, zone and memory map data structures every architecture calls free_area_init() during setup_arch() and passes it an array of zone limits. Beside code duplication it creates "interesting" ordering cases between allocation and initialization of hugetlb and the memory map. Some architectures allocate hugetlb pages very early in setup_arch() in certain cases, some only create hugetlb CMA areas in setup_arch() and sometimes hugetlb allocations happen mm_core_init(). With arch_zone_limits_init() helper available now on all architectures it is no longer necessary to call free_area_init() from architecture setup code. Rather core MM initialization can call arch_zone_limits_init() in a single place. This allows to unify ordering of hugetlb vs memory map allocation and initialization. Remove the call to free_area_init() from architecture specific code and place it in a new mm_core_init_early() function that is called immediately after setup_arch(). After this refactoring it is possible to consolidate hugetlb allocations and eliminate differences in ordering of hugetlb and memory map initialization among different architectures. As the first step of this consolidation move hugetlb_bootmem_alloc() to mm_core_early_init(). Link: https://lkml.kernel.org/r/20260111082105.290734-24-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 2d3c8c5f33e0b90d8a9f6a41014a11355a20f3b1 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:56 2026 +0200 xtensa: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-23-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 34f6b9c6e417dcde58bd5b4284e3f2b7689522c7 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:55 2026 +0200 x86: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-22-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 531de7f02d51b3198245d30364b50fde3dfaea06 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:54 2026 +0200 um: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-21-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 6ad7ea22cf6f3d635f9a7a25273b0d3f43b4b600 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:53 2026 +0200 sparc: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-20-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Andreas Larsson Cc: Alexander Gordeev Cc: Alex Shi Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 8bfa6c2259f494e18b06add7e822c1c2982d0c03 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:52 2026 +0200 sh: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-19-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 76c4c463bbc0836c46d84775e7ca5bf6e22e8618 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:51 2026 +0200 s390: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-18-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit db8cdb0ad603105d987e6c9b04d28254c9d46120 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:50 2026 +0200 riscv: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-17-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 27bebe446f8d00444bb6bdc5cd57062e64ff3c36 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:49 2026 +0200 powerpc: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-16-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Ritesh Harjani (IBM) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 950696afe400d2f97df21ee6924cd297a994bf59 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:48 2026 +0200 parisc: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-15-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Helge Deller Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 1d28b1142383416d95c14c51ab3c865fdb6770cd Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:47 2026 +0200 openrisc: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-14-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Stafford Horne Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 3b1b0e5797bd325d0b40d82fe0f535badc51d1da Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:46 2026 +0200 nios2: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-13-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Dinh Nguyen Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit f61385e29444d4d2dca06766575da72cd814edf2 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:45 2026 +0200 mips: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-12-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 2ce38c9ae840ca7ddf401aec4310042581d64975 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:44 2026 +0200 microblaze: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-11-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 41b08a7abf890deeaa7a71d1cbad9879b605d8ea Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:43 2026 +0200 m68k: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Since all variants of m68k add all memory to ZONE_DMA, it is possible to use unified implementation for arch_zone_limits_init() that sets the end of ZONE_DMA to memblock_end_of_DRAM(). Link: https://lkml.kernel.org/r/20260111082105.290734-10-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 63cadcb731c914c85577512b0688fd62350644a8 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:42 2026 +0200 loongarch: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-9-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 934afdf7f4cc243c5b00352a0f8a54d2de283fe9 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:41 2026 +0200 hexagon: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-8-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 37318eb97f2374f89be6a1ca1515004847e3cc2a Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:40 2026 +0200 csky: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-7-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Guo Ren Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 60b35af0a6aa6b92dab6dd6d2cb0b39647d07436 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:39 2026 +0200 arm64: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. While on it rename zone_sizes_init() to dma_limits_init() to better reflect what that function does. Link: https://lkml.kernel.org/r/20260111082105.290734-6-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 18b7cc70dea8b4071ebf736724e99103115c5f95 Author: Klara Modin Date: Sun Jan 11 10:20:38 2026 +0200 arm: make initialization of zero page independent of the memory map Unlike most architectures, arm keeps a struct page pointer to the empty_zero_page and to initialize it requires conversion of a virtual address to page which makes it necessary to have memory map initialized before creating the empty_zero_page. Make empty_zero_page a stataic array in BSS to decouple it's initialization from the initialization of the memory map. This also aligns arm with vast majorty of architectures. Link: https://lkml.kernel.org/r/20260111082105.290734-5-rppt@kernel.org Signed-off-by: Klara Modin Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 30a66f8a8cd3ed3df69a672cf8f2a43eddd8a212 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:37 2026 +0200 arm: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 7988e85189048033a2784e8cf81c5d62dcd2af82 Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:36 2026 +0200 arc: introduce arch_zone_limits_init() Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Vineet Gupta Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Magnus Lindholm Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit ba1c86874e25e95de9b253570bb50cc3b5df542e Author: Mike Rapoport (Microsoft) Date: Sun Jan 11 10:20:35 2026 +0200 alpha: introduce arch_zone_limits_init() Patch series "arch, mm: consolidate hugetlb early reservation", v3. Order in which early memory reservation for hugetlb happens depends on architecture, on configuration options and on command line parameters. Some architectures rely on the core MM to call hugetlb_bootmem_alloc() while others call it very early to allow pre-allocation of HVO-style vmemmap. When hugetlb_cma is supported by an architecture it is initialized during setup_arch() and then later hugetlb_init code needs to understand did it happen or not. To make everything consistent and unified, both reservation of hugetlb memory from bootmem and creation of CMA areas for hugetlb must be called from core MM initialization and it would have been a simple change. However, HVO-style pre-initialization ordering requirements slightly complicate things and for HVO pre-init to work sparse and memory map should be initialized after hugetlb reservations. This required pulling out the call to free_area_init() out of setup_arch() path and moving it MM initialization and this is what the first 23 patches do. These changes are deliberately split into per-arch patches that change how the zone limits are calculated for each architecture and the patches 22 and 23 just remove the calls to free_area_init() and sprase_init() from arch/*. Patch 24 is a simple cleanup for MIPS. Patches 25 and 26 actually consolidate hugetlb reservations and patches 27 and 28 perform some aftermath cleanups. This patch (of 29): Move calculations of zone limits to a dedicated arch_zone_limits_init() function. Later MM core will use this function as an architecture specific callback during nodes and zones initialization and thus there won't be a need to call free_area_init() from every architecture. Link: https://lkml.kernel.org/r/20260111082105.290734-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20260111082105.290734-2-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Magnus Lindholm Cc: Alexander Gordeev Cc: Alex Shi Cc: Andreas Larsson Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: David Hildenbrand Cc: David S. Miller Cc: Dinh Nguyen Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Heiko Carstens Cc: Helge Deller Cc: Huacai Chen Cc: Ingo Molnar Cc: Johannes Berg Cc: John Paul Adrian Glaubitz Cc: Jonathan Corbet Cc: Klara Modin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matt Turner Cc: Max Filippov Cc: Michael Ellerman Cc: Michal Hocko Cc: Michal Simek Cc: Muchun Song Cc: Oscar Salvador Cc: Palmer Dabbelt Cc: Pratyush Yadav Cc: Richard Weinberger Cc: "Ritesh Harjani (IBM)" Cc: Russell King Cc: Stafford Horne Cc: Suren Baghdasaryan Cc: Thomas Bogendoerfer Cc: Thomas Gleixner Cc: Vasily Gorbik Cc: Vineet Gupta Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 398556570e32af82aa7654e730bcd655712ecf08 Author: Shivank Garg Date: Sun Jan 18 19:09:43 2026 +0000 mm/khugepaged: retry with sync writeback for MADV_COLLAPSE When MADV_COLLAPSE is called on file-backed mappings (e.g., executable text sections), the pages may still be dirty from recent writes. collapse_file() will trigger async writeback and fail with SCAN_PAGE_DIRTY_OR_WRITEBACK (-EAGAIN). MADV_COLLAPSE is a synchronous operation where userspace expects immediate results. If the collapse fails due to dirty pages, perform synchronous writeback on the specific range and retry once. This avoids spurious failures for freshly written executables while avoiding unnecessary synchronous I/O for mappings that are already clean. Link: https://lkml.kernel.org/r/20260118190939.8986-7-shivankg@amd.com Signed-off-by: Shivank Garg Reported-by: Branden Moore Closes: https://lore.kernel.org/all/4e26fe5e-7374-467c-a333-9dd48f85d7cc@amd.com Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE") Suggested-by: David Hildenbrand Tested-by: Lance Yang Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nico Pache Cc: Ryan Roberts Cc: wang lian Cc: Zach O'Keefe Cc: Zi Yan Signed-off-by: Andrew Morton commit 5173ae0a068d64643ccf4915b7cbedf82810a592 Author: Shivank Garg Date: Sun Jan 18 19:09:40 2026 +0000 mm/khugepaged: map dirty/writeback pages failures to EAGAIN Patch series "mm/khugepaged: fix dirty page handling for MADV_COLLAPSE", v5. MADV_COLLAPSE on file-backed mappings fails with -EINVAL when TEXT pages are dirty. This affects scenarios like package/container updates or executing binaries immediately after writing them, etc. The issue is that collapse_file() triggers async writeback and returns SCAN_FAIL (maps to -EINVAL), expecting khugepaged to revisit later. But MADV_COLLAPSE is synchronous and userspace expects immediate success or a clear retry signal. Reproduction: - Compile or copy 2MB-aligned executable to XFS/ext4 FS - Call MADV_COLLAPSE on .text section - First call fails with -EINVAL (text pages dirty from copy) - Second call succeeds (async writeback completed) Issue Report: https://lore.kernel.org/all/4e26fe5e-7374-467c-a333-9dd48f85d7cc@amd.com This patch (of 2): When collapse_file encounters dirty or writeback pages in file-backed mappings, it currently returns SCAN_FAIL which maps to -EINVAL. This is misleading as EINVAL suggests invalid arguments, whereas dirty/writeback pages represent transient conditions that may resolve on retry. Introduce SCAN_PAGE_DIRTY_OR_WRITEBACK to cover both dirty and writeback states, mapping it to -EAGAIN. For MADV_COLLAPSE, this provides userspace with a clear signal that retry may succeed after writeback completes. For khugepaged, this is harmless as it will naturally revisit the range during periodic scans after async writeback completes. Link: https://lkml.kernel.org/r/20260118190939.8986-2-shivankg@amd.com Link: https://lkml.kernel.org/r/20260118190939.8986-4-shivankg@amd.com Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE") Signed-off-by: Shivank Garg Reported-by: Branden Moore Closes: https://lore.kernel.org/all/4e26fe5e-7374-467c-a333-9dd48f85d7cc@amd.com Reviewed-by: Dev Jain Reviewed-by: Lance Yang Reviewed-by: Baolin Wang Reviewed-by: wang lian Acked-by: David Hildenbrand (Red Hat) Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nico Pache Cc: Ryan Roberts Cc: Zach O'Keefe Cc: Zi Yan Signed-off-by: Andrew Morton commit 3eef6c061f97ab2a942dc98291bcdae9a16e5bda Author: David Yang Date: Sat Jan 24 00:48:36 2026 +0800 net: ethernet: ti: netcp: Use u64_stats_t with u64_stats_sync properly On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. Convert to u64_stats_t to ensure atomic operations. Note that does not mean the code is now tear-free: there're u32 counters unprotected by u64_stats or anything else. Signed-off-by: David Yang Link: https://patch.msgid.link/20260123164841.2890054-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 5c05b3dbccb17ddd6515a6c749feee9b657a5640 Author: David Yang Date: Sat Jan 24 05:10:55 2026 +0800 netdevsim: use u64_stats_t with u64_stats_sync properly On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. Convert to u64_stats_t to ensure atomic operations. Signed-off-by: David Yang Link: https://patch.msgid.link/20260123211101.2929547-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit a84a1fe0fb2e9bfccb1d5a2929a249960a93264d Author: Gal Pressman Date: Sun Jan 25 12:55:24 2026 +0200 selftests: net: fix wrong boolean evaluation in __exit__ The __exit__ method receives ex_type as the exception class when an exception occurs. The previous code used implicit boolean evaluation: terminate = self.terminate or (self._exit_wait and ex_type) ^^^^^^^^^^^ In Python, the and operator can be used with non-boolean values, but it does not always return a boolean result. This is probably not what we want, because 'self._exit_wait and ex_type' could return the actual ex_type value (the exception class) rather than a boolean True when an exception occurs. Use explicit `ex_type is not None` check to properly evaluate whether an exception occurred, returning a boolean result. Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260125105524.773993-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 3ccf393cdd091ad18be1135d19773d3739d09caa Author: Heiner Kallweit Date: Sat Jan 24 22:30:15 2026 +0100 r8169: remove optional size argument in calls to strscpy Minor simplification of the code by removing the optional size argument. Signed-off-by: Heiner Kallweit Reviewed-by: Simon Horman Link: https://patch.msgid.link/d560ec66-848e-4290-818a-ce28f39de493@gmail.com Signed-off-by: Jakub Kicinski commit 5e3c5a2b85da973c1f20c93ccc9b251da1c64142 Author: Javen Xu Date: Sat Jan 24 22:27:24 2026 +0100 r8169: add support for extended chip version id and RTL9151AS The bits in register TxConfig used for chip identification aren't sufficient for the number of upcoming chip versions. Therefore a register is added with extended chip version information, for compatibility purposes it's called TX_CONFIG_V2. First chip to use the extended chip identification is RTL9151AS. Signed-off-by: Javen Xu [hkallweit1@gmail.com: add support for extended XID where XID is printed] Signed-off-by: Heiner Kallweit Reviewed-by: Simon Horman Link: https://patch.msgid.link/a3525b74-a1aa-43f6-8413-56615f6fa795@gmail.com Signed-off-by: Jakub Kicinski commit bd323fab96fba4a134d3c69bd12892f8ae3940bc Author: Ethan Nelson-Moore Date: Sat Jan 24 00:22:06 2026 -0800 net: usb: replace unnecessary get_link functions with usbnet_get_link usbnet_get_link calls mii_link_ok if the device has a MII defined in its usbnet struct and no check_connect function defined there. This is true of these drivers, so their custom get_link functions which call mii_link_ok are useless. Remove them in favor of usbnet_get_link. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Andrew Lunn Reviewed-by: Peter Korsgaard Link: https://patch.msgid.link/20260124082217.82351-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 2dd698f68e3c9bfcb2b33d3a0579b32f5824d91b Author: Ethan Nelson-Moore Date: Sat Jan 24 00:07:51 2026 -0800 net: usb: smsc95xx: use phy_do_ioctl_running function The smsc95xx_ioctl function behaves identically to the phy_do_ioctl_running function. Remove it and use the phy_do_ioctl_running function directly instead. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260124080751.78488-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 6ca9de3600f482b74723dc13b5e345e4bc3fb3fa Author: Pratyush Yadav (Google) Date: Fri Jan 16 16:54:11 2026 +0000 kho: print which scratch buffer failed to be reserved When scratch area fails to reserve, KHO prints a message indicating that. But it doesn't say which scratch failed to allocate. This can be useful information for debugging. Even more so when the failure is hard to reproduce. Along with the current message, also print which exact scratch area failed to be reserved. Link: https://lkml.kernel.org/r/20260116165416.1262531-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: David Matlack Cc: Pasha Tatashin Cc: Pratyush Yadav Cc: Samiullah Khawaja Signed-off-by: Andrew Morton commit 08e8f1ef3df270daef4ffc9c4bb15669f72d5d2f Author: Randy Dunlap Date: Wed Jan 14 22:47:56 2026 -0800 kernel-chktaint: add reporting for tainted modules Check all loaded modules and report any that have their 'taint' flags set. The tainted module output format is: * () Example output: Kernel is "tainted" for the following reasons: * externally-built ('out-of-tree') module was loaded (#12) * unsigned module was loaded (#13) Raw taint value as int/string: 12288/'G OE ' Tainted modules: * dump_test (OE) Link: https://lkml.kernel.org/r/20260115064756.531592-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Acked-by: Thorsten Leemhuis Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 89802ca36c96b324829996ef05013f82ecc9b68a Author: Wangyang Guo Date: Tue Jan 13 10:29:58 2026 +0800 lib/group_cpus: make group CPU cluster aware As CPU core counts increase, the number of NVMe IRQs may be smaller than the total number of CPUs. This forces multiple CPUs to share the same IRQ. If the IRQ affinity and the CPU's cluster do not align, a performance penalty can be observed on some platforms. This patch improves IRQ affinity by grouping CPUs by cluster within each NUMA domain, ensuring better locality between CPUs and their assigned NVMe IRQs. Details: Intel Xeon E platform packs 4 CPU cores as 1 module (cluster) and share the L2 cache. Let's say, if there are 40 CPUs in 1 NUMA domain and 11 IRQs to dispatch. The existing algorithm will map first 7 IRQs each with 4 CPUs and remained 4 IRQs each with 3 CPUs. The last 4 IRQs may have cross cluster issue. For example, the 9th IRQ which pinned to CPU32, then for CPU31, it will have cross L2 memory access. CPU |28 29 30 31|32 33 34 35|36 ... -------- -------- -------- IRQ 8 9 10 If this patch applied, then first 2 IRQs each mapped with 2 CPUs and rest 9 IRQs each mapped with 4 CPUs, which avoids the cross cluster memory access. CPU |00 01 02 03|04 05 06 07|08 09 10 11| ... ----- ----- ----------- ----------- IRQ 1 2 3 4 As a result, 15%+ performance difference is observed in FIO libaio/randread/bs=8k. Changes since V1: - Add more performance details in commit messages. - Fix endless loop when topology_cluster_cpumask return invalid mask. History: v1: https://lore.kernel.org/all/20251024023038.872616-1-wangyang.guo@intel.com/ v1 [RESEND]: https://lore.kernel.org/all/20251111020608.1501543-1-wangyang.guo@intel.com/ Link: https://lkml.kernel.org/r/20260113022958.3379650-1-wangyang.guo@intel.com Signed-off-by: Wangyang Guo Reviewed-by: Tianyou Li Reviewed-by: Tim Chen Tested-by: Dan Liang Cc: Christoph Hellwig Cc: Jens Axboe Cc: Keith Busch Cc: Ming Lei Cc: Radu Rendec Cc: Sagi Grimberg Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit 9a229ae249e0a24276901ad6807f31b32124f5c5 Author: Finn Thain Date: Tue Jan 13 16:22:28 2026 +1100 atomic: add option for weaker alignment check Add a new Kconfig symbol to make CONFIG_DEBUG_ATOMIC more useful on those architectures which do not align dynamic allocations to 8-byte boundaries. Without this, CONFIG_DEBUG_ATOMIC produces excessive WARN splats. Link: https://lkml.kernel.org/r/6d25a12934fe9199332f4d65d17c17de450139a8.1768281748.git.fthain@linux-m68k.org Signed-off-by: Finn Thain Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Boqun Feng Cc: "Borislav Petkov (AMD)" Cc: Daniel Borkman Cc: Dave Hansen Cc: Dinh Nguyen Cc: Eduard Zingerman Cc: Gary Guo Cc: Geert Uytterhoeven Cc: Guo Ren Cc: Hao Luo Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Fastabend Cc: John Paul Adrian Glaubitz Cc: Jonas Bonn Cc: KP Singh Cc: Marc Rutland Cc: Martin KaFai Lau Cc: Peter Zijlstra Cc: Rich Felker Cc: Sasha Levin (Microsoft) Cc: Song Liu Cc: Stafford Horne Cc: Stanislav Fomichev Cc: Stefan Kristiansson Cc: Thomas Gleixner Cc: Will Deacon Cc: Yonghong Song Cc: Yoshinori Sato Signed-off-by: Andrew Morton commit 80047d84eed25e9c92cfb9169980a0dfec110246 Author: Peter Zijlstra Date: Tue Jan 13 16:22:28 2026 +1100 atomic: add alignment check to instrumented atomic operations Add a Kconfig option for debug builds which logs a warning when an instrumented atomic operation takes place that's misaligned. Some platforms don't trap for this. [fthain@linux-m68k.org: added __DISABLE_EXPORTS conditional and refactored as helper function] Link: https://lkml.kernel.org/r/51ebf844e006ca0de408f5d3a831e7b39d7fc31c.1768281748.git.fthain@linux-m68k.org Link: https://lore.kernel.org/lkml/20250901093600.GF4067720@noisy.programming.kicks-ass.net/ Link: https://lore.kernel.org/linux-next/df9fbd22-a648-ada4-fee0-68fe4325ff82@linux-m68k.org/ Signed-off-by: Finn Thain Signed-off-by: Peter Zijlstra (Intel) Suggested-by: Geert Uytterhoeven Cc: Sasha Levin Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: Ard Biesheuvel Cc: "H. Peter Anvin" Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Arnd Bergmann Cc: Boqun Feng Cc: Daniel Borkman Cc: Dinh Nguyen Cc: Eduard Zingerman Cc: Gary Guo Cc: Guo Ren Cc: Hao Luo Cc: Jiri Olsa Cc: John Fastabend Cc: John Paul Adrian Glaubitz Cc: Jonas Bonn Cc: KP Singh Cc: Marc Rutland Cc: Martin KaFai Lau Cc: Rich Felker Cc: Song Liu Cc: Stafford Horne Cc: Stanislav Fomichev Cc: Stefan Kristiansson Cc: Will Deacon Cc: Yonghong Song Cc: Yoshinori Sato Signed-off-by: Andrew Morton commit e428b013d9dff30f7a65509e33047ba975cce8ba Author: Finn Thain Date: Tue Jan 13 16:22:28 2026 +1100 atomic: specify alignment for atomic_t and atomic64_t Some recent commits incorrectly assumed 4-byte alignment of locks. That assumption fails on Linux/m68k (and, interestingly, would have failed on Linux/cris also). The jump label implementation makes a similar alignment assumption. The expectation that atomic_t and atomic64_t variables will be naturally aligned seems reasonable, as indeed they are on 64-bit architectures. But atomic64_t isn't naturally aligned on csky, m68k, microblaze, nios2, openrisc and sh. Neither atomic_t nor atomic64_t are naturally aligned on m68k. This patch brings a little uniformity by specifying natural alignment for atomic types. One benefit is that atomic64_t variables do not get split across a page boundary. The cost is that some structs grow which leads to cache misses and wasted memory. See also, commit bbf2a330d92c ("x86: atomic64: The atomic64_t data type should be 8 bytes aligned on 32-bit too"). Link: https://lkml.kernel.org/r/a76bc24a4e7c1d8112d7d5fa8d14e4b694a0e90c.1768281748.git.fthain@linux-m68k.org Link: https://lore.kernel.org/lkml/CAFr9PX=MYUDGJS2kAvPMkkfvH+0-SwQB_kxE4ea0J_wZ_pk=7w@mail.gmail.com Link: https://lore.kernel.org/lkml/CAMuHMdW7Ab13DdGs2acMQcix5ObJK0O2dG_Fxzr8_g58Rc1_0g@mail.gmail.com/ Signed-off-by: Finn Thain Acked-by: Guo Ren Reviewed-by: Arnd Bergmann Cc: Guo Ren Cc: Geert Uytterhoeven Cc: Dinh Nguyen Cc: Jonas Bonn Cc: Stefan Kristiansson Cc: Stafford Horne Cc: Yoshinori Sato Cc: Rich Felker Cc: John Paul Adrian Glaubitz Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Ard Biesheuvel Cc: Boqun Feng Cc: "Borislav Petkov (AMD)" Cc: Daniel Borkman Cc: Dave Hansen Cc: Eduard Zingerman Cc: Gary Guo Cc: Hao Luo Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Marc Rutland Cc: Martin KaFai Lau Cc: Peter Zijlstra Cc: Sasha Levin (Microsoft) Cc: Song Liu Cc: Stanislav Fomichev Cc: Thomas Gleixner Cc: Will Deacon Cc: Yonghong Song Signed-off-by: Andrew Morton commit 3bb83c910971c47989aa439849265600fa67b42a Author: Finn Thain Date: Tue Jan 13 16:22:28 2026 +1100 bpf: explicitly align bpf_res_spin_lock Patch series "Align atomic storage", v7. This series adds the __aligned attribute to atomic_t and atomic64_t definitions in include/linux and include/asm-generic (respectively) to get natural alignment of both types on csky, m68k, microblaze, nios2, openrisc and sh. This series also adds Kconfig options to enable a new run-time warning to help reveal misaligned atomic accesses on platforms which don't trap that. The performance impact is expected to vary across platforms and workloads. The measurements I made on m68k show that some workloads run faster and others slower. This patch (of 4): Align bpf_res_spin_lock to avoid a BUILD_BUG_ON() when the alignment changes, as it will do on m68k when, in a subsequent patch, the minimum alignment of the atomic_t member of struct rqspinlock gets increased from 2 to 4. Drop the BUILD_BUG_ON() as it becomes redundant. Link: https://lkml.kernel.org/r/cover.1768281748.git.fthain@linux-m68k.org Link: https://lkml.kernel.org/r/8a83876b07d1feacc024521e44059ae89abbb1ea.1768281748.git.fthain@linux-m68k.org Signed-off-by: Finn Thain Acked-by: Alexei Starovoitov Reviewed-by: Arnd Bergmann Cc: Geert Uytterhoeven Cc: Andrii Nakryiko Cc: Ard Biesheuvel Cc: Boqun Feng Cc: "Borislav Petkov (AMD)" Cc: Daniel Borkman Cc: Dinh Nguyen Cc: Eduard Zingerman Cc: Gary Guo Cc: Guo Ren Cc: Hao Luo Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Fastabend Cc: John Paul Adrian Glaubitz Cc: Jonas Bonn Cc: KP Singh Cc: Marc Rutland Cc: Martin KaFai Lau Cc: Peter Zijlstra Cc: Rich Felker Cc: Sasha Levin (Microsoft) Cc: Song Liu Cc: Stafford Horne Cc: Stanislav Fomichev Cc: Stefan Kristiansson Cc: Thomas Gleixner Cc: Will Deacon Cc: Yonghong Song Cc: Yoshinori Sato Cc: Dave Hansen Signed-off-by: Andrew Morton commit 499f86de4f8c34e19a57daf2b6f0cba848e91994 Author: Sun Jian Date: Tue Jan 13 18:15:32 2026 +0800 init/main: read bootconfig header with get_unaligned_le32() get_boot_config_from_initrd() scans up to 3 bytes before initrd_end to handle GRUB 4-byte alignment. As a result, the bootconfig header immediately preceding the magic may be unaligned. Read the size and checksum fields with get_unaligned_le32() instead of casting to u32 * and using le32_to_cpu(), avoiding potential unaligned access and silencing sparse "cast to restricted __le32" warnings. Sparse warnings (gcc + C=1): init/main.c:292:16: warning: cast to restricted __le32 init/main.c:293:16: warning: cast to restricted __le32 No functional change intended. Link: https://lkml.kernel.org/r/20260113101532.1630770-1-sun.jian.kdev@gmail.com Signed-off-by: Sun Jian Cc: Ingo Molnar Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit a906f3ae4423d35c9804c8ec3a0db96ce9b54d44 Author: Lillian Berry Date: Sun Jan 11 07:56:35 2026 -0500 init/main.c: check if rdinit was explicitly set before printing warning The rdinit parameter is set by default, and attempted during boot even if not specified in the command line. Only print the warning about rdinit being inaccessible if the rdinit value was found in command line; it's just noise otherwise. [akpm@linux-foundation.org: move ramdisk_execute_command_set into __initdata] Link: https://lkml.kernel.org/r/20260111125635.53682-1-lillian@star-ark.net Signed-off-by: Lillian Berry Cc: Ahmad Fatoum Cc: Alexander Shishkin Cc: Al Viro Cc: Douglas Anderson Cc: Francesco Valla Cc: Guo Weikang Cc: Huacai Chen Cc: Huan Yang Cc: Ingo Molnar Cc: "Mike Rapoport (Microsoft)" Cc: Sascha Hauer Cc: Thomas Gleixner Signed-off-by: Andrew Morton commit 4cc67b048459bebb7a60b693044ec83fb853eba1 Author: Maciej W. Rozycki Date: Sun Jan 11 21:21:57 2026 +0000 linux/log2.h: reduce instruction count for is_power_of_2() Follow an observation that (n ^ (n - 1)) will only ever retain the most significant bit set in the word operated on if that is the only bit set in the first place, and use it to determine whether a number is a whole power of 2, avoiding the need for an explicit check for nonzero. This reduces the sequence produced to 3 instructions only across Alpha, MIPS, and RISC-V targets, down from 4, 5, and 4 respectively, removing a branch in the two latter cases. And it's 5 instructions on POWER and x86-64 vs 8 and 9 respectively. There are no branches now emitted here for targets that have a suitable conditional set operation, although an inline expansion will often end with one, depending on what code a call to this function is used in. Credit goes to GCC authors for coming up with this optimisation used as the fallback for (__builtin_popcountl(n) == 1), equivalent to this code, for targets where the hardware population count operation is considered expensive. Link: https://lkml.kernel.org/r/alpine.DEB.2.21.2601111836250.30566@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Cc: Jens Axboe Cc: John Garry Cc: "Martin K. Petersen" Cc: Su Hui Signed-off-by: Andrew Morton commit 5e65b5ca7d4e1f5d18e03ada94f549086ceb6500 Author: Mathieu Desnoyers Date: Wed Dec 24 12:38:10 2025 -0500 tsacct: skip all kernel threads This patch is a preparation step for HPCC, for the OOM killer improvements. I suspect that this patch is useful on its own, because it really makes no sense to sum up accounting statistics of use_mm within kernel threads which are only temporarily using those mm. When we hit acct_account_cputime within a irq handler over a kthread that happens to use a userspace mm, we end up summing up the mm's RSS into the tsk acct_rss_mem1, which eventually decays. I don't see a good rationale behind tracking the mm's rss in that way when a kthread use a userspace mm temporarily through use_mm. It causes issues with init_mm and efi_mm which only partially initialize their mm_struct when introducing the new hierarchical percpu counters to replace RSS counters, which requires a pointer dereference when reading the approximate counter sum. The current percpu counters simply load a zeroed atomic counter, which happen to work. Skip all kernel threads in acct_account_cputime(), not just those that happen to have a NULL mm. This is a preparation step before introducing the hierarchical percpu counters. Link: https://lkml.kernel.org/r/20251224173810.648699-2-mathieu.desnoyers@efficios.com Signed-off-by: Mathieu Desnoyers Cc: Mark Brown Cc: Aboorva Devarajan Cc: Al Viro Cc: Baolin Wang Cc: Christan König Cc: Christian Brauner Cc: Christoph Lameter Cc: David Hildenbrand Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: "Liam R . Howlett" Cc: Lorenzo Stoakes Cc: Martin Liu Cc: Masami Hiramatsu Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: "Paul E. McKenney" Cc: Roman Gushchin Cc: SeongJae Park Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sweet Tea Dorminy Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Wei Yang Cc: Yu Zhao Signed-off-by: Andrew Morton commit e8eef69a99f185e75909adb24ab93d706e07bf27 Author: Tony Luck Date: Mon Jan 12 10:08:53 2026 -0800 once: don't use a work queue to reset sleepable static key Pointless overhead to use a work queue to reset the static key for a DO_ONCE_SLEEPABLE() invocation. Note that the previous code path included a BUG_ON() if the static key was already disabled. Dropped that as part of this change because: 1) Use of BUG_ON() is highly discouraged. 2) There is a WARN_ON() in the static_branch_disable() code path that would provide adequate breadcrumbs to debug any issue. Link: https://lkml.kernel.org/r/aWU4tfTju1l3oZCu@agluck-desk3 Signed-off-by: Tony Luck Reported-by: Reinette Chatre Cc: Eric Dumazet Signed-off-by: Andrew Morton commit 8cafcb881364af5ef3a8b9fed4db254054033d8a Author: Zhiyu Zhang Date: Thu Jan 1 19:11:48 2026 +0800 fat: avoid parent link count underflow in rmdir Corrupted FAT images can leave a directory inode with an incorrect i_nlink (e.g. 2 even though subdirectories exist). rmdir then unconditionally calls drop_nlink(dir) and can drive i_nlink to 0, triggering the WARN_ON in drop_nlink(). Add a sanity check in vfat_rmdir() and msdos_rmdir(): only drop the parent link count when it is at least 3, otherwise report a filesystem error. Link: https://lkml.kernel.org/r/20260101111148.1437-1-zhiyuzhang999@gmail.com Fixes: 9a53c3a783c2 ("[PATCH] r/o bind mounts: unlink: monitor i_nlink") Signed-off-by: Zhiyu Zhang Reported-by: Zhiyu Zhang Closes: https://lore.kernel.org/linux-fsdevel/aVN06OKsKxZe6-Kv@casper.infradead.org/T/#t Tested-by: Zhiyu Zhang Acked-by: OGAWA Hirofumi Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Signed-off-by: Andrew Morton commit 25929dae28f528d7d74992edabd38bf3c374e485 Author: Long Wei Date: Tue Dec 16 19:44:00 2025 +0800 kho: remove duplicate header file references kexec_handover_internal.h is included twice in kexec_handover.c. Remove the redundant first inclusion to eliminate the duplication. Link: https://lkml.kernel.org/r/20251216114400.2677311-1-longwei27@huawei.com Signed-off-by: Long Wei Reviewed-by: Pasha Tatashin Cc: Alexander Graf Cc: hewenliang Cc: Mike Rapoport Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit 77ce1b4cd08fcdd049001fdf5f59c014fb4b7711 Author: Long Wei Date: Wed Jan 7 10:24:27 2026 +0800 kho: test: clean up residual memory upon test_kho module unload During the initialization phase, the test_kho module invokes the kho_preserve_folio function, which internally configures bitmaps within kho_mem_track and establishes chunk linked lists in KHO. Upon unloading the test_kho module, it is necessary to clean up these states. Link: https://lkml.kernel.org/r/20260107022427.4114424-1-longwei27@huawei.com Signed-off-by: Long Wei Acked-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: hewenliang Cc: Pasha Tatashin Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit bf45794244ca1fb1c135754f36ff765eea01f9e6 Author: Kir Chou Date: Thu Jan 8 21:07:53 2026 +0900 lib/glob: convert selftest to KUnit This patch converts the existing glob selftest (lib/globtest.c) to use the KUnit framework (lib/tests/glob_kunit.c). The new test: - Migrates all 64 test cases from the original test to the KUnit suite. - Removes the custom 'verbose' module parameter as KUnit handles logging. - Updates Kconfig.debug and Makefile to support the new KUnit test. - Updates Kconfig and Makefile to remove the original selftest. - Updates GLOB_SELFTEST to GLOB_KUNIT_TEST for arch/m68k/configs. This commit is verified by `./tools/testing/kunit/kunit.py run' with the .kunit/.kunitconfig: CONFIG_KUNIT=y CONFIG_GLOB_KUNIT_TEST=y Link: https://lkml.kernel.org/r/20260108120753.27339-1-note351@hotmail.com Signed-off-by: Kir Chou Acked-by: Geert Uytterhoeven Reviewed-by: David Gow Reviewed-by: Kuan-Wei Chiu Cc: Signed-off-by: Andrew Morton commit 105ddfb2d2b3acec7a7d9695463df48733d91e6c Author: Alice Ryhl Date: Wed Jan 7 08:28:46 2026 +0000 rust: task: restrict Task::group_leader() to current The Task::group_leader() method currently allows you to access the group_leader() of any task, for example one you hold a refcount to. But this is not safe in general since the group leader could change when a task exits. See for example commit a15f37a40145c ("kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths"). All existing users of Task::group_leader() call this method on current, which is guaranteed running, so there's not an actual issue in Rust code today. But to prevent code in the future from making this mistake, restrict Task::group_leader() so that it can only be called on current. There are some other cases where accessing task->group_leader is okay. For example it can be safe if you hold tasklist_lock or rcu_read_lock(). However, only supporting current->group_leader is sufficient for all in-tree Rust users of group_leader right now. Safe Rust functionality for accessing it under rcu or while holding tasklist_lock may be added in the future if required by any future Rust module. This patch is a bugfix in that it prevents users of this API from writing incorrect code. It doesn't change behavior of correct code. Link: https://lkml.kernel.org/r/20260107-task-group-leader-v2-1-8fbf816f2a2f@google.com Signed-off-by: Alice Ryhl Fixes: 313c4281bc9d ("rust: add basic `Task`") Reported-by: Oleg Nesterov Closes: https://lore.kernel.org/all/aTLnV-5jlgfk1aRK@redhat.com/ Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Cc: Andreas Hindborg Cc: Benno Lossin Cc: "Björn Roy Baron" Cc: Björn Roy Baron Cc: Christian Brauner Cc: Danilo Krummrich Cc: FUJITA Tomonori Cc: Miguel Ojeda Cc: Panagiotis Foliadis Cc: Shankari Anand Cc: Trevor Gross Signed-off-by: Andrew Morton commit 2bbd9e1d14d6156180d21cc871a51a3bd1839c81 Author: mingzhu.wang(王明珠) Date: Wed Jan 7 08:15:32 2026 +0000 kernel/fork: update obsolete use_mm references to kthread_use_mm The comment for get_task_mm() in kernel/fork.c incorrectly references the deprecated function `use_mm()`, which has been renamed to `kthread_use_mm()` in kernel/kthread.c. This patch updates the documentation to reflect the current function names, ensuring accuracy when developers refer to the kernel thread memory context API. No functional changes were introduced. Link: https://lkml.kernel.org/r/KUZPR04MB8965F954108B4DD7E8FFDB2B8F84A@KUZPR04MB8965.apcprd04.prod.outlook.com Signed-off-by: mingzhu.wang Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Jiazi Li Cc: Juri Lelli Cc: Kees Cook Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit c62e7e6444cd75dfea2609646f25c66f28b95082 Author: Deepanshu Kartikey Date: Sun Jan 4 19:05:04 2026 +0530 ocfs2: add check for free bits before allocation in ocfs2_move_extent() Add a check to verify the group descriptor has enough free bits before attempting allocation in ocfs2_move_extent(). This prevents a kernel BUG_ON crash in ocfs2_block_group_set_bits() when the move_extents ioctl is called on a crafted or corrupted filesystem. The existing validation in ocfs2_validate_gd_self() only checks static metadata consistency (bg_free_bits_count <= bg_bits) when the descriptor is first read from disk. However, during move_extents operations, multiple allocations can exhaust the free bits count below the requested allocation size, triggering BUG_ON(le16_to_cpu(bg->bg_free_bits_count) < num_bits). The debug trace shows the issue clearly: - Block group 32 validated with bg_free_bits_count=427 - Repeated allocations decreased count: 427 -> 171 -> 43 -> ... -> 1 - Final request for 2 bits with only 1 available triggers BUG_ON By adding an early check in ocfs2_move_extent() right after ocfs2_find_victim_alloc_group(), we return -ENOSPC gracefully instead of crashing the kernel. This also avoids unnecessary work in ocfs2_probe_alloc_group() and __ocfs2_move_extent() when the allocation will fail. Link: https://lkml.kernel.org/r/20260104133504.14810-1-kartikey406@gmail.com Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+7960178e777909060224@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7960178e777909060224 Link: https://lore.kernel.org/all/20251231115801.293726-1-kartikey406@gmail.com/T/ [v1] Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit dbac35bee8fc844c2d8d6417af874a170a44d41f Author: Tomas Glozar Date: Tue Jan 6 15:01:40 2026 +0100 lib/Kconfig.debug: fix BOOTPARAM_HUNG_TASK_PANIC comment The comment for CONFIG_BOOTPARAM_HUNG_TASK_PANIC says: Say N if unsure. but since commit 9544f9e6947f ("hung_task: panic when there are more than N hung tasks at the same time"), N is not a valid value for the option, leading to a warning at build time: .config:11736:warning: symbol value 'n' invalid for BOOTPARAM_HUNG_TASK_PANIC as well as an error when given to menuconfig. Fix the comment to say '0' instead of 'N'. Link: https://lkml.kernel.org/r/20260106140140.136446-1-tglozar@redhat.com Fixes: 9544f9e6947f ("hung_task: panic when there are more than N hung tasks at the same time") Signed-off-by: Tomas Glozar Reported-by: Johnny Mnemonic Reviewed-by: Lance Yang Cc: Li RongQing Signed-off-by: Andrew Morton commit dd1e79ef6ca188678ece81a77d0076ae7403116c Author: Mike Rapoport (Microsoft) Date: Mon Jan 5 18:58:39 2026 +0200 kho/abi: add memblock ABI header Introduce KHO ABI header describing preservation ABI for memblock's reserve_mem regions and link the relevant documentation to KHO docs. [lukas.bulwahn@redhat.com: MAINTAINERS: adjust file entry in MEMBLOCK AND MEMORY MANAGEMENT INITIALIZATION] Link: https://lkml.kernel.org/r/20260107090438.22901-1-lukas.bulwahn@redhat.com [rppt@kernel.org: update reserved_mem node description, per Pratyush] Link: https://lkml.kernel.org/r/aW_M-HYZzx5SkbnZ@kernel.org Link: https://lkml.kernel.org/r/20260105165839.285270-7-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Jason Miu Cc: Jonathan Corbet Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit ac2d8102c4b88713a8fa371d5d802fcff131d6ac Author: Jason Miu Date: Mon Jan 5 18:58:38 2026 +0200 kho: relocate vmalloc preservation structure to KHO ABI header The `struct kho_vmalloc` defines the in-memory layout for preserving vmalloc regions across kexec. This layout is a contract between kernels and part of the KHO ABI. To reflect this relationship, the related structs and helper macros are relocated to the ABI header, `include/linux/kho/abi/kexec_handover.h`. This move places the structure's definition under the protection of the KHO_FDT_COMPATIBLE version string. The structure and its components are now also documented within the ABI header to describe the contract and prevent ABI breaks. [rppt@kernel.org: update comment, per Pratyush] Link: https://lkml.kernel.org/r/aW_Mqp6HcqLwQImS@kernel.org Link: https://lkml.kernel.org/r/20260105165839.285270-6-rppt@kernel.org Signed-off-by: Jason Miu Co-developed-by: Mike Rapoport (Microsoft) Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Jonathan Corbet Cc: Pasha Tatashin Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit 5e1ea1e27b6ff237122ac6cb30e0b8ea4618f75f Author: Jason Miu Date: Mon Jan 5 18:58:37 2026 +0200 kho: introduce KHO FDT ABI header Introduce the `include/linux/kho/abi/kexec_handover.h` header file, which defines the stable ABI for the KHO mechanism. This header specifies how preserved data is passed between kernels using an FDT. The ABI contract includes the FDT structure, node properties, and the "kho-v1" compatible string. By centralizing these definitions, this header serves as the foundational agreement for inter-kernel communication of preserved states, ensuring forward compatibility and preventing misinterpretation of data across kexec transitions. Since the ABI definitions are now centralized in the header files, the YAML files that previously described the FDT interfaces are redundant. These redundant files have therefore been removed. Link: https://lkml.kernel.org/r/20260105165839.285270-5-rppt@kernel.org Signed-off-by: Jason Miu Co-developed-by: Mike Rapoport (Microsoft) Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Jonathan Corbet Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit a6f4e56828029bc3b9a79910b38026fd2958915e Author: Mike Rapoport (Microsoft) Date: Mon Jan 5 18:58:36 2026 +0200 kho: docs: combine concepts and FDT documentation Currently index.rst in KHO documentation looks empty and sad as it only contains links to "Kexec Handover Concepts" and "KHO FDT" chapters. Inline contents of these chapters into index.rst to provide a single coherent chapter describing KHO. While on it, drop parts of the KHO FDT description that will be superseded by addition of KHO ABI documentation. [rppt@kernel.org: fix Documentation/core-api/kho/index.rst] Link: https://lkml.kernel.org/r/aV4bnHlBXGpT_FMc@kernel.org Link: https://lkml.kernel.org/r/20260105165839.285270-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Jason Miu Cc: Jonathan Corbet Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit 32cb2729c956162e5ca96fe5509b38eb9561e8c0 Author: Mike Rapoport (Microsoft) Date: Mon Jan 5 18:58:35 2026 +0200 kho/abi: memfd: make generated documentation more coherent memfd preservation ABI description starts with "This header defines" which is fine in the header but reads weird in the generated html documentation. Update it to make the generated documentation coherent. Link: https://lkml.kernel.org/r/20260105165839.285270-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Jason Miu Cc: Jonathan Corbet Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit a7e53bfb43667dd0eaf046c1725105e2cfe3be7c Author: Mike Rapoport (Microsoft) Date: Mon Jan 5 18:58:34 2026 +0200 kho/abi: luo: make generated documentation more coherent Patch series "kho: ABI headers and Documentation updates". LUO started adding KHO ABI headers to include/linux/kho/abi, but the core parts of KHO and memblock are still using the old way for descriptions on their ABIs. Let's consolidate all things KHO in include/linux/kho/abi. And while on that, make some documentation updates to have more coherent KHO docs. This patch (of 6): LUO ABI description starts with "This header defines" which is fine in the header but reads weird in the generated html documentation. Update it to make the generated documentation coherent. Link: https://lkml.kernel.org/r/20260105165839.285270-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20260105165839.285270-2-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Jonathan Corbet Cc: Pasha Tatashin Cc: Jason Miu Signed-off-by: Andrew Morton commit 77983f611fa61d749db4579d20908663e5a0895e Author: Julia Lawall Date: Tue Dec 30 15:25:13 2025 +0100 ocfs2: adjust function name reference There is no function dlm_mast_regions(). However, dlm_match_regions() is passed the buffer "local", which it uses internally, so it seems like dlm_match_regions() was intended. Link: https://lkml.kernel.org/r/20251230142513.95467-1-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit c5489d04337b47e93c0623e8145fcba3f5739efd Author: Harshit Mogalapalli Date: Tue Dec 30 22:16:09 2025 -0800 x86/kexec: add a sanity check on previous kernel's ima kexec buffer When the second-stage kernel is booted via kexec with a limiting command line such as "mem=", the physical range that contains the carried over IMA measurement list may fall outside the truncated RAM leading to a kernel panic. BUG: unable to handle page fault for address: ffff97793ff47000 RIP: ima_restore_measurement_list+0xdc/0x45a #PF: error_code(0x0000) – not-present page Other architectures already validate the range with page_is_ram(), as done in commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer against memory bounds") do a similar check on x86. Without carrying the measurement list across kexec, the attestation would fail. Link: https://lkml.kernel.org/r/20251231061609.907170-4-harshit.m.mogalapalli@oracle.com Signed-off-by: Harshit Mogalapalli Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec") Reported-by: Paul Webb Reviewed-by: Mimi Zohar Cc: Alexander Graf Cc: Ard Biesheuvel Cc: Baoquan He Cc: Borislav Betkov Cc: guoweikang Cc: Henry Willard Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jiri Bohac Cc: Joel Granados Cc: Jonathan McDowell Cc: Mike Rapoport Cc: Sohil Mehta Cc: Sourabh Jain Cc: Thomas Gleinxer Cc: Yifei Liu Cc: Signed-off-by: Andrew Morton commit 4d02233235ed0450de9c10fcdcf3484e3c9401ce Author: Harshit Mogalapalli Date: Tue Dec 30 22:16:08 2025 -0800 of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() Refactor the OF/DT ima_get_kexec_buffer() to use a generic helper to validate the address range. No functional change intended. Link: https://lkml.kernel.org/r/20251231061609.907170-3-harshit.m.mogalapalli@oracle.com Signed-off-by: Harshit Mogalapalli Reviewed-by: Mimi Zohar Cc: Alexander Graf Cc: Ard Biesheuvel Cc: Baoquan He Cc: Borislav Betkov Cc: guoweikang Cc: Henry Willard Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jiri Bohac Cc: Joel Granados Cc: Jonathan McDowell Cc: Mike Rapoport Cc: Paul Webb Cc: Sohil Mehta Cc: Sourabh Jain Cc: Thomas Gleinxer Cc: Yifei Liu Cc: Signed-off-by: Andrew Morton commit 10d1c75ed4382a8e79874379caa2ead8952734f9 Author: Harshit Mogalapalli Date: Tue Dec 30 22:16:07 2025 -0800 ima: verify the previous kernel's IMA buffer lies in addressable RAM Patch series "Address page fault in ima_restore_measurement_list()", v3. When the second-stage kernel is booted via kexec with a limiting command line such as "mem=" we observe a pafe fault that happens. BUG: unable to handle page fault for address: ffff97793ff47000 RIP: ima_restore_measurement_list+0xdc/0x45a #PF: error_code(0x0000) not-present page This happens on x86_64 only, as this is already fixed in aarch64 in commit: cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer against memory bounds") This patch (of 3): When the second-stage kernel is booted with a limiting command line (e.g. "mem="), the IMA measurement buffer handed over from the previous kernel may fall outside the addressable RAM of the new kernel. Accessing such a buffer can fault during early restore. Introduce a small generic helper, ima_validate_range(), which verifies that a physical [start, end] range for the previous-kernel IMA buffer lies within addressable memory: - On x86, use pfn_range_is_mapped(). - On OF based architectures, use page_is_ram(). Link: https://lkml.kernel.org/r/20251231061609.907170-1-harshit.m.mogalapalli@oracle.com Link: https://lkml.kernel.org/r/20251231061609.907170-2-harshit.m.mogalapalli@oracle.com Signed-off-by: Harshit Mogalapalli Reviewed-by: Mimi Zohar Cc: Alexander Graf Cc: Ard Biesheuvel Cc: Borislav Betkov Cc: guoweikang Cc: Henry Willard Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jiri Bohac Cc: Joel Granados Cc: Jonathan McDowell Cc: Mike Rapoport Cc: Paul Webb Cc: Sohil Mehta Cc: Sourabh Jain Cc: Thomas Gleinxer Cc: Yifei Liu Cc: Baoquan He Cc: Signed-off-by: Andrew Morton commit e896c44aecfb7b3470470b4e63495dfa2b359060 Author: Thomas Weißschuh Date: Tue Dec 30 08:13:15 2025 +0100 types: drop definition of __EXPORTED_HEADERS__ This definition disarms the warning in uapi/linux/types.h about including kernel headers from user space. However the warning is already disarmed due to the fact that kernel code is built with -D__KERNEL__. Drop the pointless definition. Link: https://lkml.kernel.org/r/20251230-exported-headers-types-h-v1-1-947fc606f3d8@linutronix.de Signed-off-by: Thomas Weißschuh Cc: Arnd Bergmann Signed-off-by: Andrew Morton commit 998be0a4dbcaa796a05c7b52327f3a09c29d3662 Author: Pasha Tatashin Date: Tue Dec 30 11:14:02 2025 -0500 liveupdate: separate memfd support into LIVEUPDATE_MEMFD Decouple memfd preservation support from the core Live Update Orchestrator configuration. Previously, enabling CONFIG_LIVEUPDATE forced a dependency on CONFIG_SHMEM and unconditionally compiled memfd_luo.o. However, Live Update may be used for purposes that do not require memfd-backed memory preservation. Introduce CONFIG_LIVEUPDATE_MEMFD to gate memfd_luo.o. This moves the SHMEM and MEMFD_CREATE dependencies to the specific feature that needs them, allowing the base LIVEUPDATE option to be selected independently of shared memory support. Link: https://lkml.kernel.org/r/20251230161402.1542099-1-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit 1921044eebf1d6861a6de1a76e3f63729a45e712 Author: Chaitanya Mishra Date: Sat Dec 27 14:52:29 2025 +0530 lib/kstrtox: fix kstrtobool() docstring to mention enabled/disabled Commit ae5b3500856f ("kstrtox: add support for enabled and disabled in kstrtobool()") added support for 'e'/'E' (enabled) and 'd'/'D' (disabled) inputs, but did not update the docstring accordingly. Update the docstring to include 'Ee' (for true) and 'Dd' (for false) in the list of accepted first characters. Link: https://lkml.kernel.org/r/20251227092229.57330-1-chaitanyamishra.ai@gmail.com Fixes: ae5b3500856f ("kstrtox: add support for enabled and disabled in kstrtobool()") Signed-off-by: Chaitanya Mishra Cc: Mario Limonciello Signed-off-by: Andrew Morton commit ad533a740c7ccb801619ed962807605254fe7545 Author: Christian Marangi Date: Sat Dec 13 12:53:09 2025 +0100 resource: provide 0args DEFINE_RES variant for unset resource desc Provide a variant of DEFINE_RES that takes 0 arguments to initialize an "unset" resource descriptor. This should be used for the improper case of struct resource res = {}; where DEFINE_RES() should be used. With this new helper variant, it would result in: struct resource res = DEFINE_RES(); instead of having to define the full 3 arguments: struct resource res = DEFINE_RES(0, 0, IORESOURCE_UNSET); DEFINE_RES() with no args, will set the flags to IORESOURCE_UNSET signaling the resource descriptor is UNSET and doesn't reflect an actual resource currently. Link: https://lkml.kernel.org/r/20251213115314.16700-1-ansuelsmth@gmail.com Signed-off-by: Christian Marangi Suggested-by: Ilpo Järvinen Reviewed-by: Bjorn Helgaas Reviewed-by: Andy Shevchenko Signed-off-by: Andrew Morton commit 1965bbb8f3c72e5f1972b5eeb6f19a36664a676d Author: Thomas Weißschuh Date: Mon Dec 22 08:55:10 2025 +0100 ipc/shm: uapi: remove dependency on libc Using libc types and headers from the UAPI headers is problematic as it introduces a dependency on a full C toolchain. shm.h does not even use any symbols from the libc header as the usage of getpagesize() was removed a decade ago in commit 060028bac94b ("ipc/shm.c: increase the defaults for SHMALL, SHMMAX") Drop the unnecessary inclusion. Link: https://lkml.kernel.org/r/20251222-uapi-shm-v1-1-270bb7f75d97@linutronix.de Signed-off-by: Thomas Weißschuh Cc: Arnd Bergmann Signed-off-by: Andrew Morton commit d30aca3eeffc18452e5cc5c4e59f1a4da2bd2f12 Author: Ryota Sakamoto Date: Sun Dec 21 13:35:16 2025 +0000 lib/tests: convert test_min_heap module to KUnit Move lib/test_min_heap.c to lib/tests/min_heap_kunit.c and convert it to use KUnit. This change switches the ad-hoc test code to standard KUnit test cases. The test data remains the same, but the verification logic is updated to use KUNIT_EXPECT_* macros. Also remove CONFIG_TEST_MIN_HEAP from arch/*/configs/* because it is no longer used. The new CONFIG_MIN_HEAP_KUNIT_TEST will be automatically enabled by CONFIG_KUNIT_ALL_TESTS. The reasons for converting to KUnit are: 1. Standardization: Switching from ad-hoc printk-based reporting to the standard KTAP format makes it easier for CI systems to parse and report test results 2. Better Diagnostics: Using KUNIT_EXPECT_* macros automatically provides detailed diagnostics on failure. 3. Tooling Integration: It allows the test to be managed and executed using standard KUnit tools. Link: https://lkml.kernel.org/r/20251221133516.321846-1-sakamo.ryota@gmail.com Signed-off-by: Ryota Sakamoto Acked-by: Kuan-Wei Chiu Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: David Gow Cc: Geert Uytterhoeven Cc: Heiko Carstens Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Sven Schnelle Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit 0e7fd23f9293cee3c7f341498a0011d09c491510 Author: Kari Argillander Date: Fri Dec 19 18:25:11 2025 +0200 editorconfig: add rst extension We have a lot of .rst documentation; use editorconfig rules for those. This sets the default tab width to 8, which makes indentation consistent and avoids requiring developers to adjust editor settings manually. Link: https://lkml.kernel.org/r/20251219-editorconfig-rst-v1-1-58d4fa397664@gmail.com Signed-off-by: Kari Argillander Cc: Danny Lin Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Mickael Salaun Cc: Íñigo Huguet Signed-off-by: Andrew Morton commit c243413740b39b0cf0a88732de5efc2b45716d81 Author: Randy Dunlap Date: Fri Dec 19 21:45:41 2025 -0800 kfifo: fix kmalloc_array_node() argument order To be consistent, pass the kmalloc_array_node() parameters in the order (number_of_elements, element_size). Since only the product of the two values is used, this is not a bug fix. Link: https://lkml.kernel.org/r/20251220054541.2295599-1-rdunlap@infradead.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=216015 Signed-off-by: Randy Dunlap Cc: Stefani Seibold Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 76961e5b334ae9d974b3add005c1501982c8a43c Merge: 6e9674a980f583 1fd1281250c384 Author: Jakub Kicinski Date: Mon Jan 26 18:58:23 2026 -0800 Merge branch 'code-clean-up' Justin Chen says: ==================== code clean up Clean up and streamlined some code that is no longer needed due to older HW support being dropped. ==================== Link: https://patch.msgid.link/20260122194949.1145107-1-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 1fd1281250c38408d793863c8dcaa43c7de8932c Author: Justin Chen Date: Thu Jan 22 11:49:49 2026 -0800 net: bcmasp: streamline early exit in probe Streamline the bcmasp_probe early exit. As support for other functionality is added(i.e. ptp), it is easier to keep track of early exit cleanup when it is all in one place. Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260122194949.1145107-3-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 9271fc31901d5f0894dd484a4e4437e37054c4ec Author: Justin Chen Date: Thu Jan 22 11:49:48 2026 -0800 net: bcmasp: clean up some legacy logic Removed wol_irq check. This was needed for brcm,asp-v2.0, which was removed in previous commits. Removed bcmasp_intf_ops. These function pointers were added to make it easier to implement pseudo channels. These channels were removed in newer versions of the hardware and were never implemented. Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260122194949.1145107-2-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 6e9674a980f583c9545a6a12b434e277fee28e19 Author: David Yang Date: Fri Jan 23 02:51:07 2026 +0800 net: alacritech: Use u64_stats_t with u64_stats_sync properly On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. Convert to u64_stats_t to ensure atomic operations. Signed-off-by: David Yang Link: https://patch.msgid.link/20260122185113.2760355-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 8016abd6314ed1ed01ff09404e3c82ceb13c185b Merge: 78980b4c7fcb5e 2d96bbdfd3b5d2 Author: Alexei Starovoitov Date: Mon Jan 26 18:46:43 2026 -0800 Merge branch 'selftests-bpf-migrate-a-few-bpftool-testing-scripts' Alexis Lothoré says: ==================== selftests/bpf: migrate a few bpftool testing scripts this is the v4 for some bpftool tests conversion. The new tests are being integrated in test_progs so that they can be executed on each CI run. - First commit introduces a few dedicated helpers to execute bpftool commands, with or without retrieving the generated stdout output - Second commit integrates test_bpftool_metadata.sh into test_progs - Third commit integrates test_bpftool_map.sh into test_progs Signed-off-by: Alexis Lothoré (eBPF Foundation) --- Changes in v4: - Port missing map access test in bpftool_metadata - Link to v3: https://lore.kernel.org/r/20260121-bpftool-tests-v3-0-368632f377e5@bootlin.com Changes in v3: - Drop commit reordering objects in Makefile - Rebased series on ci/bpf-next_base to fix conflict - Link to v2: https://lore.kernel.org/r/20260121-bpftool-tests-v2-0-64edb47e91ae@bootlin.com Changes in v2: - drop standalone runner in favor of test_progs - Link to v1: https://lore.kernel.org/r/20260114-bpftool-tests-v1-0-cfab1cc9beaf@bootlin.com ==================== Link: https://patch.msgid.link/20260123-bpftool-tests-v4-0-a6653a7f28e7@bootlin.com Signed-off-by: Alexei Starovoitov commit 2d96bbdfd3b5d28306001036c0161fcb1713f964 Author: Alexis Lothoré (eBPF Foundation) Date: Fri Jan 23 09:30:10 2026 +0100 selftests/bpf: convert test_bpftool_map_access.sh into test_progs framework The test_bpftool_map.sh script tests that maps read/write accesses are being properly allowed/refused by the kernel depending on a specific fmod_ret program being attached on security_bpf_map function. Rewrite this test to integrate it in the test_progs. The new test spawns a few subtests: #36/1 bpftool_maps_access/unprotected_unpinned:OK #36/2 bpftool_maps_access/unprotected_pinned:OK #36/3 bpftool_maps_access/protected_unpinned:OK #36/4 bpftool_maps_access/protected_pinned:OK #36/5 bpftool_maps_access/nested_maps:OK #36/6 bpftool_maps_access/btf_list:OK #36 bpftool_maps_access:OK Summary: 1/6 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Alexis Lothoré (eBPF Foundation) Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20260123-bpftool-tests-v4-3-a6653a7f28e7@bootlin.com Signed-off-by: Alexei Starovoitov commit 1c0b505908a201054dadc87930f550bea2631c1e Author: Alexis Lothoré (eBPF Foundation) Date: Fri Jan 23 09:30:09 2026 +0100 selftests/bpf: convert test_bpftool_metadata.sh into test_progs framework The test_bpftool_metadata.sh script validates that bpftool properly returns in its ouptput any metadata generated by bpf programs through some .rodata sections. Port this test to the test_progs framework so that it can be executed automatically in CI. The new test, similarly to the former script, checks that valid data appears both for textual output and json output, as well as for both data not used at all and used data. For the json check part, the expected json string is hardcoded to avoid bringing a new external dependency (eg: a json deserializer) for test_progs. As the test is now converted into test_progs, remove the former script. The newly converted test brings two new subtests: #37/1 bpftool_metadata/metadata_unused:OK #37/2 bpftool_metadata/metadata_used:OK #37 bpftool_metadata:OK Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20260123-bpftool-tests-v4-2-a6653a7f28e7@bootlin.com Signed-off-by: Alexei Starovoitov commit f21fae57744607330ae5dabdd996538faac7f5ab Author: Alexis Lothoré (eBPF Foundation) Date: Fri Jan 23 09:30:08 2026 +0100 selftests/bpf: Add a few helpers for bpftool testing In order to integrate some bpftool tests into test_progs, define a few specific helpers that allow to execute bpftool commands, while possibly retrieving the command output. Those helpers most notably set the path to the bpftool binary under test. This version checks different possible paths relative to the directories where the different test_progs runners are executed, as we want to make sure not to accidentally use a bootstrap version of the binary. Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20260123-bpftool-tests-v4-1-a6653a7f28e7@bootlin.com Signed-off-by: Alexei Starovoitov commit 6bb9010f78d7f0ff0e4a17b1be951e76d96757a5 Author: Chao Yu Date: Wed Jan 21 05:14:04 2026 +0000 f2fs: decrease maximum flush retry count in f2fs_enable_checkpoint() It's rare case that sync_inodes_sb() always skips to flush some drity datas, so it's enough to give extra three more chances to flush data. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1db4b3609aa13efceddeae2e58749acb62d42d71 Author: Yongpeng Yang Date: Tue Jan 13 23:23:15 2026 +0800 f2fs: optimize NAT block loading during checkpoint write Under stress tests with frequent metadata operations, checkpoint write time can become excessively long. Analysis shows that the slowdown is caused by synchronous, one-by-one reads of NAT blocks during checkpoint processing. The issue can be reproduced with the following workload: 1. seq 1 650000 | xargs -P 16 -n 1 touch 2. sync # avoid checkpoint write during deleting 3. delete 1 file every 455 files 4. echo 3 > /proc/sys/vm/drop_caches 5. sync # trigger checkpoint write This patch submits read I/O for all NAT blocks required in the __flush_nat_entry_set() phase in advance, reducing the overhead of synchronous waiting for individual NAT block reads. The NAT block flush latency before and after the change is as below: | |NAT blocks accessed|NAT blocks read|Flush time (ms)| |-------------|-------------------|---------------|---------------| |Before change|1205 |1191 |158 | |After change |1264 |1242 |11 | With a similar number of NAT blocks accessed and read from disk, adding NAT block readahead reduces the total NAT block flush time by more than 90%. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7c9ee0ed2bd4e30192d83de529c9094e18ab6f41 Author: Yongpeng Yang Date: Tue Jan 13 23:21:38 2026 +0800 f2fs: change size parameter of __has_cursum_space() to unsigned int All callers of __has_cursum_space() pass an unsigned int value as the size parameter. Change the parameter type to unsigned int accordingly. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 401a3034d3b9f33e0fd085f6964512fe999ba135 Author: Yongpeng Yang Date: Tue Jan 13 23:21:37 2026 +0800 f2fs: add write latency stats for NAT and SIT blocks in f2fs_write_checkpoint This patch adds separate write latency accounting for NAT and SIT blocks in f2fs_write_checkpoint(). Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit be38b5717a2953648dd294418b7c2dfdb8e81d7a Author: Yongpeng Yang Date: Fri Jan 16 00:47:50 2026 +0800 f2fs: pin files do not require sbi->writepages lock for ordering For pinned files, the file mapping is already established before writing, and since the writes are in IPU, there is no need to acquire the sbi->writepages lock to guarantee write ordering. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 252cf8c4d679fc40cdb934da6c5128e5943fec3f Author: Chao Yu Date: Tue Jan 20 17:18:26 2026 +0800 f2fs: fix to show simulate_lock_timeout correctly Commit d36de29f4bb5 ("f2fs: sysfs: introduce inject_lock_timeout") introduces a bug as below, fix it. cat /sys/fs/f2fs/vdx/inject_lock_timeout s/fs/f2fs/vdx/inject_lock_timeout: Invalid argument Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1120764691736cb803cd763c82aa151b1fee2b8e Author: Chao Yu Date: Tue Jan 20 17:12:15 2026 +0800 f2fs: introduce FAULT_SKIP_WRITE In order to simulate skipped write during enable_checkpoint(). Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ab59919c8a041bf0fc6c8fe65dd10729e19de88c Author: Chao Yu Date: Mon Jan 26 06:32:03 2026 +0000 f2fs: check skipped write in f2fs_enable_checkpoint() This patch introduces sbi->nr_pages[F2FS_SKIPPED_WRITE] to record any skipped write during data flush in f2fs_enable_checkpoint(). So in the loop of data flush, if there is any skipped write in previous flush, let's retry sync_inode_sb(), otherwise, all dirty data written before f2fs_enable_checkpoint() should have been persisted, then break the retry loop. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a16ac6ca46d62bcbcbd7b01be0ef03fb39530d7b Author: Thorsten Blum Date: Sun Jan 18 18:33:49 2026 +0100 m68knommu: Replace deprecated strcpy with strscpy in init_ucsimm strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Signed-off-by: Greg Ungerer commit 590fe2f46c8698bb758f9002cb247ca10ce95569 Author: Daniel Palmer Date: Sat Dec 13 21:04:01 2025 +0900 m68k: nommu: fix memmove() with differently aligned src and dest for 68000 68000 has different alignment needs to 68020+. memcpy() checks if the destination is aligned and does a smaller copy to fix the alignment and then critically for 68000 it checks if the source is still unaligned and if it is reverts to smaller copies. memmove() does not currently do the second part and malfunctions if one of the pointers is aligned and the other isn't. This is apparently getting triggered by printk. If I put breakpoints into the new checks added by this commit the first hit looks like this: memmove (n=205, src=0x2f3971 , dest=0x2f3980 ) at arch/m68k/lib/memmove.c:82 Signed-off-by: Daniel Palmer Signed-off-by: Greg Ungerer commit c16dd9eb0b58c0cabf955592a072c2022804c7e8 Author: Lukas Bulwahn Date: Wed Jan 7 10:21:01 2026 +0100 m68k: defconfig: Clean up references to non-existing configs - Drop 'CONFIG_I2C_COMPAT is not set' (removed in commit 7e722083fcc3 ("i2c: Remove I2C_COMPAT config symbol and related code")) - Drop 'CONFIG_SCHED_DEBUG is not set' (removed in commit b52173065e0a ("sched/debug: Remove CONFIG_SCHED_DEBUG")) Signed-off-by: Lukas Bulwahn Signed-off-by: Greg Ungerer commit 504f3cead6b04914c53831f9efce902b8d91c009 Merge: b2c6627e406d00 1412482b714358 Author: Dave Airlie Date: Tue Jan 27 10:55:13 2026 +1000 Merge tag 'amd-drm-next-6.20-2026-01-23' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.20-2026-01-23: amdgpu: - GC 12 fix - UserQ fixes - Misc error path fixes - IP discovery fixes - Misc cleanups - HDMI fixes - Documentation update - Panel replay fixes - Panel type handling fixes - DCN 3.1.x fixes - DC analog display fix - SMU 6 fixes - VCN 4.0.3 queue reset fix - VCN 5.0.1 queue reset fix - GPUVM TLB flush fix - RAS fixes - DC idle optimization fix amdkfd: - MQD fix for GC 9.4.3 and 9.5 - GC 11 cooperative launch fix - GC 12.1 trap handler fixes - Misc cleanups radeon: - Use drm_* logging helpers for VCE Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260123173537.17221-1-alexander.deucher@amd.com commit 3da35aa8af345abf6cd180cfc0538c753b927a18 Author: Eric Dumazet Date: Mon Jan 26 17:47:31 2026 +0000 net: include from sysctl_net_core.c Needed for hex_byte_pack(). x86_64 was already including it, but some arches were not. Fixes: 37b0ea8fef56 ("net: expand NETDEV_RSS_KEY_LEN to 256 bytes") Reported-by: Mark Brown Closes: https://lore.kernel.org/netdev/aXeka0KYBnrkwUcF@sirena.org.uk/ Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260126174731.2767372-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6bdf07302f42783345289caec7d91fa364e013ec Author: Steven Rostedt Date: Wed Jan 21 09:38:58 2026 -0500 tracing: Disable trace_printk buffer on warning too When /proc/sys/kernel/traceoff_on_warning is set to 1, the top level tracing buffer is disabled when a warning happens. This is very useful when debugging and want the tracing buffer to stop taking new data when a warning triggers keeping the events that lead up to the warning from being overwritten. Now that there is also a persistent ring buffer and an option to have trace_printk go to that buffer, the same holds true for that buffer. A warning could happen just before a crash but still write enough events to lose the events that lead up to the first warning that was the reason for the crash. When /proc/sys/kernel/traceoff_on_warning is set to 1 and a warning is triggered, not only disable the top level tracing buffer, but also disable the buffer that trace_printk()s are written to. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Mark Rutland Link: https://patch.msgid.link/20260121093858.5c5d7e7b@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit a9e0c5897a787751c373812ea21fabf955625b34 Author: Guenter Roeck Date: Tue Jan 13 07:22:43 2026 -0800 ftrace: Introduce and use ENTRIES_PER_PAGE_GROUP macro ENTRIES_PER_PAGE_GROUP() returns the number of dyn_ftrace entries in a page group, identified by its order. No functional change. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260113152243.3557219-2-linux@roeck-us.net Signed-off-by: Guenter Roeck Signed-off-by: Steven Rostedt (Google) commit 2d8b7f9bf8e6e7ae4e5a457bbaee2f84cdfd61f1 Author: Steven Rostedt Date: Mon Jan 12 15:34:08 2026 -0500 tracing: Have show_event_trigger/filter format a bit more in columns By doing: # trace-cmd sqlhist -e -n futex_wait select TIMESTAMP_DELTA_USECS as lat from sys_enter_futex as start join sys_exit_futex as end on start.common_pid = end.common_pid and # trace-cmd start -e futex_wait -f 'lat > 100' -e page_pool_state_release -f 'pfn == 1' The output of the show_event_trigger and show_event_filter files are well aligned because of the inconsistent 'tab' spacing: ~# cat /sys/kernel/tracing/show_event_triggers syscalls:sys_exit_futex hist:keys=common_pid:vals=hitcount:__lat_12046_2=common_timestamp.usecs-$__arg_12046_1:sort=hitcount:size=2048:clock=global:onmatch(syscalls.sys_enter_futex).trace(futex_wait,$__lat_12046_2) [active] syscalls:sys_enter_futex hist:keys=common_pid:vals=hitcount:__arg_12046_1=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active] ~# cat /sys/kernel/tracing/show_event_filters synthetic:futex_wait (lat > 100) page_pool:page_pool_state_release (pfn == 1) This makes it not so easy to read. Instead, force the spacing to be at least 32 bytes from the beginning (one space if the system:event is longer than 30 bytes): ~# cat /sys/kernel/tracing/show_event_triggers syscalls:sys_exit_futex hist:keys=common_pid:vals=hitcount:__lat_8125_2=common_timestamp.usecs-$__arg_8125_1:sort=hitcount:size=2048:clock=global:onmatch(syscalls.sys_enter_futex).trace(futex_wait,$__lat_8125_2) [active] syscalls:sys_enter_futex hist:keys=common_pid:vals=hitcount:__arg_8125_1=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active] ~# cat /sys/kernel/tracing/show_event_filters synthetic:futex_wait (lat > 100) page_pool:page_pool_state_release (pfn == 1) Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260112153408.18373e73@gandalf.local.home Reviewed-by: Aaron Tomlin Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 8aa76aa415897f6c1ba47d9f131fa463499c4169 Author: Petr Tesarik Date: Thu Jan 8 14:21:32 2026 +0100 ring-buffer: Use a housekeeping CPU to wake up waiters Avoid running the wakeup irq_work on an isolated CPU. Since the wakeup can run on any CPU, let's pick a housekeeping CPU to do the job. This change reduces additional noise when tracing isolated CPUs. For example, the following ipi_send_cpu stack trace was captured with nohz_full=2 on the isolated CPU: -0 [002] d.h4. 1255.379293: ipi_send_cpu: cpu=2 callsite=irq_work_queue+0x2d/0x50 callback=rb_wake_up_waiters+0x0/0x80 -0 [002] d.h4. 1255.379329: => trace_event_raw_event_ipi_send_cpu => __irq_work_queue_local => irq_work_queue => ring_buffer_unlock_commit => trace_buffer_unlock_commit_regs => trace_event_buffer_commit => trace_event_raw_event_x86_irq_vector => __sysvec_apic_timer_interrupt => sysvec_apic_timer_interrupt => asm_sysvec_apic_timer_interrupt => pv_native_safe_halt => default_idle => default_idle_call => do_idle => cpu_startup_entry => start_secondary => common_startup_64 The IRQ work interrupt alone adds considerable noise, but the impact can get even worse with PREEMPT_RT, because the IRQ work interrupt is then handled by a separate kernel thread. This requires a task switch and makes tracing useless for analyzing latency on an isolated CPU. After applying the patch, the trace is similar, but ipi_send_cpu always targets a non-isolated CPU. Unfortunately, irq_work_queue_on() is not NMI-safe. When running in NMI context, fall back to queuing the irq work on the local CPU. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Sebastian Andrzej Siewior Cc: Clark Williams Cc: Frederic Weisbecker Link: https://patch.msgid.link/20260108132132.2473515-1-ptesarik@suse.com Signed-off-by: Petr Tesarik Signed-off-by: Steven Rostedt (Google) commit e4ef389e761bc37904f5cf64b99af5c6c603f2ba Author: Steven Rostedt Date: Wed Jan 7 16:15:10 2026 -0500 tracing: Check the return value of tracing_update_buffers() In the very unlikely event that tracing_update_buffers() fails in trace_printk_init_buffers(), report the failure so that it is known. Link: https://lore.kernel.org/all/20220917020353.3836285-1-floridsleeves@gmail.com/ Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260107161510.4dc98b15@gandalf.local.home Suggested-by: Li Zhong Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 6a80838814eea232a83fab3ac33282cd1243da5b Author: Aaron Tomlin Date: Mon Jan 5 09:29:39 2026 -0500 tracing: Add show_event_triggers to expose active event triggers To audit active event triggers, userspace currently must traverse the events/ directory and read each individual trigger file. This is cumbersome for system-wide auditing or debugging. Introduce "show_event_triggers" at the trace root directory. This file displays all events that currently have one or more triggers applied, alongside the trigger configuration, in a consolidated system:event [tab] trigger format. The implementation leverages the existing trace_event_file iterators and uses the trigger's own print() operation to ensure output consistency with the per-event trigger files. Link: https://patch.msgid.link/20260105142939.2655342-3-atomlin@atomlin.com Signed-off-by: Aaron Tomlin Signed-off-by: Steven Rostedt (Google) commit 729757b96a662d87e334fe8b837707800d8fd551 Author: Aaron Tomlin Date: Mon Jan 5 09:29:38 2026 -0500 tracing: Add show_event_filters to expose active event filters Currently, to audit active Ftrace event filters, userspace must recursively traverse the events/ directory and read each individual filter file. This is inefficient for monitoring tools and debugging. Introduce "show_event_filters" at the trace root directory. This file displays all events that currently have a filter applied, alongside the actual filter string, in a consolidated system:event [tab] filter format. The implementation reuses the existing trace_event_file iterators to ensure atomic traversal of the event list and utilises guard(rcu)() for automatic, scope-based protection when accessing volatile filter strings. Link: https://patch.msgid.link/20260105142939.2655342-2-atomlin@atomlin.com Signed-off-by: Aaron Tomlin Signed-off-by: Steven Rostedt (Google) commit e5136678b1c861ed7d0c985c1acdecd37f949937 Author: Marco Crivellari Date: Tue Dec 30 15:28:20 2025 +0100 tracing: Replace use of system_wq with system_dfl_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This specific workflow has no benefits being per-cpu, so instead of system_percpu_wq the new unbound workqueue has been used (system_dfl_wq). This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Cc: Lai Jiangshan Cc: Frederic Weisbecker Cc: Sebastian Andrzej Siewior Cc: Michal Hocko Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20251230142820.173712-1-marco.crivellari@suse.com Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Steven Rostedt (Google) commit 2cddfc2e8fc78c13b0f5286ea5dd48cdf527ad41 Author: Aaron Tomlin Date: Fri Dec 26 11:07:24 2025 -0500 tracing: Add bitmask-list option for human-readable bitmask display Add support for displaying bitmasks in human-readable list format (e.g., 0,2-5,7) in addition to the default hexadecimal bitmap representation. This is particularly useful when tracing CPU masks and other large bitmasks where individual bit positions are more meaningful than their hexadecimal encoding. When the "bitmask-list" option is enabled, the printk "%*pbl" format specifier is used to render bitmasks as comma-separated ranges, making trace output easier to interpret for complex CPU configurations and large bitmask values. Link: https://patch.msgid.link/20251226160724.2246493-2-atomlin@atomlin.com Signed-off-by: Aaron Tomlin Signed-off-by: Steven Rostedt (Google) commit a4e0ea0e10a262fb6f1ad55a8a9d203bad776678 Author: Steven Rostedt Date: Thu Jan 8 17:44:29 2026 -0500 tracing: Remove redundant call to event_trigger_reset_filter() in event_hist_trigger_parse() With the change to replace kfree() with trigger_data_free(), which starts out doing the exact same thing as event_trigger_reset_filter(), there's no reason to call event_trigger_reset_filter() before calling trigger_data_free(). Remove the call to it. Link: https://lore.kernel.org/linux-trace-kernel/20251211204520.0f3ba6d1@fedora/ Cc: Mathieu Desnoyers Cc: Miaoqian Lin Link: https://patch.msgid.link/20260108174429.2d9ca51f@gandalf.local.home Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 0550069cc25f513ce1f109c88f7c1f01d63297db Author: Miaoqian Lin Date: Thu Dec 11 14:00:58 2025 +0400 tracing: Properly process error handling in event_hist_trigger_parse() Memory allocated with trigger_data_alloc() requires trigger_data_free() for proper cleanup. Replace kfree() with trigger_data_free() to fix this. Found via static analysis and code review. This isn't a real bug due to the current code basically being an open coded version of trigger_data_free() without the synchronization. The synchronization isn't needed as this is the error path of creation and there's nothing to synchronize against yet. Replace the kfree() to be consistent with the allocation. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Tom Zanussi Link: https://patch.msgid.link/20251211100058.2381268-1-linmq006@gmail.com Fixes: e1f187d09e11 ("tracing: Have existing event_command.parse() implementations use helpers") Signed-off-by: Miaoqian Lin Signed-off-by: Steven Rostedt (Google) commit 801a6e61f5fbab2c0dd76c8360f45b625b49e410 Author: Vinay Belgaumkar Date: Fri Jan 23 16:59:17 2026 -0800 drm/xe/ptl: Disable DCC on PTL On PTL, the recommendation is to disable DCC(Duty Cycle Control) as it may cause some regressions due to added latencies. Upcoming GuC releases will disable DCC on PTL as well, but we need to force it in KMD so that this behavior is propagated to older kernels. v2: Update commit message (Rodrigo) v3: Rebase v4: Fix typo: s/propagted/propagated Fixes: 5cdb71d3b0db ("drm/xe/ptl: Add GuC FW definition for PTL") Cc: Daniele Ceraolo Spurio Cc: Rodrigo Vivi Signed-off-by: Vinay Belgaumkar Link: https://patch.msgid.link/20260124005917.398522-1-vinay.belgaumkar@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi (cherry picked from commit 40ee63f5df2d5c6471b583df800aac89dc0502a4) Signed-off-by: Rodrigo Vivi commit d39fb5ca7207a2a8824639b4fada20811d3f2bdf Author: Matthew Brost Date: Wed Jan 14 10:49:05 2026 -0800 drm/xe: Reduce LRC timestamp stuck message on VFs to notice An LRC timestamp getting stuck is a somewhat normal occurrence. If a single VF submits a job that does not get timesliced, the LRC timestamp will not increment. Reduce the LRC timestamp stuck message on VFs to notice (same log level as job timeout) to avoid false CI bugs in tests where a VF submits a job that does not get timesliced. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7032 Fixes: bb63e7257e63 ("drm/xe: Avoid toggling schedule state to check LRC timestamp in TDR") Suggested-by: Daniele Ceraolo Spurio Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20260114184905.4189026-1-matthew.brost@intel.com (cherry picked from commit e89aacd1ecdd3d13e8f347aa082687878621e03c) Signed-off-by: Rodrigo Vivi commit 0a6fb6604746c92bccc71867fd0bf3d3294335d1 Author: Hrishikesh Suresh Date: Sun Jan 25 21:06:52 2026 +0100 perf session: Print all machines in session dump perf_session__fprintf() prints only the host. This has been changed to print details of host and all guests, by traversing through the RB-Tree. These are visible when using high verbosity (-vvvv) in KVM environments, during perf report dumps. Testing: - Test 1: Record the local machine and guest VM using 'perf kvm record' and generate the report using 'perf kvm report -vvvv -D'. The dump should show the threads and other details related to local and guest machine. - 1 Ubuntu VM running on Fedora host - VM is running a noisy program => $ dd if=/dev/urandom of=/dev/null - On host run => $ sudo ./perf kvm --guestvmlinux=/tmp/shared/guest_vmlinux \ --guestkallsyms=/tmp/shared/guest_kallsyms \ --guestmodules=/tmp/shared/guest_modules \ record -a -g -o perf.data.guest and exit after a few seconds. [ perf record: Woken up 9 times to write data ] [ perf record: Captured and wrote 3.150 MB perf.data.guest \ (29311 samples) ] - Generate dump => $ sudo ./perf kvm --guestkallsyms /tmp/shared/guest_kallsyms \ report -vvvv -D -i perf.data.guest > output.txt - Check for threads associated with guest machine. $ grep "Thread 0" output.txt Thread 0 swapper Thread 0 [guest/0] PASS - Test 2: Record the local machine and guest VM using 'perf kvm record' and generate the report using 'perf kvm report'. The functions running on guest VM should be seen in the report. - Same setup as Test 1 but the test looks at the performance profile, to check if the function names are visible. - Peek into profile using => $ sudo ./perf kvm --guestkallsyms /tmp/shared/guest_kallsyms \ report -i perf.data.guest - Samples: 29K of event 'cycles', Event count (approx.): 28711693142 Children Self Command Shared Object Symbol 35.69% 35.69% :5820 [guest.kernel.kallsyms] [g] chacha_permute 11.56% 11.56% :5820 [guest.kernel.kallsyms] [g] entry_SYSRETQ_unsXXX 11.12% 11.12% :5820 [guest.kernel.kallsyms] [g] syscall_return_viXXX 7.36% 7.36% :5820 [guest.kernel.kallsyms] [g] entry_SYSCALL_64_XXX 6.07% 6.07% :5820 [guest.kernel.kallsyms] [g] chacha_block_generic 5.40% 5.40% :5820 [guest.kernel.kallsyms] [g] _copy_to_iter .... PASS - Test 3: Record the local and 2 guest VMs using 'perf kvm record' and generate the report using 'perf kvm report -vvvv -D'. The dump should show the threads and other details related to local and guest machines. - 1 Ubuntu and 1 Alpine VMs running on Fedora host. - Find PIDs of qemu instances and use them during record and report $ pgrep qemu 5816 25098 - Record the activity => $ sudo ./perf kvm record -p 5816,25098 -a -g -o perf.data.guests Warning: PID/TID switch overriding SYSTEM [ perf record: Woken up 325927 times to write data ] [ perf record: Captured and wrote 3.692 MB perf.data.guests \ (57389 samples) ] - Generate dump => $ sudo ./perf kvm report -vvvv -D -i perf.data.guests > output.txt - Check if the threads related to the local machine and guest VMs are present => $ grep "Thread 0" output.txt Thread 0 swapper Thread 0 [guest/0] NOTE: Threads from Ubuntu and Alpine VMs are bundled together and appear as one guest machine. Looking into output.txt => Threads: 6 Thread 0 [guest/0] Thread 5816 :5816 Thread 25098 :25098 Thread 5819 :5819 Thread 5820 :5820 Thread 25103 :25103 To conclude, information is collected for both VMs and not listed as two different guest machines. PASS - Test 4: Check if any guest-related information is printed in perf annotate. This test is included because the command calls perf_session__fprintf() in its code path when using -vvvv option. This could be explained by inability / lack of options for 'perf annotate' to look into guest VM from host machine, due to no option to specify the guest's kallsyms or modules. A similar explanation for 'perf mem' could be used, as perf_session__fprintf() is also present in its code path. - Run annotate => $ sudo ./perf annotate -i perf.data.guest -vvvv > output.txt - Check for threads from local machine or guest VM => $ grep "Thread 0" output.txt Thread 0 swapper Threads from local machine are found while threads from guest VM are not found. It is possibly because of a lack of a guest kallsyms option for DSO matching in perf annotate. PASS - Test 5: Run kvm test available on perf path - $ sudo ./perf test kvm 89: perf kvm tests : Ok PASS Signed-off-by: Hrishikesh Suresh Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Blake Jones Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra [ Declare 'nd' in the 'for' line and and 'pos' inside the loop body, to make it more compact ] Signed-off-by: Arnaldo Carvalho de Melo commit 2becdd163ab37c9dca05f31da7e943f59f55e510 Author: Ian Rogers Date: Fri Jan 23 14:22:09 2026 -0800 perf unwind-libdw: Wire up e_flags for CSKY Wire up the e_flags now it can be read for a thread. The e_flags encode the CSKY ABI level and this can impact which perf registers need setting up for unwinding. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Swapnil Sapkal Cc: Tianyou Li Signed-off-by: Arnaldo Carvalho de Melo commit 0403930f7b1534e383116f7122539873dad3c6a6 Author: Ian Rogers Date: Fri Jan 23 14:22:08 2026 -0800 perf perf_regs: Accurately compute register names for CSKY CSKY needs the e_flags to determine the ABI level and know whether additional registers are encoded or not. Wire this up now that the e_flags for a thread can be determined. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Swapnil Sapkal Cc: Tianyou Li [ Conditionally define EF_CSKY_ABIMASK and EF_CSKY_ABIV2 for older distros ] Signed-off-by: Arnaldo Carvalho de Melo commit 546e9289c74f606423ef72075b34cc38eda3bb49 Author: Thomas Weißschuh Date: Fri Jan 23 08:35:41 2026 +0100 vdso/gettimeofday: Force inlining of __cvdso_clock_getres_common() With CONFIG_CC_OPTIMIZE_FOR_SIZE=y, GCC may decide not to inline __cvdso_clock_getres_common(). This introduces spurious internal function calls in the vDSO fastpath. Furthermore, with automatic stack variable initialization (CONFIG_INIT_STACK_ALL_ZERO or CONFIG_INIT_STACK_ALL_PATTERN) GCC can emit a call to memset() which is not valid in the vDSO. Mark __cvdso_clock_getres_common() as __always_inline to avoid both issues. Paradoxically the inlining even reduces the size of the code: $ ./scripts/bloat-o-meter arch/powerpc/kernel/vdso/vgettimeofday-32.o.before arch/powerpc/kernel/vdso/vgettimeofday-32.o.after add/remove: 0/1 grow/shrink: 1/1 up/down: 52/-148 (-96) Function old new delta __c_kernel_clock_getres_time64 92 144 +52 __c_kernel_clock_getres 136 132 -4 __cvdso_clock_getres_common 144 - -144 Total: Before=2788, After=2692, chg -3.44% With CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y the functions are always inlined and therefore the behaviour stays the same. See also the equivalent change for clock_gettime() in commit b91c8c42ffdd ("lib/vdso: Force inlining of __cvdso_clock_gettime_common()"). Fixes: 21bbfd74044f ("x86/vdso: Provide clock_getres_time64() for x86-32") Fixes: 1149dcdfc9ef ("ARM: VDSO: Provide clock_getres_time64()") Fixes: f10c2e72b5de ("arm64: vdso32: Provide clock_getres_time64()") Fixes: bec06cd6a140 ("MIPS: vdso: Provide getres_time64() for 32-bit ABIs") Fixes: 759a1f97373f ("powerpc/vdso: Provide clock_getres_time64()") Reported-by: Sverdlin, Alexander Suggested-by: Christophe Leroy (CS GROUP) Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/lkml/230c749f-ebd6-4829-93ee-601d88000a45@kernel.org/ Link: https://patch.msgid.link/20260123-vdso-clock_getres-inline-v1-1-4d6203b90cd3@linutronix.de Closes: https://lore.kernel.org/lkml/f45316f65a46da638b3c6aa69effd8980e6677b9.camel@siemens.com/ commit 87ee3f05bfe2f5955c2c77ae26a1be236fd615a5 Author: Chen Ni Date: Mon Jan 26 15:35:28 2026 +0800 ASoC: codecs: wm8731: Remove unnecessary NULL check before clk_prepare_enable/clk_disable_unprepare clk_prepare_enable() and clk_disable_unprepare() already checked NULL clock parameter. Remove unneeded NULL check for wm8731->mclk here. Signed-off-by: Chen Ni Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260126073528.1826406-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit f80bee70b1938f904d0b12783044d5eebcc6879b Author: Laurentiu Mihalcea Date: Mon Jan 26 06:55:36 2026 -0800 ASoC: dt-bindings: fsl,mqs: make gpr optional for SM-based SoCs For SM-based SoCs (i.e. MX95, MX943), GPR configuration is performed by the SM coprocessor. Thus, GPR is transparent to the software and does not need to be described in the devicetree. Make it optional. Reviewed-by: Frank Li Reviewed-by: Krzysztof Kozlowski Signed-off-by: Laurentiu Mihalcea Link: https://patch.msgid.link/20260126145537.2301-2-laurentiumihalcea111@gmail.com Signed-off-by: Mark Brown commit 233ccfe911aa62c0f9211f2e3297d6a7f870b295 Author: Andy Shevchenko Date: Sat Jan 24 11:17:03 2026 +0100 ASoC: codecs: rt1320-sdw: Refactor to reduce stack frames Compiler is not happy about used stack frames in a couple of functions: sound/soc/codecs/rt1320-sdw.c: In function 'rt1320_rae_load': sound/soc/codecs/rt1320-sdw.c:1570:1: error: the frame size of 1336 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] sound/soc/codecs/rt1320-sdw.c: In function 'rt1320_dspfw_load_code': sound/soc/codecs/rt1320-sdw.c:1786:1: error: the frame size of 1520 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Refactor the code to fix these. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260124101824.3424793-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 3febba217ea73ca86d5e331b8cde98bc6d08fcf5 Author: Mac Chiang Date: Sun Jan 25 19:18:37 2026 +0800 ASoC: sdw_utils: Add quirk to ignore RT722 DMIC DAI When the device uses the host DMIC as the capture source, add CODEC_MIC quirk to exclude the RT722 codec DMIC DAI link. Signed-off-by: Mac Chiang Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Signed-off-by: Bard Liao Link: https://patch.msgid.link/20260125111837.2386530-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 4e66527f8859a6614a3a8afd11778c832a30ebbb Author: Ian Rogers Date: Fri Jan 23 14:22:07 2026 -0800 perf thread: Add optional e_flags output argument to thread__e_machine The e_flags are needed to accurately compute complete perf register information for CSKY. Add the ability to read and have this value associated with a thread. This change doesn't wire up the use of the e_flags except in disasm where use already exists but just wasn't set up yet. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Swapnil Sapkal Cc: Tianyou Li Signed-off-by: Arnaldo Carvalho de Melo commit 7d0ebeb6c0f735d4eddc679283a1de1dea2ae878 Author: Ian Rogers Date: Fri Jan 23 14:22:06 2026 -0800 perf dso: Factor out e_machine reading for use in thread Factor out the resilient e_machine reading code in dso so that it may be used in thread. As there is no dso in that case, make the dso optional. This makes some minor other changes as the swap type from the dso cannot be ascertained. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Swapnil Sapkal Cc: Tianyou Li Signed-off-by: Arnaldo Carvalho de Melo commit 76b2cf07a6d2a836108f9c2486d76599f7adf6e8 Author: Sandipan Das Date: Thu Jan 22 13:39:46 2026 +0530 perf vendor events amd: Fix Zen 5 MAB allocation events The unit masks for PMCx041 vary across different generations of Zen processors. Fix the Zen 5 events based on PMCx041 as they incorrectly use the same unit masks as that of Zen 4. Fixes: 45c072f2537ab07b ("perf vendor events amd: Add Zen 5 core events") Reported-by: Suyash Mahar Reviewed-by: Ian Rogers Signed-off-by: Sandipan Das Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Sandipan Das Signed-off-by: Arnaldo Carvalho de Melo commit 008603bda19b29687edce533e4c09acff68c1077 Author: Thomas Richter Date: Mon Jan 26 11:18:23 2026 +0100 perf test: Fix test perf evlist for z/VM s390x Perf test case 'perf evlist tests' fails on z/VM machines on s390. The failure is causes by event cycles. This event is not available on virtualized machines like z/VM on s390. Change to software event cpu-clock to fix this. Output before: # ./perf test 78 79: perf evlist tests : FAILED! # Output after: # ./perf test 78 79: perf evlist tests : Ok # Fixes: b04d2b9199129f4f ("perf test: Fix test case perf evlist tests for s390x") Reviewed-by: Ian Rogers Reviewed-by: Jan Polensky Signed-off-by: Thomas Richter Tested-by: Jan Polensky Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Namhyung Kim Cc: Sumanth Korikkar Cc: Thomas Richter Cc: Vasily Gorbik Signed-off-by: Arnaldo Carvalho de Melo commit dda5f926a1006c735b00ed5c27291fce64236656 Author: Arnaldo Carvalho de Melo Date: Mon Jan 26 17:25:00 2026 -0300 perf annotate: Fix BUILD_NONDISTRO=1 missing args->ms conversions to pointer Fix a few missing conversions to pointer in the usage of 'struct annotate_args' 'ms' member in symbol__disassemble_bpf_libbfd(). Fixes: 00419892bac28bf1 ("perf annotate: Fix args leak of map_symbol") Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit 9966b382d06733f7467484bb440d6db68b743207 Author: Leo Yan Date: Thu Jan 8 09:43:26 2026 +0000 tools headers: Don't check arm64's unistd.h The arm64 unistd.h in tools now diverges from the kernel header. Comparing the two headers is pointless, remove the check. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Arnd Bergmann Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 129bb23a6f7d022610f902b57d36d69d7d210128 Author: Leo Yan Date: Thu Jan 8 09:43:25 2026 +0000 Revert "perf tools: Fix arm64 build by generating unistd_64.h" This reverts: commit 8988c4b91945173a ("perf tools: Fix in-source libperf build") commit bfb713ea53c746b0 ("perf tools: Fix arm64 build by generating unistd_64.h") Since we now have a static unistd_64.h for the arm64 build, there is no need to generate unistd_64.h in libperf. Revert all patches related to generating unistd_64.h. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Arnd Bergmann Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 096b86ce08332fbcb0ec6ff6714c44899ec03970 Author: Leo Yan Date: Thu Jan 8 09:43:24 2026 +0000 tools headers: Go back to include asm-generic/unistd.h for arm64 The header unistd.h is included under Arm64's uAPI folder (see tools/arch/arm64/include/uapi/asm/), but it does not include its dependent header unistd_64.h. The intention is for unistd_64.h to be generated dynamically using scripts/Makefile.asm-headers. However, this dynamic approach causes problems because the header is not available early enough, even though it is widely included throughout tools. Using the perf build as an example: 1) Feature detection: Perf first runs feature tests. The BPF feature program test-bpf.c includes unistd.h. Since unistd_64.h has not been generated yet, the program fails to build, and the BPF feature ends up being disabled. 2) libperf build: The libperf Makefile later generates unistd_64.h on the fly, so libperf itself builds successfully. 3) Final perf build: Although the perf binary can build successfully using the generated header, we never get a chance to build BPF skeleton programs, because BPF support was already disabled earlier. Restore to include asm-generic/unistd.h for fixing the issue. This aligns with most architectures (x86 is a special case that keeps unistd_32.h/unistd_64.h for its particular syscall numbers) and ensures the header is available from the start. Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources") Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Arnd Bergmann Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit d3b402c5a2d47f51eb0581da1a7b142f82cb10d1 Merge: 3d06db9bad1ad8 fcb70a56f4d814 Author: Arnaldo Carvalho de Melo Date: Mon Jan 26 17:03:53 2026 -0300 Merge remote-tracking branch 'torvalds/master' into perf-tools-next Merge with upstream to pick up fixes from perf-tools and from other tools/ parts that interact with tools/perf. Signed-off-by: Arnaldo Carvalho de Melo commit 474d54095090be8ea8701d4a16476f488aa06959 Author: Dmitry Baryshkov Date: Mon Jan 26 13:44:27 2026 +0200 drm/display: bridge_connector: move audio_infoframe checks to OP_HDMI There are DRM_BRIDGE_OP_HDMI_AUDIO bridges (e.g. Lontium LT9611UXC) which don't implement DRM_BRIDGE_OP_HDMI and don't implement hdmi_clear_audio_infoframe / hdmi_write_audio_infoframe callbacks. Move corresponding checks under the DRM_BRIDGE_OP_HDMI condition, making sure that we require those callbacks only from the bridges which are actually going to use them. Fixes: b626b1a1c9cc ("drm/bridge: refactor HDMI InfoFrame callbacks") Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260126-drm-fix-lt9611uxc-v1-1-04a635a8f5cf@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 78980b4c7fcb5ef74b7af65fbef5ce8d718cf791 Author: Leon Hwang Date: Mon Jan 19 21:34:17 2026 +0800 selftests/bpf: Harden cpu flags test for lru_percpu_hash map CI occasionally reports failures in the percpu_alloc/cpu_flag_lru_percpu_hash selftest, for example: First test_progs failure (test_progs_no_alu32-x86_64-llvm-21): #264/15 percpu_alloc/cpu_flag_lru_percpu_hash ... test_percpu_map_op_cpu_flag:FAIL:bpf_map_lookup_batch value on specified cpu unexpected bpf_map_lookup_batch value on specified cpu: actual 0 != expected 3735929054 The unexpected value indicates that an element was removed from the map. However, the test never calls delete_elem(), so the only possible cause is LRU eviction. This can happen when the current task migrates to another CPU: an update_elem() triggers eviction because there is no available LRU node on local freelist and global freelist. Harden the test against this behavior by provisioning sufficient spare elements. Set max_entries to 'nr_cpus * 2' and restrict the test to using the first nr_cpus entries, ensuring that updates do not spuriously trigger LRU eviction. Signed-off-by: Leon Hwang Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20260119133417.19739-1-leon.hwang@linux.dev commit 9c0fc1d37f531fd33abc9b3a009b818ff1bddc22 Author: Davidlohr Bueso Date: Fri Nov 28 13:23:03 2025 -0800 drivers/nvdimm: Use local kmaps Replace the now deprecated kmap_atomic() with kmap_local_page(). Optimizing nvdimm/pmem for highmem makes no sense as this is always 64bit, and the mapped regions for both btt and pmem do not require disabling preemption and pagefaults. Specifically, kmap does not care about the caller's atomic context (such as reads holding the btt arena spinlock) or NVDIMM_IO_ATOMIC semantics to avoid error handling when accessing the btt arena in general. Same for the memcpy cases. kmap local temporary mappings will hold valid across any context switches. Signed-off-by: Davidlohr Bueso Reviewed-by: Dave Jiang > --- Link: https://patch.msgid.link/20251128212303.2170933-1-dave@stgolabs.net Signed-off-by: Ira Weiny commit 13a4be41261f7ab8d705f20d9f10652ac1e087c0 Author: YiFei Zhu Date: Tue Dec 23 19:46:46 2025 +0000 idpf: export RX hardware timestamping information to XDP The logic is similar to idpf_rx_hwtstamp, but the data is exported as a BPF kfunc instead of appended to an skb to support grabbing timestamps in xsk packets. A idpf_queue_has(PTP, rxq) condition is added to check the queue supports PTP similar to idpf_rx_process_skb_fields. Tested using an xsk connection and checking xdp timestamps are retrievable in received packets. Cc: intel-wired-lan@lists.osuosl.org Signed-off-by: YiFei Zhu Signed-off-by: Mina Almasry Reviewed-by: Aleksandr Loktionov Reviewed-by: Alexander Lobakin Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 24f90786efaf1c573518706408deadcef189e6de Author: Alexander Lobakin Date: Mon Jan 19 17:08:43 2026 +0100 ice: reshuffle and group Rx and Tx queue fields by cachelines Place the fields in ice_{rx,tx}_ring used in the same pieces of hotpath code closer to each other and use __cacheline_group_{begin,end}_aligned() to isolate the read mostly, read-write, and cold groups into separate cachelines similarly to idpf. Suggested-by: Jacob Keller Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Signed-off-by: Alexander Lobakin Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen commit b38a418db3660d3c9b36bbeb54cbffe096123573 Author: Jacob Keller Date: Thu Nov 20 12:20:46 2025 -0800 ice: convert all ring stats to u64_stats_t After several cleanups, the ice driver is now finally ready to convert all Tx and Rx ring stats to the u64_stats_t and proper use of the u64 stats APIs. The final remaining part to cleanup is the VSI stats accumulation logic in ice_update_vsi_ring_stats(). Refactor the function and its helpers so that all stat values (and not just pkts and bytes) use the u64_stats APIs. The ice_fetch_u64_(tx|rx)_stats functions read the stat values using u64_stats_read and then copy them into local ice_vsi_(tx|rx)_stats structures. This does require making a new struct with the stat fields as u64. The ice_update_vsi_(tx|rx)_ring_stats functions call the fetch functions per ring and accumulate the result into one copy of the struct. This accumulated total is then used to update the relevant VSI fields. Since these are relatively small, the contents are all stored on the stack rather than allocating and freeing memory. Once the accumulator side is updated, the helper ice_stats_read and ice_stats_inc and other related helper functions all easily translate to use of u64_stats_read and u64_stats_inc. This completes the refactor and ensures that all stats accesses now make proper use of the API. Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 4c58c7152c090cdb68cc9ff97ee84df2bb5db911 Author: Jacob Keller Date: Thu Nov 20 12:20:45 2025 -0800 ice: shorten ring stat names and add accessors The ice Tx/Rx hotpath has a few statistics counters for tracking unexpected events. These values are stored as u64 but are not accumulated using the u64_stats API. This could result in load/tear stores on some architectures. Even some 64-bit architectures could have issues since the fields are not read or written using ACCESS_ONCE or READ_ONCE. A following change is going to refactor the stats accumulator code to use the u64_stats API for all of these stats, and to use u64_stats_read and u64_stats_inc properly to prevent load/store tears on all architectures. Using u64_stats_inc and the syncp pointer is slightly verbose and would be duplicated in a number of places in the Tx and Rx hot path. Add accessor macros for the cases where only a single stat value is touched at once. To keep lines short, also shorten the stats names and convert ice_txq_stats and ice_rxq_stats to struct_group. This will ease the transition to properly using the u64_stats API in the following change. Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b1c16d9cb21ed7ae0f01f5991adabc4c5ae002fd Author: Jacob Keller Date: Thu Nov 20 12:20:44 2025 -0800 ice: use u64_stats API to access pkts/bytes in dim sample The __ice_update_sample and __ice_get_ethtool_stats functions directly accesses the pkts and bytes counters from the ring stats. A following change is going to update the fields to be u64_stats_t type, and will need to be accessed appropriately. This will ensure that the accesses do not cause load/store tearing. Add helper functions similar to the ones used for updating the stats values, and use them. This ensures use of the syncp pointer on 32-bit architectures. Once the fields are updated to u64_stats_t, it will then properly avoid tears on all architectures. Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b470944ee6e8f51c1d561899c045286b6c416b46 Author: Jacob Keller Date: Thu Nov 20 12:20:43 2025 -0800 ice: remove ice_q_stats struct and use struct_group The ice_qp_reset_stats function resets the stats for all rings on a VSI. It currently behaves differently for Tx and Rx rings. For Rx rings, it only clears the rx_stats which do not include the pkt and byte counts. For Tx rings and XDP rings, it clears only the pkt and byte counts. We could add extra memset calls to cover both the stats and relevant tx/rx stats fields. Instead, lets convert stats into a struct_group which contains both the pkts and bytes fields as well as the Tx or Rx stats, and remove the ice_q_stats structure entirely. The only remaining user of ice_q_stats is the ice_q_stats_len function in ice_ethtool.c, which just counts the number of fields. Replace this with a simple multiplication by 2. I find this to be simpler to reason about than relying on knowing the layout of the ice_q_stats structure. Now that the stats field of the ice_ring_stats covers all of the statistic values, the ice_qp_reset_stats function will properly zero out all of the fields. Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit fb5b8f3c887067a925e021c148ae41bb88f4d22b Author: Jacob Keller Date: Thu Nov 20 12:20:42 2025 -0800 ice: pass pointer to ice_fetch_u64_stats_per_ring The ice_fetch_u64_stats_per_ring function takes a pointer to the syncp from the ring stats to synchronize reading of the packet stats. It also takes a *copy* of the ice_q_stats fields instead of a pointer to the stats. This completely defeats the point of using the u64_stats API. We pass the stats by value, so they are static at the point of reading within the u64_stats_fetch_retry loop. Simplify the function to take a pointer to the ice_ring_stats instead of two separate parameters. Additionally, since we never call this outside of ice_main.c, make it a static function. Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit cea7b66a80412e2a5b74627b89ae25f1d0110a4b Author: Danilo Krummrich Date: Mon Jan 19 16:31:05 2026 +0100 Documentation: nova: update pending tasks Some tasks, while already having some progress, are still pending, hence update them. Link: https://patch.msgid.link/20260119153129.59876-2-dakr@kernel.org [ Remove PCI config space, as it is completed. - Danilo ] Signed-off-by: Danilo Krummrich commit fcbc35587778738145d4f18f95d44631a5c54845 Author: Gary Guo Date: Fri Jan 23 17:19:42 2026 +0000 samples: rust: remove imports available via prelude These imports are already in scope by importing `kernel::prelude::*` and does not need to be imported separately. Signed-off-by: Gary Guo Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260123172007.136873-4-gary@garyguo.net Signed-off-by: Miguel Ojeda commit dc2f4d41a6b686dbd78a6346126cdc992f2de441 Author: Thomas Weißschuh Date: Mon Dec 22 09:29:15 2025 +0100 sparc: Implement ARCH_HAS_CC_CAN_LINK The generic CC_CAN_LINK detection does not work for all architectures. Make the logic easier to understand and allow the simplification of the generic CC_CAN_LINK by using a tailored implementation. Signed-off-by: Thomas Weißschuh Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 25439a4181ae9449781bce1f07d612033402ea14 Author: Danilo Krummrich Date: Mon Jan 19 16:31:04 2026 +0100 Documentation: nova: remove completed tasks Remove completed tasks from Nova's task list. Link: https://patch.msgid.link/20260119153129.59876-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 7e90360e6d4599795b6f4e094e20d0bdf3b2615f Author: Ilpo Järvinen Date: Fri Dec 19 19:40:14 2025 +0200 PCI: Fix bridge window alignment with optional resources pbus_size_mem() has two alignments, one for required resources in min_align and another in add_align that takes account optional resources. The add_align is applied to the bridge window through the realloc_head list. It can happen, however, that add_align is larger than min_align but calculated size1 and size0 are equal due to extra tailroom (e.g., hotplug reservation, tail alignment), and therefore no entry is created to the realloc_head list. Without the bridge appearing in the realloc head, add_align is lost when pbus_size_mem() returns. The problem is visible in this log for 0000:05:00.0 which lacks add_size ... add_align ... line that would indicate it was added into the realloc_head list: pci 0000:05:00.0: PCI bridge to [bus 06-16] ... pci 0000:06:00.0: bridge window [mem 0x00100000-0x001fffff] to [bus 07] requires relaxed alignment rules pci 0000:06:06.0: bridge window [mem 0x00100000-0x001fffff] to [bus 0a] requires relaxed alignment rules pci 0000:06:07.0: bridge window [mem 0x00100000-0x003fffff] to [bus 0b] requires relaxed alignment rules pci 0000:06:08.0: bridge window [mem 0x00800000-0x00ffffff 64bit pref] to [bus 0c-14] requires relaxed alignment rules pci 0000:06:08.0: bridge window [mem 0x01000000-0x057fffff] to [bus 0c-14] requires relaxed alignment rules pci 0000:06:08.0: bridge window [mem 0x01000000-0x057fffff] to [bus 0c-14] requires relaxed alignment rules pci 0000:06:08.0: bridge window [mem 0x01000000-0x057fffff] to [bus 0c-14] add_size 100000 add_align 1000000 pci 0000:06:0c.0: bridge window [mem 0x00100000-0x001fffff] to [bus 15] requires relaxed alignment rules pci 0000:06:0d.0: bridge window [mem 0x00100000-0x001fffff] to [bus 16] requires relaxed alignment rules pci 0000:06:0d.0: bridge window [mem 0x00100000-0x001fffff] to [bus 16] requires relaxed alignment rules pci 0000:05:00.0: bridge window [mem 0xd4800000-0xd97fffff]: assigned pci 0000:05:00.0: bridge window [mem 0x1060000000-0x10607fffff 64bit pref]: assigned pci 0000:06:08.0: bridge window [mem size 0x04900000]: can't assign; no space pci 0000:06:08.0: bridge window [mem size 0x04900000]: failed to assign While this bug itself seems old, it has likely become more visible after the relaxed tail alignment that does not grossly overestimate the size needed for the bridge window. Make sure add_align > min_align too results in adding an entry into the realloc head list. In addition, add handling to the cases where add_size is zero while only alignment differs. Fixes: d74b9027a4da ("PCI: Consider additional PF's IOV BAR alignment in sizing and assigning") Reported-by: Malte Schröder Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Malte Schröder Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251219174036.16738-2-ilpo.jarvinen@linux.intel.com commit 7c60d964fbb100103730db9560f5594c1c4fc844 Author: Gary Guo Date: Tue Jan 20 18:11:09 2026 +0000 gpu: tyr: remove redundant `.as_ref()` for `dev_*` print This is now handled by the macro itself. Acked-by: Alice Ryhl Reviewed-by: Daniel Almeida Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260120181152.3640314-4-gary@kernel.org Signed-off-by: Danilo Krummrich commit 21f3f6af42e38bb12548246762b878555e247e4a Merge: 43b1d60361a5ac f325a91895d8a9 Author: Arnd Bergmann Date: Mon Jan 26 16:58:47 2026 +0100 Merge tag 'imx-dt-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX ARM device tree changes for 6.20: - A few changes from Andreas Kemnade to correct LCDIF compatible for i.MX6SL/i.MX6SLL, add EPD regulator for imx6sll-kobo-clara2e, support TPS65185 for tolino-shine2 and e60k02 - A series from Frank Li to clean up GPMI CHECK_DTB warnings - A change from Alexander Stein to add default GIC address cells for imx6qdl - A change from Josua Mayer to add EPD PMIC for imx50-kobo-aura * tag 'imx-dt-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx: e60k02: add tps65185 ARM: dts: imx50-kobo-aura: add epd pmic description ARM: dts: imx: tolino-shine2: add tps65185 ARM: dts: imx: move nand related property under nand@0 ARM: dts: imx6sx: update gpmi #size-cells to 0 ARM: dts: imx6qdl: add '#address-cells' and '#size-cells' for gpmi-nand ARM: dts: imx: imx6sl: fix lcdif compatible ARM: dts: imx: imx6sll-kobo-clara2e: add regulator for EPD ARM: dts: imx: imx6sll: fix lcdif compatible ARM: dts: imx6qdl: Add default GIC address cells Signed-off-by: Arnd Bergmann commit d935187cfb27fc4168f78f3959aef4eafaae76bb Author: Tzung-Bi Shih Date: Mon Jan 12 11:07:55 2026 +0000 remoteproc: mediatek: Break lock dependency to `prepare_lock` A potential circular locking dependency (ABBA deadlock) exists between `ec_dev->lock` and the clock framework's `prepare_lock`. The first order (A -> B) occurs when scp_ipi_send() is called while `ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()): 1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send(). 2. scp_ipi_send() calls clk_prepare_enable(), which acquires `prepare_lock`. See #0 in the following example calling trace. (Lock Order: `ec_dev->lock` -> `prepare_lock`) The reverse order (B -> A) is more complex and has been observed (learned) by lockdep. It involves the clock prepare operation triggering power domain changes, which then propagates through sysfs and power supply uevents, eventually calling back into the ChromeOS EC driver and attempting to acquire `ec_dev->lock`: 1. Something calls clk_prepare(), which acquires `prepare_lock`. It then triggers genpd operations like genpd_runtime_resume(), which takes `&genpd->mlock`. 2. Power domain changes can trigger regulator changes; regulator changes can then trigger device link changes; device link changes can then trigger sysfs changes. Eventually, power_supply_uevent() is called. 3. This leads to calls like cros_usbpd_charger_get_prop(), which calls cros_ec_cmd_xfer_status(), which then attempts to acquire `ec_dev->lock`. See #1 ~ #6 in the following example calling trace. (Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`) Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock` is only acquired in prepare()/unprepare() callbacks. Since `ec_dev->lock` is not involved in the callbacks, the dependency loop is broken. This means the clock is always "prepared" when the SCP is running. The prolonged "prepared time" for the clock should be acceptable as SCP is designed to be a very power efficient processor. The power consumption impact can be negligible. A simplified calling trace reported by lockdep: > -> #6 (&ec_dev->lock) > cros_ec_cmd_xfer > cros_ec_cmd_xfer_status > cros_usbpd_charger_get_port_status > cros_usbpd_charger_get_prop > power_supply_get_property > power_supply_show_property > power_supply_uevent > dev_uevent > uevent_show > dev_attr_show > sysfs_kf_seq_show > kernfs_seq_show > -> #5 (kn->active#2) > kernfs_drain > __kernfs_remove > kernfs_remove_by_name_ns > sysfs_remove_file_ns > device_del > __device_link_del > device_links_driver_bound > -> #4 (device_links_lock) > device_link_remove > _regulator_put > regulator_put > -> #3 (regulator_list_mutex) > regulator_lock_dependent > regulator_disable > scpsys_power_off > _genpd_power_off > genpd_power_off > -> #2 (&genpd->mlock/1) > genpd_add_subdomain > pm_genpd_add_subdomain > scpsys_add_subdomain > scpsys_probe > -> #1 (&genpd->mlock) > genpd_runtime_resume > __rpm_callback > rpm_callback > rpm_resume > __pm_runtime_resume > clk_core_prepare > clk_prepare > -> #0 (prepare_lock) > clk_prepare > scp_ipi_send > scp_send_ipi > mtk_rpmsg_send > rpmsg_send > cros_ec_pkt_xfer_rpmsg Signed-off-by: Tzung-Bi Shih Reviewed-by: Chen-Yu Tsai Tested-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org Signed-off-by: Mathieu Poirier commit e94865ca2340e9eaec08716dfad645e9f719eedd Author: Komal Bajaj Date: Fri Jan 16 17:08:46 2026 +0000 dt-bindings: nvmem: qfprom: Add sm8750 compatible Document compatible string for the QFPROM on SM8750 platform. Signed-off-by: Komal Bajaj Reviewed-by: Akhil P Oommen Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260116170846.733558-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4796eaafd6a170db012395a40385d2baf4f4d118 Author: Randy Dunlap Date: Fri Jan 16 17:08:45 2026 +0000 nvmem: an8855: drop an unused Kconfig symbol MFD_AIROHA_AN8855 is referenced here but never defined, so drop it from the Kconfig file. Fixes: e2258cfd9b98 ("nvmem: an8855: Add support for Airoha AN8855 Switch EFUSE") Signed-off-by: Randy Dunlap Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260116170846.733558-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit e75c79f24927dd46a97f511e1dcb2bedfe29155e Author: Krzysztof Kozlowski Date: Fri Jan 16 17:08:44 2026 +0000 nvmem: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260116170846.733558-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit f397bc0781553d01b4cdba506c09334a31cb0ec5 Author: Krzysztof Kozlowski Date: Fri Jan 16 17:08:43 2026 +0000 nvmem: Drop OF node reference on nvmem_add_one_cell() failure If nvmem_add_one_cell() failed, the ownership of "child" (or "info.np"), thus its OF reference, is not passed further and function should clean up by putting the reference it got via earlier of_node_get(). Note that this is independent of references obtained via for_each_child_of_node() loop. Fixes: 50014d659617 ("nvmem: core: use nvmem_add_one_cell() in nvmem_add_cells_from_of()") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260116170846.733558-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3d9617ea8ab5ca779a227d1e7d23741f5f8400c1 Author: Aniket Limaye Date: Fri Jan 23 12:25:46 2026 +0530 irqchip/ti-sci-intr: Allow parsing interrupt-types per-line Some INTR router instances act as simple passthroughs that preserve the source interrupt type unchanged at the output line, rather than converting all interrupts to a fixed type. When interrupt sources are not homogeneous with respect to trigger type, the driver needs to read each source's interrupt type from DT and pass it unchanged to its interrupt parent. Add support to check for absence of "ti,intr-trigger-type" to indicate passthrough mode. When this property is absent, parse interrupt type per-line from the DT fwspec provided by the interrupt source. Else, use the global setting for all interrupt lines. Signed-off-by: Aniket Limaye Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260123-ul-driver-i2c-j722s-v4-2-b08625c487d5@ti.com commit 7a30a7a6c81e8343e27056ac0bddd5fcbc33b8a8 Author: Aniket Limaye Date: Fri Jan 23 12:25:45 2026 +0530 dt-bindings: interrupt-controller: ti,sci-intr: Per-line interrupt-types Update the bindings to allow setting per-line interrupt-types. Some Interrupt Router instances can only work with a specific trigger type (edge or level), while others act as simple passthroughs that preserve the source interrupt type unchanged. Make "ti,intr-trigger-type" property optional, with its absence indicating that the router acts as a passthrough. When absent, "#interrupt-cells" must be 2 to allow each interrupt source to specify its trigger type per-line. Signed-off-by: Aniket Limaye Signed-off-by: Thomas Gleixner Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260123-ul-driver-i2c-j722s-v4-1-b08625c487d5@ti.com commit 9bad74127f0ae8eeed2510fe381b064e08e6507e Author: Eric Dumazet Date: Tue Dec 23 05:20:26 2025 +0000 x86/apic: Inline __x2apic_send_IPI_dest() Avoid one call/ret in networking RPS/RFS fast path, with no space cost. scripts/bloat-o-meter -t vmlinux.before vmlinux.after add/remove: 0/2 grow/shrink: 2/0 up/down: 96/-97 (-1) Function old new delta x2apic_send_IPI 146 198 +52 __x2apic_send_IPI_mask 326 370 +44 __pfx___x2apic_send_IPI_dest 16 - -16 __x2apic_send_IPI_dest 81 - -81 Total: Before=20861234, After=20861233, chg -0.00% Signed-off-by: Eric Dumazet Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251223052026.4141498-1-edumazet@google.com commit b7f42b0cfb94d4cc96371ef77c4ecffbc1c02ac2 Author: Jason Hall Date: Tue Jan 20 06:41:19 2026 -0700 rust_binder: refactor context management to use KVVec Replace the linked list management in context.rs with KVVec. This simplifies the ownership model by using standard Arc-based tracking and moves away from manual unsafe list removals. The refactor improves memory safety by leveraging Rust's contiguous collection types while maintaining proper error propagation for allocation failures during process registration. Suggested-by: Alice Ryhl Link: https://github.com/rust-for-linux/linux/issues/1215 Signed-off-by: Jason Hall Link: https://patch.msgid.link/20260120134119.98048-1-jason.kei.hall@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5288993c4d1a8e59310e007aa68cf9b856551cc6 Author: Chuck Lever Date: Fri Dec 26 10:19:35 2025 -0500 xdrgen: Add enum value validation to generated decoders XDR enum decoders generated by xdrgen do not verify that incoming values are valid members of the enum. Incoming out-of-range values from malicious or buggy peers propagate through the system unchecked. Add validation logic to generated enum decoders using a switch statement that explicitly lists valid enumerator values. The compiler optimizes this to a simple range check when enum values are dense (contiguous), while correctly rejecting invalid values for sparse enums with gaps in their value ranges. The --no-enum-validation option on the source subcommand disables this validation when not needed. The minimum and maximum fields in _XdrEnum, which were previously unused placeholders for a range-based validation approach, have been removed since the switch-based validation handles both dense and sparse enums correctly. Because the new mechanism results in substantive changes to generated code, existing .x files are regenerated. Unrelated white space and semicolon changes in the generated code are due to recent commit 1c873a2fd110 ("xdrgen: Don't generate unnecessary semicolon") and commit 38c4df91242b ("xdrgen: Address some checkpatch whitespace complaints"). Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit 4c53b89032f14577e94d747a3ca0aee63f18d856 Author: Chuck Lever Date: Fri Dec 26 10:19:34 2025 -0500 xdrgen: Emit a max_arg_sz macro struct svc_service has a .vs_xdrsize field that is filled in by servers for each of their RPC programs. This field is supposed to contain the size of the largest procedure argument in the RPC program. This value is also sometimes used to size network transport buffers. Currently, server implementations must manually calculate and hard-code this value, which is error-prone and requires updates when procedure arguments change. Update xdrgen to determine which procedure argument structure is largest, and emit a macro with a well-known name that contains the size of that structure. Server code then uses this macro when initializing the .vs_xdrsize field. For NLM version 4, xdrgen now emits: #define NLM4_MAX_ARGS_SZ (NLM4_nlm4_lockargs_sz) Signed-off-by: Chuck Lever commit 63a5425ff5e077c54eb2719c735108e2aa1f9eb6 Author: Chuck Lever Date: Fri Dec 26 10:19:33 2025 -0500 xdrgen: Extend error reporting to AST transformation phase Commit 277df18d7df9 ("xdrgen: Improve parse error reporting") added clean, compiler-style error messages for syntax errors detected during parsing. However, semantic errors discovered during AST transformation still produce verbose Python stack traces. When an XDR specification references an undefined type, the transformer raises a VisitError wrapping a KeyError. Before this change: Traceback (most recent call last): File ".../lark/visitors.py", line 124, in _call_userfunc return f(children) ... KeyError: 'fsh4_mode' ... lark.exceptions.VisitError: Error trying to process rule "basic": 'fsh4_mode' After this change: file.x:156:2: semantic error Undefined type 'fsh4_mode' fsh4_mode mode; ^ The new handle_transform_error() function extracts position information from the Lark tree node metadata and formats the error consistently with parse error messages. Signed-off-by: Chuck Lever commit 3e6397b056335cc56ef0e9da36c95946a19f5118 Author: Chuck Lever Date: Fri Dec 26 10:15:32 2025 -0500 SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory via gssx_dec_buffer(), which calls kmemdup(). When a subsequent decode operation fails, these functions return immediately without freeing previously allocated buffers, causing memory leaks. The leak in gssx_dec_ctx() is particularly relevant because the caller (gssp_accept_sec_context_upcall) initializes several buffer length fields to non-zero values, resulting in memory allocation: struct gssx_ctx rctxh = { .exported_context_token.len = GSSX_max_output_handle_sz, .mech.len = GSS_OID_MAX_LEN, .src_name.display_name.len = GSSX_max_princ_sz, .targ_name.display_name.len = GSSX_max_princ_sz }; If, for example, gssx_dec_name() succeeds for src_name but fails for targ_name, the memory allocated for exported_context_token, mech, and src_name.display_name remains unreferenced and cannot be reclaimed. Add error handling with goto-based cleanup to free any previously allocated buffers before returning an error. Reported-by: Xingjing Deng Closes: https://lore.kernel.org/linux-nfs/CAK+ZN9qttsFDu6h1FoqGadXjMx1QXqPMoYQ=6O9RY4SxVTvKng@mail.gmail.com/ Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 404d779466646bf1461f2090ff137e99acaecf42 Author: Anthony Iliopoulos Date: Mon Dec 22 14:30:05 2025 -0500 nfsd: fix return error code for nfsd_map_name_to_[ug]id idmap lookups can time out while the cache is waiting for a userspace upcall reply. In that case cache_check() returns -ETIMEDOUT to callers. The nfsd_map_name_to_[ug]id functions currently proceed with attempting to map the id to a kuid despite a potentially temporary failure to perform the idmap lookup. This results in the code returning the error NFSERR_BADOWNER which can cause client operations to return to userspace with failure. Fix this by returning the failure status before attempting kuid mapping. This will return NFSERR_JUKEBOX on idmap lookup timeout so that clients can retry the operation instead of aborting it. Fixes: 65e10f6d0ab0 ("nfsd: Convert idmap to use kuids and kgids") Cc: stable@vger.kernel.org Signed-off-by: Anthony Iliopoulos Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit f9c206cdc4266caad6a9a7f46341420a10f03ccb Author: Anthony Iliopoulos Date: Mon Dec 22 14:30:04 2025 -0500 nfsd: never defer requests during idmap lookup During v4 request compound arg decoding, some ops (e.g. SETATTR) can trigger idmap lookup upcalls. When those upcall responses get delayed beyond the allowed time limit, cache_check() will mark the request for deferral and cause it to be dropped. This prevents nfs4svc_encode_compoundres from being executed, and thus the session slot flag NFSD4_SLOT_INUSE never gets cleared. Subsequent client requests will fail with NFSERR_JUKEBOX, given that the slot will be marked as in-use, making the SEQUENCE op fail. Fix this by making sure that the RQ_USEDEFERRAL flag is always clear during nfs4svc_decode_compoundargs(), since no v4 request should ever be deferred. Fixes: 2f425878b6a7 ("nfsd: don't use the deferral service, return NFS4ERR_DELAY") Signed-off-by: Anthony Iliopoulos Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit 9abb3549227e4fb70f0d8ba515bf7ddd249ad710 Author: Chuck Lever Date: Mon Dec 22 09:44:59 2025 -0500 xdrgen: Improve parse error reporting The current verbose Lark exception output makes it difficult to quickly identify and fix syntax errors in XDR specifications. Users must wade through hundreds of lines of cascading errors to find the root cause. Replace this with concise, compiler-style error messages showing file, line, column, the unexpected token, and the source line with a caret pointing to the error location. Before: Unexpected token Token('__ANON_1', '+1') at line 14, column 35. Expected one of: * SEMICOLON Previous tokens: [Token('__ANON_0', 'LM_MAXSTRLEN')] [hundreds more cascading errors...] After: file.x:14:35: parse error Unexpected number '+1' const LM_MAXNAMELEN = LM_MAXSTRLEN+1; ^ The error handler now raises XdrParseError on the first error, preventing cascading messages that obscure the root cause. Signed-off-by: Chuck Lever commit eb1f3b55ac6202a013daf14ed508066947cdafa8 Author: Chuck Lever Date: Mon Dec 22 09:44:29 2025 -0500 xdrgen: Remove inclusion of nlm4.h header The client-side source code template mistakenly includes the nlm4.h header file, which is specific to the NLM protocol and should not be present in the generic template that generates client stubs for all XDR-based protocols. Fixes: 903a7d37d9ea ("xdrgen: Update the files included in client-side source code") Signed-off-by: Chuck Lever commit 27b0fcae8f535fb882b1876227a935dcfdf576aa Author: Chuck Lever Date: Sat Dec 20 10:41:09 2025 -0500 xdrgen: Initialize data pointer for zero-length items The xdrgen decoders for strings and opaque data had an optimization that skipped calling xdr_inline_decode() when the item length was zero. This left the data pointer uninitialized, which could lead to unpredictable behavior when callers access it. Remove the zero-length check and always call xdr_inline_decode(). When passed a length of zero, xdr_inline_decode() returns the current buffer position, which is valid and matches the behavior of hand-coded XDR decoders throughout the kernel. Fixes: 4b132aacb076 ("tools: Add xdrgen") Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit 41b0a87bc60d5ccfa8575481ddb4d4d8758507fa Author: Olga Kornievskaia Date: Fri Dec 19 12:59:55 2025 -0500 NFSD: fix setting FMODE_NOCMTIME in nfs4_open_delegation fstests generic/215 and generic/407 were failing because the server wasn't updating mtime properly. When deleg attribute support is not compiled in and thus no attribute delegation was given, the server was skipping updating mtime and ctime because FMODE_NOCMTIME was uncoditionally set for the write delegation. Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit ae78eb497868f335919db83b82eb59849c6cf251 Author: Chuck Lever Date: Tue Dec 16 11:23:09 2025 -0500 xdrgen: Implement short (16-bit) integer types "short" and "unsigned short" types are not defined in RFC 4506, but are supported by the rpcgen program. An upcoming protocol specification includes at least one "unsigned short" field, so xdrgen needs to implement support for these types. Signed-off-by: Chuck Lever commit 789477b849394afdb60507924d65f7ef18f078ce Author: Jeff Layton Date: Sat Dec 13 11:53:17 2025 +0900 nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg() Claude pointed out that there is a nfs4_file refcount leak in nfsd_get_dir_deleg(). Ensure that the reference to "fp" is released before returning. Fixes: 8b99f6a8c116 ("nfsd: wire up GET_DIR_DELEGATION handling") Cc: stable@vger.kernel.org Cc: Chris Mason Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 27e383ddeb3c88e20874c545285f2dce1a98f56a Author: NeilBrown Date: Sat Dec 13 13:42:00 2025 -0500 nfsd: use workqueue enable/disable APIs for v4_end_grace sync "nfsd: provide locking for v4_end_grace" introduced a client_tracking_active flag protected by nn->client_lock to prevent the laundromat from being scheduled before client tracking initialization or after shutdown begins. That commit is suitable for backporting to LTS kernels that predate commit 86898fa6b8cd ("workqueue: Implement disable/enable for (delayed) work items"). However, the workqueue subsystem in recent kernels provides enable_delayed_work() and disable_delayed_work_sync() for this purpose. Using this mechanism enable us to remove the client_tracking_active flag and associated spinlock operations while preserving the same synchronization guarantees, which is a cleaner long-term approach. Signed-off-by: NeilBrown Tested-by: Li Lingfeng Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 0ac903d1bfdce8ff40657c2b7d996947b72b6645 Author: Chuck Lever Date: Tue Dec 9 19:28:50 2025 -0500 NFS: NFSERR_INVAL is not defined by NFSv2 A documenting comment in include/uapi/linux/nfs.h claims incorrectly that NFSv2 defines NFSERR_INVAL. There is no such definition in either RFC 1094 or https://pubs.opengroup.org/onlinepubs/9629799/chap7.htm NFS3ERR_INVAL is introduced in RFC 1813. NFSD returns NFSERR_INVAL for PROC_GETACL, which has no specification (yet). However, nfsd_map_status() maps nfserr_symlink and nfserr_wrong_type to nfserr_inval, which does not align with RFC 1094. This logic was introduced only recently by commit 438f81e0e92a ("nfsd: move error choice for incorrect object types to version-specific code."). Given that we have no INVAL or SERVERFAULT status in NFSv2, probably the only choice is NFSERR_IO. Fixes: 438f81e0e92a ("nfsd: move error choice for incorrect object types to version-specific code.") Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 288d9ddbb74f52e07b1e2bc628768f7847dcb7e6 Author: Chuck Lever Date: Wed Dec 10 09:04:24 2025 -0500 xdrgen: Emit the program number definition "xdrgen definitions" was not providing a definition of a symbolic constant for the RPC program number being defined. Signed-off-by: Chuck Lever commit bf0fe9ad3d597d8e1378dc9953ca96dfc3addb2b Author: Chuck Lever Date: Mon Dec 8 11:15:32 2025 -0500 xdrgen: Fix struct prefix for typedef types in program wrappers The program templates for decoder/argument.j2 and encoder/result.j2 unconditionally add 'struct' prefix to all types. This is incorrect when an RPC protocol specification lists a typedef'd basic type or an enum as a procedure argument or result (e.g., NFSv2's fhandle or stat), resulting in compiler errors when building generated C code. Fixes: 4b132aacb076 ("tools: Add xdrgen") Signed-off-by: Chuck Lever commit 9be4b7e74eb7b82ec6d7453a95e9878deab39763 Author: Jeff Layton Date: Wed Dec 3 10:52:16 2025 -0500 nfsd: prefix notification in nfsd4_finalize_deleg_timestamps() with "nfsd: " Make it distinct that this message comes from nfsd. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 96f04d24fc961a600cc9d2c4b740acf273cfcd1e Author: NeilBrown Date: Sat Nov 22 12:00:37 2025 +1100 locks: ensure vfs_test_lock() never returns FILE_LOCK_DEFERRED FILE_LOCK_DEFERRED can be returned when creating or removing a lock, but not when testing for a lock. This support was explicitly removed in Commit 09802fd2a8ca ("lockd: rip out deferred lock handling from testlock codepath") However the test in nlmsvc_testlock() suggests that it *can* be returned, only nlm cannot handle it. To aid clarity, remove the test and instead put a similar test and warning in vfs_test_lock(). If the impossible happens, convert FILE_LOCK_DEFERRED to -EIO. Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4329010ad9c36775e7092e451c37c24c4f90243f Author: Chuck Lever Date: Mon Dec 1 17:19:46 2025 -0500 xdrgen: Address some checkpatch whitespace complaints This is a roll-up of three template fixes that eliminate noise from checkpatch output so that it's easier to spot non-trivial problems. To follow conventional kernel C style, when a union declaration is marked with "pragma public", there should be a blank line between the emitted "union xxx { ... };" and the decoder and encoder function declarations. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 9654a0388a3abcfa51cb2d010a6624a6f1f46710 Author: Chuck Lever Date: Thu Nov 20 15:15:52 2025 -0500 xdrgen: Generate "if" instead of "switch" for boolean union enumerators Eliminate this warning in code generated by xdrgen: fs/nfsd/nfs3xdr_gen.c:220:2: warning: switch condition has boolean value [-Wswitch-bool] 220 | switch (ptr->attributes_follow) { | ^ ~~~~~~~~~~~~~~~~~~~~~~ No more -Wswitch-bool warnings when compiling with W=1. The generated code is functionally equivalent but somewhat more idiomatic. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511172336.Y75zj4v6-lkp@intel.com/ Signed-off-by: Chuck Lever commit e344a031a4928e9f0ae3124f0e45e953a873f3bd Author: Chuck Lever Date: Thu Nov 20 15:15:51 2025 -0500 NFSD: Add instructions on how to deal with xdrgen files xdrgen requires a number of Python packages on the build system. We don't want to add these to the kernel build dependency list, which is long enough already. The generated files are generated manually using $ cd fs/nfsd && make xdrgen whenever the .x files are modified, then they are checked into the kernel repo so others do not need to rebuild them. Signed-off-by: Chuck Lever commit 87a6e3b6c494ac519548c30b82b0d87b233b9649 Author: Khushal Chitturi Date: Wed Nov 19 01:22:58 2025 +0530 xdrgen: improve error reporting for invalid void declarations RFC 4506 defines void as a zero-length type that may appear only as union arms or as program argument/result types. It cannot be declared with an identifier, so constructs like "typedef void temp;" are not valid XDR. Previously, xdrgen raised a NotImplementedError when it encountered a void declaration in a typedef. Which was misleading, as the problem is an invalid RPC specification rather than missing functionality in xdrgen. This patch replaces the NotImplementedError for _XdrVoid in typedef handling with a clearer ValueError that specifies incorrect use of void in the XDR input, making it clear that the issue lies in the RPC specification being parsed. Signed-off-by: Khushal Chitturi Signed-off-by: Chuck Lever commit 1f1fe81acbacdc8e0c5bf18ec2f69ca21a92edbc Author: Chuck Lever Date: Mon Nov 17 11:00:51 2025 -0500 NFSD: Clean up nfsd4_check_open_attributes() The @rqstp parameter was introduced in commit 3c8e03166ae2 ("NFSv4: do exact check about attribute specified") but has never been used. Reduce indentation in callers to improve readability. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 43b1d60361a5acbb70c40d89e4380de1c4217c95 Merge: 2aced0be57814f fc12767c19d496 Author: Arnd Bergmann Date: Mon Jan 26 16:05:01 2026 +0100 Merge tag 'qcom-arm64-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm64 DeviceTree for v6.20 Introduce the Kaanapali SoC, with the MTP and QRD devices. Introduce support for the Milos SoC (SM7635) and initial support for the Fairphone (Gen 6) device on this platform. Add the QCS6490-based RubikPI3 board, the QRB2210-based Arduino UnoQ, the X Elite-based Medion SPRCHRGD 14 S1 and Surface Pro 11 laptops, and the SDM845-based Pixel 3 and Pixel 3 XL devices. On the Kodiak-based (QCS6490) RB3Gen2 the TC9563 PCIe switch controller is described. On Lemans (SA8775P/QCS9075) the GPU and crypto blocks are added. IO-regions and clocks are added to interconnect nodes to allow QoS configuration. GPU, TPM and USB support are enabled on the evaluation kit (EVK). On Monaco (QCS8300) the two PCIe controllers, the camera subsystem, tsens, display subsystem, crypto, CPUfreq, and coresight are added. On the evaluation kit (EVK) the PCIe busses are enabled, together with an AMC6821-based fan controller and the ST33 TPM chip. On MSM8939 the camera subsystem is described. The Asus ZenFone 2 Laser/Selfie gains battery and hall sensor support. On the Agatti-based RB1 board PM8008 is described and an overlay for the Vision mezzanine is introduced. On SDM630 the compute DSP remoteproc, FastRPC and related entites are described. The LPASS LPI pinctrl node is described. On SDM845-based OnePlus device the bootloader framebuffer and its resources are described, to improve the transition. On the SDM845-based devices from OnePlus, SHIFT, and Xiaomi ath10k calibration variants are specified. The sensor remoteproc is enabled on Xiaomi Pocophone F1. On SM7225-based Fairphone FP4 regulators for the cameras are described, and the camera EEPROM is added. On SM8650 the camera subsystem is described. On the QRD the Samsung S5KJN1 camera sensor is added, and for the HDK an overlay for the "Rear Camera Card" is added. On SM8750 CPUfreq, SDCHCI and Iris (video encode/decode) support are added, and missing - required - properties for the BAM DMA is added. These are then enabled on the MTP. On Talos (SM6150/QCS615) PMU, DisplayPort, and USB/DP combo PHY are added. DisplayPort is enabled on the Talos Ride board. On Hamoa (X Elite) add crypto engine, missing TCSR reference clocks, and random number generator block. The soc bus address width is corrected to match the hardware. On the Lenovo Thinkpad T14s HDMI and audio playback over DisplayPort is introduced. HDMI, Iris (video encode/decode) and PS8830 retimers are described for the ASUS Vivobook S 15. On the Hamoa evaluation kit (EVK) PCIe busses, WiFi, backlight, TPM and RG (red/green) LEDs are described. Enable QSEECOM, and thereby UEFI variable access, on the Medion SPRCHRGD 14 S1 (commit should have been on drivers branch). * tag 'qcom-arm64-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (155 commits) dt-bindings: mailbox: qcom: Add IPCC support for Kaanapali and Glymur Platforms dt-bindings: mailbox: qcom: Add CPUCP mailbox controller bindings for Kaanapali arm64: dts: qcom: lemans: enable static TPDM arm64: dts: qcom: kodiak: Add memory region for audiopd arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: add HDMI nodes arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) arm64: dts: qcom: lemans; Add EL2 overlay arm64: dts: qcom: sm8150: add uart13 arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm arm64: dts: qcom: sm6125-ginkgo: Fix missing msm-id subtype arm64: dts: qcom: qcs8300: Add GPU cooling arm64: dts: qcom: sa8775p: Add reg and clocks for QoS configuration arm64: dts: qcom: hamoa-iot-evk: Enable TPM (ST33) on SPI11 arm64: dts: qcom: talos: Add PMU support arm64: dts: qcom: talos: switch to interrupt-cells 4 to add PPI partitions arm64: dts: qcom: ipq9574: Complete USB DWC3 wrapper interrupts arm64: dts: qcom: ipq5018: Correct USB DWC3 wrapper interrupts arm64: dts: qcom: monaco: Add CTCU and ETR nodes ... Signed-off-by: Arnd Bergmann commit 2aced0be57814f45f0853f8ba6bc9c848f8cb3c6 Merge: 915ed61356c255 df7c440c904f75 Author: Arnd Bergmann Date: Mon Jan 26 16:04:07 2026 +0100 Merge tag 'qcom-arm32-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm32 DeviceTree updates for v6.20 Migrate the MSM8974 remoteproc power supplies to RPM provided power-domains, to match what is done on most other platforms. Give the LG Nexus 5 its more human friendly model name. * tag 'qcom-arm32-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: msm8974: Start using rpmpd for power domains ARM: dts: qcom: msm8974: Sort header includes alphabetically ARM: dts: qcom: msm8974-hammerhead: Update model property Signed-off-by: Arnd Bergmann commit 915ed61356c255b61f8e7164d07b7bdfff3a9c46 Merge: 3d46ce71a7e451 4310a370a32390 Author: Arnd Bergmann Date: Mon Jan 26 16:02:40 2026 +0100 Merge tag 'zynqmp-dt-for-6.20' of https://github.com/Xilinx/linux-xlnx into soc/dt arm64: Xilinx DT changes for 6.20 - Cleanup SPI compatible strings - wwdt: Add optional power-domains property - ZynqMP: Fix OPP description and setup - ZynqMP: Remove OP-TEE node - Drop label from dlg,slg7xl45106 - Remove ina260 IIO description * tag 'zynqmp-dt-for-6.20' of https://github.com/Xilinx/linux-xlnx: arm64: zynqmp: Remove ina260 IIO description arm64: dts: xilinx: Drop "label" property on dlg,slg7xl45106 Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" arm64: dts: xilinx: fix zynqmp opp-table-cpu dt-bindings: watchdog: xlnx,versal-wwdt: Add optional power-domains property arm64: dts: xilinx: add soc-specific spi compatibles for zynqmp/versal-net Signed-off-by: Arnd Bergmann commit 3d46ce71a7e45149447bbc2339e76d50d17438f2 Merge: 50411c8d83876d dfa93788dd8b2f Author: Arnd Bergmann Date: Mon Jan 26 15:45:52 2026 +0100 Merge tag 'tegra-for-6.20-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Changes for v6.20-rc1 This update improves Device Tree support for 64-bit Tegra platforms, specifically focusing on the Smaug board and the Tegra264 SoC. It enables full USB-C functionality on Smaug by adding role-switching support and enabling DisplayPort altmode. For Tegra264, it introduces nodes for Command Queue Virtualization (CMDQV) in the SMMU, adds the Data Backbone (DBB) clock for the memory controller, and corrects CPU compatible strings to match the Neoverse V3AE core. Additionally, it performs a cleanup by removing redundant status = "okay" properties across Tegra186, Tegra194, Tegra234, and Tegra264 files. * tag 'tegra-for-6.20-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: smaug: Add usb-role-switch support arm64: tegra: smaug: Complete and enable tegra-udc node arm64: tegra: smaug: Enable DisplayPort via USB-C port arm64: tegra: Correct CPU compatibles on Tegra264 arm64: tegra: Drop unneeded status=okay on Tegra264 arm64: tegra: Drop unneeded status=okay on Tegra234 arm64: tegra: Drop unneeded status=okay on Tegra194 arm64: tegra: Drop unneeded status=okay on Tegra186 arm64: tegra: Add nodes for CMDQV arm64: tegra: Add DBB clock to EMC on Tegra264 Signed-off-by: Arnd Bergmann commit 50411c8d83876d4e38f4e9fa0a5399afa660aefc Merge: d5e22ed44b0b8c 4d93678236678c Author: Arnd Bergmann Date: Mon Jan 26 15:45:04 2026 +0100 Merge tag 'tegra-for-6.20-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt ARM: tegra: Device tree changes for v6.20-rc1 This update corrects the DSI Device Tree nodes for Tegra20 and Tegra30 by adding missing properties (nvidia,mipi-calibrate and cell definitions) to ensure proper MIPI calibration support. * tag 'tegra-for-6.20-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: Adjust DSI nodes for Tegra20/Tegra30 Signed-off-by: Arnd Bergmann commit d5e22ed44b0b8c742acd763125c64a02f169e472 Author: Rob Herring (Arm) Date: Sat Jan 17 19:22:54 2026 +0100 ARM: dts: samsung: Drop s3c6400.dtsi This .dtsi file is not included anywhere in the tree and can't be tested. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251212203226.458694-7-robh@kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260117182257.14799-2-krzk@kernel.org Signed-off-by: Arnd Bergmann commit aeec6d68b673aaafbd8951a766b964a6935fe0c5 Author: Krzysztof Kozlowski Date: Sat Jan 17 19:21:17 2026 +0100 ARM: dts: nuvoton: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819131725.86770-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260117182117.14483-4-krzk@kernel.org Signed-off-by: Arnd Bergmann commit 896cc203af6334797ea4ff40a99cbc5564862f83 Merge: 6b825102945670 9afdf3e1a59e23 Author: Arnd Bergmann Date: Mon Jan 26 15:42:53 2026 +0100 Merge tag 'samsung-dt64-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v6.20 1. ExynosAutov920: - Add MFD clock controller node. 2. Google GS101: - Add True Random Number Generator (TRNG) and OTP nvmem nodes. - Correct the PMU (Power Management Unit) compatibles by dropping fallback to syscon. The PMU on Samsung devices serves the role of syscon, however on GS101 it cannot be used via standard Linux syscon interface, because register accesses require custom regmap. It was simply never correctly working with "syscon" compatible fallback. - Add phandles to System Registers SYSREG blocks in clock controllers, necessary for enabling automatic clock control later. * tag 'samsung-dt64-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos: gs101: add OTP node arm64: dts: exynos: gs101: add samsung,sysreg property to CMU nodes arm64: dts: exynosautov920: add CMU_MFD clock DT nodes arm64: dts: exynos: gs101: remove syscon compatible from pmu node dt-bindings: soc: samsung: exynos-pmu: remove syscon for google,gs101-pmu arm64: dts: exynos: gs101: add TRNG node dt-bindings: rng: add google,gs101-trng compatible Signed-off-by: Arnd Bergmann commit 6b82510294567006358510a57681eabaa2c3b26a Merge: ab8292d7021696 5cd532f7f01746 Author: Arnd Bergmann Date: Mon Jan 26 15:40:33 2026 +0100 Merge tag 'dt64-cleanup-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt into soc/dt Minor improvements in ARM64 DTS for v6.20 Several minor cleanups for Nuvoton, LG, Spreadtrum, Toshiba, Cavium, ARM and APM SoCs: 1. Switch to recommended node names by fixing style (s/lowercase/hyphen/), using generic naming and adhering to DT bindings. 2. Use consistent whitespaces around. 3. Add missing properties like UART clocks (Cavium Thunder 88xx) or "reg" (APM). 4. Drop incorrect or long time deprecated propeties. 5. Correct clock cells to 0 for fixed-factor-clock clocks. * tag 'dt64-cleanup-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt: arm64: dts: apm: Drop "dma" device_type arm64: dts: apm: Add "reg" to "syscon-reboot" and "syscon-poweroff" arm64: dts: apm: Use recommended i2c node names arm64: dts: apm/shadowcat: More clock clean-ups ARM: dts: vexpress/v2m-rs1: Use documented arm,vexpress,config-bus child node names arm64: dts: cavium: Drop thunder2 arm64: dts: cavium: thunder-88xx: Add missing PL011 "uartclk" arm64: dts: toshiba: Use recommended node names arm64: dts: sprd: Use recommended node names arm64: dts: lg: Use recommended simple-bus node name arm64: dts: nuvoton: npcm845: Minor whitespace cleanup arm64: dts: toshiba: tmpv7708: Align node names with DT bindings Signed-off-by: Arnd Bergmann commit ab8292d7021696dfd0faf9477b37b8c4b3b89adf Merge: 6e646eac67c6b7 5979010bcc665e Author: Arnd Bergmann Date: Mon Jan 26 15:36:27 2026 +0100 Merge tag 'renesas-dts-for-v6.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.20 (take two) - Add cpufreq, thermal, GPIO IRQ, and CAN-FD support for the RZ/T2H and RZ/N2H SoCs and their EVK boards, - Add more serial (RSCI) and CAN-FD support for the RZ/V2H and RZ/V2N SoCs, - Drop unused .dtsi files, - Add I3C support for the RZ/G3E SMARC SoM, - Add GPIO support for the RZ/N1 SoC, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v6.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (27 commits) arm64: dts: renesas: rzt2h-rzn2h-evk: Reorder ADC nodes ARM: dts: r9a06g032: Add support for GPIO interrupts ARM: dts: r9a06g032: Add GPIO controllers arm64: dts: renesas: rzg3e-smarc-som: Enable I3C support arm64: dts: renesas: Use lowercase hex arm64: dts: renesas: Use hyphens in node names arm/arm64: dts: renesas: Drop unused .dtsi arm64: dts: renesas: rzt2h-n2h-evk-common: Use GPIO for SD0 write protect arm64: dts: renesas: r9a09g057: Add CANFD node arm64: dts: renesas: r9a09g056: Add CANFD node arm64: dts: renesas: r9a09g087m44-rzn2h-evk: Enable CANFD arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Enable CANFD arm64: dts: renesas: r9a09g087: Add CANFD node arm64: dts: renesas: r9a09g077: Add CANFD node arm64: dts: renesas: r9a09g057: Add RSCI nodes arm64: dts: renesas: r9a09g056: Add RSCI nodes arm64: dts: renesas: r9a09g087m44-rzn2h-evk: Add GPIO keys arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Add GPIO keys arm64: dts: renesas: r9a09g087: Add GPIO IRQ support arm64: dts: renesas: r9a09g077: Add GPIO IRQ support ... Signed-off-by: Arnd Bergmann commit 2df8b310bcfe76827fd71092f58a2493ee6590b0 Author: Mikulas Patocka Date: Mon Jan 26 15:36:22 2026 +0100 dm: use bio_clone_blkg_association The origin bio carries blk-cgroup information which could be set from foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone"). The synchronous io is still under control by blkcg, because 'bio->bi_blkg' is set by io submitting task which has been added into 'cgroup.procs'. Fix it by using bio_clone_blkg_association when submitting a cloned bio. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220985 Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone") Reported-by: Zhihao Cheng Signed-off-by: Mikulas Patocka Tested-by: Zhihao Cheng commit 6e646eac67c6b77e2025239d2da2196ef7285c3c Merge: c0398be9890d17 f3b795d298a280 Author: Arnd Bergmann Date: Mon Jan 26 15:33:46 2026 +0100 Merge tag 'renesas-dt-bindings-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DT binding updates for v6.20 - Document the RZ/N1 GPIO Interrupt Multiplexer. * tag 'renesas-dt-bindings-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: dt-bindings: soc: renesas: Document RZ/N1 GPIO Interrupt Multiplexer Signed-off-by: Arnd Bergmann commit 3c58f03e805f8f9025f09fe393103947dca49c57 Author: I-Hsin Cheng Date: Sat Jan 24 20:32:41 2026 +0800 kselftest/arm64: Add missing file in .gitignore The binary generated by check_hugetlb_options is missing in .gitignore under the directory. Add it into the file so it won't be logged into version control. Signed-off-by: I-Hsin Cheng Signed-off-by: Will Deacon commit 1dc643205953c2ff2e1d95dbdc2e784675abb38c Author: Sean Christopherson Date: Thu Jan 15 09:34:27 2026 -0800 KVM: nVMX: Remove explicit filtering of GUEST_INTR_STATUS from shadow VMCS fields Drop KVM's filtering of GUEST_INTR_STATUS when generating the shadow VMCS bitmap now that KVM drops GUEST_INTR_STATUS from the set of supported vmcs12 fields if the field isn't supported by hardware, and initialization of the shadow VMCS fields omits unsupported vmcs12 fields. Note, there is technically a small functional change here, as the vmcs12 filtering only requires support for Virtual Interrupt Delivery, whereas the shadow VMCS code being removed required "full" APICv support, i.e. required Virtual Interrupt Delivery *and* APIC Register Virtualizaton *and* Posted Interrupt support. Opportunistically tweak the comment to more precisely explain why the PML and VMX preemption timer fields need to be explicitly checked. Reviewed-by: Xiaoyao Li Link: https://patch.msgid.link/20260115173427.716021-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 5fdf86e7353ce2d91a24dcbe7320935b40d55367 Author: Sean Christopherson Date: Thu Jan 15 09:34:26 2026 -0800 KVM: nVMX: Disallow access to vmcs12 fields that aren't supported by "hardware" Disallow access (VMREAD/VMWRITE), both emulated and via a shadow VMCS, to VMCS fields that the loaded incarnation of KVM doesn't support, e.g. due to lack of hardware support, as a middle ground between allowing access to any vmcs12 field defined by KVM (current behavior) and gating access based on the userspace-defined vCPU model (the most functionally correct, but very costly, implementation). Disallowing access to unsupported fields helps a tiny bit in terms of closing the virtualization hole (see below), but the main motivation is to avoid having to weed out unsupported fields when synchronizing between vmcs12 and a shadow VMCS. Because shadow VMCS accesses are done via VMREAD and VMWRITE, KVM _must_ filter out unsupported fields (or eat VMREAD/VMWRITE failures), and filtering out just shadow VMCS fields is about the same amount of effort, and arguably much more confusing. As a bonus, this also fixes a KVM-Unit-Test failure bug when running on _hardware_ without support for TSC Scaling, which fails with the same signature as the bug fixed by commit ba1f82456ba8 ("KVM: nVMX: Dynamically compute max VMCS index for vmcs12"): FAIL: VMX_VMCS_ENUM.MAX_INDEX expected: 19, actual: 17 Dynamically computing the max VMCS index only resolved the issue where KVM was hardcoding max index, but for CPUs with TSC Scaling, that was "good enough". Reviewed-by: Chao Gao Reviewed-by: Xin Li Cc: Xiaoyao Li Cc: Yosry Ahmed Link: https://lore.kernel.org/all/20251026201911.505204-22-xin@zytor.com Link: https://lore.kernel.org/all/YR2Tf9WPNEzrE7Xg@google.com Reviewed-by: Xiaoyao Li Link: https://patch.msgid.link/20260115173427.716021-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 5d4ae0bffb6eeada6dd16ba52150457ae96c3725 Author: Armin Wolf Date: Fri Jan 23 22:15:37 2026 +0100 platform/wmi: string-kunit: Add missing oversized string test case When compiling the WMI string kunit tests using llvm, the compiler will issue a warning about "oversized_test_utf8_string" being unused. This happens because the test case that was supposed to use said variable was accidentally omitted when adding the kunit tests. Fix this by adding the aforementioned test case. Fixes: 0e1a8143e797 ("platform/wmi: Add kunit test for the string conversion code") Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/platform-driver-x86/20260122234521.GA413183@ax162/ Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260123211537.4448-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8164a14b15008579801ba6ba3ae00d37ecc310e5 Author: Alexey Zagorodnikov Date: Wed Jan 21 19:35:19 2026 +0500 platform/x86/amd/pmf: Added a module parameter to disable the Smart PC function Addresses a low power limits issue on HP ZBook Ultra G1a. If vendor firmware capped APU power limits with 3rd-party AC adapters, the user can disable the Smart PC function via the module parameter Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4868 [1] Signed-off-by: Alexey Zagorodnikov Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20260121143519.12318-1-xglooom@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7c9aa38a59f611c619d026c2d082d0e8c9b9069f Author: Werner Sembach Date: Thu Jan 15 16:42:02 2026 +0100 platform/x86/uniwill: Implement cTGP setting Uniwill offers user setable cTGP for their EC on devices using NVIDIA 3000 Series and newer GPUs. This patch implements this setting as a sysfs attribute. For one device, the TUXEDO InfinityBook Gen7, the variant with and without NVIDIA GPU can't be differentiated using only the DMI strings, so the new probe callback needs to be used to test a bit from the EC memory. Co-developed-by: Armin Wolf Signed-off-by: Armin Wolf Signed-off-by: Werner Sembach Reviewed-by: Armin Wolf Link: https://patch.msgid.link/20260115154332.402873-2-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d8c560f76dcac7ff4c630d5d84958183adbf19d2 Author: Armin Wolf Date: Thu Jan 15 16:42:01 2026 +0100 platform/x86: uniwill-laptop: Introduce device descriptor system Future additions to the driver will depend on device-specific initialization steps. Extend the DMI-based feature detection system to include device descriptors. Each descriptor contains a bitmap of supported features and a set of callback for performing device-specific initialization. Signed-off-by: Armin Wolf Co-developed-by: Werner Sembach Signed-off-by: Werner Sembach Reviewed-by: Armin Wolf Link: https://patch.msgid.link/20260115154332.402873-1-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2ee832305a25657d7cfb577bc30d8c1d43bfb951 Author: Zilin Guan Date: Tue Jan 6 09:13:18 2026 +0000 platform/x86/amd: Use scope-based cleanup for wbrf_record() Simplify resource management in wbrf_record() by using the scope-based cleanup helper __free(). This ensures that the tmp and obj are automatically freed when they go out of scope, eliminating the need for explicit error handling labels and manual freeing. Suggested-by: Ilpo Järvinen Suggested-by: Markus Elfring Co-developed-by: Jianhao Xu Signed-off-by: Jianhao Xu Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20260106091318.747019-2-zilin@seu.edu.cn Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6343e06788e2edb822cd871e3e198a4ef69e3223 Merge: 2ccbdb612d0d95 4b11f2336e23d5 Author: Ilpo Järvinen Date: Mon Jan 26 15:42:17 2026 +0200 Merge branch 'fixes' of into for-next commit 22150a7d401d9e9169b9b68e05bed95f7f49bf69 Author: Andreas Gruenbacher Date: Sun Dec 14 16:47:34 2025 +0000 gfs2: Fix slab-use-after-free in qd_put Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access already-freed objects on the LRU list. Fix this by removing qd objects from the LRU list before freeing them in qd_put(). Initial fix from Deepanshu Kartikey . Fixes: a475c5dd16e5 ("gfs2: Free quota data objects synchronously") Reported-by: syzbot+046b605f01802054bff0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=046b605f01802054bff0 Signed-off-by: Andreas Gruenbacher commit 0ec49e7ea6e02e7ff146e031b0fe2243c2bad43a Author: Andreas Gruenbacher Date: Fri Jan 23 14:45:46 2026 +0100 gfs2: Introduce glock_{type,number,sbd} helpers Introduce glock_type(), glock_number(), and glock_sbd() helpers for accessing a glock's type, number, and super block pointer more easily. Created with Coccinelle using the following semantic patch: @@ struct gfs2_glock *gl; @@ - gl->gl_name.ln_type + glock_type(gl) @@ struct gfs2_glock *gl; @@ - gl->gl_name.ln_number + glock_number(gl) @@ struct gfs2_glock *gl; @@ - gl->gl_name.ln_sbd + glock_sbd(gl) glock_sbd() is a macro because it is used with const as well as non-const struct gfs2_glock * arguments. Instances in macro definitions, particularly in tracepoint definitions, replaced by hand. Signed-off-by: Andreas Gruenbacher commit d3b39fcb39574780fffec4357412ce0460339e9f Author: Andreas Gruenbacher Date: Tue Nov 18 20:19:45 2025 +0000 gfs2: gfs2_glock_hold cleanup Use lockref_get_not_dead() instead of an unguarded __lockref_is_dead() check. Signed-off-by: Andreas Gruenbacher commit 536f48e8bbefcc067cb91d4edce452f3ff007ea6 Author: Andreas Gruenbacher Date: Wed Dec 10 09:21:53 2025 +0000 gfs: Use fixed GL_GLOCK_MIN_HOLD time GL_GLOCK_MIN_HOLD represents the minimum time (in jiffies) that a glock should be held before being eligible for release. It is currently defined as 10, meaning that the duration depends on the timer interrupt frequency (CONFIG_HZ). Change that time to a constant 10ms independent of CONFIG_HZ. On CONFIG_HZ=1000 systems, the value remains the same. Signed-off-by: Andreas Gruenbacher commit c45fefe3a930ba8a7fef0ed6ad509a02097dfa80 Author: Andreas Gruenbacher Date: Thu Dec 11 02:22:20 2025 +0000 gfs2: Fix gfs2_log_get_bio argument type Fix the type of gfs2_log_get_bio()'s op argument: callers pass in a blk_opf_t value and the function passes that value on as a blk_opf_t value, so the current argument type makes no sense. Signed-off-by: Andreas Gruenbacher commit 08ca56ffcd43b37061bc675545796b3f01f9937d Author: Andreas Gruenbacher Date: Mon Jan 12 14:08:02 2026 +0100 gfs2: gfs2_chain_bio start sector fix Pass the start sector into gfs2_chain_bio(): the new bio isn't necessarily contiguous with the previous one. Signed-off-by: Andreas Gruenbacher commit 4a94f052e0982794aa65312fe8b69999e4494a20 Author: Andreas Gruenbacher Date: Thu Dec 11 01:55:47 2025 +0000 gfs2: Initialize bio->bi_opf early Pass the right blk_opf_t value to bio_alloc() so that ->bi_ops is initialized correctly and doesn't have to be changed later. Adjust the call chain to pass that value through to where it is needed (and only there). Add a separate blk_opf_t argument to gfs2_chain_bio() instead of copying the value from the previous bio. Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain") Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc Signed-off-by: Andreas Gruenbacher commit 59d81037d32ff1e415dcaa359c238c9ca730932d Author: Andreas Gruenbacher Date: Thu Dec 11 03:24:32 2025 +0000 gfs2: Rename gfs2_log_submit_{bio -> write} Rename gfs2_log_submit_bio() to gfs2_log_submit_write(): this function isn't used for submitting log reads. Signed-off-by: Andreas Gruenbacher commit 4928c36536d218ae70a1b79f1c0d3302ffe31f69 Author: Andreas Gruenbacher Date: Wed Dec 17 22:22:49 2025 +0000 gfs2: Do not cancel internal demote requests Trying to change the state of a glock may result in a "conversion deadlock" error, indicating that the requested state transition would cause a deadlock. In this case, we unlock and retry the state change. It makes no sense to try canceling those unlock requests, but the current code is not aware of that. In addition, if a locking request is canceled shortly after it is made, the cancelation request can currently overtake the locking request. This may result in deadlocks. Fix both of these bugs by repurposing the GLF_PENDING_REPLY flag into a GLF_MAY_CANCEL flag which is set only when the current locking request can be canceled. When trying to cancel a locking request in gfs2_glock_dq(), wait for this flag to be set. Signed-off-by: Andreas Gruenbacher commit 5e3319932a22cefd42e6bab2d60d2a17b2e1a6fa Author: Andreas Gruenbacher Date: Wed Dec 17 21:00:26 2025 +0000 gfs2: run_queue cleanup In run_queue(), instead of always setting the GLF_LOCK flag, only set it when the flag is actually needed. This avoids having to undo the flag setting later. Signed-off-by: Andreas Gruenbacher commit 11d763f0b0afc2cf5f92f4adae5dbbbbef712f8f Author: Andreas Gruenbacher Date: Tue Dec 9 22:59:12 2025 +0000 gfs2: Retries missing in gfs2_{rename,exchange} Fix a bug in gfs2's asynchronous glock handling for rename and exchange operations. The original async implementation from commit ad26967b9afa ("gfs2: Use async glocks for rename") mentioned that retries were needed but never implemented them, causing operations to fail with -ESTALE instead of retrying on timeout. Also makes the waiting interruptible. In addition, the timeouts used were too high for situations in which timing out is a rare but expected scenario. Switch to shorter timeouts with randomization and exponentional backoff. Fixes: ad26967b9afa ("gfs2: Use async glocks for rename") Signed-off-by: Andreas Gruenbacher commit f8f04248c7e9f5d77a93857e3a5d28c0833056dc Author: Andreas Gruenbacher Date: Fri Dec 12 16:02:05 2025 +0000 gfs2: glock cancelation flag fix When an asynchronous glock holder is dequeued that hasn't been granted yet (HIF_HOLDER not set) and no dlm operation is in progress on behalf of that holder (GLF_LOCK not set), the dequeuing takes place in __gfs2_glock_dq(). There, we are not clearing the HIF_WAIT flag and waking up waiters. Fix that. This bug prevents the same holder from being enqueued later (gfs2_glock_nq()) without first reinitializing it (gfs2_holder_reinit()). The code doesn't currently use this pattern, but this will change in the next commit. Signed-off-by: Andreas Gruenbacher commit 559ac491542c00e2389f8cfc49661527b3b0d8a0 Merge: eb3dad518e4da4 ed1ac3c977dd6b Author: Danilo Krummrich Date: Mon Jan 26 14:12:02 2026 +0100 Merge tag 'driver-core-6.19-rc7-deferred' into driver-core-next Driver core fixes deferred from 6.19-rc7 [1, 2] were originally intended for -rc7. Patch [1] uncovered potential deadlocks that require a few driver fixes; [2] is one such fix. [1] https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com [2] https://patch.msgid.link/20260121141215.29658-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0 Author: Yi Liu Date: Thu Jan 22 22:29:00 2026 +0800 RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr). Fixes: c3bea3d2dc53 ("RDMA/uverbs: Use the iterator for ib_uverbs_unmarshall_recv()") Signed-off-by: Yi Liu Link: https://patch.msgid.link/20260122142900.2356276-2-liuy22@mails.tsinghua.edu.cn Signed-off-by: Leon Romanovsky commit 5f64ae1ef639a2bab7e39497c55f76cc0682f108 Author: Niklas Cassel Date: Tue Jan 20 11:32:38 2026 +0100 ata: libata-core: Quirk INTEL SSDSC2KG480G8 max_sectors Commit 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") increased the default max_sectors_kb from 1280 KiB to 4096 KiB. INTEL SSDSC2KG480G8 with FW rev XCV10120 times out when sending I/Os of size 4096 KiB. Enable ATA_QUIRK_MAX_SEC, with value 8191 (sectors) for this device, since any I/O with more sectors than that lead to I/O timeouts. With this, the INTEL SSDSC2KG480G8 is usable again. Link: https://lore.kernel.org/linux-ide/176839089913.2398366.61500945766820256@eldamar.lan/ Fixes: 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") Signed-off-by: Niklas Cassel Reviewed-by: Martin K. Petersen Signed-off-by: Damien Le Moal commit eb3dad518e4da48ab6c6df16aa8895b8b0bd6ecf Merge: 1cab0874875a1c 63804fed149a67 Author: Danilo Krummrich Date: Mon Jan 26 13:23:52 2026 +0100 Merge tag 'v6.19-rc7' into driver-core-next We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich commit 19b08fd23b20593ebe43708308dbddb02507877d Author: Shengjiu Wang Date: Fri Jan 23 16:25:01 2026 +0800 ASoC: fsl_sai: Add AUDMIX mode support on i.MX952 One of SAI interfaces is connected to AUDMIX in the i.MX952 chip, but AUDMIX can be bypassed or not bypassed on the i.MX952 platform. There are three use cases: 1) SAI -> Codec (No AUDMIX between SAI and Codec) 2) SAI -> Codec (Has AUDMIX, but AUDMIX is bypassed) 3) SAI -> AUDMIX -> Codec (Has AUDMIX and used) So add 'fsl,sai-amix-mode' property for this feature fsl,sai-amix-mode = "none": is for case 1) fsl,sai-amix-mode = "bypass": is for case 2) fsl,sai-amix-mode = "audmix": is for case 3) Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260123082501.4050296-5-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 291f2f908823832e932582500816ad614631d568 Author: Shengjiu Wang Date: Fri Jan 23 16:25:00 2026 +0800 ASoC: fsl_audmix: Add support for i.MX952 platform Add compatible string to support AUDMIX on i.MX952 Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260123082501.4050296-4-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 4d3b56b8a3504dab98d5f9a91ed9091431749863 Author: Shengjiu Wang Date: Fri Jan 23 16:24:59 2026 +0800 ASoC: dt-bindings: fsl,sai: Add AUDMIX mode support on i.MX952 The SAI can connect to AUDMIX, but AUDMIX can be bypassed or not on i.MX952. There are three use cases: 1) SAI -> Codec (No AUDMIX between SAI and Codec) 2) SAI -> Codec (Has AUDMIX, but AUDMIX is bypassed) 3) SAI -> AUDMIX -> Codec (Has AUDMIX and used) So add 'fsl,sai-amix-mode' property for this feature fsl,sai-amix-mode = "none": is for case 1) fsl,sai-amix-mode = "bypass": is for case 2) fsl,sai-amix-mode = "audmix": is for case 3) Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20260123082501.4050296-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 7550d6263b9b2015a806f66bf7ad356b6f25d050 Author: Shengjiu Wang Date: Fri Jan 23 16:24:58 2026 +0800 ASoC: dt-bindings: fsl,audmix: Add support for i.MX952 platform Add a compatible string for i.MX952 platform. There is a power domain on i.MX952 for the mix system of AUDMIX. But it is enabled by default, AUDMIX device don't need to enable it, so make the power-domains to be optional on i.MX952, and be required on i.MX8QM. Signed-off-by: Shengjiu Wang Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260123082501.4050296-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit af6d53db28e6448b1e0ce9aa314bc5da494d35ab Author: Kuninori Morimoto Date: Tue Jan 20 00:15:08 2026 +0000 ASoC: soc-dapm: tidyup function naming Current soc-dapm is using random naming. Unified as dapm_xxx() for static functions. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ecnlqgvn.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5b517f1a5cace3cba9a48491706e330848ecef86 Author: Kuninori Morimoto Date: Tue Jan 20 00:15:01 2026 +0000 ASoC: soc-dapm: move struct snd_soc_dapm_context All drivers are now using new dapm functions. Move struct snd_soc_dapm_context to soc-dapm.c Suggested-by: Cezary Rojewski Link: https://lore.kernel.org/r/87o6x69h4y.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87fr81qgvu.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 13c84b4c6f218c196c9c72286645247996800427 Author: Kuninori Morimoto Date: Tue Jan 20 00:14:54 2026 +0000 ASoC: soc-dapm: add snd_soc_dapm_alloc() Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Current card/component are using dapm_context instance. But it will be moved to soc-dapm.c, and we can use will be only pointer. Makes it to pointer. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87h5shqgw1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cf0e8c555b34b0ea3d2a41edf6dc214239a71c80 Author: Kuninori Morimoto Date: Tue Jan 20 00:14:46 2026 +0000 ASoC: soc-dapm: remove dev from snd_soc_dapm_context() We can get dev via snd_soc_dapm_to_dev(). Remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ikcxqgw9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 40ff409eacac686bda70ce7720d8b0e7c7401635 Author: Kuninori Morimoto Date: Tue Jan 20 00:14:36 2026 +0000 ASoC: soc-dapm: remove compatibility definition for dapm All drivers uses new functions. Remove comaptibility definition. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87jyxdqgwk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d8b795f65217dd033daac5147eba6acb73a9a489 Author: Kuninori Morimoto Date: Tue Jan 20 00:14:27 2026 +0000 ASoC: soc-component: remove compatibility definition for component All drivers uses new functions. Remove comaptibility definition. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ldhtqgws.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 19a412b66df7cddbc1fa87e049c56bacf00adb27 Author: Kuninori Morimoto Date: Tue Jan 20 00:14:18 2026 +0000 ASoC: soc-component: remove snd_soc_component_xxx() wrapper Now no one is using snd_soc_component_xxx() wrapper for dapm. Remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ms29qgx2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 34a74d04cd0d8dd552ba2118bf197f09e51e2336 Author: Kuninori Morimoto Date: Tue Jan 20 00:14:07 2026 +0000 ASoC: tlv320adcx140: don't use snd_soc_component_get_bias_level() snd_soc_component_get_bias_level() will be removed. Let's use snd_soc_dapm_get_bias_level() instead. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87o6mpqgxc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cb39cf99d88e8f2c68a41fb3bb01c4f40a8fcc30 Author: Thorsten Blum Date: Sat Jan 17 21:21:50 2026 +0100 m68k: sun3: Replace vsprintf() with bounded vsnprintf() vsprintf() performs no bounds checking and can overflow - replace it with the safer vsnprintf(). Also remove the useless '+ 1' that is a leftover of commit 66ed28ea096c ("m68k: sun3: Remove unused vsprintf() return value in prom_printf()"). Signed-off-by: Thorsten Blum Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260117202152.1036278-2-thorsten.blum@linux.dev Signed-off-by: Geert Uytterhoeven commit f16a9577b7d3643456c68621325eb594142a3506 Author: Finn Thain Date: Sat Dec 13 18:21:09 2025 +1100 nubus: Call put_device() in bus initialization error path The error path for bus initialization is missing a call to put_device(). Add that call. This error path will probably never actually execute, but any kernel source code may be subject to static checking or re-use. Cc: Haoxiang Li Cc: Daniel Palmer Suggested-by: Haoxiang Li Signed-off-by: Finn Thain Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/478d5f080d74b6688c9e3f9132e3fe251e997ad7.1765610469.git.fthain@linux-m68k.org Signed-off-by: Geert Uytterhoeven commit a8a6d9b4da001a84dd715d92f034d2bf777199c8 Merge: dbd91d4f55ac49 eebe8dbd8630f5 Author: Greg Kroah-Hartman Date: Mon Jan 26 12:11:11 2026 +0100 Merge tag 'coresight-next-v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next Suzuki writes: coresight: Updates for Linux v6.20/v7.0 This batch of CoreSight hwtracing updates contains : - Fine grained control of Timestamp generation in ETM4 trace, retaining backward compatibility - Feature updates for Qualcomm TPDA driver - Support Qualcomm Interconnect TNOC - Miscellaneous fixes to TMC-ETR driver Signed-off-by: Suzuki K Poulose * tag 'coresight-next-v7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux: (27 commits) coresight: tmc: Decouple the perf buffer allocation from sysfs mode coresight: tmc-etr: Fix race condition between sysfs and perf mode coresight: tmc: Add missing doc including reading and etr_mode of struct tmc_drvdata coresight-tnoc: Add runtime PM support for Interconnect TNOC coresight-tnoc: add platform driver to support Interconnect TNOC dt-bindings: arm: qcom: Add Coresight Interconnect TNOC coresight: etm3x: Fix cpulocked warning on cpuhp coresight: tpda: Fix intendation for sysfs interface documentation coresight: tpda: add sysfs node to flush specific port coresight: tpda: add logic to configure TPDA_SYNCR register coresight: tpda: add global_flush_req sysfs node coresight: tpda: add sysfs nodes for tpda cross-trigger configuration coresight: docs: Document etm4x timestamp interval option coresight: Extend width of timestamp format attribute coresight: Prepare to allow setting the timestamp interval coresight: Remove misleading definitions coresight: Interpret ETMv4 config with ATTR_CFG_GET_FLD() coresight: Interpret perf config with ATTR_CFG_GET_FLD() coresight: Don't reject unrecognized ETMv3 format attributes coresight: Interpret ETMv3 config with ATTR_CFG_GET_FLD() ... commit dbd91d4f55ac4917b0b7f48b02eb8539805d0c85 Merge: ec833566da5781 63804fed149a67 Author: Greg Kroah-Hartman Date: Mon Jan 26 12:04:04 2026 +0100 Merge 6.19-rc7 into char-misc-next We need the char/misc/iio fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit ad3ebcc2d06875738cd463fb5424cda70cd94a34 Author: Jonathan Cavitt Date: Wed Jan 7 16:29:36 2026 +0000 drm/i915/display: Prevent u64 underflow in intel_fbc_stolen_end Static analysis reveals a potential integer underflow in intel_fbc_stolen_end. This can apparently occur if intel_parent_stolen_area_size returns zero (or, theoretically, any value less than 2^23), as 2^23 is subtracted from the return value and stored in a u64. While this doesn't appear to cause any issues due to the use of the min() function to clamp the return values from the intel_fbc_stolen_end function, it would be best practice to avoid undeflowing values like this on principle. So, rework the function to prevent the underflow from occurring. Note that the underflow at present would result in the value of intel_fbc_cfb_base_max being returned at the end of intel_fbc_stolen_end, so just return that if the value of intel_parent_stolen_area_size is too small. While we're here, fix the other comments here and modify the execution path for readability. v2: (Jani) - Fix the comments in intel_fbc_stolen_end - Use check_sub_overflow - Remove macro that mirrors SZ_8M, as it is now only referenced once - Misc. formatting fixes Fixes: a9da512b3ed7 ("drm/i915: avoid the last 8mb of stolen on BDW/SKL") Signed-off-by: Jonathan Cavitt Cc: Paulo Zanoni Cc: Ville Syrjälä Cc: Daniel Vetter Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20260107162935.8123-2-jonathan.cavitt@intel.com Signed-off-by: Matt Roper (cherry picked from commit 6695dc279820a50cb20ecd8b5250e05234dac780) Signed-off-by: Joonas Lahtinen commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 Author: Haoxiang Li Date: Sun Jan 25 22:44:52 2026 +0800 PCI/MSI: Unmap MSI-X region on error msix_capability_init() fails to unmap the MSI-X region if msix_setup_interrupts() fails. Add the missing iounmap() for that error path. [ tglx: Massaged change log ] Signed-off-by: Haoxiang Li Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn commit cefcb9297fbdb6d94b61787b4f8d84f55b741470 Author: Heinz Mauelshagen Date: Wed Jan 14 18:52:21 2026 +0100 md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. This occurs when: - A dm-raid managed device tree is suspended from top to bottom (the top-level RAID device is suspended first, followed by its underlying metadata and data devices) - The top-level RAID device is then removed Removing the top-level device triggers a hang in the following sequence: the dm-raid destructor calls md_stop(), which tries to flush the write-intent bitmap by writing to the metadata sub-devices. However, these devices are already suspended, making them unable to complete the write-intent operations and causing an indefinite block. Fix: - Prevent bitmap flushing when md_stop() is called from dm-raid destructor context and avoid a quiescing/unquescing cycle which could also cause I/O - Still allow write-intent bitmap flushing when called from dm-raid suspend context This ensures that RAID array teardown can complete successfully even when the underlying devices are in a suspended state. This second patch uses md_is_rdwr() to distinguish between suspend and destructor paths as elaborated on above. Link: https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com Signed-off-by: Heinz Mauelshagen Signed-off-by: Yu Kuai commit f150e753cb8dd756085f46e86f2c35ce472e0a3c Author: Jiasheng Jiang Date: Sat Jan 17 14:59:03 2026 +0000 md-cluster: fix NULL pointer dereference in process_metadata_update The function process_metadata_update() blindly dereferences the 'thread' pointer (acquired via rcu_dereference_protected) within the wait_event() macro. While the code comment states "daemon thread must exist", there is a valid race condition window during the MD array startup sequence (md_run): 1. bitmap_load() is called, which invokes md_cluster_ops->join(). 2. join() starts the "cluster_recv" thread (recv_daemon). 3. At this point, recv_daemon is active and processing messages. 4. However, mddev->thread (the main MD thread) is not initialized until later in md_run(). If a METADATA_UPDATED message is received from a remote node during this specific window, process_metadata_update() will be called while mddev->thread is still NULL, leading to a kernel panic. To fix this, we must validate the 'thread' pointer. If it is NULL, we release the held lock (no_new_dev_lockres) and return early, safely ignoring the update request as the array is not yet fully ready to process it. Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com Signed-off-by: Jiasheng Jiang Signed-off-by: Yu Kuai commit 46ef85f854dfa9d5226b3c1c46493d79556c9589 Author: Jack Wang Date: Tue Jan 20 11:24:56 2026 +0100 md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-free race between bitmap_daemon_work() and __bitmap_resize(). The daemon iterates over `bitmap->storage.filemap` without locking, while the resize path frees that storage via md_bitmap_file_unmap(). `quiesce()` does not stop the md thread, allowing concurrent access to freed pages. Fix by holding `mddev->bitmap_info.mutex` during the bitmap update. Link: https://lore.kernel.org/linux-raid/20260120102456.25169-1-jinpu.wang@ionos.com Closes: https://lore.kernel.org/linux-raid/CAMGffE=Mbfp=7xD_hYxXk1PAaCZNSEAVeQGKGy7YF9f2S4=NEA@mail.gmail.com/T/#u Cc: stable@vger.kernel.org Fixes: d60b479d177a ("md/bitmap: add bitmap_resize function to allow bitmap resizing.") Signed-off-by: Jack Wang Signed-off-by: Yu Kuai commit d119bd2e1643cc023210ff3c6f0657e4f914e71d Author: Yu Kuai Date: Sat Jan 24 02:26:23 2026 +0800 md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout When llbitmap_suspend_timeout() times out waiting for percpu_ref to become zero, it returns -ETIMEDOUT without resurrecting the percpu_ref. The caller (md_llbitmap_daemon_fn) then continues to the next page without calling llbitmap_resume(), leaving the percpu_ref in a killed state permanently. Fix this by resurrecting the percpu_ref before returning the error, ensuring the page control structure remains usable for subsequent operations. Link: https://lore.kernel.org/linux-raid/20260123182623.3718551-3-yukuai@fnnas.com Fixes: 5ab829f1971d ("md/md-llbitmap: introduce new lockless bitmap") Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit cd1635d844d26471c56c0a432abdee12fc9ad735 Author: Yu Kuai Date: Sat Jan 24 02:26:22 2026 +0800 md/raid5: fix IO hang with degraded array with llbitmap When llbitmap bit state is still unwritten, any new write should force rcw, as bitmap_ops->blocks_synced() is checked in handle_stripe_dirtying(). However, later the same check is missing in need_this_block(), causing stripe to deadloop during handling because handle_stripe() will decide to go to handle_stripe_fill(), meanwhile need_this_block() always return 0 and nothing is handled. Link: https://lore.kernel.org/linux-raid/20260123182623.3718551-2-yukuai@fnnas.com Fixes: 5ab829f1971d ("md/md-llbitmap: introduce new lockless bitmap") Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit 5d1dd57929be2158fb5a8bc74817cc08b10b0118 Author: Li Nan Date: Mon Jan 5 19:03:00 2026 +0800 md: remove recovery_disabled 'recovery_disabled' logic is complex and confusing, originally intended to preserve raid in extreme scenarios. It was used in following cases: - When sync fails and setting badblocks also fails, kick out non-In_sync rdev and block spare rdev from joining to preserve raid [1] - When last backup is unavailable, prevent repeated add-remove of spares triggering recovery [2] The original issues are now resolved: - Error handlers in all raid types prevent last rdev from being kicked out - Disks with failed recovery are marked Faulty and can't re-join Therefore, remove 'recovery_disabled' as it's no longer needed. [1] 5389042ffa36 ("md: change managed of recovery_disabled.") [2] 4044ba58dd15 ("md: don't retry recovery of raid1 that fails due to error on source drive.") Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-13-linan666@huaweicloud.com Signed-off-by: Li Nan Signed-off-by: Yu Kuai commit 7435b73f05fbb40c07b087fefd3d40bfd759519c Author: Li Nan Date: Mon Jan 5 19:02:59 2026 +0800 md/raid10: cleanup skip handling in raid10_sync_request Skip a sector in raid10_sync_request() when it needs no syncing or no readable device exists. Current skip handling is unnecessary: - Use 'skip' label to reissue the next sector instead of return directly - Complete sync and return 'max_sectors' when multiple sectors are skipped due to badblocks The first is error-prone. For example, commit bc49694a9e8f ("md: pass in max_sectors for pers->sync_request()") removed redundant max_sector assignments. Since skip modifies max_sectors, `goto skip` leaves max_sectors equal to sector_nr after the jump, which is incorrect. The second causes sync to complete erroneously when no actual sync occurs. For recovery, recording badblocks and continue syncing subsequent sectors is more suitable. For resync, just skip bad sectors and syncing subsequent sectors. Clean up complex and unnecessary skip code. Return immediately when a sector should be skipped. Reduce code paths and lower regression risk. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-12-linan666@huaweicloud.com Fixes: bc49694a9e8f ("md: pass in max_sectors for pers->sync_request()") Signed-off-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit 99582edb3f62e8ee6c34512021368f53f9b091f2 Author: Li Nan Date: Mon Jan 5 19:02:58 2026 +0800 md/raid10: fix any_working flag handling in raid10_sync_request In raid10_sync_request(), 'any_working' indicates if any IO will be submitted. When there's only one In_sync disk with badblocks, 'any_working' might be set to 1 but no IO is submitted. Fix it by setting 'any_working' after badblock checks. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-11-linan666@huaweicloud.com Fixes: e875ecea266a ("md/raid10 record bad blocks as needed during recovery.") Signed-off-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit 8ff59a72478d6e9f9668e153dbdbdfad7928b123 Author: Li Nan Date: Mon Jan 5 19:02:57 2026 +0800 md: move finish_reshape to md_finish_sync() finish_reshape implementations of raid10 and raid5 only update mddev and rdev configurations. Move these operations to md_finish_sync() as it is more appropriate. No functional changes. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-10-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit 6dd3aa08e83beeadf19f9d0f4110e5cd802a65d4 Author: Li Nan Date: Mon Jan 5 19:02:56 2026 +0800 md: factor out sync completion update into helper Repeatedly reading 'mddev->recovery' flags in md_do_sync() may introduce potential risk if this flag is modified during sync, leading to incorrect offset updates. Therefore, replace direct 'mddev->recovery' checks with 'action'. Move sync completion update logic into helper md_finish_sync(), which improves readability and maintainability. The reshape completion update remains safe as it only updated after successful reshape when MD_RECOVERY_INTR is not set and 'curr_resync' equals 'max_sectors'. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-9-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit af9c40ff5aed8149572ae920f520df88356b7950 Author: Li Nan Date: Mon Jan 5 19:02:55 2026 +0800 md: remove MD_RECOVERY_ERROR handling and simplify resync_offset update Following previous patch "md: update curr_resync_completed even when MD_RECOVERY_INTR is set", 'curr_resync_completed' always equals 'curr_resync' for resync, so MD_RECOVERY_ERROR can be removed. Also, simplify resync_offset update logic. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-8-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit cc0dab317acb871e11cd83225c90888397043fe8 Author: Li Nan Date: Mon Jan 5 19:02:54 2026 +0800 md: update curr_resync_completed even when MD_RECOVERY_INTR is set An error sync IO may be done and sub 'recovery_active' while its error handling work is pending. This work sets 'recovery_disabled' and MD_RECOVERY_INTR, then later removes the bad disk without Faulty flag. If 'curr_resync_completed' is updated before the disk is removed, it could lead to reading from sync-failed regions. With the previous patch, error IO will set badblocks or mark rdev as Faulty, sync-failed regions are no longer readable. After waiting for 'recovery_active' to reach 0 (in the previous line), all sync IO has *completed*, regardless of whether MD_RECOVERY_INTR is set. Thus, the MD_RECOVERY_INTR check can be removed. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-7-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit fd4d44c14ff6a0e815eefd5d87bbba2b2668b18f Author: Li Nan Date: Mon Jan 5 19:02:53 2026 +0800 md: mark rdev Faulty when badblocks setting fails Currently when sync read fails and badblocks set fails (exceeding 512 limit), rdev isn't immediately marked Faulty. Instead 'recovery_disabled' is set and non-In_sync rdevs are removed later. This preserves array availability if bad regions aren't read, but bad sectors might be read by users before rdev removal. This occurs due to incorrect resync/recovery_offset updates that include these bad sectors. When badblocks exceed 512, keeping the disk provides little benefit while adding complexity. Prompt disk replacement is more important. Therefore when badblocks set fails, directly call md_error to mark rdev Faulty immediately, preventing potential data access issues. After this change, cleanup of offset update logic and 'recovery_disabled' handling will follow. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-6-linan666@huaweicloud.com Fixes: 5e5702898e93 ("md/raid10: Handle read errors during recovery better.") Fixes: 3a9f28a5117e ("md/raid1: improve handling of read failure during recovery.") Signed-off-by: Li Nan Signed-off-by: Yu Kuai commit aa9d12cfa1a514de427c2641911755c11350ee09 Author: Li Nan Date: Mon Jan 5 19:02:52 2026 +0800 md: break remaining operations on badblocks set failure in narrow_write_error Mark device faulty and exit at once when setting badblocks fails in narrow_write_error(). No need to continue processing remaining sections. With this change, narrow_write_error() no longer needs to return a value, so adjust its return type to void. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-5-linan666@huaweicloud.com Signed-off-by: Li Nan Signed-off-by: Yu Kuai commit 4870b0f59c1ad3aae05734a833fe7c3ae90bec09 Author: Li Nan Date: Mon Jan 5 19:02:51 2026 +0800 md/raid1,raid10: support narrow_write_error when badblocks is disabled When badblocks.shift < 0 (badblocks disabled), narrow_write_error() return false, preventing write error handling. Since narrow_write_error() only splits IO into smaller sizes and re-submits, it can work with badblocks disabled. Adjust to use the logical block size for block_sectors when badblocks is disabled, allowing narrow_write_error() to function in this case. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-4-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit 2a5d4549a28da76fa426aaeab0a8561bfc6194c3 Author: Li Nan Date: Mon Jan 5 19:02:50 2026 +0800 md: factor error handling out of md_done_sync into helper The 'ok' parameter in md_done_sync() is redundant for most callers that always pass 'true'. Factor error handling logic into a separate helper function md_sync_error() to eliminate unnecessary parameter passing and improve code clarity. No functional changes introduced. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-3-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit 090856dd8599edfc7699d1ad9bf8069b9745b313 Author: Li Nan Date: Mon Jan 5 19:02:49 2026 +0800 md/raid1: simplify uptodate handling in end_sync_write In end_sync_write, r1bio state is always set to either R1BIO_WriteError or R1BIO_MadeGood. Consequently, put_sync_write_buf() never takes the 'else' branch that calls md_done_sync(), making the uptodate parameter have no practical effect. Pass 1 to put_sync_write_buf(). A more complete cleanup will be done in a follow-up patch. Link: https://lore.kernel.org/linux-raid/20260105110300.1442509-2-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit 4ffe28ed0d7ce7f2f72372cb13152ad37a43ff21 Author: Yu Kuai Date: Thu Jan 15 01:12:34 2026 +0800 md/raid5: make sure max_sectors is not less than io_opt Otherwise, even if user issue IO by io_opt, such IO will be split by max_sectors before they are submitted to raid5. For consequence, full stripe IO is impossible. BTW, dm-raid5 is not affected and still have such problem. Link: https://lore.kernel.org/linux-raid/20260114171241.3043364-7-yukuai@fnnas.com Signed-off-by: Yu Kuai commit 9340a95d489ab5ff3c2d18c78283211b03a4265a Author: Yu Kuai Date: Thu Jan 15 01:12:33 2026 +0800 md/raid5: use mempool to allocate stripe_request_ctx On the one hand, stripe_request_ctx is 72 bytes, and it's a bit huge for a stack variable. On the other hand, the bitmap sectors_to_do is a fixed size, result in max_hw_sector_kb of raid5 array is at most 256 * 4k = 1Mb, and this will make full stripe IO impossible for the array that chunk_size * data_disks is bigger. Allocate ctx during runtime will make it possible to get rid of this limit. Link: https://lore.kernel.org/linux-raid/20260114171241.3043364-6-yukuai@fnnas.com Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit 10787568cc1f3f80afc510b2728751989dfa0ae6 Author: Yu Kuai Date: Thu Jan 15 01:12:32 2026 +0800 md: merge mddev serialize_policy into mddev_flags There is not need to use a separate field in struct mddev, there are no functional changes. Link: https://lore.kernel.org/linux-raid/20260114171241.3043364-5-yukuai@fnnas.com Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit 4f6d2e648cbe963b328cb8815290676da3866434 Author: Yu Kuai Date: Thu Jan 15 01:12:31 2026 +0800 md: merge mddev faillast_dev into mddev_flags There is not need to use a separate field in struct mddev, there are no functional changes. Link: https://lore.kernel.org/linux-raid/20260114171241.3043364-4-yukuai@fnnas.com Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit fba4a980403d2f489bc680dbff7d7d2514e669f9 Author: Yu Kuai Date: Thu Jan 15 01:12:30 2026 +0800 md: merge mddev has_superblock into mddev_flags There is not need to use a separate field in struct mddev, there are no functional changes. Link: https://lore.kernel.org/linux-raid/20260114171241.3043364-3-yukuai@fnnas.com Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit 2d9f7150ac197ce79c9c917a004d4cf0b26ad7e0 Author: Yu Kuai Date: Thu Jan 15 01:12:29 2026 +0800 md/raid5: fix raid5_run() to return error when log_init() fails Since commit f63f17350e53 ("md/raid5: use the atomic queue limit update APIs"), the abort path in raid5_run() returns 'ret' instead of -EIO. However, if log_init() fails, 'ret' is still 0 from the previous successful call, causing raid5_run() to return success despite the failure. Fix this by capturing the return value from log_init(). Link: https://lore.kernel.org/linux-raid/20260114171241.3043364-2-yukuai@fnnas.com Fixes: f63f17350e53 ("md/raid5: use the atomic queue limit update APIs") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601130531.LGfcZsa4-lkp@intel.com/ Signed-off-by: Yu Kuai Reviewed-by: Li Nan Reviewed-by: Xiao Ni Reviewed-by: Christoph Hellwig commit 540de7ade1e1327119e367ec5f662a627b3fe9f9 Author: Deepak Gupta Date: Sun Jan 25 21:09:54 2026 -0700 riscv/mm: update write protect to work on shadow stacks 'fork' implements copy-on-write (COW) by making pages readonly in both child and parent. ptep_set_wrprotect() and pte_wrprotect() clear _PAGE_WRITE in PTE. The assumption is that the page is readable and, on a fault, copy-on-write happens. To implement COW on shadow stack pages, clearing the W bit makes them XWR = 000. This will result in the wrong PTE setting, which allows no permissions, but with V=1 and the PFN field pointing to the final page. Instead, the desired behavior is to turn it into a readable page, take an access (load/store) fault on sspush/sspop (shadow stack) and then perform COW on such pages. This way regular reads would still be allowed and not lead to COW maintaining current behavior of COW on non-shadow stack but writeable memory. On the other hand, this doesn't interfere with existing COW for read-write memory. The assumption is always that _PAGE_READ must have been set, and thus, setting _PAGE_READ is harmless. Reviewed-by: Alexandre Ghiti Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-9-b55691eacf4f@rivosinc.com [pjw@kernel.org: clarify patch description] Signed-off-by: Paul Walmsley commit c68c2ef9d64169317a6e0e6f0506953637760409 Author: Deepak Gupta Date: Sun Jan 25 21:09:53 2026 -0700 riscv/mm: teach pte_mkwrite to manufacture shadow stack PTEs pte_mkwrite() creates PTEs with WRITE encodings for the underlying architecture. The underlying architecture can have two types of writeable mappings: one that can be written using regular store instructions, and another one that can only be written using specialized store instructions (like shadow stack stores). pte_mkwrite can select write PTE encoding based on VMA range (i.e. VM_SHADOW_STACK) Reviewed-by: Alexandre Ghiti Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-8-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description] Signed-off-by: Paul Walmsley commit f56ffb8ada46aae61580905d93c31e4006572240 Author: Deepak Gupta Date: Sun Jan 25 21:09:53 2026 -0700 riscv/mm: manufacture shadow stack ptes This patch implements the creation of a shadow stack pte on riscv. Creating shadow stack PTE on riscv means clearing RWX and then setting W=1. Reviewed-by: Alexandre Ghiti Reviewed-by: Zong Li Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-7-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description] Signed-off-by: Paul Walmsley commit 6c7559f22b6fcb2d4b52c445434c71ade36b004c Author: Deepak Gupta Date: Sun Jan 25 21:09:53 2026 -0700 riscv/mm: ensure PROT_WRITE leads to VM_READ | VM_WRITE 'arch_calc_vm_prot_bits' is implemented on risc-v to return VM_READ | VM_WRITE if PROT_WRITE is specified. Similarly 'riscv_sys_mmap' is updated to convert all incoming PROT_WRITE to (PROT_WRITE | PROT_READ). This is to make sure that any existing apps using PROT_WRITE still work. Earlier 'protection_map[VM_WRITE]' used to pick read-write PTE encodings. Now 'protection_map[VM_WRITE]' will always pick PAGE_SHADOWSTACK PTE encodings for shadow stack. The above changes ensure that existing apps continue to work because underneath, the kernel will be picking 'protection_map[VM_WRITE|VM_READ]' PTE encodings. Reviewed-by: Zong Li Reviewed-by: Alexandre Ghiti Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-6-b55691eacf4f@rivosinc.com Signed-off-by: Paul Walmsley commit 79dd4f2f40d0414aab670c46b801b11850306448 Author: Deepak Gupta Date: Sun Jan 25 21:09:53 2026 -0700 riscv: Add usercfi state for task and save/restore of CSR_SSP on trap entry/exit Carve out space in the RISC-V architecture-specific thread struct for cfi status and shadow stack in usermode. This patch: - defines a new structure cfi_status with status bit for cfi feature - defines shadow stack pointer, base and size in cfi_status structure - defines offsets to new member fields in thread in asm-offsets.c - saves and restores shadow stack pointer on trap entry (U --> S) and exit (S --> U) Shadow stack save/restore is gated on feature availability and is implemented using alternatives. CSR_SSP can be context-switched in 'switch_to' as well, but as soon as kernel shadow stack support gets rolled in, the shadow stack pointer will need to be switched at trap entry/exit point (much like 'sp'). It can be argued that a kernel using a shadow stack deployment scenario may not be as prevalent as user mode using this feature. But even if there is some minimal deployment of kernel shadow stack, that means that it needs to be supported. Thus save/restore of shadow stack pointer is implemented in entry.S instead of in 'switch_to.h'. Reviewed-by: Charlie Jenkins Reviewed-by: Zong Li Reviewed-by: Alexandre Ghiti Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-5-b55691eacf4f@rivosinc.com [pjw@kernel.org: cleaned up patch description] Signed-off-by: Paul Walmsley commit 41a2452c99f327f2b57811e63f6d2497a4a96a9f Author: Deepak Gupta Date: Sun Jan 25 21:09:53 2026 -0700 riscv: add Zicfiss / Zicfilp extension CSR and bit definitions The Zicfiss and Zicfilp extensions are enabled via b3 and b2 in *envcfg CSRs. menvcfg controls enabling for S/HS mode. henvcfg controls enabling for VS. senvcfg controls enabling for U/VU mode. The Zicfilp extension extends *status CSRs to hold an 'expected landing pad' bit. A trap or interrupt can occur between an indirect jmp/call and target instruction. The 'expected landing pad' bit from the CPU is recorded into the xstatus CSR so that when the supervisor performs xret, the 'expected landing pad' state of the CPU can be restored. Zicfiss adds one new CSR, CSR_SSP, which contains the current shadow stack pointer. Signed-off-by: Deepak Gupta Reviewed-by: Charlie Jenkins Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-4-b55691eacf4f@rivosinc.com [pjw@kernel.org: grouped CSR_SSP macro with the other CSR macros; clarified patch description] Signed-off-by: Paul Walmsley commit df11708566d7458d1ce11eb28a59ef6a42ee5236 Author: Deepak Gupta Date: Sun Jan 25 21:09:53 2026 -0700 riscv: zicfiss / zicfilp enumeration This patch adds support for detecting the RISC-V ISA extensions Zicfiss and Zicfilp. Zicfiss and Zicfilp stand for the unprivileged integer spec extensions for shadow stack and indirect branch tracking, respectively. This patch looks for Zicfiss and Zicfilp in the device tree and accordingly lights up the corresponding bits in the cpu feature bitmap. Furthermore this patch adds detection utility functions to return whether shadow stack or landing pads are supported by the cpu. Reviewed-by: Zong Li Reviewed-by: Alexandre Ghiti Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-3-b55691eacf4f@rivosinc.com [pjw@kernel.org: updated to apply; cleaned up patch description] Signed-off-by: Paul Walmsley commit f94645fc03b864cf0823548c87a455346e87c22c Author: Deepak Gupta Date: Sun Jan 25 21:09:53 2026 -0700 dt-bindings: riscv: document zicfilp and zicfiss in extensions.yaml Make an entry for cfi extensions in extensions.yaml. Signed-off-by: Deepak Gupta Acked-by: Rob Herring (Arm) Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-2-b55691eacf4f@rivosinc.com [pjw@kernel.org: updated subject] Signed-off-by: Paul Walmsley commit 98036587a475f371005e42d3fff9feb9cf713880 Author: Deepak Gupta Date: Sun Jan 25 21:09:52 2026 -0700 mm: add VM_SHADOW_STACK definition for riscv VM_HIGH_ARCH_5 is used for riscv. Reviewed-by: Zong Li Reviewed-by: Alexandre Ghiti Acked-by: David Hildenbrand Signed-off-by: Deepak Gupta Tested-by: Andreas Korb # QEMU, custom CVA6 Tested-by: Valentin Haudiquet Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-1-b55691eacf4f@rivosinc.com [pjw@kernel.org: clarify subject; update to apply] Signed-off-by: Paul Walmsley commit 3127718ad9552c9ca90e6eab37cd504c6806bfe4 Author: Markus Elfring Date: Sun Jan 25 21:09:52 2026 -0700 iommu/riscv: Simplify maximum determination in riscv_iommu_init_check() Reduce nested max() calls by a single max3() call in this function implementation. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Link: https://patch.msgid.link/d1a384c9-f154-4537-94d6-c3613f4167bc@web.de Signed-off-by: Paul Walmsley commit 5bfb287891d455a6ac9209d58873092044b0871c Author: Javier Carrasco Date: Sun Jan 25 21:09:52 2026 -0700 riscv: defconfig: enable NLS_ISO8859_1 NLS_ISO8859_1 was enabled as a module with commit efe1e08bca9a ("riscv: defconfig: enable NLS_CODEPAGE_437, NLS_ISO8859_1"), but the NLS_CODEPAGE_437 counterpart is selected as built-in. The commit does not explain the reason behind, and it is not consistent with the defconfig for ARM64 that also enables these modules to mount EFI system partitions. Select NLS_ISO8859_1 as built-in to provide both requirements within the kernel image. Signed-off-by: Javier Carrasco Link: https://patch.msgid.link/20260111-nls_iso8859_1_y_riscv-v1-1-2c992bb2c00d@gmail.com Signed-off-by: Paul Walmsley commit 9f77b4c5c38c5734c45fe6223d57e48715dbffb8 Author: Florian Schmaus Date: Sun Jan 25 21:09:52 2026 -0700 riscv: mm: define copy_user_page() as copy_page() Currently, the implementation of copy_user_page() is identical to copy_page(). Align riscv with other architectures (alpha, arc, arm64, hexagon, longarch, m68k, openrisc, s390, um, xtensa) and map copy_user_page() to copy_page() given that their implementation is identical. In addition to following a common pattern, this centralizes the implementation. Any changes to the underlying page copy logic (e.g., for CHERI) will now automatically propagate to copy_user_page(). Signed-off-by: Florian Schmaus Link: https://patch.msgid.link/20260113134025.905627-1-florian.schmaus@codasip.com Signed-off-by: Paul Walmsley commit e741e19d7691c5e6f5c2bbff980d835dccb86054 Author: Alice Ryhl Date: Mon Jan 5 12:42:39 2026 +0000 rust: workqueue: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Acked-by: Tejun Heo Link: https://patch.msgid.link/20260105-define-rust-helper-v2-26-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit 93ad1d734ed55b010fc6a36e7f69037b4c77b776 Author: Alice Ryhl Date: Mon Jan 5 12:42:36 2026 +0000 rust: uaccess: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260105-define-rust-helper-v2-23-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit 4890cd1d331704db824923696f3fef6b0e30e496 Author: Alice Ryhl Date: Mon Jan 5 12:42:32 2026 +0000 rust: slab: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260105-define-rust-helper-v2-19-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit ac585bf970205eca30cb6f17b4db589c0dca2538 Author: Alice Ryhl Date: Mon Jan 5 12:42:28 2026 +0000 rust: rbtree: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260105-define-rust-helper-v2-15-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit fffdb58732a979564b8834b2ce25b6562dbbcbb7 Author: Alice Ryhl Date: Mon Jan 5 12:42:25 2026 +0000 rust: of: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260105-define-rust-helper-v2-12-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit 5092aeaf70266b6a8fcf6c8b59f0531e9f88647e Author: Alice Ryhl Date: Mon Jan 5 12:42:24 2026 +0000 rust: mm: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Acked-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Link: https://patch.msgid.link/20260105-define-rust-helper-v2-11-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit fa6cbf1f5acc0ae0cf9f8e5c0ce486b8e36c86cf Author: Alice Ryhl Date: Mon Jan 5 12:42:23 2026 +0000 rust: maple_tree: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Acked-by: Andrew Ballance Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Acked-by: Liam R. Howlett Link: https://patch.msgid.link/20260105-define-rust-helper-v2-10-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit 227d1955bfc3cade00f11580a6cf35a1ee770d8c Author: Alice Ryhl Date: Mon Jan 5 12:42:21 2026 +0000 rust: err: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260105-define-rust-helper-v2-8-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit 7caeac0b382ac3d48606e00d5683efda42204349 Author: Alice Ryhl Date: Mon Jan 5 12:42:16 2026 +0000 rust: bug: add __rust_helper to helpers This is needed to inline these helpers into Rust code. Reviewed-by: Boqun Feng Reviewed-by: Gary Guo Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260105-define-rust-helper-v2-3-51da5f454a67@google.com Signed-off-by: Miguel Ojeda commit 0bfea95c3c02a887c25260e8aaf31cc9567bc478 Author: Alexandre Courbot Date: Mon Dec 15 14:49:10 2025 +0900 gpu: nova-core: gsp: use () as message type for GspInitDone message `GspInitDone` has no payload whatsoever, so the unit type `()` is the correct way to represent its message content. We can use it now that `()` implements `FromBytes`. Reviewed-by: Alistair Popple Signed-off-by: Alexandre Courbot Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20251215-transmute_unit-v4-2-477d71ec7c23@nvidia.com Signed-off-by: Miguel Ojeda commit 209c70953aa3630eb25e93e95464306a41b16d12 Author: Alexandre Courbot Date: Mon Dec 15 14:49:09 2025 +0900 rust: transmute: implement FromBytes and AsBytes for inhabited ZSTs This is useful when using types that may or may not be empty in generic code relying on these traits. It is also safe because technically a no-op. Reviewed-by: Alistair Popple Reviewed-by: Gary Guo Signed-off-by: Alexandre Courbot Reviewed-by: Benno Lossin Link: https://patch.msgid.link/20251215-transmute_unit-v4-1-477d71ec7c23@nvidia.com Signed-off-by: Miguel Ojeda commit 7f87c7a003125d5af5ec7abbbc0ac21b4a4661ae Author: Peter Novak Date: Sun Nov 30 22:12:33 2025 +0100 rust: use consistent backtick formatting for NULL in docs Some doc comments use `NULL` while others use plain NULL. Make it consistent by adding backticks everywhere, matching the majority of existing usage. Signed-off-by: Peter Novak Acked-by: Stephen Boyd Acked-by: David Gow Reviewed-by: Alexandre Courbot Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20251130211233.367946-1-seimun018r@gmail.com [ Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 4b2dbf44320fc2e4bfd6a2261f16f8fdbfcfbf36 Author: Miguel Ojeda Date: Thu Jan 15 22:45:45 2026 +0100 MAINTAINERS: add "RUST [RUST-ANALYZER]" entry This entry will handle the support for `rust-analyzer`, which at the moment is essentially about the `scripts/generate_rust_analyzer.py` script. It is one more subentry of the Rust subsystem. The new branch is already part of linux-next and will be used to send PRs to be merged into rust-next. Tamir and Jesung will take care of it. They have both been active around the `rust-analyzer` support for a while. Acked-by: Tamir Duberstein Acked-by: Jesung Yang Acked-by: Andreas Hindborg Link: https://patch.msgid.link/20260115214545.63262-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit bf2e36c9dab95e41516fbcf7b1cc804539b2d021 Author: Akiyoshi Kurita Date: Sat Jan 24 00:02:11 2026 +0900 dt-bindings: net: dsa: fix typos in bindings docs Fix "alway" -> "always" in lan9303.txt and marvell,mv88e6xxx.yaml. Signed-off-by: Akiyoshi Kurita Reviewed-by: Andrew Lunn Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260123150211.2646235-1-weibu@redadmin.org Signed-off-by: Jakub Kicinski commit 116af5f2d015da415c036b3bc992c04522d0ae80 Merge: 4a7bbaa663f58f 086d030e99d25b Author: Jakub Kicinski Date: Sun Jan 25 15:09:09 2026 -0800 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== refactor IDPF resource access Pavan Kumar Linga says: Queue and vector resources for a given vport, are stored in the idpf_vport structure. At the time of configuration, these resources are accessed using vport pointer. Meaning, all the config path functions are tied to the default queue and vector resources of the vport. There are use cases which can make use of config path functions to configure queue and vector resources that are not tied to any vport. One such use case is PTP secondary mailbox creation (it would be in a followup series). To configure queue and interrupt resources for such cases, we can make use of the existing config infrastructure by passing the necessary queue and vector resources info. To achieve this, group the existing queue and vector resources into default resource group and refactor the code to pass the resource pointer to the config path functions. This series also includes patches which generalizes the send virtchnl message APIs and mailbox API that are necessary for the implementation of PTP secondary mailbox. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: idpf: generalize mailbox API idpf: avoid calling get_rx_ptypes for each vport idpf: generalize send virtchnl message API idpf: remove vport pointer from queue sets idpf: add rss_data field to RSS function parameters idpf: reshuffle idpf_vport struct members to avoid holes idpf: move some iterator declarations inside for loops idpf: move queue resources to idpf_q_vec_rsrc structure idpf: introduce idpf_q_vec_rsrc struct and move vector resources to it idpf: introduce local idpf structure to store virtchnl queue chunks ==================== Link: https://patch.msgid.link/20260122223601.2208759-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 4a7bbaa663f58f63c6e99930ec1ddee418104f92 Author: Ethan Nelson-Moore Date: Fri Jan 23 00:03:58 2026 -0800 net: usb: sr9700: rename register write commands for clarity SR_WR_REG and SR_WR_REGS may be confused at a cursory glance. Rename them to be more easily differentiated to prevent this. Suggested-by: Andrew Lunn Signed-off-by: Ethan Nelson-Moore Reviewed-by: Andrew Lunn Reviewed-by: Peter Korsgaard Link: https://patch.msgid.link/20260123080409.64165-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit c2e99887807eb1b4fea7e5f63bbd6b5512879293 Author: Ethan Nelson-Moore Date: Thu Jan 22 23:06:39 2026 -0800 net: usb: sr9700: use ETH_ALEN instead of magic number The driver hardcodes the number 6 as the number of bytes to write to the SR_PAR register, which stores the MAC address. Use ETH_ALEN instead to make the code clearer. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Andrew Lunn Reviewed-by: Peter Korsgaard Link: https://patch.msgid.link/20260123070645.56434-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 6290f7e71ba792ba796a2d781e8bdda4622f0002 Merge: e4faaf65a75f65 a00266969c8eca Author: Jakub Kicinski Date: Sun Jan 25 14:57:41 2026 -0800 Merge branch 'net-neighbour-notify-changes-atomically' Petr Machata says: ==================== net: neighbour: Notify changes atomically Andy Roulin and Francesco Ruggeri have apparently independently both hit an issue with the current neighbor notification scheme. Francesco reported the issue in [1]. In a response[2] to that report, Andy said: neigh_update sends a rtnl notification if an update, e.g., nud_state change, was done but there is no guarantee of ordering of the rtnl notifications. Consider the following scenario: userspace thread kernel thread ================ ============= neigh_update write_lock_bh(n->lock) n->nud_state = STALE write_unlock_bh(n->lock) neigh_notify neigh_fill_info read_lock_bh(n->lock) ndm->nud_state = STALE read_unlock_bh(n->lock) --------------------------> neigh:update write_lock_bh(n->lock) n->nud_state = REACHABLE write_unlock_bh(n->lock) neigh_notify neigh_fill_info read_lock_bh(n->lock) ndm->nud_state = REACHABLE read_unlock_bh(n->lock) rtnl_nofify RTNL REACHABLE sent <-------- rtnl_notify RTNL STALE sent In this scenario, the kernel neigh is updated first to STALE and then REACHABLE but the netlink notifications are sent out of order, first REACHABLE and then STALE. The solution presented in [2] was to extend the critical region to include both the call to neigh_fill_info(), as well as rtnl_notify(). Then we have a guarantee that whatever state was captured by neigh_fill_info(), will be sent right away. The above scenario can thus not happen. This is how this patchset begins: patches #1 and #2 add helper duals to neigh_fill_info() and __neigh_notify() such that the __-prefixed function assumes the neighbor lock is held, and the unprefixed one is a thin wrapper that manages locking. This extends locking further than Andy's patch, but makes for a clear code and supports the following part. At that point, the original race is gone. But what can happen is the following race, where the notification does not reflect the change that was made: userspace thread kernel thread ================ ============= neigh_update write_lock_bh(n->lock) n->nud_state = STALE write_unlock_bh(n->lock) --------------------------> neigh:update write_lock_bh(n->lock) n->nud_state = REACHABLE write_unlock_bh(n->lock) neigh_notify read_lock_bh(n->lock) __neigh_fill_info ndm->nud_state = REACHABLE rtnl_notify read_unlock_bh(n->lock) RTNL REACHABLE sent <-------- neigh_notify read_lock_bh(n->lock) __neigh_fill_info ndm->nud_state = REACHABLE rtnl_notify read_unlock_bh(n->lock) RTNL REACHABLE sent again Here, even though neigh_update() made a change to STALE, it later sends a notification with a NUD of REACHABLE. The obvious solution to fix this race is to move the notifier to the same critical section that actually makes the change. Sending a notification in fact involves two things: invoking the internal notifier chain, and sending the netlink notification. The overall approach in this patchset is to move the netlink notification to the critical section of the change, while keeping the internal notifier intact. Since the motion is not obviously correct, the patchset presents the change in series of incremental steps with discussion in commit messages. Please see details in the patches themselves. Reproducer ========== To consistently reproduce, I injected an mdelay before the rtnl_notify() call. Since only one thread should delay, a bit of instrumentation was needed to see where the call originates. The mdelay was then only issued on the call stack rooted in the RTNL request. Then the general idea is to issue an "ip neigh replace" to mark a neighbor entry as failed. In parallel to that, inject an ARP burst that validates the entry. This is all observed with an "ip monitor neigh", where one can see either a REACHABLE->FAILED transition, or FAILED->REACHABLE, while the actual state at the end of the sequence is always REACHABLE. With the patchset, only FAILED->REACHABLE is ever observed in the monitor. Alternatives ============ Another approach to solving the issue would be to have a per-neighbor queue of notification digests, each with a set of fields necessary for formatting a notification. In pseudocode, a neighbor update would look something like this: neighbor_update: - lock - do update - allocate notification digest, fill partially, mark not-committed - unlock - critical-section-breaking stuff (probes, ARP Q, etc.) - lock - fill in missing details to the digest (notably neigh->probes) - mark the digest as committed - while (front of the digest queue is committed) - pop it, convert to notifier, send the notification - unlock This adds more complexity and would imply more changes to the code, which is why I think the approach presented in this patchset is better. But it would allow us to retain the overall structure of the code while giving us accurate notifications. A third approach would be to consider the second race not very serious and be OK with seeing a notification that does not reflect the change that prompted it. Then a two-patch prefix of this patchset would be all that is needed. [1]: https://lore.kernel.org/20220606230107.D70B55EC0B30@us226.sjc.aristanetworks.com [2]: https://lore.kernel.org/ed6768c1-80b8-aee2-e545-b51661d49336@nvidia.com ==================== Link: https://patch.msgid.link/cover.1769012464.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit a00266969c8ecaa15d8170490e407131287d7a71 Author: Petr Machata Date: Wed Jan 21 17:43:42 2026 +0100 net: core: neighbour: Make another netlink notification atomically Similarly to the issue from the previous patch, neigh_timer_handler() also updates the neighbor separately from formatting and sending the netlink notification message. We have not seen reports to the effect of this causing trouble, but in theory, the same sort of issues could have come up: neigh_timer_handler() would make changes as necessary, but before formatting and sending a notification, is interrupted before sending by another thread, which makes a parallel change and sends its own message. The message send that is prompted by an earlier change thus contains information that does not reflect the change having been made. To solve this, the netlink notification needs to be in the same critical section that updates the neighbor. The critical section is ended by the neigh_probe() call which drops the lock before calling solicit. Stretching the critical section over the solicit call is problematic, because that can then involved all sorts of forwarding callbacks. Therefore, like in the previous patch, split the netlink notification away from the internal one and move it ahead of the probe call. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/e440118511cbdbe1d88eb0d71c9047116feb96e0.1769012464.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit d0887dc8b2d0b5b52b38b54474a22af7c294265b Author: Petr Machata Date: Wed Jan 21 17:43:41 2026 +0100 net: core: neighbour: Make one netlink notification atomically As noted in a previous patch, one race remains in the current code. A kernel thread might interrupt a userspace thread after the change is done, but before formatting and sending the message. Then what we would see is two messages with the same contents: userspace thread kernel thread ================ ============= neigh_update write_lock_bh(n->lock) n->nud_state = STALE write_unlock_bh(n->lock) --------------------------> neigh:update write_lock_bh(n->lock) n->nud_state = REACHABLE write_unlock_bh(n->lock) neigh_notify read_lock_bh(n->lock) __neigh_fill_info ndm->nud_state = REACHABLE rtnl_notify read_unlock_bh(n->lock) RTNL REACHABLE sent <-------- neigh_notify read_lock_bh(n->lock) __neigh_fill_info ndm->nud_state = REACHABLE rtnl_notify read_unlock_bh(n->lock) RTNL REACHABLE sent again The solution is to send the netlink message inside the critical section where the neighbor is changed, so that it reflects the notified-upon neighbor state. To that end, in __neigh_update(), move the current neigh_notify() call up to said critical section, and convert it to __neigh_notify(), because the lock is held. This motion crosses calls to neigh_update_managed_list(), neigh_update_gc_list() and neigh_update_process_arp_queue(), all of which potentially unlock and give an opportunity for the above race. This also crosses a call to neigh_update_process_arp_queue() which calls neigh->output(), which might be neigh_resolve_output() calls neigh_event_send() calls neigh_event_send_probe() calls __neigh_event_send() calls neigh_probe(), which touches neigh->probes, an update which will now not be visible in the notification. However, there is indication that there is no promise that these changes will be accurately projected to notifications: fib6_table_lookup() indirectly calls route.c's find_match() calls rt6_probe(), which looks up a neighbor and call __neigh_set_probe_once(), which sets neigh->probes to 0, but neither this nor the caller seems to send a notification. Additionally, the neighbor object that the neigh_probe() mentioned above is called on, might be the alternative neighbor looked up for the ARP queue packet destination. If that is the case, the changed value of n1->probes is not notified anywhere. So at least in some circumstances, the reported number of probes needs to be assumed to change without notification. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/ceb44995498eb52375cb2d46c3245bdb9e74b355.1769012464.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 795258891c944f37075ab8d3bc7415f5875e897a Author: Petr Machata Date: Wed Jan 21 17:43:40 2026 +0100 net: core: neighbour: Reorder netlink & internal notification The netlink message needs to be send inside the critical section where the neighbor is changed, so that it reflects the notified-upon neighbor state. On the other hand, there is no such need in case of notifier chain: the listeners do not assume lock, and often in fact just schedule a delayed work to act on the neighbor later. At least one in fact also takes the neighbor lock. This requires that the netlink notification be done before the internal notifier chain message is sent. That is safe to do, because the current listeners, as well as __neigh_notify(), only read the updated neighbor fields, and never modify them. (Apart from locking.) Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/f3ef74d5460f14c4d102b8a5857d4a6624da9a5a.1769012464.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit a228a7e681b885147699cd4eed636a37e2212933 Author: Petr Machata Date: Wed Jan 21 17:43:39 2026 +0100 net: core: neighbour: Inline neigh_update_notify() calls The obvious idea behind the helper is to keep together the two bits that should be done either both or neither: the internal notifier chain message, and the netlink notification. To make sure that the notification sent reflects the change being made, the netlink message needs to be send inside the critical section where the neighbor is changed. But for the notifier chain, there is no such need: the listeners do not assume lock, and often in fact just schedule a delayed work to act on the neighbor later. At least one in fact also takes the neighbor lock. Therefore these two items have each different locking needs. Now we could unlock inside the helper, but I find that error prone, and the fact that the notification is conditional in the first place does not help to make the call site obvious. So in this patch, the helper is instead removed and the body, which is just these two calls, inlined. That way we can use each notifier independently. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/e65dce5882bc6f4aa2530b8a4877d0e003071a1a.1769012464.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 89246ef82d799e68d5e34873e95d4c1ca2486cc5 Author: Petr Machata Date: Wed Jan 21 17:43:38 2026 +0100 net: core: neighbour: Process ARP queue later ARP queue processing unlocks the neighbor lock, which can allow another thread to asynchronously perform a neighbor update and send an out of order notification. Therefore this needs to be done after the notification is sent. Move it just before the end of the critical section. Since neigh_update_process_arp_queue() unlocks, it does not form a part of the critical section anymore but it can benefit from the lock being taken. The intention is to eventually do the RTNL notification before this call. This motion crosses a call to neigh_update_is_router(), which should not influence processing of the ARP queue. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/9ea7159e71430ebdc837ebcc880a76b7e82e52a4.1769012464.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 705ef89ac98648167f486b51bb8d9e2fefbe4fb4 Author: Petr Machata Date: Wed Jan 21 17:43:37 2026 +0100 net: core: neighbour: Extract ARP queue processing to a helper function In order to make manipulation with this bit of code clearer, extract it to a helper function, neigh_update_process_arp_queue(). Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/8b0fa0abe2cf0e24484903f5436fe0ac64163057.1769012464.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 0ecdccb8a4550d8a0d1db4d096b996566b7aab29 Author: Petr Machata Date: Wed Jan 21 17:43:36 2026 +0100 net: core: neighbour: Call __neigh_notify() under a lock Andy Roulin has described an issue with the current neighbor notification scheme as follows. This was also presented publicly at the link below. neigh_update sends a rtnl notification if an update, e.g., nud_state change, was done but there is no guarantee of ordering of the rtnl notifications. Consider the following scenario: userspace thread kernel thread ================ ============= neigh_update write_lock_bh(n->lock) n->nud_state = STALE write_unlock_bh(n->lock) neigh_notify neigh_fill_info read_lock_bh(n->lock) ndm->nud_state = STALE read_unlock_bh(n->lock) --------------------------> neigh:update write_lock_bh(n->lock) n->nud_state = REACHABLE write_unlock_bh(n->lock) neigh_notify neigh_fill_info read_lock_bh(n->lock) ndm->nud_state = REACHABLE read_unlock_bh(n->lock) rtnl_nofify RTNL REACHABLE sent <-------- rtnl_notify RTNL STALE sent In this scenario, the kernel neigh is updated first to STALE and then REACHABLE but the netlink notifications are sent out of order, first REACHABLE and then STALE. The solution is to send the netlink message inside the same critical section that formats the message. That way both the contents and ordering of the message reflect the same state, and we cannot see the abovementioned out-of-order delivery. Even with this patch, a remaining issue that the contents of the message may not reflect the changes made to the neighbor. A kernel thread might still interrupt a userspace thread after the change is done, but before formatting and sending the message. Then what we would see is two messages with the same contents. The following patches will attempt to address that issue. To support those future patches, convert __neigh_notify() to a helper that assumes that the neighbor lock is already taken by having it call __neigh_fill_info() instead of neigh_fill_info(). Add a new helper, neigh_notify(), which takes the lock before calling __neigh_notify(). Migrate all callers to use the latter. Link: https://lore.kernel.org/netdev/ed6768c1-80b8-aee2-e545-b51661d49336@nvidia.com/ Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/4b4368dcc5f5a7e407009cb6c36b69cfb5282864.1769012464.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 77fa50dcb987338e6d5253c49d590da667b12657 Author: Petr Machata Date: Wed Jan 21 17:43:35 2026 +0100 net: core: neighbour: Add a neigh_fill_info() helper for when lock not held The netlink message needs to be formatted and sent inside the critical section where the neighbor is changed, so that it reflects the notified-upon neighbor state. Because it will happen inside an already existing critical section, it has to assume that the neighbor lock is held. Add a helper __neigh_fill_info(), which is like neigh_fill_info(), but makes this assumption. Convert neigh_fill_info() to a wrapper around this new helper. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/7ec20113d5d809200e3534d3ed8f0004514914b8.1769012464.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit e4faaf65a75f650ac4366ddff5dabb826029ca5a Author: Eric Dumazet Date: Thu Jan 22 17:22:47 2026 +0000 ipv4: igmp: annotate data-races around idev->mr_maxdelay idev->mr_maxdelay is read and written locklessly, add READ_ONCE()/WRITE_ONCE() annotations. While we are at it, make this field an u32. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 0541302227817d1abb16b3aa7d968ce574272724 Author: Eric Dumazet Date: Thu Jan 22 16:50:49 2026 +0000 ipvlan: remove ipvlan_ht_addr_lookup() ipvlan_ht_addr_lookup() is called four times and not inlined. Split it to ipvlan_ht_addr_lookup6() and ipvlan_ht_addr_lookup4() and rework ipvlan_addr_lookup() to call these helpers once, so that they are (auto)inlined. After this change, ipvlan_addr_lookup() is faster, and we save 350 bytes of text on x86_64. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 1/0 up/down: 123/-473 (-350) Function old new delta ipvlan_addr_lookup 467 590 +123 __pfx_ipvlan_ht_addr_lookup 16 - -16 ipvlan_ht_addr_lookup 457 - -457 Total: Before=22571833, After=22571483, chg -0.00% Signed-off-by: Eric Dumazet Cc: Mahesh Bandewar Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260122165049.2366985-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1cab0874875a1c37f71edf1e1e3029b1cf31d81e Author: Atharv Dubey Date: Sat Nov 29 18:17:06 2025 +0530 rust: auxiliary: use `pin_init::zeroed()` for device ID Replace the previous `unsafe { core::mem::zeroed() }` initialization for `bindings::auxillary_device_id` with `pin_init::zeroed()`. This removes the explicit unsafe block and uses the safer pinned zero-initialization helper. Suggested-by: Benno Lossin Signed-off-by: Atharv Dubey Link: https://github.com/Rust-for-Linux/linux/issues/1189 Link: https://patch.msgid.link/20251129124706.26263-1-atharvd440@gmail.com Signed-off-by: Danilo Krummrich commit 37b0ea8fef56ccc29bd5a07f235ac218f7f98379 Author: Eric Dumazet Date: Thu Jan 22 19:03:49 2026 +0000 net: expand NETDEV_RSS_KEY_LEN to 256 bytes NETDEV_RSS_KEY_LEN has been set to 52 bytes in 2014, until now. Jakub suggested we bump the size to 128 bytes or more. Some drivers (like idpf) were already working around the core limit. Since this change might cause some issues in admin scripts, bump it directly to 256 in one go. tjbp26:~# cat /proc/sys/net/core/netdev_rss_key | wc -c 768 tjbp26:~# ethtool -x eth1 RX flow hash indirection table for eth1 with 32 RX ring(s): ... RSS hash key: fe:16:5b:2f:93:85:c2:c9:c1:ef:bd:60:c6:e0:2b:99:4d:bf:b7:14:c8:1e:8d:cb:31:17:51:da:55:eb:91:d9:9e:f9:89:9b:44:a1:dc:08:72:3a:b3:d6:31:86:9a:fe:02:3a:0d:eb:a1:7c:f5:a3:51:3b:08:56:c9:3f:71:69:01:ba:70:38 RSS hash function: toeplitz: on xor: off crc32: off Suggested-by: Jakub Kicinski Link: https://lore.kernel.org/netdev/20260122075206.504ec591@kernel.org/ Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260122190349.2771064-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a113a8ac5086cff408dc3320fbc0ec06a51f0897 Merge: 3f7522f36b5f1e df7388b3d7be6f Author: Jakub Kicinski Date: Sun Jan 25 13:18:59 2026 -0800 Merge branch 'net-few-critical-helpers-are-inlined-again' Eric Dumazet says: ==================== net: few critical helpers are inlined again Recent devmem additions increased stack depth. Some helpers that were inlined in the past are now out-of-line. ==================== Link: https://patch.msgid.link/20260122045720.1221017-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit df7388b3d7be6ffcb01869e4dbc1cb2cf3e07c64 Author: Eric Dumazet Date: Thu Jan 22 04:57:19 2026 +0000 net: inline get_netmem() and put_netmem() These helpers are used in network fast paths. Only call out-of-line helpers for netmem case. We might consider inlining __get_netmem() and __put_netmem() in the future. $ scripts/bloat-o-meter -t vmlinux.3 vmlinux.4 add/remove: 6/6 grow/shrink: 22/1 up/down: 2614/-646 (1968) Function old new delta pskb_carve 1669 1894 +225 gro_pull_from_frag0 - 206 +206 get_page 190 380 +190 skb_segment 3561 3747 +186 put_page 595 765 +170 skb_copy_ubufs 1683 1822 +139 __pskb_trim_head 276 401 +125 __pskb_copy_fclone 734 858 +124 skb_zerocopy 1092 1215 +123 pskb_expand_head 892 1008 +116 skb_split 828 940 +112 skb_release_data 297 409 +112 ___pskb_trim 829 941 +112 __skb_zcopy_downgrade_managed 120 226 +106 tcp_clone_payload 530 634 +104 esp_ssg_unref 191 294 +103 dev_gro_receive 1464 1514 +50 __put_netmem - 41 +41 __get_netmem - 41 +41 skb_shift 1139 1175 +36 skb_try_coalesce 681 714 +33 __pfx_put_page 112 144 +32 __pfx_get_page 32 64 +32 __pskb_pull_tail 1137 1168 +31 veth_xdp_get 250 267 +17 __pfx_gro_pull_from_frag0 - 16 +16 __pfx___put_netmem - 16 +16 __pfx___get_netmem - 16 +16 __pfx_put_netmem 16 - -16 __pfx_gro_try_pull_from_frag0 16 - -16 __pfx_get_netmem 16 - -16 put_netmem 114 - -114 get_netmem 130 - -130 napi_gro_frags 929 771 -158 gro_try_pull_from_frag0 196 - -196 Total: Before=22565857, After=22567825, chg +0.01% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260122045720.1221017-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 87918dd4eafc0749a99cb763addc1c37fe7ebb6f Author: Eric Dumazet Date: Thu Jan 22 04:57:18 2026 +0000 net: inline net_is_devmem_iov() 1) Inline this small helper to reduce code size and decrease cpu costs. 2) Constify its argument. 3) Move it to include/net/netmem.h, as a prereq for the following patch. $ scripts/bloat-o-meter -t vmlinux.2 vmlinux.3 add/remove: 0/2 grow/shrink: 0/4 up/down: 0/-158 (-158) Function old new delta validate_xmit_skb 866 857 -9 __pfx_net_is_devmem_iov 16 - -16 net_is_devmem_iov 22 - -22 get_netmem 152 130 -22 put_netmem 140 114 -26 tcp_recvmsg_locked 3860 3797 -63 Total: Before=22566015, After=22565857, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260122045720.1221017-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 Author: Eric Dumazet Date: Thu Jan 22 04:57:17 2026 +0000 gro: change the BUG_ON() in gro_pull_from_frag0() Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE() $ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2 add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116) Function old new delta gro_try_pull_from_frag0 - 196 +196 napi_gro_frags 771 929 +158 __pfx_gro_try_pull_from_frag0 - 16 +16 __pfx_gro_pull_from_frag0 16 - -16 dev_gro_receive 1514 1464 -50 gro_pull_from_frag0 188 - -188 Total: Before=22565899, After=22566015, chg +0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit c75734b585c61411fb5a12daedcbf4dbb9e7043d Author: Eric Dumazet Date: Thu Jan 22 04:57:16 2026 +0000 net: always inline skb_frag_unref() and __skb_frag_unref() clang is not inlining skb_frag_unref() and __skb_frag_unref() in gro fast path. It also does not inline gro_try_pull_from_frag0(). Using __always_inline fixes this issue, makes the kernel faster _and_ smaller. Also change __skb_frag_ref(), skb_frag_ref() and skb_page_unref() to let them inlined for the last patch in this series. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1 add/remove: 2/6 grow/shrink: 1/2 up/down: 218/-511 (-293) Function old new delta gro_pull_from_frag0 - 188 +188 __pfx_gro_pull_from_frag0 - 16 +16 skb_shift 1125 1139 +14 __pfx_skb_frag_unref 16 - -16 __pfx_gro_try_pull_from_frag0 16 - -16 __pfx___skb_frag_unref 16 - -16 __skb_frag_unref 36 - -36 skb_frag_unref 59 - -59 dev_gro_receive 1608 1514 -94 napi_gro_frags 892 771 -121 gro_try_pull_from_frag0 153 - -153 Total: Before=22566192, After=22565899, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260122045720.1221017-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3f7522f36b5f1e4e061ee076cfe74a3af7eaa75b Merge: 3085ff59fec593 58d4ca5b69947c Author: Jakub Kicinski Date: Sun Jan 25 13:14:14 2026 -0800 Merge branch 'u64_stats-introduce-u64_stats_copy' David Yang says: ==================== u64_stats: Introduce u64_stats_copy() On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. memcpy() should not be considered atomic against u64 values. Use u64_stats_copy() instead. ==================== Link: https://patch.msgid.link/20260120092137.2161162-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 58d4ca5b69947c9d8ee197095e6c1c3b5c078716 Author: David Yang Date: Tue Jan 20 17:21:32 2026 +0800 vxlan: vnifilter: fix memcpy with u64_stats On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. memcpy() should not be considered atomic against u64 values. Use u64_stats_copy() instead. Signed-off-by: David Yang Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260120092137.2161162-5-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 35710f0db8011e7ebbfb5b929a0575c3a09b761d Author: David Yang Date: Tue Jan 20 17:21:31 2026 +0800 macsec: fix memcpy with u64_stats On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. memcpy() should not be considered atomic against u64 values. Use u64_stats_copy() instead. Signed-off-by: David Yang Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260120092137.2161162-4-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit dd7fca9f49d3e7ab7e48d9c616bff0c84148a7e0 Author: David Yang Date: Tue Jan 20 17:21:30 2026 +0800 net: bridge: mcast: fix memcpy with u64_stats On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. memcpy() should not be considered atomic against u64 values. Use u64_stats_copy() instead. Signed-off-by: David Yang Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260120092137.2161162-3-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit df153517e4d4403d13d603cccef68255783d396b Author: David Yang Date: Tue Jan 20 17:21:29 2026 +0800 u64_stats: Introduce u64_stats_copy() The following (anti-)pattern was observed in the code tree: do { start = u64_stats_fetch_begin(&pstats->syncp); memcpy(&temp, &pstats->stats, sizeof(temp)); } while (u64_stats_fetch_retry(&pstats->syncp, start)); On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing, especially for memcpy(), for which arches may provide their highly-optimized implements. In theory the affected code should convert to u64_stats_t, or use READ_ONCE()/WRITE_ONCE() properly. However since there are needs to copy chunks of statistics, instead of writing loops at random places, we provide a safe memcpy() variant for u64_stats. Signed-off-by: David Yang Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260120092137.2161162-2-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 3085ff59fec593ae1135608edd8afdf0e5889cad Author: Dimitri Daskalakis Date: Thu Jan 22 14:57:23 2026 -0800 Documentation: net: Fix typos in netdevices.rst Fixes two minor typos. Specifically, on -> or and Devices -> Device. Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20260122225723.2368698-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit ae3bf7612220ac8a8020a285142e0d918543a408 Author: Ke Sun Date: Tue Jan 20 16:38:20 2026 +0800 rust: debugfs: use pin_init::zeroed() for file_operations Replace unsafe core::mem::zeroed() with pin_init::zeroed() for file_operations initialization in all debugfs file operation implementations. Suggested-by: Benno Lossin Signed-off-by: Ke Sun Link: https://github.com/Rust-for-Linux/linux/issues/1189 Link: https://patch.msgid.link/20260120083824.477339-5-sunke@kylinos.cn Signed-off-by: Danilo Krummrich commit 8e5bcc3a955a2cc4460b391f55d3b49905eb248e Author: Alexander Atanasov Date: Sun Jan 25 08:57:46 2026 +0000 selftests: ublk: add missing gitignore for metadata_size binary A new utility metadata_size was added in commit 261b67f4e347 ("selftests: ublk: add utility to get block device metadata size") but it was not added to .gitignore. Fix that by adding it there. While at it sort all entries alphabetically and add a SPDX license header. Reviewed-by: Caleb Sander Mateos Fixes: 261b67f4e347 ("selftests: ublk: add utility to get block device metadata size") Signed-off-by: Alexander Atanasov Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit e26f51f6f68749fb5ee6b3b8f7a5a91bf2633e39 Author: Jens Axboe Date: Sun Jan 25 10:07:35 2026 -0700 io_uring/rsrc: use GFP_KERNEL_ACCOUNT consistently For potential long term allocations, ensure that we play nicer with memcg and use the accounting variant of the GFP_KERNEL allocation. Signed-off-by: Jens Axboe commit 6e0d71c288fdcf5866f5d0c6cde850a091cc3c55 Author: Jens Axboe Date: Sun Jan 25 10:07:09 2026 -0700 io_uring/futex: use GFP_KERNEL_ACCOUNT for futex data allocation Be a bit nicer and ensure it plays nice with memcg accounting. Signed-off-by: Jens Axboe commit 59ef78d403806b9d1f8373ea1a2fe63f88ba17da Merge: c390adfda2440e 221b5e76c1c6e8 Author: Alexei Starovoitov Date: Sun Jan 25 08:20:50 2026 -0800 Merge branch 'selftests-bpf-introduce-execution-context-detection-helpers' Changwoo Min says: ==================== selftests/bpf: Introduce execution context detection helpers This series introduces four new BPF-native inline helpers -- bpf_in_nmi(), bpf_in_hardirq(), bpf_in_serving_softirq(), and bpf_in_task() -- to allow BPF programs to query the current execution context. Following the feedback on v1, these are implemented in bpf_experimental.h as inline helpers wrapping get_preempt_count(). This approach allows the logic to be JIT-inlined for better performance compared to a kfunc call, while providing the granular context detection (e.g., hardirq vs. softirq) required by subsystems like sched_ext. The series includes a new selftest suite, exe_ctx, which uses bpf_testmod to verify context detection across Task, HardIRQ, and SoftIRQ boundaries via irq_work and tasklets. NMI context testing is omitted as NMIs cannot be triggered deterministically within software-only BPF CI environments. ChangeLog v2 -> v3: - Added exe_ctx to DENYLIST.s390x since new helpers are supported only on x86 and arm64 (patch 2). - Added comments to helpers describing supported architectures (patch 1). ChangeLog v1 -> v2: - Dropped the core kernel kfunc implementations, and implemented context detection as inline BPF helpers in bpf_experimental.h. - Renamed the selftest suite from ctx_kfunc to exe_ctx to reflect the change from kfuncs to helpers. - Updated BPF programs to use the new inline helpers. - Swapped clean-up order between tasklet and irqwork in bpf_testmod to avoid re-scheduling the already-killed tasklet (reported by bot+bpf-ci). ==================== Link: https://patch.msgid.link/20260125115413.117502-1-changwoo@igalia.com Signed-off-by: Alexei Starovoitov commit 221b5e76c1c6e8ad4fa7c95a689e44ff45daab1c Author: Changwoo Min Date: Sun Jan 25 20:54:13 2026 +0900 selftests/bpf: Add tests for execution context helpers Add a new selftest suite `exe_ctx` to verify the accuracy of the bpf_in_task(), bpf_in_hardirq(), and bpf_in_serving_softirq() helpers introduced in bpf_experimental.h. Testing these execution contexts deterministically requires crossing context boundaries within a single CPU. To achieve this, the test implements a "Trigger-Observer" pattern using bpf_testmod: 1. Trigger: A BPF syscall program calls a new bpf_testmod kfunc bpf_kfunc_trigger_ctx_check(). 2. Task to HardIRQ: The kfunc uses irq_work_queue() to trigger a self-IPI on the local CPU. 3. HardIRQ to SoftIRQ: The irq_work handler calls a dummy function (observed by BPF fentry) and then schedules a tasklet to transition into SoftIRQ context. The user-space runner ensures determinism by pinning itself to CPU 0 before execution, forcing the entire interrupt chain to remain on a single core. Dummy noinline functions with compiler barriers are added to bpf_testmod.c to serve as stable attachment points for fentry programs. A retry loop is used in user-space to wait for the asynchronous SoftIRQ to complete. Note that testing on s390x is avoided because supporting those helpers purely in BPF on s390x is not possible at this point. Reviewed-by: Alexei Starovoitov Signed-off-by: Changwoo Min Link: https://lore.kernel.org/r/20260125115413.117502-3-changwoo@igalia.com Signed-off-by: Alexei Starovoitov commit c31df36bd26a5ed8898bb3fcc8c37ea9157ba784 Author: Changwoo Min Date: Sun Jan 25 20:54:12 2026 +0900 selftests/bpf: Introduce execution context detection helpers Introduce bpf_in_nmi(), bpf_in_hardirq(), bpf_in_serving_softirq(), and bpf_in_task() inline helpers in bpf_experimental.h. These allow BPF programs to query the current execution context with higher granularity than the existing bpf_in_interrupt() helper. While BPF programs can often infer their context from attachment points, subsystems like sched_ext may call the same BPF logic from multiple contexts (e.g., task-to-task wake-ups vs. interrupt-to-task wake-ups). These helpers provide a reliable way for logic to branch based on the current CPU execution state. Implementing these as BPF-native inline helpers wrapping get_preempt_count() allows the compiler and JIT to inline the logic. The implementation accounts for differences in preempt_count layout between standard and PREEMPT_RT kernels. Reviewed-by: Alexei Starovoitov Signed-off-by: Changwoo Min Link: https://lore.kernel.org/r/20260125115413.117502-2-changwoo@igalia.com Signed-off-by: Alexei Starovoitov commit 65d00e37b17f46a21e7a25e0fb211a4c33274a83 Author: Marc Zyngier Date: Fri Jan 23 19:16:37 2026 +0000 KVM: arm64: Simplify PAGE_S2_MEMATTR Restore PAGE_S2_MEMATTR() to its former glory, keeping the use of FWB as an implementation detail. Reviewed-by: Joey Gouly Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260123191637.715429-6-maz@kernel.org Signed-off-by: Marc Zyngier commit 4f27fe82aa304c50b24f92da72b4895cf73b54ba Author: Marc Zyngier Date: Fri Jan 23 19:16:36 2026 +0000 KVM: arm64: Kill KVM_PGTABLE_S2_NOFWB Nobody is using this flag anymore, so remove it. This allows some cleanup by removing stage2_has_fwb(), which is can be replaced by a direct check on the capability. Reviewed-by: Joey Gouly Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260123191637.715429-5-maz@kernel.org Signed-off-by: Marc Zyngier commit a373930ec9406aeb9f82b5b78db56ca8d0919d99 Author: Marc Zyngier Date: Fri Jan 23 19:16:35 2026 +0000 KVM: arm64: Switch pKVM host S2 over to KVM_PGTABLE_S2_AS_S1 Since we have the basics to use the S1 memory attributes as the final ones with FWB, flip the host over to that when FWB is present. Reviewed-by: Joey Gouly Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Link: https://patch.msgid.link/20260123191637.715429-4-maz@kernel.org Signed-off-by: Marc Zyngier commit 17d7b15131f3ed7fff29f2a43b6ead547e495653 Author: Marc Zyngier Date: Fri Jan 23 19:16:34 2026 +0000 KVM: arm64: Add KVM_PGTABLE_S2_AS_S1 flag Plumb the MT_S2{,_FWB}_AS_S1 memory types into the KVM_S2_MEMATTR() macro with a new KVM_PGTABLE_S2_AS_S1 flag. Nobody selects it yet. Reviewed-by: Joey Gouly Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260123191637.715429-3-maz@kernel.org Signed-off-by: Marc Zyngier commit d4236f1ef270347b26ed34bcd0eb28d285b86bcb Author: Marc Zyngier Date: Fri Jan 23 19:16:33 2026 +0000 arm64: Add MT_S2{,_FWB}_AS_S1 encodings pKVM usage of S2 translation on the host is purely for isolation purposes, not translation. To that effect, the memory attributes being used must be that of S1. With FWB=0, this is easily achieved by using the Normal Cacheable type (which is the weakest possible memory type) at S2, and let S1 pick something stronger as required. With FWB=1, the attributes are combined in a different way, and we cannot arbitrarily use Normal Cacheable. We can, however, use a memattr encoding that indicates that the final attributes are that of Stage-1. Add these encoding and a few pointers to the relevant parts of the specification. It might come handy some day. Reviewed-by: Joey Gouly Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Link: https://patch.msgid.link/20260123191637.715429-2-maz@kernel.org Signed-off-by: Marc Zyngier commit 2529aead51673814ebf464723626ac608b8635a5 Author: Jacob Moroni Date: Tue Jan 20 21:25:46 2026 +0000 RDMA/irdma: Use CQ ID for CEQE context The hardware allows for an opaque CQ context field to be carried over into CEQEs for the CQ. Previously, a pointer to the CQ was used for this context. In the normal CQ destroy flow, the CEQ ring is scrubbed to remove any preexisting CEQEs for the CQ that may not have been processed yet so that the CQ structure is not dereferenced in the CEQ ISR after the CQ has been freed. However, in some cases, it is possible for a CEQE to be in flight in HW even after the CQ destroy command completion is received, so it could be missed during the scrub. To protect against this, we can take advantage of the CQ table that already exists and use the CQ ID for this context rather than a CQ pointer. Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260120212546.1893076-2-jmoroni@google.com Signed-off-by: Leon Romanovsky commit 2b7c2ba1308a545a2be2d3d041c2c1cde95b700a Author: Jacob Moroni Date: Tue Jan 20 21:25:45 2026 +0000 RDMA/irdma: Add enum defs for reserved CQs/QPs Added definitions for the special reserved CQs and QPs. Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260120212546.1893076-1-jmoroni@google.com Signed-off-by: Leon Romanovsky commit 12985e5915a0b8354796efadaaeb201eed115377 Author: Li Zhijian Date: Fri Jan 16 11:27:53 2026 +0800 RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/ Fixes: 592627ccbdff ("RDMA/rxe: Replace rxe_map and rxe_phys_buf by xarray") Signed-off-by: Li Zhijian Link: https://patch.msgid.link/20260116032753.2574363-1-lizhijian@fujitsu.com Signed-off-by: Leon Romanovsky commit 7ff574599464bd0e30da88aabc7be9de1021204a Author: Gianluca Boiano Date: Sat Jan 24 21:34:30 2026 -0800 Input: novatek-nvt-ts - drop wake_type check The wake_type parameter from touchscreen registers is not used for anything functional - the driver only validates that it matches a hard-coded expected value per chip variant. This causes probe to fail on touchscreens that report a different wake_type despite being otherwise compatible. Drop the wake_type check and the associated chip data member to allow the existing compatibles to work with more touchscreen variants. Signed-off-by: Gianluca Boiano Suggested-by: Hans de Goede Link: https://patch.msgid.link/20260122001040.76869-1-morf3089@gmail.com Signed-off-by: Dmitry Torokhov commit a53a6dd64b80fc76dac3cadf010acad3f40b8f97 Author: Svyatoslav Ryhel Date: Thu Jan 22 21:35:49 2026 +0200 dt-bindings: input: touchscreen: tsc2007: document '#io-channel-cells' The tsc2007 can be used not only as resistive touchscreen controller but also as a ADC IIO sensor. The second use case requires '#io-channel-cells' property, hence add it. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260122193549.29858-2-clamor95@gmail.com Signed-off-by: Dmitry Torokhov commit c390adfda2440e4a907ecedae03ff392511bcf95 Merge: c7900f225a1022 cb4bfacfb0110a Author: Alexei Starovoitov Date: Sat Jan 24 18:49:37 2026 -0800 Merge branch 'bpf-fsession-support' Menglong Dong says: ==================== bpf: fsession support overall ------- Sometimes, we need to hook both the entry and exit of a function with TRACING. Therefore, we need define a FENTRY and a FEXIT for the target function, which is not convenient. Therefore, we add a tracing session support for TRACING. Generally speaking, it's similar to kprobe session, which can hook both the entry and exit of a function with a single BPF program. We allow the usage of bpf_get_func_ret() to get the return value in the fentry of the tracing session, as it will always get "0", which is safe enough and is OK. Session cookie is also supported with the kfunc bpf_session_cookie(). In order to limit the stack usage, we limit the maximum number of cookies to 4. kfunc design ------------ In order to keep consistency with existing kfunc, we don't introduce new kfunc for fsession. Instead, we reuse the existing kfunc bpf_session_cookie() and bpf_session_is_return(). The prototype of bpf_session_cookie() and bpf_session_is_return() don't satisfy our needs, so we change their prototype by adding the argument "void *ctx" to them. We inline bpf_session_cookie() and bpf_session_is_return() for fsession in the verifier directly. Therefore, we don't need to introduce new functions for them. architecture ------------ The fsession stuff is arch related, so the -EOPNOTSUPP will be returned if it is not supported yet by the arch. In this series, we only support x86_64. And later, other arch will be implemented. Changes v12 -> v13: * fix the selftests fail on !x86_64 in the 11th patch * v12: https://lore.kernel.org/bpf/20260124033119.28682-1-dongml2@chinatelecom.cn/ Changes v11 -> v12: * update the variable "delta" in the 2nd patch * improve the fsession testcase by adding the 11th patch, which will test bpf_get_func_* for fsession * v11: https://lore.kernel.org/bpf/20260123073532.238985-1-dongml2@chinatelecom.cn/ Changes v10 -> v11: * rebase and fix the conflicts in the 2nd patch * use "volatile" in the 11th patch * rename BPF_TRAMP_SHIFT_* to BPF_TRAMP_*_SHIFT * v10: https://lore.kernel.org/bpf/20260115112246.221082-1-dongml2@chinatelecom.cn/ Changes v9 -> v10: * 1st patch: some small adjustment, such as use switch in bpf_prog_has_trampoline() * 2nd patch: some adjustment to the commit log and comment * 3rd patch: - drop the declaration of bpf_session_is_return() and bpf_session_cookie() - use vmlinux.h instead of bpf_kfuncs.h in uprobe_multi_session.c, kprobe_multi_session_cookie.c and uprobe_multi_session_cookie.c * 4th patch: - some adjustment to the comment and commit log - rename the prefix from BPF_TRAMP_M_ to BPF_TRAMP_SHIFT_ - remove the definition of BPF_TRAMP_M_NR_ARGS - check the program type in bpf_session_filter() * 5th patch: some adjustment to the commit log * 6th patch: - add the "reg" to the function arguments of emit_store_stack_imm64() - use the positive offset in emit_store_stack_imm64() * 7th patch: - use "|" for func_meta instead of "+" - pass the "func_meta_off" to invoke_bpf() explicitly, instead of computing it with "stack_size + 8" - pass the "cookie_off" to invoke_bpf() instead of computing the current cookie index with "func_meta" * 8th patch: - split the modification to bpftool to a separate patch * v9: https://lore.kernel.org/bpf/20260110141115.537055-1-dongml2@chinatelecom.cn/ Changes v8 -> v9: * remove the definition of bpf_fsession_cookie and bpf_fsession_is_return in the 4th and 5th patch * rename emit_st_r0_imm64() to emit_store_stack_imm64() in the 6th patch * v8: https://lore.kernel.org/bpf/20260108022450.88086-1-dongml2@chinatelecom.cn/ Changes v7 -> v8: * use the last byte of nr_args for bpf_get_func_arg_cnt() in the 2nd patch * v7: https://lore.kernel.org/bpf/20260107064352.291069-1-dongml2@chinatelecom.cn/ Changes v6 -> v7: * change the prototype of bpf_session_cookie() and bpf_session_is_return(), and reuse them instead of introduce new kfunc for fsession. * v6: https://lore.kernel.org/bpf/20260104122814.183732-1-dongml2@chinatelecom.cn/ Changes v5 -> v6: * No changes in this version, just a rebase to deal with conflicts. * v5: https://lore.kernel.org/bpf/20251224130735.201422-1-dongml2@chinatelecom.cn/ Changes v4 -> v5: * use fsession terminology consistently in all patches * 1st patch: - use more explicit way in __bpf_trampoline_link_prog() * 4th patch: - remove "cookie_cnt" in struct bpf_trampoline * 6th patch: - rename nr_regs to func_md - define cookie_off in a new line * 7th patch: - remove the handling of BPF_TRACE_SESSION in legacy fallback path for BPF_RAW_TRACEPOINT_OPEN * v4: https://lore.kernel.org/bpf/20251217095445.218428-1-dongml2@chinatelecom.cn/ Changes v3 -> v4: * instead of adding a new hlist to progs_hlist in trampoline, add the bpf program to both the fentry hlist and the fexit hlist. * introduce the 2nd patch to reuse the nr_args field in the stack to store all the information we need(except the session cookies). * limit the maximum number of cookies to 4. * remove the logic to skip fexit if the fentry return non-zero. * v3: https://lore.kernel.org/bpf/20251026030143.23807-1-dongml2@chinatelecom.cn/ Changes v2 -> v3: * squeeze some patches: - the 2 patches for the kfunc bpf_tracing_is_exit() and bpf_fsession_cookie() are merged into the second patch. - the testcases for fsession are also squeezed. * fix the CI error by move the testcase for bpf_get_func_ip to fsession_test.c * v2: https://lore.kernel.org/bpf/20251022080159.553805-1-dongml2@chinatelecom.cn/ Changes v1 -> v2: * session cookie support. In this version, session cookie is implemented, and the kfunc bpf_fsession_cookie() is added. * restructure the layout of the stack. In this version, the session stuff that stored in the stack is changed, and we locate them after the return value to not break bpf_get_func_ip(). * testcase enhancement. Some nits in the testcase that suggested by Jiri is fixed. Meanwhile, the testcase for get_func_ip and session cookie is added too. * v1: https://lore.kernel.org/bpf/20251018142124.783206-1-dongml2@chinatelecom.cn/ ==================== Link: https://patch.msgid.link/20260124062008.8657-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit cb4bfacfb0110aa1b10ab60c64a3df0e176998c5 Author: Menglong Dong Date: Sat Jan 24 14:20:08 2026 +0800 selftests/bpf: test fsession mixed with fentry and fexit Test the fsession when it is used together with fentry, fexit. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260124062008.8657-14-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 8909b3fb23e245f8ade903dfcfcc43522cf28a56 Author: Menglong Dong Date: Sat Jan 24 14:20:07 2026 +0800 selftests/bpf: add testcases for fsession cookie Test session cookie for fsession. Multiple fsession BPF progs is attached to bpf_fentry_test1() and session cookie is read and write in the testcase. bpf_get_func_ip() will influence the layout of the session cookies, so we test the cookie in two case: with and without bpf_get_func_ip(). Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260124062008.8657-13-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit a5533a6eaa5b602fe54e53d85f787e09eab4e771 Author: Menglong Dong Date: Sat Jan 24 14:20:06 2026 +0800 selftests/bpf: test bpf_get_func_* for fsession Test following bpf helper for fsession: bpf_get_func_arg() bpf_get_func_arg_cnt() bpf_get_func_ret() bpf_get_func_ip() Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260124062008.8657-12-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit f7afef5617b685c3491db3593ca09abc33815774 Author: Menglong Dong Date: Sat Jan 24 14:20:05 2026 +0800 selftests/bpf: add testcases for fsession Add testcases for BPF_TRACE_FSESSION. The function arguments and return value are tested both in the entry and exit. And the kfunc bpf_session_is_ret() is also tested. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260124062008.8657-11-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 85fc4be6d811372f8f9a2a131a092735418fdbf2 Author: Menglong Dong Date: Sat Jan 24 14:20:04 2026 +0800 bpftool: add fsession support Add BPF_TRACE_FSESSION to bpftool. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260124062008.8657-10-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 257c43688b143fd9805cdfef9d2623dde92989e6 Author: Menglong Dong Date: Sat Jan 24 14:20:03 2026 +0800 libbpf: add fsession support Add BPF_TRACE_FSESSION to libbpf. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260124062008.8657-9-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 98770bd4e6df50db81cbdf5876f8836baefa3005 Author: Menglong Dong Date: Sat Jan 24 14:20:02 2026 +0800 bpf,x86: add fsession support for x86_64 Add BPF_TRACE_FSESSION supporting to x86_64, including: 1. clear the return value in the stack before fentry to make the fentry of the fsession can only get 0 with bpf_get_func_ret(). 2. clear all the session cookies' value in the stack. 2. store the index of the cookie to ctx[-1] before the calling to fsession 3. store the "is_return" flag to ctx[-1] before the calling to fexit of the fsession. Signed-off-by: Menglong Dong Co-developed-by: Leon Hwang Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260124062008.8657-8-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 37c7ba1b39c493229d1b3c1f6ab466a23362e21e Author: Menglong Dong Date: Sat Jan 24 14:20:01 2026 +0800 bpf,x86: introduce emit_store_stack_imm64() for trampoline Introduce the helper emit_store_stack_imm64(), which is used to store a imm64 to the stack with the help of a register. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260124062008.8657-7-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit eeee4239dbb155a98f8ba737324ac081acde8417 Author: Menglong Dong Date: Sat Jan 24 14:20:00 2026 +0800 bpf: support fsession for bpf_session_cookie Implement session cookie for fsession. The session cookies will be stored in the stack, and the layout of the stack will look like this: return value -> 8 bytes argN -> 8 bytes ... arg1 -> 8 bytes nr_args -> 8 bytes ip (optional) -> 8 bytes cookie2 -> 8 bytes cookie1 -> 8 bytes The offset of the cookie for the current bpf program, which is in 8-byte units, is stored in the "(((u64 *)ctx)[-1] >> BPF_TRAMP_COOKIE_INDEX_SHIFT) & 0xFF". Therefore, we can get the session cookie with ((u64 *)ctx)[-offset]. Implement and inline the bpf_session_cookie() for the fsession in the verifier. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260124062008.8657-6-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 27d89baa6da8e5e546585c53a959176d1302d46e Author: Menglong Dong Date: Sat Jan 24 14:19:59 2026 +0800 bpf: support fsession for bpf_session_is_return If fsession exists, we will use the bit (1 << BPF_TRAMP_IS_RETURN_SHIFT) in ((u64 *)ctx)[-1] to store the "is_return" flag. The logic of bpf_session_is_return() for fsession is implemented in the verifier by inline following code: bool bpf_session_is_return(void *ctx) { return (((u64 *)ctx)[-1] >> BPF_TRAMP_IS_RETURN_SHIFT) & 1; } Signed-off-by: Menglong Dong Co-developed-by: Leon Hwang Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260124062008.8657-5-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 8fe4dc4f6456b3d2c9e6f8aeb1f978b7bff0f6c8 Author: Menglong Dong Date: Sat Jan 24 14:19:58 2026 +0800 bpf: change prototype of bpf_session_{cookie,is_return} Add the function argument of "void *ctx" to bpf_session_cookie() and bpf_session_is_return(), which is a preparation of the next patch. The two kfunc is seldom used now, so it will not introduce much effect to change their function prototype. Signed-off-by: Menglong Dong Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20260124062008.8657-4-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit f1b56b3cbdb2d2a51d8ea91008eddf4d1d9f277b Author: Menglong Dong Date: Sat Jan 24 14:19:57 2026 +0800 bpf: use the least significant byte for the nr_args in trampoline For now, ((u64 *)ctx)[-1] is used to store the nr_args in the trampoline. However, 1 byte is enough to store such information. Therefore, we use only the least significant byte of ((u64 *)ctx)[-1] to store the nr_args, and reserve the rest for other usages. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20260124062008.8657-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 2d419c44658f75e7655794341a95c0687830f3df Author: Menglong Dong Date: Sat Jan 24 14:19:56 2026 +0800 bpf: add fsession support The fsession is something that similar to kprobe session. It allow to attach a single BPF program to both the entry and the exit of the target functions. Introduce the struct bpf_fsession_link, which allows to add the link to both the fentry and fexit progs_hlist of the trampoline. Signed-off-by: Menglong Dong Co-developed-by: Leon Hwang Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260124062008.8657-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit c7900f225a102219f5fe2c1c93a7dec5467315ee Author: Yonghong Song Date: Thu Jan 22 21:51:28 2026 -0800 selftests/bpf: Fix xdp_pull_data failure with 64K page If the argument 'pull_len' of run_test() is 'PULL_MAX' or 'PULL_MAX | PULL_PLUS_ONE', the eventual pull_len size will close to the page size. On arm64 systems with 64K pages, the pull_len size will be close to 64K. But the existing buffer will be close to 9000 which is not enough to pull. For those failed run_tests(), make buff size to pg_sz + (pg_sz / 2) This way, there will be enough buffer space to pull regardless of page size. Tested-by: Alan Maguire Cc: Amery Hung Signed-off-by: Yonghong Song Acked-by: Amery Hung Link: https://lore.kernel.org/r/20260123055128.495265-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit d8df878140506e7938928195f540c10b1089fdaf Author: Yonghong Song Date: Thu Jan 22 21:51:22 2026 -0800 selftests/bpf: Fix task_local_data failure with 64K page On arm64 systems with 64K pages, the selftest task_local_data has the following failures: ... test_task_local_data_basic:PASS:tld_create_key 0 nsec test_task_local_data_basic:FAIL:tld_create_key unexpected tld_create_key: actual 0 != expected -28 ... test_task_local_data_basic_thread:PASS:run task_main 0 nsec test_task_local_data_basic_thread:FAIL:task_main retval unexpected error: 2 (errno 0) test_task_local_data_basic_thread:FAIL:tld_get_data value0 unexpected tld_get_data value0: actual 0 != expected 6268 ... #447/1 task_local_data/task_local_data_basic:FAIL ... #447/2 task_local_data/task_local_data_race:FAIL #447 task_local_data:FAIL When TLD_DYN_DATA_SIZE is 64K page size, for struct tld_meta_u { _Atomic __u8 cnt; __u16 size; struct tld_metadata metadata[]; }; field 'cnt' would overflow. For example, for 4K page, 'cnt' will be 4096/64 = 64. But for 64K page, 'cnt' will be 65536/64 = 1024 and 'cnt' is not enough for 1024. To accommodate 64K page, '_Atomic __u8 cnt' becomes '_Atomic __u16 cnt'. A few other places are adjusted accordingly. In test_task_local_data.c, the value for TLD_DYN_DATA_SIZE is changed from 4096 to (getpagesize() - 8) since the maximum buffer size for TLD_DYN_DATA_SIZE is (getpagesize() - 8). Reviewed-by: Alan Maguire Tested-by: Alan Maguire Cc: Amery Hung Signed-off-by: Yonghong Song Acked-by: Amery Hung Link: https://lore.kernel.org/r/20260123055122.494352-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 66e4442966172ed0eaec9b95a72d570e8f6aadc7 Author: Krzysztof Kozlowski Date: Wed Dec 24 12:44:54 2025 +0100 mailbox: zynqmp-ipi: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 7271bcadf6038a79c84aa6830816fc555d17888c Author: Krzysztof Kozlowski Date: Wed Dec 24 12:44:53 2025 +0100 mailbox: mtk-cmdq: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit dac2b98ede6c29f01dec95e88fef59e5138bd3a4 Author: Harini T Date: Fri Jan 9 11:52:59 2026 +0530 dt-bindings: mailbox: xlnx,zynqmp-ipi-mailbox: Document msg region requirement Add description clarifying that for Versal IPI mailboxes, both host and remote agents must have the "msg" register region defined for successful message passing. Without both, only notification-based communication works. Signed-off-by: Harini T Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit 6acf50c7f0ba4fcc048bd9018080fa53844c5705 Author: Geert Uytterhoeven Date: Thu Jan 15 15:19:11 2026 +0100 mailbox: Improve RISCV_SBI_MPXY_MBOX guidance RISC-V SBI Message Proxy (MPXY) Mailbox support defaults to enabled, but the help text states "If unsure say N". Recommend enabling this driver, as it is a very critical RISC-V driver providing mailbox channels to other drivers such as clock, system MSIs, etc. Fixes: bf3022a4eb119c6b ("mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver") Suggested-by: Anup Patel Signed-off-by: Geert Uytterhoeven Reviewed-by: Anup Patel Signed-off-by: Jassi Brar commit bc4d17e495cd3b02bcb2e10f575763a5ff31f80b Author: Valentina Fernandez Date: Thu Dec 18 10:33:59 2025 +0000 mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch warnings Fix uninitialized symbol 'hartid' warning in mchp_ipc_cluster_aggr_isr() by introducing a 'found' flag to track whether the IRQ matches any online hart. If no match is found, return IRQ_NONE. Also fix other smatch warnings by removing dead code in mchp_ipc_startup() and by returning -ENODEV in dev_err_probe() if the Microchip SBI extension is not found. Fixes below smatch warnings: drivers/mailbox/mailbox-mchp-ipc-sbi.c:187 mchp_ipc_cluster_aggr_isr() error: uninitialized symbol 'hartid'. drivers/mailbox/mailbox-mchp-ipc-sbi.c:324 mchp_ipc_startup() warn: ignoring unreachable code. drivers/mailbox/mailbox-mchp-ipc-sbi.c:422 mchp_ipc_probe() warn: passing zero to 'dev_err_probe' Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202512171533.CDLdScMY-lkp@intel.com/ Signed-off-by: Valentina Fernandez Signed-off-by: Jassi Brar commit 9cf4d3f10260c37ec48c642f2f74daf9561ac3df Author: Lakshmi S Date: Tue Dec 23 14:48:07 2025 +0530 mailbox: arm_mhuv3: fix typo in comment Fix typo "channnels"-> "channels" in struct documentation. Signed-off-by: Lakshmi S Signed-off-by: Jassi Brar commit dfd997b1e24cef79528856205df96dc6dfd3d753 Author: Lakshmi S Date: Tue Dec 23 17:36:22 2025 +0530 mailbox: cix: fix typo in error message Fix typo "overlow" -> "overflow" in FIFO overflow error message. Signed-off-by: Lakshmi S Reviewed-by: Peter Chen Signed-off-by: Jassi Brar commit 673b570825ace0dcb2ac0c676080559d505c6f40 Author: Jacky Bai Date: Tue Dec 16 16:00:54 2025 +0800 mailbox: imx: Skip the suspend flag for i.MX7ULP In current imx-mailbox driver, the MU IRQ is configured with 'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow, the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx: fix wakeup failure from freeze mode"), if the MU IRQ is triggered after the priv->suspended flag has been set, the system suspend will be aborted. On i.MX7ULP platform, certain drivers that depend on rpmsg may need to send rpmsg request and receive an acknowledgment from the remote core during the late_suspend stage. Early suspend abort is not expected, and the i.MX7ULP already has additional hardware and software to make sure the system can be wakeup from freeze mode correctly when MU IRQ is trigger. Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the early abort when doing suspend. Signed-off-by: Jacky Bai Reviewed-by: Peng Fan Signed-off-by: Jassi Brar commit 6b0eadf69bd1b33e887f5f089e056739921ebe42 Author: André Draszik Date: Mon Jan 5 12:34:35 2026 +0000 mailbox: exynos: drop unneeded runtime pointer (pclk) pclk is not needed past probe(), just drop it. This saves a little bit of runtime memory. Signed-off-by: André Draszik Reviewed-by: Krzysztof Kozlowski Reviewed-by: Tudor Ambarus Signed-off-by: Jassi Brar commit 673327028cd61db68a1e0c708be2e302c082adf9 Author: Mark Brown Date: Fri Jan 16 14:07:40 2026 +0000 mailbox: pcc: Remove spurious IRQF_ONESHOT usage The PCC code currently specifies IRQF_ONESHOT if the interrupt could potentially be shared but doesn't actually use request_threaded_irq() and the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is never relevant. Since commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler") specifying it has resulted in a WARN_ON(), fix this by removing IRQF_ONESHOT. Reported-by: Aishwarya TCV Signed-off-by: Mark Brown Reviewed-by: Sudeep Holla Signed-off-by: Jassi Brar commit 55e03b8cbe2783ec9acfb88e8adb946ed504e117 Author: Darrick J. Wong Date: Fri Jan 23 09:27:40 2026 -0800 xfs: check for deleted cursors when revalidating two btrees The free space and inode btree repair functions will rebuild both btrees at the same time, after which it needs to evaluate both btrees to confirm that the corruptions are gone. However, Jiaming Zhang ran syzbot and produced a crash in the second xchk_allocbt call. His root-cause analysis is as follows (with minor corrections): In xrep_revalidate_allocbt(), xchk_allocbt() is called twice (first for BNOBT, second for CNTBT). The cause of this issue is that the first call nullified the cursor required by the second call. Let's first enter xrep_revalidate_allocbt() via following call chain: xfs_file_ioctl() -> xfs_ioc_scrubv_metadata() -> xfs_scrub_metadata() -> `sc->ops->repair_eval(sc)` -> xrep_revalidate_allocbt() xchk_allocbt() is called twice in this function. In the first call: /* Note that sc->sm->sm_type is XFS_SCRUB_TYPE_BNOPT now */ xchk_allocbt() -> xchk_btree() -> `bs->scrub_rec(bs, recp)` -> xchk_allocbt_rec() -> xchk_allocbt_xref() -> xchk_allocbt_xref_other() since sm_type is XFS_SCRUB_TYPE_BNOBT, pur is set to &sc->sa.cnt_cur. Kernel called xfs_alloc_get_rec() and returned -EFSCORRUPTED. Call chain: xfs_alloc_get_rec() -> xfs_btree_get_rec() -> xfs_btree_check_block() -> (XFS_IS_CORRUPT || XFS_TEST_ERROR), the former is false and the latter is true, return -EFSCORRUPTED. This should be caused by ioctl$XFS_IOC_ERROR_INJECTION I guess. Back to xchk_allocbt_xref_other(), after receiving -EFSCORRUPTED from xfs_alloc_get_rec(), kernel called xchk_should_check_xref(). In this function, *curpp (points to sc->sa.cnt_cur) is nullified. Back to xrep_revalidate_allocbt(), since sc->sa.cnt_cur has been nullified, it then triggered null-ptr-deref via xchk_allocbt() (second call) -> xchk_btree(). So. The bnobt revalidation failed on a cross-reference attempt, so we deleted the cntbt cursor, and then crashed when we tried to revalidate the cntbt. Therefore, check for a null cntbt cursor before that revalidation, and mark the repair incomplete. Also we can ignore the second tree entirely if the first tree was rebuilt but is already corrupt. Apply the same fix to xrep_revalidate_iallocbt because it has the same problem. Cc: r772577952@gmail.com Link: https://lore.kernel.org/linux-xfs/CANypQFYU5rRPkTy=iG5m1Lp4RWasSgrHXAh3p8YJojxV0X15dQ@mail.gmail.com/T/#m520c7835fad637eccf843c7936c200589427cc7e Cc: # v6.8 Fixes: dbfbf3bdf639a2 ("xfs: repair inode btrees") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Tested-by: Jiaming Zhang commit 1c253e11225bc5167217897885b85093e17c2217 Author: Darrick J. Wong Date: Fri Jan 23 09:27:39 2026 -0800 xfs: fix UAF in xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any freeing could happen. The correct temporal ordering was broken when we removed xfs_btnum_t. Cc: r772577952@gmail.com Cc: # v6.9 Fixes: ec793e690f801d ("xfs: remove xfs_btnum_t") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Tested-by: Jiaming Zhang commit ca27313fb3f23e4ac18532ede4ec1c7cc5814c4a Author: Darrick J. Wong Date: Fri Jan 23 09:27:38 2026 -0800 xfs: check return value of xchk_scrub_create_subord Fix this function to return NULL instead of a mangled ENOMEM, then fix the callers to actually check for a null pointer and return ENOMEM. Most of the corrections here are for code merged between 6.2 and 6.10. Cc: r772577952@gmail.com Cc: # v6.12 Fixes: 1a5f6e08d4e379 ("xfs: create subordinate scrub contexts for xchk_metadata_inode_subtype") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Tested-by: Jiaming Zhang commit ba408d299a3bb3c5309f40c5326e4fb83ead4247 Author: Darrick J. Wong Date: Fri Jan 23 09:27:37 2026 -0800 xfs: only call xf{array,blob}_destroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note that this patch fixes a large number of commits, most of which were merged between 6.9 and 6.10. Cc: r772577952@gmail.com Cc: # v6.12 Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Tested-by: Jiaming Zhang commit 938ce3b16582657e67f3bd8a7efa59089c467c90 Author: Guodong Xu Date: Tue Jan 20 19:10:52 2026 +0800 reset: spacemit: Add SpacemiT K3 reset driver Add support for the SpacemiT K3 SoC reset controller. The K3 reset driver reuses the common reset controller code and provides K3-specific reset data for devices managed by the following units: - MPMU (Main Power Management Unit) - APBC (APB clock unit) - APMU (Application Subsystem Power Management Unit) - DCIU (DMA Control and Interface Unit) Acked-by: Alex Elder Signed-off-by: Guodong Xu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/spacemit/20260114092742-GYC7933267@gentoo.org/ [1] Signed-off-by: Philipp Zabel commit aba86f7bff0bfd6956aff9bbbfb0c6ea6d56809e Author: Guodong Xu Date: Tue Jan 20 19:10:51 2026 +0800 reset: spacemit: Extract common K1 reset code Extract the common reset controller code from the K1 driver into separate reset-spacemit-common.{c,h} files to prepare for additional SpacemiT SoCs that share the same reset controller architecture. The common code includes handlers for reset assert and deassert operations and probing for auxiliary bus devices. Changes during extraction: - Module ownership: Use dev->driver->owner instead of THIS_MODULE in spacemit_reset_controller_register() to correctly reference the calling driver's module. - Rename spacemit_reset_ids to spacemit_k1_reset_ids. - Define new namespace "RESET_SPACEMIT" for the exported common functions (spacemit_reset_probe) and update K1 driver to import it. This prepares for additional SpacemiT SoCs (K3) that share the same reset controller architecture. Reviewed-by: Alex Elder Signed-off-by: Guodong Xu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/spacemit/20260114092742-GYC7933267@gentoo.org/ [1] Signed-off-by: Philipp Zabel commit 2875b4b5d2657ff2fd979103d88e9afcae51481c Author: Guodong Xu Date: Tue Jan 20 19:10:50 2026 +0800 reset: Create subdirectory for SpacemiT drivers Create a dedicated subdirectory for SpacemiT reset drivers to allow for better organization as support for more SoCs is added. Move the existing K1 reset driver into this new directory and rename it to reset-spacemit-k1.c. Rename the Kconfig symbol to RESET_SPACEMIT_K1 and update its default from ARCH_SPACEMIT to SPACEMIT_K1_CCU. The reset driver depends on the clock driver to register reset devices as an auxiliary device, so the default should reflect this dependency. Also sort the drivers/reset/Kconfig entries alphabetically. Reviewed-by: Alex Elder Signed-off-by: Guodong Xu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/spacemit/20260114092742-GYC7933267@gentoo.org/ [1] Signed-off-by: Philipp Zabel commit 216e0a5e98e5f0f02a818884e8acf340892cecae Author: Guodong Xu Date: Tue Jan 20 19:10:49 2026 +0800 dt-bindings: soc: spacemit: Add K3 reset support and IDs Update the spacemit,k1-syscon.yaml binding to document K3 SoC reset support. K3 reset devices are registered at runtime as auxiliary devices by the K3 CCU driver. Since K3 reuses the K1 syscon binding, there is no separate YAML binding file for K3 resets. Update #reset-cells description to document where reset IDs are defined. Acked-by: Alex Elder Acked-by: Krzysztof Kozlowski Signed-off-by: Guodong Xu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/spacemit/20260114092742-GYC7933267@gentoo.org/ [1] Signed-off-by: Philipp Zabel commit 733aa8e24ea6712ad2603bdfbb19299e79b512a0 Merge: c7a5e01e229d21 091d19cc24018f Author: Philipp Zabel Date: Sat Jan 24 16:51:04 2026 +0100 Merge tag 'spacemit-clkrst-v6.20-3' into reset/next commit c7a5e01e229d21e0560d78bd645b4f7398667ce4 Author: Junhui Liu Date: Sat Jan 17 18:06:22 2026 +0800 reset: canaan: k230: drop OF dependency and enable by default The driver doesn't use any symbols depending on CONFIG_OF, so drop the dependency. Also, enable it by default when ARCH_CANAAN is selected. Fixes: 360a7a647759 ("reset: canaan: add reset driver for Kendryte K230") Signed-off-by: Junhui Liu Signed-off-by: Philipp Zabel commit c5b7cd9adefc5c060facaff6f54d3187480e4e1b Author: Claudiu Beznea Date: Fri Jan 9 16:36:59 2026 +0200 reset: rzg2l-usbphy-ctrl: Add suspend/resume support The RZ/G2L USBPHY control driver is also used on the RZ/G3S SoC. The RZ/G3S SoC supports a power-saving mode in which power to most USB components (including the USBPHY control block) is turned off. Because of this, the USBPHY control block needs to be reconfigured when returning from power-saving mode. Add suspend/resume support to handle runtime suspend/resume of the device, assert/deassert the reset signal, and reinitialize the USBPHY control block. Reviewed-by: Biju Das Reviewed-by: Philipp Zabel Signed-off-by: Claudiu Beznea Signed-off-by: Philipp Zabel commit 2289ccd753deeb2cfe300d97e8697680c1ce556c Author: Claudiu Beznea Date: Fri Jan 9 16:36:58 2026 +0200 reset: rzg2l-usbphy-ctrl: Propagate the return value of regmap_field_update_bits() Propagate the return value of regmap_field_update_bits() to avoid losing any possible error. With this, the return type of rzg2l_usbphy_ctrl_set_pwrrdy() was updated accordingly. Reviewed-by: Philipp Zabel Reviewed-by: Biju Das Signed-off-by: Claudiu Beznea Signed-off-by: Philipp Zabel commit 795663b4d160ba652959f1a46381c5e8b1342a53 Author: Pavel Begunkov Date: Sat Jan 24 10:36:17 2026 +0000 io_uring/zcrx: implement large rx buffer support There are network cards that support receive buffers larger than 4K, and that can be vastly beneficial for performance, and benchmarks for this patch showed up to 30% CPU util improvement for 32K vs 4K buffers. Allows zcrx users to specify the size in struct io_uring_zcrx_ifq_reg::rx_buf_len. If set to zero, zcrx will use a default value. zcrx will check and fail if the memory backing the area can't be split into physically contiguous chunks of the required size. It's more restrictive as it only needs dma addresses to be contig, but that's beyond this series. Signed-off-by: Pavel Begunkov [axboe: kill duplicate netdev_queues.h include] Signed-off-by: Jens Axboe commit ae089de7adc4bd15c607b0045a304653cd6652e8 Author: Bartosz Golaszewski Date: Tue Dec 2 17:39:37 2025 +0100 reset: gpio: check the return value of gpiod_set_value_cansleep() gpiod_set_value_cansleep() now returns an integer and can indicate failures. Propagate the return value to the caller of the reset API. Signed-off-by: Bartosz Golaszewski Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 5aac7afc752be03bad2ed4d5074c62b3e4d9179f Author: Laurentiu Mihalcea Date: Wed Nov 26 04:42:17 2025 -0800 reset: imx8mp-audiomix: Support i.MX8ULP SIM LPAV Support i.MX8ULP's SIM LPAV by adding its reset map definition. Reviewed-by: Daniel Baluta Reviewed-by: Frank Li Reviewed-by: Philipp Zabel Signed-off-by: Laurentiu Mihalcea Signed-off-by: Philipp Zabel commit cc3b1245cd64b1bb73204e9d697e812ea76e266d Author: Laurentiu Mihalcea Date: Wed Nov 26 04:42:16 2025 -0800 reset: imx8mp-audiomix: Extend the driver usage Switch to per-device reset map to allow reusing the driver for other NXP block control IPs. Reviewed-by: Daniel Baluta Reviewed-by: Frank Li Signed-off-by: Laurentiu Mihalcea Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 6d6818abec260e506ea5978df920430f54deb70a Author: Laurentiu Mihalcea Date: Wed Nov 26 04:42:15 2025 -0800 reset: imx8mp-audiomix: Switch to using regmap API Switch to using the regmap API to allow performing register operations under the same lock. This is needed for cases such as i.MX8ULP's SIM LPAV where clock gating, reset control and MUX-ing is performed via the same register (i.e. SYSCTRL0) and different subsystem APIs. Reviewed-by: Philipp Zabel Reviewed-by: Frank Li Signed-off-by: Laurentiu Mihalcea Signed-off-by: Philipp Zabel commit 212212062f981fe2c98d235ee008201a6dd36c28 Author: Laurentiu Mihalcea Date: Wed Nov 26 04:42:14 2025 -0800 reset: imx8mp-audiomix: Drop unneeded macros The macros defining the mask values for the EARC, EARC PHY resets, and the DSP RUN_STALL signal can be dropped as they are not and will not be used anywhere else except to set the value of the "mask" field from "struct imx8mp_reset_map". In this particular case, based on the name of the "mask" field, you can already deduce what these values are for, which is why defining macros for them doesn't offer any new information, nor does it help with the code readability. Reviewed-by: Daniel Baluta Reviewed-by: Frank Li Reviewed-by: Philipp Zabel Signed-off-by: Laurentiu Mihalcea Signed-off-by: Philipp Zabel commit 756b7b8d0a7be725baaf92bfce794a72021145d4 Merge: 71ebc45fa052c2 de284988c270cc Author: Wolfram Sang Date: Sat Jan 24 12:58:36 2026 +0100 Merge tag 'at24-updates-for-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-mergewindow at24 updates for v7.0-rc1 - add a set of new compatibles to DT bindings - use dev_err_probe() consistently in the driver commit f8ed7a49d40aea7769d80e05a3b7b14594cb3aef Author: Gary Guo Date: Fri Jan 23 17:58:41 2026 +0000 rust: samples: dma: remove redundant `.as_ref()` for `dev_*` print This is now handled by the macro itself. Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260123175854.176735-4-gary@kernel.org [ Fix up code formatting. - Danilo ] Signed-off-by: Danilo Krummrich commit fc32c5725fbe1164d353400389d3e29d19960a3a Author: Raag Jadav Date: Sat Jan 24 13:44:54 2026 +0530 pinctrl: intel: Add code name documentation Intel pinctrl drivers support large set of platforms and the IPs are often reused by their different variants, but it's currently not possible to figure out the exact driver that supports specific variant. Add user friendly documentation for them. Cc: stable@vger.kernel.org Reported-by: Guido Trentalancia Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220056 Signed-off-by: Raag Jadav Acked-by: Mika Westerberg Acked-by: Guido Trentalancia [andy: added Oxford comma] Signed-off-by: Andy Shevchenko commit dd5712f3379cfe760267cdd28ff957d9ab4e51c7 Author: Magnus Lindholm Date: Fri Jan 2 18:30:43 2026 +0100 alpha: fix user-space corruption during memory compaction Alpha systems can suffer sporadic user-space crashes and heap corruption when memory compaction is enabled. Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned tcache chunk"), and compiler internal errors. The failures disappear when compaction is disabled or when using global TLB invalidation. The root cause is insufficient TLB shootdown during page migration. Alpha relies on ASN-based MM context rollover for instruction cache coherency, but this alone is not sufficient to prevent stale data or instruction translations from surviving migration. Fix this by introducing a migration-specific helper that combines: - MM context invalidation (ASN rollover), - immediate per-CPU TLB invalidation (TBI), - synchronous cross-CPU shootdown when required. The helper is used only by migration/compaction paths to avoid changing global TLB semantics. Additionally, update flush_tlb_other(), pte_clear(), to use READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering. This fixes observed crashes on both UP and SMP Alpha systems. Reviewed-by: Ivan Kokshaysky Tested-by: Matoro Mahri Tested-by: Michael Cree Signed-off-by: Magnus Lindholm Link: https://lore.kernel.org/r/20260102173603.18247-2-linmag7@gmail.com Signed-off-by: Magnus Lindholm commit 3e30278e0c71808e156cac8da5895d636ce819d5 Author: Nathan Chancellor Date: Fri Jan 23 16:20:28 2026 -0700 x86/entry/vdso32: Omit '.cfi_offset eflags' for LLVM < 16 After commit: 884961618ee5 ("x86/entry/vdso32: Remove open-coded DWARF in sigreturn.S") building arch/x86/entry/vdso/vdso32/sigreturn.S with LLVM 15 fails with: :18:20: error: invalid register name .cfi_offset eflags, 64 ^ arch/x86/entry/vdso/vdso32/sigreturn.S:33:2: note: while in macro instantiation STARTPROC_SIGNAL_FRAME 8 ^ Support for eflags as an argument to .cfi_offset was added in the LLVM 16 development cycle: https://github.com/llvm/llvm-project/commit/67bd3c58c0c7389e39c5a2f4d3b1a30459ccf5b7 [1] Only add this .cfi_offset directive if it is supported by the assembler to clear up the error. [ mingo: Tidied up the changelog and the comment a bit ] Fixes: 884961618ee5 ("x86/entry/vdso32: Remove open-coded DWARF in sigreturn.S") Signed-off-by: Nathan Chancellor Signed-off-by: Ingo Molnar Acked-by: H. Peter Anvin (Intel) Link: https://patch.msgid.link/20260123-x86-vdso32-wa-llvm-15-cfi-offset-eflags-v1-1-0f412e3516a4@kernel.org commit a48ca06cf343423faa01c573aeafba9fa5f92577 Merge: d24e091dff06d4 e6b42979ea6137 Author: Martin K. Petersen Date: Fri Jan 23 22:24:03 2026 -0500 Merge patch series "Add WQ_PERCPU to alloc_workqueue() users" Marco Crivellari says: Hi, This series continues the effort to refactor the Workqueue API. No behavior changes are introduced by this series. === Recent changes to the WQ API === The following, address the recent changes in the Workqueue API: - commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") - commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The old workqueues will be removed in a future release cycle and unbound will become the implicit default. === Introduced Changes by this series === 1) [P 1-2-3] add WQ_PERCPU to alloc_workqueue() users With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. WQ_UNBOUND will be removed in future. For more information: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://patch.msgid.link/20260113145711.242316-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit e6b42979ea61370a2046bacee63e6ec0ac033280 Author: Marco Crivellari Date: Tue Jan 13 15:57:11 2026 +0100 scsi: qla2xxx: target: Add WQ_PERCPU to alloc_workqueue() users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue() flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20260113145711.242316-4-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit e4c7c844fae0ebfae6e84ae0dab135306ba4da1b Author: Marco Crivellari Date: Tue Jan 13 15:57:10 2026 +0100 scsi: qla2xxx: Add WQ_PERCPU to alloc_workqueue() users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue() flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20260113145711.242316-3-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 267345b6d1dc3467c5d57d6bbe833107baa00dbc Author: Marco Crivellari Date: Tue Jan 13 15:57:09 2026 +0100 scsi: qla4xxx: Add WQ_PERCPU to alloc_workqueue() users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue() flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20260113145711.242316-2-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit d24e091dff06d49c1873bbd5818b204202cc118f Merge: 15df721f629722 943e9049e84a8f Author: Martin K. Petersen Date: Fri Jan 23 22:17:34 2026 -0500 Merge patch series "mpi3mr: Enhancements for mpi3mr" Ranjan Kumar says: Enhancements for mpi3mr driver Link: https://patch.msgid.link/20260116060719.32937-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 943e9049e84a8ff379534ed8945a929cec722a5a Author: Ranjan Kumar Date: Fri Jan 16 11:37:19 2026 +0530 scsi: mpi3mr: Driver version update to 8.17.0.3.50 Update driver version to 8.17.0.3.50 Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260116060719.32937-9-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 8612d94348f4209b71917b771f24c0013aed6a29 Author: Ranjan Kumar Date: Fri Jan 16 11:37:18 2026 +0530 scsi: mpi3mr: Fixed the W=1 compilation warning Fixed W=1 compilation warnings Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260116060719.32937-8-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit ec54b348f274fdd2bd32bbe74de6d62ae1a10a18 Author: Ranjan Kumar Date: Fri Jan 16 11:37:17 2026 +0530 scsi: mpi3mr: Record and report controller firmware faults Capture and retain firmware fault codes and extended fault information whenever the controller enters a fault state. Maintain a persistent firmware fault counter, expose it via sysfs, and generate uevents to aid userspace diagnostics and failure analysis. Co-developed-by: Salomon Dushimirimana Signed-off-by: Salomon Dushimirimana Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260116060719.32937-7-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit d0654335d90053f0573db293b60a93d855748f83 Author: Ranjan Kumar Date: Fri Jan 16 11:37:16 2026 +0530 scsi: mpi3mr: Update MPI Headers to revision 39 Update MPI Headers to revision 39. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260116060719.32937-6-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit c273c14b0294f11ce45afc4da2e8f91ab3f07270 Author: Ranjan Kumar Date: Fri Jan 16 11:37:15 2026 +0530 scsi: mpi3mr: Use negotiated link rate from DevicePage0 Firmware populates the negotiated SAS link rate in DevicePage0 during device discovery. Update mpi3mr to cache this value while initializing the target device. When available, the cached link rate is used instead of issuing additional SAS PHY or expander PHY page reads. If the DevicePage0 value is missing or invalid, the driver falls back to the existing PHY-based mechanism. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260116060719.32937-5-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 7a67d9262288f40ceec1de9d2def8368ea44134b Author: Ranjan Kumar Date: Fri Jan 16 11:37:14 2026 +0530 scsi: mpi3mr: Avoid redundant diag-fault resets Update reset handling to invoke diag-save only for diag-fault resets. Skip issuing a diagnostic reset if the IOC is already in FAULT state, preventing repeated fault handling and improving reset stability. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260116060719.32937-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit d0d19250ed81907eac707be8221eb31e5b96b647 Author: Ranjan Kumar Date: Fri Jan 16 11:37:13 2026 +0530 scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context Log data events can be processed from BH and threaded contexts. Rename the save helper to document its intended usage and improve readability of the event handling flow. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260116060719.32937-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 24de8b1d243b86678e92f7d0fd9d9a2954728b97 Author: Ranjan Kumar Date: Fri Jan 16 11:37:12 2026 +0530 scsi: mpi3mr: Add module parameter to control threaded IRQ polling Add a module parameter to enable or disable threaded IRQ polling in the driver. The default behavior remains unchanged with polling enabled. When disabled, completion processing is kept entirely in the hard IRQ context, avoiding the threaded polling path. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260116060719.32937-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 15df721f6297224a14bafde390146413be0d6942 Merge: 92da3818aaf6dd ad44cf1b284530 Author: Martin K. Petersen Date: Fri Jan 23 22:07:51 2026 -0500 Merge patch series "ufs: ufs-qcom: Add support firmware managed platforms" Ram Kumar Dwivedi says: On Qualcomm automotive SoC SA8255P, platform resource like clocks, interconnect, resets, regulators and PHY are configured remotely by firmware. Logical power domain is used to abstract these resources in firmware and SCMI power protocol is used to request resource operations by using runtime PM framework APIs such as pm_runtime_get/put_sync to invoke power_on/_off calls from kernel respectively. Link: https://patch.msgid.link/20260113080046.284089-1-ram.dwivedi@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit ad44cf1b2845303285fec8bb25a02d0d0f103a82 Author: Ram Kumar Dwivedi Date: Tue Jan 13 13:30:46 2026 +0530 scsi: ufs: ufs-qcom: Add support for firmware-managed resource abstraction Add a compatible string for SA8255p platforms where resources such as PHY, clocks, regulators, and resets are managed by firmware through an SCMI server. Use the SCMI power protocol to abstract these resources and invoke power operations via runtime PM APIs (pm_runtime_get/put_sync). Introduce vendor operations (vops) for SA8255p targets to enable SCMI- based resource control. In this model, capabilities like clock scaling and gating are not yet supported; these will be added incrementally. Co-developed-by: Anjana Hari Signed-off-by: Anjana Hari Co-developed-by: Shazad Hussain Signed-off-by: Shazad Hussain Signed-off-by: Ram Kumar Dwivedi Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260113080046.284089-5-ram.dwivedi@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 26c06d0baeb7999e44cf6717fc12d58a359eba99 Author: Ram Kumar Dwivedi Date: Tue Jan 13 13:30:45 2026 +0530 scsi: ufs: core: Enforce minimum PM level for sysfs configuration Some UFS platforms only support a limited subset of power levels. Currently, the sysfs interface allows users to set any PM level without validating the minimum supported value. If an unsupported level is selected, suspend may fail. Introduce an pm_lvl_min field in the ufs_hba structure and use it to clamp the PM level requested via sysfs so that only supported levels are accepted. Platforms that require a minimum PM level can set this field during probe. Signed-off-by: Ram Kumar Dwivedi Reviewed-by: Manivannan Sadhasivam Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260113080046.284089-4-ram.dwivedi@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit e2725ed2a7fb5f5f468020a52bd9ffc54caa7c8c Author: Ram Kumar Dwivedi Date: Tue Jan 13 13:30:44 2026 +0530 scsi: ufs: dt-bindings: Document bindings for SA8255P UFS Host Controller Document the device tree bindings for UFS host controller on Qualcomm SA8255P platform which integrates firmware-managed resources. The platform firmware implements the SCMI server and manages resources such as the PHY, clocks, regulators and resets via the SCMI power protocol. As a result, the OS-visible DT only describes the controller’s MMIO, interrupt, IOMMU and power-domain interfaces. The generic "qcom,ufshc" and "jedec,ufs-2.0" compatible strings are removed from the binding, since this firmware managed design won't be compatible with the drivers doing full resource management. Co-developed-by: Anjana Hari Signed-off-by: Anjana Hari Signed-off-by: Ram Kumar Dwivedi Reviewed-by: Krzysztof Kozlowski Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260113080046.284089-3-ram.dwivedi@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 7f386b05f994fc08d4e73c0c91b76ab47da36250 Author: Ram Kumar Dwivedi Date: Tue Jan 13 13:30:43 2026 +0530 scsi: MAINTAINERS: Broaden UFS Qualcomm binding file pattern Update the file pattern for UFS Qualcomm devicetree bindings to match all files under 'Documentation/devicetree/bindings/ufs/qcom*' instead of only 'qcom,ufs.yaml'. This ensures maintainers are correctly notified for any related binding changes. Acked-by: Dmitry Baryshkov Reviewed-by: Manivannan Sadhasivam Signed-off-by: Ram Kumar Dwivedi Link: https://patch.msgid.link/20260113080046.284089-2-ram.dwivedi@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 92da3818aaf6dd9c49ef8fdc39c024c76b52cba8 Merge: a9e03ec01ef263 0db3f51839fe70 Author: Martin K. Petersen Date: Fri Jan 23 21:40:33 2026 -0500 Merge patch series "Change the return type of the .queuecommand() callback" Bart Van Assche says: Hi Martin, Most but not all .queuecommand() implementations return a SCSI_MLQUEUE_* constant. This affects code readability: in order to understand what happens if a .queuecommand() function returns a value that is not a SCSI_MLQUEUE_* constant, one has to read the scsi_dispatch_cmd() implementation and check how other values are handled. Hence this patch series that changes the return type of the .queuecommand() callback and also of the implementations of this callback. Please consider this patch series for the next merge window. Thanks, Bart. Link: https://patch.msgid.link/20260115210357.2501991-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 0db3f51839fe703173966f34a4327e3a0c7cc089 Author: Bart Van Assche Date: Thu Jan 15 13:03:41 2026 -0800 scsi: Change the return type of the .queuecommand() callback In clang version 21.1 and later the -Wimplicit-enum-enum-cast warning option has been introduced. This warning is enabled by default and can be used to catch .queuecommand() implementations that return another value than 0 or one of the SCSI_MLQUEUE_* constants. Hence this patch that changes the return type of the .queuecommand() implementations from 'int' into 'enum scsi_qc_status'. No functionality has been changed. Cc: Damien Le Moal Cc: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260115210357.2501991-6-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 5612404d026d349278e6eb3b1ee55bd60b38ae3c Author: Bart Van Assche Date: Thu Jan 15 13:03:40 2026 -0800 scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static Prevent that a later patch that modifies the qla2xxx_mqueuecommand() declaration triggers the following checkpatch warning: "externs should be avoided in .c files". Cc: Nilesh Javali Cc: GR-QLogic-Storage-Upstream@marvell.com Signed-off-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/20260115210357.2501991-5-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit a784911099b1602db1074377dd2ac9c76296b5e3 Author: Bart Van Assche Date: Thu Jan 15 13:03:39 2026 -0800 scsi: megaraid_sas: Return SCSI_MLQUEUE_HOST_BUSY instead of 1 .queuecommand() implementations are expected to return a SCSI_MLQUEUE_* value. Return SCSI_MLQUEUE_HOST_BUSY from megaraid_queue_command_lck() instead of 1. This patch doesn't change any functionality since scsi_dispatch_cmd() converts all return values other than SCSI_MLQUEUE_* into SCSI_MLQUEUE_HOST_BUSY. Cc: Kashyap Desai Cc: Sumit Saxena Cc: Shivasharan S Cc: Chandrakanth patil Cc: megaraidlinux.pdl@broadcom.com Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260115210357.2501991-4-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit a9fe8cab1283f55dbe1dd8b176e70992623e4dc2 Author: Bart Van Assche Date: Thu Jan 15 13:03:38 2026 -0800 scsi: megaraid: Return SCSI_MLQUEUE_HOST_BUSY instead of 1 .queuecommand() implementations are expected to return a SCSI_MLQUEUE_* value. Return SCSI_MLQUEUE_HOST_BUSY from megaraid_queue_lck() instead of 1. This patch doesn't change any functionality since scsi_dispatch_cmd() converts all return values other than SCSI_MLQUEUE_* into SCSI_MLQUEUE_HOST_BUSY. Cc: Kashyap Desai Cc: Sumit Saxena Cc: Shivasharan S Cc: Chandrakanth patil Cc: megaraidlinux.pdl@broadcom.com Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260115210357.2501991-3-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 1bf0febfb2621d30c36af05f0f5e47e01a8bf060 Author: Bart Van Assche Date: Thu Jan 15 13:03:37 2026 -0800 scsi: aha152x: Return SCSI_MLQUEUE_HOST_BUSY instead of 0x2003 .queuecommand() implementations are expected to return a SCSI_MLQUEUE_* value. Return SCSI_MLQUEUE_HOST_BUSY from aha152x_internal_queue() instead of 0x2003. This patch doesn't change any functionality since scsi_dispatch_cmd() converts all return values other than SCSI_MLQUEUE_* into SCSI_MLQUEUE_HOST_BUSY. Cc: Juergen E. Fischer Signed-off-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/20260115210357.2501991-2-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 58d26d42818c0f8c9b334cc7cf318b43046e675f Author: Alexandre Courbot Date: Thu Jan 22 16:28:46 2026 -0600 gpu: nova-core: align LibosMemoryRegionInitArgument size to page size On Turing and GA100 (i.e. the versions that use Libos v2), GSP-RM insists that the 'size' parameter of the LibosMemoryRegionInitArgument struct be aligned to 4KB. The logging buffers are already aligned to that size, so only the GSP_ARGUMENTS_CACHED struct needs to be adjusted. Make that adjustment by adding padding to the end of the struct. Signed-off-by: Timur Tabi Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-12-ttabi@nvidia.com [acourbot@nvidia.com: GspArgumentsAligned -> GspArgumentsPadded] Signed-off-by: Alexandre Courbot commit dbfb5aa41f16484e5a5971571739e7ae80f5e32c Author: Timur Tabi Date: Thu Jan 22 16:28:45 2026 -0600 gpu: nova-core: add FalconUCodeDescV2 support The FRTS firmware in Turing and GA100 VBIOS has an older header format (v2 instead of v3). To support both v2 and v3 at runtime, add the FalconUCodeDescV2 struct, and update code that references the FalconUCodeDescV3 directly with a FalconUCodeDesc enum that encapsulates both. Signed-off-by: Timur Tabi Reviewed-by: Joel Fernandes Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-11-ttabi@nvidia.com Signed-off-by: Alexandre Courbot commit ab2aad252fe21347674cf969a5e9d44d69e403bb Author: Timur Tabi Date: Thu Jan 22 16:28:44 2026 -0600 gpu: nova-core: add Falcon HAL method load_method() Some GPUs do not support using DMA to transfer code/data from system memory to Falcon memory, and instead must use programmed I/O (PIO). Add a function to the Falcon HAL to indicate whether a given GPU's Falcons support DMA for this purpose. Signed-off-by: Timur Tabi Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-10-ttabi@nvidia.com [acourbot@nvidia.com: add short code to call into the HAL.] [acourbot@nvidia.com: make `dma_load` private as per feedback.] Signed-off-by: Alexandre Courbot commit 3be458a5a7ed57cb874474aee7929daed0d5d3aa Author: Gary Guo Date: Fri Jan 23 17:58:40 2026 +0000 rust: samples: driver-core: remove redundant `.as_ref()` for `dev_*` print This is now handled by the macro itself. Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260123175854.176735-3-gary@kernel.org Signed-off-by: Danilo Krummrich commit 600de1c008b2302b56d69ff27d12a9d8d14892ac Author: Gary Guo Date: Fri Jan 23 17:58:39 2026 +0000 rust: pci: remove redundant `.as_ref()` for `dev_*` print This is now handled by the macro itself. Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260123175854.176735-2-gary@kernel.org Signed-off-by: Danilo Krummrich commit a38cd1fea98990e20021823cea251e6cb088eeab Author: Gary Guo Date: Fri Jan 23 17:58:38 2026 +0000 rust: device: support `dev_printk` on all devices Currently, `dev_*` only works on the core `Device`, but not on any other bus or class device objects. This causes a pattern of `dev_info!(pdev.as_ref())` which is not ideal. This adds support of using these devices directly with `dev_*` macros, by adding `AsRef` call inside the macro. To make sure we can still use just `kernel::device::Device`, as `AsRef` implementation is added for it; this is typical for types that is designed to use with `AsRef` anyway, for example, `str` implements `AsRef` and `Path` implements `AsRef`. Signed-off-by: Gary Guo Link: https://patch.msgid.link/20260123175854.176735-1-gary@kernel.org Signed-off-by: Danilo Krummrich commit 8754dd7639ab0fd68c3ab9d91c7bdecc3e5740a8 Author: Manikanta Maddireddy Date: Thu Jan 8 11:57:47 2026 +0530 PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions struct configfs_item_operations callbacks are defined like the following: int (*allow_link)(struct config_item *src, struct config_item *target); void (*drop_link)(struct config_item *src, struct config_item *target); While pci_primary_epc_epf_link() and pci_secondary_epc_epf_link() specify the parameters in the correct order, pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink() specify the parameters in the wrong order, leading to the below kernel crash when using the unlink command in configfs: Unable to handle kernel paging request at virtual address 0000000300000857 Mem abort info: ... pc : string+0x54/0x14c lr : vsnprintf+0x280/0x6e8 ... string+0x54/0x14c vsnprintf+0x280/0x6e8 vprintk_default+0x38/0x4c vprintk+0xc4/0xe0 pci_epf_unbind+0xdc/0x108 configfs_unlink+0xe0/0x208+0x44/0x74 vfs_unlink+0x120/0x29c __arm64_sys_unlinkat+0x3c/0x90 invoke_syscall+0x48/0x134 do_el0_svc+0x1c/0x30prop.0+0xd0/0xf0 Fixes: e85a2d783762 ("PCI: endpoint: Add support in configfs to associate two EPCs with EPF") Signed-off-by: Manikanta Maddireddy [mani: cced stable, changed commit message as per https://lore.kernel.org/linux-pci/aV9joi3jF1R6ca02@ryzen] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Cassel Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260108062747.1870669-1-mmaddireddy@nvidia.com commit a75718afc9a5c61d9266d5d0010228a6a3bb7233 Author: Timur Tabi Date: Thu Jan 22 16:28:43 2026 -0600 gpu: nova-core: add NV_PFALCON_FALCON_ENGINE::reset_engine() Add a method for the NV_PFALCON_FALCON_ENGINE register that reset the Falcon, and update the reset_eng() HAL functions to use it. Signed-off-by: Timur Tabi Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-9-ttabi@nvidia.com Signed-off-by: Alexandre Courbot commit 954b38fd0a8f5feaa44a9c5c05ed771815949d95 Author: Timur Tabi Date: Thu Jan 22 16:28:42 2026 -0600 gpu: nova-core: Add basic Turing HAL Add the basic HAL for recognizing Turing GPUs. This isn't enough to support booting GSP-RM on Turing, but it's a start. Note that GA100, which boots using the same method as Turing, is not supported yet. Signed-off-by: Timur Tabi Reviewed-by: John Hubbard Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-8-ttabi@nvidia.com Signed-off-by: Alexandre Courbot commit 82ed3243219d160601fdb98742633bee7dc6f360 Author: Timur Tabi Date: Thu Jan 22 16:28:41 2026 -0600 gpu: nova-core: move some functions into the HAL A few Falcon methods are actually GPU-specific, so move them into the HAL. Signed-off-by: Timur Tabi Reviewed-by: John Hubbard Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-7-ttabi@nvidia.com Signed-off-by: Alexandre Courbot commit f6507640b0cddfd90d398e3996321b1a735f98be Author: Timur Tabi Date: Thu Jan 22 16:28:40 2026 -0600 gpu: nova-core: add NV_PFALCON_FALCON_DMATRFCMD::with_falcon_mem() The with_falcon_mem() method initializes the 'imem' and 'sec' fields of the NV_PFALCON_FALCON_DMATRFCMD register based on the value of the FalconMem type. Signed-off-by: Timur Tabi Reviewed-by: John Hubbard Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-6-ttabi@nvidia.com Signed-off-by: Alexandre Courbot commit 121ea04cd9f22ae8fb405d4929f6a7faefefe553 Author: Timur Tabi Date: Thu Jan 22 16:28:39 2026 -0600 gpu: nova-core: add support for Turing/GA100 fwsignature Turing and GA100 share the same GSP-RM firmware binary, but the signature ELF section is labeled either ".fwsignature_tu10x" or ".fwsignature_tu11x". Signed-off-by: Timur Tabi Reviewed-by: John Hubbard Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-5-ttabi@nvidia.com Signed-off-by: Alexandre Courbot commit a65fc53d47c05802feb4ca98f26a54251ef65cfa Author: Timur Tabi Date: Thu Jan 22 16:28:38 2026 -0600 gpu: nova-core: support header parsing on Turing/GA100 The Turing/GA100 version of Booter is slightly different from the GA102+ version. The headers are the same, but different fields of the headers are used to identify the IMEM section. In addition, there is an NMEM section on Turing/GA100. Signed-off-by: Timur Tabi Reviewed-by: John Hubbard Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-4-ttabi@nvidia.com Signed-off-by: Alexandre Courbot commit b72cb7bcc20c3a0d7fc29590a6e85de3dfbe9eff Author: Timur Tabi Date: Thu Jan 22 16:28:37 2026 -0600 gpu: nova-core: add ImemNonSecure section infrastructure The GSP booter firmware in Turing and GA100 includes a third memory section called ImemNonSecure, which is non-secure IMEM. This section must be loaded separately from DMEM and secure IMEM, but only if it actually exists. Signed-off-by: Timur Tabi Reviewed-by: John Hubbard Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-3-ttabi@nvidia.com [acourbot@nvidia.com: add `debug_assert`.] Signed-off-by: Alexandre Courbot commit 95d848dc7e639988dbb385a8cba9b484607cf98c Author: Vasiliy Kovalev Date: Sat Jan 24 01:28:01 2026 +0300 KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Add SRCU read-side protection when reading PDPTR registers in __get_sregs2(). Reading PDPTRs may trigger access to guest memory: kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() -> kvm_vcpu_read_guest_page() -> kvm_vcpu_gfn_to_memslot() kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(), which uses srcu_dereference_check() and requires either kvm->srcu or kvm->slots_lock to be held. Currently only vcpu->mutex is held, triggering lockdep warning: ============================= WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot 6.12.59+ #3 Not tainted include/linux/kvm_host.h:1062 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz.5.1717/15100: #0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x1d5/0x1590 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x1e3/0x270 kernel/locking/lockdep.c:6824 __kvm_memslots include/linux/kvm_host.h:1062 [inline] __kvm_memslots include/linux/kvm_host.h:1059 [inline] kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline] kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617 kvm_vcpu_read_guest_page+0x27/0x50 virt/kvm/kvm_main.c:3302 load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065 svm_cache_reg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688 kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline] __get_sregs2 arch/x86/kvm/x86.c:11784 [inline] kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279 kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Suggested-by: Sean Christopherson Cc: stable@vger.kernel.org Fixes: 6dba94035203 ("KVM: x86: Introduce KVM_GET_SREGS2 / KVM_SET_SREGS2") Signed-off-by: Vasiliy Kovalev Link: https://patch.msgid.link/20260123222801.646123-1-kovalev@altlinux.org Signed-off-by: Sean Christopherson commit 0975002be52bd21196b868707ed1415cf1c45b98 Author: Timur Tabi Date: Thu Jan 22 16:28:36 2026 -0600 gpu: nova-core: rename Imem to ImemSecure Rename FalconMem::Imem to ImemSecure to indicate that it references Secure Instruction Memory. This change has no functional impact. On Falcon cores, pages in instruction memory can be tagged as Secure or Non-Secure. For GA102 and later, only Secure is used, which is why FalconMem::Imem seems appropriate. However, Turing firmware images can also contain non-secure sections, and so FalconMem needs to support that. By renaming Imem to ImemSec now, future patches for Turing support will be simpler. Nouveau uses the term "IMEM" to refer both to the Instruction Memory block on Falcon cores as well as to the images of secure firmware uploaded to part of IMEM. OpenRM uses the terms "ImemSec" and "ImemNs" instead, and uses "IMEM" just to refer to the physical memory device. Renaming these terms allows us to align with OpenRM, avoid confusion between IMEM and ImemSec, and makes future patches simpler. Signed-off-by: Timur Tabi Reviewed-by: John Hubbard Reviewed-by: Gary Guo Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260122222848.2555890-2-ttabi@nvidia.com Signed-off-by: Alexandre Courbot commit 4f5e8e6f012349a107531b02eed5b5ace6181449 Author: Ojaswin Mujoo Date: Fri Jan 23 11:55:39 2026 +0530 et4: allow zeroout when doing written to unwritten split Currently, when we are doing an extent split and convert operation of written to unwritten extent (example, as done by ZERO_RANGE), we don't allow the zeroout fallback in case the extent tree manipulation fails. This is mostly because zeroout might take unsually long and the fact that this code path is more tolerant to failures than endio. Since we have zeroout machinery in place, we might as well use it hence lift this restriction. To mitigate zeroout taking too long respect the max zeroout limit here so that the operation finishes relatively fast. Also, add kunit tests for this case. Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Signed-off-by: Ojaswin Mujoo Link: https://patch.msgid.link/1c3349020b8e098a63f293b84bc8a9b56011cef4.1769149131.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 716b9c23b86240d419a43c1f211c628ac04acb8f Author: Ojaswin Mujoo Date: Fri Jan 23 11:55:38 2026 +0530 ext4: refactor split and convert extents ext4_split_convert_extents() has been historically prone to subtle bugs and inconsistent behavior due to the way all the various flags interact with the extent split and conversion process. For example, callers like ext4_convert_unwritten_extents_endio() and convert_initialized_extents() needed to open code extent conversion despite passing CONVERT or CONVERT_UNWRITTEN flags because ext4_split_convert_extents() wasn't performing the conversion. Hence, refactor ext4_split_convert_extents() to clearly enforce the semantics of each flag. The major changes here are: * Clearly separate the split and convert process: * ext4_split_extent() and ext4_split_extent_at() are now only responsible to perform the split. * ext4_split_convert_extents() is now responsible to perform extent conversion after calling ext4_split_extent() for splitting. * This helps get rid of all the MARK_UNWRIT* flags. * Clearly enforce the semantics of flags passed to ext4_split_convert_extents(): * EXT4_GET_BLOCKS_CONVERT: Will convert the split extent to written * EXT4_GET_BLOCKS_CONVERT_UNWRITTEN: Will convert the split extent to unwritten * Modify all callers to enforce the above semantics. * Use ext4_split_convert_extents() instead of ext4_split_extents() in ext4_ext_convert_to_initialized() for uniformity. * Now that ext4_split_convert_extents() is handling caching to es, we dont need to do it in ext4_split_extent_zeroout(). * Cleanup all callers open coding the conversion logic. Further, modify kuniy tests to pass flags based on the new semantics. >From an end user point of view, we should not see any changes in behavior of ext4. Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Signed-off-by: Ojaswin Mujoo Link: https://patch.msgid.link/2084a383d69ceefbaa293b8fcf725365eca0a349.1769149131.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit a985e07c264552d0aa7c019ca54d075414c56620 Author: Ojaswin Mujoo Date: Fri Jan 23 11:55:37 2026 +0530 ext4: refactor zeroout path and handle all cases Currently, zeroout is used as a fallback in case we fail to split/convert extents in the "traditional" modify-the-extent-tree way. This is essential to mitigate failures in critical paths like extent splitting during endio. However, the logic is very messy and not easy to follow. Further, the fragile use of various flags has made it prone to errors. Refactor zeroout out logic by moving it up to ext4_split_extents(). Further, zeroout correctly based on the type of conversion we want, ie: - unwritten to written: Zeroout everything around the mapped range. - written to unwritten: Zeroout only the mapped range. Also, ext4_ext_convert_to_initialized() now passes EXT4_GET_BLOCKS_CONVERT to make the intention clear. Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Ojaswin Mujoo Link: https://patch.msgid.link/e1b51dedeca7c0b1f702141d91edfe4230560e7b.1769149131.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 6066990c99c48d8955eb4b467c11e14daa8d5ec4 Author: Ojaswin Mujoo Date: Fri Jan 23 11:55:36 2026 +0530 ext4: propagate flags to ext4_convert_unwritten_extents_endio() Currently, callers like ext4_convert_unwritten_extents() pass EXT4_EX_NOCACHE flag to avoid caching extents however this is not respected by ext4_convert_unwritten_extents_endio(). Hence, modify it to accept flags from the caller and to pass the flags on to other extent manipulation functions it calls. This makes sure the NOCACHE flag is respected throughout the code path. Also, since the caller already passes METADATA_NOFAIL and CONVERT flags we don't need to explicitly pass it anymore. Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Signed-off-by: Ojaswin Mujoo Link: https://patch.msgid.link/7c2139e0ad32c49c19b194f72219e15d613de284.1769149131.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 3fffa44b6ebf65be92a562a5063303979385a1c9 Author: Ojaswin Mujoo Date: Fri Jan 23 11:55:35 2026 +0530 ext4: propagate flags to convert_initialized_extent() Currently, ext4_zero_range passes EXT4_EX_NOCACHE flag to avoid caching extents however this is not respected by convert_initialized_extent(). Hence, modify it to accept flags from the caller and to pass the flags on to other extent manipulation functions it calls. This makes sure the NOCACHE flag is respected throughout the code path. Also, we no longer explicitly pass CONVERT_UNWRITTEN as the caller takes care of this. Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Ojaswin Mujoo Link: https://patch.msgid.link/07008fbb14db727fddcaf4c30e2346c49f6c8fe0.1769149131.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 82f80e2e3b23ef7ecdef0a494f7f310a1b1702e4 Author: Ojaswin Mujoo Date: Fri Jan 23 11:55:34 2026 +0530 ext4: add extent status cache support to kunit tests Add support in Kunit tests to ensure that the extent status cache is also in sync after the extent split and conversion operations. Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Ojaswin Mujoo Link: https://patch.msgid.link/5f9d2668feeb89a3f3e9d03dadab8c10cbea3741.1769149131.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 4dff18488fe22b743d6e2ee32ca4a533ea237454 Author: Ojaswin Mujoo Date: Fri Jan 23 11:55:33 2026 +0530 ext4: kunit tests for higher level extent manipulation functions Add more kunit tests to cover the high level caller ext4_map_create_blocks(). We pass flags in a manner that covers the below function: 1. ext4_ext_handle_unwritten_extents() 1.1 - Split/Convert unwritten extent to written in endio convtext. 1.2 - Split/Convert unwritten extent to written in non endio context. 1.3 - Zeroout tests for the above 2 cases 2. convert_initialized_extent() - Convert written extent to unwritten during zero range Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Ojaswin Mujoo Link: https://patch.msgid.link/9d8ad32cb62f44999c0fe3545b44fc3113546c70.1769149131.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit cb1e0c1d1fad5bfad90d80c74ebdb53796d8a2db Author: Ojaswin Mujoo Date: Fri Jan 23 11:55:32 2026 +0530 ext4: kunit tests for extent splitting and conversion Add multiple KUnit tests to test various permutations of extent splitting and conversion. We test the following cases: 1. Split of unwritten extent into 2 parts and convert 1 part to written 2. Split of unwritten extent into 3 parts and convert 1 part to written 3. Split of written extent into 2 parts and convert 1 part to unwritten 4. Split of written extent into 3 parts and convert 1 part to unwritten 5. Zeroout fallback for all the above cases except 3-4 because zeroout is not supported for written to unwritten splits The main function we test here is ext4_split_convert_extents(). Currently some of the tests are failing due to issues in implementation. All failures are mitigated at other layers in ext4 [1] but still point out the mismatch in expectation of what the caller wants vs what the function does. The aim is to eventually fix all the failures we see here. More detailed implementation notes can be found in the topmost commit in the test file. [1] for example, EXT4_GET_BLOCKS_CONVERT doesn't really convert the split extent to written, but rather the callers end up doing the conversion. Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Ojaswin Mujoo Link: https://patch.msgid.link/22bb9d17cd88c1318a2edde48887ca7488cb8a13.1769149131.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 3f7938b1aec7f06d5b23adca83e4542fcf027001 Merge: 914c743509d560 bc62f5b308cbde Author: Dave Jiang Date: Fri Jan 23 14:13:16 2026 -0700 Merge branch 'for-7.0/cxl-init' into cxl-for-next Merge in patches to support several patch series such as Soft Reserve handling, type2 accelerator enabling, and LSA 2.1 labeling support. Mainly addition of cxl_memdev_attach() to allow the memdev probe to make a decision of proceed/fail depending success of CXL topology enumeration. dax/hmem, e820, resource: Defer Soft Reserved insertion until hmem is ready cxl/mem: Introduce cxl_memdev_attach for CXL-dependent operation cxl/mem: Drop @host argument to devm_cxl_add_memdev() cxl/mem: Convert devm_cxl_add_memdev() to scope-based-cleanup cxl/port: Arrange for always synchronous endpoint attach cxl/mem: Arrange for always-synchronous memdev attach cxl/mem: Fix devm_cxl_memdev_edac_release() confusion commit 816095894c0f44aaba4372d92c874121af687596 Author: Jens Axboe Date: Fri Jan 23 13:58:03 2026 -0700 io_uring/io-wq: handle !sysctl_hung_task_timeout_secs If the hung_task_timeout sysctl is set to 0, then we'll end up busy looping inside io_wq_exit_workers() after an earlier commit switched to using wait_for_completion_timeout(). Use the maximum schedule timeout value for that case. Fixes: 1f293098a313 ("io_uring/io-wq: don't trigger hung task for syzbot craziness") Reported-by: Chris Mason Signed-off-by: Jens Axboe commit 9635c586a559ba0e45b2bfbff79c937ddbaf1a62 Author: Rafael J. Wysocki Date: Tue Jan 20 16:23:41 2026 +0100 thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature After commit be0a3600aa1e ("thermal: sysfs: Rework the handling of trip point updates"), THERMAL_TEMP_INVALID can be passed to sys_set_trip_temp() and it is treated as a regular temperature value there, so the sysfs write fails even though it is expected to succeed and disable the given trip point. Address this by making sys_set_trip_temp() clear its temp variable when it is equal to THERMAL_TEMP_INVALID. Fixes: be0a3600aa1e ("thermal: sysfs: Rework the handling of trip point updates") Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2815400.mvXUDI8C0e@rafael.j.wysocki commit 475ca3470b3739150720f1b285646de38103e7b7 Author: Rafael J. Wysocki Date: Wed Jan 14 20:45:30 2026 +0100 cpuidle: governors: teo: Refine tick_intercepts vs total events check Use 2/3 as the proportion coefficient in the check comparing cpu_data->tick_intercepts with cpu_data->total because it is close enough to the current one (5/8) and it allows of more straightforward interpretation (on average, intercepts within the tick period length are twice as frequent as other events). Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/10793374.nUPlyArG6x@rafael.j.wysocki commit 60836533b4c7b69e6cb815c87f089e39c2878acd Author: Rafael J. Wysocki Date: Wed Jan 14 20:44:53 2026 +0100 cpuidle: governors: teo: Avoid fake intercepts produced by tick Tick wakeups can lead to fake intercepts that may skew idle state selection towards shallow states, so it is better to avoid counting them as intercepts. For this purpose, add a check causing teo_update() to only count tick wakeups as intercepts if intercepts within the tick period range are at least twice as frequent as any other events. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/3404606.44csPzL39Z@rafael.j.wysocki commit 4bd2221f231d798b01027367857d9ba2f24f6ea0 Author: Rafael J. Wysocki Date: Wed Jan 14 20:44:04 2026 +0100 cpuidle: governors: teo: Avoid selecting states with zero-size bins If the last two enabled idle states have the same target residency which is at least equal to TICK_NSEC, teo may select the next-to-last one even though the size of that state's bin is 0, which is confusing. Prevent that from happening by adding a target residency check to the relevant code path. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle [ rjw: Fixed a typo in the changelog ] Link: https://patch.msgid.link/3033265.e9J7NaK4W3@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit e62e48adf76cc4432c6d749a940da8649f8cb5a7 Author: Zhi Wang Date: Wed Jan 21 22:22:11 2026 +0200 sample: rust: pci: add tests for config space routines Add tests exercising the PCI configuration space helpers. Suggested-by: Danilo Krummrich Signed-off-by: Zhi Wang Reviewed-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260121202212.4438-6-zhiw@nvidia.com Signed-off-by: Danilo Krummrich commit 4dc0bacb1d3c4722cbd002c4aab6bd458d30d869 Author: Zhi Wang Date: Wed Jan 21 22:22:10 2026 +0200 rust: pci: add config space read/write support Drivers might need to access PCI config space for querying capability structures and access the registers inside the structures. For Rust drivers need to access PCI config space, the Rust PCI abstraction needs to support it in a way that upholds Rust's safety principles. Introduce a `ConfigSpace` wrapper in Rust PCI abstraction to provide safe accessors for PCI config space. The new type implements the `Io` trait and `IoCapable` for u8, u16, and u32 to share offset validation and bound-checking logic with other I/O backends. The `ConfigSpace` type uses marker types (`Normal` and `Extended`) to represent configuration space sizes at the type level. Cc: Alexandre Courbot Cc: Danilo Krummrich Cc: Gary Guo Cc: Joel Fernandes Signed-off-by: Zhi Wang Reviewed-by: Gary Guo Link: https://lore.kernel.org/all/DFV4IJDQC2J6.1Q91JOAL6CJSG@kernel.org/ [1] Link: https://patch.msgid.link/20260121202212.4438-5-zhiw@nvidia.com [ Applied the diff from [1], considering subsequent comment; remove #[expect(unused)] from define_{read,write}!(). - Danilo ] Signed-off-by: Danilo Krummrich commit 80606f4eb8d7484ab7f7d6f0fd30d71e6fbcf328 Author: Rafael J. Wysocki Date: Tue Jan 20 16:26:14 2026 +0100 cpuidle: governors: menu: Always check timers with tick stopped After commit 5484e31bbbff ("cpuidle: menu: Skip tick_nohz_get_sleep_length() call in some cases"), if the return value of get_typical_interval() multiplied by NSEC_PER_USEC is not greater than RESIDENCY_THRESHOLD_NS, the menu governor will skip computing the time till the closest timer. If that happens when the tick has been stopped already, the selected idle state may be too deep due to the subsequent check comparing predicted_ns with TICK_NSEC and causing its value to be replaced with the expected time till the closest timer, which is KTIME_MAX in that case. That will cause the deepest enabled idle state to be selected, but the time till the closest timer very well may be shorter than the target residency of that state, in which case a shallower state should be used. Address this by making menu_select() always compute the time till the closest timer when the tick has been stopped. Also move the predicted_ns check mentioned above into the branch in which the time till the closest timer is determined because it only needs to be done in that case. Fixes: 5484e31bbbff ("cpuidle: menu: Skip tick_nohz_get_sleep_length() call in some cases") Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/5959091.DvuYhMxLoT@rafael.j.wysocki commit 5981d03c27a14df1c03e10570eeb1ab26e9709f7 Author: Zhi Wang Date: Wed Jan 21 22:22:09 2026 +0200 rust: io: factor out MMIO read/write macros Refactor the existing MMIO accessors to use common call macros instead of inlining the bindings calls in each `define_{read,write}!` expansion. This factoring separates the common offset/bounds checks from the low-level call pattern, making it easier to add additional I/O accessor families. No functional change intended. Cc: Alexandre Courbot Signed-off-by: Zhi Wang Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260121202212.4438-4-zhiw@nvidia.com Signed-off-by: Danilo Krummrich commit 121d87b28e1d9061d3aaa156c43a627d3cb5e620 Author: Zhi Wang Date: Wed Jan 21 22:22:08 2026 +0200 rust: io: separate generic I/O helpers from MMIO implementation The previous Io type combined both the generic I/O access helpers and MMIO implementation details in a single struct. This coupling prevented reusing the I/O helpers for other backends, such as PCI configuration space. Establish a clean separation between the I/O interface and concrete backends by separating generic I/O helpers from MMIO implementation. Introduce a new trait hierarchy to handle different access capabilities: - IoCapable: A marker trait indicating that a backend supports I/O operations of a certain type (u8, u16, u32, or u64). - Io trait: Defines fallible (try_read8, try_write8, etc.) and infallibile (read8, write8, etc.) I/O methods with runtime bounds checking and compile-time bounds checking. - IoKnownSize trait: The marker trait for types support infallible I/O methods. Move the MMIO-specific logic into a dedicated Mmio type that implements the Io traits. Rename IoRaw to MmioRaw and update consumers to use the new types. Cc: Alexandre Courbot Cc: Alice Ryhl Cc: Bjorn Helgaas Cc: Gary Guo Cc: Danilo Krummrich Cc: John Hubbard Signed-off-by: Zhi Wang Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260121202212.4438-3-zhiw@nvidia.com [ Add #[expect(unused)] to define_{read,write}!(). - Danilo ] Signed-off-by: Danilo Krummrich commit 5ec66bbc74883b73d169ceb25dcb7a5cb22e275b Author: Deborah Brouwer Date: Fri Jan 23 09:52:35 2026 -0800 drm/tyr: suppress unread field warnings Currently the rust compiler warns that certain fields in the TyrDriver are 'never read'. The fields are needed, but they are not read directly, they are only written into an 'impl PinInit' that is returned by probe. When warnings are compiled as errors, these warnings prevent Tyr from building. Suppress the warnings by adding underscores to the problematic variables. This allows Tyr to build again. Signed-off-by: Deborah Brouwer Link: https://patch.msgid.link/20260123175235.209092-1-deborah.brouwer@collabora.com Signed-off-by: Alice Ryhl commit 3d06db9bad1ad8e67c3981964cfba224c07fc306 Author: Ian Rogers Date: Tue Jan 20 18:17:35 2026 -0800 perf regs: Refactor use of arch__sample_reg_masks() to perf_reg_name() arch__sample_reg_masks isn't supported on ARM(32), csky, loongarch, MIPS, RISC-V and s390. The table returned by the function just has the name of a register paired with the corresponding sample_regs_user mask value. For a given perf register we can compute the name with perf_reg_name and the mask is just 1 left-shifted by the perf register number. Change __parse_regs to use this method for finding registers rather than arch__sample_reg_masks, thereby adding __parse_regs support for ARM(32), csky, loongarch, MIPS, RISC-V and s390. As arch__sample_reg_masks is then unused, remove the now unneeded declarations. Signed-off-by: Ian Rogers Tested-by: Thomas Richter Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit f0d98c78f8bf73ce2a9b7793f66cda240fa9ab10 Author: Suchit Karunakaran Date: Thu Jan 22 22:47:04 2026 +0530 perf annotate: Fix memcpy size in arch__grow_instructions() The memcpy() in arch__grow_instructions() is copying the wrong number of bytes when growing from a non-allocated table. It should copy arch->nr_instructions * sizeof(struct ins) bytes, not just arch->nr_instructions bytes. This bug causes data corruption as only a partial copy of the instruction table is made, leading to garbage data in most entries and potential crashes Fixes: 2a1ff812c40be982 ("perf annotate: Introduce alternative method of keeping instructions table") Reviewed-by: Ian Rogers Signed-off-by: Suchit Karunakaran Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit c5e47e4d00fbc15f2390bb6ed8d9c21836363291 Author: Ian Rogers Date: Thu Jan 22 09:53:37 2026 -0800 perf tests sched: Avoid error in cleanup on loaded machines The stop_noploops function will kill the noploop processes that are running for 10 seconds. On a loaded machine they may have already terminated meaning the kill will return an error of no such process. This doesn't matter and so ignore the error to avoid the test terminating in the cleanup. Fixes: 0e22c5ca44e68798 ("perf test: Add sched latency and script shell tests") Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit e786a04b4a5461dd7e2829422314a5a6d5a664d9 Author: Ian Rogers Date: Thu Jan 22 09:58:46 2026 -0800 perf inject: With --convert-callchain ignore the dummy event for dwarf stacks On hybrid systems there is generally >1 event and a dummy event. The perf inject --convert-callchain option is failing to convert perf.data files on such systems reporting "--convert-callchain requires DWARF call graph." The failing event is the dummy event that doesn't need to be set up for samples. As such ignore this event when checking the evsels. Fixes: 92ea788d2af4e65a ("perf inject: Add --convert-callchain option") Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit dc329efc162ac168e2a0c83d1334608371dd525b Author: Ian Rogers Date: Thu Jan 22 13:35:16 2026 -0800 perf disasm: Minor layout tweaks for 'struct arch' Pack some holes to bring down the overall struct size from 96 to 88 bytes. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit 0e26ba5a87744ee8957cc1f341e403c0fd758398 Author: Ian Rogers Date: Thu Jan 22 13:35:15 2026 -0800 perf disasm: Refactor arch__find and initialization of arch structs Switch arch__find to using an ELF machine number rather than a string. Rather than an array of fixed size arch structs turn the init functions into new functions indexed by the ELF machine they correspond to. This allows data to be stored with a struct arch with the container_of trick, so the priv variable can be removed. Switch to using the thread to find the arch rather than the evsel as the evsel only has limited notions of the running thread upon which disassembly is performed. Factor out the e_machine and e_flags into their own struct to make them easier to pass around. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li [ Include elf.h for EM_CSKY and friends and also conditionally define EM_CSKY_ABIMASK for old distros ] Signed-off-by: Arnaldo Carvalho de Melo commit c4e3a00356fffb20c03bd9609083afb1dc4a2edf Author: Ian Rogers Date: Thu Jan 22 13:35:14 2026 -0800 perf map_symbol: Switch from holding maps to holding thread maps may belong to >1 thread. In contexts like symbolization information from the thread may be useful, such as the ELF machine. As the maps can be gained from the thread switch from holding maps in struct map_symbol to holding the thread. Holding the maps in addr_location is also redundant, switch this to using thread__maps. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit 5301cc698821551b34d0b357cf7842984182b35c Author: Ian Rogers Date: Thu Jan 22 13:35:13 2026 -0800 perf disasm: Refactor ins__is_call/jump to avoid exposing arch ins_ops Add booleans indicating whether and ins_ops are call or jump and return it. This avoids exposing loongarch and s390 ins_ops for the sake of matching. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit 07b972ff09f45cfb7acd20cd9b3769c6975bc434 Author: Ian Rogers Date: Thu Jan 22 13:35:12 2026 -0800 perf disasm: Don't include C files from the arch directory Move the arch instructions.c files into appropriately named files in annotate-arch in the util directory. Don't #include to compile the code, switch to building the files and fix up the #includes accordingly. Move powerpc specific disasm code out of disasm.c and into annotate-powerpc.c. Declarations and static removed as appropriate for the code to compile as separate compilation units. The e_machine and e_flags set up is moved to the disasm.c architectures array so that later patches can sort by them. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit 9273085273103e5994952dc2725f1f0109af97d1 Author: Ian Rogers Date: Thu Jan 22 13:35:11 2026 -0800 perf disasm: Rework the string arch__is to use the ELF machine Add new arch__is_x86 and arch__is_powerpc functions that avoid string comparisons and use the ELF machine. Remove arch__is() that is no longer used. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit 2a1ca20d0b586d582e56fcb615b27045834d415a Author: Ian Rogers Date: Thu Jan 22 13:35:10 2026 -0800 perf disasm: Constify use of 'struct ins' The 'struct ins' holds variables that are read but not written, except during some initialization. Change most uses to be for a "const struct ins *" version to capture this immutability. So the x86__instructions can be const pre-sort it and make the sorted variable true. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit 1e3b91d6c53e2b5e01424511d009b6405d8a4152 Author: Ian Rogers Date: Thu Jan 22 13:35:09 2026 -0800 perf disasm: Constify use of 'struct ins_op' The 'struct ins_op' holds variables to function pointers that are read but not written. Change uses to be for a "const struct ins_op *" version to capture this immutability. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit 57d26593a92fdeaca5adcbbb5362fa13d5dd7540 Author: Ian Rogers Date: Thu Jan 22 13:35:08 2026 -0800 perf disasm: Constify use of 'struct arch' The 'struct arch' holds variables that are read but not written, except during some initialization. Change most uses to be for a "const struct arch *" version to capture this immutability. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit 6fdd2676db55b503c52dd3f1359b5c57f774ab75 Author: Ian Rogers Date: Thu Jan 22 13:35:07 2026 -0800 perf maps: Fix reference count leak in maps__find_ams() ams and so ams->ms.map is an in argument, however, it is also overwritten. As a map is reference counted, ensure a map__put() is done before overwriting it. Fixes: 42fd623b58dbcc48 ("perf maps: Get map before returning in maps__find") Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit 00419892bac28bf148450d762bbff990a6bd5494 Author: Ian Rogers Date: Thu Jan 22 13:35:06 2026 -0800 perf annotate: Fix args leak of map_symbol map_symbol__exit() needs calling on an annotate_args.ms, however, rather than introduce proper reference count handling to symbol__annotate() just switch to passing the map_symbol pointer parameter around, making the puts the caller's responsibility. Fix a number of cases to ensure the map in a map_symbol has a reference count increment and add the then necessary map_symbol_exits. Fixes: 56e144fe98260a0f ("perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit") Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: linux-arm-kernel@lists.infradead.org Cc: linux-csky@vger.kernel.org Cc: linux-riscv@lists.infradead.org Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit d84f24c898864facc13412a58b78964f6a769d76 Author: Ian Rogers Date: Thu Jan 22 13:35:05 2026 -0800 perf header: Fix memory leaks in process_cpu_domain_info() do_read_string() returns a string in allocated memory, for some reason there was unused memory allocations and unnecessary strdups. Remove these and make the "perf annotate basic tests" leak sanitizer clean. Fixes: d40c68a49f69c9bd ("perf header: Support CPU DOMAIN relation info") Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: linux-arm-kernel@lists.infradead.org Cc: linux-csky@vger.kernel.org Cc: linux-riscv@lists.infradead.org Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Swapnil Sapkal Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo commit eac026ff97a9447d34113dd7c4adbcd185185142 Merge: 6a9e8b60f003e6 db69e9b838c39f Author: Jakub Kicinski Date: Fri Jan 23 11:51:38 2026 -0800 Merge branch 'net-rds-rds-tcp-state-machine-and-message-loss-improvements' Allison Henderson says: ==================== net/rds: RDS-TCP state machine and message loss improvements This is subset 2 of the larger RDS-TCP patch series I posted last Oct. The greater series aims to correct multiple rds-tcp issues that can cause dropped or out of sequence messages. I've broken it down into smaller sets to make reviews more manageable. In this set, we correct a few RDS/TCP connection handling issues, and message loss issues. ==================== Link: https://patch.msgid.link/20260122055213.83608-1-achender@kernel.org Signed-off-by: Jakub Kicinski commit db69e9b838c39f4fb17d0547aeb71d55a7f28061 Author: Gerd Rausch Date: Wed Jan 21 22:52:13 2026 -0700 net/rds: rds_tcp_accept_one ought to not discard messages RDS/TCP differs from RDS/RDMA in that message acknowledgment is done based on TCP sequence numbers: As soon as the last byte of a message has been acknowledged by the TCP stack of a peer, "rds_tcp_write_space()" goes on to discard prior messages from the send queue. Which is fine, for as long as the receiver never throws any messages away. Unfortunately, that is *not* the case since the introduction of MPRDS: commit 1a0e100fb2c96 "RDS: TCP: Enable multipath RDS for TCP" A new function "rds_tcp_accept_one_path" was introduced, which is entitled to return "NULL", if no connection path is currently available. Unfortunately, this happens after the "->accept()" call, and the new socket often already contains messages, since the peer already transitioned to "RDS_CONN_UP" on behalf of "TCP_ESTABLISHED". That's also the case after this [1]: commit 1a0e100fb2c96 "RDS: TCP: Force every connection to be initiated by numerically smaller IP address" which tried to address the situation of pending data by only transitioning connections from a smaller IP address to "RDS_CONN_UP". But even in those cases, and in particular if the "RDS_EXTHDR_NPATHS" handshake has not occurred yet, and therefore we're working with "c_npaths <= 1", "c_conn[0]" may be in a state distinct from "RDS_CONN_DOWN", and therefore all messages on the just accepted socket will be tossed away. This fix changes "rds_tcp_accept_one": * If connected from a peer with a larger IP address, the new socket will continue to get closed right away. With commit [1] above, there should not be any messages in the socket receive buffer, since the peer never transitioned to "RDS_CONN_UP". Therefore it should be okay to not make any efforts to dispatch the socket receive buffer. * If connected from a peer with a smaller IP address, we call "rds_tcp_accept_one_path" to find a free slot/"path". If found, business goes on as usual. If none was found, we save/stash the newly accepted socket into "rds_tcp_accepted_sock", in order to not lose any messages that may have arrived already. We then return from "rds_tcp_accept_one" with "-ENOBUFS". Later on, when a slot/"path" does become available again (e.g. state transitioned to "RDS_CONN_DOWN", or HS extension header was received with "c_npaths > 1") we call "rds_tcp_conn_slots_available" that simply re-issues a "rds_tcp_accept_one_path" worker-callback and picks up the new socket from "rds_tcp_accepted_sock", and thereby continuing where it left with "-ENOBUFS" last time. Since a new slot has become available, those messages won't be lost, since processing proceeds as if that slot had been available the first time around. Signed-off-by: Gerd Rausch Signed-off-by: Jack Vogel Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260122055213.83608-3-achender@kernel.org Signed-off-by: Jakub Kicinski commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da Author: Gerd Rausch Date: Wed Jan 21 22:52:12 2026 -0700 net/rds: No shortcut out of RDS_CONN_ERROR RDS connections carry a state "rds_conn_path::cp_state" and transitions from one state to another and are conditional upon an expected state: "rds_conn_path_transition." There is one exception to this conditionality, which is "RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop" regardless of what state the condition is currently in. But as soon as a connection enters state "RDS_CONN_ERROR", the connection handling code expects it to go through the shutdown-path. The RDS/TCP multipath changes added a shortcut out of "RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING" via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change"). A subsequent "rds_tcp_reset_callbacks" can then transition the state to "RDS_CONN_RESETTING" with a shutdown-worker queued. That'll trip up "rds_conn_init_shutdown", which was never adjusted to handle "RDS_CONN_RESETTING" and subsequently drops the connection with the dreaded "DR_INV_CONN_STATE", which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever. So we do two things here: a) Don't shortcut "RDS_CONN_ERROR", but take the longer path through the shutdown code. b) Add "RDS_CONN_RESETTING" to the expected states in "rds_conn_init_shutdown" so that we won't error out and get stuck, if we ever hit weird state transitions like this again." Signed-off-by: Gerd Rausch Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org Signed-off-by: Jakub Kicinski commit 6a9e8b60f003e66f989097a5928d4ba83360b4ef Merge: 56f9058eb36010 b33006ebb78a5e Author: Jakub Kicinski Date: Fri Jan 23 11:49:58 2026 -0800 Merge branch 'net-restore-the-structure-of-driver-facing-qcfg-api' Jakub Kicinski says: ==================== net: restore the structure of driver-facing qcfg API The goal of qcfg objects is to let us seamlessly support new use cases without modifying all the drivers. We want to pull all the logic of combining configuration supplied via different interfaces into the core and present the drivers with a flat queue-by-queue configuration. Additionally we want to separate the current effective configuration from the user intent (default vs user setting vs memory provider setting). Restructure the recently added code to re-introduce the pieces that are missing compared to the old RFC: https://lore.kernel.org/20250421222827.283737-1-kuba@kernel.org Namely: - the netdev_queue_config() helper - queue config validation callback I hopefully removed all the more "out there" parts of the RFC. ==================== Link: https://patch.msgid.link/20260122005113.2476634-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b33006ebb78a5e2b4bce25d01010e1e420571d5a Author: Jakub Kicinski Date: Wed Jan 21 16:51:13 2026 -0800 eth: bnxt: plug bnxt_validate_qcfg() into qops Plug bnxt_validate_qcfg() back into qops, where it was in my old RFC. Link: https://patch.msgid.link/20260122005113.2476634-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8e3245cb30864f93d7706e03e61ca1972ea4f64c Author: Jakub Kicinski Date: Wed Jan 21 16:51:12 2026 -0800 net: add queue config validation callback I imagine (tm) that as the number of per-queue configuration options grows some of them may conflict for certain drivers. While the drivers can obviously do all the validation locally doing so is fairly inconvenient as the config is fed to drivers piecemeal via different ops (for different params and NIC-wide vs per-queue). Add a centralized callback for validating the queue config in queue ops. The callback gets invoked before memory provider is installed, and in the future should also be called when ring params are modified. The validation is done after each layer of configuration. Since we can't fail MP un-binding we must make sure that the config is valid both before and after MP overrides are applied. This is moot for now since the set of MP and device configs are disjoint. It will matter significantly in the future, so adding it now so that we don't forget.. Link: https://patch.msgid.link/20260122005113.2476634-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fc1a78a25c5e3c92132f2975c7b547e67305fcf4 Author: Jakub Kicinski Date: Wed Jan 21 16:51:11 2026 -0800 net: use netdev_queue_config() for mp restart We should follow the prepare/commit approach for queue configuration. The qcfg struct should be added to dev->cfg rather than directly to queue objects so that we can clone and discard the pending config easily. Remove the qcfg in struct netdev_rx_queue, and switch remaining callers to netdev_queue_config(). netdev_queue_config() will construct the qcfg on the fly based on device defaults and state of the queue. ndo_default_qcfg becomes optional because having the callback itself does not have any meaningful semantics to us. Reviewed-by: Dragos Tatulea Link: https://patch.msgid.link/20260122005113.2476634-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit da7772a2b4ad2ee328b1fbb44e538ed1ce2a766f Author: Jakub Kicinski Date: Wed Jan 21 16:51:10 2026 -0800 net: move mp->rx_page_size validation to __net_mp_open_rxq() Move mp->rx_page_size validation where the rest of MP input validation lives. No other caller is modifying mp params so validation logic in queue restarts is out of place. Link: https://patch.msgid.link/20260122005113.2476634-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b9ac2c60a3ad445fa81289aac5adc06b8c1b1d57 Author: Jakub Kicinski Date: Wed Jan 21 16:51:09 2026 -0800 net: introduce a trivial netdev_queue_config() We may choose to extend or reimplement the logic which renders the per-queue config. The drivers should not poke directly into the queue state. Add a helper for drivers to use when they want to query the config for a specific queue. Link: https://patch.msgid.link/20260122005113.2476634-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1410c7416dc343f15e9b7152eabddbdbe483002d Author: Jakub Kicinski Date: Wed Jan 21 16:51:08 2026 -0800 eth: bnxt: always set the queue mgmt ops Core provides a centralized callback for validating per-queue settings but the callback is part of the queue management ops. Having the ops conditionally set complicates the parts of the driver which could otherwise lean on the core to feed it the correct settings. Always set the queue ops, but provide no restart-related callbacks if queue ops are not supported by the device. This should maintain current behavior, the check in netdev_rx_queue_restart() looks both at op struct and individual ops. Reviewed-by: Subbaraya Sundeep Link: https://patch.msgid.link/20260122005113.2476634-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 56f9058eb3601049c094b76462b77c2ef943100a Merge: 35527de54f6c4e 87db2fdef5a7c2 Author: Jakub Kicinski Date: Fri Jan 23 11:43:31 2026 -0800 Merge branch 'selftest-extend-tun-virtio-coverage-for-gso-over-udp-tunnel' Xu Du says: ==================== selftest: Extend tun/virtio coverage for GSO over UDP tunnel The design strategy is to extend the existing tun testing infrastructure to support this new use-case, rather than introducing a new or parallel framework. This allows for better integration and re-use of existing test logic. ==================== Link: https://patch.msgid.link/cover.1768979440.git.xudu@redhat.com Signed-off-by: Jakub Kicinski commit 87db2fdef5a7c2ea8a404afd402800d48940d6b2 Author: Xu Du Date: Wed Jan 21 18:05:01 2026 +0800 selftest: tun: Add test data for success and failure paths To improve the robustness and coverage of the TUN selftests, this patch expands the set of test data. Signed-off-by: Xu Du Link: https://patch.msgid.link/5054f3ad9f3dbfe33b827183fccc5efeb8fd0da7.1768979440.git.xudu@redhat.com Signed-off-by: Jakub Kicinski commit 6bdd7ae6059ec3c19f4717387706f92cd8b715a6 Author: Xu Du Date: Wed Jan 21 18:05:00 2026 +0800 selftest: tun: Add test for receiving gso packet from tun The test validate that GSO information are correctly exposed when reading packets from a TUN device. Signed-off-by: Xu Du Link: https://patch.msgid.link/fe75ac66466380490eba858eef50596a1bfbd071.1768979440.git.xudu@redhat.com Signed-off-by: Jakub Kicinski commit 400e658aa096cda99b37ce806ed63cfe894c9566 Author: Xu Du Date: Wed Jan 21 18:04:59 2026 +0800 selftest: tun: Add test for sending gso packet into tun The test constructs a raw packet, prepends a virtio_net_hdr, and writes the result to the TUN device. This mimics the behavior of a vm forwarding a guest's packet to the host networking stack. Signed-off-by: Xu Du Link: https://patch.msgid.link/a988dbc9ca109e4f1f0b33858c5035bce8ebede3.1768979440.git.xudu@redhat.com Signed-off-by: Jakub Kicinski commit 24e59f26eef2c806a8dbb94859aaf7af28197148 Author: Xu Du Date: Wed Jan 21 18:04:58 2026 +0800 selftest: tun: Add helpers for GSO over UDP tunnel In preparation for testing GSO over UDP tunnels, enhance the test infrastructure to support a more complex data path involving a TUN device and a GENEVE udp tunnel. This patch introduces a dedicated setup/teardown topology that creates both a GENEVE tunnel interface and a TUN interface. The TUN device acts as the VTEP (Virtual Tunnel Endpoint), allowing it to send and receive virtio-net packets. This setup effectively tests the kernel's data path for encapsulated traffic. Note that after adding a new address to the UDP tunnel, we need to wait a bit until the associated route is available. Additionally, a new data structure is defined to manage test parameters. This structure is designed to be extensible, allowing different test data and configurations to be easily added in subsequent patches. Signed-off-by: Xu Du Link: https://patch.msgid.link/b5787b8c269f43ce11e1756f1691cc7fd9a1e901.1768979440.git.xudu@redhat.com Signed-off-by: Jakub Kicinski commit 82cfdcfa201057861ec8a60ca9354d2c4c67bd68 Author: Xu Du Date: Wed Jan 21 18:04:57 2026 +0800 selftest: tun: Refactor tun_delete to use tuntap_helpers The previous patch introduced common tuntap helpers to simplify tun test code. This patch refactors the tun_delete function to use these new helpers. Signed-off-by: Xu Du Link: https://patch.msgid.link/ecc7c0c2d75d87cb814e97579e731650339703ab.1768979440.git.xudu@redhat.com Signed-off-by: Jakub Kicinski commit a942fcd72e9736a0c49b60160f29dc5bb01d6f89 Author: Xu Du Date: Wed Jan 21 18:04:56 2026 +0800 selftest: tun: Introduce tuntap_helpers.h header for TUN/TAP testing Introduce rtnetlink manipulation and packet construction helpers that will simplify the later creation of more related test cases. This avoids duplicating logic across different test cases. This new header will contain: - YNL-based netlink management utilities. - Helpers for ip link, ip address, ip neighbor and ip route operations. - Packet construction and manipulation helpers. Signed-off-by: Xu Du Link: https://patch.msgid.link/91f905715c69c75f7bf72d43388921fde6c34989.1768979440.git.xudu@redhat.com Signed-off-by: Jakub Kicinski commit e073c118db0217e1dab14eb0088e7c6a8bf9ef63 Author: Xu Du Date: Wed Jan 21 18:04:55 2026 +0800 selftest: tun: Format tun.c existing code In preparation for adding new tests for GSO over UDP tunnels, apply consistently the kernel style to the existing code. Signed-off-by: Xu Du Link: https://patch.msgid.link/d797de1e5a3d215dd78cb46775772ef682bab60e.1768979440.git.xudu@redhat.com Signed-off-by: Jakub Kicinski commit 0496fc9cdc384f67be4413b1c6156eb64fccd5c4 Author: Roberto Sassu Date: Tue Jan 20 15:53:41 2026 +0100 evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() Commit 8e5d9f916a96 ("smack: deduplicate xattr setting in smack_inode_init_security()") introduced xattr_dupval() to simplify setting the xattrs to be provided by the SMACK LSM on inode creation, in the smack_inode_init_security(). Unfortunately, moving lsm_get_xattr_slot() caused the SMACK64TRANSMUTE xattr be added in the array of new xattrs before SMACK64. This causes the HMAC of xattrs calculated by evm_init_hmac() for new files to diverge from the one calculated by both evm_calc_hmac_or_hash() and evmctl. evm_init_hmac() calculates the HMAC of the xattrs of new files based on the order LSMs provide them, while evm_calc_hmac_or_hash() and evmctl calculate the HMAC based on an ordered xattrs list. Fix the issue by making evm_init_hmac() calculate the HMAC of new files based on the ordered xattrs list too. Fixes: 8e5d9f916a96 ("smack: deduplicate xattr setting in smack_inode_init_security()") Signed-off-by: Roberto Sassu Signed-off-by: Mimi Zohar commit 35527de54f6c4eacd3558ff0af071a5b5b2ba4f7 Merge: 8811df1dd4e035 40146bf7555e9c Author: Jakub Kicinski Date: Fri Jan 23 11:31:15 2026 -0800 Merge branch 'geneve-introduce-double-tunnel-gso-gro-support' Paolo Abeni says: ==================== geneve: introduce double tunnel GSO/GRO support This is the [belated] incarnation of topic discussed in the last Neconf [1]. In container orchestration in virtual environments there is a consistent usage of double UDP tunneling - specifically geneve. Such setup lack support of GRO and GSO for inter VM traffic. After commit b430f6c38da6 ("Merge branch 'virtio_udp_tunnel_08_07_2025' of https://github.com/pabeni/linux-devel") and the qemu cunter-part, VMs are able to send/receive GSO over UDP aggregated packets. This series introduces the missing bit for full end-to-end aggregation in the above mentioned scenario. Specifically: - introduces a new netdev feature set to generalize existing per device driver GSO admission check.1 - adds GSO partial support for the geneve and vxlan drivers - introduces and use a geneve option to assist double tunnel GRO - adds some simple functional tests for the above. The new device features set is not strictly needed for the following work, but avoids the introduction of trivial `ndo_features_check` to support GSO partial and thus possible performance regression due to the additional indirect call. Such feature set could be leveraged by a number of existing drivers (intel, meta and possibly wangxun) to avoid duplicate code/tests. Such part has been omitted here to keep the series small. Both GSO partial support and double GRO support have some downsides. With the first in place, GSO partial packets will traverse the network stack 'downstream' the outer geneve UDP tunnel and will be visible by the udp/IP/IPv6 and by netfilter. Currently only H/W NICs implement GSO partial support and such packets are visible only via software taps. Double UDP tunnel GRO will cook 'GSO partial' like aggregate packets, i.e. the inner UDP encapsulation headers set will still carry the wire-level lengths and csum, so that segmentation considering such headers parts of a giant, constant encapsulation header will yield the correct result. The correct GSO packet layout is applied when the packet traverse the outermost geneve encapsulation. Both GSO partial and double UDP encap are disabled by default and must be explicitly enabled via, respectively ethtool and geneve device configuration. Finally note that the GSO partial feature could potentially be applied to all the other UDP tunnels, but this series limits its usage to geneve and vxlan devices. Link: https://netdev.bots.linux.dev/netconf/2024/paolo.pdf [1] ==================== Link: https://patch.msgid.link/cover.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 40146bf7555e9c3480b1225dfe7a5306e1b58b13 Author: Paolo Abeni Date: Wed Jan 21 17:11:36 2026 +0100 selftests: net: tests for add double tunneling GRO/GSO Create a simple, netns-based topology with double, nested UDP tunnels and perform TSO transfers on top. Explicitly enable GSO and/or GRO and check the skb layout consistency with different configuration allowing (or not) GSO frames to be delivered on the other end. The trickest part is account in a robust way the aggregated/unaggregated packets with double encapsulation: use a classic bpf filter for it. Signed-off-by: Paolo Abeni Reviewed-by: Petr Machata Link: https://patch.msgid.link/61f2c98ba0f73057c2d6f6cb62eb807abd90bf6b.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit fd0dd796576e1a560e1441e665810129f0a82be0 Author: Paolo Abeni Date: Wed Jan 21 17:11:35 2026 +0100 geneve: use GRO hint option in the RX path At the GRO stage, when a valid hint option is found, try match the whole nested headers and try to aggregate on the inner protocol; in case of hdr mismatch extract the nested address and port to properly flush on a per-inner flow basis. On GRO completion, the (unmodified) nested headers will be considered part of the (constant) outer geneve encap header so that plain UDP tunnel segmentation will yield valid wire packets. In the geneve RX path, when processing a GSO packet carrying a GRO hint option, update the nested header length fields from the wire packet size to the GSO-packet one. If the nested header additionally carries a checksum, convert it to CSUM-partial. Finally, when the RX path leverages the GRO hints, skip the additional GRO stage done by GRO cells: otherwise the already set skb->encapsulation flag will foul the GRO cells complete step to use touch the innermost IP header when it should update the nested csum, corrupting the packet. Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/4a9a390588a429191e0ffe48ccdd288bb69e567e.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 0eaf63b3fcda14c7badbe7e5ccf6239895a1e5aa Author: Paolo Abeni Date: Wed Jan 21 17:11:34 2026 +0100 geneve: extract hint option at GRO stage Add helpers for finding a GRO hint option in the geneve header, performing basic sanitization of the option offsets vs the actual packet layout, validate the option for GRO aggregation and check the nested header checksum. The validation helper closely mirrors similar check performed by the ipv4 and ipv6 gro callbacks, with the additional twist of accessing the relevant network header via the GRO hint offset. To validate the nested UDP checksum, leverage the csum completed of the outer header, similarly to LCO, with the main difference that in this case we have the outer checksum available. Use the helpers to extract the hint info at the GRO stage. Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/cd0e9dc42ba83f388b604097cffe268ffcb53351.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit e0a12cbf262b92b470b92abc285cec0f3bb6c7ff Author: Paolo Abeni Date: Wed Jan 21 17:11:33 2026 +0100 geneve: add GRO hint output path If a geneve egress packet contains nested UDP encap headers, add a geneve option including the information necessary on the RX side to perform GRO aggregation of the whole packets: the nested network and transport headers, and the nested protocol type. Use geneve option class `netdev`, already registered in the Network Virtualization Overlay (NVO3) IANA registry: https://www.iana.org/assignments/nvo3/nvo3.xhtml#Linux-NetDev. To pass the GRO hint information across the different xmit path functions, store them in the skb control buffer, to avoid adding additional arguments. Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/aa614567f7bdb776d693041375bede4990a19649.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 1da80d91bd0ea36f6c974bf50d14295734bcc278 Author: Paolo Abeni Date: Wed Jan 21 17:11:32 2026 +0100 geneve: pass the geneve device ptr to geneve_build_skb() Instead of handing to it the geneve configuration in multiple arguments. This already avoids some code duplication and we are going to pass soon more arguments to such function. Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/761f05690646181fffc533ee4db59b68e5c3a0c3.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 759b8d3cef7bfc0a69a11f260eb136bba1821ab4 Author: Paolo Abeni Date: Wed Jan 21 17:11:31 2026 +0100 geneve: constify geneve_hlen() Such helper does not modify the argument; constifying it will additionally simplify later patches. Additionally move the definition earlier, still for later's patchesi sake. Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/ea9e279b9544e8644194508dd9a4320ee455fa95.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit ba1b8c97b9a0414432382a11f144a8597f6f597e Author: Paolo Abeni Date: Wed Jan 21 17:11:30 2026 +0100 geneve: add netlink support for GRO hint Allow configuring and dumping the new device option, and cache its value into the geneve socket itself. The new option is not tie to it any code yet. Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/2295d4e4d1e919a3189425141bbc71c7850a2de0.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit e0b73b5a925739bee16ef3b0a1212a79fafc8050 Author: Paolo Abeni Date: Wed Jan 21 17:11:29 2026 +0100 vxlan: expose gso partial features for tunnel offload Similar to the previous patch, reuse the same helpers to add tunnel GSO partial capabilities to vxlan devices. Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/93d916c11b3a790a8bfccad77d9e85ee6e533042.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 0c09e89f6cea6598439edca7ff1ef97fde3edb46 Author: Paolo Abeni Date: Wed Jan 21 17:11:28 2026 +0100 geneve: expose gso partial features for tunnel offload GSO partial features for tunnels do not require any kind of support from the underlying device: we can safely add them to the geneve UDP tunnel. The only point of attention is the skb required features propagation in the device xmit op: partial features must be stripped, except for UDP_TUNNEL*. Keep partial features disabled by default. Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/d851ca8e928cf05d68310bcbaeaa5e9e0b01e058.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 31c5a71d982b57df75858974634c2f0a338f2fc6 Author: Paolo Abeni Date: Wed Jan 21 17:11:27 2026 +0100 net: introduce mangleid_features Some/most devices implementing gso_partial need to disable the GSO partial features when the IP ID can't be mangled; to that extend each of them implements something alike the following[1]: if (skb->encapsulation && !(features & NETIF_F_TSO_MANGLEID)) features &= ~NETIF_F_TSO; in the ndo_features_check() op, which leads to a bit of duplicate code. Later patch in the series will implement GSO partial support for virtual devices, and the current status quo will require more duplicate code and a new indirect call in the TX path for them. Introduce the mangleid_features mask, allowing the core to disable NIC features based on/requiring MANGLEID, without any further intervention from the driver. The same functionality could be alternatively implemented adding a single boolean flag to the struct net_device, but would require an additional checks in ndo_features_check(). Also note that [1] is incorrect if the NIC additionally implements NETIF_F_GSO_UDP_L4, mangleid_features transparently handle even such a case. Signed-off-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/5a7cdaeea40b0a29b88e525b6c942d73ed3b8ce7.1769011015.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 638eeda8abaa3e6afe6bd5758ef8045a7f33b9a0 Author: Lyude Paul Date: Thu Jan 22 17:10:37 2026 -0500 rust/drm: Fix Registration::{new,new_foreign_owned}() docs Looks like we've actually had a malformed rustdoc reference in the rustdocs for Registration::new_foreign_owned() for a while that, when fixed, still couldn't resolve properly because it refers to a private item. This is probably leftover from when Registration::new() was public, so drop the documentation from that function and fixup the documentation for Registration::new_foreign_owned(). Signed-off-by: Lyude Paul Acked-by: Danilo Krummrich Fixes: 0600032c54b7 ("rust: drm: add DRM driver registration") Cc: # v6.16+ Link: https://patch.msgid.link/20260122221037.3462081-1-lyude@redhat.com commit ed062c41dfda2de8d1712c91e089303dae013bb7 Merge: fe1d4828846f02 cc74050f13e5f1 Author: Boqun Feng Date: Fri Jan 23 11:15:15 2026 -0800 Merge branch 'rcu-nocb.20260123a' * rcu-nocb.20260123a: rcu/nocb: Extract nocb_defer_wakeup_cancel() helper rcu/nocb: Remove dead callback overload handling rcu/nocb: Remove unnecessary WakeOvfIsDeferred wake path commit cc74050f13e5f15de7835b96d633484dd6776f53 Author: Joel Fernandes Date: Fri Jan 23 09:30:31 2026 -0500 rcu/nocb: Extract nocb_defer_wakeup_cancel() helper The pattern of checking nocb_defer_wakeup and deleting the timer is duplicated in __wake_nocb_gp() and nocb_gp_wait(). Extract this into a common helper function nocb_defer_wakeup_cancel(). This removes code duplication and makes it easier to maintain. Reviewed-by: Frederic Weisbecker Reviewed-by: Paul E. McKenney Signed-off-by: Joel Fernandes Signed-off-by: Boqun Feng commit b11c1efa7ffedbb3e880d31370d2cb37394ef9f4 Author: Joel Fernandes Date: Fri Jan 23 09:30:22 2026 -0500 rcu/nocb: Remove dead callback overload handling During callback overload (exceeding qhimark), the NOCB code attempts opportunistic advancement via rcu_advance_cbs_nowake(). Analysis shows this code path is practically unreachable and serves no useful purpose. Testing with 300,000 callback floods showed: - 30 overload conditions triggered - 0 advancements actually occurred While a theoretical window exists where this code could execute (e.g., vCPU preemption between gp_seq update and rcu_nocb_gp_cleanup()), even if it did, the advancement would be redundant. The rcuog kthread must still run to wake the rcuoc callback thread - we would just be duplicating work that rcuog will perform when it finally gets to run. Since this path provides no meaningful benefit and extensive testing confirms it is never useful, remove it entirely. Reviewed-by: Frederic Weisbecker Reviewed-by: Paul E. McKenney Signed-off-by: Joel Fernandes Signed-off-by: Boqun Feng commit d92eca60fea944b2e9272603308a0fde8b6ae447 Author: Joel Fernandes Date: Fri Jan 23 09:30:12 2026 -0500 rcu/nocb: Remove unnecessary WakeOvfIsDeferred wake path The WakeOvfIsDeferred code path in __call_rcu_nocb_wake() attempts to wake rcuog when the callback count exceeds qhimark and callbacks aren't done with their GP (newly queued or awaiting GP). However, a lot of testing proves this wake is always redundant or useless. In the flooding case, rcuog is always waiting for a GP to finish. So waking up the rcuog thread is pointless. The timer wakeup adds overhead, rcuog simply wakes up and goes back to sleep achieving nothing. This path also adds a full memory barrier, and additional timer expiry modifications unnecessarily. The root cause is that WakeOvfIsDeferred fires when !rcu_segcblist_ready_cbs() (GP not complete), but waking rcuog cannot accelerate GP completion. This commit therefore removes this path. Tested with rcutorture scenarios: TREE01, TREE05, TREE08 (all NOCB configurations) - all pass. Also stress tested using a kernel module that floods call_rcu() to trigger the overload conditions and made the observations confirming the findings. Reviewed-by: Frederic Weisbecker Reviewed-by: Paul E. McKenney Signed-off-by: Joel Fernandes Signed-off-by: Boqun Feng commit ed0a1ac2aa936a0abc2d940eff51158de6e8cec0 Author: Andy Shevchenko Date: Wed Jan 21 09:50:49 2026 +0100 ACPI: PCI: simplify code with acpi_get_local_u64_address() Now we have a helper so there's no need to open-code. Signed-off-by: Andy Shevchenko Reviewed-by: Bjorn Helgaas Link: https://patch.msgid.link/20260121085105.2282380-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 5315c0ddbefe415abba4c89568ecfd27f79c5aba Author: Andy Shevchenko Date: Wed Jan 21 09:46:36 2026 +0100 ACPI: video: simplify code with acpi_get_local_u64_address() Now we have a helper so there's no need to open-code. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260121084654.2227037-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit f50af896932f5edb1ff7b407753ecfa285c30b7a Author: Ming Lei Date: Fri Jan 23 21:51:58 2026 +0800 ublk: rename auto buffer registration helpers Rename the auto buffer registration functions for clarity: - __ublk_do_auto_buf_reg() -> ublk_auto_buf_register() - ublk_prep_auto_buf_reg_io() -> ublk_auto_buf_io_setup() - ublk_do_auto_buf_reg() -> ublk_auto_buf_dispatch() Add comments documenting the locking requirements for each function. No functional change. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit a592a36e49372172d7c7551ec19ed18184c935e1 Author: Jani Nikula Date: Fri Jan 23 16:31:49 2026 +0200 Documentation: use a source-read extension for the index link boilerplate The root document usually has a special :ref:`genindex` link to the generated index. This is also the case for Documentation/index.rst. The other index.rst files deeper in the directory hierarchy usually don't. For SPHINXDIRS builds, the root document isn't Documentation/index.rst, but some other index.rst in the hierarchy. Currently they have a ".. only::" block to add the index link when doing SPHINXDIRS html builds. This is obviously very tedious and repetitive. The link is also added to all index.rst files in the hierarchy for SPHINXDIRS builds, not just the root document. Put the boilerplate in a sphinx-includes/subproject-index.rst file, and include it at the end of the root document for subproject builds in an ad-hoc source-read extension defined in conf.py. For now, keep having the boilerplate in translations, because this approach currently doesn't cover translated index link headers. Cc: Jonathan Corbet Cc: Mauro Carvalho Chehab Cc: Randy Dunlap Signed-off-by: Jani Nikula Tested-by: Mauro Carvalho Chehab Reviewed-by: Mauro Carvalho Chehab [jc: did s/doctree/kern_doc_dir/ ] Signed-off-by: Jonathan Corbet Message-ID: <20260123143149.2024303-1-jani.nikula@intel.com> commit 750e0e0a1652530618d2c07697618e705bc5061b Author: Krzysztof Kozlowski Date: Wed Dec 24 12:42:12 2025 +0100 clk: zynqmp: pll: Fix zynqmp_clk_divider_determine_rate kerneldoc After renaming round_rate->determine, kerneldoc does not match anymore, causing W=1 warnings: pll.c:102 function parameter 'req' not described in 'zynqmp_pll_determine_rate' pll.c:102 expecting prototype for zynqmp_pll_round_rate(). Prototype was for zynqmp_pll_determine_rate() instead Fixes: 193650c7a873 ("clk: zynqmp: pll: convert from round_rate() to determine_rate()") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 1b8773864904c7a25e45f1b12ab505bdb7e06568 Author: Krzysztof Kozlowski Date: Wed Dec 24 12:42:11 2025 +0100 clk: zynqmp: divider: Fix zynqmp_clk_divider_determine_rate kerneldoc After renaming round_rate->determine, kerneldoc does not match anymore, causing W=1 warnings: Warning: drivers/clk/zynqmp/divider.c:122 function parameter 'req' not described in 'zynqmp_clk_divider_determine_rate' Warning: drivers/clk/zynqmp/divider.c:122 expecting prototype for zynqmp_clk_divider_round_rate(). Prototype was for zynqmp_clk_divider_determine_rate() instead Fixes: 0f9cf96a01fd ("clk: zynqmp: divider: convert from round_rate() to determine_rate()") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 8811df1dd4e03522e52fc70ceaa6c01a41411590 Merge: 1685e1770856f9 f584347c1a2ba4 Author: Jakub Kicinski Date: Fri Jan 23 10:53:07 2026 -0800 Merge branch 'net-convert-drivers-to-get_rx_ring_count-last-part' Breno Leitao says: ==================== net: convert drivers to .get_rx_ring_count (last part) Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns the following drivers with the new ethtool API for querying RX ring parameters. * sfc * ionic * sfc/siena * sfc/ef100 * fbnic * mana * nfp * atlantic * benet (this is v2 in fact, where v1 had some discussions that required a v2). See link [0] Link: https://lore.kernel.org/all/20260119094514.5b12a097@kernel.org/ [0] This is covering the last drivers, and as soon as this lands, I will change the ethtool framework to avoid calling .get_rx_ring_count for ETHTOOL_GRXRINGS, simplifying the ethtool core framework. ==================== Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-0-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit f584347c1a2ba44ba589688100de7b482f04d00f Author: Breno Leitao Date: Thu Jan 22 10:40:21 2026 -0800 net: sfc: falcon: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-9-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit c9e4688b2ee25b5778c1d752f4804488fc408642 Author: Breno Leitao Date: Thu Jan 22 10:40:20 2026 -0800 net: sfc: siena: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-8-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit 67f16fba554f7f9a699ada51c5ad9aaed9afa1c4 Author: Breno Leitao Date: Thu Jan 22 10:40:19 2026 -0800 net: sfc: efx: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-7-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit 8bd5cee9891a1c9c87e49ea3a34a74e588d78e2d Author: Breno Leitao Date: Thu Jan 22 10:40:18 2026 -0800 net: ionic: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Since ETHTOOL_GRXRINGS was the only command handled by ionic_get_rxnfc(), remove the function entirely. Signed-off-by: Breno Leitao Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-6-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit ea28b02da84ce8495b06648b22270fd602553da2 Author: Breno Leitao Date: Thu Jan 22 10:40:17 2026 -0800 net: fbnic: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-5-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit 3eb72257183595877c81887ceb14b82313621d9f Author: Breno Leitao Date: Thu Jan 22 10:40:16 2026 -0800 net: mana: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Since ETHTOOL_GRXRINGS was the only command handled by mana_get_rxnfc(), remove the function entirely. Reviewed-by: Subbaraya Sundeep Signed-off-by: Breno Leitao Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-4-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit 46f4ad55605e725c2bf2c4da7ddff121d23083e8 Author: Breno Leitao Date: Thu Jan 22 10:40:15 2026 -0800 net: nfp: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Reviewed-by: Subbaraya Sundeep Signed-off-by: Breno Leitao Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-3-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit 489a5b81abbc4e1a29303dea27d1d5cc75276ea1 Author: Breno Leitao Date: Thu Jan 22 10:40:14 2026 -0800 net: atlantic: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-2-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit 8f2a880d652e5c78d798a21cf69319c073a9c1b1 Author: Breno Leitao Date: Thu Jan 22 10:40:13 2026 -0800 net: benet: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Since ETHTOOL_GRXRINGS was the only command handled by be_get_rxnfc(), remove the function entirely. Since the be_multi_rxq() check in be_get_rxnfc() previously blocked RSS configuration on single-queue setups (via ethtool core validation), add an equivalent check to be_set_rxfh() to preserve this behavior, as suggested by Jakub. Signed-off-by: Breno Leitao Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20260122-grxring_big_v4-v2-1-94dbe4dcaa10@debian.org Signed-off-by: Jakub Kicinski commit 330367bdc176a8f52cc4c5065ba0312277202dee Merge: ffb569d59c2533 ef6aa110d8888a Author: Jonathan Corbet Date: Fri Jan 23 11:46:08 2026 -0700 Merge branch 'mauro' into docs-mw Mauro's work to include documentation from our Python modules. His cover letter follows: This is an extended version of: https://lore.kernel.org/linux-doc/cover.1768488832.git.mchehab+huawei@kernel.org/ It basically adds everything we currently have inside libs/tool/python to "tools" book inside documentation. This version should be independent of the other series yet to be merged, (including the jobserver one). The vast amount of changes here are docstring cleanups and additions. They mainly consists on: - ensuring that every phrase will end with a period, making it uniform along all files; - cleaning ups to better uniform docstrings; - variable descriptions now use "#:" markup, as it allows autodoc to add them inside the documentation; - added some missing docstrings; - some new blank lines at comments to make ReST syntax parser happy; - add a couple of sphinx markups (mainly, code blocks). Most of those are minor changes, affecting only comments. It also has one patch per libarary type, adding them to docs. For kernel-doc, I did the cleanups first, as there is one code block inside tools/lib/python/kdoc/latex_fonts.py that would cause a Sphinx crash without such markups. The series actually starts with 3 fixes: - avoid "*" markups on indexes with deep> 3 to override text - a variable rename to stop abusing doctree name - don't rely on cwd to get Documentation/ location patch 4 adds support to document scripts either at: - tools/ - scripts/ patch 5 contains a CSS to better display autodoc html output. For those who want to play with documentation, documenting a python file is very simple. All it takes is to use: .. automodule:: lib.python. Usually, we add a couple of control members to it to adjust the desired documentation scope (add/remove members, showing class inheritance, showing members that currently don't have docstrings, etc). That's why we're using: .. automodule:: lib.python.kdoc.enrich_formatter :members: :show-inheritance: :undoc-members: (and similar) inside tools/kdoc*.rst. autodoc allows filtering in/out members, file docstrings, etc. It also allows documenting just some members or functions with directives like: ..autofunction: ..automember: Sphinx also has a helper script to generate .rst files with documentation: $ sphinx-apidoc -o foobar tools/lib/python/ which can be helpful to discover what should be documented, although changes are needed to use what it produces. commit 90ecc4b3c10344b21cf4d5edb0d4b78df8c3d8b6 Merge: 8f0b4cce4481fb 3e6b0227b93c70 Author: Stephen Boyd Date: Fri Jan 23 10:38:18 2026 -0800 Merge tag 'clk-imx-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux into clk-imx Pull i.MX clk driver updates from Abel Vesa: - Add support for 241.90 MHz and 332.60 MHz to the fractional-N General-Purpose PLL (GPPLL) i.MX driver * tag 'clk-imx-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux: clk: imx: fracn-gppll: Add 241.90 MHz Support clk: imx: fracn-gppll: Add 332.60 MHz Support commit ef6aa110d8888a14dfb2e843794097263c45a06b Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:28 2026 +0100 docs: parse_features: make documentation more consistent Do some changes to: - add missing documentation strings to vars; - add a missing docstring; - ensure that phases will end with a period. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <3722f10361638561a5ced18cf4f409930c88270b.1768838938.git.mchehab+huawei@kernel.org> commit cb472bb3c31dd9be6f0a506136524acfc2e3fd36 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:27 2026 +0100 docs: add parse_features module documentation Place parse_features module documentation at Linux Kernel docs. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <7c1e41468f765587f0962222e7f52125a039028f.1768838938.git.mchehab+huawei@kernel.org> commit 8b85f614f3b68a8a58762c8f8defbcebf6f0282a Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:26 2026 +0100 docs: jobserver: do some documentation improvements Make Sphinx handle better jobserver class documentation Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <18a9c1406bdead680e3ee5768c97ae8b2138e8ea.1768838938.git.mchehab+huawei@kernel.org> commit 7a66b29dc59f7a226a878572f726610bf4922b52 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:25 2026 +0100 docs: add jobserver module documentation Place jobserver module documentation at Linux Kernel docs. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <688215d6a41d78bd5e37854472a5fc802d58c77a.1768838938.git.mchehab+huawei@kernel.org> commit b713adadf8be2d75dd6cfb626aec143d7461b100 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:24 2026 +0100 docs: kabi: helpers: add documentation for each "enum" value Ensure that kABI module documentation will describe each debug bit. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <3b118b157e52d757bf82fd74f03b0f4bd9e8b8f1.1768838938.git.mchehab+huawei@kernel.org> commit 5c9ece0b02b219e8502f66b8d9636d511280126d Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:23 2026 +0100 docs: kabi: helpers: add helper for debug bits 7 and 8 The kabi logic supports 8 debug bits, but only 6 are currently documented. Document the remaining ones. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <60e99b9060396eac8621954d6b8a73af45df90fb.1768838938.git.mchehab+huawei@kernel.org> commit a50c62d375a824046a7baa9cb03e5a7e8bf7c6c4 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:22 2026 +0100 docs: kabi: system_symbols: end docstring phrases with a dot Some docstring classes are not ending with a dot. Fix to make it more uniform. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit ff91637dece7f4e108f7a2e76bd7e1054d24f600 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:21 2026 +0100 docs: python: abi_regex: do some improvements at documentation Add documentation for two consts and ensure that all sentenses will end with a dot. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <5419ad89a5042c1571198c2f055866674808579b.1768838938.git.mchehab+huawei@kernel.org> commit 66c3bf974d48f8e5c5f94148e1171b62bd80e26d Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:20 2026 +0100 docs: python: abi_parser: do some improvements at documentation Add documentation for two consts and ensure that all sentenses will end with a dot. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 9fa4ee7c1af35f0096a0da47d3fd74ef5fc73ff5 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:19 2026 +0100 docs: add kabi modules documentation Place kernel abi modules documentation at Linux Kernel docs. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 333f602e2fb58b197769154682ac6f0acc7a08ea Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:18 2026 +0100 docs: add kernel-doc modules documentation Place kernel-doc modules documentation at Linux Kernel docs. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <88ac2d82a45718c4e27aefac831586a71204ebf2.1768838938.git.mchehab+huawei@kernel.org> commit 33220c1fc10b2e53f0a79cdf6447fd7bf405a860 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:17 2026 +0100 docs: kdoc: python_version: Improve docstrings and comments In preparation to document kernel-doc module, improve its documentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <2153afaeb496e1bb8d3cc318fff26c3f99d99486.1768838938.git.mchehab+huawei@kernel.org> commit 7ef684c9fdb336b1e102c014da2424c0240196c2 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:16 2026 +0100 docs: kdoc: enrich_formatter: Improve docstrings and comments In preparation to document kernel-doc module, improve its documentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <55ec8b896fe00529d326859cd094230fb5a2cd30.1768838938.git.mchehab+huawei@kernel.org> commit e68c84b9f3ba138878581a9f36a02c67d2ae20d4 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:15 2026 +0100 docs: kdoc: parse_data_structs: Improve docstrings and comments In preparation to document kernel-doc module, improve its documentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <76ead85b4c13a8038180a792e270c3691d26cd25.1768838938.git.mchehab+huawei@kernel.org> commit b0b88915c83c2888e60a27c4914d10486f34fe3a Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:14 2026 +0100 docs: kdoc_re: Improve docstrings and comments In preparation to document kernel-doc module, improve its documentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <14a12a43144d52345bfd405d0401d246f0885acf.1768838938.git.mchehab+huawei@kernel.org> commit 245f1ab2c9bce18a9467b4ef892570dd83b049d2 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:13 2026 +0100 docs: kdoc_output: Improve docstrings and comments In preparation to document kernel-doc module, improve its documentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 50206750e08e3087af74aa984d850df978b2554a Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:12 2026 +0100 docs: kdoc_parser: Improve docstrings and comments In preparation to document kernel-doc module, improve its documentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit f40bba94a4db923a0ef0355b3055403fc9975729 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:11 2026 +0100 docs: kdoc_item: Improve docstrings and comments In preparation to document kernel-doc module, improve its documentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <65a7c6bb318e7a8cbf5c115903d507568099151a.1768838938.git.mchehab+huawei@kernel.org> commit 8d08c7c6ffc14abe584738843c8577c691ffcf22 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:10 2026 +0100 docs: kdoc_files: Improve docstrings and comments In preparation to document kernel-doc module, improve its documentation. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <75d58878ad6f83f24f1c0ce9e04301a000ecbaa3.1768838938.git.mchehab+huawei@kernel.org> commit 4d7f6319faf209a9472f7bc5df98706b723b9464 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:09 2026 +0100 docs: kdoc: latex_fonts: Improve docstrings and comments In preparation to document kernel-doc module, improve its documentation. Among the changes, it had to place the xml template inside a code block, as otherwise doc build would break. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <6e0eb2e245eae9b4f39cf231dee32df00b9e8b7b.1768838938.git.mchehab+huawei@kernel.org> commit 4b8fae7a169afe26916eb3813b415ff28175a534 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:08 2026 +0100 docs: custom.css: add CSS for python As we'll start adding python to documentation, add some CSS templates to better display python code. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 6a4931a7fe00c3987691a7a8c0b22a9bb96f432b Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:07 2026 +0100 docs: enable Sphinx autodoc extension to allow documenting python Adding python documentation is simple with Sphinx: all we need is to include the ext.autodoc extension and add the directories where the Python code sits at the sys.path. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <29cbe375dc418d6fa5793f55199799b5b52dcd38.1768838938.git.mchehab+huawei@kernel.org> commit f123cffb000987bfc04f2463cc33bae2b2c1d590 Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:06 2026 +0100 docs: conf: don't rely on cwd to get documentation location Instead of relying that Sphinx will be called from Documentation/ dir, pick the location based on __file__. Suggested-by: Jani Nikula Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <34c38718dfade91ff6f7afca5e9c1705ba253c97.1768838938.git.mchehab+huawei@kernel.org> commit d0b31c30b58c07985c993fcc9275490948de87aa Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:05 2026 +0100 docs: conf.py: don't use doctree with a different meaning At Sphinx, doctree is a directory where doc build cache is stored. Use a better name. No functional changes. Suggested-by: Jani Nikula Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 7bcdf96aff68ea0e588ed0d3675b4cc9d5da77df Author: Mauro Carvalho Chehab Date: Mon Jan 19 17:23:04 2026 +0100 docs: custom.css: prevent li marker to override text There's currently an issue with li marker: it is set to use -1em, which actually makes it override the text. This is visible on indexes that are deep enough. Fix it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <4f28c485b72ea27c0981cd950a1819597d6736b1.1768838938.git.mchehab+huawei@kernel.org> commit ffb569d59c253399efb2345ddfefe7929cd7e2a8 Author: Thomas Weißschuh Date: Sun Jan 18 00:26:24 2026 +0100 tools/docs: sphinx-build-wrapper: only generate rust docs when requested When the user explicitly specifies SPHINXDIRS to build a specific subdirectory it is unexpected that the rust docs are also generated. Especially as their generation may dominate the execution time. Only generate the rust docs when they are part of the SPHINXDIRS requested by the user. 'rust/rustdocs' is not considered, as it is not a valid SPHINXDIRS anyways. Signed-off-by: Thomas Weißschuh Reviewed-by: Mauro Carvalho Chehab Tested-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <20260118-docs-spurious-rust-v1-4-998e14b9ed9e@weissschuh.net> commit 6f9a96cc96ea405e0f80fede761dc415e33364c7 Author: Thomas Weißschuh Date: Sun Jan 18 00:26:23 2026 +0100 tools/docs: sphinx-build-wrapper: compute sphinxdirs_list earlier An upcoming patch will require sphinxdirs_list to be available before the call to check_rust(). Move it up in the function. Signed-off-by: Thomas Weißschuh Reviewed-by: Mauro Carvalho Chehab Tested-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <20260118-docs-spurious-rust-v1-3-998e14b9ed9e@weissschuh.net> commit 2d652135a16b413e38e6d7fed5244690d853756b Author: Thomas Weißschuh Date: Sun Jan 18 00:26:22 2026 +0100 tools/docs: sphinx-build-wrapper: make 'rustdoc' a local variable All users of this variable are now in the same method. Demote the instance variable to a local one. Signed-off-by: Thomas Weißschuh Reviewed-by: Mauro Carvalho Chehab Tested-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <20260118-docs-spurious-rust-v1-2-998e14b9ed9e@weissschuh.net> commit 5094f7d5ff2318edfe6f2a9632b31f0ddefd6ee4 Author: Thomas Weißschuh Date: Sun Jan 18 00:26:21 2026 +0100 tools/docs: sphinx-build-wrapper: generate rust docs only once Currently the rust docs are generated for each entry in SPHINXDIRS. This is unnecessary as they will be the same for each one. Move the generation, so it is executed only once. Signed-off-by: Thomas Weißschuh Reviewed-by: Mauro Carvalho Chehab Tested-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <20260118-docs-spurious-rust-v1-1-998e14b9ed9e@weissschuh.net> commit ec833566da57811d9fa3f11745e7153d9155ad66 Author: Louis-Alexis Eyraud Date: Fri Jan 23 10:20:38 2026 -0800 dt-bindings: spmi: spmi-mtk-pmif: Add compatible for MT8189 SoC Add compatible string for the SPMI block on MT8189 SoC, which is compatible with the one used on MT8195. Signed-off-by: Louis-Alexis Eyraud Acked-by: Conor Dooley Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd Link: https://patch.msgid.link/20260123182039.224314-11-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 815be38ad8c8503cec8b2c0c632e975692ab42e1 Author: David Collins Date: Fri Jan 23 10:20:37 2026 -0800 spmi: spmi-pmic-arb: add support for PMIC arbiter v8 PMIC arbiter v8 supports up to 4 SPMI buses and up to 8192 PMIC peripherals. Its register map differs from v7 as several fields increased in size. Add support for PMIC arbiter version 8. Signed-off-by: David Collins Signed-off-by: Kamal Wadhwa Signed-off-by: Jishnu Prakash Reviewed-by: Konrad Dybcio Signed-off-by: Stephen Boyd Link: https://patch.msgid.link/20260123182039.224314-10-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0914498171b9a0acc742cd4289134c418eabf095 Author: Jishnu Prakash Date: Fri Jan 23 10:20:36 2026 -0800 dt-bindings: spmi: add support for glymur-spmi-pmic-arb (arbiter v8) SPMI PMIC Arbiter version 8 builds upon version 7 with support for up to four SPMI buses. To achieve this, the register map was slightly rearranged. Add a new binding file and compatible string for version 8 using the name 'glymur' as the Qualcomm Technologies, Inc. Glymur SoC is the first one to use PMIC arbiter version 8. This specifies the new register ranges needed only for version 8. Also document SPMI PMIC Arbiter for Qualcomm Kaanapali SoC, by adding fallback to Glymur compatible string, as it too has version 8 functionality. Signed-off-by: David Collins Signed-off-by: Pankaj Patil Signed-off-by: Kamal Wadhwa Signed-off-by: Jingyi Wang Reviewed-by: Rob Herring (Arm) Signed-off-by: Jishnu Prakash Signed-off-by: Stephen Boyd Link: https://patch.msgid.link/20260123182039.224314-9-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit e9ae440c97e8f68cd7ce1dde47c04a36d8792bf0 Author: Jishnu Prakash Date: Fri Jan 23 10:20:35 2026 -0800 dt-bindings: spmi: split out common QCOM SPMI PMIC arbiter properties Split out the common SPMI PMIC arbiter properties for QCOM devices into a separate file so that it can be included as a reference for devices using them. This will be needed for the upcoming PMIC v8 arbiter support patch, as the v8 arbiter also uses these common properties. Reviewed-by: Rob Herring (Arm) Signed-off-by: Jishnu Prakash Signed-off-by: Stephen Boyd Link: https://patch.msgid.link/20260123182039.224314-8-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6c54b0a801dd8227237ba0bf0728bb42681cf027 Author: Janne Grunau Date: Fri Jan 23 10:20:34 2026 -0800 spmi: apple: Add "apple,t8103-spmi" compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,spmi" anymore [1]. Use "apple,t8103-spmi" as base compatible as it is the SoC the driver and bindings were written for. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Fixes: 77ca75e80c71 ("spmi: add a spmi driver for Apple SoC") Cc: stable@vger.kernel.org Reviewed-by: Neal Gompa Signed-off-by: Janne Grunau Signed-off-by: Stephen Boyd Link: https://patch.msgid.link/20260123182039.224314-7-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 1f5be2d7f743e5ffc6317af50276ca5508ddb5ec Author: AngeloGioacchino Del Regno Date: Fri Jan 23 10:20:33 2026 -0800 spmi: mtk-pmif: Add support for MT8196 SPMI Controller Add support for the SPMI controller found in the MT8196 SoC: this supports SPMI 2.0 and features two SPMI buses. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd Link: https://patch.msgid.link/20260123182039.224314-6-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit ab1b3469fc284ad8c7b28f881329448786bdc252 Author: AngeloGioacchino Del Regno Date: Fri Jan 23 10:20:32 2026 -0800 spmi: mtk-pmif: Implement Request Capable Slave (RCS) interrupt Add support for the per-bus RCS interrupt by adding a new linear irqdomain and its irqchip. The SPMI controller will raise an interrupt when any of the SPMI connected devices' irq needs attention (whenever any interrupt fires on any SID) in one of four registers, where each register holds four sets of four bits of information about a SID interrupt. This controller's RCS interrupt status knowledge is limited to the address of the SID that raised an interrupt, but does not have any details about the devices irq numbers: as this may change with a future SPMI controller IP version, the devicetree is meant to hold three cells, where the first one is the SPMI SID interrupt number, the second one is a device interrupt number, and the third one is the irq sense type. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd Link: https://patch.msgid.link/20260123182039.224314-5-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 63cbabb003ba314be113700ca58ec320b6ce2b33 Author: AngeloGioacchino Del Regno Date: Fri Jan 23 10:20:31 2026 -0800 spmi: mtk-pmif: Keep spinlock until read is fully done Move the spin unlocking to after reading the contents of the PMIF_SWINF_(x)_RDATA_31_0 register in pmif_spmi_read_cmd(): since this is the only register that we can read to get the data from all of the arbitered busses, a concurrent request for reading (especially on a busy arbiter) will show a race condition and a unexpected or corrupted value may be read. Doing the entire read sequence while spin locked guarantees that concurrent access to the arbiter doesn't happen. Fixes: f200fff8d019 ("spmi: mtk-pmif: Serialize PMIF status check and command submission") Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: Chen-Yu Tsai Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd Fixes: b45b3ccef8c0 ("spmi: mediatek: Add support for MT6873/8192") Link: https://patch.msgid.link/20260123182039.224314-4-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 078117963b2c678921c86f2485b0d5baf5b86131 Author: AngeloGioacchino Del Regno Date: Fri Jan 23 10:20:30 2026 -0800 spmi: mtk-pmif: Add multi-bus support for SPMI 2.0 In preparation for adding support for MT8196/MT6991 SoCs having multiple SPMI busses, move the bus specific parameters into a new pmif_bus structure and keep the SoC-specific data in the already existing struct pmif, and add means to register multiple SPMI controllers. While this needs a different devicetree node structure, where each of the controllers are in subnodes of a main SPMI node, and where each has its own resources (iospaces and clocks), support for the legacy single-controller was retained and doesn't require any DT change in the currently supported SoCs. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd Link: https://patch.msgid.link/20260123182039.224314-3-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5abb6c7aca41d827320113b6865f56d2038a4f2c Author: AngeloGioacchino Del Regno Date: Fri Jan 23 10:20:29 2026 -0800 dt-bindings: spmi: Add MediaTek MT8196 SPMI 2 Arbiter/Controllers Document the MT8196 SPMI 2.0 Controller with a new schema. This is a MIPI SPMI 2.0 compliant IP, composed of a main arbiter and two SPMI master controllers with Request Capable Slave (RCS) support. Reviewed-by: Rob Herring (Arm) Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd Link: https://patch.msgid.link/20260123182039.224314-2-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 36718450835cf89572bf569bff0927bc7ef2568a Author: Akiyoshi Kurita Date: Wed Jan 21 00:45:43 2026 +0900 docs: ja_JP: Start translation of submitting-patches Start a new Japanese translation of Documentation/process/submitting-patches.rst. Instead of moving the outdated 2011 translation (SubmittingPatches), we are starting a fresh translation of the current English document. This patch adds the initial file structure, the warning about the document being under construction, and the translation of the introduction section. The translation work will be done incrementally. Suggested-by: Akira Yokosawa Link: https://lore.kernel.org/298d3a9c-41c1-4cbd-b4ab-d3009df9388c@gmail.com/ Signed-off-by: Akiyoshi Kurita Reviewed-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Message-ID: <20260120154543.2063635-1-weibu@redadmin.org> commit 1685e1770856f9ce6e1f13600ff82bbad6a81d87 Author: Eric Dumazet Date: Thu Jan 22 09:02:27 2026 +0000 tcp: move tcp_stream_memory_free() to tcp.c Moving tcp_stream_memory_free() to tcp.c allows the compiler to (auto)inline it from tcp_poll() and tcp_sendmsg_locked() for better performance. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/0 up/down: 118/0 (118) Function old new delta tcp_poll 840 923 +83 tcp_sendmsg_locked 4217 4252 +35 Total: Before=22573095, After=22573213, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260122090228.1678207-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 339e7f59858927ab5ed24e6902e940b077db3a60 Author: Lukas Bulwahn Date: Thu Jan 22 08:46:09 2026 +0100 MAINTAINERS: remove obsolete file entry in NETWORKING DRIVERS Commit d8f87aa5fa0a ("net: remove HIPPI support and RoadRunner HIPPI driver") removes the hippidevice header file, but misses that there is still a file entry in MAINTAINERS referring to it. Remove the obsolete file entry in NETWORKING DRIVERS. Signed-off-by: Lukas Bulwahn Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260122074609.151058-1-lukas.bulwahn@redhat.com Signed-off-by: Jakub Kicinski commit 7043698aee6b6f61415ebb49b7e95fdfb9373a77 Author: Zhi Wang Date: Wed Jan 21 22:22:07 2026 +0200 rust: devres: style for imports Convert all imports in the devres to use "kernel vertical" style. Cc: Gary Guo Cc: Miguel Ojeda Reviewed-by: Gary Guo Signed-off-by: Zhi Wang Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260121202212.4438-2-zhiw@nvidia.com Signed-off-by: Danilo Krummrich commit 82f3b142c99cf44c7b1e70b7720169c646b9760f Author: Kumar Kartikeya Dwivedi Date: Thu Jan 22 03:59:11 2026 -0800 rqspinlock: Fix TAS fallback lock entry creation The TAS fallback can be invoked directly when queued spin locks are disabled, and through the slow path when paravirt is enabled for queued spin locks. In the latter case, the res_spin_lock macro will attempt the fast path and already hold the entry when entering the slow path. This will lead to creation of extraneous entries that are not released, which may cause false positives for deadlock detection. Fix this by always preceding invocation of the TAS fallback in every case with the grabbing of the held lock entry, and add a comment to make note of this. Fixes: c9102a68c070 ("rqspinlock: Add a test-and-set fallback") Reported-by: Amery Hung Signed-off-by: Kumar Kartikeya Dwivedi Tested-by: Amery Hung Link: https://lore.kernel.org/r/20260122115911.3668985-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 062768f426895b958417c85582826e20c44f477c Author: Zhao Liu Date: Thu Nov 20 13:07:20 2025 +0800 KVM: x86: Advertise AVX10_VNNI_INT CPUID to userspace Define and advertise AVX10_VNNI_INT CPUID to userspace when it's supported by the host. AVX10_VNNI_INT (0x24.0x1.ECX[bit 2]) is a discrete feature bit introduced on Intel Diamond Rapids, which enumerates the support for EVEX VPDP* instructions for INT8/INT16 [*]. Since this feature has no actual kernel usages, define it as a KVM-only feature in reverse_cpuid.h. Advertise new CPUID subleaf 0x24.0x1 with AVX10_VNNI_INT bit to userspace for guest use. It's safe since no additional enabling work is needed in the host kernel. [*]: Intel Advanced Vector Extensions 10.2 Architecture Specification (rev 5.0). Tested-by: Xudong Hao Signed-off-by: Zhao Liu Reviewed-by: Xiaoyao Li Reviewed-by: Paolo Bonzini Link: https://patch.msgid.link/20251120050720.931449-5-zhao1.liu@intel.com Signed-off-by: Sean Christopherson commit 2ff8fb1e65e1a97f75f15935f84b9d2882a49623 Author: Zhao Liu Date: Thu Nov 20 13:07:19 2025 +0800 KVM: x86: Advertise AVX10.2 CPUID to userspace Bump up the maximum supported AVX10 version and enumerate AVX10.2 to userspace when it's supported by the host. Intel AVX10 Version 2 (Intel AVX10.2) includes a suite of new instructions delivering new AI features and performance, accelerated media processing, expanded Web Assembly, and Cryptography support, along with enhancements to existing legacy instructions for completeness and efficiency, and it is enumerated as version 2 in CPUID 0x24.0x0.EBX[bits 0-7] [1]. AVX10.2 has no current kernel usage and requires no additional host kernel enabling work (based on AVX10.1 support) and provides no new VMX controls [2]. Moreover, since AVX10.2 is the superset of AVX10.1, there's no need to worry about AVX10.1 and AVX10.2 compatibility issues in KVM. Therefore, it's safe to advertise AVX10.2 version to userspace directly if host supports AVX10.2. [1]: Intel Advanced Vector Extensions 10.2 Architecture Specification (rev 5.0). [2]: Note: Since AVX10.2 spec (rev 4.0), it has been declared "AVX10/512 will be used in all Intel products, supporting vector lengths of 128, 256, and 512 in all product lines", and the VMX support (in earlier revisions) for AVX10/256 guest on AVX10/512 host has been dropped. Tested-by: Xudong Hao Signed-off-by: Zhao Liu Reviewed-by: Xiaoyao Li Reviewed-by: Paolo Bonzini Link: https://patch.msgid.link/20251120050720.931449-4-zhao1.liu@intel.com Signed-off-by: Sean Christopherson commit 58cbaf64e6530fa37752ff1362129842ac94fee0 Author: Zhao Liu Date: Thu Nov 20 13:07:18 2025 +0800 KVM: x86: Advertise AMX CPUIDs in subleaf 0x1E.0x1 to userspace Define and advertise AMX CPUIDs (0x1E.0x1) to userspace when the leaf is supported by the host. Intel Diamond Rapids adds new AMX instructions to support new formats and memory operations [*], and introduces the CPUID subleaf 0x1E.0x1 to centralize the discrete AMX feature bits within EAX. Since these AMX features have no actual kernel usages, define them as KVM-only features in reverse_cpuid.h. In addition to the new features, CPUID 0x1E.0x1.EAX[bits 0-3] are aliaseed positions of existing AMX feature bits distributed across the 0x7 leaves. To avoid duplicate feature names, name these aliases with an *_ALIAS suffix, and define them in reverse_cpuid.h as KVM-only features as well. Advertise new CPUID subleaf 0x1E.0x1 with its AMX CPUID feature bits to userspace for guest use. It's safe since no additional enabling work is needed in the host kernel. [*]: Intel Architecture Instruction Set Extensions and Future Features (rev.059). Tested-by: Xudong Hao Signed-off-by: Zhao Liu Reviewed-by: Xiaoyao Li Reviewed-by: Paolo Bonzini Link: https://patch.msgid.link/20251120050720.931449-3-zhao1.liu@intel.com Signed-off-by: Sean Christopherson commit f24ef0093dd8cf60ed7f93a82fb16335fdcbc310 Author: Zhao Liu Date: Thu Nov 20 13:07:17 2025 +0800 KVM: x86: Advertise MOVRS CPUID to userspace Define the feature flag for MOVRS and advertise support to userspace when the feature is supported by the host. MOVRS is a new set of instructions introduced in the Intel platform Diamond Rapids, to provide load instructions that carry a read-shared hint. Functionally, MOVRS family is equivalent to existing load instructions, but its read-shared hint indicates that the source memory location is likely to become read-shared by multiple processors, i.e., read in the future by at least one other processor before it is written (assuming it is ever written in the future). This hint could optimize the behavior of the caches, especially shared caches, for this data for future reads by multiple processors. Additionally, MOVRS family also includes a software prefetch instruction, PREFETCHRST2, that carries the same read-shared hint. [*] MOVRS family is enumerated by CPUID single-bit (0x7.0x1.EAX[bit 31]). Since it's on a densely-populated CPUID leaf and some other bits on this leaf have kernel usages, define this new feature in cpufeatures.h, but hide it in /proc/cpuinfo due to lack of current kernel usage. Advertise MOVRS bit to userspace directly. It's safe, since there's no new VMX controls or additional host enabling required for guests to use this feature. [*]: Intel Architecture Instruction Set Extensions and Future Features (rev.059). Tested-by: Xudong Hao Signed-off-by: Zhao Liu Reviewed-by: Xiaoyao Li Reviewed-by: Paolo Bonzini Link: https://patch.msgid.link/20251120050720.931449-2-zhao1.liu@intel.com Signed-off-by: Sean Christopherson commit 60382993a2e18041f88c7969f567f168cd3b4de3 Author: Darrick J. Wong Date: Fri Jan 23 09:27:37 2026 -0800 xfs: get rid of the xchk_xfile_*_descr calls The xchk_xfile_*_descr macros call kasprintf, which can fail to allocate memory if the formatted string is larger than 16 bytes (or whatever the nofail guarantees are nowadays). Some of them could easily exceed that, and Jiaming Zhang found a few places where that can happen with syzbot. The descriptions are debugging aids and aren't required to be unique, so let's just pass in static strings and eliminate this path to failure. Note this patch touches a number of commits, most of which were merged between 6.6 and 6.14. Cc: r772577952@gmail.com Cc: # v6.12 Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Tested-by: Jiaming Zhang commit eaec8aeff31d0679eadb27a13a62942ddbfd7b87 Author: Darrick J. Wong Date: Fri Jan 23 09:27:36 2026 -0800 xfs: add a method to replace shortform attrs If we're trying to replace an xattr in a shortform attr structure and the old entry fits the new entry, we can just memcpy and exit without having to delete, compact, and re-add the entry (or worse use the attr intent machinery). For parent pointers this only advantages renaming where the filename length stays the same (e.g. mv autoexec.bat scandisk.exe) but for regular xattrs it might be useful for updating security labels and the like. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit d693534513d8dcdaafcf855986d0fe0476a47462 Author: Darrick J. Wong Date: Fri Jan 23 09:27:35 2026 -0800 xfs: speed up parent pointer operations when possible After a recent fsmark benchmarking run, I observed that the overhead of parent pointers on file creation and deletion can be a bit high. On a machine with 20 CPUs, 128G of memory, and an NVME SSD capable of pushing 750000iops, I see the following results: $ mkfs.xfs -f -l logdev=/dev/nvme1n1,size=1g /dev/nvme0n1 -n parent=0 meta-data=/dev/nvme0n1 isize=512 agcount=40, agsize=9767586 blks = sectsz=4096 attr=2, projid32bit=1 = crc=1 finobt=1, sparse=1, rmapbt=1 = reflink=1 bigtime=1 inobtcount=1 nrext64=1 = exchange=0 metadir=0 data = bsize=4096 blocks=390703440, imaxpct=5 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0, ftype=1, parent=0 log =/dev/nvme1n1 bsize=4096 blocks=262144, version=2 = sectsz=4096 sunit=1 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 = rgcount=0 rgsize=0 extents = zoned=0 start=0 reserved=0 So we created 40 AGs, one per CPU. Now we create 40 directories and run fsmark: $ time fs_mark -D 10000 -S 0 -n 100000 -s 0 -L 8 -d ... # Version 3.3, 40 thread(s) starting at Wed Dec 10 14:22:07 2025 # Sync method: NO SYNC: Test does not issue sync() or fsync() calls. # Directories: Time based hash between directories across 10000 subdirectories with 180 seconds per subdirectory. # File names: 40 bytes long, (16 initial bytes of time stamp with 24 random bytes at end of name) # Files info: size 0 bytes, written with an IO size of 16384 bytes per write # App overhead is time in microseconds spent in the test not doing file writing related system calls. parent=0 parent=1 ================== ================== real 0m57.573s real 1m2.934s user 3m53.578s user 3m53.508s sys 19m44.440s sys 25m14.810s $ time rm -rf ... parent=0 parent=1 ================== ================== real 0m59.649s real 1m12.505s user 0m41.196s user 0m47.489s sys 13m9.566s sys 20m33.844s Parent pointers increase the system time by 28% overhead to create 32 million files that are totally empty. Removing them incurs a system time increase of 56%. Wall time increases by 9% and 22%. For most filesystems, each file tends to have a single owner and not that many xattrs. If the xattr structure is shortform, then all xattr changes are logged with the inode and do not require the the xattr intent mechanism to persist the parent pointer. Therefore, we can speed up parent pointer operations by calling the shortform xattr functions directly if the child's xattr is in short format. Now the overhead looks like: $ time fs_mark -D 10000 -S 0 -n 100000 -s 0 -L 8 -d ... parent=0 parent=1 ================== ================== real 0m58.030s real 1m0.983s user 3m54.141s user 3m53.758s sys 19m57.003s sys 21m30.605s $ time rm -rf ... parent=0 parent=1 ================== ================== real 0m58.911s real 1m4.420s user 0m41.329s user 0m45.169s sys 13m27.857s sys 15m58.564s Now parent pointers only increase the system time by 8% for creation and 19% for deletion. Wall time increases by 5% and 9% now. Close the performance gap by creating helpers for the attr set, remove, and replace operations that will try to make direct shortform updates, and fall back to the attr intent machinery if that doesn't work. This works for regular xattrs and for parent pointers. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 1ef7729df1f0c5f7bb63a121164f54d376d35835 Author: Darrick J. Wong Date: Fri Jan 23 09:27:34 2026 -0800 xfs: reduce xfs_attr_try_sf_addname parameters The dp parameter to this function is an alias of args->dp, so remove it for clarity before we go adding new callers. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit bd3138e8912c9db182eac5fed1337645a98b7a4f Author: Darrick J. Wong Date: Fri Jan 23 09:27:33 2026 -0800 xfs: fix remote xattr valuelblk check In debugging other problems with generic/753, it turns out that it's possible for the system go to down in the middle of a remote xattr set operation such that the leaf block entry is marked incomplete and valueblk is set to zero. Make this no longer a failure. Cc: # v4.15 Fixes: 13791d3b833428 ("xfs: scrub extended attribute leaf space") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 6fed8270448c246e706921c177e9633013dd3fcf Author: Darrick J. Wong Date: Fri Jan 23 09:27:33 2026 -0800 xfs: fix the xattr scrub to detect freemap/entries array collisions In the previous patches, we observed that it's possible for there to be freemap entries with zero size but a nonzero base. This isn't an inconsistency per se, but older kernels can get confused by this and corrupt the block, leading to corruption. If we see this, flag the xattr structure for optimization so that it gets rebuilt. Cc: # v4.15 Fixes: 13791d3b833428 ("xfs: scrub extended attribute leaf space") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 27a0c41f33d8d31558d334b07eb58701aab0b3dd Author: Darrick J. Wong Date: Fri Jan 23 09:27:32 2026 -0800 xfs: strengthen attr leaf block freemap checking Check for erroneous overlapping freemap regions and collisions between freemap regions and the xattr leaf entry array. Note that we must explicitly zero out the extra freemaps in xfs_attr3_leaf_compact so that the in-memory buffer has a correctly initialized freemap array to satisfy the new verification code, even if subsequent code changes the contents before unlocking the buffer. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit a165f7e7633ee0d83926d29e7909fdd8dd4dfadc Author: Darrick J. Wong Date: Fri Jan 23 09:27:31 2026 -0800 xfs: refactor attr3 leaf table size computation Replace all the open-coded callsites with a single static inline helper. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 3eefc0c2b78444b64feeb3783c017d6adc3cd3ce Author: Darrick J. Wong Date: Fri Jan 23 09:27:31 2026 -0800 xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test VMs: ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) + xfs_attr3_leaf_hdr_size(leaf)); Upon enabling quite a lot more debugging code, I narrowed this down to fsstress trying to set a local extended attribute with namelen=3 and valuelen=71. This results in an entry size of 80 bytes. At the start of xfs_attr3_leaf_add_work, the freemap looks like this: i 0 base 448 size 0 rhs 448 count 46 i 1 base 388 size 132 rhs 448 count 46 i 2 base 2120 size 4 rhs 448 count 46 firstused = 520 where "rhs" is the first byte past the end of the leaf entry array. This is inconsistent -- the entries array ends at byte 448, but freemap[1] says there's free space starting at byte 388! By the end of the function, the freemap is in worse shape: i 0 base 456 size 0 rhs 456 count 47 i 1 base 388 size 52 rhs 456 count 47 i 2 base 2120 size 4 rhs 456 count 47 firstused = 440 Important note: 388 is not aligned with the entries array element size of 8 bytes. Based on the incorrect freemap, the name area starts at byte 440, which is below the end of the entries array! That's why the assertion triggers and the filesystem shuts down. How did we end up here? First, recall from the previous patch that the freemap array in an xattr leaf block is not intended to be a comprehensive map of all free space in the leaf block. In other words, it's perfectly legal to have a leaf block with: * 376 bytes in use by the entries array * freemap[0] has [base = 376, size = 8] * freemap[1] has [base = 388, size = 1500] * the space between 376 and 388 is free, but the freemap stopped tracking that some time ago If we add one xattr, the entries array grows to 384 bytes, and freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we add a second xattr, the entries array grows to 392 bytes, and freemap[0] gets pushed up to [base = 392, size = 0]. This is bad, because freemap[1] hasn't been updated, and now the entries array and the free space claim the same space. The fix here is to adjust all freemap entries so that none of them collide with the entries array. Note that this fix relies on commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and the previous patch that resets zero length freemap entries to have base = 0. Cc: # v2.6.12 Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 6f13c1d2a6271c2e73226864a0e83de2770b6f34 Author: Darrick J. Wong Date: Fri Jan 23 09:27:30 2026 -0800 xfs: delete attr leaf freemap entries when empty Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow"), Brian Foster observed that it's possible for a small freemap at the end of the end of the xattr entries array to experience a size underflow when subtracting the space consumed by an expansion of the entries array. There are only three freemap entries, which means that it is not a complete index of all free space in the leaf block. This code can leave behind a zero-length freemap entry with a nonzero base. Subsequent setxattr operations can increase the base up to the point that it overlaps with another freemap entry. This isn't in and of itself a problem because the code in _leaf_add that finds free space ignores any freemap entry with zero size. However, there's another bug in the freemap update code in _leaf_add, which is that it fails to update a freemap entry that begins midway through the xattr entry that was just appended to the array. That can result in the freemap containing two entries with the same base but different sizes (0 for the "pushed-up" entry, nonzero for the entry that's actually tracking free space). A subsequent _leaf_add can then allocate xattr namevalue entries on top of the entries array, leading to data loss. But fixing that is for later. For now, eliminate the possibility of confusion by zeroing out the base of any freemap entry that has zero size. Because the freemap is not intended to be a complete index of free space, a subsequent failure to find any free space for a new xattr will trigger block compaction, which regenerates the freemap. It looks like this bug has been in the codebase for quite a long time. Cc: # v2.6.12 Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2") Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 20c3c4108d58f87c711bf44cb0b498b3ac5af6bf Author: Michael Roth Date: Fri Jan 9 17:17:33 2026 -0600 KVM: SEV: Add KVM_SEV_SNP_ENABLE_REQ_CERTS command Introduce a new command for KVM_MEMORY_ENCRYPT_OP ioctl that can be used to enable fetching of endorsement key certificates from userspace via the new KVM_EXIT_SNP_REQ_CERTS exit type. Also introduce a new KVM_X86_SEV_SNP_REQ_CERTS KVM device attribute so that userspace can query whether the kernel supports the new command/exit. Suggested-by: Sean Christopherson Reviewed-by: Liam Merwick Tested-by: Liam Merwick Signed-off-by: Michael Roth Link: https://patch.msgid.link/20260109231732.1160759-3-michael.roth@amd.com Signed-off-by: Sean Christopherson commit fa9893fadbc245e179cb17f3c371c67471b5a8a8 Author: Michael Roth Date: Fri Jan 9 17:17:32 2026 -0600 KVM: Introduce KVM_EXIT_SNP_REQ_CERTS for SNP certificate-fetching For SEV-SNP, the host can optionally provide a certificate table to the guest when it issues an attestation request to firmware (see GHCB 2.0 specification regarding "SNP Extended Guest Requests"). This certificate table can then be used to verify the endorsement key used by firmware to sign the attestation report. While it is possible for guests to obtain the certificates through other means, handling it via the host provides more flexibility in being able to keep the certificate data in sync with the endorsement key throughout host-side operations that might resulting in the endorsement key changing. In the case of KVM, userspace will be responsible for fetching the certificate table and keeping it in sync with any modifications to the endorsement key by other userspace management tools. Define a new KVM_EXIT_SNP_REQ_CERTS event where userspace is provided with the GPA of the buffer the guest has provided as part of the attestation request so that userspace can write the certificate data into it while relying on filesystem-based locking to keep the certificates up-to-date relative to the endorsement keys installed/utilized by firmware at the time the certificates are fetched. [Melody: Update the documentation scheme about how file locking is expected to happen.] Reviewed-by: Liam Merwick Tested-by: Liam Merwick Tested-by: Dionna Glaze Signed-off-by: Michael Roth Signed-off-by: Melody Wang Signed-off-by: Michael Roth Link: https://patch.msgid.link/20260109231732.1160759-2-michael.roth@amd.com Signed-off-by: Sean Christopherson commit c4a365cd4a4ec105012ab3ae5ff5cf11f8533771 Author: Sean Christopherson Date: Thu Jan 22 18:28:16 2026 -0800 KVM: x86: Drop WARN on INIT/SIPI being blocked when vCPU is in Wait-For-SIPI Drop the sanity check in kvm_apic_accept_events() that attempts to detect KVM bugs by asserting that a vCPU isn't in Wait-For-SIPI if INIT/SIPI are blocked, because if INIT is blocked, then it should be impossible for a vCPU to get into WFS in the first place. Unfortunately, syzbot is smarter than KVM (and its maintainers), and circumvented the guards put in place by commit 0fe3e8d804fd ("KVM: x86: Move INIT_RECEIVED vs. INIT/SIPI blocked check to KVM_RUN") by swapping the order and stuffing VMXON after INIT, and then triggering kvm_apic_accept_events() by way of KVM_GET_MP_STATE. Simply drop the WARN as it hasn't detected any meaningful KVM bugs in years (if ever?), and preventing userspace from clobbering guest state is generally a non-goal. More importantly, fully closing the hole would likely require enforcing some amount of ordering in KVM's ioctls, which is a much bigger risk than simply deleting the WARN. Reported-by: syzbot+59f2c3a3fc4f6c09b8cd@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6925da1b.a70a0220.d98e3.00b0.GAE@google.com Link: https://patch.msgid.link/20260123022816.2283567-1-seanjc@google.com Signed-off-by: Sean Christopherson commit d000422a46aad32217cf1be747eb61d641baae2f Author: Xin Zhao Date: Tue Dec 23 11:48:36 2025 +0800 tty: tty_port: add workqueue to flip TTY buffer On the embedded platform, certain critical data, such as IMU data, is transmitted through UART. The tty_flip_buffer_push() interface in the TTY layer uses system_dfl_wq to handle the flipping of the TTY buffer. Although the unbound workqueue can create new threads on demand and wake up the kworker thread on an idle CPU, it may be preempted by real-time tasks or other high-prio tasks. flush_to_ldisc() needs to wake up the relevant data handle thread. When executing __wake_up_common_lock(), it calls spin_lock_irqsave(), which does not disable preemption but disables migration in RT-Linux. This prevents the kworker thread from being migrated to other cores by CPU's balancing logic, resulting in long delays. The call trace is as follows: __wake_up_common_lock __wake_up ep_poll_callback __wake_up_common __wake_up_common_lock __wake_up n_tty_receive_buf_common n_tty_receive_buf2 tty_ldisc_receive_buf tty_port_default_receive_buf flush_to_ldisc In our system, the processing interval for each frame of IMU data transmitted via UART can experience significant jitter due to this issue. Instead of the expected 10 to 15 ms frame processing interval, we see spikes up to 30 to 35 ms. Moreover, in just one or two hours, there can be 2 to 3 occurrences of such high jitter, which is quite frequent. This jitter exceeds the software's tolerable limit of 20 ms. Introduce flip_wq in tty_port which can be set by tty_port_link_wq() or as default linked to default workqueue allocated when tty_register_driver(). The default workqueue is allocated with flag WQ_SYSFS, so that cpumask and nice can be set dynamically. The execution timing of tty_port_link_wq() is not clearly restricted. The newly added function tty_port_link_driver_wq() checks whether the flip_wq of the tty_port has already been assigned when linking the default tty_driver's workqueue to the port. After the user has set a custom workqueue for a certain tty_port using tty_port_link_wq(), the system will only use this custom workqueue, even if tty_driver does not have %TTY_DRIVER_CUSTOM_WORKQUEUE flag. Introduce %TTY_DRIVER_CUSTOM_WORKQUEUE flag meaning not to create the default single tty_driver workqueue. Two reasons why need to introduce the %TTY_DRIVER_CUSTOM_WORKQUEUE flag: 1. If the WQ_SYSFS parameter is enabled, workqueue_sysfs_register() will fail when trying to create a workqueue with the same name. The pty is an example of this; if both CONFIG_LEGACY_PTYS and CONFIG_UNIX98_PTYS are enabled, the call to tty_register_driver() in unix98_pty_init() will fail. 2. Different tty ports may be used for different tasks, which may require separate core binding control via workqueues. In this case, the workqueue created by default in the tty driver is unnecessary. Enabling this flag prevents the creation of this redundant workqueue. After applying this patch, we can set the related UART TTY flip buffer workqueue by sysfs. We set the cpumask to CPU cores associated with the IMU tasks, and set the nice to -20. Testing has shown significant improvement in the previously described issue, with almost no stuttering occurring anymore. Signed-off-by: Xin Zhao Reviewed-by: Jiri Slaby Link: https://patch.msgid.link/20251223034836.2625547-1-jackzxcui1989@163.com Signed-off-by: Greg Kroah-Hartman commit 3f0716c604e81d8440b16d0d8f5420c4a6f3c17a Author: Andy Shevchenko Date: Thu Jan 22 11:19:48 2026 +0100 serial: 8250_pci: Remove custom deprecated baud setting routine As comments mentioned this is old (and actually deprecated) interface to set custom baud rates. This interface has limitations as it only allows to set a single opaque value called "custom_divisor". If the HW needs more complex settings (like fractional divisor) it must somehow encode this. This is horrid interface that is very driver specific and not flexible. Meanwhile Linux has established way to set free baud rate settings via BOTHER [1]. With all this being said, remove deprecated interface for good. Link: https://stackoverflow.com/questions/12646324/how-can-i-set-a-custom-baud-rate-on-linux [1] Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260122102349.2395423-3-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1250ebacd4cc59ede613f95e16aba309f364c0f6 Author: Andy Shevchenko Date: Thu Jan 22 11:19:47 2026 +0100 serial: 8250_omap: Remove custom deprecated baud setting routine As comments mentioned this is old (and actually deprecated) interface to set custom baud rates. This interface has limitations as it only allows to set a single opaque value called "custom_divisor". If the HW needs more complex settings (like fractional divisor) it must somehow encode this. This is horrid interface that is very driver specific and not flexible. Meanwhile Linux has established way to set free baud rate settings via BOTHER [1]. With all this being said, remove deprecated interface for good. Link: https://stackoverflow.com/questions/12646324/how-can-i-set-a-custom-baud-rate-on-linux [1] Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260122102349.2395423-2-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b05bebaa60e4e58f36631f41a73716edd8c56d3e Author: Biju Das Date: Tue Jan 20 12:52:12 2026 +0000 dt-bindings: serial: renesas,scif: Document RZ/G3L SoC Add SCIF binding documentation for Renesas RZ/G3L SoC. SCIF block on the RZ/G3L is identical to one found on the RZ/G3S SoC. Signed-off-by: Biju Das Acked-by: Conor Dooley Reviewed-by: Fabrizio Castro Link: https://patch.msgid.link/20260120125232.349708-2-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit b64da5b16ab3c5dcc6e95180891d1c10eda83ffd Author: Kendall Willis Date: Fri Jan 16 13:55:49 2026 -0600 serial: 8250: omap: set out-of-band wakeup if wakeup pinctrl exists In TI K3 SoCs, I/O daisy chaining is used to allow wakeup from UART when the UART controller is off. Set UART device as wakeup capable using out-of-band wakeup if the 'wakeup' pinctrl state exists and the device may wakeup. Reviewed-by: Dhruva Gole Signed-off-by: Kendall Willis Link: https://patch.msgid.link/20260116-uart-wakeup-v2-1-0078ae9996e4@ti.com Signed-off-by: Greg Kroah-Hartman commit 8acc379b664ec987dcc7eca25a5f5c4a9a4eb9c4 Author: Svyatoslav Ryhel Date: Thu Jan 22 17:11:25 2026 +0200 usb: phy: tegra: add HSIC support Add support for HSIC USB mode, which can be set for second USB controller and PHY on Tegra SoC along with already supported UTMI or ULPI. Signed-off-by: Svyatoslav Ryhel Link: https://patch.msgid.link/20260122151125.7367-3-clamor95@gmail.com Signed-off-by: Greg Kroah-Hartman commit 53cc2d90542cfee42bf73627c26318372e7ea50e Author: Svyatoslav Ryhel Date: Thu Jan 22 17:11:24 2026 +0200 usb: phy: tegra: use phy type directly Refactor to directly use enum usb_phy_interface to determine the PHY mode. This change is in preparation for adding support for HSIC mode. Signed-off-by: Svyatoslav Ryhel Link: https://patch.msgid.link/20260122151125.7367-2-clamor95@gmail.com Signed-off-by: Greg Kroah-Hartman commit ffbe78fdbbbdf774a92b47ac138bc1a0a7482096 Author: Andrei Kuchynski Date: Mon Jan 19 13:18:24 2026 +0000 usb: typec: ucsi: Enforce mode selection for cros_ec_ucsi The mode selection sequence is initiated by the driver after all partner alternate modes have been successfully registered. When a partner is disconnected, the driver also stops the mode selection process and releases resources via `typec_mode_selection_delete`. Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260119131824.2529334-8-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit ab2588c040fe6e87e5b1ca5a0d005cc4df14aced Author: Andrei Kuchynski Date: Mon Jan 19 13:18:23 2026 +0000 usb: typec: ucsi: Support mode selection to activate altmodes If the ucsi port driver supports modes selection, it should implement `add_partner_altmodes` and `remove_partner_altmodes` ucsi operations. With these operations the driver can manage the mode selection process. Once partner altmodes are registered, `add_partner_altmodes` is called to start the mode selection. When the partner is unregistered, `remove_partner_altmodes` is supposed to stop any ongoing processes and clean up the resources. `typec_altmode_state_update` informes mode selection about the current mode of the Type-C connector. Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260119131824.2529334-7-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit be727d4000669a64a3ce6697669150d78bb2d492 Author: Andrei Kuchynski Date: Mon Jan 19 13:18:22 2026 +0000 usb: typec: Introduce mode_selection bit The port driver sets this bit for an alternate mode description to indicate support for the mode selection feature. Once set, individual Alt Mode drivers will no longer attempt to activate their respective modes within their probe functions. This prevents race conditions and non-prioritized activation. The bit is not set by default. If left unset, the system retains the current behavior where Alt Mode drivers manage their own activation logic. Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260119131824.2529334-6-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit fb2abc754672f769ca0bc36bdeb3c2f81927f446 Author: Andrei Kuchynski Date: Mon Jan 19 13:18:21 2026 +0000 usb: typec: Implement mode selection The mode selection process is controlled by the following API functions, which allow to initiate and complete mode entry based on the priority of each mode: `typec_mode_selection_start` function compiles a priority list of supported Alternate Modes. `typec_altmode_state_update` function is invoked by the port driver to communicate the current mode of the Type-C connector. `typec_mode_selection_delete` function stops the currently running mode selection process and releases all associated system resources. `mode_selection_work_fn` task attempts to activate modes. The process stops on success; otherwise, it proceeds to the next mode after a timeout or error. Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260119131824.2529334-5-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit 027b304ca3f6989f6946b5b3bcc727cf3f54774f Author: Andrei Kuchynski Date: Mon Jan 19 13:18:20 2026 +0000 usb: typec: Expose alternate mode priority via sysfs This patch introduces a priority sysfs attribute to the USB Type-C alternate mode port interface. This new attribute allows user-space to configure the numeric priority of alternate modes managing their preferred order of operation. If a new priority value conflicts with an existing mode's priority, the priorities of the conflicting mode and all subsequent modes are automatically incremented to ensure uniqueness. Signed-off-by: Andrei Kuchynski Reviewed-by: Benson Leung Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260119131824.2529334-4-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit 4ec128733f68f77af452b0d97d8688cd33cd963e Author: Andrei Kuchynski Date: Mon Jan 19 13:18:19 2026 +0000 platform/chrome: cros_ec_typec: Set no_mode_control flag This flag specifies that the Embedded Controller (EC) must receive explicit approval from the Application Processor (AP) before initiating Type-C alternate modes or USB4 mode. Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Acked-by: Tzung-Bi Shih Reviewed-by: Benson Leung Link: https://patch.msgid.link/20260119131824.2529334-3-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit dfd7b082c0a22ff0d697605a2a6bb62d9a4730a6 Author: Andrei Kuchynski Date: Mon Jan 19 13:18:18 2026 +0000 usb: typec: Add mode_control field to port property This new field in the port properties dictates whether the Platform Policy Manager (PPM) allows the OS Policy Manager (OPM) to change the currently active, negotiated alternate mode. Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Reviewed-by: Benson Leung Link: https://patch.msgid.link/20260119131824.2529334-2-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman commit 1360eb44d2af7baa9357a7c4dd4952c6dd5e9d6f Author: Geert Uytterhoeven Date: Wed Jan 21 15:11:23 2026 +0100 usb: phy: generic: Convert to device property API Convert from OF properties to device properties, to make the driver more generic and simpler. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/e69adff1d6ca7b26cd2a4117d45392e05470d27c.1769004444.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit c9d032cbcac4ee81602232d25a3da0c8d934e1c2 Author: Geert Uytterhoeven Date: Wed Jan 21 15:11:22 2026 +0100 usb: phy: generic: Convert to dev_err_probe() Convert the remaining error handling in the probe path to use the dev_err_probe() helper, to make sure error messages and codes are not missed, and recorded properly. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/68739eb048a394fe9198080e4e57503bb2fb9b64.1769004444.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 300034f97b04761c57111e899eb9d7ce08fcdcd1 Author: Geert Uytterhoeven Date: Wed Jan 21 15:11:21 2026 +0100 usb: phy: generic: Convert to devm_clk_get_optional() The generic USB PHY driver uses the existence of the "clocks" property to see if a clock is optional or not. Use devm_clk_get_optional() instead, which exists for this purpose. As usb_phy_generic.clk is now either a valid clock pointer or NULL, and all clock operations handle NULL pointers gracefully, several IS_ERR() checks can be removed, simplifying the code. Signed-off-by: Geert Uytterhoeven ... Link: https://patch.msgid.link/5cc21d821edf5d40f56a74cd251bb1b982876b72.1769004444.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 62b718d23348b675411b6858931932bf4541fc4b Author: Geert Uytterhoeven Date: Wed Jan 21 15:11:20 2026 +0100 usb: phy: generic: Always use dev in usb_phy_generic_probe() usb_phy_generic_probe() already has a "dev" variable that serves as a shorthand for "&pdev->dev". Use it where appropriate, to shorten the code. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/df4ce4bac088f0a4703dd8a3d1255b9072c0b8c6.1769004444.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 7fa47c1314939bc8250f04e0b15cc10d19328a08 Author: Shuah Khan Date: Wed Jan 21 15:51:56 2026 -0700 usbip: Reduce CONNRESET message noise in dmesg from stub stub_complete() prints informational messages for each urb unlink filling dmesg. Change the message to dev_dbg() similar to vhci reports the CONNRESET condition. Reported-by: Ignacio Hernandez-Ros Closes: https://lore.kernel.org/all/0101019b92e81c20-09906fb4-d5e8-40a6-9192-ab693eef4179-000000@us-west-2.amazonses.com/ Signed-off-by: Shuah Khan Link: https://patch.msgid.link/20260121225157.34635-1-skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 65c4b312f1f13f4b45e18387f4a8bb19c1ea3ff3 Author: Shuah Khan Date: Wed Jan 21 09:51:54 2026 -0700 tools: usb: usbip: remove dead-link from README Remove dead-link to Debug Tips document on usbip project wiki http://usbip.wiki.sourceforge.net/how-to-debug-usbip Tried and failed find the file in archives. It would be nice to locate the file and add this to usbip tool. Reported-by: Ignacio Hernandez-Ros Closes: https://lore.kernel.org/all/0101019bdf6ca137-60344502-51d2-4767-a34b-6a7cf1bfdf4a-000000@us-west-2.amazonses.com/ Signed-off-by: Shuah Khan Link: https://patch.msgid.link/20260121165155.13550-1-skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit f1195ca3b4bbd001d3f1264dce91f83dec7777f5 Author: Justin Chen Date: Tue Jan 20 12:07:54 2026 -0800 usb: bdc: fix sleep during atomic bdc_run() can be ran during atomic context leading to a sleep during atomic warning. Fix this by replacing read_poll_timeout() with read_poll_timeout_atomic(). Fixes: 75ae051efc9b ("usb: gadget: bdc: use readl_poll_timeout() to simplify code") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260120200754.2488765-1-justin.chen@broadcom.com Signed-off-by: Greg Kroah-Hartman commit db7fd1955e6825756d0241343add1d172098bb18 Author: Łukasz Bartosik Date: Tue Jan 20 20:11:48 2026 +0200 xhci: dbc: allow setting manufacturer string through sysfs Add dbc_manufacturer sysfs attribute to allow changing the manufacturer description presented by the debug device when a host requests a string descriptor with iManufacturer index. Value can only be changed while debug capability (DbC) is in disabled state to prevent USB device descriptor change while connected to a USB host. The default value is "Linux Foundation". The string length can be from 1 to 126 characters. String is terminated at null or newline, driver does not support empty string. [ mn: Improve commit message and sysfs entry documentation ] Signed-off-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260120181148.128712-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 33d15312e35d4cfd26b68ab4c1b0143cc43d8b16 Author: Łukasz Bartosik Date: Tue Jan 20 20:11:47 2026 +0200 xhci: dbc: allow setting product string through sysfs Add dbc_product sysfs attribute to allow changing the product description presented by the debug device when a host requests a string descriptor with iProduct index. Value can only be changed while debug capability (DbC) is in disabled state to prevent USB device descriptor change while connected to a USB host. The default value is "Linux USB Debug Target". The field length can be from 1 to 126 characters. String is terminated at null or newline, driver does not support empty string. [ mn: Improve commit message and sysfs entry documentation ] Signed-off-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260120181148.128712-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 412de639b55fcf1ab5ad50a6be84f5164104abe3 Author: Łukasz Bartosik Date: Tue Jan 20 20:11:46 2026 +0200 xhci: dbc: allow setting device serial number through sysfs Add dbc_serial sysfs attribute to allow changing the serial number string descriptor presented by the debug device when a host requests a string descriptor with iSerialNumber index. Value can only be changed while debug capability (DbC) is in disabled state to prevent USB device descriptor change while connected to a USB host. The default value is "0001". The field length can be from 1 to 126 characters. String is terminated at null or newline, driver does not support empty string. [ mn: Improve commit message and sysfs entry documentation ] Signed-off-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260120181148.128712-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a30c923c42508c6467aa65612b578bcba6c277f2 Author: Łukasz Bartosik Date: Tue Jan 20 20:11:45 2026 +0200 xhci: dbc: prepare to expose strings through sysfs Reorganize the code to prepare ground for setting serial number, product and manufacturer names through sysfs. This commit: 1. Introduces new buffers for storing serial number, product and manufacturer name in utf8. The buffers will be used by sysfs *_show and *_store functions. 2. Increases USB string descriptor data maximum length to the value from USB specification (126 bytes of data). 3. Adds new helper functions get_str_desc_len, prepare_len and xhci_dbc_populate_str_desc. Signed-off-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260120181148.128712-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 27fbc19e52b9a76b79a1de691b0b978e335c4c35 Author: Jan Remmet Date: Thu Jan 15 14:11:21 2026 +0100 usb: typec: hd3ss3220: Enable VBUS based on role state For systems where the ID pin isn't available as gpio use the ATTACHED_STATE register instead to control vbus. >From the datasheet: "This is an additional method to communicate attach other than the ID pin. These bits can be read by the application to determine what was attached." Use this method if id-gpios property is not set, but the connector node has vbus-supply defined. Signed-off-by: Jan Remmet Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20260115-wip-jremmet-hd3ss3220_vbus-v1-1-b7d9adfbe346@phytec.de Signed-off-by: Greg Kroah-Hartman commit 4298475deecbd12f7d5a83b340f59ae644c37a5e Author: Chen Ni Date: Thu Jan 15 10:38:00 2026 +0800 usb: dwc3: google: Remove redundant dev_err() The platform_get_irq_byname() function already prints an error message internally upon failure using dev_err_probe(). Therefore, the explicit dev_err() is redundant and results in duplicate error logs. Remove the redundant dev_err() call to clean up the error path. Signed-off-by: Chen Ni Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20260115023800.4142416-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit ef548189fd3f44786fb813af0018cc8b3bbed2b9 Author: Wayne Chang Date: Thu Jan 15 18:36:21 2026 +0800 usb: host: tegra: Remove manual wake IRQ disposal We found that calling irq_dispose_mapping() caused a kernel warning when removing the driver. The IRQs are obtained using platform_get_irq(), which returns a Linux virtual IRQ number directly managed by the device core, not by the OF subsystem. Therefore, the driver should not call irq_dispose_mapping() for these IRQs. Fixes: 5df186e2ef11 ("usb: xhci: tegra: Support USB wakeup function for Tegra234") Cc: stable@vger.kernel.org Signed-off-by: Wayne Chang Signed-off-by: Wei-Cheng Chen Link: https://patch.msgid.link/20260115103621.587366-1-weichengc@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 4f423d896f13e989deff8b655c81232759920dcf Merge: eb89b17f283b23 ae801944cbfb70 Author: Greg Kroah-Hartman Date: Fri Jan 23 17:04:05 2026 +0100 Merge tag 'fpga-for-v6.20-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next Xu writes: FPGA Manager changes for 6.20-rc1 - Mukesh fixes a typo in comments. - Thadeu adds support for built-in dfl driver. - Michal changes his email. - Romain corrects the error handling when an fpga bridge is missing. All patches have been reviewed on the mailing list, and have been in the last linux-next releases (as part of our for-next branch). Signed-off-by: Xu Yilun * tag 'fpga-for-v6.20-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga: fpga: dfl: fix typo in header file fpga: dfl: use subsys_initcall to allow built-in drivers to be added fpga: xilinx: Switch Michal Simek's email to new one fpga: of-fpga-region: Fail if any bridge is missing commit 10d366a846be648aa47cdcd3dc7b7346a4143a6c Author: Syed Saba Kareem Date: Fri Jan 23 15:25:04 2026 +0530 ASoC: amd: acp: Fix Kconfig dependencies for SND_SOC_ACPI_AMD_SDCA_QUIRKS Fix the following kconfig warning reported by the kernel test robot: kismet: WARNING: unmet direct dependencies detected for SND_SOC_ACPI_AMD_SDCA_QUIRKS when selected by SND_SOC_ACPI_AMD_MATCH Depends on [n]: SOUND [=y] && SND [=y] && SND_SOC [=y] && ACPI [=y] && SND_SOC_SDCA [=n] Selected by [y]: - SND_SOC_ACPI_AMD_MATCH [=y] && SOUND [=y] && SND [=y] && SND_SOC [=y] The issue occurs because SND_SOC_ACPI_AMD_SDCA_QUIRKS depends on SND_SOC_SDCA, which may be disabled, causing unmet dependency warnings. Fix this by adjusting the Kconfig dependency logic accordingly. Fixes: e7c30ac379b4 ("ASoC: amd: acp: soc-acpi: add is_device_rt712_vb() helper") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601131155.RXGj4KHv-lkp@intel.com Signed-off-by: Syed Saba Kareem Link: https://patch.msgid.link/20260123095524.490655-1-syed.sabakareem@amd.com Signed-off-by: Mark Brown commit 74120bc29856509c585c38dbe963801ecdabac46 Author: Richard Fitzgerald Date: Fri Jan 23 11:13:54 2026 +0000 ASoC: cs35l56-test: Fix missing module namespace import The test must import namespace "EXPORTED_FOR_KUNIT_TESTING". Signed-off-by: Richard Fitzgerald Fixes: d0ab89951197 ("ASoC: cs35l56: Add KUnit testing of cs35l56_set_fw_suffix()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601221843.kS9IMZ0E-lkp@intel.com/ Link: https://patch.msgid.link/20260123111354.1931986-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 4a393958b6a1f8e476201437dbad2580d9b8700e Author: Sebastian Andrzej Siewior Date: Fri Jan 23 12:36:58 2026 +0100 ASoC: codecs: rt56*: Remove IRQF_ONESHOT Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also disallows force-threading of the primary handler and the irq-core will warn about this. Remove IRQF_ONESHOT from irqflags. Cc: Oder Chiou Cc: Liam Girdwood Cc: Mark Brown Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: linux-sound@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20260123113708.416727-13-bigeasy@linutronix.de Signed-off-by: Mark Brown commit 506e0825a4c9b251d141f0f31c6cde1bdc2983ff Author: Rob Herring (Arm) Date: Wed Jan 21 17:57:56 2026 -0600 ASoC: dt-bindings: Convert ti,tas2552 to DT schema Convert the TI TAS2552 codec binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260121235757.370920-1-robh@kernel.org Signed-off-by: Mark Brown commit 9396bfdacb5aa2bcb3d2242b0de527e7d4f8a3cd Author: Andrey Albershteyn Date: Wed Jan 21 20:36:43 2026 +0100 fs: reset read-only fsflags together with xflags While setting file attributes, the read-only flags are reset for ->xflags, but not for ->flags if flag is shared between both. This is fine for now as all read-only xflags don't overlap with flags. However, for any read-only shared flag this will create inconsistency between xflags and flags. The non-shared flag will be reset in vfs_fileattr_set() to the current value, but shared one is past further to ->fileattr_set. Reported-by: Eric Biggers Signed-off-by: Andrey Albershteyn Link: https://patch.msgid.link/20260121193645.3611716-1-aalbersh@kernel.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit a45dd34663025c75652b27e384e91c9c05ba1d80 Author: Nicolin Chen Date: Wed Jan 14 17:12:43 2026 -0800 iommu/arm-smmu-v3: Do not set disable_ats unless vSTE is Translate A vSTE may have three configuration types: Abort, Bypass, and Translate. An Abort vSTE wouldn't enable ATS, but the other two might. It makes sense for a Transalte vSTE to rely on the guest vSTE.EATS field. For a Bypass vSTE, it would end up with an S2-only physical STE, similar to an attachment to a regular S2 domain. However, the nested case always disables ATS following the Bypass vSTE, while the regular S2 case always enables ATS so long as arm_smmu_ats_supported(master) == true. Note that ATS is needed for certain VM centric workloads and historically non-vSMMU cases have relied on this automatic enablement. So, having the nested case behave differently causes problems. To fix that, add a condition to disable_ats, so that it might enable ATS for a Bypass vSTE, aligning with the regular S2 case. Fixes: f27298a82ba0 ("iommu/arm-smmu-v3: Allow ATS for IOMMU_DOMAIN_NESTED") Cc: stable@vger.kernel.org Suggested-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon commit a4f976edcb87a9daf5384f3e5e13f80e0e180aa6 Author: Nicolin Chen Date: Thu Jan 15 10:23:31 2026 -0800 iommu/arm-smmu-v3-test: Add nested s1bypass/s1dssbypass coverage STE in a nested case requires both S1 and S2 fields. And this makes the use case different from the existing one. Add coverage for previously failed cases shifting between S2-only and S1+S2 STEs. Reviewed-by: Shuai Xue Reviewed-by: Mostafa Saleh Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit 7cad800485956a263318930613f8f4a084af8c70 Author: Jason Gunthorpe Date: Thu Jan 15 10:23:30 2026 -0800 iommu/arm-smmu-v3: Mark EATS_TRANS safe when computing the update sequence If VM wants to toggle EATS_TRANS off at the same time as changing the CFG, hypervisor will see EATS change to 0 and insert a V=0 breaking update into the STE even though the VM did not ask for that. In bare metal, EATS_TRANS is ignored by CFG=ABORT/BYPASS, which is why this does not cause a problem until we have the nested case where CFG is always a variation of S2 trans that does use EATS_TRANS. Relax the rules for EATS_TRANS sequencing, we don't need it to be exact as the enclosing code will always disable ATS at the PCI device when changing EATS_TRANS. This ensures there are no ATS transactions that can race with an EATS_TRANS change so we don't need to carefully sequence these bits. Fixes: 1e8be08d1c91 ("iommu/arm-smmu-v3: Support IOMMU_DOMAIN_NESTED") Cc: stable@vger.kernel.org Signed-off-by: Jason Gunthorpe Reviewed-by: Shuai Xue Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit f3c1d372dbb8e5a86923f20db66deabef42bfc9d Author: Jason Gunthorpe Date: Thu Jan 15 10:23:29 2026 -0800 iommu/arm-smmu-v3: Mark STE MEV safe when computing the update sequence Nested CD tables set the MEV bit to try to reduce multi-fault spamming on the hypervisor. Since MEV is in STE word 1 this causes a breaking update sequence that is not required and impacts real workloads. For the purposes of STE updates the value of MEV doesn't matter, if it is set/cleared early or late it just results in a change to the fault reports that must be supported by the kernel anyhow. The spec says: Note: Software must expect, and be able to deal with, coalesced fault records even when MEV == 0. So mark STE MEV safe when computing the update sequence, to avoid creating a breaking update. Fixes: da0c56520e88 ("iommu/arm-smmu-v3: Set MEV bit in nested STE for DoS mitigations") Cc: stable@vger.kernel.org Signed-off-by: Jason Gunthorpe Reviewed-by: Shuai Xue Reviewed-by: Mostafa Saleh Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit 2781f2a930abb5d27f80b8afbabfa19684833b65 Author: Jason Gunthorpe Date: Thu Jan 15 10:23:28 2026 -0800 iommu/arm-smmu-v3: Add update_safe bits to fix STE update sequence C_BAD_STE was observed when updating nested STE from an S1-bypass mode to an S1DSS-bypass mode. As both modes enabled S2, the used bit is slightly different than the normal S1-bypass and S1DSS-bypass modes. As a result, fields like MEV and EATS in S2's used list marked the word1 as a critical word that requested a STE.V=0. This breaks a hitless update. However, both MEV and EATS aren't critical in terms of STE update. One controls the merge of the events and the other controls the ATS that is managed by the driver at the same time via pci_enable_ats(). Add an arm_smmu_get_ste_update_safe() to allow STE update algorithm to relax those fields, avoiding the STE update breakages. After this change, entry_set has no caller checking its return value, so change it to void. Note that this change is required by both MEV and EATS fields, which were introduced in different kernel versions. So add get_update_safe() first. MEV and EATS will be added to arm_smmu_get_ste_update_safe() separately. Fixes: 1e8be08d1c91 ("iommu/arm-smmu-v3: Support IOMMU_DOMAIN_NESTED") Cc: stable@vger.kernel.org Signed-off-by: Jason Gunthorpe Reviewed-by: Shuai Xue Reviewed-by: Mostafa Saleh Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit 173eb9a902d1d9ce6d0d6a88546f0f7a07bfbdf4 Merge: f9c08bc13eb267 22ca2497833747 Author: Marc Kleine-Budde Date: Fri Jan 23 14:37:27 2026 +0100 Merge patch series "can: sja1000: clean up CAN state handling" Marc Kleine-Budde says: The CAN controller triggers an EPI interrupt when it enters the error passive state or transitions back to error active. Rather than tracking state in the driver, the CAN controller state should be derived from the TX/RX error counters using can_state_get_by_berr_counter(). Link: https://patch.msgid.link/20260123-sja1000-state-handling-v2-0-687498087dad@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 22ca24978337477969b955b9bfc46d28b59b5bf7 Author: Michael Tretter Date: Fri Jan 23 11:16:27 2026 +0100 can: sja1000: sja1000_err(): use error counter for error state The CAN controller sends the EPI interrupt whenever it reaches the error passive status or enters the error active status from the error passive status. Instead of keeping track of the controller status in the driver, read the txerr and rxerr counters and use can_state_get_by_berr_counter() to determine the state of the CAN controller. Suggested-by: Achim Baumgartner Signed-off-by: Michael Tretter Link: https://patch.msgid.link/20260123-sja1000-state-handling-v2-2-687498087dad@pengutronix.de Signed-off-by: Marc Kleine-Budde commit a6c89d75fd33b0df5e4f88ae9458d455f21fc656 Author: Marc Kleine-Budde Date: Fri Jan 23 11:16:26 2026 +0100 can: sja1000: sja1000_err(): make use of sja1000_get_berr_counter() to read error counters This is a preparation patch to make use of can_state_get_by_berr_counter() which works on a struct can_berr_counter. Reuse the existing function sja1000_get_berr_counter() to read the error counters into a struct can_berr_counter. Reviewed-by: Michael Tretter Link: https://patch.msgid.link/20260123-sja1000-state-handling-v2-1-687498087dad@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 3fed7e0059f0af1d0e71e165145a1e3030526835 Author: Lucas Wei Date: Wed Jan 14 14:52:41 2026 +0000 arm64: errata: Workaround for SI L1 downstream coherency issue When software issues a Cache Maintenance Operation (CMO) targeting a dirty cache line, the CPU and DSU cluster may optimize the operation by combining the CopyBack Write and CMO into a single combined CopyBack Write plus CMO transaction presented to the interconnect (MCN). For these combined transactions, the MCN splits the operation into two separate transactions, one Write and one CMO, and then propagates the write and optionally the CMO to the downstream memory system or external Point of Serialization (PoS). However, the MCN may return an early CompCMO response to the DSU cluster before the corresponding Write and CMO transactions have completed at the external PoS or downstream memory. As a result, stale data may be observed by external observers that are directly connected to the external PoS or downstream memory. This erratum affects any system topology in which the following conditions apply: - The Point of Serialization (PoS) is located downstream of the interconnect. - A downstream observer accesses memory directly, bypassing the interconnect. Conditions: This erratum occurs only when all of the following conditions are met: 1. Software executes a data cache maintenance operation, specifically, a clean or clean&invalidate by virtual address (DC CVAC or DC CIVAC), that hits on unique dirty data in the CPU or DSU cache. This results in a combined CopyBack and CMO being issued to the interconnect. 2. The interconnect splits the combined transaction into separate Write and CMO transactions and returns an early completion response to the CPU or DSU before the write has completed at the downstream memory or PoS. 3. A downstream observer accesses the affected memory address after the early completion response is issued but before the actual memory write has completed. This allows the observer to read stale data that has not yet been updated at the PoS or downstream memory. The implementation of workaround put a second loop of CMOs at the same virtual address whose operation meet erratum conditions to wait until cache data be cleaned to PoC. This way of implementation mitigates performance penalty compared to purely duplicate original CMO. Signed-off-by: Lucas Wei Signed-off-by: Will Deacon commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 Author: Thorsten Schmelzer Date: Fri Jan 23 09:57:05 2026 +0100 HID: multitouch: add eGalaxTouch EXC3188 support Add support for the for the EXC3188 touchscreen from eGalaxy. Signed-off-by: Thorsten Schmelzer Signed-off-by: Michael Tretter Signed-off-by: Jiri Kosina commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 Author: David Phillips Date: Fri Jan 23 12:56:09 2026 +0900 HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK New model in the ELECOM HUGE trackball line that has 8 buttons but the report descriptor specifies only 5. The HUGE Plus supports connecting via Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable. Each connection type reports a different device id, 01AA for cable, 01AB for USB dongle, and 01AC for Bluetooth. This patch adds these device IDs and applies the fixups similar to the other ELECOM devices to get all 8 buttons working for all 3 connection types. For reference, the usbhid-dump output: 001:013:001:DESCRIPTOR 1769085639.598405 05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01 29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01 81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10 95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06 05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0 C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01 2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03 75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00 A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81 02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 FF 00 75 08 95 07 B1 02 C0 Signed-off-by: David Phillips Signed-off-by: Jiri Kosina commit 74bd284537b3447c651588101c32a203e4fe1a32 Author: Jan Kara Date: Wed Oct 15 16:06:33 2025 +0200 fsnotify: Shutdown fsnotify before destroying sb's dcache Currently fsnotify_sb_delete() was called after we have evicted superblock's dcache and inode cache. This was done mainly so that we iterate as few inodes as possible when removing inode marks. However, as Jakub reported, this is problematic because for some filesystems encoding of file handles uses sb->s_root which gets cleared as part of dcache eviction. And either delayed fsnotify events or reading fdinfo for fsnotify group with marks on fs being unmounted may trigger encoding of file handles during unmount. So move shutdown of fsnotify subsystem before shrinking of dcache. Link: https://lore.kernel.org/linux-fsdevel/CAOQ4uxgXvwumYvJm3cLDFfx-TsU3g5-yVsTiG=6i8KS48dn0mQ@mail.gmail.com/ Reported-by: Jakub Acs Reviewed-by: Amir Goldstein Reviewed-by: Christian Brauner Signed-off-by: Jan Kara commit a05fc7edd988c176491487ef0ae4dbf5f7a64cd7 Author: Jan Kara Date: Wed Oct 15 16:02:47 2025 +0200 fsnotify: Use connector list for destroying inode marks Instead of iterating all inodes belonging to a superblock to find inode marks and remove them on umount, iterate all inode connectors for the superblock. This may be substantially faster since there are generally much less inodes with fsnotify marks than all inodes. It also removes one use of sb->s_inodes list which we strive to ultimately remove. Reviewed-by: Amir Goldstein Reviewed-by: Christian Brauner Signed-off-by: Jan Kara commit 94bd01253c3d5b1cd8955bdadeed24af02088094 Author: Jan Kara Date: Mon Jan 19 15:54:33 2026 +0100 fsnotify: Track inode connectors for a superblock Introduce a linked list tracking all inode connectors for a superblock. We will use this list when the superblock is getting shutdown to properly clean up all the inode marks instead of relying on scanning all inodes in the superblock which can get rather slow. Suggested-by: Amir Goldstein Reviewed-by: Amir Goldstein Reviewed-by: Christian Brauner Signed-off-by: Jan Kara commit e4d3fc6a22f53e5bbe51e28b43cb32bc130d9f87 Author: Ming Lei Date: Fri Jan 23 17:15:44 2026 +0800 selftests: ublk: fix test name Fix the two added test name. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit e4c4bfec2bb8db9963d87e8ccdf89cd9e485d7b6 Author: Ming Lei Date: Fri Jan 23 17:15:43 2026 +0800 ublk: fix canceling flag handling in batch I/O recovery Two issues with ubq->canceling flag handling: 1) In ublk_queue_reset_io_flags(), ubq->canceling is set outside cancel_lock, violating the locking requirement. Move it inside the spinlock-protected section. 2) In ublk_batch_unprep_io(), when rolling back after a batch prep failure, if the queue became ready during prep (which cleared canceling), the flag is not restored when the queue becomes not-ready again. This allows new requests to be queued to uninitialized IO slots. Fix by restoring ubq->canceling = true under cancel_lock when the queue transitions from ready to not-ready during rollback. Reported-by: Jens Axboe Fixes: 3f3850785594 ("ublk: fix batch I/O recovery -ENODEV error") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit dbc635c4be7eba1d0e0fe0275a289ee3ccc63d72 Author: Ming Lei Date: Fri Jan 23 17:15:42 2026 +0800 ublk: move ublk_mark_io_ready() out of __ublk_fetch() ublk_batch_prep_io() calls __ublk_fetch() while holding io->lock spinlock. When the last IO makes the device ready, ublk_mark_io_ready() tries to acquire ub->cancel_mutex which can sleep, causing a sleeping-while-atomic bug. Fix by moving ublk_mark_io_ready() out of __ublk_fetch() and into the callers (ublk_fetch and ublk_batch_prep_io) after the spinlock is released. Reported-by: Jens Axboe Fixes: b256795b3606 ("ublk: handle UBLK_U_IO_PREP_IO_CMDS") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 1edf0891d0f4a6c186721e41323c9a3b86ceceda Author: Jens Axboe Date: Fri Jan 23 05:09:08 2026 -0700 io_uring: fix bad indentation for setup flags if statement smatch complains about this: smatch warnings: io_uring/io_uring.c:2741 io_uring_sanitise_params() warn: if statement not indented hence fix it up. Link: https://lore.kernel.org/all/202601231651.HeTmPS8C-lkp@intel.com/ Fixes: 5247c034a67f ("io_uring: introduce non-circular SQ") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601231651.HeTmPS8C-lkp@intel.com/ Signed-off-by: Jens Axboe commit d86d7817c042dd651d47b1873f4b6eaefbedd890 Author: Hongzhen Luo Date: Fri Jan 23 01:31:32 2026 +0000 erofs: implement .fadvise for page cache share This patch implements the .fadvise interface for page cache share. Similar to overlayfs, it drops those clean, unused pages through vfs_fadvise(). Signed-off-by: Hongzhen Luo Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 9364b55a4dbf1ae9a8cb077cb8b7d0c7401d00fc Author: Hongzhen Luo Date: Fri Jan 23 01:31:31 2026 +0000 erofs: support compressed inodes for page cache share This patch adds page cache sharing functionality for compressed inodes. Signed-off-by: Hongzhen Luo Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 34096ba919fd0b32e86e5d617c45d0998a495c7a Author: Hongbo Li Date: Fri Jan 23 01:31:30 2026 +0000 erofs: support unencoded inodes for page cache share This patch adds inode page cache sharing functionality for unencoded files. I conducted experiments in the container environment. Below is the memory usage for reading all files in two different minor versions of container images: +-------------------+------------------+-------------+---------------+ | Image | Page Cache Share | Memory (MB) | Memory | | | | | Reduction (%) | +-------------------+------------------+-------------+---------------+ | | No | 241 | - | | redis +------------------+-------------+---------------+ | 7.2.4 & 7.2.5 | Yes | 163 | 33% | +-------------------+------------------+-------------+---------------+ | | No | 872 | - | | postgres +------------------+-------------+---------------+ | 16.1 & 16.2 | Yes | 630 | 28% | +-------------------+------------------+-------------+---------------+ | | No | 2771 | - | | tensorflow +------------------+-------------+---------------+ | 2.11.0 & 2.11.1 | Yes | 2340 | 16% | +-------------------+------------------+-------------+---------------+ | | No | 926 | - | | mysql +------------------+-------------+---------------+ | 8.0.11 & 8.0.12 | Yes | 735 | 21% | +-------------------+------------------+-------------+---------------+ | | No | 390 | - | | nginx +------------------+-------------+---------------+ | 7.2.4 & 7.2.5 | Yes | 219 | 44% | +-------------------+------------------+-------------+---------------+ | tomcat | No | 924 | - | | 10.1.25 & 10.1.26 +------------------+-------------+---------------+ | | Yes | 474 | 49% | +-------------------+------------------+-------------+---------------+ Additionally, the table below shows the runtime memory usage of the container: +-------------------+------------------+-------------+---------------+ | Image | Page Cache Share | Memory (MB) | Memory | | | | | Reduction (%) | +-------------------+------------------+-------------+---------------+ | | No | 35 | - | | redis +------------------+-------------+---------------+ | 7.2.4 & 7.2.5 | Yes | 28 | 20% | +-------------------+------------------+-------------+---------------+ | | No | 149 | - | | postgres +------------------+-------------+---------------+ | 16.1 & 16.2 | Yes | 95 | 37% | +-------------------+------------------+-------------+---------------+ | | No | 1028 | - | | tensorflow +------------------+-------------+---------------+ | 2.11.0 & 2.11.1 | Yes | 930 | 10% | +-------------------+------------------+-------------+---------------+ | | No | 155 | - | | mysql +------------------+-------------+---------------+ | 8.0.11 & 8.0.12 | Yes | 132 | 15% | +-------------------+------------------+-------------+---------------+ | | No | 25 | - | | nginx +------------------+-------------+---------------+ | 7.2.4 & 7.2.5 | Yes | 20 | 20% | +-------------------+------------------+-------------+---------------+ | tomcat | No | 186 | - | | 10.1.25 & 10.1.26 +------------------+-------------+---------------+ | | Yes | 98 | 48% | +-------------------+------------------+-------------+---------------+ Co-developed-by: Hongzhen Luo Signed-off-by: Hongzhen Luo Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 69368d2ded39b6a7ca6bd9fd53ee0d1f904e3601 Author: Hongbo Li Date: Fri Jan 23 01:31:29 2026 +0000 erofs: pass inode to trace_erofs_read_folio The trace_erofs_read_folio accesses inode information through folio, but this method fails if the real inode is not associated with the folio(such as in the upcoming page cache sharing case). Therefore, we pass the real inode to it so that the inode information can be printed out in that case. Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 5ef3208e3be50aa08b4e7a2832f34e16d42c08b3 Author: Hongzhen Luo Date: Fri Jan 23 01:31:28 2026 +0000 erofs: introduce the page cache share feature Currently, reading files with different paths (or names) but the same content will consume multiple copies of the page cache, even if the content of these page caches is the same. For example, reading identical files (e.g., *.so files) from two different minor versions of container images will cost multiple copies of the same page cache, since different containers have different mount points. Therefore, sharing the page cache for files with the same content can save memory. This introduces the page cache share feature in erofs. It allocate a shared inode and use its page cache as shared. Reads for files with identical content will ultimately be routed to the page cache of the shared inode. In this way, a single page cache satisfies multiple read requests for different files with the same contents. We introduce new mount option `inode_share` to enable the page sharing mode during mounting. This option is used in conjunction with `domain_id` to share the page cache within the same trusted domain. Signed-off-by: Hongzhen Luo Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit e77762e8966c9466a84b22680ad04880dab11914 Author: Hongbo Li Date: Fri Jan 23 01:31:27 2026 +0000 erofs: using domain_id in the safer way Either the existing fscache usecase or the upcoming page cache sharing case, the `domain_id` should be protected as sensitive information, so we use the safer helpers to allocate, free and display domain_id. Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 78331814a502b6b27ccf57dcd09801d2b48709e1 Author: Hongbo Li Date: Fri Jan 23 07:52:39 2026 +0000 erofs: add erofs_inode_set_aops helper to set the aops Add erofs_inode_set_aops helper to set the inode->i_mapping->a_ops and use IS_ENABLED to make it cleaner. Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit e0bf7d1c074dc4252223ae897560345ccc24100d Author: Hongzhen Luo Date: Fri Jan 23 01:31:25 2026 +0000 erofs: support user-defined fingerprint name When creating the EROFS image, users can specify the fingerprint name. This is to prepare for the upcoming inode page cache share. Signed-off-by: Hongzhen Luo Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 4340ca47c35b2be0b0945a3c2c9c9ee058520b96 Author: Gao Xiang Date: Fri Jan 23 01:31:24 2026 +0000 erofs: decouple `struct erofs_anon_fs_type` - Move the `struct erofs_anon_fs_type` to super.c and expose it in preparation for the upcoming page cache share feature; - Remove the `.owner` field, as they are all internal mounts and fully managed by EROFS. Retaining `.owner` would unnecessarily increment module reference counts, preventing the EROFS kernel module from being unloaded. Signed-off-by: Gao Xiang commit 37364497048c5081d3bfa424638cc91a7a7644e2 Author: Hongbo Li Date: Fri Jan 23 01:31:23 2026 +0000 fs: Export alloc_empty_backing_file There is no need to open nonexistent real files if backing files couldn't be backed by real files (e.g., EROFS page cache sharing doesn't need typical real files to open again). Therefore, we export the alloc_empty_backing_file() helper, allowing filesystems to dynamically set the backing file without real file open. This is particularly useful for obtaining the correct @path and @inode when calling file_user_path() and file_user_inode(). Signed-off-by: Hongbo Li Reviewed-by: Gao Xiang Acked-by: Amir Goldstein Acked-by: Christian Brauner Signed-off-by: Gao Xiang commit b35f42a98b9b3abaa93b7be519dd1bb14e471f57 Author: Shenghao Ding Date: Fri Jan 23 08:59:59 2026 +0800 ALSA: hda/tas2781: Drop the unused macro definition Niether TASDEVICE_CALIBRATION_REG_ADDRESS nor TASDEV_UEFI_CALI_REG_ADDR_FLG is referenced in the code, drop both. Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20260123010000.1841-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit 0bd20d8ee3f7b449241d690a17cf0a4981e1c959 Merge: 58d081ea4eab92 3431d387a7042c Author: Gao Xiang Date: Fri Jan 23 19:32:25 2026 +0800 Merge branch 'vfs-7.0.iomap' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull 'vfs-7.0.iomap' to allow iomap page cache users to set `iomap_iter::private` for the upcoming page cache sharing support. It also includes a patch to avoid triggering inline data reads for the FIEMAP operation. Signed-off-by: Gao Xiang commit 230b080623fec2e1302df2afe2cf2dcb34f9c89b Author: Fuad Tabba Date: Thu Jan 22 11:22:18 2026 +0000 KVM: arm64: Use kvm_has_mte() in pKVM trap initialization When initializing HCR traps in protected mode, use kvm_has_mte() to check for MTE support rather than kvm_has_feat(kvm, ID_AA64PFR1_EL1, MTE, IMP). kvm_has_mte() provides a more comprehensive check: - kvm_has_feat() only checks if MTE is in the guest's ID register view (i.e., what we advertise to the guest) - kvm_has_mte() checks both system_supports_mte() AND whether KVM_ARCH_FLAG_MTE_ENABLED is set for this VM instance Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260122112218.531948-5-tabba@google.com Signed-off-by: Marc Zyngier commit 5ee8ad69da07d0e2cffa0ce2f2339c9ad2d587f2 Author: Fuad Tabba Date: Thu Jan 22 11:22:17 2026 +0000 KVM: arm64: Inject UNDEF when accessing MTE sysregs with MTE disabled When MTE hardware is present but disabled via software (`arm64.nomte` or `CONFIG_ARM64_MTE=n`), the kernel clears `HCR_EL2.ATA` and sets `HCR_EL2.TID5`, to prevent the use of MTE instructions. Additionally, accesses to certain MTE system registers trap to EL2 with exception class ESR_ELx_EC_SYS64. To emulate hardware without MTE (where such accesses would cause an Undefined Instruction exception), inject UNDEF into the host. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260122112218.531948-4-tabba@google.com Signed-off-by: Marc Zyngier commit f35abcbb8a084db4c24b66ccc8db0405c08e2f61 Author: Fuad Tabba Date: Thu Jan 22 11:22:16 2026 +0000 KVM: arm64: Trap MTE access and discovery when MTE is disabled If MTE is not supported by the hardware, or is disabled in the kernel configuration (`CONFIG_ARM64_MTE=n`) or command line (`arm64.nomte`), the kernel stops advertising MTE to userspace and avoids using MTE instructions. However, this is a software-level disable only. When MTE hardware is present and enabled by EL3 firmware, leaving `HCR_EL2.ATA` set allows the host to execute MTE instructions (STG, LDG, etc.) and access allocation tags in physical memory. Prevent this by clearing `HCR_EL2.ATA` when MTE is disabled. Remove it from the `HCR_HOST_NVHE_FLAGS` default, and conditionally set it in `cpu_prepare_hyp_mode()` only when `system_supports_mte()` returns true. This causes MTE instructions to trap to EL2 when `HCR_EL2.ATA` is cleared. Additionally, set `HCR_EL2.TID5` when MTE is disabled. This traps reads of `GMID_EL1` (Multiple tag transfer ID register) to EL2, preventing the discovery of MTE parameters (such as tag block size) when the feature is suppressed. Early boot code in `head.S` temporarily keeps `HCR_ATA` set to avoid special-casing initialization paths. This is safe because this code executes before untrusted code runs and will clear `HCR_ATA` if MTE is disabled. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260122112218.531948-3-tabba@google.com Signed-off-by: Marc Zyngier commit c103c2dfe4975da31b67a0fcb95761359f30992d Author: Fuad Tabba Date: Thu Jan 22 11:22:15 2026 +0000 KVM: arm64: Remove dead code resetting HCR_EL2 for pKVM The pKVM lifecycle does not support tearing down the hypervisor and returning to the hyp stub once initialized. The transition to protected mode is one-way. Consequently, the code path in hyp-init.S responsible for resetting EL2 registers (triggered by kexec or hibernation) is unreachable in protected mode. Remove the dead code handling HCR_EL2 reset for ARM64_KVM_PROTECTED_MODE. No functional change intended. Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260122112218.531948-2-tabba@google.com Signed-off-by: Marc Zyngier commit 7d3825bfb54239c49284c5770a4d421daf5470ba Author: Danilo Krummrich Date: Tue Jan 20 13:38:53 2026 +0100 MAINTAINERS: Add missing T: entry for FIRMWARE LOADER The firmware loader is maintained through the driver-core tree, hence add a corresponding T: entry. Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260120123925.28267-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 428ad969c304bf94e11288dbfb4033baaa873a9f Author: Danilo Krummrich Date: Tue Jan 20 13:38:52 2026 +0100 MAINTAINERS: Add driver-core mailing list Add the driver-core mailing list for all entries maintained under the driver-core tree. If existent, replace linux-kernel and rust-for-linux list entries, as they're automatically picked up by scripts/get_maintainer.pl. Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260120123925.28267-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit fc94368bcee555b2cc44c2f4e7c4fcbb50404cd3 Author: Qiliang Yuan Date: Fri Jan 23 03:12:21 2026 -0500 fs/file: optimize close_range() complexity from O(N) to O(Sparse) In close_range(), the kernel traditionally performs a linear scan over the [fd, max_fd] range, resulting in O(N) complexity where N is the range size. For processes with sparse FD tables, this is inefficient as it checks many unallocated slots. This patch optimizes __range_close() by using find_next_bit() on the open_fds bitmap to skip holes. This shifts the algorithmic complexity from O(Range Size) to O(Active FDs), providing a significant performance boost for large-range close operations on sparse file descriptor tables. Signed-off-by: Qiliang Yuan Signed-off-by: Qiliang Yuan Link: https://patch.msgid.link/20260123081221.659125-1-realwujing@gmail.com Signed-off-by: Christian Brauner commit c983b3e276859edfeb836ba9f981ed71eee249df Merge: cb6cd8a86d5b02 f7d05ee84a6a8d Author: Marc Zyngier Date: Fri Jan 23 10:04:47 2026 +0000 Merge branch kvm-arm64/pkvm-features-6.20 into kvmarm-master/next * kvm-arm64/pkvm-features-6.20: : . : pKVM guest feature trapping fixes, courtesy of Fuad Tabba. : . KVM: arm64: Prevent host from managing timer offsets for protected VMs KVM: arm64: Check whether a VM IOCTL is allowed in pKVM KVM: arm64: Track KVM IOCTLs and their associated KVM caps KVM: arm64: Do not allow KVM_CAP_ARM_MTE for any guest in pKVM KVM: arm64: Include VM type when checking VM capabilities in pKVM KVM: arm64: Introduce helper to calculate fault IPA offset KVM: arm64: Fix MTE flag initialization for protected VMs KVM: arm64: Fix Trace Buffer trap polarity for protected VMs KVM: arm64: Fix Trace Buffer trapping for protected VMs Signed-off-by: Marc Zyngier commit cb6cd8a86d5b024f181b5520bcb948a27a257914 Merge: 7c652c0ddddd00 b638a9d0f8965b Author: Marc Zyngier Date: Fri Jan 23 10:04:35 2026 +0000 Merge branch kvm-arm64/feat_idst into kvmarm-master/next * kvm-arm64/feat_idst: : . : Add support for FEAT_IDST, allowing ID registers that are not implemented : to be reported as a normal trap rather than as an UNDEF exception. : . KVM: arm64: selftests: Add a test for FEAT_IDST KVM: arm64: pkvm: Report optional ID register traps with a 0x18 syndrome KVM: arm64: pkvm: Add a generic synchronous exception injection primitive KVM: arm64: Force trap of GMID_EL1 when the guest doesn't have MTE KVM: arm64: Handle CSSIDR2_EL1 and SMIDR_EL1 in a generic way KVM: arm64: Handle FEAT_IDST for sysregs without specific handlers KVM: arm64: Add a generic synchronous exception injection primitive KVM: arm64: Add trap routing for GMID_EL1 arm64: Repaint ID_AA64MMFR2_EL1.IDS description Signed-off-by: Marc Zyngier commit 7c652c0ddddd0058d8b3e3b044eb0ea10cf2def3 Merge: 1c07f35ff7b05f e0a99a2b72f3c6 Author: Marc Zyngier Date: Fri Jan 23 10:04:20 2026 +0000 Merge branch kvm-arm64/selftests-6.20 into kvmarm-master/next * kvm-arm64/selftests-6.20: : . : Some selftest fixes addressing page alignment issues as well as : a bad MMU setup bug, courtesy of Fuad Tabba. : . KVM: selftests: Fix typos and stale comments in kvm_util KVM: selftests: Move page_align() to shared header KVM: riscv: selftests: Fix incorrect rounding in page_align() KVM: arm64: selftests: Fix incorrect rounding in page_align() KVM: arm64: selftests: Disable unused TTBR1_EL1 translations Signed-off-by: Marc Zyngier commit 1c07f35ff7b05f8e17e3eac0e7ca4fb2acb46963 Merge: 31c70b971a2d48 2eb80a2eee1876 Author: Marc Zyngier Date: Fri Jan 23 10:03:03 2026 +0000 Merge branch kvm-arm64/vtcr into kvmarm-master/next * kvm-arm64/vtcr: : . : VTCR_EL2 conversion to the configuration-driven RESx framework, : fixing a couple of UXN/PXN/XN bugs in the process. : . KVM: arm64: nv: Return correct RES0 bits for FGT registers KVM: arm64: Always populate FGT masks at boot time KVM: arm64: Honor UX/PX attributes for EL2 S1 mappings KVM: arm64: Convert VTCR_EL2 to config-driven sanitisation KVM: arm64: Account for RES1 bits in DECLARE_FEAT_MAP() and co arm64: Convert VTCR_EL2 to sysreg infratructure arm64: Convert ID_AA64MMFR0_EL1.TGRAN{4,16,64}_2 to UnsignedEnum KVM: arm64: Invert KVM_PGTABLE_WALK_HANDLE_FAULT to fix pKVM walkers KVM: arm64: Don't blindly set set PSTATE.PAN on guest exit KVM: arm64: nv: Respect stage-2 write permssion when setting stage-1 AF KVM: arm64: Remove unused vcpu_{clear,set}_wfx_traps() KVM: arm64: Remove unused parameter in synchronize_vcpu_pstate() KVM: arm64: Remove extra argument for __pvkm_host_{share,unshare}_hyp() KVM: arm64: Inject UNDEF for a register trap without accessor KVM: arm64: Copy FGT traps to unprotected pKVM VCPU on VCPU load KVM: arm64: Fix EL2 S1 XN handling for hVHE setups KVM: arm64: gic: Check for vGICv3 when clearing TWI Signed-off-by: Marc Zyngier commit 31c70b971a2d489e4c2ac56dd0f1159cfd52ef96 Merge: 9ace4753a5202b 58ce78667a641f Author: Marc Zyngier Date: Fri Jan 23 09:51:57 2026 +0000 Merge branch arm64/for-next/cpufeature into kvmarm-master/next Merge arm64/for-next/cpufeature in to resolve conflicts resulting from the removal of CONFIG_PAN. * arm64/for-next/cpufeature: arm64: Add support for FEAT_{LS64, LS64_V} KVM: arm64: Enable FEAT_{LS64, LS64_V} in the supported guest arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 KVM: arm64: Handle DABT caused by LS64* instructions on unsupported memory KVM: arm64: Add documentation for KVM_EXIT_ARM_LDST64B KVM: arm64: Add exit to userspace on {LD,ST}64B* outside of memslots arm64: Unconditionally enable PAN support arm64: Unconditionally enable LSE support arm64: Add support for TSV110 Spectre-BHB mitigation Signed-off-by: Marc Zyngier commit fcaf733ca526b69595ed1d227e2cc59ddd24eff7 Author: Elad Nachman Date: Thu Jan 22 18:59:23 2026 +0200 MAINTAINERS: Add Falcon DB Add Falcon DB to the list of maintained Marvell Armada dts files Signed-off-by: Elad Nachman Signed-off-by: Gregory CLEMENT commit b3370479a5f7edf4baf0e307f1163f8fe9e09e17 Author: Elad Nachman Date: Thu Jan 22 18:59:22 2026 +0200 arm64: dts: a7k: add COM Express boards Add support for Armada 7020 Express Type 7 CPU module board by Marvell. Define this COM Express CPU module as dtsi and provide a dtsi file for the carrier board (Marvell DB-98CX85x0 COM Express type 7 carrier board). Since memory is soldered on CPU module, memory node is on CPU module dtsi file. This Carrier board only utilizes the PCIe link, hence no special device or driver support is provided by this dtsi file. Devise a dts file for the combined com express carrier and CPU module. The Aramda 7020 CPU COM Express board offers the following features: 1. Armada 7020 CPU, with dual ARM A72 cores 2. DDR4 memory, 8GB, on board soldered 3. 1Gbit Out of Band Ethernet via RGMII to PHY and RJ45 connector, all are present on A7K CPU module (none on the carrier) 4. Optional 10G KR Ethernet going via the COM Express type 7 connector 5. On-board 8 Gbit, 8-bit bus width NAND flash 6. On-board 512 Mbit SPI flash 7. PCIe Root Complex, 4 lanes PCIe gen3 connectivity, going via the COM Express type 7 connector 8. m.2 SATA connector 9. Micro-SD card connector 10. USB 2.0 via COM Express type 7 connector 11. Two i2c interfaces - one to the CPU module, and one to the carrier board via the COM Express type 7 connector 12. UART (mini USB connector by virtue of FT2232D UART to USB converter, connected to the Armada 7020 UART0) gc: 10gbase-kr is legacy, use "10gbase-r" instead in cp0_eth0 node Signed-off-by: Elad Nachman Signed-off-by: Gregory CLEMENT commit 52e7b5bd62bab3851f25d8b70ad7eae9e94aba60 Author: Manivannan Sadhasivam Date: Thu Jan 22 22:46:54 2026 +0530 power: sequencing: Add the Power Sequencing driver for the PCIe M.2 connectors This driver is used to control the PCIe M.2 connectors of different Mechanical Keys attached to the host machines and supporting different interfaces like PCIe/SATA, USB/UART etc... Currently, this driver supports only the Mechanical Key M connectors with PCIe interface. The driver also only supports driving the mandatory 3.3v and optional 1.8v power supplies. The optional signals of the Key M connectors are not currently supported. Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20260122-pci-m2-v6-4-575da9f97239@oss.qualcomm.com [Bartosz: rename pwrseq_pcie_m2_free_resources() to pwrseq_pcie_m2_free_regulators()] Signed-off-by: Bartosz Golaszewski commit 926194a6675a9cd5943f85820508648b74669fc6 Author: Manivannan Sadhasivam Date: Thu Jan 22 22:46:51 2026 +0530 dt-bindings: connector: Add PCIe M.2 Mechanical Key M connector Add the devicetree binding for PCIe M.2 Mechanical Key M connector defined in the PCI Express M.2 Specification, r4.0, sec 5.3. This connector provides interfaces like PCIe and SATA to attach the Solid State Drives (SSDs) to the host machine along with additional interfaces like USB, and SMBus for debugging and supplementary features. The connector provides a primary power supply of 3.3v, along with an optional 1.8v VIO supply for the Adapter I/O buffer circuitry operating at 1.8v sideband signaling. The connector also supplies optional signals in the form of GPIOs for fine grained power management. Reviewed-by: Frank Li Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260122-pci-m2-v6-1-575da9f97239@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit f52690c50893ef1504990199c8a2dfbb869f38c6 Author: Janani Sunil Date: Mon Jan 19 12:24:24 2026 +0100 iio: dac: Add MAX22007 DAC driver support Add support for the MAX22007 4 channel DAC that drives a voltage or current output on each channel. Signed-off-by: Janani Sunil Signed-off-by: Jonathan Cameron commit 2f7bc8f01a9ba4ba4b1521e53a8c23b21a4c04e8 Author: Janani Sunil Date: Mon Jan 19 12:24:23 2026 +0100 dt-bindings: iio: dac: Add max22007 Devicetree bindings for MAX22007 4-channel 12-bit DAC that drives a voltage or current output on each channel Reviewed-by: Krzysztof Kozlowski Signed-off-by: Janani Sunil Signed-off-by: Jonathan Cameron commit 0ecd890e3cf54a0586247b9a384702703277e4fd Author: Qiang Yu Date: Wed Jan 21 23:45:19 2026 -0800 PCI: dwc: Rename dw_pcie_rp::has_msi_ctrl to dw_pcie_rp::use_imsi_rx for clarity The current "has_msi_ctrl" flag name is misleading because it suggests the presence of any MSI controller, while it is specifically set for platforms that lack .msi_init() callback and don't have "msi-parent" or "msi-map" device tree properties, indicating they rely on the iMSI-RX module for MSI functionality. Rename it to "use_imsi_rx" to make the intent clear: - When true: Platform uses the iMSI-RX module for MSI handling - When false: Platform has other MSI controller support (ITS/MBI, external MSI controller) No functional changes, only improves code readability and eliminates naming confusion. Signed-off-by: Qiang Yu [mani: renamed 'uses_imsi_rx' to 'use_imsi_rx' per https://lore.kernel.org/linux-pci/09f9acc1-d1ad-4971-8488-f0268cf08799@rock-chips.com] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Shawn Lin Link: https://patch.msgid.link/20260121-remove_cap_clean_up-v1-2-e78115e5d467@oss.qualcomm.com commit 8a214f64554ce4da91f35e7d3b8eaa9674f5154d Author: Qiang Yu Date: Wed Jan 21 23:45:18 2026 -0800 PCI: dwc: Fix grammar and formatting for comment in dw_pcie_remove_ext_capability() Fix a grammatical error in the comment by changing "it's" to "its". Also add a blank line after the variable declaration for better code formatting. Signed-off-by: Qiang Yu Signed-off-by: Manivannan Sadhasivam Reviewed-by: Shawn Lin Link: https://patch.msgid.link/20260121-remove_cap_clean_up-v1-1-e78115e5d467@oss.qualcomm.com commit e9ed88a4ce42bf42cd8b95a5b05298cf225b8b52 Author: Rob Herring (Arm) Date: Thu Jan 22 14:23:45 2026 -0600 ARM: dts: microchip: Drop usb_a9g20-dab-mmx.dtsi This .dtsi file is not included anywhere in the tree and can't be tested. Acked-by: Alexandre Belloni Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260122202345.3387936-2-robh@kernel.org Signed-off-by: Claudiu Beznea commit c66e0a273f223fe38b8b72c034857622b0651482 Author: Thorsten Blum Date: Mon Jan 5 23:21:53 2026 +0100 crypto: ecc - Streamline alloc_point and remove {alloc,free}_digits_space Check 'ndigits' before allocating 'struct ecc_point' to return early if needed. Inline the code from and remove ecc_alloc_digits_space() and ecc_free_digits_space(), respectively. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit c0008a29a006091d7f9d288620c2456afa23ff27 Author: Aleksander Jan Bajkowski Date: Mon Jan 5 21:41:49 2026 +0100 hwrng: airoha - set rng quality to 900 Airoha uses RAW mode to collect noise from the TRNG. These appear to be unprocessed oscillations from the tero loop. For this reason, they do not have a perfect distribution and entropy. Simple noise compression reduces its size by 9%, so setting the quality to 900 seems reasonable. The same value is used by the downstream driver. Compare the size before and after compression: $ ls -l random_airoha* -rw-r--r-- 1 aleksander aleksander 76546048 Jan 3 23:43 random_airoha -rw-rw-r-- 1 aleksander aleksander 69783562 Jan 5 20:23 random_airoha.zip FIPS test results: $ cat random_airoha | rngtest -c 10000 rngtest 2.6 Copyright (c) 2004 by Henrique de Moraes Holschuh This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. rngtest: starting FIPS tests... rngtest: bits received from input: 200000032 rngtest: FIPS 140-2 successes: 0 rngtest: FIPS 140-2 failures: 10000 rngtest: FIPS 140-2(2001-10-10) Monobit: 9957 rngtest: FIPS 140-2(2001-10-10) Poker: 10000 rngtest: FIPS 140-2(2001-10-10) Runs: 10000 rngtest: FIPS 140-2(2001-10-10) Long run: 4249 rngtest: FIPS 140-2(2001-10-10) Continuous run: 0 rngtest: input channel speed: (min=953.674; avg=27698.935; max=19073.486)Mibits/s rngtest: FIPS tests speed: (min=59.791; avg=298.028; max=328.853)Mibits/s rngtest: Program run time: 647638 microseconds In general, these data look like real noise, but with lower entropy than expected. Fixes: e53ca8efcc5e ("hwrng: airoha - add support for Airoha EN7581 TRNG") Suggested-by: Benjamin Larsson Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit dc8ccab15081efc4f2c5a9fc7b209cd641d29177 Author: Tycho Andersen (AMD) Date: Mon Jan 5 10:22:18 2026 -0700 crypto: ccp - narrow scope of snp_range_list snp_range_list is only used in __sev_snp_init_locked() in the SNP_INIT_EX case, move the declaration there and add a __free() cleanup helper for it instead of waiting until shutdown. Fixes: 1ca5614b84ee ("crypto: ccp: Add support to initialize the AMD-SP for SEV-SNP") Reviewed-by: Alexey Kardashevskiy Signed-off-by: Tycho Andersen (AMD) Reviewed-by: Tom Lendacky Signed-off-by: Herbert Xu commit 551120148b67e04527b405c5ec33a31593846ba4 Author: Tom Lendacky Date: Mon Jan 5 10:22:17 2026 -0700 crypto: ccp - Fix a case where SNP_SHUTDOWN is missed If page reclaim fails in sev_ioctl_do_snp_platform_status() and SNP was moved from UNINIT to INIT for the function, SNP is not moved back to UNINIT state. Additionally, SNP is not required to be initialized in order to execute the SNP_PLATFORM_STATUS command, so don't attempt to move to INIT state and let SNP_PLATFORM_STATUS report the status as is. Fixes: ceac7fb89e8d ("crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls") Signed-off-by: Tom Lendacky Reviewed-by: Tycho Andersen (AMD) Reviewed-by: Alexey Kardashevskiy Signed-off-by: Tycho Andersen (AMD) Signed-off-by: Herbert Xu commit f7738c07b5fed94a712d71b1d88cd2aa9c11210c Author: Krzysztof Kozlowski Date: Fri Jan 2 13:50:12 2026 +0100 crypto: nx - Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit e1dc530d0c082c903e74bf6e16d8a38843d3d1d7 Author: Aleksander Jan Bajkowski Date: Thu Jan 1 16:25:18 2026 +0100 crypto: testmgr - allow authenc(sha224,rfc3686) variant in fips mode The remaining combinations of AES-CTR-RFC3686 and SHA* have already been marked as allowed in 8888690ef5f7. This commit does the same for SHA224. rfc3686(ctr(aes)) is already marked fips compliant, so these should be fine. Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Herbert Xu commit b6e32ba6d32503440a3e3e16c8d0521cbb7e0c5d Author: Aleksander Jan Bajkowski Date: Tue Dec 30 22:17:17 2025 +0100 crypto: inside-secure/eip93 - fix kernel panic in driver detach During driver detach, the same hash algorithm is unregistered multiple times due to a wrong iterator. Fixes: 9739f5f93b78 ("crypto: eip93 - Add Inside Secure SafeXcel EIP-93 crypto engine support") Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Antoine Tenart Signed-off-by: Herbert Xu commit 1ab7c366007464a1dcfb01af56655ea6118974f2 Author: Herbert Xu Date: Mon Dec 29 08:48:09 2025 +0800 crypto: ccp - Use NULL instead of plain 0 Use NULL instead of 0 as the null pointer. Signed-off-by: Herbert Xu Reviewed-by: Alexey Kardashevskiy Acked-by: Tom Lendacky Signed-off-by: Herbert Xu commit fcce6bcb14f5cfddcf79ac49a67ce36fec850b53 Author: Alexander Bendezu Date: Sun Dec 28 00:01:01 2025 +0000 crypto: blowfish - fix typo in comment Fix spelling mistake in comment: endianess -> endianness Signed-off-by: Alexander Bendezu Signed-off-by: Herbert Xu commit c1b12cd933a74d898fbb7b4cb38096cac1f6f04e Author: Thomas Weißschuh Date: Fri Dec 26 17:03:18 2025 +0100 padata: Constify padata_sysfs_entry structs These structs are never modified. To prevent malicious or accidental modifications due to bugs, mark them as const. Signed-off-by: Thomas Weißschuh Signed-off-by: Herbert Xu commit a3f8e00991f96ee7c3c77834258baa06a39fbbff Author: Thorsten Blum Date: Mon Dec 22 11:44:55 2025 +0100 crypto: api - remove unnecessary forward declarations Add the __maybe_unused attribute to the function definitions and remove the now-unnecessary forward declarations. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit b4f275b92dc74750a09ac0d272c1570828b86f7e Author: Thorsten Blum Date: Mon Dec 22 11:42:53 2025 +0100 crypto: simd - Simplify request size calculation in simd_aead_init Fold both assignments into a single max() call to simplify the code. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 280bfc3eb5d3f3199f888197462e7da7e9914160 Author: Harsh Jain Date: Sat Dec 20 21:29:05 2025 +0530 crypto: xilinx - Add gcm(aes) support for AMD/Xilinx Versal device Add gcm(aes) algorithm support for AMD/Xilinx Versal devices. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 856f0619252debaf0b15a12cab14f93e73180d90 Author: Harsh Jain Date: Sat Dec 20 21:29:04 2025 +0530 crypto: xilinx - Remove un-necessary typecast operation Return type of crypto_tfm_ctx() is void *. Remove explicit type cast. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit e9f6870bb753b11b325f7d7839b4be6956d448d9 Author: Harsh Jain Date: Sat Dec 20 21:29:03 2025 +0530 firmware: xilinx: Add firmware API's to support aes-gcm in Versal device Add aes-gcm crypto API's for AMD/Xilinx Versal device. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit c315cb0005bed288e1db58f52ccd60ec189302d7 Author: Harsh Jain Date: Sat Dec 20 21:29:02 2025 +0530 crypto: xilinx - Change coherent DMA to streaming DMA API Update the driver to use streaming DMA API. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 56934489a80a74a067d9129f025c81d1ebf267a4 Author: Harsh Jain Date: Sat Dec 20 21:29:01 2025 +0530 crypto: xilinx - Replace zynqmp prefix with xilinx Replace zynqmp with xilinx to have more generic name. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 43f0478672c3239cd10fd460ae84ba2b3f55dc07 Author: Harsh Jain Date: Sat Dec 20 21:29:00 2025 +0530 crypto: xilinx - Register H/W key support with paes Register gcm(paes) for hardware supported keys. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 0d120a39b9de5a2d9d9e3fb83db672825d5a798a Author: Harsh Jain Date: Sat Dec 20 21:28:59 2025 +0530 crypto: xilinx - Avoid submitting fallback requests to engine Don't enqueue requests which are supposed to fallback to s/w crypto. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit f939b88c7ca56cd307e351cef1683756835a7193 Author: Harsh Jain Date: Sat Dec 20 21:28:58 2025 +0530 crypto: xilinx - Avoid Encrypt request to fallback for authsize < 16 Encrypt requests can be handled by driver when authsize is less than 16. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 349f0d326d7c9262ac7644cb624ccbcbedd917f9 Author: Harsh Jain Date: Sat Dec 20 21:28:57 2025 +0530 crypto: xilinx - Return linux error code instead of firmware error code Convert FW error code to linux error code and remove dmesg error print for authentication tag mismatch failure. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 75578e5c2040b52af89005b9116dfd0f9ae462c1 Author: Harsh Jain Date: Sat Dec 20 21:28:56 2025 +0530 crypto: xilinx - Update probe to self discover the device Update driver to self discover the device. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 2de468529f270d0696738ca7d0252a57aa31b191 Author: Harsh Jain Date: Sat Dec 20 21:28:55 2025 +0530 dt-bindings: crypto: Mark zynqmp-aes as Deprecated zynqmp-aes-gcm updated to self discover, corresponding dt binding can be mark deprecated. Signed-off-by: Harsh Jain Reviewed-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit 465d7831261965248a7a1484bd186066d29427f0 Author: Harsh Jain Date: Sat Dec 20 21:28:54 2025 +0530 firmware: zynqmp: Add helper API to self discovery the device Add API to get SoC version and family info. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit c7a768f57de0ebd7a9149d1dab1dadb9c5409d5f Author: Harsh Jain Date: Sat Dec 20 21:28:53 2025 +0530 crypto: xilinx - Remove union from zynqmp_aead_drv_ctx "alg" in zynqmp_aead_drv_ctx is single field union variable. Remove unnecessary alg union from structure. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit c15291e2278ea930ca47a034780f002bee1e1b4f Author: Harsh Jain Date: Sat Dec 20 21:28:52 2025 +0530 firmware: zynqmp: Move crypto API's to separate file For better maintainability move crypto related API's to new zynqmp-crypto.c file. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit 1ccc00d71e3ba3300f95b0baad991400b9d521d1 Author: Thorsten Blum Date: Fri Dec 19 15:51:22 2025 +0100 crypto: engine - Use unregister_* in register_{aeads,ahashes,skciphers} Replace the for loops with calls to unregister_aeads(), unregister_ahashes(), and unregister_skciphers(), respectively. Return 'ret' immediately and remove the goto statements to simplify the error handling code. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 32adff68c7d3b57b409cee88aa4d603579cf12b4 Author: Thorsten Blum Date: Fri Dec 19 15:51:21 2025 +0100 crypto: lskcipher - Use unregister_lskciphers in register_lskciphers Replace the for loop with a call to crypto_unregister_lskciphers(). Return 'ret' immediately and remove the goto statement to simplify the error handling code. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 5a22716ebed071f81413ae3bbbfaf8cd16b992f1 Author: Thorsten Blum Date: Fri Dec 19 15:51:20 2025 +0100 crypto: skcipher - Use unregister_skciphers in register_skciphers Replace the for loop with a call to crypto_unregister_skciphers(). Return 'ret' immediately and remove the goto statement to simplify the error handling code. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit c29fcecaf8a9e92adb41d3e2b9d6af9b2e04a385 Author: Thorsten Blum Date: Fri Dec 19 15:51:19 2025 +0100 crypto: shash - Use unregister_shashes in register_shashes Replace the for loop with a call to crypto_unregister_shashes(). Return 'ret' immediately and remove the goto statement to simplify the error handling code. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit bcc3b3c8ae49d00c8e6a4a7616ef74ef0b176daf Author: Thorsten Blum Date: Fri Dec 19 15:51:18 2025 +0100 crypto: ahash - Use unregister_ahashes in register_ahashes Replace the for loop with a call to crypto_unregister_ahashes(). Return 'ret' immediately and remove the goto statement to simplify the error handling code. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit fbbc944b5945bfd2715a3d762784c318a040f36a Author: Thorsten Blum Date: Fri Dec 19 15:51:17 2025 +0100 crypto: acomp - Use unregister_acomps in register_acomps Replace the for loop with a call to crypto_unregister_acomps(). Return 'ret' immediately and remove the goto statement to simplify the error handling code. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 9abf22075da98c615be2f608ec1167329a71eafd Merge: 0b87bbf65d7d33 0a80e38d0fe1fe Author: Jakub Kicinski Date: Thu Jan 22 20:13:25 2026 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.19-rc7). Conflicts: drivers/net/ethernet/huawei/hinic3/hinic3_irq.c b35a6fd37a00 ("hinic3: Add adaptive IRQ coalescing with DIM") fb2bb2a1ebf7 ("hinic3: Fix netif_queue_set_napi queue_index input parameter error") https://lore.kernel.org/fc0a7fdf08789a52653e8ad05281a0a849e79206.1768915707.git.zhuyikai1@h-partners.com drivers/net/wireless/ath/ath12k/mac.c drivers/net/wireless/ath/ath12k/wifi7/hw.c 31707572108d ("wifi: ath12k: Fix wrong P2P device link id issue") c26f294fef2a ("wifi: ath12k: Move ieee80211_ops callback to the arch specific module") https://lore.kernel.org/20260114123751.6a208818@canb.auug.org.au Adjacent changes: drivers/net/wireless/ath/ath12k/mac.c 8b8d6ee53dfd ("wifi: ath12k: Fix scan state stuck in ABORTING after cancel_remain_on_channel") 914c890d3b90 ("wifi: ath12k: Add framework for hardware specific ieee80211_ops registration") Signed-off-by: Jakub Kicinski commit e8cd481cc665d5db8e918e84740db22bc213059e Author: Ming Lei Date: Fri Jan 16 22:18:57 2026 +0800 selftests: ublk: support arbitrary threads/queues combination Enable flexible thread-to-queue mapping in batch I/O mode to support arbitrary combinations of threads and queues, improving resource utilization and scalability. Key improvements: - Support N:M thread-to-queue mapping (previously limited to 1:1) - Dynamic buffer allocation based on actual queue assignment per thread - Thread-safe queue preparation with spinlock protection - Intelligent buffer index calculation for multi-queue scenarios - Enhanced validation for thread/queue combination constraints Implementation details: - Add q_thread_map matrix to track queue-to-thread assignments - Dynamic allocation of commit and fetch buffers per thread - Round-robin queue assignment algorithm for load balancing - Per-queue spinlock to prevent race conditions during prep - Updated buffer index calculation using queue position within thread This enables efficient configurations like: - Any other N:M combinations for optimal resource matching Testing: - Added test_batch_02.sh: 4 threads vs 1 queue - Added test_batch_03.sh: 1 thread vs 4 queues - Validates correctness across different mapping scenarios Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 20aeab0b08a175d9ceb4ad327f55ba5c29a79888 Author: Ming Lei Date: Fri Jan 16 22:18:56 2026 +0800 selftests: ublk: add --batch/-b for enabling F_BATCH_IO Add --batch/-b for enabling F_BATCH_IO. Add batch_01 for covering its basic function. Add stress_08 and stress_09 for covering stress test. Add recovery test for F_BATCH_IO in generic_04 and generic_05. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 4968fb7cc60676040258c8867f22931c8735126f Author: Ming Lei Date: Fri Jan 16 22:18:55 2026 +0800 selftests: ublk: increase timeout to 150 seconds More tests need to be covered in existing generic tests, and default 45sec isn't enough, and timeout is often triggered, increase timeout by adding setting file. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit cb5a6b308700c65c29baccbb6b9b07f306633ad5 Author: Ming Lei Date: Fri Jan 16 22:18:54 2026 +0800 selftests: ublk: handle UBLK_U_IO_FETCH_IO_CMDS Add support for UBLK_U_IO_FETCH_IO_CMDS to enable efficient batch fetching of I/O commands using multishot io_uring operations. Key improvements: - Implement multishot UBLK_U_IO_FETCH_IO_CMDS for continuous command fetching - Add fetch buffer management with page-aligned, mlocked buffers - Process fetched I/O command tags from kernel-provided buffers - Integrate fetch operations with existing batch I/O infrastructure - Significantly reduce uring_cmd issuing overhead through batching The implementation uses two fetch buffers per thread with automatic requeuing to maintain continuous I/O command flow. Each fetch operation retrieves multiple command tags in a single syscall, dramatically improving performance compared to individual command fetching. Technical details: - Fetch buffers are page-aligned and mlocked for optimal performance - Uses IORING_URING_CMD_MULTISHOT for continuous operation - Automatic buffer management and requeuing on completion - Enhanced CQE handling for fetch command completions Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit dee7024ffecba291891503e425373d9f2a1d01b6 Author: Ming Lei Date: Fri Jan 16 22:18:53 2026 +0800 selftests: ublk: handle UBLK_U_IO_COMMIT_IO_CMDS Implement UBLK_U_IO_COMMIT_IO_CMDS to enable efficient batched completion of I/O operations in the batch I/O framework. This completes the batch I/O infrastructure by adding the commit phase that notifies the kernel about completed I/O operations: Key features: - Batch multiple I/O completions into single UBLK_U_IO_COMMIT_IO_CMDS - Dynamic commit buffer allocation and management per thread - Automatic commit buffer preparation before processing events - Commit buffer submission after processing completed I/Os - Integration with existing completion workflows Implementation details: - ublk_batch_prep_commit() allocates and initializes commit buffers - ublk_batch_complete_io() adds completed I/Os to current batch - ublk_batch_commit_io_cmds() submits batched completions to kernel - Modified ublk_process_io() to handle batch commit lifecycle - Enhanced ublk_complete_io() to route to batch or legacy completion The commit buffer stores completion information (tag, result, buffer details) for multiple I/Os, then submits them all at once, significantly reducing syscall overhead compared to individual I/O completions. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit d468930a019df71951a80fde20f6348136a2175d Author: Ming Lei Date: Fri Jan 16 22:18:52 2026 +0800 selftests: ublk: handle UBLK_U_IO_PREP_IO_CMDS Implement support for UBLK_U_IO_PREP_IO_CMDS in the batch I/O framework: - Add batch command initialization and setup functions - Implement prep command queueing with proper buffer management - Add command completion handling for prep and commit commands - Integrate batch I/O setup into thread initialization - Update CQE handling to support batch commands The implementation uses the previously established buffer management infrastructure to queue UBLK_U_IO_PREP_IO_CMDS commands. Commands are prepared in the first thread context and use commit buffers for efficient command batching. Key changes: - ublk_batch_queue_prep_io_cmds() prepares I/O command batches - ublk_batch_compl_cmd() handles batch command completions - Modified thread setup to use batch operations when enabled - Enhanced buffer index calculation for batch mode Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit dccbfa9d416424fbcbc83a46e84c604bad1db9d0 Author: Ming Lei Date: Fri Jan 16 22:18:51 2026 +0800 selftests: ublk: add batch buffer management infrastructure Add the foundational infrastructure for UBLK_F_BATCH_IO buffer management including: - Allocator utility functions for small sized per-thread allocation - Batch buffer allocation and deallocation functions - Buffer index management for commit buffers - Thread state management for batch I/O mode - Buffer size calculation based on device features This prepares the groundwork for handling batch I/O commands by establishing the buffer management layer needed for UBLK_U_IO_PREP_IO_CMDS and UBLK_U_IO_COMMIT_IO_CMDS operations. The allocator uses CPU sets for efficient per-thread buffer tracking, and commit buffers are pre-allocated with 2 buffers per thread to handle overlapping command operations. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit f1d621b5a04ea41ee90f177db084d00db57e6839 Author: Ming Lei Date: Fri Jan 16 22:18:50 2026 +0800 selftests: ublk: add ublk_io_buf_idx() for returning io buffer index Since UBLK_F_PER_IO_DAEMON is added, io buffer index may depend on current thread because the common way is to use per-pthread io_ring_ctx for issuing ublk uring_cmd. Add one helper for returning io buffer index, so we can hide the buffer index implementation details for target code. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 584709ad5ce359f8b5773eb6af40070412652c51 Author: Ming Lei Date: Fri Jan 16 22:18:49 2026 +0800 selftests: ublk: replace assert() with ublk_assert() Replace assert() with ublk_assert() since it is often triggered in daemon, and we may get nothing shown in terminal. Add ublk_assert(), so we can log something to syslog when assert() is triggered. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit caf84294ff98bb7455722285f30f46c193ffccdd Author: Ming Lei Date: Fri Jan 16 22:18:48 2026 +0800 selftests: ublk: fix user_data truncation for tgt_data >= 256 The build_user_data() function packs multiple fields into a __u64 value using bit shifts. Without explicit __u64 casts before shifting, the shift operations are performed on 32-bit unsigned integers before being promoted to 64-bit, causing data loss. Specifically, when tgt_data >= 256, the expression (tgt_data << 24) shifts on a 32-bit value, truncating the upper 8 bits before promotion to __u64. Since tgt_data can be up to 16 bits (assertion allows up to 65535), values >= 256 would have their high byte lost. Add explicit __u64 casts to both op and tgt_data before shifting to ensure the shift operations happen in 64-bit space, preserving all bits of the input values. user_data_to_tgt_data() is only used by stripe.c, in which the max supported member disks are 4, so won't trigger this issue. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 3f3850785594e323c5adc6b19ef5907419d3159f Author: Ming Lei Date: Fri Jan 16 22:18:47 2026 +0800 ublk: fix batch I/O recovery -ENODEV error During recovery with batch I/O, UBLK_U_IO_FETCH_IO_CMDS command fails with -ENODEV because ublk_batch_attach() rejects them when ubq->canceling is set. The canceling flag remains set until all queues are ready. Fix this by tracking per-queue readiness and clearing ubq->canceling as soon as each individual queue becomes ready, rather than waiting for all queues. This allows subsequent UBLK_U_IO_FETCH_IO_CMDS commands to succeed during recovery. Changes: - Add ubq->nr_io_ready to track I/Os ready per queue - Add ub->nr_queue_ready to track number of ready queues - Add ublk_queue_ready() helper to check queue readiness - Redefine ublk_dev_ready() based on queue count instead of I/O count - Clear ubq->canceling immediately when queue becomes ready - Add ublk_queue_reset_io_flags() to reset per-queue flags Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 7aa78d4a3c9c30d15c0107fb652b22376aaacce6 Author: Ming Lei Date: Fri Jan 16 22:18:46 2026 +0800 ublk: implement batch request completion via blk_mq_end_request_batch() Reduce overhead when completing multiple requests in batch I/O mode by accumulating them in an io_comp_batch structure and completing them together via blk_mq_end_request_batch(). This minimizes per-request completion overhead and improves performance for high IOPS workloads. The implementation adds an io_comp_batch pointer to struct ublk_io and initializes it in __ublk_fetch(). For batch I/O, the pointer is set to the batch structure in ublk_batch_commit_io(). The __ublk_complete_rq() function uses io->iob to call blk_mq_add_to_batch() for batch mode. After processing all batch I/Os, the completion callback is invoked in ublk_handle_batch_commit_cmd() to complete all accumulated requests efficiently. So far just covers direct completion. For deferred completion(zero copy, auto buffer reg), ublk_io_release() is often delayed in freeing buffer consumer io_uring request's code path, so this patch often doesn't work, also it is hard to pass the per-task 'struct io_comp_batch' for deferred completion. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 4d8fd7c5592acc2cc89b1759fb01171478c9ee5f Author: Ming Lei Date: Fri Jan 16 22:18:45 2026 +0800 ublk: document feature UBLK_F_BATCH_IO Document feature UBLK_F_BATCH_IO. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit e2723e6ce6025026b6d79d9a00048386a69e00c3 Author: Ming Lei Date: Fri Jan 16 22:18:44 2026 +0800 ublk: add new feature UBLK_F_BATCH_IO Add new feature UBLK_F_BATCH_IO which replaces the following two per-io commands: - UBLK_U_IO_FETCH_REQ - UBLK_U_IO_COMMIT_AND_FETCH_REQ with three per-queue batch io uring_cmd: - UBLK_U_IO_PREP_IO_CMDS - UBLK_U_IO_COMMIT_IO_CMDS - UBLK_U_IO_FETCH_IO_CMDS Then ublk can deliver batch io commands to ublk server in single multishort uring_cmd, also allows to prepare & commit multiple commands in batch style via single uring_cmd, communication cost is reduced a lot. This feature also doesn't limit task context any more for all supported commands, so any allowed uring_cmd can be issued in any task context. ublk server implementation becomes much easier. Meantime load balance becomes much easier to support with this feature. The command `UBLK_U_IO_FETCH_IO_CMDS` can be issued from multiple task contexts, so each task can adjust this command's buffer length or number of inflight commands for controlling how much load is handled by current task. Later, priority parameter will be added to command `UBLK_U_IO_FETCH_IO_CMDS` for improving load balance support. UBLK_U_IO_NEED_GET_DATA isn't supported in batch io yet, but it may be enabled in future via its batch pair. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 29d0a927f9efd5f87ac8a2d291d2782384d1bee2 Author: Ming Lei Date: Fri Jan 16 22:18:43 2026 +0800 ublk: abort requests filled in event kfifo In case of BATCH_IO, any request filled in event kfifo, they don't get chance to be dispatched any more when releasing ublk char device, so we have to abort them too. Add ublk_abort_batch_queue() for aborting this kind of requests. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 3ac4796b888a2574cb982c89076ed717f122289d Author: Ming Lei Date: Fri Jan 16 22:18:42 2026 +0800 ublk: refactor ublk_queue_rq() and add ublk_batch_queue_rq() Extract common request preparation and cancellation logic into __ublk_queue_rq_common() helper function. Add dedicated ublk_batch_queue_rq() for batch mode operations to eliminate runtime check in ublk_queue_rq(). Signed-off-by: Ming Lei Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit a4d88375539920b7401ead59d2f944ac23c668ea Author: Ming Lei Date: Fri Jan 16 22:18:41 2026 +0800 ublk: add UBLK_U_IO_FETCH_IO_CMDS for batch I/O processing Add UBLK_U_IO_FETCH_IO_CMDS command to enable efficient batch processing of I/O requests. This multishot uring_cmd allows the ublk server to fetch multiple I/O commands in a single operation, significantly reducing submission overhead compared to individual FETCH_REQ* commands. Key Design Features: 1. Multishot Operation: One UBLK_U_IO_FETCH_IO_CMDS can fetch many I/O commands, with the batch size limited by the provided buffer length. 2. Dynamic Load Balancing: Multiple fetch commands can be submitted simultaneously, but only one is active at any time. This enables efficient load distribution across multiple server task contexts. 3. Implicit State Management: The implementation uses three key variables to track state: - evts_fifo: Queue of request tags awaiting processing - fcmd_head: List of available fetch commands - active_fcmd: Currently active fetch command (NULL = none active) States are derived implicitly: - IDLE: No fetch commands available - READY: Fetch commands available, none active - ACTIVE: One fetch command processing events 4. Lockless Reader Optimization: The active fetch command can read from evts_fifo without locking (single reader guarantee), while writers (ublk_queue_rq/ublk_queue_rqs) use evts_lock protection. The memory barrier pairing plays key role for the single lockless reader optimization. Implementation Details: - ublk_queue_rq() and ublk_queue_rqs() save request tags to evts_fifo - __ublk_acquire_fcmd() selects an available fetch command when events arrive and no command is currently active - ublk_batch_dispatch() moves tags from evts_fifo to the fetch command's buffer and posts completion via io_uring_mshot_cmd_post_cqe() - State transitions are coordinated via evts_lock to maintain consistency Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 7a1bb41947cee3aa50fa9b276e9aeb6caa87b543 Author: Ming Lei Date: Fri Jan 16 22:18:40 2026 +0800 ublk: add batch I/O dispatch infrastructure Add infrastructure for delivering I/O commands to ublk server in batches, preparing for the upcoming UBLK_U_IO_FETCH_IO_CMDS feature. Key components: - struct ublk_batch_fetch_cmd: Represents a batch fetch uring_cmd that will receive multiple I/O tags in a single operation, using io_uring's multishot command for efficient ublk IO delivery. - ublk_batch_dispatch(): Batch version of ublk_dispatch_req() that: * Pulls multiple request tags from the events FIFO (lock-free reader) * Prepares each I/O for delivery (including auto buffer registration) * Delivers tags to userspace via single uring_cmd notification * Handles partial failures by restoring undelivered tags to FIFO The batch approach significantly reduces notification overhead by aggregating multiple I/O completions into single uring_cmd, while maintaining the same I/O processing semantics as individual operations. Error handling ensures system consistency: if buffer selection or CQE posting fails, undelivered tags are restored to the FIFO for retry, meantime IO state has to be restored. This runs in task work context, scheduled via io_uring_cmd_complete_in_task() or called directly from ->uring_cmd(), enabling efficient batch processing without blocking the I/O submission path. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit f1f99ddf607a4b54dc19d92fb07f2a30c131ee56 Author: Ming Lei Date: Fri Jan 16 22:18:39 2026 +0800 ublk: add io events fifo structure Add ublk io events fifo structure and prepare for supporting command batch, which will use io_uring multishot uring_cmd for fetching one batch of io commands each time. One nice feature of kfifo is to allow multiple producer vs single consumer. We just need lock the producer side, meantime the single consumer can be lockless. The producer is actually from ublk_queue_rq() or ublk_queue_rqs(), so lock contention can be eased by setting proper blk-mq nr_queues. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 1e500e106d5a82280db59dba06f0108085beba65 Author: Ming Lei Date: Fri Jan 16 22:18:38 2026 +0800 ublk: handle UBLK_U_IO_COMMIT_IO_CMDS Handle UBLK_U_IO_COMMIT_IO_CMDS by walking the uring_cmd fixed buffer: - read each element into one temp buffer in batch style - parse and apply each element for committing io result Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit b256795b3606e9a67c725dde8eaae91dd9d21de4 Author: Ming Lei Date: Fri Jan 16 22:18:37 2026 +0800 ublk: handle UBLK_U_IO_PREP_IO_CMDS This commit implements the handling of the UBLK_U_IO_PREP_IO_CMDS command, which allows userspace to prepare a batch of I/O requests. The core of this change is the `ublk_walk_cmd_buf` function, which iterates over the elements in the uring_cmd fixed buffer. For each element, it parses the I/O details, finds the corresponding `ublk_io` structure, and prepares it for future dispatch. Add per-io lock for protecting concurrent delivery and committing. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit e86f89ab24f5ec595879a01eebb5df84f5ed6d2b Author: Ming Lei Date: Fri Jan 16 22:18:36 2026 +0800 ublk: add new batch command UBLK_U_IO_PREP_IO_CMDS & UBLK_U_IO_COMMIT_IO_CMDS Add new command UBLK_U_IO_PREP_IO_CMDS, which is the batch version of UBLK_IO_FETCH_REQ. Add new command UBLK_U_IO_COMMIT_IO_CMDS, which is for committing io command result only, still the batch version. The new command header type is `struct ublk_batch_io`. This patch doesn't actually implement these commands yet, just validates the SQE fields. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 7ba62f5969defbab7df47c0016ffd4dedf30950a Author: Ming Lei Date: Fri Jan 16 22:18:35 2026 +0800 ublk: prepare for not tracking task context for command batch batch io is designed to be independent of task context, and we will not track task context for batch io feature. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit fb027d569422efcf1b367441f782fb425a4b5569 Author: Ming Lei Date: Fri Jan 16 22:18:34 2026 +0800 ublk: define ublk_ch_batch_io_fops for the coming feature F_BATCH_IO Introduces the basic structure for a batched I/O feature in the ublk driver. It adds placeholder functions and a new file operations structure, ublk_ch_batch_io_fops, which will be used for fetching and committing I/O commands in batches. Currently, the feature is disabled. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 9160ca46d2e320523b8f10bc6e7873f49b96dcee Merge: 8f0b4cce4481fb ed806240b8975f Author: Stephen Boyd Date: Thu Jan 22 18:54:16 2026 -0800 Merge tag 'clk-divider-round-rate-v6.20-v2' of https://github.com/masneyb/linux into clk-divider Pull divider_round_rate() and friends removal series from Brian Masney: Here's a series that lays the groundwork to rid of the deprecated APIs divider_round_rate(), divider_round_rate_parent(), and divider_ro_round_rate_parent() since these functions are just wrappers for the determine_rate variant. We need to wait for some other changes to land in Linus's tree via the phy tree before we can actually remove these functions. We should be able to do that during the next development cycle. Note that when I converted some of these drivers from round_rate to determine_rate, this was mistakenly converted to the following in some cases: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. So this series fixes those bugs and removes the deprecated APIs all in one go. Note that this also contains a clk-specific change to drivers/rtc/rtc-ac100.c, and that patch carrys an Acked-by from Alexandre. * tag 'clk-divider-round-rate-v6.20-v2' of https://github.com/masneyb/linux: rtc: ac100: convert from divider_round_rate() to divider_determine_rate() clk: zynqmp: divider: convert from divider_round_rate() to divider_determine_rate() clk: x86: cgu: convert from divider_round_rate() to divider_determine_rate() clk: versaclock3: convert from divider_round_rate() to divider_determine_rate() clk: stm32: stm32-core: convert from divider_round_rate_parent() to divider_determine_rate() clk: stm32: stm32-core: convert from divider_ro_round_rate() to divider_ro_determine_rate() clk: sprd: div: convert from divider_round_rate() to divider_determine_rate() clk: sophgo: sg2042-clkgen: convert from divider_round_rate() to divider_determine_rate() clk: nxp: lpc32xx: convert from divider_round_rate() to divider_determine_rate() clk: nuvoton: ma35d1-divider: convert from divider_round_rate() to divider_determine_rate() clk: milbeaut: convert from divider_round_rate() to divider_determine_rate() clk: milbeaut: convert from divider_ro_round_rate() to divider_ro_determine_rate() clk: loongson1: convert from divider_round_rate() to divider_determine_rate() clk: hisilicon: clkdivider-hi6220: convert from divider_round_rate() to divider_determine_rate() clk: bm1880: convert from divider_round_rate() to divider_determine_rate() clk: bm1880: convert from divider_ro_round_rate() to divider_ro_determine_rate() clk: actions: owl-divider: convert from divider_round_rate() to divider_determine_rate() clk: actions: owl-composite: convert from owl_divider_helper_round_rate() to divider_determine_rate() clk: sunxi-ng: convert from divider_round_rate_parent() to divider_determine_rate() clk: sophgo: cv18xx-ip: convert from divider_round_rate() to divider_determine_rate() commit b2c6627e406d00bc53903ff6204aabb0c6a22b1a Merge: d2f618b8fe76b5 68b271a3a94cfd Author: Dave Airlie Date: Fri Jan 23 12:44:59 2026 +1000 Merge tag 'drm-misc-next-2026-01-22' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 6.20: Core Changes: - buddy: Fix free_trees memory leak, prevent a BUG_ON - dma-buf: Start to introduce cgroup memory accounting in heaps, Remove sysfs stats, add new tracepoints - hdmi: Limit infoframes exposure to userspace based on driver capabilities - property: Account for property blobs in memcg Driver Changes: - atmel-hlcdc: Switch to drmm resources, Support nomodeset parameter, various patches to use newish helpers and fix memory safety bugs - hisilicon: Fix various DisplayPort related bugs - imagination: Introduce hardware version checks - renesas: Fix kernel panic on reboot - rockchip: Fix RK3576 HPD interrupt handling, Improve RK3588 HPD interrupt handling - v3d: Convert to drm logging helpers - bridge: - Continuation of the refcounting effort - new bridge: Algoltek AG6311 - panel: - new panel: Anbernic RG-DS Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260122-antique-sexy-junglefowl-1bc5a8@houat commit 0b87bbf65d7d33754fd12df5984b9741e886dc69 Author: Simon Horman Date: Wed Jan 21 19:49:52 2026 +0000 net: phy: Grammar update for comment in genphy_update_link Enhance the grammar of the comment in genphy_update_link() describing momentary link drop handling. Found by inspection. Signed-off-by: Simon Horman Link: https://patch.msgid.link/20260121-phy-gra-v1-1-8b4d178939de@kernel.org Signed-off-by: Jakub Kicinski commit d07d7c3dd9446b47507d15fdfbb835638a2f6f50 Author: Danielle Ratson Date: Wed Jan 21 13:46:44 2026 +0200 selftests: net: Add kernel selftest for RFC 4884 RFC 4884 extended certain ICMP messages with a length attribute that encodes the length of the "original datagram" field. This is needed so that new information could be appended to these messages without applications thinking that it is part of the "original datagram" field. In version 5.9, the kernel was extended with two new socket options (SOL_IP/IP_RECVERR_4884 and SOL_IPV6/IPV6_RECVERR_RFC4884) that allow user space to retrieve this length which is basically the offset to the ICMP Extension Structure at the end of the ICMP message. This is required by user space applications that need to parse the information contained in the ICMP Extension Structure. For example, the RFC 5837 extension for tracepath. Add a selftest that verifies correct handling of the RFC 4884 length field for both IPv4 and IPv6, with and without extension structures, and validates that malformed extensions are correctly reported as invalid. For each address family, the test creates: - a raw socket used to send locally crafted ICMP error packets to the loopback address, and - a datagram socket used to receive the encapsulated original datagram and associated error metadata from the kernel error queue. ICMP packets are constructed entirely in user space rather than relying on kernel-generated errors. This allows the test to exercise invalid scenarios (such as corrupted checksums and incorrect length fields) and verify that the SO_EE_RFC4884_FLAG_INVALID flag is set as expected. Output Example: $ ./icmp_rfc4884 Starting 18 tests from 18 test cases. RUN rfc4884.ipv4_ext_small_payload.rfc4884 ... OK rfc4884.ipv4_ext_small_payload.rfc4884 ok 1 rfc4884.ipv4_ext_small_payload.rfc4884 RUN rfc4884.ipv4_ext.rfc4884 ... OK rfc4884.ipv4_ext.rfc4884 ok 2 rfc4884.ipv4_ext.rfc4884 RUN rfc4884.ipv4_ext_large_payload.rfc4884 ... OK rfc4884.ipv4_ext_large_payload.rfc4884 ok 3 rfc4884.ipv4_ext_large_payload.rfc4884 RUN rfc4884.ipv4_no_ext_small_payload.rfc4884 ... OK rfc4884.ipv4_no_ext_small_payload.rfc4884 ok 4 rfc4884.ipv4_no_ext_small_payload.rfc4884 RUN rfc4884.ipv4_no_ext_min_payload.rfc4884 ... OK rfc4884.ipv4_no_ext_min_payload.rfc4884 ok 5 rfc4884.ipv4_no_ext_min_payload.rfc4884 RUN rfc4884.ipv4_no_ext_large_payload.rfc4884 ... OK rfc4884.ipv4_no_ext_large_payload.rfc4884 ok 6 rfc4884.ipv4_no_ext_large_payload.rfc4884 RUN rfc4884.ipv4_invalid_ext_checksum.rfc4884 ... OK rfc4884.ipv4_invalid_ext_checksum.rfc4884 ok 7 rfc4884.ipv4_invalid_ext_checksum.rfc4884 RUN rfc4884.ipv4_invalid_ext_length_small.rfc4884 ... OK rfc4884.ipv4_invalid_ext_length_small.rfc4884 ok 8 rfc4884.ipv4_invalid_ext_length_small.rfc4884 RUN rfc4884.ipv4_invalid_ext_length_large.rfc4884 ... OK rfc4884.ipv4_invalid_ext_length_large.rfc4884 ok 9 rfc4884.ipv4_invalid_ext_length_large.rfc4884 RUN rfc4884.ipv6_ext_small_payload.rfc4884 ... OK rfc4884.ipv6_ext_small_payload.rfc4884 ok 10 rfc4884.ipv6_ext_small_payload.rfc4884 RUN rfc4884.ipv6_ext.rfc4884 ... OK rfc4884.ipv6_ext.rfc4884 ok 11 rfc4884.ipv6_ext.rfc4884 RUN rfc4884.ipv6_ext_large_payload.rfc4884 ... OK rfc4884.ipv6_ext_large_payload.rfc4884 ok 12 rfc4884.ipv6_ext_large_payload.rfc4884 RUN rfc4884.ipv6_no_ext_small_payload.rfc4884 ... OK rfc4884.ipv6_no_ext_small_payload.rfc4884 ok 13 rfc4884.ipv6_no_ext_small_payload.rfc4884 RUN rfc4884.ipv6_no_ext_min_payload.rfc4884 ... OK rfc4884.ipv6_no_ext_min_payload.rfc4884 ok 14 rfc4884.ipv6_no_ext_min_payload.rfc4884 RUN rfc4884.ipv6_no_ext_large_payload.rfc4884 ... OK rfc4884.ipv6_no_ext_large_payload.rfc4884 ok 15 rfc4884.ipv6_no_ext_large_payload.rfc4884 RUN rfc4884.ipv6_invalid_ext_checksum.rfc4884 ... OK rfc4884.ipv6_invalid_ext_checksum.rfc4884 ok 16 rfc4884.ipv6_invalid_ext_checksum.rfc4884 RUN rfc4884.ipv6_invalid_ext_length_small.rfc4884 ... OK rfc4884.ipv6_invalid_ext_length_small.rfc4884 ok 17 rfc4884.ipv6_invalid_ext_length_small.rfc4884 RUN rfc4884.ipv6_invalid_ext_length_large.rfc4884 ... OK rfc4884.ipv6_invalid_ext_length_large.rfc4884 ok 18 rfc4884.ipv6_invalid_ext_length_large.rfc4884 PASSED: 18 / 18 tests passed. Totals: pass:18 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Danielle Ratson Reviewed-by: Ido Schimmel Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260121114644.2863640-1-danieller@nvidia.com Signed-off-by: Jakub Kicinski commit 2849d179d442b1f3d2cb9ffdf8c0cdc8127f3b95 Merge: 3b87882bb399bf bc1f0b1c98f518 Author: Jakub Kicinski Date: Thu Jan 22 18:28:51 2026 -0800 Merge branch 'tcp-remove-tcp_rate-c' Eric Dumazet says: ==================== tcp: remove tcp_rate.c Move tcp_rate_gen() to tcp_input.c and tcp_rate_check_app_limited() to tcp.c for better code generation. tcp_rate.c was interesting from code maintenance perspective but was adding cpu costs. ==================== Link: https://patch.msgid.link/20260121095923.3134639-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit bc1f0b1c98f518867efc5cc9c22181722be14532 Author: Eric Dumazet Date: Wed Jan 21 09:59:23 2026 +0000 tcp: move tcp_rate_check_app_limited() to tcp.c tcp_rate_check_app_limited() is used from tcp_sendmsg_locked() fast path and from other callers. Move it to tcp.c so that it can be inlined in tcp_sendmsg_locked(). Small increase of code, for better TCP performance. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 1/0 up/down: 87/0 (87) Function old new delta tcp_sendmsg_locked 4217 4304 +87 Total: Before=22566462, After=22566549, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260121095923.3134639-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit b814bdcecd7990d85d42e19cff6ce0c12f146330 Author: Eric Dumazet Date: Wed Jan 21 09:59:22 2026 +0000 tcp: move tcp_rate_gen to tcp_input.c This function is called from one caller only, in TCP fast path. Move it to tcp_input.c so that compiler can inline it. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 1/0 up/down: 226/-300 (-74) Function old new delta tcp_ack 5405 5631 +226 __pfx_tcp_rate_gen 16 - -16 tcp_rate_gen 284 - -284 Total: Before=22566536, After=22566462, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260121095923.3134639-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3b87882bb399bf6d1900a1c2cc8dde65d336680a Merge: 31d44a37820f00 dc6597fab3e3d2 Author: Jakub Kicinski Date: Thu Jan 22 18:27:34 2026 -0800 Merge branch 'net-stmmac-dwmac-enforce-preamble-before-sfd-for-i-mx8mp' Stefan Eichenberger says: ==================== net: stmmac: dwmac: enforce preamble before SFD for i.MX8MP This series adds a new phy_device flag PHY_F_KEEP_PREAMBLE_BEFORE_SFD that allows a MAC driver to request to keep the preamble bytes before the start frame delimiter (SFD) when receiving frames from the PHY. This flag is set in the stmmac driver for the i.MX8MP SoC due to errata (ERR050694), which causes it to drop frames without a preamble. The Micrel KSZ9131 PHY supports keeping the preamble before SFD by setting an undocumented flag, that was confirmed by NXP and Micrel. This new feature has been added to the Micrel PHY driver for the KSZ9131 PHY. ==================== Link: https://patch.msgid.link/20260120203905.23805-1-eichest@gmail.com Signed-off-by: Jakub Kicinski commit dc6597fab3e3d291da9e0b4c6f7da01a5a863e80 Author: Stefan Eichenberger Date: Tue Jan 20 21:30:04 2026 +0100 net: stmmac: dwmac-imx: keep preamble before sfd on i.MX8MP The stmmac implementation used by NXP for the i.MX8MP SoC is subject to errata ERR050694. According to this errata, when no preamble byte is transferred before the SFD from the PHY to the MAC, the MAC will discard the frame. Setting the PHY_F_KEEP_PREAMBLE_BEFORE_SFD flag instructs PHYs that support it to keep the preamble byte before the SFD. This ensures that the MAC successfully receives frames. As this is an issue in the MAC implementation, only enable the flag for the i.MX8MP SoC where the errata applies but not for other SoCs using a working stmmac implementation. The exact wording of the errata ERR050694 from NXP: The IEEE 802.3 standard states that, in MII/GMII modes, the byte preceding the SFD (0xD5), SMD-S (0xE6,0x4C, 0x7F, or 0xB3), or SMD-C (0x61, 0x52, 0x9E, or 0x2A) byte can be a non-PREAMBLE byte or there can be no preceding preamble byte. The MAC receiver must successfully receive a packet without any preamble(0x55) byte preceding the SFD, SMD-S, or SMD-C byte. However due to the defect, in configurations where frame preemption is enabled, when preamble byte does not precede the SFD, SMD-S, or SMD-C byte, the received packet is discarded by the MAC receiver. This is because, the start-of-packet detection logic of the MAC receiver incorrectly checks for a preamble byte. NXP refers to IEEE 802.3 where in clause 35.2.3.2.2 Receive case (GMII) they show two tables one where the preamble is preceding the SFD and one where it is not. The text says: The operation of 1000 Mb/s PHYs can result in shrinkage of the preamble between transmission at the source GMII and reception at the destination GMII. Table 35-3 depicts the case where no preamble bytes are conveyed across the GMII. This case may not be possible with a specific PHY, but illustrates the minimum preamble with which MAC shall be able to operate. Table 35-4 depicts the case where the entire preamble is conveyed across the GMII. This workaround was tested on a Verdin iMX8MP by enforcing 10 MBit/s: ethtool -s end0 speed 10 Without keeping the preamble, no packet were received. With keeping the preamble, everything worked as expected. Signed-off-by: Stefan Eichenberger Reviewed-by: Andrew Lunn Tested-by: Maxime Chevallier Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260120203905.23805-4-eichest@gmail.com Signed-off-by: Jakub Kicinski commit fa1197a09496e6145e3d54a5ce60334a65595d48 Author: Stefan Eichenberger Date: Tue Jan 20 21:30:03 2026 +0100 net: phy: micrel: add option to keep the preamble before sfd for KSZ9131 If the PHY_F_KEEP_PREAMBLE_BEFORE_SFD flag is set in the phy_device::dev_flags field, the preamble will be kept before the start frame delimiter (SFD) on the KSZ9131 PHY. This flag is not officially documented by Micrel. However, information provided by NXP and Micrel indicates that this flag ensures the PHY sends the full preamble instead of removing it. The full discussion can be found on the NXP forum: https://community.nxp.com/t5/i-MX-Processors/iMX8MP-eqos-not-working-for-10base-t/m-p/2151032 Signed-off-by: Stefan Eichenberger Reviewed-by: Andrew Lunn Tested-by: Maxime Chevallier Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260120203905.23805-3-eichest@gmail.com Signed-off-by: Jakub Kicinski commit 2153e151c27cee16f5b33b882aa7ffe03bc7afc8 Author: Stefan Eichenberger Date: Tue Jan 20 21:30:02 2026 +0100 net: phy: add a new phy_device flag to keep preamble before sfd Add a new flag, PHY_F_KEEP_PREAMBLE_BEFORE_SFD, to indicate that the PHY shall not remove the preamble before the SFD if it supports it. MACs that do not support receiving frames without a preamble can set this flag. Signed-off-by: Stefan Eichenberger Reviewed-by: Andrew Lunn Tested-by: Maxime Chevallier Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260120203905.23805-2-eichest@gmail.com Signed-off-by: Jakub Kicinski commit 847eaf0d3123eaf78ddc48916fd5b7a5f12d43db Merge: 8f0b4cce4481fb 4b18a3ef2230e3 Author: Stephen Boyd Date: Thu Jan 22 18:09:44 2026 -0800 Merge tag 'samsung-clk-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung clk driver updates from Krzysztof Kozlowski: 1. Add new clock controllers: - MFD for ExynosAutov920 SoC, - Display Process Unit (DPU) for Google GS101 SoC. 2. Implement automatic clock gating mode (HWACG) for Google GS101 SoC clock controllers (but also used on almost all modern Exynos SoC), opposed to currently used mode - manual mode. Background on HW automatic clock gating from Peter Griffin in cover letter: This series addresses an issue with Samsung Exynos based upstream clock driver whereby the upstream clock driver sets all the clock gates into "manual mode" (which uses a bit that is documented as reserved in the gate registers). Another issue with the current "manual clock gating" approach upstream is there are many bus/interconnect clocks whose relationships to the IPs are not well documented or defined in the specs. When adding a new CMU until now we have tried to label these clocks appropriately with CLK_IS_CRITICAL and CLK_IGNORE_UNUSED but doing so is both error prone and time consuming. If your lucky disabling a critical bus clock causes an immediate hang. Other clocks however aren't so obvious and show up through random instability some period of time later. Fortunately each CMU (at least on newer Exynos) provides a "hardware automatic clock gating" HWACG feature that is used by the downstream Samsung clock drivers. Hardware automatic clock gating uses a hardware interface between the CMU and IP to control all clocks required by the IP. This interface is called Q-channel, and is part of the Arm AMBA low power interface specification [1]. The advantage of using this Qchannel hardware interface for enabling/disabling the clocks is that it takes care of all clocks (including bus/interconnect) ones for the IP automatically thereby reducing the dynamic power. Whilst each clock component (GATE, MUX, DIV, QCH etc) has a HWACG enable bit there are also some "global enable override" bits for the entire CMU in the CMU_CONTROLLER_OPTION register. This series makes use of those "global enable" override bits to enable auto clock mode for the entire CMU and every component within it. Through experimentation we can see that setting the "manual mode" reserved gate bit on a particular gate register overides the global enable bits. So the code is updated accordingly not to do that. Auto clock mode has been implemented as a "opt in" by setting a new auto_clock_gate flag in the CMU static data. The intention is existing platforms in manual mode should not be effected by any of these changes. If auto_clock_mode flag is set and the option_offset field is specified then the global enable override bits will be written for the CMU (to avoid relying on any prior bootstage configuration). Again if auto mode is enabled the code no longer sets MANUAL and clears HWACG bits on each gate register. To ensure compatibility with older DTs (that specified an incorrect CMU size) the resource size is checked and the driver falls back to manual clock gate mode in such cases. As the CLK_IGNORE_UNUSED and CLK_IS_CRITICAL flags are required for manual clock gate mode, the patch removing these flags has been dropped from v2. I tested with an old DT and we successfully switch to manual clock gate mode and the system correctly boots. To have dynamic root clock gating (drcg) of bus components and memclk enabled, it is required to set the bus_component_drcg and memclk registers in the correspondingly named sysreg controller. If auto clock mode is enabled the clock driver will now attempt to get the sysreg syscon via the samsung,sysreg property (as used by other Exynos drivers upstream) and set the registers accordingly. The suspend/resume code paths are also updated to handle saving/restoring registers using a regmap. Note cmu_top is an exception and does not have a corresondingly named sysreg_top. As all clock gates are currently exposed in the gs101 drivers and DT, we continue to register all of these gates in auto clock mode, but with some new samsung_auto_clk_gate_ops. As clk enable and clk disable are now handled by Q-channel interface the .enable and .disable implementations are no-ops. However by using some CMU qchannel debug registers we can report the current clock status (enabled or disabled) of every clock gate in the system. This has the nice effect of still being able to dump the entire clock tree from /sys/kernel/debug/clk/clk_summary and see a live view of every auto clock in the system. With the infrastructure in place, all the CMUs registered in clk-gs101 are now updated to enable auto clock mode. From dumping /sys/kernel/debug/clk/clk_summary it is possible to see that after enabling auto clock mode approximately 305 clocks are enabled, and 299 are now disabled. This number goes up and down a bit by 3-5 clocks just on a idle system sat at a console. With auto clock mode enabled it is now also possible to boot without the clk_ignore_unused kernel command line property for the first time! For future CMUs in gs101 I propose we continue to expose all gates, but register the CMU in "auto mode". For new device drivers or updates to existing dt bindings related to clocks to support gs101 I suggest we only use the "obviously correct" clock(s). By "obviously correct" I mean a clock has the IP name in the clock register name, but not try to deduce other obsucurely named bus/interconnect clocks which will now all be handled automatically. Note it is still possible to test whether the "obviously correct" clock is indeed correct by putting the individual gate in manual mode and disabling the clock (e.g. by using devmem). * tag 'samsung-clk-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: gs101: add support for Display Process Unit (DPU) clocks dt-bindings: samsung: exynos-sysreg: add gs101 dpu compatible dt-bindings: clock: google,gs101-clock: Add DPU clock management unit dt-bindings: clock: google,gs101-clock: fix alphanumeric ordering clk: samsung: fix sysreg save/restore when PM is enabled for CMU clk: samsung: avoid warning message on legacy Exynos (auto clock gating) clk: samsung: gs101: Enable auto_clock_gate mode for each gs101 CMU clk: samsung: Implement automatic clock gating mode for CMUs dt-bindings: clock: google,gs101-clock: add samsung,sysreg property as required clk: samsung: exynosautov920: add clock support dt-bindings: clock: exynosautov920: add MFD clock definitions commit aa2ad19210a6a444111bce55e8b69579f29318fb Author: Haotian Zhang Date: Sun Nov 23 23:43:15 2025 +0800 clk: mediatek: Fix error handling in runtime PM setup devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value, and when pm_runtime_resume_and_get() fails, it returns directly without unmapping the shared_io region. Add error handling for devm_pm_runtime_enable(). Reorder cleanup labels to properly unmap shared_io on pm_runtime_resume_and_get() failure. Fixes: 2f7b1d8b5505 ("clk: mediatek: Do a runtime PM get on controllers during probe") Signed-off-by: Haotian Zhang Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd commit 963bb1866c2cf3f599dcf6d57bde35fb6fb42ec4 Author: Bartosz Golaszewski Date: Mon Dec 22 16:02:35 2025 +0100 clk: mediatek: don't select clk-mt8192 for all ARM64 builds This option defaults to y for ARCH64 meaning it's built even if we don't want anything related to mediatek. Make the default condition stricter and only build it if ARCH_MEDIATEK is selected. Signed-off-by: Bartosz Golaszewski Reviewed-by: Brian Masney Reviewed-by: Chen-Yu Tsai Signed-off-by: Stephen Boyd commit 19024c9980c331908de0680283d572b80308654e Author: Nicolas Frattaroli Date: Mon Dec 15 11:24:02 2025 +0100 clk: mediatek: Add mfg_eb as parent to mt8196 mfgpll clocks All the MFGPLL require MFG_EB to be on for any operation on them, and they only tick when MFG_EB is on as well, therefore making this a parent-child relationship. This dependency wasn't clear during the initial upstreaming of these clock controllers, as it only made itself known when I could observe the effects of the clock by bringing up a different piece of hardware. Add a new PLL_PARENT_EN flag to mediatek's clk-pll.h, and check for it when initialising the pll to then translate it into the actual CLK_OPS_PARENT_ENABLE flag. Then add the mfg_eb parent to the mfgpll clocks, and set the new PLL_PARENT_EN flag. Fixes: 03dc02f8c7dc ("clk: mediatek: Add MT8196 mfg clock support") Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Nicolas Frattaroli Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd commit 483f364bb0014495da19c1ccb1a6e2423fc37d95 Author: Nicolas Frattaroli Date: Mon Dec 15 11:24:01 2025 +0100 clk: mediatek: Refactor pllfh registration to pass device After refactoring all of PLL to pass the device, it's now fairly easy to refactor pllfh and its users, as pllfh registration wraps PLL registration. Do this refactor and move all of the pllfh users to pass the device as well. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Nicolas Frattaroli Signed-off-by: Stephen Boyd commit ecffd05839b32f17bde1f3701b68ab182a837b07 Author: Nicolas Frattaroli Date: Mon Dec 15 11:24:00 2025 +0100 clk: mediatek: Pass device to clk_hw_register for PLLs Passing the struct device pointer to clk_hw_register allows for runtime power management to work for the registered clock controllers. However, the mediatek PLL clocks do not do this. Change this by adding a struct device pointer argument to mtk_clk_register_pll, and fix up the only other user of it. Also add a new member to the struct mtk_clk_pll for the struct device pointer, which is set by mtk_clk_register_pll and is used by mtk_clk_register_pll_ops. If mtk_clk_register_pll is called with a NULL struct device pointer, then everything still works as expected; the clock core will simply treat them as previously, i.e. without runtime power management. Reviewed-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Nicolas Frattaroli Signed-off-by: Stephen Boyd commit c9ced38af56fe6411118c6bc6522eab80849326d Author: Nicolas Frattaroli Date: Mon Dec 15 11:23:59 2025 +0100 clk: mediatek: Refactor pll registration to pass device As it stands, mtk_clk_register_plls takes a struct device_node pointer as its first argument. This is a tragic happenstance, as it's trivial to get the device_node from a struct device, but the opposite not so much. The struct device is a much more useful thing to have passed down. Refactor mtk_clk_register_plls to take a struct device pointer instead of a struct device_node pointer, and fix up all users of this function. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Nicolas Frattaroli Signed-off-by: Stephen Boyd commit 669917676e93fca5ea3c66fc9539830312bec58e Author: Nicolas Frattaroli Date: Mon Dec 15 11:23:58 2025 +0100 clk: Respect CLK_OPS_PARENT_ENABLE during recalc When CLK_OPS_PARENT_ENABLE was introduced, it guarded various clock operations, such as setting the rate or switching parents. However, another operation that can and often does touch actual hardware state is recalc_rate, which may also be affected by such a dependency. Add parent enables/disables where the recalc_rate op is called directly. Fixes: fc8726a2c021 ("clk: core: support clocks which requires parents enable (part 2)") Fixes: a4b3518d146f ("clk: core: support clocks which requires parents enable (part 1)") Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Nicolas Frattaroli Signed-off-by: Stephen Boyd commit a2ed1aed687a21738a6c8bd4043149c443298e88 Author: AngeloGioacchino Del Regno Date: Tue Jan 13 12:00:08 2026 +0100 dt-bindings: clock: mediatek,mt7622-pciesys: Remove syscon compatible The PCIESYS register space contains a pure clock controller, which has no system controller register, so this definitely doesn't need any "syscon" compatible. As a side note, luckily no devicetree ever added the syscon string to PCIESYS clock controller node compatibles, so this also resolves a dtbs_check warning for mt7622. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Reviewed-by: Matthias Brugger Signed-off-by: Stephen Boyd commit 871afb43e41ad4e8246438de495a939cd0f8113c Author: Sjoerd Simons Date: Tue Dec 23 12:05:17 2025 +0100 clk: mediatek: Drop __initconst from gates Since commit 8ceff24a754a ("clk: mediatek: clk-gate: Refactor mtk_clk_register_gate to use mtk_gate struct") the mtk_gate structs are no longer just used for initialization/registration, but also at runtime. So drop __initconst annotations. Fixes: 8ceff24a754a ("clk: mediatek: clk-gate: Refactor mtk_clk_register_gate to use mtk_gate struct") Signed-off-by: Sjoerd Simons Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Laura Nao Signed-off-by: Stephen Boyd commit da61439c63d34ae6503d080a847f144d587e3a48 Author: Johan Hovold Date: Fri Nov 21 17:40:03 2025 +0100 clk: tegra: tegra124-emc: fix device leak on set_rate() Make sure to drop the reference taken when looking up the EMC device and its driver data on first set_rate(). Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver") Fixes: 6d6ef58c2470 ("clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver") Cc: stable@vger.kernel.org # 4.2: 6d6ef58c2470 Cc: Mikko Perttunen Cc: Miaoqian Lin Signed-off-by: Johan Hovold Signed-off-by: Stephen Boyd commit d2f618b8fe76b565f6bc0071b5eeee07a9012c6d Merge: d62dec8c70934c 69f83f167463ba Author: Dave Airlie Date: Fri Jan 23 10:04:07 2026 +1000 Merge tag 'drm-intel-next-fixes-2026-01-22' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next - Don't enable Panel Replay on sink if globally disabled Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/aXHZjieG9PkFKjZ2@jlahtine-mobl commit 914c743509d56067eeeb2b5e341a44a68ef8377d Merge: 064c098790944f 9a8920ca8ebfb9 Author: Dave Jiang Date: Thu Jan 22 16:59:43 2026 -0700 Merge branch 'for-7.0/cxl-aer-prep' into cxl-for-next Preparation for CXL port error protocol handling. First part contains all the changes centered around setting up the PCI side of error handling. cxl: Update RAS handler interfaces to also support CXL Ports cxl/mem: Clarify @host for devm_cxl_add_nvdimm() PCI/AER: Update struct aer_err_info with kernel-doc formatting PCI/AER: Report CXL or PCIe bus type in AER trace logging PCI/AER: Use guard() in cxl_rch_handle_error_iter() PCI/AER: Move CXL RCH error handling to aer_cxl_rch.c PCI/AER: Update is_internal_error() to be non-static is_aer_internal_error() PCI/AER: Export pci_aer_unmask_internal_errors() cxl/pci: Move CXL driver's RCH error handling into core/ras_rch.c PCI/AER: Replace PCIEAER_CXL symbol with CXL_RAS cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c PCI: Replace cxl_error_is_native() with pcie_aer_is_native() cxl/pci: Remove unnecessary CXL RCH handling helper functions cxl/pci: Remove unnecessary CXL Endpoint handling helper functions PCI: Introduce pcie_is_cxl() PCI: Update CXL DVSEC definitions PCI: Move CXL DVSEC definitions into uapi/linux/pci_regs.h commit 064c098790944fa44f6aa704eb55a5c3ed65a2fa Author: Alison Schofield Date: Fri Jan 16 20:47:30 2026 -0800 cxl/region: Use do_div() for 64-bit modulo operation div64_u64_rem() was the wrong choice for doing a modulo operation and it was used incorrectly, causing a kernel oops by passing NULL as the remainder parameter. Replace it with the do_div() helper that does the intended math (gran_offset = offset % gran) and is architecture safe. This bug appeared during testing of unaligned address translations. The visibility to userspace would be limited to folks doing poison injection or clear by HPA on unaligned regions. Fixes: 78b50b598462 ("cxl/region: Translate HPA to DPA and memdev in unaligned regions") Signed-off-by: Alison Schofield Link: https://patch.msgid.link/20260117044732.567831-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit b51792fd9168e581e51be98e22df5f79454e22de Author: Alison Schofield Date: Thu Jan 15 20:58:37 2026 -0800 cxl/region: Translate HPA to DPA and memdev in unaligned regions The CXL driver supports an expert user debugfs interface to inject and clear poison by a region offset. That feature requires translating a HPA (the region address) to a DPA and a memdev to perform the poison operation. Unaligned regions do not have an algebraically invertible mapping from HPA to DPA due to the region offset skew. The region base is not aligned to a full interleave. Add a helper to perform the unaligned translations that first calculates the DPA offset and then tests it against each candidate endpoint decoder. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Alison Schofield Link: https://patch.msgid.link/f338b7aff7e4574fcc525b1a0d4f09786bfb6489.1768538962.git.alison.schofield@intel.com Signed-off-by: Dave Jiang commit e639055f1f30311db91cafb36e408cc727c7d445 Author: Alison Schofield Date: Thu Jan 15 20:58:36 2026 -0800 cxl/region: Translate DPA->HPA in unaligned MOD3 regions The CXL driver implementation of DPA->HPA address translation depends on a region's starting address always being aligned to Host Bridge Interleave Ways * 256MB. The driver follows the decode methods defined in the CXL Spec[1] and expanded upon in the CXL Driver Writers Guide[2], which describe bit manipulations based on power-of-2 alignment to translate a DPA to an HPA. With the introduction of MOD3 interleave way support, platforms may create regions at starting addresses that are not power-of-2 aligned. This allows platforms to avoid gaps in the memory map, but addresses within those regions cannot be translated using the existing bit manipulation method. Introduce an unaligned translation method for DPA->HPA that reconstructs an HPA by restoring the address first at the port level and then at the host bridge level. [1] CXL Spec 4.0 8.2.4.20.13 Implementation Note Device Decoder Logic [2] CXL Type 3 Memory Software Guide 1.1 2.13.25 DPA to HPA Translation Suggested-by: Qing Huang Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Alison Schofield Link: https://patch.msgid.link/e7c53215bf69f2ff1ae7e58bcc49ca387b7b0299.1768538962.git.alison.schofield@intel.com Signed-off-by: Dave Jiang commit 4ed7952b9e87cf731ebc8251874416e60eb15230 Author: Cheatham, Benjamin Date: Fri Jan 9 07:57:38 2026 -0600 cxl/core: Fix cxl_dport debugfs EINJ entries Protocol error injection is only valid for CXL 2.0+ root ports and CXL 1.1 memory-mapped downstream ports as per the ACPI v6.5 spec (Table 8-31). The core code currently creates an 'einj_inject' file in CXL debugfs for all CXL 1.1 downstream ports and all PCI CXL 2.0+ downstream ports. This results in debugfs EINJ files that won't work due to platform/spec restrictions. Fix by limiting 'einj_inject' file creation to only CXL 1.1 dports and CXL 2.0+ root ports. Update the comment above the check to more accurately represent the requirements expected by the EINJ module and ACPI spec. Fixes: 8039804cfa73 ("cxl/core: Add CXL EINJ debugfs files") Signed-off-by: Ben Cheatham Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/6e9fb657-8264-4028-92e2-5428e2695bf1@amd.com Signed-off-by: Dave Jiang commit 99698e70148fbce4410799570adac8456204fa37 Author: Li Ming Date: Fri Jan 9 23:40:42 2026 +0800 cxl/acpi: Remove cxl_acpi_set_cache_size() cxl_acpi_set_cache_size() returns an error only when the size of the cache range is not matched with the CXL address range. Almost all implementation of setting cache size is in cxl_acpi_set_cache_size(), cxl_setup_extended_linear_size() does nothing except printing a warning in above error case, but cxl_acpi_set_cache_size() also prints a warning at the same time. So can consolidates these two functions into one, keep the function name as cxl_setup_extended_linear_size(). Signed-off-by: Li Ming Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260109154042.331296-1-ming.li@zohomail.com Signed-off-by: Dave Jiang commit e5b1887619403c2da25a5899cad3e1ab34e7717f Author: Robert Richter Date: Fri Jan 9 13:29:51 2026 +0100 cxl/hdm: Fix newline character in dev_err() messages The newline character is not placed at the end of the string. This causes unintended line wraps, broken log level and unterminated log messages. Fix that for all messages. Note that the messages are changed to use colons now instead of parentheses, which is more common use. Fixes: 24b18197184a ("cxl/hdm: Extend DVSEC range register emulation for region enumeration") Fixes: 9c57cde0dcbd ("cxl/hdm: Enumerate allocated DPA") Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260109122952.639231-1-rrichter@amd.com Signed-off-by: Dave Jiang commit 4dd05f02f1d618da610e7d3bd479c47a96b4fc3f Author: Samasth Norway Ananda Date: Mon Jan 5 12:38:33 2026 -0800 cxl/pci: Remove outdated FIXME comment and BUILD_BUG_ON Remove the outdated FIXME comment about switching to struct_group() and the associated BUILD_BUG_ON check. This work was already completed in commit 301e68dd9b9b ("cxl/core: Replace unions with struct_group()") which converted struct cxl_regs to use struct_group_tagged(). The BUILD_BUG_ON was checking that anonymous union layout was preserved, but since struct_group() now handles this correctly, the compile-time check is no longer necessary. Signed-off-by: Samasth Norway Ananda Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260105203833.1604585-1-samasth.norway.ananda@oracle.com Signed-off-by: Dave Jiang commit 7362facf6ec14f70fe28413cb484639d783b89f0 Author: Gregory Price Date: Fri Dec 19 12:05:38 2025 -0500 Documentation/driver-api/cxl: device hotplug section Describe cxl memory device hotplug implications, in particular how the platform CEDT CFMWS must be described to support successful hot-add of memory devices. Reviewed-by: Jonathan Cameron Signed-off-by: Gregory Price Reviewed-by: Dave Jiang Reviewed-by: Alejandro Lucero Palau Link: https://patch.msgid.link/20251219170538.1675743-3-gourry@gourry.net Signed-off-by: Dave Jiang commit 2489d83c22ce9e44425469960677e6dbfd68adcc Author: Gregory Price Date: Fri Dec 19 12:05:37 2025 -0500 Documentation/driver-api/cxl: BIOS/EFI expectation update Add a snippet about what Linux expects BIOS/EFI to do (and not to do) to the BIOS/EFI section. Suggested-by: Alejandro Lucero Palau Signed-off-by: Gregory Price Reviewed-by: Dave Jiang Reviewed-by: Alejandro Lucero Palau Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251219170538.1675743-2-gourry@gourry.net Signed-off-by: Dave Jiang commit a5b46cd1a08ceb8af35b01a335ee810c855b87e2 Author: Mikko Rapeli Date: Thu Jan 22 12:57:51 2026 +0200 scripts: kconfig: merge_config.sh: warn on duplicate input files External scripts like yocto kernel scc may provide same input config fragment multiple times. This may be a bug since processing same fragments multiple times can be time consuming. Signed-off-by: Mikko Rapeli Link: https://patch.msgid.link/20260122105751.2186609-3-mikko.rapeli@linaro.org Signed-off-by: Nathan Chancellor commit dfc97e1c5da5ba56356cd403b97546c86d43ca9a Author: Mikko Rapeli Date: Thu Jan 22 12:57:50 2026 +0200 scripts: kconfig: merge_config.sh: use awk in checks too Converting from shell/sed/grep loop to awk improves runtime checks of Yocto genericarm64 kernel config from 20 seconds to under 1 second. The checks catch this kind of issues: WARNING: CONFIG_BLK_DEV_DM differs: Requested value: CONFIG_BLK_DEV_DM=y Actual value: CONFIG_BLK_DEV_DM=m WARNING: CONFIG_SECURITY_NETWORK differs: Requested value: CONFIG_SECURITY_NETWORK=n Actual value: CONFIG_SECURITY_NETWORK=y WARNING: Value requested for CONFIG_ARM64_BTI_KERNEL not in final .config Requested value: CONFIG_ARM64_BTI_KERNEL=y Actual value: Signed-off-by: Mikko Rapeli Link: https://patch.msgid.link/20260122105751.2186609-2-mikko.rapeli@linaro.org Signed-off-by: Nathan Chancellor commit 5fa9b82cbcfc524a2dad581ac2af136536d4e8e5 Author: Anders Roxell Date: Thu Jan 22 12:57:49 2026 +0200 scripts: kconfig: merge_config.sh: refactor from shell/sed/grep to awk merge_config.sh shell/sed/grep loop scales poorly and is slow. With Yocto genericarm64 kernel and around 190 config fragments the script takes more than 20 minutes to run on a fast build machine. Re-implementation with awk does the same job in 10 seconds. Using awk since it is likely available in the build environments and using perl, python etc would introduce more complex runtime dependencies. awk is good enough and lot better than shell/sed/grep. Output stays the same but changed execution time means that parallel job output may be ordered differently. Signed-off-by: Anders Roxell Signed-off-by: Mikko Rapeli Link: https://patch.msgid.link/20260122105751.2186609-1-mikko.rapeli@linaro.org Signed-off-by: Nathan Chancellor commit a081b5789255d27b76cd2cbab85676b2a31dbde1 Author: Ard Biesheuvel Date: Fri Jan 16 10:34:02 2026 +0100 kallsyms: Get rid of kallsyms relative base When the kallsyms relative base was introduced, per-CPU variable references on x86_64 SMP were implemented as offsets into the respective per-CPU region, rather than offsets relative to the location of the variable's template in the kernel image, which is how other architectures implement it. This required kallsyms to reason about the difference between the two, and the sign of the value in the kallsyms_offsets[] array was used to distinguish them. This meant that negative offsets were not permitted for ordinary variables, and so it was crucial that the relative base was chosen such that all offsets were positive numbers. This is no longer needed: instead, the offsets can simply be encoded as values in the range -/+ 2 GiB, which is precisely what PC32 relocations provide on most architectures. So it is possible to simplify the logic, and just use _text as the anchor directly, and let the linker calculate the final value based on the location of the entry itself. Some architectures (nios2, extensa) do not support place-relative relocations at all, but these are all 32-bit and non-relocatable, and so there is no need for place-relative relocations in the first place, and the actual symbol values can just be stored directly. This makes all entries in the kallsyms_offsets[] array visible as place-relative references in the ELF metadata, which will be important when implementing ELF-based fg-kaslr. Reviewed-by: Kees Cook Signed-off-by: Ard Biesheuvel Link: https://patch.msgid.link/20260116093359.2442297-6-ardb+git@google.com Signed-off-by: Nathan Chancellor commit 82dadc8a494758093e775336390cb31033c6f9a3 Author: Caleb Sander Mateos Date: Thu Jan 22 14:45:04 2026 -0700 io_uring/rsrc: take unsigned index in io_rsrc_node_lookup() io_rsrc_node_lookup() takes a signed int index as input and compares it to an unsigned length. Since the signed int is implicitly cast to an unsigned int for the comparison and the length is bounded by IORING_MAX_FIXED_FILES/IORING_MAX_REG_BUFFERS, negative indices are already rejected on architectures where int is at least 32 bits. Make this a bit clearer and avoid compiler warnings for comparisons of signed and unsigned values by taking an unsigned int index instead. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit ff79d31eb536f6d87bcbc09287d54d5606bf6dbe Author: Ard Biesheuvel Date: Fri Jan 16 10:34:01 2026 +0100 mips: Add support for PC32 relocations in vmlinux MIPS supports PC32 relocations like most other architectures, which will be used by kallsyms to make its symbol references visible to the linker. Given that these are place-relative, they can be ignored by the 'relocs' tool, just like other PC type relocations. Signed-off-by: Ard Biesheuvel Link: https://patch.msgid.link/20260116093359.2442297-5-ardb+git@google.com Signed-off-by: Nathan Chancellor commit 5247c034a67f5a93cc1faa15e9867eec5b22f38a Author: Pavel Begunkov Date: Tue Jan 20 20:47:40 2026 +0000 io_uring: introduce non-circular SQ Outside of SQPOLL, normally SQ entries are consumed by the time the submission syscall returns. For those cases we don't need a circular buffer and the head/tail tracking, instead the kernel can assume that entries always start from the beginning of the SQ at index 0. This patch introduces a setup flag doing exactly that. It's a simpler and helps to keeps SQEs hot in cache. The feature is optional and enabled by setting IORING_SETUP_SQ_REWIND. The flag is rejected if passed together with SQPOLL as it'd require waiting for SQ before each submission. It also requires IORING_SETUP_NO_SQARRAY, which can be supported but it's unlikely there will be users, so leave more space for future optimisations. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 31d44a37820f00de8156d1c1960dbf1bf04263c2 Merge: b00a7b3a612925 5599fa810b503e Author: Jakub Kicinski Date: Thu Jan 22 14:40:38 2026 -0800 Merge tag 'nf-next-26-01-22' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: updates for net-next There is an issue with interval matching in nftables rbtree set type: When userspace sends us set updates, there is a brief window where false negative lookups may occur from the data plane. Quoting Pablos original cover letter: This series addresses this issue by translating the rbtree, which keeps the intervals in order, to binary search. The array is published to packet path through RCU. The idea is to keep using the rbtree datastructure for control plane, which needs to deal with updates, then generate an array using this rbtree for binary search lookups. Patch #1 allows to call .remove in case .abort is defined, which is needed by this new approach. Only pipapo needs to skip .remove to speed. Patch #2 add the binary search array approach for interval matching. Patch #3 updates .get to use the binary search array to find for (closest or exact) interval matching. Patch #4 removes seqcount_rwlock_t as it is not needed anymore (new in this series). * tag 'nf-next-26-01-22' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nft_set_rbtree: remove seqcount_rwlock_t netfilter: nft_set_rbtree: use binary search array in get command netfilter: nft_set_rbtree: translate rbtree to array for binary search netfilter: nf_tables: add .abort_skip_removal flag for set types ==================== Link: https://patch.msgid.link/20260122162935.8581-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 6eac13c876805f61bbb588eaff5ada0b6dc603e8 Author: Guillaume Tucker Date: Thu Jan 22 15:07:00 2026 +0100 Documentation: dev-tools: add container.rst page Add a dev-tools/container.rst documentation page for the scripts/container tool. This covers the basic usage with additional information about environment variables and user IDs. It also includes a number of practical examples with a reference to the experimental kernel.org toolchain images. Update MAINTAINERS accordingly with a reference to the added file. Signed-off-by: Guillaume Tucker Reviewed-by: Onur Özkan Tested-by: Nicolas Schier Acked-by: Nicolas Schier Link: https://patch.msgid.link/af886533cc5cbdd6ef1d909793b79a1ad42c74ca.1769090419.git.gtucker@gtucker.io Signed-off-by: Nathan Chancellor commit 8f989b3b6f0f029e34fcfbf259e4ac47e2028d4b Author: Guillaume Tucker Date: Thu Jan 22 15:06:59 2026 +0100 scripts: add tool to run containerized builds Add a 'scripts/container' tool written in Python to run any command in the source tree from within a container. This can typically be used to call 'make' with a compiler toolchain image to run reproducible builds but any arbitrary command can be run too. Only Docker and Podman are supported in this initial version. Add a new entry to MAINTAINERS accordingly. Link: https://lore.kernel.org/all/affb7aff-dc9b-4263-bbd4-a7965c19ac4e@gtucker.io/ Signed-off-by: Guillaume Tucker Tested-by: Nicolas Schier Acked-by: Nicolas Schier Link: https://patch.msgid.link/9b8da20157e409e8fa3134d2101678779e157256.1769090419.git.gtucker@gtucker.io Signed-off-by: Nathan Chancellor commit 9a8920ca8ebfb99604f639e7fbc681d0d04518a0 Author: Terry Bowman Date: Wed Jan 14 12:20:38 2026 -0600 cxl: Update RAS handler interfaces to also support CXL Ports CXL PCIe Port Protocol Error handling support will be added to the CXL drivers in the future. In preparation, rename the existing interfaces to support handling all CXL PCIe Port Protocol Errors. The driver's RAS support functions currently rely on a 'struct cxl_dev_state' type parameter, which is not available for CXL Port devices. However, since the same CXL RAS capability structure is needed across most CXL components and devices, a common handling approach should be adopted. To accommodate this, update the __cxl_handle_cor_ras() and __cxl_handle_ras() functions to use a `struct device` instead of `struct cxl_dev_state`. No functional changes are introduced. [1] CXL 3.1 Spec, 8.2.4 CXL.cache and CXL.mem Registers Signed-off-by: Terry Bowman Reviewed-by: Alejandro Lucero Reviewed-by: Ira Weiny Reviewed-by: Gregory Price Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Ben Cheatham Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260114182055.46029-18-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit f953b7d5e19a1310dd5d92b86bafc5957847b4d6 Author: Dan Williams Date: Wed Jan 14 12:20:37 2026 -0600 cxl/mem: Clarify @host for devm_cxl_add_nvdimm() The convention for devm_ helpers in the CXL driver is that the first argument is the @host for the operation (locked driver::probe() context). Reviewed-by: Terry Bowman Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260114182055.46029-17-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit fda78d848178fb2b4eea74d96218c6c98fbe8562 Author: Terry Bowman Date: Mon Jan 19 18:40:58 2026 -0800 PCI/AER: Update struct aer_err_info with kernel-doc formatting Update the existing 'struct aer_err_info' definition to use kernel-doc formatting. Remove the inline comments to reduce noise and do not introduce functional changes. This will improve readability and maintainability. Signed-off-by: Terry Bowman Reviewed-by: Dan Williams Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260114182055.46029-16-terry.bowman@amd.com Acked-by: Bjorn Helgaas Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 83cba5b31e6b0aeb32f41b9c954fe97b60db2817 Author: Terry Bowman Date: Wed Jan 14 12:20:35 2026 -0600 PCI/AER: Report CXL or PCIe bus type in AER trace logging The AER service driver and aer_event tracing currently log 'PCIe Bus Type' for all errors. Update the driver and aer_event tracing to log 'CXL Bus Type' for CXL device errors. This requires that AER can identify and distinguish between PCIe errors and CXL errors. Introduce boolean 'is_cxl' to 'struct aer_err_info'. Add assignment in aer_get_device_error_info() and pci_print_aer(). Update the aer_event trace routine to accept a bus type string parameter. Signed-off-by: Terry Bowman Co-developed-by: Dan Williams Acked-by: Bjorn Helgaas Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260114182055.46029-15-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit da71bd360ded15626dabd59dd1d6939de38cab39 Author: Terry Bowman Date: Wed Jan 14 12:20:33 2026 -0600 PCI/AER: Use guard() in cxl_rch_handle_error_iter() cxl_rch_handle_error_iter() includes a call to device_lock() using a goto for multiple return paths. Improve readability and maintainability by using the guard() lock variant. Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Dan Williams Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/20260114182055.46029-13-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 59010029faf27c82d1e786dfd1fb83b09f478d1b Author: Terry Bowman Date: Wed Jan 14 12:20:32 2026 -0600 PCI/AER: Move CXL RCH error handling to aer_cxl_rch.c The Restricted CXL Host (RCH) AER error handling logic currently resides in the AER driver file, aer.c. CXL specific changes conditionally compiled using #ifdefs. Improve the AER driver maintainability by separating the RCH specific logic from the AER driver's core functionality and removing the ifdefs. Introduce drivers/pci/pcie/aer_cxl_rch.c for moving the RCH AER logic into. Conditionally compile the file using the CONFIG_CXL_RCH_RAS Kconfig. Move the CXL logic into the new file but leave CXL helper function is_internal_error() in aer.c for now as it will be moved in future patch for CXL Virtual Hierarchy handling. To maintain compilation after the move other changes are required. Change cxl_rch_handle_error(), cxl_rch_enable_rcec(), and is_internal_error() to be non-static inorder for accessing from the AER driver. Update the new file with the SPDX and 2023 AMD copyright notations because the RCH bits were initially contributed in 2023 by AMD. See commit: commit 0a867568bb0d ("PCI/AER: Forward RCH downstream port-detected errors to the CXL.mem dev handler") Signed-off-by: Terry Bowman Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Ben Cheatham Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260114182055.46029-12-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 51ce56b1a5d6f7263739d4766ae445463c74b689 Author: Terry Bowman Date: Wed Jan 14 12:20:31 2026 -0600 PCI/AER: Update is_internal_error() to be non-static is_aer_internal_error() The AER driver includes significant logic for handling CXL protocol errors. The AER driver will be updated in the future to separate the AER and CXL logic. Rename the is_internal_error() function to is_aer_internal_error() as it gives a more precise indication of the purpose. Make is_aer_internal_error() non-static to allow for the 2 different CXL topology error model implementations (RCH and VH) to share this helper. Signed-off-by: Terry Bowman Link: https://patch.msgid.link/20260114182055.46029-11-terry.bowman@amd.com Acked-by: Bjorn Helgaas Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 6dc5fe212e74e6880a1da0093f627387d0a658bb Author: Terry Bowman Date: Wed Jan 14 12:20:30 2026 -0600 PCI/AER: Export pci_aer_unmask_internal_errors() Internal PCIe errors are not enabled by default during initialization because their behavior is too device-specific and there is no standard way to reason about them. However, for CXL an internal error is the standard mechanism for conveying CXL protocol errors. Export pci_aer_unmask_internal_errors() for CXL, but make it clear that they are only meant for CXL and the status quo for leaving them masked for PCIe in general remains. Signed-off-by: Terry Bowman Reviewed-by: Dave Jiang Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260114182055.46029-10-terry.bowman@amd.com Co-developed-by: Dan Williams Signed-off-by: Dan Williams Acked-by: Bjorn Helgaas Signed-off-by: Dave Jiang commit 0ff60f2ec3e4043a442e805f80f8a2445113ec8f Author: Terry Bowman Date: Wed Jan 14 12:20:29 2026 -0600 cxl/pci: Move CXL driver's RCH error handling into core/ras_rch.c Restricted CXL Host (RCH) protocol error handling uses a procedure distinct from the CXL Virtual Hierarchy (VH) handling. This is because of the differences in the RCH and VH topologies. Improve the maintainability and add ability to enable/disable RCH handling. Move and combine the RCH handling code into a single block conditionally compiled with the CONFIG_CXL_RCH_RAS kernel config. Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260114182055.46029-9-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit d18f1b7beadf1af1cd334ff789ba5a07ce285bbc Author: Dan Williams Date: Wed Jan 14 12:20:34 2026 -0600 PCI/AER: Replace PCIEAER_CXL symbol with CXL_RAS One of the primary reasons for the CXL driver to exist is to perform error handling. If both PCIEAER and CXL are enabled then light up CXL error handling as well. Now that all RAS handling is moved under the CXL_RAS symbol, drop the previous PCIEAER_CXL symbol. Reviewed-by: Terry Bowman Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260114182055.46029-14-terry.bowman@amd.com Acked-by: Bjorn Helgaas Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 086d030e99d25b27d89ab62c8509db7626bdcc48 Author: Pavan Kumar Linga Date: Wed Nov 12 16:41:43 2025 -0800 idpf: generalize mailbox API Add a control queue parameter to all mailbox APIs in order to make use of those APIs for non-default mailbox as well. Signed-off-by: Anton Nadezhdin Reviewed-by: Madhu Chittim Signed-off-by: Pavan Kumar Linga Signed-off-by: Joshua Hay Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 822cd0923344f03bb568f8a675fd1b955f9e858c Author: Pavan Kumar Linga Date: Wed Nov 12 16:41:42 2025 -0800 idpf: avoid calling get_rx_ptypes for each vport RX ptypes received from device control plane doesn't depend on vport info, but might vary based on the queue model. When the driver requests for ptypes, control plane fills both ptype_id_10 (used for splitq) and ptype_id_8 (used for singleq) fields of the virtchnl2_ptype response structure. This allows to call get_rx_ptypes once at the adapter level instead of each vport. Parse and store the received ptypes of both splitq and singleq in a separate lookup table. Respective lookup table is used based on the queue model info. As part of the changes, pull the ptype protocol parsing code into a separate function. Reviewed-by: Madhu Chittim Signed-off-by: Pavan Kumar Linga Signed-off-by: Joshua Hay Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 601643400bbb6bd89b958a929667974766c10250 Author: Pavan Kumar Linga Date: Wed Nov 12 16:41:41 2025 -0800 idpf: generalize send virtchnl message API With the previous refactor of passing idpf resource pointer, all of the virtchnl send message functions do not require full vport structure. Those functions can be generalized to be able to use for configuring vport independent queues. Signed-off-by: Anton Nadezhdin Reviewed-by: Madhu Chittim Signed-off-by: Pavan Kumar Linga Signed-off-by: Joshua Hay Signed-off-by: Tony Nguyen commit 9ad94c235aa65f81e32c5762f24e118565c93105 Author: Joshua Hay Date: Wed Nov 12 16:41:40 2025 -0800 idpf: remove vport pointer from queue sets Replace vport pointer in queue sets struct with adapter backpointer and vport_id as those are the primary fields necessary for virtchnl communication. Otherwise, pass the vport pointer as a separate parameter where available. Also move xdp_txq_offset to queue vector resource struct since we no longer have the vport pointer. Reviewed-by: Madhu Chittim Signed-off-by: Joshua Hay Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit cfa7029a25000f4e09e3a69bb9510f73dd1dbe3f Author: Pavan Kumar Linga Date: Wed Nov 12 16:41:39 2025 -0800 idpf: add rss_data field to RSS function parameters Retrieve rss_data field of vport just once and pass it to RSS related functions instead of retrieving it in each function. While at it, update s/rss/RSS in the RSS function doc comments. Reviewed-by: Anton Nadezhdin Signed-off-by: Pavan Kumar Linga Signed-off-by: Joshua Hay Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 47ee0543a45042b54f85a935ae2f1422b30028a9 Author: Pavan Kumar Linga Date: Wed Nov 12 16:41:38 2025 -0800 idpf: reshuffle idpf_vport struct members to avoid holes The previous refactor of moving queue and vector resources out of the idpf_vport structure, created few holes. Reshuffle the existing members to avoid holes as much as possible. Reviewed-by: Anton Nadezhdin Signed-off-by: Pavan Kumar Linga Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit f6892116be91bb9d70d31b1ce2474bde0a8c52f9 Author: Joshua Hay Date: Wed Nov 12 16:41:37 2025 -0800 idpf: move some iterator declarations inside for loops Move some iterator declarations to their respective for loops; use more appropriate unsigned type. Signed-off-by: Joshua Hay Reviewed-by: Madhu Chittim Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 502eccecce5fbcef9ea3b90957e2660dfb6c5dcc Author: Pavan Kumar Linga Date: Wed Nov 12 16:41:36 2025 -0800 idpf: move queue resources to idpf_q_vec_rsrc structure Move both TX and RX queue resources to the newly introduced idpf_q_vec_rsrc structure. Reviewed-by: Anton Nadezhdin Signed-off-by: Pavan Kumar Linga Signed-off-by: Joshua Hay Signed-off-by: Tony Nguyen commit d1061502f353d5e1a8937181b84b722e75fabf11 Author: Pavan Kumar Linga Date: Wed Nov 12 16:41:35 2025 -0800 idpf: introduce idpf_q_vec_rsrc struct and move vector resources to it To group all the vector and queue resources, introduce idpf_q_vec_rsrc structure. This helps to reuse the same config path functions by other features. For example, PTP implementation can use the existing config infrastructure to configure secondary mailbox by passing its queue and vector info. It also helps to avoid any duplication of code. Existing queue and vector resources are grouped as default resources. This patch moves vector info to the newly introduced structure. Following patch moves the queue resources. While at it, declare the loop iterator for 'num_q_vectors' in loop and use the correct type. Include idpf_q_vec_rsrc backpointer in idpf_alloc_queue_set along with vport. Reviewed-by: Anton Nadezhdin Signed-off-by: Pavan Kumar Linga Signed-off-by: Joshua Hay Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit d83d80347dea37e568ca9abf969ee909859a5a7d Author: Pavan Kumar Linga Date: Wed Nov 12 16:41:34 2025 -0800 idpf: introduce local idpf structure to store virtchnl queue chunks Queue ID and register info received from device Control Plane is stored locally in the same little endian format. As the queue chunks are retrieved in 3 functions, lexx_to_cpu conversions are done each time. Instead introduce a new idpf structure to store the received queue info. It also avoids conditional check to retrieve queue chunks. With this change, there is no need to store the queue chunks in 'req_qs_chunks' field. So remove that. Suggested-by: Milena Olech Reviewed-by: Anton Nadezhdin Signed-off-by: Pavan Kumar Linga Reviewed-by: Aleksandr Loktionov Signed-off-by: Joshua Hay Signed-off-by: Tony Nguyen commit 7ff8b1d60881c5f97b5ae426e14d2822917d3b69 Author: Dave Jiang Date: Wed Jan 14 12:20:28 2026 -0600 cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c Create new config CONFIG_CXL_RAS and put all CXL RAS items behind the config. The config will depend on CPER and PCIE AER to build. Move the related VH RAS code from core/pci.c to core/ras.c. Restricted CXL host (RCH) RAS functions will be moved in a future patch. Cc: Robert Richter Reviewed-by: Joshua Hahn Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Reviewed-by: Alison Schofield Co-developed-by: Terry Bowman Signed-off-by: Terry Bowman Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260114182055.46029-8-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit bcfa289932a703dd189466ea5947212e8dddd399 Author: Terry Bowman Date: Wed Jan 14 12:20:27 2026 -0600 PCI: Replace cxl_error_is_native() with pcie_aer_is_native() The AER driver includes a CXL support function cxl_error_is_native(). This function adds no additional value from pcie_aer_is_native(). Simplify the codebase by removing cxl_error_is_native() and replace occurrences of cxl_error_is_native() with pcie_aer_is_native(). Signed-off-by: Terry Bowman Reviewed-by: Dan Williams Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/20260114182055.46029-7-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit eb78ef4d6f0e51243c1ee117f801dbc503e886ab Author: Terry Bowman Date: Wed Jan 14 12:20:26 2026 -0600 cxl/pci: Remove unnecessary CXL RCH handling helper functions cxl_handle_rdport_cor_ras() and cxl_handle_rdport_ras() are specific to Restricted CXL Host (RCH) handling. Improve readability and maintainability by replacing these and instead using the common cxl_handle_cor_ras() and cxl_handle_ras() functions. Signed-off-by: Terry Bowman Reviewed-by: Alejandro Lucero Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260114182055.46029-6-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit ca3d1a53e62093d17436abd447463da9c0f4e56b Author: Terry Bowman Date: Wed Jan 14 12:20:25 2026 -0600 cxl/pci: Remove unnecessary CXL Endpoint handling helper functions The CXL driver's cxl_handle_endpoint_cor_ras()/cxl_handle_endpoint_ras() are unnecessary helper functions used only for Endpoints. Remove these functions as they are not common for all CXL devices and do not provide value for EP handling. Rename __cxl_handle_ras to cxl_handle_ras() and __cxl_handle_cor_ras() to cxl_handle_cor_ras(). Signed-off-by: Terry Bowman Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Tested-by: Joshua Hahn Reviewed-by: Dan Williams Link: https://patch.msgid.link/20260114182055.46029-5-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 7c29ba02210c6e4570cdce53813a1ae68fb6d049 Author: Terry Bowman Date: Wed Jan 14 12:20:24 2026 -0600 PCI: Introduce pcie_is_cxl() CXL is a protocol that runs on top of PCIe electricals. Its error model also runs on top of the PCIe AER error model by standardizing "internal" errors as "CXL" errors. Linux has historically ignored internal errors. CXL protocol error handling is then a task of enhancing the PCIe AER core to understand that PCIe ports (upstream and downstream) and endpoints may throw internal errors that represent standard CXL protocol errors. The proposed method to make that determination is to teach 'struct pci_dev' to cache when its link has trained the CXL.mem and/or CXL.cache protocols and then treat all internal errors as CXL errors. A design goal is to not burden the PCIe AER core with CXL knowledge beyond just enough to forward error notifications to the CXL RAS core. The forwarded notification looks up a 'struct cxl_port' or 'struct cxl_dport' companion device to the PCI device. Introduce set_pcie_cxl() with logic checking for CXL.mem or CXL.cache status in the CXL Flex Bus DVSEC status register. The CXL Flex Bus DVSEC presence is used because it is required for all the CXL PCIe devices.[1] [1] CXL 3.1 Spec, 8.1.1 PCIe Designated Vendor-Specific Extended Capability (DVSEC) ID Assignment, Table 8-2 Signed-off-by: Terry Bowman Reviewed-by: Ira Weiny Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alejandro Lucero Reviewed-by: Ben Cheatham Reviewed-by: Dan Williams Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/20260114182055.46029-4-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 6612bd9ff0b1001cff5f5d79db6ce44427d2e99c Author: Terry Bowman Date: Wed Jan 14 12:20:23 2026 -0600 PCI: Update CXL DVSEC definitions CXL DVSEC definitions were recently moved into uapi/pci_regs.h, but the newly added macros do not follow the file's existing naming conventions. The current format uses CXL_DVSEC_XYZ, while the new CXL entries must instead use the PCI_DVSEC_CXL_XYZ prefix to match the conventions already established in pci_regs.h. The new CXL DVSEC macros also introduce _MASK and _OFFSET suffixes, which are not used anywhere else in the file. These suffixes lengthen the identifiers and reduce readability. Remove _MASK and _OFFSET from the recently added definitions. Additionally, remove PCI_DVSEC_HEADER1_LENGTH, as it duplicates the existing PCI_DVSEC_HEADER1_LEN() macro. Update all existing references to use the new macro names. Finally, update the inline documentation to reference the latest revision of the CXL specification. Signed-off-by: Terry Bowman Reviewed-by: Dan Williams Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/20260114182055.46029-3-terry.bowman@amd.com Signed-off-by: Dan Williams Signed-off-by: Dave Jiang commit 0f7afd80d81b739c4a9a6e4e24109ba1030c9c56 Author: Terry Bowman Date: Wed Jan 14 12:20:22 2026 -0600 PCI: Move CXL DVSEC definitions into uapi/linux/pci_regs.h The CXL DVSECs are currently defined in cxl/core/cxlpci.h. These are not accessible to other subsystems. Move these to uapi/linux/pci_regs.h. The CXL DVSEC definitions will be renamed and reformatted to fit better with existing defines. Signed-off-by: Terry Bowman Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Dan Williams Signed-off-by: Dan Williams Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/20260114182055.46029-2-terry.bowman@amd.com Signed-off-by: Dave Jiang commit 56f79097105712521f5996238f8944c9215d7c4c Merge: 2064fe4b8fe0c9 7799ba2160e491 Author: Rafael J. Wysocki Date: Thu Jan 22 21:53:51 2026 +0100 Merge tag 'linux-cpupower-6.20-update-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull one more cpuidle utility update for 6.20 from Shuah Khan: "Improve the installation procedure by making this systemd step optional enabling users to disable installation of systemd's unit file." * tag 'linux-cpupower-6.20-update-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: make systemd unit installation optional commit b010880b9936da14f8035585ab57577aa05be23a Author: Svyatoslav Ryhel Date: Thu Jan 22 17:34:25 2026 +0200 drivers: iio: mpu3050: use dev_err_probe for regulator request Regulator requesting may result in deferred probing error which will abort driver probing. To avoid this just use dev_err_probe which handles deferred probing. Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope") Signed-off-by: Svyatoslav Ryhel Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 6939484a425a87d3d8fd168f721d9cf8a0fa86dd Author: Francesco Lavra Date: Mon Jan 19 11:23:17 2026 +0100 iio: accel: adxl380: Optimize reading of FIFO entries in interrupt handler In order to minimize the time required for transferring FIFO data from the sensor to the host machine, perform the read from the FIFO in a single call to regmap_noinc_read(). This allows reading acceleration data for all 3 axes at 16 kHz sampling frequency using a 1MHz I2C bus frequency. Signed-off-by: Francesco Lavra Signed-off-by: Jonathan Cameron commit c1b14015224cfcccd5356333763f2f4f401bd810 Author: Francesco Lavra Date: Mon Jan 19 11:23:16 2026 +0100 iio: accel: adxl380: Avoid reading more entries than present in FIFO The interrupt handler reads FIFO entries in batches of N samples, where N is the number of scan elements that have been enabled. However, the sensor fills the FIFO one sample at a time, even when more than one channel is enabled. Therefore,the number of entries reported by the FIFO status registers may not be a multiple of N; if this number is not a multiple, the number of entries read from the FIFO may exceed the number of entries actually present. To fix the above issue, round down the number of FIFO entries read from the status registers so that it is always a multiple of N. Fixes: df36de13677a ("iio: accel: add ADXL380 driver") Signed-off-by: Francesco Lavra Cc: Signed-off-by: Jonathan Cameron commit b0913a44a9ae02f498682e6010b57f773e44f845 Author: Petre Rodan Date: Sun Jan 18 13:19:39 2026 +0200 iio: pressure: mprls0025pa: remove error message Do not print a duplicate error message if devm_request_irq() fails. Signed-off-by: Petre Rodan Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit ff085189cb1703b3be8176310545afbe544cd1f4 Author: Jonathan Santos Date: Wed Jan 14 06:27:29 2026 -0300 iio: adc: ad7768-1: add support for ADAQ776x-1 ADC Family Add support for ADAQ7767/68/69-1 series, which includes PGIA and Anti-aliasing filter (AAF) gains. Unlike the AD7768-1, they do not provide a VCM regulator interface. The PGA gain is configured in run-time through the scale attribute, if supported by the device. PGA is controlled by GPIOs provided in the device tree. The AAF gain is defined by hardware connections and should be specified in the device tree. Signed-off-by: Jonathan Santos Signed-off-by: Jonathan Cameron commit e7b0312c60a67431ad249b95c624b98fa782f33f Author: Jonathan Santos Date: Wed Jan 14 06:27:14 2026 -0300 iio: adc: ad7768-1: refactor ad7768_write_raw() Squash __ad7768_write_raw() back to ad7768_write_raw() to allow the addition of new attributes without requiring a direct mode claim. Signed-off-by: Jonathan Santos Signed-off-by: Jonathan Cameron commit 404a3b4c36f2e1987ff28d1d61d309292d2e33cb Author: Jonathan Santos Date: Wed Jan 14 06:27:03 2026 -0300 units: add conversion macros for percentage related units Add macros to convert between ratio and percentage related units, including percent (1/100), permille (1/1,000), permyriad (1/10,000, also equivalent to one Basis point) and per cent mille (1/100,000). Those are Used for precise fractional calculations in engineering, finance, and measurement applications. Signed-off-by: Jonathan Santos Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit fa087f5babbc24db76d5b24073216fa2d7d7b57d Author: Jonathan Santos Date: Wed Jan 14 06:26:52 2026 -0300 iio: adc: ad7768-1: introduce chip info for future multidevice support Add Chip info struct in SPI device to store channel information for each supported part. Signed-off-by: Jonathan Santos Signed-off-by: Jonathan Cameron commit 2f55ae3a891e3fea38327a7abb2c1f3679e8543a Author: Jonathan Santos Date: Wed Jan 14 06:26:39 2026 -0300 dt-bindings: iio: adc: ad7768-1: add new supported parts Add compatibles for supported parts in the ad7768-1 family: ADAQ7767-1, ADAQ7768-1 and ADAQ7769-1 Add property and checks for AFF gain, supported by ADAQ7767-1 and ADAQ7769-1, and for PGA gain, supported by ADAQ7768-1 and ADAQ7769-1: adi,aaf-gain-bp pga-gpios Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jonathan Santos Signed-off-by: Jonathan Cameron commit 8284a498541623414abc616450371b08f24a4aac Author: Kurt Borja Date: Tue Jan 20 01:20:47 2026 -0500 iio: light: opt4060: Use IIO cleanup helpers Use IIO_DEV_GUARD_CURRENT_MODE() cleanup helper to simplify and drop busy-waiting code in opt4060_set_driver_state(). Reviewed-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Kurt Borja Signed-off-by: Jonathan Cameron commit 421ac0c231cd66bd8cd7fea6a7b79a59ea2f7f1a Author: Kurt Borja Date: Tue Jan 20 01:20:46 2026 -0500 iio: health: max30102: Use IIO cleanup helpers Use IIO_DEV_GUARD_CURRENT_MODE() cleanup helper to simplify and drop busy-waiting code in max30102_read_raw(). Reviewed-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Kurt Borja Signed-off-by: Jonathan Cameron commit 6a3fe0fc9e623352ccf65650cb31c4309f853d1d Author: Kurt Borja Date: Tue Jan 20 01:20:45 2026 -0500 iio: light: vcnl4000: Use IIO cleanup helpers Use IIO_DEV_ACQUIRE_DIRECT_MODE() helper to automatically release direct mode. Reviewed-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Kurt Borja Signed-off-by: Jonathan Cameron commit 7a38b75da1dc38a8cd9563c41b87367b2475b975 Author: Kurt Borja Date: Tue Jan 20 01:20:44 2026 -0500 iio: core: Add cleanup.h support for iio_device_claim_*() Add guard classes for iio_device_claim_*() conditional locks. This will aid drivers write safer and cleaner code when dealing with some common patterns. These classes are not meant to be used directly by drivers (hence the __priv__ prefix). Instead, documented wrapper macros are provided to enforce the use of ACQUIRE() or guard() semantics and avoid the problematic scoped guard. Suggested-by: Andy Shevchenko Reviewed-by: David Lechner Reviewed-by: Nuno Sá Acked-by: Andy Shevchenko Signed-off-by: Kurt Borja Signed-off-by: Jonathan Cameron commit 2daee817df13fb539be01a6a8094d52667d402f6 Author: Kurt Borja Date: Tue Jan 20 01:20:43 2026 -0500 iio: core: Match iio_device_claim_*() semantics and implementation Implement iio_device_claim_buffer_mode() fully inline with the use of __iio_dev_mode_lock(), which takes care of sparse annotations. To completely match iio_device_claim_direct() semantics, we need to also change iio_device_claim_buffer_mode() return semantics to usual true/false conditional lock semantics. Additionally, to avoid silently breaking out-of-tree drivers, rename iio_device_claim_buffer_mode() to iio_device_claim_try_buffer_mode(). Reviewed-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Kurt Borja Signed-off-by: Jonathan Cameron commit c37ec9d507966a827913f42e06179e3475a00181 Author: Kurt Borja Date: Tue Jan 20 01:20:42 2026 -0500 iio: core: Refactor iio_device_claim_direct() implementation In order to eventually unify the locking API, implement iio_device_claim_direct() fully inline, with the use of __iio_dev_mode_lock(), which takes care of sparse annotations. Reviewed-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Kurt Borja Signed-off-by: Jonathan Cameron commit 88fd1f90792411226f49e5f285bf3faca5ac970b Author: Kurt Borja Date: Tue Jan 20 01:20:41 2026 -0500 iio: core: Add and export __iio_dev_mode_lock() Add unconditional wrappers around the internal IIO mode lock. As mentioned in the documentation, this is not meant to be used by drivers, instead this will aid in the eventual addition of cleanup classes around conditional locks. Reviewed-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Kurt Borja Signed-off-by: Jonathan Cameron commit 4296b1fb54d65906911e677a0eb33471c626e799 Merge: e559c864146070 8564f88df20203 Author: Jonathan Cameron Date: Thu Jan 22 20:52:15 2026 +0000 Merge remote-tracking branch 'i3c/ib-i3c-iio-v6.20' into togreg Needed for some stubs to prevent build issues if !CONFIG_I3C commit e559c864146070905ce7bc6da1e9d269232d609b Author: Jonathan Cameron Date: Mon Jan 19 21:48:16 2026 +0000 iio: magn: mmc5633: Ensure REGMAP_I2C / I3C not build if I2C / I3C is not. Fixes the following build warning (and equivalent I2C one) WARNING: unmet direct dependencies detected for REGMAP_I3C Depends on [n]: I3C [=n] Selected by [m]: - MMC5633 [=m] && IIO [=y] && (I2C [=y] || I3C [=n]) Fixes: 6e5f6bf2e3f0 ("iio: magnetometer: Add mmc5633 sensor") Reviewed-by: Frank Li Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit a02d46be8aec5e3daea8033446f93ea4bab1ed62 Author: Jonathan Cameron Date: Mon Jan 19 21:28:04 2026 +0000 iio: adc: ad4062: Switch from struct i3c_priv_xfer to struct i3c_xfer Commit 9904232ae30bc ("i3c: drop i3c_priv_xfer and i3c_device_do_priv_xfers()") currently in the i3c/for-next tree removes the deprecated struct i3c_priv_xfer and i3c_device_do_priv_xfers(). Switch to struct i3c_xfer and i3c_device_do_xfers(..., I3C_SDR) now rather causing a build issue when both trees are merged. Suggested-by: Sasha Levin Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 64a506fb7c531651ccbdc78a3e0abc96f35e8be3 Author: Rafael J. Wysocki Date: Tue Jan 13 14:38:41 2026 +0100 ACPI: PM: Adjust messages regarding postponed ACPI PM The debug messages added by commit f7599be2bb76 ("ACPI: PM: postpone bringing devices to D0 unless we need them") in acpi_subsys_resume_early() and acpi_subsys_resume() are not quite accurate because what is postponed is not just a transition to D0, but also an adjustment of the device's wakeup setting (which may involve disabling a GPE among other things). Moreover, these messages don't even mention ACPI. Rephrase them and adjust the style to match other messages in device_pm.c. Signed-off-by: Rafael J. Wysocki Reviewed-by: Dmitry Torokhov Link: https://patch.msgid.link/5969819.DvuYhMxLoT@rafael.j.wysocki commit de69a0875324c72b9fc78503f6852ea1e380f5f7 Author: Gergo Koteles Date: Fri Jan 9 01:16:19 2026 +0100 ACPI: x86: s2idle: Remove dead code in lps0_device_attach() The rev_id is always 0 for AMD since commit e32d546483a2 ("ACPI: x86: Drop quirk for HP Elitebook"), so this condition will never be true. Remove the dead code. Signed-off-by: Gergo Koteles Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20260109001619.37532-1-soyer@irl.hu Signed-off-by: Rafael J. Wysocki commit 0e841d1d561376828ea9ecdf7d591f491046924c Author: Gabor Juhos Date: Thu Jan 22 20:34:23 2026 +0100 interconnect: qcom: msm8974: drop duplicated RPM_BUS_{MASTER,SLAVE}_REQ defines Both the RPM_BUS_MASTER_REQ and the RPM_BUS_SLAVE_REQ constants are also defined in the 'icc-rpm.h' header. $ git grep -nHE 'define[[:blank:]]+RPM_BUS_MASTER_REQ[[:blank:]]' drivers/interconnect/qcom/icc-rpm.h:16:#define RPM_BUS_MASTER_REQ 0x73616d62 drivers/interconnect/qcom/msm8974.c:176:#define RPM_BUS_MASTER_REQ 0x73616d62 $ git grep -nHE 'define[[:blank:]]+RPM_BUS_SLAVE_REQ[[:blank:]]' drivers/interconnect/qcom/icc-rpm.h:17:#define RPM_BUS_SLAVE_REQ 0x766c7362 drivers/interconnect/qcom/msm8974.c:177:#define RPM_BUS_SLAVE_REQ 0x766c7362 Drop the local defines to avoid the duplications. No functional changes intended. Compile tested only. Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260122-icc-qcom-dupe-defines-v1-2-eea876c2d98f@gmail.com Signed-off-by: Georgi Djakov commit 35bf070bb53c88794772336da759b55447106de4 Author: Gabor Juhos Date: Thu Jan 22 20:34:22 2026 +0100 interconnect: qcom: smd-rpm: drop duplicated QCOM_RPM_SMD_KEY_RATE define The 'linux/soc/qcom/smd-rpm.h' header defines QCOM_RPM_SMD_KEY_RATE with the exact same value. $ git grep -nHE 'define[[:blank:]]+QCOM_RPM_SMD_KEY_RATE[[:blank:]]' drivers/interconnect/qcom/smd-rpm.c:17:#define QCOM_RPM_SMD_KEY_RATE 0x007a484b include/linux/soc/qcom/smd-rpm.h:52:#define QCOM_RPM_SMD_KEY_RATE 0x007a484b Drop the local define to avoid the duplication. No functional changes intended. Compile tested only. Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260122-icc-qcom-dupe-defines-v1-1-eea876c2d98f@gmail.com Signed-off-by: Georgi Djakov commit 51c0996dadaea20d73eb0495aeda9cb0422243e8 Author: Brian Norris Date: Thu Jan 22 09:48:15 2026 -0800 PCI/PM: Prevent runtime suspend until devices are fully initialized Previously, it was possible for a PCI device to be runtime-suspended before it was fully initialized. When that happened, the suspend process could save invalid device state, for example, before BAR assignment. Restoring the invalid state during resume may leave the device non-functional. Prevent runtime suspend for PCI devices until they are fully initialized by deferring pm_runtime_enable(). More details on how exactly this may occur: 1. PCI device is created by pci_scan_slot() or similar 2. As part of pci_scan_slot(), pci_pm_init() puts the device in D0 and prevents runtime suspend prevented via pm_runtime_forbid() 3. pci_device_add() adds the underlying 'struct device' via device_add(), which means user space can allow runtime suspend, e.g., echo auto > /sys/bus/pci/devices/.../power/control 4. PCI device receives BAR configuration (pci_assign_unassigned_bus_resources(), etc.) 5. pci_bus_add_device() applies final fixups, saves device state, and tries to attach a driver The device may potentially be suspended between #3 and #5, so this is racy with user space (udev or similar). Many PCI devices are enumerated at subsys_initcall time and so will not race with user space, but devices created later by hotplug or modular pwrctrl or host controller drivers are susceptible to this race. More runtime PM details at the first Link: below. Link: https://lore.kernel.org/all/0e35a4e1-894a-47c1-9528-fc5ffbafd9e2@samsung.com/ Signed-off-by: Brian Norris [bhelgaas: update comments per https://lore.kernel.org/r/CAJZ5v0iBNOmMtqfqEbrYyuK2u+2J2+zZ-iQd1FvyCPjdvU2TJg@mail.gmail.com] Signed-off-by: Bjorn Helgaas Tested-by: Marek Szyprowski Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260122094815.v5.1.I60a53c170a8596661883bd2b4ef475155c7aa72b@changeid commit 46c56b737161060dfa468f25ae699749047902a2 Author: Shawn Lin Date: Mon Jan 5 16:15:29 2026 +0800 arm64: dts: rockchip: Fix rk3588 PCIe range mappings The pcie bus address should be mapped 1:1 to the cpu side MMIO address, so that there is no same address allocated from normal system memory. Otherwise it's broken if the same address assigned to the EP for DMA purpose.Fix it to sync with the vendor BSP. Fixes: 0acf4fa7f187 ("arm64: dts: rockchip: add PCIe3 support for rk3588") Fixes: 8d81b77f4c49 ("arm64: dts: rockchip: add rk3588 PCIe2 support") Cc: stable@vger.kernel.org Cc: Sebastian Reichel Signed-off-by: Shawn Lin Link: https://patch.msgid.link/1767600929-195341-2-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Heiko Stuebner commit f63ea193a404481f080ca2958f73e9f364682db9 Author: Shawn Lin Date: Mon Jan 5 16:15:28 2026 +0800 arm64: dts: rockchip: Fix rk356x PCIe range mappings The pcie bus address should be mapped 1:1 to the cpu side MMIO address, so that there is no same address allocated from normal system memory. Otherwise it's broken if the same address assigned to the EP for DMA purpose.Fix it to sync with the vendor BSP. Fixes: 568a67e742df ("arm64: dts: rockchip: Fix rk356x PCIe register and range mappings") Fixes: 66b51ea7d70f ("arm64: dts: rockchip: Add rk3568 PCIe2x1 controller") Cc: stable@vger.kernel.org Cc: Andrew Powers-Holmes Signed-off-by: Shawn Lin Link: https://patch.msgid.link/1767600929-195341-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Heiko Stuebner commit 9e3f8ae040009f66367b2ba1081b7e313b39aeff Author: Chris Morgan Date: Tue Jan 13 13:57:21 2026 -0600 arm64: dts: rockchip: Add Anbernic RG-DS Add device tree for the Anbernic RG-DS, based on the Rockchip RK3568. All hardware is currently working except for the accelerometer, the speaker output, and one of the two battery gauges. A bug in the Rockchip VOP2 driver is currently causing the device to pause for 30 seconds at boot and is being investigated. The Anbernic RG-DS includes the following (supported) hardware: - 2 640x480 DSI display screens with touch. - 21 buttons. - 2 Analog joysticks. - 3 LEDs (red and green LED share the same housing). - 32GB eMMC, 1 SDMMC slot. - RTL8821CS WiFi/Bluetooth combo - 1 USB 2.0 port in host mode, 1 USB 2.0 port in peripheral mode. - 3.5mm headphone jack with play button support. - 4000mAH battery The following hardware has incomplete driver support and is not yet working: - An Invensense icm42607p accelerometer. - Two Awinic aw87391 speaker amplifiers. - A Cellwise cw2015 battery monitor, which appears to conflict with the rk817 charger driver at the moment. Co-developed-by: Alexander Weinzerl Signed-off-by: Alexander Weinzerl Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20260113195721.151205-7-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 3c8399d31c8eb10aa34bccec1f49b51694e67b00 Author: Chris Morgan Date: Tue Jan 13 13:57:20 2026 -0600 dt-bindings: input: touchscreen: goodix: Add "panel" property Add a "panel" property to define a relationship between a touchscreen and an associated panel when more than one of each exist in a device. Signed-off-by: Chris Morgan Acked-by: Dmitry Torokhov Acked-by: Rob Herring (Arm) [picked with the rest with Dmitry's Ack] Link: https://patch.msgid.link/20260113195721.151205-6-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 84f42966b80eaec59349c7b474ebd6b0943731e4 Author: Chris Morgan Date: Tue Jan 13 13:57:19 2026 -0600 dt-bindings: arm: rockchip: Add Anbernic RG-DS Add compatible string for the Anbernic RG-DS. Signed-off-by: Chris Morgan Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260113195721.151205-5-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 79a3286e61829fc43abdd6e3beb31b24930c7af6 Author: Alexey Charkov Date: Wed Jan 21 11:42:13 2026 +0400 arm64: dts: rockchip: Explicitly request UFS reset pin on RK3576 Rockchip RK3576 UFS controller uses a dedicated pin to reset the connected UFS device, which can operate either in a hardware controlled mode or as a GPIO pin. Power-on default is GPIO mode, but the boot ROM reconfigures it to a hardware controlled mode if it uses UFS to load the next boot stage. Given that existing bindings (and rk3576.dtsi) expect a GPIO-controlled device reset, request the required pin config explicitly. The pin is requested with pull-down enabled, which is in line with the SoC power-on default and helps ensure that the attached UFS chip stays in reset until the driver takes over the control of the respective GPIO line. This doesn't appear to affect Linux, but it does affect U-boot: Before: => md.l 0x2604b398 2604b398: 00000011 00000000 00000000 00000000 ................ < ... snip ... > => ufs init ufshcd-rockchip ufshc@2a2d0000: [RX, TX]: gear=[3, 3], lane[2, 2], pwr[FASTAUTO_MODE, FASTAUTO_MODE], rate = 2 => md.l 0x2604b398 2604b398: 00000011 00000000 00000000 00000000 ................ After: => md.l 0x2604b398 2604b398: 00000011 00000000 00000000 00000000 ................ < ... snip ...> => ufs init ufshcd-rockchip ufshc@2a2d0000: [RX, TX]: gear=[3, 3], lane[2, 2], pwr[FASTAUTO_MODE, FASTAUTO_MODE], rate = 2 => md.l 0x2604b398 2604b398: 00000010 00000000 00000000 00000000 ................ (0x2604b398 is the respective pin mux register, with its BIT0 driving the mode of UFS_RST: unset = GPIO, set = hardware controlled UFS_RST) This helps ensure that GPIO-driven device reset actually fires when the system requests it, not when whatever black box magic inside the UFSHC decides to reset the flash chip. Cc: stable@vger.kernel.org Fixes: c75e5e010fef ("scsi: arm64: dts: rockchip: Add UFS support for RK3576 SoC") Reported-by: Quentin Schulz Reviewed-by: Quentin Schulz Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20260121-ufs-rst-v3-1-35839bcb4ca7@gmail.com Signed-off-by: Heiko Stuebner commit f1ebfaeee3200b0d12f5f2079c429f0eb1512a79 Author: Andreas Kemnade Date: Wed Jan 21 11:22:37 2026 +0100 arm64: dts: rockchip: Add TPS65185 for PineNote As the TPS65185 driver is now upsteram, add it to the PineNote devietrees. This is based on https://ayakael.net/forge/linux-pinenote but modified to the binding requirements. Without any other out-of-tree materials applied, this enables the hwmon temperature reporting and the interrupt counter increments by one per reading. Signed-off-by: Andreas Kemnade Link: https://patch.msgid.link/20260121-rk-tps-v1-1-bc867e1dd200@kemnade.info Signed-off-by: Heiko Stuebner commit de715325cc47b5a699019b6071620be8da5df146 Author: Frederic Weisbecker Date: Mon Aug 25 18:01:58 2025 +0200 cpu: Revert "cpu/hotplug: Prevent self deadlock on CPU hot-unplug" 1) The commit: 2b8272ff4a70 ("cpu/hotplug: Prevent self deadlock on CPU hot-unplug") was added to fix an issue where the hotplug control task (BP) was throttled between CPUHP_AP_IDLE_DEAD and CPUHP_HRTIMERS_PREPARE waiting in the hrtimer blindspot for the bandwidth callback queued in the dead CPU. 2) Later on, the commit: 38685e2a0476 ("cpu/hotplug: Don't offline the last non-isolated CPU") plugged on the target selection for the workqueue offloaded CPU down process to prevent from destroying the last CPU domain. 3) Finally: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") removed entirely the conditions for the race exposed and partially fixed in 1). The offloading of the CPU down process to a workqueue on another CPU then becomes unnecessary. But the last CPU belonging to scheduler domains must still remain online. Therefore revert the now obsolete commit 2b8272ff4a70b866106ae13c36be7ecbef5d5da2 and move the housekeeping check under the cpu_hotplug_lock write held. Since HK_TYPE_DOMAIN will include both isolcpus and cpuset isolated partition, the hotplug lock will synchronize against concurrent cpuset partition updates. Signed-off-by: Frederic Weisbecker Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Waiman Long commit 608fedd2f303c30fdfbc948112c4281f46fc028a Author: Frederic Weisbecker Date: Wed May 14 16:47:19 2025 +0200 PCI: Prepare to protect against concurrent isolated cpuset change HK_TYPE_DOMAIN will soon integrate cpuset isolated partitions and therefore be made modifiable at runtime. Synchronize against the cpumask update using RCU. The RCU locked section includes both the housekeeping CPU target election for the PCI probe work and the work enqueue. This way the housekeeping update side will simply need to flush the pending related works after updating the housekeeping mask in order to make sure that no PCI work ever executes on an isolated CPU. This part will be handled in a subsequent patch. Signed-off-by: Frederic Weisbecker Acked-by: Bjorn Helgaas Cc: linux-pci@vger.kernel.org Cc: Marco Crivellari Cc: Michal Hocko Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Cc: Vlastimil Babka Cc: Waiman Long commit 1412482b714358ffa30d38fd3dd0b05795163648 Author: Alex Deucher Date: Wed Jan 21 18:10:04 2026 -0500 Revert "drm/amd/display: pause the workload setting in dm" This reverts commit bc6d54ac7e7436721a19443265f971f890c13cc5. The workload profile needs to be in the default state when the dc idle optimizaion state is entered. However, when jobs come in for video or GFX or compute, the profile may be set to a non-default profile resulting in the dc idle optimizations not taking affect and resulting in higher power usage. As such we need to pause the workload profile changes during this transition. When this patch was originally committed, it caused a regression with a Dell U3224KB display, but no other problems were reported at the time. When it was reapplied (this patch) to address increased power usage, it seems to have caused additional regressions. This change seems to have a number of side affects (audio issues, stuttering, etc.). I suspect the pause should only happen when all displays are off or in static screen mode, but I think this call site gets called more often than that which results in idle state entry more often than intended. For now revert. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4894 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4717 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4725 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4517 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4806 Cc: Yang Wang Cc: Kenneth Feng Cc: Roman Li Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 0105b0562a5ed6374f06e5cd4246a3f1311a65a0 Author: Jens Axboe Date: Thu Jan 22 08:40:19 2026 -0700 io_uring: split out CQ waiting code into wait.c Move the completion queue waiting and scheduling code out of io_uring.c into a dedicated wait.c file. This further removes code out of the main io_uring C and header file, and into a topical new file. Signed-off-by: Jens Axboe commit 7642e668606009fcd3fe1fc161a79ef90403d507 Author: Jens Axboe Date: Thu Jan 22 08:55:45 2026 -0700 io_uring: split out task work code into tw.c Move the task work handling code out of io_uring.c into a new tw.c file. This includes the local work, normal work, and fallback work handling infrastructure. The associated tw.h header contains io_should_terminate_tw() as a static inline helper, along with the necessary function declarations. Signed-off-by: Jens Axboe commit 5599fa810b503eafc2bd8cd15bd45f35fc8ff6b9 Author: Pablo Neira Ayuso Date: Wed Jan 21 01:08:47 2026 +0100 netfilter: nft_set_rbtree: remove seqcount_rwlock_t After the conversion to binary search array, this is not required anymore. Remove it. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 2aa34191f06fc5af4f70241518a8554370d86054 Author: Pablo Neira Ayuso Date: Wed Jan 21 01:08:46 2026 +0100 netfilter: nft_set_rbtree: use binary search array in get command Rework .get interface to use the binary search array, this needs a specific lookup function to match on end intervals (<=). Packet path lookup is slight different because match is on lesser value, not equal (ie. <). After this patch, seqcount can be removed in a follow up patch. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 7e43e0a1141deec651a60109dab3690854107298 Author: Pablo Neira Ayuso Date: Wed Jan 21 01:08:45 2026 +0100 netfilter: nft_set_rbtree: translate rbtree to array for binary search The rbtree can temporarily store overlapping inactive elements during the transaction processing, leading to false negative lookups. To address this issue, this patch adds a .commit function that walks the the rbtree to build a array of intervals of ordered elements. This conversion compacts the two singleton elements that represent the start and the end of the interval into a single interval object for space efficient. Binary search is O(log n), similar to rbtree lookup time, therefore, performance number should be similar, and there is an implementation available under lib/bsearch.c and include/linux/bsearch.h that is used for this purpose. This slightly increases memory consumption for this new array that stores pointers to the start and the end of the interval. With this patch: # time nft -f 100k-intervals-set.nft real 0m4.218s user 0m3.544s sys 0m0.400s Without this patch: # time nft -f 100k-intervals-set.nft real 0m3.920s user 0m3.547s sys 0m0.276s With this patch, with IPv4 intervals: baseline rbtree (match on first field only): 15254954pps Without this patch: baseline rbtree (match on first field only): 10256119pps This provides a ~50% improvement in matching intervals from packet path. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit f175b46d9134f708358b5404730c6dfa200fbf3c Author: Pablo Neira Ayuso Date: Wed Jan 21 01:08:44 2026 +0100 netfilter: nf_tables: add .abort_skip_removal flag for set types The pipapo set backend is the only user of the .abort interface so far. To speed up pipapo abort path, removals are skipped. The follow up patch updates the rbtree to use to build an array of ordered elements, then use binary search. This needs a new .abort interface but, unlike pipapo, it also need to undo/remove elements. Add a flag and use it from the pipapo set backend. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 08a55792245a7bd395c947ff88b08b6abdd56f93 Author: Danilo Krummrich Date: Mon Jan 19 17:27:57 2026 +0100 driver-core: move devres_for_each_res() to base.h devres_for_each_res() is only used by .../firmware_loader/main.c, which already includes base.h. The usage of devres_for_each_res() by code outside of driver-core is questionable, hence move it to base.h. Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260119162920.77189-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 58d081ea4eab924b9e5a55cbb151bde847068c8d Author: Gao Xiang Date: Thu Jan 22 22:36:33 2026 +0800 erofs: tidy up erofs_init_inode_xattrs() Mainly get rid of the use of `struct erofs_xattr_iter`, as it is no longer needed now that meta buffers are used. This also simplifies the code and uses an early return when there are no xattrs. Signed-off-by: Gao Xiang commit a221a737406501c9036d00667095d61317d50d7f Author: Gao Xiang Date: Thu Jan 22 10:52:52 2026 +0800 erofs: add missing documentation about `directio` mount option Document the `directio` mount option for file-backed mounts, because recent users need this and this mount option has been available since commit 6422cde1b0d5 ("erofs: use buffered I/O for file-backed mounts by default") without proper documentation. Reported-by: Yuxuan Liu Signed-off-by: Gao Xiang commit cc831ab33644088c1eef78936de24701014d520a Author: Gao Xiang Date: Mon Jan 12 11:43:30 2026 +0800 erofs: tidy up synchronous decompression - Get rid of `sbi->opt.max_sync_decompress_pages` since it's fixed as 3 all the time; - Add Z_EROFS_MAX_SYNC_DECOMPRESS_BYTES in bytes instead of in pages, since for non-4K pages, 3-page limitation makes no sense; - Move `sync_decompress` to sbi to avoid unexpected remount impact; - Fold z_erofs_is_sync_decompress() into its caller; - Better description of sysfs entry `sync_decompress`. Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 06e5c340941fba1c7a2da95ee64d9cae6154bd6e Author: Ferry Meng Date: Mon Dec 29 18:05:15 2025 +0800 erofs: remove useless src in erofs_xattr_copy_to_buffer() Use it->kaddr directly. Signed-off-by: Ferry Meng Reviewed-by: Hongbo Li Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 7ed7a713f1267d14e737a935b662bffa4c667dc9 Author: Gao Xiang Date: Wed Dec 31 12:57:36 2025 +0800 erofs: unexport erofs_xattr_prefix() It can be simply in xattr.c due to no external users. Reviewed-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 09225312f2dbba4f084a16e544662f33f4dd035b Author: Gao Xiang Date: Mon Dec 29 17:29:48 2025 +0800 erofs: unexport erofs_getxattr() No external users other than those in xattr.c. Reviewed-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 3afa4da38802a4cba1c23848a32284e7e57b831b Author: Gao Xiang Date: Mon Dec 29 17:29:47 2025 +0800 erofs: fix incorrect early exits in volume label handling Crafted EROFS images containing valid volume labels can trigger incorrect early returns, leading to folio reference leaks. However, this does not cause system crashes or other severe issues. Fixes: 1cf12c717741 ("erofs: Add support for FS_IOC_GETFSLABEL") Cc: stable@kernel.org Reviewed-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 643575d5a4f24b23b0c54aa20aa74a4abed8ff5e Author: Gao Xiang Date: Mon Dec 29 17:29:46 2025 +0800 erofs: fix incorrect early exits for invalid metabox-enabled images Crafted EROFS images with metadata compression enabled can trigger incorrect early returns, leading to folio reference leaks. However, this does not cause system crashes or other severe issues. Fixes: 414091322c63 ("erofs: implement metadata compression") Cc: stable@kernel.org Reviewed-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 9aa64b62a73cbca226c0144dcf3cdf97294e0641 Author: Gao Xiang Date: Fri Dec 26 14:09:45 2025 +0800 erofs: avoid noisy messages for transient -ENOMEM EROFS may allocate temporary pages using GFP_NOWAIT | GFP_NORETRY when pcl->besteffort is off (e.g., for readahead requests). If the allocation fails, the original request will fall back to synchronous read, so the failure is transient. Such fallback can frequently happen in low memory scenarios, but since these failures are expected and temporary, avoid printing error messages like below: [ 7425.184264] erofs (device sr0): failed to decompress (lz4) -ENOMEM @ pa 148447232 size 28672 => 26788 [ 7426.244267] erofs (device sr0): failed to decompress (lz4) -ENOMEM @ pa 149422080 size 28672 => 15903 [ 7426.245508] erofs (device sr0): failed to decompress (lz4) -ENOMEM @ pa 138440704 size 28672 => 39294 ... [ 7504.258373] erofs (device sr0): failed to decompress (lz4) -ENOMEM @ pa 93581312 size 20480 => 47366 Fixes: 831faabed812 ("erofs: improve decompression error reporting") Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 48df6d1bc9d5e8d2d778c39d952c3d6cc39e5c73 Author: Gao Xiang Date: Fri Dec 19 14:43:36 2025 +0800 erofs: improve LZ4 error strings Just like what was done for other algorithms, let's propagate detailed error reasons for LZ4 instead of just -EFSCORRUPTED to users: "corrupted compressed data": the compressed data is malformed or destination buffer is not large enough "unexpected end of stream": the compressed stream ends normally, but without producing enough decompressed data. "compressed data start not found": can be returned by z_erofs_fixup_insize(). Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 43ac93b5432c4aa826a19be95737af53c0f5c1e1 Author: Yuwen Chen Date: Thu Dec 18 12:19:52 2025 +0800 erofs: simplify the code using for_each_set_bit When mounting the EROFS file system, it is necessary to check the available compression algorithms. At this time, the for_each_set_bit function can be used to simplify the code logic. Signed-off-by: Yuwen Chen Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 0cc7d0c926cc80151bdf803f3cb6f7476f648d73 Author: Ferry Meng Date: Tue Dec 16 16:21:41 2025 +0800 erofs: make z_erofs_crypto[] static Reduce the scope of 'z_erofs_crypto[]' that is not used outside of 'decompressor_crypto.c'. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512102025.4mWeBSsf-lkp@intel.com/ Signed-off-by: Ferry Meng Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 19bfef0178c64a6281a44687380b082e69215e06 Author: Ferry Meng Date: Mon Dec 8 17:31:38 2025 +0800 erofs: Use %pe format specifier for error pointers %pe will print a symbolic error name (e.g,. -ENOMEM), opposed to the raw errno (e.g,. -12) produced by PTR_ERR(). Signed-off-by: Ferry Meng Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 1309c52de15b6a4204e569ea1b181c4e9dc25927 Author: Mike Snitzer Date: Wed Jan 7 11:08:58 2026 -0500 NFS/localio: switch nfs_local_do_read and nfs_local_do_write to return void Both nfs_local_do_read and nfs_local_do_write only return 0 at the end, so switch them to returning void. Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit e72a73957613653f50375db1f3a3fbb907a9c40b Author: Mike Snitzer Date: Wed Jan 7 11:08:57 2026 -0500 NFS/localio: remove -EAGAIN handling in nfs_local_doio() Handling -EAGAIN in nfs_local_doio() was introduced with commit 0978e5b85fc08 (nfs_do_local_{read,write} were made to have negative checks for correspoding iter method) but commit e43e9a3a3d66 since eliminated the possibility for this -EAGAIN early return. So remove nfs_local_doio()'s -EAGAIN handling that calls nfs_localio_disable_client() -- while it should never happen from nfs_do_local_{read,write} this particular -EAGAIN handling is now "dead" and so it has become a liability. Fixes: e43e9a3a3d66 ("nfs/localio: refactor iocb initialization") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 9bb0060f7860aa4561c5b21163dd45ceb66946a9 Author: Mike Snitzer Date: Wed Jan 7 11:08:56 2026 -0500 NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit nfslocaliod_workqueue is a non-memreclaim workqueue (it isn't initialized with WQ_MEM_RECLAIM), see commit b9f5dd57f4a5 ("nfs/localio: use dedicated workqueues for filesystem read and write"). Use nfslocaliod_workqueue for LOCALIO's SYNC work. Also, set PF_LOCAL_THROTTLE | PF_MEMALLOC_NOIO in nfs_local_fsync_work. Fixes: b9f5dd57f4a5 ("nfs/localio: use dedicated workqueues for filesystem read and write") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 67435d2d8a33a75f9647724952cb1b18279d2e95 Author: Mike Snitzer Date: Wed Jan 7 11:08:55 2026 -0500 NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages LOCALIO is an NFS loopback mount optimization that avoids using the network for READ, WRITE and COMMIT if the NFS client and server are determined to be on the same system. But because LOCALIO is still fundamentally "just NFS loopback mount" it is susceptible to recursion deadlock via direct reclaim, e.g.: NFS LOCALIO down to XFS and then back into NFS via nfs_writepages. Fix LOCALIO's potential for direct reclaim deadlock by ensuring that all its page cache allocations are done from GFP_NOFS context. Thanks to Ben Coddington for pointing out commit ad22c7a043c2 ("xfs: prevent stack overflows from page cache allocation"). Reported-by: John Cagle Tested-by: Allen Lu Suggested-by: Benjamin Coddington Fixes: 70ba381e1a43 ("nfs: add LOCALIO support") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 5fcd95831d9751435e3617e870d706cb9070b55a Author: Trond Myklebust Date: Sat Jan 3 12:15:00 2026 -0500 NFS/localio: Cleanup the nfs_local_pgio_done() parameters Remove the redundant 'force' parameter. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 615762059d284b863f9163b53679d95b3dcdd495 Author: Trond Myklebust Date: Sat Jan 3 12:14:59 2026 -0500 NFS/localio: Handle short writes by retrying The current code for handling short writes in localio just truncates the I/O and then sets an error. While that is close to how the ordinary NFS code behaves, it does mean there is a chance the data that got written is lost because it isn't persisted. To fix this, change localio so that the upper layers can direct the behaviour to persist any unstable data by rewriting it, and then continuing writing until an ENOSPC is hit. Fixes: 70ba381e1a43 ("nfs: add LOCALIO support") Signed-off-by: Trond Myklebust Reviewed-by: Mike Snitzer Signed-off-by: Anna Schumaker commit ed806240b8975f951c88ccb4bb75813f5fb949df Author: Brian Masney Date: Thu Jan 22 07:47:16 2026 -0500 rtc: ac100: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Acked-by: Alexandre Belloni Signed-off-by: Brian Masney commit 30a807808c69a1907001ffb79289237a2ee97cfa Author: Brian Masney Date: Thu Jan 8 16:16:41 2026 -0500 clk: zynqmp: divider: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: 0f9cf96a01fd ("clk: zynqmp: divider: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney commit bb1b0e63dbbd7150324cb4d6aef7854dbe26a617 Author: Brian Masney Date: Thu Jan 8 16:16:40 2026 -0500 clk: x86: cgu: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: f7a6bed91a19 ("clk: x86: cgu: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney commit 56c1cfb488cc17944c200edad96191a70a3783ba Author: Brian Masney Date: Thu Jan 8 16:16:39 2026 -0500 clk: versaclock3: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: 9e3372b2ebac ("clk: versaclock3: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney commit 2532795a6d6bb9791d713ffa9d9433f293b45b14 Author: Brian Masney Date: Thu Jan 8 16:16:38 2026 -0500 clk: stm32: stm32-core: convert from divider_round_rate_parent() to divider_determine_rate() The divider_round_rate_parent() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: cd1cb38836c0 ("clk: stm32: stm32-core: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney commit 6587c9dacc89ad7014bf601fe851955429f13230 Author: Brian Masney Date: Thu Jan 8 16:16:37 2026 -0500 clk: stm32: stm32-core: convert from divider_ro_round_rate() to divider_ro_determine_rate() The divider_ro_round_rate() function is now deprecated, so let's migrate to divider_ro_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: cd1cb38836c0 ("clk: stm32: stm32-core: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney commit f78fb9422980ceeb340fa3a2e370ae8845798ec7 Author: Brian Masney Date: Thu Jan 8 16:16:36 2026 -0500 clk: sprd: div: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: deb4740a5ff8 ("clk: sprd: div: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney commit 77b04dc19693510ce8ed1c6eda5f5b833e208816 Author: Brian Masney Date: Thu Jan 8 16:16:35 2026 -0500 clk: sophgo: sg2042-clkgen: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Note that this commit also removes a debugging message that's not really needed. Fixes: 9a3b6993613d ("clk: sophgo: sg2042-clkgen: convert from round_rate() to determine_rate()") Tested-by: Chen Wang Reviewed-by: Chen Wang Signed-off-by: Brian Masney commit af943663ccc266e6346e5645b13c0fca71d24395 Author: Brian Masney Date: Thu Jan 8 16:16:31 2026 -0500 clk: nxp: lpc32xx: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: 0879768df240 ("clk: nxp: lpc32xx: convert from round_rate() to determine_rate()") Tested-by: Vladimir Zapolskiy Reviewed-by: Vladimir Zapolskiy Signed-off-by: Brian Masney commit 9329d784ca9aad03b12508128797d40fd1f2e0c1 Author: Brian Masney Date: Thu Jan 8 16:16:30 2026 -0500 clk: nuvoton: ma35d1-divider: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: 215f8aa095a1 ("clk: nuvoton: ma35d1-divider: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney commit 865e63b038c446d38593ddbcc362ebb62e6ff007 Author: Brian Masney Date: Thu Jan 8 16:16:29 2026 -0500 clk: milbeaut: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: 7b45988fcf78 ("clk: milbeaut: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney commit fc5d7e7ee681238035466ce60a6892ee8f637e9d Author: Brian Masney Date: Thu Jan 8 16:16:28 2026 -0500 clk: milbeaut: convert from divider_ro_round_rate() to divider_ro_determine_rate() The divider_ro_round_rate() function is now deprecated, so let's migrate to divider_ro_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: fe67c682f91c ("clk: milbeaut: convert from divider_round_rate() to divider_determine_rate()") Signed-off-by: Brian Masney commit 11d3c676e7e0f00e3398199f85e47a0e22369866 Author: Brian Masney Date: Thu Jan 8 16:16:27 2026 -0500 clk: loongson1: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: bb40a2ef4fc9 ("clk: loongson1: convert from round_rate() to determine_rate()") Reviewed-by: Keguang Zhang Tested-by: Keguang Zhang # on LS1B & LS1C Signed-off-by: Brian Masney commit e3a5249c140a1ded55937ba04247d530a85f0edc Author: Brian Masney Date: Thu Jan 8 16:16:26 2026 -0500 clk: hisilicon: clkdivider-hi6220: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: 619a6210f398 ("clk: hisilicon: clkdivider-hi6220: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney commit 463b97bef0c9fb02b743d6b9f0d698cae81a1d9f Author: Brian Masney Date: Thu Jan 8 16:16:25 2026 -0500 clk: bm1880: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: 64613d7fb42f ("clk: bm1880: convert from round_rate() to determine_rate()") Acked-by: Manivannan Sadhasivam Signed-off-by: Brian Masney commit 7468ac0ce262640e928c71a5da6f6b42a89d453e Author: Brian Masney Date: Thu Jan 8 16:16:24 2026 -0500 clk: bm1880: convert from divider_ro_round_rate() to divider_ro_determine_rate() The divider_ro_round_rate() function is now deprecated, so let's migrate to divider_ro_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: cf1d95fa0c64 ("clk: bm1880: convert from divider_round_rate() to divider_determine_rate()") Acked-by: Manivannan Sadhasivam Signed-off-by: Brian Masney commit 3ff3360440fa8cc7ef5a4da628d3b770b46a4f73 Author: Brian Masney Date: Thu Jan 8 16:16:23 2026 -0500 clk: actions: owl-divider: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Additionally, owl_divider_helper_round_rate() is no longer used, so let's drop that from the header file as well. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: 1b04e12a8bcc ("clk: actions: owl-divider: convert from round_rate() to determine_rate()") Acked-by: Manivannan Sadhasivam Signed-off-by: Brian Masney commit d0b7c5bf6c5520c35fecff34da83d390405d3eaf Author: Brian Masney Date: Thu Jan 8 16:16:22 2026 -0500 clk: actions: owl-composite: convert from owl_divider_helper_round_rate() to divider_determine_rate() owl_divider_helper_round_rate() is just a wrapper for divider_round_rate(), which is deprecated. Let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Acked-by: Manivannan Sadhasivam Signed-off-by: Brian Masney commit 1c8d7af61b37db526393a46224417f36420e97f8 Author: Brian Masney Date: Thu Jan 8 16:16:20 2026 -0500 clk: sunxi-ng: convert from divider_round_rate_parent() to divider_determine_rate() The divider_round_rate_parent() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Also go ahead and convert all of the driver from round rate type to determine rate that accepts a 'struct clk_rate_request' to simplify the overall driver code. Acked-by: Chen-Yu Tsai Signed-off-by: Brian Masney commit a641384bb03bc2c85bd51dc60d40e9f15aeaa446 Author: Brian Masney Date: Thu Jan 8 16:16:19 2026 -0500 clk: sophgo: cv18xx-ip: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Also go ahead and convert all of the driver from round rate type to determine rate that accepts a 'struct clk_rate_request' to simplify the overall driver code. Signed-off-by: Brian Masney commit 800af362d68945e589f73cda429d04bfe4287feb Author: Swapnil Sapkal Date: Mon Jan 19 17:58:32 2026 +0000 perf sched stats: Add details in man page Document 'perf sched stats' purpose, usage examples and guide on how to interpret the report data in the perf-sched man page. Signed-off-by: Ravi Bangoria Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Acked-by: Ian Rogers Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Namhyung Kim Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han Signed-off-by: Arnaldo Carvalho de Melo commit c6b1f5707509c2718832a8f79e1d1510c85bcc75 Author: Swapnil Sapkal Date: Mon Jan 19 17:58:31 2026 +0000 perf sched stats: Add basic 'perf sched stats' test Add basic test for 'perf sched stats {record|report|diff}' subcommand. Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Acked-by: Ian Rogers Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Namhyung Kim Cc: Ravi Bangoria Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han Link: https://lore.kernel.org/r/20260119175833.340369-10-swapnil.sapkal@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 064790a3d4a89536d00a61d7a02de67ad319bdc5 Author: Swapnil Sapkal Date: Mon Jan 19 17:58:30 2026 +0000 perf sched stats: Add support for diff subcommand `perf sched stats diff` subcommand will take two perf.data files as an input and it will print the diff between the two perf.data files. The default input to this subcommnd is perf.data.old and perf.data. Example usage: # perf sched stats diff sample1.data sample2.data Description ---------------------------------------------------------------------------------------------------- DESC -> Description of the field COUNT -> Value of the field PCT_CHANGE -> Percent change with corresponding base value AVG_JIFFIES -> Avg time in jiffies between two consecutive occurrence of event ---------------------------------------------------------------------------------------------------- Time elapsed (in jiffies) : 1, 1 ---------------------------------------------------------------------------------------------------- CPU: ---------------------------------------------------------------------------------------------------- DESC COUNT1 COUNT2 PCT_CHANGE PCT_CHANGE1 PCT_CHANGE2 ---------------------------------------------------------------------------------------------------- yld_count : 0, 0 | 0.00% | array_exp : 0, 0 | 0.00% | sched_count : 0, 0 | 0.00% | sched_goidle : 0, 0 | 0.00% | ( 0.00%, 0.00% ) ttwu_count : 0, 0 | 0.00% | ttwu_local : 0, 0 | 0.00% | ( 0.00%, 0.00% ) rq_cpu_time : 32565, 33525 | 2.95% | run_delay : 0, 436 | 0.00% | ( 0.00%, 1.30% ) pcount : 0, 0 | 0.00% | ---------------------------------------------------------------------------------------------------- CPU: | DOMAIN: SMT ---------------------------------------------------------------------------------------------------- DESC COUNT1 COUNT2 PCT_CHANGE AVG_JIFFIES1 AVG_JIFFIES2 ----------------------------------------- ------------------------------------------ busy_lb_count : 0, 0 | 0.00% | $ 0.00, 0.00 $ busy_lb_balanced : 0, 0 | 0.00% | $ 0.00, 0.00 $ busy_lb_failed : 0, 0 | 0.00% | $ 0.00, 0.00 $ busy_lb_imbalance_load : 0, 0 | 0.00% | busy_lb_imbalance_util : 0, 0 | 0.00% | busy_lb_imbalance_task : 0, 0 | 0.00% | busy_lb_imbalance_misfit : 0, 0 | 0.00% | busy_lb_gained : 0, 0 | 0.00% | busy_lb_hot_gained : 0, 0 | 0.00% | busy_lb_nobusyq : 0, 0 | 0.00% | $ 0.00, 0.00 $ busy_lb_nobusyg : 0, 0 | 0.00% | $ 0.00, 0.00 $ *busy_lb_success_count : 0, 0 | 0.00% | *busy_lb_avg_pulled : 0.00, 0.00 | 0.00% | ... and so on. Output contains the diff of aggregated data of all the busy, idle and newidle categories for all the sched domains in the system. Signed-off-by: Ravi Bangoria Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Acked-by: Ian Rogers Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Namhyung Kim Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han Signed-off-by: Arnaldo Carvalho de Melo commit 00093b3133984ffe80697b5d2e7f204983660dd9 Author: Swapnil Sapkal Date: Mon Jan 19 17:58:29 2026 +0000 perf sched stats: Add support for live mode The live mode works similar to simple `perf stat` command, by profiling the target and printing results on the terminal as soon as the target finishes. Example usage: # perf sched stats -- true Description ---------------------------------------------------------------------------------------------------- DESC -> Description of the field COUNT -> Value of the field PCT_CHANGE -> Percent change with corresponding base value AVG_JIFFIES -> Avg time in jiffies between two consecutive occurrence of event ---------------------------------------------------------------------------------------------------- Time elapsed (in jiffies) : 1 ---------------------------------------------------------------------------------------------------- CPU: ---------------------------------------------------------------------------------------------------- DESC COUNT PCT_CHANGE ---------------------------------------------------------------------------------------------------- yld_count : 0 array_exp : 0 sched_count : 0 sched_goidle : 0 ( 0.00% ) ttwu_count : 0 ttwu_local : 0 ( 0.00% ) rq_cpu_time : 27875 run_delay : 0 ( 0.00% ) pcount : 0 ---------------------------------------------------------------------------------------------------- CPU: | DOMAIN: SMT ---------------------------------------------------------------------------------------------------- DESC COUNT AVG_JIFFIES ----------------------------------------- ------------------------------------------ busy_lb_count : 0 $ 0.00 $ busy_lb_balanced : 0 $ 0.00 $ busy_lb_failed : 0 $ 0.00 $ busy_lb_imbalance_load : 0 busy_lb_imbalance_util : 0 busy_lb_imbalance_task : 0 busy_lb_imbalance_misfit : 0 busy_lb_gained : 0 busy_lb_hot_gained : 0 busy_lb_nobusyq : 0 $ 0.00 $ busy_lb_nobusyg : 0 $ 0.00 $ *busy_lb_success_count : 0 *busy_lb_avg_pulled : 0.00 ... and so on. Output will show similar data for all the cpus in the system. Co-developed-by: Ravi Bangoria Signed-off-by: Ravi Bangoria Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Tested-by: James Clark Acked-by: Ian Rogers Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Namhyung Kim Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han [ Avoid potentially using 'sv' uninitialized by calling free_cpu_domain_info() only when build_cpu_domain_map() is called ] Signed-off-by: Arnaldo Carvalho de Melo commit 5a357ae6ad63fd101a4f20d081f8893b51cc0790 Author: Swapnil Sapkal Date: Mon Jan 19 17:58:28 2026 +0000 perf sched stats: Add support for report subcommand `perf sched stats record` captures two sets of samples. For workload profile, first set right before workload starts and second set after workload finishes. For the systemwide profile, first set at the beginning of profile and second set on receiving SIGINT signal. Add `perf sched stats report` subcommand that will read both the set of samples, get the diff and render a final report. Final report prints scheduler stat at cpu granularity as well as sched domain granularity. Example usage: # ./perf sched stats record -- true [ perf sched stats: Wrote samples to perf.data ] # perf sched stats report Description ---------------------------------------------------------------------------------------------------- DESC -> Description of the field COUNT -> Value of the field PCT_CHANGE -> Percent change with corresponding base value AVG_JIFFIES -> Avg time in jiffies between two consecutive occurrence of event ---------------------------------------------------------------------------------------------------- Time elapsed (in jiffies) : 1 ---------------------------------------------------------------------------------------------------- CPU: ---------------------------------------------------------------------------------------------------- DESC COUNT PCT_CHANGE ---------------------------------------------------------------------------------------------------- yld_count : 0 array_exp : 0 sched_count : 0 sched_goidle : 0 ( 0.00% ) ttwu_count : 0 ttwu_local : 0 ( 0.00% ) rq_cpu_time : 33525 run_delay : 436 ( 1.30% ) pcount : 0 ---------------------------------------------------------------------------------------------------- CPU: | DOMAIN: SMT ---------------------------------------------------------------------------------------------------- DESC COUNT AVG_JIFFIES ----------------------------------------- ------------------------------------------ busy_lb_count : 0 $ 0.00 $ busy_lb_balanced : 0 $ 0.00 $ busy_lb_failed : 0 $ 0.00 $ busy_lb_imbalance_load : 0 busy_lb_imbalance_util : 0 busy_lb_imbalance_task : 0 busy_lb_imbalance_misfit : 0 busy_lb_gained : 0 busy_lb_hot_gained : 0 busy_lb_nobusyq : 0 $ 0.00 $ busy_lb_nobusyg : 0 $ 0.00 $ *busy_lb_success_count : 0 *busy_lb_avg_pulled : 0.00 ... and so on. Output shows similar data for all the cpus in the system. Co-developed-by: Ravi Bangoria Signed-off-by: Ravi Bangoria Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Tested-by: James Clark Acked-by: Ian Rogers Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Namhyung Kim Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han Signed-off-by: Arnaldo Carvalho de Melo commit 805da27252a290984782abfdb313a78e7c157369 Author: Swapnil Sapkal Date: Mon Jan 19 17:58:27 2026 +0000 perf sched stats: Add schedstat v17 support The /proc/schedstat file output is standardized with version number. Add support to record and raw dump v17 version layout. Version 17 of schedstats removed 'lb_imbalance' field as it has no significance anymore and instead added more relevant fields namely 'lb_imbalance_load', 'lb_imbalance_util', 'lb_imbalance_task' and 'lb_imbalance_misfit'. The domain field prints the name of the corresponding sched domain from this version onwards. Co-developed-by: Ravi Bangoria Signed-off-by: Ravi Bangoria Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Acked-by: Ian Rogers Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Namhyung Kim Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han Signed-off-by: Arnaldo Carvalho de Melo commit 55657d7ac8caa98c7c0ef241bf64e176db899b4d Author: Swapnil Sapkal Date: Mon Jan 19 17:58:26 2026 +0000 perf sched stats: Add schedstat v16 support The /proc/schedstat file output is standardized with version number. Add support to record and raw dump v16 version layout. Version 16 of schedstats changed the order of definitions within 'enum cpu_idle_type', which changed the order of [CPU_MAX_IDLE_TYPES] columns in show_schedstat(). In particular the position of CPU_IDLE and __CPU_NOT_IDLE changed places. Co-developed-by: Ravi Bangoria Signed-off-by: Ravi Bangoria Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Tested-by: James Clark Acked-by: Ian Rogers Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Namhyung Kim Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han Signed-off-by: Arnaldo Carvalho de Melo commit c3030995f23b3d35f94b9bc4375706ec5916fd55 Author: Swapnil Sapkal Date: Mon Jan 19 17:58:25 2026 +0000 perf sched stats: Add record and rawdump support Define new, perf tool only, sample types and their layouts. Add logic to parse /proc/schedstat, convert it to perf sample format and save samples to perf.data file with `perf sched stats record` command. Also add logic to read perf.data file, interpret schedstat samples and print rawdump of samples with `perf script -D`. Note that, /proc/schedstat file output is standardized with version number. The patch supports v15 but older or newer version can be added easily. Co-developed-by: Ravi Bangoria Signed-off-by: Ravi Bangoria Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Tested-by: James Clark Acked-by: Ian Rogers Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Namhyung Kim Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han [ PRIu64 needs uint64_t, not 'unsigned long' to work on both 32-bit and 64-bit ] Signed-off-by: Arnaldo Carvalho de Melo commit ea69dc4e207b09fb9adb6dab1901739d64853090 Author: Ashish Mhetre Date: Tue Jan 13 05:49:33 2026 +0000 iommu/arm-smmu-v3: Add device-tree support for CMDQV driver Add device tree support to the CMDQV driver to enable usage on Tegra264 SoCs. The implementation parses the nvidia,cmdqv phandle from the SMMU device tree node to associate each SMMU with its corresponding CMDQV instance based on compatible string. Reviewed-by: Nicolin Chen Signed-off-by: Ashish Mhetre Reviewed-by: Jon Hunter Signed-off-by: Will Deacon commit eb20758f86723bb94d30747fca7b65ed2e6846b8 Author: Nicolin Chen Date: Tue Jan 13 05:49:32 2026 +0000 iommu/tegra241-cmdqv: Decouple driver from ACPI A platform device is created by acpi_create_platform_device() per CMDQV's adev. That means there is no point in going through _CRS of ACPI. Replace all the ACPI functions with standard platform functions. And drop all ACPI dependencies. This will make the driver compatible with DT also. Suggested-by: Robin Murphy Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon commit f36e738549d483878ebf4cc9826c46d9dc4aa496 Author: Alex Studer Date: Tue Jan 13 19:29:48 2026 +0100 riscv: dts: allwinner: d1: Add CPU thermal sensor and zone The sun20i THS (built in CPU thermal sensor) is supported in code, but was never added to the device tree. So, add it to the device tree, along with a thermal zone for the CPU. Signed-off-by: Alex Studer Changes since v1: - Move include before defines in sun20i-d1s.dtsi - Fix register size for thermal-sensor@2009400 - Move thermal-sensor@2009400 in SoC to match register address sorting - Add thermal-zone for sun8i-t113s.dtsi and fix missing cooling-cells Link: https://lore.kernel.org/r/20250218020629.1476126-1-alex@studer.dev Signed-off-by: Lukas Schmid Link: https://patch.msgid.link/20260113182951.1059690-1-lukas.schmid@netcube.li Signed-off-by: Chen-Yu Tsai commit ed1ac3c977dd6b119405fa36dd41f7151bd5b4de Author: Danilo Krummrich Date: Wed Jan 21 15:12:01 2026 +0100 iommu/arm-smmu-qcom: do not register driver in probe() Commit 0b4eeee2876f ("iommu/arm-smmu-qcom: Register the TBU driver in qcom_smmu_impl_init") intended to also probe the TBU driver when CONFIG_ARM_SMMU_QCOM_DEBUG is disabled, but also moved the corresponding platform_driver_register() call into qcom_smmu_impl_init() which is called from arm_smmu_device_probe(). However, it neither makes sense to register drivers from probe() callbacks of other drivers, nor does the driver core allow registering drivers with a device lock already being held. The latter was revealed by commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") leading to a deadlock condition described in [1]. Additionally, it was noted by Robin that the current approach is potentially racy with async probe [2]. Hence, fix this by registering the qcom_smmu_tbu_driver from module_init(). Unfortunately, due to the vendoring of the driver, this requires an indirection through arm-smmu-impl.c. Reported-by: Mark Brown Closes: https://lore.kernel.org/lkml/7ae38e31-ef31-43ad-9106-7c76ea0e8596@sirena.org.uk/ Link: https://lore.kernel.org/lkml/DFU7CEPUSG9A.1KKGVW4HIPMSH@kernel.org/ [1] Link: https://lore.kernel.org/lkml/0c0d3707-9ea5-44f9-88a1-a65c62e3df8d@arm.com/ [2] Fixes: dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") Fixes: 0b4eeee2876f ("iommu/arm-smmu-qcom: Register the TBU driver in qcom_smmu_impl_init") Acked-by: Robin Murphy Tested-by: Bjorn Andersson Reviewed-by: Bjorn Andersson Acked-by: Konrad Dybcio Reviewed-by: Greg Kroah-Hartman Tested-by: Ioana Ciornei #LX2160ARDB Tested-by: Wang Jiayue Reviewed-by: Wang Jiayue Tested-by: Mark Brown Acked-by: Joerg Roedel Link: https://patch.msgid.link/20260121141215.29658-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 1f293098a31368a5d5cfab215a56f4cbed3f657a Author: Jens Axboe Date: Wed Jan 21 10:40:33 2026 -0700 io_uring/io-wq: don't trigger hung task for syzbot craziness Use the same trick that blk_io_schedule() does to avoid triggering the hung task warning (and potential reboot/panic, depending on system settings), and only wait for half the hung task timeout at the time. If we exceed the default IO_URING_EXIT_WAIT_MAX period where we expect things to certainly have finished unless there's a bug, then throw a WARN_ON_ONCE() for that case. Reported-by: syzbot+4eb282331cab6d5b6588@syzkaller.appspotmail.com Tested-by: syzbot+4eb282331cab6d5b6588@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit dd120bddc43af583e3bc9afe75f58bb9280947b0 Author: Jens Axboe Date: Wed Jan 21 16:06:41 2026 -0700 io_uring: add IO_URING_EXIT_WAIT_MAX definition Add the timeout we normally wait before complaining about things being stuck waiting for cancelations to complete as a define, and use it in io_ring_exit_work(). Signed-off-by: Jens Axboe commit 14e9a138dd020e234bbbecdbcf4d68eabfe3641e Author: Bibek Kumar Patro Date: Tue Jan 20 20:41:05 2026 +0530 iommu/arm-smmu-qcom: Restore ACTLR settings for MDSS on sa8775p The ACTLR configuration for the sa8775p MDSS client was inadvertently dropped while reworking the commit f91879fdf70b ("iommu/arm-smmu-qcom: Add actlr settings for mdss on Qualcomm platforms"). Without this entry, the sa8775p MDSS block does not receive the intended default ACTLR configuration. Restore the missing compatible entry so that the platform receives the expected behavior. Fixes: f91879fdf70b ("iommu/arm-smmu-qcom: Add actlr settings for mdss on Qualcomm platforms") Signed-off-by: Bibek Kumar Patro Signed-off-by: Will Deacon commit 76246f598ee3e8ba8796360f24cc8ea491350937 Author: Jishnu Prakash Date: Tue Dec 16 15:44:12 2025 +0530 dt-bindings: mfd: qcom,spmi-pmic: Document PMICs present on Glymur and Kaanapali Document compatibles for the pmcx0102, pmh0101, pmh0104, pmh0110, pmk8850 and smb2370 SPMI PMICs. Signed-off-by: Jingyi Wang Signed-off-by: Jishnu Prakash Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251216-knp-pmic-mfd-v3-1-9d0cd62676d9@oss.qualcomm.com Signed-off-by: Lee Jones commit 30e312bb1f410459e6dd0e742f3665e1f205f0f9 Author: Andrew Jeffery Date: Fri Jan 9 17:05:18 2026 +1030 dt-bindings: mfd: Document smp-memram subnode for aspeed,ast2x00-scu The platform initialisation code for the AST2600 implements the custom SMP bringup protocol, and searches for the relevant compatible. As a consequence, define the requisite node and the compatible string, which in-turn tidies up the dtb check results. Signed-off-by: Andrew Jeffery Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260109-dev-dt-warnings-mfd-v1-1-1aabe37e9a14@codeconstruct.com.au Signed-off-by: Lee Jones commit cefd793fa17de708d043adab50e7f96f414b0f1d Author: Ilpo Järvinen Date: Tue Jan 13 19:21:50 2026 +0200 mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs Add Intel Nova Lake-S LPSS PCI IDs. Signed-off-by: Ilpo Järvinen Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260113172151.48062-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Lee Jones commit 9e87c8bff5390791b3b9b22781110489e2437d0e Author: Andy Shevchenko Date: Thu Oct 30 12:36:34 2025 +0100 mfd: ls2kbmc: Use PCI API instead of direct accesses There is a PCI API to access device resources. Use it instead of direct accesses. Signed-off-by: Andy Shevchenko Reviewed-by: Binbin Zhou Link: https://patch.msgid.link/20251030113735.3741913-3-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit e11a9ad38095fe7bd1322ed6962c46f51523e885 Author: Andy Shevchenko Date: Thu Oct 30 12:36:33 2025 +0100 mfd: ls2kbmc: Fully convert to use managed resources The mixing of managed and non-managed resources may lead to possible use-after-free bugs. In this driver the problematic part is the device functionality that may just have gone behind the functions back, e.g., when interrupt is being served. Fix this by switching to managed resources for PCI. Fixes: 91a3e1f5453a ("mfd: ls2kbmc: Check for devm_mfd_add_devices() failure") Fixes: d952bba3fbb5 ("mfd: ls2kbmc: Add Loongson-2K BMC reset function support") Signed-off-by: Andy Shevchenko Reviewed-by: Binbin Zhou Link: https://patch.msgid.link/20251030113735.3741913-2-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit 71ae8abaf100f92b72e99bed4801953b199a7ed4 Author: AngeloGioacchino Del Regno Date: Tue Jan 13 11:59:56 2026 +0100 dt-bindings: mfd: mediatek: mt6397: Add missing MT6331 regulator compat Add the missing mediatek,mt6331-regulator in the compatible string list for the regulators subnode. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260113110000.36953-3-angelogioacchino.delregno@collabora.com Signed-off-by: Lee Jones commit 2872d17a9633bf710e3dcbe3c250daa9a11ba495 Author: AngeloGioacchino Del Regno Date: Tue Jan 13 11:59:55 2026 +0100 dt-bindings: mfd: mediatek,mt8195-scpsys: Add mediatek,mt6795-scpsys Add a new compatible for the SCPSYS IP block found in the MT6795 Helio X10 SoC. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260113110000.36953-2-angelogioacchino.delregno@collabora.com Signed-off-by: Lee Jones commit 6647a80dfbbe10b920b6d6d3cc7b6bdc9168a29e Author: Robert Marko Date: Mon Dec 29 19:37:43 2025 +0100 dt-bindings: mfd: atmel,sama5d2-flexcom: Add microchip,lan9691-flexcom Add binding documentation for Microchip LAN969x. Signed-off-by: Robert Marko Acked-by: Conor Dooley Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20251229184004.571837-3-robert.marko@sartura.hr Signed-off-by: Lee Jones commit 24804ba508a3e240501c521685a1c4eb9f574f8e Author: Johan Hovold Date: Fri Dec 19 12:07:14 2025 +0100 mfd: omap-usb-host: Fix OF populate on driver rebind Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes. Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound. Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Cc: stable@vger.kernel.org # 3.16 Signed-off-by: Johan Hovold Reviewed-by: Andreas Kemnade Link: https://patch.msgid.link/20251219110714.23919-1-johan@kernel.org Signed-off-by: Lee Jones commit 27a8acea47a93fea6ad0e2df4c20a9b51490e4d9 Author: Johan Hovold Date: Fri Dec 19 12:09:47 2025 +0100 mfd: qcom-pm8xxx: Fix OF populate on driver rebind Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes. Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound. Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Cc: stable@vger.kernel.org # 3.16 Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20251219110947.24101-1-johan@kernel.org Signed-off-by: Lee Jones commit 42e4a9aab4775683b52dfdb8c7f2072817758152 Author: AngeloGioacchino Del Regno Date: Fri Jan 9 12:43:56 2026 +0100 dt-bindings: mfd: syscon: Allow syscon compatible for mediatek,mt7981-topmisc Commit a95419ff9f21 ("dt-bindings: mfd: syscon: Add mt7981-topmisc") added the mediatek,mt7981-topmisc compatible to the `select` block which is used only for compatibility with older dtschema, but did not add it in the actual block allowing to specify the "syscon" fallback compatible, which is required for such node to do anything meaningful in the end. Add the mediatek,mt7981-topmisc compatible in the right list to allow specifing compatible = "mediatek,mt7981-topmisc", "syscon" in the relevant devicetree node. Fixes: a95419ff9f21 ("dt-bindings: mfd: syscon: Add mt7981-topmisc") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260109114356.36454-1-angelogioacchino.delregno@collabora.com Signed-off-by: Lee Jones commit a212772791d7bb44440d60485bd1102fbedb0bb1 Author: Heiko Stuebner Date: Sun Jan 4 18:33:10 2026 +0100 mfd: qnap-mcu: Add driver data for TS133 variant Add the TS133 compatible and affiliated driver data to qnap-mcu. The TS133 is mostly similar to the TS233/TS433, except only having one drive and no USB-LED. The fan pwm-limits from the vendor-configuration also are the same as for the TS233/TS433 variants. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260104173310.2685852-3-heiko@sntech.de Signed-off-by: Lee Jones commit 321c8fa2b6c8475634af246c6b2d51c31dbb60aa Author: Heiko Stuebner Date: Sun Jan 4 18:33:09 2026 +0100 dt-bindings: mfd: qnap,ts433-mcu: Add qnap,ts133-mcu compatible The same MCU is used on a number of devices, each with a slightly different set of features, like the number of LEDs. Add a compatible for the MCU used in the TS133 variant. This is the 1-disk consumer variant of the RK356x-based family. Signed-off-by: Heiko Stuebner Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260104173310.2685852-2-heiko@sntech.de Signed-off-by: Lee Jones commit b60c2dba6d3c3ad72a7c30bbd8eda07d8a49bc7f Author: André Draszik Date: Mon Jan 5 16:25:46 2026 +0000 mfd: sec: Fix IRQ domain names duplication For the S2MPG10 IRQ and chained IRQ, regmap IRQ will try to create a folder with the same name which is impossible and fails with: debugfs: ':firmware:power-management:pmic' already exists in 'domains' Add domain_suffix to the chained IRQ chip driver to fix it. Fixes: ee19b52c31b3 ("mfd: sec: Use chained IRQs for s2mpg10") Signed-off-by: André Draszik Link: https://patch.msgid.link/20260105-s2mpg10-chained-irq-domain-suffix-v1-1-01ab16204b97@linaro.org Signed-off-by: Lee Jones commit 8f34c1a64c5394d2b51d3fba197947dc4b0b48a0 Author: Robert Marko Date: Mon Jan 12 17:14:52 2026 +0100 mfd: simple-mfd-i2c: Add Delta TN48M CPLD support Delta TN48M switches have a Lattice CPLD that serves multiple purposes including being a GPIO expander. So, lets use the simple I2C MFD driver to provide the MFD core. Also add a virtual symbol which pulls in the simple-mfd-i2c driver and provide a common symbol on which the subdevice drivers can depend on. Fixes: b3dcb5de6209 ("gpio: Add Delta TN48M CPLD GPIO driver") Signed-off-by: Robert Marko Link: https://lore.kernel.org/20220131133049.77780-2-robert.marko@sartura.hr Link: https://lore.kernel.org/linux-gpio/20260112064950.3837737-1-rdunlap@infradead.org/ Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260112-mfd-tn48m-v11-1-00c798d8cd2a@kernel.org Signed-off-by: Lee Jones commit 414f65d6736342c77d4ec5e7373039f4a09250dd Author: Janne Grunau Date: Wed Dec 31 10:42:12 2025 +0100 mfd: macsmc: Initialize mutex Initialize struct apple_smc's mutex in apple_smc_probe(). Using the mutex uninitialized surprisingly resulted only in occasional NULL pointer dereferences in apple_smc_read() calls from the probe() functions of sub devices. Cc: stable@vger.kernel.org Fixes: e038d985c9823 ("mfd: Add Apple Silicon System Management Controller") Signed-off-by: Janne Grunau Reviewed-by: Sven Peter Reviewed-by: Neal Gompa Link: https://patch.msgid.link/20251231-macsmc-mutex_init-v2-1-5818c9dc9b29@jannau.net Signed-off-by: Lee Jones commit e46de99c91de2eb1c6517a9be6934086cefb85b8 Author: Vladimir Zapolskiy Date: Wed Dec 31 23:57:50 2025 +0200 dt-bindings: mfd: nxp: Add NXP LPC32xx System Control Block NXP LPC32xx SoC series contains a System Control Block, which serves for a multitude of purposes including clock and power management, DMA muxing, storing SoC unique ID etc. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251231215754.2222308-2-vz@mleia.com Signed-off-by: Lee Jones commit 9d1e2d5f2b24a24b32aca451d6a7feb081ad5a62 Author: Troy Mitchell Date: Thu Dec 25 15:46:32 2025 +0800 mfd: Kconfig: Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT The default value of the P1 sub-device depends on the value of P1, so P1 should have a default value here. Signed-off-by: Troy Mitchell Acked-by: Alex Elder Link: https://patch.msgid.link/20251225-p1-kconfig-fix-v4-2-44b6728117c1@linux.spacemit.com Signed-off-by: Lee Jones commit f78263a87336056b5948396c646d7d8413a2c2ea Author: Chen-Yu Tsai Date: Thu Dec 25 16:02:40 2025 +0800 mfd: axp20x: AXP717: Add type-C CC registers The AXP717 has some extra registers related to type-C CC pin negotiation. They were missing from the original submission. Add them for completeness. Signed-off-by: Chen-Yu Tsai Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20251225080241.3153453-1-wens@kernel.org Signed-off-by: Lee Jones commit 7d60a2b8c23a7109f3048c6cee77cc9ffa832755 Author: Krzysztof Kozlowski Date: Wed Dec 24 13:44:58 2025 +0100 mfd: core: Simplify storing device_node in mfd_match_of_node_to_dev() of_node_get() returns the same pointer it received and canonical form of storing device_node is to use of_node_get() in the assignment. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251224124456.208529-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Lee Jones commit cd18e9af79ad17db88c0799197ed1fd948396388 Author: Krzysztof Kozlowski Date: Wed Dec 24 13:44:57 2025 +0100 mfd: core: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251224124456.208529-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Lee Jones commit 541b1e867ea1c3c9021ce684113859e0494094ea Author: Rob Herring (Arm) Date: Mon Dec 15 15:26:38 2025 -0600 dt-bindings: mfd: Add Bitmain BM1880 System Controller Add the already in use Bitmain BM1880 System Controller binding. All the child nodes already have schemas. Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251215212639.3320085-1-robh@kernel.org Signed-off-by: Lee Jones commit d3fcf276b501a82d4504fd5b1ed40249546530d1 Author: Kory Maincent (TI.com) Date: Thu Dec 18 16:06:28 2025 +0100 mfd: tps65219: Implement LOCK register handling for TPS65214 The TPS65214 PMIC variant has a LOCK_REG register that prevents writes to nearly all registers when locked. Unlock the registers at probe time and leave them unlocked permanently. This approach is justified because: - Register locking is very uncommon in typical system operation - No code path is expected to lock the registers during runtime - Adding a custom regmap write function would add overhead to every register write, including voltage changes triggered by CPU OPP transitions from the cpufreq governor which could happen quite frequently Cc: stable@vger.kernel.org Fixes: 7947219ab1a2d ("mfd: tps65219: Add support for TI TPS65214 PMIC") Reviewed-by: Andrew Davis Signed-off-by: Kory Maincent (TI.com) Link: https://patch.msgid.link/20251218-fix_tps65219-v5-1-8bb511417f3a@bootlin.com Signed-off-by: Lee Jones commit 05995af05b958dc22cb3b28a8d2ee0e79c7b4484 Author: Ryan Wanner Date: Thu Dec 18 09:35:20 2025 +0530 mfd: atmel-hlcdc: Add compatible for sama7d65 XLCD controller Add compatible for sama7d65 XLCD controller. Signed-off-by: Ryan Wanner Signed-off-by: Manikandan Muralidharan Acked-by: Nicolas Ferre Link: https://patch.msgid.link/20251218040521.463937-2-manikandan.m@microchip.com Signed-off-by: Lee Jones commit d5599f7235a223a4ea6af897e32e84b672482036 Author: Manikandan Muralidharan Date: Thu Dec 18 09:35:19 2025 +0530 dt-bindings: mfd: atmel,hlcdc: Add sama7d65 compatible string Add LCD compatible string for sama7d65. Signed-off-by: Manikandan Muralidharan Acked-by: Krzysztof Kozlowski Acked-by: Nicolas Ferre Link: https://patch.msgid.link/20251218040521.463937-1-manikandan.m@microchip.com Signed-off-by: Lee Jones commit 8644fa4a5fe7c1a256b9e5cf34a71e4b2cd04a0c Author: Dan Carpenter Date: Mon Dec 15 17:41:52 2025 +0300 dt-bindings: mfd: syscon: Document the GPR syscon for the NXP S32 SoCs The NXP S32 SoCs have a GPR region which is used by a variety of drivers. Some examples of the registers in this region are: * DDR_PMU_IRQ * GMAC0_PHY_INTF_SEL * GMAC1_PHY_INTF_SEL * PFE_EMACS_INTF_SEL * PFE_COH_EN * PFE_PWR_CTRL * PFE_EMACS_GENCTRL1 * PFE_GENCTRL3 Use the syscon interface to access these registers. Signed-off-by: Dan Carpenter Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/792d3f59b9f519529b94e673faf70d77c4b61fb3.1765806521.git.dan.carpenter@linaro.org Signed-off-by: Lee Jones commit 1c378a4c9b33a9a60b525b4219553b3aded11856 Author: André Draszik Date: Wed Dec 17 12:03:58 2025 +0000 mfd: max77759: Drop use of irqd_get_trigger_type irqd_get_trigger_type() is meant for cases where the driver needs to know the configured IRQ trigger type and e.g. wants to change its behaviour accordingly. Furthermore, platform support code, e.g. DT handling, will configure the hardware based on that, and drivers don't need to pass the trigger type into request_irq() and friends. Drop the use from this driver, as it doesn't need to know the trigger type. Signed-off-by: André Draszik Link: https://patch.msgid.link/20251217-max77759-mfd-irq-trigger-v1-1-e7d29f84d34f@linaro.org Signed-off-by: Lee Jones commit 0ec4122f003ea8b7baca01fae71cfa5ffe0c5663 Author: James Calligeros Date: Mon Dec 15 19:37:49 2025 +1000 mfd: macsmc: Wire up Apple SMC input subdevice Add the new SMC input function to the mfd device Signed-off-by: James Calligeros Reviewed-by: Neal Gompa Link: https://patch.msgid.link/20251215-macsmc-subdevs-v6-5-0518cb5f28ae@gmail.com Signed-off-by: Lee Jones commit 5dce1c0bff744fd3a3be2fbbfe13e1d264d1d45e Author: James Calligeros Date: Mon Dec 15 19:37:47 2025 +1000 mfd: macsmc: Wire up Apple SMC hwmon subdevice Add the SMC hwmon functionality to the mfd device Signed-off-by: James Calligeros Reviewed-by: Neal Gompa Link: https://patch.msgid.link/20251215-macsmc-subdevs-v6-3-0518cb5f28ae@gmail.com Signed-off-by: Lee Jones commit 899c590a257269fa9e5d4fd69134496defe1851c Author: James Calligeros Date: Mon Dec 15 19:37:46 2025 +1000 mfd: macsmc: Wire up Apple SMC RTC subdevice Add the new SMC RTC function to the mfd device Signed-off-by: James Calligeros Reviewed-by: Neal Gompa Link: https://patch.msgid.link/20251215-macsmc-subdevs-v6-2-0518cb5f28ae@gmail.com Signed-off-by: Lee Jones commit 4feb753ba6e5e5bbaba868b841a2db41c21e56fa Author: Haotian Zhang Date: Sun Dec 14 22:58:03 2025 +0800 mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure The wm5102_clear_write_sequencer() helper may return an error and just return, bypassing the cleanup sequence and causing regulators to remain enabled, leading to a resource leak. Change the direct return to jump to the err_reset label to properly free the resources. Fixes: 1c1c6bba57f5 ("mfd: wm5102: Ensure we always boot the device fully") Signed-off-by: Haotian Zhang Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251214145804.2037-1-vulab@iscas.ac.cn Signed-off-by: Lee Jones commit 20117c92bcf9c11afd64d7481d8f94fdf410726e Author: Douglas Anderson Date: Wed Dec 10 11:30:03 2025 -0800 mfd: core: Add locking around 'mfd_of_node_list' Manipulating a list in the kernel isn't safe without some sort of mutual exclusion. Add a mutex any time we access / modify 'mfd_of_node_list' to prevent possible crashes. Cc: stable@vger.kernel.org Fixes: 466a62d7642f ("mfd: core: Make a best effort attempt to match devices with the correct of_nodes") Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20251210113002.1.I6ceaca2cfb7eb25737012b166671f516696be4fd@changeid Signed-off-by: Lee Jones commit a71fee8421cf05d022880ae102983cd46535dac0 Author: Andreas Kemnade Date: Sun Dec 7 09:50:24 2025 +0100 mfd: bd71828: Add some missing charger related registers As there are some registers missing which are required for future charger extensions, add them. Signed-off-by: Andreas Kemnade Reviewed-by: Matti Vaittinen Link: https://patch.msgid.link/20251207085024.7375-1-andreas@kemnade.info Signed-off-by: Lee Jones commit 360bc3ae0d3fdcf5b234e8141ada93ecfb8b2a51 Author: Geert Uytterhoeven Date: Fri Nov 28 10:11:27 2025 +0100 mfd: core: Improve compile coverage of mfd_match_of_node_to_dev() As of commit c7fe3bbfd622b5ee ('mfd: core: Use of_property_read_reg() to parse "reg"'), all code in mfd_match_of_node_to_dev() compiles fine when CONFIG_OF is disabled. As the sole caller of this function is protected by IS_ENABLED(CONFIG_OF), the #ifdef inside the function can be removed to increase build coverage, without impacting code size. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/7b9a4a355c5da3fe812ead663285d05b64b84857.1764320964.git.geert+renesas@glider.be Signed-off-by: Lee Jones commit ed30d0296373e354f35ffc14558f265934dfa790 Author: Randy Dunlap Date: Mon Nov 24 18:27:50 2025 -0800 mfd: tps6105x: Fix kernel-doc warnings relating to the core struct and tps6105x_mode Fix spelling of an enum to fix a kernel-doc warning. Fix kernel-doc of struct tps6105x to prevent kernel-doc warnings. Warning: include/linux/mfd/tps6105x.h:68 Enum value 'TPS6105X_MODE_TORCH' not described in enum 'tps6105x_mode' Warning: include/linux/mfd/tps6105x.h:68 Excess enum value '%TPS61905X_MODE_TORCH' description in 'tps6105x_mode' Warning: include/linux/mfd/tps6105x.h:93 struct member 'pdata' not described in 'tps6105x' Warning: include/linux/mfd/tps6105x.h:93 struct member 'client' not described in 'tps6105x' Fixes: 798a8eee44da ("mfd: Add a core driver for TI TPS61050/TPS61052 chips v2") Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251125022750.3165569-1-rdunlap@infradead.org Signed-off-by: Lee Jones commit 12daa9c1954542bf98bb942fb2dadf19de79a44b Author: Marcus Folkesson Date: Mon Nov 24 17:16:51 2025 +0100 Revert "mfd: da9052-spi: Change read-mask to write-mask" This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed. Almost every register in this chip can be customized via OTP memory. Somehow the value for R19, which decide if the flag is set on read or write operation, seems to have been overwritten for the chip the original patch were written for. Revert the change to follow the default behavior. Signed-off-by: Marcus Folkesson Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com Signed-off-by: Lee Jones commit 70ef762fa8ca126e8ff7dfdfa7a83df46e671de7 Merge: e39951f8ad5006 3e10bbd9c8a6d5 b31583a1a9ab32 Author: Lee Jones Date: Thu Jan 22 14:21:19 2026 +0000 Merge branches 'ib-mfd-clk-gpio-power-regulator-rtc-6.20', 'ib-mfd-regulator-6.20' and 'ib-mfd-rtc-6.20' into ibs-for-mfd-merged commit 980ce2b02dd06a4fdf5fee38b2e14becf9cf7b8b Author: Zilin Guan Date: Thu Jan 22 13:09:50 2026 +0000 mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() The function mtd_parser_tplink_safeloader_parse() allocates buf via mtd_parser_tplink_safeloader_read_table(). If the allocation for parts[idx].name fails inside the loop, the code jumps to the err_free label without freeing buf, leading to a memory leak. Fix this by freeing the temporary buffer buf in the err_free label. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 00a3588084be ("mtd: parsers: add TP-Link SafeLoader partitions table parser") Signed-off-by: Zilin Guan Signed-off-by: Miquel Raynal commit 125981ffa1674573d3a9200e72ed93a2270344b1 Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:43 2026 -0600 dt-bindings: mtd: partitions: Combine simple partition bindings Several partition node bindings are just a compatible plus properties defined in partition.yaml. Move all of these bindings to a single schema file. Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit a1fa0f8ca1fb108d2cbf67fad8056f07bce898f8 Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:42 2026 -0600 dt-bindings: mtd: partitions: Convert brcm,trx to DT schema Convert the brcm,trx partition binding to DT schema format. As the "linksys,ns-firmware" compatible also uses "brcm,trx" as a fallback, move it to the converted binding. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 6ecd7715d64ee3bf0b55b374f731d1518b57bc81 Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:41 2026 -0600 dt-bindings: mtd: fixed-partitions: Restrict undefined properties The fixed-partitions schema allowed undefined properties in order to avoid warnings when there are nested fixed-partitions. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 1eb9fabd52933cdf9be349de5391920fac4ed30b Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:40 2026 -0600 dt-bindings: mtd: Ensure partition node properties are documented Partition nodes without a compatible have no restrictions on additional properties. Fix this by ensuring 'unevaluatedProperties' is set when there's no compatible property. If there is a compatible property, then there should be a specific schema for it which will enforce 'unevaluatedProperties'. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 95af1e641b0f245d1d6820bb0c8696fa6a07f5f5 Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:39 2026 -0600 dt-bindings: mtd: partitions: Drop partitions.yaml The partitions.yaml schema is an unusual structure in that it includes all possible partition types, and it disables the normal matching by compatible strings. As partitions.yaml has nothing to match on, it is only applied when explicitly referenced. The use of "oneOf" also results in misleading warnings which are difficult to understand. Drop partitions.yaml and rely on the standard compatible matching instead. The "mmc-card" case previously allowed any partition type, but now only allows "fixed-partitions". There aren't any users and the original intent appeared to be only for "fixed-partitions". Acked-by: Ulf Hansson # For MMC Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 002d2fe7992220fab57497d3d78de526982cf511 Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:38 2026 -0600 dt-bindings: mtd: partitions: Define "#{address,size}-cells" in specific schemas Whether "#address-cells" and "#size-cells" are used or not depends on the specific partition type, so drop them from partitions.yaml and define them in the specific partition schemas as needed. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 9f30ba0a22b79d46689c686546fb3fea28d475a3 Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:37 2026 -0600 dt-bindings: mtd: partitions: Allow "nvmem-layout" in generic partition nodes An "nvmem-layout" node can be used in any partition node, so add it. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit ac83f4fa911dbe6b7ccadeb82c35f2e42d7ce2f1 Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:36 2026 -0600 dt-bindings: mtd: partitions: Move "sercomm,scpart-id" to partition.yaml Defining child node properties specific to the parent schema doesn't work unless all the child node properties are known. They aren't known because any partition can define its own properties. The solution to this is typically something like spi-peripheral-props.yaml, but that's overkill for this single property. Just move it to partition.yaml instead. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 30f138c078525fc49b0694e879a1eb60eda437d4 Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:35 2026 -0600 dt-bindings: mtd: fixed-partitions: Move "compression" to partition node The "compression" property is defined in the wrong place as it applies to individual partitions nodes, not all nodes. Fixes: 8baba8d52ff5 ("dt-bindings: mtd: fixed-partitions: Add compression property") Reviewed-by: Simon Glass Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 4db35366d6dcda7475b75887f89078a11fb2d89a Author: Rob Herring (Arm) Date: Wed Jan 21 13:56:34 2026 -0600 dt-bindings: mtd: brcm,brcmnand: Drop "brcm,brcmnand" compatible for iProc Some users of "brcm,nand-iproc" include "brcm,brcmnand" and some don't. The "brcm,brcmnand" compatible is not useful for iProc systems as there's a separate driver for iProc. So drop it as a fallback. Reviewed-by: William Zhang Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 2b14660c1caf0b67adf99428a225f71ed653437d Author: Chenxi Hou Date: Wed Jan 21 20:32:50 2026 -0500 mtd: jedec_probe: fix shift-out-of-bounds UB in JEDEC ID masking UBSAN reports shift-out-of-bounds in jedec_read_mfr() and jedec_read_id():   UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1924:13   shift exponent 32 is too large for 32-bit type 'int'   UBSAN: shift-out-of-bounds in drivers/mtd/chips/jedec_probe.c:1940:12   shift exponent 32 is too large for 32-bit type 'int' The JEDEC manufacturer/device ID masking uses:   (1 << (cfi->device_type * 8)) - 1 When cfi->device_type is 4, this evaluates to 1 << 32. Since the literal '1' has type int, this is a 32-bit shift and is undefined behavior. Fix it by using a 64-bit literal (1ULL) so the shift is performed in a 64-bit type. Co-developed-by: Hui Peng Signed-off-by: Hui Peng Co-developed-by: Zhihao Yao (Zephyr) Signed-off-by: Zhihao Yao (Zephyr) Signed-off-by: Chenxi Hou Signed-off-by: Miquel Raynal commit 51e8ce3630878fa6083e1eec84f58f49ec85089b Author: Heikki Krogerus Date: Tue Jan 20 14:07:28 2026 +0100 i2c: designware: Remove an unnecessary condition Writing also the high speed timing registers unconditionally. The reset value for these registers is 0, so this should always be safe. Suggested-by: Andy Shevchenko Signed-off-by: Heikki Krogerus Acked-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260120130729.1679560-5-heikki.krogerus@linux.intel.com commit cfbcc20d5c02d6d9e5218ea493fb231b58efe6b3 Author: Heikki Krogerus Date: Tue Jan 20 14:07:27 2026 +0100 i2c: designware: Enable mode swapping The DesignWare I2C can not be operated as I2C master and I2C slave simultaneously, but that does not actually mean master and slave modes can not be supported at the same time. It just means an explicit mode swap needs to be executed when the mode is changed. The DesignWare I2C documentation actually describes a couple of cases where the mode is excepted to be changed. The I2C master will now always be supported. Both modes are now always configured in i2c_dw_configure(), but the slave mode will continue to be available only when the Kconfig option I2C_SLAVE is enabled. The driver will now start in master mode and then swap to slave mode when a slave device is registered. After a slave device is registered, the controller is swapped to master mode when a transfer in master mode is started and then back to slave mode again after the transfer is completed. The DesignWare I2C can now be used with protocols such as MCTP (drivers/net/mctp/mctp-i2c.c) and IPMI (drivers/char/ipmi/) that require support for both I2C master and I2C slave. It is now also possible to support the SMBus Host Notification Protocol as I2C master if needed. Signed-off-by: Heikki Krogerus Acked-by: Mika Westerberg Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260120130729.1679560-4-heikki.krogerus@linux.intel.com commit 38fa29b01a6a295aedb69d1bbdad70acd7d204c6 Author: Heikki Krogerus Date: Tue Jan 20 14:07:26 2026 +0100 i2c: designware: Combine the init functions Providing a single function for controller initialisation. The controller initialisation has the same steps for master and slave modes, except the timing parameters are only needed in master mode. Signed-off-by: Heikki Krogerus Acked-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260120130729.1679560-3-heikki.krogerus@linux.intel.com commit 6062443a0593a0e1d36c3af939dde170a396f1a0 Author: Heikki Krogerus Date: Tue Jan 20 14:07:25 2026 +0100 i2c: designware: Combine some of the common functions The adapter can be registered just in the core instead of separately in the master and slave drivers. The same applies to the interrupt. The dedicated "target only" (slave only) configuration for this controller will be removed so that host mode (master mode) will always be supported together with the target mode. Therefore the descrption for the "target only" configuration that appears in the "name" sysfs attribute file is also dropped while at it. Signed-off-by: Heikki Krogerus Acked-by: Mika Westerberg Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260120130729.1679560-2-heikki.krogerus@linux.intel.com commit 57a96356bb6942e16283138d0a42baad29169ed8 Author: Yicong Yang Date: Mon Jan 19 10:29:28 2026 +0800 kselftest/arm64: Add HWCAP test for FEAT_LS64 Add tests for FEAT_LS64. Issue related instructions if feature presents, no SIGILL should be received. When such instructions operate on Device memory or non-cacheable memory, we may received a SIGBUS during the test (w/o FEAT_LS64WB). Just ignore it since we only tested whether the instruction itself can be issued as expected on platforms declaring the support of such features. Acked-by: Arnd Bergmann Acked-by: Oliver Upton Signed-off-by: Yicong Yang Signed-off-by: Zhou Wang Signed-off-by: Will Deacon commit 58ce78667a641f93afa0c152c700a1673383d323 Author: Yicong Yang Date: Mon Jan 19 10:29:27 2026 +0800 arm64: Add support for FEAT_{LS64, LS64_V} Armv8.7 introduces single-copy atomic 64-byte loads and stores instructions and its variants named under FEAT_{LS64, LS64_V}. These features are identified by ID_AA64ISAR1_EL1.LS64 and the use of such instructions in userspace (EL0) can be trapped. As st64bv (FEAT_LS64_V) and st64bv0 (FEAT_LS64_ACCDATA) can not be tell apart, FEAT_LS64 and FEAT_LS64_ACCDATA which will be supported in later patch will be exported to userspace, FEAT_LS64_V will be enabled only in kernel. In order to support the use of corresponding instructions in userspace: - Make ID_AA64ISAR1_EL1.LS64 visbile to userspace - Add identifying and enabling in the cpufeature list - Expose these support of these features to userspace through HWCAP3 and cpuinfo ld64b/st64b (FEAT_LS64) and st64bv (FEAT_LS64_V) is intended for special memory (device memory) so requires support by the CPU, system and target memory location (device that support these instructions). The HWCAP3_LS64, implies the support of CPU and system (since no identification method from system, so SoC vendors should advertise support in the CPU if system also support them). Otherwise for ld64b/st64b the atomicity may not be guaranteed or a DABT will be generated, so users (probably userspace driver developer) should make sure the target memory (device) also have the support. For st64bv 0xffffffffffffffff will be returned as status result for unsupported memory so user should check it. Document the restrictions along with HWCAP3_LS64. Acked-by: Arnd Bergmann Acked-by: Oliver Upton Signed-off-by: Yicong Yang Signed-off-by: Zhou Wang Signed-off-by: Will Deacon commit 151b92c92a45704216c37d6238efbffd84aac538 Author: Yicong Yang Date: Mon Jan 19 10:29:26 2026 +0800 KVM: arm64: Enable FEAT_{LS64, LS64_V} in the supported guest Using FEAT_{LS64, LS64_V} instructions in a guest is also controlled by HCRX_EL2.{EnALS, EnASR}. Enable it if guest has related feature. Acked-by: Arnd Bergmann Acked-by: Oliver Upton Signed-off-by: Yicong Yang Signed-off-by: Zhou Wang Signed-off-by: Will Deacon commit dea58da4b6fede082d9f38ce069090fd6d43f4e2 Author: Yicong Yang Date: Mon Jan 19 10:29:25 2026 +0800 arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 Instructions introduced by FEAT_{LS64, LS64_V} is controlled by HCRX_EL2.{EnALS, EnASR}. Configure all of these to allow usage at EL0/1. This doesn't mean these instructions are always available in EL0/1 if provided. The hypervisor still have the control at runtime. Acked-by: Will Deacon Acked-by: Arnd Bergmann Acked-by: Oliver Upton Signed-off-by: Yicong Yang Signed-off-by: Zhou Wang Signed-off-by: Will Deacon commit 2937aeec9dc5d25a02c1415a56d88ee4cc17ad83 Author: Yicong Yang Date: Mon Jan 19 10:29:24 2026 +0800 KVM: arm64: Handle DABT caused by LS64* instructions on unsupported memory If FEAT_LS64WB not supported, FEAT_LS64* instructions only support to access Device/Uncacheable memory, otherwise a data abort for unsupported Exclusive or atomic access (0x35, UAoEF) is generated per spec. It's implementation defined whether the target exception level is routed and is possible to implemented as route to EL2 on a VHE VM according to DDI0487L.b Section C3.2.6 Single-copy atomic 64-byte load/store. If it's implemented as generate the DABT to the final enabled stage (stage-2), inject the UAoEF back to the guest after checking the memslot is valid. Acked-by: Arnd Bergmann Acked-by: Oliver Upton Signed-off-by: Yicong Yang Signed-off-by: Zhou Wang Signed-off-by: Will Deacon commit 902eebac8fa3bad1c369f48f2eaf859755ad9e6d Author: Marc Zyngier Date: Mon Jan 19 10:29:23 2026 +0800 KVM: arm64: Add documentation for KVM_EXIT_ARM_LDST64B Add a bit of documentation for KVM_EXIT_ARM_LDST64B so that userspace knows what to expect. Acked-by: Arnd Bergmann Acked-by: Oliver Upton Signed-off-by: Marc Zyngier Signed-off-by: Yicong Yang Signed-off-by: Zhou Wang Signed-off-by: Will Deacon commit f174a9ffcd48d78a45d560c02ce4071ded036b53 Author: Marc Zyngier Date: Mon Jan 19 10:29:22 2026 +0800 KVM: arm64: Add exit to userspace on {LD,ST}64B* outside of memslots The main use of {LD,ST}64B* is to talk to a device, which is hopefully directly assigned to the guest and requires no additional handling. However, this does not preclude a VMM from exposing a virtual device to the guest, and to allow 64 byte accesses as part of the programming interface. A direct consequence of this is that we need to be able to forward such access to userspace. Given that such a contraption is very unlikely to ever exist, we choose to offer a limited service: userspace gets (as part of a new exit reason) the ESR, the IPA, and that's it. It is fully expected to handle the full semantics of the instructions, deal with ACCDATA, the return values and increment PC. Much fun. A canonical implementation can also simply inject an abort and be done with it. Frankly, don't try to do anything else unless you have time to waste. Acked-by: Arnd Bergmann Acked-by: Oliver Upton Signed-off-by: Marc Zyngier Signed-off-by: Yicong Yang Signed-off-by: Zhou Wang Signed-off-by: Will Deacon commit 2c7aa2683bfa80670dc45d310d259544240daea4 Author: Andy Shevchenko Date: Wed Jan 14 09:17:51 2026 +0100 i2c: designware: Use device_is_compatible() instead of custom approach We use MODEL_MSCC_OCELOT effectively as a flag for comparing against "compatible" property. Use device_is_compatible() directly to make it clear. Signed-off-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260114081954.252160-3-andriy.shevchenko@linux.intel.com commit c140dcd1246bfe705921ca881bbb247ff1ba2bca Author: John Johansen Date: Fri Aug 1 02:21:44 2025 -0700 apparmor: make str table more generic and be able to have multiple entries The strtable is currently limited to a single entry string on unpack even though domain has the concept of multiple entries within it. Make this a reality as it will be used for tags and more advanced domain transitions. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit 6fc367bfd4c8886e6b1742aabbd1c0bdc310db3a Author: Helge Deller Date: Wed Nov 26 21:15:04 2025 +0100 apparmor: Fix & Optimize table creation from possibly unaligned memory Source blob may come from userspace and might be unaligned. Try to optize the copying process by avoiding unaligned memory accesses. - Added Fixes tag - Added "Fix &" to description as this doesn't just optimize but fixes a potential unaligned memory access Fixes: e6e8bf418850d ("apparmor: fix restricted endian type warnings for dfa unpack") Signed-off-by: Helge Deller [jj: remove duplicate word "convert" in comment trigger checkpatch warning] Signed-off-by: John Johansen commit 64802f731214a51dfe3c6c27636b3ddafd003eb0 Author: Helge Deller Date: Tue Nov 25 16:11:07 2025 +0100 AppArmor: Allow apparmor to handle unaligned dfa tables The dfa tables can originate from kernel or userspace and 8-byte alignment isn't always guaranteed and as such may trigger unaligned memory accesses on various architectures. Resulting in the following [   73.901376] WARNING: CPU: 0 PID: 341 at security/apparmor/match.c:316 aa_dfa_unpack+0x6cc/0x720 [   74.015867] Modules linked in: binfmt_misc evdev flash sg drm drm_panel_orientation_quirks backlight i2c_core configfs nfnetlink autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid sr_mod hid cdrom sd_mod ata_generic ohci_pci ehci_pci ehci_hcd ohci_hcd pata_ali libata sym53c8xx scsi_transport_spi tg3 scsi_mod usbcore libphy scsi_common mdio_bus usb_common [   74.428977] CPU: 0 UID: 0 PID: 341 Comm: apparmor_parser Not tainted 6.18.0-rc6+ #9 NONE [   74.536543] Call Trace: [   74.568561] [<0000000000434c24>] dump_stack+0x8/0x18 [   74.633757] [<0000000000476438>] __warn+0xd8/0x100 [   74.696664] [<00000000004296d4>] warn_slowpath_fmt+0x34/0x74 [   74.771006] [<00000000008db28c>] aa_dfa_unpack+0x6cc/0x720 [   74.843062] [<00000000008e643c>] unpack_pdb+0xbc/0x7e0 [   74.910545] [<00000000008e7740>] unpack_profile+0xbe0/0x1300 [   74.984888] [<00000000008e82e0>] aa_unpack+0xe0/0x6a0 [   75.051226] [<00000000008e3ec4>] aa_replace_profiles+0x64/0x1160 [   75.130144] [<00000000008d4d90>] policy_update+0xf0/0x280 [   75.201057] [<00000000008d4fc8>] profile_replace+0xa8/0x100 [   75.274258] [<0000000000766bd0>] vfs_write+0x90/0x420 [   75.340594] [<00000000007670cc>] ksys_write+0x4c/0xe0 [   75.406932] [<0000000000767174>] sys_write+0x14/0x40 [   75.472126] [<0000000000406174>] linux_sparc_syscall+0x34/0x44 [   75.548802] ---[ end trace 0000000000000000 ]--- [   75.609503] dfa blob stream 0xfff0000008926b96 not aligned. [   75.682695] Kernel unaligned access at TPC[8db2a8] aa_dfa_unpack+0x6e8/0x720 Work around it by using the get_unaligned_xx() helpers. Fixes: e6e8bf418850d ("apparmor: fix restricted endian type warnings for dfa unpack") Reported-by: John Paul Adrian Glaubitz Closes: https://github.com/sparclinux/issues/issues/30 Signed-off-by: Helge Deller Signed-off-by: John Johansen commit 1c90ed1f14c9892c24d5252a2966470f4937f7a2 Author: Thorsten Blum Date: Thu Oct 16 17:41:10 2025 +0200 apparmor: Replace deprecated strcpy with memcpy in gen_symlink_name strcpy() is deprecated; use memcpy() instead. Unlike strcpy(), memcpy() does not copy the NUL terminator from the source string, which would be overwritten anyway on every iteration when using strcpy(). snprintf() then ensures that 'char *s' is NUL-terminated. Replace the hard-coded path length to remove the magic number 6, and add a comment explaining the extra 11 bytes. Closes: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: John Johansen commit 00b67657535dfea56e84d11492f5c0f61d0af297 Author: John Johansen Date: Mon Nov 24 15:07:42 2025 -0800 apparmor: fix NULL sock in aa_sock_file_perm Deal with the potential that sock and sock-sk can be NULL during socket setup or teardown. This could lead to an oops. The fix for NULL pointer dereference in __unix_needs_revalidation shows this is at least possible for af_unix sockets. While the fix for af_unix sockets applies for newer mediation this is still the fall back path for older af_unix mediation and other sockets, so ensure it is covered. Fixes: 56974a6fcfef6 ("apparmor: add base infastructure for socket mediation") Reviewed-by: Georgia Garcia Signed-off-by: John Johansen commit b00a7b3a612925faa7362f5c61065e3e5f393fff Author: Ethan Nelson-Moore Date: Wed Jan 21 00:45:04 2026 -0800 net: atp: drop ancient parallel-port Ethernet driver This driver is old and almost certainly entirely unused. The two other parallel port Ethernet drivers (de600/de620) were removed by Paul Gortmaker in commit 168e06ae26dd ("drivers/net: delete old parallel port de600/de620 drivers"), but this driver remained. Drop it - Paul's reasoning applies here as well. To quote him: "The parallel port is largely replaced by USB [...] Let us not pretend that anyone cares about these drivers anymore, or worse - pretend that anyone is using them on a modern kernel." Signed-off-by: Ethan Nelson-Moore Acked-by: Daniel Palmer Link: https://patch.msgid.link/20260121084532.60606-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni commit a2ba9902e4b932537df402494b2657bd249fcf0b Author: David Yang Date: Wed Jan 21 16:25:46 2026 +0800 xen/netfront: Use u64_stats_t with u64_stats_sync properly On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. Convert to u64_stats_t to ensure atomic operations. Signed-off-by: David Yang Link: https://patch.msgid.link/20260121082550.2389249-1-mmyangfl@gmail.com Signed-off-by: Paolo Abeni commit cbe38d2e52cf1798b0838e440b3d95723a56dcc2 Author: David Yang Date: Wed Jan 21 16:23:44 2026 +0800 net: ifb: use u64_stats_t with u64_stats_sync properly On 64bit arches, struct u64_stats_sync is empty and provides no help against load/store tearing. Convert to u64_stats_t to ensure atomic operations. Signed-off-by: David Yang Link: https://patch.msgid.link/20260121082348.2388314-1-mmyangfl@gmail.com Signed-off-by: Paolo Abeni commit 2a369c4942489aeab799a7509b7cc721eecafa8a Author: Thomas Weißschuh Date: Sat Jan 17 13:10:51 2026 +0100 kselftest/arm64: Use syscall() macro over nolibc my_syscall() The my_syscall*() macros are internal implementation details of nolibc. Nolibc also provides the regular syscall(2), which is also a macro and directly expands to the correct my_syscall(). Use syscall() instead. As a side-effect this fixes some return value checks, as my_syscall() returns the raw value as set by the kernel and does not set errno. Signed-off-by: Thomas Weißschuh Acked-by: Mark Brown Signed-off-by: Will Deacon commit 53f45f045cbe89024d2b71c145c782bb6a82a602 Author: Breno Leitao Date: Mon Dec 22 07:28:55 2025 -0800 arm64: mm: warn once for ioremap attempts on RAM mappings Replace WARN_ON with WARN_ONCE when detecting attempts to ioremap RAM. This prevents log spam when a misbehaving driver repeatedly tries to map RAM via ioremap. A single warning is more than enough to show the broken code path, and extra reports don't add extra information. Warning floods have been seen in production environments where broken external drivers hit this code path thousand of times, causing unnecessary messages to be printed and pressure on the serial console. Signed-off-by: Breno Leitao Acked-by: Catalin Marinas Signed-off-by: Will Deacon commit 747d5b6735caa0178b3f1c922cfa9c285b093f22 Author: Geert Uytterhoeven Date: Thu Jan 15 09:51:45 2026 +0100 arm64: topology: Do not warn on missing AMU in cpuhp_topology_online() When CONFIG_CPUMASK_OFFSTACK is not enabled, and resuming from s2ram on Renesas R-Car H3 (big.LITTLE 4x Cortex-A57 + 4x Cortex-A53), during enabling of the first little core, a warning message is printed: AMU: CPU[4] doesn't support AMU counters This confuses users, as during boot amu_fie_setup() does not print such a message, unless debugging is enabled (freq_counters_valid() prints "CPU%d: counters are not supported.\n" at debug level in that case). Hence drop the warning, freq_counters_valid() has already printed a debug message anyway. Fixes: 6fd9be0b7b2e ("arm64: topology: Handle AMU FIE setup on CPU hotplug") Signed-off-by: Geert Uytterhoeven Reviewed-by: Lifeng Zheng Signed-off-by: Will Deacon commit 40cb4cb77ea26d65156f0442c846d5f7ff497839 Author: Will Rosenberg Date: Tue Jan 20 08:57:38 2026 -0700 cipso: harden use of skb_cow() in cipso_v4_skbuff_setattr() If skb_cow() is passed a headroom <= -NET_SKB_PAD, it will trigger a BUG. As a result, use cases should avoid calling with a headroom that is negative to prevent triggering this issue. This is the same code pattern fixed in Commit 58fc7342b529 ("ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()"). In cipso_v4_skbuff_setattr(), len_delta can become negative, leading to a negative headroom passed to skb_cow(). However, the BUG is not triggerable because the condition headroom <= -NET_SKB_PAD cannot be satisfied due to limits on the IPv4 options header size. Avoid potential problems in the future by only using skb_cow() to grow the skb headroom. Signed-off-by: Will Rosenberg Acked-by: Paul Moore Link: https://patch.msgid.link/20260120155738.982771-1-whrosenb@asu.edu Signed-off-by: Paolo Abeni commit b6d5a62231acd628c4a989cad562fe37958b1218 Merge: 0b42aeb46873c0 429208aab9db64 Author: Paolo Abeni Date: Thu Jan 22 11:20:34 2026 +0100 t Merge branch 'a-series-of-minor-optimizations-of-the-bonding-module' Tonghao Zhang says: ==================== A series of minor optimizations of the bonding module These patches mainly target the peer notify mechanism of the bonding module. Including updates of peer notify, lock races, etc. For more information, please refer to the patch. Cc: Jay Vosburgh Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Nikolay Aleksandrov Cc: Hangbin Liu Cc: Jason Xing ==================== Link: https://patch.msgid.link/cover.1768709239.git.tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit 429208aab9db641e52ee2a2da3ab50fa9eacdb9f Author: Tonghao Zhang Date: Sun Jan 18 12:21:14 2026 +0800 net: bonding: add the READ_ONCE/WRITE_ONCE for outside lock accessing Although operations on the variable send_peer_notif are already within a lock-protected critical section, there are cases where it is accessed outside the lock. Therefore, READ_ONCE() and WRITE_ONCE() should be added to it. Cc: Jay Vosburgh Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Nikolay Aleksandrov Cc: Hangbin Liu Cc: Jason Xing Signed-off-by: Tonghao Zhang Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/c1dcc53442f4d0f67beb9e0a3e7a7a6a2c94c47f.1768709239.git.tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit f1986b3a9f2e281c6c784d1ece70a065f3f9545e Author: Tonghao Zhang Date: Sun Jan 18 12:21:13 2026 +0800 net: bonding: skip the 2nd trylock when first one fail After the first trylock fail, retrying immediately is not advised as there is a high probability of failing to acquire the lock again. This optimization makes sense. Cc: Jay Vosburgh Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Nikolay Aleksandrov Cc: Hangbin Liu Cc: Jason Xing Signed-off-by: Tonghao Zhang Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/9aba44f02163e8fe8dbaba63ff2df921bc2b114e.1768709239.git.tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit 70fc6649b36cf22167bbd7e2a6cc0960b746316e Author: Tonghao Zhang Date: Sun Jan 18 12:21:12 2026 +0800 net: bonding: move bond_should_notify_peers, e.g. into rtnl lock block This patch tries to avoid the possible peer notify event loss. In bond_mii_monitor()/bond_activebackup_arp_mon(), when we hold the rtnl lock: - check send_peer_notif again to avoid unconditionally reducing this value. - send_peer_notif may have been reset. Therefore, it is necessary to check whether to send peer notify via bond_should_notify_peers() to avoid the loss of notification events. Cc: Jay Vosburgh Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Nikolay Aleksandrov Cc: Hangbin Liu Cc: Jason Xing Signed-off-by: Tonghao Zhang Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/78cef328822b94638c97638b89011c507b8bf19e.1768709239.git.tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit 11ea9b8a88dd7524c23dffc22d8173504273a9db Author: Tonghao Zhang Date: Sun Jan 18 12:21:11 2026 +0800 net: bonding: use workqueue to make sure peer notify updated in lacp mode The rtnl lock might be locked, preventing ad_cond_set_peer_notif() from acquiring the lock and updating send_peer_notif. This patch addresses the issue by using a workqueue. Since updating send_peer_notif does not require high real-time performance, such delayed updates are entirely acceptable. In fact, checking this value and using it in multiple places, all operations are protected at the same time by rtnl lock, such as - read send_peer_notif - send_peer_notif-- - bond_should_notify_peers By the way, rtnl lock is still required, when accessing bond.params.* for updating send_peer_notif. In lacp mode, resetting send_peer_notif in workqueue is safe, simple and effective way. Additionally, this patch introduces bond_peer_notify_may_events(), which is used to check whether an event should be sent. This function will be used in both patch 1 and 2. Cc: Jay Vosburgh Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Nikolay Aleksandrov Cc: Hangbin Liu Cc: Jason Xing Suggested-by: Hangbin Liu Signed-off-by: Tonghao Zhang Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/f95accb5db0b10ce3ed2f834fc70f716c9abbb9c.1768709239.git.tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit 018a231b0260ebd85eddca3fec85031b59f50117 Author: Marc Zyngier Date: Wed Jan 7 18:07:00 2026 +0000 arm64: Unconditionally enable PAN support FEAT_PAN has been around since ARMv8.1 (over 11 years ago), has no compiler dependency (we have our own accessors), and is a great security benefit. Drop CONFIG_ARM64_PAN, and make the support unconditionnal. Signed-off-by: Marc Zyngier Signed-off-by: Will Deacon commit 6191b25d8bd902c1a107170df54bddbb0e2335f8 Author: Marc Zyngier Date: Wed Jan 7 18:06:59 2026 +0000 arm64: Unconditionally enable LSE support LSE atomics have been in the architecture since ARMv8.1 (released in 2014), and are hopefully supported by all modern toolchains. Drop the optional nature of LSE support in the kernel, and always compile the support in, as this really is very little code. LL/SC still is the default, and the switch to LSE is done dynamically. Signed-off-by: Marc Zyngier Signed-off-by: Will Deacon commit 377521af0341083bc9d196cf021ec7265dc47c20 Author: Christoph Hellwig Date: Thu Jan 22 09:52:23 2026 +0100 sched: remove task_struct->faults_disabled_mapping This reverts commit 2b69987be575 ("sched: Add task_struct->faults_disabled_mapping"), which added this field without review or maintainer signoff. With bcachefs removed from the tree it is also unused now. Signed-off-by: Christoph Hellwig Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260122085223.487092-1-hch@lst.de commit 4b603f1551a73e2868b9e7a14b3938c23275cefb Author: Shubhang Kaushik Date: Wed Jan 21 01:31:53 2026 -0800 sched: Update rq->avg_idle when a task is moved to an idle CPU Currently, rq->idle_stamp is only used to calculate avg_idle during wakeups. This means other paths that move a task to an idle CPU such as fork/clone, execve, or migrations, do not end the CPU's idle status in the scheduler's eyes, leading to an inaccurate avg_idle. This patch introduces update_rq_avg_idle() to provide a more accurate measurement of CPU idle duration. By invoking this helper in put_prev_task_idle(), we ensure avg_idle is updated whenever a CPU stops being idle, regardless of how the new task arrived. Testing on an 80-core Ampere Altra (ARMv8) with 6.19-rc5 baseline: - Hackbench : +7.2% performance gain at 16 threads. - Schbench: Reduced p99.9 tail latencies at high concurrency. Signed-off-by: Shubhang Kaushik Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Vincent Guittot Tested-by: Shubhang Kaushik Link: https://patch.msgid.link/20260121-v8-patch-series-v8-1-b7f1cbee5055@os.amperecomputing.com commit bb332a9e5a057d2cb9b90e307b26cce9b1f6f660 Author: Peter Zijlstra Date: Wed Jan 21 15:10:29 2026 +0100 selftests/rseq: Add rseq slice histogram script A script that processes trace-cmd data and generates a histogram of rseq slice_ext durations for the recorded workload. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260121143208.340549136@infradead.org commit 5d6446f409da00e5a389125ddb5ce09f5bc404c9 Author: Thomas Gleixner Date: Mon Jan 19 11:38:34 2026 +0100 hrtimer: Fix trace oddity It turns out that __run_hrtimer() will trace like: -0 [032] d.h2. 20705.474563: hrtimer_cancel: hrtimer=0xff2db8f77f8226e8 -0 [032] d.h1. 20705.474563: hrtimer_expire_entry: hrtimer=0xff2db8f77f8226e8 now=20699452001850 function=tick_nohz_handler/0x0 Which is a bit nonsensical, the timer doesn't get canceled on expiration. The cause is the use of the incorrect debug helper. Fixes: c6a2a1770245 ("hrtimer: Add tracepoint for hrtimers") Reported-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260121143208.219595606@infradead.org commit 21c0e92d0681fbd10ac024311bd09bca439e0bb1 Author: Peter Zijlstra Date: Wed Jan 21 14:25:04 2026 +0100 rseq: Lower default slice extension Change the minimum slice extension to 5 usec. Since slice_test selftest reaches a staggering ~350 nsec extension: Task: slice_test Mean: 350.266 ns Latency (us) | Count ------------------------------ EXPIRED | 238 0 us | 143189 1 us | 167 2 us | 26 3 us | 11 4 us | 28 5 us | 31 6 us | 22 7 us | 23 8 us | 32 9 us | 16 10 us | 35 Lower the minimal (and default) value to 5 usecs -- which is still massive. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260121143208.073200729@infradead.org commit e1d7f54900f1e1d3003a85b78cd7105a64203ff7 Author: Peter Zijlstra Date: Wed Jan 21 14:21:51 2026 +0100 rseq: Move slice_ext_nsec to debugfs Move changing the slice ext duration to debugfs, a sliglty less permanent interface. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260121143207.923520192@infradead.org commit d6200245c75e832af2087bc60ba2e6641a90eee9 Author: Peter Zijlstra Date: Mon Jan 19 11:23:57 2026 +0100 rseq: Allow registering RSEQ with slice extension Since glibc cares about the number of syscalls required to initialize a new thread, allow initializing rseq with slice extension on. This avoids having to do another prctl(). Requested-by: Mathieu Desnoyers Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260121143207.814193010@infradead.org commit 830969e7821af377bdc1bb016929ff28c78490e8 Author: Thomas Gleixner Date: Mon Dec 15 17:52:34 2025 +0100 selftests/rseq: Implement time slice extension test Provide an initial test case to evaluate the functionality. This needs to be extended to cover the ABI violations and expose the race condition between observing granted and arriving in rseq_slice_yield(). Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251215155709.320325431@linutronix.de commit 3c78aaec19b0621bf952756670c8b066a55202fe Author: Thomas Gleixner Date: Mon Dec 15 17:52:31 2025 +0100 entry: Hook up rseq time slice extension Wire the grant decision function up in exit_to_user_mode_loop() Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251215155709.258157362@linutronix.de commit dfb630f548a7c715efb0651c6abf334dca75cd52 Author: Thomas Gleixner Date: Mon Dec 15 17:52:28 2025 +0100 rseq: Implement rseq_grant_slice_extension() Provide the actual decision function, which decides whether a time slice extension is granted in the exit to user mode path when NEED_RESCHED is evaluated. The decision is made in two stages. First an inline quick check to avoid going into the actual decision function. This checks whether: #1 the functionality is enabled #2 the exit is a return from interrupt to user mode #3 any TIF bit, which causes extra work is set. That includes TIF_RSEQ, which means the task was already scheduled out. The slow path, which implements the actual user space ABI, is invoked when: A) #1 is true, #2 is true and #3 is false It checks whether user space requested a slice extension by setting the request bit in the rseq slice_ctrl field. If so, it grants the extension and stores the slice expiry time, so that the actual exit code can double check whether the slice is already exhausted before going back. B) #1 - #3 are true _and_ a slice extension was granted in a previous loop iteration In this case the grant is revoked. In case that the user space access faults or invalid state is detected, the task is terminated with SIGSEGV. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251215155709.195303303@linutronix.de commit 7ee58f98b59b0ec32ea8a92f0bc85cb46fcd3de3 Author: Thomas Gleixner Date: Mon Dec 15 17:52:26 2025 +0100 rseq: Reset slice extension when scheduled When a time slice extension was granted in the need_resched() check on exit to user space, the task can still be scheduled out in one of the other pending work items. When it gets scheduled back in, and need_resched() is not set, then the stale grant would be preserved, which is just wrong. RSEQ already keeps track of that and sets TIF_RSEQ, which invokes the critical section and ID update mechanisms. Utilize them and clear the user space slice control member of struct rseq unconditionally within the existing user access sections. That's just an unconditional store more in that path. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251215155709.131081527@linutronix.de commit 0ac3b5c3dc45085b28a10ee730fb2860841f08ef Author: Thomas Gleixner Date: Mon Dec 15 17:52:22 2025 +0100 rseq: Implement time slice extension enforcement timer If a time slice extension is granted and the reschedule delayed, the kernel has to ensure that user space cannot abuse the extension and exceed the maximum granted time. It was suggested to implement this via the existing hrtick() timer in the scheduler, but that turned out to be problematic for several reasons: 1) It creates a dependency on CONFIG_SCHED_HRTICK, which can be disabled independently of CONFIG_HIGHRES_TIMERS 2) HRTICK usage in the scheduler can be runtime disabled or is only used for certain aspects of scheduling. 3) The function is calling into the scheduler code and that might have unexpected consequences when this is invoked due to a time slice enforcement expiry. Especially when the task managed to clear the grant via sched_yield(0). It would be possible to address #2 and #3 by storing state in the scheduler, but that is extra complexity and fragility for no value. Implement a dedicated per CPU hrtimer instead, which is solely used for the purpose of time slice enforcement. The timer is armed when an extension was granted right before actually returning to user mode in rseq_exit_to_user_mode_restart(). It is disarmed, when the task relinquishes the CPU. This is expensive as the timer is probably the first expiring timer on the CPU, which means it has to reprogram the hardware. But that's less expensive than going through a full hrtimer interrupt cycle for nothing. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251215155709.068329497@linutronix.de commit dd0a04606937af5810e9117d343ee3792635bd3d Author: Thomas Gleixner Date: Mon Dec 15 17:52:19 2025 +0100 rseq: Implement syscall entry work for time slice extensions The kernel sets SYSCALL_WORK_RSEQ_SLICE when it grants a time slice extension. This allows to handle the rseq_slice_yield() syscall, which is used by user space to relinquish the CPU after finishing the critical section for which it requested an extension. In case the kernel state is still GRANTED, the kernel resets both kernel and user space state with a set of sanity checks. If the kernel state is already cleared, then this raced against the timer or some other interrupt and just clears the work bit. Doing it in syscall entry work allows to catch misbehaving user space, which issues an arbitrary syscall, i.e. not rseq_slice_yield(), from the critical section. Contrary to the initial strict requirement to use rseq_slice_yield() arbitrary syscalls are not considered a violation of the ABI contract anymore to allow onion architecture applications, which cannot control the code inside a critical section, to utilize this as well. If the code detects inconsistent user space that result in a SIGSEGV for the application. If the grant was still active and the task was not preempted yet, the work code reschedules immediately before continuing through the syscall. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251215155709.005777059@linutronix.de commit 99d2592023e5d0a31f5f5a83c694df48239a1e6c Author: Thomas Gleixner Date: Mon Dec 15 17:52:15 2025 +0100 rseq: Implement sys_rseq_slice_yield() Provide a new syscall which has the only purpose to yield the CPU after the kernel granted a time slice extension. sched_yield() is not suitable for that because it unconditionally schedules, but the end of the time slice extension is not required to schedule when the task was already preempted. This also allows to have a strict check for termination to catch user space invoking random syscalls including sched_yield() from a time slice extension region. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20251215155708.929634896@linutronix.de commit 28621ec2d46c6adf7d33a6facbd83e2fa566bd34 Author: Thomas Gleixner Date: Mon Dec 15 17:52:12 2025 +0100 rseq: Add prctl() to enable time slice extensions Implement a prctl() so that tasks can enable the time slice extension mechanism. This fails, when time slice extensions are disabled at compile time or on the kernel command line and when no rseq pointer is registered in the kernel. That allows to implement a single trivial check in the exit to user mode hotpath, to decide whether the whole mechanism needs to be invoked. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251215155708.858717691@linutronix.de commit b5b8282441bc4f8f1ff505e19d566dbd7b805761 Author: Thomas Gleixner Date: Mon Dec 15 17:52:09 2025 +0100 rseq: Add statistics for time slice extensions Extend the quick statistics with time slice specific fields. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251215155708.795202254@linutronix.de commit f8380f976804533df4c6c3d3a0b2cd03c2d262bc Author: Thomas Gleixner Date: Mon Dec 15 17:52:06 2025 +0100 rseq: Provide static branch for time slice extensions Guard the time slice extension functionality with a static key, which can be disabled on the kernel command line. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251215155708.733429292@linutronix.de commit d7a5da7a0f7fa7ff081140c4f6f971db98882703 Author: Thomas Gleixner Date: Mon Dec 15 17:52:04 2025 +0100 rseq: Add fields and constants for time slice extension Aside of a Kconfig knob add the following items: - Two flag bits for the rseq user space ABI, which allow user space to query the availability and enablement without a syscall. - A new member to the user space ABI struct rseq, which is going to be used to communicate request and grant between kernel and user space. - A rseq state struct to hold the kernel state of this - Documentation of the new mechanism Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251215155708.669472597@linutronix.de commit 4fe82cf3024a4bdd2571d584efc25598533d5c96 Author: Fushuai Wang Date: Sat Jan 17 22:56:14 2026 +0800 sched/debug: Convert copy_from_user() + kstrtouint() to kstrtouint_from_user() Using kstrtouint_from_user() instead of copy_from_user() + kstrtouint() makes the code simpler and less error-prone. Suggested-by: Yury Norov Signed-off-by: Fushuai Wang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Yury Norov Link: https://patch.msgid.link/20260117145615.53455-2-fushuai.wang@linux.dev commit c0398be9890d17d0d711288e9eeaa8de66af7635 Merge: 3bce0076f94eee 1a1b4d40b8e456 Author: Krzysztof Kozlowski Date: Thu Jan 22 11:09:43 2026 +0100 Merge tag 'apple-soc-dt-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt Apple SoC DT update for 6.20 - Add all required nodes and connections for USB3 support. This is responsible for the majority of the diffstat. The dt-bindings for the Type-C PHY are scheduled to be sent via the PHY tree and are already in next. - Add RTC subnodes to the System Management Controller - Add chassis-type property for all M1 and M2 machines - Fix some minor power management issues - Add backlight nodes for the A9X-based iPad Pro * tag 'apple-soc-dt-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: arm64: dts: apple: t60xx: Add nodes for integrated USB Type-C ports arm64: dts: apple: t8112: Add nodes for integrated USB Type-C ports arm64: dts: apple: t8103: Add nodes for integrated USB Type-C ports arm64: dts: apple: t8103: Add ps_pmp dependency to ps_gfx arm64: dts: apple: t8103: Mark ATC USB AON domains as always-on arm64: dts: apple: t8112-j473: Keep the HDMI port powered on arm64: dts: apple: Add chassis-type property for Apple iMacs arm64: dts: apple: Add chassis-type property for Mac Pro arm64: dts: apple: Add chassis-type property for Apple desktop devices arm64: dts: apple: Add chassis-type property for all Macbooks arm64: dts: apple: s8001: Add DWI backlight for J98a, J99a arm64: dts: apple: t8103,t60xx,t8112: Add SMC RTC node Signed-off-by: Krzysztof Kozlowski commit 3bce0076f94eeead971b9641a72c69012c9fd5da Merge: 0a976e907a15f9 2940a49ab7e31e Author: Krzysztof Kozlowski Date: Thu Jan 22 11:05:15 2026 +0100 Merge tag 'lpc32xx-dt-for-6.20' of https://github.com/vzapolskiy/linux-lpc32xx into soc/dt ARM: nxp: lpc: device tree updates for v6.20 This pull request contains device tree changes for ARM NXP LPC32xx intended for v6.20, please pull the following: - Frank fixes device tree checker warnings reported for NXP LPC32xx boards, - Piotr addes a DMA mux block under SCB, DMA properties to controllers and I2S support for NXP LPC32xx, - Kuldeep corrects values of PrimeCell PL022 'clocks' and 'clock-names' properties, this is the change from a waiting queue, recently it was repeatedly done by Frank, the hesitation was about a probable ABI break, but here in particular the risk is practically negligible due to the kept backwards compatibale 'clocks' property, - Vladimir adds a few missing properties to a number of LPC32xx controllers. * tag 'lpc32xx-dt-for-6.20' of https://github.com/vzapolskiy/linux-lpc32xx: arm: dts: lpc32xx: add interrupts property to Motor Control PWM arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node ARM: dts: lpc32xx: Add missing properties to I2S device tree nodes ARM: dts: lpc32xx: Declare the second AHB master support on PL080 DMA controller ARM: dts: lpc32xx: Add missing DMA properties ARM: dts: lpc32xx: Use syscon for system control block ARM: dts: lpc32xx: describe FLASH_INT of SLC NAND controller ARM: dts: lpc32xx: change NAND controllers node names ARM: dts: lpc32xx: Update spi clock properties ARM: dts: lpc3250-phy3250: replace deprecated at25 properties with new ones ARM: dts: lpc3250-phy3250: rename nodename at@0 to eeprom@0 ARM: dts: lpc3250-ea3250: add key- prefix for gpio-keys ARM: dts: lpc32xx: remove usb bus and elevate all children nodes Signed-off-by: Krzysztof Kozlowski commit 0a976e907a15f9b36eef82bde241c02bd137a21c Merge: 332bd42e2f80e3 e600933b6e5183 Author: Krzysztof Kozlowski Date: Thu Jan 22 10:59:14 2026 +0100 Merge tag 'aspeed-6.20-devicetree-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt aspeed: second batch of arm devicetree changes for 6.20 New platforms: - Facebook Anacapa The Meta Anacapa BMC is the DC-SCM (Data Center Secure Control Module) controller for the Meta OCP Open Rack Wide (ORW) compute tray. This platform is a key component of the AMD Helios AI rack reference design system, designed for next-generation AI workloads. The BMC utilizes the Aspeed AST2600 SoC to manage the compute tray, which contains up to 4 AMD Instinct MI450 Series GPUs (connected via a Broadcom OCP NIC) and host CPUs. Its primary role is to provide essential system control, power sequencing, and telemetry reporting for the compute complex via the OpenBMC software stack. For more detail on the AMD Helios reference design: https://www.amd.com/en/blogs/2025/amd-helios-ai-rack-built-on-metas-2025-ocp-design.html - ASRock Rack ALTRAD8 The ALTRAD8 BMC is an Aspeed AST2500-based BMC for the ASRock Rack ALTRAD8UD-1L2T and ALTRAD8UD2-1L2Q boards. Significant changes: - Switch IBM FSI CFAM nodes to use non-deprecated AT25 properties Updated platforms: - bletchley (Facebook): USB-C tweaks * tag 'aspeed-6.20-devicetree-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: dts: aspeed: ibm: Use non-deprecated AT25 properties ARM: dts: aspeed: add device tree for ASRock Rack ALTRAD8 BMC dt-bindings: arm: aspeed: add ASRock Rack ALTRAD8 board ARM: dts: aspeed: bletchley: Remove try-power-role from connectors ARM: dts: aspeed: Add Facebook Anacapa platform dt-bindings: arm: aspeed: Add compatible for Facebook Anacapa BMC Signed-off-by: Krzysztof Kozlowski commit 332bd42e2f80e3c4d9610c21abf61e766a7bd5c1 Merge: ccbd9e92c43670 c6a40c867467c2 Author: Krzysztof Kozlowski Date: Thu Jan 22 10:54:58 2026 +0100 Merge tag 'nuvoton-arm64-6.20-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt Nuvoton arm64 devicetree changes for 6.20 Just the one patch from Rob adding the device_type property to the memory node of the NPCM845 EVB DTS. * tag 'nuvoton-arm64-6.20-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: arm64: dts: nuvoton: Add missing "device_type" property on memory node Signed-off-by: Krzysztof Kozlowski commit e9a5415adb209f86a05e55b850127ada82e070f1 Author: Samuel Holland Date: Fri Jan 9 19:34:30 2026 +0800 PCI: dwc: Use multiple iATU windows for mapping large bridge windows and DMA ranges The DWC driver tries to use a single iATU region for mapping the individual entries of the bridge window and DMA range. If a bridge window/DMA range is larger than the iATU inbound/outbound window size, then the mapping will fail. Hence, avoid this failure by using multiple iATU windows to map the whole region. If the region runs out of iATU windows, then return failure. Signed-off-by: Charles Mirabile Signed-off-by: Samuel Holland Co-developed-by: Randolph Lin Signed-off-by: Randolph Lin [mani: reworded description, minor code cleanup] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Reviewed-by: Frank Li Acked-by: Charles Mirabile Link: https://patch.msgid.link/20260109113430.2767264-1-randolph@andestech.com commit f6c8955f08749e2ded547a48ce6002df2c100859 Author: AngeloGioacchino Del Regno Date: Mon Jan 12 15:55:57 2026 +0100 arm64: dts: marvell: Add SoC specific compatibles to SafeXcel crypto Following the changes in the binding for the SafeXcel crypto engine, add SoC specific compatibles to the existing nodes in Armada 37xx and CP11x. Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Gregory CLEMENT commit 2eb80a2eee18762a33aa770d742d64fe47852c7e Author: Zenghui Yu (Huawei) Date: Wed Jan 21 18:16:31 2026 +0800 KVM: arm64: nv: Return correct RES0 bits for FGT registers We had extended the sysreg masking infrastructure to more general registers, instead of restricting it to VNCR-backed registers, since commit a0162020095e ("KVM: arm64: Extend masking facility to arbitrary registers"). Fix kvm_get_sysreg_res0() to reflect this fact. Note that we're sure that we only deal with FGT registers in kvm_get_sysreg_res0(), the if (sr < __VNCR_START__) is actually a never false, which should probably be removed later. Fixes: 69c19e047dfe ("KVM: arm64: Add TCR2_EL2 to the sysreg arrays") Signed-off-by: Zenghui Yu (Huawei) Link: https://patch.msgid.link/20260121101631.41037-1-zenghui.yu@linux.dev Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org commit ae801944cbfb70326afc373c11a282d1ce3bae97 Author: Mukesh Kumar Sisodiya Date: Fri Dec 26 15:04:08 2025 +0000 fpga: dfl: fix typo in header file fix typo "definitons" ==> "definitions" in DFHv1 Register Offset comment. Signed-off-by: Mukesh Kumar Sisodiya Link: https://lore.kernel.org/r/20251226150408.2802-1-mukeshkumarsisodiya1981@gmail.com Reviewed-by: Xu Yilun Signed-off-by: Xu Yilun commit 0b42aeb46873c0204c15ff3f11d31f3a4133776b Author: David Yang Date: Sun Jan 18 00:21:11 2026 +0800 net: dsa: yt921x: Add LAG offloading support Add offloading for a link aggregation group supported by the YT921x switches. Signed-off-by: David Yang Link: https://patch.msgid.link/20260117162116.1063043-1-mmyangfl@gmail.com Signed-off-by: Paolo Abeni commit ccbd9e92c43670109e3a07fbbfb4b3d9beb50aea Merge: 43fdf9c1209313 da0de806d8b462 Author: Krzysztof Kozlowski Date: Thu Jan 22 10:02:15 2026 +0100 Merge tag 'v6.20-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: Orange Pi CM5 module + Baseboard, Radxa CM5 module + IO-board. PCIe-slot-overlay for rk3576-evb1 New peripherals: some of the video decoders on rk3576 and rk3588 Enabled peripherals: many RK3588-NPUs and a lot of other peripherals on a plethora of boards. * tag 'v6.20-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (40 commits) arm64: dts: rockchip: Add the vdpu383 Video Decoder on rk3576 arm64: dts: rockchip: Add the vdpu381 Video Decoders on RK3588 arm64: dts: rockchip: Add rk3588s-orangepi-cm5-base device tree dt-bindings: arm: rockchip: Add Orange Pi CM5 Base arm64: dts: rockchip: Enable second HDMI output on CM3588 arm64: dts: rockchip: Add HDMI to Gameforce Ace arm64: dts: rockchip: Enable analog sound on RK3576 EVB1 arm64: dts: rockchip: Enable HDMI sound on RK3576 EVB1 arm64: dts: rockchip: Enable HDMI sound on Luckfox Core3576 arm64: dts: rockchip: Enable HDMI sound on FriendlyElec NanoPi M5 arm64: dts: rockchip: Use a readable audio card name on NanoPi M5 arm64: dts: rockchip: enable NPU on rk3588-jaguar arm64: dts: rockchip: enable NPU on rk3588-tiger dt-bindings: arm: rockchip: fix description for Radxa CM5 dt-bindings: arm: rockchip: fix description for Radxa CM3I arm64: dts: rockchip: Add missing everest,es8388 supplies to rk3399-roc-pc-plus arm64: dts: rockchip: Enable PCIe for ArmSoM Sige1 arm64: dts: rockchip: Enable the NPU on Turing RK1 arm64: dts: rockchip: Enable the NPU on FriendlyElec CM3588 arm64: dts: rockchip: Enable the NPU on NanoPC T6/T6-LTS ... Signed-off-by: Krzysztof Kozlowski commit 54adbfe40e3b6d238293cc36ef071ed9f35c8af7 Author: Marc Zyngier Date: Thu Jan 22 08:51:53 2026 +0000 KVM: arm64: Always populate FGT masks at boot time We currently only populate the FGT masks if the underlying HW does support FEAT_FGT. However, with the addition of the RES1 support for system registers, this results in a lot of noise at boot time, as reported by Nathan. That's because even if FGT isn't supported, we still check for the attribution of the bits to particular features, and not keeping the masks up-to-date leads to (fairly harmess) warnings. Given that we want these checks to be enforced even if the HW doesn't support FGT, enable the generation of FGT masks unconditionally (this is rather cheap anyway). Only the storage of the FGT configuration is avoided, which will save a tiny bit of memory on these machines. Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Fixes: c259d763e6b09 ("KVM: arm64: Account for RES1 bits in DECLARE_FEAT_MAP() and co") Link: https://lore.kernel.org/r/20260120211558.GA834868@ax162 Link: https://patch.msgid.link/20260122085153.535538-1-maz@kernel.org Signed-off-by: Marc Zyngier commit 43fdf9c12093135dc5bc953ef8d3ad3af12ed71c Merge: 94cdfe3980539d e74470cf3101da Author: Krzysztof Kozlowski Date: Thu Jan 22 09:58:41 2026 +0100 Merge tag 'v6.20-rockchip-dts32-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt HEVC decoder node for RK3288. * tag 'v6.20-rockchip-dts32-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: Add vdec node for RK3288 Signed-off-by: Krzysztof Kozlowski commit 94cdfe3980539d1ac2387e6e51a35226785d2df2 Merge: aa5f91ce4fd897 f0d0f087227c4b Author: Krzysztof Kozlowski Date: Thu Jan 22 09:53:53 2026 +0100 Merge tag 'juno-updates-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/dt Armv8 Juno/Vexpress updates for v7.0 This contains a small set of DT updates: 1. Align DTS node naming with established coding style by replacing underscores with hyphens in node names. This is a safe change and does not affect ABI. 2. Add support for the CMN PMU on the Arm Morello platform, exposing the CMN-Skeena (CMN-600 r3p1–compatible) PMU via the standard CMN-600 binding. This enables PMU access on real Morello SDP hardware, where the registers are functional. * tag 'juno-updates-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm64: dts: arm: Use hyphen in node names arm64: dts: morello: Add CMN PMU Signed-off-by: Krzysztof Kozlowski commit c3b1edea3791fa91ab7032faa90355913ad9451b Author: Lu Baolu Date: Thu Jan 22 09:48:56 2026 +0800 iommu/vt-d: Fix race condition during PASID entry replacement The Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing an active PASID entry (e.g., during domain replacement), the current implementation calculates a new entry on the stack and copies it to the table using a single structure assignment. struct pasid_entry *pte, new_pte; pte = intel_pasid_get_entry(dev, pasid); pasid_pte_config_first_level(iommu, &new_pte, ...); *pte = new_pte; Because the hardware may fetch the 512-bit PASID entry in multiple 128-bit chunks, updating the entire entry while it is active (Present bit set) risks a "torn" read. In this scenario, the IOMMU hardware could observe an inconsistent state — partially new data and partially old data — leading to unpredictable behavior or spurious faults. Fix this by removing the unsafe "replace" helpers and following the "clear-then-update" flow, which ensures the Present bit is cleared and the required invalidation handshake is completed before the new configuration is applied. Fixes: 7543ee63e811 ("iommu/vt-d: Add pasid replace helpers") Signed-off-by: Lu Baolu Reviewed-by: Samiullah Khawaja Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260120061816.2132558-4-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2 Author: Lu Baolu Date: Thu Jan 22 09:48:55 2026 +0800 iommu/vt-d: Clear Present bit before tearing down context entry When tearing down a context entry, the current implementation zeros the entire 128-bit entry using multiple 64-bit writes. This creates a window where the hardware can fetch a "torn" entry — where some fields are already zeroed while the 'Present' bit is still set — leading to unpredictable behavior or spurious faults. While x86 provides strong write ordering, the compiler may reorder writes to the two 64-bit halves of the context entry. Even without compiler reordering, the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. Align with the "Guidance to Software for Invalidations" in the VT-d spec (Section 6.5.3.3) by implementing the recommended ownership handshake: 1. Clear only the 'Present' (P) bit of the context entry first to signal the transition of ownership from hardware to software. 2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU. 3. Perform the required cache and context-cache invalidation to ensure hardware no longer has cached references to the entry. 4. Fully zero out the entry only after the invalidation is complete. Also, add a dma_wmb() to context_set_present() to ensure the entry is fully initialized before the 'Present' bit becomes visible. Fixes: ba39592764ed2 ("Intel IOMMU: Intel IOMMU driver") Reported-by: Dmytro Maluka Closes: https://lore.kernel.org/all/aTG7gc7I5wExai3S@google.com/ Signed-off-by: Lu Baolu Reviewed-by: Dmytro Maluka Reviewed-by: Samiullah Khawaja Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260120061816.2132558-3-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 75ed00055c059dedc47b5daaaa2f8a7a019138ff Author: Lu Baolu Date: Thu Jan 22 09:48:54 2026 +0800 iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implementation zeros the entire 64-byte structure immediately using multiple 64-bit writes. Since the IOMMU hardware may fetch these 64 bytes using multiple internal transactions (e.g., four 128-bit bursts), updating or zeroing the entire entry while it is active (P=1) risks a "torn" read. If a hardware fetch occurs simultaneously with the CPU zeroing the entry, the hardware could observe an inconsistent state, leading to unpredictable behavior or spurious faults. Follow the "Guidance to Software for Invalidations" in the VT-d spec (Section 6.5.3.3) by implementing the recommended ownership handshake: 1. Clear only the 'Present' (P) bit of the PASID entry. 2. Use a dma_wmb() to ensure the cleared bit is visible to hardware before proceeding. 3. Execute the required invalidation sequence (PASID cache, IOTLB, and Device-TLB flush) to ensure the hardware has released all cached references. 4. Only after the flushes are complete, zero out the remaining fields of the PASID entry. Also, add a dma_wmb() in pasid_set_present() to ensure that all other fields of the PASID entry are visible to the hardware before the Present bit is set. Fixes: 0bbeb01a4faf ("iommu/vt-d: Manage scalalble mode PASID tables") Signed-off-by: Lu Baolu Reviewed-by: Dmytro Maluka Reviewed-by: Samiullah Khawaja Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260120061816.2132558-2-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 04b1b069f151e793767755f58b51670bff00cbc1 Author: Yi Liu Date: Thu Jan 22 09:48:53 2026 +0800 iommu/vt-d: Flush piotlb for SVM and Nested domain Besides the paging domains that use FS, SVM and Nested domains need to use piotlb invalidation descriptor as well. Fixes: b33125296b50 ("iommu/vt-d: Create unique domain ops for each stage") Cc: stable@vger.kernel.org Signed-off-by: Yi Liu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20251223065824.6164-1-yi.l.liu@intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 22d169bdd2849fe6bd18c2643742e1c02be6451c Author: Dmytro Maluka Date: Thu Jan 22 09:48:52 2026 +0800 iommu/vt-d: Flush cache for PASID table before using it When writing the address of a freshly allocated zero-initialized PASID table to a PASID directory entry, do that after the CPU cache flush for this PASID table, not before it, to avoid the time window when this PASID table may be already used by non-coherent IOMMU hardware while its contents in RAM is still some random old data, not zero-initialized. Fixes: 194b3348bdbb ("iommu/vt-d: Fix PASID directory pointer coherency") Signed-off-by: Dmytro Maluka Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20251221123508.37495-1-dmaluka@chromium.org Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 10e60d87813989e20eac1f3eda30b3bae461e7f9 Author: Jinhui Guo Date: Thu Jan 22 09:48:51 2026 +0800 iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") relies on pci_dev_is_disconnected() to skip ATS invalidation for safely-removed devices, but it does not cover link-down caused by faults, which can still hard-lock the system. For example, if a VM fails to connect to the PCIe device, "virsh destroy" is executed to release resources and isolate the fault, but a hard-lockup occurs while releasing the group fd. Call Trace: qi_submit_sync qi_flush_dev_iotlb intel_pasid_tear_down_entry device_block_translation blocking_domain_attach_dev __iommu_attach_device __iommu_device_set_domain __iommu_group_set_domain_internal iommu_detach_group vfio_iommu_type1_detach_group vfio_group_detach_container vfio_group_fops_release __fput Although pci_device_is_present() is slower than pci_dev_is_disconnected(), it still takes only ~70 µs on a ConnectX-5 (8 GT/s, x2) and becomes even faster as PCIe speed and width increase. Besides, devtlb_invalidation_with_pasid() is called only in the paths below, which are far less frequent than memory map/unmap. 1. mm-struct release 2. {attach,release}_dev 3. set/remove PASID 4. dirty-tracking setup The gain in system stability far outweighs the negligible cost of using pci_device_is_present() instead of pci_dev_is_disconnected() to decide when to skip ATS invalidation, especially under GDR high-load conditions. Fixes: 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") Cc: stable@vger.kernel.org Signed-off-by: Jinhui Guo Link: https://lore.kernel.org/r/20251211035946.2071-3-guojinhui.liam@bytedance.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 42662d19839f34735b718129ea200e3734b07e50 Author: Jinhui Guo Date: Thu Jan 22 09:48:50 2026 +0800 iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode PCIe endpoints with ATS enabled and passed through to userspace (e.g., QEMU, DPDK) can hard-lock the host when their link drops, either by surprise removal or by a link fault. Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") adds pci_dev_is_disconnected() to devtlb_invalidation_with_pasid() so ATS invalidation is skipped only when the device is being safely removed, but it applies only when Intel IOMMU scalable mode is enabled. With scalable mode disabled or unsupported, a system hard-lock occurs when a PCIe endpoint's link drops because the Intel IOMMU waits indefinitely for an ATS invalidation that cannot complete. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev iommu_deinit_device __iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Commit 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release") adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(), which calls qi_flush_dev_iotlb() and can also hard-lock the system when a PCIe endpoint's link drops. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 intel_context_flush_no_pasid device_pasid_table_teardown pci_pasid_table_teardown pci_for_each_dma_alias intel_pasid_teardown_sm_context intel_iommu_release_device iommu_deinit_device __iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Sometimes the endpoint loses connection without a link-down event (e.g., due to a link fault); killing the process (virsh destroy) then hard-locks the host. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev __iommu_attach_device __iommu_device_set_domain __iommu_group_set_domain_internal iommu_detach_group vfio_iommu_type1_detach_group vfio_group_detach_container vfio_group_fops_release __fput pci_dev_is_disconnected() only covers safe-removal paths; pci_device_is_present() tests accessibility by reading vendor/device IDs and internally calls pci_dev_is_disconnected(). On a ConnectX-5 (8 GT/s, x2) this costs ~70 µs. Since __context_flush_dev_iotlb() is only called on {attach,release}_dev paths (not hot), add pci_device_is_present() there to skip inaccessible devices and avoid the hard-lock. Fixes: 37764b952e1b ("iommu/vt-d: Global devTLB flush when present context entry changed") Fixes: 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release") Cc: stable@vger.kernel.org Signed-off-by: Jinhui Guo Link: https://lore.kernel.org/r/20251211035946.2071-2-guojinhui.liam@bytedance.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 12248a3862d50ef1a889153bb222d10d43e78c9d Author: Miguel Ojeda Date: Wed Jan 21 19:43:39 2026 +0100 rust: iommu: fix `srctree` link warning The Rust kernel code should be kept `rustdoc`-clean [1]. Our custom `srctree` link checker in the `rustdoc` target reports: warning: srctree/ link to include/io-pgtable.h does not exist Thus fix it. Link: https://rust-for-linux.com/contributing#submit-checklist-addendum [1] Fixes: 2e2f6b0ef855 ("rust: iommu: add io_pgtable abstraction") Signed-off-by: Miguel Ojeda Signed-off-by: Joerg Roedel commit 7222dd071b221dde38fea6d0798520572877ee2a Author: Miguel Ojeda Date: Wed Jan 21 19:43:38 2026 +0100 rust: iommu: fix Rust formatting The Rust kernel code should be kept `rustfmt`-clean [1]. Thus run the `rustfmt` target to fix the formatting issue. Link: https://rust-for-linux.com/contributing#submit-checklist-addendum [1] Fixes: 2e2f6b0ef855 ("rust: iommu: add io_pgtable abstraction") Signed-off-by: Miguel Ojeda Signed-off-by: Joerg Roedel commit c824345288d11e269ce41b36c105715bc2286050 Author: Ricardo Ribalda Date: Wed Jan 14 10:32:14 2026 +0000 media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer The uvc_alloc_urb_buffer() function implicitly depended on the stream->urb_size field, which was set by its caller, uvc_alloc_urb_buffers(). This implicit data flow makes the code harder to follow. More importantly, stream->urb_size was updated within the allocation loop before the allocation was confirmed to be successful. If the allocation failed, the stream object would be left with a urb_size that doesn't correspond to valid, allocated URB buffers. Refactor uvc_alloc_urb_buffer() to accept the buffer size as an explicit argument. This makes the function's dependencies clear and improves the robustness of the error handling path. The stream->urb_size is now set only after a complete and successful allocation. This is a pure refactoring and introduces no functional changes. Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Tested-by: Itay Chamiel Link: https://patch.msgid.link/20260114-uvc-alloc-urb-v1-2-cedf3fb66711@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 40d3ac25c11310bfaa50ed7614846ef75cb69a1e Author: Ricardo Ribalda Date: Wed Jan 14 10:32:13 2026 +0000 media: uvcvideo: Fix allocation for small frame sizes If a frame has size of less or equal than one packet size uvc_alloc_urb_buffers() is unable to allocate memory for it due to a off-by-one error. Fix the off-by-one-error and now that we are at it, make sure that stream->urb_size has always a valid value when we return from the function, even when an error happens. Fixes: efdc8a9585ce ("V4L/DVB (10295): uvcvideo: Retry URB buffers allocation when the system is low on memory.") Reported-by: Itay Chamiel Closes: https://lore.kernel.org/linux-media/CANiDSCsSoZf2LsCCoWAUbCg6tJT-ypXR1B85aa6rAdMVYr2iBQ@mail.gmail.com/T/#t Co-developed-by: Itay Chamiel Signed-off-by: Itay Chamiel Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Tested-by: Itay Chamiel Link: https://patch.msgid.link/20260114-uvc-alloc-urb-v1-1-cedf3fb66711@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 4cf3b6fd54ebb1ebc977bdc47fb6cfcf9a471a22 Author: Michal Pecio Date: Wed Oct 15 13:36:42 2025 +0200 media: uvcvideo: Return queued buffers on start_streaming() failure Return buffers if streaming fails to start due to uvc_pm_get() error. This bug may be responsible for a warning I got running while :; do yavta -c3 /dev/video0; done on an xHCI controller which failed under this workload. I had no luck reproducing this warning again to confirm. xhci_hcd 0000:09:00.0: HC died; cleaning up usb 13-2: USB disconnect, device number 2 WARNING: CPU: 2 PID: 29386 at drivers/media/common/videobuf2/videobuf2-core.c:1803 vb2_start_streaming+0xac/0x120 Fixes: 7dd56c47784a ("media: uvcvideo: Remove stream->is_streaming field") Cc: stable@vger.kernel.org Signed-off-by: Michal Pecio Reviewed-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20251015133642.3dede646.michal.pecio@gmail.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 3d9f32e02c2ed85338be627de672e2b81b88a836 Author: Ricardo Ribalda Date: Thu Nov 13 23:04:00 2025 +0200 media: uvcvideo: Create an ID namespace for streaming output terminals Some devices, such as the Grandstream GUV3100 and the LSK Meeting Eye for Business & Home, exhibit entity ID collisions between units and streaming output terminals. The UVC specification requires unit and terminal IDs to be unique, and uses the ID to reference entities: - In control requests, to identify the target entity - In the UVC units and terminals descriptors' bSourceID field, to identify source entities - In the UVC input header descriptor's bTerminalLink, to identify the terminal associated with a streaming interface Entity ID collisions break accessing controls and make the graph description in the UVC descriptors ambiguous. However, collisions where one of the entities is a streaming output terminal and the other entity is not a streaming terminal are less severe. Streaming output terminals have no controls, and, as they are the final entity in pipelines, they are never referenced in descriptors as source entities. They are referenced by ID only from innput header descriptors, which by definition only reference streaming terminals. For these reasons, we can work around the collision by giving streaming output terminals their own ID namespace. Do so by setting bit UVC_TERM_OUTPUT (15) in the uvc_entity.id field, which is normally never set as the ID is a 8-bit value. This ID change doesn't affect the entity name in the media controller graph as the name isn't constructed from the ID, so there should not be any impact on the uAPI. Although this change handles some ID collisions automagically, keep printing an error in uvc_alloc_new_entity() when a camera has invalid descriptors. Hopefully this message will help vendors fix their invalid descriptors. This new method of handling ID collisions includes a revert of commit 758dbc756aad ("media: uvcvideo: Use heuristic to find stream entity") that attempted to fix the problem urgently due to regression reports. Suggested-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Tested-by: Lili Orosz Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Link: https://patch.msgid.link/20251113210400.28618-1-laurent.pinchart@ideasonboard.com Signed-off-by: Hans Verkuil commit a7c708dc0d1c090ae6cf8978de2bbae594edb23c Merge: 82a6c28d51c746 735ee8582da3d2 Author: Jakub Kicinski Date: Wed Jan 21 20:23:11 2026 -0800 Merge tag 'nf-next-26-01-20' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== Subject: netfilter: updates for net-next 1) Speed up nftables transactions after earlier transaction failed. Due to a (harmeless) bug we remained in slow paranoia mode until a successful transaction completes. 2) Allow generic tracker to resolve clashes, this avoids very rare packet drops. From Yuto Hamaguchi. 3) Increase the cleanup budget to 64 entries in nf_conncount to reap more entries in one go, from Fernando Fernandez Mancera. 4) Allow icmp trackers to resolve clashes, this avoids very rare initial packet drop with test cases that have high-frequency pings. After this all trackers except tcp and sctp allow clash resolution. 5) Disentangle netfilter headers, don't include nftables/xtables headers in subsystems that are unrelated. 6) Don't rely on implicit includes coming from nf_conntrack_proto_gre.h. 7) Allow nfnetlink_queue nfq instance struct to get accounted via memcg, from Scott Mitchell. 8) Reject bogus xt target/match data upfront via netlink policiy in nft_compat interface rather than relying on x_tables API to do it. 9) Fix nf_conncount breakage when trying to limit loopback flows via prerouting rule, from Fernando Fernandez Mancera. This is a recent breakage but not seen as urgent enough to rush this via net tree at this late stage in development cycle. 10) Fix a possible off-by-one when parsing tcp option in xtables tcpmss match. Also handled via -next due to late stage in development cycle. * tag 'nf-next-26-01-20' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: xt_tcpmss: check remaining length before reading optlen netfilter: nf_conncount: fix tracking of connections from localhost netfilter: nft_compat: add more restrictions on netlink attributes netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation netfilter: nf_conntrack: don't rely on implicit includes netfilter: don't include xt and nftables.h in unrelated subsystems netfilter: nf_conntrack: enable icmp clash support netfilter: nf_conncount: increase the connection clean up limit to 64 netfilter: nf_conntrack: Add allow_clash to generic protocol handler netfilter: nf_tables: reset table validation state on abort ==================== Link: https://patch.msgid.link/20260120191803.22208-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 82a6c28d51c7467834e4bbf890f857b3bae0618f Merge: 331cf8fc1855c2 ae73535c9d0f16 Author: Jakub Kicinski Date: Wed Jan 21 19:50:56 2026 -0800 Merge branch 'phylink-link-callback-replay-helpers-for-sja1105-and-xpcs' Vladimir Oltean says: ==================== Phylink link callback replay helpers for SJA1105 and XPCS The sja1105 is reducing its direct interaction with the XPCS. The changes presented here are an older simplification idea, broken out of a previous patch set to allow for more thorough review. ==================== Link: https://patch.msgid.link/20260119121954.1624535-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit ae73535c9d0f166c1538df59198d10ce68ca99e8 Author: Vladimir Oltean Date: Mon Jan 19 14:19:54 2026 +0200 net: dsa: sja1105: re-merge sja1105_set_port_speed() and sja1105_set_port_config() Commit a18891b55703 ("net: dsa: sja1105: simplify static configuration reload") split sja1105_mac_link_up() -> sja1105_adjust_port_config() into two separate: - sja1105_set_port_speed() - sja1105_set_port_config() in order to pick up the second sja1105_set_port_config() and reuse it for the sja1105_static_config_reload() procedure which involves saving and restoring MAC and PCS settings. Now that these settings are restored by phylink itself, the driver no longer needs to call its own sja1105_set_port_config(), and the splitting is unnatural. Merge the functions back, which is to say that the only supported internal code path is to submit the MAC Configuration Table entry to hardware after phylink has dictated what we should set it to. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260119121954.1624535-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 0b2edc531e0b0509768a0732515e2a2abd69d827 Author: Vladimir Oltean Date: Mon Jan 19 14:19:53 2026 +0200 net: dsa: sja1105: let phylink help with the replay of link callbacks sja1105_static_config_reload() changes major settings in the switch and it requires a reset. A use case is to change things like Qdiscs (but see sja1105_reset_reasons[] for full list) while PTP synchronization is running, and the servo loop must not exit the locked state (s2). Therefore, stopping and restarting the phylink instances of all ports is not desirable, because that also stops the phylib state machine, and retriggers a seconds-long auto-negotiation process that breaks PTP. Thus, saving and restoring the link management settings is handled privately by the driver. The method got progressively more complex as SGMII support got added, because this is handled through the xpcs phylink_pcs component, to which we don't have unfettered access. Nonetheless, the switch reset line is hardwired to also reset the XPCS, creating a situation where it loses state and needs to be reprogrammed at a moment in time outside phylink's control. Although commits 907476c66d73 ("net: dsa: sja1105: call PCS config/link_up via pcs_ops structure") and 41bf58314b17 ("net: dsa: sja1105: use phylink_pcs internally") made the sja1105 <-> xpcs interaction slightly prettier, we still depend heavily on the PCS being "XPCS-like", because to back up its settings, we read the MII_BMCR register, through a mdiobus_c45_read() operation, breaking all layering separation. With the existence of phylink link callback replay helpers, we can do away with all this custom code and become even more PCS-agnostic, even though the reset domain is tightly coupled. This creates the unique opportunity to simplify away even more code than just the xpcs handling from sja1105_static_config_reload(). The sja1105_set_port_config() method is also invoked from sja1105_mac_link_up(). And since that is now called directly by phylink - we can just remove it from sja1105_static_config_reload(). This makes it possible to re-merge sja1105_set_port_speed() and sja1105_set_port_config() in a later change. Note that my only setups with sja1105 where the xpcs is used is with the xpcs on the CPU-facing port (fixed-link). Thus, I cannot test xpcs + PHY. But the replay procedure walks through all ports, and I did test a regular RGMII user port + a PHY. ptp4l[54.552]: master offset 5 s2 freq -931 path delay 764 ptp4l[55.551]: master offset 22 s2 freq -913 path delay 764 ptp4l[56.551]: master offset 13 s2 freq -915 path delay 765 ptp4l[57.552]: master offset 5 s2 freq -919 path delay 765 ptp4l[58.553]: master offset 13 s2 freq -910 path delay 765 ptp4l[59.553]: master offset 13 s2 freq -906 path delay 765 ptp4l[60.553]: master offset 6 s2 freq -909 path delay 765 ptp4l[61.553]: master offset 6 s2 freq -907 path delay 765 ptp4l[62.553]: master offset 6 s2 freq -906 path delay 765 ptp4l[63.553]: master offset 14 s2 freq -896 path delay 765 $ ip link set br0 type bridge vlan_filtering 1 [ 63.983283] sja1105 spi2.0 sw0p0: Link is Down [ 63.991913] sja1105 spi2.0: Link is Down [ 64.009784] sja1105 spi2.0: Reset switch and programmed static config. Reason: VLAN filtering [ 64.020217] sja1105 spi2.0 sw0p0: Link is Up - 1Gbps/Full - flow control off [ 64.030683] sja1105 spi2.0: Link is Up - 1Gbps/Full - flow control off ptp4l[64.554]: master offset 7397 s2 freq +6491 path delay 765 ptp4l[65.554]: master offset 38 s2 freq +1352 path delay 765 ptp4l[66.554]: master offset -2225 s2 freq -900 path delay 764 ptp4l[67.555]: master offset -2226 s2 freq -1569 path delay 765 ptp4l[68.555]: master offset -1553 s2 freq -1563 path delay 765 ptp4l[69.555]: master offset -865 s2 freq -1341 path delay 765 ptp4l[70.555]: master offset -401 s2 freq -1137 path delay 765 ptp4l[71.556]: master offset -145 s2 freq -1001 path delay 765 ptp4l[72.558]: master offset -26 s2 freq -926 path delay 765 ptp4l[73.557]: master offset 30 s2 freq -877 path delay 765 ptp4l[74.557]: master offset 47 s2 freq -851 path delay 765 ptp4l[75.557]: master offset 29 s2 freq -855 path delay 765 Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260119121954.1624535-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 96969b132bf1a5b875ab84fcb41a5c4972c3be9e Author: Vladimir Oltean Date: Mon Jan 19 14:19:52 2026 +0200 net: phylink: introduce helpers for replaying link callbacks Some drivers of MAC + tightly integrated PCS (example: SJA1105 + XPCS covered by same reset domain) need to perform resets at runtime. The reset is triggered by the MAC driver, and it needs to restore its and the PCS' registers, all invisible to phylink. However, there is a desire to simplify the API through which the MAC and the PCS interact, so this becomes challenging. Phylink holds all the necessary state to help with this operation, and can offer two helpers which walk the MAC and PCS drivers again through the callbacks required during a destructive reset operation. The procedure is as follows: Before reset, MAC driver calls phylink_replay_link_begin(): - Triggers phylink mac_link_down() and pcs_link_down() methods After reset, MAC driver calls phylink_replay_link_end(): - Triggers phylink mac_config() -> pcs_config() -> mac_link_up() -> pcs_link_up() methods. MAC and PCS registers are restored with no other custom driver code. Signed-off-by: Vladimir Oltean Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260119121954.1624535-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 7bf588dc62a05c1866efe098e1b188fd879aa2cf Author: Vladimir Oltean Date: Mon Jan 19 14:19:51 2026 +0200 net: phylink: simplify phylink_resolve() -> phylink_major_config() path This is a trivial change with no functional effect which replaces the pattern: if (a) { if (b) { do_stuff(); } } with: if (a && b) { do_stuff(); }; The purpose is to reduce the delta of a subsequent functional change. Signed-off-by: Vladimir Oltean Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260119121954.1624535-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 331cf8fc1855c2c750cbc3fb797e71ac8e4428cf Merge: 9de76f55b9f856 8871389da15165 Author: Jakub Kicinski Date: Wed Jan 21 19:47:01 2026 -0800 Merge branch 'phy-polarity-inversion-via-generic-device-tree-properties' Vladimir Oltean says: ==================== PHY polarity inversion via generic device tree properties Using the "rx-polarity" and "tx-polarity" device tree properties introduced in linux-phy and merged into net-next in commit 96a2d53f2478 ("Merge tag 'phy_common_properties' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy") we convert here two existing networking use cases - the EN8811H Ethernet PHY and the Mediatek LynxI PCS. Original cover letter: Polarity inversion (described in patch 4/10) is a feature with at least 4 potential new users waiting for a generic description: - Horatiu Vultur with the lan966x SerDes - Daniel Golle with the MaxLinear GSW1xx switches - Bjørn Mork with the AN8811HB Ethernet PHY - Me with a custom SJA1105 board, switch which uses the DesignWare XPCS I became interested in exploring the problem space because I was averse to the idea of adding vendor-specific device tree properties to describe a common need. This set contains an implementation of a generic feature that should cater to all known needs that were identified during my documentation phase. Apart from what is converted here, we also have the following, which I did not touch: - "st,px_rx_pol_inv" - its binding is a .txt file and I don't have time for such a large detour to convert it to dtschema. - "st,pcie-tx-pol-inv" and "st,sata-tx-pol-inv" - these are defined in a .txt schema but are not implemented in any driver. My verdict would be "delete the properties" but again, I would prefer not introducing such dependency to this series. ==================== Link: https://patch.msgid.link/20260119091220.1493761-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 8871389da15165198c3407584d40e7295bceaca5 Author: Vladimir Oltean Date: Mon Jan 19 11:12:20 2026 +0200 net: pcs: pcs-mtk-lynxi: deprecate "mediatek,pnswap" Prefer the new "rx-polarity" and "tx-polarity" properties, which in this case have the advantage that polarity inversion can be specified per direction (and per protocol, although this isn't useful here). We use the vendor specific ones as fallback if the standard description doesn't exist. Daniel, referring to the Mediatek SDK, clarifies that the combined SGMII_PN_SWAP_TX_RX register field should be split like this: bit 0 is TX and bit 1 is RX: https://lore.kernel.org/linux-phy/aSW--slbJWpXK0nv@makrotopia.org/ Suggested-by: Daniel Golle Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260119091220.1493761-6-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit bde1ae2d52ab3599e1c7ca68a90af8407d20f91d Author: Vladimir Oltean Date: Mon Jan 19 11:12:19 2026 +0200 net: pcs: pcs-mtk-lynxi: pass SGMIISYS OF node to PCS The Mediatek LynxI PCS is used from the MT7530 DSA driver (where it does not have an OF presence) and from mtk_eth_soc, where it does (Documentation/devicetree/bindings/net/pcs/mediatek,sgmiisys.yaml informs of a combined clock provider + SGMII PCS "SGMIISYS" syscon block). Currently, mtk_eth_soc parses the SGMIISYS OF node for the "mediatek,pnswap" property and sets a bit in the "flags" argument of mtk_pcs_lynxi_create() if set. I'd like to deprecate "mediatek,pnswap" in favour of a property which takes the current phy-mode into consideration. But this is only known at mtk_pcs_lynxi_config() time, and not known at mtk_pcs_lynxi_create(), when the SGMIISYS OF node is parsed. To achieve that, we must pass the OF node of the PCS, if it exists, to mtk_pcs_lynxi_create(), and let the PCS take a reference on it and handle property parsing whenever it wants. Use the fwnode API which is more general than OF (in case we ever need to describe the PCS using some other format). This API should be NULL tolerant, so add no particular tests for the mt7530 case. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260119091220.1493761-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 9f841922ebd0a34c78fc1984dc9abcb346704c58 Author: Vladimir Oltean Date: Mon Jan 19 11:12:18 2026 +0200 dt-bindings: net: pcs: mediatek,sgmiisys: deprecate "mediatek,pnswap" Reference the common PHY properties, and update the example to use them. Note that a PCS subnode exists, and it seems a better container of the polarity description than the SGMIISYS node that hosts "mediatek,pnswap". So use that. Signed-off-by: Vladimir Oltean Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260119091220.1493761-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 66d8a334b57e64e43810623b3d88f0ce9745270b Author: Vladimir Oltean Date: Mon Jan 19 11:12:17 2026 +0200 net: phy: air_en8811h: deprecate "airoha,pnswap-rx" and "airoha,pnswap-tx" Prefer the new "rx-polarity" and "tx-polarity" properties, and use the vendor specific ones as fallback if the standard description doesn't exist. Signed-off-by: Vladimir Oltean Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260119091220.1493761-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 44f62aa1b1209232cedcfb39097fc1bfbe75bbc7 Author: Vladimir Oltean Date: Mon Jan 19 11:12:16 2026 +0200 dt-bindings: net: airoha,en8811h: deprecate "airoha,pnswap-rx" and "airoha,pnswap-tx" Reference the common PHY properties, and update the example to use them. Signed-off-by: Vladimir Oltean Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260119091220.1493761-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 9de76f55b9f856b317773e106253051fb33a9e92 Merge: a4674aa58be539 b8d9b7daf0af36 Author: Jakub Kicinski Date: Wed Jan 21 19:28:34 2026 -0800 Merge branch 'gro-inline-tcp6_gro_-receive-complete' Eric Dumazet says: ==================== gro: inline tcp6_gro_{receive,complete} On some platforms, GRO stack is too deep and causes cpu stalls. Decreasing call depths by one shows a 1.5 % gain on Zen2 cpus. (32 RX queues, 100Gbit NIC, RFS enabled, tcp_rr with 128 threads and 10,000 flows) We can go further by inlining ipv6_gro_{receive,complete} and take care of IPv4 if there is interest. Note: two temporary __always_inline will be replaced with inline_for_performance when/if available. Cumulative size increase for this series (of 3): $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.3 add/remove: 2/2 grow/shrink: 5/1 up/down: 1572/-471 (1101) Function old new delta ipv6_gro_receive 1069 1846 +777 ipv6_gro_complete 433 733 +300 tcp6_check_fraglist_gro - 272 +272 tcp6_gro_complete 227 306 +79 tcp4_gro_complete 325 397 +72 ipv6_offload_init 218 274 +56 __pfx_tcp6_check_fraglist_gro - 16 +16 __pfx___skb_incr_checksum_unnecessary 32 - -32 __skb_incr_checksum_unnecessary 186 - -186 tcp6_gro_receive 959 706 -253 Total: Before=22592724, After=22593825, chg +0.00% ==================== Link: https://patch.msgid.link/20260120164903.1912995-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b8d9b7daf0af367f3fff017de0873ab825a6dbbe Author: Eric Dumazet Date: Tue Jan 20 16:49:03 2026 +0000 gro: inline tcp6_gro_complete() Remove one function call from GRO stack for native IPv6 + TCP packets. $ scripts/bloat-o-meter -t vmlinux.2 vmlinux.3 add/remove: 0/0 grow/shrink: 1/1 up/down: 298/-5 (293) Function old new delta ipv6_gro_complete 435 733 +298 tcp6_gro_complete 311 306 -5 Total: Before=22593532, After=22593825, chg +0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260120164903.1912995-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 87737cd76e44fe5d481e7da2021b925191ccab53 Author: Eric Dumazet Date: Tue Jan 20 16:49:02 2026 +0000 gro: inline tcp6_gro_receive() FDO/LTO are unable to inline tcp6_gro_receive() from ipv6_gro_receive() Make sure tcp6_check_fraglist_gro() is only called only when needed, so that compiler can leave it out-of-line. $ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2 add/remove: 2/0 grow/shrink: 3/1 up/down: 1123/-253 (870) Function old new delta ipv6_gro_receive 1069 1846 +777 tcp6_check_fraglist_gro - 272 +272 ipv6_offload_init 218 274 +56 __pfx_tcp6_check_fraglist_gro - 16 +16 ipv6_gro_complete 433 435 +2 tcp6_gro_receive 959 706 -253 Total: Before=22592662, After=22593532, chg +0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260120164903.1912995-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9bd6ff503077e03fdf3b1a0a55b1427759eb23ac Author: Eric Dumazet Date: Tue Jan 20 16:49:01 2026 +0000 net: always inline __skb_incr_checksum_unnecessary() clang does not inline this helper in GRO fast path. We can save space and cpu cycles. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1 add/remove: 0/2 grow/shrink: 2/0 up/down: 156/-218 (-62) Function old new delta tcp6_gro_complete 227 311 +84 tcp4_gro_complete 325 397 +72 __pfx___skb_incr_checksum_unnecessary 32 - -32 __skb_incr_checksum_unnecessary 186 - -186 Total: Before=22592724, After=22592662, chg -0.00% Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260120164903.1912995-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit a4674aa58be53921f2aba62e143cc338d6ab142c Author: Eric Dumazet Date: Tue Jan 20 12:53:53 2026 +0000 tcp: preserve const qualifier in tcp_rsk() and inet_rsk() We can change tcp_rsk() and inet_rsk() to propagate their argument const qualifier thanks to container_of_const(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260120125353.1470456-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1b58c94e9cf928970d5287550d3005389b198ff9 Merge: c7cffa49936d7b 3847173525e307 Author: Jakub Kicinski Date: Wed Jan 21 19:17:56 2026 -0800 Merge branch 'airoha-add-the-capability-to-read-firmware-binary-names-from-dts-for-airoha-npu-driver' Lorenzo Bianconi says: ==================== airoha: Add the capability to read firmware binary names from dts for Airoha NPU driver This patch is needed because NPU firmware binaries are board specific since they depend on the MediaTek WiFi chip used on the board (e.g. MT7996 or MT7992). This is a preliminary patch to enable MT76 NPU offloading if the Airoha SoC is equipped with MT7996 (Eagle) WiFi chipset. ==================== Link: https://patch.msgid.link/20260120-airoha-npu-firmware-name-v4-0-88999628b4c1@kernel.org Signed-off-by: Jakub Kicinski commit 3847173525e307ebcd23bd4863da943ea78b0057 Author: Lorenzo Bianconi Date: Tue Jan 20 11:17:18 2026 +0100 net: airoha: npu: Add the capability to read firmware names from dts Introduce the capability to read the firmware binary names from device-tree using the firmware-name property if available. This patch is needed because NPU firmware binaries are board specific since they depend on the MediaTek WiFi chip used on the board (e.g. MT7996 or MT7992) and the WiFi chip version info is not available in the NPU driver. This is a preliminary patch to enable MT76 NPU offloading if the Airoha SoC is equipped with MT7996 (Eagle) WiFi chipset. Signed-off-by: Lorenzo Bianconi Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260120-airoha-npu-firmware-name-v4-2-88999628b4c1@kernel.org Signed-off-by: Jakub Kicinski commit 03135a5a6ed37329ea8d0add992ab15555dc612d Author: Lorenzo Bianconi Date: Tue Jan 20 11:17:17 2026 +0100 dt-bindings: net: airoha: npu: Add firmware-name property Add firmware-name property in order to introduce the capability to specify the firmware names used for 'RiscV core' and 'Data section' binaries. This patch is needed because NPU firmware binaries are board specific since they depend on the MediaTek WiFi chip used on the board (e.g. MT7996 or MT7992) and the WiFi chip version info is not available in the NPU driver. This is a preliminary patch to enable MT76 NPU offloading if the Airoha SoC is equipped with MT7996 (Eagle) WiFi chipset. Reviewed-by: Andrew Lunn Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260120-airoha-npu-firmware-name-v4-1-88999628b4c1@kernel.org Signed-off-by: Jakub Kicinski commit c7cffa49936d7b07fd5cd7cc54c7e6cd01d154c1 Merge: 938b404e25d67b 6ecc08329bab2c Author: Jakub Kicinski Date: Wed Jan 21 19:09:14 2026 -0800 Merge branch 'netconsole-support-automatic-target-recovery' Andre Carvalho says: ==================== netconsole: support automatic target recovery This patchset introduces target resume capability to netconsole allowing it to recover targets when underlying low-level interface comes back online. The patchset starts by refactoring netconsole state representation in order to allow representing deactivated targets (targets that are disabled due to interfaces unregister). It then modifies netconsole to handle NETDEV_REGISTER events for such targets, setups netpoll and forces the device UP. Targets are matched with incoming interfaces depending on how they were bound in netconsole (by mac or interface name). For these reasons, we also attempt resuming on NETDEV_CHANGENAME. The patchset includes a selftest that validates netconsole target state transitions and that target is functional after resumed. ==================== Link: https://patch.msgid.link/20260118-netcons-retrigger-v11-0-4de36aebcf48@gmail.com Signed-off-by: Jakub Kicinski commit 6ecc08329bab2c87f579cf1a8ab7799d8d88d9bc Author: Andre Carvalho Date: Sun Jan 18 11:00:27 2026 +0000 selftests: netconsole: validate target resume Introduce a new netconsole selftest to validate that netconsole is able to resume a deactivated target when the low level interface comes back. The test setups the network using netdevsim, creates a netconsole target and then remove/add netdevsim in order to bring the same interfaces back. Afterwards, the test validates that the target works as expected. Targets are created via cmdline parameters to the module to ensure that we are able to resume targets that were bound by mac and interface name. Reviewed-by: Breno Leitao Signed-off-by: Andre Carvalho Tested-by: Breno Leitao Link: https://patch.msgid.link/20260118-netcons-retrigger-v11-7-4de36aebcf48@gmail.com Signed-off-by: Jakub Kicinski commit 220dbe3c76ed13a7b68393212a625eaf1770b96f Author: Andre Carvalho Date: Sun Jan 18 11:00:26 2026 +0000 netconsole: resume previously deactivated target Attempt to resume a previously deactivated target when the associated interface comes back (NETDEV_REGISTER) or when it changes name (NETDEV_CHANGENAME) by calling netpoll_setup on the device. Depending on how the target was setup (by mac or interface name), the corresponding field is compared with the device being brought up. Targets that match the incoming device, are scheduled for resume on a workqueue. Resuming happens on a workqueue as we can't execute netpoll_setup in the context of the netdev event. A standalone workqueue (as opposed to the global one) is used to allow for proper cleanup process during netconsole module cleanup as we need to be able to flush all pending work before traversing the target list given that targets are temporarily removed from the list during resume_target. Target transitions to STATE_DISABLED in case of failures resuming it to avoid retrying the same target indefinitely. Signed-off-by: Andre Carvalho Reviewed-by: Breno Leitao Tested-by: Breno Leitao Link: https://patch.msgid.link/20260118-netcons-retrigger-v11-6-4de36aebcf48@gmail.com Signed-off-by: Jakub Kicinski commit c52861e566db8af86c9fb412ccffa274c610babf Author: Andre Carvalho Date: Sun Jan 18 11:00:25 2026 +0000 netconsole: introduce helpers for dynamic_netconsole_mutex lock/unlock This commit introduces two helper functions to perform lock/unlock on dynamic_netconsole_mutex providing no-op stub versions when compiled without CONFIG_NETCONSOLE_DYNAMIC and refactors existing call sites to use the new helpers. This is done following kernel coding style guidelines, in preparation for an upcoming change. It avoids the need for preprocessor conditionals in the call site and keeps the logic easier to follow. Signed-off-by: Andre Carvalho Reviewed-by: Breno Leitao Tested-by: Breno Leitao Link: https://patch.msgid.link/20260118-netcons-retrigger-v11-5-4de36aebcf48@gmail.com Signed-off-by: Jakub Kicinski commit 5b114087438dcd229c8754c093c44619c346d67c Author: Andre Carvalho Date: Sun Jan 18 11:00:24 2026 +0000 netconsole: clear dev_name for devices bound by mac This patch makes sure netconsole clears dev_name for devices bound by mac in order to allow calling setup_netpoll on targets that have previously been cleaned up (in order to support resuming deactivated targets). This is required as netpoll_setup populates dev_name even when devices are matched via mac address. The cleanup is done inside netconsole as bound by mac is a netconsole concept. Signed-off-by: Andre Carvalho Reviewed-by: Breno Leitao Tested-by: Breno Leitao Link: https://patch.msgid.link/20260118-netcons-retrigger-v11-4-4de36aebcf48@gmail.com Signed-off-by: Jakub Kicinski commit e8f4005ab2d4819805c2f6b19e8bd633f8579bd0 Author: Breno Leitao Date: Sun Jan 18 11:00:23 2026 +0000 netconsole: add STATE_DEACTIVATED to track targets disabled by low level When the low level interface brings a netconsole target down, record this using a new STATE_DEACTIVATED state. This allows netconsole to distinguish between targets explicitly disabled by users and those deactivated due to interface state changes. It also enables automatic recovery and re-enabling of targets if the underlying low-level interfaces come back online. From a code perspective, anything that is not STATE_ENABLED is disabled. Devices (de)enslaving are marked STATE_DISABLED to prevent automatically resuming as enslaved interfaces cannot have netconsole enabled. Signed-off-by: Breno Leitao Signed-off-by: Andre Carvalho Tested-by: Breno Leitao Link: https://patch.msgid.link/20260118-netcons-retrigger-v11-3-4de36aebcf48@gmail.com Signed-off-by: Jakub Kicinski commit a46bb0103c351766e165c13c7ee8dd52beb76dfc Author: Andre Carvalho Date: Sun Jan 18 11:00:22 2026 +0000 netconsole: convert 'enabled' flag to enum for clearer state management This patch refactors the netconsole driver's target enabled state from a simple boolean to an explicit enum (`target_state`). This allow the states to be expanded to a new state in the upcoming change. Co-developed-by: Breno Leitao Signed-off-by: Breno Leitao Reviewed-by: Breno Leitao Signed-off-by: Andre Carvalho Tested-by: Breno Leitao Link: https://patch.msgid.link/20260118-netcons-retrigger-v11-2-4de36aebcf48@gmail.com Signed-off-by: Jakub Kicinski commit d793db4aa0db9ebcdd5ccde0a933323b778d1f2d Author: Breno Leitao Date: Sun Jan 18 11:00:21 2026 +0000 netconsole: add target_state enum Introduces a enum to track netconsole target state which is going to replace the enabled boolean. Signed-off-by: Breno Leitao Signed-off-by: Andre Carvalho Tested-by: Breno Leitao Link: https://patch.msgid.link/20260118-netcons-retrigger-v11-1-4de36aebcf48@gmail.com Signed-off-by: Jakub Kicinski commit 938b404e25d67be9004b3c853afa4a2e9723fe5b Merge: d8f87aa5fa0a42 808d077f5b5380 Author: Jakub Kicinski Date: Wed Jan 21 18:57:09 2026 -0800 Merge branch 'add-devm_clk_bulk_get_optional_enable-helper-and-use-in-axi-ethernet-driver' Suraj Gupta says: ==================== Add devm_clk_bulk_get_optional_enable() helper and use in AXI Ethernet driver This patch series introduces a new managed clock framework helper function and demonstrates its usage in AXI ethernet driver. Device drivers frequently need to get optional bulk clocks, prepare them, and enable them during probe, while ensuring automatic cleanup on device unbind. Currently, this requires three separate operations with manual cleanup handling. The new devm_clk_bulk_get_optional_enable() helper combines these operations into a single managed call, eliminating boilerplate code and following the established pattern of devm_clk_bulk_get_all_enabled(). ==================== Link: https://patch.msgid.link/20260116192725.972966-1-suraj.gupta2@amd.com Signed-off-by: Jakub Kicinski commit 808d077f5b538065c524b76b340007c51fad215c Author: Sean Anderson Date: Sat Jan 17 00:57:24 2026 +0530 net: xilinx: axienet: Use devres for resource management in probe path Transition axienet_probe() to managed resource allocation using devm_* APIs for network device and clock handling, while improving error paths with dev_err_probe(). This eliminates the need for manual resource cleanup during probe failures and streamlines the remove() function. Signed-off-by: Sean Anderson Co-developed-by: Suraj Gupta Signed-off-by: Suraj Gupta Link: https://patch.msgid.link/20260116192725.972966-3-suraj.gupta2@amd.com Signed-off-by: Jakub Kicinski commit 820ce0c8e98a8999f4c233ffb1ca92c27894614e Author: Suraj Gupta Date: Sat Jan 17 00:57:23 2026 +0530 clk: Add devm_clk_bulk_get_optional_enable() helper Add a new managed clock framework helper function that combines getting optional bulk clocks and enabling them in a single operation. The devm_clk_bulk_get_optional_enable() function simplifies the common pattern where drivers need to get optional bulk clocks, prepare and enable them, and have them automatically disabled/unprepared and freed when the device is unbound. This new API follows the established pattern of devm_clk_bulk_get_all_enabled() and reduces boilerplate code in drivers that manage multiple optional clocks. Suggested-by: Andrew Lunn Signed-off-by: Suraj Gupta Reviewed-by: Brian Masney Acked-by: Stephen Boyd Link: https://patch.msgid.link/20260116192725.972966-2-suraj.gupta2@amd.com Signed-off-by: Jakub Kicinski commit 8da7e88682d58a7c2e2c2101e49d3c9c9ac481b0 Author: Po-Hao Huang Date: Sat Jan 17 12:41:57 2026 +0800 wifi: rtw89: 8922a: add digital compensation for 2GHz This fixes transmit power too low under 2GHz connection. Previously we missed the settings of 2GHz, add the according calibrated tables. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260117044157.2392958-10-pkshih@realtek.com commit 1945c83dc5cef50c46101c0c2abb2da8650fd3b1 Author: Ping-Ke Shih Date: Sat Jan 17 12:41:56 2026 +0800 wifi: rtw89: mac: set force MBA duration to 0 Enable force MBA (Multi-user Block Ack) field to ensure trasnmiting packet of duration field of MBA in multi-user block ack request is 0 as expected. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260117044157.2392958-9-pkshih@realtek.com commit 9cc1a84c53d4fe9494ed13b3cdba0e23519342f3 Author: Ping-Ke Shih Date: Sat Jan 17 12:41:55 2026 +0800 wifi: rtw89: mac: clear DTOP disable excluding CID7090 variant for RTL8922D The data TX FIFO operation (DTOP) is a hardware component in TMAC circuit to control TX flow, since CID7090 variant can clear DTOP by default, no need it by driver. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260117044157.2392958-8-pkshih@realtek.com commit 5fe702e4b2cdb1aca4fc6e639b1bfbefd7905347 Author: Zong-Zhe Yang Date: Sat Jan 17 12:41:54 2026 +0800 wifi: rtw89: phy: update TSSI flow for RTL8922D TSSI is to do TX compensation caused by temperature. The RTL8922D defines different H2C command format. Update it accordingly. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260117044157.2392958-7-pkshih@realtek.com commit 4809013c088c2e211f2c8e2560ce63924a82a43f Author: Ping-Ke Shih Date: Sat Jan 17 12:41:53 2026 +0800 wifi: rtw89: phy: add firmware element of digital TX power compensation Define and set compensation value to corresponding frequency bands. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260117044157.2392958-6-pkshih@realtek.com commit bcd23ebfef1c292e8965ac116bc0f88f7e7d3bbc Author: Eric Huang Date: Sat Jan 17 12:41:52 2026 +0800 wifi: rtw89: phy: update edcca log parsing for RTL8922D Before this change the rtw89_phy_edcca_log routine didn't handled RTL8922D. This update expands the logic to recognize RTL8922D EDCCA reports. Signed-off-by: Eric Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260117044157.2392958-5-pkshih@realtek.com commit 20380a039ddd6504e663d3701e55e29a20da5721 Author: Eric Huang Date: Sat Jan 17 12:41:51 2026 +0800 wifi: rtw89: phy: add H2C command to send detail RX gain and link parameters for PS mode Introduce support for a new PS multi-link common info version (v1) for RTL8922D, enabling the driver to send detailed RX gain and link parameters to firmware via a new H2C command. A dedicated 20 MHz beacon channel (chan_bcn) that replicates the primary channel and band type of the original channel but forces a 20 MHz width. This ensures that beacon mode always reference the 20 MHz gain table, fixing the mis-assignment that could degrade signal strength or cause incorrect RSSI calibration. Signed-off-by: Eric Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260117044157.2392958-4-pkshih@realtek.com commit 496a0752fe5042908c8dd44d477916fa83414595 Author: Eric Huang Date: Sat Jan 17 12:41:50 2026 +0800 wifi: rtw89: phy: handle C2H event for PS mode report Introduce support for processing the new PS C2H report, enabling detailed debugging of low-power state hardware changes. Signed-off-by: Eric Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260117044157.2392958-3-pkshih@realtek.com commit 32f6bf1872cb41c46e601c1c59e55b78699d0a0d Author: Ping-Ke Shih Date: Sat Jan 17 12:41:49 2026 +0800 wifi: rtw89: phy: add chip_ops to calculate RX gain from efuse to support PS mode In PS mode, it needs to restore RX gain settings while waking up. Add to get RX gain values from chip specific ops, and pass these data to firmware when going to enter PS mode. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260117044157.2392958-2-pkshih@realtek.com commit 6070a44051b1c35714fa130de7726cfe91ca5559 Author: Zilin Guan Date: Fri Jan 16 13:08:34 2026 +0000 wifi: rtw89: debug: Fix memory leak in __print_txpwr_map() In __print_txpwr_map(), memory is allocated to bufp via vzalloc(). If max_valid_addr is 0, the function returns -EOPNOTSUPP immediately without freeing bufp, leading to a memory leak. Since the validation of max_valid_addr does not depend on the allocated memory, fix this by moving the vzalloc() call after the check. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 036042e15770 ("wifi: rtw89: debug: txpwr table supports Wi-Fi 7 chips") Suggested-by: Zong-Zhe Yang Signed-off-by: Zilin Guan Reviewed-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260116130834.1413924-1-zilin@seu.edu.cn commit 5f65ebf9aaf00c7443252136066138435ec03958 Author: Shin-Yi Lin Date: Wed Jan 14 09:49:06 2026 +0800 wifi: rtw89: Add default ID 28de:2432 for RTL8832CU Add 28de:2432 for RTL8832CU-based adapters that use this default ID. Signed-off-by: Shin-Yi Lin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114014906.21829-1-pkshih@realtek.com commit 6f6d7a325fbde4f025ee1b1277f6f44727e21223 Author: Po-Hao Huang Date: Wed Jan 14 09:39:50 2026 +0800 wifi: rtw89: fix unable to receive probe responses under MLO connection During MLO connections, A1 of the probe responses we received are in link address, these frames will then be dropped by mac80211 due to not matching the MLD address in ieee80211_scan_accept_presp(). Fix this by using MLD address to scan when not using random MAC address. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-13-pkshih@realtek.com commit 76bada91a41a08e101b05c241c0066cd85bdfa68 Author: Po-Hao Huang Date: Wed Jan 14 09:39:49 2026 +0800 wifi: rtw89: phy: fix incorrect power limit by mac_id Modify the power register range based on chip ability. When not set, the default value is random. This fixes incorrect power limit on some ICs. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-12-pkshih@realtek.com commit a0343cdc7767578e21822bd4e0961d204add2eef Author: Ping-Ke Shih Date: Wed Jan 14 09:39:48 2026 +0800 wifi: rtw89: phy: refine initial flow of BB wrapper Set initial value of TX power and TX path per MAC ID to 0x0, and reorder initial flow as vendor driver does. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-11-pkshih@realtek.com commit ee866bb4aa7826fe37974b105e1c2938247ff9c1 Author: Ping-Ke Shih Date: Wed Jan 14 09:39:47 2026 +0800 wifi: rtw89: phy: write BB wrapper registers with flush BB wrapper is a hardware circuit to control TX power, and for single writing it needs an additional flush to ensure writing is properly completed. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-10-pkshih@realtek.com commit 51cc8220f8ce556d86f225e4c0732315acf029ff Author: Ping-Ke Shih Date: Wed Jan 14 09:39:46 2026 +0800 wifi: rtw89: phy: update BB wrapper RFSI RTL8922D adds newly BB wrapper RFSI, including compensation values and threshold, bandedge settings, and CIM3K coefficient. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-9-pkshih@realtek.com commit d6cc6e12c15b92ecca4f3839baabed94533fc09e Author: Eric Huang Date: Wed Jan 14 09:39:45 2026 +0800 wifi: rtw89: phy: update bb wrapper TPU init Set DBW by rate to on in TPU (TX Power Unit) init, and extend to initialize two hardware bands. Signed-off-by: Eric Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-8-pkshih@realtek.com commit ace51dc80334f1a9b479fb039e31a0c7d581e9cf Author: Ping-Ke Shih Date: Wed Jan 14 09:39:44 2026 +0800 wifi: rtw89: phy: abstract BB wrap registers to share initial flow BB wrap registers are to configure TX power in MAC register domain, but they are controlled and designed by BB layer. Since coming chips use different register address, add a struct to define them. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-7-pkshih@realtek.com commit 0e8818a309f70b095d9b7753beca92da285a1c36 Author: Eric Huang Date: Wed Jan 14 09:39:43 2026 +0800 wifi: rtw89: phy: extend register to read history 2 of PHY env_monitor For old chips, history is 8 bits storing in single one register, and RTL8922D's one is 16 bits and two registers. Extend to common flow accordingly. Signed-off-by: Eric Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-6-pkshih@realtek.com commit fc31826cbc24115091a4a68a95fa2697cf725416 Author: Ping-Ke Shih Date: Wed Jan 14 09:39:42 2026 +0800 wifi: rtw89: phy: abstract start address and EHT of PHY status bitmap Select PHY status being reported by a set of addresses. Abstract the address and EHT bitmap to share common flow. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-5-pkshih@realtek.com commit 3b99dac7bf917df0e298412430a9fb30eee6cc97 Author: Ping-Ke Shih Date: Wed Jan 14 09:39:41 2026 +0800 wifi: rtw89: phy: add ops rtw89_phy_gen_be_v1 for RTL8922D Define RTL8922D specific registers, including PHY base control register, PHY status, CFO registers, and TX power registers. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-4-pkshih@realtek.com commit 1e3c50e0b491eaca8beb6b5ec9cb8261b4f1e38f Author: Ping-Ke Shih Date: Wed Jan 14 09:39:40 2026 +0800 wifi: rtw89: phy: add {read,write}_rf_v3 for RTL8922D Implement to access RF registers for RTL8922D. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-3-pkshih@realtek.com commit e497fc05e9f5c119aedf7b4e3780a6568a9b12e5 Author: Ping-Ke Shih Date: Wed Jan 14 09:39:39 2026 +0800 wifi: rtw89: mac: clear global interrupt right after power-on The global interrupt indicator is always persistent, and firmware will handle it right after boot. To prevent this unnecessary handling, clear the indicator before downloading firmware. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260114013950.19704-2-pkshih@realtek.com commit f65ca6c5117981784943eb3fe9ba4e11e85746ea Author: Marco Crivellari Date: Thu Nov 13 17:06:05 2025 +0100 wifi: rtw88: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. For more details see the Link tag below. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251113160605.381777-3-marco.crivellari@suse.com commit d40c68a49f69c9bdb4ca14b3e6a0422bbaeb5d8f Author: Swapnil Sapkal Date: Mon Jan 19 17:58:24 2026 +0000 perf header: Support CPU DOMAIN relation info The '/proc/schedstat' file gives info about load balancing statistics within a given domain. It also contains the cpu_mask giving information about the sibling cpus and domain names after schedstat version 17. Storing this information in perf header will help tools like `perf sched stats` for better analysis. Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Acked-by: Ian Rogers Acked-by: Namhyung Kim Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Ravi Bangoria Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han Signed-off-by: Arnaldo Carvalho de Melo commit cb68cba4453d3e021b27c2a08fcefdd1376a5ef0 Author: Swapnil Sapkal Date: Mon Jan 19 17:58:23 2026 +0000 tools/lib: Add list_is_first() Add list_is_first() to check whether @list is the first entry in list @head Signed-off-by: Swapnil Sapkal Tested-by: Chen Yu Acked-by: Ian Rogers Acked-by: Namhyung Kim Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Anubhav Shelat Cc: Ben Gainey Cc: Blake Jones Cc: Chun-Tse Shao Cc: David Vernet Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Gautham Shenoy Cc: Graham Woodward Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Juri Lelli Cc: K Prateek Nayak Cc: Kan Liang Cc: Leo Yan Cc: Madadi Vineeth Reddy Cc: Mark Rutland Cc: Ravi Bangoria Cc: Sandipan Das Cc: Santosh Shukla Cc: Shrikanth Hegde Cc: Steven Rostedt (VMware) Cc: Tejun Heo Cc: Thomas Falcon Cc: Tim Chen Cc: Vincent Guittot Cc: Yang Jihong Cc: Yujie Liu Cc: Zhongqiu Han Signed-off-by: Arnaldo Carvalho de Melo commit 0ff6402de70b3233b4df09df9e5072088a993148 Author: Tejun Heo Date: Wed Jan 21 14:24:24 2026 -1000 cgroup: Remove stale cpu.rt.max reference from documentation cpu.rt.max was a proposed interface that never landed in mainline. Remove the reference from cgroup-v2 documentation. Signed-off-by: Tejun Heo Reported-by: Orestis Floros commit a00772171251cf78263a3a5ffcb7c09bf9141182 Author: Marek Vasut Date: Thu Jan 22 00:06:47 2026 +0100 Input: ili210x - add support for polling mode There are designs incorporating Ilitek ILI2xxx touch controller that do not connect interrupt pin, for example Waveshare 13.3" DSI display. To support such systems use polling mode for the input device when I2C client does not have interrupt assigned to it. Factor out ili210x_firmware_update_noirq() to allow conditional scoped guard around this code. The scoped guard has to be applied only in case the IRQ line is connected, and not applied otherwise. Reviewed-by: Frank Li Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260121230736.114623-2-marek.vasut+renesas@mailbox.org Signed-off-by: Dmitry Torokhov commit 87ac7cfac4d762da0e6438ada44f51bd5cf11649 Author: Marek Vasut Date: Thu Jan 22 00:06:46 2026 +0100 dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek The old Ilitek touch controllers V3 and V6 can operate without interrupt line, in polling mode. Drop the 'interrupts' property requirement for those four controllers. To avoid overloading the trivial-touch, fork the old Ilitek V3/V6 touch controller binding into separate document. Reviewed-by: Frank Li Reviewed-by: Krzysztof Kozlowski Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260121230736.114623-1-marek.vasut+renesas@mailbox.org Signed-off-by: Dmitry Torokhov commit a32ae2658471dd87a2f7a438388ed7d9a5767212 Author: Kery Qi Date: Wed Jan 21 17:41:16 2026 +0800 selftests/bpf: Fix resource leak in serial_test_wq on attach failure When wq__attach() fails, serial_test_wq() returns early without calling wq__destroy(), leaking the skeleton resources allocated by wq__open_and_load(). This causes ASAN leak reports in selftests runs. Fix this by jumping to a common clean_up label that calls wq__destroy() on all exit paths after successful open_and_load. Note that the early return after wq__open_and_load() failure is correct and doesn't need fixing, since that function returns NULL on failure (after internally cleaning up any partial allocations). Fixes: 8290dba51910 ("selftests/bpf: wq: add bpf_wq_start() checks") Signed-off-by: Kery Qi Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20260121094114.1801-3-qikeyu2017@gmail.com commit 959ac08a2c2811305be8c2779779e8b0932e5a99 Author: Jörg Wedekind Date: Mon Jan 19 15:31:10 2026 +0100 PCI: Mark 3ware-9650SA Root Port Extended Tags as broken Per PCIe r7.0, sec 2.2.6.2.1 and 7.5.3.4, a Requester may not use 8-bit Tags unless its Extended Tag Field Enable is set, but all Receivers/Completers must handle 8-bit Tags correctly regardless of their Extended Tag Field Enable. Some devices do not handle 8-bit Tags as Completers, so add a quirk for them. If we find such a device, we disable Extended Tags for the entire hierarchy to make peer-to-peer DMA possible. The 3ware 9650SA seems to have issues with handling 8-bit tags. Mark it as broken. This fixes PCI Parity Errors like : 3w-9xxx: scsi0: ERROR: (0x06:0x000C): PCI Parity Error: clearing. 3w-9xxx: scsi0: ERROR: (0x06:0x000D): PCI Abort: clearing. 3w-9xxx: scsi0: ERROR: (0x06:0x000E): Controller Queue Error: clearing. 3w-9xxx: scsi0: ERROR: (0x06:0x0010): Microcontroller Error: clearing. Fixes: 60db3a4d8cc9 ("PCI: Enable PCIe Extended Tags if supported") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=202425 Signed-off-by: Jörg Wedekind Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260119143114.21948-1-joerg@wedekind.de commit 502678b88cb3b01908315bc2ba91557f4d2cf49a Author: Thomas Weißschuh Date: Wed Jan 21 14:42:39 2026 +0100 kbuild: Reject unexpected values for LLVM= The LLVM argument is documented to accept one of three forms: * a literal '1' to use the default 'clang', * a toolchain prefix path, ending in a trailing '/', * a version suffix. All other values are silently treated as '1'. If for example the user accidentally forgets the trailing '/' of a toolchain prefix, kbuild will unexpectedly and silently fall back to the system toolchain. Instead report an error if the user specified an invalid value for LLVM. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Link: https://patch.msgid.link/20260121-kbuild-llvm-arg-v2-1-5e4d8dca4ad8@weissschuh.net Signed-off-by: Nathan Chancellor commit 301a02d405a3ac4c7661b47571e2b843671e9c60 Author: Jihan LIN Date: Wed Jan 14 19:47:45 2026 +0800 Documentation/kbuild: gendwarfksyms: Style cleanup The indentation in gendwarfksyms.rst currently uses a mix of tabs and spaces. Convert all indentation to tabs, and match the usage output and code examples with theirs references. Suggested-by: Miguel Ojeda Signed-off-by: Jihan LIN Reviewed-by: Petr Pavlu Link: https://patch.msgid.link/20260114-documents_gendwarfksyms-v2-2-297c98bd62c6@gmail.com [nathan: Minor commit message formatting adjustment] Signed-off-by: Nathan Chancellor commit 983233ac2ef1b6a423419e0542734e8f79802124 Author: Jihan LIN Date: Wed Jan 14 19:47:44 2026 +0800 Documentation/kbuild: Document gendwarfksyms build dependencies Although dependencies for gendwarfksyms were recently added to the packaging rules [1-2], the corresponding documentation was missing. Document the required build dependencies for gendwarfksyms, and include a few examples for installing these dependencies on some distributions. [1] commit 657f96cb7c06 ("kbuild: deb-pkg: Add libdw-dev:native to Build-Depends-Arch") [2] commit 5bd6bdd0f76e ("kbuild: rpm-pkg: Add (elfutils-devel or libdw-devel) to BuildRequires") Signed-off-by: Jihan LIN Reviewed-by: Petr Pavlu Link: https://patch.msgid.link/20260114-documents_gendwarfksyms-v2-1-297c98bd62c6@gmail.com [nathan: Applied Petr's suggested changes from review and minor commit message formatting adjustments] Signed-off-by: Nathan Chancellor commit 50c4a49f7292b33b454ea1a16c4f77d6965405dc Author: Akhil P Oommen Date: Wed Jan 21 21:31:57 2026 +0530 drm/msm/a8xx: Add UBWC v6 support Adreno 840 GPU supports UBWC v6. Add support for this. Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/700073/ Link: https://lore.kernel.org/r/20260121-kaana-gpu-support-v5-1-984848af12e4@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit b38d2c3302dfe7c22fde158c59cc55acd3744a26 Author: Dmitry Baryshkov Date: Wed Jan 21 10:41:24 2026 +0200 drm/ci: ignore Gamma test failures on Qualcomm SC7180 It seems, on SC7180 color conversion results are not included into the CRC calculation (unlike SM8350). The fails for SC7180 already lists CTM tests. Add gamma-related tests too. Signed-off-by: Dmitry Baryshkov Acked-by: Daniel Stone Patchwork: https://patchwork.freedesktop.org/patch/699820/ Link: https://lore.kernel.org/r/20260121-dpu-sc7180-ignore-gamma-v1-1-84f2cc2beeb1@oss.qualcomm.com commit 39a750ff5fc9cab1085dc2d4b6a3f34fe1ad23c3 Author: Federico Amedeo Izzo Date: Sun Oct 19 12:06:32 2025 +0200 drm/msm/dpu: Add DSPP GC driver to provide GAMMA_LUT DRM property Add support for DSPP GC block in DPU driver for Qualcomm SoCs. Expose the GAMMA_LUT DRM property, which is needed to enable night light and basic screen color calibration. I used LineageOS downstream kernel as a reference and found the LUT format by trial-and-error on OnePlus 6. Tested on oneplus-enchilada (sdm845-mainline 6.16-dev) and xiaomi-tissot (msm8953-mainline 6.12/main). Tested-by: David Heidelberg # Pixel 3 (next-20251018) Tested-by: Guido Günther # on sdm845-shift-axolotl Signed-off-by: Federico Amedeo Izzo Tested-by: Steev Klimaszewski Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/682102/ Link: https://lore.kernel.org/r/20251019-dpu-add-dspp-gc-driver-v3-1-840491934e56@izzo.pro Signed-off-by: Dmitry Baryshkov commit 8a8e63fedbe433b888143fcb7ff55b7a87fa3163 Author: Dmitry Torokhov Date: Tue Jan 20 10:14:45 2026 -0800 Input: appletouch - fix potential race between resume and open Take the input device's mutex in atp_resume() and atp_recover() to make sure they are not racing with open and close methods, and use input_device_enabled() helper to see if communication with the device needs to be restarted after resume. Link: https://patch.msgid.link/uuwucixxc2ckd6ul6yv5mdvkc3twytg4tg5a5vhfqg6m2qcodc@klaco6axglbm Signed-off-by: Dmitry Torokhov commit d3b6dd90e23ef1b57143e60668175ecd890948d1 Author: David Howells Date: Thu Nov 20 09:15:19 2025 +0000 crypto: Add ML-DSA crypto_sig support Add verify-only public key crypto support for ML-DSA so that the X.509/PKCS#7 signature verification code, as used by module signing, amongst other things, can make use of it through the common crypto_sig API. Signed-off-by: David Howells Reviewed-by: Jarkko Sakkinen cc: Eric Biggers cc: Lukas Wunner cc: Ignat Korchagin cc: Stephan Mueller cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org commit 3d9586f1f90c9101b1abf5b0e9d70ca45f5f16db Author: Daniel Peng Date: Mon Nov 17 17:40:41 2025 +0800 HID: i2c-hid: Add FocalTech FT8112 Information for touchscreen model HKO/RB116AS01-2 as below: - HID :FTSC1000 - slave address:0X38 - Interface:HID over I2C - Touch control lC:FT8112 - I2C ID: PNP0C50 Signed-off-by: Daniel Peng Acked-by: Jiri Kosina Reviewed-by: Douglas Anderson Link: https://patch.msgid.link/20251117094041.300083-2-Daniel_Peng@pegatron.corp-partner.google.com Signed-off-by: Dmitry Torokhov commit 38a7f7d3af10dfdb631963b9b7f30b91ba66bbc4 Author: Daniel Peng Date: Mon Nov 17 17:40:40 2025 +0800 dt-bindings: input: i2c-hid: Introduce FocalTech FT8112 Create new binding file for the FocalTech FT8112 due to new touchscreen chip. Confirm its compatible, reg for the device via vendor, and set the interrupt and reset gpio to map for Skywalker platform. FocalTech FT8112 also uses vcc33/vccio power supply. Signed-off-by: Daniel Peng Reviewed-by: Rob Herring (Arm) Acked-by: Conor Dooley Link: https://patch.msgid.link/20251117094041.300083-1-Daniel_Peng@pegatron.corp-partner.google.com Signed-off-by: Dmitry Torokhov commit 4506cdf52a806be0d9e1b1c0b6c9bc2909ca8b1c Author: Dmitry Baryshkov Date: Thu Dec 11 03:52:53 2025 +0200 ARM: dts: qcom: switch to RPMPD_* indices Use generic RPMPD_* defines for power domain instead of using platform-specific defines. Reviewed-by: Bjorn Andersson Acked-by: Bjorn Andersson Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251211-rework-rpmhpd-rpmpd-v2-2-a5ec4028129f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 26ad5d6e763070aa146d86b941884b11eb1ac0aa Author: Ihor Solodrai Date: Wed Jan 21 10:16:17 2026 -0800 scripts/gen-btf.sh: Use CONFIG_SHELL for execution According to the docs [1], kernel build scripts should be executed via CONFIG_SHELL, which is sh by default. Fixup gen-btf.sh to be runnable with sh, and use CONFIG_SHELL at every invocation site. See relevant discussion for context [2]. [1] https://docs.kernel.org/kbuild/makefiles.html#script-invocation [2] https://lore.kernel.org/bpf/CAADnVQ+dxmSNoJAGb6xV89ffUCKXe5CJXovXZt22nv5iYFV5mw@mail.gmail.com/ Signed-off-by: Ihor Solodrai Tested-by: Gary Guo Reported-by: Gary Guo Suggested-by: Thomas Weißschuh Fixes: 522397d05e7d ("resolve_btfids: Change in-place update with raw binary output") Link: https://lore.kernel.org/r/20260121181617.820300-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 84910bc5daaadff27a4f1428e15d939ee570a807 Author: Dmitry Torokhov Date: Wed Jan 21 11:55:51 2026 -0800 Input: synaptics_i2c - switch to using managed resources Switch the driver to use managed resources (devm_*) which simplifier error handling and allows removing synaptics_i2c_remove() methods form the driver. Rename "ret" to "error" where makes sense while at it. Signed-off-by: Dmitry Torokhov commit 870c2e7cd881d7a10abb91f2b38135622d9f9f65 Author: Minseong Kim Date: Wed Jan 21 10:02:02 2026 -0800 Input: synaptics_i2c - guard polling restart in resume synaptics_i2c_resume() restarts delayed work unconditionally, even when the input device is not opened. Guard the polling restart by taking the input device mutex and checking input_device_enabled() before re-queuing the delayed work. Fixes: eef3e4cab72ea ("Input: add driver for Synaptics I2C touchpad") Signed-off-by: Minseong Kim Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260121063738.799967-1-ii4gsp@gmail.com Signed-off-by: Dmitry Torokhov commit 219be8d98bd758a4d06b2ac2b1fdbb6a8c76cebe Author: Andy Shevchenko Date: Thu Nov 13 16:44:46 2025 +0100 Input: gpio_decoder - don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113154616.3107676-6-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 829400644b0afe02107e2e19a8b90dfdcd23aafe Author: Andy Shevchenko Date: Thu Nov 13 16:44:45 2025 +0100 Input: gpio_decoder - make use of the macros from bits.h Make use of BIT() where it makes sense. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113154616.3107676-5-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 4eec8772e4f501b719df5264fc345b37a9af3c68 Author: Andy Shevchenko Date: Thu Nov 13 16:44:44 2025 +0100 Input: gpio_decoder - replace custom loop by gpiod_get_array_value_cansleep() There is a custom loop that repeats parts of gpiod_get_array_value_cansleep(). Use that in conjunction with bitmap API to make code shorter and easier to follow. With this done, add an upper check for amount of GPIOs given based on the driver's code. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113154616.3107676-4-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 7cda46c30d17e6c7011fd7067f7b7638fa45934d Author: Andy Shevchenko Date: Thu Nov 13 16:44:43 2025 +0100 Input: gpio_decoder - unify messages with help of dev_err_probe() Unify error messages that might appear during probe phase by switching to use dev_err_probe(). Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113154616.3107676-3-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit c83504aac85a47e9f69cc78df396e1ab63343299 Author: Andy Shevchenko Date: Thu Nov 13 16:44:42 2025 +0100 Input: gpio_decoder - make use of device properties Convert the module to be property provider agnostic and allow it to be used on non-OF platforms. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113154616.3107676-2-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit ad7b68b04342476bd26967fed58213c61bfe7785 Author: Alex Deucher Date: Tue Jan 6 17:57:29 2026 -0500 drm/amdgpu: rename amdgpu_fence_driver_guilty_force_completion() The function no longer signals the fence so rename it to better match what it does. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 56fff1941abd3ca3b6f394979614ca7972552f7f Author: Alex Deucher Date: Thu Jan 15 21:45:43 2026 -0500 drm/amdgpu: fix type for wptr in ring backup Needs to be a u64. Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d8b210f872924112c9d9b9b9da42f3018331db9f Merge: 8f0b4cce4481fb 2fe1ef40b58c22 Author: Stephen Boyd Date: Wed Jan 21 11:25:45 2026 -0800 Merge tag 'clk-meson-v6.20-1' of https://github.com/BayLibre/clk-meson into clk-amlogic Pull Amlogic clk driver updates from Jerome Brunet: - Add support for Amlogic t7 clock controllers - Add video clocks on Amlogic s4 - HDMI PLL post divider fixes on Amlogic gx/g12 SoCs * tag 'clk-meson-v6.20-1' of https://github.com/BayLibre/clk-meson: clk: meson: gxbb: use the existing HHI_HDMI_PLL_CNTL3 macro clk: meson: g12a: Limit the HDMI PLL OD to /4 clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs clk: amlogic: remove potentially unsafe flags from S4 video clocks clk: amlogic: add video-related clocks for S4 SoC dt-bindings: clock: add video clock indices for Amlogic S4 SoC clk: meson: t7: add t7 clock peripherals controller driver clk: meson: t7: add support for the T7 SoC PLL clock dt-bindings: clock: add Amlogic T7 peripherals clock controller dt-bindings: clock: add Amlogic T7 SCMI clock controller dt-bindings: clock: add Amlogic T7 PLL clock controller commit 0028b86b52f7609e36af635ef6cb908925306233 Author: Gangliang Xie Date: Fri Jan 16 11:32:08 2026 +0800 drm/amdgpu: mark invalid records with U64_MAX set retired_page of invalid ras records to U64_MAX, and skip them when reading ras records Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 9d03d404f4bf6f02cf690ef8c9608d8f0e4ce630 Author: Lijo Lazar Date: Fri Jan 16 10:17:59 2026 +0530 drm/amdgpu: Avoid excessive dmesg log KIQ access is not guaranteed to work reliably under all reset situations. Avoid flooding dmesg with HDP flush failure messages. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit e3a6eff92bbd960b471966d9afccb4d584546d17 Author: Timur Kristóf Date: Sun Jan 18 13:57:46 2026 +0100 drm/amdgpu: Fix validating flush_gpu_tlb_pasid() When a function holds a lock and we return without unlocking it, it deadlocks the kernel. We should always unlock before returning. This commit fixes suspend/resume on SI. Tested on two Tahiti GPUs: FirePro W9000 and R9 280X. Fixes: f4db9913e4d3 ("drm/amdgpu: validate the flush_gpu_tlb_pasid()") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601190121.z9C0uml5-lkp@intel.com/ Signed-off-by: Timur Kristóf Signed-off-by: Prike Liang Reviewed-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit afaf4250713e4678563914c6cfaf3e381562cf5f Author: Yury Norov Date: Wed Jan 14 11:05:10 2026 -0500 drm/amdkfd: simplify svm_range_unmap_from_gpus() The function calls bitmap_or() followed by for_each_set_bit(). Switch it to the dedicated for_each_or_bit() and drop the temporary bitmap. Signed-off-by: Yury Norov Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 532e2c87d428d2dc18152f004c59be15281310bc Author: Lancelot Six Date: Fri Jan 16 14:30:27 2026 -0600 drm/amdkfd: Do not include VGPR MSBs in saved PC during save The current trap handler uses the top bits of ttmp1 to store a copy of sq_wave_mode.*vgpr_msb (except for src2_vgpr_msb). This is so the effective values in sq_wave_mode can be cleared to ensure correct behavior of the trap handler. When saving sq_wave_mode, the trap handler correctly rebuilds the expected value (with *vgpr_msb restored), so the save area is correct. However, the PC itself is copied from ttmp[0:1], which contains the wave's PC as well as the saved MSBs. The debugger reads the PC from the save area and is confused when non-0 values from VGPR_MSBs are present. This patch fixes this by saving the PC in the save area's PC slot, not the composite of the PC and VGPR_MSBs. On restore, the VGPR_MSBs are restored from sq_wave_mode. Signed-off-by: Lancelot Six Tested-by: Alexey Kondratiev Reviewed-by: Jay Cornwall Cc: Vladimir Indic Signed-off-by: Alex Deucher commit d5798ed98baa7691f7fbd90afd1ed03e0d62d79a Merge: 8f0b4cce4481fb baf4fc7c03bd0f Author: Stephen Boyd Date: Wed Jan 21 11:23:30 2026 -0800 Merge tag 'thead-clk-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into clk-thead Pull T-HEAD clock driver updates from Drew Fustini: There is just one set of changes for thead this cycle. They add support for CPU scaling on the T-HEAD TH1520 by allowing the PLL rate used for the CPU cluster to be reconfigured. The changes have been tested in linux-next. Signed-off-by: Drew Fustini * tag 'thead-clk-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: clk: thead: th1520-ap: Support CPU frequency scaling clk: thead: th1520-ap: Add macro to define multiplexers with flags clk: thead: th1520-ap: Support setting PLL rates clk: thead: th1520-ap: Add C910 bus clock clk: thead: th1520-ap: Poll for PLL lock and wait for stability dt-bindings: clock: thead,th1520-clk-ap: Add ID for C910 bus clock commit cf818707b543687f7cf99180ae0d218bab9a3205 Author: Timur Kristóf Date: Mon Jan 19 21:36:26 2026 +0100 drm/amd/pm: Correct comment above power2_cap attributes Previously only Van Gogh supported this, but that is not true anymore since: commit 12c958d1db36 ("drm/amd/pm: Expose ppt1 limit for gc_v9_5_0") Update the comment to reflect that. Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit e53dcefe30df4f317161f36e8bc11926e7dd7a2e Author: Timur Kristóf Date: Mon Jan 19 21:36:25 2026 +0100 drm/amd/pm: Return -EOPNOTSUPP when can't read power limit So that hwmon_attributes_visible() will see that the power2_cap attributes should not be visible on GPUs that don't support the get_power_limit() function. This fixes an error when running the "sensors" command on SI. Fixes: 12c958d1db36 ("drm/amd/pm: Expose ppt1 limit for gc_v9_5_0") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 966d70f1e160bdfdecaf7ff2b3f22ad088516e9f Author: Timur Kristóf Date: Mon Jan 19 21:36:24 2026 +0100 drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) Radeon 430 and 520 are OEM GPUs from 2016~2017 They have the same device id: 0x6611 and revision: 0x87 On the Radeon 430, powertune is buggy and throttles the GPU, never allowing it to reach its maximum SCLK. Work around this bug by raising the TDP limits we program to the SMC from 24W (specified by the VBIOS on Radeon 430) to 32W. Disabling powertune entirely is not a viable workaround, because it causes the Radeon 520 to heat up above 100 C, which I prefer to avoid. Additionally, revise the maximum SCLK limit. Considering the above issue, these GPUs never reached a high SCLK on Linux, and the workarounds were added before the GPUs were released, so the workaround likely didn't target these specifically. Use 780 MHz (the maximum SCLK according to the VBIOS on the Radeon 430). Note that the Radeon 520 VBIOS has a higher maximum SCLK: 905 MHz, but in practice it doesn't seem to perform better with the higher clock, only heats up more. v2: Move the workaround to si_populate_smc_tdp_limits. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit e214d626253f5b180db10dedab161b7caa41f5e9 Author: Timur Kristóf Date: Mon Jan 19 21:36:23 2026 +0100 drm/amd/pm: Don't clear SI SMC table when setting power limit There is no reason to clear the SMC table. We also don't need to recalculate the power limit then. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit bbcad5a8896b2d3da75d2f0dd9c85f37757d8c37 Author: Jay Cornwall Date: Fri Jan 16 12:48:45 2026 -0600 drm/amdkfd: gfx12.1 trap handler support for expert scheduling mode - Leave DEP_MODE unchanged as it is ignored in the trap handler - Save/restore SCHED_MODE (gfx12.0 saves in ttmp11) Signed-off-by: Jay Cornwall Reviewed-by: Lancelot Six Cc: Vladimir Indic Signed-off-by: Alex Deucher commit 29b703d7addf767b99ba4af98ecddd5c1c91ef38 Author: Jay Cornwall Date: Fri Jan 16 12:30:44 2026 -0600 drm/amdkfd: gfx12.1 cluster barrier context save workaround Trap cluster barrier may not serialize with user cluster barrier under some circumstances. Add a check for pending user cluster barrier complete. Signed-off-by: Jay Cornwall Tested-by: Gang Ba Cc: Harish Kasiviswanathan Reviewed-by: Lancelot Six Cc: Vladimir Indic Signed-off-by: Alex Deucher commit ea89b305b6364ea8190b5ee108b9d122e2886f34 Author: Jay Cornwall Date: Fri Jan 16 12:25:22 2026 -0600 drm/amdkfd: Fix scalar load ordering in gfx12.1 trap handler Scalar loads may arrive out-of-order with respect to KMCNT. The affected code expects the two loads to arrive in-order. Signed-off-by: Jay Cornwall Reviewed-by: Lancelot Six Cc: Joseph Greathouse Cc: Vladimir Indic Signed-off-by: Alex Deucher commit d9fc0bdf9ce43225e4de2aec316ffb0acad65ea1 Author: Jay Cornwall Date: Fri Jan 16 12:22:50 2026 -0600 drm/amdkfd: Sync trap handler binary with source Binary and source desynced during branch activity. Source merge also introduced compile error. Signed-off-by: Jay Cornwall Reviewed-by: Lancelot Six Cc: Vladimir Indic Signed-off-by: Alex Deucher commit fab47d2db5ca10c726459753224dd296506e0f97 Author: Jesse.Zhang Date: Wed Jan 14 10:51:52 2026 +0800 drm/amdgpu/vcn5.0.1: rework reset handling Resetting VCN resets the entire tile, including jpeg. When resetting the VCN, we need to ensure that JPEG data blocks are accessible and we also need to handle the JPEG queue. Add a helper function to restore the JPEG queue during the VCN reset. v2: split the jpeg helper in two, in the top helper we can stop the sched workqueues and attempt to wait for any outstanding fences. Then in the bottom helper, we can force completion, re-init the rings, and restart the sched workqueues (Alex) v3: merge patches 4 and 5 into one patch (Alex) Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit d25c67fd9d6fe0921024791bca3ab8a83ca32df7 Author: Jesse.Zhang Date: Tue Jan 20 10:23:35 2026 +0800 drm/amdgpu/vcn4.0.3: rework reset handling Resetting VCN resets the entire tile, including jpeg. When resetting the VCN, we need to ensure that JPEG data blocks are accessible and we also need to handle the JPEG queue. Add a helper function to restore the JPEG queue during the VCN reset. v2: split the jpeg helper in two, in the top helper we can stop the sched workqueues and attempt to wait for any outstanding fences. Then in the bottom helper, we can force completion, re-init the rings, and restart the sched workqueues (Alex) v3: merge patches 1 and 2 into one patch (Alex) Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit de93bc353361f5939f5257e6dcd9cb533dd7cce3 Author: Jesse.Zhang Date: Wed Jan 14 10:37:59 2026 +0800 drm/amdgpu/vcn4.0.3: implement DPG pause mode handling for VCN 4.0.3 For MI projects, when Dynamic Power Gating (DPG) is enabled, VCN reset operations should be performed with DPG in pause mode. Otherwise, the hardware may perform undesirable reset operations Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 2555f4e4a741d31e0496572a8ab4f55941b4e30e Author: Timur Kristóf Date: Mon Jan 19 21:36:22 2026 +0100 drm/amd/pm: Fix si_dpm mmCG_THERMAL_INT setting Use WREG32 to write mmCG_THERMAL_INT. This is a direct access register. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 2d4235b18974f9e47ecc363ed07f88f4ce07ebeb Merge: 8f0b4cce4481fb e897e86711b28f Author: Stephen Boyd Date: Wed Jan 21 11:16:11 2026 -0800 Merge tag 'for-6.20-clk' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into clk-tegra Pull Tegra clk driver updates from Thierry Reding: This series updates the Tegra clock driver to improve hardware support and code correctness. Key changes include fixing camera and display clock hierarchies for Tegra20/30 (adding CSI pad gates, reparenting DSI/CSUS), resolving a memory leak in the Tegra124 EMC driver, and optimizing system suspend/resume callbacks to remove redundant runtime PM overhead. * tag 'for-6.20-clk' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: clk: tegra30: Add CSI pad clock gates clk: tegra: Set CSUS as vi_sensor's gate for Tegra20, Tegra30 and Tegra114 clk: tegra20: Reparent dsi clock to pll_d_out0 clk: tegra: tegra124-emc: Simplify with scoped for each OF child loop clk: tegra: Adjust callbacks in tegra_clock_pm clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() commit 78c13dac18cf0e6f6cbc6ea85d4f967e6cca9562 Author: Konrad Dybcio Date: Mon Dec 29 21:47:41 2025 +0100 arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions Describe the GPU register regions, with the former existing but not being used much if at all on this silicon, and the latter containing various debugging levers generally related to dumping the state of the IP upon a crash. Fixes: 11750af256f8 ("arm64: dts: qcom: sm6115: Add GPU nodes") Reported-by: Krzysztof Kozlowski Closes: https://lore.kernel.org/linux-arm-msm/8a64f70b-8034-45e7-86a3-0015cf357132@oss.qualcomm.com/T/#m404f1425c36b61467760f058b696b8910340a063 Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Akhil P Oommen Link: https://lore.kernel.org/r/20251229-topic-6115_2290_gpu_dbgc-v1-3-4a24d196389c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0fdcc948929a6d673bd0f90631dd6e42090c3dbd Author: Konrad Dybcio Date: Mon Dec 29 21:47:40 2025 +0100 arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions Describe the GPU register regions, with the former existing but not being used much if at all on this silicon, and the latter containing various debugging levers generally related to dumping the state of the IP upon a crash. Fixes: 4faeef52c8e6 ("arm64: dts: qcom: qcm2290: Add GPU nodes") Reported-by: Krzysztof Kozlowski Closes: https://lore.kernel.org/linux-arm-msm/8a64f70b-8034-45e7-86a3-0015cf357132@oss.qualcomm.com/T/#m404f1425c36b61467760f058b696b8910340a063 Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Akhil P Oommen Link: https://lore.kernel.org/r/20251229-topic-6115_2290_gpu_dbgc-v1-2-4a24d196389c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit be9d54c35312479ed92c85aec3cd43153513210d Author: Alexey Klimov Date: Tue Dec 9 07:38:00 2025 +0000 arm64: dts: qcom: sm8750: add ADSP fastrpc-compute-cb nodes Add ADSP fastrpc nodes for sm8750 SoC. Cc: Ekansh Gupta Cc: Srinivas Kandagatla Signed-off-by: Alexey Klimov Link: https://lore.kernel.org/r/20251209-sm8750-fastrpc-adsp-v3-2-ccfff49a8af9@linaro.org Signed-off-by: Bjorn Andersson commit 0bcf9ca23a873e5208a32a7e8b908a6002babc8f Author: Alexey Klimov Date: Tue Dec 9 07:37:59 2025 +0000 arm64: dts: qcom: sm8750: add memory node for adsp fastrpc Add optional memory heap node that can be used for ADSP fastrpc. Cc: Ekansh Gupta Cc: Srinivas Kandagatla Signed-off-by: Alexey Klimov Link: https://lore.kernel.org/r/20251209-sm8750-fastrpc-adsp-v3-1-ccfff49a8af9@linaro.org Signed-off-by: Bjorn Andersson commit 16860aee5003dc63f788f6f2999d657da991bd58 Author: Dmitry Baryshkov Date: Thu Dec 11 03:52:52 2025 +0200 arm64: dts: qcom: switch to RPMPD_* indices Use generic RPMPD_* defines for power domain instead of using platform-specific defines. Reviewed-by: Bjorn Andersson Acked-by: Bjorn Andersson Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251211-rework-rpmhpd-rpmpd-v2-1-a5ec4028129f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6294bb8eda88c56aa5dca5953986f781eb59a4c6 Merge: 8f0b4cce4481fb e371a77255b837 Author: Stephen Boyd Date: Wed Jan 21 11:04:31 2026 -0800 Merge tag 'spacemit-clk-for-6.20-1' of https://github.com/spacemit-com/linux into clk-spacemit Pull SpacemiT clock driver updates from Yixun Lan: - Allow SpacemiT driver to be built as module - Refactor SpacemiT driver to extract common code - Add support for SpacemiT K3 SoC clk hardware * tag 'spacemit-clk-for-6.20-1' of https://github.com/spacemit-com/linux: clk: spacemit: k3: add the clock tree clk: spacemit: k3: extract common header clk: spacemit: ccu_pll: add plla type clock clk: spacemit: ccu_mix: add inverted enable gate clock dt-bindings: soc: spacemit: k3: add clock support clk: spacemit: add platform SoC prefix to reset name clk: spacemit: extract common ccu functions reset: spacemit: fix auxiliary device id clk: spacemit: prepare common ccu header clk: spacemit: Hide common clock driver from user controller clk: spacemit: Respect Kconfig setting when building modules commit 83436f2bf4e0cd84932a8fe5bce33af3b9e58120 Merge: a46a9cd19beefd 4fef3fd633be4a Author: Stephen Boyd Date: Wed Jan 21 10:56:09 2026 -0800 Merge tag 'renesas-clk-for-v6.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Fix s2ram on Renesas RZ/T2H and RZ/N2H - Add CAN-FD clocks and resets on Renesas RZ/T2H, RZ/N2H, RZ/V2H, and RZ/V2N * tag 'renesas-clk-for-v6.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: Add missing log message terminators clk: renesas: rzg2l: Remove DSI clock rate restrictions clk: renesas: rzv2h: Deassert reset on assert timeout clk: renesas: rzg2l: Deassert reset on assert timeout clk: renesas: cpg-mssr: Unlock before reset verification clk: renesas: r9a09g056: Add entries for CANFD clk: renesas: r9a09g057: Add entries for CANFD clk: renesas: r9a09g077: Add CANFD clocks clk: renesas: cpg-mssr: Handle RZ/T2H register layout in PM callbacks dt-bindings: clock: renesas,r9a09g077/87: Add PCLKCAN ID clk: renesas: cpg-mssr: Simplify pointer math in cpg_rzt2h_mstp_read() commit 649dd18f559891bdafc5532d737c7dfb56060a6d Author: Jens Axboe Date: Wed Jan 21 11:48:56 2026 -0700 io_uring/sync: validate passed in offset Check if the passed in offset is negative once cast to sync->off. This ensures that -EINVAL is returned for that case, like it would be for sync_file_range(2). Fixes: c992fe2925d7 ("io_uring: add fsync support") Signed-off-by: Jens Axboe commit 07f3c3a1cd56c2048a92dad0c11f15e4ac3888c1 Author: Jens Axboe Date: Wed Jan 21 11:21:32 2026 -0700 io_uring/eventfd: remove unused ctx->evfd_last_cq_tail member A previous commit got rid of any use of this member, but forgot to remove it. Kill it. Fixes: f4bb2f65bb81 ("io_uring/eventfd: move ctx->evfd_last_cq_tail into io_ev_fd") Signed-off-by: Jens Axboe commit 0061030929e2d09398ade9fae320528bdcba2bed Author: Cosmin Tanislav Date: Thu Jan 8 21:52:23 2026 +0200 thermal: renesas: rzg3e: add support for RZ/T2H and RZ/N2H The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs expose the temperature calibration via SMC SIP and do not have a reset for the TSU peripheral, and use different minimum and maximum temperature values compared to the already supported RZ/G3E. Although the calibration data is stored in an OTP memory, the OTP itself is not memory-mapped, access to it is done through an OTP controller. The OTP controller is only accessible from the secure world, but the temperature calibration data stored in the OTP is exposed via SMC. Add support for retrieving the calibration data using arm_smcc_smc(). Add a compatible for RZ/T2H, RZ/N2H can use it as a fallback. Reviewed-by: John Madieu Tested-by: John Madieu Signed-off-by: Cosmin Tanislav Reviewed-by: Biju Das Link: https://patch.msgid.link/20260108195223.193531-6-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Daniel Lezcano commit f41eaaa5f2c9fb4fc816e45e2061d80c0b927d39 Author: Cosmin Tanislav Date: Thu Jan 8 21:52:22 2026 +0200 dt-bindings: thermal: r9a09g047-tsu: document RZ/T2H and RZ/N2H The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs include a Temperature Sensor Unit (TSU). The device provides real-time temperature measurements for thermal management, utilizing a single dedicated channel for temperature sensing. Compared to the previously supported RZ/G3E, the RZ/T2H and RZ/N2H SoCs do not have a reset for the TSU peripheral, and the OTP data is exposed via ARM SMC, as opposed to a system register. Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20260108195223.193531-5-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Daniel Lezcano commit c33edd8f936ccf2e47eb1883f6b6944643d325c7 Author: Cosmin Tanislav Date: Thu Jan 8 21:52:21 2026 +0200 thermal: renesas: rzg3e: make calibration value retrieval per-chip The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs expose the temperature calibration data via SMC SIP calls. To prepare for supporting these SoCs, do the following changes. Rename rzg3e_thermal_parse_dt() to rzg3e_thermal_get_syscon_trim(). Move the syscon usage out of rzg3e_thermal_get_calibration() and into rzg3e_thermal_get_syscon_trim() and remove single-use variables from the private state. Place a pointer to rzg3e_thermal_get_syscon_trim() into the chip-specific struct, and use it in the probe function to retrieve the calibration values. Now that syscon usage has been moved out of rzg3e_thermal_get_calibration(), remove it and inline the calibration validation into the probe function. Also, reuse the TSU_CODE_MAX macro to mask the calibration values, as GEMASK(11, 0) and 0xFFF are equivalent, and replace the hardcoded 0xFFF with TSU_CODE_MAX in the calibration validation. Reviewed-by: John Madieu Tested-by: John Madieu Signed-off-by: Cosmin Tanislav Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260108195223.193531-4-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Daniel Lezcano commit 6c7f87f517d3704a3fcc3b1c7f4220c2fcf75322 Author: Cosmin Tanislav Date: Thu Jan 8 21:52:20 2026 +0200 thermal: renesas: rzg3e: make min and max temperature per-chip The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have different minimum and maximum temperatures compared to the already supported RZ/G3E. Prepare for them by moving these into a chip-specific struct. Reviewed-by: Geert Uytterhoeven Reviewed-by: John Madieu Tested-by: John Madieu Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20260108195223.193531-3-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Daniel Lezcano commit 671d315c1c86a43128c0c30c82fe1eccc7af9901 Author: Cosmin Tanislav Date: Thu Jan 8 21:52:19 2026 +0200 thermal: renesas: rzg3e: make reset optional The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs do not have a reset line. Prepare for them by making it optional. Reviewed-by: Geert Uytterhoeven Reviewed-by: John Madieu Tested-by: John Madieu Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20260108195223.193531-2-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Daniel Lezcano commit 6d6ad32e22f028c525d5df471c5522616e645a6b Author: Ziyu Chen Date: Wed Jan 21 17:41:47 2026 +0800 selftests/pidfd: fix typo in comment Fix the typo "untill" → "until" in a comment in pidfd_info_test.c. This typo is already listed in scripts/spelling.txt by commit 66b47b4a9dad ("checkpatch: look for common misspellings"). Link: https://lore.kernel.org/r/20260121094147.4187337-1-chenziyu@uniontech.com Suggested-by: Cryolitia PukNgae Signed-off-by: Ziyu Chen Signed-off-by: Shuah Khan commit d73cbe2c14cce700d18fc135946d3a0e1c989bae Merge: d0f5d4f8f32853 f4924ad0b13fd4 Author: Alexei Starovoitov Date: Wed Jan 21 09:42:53 2026 -0800 Merge branch 'bpf-add-kfunc-bpf_strncasecmp' Yuzuki Ishiyama says: ==================== bpf: Add kfunc bpf_strncasecmp() This patchset introduces bpf_strncasecmp to allow case-insensitive and limited-length string comparison. This is useful for parsing protocol headers like HTTP. --- Changes in v5: - Fixed the test function numbering Changes in v4: - Updated the loop variable to maintain style consistency Changes in v3: - Use ternary operator to maintain style consistency - Reverted unnecessary doc comment about XATTR_SIZE_MAX Changes in v2: - Compute max_sz upfront and remove len check from the loop body - Document that @len is limited by XATTR_SIZE_MAX ==================== Link: https://patch.msgid.link/20260121033328.1850010-1-ishiyama@hpc.is.uec.ac.jp Signed-off-by: Alexei Starovoitov commit f4924ad0b13fd4ca4f0c7117dc143bf372224aec Author: Yuzuki Ishiyama Date: Wed Jan 21 12:33:28 2026 +0900 selftests/bpf: Test kfunc bpf_strncasecmp Add testsuites for kfunc bpf_strncasecmp. Signed-off-by: Yuzuki Ishiyama Acked-by: Viktor Malik Link: https://lore.kernel.org/r/20260121033328.1850010-3-ishiyama@hpc.is.uec.ac.jp Signed-off-by: Alexei Starovoitov commit 1dc669646762726d59be15e2de354b06e3e0cbcf Author: Yuzuki Ishiyama Date: Wed Jan 21 12:33:27 2026 +0900 bpf: add bpf_strncasecmp kfunc bpf_strncasecmp() function performs same like bpf_strcasecmp() except limiting the comparison to a specific length. Signed-off-by: Yuzuki Ishiyama Acked-by: Viktor Malik Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260121033328.1850010-2-ishiyama@hpc.is.uec.ac.jp Signed-off-by: Alexei Starovoitov commit 75e7ed52ac7c1da90f304dcda2906636404df921 Author: Gokul Praveen Date: Wed Jan 21 11:41:34 2026 +0530 pwm: tiehrpwm: Enable pwmchip's parent device before setting configuration The period and duty cycle configurations on J7200 and J784S4 SoCs does not get reflected after setting them using sysfs nodes. This is because at the end of ehrpwm_pwm_config function, the put_sync function is called which resets the hardware. Hold the PWM controller out of low-power mode during .apply() to make sure it accepts the writes to its registers. This renders the calls to pm_runtime_get_sync() and pm_runtime_put_sync() in ehrpwm_pwm_config() into no-ops, so these can be dropped. Fixes: 5f027d9b83db ("pwm: tiehrpwm: Implement .apply() callback") Signed-off-by: Gokul Praveen Suggested-by: Uwe Kleine-König Link: https://patch.msgid.link/20260121061134.15466-1-g-praveen@ti.com Signed-off-by: Uwe Kleine-König commit d0f5d4f8f3285349bfb94fa84555ab267d2c041d Author: Matt Bobrowski Date: Wed Jan 21 09:00:01 2026 +0000 bpf: Revert "bpf: drop KF_ACQUIRE flag on BPF kfunc bpf_get_root_mem_cgroup()" This reverts commit e463b6de9da1 ("bpf: drop KF_ACQUIRE flag on BPF kfunc bpf_get_root_mem_cgroup()"). The original commit removed the KF_ACQUIRE flag from bpf_get_root_mem_cgroup() under the assumption that it resulted in simplified usage. This stemmed from the fact that bpf_get_root_mem_cgroup() inherently returns a reference to an object which technically isn't reference counted, therefore there is no strong requirement to call a matching bpf_put_mem_cgroup() on the returned reference. Although technically correct, as per the arguments in the thread [0], dropping the KF_ACQUIRE flag and losing reference tracking semantics negatively impacted the usability of bpf_get_root_mem_cgroup() in practice. [0] https://lore.kernel.org/bpf/878qdx6yut.fsf@linux.dev/ Link: https://lore.kernel.org/bpf/CAADnVQ+6d1Lj4dteAv8u62d7kj3Ze5io6bqM0xeQd-UPk9ZgJQ@mail.gmail.com/ Signed-off-by: Matt Bobrowski Link: https://lore.kernel.org/r/20260121090001.240166-1-mattbobrowski@google.com Signed-off-by: Alexei Starovoitov commit ca674a032fb3ecc8e658ba24dd40b8c3dfff4dff Merge: ba335bf3a5b8c5 1ed79776431549 Author: Alexei Starovoitov Date: Wed Jan 21 09:31:35 2026 -0800 Merge branch 'bpf-support-bpf_get_func_arg-for-bpf_trace_raw_tp' Menglong Dong says: ==================== bpf: support bpf_get_func_arg() for BPF_TRACE_RAW_TP Support bpf_get_func_arg() for BPF_TRACE_RAW_TP by getting the function argument count from "prog->aux->attach_func_proto" during verifier inline. Changes v5 -> v4: * some format adjustment in the 1st patch * v4: https://lore.kernel.org/bpf/20260120073046.324342-1-dongml2@chinatelecom.cn/ Changes v4 -> v3: * fix the error of using bpf_get_func_arg() for BPF_TRACE_ITER * v3: https://lore.kernel.org/bpf/20260119023732.130642-1-dongml2@chinatelecom.cn/ Changes v3 -> v2: * remove unnecessary NULL checking for prog->aux->attach_func_proto * v2: https://lore.kernel.org/bpf/20260116071739.121182-1-dongml2@chinatelecom.cn/ Changes v2 -> v1: * for nr_args, skip first 'void *__data' argument in btf_trace_##name typedef * check the result4 and result5 in the selftests * v1: https://lore.kernel.org/bpf/20260116035024.98214-1-dongml2@chinatelecom.cn/ ==================== Link: https://patch.msgid.link/20260121044348.113201-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 1ed797764315496a115cd0568450a7f72da80df6 Author: Menglong Dong Date: Wed Jan 21 12:43:48 2026 +0800 selftests/bpf: test bpf_get_func_arg() for tp_btf Test bpf_get_func_arg() and bpf_get_func_arg_cnt() for tp_btf. The code is most copied from test1 and test2. Signed-off-by: Menglong Dong Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20260121044348.113201-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 85c7f914714741de992fc19c2ba673f6c400a584 Author: Menglong Dong Date: Wed Jan 21 12:43:47 2026 +0800 bpf: support bpf_get_func_arg() for BPF_TRACE_RAW_TP For now, bpf_get_func_arg() and bpf_get_func_arg_cnt() is not supported by the BPF_TRACE_RAW_TP, which is not convenient to get the argument of the tracepoint, especially for the case that the position of the arguments in a tracepoint can change. The target tracepoint BTF type id is specified during loading time, therefore we can get the function argument count from the function prototype instead of the stack. Signed-off-by: Menglong Dong Acked-by: Yonghong Song Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20260121044348.113201-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 702ce71d32f2c30b4f45b7c6b701d87583c58df8 Author: Charles Keepax Date: Thu Jan 15 13:17:26 2026 +0000 ASoC: SDCA: Add NO_DIRECT_COMPLETE flag to class driver The SDCA class driver currently expects the device will be fully powered down on system suspend but not on runtime suspend. This is typically required as when audio is not active (ie. runtime suspend) jack detect is expected to still function, but when the whole system is hibernated there is no need to recognise audio jack events. This means the class driver needs to always be informed of a system suspend, so the direct complete optimisation (where PM will skip calling system suspend if the device is runtime suspended) is not appropriate for the SDCA class driver. Add the NO_DIRECT_COMPLETE flag to prevent this optimisation from running against this driver. Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart link: https://github.com/thesofproject/linux/blob/ec0e6c69113f4b342ee8eabec286dea33d98a7cc/drivers/soundwire/intel_auxdevice.c#L568 Link: https://patch.msgid.link/20260115131727.373738-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 96b0bb4a2310302307bafe62edbc3455fae8b723 Author: Ovidiu Panait Date: Tue Dec 9 09:11:13 2025 +0000 dt-bindings: thermal: r9a09g047-tsu: Document RZ/V2N TSU The Renesas RZ/V2N SoC includes a Thermal Sensor Unit (TSU) block designed to measure the junction temperature. The device provides real-time temperature measurements for thermal management, utilizing two dedicated channels for temperature sensing. The Renesas RZ/V2N SoC is using the same TSU IP found on the RZ/G3E SoC, the only difference being that it has two channels instead of one. Add new compatible string "renesas,r9a09g056-tsu" for RZ/V2N and use "renesas,r9a09g047-tsu" as a fallback compatible to indicate hardware compatibility with the RZ/G3E implementation. Signed-off-by: Ovidiu Panait Acked-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251209091115.8541-2-ovidiu.panait.rb@renesas.com Signed-off-by: Daniel Lezcano commit 68b271a3a94cfd6c7695a96b6398b52feb89e2c2 Author: Luca Ceresoli Date: Wed Dec 31 09:22:47 2025 +0100 drm/bridge: fix kdoc syntax Use the correct kdoc syntax for bullet list. Fixes kdoc error and warning: Documentation/gpu/drm-kms-helpers:197: ./drivers/gpu/drm/drm_bridge.c:1519: ERROR: Unexpected indentation. [docutils] Documentation/gpu/drm-kms-helpers:197: ./drivers/gpu/drm/drm_bridge.c:1521: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512302319.1PGGt3CN-lkp@intel.com/ Fixes: 9da0e06abda8 ("drm/bridge: deprecate of_drm_find_bridge()") Reviewed-by: Nicolas Frattaroli Link: https://patch.msgid.link/20251231-drm-bridge-alloc-getput-drm_of_find_bridge-kdoc-fix-v1-1-193a03f0609c@bootlin.com Signed-off-by: Luca Ceresoli commit d6d0e6b9d54532264761405a1ba8ea5bd293acb1 Author: Eric Biggers Date: Fri Jan 16 19:02:36 2026 -0800 dm: fix excessive blk-crypto operations for invalid keys dm_exec_wrappedkey_op() passes through the derive_sw_secret, import_key, generate_key, and prepare_key blk-crypto operations to an underlying device. Currently, it calls the operation on every underlying device until one returns success. This logic is flawed when the operation is expected to fail, such as an invalid key being passed to derive_sw_secret. That can happen if userspace passes an invalid key to the FS_IOC_ADD_ENCRYPTION_KEY ioctl. When that happens on a device-mapper device that consists of many dm-linear targets, a lot of unnecessary key unwrapping requests get sent to the underlying key wrapping hardware. Fix this by considering the first device only. As already documented in the comment, it was already checked that all underlying devices support wrapped keys, so this should be fine. Fixes: e93912786e50 ("dm: pass through operations on wrapped inline crypto keys") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 854583f9992671411bad28bd8a3867afba7cce77 Author: Nick Xie Date: Wed Jan 21 09:47:25 2026 +0800 arm64: dts: amlogic: meson-s4-s905y4-khadas-vim1s: enable SDIO interface Enable the SDIO controller interface connected to the on-board AP6256 WiFi/BT module. Signed-off-by: Nick Xie Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260121014725.122722-1-nick@khadas.com Signed-off-by: Neil Armstrong commit be9d8d966447aeb8f0f8047503195bdd128ecd31 Merge: 7f428282fde34f d0ab89951197f0 Author: Mark Brown Date: Wed Jan 21 16:06:39 2026 +0000 ASoC: cs35l56: Add support for new Dell laptops Merge series from Richard Fitzgerald : On new Dell models the driver must read a UEFI variable to get a variant identifier for the audio hardware. Without this, the driver cannot know which firmware file to load to the amps. commit 68dabf4ebe0ec2f9a51d3fdc17b1ec64500b7ed4 Author: Thorsten Blum Date: Mon Jan 5 13:13:03 2026 +0100 thermal/drivers/broadcom: Use clamp to simplify bcm2835_thermal_temp2adc Use clamp() to simplify bcm2835_thermal_temp2adc() and improve its readability. Explicitly cast BIT() to int to prevent a signedness error. Signed-off-by: Thorsten Blum Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260105121308.1761-1-thorsten.blum@linux.dev Signed-off-by: Daniel Lezcano commit 733f0303c2a7282750fa283b0458ffad3b6ba8ee Merge: 599efa093ffcc3 fe099c387e06b5 Author: Arnd Bergmann Date: Wed Jan 21 16:45:49 2026 +0100 Merge tag 'qcom-drivers-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers Qualcomm driver updates for v6.20 Support multiple wait queues in the SCM firmware interface and provide discovery of the wait queue interrupt to deal with the cases where bootloader didn't patch the DeviceTree with the IRQ information. Refactor the MDT loader and the SCM driver's peripheral authentication service interface and introduce support for passing a remoteproc resource table to the firmware. The remoteproc patches that uses this and uses this to configure the IOMMU are included here due to bidirectional dependencies. The end result is remoteproc support on the Glymur platform. Enable QSEECOM and thereby UEFI variable access, on the Surface Pro 11. Make the QMI interface endianness aware, to support ath1Xk on big endian machines. Add the Glymur support in LLCC driver. * tag 'qcom-drivers-for-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (33 commits) soc: qcom: preserve CPU endianness for QMI_DATA_LEN soc: qcom: fix QMI encoding/decoding for basic elements soc: qcom: check QMI basic element error codes soc: qcom: ubwc: add missing include remoteproc: qcom: pas: Enable Secure PAS support with IOMMU managed by Linux remoteproc: pas: Extend parse_fw callback to fetch resources via SMC call firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table firmware: qcom_scm: Add SHM bridge handling for PAS when running without QHEE firmware: qcom_scm: Refactor qcom_scm_pas_init_image() firmware: qcom_scm: Add a prep version of auth_and_reset function soc: qcom: mdtloader: Remove qcom_mdt_pas_init() from exported symbols soc: qcom: mdtloader: Add PAS context aware qcom_mdt_pas_load() function remoteproc: pas: Replace metadata context with PAS context structure firmware: qcom_scm: Introduce PAS context allocator helper function firmware: qcom_scm: Rename peripheral as pas_id firmware: qcom_scm: Remove redundant piece of code dt-bindings: remoteproc: qcom,pas: Add iommus property soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe soc: qcom: pmic_glink_altmode: Consume TBT3/USB4 mode notifications dt-bindings: qcom,pdc: document the Milos Power Domain Controller ... Signed-off-by: Arnd Bergmann commit 599efa093ffcc342b8ec18e9c77a8c959efd4b9b Merge: 6d9e4c74372bd0 80db65d4acfb9f Author: Arnd Bergmann Date: Wed Jan 21 16:43:45 2026 +0100 Merge tag 'ti-driver-soc-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers TI SoC driver updates for v6.20 Bug Fixes: - pruss: Fix double free in pruss_clk_mux_setup() - k3-socinfo: Fix regmap leak on probe failure - k3-socinfo: Fix compile testing dependency issue Cleanups: - knav_dma/knav_qmss: Remove redundant ENOMEM printks and simplify error messages - knav_dma/knav: Simplify code with scoped for each OF child loops - ti_sci.h: Fix all kernel-doc warnings * tag 'ti-driver-soc-for-v6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: soc: ti: pruss: Fix double free in pruss_clk_mux_setup() soc: ti: k3-socinfo: Fix regmap leak on probe failure soc: ti: k3-socinfo: Fix compile testing soc: ti: knav_dma: Simplify with scoped for each OF child loop soc: ti: knav: Simplify with scoped for each OF child loop soc: ti: knav_dma: Simplify error messages in probe soc: ti: knav_dma: Remove ENOMEM printks soc: ti: knav_qmss: Remove ENOMEM printks firmware: ti_sci.h: fix all kernel-doc warnings Signed-off-by: Arnd Bergmann commit 6d9e4c74372bd08c75d7c2dbdccc4d713caabbd9 Merge: 419a620dc452b9 f6ef3d9ff81240 Author: Arnd Bergmann Date: Wed Jan 21 16:39:29 2026 +0100 Merge tag 'imx-drivers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/drivers i.MX drivers changes for 6.20: - A few changes from Peng Fan adding dump syslog support for i.MX System Manager firmware driver, cleaning up soc-imx9 driver, fixing error handling for soc-imx8m driver * tag 'imx-drivers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: soc: imx8m: Fix error handling for clk_prepare_enable() soc: imx: Spport i.MX9[4,52] soc: imx: Use dev_err_probe() for i.MX9 soc: imx: Use device-managed APIs for i.MX9 firmware: imx: sm-misc: Dump syslog info firmware: arm_scmi: imx: Support getting syslog of MISC protocol Signed-off-by: Arnd Bergmann commit 419a620dc452b9cd6aa684d99bcff352f7ab7f13 Merge: f8d91cfb93a292 1f58ad77a8b496 Author: Arnd Bergmann Date: Wed Jan 21 16:37:44 2026 +0100 Merge tag 'zynqmp-soc-for-6.20' of https://github.com/Xilinx/linux-xlnx into soc/drivers arm64: Xilinx SOC changes for 6.20 - Fix Michal's email in cpuidle driver - s/system_unbound_wq/system_dfl_wq/g in zynqmp_power * tag 'zynqmp-soc-for-6.20' of https://github.com/Xilinx/linux-xlnx: cpuidle: zynq: Switch Michal Simek's email to new one soc/xilinx: replace use of system_unbound_wq with system_dfl_wq Signed-off-by: Arnd Bergmann commit f8d91cfb93a292724352747b24ca2b6ad756107a Merge: ee405f1a3bab11 70f752ebb08c85 Author: Arnd Bergmann Date: Wed Jan 21 16:34:00 2026 +0100 Merge tag 'tegra-for-6.20-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers soc/tegra: Changes for v6.20-rc1 This series primarily refactors the Tegra PMC driver to eliminate reliance on a global variable, transitioning to passing the tegra_pmc context explicitly across clocks, powergates, sysfs/debugfs interfaces, and power management callbacks. Additionally, it resolves a warning during system resume by deferring an unsafe generic_handle_irq() call to a hard IRQ context using irq_work. * tag 'tegra-for-6.20-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: pmc: Add PMC contextual functions soc/tegra: pmc: Do not rely on global variable soc/tegra: pmc: Use driver-private data soc/tegra: pmc: Use PMC context embedded in powergates soc/tegra: pmc: Pass PMC context as debugfs data soc/tegra: pmc: Pass PMC context via sys-off callback data soc/tegra: pmc: Embed reboot notifier in PMC context soc/tegra: pmc: Store PMC context in clocks soc/tegra: pmc: Pass struct tegra_pmc to tegra_powergate_state() soc/tegra: pmc: Use contextual data instead of global variable soc/tegra: pmc: Fix unsafe generic_handle_irq() call Signed-off-by: Arnd Bergmann commit ee405f1a3bab111b9726b84325b72b8e11ac4c1f Merge: ee5dde7ed6ab1b 900131320bc9a9 Author: Arnd Bergmann Date: Wed Jan 21 16:31:46 2026 +0100 Merge tag 'samsung-drivers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers Samsung SoC drivers for v6.20 1. Several improvements in Exynos ChipID Socinfo driver and finally adding Google GS101 SoC support. 2. Few cleanups from old code. 3. Documenting Axis Artpec-9 SoC PMU (Power Management Unit). * tag 'samsung-drivers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: s3c: remove a leftover hwmon-s3c.h header file dt-bindings: soc: samsung: exynos-pmu: Drop unnecessary select schema soc: samsung: exynos-chipid: add google,gs101-otp support soc: samsung: exynos-chipid: downgrade dev_info to dev_dbg for soc info soc: samsung: exynos-chipid: rename method dt-bindings: nvmem: add google,gs101-otp soc: samsung: exynos-chipid: use dev_err_probe where appropiate soc: samsung: exynos-chipid: use devm action to unregister soc device dt-bindings: samsung: exynos-pmu: Add compatible for ARTPEC-9 SoC Signed-off-by: Arnd Bergmann commit ee5dde7ed6ab1b7efc26e3bdd534554d2242a14d Merge: 4b45c2f3f88c1b c19faf5a62315d Author: Arnd Bergmann Date: Wed Jan 21 16:30:51 2026 +0100 Merge tag 'tee-sysfs-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers TEE sysfs for 6.20 - Add an optional generic sysfs attribute for TEE revision - Implement revision reporting for OP-TEE using both SMC and FF-A ABIs * tag 'tee-sysfs-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: optee: store OS revision for TEE core tee: add revision sysfs attribute Signed-off-by: Arnd Bergmann commit 4b45c2f3f88c1be871f6e74efcf1606e476e0f0b Merge: e6bea2f5534d5c a0db08f47c8362 Author: Arnd Bergmann Date: Wed Jan 21 16:29:53 2026 +0100 Merge tag 'amdtee-update-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers AMDTEE update for 6.20 Remove unused return variables * tag 'amdtee-update-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: amdtee: Remove unused return variables Signed-off-by: Arnd Bergmann commit 8672be1c1aae98ca96e520bb71245228a1b65f8d Author: Andy Shevchenko Date: Wed Jan 14 10:28:08 2026 +0100 thermal/drivers/stm32: Use predefined HZ_PER_MHZ instead of a custom one Use predefined HZ_PER_MHZ instead of a custom one. No functional changes. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260114092808.273695-1-andriy.shevchenko@linux.intel.com Signed-off-by: Daniel Lezcano commit e6bea2f5534d5c68ea48f840ef84296062961ede Merge: 08b67ff20fc6f1 e82d0477fd8070 Author: Arnd Bergmann Date: Wed Jan 21 16:28:23 2026 +0100 Merge tag 'tee-bus-callback-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers TEE bus callback for 6.20 - Move from generic device_driver to TEE bus-specific callbacks - Add module_tee_client_driver() and registration helpers to reduce boilerplate - Convert several client drivers (TPM, KEYS, firmware, EFI, hwrng, and RTC) - Update documentation and fix kernel-doc warnings * tag 'tee-bus-callback-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tpm/tpm_ftpm_tee: Fix kdoc after function renames tpm/tpm_ftpm_tee: Make use of tee bus methods tpm/tpm_ftpm_tee: Make use of tee specific driver registration KEYS: trusted: Make use of tee bus methods KEYS: trusted: Migrate to use tee specific driver registration function firmware: tee_bnxt: Make use of tee bus methods firmware: tee_bnxt: Make use of module_tee_client_driver() firmware: arm_scmi: Make use of tee bus methods firmware: arm_scmi: optee: Make use of module_tee_client_driver() efi: stmm: Make use of tee bus methods efi: stmm: Make use of module_tee_client_driver() hwrng: optee - Make use of tee bus methods hwrng: optee - Make use of module_tee_client_driver() rtc: optee: Make use of tee bus methods rtc: optee: Migrate to use tee specific driver registration function tee: Adapt documentation to cover recent additions tee: Add probe, remove and shutdown bus callbacks to tee_client_driver tee: Add some helpers to reduce boilerplate for tee client drivers Signed-off-by: Arnd Bergmann commit 08b67ff20fc6f1f9955ac71f790147e3a6bb4c07 Merge: 06e981ae164839 94ea7063fae835 Author: Arnd Bergmann Date: Wed Jan 21 16:27:26 2026 +0100 Merge tag 'optee-update-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers OP-TEE update for 6.20 - A micro optimization by making a local array static const - Update OP-TEE mailing list as moderated - Update an outdated comment for cmd_alloc_suppl() * tag 'optee-update-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: optee: make read-only array attr static const MAINTAINERS: Mark the OP-TEE mailing list moderated optee: update outdated comment Signed-off-by: Arnd Bergmann commit 06e981ae1648390f404a1e36fce19a9fea7eeb95 Merge: f716774b2cc873 1c05d9a4cab2ab Author: Arnd Bergmann Date: Wed Jan 21 16:26:56 2026 +0100 Merge tag 'qcomtee-fixes-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers QCOMTEE fixes for 6.20 Small cleanups for the qcomtee driver to align with recommended coding practices for the cleanup.h infrastructure. * tag 'qcomtee-fixes-for-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: qcomtee: user: Fix confusing cleanup.h syntax tee: qcomtee: mem: Fix confusing cleanup.h syntax tee: qcomtee: call: Fix confusing cleanup.h syntax Signed-off-by: Arnd Bergmann commit f716774b2cc873fe59d34d137f36f3b609bc1c84 Merge: 34f60ff256e18a 49261f479d4571 Author: Arnd Bergmann Date: Wed Jan 21 16:25:01 2026 +0100 Merge tag 'renesas-drivers-for-v6.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v6.20 (take two) - Add and use for_each_of_imap_item() iterator, - Add support for the RZ/N1 GPIO Interrupt Multiplexer. * tag 'renesas-drivers-for-v6.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: Add support for RZ/N1 GPIO Interrupt Multiplexer irqchip/renesas-rza1: Use for_each_of_imap_item iterator irqchip/ls-extirq: Use for_each_of_imap_item iterator of: unittest: Add a test case for for_each_of_imap_item iterator of/irq: Introduce for_each_of_imap_item Signed-off-by: Arnd Bergmann commit 34f60ff256e18a3a8b521a59cae7fc80dd31d720 Merge: 7a391243d4a5e2 24a0ffefe3f097 Author: Arnd Bergmann Date: Wed Jan 21 16:22:21 2026 +0100 Merge tag 'scmi-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm SCMI updates for v7.0 A set of cleanups, refactoring, and fixes to the Arm SCMI stack: 1. Rework protocol version negotiation by moving version discovery and downgrade handling into the SCMI core and performing negotiation early, before protocol initialization. Remove legacy per-protocol versioning logic now made redundant by centralized SCMI handling. 2. Increase the internal MAX_OPPS limit in the SCMI performance protocol to 64, allowing platforms with larger OPP tables to be fully supported. 3. Reduce duplicated boilerplate in pinctrl and related protocols by consolidating validation and lookup logic in protocol get info helpers. 4. Refactor reset protocol domain handling by introducing a shared lookup helper, ensuring consistent validation and error reporting. 5. Fix potential undefined behaviour by properly initializing pointers annotated with the __free attribute. * tag 'scmi-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Remove legacy protocol versioning logic firmware: arm_scmi: Rework protocol version negotiation logic firmware: arm_scmi: Increase performance MAX_OPPS limit to 64 firmware: arm_scmi: Move boiler plate code into the get info functions firmware: arm_scmi: Refactor reset domain handling firmware: arm_scmi: Fix uninitialized pointers with __free attr Signed-off-by: Arnd Bergmann commit 7a391243d4a5e2e48ffd2b0bb20f69b652ef2791 Merge: 4e2c045f1043ae be4d4543f78074 Author: Arnd Bergmann Date: Wed Jan 21 16:19:24 2026 +0100 Merge tag 'ffa-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm FF-A updates for v7.0 A small set of updates to the Arm FF-A driver: 1. Fix a correctness issue in NOTIFICATION_INFO_GET handling of 32-bit firmware responses, avoiding reads from undefined register bits. 2. Improve clarity and robustness of FF-A feature checks by tying them to explicit version requirements. 3. Ensure Rx/Tx buffers are unmapped on FF-A initialization failure to prevent resource leaks. * tag 'ffa-updates-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET firmware: arm_ffa: Tie FF-A version checks to specific features firmware: arm_ffa: Unmap Rx/Tx buffers on init failure Signed-off-by: Arnd Bergmann commit eb89b17f283b233ba721fce358fa0d15223ae69d Author: Greg Kroah-Hartman Date: Wed Jan 21 15:51:04 2026 +0100 Revert "mmc: rtsx_pci: add quirk to disable MMC_CAP_AGGRESSIVE_PM for RTS525A" This reverts commit 5f0bf80cc5e04d31eeb201683e0b477c24bd18e7. This was asked to be reverted as it is not the correct way to do this. Fixes: 5f0bf80cc5e0 ("mmc: rtsx_pci: add quirk to disable MMC_CAP_AGGRESSIVE_PM for RTS525A") Cc: Matthew Schwartz Signed-off-by: Greg Kroah-Hartman commit c23f0550c05d40762b141808709667759291c938 Author: Greg Kroah-Hartman Date: Wed Jan 21 15:50:36 2026 +0100 Revert "mmc: rtsx: reset power state on suspend" This reverts commit eac85fbd0867c25ac517f58fae401d65c627edff. This is not the correct change, so revert it for now. Fixes: eac85fbd0867 ("mmc: rtsx: reset power state on suspend") Cc: Matthew Schwartz Cc: Ulf Hansson Signed-off-by: Greg Kroah-Hartman commit ff112f1ecd10b72004eac05bae395e1c65f0c63c Author: Greg Kroah-Hartman Date: Wed Jan 21 15:49:31 2026 +0100 Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" This reverts commit aced969e9bf3701dc75cfca57c78c031b7875b9d. It was determined that this was not the correct "fix", so should be reverted. Fixes: aced969e9bf3 ("mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms") Cc: Matthew Schwartz Cc: Ulf Hansson Signed-off-by: Greg Kroah-Hartman commit 4e2c045f1043aee67c6a3f1fbba609fba2f70532 Merge: f8f9c1f4d0c7a6 1bea7e94bf09ee Author: Arnd Bergmann Date: Wed Jan 21 15:48:41 2026 +0100 Merge tag 'renesas-drivers-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v6.20 - Enable Interrupt Controller (ICU) support on the RZ/N2H SoC. * tag 'renesas-drivers-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: Enable ICU support on RZ/N2H Signed-off-by: Arnd Bergmann commit 880528eaa67fc6446a0b5c16757f0d6a2639ccda Author: Ke Sun Date: Tue Jan 20 16:38:19 2026 +0800 rust: block: mq: use pin_init::zeroed() for tag_set Replace unsafe core::mem::zeroed() with pin_init::zeroed() for blk_mq_tag_set initialization. Signed-off-by: Ke Sun Acked-by: Andreas Hindborg Reviewed-by: Gary Guo Link: https://lore.kernel.org/r/20260120083824.477339-4-sunke@kylinos.cn Signed-off-by: Jens Axboe commit d7a4693a250ee2f185ce5c878e74252e533ac4b9 Author: Ke Sun Date: Tue Jan 20 16:38:18 2026 +0800 rust: block: mq: use pin_init::zeroed() for queue_limits Replace unsafe core::mem::zeroed() with pin_init::zeroed() for queue_limits initialization. Signed-off-by: Ke Sun Acked-by: Andreas Hindborg Reviewed-by: Gary Guo Link: https://lore.kernel.org/r/20260120083824.477339-3-sunke@kylinos.cn Signed-off-by: Jens Axboe commit 86291f774fe8524178446cb2c792939640b4970c Author: Qiang Yu Date: Wed Dec 24 02:10:46 2025 -0800 PCI: dwc: Remove duplicate dw_pcie_ep_hide_ext_capability() function Remove dw_pcie_ep_hide_ext_capability() and replace its usage with dw_pcie_remove_ext_capability(). Both functions serve the same purpose of hiding PCIe extended capabilities, but dw_pcie_remove_ext_capability() provides a cleaner API that doesn't require the caller to specify the previous capability ID. Suggested-by: Niklas Cassel Signed-off-by: Qiang Yu Signed-off-by: Manivannan Sadhasivam Tested-by: Niklas Cassel Link: https://patch.msgid.link/20251224-remove_dw_pcie_ep_hide_ext_capability-v1-1-4302c9cdc316@oss.qualcomm.com commit 29132d16965e66fed0bf7b38242e7e57df294ba0 Author: Arnaldo Carvalho de Melo Date: Tue Jan 20 18:16:09 2026 -0300 perf list: Don't write to const memory Something now detected on fedora 44, where strchr() returns const if it is passed a const pointer: util/print-events.c: In function 'print_sdt_events': util/print-events.c:89:29: error: initialization discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] 89 | char *bid = strchr(sdt_name->s, '@'); | ^~~~~~ Fix it by using strchrnul() + strncmp() instead of temporarily scrubbing it with '\0'. Reviewed-by: Ian Rogers Suggested-by: David Laight Link: https://lore.kernel.org/r/20260121112536.27fd5d11@pumpkin Signed-off-by: Arnaldo Carvalho de Melo commit 9a0a5b5ac4372da84394dc329f763d6b7d384a86 Author: Arnaldo Carvalho de Melo Date: Tue Jan 20 18:26:44 2026 -0300 perf list: Signal changing const memory is ok In this case its a temp list that is created just for listing events and will be deleted at the end, so just cast it to get rid of the compiler warning. Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit e3b5b77e36894b4d61374ecb916355809c6e4aa4 Author: Detlev Casanova Date: Fri Jan 9 11:15:33 2026 -0500 media: rkvdec: Add HEVC support for the VDPU383 variant The VDPU383 decoder is used on the RK3576 SoC and has support for HEVC. This patch also moves some functions to a common rkvdec-hevc-common.c file and adds a specific scaling matrix flatten function. The fluster score for JCT-VC-HEVC_V1 is 146/147. Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit c9a59dc2acc72789d5c778af080d1e65af84862c Author: Detlev Casanova Date: Fri Jan 9 11:15:32 2026 -0500 media: rkvdec: Add HEVC support for the VDPU381 variant The VDPU381 supports HEVC decoding up to 7680x4320@30fps. It could double that when using both decoder cores. It support YUV420 (8 and 10 bits) as well as AFBC (not implemented here) The fluster score is 146/147 for JCT-VC-HEVC_V1, tested on ROCK 5B. None of the other test suites works. Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit fde24907570dcc56406f5e48d5c9d9e7e2da36fc Author: Detlev Casanova Date: Fri Jan 9 11:15:31 2026 -0500 media: rkvdec: Add H264 support for the VDPU383 variant This variant is used on the RK3576 SoC. The moving vectors size requirements are slightly different so support for a colmv_size function per variant is added. Also, the link registers are used to start the decoder and read IRQ status. The fluster score is 128/135 for JVT-AVC_V1, with MPS_MW_A failing in addition to the usual ones. The other test suites are not supported yet. Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit e5aa698ea6591482286e99f4f6f2894cfeed3c22 Author: Detlev Casanova Date: Fri Jan 9 11:15:30 2026 -0500 media: rkvdec: Add H264 support for the VDPU381 variant This decoder variant is found in Rockchip RK3588 SoC family. Like for rkvdec on rk3399, it supports the NV12, NV15, NV16 and NV20 output formats and level up to 6.0. The maximum width and height have been significantly increased supporting up to 65520 pixels for both. Support for named register sections is added for this variant and future ones. Fluster score for JVT-AVC_V1 is 129/135. Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit e570307ac987482dfdd8950e7cce96048b047b10 Author: Detlev Casanova Date: Fri Jan 9 11:15:29 2026 -0500 media: rkvdec: Disable multicore support Similarly to what is done in Hantro, avoid exposing equal video codecs to userspace. Equal video codecs allow scheduling work between the cores. For that kernel support is required, which does not yet exist. Until that is implemented, avoid exposing each core separately to userspace so that multicore can be added in the future without breaking userspace ABI. This currently applies only to RK3588 which has 2 equal VDPU381 decoders, but will be applied for all SoC supported by rkvdec that has multiple DTS nodes with the same compatible. Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 6a846f7d72c7b64627398c8fe82de74da97a7b2a Author: Detlev Casanova Date: Fri Jan 9 11:15:28 2026 -0500 media: rkvdec: Enable all clocks without naming them For other variants, the clock names and number will differ. There is no need to keep track of the clock names in the driver so drop them to avoid having a list for each variant. Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit f9c7b7deeffd9e1fa2d9ed0c7a84c21226b24b0a Author: Detlev Casanova Date: Fri Jan 9 11:15:27 2026 -0500 media: rkvdec: Support per-variant interrupt handler Prepare for supporting different variants with different interrupt managers. To support other variants specific function type later, introduce the rkvdec_variant_ops struct. Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit e5640dbb991c498b0f6fcf2e968fa795a8062eb6 Author: Detlev Casanova Date: Fri Jan 9 11:15:26 2026 -0500 media: rkvdec: Add RCB and SRAM support The RCB (Rows and Cols Buffers) are a set of buffers used by other variations of the decoder to store temporary data. Those variation come with a dedicated SRAM area used to store those buffers for better performances. The buffer sizes are either the width or height of the frame being decoded multiplied by a documented factor and can be stored either in SRAM or RAM. A fallback to RAM is provided if the SRAM is full (e.g.: multiple streams are being decoded at the same time). To manage the different kind of allocation, an enum is added to the rkvdec_aux_buf struct to specify how the buffer was allocated, and so, how to free it. This commit is in preparation of other variants support. Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit ae2070ca8ab2cc9cad0303fb6f9ed74cde9ec96c Author: Detlev Casanova Date: Fri Jan 9 11:15:25 2026 -0500 media: rkvdec: Add variant specific coded formats list Prepare for adding new variants of the decoder and support specific formats and format ops per variant. This removes the need of capability flags for variants, so remove them. Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 34e2b14ae90efdc19c4d348710c6b6803a4acfe2 Author: Detlev Casanova Date: Fri Jan 9 11:15:24 2026 -0500 media: rkvdec: Move hevc functions to common file This is a preparation commit to add support for new variants of the decoder. The functions will later be shared with vdpu381 (rk3588) and vdpu383 (rk3576). Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 560438ed7c2c09efacd5937771769d828d3aa525 Author: Detlev Casanova Date: Fri Jan 9 11:15:23 2026 -0500 media: rkvdec: Move h264 functions to common file This is a preparation commit to add support for new variants of the decoder. The functions will later be shared with vdpu381 (rk3588) and vdpu383 (rk3576). Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit cf29115a68e334f2216cd7d4dfc6d51e986ca726 Author: Detlev Casanova Date: Fri Jan 9 11:15:22 2026 -0500 media: rkvdec: Use structs to represent the HW RPS This is in preparation to add support for other variants of the decoder. Moving to struct representation is mainly to prepare for multicore support that is present in e.g. rk3588. Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 2b0ec90061672274978db0fbe898740a1e52c973 Author: Detlev Casanova Date: Fri Jan 9 11:15:21 2026 -0500 media: rkvdec: Move cabac tables to their own source file This is in preparation to add support for new variants that will use the same tables. Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit dc6898981f744cf54c29313f5a399260933cdf66 Author: Detlev Casanova Date: Fri Jan 9 11:15:20 2026 -0500 media: rkvdec: Switch to using structs instead of writel In an effort to merge the rkvdec2 driver [1] with this one, switch from writel() calls to using structs to represent the register mappings. This is done in order to have all supported decoders use the same format in the future and ease reading of the code. Using structs also improves stability as the hardware is tested and validated downstream using a similar method. It was noticed, on decoders, that: - Some registers require to be writen in increasing order [2] - Some registers, even if unrelated, need to be written to their reset values (it was the case here for axi_ddr_[rw]data). Using structs can also help improving performance later when, e.g. multicore support is added on RK3588. Performance seems to be slightly improved, but at least, not made worse. Running fluster's JVT-AVC_V1 test suite with GStreamer on the Radxa ROCK PI 4 SE gives the following times: Before this patch: - --jobs 1: Ran 129/135 tests successfully in 77.167 secs - --jobs 6: Ran 129/135 tests successfully in 23.046 secs With this patch: - --jobs 1: Ran 129/135 tests successfully in 70.698 secs - --jobs 6: Ran 129/135 tests successfully in 22.917 secs This also shows that the fluster score hasn't changed. [1]: https://lore.kernel.org/all/20250325213303.826925-1-detlev.casanova@collabora.com/ [2]: https://lore.kernel.org/all/20200127143009.15677-5-andrzej.p@collabora.com/ Tested-by: Diederik de Haas # Rock 5B Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 4cb9cd80b36ea977c468415eb2730ae4435505cc Author: Detlev Casanova Date: Fri Jan 9 11:15:19 2026 -0500 media: visl: Add HEVC short and long term RPS sets Log the recently added v4l2 controls to set HEVC short and long term RPS sets with 2 new ftrace entries. Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit fa05705107a40131a8335ad37817153709261738 Author: Detlev Casanova Date: Fri Jan 9 11:15:18 2026 -0500 media: v4l2-ctrls: Add hevc_ext_sps_[ls]t_rps controls The vdpu381 decoder found on newer Rockchip SoC need the information from the long term and short term ref pic sets from the SPS. So far, it wasn't included in the v4l2 API, so add it with new dynamic sized controls. Each element of the hevc_ext_sps_lt_rps array contains the long term ref pic set at that index. Each element of the hevc_ext_sps_st_rps contains the short term ref pic set at that index, as the raw data. It is the role of the drivers to calculate the reference sets values. Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 8a5586d4ffb10751b869a02d757482fe0b3739f3 Author: Detlev Casanova Date: Fri Jan 9 11:15:17 2026 -0500 media: uapi: HEVC: Add v4l2_ctrl_hevc_ext_sps_[ls]t_rps controls Some hardware (e.g.: Rockchip's rk3588 hevc decoder) need to fully parse the slice header, which cannot be passed with the current controls. There is also no skip method similar as to what can be found in verisilicon HW. The SPS is therefore extended through these 2 new controls, providing the long and short term reference information from the slice header for HEVC decoding. These now controls are similar as what is passed in the Vulkan Video API with the StdVideoH265ShortTermRefPicSet and StdVideoH265LongTermRefPicsSps structures embedded in the SPS struct. Reviewed-by: Nicolas Dufresne Signed-off-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit a505ca2db89ad92a8d8d27fa68ebafb12e04a679 Author: Benjamin Gaignard Date: Wed Jan 14 10:07:10 2026 +0100 media: verisilicon: AV1: Fix tile info buffer size Each tile info is composed of: row_sb, col_sb, start_pos and end_pos (4 bytes each). So the total required memory is AV1_MAX_TILES * 16 bytes. Use the correct #define to allocate the buffer and avoid writing tile info in non-allocated memory. Signed-off-by: Benjamin Gaignard Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder") Cc: stable@vger.kernel.org Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit d0ab89951197f0fc509a0cd732d830880e79c2d4 Author: Richard Fitzgerald Date: Wed Jan 21 13:22:43 2026 +0000 ASoC: cs35l56: Add KUnit testing of cs35l56_set_fw_suffix() Add a new KUnit test for testing the creation of firmware name qualifiers in the cs35l56 driver. The initial set of test cases are for cs35l56_set_fw_suffix(). Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260121132243.1256019-6-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 3f086a4f277af799467af6c74902000461e60a33 Author: Richard Fitzgerald Date: Wed Jan 21 13:22:42 2026 +0000 ASoC: cs-amp-lib: Add a Kconfig symbol for enabling test hooks Add Kconfig symbol CONFIG_SND_SOC_CS_AMP_LIB_TEST_HOOKS to enable calling into functions that would normally abort because of missing EFI functionality. Before this the code paths were only enabled if the KUnit test for cs-amp-lib was enabled. This change allows KUnit tests for clients of cs-amp-lib to install redirection hooks in cs-amp-lib. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260121132243.1256019-5-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d70fa6b569a95e71cc25b86ac3cc221bea541f53 Author: Richard Fitzgerald Date: Wed Jan 21 13:22:41 2026 +0000 ASoC: cs-amp-lib-test: Tests for reading SSIDExV2 Adds test cases for getting a Dell SSIDExV2 string by calling cs_amp_devm_get_vendor_specific_variant_id(). This is a fairly simple test harness, the redirected call to cs_amp_get_efi_variable() returns a test string to simulate reading a string from UEFI. The returned string should be the second field in the SSIDExV2 string (if valid). Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260121132243.1256019-4-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 51b069172a4ef2c6278c64c603a41a7f20329921 Author: Richard Fitzgerald Date: Wed Jan 21 13:22:40 2026 +0000 ASoC: cs35l56: Use vendor-specific qualifier in firmware file search If cs_amp_devm_get_vendor_specific_variant_id() returns a string, use it as part of the firmware filename. If this firmware isn't found, fall back to the standard firmware name. This re-uses the fwf_suffix fallback mechanism that was introduced in commit e5d5b3aebdc8 ("ASoC: cs35l56: Use SoundWire address as alternate firmware suffix on L56 B0"). This is for handling vendors that use the same PCI SSID on systems with various audio hardware and have a custom vendor-specific way to identify the hardware variant. This is currently used on Dell laptops. Dell create a UEFI variable that indicates varations to the base hardware. This variance can be any part of the hardware (not necessarily affecting the audio). It would be impractical to publish many aliases for the same firmware files to match every possible variance to that base hardware. Hence the fallback to the standard firmware name. This allows alternate firmware files to be published only for variants that need it. For all other variants the fallback will load the firmware for the base SSID. This is not done for CS35L56 B0 because the fallback mechanism is already used for a different purpose for these parts. None of the products with the older L56 B0 silicon revision need the additional vendor-specific descriptor. For SoundWire the resulting firmware searches with a variant descriptor will be: 1. cs35l??-dsp1-misc-SSID-VARIANT-l?u?.wmfw 2. cs35l??-dsp1-misc-SSID-VARIANT.wmfw 3. cs35l??-dsp1-misc-SSID-VARIANT-l?u?.bin 4. cs35l??-dsp1-misc-SSID-VARIANT.bin If this doesn't find a wmfw and bin file it will then fallback to: 5. cs35l??-dsp1-misc-SSID-l?u?.wmfw 6. cs35l??-dsp1-misc-SSID.wmfw 7. cs35l??-dsp1-misc-SSID-l?u?.bin 8. cs35l??-dsp1-misc-SSID.bin With the typical published firmware names and qualifiers (a single wmfw but amp-specific bin file) this will load either: cs35l??-dsp1-misc-SSID-VARIANT.wmfw and cs35l??-dsp1-misc-SSID-VARIANT-l?u?.bin or cs35l??-dsp1-misc-SSID.wmfw and cs35l??-dsp1-misc-SSID-l?u?.bin For non-Soundwire (I2S/TDM) systems the searches and fallbacks are as above except that the "l?u?" component of the name is instead the ALSA name prefix, usually of the form "AMPn". Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260121132243.1256019-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 00fd40bc7acecf9f41d645aa0b35ddc7fd7679b6 Author: Richard Fitzgerald Date: Wed Jan 21 13:22:39 2026 +0000 ASoC: cs-amp-lib: Support Dell SSIDExV2 UEFI variable Add a function cs_amp_devm_get_vendor_specific_variant_id() to return a vendor-specific hardware identifier string (if there is one) and use it to fetch an identifier from Dell SSIDExV2 UEFI variable content. Dell use the same PCI SSID on multiple products that might have different audio hardware and thus need different firmware for the amplifier DSP. The SSIDExV2 string contains additional system identifiers, and the second field is a 2-character audio hardware identifier. There are older Dell models with Cirrus Logic amplifiers that have the SSIDExV2 UEFI variable but do not have the 2-character audio ID in the second field. The SSIDExV2 is ignored if the second field is not 2 characters. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260121132243.1256019-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 1ef28ee5c51f21bc3ff493dfdc175827bbabf195 Author: David Heidelberg Date: Sun Nov 30 00:22:39 2025 +0100 arm64: dts: qcom: oneplus-enchilada: Specify i2c4 clock frequency Per the binding, omitting the clock frequency from a Geni I2C controller node defaults the bus to 100 kHz. But at least in Linux, a friendly info print highlights the lack of explicitly defined frequency in the DeviceTree. Specify the frequency, to give it an explicit value, and to silence the log print in Linux. Downstream doesn't define any frequency, thus also using 100 kHz. Signed-off-by: David Heidelberg Link: https://lore.kernel.org/r/20251130-enchilada-i2c-freq-v1-1-2932480a0261@ixit.cz Signed-off-by: Bjorn Andersson commit 15bbdb3e56684bfe6ca2a38dd9c2d5bd2d2a8247 Author: Luca Weiss Date: Fri Nov 14 10:31:13 2025 +0100 arm64: dts: qcom: sm6350: Add clocks for aggre1 & aggre2 NoC As per updated bindings, add the clocks for those two interconnects, which are required to set up QoS correctly. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20251114-sm6350-icc-qos-v2-5-6af348cb9c69@fairphone.com Signed-off-by: Bjorn Andersson commit 61b76d07d2b46a86ea91267d36449fc78f8a1f6e Author: Greg Kroah-Hartman Date: Wed Jan 21 11:29:45 2026 +0100 driver core: faux: stop using static struct device faux_bus_root should not have been a static struct device, but rather a dynamically created structure so that lockdep and other testing tools do not trip over it (as well as being the right thing overall to do.) Fix this up by making it properly dynamic. Reported-by: Gui-Dong Han Closes: https://lore.kernel.org/lkml/CALbr=LYKJsj6cbrDLA07qioKhWJcRj+gW8=bq5=4ZvpEe2c4Yg@mail.gmail.com/ Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/2026012145-lapping-countless-ef81@gregkh Signed-off-by: Greg Kroah-Hartman commit fdeb3ca3cca827f1a4845b570e4c5dd59fa893de Author: Tzung-Bi Shih Date: Wed Jan 21 04:02:04 2026 +0000 revocable: Remove redundant synchronize_srcu() call When allocating a revocable provider via revocable_provider_alloc(), there is no revocable consumers (i.e., RCU readers) yet. Remove the redundant synchronize_srcu() call to save cycles. Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260121040204.2699886-1-tzungbi@kernel.org Signed-off-by: Greg Kroah-Hartman commit 851d5ae6003b6517fb641675c33d4b529765fe14 Author: Dmitry Baryshkov Date: Tue Jan 13 18:41:59 2026 +0200 arm64: dts: qcom: agatti: enable FastRPC on the ADSP On Agatti platform the ADSP provides FastRPC support. Add corresponding device node, in order to be able to utilize the DSP offload from the Linux side. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260113-agatti-fastrpc-v2-1-b66870213f89@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0f1e16b3a8634d540fb0c7a11ca13412d2902974 Author: Mikulas Patocka Date: Wed Jan 21 14:02:20 2026 +0100 dm-verity: fix section mismatch error The function "__init dm_verity_init" was calling "__exit dm_verity_verify_sig_exit" and this triggered section mismatch error. Fix this by dropping the "__exit" tag on dm_verity_verify_sig_exit. Signed-off-by: Mikulas Patocka Fixes: 033724b1c627A ("dm-verity: add dm-verity keyring") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601210645.11u5Myme-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202601211041.pcTzwcdp-lkp@intel.com/ commit 95d628c9e4738c070ba780488efbab894e583646 Author: Luca Ceresoli Date: Fri Jan 9 11:02:55 2026 +0100 drm: rcar-du: lvds: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done. Since the companion bridge pointer is used by .atomic_enable, putting its reference in the remove function would be dangerous. Use .destroy to put it on final deallocation. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-3-v2-6-8d7a3dbacdf4@bootlin.com Signed-off-by: Luca Ceresoli commit 2db0d298f22d685e0c9f7f66ab6470f12a0255b6 Author: Luca Ceresoli Date: Fri Jan 9 11:02:54 2026 +0100 drm/exynos: hdmi: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done. Tested-by: Marek Szyprowski Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-3-v2-5-8d7a3dbacdf4@bootlin.com Signed-off-by: Luca Ceresoli commit 4ace6fbcd25f5ef275c91b93424e715f96197e50 Author: Luca Ceresoli Date: Fri Jan 9 11:02:53 2026 +0100 drm/mediatek: mtk_hdmi*: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done by using the drm_bridge::next_bridge pointer. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-3-v2-4-8d7a3dbacdf4@bootlin.com Signed-off-by: Luca Ceresoli commit 6dfebeee296cbb3296f06c28f3b2d053ec8374e7 Author: Luca Ceresoli Date: Fri Jan 9 11:02:52 2026 +0100 drm/imx/dw-hdmi: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done. Acked-by: Maxime Ripard Reviewed-by: Philipp Zabel Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-3-v2-3-8d7a3dbacdf4@bootlin.com Signed-off-by: Luca Ceresoli commit 9afbf7a9cce584e3ce7b709ea5654f2721b00694 Author: Luca Ceresoli Date: Fri Jan 9 11:02:51 2026 +0100 drm/meson/dw-hdmi: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done. dw_hdmi->bridge is used only in dw_hdmi_top_thread_irq(), so in order to avoid potential use-after-free ensure the irq is freed before putting the dw_hdmi->bridge reference. Acked-by: Maxime Ripard Reviewed-by: Martin Blumenstingl Acked-by: Neil Armstrong Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-3-v2-2-8d7a3dbacdf4@bootlin.com Signed-off-by: Luca Ceresoli commit 4e7fd5aa3f3939dfcd8b0578de57f1cc00d6c31c Author: Luca Ceresoli Date: Fri Jan 9 11:02:50 2026 +0100 drm/bridge: dw-hdmi: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done by using the drm_bridge::next_bridge pointer. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-3-v2-1-8d7a3dbacdf4@bootlin.com Signed-off-by: Luca Ceresoli commit 3b3ddafde1c2b5262628b4463c7b6f4ccc6430b5 Author: gaoxiang17 Date: Fri Jan 9 19:54:11 2026 +0800 dma-buf: add some tracepoints to debug. Since we can only inspect dmabuf by iterating over process FDs or the dmabuf_list, we need to add our own tracepoints to track its status in real time in production. For example: binder:3016_1-3102 [006] ...1. 255.126521: dma_buf_export: exp_name=qcom,system size=12685312 ino=2738 binder:3016_1-3102 [006] ...1. 255.126528: dma_buf_fd: exp_name=qcom,system size=12685312 ino=2738 fd=8 binder:3016_1-3102 [006] ...1. 255.126642: dma_buf_mmap_internal: exp_name=qcom,system size=28672 ino=2739 kworker/6:1-86 [006] ...1. 255.127194: dma_buf_put: exp_name=qcom,system size=12685312 ino=2738 RenderThread-9293 [006] ...1. 316.618179: dma_buf_get: exp_name=qcom,system size=12771328 ino=2762 fd=176 RenderThread-9293 [006] ...1. 316.618195: dma_buf_dynamic_attach: exp_name=qcom,system size=12771328 ino=2762 attachment:ffffff880a18dd00 is_dynamic=0 dev_name=kgsl-3d0 RenderThread-9293 [006] ...1. 318.878220: dma_buf_detach: exp_name=qcom,system size=12771328 ino=2762 attachment:ffffff880a18dd00 is_dynamic=0 dev_name=kgsl-3d0 Signed-off-by: Xiang Gao Reviewed-by: Steven Rostedt (Google) Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20260109115411.115270-1-gxxa03070307@gmail.com commit 66af8ac52d10ea229d5755b8700e2fe86fc037f7 Author: Emmanuel Grumbach Date: Sun Jan 11 19:39:26 2026 +0200 wifi: iwlwifi: rename struct iwl_mcc_allowed_ap_type_cmd::offset_map This was poorly named, probably a copy paste mistake. The real meaning of this field is a map of the MCCs to describe the AP type allowed for each country. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.6ed558b09581.I6560b8cfb36b68cea1afe8f89f87dded99d2caf7@changeid commit b46616bb54f71f28bb35c761d3fc77babdd8f5c3 Author: Nidhish A N Date: Sun Jan 11 19:39:25 2026 +0200 wifi: iwlwifi: mvm: Remove link_id from time_events As part of removal of EMLSR support from mvm, remove link_id parameter from time_events. Additionally, remove link_id parameter from iwl_mvm_protect_assoc as we can now directly use deflink. Signed-off-by: Nidhish A N Reviewed-by: Pagadala Yesu Anjaneyulu Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.9475bb832db6.I5829b0a2a9a5b56fe885eb0f1e1ad8cd70bc69ff@changeid commit 5b31cf3f487a4c7f21cb264a3501fb4a4a06b067 Author: Benjamin Berg Date: Sun Jan 11 19:39:24 2026 +0200 wifi: iwlwifi: mld: change cluster_id type to u8 array While the cluster_id is two bytes long, it is just the last two bytes of the cluster ID MAC address. This does not really map to a big or little endian data type. Switch it to use an array to avoid confusion and adjust all users so that they do the right thing independent of endianness. Signed-off-by: Benjamin Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.80921dc7d305.I56c2bbe0bfc6ee02782bc5d69fda2ac77f3502c4@changeid commit abce13f5607efcf423cdec31ee36adfb92bb94d6 Author: Emmanuel Grumbach Date: Sun Jan 11 19:39:23 2026 +0200 wifi: iwlwifi: support V13 of iwl_lari_config_change_cmd This command is getting a new field for UNII-9 and ieee80211bn enablement. We must read the relevant DSM values and pass them to the firmware, Remember whether we have ACPI or UEFI available in the firmware runtime object and remember the DSM function revision. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.9577f0cade21.I82b26f082f152a83eb9990dddf68d7dcc549f227@changeid commit 1e00423de0f8a9bf1a669a6e427fe32202403b35 Author: Emmanuel Grumbach Date: Sun Jan 11 19:39:22 2026 +0200 wifi: iwlwifi: split bios_value_u32 to separate the header This header will be reused in other firmware API structures Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.2f191a5f33fe.I7797134967b980bbda9ba29daa360e50a2196d7d@changeid commit 4172db83b0af647c75431e2ceb56ef46d5c8c6d9 Author: Emmanuel Grumbach Date: Sun Jan 11 19:39:21 2026 +0200 wifi: iwlwifi: uefi: cache the DSM functions Just like we did for ACPI, cache the UEFI values to avoid reading the tables over and over again. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.15871db3cfab.Ib39db197646cc303d60bb12448794d20f6ccbd15@changeid commit af60fe4b1236d7f355afc52a57b9b0b7a42792ac Author: Emmanuel Grumbach Date: Sun Jan 11 19:39:20 2026 +0200 wifi: iwlwifi: acpi: cache the DSM functions Instead of reading the DSM functions on demand, just read them all when the first DSM function is called and cache the values for all the other DSM functions. This simplifies the flow. Since the same will be done for UEFI in the next patch, remove the ifdef CONFIG_ACPI around the relevant variables. Once UEFI's cache will be implemented, we'll be able to change iwl_bios_get_dsm to access the cache directly. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.732ff6856796.Iff844bfbb0fea3c3d9654a53254a5b14dbaec8c1@changeid commit b9d19dd12c1ba318e3449487e430a3859421d740 Author: Nidhish A N Date: Sun Jan 11 19:39:19 2026 +0200 wifi: iwlwifi: mvm: Cleanup MLO code iwlmld is now the op mode that is used for EHT devices, so iwlmvm code can never run in MLO. Cleanup some of the MLO code. Signed-off-by: Nidhish A N Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.214157366bc7.I324778c008058c5d894328aab8e473304f657b69@changeid commit d5b2927a3387e536c560a49b0753f127d823ac8e Author: Emmanuel Grumbach Date: Sun Jan 11 19:39:18 2026 +0200 wifi: iwlwifi: move iwl_get_lari_config_bitmap to the op_mode This is used solely there. The implementation can differe between different op_modes that support different firmware versions Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.099e733b1ece.Icac5b8eb5d8260e35df89622443d68a6beacedbb@changeid commit 839d9176176da9f5fe4ba7b988c570d3b6174e70 Author: Emmanuel Grumbach Date: Sun Jan 11 19:39:17 2026 +0200 wifi: iwlwifi: move lari helper functions to the op_mode iwlmvm is the only op_mode that uses the lari helper functions. iwlmld has its own version to avoid introducing regressions. Move all those functions to iwlmvm, as they are more related to the op_mode. iwl_get_lari_config_bitmap will move in the next patch. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.4bb241e436cb.I3d80796d4722376ce24a847419d34723083baaa8@changeid commit 53d649ae79a760785d7f74ccf9830f3fe0e82380 Author: Miri Korenblit Date: Sun Jan 11 19:39:16 2026 +0200 wifi: iwlwifi: mld: prevent EMLSR when NAN is active EMLSR is not allowed when NAN is active. Block EMLSR when starting NAN, and unblock EMLSR when NAN is stopped. Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.8baef343023a.Ie94e5f32db003ebce33bde65e0ed8c6d98673b5a@changeid commit 81a33d0f3c69289c7555c4a40af1ce74e130e30e Author: Miri Korenblit Date: Sun Jan 11 19:39:15 2026 +0200 wifi: iwlwifi: mld: add an helper to update an EMLSR blocker Add an helper function that iterates over all (relevant) interfaces and sets/unsets a given EMLSR blocker. For now use it only for IWL_MLD_EMLSR_BLOCKED_NON_BSS. Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.f87b347a5cf0.I6836ba40d21cca49401d1f88e03a37b00dd9f5c2@changeid commit 7a749db26cab2334d5b356ac31e6f1147c7682da Author: Nidhish A N Date: Sun Jan 11 19:39:14 2026 +0200 wifi: iwlwifi: mld: Fix primary link selection logic When assigning emlsr.primary with emlsr.selected_primary we are checking if BIT(mld_vif->emlsr.selected_links) are a part of vif->active_links. This is incorrect as emlsr.selected_links is a bitmap of possibly two selected links. Therefore, performing the BIT() operation on it does not yield any meaningful result and almost always leads to incorrect primary link selection. Additionally, we cannot rely on vif->active_links at this stage of the link switch flow because it contains both the removed links and also the newly added links. For example, if we had selected links in the past (0x11) and we now select links because of TTLM/debugfs (0x100), vif->active_links will now be (0x111) and primary link will be 0, while 0 is not even an active link. Thus, we create our own bitmap of final active links. Signed-off-by: Nidhish A N Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.38b2e14e3a20.Ie81a88dfff0c5d2becedabab8398702808f6b1bf@changeid commit 4f042e3bb907fc33c1a42676fbbf15ae679f87e8 Author: Johannes Berg Date: Sun Jan 11 19:39:13 2026 +0200 wifi: iwlwifi: cfg: remove iwl_be221_name This is unused, no devices with such a name exist, so remove it. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.360ca699c9d6.I26ceddc2916e134ff50ea8550e44935f287b063c@changeid commit d2fcdf36554316cc51f7928b777944738d06e332 Author: Miri Korenblit Date: Sun Jan 11 19:39:12 2026 +0200 wifi: iwlwifi: mld: fix chandef start calculation A link pair in which both links are in 5 GHz can be used for EMLSR only if they are separated enough. To check this condition we calculate the start and the end of the chandefs of both links in the pair and do some checks. But the calculation of the start/end of the chandef is currently done by subtracting/adding half the bandwidth from/to the control channel's center frequency, when it should really be subtracted/added from/to the center frequency of the entire chandef. Fix the wrong calculation. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111193638.2138fdb99bd5.I4d2e5957b22482a57b1d6ca444e90fcf73bf2cab@changeid commit d0f573f3bf96d6441caf32202644f3b16a3afca3 Author: Ally Heev Date: Tue Nov 11 13:53:51 2025 +0530 wifi: iwlwifi: mld: remove unused variable in d3.c remove unused variable `old_keys` Signed-off-by: Ally Heev Link: https://patch.msgid.link/20251111-aheev-remove-unused-var-old-keys-v1-1-988de3a91b1c@gmail.com Signed-off-by: Miri Korenblit commit 85fad59d21ae958e42993179ad205acbb84945de Author: Johannes Berg Date: Mon Nov 10 15:02:26 2025 +0200 wifi: iwlwifi: fw: api: add HE type for UHR ELR For UHR ELR, the EXT_SU type is reused, so it depends on the modulation. Add a define so the code will be clearer. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.3dabe4690805.I93dfb6b41ace7844e462e8649253c20f2712b382@changeid commit e4d47493c6be00939eecaf03713789766faf10f7 Author: Miri Korenblit Date: Mon Nov 10 15:02:25 2025 +0200 wifi: iwlwifi: cfg: move the MODULE_FIRMWARE to the per-rf file The MODULE_FIRMWARE are now located in the rf-*.h file and not in the mac (bz.h in our case) files. Move them around for consistency. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.9749e9514e8c.Ib6f15663c875cf231e97cb4b37adaf21fa616a77@changeid commit 772fe513e198b83324b8c0f93a886d6c24667832 Author: Johannes Berg Date: Mon Nov 10 15:02:24 2025 +0200 wifi: iwlwifi: mld: fix HE SIG-B MCS/DCM/compression These values should be taken from SIG-A, indicating how SIG-B is encoded. The values taken from SIG-B (the corresponding register) indicate how the data portion (for that user) is encoded. For the SIG-B compression value the correct mask was applied to the wrong value. Signed-off-by: Johannes Berg Reviewed-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.4d625e05dece.If295eb9382fc681d63b0853261d884cd1a833ba5@changeid commit 3b6e7afaf7c35c9840f34dc7550ed95d875741ec Author: Johannes Berg Date: Mon Nov 10 15:02:23 2025 +0200 wifi: iwlwifi: fw: api: add UHR data definitions Add the necessary data definitions for the sniffer-related fields reported for the various UHR frame formats by the firmware/hardware to be able to later add the necessary sniffer code. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.358b51dd8cb2.I16178416dd7019cb88a45e55f81eb28510982028@changeid commit ac47aa8bc906e1c42dd8b7caf96c180680bddda5 Author: Johannes Berg Date: Mon Nov 10 15:02:22 2025 +0200 wifi: iwlwifi: add UHR TLC mode This is part of the new TLC API for UHR, was just missed in the earlier update. Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.aba5036fcee0.Ifba8e366a3ad794a384ced1ebe39fccfc0ec5198@changeid commit d9ca724db72880d2f1a1ab2e5bb57e271f8569e5 Author: Johannes Berg Date: Mon Nov 10 15:02:21 2025 +0200 wifi: iwlwifi: adjust LINK context NPCA API The link context NPCA API was changed in the firmware, adjust the driver accordingly. Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.93bd7a454eef.I3d2ce1a363b0d8c3809ec8e729b7acf94efca25b@changeid commit cc10aa812472535a004b8ff8b6177912169fac0b Author: Pagadala Yesu Anjaneyulu Date: Mon Nov 10 15:02:20 2025 +0200 wifi: iwlwifi: mld: refactor AP power type setting Fix unsafe power type mapping for iwl_txpower_constraints_cmd that breaks if enum values change. Replace "power_type - 1" with explicit case handling for each power type. While on it, Add debug logging to show configured power type. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.f3b15566dac8.I31b900ab161fb627158dc1b3e2fc4ab35d84fddf@changeid commit 58192b9ce09b0f0f86e2036683bd542130b91a98 Author: Johannes Berg Date: Mon Nov 10 15:02:19 2025 +0200 wifi: iwlwifi: fix 22000 series SMEM parsing If the firmware were to report three LMACs (which doesn't exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is an overrun of the array. Reject such and use IWL_FW_CHECK instead of WARN_ON in this function. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.16e8c2d70c26.Iadfcc1aedf43c5175b3f0757bea5aa232454f1ac@changeid commit 5f05d20180059f00e17b514c1022963034756cfd Author: Miri Korenblit Date: Mon Nov 10 15:02:18 2025 +0200 wifi: iwlwifi: mld: support TLC command version 6 In version 6, a phy id is added to the tlc command and the sta_id becomes a sta_mask. This change is required for NAN: - in NAN we can have 2 logical stations of the same physical station and with the same channel/band (2 NDIs with the same peer) - hence the sta_mask. - In NAN we can have more than one TLC configuration for a single station (for example if it operates on more than one channel) - so the FW needs to be able to find the right TLC context, based on the phy id. Populate the new version (for now with a single station id only. The other ones will be added later when NAN is implemented). In case the FW has a lower version than that - convert it to the FW version. Note that there is some code duplicantion in the conversions to v5 and to v4, but this is intentional since v5 will be removed as soon as v6 is supported. Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.64220c6b292b.I2f5d195ce2bf9d35398f0f6f2d5faf9e90ae45a4@changeid commit 0b9e07b76537f5b22f980974423778509c38a390 Author: Emmanuel Grumbach Date: Mon Nov 10 15:02:17 2025 +0200 wifi: iwlwifi: mld: trigger a dump upon notification if needed The firmware can request us to trigger a dump upon specific notifications. In order for that flow to work, we need to call the firmware debug infra when we get a notification from the firmware. This was missing. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.d6d7e69c7da6.I40f891ece6f98983e0fd2cd0c6863f8620ca08aa@changeid commit 86a6faaf05a4c852ae5550e0ea86056eb4b83154 Author: Pagadala Yesu Anjaneyulu Date: Mon Nov 10 15:02:16 2025 +0200 wifi: iwlwifi: fw: fix documentation reference for ap_type field Fix the documentation comment for the ap_type field in AP_TX_POWER_CONSTRAINTS_CMD to reference the correct enum iwl_6ghz_ap_type. Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.d70f56dd24b0.I82956bd93a36c7fa5585f014c197afea0610a076@changeid commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d Author: Miri Korenblit Date: Mon Nov 10 15:02:15 2025 +0200 wifi: iwlwifi: mvm: check the validity of noa_len Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using its value to determine the noa_len, which is later used for the NoA attribute. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid commit 60abc027701dbb0c5d1d3712a5336d5977562071 Author: Daniel Gabay Date: Mon Nov 10 15:02:14 2025 +0200 wifi: iwlwifi: mvm: Remove few redundant 6 GHz scan chan params - iwl_mvm_scan_umac_chan_flags_v2() computes channel params flags that are only relevant for 2.4/5 GHz scan, explicitly clear the flags for 6 GHz scan. - n_aps_override[0] and n_aps_override[1] are not relevant for 6 GHz scan, remove them. Signed-off-by: Daniel Gabay Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.3b4f8ed30498.I014c098e64118fe3adaf6db07816e7df8ea4f79e@changeid commit c5ee8b255451611590b10b5df18625f02b3741c7 Author: Daniel Gabay Date: Mon Nov 10 15:02:13 2025 +0200 wifi: iwlwifi: mld: Remove wrong channel flags in scan cmd Erroneously, the channel flags in the scan command for 6 GHz scan were mistakenly set using iwl_mld_scan_get_cmd_gen_flags, which actually calculates a different field (the general flags) in the command. However, these flags are not relevant for 6 GHz scan part, except for IWL_SCAN_CHANNEL_FLAG_6G_PSC_NO_FILTER, which is already set correctly. Since the incorrect flags are only applied in the 6 GHz scan part and are ignored by the firmware, this has no adverse effect. Therefore, we can simply remove this helper function call and explicitly clear the flags. Signed-off-by: Daniel Gabay Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.a8a931e1abef.I8f7dc66b23198b83083685ef76dec59cfb407f57@changeid commit 4bfdbd5d1ea9d6f04975e9ebaf830b75e5fb960b Author: Benjamin Berg Date: Mon Nov 10 15:02:12 2025 +0200 wifi: iwlwifi: mld: decode VHT information for sniffer The available VHT information may be useful, so decode it and include it in the generated radiotap headers. Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110150012.6751d1d0b31d.I927cb0767667f2c03ee41f2ba417f3b94bba6d91@changeid commit b47b3d0d8be376d0baf83bc14933377216417504 Author: Ilan Peer Date: Mon Nov 10 18:08:50 2025 +0200 wifi: iwlwifi: mld: Advertise support for multicast RX registration While this is not needed for configuring Rx filters, without setting it some multicast action frame registrations from user space would fail, specifically, NAN multicast action frame registration (SDFs). Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110180612.640fb5a99470.If6f423bcf0a426e662041a4b310ce81485f1af03@changeid commit ab4107583b0a42868a1638603d449e64121f5640 Author: Ilan Peer Date: Mon Nov 10 18:08:49 2025 +0200 wifi: iwlwifi: mld: Support changing NAN configuration Add support for changing the NAN configuration. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110180612.82dcdfeb9533.Ib8576873c92f68f1bcafbda409d45ef2b4133e9f@changeid commit 89000fe4b1dca198ade6ba9f8edd61fa6b9596dc Author: Ilan Peer Date: Mon Nov 10 18:08:48 2025 +0200 wifi: iwlwifi: mld: Extend the NAN configuration Configure the FW based on the NAN cluster configuration provided by higher layers. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110180612.5353d9520f0f.Ie41dcea815afbb5da6cc870ea50a271c18f66639@changeid commit 6009414649910210ae3c18a96747e9a5e5224306 Author: Ilan Peer Date: Mon Nov 10 18:08:47 2025 +0200 wifi: iwlwifi: mld: Declare support for NAN capabilities And notify cfg80211 about NAN cluster events and DW end events. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110180612.eb49cb2172ce.Iaf59884242cb52351e24cb0711875851b5c863f8@changeid commit dbbeebece03050cd510073ce89fee83844e06b00 Author: Ilan Peer Date: Mon Nov 10 18:08:46 2025 +0200 wifi: iwlwifi: mld: Handle rate selection for NAN interface Frames transmitted over a NAN interface might not have channel information assigned to them. In such cases assign the lowest OFDM to the frame. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110180612.72046f98f878.Ib784931fffd0747acd9d7bb22eabbbec5282733e@changeid commit 9e978d8ebbe96e6abff33f2cc886b2fca1825d4f Author: Ilan Peer Date: Mon Nov 10 18:08:45 2025 +0200 wifi: iwlwifi: mld: Add support for NAN - Add firmware API definitions related to NAN. - Indicate support for NAN Device interface operation, if supported by the firmware. - Add support for starting and stopping NAN cluster functionality. The NAN cluster operation is offloaded to the FW, which notifies the driver on: - cluster events: Start/Join cluster. - Discovery Window (DW) end, which allows the driver to flush the HW queues and update the higher layers Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110180612.76dd4d45b91e.I5abfab64b4f27bed442aeca6231ffebad979cad6@changeid commit 8ecfc7dfdfc53513d465d436b6ea101b07323ee5 Author: Conor Dooley Date: Tue Jan 20 18:15:43 2026 +0000 MAINTAINERS: add Microchip mpfs mssio driver/bindings to entry Add the new mssio driver and bindings to the existing entry for Microchip RISC-V devices. Signed-off-by: Conor Dooley Signed-off-by: Linus Walleij commit 488d704ed7b7e7afeef24ee846c8223b607357b7 Author: Conor Dooley Date: Tue Jan 20 18:15:42 2026 +0000 pinctrl: add polarfire soc mssio pinctrl driver On Polarfire SoC, the Bank 2 and Bank 4 IOs connected to the Multiprocessor Subsystem (MSS) are controlled by IOMUX_CRs 1 through 6, which determine what function in routed to them, and MSSIO_BANK#_IO_CFG_CRs, which determine the configuration of each pin. Add a driver for this pin controller, including several custom properties that reflect aspects of the MSS's configuration. Reuse the Kconfig option for iomux0, since controlling MSSIOs without iomux0 routing a function to the MSSIOs in question is pointless, and routing a function to the MSSIOs is equally unhelpful if none of them are configured to make use of that function. Signed-off-by: Conor Dooley Signed-off-by: Linus Walleij commit 6b324d199467bf346132f0cb7f5ad4bbcdc3c037 Author: Conor Dooley Date: Tue Jan 20 18:15:41 2026 +0000 dt-bindings: pinctrl: document polarfire soc mssio pin controller On Polarfire SoC, the Bank 2 and Bank 4 IOs connected to the Multiprocessor Subsystem (MSS) are controlled by IOMUX_CRs 1 through 6, which determine what function in routed to them, and MSSIO_BANK#_IO_CFG_CRs, which determine the configuration of each pin. Document it, including several custom configuration options that stem from MSS Configurator options (the MSS Configurator is part of the FPGA tooling for this device). "ibufmd" unfortunately is not a 1:1 mapping with an MSS Configurator option, unlike clamp-diode or lockdown, and I do not know the effect of any bits in the field. I have no been able to find an explanation for these bits in documentation. Signed-off-by: Conor Dooley Reviewed-by: Rob Herring (Arm) Signed-off-by: Linus Walleij commit 43722575e5cdcc6c457bfe81fae9c3ad343ea031 Author: Conor Dooley Date: Tue Jan 20 18:15:40 2026 +0000 pinctrl: add generic functions + pins mapper Add a generic function to allow creation of groups and functions at runtime based on devicetree content, before setting up mux mappings. It works similarly to pinconf_generic_dt_node_to_map(), and therefore parses pinconf properties and maps those too, allowing it to be used as the dt_node_to_map member of the pinctrl_ops struct. Signed-off-by: Conor Dooley Signed-off-by: Linus Walleij commit 95c1762aaf34b0d5d128f5c14a82826499c563a3 Author: Conor Dooley Date: Tue Jan 20 18:15:39 2026 +0000 pinctrl: move microchip riscv pinctrl drivers to a folder There's three of these drivers now for the same platforms, move them together with other microchip drivers to follow. Signed-off-by: Conor Dooley Signed-off-by: Linus Walleij commit 84340785fa061d4c39eeaa89dea381fa94e4aeaa Author: Gopikrishna Garmidi Date: Tue Jan 20 09:22:51 2026 -0800 pinctrl: qcom: glymur: Add Mahua TLMM support Mahua TLMM block is identical to Glymur, but the PDC wake IRQ map differs since PDC handles the interrupt for GPIO 155 instead of GPIO 143 as seen on Glymur. Hence add the Mahua-specific PDC map to the Glymur TLMM driver. Signed-off-by: Gopikrishna Garmidi Reviewed-by: Dmitry Baryshkov Signed-off-by: Linus Walleij commit 84a3bc337378385ed9c9cef06910587de7accf0b Author: Gopikrishna Garmidi Date: Tue Jan 20 09:22:50 2026 -0800 dt-bindings: pinctrl: qcom,glymur-tlmm: Document Mahua TLMM block Document the pinctrl compatible for the Mahua SoC, a 12-core variant of Glymur. The PDC wake IRQ map differs since PDC handles the interrupt for GPIO 155 instead of GPIO 143 as seen on Glymur. Signed-off-by: Gopikrishna Garmidi Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit a1ca658d649a4d8972e2e21ac2625b633217e327 Author: Wenwu Hou Date: Sat Jan 17 14:52:43 2026 +0800 xfs: fix incorrect context handling in xfs_trans_roll The memalloc_nofs_save() and memalloc_nofs_restore() calls are incorrectly paired in xfs_trans_roll. Call path: xfs_trans_alloc() __xfs_trans_alloc() // tp->t_pflags = memalloc_nofs_save(); xfs_trans_set_context() ... xfs_defer_trans_roll() xfs_trans_roll() xfs_trans_dup() // old_tp->t_pflags = 0; xfs_trans_switch_context() __xfs_trans_commit() xfs_trans_free() // memalloc_nofs_restore(tp->t_pflags); xfs_trans_clear_context() The code passes 0 to memalloc_nofs_restore() when committing the original transaction, but memalloc_nofs_restore() should always receive the flags returned from the paired memalloc_nofs_save() call. Before commit 3f6d5e6a468d ("mm: introduce memalloc_flags_{save,restore}"), calling memalloc_nofs_restore(0) would unset the PF_MEMALLOC_NOFS flag, which could cause memory allocation deadlocks[1]. Fortunately, after that commit, memalloc_nofs_restore(0) does nothing, so this issue is currently harmless. Fixes: 756b1c343333 ("xfs: use current->journal_info for detecting transaction recursion") Link: https://lore.kernel.org/linux-xfs/20251104131857.1587584-1-leo.lilong@huawei.com [1] Signed-off-by: Wenwu Hou Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 01a28961549ac9c387ccd5eb00d58be1d8c2794b Author: Hans Holmberg Date: Tue Jan 20 09:57:46 2026 +0100 xfs: always allocate the free zone with the lowest index Zones in the beginning of the address space are typically mapped to higer bandwidth tracks on HDDs than those at the end of the address space. So, in stead of allocating zones "round robin" across the whole address space, always allocate the zone with the lowest index. This increases average write bandwidth for overwrite workloads when less than the full capacity is being used. At ~50% utilization this improves bandwidth for a random file overwrite benchmark with 128MiB files and 256MiB zone capacity by 30%. Running the same benchmark with small 2-8 MiB files at 67% capacity shows no significant difference in performance. Due to heavy fragmentation the whole zone range is in use, greatly limiting the number of free zones with high bw. Signed-off-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 4d6d335ea9558a7dc0c5044886440d7223596235 Author: Darrick J. Wong Date: Tue Jan 20 22:45:40 2026 -0800 xfs: promote metadata directories and large block support Large block support was merged upstream in 6.12 (Dec 2024) and metadata directories was merged in 6.13 (Jan 2025). We've not received any serious complaints about the ondisk formats of these two features in the past year, so let's remove the experimental warnings. Signed-off-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 12d12dcc1508874886ebcbd2aefba74f1ed71f98 Author: Christoph Hellwig Date: Wed Jan 14 07:53:29 2026 +0100 xfs: use blkdev_get_zone_info to simplify zone reporting Unwind the callback based programming model by querying the cached zone information using blkdev_get_zone_info. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit b37c1e4e9af795ac31ddc992b0461182c45705dc Author: Christoph Hellwig Date: Wed Jan 14 07:53:28 2026 +0100 xfs: check that used blocks are smaller than the write pointer Any used block must have been written, this reject used blocks > write pointer. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 19c5b6051ed62d8c4b1cf92e463c1bcf629107f4 Author: Christoph Hellwig Date: Wed Jan 14 07:53:27 2026 +0100 xfs: split and refactor zone validation Currently xfs_zone_validate mixes validating the software zone state in the XFS realtime group with validating the hardware state reported in struct blk_zone and deriving the write pointer from that. Move all code that works on the realtime group to xfs_init_zone, and only keep the hardware state validation in xfs_zone_validate. This makes the code more clear, and allows for better reuse in userspace. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 776b76f7547fb839954aae06f58ac7b6b35c0b25 Author: Christoph Hellwig Date: Wed Jan 14 07:53:26 2026 +0100 xfs: pass the write pointer to xfs_init_zone Move the two methods to query the write pointer out of xfs_init_zone into the callers, so that xfs_init_zone doesn't have to bother with the blk_zone structure and instead operates purely at the XFS realtime group level. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit fc633b5c5b80c1d840b7a8bc2828be96582c6b55 Author: Christoph Hellwig Date: Wed Jan 14 07:53:25 2026 +0100 xfs: add a xfs_rtgroup_raw_size helper Add a helper to figure the on-disk size of a group, accounting for the XFS_SB_FEAT_INCOMPAT_ZONE_GAPS feature if needed. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 41263267ef26d315b1425eb9c8a8d7092f9db7c8 Author: Damien Le Moal Date: Wed Jan 14 07:53:24 2026 +0100 xfs: add missing forward declaration in xfs_zones.h Add the missing forward declaration for struct blk_zone in xfs_zones.h. This avoids headaches with the order of header file inclusion to avoid compilation errors. Signed-off-by: Damien Le Moal Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 3a65ea768b8094e4699e72f9ab420eb9e0f3f568 Author: Christoph Hellwig Date: Fri Jan 9 16:17:40 2026 +0100 xfs: remove xfs_attr_leaf_hasname The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values. Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read. Cc: stable@vger.kernel.org # v5.19+ Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines") Reported-by: Mark Tinguely Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit f39854a3fb2f06dc69b81ada002b641ba5b4696b Author: Darrick J. Wong Date: Thu Dec 18 18:40:50 2025 -0800 xfs: mark data structures corrupt on EIO and ENODATA I learned a few things this year: first, blk_status_to_errno can return ENODATA for critical media errors; and second, the scrub code doesn't mark data structures as corrupt on ENODATA or EIO. Currently, scrub failing to capture these errors isn't all that impactful -- the checking code will exit to userspace with EIO/ENODATA, and xfs_scrub will log a complaint and exit with nonzero status. Most people treat fsck tools failing as a sign that the fs is corrupt, but online fsck should mark the metadata bad and keep moving. Cc: stable@vger.kernel.org # v4.15 Fixes: 4700d22980d459 ("xfs: create helpers to record and deal with scrub problems") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 102f444b57b35e41b04a5c8192fcdacb467c9161 Author: Christoph Hellwig Date: Wed Jan 14 14:06:43 2026 +0100 xfs: rework zone GC buffer management The double buffering where just one scratch area is used at a time does not efficiently use the available memory. It was originally implemented when GC I/O could happen out of order, but that was removed before upstream submission to avoid fragmentation. Now that all GC I/Os are processed in order, just use a number of buffers as a simple ring buffer. For a synthetic benchmark that fills 256MiB HDD zones and punches out holes to free half the space this leads to a decrease of GC time by a little more than 25%. Thanks to Hans Holmberg for testing and benchmarking. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Carlos Maiolino Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 0506d32f7c52e41f6e8db7c337e0ce6374c6ffbb Author: Christoph Hellwig Date: Wed Jan 14 14:06:42 2026 +0100 xfs: use bio_reuse in the zone GC code Replace our somewhat fragile code to reuse the bio, which caused a regression in the past with the block layer bio_reuse helper. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Carlos Maiolino Reviewed-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 7ca44303f9f6160a2f87ae3d5d2326d9127cd61c Author: Christoph Hellwig Date: Wed Jan 14 14:06:41 2026 +0100 block: add a bio_reuse helper Add a helper to allow an existing bio to be resubmitted without having to re-add the payload. Signed-off-by: Christoph Hellwig Reviewed-by: Jens Axboe Reviewed-by: Hans Holmberg Reviewed-by: Carlos Maiolino Reviewed-by: Damien Le Moal Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit cf9b52fa7d65362b648927d1d752ec99659f5c43 Author: Christoph Hellwig Date: Fri Dec 19 06:41:47 2025 +0100 xfs: directly include xfs_platform.h The xfs.h header conflicts with the public xfs.h in xfsprogs, leading to a spurious difference in all shared libxfs files that have to include libxfs_priv.h in userspace. Directly include xfs_platform.h so that we can add a header of the same name to xfsprogs and remove this major annoyance for the shared code. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 19a46f12466993c1227276cd934a1eb8071a24cb Author: Christoph Hellwig Date: Fri Dec 19 06:41:46 2025 +0100 xfs: move the remaining content from xfs.h to xfs_platform.h Move the global defines from xfs.h to xfs_platform.h to prepare for removing xfs.h. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 501a5161d2c3c3e6d6cf520446e51dfc86f06d8e Author: Christoph Hellwig Date: Fri Dec 19 06:41:45 2025 +0100 xfs: include global headers first in xfs_platform.h Ensure we have all kernel headers included by the time we do our own thing, just like the rest of the tree. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 971ffb634113474add7c3adb07c1ea03110e7844 Author: Christoph Hellwig Date: Fri Dec 19 06:41:44 2025 +0100 xfs: rename xfs_linux.h to xfs_platform.h Rename xfs_linux.h to prepare for including including it directly from source files including those shared with xfsprogs. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a10b44cf1018f5f94d5a4caefef581d181c70f5d Author: Christoph Hellwig Date: Wed Nov 12 13:14:26 2025 +0100 xfs: factor out a xlog_write_space_advance helper Add a new xlog_write_space_advance that returns the current place in the iclog that data is written to, and advances the various counters by the amount taken from xlog_write_iovec, and also use it xlog_write_partial, which open codes the counter adjustments, but misses the asserts. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e2663443da71445a0c847199480b6a53ddec35e5 Author: Christoph Hellwig Date: Wed Nov 12 13:14:25 2025 +0100 xfs: improve the iclog space assert in xlog_write_iovec We need enough space for the length we copy into the iclog, not just some space, so tighten up the check a bit. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 865970d49a45af00ac4576684c33024e8d59b84c Author: Christoph Hellwig Date: Wed Nov 12 13:14:24 2025 +0100 xfs: add a xlog_write_space_left helper Various places check how much space is left in the current iclog, add a helper for that. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a3eb1f9cf85ff88939f5a9d360efc3eb73469afd Author: Christoph Hellwig Date: Wed Nov 12 13:14:23 2025 +0100 xfs: improve the calling convention for the xlog_write helpers The xlog_write chain passes around the same seven variables that are often passed by reference. Add a xlog_write_data structure to contain them to improve code generation and readability. This change increases the generated code size by about 140 bytes for my x86_64 build, which is hopefully worth the much easier to follow code: $ size fs/xfs/xfs_log.o* text data bss dec hex filename 29300 1730 176 31206 79e6 fs/xfs/xfs_log.o 29160 1730 176 31066 795a fs/xfs/xfs_log.o.old Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a82d7aac758161c310345bb5066f344c21ee783b Author: Christoph Hellwig Date: Wed Nov 12 13:14:22 2025 +0100 xfs: regularize iclog space accounting in xlog_write_partial When xlog_write_partial splits a log region over multiple iclogs, it has to include the continuation ophder in the length requested for the new iclog. Currently is simply adds that to the request, which makes the accounting of the used space below look slightly different from the other users of iclog space that decrement it. To prepare for more code sharing, add the ophdr size to the len variable that tracks the number of bytes still are left in this xlog_write operation before the calling xlog_write_get_more_iclog_space, and then decrement it later when consuming that space. This changes the value of len when xlog_write_get_more_iclog_space returns an error, but as nothing looks at len in that case the difference doesn't matter. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 2499d91180142f18fcd472ab52f37655fd787bf7 Author: Christoph Hellwig Date: Wed Nov 12 13:14:21 2025 +0100 xfs: move struct xfs_log_vec to xfs_log_priv.h The log_vec is a private type for the log/CIL code and should not be exposed to anything else. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 027410591418bded6ba6051151d88fc6fb8a7614 Author: Christoph Hellwig Date: Wed Nov 12 13:14:20 2025 +0100 xfs: move struct xfs_log_iovec to xfs_log_priv.h This structure is now only used by the core logging and CIL code. Also remove the unused typedef. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 8e7625344321105f5a52f59a3c7b3475a9a9e098 Author: Christoph Hellwig Date: Wed Nov 12 13:14:19 2025 +0100 xfs: improve the ->iop_format interface Export a higher level interface to format log items. The xlog_format_buf structure is hidden inside xfs_log_cil.c and only accessed using two helpers (and a wrapper build on top), hiding details of log iovecs from the log items. This also allows simply using an index into lv_iovecp instead of keeping a cursor vec. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit c53fbeedbe9098ba2e355fe646f3fe93e57f3f0e Author: Christoph Hellwig Date: Wed Nov 12 13:14:18 2025 +0100 xfs: set lv_bytes in xlog_write_one_vec lv_bytes is mostly just use by the CIL code, but has crept into the low-level log writing code to decide on a full or partial iclog write. Ensure it is valid even for the special log writes that don't go through the CIL by initializing it in xlog_write_one_vec. Note that even without this fix, the checkpoint commits would never trigger a partial iclog write, as they have no payload beyond the opheader. The unmount record on the other hand could in theory trigger a an overflow of the iclog, but given that is has never been seen in the wild this has probably been masked by the small size of it and the fact that the unmount process does multiple log forces before writing the unmount record and we thus usually operate on an empty or almost empty iclog. Fixes: 110dc24ad2ae ("xfs: log vector rounding leaks log space") Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 2d4521e4c00cafcd195f5e6fe5ee75b5c0680b8e Author: Christoph Hellwig Date: Wed Nov 12 13:14:17 2025 +0100 xfs: add a xlog_write_one_vec helper Add a wrapper for xlog_write for the two callers who need to build a log_vec and add it to a single-entry chain instead of duplicating the code. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a7f1bc231b666aed85358d4940ca8c37a75639f7 Author: Mostafa Saleh Date: Tue Jan 20 09:19:26 2026 +0000 iommu: debug-pagealloc: Use page_ext_get_from_phys() Instead of calling pfn_valid() and then getting the page, call the newly added function page_ext_get_from_phys(), which would also check for MMIO and offline memory and return NULL in that case. Signed-off-by: Mostafa Saleh Signed-off-by: Joerg Roedel commit d414b83dc5f90a6a9a656cd6fbb9378ddc824032 Author: Mostafa Saleh Date: Tue Jan 20 09:19:25 2026 +0000 mm/page_ext: Add page_ext_get_from_phys() The IOMMU code operates on physical addresses which can be outside of system RAM. Add a new function page_ext_get_from_phys() to abstract the logic of checking the address and returning the page_ext. Signed-off-by: Mostafa Saleh Acked-by: Vlastimil Babka Signed-off-by: Joerg Roedel commit 355a110040665e439af126e8ec9c3968e73f163c Author: Michael Riesch Date: Tue Jan 20 13:22:28 2026 +0100 media: synopsys: add driver for the designware mipi csi-2 receiver The Synopsys DesignWare MIPI CSI-2 Receiver is a CSI-2 bridge with one input port and one output port. It receives the data with the help of an external MIPI PHY (C-PHY or D-PHY) and passes it to e.g., the Rockchip Video Capture (VICAP) block on recent Rockchip SoCs. Add a V4L2 subdevice driver for this unit. Signed-off-by: Michael Riesch Reviewed-by: Bryan O'Donoghue Reviewed-by: Mehdi Djait Signed-off-by: Michael Riesch [Sakari Ailus: Make sparse and smatch happy.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit a1da27d0c3e08d88980a3205fc61773ec6089666 Author: Michael Riesch Date: Tue Jan 20 13:22:27 2026 +0100 media: dt-bindings: add rockchip mipi csi-2 receiver Add documentation for the Rockchip MIPI CSI-2 Receiver. Signed-off-by: Michael Riesch Reviewed-by: Krzysztof Kozlowski Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit eebe8dbd8630f51cf70b1f68a440cd3d7f7a914d Author: Yicong Yang Date: Wed Jan 21 18:15:43 2026 +0800 coresight: tmc: Decouple the perf buffer allocation from sysfs mode Currently the perf buffer allocation follows the below logic: - if the required AUX buffer size if larger, allocate the buffer with the required size - otherwise allocate the size reference to the sysfs buffer size This is not useful as we only collect to one AUX data, so just try to allocate the buffer match the AUX buffer size. Suggested-by: Suzuki K Poulose Link: https://lore.kernel.org/linux-arm-kernel/df8967cd-2157-46a2-97d9-a1aea883cf63@arm.com/ Signed-off-by: Yicong Yang Signed-off-by: Junhao He Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260121101543.2017014-4-wangyushan12@huawei.com commit e6e43e82c79c97917cbe356c07e8a6f3f982ab53 Author: Yicong Yang Date: Wed Jan 21 18:15:42 2026 +0800 coresight: tmc-etr: Fix race condition between sysfs and perf mode When trying to run perf and sysfs mode simultaneously, the WARN_ON() in tmc_etr_enable_hw() is triggered sometimes: WARNING: CPU: 42 PID: 3911571 at drivers/hwtracing/coresight/coresight-tmc-etr.c:1060 tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc] [..snip..] Call trace: tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc] (P) tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc] (L) tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc] coresight_enable_path+0x1c8/0x218 [coresight] coresight_enable_sysfs+0xa4/0x228 [coresight] enable_source_store+0x58/0xa8 [coresight] dev_attr_store+0x20/0x40 sysfs_kf_write+0x4c/0x68 kernfs_fop_write_iter+0x120/0x1b8 vfs_write+0x2c8/0x388 ksys_write+0x74/0x108 __arm64_sys_write+0x24/0x38 el0_svc_common.constprop.0+0x64/0x148 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x130 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x1ac/0x1b0 ---[ end trace 0000000000000000 ]--- Since the enablement of sysfs mode is separeted into two critical regions, one for sysfs buffer allocation and another for hardware enablement, it's possible to race with the perf mode. Fix this by double check whether the perf mode's been used before enabling the hardware in sysfs mode. mode: [sysfs mode] [perf mode] tmc_etr_get_sysfs_buffer() spin_lock(&drvdata->spinlock) [sysfs buffer allocation] spin_unlock(&drvdata->spinlock) spin_lock(&drvdata->spinlock) tmc_etr_enable_hw() drvdata->etr_buf = etr_perf->etr_buf spin_unlock(&drvdata->spinlock) spin_lock(&drvdata->spinlock) tmc_etr_enable_hw() WARN_ON(drvdata->etr_buf) // WARN sicne etr_buf initialized at the perf side spin_unlock(&drvdata->spinlock) With this fix, we retain the check for CS_MODE_PERF in get_etr_sysfs_buf. This ensures we verify whether the perf mode's already running before we actually allocate the buffer. Then we can save the time of allocating/freeing the sysfs buffer if race with the perf mode. Fixes: 296b01fd106e ("coresight: Refactor out buffer allocation function for ETR") Signed-off-by: Yicong Yang Signed-off-by: Junhao He Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260121101543.2017014-3-wangyushan12@huawei.com commit 5da8c55dd879347db64a1d28e66f6d7f62652373 Author: Yicong Yang Date: Wed Jan 21 18:15:41 2026 +0800 coresight: tmc: Add missing doc including reading and etr_mode of struct tmc_drvdata tmc_drvdata::reading is used to indicate whether a reading process is performed through /dev/xyz.tmc. tmc_drvdata::etr_mode is used to store the Coresight TMC-ETR buffer mode selected by the user. Document them. Reviewed-by: James Clark Signed-off-by: Yicong Yang Reviewed-by: Leo Yan Signed-off-by: Junhao He Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260121101543.2017014-2-wangyushan12@huawei.com commit d51e390ae84857a999ad2046e074e97663e98e36 Author: Val Packett Date: Tue Jan 20 20:30:10 2026 -0300 drm/bridge: simple: add the Algoltek AG6311 DP-to-HDMI bridge The Algoltek AG6311 is a transparent DisplayPort to HDMI bridge. Reviewed-by: Dmitry Baryshkov Signed-off-by: Val Packett Link: https://patch.msgid.link/20260120234029.419825-8-val@packett.cool Signed-off-by: Dmitry Baryshkov commit e58be49a9a09112fdb4e4d68b4653a2545746091 Author: Val Packett Date: Tue Jan 20 20:30:09 2026 -0300 dt-bindings: display: bridge: simple: document the Algoltek AG6311 DP-to-HDMI bridge The Algoltek AG6311 is a transparent DisplayPort to HDMI bridge. Reviewed-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Signed-off-by: Val Packett Link: https://patch.msgid.link/20260120234029.419825-7-val@packett.cool Signed-off-by: Dmitry Baryshkov commit 00e6f8f60601b412e400873c8972f3e3802557f3 Author: Val Packett Date: Tue Jan 20 20:30:06 2026 -0300 dt-bindings: vendor-prefixes: Add AlgolTek AlgolTek is a Taiwanese chip manufacturer specialized in high-speed signal and power transmission and conversion. Signed-off-by: Val Packett Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260120234029.419825-4-val@packett.cool Signed-off-by: Dmitry Baryshkov commit cd796ca8b83be6bcab7610e420078539fe67ea03 Author: Pragnesh Papaniya Date: Tue Jan 20 19:07:35 2026 +0530 dt-bindings: interconnect: qcom-bwmon: Document Glymur BWMONs Document Glymur BWMONs, which has multiple (one per cluster) BWMONv4 instances for the CPU->DDR path. Signed-off-by: Pragnesh Papaniya Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260120-glymur_bwmon_binding-v1-1-57848445eccf@oss.qualcomm.com Signed-off-by: Georgi Djakov commit de284988c270cc16a3fb41f8f6955394d4af2a12 Author: Luca Weiss Date: Fri Jan 16 14:38:55 2026 +0100 dt-bindings: eeprom: at24: Add compatible for Puya P24C128F Add the compatible for an 128Kb EEPROM from Puya. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260116-milos-cci-v1-1-28e01128da9c@fairphone.com Signed-off-by: Bartosz Golaszewski commit 3dc4092fe5c8baf6bf4e882b44615f19564a5076 Author: Raviteja Laggyshetty Date: Tue Jan 20 09:30:10 2026 +0000 interconnect: qcom: qcs8300: fix the num_links for nsp icc node The qxm_nsp node is configured with an incorrect num_links value, causing remoteproc driver to fail probing because it cannot acquire the interconnect path for qxm_nsp -> ebi. This results in the following error in dmesg: platform 26300000.remoteproc: deferred probe pending: qcom_q6v5_pas: failed to acquire interconnect path Set num_links to 2 to match the two link_nodes, allowing remoteproc clients to obtain the correct path handle and vote on qxm_nsp -> ebi. Fixes: 874be3339c85 ("interconnect: qcom: qcs8300: convert to dynamic IDs") Signed-off-by: Raviteja Laggyshetty Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260120-monaco_num_links_fix_nsp_ebi_path-v3-1-536be21ce3ff@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 58a17b2647ba5aac47e3ffafd0a9b92bf4a9bcbe Author: Richard Zhu Date: Wed Jan 14 16:33:00 2026 +0800 PCI: dwc: Skip waiting for L2/L3 Ready if dw_pcie_rp::skip_l23_wait is true In NXP i.MX6QP and i.MX7D SoCs, LTSSM registers are not accessible once PME_Turn_Off message is broadcasted to the link. So there is no way to verify whether the link has entered L2/L3 Ready state or not. Hence, add a new flag 'dw_pcie_rp::skip_l23_ready' and set it to 'true' for the above mentioned SoCs. This flag when set, will allow the DWC core to skip polling for L2/L3 Ready state and just wait for 10ms as recommended in the PCIe spec r6.0, sec 5.3.3.2.1. Fixes: a528d1a72597 ("PCI: imx6: Use DWC common suspend resume method") Signed-off-by: Richard Zhu [mani: renamed flag to skip_l23_ready and reworded description] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260114083300.3689672-2-hongxing.zhu@nxp.com commit 86cbb7a81068434fdc1d5afb96d91ab971fb279e Author: Manivannan Sadhasivam Date: Tue Jan 20 23:17:44 2026 +0530 PCI: dwc: Fail dw_pcie_host_init() if dw_pcie_wait_for_link() returns -ETIMEDOUT The dw_pcie_wait_for_link() API now distinguishes link failures more precisely: -ENODEV: Device not found on the bus. -EIO: Device found but inactive. -ETIMEDOUT: Link failed to come up. Out of these three errors, only -ETIMEDOUT represents a definitive link failure since it signals that something is wrong with the link. For the other two errors, there is a possibility that the link might come up later. So fail dw_pcie_host_init() if -ETIMEDOUT is returned and skip the failure otherwise. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260120-pci-dwc-suspend-rework-v4-5-2f32d5082549@oss.qualcomm.com commit d266f63b385a3bad5fd6f23797b6de57de998677 Author: Manivannan Sadhasivam Date: Tue Jan 20 23:17:43 2026 +0530 PCI: dwc: Rework the error print of dw_pcie_wait_for_link() For the cases where the link cannot come up later i.e., when LTSSM is not in Detect.{Quiet/Active} or Poll.{Active/Compliance} states, dw_pcie_wait_for_link() should log an error. So promote dev_info() to dev_err(), reword the error log to make it clear and also print the LTSSM state to aid debugging. Signed-off-by: Manivannan Sadhasivam Tested-by: Richard Zhu Tested-by: Vincent Guittot Reviewed-by: Shawn Lin Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260120-pci-dwc-suspend-rework-v4-4-2f32d5082549@oss.qualcomm.com commit 36dd677f7d76ddec96d50cf57f543ba7d612087c Author: Manivannan Sadhasivam Date: Tue Jan 20 23:17:42 2026 +0530 PCI: dwc: Rename and move ltssm_status_string() to pcie-designware.c Rename ltssm_status_string() to dw_pcie_ltssm_status_string() and move it to the common file pcie-designware.c so that this function could be used outside of pcie-designware-debugfs.c file. Signed-off-by: Manivannan Sadhasivam Tested-by: Richard Zhu Tested-by: Vincent Guittot Reviewed-by: Shawn Lin Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260120-pci-dwc-suspend-rework-v4-3-2f32d5082549@oss.qualcomm.com commit 01d16b8afb7afcc17f999f8b4a9b9cfe6c6fae71 Author: Manivannan Sadhasivam Date: Tue Jan 20 23:17:41 2026 +0530 PCI: dwc: Return -EIO from dw_pcie_wait_for_link() if device is not active There are cases where the PCIe device would be physically connected to the bus, but the device firmware might not be active. So the LTSSM will get stuck in POLL.{Active/Compliance} states. This behavior is common with endpoint devices controlled by the PCI Endpoint framework, where the device will wait for the user to start its operation through configfs. For those cases, print the relevant log and return -EIO to indicate that the device is present, but not active. This will allow the callers to skip the failure as the device might become active in the future. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260120-pci-dwc-suspend-rework-v4-2-2f32d5082549@oss.qualcomm.com commit 1bcf245c837bc66fdaddea222bab9eb5c978a9d7 Author: Manivannan Sadhasivam Date: Tue Jan 20 23:17:40 2026 +0530 PCI: dwc: Return -ENODEV from dw_pcie_wait_for_link() if device is not found The dw_pcie_wait_for_link() function waits up to 1 second for the PCIe link to come up and returns -ETIMEDOUT for all failures without distinguishing cases where no device is present on the bus. But the callers may want to just skip the failure if the device is not found on the bus and handle failure for other reasons. So after timeout, if the LTSSM is in Detect.Quiet or Detect.Active state, return -ENODEV to indicate the callers that the device is not found on the bus and return -ETIMEDOUT otherwise. Also add kernel doc to document the parameter and return values. Signed-off-by: Manivannan Sadhasivam Tested-by: Richard Zhu Tested-by: Vincent Guittot Reviewed-by: Shawn Lin Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20260120-pci-dwc-suspend-rework-v4-1-2f32d5082549@oss.qualcomm.com commit 2ccbdb612d0d95f25c38189b83666ff0fb2bfb47 Author: Benjamin Philip Date: Wed Jan 7 00:18:29 2026 +0530 platform/x86: ideadpad-laptop: Clean up style warnings and checks This commit makes some style changes to clean up the following checkpatch warnings and checks at various places in ideapad.c: - WARNING: quoted string split across lines - WARNING: space prohibited between function name and open parenthesis '(' - WARNING: braces {} are not necessary for any arm of this statement - CHECK: Alignment should match open parenthesis We exceed the 80 column limit to fix the quoted string warning since strings in question are user visible. See coding style, part 2 for details. Signed-off-by: Benjamin Philip Acked-by: Ike Panhc Link: https://patch.msgid.link/20260106184830.34426-1-benjamin.philip495@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 118222e20d16caf38264b850d7a386e5f063008c Author: Shyam Sundar S K Date: Thu Jan 15 09:34:48 2026 -0800 platform/x86/amd/pmf: Introduce new interface to export NPU metrics The PMF driver retrieves NPU metrics data from the PMFW. Introduce a new interface to make NPU metrics accessible to other drivers like AMDXDNA driver, which can access and utilize this information as needed. Reviewed-by: Mario Limonciello Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K [lizhi: save return value of is_npu_metrics_supported() and return it] Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260115173448.403826-1-lizhi.hou@amd.com Signed-off-by: Ilpo Järvinen commit 7b85137caf110a09a4a18f00f730de4709f9afc8 Author: Mario Limonciello (AMD) Date: Thu Jan 15 22:11:32 2026 -0600 crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails The hibernate resume sequence involves loading a resume kernel that is just used for loading the hibernate image before shifting back to the existing kernel. During that hibernate resume sequence the resume kernel may have loaded the ccp driver. If this happens the resume kernel will also have called PSP_CMD_TEE_RING_INIT but it will never have called PSP_CMD_TEE_RING_DESTROY. This is problematic because the existing kernel needs to re-initialize the ring. One could argue that the existing kernel should call destroy as part of restore() but there is no guarantee that the resume kernel did or didn't load the ccp driver. There is also no callback opportunity for the resume kernel to destroy before handing back control to the existing kernel. Similar problems could potentially exist with the use of kdump and crash handling. I actually reproduced this issue like this: 1) rmmod ccp 2) hibernate the system 3) resume the system 4) modprobe ccp The resume kernel will have loaded ccp but never destroyed and then when I try to modprobe it fails. Because of these possible cases add a flow that checks the error code from the PSP_CMD_TEE_RING_INIT call and tries to call PSP_CMD_TEE_RING_DESTROY if it failed. If this succeeds then call PSP_CMD_TEE_RING_INIT again. Fixes: f892a21f51162 ("crypto: ccp - use generic power management") Reported-by: Lars Francke Closes: https://lore.kernel.org/platform-driver-x86/CAD-Ua_gfJnQSo8ucS_7ZwzuhoBRJ14zXP7s8b-zX3ZcxcyWePw@mail.gmail.com/ Tested-by: Yijun Shen Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Shyam Sundar S K Acked-by: Tom Lendacky Link: https://patch.msgid.link/20260116041132.153674-6-superm1@kernel.org Signed-off-by: Ilpo Järvinen commit d95f87a65bce5f2f2a02ca6094ca4841d4073df3 Author: Mario Limonciello (AMD) Date: Thu Jan 15 22:11:31 2026 -0600 crypto: ccp - Factor out ring destroy handling to a helper The ring destroy command needs to be used in multiple places. Split out the code to a helper. Tested-by: Yijun Shen Signed-off-by: Mario Limonciello (AMD) Acked-by: Tom Lendacky Reviewed-by: Shyam Sundar S K Link: https://patch.msgid.link/20260116041132.153674-5-superm1@kernel.org Signed-off-by: Ilpo Järvinen commit 0ba2035026d0ab6c7c7e65ad8b418dc73d5700d9 Author: Mario Limonciello (AMD) Date: Thu Jan 15 22:11:30 2026 -0600 crypto: ccp - Add an S4 restore flow The system will have lost power during S4. The ring used for TEE communications needs to be initialized before use. Fixes: f892a21f51162 ("crypto: ccp - use generic power management") Reported-by: Lars Francke Closes: https://lore.kernel.org/platform-driver-x86/CAD-Ua_gfJnQSo8ucS_7ZwzuhoBRJ14zXP7s8b-zX3ZcxcyWePw@mail.gmail.com/ Tested-by: Yijun Shen Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Shyam Sundar S K Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20260116041132.153674-4-superm1@kernel.org Signed-off-by: Ilpo Järvinen commit 5e599d7871bf852e94e8aa08b99724635f2cbf96 Author: Mario Limonciello (AMD) Date: Thu Jan 15 22:11:29 2026 -0600 crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails tee_init_ring() only declares PSP dead if the command times out. If there is any other failure it is still considered fatal though. Set psp_dead for other failures as well. Fixes: 949a0c8dd3c2 ("crypto: ccp - Move direct access to some PSP registers out of TEE") Tested-by: Yijun Shen Signed-off-by: Mario Limonciello (AMD) Acked-by: Tom Lendacky Reviewed-by: Shyam Sundar S K Link: https://patch.msgid.link/20260116041132.153674-3-superm1@kernel.org Signed-off-by: Ilpo Järvinen commit 48d229c7047128dd52eaf863881bb3e62b5896e5 Author: Shyam Sundar S K Date: Thu Jan 15 22:11:28 2026 -0600 platform/x86/amd/pmf: Prevent TEE errors after hibernate After resuming from hibernate, TEE commands can time out and cause PSP disables. Fix this by reinitializing the Trusted Application (TA) and cancelling the pb workqueue in the hibernate callbacks to avoid these errors. ccp 0000:c4:00.2: tee: command 0x5 timed out, disabling PSP amd-pmf AMDI0107:00: TEE enact cmd failed. err: ffff000e, ret:0 amd-pmf AMDI0107:00: TEE enact cmd failed. err: ffff000e, ret:0 amd-pmf AMDI0107:00: TEE enact cmd failed. err: ffff000e, ret:0 Fixes: ae82cef7d9c5 ("platform/x86/amd/pmf: Add support for PMF-TA interaction") Reported-by: Lars Francke Closes: https://lore.kernel.org/platform-driver-x86/CAD-Ua_gfJnQSo8ucS_7ZwzuhoBRJ14zXP7s8b-zX3ZcxcyWePw@mail.gmail.com/ Tested-by: Yijun Shen Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K [ML: Add more tags] Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20260116041132.153674-2-superm1@kernel.org Signed-off-by: Ilpo Järvinen commit 51ed34282f63fab5b3996477cc56135eb4de5284 Author: Rong Zhang Date: Wed Jan 21 02:20:08 2026 +0800 platform/x86: lenovo-wmi-other: Add HWMON for fan reporting/tuning Register an HWMON device for fan reporting/tuning according to Capability Data 00 (capdata00) and Fan Test Data (capdata_fan) provided by lenovo-wmi-capdata. The corresponding HWMON nodes are: - fanX_div: internal RPM divisor - fanX_input: current RPM - fanX_max: maximum RPM - fanX_min: minimum RPM - fanX_target: target RPM (tunable, 0=auto) Information from capdata00 and capdata_fan are used to control the visibility and constraints of HWMON attributes. Fan info from capdata00 is collected on bind, while fan info from capdata_fan is collected in a callback. Once all fan info is collected, register the HWMON device. Signed-off-by: Rong Zhang Reviewed-by: Derek J. Clark Tested-by: Kurt Borja Link: https://patch.msgid.link/20260120182104.163424-8-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 67d9a39ce85fafc2d88f82c9229ace111aaa8c1f Author: Rong Zhang Date: Wed Jan 21 02:20:07 2026 +0800 platform/x86: lenovo-wmi-capdata: Wire up Fan Test Data A capdata00 attribute (0x04050000) describes the presence of Fan Test Data. Query it, and bind Fan Test Data as a component of capdata00 accordingly. The component master of capdata00 may pass a callback while binding to retrieve fan info from Fan Test Data. Summarizing this scheme: lenovo-wmi-other <-> capdata00 <-> capdata_fan |- master |- component | |- sub-master |- sub-component The callback will be called once both the master and the sub-component are bound to the sub-master (component). This scheme is essential to solve these issues: - The component framework only supports one aggregation per master - A binding is only established until all components are found - The Fan Test Data interface may be missing on some devices - To get rid of queries for the presence of WMI GUIDs - The notifier framework cannot cleanly connect capdata_fan to lenovo-wmi-other without introducing assumptions on probing sequence capdata00 is registered as a component and a sub-master on probe, instead of chaining the registrations in one's bind callback. This is because calling (un)registration methods of the component framework causes deadlock in (un)bind callbacks, i.e., it's impossible to register capdata00 as a sub-master/component in its component/sub-master bind callback, and vice versa. Signed-off-by: Rong Zhang Reviewed-by: Derek J. Clark Tested-by: Derek J. Clark Link: https://patch.msgid.link/20260120182104.163424-7-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 012a8f967a87dea3f25c3a3ae32610c0dd145f34 Author: Rong Zhang Date: Wed Jan 21 02:20:06 2026 +0800 platform/x86: lenovo-wmi-capdata: Add support for Fan Test Data Add support for LENOVO_FAN_TEST_DATA WMI data block. Provides an interface for querying the min/max fan speed RPM (reference data) of a given fan ID. This interface is optional. Hence, it does not bind to lenovo-wmi-other and is not registered as a component for the moment. Appropriate binding will be implemented in the subsequent patch. Signed-off-by: Rong Zhang Reviewed-by: Derek J. Clark Tested-by: Derek J. Clark Link: https://patch.msgid.link/20260120182104.163424-6-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c05f67e6c2e508f5462f30a5394a1607ef683ff9 Author: Rong Zhang Date: Wed Jan 21 02:20:05 2026 +0800 platform/x86: lenovo-wmi-capdata: Add support for Capability Data 00 Add support for LENOVO_CAPABILITY_DATA_00 WMI data block that comes on "Other Mode" enabled hardware. Provides an interface for querying if a given attribute is supported by the hardware, as well as its default value. capdata00 always presents on devices with capdata01. lenovo-wmi-other now binds to both (no functional change intended). Signed-off-by: Rong Zhang Reviewed-by: Derek J. Clark Tested-by: Derek J. Clark Link: https://patch.msgid.link/20260120182104.163424-5-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4ff1a029531441a27288eed8ba57d48fe11ba79a Author: Rong Zhang Date: Wed Jan 21 02:20:04 2026 +0800 platform/x86: lenovo-wmi-{capdata,other}: Support multiple Capability Data The current implementation are heavily bound to capdata01. Rewrite it so that it is suitable to utilize other Capability Data as well. No functional change intended. Signed-off-by: Rong Zhang Reviewed-by: Derek J. Clark Tested-by: Derek J. Clark Link: https://patch.msgid.link/20260120182104.163424-4-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f28d76b17561bd5f1b7b2c8f139a00158218c2d2 Author: Rong Zhang Date: Wed Jan 21 02:20:03 2026 +0800 platform/x86: Rename lenovo-wmi-capdata01 to lenovo-wmi-capdata Prepare for the upcoming changes to make it suitable to retrieve and provide other Capability Data as well. Signed-off-by: Rong Zhang Reviewed-by: Derek J. Clark Tested-by: Derek J. Clark Link: https://patch.msgid.link/20260120182104.163424-3-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 465dc9da8ff61a69e649ec2d402d8e06034f4585 Author: Rong Zhang Date: Wed Jan 21 02:20:02 2026 +0800 platform/x86: lenovo-wmi-helpers: Convert returned buffer into u32 The Windows WMI-ACPI driver converts all ACPI objects into a common buffer format, so returning a buffer with four bytes will look like an integer for WMI consumers under Windows. Therefore, some devices may simply implement the corresponding ACPI methods to always return a buffer. While lwmi_dev_evaluate_int() expects an integer (u32), convert returned >=4B buffer into u32 to support these devices. Suggested-by: Armin Wolf Link: https://lore.kernel.org/r/f1787927-b655-4321-b9d9-bc12353c72db@gmx.de/ Signed-off-by: Rong Zhang Reviewed-by: Derek J. Clark Tested-by: Derek J. Clark Reviewed-by: Armin Wolf Link: https://patch.msgid.link/20260120182104.163424-2-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8bb92fd7a04077925c8330f46a6ab44c80ca59f4 Author: Tommaso Merciai Date: Mon Dec 22 14:43:47 2025 +0100 phy: renesas: rcar-gen3-usb2: Use mux-state for phyrst management Add support for selecting the phyrst mux-state using the Linux mux subsystem in the R-Car Gen3 USB2 PHY driver. This ensures correct hardware initialization and integration with systems utilizing the mux-state device tree property. A temporary wrapper for optional muxes is introduced until native support is available in the multiplexer subsystem. Signed-off-by: Tommaso Merciai Link: https://patch.msgid.link/80aafdb2367dcada720b0a9ebeea344764e710fb.1766405010.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Vinod Koul commit b6d7dd157763e0c8937f60241fb4af9eb546a7fb Author: Tommaso Merciai Date: Mon Dec 22 14:43:46 2025 +0100 phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control Enable OTG VBUS control on R-Car Gen3 USB2 PHY by registering a regulator driver that manages the VBOUT line. This change allows the controller to handle VBUS output for OTG ports using the regulator framework when the platform requires hardware-based VBUS control. Without this, some platforms cannot properly manage VBUS power on OTG- capable ports, leading to potential USB functionality issues. Signed-off-by: Tommaso Merciai Link: https://patch.msgid.link/6c1aebf60b4d8ff0c51a8243c68b397c1a384867.1766405010.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Vinod Koul commit 230c817a1601af3ac2c9fdf3fbde9a3fee6bd26c Author: Tommaso Merciai Date: Mon Dec 22 14:43:45 2025 +0100 phy: renesas: rcar-gen3-usb2: Use devm_pm_runtime_enable() Replace pm_runtime_enable() with devm_pm_runtime_enable() to ensure proper cleanup if the probe fails. This change enhances driver reliability by avoiding resource leaks, as the devm-managed version automatically handles disabling at probe failure or device removal. Signed-off-by: Tommaso Merciai Link: https://patch.msgid.link/ca028d41f84227efeccb0cbdff22fbf16e5cf6ab.1766405010.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Vinod Koul commit d6db3b3af74a26b65d1ec1e86f9738c784e7ae29 Author: Tommaso Merciai Date: Mon Dec 22 14:43:44 2025 +0100 phy: renesas: rcar-gen3-usb2: Factor out VBUS control logic Refactor the VBUS control logic into a new helper function to improve code clarity and reduce duplication. This makes it easier to handle different VBUS control register cases and aids future maintenance. Signed-off-by: Tommaso Merciai Link: https://patch.msgid.link/2d94c9876b965bdf7cd74cdbbc0c54689e122798.1766405010.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Vinod Koul commit 642c462854bf1f20e4d61a06e880c1b73bf6e542 Author: Tommaso Merciai Date: Mon Dec 22 14:43:43 2025 +0100 dt-bindings: phy: renesas,usb2-phy: Document RZ/G3E SoC Document USB2.0 phy bindings for RZ/G3E ("R9A09G047") SoC. The RZ/G3E USB2.0 phy is functionally identical to the one found on the RZ/V2H(P), so no driver changes are needed. The existing "renesas,usb2-phy-r9a09g057" will be used as a fallback compatible for this IP. Acked-by: Conor Dooley Signed-off-by: Tommaso Merciai Link: https://patch.msgid.link/4f2454708428b48e03faabe79e383999fb1ab458.1766405010.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Vinod Koul commit cd597ce6460dc01f30f0f4158bbf20624c33c594 Author: Tommaso Merciai Date: Mon Dec 22 14:43:42 2025 +0100 dt-bindings: phy: renesas,usb2-phy: Document mux-states property Some Renesas SoCs, such as RZ/G3E, provide a USB2.0 OTG PHY with configurable VBUS control through a multiplexed hardware register. This register allows selecting the VBUS source via a mux control line exposed by the PHY. To represent this hardware configuration, support the standard `mux-states` property in the Renesas USB2 PHY binding. This allows the DeviceTree to model the VBUS source selection as a mux, consistent with generic binding conventions. Acked-by: Conor Dooley Signed-off-by: Tommaso Merciai Link: https://patch.msgid.link/36d448dd10bbb2bbfa5b1b6b6e3fee86c34d01aa.1766405010.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Vinod Koul commit 274038b82f413a754ffc6fbdb771a3ac62d1bb4b Author: Tommaso Merciai Date: Mon Dec 22 14:43:41 2025 +0100 dt-bindings: phy: renesas,usb2-phy: Document USB VBUS regulator Document the 'vbus-regulator' child node in the Renesas USB2 PHY binding to describe the internal USB VBUS regulator. Require this regulator node on OTG channels to accurately represent hardware dependencies in the device tree. Documenting this regulator allows device trees to model the VBUS power requirements of these SoCs properly. Acked-by: Conor Dooley Signed-off-by: Tommaso Merciai Link: https://patch.msgid.link/aaa8044283eb736817afd43d4fba3aa93b50b1dd.1766405010.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Vinod Koul commit de5dba83311842cf208735b37bea84073688d470 Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:58 2026 +0200 phy: rockchip: samsung-hdptx: Add HDMI 2.1 FRL support The PHY is capable of handling four HDMI 2.1 Fixed Rate Link (FRL) lanes, and each one can operate at any of the rates of 3Gbps, 6Gbps, 8Gbps, 10Gbps or 12Gbps. Add the necessary driver changes to support the feature. Co-developed-by: Algea Cao Signed-off-by: Algea Cao Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-11-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit b14fec4dbda301d61603c047277b4f447837b3e3 Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:57 2026 +0200 phy: rockchip: samsung-hdptx: Extend rk_hdptx_phy_verify_hdmi_config() helper In order to facilitate introduction of HDMI 2.1 FRL support and to avoid recomputing the link rate after verifying the HDMI configuration given as input, extend rk_hdptx_phy_verify_hdmi_config() by providing an optional output parameter to store the validated configuration. For improved code readability, also rename the existing hdmi input parameter. Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-10-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit ac079c1207e492924237fdfb12c93664265b2e23 Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:56 2026 +0200 phy: rockchip: samsung-hdptx: Switch to driver specific HDMI config In preparation to support the FRL operation mode which gets configured via the lanes and rate per lane tuple, switch to a driver specific struct for configuring the link rate and bpc. This simplifies and optimizes the implementation by allowing implicit switches between TMDS and FRL rates, without requiring additional checks of the active PHY mode followed by recalculations of the link rate when operating in FRL mode. Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-9-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit 66d76b6d958d7ca195c8b3f43828b12a206fb731 Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:55 2026 +0200 phy: rockchip: samsung-hdptx: Drop hw_rate driver data The ->hw_rate member of struct rk_hdptx_phy was mainly used to keep track of the clock rate programmed in hardware and support implementing the ->recalc_rate() callback in hdptx_phy_clk_ops. Computing the clock rate from the actual PHY PLL configuration seems to work reliably, hence remove the now redundant struct member. Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-8-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit 3481fc04d969bc1528c2d1f7c02443a9fccf1a83 Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:54 2026 +0200 phy: rockchip: samsung-hdptx: Compute clk rate from PLL config Improve ->recalc_rate() callback of hdptx_phy_clk_ops to calculate the initial clock rate based on the actual PHY PLL configuration as retrieved from the related hardware registers. Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-7-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit df74a964e4354e65fefef60c9c50765ff32cd26e Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:53 2026 +0200 phy: rockchip: samsung-hdptx: Cleanup *_cmn_init_seq lists Drop redundant reg_sequence entries from rk_hdptx_common_cmn_init_seq[], i.e. those that are either duplicated or overridden in rk_hdptx_tmds_cmn_init_seq[]. Additionally, a few items do not really belong to the former, hence move them to the latter. That's mostly a preparatory step for adding FRL support. No functional changes intended at this point. Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-6-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit 8e8aa072b19d0d16afbfd690c8e50628176db3ef Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:52 2026 +0200 phy: rockchip: samsung-hdptx: Enable lane output in common helper In preparation to support FRL mode, move the PHY lane output enablement from the TMDS specific configuration to the common *_post_enable_lane() helper and make sure it gets turned off in *_phy_disable(). Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-5-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit 925f26a4f8c65e5686e1820f0bdc7e0a237edba7 Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:51 2026 +0200 phy: rockchip: samsung-hdptx: Consistently use [rk_]hdptx_[tmds_] prefixes Fix the naming inconsistencies for some of the functions and global variables: * Add the missing 'rk_hdptx_' prefix to ropll_tmds_cfg variable * Replace '_ropll_tmds_' with '_tmds_ropll_' globally * Replace 'hdtpx' with 'hdptx' globally Signed-off-by: Cristian Ciocaltea Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-4-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit 4f310f180373bd0e68311debee7a0dddb14c1656 Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:50 2026 +0200 phy: rockchip: samsung-hdptx: Fix coding style alignment Handle a bunch of reported checkpatch.pl complaints: CHECK: Alignment should match open parenthesis Signed-off-by: Cristian Ciocaltea Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-3-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit 0ef8dd1034e3656e40d020911bb7aa14e7084663 Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:49 2026 +0200 phy: rockchip: samsung-hdptx: Use usleep_range() instead of udelay() rk_hdptx_dp_reset() is allowed to sleep, hence replace the busy waiting with usleep_range(), to allow other threads to run. Signed-off-by: Cristian Ciocaltea Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-2-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit 41c6cac6decd5123db1da8ca240a9c808b0ae6ce Author: Cristian Ciocaltea Date: Tue Jan 13 01:20:48 2026 +0200 phy: hdmi: Add HDMI 2.1 FRL configuration options The HDMI 2.1 specification introduced the Fixed Rate Link (FRL) mode, aiming to replace the older Transition-Minimized Differential Signaling (TMDS) mode used in previous HDMI versions to support much higher bandwidths (up to 48 Gbps) for modern video and audio formats. FRL has been designed to support ultra high resolution formats at high refresh rates like 8K@60Hz or 4K@120Hz, and eliminates the need for dynamic bandwidth adjustments, which reduces latency. It operates with 3 or 4 lanes at different link rates: 3Gbps, 6Gbps, 8Gbps, 10Gbps or 12Gbps. Add support for configuring the FRL mode for HDMI PHYs. Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20260113-phy-hdptx-frl-v6-1-8d5f97419c0b@collabora.com Signed-off-by: Vinod Koul commit 4dd5d4c0361af0a3fd24f45c815996abf4429770 Author: Thomas Richard Date: Wed Jan 14 17:50:23 2026 +0100 phy: freescale: imx8qm-hsio: fix NULL pointer dereference During the probe the refclk_pad pointer is set to NULL if the 'fsl,refclk-pad-mode' property is not defined in the devicetree node. But in imx_hsio_configure_clk_pad() this pointer is unconditionally used which could result in a NULL pointer dereference. So check the pointer before to use it. Fixes: 82c56b6dd24f ("phy: freescale: imx8qm-hsio: Add i.MX8QM HSIO PHY driver support") Signed-off-by: Thomas Richard Reviewed-by: Richard Zhu Link: https://patch.msgid.link/20260114-phy-fsl-imx8qm-hsio-fix-null-pointer-dereference-v1-1-730e941be464@bootlin.com Signed-off-by: Vinod Koul commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a Author: Aleksandar Gerasimovski Date: Tue Jan 6 15:06:43 2026 +0000 phy: mvebu-cp110-utmi: fix dr_mode property read from dts The problem with the current implementation is that it does not consider that the USB controller can have multiple PHY handles with different arguments count, as for example we have in our cn9131 based platform: "phys = <&cp0_comphy1 0>, <&cp0_utmi0>;". In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells) leads to not proper phy detection, taking the "marvell,cp110-utmi-phy" dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0 (#phy-cells = <0>) and safely look for that phy. Signed-off-by: Aleksandar Gerasimovski Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com Signed-off-by: Vinod Koul commit 65d5727645acbc019fd17d47f47b743eb116ff14 Author: Chen Ni Date: Mon Jan 19 13:57:15 2026 +0800 soc: fsl: qe: qe_ports_ic: Consolidate chained IRQ handler install/remove The driver currently sets the handler data and the chained handler in two separate steps. This creates a theoretical race window where an interrupt could fire after the handler is set but before the data is assigned, leading to a NULL pointer dereference. Replace the two calls with irq_set_chained_handler_and_data() to set both the handler and its data atomically under the irq_desc->lock. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20260119055715.889001-1-nichen@iscas.ac.cn Signed-off-by: Christophe Leroy (CS GROUP) commit a152a90f53909544fe996fb0fa072ae9e355c452 Author: Richard Zhu Date: Tue Jan 6 17:19:19 2026 +0530 PCI: imx6: Clear CLKREQ# override if 'supports-clkreq' DT property is available CLKREQ# is an optional reference clock request signal defined by the PCIe CEM and M.2 specifications to request REFCLK and exit the L1 Substates. The imx6 controller driver so far forced the CLKREQ# signal to low by enabling the CLKREQ# override logic as the slots do not expose this signal. Now, there are board designs coming up exposing this signal to the endpoint devices. This is identified using the 'supports-clkreq' DT property in the controller node. So when the DT node has this property, clear the CLKREQ# override after link up in host_post_init() callback to allow the endpoint to drive the CLKREQ# signal. Signed-off-by: Richard Zhu [mani: squashed the imx8mm_pcie_clkreq_override helper patch & reworded description] Signed-off-by: Manivannan Sadhasivam commit 27a064aba2da6bc58fc36a6b8e889187ae3bf89d Author: Richard Zhu Date: Wed Oct 15 11:04:27 2025 +0800 PCI: imx6: Add CLKREQ# override to enable REFCLK for i.MX95 PCIe The CLKREQ# is an open drain, active low signal that is driven low by the card to request reference clock. It's an optional signal added in PCIe CEM r4.0, sec 2. Thus, this signal wouldn't be driven low if it's not exposed on the slot. On the i.MX95 EVK board, REFCLK to the host and endpoint is gated by this CLKREQ# signal. So if the CLKREQ# signal is not driven by the endpoint, it will gate the REFCLK to host too, leading to operational failure. Hence, enable the REFCLK on this SoC by enabling the CLKREQ# override using imx95_pcie_clkreq_override() helper during probe. This override should only be cleared when the CLKREQ# signal is exposed on the slot. Signed-off-by: Richard Zhu [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Tested-by: Alexander Stein Reviewed-by: Frank Li Link: https://patch.msgid.link/20251015030428.2980427-11-hongxing.zhu@nxp.com commit c577ce2881f9c76892de5ffc1a122e3ef427ecee Author: Richard Zhu Date: Wed Oct 15 11:04:25 2025 +0800 PCI: dwc: Invoke post_init in dw_pcie_resume_noirq() In some SoCs like i.MX95, CLKREQ# is pulled low by the controller driver before link up. After link up, if the 'supports-clkreq' property is specified in DT, the driver will release CLKREQ# so that it can go high and the endpoint can pull it low whenever required i.e., during exit from L1 Substates. Hence, at the end of dw_pcie_resume_noirq(), invoke the '.post_init()' callback if exists to perform the above mentioned action. Signed-off-by: Richard Zhu [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Link: https://patch.msgid.link/20251015030428.2980427-9-hongxing.zhu@nxp.com commit 6ee54e03d97bce5168b4ac87cdf7ac88b3f944a8 Author: Frank Li Date: Fri Jan 16 11:18:00 2026 -0500 media: staging: media: imx6-mipi-csi2: use devm_platform_ioremap_resource() simplify code Use devm_platform_ioremap_resource() simplify code. No functional change. Reviewed-by: Laurent Pinchart Reviewed-by: Philipp Zabel Signed-off-by: Frank Li Link: https://patch.msgid.link/20260116-stage-csi2-cleanup-v2-5-a56e9cb25196@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2da4207d0a7c7de28edde12fe9e3da574f877351 Author: Frank Li Date: Fri Jan 16 11:17:57 2026 -0500 media: staging: media: imx6-mipi-csi2: use devm_mutex_init() to simplify code Use devm_mutex_init() to simplify the code. No functional change. Reviewed-by: Philipp Zabel Signed-off-by: Frank Li Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260116-stage-csi2-cleanup-v2-2-a56e9cb25196@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 7ce92f358970242fba35e854a17663a44d26ccc9 Author: Frank Li Date: Fri Jan 16 11:17:56 2026 -0500 media: staging: media: imx6-mipi-csi2: replace spaces with tabs for alignment Replace spaces with tabs to align register value definitions, making it easier to add new entries and maintain consistent formatting. Also use a space between the type and field in struct csi2_dev. No functional change. Signed-off-by: Frank Li Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260116-stage-csi2-cleanup-v2-1-a56e9cb25196@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit e001b3b1cdd460eba59c7738dc43530d5781579b Author: Frank Li Date: Fri Jan 16 11:29:21 2026 -0500 media: nxp: use cleanup __free(fwnode_handle) simplify code Use cleanup __free(fwnode_handle) simplify code. No functional change. Signed-off-by: Frank Li Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260116-cam_cleanup-v4-3-29ce01640443@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 078161dd44d6f848a62a473206d69025607736ec Author: Frank Li Date: Fri Jan 16 11:29:20 2026 -0500 media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code Use devm_pm_runtime_enable() to simplify code. Change to use dev_err_probe() because previous goto change to return. No functional change. Signed-off-by: Frank Li Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260116-cam_cleanup-v4-2-29ce01640443@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 075282b2e68daffb6a49cb1eb6acc531a60ba74a Author: Frank Li Date: Fri Jan 16 11:29:19 2026 -0500 media: nxp: use dev_err_probe() to simplify code Use dev_err_probe() to simplify the code. Drop the explicit error message after returning from imx8mq_mipi_csi_parse_dt(), as the error is already reported by this helper. No functional change. Reviewed-by: Laurent Pinchart Reviewed-by: Alexander Stein Signed-off-by: Frank Li Link: https://patch.msgid.link/20260116-cam_cleanup-v4-1-29ce01640443@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 5a50f2b61104d0d351b59ec179f67abab7870453 Author: Rui Wang Date: Mon Jan 5 12:11:42 2026 -0500 media: rkisp1: Fix filter mode register configuration The rkisp1_flt_config() function performs an initial direct write to RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA bit, which clears the filter enable bit in the hardware. The subsequent read/modify/write sequence then reads back the register with the enable bit already cleared and cannot restore it, resulting in the filter being inadvertently disabled. Remove the redundant direct write. The read/modify/write sequence alone correctly preserves the existing enable bit state while updating the DNR mode and filter configuration bits. Signed-off-by: Rui Wang Reviewed-by: Stefan Klug Reviewed-by: Kieran Bingham Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit bb0365f4f3423ac54f892a28da6588da8a67dd42 Author: Rafael J. Wysocki Date: Mon Dec 22 21:01:55 2025 +0100 media: rkisp1: Discard pm_runtime_put() return value Printing error messages on pm_runtime_put() returning negative values is not particularly useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. Accordingly, update rkisp1_vb2_stop_streaming() to simply discard the return value of pm_runtime_put(). This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/2356323.iZASKD2KPV@rafael.j.wysocki Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 23e1bfeff47658698673a7211dec0ced2a1a0a00 Author: Laurent Pinchart Date: Mon Nov 3 01:44:38 2025 +0200 media: imx8-isi: Drop unneeded module alias The imx8-isi driver has a module alias named "ISI". This is not required, as there is no reason to load this module through an alias: the device is probed through OF, and the module has never been named "ISI". Drop the alias. Suggested-by: Johan Hovold Reviewed-by: Johan Hovold Reviewed-by: Frank Li Link: https://patch.msgid.link/20251102234438.8022-1-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit ae8694393e13f563209fad681e5bc1b99d558646 Author: Lad Prabhakar Date: Mon Nov 3 19:45:54 2025 +0000 media: dt-bindings: media: renesas,fcp: Allow three clocks for RZ/V2N SoC Update the FCP DT schema to permit three clock inputs for the RZ/V2N SoC. The FCP block on this SoC requires three separate clocks, unlike other variants which use only one. Fixes: f42eddf44fbf ("media: dt-bindings: media: renesas,fcp: Document RZ/V2N SoC") Signed-off-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Acked-by: Conor Dooley Link: https://patch.msgid.link/20251103194554.54313-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 05b56ef347495239da896f310c9d613e9bd1a015 Author: Xu Yang Date: Fri Jan 16 18:18:35 2026 +0800 phy: fsl-imx8mq-usb: enable RX Termination override This is to resolve the problem of wakeup system by USB3 device insertion if HSIOMIX on, in that case, the USB3 device detects RX term on so the USB3 device doesn't downgrade to high-speed, we can't expect CONN wakeup (for USB3) happen because the 24MHz OSC is required ON to trigger it. Because the device works at Super-speed so DP/DM wakeup can't happen either. Then the entire systen can't be waken up by such device attach event. With this override bit we can force the RX term off when enters system suspend, and disable the override after system resume. Therefore, the USB3 device will always downgrade to High-speed, then DP/DM wakeup can always happen. It will correctly switch to Super-speed later when the host reset it after the system resume back. Signed-off-by: Li Jun Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260116101835.1810675-1-xu.yang_2@nxp.com Signed-off-by: Vinod Koul commit debf8326a435ac746f48173e4742a574810f1ff4 Author: Xu Yang Date: Tue Jan 20 19:16:46 2026 +0800 phy: fsl-imx8mq-usb: set platform driver data Add missing platform_set_drvdata() as the data will be used in remove(). Fixes: b58f0f86fd61 ("phy: fsl-imx8mq-usb: add tca function driver for imx95") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260120111646.3159766-1-xu.yang_2@nxp.com Signed-off-by: Vinod Koul commit 27ee0869d77b2cb404770ac49bdceae3aedf658b Author: Xu Yang Date: Tue Jan 20 19:17:12 2026 +0800 phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature Disabling PHYs in runtime usually causes the client with external abort exception or similar issue due to lack of API to notify clients about PHY removal. This patch removes the possibility to unbind i.MX PHY drivers in runtime. Signed-off-by: Xu Yang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com Signed-off-by: Vinod Koul commit 1d5362145de96b5d00d590605cc94cdfa572b405 Author: Loic Poulain Date: Thu Dec 18 16:13:07 2025 +0100 drm/bridge: anx7625: Fix invalid EDID size DRM checks EDID block count against allocated size in drm_edid_valid function. We have to allocate the right EDID size instead of the max size to prevent the EDID to be reported as invalid. Cc: stable@kernel.org Fixes: 7c585f9a71aa ("drm/bridge: anx7625: use struct drm_edid more") Reviewed-by: Dmitry Baryshkov Signed-off-by: Loic Poulain Link: https://patch.msgid.link/20251218151307.95491-1-loic.poulain@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit dc0e3aa54eaa4fc6efa1cf4467a487ea52b94f01 Author: Sanjay Yadav Date: Thu Jan 8 17:02:30 2026 +0530 drm/tests/drm_buddy: Add tests for allocations exceeding max_order Add kunit tests that exercise edge cases where allocation requests exceed mm->max_order after rounding. This can happen with non-power-of-two VRAM sizes when the allocator rounds up requests. For example, with 10G VRAM (8G + 2G roots), mm->max_order represents the 8G block. A 9G allocation can round up to 16G in multiple ways: CONTIGUOUS allocation rounds to next power-of-two, or non-CONTIGUOUS with 8G min_block_size rounds to next alignment boundary. The test validates CONTIGUOUS and RANGE flag combinations, ensuring that only CONTIGUOUS-alone allocations use try_harder fallback, while other combinations return -EINVAL when rounded size exceeds memory, preventing BUG_ON assertions. Cc: Christian König Cc: Arunpravin Paneer Selvam Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Matthew Auld Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20260108113227.2101872-6-sanjay.kumar.yadav@intel.com commit 5488a29596cdba93a60a79398dc9b69d5bdadf92 Author: Sanjay Yadav Date: Thu Jan 8 17:02:29 2026 +0530 drm/buddy: Prevent BUG_ON by validating rounded allocation When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is rounded up to the next power-of-two via roundup_pow_of_two(). Similarly, for non-contiguous allocations with large min_block_size, the size is aligned up via round_up(). Both operations can produce a rounded size that exceeds mm->size, which later triggers BUG_ON(order > mm->max_order). Example scenarios: - 9G CONTIGUOUS allocation on 10G VRAM memory: roundup_pow_of_two(9G) = 16G > 10G - 9G allocation with 8G min_block_size on 10G VRAM memory: round_up(9G, 8G) = 16G > 10G Fix this by checking the rounded size against mm->size. For non-contiguous or range allocations where size > mm->size is invalid, return -EINVAL immediately. For contiguous allocations without range restrictions, allow the request to fall through to the existing __alloc_contig_try_harder() fallback. This ensures invalid user input returns an error or uses the fallback path instead of hitting BUG_ON. v2: (Matt A) - Add Fixes, Cc stable, and Closes tags for context Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6712 Fixes: 0a1844bf0b53 ("drm/buddy: Improve contiguous memory allocation") Cc: # v6.7+ Cc: Christian König Cc: Arunpravin Paneer Selvam Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Matthew Auld Reviewed-by: Arunpravin Paneer Selvam Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20260108113227.2101872-5-sanjay.kumar.yadav@intel.com commit ba335bf3a5b8c5f47d56e9be3f96e0989dad5346 Merge: 83c9030cdc45e0 4fca95095cdcd8 Author: Alexei Starovoitov Date: Tue Jan 20 20:39:01 2026 -0800 Merge branch 'bpf-x86-inline-bpf_get_current_task-for-x86_64' Menglong Dong says: ==================== bpf, x86: inline bpf_get_current_task() for x86_64 Inline bpf_get_current_task() and bpf_get_current_task_btf() for x86_64 to obtain better performance, and add the testcase for it. Changes since v5: * remove unnecessary 'ifdef' and __description in the selftests * v5: https://lore.kernel.org/bpf/20260119070246.249499-1-dongml2@chinatelecom.cn/ Changes since v4: * don't support the !CONFIG_SMP case * v4: https://lore.kernel.org/bpf/20260112104529.224645-1-dongml2@chinatelecom.cn/ Changes since v3: * handle the !CONFIG_SMP case * ignore the !CONFIG_SMP case in the testcase, as we enable CONFIG_SMP for x86_64 in the selftests Changes since v2: * implement it in the verifier with BPF_MOV64_PERCPU_REG() instead of in x86_64 JIT (Alexei). Changes since v1: * add the testcase * remove the usage of const_current_task ==================== Link: https://patch.msgid.link/20260120070555.233486-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 4fca95095cdcd81bd4a8c8c7008fb3c175a3a5d5 Author: Menglong Dong Date: Tue Jan 20 15:05:55 2026 +0800 selftests/bpf: test the jited inline of bpf_get_current_task Add the testcase for the jited inline of bpf_get_current_task(). Signed-off-by: Menglong Dong Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260120070555.233486-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit eaedea154eb96b2f4ba8ec8e4397dab10758a705 Author: Menglong Dong Date: Tue Jan 20 15:05:54 2026 +0800 bpf, x86: inline bpf_get_current_task() for x86_64 Inline bpf_get_current_task() and bpf_get_current_task_btf() for x86_64 to obtain better performance. Signed-off-by: Menglong Dong Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260120070555.233486-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit a4065662998fbee4a0ca9886b9aa50aa9694e0e7 Author: Andy Shevchenko Date: Tue Jan 20 14:12:31 2026 +0100 platform/chrome: cros_typec_switch: Use acpi_get_local_u64_address() Now we have a helper so there's no need to open-code. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20260120131413.1697891-3-andriy.shevchenko@linux.intel.com Signed-off-by: Tzung-Bi Shih commit e1adf48853bc715f4deea074932aa1c44eb7abea Author: Andy Shevchenko Date: Tue Jan 20 14:12:30 2026 +0100 platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev The 'dev' field in struct fwnode is special and related to device links, There no driver should use it for printing messages. Fix incorrect use of private field. Fixes: affc804c44c8 ("platform/chrome: cros_typec_switch: Add switch driver") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20260120131413.1697891-2-andriy.shevchenko@linux.intel.com Signed-off-by: Tzung-Bi Shih commit 06682206e2a1883354ed758c09efeb51f435adbd Author: Ludovic Desroches Date: Thu Nov 20 11:38:25 2025 +0100 drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts Don’t reject the commit when the source rectangle has fractional parts. This can occur due to scaling: drm_atomic_helper_check_plane_state() calls drm_rect_clip_scaled(), which may introduce fractional parts while computing the clipped source rectangle. This does not imply the commit is invalid, so we should accept it instead of discarding it. Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com Signed-off-by: Manikandan Muralidharan commit f34e19c34e4e92338d2ceaab2b95dd7790d262de Author: Minu Jin Date: Tue Nov 25 09:04:07 2025 +0900 fork-comment-fix: remove ambiguous question mark in CLONE_CHILD_CLEARTID comment The current comment "Clear TID on mm_release()?" ends with a question mark, implying uncertainty about whether the TID is actually cleared in mm_release(). However, the code flow is deterministic. When a task exits, mm_release() explicitly checks 'tsk->clear_child_tid' and clears. Since this behavior is unambiguous, remove the confusing question mark and rephrase the comment to clearly state that TID is cleared in mm_release(). Link: https://lkml.kernel.org/r/20251125000407.24470-1-s9430939@naver.com Signed-off-by: Minu Jin Cc: Ben Segall Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Cc: Oleg Nesterov Signed-off-by: Andrew Morton commit 3b07086444f80c844351255fd94c2cb0a7224df2 Author: Petr Mladek Date: Fri Nov 28 14:59:20 2025 +0100 kallsyms: prevent module removal when printing module name and buildid kallsyms_lookup_buildid() copies the symbol name into the given buffer so that it can be safely read anytime later. But it just copies pointers to mod->name and mod->build_id which might get reused after the related struct module gets removed. The lifetime of struct module is synchronized using RCU. Take the rcu read lock for the entire __sprint_symbol(). Link: https://lkml.kernel.org/r/20251128135920.217303-8-pmladek@suse.com Signed-off-by: Petr Mladek Reviewed-by: Aaron Tomlin Cc: Alexei Starovoitov Cc: Daniel Borkman Cc: Daniel Gomez Cc: John Fastabend Cc: Kees Cook Cc: Luis Chamberalin Cc: Marc Rutland Cc: "Masami Hiramatsu (Google)" Cc: Petr Pavlu Cc: Sami Tolvanen Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit e8a1e7eaa19d0b757b06a2f913e3eeb4b1c002c6 Author: Petr Mladek Date: Fri Nov 28 14:59:19 2025 +0100 kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() __sprint_symbol() might access an invalid pointer when kallsyms_lookup_buildid() returns a symbol found by ftrace_mod_address_lookup(). The ftrace lookup function must set both @modname and @modbuildid the same way as module_address_lookup(). Link: https://lkml.kernel.org/r/20251128135920.217303-7-pmladek@suse.com Fixes: 9294523e3768 ("module: add printk formats to add module build ID to stacktraces") Signed-off-by: Petr Mladek Reviewed-by: Aaron Tomlin Acked-by: Steven Rostedt (Google) Cc: Alexei Starovoitov Cc: Daniel Borkman Cc: Daniel Gomez Cc: John Fastabend Cc: Kees Cook Cc: Luis Chamberalin Cc: Marc Rutland Cc: "Masami Hiramatsu (Google)" Cc: Petr Pavlu Cc: Sami Tolvanen Signed-off-by: Andrew Morton commit cd6735896d0343942cf3dafb48ce32eb79341990 Author: Petr Mladek Date: Fri Nov 28 14:59:18 2025 +0100 kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() bpf_address_lookup() has been used only in kallsyms_lookup_buildid(). It was supposed to set @modname and @modbuildid when the symbol was in a module. But it always just cleared @modname because BPF symbols were never in a module. And it did not clear @modbuildid because the pointer was not passed. The wrapper is no longer needed. Both @modname and @modbuildid are now always initialized to NULL in kallsyms_lookup_buildid(). Remove the wrapper and rename __bpf_address_lookup() to bpf_address_lookup() because this variant is used everywhere. [akpm@linux-foundation.org: fix loongarch] Link: https://lkml.kernel.org/r/20251128135920.217303-6-pmladek@suse.com Fixes: 9294523e3768 ("module: add printk formats to add module build ID to stacktraces") Signed-off-by: Petr Mladek Acked-by: Alexei Starovoitov Cc: Aaron Tomlin Cc: Daniel Borkman Cc: Daniel Gomez Cc: John Fastabend Cc: Kees Cook Cc: Luis Chamberalin Cc: Marc Rutland Cc: "Masami Hiramatsu (Google)" Cc: Petr Pavlu Cc: Sami Tolvanen Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 8e81dac4cd5477731169b92cff7c24f8f6635950 Author: Petr Mladek Date: Fri Nov 28 14:59:17 2025 +0100 kallsyms: cleanup code for appending the module buildid Put the code for appending the optional "buildid" into a helper function, It makes __sprint_symbol() better readable. Also print a warning when the "modname" is set and the "buildid" isn't. It might catch a situation when some lookup function in kallsyms_lookup_buildid() does not handle the "buildid". Use pr_*_once() to avoid an infinite recursion when the function is called from printk(). The recursion is rather theoretical but better be on the safe side. Link: https://lkml.kernel.org/r/20251128135920.217303-5-pmladek@suse.com Signed-off-by: Petr Mladek Cc: Aaron Tomlin Cc: Alexei Starovoitov Cc: Daniel Borkman Cc: Daniel Gomez Cc: John Fastabend Cc: Kees Cook Cc: Luis Chamberalin Cc: Marc Rutland Cc: "Masami Hiramatsu (Google)" Cc: Petr Pavlu Cc: Sami Tolvanen Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit acfdbb4ab2910ff6f03becb569c23ac7b2223913 Author: Petr Mladek Date: Fri Nov 28 14:59:16 2025 +0100 module: add helper function for reading module_buildid() Add a helper function for reading the optional "build_id" member of struct module. It is going to be used also in ftrace_mod_address_lookup(). Use "#ifdef" instead of "#if IS_ENABLED()" to match the declaration of the optional field in struct module. Link: https://lkml.kernel.org/r/20251128135920.217303-4-pmladek@suse.com Signed-off-by: Petr Mladek Reviewed-by: Daniel Gomez Reviewed-by: Petr Pavlu Cc: Aaron Tomlin Cc: Alexei Starovoitov Cc: Daniel Borkman Cc: John Fastabend Cc: Kees Cook Cc: Luis Chamberalin Cc: Marc Rutland Cc: "Masami Hiramatsu (Google)" Cc: Sami Tolvanen Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit fda024fb64769e9d6b3916d013c78d6b189129f8 Author: Petr Mladek Date: Fri Nov 28 14:59:15 2025 +0100 kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() The @modname and @modbuildid optional return parameters are set only when the symbol is in a module. Always initialize them so that they do not need to be cleared when the module is not in a module. It simplifies the logic and makes the code even slightly more safe. Note that bpf_address_lookup() function will get updated in a separate patch. Link: https://lkml.kernel.org/r/20251128135920.217303-3-pmladek@suse.com Signed-off-by: Petr Mladek Cc: Aaron Tomlin Cc: Alexei Starovoitov Cc: Daniel Borkman Cc: Daniel Gomez Cc: John Fastabend Cc: Kees Cook Cc: Luis Chamberalin Cc: Marc Rutland Cc: "Masami Hiramatsu (Google)" Cc: Petr Pavlu Cc: Sami Tolvanen Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 426295ef18c5d5f0b7f75ac89d09022fcfafd25c Author: Petr Mladek Date: Fri Nov 28 14:59:14 2025 +0100 kallsyms: clean up @namebuf initialization in kallsyms_lookup_buildid() Patch series "kallsyms: Prevent invalid access when showing module buildid", v3. We have seen nested crashes in __sprint_symbol(), see below. They seem to be caused by an invalid pointer to "buildid". This patchset cleans up kallsyms code related to module buildid and fixes this invalid access when printing backtraces. I made an audit of __sprint_symbol() and found several situations when the buildid might be wrong: + bpf_address_lookup() does not set @modbuildid + ftrace_mod_address_lookup() does not set @modbuildid + __sprint_symbol() does not take rcu_read_lock and the related struct module might get removed before mod->build_id is printed. This patchset solves these problems: + 1st, 2nd patches are preparatory + 3rd, 4th, 6th patches fix the above problems + 5th patch cleans up a suspicious initialization code. This is the backtrace, we have seen. But it is not really important. The problems fixed by the patchset are obvious: crash64> bt [62/2029] PID: 136151 TASK: ffff9f6c981d4000 CPU: 367 COMMAND: "btrfs" #0 [ffffbdb687635c28] machine_kexec at ffffffffb4c845b3 #1 [ffffbdb687635c80] __crash_kexec at ffffffffb4d86a6a #2 [ffffbdb687635d08] hex_string at ffffffffb51b3b61 #3 [ffffbdb687635d40] crash_kexec at ffffffffb4d87964 #4 [ffffbdb687635d50] oops_end at ffffffffb4c41fc8 #5 [ffffbdb687635d70] do_trap at ffffffffb4c3e49a #6 [ffffbdb687635db8] do_error_trap at ffffffffb4c3e6a4 #7 [ffffbdb687635df8] exc_stack_segment at ffffffffb5666b33 #8 [ffffbdb687635e20] asm_exc_stack_segment at ffffffffb5800cf9 ... This patch (of 7) The function kallsyms_lookup_buildid() initializes the given @namebuf by clearing the first and the last byte. It is not clear why. The 1st byte makes sense because some callers ignore the return code and expect that the buffer contains a valid string, for example: - function_stat_show() - kallsyms_lookup() - kallsyms_lookup_buildid() The initialization of the last byte does not make much sense because it can later be overwritten. Fortunately, it seems that all called functions behave correctly: - kallsyms_expand_symbol() explicitly adds the trailing '\0' at the end of the function. - All *__address_lookup() functions either use the safe strscpy() or they do not touch the buffer at all. Document the reason for clearing the first byte. And remove the useless initialization of the last byte. Link: https://lkml.kernel.org/r/20251128135920.217303-2-pmladek@suse.com Signed-off-by: Petr Mladek Reviewed-by: Aaron Tomlin Cc: Alexei Starovoitov Cc: Daniel Borkman Cc: John Fastabend Cc: Kees Cook Cc: Luis Chamberalin Cc: Marc Rutland Cc: "Masami Hiramatsu (Google)" Cc: Petr Pavlu Cc: Sami Tolvanen Cc: Steven Rostedt Cc: Daniel Gomez Signed-off-by: Andrew Morton commit 7c5b0f6a9ff5041ea6f4213c9827170c60a376f0 Author: Kevin Hao Date: Wed Dec 17 12:23:27 2025 +0800 .editorconfig: respect .editorconfig settings from parent directories Setting 'root' to 'true' prevents the editor from searching for other .editorconfig files in parent directories. However, a common workflow involves generating a patch with 'git format-patch' and opening it in an editor within the kernel source directory. In such cases, we want any specific settings for patch files defined in an .editorconfig located above the kernel source directory to remain effective. Therefore, remove the 'root' setting from the kernel .editorconfig. Link: https://lkml.kernel.org/r/20251217-editconfig-v1-1-883e6dd6dbfa@gmail.com Signed-off-by: Kevin Hao Cc: Íñigo Huguet Cc: Danny Lin Cc: Mickaël Salaün Cc: Masahiro Yamada Signed-off-by: Andrew Morton commit b8f690f6d1d9008ffab1f58fffc769ba813da373 Author: Lalit Shankar Chowdhury Date: Tue Dec 2 03:14:04 2025 +0530 fat: remove unused parameter Remove unused inode parameter from fat_cache_alloc(). Link: https://lkml.kernel.org/r/20251201214403.90604-2-lalitshankarch@gmail.com Signed-off-by: Lalit Shankar Chowdhury Acked-by: OGAWA Hirofumi Cc: Christian Brauner Signed-off-by: Andrew Morton commit e700f5d1560798aacf0e56fdcc70ee2c20bf56ec Author: Li RongQing Date: Tue Dec 16 02:45:21 2025 -0500 watchdog: softlockup: panic when lockup duration exceeds N thresholds The softlockup_panic sysctl is currently a binary option: panic immediately or never panic on soft lockups. Panicking on any soft lockup, regardless of duration, can be overly aggressive for brief stalls that may be caused by legitimate operations. Conversely, never panicking may allow severe system hangs to persist undetected. Extend softlockup_panic to accept an integer threshold, allowing the kernel to panic only when the normalized lockup duration exceeds N watchdog threshold periods. This provides finer-grained control to distinguish between transient delays and persistent system failures. The accepted values are: - 0: Don't panic (unchanged) - 1: Panic when duration >= 1 * threshold (20s default, original behavior) - N > 1: Panic when duration >= N * threshold (e.g., 2 = 40s, 3 = 60s.) The original behavior is preserved for values 0 and 1, maintaining full backward compatibility while allowing systems to tolerate brief lockups while still catching severe, persistent hangs. [lirongqing@baidu.com: v2] Link: https://lkml.kernel.org/r/20251218074300.4080-1-lirongqing@baidu.com Link: https://lkml.kernel.org/r/20251216074521.2796-1-lirongqing@baidu.com Signed-off-by: Li RongQing Cc: Eduard Zingerman Cc: Hao Luo Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Lance Yang Cc: Martin KaFai Lau Cc: Nicholas Piggin Cc: Song Liu Cc: Stanislav Fomichev Cc: Yonghong Song Signed-off-by: Andrew Morton commit b5bfcc1ffe512c7879cb90befdeabaa43d9f07ca Author: Pnina Feder Date: Tue Dec 16 15:28:01 2025 +0200 kernel/crash: handle multi-page vmcoreinfo in crash kernel copy kimage_crash_copy_vmcoreinfo() currently assumes vmcoreinfo fits in a single page. This breaks if VMCOREINFO_BYTES exceeds PAGE_SIZE. Allocate the required order of control pages and vmap all pages needed to safely copy vmcoreinfo into the crash kernel image. Link: https://lkml.kernel.org/r/20251216132801.807260-3-pnina.feder@mobileye.com Signed-off-by: Pnina Feder Reviewed-by: Andrew Morton Cc: Baoquan He Cc: Dave Young Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 76103d1b268e6f45735aa92d70bea5b5e8174a70 Author: Pnina Feder Date: Tue Dec 16 15:28:00 2025 +0200 kernel: vmcoreinfo: allocate vmcoreinfo_data based on VMCOREINFO_BYTES Patch series "vmcoreinfo: support VMCOREINFO_BYTES larger than PAGE_SIZE". VMCOREINFO_BYTES is defined as a configurable size, but multiple code paths implicitly assume it always fits into a single page. This series removes that assumption by allocating and mapping vmcoreinfo based on its actual size. Patch 1 updates vmcoreinfo allocation to use get_order(VMCOREINFO_BYTES). Patch 2 updates crash kernel handling to correctly allocate and map multiple pages when copying vmcoreinfo. This makes vmcoreinfo size consistent across the kernel and avoids future breakage if VMCOREINFO_BYTES grows. (No functional change when VMCOREINFO_BYTES == PAGE_SIZE.) This patch (of 2): VMCOREINFO_BYTES defines the size of vmcoreinfo data, but the current implementation assumes a single page allocation. Allocate vmcoreinfo_data using get_order(VMCOREINFO_BYTES) so that vmcoreinfo can safely grow beyond PAGE_SIZE. This avoids hidden assumptions and keeps vmcoreinfo size consistent across the kernel. Link: https://lkml.kernel.org/r/20251216132801.807260-1-pnina.feder@mobileye.com Link: https://lkml.kernel.org/r/20251216132801.807260-2-pnina.feder@mobileye.com Signed-off-by: Pnina Feder Reviewed-by: Andrew Morton Cc: Baoquan He Cc: Dave Young Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 61e9210e23921cf1176af23b426b9bad8b08ffff Author: Alejandro Colomar Date: Thu Dec 11 11:44:04 2025 +0100 mm: use ARRAY_END() instead of open-coding it There aren't any bugs in this code; it's purely cosmetic. By using ARRAY_END(), we prevent future issues, in case the code is modified; it has less moving parts. Also, it should be more readable (and perhaps more importantly, greppable), as there are several ways of writing an expression that gets the end of an array, which are unified by this API name. Link: https://lkml.kernel.org/r/2335917d123891fec074ab1b3acfb517cf14b5a7.1765449750.git.alx@kernel.org Signed-off-by: Alejandro Colomar Cc: Kees Cook Cc: Linus Torvalds Cc: Alexander Potapenko Cc: Al Viro Cc: Christopher Bazley Cc: Dmitriy Vyukov Cc: Jann Horn Cc: Maciej W. Rozycki Cc: Marco Elver Cc: Michal Hocko Cc: Rasmus Villemoes Signed-off-by: Andrew Morton commit a9e5620c9a9e237b3344702dec0839b89159a060 Author: Alejandro Colomar Date: Thu Dec 11 11:44:00 2025 +0100 kernel: fix off-by-one benign bugs We were wasting a byte due to an off-by-one bug. s[c]nprintf() doesn't write more than $2 bytes including the null byte, so trying to pass 'size-1' there is wasting one byte. This is essentially the same as the previous commit, in a different file. Link: https://lkml.kernel.org/r/b4a945a4d40b7104364244f616eb9fb9f1fa691f.1765449750.git.alx@kernel.org Signed-off-by: Alejandro Colomar Cc: Marco Elver Cc: Kees Cook Cc: Christopher Bazley Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Jann Horn Cc: Linus Torvalds Cc: Rasmus Villemoes Cc: Marco Elver Cc: Michal Hocko Cc: Al Viro Cc: Maciej W. Rozycki Signed-off-by: Andrew Morton commit 8118f197b7b738285eb4b66a80d01a5c8f35e231 Author: Alejandro Colomar Date: Thu Dec 11 11:43:54 2025 +0100 mm: fix benign off-by-one bugs We were wasting a byte due to an off-by-one bug. s[c]nprintf() doesn't write more than $2 bytes including the null byte, so trying to pass 'size-1' there is wasting one byte. Link: https://lkml.kernel.org/r/9c38dd009c17b0219889c7089d9bdde5aaf28a8e.1765449750.git.alx@kernel.org Signed-off-by: Alejandro Colomar Acked-by: Marco Elver Cc: Kees Cook Cc: Christopher Bazley Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Jann Horn Cc: Linus Torvalds Cc: Rasmus Villemoes Cc: Michal Hocko Cc: Al Viro Cc: Maciej W. Rozycki Signed-off-by: Andrew Morton commit 436debc9cad892576d4f3287446b64474922764c Author: Alejandro Colomar Date: Thu Dec 11 11:43:49 2025 +0100 array_size.h: add ARRAY_END() Patch series "Add ARRAY_END(), and use it to fix off-by-one bugs", v6. Add ARRAY_END(), and use it to fix off-by-one bugs ARRAY_END() is a macro to calculate a pointer to one past the last element of an array argument. This is a very common pointer, which is used to iterate over all elements of an array: for (T *p = a; p < ARRAY_END(a); p++) ... Of course, this pointer should never be dereferenced. A pointer one past the last element of an array should not be dereferenced; it's perfectly fine to hold such a pointer --and a good thing to do--, but the only thing it should be used for is comparing it with other pointers derived from the same array. Due to how special these pointers are, it would be good to use consistent naming. It's common to name such a pointer 'end' --in fact, we have many such cases in the kernel--. C++ even standardized this name with std::end(). Let's try naming such pointers 'end', and try also avoid using 'end' for pointers that are not the result of ARRAY_END(). It has been incorrectly suggested that these pointers are dangerous, and that they should never be used, suggesting to use something like #define ARRAY_LAST(a) ((a) + ARRAY_SIZE(a) - 1) for (T *p = a; p <= ARRAY_LAST(a); p++) ... This is bogus, as it doesn't scale down to arrays of 0 elements. In the case of an array of 0 elements, ARRAY_LAST() would underflow the pointer, which not only it can't be dereferenced, it can't even be held (it produces Undefined Behavior). That would be a footgun. Such arrays don't exist per the ISO C standard; however, GCC supports them as an extension (with partial support, though; GCC has a few bugs which need to be fixed). This patch set fixes a few places where it was intended to use the array end (that is, one past the last element), but accidentally a pointer to the last element was used instead, thus wasting one byte. It also replaces other places where the array end was correctly calculated with ARRAY_SIZE(), by using the simpler ARRAY_END(). Also, there was one drivers/ file that already defined this macro. We remove that definition, to not conflict with this one. This patch (of 4): ARRAY_END() returns a pointer one past the end of the last element in the array argument. This pointer is useful for iterating over the elements of an array: for (T *p = a, p < ARRAY_END(a); p++) ... Link: https://lkml.kernel.org/r/cover.1765449750.git.alx@kernel.org Link: https://lkml.kernel.org/r/5973cfb674192bc8e533485dbfb54e3062896be1.1765449750.git.alx@kernel.org Signed-off-by: Alejandro Colomar Cc: Kees Cook Cc: Christopher Bazley Cc: Rasmus Villemoes Cc: Marco Elver Cc: Michal Hocko Cc: Linus Torvalds Cc: Al Viro Cc: Alexander Potapenko Cc: Dmitriy Vyukov Cc: Jann Horn Cc: Maciej W. Rozycki Signed-off-by: Andrew Morton commit 24c776355f4097316a763005434ffff716aa21a8 Author: Randy Dunlap Date: Sun Dec 14 16:51:56 2025 -0800 kernel.h: drop hex.h and update all hex.h users Remove from and update all users/callers of hex.h interfaces to directly #include as part of the process of putting kernel.h on a diet. Removing hex.h from kernel.h means that 36K C source files don't have to pay the price of parsing hex.h for the roughly 120 C source files that need it. This change has been build-tested with allmodconfig on most ARCHes. Also, all users/callers of in the entire source tree have been updated if needed (if not already #included). Link: https://lkml.kernel.org/r/20251215005206.2362276-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Reviewed-by: Andy Shevchenko Cc: Ingo Molnar Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton commit 6dcd539f062d89127cb3a84a7da373a9bd28ba7b Author: Ryota Sakamoto Date: Mon Dec 15 13:43:22 2025 +0000 lib/tests: convert test_uuid module to KUnit Move lib/test_uuid.c to lib/tests/uuid_kunit.c and convert it to use KUnit. This change switches the ad-hoc test code to standard KUnit test cases. The test data remains the same, but the verification logic is updated to use KUNIT_EXPECT_* macros. Also remove CONFIG_TEST_UUID from arch/*/configs/* because it is no longer used. The new CONFIG_UUID_KUNIT_TEST will be automatically enabled by CONFIG_KUNIT_ALL_TESTS. [lukas.bulwahn@redhat.com: MAINTAINERS: adjust file entry in UUID HELPERS] Link: https://lkml.kernel.org/r/20251217053907.2778515-1-lukas.bulwahn@redhat.com Link: https://lkml.kernel.org/r/20251215134322.12949-1-sakamo.ryota@gmail.com Signed-off-by: Ryota Sakamoto Signed-off-by: Lukas Bulwahn Acked-by: Geert Uytterhoeven Reviewed-by: David Gow Cc: Andriy Shevchenko Cc: Brendan Higgins Cc: Lukas Bulwahn Signed-off-by: Andrew Morton commit 29300f929eb1f9b3e555b834d05f2e9d73da303f Author: Dmitry Antipov Date: Tue Oct 21 13:55:18 2025 +0300 ocfs2: annotate more flexible array members with __counted_by_le() Annotate flexible array members of 'struct ocfs2_local_alloc' and 'struct ocfs2_inline_data' with '__counted_by_le()' attribute to improve array bounds checking when CONFIG_UBSAN_BOUNDS is enabled, and prefer the convenient 'memset()' over an explicit loop to simplify 'ocfs2_clear_local_alloc()'. Link: https://lkml.kernel.org/r/20251021105518.119953-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reviewed-by: Heming Zhao Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit e0b0f2834c9bec51b1068de5cf5e10c7519143eb Author: Edward Adam Davis Date: Fri Dec 19 16:31:52 2025 +0800 ocfs2: fix oob in __ocfs2_find_path syzbot constructed a corrupted image, which resulted in el->l_count from the b-tree extent block being 0. Since the length of the l_recs array depends on l_count, reading its member e_blkno triggered the out-of-bounds access reported by syzbot in [1]. The loop terminates when l_count is 0, similar to when next_free is 0. [1] UBSAN: array-index-out-of-bounds in fs/ocfs2/alloc.c:1838:11 index 0 is out of range for type 'struct ocfs2_extent_rec[] __counted_by(l_count)' (aka 'struct ocfs2_extent_rec[]') Call Trace: __ocfs2_find_path+0x606/0xa40 fs/ocfs2/alloc.c:1838 ocfs2_find_leaf+0xab/0x1c0 fs/ocfs2/alloc.c:1946 ocfs2_get_clusters_nocache+0x172/0xc60 fs/ocfs2/extent_map.c:418 ocfs2_get_clusters+0x505/0xa70 fs/ocfs2/extent_map.c:631 ocfs2_extent_map_get_blocks+0x202/0x6a0 fs/ocfs2/extent_map.c:678 ocfs2_read_virt_blocks+0x286/0x930 fs/ocfs2/extent_map.c:1001 ocfs2_read_dir_block fs/ocfs2/dir.c:521 [inline] ocfs2_find_entry_el fs/ocfs2/dir.c:728 [inline] ocfs2_find_entry+0x3e4/0x2090 fs/ocfs2/dir.c:1120 ocfs2_find_files_on_disk+0xdf/0x310 fs/ocfs2/dir.c:2023 ocfs2_lookup_ino_from_name+0x52/0x100 fs/ocfs2/dir.c:2045 _ocfs2_get_system_file_inode fs/ocfs2/sysfile.c:136 [inline] ocfs2_get_system_file_inode+0x326/0x770 fs/ocfs2/sysfile.c:112 ocfs2_init_global_system_inodes+0x319/0x660 fs/ocfs2/super.c:461 ocfs2_initialize_super fs/ocfs2/super.c:2196 [inline] ocfs2_fill_super+0x4432/0x65b0 fs/ocfs2/super.c:993 get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1691 vfs_get_tree+0x92/0x2a0 fs/super.c:1751 fc_mount fs/namespace.c:1199 [inline] Link: https://lkml.kernel.org/r/tencent_4D99464FA28D9225BE0DBA923F5DF6DD8C07@qq.com Signed-off-by: Edward Adam Davis Reported-by: syzbot+151afab124dfbc5f15e6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=151afab124dfbc5f15e6 Reviewed-by: Heming Zhao Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 4e9f69c062150566de5870536f08a50239724537 Author: Prithvi Tambewagh Date: Tue Dec 16 00:15:57 2025 +0530 ocfs2: add validate function for slot map blocks When the filesystem is being mounted, the kernel panics while the data regarding slot map allocation to the local node, is being written to the disk. This occurs because the value of slot map buffer head block number, which should have been greater than or equal to `OCFS2_SUPER_BLOCK_BLKNO` (evaluating to 2) is less than it, indicative of disk metadata corruption. This triggers BUG_ON(bh->b_blocknr < OCFS2_SUPER_BLOCK_BLKNO) in ocfs2_write_block(), causing the kernel to panic. This is fixed by introducing function ocfs2_validate_slot_map_block() to validate slot map blocks. It first checks if the buffer head passed to it is up to date and valid, else it panics the kernel at that point itself. Further, it contains an if condition block, which checks if `bh->b_blocknr` is lesser than `OCFS2_SUPER_BLOCK_BLKNO`; if yes, then ocfs2_error is called, which prints the error log, for debugging purposes, and the return value of ocfs2_error() is returned. If the if condition is false, value 0 is returned by ocfs2_validate_slot_map_block(). This function is used as validate function in calls to ocfs2_read_blocks() in ocfs2_refresh_slot_info() and ocfs2_map_slot_buffers(). Link: https://lkml.kernel.org/r/20251215184600.13147-1-activprithvi@gmail.com Signed-off-by: Prithvi Tambewagh Reported-by: syzbot+c818e5c4559444f88aa0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c818e5c4559444f88aa0 Tested-by: Reviewed-by: Heming Zhao Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit d3cd8de2e17e496e115f36faeccad7d219edd381 Author: Dmitry Antipov Date: Thu Dec 11 18:59:49 2025 +0300 ocfs2: adjust ocfs2_xa_remove_entry() to match UBSAN boundary checks After introducing 2f26f58df041 ("ocfs2: annotate flexible array members with __counted_by_le()"), syzbot has reported the following issue: UBSAN: array-index-out-of-bounds in fs/ocfs2/xattr.c:1955:3 index 2 is out of range for type 'struct ocfs2_xattr_entry[] __counted_by(xh_count)' (aka 'struct ocfs2_xattr_entry[]') ... Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x40 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:455 ocfs2_xa_remove_entry+0x36d/0x3e0 fs/ocfs2/xattr.c:1955 ... To address this issue, 'xh_entries[]' member removal should be performed before actually changing 'xh_count', thus making sure that all array accesses matches the boundary checks performed by UBSAN. Link: https://lkml.kernel.org/r/20251211155949.774485-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reported-by: syzbot+cf96bc82a588a27346a8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cf96bc82a588a27346a8 Reviewed-by: Heming Zhao Acked-by: Joseph Qi Cc: Deepanshu Kartikey Cc: Joel Becker Cc: Mark Fasheh Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 1524af3685b35feac76662cc551cbc37bd14775f Author: Deepanshu Kartikey Date: Fri Dec 12 10:51:32 2025 +0530 ocfs2: validate inline data i_size during inode read When reading an inode from disk, ocfs2_validate_inode_block() performs various sanity checks but does not validate the size of inline data. If the filesystem is corrupted, an inode's i_size can exceed the actual inline data capacity (id_count). This causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data buffer, triggering a use-after-free when accessing directory entries from freed memory. In the syzbot report: - i_size was 1099511627576 bytes (~1TB) - Actual inline data capacity (id_count) is typically <256 bytes - A garbage rec_len (54648) caused ctx->pos to jump out of bounds - This triggered a UAF in ocfs2_check_dir_entry() Fix by adding a validation check in ocfs2_validate_inode_block() to ensure inodes with inline data have i_size <= id_count. This catches the corruption early during inode read and prevents all downstream code from operating on invalid data. Link: https://lkml.kernel.org/r/20251212052132.16750-1-kartikey406@gmail.com Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+c897823f699449cc3eb4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c897823f699449cc3eb4 Tested-by: syzbot+c897823f699449cc3eb4@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/20251211115231.3560028-1-kartikey406@gmail.com/T/ [v1] Link: https://lore.kernel.org/all/20251212040400.6377-1-kartikey406@gmail.com/T/ [v2] Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 688dab01c3bb14cb559878aaf7019bfba4a79275 Author: Deepanshu Kartikey Date: Fri Dec 12 11:28:26 2025 +0530 ocfs2: validate i_refcount_loc when refcount flag is set Add validation in ocfs2_validate_inode_block() to check that if an inode has OCFS2_HAS_REFCOUNT_FL set, it must also have a valid i_refcount_loc. A corrupted filesystem image can have this inconsistent state, which later triggers a BUG_ON in ocfs2_remove_refcount_tree() when the inode is being wiped during unlink. Catch this corruption early during inode validation to fail gracefully instead of crashing the kernel. Link: https://lkml.kernel.org/r/20251212055826.20929-1-kartikey406@gmail.com Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+6d832e79d3efe1c46743@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6d832e79d3efe1c46743 Tested-by: syzbot+6d832e79d3efe1c46743@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/20251208084407.3021466-1-kartikey406@gmail.com/T/ [v1] Link: https://lore.kernel.org/all/20251212045646.9988-1-kartikey406@gmail.com/T/ [v2] Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 9677a51abd860aa75bd4fe28176672744bf5180e Author: Christophe JAILLET Date: Sun Dec 14 11:41:35 2025 +0100 ocfs2: constify struct configfs_item_operations and configfs_group_operations 'struct configfs_item_operations' and 'configfs_group_operations' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 74011 19312 5280 98603 1812b fs/ocfs2/cluster/heartbeat.o After: ===== text data bss dec hex filename 74171 19152 5280 98603 1812b fs/ocfs2/cluster/heartbeat.o Link: https://lkml.kernel.org/r/7c7c00ba328e5e514d8debee698154039e9640dd.1765708880.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit fd4d53bde9128bc85d85cc3427bd592e4c3293e4 Author: Heming Zhao Date: Fri Dec 12 15:45:04 2025 +0800 ocfs2: detect released suballocator BG for fh_to_[dentry|parent] After ocfs2 gained the ability to reclaim suballocator free block group (BGs), a suballocator block group may be released. This change causes the xfstest case generic/426 to fail. generic/426 expects return value -ENOENT or -ESTALE, but the current code triggers -EROFS. Call stack before ocfs2 gained the ability to reclaim bg: ocfs2_fh_to_dentry //or ocfs2_fh_to_parent ocfs2_get_dentry + ocfs2_test_inode_bit | ocfs2_test_suballoc_bit | + ocfs2_read_group_descriptor //Since ocfs2 never releases the bg, | | //the bg block was always found. | + *res = ocfs2_test_bit //unlink was called, and the bit is zero | + if (!set) //because the above *res is 0 status = -ESTALE //the generic/426 expected return value Current call stack that triggers -EROFS: ocfs2_get_dentry ocfs2_test_inode_bit ocfs2_test_suballoc_bit ocfs2_read_group_descriptor + if reading a released bg, validation fails and triggers -EROFS How to fix: Since the read BG is already released, we must avoid triggering -EROFS. With this commit, we use ocfs2_read_hint_group_descriptor() to detect the released BG block. This approach quietly handles this type of error and returns -EINVAL, which triggers the caller's existing conversion path to -ESTALE. [dan.carpenter@linaro.org: fix uninitialized variable] Link: https://lkml.kernel.org/r/dc37519fd2470909f8c65e26c5131b8b6dde2a5c.1766043917.git.dan.carpenter@linaro.org Link: https://lkml.kernel.org/r/20251212074505.25962-3-heming.zhao@suse.com Signed-off-by: Heming Zhao Signed-off-by: Dan Carpenter Reviewed-by: Su Yue Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 4a54331616b309934d46e255a9f1fdd890e77ebe Author: Heming Zhao Date: Fri Dec 12 15:45:03 2025 +0800 ocfs2: give ocfs2 the ability to reclaim suballocator free bg Patch series "ocfs2: give ocfs2 the ability to reclaim suballocator free bg", v6. This patch (of 2): The current ocfs2 code can't reclaim suballocator block group space. In some cases, this causes ocfs2 to hold onto a lot of space. For example, when creating lots of small files, the space is held/managed by the '//inode_alloc'. After the user deletes all the small files, the space never returns to the '//global_bitmap'. This issue prevents ocfs2 from providing the needed space even when there is enough free space in a small ocfs2 volume. This patch gives ocfs2 the ability to reclaim suballocator free space when the block group is freed. For performance reasons, this patch keeps the first suballocator block group active. Link: https://lkml.kernel.org/r/20251212074505.25962-2-heming.zhao@suse.com Signed-off-by: Heming Zhao Reviewed-by: Su Yue Reviewed-by: Joseph Qi Cc: Changwei Ge Cc: Joel Becker Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton commit b11052be3ea7c1dfc81804b203bc4369edafd040 Author: Christophe JAILLET Date: Sun Dec 14 18:57:30 2025 +0100 crash_dump: constify struct configfs_item_operations and configfs_group_operations 'struct configfs_item_operations' and 'configfs_group_operations' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 16339 11001 384 27724 6c4c kernel/crash_dump_dm_crypt.o After: ===== text data bss dec hex filename 16499 10841 384 27724 6c4c kernel/crash_dump_dm_crypt.o Link: https://lkml.kernel.org/r/d046ee5666d2f6b1a48ca1a222dfbd2f7c44462f.1765735035.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET Reviewed-by: Coiby Xu Tested-by: Coiby Xu Cc: Baoquan He Cc: Dave Young Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 0319227099dfa06157b7cd669072b6e899d1bba8 Author: James Bottomley Date: Tue Nov 25 13:19:56 2025 -0500 oid_registry: allow arbitrary size OIDs The current OID registry parser uses 64 bit arithmetic which limits us to supporting 64 bit or smaller OIDs. This isn't usually a problem except that it prevents us from representing the 2.25. prefix OIDs which are the OID representation of UUIDs and have a 128 bit number following the prefix. Rather than import not often used perl arithmetic modules, replace the current perl 64 bit arithmetic with a callout to bc, which is arbitrary precision, for decimal to base 2 conversion, then do pure string operations on the base 2 number. [James.Bottomley@HansenPartnership.com: tidy up perl with better my placement also set bc to arbitrary size] Link: https://lkml.kernel.org/r/dbc90c344c691ed988640a28367ff895b5ef2604.camel@HansenPartnership.com Link: https://lkml.kernel.org/r/833c858cd74533203b43180208734b84f1137af0.camel@HansenPartnership.com Signed-off-by: James Bottomley Cc: David Howells Cc: Blaise Boscaccy Signed-off-by: Andrew Morton commit f9b74c13b773b7c7e4920d7bc214ea3d5f37b422 Author: Wei Yang Date: Wed Dec 31 03:00:26 2025 +0000 mm/mmu_gather: remove @delay_remap of __tlb_remove_page_size() __tlb_remove_page_size() is only used in tlb_remove_page_size() with @delay_remap set to false and it is passed directly to __tlb_remove_folio_pages_size(). Remove @delay_remap of __tlb_remove_page_size() and call __tlb_remove_folio_pages_size() with false @delay_remap. Link: https://lkml.kernel.org/r/20251231030026.15938-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: SeongJae Park Acked-by: David Hildenbrand (Red Hat) Acked-by: Will Deacon Acked-by: Heiko Carstens # s390 Cc: Alexander Gordeev Cc: "Aneesh Kumar K.V" Cc: Arnd Bergmann Cc: Christian Borntraeger Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Sven Schnelle Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit 29ec27805f55122252c3973e4edae82676cc737d Author: Dipendra Khadka Date: Sun Dec 28 15:44:55 2025 +0000 mm/oom_kill: remove unnecessary integer promotion in format string The 'h' length modifier in '%hd' is unnecessary as short integers are promoted to int in variadic functions. Use '%d' instead. Checkpatch flags the 'h' modifier as unnecessary for this reason, and many other subsystems have moved to using %d for promoted types. Hence, I think this patch aligns with kernel coding practices. Link: https://lkml.kernel.org/r/20251228154456.2386-1-kdipendra88@gmail.com Signed-off-by: Dipendra Khadka Acked-by: David Rientjes Acked-by: Michal Hocko Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 860996495f989fd86b7f1525d7500a6e15986a24 Author: Shu Anzai Date: Wed Dec 24 04:22:00 2025 +0000 mm/damon/tests/core-kunit: remove a redundant test case and add a new test case in damos_test_commit_quota_goal() Remove a redundant test case from damos_test_commit_quota_goal() as it is already covered. Instead, add a new test for DAMOS_QUOTA_SOME_MEM_PSI_US, which was previously not tested. Link: https://lkml.kernel.org/r/20251224042200.2061847-6-shu17az@gmail.com Signed-off-by: Shu Anzai Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 2caf45764a4fdb5d35524e364c963bb9e2d07fce Author: Shu Anzai Date: Wed Dec 24 04:21:59 2025 +0000 mm/damon/tests/core-kunit: add test cases for multiple regions in damon_test_split_regions_of() Extend damon_test_split_regions_of() to verify that it correctly handles multiple regions with various 'min_sz_region'. [sj@kernel.org: remove braces in damon_test_split_regions_of()] Link: https://lkml.kernel.org/r/20251224153125.69194-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251224042200.2061847-5-shu17az@gmail.com Signed-off-by: Shu Anzai Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 65a17a3e609f63c7ea2887096dc232a6c05d02a2 Author: Shu Anzai Date: Wed Dec 24 04:21:58 2025 +0000 mm/damon/tests/core-kunit: add a test case for region merge size limit in damon_test_merge_regions_of() Add a test case in damon_test_merge_regions_of() to verify that two adjacent regions are not merged if the resulting region would exceed the specified size limit. Link: https://lkml.kernel.org/r/20251224042200.2061847-4-shu17az@gmail.com Signed-off-by: Shu Anzai Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 738dae96b2fb69c15c99f95ed0044bc12830dcba Author: Shu Anzai Date: Wed Dec 24 04:21:57 2025 +0000 mm/damon/tests/core-kunit: verify the 'age' and 'nr_accesses_bp' fields in damon_test_merge_two() Extend damon_test_merge_two() to verify the 'age' and 'nr_accesses_bp' fields. Link: https://lkml.kernel.org/r/20251224042200.2061847-3-shu17az@gmail.com Signed-off-by: Shu Anzai Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 6c59085fc09428b2c168bb9fa1cab760e0831914 Author: Shu Anzai Date: Wed Dec 24 04:21:56 2025 +0000 mm/damon/tests/core-kunit: verify the 'age' field in damon_test_split_at() Patch series "mm/damon/tests/core-kunit: extend existing test scenarios", v2. Improve the KUnit test coverage for DAMON. The five patches in this series respectively extend damon_test_split_at(), damon_test_merge_two(), damon_test_merge_regions_of(), damon_test_split_regions_of(), and damos_test_commit_quota_goal(). This patch (of 5): Extend damon_test_split_at() to verify the 'age' field. Link: https://lkml.kernel.org/r/20251224042200.2061847-1-shu17az@gmail.com Link: https://lkml.kernel.org/r/20251224042200.2061847-2-shu17az@gmail.com Signed-off-by: Shu Anzai Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit a8d933dc3354bfb9db1fc0e09c289ec1778ee271 Author: Wei Yang Date: Thu Dec 25 21:02:13 2025 +0000 mm/vmstat: remove unused node and zone state helpers Several helper functions for managing node and zone states have become obsolete and no longer have any callers within the kernel. inc_node_state() inc_zone_state() dec_zone_state() This commit removes the dead code. Link: https://lkml.kernel.org/r/20251225210213.2553-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Joshua Hahn Acked-by: David Hildenbrand (Red Hat) Acked-by: Vlastimil Babka Signed-off-by: Andrew Morton commit 6319c4f44234c3849fdb2c3f72c45353aa428d3f Author: Chunyu Hu Date: Sun Dec 21 12:00:25 2025 +0800 selftests/mm: fix comment for check_test_requirements The test supports arm64 as well so the comment is incorrect. And there's a check for arm64 in va_high_addr_switch.c. Link: https://lkml.kernel.org/r/20251221040025.3159990-5-chuhu@redhat.com Fixes: 983e760bcdb6 ("selftest/mm: va_high_addr_switch: add ppc64 support check") Fixes: f556acc2facd ("selftests/mm: skip test for non-LPA2 and non-LVA systems") Signed-off-by: Chunyu Hu Reviewed-by: Luiz Capitulino Cc: "David Hildenbrand (Red Hat)" Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit dd0202a0bd81c33096f3d473c296cad997baba5b Author: Chunyu Hu Date: Sun Dec 21 12:00:24 2025 +0800 selftests/mm: va_high_addr_switch return fail when either test failed When the first test failed, and the hugetlb test passed, the result would be pass, but we expect a fail. Fix this issue by returning fail if either is not KSFT_PASS. Link: https://lkml.kernel.org/r/20251221040025.3159990-4-chuhu@redhat.com Signed-off-by: Chunyu Hu Reviewed-by: Luiz Capitulino Cc: "David Hildenbrand (Red Hat)" Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7544d7969d84c1c4a078d1c5a7d4117fbf6f385c Author: Chunyu Hu Date: Sun Dec 21 12:00:23 2025 +0800 selftests/mm: remove arm64 nr_hugepages setup for va_high_addr_switch test arm64 and x86_64 has the same nr_hugepages requriement for running the va_high_addr_switch test. Since commit d9d957bd7b61 ("selftests/mm: alloc hugepages in va_high_addr_switch test"), the setup can be done in va_high_addr_switch.sh. So remove the duplicated setup. Link: https://lkml.kernel.org/r/20251221040025.3159990-3-chuhu@redhat.com Signed-off-by: Chunyu Hu Reviewed-by: Luiz Capitulino Cc: Luiz Capitulino Cc: "David Hildenbrand (Red Hat)" Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b1f031e33cb5ae4be039a17613ad8da84c777e70 Author: Chunyu Hu Date: Sun Dec 21 12:00:22 2025 +0800 selftests/mm: allocate 6 hugepages in va_high_addr_switch.sh The va_high_addr_switch test requires 6 hugepages, not 5. If running the test directly by: ./va_high_addr_switch.sh, the test will hit a mmap 'FAIL' caused by not enough hugepages: mmap(addr_switch_hint - hugepagesize, 2*hugepagesize, MAP_HUGETLB): 0x7f330f800000 - OK mmap(addr_switch_hint , 2*hugepagesize, MAP_FIXED | MAP_HUGETLB): 0xffffffffffffffff - FAILED The failure can't be hit if run the tests by running 'run_vmtests.sh -t hugevm' because the nr_hugepages is set to 128 at the beginning of run_vmtests.sh and va_high_addr_switch.sh skip the setup of nr_hugepages because already enough. Link: https://lkml.kernel.org/r/20251221040025.3159990-2-chuhu@redhat.com Fixes: d9d957bd7b61 ("selftests/mm: alloc hugepages in va_high_addr_switch test") Signed-off-by: Chunyu Hu Reviewed-by: Luiz Capitulino Cc: "David Hildenbrand (Red Hat)" Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b47beff129c6193df3dd406f2db2628fcc09d1eb Author: Chunyu Hu Date: Sun Dec 21 12:00:21 2025 +0800 selftests/mm: fix va_high_addr_switch.sh return value Patch series "Fix va_high_addr_switch.sh test failure - again", v2. The series address several issues exist for the va_high_addr_switch test: 1) the test return value is ignored in va_high_addr_switch.sh. 2) the va_high_addr_switch test requires 6 hugepages not 5. 3) the reurn value of the first test in va_high_addr_switch.c can be overridden by the second test. 4) the nr_hugepages setup in run_vmtests.sh for arm64 can be done in va_high_addr_switch.sh too. 5) update a comment for check_test_requirements. This patch: (of 5) The return value should be return value of va_high_addr_switch, otherwise a test failure would be silently ignored. Link: https://lkml.kernel.org/r/20251221040025.3159990-1-chuhu@redhat.com Fixes: d9d957bd7b61 ("selftests/mm: alloc hugepages in va_high_addr_switch test") Signed-off-by: Chunyu Hu Reviewed-by: Luiz Capitulino Cc: Luiz Capitulino Cc: "David Hildenbrand (Red Hat)" Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b618876f2e7055160cc5b98b4ff5cd8917e7b49e Author: Li Wang Date: Sun Dec 21 20:26:39 2025 +0800 selftests/mm/charge_reserved_hugetlb.sh: add waits with timeout helper The hugetlb cgroup usage wait loops in charge_reserved_hugetlb.sh were unbounded and could hang forever if the expected cgroup file value never appears (e.g. due to write_to_hugetlbfs in Error mapping). === Error log === # uname -r 6.12.0-xxx.el10.aarch64+64k # ls /sys/kernel/mm/hugepages/hugepages-* hugepages-16777216kB/ hugepages-2048kB/ hugepages-524288kB/ #./charge_reserved_hugetlb.sh -cgroup-v2 # ----------------------------------------- ... # nr hugepages = 10 # writing cgroup limit: 5368709120 # writing reseravation limit: 5368709120 ... # write_to_hugetlbfs: Error mapping the file: Cannot allocate memory # Waiting for hugetlb memory reservation to reach size 2684354560. # 0 # Waiting for hugetlb memory reservation to reach size 2684354560. # 0 # Waiting for hugetlb memory reservation to reach size 2684354560. # 0 # Waiting for hugetlb memory reservation to reach size 2684354560. # 0 # Waiting for hugetlb memory reservation to reach size 2684354560. # 0 # Waiting for hugetlb memory reservation to reach size 2684354560. # 0 ... Introduce a small helper, wait_for_file_value(), and use it for: - waiting for reservation usage to drop to 0, - waiting for reservation usage to reach a given size, - waiting for fault usage to reach a given size. This makes the waits consistent and adds a hard timeout (60 tries with 1s sleep) so the test fails instead of stalling indefinitely. Link: https://lkml.kernel.org/r/20251221122639.3168038-4-liwang@redhat.com Signed-off-by: Li Wang Acked-by: David Hildenbrand (Red Hat) Cc: Mark Brown Cc: Shuah Khan Cc: Waiman Long Signed-off-by: Andrew Morton commit 1aa1dd9cc595917882fb6db67725442956f79607 Author: Li Wang Date: Sun Dec 21 20:26:38 2025 +0800 selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs charge_reserved_hugetlb.sh mounts a hugetlbfs instance at /mnt/huge with a fixed size of 256M. On systems with large base hugepages (e.g. 512MB), this is smaller than a single hugepage, so the hugetlbfs mount ends up with zero capacity (often visible as size=0 in mount output). As a result, write_to_hugetlbfs fails with ENOMEM and the test can hang waiting for progress. === Error log === # uname -r 6.12.0-xxx.el10.aarch64+64k #./charge_reserved_hugetlb.sh -cgroup-v2 # ----------------------------------------- ... # nr hugepages = 10 # writing cgroup limit: 5368709120 # writing reseravation limit: 5368709120 ... # write_to_hugetlbfs: Error mapping the file: Cannot allocate memory # Waiting for hugetlb memory reservation to reach size 2684354560. # 0 # Waiting for hugetlb memory reservation to reach size 2684354560. # 0 ... # mount |grep /mnt/huge none on /mnt/huge type hugetlbfs (rw,relatime,seclabel,pagesize=512M,size=0) # grep -i huge /proc/meminfo ... HugePages_Total: 10 HugePages_Free: 10 HugePages_Rsvd: 0 HugePages_Surp: 0 Hugepagesize: 524288 kB Hugetlb: 5242880 kB Drop the mount args with 'size=256M', so the filesystem capacity is sufficient regardless of HugeTLB page size. Link: https://lkml.kernel.org/r/20251221122639.3168038-3-liwang@redhat.com Fixes: 29750f71a9b4 ("hugetlb_cgroup: add hugetlb_cgroup reservation tests") Signed-off-by: Li Wang Acked-by: David Hildenbrand (Red Hat) Acked-by: Waiman Long Cc: Mark Brown Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton commit 8e46adb62fae98a866baa7c23f6ed3bfe02e6f88 Author: Li Wang Date: Sun Dec 21 20:26:37 2025 +0800 selftests/mm/write_to_hugetlbfs: parse -s as size_t Patch series "selftests/mm: hugetlb cgroup charging: robustness fixes", v3. This series fixes a few issues in the hugetlb cgroup charging selftests (write_to_hugetlbfs.c + charge_reserved_hugetlb.sh) that show up on systems with large hugepages (e.g. 512MB) and when failures cause the test to wait indefinitely. On an aarch64 64k page kernel with 512MB hugepages, the test consistently fails in write_to_hugetlbfs with ENOMEM and then hangs waiting for the expected usage values. The root cause is that charge_reserved_hugetlb.sh mounts hugetlbfs with a fixed size=256M, which is smaller than a single hugepage, resulting in a mount with size=0 capacity. In addition, write_to_hugetlbfs previously parsed -s via atoi() into an int, which can overflow and print negative sizes. Reproducer / environment: - Kernel: 6.12.0-xxx.el10.aarch64+64k - Hugepagesize: 524288 kB (512MB) - ./charge_reserved_hugetlb.sh -cgroup-v2 - Observed mount: pagesize=512M,size=0 before this series After applying the series, the test completes successfully on the above setup. This patch (of 3): write_to_hugetlbfs currently parses the -s size argument with atoi() into an int. This silently accepts malformed input, cannot report overflow, and can truncate large sizes. === Error log === # uname -r 6.12.0-xxx.el10.aarch64+64k # ls /sys/kernel/mm/hugepages/hugepages-* hugepages-16777216kB/ hugepages-2048kB/ hugepages-524288kB/ #./charge_reserved_hugetlb.sh -cgroup-v2 # ----------------------------------------- ... # nr hugepages = 10 # writing cgroup limit: 5368709120 # writing reseravation limit: 5368709120 ... # Writing to this path: /mnt/huge/test # Writing this size: -1610612736 <-------- Switch the size variable to size_t and parse -s with sscanf("%zu", ...). Also print the size using %zu. This avoids incorrect behavior with large -s values and makes the utility more robust. Link: https://lkml.kernel.org/r/20251221122639.3168038-1-liwang@redhat.com Link: https://lkml.kernel.org/r/20251221122639.3168038-2-liwang@redhat.com Signed-off-by: Li Wang Acked-by: David Hildenbrand (Red Hat) Acked-by: Waiman Long Cc: David Hildenbrand Cc: Mark Brown Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3bb64898f00368cd110d4b31334f93251d56b404 Author: Gregory Price Date: Sun Dec 21 07:46:56 2025 -0500 page_alloc: allow migration of smaller hugepages during contig_alloc We presently skip regions with hugepages entirely when trying to do contiguous page allocation. This will cause otherwise-movable 2MB HugeTLB pages to be considered unmovable, and makes 1GB gigantic page allocation less reliable on systems utilizing both. Commit 4d73ba5fa710 ("mm: page_alloc: skip regions with hugetlbfs pages when allocating 1G pages") skipped all HugePage containing regions because it can cause significant delays in 1G allocation (as HugeTLB migrations may fail for a number of reasons). Instead, if hugepage migration is enabled, consider regions with hugepages smaller than the target contiguous allocation request as valid targets for allocation. We optimize for the existing behavior by searching for non-hugetlb regions in a first pass, then retrying the search to include hugetlb only on failure. This allows the existing fast-path to remain the default case with a slow-path fallback to increase reliability. We only fallback to the slow path if a hugetlb region was detected, and we do a full re-scan because the zones/blocks may have changed during the first pass (and it's not worth further complexity). isolate_migrate_pages_block() has similar hugetlb filter logic, and the hugetlb code does a migratable check in folio_isolate_hugetlb() during isolation. The code servicing the allocation and migration already supports this exact use case. To test, allocate a bunch of 2MB HugeTLB pages (in this case 48GB) and then attempt to allocate some 1G HugeTLB pages (in this case 4GB) (Scale to your machine's memory capacity). echo 24576 > .../hugepages-2048kB/nr_hugepages echo 4 > .../hugepages-1048576kB/nr_hugepages Prior to this patch, the 1GB page reservation can fail if no contiguous 1GB pages remain. After this patch, the kernel will try to move 2MB pages and successfully allocate the 1GB pages (assuming overall sufficient memory is available). Also tested this while a program had the 2MB reservations mapped, and the 1GB reservation still succeeds. folio_alloc_gigantic() is the primary user of alloc_contig_pages(), other users are debug or init-time allocations and largely unaffected. - ppc/memtrace is a debugfs interface - x86/tdx memory allocation occurs once on module-init - kfence/core happens once on module (late) init - THP uses it in debug_vm_pgtable_alloc_huge_page at __init time Link: https://lkml.kernel.org/r/20251221124656.2362540-1-gourry@gourry.net Signed-off-by: Gregory Price Suggested-by: David Hildenbrand Link: https://lore.kernel.org/linux-mm/6fe3562d-49b2-4975-aa86-e139c535ad00@redhat.com/ Reviewed-by: Zi Yan Reviewed-by: Wei Yang Acked-by: Michal Hocko Acked-by: David Hildenbrand (Red Hat) Cc: Brendan Jackman Cc: Johannes Weiner Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9e80e66ddaf736e5ca80cba8adf8d497bd53092f Author: Gregory Price Date: Sun Dec 21 07:56:03 2025 -0500 mm, hugetlb: implement movable_gigantic_pages sysctl This reintroduces a concept removed by: commit d6cb41cc44c6 ("mm, hugetlb: remove hugepages_treat_as_movable sysctl") This sysctl provides flexibility between ZONE_MOVABLE use cases: 1) onlining memory in ZONE_MOVABLE to maintain hotplug compatibility 2) onlining memory in ZONE_MOVABLE to make hugepage allocate reliable When ZONE_MOVABLE is used to make huge page allocation more reliable, disallowing gigantic pages memory in this region is pointless. If hotplug is not a requirement, we can loosen the restrictions to allow 1GB gigantic pages in ZONE_MOVABLE. Since 1GB can be difficult to migrate / has impacts on compaction / defragmentation, we don't enable this by default. Notably, 1GB pages can only be migrated if another 1GB page is available - so hot-unplug will fail if such a page cannot be found. However, since there are scenarios where gigantic pages are migratable, we should allow use of these on movable regions. When not valid 1GB is available for migration, hot-unplug will retry indefinitely (or until interrupted). For example: echo 0 > node0/hugepages/..-1GB/nr_hugepages # clear node0 1GB pages echo 1 > node1/hugepages/..-1GB/nr_hugepages # reserve node1 1GB page ./alloc_huge_node1 & # Allocate a 1GB page on node1 ./node1_offline & # attempt to offline all node1 memory echo 1 > node0/hugepages/..-1GB/nr_hugepages # reserve node0 1GB page In this example, node1_offline will block indefinitely until the final step, when a node0 1GB page is made available. Note: Boot-time CMA is not possible for driver-managed hotplug memory, as CMA requires the memory to be registered as SystemRAM at boot time. Additionally, 1GB huge pages are not supported by THP. Link: https://lkml.kernel.org/r/20251221125603.2364174-1-gourry@gourry.net Signed-off-by: Gregory Price Suggested-by: David Rientjes Link: https://lore.kernel.org/all/20180201193132.Hk7vI_xaU%25akpm@linux-foundation.org/ Acked-by: David Hildenbrand (Red Hat) Acked-by: David Rientjes Cc: Mel Gorman Cc: Michal Hocko Cc: "David Hildenbrand (Red Hat)" Cc: Gregory Price Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Muchun Song Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7db0787000d44d52710e5cdd67113458fa28f3cd Author: Wentao Guan Date: Thu Nov 6 19:09:29 2025 +0800 mm: cleanup vma_iter_bulk_alloc commit d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()"), removed the only user and mas_expected_entries has been removed, since commit e3852a1213ffc ("maple_tree: Drop bulk insert support"). Also cleanup the mas_expected_entries in maple_tree.h. No functional change. Link: https://lkml.kernel.org/r/20251106110929.3522073-1-guanwentao@uniontech.com Signed-off-by: Wentao Guan Reviewed-by: Liam R. Howlett Cc: Anshuman Khandual Cc: Cheng Nie Cc: Guan Wentao Cc: Vlastimil Babka Cc: Lorenzo Stoakes Cc: Jann Horn Cc: Pedro Falcato Signed-off-by: Andrew Morton commit 241b3a09639c317bdcaeea6721b7d1aabef341f9 Author: Brendan Jackman Date: Fri Dec 19 11:32:18 2025 +0000 mm: clarify GFP_ATOMIC/GFP_NOWAIT doc-comment The current description of contexts where it's invalid to make GFP_ATOMIC and GFP_NOWAIT calls is rather vague. Replace this with a direct description of the actual contexts of concern and refer to the RT docs where this is explained more discursively. While rejigging this prose, also move the documentation of GFP_NOWAIT to the GFP_NOWAIT section. Link: https://lore.kernel.org/all/d912480a-5229-4efe-9336-b31acded30f5@suse.cz/ Link: https://lkml.kernel.org/r/20251219-b4-gfp_atomic-comment-v2-1-4c4ce274c2b6@google.com Signed-off-by: Brendan Jackman Acked-by: Vlastimil Babka Acked-by: David Hildenbrand (Red Hat) Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 7969f3059493eeb1aa93151d3ad5aded6af4e836 Author: Kairui Song Date: Fri Dec 19 19:46:00 2025 +0800 mm/gup: remove no longer used gup_fast_undo_dev_pagemap This helper is no longer used after commit fd2825b0760a ("mm/gup: remove pXX_devmap usage from get_user_pages()"). Link: https://lkml.kernel.org/r/20251219-gup-cleanup-v1-1-348a70d9eecb@tencent.com Signed-off-by: Kairui Song Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Alistair Popple Cc: Jason Gunthorpe Cc: John Hubbard Cc: Peter Xu Signed-off-by: Andrew Morton commit 9c9828d3ead69416d731b1238802af31760c823e Author: Vlastimil Babka Date: Fri Dec 19 17:31:57 2025 +0100 mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations Since commit cc638f329ef6 ("mm, thp: tweak reclaim/compaction effort of local-only and all-node allocations"), THP page fault allocations have settled on the following scheme (from the commit log): 1. local node only THP allocation with no reclaim, just compaction. 2. for madvised VMA's or when synchronous compaction is enabled always - THP allocation from any node with effort determined by global defrag setting and VMA madvise 3. fallback to base pages on any node Recent customer reports however revealed we have a gap in step 1 above. What we have seen is excessive reclaim due to THP page faults on a NUMA node that's close to its high watermark, while other nodes have plenty of free memory. The problem with step 1 is that it promises no reclaim after the compaction attempt, however reclaim is only avoided for certain compaction outcomes (deferred, or skipped due to insufficient free base pages), and not e.g. when compaction is actually performed but fails (we did see compact_fail vmstat counter increasing). THP page faults can therefore exhibit a zone_reclaim_mode-like behavior, which is not the intention. Thus add a check for __GFP_THISNODE that corresponds to this exact situation and prevents continuing with reclaim/compaction once the initial compaction attempt isn't successful in allocating the page. Note that commit cc638f329ef6 has not introduced this over-reclaim possibility; it appears to exist in some form since commit 2f0799a0ffc0 ("mm, thp: restore node-local hugepage allocations"). Followup commits b39d0ee2632d ("mm, page_alloc: avoid expensive reclaim when compaction may not succeed") and cc638f329ef6 have moved in the right direction, but left the abovementioned gap. Link: https://lkml.kernel.org/r/20251219-costly-noretry-thisnode-fix-v1-1-e1085a4a0c34@suse.cz Fixes: 2f0799a0ffc0 ("mm, thp: restore node-local hugepage allocations") Signed-off-by: Vlastimil Babka Acked-by: Michal Hocko Acked-by: Johannes Weiner Acked-by: Pedro Falcato Acked-by: Zi Yan Cc: Brendan Jackman Cc: "David Hildenbrand (Red Hat)" Cc: David Rientjes Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit ed60c8e280248c02cd87ce7982f8fcb402cce001 Author: Xiu Jianfeng Date: Mon Dec 22 07:23:59 2025 +0000 mm/hugetlb_cgroup: fix -Wformat-truncation warning A false-positive compile warnings with -Wformat-trucation was introduced by commit 47179fe03588 ("mm/hugetlb_cgroup: prepare cftypes based on template") on arch s390. Suppress it by replacing snprintf() with scnprintf(). mm/hugetlb_cgroup.c: In function 'hugetlb_cgroup_file_init': mm/hugetlb_cgroup.c:829:44: warning: '%s' directive output may be truncated writing up to 1623 bytes into a region of size between 32 and 63 [-Wformat-truncation=] 829 | snprintf(cft->name, MAX_CFTYPE_NAME, "%s.%s", buf, tmpl->name); | ^~ Link: https://lkml.kernel.org/r/20251222072359.3626182-1-xiujianfeng@huaweicloud.com Fixes: 47179fe03588 ("mm/hugetlb_cgroup: prepare cftypes based on template") Signed-off-by: Xiu Jianfeng Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512212332.9lFRbgdS-lkp@intel.com/ Reviewed-by: Andrew Morton Cc: "David Hildenbrand (Red Hat)" Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 62451ae347b0015bf3d644c97cbc14e75a8287e6 Author: Kevin Lourenco Date: Thu Dec 18 16:09:06 2025 +0100 mm: fix minor spelling mistakes in comments Correct several typos in comments across files in mm/ [akpm@linux-foundation.org: also fix comment grammar, per SeongJae] Link: https://lkml.kernel.org/r/20251218150906.25042-1-klourencodev@gmail.com Signed-off-by: Kevin Lourenco Reviewed-by: SeongJae Park Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 5ec9bb6de4933b8a9bca09ce56039277d63dd5a8 Author: Kevin Lourenco Date: Wed Dec 17 19:12:16 2025 +0100 mm/damon: fix typos in comments Correct minor spelling mistakes in several files under mm/damon. No functional changes. Link: https://lkml.kernel.org/r/20251217181216.47576-1-klourencodev@gmail.com Signed-off-by: Kevin Lourenco Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit a9853ac1c3bcf79cef46046529a3f7912ff5ecee Author: Heiko Carstens Date: Wed Nov 26 15:36:02 2025 +0100 zram: remove KMSG_COMPONENT macro The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel message catalog" from 2008 [1] which never made it upstream. The macro was added to s390 code to allow for an out-of-tree patch which used this to generate unique message ids. Also this out-of-tree doesn't exist anymore. The pattern of how the KMSG_COMPONENT is used was partially also used for non s390 specific code, for whatever reasons. Remove the macro in order to get rid of a pointless indirection. Link: https://lkml.kernel.org/r/20251126143602.2207435-1-hca@linux.ibm.com Link: https://lwn.net/Articles/292650/ [1] Signed-off-by: Heiko Carstens Reviewed-by: Sergey Senozhatsky Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit 84355caa271a0eab2d1b55ff73aa8aa3e4627661 Author: Thorsten Blum Date: Wed Dec 17 12:02:13 2025 +0100 mm/mm_init: replace simple_strtoul with kstrtobool in set_hashdist Use bool for 'hashdist' and replace simple_strtoul() with kstrtobool() for parsing the 'hashdist=' boot parameter. Unlike simple_strtoul(), which returns an unsigned long, kstrtobool() converts the string directly to bool and avoids implicit casting. Check the return value of kstrtobool() and reject invalid values. This adds error handling while preserving behavior for existing values, and removes use of the deprecated simple_strtoul() helper. The current code silently sets 'hashdist = 0' if parsing fails, instead of leaving the default value (HASHDIST_DEFAULT) unchanged. Additionally, kstrtobool() accepts common boolean strings such as "on" and "off". Link: https://lkml.kernel.org/r/20251217110214.50807-1-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit a98ec863fdedf4940447f32ceda7d937bebd06a2 Author: Audra Mitchell Date: Mon Dec 1 13:18:48 2025 -0500 lib/test_vmalloc.c: minor fixes to test_vmalloc.c If PAGE_SIZE is larger than 4k and if you have a system with a large number of CPUs, this test can require a very large amount of memory leading to oom-killer firing. Given the type of allocation, the kernel won't have anything to kill, causing the system to stall. Add a parameter to the test_vmalloc driver to represent the number of times a percpu object will be allocated. Calculate this in test_vmalloc.sh to be 90% of available memory or the current default of 35000, whichever is smaller. Link: https://lkml.kernel.org/r/20251201181848.1216197-1-audra@redhat.com Signed-off-by: Audra Mitchell Reviewed-by: Andrew Morton Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Rafael Aquini Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: "Uladzislau Rezki (Sony)" Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit bd4526e64bcff4cbeaefbbd91c40d3e38b9920a9 Author: Sidhartha Kumar Date: Wed Dec 3 22:45:11 2025 +0000 maple_tree: remove struct maple_alloc struct maple_alloc is deprecated after the maple tree conversion to sheaves, remove the references from the header file. Link: https://lkml.kernel.org/r/20251203224511.469978-1-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Jinjie Ruan Reviewed-by: Liam R. Howlett Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 64dd89ae01f2708a508e028c28b7906e4702a9a7 Author: Johannes Weiner Date: Mon Dec 15 12:57:53 2025 -0500 mm/block/fs: remove laptop_mode Laptop mode was introduced to save battery, by delaying and consolidating writes and thereby maximize the time rotating hard drives wouldn't have to spin. Luckily, rotating hard drives, with their high spin-up times and power draw, are a thing of the past for battery-powered devices. Reclaim has also since changed to not write single filesystem pages anymore, and regular filesystem writeback is lumpy by design. The juice doesn't appear worth the squeeze anymore. The footprint of the feature is small, but nevertheless it's a complicating factor in mm, block, filesystems. Developers don't think about it, and it likely hasn't been tested with new reclaim and writeback changes in years. Let's sunset it. Keep the sysctl with a deprecation warning around for a few more cycles, but remove all functionality behind it. [akpm@linux-foundation.org: fix Documentation/admin-guide/laptops/index.rst] Link: https://lkml.kernel.org/r/20251216185201.GH905277@cmpxchg.org Signed-off-by: Johannes Weiner Suggested-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Acked-by: Jens Axboe Reviewed-by: Shakeel Butt Acked-by: Michal Hocko Cc: Deepanshu Kartikey Signed-off-by: Andrew Morton commit 657a81fe3b41bd58c63e15ae282f992dda5c8eee Author: Sergey Senozhatsky Date: Tue Dec 16 16:13:42 2025 +0900 zram: drop pp_in_progress pp_in_progress makes sure that only one post-processing (writeback or recomrpession) is active at any given time. Functionality wise it, basically, shadows zram init_lock, when init_lock is acquired in writer mode. Switch recompress_store() and writeback_store() to take zram init_lock in writer mode, like all store() sysfs handlers should do, so that we can drop pp_in_progress. Recompression and writeback can be somewhat slow, so holding init_lock in writer mode can block zram attrs reads, but in reality the only zram attrs reads that take place are mm_stat reads, and usually it's the same process that reads mm_stat and does recompression or writeback. Link: https://lkml.kernel.org/r/20251216071342.687993-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Suggested-by: Greg Kroah-Hartman Cc: Brian Geffon Cc: Minchan Kim Signed-off-by: Andrew Morton commit 9082f24bd3b700bfc98a24baf794cc7af8f6bcd0 Author: JaeJoon Jung Date: Mon Dec 15 23:34:38 2025 -0800 mm/damon/stat: deduplicate intervals_goal setup in damon_stat_build_ctx() The damon_stat_build_ctx() function sets the values of intervals_goal structure members. These values are applied to damon_ctx in damon_set_attrs(). However, It is resetting the values that were already applied previously to the same values. I suggest removing this code as it constitutes duplicate execution. Link: https://patch.msgid.link/20251206011716.7185-1-rgbi3307@gmail.com Link: https://lkml.kernel.org/r/20251216073440.40891-1-sj@kernel.org Signed-off-by: JaeJoon Jung Reviewed-by: Enze Li Reviewed-by: SeongJae Park Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 804c26b961da295bd70c86a3c9dc4bea0b09de88 Author: SeongJae Park Date: Tue Dec 16 00:01:25 2025 -0800 mm/damon/core: add trace point for damos stat per apply interval DAMON users can read DAMOS stats via DAMON sysfs interface. It enables efficient, simple and flexible usages of the stats. Especially for systems not having advanced tools like perf or bpftrace, that can be useful. But if the advanced tools are available, exposing the stats via tracepoint can reduce unnecessary reimplementation of the wheels. Add a new tracepoint for DAMOS stats, namely damos_stat_after_apply_interval. The tracepoint is triggered for each scheme's apply interval and exposes the whole stat values. If the user needs sub-apply interval information for any chance, damos_before_apply tracepoint could be used. Link: https://lkml.kernel.org/r/20251216080128.42991-13-sj@kernel.org Signed-off-by: SeongJae Park Reviewed-by: Steven Rostedt (Google) Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit dcecf9e58b976dd848a06c667d92d2566f9384aa Author: SeongJae Park Date: Tue Dec 16 00:01:24 2025 -0800 Docs/ABI/damon: update for max_nr_snapshots Update DAMON ABI document for the newly added DAMON sysfs interface file, max_nr_snapshots. Link: https://lkml.kernel.org/r/20251216080128.42991-12-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2584dd7496c53135287d3a4b2e0699fe386df015 Author: SeongJae Park Date: Tue Dec 16 00:01:23 2025 -0800 Docs/admin-guide/mm/damon/usage: update for max_nr_snapshots Update DAMON usage document for the newly added DAMON sysfs interface file, max_nr_snapshots. Link: https://lkml.kernel.org/r/20251216080128.42991-11-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 64aa87f03da9165c45534695da42d9e87ada7544 Author: SeongJae Park Date: Tue Dec 16 00:01:22 2025 -0800 Docs/mm/damon/design: update for max_nr_snapshots Update DAMON design document for the newly added snapshot level DAMOS deactivation feature, max_nr_snapshots. Link: https://lkml.kernel.org/r/20251216080128.42991-10-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 204ab9ab9310cd79c710037992e6ad681c8fa6b9 Author: SeongJae Park Date: Tue Dec 16 00:01:21 2025 -0800 mm/damon/sysfs-schemes: implement max_nr_snapshots file Add a new DAMON sysfs file for setting and getting the newly introduced per-DAMON-snapshot level DAMOS deactivation control parameter, max_nr_snapshots. The file has a name same to the parameter and placed under the damos stat directory. Link: https://lkml.kernel.org/r/20251216080128.42991-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 84e425c68e6061751adecd2d328789e4f67eac1e Author: SeongJae Park Date: Tue Dec 16 00:01:20 2025 -0800 mm/damon/core: implement max_nr_snapshots There are DAMOS use cases that require user-space centric control of its activation and deactivation. Having the control plane on the user-space, or using DAMOS as a way for monitoring results collection are such examples. DAMON parameters online commit, DAMOS quotas and watermarks can be useful for this purpose. However, those features work only at the sub-DAMON-snapshot level. In some use cases, the DAMON-snapshot level control is required. For example, in DAMOS-based monitoring results collection use case, the user online-installs a DAMOS scheme with DAMOS_STAT action, wait it be applied to whole regions of a single DAMON-snapshot, retrieves the stats and tried regions information, and online-uninstall the scheme. It is efficient to ensure the lifetime of the scheme as no more no less one snapshot consumption. To support such use cases, introduce a new DAMOS core API per-scheme parameter, namely max_nr_snapshots. As the name implies, it is the upper limit of nr_snapshots, which is a DAMOS stat that represents the number of DAMON-snapshots that the scheme has fully applied. If the limit is set with a non-zero value and nr_snapshots reaches or exceeds the limit, the scheme is deactivated. Link: https://lkml.kernel.org/r/20251216080128.42991-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ccaa2d062a35add92832e8f082b8e00eed3f6efd Author: SeongJae Park Date: Tue Dec 16 00:01:19 2025 -0800 mm/damon: update damos kerneldoc for stat field Commit 0e92c2ee9f45 ("mm/damon/schemes: account scheme actions that successfully applied") has replaced ->stat_count and ->stat_sz of 'struct damos' with ->stat. The commit mistakenly did not update the related kernel doc comment, though. Update the comment. Link: https://lkml.kernel.org/r/20251216080128.42991-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 55221e53f73e41b4ebac575ed1333f50488a7ba4 Author: SeongJae Park Date: Tue Dec 16 00:01:18 2025 -0800 Docs/ABI/damon: update for nr_snapshots damos stat Update DAMON ABI document for the newly added damos stat, nr_snapshots. Link: https://lkml.kernel.org/r/20251216080128.42991-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0b43f89e2d9a18d1a2373064f70bc730180b70f2 Author: SeongJae Park Date: Tue Dec 16 00:01:17 2025 -0800 Docs/admin-guide/mm/damon/usage: update for nr_snapshots damos stat Update DAMON usage document for the newly added damos stat, nr_snapshots. Link: https://lkml.kernel.org/r/20251216080128.42991-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit ee7f5d193358a6e8624a17cef78c508635f9b9b6 Author: SeongJae Park Date: Tue Dec 16 00:01:16 2025 -0800 Docs/mm/damon/design: update for nr_snapshots damos stat Update DAMON design document for the newly added damos stat, nr_snapshots. Link: https://lkml.kernel.org/r/20251216080128.42991-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 83a741b9742505bda70e6cd82dc5cb32baf5e16c Author: SeongJae Park Date: Tue Dec 16 00:01:15 2025 -0800 mm/damon/sysfs-schemes: introduce nr_snapshots damos stat file Introduce a new DAMON sysfs interface file for exposing the newly added DAMOS stat, nr_snapshots. The file has the name same to the stat name (nr_snapshots) and placed under the damos stat sysfs directory. Link: https://lkml.kernel.org/r/20251216080128.42991-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4a6ceb7c9744c69546d4ca43b7bd308f4db0927b Author: SeongJae Park Date: Tue Dec 16 00:01:14 2025 -0800 mm/damon/core: introduce nr_snapshots damos stat Patch series "mm/damon: introduce {,max_}nr_snapshots and tracepoint for damos stats". Introduce three changes for improving DAMOS stat's provided information, deterministic control, and reading usability. DAMOS provides stats that are important for understanding its behavior. It lacks information about how many DAMON-generated monitoring output snapshots it has worked on. Add a new stat, nr_snapshots, to show the information. Users can control DAMOS schemes in multiple ways. Using the online parameters commit feature, they can install and uninstall DAMOS schemes whenever they want while keeping DAMON runs. DAMOS quotas and watermarks can be used for manually or automatically turning on/off or adjusting the aggressiveness of the scheme. DAMOS filters can be used for applying the scheme to specific memory entities based on their types and locations. Some users want their DAMOS scheme to be applied to only specific number of DAMON snapshots, for more deterministic control. One example use case is tracepoint based snapshot reading. Add a new knob, max_nr_snapshots, to support this. If the nr_snapshots parameter becomes same to or greater than the value of this parameter, the scheme is deactivated. Users can read DAMOS stats via DAMON's sysfs interface. For deep level investigations on environments having advanced tools like perf and bpftrace, exposing the stats via a tracepoint can be useful. Implement a new tracepoint, namely damon:damos_stat_after_apply_interval. First five patches (patches 1-5) of this series implement the new stat, nr_snapshots, on the core layer (patch 1), expose on DAMON sysfs user interface (patch 2), and update documents (patches 3-5). Following six patches (patches 6-11) are for the new stat based DAMOS deactivation (max_nr_snapshots). The first one (patch 6) of this group updates a kernel-doc comment before making further changes. Then an implementation of it on the core layer (patch 7), an introduction of a new DAMON sysfs interface file for users of the feature (patch 8), and three updates of the documents (patches 9-11) follow. The final one (patch 12) introduces the new tracepoint that exposes the DAMOS stat values for each scheme apply interval. This patch (of 12): DAMON generates monitoring results snapshots for every sampling interval. DAMOS applies given schemes on the regions of the snapshots, for every apply interval of the scheme. DAMOS stat informs a given scheme has tried to how many memory entities and applied, in the region and byte level. In some use cases including user-space oriented tuning and investigations, it is useful to know that in the DAMON-snapshot level. Introduce a new stat, namely nr_snapshots for DAMON core API callers. [sj@kernel.org: fix wrong list_is_last() call in damons_is_last_region()] Link: https://lkml.kernel.org/r/20260114152049.99727-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251216080128.42991-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251216080128.42991-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 8b8017d7c411403731ee4d502cdbd76e9425f0e1 Author: Kaushlendra Kumar Date: Mon Dec 8 16:22:40 2025 +0530 tools/mm/slabinfo: fix --partial long option mapping The long option "--partial" was incorrectly mapped to lowercase 'p' in the opts[] array, but the getopt string and switch case handle uppercase 'P'. This mismatch caused --partial to be rejected. Fix the long_options mapping to use 'P' so --partial works correctly alongside the existing -P short option. Link: https://lkml.kernel.org/r/20251208105240.2719773-1-kaushlendra.kumar@intel.com Signed-off-by: Kaushlendra Kumar Reviewed-by: SeongJae Park Tested-by: SeongJae Park Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9f5edd785da3cf373285259928d7f1f08c9ce758 Author: Kaushlendra Kumar Date: Tue Dec 9 08:47:45 2025 +0530 tools/mm/thp_swap_allocator_test: fix small folio alignment Use ALIGNMENT_SMALLFOLIO instead of ALIGNMENT_MTHP when allocating small folios to ensure correct memory alignment for the test case. Before: test allocates small folios with 64KB alignment (ALIGNMENT_MTHP) when only 4KB alignment (ALIGNMENT_SMALLFOLIO) is needed. This wastes address space and may cause allocation failures on systems with fragmented memory. Worst-case impact: this only affects thp_swap_allocator_test tool behavior. Link: https://lkml.kernel.org/r/20251209031745.2723120-1-kaushlendra.kumar@intel.com Signed-off-by: Kaushlendra Kumar Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 6e4930e33329eec80dd245f28b52202271f5fb28 Author: Enze Li Date: Wed Dec 10 13:25:08 2025 +0800 mm/damon/core: fix wasteful CPU calls by skipping non-existent targets Currently, DAMON does not proactively clean up invalid monitoring targets during its runtime. When some monitored processes exit, DAMON continues to make the following unnecessary function calls, --damon_for_each_target-- --damon_for_each_region-- damon_do_apply_schemes damos_apply_scheme damon_va_apply_scheme damos_madvise damon_get_mm it is only in the damon_get_mm() function that it may finally discover the target no longer exists, which wastes CPU resources. A simple idea is to check for the existence of monitoring targets within the kdamond_need_stop() function and promptly clean up non-existent targets. However, SJ pointed out that this approach is problematic because the online commit logic incorrectly uses list indices to update the monitoring state. This can lead to data loss if the target list is changed concurrently. Meanwhile, SJ suggests checking for target existence at the damon_for_each_target level, and if a target does not exist, simply skip it and proceed to the next one. Link: https://lkml.kernel.org/r/20251210052508.264433-1-lienze@kylinos.cn Signed-off-by: Enze Li Suggested-by: SeongJae Park Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 16cc8b9396f6d63c1331059d67626cf907a7f23c Author: Johannes Weiner Date: Wed Dec 10 10:43:01 2025 -0500 mm: memcontrol: rename mem_cgroup_from_slab_obj() In addition to slab objects, this function is used for resolving non-slab kernel pointers. This has caused confusion in recent refactoring work. Rename it to mem_cgroup_from_virt(), sticking with terminology established by the virt_to_() converters. Link: https://lore.kernel.org/linux-mm/20251113161424.GB3465062@cmpxchg.org/ Link: https://lkml.kernel.org/r/20251210154301.720133-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Roman Gushchin Reviewed-by: Anshuman Khandual Acked-by: Vlastimil Babka Acked-by: Shakeel Butt Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Muchun Song Signed-off-by: Andrew Morton commit 055059ed720ec7546d2bf7122d858814a9f84741 Author: Chen Ridong Date: Thu Dec 11 01:30:19 2025 +0000 memcg: remove mem_cgroup_size() The mem_cgroup_size helper is used only in apply_proportional_protection to read the current memory usage. Its semantics are unclear and inconsistent with other sites, which directly call page_counter_read for the same purpose. Remove this helper and get its usage via mem_cgroup_protection for clarity. Additionally, rename the local variable 'cgroup_size' to 'usage' to better reflect its meaning. No functional changes intended. Link: https://lkml.kernel.org/r/20251211013019.2080004-3-chenridong@huaweicloud.com Signed-off-by: Chen Ridong Acked-by: Johannes Weiner Acked-by: Michal Hocko Acked-by: Shakeel Butt Cc: Michal Koutný Cc: Axel Rasmussen Cc: Lorenzo Stoakes Cc: Lu Jialin Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 558605a530e079a59bafe4877b06100055f7d91d Author: Chen Ridong Date: Thu Dec 11 01:30:18 2025 +0000 memcg: move mem_cgroup_usage memcontrol-v1.c Patch series "memcg cleanups", v3. Two code moves/removals with no behavior change. This patch (of 2): Currently, mem_cgroup_usage is only used for v1, just move it to memcontrol-v1.c Link: https://lkml.kernel.org/r/20251211013019.2080004-1-chenridong@huaweicloud.com Link: https://lkml.kernel.org/r/20251211013019.2080004-2-chenridong@huaweicloud.com Signed-off-by: Chen Ridong Acked-by: Michal Hocko Acked-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Michal Koutný Cc: Axel Rasmussen Cc: Lorenzo Stoakes Cc: Lu Jialin Cc: Muchun Song Cc: Qi Zheng Cc: Roman Gushchin Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 85aa39197420c2eb3cfad4cdfe499bb9b18fafbd Author: Johannes Weiner Date: Wed Dec 10 21:56:45 2025 -0500 mm: zswap: delete unused acomp->is_sleepable This hasn't been used since 7d4c9629b74f ("mm: zswap: use object read/write APIs instead of object mapping APIs"). Drop it. Link: https://lkml.kernel.org/r/20251211025645.820517-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Chengming Zhou Reviewed-by: Anshuman Khandual Acked-by: Yosry Ahmed Acked-by: Nhat Pham Signed-off-by: Andrew Morton commit cc05d5d94bda595e66cf68a90b313baff5dc20ab Author: Swaraj Gaikwad Date: Thu Dec 11 03:27:22 2025 +0000 mm/damon/sysfs-schemes: remove outdated TODO in target_nid_store() The TODO comment in target_nid_store() suggested adding range validation for target_nid. As discussed in [1], the current behavior of accepting any integer value is intentional. DAMON sysfs aims to remain flexible, including supporting users who prepare node IDs before future NUMA hotplug events. Because this behavior matches the broader design philosophy of the DAMON sysfs interface, the TODO comment is now misleading. This patch removes the comment without introducing any behavioral change. No functional changes. Link: https://lkml.kernel.org/r/20251211032722.4928-2-swarajgaikwad1925@gmail.com Link: https://lore.kernel.org/lkml/20251210150930.57679-1-sj@kernel.org/ [1] Signed-off-by: Swaraj Gaikwad Suggested-by: SeongJae Park Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 93552c9a3350fff06543da18e4c80d3e804191ca Author: Ankur Arora Date: Tue Jan 6 23:20:09 2026 -0800 mm: folio_zero_user: cache neighbouring pages folio_zero_user() does straight zeroing without caring about temporal locality for caches. This replaced commit c6ddfb6c5890 ("mm, clear_huge_page: move order algorithm into a separate function") where we cleared a page at a time converging to the faulting page from the left and the right. To retain limited temporal locality, split the clearing in three parts: the faulting page and its immediate neighbourhood, and the regions on its left and right. We clear the local neighbourhood last to maximize chances of it sticking around in the cache. Performance === AMD Genoa (EPYC 9J14, cpus=2 sockets * 96 cores * 2 threads, memory=2.2 TB, L1d=16K/thread, L2=512K/thread, L3=2MB/thread) vm-scalability/anon-w-seq-hugetlb: this workload runs with 384 processes (one for each CPU) each zeroing anonymously mapped hugetlb memory which is then accessed sequentially. stime utime discontiguous-page 1739.93 ( +- 6.15% ) 1016.61 ( +- 4.75% ) contiguous-page 1853.70 ( +- 2.51% ) 1187.13 ( +- 3.50% ) batched-pages 1756.75 ( +- 2.98% ) 1133.32 ( +- 4.89% ) neighbourhood-last 1725.18 ( +- 4.59% ) 1123.78 ( +- 7.38% ) Both stime and utime largely respond somewhat expectedly. There is a fair amount of run to run variation but the general trend is that the stime drops and utime increases. There are a few oddities, like contiguous-page performing very differently from batched-pages. As such this is likely an uncommon pattern where we saturate the memory bandwidth (since all CPUs are running the test) and at the same time are cache constrained because we access the entire region. Kernel make (make -j 12 bzImage): stime utime discontiguous-page 199.29 ( +- 0.63% ) 1431.67 ( +- .04% ) contiguous-page 193.76 ( +- 0.58% ) 1433.60 ( +- .05% ) batched-pages 193.92 ( +- 0.76% ) 1431.04 ( +- .08% ) neighbourhood-last 194.46 ( +- 0.68% ) 1431.51 ( +- .06% ) For make the utime stays relatively flat with a fairly small (-2.4%) improvement in the stime. Link: https://lkml.kernel.org/r/20260107072009.1615991-9-ankur.a.arora@oracle.com Signed-off-by: Ankur Arora Reviewed-by: Raghavendra K T Tested-by: Raghavendra K T Acked-by: David Hildenbrand (Red Hat) Cc: Andy Lutomirski Cc: "Borislav Petkov (AMD)" Cc: Boris Ostrovsky Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Konrad Rzessutek Wilk Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Li Zhe Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 94962b2628e6af2c48be6ebdf9f76add28d60ecc Author: Ankur Arora Date: Tue Jan 6 23:20:08 2026 -0800 mm: folio_zero_user: clear page ranges Use batch clearing in clear_contig_highpages() instead of clearing a single page at a time. Exposing larger ranges enables the processor to optimize based on extent. To do this we just switch to using clear_user_highpages() which would in turn use clear_user_pages() or clear_pages(). Batched clearing, when running under non-preemptible models, however, has latency considerations. In particular, we need periodic invocations of cond_resched() to keep to reasonable preemption latencies. This is a problem because the clearing primitives do not, or might not be able to, call cond_resched() to check if preemption is needed. So, limit the worst case preemption latency by doing the clearing in units of no more than PROCESS_PAGES_NON_PREEMPT_BATCH pages. (Preemptible models already define away most of cond_resched(), so the batch size is ignored when running under those.) PROCESS_PAGES_NON_PREEMPT_BATCH: for architectures with "fast" clear-pages (ones that define clear_pages()), we define it as 32MB worth of pages. This is meant to be large enough to allow the processor to optimize the operation and yet small enough that we see reasonable preemption latency for when this optimization is not possible (ex. slow microarchitectures, memory bandwidth saturation.) This specific value also allows for a cacheline allocation elision optimization (which might help unrelated applications by not evicting potentially useful cache lines) that kicks in recent generations of AMD Zen processors at around LLC-size (32MB is a typical size). At the same time 32MB is small enough that even with poor clearing bandwidth (say ~10GBps), time to clear 32MB should be well below the scheduler's default warning threshold (sysctl_resched_latency_warn_ms=100). "Slow" architectures (don't have clear_pages()) will continue to use the base value (single page). Performance == Testing a demand fault workload shows a decent improvement in bandwidth with pg-sz=1GB. Bandwidth with pg-sz=2MB stays flat. $ perf bench mem mmap -p $pg-sz -f demand -s 64GB -l 5 contiguous-pages batched-pages (GBps +- %stdev) (GBps +- %stdev) pg-sz=2MB 23.58 +- 1.95% 25.34 +- 1.18% + 7.50% preempt=* pg-sz=1GB 25.09 +- 0.79% 39.22 +- 2.32% + 56.31% preempt=none|voluntary pg-sz=1GB 25.71 +- 0.03% 52.73 +- 0.20% [#] +110.16% preempt=full|lazy [#] We perform much better with preempt=full|lazy because, not needing explicit invocations of cond_resched() we can clear the full extent (pg-sz=1GB) as a single unit which the processor can optimize for. (Unless otherwise noted, all numbers are on AMD Genoa (EPYC 9J13); region-size=64GB, local node; 2.56 GHz, boost=0.) Analysis == pg-sz=1GB: the improvement we see falls in two buckets depending on the batch size in use. For batch-size=32MB the number of cachelines allocated (L1-dcache-loads) -- which stay relatively flat for smaller batches, start to drop off because cacheline allocation elision kicks in. And as can be seen below, at batch-size=1GB, we stop allocating cachelines almost entirely. (Not visible here but from testing with intermediate sizes, the allocation change kicks in only at batch-size=32MB and ramps up from there.) contigous-pages 6,949,417,798 L1-dcache-loads # 883.599 M/sec ( +- 0.01% ) (35.75%) 3,226,709,573 L1-dcache-load-misses # 46.43% of all L1-dcache accesses ( +- 0.05% ) (35.75%) batched,32MB 2,290,365,772 L1-dcache-loads # 471.171 M/sec ( +- 0.36% ) (35.72%) 1,144,426,272 L1-dcache-load-misses # 49.97% of all L1-dcache accesses ( +- 0.58% ) (35.70%) batched,1GB 63,914,157 L1-dcache-loads # 17.464 M/sec ( +- 8.08% ) (35.73%) 22,074,367 L1-dcache-load-misses # 34.54% of all L1-dcache accesses ( +- 16.70% ) (35.70%) The dropoff is also visible in L2 prefetch hits (miss numbers are on similar lines): contiguous-pages 3,464,861,312 l2_pf_hit_l2.all # 437.722 M/sec ( +- 0.74% ) (15.69%) batched,32MB 883,750,087 l2_pf_hit_l2.all # 181.223 M/sec ( +- 1.18% ) (15.71%) batched,1GB 8,967,943 l2_pf_hit_l2.all # 2.450 M/sec ( +- 17.92% ) (15.77%) This largely decouples the frontend from the backend since the clearing operation does not need to wait on loads from memory (we still need cacheline ownership but that's a shorter path). This is most visible if we rerun the test above with (boost=1, 3.66 GHz). $ perf bench mem mmap -p $pg-sz -f demand -s 64GB -l 5 contiguous-pages batched-pages (GBps +- %stdev) (GBps +- %stdev) pg-sz=2MB 26.08 +- 1.72% 26.13 +- 0.92% - preempt=* pg-sz=1GB 26.99 +- 0.62% 48.85 +- 2.19% + 80.99% preempt=none|voluntary pg-sz=1GB 27.69 +- 0.18% 75.18 +- 0.25% +171.50% preempt=full|lazy Comparing the batched-pages numbers from the boost=0 ones and these: for a clock-speed gain of 42% we gain 24.5% for batch-size=32MB and 42.5% for batch-size=1GB. In comparison the baseline contiguous-pages case and both the pg-sz=2MB ones are largely backend bound so gain no more than ~10%. Other platforms tested, Intel Icelakex (Oracle X9) and ARM64 Neoverse-N1 (Ampere Altra) both show an improvement of ~35% for pg-sz=2MB|1GB. The first goes from around 8GBps to 11GBps and the second from 32GBps to 44 GBPs. [ankur.a.arora@oracle.com: move the unit computation and make it a const Link: https://lkml.kernel.org/r/20260108060406.1693853-1-ankur.a.arora@oracle.com Link: https://lkml.kernel.org/r/20260107072009.1615991-8-ankur.a.arora@oracle.com Signed-off-by: Ankur Arora Acked-by: David Hildenbrand (Red Hat) Cc: Andy Lutomirski Cc: "Borislav Petkov (AMD)" Cc: Boris Ostrovsky Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Konrad Rzessutek Wilk Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Li Zhe Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9890ecab6ad9c0d3d342469f3b619fd704b5c59a Author: Ankur Arora Date: Tue Jan 6 23:20:07 2026 -0800 mm: folio_zero_user: clear pages sequentially process_huge_pages(), used to clear hugepages, is optimized for cache locality. In particular it processes a hugepage in 4KB page units and in a difficult to predict order: clearing pages in the periphery in a backwards or forwards direction, then converging inwards to the faulting page (or page specified via base_addr.) This helps maximize temporal locality at time of access. However, while it keeps stores inside a 4KB page sequential, pages are ordered semi-randomly in a way that is not easy for the processor to predict. This limits the clearing bandwidth to what's available in a 4KB page. Consider the baseline bandwidth: $ perf bench mem mmap -p 2MB -f populate -s 64GB -l 3 # Running 'mem/mmap' benchmark: # function 'populate' (Eagerly populated mmap()) # Copying 64GB bytes ... 11.791097 GB/sec (Unless otherwise noted, all numbers are on AMD Genoa (EPYC 9J13); region-size=64GB, local node; 2.56 GHz, boost=0.) 11.79 GBps amounts to around 323ns/4KB. With memory access latency of ~100ns, that doesn't leave much time to help from, say, hardware prefetchers. (Note that since this is a purely write workload, it's reasonable to assume that the processor does not need to prefetch any cachelines. However, for a processor to skip the prefetch, it would need to look at the access pattern, and see that full cachelines were being written. This might be easily visible if clear_page() was using, say x86 string instructions; less so if it were using a store loop. In any case, the existence of these kind predictors or appropriately helpful threshold values is implementation specific. Additionally, even when the processor can skip the prefetch, coherence protocols will still need to establish exclusive ownership necessitating communication with remote caches.) With that, the change is quite straight-forward. Instead of clearing pages discontiguously, clear contiguously: switch to a loop around clear_user_highpage(). Performance == Testing a demand fault workload shows a decent improvement in bandwidth with pg-sz=2MB. Performance of pg-sz=1GB does not change because it has always used straight clearing. $ perf bench mem mmap -p $pg-sz -f demand -s 64GB -l 5 discontiguous-pages contiguous-pages (baseline) (GBps +- %stdev) (GBps +- %stdev) pg-sz=2MB 11.76 +- 1.10% 23.58 +- 1.95% +100.51% pg-sz=1GB 24.85 +- 2.41% 25.40 +- 1.33% - Analysis (pg-sz=2MB) == At L1 data cache level, nothing changes. The processor continues to access the same number of cachelines, allocating and missing them as it writes to them. discontiguous-pages 7,394,341,051 L1-dcache-loads # 445.172 M/sec ( +- 0.04% ) (35.73%) 3,292,247,227 L1-dcache-load-misses # 44.52% of all L1-dcache accesses ( +- 0.01% ) (35.73%) contiguous-pages 7,205,105,282 L1-dcache-loads # 861.895 M/sec ( +- 0.02% ) (35.75%) 3,241,584,535 L1-dcache-load-misses # 44.99% of all L1-dcache accesses ( +- 0.00% ) (35.74%) The L2 prefetcher, however, is now able to prefetch ~22% more cachelines (L2 prefetch miss rate also goes up significantly showing that we are backend limited): discontiguous-pages 2,835,860,245 l2_pf_hit_l2.all # 170.242 M/sec ( +- 0.12% ) (15.65%) contiguous-pages 3,472,055,269 l2_pf_hit_l2.all # 411.319 M/sec ( +- 0.62% ) (15.67%) That sill leaves a large gap between the ~22% improvement in prefetch and the ~100% improvement in bandwidth but better prefetching seems to streamline the traffic well enough that most of the data starts comes from the L2 leading to substantially fewer cache-misses at the LLC: discontiguous-pages 8,493,499,137 cache-references # 511.416 M/sec ( +- 0.15% ) (50.01%) 930,501,344 cache-misses # 10.96% of all cache refs ( +- 0.52% ) (50.01%) contiguous-pages 9,421,926,416 cache-references # 1.120 G/sec ( +- 0.09% ) (50.02%) 68,787,247 cache-misses # 0.73% of all cache refs ( +- 0.15% ) (50.03%) In addition, there are a few minor frontend optimizations: clear_pages() on x86 is now fully inlined, so we don't have a CALL/RET pair (which isn't free when using RETHUNK speculative execution mitigation as we do on my test system.) The loop in clear_contig_highpages() is also easier to predict (especially when handling faults) as compared to that in process_huge_pages(). discontiguous-pages 980,014,411 branches # 59.005 M/sec (31.26%) discontiguous-pages 180,897,177 branch-misses # 18.46% of all branches (31.26%) contiguous-pages 515,630,550 branches # 62.654 M/sec (31.27%) contiguous-pages 78,039,496 branch-misses # 15.13% of all branches (31.28%) Note that although clearing contiguously is easier to optimize for the processor, it does not, sadly, mean that the processor will necessarily take advantage of it. For instance this change does not result in any improvement in my tests on Intel Icelakex (Oracle X9), or on ARM64 Neoverse-N1 (Ampere Altra). Link: https://lkml.kernel.org/r/20260107072009.1615991-7-ankur.a.arora@oracle.com Signed-off-by: Ankur Arora Reviewed-by: Raghavendra K T Tested-by: Raghavendra K T Acked-by: David Hildenbrand (Red Hat) Cc: Andy Lutomirski Cc: "Borislav Petkov (AMD)" Cc: Boris Ostrovsky Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Konrad Rzessutek Wilk Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Li Zhe Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit cb431accb36e51b64ce34b5cc4d5ed292895fd84 Author: Ankur Arora Date: Tue Jan 6 23:20:06 2026 -0800 x86/clear_page: introduce clear_pages() Performance when clearing with string instructions (x86-64-stosq and similar) can vary significantly based on the chunk-size used. $ perf bench mem memset -k 4KB -s 4GB -f x86-64-stosq # Running 'mem/memset' benchmark: # function 'x86-64-stosq' (movsq-based memset() in arch/x86/lib/memset_64.S) # Copying 4GB bytes ... 13.748208 GB/sec $ perf bench mem memset -k 2MB -s 4GB -f x86-64-stosq # Running 'mem/memset' benchmark: # function 'x86-64-stosq' (movsq-based memset() in # arch/x86/lib/memset_64.S) # Copying 4GB bytes ... 15.067900 GB/sec $ perf bench mem memset -k 1GB -s 4GB -f x86-64-stosq # Running 'mem/memset' benchmark: # function 'x86-64-stosq' (movsq-based memset() in arch/x86/lib/memset_64.S) # Copying 4GB bytes ... 38.104311 GB/sec (Both on AMD Milan.) With a change in chunk-size from 4KB to 1GB, we see the performance go from 13.7 GB/sec to 38.1 GB/sec. For the chunk-size of 2MB the change isn't quite as drastic but it is worth adding a clear_page() variant that can handle contiguous page-extents. Link: https://lkml.kernel.org/r/20260107072009.1615991-6-ankur.a.arora@oracle.com Signed-off-by: Ankur Arora Tested-by: Raghavendra K T Reviewed-by: David Hildenbrand (Red Hat) Cc: Andy Lutomirski Cc: "Borislav Petkov (AMD)" Cc: Boris Ostrovsky Cc: David Hildenbrand Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Konrad Rzessutek Wilk Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Li Zhe Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 54a6b89a3db2ecb4462abcd6e6e52dfebaa7e6c4 Author: Ankur Arora Date: Tue Jan 6 23:20:05 2026 -0800 x86/mm: simplify clear_page_* clear_page_rep() and clear_page_erms() are wrappers around "REP; STOS" variations. Inlining gets rid of an unnecessary CALL/RET (which isn't free when using RETHUNK speculative execution mitigations.) Fixup and rename clear_page_orig() to adapt to the changed calling convention. Also add a comment from Dave Hansen detailing various clearing mechanisms used in clear_page(). Link: https://lkml.kernel.org/r/20260107072009.1615991-5-ankur.a.arora@oracle.com Signed-off-by: Ankur Arora Tested-by: Raghavendra K T Reviewed-by: Borislav Petkov (AMD) Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: David Hildenbrand Cc: David Hildenbrand Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Konrad Rzessutek Wilk Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Li Zhe Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 8d846b723e5723d98d859df9feeab89c2c889fb2 Author: Ankur Arora Date: Tue Jan 6 23:20:04 2026 -0800 highmem: introduce clear_user_highpages() Define clear_user_highpages() which uses the range clearing primitive, clear_user_pages(). We can safely use this when CONFIG_HIGHMEM is disabled and if the architecture does not have clear_user_highpage. The first is needed to ensure that contiguous page ranges stay contiguous which precludes intermediate maps via HIGMEM. The second, because if the architecture has clear_user_highpage(), it likely needs flushing magic when clearing the page, magic that we aren't privy to. For both of those cases, just fallback to a loop around clear_user_highpage(). Link: https://lkml.kernel.org/r/20260107072009.1615991-4-ankur.a.arora@oracle.com Signed-off-by: Ankur Arora Acked-by: David Hildenbrand (Red Hat) Cc: Andy Lutomirski Cc: "Borislav Petkov (AMD)" Cc: Boris Ostrovsky Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Konrad Rzessutek Wilk Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Li Zhe Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 62a9f5a85b98d6d2d9b5e0d67b2d4e5903bc53ec Author: Ankur Arora Date: Tue Jan 6 23:20:03 2026 -0800 mm: introduce clear_pages() and clear_user_pages() Introduce clear_pages(), to be overridden by architectures that support more efficient clearing of consecutive pages. Also introduce clear_user_pages(), however, we will not expect this function to be overridden anytime soon. As we do for clear_user_page(), define clear_user_pages() only if the architecture does not define clear_user_highpage(). That is because if the architecture does define clear_user_highpage(), then it likely needs some flushing magic when clearing user pages or highpages. This means we can get away without defining clear_user_pages(), since, much like its single page sibling, its only potential user is the generic clear_user_highpages() which should instead be using clear_user_highpage(). Link: https://lkml.kernel.org/r/20260107072009.1615991-3-ankur.a.arora@oracle.com Signed-off-by: Ankur Arora Acked-by: David Hildenbrand (Red Hat) Cc: Andy Lutomirski Cc: "Borislav Petkov (AMD)" Cc: Boris Ostrovsky Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Konrad Rzessutek Wilk Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Li Zhe Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 8e38607aa4aa8ee7ad4058d183465d248d04dca4 Author: David Hildenbrand Date: Tue Jan 6 23:20:02 2026 -0800 treewide: provide a generic clear_user_page() variant Patch series "mm: folio_zero_user: clear page ranges", v11. This series adds clearing of contiguous page ranges for hugepages. The series improves on the current discontiguous clearing approach in two ways: - clear pages in a contiguous fashion. - use batched clearing via clear_pages() wherever exposed. The first is useful because it allows us to make much better use of hardware prefetchers. The second, enables advertising the real extent to the processor. Where specific instructions support it (ex. string instructions on x86; "mops" on arm64 etc), a processor can optimize based on this because, instead of seeing a sequence of 8-byte stores, or a sequence of 4KB pages, it sees a larger unit being operated on. For instance, AMD Zen uarchs (for extents larger than LLC-size) switch to a mode where they start eliding cacheline allocation. This is helpful not just because it results in higher bandwidth, but also because now the cache is not evicting useful cachelines and replacing them with zeroes. Demand faulting a 64GB region shows performance improvement: $ perf bench mem mmap -p $pg-sz -f demand -s 64GB -l 5 baseline +series (GBps +- %stdev) (GBps +- %stdev) pg-sz=2MB 11.76 +- 1.10% 25.34 +- 1.18% [*] +115.47% preempt=* pg-sz=1GB 24.85 +- 2.41% 39.22 +- 2.32% + 57.82% preempt=none|voluntary pg-sz=1GB (similar) 52.73 +- 0.20% [#] +112.19% preempt=full|lazy [*] This improvement is because switching to sequential clearing allows the hardware prefetchers to do a much better job. [#] For pg-sz=1GB a large part of the improvement is because of the cacheline elision mentioned above. preempt=full|lazy improves upon that because, not needing explicit invocations of cond_resched() to ensure reasonable preemption latency, it can clear the full extent as a single unit. In comparison the maximum extent used for preempt=none|voluntary is PROCESS_PAGES_NON_PREEMPT_BATCH (32MB). When provided the full extent the processor forgoes allocating cachelines on this path almost entirely. (The hope is that eventually, in the fullness of time, the lazy preemption model will be able to do the same job that none or voluntary models are used for, allowing us to do away with cond_resched().) Raghavendra also tested previous version of the series on AMD Genoa and sees similar improvement [1] with preempt=lazy. $ perf bench mem map -p $page-size -f populate -s 64GB -l 10 base patched change pg-sz=2MB 12.731939 GB/sec 26.304263 GB/sec 106.6% pg-sz=1GB 26.232423 GB/sec 61.174836 GB/sec 133.2% This patch (of 8): Let's drop all variants that effectively map to clear_page() and provide it in a generic variant instead. We'll use the macro clear_user_page to indicate whether an architecture provides it's own variant. Also, clear_user_page() is only called from the generic variant of clear_user_highpage(), so define it only if the architecture does not provide a clear_user_highpage(). And, for simplicity define it in linux/highmem.h. Note that for parisc, clear_page() and clear_user_page() map to clear_page_asm(), so we can just get rid of the custom clear_user_page() implementation. There is a clear_user_page_asm() function on parisc, that seems to be unused. Not sure what's up with that. Link: https://lkml.kernel.org/r/20260107072009.1615991-1-ankur.a.arora@oracle.com Link: https://lkml.kernel.org/r/20260107072009.1615991-2-ankur.a.arora@oracle.com Signed-off-by: David Hildenbrand Co-developed-by: Ankur Arora Signed-off-by: Ankur Arora Cc: Andy Lutomirski Cc: Ankur Arora Cc: "Borislav Petkov (AMD)" Cc: Boris Ostrovsky Cc: David Hildenbrand Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Konrad Rzessutek Wilk Cc: Lance Yang Cc: "Liam R. Howlett" Cc: Li Zhe Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Raghavendra K T Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 8b05d2d8af817c6a1e23032df51e7ad83030d543 Author: Sergey Senozhatsky Date: Thu Jan 15 12:30:06 2026 +0900 zram: fixup read_block_state() ac_time is now in seconds, do not use ktime_to_timespec64() [akpm@linux-foundation.org: remove now-unused local `ts'] [akpm@linux-foundation.org: fix build] Link: https://lkml.kernel.org/r/20260115033031.3818977-1-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reported-by: Chris Mason Closes: https://lkml.kernel.org/r/20260114124522.1326519-1-clm@meta.com Cc: Brian Geffon Cc: David Stevens Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit 4932844eb87076a8c51bc6bcf8bfcf7ad30edd75 Author: Sergey Senozhatsky Date: Mon Dec 15 14:47:13 2025 +0900 zram: trivial fix of recompress_slot() coding styles A minor fixup of 80-cols breakage in recompress_slot() comment and zs_malloc() call. Link: https://lkml.kernel.org/r/ff3254847dbdc6fbd2e3fed53c572a261d60b7b6.1765775954.git.senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: David Stevens Cc: Minchan Kim Cc: Richard Chang Cc: Chris Mason Signed-off-by: Andrew Morton commit bde60fe747216d3449a1a74f07937a5273717b69 Author: Sergey Senozhatsky Date: Mon Dec 15 14:47:12 2025 +0900 zram: rename internal slot API We have a somewhat confusing internal API naming. E.g. the following code: zram_slot_lock() if (zram_allocated()) zram_set_flag() zram_slot_unlock() may look like it does something on zram device level, but in fact it tests and sets slot entry flags, not the device ones. Rename API to explicitly distinguish functions that operate on the slot level from functions that operate on the zram device level. While at it, fixup some coding styles. [senozhatsky@chromium.org: fix up mark_slot_accessed()] Link: https://lkml.kernel.org/r/20260115031922.3813659-1-senozhatsky@chromium.org Link: https://lkml.kernel.org/r/775a0b1a0ace5caf1f05965d8bc637c1192820fa.1765775954.git.senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: David Stevens Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit 2e8ff2f51dde73a26b94aed2df4827177bd25e6e Author: Sergey Senozhatsky Date: Mon Dec 15 14:47:11 2025 +0900 zram: use u32 for entry ac_time tracking We can reduce sizeof(zram_table_entry) on 64-bit systems by converting flags and ac_time to u32. Entry flags fit into u32, and for ac_time u32 gives us over a century of entry lifespan (approx 136 years) which is plenty (zram uses system boot time (seconds)). In struct zram_table_entry we use bytes aliasing, because bit-wait API (for slot lock) requires a whole unsigned long word. Link: https://lkml.kernel.org/r/d7c0b48450c70eeb5fd8acd6ecd23593f30dbf1f.1765775954.git.senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Suggested-by: David Stevens Cc: Brian Geffon Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit 0327a862135b0b0b5e67f1434468326b733562bf Author: Sergey Senozhatsky Date: Mon Dec 1 18:47:54 2025 +0900 zram: consolidate device-attr declarations Do not spread device attributes declarations across the file, move io_stat, mm_stat, debug_stat to a common device-attr section. Link: https://lkml.kernel.org/r/20251201094754.4149975-8-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: David Stevens Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit 0d38260c2a11de147f0c4701b344fdfa6bcdd04c Author: Sergey Senozhatsky Date: Mon Dec 1 18:47:53 2025 +0900 zram: switch to guard() for init_lock Use init_lock guard() in sysfs store/show handlers, in order to simplify and, more importantly, to modernize the code. While at it, fix up more coding styles. Link: https://lkml.kernel.org/r/20251201094754.4149975-7-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: David Stevens Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit 7ad688c0cdc46d01fc46f6d226813715542c531e Author: Sergey Senozhatsky Date: Mon Dec 1 18:47:52 2025 +0900 zram: rename zram_free_page() We don't free page in zram_free_page(), not all slots even have any memory associated with them (e.g. ZRAM_SAME). We free the slot (or reset it), rename the function accordingly. Link: https://lkml.kernel.org/r/20251201094754.4149975-6-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: David Stevens Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit 910bbb441c004050e188dd8da5071054099e592c Author: Sergey Senozhatsky Date: Mon Dec 1 18:47:51 2025 +0900 zram: move bd_stat to writeback section Move bd_stat function and attribute declaration to existing CONFIG_WRITEBACK ifdef-sections. Link: https://lkml.kernel.org/r/20251201094754.4149975-5-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: David Stevens Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit 2502673aed6c66befc7efc2dc008e2a8a50508cd Author: Sergey Senozhatsky Date: Mon Dec 1 18:47:50 2025 +0900 zram: document writeback_batch_size Add missing writeback_batch_size documentation. Link: https://lkml.kernel.org/r/20251201094754.4149975-4-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: David Stevens Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit 4c1d61389e8e4307449eb2ebad997241cbf08fef Author: Richard Chang Date: Mon Dec 1 18:47:49 2025 +0900 zram: introduce writeback_compressed device attribute Introduce witeback_compressed device attribute to toggle compressed writeback (decompression on demand) feature. [senozhatsky@chromium.org: rewrote original patch, added documentation] Link: https://lkml.kernel.org/r/20251201094754.4149975-3-senozhatsky@chromium.org Signed-off-by: Richard Chang Co-developed-by: Sergey Senozhatsky Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: David Stevens Cc: Minchan Kim Signed-off-by: Andrew Morton commit d38fab605c66778a8ddfbe2ac66c3a3eb7b2295a Author: Richard Chang Date: Mon Dec 1 18:47:48 2025 +0900 zram: introduce compressed data writeback Patch series "zram: introduce compressed data writeback", v2. As writeback becomes more common there is another shortcoming that needs to be addressed - compressed data writeback. Currently zram does uncompressed data writeback which is not optimal due to potential CPU and battery wastage. This series changes suboptimal uncompressed writeback to a more optimal compressed data writeback. This patch (of 7): zram stores all written back slots raw, which implies that during writeback zram first has to decompress slots (except for ZRAM_HUGE slots, which are raw already). The problem with this approach is that not every written back page gets read back (either via read() or via page-fault), which means that zram basically wastes CPU cycles and battery decompressing such slots. This changes with introduction of decompression on demand, in other words decompression on read()/page-fault. One caveat of decompression on demand is that async read is completed in IRQ context, while zram decompression is sleepable. To workaround this, read-back decompression is offloaded to a preemptible context - system high-prio work-queue. At this point compressed writeback is still disabled, a follow up patch will introduce a new device attribute which will make it possible to toggle compressed writeback per-device. [senozhatsky@chromium.org: rewrote original implementation] Link: https://lkml.kernel.org/r/20251201094754.4149975-1-senozhatsky@chromium.org Link: https://lkml.kernel.org/r/20251201094754.4149975-2-senozhatsky@chromium.org Signed-off-by: Richard Chang Co-developed-by: Sergey Senozhatsky Suggested-by: Minchan Kim Suggested-by: Brian Geffon Cc: David Stevens Signed-off-by: Andrew Morton commit 7adc97bc93946e55fc6af30a03d296fb833a28df Author: Andrew Morton Date: Mon Dec 15 11:05:56 2025 -0800 mm/vmscan.c:shrink_folio_list(): save a tabstop We have some needlessly deep indentation in this huge function due to if (expr1) { if (expr2) { ... } } Convert this to if (expr1 && expr2) { ... } Also, reflow that big block comment to fit in 80 cols. Cc: Johannes Weiner Cc: David Hildenbrand Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Cc: Lorenzo Stoakes Cc: Axel Rasmussen Cc: Yuanchu Xie Cc: Wei Xu Signed-off-by: Andrew Morton commit bf3480d7d0bce40d8687559fd6ff40c233a7052f Author: Weilin Tong Date: Mon Dec 15 10:46:32 2025 +0800 mm/shmem: add mTHP swpout fallback statistics in shmem_writeout() Currently, when shmem mTHPs are split and swapped out via shmem_writeout(), there are no unified statistics to trace these mTHP swpout fallback events. This makes it difficult to analyze the prevalence of mTHP splitting and fallback during swap operations, which is important for memory diagnostics. Here we add statistics counting for mTHP fallback to small pages when splitting and swapping out in shmem_writeout(). Link: https://lkml.kernel.org/r/20251215024632.250149-1-tongweilin@linux.alibaba.com Signed-off-by: Weilin Tong Reviewed-by: Baolin Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton commit ee628d9cc8d5b96fdceeb270cf662efc4f85f2b6 Author: Kevin Brodsky Date: Mon Dec 15 15:03:23 2025 +0000 mm: add basic tests for lazy_mmu Add basic KUnit tests for the generic aspects of the lazy MMU mode: ensure that it appears active when it should, depending on how enable/disable and pause/resume pairs are nested. [akpm@linux-foundation.org: export ppc64_tlb_batch and __flush_tlb_pending to modules] [ritesh.list@gmail.com: use EXPORT_SYMBOL_IF_KUNIT()] Link: https://lkml.kernel.org/r/87a4zhkt6h.ritesh.list@gmail.com [kevin.brodsky@arm.com: move MODULE_IMPORT_NS(), add comment] Link: https://lkml.kernel.org/r/20251217163812.2633648-2-kevin.brodsky@arm.com Link: https://lkml.kernel.org/r/20251215150323.2218608-15-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Reviewed-by: Yeoreum Yun Signed-off-by: Ritesh Harjani (IBM) Acked-by: David Hildenbrand (Red Hat) Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 291b3abed657cb3c485cce7753e0913dc408cf85 Author: Kevin Brodsky Date: Mon Dec 15 15:03:22 2025 +0000 x86/xen: use lazy_mmu_state when context-switching We currently set a TIF flag when scheduling out a task that is in lazy MMU mode, in order to restore it when the task is scheduled again. The generic lazy_mmu layer now tracks whether a task is in lazy MMU mode in task_struct::lazy_mmu_state. We can therefore check that state when switching to the new task, instead of using a separate TIF flag. Link: https://lkml.kernel.org/r/20251215150323.2218608-14-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Juergen Gross Reviewed-by: Yeoreum Yun Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit dacd24ec4965d92cd5ef338c2b86d5e7e3722bed Author: Kevin Brodsky Date: Mon Dec 15 15:03:21 2025 +0000 sparc/mm: replace batch->active with is_lazy_mmu_mode_active() A per-CPU batch struct is activated when entering lazy MMU mode; its lifetime is the same as the lazy MMU section (it is deactivated when leaving the mode). Preemption is disabled in that interval to ensure that the per-CPU reference remains valid. The generic lazy_mmu layer now tracks whether a task is in lazy MMU mode. We can therefore use the generic helper is_lazy_mmu_mode_active() to tell whether a batch struct is active instead of tracking it explicitly. Link: https://lkml.kernel.org/r/20251215150323.2218608-13-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Yeoreum Yun Acked-by: Andreas Larsson Cc: Alexander Gordeev Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 313a05a15a1b29c29c7eb4ae8cf44a7cf0fcf419 Author: Kevin Brodsky Date: Mon Dec 15 15:03:20 2025 +0000 powerpc/mm: replace batch->active with is_lazy_mmu_mode_active() A per-CPU batch struct is activated when entering lazy MMU mode; its lifetime is the same as the lazy MMU section (it is deactivated when leaving the mode). Preemption is disabled in that interval to ensure that the per-CPU reference remains valid. The generic lazy_mmu layer now tracks whether a task is in lazy MMU mode. We can therefore use the generic helper is_lazy_mmu_mode_active() to tell whether a batch struct is active instead of tracking it explicitly. Link: https://lkml.kernel.org/r/20251215150323.2218608-12-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand Reviewed-by: Ritesh Harjani (IBM) Tested-by: Venkat Rao Bagalkote Reviewed-by: Yeoreum Yun Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand (Red Hat) Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 4dd9b4d7a8d5537b982a6b35a6309c0517fc3da3 Author: Kevin Brodsky Date: Mon Dec 15 15:03:19 2025 +0000 arm64: mm: replace TIF_LAZY_MMU with is_lazy_mmu_mode_active() The generic lazy_mmu layer now tracks whether a task is in lazy MMU mode. As a result we no longer need a TIF flag for that purpose - let's use the new is_lazy_mmu_mode_active() helper instead. The explicit check for in_interrupt() is no longer necessary either as is_lazy_mmu_mode_active() always returns false in interrupt context. Link: https://lkml.kernel.org/r/20251215150323.2218608-11-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 5ab246749569cff9f815618f02ba0d7cf20e5edd Author: Kevin Brodsky Date: Mon Dec 15 15:03:18 2025 +0000 mm: enable lazy_mmu sections to nest Despite recent efforts to prevent lazy_mmu sections from nesting, it remains difficult to ensure that it never occurs - and in fact it does occur on arm64 in certain situations (CONFIG_DEBUG_PAGEALLOC). Commit 1ef3095b1405 ("arm64/mm: Permit lazy_mmu_mode to be nested") made nesting tolerable on arm64, but without truly supporting it: the inner call to leave() disables the batching optimisation before the outer section ends. This patch actually enables lazy_mmu sections to nest by tracking the nesting level in task_struct, in a similar fashion to e.g. pagefault_{enable,disable}(). This is fully handled by the generic lazy_mmu helpers that were recently introduced. lazy_mmu sections were not initially intended to nest, so we need to clarify the semantics w.r.t. the arch_*_lazy_mmu_mode() callbacks. This patch takes the following approach: * The outermost calls to lazy_mmu_mode_{enable,disable}() trigger calls to arch_{enter,leave}_lazy_mmu_mode() - this is unchanged. * Nested calls to lazy_mmu_mode_{enable,disable}() are not forwarded to the arch via arch_{enter,leave} - lazy MMU remains enabled so the assumption is that these callbacks are not relevant. However, existing code may rely on a call to disable() to flush any batched state, regardless of nesting. arch_flush_lazy_mmu_mode() is therefore called in that situation. A separate interface was recently introduced to temporarily pause the lazy MMU mode: lazy_mmu_mode_{pause,resume}(). pause() fully exits the mode *regardless of the nesting level*, and resume() restores the mode at the same nesting level. pause()/resume() are themselves allowed to nest, so we actually store two nesting levels in task_struct: enable_count and pause_count. A new helper is_lazy_mmu_mode_active() is introduced to determine whether we are currently in lazy MMU mode; this will be used in subsequent patches to replace the various ways arch's currently track whether the mode is enabled. In summary (enable/pause represent the values *after* the call): lazy_mmu_mode_enable() -> arch_enter() enable=1 pause=0 lazy_mmu_mode_enable() -> ø enable=2 pause=0 lazy_mmu_mode_pause() -> arch_leave() enable=2 pause=1 lazy_mmu_mode_resume() -> arch_enter() enable=2 pause=0 lazy_mmu_mode_disable() -> arch_flush() enable=1 pause=0 lazy_mmu_mode_disable() -> arch_leave() enable=0 pause=0 Note: is_lazy_mmu_mode_active() is added to to allow arch headers included by to use it. Link: https://lkml.kernel.org/r/20251215150323.2218608-10-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Yeoreum Yun Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 9273dfaeaca8ea4d88c7e9fd081922a029984fd4 Author: Kevin Brodsky Date: Mon Dec 15 15:03:17 2025 +0000 mm: bail out of lazy_mmu_mode_* in interrupt context The lazy MMU mode cannot be used in interrupt context. This is documented in , but isn't consistently handled across architectures. arm64 ensures that calls to lazy_mmu_mode_* have no effect in interrupt context, because such calls do occur in certain configurations - see commit b81c688426a9 ("arm64/mm: Disable barrier batching in interrupt contexts"). Other architectures do not check this situation, most likely because it hasn't occurred so far. Let's handle this in the new generic lazy_mmu layer, in the same fashion as arm64: bail out of lazy_mmu_mode_* if in_interrupt(). Also remove the arm64 handling that is now redundant. Both arm64 and x86/Xen also ensure that any lazy MMU optimisation is disabled while in interrupt (see queue_pte_barriers() and xen_get_lazy_mode() respectively). This will be handled in the generic layer in a subsequent patch. Link: https://lkml.kernel.org/r/20251215150323.2218608-9-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 0a096ab7a3a6e2859c3c88988e548c5c213138bc Author: Kevin Brodsky Date: Mon Dec 15 15:03:16 2025 +0000 mm: introduce generic lazy_mmu helpers The implementation of the lazy MMU mode is currently entirely arch-specific; core code directly calls arch helpers: arch_{enter,leave}_lazy_mmu_mode(). We are about to introduce support for nested lazy MMU sections. As things stand we'd have to duplicate that logic in every arch implementing lazy_mmu - adding to a fair amount of logic already duplicated across lazy_mmu implementations. This patch therefore introduces a new generic layer that calls the existing arch_* helpers. Two pair of calls are introduced: * lazy_mmu_mode_enable() ... lazy_mmu_mode_disable() This is the standard case where the mode is enabled for a given block of code by surrounding it with enable() and disable() calls. * lazy_mmu_mode_pause() ... lazy_mmu_mode_resume() This is for situations where the mode is temporarily disabled by first calling pause() and then resume() (e.g. to prevent any batching from occurring in a critical section). The documentation in will be updated in a subsequent patch. No functional change should be introduced at this stage. The implementation of enable()/resume() and disable()/pause() is currently identical, but nesting support will change that. Most of the call sites have been updated using the following Coccinelle script: @@ @@ { ... - arch_enter_lazy_mmu_mode(); + lazy_mmu_mode_enable(); ... - arch_leave_lazy_mmu_mode(); + lazy_mmu_mode_disable(); ... } @@ @@ { ... - arch_leave_lazy_mmu_mode(); + lazy_mmu_mode_pause(); ... - arch_enter_lazy_mmu_mode(); + lazy_mmu_mode_resume(); ... } A couple of notes regarding x86: * Xen is currently the only case where explicit handling is required for lazy MMU when context-switching. This is purely an implementation detail and using the generic lazy_mmu_mode_* functions would cause trouble when nesting support is introduced, because the generic functions must be called from the current task. For that reason we still use arch_leave() and arch_enter() there. * x86 calls arch_flush_lazy_mmu_mode() unconditionally in a few places, but only defines it if PARAVIRT_XXL is selected, and we are removing the fallback in . Add a new fallback definition to to keep things building. Link: https://lkml.kernel.org/r/20251215150323.2218608-8-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand (Red Hat) Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 7303ecbfe4f46c00191b9b66acaa918784bad210 Author: Kevin Brodsky Date: Mon Dec 15 15:03:15 2025 +0000 mm: introduce CONFIG_ARCH_HAS_LAZY_MMU_MODE Architectures currently opt in for implementing lazy_mmu helpers by defining __HAVE_ARCH_ENTER_LAZY_MMU_MODE. In preparation for introducing a generic lazy_mmu layer that will require storage in task_struct, let's switch to a cleaner approach: instead of defining a macro, select a CONFIG option. This patch introduces CONFIG_ARCH_HAS_LAZY_MMU_MODE and has each arch select it when it implements lazy_mmu helpers. __HAVE_ARCH_ENTER_LAZY_MMU_MODE is removed and relies on the new CONFIG instead. On x86, lazy_mmu helpers are only implemented if PARAVIRT_XXL is selected. This creates some complications in arch/x86/boot/, because a few files manually undefine PARAVIRT* options. As a result does not define the lazy_mmu helpers, but this breaks the build as only defines them if !CONFIG_ARCH_HAS_LAZY_MMU_MODE. There does not seem to be a clean way out of this - let's just undefine that new CONFIG too. Link: https://lkml.kernel.org/r/20251215150323.2218608-7-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Ryan Roberts Reviewed-by: Yeoreum Yun Acked-by: Andreas Larsson [sparc] Cc: Alexander Gordeev Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand (Red Hat) Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit f2be745071ffd6793c032ca8443348c3ce0e3e18 Author: Kevin Brodsky Date: Mon Dec 15 15:03:14 2025 +0000 mm: clarify lazy_mmu sleeping constraints The lazy MMU mode documentation makes clear that an implementation should not assume that preemption is disabled or any lock is held upon entry to the mode; however it says nothing about what code using the lazy MMU interface should expect. In practice sleeping is forbidden (for generic code) while the lazy MMU mode is active: say it explicitly. Link: https://lkml.kernel.org/r/20251215150323.2218608-6-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Reviewed-by: Yeoreum Yun Acked-by: David Hildenbrand (Red Hat) Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 442bf488b9e876712c4c86783c3b6818c4042f26 Author: Kevin Brodsky Date: Mon Dec 15 15:03:13 2025 +0000 sparc/mm: implement arch_flush_lazy_mmu_mode() Upcoming changes to the lazy_mmu API will cause arch_flush_lazy_mmu_mode() to be called when leaving a nested lazy_mmu section. Move the relevant logic from arch_leave_lazy_mmu_mode() to arch_flush_lazy_mmu_mode() and have the former call the latter. Note: the additional this_cpu_ptr() call on the arch_leave_lazy_mmu_mode() path will be removed in a subsequent patch. Link: https://lkml.kernel.org/r/20251215150323.2218608-5-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand Reviewed-by: Yeoreum Yun Acked-by: Andreas Larsson Cc: Alexander Gordeev Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand (Red Hat) Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit c3f0778ffeca271b3b221fcdec66784c1eb9440d Author: Kevin Brodsky Date: Mon Dec 15 15:03:12 2025 +0000 powerpc/mm: implement arch_flush_lazy_mmu_mode() Upcoming changes to the lazy_mmu API will cause arch_flush_lazy_mmu_mode() to be called when leaving a nested lazy_mmu section. Move the relevant logic from arch_leave_lazy_mmu_mode() to arch_flush_lazy_mmu_mode() and have the former call the latter. The radix_enabled() check is required in both as arch_flush_lazy_mmu_mode() will be called directly from the generic layer in a subsequent patch. Note: the additional this_cpu_ptr() and radix_enabled() calls on the arch_leave_lazy_mmu_mode() path will be removed in a subsequent patch. Link: https://lkml.kernel.org/r/20251215150323.2218608-4-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Acked-by: David Hildenbrand Tested-by: Venkat Rao Bagalkote Reviewed-by: Yeoreum Yun Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand (Red Hat) Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 66bdd779d3441329d0c55af1b679d97e10e7dfde Author: Kevin Brodsky Date: Mon Dec 15 15:03:11 2025 +0000 x86/xen: simplify flush_lazy_mmu() arch_flush_lazy_mmu_mode() is called when outstanding batched pgtable operations must be completed immediately. There should however be no need to leave and re-enter lazy MMU completely. The only part of that sequence that we really need is xen_mc_flush(); call it directly. Link: https://lkml.kernel.org/r/20251215150323.2218608-3-kevin.brodsky@arm.com Signed-off-by: Kevin Brodsky Reviewed-by: David Hildenbrand Reviewed-by: Ryan Roberts Reviewed-by: Juergen Gross Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand (Red Hat) Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Ritesh Harjani (IBM) Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Venkat Rao Bagalkote Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 58852f24f9566602340130804bf7f4474a3f5f2a Author: Alexander Gordeev Date: Mon Dec 15 15:03:10 2025 +0000 powerpc/64s: do not re-activate batched TLB flush Patch series "Nesting support for lazy MMU mode", v6. When the lazy MMU mode was introduced eons ago, it wasn't made clear whether such a sequence was legal: arch_enter_lazy_mmu_mode() ... arch_enter_lazy_mmu_mode() ... arch_leave_lazy_mmu_mode() ... arch_leave_lazy_mmu_mode() It seems fair to say that nested calls to arch_{enter,leave}_lazy_mmu_mode() were not expected, and most architectures never explicitly supported it. Nesting does in fact occur in certain configurations, and avoiding it has proved difficult. This series therefore enables lazy_mmu sections to nest, on all architectures. Nesting is handled using a counter in task_struct (patch 8), like other stateless APIs such as pagefault_{disable,enable}(). This is fully handled in a new generic layer in ; the arch_* API remains unchanged. A new pair of calls, lazy_mmu_mode_{pause,resume}(), is also introduced to allow functions that are called with the lazy MMU mode enabled to temporarily pause it, regardless of nesting. An arch now opts in to using the lazy MMU mode by selecting CONFIG_ARCH_LAZY_MMU; this is more appropriate now that we have a generic API, especially with state conditionally added to task_struct. This patch (of 14): Since commit b9ef323ea168 ("powerpc/64s: Disable preemption in hash lazy mmu mode") a task can not be preempted while in lazy MMU mode. Therefore, the batch re-activation code is never called, so remove it. Link: https://lkml.kernel.org/r/20251215150323.2218608-1-kevin.brodsky@arm.com Link: https://lkml.kernel.org/r/20251215150323.2218608-2-kevin.brodsky@arm.com Signed-off-by: Alexander Gordeev Signed-off-by: Kevin Brodsky Reviewed-by: David Hildenbrand Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Ryan Roberts Tested-by: Venkat Rao Bagalkote Reviewed-by: Yeoreum Yun Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Borislav Betkov Cc: Boris Ostrovsky Cc: Catalin Marinas Cc: Christophe Leroy Cc: David S. Miller Cc: David Woodhouse Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jann Horn Cc: Juegren Gross Cc: levi.yun Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport Cc: Nicholas Piggin Cc: Peter Zijlstra Cc: Suren Baghdasaryan Cc: Thomas Gleinxer Cc: Vlastimil Babka Cc: Will Deacon Cc: David Hildenbrand (Red Hat) Signed-off-by: Andrew Morton commit 2a912d440c6024148a25850c7c4066b152ec8750 Author: Joel Granados Date: Mon Dec 15 16:47:37 2025 +0100 alloc_tag: move memory_allocation_profiling_sysctls into .rodata Remove the change in file mode permissions done before initializing the sysctl. It is not necessary as the writing of the kernel variable will be blocked by the proc_mem_profiling_handler when writing is disallowed (also controlled by mem_profiling_support). Link: https://lkml.kernel.org/r/20251215-jag-alloc_tag_const-v1-1-35ea56a1ce13@kernel.org Signed-off-by: Joel Granados Acked-by: Suren Baghdasaryan Cc: Kent Overstreet Signed-off-by: Andrew Morton commit 817383b34db1e7d2a74d2d2b51cb0eed1586253b Author: Enze Li Date: Tue Dec 2 16:23:40 2025 +0800 mm/damon/core: fix memory leak of repeat mode damon_call_control objects A memory leak exists in the handling of repeat mode damon_call_control objects by kdamond_call(). While damon_call() correctly allows multiple repeat mode objects (with ->repeat set to true) to be added to the per-context list, kdamond_call() incorrectly processes them. The function moves all repeat mode objects from the context's list to a temporary list (repeat_controls). However, it only moves the first object back to the context's list for future calls, leaving the remaining objects on the temporary list where they are abandoned and leaked. This patch fixes the leak by ensuring all repeat mode objects are properly re-added to the context's list. Note that the leak is not in the real world, and therefore no user is impacted. It is only potential for imaginaray damon_call() use cases that do not exist in the tree for now. In more detail, the leak happens only when the multiple repeat mode objects are assumed to be deallocated by kdamond_call() (damon_call_control->dealloc_on_cancel is set). There is no such damon_call() use cases at the moment. Link: https://lkml.kernel.org/r/20251202082340.34178-1-lienze@kylinos.cn Fixes: 43df7676e550 ("mm/damon/core: introduce repeat mode damon_call()") Signed-off-by: Enze Li Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit a03ed8f144e2732dbfce05d4ee5576d77aba6957 Author: Brendan Jackman Date: Mon Dec 15 10:40:25 2025 +0000 mm/vmalloc: clarify why vmap_range_noflush() might sleep The only reason vmap_range_noflush() can sleep is because of pagetable allocations. The actual allocation mechanism is arch-specific so might_alloc() doesn't work here (what GFP flags would be used?). Hence, just add a comment. Also note that this might do a TLB shootdown. This is not actually sleeping but it requires IRQs on for x86, and might_sleep() incidentally serves to detect violations of that too. Link: https://lkml.kernel.org/r/20251215-b4-vmalloc-might_alloc-v3-1-92dd8e406868@google.com Signed-off-by: Brendan Jackman Reviewed-by: Uladzislau Rezki (Sony) Reviewed-by: Anshuman Khandual Signed-off-by: Andrew Morton commit d8f87aa5fa0a4276491fa8ef436cd22605a3f9ba Author: Ethan Nelson-Moore Date: Sun Jan 18 18:24:04 2026 -0800 net: remove HIPPI support and RoadRunner HIPPI driver HIPPI has not been relevant for over two decades. It was rapidly eclipsed by Fibre Channel, and even when it was new, it was confined to very high-end hardware. The HIPPI code has only received tree-wide changes and fixes by inspection in the entire Git history. Remove HIPPI support and the rrunner HIPPI driver, and move the former maintainer to the CREDITS file. Keep the include/uapi/linux/if_hippi.h header because it is used by the TUN code, and to avoid breaking userspace, however unlikely that may be. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260119022451.22344-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit bc847787233277a337788568e90a6ee1557595eb Author: Ludovic Desroches Date: Fri Oct 24 18:14:53 2025 +0200 drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying the atmel_hlcdc_plane state structure without properly duplicating the drm_plane_state. In particular, state->commit remained set to the old state commit, which can lead to a use-after-free in the next drm_atomic_commit() call. Fix this by calling __drm_atomic_helper_duplicate_plane_state(), which correctly clones the base drm_plane_state (including the ->commit pointer). It has been seen when closing and re-opening the device node while another DRM client (e.g. fbdev) is still attached: ============================================================================= BUG kmalloc-64 (Not tainted): Poison overwritten ----------------------------------------------------------------------------- 0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 pid=29 drm_atomic_helper_setup_commit+0x1e8/0x7bc drm_atomic_helper_commit+0x3c/0x15c drm_atomic_commit+0xc0/0xf4 drm_framebuffer_remove+0x4cc/0x5a8 drm_mode_rmfb_work_fn+0x6c/0x80 process_one_work+0x12c/0x2cc worker_thread+0x2a8/0x400 kthread+0xc0/0xdc ret_from_fork+0x14/0x28 Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 pid=169 drm_atomic_helper_commit_hw_done+0x100/0x150 drm_atomic_helper_commit_tail+0x64/0x8c commit_tail+0x168/0x18c drm_atomic_helper_commit+0x138/0x15c drm_atomic_commit+0xc0/0xf4 drm_atomic_helper_set_config+0x84/0xb8 drm_mode_setcrtc+0x32c/0x810 drm_ioctl+0x20c/0x488 sys_ioctl+0x14c/0xc20 ret_fast_syscall+0x0/0x54 Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 flags=0x200(workingset|zone=0) Object 0xc611b340 @offset=832 fp=0xc611b7c0 Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com Signed-off-by: Manikandan Muralidharan commit f12352471061df83a36edf54bbb16284793284e4 Author: Ludovic Desroches Date: Fri Oct 24 18:14:52 2025 +0200 drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback After several commits, the slab memory increases. Some drm_crtc_commit objects are not freed. The atomic_destroy_state callback only put the framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function to put all the objects that are no longer needed. It has been seen after hours of usage of a graphics application or using kmemleak: unreferenced object 0xc63a6580 (size 64): comm "egt_basic", pid 171, jiffies 4294940784 hex dump (first 32 bytes): 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. backtrace (crc c25aa925): kmemleak_alloc+0x34/0x3c __kmalloc_cache_noprof+0x150/0x1a4 drm_atomic_helper_setup_commit+0x1e8/0x7bc drm_atomic_helper_commit+0x3c/0x15c drm_atomic_commit+0xc0/0xf4 drm_atomic_helper_set_config+0x84/0xb8 drm_mode_setcrtc+0x32c/0x810 drm_ioctl+0x20c/0x488 sys_ioctl+0x14c/0xc20 ret_fast_syscall+0x0/0x54 Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com Signed-off-by: Manikandan Muralidharan commit 670ade3bfae6f8a06213b65be3435b445c11c36d Author: Eric Dumazet Date: Sun Jan 18 12:32:04 2026 +0000 tcp: move tcp_rate_skb_delivered() to tcp_input.c tcp_rate_skb_delivered() is only called from tcp_input.c. Move it there and make it static. Both gcc and clang are (auto)inlining it, TCP performance is increased at a small space cost. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/2 grow/shrink: 3/0 up/down: 509/-187 (322) Function old new delta tcp_sacktag_walk 1682 1867 +185 tcp_ack 5230 5405 +175 tcp_shifted_skb 437 586 +149 __pfx_tcp_rate_skb_delivered 16 - -16 tcp_rate_skb_delivered 171 - -171 Total: Before=22566192, After=22566514, chg +0.00% Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260118123204.2315993-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2d265e2fe6f2d6370003db99c96eaff2dd1b7e43 Merge: 0d035fb5dcd925 f117205ad70b52 Author: Jakub Kicinski Date: Tue Jan 20 19:00:47 2026 -0800 Merge branch 'fix-typos-in-network-driver-code-comments' Yicong Hui says: ==================== Fix typos in network driver code comments Fix various minor typos and mispellings in 3 different driver subdirectories in drivers/net/ethernet ==================== Link: https://patch.msgid.link/20260118121001.136806-1-yiconghui@gmail.com Signed-off-by: Jakub Kicinski commit f117205ad70b52070810051391b8f6dfa671a25e Author: Yicong Hui Date: Sun Jan 18 12:10:01 2026 +0000 net/xen-netback: Fix mispelling of "Software" as "Softare" Fix misspelling of "software" as "softare" in xen-netback code comment. Signed-off-by: Yicong Hui Link: https://patch.msgid.link/20260118121001.136806-4-yiconghui@gmail.com Signed-off-by: Jakub Kicinski commit c2b733da93bf607d6c6f925b4d40598e6bb516be Author: Yicong Hui Date: Sun Jan 18 12:10:00 2026 +0000 net/micrel: Fix typos in micrel driver code comments Fix various typos and misspellings in code comments in the drivers/net/ethernet/micrel directory Signed-off-by: Yicong Hui Link: https://patch.msgid.link/20260118121001.136806-3-yiconghui@gmail.com Signed-off-by: Jakub Kicinski commit 1cbc1fe0a434b9b55934acd5f00e7fdfebd6d7c6 Author: Yicong Hui Date: Sun Jan 18 12:09:59 2026 +0000 net/benet: Fix typos in driver code comments Fix various typos and misspellings in code comments in the drivers/net/ethernet/emulex directory Signed-off-by: Yicong Hui Link: https://patch.msgid.link/20260118121001.136806-2-yiconghui@gmail.com Signed-off-by: Jakub Kicinski commit 0d035fb5dcd925385e607605c57acc7a5c6eee75 Author: Heiner Kallweit Date: Sun Jan 18 23:16:27 2026 +0100 net: phy: simplify PHY fixup registration Based on the fact that either bus_id-based matching or phy_uid-based matching is used, the code can be simplified. PHY_ANY_ID and PHY_ANY_UID are not needed. Ensure that phy_id_compare() is called only if phy_uid_mask isn't zero, because a zero value would always result in a match. In addition change the return value type of phy_needs_fixup() to bool. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/e7394cc8-5895-4d02-a8fe-802345c7c547@gmail.com Signed-off-by: Jakub Kicinski commit 1be080b78fd37fffe27b15edf19a3ff1b3867fe4 Author: Kevin Hao Date: Sat Jan 17 09:46:18 2026 +0800 net: macb: Replace open-coded device config retrieval with of_device_get_match_data() Use of_device_get_match_data() to replace the open-coded method for obtaining the device config. Additionally, adjust the ordering of local variables to ensure compatibility with RCS. Signed-off-by: Kevin Hao Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260117-macb-v1-1-f092092d8c91@gmail.com Signed-off-by: Jakub Kicinski commit 6406fc709ace081575de2a8a7eee12e63d4c96c6 Author: Sayantan Nandy Date: Mon Jan 19 13:06:58 2026 +0530 net: airoha_eth: increase max MTU to 9220 for DSA jumbo frames The industry standard jumbo frame MTU is 9216 bytes. When using the DSA subsystem, a 4-byte tag is added to each Ethernet frame. Increase AIROHA_MAX_MTU to 9220 bytes (9216 + 4) so that users can set a standard 9216-byte MTU on DSA ports. The underlying hardware supports significantly larger frame sizes (approximately 16K). However, the maximum MTU is limited to 9220 bytes for now, as this is sufficient to support standard jumbo frames and does not incur additional memory allocation overhead. Signed-off-by: Sayantan Nandy Reviewed-by: Andrew Lunn Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260119073658.6216-1-sayantann11@gmail.com Signed-off-by: Jakub Kicinski commit 2ec113ee41b632492baba09f3527a0ae292a747b Author: Simon Horman Date: Mon Jan 19 16:39:37 2026 +0000 octeontx2-pf: Remove unnecessary bounds check active_fec is a 2-bit unsigned field, and thus can only have the values 0-3. So checking that it is less than 4 is unnecessary. Simplify the code by dropping this check. As it no longer fits well where it is, move FEC_MAX_INDEX to towards the top of the file. And add the prefix OXT2. I believe this is more idiomatic. Flagged by Smatch as: ...//otx2_ethtool.c:1024 otx2_get_fecparam() warn: always true condition '(pfvf->linfo.fec < 4) => (0-3 < 4)' No functional change intended. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Vadim Fedorenko Reviewed-by: Hariprasad Kelam Link: https://patch.msgid.link/20260119-oob-v1-1-a4147e75e770@kernel.org Signed-off-by: Jakub Kicinski commit cd18e8ac030e646ea88bad0200e0e4593a1b11b1 Author: Jakub Kicinski Date: Mon Jan 19 14:41:40 2026 -0800 net: add kdoc for napi_consume_skb() Looks like AI reviewers miss that napi_consume_skb() must have a real budget passed to it. Let's see if adding a real kdoc will help them figure this out. Reviewed-by: Jason Xing Link: https://patch.msgid.link/20260119224140.1362729-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 Author: Mingj Ye Date: Tue Jan 20 09:59:49 2026 +0800 net: usb: r8152: fix transmit queue timeout When the TX queue length reaches the threshold, the netdev watchdog immediately detects a TX queue timeout. This patch updates the trans_start timestamp of the transmit queue on every asynchronous USB URB submission along the transmit path, ensuring that the network watchdog accurately reflects ongoing transmission activity. Signed-off-by: Mingj Ye Reviewed-by: Hayes Wang Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com Signed-off-by: Jakub Kicinski commit 1802e9079f65cbe47d90d048b06df650a91407f4 Author: Jakub Kicinski Date: Tue Jan 20 10:03:19 2026 -0800 selftests: drv-net: fix missing include in ncdevmem Commit ca9d74eb5f6a ("uapi: add INT_MAX and INT_MIN constants") recently removed some includes of limits.h in uAPI headers. ncdevmem.c was depending on them: ncdevmem.c: In function ‘ethtool_add_flow’: ncdevmem.c:369:60: error: ‘INT_MAX’ undeclared (first use in this function) 369 | if (endptr == id_start || flow_id < 0 || flow_id > INT_MAX) | ^~~~~~~ ncdevmem.c:77:1: note: ‘INT_MAX’ is defined in header ‘’; did you forget to ‘#include ’? Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20260120180319.1673271-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2583cb925ca1ce450aa5d74a05a67448db970193 Author: Dmitry Baryshkov Date: Sat Jan 17 05:54:47 2026 +0200 clk: qcom: gfx3d: add parent to parent request map After commit d228ece36345 ("clk: divider: remove round_rate() in favor of determine_rate()") determining GFX3D clock rate crashes, because the passed parent map doesn't provide the expected best_parent_hw clock (with the roundd_rate path before the offending commit the best_parent_hw was ignored). Set the field in parent_req in addition to setting it in the req, fixing the crash. clk_hw_round_rate (drivers/clk/clk.c:1764) (P) clk_divider_bestdiv (drivers/clk/clk-divider.c:336) divider_determine_rate (drivers/clk/clk-divider.c:358) clk_alpha_pll_postdiv_determine_rate (drivers/clk/qcom/clk-alpha-pll.c:1275) clk_core_determine_round_nolock (drivers/clk/clk.c:1606) clk_core_round_rate_nolock (drivers/clk/clk.c:1701) __clk_determine_rate (drivers/clk/clk.c:1741) clk_gfx3d_determine_rate (drivers/clk/qcom/clk-rcg2.c:1268) clk_core_determine_round_nolock (drivers/clk/clk.c:1606) clk_core_round_rate_nolock (drivers/clk/clk.c:1701) clk_core_round_rate_nolock (drivers/clk/clk.c:1710) clk_round_rate (drivers/clk/clk.c:1804) dev_pm_opp_set_rate (drivers/opp/core.c:1440 (discriminator 1)) msm_devfreq_target (drivers/gpu/drm/msm/msm_gpu_devfreq.c:51) devfreq_set_target (drivers/devfreq/devfreq.c:360) devfreq_update_target (drivers/devfreq/devfreq.c:426) devfreq_monitor (drivers/devfreq/devfreq.c:458) process_one_work (arch/arm64/include/asm/jump_label.h:36 include/trace/events/workqueue.h:110 kernel/workqueue.c:3284) worker_thread (kernel/workqueue.c:3356 (discriminator 2) kernel/workqueue.c:3443 (discriminator 2)) kthread (kernel/kthread.c:467) ret_from_fork (arch/arm64/kernel/entry.S:861) Fixes: 55213e1acec9 ("clk: qcom: Add gfx3d ping-pong PLL frequency switching") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Brian Masney Link: https://lore.kernel.org/r/20260117-db820-fix-gfx3d-v1-1-0f8894d71d63@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 79bfa5fb85870d44a5368790dbf5ccce007e6e9f Author: Eric Dumazet Date: Fri Jan 16 16:44:02 2026 +0000 net: fclone allocation small optimization After skb allocation, initial skb->fclone value is 0 (SKB_FCLONE_UNAVAILABLE) We can replace one RMW sequence with a single OR instruction. movzbl 0x7e(%r13),%eax // skb->fclone = SKB_FCLONE_ORIG; and $0xf3,%al or $0x4,%al mov %al,0x7e(%r13) -> or $0x4,0x7e(%r13) // skb->fclone |= SKB_FCLONE_ORIG; Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260116164402.1872649-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit ee7be82f8c7e753e38dcf3add7ba65b543d49bd6 Merge: 3cc3ca6dc25a79 283d5872388709 Author: Jakub Kicinski Date: Tue Jan 20 18:24:46 2026 -0800 Merge branch 'convert-the-micrel-bindings-to-dt-schema' Stefan Eichenberger says: ==================== Convert the Micrel bindings to DT schema Convert the device tree bindings for the Micrel PHYs and switches to DT schema. ==================== Link: https://patch.msgid.link/20260116130948.79558-1-eichest@gmail.com Signed-off-by: Jakub Kicinski commit 283d58723887091eff3fd4ecc8eaa9d480d0a40e Author: Stefan Eichenberger Date: Fri Jan 16 14:09:12 2026 +0100 dt-bindings: net: micrel: Convert micrel-ksz90x1.txt to DT schema Convert the micrel-ksz90x1.txt to DT schema. Create a separate YAML file for this PHY series. The old naming of ksz90x1 would be misleading in this case, so rename it to gigabit, as it contains ksz9xx1 and lan8xxx gigabit PHYs. Signed-off-by: Stefan Eichenberger Reviewed-by: Rob Herring (Arm) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260116130948.79558-3-eichest@gmail.com Signed-off-by: Jakub Kicinski commit 4dd29c654b0abc6cf20ab4832185ca5f2723cde5 Author: Stefan Eichenberger Date: Fri Jan 16 14:09:11 2026 +0100 dt-bindings: net: micrel: Convert to DT schema Convert the devicetree bindings for the Micrel PHYs and switches to DT schema. Signed-off-by: Stefan Eichenberger Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260116130948.79558-2-eichest@gmail.com Signed-off-by: Jakub Kicinski commit 3cc3ca6dc25a791b43ff88ce1b9dc05873e6b68c Author: Robert Marko Date: Thu Jan 15 12:37:35 2026 +0100 dt-bindings: net: sparx5: do not require phys when RGMII is used LAN969x has 2 dedicated RGMII ports, so regular SERDES lanes are not used for RGMII. So, lets not require phys to be defined when any of the rgmii phy-modes are set. Signed-off-by: Robert Marko Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260115114021.111324-11-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski commit 49743f27268ffbe2029d9c8fdfbd04d0869bd51d Author: Vadim Fedorenko Date: Fri Jan 16 06:21:21 2026 +0000 selftests: drv-net: extend HW timestamp test with ioctl Extend HW timestamp tests to check that ioctl interface is not broken and configuration setups and requests are equal to netlink interface. Some linter warnings are disabled because of ctypes classes. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20260116062121.1230184-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 5062245a5a7f78e801329fc1047d1ce734ec52f5 Author: Vadim Fedorenko Date: Fri Jan 16 06:21:20 2026 +0000 net: remove legacy way to get/set HW timestamp config With all drivers converted to use ndo_hwstamp callbacks the legacy way can be removed, marking ioctl interface as deprecated. Signed-off-by: Vadim Fedorenko Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20260116062121.1230184-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 3fbb5395c7303582757d5090ab8f7ec70dbe2c10 Author: Eric Dumazet Date: Fri Jan 16 04:13:59 2026 +0000 net: split kmalloc_reserve() to allow inlining kmalloc_reserve() is too big to be inlined. Put the slow path in a new out-of-line function : kmalloc_pfmemalloc() Then let kmalloc_reserve() set skb->pfmemalloc only when/if the slow path is taken. This makes __alloc_skb() faster : - kmalloc_reserve() is now automatically inlined by both gcc and clang. - No more expensive RMW (skb->pfmemalloc = pfmemalloc). - No more expensive stack canary (for CONFIG_STACKPROTECTOR_STRONG=y). - Removal of two prefetches that were coming too late for modern cpus. Text size increase is quite small compared to the cpu savings (~0.7 %) $ size net/core/skbuff.clang.before.o net/core/skbuff.clang.after.o text data bss dec hex filename 72507 5897 0 78404 13244 net/core/skbuff.clang.before.o 72681 5897 0 78578 132f2 net/core/skbuff.clang.after.o Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260116041359.181104-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7333299be4e5cc0d9ccbe9d13c9cd954a00f94d9 Merge: 677a51790be9fe 5d18a4d043098c Author: Jakub Kicinski Date: Tue Jan 20 18:18:43 2026 -0800 Merge branch 'eth-fbnic-update-ipc-mailbox-support' Mohsin Bashir says: ==================== eth: fbnic: Update IPC mailbox support Update IPC mailbox support for fbnic to cater for several changes. ==================== Link: https://patch.msgid.link/20260115003353.4150771-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 5d18a4d043098c129a3bb59496d40fb32fdabdad Author: Mohsin Bashir Date: Wed Jan 14 16:33:53 2026 -0800 eth: fbnic: Update RX mbox timeout value While waiting for completions on read requests, driver is using different timeout values for different messages. Make use of a single timeout value. Introduce a wrapper function to handle the wait, which also simplify maintaining the 80 char line limit. Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260115003353.4150771-6-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 320ee20a0b5489de26e47151c1787f629336309f Author: Mohsin Bashir Date: Wed Jan 14 16:33:52 2026 -0800 eth: fbnic: Remove retry support The driver retries sensor read requests from firmware, but this is unnecessary. A functioning firmware should respond to each request within the timeout period. Remove the retry logic and set the timeout to the sum of all retry timeouts. Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260115003353.4150771-5-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 301ae0d5391a19d9897c342c874240b36f7bc85f Author: Mohsin Bashir Date: Wed Jan 14 16:33:51 2026 -0800 eth: fbnic: Reuse RX mailbox pages Currently, the RX mailbox frees and reallocates a page for each received message. Since FW Rx messages are processed synchronously, and nothing hold these pages (unlike skbs which we hand over to the stack), reuse the pages and put them back on the Rx ring. Now that we ensure the ring is always fully populated we don't have to worry about filling it up after partial population during init, either. Update fbnic_mbx_process_rx_msgs() to recycle pages after message processing. Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260115003353.4150771-4-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 0c86b52b1a942debbabf02f569b2d54117701f89 Author: Mohsin Bashir Date: Wed Jan 14 16:33:50 2026 -0800 eth: fbnic: Allocate all pages for RX mailbox Now that memory is allocated with GFP_KERNEL, allocation failures should be extremely rare. Ensure the FW communication ring is always fully populated with free pages, and hard fail initialization otherwise. This enables simplifications in next patches. Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260115003353.4150771-3-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit bafae5de41c203d0ee4a5af2aa61749890374ff6 Author: Mohsin Bashir Date: Wed Jan 14 16:33:49 2026 -0800 eth: fbnic: Use GFP_KERNEL to allocting mbx pages Replace GFP_ATOMIC with GFP_KERNEL for mailbox RX page allocation. Since interrupt handler is threaded GFP_KERNEL is a safe option to reduce allocation failures. Also remove __GFP_NOWARN so the kernel reports a warning on allocation failure to aid debugging. Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20260115003353.4150771-2-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 83c9030cdc45e0518d71065c25201a24eafc9818 Author: Mykyta Yatsenko Date: Tue Jan 20 15:59:13 2026 +0000 bpf: Simplify bpf_timer_cancel() Remove lock from the bpf_timer_cancel() helper. The lock does not protect from concurrent modification of the bpf_async_cb data fields as those are modified in the callback without locking. Use guard(rcu)() instead of pair of explicit lock()/unlock(). Acked-by: Kumar Kartikeya Dwivedi Acked-by: Andrii Nakryiko Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260120-timer_nolock-v6-4-670ffdd787b4@meta.com Signed-off-by: Alexei Starovoitov commit 8bb1e32b3fac1becb4c1c8079d720784b8e33e34 Author: Mykyta Yatsenko Date: Tue Jan 20 15:59:12 2026 +0000 bpf: Introduce lock-free bpf_async_update_prog_callback() Introduce bpf_async_update_prog_callback(): lock-free update of cb->prog and cb->callback_fn. This function allows updating prog and callback_fn fields of the struct bpf_async_cb without holding lock. For now use it under the lock from __bpf_async_set_callback(), in the next patches that lock will be removed. Lock-free algorithm: * Acquire a guard reference on prog to prevent it from being freed during the retry loop. * Retry loop: 1. Each iteration acquires a new prog reference and stores it in cb->prog via xchg. The previous prog is released. 2. The loop condition checks if both cb->prog and cb->callback_fn match what we just wrote. If either differs, a concurrent writer overwrote our value, and we must retry. 3. When we retry, our previously-stored prog was already released by the concurrent writer or will be released by us after overwriting. * Release guard reference. Acked-by: Andrii Nakryiko Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260120-timer_nolock-v6-3-670ffdd787b4@meta.com Signed-off-by: Alexei Starovoitov commit 57d31e72dbdd1f71455aa62a2505a8cf088f46c6 Author: Mykyta Yatsenko Date: Tue Jan 20 15:59:11 2026 +0000 bpf: Remove unnecessary arguments from bpf_async_set_callback() Remove unused arguments from __bpf_async_set_callback(). Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260120-timer_nolock-v6-2-670ffdd787b4@meta.com Signed-off-by: Alexei Starovoitov commit c1f2c449de279967e04254f09104f657ba60ab3f Author: Mykyta Yatsenko Date: Tue Jan 20 15:59:10 2026 +0000 bpf: Factor out timer deletion helper Move the timer deletion logic into a dedicated bpf_timer_delete() helper so it can be reused by later patches. Acked-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260120-timer_nolock-v6-1-670ffdd787b4@meta.com Signed-off-by: Alexei Starovoitov commit 677a51790be9fe1c843885e6d0c613a50f1de1c0 Merge: 8766d61a1d33cb d1de61db153672 Author: Jakub Kicinski Date: Tue Jan 20 18:10:04 2026 -0800 Merge tag 'net-queue-rx-buf-len-v9' of https://github.com/isilence/linux Pavel Begunkov says: ==================== Add support for providers with large rx buffer Many modern NICs support configurable receive buffer lengths, and zcrx and memory providers can use buffers larger than 4K to improve performance. When paired with hw-gro larger rx buffer sizes can drastically reduce the number of buffers traversing the stack and save a lot of processing time. It also allows to give to users larger contiguous chunks of data. Single stream benchmarks showed up to ~30% CPU util improvement. E.g. comparison for 4K vs 32K buffers using a 200Gbit NIC: packets=23987040 (MB=2745098), rps=199559 (MB/s=22837) CPU %usr %nice %sys %iowait %irq %soft %idle 0 1.53 0.00 27.78 2.72 1.31 66.45 0.22 packets=24078368 (MB=2755550), rps=200319 (MB/s=22924) CPU %usr %nice %sys %iowait %irq %soft %idle 0 0.69 0.00 8.26 31.65 1.83 57.00 0.57 This series adds net infrastructure for memory providers configuring the size and implements it for bnxt. It's an opt-in feature for drivers, they should advertise support for the parameter in the qops and must check if the hardware supports the given size. It's limited to memory providers as it drastically simplifies implementation. It doesn't affect the fast path zcrx uAPI, and the user exposed parameter is defined in zcrx terms, which allows it to be flexible and adjusted in the future. A liburing example can be found at [2] full branch: [1] https://github.com/isilence/linux.git zcrx/large-buffers-v8 Liburing example: [2] https://github.com/isilence/liburing.git zcrx/rx-buf-len * tag 'net-queue-rx-buf-len-v9' of https://github.com/isilence/linux: io_uring/zcrx: document area chunking parameter selftests: iou-zcrx: test large chunk sizes eth: bnxt: support qcfg provided rx page size eth: bnxt: adjust the fill level of agg queues with larger buffers eth: bnxt: store rx buffer size per queue net: pass queue rx page size from memory provider net: add bare bone queue configs net: reduce indent of struct netdev_queue_mgmt_ops members net: memzero mp params when closing a queue ==================== Link: https://patch.msgid.link/ Signed-off-by: Jakub Kicinski commit b8accfd65d31f25b9df15ec2419179b6fa0b21d5 Author: Darrick J. Wong Date: Tue Jan 20 18:06:52 2026 -0800 xfs: add media verification ioctl Add a new privileged ioctl so that xfs_scrub can ask the kernel to verify the media of the devices backing an xfs filesystem, and have any resulting media errors reported to fsnotify and xfs_healer. To accomplish this, the kernel allocates a folio between the base page size and 1MB, and issues read IOs to a gradually incrementing range of one of the storage devices underlying an xfs filesystem. If any error occurs, that raw error is reported to the calling process. If the error happens to be one of the ones that the kernel considers indicative of data loss, then it will also be reported to xfs_healthmon and fsnotify. Driving the verification from the kernel enables xfs (and by extension xfs_scrub) to have precise control over the size and error handling of IOs that are issued to the underlying block device, and to emit notifications about problems to other relevant kernel subsystems immediately. Note that the caller is also allowed to reduce the size of the IO and to ask for a relaxation period after each IO. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 8b85dc4090e1c72c6d42acd823514cce67cd54fc Author: Darrick J. Wong Date: Tue Jan 20 18:06:51 2026 -0800 xfs: check if an open file is on the health monitored fs Create a new ioctl for the healthmon file that checks that a given fd points to the same filesystem that the healthmon file is monitoring. This allows xfs_healer to check that when it reopens a mountpoint to perform repairs, the file that it gets matches the filesystem that generated the corruption report. (Note that xfs_healer doesn't maintain an open fd to a filesystem that it's monitoring so that it doesn't pin the mount.) Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit c0e719cb36672b69a06da65ac4ec71e9a599dff5 Author: Darrick J. Wong Date: Tue Jan 20 18:06:51 2026 -0800 xfs: allow toggling verbose logging on the health monitoring file Make it so that we can reconfigure the health monitoring device by calling the XFS_IOC_HEALTH_MONITOR ioctl on it. As of right now we can only toggle the verbose flag, but this is less annoying than having to closing the monitor fd and reopen it. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit dfa8bad3a8796ce1ca4f1d15158e2ecfb9c5c014 Author: Darrick J. Wong Date: Tue Jan 20 18:06:50 2026 -0800 xfs: convey file I/O errors to the health monitor Connect the fserror reporting to the health monitor so that xfs can send events about file I/O errors to the xfs_healer daemon. These events are entirely informational because xfs cannot regenerate user data, so hopefully the fsnotify I/O error event gets noticed by the relevant management systems. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit e76e0e3fc9957a5183ddc51dc84c3e471125ab06 Author: Darrick J. Wong Date: Tue Jan 20 18:06:49 2026 -0800 xfs: convey externally discovered fsdax media errors to the health monitor Connect the fsdax media failure notification code to the health monitor so that xfs can send events about that to the xfs_healer daemon. Later on we'll add the ability for the xfs_scrub media scan (phase 6) to report the errors that it finds to the kernel so that those are also logged by xfs_healer. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 74c4795e50f816dbf5cf094691fc4f95bbc729ad Author: Darrick J. Wong Date: Tue Jan 20 18:06:48 2026 -0800 xfs: convey filesystem shutdown events to the health monitor Connect the filesystem shutdown code to the health monitor so that xfs can send events about that to the xfs_healer daemon. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 5eb4cb18e445d09f64ef4b7c8fdc3b2296cb0702 Author: Darrick J. Wong Date: Tue Jan 20 18:06:47 2026 -0800 xfs: convey metadata health events to the health monitor Connect the filesystem metadata health event collection system to the health monitor so that xfs can send events to xfs_healer as it collects information. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 25ca57fa3624cae9c6b5c6d3fc7f38318ca1402e Author: Darrick J. Wong Date: Tue Jan 20 18:06:47 2026 -0800 xfs: convey filesystem unmount events to the health monitor In xfs_healthmon_unmount, send events to xfs_healer so that it knows that nothing further can be done for the filesystem. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit b3a289a2a9397b2e731f334d7d36623a0f9192c5 Author: Darrick J. Wong Date: Tue Jan 20 18:06:46 2026 -0800 xfs: create event queuing, formatting, and discovery infrastructure Create the basic infrastructure that we need to report health events to userspace. We need a compact form for recording critical information about an event and queueing them; a means to notice that we've lost some events; and a means to format the events into something that userspace can handle. Make the kernel export C structures via read(). In a previous iteration of this new subsystem, I wanted to explore data exchange formats that are more flexible and easier for humans to read than C structures. The thought being that when we want to rev (or worse, enlarge) the event format, it ought to be trivially easy to do that in a way that doesn't break old userspace. I looked at formats such as protobufs and capnproto. These look really nice in that extending the wire format is fairly easy, you can give it a data schema and it generates the serialization code for you, handles endianness problems, etc. The huge downside is that neither support C all that well. Too hard, and didn't want to port either of those huge sprawling libraries first to the kernel and then again to xfsprogs. Then I thought, how about JSON? Javascript objects are human readable, the kernel can emit json without much fuss (it's all just strings!) and there are plenty of interpreters for python/rust/c/etc. There's a proposed schema format for json, which means that xfs can publish a description of the events that kernel will emit. Userspace consumers (e.g. xfsprogs/xfs_healer) can embed the same schema document and use it to validate the incoming events from the kernel, which means it can discard events that it doesn't understand, or garbage being emitted due to bugs. However, json has a huge crutch -- javascript is well known for its vague definitions of what are numbers. This makes expressing a large number rather fraught, because the runtime is free to represent a number in nearly any way it wants. Stupider ones will truncate values to word size, others will roll out doubles for uint52_t (yes, fifty-two) with the resulting loss of precision. Not good when you're dealing with discrete units. It just so happens that python's json library is smart enough to see a sequence of digits and put them in a u64 (at least on x86_64/aarch64) but an actual javascript interpreter (pasting into Firefox) isn't necessarily so clever. It turns out that none of the proposed json schemas were ever ratified even in an open-consensus way, so json blobs are still just loosely structured blobs. The parsing in userspace was also noticeably slow and memory-consumptive. Hence only the C interface survives. Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit a48373e7d35a89f6f9b39f0d0da9bf158af054ee Author: Darrick J. Wong Date: Tue Jan 20 18:06:45 2026 -0800 xfs: start creating infrastructure for health monitoring Start creating helper functions and infrastructure to pass filesystem health events to a health monitoring file. Since this is an administrative interface, we only support a single health monitor process per filesystem, so we don't need to use anything fancy such as notifier chains (== tons of indirect calls). Signed-off-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig commit 8766d61a1d33cb5f15bfdd6ce9832bbe1fc649c2 Author: Jakub Kicinski Date: Tue Jan 20 18:04:55 2026 -0800 Revert "Merge branch 'netkit-support-for-io_uring-zero-copy-and-af_xdp'" This reverts commit 77b9c4a438fc66e2ab004c411056b3fb71a54f2c, reversing changes made to 4515ec4ad58a37e70a9e1256c0b993958c9b7497: 931420a2fc36 ("selftests/net: Add netkit container tests") ab771c938d9a ("selftests/net: Make NetDrvContEnv support queue leasing") 6be87fbb2776 ("selftests/net: Add env for container based tests") 61d99ce3dfc2 ("selftests/net: Add bpf skb forwarding program") 920da3634194 ("netkit: Add xsk support for af_xdp applications") eef51113f8af ("netkit: Add netkit notifier to check for unregistering devices") b5ef109d22d4 ("netkit: Implement rtnl_link_ops->alloc and ndo_queue_create") b5c3fa4a0b16 ("netkit: Add single device mode for netkit") 0073d2fd679d ("xsk: Proxy pool management for leased queues") 1ecea95dd3b5 ("xsk: Extend xsk_rcv_check validation") 804bf334d08a ("net: Proxy netdev_queue_get_dma_dev for leased queues") 0caa9a8ddec3 ("net: Proxy net_mp_{open,close}_rxq for leased queues") ff8889ff9107 ("net, ethtool: Disallow leased real rxqs to be resized") 9e2103f36110 ("net: Add lease info to queue-get response") 31127deddef4 ("net: Implement netdev_nl_queue_create_doit") a5546e18f77c ("net: Add queue-create operation") The series will conflict with io_uring work, and the code needs more polish. Signed-off-by: Jakub Kicinski commit dd341eacdba360d035c9d4de66d3c80a89d77c84 Author: Matt Bobrowski Date: Tue Jan 20 09:16:30 2026 +0000 selftests/bpf: update verifier test for default trusted pointer semantics Replace the verifier test for default trusted pointer semantics, which previously relied on BPF kfunc bpf_get_root_mem_cgroup(), with a new test utilizing dedicated BPF kfuncs defined within the bpf_testmod. bpf_get_root_mem_cgroup() was modified such that it again relies on KF_ACQUIRE semantics, therefore no longer making it a suitable candidate to test BPF verifier default trusted pointer semantics against. Link: https://lore.kernel.org/bpf/20260113083949.2502978-2-mattbobrowski@google.com Signed-off-by: Matt Bobrowski Link: https://lore.kernel.org/r/20260120091630.3420452-1-mattbobrowski@google.com Signed-off-by: Alexei Starovoitov commit 2516a9c5a5545c061cef6c19bdedebb7c2ee43a2 Merge: 900dbb6db68b69 ed4724212f6f47 Author: Alexei Starovoitov Date: Tue Jan 20 16:59:25 2026 -0800 Merge branch 'bpf-fix-memory-access-flags-in-helper-prototypes' Zesen Liu says: ==================== bpf: Fix memory access flags in helper prototypes This series adds missing memory access flags (MEM_RDONLY or MEM_WRITE) to several bpf helper function prototypes that use ARG_PTR_TO_MEM but lack the correct flag. It also adds a new check in verifier to ensure the flag is specified. Missing memory access flags in helper prototypes can lead to critical correctness issues when the verifier tries to perform code optimization. After commit 37cce22dbd51 ("bpf: verifier: Refactor helper access type tracking"), the verifier relies on the memory access flags, rather than treating all arguments in helper functions as potentially modifying the pointed-to memory. Using ARG_PTR_TO_MEM alone without flags does not make sense because: - If the helper does not change the argument, missing MEM_RDONLY causes the verifier to incorrectly reject a read-only buffer. - If the helper does change the argument, missing MEM_WRITE causes the verifier to incorrectly assume the memory is unchanged, leading to errors in code optimization. We have already seen several reports regarding this: - commit ac44dcc788b9 ("bpf: Fix verifier assumptions of bpf_d_path's output buffer") adds MEM_WRITE to bpf_d_path; - commit 2eb7648558a7 ("bpf: Specify access type of bpf_sysctl_get_name args") adds MEM_WRITE to bpf_sysctl_get_name. This series looks through all prototypes in the kernel and completes the flags. It also adds check_mem_arg_rw_flag_ok() and wires it into check_func_proto() to statically restrict ARG_PTR_TO_MEM from appearing without memory access flags. Changelog ========= v3: - Rebased to bpf-next to address check_func_proto() signature changes, as suggested by Eduard Zingerman. v2: - Add missing MEM_RDONLY flags to protos with ARG_PTR_TO_FIXED_SIZE_MEM. ==================== Link: https://patch.msgid.link/20260120-helper_proto-v3-0-27b0180b4e77@gmail.com Signed-off-by: Alexei Starovoitov commit ed4724212f6f472fcb529947730ee0ec21c2eb6c Author: Zesen Liu Date: Tue Jan 20 16:28:47 2026 +0800 bpf: Require ARG_PTR_TO_MEM with memory flag Add check to ensure that ARG_PTR_TO_MEM is used with either MEM_WRITE or MEM_RDONLY. Using ARG_PTR_TO_MEM alone without flags does not make sense because: - If the helper does not change the argument, missing MEM_RDONLY causes the verifier to incorrectly reject a read-only buffer. - If the helper does change the argument, missing MEM_WRITE causes the verifier to incorrectly assume the memory is unchanged, leading to errors in code optimization. Co-developed-by: Shuran Liu Signed-off-by: Shuran Liu Co-developed-by: Peili Gao Signed-off-by: Peili Gao Co-developed-by: Haoran Ni Signed-off-by: Haoran Ni Signed-off-by: Zesen Liu Reviewed-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260120-helper_proto-v3-2-27b0180b4e77@gmail.com Signed-off-by: Alexei Starovoitov commit 802eef5afb1865bc5536a5302c068ba2215a1f72 Author: Zesen Liu Date: Tue Jan 20 16:28:46 2026 +0800 bpf: Fix memory access flags in helper prototypes After commit 37cce22dbd51 ("bpf: verifier: Refactor helper access type tracking"), the verifier started relying on the access type flags in helper function prototypes to perform memory access optimizations. Currently, several helper functions utilizing ARG_PTR_TO_MEM lack the corresponding MEM_RDONLY or MEM_WRITE flags. This omission causes the verifier to incorrectly assume that the buffer contents are unchanged across the helper call. Consequently, the verifier may optimize away subsequent reads based on this wrong assumption, leading to correctness issues. For bpf_get_stack_proto_raw_tp, the original MEM_RDONLY was incorrect since the helper writes to the buffer. Change it to ARG_PTR_TO_UNINIT_MEM which correctly indicates write access to potentially uninitialized memory. Similar issues were recently addressed for specific helpers in commit ac44dcc788b9 ("bpf: Fix verifier assumptions of bpf_d_path's output buffer") and commit 2eb7648558a7 ("bpf: Specify access type of bpf_sysctl_get_name args"). Fix these prototypes by adding the correct memory access flags. Fixes: 37cce22dbd51 ("bpf: verifier: Refactor helper access type tracking") Co-developed-by: Shuran Liu Signed-off-by: Shuran Liu Co-developed-by: Peili Gao Signed-off-by: Peili Gao Co-developed-by: Haoran Ni Signed-off-by: Haoran Ni Signed-off-by: Zesen Liu Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260120-helper_proto-v3-1-27b0180b4e77@gmail.com Signed-off-by: Alexei Starovoitov commit 5164e95565d3fd508ca8a95351323f5716dfb695 Author: Chukun Pan Date: Tue Jan 20 18:00:01 2026 +0800 riscv: dts: spacemit: Disable ETH PHY sleep mode for OrangePi On the SpacemiT K1 platform, the MAC can't read statistics when the PHY clock stops. Disable Link Down Power Saving Mode for the YT8531C PHY on OrangePi R2S and RV2 boards to avoid reading statistics timeout logs. Signed-off-by: Chukun Pan Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260120100001.1285624-2-amadeus@jmu.edu.cn Signed-off-by: Yixun Lan commit 900dbb6db68b6900b969421b42f64d9d3439d941 Merge: b236134f70ba1e c9e440bf25a712 Author: Alexei Starovoitov Date: Tue Jan 20 16:41:54 2026 -0800 Merge branch 'bpf-add-range-tracking-for-bpf_div-and-bpf_mod' Yazhou Tang says: ==================== bpf: Add range tracking for BPF_DIV and BPF_MOD From: Yazhou Tang Add range tracking (interval analysis) for BPF_DIV and BPF_MOD when divisor is constant. Please see commit log of 1/2 for more details. Changes v4 => v5: 1. Rename helper functions `__reset_reg(32|64)_and_tnum` to `reset_reg(32|64)_and_tnum`. (Alexei) 2. Replace plain C division with `div64_u64` and `div64_s64` for 64-bit operations, ensuring compatibility with 32-bit architectures. (Alexei & kernel test robot) 3. Fixup an indent typo in selftest file `verifier_div_mod_bounds.c`. v4: https://lore.kernel.org/bpf/20260116103246.2477635-1-tangyazhou@zju.edu.cn/ Changes v3 => v4: 1. Remove verbose helper functions for "division by zero" handling. (Alexei) 2. Put all "reset" logic in one place for clarity, and add 2 helper function `__reset_reg64_and_tnum` and `__reset_reg32_and_tnum` to reduce code duplication. (Alexei) 3. Update all multi-line comments to follow the standard kernel style. (Alexei) 4. Add new test cases to cover strictly positive and strictly negative divisor scenarios in SDIV and SMOD analysis. (Alexei) 5. Fixup a typo in SDIV analysis functions. v3: https://lore.kernel.org/bpf/20260113103552.3435695-1-tangyazhou@zju.edu.cn/ Changes v2 => v3: 1. Fixup a bug in `adjust_scalar_min_max_vals` function that lead to incorrect range results. (Syzbot) 2. Remove tnum analysis logic. (Alexei) 3. Only handle "constant divisor" case. (Alexei) 4. Add BPF_MOD range analysis logic. 5. Update selftests accordingly. 6. Add detailed code comments and improve commit messages. (Yonghong) v2: https://lore.kernel.org/bpf/20251223091120.2413435-1-tangyazhou@zju.edu.cn/ Changes v1 => v2: 1. Fixed 2 bugs in sdiv32 analysis logic and corrected the associated selftest cases. (AI reviewer) 2. Renamed `tnum_bottom` to `tnum_empty` for better clarity, and updated commit message to explain its role in signed BPF_DIV analysis. v1: https://lore.kernel.org/bpf/tencent_717092CD734D050CCD93401CA624BB3C8307@qq.com/ https://lore.kernel.org/bpf/tencent_7C98FAECA40C98489ACF4515CE346F031509@qq.com/ ==================== Link: https://patch.msgid.link/20260119085458.182221-1-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit c9e440bf25a712d906c40ba3ef831f3f0ccc6a1b Author: Yazhou Tang Date: Mon Jan 19 16:54:58 2026 +0800 selftests/bpf: Add tests for BPF_DIV and BPF_MOD range tracking Now BPF_DIV has range tracking support via interval analysis. This patch adds selftests to cover various cases of BPF_DIV and BPF_MOD operations when the divisor is a constant, also covering both signed and unsigned variants. This patch includes several types of tests in 32-bit and 64-bit variants: 1. For UDIV - positive divisor - zero divisor 2. For SDIV - positive divisor, positive dividend - positive divisor, negative dividend - positive divisor, mixed sign dividend - negative divisor, positive dividend - negative divisor, negative dividend - negative divisor, mixed sign dividend - zero divisor - overflow (SIGNED_MIN/-1), normal dividend - overflow (SIGNED_MIN/-1), constant dividend 3. For UMOD - positive divisor - positive divisor, small dividend - zero divisor 4. For SMOD - positive divisor, positive dividend - positive divisor, negative dividend - positive divisor, mixed sign dividend - positive divisor, mixed sign dividend, small dividend - negative divisor, positive dividend - negative divisor, negative dividend - negative divisor, mixed sign dividend - negative divisor, mixed sign dividend, small dividend - zero divisor - overflow (SIGNED_MIN/-1), normal dividend - overflow (SIGNED_MIN/-1), constant dividend Specifically, these selftests are based on dead code elimination: If the BPF verifier can precisely analyze the result of BPF_DIV/BPF_MOD instruction, it can prune the path that leads to an error (here we use invalid memory access as the error case), allowing the program to pass verification. Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Signed-off-by: Yazhou Tang Link: https://lore.kernel.org/r/20260119085458.182221-3-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit 44fdd581d27366092e162b42f025d75d5a16c851 Author: Yazhou Tang Date: Mon Jan 19 16:54:57 2026 +0800 bpf: Add range tracking for BPF_DIV and BPF_MOD This patch implements range tracking (interval analysis) for BPF_DIV and BPF_MOD operations when the divisor is a constant, covering both signed and unsigned variants. While LLVM typically optimizes integer division and modulo by constants into multiplication and shift sequences, this optimization is less effective for the BPF target when dealing with 64-bit arithmetic. Currently, the verifier does not track bounds for scalar division or modulo, treating the result as "unbounded". This leads to false positive rejections for safe code patterns. For example, the following code (compiled with -O2): ```c int test(struct pt_regs *ctx) { char buffer[6] = {1}; __u64 x = bpf_ktime_get_ns(); __u64 res = x % sizeof(buffer); char value = buffer[res]; bpf_printk("res = %llu, val = %d", res, value); return 0; } ``` Generates a raw `BPF_MOD64` instruction: ```asm ; __u64 res = x % sizeof(buffer); 1: 97 00 00 00 06 00 00 00 r0 %= 0x6 ; char value = buffer[res]; 2: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0x0 ll 4: 0f 01 00 00 00 00 00 00 r1 += r0 5: 91 14 00 00 00 00 00 00 r4 = *(s8 *)(r1 + 0x0) ``` Without this patch, the verifier fails with "math between map_value pointer and register with unbounded min value is not allowed" because it cannot deduce that `r0` is within [0, 5]. According to the BPF instruction set[1], the instruction's offset field (`insn->off`) is used to distinguish between signed (`off == 1`) and unsigned division (`off == 0`). Moreover, we also follow the BPF division and modulo runtime behavior (semantics) to handle special cases, such as division by zero and signed division overflow. - UDIV: dst = (src != 0) ? (dst / src) : 0 - SDIV: dst = (src == 0) ? 0 : ((src == -1 && dst == LLONG_MIN) ? LLONG_MIN : (dst / src)) - UMOD: dst = (src != 0) ? (dst % src) : dst - SMOD: dst = (src == 0) ? dst : ((src == -1 && dst == LLONG_MIN) ? 0: (dst s% src)) Here is the overview of the changes made in this patch (See the code comments for more details and examples): 1. For BPF_DIV: Firstly check whether the divisor is zero. If so, set the destination register to zero (matching runtime behavior). For non-zero constant divisors: goto `scalar(32)?_min_max_(u|s)div` functions. - General cases: compute the new range by dividing max_dividend and min_dividend by the constant divisor. - Overflow case (SIGNED_MIN / -1) in signed division: mark the result as unbounded if the dividend is not a single number. 2. For BPF_MOD: Firstly check whether the divisor is zero. If so, leave the destination register unchanged (matching runtime behavior). For non-zero constant divisors: goto `scalar(32)?_min_max_(u|s)mod` functions. - General case: For signed modulo, the result's sign matches the dividend's sign. And the result's absolute value is strictly bounded by `min(abs(dividend), abs(divisor) - 1)`. - Special care is taken when the divisor is SIGNED_MIN. By casting to unsigned before negation and subtracting 1, we avoid signed overflow and correctly calculate the maximum possible magnitude (`res_max_abs` in the code). - "Small dividend" case: If the dividend is already within the possible result range (e.g., [-2, 5] % 10), the operation is an identity function, and the destination register remains unchanged. 3. In `scalar(32)?_min_max_(u|s)(div|mod)` functions: After updating current range, reset other ranges and tnum to unbounded/unknown. e.g., in `scalar_min_max_sdiv`, signed 64-bit range is updated. Then reset unsigned 64-bit range and 32-bit range to unbounded, and tnum to unknown. Exception: in BPF_MOD's "small dividend" case, since the result remains unchanged, we do not reset other ranges/tnum. 4. Also updated existing selftests based on the expected BPF_DIV and BPF_MOD behavior. [1] https://www.kernel.org/doc/Documentation/bpf/standardization/instruction-set.rst Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Signed-off-by: Yazhou Tang Tested-by: syzbot@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20260119085458.182221-2-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov commit b236134f70ba1e98a85d00623ea8fafb41dacf7f Merge: 2e6690d4f7fc41 74bc4f61272076 Author: Alexei Starovoitov Date: Tue Jan 20 16:15:58 2026 -0800 Merge branch 'bpf-kernel-functions-with-kf_implicit_args' Ihor Solodrai says: ==================== bpf: Kernel functions with KF_IMPLICIT_ARGS This series implements a generic "implicit arguments" feature for BPF kernel functions. For context see prior work [1][2]. A mechanism is created for kfuncs to have arguments that are not visible to the BPF programs, and are provided to the kernel function implementation by the verifier. This mechanism is then used in the kfuncs that have a parameter with __prog annotation [3], which is the current way of passing struct bpf_prog_aux pointer to kfuncs. The function with implicit arguments is defined by KF_IMPLICIT_ARGS flag in BTF_IDS_FLAGS set. In this series, only a pointer to struct bpf_prog_aux can be implicit, although it is simple to extend this to more types. The verifier handles a kfunc with KF_IMPLICIT_ARGS by resolving it to a different (actual) BTF prototype early in verification (patch #3). A _impl function generated in BTF for a kfunc with implicit args does not have a "bpf_kfunc" decl tag, and a kernel address. The verifier will reject a program trying to call such an _impl kfunc. The usage of _impl functions in BPF is only allowed for kfuncs with an explicit kernel (or kmodule) declaration, that is in "legacy" cases. As of this series, there are no legacy kernel functions, as all __prog users are migrated to KF_IMPLICIT_ARGS. However the implementation allows for legacy cases support in principle. The series removes the following BPF kernel functions: - bpf_stream_vprintk_impl - bpf_task_work_schedule_resume_impl - bpf_task_work_schedule_signal_impl - bpf_wq_set_callback_impl This will break existing BPF programs calling these functions (the verifier will not load them) on new kernels. To mitigate, BPF users are advised to use the following pattern [4]: if (xxx_impl) xxx_impl(..., NULL); else xxx(...); Which can be wrapped in a macro. The series consists of the following patches: - patches #1 and #2 are non-functional refactoring in kernel/bpf - patch #3 defines KF_IMPLICIT_ARGS flag and teaches the verifier about it - patches #4-#5 implement btf2btf transformation in resolve_btfids - patch #6 adds selftests specific to KF_IMPLICIT_ARGS feature - patches #7-#11 migrate the current users of __prog argument to KF_IMPLICIT_ARGS - patch #12 removes __prog arg suffix support from the kernel - patch #13 updates the docs [1] https://lore.kernel.org/bpf/20251029190113.3323406-1-ihor.solodrai@linux.dev/ [2] https://lore.kernel.org/bpf/20250924211716.1287715-1-ihor.solodrai@linux.dev/ [3] https://docs.kernel.org/bpf/kfuncs.html#prog-annotation [4] https://lore.kernel.org/bpf/CAEf4BzbgPfRm9BX=TsZm-TsHFAHcwhPY4vTt=9OT-uhWqf8tqw@mail.gmail.com/ --- v2->v3: - resolve_btfids: Use dynamic reallocation for btf2btf_context arrays (Andrii) - resolve_btfids: Add missing free() for btf2btf_context arrays (AI) - Other nits in resolve_btfids (Andrii, Eduard) v2: https://lore.kernel.org/bpf/20260116201700.864797-1-ihor.solodrai@linux.dev/ v1->v2: - Replace the following kernel functions with KF_IMPLICIT_ARGS version: - bpf_stream_vprintk_impl -> bpf_stream_vprintk - bpf_task_work_schedule_resume_impl -> bpf_task_work_schedule_resume - bpf_task_work_schedule_signal_impl -> bpf_task_work_schedule_signal - bpf_wq_set_callback_impl -> bpf_wq_set_callback_impl - Remove __prog arg suffix support from the verifier - Rework btf2btf implementation in resolve_btfids - Do distill base and sort before BTF_ids patching - Collect kfuncs based on BTF decl tags, before BTF_ids are patched - resolve_btfids: use dynamic memory for intermediate data (Andrii) - verifier: reset .subreg_def for caller saved registers on kfunc call (Eduard) - selftests/hid: remove Makefile changes (Benjamin) - selftests/bpf: Add a patch (#11) migrating struct_ops_assoc test to KF_IMPLICIT_ARGS - Various nits across the series (Alexei, Andrii, Eduard) v1: https://lore.kernel.org/bpf/20260109184852.1089786-1-ihor.solodrai@linux.dev/ --- ==================== Link: https://patch.msgid.link/20260120222638.3976562-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 74bc4f6127207624ec06f0d0984b280a390992aa Author: Ihor Solodrai Date: Tue Jan 20 14:30:26 2026 -0800 bpf,docs: Document KF_IMPLICIT_ARGS flag Add a section explaining KF_IMPLICIT_ARGS kfunc flag. Remove __prog arg annotation, as it is no longer supported. Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120223027.3981805-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit aed57a36387135bcb73f01bac3d0a286a657b006 Author: Ihor Solodrai Date: Tue Jan 20 14:26:37 2026 -0800 bpf: Remove __prog kfunc arg annotation Now that all the __prog suffix users in the kernel tree migrated to KF_IMPLICIT_ARGS, remove it from the verifier. See prior discussion for context [1]. [1] https://lore.kernel.org/bpf/CAEf4BzbgPfRm9BX=TsZm-TsHFAHcwhPY4vTt=9OT-uhWqf8tqw@mail.gmail.com/ Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-13-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit bd06b977e02d80fe0dec303cc219d007121a4526 Author: Ihor Solodrai Date: Tue Jan 20 14:26:36 2026 -0800 selftests/bpf: Migrate struct_ops_assoc test to KF_IMPLICIT_ARGS A test kfunc named bpf_kfunc_multi_st_ops_test_1_impl() is a user of __prog suffix. Subsequent patch removes __prog support in favor of KF_IMPLICIT_ARGS, so migrate this kfunc to use implicit argument. Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-12-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit d806f3101276a1ed18d963944580e1ee1c7a3d26 Author: Ihor Solodrai Date: Tue Jan 20 14:26:35 2026 -0800 bpf: Migrate bpf_stream_vprintk() to KF_IMPLICIT_ARGS Implement bpf_stream_vprintk with an implicit bpf_prog_aux argument, and remote bpf_stream_vprintk_impl from the kernel. Update the selftests to use the new API with implicit argument. bpf_stream_vprintk macro is changed to use the new bpf_stream_vprintk kfunc, and the extern definition of bpf_stream_vprintk_impl is replaced accordingly. Reviewed-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-11-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 6e663ffdf7600168338fdfa2fd1eed83395d58a3 Author: Ihor Solodrai Date: Tue Jan 20 14:26:34 2026 -0800 bpf: Migrate bpf_task_work_schedule_* kfuncs to KF_IMPLICIT_ARGS Implement bpf_task_work_schedule_* with an implicit bpf_prog_aux argument, and remove corresponding _impl funcs from the kernel. Update special kfunc checks in the verifier accordingly. Update the selftests to use the new API with implicit argument. Reviewed-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-10-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 8157cc739ad301b7fb6dfc4cfc5497cedd33df4e Author: Ihor Solodrai Date: Tue Jan 20 14:26:33 2026 -0800 HID: Use bpf_wq_set_callback kernel function Remove extern declaration of bpf_wq_set_callback_impl() from hid_bpf_helpers.h and replace bpf_wq_set_callback macro with a corresponding new declaration. Tested with: # append tools/testing/selftests/hid/config and build the kernel $ make -C tools/testing/selftests/hid # in built kernel $ ./tools/testing/selftests/hid/hid_bpf -t test_multiply_events_wq TAP version 13 1..1 # Starting 1 tests from 1 test cases. # RUN hid_bpf.test_multiply_events_wq ... [ 2.575520] hid-generic 0003:0001:0A36.0001: hidraw0: USB HID v0.00 Device [test-uhid-device-138] on 138 # OK hid_bpf.test_multiply_events_wq ok 1 hid_bpf.test_multiply_events_wq # PASSED: 1 / 1 tests passed. # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 PASS Acked-by: Benjamin Tissoires Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-9-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit b97931a25a4bc74076ffb5c3d1a534c71ade4d55 Author: Ihor Solodrai Date: Tue Jan 20 14:26:32 2026 -0800 bpf: Migrate bpf_wq_set_callback_impl() to KF_IMPLICIT_ARGS Implement bpf_wq_set_callback() with an implicit bpf_prog_aux argument, and remove bpf_wq_set_callback_impl(). Update special kfunc checks in the verifier accordingly. Reviewed-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-8-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit e939f3d16d77a88e5f363394ef73db4c898c4107 Author: Ihor Solodrai Date: Tue Jan 20 14:26:31 2026 -0800 selftests/bpf: Add tests for KF_IMPLICIT_ARGS Add trivial end-to-end tests to validate that KF_IMPLICIT_ARGS flag is properly handled by both resolve_btfids and the verifier. Declare kfuncs in bpf_testmod. Check that bpf_prog_aux pointer is set in the kfunc implementation. Verify that calls with implicit args and a legacy case all work. Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-7-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 9d199965990c0b21160c565076b93725d6638c28 Author: Ihor Solodrai Date: Tue Jan 20 14:26:30 2026 -0800 resolve_btfids: Support for KF_IMPLICIT_ARGS Implement BTF modifications in resolve_btfids to support BPF kernel functions with implicit arguments. For a kfunc marked with KF_IMPLICIT_ARGS flag, a new function prototype is added to BTF that does not have implicit arguments. The kfunc's prototype is then updated to a new one in BTF. This prototype is the intended interface for the BPF programs. A _impl function is added to BTF to make the original kfunc prototype searchable for the BPF verifier. If a _impl function already exists in BTF, its interpreted as a legacy case, and this step is skipped. Whether an argument is implicit is determined by its type: currently only `struct bpf_prog_aux *` is supported. As a result, the BTF associated with kfunc is changed from __bpf_kfunc bpf_foo(int arg1, struct bpf_prog_aux *aux); into bpf_foo_impl(int arg1, struct bpf_prog_aux *aux); __bpf_kfunc bpf_foo(int arg1); For more context see previous discussions and patches [1][2]. [1] https://lore.kernel.org/dwarves/ba1650aa-fafd-49a8-bea4-bdddee7c38c9@linux.dev/ [2] https://lore.kernel.org/bpf/20251029190113.3323406-1-ihor.solodrai@linux.dev/ Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-6-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 2583e81fd8852e6cf6730c4463b6580deb7a8aad Author: Ihor Solodrai Date: Tue Jan 20 14:26:29 2026 -0800 resolve_btfids: Introduce finalize_btf() step Since recently [1][2] resolve_btfids executes final adjustments to the kernel/module BTF before it's embedded into the target binary. To keep the implementation simple, a clear and stable "pipeline" of how BTF data flows through resolve_btfids would be helpful. Some BTF modifications may change the ids of the types, so it is important to maintain correct order of operations with respect to .BTF_ids resolution too. This patch refactors the BTF handling to establish the following sequence: - load target ELF sections - load .BTF_ids symbols - this will be a dependency of btf2btf transformations in subsequent patches - load BTF and its base as is - (*) btf2btf transformations will happen here - finalize_btf(), introduced in this patch - does distill base and sort BTF - resolve and patch .BTF_ids This approach helps to avoid fixups in .BTF_ids data in case the ids change at any point of BTF processing, because symbol resolution happens on the finalized, ready to dump, BTF data. This also gives flexibility in BTF transformations, because they will happen on BTF that is not distilled and/or sorted yet, allowing to freely add, remove and modify BTF types. [1] https://lore.kernel.org/bpf/20251219181321.1283664-1-ihor.solodrai@linux.dev/ [2] https://lore.kernel.org/bpf/20260109130003.3313716-1-dolinux.peng@gmail.com/ Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-5-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 64e1360524b9ef5835714669b5876e122a23e6fc Author: Ihor Solodrai Date: Tue Jan 20 14:26:28 2026 -0800 bpf: Verifier support for KF_IMPLICIT_ARGS A kernel function bpf_foo marked with KF_IMPLICIT_ARGS flag is expected to have two associated types in BTF: * `bpf_foo` with a function prototype that omits implicit arguments * `bpf_foo_impl` with a function prototype that matches the kernel declaration of `bpf_foo`, but doesn't have a ksym associated with its name In order to support kfuncs with implicit arguments, the verifier has to know how to resolve a call of `bpf_foo` to the correct BTF function prototype and address. To implement this, in add_kfunc_call() kfunc flags are checked for KF_IMPLICIT_ARGS. For such kfuncs a BTF func prototype is adjusted to the one found for `bpf_foo_impl` (func_name + "_impl" suffix, by convention) function in BTF. This effectively changes the signature of the `bpf_foo` kfunc in the context of verification: from one without implicit args to the one with full argument list. The values of implicit arguments by design are provided by the verifier, and so they can only be of particular types. In this patch the only allowed implicit arg type is a pointer to struct bpf_prog_aux. In order for the verifier to correctly set an implicit bpf_prog_aux arg value at runtime, is_kfunc_arg_prog() is extended to check for the arg type. At a point when prog arg is determined in check_kfunc_args() the kfunc with implicit args already has a prototype with full argument list, so the existing value patch mechanism just works. If a new kfunc with KF_IMPLICIT_ARG is declared for an existing kfunc that uses a __prog argument (a legacy case), the prototype substitution works in exactly the same way, assuming the kfunc follows the _impl naming convention. The difference is only in how _impl prototype is added to the BTF, which is not the verifier's concern. See a subsequent resolve_btfids patch for details. __prog suffix is still supported at this point, but will be removed in a subsequent patch, after current users are moved to KF_IMPLICIT_ARGS. Introduction of KF_IMPLICIT_ARGS revealed an issue with zero-extension tracking, because an explicit rX = 0 in place of the verifier-supplied argument is now absent if the arg is implicit (the BPF prog doesn't pass a dummy NULL anymore). To mitigate this, reset the subreg_def of all caller saved registers in check_kfunc_call() [1]. [1] https://lore.kernel.org/bpf/b4a760ef828d40dac7ea6074d39452bb0dc82caa.camel@gmail.com/ Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-4-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit 08ca87d6324350a7abf5f05db5b63df9420dd29d Author: Ihor Solodrai Date: Tue Jan 20 14:26:27 2026 -0800 bpf: Introduce struct bpf_kfunc_meta There is code duplication between add_kfunc_call() and fetch_kfunc_meta() collecting information about a kfunc from BTF. Introduce struct bpf_kfunc_meta to hold common kfunc BTF data and implement fetch_kfunc_meta() to fill it in, instead of struct bpf_kfunc_call_arg_meta directly. Then use these in add_kfunc_call() and (new) fetch_kfunc_arg_meta() functions, and fixup previous usages of fetch_kfunc_meta() to fetch_kfunc_arg_meta(). Besides the code dedup, this change enables add_kfunc_call() to access kfunc->flags. Acked-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-3-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit ea073d1818e228440275cc90047b4ef0fddd6eb5 Author: Ihor Solodrai Date: Tue Jan 20 14:26:26 2026 -0800 bpf: Refactor btf_kfunc_id_set_contains btf_kfunc_id_set_contains() is called by fetch_kfunc_meta() in the BPF verifier to get the kfunc flags stored in the .BTF_ids ELF section. If it returns NULL instead of a valid pointer, it's interpreted as an illegal kfunc usage failing the verification. There are two potential reasons for btf_kfunc_id_set_contains() to return NULL: 1. Provided kfunc BTF id is not present in relevant kfunc id sets. 2. The kfunc is not allowed, as determined by the program type specific filter [1]. The filter functions accept a pointer to `struct bpf_prog`, so they might implicitly depend on earlier stages of verification, when bpf_prog members are set. For example, bpf_qdisc_kfunc_filter() in linux/net/sched/bpf_qdisc.c inspects prog->aux->st_ops [2], which is initialized in: check_attach_btf_id() -> check_struct_ops_btf_id() So far this hasn't been an issue, because fetch_kfunc_meta() is the only caller of btf_kfunc_id_set_contains(). However in subsequent patches of this series it is necessary to inspect kfunc flags earlier in BPF verifier, in the add_kfunc_call(). To resolve this, refactor btf_kfunc_id_set_contains() into two interface functions: * btf_kfunc_flags() that simply returns pointer to kfunc_flags without applying the filters * btf_kfunc_is_allowed() that both checks for kfunc_flags existence (which is a requirement for a kfunc to be allowed) and applies the prog filters See [3] for the previous version of this patch. [1] https://lore.kernel.org/all/20230519225157.760788-7-aditi.ghag@isovalent.com/ [2] https://lore.kernel.org/all/20250409214606.2000194-4-ameryhung@gmail.com/ [3] https://lore.kernel.org/bpf/20251029190113.3323406-3-ihor.solodrai@linux.dev/ Reviewed-by: Eduard Zingerman Signed-off-by: Ihor Solodrai Link: https://lore.kernel.org/r/20260120222638.3976562-2-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov commit f185076da44c774241a16a82a7773ece3c1c607b Author: Nathan Chancellor Date: Tue Jan 13 17:00:31 2026 -0700 drm/msm/dp: Avoid division by zero in msm_dp_ctrl_config_msa() An (admittedly problematic) optimization change in LLVM 20 [1] turns known division by zero into the equivalent of __builtin_unreachable(), which invokes undefined behavior if it is encountered in a control flow graph, destroying code generation. When compile testing for x86_64, objtool flags an instance of this optimization triggering in msm_dp_ctrl_config_msa(), inlined into msm_dp_ctrl_on_stream(): drivers/gpu/drm/msm/msm.o: warning: objtool: msm_dp_ctrl_on_stream(): unexpected end of section .text.msm_dp_ctrl_on_stream The zero division happens if the else branch in the first if statement in msm_dp_ctrl_config_msa() is taken because pixel_div is initialized to zero and it is not possible for LLVM to eliminate the else branch since rate is still not known after inlining into msm_dp_ctrl_on_stream(). Transform the if statements into a switch statement with a default case with the existing error print and an early return to avoid the invalid division. Add a comment to note this helps the compiler, even though the case is known to be unreachable. With this, pixel_dev's default zero initialization can be dropped, as it is dead with this change. Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") Link: https://github.com/llvm/llvm-project/commit/37932643abab699e8bb1def08b7eb4eae7ff1448 [1] Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601081959.9UVJEOfP-lkp@intel.com/ Suggested-by: Konrad Dybcio Signed-off-by: Nathan Chancellor Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/698355/ Link: https://lore.kernel.org/r/20260113-drm-msm-dp_ctrl-avoid-zero-div-v2-1-f1aa67bf6e8e@kernel.org Signed-off-by: Dmitry Baryshkov commit 42f62cd795782ab29eca6ca3572d98e392fc9408 Author: Dmitry Baryshkov Date: Thu Jan 15 22:05:39 2026 +0200 drm/msm/dpu: try reserving the DSPP-less LM first On most of the platforms only some mixers have connected DSPP blocks. If DSPP is not required for the CRTC, try looking for the LM with no DSSP block, leaving DSPP-enabled LMs to CRTCs which actually require those. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/698773/ Link: https://lore.kernel.org/r/20260115-dpu-fix-dspp-v1-2-b73152c147b3@oss.qualcomm.com commit 98c8f146f5744347f15c824fb9442867c71c4d32 Author: Dmitry Baryshkov Date: Thu Jan 15 22:05:38 2026 +0200 drm/msm/dpu: correct error messages in RM Some of error messages in RM reference block index, while other print the enum value (which is shifted by 1), not to mention that some of the messages are misleading. Reformat the messages, making them more clear and also always printing the hardware block name. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/698774/ Link: https://lore.kernel.org/r/20260115-dpu-fix-dspp-v1-1-b73152c147b3@oss.qualcomm.com commit 83fe2cd56b1ddd023a9624c916e5ad714795587b Author: Yuanjie Yang Date: Thu Jan 15 17:27:49 2026 +0800 drm/msm/dpu: Add support for Kaanapali DPU Add support for Display Processing Unit (DPU) version 13.0 on the Kaanapali platform. This version introduces changes to the SSPP sub-block structure. Add common block and rectangle blocks to accommodate these structural modifications for compatibility. Co-developed-by: Yongxing Mou Signed-off-by: Yongxing Mou Reviewed-by: Dmitry Baryshkov Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698716/ Link: https://lore.kernel.org/r/20260115092749.533-13-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit c6c9f129e98ee86f960f42a6f14fa84c82069481 Author: Yuanjie Yang Date: Thu Jan 15 17:27:48 2026 +0800 drm/msm/dpu: Add Kaanapali WB support Add support for Kaanapali WB, which introduce register relocations, use the updated registeri definition to ensure compatibility. Co-developed-by: Yongxing Mou Signed-off-by: Yongxing Mou Reviewed-by: Dmitry Baryshkov Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698715/ Link: https://lore.kernel.org/r/20260115092749.533-12-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 688c7734002a1ee6f50a28ba9bd7aa380edbe12d Author: Yuanjie Yang Date: Thu Jan 15 17:27:47 2026 +0800 drm/msm/dpu: Add Kaanapali SSPP sub-block support Add support for Kaanapali platform SSPP sub-blocks, which introduce structural changes including register additions, removals, and relocations. Add the new common and rectangle blocks, and update register definitions and handling to ensure compatibility with DPU v13.0. Co-developed-by: Yongxing Mou Signed-off-by: Yongxing Mou Signed-off-by: Yuanjie Yang Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/698712/ Link: https://lore.kernel.org/r/20260115092749.533-11-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit cc4b81f178c77d623eea34eb076a091a520233cb Author: Yuanjie Yang Date: Thu Jan 15 17:27:46 2026 +0800 drm/msm/dpu: Refactor SSPP to compatible DPU 13.0.0 DPU version 13.0.0 introduces structural changes including register additions, removals, and relocations. Refactor SSPP-related code to be compatible with DPU 13.0.0 modifications. Co-developed-by: Yongxing Mou Signed-off-by: Yongxing Mou Reviewed-by: Dmitry Baryshkov Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698710/ Link: https://lore.kernel.org/r/20260115092749.533-10-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit b78956dc9ed7c23b8216eb36ff1c504ab762c3eb Author: Yuanjie Yang Date: Thu Jan 15 17:27:45 2026 +0800 drm/msm/dpu: Add interrupt registers for DPU 13.0.0 DPU version 13.0.0 introduces changes to the interrupt register layout. Update the driver to support these modifications for proper interrupt handling. Co-developed-by: Yongxing Mou Signed-off-by: Yongxing Mou Reviewed-by: Dmitry Baryshkov Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698708/ Link: https://lore.kernel.org/r/20260115092749.533-9-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 2482c6f93aa6669aa6ec425864328036cf9e78ab Author: Yuanjie Yang Date: Thu Jan 15 17:27:44 2026 +0800 drm/msm/dsi: Add support for Kaanapali Add DSI Controller version 2.10.0 support for DSI on Qualcomm Kaanapali SoC. Co-developed-by: Yongxing Mou Signed-off-by: Yongxing Mou Reviewed-by: Dmitry Baryshkov Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698707/ Link: https://lore.kernel.org/r/20260115092749.533-8-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 223bff623c7d675abee27d12536493346394ab82 Author: Yuanjie Yang Date: Thu Jan 15 17:27:43 2026 +0800 drm/msm/dsi/phy: Add support for Kaanapali Add DSI PHY support for the Kaanapali platform, Kaanapali introduce addition of DSI2/DSI2_phy compared to SM8650. However, based on the HPG diagram, only DSI0_phy and DSI1_phy works. Co-developed-by: Yongxing Mou Signed-off-by: Yongxing Mou Reviewed-by: Dmitry Baryshkov Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698705/ Link: https://lore.kernel.org/r/20260115092749.533-7-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 3d2d7a3386e8b2c48ef186c59a47e269552502f2 Author: Yuanjie Yang Date: Thu Jan 15 17:27:42 2026 +0800 drm/msm/mdss: Add support for Kaanapali Add mdss support for the Qualcomm Kaanapali platform. Co-developed-by: Yongxing Mou Signed-off-by: Yongxing Mou Reviewed-by: Dmitry Baryshkov Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698703/ Link: https://lore.kernel.org/r/20260115092749.533-6-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 5260159778168a533fd13746c3b89e52f01cbfc3 Author: Yuanjie Yang Date: Thu Jan 15 17:27:41 2026 +0800 dt-bindings: display/msm: qcom, kaanapali-mdss: Add Kaanapali Kaanapali introduces DPU 13.0.0 and DSI 2.10. Compared to SM8750, Kaanapali has significant register changes, making it incompatible with SM8750. So add MDSS/MDP display subsystem for Qualcomm Kaanapali. Co-developed-by: Yongxing Mou Signed-off-by: Yongxing Mou Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698700/ Link: https://lore.kernel.org/r/20260115092749.533-5-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit ac9d8bf748625c944775699875bd53d8dce13a34 Author: Yuanjie Yang Date: Thu Jan 15 17:27:40 2026 +0800 dt-bindings: display/msm: dsi-controller-main: Add Kaanapali The DSI registers on the Kaanapali platform differ from those on SM8750. So add DSI for Kaanapali to compatible these changes. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698698/ Link: https://lore.kernel.org/r/20260115092749.533-4-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit b92efcf5197e5326002cfb2a37a5945533678762 Author: Yuanjie Yang Date: Thu Jan 15 17:27:39 2026 +0800 dt-bindings: display/msm: dsi-phy-7nm: Add Kaanapali DSI PHY The DSI PHY registers on the Kaanapali platform differ from those on SM8750. So add DSI PHY for Kaanapali to compatible these changes. Acked-by: Krzysztof Kozlowski Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698696/ Link: https://lore.kernel.org/r/20260115092749.533-3-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 60772c225f0f36790e6f7bba684b68675a4a799f Author: Yuanjie Yang Date: Thu Jan 15 17:27:38 2026 +0800 dt-bindings: display/msm: qcom, kaanapali-dpu: Add Kaanapali Add DPU version 13.0 for Qualcomm Kaanapali Soc. The Kaanapali DPU and SM8750 have significant differences, including additions and removals of registers, as well as changes in register addresses. Acked-by: Rob Herring (Arm) Signed-off-by: Yuanjie Yang Patchwork: https://patchwork.freedesktop.org/patch/698694/ Link: https://lore.kernel.org/r/20260115092749.533-2-yuanjie.yang@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 258b080dc280e927d200af51992048ec818d0491 Author: Dmitry Baryshkov Date: Mon Jan 19 14:16:40 2026 +0200 drm/msm/dpu: fix SSPP_UBWC_STATIC_CTRL programming on UBWC 5.x+ Code in dpu_hw_sspp_setup_format() doesn't handle UBWC versions bigger than 4.0. Replace switch-case with if-else checks, making sure that the register is initialized on UBWC 5.x (and later) hosts. Fixes: c2577fc1740d ("drm/msm/dpu: Add support for SM8750") Tested-by: Val Packett # x1e80100-dell-latitude-7455 Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/699280/ Link: https://lore.kernel.org/r/20260119-msm-ubwc-fixes-v4-4-0987acc0427f@oss.qualcomm.com commit 5dcec3fc1311c277369a4bdf8b292781e5cc91fd Author: Dmitry Baryshkov Date: Mon Jan 19 14:16:39 2026 +0200 drm/msm/dpu: program correct register for UBWC config on DPU 8.x+ Since DPU 8.0 there is a separate register for the second rectangle, which needs to be programmed with the UBWC config if multirect is being used. Write pipe's UBWC configuration to the correct register. Fixes: 100d7ef6995d ("drm/msm/dpu: add support for SM8450") Tested-by: Val Packett # x1e80100-dell-latitude-7455 Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/699277/ Link: https://lore.kernel.org/r/20260119-msm-ubwc-fixes-v4-3-0987acc0427f@oss.qualcomm.com commit 7ead14d4b9742b5ed244f35b999f0fe26dc23586 Author: Dmitry Baryshkov Date: Mon Jan 19 14:16:38 2026 +0200 drm/msm/dpu: offset HBB values written to DPU by -13 As in all other places, the Highest Bank Bit value should be programmed into the hardware with the offset of -13. Correct the value written into the register to prevent unpredictable results. Fixes: 227d4ce0b09e ("drm/msm: Offset MDSS HBB value by 13") Tested-by: Val Packett # x1e80100-dell-latitude-7455 Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/699276/ Link: https://lore.kernel.org/r/20260119-msm-ubwc-fixes-v4-2-0987acc0427f@oss.qualcomm.com commit e6177c7a2401b87b016728b75992926971d871fc Author: Dmitry Baryshkov Date: Mon Jan 19 14:16:37 2026 +0200 drm/msm/mdss: correct HBB programmed on UBWC 5.x and 6.x devices As in the previous generations, on UBWC 5.x and 6.x devices the Highest Bank Bit value should be programmed into the hardware with the offset of -13. Correct the value written into the register to prevent unpredictable results. Fixes: 227d4ce0b09e ("drm/msm: Offset MDSS HBB value by 13") Tested-by: Val Packett # x1e80100-dell-latitude-7455 Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/699274/ Link: https://lore.kernel.org/r/20260119-msm-ubwc-fixes-v4-1-0987acc0427f@oss.qualcomm.com commit 2c850606a46b319d5128bda59f67b1fc642d94ef Author: Arnaldo Carvalho de Melo Date: Tue Jan 20 17:57:43 2026 -0300 perf trace: Deal with compiler const checks The strchr() function these days return const/non-const based on the arg it receives, and sometimes we need to use casts when we're dealing with variables that are used in code that needs to safely change the returned value and sometimes not (as it points to really const areas). Tweak one such case. Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit 01ea38942bdcd28a7962d49d6f3a602979b81009 Author: Arnaldo Carvalho de Melo Date: Tue Jan 20 17:47:09 2026 -0300 perf tests sw-clock: Mark the volatile tmp variable as __maybe_unused As it is just used to waste some cycles, not being used as all, to silence some compilers. Noticed with gcc version 16.0.1 20260115 on fedora 44: tests/sw-clock.c: In function '__test__sw_clock_freq': tests/sw-clock.c:31:22: error: variable 'tmp' set but not used [-Werror=unused-but-set-variable=] 31 | volatile int tmp = 0; | ^~~ Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit 11ba4215d0d6acc5a7d866a5e0a063b5a8487022 Merge: b2664a90c17184 a9e732c12dab2a Author: Jonathan Corbet Date: Tue Jan 20 16:13:23 2026 -0700 Merge branch 'mauro' into docs-mw A combination of Mauro's -Werror work and my long-belated kernel-doc move. commit b2664a90c171846fcd572d93f6f21459721a1d2e Author: Jonathan Corbet Date: Mon Jan 12 09:19:49 2026 -0700 jobserver: Split up the big try: block The parsing of jobserver options is done in a massive try: block that hides problems and (perhaps) bugs. Split up that block and make the logic explicit by moving the initial parsing of MAKEFLAGS out of that block. Add warnings in the places things can go wrong. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit a9e732c12dab2a7fc2e354bc524af6a8f73f4bc7 Author: Jonathan Corbet Date: Tue Jan 20 15:57:06 2026 -0700 docs: add a scripts/kernel-doc symbolic link Some folks evidently have muscle memory expecting kernel-doc to be under scripts/. Now that we have moved it to tools/docs, leave behind a symbolic link to reduce the global profanity count. Signed-off-by: Jonathan Corbet commit 4a3efd128f7da996b677151790d043ec44a00561 Author: Jonathan Corbet Date: Tue Jan 20 15:50:38 2026 -0700 docs: sphinx-build-wrapper: stop setting kerneldoc_bin for Sphinx Now that the Sphinx build does not use the kerneldoc_bin configuration variable, we shouldn't try to set it in the build wrapper or we get a nifty warning: WARNING: unknown config value 'kerneldoc_bin' in override, ignoring Signed-off-by: Jonathan Corbet commit 0407f3714ce559bc0116b05a1b916321b832aca1 Author: Mauro Carvalho Chehab Date: Mon Jan 19 13:05:04 2026 +0100 docs: conf.py: get rid of the now unused kerneldoc_bin env var In the past, this contained the location of the binary file to parse kernel-doc. Nowadays, it is used only for debugging purposes, inside kerneldoc.py extension. Move it to sphinx/kerneldoc.py, to avoid needing to handle with it on several places. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 35c0f975ef4a96cb488bcb5fca6e852fc347bc49 Author: Mauro Carvalho Chehab Date: Mon Jan 19 13:05:03 2026 +0100 docs: kdoc: improve description of MsgFormatter The description there is quite vague. Make it clearer. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <94269990e2d665bec08a1b6f4d28d84939cb9d83.1768823489.git.mchehab+huawei@kernel.org> commit 32e9a42440a230b14c438099bc5fccb5012a638a Author: Mauro Carvalho Chehab Date: Mon Jan 19 13:05:02 2026 +0100 docs: kdoc: move the return values to the helper message It makes sense to describe what kernel-doc is expected to return on its help message. Move such messages to argparse epilog. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <3bcfa48016770929fcd073376515e3ff0b777ea8.1768823489.git.mchehab+huawei@kernel.org> commit eba6ffd126cd52358181ed5a179644a161f9c65f Author: Jonathan Corbet Date: Mon Jan 19 13:05:01 2026 +0100 docs: kdoc: move kernel-doc to tools/docs kernel-doc is the last documentation-related tool still living outside of the tools/docs directory; the time has come to move it over. [mchehab: fixed kdoc lib location] Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <311d17e403524349940a8b12de6b5e91e554b1f4.1768823489.git.mchehab+huawei@kernel.org> commit 24f984aa117f376b237e7b78a760dbda20383a0d Author: Jonathan Corbet Date: Mon Jan 19 13:05:00 2026 +0100 docs: kdoc: remove support for an external kernel-doc from sphinx The ability to build the docs with an external kernel-doc program involves some truly confusing logic and complicates the task of moving kernel-doc out of scripts/. But this feature is not useful for normal documentation builds, and the external kernel-doc can always be run by hand when it needs debugging. So just remove that feature and make life easier. There is still a bunch of logic to build a command line that we never use; the idea is to be able to output it, but I'm not sure if that is worth keeping. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 6cc45ee5df3bd89c8fa62aa2be91f747938686a1 Author: Mauro Carvalho Chehab Date: Mon Jan 19 13:04:59 2026 +0100 docs: kdoc: some fixes to kernel-doc comments There are some typos and English errors in the comments of kernel‑doc.py. Locate them with the help of an LLM (gpt‑oss 14B), executed locally with this prompt: review English grammar and syntax at the comments on the code below: While LLM worked fine for the task of doing an English grammar review for strings, being able to distinguish them from the actual code, it was not is perfect: some things required manual work to fix. - While here, replace: "/**" with: ``/**`` As, if we ever rename this script to kernel_doc.py and add it to Sphinx ext autodoc, we want to avoid this warning: scripts/kernel_doc.py:docstring of kernel_doc:10: WARNING: Inline strong start-string without end-string. [docutils] Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit bd28e99720f3f070e80551b5e94695640d3a730a Author: Mauro Carvalho Chehab Date: Mon Jan 19 13:04:58 2026 +0100 docs: kdoc: ensure that comments are using our coding style Along kernel-doc libs, we opted to have all comments starting/ending with a blank comment line. Use the same style here. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <50e430acd333a500719205e80ab3b2d297edcd7d.1768823489.git.mchehab+huawei@kernel.org> commit 802774d8539fa73487190ec45438777a3c38d424 Author: Mauro Carvalho Chehab Date: Mon Jan 19 13:04:57 2026 +0100 docs: kdoc: avoid error_count overflows The glibc library limits the return code to 8 bits. We need to stick to this limit when using sys.exit(error_count). Signed-off-by: Mauro Carvalho Chehab Cc: stable@vger.kernel.org Signed-off-by: Jonathan Corbet Message-ID: <233d1674db99ed8feb405a2f781de350f0fba0ac.1768823489.git.mchehab+huawei@kernel.org> commit 292eca3163218f2185a8eabe59f4a576bb9e05f8 Author: Mauro Carvalho Chehab Date: Mon Jan 19 13:04:56 2026 +0100 docs: kdoc: fix logic to handle unissued warnings Changeset 469c1c9eb6c9 ("kernel-doc: Issue warnings that were silently discarded") didn't properly addressed the missing messages behavior, as it was calling directly python logger low-level function, instead of using the expected method to emit warnings. Basically, there are two methods to log messages: - self.config.log.warning() - This is the raw level to emit a warning. It just writes the a message at stderr, via python logging, as it is initialized as: self.config.log = logging.getLogger("kernel-doc") - self.config.warning() - This is where we actually consider a message as a warning, properly incrementing error count. Due to that, several parsing error messages are internally considered as success, causing -Werror to not work on such messages. While here, ensure that the last ignored entry will also be handled by adding an extra check at the end of the parse handler. Fixes: 469c1c9eb6c9 ("kernel-doc: Issue warnings that were silently discarded") Closes: https://lore.kernel.org/linux-doc/20260112091053.00cee29a@foz.lan/ Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Acked-by: Andy Shevchenko Signed-off-by: Jonathan Corbet Message-ID: <95109a6585171da4d6900049deaa2634b41ee743.1768823489.git.mchehab+huawei@kernel.org> commit 05138e8ff287188be7b1bedf022c8b4fd1f09a25 Author: Lijo Lazar Date: Mon Jan 19 10:11:09 2026 +0530 drm/amd/pm: Fix unneeded semicolon warning Fix the warning reported. drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c:909:3-4: Unneeded semicolon Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601182157.r1AfndME-lkp@intel.com/ Fixes: b480f573a8ab ("drm/amd/pm: Use gpu metrics 1.9 for SMUv13.0.12") Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 1de6763bdd0437473239103d7733b24f11e0d824 Author: Mukesh Ogare Date: Tue Jan 20 12:07:18 2026 +0530 drm/radeon: convert VCE logging to drm_* helpers Replace legacy DRM_INFO() logging in the VCE code with drm_info() helper that takes a struct drm_device. This provides proper device context in dmesg on multi-GPU systems and aligns the radeon driver with current DRM logging practices. Note that this change logs firmware version information at info level and does not indicate a failure. Signed-off-by: Mukesh Ogare Signed-off-by: Alex Deucher commit e924c7004b08e4e173782bad60b27841d889e371 Author: Timur Kristóf Date: Sun Jan 18 14:03:45 2026 +0100 drm/amd/display: Only poll analog connectors Analog connectors may be hot-plugged unlike other connector types that don't support HPD. Stop DRM from polling other connector types that don't support HPD, such as eDP, LVDS, etc. These were wrongly polled when analog connector support was added, causing issues with the seamless boot process. Fixes: c4f3f114e73c ("drm/amd/display: Poll analog connectors (v3)") Signed-off-by: Timur Kristóf Reported-by: Matthew Schwartz Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 0314df64dd328261215215a201b578ffbd56d3db Author: Runrun Liu Date: Mon Jan 19 16:44:03 2026 +0800 drm/amd/display: fix misspelling of "minimum" in dc_dsc.c Fix the typo "miniumum" → "minimum" in a comment in dc_dsc.c. This typo is already listed in scripts/spelling.txt by commit 8c3200265787 ("scripts/spelling.txt: add several more common spelling mistakes"). Suggested-by: Cryolitia PukNgae Signed-off-by: Runrun Liu Signed-off-by: Alex Deucher commit f16a208cfb55dd39deab74957783a19b0130b261 Author: Taimur Hassan Date: Fri Jan 9 19:34:11 2026 -0500 drm/amd/display: Promote DC to 3.2.366 This version brings along the following updates: - Update memory QoS measurement interface. - Panel inst for monitors. - Disable FEC when powering down encoders. - Detect panel type from VSDB. - Check NULL before accessing a variable. - Initialize a default to phyd32clk. - Revert "init dispclk from bootup clock". - Add IPS residency info to debugfs. - Ensure link output is disabled in backend reset for PLL_ON. - Remove unused code. - Add DMU crash recovery callback to DM. - Remove coverity comments. Signed-off-by: Taimur Hassan Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Acked-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit e51b709a6dd0b95bfd9df7626b7f4a9d325fc3ff Author: Alex Deucher Date: Wed Jan 7 12:39:26 2026 -0500 drm/amdgpu: add new job ids Use this for gfx, sdma, vpe IB tests and kernel shaders. The end goal it to get rid of the direct IB submit without a job structure. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 5eb680a06007f2f6ea333d11a4e29039da90614b Author: Alex Deucher Date: Mon Dec 29 15:24:10 2025 -0500 drm/amdgpu: fix error handling in ib_schedule() If fence emit fails, free the fence if necessary. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 4321c5cac7f21e88d3bae9a67d5a6008d0b4a9c4 Author: Alex Hung Date: Tue Jan 6 17:18:29 2026 -0700 drm/amd/display: Remove coverity comments and fix spaces [WHAT] Coverity annotation is useless and thus is removed along with other fixes for spacing errors. Signed-off-by: Alex Hung Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Acked-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 443c30f243a3f07c310650f827cb71c2a1d5500b Author: Nicholas Kazlauskas Date: Thu Jan 8 14:00:02 2026 -0500 drm/amd/display: Add DMU crash recovery callback to DM [Why] To improve reliability of the system in the case of infrequent or potentially recoverable hangs when the DMU times out. [How] Attempt to recover the ASIC when DMU hangs by triggering a crash recovery callback for the DM to forward to the base driver. Reviewed-by: Dillon Varone Signed-off-by: Nicholas Kazlauskas Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c0d6f52f9b62479d61f8cd4faf9fb2f8bce6e301 Author: Charlene Liu Date: Tue Jan 6 10:41:20 2026 -0500 drm/amd/display: Remove unused code [why] two sets of dccg_init: one in dc/dccg, one in dc/hwss. remove hwss's dccg_init for asics not use it. Reviewed-by: Chris Park Reviewed-by: Dillon Varone Signed-off-by: Charlene Liu Signed-off-by: Ilya Bakoulin Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 4589712e0111352973131bad975023b25569287c Author: Nicholas Kazlauskas Date: Tue Jan 6 11:11:19 2026 -0500 drm/amd/display: Ensure link output is disabled in backend reset for PLL_ON [Why] We're missing the code to actually disable the link output when we have to leave the SYMCLK_ON but the TX remains OFF. [How] Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable the link output when the backend is reset. Reviewed-by: Ovidiu (Ovi) Bunea Signed-off-by: Nicholas Kazlauskas Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d5db4f88e0db6fdbc3f3681458132c0d18a44a29 Author: Ray Wu Date: Tue Jan 6 17:58:48 2026 +0800 drm/amd/display: Add IPS residency info to debugfs [Why] For debugging and testing purpose [How] Usage: - echo 1 > /sys/kernel/debug/dri/0/amdgpu_dm_ips_residency_cntl - echo 0 > /sys/kernel/debug/dri/0/amdgpu_dm_ips_residency_cntl - cat /sys/kernel/debug/dri/0/amdgpu_dm_ips_residency Reviewed-by: ChiaHsuan (Tom) Chung Signed-off-by: Ray Wu Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a625dc4989a2affb8f06e7b418bf30e1474b99c1 Author: Wang, Sung-huai Date: Tue Dec 30 11:01:38 2025 +0800 drm/amd/display: Revert "init dispclk from bootup clock for DCN315" [Why&How] This reverts commit 14bb17cc37e0. Due to the change, the display shows garbage on startup. We have an alternative solution for the original issue: d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not") Reviewed-by: Nicholas Kazlauskas Signed-off-by: Wang, Sung-huai Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit bdc26342c49e1dc1afb48feeb20c9d74d15b784c Author: Wang, Sung-huai Date: Wed Dec 24 13:04:48 2025 +0800 drm/amd/display: Revert "init dispclk from bootup clock for DCN314" [Why&How] This reverts commit f082daf08f2f. Due to the change, the display shows garbage on startup. We have an alternative solution for the original issue: d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not") Reviewed-by: Nicholas Kazlauskas Signed-off-by: Wang, Sung-huai Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c59ade93fbf530abe42afc4b79fef3cc771f91f1 Author: Alex Hung Date: Tue Jan 6 10:00:00 2026 -0700 drm/amd/display: Initialize a default to phyd32clk [WHAT] phyd32clk may not be assigned before used. Give it a value based on the default from get_phyd32clk_src(). This is reported as an UNINIT error by Coverity. Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 803a4cb8e3a4790c38be7e9bf64adfd2b6bdeeac Author: Alex Hung Date: Tue Jan 6 09:42:26 2026 -0700 drm/amd/display: Check NULL before accessing a variable [WHAT] Check NULL before accessing link, not after. This is reported as a REVERSE_INULL error by Coverity. Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0a62732e53d7e295e1733a2d9bf661e593d86675 Author: Mario Limonciello (AMD) Date: Mon Jan 5 21:52:48 2026 -0600 drm/amd/display: Detect panel type from VSDB [Why] The AMD VSDB contains two bits that indicate the type of panel connected. This can be useful for policy decisions based upon panel technology. [How] Read the bits for the panel type when parsing VSDB and store them in the dc_link. Reviewed-by: Harry Wentland Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8cee62904caf95e5698fa0f2d420f5f22b4dea15 Author: Ovidiu Bunea Date: Fri Jan 2 17:48:59 2026 -0500 drm/amd/display: Disable FEC when powering down encoders [why & how] VBIOS DMCUB FW can enable FEC for capable eDPs, but S/W DC state is only updated for link0 when transitioning into OS with driver loaded. This causes issues when the eDP is immediately hidden and DIG0 is assigned to another link that does not support FEC. Driver will attempt to disable FEC but FEC enablement occurs based on the link state, which does not have fec_state updated since it is a different link. Thus, FEC disablement on DIG0 will get skipped and cause no light up. Reviewed-by: Karen Chen Signed-off-by: Ovidiu Bunea Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 942782883955b52f399b99ec6f0e6af2c7e8d440 Author: Peichen Huang Date: Wed Dec 24 14:39:52 2025 +0800 drm/amd/display: panel inst for monitors [WHY] To find proper panel replay panel inst for external monitors. [HOW] Use otg index as panel replay panel inst. Both Replay features use the same logic to get panel inst. Correct the bug that would overwrite panel inst in cmd Reviewed-by: Robin Chen Signed-off-by: Peichen Huang Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 1417281ca89c7f39eb91a8cd77e2fd9c25f3bb77 Author: Wenjing Liu Date: Tue Dec 16 19:37:30 2025 -0500 drm/amd/display: update memory QoS measurement interface [how] - Consolidate memory QoS measurement functions into a single interface for better maintainability and usability. - Update function naming for improved clarity. - Unify latency measurements into a single function call with update programming sequence. - Add `start_measuring_urgent_assertion_count` and `get_urgent_assertion_count` interfaces. - Add `start_measuring_prefetch_data_size` and `get_prefetch_data_size` interfaces. - Update start_measuring_unbounded_bandwidth implementation to measure 200 data returns in the middle of prefetch window. Reviewed-by: Dillon Varone Signed-off-by: Wenjing Liu Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit e53278b220df98fd5261cbeeef75519d00930029 Author: Mario Limonciello Date: Thu Jan 15 15:45:43 2026 -0600 drm/amd: Update IP versions for Gorgon Point products Gorgon point products were announced. Add the IP versions for each product. Link: https://www.amd.com/en/products/processors/laptop/ryzen-pro/ai-400-series/amd-ryzen-ai-9-hx-pro-475.html Link: https://www.amd.com/en/products/processors/laptop/ryzen-pro/ai-400-series/amd-ryzen-ai-9-hx-pro-470.html Link: https://www.amd.com/en/products/processors/laptop/ryzen-pro/ai-400-series/amd-ryzen-ai-9-pro-465.html Link: https://www.amd.com/en/products/processors/laptop/ryzen-pro/ai-400-series/amd-ryzen-ai-7-pro-450.html Link: https://www.amd.com/en/products/processors/laptop/ryzen-pro/ai-400-series/amd-ryzen-ai-5-pro-440.html Link: https://www.amd.com/en/products/processors/laptop/ryzen-pro/ai-400-series/amd-ryzen-ai-5-pro-435.html Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 17b2c526fd8026d8e0f4c0e7f94fc517e3901589 Author: Ivan Lipski Date: Fri Jan 16 10:03:54 2026 -0500 drm/amd/display: Clear HDMI HPD pending work only if it is enabled [Why&How] On amdgpu_dm_connector_destroy(), the driver attempts to cancel pending HDMI HPD work without checking if the HDMI HPD is enabled. Added a check that it is enabled before clearing it. Fixes: 6a681cd90345 ("drm/amd/display: Add an hdmi_hpd_debounce_delay_ms module") Signed-off-by: Ivan Lipski Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher commit e6048510c3197f3aa7eb4a6993b1edb22ff7ffa3 Author: Alex Deucher Date: Wed Jan 7 11:40:34 2026 -0500 drm/amdgpu/jpeg4.0.3: remove redundant sr-iov check The per queue reset flag is only set when sr-iov is disabled so this check is not necessary as the function will never be called on sr-iov. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 230ef3977d6ffdd498ffa9baa6f5a061786189bf Author: Jonathan Kim Date: Wed Dec 17 11:03:12 2025 -0500 drm/amdkfd: fix gfx11 restrictions on debugging cooperative launch Restrictions on debugging cooperative launch for GFX11 devices should align to CWSR work around requirements. i.e. devices without the need for the work around should not be subject to such restrictions. Signed-off-by: Jonathan Kim Reviewed-by: James Zhu Signed-off-by: Alex Deucher commit 54f2fc76ddd3caa7ec8d6018b10147a82b8215ec Author: Perry Yuan Date: Tue Jan 13 15:04:04 2026 +0800 drm/amdgpu: Improve IP discovery checksum failure logging Enhance the error logging in amdgpu_discovery_verify_checksum() to print the calculated checksum, the expected checksum, the data size. This extra context helps quickly identify if the issue is a data corruption, a partially read binary, or an invalid table header without requiring additional instrumentation. Signed-off-by: Perry Yuan Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 5d42ee457ccd1fb5da4c7f817825b2806ec36956 Author: Jiqian Chen Date: Wed Jan 14 18:06:10 2026 +0800 drm/amdgpu: free hw_vm_fence when fail in amdgpu_job_alloc If drm_sched_job_init fails, hw_vm_fence is not freed currently, then cause memory leak. Fixes: db36632ea51e ("drm/amdgpu: clean up and unify hw fence handling") Link: https://lore.kernel.org/amd-gfx/a5a828cb-0e4a-41f0-94c3-df31e5ddad52@amd.com/T/#t Signed-off-by: Jiqian Chen Reviewed-by: Amos Kong Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit fc3336be9c6297282dd7968a597166b212cb0dc0 Author: Jesse.Zhang Date: Tue Jan 13 16:13:47 2026 +0800 drm/amd/amdgpu: Add independent hang detect work for user queue fence In error scenarios (e.g., malformed commands), user queue fences may never be signaled, causing processes to wait indefinitely. To address this while preserving the requirement of infinite fence waits, implement an independent timeout detection mechanism: 1. Initialize a hang detect work when creating a user queue (one-time setup) 2. Start the work with queue-type-specific timeout (gfx/compute/sdma) when the last fence is created via amdgpu_userq_signal_ioctl (per-fence timing) 3. Trigger queue reset logic if the timer expires before the fence is signaled v2: make timeout per queue type (adev->gfx_timeout vs adev->compute_timeout vs adev->sdma_timeout) to be consistent with kernel queues. (Alex) v3: The timeout detection must be independent from the fence, e.g. you don't wait for a timeout on the fence but rather have the timeout start as soon as the fence is initialized. (Christian) v4: replace the timer with the `hang_detect_work` delayed work. Reviewed-by: Alex Deucher Acked-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 5aaa5058dec5bfdcb24c42fe17ad91565a3037ca Author: Likun Gao Date: Mon Dec 15 11:33:58 2025 +0800 drm/amdgpu: remove frame cntl for gfx v12 Remove emit_frame_cntl function for gfx v12, which is not support. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit d4a814f400d4f3bd1e52f9b82e7d1f11b2721cf8 Author: Philip Yang Date: Thu Nov 20 16:43:04 2025 -0500 drm/amdkfd: Move gfx9.4.3 and gfx 9.5 MQD to HBM To reduce queue switch latency further, move MQD to VRAM domain, CP access MQD and control stack via FB aperture, this requires contiguous pages. After MQD is initialized, updated or restored, flush HDP to guarantee the data is written to HBM and GPU cache is invalidated, then CP will read the new MQD. Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit cc4adab164b772a34b3340d644b7c4728498581e Merge: 3f6cf0653f8a21 8f0b4cce4481fb Author: Dmitry Baryshkov Date: Wed Jan 21 00:06:55 2026 +0200 Merge tag 'v6.19-rc1' into msm-next Merge Linux 6.19-rc1 in order to catch up with other changes (e.g. UBWC config database defining UBWC_6). Signed-off-by: Dmitry Baryshkov commit 20f73d6fc298a22d97286e8fd8529c064d1a33f5 Author: Yiwei Lin Date: Thu Jan 15 14:53:41 2026 +0800 scsi: docs: Add description for missing options of link_power_management_policy With the kernel update we have more different policy for SCSI link power management. Add the corresponding description to the file. Signed-off-by: Yiwei Lin Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260115065341.10230-1-s921975628@gmail.com> commit 3c5fefc8f1c87ce5aad32b752abd1c0f4d25a39a Author: junan Date: Fri Jan 16 13:03:13 2026 +0800 doc: kgdb: Add description about rodata=off kernel parameter STRICT_KERNEL_RWX can not be turned off throught menuconfig on some architectures, pass "rodata=off" to the kernel in this case. Tested with qemu on arm64. Signed-off-by: junan Suggested-by: Will Deacon Reviewed-by: Daniel Thompson (RISCstar) Signed-off-by: Jonathan Corbet Message-ID: <20260116050410.772340-2-junan76@163.com> commit a66437c27979577fe1feffba502b9eadff13af7d Author: Dave Hansen Date: Mon Jan 19 12:04:18 2026 -0800 Documentation: Provide guidelines for tool-generated content In the last few years, the capabilities of coding tools have exploded. As those capabilities have expanded, contributors and maintainers have more and more questions about how and when to apply those capabilities. Add new Documentation to guide contributors on how to best use kernel development tools, new and old. Note, though, there are fundamentally no new or unique rules in this new document. It clarifies expectations that the kernel community has had for many years. For example, researchers are already asked to disclose the tools they use to find issues by Documentation/process/researcher-guidelines.rst. This new document just reiterates existing best practices for development tooling. In short: Please show your work and make sure your contribution is easy to review. Signed-off-by: Dave Hansen Reviewed-by: Shuah Khan Reviewed-by: Kees Cook Reviewed-by: Greg Kroah-Hartman Reviewed-by: Miguel Ojeda Reviewed-by: Luis Chamberlain Reviewed-by: SeongJae Park Reviewed-by: Dan Williams Reviewed-by: Steven Rostedt Reviewed-by: Paul E. McKenney Reviewed-by: Simon Glass Reviewed-by: Lee Jones Reviewed-by: Lorenzo Stoakes Cc: NeilBrown Cc: Lorenzo Stoakes Cc: Dan Williams Cc: Theodore Ts'o Cc: Sasha Levin Cc: Jonathan Corbet Cc: Vlastimil Babka Cc: workflows@vger.kernel.org Cc: ksummit@lists.linux.dev Link: https://lore.kernel.org/all/cfb8bb96-e798-474d-bc6f-9cf610fe720f@lucifer.local/ -- Changes from v5: * Add more review tags * Add a blurb to the "special" asks bullet to mention that extra testing may be requested. * Reword the closing paragraph of "Out of Scope" section for clarity * Remove an "AI" and make small wording tweak (Jon) Changes from v4: * Modest tweaking and rewording to strengthen language * Add a section to help alleviate concerns that the document would not enable maintainers to act forcefully enough in the face of high-volume low-quality contributions (aka. AI slop). This is very close to some text that Lorenzo posted. I just made some very minor wording tweaks and spelling fixes. * Note: v4 mistakenly had "v3" in the subject Changes from v3: * Wording/formatting tweaks (Randy) Changes from v2: * Mention testing (Shuah) * Remove "very", rename LLM => coding assistant (Dan) * More formatting sprucing up and minor typos (Miguel) * Make changelog and text less flashy (Christian) * Tone down critical=>helpful (Neil) Changes from v1: * Rename to generated-content.rst and add to documentation index. (Jon) * Rework subject to align with the new filename * Replace commercial names with generic ones. (Jon) * Be consistent about punctuation at the end of bullets for whole sentences. (Miguel) * Formatting sprucing up and minor typos (Miguel) This document was a collaborative effort from all the members of the TAB. I just reformatted it into .rst and wrote the changelog. Signed-off-by: Jonathan Corbet Message-ID: <20260119200418.89541-1-dave.hansen@linux.intel.com> commit 6cdd8b58458941ab4c0ffade957db8dc773fd91c Author: Jessica Zhang Date: Wed Oct 29 23:31:45 2025 -0700 mailmap: Update Jessica Zhang's email address Update mailmap to point to my current address Reported-by: Neil Armstrong Link: http://lore.kernel.org/r/6eedef19-5473-4c09-bae5-04490f711d9e@linaro.org Signed-off-by: Jessica Zhang Acked-by: Neil Armstrong Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20251029-mailmap-fix-v1-1-8534ffa12ed3@gmail.com commit 993663874be557a80d4cdc9700b760bb6d27c098 Author: Jaegeuk Kim Date: Fri Jan 16 21:50:44 2026 +0000 Revert "f2fs: add timeout in f2fs_enable_checkpoint()" This reverts commit 4bc347779698b5e67e1514bab105c2c083e55502. Let's apply a better approach to flush the only dirty pages committed by user to avoid the delay caused by unncessary incoming ones. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6cebd8e193d023c2580ca7b4f8b22a60701cb3d4 Author: Wentong Tian Date: Tue Jan 13 00:27:09 2026 +0800 Input: serio - complete sizeof(*pointer) conversions Complete the sizeof(*pointer) conversion for arc_ps2, altera_ps2, and olpc_apsp drivers. This follows the cleanup initiated in commit 06b449d7f7c3 ("Input: serio - use sizeof(*pointer) instead of sizeof(type)). Signed-off-by: Wentong Tian Link: https://patch.msgid.link/20260112162709.89515-1-tianwentong2000@gmail.com Signed-off-by: Dmitry Torokhov commit 3d020f2e3baea49f68c71f73ebb947da8e6fedc5 Author: James Clark Date: Mon Jan 19 10:18:36 2026 +0000 perf cs-etm: Test sparse CPU maps We only currently test with default (all CPUs) or --per-thread mode. Different permutations of the "-C" option can affect decoding so add tests for some of them. Signed-off-by: James Clark Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit a70493e2bb0878885aa7a8178162550270693eb1 Author: James Clark Date: Mon Jan 19 10:18:35 2026 +0000 perf cs-etm: Fix decoding for sparse CPU maps The ETM decoder incorrectly assumed that auxtrace queue indices were equivalent to CPU number. This assumption is used for inserting records into the queue, and for fetching queues when given a CPU number. This assumption held when Perf always opened a dummy event on every CPU, even if the user provided a subset of CPUs on the commandline, resulting in the indices aligning. For example: # event : name = cs_etm//u, , id = { 2451, 2452 }, type = 11 (cs_etm), size = 136, config = 0x4010, { sample_period, samp> # event : name = dummy:u, , id = { 2453, 2454, 2455, 2456 }, type = 1 (PERF_TYPE_SOFTWARE), size = 136, config = 0x9 (PER> 0 0 0x200 [0xd0]: PERF_RECORD_ID_INDEX nr: 6 ... id: 2451 idx: 2 cpu: 2 tid: -1 ... id: 2452 idx: 3 cpu: 3 tid: -1 ... id: 2453 idx: 0 cpu: 0 tid: -1 ... id: 2454 idx: 1 cpu: 1 tid: -1 ... id: 2455 idx: 2 cpu: 2 tid: -1 ... id: 2456 idx: 3 cpu: 3 tid: -1 Since commit 811082e4b668 ("perf parse-events: Support user CPUs mixed with threads/processes") the dummy event no longer behaves in this way, making the ETM event indices start from 0 on the first CPU recorded regardless of its ID: # event : name = cs_etm//u, , id = { 771, 772 }, type = 11 (cs_etm), size = 144, config = 0x4010, { sample_period, sample> # event : name = dummy:u, , id = { 773, 774 }, type = 1 (PERF_TYPE_SOFTWARE), size = 144, config = 0x9 (PERF_COUNT_SW_DUM> 0 0 0x200 [0x90]: PERF_RECORD_ID_INDEX nr: 4 ... id: 771 idx: 0 cpu: 2 tid: -1 ... id: 772 idx: 1 cpu: 3 tid: -1 ... id: 773 idx: 0 cpu: 2 tid: -1 ... id: 774 idx: 1 cpu: 3 tid: -1 This causes the following segfault when decoding: $ perf record -e cs_etm//u -C 2,3 -- true $ perf report perf: Segmentation fault -------- backtrace -------- #0 0xaaaabf9fd020 in ui__signal_backtrace setup.c:110 #1 0xffffab5c7930 in __kernel_rt_sigreturn [vdso][930] #2 0xaaaabfb68d30 in cs_etm_decoder__reset cs-etm-decoder.c:85 #3 0xaaaabfb65930 in cs_etm__get_data_block cs-etm.c:2032 #4 0xaaaabfb666fc in cs_etm__run_per_cpu_timeless_decoder cs-etm.c:2551 #5 0xaaaabfb6692c in (cs_etm__process_timeless_queues cs-etm.c:2612 #6 0xaaaabfb63390 in cs_etm__flush_events cs-etm.c:921 #7 0xaaaabfb324c0 in auxtrace__flush_events auxtrace.c:2915 #8 0xaaaabfaac378 in __perf_session__process_events session.c:2285 #9 0xaaaabfaacc9c in perf_session__process_events session.c:2442 #10 0xaaaabf8d3d90 in __cmd_report builtin-report.c:1085 #11 0xaaaabf8d6944 in cmd_report builtin-report.c:1866 #12 0xaaaabf95ebfc in run_builtin perf.c:351 #13 0xaaaabf95eeb0 in handle_internal_command perf.c:404 #14 0xaaaabf95f068 in run_argv perf.c:451 #15 0xaaaabf95f390 in main perf.c:558 #16 0xffffaab97400 in __libc_start_call_main libc_start_call_main.h:74 #17 0xffffaab974d8 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 #18 0xaaaabf8aa8f0 in _start perf[7a8f0] Fix it by inserting into the queues based on CPU number, rather than using the index. Fixes: 811082e4b668db96 ("perf parse-events: Support user CPUs mixed with threads/processes") Signed-off-by: James Clark Tested-by: Leo Yan Cc: Adrian Hunter Cc: Alexander Shishkin Cc: coresight@lists.linaro.org Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Suzuki Poulouse Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 3033da61dc3982234da896be03e50633b62cfbd3 Author: Andy Shevchenko Date: Tue Jan 20 12:33:52 2026 -0800 Input: wdt87xx_i2c - switch to use dev_err_probe() Switch to use dev_err_probe() to simplify the error path and unify a message template. With that being done, drop the now no-op message for -ENOMEM as allocator will print a big warning anyway and remove duplicate message for devm_request_threaded_irq(). Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082445.44186-3-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 838def24130540dcb7b846bdb2bad63ea4c3dd55 Author: James Clark Date: Thu Dec 4 09:10:54 2025 +0000 perf test: Add missing newlines in debug messages These debug messages bleed into the next log line. Fix it by adding the missing newlines. Reviewed-by: Ian Rogers Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 9bb93278c35d658057f513ba25ffb2b5204c2b9e Author: James Clark Date: Thu Dec 4 09:10:53 2025 +0000 perf tools: Always uniquify event names evlist__uniquify_evsel_names() only gets called in __parse_events() if verbose is > 0. This means that the auto added "slots" events stay as "slots" rather than being expanded to "cpu_core/slots/" unless Perf is run in verbose mode. This is invisible to users when running Perf stat because evlist__print_counters() always calls it regardless of verbose mode before displaying. The only thing this seems to affect is the test "Parsing of all PMU events from sysfs" which fails when not run in verbose mode. test__checkevent_pmu_events() always expects event names to be prefixed with the pmu name, but this only happens for "slots" events after evlist__uniquify_evsel_names() is called. One fix could be to relax the test to accept the non prefixed name in normal mode. But seeing as Perf stat uniquifies unconditionally, make parse_events() do the same. This fixes the following test failure: $ perf test "Parsing of all PMU events from sysfs" 5.2: Parsing of all PMU events from sysfs : FAILED! $ Reviewed-by: Ian Rogers Signed-off-by: James Clark Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit dc7fb075f7de33ee78a2133598215af6a87d7ab3 Author: Leo Yan Date: Fri Dec 12 17:25:00 2025 +0000 perf c2c: Update documentation for adding memory event table Users may occasionally need to see which options are applied to memory events. This helps to understand the behavior of "perf c2c" and "perf mem", and provides guidance for configuring memory event options directly. Add a table to track memory events and their corresponding options, and include the Arm SPE events in it. Suggested-by: Al Grant Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit e524dda49340cb973c95fdfd6aa700eeb67aa128 Author: Leo Yan Date: Fri Dec 12 17:24:59 2025 +0000 perf mem: Simplify Arm SPE event config Since configuration fields default to zero, the zero assignments are redundant, remove them. Reviewed-by: James Clark Signed-off-by: Leo Yan Cc: Adrian Hunter Cc: Al Grant Cc: Ian Rogers Cc: Jiri Olsa Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit a58807adbed5f532efb231e5490767f284f237c0 Author: Ian Rogers Date: Wed Dec 10 11:01:41 2025 -0800 perf tests kallsyms: Fix missed map__put() Issue was caught by leak sanitizer and the test robot. Fixes: 34e271ae55382fbd ("perf test: Add kallsyms split test") Reported-by: kernel test robot Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Closes: https://lore.kernel.org/oe-lkp/202512101502.f3819cd3-lkp@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 4906eccbfae3eec58f7bf27f2921dc365bedafec Author: Haiyue Wang Date: Mon Dec 8 10:15:14 2025 +0800 perf tools: Add the legacy-cache.json to .gitignore The commit 0012e0fa221bf9cc ("perf jevents: Add legacy-hardware and legacy-cache json") will auto-generate: "pmu-events/arch/common/common/legacy-cache.json". Reviewed-by: James Clark Signed-off-by: Haiyue Wang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 069e603d8248dac98b1ef2909e2f1c4169b9da11 Author: Namhyung Kim Date: Tue Jan 13 15:37:57 2026 -0800 perf tools: Get debug info of DSO properly The dso__debuginfo() just used the path name to open the file but it may be outdated. It should check build-ID and use the file in the build-ID cache if available rather than just using the path name. Let's factor out dso__get_filename() to avoid code duplicate. Fixes: 53a61a6ca279165d ("perf annotate: Add dso__debuginfo() helper") Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit b42c4dfe02af407d04375f070f56a818ed4c92ce Author: Namhyung Kim Date: Tue Jan 13 15:29:03 2026 -0800 perf test: Add DWARF callchain conversion test $ perf test -vv "DWARF callchain" 87: perf inject to convert DWARF callchains to regular ones: --- start --- test child forked, pid 1560328 recording data with DWARF callchain [ perf record: Woken up 4 times to write data ] [ perf record: Captured and wrote 0.908 MB /tmp/perf-test.nM3WoW (105 samples) ] convert DWARF callchain using perf inject compare the both result excluding inlined functions ---- end(0) ---- 87: perf inject to convert DWARF callchains to regular ones : Ok $ Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 92ea788d2af4e65ad7a144ccfff50667e9a0d227 Author: Namhyung Kim Date: Tue Jan 13 15:29:02 2026 -0800 perf inject: Add --convert-callchain option There are applications not built with frame pointers, so DWARF is needed to get the stack traces. `perf record --call-graph dwarf` saves the stack and register data for each sample to get the stacktrace offline. But sometimes this data may have sensitive information and we don't want to keep them in the file. This new 'perf inject --convert-callchain' option creates the callchains and discards the stack and register after that. This saves storage space and processing time for the new data file. Of course, users should remove the original data file to not keep sensitive data around. :) The down side is that it cannot handle inlined callchain entries as they all have the same IPs. Maybe we can add an option to 'perf report' to look up inlined functions using DWARF - IIUC it doesn't require stack and register data. This is an example. $ perf record --call-graph dwarf -- perf test -w noploop $ perf report --stdio --no-children --percent-limit=0 > output-prev $ perf inject -i perf.data --convert-callchain -o perf.data.out $ perf report --stdio --no-children --percent-limit=0 -i perf.data.out > output-next $ diff -u output-prev output-next ... 0.23% perf ld-linux-x86-64.so.2 [.] _dl_relocate_object_no_relro | - ---elf_dynamic_do_Rela (inlined) - _dl_relocate_object_no_relro + ---_dl_relocate_object_no_relro _dl_relocate_object dl_main _dl_sysdep_start - _dl_start_final (inlined) _dl_start _start Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim Cc: Adrian Hunter Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit b58a2c1a91e79fa7eeb636433d0e8d3e6d7896c7 Author: Andy Shevchenko Date: Tue Jan 20 12:05:24 2026 -0800 Input: tsc40 - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082941.90006-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 9f18271c58b9afdd9a51e66467b774ad8becb0e0 Author: Andy Shevchenko Date: Tue Jan 20 12:05:11 2026 -0800 Input: touchwin - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082938.89437-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 2d3bb7165a3ac9448247286b49513c390a260a5e Author: Andy Shevchenko Date: Tue Jan 20 12:04:51 2026 -0800 Input: touchright - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082935.88801-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit b2c767ef3ba6b684762cdfd8be97b0565f929f99 Author: Andy Shevchenko Date: Tue Jan 20 12:03:57 2026 -0800 Input: touchit213 - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082931.88083-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 1828b52063117fa48db4c3dd637ee320bb2a788b Author: Andy Shevchenko Date: Tue Jan 20 12:03:46 2026 -0800 Input: penmount - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082926.87049-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 597c12d9f52299a77039b4af1f199af391e8b70f Author: Andy Shevchenko Date: Tue Jan 20 12:03:35 2026 -0800 Input: mtouch - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082921.86167-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 6dd774d527863f981d6dad074b03bf856e8d5921 Author: Andy Shevchenko Date: Tue Jan 20 12:03:20 2026 -0800 Input: inexio - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082917.85109-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 7cf2d840211fe06b5b9b670fe3705efe3de04ccb Author: Andy Shevchenko Date: Tue Jan 20 12:03:07 2026 -0800 Input: fujitsu_ts - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082912.84123-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit c2f24e91c9144f4163b6fb2f443e63c24b7a9bb8 Author: Andy Shevchenko Date: Tue Jan 20 12:01:27 2026 -0800 Input: hampshire - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082905.83718-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit ed9b2fc10db71c20780a246ff7977d8b1938d17b Author: Andy Shevchenko Date: Tue Jan 20 12:01:14 2026 -0800 Input: gunze - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082901.83668-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit be1735de10d0c42ea4f6214dab210e0d2f07e082 Author: Andy Shevchenko Date: Tue Jan 20 12:01:04 2026 -0800 Input: elo - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082856.83617-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 6b88bc3f0ac672a27d97849336b3723c1ff0e621 Author: Andy Shevchenko Date: Tue Jan 20 12:00:18 2026 -0800 Input: egalax_ts_serial - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082851.83584-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 572ffd4f442ea63fd73d4d664aeae6a9ab72ee44 Author: Andy Shevchenko Date: Tue Jan 20 11:58:10 2026 -0800 Input: dynapro - switch to use scnprintf() to suppress truncation warning Switch the driver to use scnprintf() to avoid warnings about potential truncation of "phys" field which we can tolerate. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260113082845.83550-1-andriy.shevchenko@linux.intel.com Signed-off-by: Dmitry Torokhov commit 7f428282fde34f06f3ab898b8a9081bf93a41f22 Author: Peter Ujfalusi Date: Tue Jan 20 21:35:07 2026 +0200 ALSA: hda: controllers: intel: add support for Nova Lake Add NVL to the PCI-ID list. Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Acked-by: Takashi Iwai Link: https://patch.msgid.link/20260120193507.14019-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit a094d8a50679356fbf045af274ccab85c9a644fb Author: Peter Ujfalusi Date: Tue Jan 20 21:35:06 2026 +0200 ALSA: hda: core: intel-dsp-config: Add support for NVL Add entry for NVL variant of Nova Lake family. Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Acked-by: Takashi Iwai Link: https://patch.msgid.link/20260120193507.14019-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 1800bcdc68ead7209451085431d80aa95ea7cd03 Author: Peter Ujfalusi Date: Tue Jan 20 21:35:05 2026 +0200 ASoC: SOF: Intel: add support for Nova Lake NVL Add support for Nova Lake (NVL). The core count for NVL is different compared to NVL-S (4 vs 2) Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Acked-by: Mark Brown Acked-by: Takashi Iwai Link: https://patch.msgid.link/20260120193507.14019-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit b190870e0e0cfb375c0d4da02761c32083f3644d Author: Peter Ujfalusi Date: Tue Jan 20 21:35:04 2026 +0200 PCI: Add Intel Nova Lake audio Device ID Add Nova Lake (NVL) audio Device ID The ID will be used by HDA legacy, SOF audio stack and the driver to determine which audio stack should be used (intel-dsp-config). Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Acked-by: Bjorn Helgaas Acked-by: Takashi Iwai Link: https://patch.msgid.link/20260120193507.14019-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit c6b2deed512af5af37798f36d1a8de74c57be949 Author: Kuan-Wei Chiu Date: Tue Jan 13 09:25:59 2026 +0000 dt-bindings: input: google,goldfish-events-keypad: Convert to DT schema Convert the Android Goldfish Events Keypad binding to DT schema format. Move the file to the input directory to match the subsystem. Update the example node name to 'keypad' to comply with generic node naming standards. Signed-off-by: Kuan-Wei Chiu Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260113092602.3197681-4-visitorckw@gmail.com Signed-off-by: Dmitry Torokhov commit 78c24e67d6f85d176af1ce29932dc215273c3957 Author: Frank Wunderlich Date: Tue Dec 23 18:56:27 2025 +0100 thermal/drivers/mediatek/lvts_thermal: Add mt7987 support Add support for MT7987. Signed-off-by: Frank Wunderlich Link: https://patch.msgid.link/20251223175710.25850-3-linux@fw-web.de Signed-off-by: Daniel Lezcano commit aee1950f73f40c29271e8ed07b8be106390ed0b8 Author: Frank Wunderlich Date: Tue Dec 23 18:56:26 2025 +0100 dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for MT7987 Add thermal controller definition for MT7987. Signed-off-by: Frank Wunderlich Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251223175710.25850-2-linux@fw-web.de Signed-off-by: Daniel Lezcano commit a13bc3286cb380aeca0d68dcb80d7611520e0b9e Author: Christoph Hellwig Date: Wed Jan 7 08:27:15 2026 +0100 NFS: make nfs_mark_return_unreferenced_delegations less aggressive Currently nfs_mark_return_unreferenced_delegations marks all open but not referenced delegations (i.e., those were found by a previous pass) as return on close, which means that we'll return them on close without a way out. Replace this with only iterating delegations that are on the LRU list, and avoid delegations that are in use by an open files to avoid this. Delegations that were never referenced while open still are be prime candidates for return from the LRU if the number of delegations is over the watermark, or otherwise will be returned by the next nfs_mark_return_unreferenced_delegations pass after they are closed. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 300ca8123c901605eda5eba33c83dc6eb03d0a3c Author: Christoph Hellwig Date: Wed Jan 7 08:27:14 2026 +0100 NFS: return delegations from the end of a LRU when over the watermark Directly returning delegations on close when over the watermark is rather suboptimal as these delegations are much more likely to be reused than those that have been unused for a long time. Switch to returning unused delegations from a new LRU list when we are above the threshold and there are reclaimable delegations instead. Pass over referenced delegations during the first pass to give delegations that aren't in active used by frequently used for stat() or similar another chance to not be instantly reclaimed. This scheme works the same as the referenced flags in the VFS inode and dentry caches. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 0ebe655bd033fd84e312980c9eba199604631e7e Author: Christoph Hellwig Date: Wed Jan 7 08:27:13 2026 +0100 NFS: add a separate delegation return list Searching for returnable delegations in the per-server delegations list can be very expensive. While commit e04bbf6b1bbe ("NFS: Avoid quadratic search when freeing delegations.") reduced the overhead a bit, the fact that all the non-returnable delegations have to be searched limits the amount of optimizations that can be done. Fix this by introducing a separate list that only contains delegations scheduled for return. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 85e056332840ec4a938cf7a082d8922533b3b169 Author: Christoph Hellwig Date: Wed Jan 7 08:27:12 2026 +0100 NFS: reformat nfs_mark_delegation_revoked Remove a level of indentation for the main code path. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 3365322401450971111ced702591ef78db950c28 Author: Christoph Hellwig Date: Wed Jan 7 08:27:11 2026 +0100 NFS: use a local RCU critical section in nfs_start_delegation_return Nested RCU critical sections are fine and very cheap. Have a local one in nfs_start_delegation_return so that the function is self-contained and to prepare for simplifying the callers. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 36e3e9387b367bd0cef3437d8181a6d6cb3c3b3f Author: Christoph Hellwig Date: Wed Jan 7 08:27:10 2026 +0100 NFS: use refcount_inc_not_zero nfs_start_delegation_return Using the unconditional reference increment means we can take a reference to a delegation already in the RCU grace period, which could cause a use after free under very unlikely conditions. Switch to use refcount_inc_not_zero instead. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit e96d9ca486b8310abc3736f45b45a91f0628b041 Author: Christoph Hellwig Date: Wed Jan 7 08:27:09 2026 +0100 NFS: don't consume a delegation reference in nfs_end_delegation_return All callers now hold references to the delegation as part of the lookup, removing the need for an extra reference for those that are actually returned which is then dropped in nfs_end_delegation_return. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 542b11c0728335a1e06f61dc71b48e9bbbe13169 Author: Christoph Hellwig Date: Wed Jan 7 08:27:08 2026 +0100 NFS: take a delegation reference in nfs4_get_valid_delegation Currently most work on struct nfs_delegation happens directly under RCU protection. This is generally fine, despite that long RCU sections are not good for performance. But for operations later taking a reference to the delegation to perform blocking work, refcount_inc is used, which can be racy against dropping the last reference and thus lead to use after frees in extremely rare cases. Fix this by taking a reference in nfs4_get_valid_delegation using refcount_inc_not_zero so that the callers have a stabilized reference they can work with and can be moved outside the RCU critical section. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 23e6208755cae5afd350f6805c7ea70bfd2b336d Author: Christoph Hellwig Date: Wed Jan 7 08:27:07 2026 +0100 NFS: simplify the detached delegation check in update_open_stateid When nfs_detach_delegation_locked detaches a delegation from an inode, it clears both nfsi->delegation and delegation->inode. Use the later in update_open_stateid to check for a detached inode, as that avoids an extra local variable, and removes the need for a RCU derefernence as we already hold the lock in the delegation. This prepares for removing the surrounding RCU critical section. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 9f6ddc90d5a2162ecfecbdb5f5ed5bd9f71cc65f Author: Christoph Hellwig Date: Wed Jan 7 08:27:06 2026 +0100 NFS: move the deleg_cur check out of nfs_detach_delegation_locked nfs_inode_set_delegation as the only direct caller of nfs_detach_delegation_locked already check this under cl_lock, so don't repeat it. Replace the lockdep coverage for the lock that was implicitly provided by the rcu_dereference_protected call that is removed with an explicit lockdep assert to keep the coverage. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 8f7e0b808067afaca0d370c49824c5393101302c Author: Christoph Hellwig Date: Wed Jan 7 08:27:05 2026 +0100 NFS: return bool from nfs_detach_delegation{,_locked} nfs_detach_delegation always returns either the passed in delegation or NULL, simplify this to a bool return. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 3e39019e687a84ffe8b784e8a9c911bdb4d7d26c Author: Christoph Hellwig Date: Wed Jan 7 08:27:04 2026 +0100 NFS: move delegation lookup into can_open_delegated Keep the delegation handling in a single place, and just return the stateid in an optional argument. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 2d80e59f29d8cd14230899dfe9c462b710521a85 Author: Christoph Hellwig Date: Wed Jan 7 08:27:03 2026 +0100 NFS: rewrite nfs_delegations_present in terms of nr_active_delegations Renewal only cares for active delegations and not revoked ones. Replace the list empty check with reading the active delegation counter to implement this. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 20151c11364ec9e0110413e7098593bf7c1db83f Author: Christoph Hellwig Date: Wed Jan 7 08:27:02 2026 +0100 NFS: remove nfs_free_delegation Open code nfs_free_delegation in the callers, because having a "free" function that wraps a revoke and put operation is a bit confusing, especially when the __free version does the actual freeing triggered by the last put. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 8cb32b9344f65dbdcb947745f812173d4bb65601 Author: Christoph Hellwig Date: Wed Jan 7 08:27:01 2026 +0100 NFS: open code nfs_delegation_need_return There is only a single caller, and the function can be condensed into a single if statement, making it more clear what is being tested there. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 86ac1b7b616bbc33f886882655d31068f0b14b8d Author: Christoph Hellwig Date: Wed Jan 7 08:27:00 2026 +0100 NFS: remove NFS_DELEGATION_INODE_FREEING This essentially reverts commit 6f9449be53f3 ("NFS: Fix a soft lockup in the delegation recovery code") because the code walking the per-server delegation list has been fixed to just skip inodes for which nfs_delegation_grab_inode fails, instead of having to restart the entire series in commit f92214e4c312 ("NFS: Avoid unnecessary rescanning of the per-server delegation list"). Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 0513044b749db4e20800da0c44e4299e1c7ed50a Author: Christoph Hellwig Date: Wed Jan 7 08:26:59 2026 +0100 NFS: drop the _locked postfix from nfs_start_delegation_return Now that nfs_start_delegation_return_locked is gone, and we have RCU locking asserts, drop the extra postfix. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 7c80c3b8c80bc79f49c978c7d6d5166bc61816b1 Author: Christoph Hellwig Date: Wed Jan 7 08:26:58 2026 +0100 NFS: assert rcu_read_lock is held in nfs_start_delegation_return_locked And clean up the dereference of the delegation a bit. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 635879a427b855db477e293514f74ffbfa920794 Author: Christoph Hellwig Date: Wed Jan 7 08:26:57 2026 +0100 NFS: remove nfs_start_delegation_return There is only one caller, so fold it into that. With that, nfs_start_delegation_return Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit ee443e116151fbcf08e2296b21f28f942b18c2ed Author: Christoph Hellwig Date: Wed Jan 7 08:26:56 2026 +0100 NFS: remove nfs_inode_detach_delegation Fold it into the only caller. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit c6c9b9bc9f6aaba1d518c7b4bcdbbd9171ce82cb Author: Christoph Hellwig Date: Wed Jan 7 08:26:55 2026 +0100 NFS: remove the NULL inode check in nfs4_inode_return_delegation_on_close The only caller dereferences a field in the inode just before calling nfs4_inode_return_delegation_on_close. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 45875b7efb8a805414fe3d74f276e5fa9cf3e34e Author: Christoph Hellwig Date: Wed Jan 7 08:26:54 2026 +0100 NFS: remove nfs_client_mark_return_all_delegations Fold nfs_client_mark_return_all_delegations into nfs_expire_all_delegations, which is the only caller. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit f8abad38684c43ce00fefc6858d16034f0f359bb Author: Christoph Hellwig Date: Wed Jan 7 08:26:53 2026 +0100 NFS: remove nfs_client_mark_return_unused_delegation_types nfs_client_mark_return_unused_delegation_types is only called by nfs_expire_unused_delegation_types, so merge the two. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 70f1e6aa3f211b70418046a66b2ebd71069ec563 Author: Christoph Hellwig Date: Wed Jan 7 08:26:52 2026 +0100 NFS: remove __nfs_client_for_each_server __nfs_client_for_each_server is only called by nfs_client_for_each_server, so merge the two. Signed-off-by: Christoph Hellwig Signed-off-by: Anna Schumaker commit 1460b9dff9af392bf7ea76861187bf2c1cac0a0e Author: Laura Nao Date: Tue Nov 25 17:16:58 2025 +0100 dt-bindings: nvmem: mediatek: efuse: Add support for MT8196 The MT8196 eFuse layout is compatible with MT8186 and shares the same decoding scheme for the gpu-speedbin cell. Reviewed-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Tested-by: AngeloGioacchino Del Regno Tested-by: Frank Wunderlich Signed-off-by: Laura Nao Link: https://patch.msgid.link/20251125-mt8196-lvts-v4-v5-8-6db7eb903fb7@collabora.com Signed-off-by: Daniel Lezcano commit 6de27b41b75599eb50ff919994b2d3a1adbde379 Author: Laura Nao Date: Tue Nov 25 17:16:57 2025 +0100 thermal/drivers/mediatek/lvts_thermal: Add MT8196 support Add LVTS driver support for MT8196. Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Tested-by: Frank Wunderlich Signed-off-by: Laura Nao Link: https://patch.msgid.link/20251125-mt8196-lvts-v4-v5-7-6db7eb903fb7@collabora.com Signed-off-by: Daniel Lezcano commit b5468be97fcc8c78e6904f718a249231b9e54896 Author: Laura Nao Date: Tue Nov 25 17:16:56 2025 +0100 thermal/drivers/mediatek/lvts: Support MSR offset for 16-bit calibration data On MT8196/MT6991, per-sensor calibration data read from eFuses is 16-bit. When the LVTS controller operates in 16-bit mode, a fixed offset must be added to MSR values during post-processing to obtain correct temperature readings. Introduce a new msr_offset field in lvts_data, program the respective register and apply the offset to the calibration data read from eFuses. Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Tested-by: Frank Wunderlich Signed-off-by: Laura Nao Link: https://patch.msgid.link/20251125-mt8196-lvts-v4-v5-6-6db7eb903fb7@collabora.com Signed-off-by: Daniel Lezcano commit 6cd9a3b23a2d534fa582b78fd988fef7ed837ee9 Author: Laura Nao Date: Tue Nov 25 17:16:55 2025 +0100 thermal/drivers/mediatek/lvts: Add support for ATP mode MT8196/MT6991 uses ATP (Abnormal Temperature Prevention) mode to detect abnormal temperature conditions, which involves reading temperature data from a dedicated set of registers separate from the ones used for immediate and filtered modes. Add support for ATP mode and its relative registers to ensure accurate temperature readings and proper thermal management on MT8196/MT6991 devices. While at it, convert mode defines to enum. Reviewed-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Tested-by: AngeloGioacchino Del Regno Tested-by: Frank Wunderlich Signed-off-by: Laura Nao Link: https://patch.msgid.link/20251125-mt8196-lvts-v4-v5-5-6db7eb903fb7@collabora.com Signed-off-by: Daniel Lezcano commit 6d0fc797777c6f2b9d5202fe15fbc43b2209fdd2 Author: Laura Nao Date: Tue Nov 25 17:16:54 2025 +0100 thermal/drivers/mediatek/lvts: Add lvts_temp_to_raw variant MT8196/MT6991 require a different version of lvts_temp_to_raw(), specifically the multiplicative inverse of the existing implementation. Introduce a variant of the function with inverted calculation logic to match this requirement. This ensures accurate raw value generation for temperature thresholds, avoiding spurious thermal interrupts or unintended hardware resets on MT8196/MT6991. Reviewed-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Fei Shao Tested-by: AngeloGioacchino Del Regno Tested-by: Frank Wunderlich Signed-off-by: Laura Nao Link: https://patch.msgid.link/20251125-mt8196-lvts-v4-v5-4-6db7eb903fb7@collabora.com Signed-off-by: Daniel Lezcano commit a4c40559499fdfb37bcb2aa3804c3ea3cc6c2e40 Author: Laura Nao Date: Tue Nov 25 17:16:53 2025 +0100 thermal/drivers/mediatek/lvts: Add platform ops to support alternative conversion logic Introduce lvts_platform_ops struct to support SoC-specific versions of lvts_raw_to_temp() and lvts_temp_to_raw() conversion functions. This is in preparation for supporting SoCs like MT8196/MT6991, which require a different lvts_temp_to_raw() implementation. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Laura Nao Link: https://patch.msgid.link/20251125-mt8196-lvts-v4-v5-3-6db7eb903fb7@collabora.com Signed-off-by: Daniel Lezcano commit 6931d597c5ef8eae583df0cb2e4af8fbbf2b9e6e Author: Laura Nao Date: Tue Nov 25 17:16:52 2025 +0100 thermal/drivers/mediatek/lvts: Make number of calibration offsets configurable MT8196/MT6991 use 2-byte eFuse calibration data, whereas other SoCs supported by the driver rely on 3 bytes. Make the number of calibration bytes per sensor configurable, enabling support for SoCs with varying calibration formats. Signed-off-by: Laura Nao Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251125-mt8196-lvts-v4-v5-2-6db7eb903fb7@collabora.com Signed-off-by: Daniel Lezcano commit 03656dc61deb014fb536b728da8750bff45eedb2 Author: Laura Nao Date: Tue Nov 25 17:16:51 2025 +0100 dt-bindings: thermal: mediatek: Add LVTS thermal controller support for MT8196 Add LVTS thermal controller binding for MediaTek MT8196. Acked-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Tested-by: Frank Wunderlich Signed-off-by: Laura Nao Link: https://patch.msgid.link/20251125-mt8196-lvts-v4-v5-1-6db7eb903fb7@collabora.com Signed-off-by: Daniel Lezcano commit 965ef09a26f3efe7dcdc4691860c1e85da353b77 Author: Romain Gantois Date: Fri Dec 26 08:54:32 2025 +0100 tools: lib: thermal: Correct CFLAGS and LDFLAGS in pkg-config template There are two issues with the current pkg-config template. Firstly, the -lthermal linker flag is missing. Secondly, the libnl3 include directory compiler flag references "include" instead of "includedir", which leads to an unexpanded variable when pkg-config is called. Add the missing -lthermal flag and correct the libnl3 include directory. Signed-off-by: Romain Gantois Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251226-libthermal-pkgconfig-v1-1-3406de5ca8ea@bootlin.com commit 2e6690d4f7fc41c4fae7d0a4c0bf11f1973e5650 Author: Gyutae Bae Date: Tue Jan 20 18:07:16 2026 +0900 selftests/bpf: Add perfbuf multi-producer benchmark Add a multi-producer benchmark for perfbuf to complement the existing ringbuf multi-producer test. Unlike ringbuf which uses a shared buffer and experiences contention, perfbuf uses per-CPU buffers so the test measures scaling behavior rather than contention. This allows developers to compare perfbuf vs ringbuf performance under multi-producer workloads when choosing between the two for their systems. Signed-off-by: Gyutae Bae Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260120090716.82927-1-gyutae.opensource@navercorp.com commit f81c07a6e98e3171d0c4c5ab79f5aeff71b42c44 Author: Qiliang Yuan Date: Tue Jan 20 10:32:34 2026 +0800 bpf/verifier: Optimize ID mapping reset in states_equal Currently, reset_idmap_scratch() performs a 4.7KB memset() in every states_equal() call. Optimize this by using a counter to track used ID mappings, replacing the O(N) memset() with an O(1) reset and bounding the search loop in check_ids(). Signed-off-by: Qiliang Yuan Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20260120023234.77673-1-realwujing@gmail.com commit 713edc71449f122491f8860be49b40f27d5f46b5 Author: Daniel Borkmann Date: Tue Jan 20 13:55:01 2026 +0100 bpf: Remove leftover accounting in htab_map_mem_usage after rqspinlock After commit 4fa8d68aa53e ("bpf: Convert hashtab.c to rqspinlock") we no longer use HASHTAB_MAP_LOCK_{COUNT,MASK} as the per-CPU map_locked[HASHTAB_MAP_LOCK_COUNT] array got removed from struct bpf_htab. Right now it is still accounted for in htab_map_mem_usage. Signed-off-by: Daniel Borkmann Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/09703eb6bb249f12b1d5253b5a50a0c4fa239d27.1768913513.git.daniel@iogearbox.net commit ef7d4e42d16f74b123c86c9195ba5136046cee57 Author: Puranjay Mohan Date: Fri Jan 16 06:14:35 2026 -0800 bpf: verifier: Make sync_linked_regs() scratch registers sync_linked_regs() is called after a conditional jump to propagate new bounds of a register to all its liked registers. But the verifier log only prints the state of the register that is part of the conditional jump. Make sync_linked_regs() scratch the registers whose bounds have been updated by propagation from a known register. Before: 0: (85) call bpf_get_prandom_u32#7 ; R0=scalar() 1: (57) r0 &= 255 ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) 2: (bf) r1 = r0 ; R0=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R1=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) 3: (07) r1 += 4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=4,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff)) 4: (a5) if r1 < 0xa goto pc+2 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=10,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff)) 5: (35) if r0 >= 0x6 goto pc+1 After: 0: (85) call bpf_get_prandom_u32#7 ; R0=scalar() 1: (57) r0 &= 255 ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) 2: (bf) r1 = r0 ; R0=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R1=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) 3: (07) r1 += 4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=4,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff)) 4: (a5) if r1 < 0xa goto pc+2 ; R0=scalar(id=1+0,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255) R1=scalar(id=1+4,smin=umin=smin32=umin32=10,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff)) 5: (35) if r0 >= 0x6 goto pc+1 The conditional jump in 4 updates the bound of R1 and the new bounds are propogated to R0 as it is linked with the same id, before this change, verifier only printed the state for R1 but after it prints for both R0 and R1. Suggested-by: Andrii Nakryiko Signed-off-by: Puranjay Mohan Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20260116141436.3715322-1-puranjay@kernel.org commit 0dfffa5479d6260d04d021f69203b1926f73d889 Author: Brian Masney Date: Tue Jan 20 12:07:23 2026 -0500 openrisc: define arch-specific version of nop() When compiling a driver written for MIPS on OpenRISC that uses the nop() function, it fails due to the following error: drivers/watchdog/pic32-wdt.c: Assembler messages: drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop' The driver currently uses the generic version of nop() from include/asm-generic/barrier.h: #ifndef nop #define nop() asm volatile ("nop") #endif Let's fix this on OpenRISC by defining an architecture-specific version of nop(). This was tested by performing an allmodconfig openrisc cross compile on an aarch64 host. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/ Signed-off-by: Brian Masney Signed-off-by: Stafford Horne commit 28cb835f7645892f4559b92fcfeb25a81646f4cf Author: Ian Rogers Date: Fri Jan 16 21:28:49 2026 -0800 perf machine: Add inline information to frame pointer and LBR callchains Use append_inlines() in frame pointer and LBR cases. Update the addr2line test to also test frame pointers. LBR is also updated but inaccuracy in the branched to IP means the inline information is missing in the leaf. Leave LBR callchains untested for now. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 6b2658b3f36a7e524d7a8957e729e307484f2a8c Author: Ian Rogers Date: Fri Jan 16 21:28:48 2026 -0800 perf unwind-libdw: Don't discard loaded ELF/DWARF after every unwind The unwind-libdw dwfl has ELF binaries associated with mmap addresses. Experimenting with using the per dso dwfl it is required to alter the address to be 0 based variant. Unfortunately libdwfl doesn't allow a single unwind and then an update to the return address to be 0 based as there are assertions that registers aren't updated once an unwind has started, etc. As removing the dwfl didn't prove possible, an alternative is to just not discard the dwfl when the unwind ends. The dwfl is valid for a process unless a dso is loaded at the same address as a previous one. So keep the dwfl with the maps, invalidate it if a map is removed (in case a new map replaces it) and recycle the dwfl in the unwinding code. A wrinkly in the implementation of this is that the attached thread argument is remembered by the dwfl and so it needs to be a pointer to memory that also persists with the dwfl (struct dwfl_ui_thread_info in the code). Recording 10 seconds of system wide data with --call-graph=dwarf and then processing with perf report shows a total runtime improvement from 41.583s to 2.279s (an 18x speedup). Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 2e9191573a69ff962b018d85a2c58269a1637b27 Author: Ian Rogers Date: Fri Jan 16 21:28:47 2026 -0800 perf build: Remove NO_LIBDW_DWARF_UNWIND option Libdw unwinding support is present for every architecture that has a perf_regs.h - perf registers are needed for the initial frame to unwind. Elfutils also supports SPARC, ARC and m68k but there is no support in the Linux kernel for perf registers on these architectures. As the perf supported DWARF unwinding architectures are a subset of the elfutils ones, remove NO_LIBDW_DWARF_UNWIND as there isn't a case of elfutils lacking the support need for perf. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 406b51a9a5e8d3c3d862a6eebe3def7e11229693 Author: Ian Rogers Date: Fri Jan 16 21:28:46 2026 -0800 perf dwarf-regs: Add MIPS perf to DWARF register number mapping functions Despite an unused function declaration, there was no unwind-libdw for MIPS but there is a perf_regs.h and a libdw implementation. Fill in the pieces so hopefully MIPS unwinding with libdw works. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 1e452dd850f3d509cdc9da05f2c70161f7f73d37 Author: Ian Rogers Date: Fri Jan 16 21:28:45 2026 -0800 perf dwarf-regs: Add S390 perf to DWARF register number mapping functions These functions allow the generic initial register state code in unwind-libdw to be used. Now the non-generic code in unwind-libdw has no uses remove it. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 36b372dfff51a0f069d4f8f11991b7241743fd52 Author: Ian Rogers Date: Fri Jan 16 21:28:44 2026 -0800 perf dwarf-regs: Add RISC-V perf to DWARF register number mapping functions These functions allow the generic initial register state code in unwind-libdw to be used. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit f005302294601a8fb770c71179a3a13951d125ad Author: Ian Rogers Date: Fri Jan 16 21:28:43 2026 -0800 perf dwarf-regs: Add powerpc perf to DWARF register number mapping functions These functions allow the generic initial register state code in unwind-libdw to be used. Note, the link register was being coped to DWARF register 65 that the SysV ABI spec claims is FPSCR. It is corrected here to 108, but this is unlikely to matter as FPSCR has little to no impact on unwinding. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 1f10d82e6adffd45cf1a59618d1ecc33625a8a37 Author: Ian Rogers Date: Fri Jan 16 21:28:42 2026 -0800 perf dwarf-regs: Add loongarch perf to DWARF register number mapping functions These functions allow the generic initial register state code in unwind-libdw to be used. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 8cac4013b0c23739ccbce19f74c1b572eba050d2 Author: Ian Rogers Date: Fri Jan 16 21:28:41 2026 -0800 perf dwarf-regs: Add csky perf to dwarf register number mapping functions These functions allow the generic initial register state code in unwind-libdw to be used. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 8b863e70e2be6c256201d2297735a2a4bf1acf75 Author: Ian Rogers Date: Fri Jan 16 21:28:40 2026 -0800 perf dwarf-regs: Add ARM perf to dwarf register number mapping functions These functions allow the generic initial register state code in unwind-libdw to be used. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit cf7c7f12042b9e9dfb7e63c9c3180b6af1860b2b Author: Ian Rogers Date: Fri Jan 16 21:28:39 2026 -0800 perf dwarf-regs: Add basic get_dwarf_regnum() for most architectures Add a basic get_dwarf_regnum() implementation for most architectures by using the get_dwarf_regstr() tables and returning the index of the name within the table. Some minor name and constification clean up for csky. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit d3ab52c31efab9e8a29b8fc1ae4c09ab41e0cf84 Author: Ian Rogers Date: Fri Jan 16 21:28:38 2026 -0800 perf dwarf-regs: Add get_dwarf_regnum_for_perf_regnum() and use for x86 unwinding Add a utility to map a perf register number to a DWARF register number for a particular ELF machine type. Create a generic unwind-libdw initial register initialization routine that uses this function and thereby avoids arch specific initialization. The unwind-libdw code does: 1) compute the maximum DWARF register from the set of sampled user registers, 2) allocates a set of DWARF registers, 3) copies the sample registers into the appropriate DWARF registers. This generic solution is initially implemented for use with x86 as only get_dwarf_regnum_for_perf_regnum() support for x86 is currently present. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit c31040085914f1188720073baa43d1483693c0a3 Author: Ian Rogers Date: Fri Jan 16 21:28:37 2026 -0800 perf dwarf-regs: Clean up x86 dwarf_regnum code The i386 and x86-64 register numbers differ on x86, but previously x86 was a single arch string and so this couldn't be handled. The transition to using ELF EM_* values means we can translate x86 registers correctly for either the x86-64 dwarf register mappings (from the System V ABI) or i386 register mappings. Correct the mappings. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 3a00f41646bbcb45aff17bb4ba27c52c6bab4f68 Author: Ian Rogers Date: Fri Jan 16 21:28:36 2026 -0800 perf dwarf-regs: Remove get_arch_regnum() Except in dwarf-regs the function is never called. The weak function has no strong arch implementations. Remove so that the fall-through case applies. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 1672f3707a6ef4b386c30bb76df2f62e58a39430 Author: Ian Rogers Date: Fri Jan 16 21:28:35 2026 -0800 perf dwarf-regs: Add util/dwarf-regs-arch for consistency with perf-regs perf_regs.h has cross architecture functions for operating with the differing perf register constants. dwarf-regs.h is similar but for cross architecture dwarf notions of registers. For consistency move the arch parts of dwarf-regs out of util and into its own directory. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit a457ef08a72cb408318ddb851865c5981b842c63 Author: Ian Rogers Date: Fri Jan 16 21:28:34 2026 -0800 perf perf_regs: Switch from arch string to int e_machine The arch string requires multiple strcmp to identify things like the IP and SP. Switch to passing in an e_machine that in the bulk of cases is computed using a current thread load. The e_machine also allows identification of 32-bit vs 64-bit processes. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon [ Include dwarf-regs.h to get conditional defines for EM_CSKY and EM_LOONGARCH, not available in old distros ] Signed-off-by: Arnaldo Carvalho de Melo commit 5383e76483dc2529c2c5ca7e98cd679eb77d8327 Author: Yedaya Katsman Date: Sun Jan 18 22:29:41 2026 +0200 Input: edt-ft5x06 - add support for FocalTech FT3518 The driver also works with FT3518, which supports up to 10 touch points. Add compatible data for it. Co-developed-by: Kamil Gołda Signed-off-by: Kamil Gołda Reviewed-by: Dmitry Baryshkov Signed-off-by: Yedaya Katsman Link: https://patch.msgid.link/20260118-touchscreen-patches-v3-2-1c6a729c5eb4@gmail.com Signed-off-by: Dmitry Torokhov commit 9b352327add1ab93a607992456835659787a0233 Author: Yedaya Katsman Date: Sun Jan 18 22:29:40 2026 +0200 dt-bindings: input: touchscreen: edt-ft5x06: Add FocalTech FT3518 Document FocalTech FT3518 support by adding the compatible. Co-developed-by: Kamil Gołda Signed-off-by: Kamil Gołda Acked-by: Krzysztof Kozlowski Signed-off-by: Yedaya Katsman Link: https://patch.msgid.link/20260118-touchscreen-patches-v3-1-1c6a729c5eb4@gmail.com Signed-off-by: Dmitry Torokhov commit 05c7f348f64281e62da38da20a8821da2df9b9d6 Author: Marek Vasut Date: Sat Jan 17 01:12:03 2026 +0100 Input: ili210x - convert to dev_err_probe() Simplify error return handling, use dev_err_probe() where possible. No functional change. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260117001215.59272-2-marek.vasut+renesas@mailbox.org Signed-off-by: Dmitry Torokhov commit db0c35ca36526f3072affcb573631ccf8c85f827 Author: Ryota Sakamoto Date: Sat Jan 17 02:46:34 2026 +0900 kunit: add bash completion Currently, kunit.py has many subcommands and options, making it difficult to remember them without checking the help message. Add --list-cmds and --list-opts to kunit.py to get available commands and options, use those outputs in kunit-completion.sh to show completion. This implementation is similar to perf and tools/perf/perf-completion.sh. Example output: $ source tools/testing/kunit/kunit-completion.sh $ ./tools/testing/kunit/kunit.py [TAB][TAB] build config exec parse run $ ./tools/testing/kunit/kunit.py run --k[TAB][TAB] --kconfig_add --kernel_args --kunitconfig Link: https://lore.kernel.org/r/20260117-kunit-completion-v2-1-cabd127d0801@gmail.com Reviewed-by: David Gow Signed-off-by: Ryota Sakamoto Signed-off-by: Shuah Khan commit 9ef552fcf0e0fbc0d8a7d6a5903a08a90eb97f34 Merge: 58b2e9a1d9a7cc cafadbf430f4b2 Author: Mark Brown Date: Tue Jan 20 18:17:02 2026 +0000 ASoC: renesas: rz-ssi: Cleanups Merge series from Claudiu : This series adds cleanups for the Renesas RZ SSI driver. commit 58b2e9a1d9a7ccaafb75a2569b09108f56291f81 Merge: 965f58e70e76aa 4fbd3b2ec04dc6 Author: Mark Brown Date: Tue Jan 20 18:16:58 2026 +0000 ASoC: soc-acpi-intel-arl/ptl-match: use aggregated Merge series from Bard Liao : When rt722 work with other amps, the rt722 amp endpoint is aggregated. Set .aggregated = 1 to represent the fact and avoid unexpected issue. commit 965f58e70e76aa8a595669ec2d4a385e518c7801 Merge: 00ca2dd431fa2a 3c5ddd56aa9304 Author: Mark Brown Date: Tue Jan 20 18:16:54 2026 +0000 ASoC: codec: es8323: Enable DAPM for ADC and ChipPower Merge series from Binbin Zhou : This patchset replaces the original magic numbers with register bit field macro definitions in an attempt to improve code readability. In addition, DAPM for capture ADC and chip power has been enabled. commit 6dda4f0a31b0b8c0824cb63ebda600e6da886e1d Author: Alex Shi Date: Tue Jan 20 10:35:09 2026 -0500 fs/dlm/dir: remove unuse variable count_match The variable was never used after introduced. Better to comment it if we want to keep the info. fs/dlm/dir.c:65:26: error: variable 'count_match' set but not used [-Werror,-Wunused-but-set-variable] 65 | unsigned int count = 0, count_match = 0, count_bad = 0, count_add = 0; | ^ 1 error generated. Signed-off-by: Alex Shi Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 596ce53d647ca7c8d6408a4148dc44ead39e8474 Author: Christophe JAILLET Date: Tue Jan 20 10:35:08 2026 -0500 dlm: Constify struct configfs_item_operations and configfs_group_operations 'struct configfs_item_operations' and 'configfs_group_operations' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 29436 12952 384 42772 a714 fs/dlm/config.o After: ===== text data bss dec hex filename 30076 12312 384 42772 a714 fs/dlm/config.o Signed-off-by: Christophe JAILLET Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 6155b409761f50c7f3353739610bb37e02422116 Author: Shaurya Rane Date: Tue Jan 20 10:35:07 2026 -0500 fs/dlm: use list_add_tail() instead of open-coding list insertion Replace the manual list pointer manipulation in add_ordered_member() with the standard list_add_tail() helper. The original code explicitly updated ->prev and ->next pointers to insert @newlist before @tmp, which is exactly what list_add_tail(newlist, tmp) provides. Using the list macro improves readability, removes a source of potential pointer bugs, and satisfies the existing FIXME requesting conversion to the list helpers. No functional change in the ordering logic for DLM members. Signed-off-by: Shaurya Rane Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 080e5563f878c64e697b89e7439d730d0daad882 Author: Ezrak1e Date: Tue Jan 20 10:35:06 2026 -0500 dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-bounds write in dlm_search_rsb_tree(). Add length validation to prevent potential buffer overflow. Signed-off-by: Ezrak1e Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit dcce06fb729e672fb2cc1e921dad2e91284e13e0 Author: Uwe Kleine-König Date: Thu Jan 15 17:50:54 2026 +0100 pwm: Update MAINTAINER entry There is little sense in having gpio-mvebu and pwm-backlight explicitly listed in the PWM entry. Drop these and add the keywords that actually identify a driver as PWM related. Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115165055.1739004-2-ukleinek@kernel.org Signed-off-by: Uwe Kleine-König commit e73eb6a73c209e63f5f239337bda4b938d75a1f7 Merge: 8f7745fcb443f9 c3608162a95a25 Author: Mark Brown Date: Tue Jan 20 17:58:35 2026 +0000 spi: xilinx: make IRQs optional Merge series from Abdurrahman Hussain : Additionally, make interrupts optional to allow the driver to fall back to its existing polling mode on systems where interrupts are either missing or broken. commit 8f7745fcb443f9223ccfb17e02cbe06e80b72d78 Merge: 3495a5df94a9ad 37fbc1ab0f225d Author: Mark Brown Date: Tue Jan 20 17:58:31 2026 +0000 spi: Make SPI core to take care of fwnode Merge series from Andy Shevchenko : It seems all of the SPI drivers want to propagate fwnode (or of_node) of the physical device to the SPI device. Make sure we don't duplicate it over and over in each new driver (+2 in this cycle) by making core to take care of that. Note, similar is done already by IIO and I²C subsystems. There is one noticeable and quite specific case that is taken care in the first patch and now we have a confirmation from Cirrus that everything is okay. The rest is just a mechanical conversion after checking that the parent device is assigned to the same that provides the respective fwnode. Changelog v2: - collected tags - fixed W=1 warning (unused variable) in spi-dln2.c (LKP) v1: 20260108203004.3538449-1-andriy.shevchenko@linux.intel.com Andy Shevchenko (4): spi: Propagate default fwnode to the SPI controller device spi: Drop duplicate of_node assignment spi: Drop duplicate fwnode assignment spi: Drop duplicate device_set_node() call drivers/spi/atmel-quadspi.c | 1 - drivers/spi/spi-airoha-snfi.c | 1 - drivers/spi/spi-altera-platform.c | 2 -- drivers/spi/spi-amlogic-spifc-a1.c | 1 - drivers/spi/spi-amlogic-spisg.c | 1 - drivers/spi/spi-apple.c | 1 - drivers/spi/spi-ar934x.c | 1 - drivers/spi/spi-armada-3700.c | 4 +--- drivers/spi/spi-aspeed-smc.c | 1 - drivers/spi/spi-atcspi200.c | 1 - drivers/spi/spi-ath79.c | 1 - drivers/spi/spi-atmel.c | 1 - drivers/spi/spi-axi-spi-engine.c | 1 - drivers/spi/spi-bcm-qspi.c | 1 - drivers/spi/spi-bcm2835.c | 1 - drivers/spi/spi-bcm2835aux.c | 1 - drivers/spi/spi-bcm63xx-hsspi.c | 1 - drivers/spi/spi-bcm63xx.c | 1 - drivers/spi/spi-bcmbca-hsspi.c | 1 - drivers/spi/spi-cadence-quadspi.c | 1 - drivers/spi/spi-cadence-xspi.c | 1 - drivers/spi/spi-cadence.c | 1 - drivers/spi/spi-cavium-octeon.c | 1 - drivers/spi/spi-cavium-thunderx.c | 1 - drivers/spi/spi-clps711x.c | 1 - drivers/spi/spi-cs42l43.c | 8 ++++++++ drivers/spi/spi-davinci.c | 1 - drivers/spi/spi-dln2.c | 3 --- drivers/spi/spi-dw-core.c | 2 -- drivers/spi/spi-ep93xx.c | 1 - drivers/spi/spi-falcon.c | 1 - drivers/spi/spi-fsl-dspi.c | 1 - drivers/spi/spi-fsl-espi.c | 1 - drivers/spi/spi-fsl-lib.c | 1 - drivers/spi/spi-fsl-lpspi.c | 1 - drivers/spi/spi-geni-qcom.c | 1 - drivers/spi/spi-gpio.c | 1 - drivers/spi/spi-gxp.c | 1 - drivers/spi/spi-hisi-kunpeng.c | 1 - drivers/spi/spi-img-spfi.c | 1 - drivers/spi/spi-imx.c | 1 - drivers/spi/spi-ingenic.c | 1 - drivers/spi/spi-lantiq-ssc.c | 1 - drivers/spi/spi-ljca.c | 1 - drivers/spi/spi-loongson-core.c | 1 - drivers/spi/spi-lp8841-rtc.c | 1 - drivers/spi/spi-meson-spicc.c | 1 - drivers/spi/spi-meson-spifc.c | 1 - drivers/spi/spi-microchip-core-spi.c | 1 - drivers/spi/spi-mpc512x-psc.c | 2 -- drivers/spi/spi-mpc52xx-psc.c | 2 -- drivers/spi/spi-mpc52xx.c | 1 - drivers/spi/spi-mpfs.c | 1 - drivers/spi/spi-mt65xx.c | 1 - drivers/spi/spi-mt7621.c | 1 - drivers/spi/spi-mtk-nor.c | 1 - drivers/spi/spi-mtk-snfi.c | 1 - drivers/spi/spi-mux.c | 1 - drivers/spi/spi-mxic.c | 1 - drivers/spi/spi-npcm-fiu.c | 1 - drivers/spi/spi-npcm-pspi.c | 1 - drivers/spi/spi-nxp-fspi.c | 2 -- drivers/spi/spi-nxp-xspi.c | 1 - drivers/spi/spi-oc-tiny.c | 1 - drivers/spi/spi-orion.c | 1 - drivers/spi/spi-pl022.c | 1 - drivers/spi/spi-pxa2xx.c | 2 -- drivers/spi/spi-qcom-qspi.c | 1 - drivers/spi/spi-qpic-snand.c | 1 - drivers/spi/spi-qup.c | 1 - drivers/spi/spi-rb4xx.c | 1 - drivers/spi/spi-realtek-rtl-snand.c | 1 - drivers/spi/spi-realtek-rtl.c | 1 - drivers/spi/spi-rockchip-sfc.c | 1 - drivers/spi/spi-rockchip.c | 1 - drivers/spi/spi-rspi.c | 1 - drivers/spi/spi-rzv2h-rspi.c | 2 -- drivers/spi/spi-rzv2m-csi.c | 2 -- drivers/spi/spi-s3c64xx.c | 1 - drivers/spi/spi-sc18is602.c | 2 -- drivers/spi/spi-sg2044-nor.c | 1 - drivers/spi/spi-sh-hspi.c | 1 - drivers/spi/spi-sh-msiof.c | 1 - drivers/spi/spi-sifive.c | 1 - drivers/spi/spi-slave-mt27xx.c | 1 - drivers/spi/spi-sn-f-ospi.c | 1 - drivers/spi/spi-sprd-adi.c | 1 - drivers/spi/spi-sprd.c | 1 - drivers/spi/spi-stm32-ospi.c | 1 - drivers/spi/spi-stm32-qspi.c | 1 - drivers/spi/spi-stm32.c | 1 - drivers/spi/spi-sun4i.c | 1 - drivers/spi/spi-sun6i.c | 1 - drivers/spi/spi-sunplus-sp7021.c | 1 - drivers/spi/spi-synquacer.c | 3 --- drivers/spi/spi-tegra114.c | 1 - drivers/spi/spi-tegra20-sflash.c | 1 - drivers/spi/spi-tegra20-slink.c | 1 - drivers/spi/spi-tegra210-quad.c | 1 - drivers/spi/spi-ti-qspi.c | 1 - drivers/spi/spi-uniphier.c | 1 - drivers/spi/spi-virtio.c | 2 -- drivers/spi/spi-wpcm-fiu.c | 1 - drivers/spi/spi-xcomm.c | 1 - drivers/spi/spi-xilinx.c | 1 - drivers/spi/spi-xlp.c | 1 - drivers/spi/spi-xtensa-xtfpga.c | 1 - drivers/spi/spi.c | 3 +++ 108 files changed, 12 insertions(+), 122 deletions(-) -- 2.50.1 commit 8d8db7dbf2181052dc2e8813737ef31d136e4dbd Author: Manivannan Sadhasivam Date: Thu Jan 15 12:59:07 2026 +0530 PCI: qcom: Rename PERST# assert/deassert helpers for uniformity Rename the PERST# assert/deassert helpers from qcom_ep_reset_{assert/deassert}() to qcom_pcie_perst_{assert/deassert}() to maintain uniformity. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-15-9d26da3ce903@oss.qualcomm.com commit 0332d0408d59a35edba128036246c3f60a6953dc Author: Alice Ryhl Date: Mon Jan 5 12:42:27 2026 +0000 rust: pwm: Add __rust_helper to helpers This is needed to inline these helpers into Rust code. Signed-off-by: Alice Ryhl Acked-by: Michal Wilczynski Link: https://patch.msgid.link/20260105-define-rust-helper-v2-14-51da5f454a67@google.com Signed-off-by: Uwe Kleine-König commit fc1e4eae19eef739fea732902354ec93ab8234c6 Author: Kari Argillander Date: Fri Jan 2 09:51:42 2026 +0200 rust: pwm: Simplify to_result call sites and unsafe blocks Remove unnecessary temporary variables around to_result() calls and move trailing semicolons outside unsafe blocks to improve readability and produce cleaner rustfmt output. No functional change intended. Signed-off-by: Kari Argillander Acked-by: Michal Wilczynski Link: https://patch.msgid.link/20260102-pwm-rust-v2-2-2702ce57d571@gmail.com Signed-off-by: Uwe Kleine-König commit a2633dc243c35754a0c2270131d8a199c987c9bf Author: Kari Argillander Date: Fri Jan 2 09:51:41 2026 +0200 rust: pwm: Fix potential memory leak on init error When initializing a PWM chip using pwmchip_alloc(), the allocated device owns an initial reference that must be released on all error paths. If __pinned_init() were to fail, the allocated pwm_chip would currently leak because the error path returns without calling pwmchip_put(). Fixes: 7b3dce814a15 ("rust: pwm: Add Kconfig and basic data structures") Signed-off-by: Kari Argillander Acked-by: Michal Wilczynski Link: https://patch.msgid.link/20260102-pwm-rust-v2-1-2702ce57d571@gmail.com Signed-off-by: Uwe Kleine-König commit b0dc6c6e97101a5d17d18be62c39817f38590da3 Author: Vladimir Zapolskiy Date: Mon Dec 29 00:49:06 2025 +0200 dt-bindings: pwm: nxp,lpc32xx-pwm: Specify clocks property as mandatory Both described in the binding PWM controllers depend on supply clocks, thus it's necessary to specify 'clocks' property in the correspondent device tree nodes. Signed-off-by: Vladimir Zapolskiy Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251228224907.1729627-2-vz@mleia.com Signed-off-by: Uwe Kleine-König commit 269febe7747904d717d916ed1ee586aebce95d54 Author: Tamir Duberstein Date: Mon Dec 22 13:24:46 2025 +0100 pwm: th1520: Replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Signed-off-by: Tamir Duberstein Reviewed-by: Michal Wilczynski Reviewed-by: Daniel Almeida Link: https://patch.msgid.link/20251222-cstr-pwm-v1-1-e8916d976f8d@gmail.com Signed-off-by: Uwe Kleine-König commit 02a140d3318abbe2a4a12f0fad88362eb118d25c Author: Raag Jadav Date: Mon Jan 5 14:47:37 2026 +0530 pwm: dwc: Use size macro Use SZ_4K from linux/sizes.h instead of hardcoding constant. Signed-off-by: Raag Jadav Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20260105091737.17280-1-raag.jadav@intel.com Signed-off-by: Uwe Kleine-König commit aa12c7e70319c9746e55e5b00a215119ba838dad Author: Uwe Kleine-König Date: Fri Nov 21 11:49:48 2025 +0100 pwm: Emit native configuration in /sys/kernel/debug/pwm Currently there are two abstractions for PWM drivers. Use the waveform representation for the drivers that support it as this is more expressive and so tells more about the actual hardware state. Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/20251121104947.2652013-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 85a5ffbd56b236e96a7a22a631f9febf36d7ead5 Author: Markus Probst Date: Tue Dec 2 18:17:52 2025 +0000 rust: pwm: Add UnregisteredChip wrapper around Chip The `pwm::Registration::register` function provides no guarantee that the function isn't called twice with the same pwm chip, which is considered unsafe. Add `pwm::UnregisteredChip` as wrapper around `pwm::Chip`. Implement `pwm::UnregisteredChip::register` for the registration. This function takes ownership of `pwm::UnregisteredChip` and therefore guarantees that the registration can't be called twice on the same pwm chip. Signed-off-by: Markus Probst Tested-by: Michal Wilczynski Acked-by: Michal Wilczynski Link: https://patch.msgid.link/20251202-pwm_safe_register-v2-1-7a2e0d1e287f@posteo.de [ukleinek: fixes a typo that Michal pointed out during review] Signed-off-by: Uwe Kleine-König commit 5025569cb63060255834c95ab3779905aecf67b0 Author: Shankari Anand Date: Sun Nov 23 14:54:34 2025 +0530 rust: pwm: Update ARef and AlwaysRefCounted imports to use sync::aref Update call sites in `pwm.rs` to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Acked-by: Michal Wilczynski Link: https://patch.msgid.link/20251123092438.182251-7-shankari.ak0208@gmail.com Signed-off-by: Uwe Kleine-König commit 1416bd508c78bdfdb9ae0b4511369e5581f348ea Author: Alexander Aring Date: Tue Jan 20 10:35:05 2026 -0500 dlm: fix recovery pending middle conversion During a workload involving conversions between lock modes PR and CW, lock recovery can create a "conversion deadlock" state between locks that have been recovered. When this occurs, kernel warning messages are logged, e.g. "dlm: WARN: pending deadlock 1e node 0 2 1bf21" "dlm: receive_rcom_lock_args 2e middle convert gr 3 rq 2 remote 2 1e" After this occurs, the deadlocked conversions both appear on the convert queue of the resource being locked, and the conversion requests do not complete. Outside of recovery, conversions that would produce a deadlock are resolved immediately, and return -EDEADLK. The locks are not placed on the convert queue in the deadlocked state. To fix this problem, an lkb under conversion between PR/CW is rebuilt during recovery on a new master's granted queue, with the currently granted mode, rather than being rebuilt on the new master's convert queue, with the currently granted mode and the newly requested mode. The in-progress convert is then resent to the new master after recovery, so the conversion deadlock will be processed outside of the recovery context and handled as described above. Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit f7bc22ca0d55bdcb59e3a4a028fb811d23e53959 Author: Ming Lei Date: Fri Jan 16 15:46:38 2026 +0800 nvme/io_uring: optimize IOPOLL completions for local ring context When multiple io_uring rings poll on the same NVMe queue, one ring can find completions belonging to another ring. The current code always uses task_work to handle this, but this adds overhead for the common single-ring case. This patch passes the polling io_ring_ctx through io_comp_batch's new poll_ctx field. In io_do_iopoll(), the polling ring's context is stored in iob.poll_ctx before calling the iopoll callbacks. In nvme_uring_cmd_end_io(), we now compare iob->poll_ctx with the request's owning io_ring_ctx (via io_uring_cmd_ctx_handle()). If they match (local context), we complete inline with io_uring_cmd_done32(). If they differ (remote context) or iob is NULL (non-iopoll path), we use task_work as before. This optimization eliminates task_work scheduling overhead for the common case where a ring polls and finds its own completions. ~10% IOPS improvement is observed in the following benchmark: fio/t/io_uring -b512 -d128 -c32 -s32 -p1 -F1 -O0 -P1 -u1 -n1 /dev/ng0n1 Signed-off-by: Ming Lei Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit 5e2fde1a9433efc484a5feec36f748aa3ea58c85 Author: Ming Lei Date: Fri Jan 16 15:46:37 2026 +0800 block: pass io_comp_batch to rq_end_io_fn callback Add a third parameter 'const struct io_comp_batch *' to the rq_end_io_fn callback signature. This allows end_io handlers to access the completion batch context when requests are completed via blk_mq_end_request_batch(). The io_comp_batch is passed from blk_mq_end_request_batch(), while NULL is passed from __blk_mq_end_request() and blk_mq_put_rq_ref() which don't have batch context. This infrastructure change enables drivers to detect whether they're being called from a batched completion path (like iopoll) and access additional context stored in the io_comp_batch. Update all rq_end_io_fn implementations: - block/blk-mq.c: blk_end_sync_rq - block/blk-flush.c: flush_end_io, mq_flush_data_end_io - drivers/nvme/host/ioctl.c: nvme_uring_cmd_end_io - drivers/nvme/host/core.c: nvme_keep_alive_end_io - drivers/nvme/host/pci.c: abort_endio, nvme_del_queue_end, nvme_del_cq_end - drivers/nvme/target/passthru.c: nvmet_passthru_req_done - drivers/scsi/scsi_error.c: eh_lock_door_done - drivers/scsi/sg.c: sg_rq_end_io - drivers/scsi/st.c: st_scsi_execute_end - drivers/target/target_core_pscsi.c: pscsi_req_done - drivers/md/dm-rq.c: end_clone_request Signed-off-by: Ming Lei Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit a83f9c04be4e807d1c3961eec3fe3310c60ed9aa Author: Marc Zyngier Date: Wed Dec 10 08:22:41 2025 +0000 clocksource/drivers/mips-gic-timer: Move GIC timer to request_percpu_irq() Teach the MIPS GIC timer about request_percpu_irq(), which ultimately will allow for the removal of the antiquated setup_percpu_irq() API. Signed-off-by: Marc Zyngier Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251210082242.360936-6-maz@kernel.org commit 694921a93f3e3621e067afc545cedf6fe3b234a9 Author: Stephen Eta Zhou Date: Thu Dec 25 16:16:31 2025 +0800 clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock. On SP804, the delay timer shares the same clkevt instance with sched_clock. On some platforms, when sp804_clocksource_and_sched_clock_init is called with use_sched_clock not set to 1, sched_clkevt is not properly initialized. However, sp804_register_delay_timer is invoked unconditionally, and read_current_timer() subsequently calls sp804_read on an uninitialized sched_clkevt, leading to a kernel Oops when accessing sched_clkevt->value. Declare a dedicated clkevt instance exclusively for delay timer, instead of sharing the same clkevt with sched_clock. This ensures that read_current_timer continues to work correctly regardless of whether SP804 is selected as the sched_clock. Fixes: 640594a04f11 ("clocksource/drivers/timer-sp804: Fix read_current_timer() issue when clock source is not registered") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512250520.APOMkYRQ-lkp@intel.com/ Signed-off-by: Stephen Eta Zhou Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251225-fix_timersp804-v2-1-a366d7157f58@gmail.com commit f555fd9ebec9aefaa6281b457de27dd6cba1d168 Author: Soham Metha Date: Thu Dec 4 01:28:59 2025 +0530 clocksource/drivers/armada-370-xp: Fix dead link to timer binding The old text binding 'marvell,armada-370-xp-timer.txt' was replaced by a DT schema in commit '4334d83904fc' ("dt-bindings: timer: Convert marvell,armada-370-timer to DT schema"). Signed-off-by: Soham Metha Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251203195859.65835-1-sohammetha01@gmail.com commit 2246464821e2820572e6feefca2029f17629cc50 Author: Bartosz Golaszewski Date: Fri Jan 16 12:17:23 2026 +0100 clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF This driver accesses the of_aliases global variable declared in linux/of.h and defined in drivers/base/of.c. It requires OF support or will cause a link failure. Add the missing Kconfig dependency. Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/ Signed-off-by: Bartosz Golaszewski Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com commit b1278972b08e480990e2789bdc6a7c918bc349be Author: Niklas Söderlund Date: Tue Dec 2 23:13:41 2025 +0100 clocksource/drivers/sh_tmu: Always leave device running after probe The TMU device can be used as both a clocksource and a clockevent provider. The driver tries to be smart and power itself on and off, as well as enabling and disabling its clock when it's not in operation. This behavior is slightly altered if the TMU is used as an early platform device in which case the device is left powered on after probe, but the clock is still enabled and disabled at runtime. This has worked for a long time, but recent improvements in PREEMPT_RT and PROVE_LOCKING have highlighted an issue. As the TMU registers itself as a clockevent provider, clockevents_register_device(), it needs to use raw spinlocks internally as this is the context of which the clockevent framework interacts with the TMU driver. However in the context of holding a raw spinlock the TMU driver can't really manage its power state or clock with calls to pm_runtime_*() and clk_*() as these calls end up in other platform drivers using regular spinlocks to control power and clocks. This mix of spinlock contexts trips a lockdep warning. ============================= [ BUG: Invalid wait context ] 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted ----------------------------- swapper/0/0 is trying to lock: ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 other info that might help us debug this: context-{5:5} 1 lock held by swapper/0/0: ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 #0: ffff8000817ec298 ccree e6601000.crypto: ARM ccree device initialized (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 stack backtrace: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) Call trace: show_stack+0x14/0x1c (C) dump_stack_lvl+0x6c/0x90 dump_stack+0x14/0x1c __lock_acquire+0x904/0x1584 lock_acquire+0x220/0x34c _raw_spin_lock_irqsave+0x58/0x80 __pm_runtime_resume+0x38/0x88 sh_tmu_clock_event_set_oneshot+0x84/0xd4 clockevents_switch_state+0xfc/0x13c tick_broadcast_set_event+0x30/0xa4 __tick_broadcast_oneshot_control+0x1e0/0x3a8 tick_broadcast_oneshot_control+0x30/0x40 cpuidle_enter_state+0x40c/0x680 cpuidle_enter+0x30/0x40 do_idle+0x1f4/0x280 cpu_startup_entry+0x34/0x40 kernel_init+0x0/0x130 do_one_initcall+0x0/0x230 __primary_switched+0x88/0x90 For non-PREEMPT_RT builds this is not really an issue, but for PREEMPT_RT builds where normal spinlocks can sleep this might be an issue. Be cautious and always leave the power and clock running after probe. Signed-off-by: Niklas Söderlund Signed-off-by: Daniel Lezcano Tested-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se commit 42b12cb5fd4554679bac06bbdd05dc8b643bcc42 Author: Jens Axboe Date: Tue Jan 20 09:53:43 2026 -0700 io_uring/timeout: annotate data race in io_flush_timeouts() syzbot correctly reports this as a KCSAN race, as ctx->cached_cq_tail should be read under ->uring_lock. This isn't immediately feasible in io_flush_timeouts(), but as long as we read a stable value, that should be good enough. If two io-wq threads compete on this value, then they will both end up calling io_flush_timeouts() and at least one of them will see the correct value. Reported-by: syzbot+6c48db7d94402407301e@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit b7db7d9c4ffc04210fe631f73a81746d6e2ef24b Author: Junjie Cao Date: Sun Jan 11 21:01:17 2026 +0800 backlight: aw99706: Fix build errors caused by wrong gpio header The driver uses GPIO descriptor API (devm_gpiod_get, gpiod_set_value_cansleep, GPIOD_OUT_LOW) but includes the legacy header instead of . When CONFIG_GPIOLIB is not set, does not include , causing build errors: error: implicit declaration of function 'gpiod_set_value_cansleep' error: implicit declaration of function 'devm_gpiod_get' error: 'GPIOD_OUT_LOW' undeclared Fix by including the correct header . Fixes: 147b38a5ad06 ("backlight: aw99706: Add support for Awinic AW99706 backlight") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512171631.uKXlYwqu-lkp@intel.com/ Signed-off-by: Junjie Cao Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20260111130117.5041-1-junjie.cao@intel.com Signed-off-by: Lee Jones commit b7a2b011e9627ff3359306f1eaac718baeadbd83 Author: Ian Rogers Date: Fri Jan 16 21:28:33 2026 -0800 perf powerpc: Unify the skip-callchain-idx libdw with that for addr2line Rather than have 2 Dwfl unify the Dwfl in skip-callchain-idx with that is used by libdw__addr2line(). Rename that variable in 'struct dso' from 'a2l_libdw' to just 'libdw' as it is now used in more than addr2line. The Dwfl in skip-callchain-idx uses a map address when being read with dwfl_report_elf (rather than dwfl_report_offline that addr2line uses). skip-callchain-idx is wrong as the map address can vary between processes because of ASLR, ie it should need a different Dwfl per process. In the code after this patch the base address becomes 0 and the mapped PC is used with the dwfl functions. This should increase the accuracy of skip-callchain-idx, but the impact has only been build tested. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 8c59835851de28595e5899290f4b7aec656c7f24 Author: Ian Rogers Date: Fri Jan 16 21:28:32 2026 -0800 perf unwind-libdw: Correct argument to dwfl_attach_state() Argument is a pointer but EM_NONE (0) was being passed. Correct by passing NULL. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 6cc3e0f659b890cfb4a8753eb0e31c871cc7555b Author: Ian Rogers Date: Fri Jan 16 21:28:31 2026 -0800 perf libdw_addr2line: Fixes to srcline memory allocation Some irregular stack traces are causing double frees and memory leaks. Make the code robust by proactively freeing and being more careful with the memory management of the leaf_srcline. Fixes: 88c51002d06f9a68 ("perf addr2line: Add a libdw implementation") Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit e62fae9d9e85d38cdda1ee08a424e1b5b8246620 Author: Shimin Guo Date: Fri Jan 16 21:28:30 2026 -0800 perf unwind-libdw: Fix a cross-arch unwinding bug The set_initial_registers field of Dwfl_Thread_Callbacks needs to be set according to the arch of the stack samples being analyzed, not the arch that perf itself is built for. Currently perf fails to unwind stack samples collected from archs different from that of the host perf is running on. This patch moves the arch-specific implementations of set_initial_registers from tools/perf/arch to tools/perf/utli/unwind-libdw-arch, similar to the way the perf-regs-arch folder contains arch-specific functions related to registers, and chooses the implementation based on the arch of the data being processed. Reviewed-by: Ian Rogers Signed-off-by: Shimin Guo Acked-by: Namhyung Kim Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo commit 86f3801208ed1632ddd75a8e95ade5e433567be1 Author: Ian Rogers Date: Fri Jan 16 21:28:29 2026 -0800 perf record: Disable inline frames when marking build IDs Marking DSOs doesn't need inline frames traversing as the inline frames are all part of the same DSO. Disable to improve performance and also to avoid potential issues with dwarf information. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit e99d544c7f3691eb321c88fdbadf04b777c114c4 Author: Ian Rogers Date: Fri Jan 16 21:28:28 2026 -0800 perf dso: Extra validity checks that e_machine is valid Better ensure a read e_machine is valid by checking the file appears like an ELF file and the read e_machine value is less than EM_NUM. This better avoids spurious e_machine values when looking for an e_machine in say a thread. Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 92d65d9c31621befe0a5f7c0bd43bd217613c6b6 Author: Ian Rogers Date: Fri Jan 16 21:28:27 2026 -0800 perf symbol-elf: Fix leak of ELF files with GNU debugdata The processing of DSO_BINARY_TYPE__GNU_DEBUGDATA in symsrc__init happens with an open ELF file but the error path only closes the associate fd. Fix the goto so that the ELF file is also ended and memory released. Fixes: b10f74308e130527 ("perf symbol: Support .gnu_debugdata for symbols") Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Chun-Tse Shao Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Haibo Xu Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Mark Wielaard Cc: Namhyung Kim Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Stephen Brennan Cc: Thomas Falcon Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 740aeaf40f0b975dd508fa26aa493a11d2dae52a Merge: aced969e9bf370 91a0b0dce35076 Author: Greg Kroah-Hartman Date: Tue Jan 20 16:40:49 2026 +0100 Merge tag 'mhi-for-v6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host -------- - Add support for loading dual ELF image format firmware to Qcom Trust Management Engine Lit (TME-L) supported devices like QCC2072, which require separate ELF header for SBL and WLAN firmware segments in a single firmware. - Remove the MHI auto_queue feature support. This feature was added to offload the queuing of buffers from the client drivers to the MHI stack, but it caused a lot of race over the time. So remove this feature from the QRTR client driver and also from the MHI stack/controller drivers. - Move the .probe() and .remove() callbacks from driver level to bus level. MHI Endpoint ------------ - Move the .probe() and .remove() callbacks from driver level to bus level. * tag 'mhi-for-v6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: ep: Use bus callbacks for .probe() and .remove() bus: mhi: host: Use bus callbacks for .probe() and .remove() bus: mhi: host: Drop the auto_queue support net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels mhi: host: Add support for loading dual ELF image format commit b31583a1a9ab32923734ceb5fc95e536dfacccf7 Author: André Draszik Date: Tue Jan 13 14:03:13 2026 +0000 mfd: sec: Drop now unused struct sec_pmic_dev::irq_data This was used only to allow the s5m RTC driver to deal with the alarm IRQ. That driver now uses a different approach to acquire that IRQ, and ::irq_data doesn't need to be kept around anymore. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260113-s5m-alarm-v3-3-855a19db1277@linaro.org Signed-off-by: Lee Jones commit c70aee3dd85482c67720eb642d59ebbb9433faa5 Author: André Draszik Date: Tue Jan 13 14:03:12 2026 +0000 rtc: s5m: query platform device IRQ resource for alarm IRQ The core driver now exposes the alarm IRQ as a resource, so we can drop the lookup from here to simplify the code and make adding support for additional variants easier in this driver. Signed-off-by: André Draszik Acked-by: Alexandre Belloni Link: https://patch.msgid.link/20260113-s5m-alarm-v3-2-855a19db1277@linaro.org Signed-off-by: Lee Jones commit 153ae5c52b7063ac0926926d0cc9b53ee9d7fed2 Author: André Draszik Date: Tue Jan 13 14:03:11 2026 +0000 mfd: sec: Add rtc alarm IRQ as platform device resource By adding the RTC alarm IRQ to the MFD cell as a resource, the child driver (rtc) can simply query that IRQ, instead of having a lookup table itself. This change therefore allows the child driver to be simplified with regards to determining the alarm IRQ. Signed-off-by: André Draszik Link: https://patch.msgid.link/20260113-s5m-alarm-v3-1-855a19db1277@linaro.org Signed-off-by: Lee Jones commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 Author: Florian Westphal Date: Mon Jan 19 12:30:42 2026 +0100 netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validating the remaining option length. If the last byte of the option field is not EOL/NOP (0/1), the code attempts to index op[i+1]. In the case where i + 1 == optlen, this causes an out-of-bounds read, accessing memory past the optlen boundary (either reading beyond the stack buffer _opt or the following payload). Reported-by: sungzii Signed-off-by: Florian Westphal commit de8a70cefcb26cdceaafdc5ac144712681419c29 Author: Fernando Fernandez Mancera Date: Mon Jan 19 21:35:46 2026 +0100 netfilter: nf_conncount: fix tracking of connections from localhost Since commit be102eb6a0e7 ("netfilter: nf_conncount: rework API to use sk_buff directly"), we skip the adding and trigger a GC when the ct is confirmed. For connections originated from local to local it doesn't work because the connection is confirmed on POSTROUTING, therefore tracking on the INPUT hook is always skipped. In order to fix this, we check whether skb input ifindex is set to loopback ifindex. If it is then we fallback on a GC plus track operation skipping the optimization. This fallback is necessary to avoid duplicated tracking of a packet train e.g 10 UDP datagrams sent on a burst when initiating the connection. Tested with xt_connlimit/nft_connlimit and OVS limit and with a HTTP server and iperf3 on UDP mode. Fixes: be102eb6a0e7 ("netfilter: nf_conncount: rework API to use sk_buff directly") Reported-by: Michal Slabihoudek Closes: https://lore.kernel.org/netfilter/6989BD9F-8C24-4397-9AD7-4613B28BF0DB@gooddata.com/ Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit cda26c645946b08f070f20c166d4736767e4a805 Author: Florian Westphal Date: Fri Aug 19 16:16:07 2022 +0200 netfilter: nft_compat: add more restrictions on netlink attributes As far as I can see nothing bad can happen when NFTA_TARGET/MATCH_NAME are too large because this calls x_tables helpers which check for the length, but it seems better to already reject it during netlink parsing. Rest of the changes avoid silent u8/u16 truncations. For _TYPE, its expected to be only 1 or 0. In x_tables world, this variable is set by kernel, for IPT_SO_GET_REVISION_TARGET its 1, for all others its set to 0. As older versions of nf_tables permitted any value except 1 to mean 'match', keep this as-is but sanitize the value for consistency. Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit a4400a5b343d1bc4aa8f685608515413238e7ee2 Author: Scott Mitchell Date: Sat Jan 17 09:32:30 2026 -0800 netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation Currently, instance_create() uses GFP_ATOMIC because it's called while holding instances_lock spinlock. This makes allocation more likely to fail under memory pressure. Refactor nfqnl_recv_config() to drop RCU lock after instance_lookup() and peer_portid verification. A socket cannot simultaneously send a message and close, so the queue owned by the sending socket cannot be destroyed while processing its CONFIG message. This allows instance_create() to allocate with GFP_KERNEL_ACCOUNT before taking the spinlock. Suggested-by: Florian Westphal Signed-off-by: Scott Mitchell Signed-off-by: Florian Westphal commit d00453b6e3a3d2340b88c5292c3c5b5f9c4ece75 Author: Florian Westphal Date: Fri Nov 28 21:55:53 2025 +0100 netfilter: nf_conntrack: don't rely on implicit includes several netfilter compilation units rely on implicit includes coming from nf_conntrack_proto_gre.h. Clean this up and add the required dependencies where needed. nf_conntrack.h requires net_generic() helper. Place various gre/ppp/vlan includes to where they are needed. Signed-off-by: Florian Westphal commit 910d2712277583696474cd90dffcb56d3e0ff08e Author: Florian Westphal Date: Fri Nov 28 21:59:27 2025 +0100 netfilter: don't include xt and nftables.h in unrelated subsystems conntrack, xtables and nftables are distinct subsystems, don't use them in other subystems. Signed-off-by: Florian Westphal commit f7becf0dad8f558832a64183c7b1d0c65d327947 Author: Florian Westphal Date: Wed Nov 19 20:36:41 2025 +0100 netfilter: nf_conntrack: enable icmp clash support Not strictly required, but should not be harmful either: This isn't a stateful protocol, hence clash resolution should work fine. Signed-off-by: Florian Westphal commit 21d033e472735ecec677f1ae46d6740b5e47a4f3 Author: Fernando Fernandez Mancera Date: Wed Dec 17 15:46:41 2025 +0100 netfilter: nf_conncount: increase the connection clean up limit to 64 After the optimization to only perform one GC per jiffy, a new problem was introduced. If more than 8 new connections are tracked per jiffy the list won't be cleaned up fast enough possibly reaching the limit wrongly. In order to prevent this issue, only skip the GC if it was already triggered during the same jiffy and the increment is lower than the clean up limit. In addition, increase the clean up limit to 64 connections to avoid triggering GC too often and do more effective GCs. This has been tested using a HTTP server and several performance tools while having nft_connlimit/xt_connlimit or OVS limit configured. Output of slowhttptest + OVS limit at 52000 connections: slow HTTP test status on 340th second: initializing: 0 pending: 432 connected: 51998 error: 0 closed: 0 service available: YES Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC") Reported-by: Aleksandra Rukomoinikova Closes: https://lore.kernel.org/netfilter/b2064e7b-0776-4e14-adb6-c68080987471@k2.cloud/ Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec Author: Yuto Hamaguchi Date: Fri Dec 19 20:53:51 2025 +0900 netfilter: nf_conntrack: Add allow_clash to generic protocol handler The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956 ("netfilter: conntrack: introduce clash resolution on insertion race"), sets allow_clash=true in the UDP/UDPLITE protocol handler but does not set it in the generic protocol handler. As a result, packets composed of connectionless protocols at each layer, such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion. To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic. Signed-off-by: Yuto Hamaguchi Signed-off-by: Florian Westphal commit 6f93616a7323d646d18db9c09f147e453b40fdd7 Author: Florian Westphal Date: Fri Nov 28 12:26:54 2025 +0100 netfilter: nf_tables: reset table validation state on abort If a transaction fails the final validation in the commit hook, the table validation state is changed to NFT_VALIDATE_DO and a replay of the batch is performed. Every rule insert will then do a graph validation. This is much slower, but provides better error reporting to the user because we can point at the rule that introduces the validation issue. Without this reset the affected table(s) remain in full validation mode, i.e. on next transaction we start with slow-mode. This makes the next transaction after a failed incremental update very slow: # time iptables-restore < /tmp/ruleset real 0m0.496s [..] # time iptables -A CALLEE -j CALLER iptables v1.8.11 (nf_tables): RULE_APPEND failed (Too many links): rule in chain CALLEE real 0m0.022s [..] # time iptables-restore < /tmp/ruleset real 1m22.355s [..] After this patch, 2nd iptables-restore is back to ~0.5s. Fixes: 9a32e9850686 ("netfilter: nf_tables: don't write table validation state without mutex") Signed-off-by: Florian Westphal commit dde659d37036c6edf5eeef81274b43fe12dfad53 Author: Vikash Garodia Date: Wed Dec 10 18:06:04 2025 +0530 media: iris: Introduce vpu ops for vpu4 with necessary hooks Add power sequence for vpu4 by reusing from previous generation wherever possible. Hook up vpu4 op with vpu4 specific implemtation or resue from earlier generation wherever feasible, like clock calculation in this case. Co-developed-by: Vishnu Reddy Signed-off-by: Vishnu Reddy Signed-off-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 82b96a8d8d6ebedcda8ef2d051ddd0f43d8eee14 Author: Vikash Garodia Date: Wed Dec 10 18:06:03 2025 +0530 media: iris: Move vpu35 specific api to common to use for vpu4 Some of the sequence and calculations for vpu4 is identical to vpu35, namely power sequence for vpu controller and the clock frequency calculation. Move those to common file that can be shared for both vpu35 and vpu4. This patch prepares for power sequence for vpu4 which is added in subsequent patch. Reviewed-by: Bryan O'Donoghue Co-developed-by: Vishnu Reddy Signed-off-by: Vishnu Reddy Signed-off-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 2fc9b85dea50497f2264863d2f398bd1cfa5375b Author: Vikash Garodia Date: Wed Dec 10 18:06:02 2025 +0530 media: iris: Move vpu register defines to common header file Some of vpu4 register defines are common with vpu3x. Move those into the common register defines header. This is done to reuse the defines for vpu4 in subsequent patch which enables the power sequence for vpu4. Reviewed-by: Bryan O'Donoghue Co-developed-by: Vishnu Reddy Signed-off-by: Vishnu Reddy Signed-off-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Co-developed-by: Dmitry Baryshkov Signed-off-by: Dmitry Baryshkov Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit df816dce1b01ad761b20ff9568fbb5383e485bf9 Author: Vikash Garodia Date: Wed Dec 10 18:06:01 2025 +0530 media: iris: Introduce buffer size calculations for vpu4 Introduces vp4 buffer size calculation for both encoder and decoder. Reuse the buffer size calculation which are common, while adding the vpu4 ones separately. Co-developed-by: Vishnu Reddy Signed-off-by: Vishnu Reddy Signed-off-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit dff99dff6c3c4feadc28585dc16f741b0978e631 Author: Vikash Garodia Date: Wed Dec 10 18:06:00 2025 +0530 media: iris: Add support for multiple TZ content protection(CP) configs vpu4 needs an additional configuration with respect to CP regions. Make the CP configuration as array such that the multiple configuration can be managed per platform. Reviewed-by: Konrad Dybcio Reviewed-by: Bryan O'Donoghue Co-developed-by: Vishnu Reddy Signed-off-by: Vishnu Reddy Signed-off-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 8744df0e8946abee487342c97233e61ceb35a632 Author: Vikash Garodia Date: Wed Dec 10 18:05:59 2025 +0530 media: iris: Add support for multiple clock sources vpu4 depends on more than one clock source. Thus far hardware versions up to vpu3x have been clocked by a single source. This adds support for multiple clocks by, - Adding a lookup table - Configuring OPP table for video device with different video clocks - Setting OPP for multiple clocks during dev_pm_opp_set_opp() This patch extends the support for multiple clocks in driver, which would be used in subsequent patch for kaanapali, when the platform data is prepared. Reviewed-by: Bryan O'Donoghue Co-developed-by: Vishnu Reddy Signed-off-by: Vishnu Reddy Signed-off-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 5ef0832c6e42dc67101629810c763625905cd026 Author: Wangao Wang Date: Fri Nov 14 11:09:03 2025 +0800 media: qcom: iris: Add intra refresh support for encoder Add support for V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD and V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE controls. Reviewed-by: Dikshita Agarwal Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Wangao Wang Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 874eca6d309530d9223fb33e1ad056861955f491 Author: Wangao Wang Date: Fri Nov 14 11:09:02 2025 +0800 media: qcom: iris: Add flip support for encoder Add support for V4L2_CID_HFLIP and V4L2_CID_VFLIP controls in encoder. Reviewed-by: Dikshita Agarwal Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Wangao Wang Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 49a940f37de337dbbede5ac204cc9d7ebe22c59a Author: Wangao Wang Date: Fri Nov 14 11:09:01 2025 +0800 media: qcom: iris: Add rotation support for encoder Add rotation control for encoder, enabling V4L2_CID_ROTATE and handling 90/180/270 degree rotation. Reviewed-by: Dikshita Agarwal Co-developed-by: Neil Armstrong Signed-off-by: Neil Armstrong Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Wangao Wang Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 121d6d7a35110a5ce6892b1e4695cac9c0f3094b Author: Wangao Wang Date: Fri Nov 14 11:09:00 2025 +0800 media: qcom: iris: Add scale support for encoder Add members enc_scale_width, enc_scale_height to the struct iris_inst to support scale requirements. Add output width and height settings in iris_venc_s_fmt_output to enable scaling functionality. Add VPSS buffer to platform data, which the scale function requires. Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Wangao Wang Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 0708f305d6fabf9aca1d1c96d5a5b003df2d8bc9 Author: Wangao Wang Date: Fri Nov 14 11:08:59 2025 +0800 media: qcom: iris: Improve crop_offset handling for encoder The setting of HFI_PROP_CROP_OFFSETS for the OUTPUT port is correct, but on the CAPTURE port it is used to inform the firmware about the region of interest, so crop_offset needs to be handled accordingly. Reviewed-by: Dikshita Agarwal Signed-off-by: Wangao Wang Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit d9967fa37ca97aec5aea98d627107147cc02edbc Author: Wangao Wang Date: Fri Nov 14 11:08:58 2025 +0800 media: qcom: iris: Improve format alignment for encoder Add members enc_raw_width, enc_raw_height to the struct iris_inst to support codec alignment requirements. HFI_PROP_RAW_RESOLUTION needs to be set to the actual YUV resolution. Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Wangao Wang Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 9adfb1ba701494aea216ee5c45ed9a1929398102 Author: Vishnu Reddy Date: Mon Nov 10 12:54:29 2025 +0530 media: iris: Change psc properties message to debug level The message for attempting to set already configured input or output parameter subscribe change properties is not an error condition. Move it from error to debug level and make it more descriptive by indicating which specific input or output psc was already set. Signed-off-by: Vishnu Reddy Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 3f9b5c1ccd4484086b5ad51ed05c5d94ecaab7d3 Author: Ricardo Ribalda Date: Tue Dec 23 10:02:57 2025 +0000 media: iris: Document difference in size during allocation As we get ready for kzalloc checking for invalid sizes, let's add documentation for the cases where the size is different but valid. This patch fixes this cocci warning: ./platform/qcom/iris/iris_hfi_gen2_command.c:1215:9-25: WARNING: casting value returned by memory allocation function to (struct iris_inst *) is useless. Signed-off-by: Ricardo Ribalda Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 3e10bbd9c8a6d5d016b8e52c5d4ceba93a2304a0 Author: Joseph Chen Date: Mon Jan 12 20:43:51 2026 +0800 regulator: rk808: Add RK801 support Add support for rk801 to the existing rk808 regulator driver. It provides 4 BUCK, 2 LDO and 1 SWITCH. Signed-off-by: Joseph Chen Reviewed-by: Mark Brown Link: https://patch.msgid.link/20260112124351.17707-4-chenjh@rock-chips.com Signed-off-by: Lee Jones commit 156442eb6e44d545f09559bd70c5b31fba39eb01 Author: Joseph Chen Date: Mon Jan 12 20:43:50 2026 +0800 mfd: rk8xx: Add RK801 support The RK801 is a Power Management IC (PMIC) for multimedia and handheld devices. It contains the following components: - 4 BUCK - 2 LDO - 1 SWITCH Signed-off-by: Joseph Chen Link: https://patch.msgid.link/20260112124351.17707-3-chenjh@rock-chips.com Signed-off-by: Lee Jones commit f76d1c41b609b3e8f727fe681b7dd36bab71e3c3 Author: hongao Date: Thu Jan 15 10:38:03 2026 +0800 kprobes: retry blocked optprobe in do_free_cleaned_kprobes Once the aggrprobe is fully reverted in do_free_cleaned_kprobes(), retry optimize_kprobe() on that sibling so it can return to OPTIMIZED. Also remove the stale comment in __disarm_kprobe(). Link: https://lore.kernel.org/all/349359900266B25F+20260115023804.3951960-2-hongao@uniontech.com/ Signed-off-by: hongao Signed-off-by: Masami Hiramatsu (Google) commit a8a2add7b1889f00bc5d2b1f25fad34e89ef85fb Author: Joseph Chen Date: Mon Jan 12 20:43:49 2026 +0800 dt-bindings: mfd: Add rk801 binding Add DT binding document for Rockchip's RK801 PMIC Signed-off-by: Joseph Chen Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260112124351.17707-2-chenjh@rock-chips.com Signed-off-by: Lee Jones commit 4083d8d6c0aa445fc440d70a5258351c47547ee2 Author: Troy Mitchell Date: Thu Jan 8 14:42:40 2026 +0800 riscv: dts: spacemit: pinctrl: update register and IO power Change the size of the reg register to 0x1000 to match the hardware. This register range covers the IO power domain's register addresses. The IO power domain registers are protected. In order to access the protected IO power domain registers, a valid unlock sequence must be performed by writing the required keys to the AIB Secure Access Register (ASAR). The ASAR register resides within the APBC register address space. A corresponding syscon property `spacemit,apbc` is added to allow the pinctrl driver to access this register. Signed-off-by: Troy Mitchell Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20260108-kx-pinctrl-aib-io-pwr-domain-v2-3-6bcb46146e53@linux.spacemit.com Signed-off-by: Yixun Lan commit 7a61318049861b777f098d7148d892d7dc79b010 Author: Guodong Xu Date: Thu Jan 15 14:51:46 2026 +0800 riscv: dts: spacemit: add K3 Pico-ITX board support K3 Pico-ITX is a 2.5-inch single-board computer equipted with a SpacemiT K3 SoC. This minimal device tree enables booting into a serial console with UART output. Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20260115-k3-basic-dt-v5-7-6990ac9f4308@riscstar.com Signed-off-by: Yixun Lan commit 56f37e391a626f964615ee5939710eff212b621f Author: Guodong Xu Date: Thu Jan 15 14:51:45 2026 +0800 riscv: dts: spacemit: add initial support for K3 SoC SpacemiT K3 is equipped with 8 X100 cores, which are RVA23 compliant. Add nodes of uarts, timer and interrupt-controllers. Also add M-mode APLIC (maplic) and IMSIC (mimsic) nodes to represent the hardware topology and ready for potential firmware usage. Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20260115-k3-basic-dt-v5-6-6990ac9f4308@riscstar.com Signed-off-by: Yixun Lan commit 7cb5fafc180f6e188af7943d6b162051f22490fc Author: Guodong Xu Date: Thu Jan 15 14:51:44 2026 +0800 dt-bindings: riscv: spacemit: add K3 and Pico-ITX board bindings Add DT binding documentation for the SpacemiT K3 SoC and the board Pico-ITX which is a 2.5-inch single-board computer. Acked-by: Conor Dooley Reviewed-by: Yixun Lan Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20260115-k3-basic-dt-v5-5-6990ac9f4308@riscstar.com Signed-off-by: Yixun Lan commit a716729a3ce1055efab477030235777d2be0852b Author: Guodong Xu Date: Thu Jan 15 14:51:43 2026 +0800 dt-bindings: interrupt-controller: add SpacemiT K3 IMSIC Add compatible string for SpacemiT K3 IMSIC. Acked-by: Krzysztof Kozlowski Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20260115-k3-basic-dt-v5-4-6990ac9f4308@riscstar.com Signed-off-by: Yixun Lan commit 60490ca6d54b6f0a00223a4fe59bb180bb1538bf Author: Guodong Xu Date: Thu Jan 15 14:51:42 2026 +0800 dt-bindings: interrupt-controller: add SpacemiT K3 APLIC Add compatible string for SpacemiT K3 APLIC. Acked-by: Conor Dooley Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20260115-k3-basic-dt-v5-3-6990ac9f4308@riscstar.com Signed-off-by: Yixun Lan commit 6cdeb30db4d8faf9f1fa7ab863d91d36a584716d Author: Guodong Xu Date: Thu Jan 15 14:51:41 2026 +0800 dt-bindings: timer: add SpacemiT K3 CLINT Add compatible string for SpacemiT K3 CLINT. Acked-by: Conor Dooley Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20260115-k3-basic-dt-v5-2-6990ac9f4308@riscstar.com Signed-off-by: Yixun Lan commit 81a52103b90f5cddc41c34f633c014a956236abc Author: Guodong Xu Date: Thu Jan 15 14:51:40 2026 +0800 dt-bindings: riscv: add SpacemiT X100 CPU compatible Add compatible string for the SpacemiT X100 core. [1] The X100 is a 64-bit RVA23-compliant RISC-V core from SpacemiT. X100 supports the RISC-V vector and hypervisor extensions and all mandatory extersions as required by the RVA23U64 and RVA23S64 profiles, per the definition in 'RVA23 Profile, Version 1.0'. [2] From a microarchieture viewpoint, the X100 features a 4-issue out-of-order pipeline. X100 is used in SpacemiT K3 SoC. Acked-by: Paul Walmsley Acked-by: Krzysztof Kozlowski Link: https://www.spacemit.com/en/spacemit-x100-core/ [1] Link: https://docs.riscv.org/reference/profiles/rva23/_attachments/rva23-profile.pdf [2] Reviewed-by: Yixun Lan Reviewed-by: Heinrich Schuchardt Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20260115-k3-basic-dt-v5-1-6990ac9f4308@riscstar.com Signed-off-by: Yixun Lan commit 4168630825f95bf57729dad46d2a097096e73e4d Author: Guodong Xu Date: Thu Jan 15 07:19:00 2026 +0800 riscv: dts: spacemit: k1: Add "b" ISA extension "b" is ratified (Apr/2024) much later than its components zba/zbb/zbs (Jun/2021). With "b" added into riscv/extensions.yaml, a dependency checking rule is now enforced, which requires that when zba, zbb, and zbs are all specified, "b" must be added as well. Failing to do this will cause dtbs_check schema check warnings. According to uabi.rst, as a single-letter extension, "b" should be added after "c" in canonical order. Update k1.dtsi to conform to this rule. Signed-off-by: Guodong Xu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260115-adding-b-dtsi-v2-4-254dd61cf947@riscstar.com Signed-off-by: Yixun Lan commit c7e62c4eea026d42d192a0b86ce7313086ef2093 Author: Ze Huang Date: Sun Jan 11 14:41:04 2026 +0800 riscv: dts: spacemit: Enable USB3.0 on BananaPi-F3 Enable the DWC3 USB 3.0 controller and its associated usbphy2 on the Banana Pi F3 board. The board utilizes a VLI VL817 hub, which requires two separate power supplies: one VBUS and one for hub itself. Add two GPIO-controlled fixed-regulators to manage this. Tested-by: Aurelien Jarno Signed-off-by: Ze Huang Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260111-k1-usb3dts-v2-v3-3-f5ebd546e904@linux.dev Signed-off-by: Yixun Lan commit 6e8dcd141833a23d7117fe16896f6d5dfdb2e112 Author: Ze Huang Date: Sun Jan 11 14:41:03 2026 +0800 riscv: dts: spacemit: Add DWC3 USB 3.0 controller node for K1 Add node for the Synopsys DWC3 USB 3.0 host controller on the K1 SoC. The controller resides on the 'storage-bus' and uses its DMA translations. Tested-by: Aurelien Jarno Signed-off-by: Ze Huang Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260111-k1-usb3dts-v2-v3-2-f5ebd546e904@linux.dev Signed-off-by: Yixun Lan commit 9d591fef025d5008f23ab339a10006b151150578 Author: Ze Huang Date: Sun Jan 11 14:41:02 2026 +0800 riscv: dts: spacemit: Add USB2 PHY node for K1 K1's DWC3 USB 3.0 controller requires two separate PHYs to function: the USB 3.0 combophy (for SuperSpeed) and a USB 2.0 PHY (for High-Speed, Full-Speed, etc.). Add node for this second USB 2.0 PHY (usbphy2). Tested-by: Aurelien Jarno Signed-off-by: Ze Huang Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20260111-k1-usb3dts-v2-v3-1-f5ebd546e904@linux.dev Signed-off-by: Yixun Lan commit 7689c2d1bb1f53b170af79007d0611b43f232f05 Author: Yixun Lan Date: Tue Dec 23 10:24:51 2025 +0800 riscv: dts: spacemit: sdhci: add reset support Request two reset line explicitly for SDHCI controller. Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251223-07-k1-sdhci-reset-v2-3-5b8248cfc522@gentoo.org Signed-off-by: Yixun Lan commit 7d6fe7e381d2912300df06e1a7e7a6f6a9269af0 Author: Encrow Thorne Date: Tue Dec 30 23:06:53 2025 +0800 riscv: dts: spacemit: add reset property Add resets property to K1 I2C node. Signed-off-by: Encrow Thorne Link: https://lore.kernel.org/r/20251230150653.42097-3-jyc0019@gmail.com Signed-off-by: Yixun Lan commit 6ea258d1f6895c61af212473b51477d39b8c99d2 Author: Jay Winston Date: Sun Jan 18 13:04:01 2026 +0200 fs/namei: fix kernel-doc markup for dentry_create O_ is interpreted as a broken hyperlink target. Escape _ with a backslash. The asterisk in "struct file *" is interpreted as an opening emphasis string that never closes. Replace double quotes with rST backticks. Change "a ERR_PTR" to "an ERR_PTR". Signed-off-by: Jay Winston Link: https://patch.msgid.link/20260118110401.2651-1-jaybenjaminwinston@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 685d0dfc37d081e56374852165afc8ab3b3e8d5b Author: Luca Ceresoli Date: Fri Jan 9 08:31:43 2026 +0100 drm/bridge: samsung-dsim: samsung_dsim_host_attach: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done. Also switch to the drm_bridge::next_bridge pointer. This needs to handle both cases: when of_drm_find_panel() succeeds and when it fails. In the 'else' case (i.e. when of_drm_find_panel() fails), just switch to of_drm_find_and_get_bridge() to ensure the bridge is not freed while in use in the function tail, when it is stored in dsi->bridge.next_bridge. In the 'then' case (i.e. when of_drm_find_panel() succeeds), devm_drm_panel_bridge_add() already increments the refcount using devres which ties the bridge allocation lifetime to the device lifetime, so we would not need to do anything. However to have the same behaviour in both branches take an additional reference here, so that the bridge needs to be put whichever branch is taken without more complicated logic. Ensure to clear the bridge pointer however, to avoid calling drm_bridge_put() on an ERR_PTR. Acked-by: Maxime Ripard Tested-by: Marek Szyprowski Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-12-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit 33f86ac63031d0593e48eb0a738f2d1b1ee29879 Author: Luca Ceresoli Date: Fri Jan 9 08:31:42 2026 +0100 drm/bridge: samsung-dsim: samsung_dsim_host_attach: don't use the bridge pointer as an error indicator In preparation to handle refcounting of the out_bridge, we need to ensure the out_bridge pointer contains either a valid bridge pointer or NULL, not an ERR_PTR. Otherwise calls such as drm_bridge_get/put() would try to redeference an ERR_PTR. Stop using IS_ERR(next_bridge) as an indication of an error, and instead use the 'ret' integer. No functional change. Acked-by: Maxime Ripard Tested-by: Marek Szyprowski Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-11-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit e5e1a0000746ded4d9fa16fceda0748aec2b6e6a Author: Luca Ceresoli Date: Fri Jan 9 08:31:41 2026 +0100 drm/bridge: samsung-dsim: samsung_dsim_host_attach: use a temporary variable for the next bridge In preparation to handle refcounting of the out_bridge, we need to ensure the out_bridge pointer contains either a valid bridge pointer or NULL, not an ERR_PTR. Otherwise calls such as drm_bridge_get/put() would try to redeference an ERR_PTR. As a preliminary cleanup, add a temporary local 'next_bridge' pointer and only copy it in dsi->out_bridge as late as possible, i.e. just before calling pdata->host_ops->attach() which uses it (only in the exynos driver). Not strictly needed, but for symmetry move the clearing of dsi->out_bridge in samsung_dsim_host_detach() to after pdata->host_ops->detach(). Acked-by: Maxime Ripard Tested-by: Marek Szyprowski Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-10-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit 32529d384cea3a9b939ff1b56aa30a13f8370129 Author: Luca Ceresoli Date: Fri Jan 9 08:31:40 2026 +0100 drm/bridge: imx8qxp-ldb: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done. Since the companion bridge pointer is used by many bridge funcs, putting its reference in the remove function would be dangerous. Use .destroy to put it on final deallocation. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-9-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit 7654c807f20701ebd1dc7e967270d017dcc36730 Author: Luca Ceresoli Date: Fri Jan 9 08:31:39 2026 +0100 drm/bridge: imx8mp-hdmi-pvi: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done by using the drm_bridge::next_bridge pointer. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-8-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit 31cb3cd7e7149983e279f3d6da3ae5757a965ea5 Author: Luca Ceresoli Date: Fri Jan 9 08:31:38 2026 +0100 drm/bridge: lt8912b: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done by using the drm_bridge::next_bridge pointer. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-7-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit 0bbca46cd50a527bded903ffe7f32e3761e825bd Author: Luca Ceresoli Date: Fri Jan 9 08:31:37 2026 +0100 drm/bridge: tpd12s015: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done by using the drm_bridge::next_bridge pointer. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-6-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit 35dd5e1c089b6fd9f503bb15ebc1138d5a3f887e Author: Luca Ceresoli Date: Fri Jan 9 08:31:36 2026 +0100 drm/bridge: tfp410: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done by using the drm_bridge::next_bridge pointer. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-5-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit 9d34e1a8cf7b643bca058a65f3441d90099b297f Author: Luca Ceresoli Date: Fri Jan 9 08:31:35 2026 +0100 drm/bridge: thc63lvd1024: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done by using the drm_bridge::next_bridge pointer. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-4-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit d07490fb23958006bcecd6f2ba411571c099d104 Author: Luca Ceresoli Date: Fri Jan 9 08:31:34 2026 +0100 drm/bridge: sii902x: convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done by using the drm_bridge::next_bridge pointer. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-3-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit f675a276b84488e78287dd22c2e9461e4c008c66 Author: Luca Ceresoli Date: Fri Jan 9 08:31:33 2026 +0100 drm: of: drm_of_panel_bridge_remove(): convert to of_drm_find_and_get_bridge() of_drm_find_bridge() is deprecated. Move to its replacement of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it is put when done. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-2-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit a4b4385d0523e39a7c058cb5a6c8269e513126ca Author: Luca Ceresoli Date: Fri Jan 9 08:31:32 2026 +0100 drm: of: drm_of_panel_bridge_remove(): fix device_node leak drm_of_panel_bridge_remove() uses of_graph_get_remote_node() to get a device_node but does not put the node reference. Fixes: c70087e8f16f ("drm/drm_of: add drm_of_panel_bridge_remove function") Cc: stable@vger.kernel.org # v4.15 Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-1-8bad3ef90b9f@bootlin.com Signed-off-by: Luca Ceresoli commit 2177a02246ffef9ed4a01af2942119e601312965 Author: Armin Wolf Date: Fri Jan 16 21:41:16 2026 +0100 platform/wmi: Update driver development guide New WMI drivers should use the new buffer-based WMI API instead of the deprecated ACPI-based API. Update the driver development guide to recommend the buffer-based API to driver developers and explain the purpose of struct wmi_buffer. Also update the ACPI interface documentation to describe the conversion rules for converting ACPI objects into WMI buffers. Reviewed-by: Randy Dunlap Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260116204116.4030-10-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 926a266575a21e96c4c0b9c16b1da1f7fda5a519 Author: Armin Wolf Date: Fri Jan 16 21:41:15 2026 +0100 platform/x86: wmi-bmof: Use new buffer-based WMI API Use the new buffer-based WMI API to also support ACPI firmware implementations that do not use ACPI buffers to return the BMOF data. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260116204116.4030-9-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit bb7527c63f8567d69a22a818aa5999be47c5d479 Author: Armin Wolf Date: Fri Jan 16 21:41:14 2026 +0100 platform/x86: xiaomi-wmi: Use new buffer-based WMI API Use the new buffer-based WMI API to avoid having to deal with ACPI at all. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260116204116.4030-8-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e210986f52b657301d009e23344e3effec12bbeb Author: Armin Wolf Date: Fri Jan 16 21:41:13 2026 +0100 platform/x86/intel/wmi: thunderbolt: Use new buffer-based WMI API Use the new buffer-based WMI API to avoid having to deal with ACPI at all. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260116204116.4030-7-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 534f685d8a952371148e1374576f8ede2919ec1d Author: Armin Wolf Date: Fri Jan 16 21:41:12 2026 +0100 platform/x86: intel-wmi-sbl-fw-update: Use new buffer-based WMI API Use the new buffer-based WMI API to also support ACPI firmware implementations that return a ACPI buffer instead of a ACPI integer. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260116204116.4030-6-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0e1a8143e79713eef7e027737fed259aa58866e7 Author: Armin Wolf Date: Fri Jan 16 21:41:11 2026 +0100 platform/wmi: Add kunit test for the string conversion code The string conversion frunctions provided by the WMI driver core have no dependencies on the remaining WMI API, making them suitable for unit tests. Implement such a unit test using kunit. Those unit tests verify that converting between WMI strings and UTF8 strings works as expected. They also verify that edge cases are handled correctly. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260116204116.4030-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b990a06f7ec6dc3ceecd8015c3b421690f267122 Author: Armin Wolf Date: Fri Jan 16 21:41:10 2026 +0100 platform/wmi: Add helper functions for WMI string conversions WMI strings are encoded using UTF16-LE characters, forcing WMI drivers to manually convert them to/from standard UTF8 strings. Add a two helper functions for those tasks. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260116204116.4030-4-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 29dfba69c3ddb7945cd772042c6a9ce770c1ba22 Author: Armin Wolf Date: Fri Jan 16 21:41:09 2026 +0100 platform/wmi: Add kunit test for the marshalling code The marshalling code used by the WMI driver core is implemented as a separate component, suitable for unit tests. Implmented such a unit test using KUnit. Those unit tests verify that ACPI objects are correctly converted into WMI buffers and that WMI strings are correctly converted into ACPI strings. They also verify that invalid ACPI data (like nested packages) is rejected. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260116204116.4030-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 015b70a6ae697f5dac3562e4ab45ee275d98860b Author: Armin Wolf Date: Fri Jan 16 21:41:08 2026 +0100 platform/wmi: Introduce marshalling support The Windows WMI-ACPI driver likely uses wmilib [1] to interact with the WMI service in userspace. Said library uses plain byte buffers for exchanging data, so the WMI-ACPI driver has to convert between those byte buffers and ACPI objects returned by the ACPI firmware. The format of the byte buffer is publicly documented [2], and after some reverse eingineering of the WMI-ACPI driver using a set of custom ACPI tables, the following conversion rules have been discovered: - ACPI integers are always converted into a uint32 - ACPI strings are converted into special WMI strings - ACPI buffers are copied as-is - ACPI packages are unpacked Extend the ACPI-WMI driver to also perform this kind of marshalling for WMI data blocks, methods and events. Doing so gives us a number of benefits: - WMI drivers are not restricted to a fixed set of supported ACPI data types anymore, see dell-wmi-aio (integer vs buffer) and hp-wmi-sensors (string vs buffer) - correct marshalling of WMI strings when data blocks are marked as requiring ACPI strings instead of ACPI buffers - development of WMI drivers without having to understand ACPI This eventually should result in better compatibility with some ACPI firmware implementations and in simpler WMI drivers. There are however some differences between the original Windows driver and the ACPI-WMI driver when it comes to ACPI object conversions: - the Windows driver copies internal _ACPI_METHOD_ARGUMENT_V1 data structures into the output buffer when encountering nested ACPI packages. This is very likely an error inside the driver itself, so we do not support nested ACPI packages. - when converting WMI strings (UTF-16LE) into ACPI strings (ASCII), the Windows driver replaces non-ascii characters (ä -> a, & -> ?) instead of returning an error. This behavior is not documented anywhere and might lead to severe errors in some cases (like setting BIOS passwords over WMI), so we simply return an error. As the current bus-based WMI API is based on ACPI buffers, a new API is necessary. The legacy GUID-based WMI API is not extended to support marshalling, as WMI drivers using said API are expected to move to the bus-based WMI API in the future. [1] https://learn.microsoft.com/de-de/windows-hardware/drivers/ddi/wmilib/ [2] https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/ driver-defined-wmi-data-items Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260116204116.4030-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit fae88e03f45893cfb63c608761220a489cc6e25e Author: David Laight Date: Wed Nov 19 22:41:16 2025 +0000 drivers/i2c/busses: use min() instead of min_t() min_t(u8, a, b) casts both its arguments to u8 potentially discarding signifinact bits. Use min(a, b) instead as it cannot discard significant bits. Detected by an extra check added to min_t(). Signed-off-by: David Laight Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251119224140.8616-21-david.laight.linux@gmail.com commit 2c73cfd0cfc44ffe331ccb81f6ac45fc399d9ddb Author: Vishnu Reddy Date: Mon Dec 29 12:01:25 2025 +0530 media: iris: Prevent output buffer queuing before stream-on completes During normal playback, stream-on for input is followed by output, and only after input stream-on does actual streaming begin. However, when gst-play performs a seek, both input and output streams are stopped, and on restart, output stream-on occurs first. At this point, firmware has not yet started streaming. Queuing output buffers before the firmware begins streaming causes it to process buffers in an invalid state, leading to an error response. These buffers are returned to the driver as errors, forcing the driver into an error state and stopping playback. Fix this by deferring output buffer queuing until stream-on completes. Input buffers can still be queued before stream-on as required. Fixes: 92e007ca5ab6 ("media: iris: Add V4L2 streaming support for encoder video device") Signed-off-by: Vishnu Reddy Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 9aa8d63d09cfc44d879427cc5ba308012ca4ab8e Author: Dikshita Agarwal Date: Mon Dec 29 12:01:24 2025 +0530 media: iris: gen2: Add sanity check for session stop In iris_kill_session, inst->state is set to IRIS_INST_ERROR and session_close is executed, which will kfree(inst_hfi_gen2->packet). If stop_streaming is called afterward, it will cause a crash. Add a NULL check for inst_hfi_gen2->packet before sendling STOP packet to firmware to fix that. Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 1dabf00ee206eceb0f08a1fe5d1ce635f9064338 Author: Dikshita Agarwal Date: Mon Dec 29 12:01:22 2025 +0530 media: iris: gen1: Destroy internal buffers after FW releases After the firmware releases internal buffers, the driver was not destroying them. This left stale allocations that were no longer used, especially across resolution changes where new buffers are allocated per the updated requirements. As a result, memory was wasted until session close. Destroy internal buffers once the release response is received from the firmware. Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") Reviewed-by: Bryan O'Donoghue Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 811dbc546f47559dc9d2098c612acfd47e32479e Author: Dikshita Agarwal Date: Mon Dec 29 12:01:21 2025 +0530 media: iris: Skip resolution set on first IPSC The resolution property is not supposed to be set during reconfig. Existing iris_drc_pending(inst) check is insufficient, as it doesn't cover the first port setting change. Extend the conditional check to also skip resolution setting when the instance is in IRIS_INST_SUB_FIRST_IPSC. Fixes: caf205548769 ("media: iris: Avoid updating frame size to firmware during reconfig") Reviewed-by: Bryan O'Donoghue Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 2d0bbd982dfdd67da488a772f7a8a1bdca7642bf Author: Dikshita Agarwal Date: Mon Dec 29 12:01:20 2025 +0530 media: iris: Add buffer to list only after successful allocation Move `list_add_tail()` to after `dma_alloc_attrs()` succeeds when creating internal buffers. Previously, the buffer was enqueued in `buffers->list` before the DMA allocation. If the allocation failed, the function returned `-ENOMEM` while leaving a partially initialized buffer in the list, which could lead to inconsistent state and potential leaks. By adding the buffer to the list only after `dma_alloc_attrs()` succeeds, we ensure the list contains only valid, fully initialized buffers. Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") Reviewed-by: Bryan O'Donoghue Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit bbef55f414100853d5bcea56a41f8b171bac8fcb Author: Dikshita Agarwal Date: Thu Dec 18 12:24:09 2025 +0530 media: iris: Add missing platform data entries for SM8750 Two platform-data fields for SM8750 were missed: - get_vpu_buffer_size = iris_vpu33_buf_size Without this, the driver fails to allocate the required internal buffers, leading to basic decode/encode failures during session bring-up. - max_core_mbps = ((7680 * 4320) / 256) * 60 Without this capability exposed, capability checks are incomplete and v4l2-compliance for encoder fails. Fixes: a5925a2ce077 ("media: iris: add VPU33 specific encoding buffer calculation") Fixes: a6882431a138 ("media: iris: Add support for ENUM_FRAMESIZES/FRAMEINTERVALS for encoder") Cc: stable@vger.kernel.org Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Reviewed-by: Konrad Dybcio Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 8fc707d13df517222db12b465af4aa9df05c99e1 Author: Dikshita Agarwal Date: Sun Nov 2 09:10:19 2025 +0530 media: iris: remove v4l2_m2m_ioctl_{de,en}coder_cmd API usage during STOP handling Currently v4l2_m2m_ioctl_{de,enc}coder_cmd is being invoked during STOP command handling. However, this is not required as the iris driver has its own drain and stop handling mechanism in place. Using the m2m command API in this context leads to incorrect behavior, where the LAST flag is prematurely attached to a capture buffer, when there are no buffers in m2m source queue. But, in this scenario even though the source buffers are returned to client, hardware might still need to process the pending capture buffers. Attaching LAST flag prematurely can result in the capture buffer being removed from the destination queue before the hardware has finished processing it, causing issues when the buffer is eventually returned by the hardware. To prevent this, remove the m2m API usage in stop handling. Fixes: d09100763bed ("media: iris: add support for drain sequence") Fixes: 75db90ae067d ("media: iris: Add support for drain sequence in encoder video device") Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 4980721cb97d6c47700ab61a048ac8819cfeec87 Author: Val Packett Date: Thu Dec 25 20:09:10 2025 -0300 media: iris: use fallback size when S_FMT is called without width/height According to 4.5.1.5 of the M2M stateful decoder UAPI documentation, providing the width and the height to S_FMT is "required only if it cannot be parsed from the stream", otherwise they can be left as 0 and the S_FMT implementation is expected to return a valid placeholder resolution that would let REQBUFS succeed. iris was missing the fallback, so clients like rpi-ffmpeg wouldn't work. Fix by adding an explicit fallback to defaults. Fixes: b530b95de22c ("media: iris: implement s_fmt, g_fmt and try_fmt ioctls") Link: https://github.com/jc-kynesim/rpi-ffmpeg/issues/103 Reviewed-by: Dikshita Agarwal Signed-off-by: Val Packett Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 71fe80364a6584f404556ac9a6a4aca4ab80fb5b Author: Ricardo Ribalda Date: Tue Dec 23 10:02:58 2025 +0000 media: iris: Fix fps calculation iris_venc_s_param() uses do_div to divide two 64 bits operators, this is wrong. Luckily for us, both of the operators fit in 32 bits, so we can use a normal division. Now that we are at it, mark the fps smaller than 1 as invalid, the code does not seem to handle them properly. The following cocci warning is fixed with this patch: ./platform/qcom/iris/iris_venc.c:378:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead Fixes: 4ff586ff28e3 ("media: iris: Add support for G/S_PARM for encoder video device") Reviewed-by: Dikshita Agarwal Cc: stable@vger.kernel.org Signed-off-by: Ricardo Ribalda Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 89f7cf35901138d9828d981ce64c131a3da6e867 Author: Vishnu Reddy Date: Mon Oct 6 14:48:19 2025 +0530 media: iris: Fix ffmpeg corrupted frame error When the ffmpeg decoder is running, the driver receives the V4L2_BUF_FLAG_KEYFRAME flag in the input buffer. The driver then forwards this flag information to the firmware. The firmware, in turn, copies the input buffer flags directly into the output buffer flags. Upon receiving the output buffer from the firmware, the driver observes that the buffer contains the HFI_BUFFERFLAG_DATACORRUPT flag. The root cause is that both V4L2_BUF_FLAG_KEYFRAME and HFI_BUFFERFLAG_DATACORRUPT are the same value. As a result, the driver incorrectly interprets the output frame as corrupted, even though the frame is actually valid. This misinterpretation causes the driver to report an error and skip good frames, leading to missing frames in the final video output and triggering ffmpeg's "corrupt decoded frame" error. To resolve this issue, the input buffer flags should not be sent to the firmware during decoding, since the firmware does not require this information. Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response") Cc: stable@vger.kernel.org Signed-off-by: Vishnu Reddy Reviewed-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 370e19042fb8ac68109f8bdb0fdd8118baf39318 Author: Dikshita Agarwal Date: Mon Dec 29 12:01:23 2025 +0530 Revert "media: iris: Add sanity check for stop streaming" This reverts commit ad699fa78b59241c9d71a8cafb51525f3dab04d4. Revert the check that skipped stop_streaming when the instance was in IRIS_INST_ERROR, as it caused multiple regressions: 1. Buffers were not returned to vb2 when the instance was already in error state, triggering warnings in the vb2 core because buffer completion was skipped. 2. If a session failed early (e.g. unsupported configuration), the instance transitioned to IRIS_INST_ERROR. When userspace attempted to stop streaming for cleanup, stop_streaming was skipped due to the added check, preventing proper teardown and leaving the firmware in an inconsistent state. Fixes: ad699fa78b59 ("media: iris: Add sanity check for stop streaming") Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit a8bdd9310cc9b47d9ea851f6f5fb699aaa4930d6 Author: Jani Nikula Date: Wed Jan 7 17:27:04 2026 +0200 drm/rockchip: inno-hdmi: make inno_hdmi.h header self-contained Include linux/types.h for u8. Reviewed-by: Andy Yan Link: https://patch.msgid.link/20260107152704.2290146-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 66c744e28b69d931b142adb6b9f5e56ac9644f79 Author: Jorge Ramirez-Ortiz Date: Wed Nov 26 15:00:24 2025 +0100 media: venus: assign unique bus_info strings for encoder and decoder The Venus encoder and decoder video devices currently report the same bus_info string ("platform:qcom-venus"). Assign unique bus_info identifiers by appending ":dec" and ":enc" to the parent device name. With this change v4l2-ctl will display two separate logical devices Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 63c072e2937e6c9995df1b6a28523ed2ae68d364 Author: Dikshita Agarwal Date: Tue Nov 25 11:04:19 2025 +0530 media: venus: vdec: restrict EOS addr quirk to IRIS2 only On SM8250 (IRIS2) with firmware older than 1.0.087, the firmware could not handle a dummy device address for EOS buffers, so a NULL device address is sent instead. The existing check used IS_V6() alongside a firmware version gate: if (IS_V6(core) && is_fw_rev_or_older(core, 1, 0, 87)) fdata.device_addr = 0; else fdata.device_addr = 0xdeadb000; However, SC7280 which is also V6, uses a firmware string of the form "1.0.", which the version parser translates to 1.0.0. This unintentionally satisfies the `is_fw_rev_or_older(..., 1, 0, 87)` condition on SC7280. Combined with IS_V6() matching there as well, the quirk is incorrectly applied to SC7280, causing VP9 decode failures. Constrain the check to IRIS2 (SM8250) only, which is the only platform that needed this quirk, by replacing IS_V6() with IS_IRIS2(). This restores correct behavior on SC7280 (no forced NULL EOS buffer address). Fixes: 47f867cb1b63 ("media: venus: fix EOS handling in decoder stop command") Cc: stable@vger.kernel.org Reported-by: Mecid Closes: https://github.com/qualcomm-linux/kernel-topics/issues/222 Co-developed-by: Renjiang Han Signed-off-by: Renjiang Han Signed-off-by: Dikshita Agarwal Tested-by: Renjiang Han Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 93ecd6ee95c38cb533fa25f48d3c1c8cb69f410f Author: Renjiang Han Date: Thu Dec 11 15:20:39 2025 +0530 media: venus: vdec: fix error state assignment for zero bytesused When hfi_session_flush is issued, all queued buffers are returned to the V4L2 driver. Some of these buffers are not processed and have bytesused = 0. Currently, the driver marks such buffers as error even during drain operations, which can incorrectly flag EOS buffers. Only capture buffers with zero payload (and not EOS) should be marked with VB2_BUF_STATE_ERROR. The check is performed inside the non-EOS branch to ensure correct handling. Fixes: 51df3c81ba10b ("media: venus: vdec: Mark flushed buffers with error state") Signed-off-by: Renjiang Han Reviewed-by: Vikash Garodia Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit e005fd94e2e5867f2a4e66e5df85069cda6f0db4 Author: Alice Ryhl Date: Tue Jan 20 10:34:58 2026 +0000 drm/tyr: rename pad0 to selected_coherency This applies the uapi change in commit ea78ec982653 ("drm/panthor: Expose the selected coherency protocol to the UMD") to the Tyr driver as well. Once this is merged with drm-rust-next, this kind of change to the uapi struct is automatically reflected in the Tyr driver's GpuInfo. [1] Link: https://lore.kernel.org/r/aW8-oH7dtp-OTAZC@google.com [1] Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20260120-tyr-pad0-coherency-v1-1-91f40e56c67a@google.com Signed-off-by: Alice Ryhl commit 00ca2dd431fa2acb07b3ecc6ce49fb9a0a4d72cb Author: Peter Ujfalusi Date: Tue Jan 20 10:19:35 2026 +0200 ASoC: SOF: Intel: hda: Remove MODULE_SOFTDEP for snd-hda-codec-hdmi The sofdep no longer works due to the reworked HDA audio stack and it was an incorrect way to try to work around system security policy blocking request_module use, even if they are legitimate. Drop the softdep to stop the whack-a-mole hacking around system configuration issues. Revert "ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module" This reverts commit 33b7dc7843dbdc9b90c91d11ba30b107f9138ffd. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20260120081935.11005-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 1616c41e469cf5263e756161ed2e35664ff7d978 Author: Niranjan H Y Date: Tue Jan 20 09:38:25 2026 +0530 ASoC: tas2783A: fw loading for devices without pci bus Currently, there is compilation error when the CONFIG_PCI is not enabled which is used for creating firmware name. This commit address this issue by adding fallback mechanism to construct unqiue name by using SounWire slave's link and unique ids alone when the CONFIG_PCI is not available. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601190756.IpoMY5AJ-lkp@intel.com/ Signed-off-by: Niranjan H Y Link: https://patch.msgid.link/20260120040825.1460-1-niranjan.hy@ti.com Signed-off-by: Mark Brown commit 8d38c275f7ffe257d21bea224d4288eef183817d Author: Bard Liao Date: Tue Jan 20 14:56:58 2026 +0800 ASoC: sdw_utils: remove dai registered check Checking for a registered DAI for non-existing endpoints causes the following error. The driver will always return -EPROBE_DEFER if the codec driver doesn't register the DAI of the unexist endpoint. Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260120065658.1806027-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit cafadbf430f4b2f3ca4158de48ef6ba4d97fbf17 Author: Claudiu Beznea Date: Mon Jan 19 21:52:52 2026 +0200 ASoC: renesas: rz-ssi: Drop goto label There is no need to jump to a label just to return. Return directly instead. Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260119195252.3362486-5-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit c7a4c368e7135046c358ff15c4f7897e2522dedc Author: Claudiu Beznea Date: Mon Jan 19 21:52:51 2026 +0200 ASoC: renesas: rz-ssi: Drop the & operator in front of function name There is no need for & operator in front of the function name. Drop it. Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260119195252.3362486-4-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit 9e0e337cc6c7f30a5986dd44dac5c0a0e30d971f Author: Claudiu Beznea Date: Mon Jan 19 21:52:50 2026 +0200 ASoC: renesas: rz-ssi: Drop unnecessary if condition The is_stopped variable can be initialized directly at declaration, removing the need for an extra if condition. Drop the if condition and initialize is_stopped at declaration. Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260119195252.3362486-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit 53dfb2ad6fcff111f58aa506afbbf6fd82f32cb1 Author: Claudiu Beznea Date: Mon Jan 19 21:52:49 2026 +0200 ASoC: renesas: rz-ssi: Simplify the logic in rz_ssi_stream_is_play() The code in rz_ssi_stream_is_play() checks whether substream->stream is different from SNDRV_PCM_STREAM_PLAYBACK and returns the capture struct rz_ssi_stream in that case. The logic is easier to follow if substream->stream is compared directly against SNDRV_PCM_STREAM_CAPTURE and return the capture struct rz_ssi_stream. Use the conditional operator to simplify the code. Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20260119195252.3362486-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit 65428481cf6e174cc1bb45444ddc7489e3f2ef0d Author: Michael Walle Date: Thu Jan 15 14:24:42 2026 +0100 arm64: defconfig: Enable configurations for Kontron SMARC-sAM67 Enable the configurations needed for boards with the Kontron SMARC-sAM67 SoM. This allows the use of PCI peripherals, TPS6594 power button, voltage and temperature sensors on carrier boards designed for this module. Signed-off-by: Michael Walle Link: https://patch.msgid.link/20260115132558.1522169-2-mwalle@kernel.org Link: https://patch.msgid.link/20260115132558.1522169-3-mwalle@kernel.org Link: https://patch.msgid.link/20260115132558.1522169-4-mwalle@kernel.org [nm@ti.com: Squashed patches] Signed-off-by: Nishanth Menon commit 3495a5df94a9ad7a8940bcb3ebfda58255f5b952 Author: Haibo Chen Date: Wed Jan 14 14:49:45 2026 +0800 spi: dt-bindings: nxp,imx94-xspi: add nxp,imx952-xspi Document i.MX952 XSPI compatible, which is derived from i.MX94 XSPI. Signed-off-by: Haibo Chen Link: https://patch.msgid.link/20260114-xspi-imx952-v1-1-acc60a5a2a9d@nxp.com Signed-off-by: Mark Brown commit 53ed3d91a141f5c8b3bce45b0004fbbfefe77956 Author: Uros Bizjak Date: Mon Jan 5 10:02:32 2026 +0100 x86/segment: Use MOVL when reading segment registers Use MOVL when reading segment registers to avoid 0x66 operand-size override insn prefix. The segment value is always 16-bit and gets zero-extended to the full 32-bit size. Example: 4e4: 66 8c c0 mov %es,%ax 4e7: 66 89 83 80 0b 00 00 mov %ax,0xb80(%rbx) 4e4: 8c c0 mov %es,%eax 4e6: 66 89 83 80 0b 00 00 mov %ax,0xb80(%rbx) Also, use the %k0 modifier which generates the SImode (signed integer) register name for the target register. [ bp: Extend and clarify commit message. ] Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Reviewed-by: H. Peter Anvin (Intel) Tested-by: Michael Kelley Link: https://patch.msgid.link/20260105090422.6243-1-ubizjak@gmail.com commit 77b9c4a438fc66e2ab004c411056b3fb71a54f2c Merge: 4515ec4ad58a37 931420a2fc3638 Author: Paolo Abeni Date: Tue Jan 20 11:58:52 2026 +0100 Merge branch 'netkit-support-for-io_uring-zero-copy-and-af_xdp' Daniel Borkmann says: ==================== netkit: Support for io_uring zero-copy and AF_XDP Containers use virtual netdevs to route traffic from a physical netdev in the host namespace. They do not have access to the physical netdev in the host and thus can't use memory providers or AF_XDP that require reconfiguring/restarting queues in the physical netdev. This patchset adds the concept of queue leasing to virtual netdevs that allow containers to use memory providers and AF_XDP at native speed. Leased queues are bound to a real queue in a physical netdev and act as a proxy. Memory providers and AF_XDP operations take an ifindex and queue id, so containers would pass in an ifindex for a virtual netdev and a queue id of a leased queue, which then gets proxied to the underlying real queue. We have implemented support for this concept in netkit and tested the latter against Nvidia ConnectX-6 (mlx5) as well as Broadcom BCM957504 (bnxt_en) 100G NICs. For more details see the individual patches. ==================== Link: https://patch.msgid.link/20260115082603.219152-1-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 931420a2fc363817c92990fa14eb1bdec024ce04 Author: David Wei Date: Thu Jan 15 09:26:03 2026 +0100 selftests/net: Add netkit container tests Add two tests using NetDrvContEnv. One basic test that sets up a netkit pair, with one end in a netns. Use LOCAL_PREFIX_V6 and nk_forward BPF program to ping from a remote host to the netkit in netns. Second is a selftest for netkit queue leasing, using io_uring zero copy test binary inside of a netns with netkit. This checks that memory providers can be bound against virtual queues in a netkit within a netns that are leasing from a physical netdev in the default netns. Signed-off-by: David Wei Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-17-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit ab771c938d9a57d510bb70c565c9388b10494090 Author: David Wei Date: Thu Jan 15 09:26:02 2026 +0100 selftests/net: Make NetDrvContEnv support queue leasing Add a new parameter `lease` to NetDrvContEnv that sets up queue leasing in the env. The NETIF also has some ethtool parameters changed to support memory provider tests. This is needed in NetDrvContEnv rather than individual test cases since the cleanup to restore NETIF can't be done, until the netns in the env is gone. Signed-off-by: David Wei Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-16-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 6be87fbb27763c2999e1c69bbec1f3a63cf05422 Author: David Wei Date: Thu Jan 15 09:26:01 2026 +0100 selftests/net: Add env for container based tests Add an env NetDrvContEnv for container based selftests. This automates the setup of a netns, netkit pair with one inside the netns, and a BPF program that forwards skbs from the NETIF host inside the container. Currently only netkit is used, but other virtual netdevs e.g. veth can be used too. Expect netkit container datapath selftests to have a publicly routable IP prefix to assign to netkit in a container, such that packets will land on eth0. The BPF skb forward program will then forward such packets from the host netns to the container netns. Signed-off-by: David Wei Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-15-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 61d99ce3dfc2f1ba5bf713093bb3a5faf5ebc2dc Author: David Wei Date: Thu Jan 15 09:26:00 2026 +0100 selftests/net: Add bpf skb forwarding program Add nk_forward.bpf.c, a BPF program that forwards skbs matching some IPv6 prefix received on eth0 ifindex to a specified netkit ifindex. This will be needed by netkit container tests. Signed-off-by: David Wei Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-14-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 920da3634194cde889005f67ccd7f873425a60a5 Author: Daniel Borkmann Date: Thu Jan 15 09:25:59 2026 +0100 netkit: Add xsk support for af_xdp applications Enable support for AF_XDP applications to operate on a netkit device. The goal is that AF_XDP applications can natively consume AF_XDP from network namespaces. The use-case from Cilium side is to support Kubernetes KubeVirt VMs through QEMU's AF_XDP backend. KubeVirt is a virtual machine management add-on for Kubernetes which aims to provide a common ground for virtualization. KubeVirt spawns the VMs inside Kubernetes Pods which reside in their own network namespace just like regular Pods. Raw QEMU AF_XDP backend example with eth0 being a physical device with 16 queues where netkit is bound to the last queue (for multi-queue RSS context can be used if supported by the driver): # ethtool -X eth0 start 0 equal 15 # ethtool -X eth0 start 15 equal 1 context new # ethtool --config-ntuple eth0 flow-type ether \ src 00:00:00:00:00:00 \ src-mask ff:ff:ff:ff:ff:ff \ dst $mac dst-mask 00:00:00:00:00:00 \ proto 0 proto-mask 0xffff action 15 [ ... setup BPF/XDP prog on eth0 to steer into shared xsk map ... ] # ip netns add foo # ip link add numrxqueues 2 nk type netkit single # ./pyynl/cli.py --spec ~/netlink/specs/netdev.yaml \ --do queue-create \ --json "{"ifindex": $(ifindex nk), "type": "rx", \ "lease": { "ifindex": $(ifindex eth0), \ "queue": { "type": "rx", "id": 15 } } }" {'id': 1} # ip link set nk netns foo # ip netns exec foo ip link set lo up # ip netns exec foo ip link set nk up # ip netns exec foo qemu-system-x86_64 \ -kernel $kernel \ -drive file=${image_name},index=0,media=disk,format=raw \ -append "root=/dev/sda rw console=ttyS0" \ -cpu host \ -m $memory \ -enable-kvm \ -device virtio-net-pci,netdev=net0,mac=$mac \ -netdev af-xdp,ifname=nk,id=net0,mode=native,queues=1,start-queue=1,inhibit=on,map-path=$dir/xsks_map \ -nographic We have tested the above against a dual-port Nvidia ConnectX-6 (mlx5) 100G NIC with successful network connectivity out of QEMU. An earlier iteration of this work was presented at LSF/MM/BPF [0] and more recently at LPC [1]. For getting to a first starting point to connect all things with KubeVirt, bind mounting the xsk map from Cilium into the VM launcher Pod which acts as a regular Kubernetes Pod while not perfect, is not a big problem given its out of reach from the application sitting inside the VM (and some of the control plane aspects are baked in the launcher Pod already), so the isolation barrier is still the VM. Eventually the goal is to have a XDP/XSK redirect extension where there is no need to have the xsk map, and the BPF program can just derive the target xsk through the queue where traffic was received on. The exposure through netkit is because Cilium should not act as a proxy handing out xsk sockets. Existing applications expect a netdev from kernel side and should not need to rewrite just to implement against a CNI's protocol. Also, all the memory should not be accounted against Cilium but rather the application Pod itself which is consuming AF_XDP. Further, on up/downgrades we expect the data plane to being completely decoupled from the control plane; if Cilium would own the sockets that would be disruptive. Another use-case which opens up and is regularly asked from users would be to have DPDK applications on top of AF_XDP in regular Kubernetes Pods. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Link: https://bpfconf.ebpf.io/bpfconf2025/bpfconf2025_material/lsfmmbpf_2025_netkit_borkmann.pdf [0] Link: https://lpc.events/event/19/contributions/2275/ [1] Link: https://patch.msgid.link/20260115082603.219152-13-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit eef51113f8afd35c69cbf3702e0ecd55263f2416 Author: Daniel Borkmann Date: Thu Jan 15 09:25:58 2026 +0100 netkit: Add netkit notifier to check for unregistering devices Add a netdevice notifier in netkit to watch for NETDEV_UNREGISTER events. If the target device is indeed NETREG_UNREGISTERING and previously leased a queue to a netkit device, then collect the related netkit devices and batch-unregister_netdevice_many() them. If this would not be done, then the netkit device would hold a reference on the physical device preventing it from going away. However, in case of both io_uring zero-copy as well as AF_XDP this situation is handled gracefully and the allocated resources are torn down. In the case where mentioned infra is used through netkit, the applications have a reference on netkit, and netkit in turn holds a reference on the physical device. In order to have netkit release the reference on the physical device, we need such watcher to then unregister the netkit ones. This is generally quite similar to the dependency handling in case of tunnels (e.g. vxlan bound to a underlying netdev) where the tunnel device gets removed along with the physical device. # ip a [...] 4: enp10s0f0np0: mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether e8:eb:d3:a3:43:f6 brd ff:ff:ff:ff:ff:ff inet 10.0.0.2/24 scope global enp10s0f0np0 valid_lft forever preferred_lft forever [...] 8: nk@NONE: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff [...] # rmmod mlx5_ib # rmmod mlx5_core [ 309.261822] mlx5_core 0000:0a:00.0 mlx5_0: Port: 1 Link DOWN [ 344.235236] mlx5_core 0000:0a:00.1: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) [ 344.246948] mlx5_core 0000:0a:00.1: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) [ 344.463754] mlx5_core 0000:0a:00.1: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) [ 344.770155] mlx5_core 0000:0a:00.1: E-Switch: cleanup [ 345.345709] mlx5_core 0000:0a:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) [ 345.357524] mlx5_core 0000:0a:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) [ 350.995989] mlx5_core 0000:0a:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) [ 351.574396] mlx5_core 0000:0a:00.0: E-Switch: cleanup # ip a [...] [ both enp10s0f0np0 and nk gone ] [...] Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-12-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit b5ef109d22d4c5d4400488953fbd81b9725b4417 Author: David Wei Date: Thu Jan 15 09:25:57 2026 +0100 netkit: Implement rtnl_link_ops->alloc and ndo_queue_create Implement rtnl_link_ops->alloc that allows the number of rx queues to be set when netkit is created. By default, netkit has only a single rxq (and single txq). The number of queues is deliberately not allowed to be changed via ethtool -L and is fixed for the lifetime of a netkit instance. For netkit device creation, numrxqueues with larger than one rxq can be specified. These rxqs are leasable to real rxqs in physical netdevs: ip link add type netkit peer numrxqueues 64 # for device pair ip link add numrxqueues 64 type netkit single # for single device The limit of numrxqueues for netkit is currently set to 1024, which allows leasing multiple real rxqs from physical netdevs. The implementation of ndo_queue_create() adds a new rxq during the queue lease operation. We allow to create queues either in single device mode or for the case of dual device mode for the netkit peer device which gets placed into the target network namespace. For dual device mode the lease against the primary device does not make sense for the targeted use cases, and therefore gets rejected. We also need to add a lockdep class for netkit, such that lockdep does not trip over us, similarly done as in commit 0bef512012b1 ("net: add netdev_lockdep_set_classes() to virtual drivers"). This is also the last missing bit to netkit for supporting io_uring with zero-copy mode [0]. Up until this point it was not possible to consume the latter out of containers or Kubernetes Pods where applications are in their own network namespace. io_uring example with eth0 being a physical device with 16 queues where netkit is bound to the last queue, iou-zcrx.c is binary from selftests. Flow steering to that queue is based on the service VIP:port of the server utilizing io_uring: # ethtool -X eth0 start 0 equal 15 # ethtool -X eth0 start 15 equal 1 context new # ethtool --config-ntuple eth0 flow-type tcp4 dst-ip 1.2.3.4 dst-port 5000 action 15 # ip netns add foo # ip link add type netkit peer numrxqueues 2 # ./pyynl/cli.py --spec ~/netlink/specs/netdev.yaml \ --do queue-create \ --json "{"ifindex": $(ifindex nk0), "type": "rx", \ "lease": { "ifindex": $(ifindex eth0), \ "queue": { "type": "rx", "id": 15 } } }" {'id': 1} # ip link set nk0 netns foo # ip link set nk1 up # ip netns exec foo ip link set lo up # ip netns exec foo ip link set nk0 up # ip netns exec foo ip addr add 1.2.3.4/32 dev nk0 [ ... setup routing etc to get external traffic into the netns ... ] # ip netns exec foo ./iou-zcrx -s -p 5000 -i nk0 -q 1 Remote io_uring client: # ./iou-zcrx -c -h 1.2.3.4 -p 5000 -l 12840 -z 65536 We have tested the above against a Broadcom BCM957504 (bnxt_en) 100G NIC, supporting TCP header/data split. Similarly, this also works for devmem which we tested using ncdevmem: # ip netns exec foo ./ncdevmem -s 1.2.3.4 -l -p 5000 -f nk0 -t 1 -q 1 And on the remote client: # ./ncdevmem -s 1.2.3.4 -p 5000 -f eth0 For Cilium, the plan is to open up support for the various memory providers for regular Kubernetes Pods when Cilium is configured with netkit datapath mode. Signed-off-by: David Wei Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Link: https://kernel-recipes.org/en/2024/schedule/efficient-zero-copy-networking-using-io_uring [0] Link: https://patch.msgid.link/20260115082603.219152-11-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit b5c3fa4a0b16d4a7d0bd0e5626a13fec0024030a Author: Daniel Borkmann Date: Thu Jan 15 09:25:56 2026 +0100 netkit: Add single device mode for netkit Add a single device mode for netkit instead of netkit pairs. The primary target for the paired devices is to connect network namespaces, of course, and support has been implemented in projects like Cilium [0]. For the rxq leasing the plan is to support two main scenarios related to single device mode: * For the use-case of io_uring zero-copy, the control plane can either set up a netkit pair where the peer device can perform rxq leasing which is then tied to the lifetime of the peer device, or the control plane can use a regular netkit pair to connect the hostns to a Pod/container and dynamically add/remove rxq leasing through a single device without having to interrupt the device pair. In the case of io_uring, the memory pool is used as skb non-linear pages, and thus the skb will go its way through the regular stack into netkit. Things like the netkit policy when no BPF is attached or skb scrubbing etc apply as-is in case the paired devices are used, or if the backend memory is tied to the single device and traffic goes through a paired device. * For the use-case of AF_XDP, the control plane needs to use netkit in the single device mode. The single device mode currently enforces only a pass policy when no BPF is attached, and does not yet support BPF link attachments for AF_XDP. skbs sent to that device get dropped at the moment. Given AF_XDP operates at a lower layer of the stack tying this to the netkit pair did not make sense. In future, the plan is to allow BPF at the XDP layer which can: i) process traffic coming from the AF_XDP application (e.g. QEMU with AF_XDP backend) to filter egress traffic or to push selected egress traffic up to the single netkit device to the local stack (e.g. DHCP requests), and ii) vice-versa skbs sent to the single netkit into the AF_XDP application (e.g. DHCP replies). Also, the control-plane can dynamically manage rxq leasing for the single netkit device without having to interrupt (e.g. down/up cycle) the main netkit pair for the Pod which has traffic going in and out. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Jordan Rife Reviewed-by: Nikolay Aleksandrov Link: https://docs.cilium.io/en/stable/operations/performance/tuning/#netkit-device-mode [0] Link: https://patch.msgid.link/20260115082603.219152-10-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 0073d2fd679d2219c2a123f79d6a2a6933a88ae0 Author: Daniel Borkmann Date: Thu Jan 15 09:25:55 2026 +0100 xsk: Proxy pool management for leased queues Similarly to the net_mp_{open,close}_rxq handling for leased queues, proxy the xsk_{reg,clear}_pool_at_qid via netif_get_rx_queue_lease_locked such that in case a virtual netdev picked a leased rxq, the request gets through to the real rxq in the physical netdev. The proxying is only relevant for queue_id < dev->real_num_rx_queues since right now its only supported for rxqs. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-9-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 1ecea95dd3b524e36b344dc41895ba5051653925 Author: Daniel Borkmann Date: Thu Jan 15 09:25:54 2026 +0100 xsk: Extend xsk_rcv_check validation xsk_rcv_check tests for inbound packets to see whether they match the bound AF_XDP socket. Refactor the test into a small helper xsk_dev_queue_valid and move the validation against xs->dev and xs->queue_id there. The fast-path case stays in place and allows for quick return in xsk_dev_queue_valid. If it fails, the validation is extended to check whether the AF_XDP socket is bound against a leased queue, and if the case then the test is redone. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-8-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 804bf334d08aeceda1c39f4e26d7eda802b63a33 Author: David Wei Date: Thu Jan 15 09:25:53 2026 +0100 net: Proxy netdev_queue_get_dma_dev for leased queues Extend netdev_queue_get_dma_dev to return the physical device of the real rxq for DMA in case the queue was leased. This allows memory providers like io_uring zero-copy or devmem to bind to the physically leased rxq via virtual devices such as netkit. Signed-off-by: David Wei Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-7-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 0caa9a8ddec3bf87bffb0eb99635068ddddce35d Author: David Wei Date: Thu Jan 15 09:25:52 2026 +0100 net: Proxy net_mp_{open,close}_rxq for leased queues When a process in a container wants to setup a memory provider, it will use the virtual netdev and a leased rxq, and call net_mp_{open,close}_rxq to try and restart the queue. At this point, proxy the queue restart on the real rxq in the physical netdev. For memory providers (io_uring zero-copy rx and devmem), it causes the real rxq in the physical netdev to be filled from a memory provider that has DMA mapped memory from a process within a container. Signed-off-by: David Wei Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Reviewed-by: Nikolay Aleksandrov Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260115082603.219152-6-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit ff8889ff9107f01346ba0d2e580ecadfa5fac5c5 Author: Daniel Borkmann Date: Thu Jan 15 09:25:51 2026 +0100 net, ethtool: Disallow leased real rxqs to be resized Similar to AF_XDP, do not allow queues in a physical netdev to be resized by ethtool -L when they are leased. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260115082603.219152-5-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 9e2103f36110b50fc30be333fe2b43522c2dfa2a Author: Daniel Borkmann Date: Thu Jan 15 09:25:50 2026 +0100 net: Add lease info to queue-get response Populate nested lease info to the queue-get response that returns the ifindex, queue id with type and optionally netns id if the device resides in a different netns. Example with ynl client: # ip a [...] 4: enp10s0f0np0: mtu 1500 xdp/id:24 qdisc mq state UP group default qlen 1000 link/ether e8:eb:d3:a3:43:f6 brd ff:ff:ff:ff:ff:ff inet 10.0.0.2/24 scope global enp10s0f0np0 valid_lft forever preferred_lft forever inet6 fe80::eaeb:d3ff:fea3:43f6/64 scope link proto kernel_ll valid_lft forever preferred_lft forever [...] # ethtool -i enp10s0f0np0 driver: mlx5_core [...] # ./pyynl/cli.py \ --spec ~/netlink/specs/netdev.yaml \ --do queue-get \ --json '{"ifindex": 4, "id": 15, "type": "rx"}' {'id': 15, 'ifindex': 4, 'lease': {'ifindex': 8, 'netns-id': 0, 'queue': {'id': 1, 'type': 'rx'}}, 'napi-id': 8227, 'type': 'rx', 'xsk': {}} # ip netns list foo (id: 0) # ip netns exec foo ip a [...] 8: nk@NONE: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff inet6 fe80::200:ff:fe00:0/64 scope link proto kernel_ll valid_lft forever preferred_lft forever [...] # ip netns exec foo ethtool -i nk driver: netkit [...] # ip netns exec foo ls /sys/class/net/nk/queues/ rx-0 rx-1 tx-0 # ip netns exec foo ./pyynl/cli.py \ --spec ~/netlink/specs/netdev.yaml \ --do queue-get \ --json '{"ifindex": 8, "id": 1, "type": "rx"}' {'id': 1, 'ifindex': 8, 'type': 'rx'} Note that the caller of netdev_nl_queue_fill_one() holds the netdevice lock. For the queue-get we do not lock both devices. When queues get {un,}leased, both devices are locked, thus if __netif_get_rx_queue_peer() returns true, the peer pointer points to a valid device. The netns-id is fetched via peernet2id_alloc() similarly as done in OVS. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260115082603.219152-4-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit 31127deddef4a13628202a7bfef912e6c1ba3e57 Author: Daniel Borkmann Date: Thu Jan 15 09:25:49 2026 +0100 net: Implement netdev_nl_queue_create_doit Implement netdev_nl_queue_create_doit which creates a new rx queue in a virtual netdev and then leases it to a rx queue in a physical netdev. Example with ynl client: # ./pyynl/cli.py \ --spec ~/netlink/specs/netdev.yaml \ --do queue-create \ --json '{"ifindex": 8, "type": "rx", "lease": {"ifindex": 4, "queue": {"type": "rx", "id": 15}}}' {'id': 1} Note that the netdevice locking order is always from the virtual to the physical device. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-3-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit a5546e18f77c0cb15d434bf5b92647687fe483e3 Author: Daniel Borkmann Date: Thu Jan 15 09:25:48 2026 +0100 net: Add queue-create operation Add a ynl netdev family operation called queue-create that creates a new queue on a netdevice: name: queue-create attribute-set: queue flags: [admin-perm] do: request: attributes: - ifindex - type - lease reply: &queue-create-op attributes: - id This is a generic operation such that it can be extended for various use cases in future. Right now it is mandatory to specify ifindex, the queue type which is enforced to rx and a lease. The newly created queue id is returned to the caller. A queue from a virtual device can have a lease which refers to another queue from a physical device. This is useful for memory providers and AF_XDP operations which take an ifindex and queue id to allow applications to bind against virtual devices in containers. The lease couples both queues together and allows to proxy the operations from a virtual device in a container to the physical device. In future, the nested lease attribute can be lifted and made optional for other use-cases such as dynamic queue creation for physical netdevs. The lack of lease and the specification of the physical device as an ifindex will imply that we need a real queue to be allocated. Similarly, the queue type enforcement to rx can then be lifted as well to support tx. An early implementation had only driver-specific integration [0], but in order for other virtual devices to reuse, it makes sense to have this as a generic API in core net. For leasing queues, the virtual netdev must have real_num_rx_queue less than num_rx_queues at the time of calling queue-create. The queue-type must be rx as only rx queues are supported for leasing for now. We also enforce that the queue-create ifindex must point to a virtual device, and that the nested lease attribute's ifindex must point to a physical device. The nested lease attribute set contains a netns-id attribute which is currently only intended for dumping as part of the queue-get operation. Also, it is modeled as an s32 type similarly as done elsewhere in the stack. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Link: https://bpfconf.ebpf.io/bpfconf2025/bpfconf2025_material/lsfmmbpf_2025_netkit_borkmann.pdf [0] Acked-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115082603.219152-2-daniel@iogearbox.net Signed-off-by: Paolo Abeni commit af05e558988ed004a20fc4de7d0f80cfbba663f0 Author: Borislav Petkov (AMD) Date: Mon Jan 12 12:37:49 2026 +0100 x86/sev: Use kfree_sensitive() when freeing a SNP message descriptor Use the proper helper instead of an open-coded variant. Closes: https://lore.kernel.org/r/202512202235.WHPQkLZu-lkp@intel.com Reported-by: kernel test robot Reported-by: Julia Lawall Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20260112114147.GBaWTd-8HSy_Xp4S3X@fat_crate.local commit 81af99cbd9e4f238011af811d544fff75641fc25 Author: Ludovic Desroches Date: Thu Dec 18 14:26:06 2025 +0100 drm/atmel-hlcdc: destroy properly the plane state in the reset callback If there is a plane state to destroy when doing a plane reset, destroy it using the atmel_hlcdc_plane_destroy_state() function. So we call __drm_atomic_helper_plane_destroy_state() and avoid code duplication. Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-8-df837aba878f@microchip.com Signed-off-by: Manikandan Muralidharan commit 4bad57c21bb3569efde4dc81915b53f9a036678c Author: Ludovic Desroches Date: Thu Dec 18 14:26:05 2025 +0100 drm/atmel-hlcdc: use drmm_universal_plane_alloc() Use the drmm_universal_plane_alloc() helper to simplify the code. Using it, we no longer need to register the destroy callback for drm_plane_funcs. Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-7-df837aba878f@microchip.com Signed-off-by: Manikandan Muralidharan commit d8a29980eb3dd4efff895317c74b4cce9636e14d Author: Ludovic Desroches Date: Thu Dec 18 14:26:04 2025 +0100 drm/atmel-hlcdc: use drmm_crtc_alloc_with_planes() Use drmm_crtc_alloc_with_planes() to simplify the code. As we no longer have to take care about cleanup, we can get rid of atmel_hlcdc_crtc_destroy(). Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-6-df837aba878f@microchip.com Signed-off-by: Manikandan Muralidharan commit a1018063f7553cdd380f153441905d98dfd0a9e5 Author: Ludovic Desroches Date: Thu Dec 18 14:26:03 2025 +0100 drm/atmel-hlcdc: use devm_drm_of_get_bridge() Get rid of drm_of_find_panel_or_bridge() as it is deprecated and use devm_drm_of_get_bridge() instead. Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-5-df837aba878f@microchip.com Signed-off-by: Manikandan Muralidharan commit 07972c070f4879a621b3194662b90ff66e25d666 Author: Ludovic Desroches Date: Thu Dec 18 14:26:02 2025 +0100 drm/atmel-hlcdc: use drm_crtc_mask() Prefer using the drm_crtc_mask() helper instead of a raw value. It involves reordering components initialization as we need a valid crtc. Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-4-df837aba878f@microchip.com Signed-off-by: Manikandan Muralidharan commit 227ef8cf93a5328642d844d0f61dbd941e90a2a9 Author: Ludovic Desroches Date: Thu Dec 18 14:26:01 2025 +0100 drm/atmel-hlcdc: use drmm_simple_encoder_alloc() Simplify the code using drmm_simple_encoder_alloc to handle allocation and initialization at once. Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-3-df837aba878f@microchip.com Signed-off-by: Manikandan Muralidharan commit 87cac7a5f99e7c7ec9687e3f1e61138da41683b7 Author: Ludovic Desroches Date: Thu Dec 18 14:26:00 2025 +0100 drm/atmel-hlcdc: add support for the nomodeset kernel parameter According to Documentation/admin-guide/kernel-parameters.txt, this parameter can be used to disable kernel modesetting. Signed-off-by: Ludovic Desroches Reviewed-by: Dharma Balasubiramani Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-2-df837aba878f@microchip.com Signed-off-by: Manikandan Muralidharan commit 950cba9870f98a6db932f6b914f2d4786c87236c Author: Ludovic Desroches Date: Thu Dec 18 14:25:59 2025 +0100 drm/atmel-hlcdc: use managed device resources for the display controller Take benefit of managed device resources to reduce the risk of memory leak and to simplify error paths. Signed-off-by: Ludovic Desroches Reviewed-by: Manikandan Muralidharan Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-1-df837aba878f@microchip.com Signed-off-by: Manikandan Muralidharan commit ce76a267341cb306016beedb24a205e892613716 Author: Chris Morgan Date: Tue Jan 13 13:57:18 2026 -0600 drm/panel: jd9365da: Support for Anbernic RG-DS Panel Add support for both panels used in the Anbernic RG-DS. These panels are physically identical and differ only with a single instruction in the init sequence. The init sequence commands suggest it uses an identical controller as the jd9365da. Additionally, allow specifying per-panel dsi->mode_flags that can override the default values. Co-developed-by: Alexander Weinzerl Signed-off-by: Alexander Weinzerl Signed-off-by: Chris Morgan Reviewed-by: Neil Armstrong Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260113195721.151205-4-macroalpha82@gmail.com commit b83a3a48edd26da7db2414797c7a428ba8b5c5e5 Author: Chris Morgan Date: Tue Jan 13 13:57:17 2026 -0600 dt-bindings: display: panel: Add compatible for Anbernic RG-DS The Anbernic RG-DS uses two (mostly) identical panels as a top and bottom panel which appear to use the same controller as the Jadard JD9365DA-H3. The panels differ with a parameter defined differently in the init sequence. Signed-off-by: Chris Morgan Acked-by: Rob Herring (Arm) Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260113195721.151205-3-macroalpha82@gmail.com commit 388df23fda2db75abe988015a1dd681a43fcdf94 Author: Chris Morgan Date: Tue Jan 13 13:57:16 2026 -0600 drm: panel: jd9365da: Use gpiod_set_value_cansleep() Change instances of gpiod_set_value() to gpiod_set_value_cansleep(). Uses of gpiod_set_value() generates warnings when used in instances where desc->gdev->can_sleep is true. Signed-off-by: Chris Morgan Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260113195721.151205-2-macroalpha82@gmail.com commit 88b14b9279d824dd84bdda20c7b2fdb4b285dd25 Author: Andy Yan Date: Sat Jan 17 10:07:30 2026 +0800 drm/rockchip: vop2: Add mode valid callback for crtc The different Video Ports support different maximum resolutions. Reject resolutions that are not supported by a specific VP. Only the output width is checked because the hardware itself does not have a hard output height limit. Filter the mode that can't output by the VP/crtc. Signed-off-by: Andy Yan Reviewed-by: Sebastian Reichel Tested-by: Sebastian Reichel # Sige5 Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260117020738.294825-1-andyshrk@163.com commit aa156ad92523b21b12bfa5bb261d6affb4b1597f Author: Cristian Ciocaltea Date: Thu Jan 15 18:24:44 2026 +0200 drm/rockchip: dw_hdmi_qp: Optimize RK3588 HPD interrupt handling The threaded interrupt handler on RK3588 checks HPD IRQ status before deciding to continue with interrupt clearing and unmasking. However, this is not really necessary, since the hard interrupt handler already performs the very same verification before waking the handler thread. Get rid of the redundant verification of the HPD interrupt status in the threaded interrupt handler. Signed-off-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260115-dw-hdmi-qp-hpd-v1-2-e59c166eaa65@collabora.com commit 5f7be8afc40c5ccf1be0410514703e50a49532c0 Author: Cristian Ciocaltea Date: Thu Jan 15 18:24:43 2026 +0200 drm/rockchip: dw_hdmi_qp: Fix RK3576 HPD interrupt handling The threaded interrupt handler on RK3576 checks HPD IRQ status before deciding to continue with interrupt clearing and unmasking. This is not only redundant, since a similar verification has been already performed by the hard IRQ handler before masking the interrupt, but is also error prone, because it might happen that hardware clears the status register right after the masking operation completes, and before the threaded handler reads its value. The consequence is that HPD IRQ gets never unmasked, which breaks hotplug detection until reloading the driver or rebooting the system. Drop the unnecessary verification of the HPD interrupt status from the threaded interrupt handler. Fixes: 36439120efbd ("drm/rockchip: dw_hdmi_qp: Add basic RK3576 HDMI output support") Signed-off-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260115-dw-hdmi-qp-hpd-v1-1-e59c166eaa65@collabora.com commit c259cd7ea3c9ad369c473ba2385d82e3432088b1 Author: Danilo Krummrich Date: Mon Jan 19 20:51:15 2026 +0100 revocable: fix missing module license and description Fix missing MODULE_LICENSE() and MODULE_DESCRIPTION() in the revocable Kunit test module. Reported-by: Mark Brown Closes: https://lore.kernel.org/all/aW6GNvuQVNCUcoy-@sirena.org.uk/ Fixes: cd7693419bb5 ("revocable: Add Kunit test cases") Reviewed-by: Tzung-Bi Shih Link: https://patch.msgid.link/20260119195141.12843-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit e546c69ac54e907d0c33bc1fde55689db301981f Author: Johan Jonker Date: Fri Jan 16 22:05:24 2026 +0100 ARM: dts: rockchip: rk3036: remove mshc aliases The use of mshc aliases is deprecated for some while, so remove them from the rk3036.dtsi file. Signed-off-by: Johan Jonker Link: https://patch.msgid.link/c6feab79-5b73-413b-a94f-9d1b2fa6df43@gmail.com Signed-off-by: Heiko Stuebner commit 4515ec4ad58a37e70a9e1256c0b993958c9b7497 Merge: c5e7b1d1cc8a6c cb36f89b1001ef Author: Paolo Abeni Date: Tue Jan 20 10:34:34 2026 +0100 Merge branch 'net-hinic3-pf-initialization' Fan Gong says: ==================== net: hinic3: PF initialization This is [1/3] part of hinic3 Ethernet driver second submission. With this patch hinic3 becomes a complete Ethernet driver with pf and vf. The driver parts contained in this patch: Add support for PF framework based on the VF code. Add PF management interfaces to communicate with HW. Add 8 netdev ops to configure NIC features. Support mac filter to unicast and multicast. Add HW event handler to manage port and link status. V01: https://lore.kernel.org/netdev/cover.1760502478.git.zhuyikai1@h-partners.com/ V02: https://lore.kernel.org/netdev/cover.1760685059.git.zhuyikai1@h-partners.com/ V03: https://lore.kernel.org/netdev/cover.1761362580.git.zhuyikai1@h-partners.com/ V04: https://lore.kernel.org/netdev/cover.1761711549.git.zhuyikai1@h-partners.com/ V05: https://lore.kernel.org/netdev/cover.1762414088.git.zhuyikai1@h-partners.com/ V06: https://lore.kernel.org/netdev/cover.1762581665.git.zhuyikai1@h-partners.com/ V07: https://lore.kernel.org/netdev/cover.1763555878.git.zhuyikai1@h-partners.com/ V08: https://lore.kernel.org/netdev/cover.1767495881.git.zhuyikai1@h-partners.com/ V09: https://lore.kernel.org/netdev/cover.1767707500.git.zhuyikai1@h-partners.com/ V10: https://lore.kernel.org/netdev/cover.1767861236.git.zhuyikai1@h-partners.com/ ==================== Link: https://patch.msgid.link/cover.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit cb36f89b1001ef7a8b661c46c5bf91c35ec91cac Author: Fan Gong Date: Wed Jan 14 16:38:28 2026 +0800 hinic3: Add HW event handler Add HINIC3_INIT_UP flags to trace netdev open status. Add port module event handler. Add link status event type(FAULT, PCIE link down, heart lost, mgmt watchdog). Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/53a2b928136998f740d597bbd45ca1740b95538f.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit aebd95b00a3a62e90121d19198b88e4fa555dd38 Author: Fan Gong Date: Wed Jan 14 16:38:27 2026 +0800 hinic3: Add mac filter ops Add ops to support unicast and multicast to filter mac address in packets sending and receiving. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/9ea618ad5d6c404e222e9114e08e913a73177705.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit b35a6fd37a00dae184ca1a1f0a587cc1b167d86d Author: Fan Gong Date: Wed Jan 14 16:38:26 2026 +0800 hinic3: Add adaptive IRQ coalescing with DIM DIM offers a way to adjust the coalescing settings based on load. As hinic3 rx and tx share interrupts, we only need to base dim on rx stats. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/af96c20a836800a5972a09cdaf520029d976ad48.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 0f9e2d957474c19fb81a1182ee784fcbea73933c Author: Fan Gong Date: Wed Jan 14 16:38:25 2026 +0800 hinic3: Add .ndo_vlan_rx_add/kill_vid and .ndo_validate_addr Implement following callback function: .ndo_vlan_rx_add_vid .ndo_vlan_rx_kill_vid .ndo_validate_addr Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/70be187afcaa7b38981d114c088ffdc2cba0b4f1.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 2467a0466028f23c9ee173ddd160ef766a838e8d Author: Fan Gong Date: Wed Jan 14 16:38:24 2026 +0800 hinic3: Add .ndo_features_check As we cannot solve packets with multiple stacked vlan, so we use .ndo_features_check to check for these packets and return a smaller feature without offload features. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/3879b20b7ffa20106a3f8f56dbf2d5eb389f260a.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 721df7639c83f008dc15669268be315f2a205c34 Author: Fan Gong Date: Wed Jan 14 16:38:23 2026 +0800 hinic3: Add .ndo_set_features and .ndo_fix_features Implement following callback function: .ndo_set_features .ndo_fix_features The .ndo_set_features function includes five features: rx_csum, tso, lro, rx_cvlan and vlan_filter. Add these new features in netdev_feature_init. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/682734a08fde421413048bf70057dafe3cbe8497.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit f47872bed40ffee580ac772eefea94fab75b18d3 Author: Fan Gong Date: Wed Jan 14 16:38:22 2026 +0800 hinic3: Add .ndo_tx_timeout and .ndo_get_stats64 Implement following callback function: .ndo_tx_timeout .ndo_get_stats64 Use a work queue to trace tx_timeout callback and dump necessary debug information. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/ec34d2ff9b142e1e142e47700714533baf7e659c.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit a30cc9b277903bcbfb00cefdf51cc3dc71195f7d Author: Fan Gong Date: Wed Jan 14 16:38:21 2026 +0800 hinic3: Add PF management interfaces Add management and communication pathways between PF and HW. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/447e72b1c5f255ea5d79ecf96c8dac58011e604d.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit 53200a8605d70cc00c5b3526cc1116599c47359d Author: Fan Gong Date: Wed Jan 14 16:38:20 2026 +0800 hinic3: Add PF framework Add support for PF framework based on the VF code. Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/4796d6076bbad0f096eb10261ab3c7d989c5f7b7.1768375903.git.zhuyikai1@h-partners.com Signed-off-by: Paolo Abeni commit c0a652a3d1970caa0023632ae3a4ea21991d2f1a Author: Suravee Suthikulpanit Date: Tue Jan 20 01:48:43 2026 +0000 iommu/amd: Remove unused variable in amd_iommufd_viommu_destroy() This fixes warning reported by 0-DAY CI Kernel Test Service. Fixes: 757d2b1fdf5b ("iommu/amd: Introduce gDomID-to-hDomID Mapping and handle parent domain invalidation") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601190634.bl7Mjx5Q-lkp@intel.com/ Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit b18247f9dab735c9c2d63823d28edc9011e7a1ad Author: Jun Yan Date: Fri Jan 16 23:12:53 2026 +0800 arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro Remove the redundant enabling of the hdmi_sound node in the Pinebook Pro board dts file, because the HDMI output is unused on this device. [1][2] This change also eliminates the following kernel log warning, which is caused by the unenabled dependent node of hdmi_sound that ultimately results in the node's probe failure: platform hdmi-sound: deferred probe pending: asoc-simple-card: parse error [1] https://files.pine64.org/doc/PinebookPro/pinebookpro_v2.1_mainboard_schematic.pdf [2] https://files.pine64.org/doc/PinebookPro/pinebookpro_schematic_v21a_20220419.pdf Cc: stable@vger.kernel.org Fixes: 5a65505a69884 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") Signed-off-by: Jun Yan Reviewed-by: Peter Robinson Reviewed-by: Dragan Simic Link: https://patch.msgid.link/20260116151253.9223-1-jerrysteve1101@gmail.com Signed-off-by: Heiko Stuebner commit 6742b998166485558ccb0e89b5d5fd93c1aae3ca Author: Luis Garcia Date: Sun Jan 18 18:06:33 2026 -0700 arm64: dts: rockchip: Fix imx258 variant on pinephone pro imx258 had the driver updated a while back and it introduced two variants, the imx258 and imx258-pdaf. The pinephone pro is using the pdaf variant so this switches it to the correct variant and eliminates the pdaf pixels from the sensor output resulting in a much cleaner image. Signed-off-by: Luis Garcia Link: https://patch.msgid.link/20260119010633.3447863-1-git@luigi311.com Signed-off-by: Heiko Stuebner commit d1c0978a7e7864fcaa7cdd562a8f938afcd2ad39 Author: Dmitry Baryshkov Date: Mon Jan 19 22:08:09 2026 +0200 drm/tests: hdmi: fix build failure The commit ca59e33f5a1f ("drm/atomic: add max_size check to drm_property_replace_blob_from_id()") added a new parameter to drm_property_replace_blob_from_id(), however commit 7436a87db99d ("drm/tests: hdmi: check the infoframes behaviour") was based on the older tree and used the old number of params (with me failing to run kunit tests when applying). Fix the build error by specifying -1 as the max_size (as expected). Fixes: 7436a87db99d ("drm/tests: hdmi: check the infoframes behaviour") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601200306.dgF5deFm-lkp@intel.com/ Tested-by: Luca Ceresoli Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260119-fix-kunit-infoframe-v1-1-5f2f9b066594@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 1636348aab60830a1bc58a55916b218ce18712b5 Author: Rob Herring (Arm) Date: Tue Jan 13 14:13:38 2026 -0600 arm/arm64: dts: st: Drop unused .dtsi These .dtsi files are not included anywhere in the tree and can't be tested. Signed-off-by: Rob Herring (Arm) Reviewed-by: Alexandre Torgue Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20260113201340.36950-1-robh@kernel.org Signed-off-by: Alexandre Torgue commit 7006477e7ff01ce9be7014f25049372450a8e17b Author: Randy Dunlap Date: Tue Dec 30 10:14:29 2025 -0800 arm64: STM32: drop an undefined Kconfig symbol Drop ARM_SMC_MBOX since it is not defined or used anywhere else in the kernel source tree. Fixes: 9e4e24414cc6 ("arm64: introduce STM32 family on Armv8 architecture") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20251230181429.3429404-1-rdunlap@infradead.org Signed-off-by: Alexandre Torgue commit cd7d34dad61f3334fb5a0584fb8e7cfc88716082 Author: Krzysztof Kozlowski Date: Tue Dec 23 16:25:46 2025 +0100 arm64: dts: st: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' and before '{' characters. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251223152544.155637-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Alexandre Torgue commit f4051bcb0f96f235a04d595e497a11eaf1caf13c Author: Krzysztof Kozlowski Date: Tue Dec 23 16:25:45 2025 +0100 arm64: dts: st: Use hyphen in node names DTS coding style prefers hyphens instead of underscores in the node names. Change should be safe, because node names are not considered an ABI. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251223152544.155637-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Alexandre Torgue commit 8648e9b18e3ef8a2960d2cc857b961333b52b183 Author: Alain Volmat Date: Fri Dec 19 16:58:08 2025 +0100 arm64: dts: st: add power-domain of dcmipp in stm32mp231.dtsi Add the power-domain property in the dcmipp node of stm32mp231.dtsi Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251219-stm32-mp2x-dcmipp-csi-power-domain-v1-6-a6edb2aa8154@foss.st.com Signed-off-by: Alexandre Torgue commit f056d9a424c3ce50822659f06487d3272eca63db Author: Alain Volmat Date: Fri Dec 19 16:58:07 2025 +0100 arm64: dts: st: add power-domain of dcmipp in stm32mp251.dtsi Add the power-domain property in the dcmipp node of stm32mp251.dtsi Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251219-stm32-mp2x-dcmipp-csi-power-domain-v1-5-a6edb2aa8154@foss.st.com Signed-off-by: Alexandre Torgue commit 196369e3823ed10ff42364f580164640255f5a4c Author: Alain Volmat Date: Fri Dec 19 16:58:06 2025 +0100 dt-bindings: media: st: dcmipp: add 'power-domains' property STM32 DCMIPP may be in a power domain which is the case for the STM32MP2x based boards. Allow a single 'power-domains' entry for STM32 DCMIPP. Signed-off-by: Alain Volmat Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251219-stm32-mp2x-dcmipp-csi-power-domain-v1-4-a6edb2aa8154@foss.st.com Signed-off-by: Alexandre Torgue commit f447cf079dba72a655c2ad59a582447831b112aa Author: Alain Volmat Date: Fri Dec 19 16:58:05 2025 +0100 arm64: dts: st: add power-domain of csi in stm32mp231.dtsi Add the power-domain property in the csi node of stm32mp231.dtsi Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251219-stm32-mp2x-dcmipp-csi-power-domain-v1-3-a6edb2aa8154@foss.st.com Signed-off-by: Alexandre Torgue commit 886fd33507adfc121dde529f807eec5f76dc8653 Author: Alain Volmat Date: Fri Dec 19 16:58:04 2025 +0100 arm64: dts: st: add power-domain of csi in stm32mp251.dtsi Add the power-domain property in the csi node of stm32mp251.dtsi Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251219-stm32-mp2x-dcmipp-csi-power-domain-v1-2-a6edb2aa8154@foss.st.com Signed-off-by: Alexandre Torgue commit 9cdfabe2f2d1eed6e57d5b4fb18fb4719b6c565a Author: Alain Volmat Date: Fri Dec 19 16:58:03 2025 +0100 dt-bindings: media: st: csi: add 'power-domains' property STM32 CSI may be in a power domain which is the case for the STM32MP2x based boards. Allow a single 'power-domains' entry for STM32 CSI. Signed-off-by: Alain Volmat Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251219-stm32-mp2x-dcmipp-csi-power-domain-v1-1-a6edb2aa8154@foss.st.com Signed-off-by: Alexandre Torgue commit 75048a8de01bbf790b1da94a31b10665db42e065 Author: Alain Volmat Date: Thu Dec 18 11:48:30 2025 +0100 ARM: dts: stm32: add spi1 sleep state pinctrl on stm32mp157c-ev1 Add the sleep state of the spi1 instance on stm32mp157c-ev1. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251218-stm32-spi-enhancements-v2-4-3b69901ca9fe@foss.st.com Signed-off-by: Alexandre Torgue commit ba96d918d31432ae4bdbfe2ac5e7a90569d60981 Author: Clément Le Goffic Date: Tue Nov 18 16:08:03 2025 +0100 arm64: dts: st: add DDR channel to stm32mp257f-ev1 board Add 32bits DDR4 channel to the stm32mp257f-dk board. Signed-off-by: Clément Le Goffic Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20251118-b4-ddr-bindings-v9-7-a033ac5144da@gmail.com Signed-off-by: Alexandre Torgue commit ec6eac731f7bdfd54d44cb4c81706f85aa462d3e Author: Clément Le Goffic Date: Tue Nov 18 16:08:02 2025 +0100 arm64: dts: st: add LPDDR channel to stm32mp257f-dk board Add 32bits LPDDR4 channel to the stm32mp257f-dk board. Signed-off-by: Clément Le Goffic Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20251118-b4-ddr-bindings-v9-6-a033ac5144da@gmail.com Signed-off-by: Alexandre Torgue commit 5e697793315433094196362000deb8a0c7f552b8 Author: Alain Volmat Date: Mon Dec 15 13:19:44 2025 +0100 arm64: dts: st: enable i2c analog-filter in stm32mp231.dtsi By default enable the analog filter on all i2c instances on the stm32mp23x series. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251215-stm32-i2c-mp2x-dt-updates-v1-5-2738a05a7af8@foss.st.com Signed-off-by: Alexandre Torgue commit a81fcfd4487ba35de66e814933fe5df1c4a6b3e7 Author: Alain Volmat Date: Mon Dec 15 13:19:43 2025 +0100 arm64: dts: st: enable i2c analog-filter in stm32mp251.dtsi By default enable the analog filter on all i2c instances on the stm32mp25x series. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251215-stm32-i2c-mp2x-dt-updates-v1-4-2738a05a7af8@foss.st.com Signed-off-by: Alexandre Torgue commit d8d366cb6b6566e801da88c1ef44a3885b771610 Author: Alain Volmat Date: Mon Dec 15 13:19:42 2025 +0100 arm64: dts: st: add power-domains in all i2c of stm32mp231.dtsi Add the power-domains property in all i2c instances available on the stm32mp231.dtsi Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251215-stm32-i2c-mp2x-dt-updates-v1-3-2738a05a7af8@foss.st.com Signed-off-by: Alexandre Torgue commit 4dc102d8fb7cd5e9da134c88693ef95e99407a9c Author: Alain Volmat Date: Mon Dec 15 13:19:41 2025 +0100 arm64: dts: st: add power-domains in all i2c of stm32mp251.dtsi Add the power-domains property in all i2c instances available on the stm32mp251.dtsi Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251215-stm32-i2c-mp2x-dt-updates-v1-2-2738a05a7af8@foss.st.com Signed-off-by: Alexandre Torgue commit 974e24ed49e03586c101c414ba9cf9764de5863b Author: Alain Volmat Date: Mon Dec 15 13:19:40 2025 +0100 dt-bindings: i2c: st,stm32-i2c: add 'power-domains' property STM32 I2C may be in a power domain which is the case for the STM32MP2x based boards. Allow a single 'power-domains' entry for STM32 I2C. Signed-off-by: Alain Volmat Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251215-stm32-i2c-mp2x-dt-updates-v1-1-2738a05a7af8@foss.st.com Signed-off-by: Alexandre Torgue commit a5692f50392b4a947a3c328c6175b9abe1980129 Author: Alain Volmat Date: Mon Dec 15 13:26:22 2025 +0100 arm64: dts: st: add power-domains in all spi of stm32mp231.dtsi Add the power-domains property in all spi instances available on the stm32mp231.dtsi Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251215-stm32-spi-mp2x-dt-updates-v1-3-464a5fd20f13@foss.st.com Signed-off-by: Alexandre Torgue commit 6d280a351e280a1f4f4f1ddcb1b75360f18406aa Author: Alain Volmat Date: Mon Dec 15 13:26:21 2025 +0100 arm64: dts: st: add power-domains in all spi of stm32mp251.dtsi Add the power-domains property in all spi instances available on the stm32mp251.dtsi Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20251215-stm32-spi-mp2x-dt-updates-v1-2-464a5fd20f13@foss.st.com Signed-off-by: Alexandre Torgue commit 0dfff7c550f3aa29441d0a5e581161b9eaa58697 Author: Patrice Chotard Date: Wed Nov 12 16:48:16 2025 +0100 arm64: dts: st: Add boot-led for stm32mp2 ST boards Add options/u-boot/boot-led property to specify to U-Boot the LED which indicates a successful boot. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-13-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-14-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-15-50a3a9b339a8@foss.st.com Signed-off-by: Alexandre Torgue commit 6dad7fa8581e96321ec8a6a4f8160762466f539a Author: Baihan Li Date: Wed Dec 10 10:37:59 2025 +0800 drm/hisilicon/hibmc: Adding reset colorbar cfg in dp init. Add colorbar disable operation before reset chontroller, to make sure colorbar status is clear in the DP init, so if rmmod the driver and the previous colorbar configuration will not affect the next time insmod the driver. Fixes: 3c7623fb5bb6 ("drm/hisilicon/hibmc: Enable this hot plug detect of irq feature") Signed-off-by: Baihan Li Signed-off-by: Yongbang Shi Reviewed-by: Dmitry Baryshkov Reviewed-by: Tao Tian Link: https://patch.msgid.link/20251210023759.3944834-5-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov commit 0607052a6aee1e3d218a99fae70ba9f14b3b47ed Author: Baihan Li Date: Wed Dec 10 10:37:58 2025 +0800 drm/hisilicon/hibmc: fix no showing problem with loading hibmc manually When using command rmmod and insmod, there is no showing in second time insmoding. Because DP controller won't send HPD signals, if connection doesn't change or controller isn't reset. So add reset before unreset in hibmc_dp_hw_init(). And also need to move the HDCP cfg after DP controller de-resets, so that HDCP configuration takes effect. Fixes: 3c7623fb5bb6 ("drm/hisilicon/hibmc: Enable this hot plug detect of irq feature") Signed-off-by: Baihan Li Signed-off-by: Yongbang Shi Reviewed-by: Dmitry Baryshkov Reviewed-by: Tao Tian Link: https://patch.msgid.link/20251210023759.3944834-4-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov commit 607805abfb747b98f43aa57d6d9ba4caed4d106f Author: Baihan Li Date: Wed Dec 10 10:37:57 2025 +0800 drm/hisilicon/hibmc: add dp mode valid check If DP is connected, check the DP BW in mode_valid_ctx() to ensure that DP's link rate supports high-resolution data transmission. Fixes: 0ab6ea261c1f ("drm/hisilicon/hibmc: add dp module in hibmc") Signed-off-by: Baihan Li Signed-off-by: Yongbang Shi Reviewed-by: Dmitry Baryshkov Reviewed-by: Tao Tian Link: https://patch.msgid.link/20251210023759.3944834-3-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov commit 3906e7a3b26d683868704fe262db443207f392fe Author: Baihan Li Date: Wed Dec 10 10:37:56 2025 +0800 drm/hisilicon/hibmc: fix dp probabilistical detect errors after HPD irq The issue is that drm_connector_helper_detect_from_ddc() returns wrong status when plugging or unplugging the monitor, which may cause the link failed err.[0] Use HPD pin status in DP's detect_ctx() for real physical monitor in/out, and implement a complete DP detection including read DPCD, check if it's a branch device and its sink count for different situations. [0]: hibme-drm 0000:83:00.0: [drm] *ERROR* channel equalization failed 5 times hibme-drm 0000:83:00.0: [drm] *ERROR* channel equalization failed 5 times hibme-drm 0000:83:00.0: [drm] *ERROR* dp link training failed, ret: -16 hibmc-drm 0000:83:00.0: [drm] *ERROR* hibme dp mode set failed: -16 Fixes: 3c7623fb5bb6 ("drm/hisilicon/hibmc: Enable this hot plug detect of irq feature") Signed-off-by: Baihan Li Signed-off-by: Yongbang Shi Reviewed-by: Tao Tian Link: https://patch.msgid.link/20251210023759.3944834-2-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov commit 2e54d44665606b20e8c65be65b54d09616564321 Author: Patrice Chotard Date: Wed Nov 12 16:48:13 2025 +0100 ARM: dts: stm32: Add boot-led for stm32mp1 ST boards Add options/u-boot/boot-led property to specify to U-Boot the LED which indicates a successful boot. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-10-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-11-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-12-50a3a9b339a8@foss.st.com Signed-off-by: Alexandre Torgue commit 6ea52b6d8f33ae627f4dcf43b12b6e713a8b9331 Author: Deborah Brouwer Date: Mon Jan 19 12:26:45 2026 -0800 drm/tyr: use read_poll_timeout The L2 power-on sequence and soft reset in Tyr previously relied on fixed sleeps followed by a single register check, since polling helpers were not available in Rust at the time. Now that read_poll_timeout() is available, poll the relevant registers until the hardware reports readiness or a timeout is reached. This avoids unnecessary delays on start-up. Signed-off-by: Deborah Brouwer Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260119202645.362457-1-deborah.brouwer@collabora.com Signed-off-by: Alice Ryhl commit 793e8f7d52814e096f63373eca643d2672366a5a Author: Dirk Behme Date: Mon Jan 19 08:08:38 2026 +0100 drm/tyr: fix register name in error print The `..IRQ..` register is printed here. Not the `..INT..` one. Correct this. Cc: stable@vger.kernel.org Fixes: cf4fd52e3236 ("rust: drm: Introduce the Tyr driver for Arm Mali GPUs") Link: https://lore.kernel.org/rust-for-linux/A04F0357-896E-4ACC-BC0E-DEE8608CE518@collabora.com/ Signed-off-by: Dirk Behme Link: https://patch.msgid.link/20260119070838.3219739-1-dirk.behme@de.bosch.com [aliceryhl: update commit message prefix] [aliceryhl: add cc stable as per Miguel's suggestion] Signed-off-by: Alice Ryhl commit 5c6f60c2d2f83499e2fe5075e58ab11402059691 Author: Patrice Chotard Date: Thu Jan 8 16:52:35 2026 +0100 ARM: dts: stm32: Add boot-led for stm32 MCU ST boards Add options/u-boot/boot-led property to specify to U-Boot the LED which indicates a successful boot. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-1-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-2-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-3-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-4-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-5-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-6-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-7-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-8-50a3a9b339a8@foss.st.com Link: https://lore.kernel.org/r/20251112-upstream_add_boot-led_for_stm32_boards-v1-9-50a3a9b339a8@foss.st.com Signed-off-by: Alexandre Torgue commit 86e73410c8bc512d7153a589cb9e13ca7c91c4b0 Author: Patrice Chotard Date: Thu Nov 13 16:14:05 2025 +0100 arm64: dts: st: Add green and orange LED for stm32mp2 ST boards Add green and orange LED support on stm32mp235f-dk board. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-14-45090db9e2e5@foss.st.com Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-15-45090db9e2e5@foss.st.com Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-16-45090db9e2e5@foss.st.com Signed-off-by: Alexandre Torgue commit 55fb8865f35336b04b1b27efe6ce2bbafcc2c507 Author: Patrice Chotard Date: Thu Nov 13 16:14:04 2025 +0100 ARM: dts: stm32: Update LED node for stm32mp15xx-dkx board Add led-red node for stm32mp15xx-dkx, this LED is used as status LED in U-Boot. Update led-blue node by adding color property and replacing obsolete label property by function property. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-13-45090db9e2e5@foss.st.com Signed-off-by: Alexandre Torgue commit 7f2815c962039965b01de8e0c01dc6baa6726fbd Author: Patrice Chotard Date: Thu Nov 13 16:14:03 2025 +0100 ARM: dts: stm32: Add red LED for stm32mp157c-ed1 board Add led-red node for stm32mp157c-ed1. This LED is used as status LED in U-Boot. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-12-45090db9e2e5@foss.st.com Signed-off-by: Alexandre Torgue commit 31f0d9a486a8c7361692fd5e9d77e187720a5ece Author: Patrice Chotard Date: Thu Nov 13 16:14:02 2025 +0100 ARM: dts: stm32: Add red LED for stm32mp135f-dk board Add LED red node for stm32mp135f-dk. This LED is used as status lLED in U-Boot. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-11-45090db9e2e5@foss.st.com Signed-off-by: Alexandre Torgue commit 4d33caf1f0b7a859661f00b8ff909fb7fbcc02d7 Author: Patrice Chotard Date: Thu Nov 13 16:14:00 2025 +0100 ARM: dts: stm32: Add LED support for stm32h743i-eval Add green and red LEDs support for stm32h743-eval. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-9-45090db9e2e5@foss.st.com Signed-off-by: Alexandre Torgue commit f5f2fce8af2a7a8c5f6abd1ccee71998bcd83651 Author: Patrice Chotard Date: Thu Nov 13 16:13:59 2025 +0100 ARM: dts: stm32: Add LED support for stm32h743i-disco Add gpio led support for LED green,orange,red and blue in stm32h743i-disco.dts. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-8-45090db9e2e5@foss.st.com Signed-off-by: Alexandre Torgue commit e89ae0ec2fb8c29f351dd2790574f3fc22599875 Author: Patrice Chotard Date: Thu Nov 13 16:13:53 2025 +0100 ARM: dts: stm32: Update LED nodes for stm32 MCU boards Add function porperty for led nodes. Add LED color property for LED nodes. Reorder include dt-bindings. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-2-45090db9e2e5@foss.st.com Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-3-45090db9e2e5@foss.st.com Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-4-45090db9e2e5@foss.st.com Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-5-45090db9e2e5@foss.st.com Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-6-45090db9e2e5@foss.st.com Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-7-45090db9e2e5@foss.st.com Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-10-45090db9e2e5@foss.st.com Signed-off-by: Alexandre Torgue commit 069bb6f69afadcea3ac5e3e00af45e8519de380a Author: Andy Shevchenko Date: Wed Jan 14 11:05:55 2026 +0100 pinctrl: intel: platform: Add Nova Lake to the list of supported Intel Nova Lake is supported by the generic platform driver, so add it to the list of supported in Kconfig. Acked-by: Mika Westerberg Reviewed-by: Raag Jadav Signed-off-by: Andy Shevchenko commit 2afef25cc448ada7c9a7771fbfe4087a9e1a6d03 Author: Ricardo Pardini Date: Thu Jan 15 18:52:46 2026 +0100 arm64: dts: amlogic: add the type-c controller on Radxa Zero 2 The Radxa Zero2 has an FUSB302 controller on i2c3 at address 0x22 and INT# wired to GPIOA-13; include a minimal connector. Signed-off-by: Ricardo Pardini Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260115-arm64-dts-amlogic-radxa-zero2-additions-v2-1-948bb0479a45@pardini.net Signed-off-by: Neil Armstrong commit 436418ef5baa024b7b15dd730c36d651c6aaaf47 Author: Eric Neulight Date: Fri Jan 16 23:02:20 2026 -0500 arm64: dts: amlogic: meson-sm1-odroid: Eliminate Odroid HC4 power glitches during boot. Fix issue with Odroid HC4 (and all meson-sm1-odroid) DTS that causes regulator power to momentarily glitch OFF-ON during boot. Add regulator-boot-on to all regulator-fixed and regulator-gpio entries that (1) define a gpio AND (2) define regulator-always-on. U-boot powers on devices necessary for boot then hands off the DTB to the kernel. During probe, linux drivers/regulator/fixed.c and gpio-regulator.c both first set the regulator control gpio (that U-boot already turned ON) to default OFF before then setting it to the defined (ON) state. This glitches the power to the affected devices, unless regulator-boot-on is specified with it. In fact, U-boot has the same behavior. So, during reboot, a power glitch can actually happen twice: once when U-boot reads the DTB and probes the gpio and again when the kernel reads the DTB and probes the gpio. Problem this fixes: On the Odroid HC4, power to the SATA ports glitches during boot and causes some HDDs to do emergency head retract, which should be avoided. On the HC4, power glitches to the SD card, USB, SATA, and HDMI interfaces during boot. These are all boot devices. A power glitch can potentially cause a problem for any sensitive devices during boot. NOTE: This is not limited to just the HC4, likely an issue with ALL DTS with regulator-fixed or regulator-gpio entries that (1) define a gpio AND (2) define regulator-always-on. All such entries should also include regulator-boot-on in order to avoid potential power glitches. At worst, adding regulator-boot-on in such cases is harmless because of regulator-always-on, and, at best, it eliminates detrimental power glitches during boot. So, this is best-practice. Fixes: 164147f094ec5d0fc2c2098a888f4b50cf3096a7 ("arm64: dts: meson-sm1-odroid-hc4: add regulators controlled by GPIOH_8") Fixes: 45d736ab17b44257e15e75e0dba364139fdb0983 ("arm64: dts: meson-sm1-odroid: add 5v regulator gpio") Fixes: 1f80a5cf74a60997b92d2cde772edec093bec4d9 ("arm64: dts: meson-sm1-odroid: add missing enable gpio and supply for tf_io regulator") Fixes: 88d537bc92ca035e2a9920b0abc750dd62146520 ("arm64: dts: meson: convert meson-sm1-odroid-c4 to dtsi") Signed-off-by: Eric Neulight Reviewed-by: Neil Armstrong Acked-by: Viacheslav Bocharov Tested-by: Ricardo Pardini # on Odroid-HC4 5V HDD Link: https://patch.msgid.link/20260116-odroid-hc4-dts-v1-1-459b601cd5cf@linuxdev.slmail.me [narmstrong: fixed subject prefix] Signed-off-by: Neil Armstrong commit 1099b3b6ab01e481c5aaf6c74e9c8892c9636fe6 Author: Nick Xie Date: Fri Jan 16 10:36:11 2026 +0800 arm64: dts: amlogic: meson-s4-s905y4-khadas-vim1s: enable eMMC storage Enable the on-board eMMC storage for Khadas VIM1S. The VIM1S features a 16GB eMMC 5.1 module. This patch adds the necessary regulators and the eMMC controller node. Signed-off-by: Nick Xie Reviewed-by: Martin Blumenstingl Link: https://patch.msgid.link/20260116023611.2033078-1-nick@khadas.com Signed-off-by: Neil Armstrong commit 7d0507772406e129329983b8b807e5b499bd74fd Author: Michał Grzelak Date: Mon Dec 8 11:27:14 2025 +0100 drm/buddy: release free_trees array on buddy mm teardown During initialization of DRM buddy memory manager at drm_buddy_init, mm->free_trees array is allocated for both clear and dirty RB trees. During cleanup happening at drm_buddy_fini it is never freed, leading to following memory leaks observed on xe module load & unload cycles: kmemleak_alloc+0x4a/0x90 __kmalloc_cache_noprof+0x488/0x800 drm_buddy_init+0xc2/0x330 [drm_buddy] __xe_ttm_vram_mgr_init+0xc3/0x190 [xe] xe_ttm_stolen_mgr_init+0xf5/0x9d0 [xe] xe_device_probe+0x326/0x9e0 [xe] xe_pci_probe+0x39a/0x610 [xe] local_pci_probe+0x47/0xb0 pci_device_probe+0xf3/0x260 really_probe+0xf1/0x3c0 __driver_probe_device+0x8c/0x180 driver_probe_device+0x24/0xd0 __driver_attach+0x10f/0x220 bus_for_each_dev+0x7f/0xe0 driver_attach+0x1e/0x30 bus_add_driver+0x151/0x290 Deallocate array for free trees when cleaning up buddy memory manager in the same way as if going through out_free_tree label. Fixes: d4cd665c98c1 ("drm/buddy: Separate clear and dirty free block trees") Signed-off-by: Michał Grzelak Reviewed-by: Lucas De Marchi Reviewed-by: Matthew Auld Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20251208102714.4008260-2-michal.grzelak@intel.com commit 3574c322b1d0eb32dbd76b469cb08f9a67641599 Author: Jan Kara Date: Wed Jan 14 19:28:19 2026 +0100 ext4: use optimized mballoc scanning regardless of inode format Currently we don't used mballoc optimized scanning (using max free extent order and avg free extent order group lists) for inodes with indirect block based format. This is confusing for users and I don't see a good reason for that. Even with indirect block based inode format we can spend big amount of time searching for free blocks for large filesystems with fragmented free space. To add to the confusion before commit 077d0c2c78df ("ext4: make mb_optimize_scan performance mount option work with extents") optimized scanning was applied *only* to indirect block based inodes so that commit appears as a performance regression to some users. Just use optimized scanning whenever it is enabled by mount options. Reviewed-by: Baokun Li Reviewed-by: Zhang Yi Signed-off-by: Jan Kara Cc: stable@kernel.org Link: https://patch.msgid.link/20260114182836.14120-4-jack@suse.cz Signed-off-by: Theodore Ts'o commit 4865c768b563deff1b6a6384e74a62f143427b42 Author: Jan Kara Date: Wed Jan 14 19:28:18 2026 +0100 ext4: always allocate blocks only from groups inode can use For filesystems with more than 2^32 blocks inodes using indirect block based format cannot use blocks beyond the 32-bit limit. ext4_mb_scan_groups_linear() takes care to not select these unsupported groups for such inodes however other functions selecting groups for allocation don't. So far this is harmless because the other selection functions are used only with mb_optimize_scan and this is currently disabled for inodes with indirect blocks however in the following patch we want to enable mb_optimize_scan regardless of inode format. Reviewed-by: Baokun Li Reviewed-by: Zhang Yi Signed-off-by: Jan Kara Acked-by: Pedro Falcato Cc: stable@kernel.org Link: https://patch.msgid.link/20260114182836.14120-3-jack@suse.cz Signed-off-by: Theodore Ts'o commit 94a8cea54cd935c54fa2fba70354757c0fc245e3 Author: Brian Foster Date: Tue Jan 13 12:19:05 2026 -0500 ext4: fix dirtyclusters double decrement on fs shutdown fstests test generic/388 occasionally reproduces a warning in ext4_put_super() associated with the dirty clusters count: WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4] Tracing the failure shows that the warning fires due to an s_dirtyclusters_counter value of -1. IOW, this appears to be a spurious decrement as opposed to some sort of leak. Further tracing of the dirty cluster count deltas and an LLM scan of the resulting output identified the cause as a double decrement in the error path between ext4_mb_mark_diskspace_used() and the caller ext4_mb_new_blocks(). First, note that generic/388 is a shutdown vs. fsstress test and so produces a random set of operations and shutdown injections. In the problematic case, the shutdown triggers an error return from the ext4_handle_dirty_metadata() call(s) made from ext4_mb_mark_context(). The changed value is non-zero at this point, so ext4_mb_mark_diskspace_used() does not exit after the error bubbles up from ext4_mb_mark_context(). Instead, the former decrements both cluster counters and returns the error up to ext4_mb_new_blocks(). The latter falls into the !ar->len out path which decrements the dirty clusters counter a second time, creating the inconsistency. To avoid this problem and simplify ownership of the cluster reservation in this codepath, lift the counter reduction to a single place in the caller. This makes it more clear that ext4_mb_new_blocks() is responsible for acquiring cluster reservation (via ext4_claim_free_clusters()) in the !delalloc case as well as releasing it, regardless of whether it ends up consumed or returned due to failure. Fixes: 0087d9fb3f29 ("ext4: Fix s_dirty_blocks_counter if block allocation failed with nodelalloc") Signed-off-by: Brian Foster Reviewed-by: Baokun Li Link: https://patch.msgid.link/20260113171905.118284-1-bfoster@redhat.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit b18c5b84fa4a3c3c41b25c9b8f52ed9471c0c98d Author: Viacheslav Dubeyko Date: Fri Jan 9 15:42:13 2026 -0800 hfsplus: fix generic/037 xfstests failure The xfstests' test-case generic/037 fails to execute correctly: FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc4+ #8 SMP PREEMPT_DYNAMIC Thu May 1 16:43:22 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/037 - output mismatch (see xfstests-dev/results//generic/037.out.bad) The goal of generic/037 test-case is to "verify that replacing a xattr's value is an atomic operation". The test "consists of removing the old value and then inserting the new value in a btree. This made readers (getxattr and listxattrs) not getting neither the old nor the new value during a short time window". The HFS+ has the issue of executing the xattr replace operation because __hfsplus_setxattr() method [1] implemented it as not atomic operation [2]: if (hfsplus_attr_exists(inode, name)) { if (flags & XATTR_CREATE) { pr_err("xattr exists yet\n"); err = -EOPNOTSUPP; goto end_setxattr; } err = hfsplus_delete_attr(inode, name); if (err) goto end_setxattr; err = hfsplus_create_attr(inode, name, value, size); if (err) goto end_setxattr; } The main issue of the logic that it implements delete and create of xattr as independent atomic operations, but the replace operation at whole is not atomic operation. This patch implements a new hfsplus_replace_attr() method that makes the xattr replace operation by atomic one. Also, it reworks hfsplus_create_attr() and hfsplus_delete_attr() with the goal of reusing the common logic in hfsplus_replace_attr() method. sudo ./check generic/037 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.19.0-rc1+ #47 SMP PREEMPT_DYNAMIC Thu Jan 8 15:37:20 PST 2026 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/037 37s ... 37s Ran: generic/037 Passed all 1 tests [1] https://elixir.bootlin.com/linux/v6.19-rc4/source/fs/hfsplus/xattr.c#L261 [2] https://elixir.bootlin.com/linux/v6.19-rc4/source/fs/hfsplus/xattr.c#L338 Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20260109234213.2805400-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 491f2927ae097e2d405afe0b3fe841931ab8aad2 Author: Li Chen Date: Tue Jan 6 20:06:21 2026 +0800 ext4: fast commit: make s_fc_lock reclaim-safe s_fc_lock can be acquired from inode eviction and thus is reclaim unsafe. Since the fast commit path holds s_fc_lock while writing the commit log, allocations under the lock can enter reclaim and invert the lock order with fs_reclaim. Add ext4_fc_lock()/ext4_fc_unlock() helpers which acquire s_fc_lock under memalloc_nofs_save()/restore() context and use them everywhere so allocations under the lock cannot recurse into filesystem reclaim. Fixes: 6593714d67ba ("ext4: hold s_fc_lock while during fast commit") Signed-off-by: Li Chen Reviewed-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260106120621.440126-1-me@linux.beauty Signed-off-by: Theodore Ts'o commit bdc56a9c46b2a99c12313122b9352b619a2e719e Author: Yongjian Sun Date: Tue Jan 6 17:08:20 2026 +0800 ext4: fix e4b bitmap inconsistency reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads. Ext4 reported multiple e4b bitmap check failures like: ext4_mb_complex_scan_group:2508: group 350, 8179 free clusters as per group info. But got 8192 blocks Analysis and experimentation confirmed that the issue is caused by a race condition between page migration and bitmap modification. Although this timing window is extremely narrow, it is still hit in practice: folio_lock ext4_mb_load_buddy __migrate_folio check ref count folio_mc_copy __filemap_get_folio folio_try_get(folio) ...... mb_mark_used ext4_mb_unload_buddy __folio_migrate_mapping folio_ref_freeze folio_unlock The root cause of this issue is that the fast path of load_buddy only increments the folio's reference count, which is insufficient to prevent concurrent folio migration. We observed that the folio migration process acquires the folio lock. Therefore, we can determine whether to take the fast path in load_buddy by checking the lock status. If the folio is locked, we opt for the slow path (which acquires the lock) to close this concurrency window. Additionally, this change addresses the following issues: When the DOUBLE_CHECK macro is enabled to inspect bitmap-related issues, the following error may be triggered: corruption in group 324 at byte 784(6272): f in copy != ff on disk/prealloc Analysis reveals that this is a false positive. There is a specific race window where the bitmap and the group descriptor become momentarily inconsistent, leading to this error report: ext4_mb_load_buddy ext4_mb_load_buddy __filemap_get_folio(create|lock) folio_lock ext4_mb_init_cache folio_mark_uptodate __filemap_get_folio(no lock) ...... mb_mark_used mb_mark_used_double mb_cmp_bitmaps mb_set_bits(e4b->bd_bitmap) folio_unlock The original logic assumed that since mb_cmp_bitmaps is called when the bitmap is newly loaded from disk, the folio lock would be sufficient to prevent concurrent access. However, this overlooks a specific race condition: if another process attempts to load buddy and finds the folio is already in an uptodate state, it will immediately begin using it without holding folio lock. Signed-off-by: Yongjian Sun Reviewed-by: Zhang Yi Reviewed-by: Baokun Li Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260106090820.836242-1-sunyongjian@huaweicloud.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 591a4ab9b8b125bf72a345ca6f5c0ee4481db02b Author: Baolin Liu Date: Tue Jan 6 14:20:16 2026 +0800 ext4: remove redundant NULL check after __GFP_NOFAIL Remove redundant NULL check after kcalloc() with GFP_NOFS | __GFP_NOFAIL. Signed-off-by: Baolin Liu Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20260106062016.154573-1-liubaolin12138@163.com Signed-off-by: Theodore Ts'o commit 5f18f60d56c0cedd17826882b66b94f1a52f65ef Author: Zhang Yi Date: Mon Jan 5 09:45:22 2026 +0800 ext4: remove EXT4_GET_BLOCKS_IO_CREATE_EXT We do not use EXT4_GET_BLOCKS_IO_CREATE_EXT or split extents before submitting I/O; therefore, remove the related code. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260105014522.1937690-8-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 5ca28af074ad506c95a8f86a5d260562f3caa39b Author: Zhang Yi Date: Mon Jan 5 09:45:21 2026 +0800 ext4: simplify the mapping query logic in ext4_iomap_begin() In the write path mapping check of ext4_iomap_begin(), the return value 'ret' should never greater than orig_mlen. If 'ret' equals 'orig_mlen', it can be returned directly without checking IOMAP_ATOMIC. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260105014522.1937690-7-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 8bd1f257af1c21d34f8758f4e36854970e1dc2f5 Author: Zhang Yi Date: Mon Jan 5 09:45:20 2026 +0800 ext4: remove unused unwritten parameter in ext4_dio_write_iter() The parameter unwritten in ext4_dio_write_iter() is no longer needed, simply remove it. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260105014522.1937690-6-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 012924f0eeef84f9bdb71896265f8303245065a8 Author: Zhang Yi Date: Mon Jan 5 09:45:19 2026 +0800 ext4: remove useless ext4_iomap_overwrite_ops ext4_iomap_overwrite_ops was introduced in commit 8cd115bdda17 ("ext4: Optimize ext4 DIO overwrites"), which can optimize pure overwrite performance by dropping the IOMAP_WRITE flag to only query the mapped mapping information. This avoids starting a new journal handle, thereby improving speed. Later, commit 9faac62d4013 ("ext4: optimize file overwrites") also optimized similar scenarios, but it performs the check later, examining the mappings status only when the actual block mapping is needed. Thus, it can handle the previous commit scenario. That means in the case of an overwrite scenario, the condition "offset + length <= i_size_read(inode)" in the write path must always be true. Therefore, it is acceptable to remove the ext4_iomap_overwrite_ops, which will also clarify the write and read paths of ext4_iomap_begin. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260105014522.1937690-5-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 5d87c7fca2c1f51537052c791df694dc3c4261cb Author: Zhang Yi Date: Mon Jan 5 09:45:18 2026 +0800 ext4: avoid starting handle when dio writing an unwritten extent Since we have deferred the split of the unwritten extent until after I/O completion, it is not necessary to initiate the journal handle when submitting the I/O. This can improve the write performance of concurrent DIO for multiple files. The fio tests below show a ~25% performance improvement when wirting to unwritten files on my VM with a mem disk. [unwritten] direct=1 ioengine=psync numjobs=16 rw=write # write/randwrite bs=4K iodepth=1 directory=/mnt size=5G runtime=30s overwrite=0 norandommap=1 fallocate=native ramp_time=5s group_reporting=1 [w/o] w: IOPS=62.5k, BW=244MiB/s rw: IOPS=56.7k, BW=221MiB/s [w] w: IOPS=79.6k, BW=311MiB/s rw: IOPS=70.2k, BW=274MiB/s Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260105014522.1937690-4-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit ea96cb5c4ae3ab9516a78b6b435721a6c701eff4 Author: Zhang Yi Date: Mon Jan 5 09:45:17 2026 +0800 ext4: don't split extent before submitting I/O Currently, when writing back dirty pages to the filesystem with the dioread_nolock feature enabled and when doing DIO, if the area to be written back is part of an unwritten extent, the EXT4_GET_BLOCKS_IO_CREATE_EXT flag is set during block allocation before submitting I/O. The function ext4_split_convert_extents() then attempts to split this extent in advance. This approach is designed to prevents extent splitting and conversion to the written type from failing due to insufficient disk space at the time of I/O completion, which could otherwise result in data loss. However, we already have two mechanisms to ensure successful extent conversion. The first is the EXT4_GET_BLOCKS_METADATA_NOFAIL flag, which is a best effort, it permits the use of 2% of the reserved space or 4,096 blocks in the file system when splitting extents. This flag covers most scenarios where extent splitting might fail. The second is the EXT4_EXT_MAY_ZEROOUT flag, which is also set during extent splitting. If the reserved space is insufficient and splitting fails, it does not retry the allocation. Instead, it directly zeros out the extra part of the extent, thereby avoiding splitting and directly converting the entire extent to the written type. These two mechanisms also exist when I/Os are completed because there is a concurrency window between write-back and fallocate, which may still require us to split extents upon I/O completion. There is no much difference between splitting extents before submitting I/O. Therefore, It seems possible to defer the splitting until I/O completion, it won't increase the risk of I/O failure and data loss. On the contrary, if some I/Os can be merged when I/O completion, it can also reduce unnecessary splitting operations, thereby alleviating the pressure on reserved space. In addition, deferring extent splitting until I/O completion can also simplify the IO submission process and avoid initiating unnecessary journal handles when writing unwritten extents. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260105014522.1937690-3-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 01942af95ab6c9d98e64ae01fdc243a03e4b973f Author: Zhang Yi Date: Mon Jan 5 09:45:16 2026 +0800 ext4: use reserved metadata blocks when splitting extent on endio When performing buffered writes, we may need to split and convert an unwritten extent into a written one during the end I/O process. However, we do not reserve space specifically for these metadata changes, we only reserve 2% of space or 4096 blocks. To address this, we use EXT4_GET_BLOCKS_PRE_IO to potentially split extents in advance and EXT4_GET_BLOCKS_METADATA_NOFAIL to utilize reserved space if necessary. These two approaches can reduce the likelihood of running out of space and losing data. However, these methods are merely best efforts, we could still run out of space, and there is not much difference between converting an extent during the writeback process and the end I/O process, it won't increase the risk of losing data if we postpone the conversion. Therefore, also use EXT4_GET_BLOCKS_METADATA_NOFAIL in ext4_convert_unwritten_extents_endio() to prepare for the buffered I/O iomap conversion, which may perform extent conversion during the end I/O process. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Reviewed-by: Ojaswin Mujoo Link: https://patch.msgid.link/20260105014522.1937690-2-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit ca81109d4a8f192dc1cbad4a1ee25246363c2833 Author: Zilin Guan Date: Thu Dec 25 08:48:00 2025 +0000 ext4: fix memory leak in ext4_ext_shift_extents() In ext4_ext_shift_extents(), if the extent is NULL in the while loop, the function returns immediately without releasing the path obtained via ext4_find_extent(), leading to a memory leak. Fix this by jumping to the out label to ensure the path is properly released. Fixes: a18ed359bdddc ("ext4: always check ext4_ext_find_extent result") Signed-off-by: Zilin Guan Reviewed-by: Zhang Yi Reviewed-by: Baokun Li Link: https://patch.msgid.link/20251225084800.905701-1-zilin@seu.edu.cn Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 154922b34da9770223d9883ac6976635a786b5ba Author: Zhang Yi Date: Tue Dec 23 09:19:27 2025 +0800 ext4: don't order data when zeroing unwritten or delayed block When zeroing out a written partial block, it is necessary to order the data to prevent exposing stale data on disk. However, if the buffer is unwritten or delayed, it is not allocated as written, so ordering the data is not required. This can prevent strange and unnecessary ordered writes when appending data across a region within a block. Assume we have a 2K unwritten file on a filesystem with 4K blocksize, and buffered write from 3K to 4K. Before this patch, __ext4_block_zero_page_range() would add the range [2k,3k) to the ordered range, and then the JBD2 commit process would write back this block. However, it does nothing since the block is not mapped as written, this folio will be redirtied and written back agian through the normal write back process. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Link: https://patch.msgid.link/20251223011927.34042-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 26f260ce5828fc7897a70629884916301f5825d0 Author: pengdonglin Date: Thu Dec 11 20:38:29 2025 +0800 ext4: remove unnecessary zero-initialization via memset The d_path function does not require the caller to pre-zero the buffer. Signed-off-by: pengdonglin Reviewed-by: Zhang Yi Reviewed-by: Baokun Li Link: https://patch.msgid.link/20251211123829.2777009-1-dolinux.peng@gmail.com Signed-off-by: Theodore Ts'o commit f16ae81b80ca4e721f4c4ed1f28390115f7721eb Author: Guodong Xu Date: Thu Jan 15 07:18:59 2026 +0800 riscv: dts: sophgo: sg2044: Add "b" ISA extension "b" is ratified (Apr/2024) much later than its components zba/zbb/zbs (Jun/2021). With "b" added into riscv/extensions.yaml, a dependency checking rule is now enforced, which requires that when zba, zbb, and zbs are all specified, "b" must be added as well. Failing to do this will cause dtbs_check schema check warnings. According to uabi.rst, as a single-letter extension, "b" should be added after "c" in canonical order. Update sg2044-cpus.dtsi to conform to this rule. Signed-off-by: Guodong Xu Reviewed-by: Inochi Amaoto Link: https://lore.kernel.org/r/20260115-adding-b-dtsi-v2-3-254dd61cf947@riscstar.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit ebb87dd74c34a76e1e93041e9329cf9269be35ed Author: Inochi Amaoto Date: Tue Jan 13 10:38:27 2026 +0800 riscv: dts: sophgo: fix the node order of SG2042 peripheral In sg2042.dtsi, some peripheral device node does not follow the address order. Reorder them in ascending order by address. Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/20260113023828.790136-2-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 5e6836e735f9c9c5e8e1d1dce02dfed5fe566e8f Author: Inochi Amaoto Date: Tue Jan 13 10:38:26 2026 +0800 riscv: dts: sophgo: Move PLIC and CLINT node into CPU dtsi As we have a separate CPU dtsi file, move the PLIC and CLINT node to the CPU dtsi file. This will make the sg2042.dtsi focus on peripheral devices, and make the CPU dtsi force CPU related devices. Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/20260113023828.790136-1-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 1f8dd813a1c771b13c303f73d876164bc9b327cc Author: Li Chen Date: Thu Dec 11 19:51:42 2025 +0800 ext4: mark group extend fast-commit ineligible Fast commits only log operations that have dedicated replay support. EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last block group and updates the same on-disk metadata without going through the fast commit tracking paths. In practice these operations are rare and usually followed by further updates, but mixing them into a fast commit makes the overall semantics harder to reason about and risks replay gaps if new call sites appear. Teach ext4 to mark the filesystem fast-commit ineligible when EXT4_IOC_GROUP_EXTEND grows the filesystem. This forces those transactions to fall back to a full commit, ensuring that the group extension changes are captured by the normal journal rather than partially encoded in fast commit TLVs. This change should not affect common workloads but makes online resize via GROUP_EXTEND safer and easier to reason about under fast commit. Testing: 1. prepare: dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 mkfs.ext4 -O fast_commit -F /root/fc_resize.img mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize 2. Extended the filesystem to the end of the last block group using a helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem and checked fc_info: ./group_extend_helper /mnt/fc_resize cat /proc/fs/ext4/loop0/fc_info shows the "Resize" ineligible reason increased. 3. Fsynced a file on the resized filesystem and confirmed that the fast commit ineligible counter incremented for the resize transaction: touch /mnt/fc_resize/file /root/fsync_file /mnt/fc_resize/file sync cat /proc/fs/ext4/loop0/fc_info Signed-off-by: Li Chen Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty Signed-off-by: Theodore Ts'o commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 Author: Li Chen Date: Thu Dec 11 19:51:41 2025 +0800 ext4: mark group add fast-commit ineligible Fast commits only log operations that have dedicated replay support. Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group descriptor metadata without going through the fast commit tracking paths. In practice these operations are rare and usually followed by further updates, but mixing them into a fast commit makes the overall semantics harder to reason about and risks replay gaps if new call sites appear. Teach ext4 to mark the filesystem fast-commit ineligible when ext4_ioctl_group_add() adds new block groups. This forces those transactions to fall back to a full commit, ensuring that the filesystem geometry updates are captured by the normal journal rather than partially encoded in fast commit TLVs. This change should not affect common workloads but makes online resize via GROUP_ADD safer and easier to reason about under fast commit. Testing: 1. prepare: dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256 mkfs.ext4 -O fast_commit -F /root/fc_resize.img mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize 2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted filesystem and checked the resize ineligible reason: ./group_add_helper /mnt/fc_resize cat /proc/fs/ext4/loop0/fc_info shows "Resize": > 0. 3. Fsynced a file on the resized filesystem and verified that the fast commit stats report at least one ineligible commit: touch /mnt/fc_resize/file /root/fsync_file /mnt/fc_resize/file sync cat /proc/fs/ext4/loop0/fc_info shows fc stats ineligible > 0. Signed-off-by: Li Chen Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty Signed-off-by: Theodore Ts'o commit 690558921d9f9388c6bc83610451d8cb393e4d88 Author: Li Chen Date: Thu Dec 11 19:51:40 2025 +0800 ext4: mark move extents fast-commit ineligible Fast commits only log operations that have dedicated replay support. EXT4_IOC_MOVE_EXT swaps extents between regular files and may copy data, rewriting the affected inodes' block mapping layout without going through the fast commit tracking paths. In practice these operations are rare and usually followed by further updates, but mixing them into a fast commit makes the overall semantics harder to reason about and risks replay gaps if new call sites appear. Teach ext4 to mark the filesystem fast-commit ineligible for the journal transactions used by move_extent_per_page() when EXT4_IOC_MOVE_EXT runs. This forces those transactions to fall back to a full commit, ensuring that these multi-inode extent swaps are captured by the normal journal rather than partially encoded in fast commit TLVs. This change should not affect common workloads but makes online defragmentation safer and easier to reason about under fast commit. Testing: 1. prepare: dd if=/dev/zero of=/root/fc_move.img bs=1M count=0 seek=256 mkfs.ext4 -O fast_commit -F /root/fc_move.img mkdir -p /mnt/fc_move && mount -t ext4 -o loop \ /root/fc_move.img /mnt/fc_move 2. Created two files, ran EXT4_IOC_MOVE_EXT via e4defrag, and checked the ineligible reason statistics: fallocate -l 64M /mnt/fc_move/file1 cp /mnt/fc_move/file1 /mnt/fc_move/file2 e4defrag /mnt/fc_move/file1 cat /proc/fs/ext4/loop0/fc_info shows "Move extents": > 0 and fc stats ineligible > 0. Signed-off-by: Li Chen Link: https://patch.msgid.link/20251211115146.897420-4-me@linux.beauty Signed-off-by: Theodore Ts'o commit 16d43b9748c655b36a675cc55789f40fd827e9b1 Author: Li Chen Date: Thu Dec 11 19:51:39 2025 +0800 ext4: mark fs-verity enable fast-commit ineligible Fast commits only log operations that have dedicated replay support. Enabling fs-verity builds a Merkle tree and updates inode and orphan state in ways that are not described by the fast commit replay tags. In practice these operations are rare and usually followed by further updates, but mixing them into a fast commit makes the overall semantics harder to reason about and risks replay gaps if new call sites appear. Teach ext4 to mark the filesystem fast-commit ineligible when ext4_end_enable_verity() starts its journal transaction. This forces that transaction to fall back to a full commit, ensuring that the fs-verity enable changes are captured by the normal journal rather than partially encoded in fast commit TLVs. This change should not affect common workloads but makes fs-verity enable safer and easier to reason about under fast commit. Testing: 1. prepare: dd if=/dev/zero of=/root/fc_verity.img bs=1M count=0 seek=128 mkfs.ext4 -O fast_commit,verity -F /root/fc_verity.img mkdir -p /mnt/fc_verity && mount -t ext4 -o loop /root/fc_verity.img /mnt/fc_verity 2. Enabled fs-verity on a file and verified reason accounting: echo "data" > /mnt/fc_verity/verityfile /root/enable_verity /mnt/fc_verity/verityfile sync tail -n 1 /proc/fs/ext4/loop0/fc_info "fs-verity enable": 1 3. Enabled fs-verity on a second file, fsynced it, and checked that the ineligible commit counter is updated too: echo "data2" > /mnt/fc_verity/verityfile2 /root/enable_verity /mnt/fc_verity/verityfile2 /root/fsync_file /mnt/fc_verity/verityfile2 sync /proc/fs/ext4/loop0/fc_info shows "fs-verity enable" incremented and fc stats ineligible increased accordingly. Signed-off-by: Li Chen Link: https://patch.msgid.link/20251211115146.897420-3-me@linux.beauty Signed-off-by: Theodore Ts'o commit 87e79fa122bc9a6576f1690ee264fcbd77d3ab58 Author: Li Chen Date: Thu Dec 11 19:51:38 2025 +0800 ext4: mark inode format migration fast-commit ineligible Fast commits only log operations that have dedicated replay support. Inode format migration (indirect<->extent layout changes via EXT4_IOC_MIGRATE or toggling EXT4_EXTENTS_FL) rewrites the block mapping representation without going through the fast commit tracking paths. In practice these migrations are rare and usually followed by further updates, but mixing them into a fast commit makes the overall semantics harder to reason about and risks replay gaps if new call sites appear. Teach ext4 to mark the filesystem fast-commit ineligible when ext4_ext_migrate() or ext4_ind_migrate() start their journal transactions. This forces those transactions to fall back to a full commit, ensuring that the entire inode layout change is captured by the normal journal rather than partially encoded in fast commit TLVs. This change should not affect common workloads but makes format migrations safer and easier to reason about under fast commit. Testing: 1. prepare: dd if=/dev/zero of=/root/fc.img bs=1M count=0 seek=128 mkfs.ext4 -O fast_commit -F /root/fc.img mkdir -p /mnt/fc && mount -t ext4 -o loop /root/fc.img /mnt/fc 2. Created a test file and toggled the extents flag to exercise both ext4_ind_migrate() and ext4_ext_migrate(): touch /mnt/fc/migtest chattr -e /mnt/fc/migtest chattr +e /mnt/fc/migtest 3. Verified fast-commit ineligible statistics: tail -n 1 /proc/fs/ext4/loop0/fc_info "Inode format migration": 2 Signed-off-by: Li Chen Link: https://patch.msgid.link/20251211115146.897420-2-me@linux.beauty Signed-off-by: Theodore Ts'o commit d518215c27194486fe13136a8dbbbabeefb5c9b6 Author: Baolin Liu Date: Thu Dec 11 11:02:56 2025 +0800 ext4: add sysfs attribute err_report_sec to control s_err_report timer Add a new sysfs attribute "err_report_sec" to control the s_err_report timer in ext4_sb_info. Writing '0' disables the timer, while writing a non-zero value enables the timer and sets the timeout in seconds. Signed-off-by: Baolin Liu Link: https://patch.msgid.link/20251211030256.28613-1-liubaolin12138@163.com Signed-off-by: Theodore Ts'o commit 270564513489d98b721a1e4a10017978d5213bff Author: Baokun Li Date: Tue Dec 9 21:31:16 2025 +0800 ext4: move ext4_percpu_param_init() before ext4_mb_init() When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the `DOUBLE_CHECK` macro defined, the following panic is triggered: ================================================================== EXT4-fs error (device vdc): ext4_validate_block_bitmap:423: comm mount: bg 0: bad block bitmap checksum BUG: unable to handle page fault for address: ff110000fa2cc000 PGD 3e01067 P4D 3e02067 PUD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W 6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none) RIP: 0010:percpu_counter_add_batch+0x13/0xa0 Call Trace: ext4_mark_group_bitmap_corrupted+0xcb/0xe0 ext4_validate_block_bitmap+0x2a1/0x2f0 ext4_read_block_bitmap+0x33/0x50 mb_group_bb_bitmap_alloc+0x33/0x80 ext4_mb_add_groupinfo+0x190/0x250 ext4_mb_init_backend+0x87/0x290 ext4_mb_init+0x456/0x640 __ext4_fill_super+0x1072/0x1680 ext4_fill_super+0xd3/0x280 get_tree_bdev_flags+0x132/0x1d0 vfs_get_tree+0x29/0xd0 vfs_cmd_create+0x59/0xe0 __do_sys_fsconfig+0x4f6/0x6b0 do_syscall_64+0x50/0x1f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ================================================================== This issue can be reproduced using the following commands: mkfs.ext4 -F -q -b 1024 /dev/sda 5G tune2fs -O quota,project /dev/sda mount /dev/sda /tmp/test With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads and validates the block bitmap. When the validation fails, ext4_mark_group_bitmap_corrupted() attempts to update sbi->s_freeclusters_counter. However, this percpu_counter has not been initialized yet at this point, which leads to the panic described above. Fix this by moving the execution of ext4_percpu_param_init() to occur before ext4_mb_init(), ensuring the per-CPU counters are initialized before they are used. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o commit 450e2487d5a28260f70ad7fbf3060e7f8304203d Author: Troy Mitchell Date: Thu Jan 8 14:42:39 2026 +0800 pinctrl: spacemit: support I/O power domain configuration Dual-voltage GPIO banks default to 3.3V operation. Even when a bank is externally supplied with 1.8V, the internal logic remains in the 3.3V domain, leading to functional failures. Add support for programming the IO domain power control registers to allow explicit configuration for 1.8V operation. These registers are secure due to hardware safety constraints. Specifically, configuring the domain for 1.8V while externally supplying 3.3V causes back-powering and potential pin damage. Consequently, access requires unlocking the AIB Secure Access Register (ASAR) in the APBC block before any read or write operation. Signed-off-by: Troy Mitchell Signed-off-by: Linus Walleij commit e817f0223d78818cd6c0e3480355c9a9cfbc0096 Author: Troy Mitchell Date: Thu Jan 8 14:42:38 2026 +0800 dt-bindings: pinctrl: spacemit: add syscon property In order to access the protected IO power domain registers, a valid unlock sequence must be performed by writing the required keys to the AIB Secure Access Register (ASAR). The ASAR register resides within the APBC register address space. A corresponding syscon property is added to allow the pinctrl driver to access this register. Signed-off-by: Troy Mitchell Reviewed-by: Rob Herring (Arm) Signed-off-by: Linus Walleij commit c3608162a95a259c669cf9fdccf900782fa8d902 Author: Abdurrahman Hussain Date: Mon Jan 19 07:06:23 2026 +0000 spi: xilinx: make irq optional Both the hardware and driver already support polling mode. By removing the mandatory IRQ requirement during probe, the driver can now fall back to polling when an interrupt is unavailable, ensuring compatibility with a wider range of systems. Signed-off-by: Abdurrahman Hussain Link: https://patch.msgid.link/20260119-spi-xilinx-v3-2-4566c33bac0d@nexthop.ai Signed-off-by: Mark Brown commit b603500de20fbe15ee54580481c1df4212a4ec44 Author: Abdurrahman Hussain Date: Mon Jan 19 07:06:22 2026 +0000 spi: dt-bindings: xilinx: make interrupts optional Both the hardware and driver already support polling mode. By removing the mandatory IRQ requirement during probe, the driver can now fall back to polling when an interrupt is unavailable, ensuring compatibility with a wider range of systems. Signed-off-by: Abdurrahman Hussain Link: https://patch.msgid.link/20260119-spi-xilinx-v3-1-4566c33bac0d@nexthop.ai Signed-off-by: Mark Brown commit a380a02ea3ddc69c1c1ccca3882748dee33ec3d3 Author: John Keeping Date: Thu Jan 8 18:47:48 2026 +0000 rtc: pcf8563: use correct of_node for output clock When switching to regmap, the i2c_client pointer was removed from struct pcf8563 so this function switched to using the RTC device instead. But the RTC device is a child of the original I2C device and does not have an associated of_node. Reference the correct device's of_node to ensure that the output clock can be found when referenced by other devices and so that the override clock name is read correctly. Cc: stable@vger.kernel.org Fixes: 00f1bb9b8486b ("rtc: pcf8563: Switch to regmap") Signed-off-by: John Keeping Link: https://patch.msgid.link/20260108184749.3413348-1-jkeeping@inmusicbrands.com Signed-off-by: Alexandre Belloni commit d5aca9a17f6de884febc56018f92d743b8ea1298 Author: Randy Dunlap Date: Wed Jan 7 20:54:32 2026 -0800 rtc: max31335: use correct CONFIG symbol in IS_REACHABLE() IS_REACHABLE() is meant to be used with full symbol names from a kernel .config file, not the shortened symbols used in Kconfig files, so change HWMON to CONFIG_HWMON in 3 places. Fixes: dedaf03b99d6 ("rtc: max31335: add driver support") Signed-off-by: Randy Dunlap Acked-by: Nuno Sá Link: https://patch.msgid.link/20260108045432.2705691-1-rdunlap@infradead.org Signed-off-by: Alexandre Belloni commit f9ecfd9bfedba9fd9d4b015b33b847571f7fdd42 Author: Peter Robinson Date: Mon Dec 22 03:56:48 2025 +0000 rtc: nvvrs: Add ARCH_TEGRA to the NV VRS RTC driver The NV VRS RTC driver currently is only supported on the Tegra platform so add a dep for ARCH_TEGRA and compile test so it doesn't show up universally across all arches/platforms. Fixes: 9d6d6b06933c8 ("rtc: nvvrs: add NVIDIA VRS RTC device driver") Cc: Shubhi Garg Cc: Jon Hunter Signed-off-by: Peter Robinson Acked-by: Jon Hunter Link: https://patch.msgid.link/20251222035651.433603-1-pbrobinson@gmail.com Signed-off-by: Alexandre Belloni commit 9e835108a9ae1c37aef52a6f8d53265f474904a1 Author: Thorsten Blum Date: Sat Jan 17 14:49:53 2026 +0100 fs/orangefs: Replace deprecated strcpy with memcpy + strscpy strcpy() is deprecated [1] and using strcat() is discouraged. In orangefs_debugfs_init() and orangefs_client_debug_init(), replace them with memcpy() since the string lengths are already known. Replace all other uses of strcpy() with the safer strscpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Signed-off-by: Mike Marshall commit 0eb1927502e870e4b8beaab403775056a8f4f0db Author: Thorsten Blum Date: Mon Dec 22 11:00:57 2025 +0100 orangefs: Replace deprecated strcpy with strscpy strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(). No functional changes. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Signed-off-by: Mike Marshall commit c5e7b1d1cc8a6cb8b709eef34c93a9458427ab2e Merge: 3b85d5f8562cd7 abed42f9cd809b Author: Jakub Kicinski Date: Mon Jan 19 12:26:45 2026 -0800 Merge branch 'net-mlx5e-save-per-channel-async-icosq-in-default' Tariq Toukan says: ==================== net/mlx5e: Save per-channel async ICOSQ in default This series by William reduces the default number of SQs in a channel from 3 down to 2, by not creating the async ICOSQ (asynchronous internal-communication-operations send-queue). This significantly improves the latency of channel configuration operations, like interface up (create channels), interface down (destroy channels), and channels reconfiguration (create new set, destroy old one). This reduces the per-channel memory usage, saves hardware resources, in addition to the improved latency. This significantly speeds up the setup/config stage on systems with high number of channels or many netdevs, in particular systems with hundreds or K's of SFs. The two remaining default SQs per channel after this series: 1 TXQ SQ (for traffic), and 1 ICOSQ (for internal communication operations with the device). Perf numbers: NIC: Connect-X7. Test: Latency of interface up + down operations. Measured 20% speedup. Saving ~0.36 sec for 248 channels (~1.45 msec per channel). ==================== Link: https://patch.msgid.link/1768376800-1607672-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit abed42f9cd809bf790c415c86f6dc41a3f69c91b Author: William Tu Date: Wed Jan 14 09:46:40 2026 +0200 net/mlx5e: Conditionally create async ICOSQ The async ICOSQ is only required by TLS RX (for re-sync flow) and XSK TX. Create it only when these features are enabled instead of always allocating it. This reduces per-channel memory usage, saves hardware resources, improves latency, and decreases the default number of SQs (from 3 to 2) and CQs (from 4 to 3). It also speeds up channel open/close operations for a netdev when async ICOSQ is not needed. Currently when TLS RX is enabled, there is no channel reset triggered. As a result, async ICOSQ allocation is not triggered, causing a NULL pointer crash. One solution is to do channel reset every time when toggling TLS RX. However, it's not straightforward as the offload state matters only on connection creation, and can go on beyond the channels reset. Instead, introduce a new field 'ktls_rx_was_enabled': if TLS RX is enabled for the first time: reset channels, create async ICOSQ, set the field. From that point on, no need to reset channels for any TLS RX enable/disable. Async ICOSQ will always be needed. For XSK TX, async ICOSQ is used in wakeup control and is guaranteed to have async ICOSQ allocated. This improves the latency of interface up/down operations when it applies. Perf numbers: NIC: Connect-X7. Test: Latency of interface up + down operations. Measured 20% speedup. Saving ~0.36 sec for 248 channels (~1.45 msec per channel). Signed-off-by: William Tu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1768376800-1607672-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 1b080bd748409d330399c2607ea18dfbb5df802d Author: William Tu Date: Wed Jan 14 09:46:39 2026 +0200 net/mlx5e: Move async ICOSQ to dynamic allocation Dynamically allocate async ICOSQ. ICO (Internal Communication Operations) is for driver to communicate with the HW, and it's not used for traffic. Currently mlx5 driver has sync and async ICO send queues. The async ICOSQ means that it's not necessarily under NAPI context protection. The patch is in preparation for the later patch to detect its usage and enable it when necessary. Signed-off-by: William Tu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1768376800-1607672-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 56aca3e0f7308821b6404730a0a6bfd9f26fa04c Author: William Tu Date: Wed Jan 14 09:46:38 2026 +0200 net/mlx5e: Use regular ICOSQ for triggering NAPI Before the cited commit, ICOSQ is used to post NOP WQE to trigger hardware interrupt and start NAPI, but this mechanism suffers from a race condition: mlx5e_alloc_rx_mpwqe may post UMR WQEs to ICOSQ _before_ NOP WQE is posted. The cited commit fixes the issue by replacing ICOSQ with async ICOSQ, as a new way to post the NOP WQE to trigger the hardware interrupt and NAPI. The patch changes it back by replacing async ICOSQ with regular ICOSQ, for the purpose of saving memory in later patches, and solves the issue by adding a new SQ state, MLX5E_SQ_STATE_LOCK_NEEDED for syncing the start of NAPI. What it does: - Switch trigger path from async ICOSQ to regular ICOSQ to reduce need for async SQ. - Introduce MLX5E_SQ_STATE_LOCK_NEEDED and mlx5e_icosq_sync_lock(), unlock() to prevent the race where UMR WQEs could be posted before the NOP WQE used to trigger NAPI. - Use synchronize_net() once per trigger cycle to quiesce in-flight softirqs before serializing the NOP WQE and any UMR postings via the ICOSQ lock. - Wrap ICOSQ UMR posting in en_rx.c and xsk/rx.c with the new conditional lock. The conditional locking approach is critical for performance: always locking would impose unnecessary overhead. Synchronization is not needed between regular NAPI cycles once the channel is activated and running. The lock is only required to protect against the race during channel activation—specifically, when the very first NOP WQE is posted to trigger NAPI. After that initial trigger, normal NAPI polling handles subsequent work without contention. The MLX5E_SQ_STATE_LOCK_NEEDED flag ensures we pay the synchronization cost only when necessary. Signed-off-by: William Tu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1768376800-1607672-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ea945f4f399130658a358103b57f37c2d2150458 Author: William Tu Date: Wed Jan 14 09:46:37 2026 +0200 net/mlx5e: Move async ICOSQ lock into ICOSQ struct Move the async_icosq spinlock from the mlx5e_channel structure into the mlx5e_icosq structure itself for better encapsulation and for later patch to also use it for other icosq use cases. Changes: - Add spinlock_t lock field to struct mlx5e_icosq - Remove async_icosq_lock field from struct mlx5e_channel - Initialize the new lock in mlx5e_open_icosq() - Update all lock usage in ktls_rx.c and en_main.c to use sq->lock instead of c->async_icosq_lock Signed-off-by: William Tu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1768376800-1607672-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 3b85d5f8562cd7341d71f3f3c58120681f518ed3 Author: Vimlesh Kumar Date: Thu Jan 15 09:20:47 2026 +0000 octeon_ep: reset firmware ready status Add support to reset firmware ready status when the driver is removed(either in unload or unbind) Signed-off-by: Sathesh Edara Signed-off-by: Shinas Rasheed Signed-off-by: Vimlesh Kumar Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260115092048.870237-1-vimleshk@marvell.com Signed-off-by: Jakub Kicinski commit 3d4375c2a9d33cbc440c72afb4782d4976713a98 Merge: 456083e7f1cfa6 7a3d3279a56681 Author: Jakub Kicinski Date: Mon Jan 19 12:09:59 2026 -0800 Merge branch 'net-thunderbolt-various-improvements' Mika Westerberg says: ==================== net: thunderbolt: Various improvements This series improves the Thunderbolt networking driver so that it should work with the bonding driver. The discussion that started this patch series can be read below: https://lore.kernel.org/netdev/CAFJzfF9N4Hak23sc-zh0jMobbkjK7rg4odhic1DQ1cC+=MoQoA@mail.gmail.com/ v2: https://lore.kernel.org/20260109122606.3586895-1-mika.westerberg@linux.intel.com v1: https://lore.kernel.org/20251127131521.2580237-1-mika.westerberg@linux.intel.com ==================== Link: https://patch.msgid.link/20260115115646.328898-1-mika.westerberg@linux.intel.com Signed-off-by: Jakub Kicinski commit 7a3d3279a566813b453f9ac4cf01e6f48e4e40e4 Author: Ian MacDonald Date: Thu Jan 15 12:56:46 2026 +0100 net: thunderbolt: Allow reading link settings In order to use Thunderbolt networking as part of bonding device it needs to support ->get_link_ksettings() ethtool operation, so that the bonding driver can read the link speed and the related attributes. Add support for this to the driver. Signed-off-by: Ian MacDonald Reviewed-by: Andrew Lunn Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20260115115646.328898-5-mika.westerberg@linux.intel.com Signed-off-by: Jakub Kicinski commit 2e62e5565bd287d157ad09b0a6d88446d38771ed Author: Mika Westerberg Date: Thu Jan 15 12:56:45 2026 +0100 bonding: 3ad: Add support for SPEED_80000 Add support for ethtool SPEED_80000. This is needed to allow Thunderbolt/USB4 networking driver to be used with the bonding driver. Signed-off-by: Mika Westerberg Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260115115646.328898-4-mika.westerberg@linux.intel.com Signed-off-by: Jakub Kicinski commit a9927022c4491ba44249af079e8799ce56f8053c Author: Mika Westerberg Date: Thu Jan 15 12:56:44 2026 +0100 net: ethtool: Add support for 80Gbps speed USB4 v2 link used in peer-to-peer networking is symmetric 80Gbps so in order to support reading this link speed, add support for it to ethtool. Signed-off-by: Mika Westerberg Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260115115646.328898-3-mika.westerberg@linux.intel.com Signed-off-by: Jakub Kicinski commit 8411d7286bcbda9c3d6bbe5c1427fe895c216628 Author: Mika Westerberg Date: Thu Jan 15 12:56:43 2026 +0100 net: thunderbolt: Allow changing MAC address of the device The MAC address we use is based on a suggestion in the USB4 Inter-domain spec but it is not really used in the USB4NET protocol. It is more targeted for the upper layers of the network stack. There is no reason why it should not be changed by the userspace for example if needed for bonding. Reported-by: Ian MacDonald Closes: https://lore.kernel.org/netdev/CAFJzfF9N4Hak23sc-zh0jMobbkjK7rg4odhic1DQ1cC+=MoQoA@mail.gmail.com/ Reviewed-by: Andrew Lunn Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20260115115646.328898-2-mika.westerberg@linux.intel.com Signed-off-by: Jakub Kicinski commit 456083e7f1cfa6a9133f06c48ff04f4c2956dbac Merge: d321d505edb642 d6df0dea24d2a4 Author: Jakub Kicinski Date: Mon Jan 19 12:05:03 2026 -0800 Merge branch 'dpll-support-mode-switching' Ivan Vecera says: ==================== dpll: support mode switching This series adds support for switching the working mode (automatic vs manual) of a DPLL device via netlink. Currently, the DPLL subsystem allows userspace to retrieve the current working mode but lacks the mechanism to configure it. Userspace is also unaware of which modes a specific device actually supports, as it currently assumes only the active mode is supported. The series addresses these limitations by: 1. Introducing .supported_modes_get() callback to allow drivers to report all modes capable of running on the device. 2. Introducing .mode_set() callback and updating the netlink policy to allow userspace to request a mode change. 3. Implementing these callbacks in the zl3073x driver, enabling dynamic switching between automatic and manual modes. ==================== Link: https://patch.msgid.link/20260114122726.120303-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit d6df0dea24d2a44e08207b3b41c965e50bb212c6 Author: Ivan Vecera Date: Wed Jan 14 13:27:26 2026 +0100 dpll: zl3073x: Implement device mode setting support Add support for .supported_modes_get() and .mode_set() callbacks to enable switching between manual and automatic modes via netlink. Implement .supported_modes_get() to report available modes based on the current hardware configuration: * manual mode is always supported * automatic mode is supported unless the dpll channel is configured in NCO (Numerically Controlled Oscillator) mode Implement .mode_set() to handle the specific logic required when transitioning between modes: 1) Transition to manual: * If a valid reference is currently active, switch the hardware to ref-lock mode (force lock to that reference). * If no reference is valid and the DPLL is unlocked, switch to freerun. * Otherwise, switch to Holdover. 2) Transition to automatic: * If the currently selected reference pin was previously marked as non-selectable (likely during a previous manual forcing operation), restore its priority and selectability in the hardware. * Switch the hardware to Automatic selection mode. Signed-off-by: Ivan Vecera Reviewed-by: Prathosh Satish Link: https://patch.msgid.link/20260114122726.120303-4-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit e3f6c65192fe484ab16f0be2b495ceef5ca3b85c Author: Ivan Vecera Date: Wed Jan 14 13:27:25 2026 +0100 dpll: add dpll_device op to set working mode Currently, userspace can retrieve the DPLL working mode but cannot configure it. This prevents changing the device operation, such as switching from manual to automatic mode and vice versa. Add a new callback .mode_set() to struct dpll_device_ops. Extend the netlink policy and device-set command handling to process the DPLL_A_MODE attribute. Update the netlink YAML specification to include the mode attribute in the device-set operation. Reviewed-by: Vadim Fedorenko Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260114122726.120303-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit b1f99cc8863847676d4a7329ffb668a030150d99 Author: Ivan Vecera Date: Wed Jan 14 13:27:24 2026 +0100 dpll: add dpll_device op to get supported modes Currently, the DPLL subsystem assumes that the only supported mode is the one currently active on the device. When dpll_msg_add_mode_supported() is called, it relies on ops->mode_get() and reports that single mode to userspace. This prevents users from discovering other modes the device might be capable of. Add a new callback .supported_modes_get() to struct dpll_device_ops. This allows drivers to populate a bitmap indicating all modes supported by the hardware. Update dpll_msg_add_mode_supported() to utilize this new callback: * if ops->supported_modes_get is defined, use it to retrieve the full bitmap of supported modes. * if not defined, fall back to the existing behavior: retrieve the current mode via ops->mode_get and set the corresponding bit in the bitmap. Finally, iterate over the bitmap and add a DPLL_A_MODE_SUPPORTED netlink attribute for every set bit, accurately reporting the device's capabilities to userspace. Reviewed-by: Vadim Fedorenko Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260114122726.120303-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit fab13d738c9bd645965464b881335f580d38a54e Author: David Heidelberg Date: Sat Jan 17 19:18:28 2026 +0100 clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src Set CLK_OPS_PARENT_ENABLE to ensure the parent gets prepared and enabled when switching to it. Fixes: e3c13e0caa8c ("clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src") Signed-off-by: David Heidelberg Link: https://lore.kernel.org/r/20260117-sm7150-dispcc-fix-v1-1-2f39966bcad2@ixit.cz Signed-off-by: Bjorn Andersson commit ebd1eb365caef3c815cb8a041d300dfe4263faea Author: Jie Gan Date: Thu Nov 20 21:48:54 2025 +0800 arm64: qcom: dts: sm8750: add coresight nodes Add CoreSight DT nodes for AOSS, QDSS, CDSP, and Modem blocks to enable the STM and TPDM sources to route trace data to the ETF for debugging. Reviewed-by: Abel Vesa Signed-off-by: Jie Gan Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251120-add-coresight-nodes-for-pakala-v3-1-03bb7651bc90@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit dda4bdd325326dd67ae4401f4f3d35b9cf781e3f Author: Viken Dadhaniya Date: Tue Nov 11 22:33:50 2025 +0530 arm64: dts: qcom: talos: Drop opp-shared from QUP OPP table QUP devices are currently marked with opp-shared in their OPP table, causing the kernel to treat them as part of a shared OPP domain. This leads to the qcom_geni_serial driver failing to probe with error -EBUSY (-16). Remove the opp-shared property to ensure the OPP framework treats the QUP OPP table as device-specific, allowing the serial driver to probe successfully Fixes: f6746dc9e379 ("arm64: dts: qcom: qcs615: Add QUPv3 configuration") Signed-off-by: Viken Dadhaniya Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251111170350.525832-1-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit f010e0b997035d82586e32e3427d88ef76edb3cb Author: Abel Vesa Date: Wed Dec 24 12:45:22 2025 +0200 arm64: dts: qcom: x1-el2: Enable the APSS watchdog In EL2, the APSS watchdog is available. So enable it in the overlay. Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251224-arm64-dts-qcom-x1e80100-el2-add-apss-wdt-v3-3-1801c55d2883@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4da4883613f62d4d60ada443d09ac36644f27d8a Author: Abel Vesa Date: Wed Dec 24 12:45:21 2025 +0200 arm64: dts: qcom: hamoa: Add the APSS watchdog The watchdog support in EL1 is SBSA compliant, handled by Gunyah hypervisor, but in EL2. the watchdog is an instance of the APSS WDT HW block, same as older platforms. So describe the APSS WDT node and mark it as reserved, as it will only be enabled in EL2 overlay. Signed-off-by: Abel Vesa Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251224-arm64-dts-qcom-x1e80100-el2-add-apss-wdt-v3-2-1801c55d2883@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6609c1976e64b6ce31fc2de11136dd7703372f20 Author: Abel Vesa Date: Wed Dec 24 12:45:20 2025 +0200 dt-bindings: watchdog: Document X1E80100 compatible Document the compatible for the X1E80100 platform to the Qualcomm watchdog binding. The HW implementation is compatible with the KPSS WDT. Acked-by: Rob Herring (Arm) Reviewed-by: Guenter Roeck Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20251224-arm64-dts-qcom-x1e80100-el2-add-apss-wdt-v3-1-1801c55d2883@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7f45d77240f9fc9948ba4d9c4eec3b97c3e2c51d Author: Rudraksha Gupta Date: Mon Nov 24 15:35:27 2025 -0800 ARM: dts: qcom: msm8960: expressatt: Add Accelerometer Add the Bosch Accelerometer. Reviewed-by: Konrad Dybcio Signed-off-by: Rudraksha Gupta Link: https://lore.kernel.org/r/20251124-expressatt_nfc_accel_magn_light-v4-6-9c5686ad67e2@gmail.com Signed-off-by: Bjorn Andersson commit 3649a120a7106aca89a4eddbddbc2e5a85aa64f9 Author: Rudraksha Gupta Date: Mon Nov 24 15:35:25 2025 -0800 ARM: dts: qcom: msm8960: expressatt: Add Magnetometer Add the Yamaha magnetometer. Mount Matrix is left as a TODO. Reviewed-by: Konrad Dybcio Signed-off-by: Rudraksha Gupta Link: https://lore.kernel.org/r/20251124-expressatt_nfc_accel_magn_light-v4-4-9c5686ad67e2@gmail.com Signed-off-by: Bjorn Andersson commit 7f07c27808e68af92cbf6d352f675248c3ea7cab Author: Rudraksha Gupta Date: Mon Nov 24 15:35:24 2025 -0800 ARM: dts: qcom: msm8960: expressatt: Add NFC Add pn544 NFC chip Reviewed-by: Konrad Dybcio Signed-off-by: Rudraksha Gupta Link: https://lore.kernel.org/r/20251124-expressatt_nfc_accel_magn_light-v4-3-9c5686ad67e2@gmail.com Signed-off-by: Bjorn Andersson commit 72c6158e17cd3ef2069423ae70a24b955b1c0b72 Author: Rudraksha Gupta Date: Mon Nov 24 15:35:23 2025 -0800 ARM: dts: qcom: msm8960: expressatt: Add Light/Proximity Sensor Currently the Proximity Sensor doesn't work, but light sensor does. Left the proximity sensor as a TODO for later. Reviewed-by: Konrad Dybcio Signed-off-by: Rudraksha Gupta Link: https://lore.kernel.org/r/20251124-expressatt_nfc_accel_magn_light-v4-2-9c5686ad67e2@gmail.com Signed-off-by: Bjorn Andersson commit 4535af3dc91c43c16c31e4e2ad9e79cead0ef308 Author: Rudraksha Gupta Date: Mon Nov 24 15:35:22 2025 -0800 ARM: dts: qcom: msm8960: Add GSBI2 & GSBI7 Add the GSBI2 & GSBI7 Node, which is similar to the other GSBI nodes in this file. Reviewed-by: Konrad Dybcio Signed-off-by: Rudraksha Gupta Link: https://lore.kernel.org/r/20251124-expressatt_nfc_accel_magn_light-v4-1-9c5686ad67e2@gmail.com Signed-off-by: Bjorn Andersson commit cfc22c2121cbf8bb75cb9a9993f13c17587ed55e Author: Luca Weiss Date: Tue Oct 28 17:40:52 2025 +0100 arm64: dts: qcom: sdm632-fairphone-fp3: Enable CCI and add EEPROM Enable the CCI where the camera modules are connected to, and add a node for the EEPROM found next to the IMX363 rear camera. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20251028-msm8953-cci-v2-7-b5f9f7135326@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 9e834e768d0b2e9007cd6a5c778d2d8e3674e78f Author: Luca Weiss Date: Tue Oct 28 17:40:51 2025 +0100 arm64: dts: qcom: sdm632-fairphone-fp3: Add camera fixed regulators Add the definitions for a few fixed regulators found on the Fairphone 3. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20251028-msm8953-cci-v2-6-b5f9f7135326@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 842c0aa3e04201bc13f51f5ce9edbb8100ef0d73 Author: Luca Weiss Date: Tue Oct 28 17:40:50 2025 +0100 arm64: dts: qcom: msm8953: Add CCI nodes Add the nodes for the camera I2C bus on the MSM8953 SoC. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20251028-msm8953-cci-v2-5-b5f9f7135326@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 589deb6bc2757787f2b15a84017c23839db3bf8e Author: Luca Weiss Date: Tue Oct 28 17:40:49 2025 +0100 arm64: dts: qcom: msm8953: Re-sort tlmm pinctrl states Follow the Devicetree Sources Coding Style and sort the pinctrl nodes by the pins property. This makes it simpler to add new pinctrl states in the future. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20251028-msm8953-cci-v2-4-b5f9f7135326@lucaweiss.eu Signed-off-by: Bjorn Andersson commit d321d505edb64286bae0e464574d0fd553e31adc Author: Christophe Leroy (CS GROUP) Date: Fri Jan 16 10:48:55 2026 +0100 selftests: net: csum: Fix printk format in recv_get_packet_csum_status() Following warning is encountered when building selftests on powerpc/32. CC csum csum.c: In function 'recv_get_packet_csum_status': csum.c:710:50: warning: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'size_t' {aka 'unsigned int'} [-Wformat=] 710 | error(1, 0, "cmsg: len=%lu expected=%lu", | ~~^ | | | long unsigned int | %u 711 | cm->cmsg_len, CMSG_LEN(sizeof(struct tpacket_auxdata))); | ~~~~~~~~~~~~ | | | size_t {aka unsigned int} csum.c:710:63: warning: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'unsigned int' [-Wformat=] 710 | error(1, 0, "cmsg: len=%lu expected=%lu", | ~~^ | | | long unsigned int | %u cm->cmsg_len has type __kernel_size_t and CMSG() macro has the type returned by sizeof() which is size_t. size_t is 'unsigned int' on some platforms and 'unsigned long' on other ones so use %zu instead of %lu. The code in question was introduced by commit 91a7de85600d ("selftests/net: add csum offload test"). Signed-off-by: Christophe Leroy (CS GROUP) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/8b69b40826553c1dd500d9d25e45883744f3f348.1768556791.git.chleroy@kernel.org Signed-off-by: Jakub Kicinski commit 2f52f835b41350e47085f86841ccfdef0f938c6f Merge: 8f762b2e88398f dbf24ab58fec34 Author: Jakub Kicinski Date: Mon Jan 19 10:08:28 2026 -0800 Merge branch 'dsa-mxl-gsw1xx-support-r-g-mii-slew-rate-configuration' Alexander Sverdlin says: ==================== dsa: mxl-gsw1xx: Support R(G)MII slew rate configuration Maxlinear GSW1xx switches offer slew rate configuration bits for R(G)MII interface. The default state of the configuration bits is "normal", while "slow" can be used to reduce the radiated emissions. Add the support for the latter option into the driver as well as the new DT bindings. ==================== Link: https://patch.msgid.link/20260114104509.618984-1-alexander.sverdlin@siemens.com Signed-off-by: Jakub Kicinski commit dbf24ab58fec34e168e331a0a2065ce7805fb3f4 Author: Alexander Sverdlin Date: Wed Jan 14 11:45:04 2026 +0100 net: dsa: mxl-gsw1xx: Support R(G)MII slew rate configuration Support newly introduced maxlinear,slew-rate-txc and maxlinear,slew-rate-txd device tree properties to configure R(G)MII interface pins' slew rate. It might be used to reduce the radiated emissions. Reviewed-by: Daniel Golle Tested-by: Daniel Golle Signed-off-by: Alexander Sverdlin Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20260114104509.618984-3-alexander.sverdlin@siemens.com Signed-off-by: Jakub Kicinski commit 4cc265663da54944b22fa012e506592eab146388 Author: Alexander Sverdlin Date: Wed Jan 14 11:45:03 2026 +0100 dt-bindings: net: dsa: lantiq,gswip: add MaxLinear R(G)MII slew rate Add new maxlinear,slew-rate-txc and maxlinear,slew-rate-txd uint32 properties. The properties are only applicable for ports in R(G)MII mode and allow for slew rate reduction in comparison to "normal" default configuration with the purpose to reduce radiated emissions. Signed-off-by: Alexander Sverdlin Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260114104509.618984-2-alexander.sverdlin@siemens.com Signed-off-by: Jakub Kicinski commit 8f762b2e88398f14ceec2e0c8919696bd9e6b07b Merge: b4e486e2c46f75 f062e8e2510232 Author: Jakub Kicinski Date: Mon Jan 19 09:56:46 2026 -0800 Merge branch 'ipv6-more-data-race-annotations' Eric Dumazet says: ==================== ipv6: more data-race annotations Inspired by one unrelated syzbot report. This series adds missing (and boring) data-race annotations in IPv6. Only the first patch adds sysctl_ipv6_flowlabel group to speedup ip6_make_flowlabel() a bit. ==================== Link: https://patch.msgid.link/20260115094141.3124990-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit f062e8e25102324364aada61b8283356235bc3c1 Author: Eric Dumazet Date: Thu Jan 15 09:41:41 2026 +0000 ipv6: annotate data-races in net/ipv6/route.c sysctls are read while their values can change, add READ_ONCE() annotations. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260115094141.3124990-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad Author: Eric Dumazet Date: Thu Jan 15 09:41:40 2026 +0000 ipv6: exthdrs: annotate data-race over multiple sysctl Following four sysctls can change under us, add missing READ_ONCE(). - ipv6.sysctl.max_dst_opts_len - ipv6.sysctl.max_dst_opts_cnt - ipv6.sysctl.max_hbh_opts_len - ipv6.sysctl.max_hbh_opts_cnt Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit 12eddc68574441b7fe319cf7726f1218f80e4e2b Author: Eric Dumazet Date: Thu Jan 15 09:41:39 2026 +0000 ipv6: annotate data-races around sysctl.ip6_rt_gc_interval Add READ_ONCE() on lockless reads of net->ipv6.sysctl.ip6_rt_gc_interval Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260115094141.3124990-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5ade47c974b46eb2a1279185962a0ffa15dc5450 Author: Eric Dumazet Date: Thu Jan 15 09:41:38 2026 +0000 ipv6: annotate data-races over sysctl.flowlabel_reflect Add missing READ_ONCE() when reading ipv6.sysctl.flowlabel_reflect, as its value can be changed under us. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260115094141.3124990-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d Author: Eric Dumazet Date: Thu Jan 15 09:41:37 2026 +0000 ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() Add missing READ_ONCE() when reading sysctl values. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3681282530e68a507dfd8cb58f04a10b41282ab3 Author: Eric Dumazet Date: Thu Jan 15 09:41:36 2026 +0000 ipv6: annotate date-race in ipv6_can_nonlocal_bind() Add a missing READ_ONCE(), and add const qualifiers to the two parameters. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260115094141.3124990-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit ded139b59b5df3c8dbeb2d63685efdc715fc4434 Author: Eric Dumazet Date: Thu Jan 15 09:41:35 2026 +0000 ipv6: annotate data-races from ip6_make_flowlabel() Use READ_ONCE() to read sysctl values in ip6_make_flowlabel() and ip6_make_flowlabel() Add a const qualifier to 'struct net' parameters. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260115094141.3124990-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit e82a347d92d14260d1e2cf121a25e0458b1abbf7 Author: Eric Dumazet Date: Thu Jan 15 09:41:34 2026 +0000 ipv6: add sysctl_ipv6_flowlabel group Group together following struct netns_sysctl_ipv6 fields: - flowlabel_consistency - auto_flowlabels - flowlabel_state_ranges After this patch, ip6_make_flowlabel() uses a single cache line to fetch auto_flowlabels and flowlabel_state_ranges (instead of two before the patch). Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260115094141.3124990-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 962ae6892d8bd208b2d1e2b358f07551ddc8d32f Author: Anthony Pighin (Nokia) Date: Fri Jan 16 15:31:26 2026 +0000 vfio/pci: Lock upstream bridge for vfio_pci_core_disable() The commit 7e89efc6e9e4 ("Lock upstream bridge for pci_reset_function()") added locking of the upstream bridge to the reset function. To catch paths that are not properly locked, the commit 920f6468924f ("Warn on missing cfg_access_lock during secondary bus reset") added a warning if the PCI configuration space was not locked during a secondary bus reset request. When a VFIO PCI device is released from userspace ownership, an attempt to reset the PCI device function may be made. If so, and the upstream bridge is not locked, the release request results in a warning: pcieport 0000:00:00.0: unlocked secondary bus reset via: pci_reset_bus_function+0x188/0x1b8 Add missing upstream bridge locking to vfio_pci_core_disable(). Fixes: 7e89efc6e9e4 ("PCI: Lock upstream bridge for pci_reset_function()") Signed-off-by: Anthony Pighin Link: https://lore.kernel.org/r/BN0PR08MB695171D3AB759C65B6438B5D838DA@BN0PR08MB6951.namprd08.prod.outlook.com Signed-off-by: Alex Williamson commit fab06e956fce42f07ad35ca53073504bad2a080f Merge: e5f19b619fa0b6 b703b31ea8cd22 Author: Alex Williamson Date: Mon Jan 19 10:25:24 2026 -0700 Merge tag 'common_phys_vec_via_vfio' into v6.20/vfio/next * Reuse common phys_vec, phase out dma_buf_phys_vec Signed-off-by: Alex Williamson commit 90959cd1b2470491a3f5d8ab943579475b2baccb Merge: 8ca7515d3c76a8 6142b726e6e648 Author: Ilpo Järvinen Date: Mon Jan 19 19:15:12 2026 +0200 Merge branch 'intel-sst' of https://github.com/spandruvada/linux-kernel into for-next commit b703b31ea8cd22c1915cfdd6d8e39bf39ec64c8b Author: Leon Romanovsky Date: Wed Jan 7 11:14:14 2026 +0200 types: reuse common phys_vec type instead of DMABUF open‑coded variant After commit fcf463b92a08 ("types: move phys_vec definition to common header"), we can use the shared phys_vec type instead of the DMABUF‑specific dma_buf_phys_vec, which duplicated the same structure and semantics. Signed-off-by: Leon Romanovsky Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20260107-convert-to-pvec-v1-1-6e3ab8079708@nvidia.com Signed-off-by: Alex Williamson commit 83c10e8dd43628d0bf86486616556cd749a3c310 Author: Matt Whitlock Date: Sun Jan 18 13:36:15 2026 -0500 dm-unstripe: fix mapping bug when there are multiple targets in a table The "unstriped" device-mapper target incorrectly calculates the sector offset on the mapped device when the target's origin is not zero. Take for example this hypothetical concatenation of the members of a two-disk RAID0: linearized: 0 2097152 unstriped 2 128 0 /dev/md/raid0 0 linearized: 2097152 2097152 unstriped 2 128 1 /dev/md/raid0 0 The intent in this example is to create a single device named /dev/mapper/linearized that comprises all of the chunks of the first disk of the RAID0 set, followed by all of the chunks of the second disk of the RAID0 set. This fails because dm-unstripe.c's map_to_core function does its computations based on the sector number within the mapper device rather than the sector number within the target. The bug turns invisible when the target's origin is at sector zero of the mapper device, as is the common case. In the example above, however, what happens is that the first half of the mapper device gets mapped correctly to the first disk of the RAID0, but the second half of the mapper device gets mapped past the end of the RAID0 device, and accesses to any of those sectors return errors. Signed-off-by: Matt Whitlock Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Fixes: 18a5bf270532 ("dm: add unstriped target") commit a5d8b9d94e1863f3ebb7182c238b2c713f6f4efd Author: Chao Yu Date: Fri Jan 16 14:31:15 2026 +0800 f2fs: fix to unlock folio in f2fs_read_data_large_folio() We missed to unlock folio in error path of f2fs_read_data_large_folio(), fix it. With below testcase, it can reproduce the bug. touch /mnt/f2fs/file truncate -s $((1024*1024*1024)) /mnt/f2fs/file f2fs_io setflags immutable /mnt/f2fs/file sync echo 3 > /proc/sys/vm/drop_caches time dd if=/mnt/f2fs/file of=/dev/null bs=1M count=1024 f2fs_io clearflags immutable /mnt/f2fs/file echo 1 > /proc/sys/vm/drop_caches time dd if=/mnt/f2fs/file of=/dev/null bs=1M count=1024 time dd if=/mnt/f2fs/file of=/dev/null bs=1M count=1024 Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fe15bc3d447c5ee61dbea41c9e9a11fa2968d32d Author: Chao Yu Date: Fri Jan 16 14:29:27 2026 +0800 f2fs: fix error path handling in f2fs_read_data_large_folio() In error path of f2fs_read_data_large_folio(), if bio is valid, it may submit bio twice, fix it. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e5f19b619fa0b691ccb537d72240bd20eb72087c Author: Ankit Agrawal Date: Thu Jan 15 20:28:49 2026 +0000 vfio/nvgrace-gpu: register device memory for poison handling The nvgrace-gpu module [1] maps the device memory to the user VA (Qemu) without adding the memory to the kernel. The device memory pages are PFNMAP and not backed by struct page. The module can thus utilize the MM's PFNMAP memory_failure mechanism that handles ECC/poison on regions with no struct pages. The kernel MM code exposes register/unregister APIs allowing modules to register the device memory for memory_failure handling. Make nvgrace-gpu register the GPU memory with the MM on open. The module registers its memory region, the address_space with the kernel MM for ECC handling and implements a callback function to convert the PFN to the file page offset. The callback functions checks if the PFN belongs to the device memory region and is also contained in the VMA range, an error is returned otherwise. Link: https://lore.kernel.org/all/20240220115055.23546-1-ankita@nvidia.com/ [1] Suggested-by: Alex Williamson Suggested-by: Jason Gunthorpe Signed-off-by: Ankit Agrawal Reviewed-by: Jiaqi Yan Link: https://lore.kernel.org/r/20260115202849.2921-3-ankita@nvidia.com Signed-off-by: Alex Williamson commit 205e6d17cdf5b7f7b221bf64be9850eabce429c9 Author: Ankit Agrawal Date: Thu Jan 15 20:28:48 2026 +0000 mm: add stubs for PFNMAP memory failure registration functions Add stubs to address CONFIG_MEMORY_FAILURE disabled. Suggested-by: Alex Williamson Signed-off-by: Ankit Agrawal Link: https://lore.kernel.org/r/20260115202849.2921-2-ankita@nvidia.com Signed-off-by: Alex Williamson commit 1c588bca3bd5b39c93a28a5986bf82ebfb05eec2 Author: David Matlack Date: Wed Jan 14 21:12:52 2026 +0000 vfio: selftests: Drop IOMMU mapping size assertions for VFIO_TYPE1_IOMMU Drop the assertions about IOMMU mappings sizes for VFIO_TYPE1_IOMMU modes (both the VFIO mode and the iommufd compatibility mode). These assertions fail when CONFIG_IOMMUFD_VFIO_CONTAINER is enabled, since iommufd compatibility mode provides different huge page behavior than VFIO for VFIO_TYPE1_IOMMU. VFIO_TYPE1_IOMMU is an old enough interface that it's not worth changing the behavior of VFIO and iommufd to match nor care about the IOMMU mapping sizes. Cc: Jason Gunthorpe Link: https://lore.kernel.org/kvm/20260109143830.176dc279@shazbot.org/ Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20260114211252.2581145-1-dmatlack@google.com Signed-off-by: Alex Williamson commit 080723f4d4c3c6fb0720aae614deb1f30ee9ef2e Author: Alex Mastro Date: Wed Jan 14 10:57:18 2026 -0800 vfio: selftests: Add vfio_dma_mapping_mmio_test Test IOMMU mapping the BAR mmaps created during vfio_pci_device_setup(). All IOMMU modes are tested: vfio_type1 variants are expected to succeed, while non-type1 modes are expected to fail. iommufd compat mode can be updated to expect success once kernel support lands. Native iommufd will not support mapping vaddrs backed by MMIO (it will support dma-buf based MMIO mapping instead). Signed-off-by: Alex Mastro Reviewed-by: David Matlack Tested-by: David Matlack Link: https://lore.kernel.org/r/20260114-map-mmio-test-v3-3-44e036d95e64@fb.com Signed-off-by: Alex Williamson commit 557dbdf6c4e9c2dc3d4a4476c67ef14dca32378d Author: Alex Mastro Date: Wed Jan 14 10:57:17 2026 -0800 vfio: selftests: Align BAR mmaps for efficient IOMMU mapping Update vfio_pci_bar_map() to align BAR mmaps for efficient huge page mappings. The manual mmap alignment can be removed once mmap(!MAP_FIXED) on vfio device fds improves to automatically return well-aligned addresses. Also add MADV_HUGEPAGE, which encourages the kernel to use huge pages (e.g. when /sys/kernel/mm/transparent_hugepage/enabled is set to "madvise"). Drop MAP_FILE from mmap(). It is an ignored compatibility flag. Signed-off-by: Alex Mastro Reviewed-by: David Matlack Tested-by: David Matlack Link: https://lore.kernel.org/r/20260114-map-mmio-test-v3-2-44e036d95e64@fb.com Signed-off-by: Alex Williamson commit 03b7c2d763c907f508edf8c317c0e920ce072a33 Author: Alex Mastro Date: Wed Jan 14 10:57:16 2026 -0800 vfio: selftests: Centralize IOMMU mode name definitions Replace scattered string literals with MODE_* macros in iommu.h. This provides a single source of truth for IOMMU mode name strings. Signed-off-by: Alex Mastro Reviewed-by: David Matlack Tested-by: David Matlack Link: https://lore.kernel.org/r/20260114-map-mmio-test-v3-1-44e036d95e64@fb.com Signed-off-by: Alex Williamson commit ffc987b3bca22ff62f140a8d4960e1b8685972ed Author: Julia Lawall Date: Tue Dec 30 17:41:13 2025 +0100 vfio/mdev: update outdated comment The function add_mdev_supported_type() was renamed mdev_type_add() in commit da44c340c4fe ("vfio/mdev: simplify mdev_type handling"). Update the comment accordingly. Note that just as mdev_type_release() now states that its put pairs with the get in mdev_type_add(), mdev_type_add() already stated that its get pairs with the put in mdev_type_release(). Signed-off-by: Julia Lawall Reviewed-by: Kirti Wankhede Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20251230164113.102604-1-Julia.Lawall@inria.fr Signed-off-by: Alex Williamson commit 83ba6efa711fad83a0fbf02178ad64d3906d8d09 Author: Mark Brown Date: Fri Jan 16 13:23:40 2026 +0000 spi: rockchip: Use plain request_irq() The Rockchip driver has since interrupt support was added used request_threaded_irq() but not actually supplied a threaded handler, handling everything in the primary handler. This is equivalent to just using a plain request_irq(), and since aef30c8d569c (genirq: Warn about using IRQF_ONESHOT without a threaded handler) the current behaviour has triggered a WARN_ON(). Convert to use request_irq(). Reported-by: Aishwarya TCV Reviewed-by: Shawn Lin Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260116-spi-rockchip-threaded-irq-v1-1-c45c3a5a38b1@kernel.org Signed-off-by: Mark Brown commit a1d63493634e98360140027fef49d82b1ff0a267 Author: Petr Hodina Date: Wed Jan 7 12:44:43 2026 +0100 clk: qcom: dispcc-sdm845: Enable parents for pixel clocks Add CLK_OPS_PARENT_ENABLE to MDSS pixel clock sources to ensure parent clocks are enabled during clock operations, preventing potential stability issues during display configuration. Fixes: 81351776c9fb ("clk: qcom: Add display clock controller driver for SDM845") Signed-off-by: Petr Hodina Reviewed-by: Dmitry Baryshkov Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20260107-stability-discussion-v2-1-ef7717b435ff@protonmail.com Signed-off-by: Bjorn Andersson commit df7c440c904f754d8c94863a910d99e7ed8bbda9 Author: Luca Weiss Date: Sat Jun 21 15:19:59 2025 +0200 ARM: dts: qcom: msm8974: Start using rpmpd for power domains Due to historical reasons all msm8974 boards have used the CX power rail as regulator instead of going through the power domain framework. Since rpmpd has gained msm8974 support quite a bit ago, let's start using it and replace all usages of pm8841_s2 (CX), pm8841_s4 (GFX) and for the boards using pma8084 pma8084_s2 (CX), pma8084_s7 (GFX). For reference, downstream is using GFX power rail as parent-supply for mmcc's OXILI_GDSC GDSC which then is used for GPU, but nothing there is modelled upstream. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250621-msm8974-rpmpd-switch-v1-4-0a2cb303c446@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 4cf8d541f4716444b61a919e3fe6f04814165782 Author: Luca Weiss Date: Sat Jun 21 15:19:58 2025 +0200 ARM: dts: qcom: msm8974: Sort header includes alphabetically Before adding more headers in a random order, let's sort the includes once so that's done. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250621-msm8974-rpmpd-switch-v1-3-0a2cb303c446@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 118ba36e446c01e3cd34b3eedabf1d9436525e1d Author: Mikulas Patocka Date: Mon Jan 19 15:06:02 2026 +0100 dm-integrity: fix recalculation in bitmap mode There's a logic quirk in the handling of suspend in the bitmap mode: This is the sequence of calls if we are reloading a dm-integrity table: * dm_integrity_ctr reads a superblock with the flag SB_FLAG_DIRTY_BITMAP set. * dm_integrity_postsuspend initializes a journal and clears the flag SB_FLAG_DIRTY_BITMAP. * dm_integrity_resume sees the superblock with SB_FLAG_DIRTY_BITMAP set - thus it interprets the journal as if it were a bitmap. This quirk causes recalculation problem if the user increases the size of the device in the bitmap mode. Fix this by reading a fresh copy on the superblock in dm_integrity_resume. This commit also fixes another logic quirk - the branch that sets bitmap bits if the device was extended should only be executed if the flag SB_FLAG_DIRTY_BITMAP is set. Signed-off-by: Mikulas Patocka Tested-by: Ondrej Kozina Fixes: 468dfca38b1a ("dm integrity: add a bitmap mode") Cc: stable@vger.kernel.org commit 929fde5e8457ac9af0ab63b59009102de4a08704 Author: Eric Farman Date: Wed Dec 17 04:01:07 2025 +0100 KVM: s390: vsie: retry SIE when unable to get vsie_page SIE may exit because of pending host work, such as handling an interrupt, in which case VSIE rewinds the guest PSW such that it is transparently resumed (see Fixes tag). Unlike those other places that return rc=0, this return leaves the guest PSW in place, requiring the guest to handle a spurious intercept. This showed up when testing heavy I/O workloads, when multiple vcpus attempted to dispatch the same SIE block and incurred failures inserting them into the radix tree. Fixes: 33a729a1770b ("KVM: s390: vsie: retry SIE instruction on host intercepts") Signed-off-by: Eric Farman Reviewed-by: Christoph Schlameuss Reviewed-by: Claudio Imbrenda [frankja@linux.ibm.com: Replaced commit message as agreed on the list] Signed-off-by: Janosch Frank commit 37fbc1ab0f225d23f0839260a11375b4f1f7cf8c Author: Andy Shevchenko Date: Mon Jan 12 21:21:26 2026 +0100 spi: Drop duplicate device_set_node() call The SPI core provides the default fwnode for the controller, assigned by device_set_node(). No need to repeat it in the driver. Tested-by: Benoît Monin # dw mobileye Reviewed-by: Geert Uytterhoeven # renesas Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260112203534.4186261-5-andriy.shevchenko@linux.intel.com Reviewed-by: Linus Walleij Signed-off-by: Mark Brown commit 103c510e1c6832720059756d155dd13a42baa7ab Author: Andy Shevchenko Date: Mon Jan 12 21:21:25 2026 +0100 spi: Drop duplicate fwnode assignment The SPI core provides the default fwnode for the controller, inherited from the actual (parent) device. No need to repeat it in the driver. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260112203534.4186261-4-andriy.shevchenko@linux.intel.com Reviewed-by: Linus Walleij Signed-off-by: Mark Brown commit 3974a585be78a1dc90a19d5cf1846a99954e3842 Author: Andy Shevchenko Date: Mon Jan 12 21:21:24 2026 +0100 spi: Drop duplicate of_node assignment The SPI core provides the default of_node for the controller, inherited from the actual (parent) device. No need to repeat it in the driver. Acked-by: Heiko Stuebner Reviewed-by: William Zhang Acked-by: Chen-Yu Tsai # sun4i, sun6i Reviewed-by: Cédric Le Goater Reviewed-by: Amelie Delaunay Reviewed-by: Geert Uytterhoeven # renesas Reviewed-by: Martin Blumenstingl Reviewed-by: Patrice Chotard Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260112203534.4186261-3-andriy.shevchenko@linux.intel.com Tested-by: Prajna Rajendra Kumar Reviewed-by: Linus Walleij Signed-off-by: Mark Brown commit f2d1a3318eb1ec860999db48cb8d13b43261624d Author: Andy Shevchenko Date: Mon Jan 12 21:21:23 2026 +0100 spi: Propagate default fwnode to the SPI controller device Most of the SPI controller drivers share the parent's fwnode by explicit assignment. Propagate the default by SPI core, so they may drop that in the code. Only corner cases may require a special treatment and we simply (re)assign the controller's fwnode explicitly (as it's done right now, no changes required for that). Reviewed-by: Charles Keepax Tested-by: Charles Keepax Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260112203534.4186261-2-andriy.shevchenko@linux.intel.com Reviewed-by: Linus Walleij Signed-off-by: Mark Brown commit 20c4701b75a3d6ce09d61e17125aefe77e7eb333 Author: Peng Fan Date: Mon Jan 19 11:48:49 2026 +0800 dt-bindings: regulator: mark regulator-suspend-microvolt as deprecated The Documentation/devicetree/bindings/regulator/regulator.yaml already states in its description that regulator-suspend-microvolt is deprecated, but the schema did not formally mark it as such. Add the `deprecated: true` annotation to regulator-suspend-microvolt so that this is enforced at the schema level. Signed-off-by: Peng Fan Link: https://patch.msgid.link/20260119-regulator-binding-v1-1-e55d33b4c3e3@nxp.com Signed-off-by: Mark Brown commit a18467a50eddbd7c6548b53b25b68e5454ceb587 Author: Runrun Liu Date: Mon Jan 19 10:53:02 2026 +0800 ASoC: realtek: fix misspelling of "minimum" in comments Fix the typo "miniumum" -> "minimum" in comments in rt5659, rt5665, rt5668, and rt5682-i2c codec drivers. This typo is already listed in scripts/spelling.txt by commit 8c3200265787 ("scripts/spelling.txt: add several more common spelling mistakes"). Suggested-by: Cryolitia PukNgae Signed-off-by: Runrun Liu Link: https://patch.msgid.link/3D20FA99934F2891+20260119025302.1288888-1-liurunrun@uniontech.com Signed-off-by: Mark Brown commit 3c5ddd56aa93048314c64533c21e731a44b0f067 Author: Binbin Zhou Date: Sat Jan 17 17:20:15 2026 +0800 ASoC: codecs: es8323: Enable proper DAPM widgets for chip power Remove initialization of the chip power register from the es8323_set_bias_level routine, and add proper DAPM power supply widgets to DAPM, which really should be handled by the DAPM subsystem. Signed-off-by: Binbin Zhou Link: https://patch.msgid.link/db47e56e7c72bb900a84a33ee07d4ffcf0a908a3.1768641428.git.zhoubinbin@loongson.cn Signed-off-by: Mark Brown commit 95814d4b8d478c76505188e45e81682206e41fe6 Author: Binbin Zhou Date: Sat Jan 17 17:18:36 2026 +0800 ASoC: codecs: es8323: Enable proper DAPM widgets for capture ADC Add proper DAPM capture ADC widgets to DAPM, which really should be handled by the DAPM subsystem. Signed-off-by: Binbin Zhou Link: https://patch.msgid.link/9d93040f4cea77054e669c50325e080dffa7a7f1.1768641428.git.zhoubinbin@loongson.cn Signed-off-by: Mark Brown commit 9dd2719a9ad3e18c3a5007466ca5922937bd4c5e Author: Binbin Zhou Date: Sat Jan 17 17:18:35 2026 +0800 ASoC: codecs: es8323: remove DAC enablement write from es8323_set_bias_level Since commit daf855f76a12 ("ASoC: es8323: enable DAPM power widgets for playback DAC"), the DAC is handled by the DAPM subsystem. Remove initialization of the DAC enablement bits from the es8323_set_bias_level routine Signed-off-by: Binbin Zhou Link: https://patch.msgid.link/d2823ad7ae226a83d49bcb860240c0ddc4080f14.1768641428.git.zhoubinbin@loongson.cn Signed-off-by: Mark Brown commit 0cccfe65895d42fdc1f04aae7f85d8189ad80fdf Author: Binbin Zhou Date: Sat Jan 17 17:18:34 2026 +0800 ASoC: codecs: es8323: Replace magic numbers with defined macros According to the manual, add more detailed register bitfield definitions to replace the magic numbers in the register settings in es8323 codec. No functional change intended. Signed-off-by: Binbin Zhou Link: https://patch.msgid.link/7e8953f2d36a86e9d507d6bb01c72b64846e0829.1768641428.git.zhoubinbin@loongson.cn Signed-off-by: Mark Brown commit 4fbd3b2ec04dc6ef93090ec24733a5c5671fb71f Author: Bard Liao Date: Mon Jan 19 17:17:49 2026 +0800 ASoC: soc-acpi-intel-ptl-match: use aggregated endpoint in ptl_rt722_l0_rt1320_l23 The rt722 amp and rt1320 amps are aggregated in this case. Signed-off-by: Bard Liao Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20260119091749.1752088-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 08c09899960118ffb01417242e659eb6cc067d6a Author: Bard Liao Date: Mon Jan 19 17:17:48 2026 +0800 ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated rt722 is aggregated with rt1320 amp in arl_rt722_l0_rt1320_l2 and it is the only audio configuration in the ARL platform. Set .aggregated = 1 to represent the fact and avoid unexpected issue. Signed-off-by: Bard Liao Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20260119091749.1752088-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit be9badced98f89cf5c6f7690f7d9739a213c4502 Author: Eric Biggers Date: Sun Jan 11 13:38:21 2026 -0800 dm-bufio: avoid redundant buffer_tree lookups dm-bufio's map from block number to buffer is organized as a hash table of red-black trees. It does far more lookups in this hash table than necessary: typically one lookup to lock the tree, one lookup to search the tree, and one lookup to unlock the tree. Only one of those lookups is needed. Optimize it to do only the minimum number of lookups. This improves performance. It also reduces the object code size, considering that the redundant hash table lookups were being inlined. For example, the size of the text section of dm-bufio.o decreases from 15599 to 15070 bytes with gcc 15 and x86_64, or from 20652 to 20244 bytes with clang 21 and arm64. Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 1bf7ba4ca342ada012e7ef88274fb306e88917ad Author: Eric Biggers Date: Sun Jan 11 13:38:20 2026 -0800 dm-bufio: merge cache_put() into cache_put_and_wake() Merge cache_put() into its only caller, cache_put_and_wake(). Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 9183c97e7e22591cfd258b5131493d5afcab4b08 Author: Borislav Petkov (AMD) Date: Mon Jan 19 14:49:13 2026 +0100 x86/sev: Rename sev_es_ghcb_handle_msr() to __vc_handle_msr() Forgot to do that during the Secure AVIC review. :-\ No functional changes. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20260119141310.29605-1-bp@kernel.org commit f93bc869825fdba3632ff6ddece4906a6673e679 Author: Christian Brauner Date: Fri Jan 16 15:30:35 2026 +0100 selftests: add dm-verity keyring selftests Add selftests that verify the keyring behaves correctly. For simplicity this works with dm-verity as a module. Signed-off-by: Christian Brauner Signed-off-by: Mikulas Patocka commit 033724b1c627885aed049f775e4b10583d895af6 Author: Christian Brauner Date: Fri Jan 16 15:30:34 2026 +0100 dm-verity: add dm-verity keyring Add a dedicated ".dm-verity" keyring for root hash signature verification, similar to the ".fs-verity" keyring used by fs-verity. By default the keyring is unused retaining the exact same old behavior. For systems that provision additional keys only intended for dm-verity images during boot, the dm_verity.keyring_unsealed=1 kernel parameter leaves the keyring open. We want to use this in systemd as a way add keys during boot that are only used for creating dm-verity devices for later mounting and nothing else. The discoverable disk image (DDI) spec at [1] heavily relies on dm-verity and we would like to expand this even more. This will allow us to do that in a fully backward compatible way. Once provisioning is complete, userspace restricts and activates it for dm-verity verification. If userspace fully seals the keyring then it gains the guarantee that no new keys can be added. Link: https://uapi-group.org/specifications/specs/discoverable_partitions_specification [1] Co-developed-by: Aleksa Sarai Signed-off-by: Aleksa Sarai Signed-off-by: Christian Brauner Signed-off-by: Mikulas Patocka commit 744905705113a6ab4c38127f18cc0d71594cfaec Author: FUJITA Tomonori Date: Wed Dec 3 09:04:11 2025 +0900 rust: debugfs: Use kernel Atomic type in docs example Switch the read_callback_file() documentation example from core::sync::atomic::AtomicU32 to the kernel's Atomic because Rust native atomics are not allowed to use in kernel. Signed-off-by: FUJITA Tomonori Reviewed-by: Boqun Feng Link: https://patch.msgid.link/20251203000411.30434-1-fujita.tomonori@gmail.com [ Use kernel vertical import style. - Danilo ] Signed-off-by: Danilo Krummrich commit ab4c3dcf9a71582503b4fb25aeab884c696cab25 Author: T.J. Mercier Date: Fri Jan 16 11:05:12 2026 -0800 dma-buf: Remove DMA-BUF sysfs stats Commit bdb8d06dfefd ("dmabuf: Add the capability to expose DMA-BUF stats in sysfs") added dmabuf statistics to sysfs in 2021 under CONFIG_DMABUF_SYSFS_STATS. After being used in production, performance problems were discovered leading to its deprecation in 2022 in commit e0a9f1fe206a ("dma-buf: deprecate DMABUF_SYSFS_STATS"). Some of the problems with this interface were discussed in my LPC 2025 talk. [1][2] Android was probably the last user of the interface, which has since been migrated to use the dmabuf BPF iterator [3] to obtain the same information more cheaply. As promised in that series, now that the longterm stable 6.18 kernel has been released let's remove the sysfs dmabuf statistics from the kernel. [1] https://www.youtube.com/watch?v=D83qygudq9c [2] https://lpc.events/event/19/contributions/2118/ [3] https://lore.kernel.org/all/20250522230429.941193-1-tjmercier@google.com/ Signed-off-by: T.J. Mercier Reviewed-by: Christian König Signed-off-by: Sumit Semwal Link: https://patch.msgid.link/20260116190517.3268458-1-tjmercier@google.com commit 3c227be9065902f496a748068e0b2b6bd6f3f0a6 Author: Eric Chanudet Date: Fri Jan 16 15:05:39 2026 -0500 dma-buf: system_heap: account for system heap allocation in memcg The system dma-buf heap lets userspace allocate buffers from the page allocator. However, these allocations are not accounted for in memcg, allowing processes to escape limits that may be configured. Pass __GFP_ACCOUNT for system heap allocations, based on the dma_heap.mem_accounting parameter, to use memcg and account for them. Signed-off-by: Eric Chanudet Reviewed-by: T.J. Mercier Reviewed-by: Maxime Ripard Signed-off-by: Sumit Semwal Link: https://patch.msgid.link/20260116-dmabuf-heap-system-memcg-v3-2-ecc6b62cc446@redhat.com commit bb33013bdd238129c8f8f29ed2e9bbdfa8caa643 Author: Eric Chanudet Date: Fri Jan 16 15:05:38 2026 -0500 dma-buf: heaps: add parameter to account allocations using cgroup Add a parameter to enable dma-buf heaps allocation accounting using cgroup for heaps that implement it. It is disabled by default as doing so incurs caveats based on how memcg currently accounts for shared buffers. Signed-off-by: Eric Chanudet Reviewed-by: T.J. Mercier Reviewed-by: Christian König Reviewed-by: Maxime Ripard Signed-off-by: Sumit Semwal Link: https://patch.msgid.link/20260116-dmabuf-heap-system-memcg-v3-1-ecc6b62cc446@redhat.com commit 436ee609df7da5671ae5a717d1df867313868baf Author: Lukas Bulwahn Date: Mon Jan 19 10:38:35 2026 +0100 MAINTAINERS: Adjust vdso file entry in INTEL SGX Commit 693c819fedcd ("x86/entry/vdso: Refactor the vdso build") moves the vdso sources into common, vdso32, and vdso64 subdirectories, but misses to adjust the file entry in the INTEL SGX section of the MAINTAINERS file. Adjust the file entry in accordance with the file movement of the commit above. Signed-off-by: Lukas Bulwahn Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260119093835.114554-1-lukas.bulwahn@redhat.com commit 22ce09ce1af574747fce072c3f62c29c440538d7 Author: Jason-JH Lin Date: Fri Oct 31 23:56:37 2025 +0800 soc: mediatek: mtk-cmdq: Add mminfra_offset adjustment for DRAM addresses Since GCE has been moved to MMINFRA in MT8196, all transactions from MMINFRA to DRAM will have their addresses adjusted by subtracting a mminfra_offset. Therefore, the CMDQ helper driver needs to get the mminfra_offset value of the SoC from cmdq_mbox_priv of cmdq_pkt and then add it to the DRAM address when generating instructions to ensure GCE accesses the correct DRAM address. CMDQ users can then call CMDQ helper APIs as usual. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Acked-by: Jassi Brar Acked-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 40dc5bbad63b5f60dd2e69a32def1a2673cba09e Author: Jason-JH Lin Date: Fri Oct 31 23:56:36 2025 +0800 soc: mediatek: mtk-cmdq: Extend cmdq_pkt_write API for SoCs without subsys ID This patch extends the cmdq_pkt_write API to support SoCs that do not have subsys ID mapping by introducing new register write APIs: - cmdq_pkt_write_pa() and cmdq_pkt_write_subsys() replace cmdq_pkt_write() - cmdq_pkt_write_mask_pa() and cmdq_pkt_write_mask_subsys() replace cmdq_pkt_write_mask() To ensure consistent function pointer interfaces, both cmdq_pkt_write_pa() and cmdq_pkt_write_subsys() provide subsys and pa_base parameters. This unifies how register writes are invoked, regardless of whether subsys ID is supported by the device. All GCEs support writing registers by PA (with mask) without subsys, but this requires extra GCE instructions to convert the PA into a GCE readable format, reducing performance compared to using subsys directly. Therefore, subsys is preferred for register writes when available. API documentation and function pointer declarations in cmdq_client_reg have been updated. The original write APIs will be removed after all CMDQ users transition to the new interfaces. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Acked-by: Jassi Brar Acked-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 4bf783d8415cc397334b375a05f0b2321fc6c319 Author: Jason-JH Lin Date: Fri Oct 31 23:56:35 2025 +0800 soc: mediatek: mtk-cmdq: Add pa_base parsing for hardware without subsys ID support When GCE executes instructions, it typically locates the corresponding hardware register using the subsys ID. For hardware that does not support subsys ID, the subsys ID is set to an invalid value, and the physical address must be used to generate GCE instructions. The main advantage of using subsys ID is to reduce the number of instructions. Without subsys ID, an additional `ASSIGN` instruction is needed to assign the high bytes of the physical address, which can impact performance if too many instructions are required. However, if the hardware does not support subsys ID, using the physical address is the only option to achieve the same functionality. This commit adds a pa_base parsing flow to the cmdq_client_reg structure to handle hardware without subsys ID support. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Acked-by: Jassi Brar Acked-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit c775b23b1f78626daca804bd26f1460368f20406 Author: Jason-JH Lin Date: Fri Oct 31 23:56:34 2025 +0800 soc: mediatek: mtk-cmdq: Add cmdq_get_mbox_priv() in cmdq_pkt_create() Add cmdq_get_mbox_priv() in cmdq_pkt_create() to ensure getting private data before generating GCE instructions. Signed-off-by: Jason-JH Lin Acked-by: Jassi Brar Acked-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 5ea617e818333a2078dadc11e5734886e39901d0 Author: Jason-JH Lin Date: Fri Oct 31 23:56:33 2025 +0800 mailbox: mtk-cmdq: Add driver data to support for MT8196 MT8196 has 2 new hardware configuration compared with the previous SoC, which correspond to the 2 new driver data: 1. mminfra_offset: For GCE data path control Since GCE has been moved into mminfra, GCE needs to append the mminfra offset to the DRAM address when accessing the DRAM. 2. gce_vm: For GCE hardware virtualization control Currently, the first version of the mt8196 mailbox controller only requires setting the VM-related registers to enable the permissions of a host VM. Signed-off-by: Jason-JH Lin Reviewed-by: CK Hu Reviewed-by: AngeloGioacchino Del Regno Acked-by: Jassi Brar Acked-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 1c1874843bc43d9f333d441af00f61ece2373e5d Author: Jason-JH Lin Date: Fri Oct 31 23:56:32 2025 +0800 mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction The GCE in MT8196 is placed in MMINFRA and requires all addresses in GCE instructions for DRAM transactions to be IOVA. Due to MMIO, if the GCE needs to access a hardware register at 0x1000_0000, but the SMMU is also mapping a DRAM block at 0x1000_0000, the MMINFRA will not know whether to write to the hardware register or the DRAM. To solve this, MMINFRA treats addresses greater than 2G as data paths and those less than 2G as config paths because the DRAM start address is currently at 2G (0x8000_0000). On the data path, MMINFRA remaps DRAM addresses by subtracting 2G, allowing SMMU to map DRAM addresses less than 2G. For example, if the DRAM start address 0x8000_0000 is mapped to IOVA=0x0, when GCE accesses IOVA=0x0, it must add a 2G offset to the address in the GCE instruction. MMINFRA will then see it as a data path (IOVA >= 2G) and subtract 2G, allowing GCE to access IOVA=0x0. Since the MMINFRA remap subtracting 2G is done in hardware and cannot be configured by software, the address of DRAM in GCE instruction must always add 2G to ensure proper access. After that, the shift functions do more than just shift addresses, so the APIs were renamed to cmdq_convert_gce_addr() and cmdq_revert_gce_addr(). This 2G adjustment is referred to as mminfra_offset in the CMDQ driver. CMDQ helper can get the mminfra_offset from the cmdq_mbox_priv of cmdq_pkt and add the mminfra_offset to the DRAM address in GCE instructions. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Acked-by: Jassi Brar Acked-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 7005b7cb2fff9081a6b1738b84a8ea12a6781fb3 Author: Jason-JH Lin Date: Fri Oct 31 23:56:31 2025 +0800 mailbox: mtk-cmdq: Add GCE hardware virtualization configuration The GCE hardware virtualization configuration supports the isolation of GCE hardware resources across different OS environments. Each OS is treated as a virtual machine (VM) for GCE purposes. There are 6 VMs and 1 host VM. The host VM has main control over the GCE virtualization settings for all VMs. To properly access the GCE thread registers, it is necessary to configure access permissions for specific GCE threads assigned to different VMs. Currently, since only the host VM is being used, it is required to enable access permissions for all GCE threads for the host VM. There are 2 VM configurations: 1. VM_ID_MAP There are 4 registers to allocate 32 GCE threads across different VMs: VM_ID_MAP0 for threads 0-9, VM_ID_MAP1 for threads 10-19, VM_ID_MAP2 for threads 20-29, and VM_ID_MAP3 for threads 30-31. Each thread has a 3-bit configuration, where setting all bits to 1 configures the thread for the host VM. 2. VM_CPR_GSIZE It is used to allocate the CPR SRAM size to each VM. Each VM has 4-bit configuration, where setting bit 0-3 to configures the size of host VM. This setting must be configured before the VM configuration to prevent resource leakage. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Acked-by: Jassi Brar Acked-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit 266f35701b6f7ddd9521310eb5add01001d4a614 Author: Jason-JH Lin Date: Fri Oct 31 23:56:30 2025 +0800 mailbox: mtk-cmdq: Add cmdq private data to cmdq_pkt for generating instruction Add the cmdq_mbox_priv structure to store the private data of GCE, such as the shift bits of the physical address. Then, include the cmdq_mbox_priv structure within the cmdq_pkt structure. This allows CMDQ users to utilize the private data in cmdq_pkt to generate GCE instructions when needed. Additionally, having cmdq_mbox_priv makes it easier to expand and reference other GCE private data in the future. Add cmdq_get_mbox_priv() for CMDQ users to get all the private data into the cmdq_mbox_priv of the cmdq_pkt. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Acked-by: Jassi Brar Acked-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit a00e771c2261e566ebb244342a4172ff2e94b031 Merge: 7edf6f7ef5345e 057edc58aa5926 Author: Rafael J. Wysocki Date: Mon Jan 19 12:54:43 2026 +0100 Merge back ACPI power management material for 6.20 commit 25556c12f4d3edc2f614f752f204c3941697b30a Author: AngeloGioacchino Del Regno Date: Thu Jan 15 13:56:24 2026 +0100 arm64: dts: mediatek: mt8192: Rename mt8192-afe-pcm to audio-controller Device tree nodes should have generic names, and this one doesn't. Rename the mt8192-afe-pcm subnode of audsys to `audio-controller`. This commit brings no functional changes, but resolves dtbs_check warnings. Acked-by: Rob Herring (Arm) Signed-off-by: AngeloGioacchino Del Regno commit a8e3d66ff5c0c37e7c10b3e486d2c5047bf9cf2b Author: AngeloGioacchino Del Regno Date: Thu Jan 15 13:56:23 2026 +0100 dt-bindings: arm: mediatek: audsys: Support mt8192-audsys variant Add support for the mediatek,mt8192-audsys compatible, which uses a different audio controller (mt8192-afe-pcm) compared to mt8183 and mt2701. This resolves a dtbs_check warning on all MT8192 devicetrees. Reviewed-by: Rob Herring (Arm) Signed-off-by: AngeloGioacchino Del Regno commit 1c21f240fbc1e47b94e68abfa2da2c01ed29a74d Author: Matt Coster Date: Tue Jan 13 10:16:44 2026 +0000 drm/imagination: Warn or error on unsupported hardware Gate the use of unsupported hardware behind a new module parameter (exp_hw_support). Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260113-device-support-info-v1-6-91e5db7f7294@imgtec.com Signed-off-by: Matt Coster commit 3519e9ea13b49e7b37a20fa3a11a9e1fc5441af5 Author: Matt Coster Date: Tue Jan 13 10:16:43 2026 +0000 drm/imagination: KUnit test for pvr_gpuid_decode_string() This is a nice self-contained function to serve as the basis of our first KUnit tests. Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260113-device-support-info-v1-5-91e5db7f7294@imgtec.com Signed-off-by: Matt Coster commit 3bf74137340a1ced1566f4f9e9c2f08cba7bdf7c Author: Alexandru Dadu Date: Tue Jan 13 10:16:42 2026 +0000 drm/imagination: Add gpuid module parameter The "gpuid" module parameter is used to override the gpuid read from a hardware register and is useful for testing the loading of different firmware (including processing of the firmware header) without having the hardware to hand. Signed-off-by: Alexandru Dadu Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260113-device-support-info-v1-4-91e5db7f7294@imgtec.com Signed-off-by: Matt Coster commit ee184ab0ffb6cdd20527aa3b3729b824f52d3cd7 Author: Matt Coster Date: Tue Jan 13 10:16:41 2026 +0000 drm/imagination: Load FW trace config at init We have a module parameter to set the initial group mask before debugfs is available for any specific device, but don't currently use that value when initialising devices. Use the module parameter value as the initial value for group_mask. Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260113-device-support-info-v1-3-91e5db7f7294@imgtec.com Signed-off-by: Matt Coster commit c6978643ea1c74c913f925c08ef9bafbdc031a04 Author: Matt Coster Date: Tue Jan 13 10:16:40 2026 +0000 drm/imagination: Validate fw trace group_mask This value can come from two places: a module parameter or a debugfs file. In both cases, validate it early to provide feedback to userspace at the time the value is set instead of deferring until the value is used. Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260113-device-support-info-v1-2-91e5db7f7294@imgtec.com Signed-off-by: Matt Coster commit a331631496a0af9a6f4e7e1860983afd8b1bb013 Author: Matt Coster Date: Tue Jan 13 10:16:39 2026 +0000 drm/imagination: Simplify module parameters We had a whole load of bloaty infrastructure to deal with module parameters in a way that's wholly unnecessary. Strip it all back to basics to make adding new parameters less of a headache. Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20260113-device-support-info-v1-1-91e5db7f7294@imgtec.com Signed-off-by: Matt Coster commit 16de4c6a8fe9ff497ca1aba33ef0dbee09f11952 Author: Bartosz Golaszewski Date: Thu Dec 4 10:44:12 2025 +0100 reset: gpio: suppress bind attributes in sysfs This is a special device that's created dynamically and is supposed to stay in memory forever. We also currently don't have a devlink between it and the actual reset consumer. Suppress sysfs bind attributes so that user-space can't unbind the device because - as of now - it will cause a use-after-free splat from any user that puts the reset control handle. Fixes: cee544a40e44 ("reset: gpio: Add GPIO-based reset controller") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Philipp Zabel commit 8c97a6ddc95690a938ded44b4e3202f03f15078c Author: Jori Koolstra Date: Mon Dec 8 16:39:47 2025 +0100 minix: Add required sanity checking to minix_check_superblock() The fs/minix implementation of the minix filesystem does not currently support any other value for s_log_zone_size than 0. This is also the only value supported in util-linux; see mkfs.minix.c line 511. In addition, this patch adds some sanity checking for the other minix superblock fields, and moves the minix_blocks_needed() checks for the zmap and imap also to minix_check_super_block(). This also closes a related syzbot bug report. Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl Reviewed-by: Jan Kara Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2 Signed-off-by: Christian Brauner commit 5a4e4e30f6dc4d2a68eec08257128906572f3346 Author: Dmitry Baryshkov Date: Wed Jan 7 20:15:07 2026 +0200 drm/debug: don't register files for unsupported HDMI InfoFrames Having debugfs files for the InfoFrames that are not supported by the driver is confusing, stop registering those in the debugfs. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-10-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit ae219fdc952c315182b471f5aa71b379584b70ca Author: Dmitry Baryshkov Date: Wed Jan 7 20:15:06 2026 +0200 drm/display: bridge_connector: dynamically generate HDMI callbacks The rest of the DRM framework uses presence of the callbacks to check if the particular infoframe is supported. Register HDMI callbacks dynamically, basing on the corresponding drm_bridge ops. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-9-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 4fc30c2c5c61db88e3d6644bd3dd2032ec4bee06 Author: Dmitry Baryshkov Date: Wed Jan 7 20:15:05 2026 +0200 drm/display: hdmi_state_helper: don't generate unsupported InfoFrames There is little point in generating InfoFrames which are not supported by the driver. Skip generating the unsupported InfoFrames, making sure that the kernel never tries to write the unsupported frame. As there are no remaining usecases, change write_infoframe / clear_infoframe helpers return an error if the corresponding callback is NULL. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-8-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 1d8847f457648ed4932019dcd3081bc27bcea936 Author: Dmitry Baryshkov Date: Wed Jan 7 20:15:04 2026 +0200 drm/display: hdmi_state_helper: reject Audio IF updates if it's not supported Updating the InfoFrame if it can not be sent over the wire makes no sense. Change drm_atomic_helper_connector_hdmi_update_audio_infoframe() and drm_atomic_helper_connector_hdmi_clear_audio_infoframe() to return an error if Audio InfoFrame callbacks are not implemented. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-7-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit e802c783be94bf71541a7e2ac8b1b5486aad10db Author: Dmitry Baryshkov Date: Wed Jan 7 20:15:03 2026 +0200 drm/display: hdmi_state_helper: split InfoFrame functions per type Havign a single set of InfoFrame callbacks doesn't provide enough information to the DRM framework about the InfoFrame types that are actually supported. Also it's not really future-proof: it provides a way to program only a single Vendor-Specific frame, however we might need to support multiple VSIs at the same time (e.g. HDMI vs HDMI Forum VSIs). Provide separate sets of callbacks, one per the InfoFrame type. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-6-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit b626b1a1c9ccadd8861870a2a450f02e0c61ab88 Author: Dmitry Baryshkov Date: Wed Jan 7 20:15:02 2026 +0200 drm/bridge: refactor HDMI InfoFrame callbacks Having only a single set of callbacks, hdmi_clear_infoframe and hdmi_write_infoframe, bridge drivers don't have an easy way to signal to the DRM framework, which InfoFrames are actually supported by the hardware and by the driver and which are not. Also, it makes it extremely easy for HDMI bridge drivers to skip implementing the seemingly required InfoFrames (e.g. HDMI VSI). Last, but not least, those callbacks take a single 'type' parameter, which makes it impossible to implement support for multiple VSIs (which will be required once we start working on HDMI Forum VSI). Split the callbacks into a per-InfoFrame-kind pairs, letting the bridge drivers actually signal supported features. The implementation follows the overall drm_bridge design, where the bridge has a single drm_bridge_funcs implementation and signals, which functions are to be called using the drm_bridge->ops flags. The AVI and HDMI VSI are assumed to be required for a normal HDMI operation (with the drivers getting a drm_warn_once() stub implementation if one is missing). The Audio InfoFrame is handled by the existing DRM_BRIDGE_OP_HDMI_AUDIO, while the SPD and HDR DRM InfoFrames got new drm_bridge_ops values. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-5-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit afc399f7a5ea7bf405b2ef85c7470529b1a9e47c Author: Dmitry Baryshkov Date: Wed Jan 7 20:15:01 2026 +0200 drm/connector: make clear_infoframe callback mandatory for HDMI connectors We already require both hdmi_write_infoframe and hdmi_clear_infoframe for bridges implementing DRM_BRIDGE_OP_HDMI. It makes sense to require the clear_infoframes callback for HDMI connectors utilizing drmm_connector_hdmi_init(). Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-4-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 638409979c5f7d3155afcded67532003e07a7d0e Author: Dmitry Baryshkov Date: Wed Jan 7 20:15:00 2026 +0200 drm/sun4i: hdmi_enc: implement clear_infoframe stub In preparation to making clear_infoframes callbacks required, add a stub to the sun4i driver. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-3-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 3a4ceb89a9723088615ea1c960fc589f87caddb7 Author: Dmitry Baryshkov Date: Wed Jan 7 20:14:59 2026 +0200 drm/vc4: hdmi: implement clear_infoframe Implement the clear_infoframe callback, disabling corresponding InfoFrame type. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-2-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 7436a87db99d57196c49d10de35f41531993d5f1 Author: Dmitry Baryshkov Date: Wed Jan 7 20:14:58 2026 +0200 drm/tests: hdmi: check the infoframes behaviour Verify the InfoFrames behaviour. Check that reporting InfoFrame as unsupported doesn't result in a commit error. Also check that HDR and Audio InfoFrames are not triggered if corresponding features are not enabled. Acked-by: Maxime Ripard Link: https://patch.msgid.link/20260107-limit-infoframes-2-v4-1-213d0d3bd490@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 59cac9d52b885cbeba45fa455417b03dfb03eaa7 Author: UYeol Jo Date: Mon Jan 12 06:01:26 2026 +0900 selftests/x86: Clean up sysret_rip coding style Tidy up sysret_rip style (cast spacing, main(void), const placement). No functional change intended. Signed-off-by: UYeol Jo Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260111210126.74752-1-jouyeol8739@gmail.com commit 5ec64aa7fef37c84507eab43fa29985a17db85ed Author: Geert Uytterhoeven Date: Thu Jan 15 15:26:22 2026 +0100 mtd: rawnand: sunxi: Convert to common field_{get,prep}() helpers Drop the driver-specific field_get() and field_prep() macros, in favor of the globally available variants from . Signed-off-by: Geert Uytterhoeven Acked-by: Miquel Raynal Signed-off-by: Miquel Raynal commit b81db376444244671a86b66e974d705327e433de Merge: 954fc7ac15c18f 24d479d26b25bc Author: Borislav Petkov (AMD) Date: Mon Jan 19 12:03:56 2026 +0100 Merge tag 'v6.19-rc6' into tip-x86-cleanups Pick up upstream work and d9b40d7262a2 ("selftests/x86: Add selftests include path for kselftest.h after centralization") especially which is a build fix needed for a selftests cleanup coming ontop of this. Signed-off-by: Borislav Petkov (AMD) commit 4d9024d14d1bacb097f33ef7d3ed1696d6a46c88 Author: Yuanfang Zhang Date: Wed Dec 3 20:43:09 2025 -0800 coresight-tnoc: Add runtime PM support for Interconnect TNOC This patch adds runtime power management support for platform-based CoreSight Interconnect TNOC (ITNOC) devices. It introduces suspend and resume callbacks to manage the APB clock (`pclk`) during device runtime transitions. Signed-off-by: Yuanfang Zhang Reviewed-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251203-itnoc-v5-3-5b97c63f2268@oss.qualcomm.com commit 5799dee92dc244d750043373bf2f634e13398d52 Author: Yuanfang Zhang Date: Wed Dec 3 20:43:08 2025 -0800 coresight-tnoc: add platform driver to support Interconnect TNOC This patch adds platform driver support for the CoreSight Interconnect TNOC, Interconnect TNOC is a CoreSight link that forwards trace data from a subsystem to the Aggregator TNOC. Compared to Aggregator TNOC, it does not have aggregation and ATID functionality. Key changes: - Add platform driver `coresight-itnoc` with device tree match support. - Refactor probe logic into a common `_tnoc_probe()` function. - Conditionally initialize ATID only for AMBA-based TNOC blocks. Signed-off-by: Yuanfang Zhang Reviewed-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251203-itnoc-v5-2-5b97c63f2268@oss.qualcomm.com commit 2b3625a83245e414a0a7abe3906a9972a40b1940 Author: Yuanfang Zhang Date: Wed Dec 3 20:43:07 2025 -0800 dt-bindings: arm: qcom: Add Coresight Interconnect TNOC Add device tree binding for Qualcomm Coresight Interconnect Trace Network On Chip (ITNOC). This TNOC acts as a CoreSight graph link that forwards trace data from a subsystem to the Aggregator TNOC, without aggregation or ATID functionality. Signed-off-by: Yuanfang Zhang Reviewed-by: Rob Herring (Arm) Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251203-itnoc-v5-1-5b97c63f2268@oss.qualcomm.com commit 779c59274d03cc5c07237a2c845dfb71cff77705 Author: Alexander Usyskin Date: Thu Jan 15 07:22:37 2026 +0200 mtd: intel-dg: Fix accessing regions before setting nregions The regions array is counted by nregions, but it's set only after accessing it: [] UBSAN: array-index-out-of-bounds in drivers/mtd/devices/mtd_intel_dg.c:750:15 [] index 0 is out of range for type ' [*]' Fix it by also fixing an undesired behavior: the loop silently ignores ENOMEM and continues setting the other entries. CC: Gustavo A. R. Silva CC: Raag Jadav Reported-by: Jani Partanen Closes: https://lore.kernel.org/all/caca6c67-4f1d-49f1-948f-e63b6b937b29@sotapeli.fi Fixes: ceb5ab3cb646 ("mtd: add driver for intel graphics non-volatile memory device") Signed-off-by: Lucas De Marchi Signed-off-by: Alexander Usyskin Reviewed-by: Raag Jadav Signed-off-by: Miquel Raynal commit 90541270967837c996631faa94e43d465e2a20c7 Author: Akhila YS Date: Tue Jan 6 15:25:43 2026 +0000 dt-bindings: mtd: st,spi-fsm: convert to DT schema Convert STMicroelectronics SPI FSM Serial NOR Flash Controller binding to DT Schema. Signed-off-by: Akhila YS Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 5f68fb7ead5c39d03bab98d5bcb1ddba9ca51b2d Author: Rob Herring (Arm) Date: Mon Jan 5 15:06:43 2026 -0600 mtd: rawnand: atmel: Defer probe if SRAM is missing The Atmel NAND controller driver depends on an SRAM pool and has an implicit assumption that the SRAM pool has already been created. Changing the initcall ordering can break this. Unfortunately, fw_devlink can't save us here as there's not a standard property to track the dependency. So it's up to deferring probe to save us. Acked-by: Alexandre Belloni Tested-by: Alexandre Belloni Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 2372fe1ceaf5a1e681c81f3dc35eb7f954526cbd Author: Akhila YS Date: Mon Jan 5 15:08:00 2026 +0000 dt-bindings: mtd: microchip,mchp23k256: convert to DT schema Convert Microchip 23K256 SPI SRAM MTD binding to YAML format. Changes during conversion: - Remove "address-cells" and "size-cells" from properties and required sections as there is no child node for sram. Signed-off-by: Akhila YS Acked-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit 9986a70db37627cbe92fba288c2efcde25ad5c6d Author: Charan Pedumuru Date: Sun Jan 4 11:23:04 2026 +0000 dt-bindings: mtd: nvidia,tegra20-nand: convert to DT schema Convert NVIDIA Tegra NAND Flash Controller binding to YAML format. Changes during Conversion: - Define new properties `power-domains` and `operating-points-v2` because the existing in tree DTS uses them. - Modify MAINTAINERS references to point the created YAML file. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 56477aea482dd81e0364d98a02ab805d24242b72 Author: Daniel Palmer Date: Sun Jan 4 19:01:51 2026 +0900 mtd: parsers: ofpart: Remove code/data for disabled custom parsers Currently even if none of the custom parsers are selected a struct of_device_id and a dummy function that just returns -EOPNOTSUPP is compiled in for each of them. Its not obvious from the code but struct of_device_id is massive, 196 or 200 bytes (see link), so this is a lot more wasteful than you'd think just skimming the code and assuming the wasted size is just the length of the string with some small overhead. If they aren't enabled use ifdef's to avoid anything being compiled in and remove the dummy functions. Link: https://lore.kernel.org/all/ef59d6fd3b2201b912d5eaa7f7a037d8f9adb744.1636561068.git.geert+renesas@glider.be/ Signed-off-by: Daniel Palmer Signed-off-by: Miquel Raynal commit 1feb0377b9b816f89a04fc381eb19fc6bac9f4a4 Author: Antonio Borneo Date: Thu Jan 8 16:24:27 2026 +0100 coresight: etm3x: Fix cpulocked warning on cpuhp When changes [1] and [2] have been applied to the driver etm4x, the same modifications have been also collapsed in [3] and applied in one shot to the driver etm3x. While doing this, the driver etm3x has not been aligned to etm4x on the use of non cpuslocked version of cpuhp callback setup APIs. The current code triggers two run-time warnings when the kernel is compiled with CONFIG_PROVE_LOCKING=y. Use non cpuslocked version of cpuhp callback setup APIs in driver etm3x, aligning it to the driver etm4x. [1] commit 2d1a8bfb61ec ("coresight: etm4x: Fix etm4_count race by moving cpuhp callbacks to init") [2] commit 22a550a306ad ("coresight: etm4x: Allow etm4x to be built as a module") [3] commit 97fe626ce64c ("coresight: etm3x: Allow etm3x to be built as a module") Fixes: 97fe626ce64c ("coresight: etm3x: Allow etm3x to be built as a module") Signed-off-by: Antonio Borneo Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260108152427.357379-1-antonio.borneo@foss.st.com commit aa8cb72c2018c72b9c2fe5a8e55d530db3bc757e Author: Krzysztof Kozlowski Date: Fri Jan 2 13:49:34 2026 +0100 mtd: spi-nor: hisi-sfc: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Acked-by: Pratyush Yadav Signed-off-by: Miquel Raynal commit 8f51b6be269746d9a6abff4a5abc8b7aa680c659 Author: Krzysztof Kozlowski Date: Fri Jan 2 13:49:33 2026 +0100 mtd: rawnand: vf610: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit 3b9605987e602adc5d0f4b0d08ebb32ac13279e3 Author: Krzysztof Kozlowski Date: Fri Jan 2 13:49:32 2026 +0100 mtd: rawnand: vf610: Fix Wvoid-pointer-to-enum-cast warning "nfc->variant" is an enum, thus cast of pointer on 64-bit compile test with clang W=1 causes: vf610_nfc.c:843:17: error: cast to smaller integer type 'enum vf610_nfc_variant' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit 42983837ef2bba8a3fb984055eac814bccab8a1e Author: Krzysztof Kozlowski Date: Fri Jan 2 13:49:31 2026 +0100 mtd: rawnand: qcom: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Signed-off-by: Miquel Raynal commit c522c198aa7af17d487179e271fbd57351bcb795 Author: Krzysztof Kozlowski Date: Fri Jan 2 13:49:30 2026 +0100 mtd: rawnand: ingenic: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Paul Cercueil Signed-off-by: Miquel Raynal commit 758916e2201f4a318b8d29f28c487474b432cde0 Author: Krzysztof Kozlowski Date: Fri Jan 2 13:49:29 2026 +0100 mtd: rawnand: denali: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit f3701ba18069d2108d134271a5ad6d0a69d9ca36 Author: Krzysztof Kozlowski Date: Fri Jan 2 13:49:28 2026 +0100 mtd: rawnand: brcm: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Miquel Raynal commit 6d8226cbbf124bb5613b532216b74c886a4361b7 Author: Alok Tiwari Date: Fri Dec 19 03:09:30 2025 -0800 mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper cadence_nand_cdma_send_and_wait() propagates negative errno values from cadence_nand_cdma_send(), returns -ETIMEDOUT on failure and -EIO when the CDMA engine reports a command failure. However, it is declared as u32, causing error codes to wrap. Change the return type to int to correctly propagate errors. Fixes: ec4ba01e894d ("mtd: rawnand: Add new Cadence NAND driver to MTD subsystem") Signed-off-by: Alok Tiwari Signed-off-by: Miquel Raynal commit f5520a1a844342af7295a72c35cc9690b7a9fdd1 Author: Maíra Canal Date: Mon Jan 12 08:51:37 2026 -0300 drm/v3d: Convert v3d logging to device-based DRM helpers Replace legacy DRM_DEBUG/INFO/WARN/ERROR logging with the corresponding device-based drm_dbg(), drm_info(), drm_warn() and drm_err() helpers. For some messages, adjust the log level to better reflect their severity. This allows filtering via drm.debug, reduces log spam, and helps differentiate v3d logs from vc4 logs. Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260112-v3d-drm-debug-v2-2-8ef6244c97bb@igalia.com Signed-off-by: Maíra Canal commit eaba54b8a67bdec7f834d61ff6cf5f0f3f4ea5bc Author: Maíra Canal Date: Mon Jan 12 08:51:36 2026 -0300 drm/v3d: Consolidate CPU job validation in a function All CPU job extension parsers duplicate the same validation procedure: ensure the extension is attached to a CPU job (not a GPU job) and that only a single CPU job extension is associated with a given job. Create a function to consolidate these checks and reduce the boilerplate across the various CPU job extension handlers. While here, convert the legacy DRM_DEBUG with a more appropriate drm_dbg(). Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260112-v3d-drm-debug-v2-1-8ef6244c97bb@igalia.com Signed-off-by: Maíra Canal commit 18649ffbb63bca40896f973b6997914f9d603b1e Author: Guodong Xu Date: Thu Jan 15 07:18:58 2026 +0800 riscv: dts: anlogic: dr1v90: Add "b" ISA extension "b" is ratified (Apr/2024) much later than its components zba/zbb/zbs (Jun/2021). With "b" added into riscv/extensions.yaml, a dependency checking rule is now enforced, which requires that when zba, zbb, and zbs are all specified, "b" must be added as well. Failing to do this will cause dtbs_check schema check warnings. According to uabi.rst, as a single-letter extension, "b" should be added after "c" in canonical order. Update dr1v90.dtsi to conform to this rule. Line balancing is performed to improve readability. Signed-off-by: Guodong Xu Signed-off-by: Conor Dooley commit 69f83f167463bad26104af7fbc114ce1f80366b0 Author: Jouni Högander Date: Thu Jan 15 09:00:39 2026 +0200 drm/i915/psr: Don't enable Panel Replay on sink if globally disabled With some panels informing support for Panel Replay we are observing problems if having Panel Replay enable bit set on sink when forced to use PSR instead of Panel Replay. Avoid these problems by not setting Panel Replay enable bit in sink when Panel Replay is globally disabled during link training. I.e. disabled by module parameter. The enable bit is still set when disabling Panel Replay via debugfs interface. Added note comment about this. Fixes: 68f3a505b367 ("drm/i915/psr: Enable Panel Replay on sink always when it's supported") Cc: Mika Kahola Cc: Jani Nikula Cc: Rodrigo Vivi Cc: # v6.15+ Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://patch.msgid.link/20260115070039.368965-1-jouni.hogander@intel.com (cherry picked from commit c5a52cd04e24f0ae53fda26f74ab027b8c548e0e) Signed-off-by: Joonas Lahtinen commit 2e2f6b0ef8551bf3bd8255729d27e3ad9451e562 Author: Asahi Lina Date: Sun Jan 18 10:08:08 2026 +0000 rust: iommu: add io_pgtable abstraction This will be used by the Tyr driver to create and modify the page table of each address space on the GPU. Each time a mapping gets created or removed by userspace, Tyr will call into GPUVM, which will figure out which calls to map_pages and unmap_pages are required to map the data in question in the page table so that the GPU may access those pages when using that address space. The Rust type wraps the struct using a raw pointer rather than the usual Opaque+ARef approach because Opaque+ARef requires the target type to be refcounted. Signed-off-by: Asahi Lina Acked-by: Boris Brezillon Reviewed-by: Daniel Almeida Tested-by: Deborah Brouwer Co-developed-by: Alice Ryhl Signed-off-by: Alice Ryhl Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich [joro: Fixed up Rust import style] Signed-off-by: Joerg Roedel commit 5ac87cd859eca21ebf657d94affd29f40003bede Merge: fa3bb5011f33cc 24d479d26b25bc Author: Greg Kroah-Hartman Date: Mon Jan 19 10:24:11 2026 +0100 Merge 6.19-rc6 usb-next We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit 1e1dd9eeaab3908746d1dce5db6b0c29e0d28d6d Author: Johannes Berg Date: Fri Jan 16 09:21:15 2026 +0100 wifi: mac80211: mark iface work SKBs as consumed Using kfree_skb() here is misleading when looking at traces, since these frames have been handled. Use consume_skb() instead. Link: https://patch.msgid.link/20260116092115.1db534bdc12c.Ic0adae06684a6871144398d15cf7700c57620baa@changeid Signed-off-by: Johannes Berg commit 58dc87d839280ac0f57b2a5caf647c2ed5cab1aa Author: Johannes Berg Date: Fri Jan 16 09:20:25 2026 +0100 wifi: mac80211: remove RX_DROP Since it's hard to figure out what RX_DROP means when looking at traces that drop packets in mac80211, add more specific drop reasons and remove RX_DROP entirely. Link: https://patch.msgid.link/20260116092025.79d995e87026.I7cde413988f7a382c551cd1c1e2b05a52ec71755@changeid Signed-off-by: Johannes Berg commit e2692c4eeaa4bd945b7bae156b4cac55d6a0c730 Author: Wei Wang Date: Mon Jan 26 03:19:20 2026 +0800 iommupt: Do not set C-bit on MMIO backed PTEs AMD Secure Memory Encryption (SME) marks individual memory pages as encrypted by setting the C-bit in page table entries. According to the AMD APM,any pages corresponding to MMIO addresses must be configured with the C-bit clear. The current *_iommu_set_prot() implementation sets the C-bit on all PTEs in the IOMMU page tables. This is incorrect for PTEs backed by MMIO, and can break PCIe peer-to-peer communication when IOVA is used. Fix this by avoiding the C-bit for MMIO-backed mappings. For amdv2 IOMMU page tables, there is a usage scenario for GVA->GPA mappings, and for the trusted MMIO in the TEE-IO case, the C-bit will need to be added to GPA. However, SNP guests do not yet support vIOMMU, and the trusted MMIO support is not ready in upstream. Adding the C-bit for trusted MMIO can be considered once those features land. Fixes: 879ced2bab1b ("iommupt: Add the AMD IOMMU v1 page table format") Fixes: aef5de756ea8 ("iommupt: Add the x86 64 bit page table format") Suggested-by: Jason Gunthorpe Signed-off-by: Wei Wang Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel commit 8a42938a28941da29bf3e4cd2af877b0d5d929e1 Author: Miri Korenblit Date: Wed Jan 7 14:22:54 2026 +0200 wifi: nl80211: ignore cluster id after NAN started After NAN was started, cluster id updates from the user space should not happen, since the device already started a cluster with the previousely provided id. Since NL80211_CMD_CHANGE_NAN_CONFIG requires to set the full NAN configuration, we can't require that NL80211_NAN_CONF_CLUSTER_ID won't be included in this command, and keeping the last confgiured value just to be able to compare it against the new one seems a bit overkill. Therefore, just ignore cluster id in this command and clarify the documentation. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260107142229.fb55e5853269.I10d18c8f69d98b28916596d6da4207c15ea4abb5@changeid Signed-off-by: Johannes Berg commit 36e83df3a66f57589558bad5336f96ec233a1cb3 Author: Miri Korenblit Date: Wed Jan 7 14:22:53 2026 +0200 wifi: cfg80211: cleanup cluster_id when stopping NAN When NAN is stopped, cluster_id should be set to 0 to indicate that we are not part of any cluster. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260107142229.9ccb700797ec.I890ac852be6ca0093995655d987ca5c28a26ce3d@changeid Signed-off-by: Johannes Berg commit f816141cbae2014e87950cc5e4e336a6420d1096 Author: Miri Korenblit Date: Wed Jan 7 14:15:56 2026 +0200 wifi: cfg80211: limit NAN func management APIs to offloaded DE A driver that declared that it has userspace DE should not call NAN func related APIs such as cfg80211_nan_match and cfg80211_nan_func_terminated Check and warn in such a case, as this indicates a driver bug. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260107141549.86fa96c75211.I8fbb0506377170dd7b41234f20bcba057951dd1e@changeid Signed-off-by: Johannes Berg commit e1696c8bd0056bc1a5f7766f58ac333adc203e8a Author: Miri Korenblit Date: Wed Jan 7 14:04:51 2026 +0200 wifi: cfg80211: stop NAN and P2P in cfg80211_leave Seems that there is an assumption that this function should be called only for netdev interfaces, but it can also be called in suspend, or from nl80211_netlink_notify (indirectly). Note that the documentation of NL80211_ATTR_SOCKET_OWNER explicitly says that NAN interfaces would be destroyed as well in the nl80211_netlink_notify case. Fix this by also stopping P2P and NAN. Fixes: cb3b7d87652a ("cfg80211: add start / stop NAN commands") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260107140430.dab142cbef0b.I290cc47836d56dd7e35012ce06bec36c6da688cd@changeid Signed-off-by: Johannes Berg commit e69fda4d07701373354e52b0321bd40311d743d0 Author: Miri Korenblit Date: Wed Jan 7 13:51:57 2026 +0200 wifi: cfg80211: allow only one NAN interface, also in multi radio According to Wi-Fi Aware (TM) 4.0 specification 2.8, A NAN device can have one NAN management interface. This applies also to multi radio devices. The current code allows a driver to support more than one NAN interface, if those are not in the same radio. Fix it. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260107135129.fdaecec0fe8a.I246b5ba6e9da3ec1481ff197e47f6ce0793d7118@changeid Signed-off-by: Johannes Berg commit c34dbc5900b0158edaab51c481510d66679d8f72 Author: Peter Åstrand Date: Fri Jan 16 18:58:58 2026 +0100 wifi: wlcore: Add support for IGTK key This change re-applies commit 2b7aadd3b9e1 ("wlcore: Adding suppoprt for IGTK key in wlcore driver") (sic), but only enables WLAN_CIPHER_SUITE_AES_CMAC with modern firmware. This patch is required to support WPA3 connections. Signed-off-by: Peter Åstrand Link: https://patch.msgid.link/0d3df7ab-6c41-c3cc-83cc-5ba55fe4e4bd@lysator.liu.se Signed-off-by: Johannes Berg commit 0acd76b728f35b799fb4beee9853a33acb5e2888 Merge: 3d2515fdd336b2 5e632c7ca9e15a Author: Johannes Berg Date: Mon Jan 19 10:15:00 2026 +0100 Merge tag 'rtw-next-2026-01-15' of https://github.com/pkshih/rtw Ping-Ke Shih says: ================== rtw-next patches for -next release. Main changes are to prepare to support RTL8922DE, including refactor/add register settings in common flow, and add newly firmware command/event handlers. Others are some random fixes and improvements across all drivers. ================== Link: https://patch.msgid.link/006be16d-61ba-4af8-b76a-bc94100c3555@RTKEXHMBS03.realtek.com.tw Signed-off-by: Johannes Berg commit 2ad6c5cdc89acfefb01b84afa5e55262c40d6fec Author: Onur Özkan Date: Thu Nov 13 17:45:47 2025 +0300 rust: rbtree: reduce unsafe blocks on pointer derefs Refactors parts of the get() and find_best_match() traversal logic to minimize the scope of unsafe blocks and avoid duplicating same safety comments. One of the removed comments was also misleading: // SAFETY: `node` is a non-null node... Ordering::Equal => return Some(unsafe { &(*this).value }), as `node` should have been `this`. No functional changes intended; this is purely a safety improvement that reduces the amount of unsafe blocks while keeping all invariants intact. [ Alice writes: "One consequence of creating a &_ to the bindings::rb_node struct means that we assert immutability for the entire struct and not just the rb_left/rb_right fields, but I have verified that this is ok." - Miguel ] Signed-off-by: Onur Özkan Reviewed-by: Charalampos Mitrodimas Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251113144547.502-1-work@onurozkan.dev [ Reworded title and replaced `cursor_lower_bound()` with `find_best_match()` in message. - Miguel ] Signed-off-by: Miguel Ojeda commit db5e9260be8d3437222df74b5074359b22f1f029 Author: Chen-Yu Tsai Date: Thu Dec 25 18:36:15 2025 +0800 ARM: dts: allwinner: Replace status "failed" with "fail" The device tree bindings specify using "fail", not "failed". Fix up all the ones that are wrong. Link: https://patch.msgid.link/20251225103616.3203473-5-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit d62dec8c70934c428f80889c49e09a9d1d93c126 Merge: 95adee9a04fa1e 79643afdd985ee Author: Dave Airlie Date: Mon Jan 19 15:38:39 2026 +1000 Merge tag 'mediatek-drm-next-20260117' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next Mediatek DRM Next - 20260117 1. mtk_hdmi_v2: Remove unneeded semicolon 2. Move DP training to hotplug thread 3. Convert legacy DRM logging to drm_* helpers in mtk_crtc.c 4. mtk_dsi: Add support for High Speed (HS) mode 5. Add HDMI support for Mediatek Genio 510/700/1200-EVK and Radxa NIO-12L boards Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patch.msgid.link/20260117005152.3770-1-chunkuang.hu@kernel.org commit 95adee9a04fa1eaa352e960e9d3387055fa03bb3 Merge: c098b1aa2fa60f 9512d9fc2a7a4f Author: Dave Airlie Date: Mon Jan 19 13:51:08 2026 +1000 Merge tag 'drm-intel-gt-next-2026-01-16' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: - Bump recommended GuC version for DG2 and MTL - Fix for syzkaller found NULL deref in execbuf (Krzyssztof, Gangmin) - Use designated initializers in debugfs code (Sebastian) - Selftest and static checker fixes (Ard, Sk) Signed-off-by: Dave Airlie From: Joonas Lahtinen Link: https://patch.msgid.link/aWnzOx78S4Vh38QE@jlahtine-mobl commit 6c37b6841a92714eba4a7b7f823aea801da4e09f Author: Tamir Duberstein Date: Mon Dec 22 13:28:27 2025 +0100 rust: kunit: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Reviewed-by: David Gow Link: https://patch.msgid.link/20251222-cstr-kunit-v1-1-39d999672f35@gmail.com Signed-off-by: Miguel Ojeda commit 32d61c516f75c15b8c6420d8ef749d80615943df Author: Tamir Duberstein Date: Mon Dec 22 13:14:33 2025 +0100 samples: rust: i2c: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Signed-off-by: Tamir Duberstein Acked-by: Igor Korotin Reviewed-by: Daniel Almeida Link: https://patch.msgid.link/20251222-cstr-i2c-v1-2-df1c258d4615@gmail.com Signed-off-by: Miguel Ojeda commit eeaad2f021def7efdaa441b104550615ca328a48 Author: Tamir Duberstein Date: Mon Dec 22 13:14:32 2025 +0100 rust: i2c: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Signed-off-by: Tamir Duberstein Acked-by: Igor Korotin Reviewed-by: Daniel Almeida Link: https://patch.msgid.link/20251222-cstr-i2c-v1-1-df1c258d4615@gmail.com Signed-off-by: Miguel Ojeda commit 84b1b49eccb79ec2e4aaa45116fffb2ac61b876c Author: Alexandre Courbot Date: Tue Dec 16 17:24:49 2025 +0900 rust: ptr: replace unneeded use of `build_assert` Since `ALIGN` is a const parameter, this assertion can be done in const context using the `assert!` macro. Suggested-by: Alice Ryhl Signed-off-by: Alexandre Courbot Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251216-ptr_assert-v1-1-d8b2d5c5741d@nvidia.com Signed-off-by: Miguel Ojeda commit 1b18b37a2c30f6e6698205a06de393f7e626f5d2 Author: Alexandre Courbot Date: Mon Dec 8 11:46:59 2025 +0900 rust: build_assert: add instructions for use with function arguments `build_assert` relies on the compiler to optimize out its error path, lest build fails with the dreaded error: ERROR: modpost: "rust_build_error" [path/to/module.ko] undefined! It has been observed that very trivial code performing I/O accesses (sometimes even using an immediate value) would seemingly randomly fail with this error whenever `CLIPPY=1` was set. The same behavior was also observed until different, very similar conditions [1][2]. The cause appears to be that the failing function is eventually using `build_assert` with its argument, but is only annotated with `#[inline]`. This gives the compiler freedom to not inline the function, which it notably did when Clippy was active, triggering the error. The fix is to annotate functions passing their argument to `build_assert` with `#[inline(always)]`, telling the compiler to be as aggressive as possible with their inlining. This is also the correct behavior as inlining is mandatory for correct behavior in these cases. Add a paragraph instructing to annotate such functions with `#[inline(always)]` in `build_assert`'s documentation, and split its example to illustrate. Reviewed-by: Daniel Almeida Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20251208-io-build-assert-v3-1-98aded02c1ea@nvidia.com Signed-off-by: Miguel Ojeda commit 9fa7153c31a3e5fe578b83d23bc9f185fde115da Author: Miguel Ojeda Date: Sat Dec 13 01:00:42 2025 +0100 rust: conclude the Rust experiment The Rust support was merged in v6.1 into mainline in order to help determine whether Rust as a language was suitable for the kernel, i.e. worth the tradeoffs, technically, procedurally and socially. At the 2025 Linux Kernel Maintainers Summit, the experiment has just been deemed concluded [1]. Thus remove the section -- it was not fully true already anyway, since there are already uses of Rust in production out there, some well-known Linux distributions enable it and it is already in millions of devices via Android. Obviously, this does not mean that everything works for every kernel configuration, architecture, toolchain etc., or that there won't be new issues. There is still a ton of work to do in all areas, from the kernel to upstream Rust, GCC and other projects. And, in fact, certain combinations (such as the mixed GCC+LLVM builds and the upcoming GCC support) are still quite experimental but getting there. But the experiment is done, i.e. Rust is here to stay. I hope this signals commitment from the kernel to companies and other entities to invest more into it, e.g. into giving time to their kernel developers to train themselves in Rust. Thanks to the many kernel maintainers that gave the project their support and patience throughout these years, and to the many other developers, whether in the kernel or in other projects, that have made this possible. I had a long list of 173 names in the credits of the original pull that merged the support into the kernel [2], and now such a list would be way longer, so I will not even try to compose one, but again, thanks a lot, everybody. Link: https://lwn.net/Articles/1050174/ [1] Link: https://git.kernel.org/linus/8aebac82933f [2] Reviewed-by: Gary Guo Acked-by: Greg Kroah-Hartman Acked-by: Benno Lossin Acked-by: Andreas Hindborg Acked-by: Danilo Krummrich Reviewed-by: Boqun Feng Link: https://patch.msgid.link/20251213000042.23072-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 76d415763bae9488dd2b923b1348ce6f26c1f0ae Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:34 2026 +0100 pinctrl: st: Annotate st_pinconf_dbg_show() as holding mutex st_pinconf_dbg_show() unlocks and locks the pinctrl_dev mutex, so it must be called by the pinctrl core with the mutex hold. Annotate the function with sparse __must_hold, so any changes in pinctrl locking will be statically detected. Reviewed-by: Patrice Chotard Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit e2c58cbe3aff49fe201e81ee5f651294e313ec74 Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:33 2026 +0100 pinctrl: rockchip: Simplify locking with scoped_guard() Simplify error handling by removing two mutex_unlock() calls with scoped_guard(). Reviewed-by: Heiko Stuebner Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 160d686fbf8f9ee5aca85ee27557afb55358edae Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:32 2026 +0100 pinctrl: tegra-xusb: Simplify locking with guard() Simplify error handling (less gotos) over locks with guard(). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 0899bab9b2364c2ff2779d0f28c86474fb09b985 Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:31 2026 +0100 pinctrl: tegra-xusb: Return void in padctl enable/disable functions Make the padctl functions a bit simpler by returning void instead of always '0'. The callers - phy init/exit - still need to return 0, but these are smaller function without if/branching. Acked-by: Thierry Reding Reviewed-by: Jon Hunter Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit b339e1df67e9e7a7518c5d2a4967ef69f03a7015 Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:30 2026 +0100 pinctrl: tb10x: Simplify locking with guard() Simplify error handling (less code in error case) over locks with guard(). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 708adef80cb19152192df1999341542328596da5 Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:29 2026 +0100 pinctrl: microchip-sgpio: Simplify locking with guard() Simplify error handling (less gotos) over locks with guard(). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 6fe3b96b051d0ce4cbc0b76008fef0653f2e21ab Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:28 2026 +0100 pinctrl: aw9523: Simplify locking with guard() Simplify error handling (less gotos) over locks with guard() which also removes possibility (at least by reading the code) of returning uninitialized rc/ret value in aw9523_pconf_set() and aw9523_gpio_get_multiple() functions. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit b4b224ec05e7e29e07833527e1e0c2fb6305ae6b Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:27 2026 +0100 pinctrl: amd: Cleanup header includes Remove unused includes: no lists and mutexes. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit faf55ac9a40d900921df4f74a16fbcba9106e24e Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:26 2026 +0100 pinctrl: sophgo: Cleanup header includes Remove unused includes from internal headers, because they do not have following: bit manipulations, mutexes, spinlocks and struct devices. These headers are included by actual C files, which seem to have all necessary includes. Reviewed-by: Inochi Amaoto Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 17d41be3c703e4d164062e54555931b9fdc32e28 Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:25 2026 +0100 pinctrl: starfive: jh7110-sys: Cleanup header includes Remove unused includes: no clocks, mutexes and resets. Reviewed-by: Hal Feng Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit a7f7ee348de1b4ef2d5d328517984a965245ac9f Author: Krzysztof Kozlowski Date: Sun Jan 18 19:09:24 2026 +0100 pinctrl: aspeed: Cleanup header includes Remove unused includes (no mutexes, string functions, no OF functions) and bring directly used mod_devicetable.h (previously pulled via of.h). Reviewed-by: Andrew Jeffery Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit badf64c1edde7ffea8bf3d9341faa2dbb0cd7520 Merge: eb9eb4db98d68c 8c483209a6fc71 Author: Linus Walleij Date: Mon Jan 19 00:45:43 2026 +0100 Merge tag 'samsung-pinctrl-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/samsung into devel Samsung pinctrl drivers changes for v6.20 Add new pin controllers for Samsung Exynos9610 SoC. Signed-off-by: Linus Walleij commit 949f647eff76a1e759af7b1c0295db5b5640928a Author: Carlos Song Date: Tue Nov 25 16:47:18 2025 +0800 i2c: imx-lpi2c: Add runtime PM support for IRQ and clock management on i.MX8QXP/8QM On i.MX8QXP/8QM SoCs, both the lvds/mipi and lvds/mipi-lpi2c power domains must enter low-power mode during runtime suspend to achieve deep power savings. LPI2C resides in the lvds-lpi2c/mipi-lpi2c power domain, while its IRQ is routed through an irqsteer located in the lvds/mipi power domain. The LPI2C clock source comes from an LPCG within the lvds-lpi2c domain. For example, the hierarchy for lvds0 and lvds0-lpi2c0 domains is: ┌───────────────────────┐ │ pm-domain : lvds0 │ │ │ │ ┌──────────────┐ │ │ │ irqsteer │ │ │ └───────▲──────┘ │ │ │irq │ │ │ │ └────────────┼──────────┘ ┌────────────┼──────────┐ │ ┌───┼───┐ │ │ │lpi2c0 │ │ │ └───┬───┘clk │ │ ┌────────┼───────┐ │ │ │ LPCG │ │ │ └────────────────┘ │ │pm-domain:lvds0-lpi2c0 │ └───────────────────────┘ To allow these domains to power down in system runtime suspend: - All irqsteer clients must release IRQs. - All LPCG clients must disable and unprepare clocks. Thus, LPI2C must: - Free its IRQ during runtime suspend and re-request it on resume. - Disable and unprepare all clocks during runtime suspend and prepare and rne ble them on resume. This enables the lvds/mipi domains to enter deep low-power mode, significantly reducing power consumption compared to active mode. Signed-off-by: Carlos Song Reviewed-by: Frank Li Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251125084718.2156168-1-carlos.song@nxp.com commit eb9eb4db98d68c680900d48ee672b92c59ffee71 Author: Bartosz Golaszewski Date: Thu Jan 8 13:52:37 2026 +0100 driver core: make pinctrl_bind_pins() private pinctrl_bind_pins() is only used by driver core (as it should). Move it out of the public header into base.h. Signed-off-by: Bartosz Golaszewski Reviewed-by: Greg Kroah-Hartman Acked-by: Danilo Krummrich Signed-off-by: Linus Walleij commit 43519f545757e291cff04f23cc1a0bbc1ca6e2f0 Merge: ba7693014d52e7 829dde3369a91a Author: Linus Walleij Date: Mon Jan 19 00:27:18 2026 +0100 Merge tag 'renesas-pinctrl-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: renesas: Updates for v6.20 - Add support for GPIO IRQs on RZ/T2H and RZ/N2H. Signed-off-by: Linus Walleij commit c098b1aa2fa60fad42df8a1a6250099329e33311 Merge: 971c2b68bddb87 6a681cd9034587 Author: Dave Airlie Date: Mon Jan 19 06:53:41 2026 +1000 Merge tag 'amd-drm-next-6.20-2026-01-16' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.20-2026-01-16: amdgpu: - SR-IOV fixes - Rework SMU mailbox handling - Drop MMIO_REMAP domain - UserQ fixes - MES cleanups - Panel Replay updates - HDMI fixes - Backlight fixes - SMU 14.x fixes - SMU 15 updates amdkfd: - Fix a memory leak - Fixes for systems with non-4K pages - LDS/Scratch cleanup - MES process eviction fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260116202609.23107-1-alexander.deucher@amd.com commit 244d11ae7d12514089eb481589d5d7d2de4572ef Author: Jason-JH Lin Date: Fri Oct 31 23:56:33 2025 +0800 mailbox: mtk-cmdq: Add driver data to support for MT8196 MT8196 has 2 new hardware configuration compared with the previous SoC, which correspond to the 2 new driver data: 1. mminfra_offset: For GCE data path control Since GCE has been moved into mminfra, GCE needs to append the mminfra offset to the DRAM address when accessing the DRAM. 2. gce_vm: For GCE hardware virtualization control Currently, the first version of the mt8196 mailbox controller only requires setting the VM-related registers to enable the permissions of a host VM. Signed-off-by: Jason-JH Lin Reviewed-by: CK Hu Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit ddb5d0c941c64b51b003f62df3596682a6591c35 Author: Jason-JH Lin Date: Fri Oct 31 23:56:32 2025 +0800 mailbox: mtk-cmdq: Add mminfra_offset configuration for DRAM transaction The GCE in MT8196 is placed in MMINFRA and requires all addresses in GCE instructions for DRAM transactions to be IOVA. Due to MMIO, if the GCE needs to access a hardware register at 0x1000_0000, but the SMMU is also mapping a DRAM block at 0x1000_0000, the MMINFRA will not know whether to write to the hardware register or the DRAM. To solve this, MMINFRA treats addresses greater than 2G as data paths and those less than 2G as config paths because the DRAM start address is currently at 2G (0x8000_0000). On the data path, MMINFRA remaps DRAM addresses by subtracting 2G, allowing SMMU to map DRAM addresses less than 2G. For example, if the DRAM start address 0x8000_0000 is mapped to IOVA=0x0, when GCE accesses IOVA=0x0, it must add a 2G offset to the address in the GCE instruction. MMINFRA will then see it as a data path (IOVA >= 2G) and subtract 2G, allowing GCE to access IOVA=0x0. Since the MMINFRA remap subtracting 2G is done in hardware and cannot be configured by software, the address of DRAM in GCE instruction must always add 2G to ensure proper access. After that, the shift functions do more than just shift addresses, so the APIs were renamed to cmdq_convert_gce_addr() and cmdq_revert_gce_addr(). This 2G adjustment is referred to as mminfra_offset in the CMDQ driver. CMDQ helper can get the mminfra_offset from the cmdq_mbox_priv of cmdq_pkt and add the mminfra_offset to the DRAM address in GCE instructions. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit 7063a901fe1ae9c7b875917df5945806f04f6921 Author: Jason-JH Lin Date: Fri Oct 31 23:56:31 2025 +0800 mailbox: mtk-cmdq: Add GCE hardware virtualization configuration The GCE hardware virtualization configuration supports the isolation of GCE hardware resources across different OS environments. Each OS is treated as a virtual machine (VM) for GCE purposes. There are 6 VMs and 1 host VM. The host VM has main control over the GCE virtualization settings for all VMs. To properly access the GCE thread registers, it is necessary to configure access permissions for specific GCE threads assigned to different VMs. Currently, since only the host VM is being used, it is required to enable access permissions for all GCE threads for the host VM. There are 2 VM configurations: 1. VM_ID_MAP There are 4 registers to allocate 32 GCE threads across different VMs: VM_ID_MAP0 for threads 0-9, VM_ID_MAP1 for threads 10-19, VM_ID_MAP2 for threads 20-29, and VM_ID_MAP3 for threads 30-31. Each thread has a 3-bit configuration, where setting all bits to 1 configures the thread for the host VM. 2. VM_CPR_GSIZE It is used to allocate the CPR SRAM size to each VM. Each VM has 4-bit configuration, where setting bit 0-3 to configures the size of host VM. This setting must be configured before the VM configuration to prevent resource leakage. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit 7d834d5ce5cb780b926ea0484a80b47bafbb3b64 Author: Jason-JH Lin Date: Fri Oct 31 23:56:30 2025 +0800 mailbox: mtk-cmdq: Add cmdq private data to cmdq_pkt for generating instruction Add the cmdq_mbox_priv structure to store the private data of GCE, such as the shift bits of the physical address. Then, include the cmdq_mbox_priv structure within the cmdq_pkt structure. This allows CMDQ users to utilize the private data in cmdq_pkt to generate GCE instructions when needed. Additionally, having cmdq_mbox_priv makes it easier to expand and reference other GCE private data in the future. Add cmdq_get_mbox_priv() for CMDQ users to get all the private data into the cmdq_mbox_priv of the cmdq_pkt. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit c2b69f71ffd05d494f706d067c8dbcdbb7e6b901 Author: Sudeep Holla Date: Thu Oct 16 20:08:20 2025 +0100 mailbox: pcc: Clear any pending responder interrupts before enabling it Some platforms may leave a responder interrupt pending from earlier transactions. If a PCC responder channel has a pending interrupt when the controller starts up, enabling the IRQ line without first clearing the condition can lead to a spurious interrupt which could disrupt other transmissions if the IRQ is shared. Explicitly clear any pending responder interrupt before enabling the IRQ to ensure a clean start. Acknowledge the responder channel via pcc_chan_acknowledge() in startup before requesting/enablement of the IRQ. This ensures a clean baseline for the first transfer/receiption of the notification/response. Signed-off-by: Sudeep Holla Tested-by: Adam Young Signed-off-by: Jassi Brar commit 9f3bbbb72ad03378c45523b8045ac82d1ba28ae6 Author: Sudeep Holla Date: Thu Oct 16 20:08:19 2025 +0100 mailbox: pcc: Initialize SHMEM before binding the channel with the client The PCC channel's shared memory region must be set up before the mailbox controller binds the channel with the client, as the binding process may trigger client operations like startup() that may rely on SHMEM being initialized. Reorder the setup sequence to ensure the shared memory is ready before binding. Initialize and map the PCC shared memory (SHMEM) prior to calling mbox_bind_client() so that clients never observe an uninitialized or NULL SHMEM during bind-time callbacks or early use in startup(). This makes the PCC mailbox channel bring-up order consistent and eliminates a race between SHMEM setup and client binding. This will be needed in channel startup to clear/acknowledge any pending interrupts before enabling them. Signed-off-by: Sudeep Holla Acked-by: lihuisong@huawei.com Tested-by: Adam Young Signed-off-by: Jassi Brar commit 9c753f7c953c0c564db677773e767b8cecaee960 Author: Sudeep Holla Date: Thu Oct 16 20:08:18 2025 +0100 mailbox: pcc: Mark Tx as complete in PCC IRQ handler The PCC IRQ handler clears channel-in-use and notifies clients with mbox_chan_received_data(), but it does not explicitly mark the transmit as complete. In IRQ completion mode this could leave Tx complete waiters hanging or lead to generic timeouts in the mailbox core. Invoke mbox_chan_txdone() in the IRQ path once the platform has acknowledged the transfer so the core can wake any waiters and update state accordingly. Signed-off-by: Sudeep Holla Tested-by: Adam Young Signed-off-by: Jassi Brar commit 3349f800609eadd396d1702da9d979f88770bad9 Author: Sudeep Holla Date: Thu Oct 16 20:08:17 2025 +0100 mailbox: pcc: Set txdone_irq/txdone_poll based on PCCT flags The PCC controller currently enables txdone via IRQ if the PCCT exposes platform capability to generate command completion interrupt, but it leaves txdone_poll unchanged. Make the behaviour explicit: - If ACPI_PCCT_DOORBELL is present, use txdone_irq and disable polling. - Otherwise, disable txdone_irq and fall back to txdone_poll. Configure the PCC mailbox to use interrupt-based completion for PCC types that signal completion via IRQ using TXDONE_BY_IRQ, and fall back to polling for others using TXDONE_BY_POLL. This ensures the PCC driver uses the appropriate completion mechanism according to the PCCT table definition and makes the completion mode unambiguous avoiding mixed signalling when the platform lacks a doorbell flag set. Signed-off-by: Sudeep Holla Tested-by: Adam Young Signed-off-by: Jassi Brar commit a5695dedb76684b85c7deb54bc81546dac2724ad Author: Sudeep Holla Date: Thu Oct 16 20:08:16 2025 +0100 mailbox: pcc: Wire up ->last_tx_done() for PCC channels Some PCC users poll for completion between transfers and benefit from the knowledge of previous Tx completion check through the mailbox framework's ->last_tx_done() op. Hook up the last_tx_done callback in the PCC mailbox driver so the mailbox framework can correctly query the completion status of the last transmitted message. This aligns PCC with other controllers that already implement such last_tx_done status query. No functional change unless callers use ->last_tx_done(). Normal Tx and IRQ paths are unchanged. This change just improves synchronization and avoids unnecessary timeouts for non-interrupt driven channels by ensuring correct completion detection for PCC channels that don’t rely on interrupts. Signed-off-by: Sudeep Holla Tested-by: Adam Young Signed-off-by: Jassi Brar commit f82c3e62b6b8c31d8c56415bf38658f306fda4cb Author: Sudeep Holla Date: Thu Oct 16 20:08:15 2025 +0100 Revert "mailbox/pcc: support mailbox management of the shared buffer" This reverts commit 5378bdf6a611a32500fccf13d14156f219bb0c85. Commit 5378bdf6a611 ("mailbox/pcc: support mailbox management of the shared buffer") attempted to introduce generic helpers for managing the PCC shared memory, but it largely duplicates functionality already provided by the mailbox core and leaves gaps: 1. TX preparation: The mailbox framework already supports this via ->tx_prepare callback for mailbox clients. The patch adds pcc_write_to_buffer() and expects clients to toggle pchan->chan.manage_writes, but no drivers set manage_writes, so pcc_write_to_buffer() has no users. 2. RX handling: Data reception is already delivered through mbox_chan_received_data() and client ->rx_callback. The patch adds an optional pchan->chan.rx_alloc, which again has no users and duplicates the existing path. 3. Completion handling: While adding last_tx_done is directionally useful, the implementation only covers Type 3/4 and fails to handle the absence of a command_complete register, so it is incomplete for other types. Given the duplication and incomplete coverage, revert this change. Any new requirements should be addressed in focused follow-ups rather than bundling multiple behavioral changes together. Fixes: 5378bdf6a611 ("mailbox/pcc: support mailbox management of the shared buffer") Signed-off-by: Sudeep Holla Signed-off-by: Jassi Brar commit b411f2109ec1fb47384c9596e34826eed8e7aaec Author: Conor Dooley Date: Mon Nov 17 15:46:56 2025 +0000 mailbox: mpfs: drop POLARFIRE from ARCH_MICROCHIP_POLARFIRE The ARCH_MICROCHIP symbol has been defined for some time on RISCV, as a replacement for ARCH_MICROCHIP_POLARFIRE since there are now other Microchip RISC-V products. Drop the POLARFIRE from ARCH_MICROCHIP_POLARFIRE in the POLARFIRE_SOC_MAILBOX Kconfig entry since the newly added pic64gx also uses the mailbox and it is one of the few users of ARCH_MICROCHIP_POLARFIRE left in the tree. Signed-off-by: Conor Dooley Signed-off-by: Jassi Brar commit 74ff7036589a8b7708b7cdad76d1aff1a842e5ba Author: Pierre-Henry Moussay Date: Mon Nov 17 15:46:54 2025 +0000 dt-bindings: mbox: add pic64gx mailbox compatibility to mpfs mailbox pic64gx mailbox is compatible with mpfs mailbox, even if the mailbox consumer is not - the underlying communication mechanism is the same. Signed-off-by: Pierre-Henry Moussay Signed-off-by: Conor Dooley Reviewed-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit f7c330a8c83c9b0332fd524097eaf3e69148164d Author: Valentina Fernandez Date: Thu Nov 13 13:49:22 2025 +0000 mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq() The cluster_cfg array is dynamically allocated to hold per-CPU configuration structures, with its size based on the number of online CPUs. Previously, this array was indexed using hartid, which may be non-contiguous or exceed the bounds of the array, leading to out-of-bounds access. Switch to using cpuid as the index, as it is guaranteed to be within the valid range provided by for_each_online_cpu(). Signed-off-by: Valentina Fernandez Reviewed-by: Conor Dooley Signed-off-by: Jassi Brar commit ba99035bf16ef0d4a7f6acd56fc9292c0bd0d42e Author: Sven Peter Date: Sat Jan 17 18:59:10 2026 +0100 soc: apple: rtkit: Add function to poweroff Add a function to put a co-processor into the lowest possible power state from which recovery usually isn't possible without a full SoC reset. This is required for the USB4/Thunderbolt co-processors which can be restarted since the entire USB4 root complex can be completely reset independently of the rest of the SoC. Reviewed-by: Janne Grunau Link: https://patch.msgid.link/20260117-apple-rtkit-poweroff-v2-1-b882a180e44d@kernel.org Signed-off-by: Sven Peter commit d96ebba37b7d08a4d7d5f4b992b4400e6e7b8fa1 Author: Jingyi Wang Date: Tue Oct 21 23:32:30 2025 -0700 dt-bindings: mailbox: qcom: Add CPUCP mailbox controller bindings for Kaanapali Document CPUSS Control Processor (CPUCP) mailbox controller for Qualcomm Kaanapali, which is compatible with X1E80100, use fallback to indicate this. Signed-off-by: Jingyi Wang Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit da5eef6a5e941faf6bf5942696671aa15216cfbb Author: Kuninori Morimoto Date: Wed Oct 29 23:38:40 2025 +0000 mailbox: remove unneeded double quotation It makes Kconfig strange. fix it. Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Signed-off-by: Jassi Brar commit fcd7f96c783626c07ee3ed75fa3739a8a2052310 Author: Joonwon Kang Date: Wed Nov 26 06:22:50 2025 +0000 mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable@vger.kernel.org Signed-off-by: Joonwon Kang Signed-off-by: Jassi Brar commit b562abd956726f57bb78813b4c77db51d28933a9 Author: Jjian Zhou Date: Mon Oct 13 14:31:36 2025 +0800 mailbox: mediatek: Add mtk-vcp-mailbox driver Add mtk-vcp-mailbox driver to support the communication with VCP remote microprocessor. Signed-off-by: Jjian Zhou Reviewed-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit c2b75a5353aec990bbb8bd53737d39b497a7bdaa Author: Jjian Zhou Date: Mon Oct 13 14:31:35 2025 +0800 dt-bindings: mailbox: mediatek,mt8196-vcp-mbox: add mtk vcp-mbox document The MTK VCP mailbox enables the SoC to communicate with the VCP by passing messages through 64 32-bit wide registers. It has 32 interrupt vectors in either direction for signalling purposes. This adds a binding for Mediatek VCP mailbox. Signed-off-by: Jjian Zhou Reviewed-by: Krzysztof Kozlowski Reviewed-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit d3922f6dad69b3d1f7656c9035bd0e82f73091b7 Author: Li Zhijian Date: Fri Jan 16 11:28:33 2026 +0800 RDMA/rxe: Remove unused page_offset member In rxe_map_mr_sg(), the `page_offset` member of the `rxe_mr` struct was initialized based on `ibmr.iova`, which will be updated inside ib_sg_to_pages() later. Consequently, the value assigned to `page_offset` was incorrect. However, since `page_offset` was never utilized throughout the code, it can be safely removed to clean up the codebase and avoid future confusion. Signed-off-by: Li Zhijian Link: https://patch.msgid.link/20260116032833.2574627-1-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 18ea78e2ae83d1d86a72d21d9511927e57e2c0e1 Author: Or Har-Toov Date: Thu Jan 15 14:26:45 2026 +0200 IB/mlx5: Fix port speed query for representors When querying speed information for a representor in switchdev mode, the code previously used the first device in the eswitch, which may not match the device that actually owns the representor. In setups such as multi-port eswitch or LAG, this led to incorrect port attributes being reported. Fix this by retrieving the correct core device from the representor's eswitch before querying its port attributes. Fixes: 27f9e0ccb6da ("net/mlx5: Lag, Add single RDMA device in multiport mode") Signed-off-by: Or Har-Toov Reviewed-by: Mark Bloch Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260115-port-speed-query-fix-v2-1-3bde6a3c78e7@nvidia.com Signed-off-by: Leon Romanovsky commit 382dd788cb8b25dff007fb45d064ba8b1095685a Author: Zhang Yi Date: Sat Nov 29 18:32:46 2025 +0800 ext4: drop the TODO comment in ext4_es_insert_extent() Now we have ext4_es_cache_extent() to cache on-disk extents instead of ext4_es_insert_extent(), so drop the TODO comment. Signed-off-by: Zhang Yi Reviewed-by: Baokun Li Message-ID: <20251129103247.686136-15-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit a5567347b6f5e888c56274d710b8f9525dbd57d0 Author: Zhang Yi Date: Sat Nov 29 18:32:45 2025 +0800 ext4: replace ext4_es_insert_extent() when caching on-disk extents In ext4, the remaining places for inserting extents into the extent status tree within ext4_ext_determine_insert_hole() and ext4_map_query_blocks() directly cache on-disk extents. We can use ext4_es_cache_extent() instead of ext4_es_insert_extent() in these cases. This will help reduce unnecessary increases in extent sequence numbers and cache invalidations after supporting IOMAP in the future. Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Baokun Li Message-ID: <20251129103247.686136-14-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit b32e61cf6470ced0a70f20c9b513511a4e79b390 Author: Zhang Yi Date: Sat Nov 29 18:32:44 2025 +0800 ext4: adjust the debug info in ext4_es_cache_extent() Print a trace point after successfully inserting an extent in the ext4_es_cache_extent() function. Additionally, similar to other extent cache operation functions, call ext4_print_pending_tree() to display the extent debug information of the inode when in ES_DEBUG mode. Signed-off-by: Zhang Yi Reviewed-by: Baokun Li Message-ID: <20251129103247.686136-13-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit ae3e5ebbdd77a9b2b2eccd6a96ff656dfa3d718f Author: Zhang Yi Date: Sat Nov 29 18:32:43 2025 +0800 ext4: make ext4_es_cache_extent() support overwrite existing extents Currently, ext4_es_cache_extent() is used to load extents into the extent status tree when reading on-disk extent blocks. But it inserts information into the extent status tree if and only if there isn't information about the specified range already. So it only used for the initial loading and does not support overwrit extents. However, there are many other places in ext4 where on-disk extents are inserted into the extent status tree, such as in ext4_map_query_blocks(). Currently, they call ext4_es_insert_extent() to perform the insertion, but they don't modify the extents, so ext4_es_cache_extent() would be a more appropriate choice. However, when ext4_map_query_blocks() inserts an extent, it may overwrite a short existing extent of the same type. Therefore, to prepare for the replacements, we need to extend ext4_es_cache_extent() to allow it to overwrite existing extents with the same status. So it checks the found extents before removing and inserting. (There is one exception, a hole in the on-disk extent but a delayed extent in the extent status tree is allowed.) In addition, since cached extents can be more lenient than the extents they modify and do not involve modifying reserved blocks, it is not necessary to ensure that the insertion operation succeeds as strictly as in the ext4_es_insert_extent() function. Signed-off-by: Zhang Yi Reviewed-by: Baokun Li Message-ID: <20251129103247.686136-12-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 42ad7b23b335835548fecc757d6627b67cd5f0b4 Author: Zhang Yi Date: Sat Nov 29 18:32:42 2025 +0800 ext4: make __es_remove_extent() check extent status Currently, __es_remove_extent() unconditionally removes extent status entries within the specified range. In order to prepare for extending the ext4_es_cache_extent() function to cache on-disk extents, which may overwrite some existing short-length extents with the same status, allow __es_remove_extent() to check the specified extent type before removing it, and return error and pass out the conflicting extent if the status does not match. Signed-off-by: Zhang Yi Reviewed-by: Baokun Li Message-ID: <20251129103247.686136-11-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit ef46e0d70014cad87dc18e7d292e7c75c0ef30c8 Author: Zhang Yi Date: Sat Nov 29 18:32:41 2025 +0800 ext4: cleanup useless out label in __es_remove_extent() The out label in __es_remove_extent() is just return err value, we can return it directly if something bad happens. Therefore, remove the useless out label and rename out_get_reserved to out. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Reviewed-by: Baokun Li Message-ID: <20251129103247.686136-10-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit c0329d0288dee6be26e5eca71fdc520c1c5e6acf Author: Zhang Yi Date: Sat Nov 29 18:32:40 2025 +0800 ext4: cleanup zeroout in ext4_split_extent_at() zero_ex is a temporary variable used only for writing zeros and inserting extent status entry, it will not be directly inserted into the tree. Therefore, it can be assigned values from the target extent in various scenarios, eliminating the need to explicitly assign values to each variable individually. Signed-off-by: Zhang Yi Reviewed-by: Ojaswin Mujoo Reviewed-by: Jan Kara Reviewed-by: Baokun Li Message-ID: <20251129103247.686136-9-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 79b592e8f1b435796cbc2722190368e3e8ffd7a1 Author: Zhang Yi Date: Sat Nov 29 18:32:39 2025 +0800 ext4: drop extent cache when splitting extent fails When the split extent fails, we might leave some extents still being processed and return an error directly, which will result in stale extent entries remaining in the extent status tree. So drop all of the remaining potentially stale extents if the splitting fails. Signed-off-by: Zhang Yi Reviewed-by: Baokun Li Cc: stable@kernel.org Reviewed-by: Ojaswin Mujoo Message-ID: <20251129103247.686136-8-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 6d882ea3b0931b43530d44149b79fcd4ffc13030 Author: Zhang Yi Date: Sat Nov 29 18:32:38 2025 +0800 ext4: drop extent cache after doing PARTIAL_VALID1 zeroout When splitting an unwritten extent in the middle and converting it to initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent. Assume we have an unwritten file and buffered write in the middle of it without dioread_nolock enabled, it will allocate blocks as written extent. 0 A B N [UUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDD--] D: valid data |<- ->| ----> this range needs to be initialized ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and leave the entire extent as unwritten. 0 A B N [UUUUUUUUUUUU] on-disk extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDDZZ] Z: zeroed data ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and leave an written extent from A to N. 0 A B N [UUWWWWWWWWWW] on-disk extent W: written extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDDZZ] Finally ext4_map_create_blocks() only insert extent A to B to the extent status tree, and leave an stale unwritten extent in the status tree. 0 A B N [UUWWWWWWWWWW] on-disk extent W: written extent [UUWWWWWWWWUU] extent status tree [--DDDDDDDDZZ] Fix this issue by always cached extent status entry after zeroing out the second part. Signed-off-by: Zhang Yi Reviewed-by: Baokun Li Cc: stable@kernel.org Reviewed-by: Ojaswin Mujoo Message-ID: <20251129103247.686136-7-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 8b4b19a2f96348d70bfa306ef7d4a13b0bcbea79 Author: Zhang Yi Date: Sat Nov 29 18:32:37 2025 +0800 ext4: don't cache extent during splitting extent Caching extents during the splitting process is risky, as it may result in stale extents remaining in the status tree. Moreover, in most cases, the corresponding extent block entries are likely already cached before the split happens, making caching here not particularly useful. Assume we have an unwritten extent, and then DIO writes the first half. [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUUUUUU] extent status tree |<- ->| ----> dio write this range First, when ext4_split_extent_at() splits this extent, it truncates the existing extent and then inserts a new one. During this process, this extent status entry may be shrunk, and calls to ext4_find_extent() and ext4_cache_extents() may occur, which could potentially insert the truncated range as a hole into the extent status tree. After the split is completed, this hole is not replaced with the correct status. [UUUUUUU|UUUUUUUU] on-disk extent U: unwritten extent [UUUUUUU|HHHHHHHH] extent status tree H: hole Then, the outer calling functions will not correct this remaining hole extent either. Finally, if we perform a delayed buffer write on this latter part, it will re-insert the delayed extent and cause an error in space accounting. In adition, if the unwritten extent cache is not shrunk during the splitting, ext4_cache_extents() also conflicts with existing extents when caching extents. In the future, we will add checks when caching extents, which will trigger a warning. Therefore, Do not cache extents that are being split. Signed-off-by: Zhang Yi Reviewed-by: Ojaswin Mujoo Reviewed-by: Baokun Li Cc: stable@kernel.org Message-ID: <20251129103247.686136-6-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 5f1a1cccebf87e6c51f981908cc3cc10c3bc936b Author: Zhang Yi Date: Sat Nov 29 18:32:36 2025 +0800 ext4: correct the mapping status if the extent has been zeroed Before submitting I/O and allocating blocks with the EXT4_GET_BLOCKS_PRE_IO flag set, ext4_split_convert_extents() may convert the target extent range to initialized due to ENOSPC, ENOMEM, or EQUOTA errors. However, it still marks the mapping as incorrectly unwritten. Although this may not seem to cause any practical problems, it will result in an unnecessary extent conversion operation after I/O completion. Therefore, it's better to correct the returned mapping status. Signed-off-by: Zhang Yi Reviewed-by: Ojaswin Mujoo Reviewed-by: Baokun Li Message-ID: <20251129103247.686136-5-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit feaf2a80e78f89ee8a3464126077ba8683b62791 Author: Zhang Yi Date: Sat Nov 29 18:32:35 2025 +0800 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O When allocating blocks during within-EOF DIO and writeback with dioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an existing large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was set when calling ext4_split_convert_extents(), which may potentially result in stale data issues. Assume we have an unwritten extent, and then DIO writes the second half. [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUUUUUU] extent status tree |<- ->| ----> dio write this range First, ext4_iomap_alloc() call ext4_map_blocks() with EXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and EXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and call ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the above flags set. Then, ext4_split_convert_extents() calls ext4_split_extent() with EXT4_EXT_MAY_ZEROOUT, EXT4_EXT_MARK_UNWRIT2 and EXT4_EXT_DATA_VALID2 flags set, and it calls ext4_split_extent_at() to split the second half with EXT4_EXT_DATA_VALID2, EXT4_EXT_MARK_UNWRIT1, EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_MARK_UNWRIT2 flags set. However, ext4_split_extent_at() failed to insert extent since a temporary lack -ENOSPC. It zeroes out the first half but convert the entire on-disk extent to written since the EXT4_EXT_DATA_VALID2 flag set, but left the second half as unwritten in the extent status tree. [0000000000SSSSSS] data S: stale data, 0: zeroed [WWWWWWWWWWWWWWWW] on-disk extent W: written extent [WWWWWWWWWWUUUUUU] extent status tree Finally, if the DIO failed to write data to the disk, the stale data in the second half will be exposed once the cached extent entry is gone. Fix this issue by not passing EXT4_GET_BLOCKS_CONVERT when splitting an unwritten extent before submitting I/O, and make ext4_split_convert_extents() to zero out the entire extent range to zero for this case, and also mark the extent in the extent status tree for consistency. Fixes: b8a8684502a0 ("ext4: Introduce FALLOC_FL_ZERO_RANGE flag for fallocate") Signed-off-by: Zhang Yi Reviewed-by: Ojaswin Mujoo Reviewed-by: Baokun Li Cc: stable@kernel.org Message-ID: <20251129103247.686136-4-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 1bf6974822d1dba86cf11b5f05498581cf3488a2 Author: Zhang Yi Date: Sat Nov 29 18:32:34 2025 +0800 ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 When allocating initialized blocks from a large unwritten extent, or when splitting an unwritten extent during end I/O and converting it to initialized, there is currently a potential issue of stale data if the extent needs to be split in the middle. 0 A B N [UUUUUUUUUUUU] U: unwritten extent [--DDDDDDDD--] D: valid data |<- ->| ----> this range needs to be initialized ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and mark the entire extent from 0 to N as written. 0 A B N [WWWWWWWWWWWW] W: written extent [SSDDDDDDDDZZ] Z: zeroed, S: stale data ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left a stale written extent from 0 to A. 0 A B N [WW|WWWWWWWWWW] [SS|DDDDDDDDZZ] Fix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at() when splitting at B, don't convert the entire extent to written and left it as unwritten after zeroing out B to N. The remaining work is just like the standard two-part split. ext4_split_extent() will pass the EXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the second time, allowing it to properly handle the split. If the split is successful, it will keep extent from 0 to A as unwritten. Signed-off-by: Zhang Yi Reviewed-by: Ojaswin Mujoo Reviewed-by: Baokun Li Cc: stable@kernel.org Message-ID: <20251129103247.686136-3-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 22784ca541c0f01c5ebad14e8228298dc0a390ed Author: Zhang Yi Date: Sat Nov 29 18:32:33 2025 +0800 ext4: subdivide EXT4_EXT_DATA_VALID1 When splitting an extent, if the EXT4_GET_BLOCKS_CONVERT flag is set and it is necessary to split the target extent in the middle, ext4_split_extent() first handles splitting the latter half of the extent and passes the EXT4_EXT_DATA_VALID1 flag. This flag implies that all blocks before the split point contain valid data; however, this assumption is incorrect. Therefore, subdivid EXT4_EXT_DATA_VALID1 into EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_DATA_PARTIAL_VALID1, which indicate that the first half of the extent is either entirely valid or only partially valid, respectively. These two flags cannot be set simultaneously. This patch does not use EXT4_EXT_DATA_PARTIAL_VALID1, it only replaces EXT4_EXT_DATA_VALID1 with EXT4_EXT_DATA_ENTIRE_VALID1 at the location where it is set, no logical changes. Signed-off-by: Zhang Yi Reviewed-by: Ojaswin Mujoo Reviewed-by: Baokun Li Cc: stable@kernel.org Message-ID: <20251129103247.686136-2-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit ebc2164a4cd4314503f1a0c8e7aaf76d7e5fa211 Author: Chiara Meiohas Date: Tue Jan 13 15:37:10 2026 +0200 RDMA/mlx5: Fix UMR hang in LAG error state unload During firmware reset in LAG mode, a race condition causes the driver to hang indefinitely while waiting for UMR completion during device unload. See [1]. In LAG mode the bond device is only registered on the master, so it never sees sys_error events from the slave. During firmware reset this causes UMR waits to hang forever on unload as the slave is dead but the master hasn't entered error state yet, so UMR posts succeed but completions never arrive. Fix this by adding a sys_error notifier that gets registered before MLX5_IB_STAGE_IB_REG and stays alive until after ib_unregister_device(). This ensures error events reach the bond device throughout teardown. [1] Call Trace: __schedule+0x2bd/0x760 schedule+0x37/0xa0 schedule_preempt_disabled+0xa/0x10 __mutex_lock.isra.6+0x2b5/0x4a0 __mlx5_ib_dereg_mr+0x606/0x870 [mlx5_ib] ? __xa_erase+0x4a/0xa0 ? _cond_resched+0x15/0x30 ? wait_for_completion+0x31/0x100 ib_dereg_mr_user+0x48/0xc0 [ib_core] ? rdmacg_uncharge_hierarchy+0xa0/0x100 destroy_hw_idr_uobject+0x20/0x50 [ib_uverbs] uverbs_destroy_uobject+0x37/0x150 [ib_uverbs] __uverbs_cleanup_ufile+0xda/0x140 [ib_uverbs] uverbs_destroy_ufile_hw+0x3a/0xf0 [ib_uverbs] ib_uverbs_remove_one+0xc3/0x140 [ib_uverbs] remove_client_context+0x8b/0xd0 [ib_core] disable_device+0x8c/0x130 [ib_core] __ib_unregister_device+0x10d/0x180 [ib_core] ib_unregister_device+0x21/0x30 [ib_core] __mlx5_ib_remove+0x1e4/0x1f0 [mlx5_ib] auxiliary_bus_remove+0x1e/0x30 device_release_driver_internal+0x103/0x1f0 bus_remove_device+0xf7/0x170 device_del+0x181/0x410 mlx5_rescan_drivers_locked.part.10+0xa9/0x1d0 [mlx5_core] mlx5_disable_lag+0x253/0x260 [mlx5_core] mlx5_lag_disable_change+0x89/0xc0 [mlx5_core] mlx5_eswitch_disable+0x67/0xa0 [mlx5_core] mlx5_unload+0x15/0xd0 [mlx5_core] mlx5_unload_one+0x71/0xc0 [mlx5_core] mlx5_sync_reset_reload_work+0x83/0x100 [mlx5_core] process_one_work+0x1a7/0x360 worker_thread+0x30/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x116/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x22/0x40 Fixes: ede132a5cf55 ("RDMA/mlx5: Move events notifier registration to be after device registration") Signed-off-by: Chiara Meiohas Signed-off-by: Maher Sanalla Reviewed-by: Mark Bloch Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260113-umr-hand-lag-fix-v1-1-3dc476e00cd9@nvidia.com Signed-off-by: Leon Romanovsky commit 3f6cf0653f8a2117ec135b2ca322ec68abc1b26c Author: Swaraj Gaikwad Date: Mon Dec 15 02:28:50 2025 +0000 drm/msm: Replace custom dumb_map_offset with generic helper The msm driver implements a custom dumb_map_offset callback. This implementation acquires the msm_gem_lock, but the underlying drm_gem_create_mmap_offset() function is already thread-safe regarding the VMA offset manager (it acquires the mgr->vm_lock internally). Switching to the generic drm_gem_dumb_map_offset() helper provides several benefits: 1. Removes the unnecessary locking overhead (locking leftovers). 2. Adds a missing check to reject mapping of imported objects, which is invalid for dumb buffers. 3. Allows for the removal of the msm_gem_dumb_map_offset() wrapper and the msm_gem_mmap_offset() helper function. The logic from msm_gem_mmap_offset() has been inlined into msm_ioctl_gem_info() to maintain functionality without the separate helper. This addresses the TODO: "Documentation/gpu/todo.rst: Remove custom dumb_map_offset implementations" Signed-off-by: Swaraj Gaikwad Patchwork: https://patchwork.freedesktop.org/patch/694727/ Message-ID: <20251215022850.12358-1-swarajgaikwad1925@gmail.com> Signed-off-by: Rob Clark commit 5b6f6a76e0b8908d7071cd7d83bd8fb12f38990e Author: Dmitry Baryshkov Date: Fri Nov 21 18:13:04 2025 +0200 drm/msm/a2xx: add A225 entry to catalog Add catalog entry for Adreno A225.6 as present on MSM8960v3. Most of the pieces were already contributed by Jonathan Marek in commit 21af872cd8c6 ("drm/msm/adreno: add a2xx"), but weren't enabled because there was no GPU entry. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/689908/ Message-ID: <20251121-a225-v1-2-a1bab651d186@oss.qualcomm.com> Signed-off-by: Rob Clark commit 6a7b0a670ba4d283285d76d45233cbecc5af5e40 Author: Dmitry Baryshkov Date: Fri Nov 21 18:13:03 2025 +0200 drm/msm/a2xx: fix pixel shader start on A225 A225 has a different PixelShader start address, write correct address while initializing GPU. Fixes: 21af872cd8c6 ("drm/msm/adreno: add a2xx") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/689906/ Message-ID: <20251121-a225-v1-1-a1bab651d186@oss.qualcomm.com> Signed-off-by: Rob Clark commit ae26b4d513347aa247772a26f374b66d30af550e Author: Konrad Dybcio Date: Mon Dec 29 21:47:39 2025 +0100 dt-bindings: display/msm/gpu: Straighten out reg-names on A619L/610/702 These GPUs have physically have the same regions as the base case ("main" + "cx_mem" + "cx_dbgc"). Remove the specific override. Signed-off-by: Konrad Dybcio Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/696547/ Message-ID: <20251229-topic-6115_2290_gpu_dbgc-v1-1-4a24d196389c@oss.qualcomm.com> Signed-off-by: Rob Clark commit e2938ad00b21340c0362562dfedd7cfec0554d67 Author: System Administrator Date: Thu Oct 9 16:35:00 2025 +0000 apparmor: fix NULL pointer dereference in __unix_needs_revalidation When receiving file descriptors via SCM_RIGHTS, both the socket pointer and the socket's sk pointer can be NULL during socket setup or teardown, causing NULL pointer dereferences in __unix_needs_revalidation(). This is a regression in AppArmor 5.0.0 (kernel 6.17+) where the new __unix_needs_revalidation() function was added without proper NULL checks. The crash manifests as: BUG: kernel NULL pointer dereference, address: 0x0000000000000018 RIP: aa_file_perm+0xb7/0x3b0 (or +0xbe/0x3b0, +0xc0/0x3e0) Call Trace: apparmor_file_receive+0x42/0x80 security_file_receive+0x2e/0x50 receive_fd+0x1d/0xf0 scm_detach_fds+0xad/0x1c0 The function dereferences sock->sk->sk_family without checking if either sock or sock->sk is NULL first. Add NULL checks for both sock and sock->sk before accessing sk_family. Fixes: 88fec3526e841 ("apparmor: make sure unix socket labeling is correctly updated.") Reported-by: Jamin Mc Closes: https://bugzilla.proxmox.com/show_bug.cgi?id=7083 Closes: https://gitlab.com/apparmor/apparmor/-/issues/568 Signed-off-by: Fabian Grünbichler Signed-off-by: System Administrator Signed-off-by: John Johansen commit bbef8e2c29c32f048fac8e07f884f827d028f1da Author: Thomas Gleixner Date: Sun Jan 18 15:45:40 2026 +0100 x86/percpu: Make CONFIG_USE_X86_SEG_SUPPORT work with sparse Now that sparse builds enforce the usage of typeof_unqual() the casts in __raw_cpu_read/write() cause sparse to emit tons of false postive warnings: warning: cast removes address space '__percpu' of expression Address this by annotating the casts with __force. Reported-by: kernel test robot Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/87v7gz0yjv.ffs@tglx Closes: https://lore.kernel.org/oe-kbuild-all/202601181733.YZOf9XU3-lkp@intel.com/ commit 93d4dbdc8da0b8a3ba86f4a08868084f8da872e1 Author: Thorsten Blum Date: Thu Nov 6 15:51:38 2025 +0100 apparmor: Replace deprecated strcpy in d_namespace_path strcpy() is deprecated; replace it with a direct '/' assignment. The buffer is already NUL-terminated, so there is no need to copy an additional NUL terminator as strcpy() did. Update the comment and add the local variable 'is_root' for clarity. Closes: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: John Johansen commit b31d3f7385fbb49681d44e7104cfa033cba4b1e8 Author: Thorsten Blum Date: Sat Nov 22 12:55:51 2025 +0100 apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init strcpy() is deprecated and sprintf() does not perform bounds checking either. Although an overflow is unlikely, it's better to proactively avoid it by using the safer strscpy() and scnprintf(), respectively. Additionally, unify memory allocation for 'hname' to simplify and improve aa_policy_init(). Closes: https://github.com/KSPP/linux/issues/88 Reviewed-by: Serge Hallyn Signed-off-by: Thorsten Blum Signed-off-by: John Johansen commit 3a74e73b863a2493c0502a08e20ab026a0134ca1 Author: Biju Das Date: Tue Jan 13 12:53:12 2026 +0000 irqchip/renesas-rzv2h: Add suspend/resume support On RZ/G3E using PSCI, s2ram powers down the SoC. Add suspend/resume callbacks to restore IRQ type for NMI, TINT and external IRQ interrupts. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260113125315.359967-3-biju.das.jz@bp.renesas.com commit a384f2ed886d4417d50fdad78aaf1ccf870d62e6 Author: Vladimir Kondratiev Date: Sun Jan 18 10:28:43 2026 +0200 irqchip/aslint-sswi: Fix error check of of_io_request_and_map() result of_io_request_and_map() returns IOMEM_ERR_PTR() on failure which is non-NULL. Fixes: 8a7f030df897 ("irqchip/aslint-sswi: Request IO memory resource") Reported-by: Chris Mason Signed-off-by: Vladimir Kondratiev Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260118082843.2786630-1-vladimir.kondratiev@mobileye.com Closes: https://lore.kernel.org/all/20260116124257.78357-1-clm@meta.com commit a34d398c83a4a4bc00513c00f6eecc34267f834f Author: Huacai Chen Date: Tue Jan 13 16:59:40 2026 +0800 irqchip: Allow LoongArch irqchip drivers on both 32BIT/64BIT All LoongArch irqchip drivers are adjusted, allow them to be built on both 32BIT and 64BIT platforms. Co-developed-by: Jiaxun Yang Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260113085940.3344837-8-chenhuacai@loongson.cn commit 0370a5e740f2a078ac3cd3e20dae2dc95c6b92f3 Author: Huacai Chen Date: Tue Jan 13 16:59:39 2026 +0800 irqchip/loongson-pch-pic: Adjust irqchip driver for 32BIT/64BIT irq_domain_alloc_fwnode() takes a parameter with the phys_addr_t type. Currently we pass acpi_pchpic->address to it. This can only work on 64BIT platform because its type is u64, so cast it to phys_addr_t and then the driver works on both 32BIT and 64BIT platforms. Also use readl() to read vec_count because readq() is only available on 64BIT platform. [ tglx: Make the cast explicit and use the casted address as argument for pch_pic_init() which takes a phys_addr_t as well. Fixup coding style. More sigh... ] Co-developed-by: Jiaxun Yang Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260113085940.3344837-7-chenhuacai@loongson.cn commit 4093b0e55b39422bbdae108a1be06292714a994d Author: Huacai Chen Date: Tue Jan 13 16:59:38 2026 +0800 irqchip/loongson-pch-msi: Adjust irqchip driver for 32BIT/64BIT irq_domain_alloc_fwnode() takes a parameter with the phys_addr_t type. Currently the code passe acpi_pchmsi->msg_address to it. This can only work on 64BIT platform because its type is u64, so cast it to phys_addr_t and then the driver works on both 32BIT and 64BIT platform. [ tglx: Make the cast explicit and fixup coding style. ] Co-developed-by: Jiaxun Yang Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260113085940.3344837-6-chenhuacai@loongson.cn commit 04f1f17d28ce24a7b40039c8d8ee053a777661a7 Author: Huacai Chen Date: Tue Jan 13 16:59:37 2026 +0800 irqchip/loongson-htvec: Adjust irqchip driver for 32BIT/64BIT irq_domain_alloc_fwnode() takes a parameter with the phys_addr_t type. Currently the code passes acpi_htvec->address to it. This can only work on 64BIT platform because its type is u64, so cast it to phys_addr_t and then the driver works on both 32BIT and 64BIT platforms. [ tglx: Dereference _after_ the NULL pointer check, make the cast explicit and use the casted address as argument for htvec_init() which takes a phys_addr_t as well. Sigh... ] Co-developed-by: Jiaxun Yang Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260113085940.3344837-5-chenhuacai@loongson.cn commit 61fb5e517ec457c76211f03ab0b379882248706d Author: Huacai Chen Date: Tue Jan 13 16:59:36 2026 +0800 irqchip/loongson-eiointc: Adjust irqchip driver for 32BIT/64BIT iocsr_read64()/iocsr_write64() are only available on 64BIT LoongArch platform, so add and use a pair of helpers, i.e. read_isr()/write_isr() instead to make the driver work on both 32BIT and 64BIT platforms. This makes eoiintc_enable() a no-op for 32-bit as it is only required on 64-bit systems. [ tglx: Make the helpers inline and fixup the variable declaration order ] Co-developed-by: Jiaxun Yang Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260113085940.3344837-4-chenhuacai@loongson.cn commit 57e05137ac3b37fd9b7b8714839d25b924073aef Author: Huacai Chen Date: Tue Jan 13 16:59:35 2026 +0800 irqchip/loongson-liointc: Adjust irqchip driver for 32BIT/64BIT irq_domain_alloc_fwnode() takes a parameter with the phys_addr_t type. Currently the code passes acpi_liointc->address to it. This can only work on 64BIT platforms because its type is u64, so cast it to phys_addr_t and then the driver works on both 32BIT and 64BIT platform. [ tglx: Make the cast explicit and use the casted address as argument for liointc_init() which takes a phys_addr_t as well. Sigh... ] Co-developed-by: Jiaxun Yang Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260113085940.3344837-3-chenhuacai@loongson.cn commit d9e7035a51b89ef6041ce7c00b629e7877134a51 Author: Huacai Chen Date: Tue Jan 13 16:59:34 2026 +0800 irqchip/loongarch-avec: Adjust irqchip driver for 32BIT/64BIT csr_read64() is only available on 64BIT LoongArch platform, so use the recently added adaptive csr_read() instead to make the driver work on both 32BIT and 64BIT platforms. This makes avecintc_enable() a no-op for 32-bit as it is only required on 64-bit systems. Co-developed-by: Jiaxun Yang Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260113085940.3344837-2-chenhuacai@loongson.cn commit df73d3c618b4d6cca85304291d2bdaa35c87fb26 Merge: 5e35a24c96185e fcf463b92a0868 Author: Jens Axboe Date: Sun Jan 18 06:27:37 2026 -0700 Merge branch 'for-7.0/blk-pvec' into for-7.0/block * for-7.0/blk-pvec: types: move phys_vec definition to common header nvme-pci: Use size_t for length fields to handle larger sizes commit 450517fa5aae98b857c68743fd12ce93e4b8989d Author: Pankaj Patil Date: Sun Jan 11 21:22:34 2026 +0530 dt-bindings: watchdog: qcom-wdt: Document Glymur watchdog Add devicetree binding for watchdog present on Qualcomm's Glymur SoC Signed-off-by: Pankaj Patil Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 478003f61bf5db3c844a1976b54a1d2247a24793 Author: J. Neuschäfer Date: Thu Jan 1 17:54:22 2026 +0100 dt-bindings: watchdog: Convert mpc8xxx-wdt to YAML Convert mpc83xx-wdt.txt to YAML to enable automatic schema validation. Signed-off-by: J. Neuschäfer Reviewed-by: Rob Herring (Arm) Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 103f4e7c8544961c72dd9f68eed384a2f1194d03 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:14 2026 +0000 iommu/amd: Add support for nested domain attach/detach Introduce set_dte_nested() to program guest translation settings in the host DTE when attaches the nested domain to a device. Reviewed-by: Nicolin Chen Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit 93eee2a49c1b33b73921a915a1ec47845bd60551 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:13 2026 +0000 iommu/amd: Refactor logic to program the host page table in DTE Introduce the amd_iommu_set_dte_v1() helper function to configure IOMMU host (v1) page table into DTE. This will be used later when attaching nested doamin. Also, remove obsolete warning when SNP is enabled and domain id is zero since this check is no longer applicable. Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit 4e1b09d90bdfc79b2a024121a1f3b5e41c80de81 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:12 2026 +0000 iommu/amd: Refactor persistent DTE bits programming into amd_iommu_make_clear_dte() To help avoid duplicate logic when programing DTE for nested translation. Note that this commit changes behavior of when the IOMMU driver is switching domain during attach and the blocking domain, where DTE bit fields for interrupt pass-through (i.e. Lint0, Lint1, NMI, INIT, ExtInt) and System management message could be affected. These DTE bits are specified in the IVRS table for specific devices, and should be persistent. Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: Nicolin Chen Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit 757d2b1fdf5b7d6eead5963a49b5780617987ab8 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:11 2026 +0000 iommu/amd: Introduce gDomID-to-hDomID Mapping and handle parent domain invalidation Each nested domain is assigned guest domain ID (gDomID), which guest OS programs into guest Device Table Entry (gDTE). For each gDomID, the driver assigns a corresponding host domain ID (hDomID), which will be programmed into the host Device Table Entry (hDTE). The hDomID is allocated during amd_iommu_alloc_domain_nested(), and free during nested_domain_free(). The gDomID-to-hDomID mapping info (struct guest_domain_mapping_info) is stored in a per-viommu xarray (struct amd_iommu_viommu.gdomid_array), which is indexed by gDomID. Note also that parent domain can be shared among struct iommufd_viommu. Therefore, when hypervisor invalidates the nest parent domain, the AMD IOMMU command INVALIDATE_IOMMU_PAGES must be issued for each hDomID in the gdomid_array. This is handled by the iommu_flush_pages_v1_hdom_ids(), where it iterates through struct protection_domain.viommu_list. Suggested-by: Jason Gunthorpe Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit 774180a74abc89fd1389f51a6f93dbfcded365c2 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:10 2026 +0000 iommu/amd: Add support for nested domain allocation The nested domain is allocated with IOMMU_DOMAIN_NESTED type to store stage-1 translation (i.e. GVA->GPA). This includes the GCR3 root pointer table along with guest page tables. The struct iommu_hwpt_amd_guest contains this information, and is passed from user-space as a parameter of the struct iommu_ops.domain_alloc_nested(). Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit 8fa8380abd09aa4a72b20329a4beb58544ccaed9 Author: Krzysztof Kozlowski Date: Wed Dec 17 10:51:57 2025 +0100 dt-bindings: watchdog: samsung-wdt: Split if:then: and constrain more Binding defined two if:then: blocks covering different conditions but not fully constraining the properties per each variant: 1. "if:" to require samsung,syscon-phandle, 2. "if:" with "else:" to narrow number of clocks and require or disallow samsung,cluster-index. This still did not cover following cases: 1. Disallow samsung,syscon-phandle when not applicable, 2. Narrow samsung,cluster-index to [0, 1], for SoCs with only two clusters. Solving this in current format would lead to spaghetti code, so re-write entire "if:then:" approach into mutually exclusive cases so each SoC appears only in one "if:" block. This allows to forbid samsung,syscon-phandle for S3C6410, and narrow samsung,cluster-index to [0, 1]. Signed-off-by: Krzysztof Kozlowski Acked-by: Guenter Roeck Acked-by: Rob Herring (Arm) Reviewed-by: Alim Akhtar Signed-off-by: Wim Van Sebroeck commit e113a72576d6056aa91925beaa7256533a808750 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:09 2026 +0000 iommu/amd: Introduce struct amd_iommu_viommu Which stores reference to nested parent domain assigned during the call to struct iommu_ops.viommu_init(). Information in the nest parent is needed when setting up the nested translation. Note that the viommu initialization will be introduced in subsequent commit. Reviewed-by: Jason Gunthorpe Reviewed-by: Nicolin Chen Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit 6a11dbf4d02d56182ff97f596197d93993916878 Author: Krzysztof Kozlowski Date: Wed Dec 17 10:51:56 2025 +0100 dt-bindings: watchdog: samsung-wdt: Drop S3C2410 Samsung S3C2410 SoC was removed from Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of samsung,s3c2410-wdt compatible anymore and platform is so old, that there should be no out-of-tree users. If such existed, they would have enough of time to object dropping Samsung S3C2410 SoC removal from the kernel (which did not happen). Signed-off-by: Krzysztof Kozlowski Acked-by: Guenter Roeck Acked-by: Rob Herring (Arm) Signed-off-by: Wim Van Sebroeck commit b43a29def24f38a28085635e2be39566671976a8 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:08 2026 +0000 iommu/amd: Add support for nest parent domain allocation To support nested translation, the nest parent domain is allocated with IOMMU_HWPT_ALLOC_NEST_PARENT flag, and stores information of the v1 page table for stage 2 (i.e. GPA->SPA). Also, only support nest parent domain on AMD system, which can support the Guest CR3 Table (GCR3TRPMode) feature. This feature is required in order to program DTE[GCR3 Table Root Pointer] with the GPA. Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit b2bb0573ddb2dcac7ebcd65708e172ce0a1de754 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:07 2026 +0000 iommu/amd: Always enable GCR3TRPMode when supported. The GCR3TRPMode feature allows the DTE[GCR3TRP] field to be configured with GPA (instead of SPA). This simplifies the implementation, and is a pre-requisite for nested translation support. Therefore, always enable this feature if available. Reviewed-by: Jason Gunthorpe Reviewed-by: Nicolin Chen Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit e05698c10d980ac0a0b57ed81ec9353b9e9533c6 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:06 2026 +0000 iommufd: Introduce data struct for AMD nested domain allocation Introduce IOMMU_HWPT_DATA_AMD_GUEST data type for IOMMU guest page table, which is used for stage-1 in nested translation. The data structure contains information necessary for setting up the AMD HW-vIOMMU support. Reviewed-by: Jason Gunthorpe Reviewed-by: Nicolin Chen Reviewed-by: Vasant Hegde Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit a7264838057f32317db9e903ab44402b391fda2c Author: Krzysztof Kozlowski Date: Wed Dec 17 10:51:55 2025 +0100 watchdog: s3c2410_wdt: Drop S3C2410 support Samsung S3C2410 SoC was removed from Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of samsung,s3c2410-wdt compatible and s3c2410-wdt platform device name, so drop both. This leaves the driver boundable only via compatibles, so drop any CONFIG_OF ifdefs. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9b467a5af856dce9aba17bb6db3ed34ed79f5d90 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:05 2026 +0000 iommu/amd: Introduce helper function amd_iommu_update_dte() Which includes DTE update, clone_aliases, DTE flush and completion-wait commands to avoid code duplication when reuse to setup DTE for nested translation. Also, make amd_iommu_update_dte() non-static to reuse in in a new nested.c file for nested translation. Reviewed-by: Jason Gunthorpe Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit f2cfba28754490291019d670b985515a36b9d19f Author: Krzysztof Kozlowski Date: Wed Dec 17 10:51:54 2025 +0100 dt-bindings: watchdog: samsung-wdt: Define cluster constraints top-level Properties should be always constrained in top-level part of the bindings, so move the samsung,cluster-index constrain from if: block. Signed-off-by: Krzysztof Kozlowski Acked-by: Guenter Roeck Acked-by: Rob Herring (Arm) Signed-off-by: Wim Van Sebroeck commit 11cfa782f01b2d988175011c19906180a62dd893 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:04 2026 +0000 iommu/amd: Make amd_iommu_make_clear_dte() non-static inline This will be reused in a new nested.c file for nested translation. Also, remove unused function parameter ptr. Reviewed-by: Nicolin Chen Reviewed-by: Vasant Hegde Reviewed-by: Jason Gunthorpe Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit 2dea984a74265a67e3210f818416a83b87f70200 Author: Rafael J. Wysocki Date: Mon Dec 22 21:09:22 2025 +0100 watchdog: rzv2h_wdt: Discard pm_runtime_put() return value Failing device probe due to pm_runtime_put() returning an error is not particularly useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. It also happens when the kernel is configured with CONFIG_PM unset. Accordingly, update rzt2h_wdt_wdtdcr_init() to simply discard the return value of pm_runtime_put() and return success to the caller after invoking that function. This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 5335fc1657493f352fd90121fcb4e5ff2e2fc796 Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:03 2026 +0000 iommu/amd: Rename DEV_DOMID_MASK to DTE_DOMID_MASK Also change the define to use GENMASK_ULL instead. There is no functional change. Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Reviewed-by: Vasant Hegde Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit 4a4da4895895fa4b991bb5e47430bb84a19fdb95 Author: Rafael J. Wysocki Date: Mon Dec 22 21:07:46 2025 +0100 watchdog: rz: Discard pm_runtime_put() return values Failing a watchdog stop due to pm_runtime_put() returning a negative value is not particularly useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. It also happens when the kernel is configured with CONFIG_PM unset. Accordingly, update rzg2l_wdt_stop() and rzv2h_wdt_stop() to simply discard the return value of pm_runtime_put(). This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 439cf01b2e0030eed6020a03a7df4a528f8db7ba Author: Kari Argillander Date: Fri Dec 19 22:42:38 2025 +0200 watchdog: Make API functions const correct Many watchdog API functions do not modify the watchdog_device nor device. Mark their arguments as const to reflect this and improve const-correctness of the API. No functional change intended. Signed-off-by: Kari Argillander Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7d8b06ecc45bd679dec58d2cc2bd86223d4e076d Author: Suravee Suthikulpanit Date: Thu Jan 15 06:08:02 2026 +0000 iommu/amd: Add support for hw_info for iommu capability query AMD IOMMU Extended Feature (EFR) and Extended Feature 2 (EFR2) registers specify features supported by each IOMMU hardware instance. The IOMMU driver checks each feature-specific bits before enabling each feature at run time. For IOMMUFD, the hypervisor passes the raw value of amd_iommu_efr and amd_iommu_efr2 to VMM via iommufd IOMMU_DEVICE_GET_HW_INFO ioctl. Reviewed-by: Nicolin Chen Reviewed-by: Vasant Hegde Reviewed-by: Jason Gunthorpe Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 Author: Oleksandr Suvorov Date: Sun Nov 23 22:24:33 2025 +0200 watchdog: imx7ulp_wdt: handle the nowayout option The module parameter `nowayout` indicates whether the watchdog should ever be allowed to stop, but the driver currently ignores this option. Pass the `nowayout` parameter to the watchdog core by setting the WDOG_NO_WAY_OUT flag accordingly. Signed-off-by: Oleksandr Suvorov Reviewed-by: Guenter Roeck Reviewed-by: Frank Li Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a1a548c5eca62716c118134a8a1988277e8c5e96 Author: Naina Mehta Date: Fri Nov 21 11:44:11 2025 +0530 watchdog: sbsa: Update the W_IIDR Implementer bit mask to 0xFFF The implementer mask defined in the driver [1] captures bits 0-10, whereas section C.4.2 of BSA specification [2] indicates that bits 0-11 of the W_IIDR register represent the implementer JEP106 code. Update the SBSA_GWDT_IMPL_MASK corresponding to bits 0-11, while at it update SBSA_GWDT_VERSION_MASK mask to use GENMASK. [1] #define SBSA_GWDT_IMPL_MASK 0x7FF [2] Implementer, bits [11:0] Contains the JEP106 code of the company that implemented the Generic Watchdog: Bits[11:8] The JEP106 continuation code of the implementer. Bit[7] Always 0 Bits [6:0] The JEP106 identity code of the implementer. Signed-off-by: Naina Mehta Acked-by: Aaron Plattner Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b0fd1f580bd1eaea1074408dd8ebbc6d3a1ba03c Author: Guenter Roeck Date: Tue Nov 18 13:04:07 2025 -0800 watchdog: Always return time left until watchdog times out The watchdog core knows when the most recent keepalive was sent. It also knows the configured timeout. With that, it can always calculate and return the time left until a watchdog times out, even if its driver does not support it. Convert watchdog_get_timeleft() into a void function. It never returns an error after this patch is applied, so the error checks in the calling code are now pointless and can be removed. Signed-off-by: Guenter Roeck Reviewed-by: Wim Van Sebroeck Signed-off-by: Wim Van Sebroeck commit 0bf75b9c8a0eb1ef46ce85a393dd27ae801fc207 Author: Guenter Roeck Date: Tue Nov 18 11:29:58 2025 -0800 watchdog: iTCO: Drop vendor support iTCO vendor support was introduced in 2006 to support SuperMicro boards with Pentium 3 CPUs. It was extended in 2009 to support motherbords with broken BIOS (specifically Intel DG33TL). The code is long since obsolete, so let's drop support for it. Signed-off-by: Guenter Roeck Reviewed-by: Wim Van Sebroeck Signed-off-by: Wim Van Sebroeck commit fd69b2f7d5f4e1d89cea4cdfa6f15e7fa53d8358 Author: Peter Zijlstra Date: Fri Jan 16 19:18:16 2026 +0100 compiler: Use __typeof_unqual__() for __unqual_scalar_typeof() The recent changes to get_unaligned() resulted in a new sparse warning: net/rds/ib_cm.c:96:35: sparse: sparse: incorrect type in argument 1 (different modifiers) @@ expected void * @@ got restricted __be64 const * @@ net/rds/ib_cm.c:96:35: sparse: expected void * net/rds/ib_cm.c:96:35: sparse: got restricted __be64 const * The updated get_unaligned_t() uses __unqual_scalar_typeof() to get an unqualified type. This works correctly for the compilers, but fails for sparse when the data type is __be64 (or any other __beNN variant). On sparse runs (C=[12]) __beNN types are annotated with __attribute__((bitwise)). That annotation allows sparse to detect incompatible operations on __beNN variables, but it also prevents sparse from evaluating the _Generic() in __unqual_scalar_typeof() and map __beNN to a unqualified scalar type, so it ends up with the default, i.e. the original qualified type of a 'const __beNN' pointer. That then ends up as the first pointer argument to builtin_memcpy(), which obviously causes the above sparse warnings. The sparse git tree supports typeof_unqual() now, which allows to use it instead of the _Generic() based __unqual_scalar_typeof(). With that sparse correctly evaluates the unqualified type and keeps the __beNN logic intact. The downside is that this requires a top of tree sparse build and an old sparse version will emit a metric ton of incomprehensible error messages before it dies with a segfault. Therefore implement a sanity check which validates that the checker is available and capable of handling typeof_unqual(). Emit a warning if not so the user can take informed action. [ tglx: Move the evaluation of USE_TYPEOF_UNQUAL to compiler_types.h so it is set before use and implement the sanity checker ] Reported-by: kernel test robot Signed-off-by: Peter Zijlstra Signed-off-by: Thomas Gleixner Acked-by: Ian Rogers Link: https://patch.msgid.link/87ecnp2zh3.ffs@tglx Closes: https://lore.kernel.org/oe-kbuild-all/202601150001.sKSN644a-lkp@intel.com/ commit 6b617317e5bc95e9962a712314ae0c4b7a4d5cc3 Author: Takashi Sakamoto Date: Sat Jan 17 23:28:22 2026 +0900 ALSA: firewire: remove PCM buffer size constraint from isoc context header In the IEC 61883-1/6 packet streaming engine, the isochronous context header stores CIP headers. Previously, the header storage was limited to PAGE_SIZE, which constrained the maximum PCM buffer size. There is a function with configurable header size. Now the limitation is removed. Link: https://lore.kernel.org/r/20260117142823.440811-10-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit e5f1291b6f3f85559ed124316f814c013262b44e Author: Takashi Sakamoto Date: Sat Jan 17 23:28:21 2026 +0900 firewire: core: add fw_iso_context_create() variant with header storage size This commit adds a new variant of fw_iso_context_create() that allows specifying the size of the isochronous context header storage at allocation time. Link: https://lore.kernel.org/r/20260117142823.440811-9-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 9bf71acd65bf190a0ef1bc885a0a664f91beff03 Author: Takashi Sakamoto Date: Sat Jan 17 23:28:20 2026 +0900 firewire: core: provide isoc header buffer size outside card driver For single-channel isochronous contexts, the header storage size is hard-coded to PAGE_SIZE. which is inconvenient for protocol implementations requiring more space. This commit refactors the code to obtain the header storage size outside the 1394 OHCI driver. Link: https://lore.kernel.org/r/20260117142823.440811-8-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit fc999c7b68ac80cf260a43237e2b304222987243 Author: Takashi Sakamoto Date: Sat Jan 17 23:28:19 2026 +0900 firewire: ohci: allocate isoc context header by kvmalloc() Isochronous packet handling now runs in a workqueue context, where page faults is acceptable. This commit replaces __get_free_page() with kvmalloc() when allocating the isochronous context header buffer. Link: https://lore.kernel.org/r/20260117142823.440811-7-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 090ac6520044d0d02e039d76aaa22f4c9751837f Author: Takashi Sakamoto Date: Sat Jan 17 23:28:18 2026 +0900 firewire: core: add flags member for isochronous context structure This is minor code refactoring to add a flag member to the isochronous context structure. At present, it is used only for the option to drop packets when the context header overflows. Link: https://lore.kernel.org/r/20260117142823.440811-6-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit ea6fdb1cbde04b16c64205176e20082358ce8e99 Author: Takashi Sakamoto Date: Sat Jan 17 23:28:17 2026 +0900 firewire: ohci: use cleanup helper for isoc context header allocation Some cleanup helpers are useful in error path after memory allocation for header storage. Link: https://lore.kernel.org/r/20260117142823.440811-5-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit c544c829894faa9251be1dcb2fe59a0a7ad21fa9 Author: Takashi Sakamoto Date: Sat Jan 17 23:28:16 2026 +0900 firewire: ohci: code refactoring to use union for isoc multiple channel state In 1394 OHCI driver, some members of struct iso_context are only used for multi-channel isochronous contexts. This commit uses a union for these members to clearly separate multi-channel specific state. Link: https://lore.kernel.org/r/20260117142823.440811-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 0fe92d5d2c2ac3af9cb54260e7c90b945ebb306c Author: Takashi Sakamoto Date: Sat Jan 17 23:28:15 2026 +0900 firewire: ohci: refactor isoc single-channel state using a union In 1394 OHCI driver, some members of struct iso_context are only used for single-channel isochronous contexts. This commit groups these members into a union. Link: https://lore.kernel.org/r/20260117142823.440811-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 6b67470dce11cfaa09915cca8a5a807d3daf0b87 Author: Takashi Sakamoto Date: Sat Jan 17 23:28:14 2026 +0900 firewire: core: add function variants for isochronous context creation The fw_iso_callback union was added by a commit ebe4560ed5c ("firewire: Remove function callback casts") to remove function pointer cast. That change affected the cdev layer of the core code, but it is more convenient for fw_iso_context_create() to accept the union directly. This commit renames and changes the existing function to take the union argument, and add static inline wrapper functions as variants. Link: https://lore.kernel.org/r/20260117142823.440811-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 70f752ebb08c85a5ea19471a5aaf26263e53dcb0 Author: Thierry Reding Date: Mon Feb 3 16:22:58 2025 +0100 soc/tegra: pmc: Add PMC contextual functions Add implementations that take as argument a struct tegra_pmc * for most public APIs, as well as a function to obtain the PMC for any given device. This will allow transitioning away users from relying on a global variable storing the PMC context. Signed-off-by: Thierry Reding commit e1fd5ad68acd3c3a76651c811e1fdb4846237370 Author: Thierry Reding Date: Mon Feb 3 14:55:03 2025 +0100 soc/tegra: pmc: Do not rely on global variable The reset action for changing the suspend mode back on failure can take a context-specific data argument that can be set to the PMC context in order to avoid relying on a global variable. Signed-off-by: Thierry Reding commit 2e944c51d6617d3ded7734d21202036c126344a1 Author: Thierry Reding Date: Mon Feb 3 14:52:46 2025 +0100 soc/tegra: pmc: Use driver-private data Instead of relying on a global variable for the PMC context, use the driver-private data for sysfs attributes. Signed-off-by: Thierry Reding commit bb946b0e118dc95160d2313474b2ca4de771f82b Author: Thierry Reding Date: Mon Feb 3 14:51:18 2025 +0100 soc/tegra: pmc: Use PMC context embedded in powergates The powergates exposed by the PMC have a pointer to the PMC context embedded. Use that embedded reference instead of relying on a global variable. For the core power domain a new structure needs to be introduced to wrap the generic PM domain and store the PMC context. Signed-off-by: Thierry Reding commit b2a3e8200056480219d4bc44c3403cacf0125495 Author: Thierry Reding Date: Mon Feb 3 14:47:15 2025 +0100 soc/tegra: pmc: Pass PMC context as debugfs data Each debugfs file can have private data associated with it. Use this to pass the PMC context instead of relying on a global variable. Signed-off-by: Thierry Reding commit a9f822b3ff7b47a5b78f1258b998cbeb29089a62 Author: Thierry Reding Date: Mon Feb 3 14:41:45 2025 +0100 soc/tegra: pmc: Pass PMC context via sys-off callback data To avoid relying on global variables, use the sys-off callback data to store a reference to the PMC context structure. Signed-off-by: Thierry Reding commit 48b7f802fb78f6f13c771c03fd6329c8a88e6991 Author: Thierry Reding Date: Mon Feb 3 14:38:24 2025 +0100 soc/tegra: pmc: Embed reboot notifier in PMC context Instead of relying on a global variable to track the PMC context, embed the reboot notifier into the PMC context so that the latter can be resolved using container_of(). Signed-off-by: Thierry Reding commit 0732dffeb093064b7954a48362ec83a25262878b Author: Thierry Reding Date: Mon Feb 3 14:33:09 2025 +0100 soc/tegra: pmc: Store PMC context in clocks Clocks exposed by the PMC need to reference the PMC context for register programming. Store a reference to the context in the data structure for each clock to avoid the need for a global variable. Signed-off-by: Thierry Reding commit 1c672945ceb4ba55feb2ba9d6816be395a6e32d7 Author: Thierry Reding Date: Mon Feb 3 14:27:21 2025 +0100 soc/tegra: pmc: Pass struct tegra_pmc to tegra_powergate_state() By using the generic read_poll_timeout() instead of readx_poll_timeout() we can pass additional parameters, which allows us to pass an additional PMC context structure and avoid relying on a global variable for this. Signed-off-by: Thierry Reding commit f59dbd0c9388321336b0f5c57644fd8b0ee94aa9 Author: Thierry Reding Date: Mon Feb 3 18:17:37 2025 +0100 soc/tegra: pmc: Use contextual data instead of global variable Pass the driver-specific data via the syscore struct and use it in the syscore ops. Signed-off-by: Thierry Reding commit e6d96073af681780820c94079b978474a8a44413 Author: Prathamesh Shete Date: Thu Jan 8 05:01:03 2026 +0000 soc/tegra: pmc: Fix unsafe generic_handle_irq() call Currently, when resuming from system suspend on Tegra platforms, the following warning is observed: WARNING: CPU: 0 PID: 14459 at kernel/irq/irqdesc.c:666 Call trace: handle_irq_desc+0x20/0x58 (P) tegra186_pmc_wake_syscore_resume+0xe4/0x15c syscore_resume+0x3c/0xb8 suspend_devices_and_enter+0x510/0x540 pm_suspend+0x16c/0x1d8 The warning occurs because generic_handle_irq() is being called from a non-interrupt context which is considered as unsafe. Fix this warning by deferring generic_handle_irq() call to an IRQ work which gets executed in hard IRQ context where generic_handle_irq() can be called safely. When PREEMPT_RT kernels are used, regular IRQ work (initialized with init_irq_work) is deferred to run in per-CPU kthreads in preemptible context rather than hard IRQ context. Hence, use the IRQ_WORK_INIT_HARD variant so that with PREEMPT_RT kernels, the IRQ work is processed in hardirq context instead of being deferred to a thread which is required for calling generic_handle_irq(). On non-PREEMPT_RT kernels, both init_irq_work() and IRQ_WORK_INIT_HARD() execute in IRQ context, so this change has no functional impact for standard kernel configurations. Signed-off-by: Petlozu Pravareshwar Signed-off-by: Prathamesh Shete Reviewed-by: Jon Hunter Tested-by: Jon Hunter [treding@nvidia.com: miscellaneous cleanups] Signed-off-by: Thierry Reding commit 9bdfeed989b126a3c9c5a6f74ad2d96784b69d27 Author: Lei Xu Date: Fri Jan 16 00:56:14 2026 -0800 arm64: dts: freescale: imx95: Add support for i.MX95 15x15 FRDM board The i.MX95 15x15 FRDM board is a compact and cost-effective development platform based on the i.MX95 applications processor. Add device tree support for this board, including: - LPUART1 and LPUART5 - NETC - USB - PCIe - uSDHC1, uSDHC2 and uSDHC3 - FlexCAN2 and FlexCAN5 - LPI2C2, LPI2C3, LPI2C4 and their child nodes - Watchdog3 Reviewed-by: Laurentiu Mihalcea Signed-off-by: Lei Xu Signed-off-by: Shawn Guo commit b17171492e9897f2c283d7b62d7a283cbbeee6d0 Author: Lei Xu Date: Fri Jan 16 00:56:13 2026 -0800 dt-bindings: arm: fsl: Add compatible for i.MX95 15x15 FRDM board Introduce a new DT compatible string for the NXP i.MX95 15x15 FRDM development board, a compact and cost-effective platform based on the i.MX95 applications processor. Acked-by: Krzysztof Kozlowski Reviewed-by: Daniel Baluta Reviewed-by: Laurentiu Mihalcea Signed-off-by: Lei Xu Signed-off-by: Shawn Guo commit 868f5c154c25b7b2fba29c5c07f3b22a7ec8d49e Author: Francesco Valla Date: Thu Jan 15 18:41:10 2026 +0100 arm64: dts: imx91-11x11-frdm: fix CAN transceiver gpio According to the HW schematic, the CAN transceiver does not have an enable pin but a silent one. Fix the GPIO property name and polarity. Fixes: b4bf5e55899e ("arm64: dts: freescale: Add FRDM-IMX91 basic support") Signed-off-by: Francesco Valla Acked-by: Daniel Baluta Signed-off-by: Shawn Guo commit 1a7d97c2d3868c7c7b74b26d4af210e22666171b Author: Francesco Valla Date: Thu Jan 15 18:11:34 2026 +0100 arm64: dts: imx93-11x11-frdm: enable additional devices Enable additional devices on the i.MX93 FRDM board: - CAN port and associated transceiver - Bluetooth portion of the IW612 chipset - WiFi SDIO port - user buttons The WiFi portion of the on-board IW612 chipset is still not supported upstream, but since SDIO is a discoverable bus it will be probed once it is. Signed-off-by: Francesco Valla Signed-off-by: Shawn Guo commit f6ef3d9ff81240e9bcc030f2da132eb0f8a761d7 Author: Peng Fan Date: Wed Jan 14 06:12:41 2026 +0800 soc: imx8m: Fix error handling for clk_prepare_enable() imx8m_soc_prepare() directly returns the result of clk_prepare_enable(), which skips proper cleanup if the clock enable fails. Check the return value of clk_prepare_enable() and release resources if failure. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601111406.ZVV3YaiU-lkp@intel.com/ Signed-off-by: Peng Fan Reviewed-by: Marco Felsch Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit f325a91895d8a9167a7f1268569c1877272f897c Author: Andreas Kemnade Date: Tue Jan 13 16:31:36 2026 +0100 ARM: dts: imx: e60k02: add tps65185 Wire up the TPS65185 regulator needed for the display. Signed-off-by: Andreas Kemnade Signed-off-by: Shawn Guo commit 9fcca3e28533b8ee5a67c83be5defad3ed445e91 Author: Josua Mayer Date: Tue Jan 13 16:31:35 2026 +0100 ARM: dts: imx50-kobo-aura: add epd pmic description Kobo Aura (N514) includes a TPS65185 PMIC for the epaper display. Add description for this pmic and its vin power-supply. Signed-off-by: Josua Mayer Signed-off-by: Andreas Kemnade Signed-off-by: Shawn Guo commit e9c48e558696addf692559a9ded4f0064b5e6db2 Author: Andreas Kemnade Date: Tue Jan 13 16:31:34 2026 +0100 ARM: dts: imx: tolino-shine2: add tps65185 Wire up the TPS65185 regulator needed for the display. Signed-off-by: Andreas Kemnade Signed-off-by: Shawn Guo commit b4e486e2c46f754a515571a8ca1238fa567396dd Merge: aa5baafd3345e6 c4279332f479a8 Author: Jakub Kicinski Date: Sat Jan 17 18:04:44 2026 -0800 Merge branch 'net-convert-drivers-to-get_rx_ring_count-part-2' Breno Leitao says: ==================== net: convert drivers to .get_rx_ring_count (part 2) Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns the following drivers with the new ethtool API for querying RX ring parameters. * engleder/tsnep * mediatek * amazon/ena * microchip/lan743x * amd/xgbe * chelsio/cxgb4 * wangxun/txgbe * cadence/macb All of these change were compile-tested only. ==================== Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-0-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski commit c4279332f479a811e4c3c413eb4cd71bc8463288 Author: Breno Leitao Date: Thu Jan 15 06:37:56 2026 -0800 net: txgbe: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-9-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski commit d1c7ed5dfa35d142b5aec4cf9b28eb40f1240fc3 Author: Breno Leitao Date: Thu Jan 15 06:37:55 2026 -0800 net: macb: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-8-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski commit ceec168d03db09f85c208d3ce536ccd715791665 Author: Breno Leitao Date: Thu Jan 15 06:37:54 2026 -0800 net: cxgb4: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-7-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski commit 507353bf84fc1d10f375b7f9303039937ea89e2b Author: Breno Leitao Date: Thu Jan 15 06:37:53 2026 -0800 net: xgbe: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Since ETHTOOL_GRXRINGS was the only command handled by xgbe_get_rxnfc(), remove the function entirely. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-6-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski commit 05ba3044865d81b2248b06c3f60a8d6f1ab5360f Author: Breno Leitao Date: Thu Jan 15 06:37:52 2026 -0800 net: lan743x: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Since ETHTOOL_GRXRINGS was the only command handled by lan743x_ethtool_get_rxnfc(), remove the function entirely. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-5-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski commit 289f714a084c1f6f7359fc2c22dd37db5bc88fb7 Author: Breno Leitao Date: Thu Jan 15 06:37:51 2026 -0800 net: ena: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Since ETHTOOL_GRXRINGS was the only useful command handled by ena_get_rxnfc(), remove the function entirely. Signed-off-by: Breno Leitao Reviewed-by: Arthur Kiyanovski Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-4-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski commit e33bd8dd7f1f81110e22cd9605ef6f9de0235815 Author: Breno Leitao Date: Thu Jan 15 06:37:50 2026 -0800 net: mediatek: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-3-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski commit efa375c44090faf214d351a873cc90b7903080b2 Author: Breno Leitao Date: Thu Jan 15 06:37:49 2026 -0800 net: tsnep: convert to use .get_rx_ring_count Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-2-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski commit aa5baafd3345e621febd6074285b2e9a741666c9 Merge: ba4550d5d724b6 342e31254f0204 Author: Jakub Kicinski Date: Sat Jan 17 18:01:31 2026 -0800 Merge branch 'selftests-net-improve-error-handling-in-passive-tfo-test' Yohei Kojima says: ==================== selftests: net: improve error handling in passive TFO test This series improves error handling in the passive TFO test by (1) fixing a broken behavior when the child processes failed (or timed out), and (2) adding more error handlng code in the test program. The first patch fixes the behavior that the test didn't report failure even if the server or the client process exited with non-zero status. The second patch adds error handling code in the test program to improve reliability of the test. ==================== Link: https://patch.msgid.link/cover.1768312014.git.yk@y-koj.net Signed-off-by: Jakub Kicinski commit 342e31254f02041e3b9d4ad573204d53b2f832c9 Author: Yohei Kojima Date: Tue Jan 13 23:11:55 2026 +0900 selftests: net: improve error handling in passive TFO test Improve the error handling in passive TFO test to check the return value from sendto(), and to fail if read() or fprintf() failed. Signed-off-by: Yohei Kojima Link: https://patch.msgid.link/24707c8133f7095c0e5a94afa69e75c3a80bf6e7.1768312014.git.yk@y-koj.net Signed-off-by: Jakub Kicinski commit 52b4859730434902731e1cd4ea061d9611398008 Author: Yohei Kojima Date: Tue Jan 13 23:11:54 2026 +0900 selftests: net: fix passive TFO test to fail if child processes failed Improve the passive TFO test to report failure if the server or the client timed out or exited with non-zero status. Before this commit, TFO test didn't fail even if exit(EXIT_FAILURE) is added to the first line of the run_server() and run_client() functions. Signed-off-by: Yohei Kojima Link: https://patch.msgid.link/214d399caec2e5de7738ced5736829915d507e4e.1768312014.git.yk@y-koj.net Signed-off-by: Jakub Kicinski commit 8c898869809ddb3347a7cddcb3a8ceee42b38488 Author: Daniel Baluta Date: Tue Jan 13 09:50:02 2026 +0200 arm64: dts: imx93-11x11-frdm: Add MQS audio support Enable Medium Quality Sound (MQS) output on the i.MX93 FRDM 11x11 board by adding sound card description and enabling sai1 and mqs1 dts nodes, together with necessary clocks and pinmux. This supports audio playback via SAI1 DAI which is connected to the MQS1 block. Co-developed-by: Tom Zheng Signed-off-by: Tom Zheng Signed-off-by: Daniel Baluta Tested-by: Francesco Valla Signed-off-by: Shawn Guo commit 2da6336e94c223ee5b8535faf8138f0c8b8f1275 Author: Peng Fan Date: Sun Jan 11 20:40:16 2026 +0800 arm64: dts: imx952-evk: Add nxp,ctrl-ids for scmi misc Add nxp,ctrl-ids in scmi_misc node for wakeup notification. Signed-off-by: Peng Fan Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit aef607803edda92d2fc853a2e5f3dba6d147d598 Author: Haibo Chen Date: Sun Jan 11 20:40:15 2026 +0800 arm64: dts: imx952-evk: Add flexcan support Add flexcan support, since flexcan1 share pins with PDM, default disable flexcan1. Signed-off-by: Haibo Chen Signed-off-by: Peng Fan Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit 13b56cf38fcaf6320d84392c6b6ec783d6def5a1 Author: Peng Fan Date: Sun Jan 11 20:40:14 2026 +0800 arm64: dts: imx952-evk: Enable TPM[3,6] Enable TPM[3,6] for PWM. Signed-off-by: Peng Fan Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit 1f563af57f255b26d4b788f9219ba17a748ccbe3 Author: Peng Fan Date: Sun Jan 11 20:40:13 2026 +0800 arm64: dts: imx952-evk: Enable wdog3 Enable wdog3 to allow System manager reset Linux. Signed-off-by: Peng Fan Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit 8e135b9d57f844da78db760bf22b68a151a0e710 Author: Peng Fan Date: Sun Jan 11 20:40:12 2026 +0800 arm64: dts: imx952-evk: Enable USB[1,2] Enable USB[1,2] and add ptn5110 connected to USB1. Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit ba1d167451875caddb11502fcc26015bbb31d728 Author: Peng Fan Date: Sun Jan 11 20:40:11 2026 +0800 arm64: dts: imx952-evk: Enable SPI7 Enable SPI7 for i.MX952-EVK. Signed-off-by: Peng Fan Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit fc910b85b27147accce831da2e52a56f17987c3c Author: Peng Fan Date: Sun Jan 11 20:40:10 2026 +0800 arm64: dts: imx952-evk: Enable UART5 Enable UART5 for using Bluetooth. Signed-off-by: Peng Fan Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit b7f274333167c9ba3343780d2621f7fa90904657 Author: Peng Fan Date: Sun Jan 11 20:40:09 2026 +0800 arm64: dts: imx952-evk: Enable I2C[2,3,4,6,7] bus Enable I2C bus[2,3,4,6,7] and the io-expanders connected to each I2C bus. Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 570a0eb963274c6f5457e4ee24a18c0baa47058a Author: Haibo Chen Date: Sun Jan 11 20:40:08 2026 +0800 arm64: dts: imx952-evk: Change the usdhc1_200mhz drive strength to DSE4 Set usdhc1_200mhz drive strength need to use DSE4, according to validation team's suggestion, Signed-off-by: Haibo Chen Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 730f6b28cb877fdc75bb13bd4d82c270e3bcd3cd Author: Peng Fan Date: Sun Jan 11 20:40:07 2026 +0800 arm64: dts: imx952: Add idle-states node Add idle-states node and refer it in A55 nodes to enable cpuidle. Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 5eb7405db99b171494f9aa3d37e2985ae74ee37f Author: Fedor Ross Date: Tue Jan 6 20:00:40 2026 +0100 arm64: dts: imx8mn: Add ifm VHIP4 EvalBoard v1 and v2 Add support for ifm i.MX8MN VHIP4 EvalBoard v1 and v2 reference design. This system exists in two generations, v1 and v2, which share a lot of commonality. The boards come with either single gigabit ethernet or an KSZ8794 fast-ethernet switch, boot from eMMC, and offer CAN interfaces via Microchip MCP25xx SPI CAN controllers, UART, and USB host. The GPU is not available in the SoC populated on these devices. Signed-off-by: Fedor Ross Signed-off-by: Marek Vasut Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 347e8b20acfeb2861e28892062b6dc3d9f579981 Author: Marek Vasut Date: Tue Jan 6 20:00:39 2026 +0100 arm64: dts: imx8mn: Add SNVS LPGPR Add SNVS LPGPR bindings to MX8M Nano, the LPGPR is used to store boot counter. Reviewed-by: Peng Fan Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit 507d920800ea52388d89756eb168482e18bf0681 Author: Sebastian Krzyszkowiak Date: Mon Jan 5 21:39:43 2026 +0100 arm64: dts: imx8mq-librem5: Don't set mic-cfg for wm8962 The default values are fine, and MICDET_ENA is handled by the driver on its own anyway. Signed-off-by: Sebastian Krzyszkowiak Signed-off-by: Shawn Guo commit f8d3da15a96975646eb17b270753fdf639c37a65 Author: Sebastian Krzyszkowiak Date: Mon Jan 5 21:39:42 2026 +0100 arm64: dts: imx8mq-librem5: Set cap-power-off-card for usdhc2 This is needed for brcmfmac to turn the card off in suspend since 8c3170628a9ce24a59647bd24f897e666af919b8. Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit f9774d6d4ba45cb345b17001861e5ecdf0b4c659 Author: Sebastian Krzyszkowiak Date: Mon Jan 5 21:39:41 2026 +0100 arm64: dts: imx8mq-librem5: Limit uSDHC2 frequency to 50MHz SparkLAN card has stability issues at 100MHz. It still appears to be able to max out its throughput this way, so limit the frequency to ensure stable operation. Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 1361bfee8d7b791288e585a3467330a5f5b699ed Author: Sebastian Krzyszkowiak Date: Mon Jan 5 21:39:40 2026 +0100 arm64: dts: imx8mq-librem5: Enable SNVS RTC It has been disabled because it was being used for system clock instead of the discrete RTC. However, SNVS has some features that the discrete RTC does not, such as being able to turn the device on. Solve that issue with aliases instead and reenable SNVS RTC. Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit bb01a42b1bc2ee4483a784ac6e8597d16227a04f Author: Sebastian Krzyszkowiak Date: Mon Jan 5 21:39:39 2026 +0100 arm64: dts: imx8mq-librem5: Set vibrator's PWM frequency to 20kHz 1Hz as used previously was way too long. Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 6429d40e519fed71e2bd2afd59f9a379f9740a9b Author: Sebastian Krzyszkowiak Date: Mon Jan 5 21:39:38 2026 +0100 arm64: dts: imx8mq-librem5: Enable I2C recovery i2c-imx can perform bus recovery by temporarily switching I2C pins into GPIO mode. To do so, it needs GPIO and pinctrl handles to be provided in the device tree. Suggested-by: Denis Sergeevich Signed-off-by: Sebastian Krzyszkowiak Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit ba4550d5d724b693b142812af435b0984fbb9da0 Merge: 5ccde4c81e843a 650e55f224a575 Author: Jakub Kicinski Date: Sat Jan 17 16:12:18 2026 -0800 Merge branch 'net-phy-realtek-simplify-and-reunify-c22-c45-drivers' Daniel Golle says: ==================== net: phy: realtek: simplify and reunify C22/C45 drivers The RTL8221B PHY variants (VB-CG and VM-CG) were previously split into separate C22 and C45 driver instances to support copper SFP modules using the RollBall MDIO-over-I2C protocol, which only supports Clause-45 access. However, this split created significant code duplication and complexity. Commit 8af2136e77989 ("net: phy: realtek: add helper RTL822X_VND2_C22_REG") exposed that RealTek PHYs map all standard Clause-22 registers into MDIO_MMD_VEND2 at offset 0xa400. With commit 1850ec20d6e71 ("net: phy: realtek: use paged access for MDIO_MMD_VEND2 in C22 mode") it is now possible to access all MMD registers transparently, regardless of whether the PHY is accessed via C22 or C45 MDIO. Further improve the translation logic for this register mapping, so a single unified driver works efficiently with both access methods, reducing code duplication. The series also includes cleanup to remove unnecessary paged operations on registers that aren't actually affected by page selection. Testing was done on RTL8211F and RTL8221B-VB-CG (the latter in both C22 and C45 modes). ==================== Link: https://patch.msgid.link/cover.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 650e55f224a575cdb18c984b95036109519502d1 Author: Daniel Golle Date: Tue Jan 13 03:44:42 2026 +0000 net: phy: realtek: simplify bogus paged operations Only registers 0x10~0x17 are affected by the value in the page selection register 0x1f. Hence there is no point in using paged operations when accessing any other registers. Simplify the driver by using the normal phy_read and phy_write operations for registers which are anyway not affected by paging. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/0c5cbb66ce3e72a011d76f8c3d61ebcac44483bb.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 46ff862d376cfadf0f9e36a6edce41a003175708 Author: Daniel Golle Date: Tue Jan 13 03:44:33 2026 +0000 net: phy: realtek: demystify PHYSR register location Turns out that register address RTL_VND2_PHYSR (0xa434) maps to Clause-22 register MII_RESV2. Use that to get rid of yet another magic number, and rename access macros accordingly. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/6ed246e0aa3ca8038d2fa432d51518959fb89b6b.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 85f75da86a0adc4798d3675aab3365e721a1dbf5 Author: Daniel Golle Date: Tue Jan 13 03:44:25 2026 +0000 net: phy: realtek: reunify C22 and C45 drivers Reunify the split C22/C45 drivers for the RTL8221B-VB-CG 2.5Gbps and RTL8221B-VM-CG 2.5Gbps PHYs back into a single driver. This is possible now by using all the driver operations previously used by the C45 driver, as transparent access to all MMDs including MDIO_MMD_VEND2 is now possible also over Clause-22 MDIO. The unified driver will still only use Clause-45 access on any Clause-45 capable busses while still working fine on Clause-22 busses. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/bffcb85fdc20e07056976962d3caaa1be5d0ddb0.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 2809a1c4340437f2ff6b73c0094d7ca51b575e1b Author: Daniel Golle Date: Tue Jan 13 03:44:17 2026 +0000 net: phy: realtek: simplify C22 reg access via MDIO_MMD_VEND2 RealTek 2.5GE PHYs have all standard Clause-22 registers mapped also inside MDIO_MMD_VEND2 at offset 0xa400. This is used mainly in case the PHY is connected to a Clause-45-only bus. The RTL8221B is frequently used in copper SFP module which uses the RollBall MDIO-over-I2C method which *only* supports Clause-45, for example. In order to support using the PHY on Clause-45-only busses, the PHY driver has previously been split into a C22-only and C45-only instances, creating quite a bit of redundancy and confusion. In preparation of reunifying the two driver instances, add support for translating MDIO_MMD_VEND2 registers 0xa400 to 0xa43c back to Clause-22 registers 0 to 30 in case the PHY is accessed on a Clause-22 bus. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/fd49d86bd0445b76269fd3ea456c709c2066683f.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 84fb8b93fae2a4c53323b2bf6d81e7ddcc8e7cf4 Author: Daniel Golle Date: Tue Jan 13 03:44:00 2026 +0000 net: phy: realtek: support interrupt also for C22 variants Now that access to MDIO_MMD_VEND2 works transparently also in Clause-22 mode, add interrupt support also for the C22 variants of the RTL8221B-VB-CG and RTL8221B-VM-CG. This results in the C22 and C45 driver instances now having all the same features implemented. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/7620084b1de01580edc2d0e1b9548507fb4643a8.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 5ccde4c81e843ab6b3a324c8e2aa96d9b1270a1a Author: Russell King (Oracle) Date: Fri Jan 16 00:49:24 2026 +0000 net: stmmac: fix dwmac4 transmit performance regression dwmac4's transmit performance dropped by a factor of four due to an incorrect assumption about which definitions are for what. This highlights the need for sane register macros. Commit 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT definitions") changed the way the txpbl value is merged into the register: value = readl(ioaddr + DMA_CHAN_TX_CONTROL(dwmac4_addrs, chan)); - value = value | (txpbl << DMA_BUS_MODE_PBL_SHIFT); + value = value | FIELD_PREP(DMA_BUS_MODE_PBL, txpbl); With the following in the header file: #define DMA_BUS_MODE_PBL BIT(16) -#define DMA_BUS_MODE_PBL_SHIFT 16 The assumption here was that DMA_BUS_MODE_PBL was the mask for DMA_BUS_MODE_PBL_SHIFT, but this turns out not to be the case. The field is actually six bits wide, buts 21:16, and is called TXPBL. What's even more confusing is, there turns out to be a PBLX8 single bit in the DMA_CHAN_CONTROL register (0x1100 for channel 0), and DMA_BUS_MODE_PBL seems to be used for that. However, this bit et.al. was listed under a comment "/* DMA SYS Bus Mode bitmap */" which is for register 0x1004. Fix this up by adding an appropriately named field definition under the DMA_CHAN_TX_CONTROL() register address definition. Move the RPBL mask definition under DMA_CHAN_RX_CONTROL(), correctly renaming it as well. Also move the PBL bit definition under DMA_CHAN_CONTROL(), correctly renaming it. This removes confusion over the PBL fields. Fixes: 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT definitions") Signed-off-by: Russell King (Oracle) Bisected-by: Maxime Chevallier Link: https://lore.kernel.org/51859704-57fd-4913-b09d-9ac58a57f185@bootlin.com Tested-by: Maxime Chevallier Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vgY1k-00000003vOC-0Z1H@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f10ab9d3a7ea06ef7d6aa2d3c527f8cf728bbdee Author: Eric Dumazet Date: Wed Jan 14 16:51:09 2026 +0000 tcp: move tcp_rate_skb_sent() to tcp_output.c It is only called from __tcp_transmit_skb() and __tcp_retransmit_skb(). Move it in tcp_output.c and make it static. clang compiler is now able to inline it from __tcp_transmit_skb(). gcc compiler inlines it in the two callers, which is also fine. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260114165109.1747722-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 799759e610d32de37f65cb109f2801b5f099b13d Author: Stefan Wiehler Date: Wed Jan 14 15:44:25 2026 +0100 net: ethernet: ti: cpsw_ale: Remove obsolete macros - ALE_VERSION_MAJOR/MINOR are no longer used following the transition to regmaps in commit bbfc7e2b9ebe ("net: ethernet: ti: cpsw_ale: use regfields for ALE registers") - ALE_VERSION_IR3 is unused since entry mask bits are no longer hardcoded with commit b5d31f294027 ("net: ethernet: ti: ale: optimize ale entry mask bits configuartion") - ALE_VERSION_IR4 has never been used since its introduction in commit ca47130a744b ("net: netcp: ale: update to support unknown vlan controls for NU switch") Signed-off-by: Stefan Wiehler Link: https://patch.msgid.link/20260114144425.3973272-1-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski commit 2a85541d95f7b791a8547ea1c2e22d214278079d Author: Toke Høiland-Jørgensen Date: Tue Jan 13 15:31:56 2026 +0100 net/sched: cake: avoid separate allocation of struct cake_sched_config Paolo pointed out that we can avoid separately allocating struct cake_sched_config even in the non-mq case, by embedding it into struct cake_sched_data. This reduces the complexity of the logic that swaps the pointers and frees the old value, at the cost of adding 56 bytes to the latter. Since cake_sched_data is already almost 17k bytes, this seems like a reasonable tradeoff. Suggested-by: Paolo Abeni Signed-off-by: Toke Høiland-Jørgensen Fixes: bc0ce2bad36c ("net/sched: sch_cake: Factor out config variables into separate struct") Link: https://patch.msgid.link/20260113143157.2581680-1-toke@redhat.com Signed-off-by: Jakub Kicinski commit 8fc807104125428be6b2ac9c3f210d0f69e055be Author: Shahar Shitrit Date: Tue Jan 13 12:08:03 2026 +0200 docs: tls: Enhance TLS resync async process documentation Expand the tls-offload.rst documentation to provide a more detailed explanation of the asynchronous resync process, including the role of struct tls_offload_resync_async in managing resync requests on the kernel side. Also, add documentation for helper functions tls_offload_rx_resync_async_request_start/ _end/ _cancel. Signed-off-by: Shahar Shitrit Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1768298883-1602599-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e8c6888e177c5ae0e09e184f51bf60d28bb49a34 Merge: 171e8ed48276df 0b3877bec78b0f Author: Jakub Kicinski Date: Sat Jan 17 15:24:06 2026 -0800 Merge branch 'uapi-use-uapi-definitions-of-int_max-and-int_min' Thomas Weißschuh says: ==================== uapi: Use UAPI definitions of INT_MAX and INT_MIN Using to gain access to INT_MAX and INT_MIN introduces a dependency on a libc, which UAPI headers should not do. Introduce and use equivalent UAPI constants. ==================== Link: https://patch.msgid.link/20260113-uapi-limits-v2-0-93c20f4b2c1a@linutronix.de Signed-off-by: Jakub Kicinski commit 0b3877bec78b0f26a280078a15f8992426de1db7 Author: Thomas Weißschuh Date: Tue Jan 13 08:44:19 2026 +0100 netfilter: uapi: Use UAPI definition of INT_MAX and INT_MIN Using to gain access to INT_MAX and INT_MIN introduces a dependency on a libc, which UAPI headers should not do. Use the equivalent UAPI constants. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260113-uapi-limits-v2-3-93c20f4b2c1a@linutronix.de Signed-off-by: Jakub Kicinski commit a8a11e5237aed71b7f5f9d33c554ef06fe974311 Author: Thomas Weißschuh Date: Tue Jan 13 08:44:18 2026 +0100 ethtool: uapi: Use UAPI definition of INT_MAX Using to gain access to INT_MAX introduces a dependency on a libc, which UAPI headers should not do. Use the equivalent UAPI constant. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260113-uapi-limits-v2-2-93c20f4b2c1a@linutronix.de Signed-off-by: Jakub Kicinski commit ca9d74eb5f6aea6eee746aae648382332dbcf24e Author: Thomas Weißschuh Date: Tue Jan 13 08:44:17 2026 +0100 uapi: add INT_MAX and INT_MIN constants Some UAPI headers use INT_MAX and INT_MIN. Currently they include for their definitions, which introduces a problematic dependency on libc. Add custom, namespaced definitions of INT_MAX and INT_MIN using the same values as the regular kernel code. These definitions are not added to uapi/linux/limits.h, as that header will conflict with libc definitions on some platforms. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260113-uapi-limits-v2-1-93c20f4b2c1a@linutronix.de Signed-off-by: Jakub Kicinski commit 171e8ed48276dff973390c5aa3c9e93c0e903725 Author: Ethan Nelson-Moore Date: Mon Jan 12 20:06:38 2026 -0800 net: usb: sr9700: remove code to drive nonexistent MII This device does not have a MII, even though the driver contains code to drive one (because it originated as a copy of the dm9601 driver). It also only supports 10Mbps half-duplex operation (the DM9601 registers to set the speed/duplex mode are read-only). Remove all MII-related code and implement sr9700_get_link_ksettings which returns hardcoded correct information for the link speed and duplex mode. Also add announcement of the link status like many other Ethernet drivers have. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260113040649.54248-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit b790404680169591ec2cd9fd356cb9d0d3cbe6bd Merge: 2a14e91b6d7663 61f1139a476569 Author: Jakub Kicinski Date: Sat Jan 17 15:17:27 2026 -0800 Merge branch 'net-pcs-rzn1-miic-support-configurable-phy_link-polarity' Lad Prabhakar says: ==================== net: pcs: rzn1-miic: Support configurable PHY_LINK polarity This series adds support for configuring the active level of MIIC PHY_LINK status signals on Renesas RZ/N1 and RZ/T2H/N2H platforms. The MIIC block provides dedicated hardware PHY_LINK signals that indicate EtherPHY link-up and link-down status independently of whether the MAC (GMAC) or Ethernet switch (ETHSW) is used. While GMAC-based systems typically obtain link state via MDIO and handle it in software, the ETHSW relies on these PHY_LINK pins for both CPU-assisted operation and switch-only forwarding paths that do not involve the host processor. These hardware PHY_LINK signals are particularly important for use cases requiring fast reaction to link-down events, such as redundancy protocols including Device Level Ring (DLR). In such scenarios, relying solely on software-based link detection introduces latency that can negatively impact recovery time. The ETHSW therefore exposes PHY_LINK signals to enable immediate hardware-level detection of cable or port failures. Some systems require the PHY_LINK signal polarity to be configured as active low rather than the default active high. This series introduces a new DT property to describe the required polarity and adds corresponding driver support to program the MIIC PHY_LINK register accordingly. The configuration is accumulated during DT parsing and applied once hardware initialization is complete, taking into account SoC-specific differences between RZ/N1 and RZ/T2H/N2H. ==================== Link: https://patch.msgid.link/20260112173555.1166714-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 61f1139a476569dfe28778358e01ebcf0bef3837 Author: Lad Prabhakar Date: Mon Jan 12 17:35:55 2026 +0000 net: pcs: rzn1-miic: Add PHY_LINK active-level configuration support Add support to configure the active level of MIIC PHY_LINK status signals on a per-converter basis using a DT property. MIIC provides dedicated PHY_LINK signals that indicate EtherPHY link-up and link-down status in hardware. These signals are required regardless of whether GMAC or ETHSW is used. With GMAC, link state is retrieved via MDC/MDIO and handled in software, while ETHSW relies on PHY_LINK pins for both CPU-assisted operation and switch-only data paths that do not involve the host. Hardware PHY_LINK signals are also critical for fast reaction to link-down events, for example when running redundancy protocols such as Device Level Ring (DLR), where rapid detection of cable faults is required to switch to an alternate path without software latency. Parse the requested polarity from DT, accumulate the configuration during probing, and apply it to the MIIC_PHY_LINK register once hardware initialization is complete, when the registers can be safely modified. Handle SoC-specific bit layout differences between RZ/N1 and RZ/T2H/N2H within the driver. Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20260112173555.1166714-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 98e8039a3b14281b3240f0b40469041365d0e378 Author: Lad Prabhakar Date: Mon Jan 12 17:35:54 2026 +0000 dt-bindings: net: pcs: renesas,rzn1-miic: Add phy_link property Add the renesas,miic-phy-link-active-low property to allow configuring the active level of phy_link status signals provided by the MIIC block. EtherPHY link-up and link-down status is required as a hardware IP feature independent of whether GMAC or ETHSW is used. With GMAC, link state is retrieved via MDC/MDIO and handled in software. In contrast, ETHSW exposes dedicated PHY_LINK pins that provide this information directly in hardware. These PHY_LINK signals are required not only for host-controlled traffic but also for switch-only forwarding paths where frames are exchanged between external nodes without CPU involvement. This is particularly important for redundancy protocols such as DLR (Device Level Ring), which depend on fast detection of link-down events caused by cable or port failures. Handling such events purely in software introduces latency, which is why ETHSW provides dedicated hardware PHY_LINK pins. Signed-off-by: Lad Prabhakar Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260112173555.1166714-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 2a14e91b6d76639dac70ea170f4384c1ee3cb48d Author: Matt Johnston Date: Tue Jan 13 17:01:16 2026 +0800 mctp i2c: initialise event handler read bytes Set a 0xff value for i2c reads of an mctp-i2c device. Otherwise reads will return "val" from the i2c bus driver. For i2c-aspeed and i2c-npcm7xx that is a stack uninitialised u8. Tested with "i2ctransfer -y 1 r10@0x34" where 0x34 is a mctp-i2c instance, now it returns all 0xff. Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver") Signed-off-by: Matt Johnston Link: https://patch.msgid.link/20260113-mctp-read-fix-v1-1-70c4b59c741c@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit fc12767c19d49663b13ba2def6e4674df041c8a2 Author: Jingyi Wang Date: Fri Oct 31 00:41:44 2025 -0700 dt-bindings: mailbox: qcom: Add IPCC support for Kaanapali and Glymur Platforms Document the Inter-Processor Communication Controller on the Qualcomm Kaanapali and Glymur Platforms, which will be used to route interrupts across various subsystems found on the SoC. Co-developed-by: Sibi Sankar Signed-off-by: Sibi Sankar Signed-off-by: Jingyi Wang Reviewed-by: Bjorn Andersson Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251031-knp-ipcc-v3-1-62ffb4168dff@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3e6b0227b93c708e93e33f6c3485bad077650766 Author: Marco Felsch Date: Tue Jan 13 15:52:42 2026 +0100 clk: imx: fracn-gppll: Add 241.90 MHz Support Some parallel panels have a pixelclk of 24.19 MHz. Add support for 241.90 MHz so a by 10 divider can be used to derive the exact pixelclk. Signed-off-by: Marco Felsch Reviewed-by: Abel Vesa Reviewed-by: Peng Fan Acked-by: Daniel Baluta Link: https://patch.msgid.link/20260113-v6-18-topic-clk-fracn-gppll-v3-2-45da70f43c98@pengutronix.de Signed-off-by: Abel Vesa commit 9bb910b049402b7a3496250c9c6ab169aed83d15 Author: Marco Felsch Date: Tue Jan 13 15:52:41 2026 +0100 clk: imx: fracn-gppll: Add 332.60 MHz Support Some parallel panels have a pixelclk of 33.260 MHz. Add support for 332.60 MHz so a by 10 divider can be used to derive the exact pixelclk. Reviewed-by: Primoz Fiser Signed-off-by: Marco Felsch Reviewed-by: Abel Vesa Reviewed-by: Peng Fan Acked-by: Daniel Baluta Link: https://patch.msgid.link/20260113-v6-18-topic-clk-fracn-gppll-v3-1-45da70f43c98@pengutronix.de Signed-off-by: Abel Vesa commit 024d8f4aa35970c4563c6ef0c4170133719b2103 Author: Peter Griffin Date: Tue Jan 13 10:59:02 2026 +0000 arm64: dts: exynos: gs101: add cmu_dpu and sysreg_dpu dt nodes Enable the cmu_dpu clock management unit. It feeds some of the display IPs. Additionally add the sysreg_dpu node which contains the BUSCOMPONENT_DRCG_EN and MEMCLK registers required by cmu_dpu to enable dynamic root clock gating of bus components. Reviewed-by: André Draszik Signed-off-by: Peter Griffin Link: https://patch.msgid.link/20260113-dpu-clocks-v3-5-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski commit 791d34232c7896038f934e561af77afe9fba453d Merge: 9afdf3e1a59e23 52300cd894b316 Author: Krzysztof Kozlowski Date: Sat Jan 17 20:31:29 2026 +0100 Merge branch 'for-v6.20/dt-bindings-clk' into next/dt64 Merge clock DT binding headers from topic branch. commit 4b18a3ef2230e38439c9c3a0e3fa4a2b5edcc5cd Author: Peter Griffin Date: Tue Jan 13 10:59:01 2026 +0000 clk: samsung: gs101: add support for Display Process Unit (DPU) clocks cmu_dpu is the clock management unit used for the Display Process Unit block. It generates clocks for image scaler, compressor etc. Add support for the muxes, dividers and gates in cmu_dpu. Signed-off-by: Peter Griffin Reviewed-by: André Draszik Link: https://patch.msgid.link/20260113-dpu-clocks-v3-4-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski commit 1d8fae6617b6ebcaf3ef3040ee84cdde25d5d10f Author: Peter Griffin Date: Tue Jan 13 10:59:00 2026 +0000 dt-bindings: samsung: exynos-sysreg: add gs101 dpu compatible Add dedicated compatibles for gs101 dpu sysreg controllers to the documentation. Reviewed-by: André Draszik Signed-off-by: Peter Griffin Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260113-dpu-clocks-v3-3-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski commit a0d3aeaa34854d97831039754563ef7842f2f32e Merge: c9d24fe079027f 52300cd894b316 Author: Krzysztof Kozlowski Date: Sat Jan 17 20:29:51 2026 +0100 Merge branch 'for-v6.20/dt-bindings-clk' into next/clk Merge DT binding headers from topic branch, used by the driver. commit 52300cd894b3167d6206e266e341a089e87124b9 Author: Peter Griffin Date: Tue Jan 13 10:58:59 2026 +0000 dt-bindings: clock: google,gs101-clock: Add DPU clock management unit Add dt schema documentation and clock IDs for the Display Process Unit (DPU) clock management unit (CMU). This CMU feeds IPs such as image scaler, enhancer and compressor. Signed-off-by: Peter Griffin Reviewed-by: Rob Herring (Arm) Reviewed-by: André Draszik Link: https://patch.msgid.link/20260113-dpu-clocks-v3-2-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski commit 3a2741fa31385348c5b501bdcbab6f6d7b4628ac Author: Peter Griffin Date: Tue Jan 13 10:58:58 2026 +0000 dt-bindings: clock: google,gs101-clock: fix alphanumeric ordering Ensure children of cmu_top have alphanumeric ordering. Top is special as it feeds all the other children CMUs. This ordering then matches the clk-gs101.c file. Reviewed-by: André Draszik Signed-off-by: Peter Griffin Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260113-dpu-clocks-v3-1-cb85424f2c72@linaro.org Signed-off-by: Krzysztof Kozlowski commit c9d24fe079027f143992a4a1c0be74c4f4455f12 Author: André Draszik Date: Fri Jan 9 17:27:24 2026 +0000 clk: samsung: fix sysreg save/restore when PM is enabled for CMU Currently, sysreg registers of a CMU that has PM and automatic clock gating enabled are not saved / restored during runtime PM (RPM) or s2idle. During normal suspend, they are accessed too late, after the CMU (and potentially power domain) have been shut down, causing an SError. The reason is that these registers are registered to be saved/restored via a syscore suspend handler which doesn't run during RPM or s2idle. During normal suspend, this handler runs after the CMU has been shut down. This registration happens as part of samsung_clk_extended_sleep_init() via samsung_en_dyn_root_clk_gating(). When PM is enabled for a CMU, registers must be saved/restored via exynos_arm64_cmu_suspend() / exynos_arm64_cmu_resume() respectively instead. These use their own data structures and are unrelated to anything that samsung_clk_extended_sleep_init() does. Calling it unconditionally from samsung_en_dyn_root_clk_gating() therefore isn't useful. Update the code to prepare sysreg save / restore in a similar way to how it handles other clock registers in the PM case already. exynos_arm64_cmu_suspend() / exynos_arm64_cmu_resume() already handle sysreg save/restore, just the setup was incorrect. Fixes: 298fac4f4b96 ("clk: samsung: Implement automatic clock gating mode for CMUs") Signed-off-by: André Draszik Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260109-clk-samsung-autoclk-updates-v1-2-2394dcf242a9@linaro.org Signed-off-by: Krzysztof Kozlowski commit aafaa4d875fb8ff525c514e69eb0440c69425c13 Author: André Draszik Date: Fri Jan 9 17:27:23 2026 +0000 clk: samsung: avoid warning message on legacy Exynos (auto clock gating) We currently print a warning message that the IO memory size is not compatible with automatic clock gating for many Exynos-based boards, including legacy ones, even if not requested to enable automatic clock gating in the first place. Change the test in question to avoid that warning. Fixes: 298fac4f4b96 ("clk: samsung: Implement automatic clock gating mode for CMUs") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/8b2c412d-3e1e-4be0-a9d5-ef67f6f0d409@samsung.com/ Suggested-by: Marek Szyprowski Signed-off-by: André Draszik Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260109-clk-samsung-autoclk-updates-v1-1-2394dcf242a9@linaro.org Signed-off-by: Krzysztof Kozlowski commit 44dd7cfbd1db5199cf7afe03158a578a64b55800 Author: Kees Cook Date: Thu Jan 15 16:56:32 2026 -0800 MAINTAINERS: pstore: Remove L: entry A lot of SoC series end up getting CCed to the hardening list due to their mention of "pstore" in device tree or similar, and this noise isn't worth making sure I don't lose pstore patches by having them show up in the hardening patchwork. ;) I can use better email filters instead! Link: https://patch.msgid.link/20260116005631.work.387-kees@kernel.org Signed-off-by: Kees Cook commit ee4acc596786ab08db7b5d4de4dfa15a67c9e684 Author: Gustavo A. R. Silva Date: Thu Nov 27 12:21:14 2025 +0900 nfp: tls: Avoid -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. So, in order to avoid ending up with flexible-array members in the middle of other structs, we use the `struct_group_tagged()` helper to separate the flexible array from the rest of the members in the flexible structure. We then use the newly created tagged `struct nfp_crypto_req_add_front_hdr` to replace the type of the objects causing trouble in a couple of structures. We also want to ensure that when new members need to be added to the flexible structure, they are always included within the newly created tagged struct. For this, we use `static_assert()`. This ensures that the memory layout for both the flexible structure and the new tagged struct is the same after any changes. Lastly, use container_of() to retrieve a pointer to the flexible structure and, through that, access the flexible-array member when needed. So, with these changes, fix the following warnings: drivers/net/ethernet/netronome/nfp/nfd3/../crypto/fw.h:58:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/ethernet/netronome/nfp/nfd3/../crypto/fw.h:65:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Reviewed-by: Simon Horman Signed-off-by: Gustavo A. R. Silva Link: https://patch.msgid.link/aSfDqouLFcA4h8JX@kspp Signed-off-by: Kees Cook commit cd8da637106d6a1924c0d6dd05e8ee932ef234b5 Author: Gustavo A. R. Silva Date: Wed Nov 19 16:33:26 2025 +0900 carl9170: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration (which happens to be in a union, so we're moving the entire union) to the end of the corresponding structure. Notice that `struct carl9170_rsp` is a flexible structure, this is a structure that contains a flexible-array member. With these changes fix the following warning: drivers/net/wireless/ath/carl9170/carl9170.h:382:9: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Acked-by: Christian Lamparter Link: https://patch.msgid.link/aR1yxjmzb2DM2-Uq@kspp Signed-off-by: Kees Cook commit fac4ab5cd0ad8d3abce6d2b519c9f0d26c8f2abc Author: Kees Cook Date: Mon Oct 20 15:01:17 2025 -0700 coredump: Use __counted_by_ptr for struct core_name::corename Use the __counted_by annotation now available for struct pointer members, __counted_by_ptr(). Move assignments to immediately after allocation. Link: https://patch.msgid.link/20251020220118.1226740-3-kees@kernel.org Signed-off-by: Kees Cook commit a120a832e3ebca48474d7183ddeadf4138472535 Author: Kees Cook Date: Mon Oct 20 15:01:16 2025 -0700 lkdtm/bugs: Add __counted_by_ptr() test PTR_BOUNDS Provide run-time validation of the __counted_by_ptr() annotation via newly added PTR_BOUNDS LKDTM test. Link: https://patch.msgid.link/20251020220118.1226740-2-kees@kernel.org Signed-off-by: Kees Cook commit 150a04d817d8f5be5a4f92799827cdc8d7e45989 Author: Bill Wendling Date: Fri Jan 16 00:57:57 2026 +0000 compiler_types.h: Attributes: Add __counted_by_ptr macro Introduce __counted_by_ptr(), which works like __counted_by(), but for pointer struct members. struct foo { int a, b, c; char *buffer __counted_by_ptr(bytes); short nr_bars; struct bar *bars __counted_by_ptr(nr_bars); size_t bytes; }; Because "counted_by" can only be applied to pointer members in very recent compiler versions, its application ends up needing to be distinct from flexibe array "counted_by" annotations, hence a separate macro. This is a reworking of Kees' previous patch [1]. Link: https://lore.kernel.org/all/20251020220118.1226740-1-kees@kernel.org/ [1] Co-developed-by: Kees Cook Signed-off-by: Bill Wendling Link: https://patch.msgid.link/20260116005838.2419118-1-morbo@google.com Signed-off-by: Kees Cook commit 2a11e1479ef07519bfd6b64ee276905ca84cf817 Author: Shenghao Yang Date: Sat Jan 17 15:28:27 2026 +0800 x86/acpi: Add acpi=spcr to use SPCR-provided default console The SPCR provided console on x86 is only available as a boot console when earlycon is provided on the kernel command line, and will not be present in /proc/consoles. While it's possible to retain the boot console with the keep_bootcon parameter, that leaves the console using the less efficient 8250_early driver. Users wanting to use the firmware suggested console (to avoid maintaining unique serial console parameters for different server models in large fleets) with the conventional driver have to parse the kernel log for the console parameters and reinsert them. [ 0.005091] ACPI: SPCR 0x000000007FFB5000 000059 (v04 ALASKA A M I 01072009 INTL 20250404) [ 0.073387] ACPI: SPCR: console: uart,io,0x3f8,115200 In commit 0231d00082f6 ("ACPI: SPCR: Make SPCR available to x86")¹ the SPCR console was only added as an option for earlycon but not as an ordinary console so users don't see console output changes. So users can opt in to an automatic SPCR console, make ACPI init add it if acpi=spcr is set. ¹https://lore.kernel.org/lkml/20180118150951.28964-1-prarit@redhat.com/ [ bp: Touchups. ] Signed-off-by: Shenghao Yang Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20260117072827.355360-1-me@shenghaoyang.info commit 88303fb68cc2e8b975f1505c84f215a934f6c2ad Author: Niklas Schnelle Date: Thu Jan 8 16:45:54 2026 +0100 s390/pci: Use PCIBIOS return values in pci_read()/pci_write() While pci_read() and pci_write() have returned errno values since their inception with commit cd24834130ac ("s390/pci: base support") other config accessors in particular pci_generic_config_read() as well as pci_generic_config_write() return specific error values which are then converted to errno by pcibios_err_to_errno(). Since latter does handle the case where the error value already looks like an errno the previous behavior is unlikely to cause actual issues. Still, for consistency and in case any caller explicitly checks error values align pci_read() and pci_write() with the generic accessors. Reviewed-by: Benjamin Block Signed-off-by: Niklas Schnelle Reviewed-by: Farhan Ali Signed-off-by: Heiko Carstens commit 84d875e69818bed600edccb09be4a64b84a34a54 Author: Niklas Schnelle Date: Thu Jan 8 16:45:53 2026 +0100 s390/pci: Handle futile config accesses of disabled devices directly On s390 PCI busses and slots with multiple functions may have holes because PCI functions are passed-through by the hypervisor on a per function basis and some functions may be in standby or reserved. This fact is indicated by returning true from the hypervisor_isolated_pci_functions() helper and triggers common code to scan all possible devfn values. Via pci_scan_single_device() this in turn causes config reads for the device and vendor IDs, even for PCI functions which are in standby and thereofore disabled. So far these futile config reads, as well as potentially writes, which can never succeed were handled by the PCI load/store instructions themselves. This works as the platform just returns an error for a disabled and thus not usable function handle. It does cause spamming of error logs and additional overhead though. Instead check if the used function handle is enabled in zpci_cfg_load() and zpci_cfg_write() and if not enable directly return -ENODEV. Also refactor zpci_cfg_load() and zpci_cfg_store() slightly to accommodate the new logic while meeting modern kernel style guidelines. Cc: stable@vger.kernel.org Fixes: a50297cf8235 ("s390/pci: separate zbus creation from scanning") Signed-off-by: Niklas Schnelle Reviewed-by: Benjamin Block Reviewed-by: Farhan Ali Signed-off-by: Heiko Carstens commit 86302ddf20e6b27ef463006c8bde6fd753056101 Merge: 12ea976f955cef 48b4790f054994 Author: Heiko Carstens Date: Sat Jan 17 15:53:26 2026 +0100 Merge branch 'preempt' Heiko Carstens says: ==================== The option to select PREEMPT_NONE will go away for all architectures which support PREEMPT_LAZY [1]. Until now all distributions provide kernels built with PREEMPT_NONE enabled for s390. In particular this means that all preempt_disable() / preempt_enable() pairs are optimized away during compile time. With PREEMPT_LAZY this is not the case. Switching to PREEMPT_LAZY leads to a kernel image size increase of ~218kb (defconfig, gcc15). s390 provides optimized preempt primitives, however there is still room for improvement. Since support for relocatable lowcore was added access to preempt_count in lowcore requires an extra call of get_lowcore(), which generates an extra instruction. Also all instructions have to use a base register which is not zero to access preempt_count. Address this by adding a couple of inline assemblies with alternatives. This generates better code and reduces the size of a PREEMPT_LAZY built kernel image by ~58kb. [1] https://lore.kernel.org/all/20251219101502.GB1132199@noisy.programming.kicks-ass.net/ ==================== Signed-off-by: Heiko Carstens commit 48b4790f054994d4df6d1025ec9267b19618f0ec Author: Heiko Carstens Date: Tue Jan 13 20:44:00 2026 +0100 s390/preempt: Optimize __preempt_count_dec_and_test() Provide an inline assembly using alternatives to avoid the need of a base register due to relocatable lowcore when adding or subtracting small constants from preempt_count. Main user is preempt_enable(), which subtracts one from preempt_count and tests if the result is zero. With this the generated code changes from 1000b8: a7 19 00 00 lghi %r1,0 1000bc: eb ff 13 a8 00 6e alsi 936(%r1),-1 1000c2: a7 54 00 05 jnhe 1000cc <__rcu_read_unlock+0x14> to something like this: 1000b8: eb ff 03 a8 00 6e alsi 936,-1 1000be: a7 54 00 05 jnhe 1000c8 <__rcu_read_unlock+0x10> Kernel image size is reduced by 45kb (bloat-o-meter -t, defconfig, gcc15). Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 05405b8fd284189278636a0392976cbec3bb6d19 Author: Heiko Carstens Date: Tue Jan 13 20:43:59 2026 +0100 s390/asm: Let __HAVE_ASM_FLAG_OUTPUTS__ define 1 With the empty define __is_enabled(__HAVE_ASM_FLAG_OUTPUTS__) evaluates to false. Therefore let __HAVE_ASM_FLAG_OUTPUTS__ define 1 if it is defined. This allows to make use of __is_defined(__HAVE_ASM_FLAG_OUTPUTS__) like expected. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 23ba7d31633da6b0706b4154e4eb74cdfab710ef Author: Heiko Carstens Date: Tue Jan 13 20:43:58 2026 +0100 s390/preempt: Optimize __preemp_count_add()/__preempt_count_sub() Provide an inline assembly using alternatives to avoid the need of a base register due to relocatable lowcore when adding or subtracting small constants from preempt_count. Main user is preempt_disable(), which subtracts one from preempt_count. With this the generated code changes from 10012c: a7 b9 00 00 lghi %r11,0 100130: eb 01 b3 a8 00 6a asi 936(%r11),1 to something like this: 10012c: eb 01 03 a8 00 6a asi 936,1 Kernel image size is reduced by 13kb (bloat-o-meter -t, defconfig, gcc15). Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 6cce3609a1e0dedeef9b4bfdc87d0d4692f691d7 Author: Heiko Carstens Date: Tue Jan 13 20:43:57 2026 +0100 s390/preempt: Optimize preempt_count() Provide an inline assembly using alternatives to avoid the need of a base register when reading preempt_count() from lowcore. Use the LLGT instruction, which reads only the least significant 31 bits of preempt_count. This masks out the encoded PREEMPT_NEED_RESCHED bit. Generated code is changed from 000000000046e5d0 : 46e5d0: c0 04 00 00 00 00 jgnop 46e5d0 46e5d6: a7 39 00 00 lghi %r3,0 46e5da: 58 10 33 a8 l %r1,936(%r3) 46e5de: c0 1b 00 ff ff 00 nilf %r1,16776960 46e5e4: a7 74 00 11 jne 46e606 to something like this: 000000000046e5d0 : 46e5d0: c0 04 00 00 00 00 jgnop 46e5d0 46e5d6: e3 10 03 a8 00 17 llgt %r1,936 46e5dc: ec 41 28 b7 00 55 risbgz %r4,%r1,40,55 46e5e2: a7 74 00 0f jne 46e600 Overall savings are only 82 bytes according to bloat-o-meter. This is because of different inlining decisions, and there aren't many preempt_count() users in the kernel. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 3f2d8d79cceb05a8b8dd200fa81c0dffc59ec46f Author: Kery Qi Date: Mon Jan 12 01:29:15 2026 +0800 watchdog: starfive-wdt: Fix PM reference leak in probe error path The PM reference count is not expected to be incremented on return in functions starfive_wdt_probe. However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here. Replace it with pm_runtime_resume_and_get to keep usage counter balanced. Fixes: db728ea9c7be ("drivers: watchdog: Add StarFive Watchdog driver") Signed-off-by: Kery Qi Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 88b2ab346436f799b99894a3e9518a3ffa344524 Author: René Rebe Date: Mon Nov 17 13:11:24 2025 +0100 fix it87_wdt early reboot by reporting running timer Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87 wdt enabled by the firmware and a broken BIOS option that does not allow to change the time or turn it off. As this makes installing Linux rather difficult, change the it87_wdt to report it running to the watchdog core. Signed-off-by: René Rebe Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit aeb5ecad5316f6af160993915163367290825b6b Author: Oleksandr Babak Date: Thu Jan 8 13:43:16 2026 +0100 rust: pin-init: Implement `InPlaceWrite` for `&'static mut MaybeUninit` This feature allows users to use `&'static mut MaybeUninit` as a place to initialize the value. It mirrors an existing implemetation for `Box`, but enables users to use external allocation mechanisms such as `static_cell` [1]. Signed-off-by: Oleksandr Babak Link: https://crates.io/crates/static_cell [1] [ Added link to `static_cell` - Benno ] Signed-off-by: Benno Lossin commit da9cfc4fcf535db9fb29cc05f41e28ef1e152fc1 Author: Benno Lossin Date: Fri Jan 16 11:54:30 2026 +0100 MAINTAINERS: add Gary Guo to pin-init Gary has been involved in pin-init since the very beginning. He created his own version before I even joined Rust-for-Linux, contributed ideas to my solution, and reviewed it. With the removal of the declarative macro mess, he is also going to be a maintainer of pin-init. Acked-by: Gary Guo Signed-off-by: Benno Lossin commit 1f1cd6964bbc37f2cc82a0adc8a0acec34af1afb Author: Benno Lossin Date: Fri Jan 16 11:54:29 2026 +0100 rust: pin-init: internal: init: simplify Zeroable safety check The `Zeroable` type check uses a small dance with a raw pointer to aid type inference. It turns out that this is not necessary and type inference is powerful enough to resolve any ambiguity. Thus remove it. Suggested-by: Gary Guo Tested-by: Andreas Hindborg Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit ceca298c53f9300ea689207f9ae9a3da3b4b4c4f Author: Benno Lossin Date: Fri Jan 16 11:54:28 2026 +0100 rust: pin-init: internal: init: add escape hatch for referencing initialized fields The initializer macro emits mutable references for already initialized fields, which allows modifying or accessing them later in code blocks or when initializing other fields. This behavior results in compiler errors when combining with packed structs, since those do not permit creating references to misaligned fields. For example: #[repr(C, packed)] struct Foo { a: i8, b: i32, } fn main() { let _ = init!(Foo { a: -42, b: 42 }); } This will lead to an error like this: error[E0793]: reference to field of packed struct is unaligned --> tests/ui/compile-fail/init/packed_struct.rs:10:13 | 10 | let _ = init!(Foo { a: -42, b: 42 }); | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | = note: this struct is 1-byte aligned, but the type of this field may require higher alignment = note: creating a misaligned reference is undefined behavior (even if that reference is never dereferenced) = help: copy the field contents to a local variable, or replace the reference with a raw pointer and use `read_unaligned`/`write_unaligned` (loads and stores via `*p` must be properly aligned even when using raw pointers) = note: this error originates in the macro `init` (in Nightly builds, run with -Z macro-backtrace for more info) This was requested by Janne Grunau [1] and will most certainly be used by the kernel when we eventually end up with trying to initialize packed structs. Thus add an initializer attribute `#[disable_initialized_field_access]` that does what the name suggests: do not generate references to already initialized fields. There is space for future work: add yet another attribute which can be applied on fields of initializers that ask for said field to be made accessible. We can add that when the need arises. Requested-by: Janne Grunau Link: https://lore.kernel.org/all/20251206170214.GE1097212@robin.jannau.net [1] Tested-by: Andreas Hindborg Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit d26732e57b06ef32dadfc32d5de9ac39262698cb Author: Benno Lossin Date: Fri Jan 16 11:54:27 2026 +0100 rust: pin-init: internal: init: add support for attributes on initializer fields Initializer fields ought to support the same attributes that are allowed in struct initializers on fields. For example, `cfg` or lint levels such as `expect`, `allow` etc. Add parsing support for these attributes using syn to initializer fields and adjust the macro expansion accordingly. Tested-by: Andreas Hindborg Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit d083a6214ca6d486ac58f84f8964c72028469342 Author: Benno Lossin Date: Fri Jan 16 11:54:26 2026 +0100 rust: init: use `#[default_error(err)]` for the initializer macros Initializer macros should use this attribute instead of manually parsing the macro's input. This is because the syntax is now parsed using `syn`, which permits more complex constructs to be parsed. In addition, this ensures that the kernel's initializer marcos will have the exact same syntax as the ones from pin-init. Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit aeabc92eb2d8c27578274a7ec3d0d00558fedfc2 Author: Benno Lossin Date: Fri Jan 16 11:54:25 2026 +0100 rust: pin-init: add `#[default_error()]` attribute to initializer macros The `#[default_error()]` attribute can be used to supply a default type as the error used for the `[pin_]init!` macros. This way one can easily define custom `try_[pin_]init!` variants that default to your project specific error type. Just write the following declarative macro: macro_rules! try_init { ($($args:tt)*) => { ::pin_init::init!( #[default_error(YourCustomErrorType)] $($args)* ) } } Tested-by: Andreas Hindborg Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit 4883830e9784bdf6223fe0e5f1ea36d4a4ab4fef Author: Benno Lossin Date: Fri Jan 16 11:54:24 2026 +0100 rust: pin-init: rewrite the initializer macros using `syn` Rewrite the initializer macros `[pin_]init!` using `syn`. No functional changes intended aside from improved error messages on syntactic and semantical errors. For example if one forgets to use `<-` with an initializer (and instead uses `:`): impl Bar { fn new() -> impl PinInit { ... } } impl Foo { fn new() -> impl PinInit { pin_init!(Self { bar: Bar::new() }) } } Then the declarative macro would report: error[E0308]: mismatched types --> tests/ui/compile-fail/init/colon_instead_of_arrow.rs:21:9 | 14 | fn new() -> impl PinInit { | ------------------ the found opaque type ... 21 | pin_init!(Self { bar: Bar::new() }) | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | | | expected `Bar`, found opaque type | arguments to this function are incorrect | = note: expected struct `Bar` found opaque type `impl pin_init::PinInit` note: function defined here --> $RUST/core/src/ptr/mod.rs | | pub const unsafe fn write(dst: *mut T, src: T) { | ^^^^^ = note: this error originates in the macro `$crate::__init_internal` which comes from the expansion of the macro `pin_init` (in Nightly builds, run with -Z macro-backtrace for more info) And the new error is: error[E0308]: mismatched types --> tests/ui/compile-fail/init/colon_instead_of_arrow.rs:21:31 | 14 | fn new() -> impl PinInit { | ------------------ the found opaque type ... 21 | pin_init!(Self { bar: Bar::new() }) | --- ^^^^^^^^^^ expected `Bar`, found opaque type | | | arguments to this function are incorrect | = note: expected struct `Bar` found opaque type `impl pin_init::PinInit` note: function defined here --> $RUST/core/src/ptr/mod.rs | | pub const unsafe fn write(dst: *mut T, src: T) { | ^^^^^ Importantly, this error gives much more accurate span locations, pointing to the offending field, rather than the entire macro invocation. Tested-by: Andreas Hindborg Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit dae5466c4aa5b43a6cda4282bf9ff8e6b42ece0e Author: Benno Lossin Date: Fri Jan 16 11:54:23 2026 +0100 rust: pin-init: add `?Sized` bounds to traits in `#[pin_data]` macro The `#[pin_data]` macro uses some auxiliary traits to ensure that a user does not implement `Drop` for the annotated struct, as that is unsound and can lead to UB. However, if the struct that is annotated is `!Sized`, the current bounds do not work, because `Sized` is an implicit bound for generics. This is *not* a soundness hole of pin-init, as it currently is impossible to construct an unsized struct using pin-init. Tested-by: Andreas Hindborg Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit 560f6d13c33f9f06ca34c14dc7c0a045d949c4a0 Author: Benno Lossin Date: Fri Jan 16 11:54:22 2026 +0100 rust: pin-init: rewrite `#[pin_data]` using `syn` Rewrite the attribute macro `#[pin_data]` using `syn`. No functional changes intended aside from improved error messages on syntactic and semantical errors. For example if one forgets a comma at the end of a field: #[pin_data] struct Foo { a: Box b: Box } The declarative macro reports the following errors: error: expected `,`, or `}`, found `b` --> tests/ui/compile-fail/pin_data/missing_comma.rs:5:16 | 5 | a: Box | ^ help: try adding a comma: `,` error: recursion limit reached while expanding `$crate::__pin_data!` --> tests/ui/compile-fail/pin_data/missing_comma.rs:3:1 | 3 | #[pin_data] | ^^^^^^^^^^^ | = help: consider increasing the recursion limit by adding a `#![recursion_limit = "256"]` attribute to your crate (`$CRATE`) = note: this error originates in the macro `$crate::__pin_data` which comes from the expansion of the attribute macro `pin_data` (in Nightly builds, run with -Z macro-backtrace for more info) The new `syn` version reports: error: expected `,`, or `}`, found `b` --> tests/ui/compile-fail/pin_data/missing_comma.rs:5:16 | 5 | a: Box | ^ help: try adding a comma: `,` error: expected `,` --> tests/ui/compile-fail/pin_data/missing_comma.rs:6:5 | 6 | b: Box | ^ Tested-by: Andreas Hindborg Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit a92f5fd29257d3bb4c62b81aebca0774e5f5c856 Author: Benno Lossin Date: Fri Jan 16 11:54:21 2026 +0100 rust: pin-init: rewrite the `#[pinned_drop]` attribute macro using `syn` Rewrite the attribute macro for implementing `PinnedDrop` using `syn`. Otherwise no functional changes intended aside from improved error messages on syntactic and semantical errors. For example: When missing the `drop` function in the implementation, the old error was: error: no rules expected `)` --> tests/ui/compile-fail/pinned_drop/no_fn.rs:6:1 | 6 | #[pinned_drop] | ^^^^^^^^^^^^^^ no rules expected this token in macro call | note: while trying to match keyword `fn` --> src/macros.rs | | fn drop($($sig:tt)*) { | ^^ = note: this error originates in the attribute macro `pinned_drop` (in Nightly builds, run with -Z macro-backtrace for more info) And the new one is: error[E0046]: not all trait items implemented, missing: `drop` --> tests/ui/compile-fail/pinned_drop/no_fn.rs:7:1 | 7 | impl PinnedDrop for Foo {} | ^^^^^^^^^^^^^^^^^^^^^^^ missing `drop` in implementation | = help: implement the missing item: `fn drop(self: Pin<&mut Self>, _: OnlyCallFromDrop) { todo!() }` Tested-by: Andreas Hindborg Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit 50426bde1577d17e61362bd199d487dbeb159110 Author: Benno Lossin Date: Fri Jan 16 11:54:20 2026 +0100 rust: pin-init: rewrite `derive(Zeroable)` and `derive(MaybeZeroable)` using `syn` Rewrite the two derive macros for `Zeroable` using `syn`. One positive side effect of this change is that tuple structs are now supported by them. Additionally, syntax errors and the error emitted when trying to use one of the derive macros on an `enum` are improved. Otherwise no functional changes intended. For example: #[derive(Zeroable)] enum Num { A(u32), B(i32), } Produced this error before this commit: error: no rules expected keyword `enum` --> tests/ui/compile-fail/zeroable/enum.rs:5:1 | 5 | enum Num { | ^^^^ no rules expected this token in macro call | note: while trying to match keyword `struct` --> src/macros.rs | | $vis:vis struct $name:ident | ^^^^^^ Now the error is: error: cannot derive `Zeroable` for an enum --> tests/ui/compile-fail/zeroable/enum.rs:5:1 | 5 | enum Num { | ^^^^ error: cannot derive `Zeroable` for an enum Tested-by: Andreas Hindborg Reviewed-by: Gary Guo Signed-off-by: Benno Lossin commit 26bd9402389eaebed086755afb03453dcae6617a Author: Benno Lossin Date: Fri Jan 16 11:54:19 2026 +0100 rust: pin-init: internal: add utility API for syn error handling The API is similar to diagnostics handling in rustc and uses a `ErrorGuaranteed` value to signify that an error has been emitted. It supports both fatal errors (which abort the macro expansion immediately by returning `Err(ErrorGuaranteed)`) and non-fatal ones at generation time. These errors are appended to the token stream after generation has finished normally. This allows giving good errors while still expanding most of the code as expected to avoid the user encountering additional errors (for example missing definitions). Suggested-by: Gary Guo Tested-by: Andreas Hindborg Reviewed-by: Gary Guo [ remove duplicate word in commit message - Benno ] Signed-off-by: Benno Lossin commit 514e4ed2c9da9112fcd378b1bd9b9d120edf7ca9 Author: Benno Lossin Date: Fri Jan 16 11:54:18 2026 +0100 rust: pin-init: add `syn` dependency and remove `proc-macro[2]` and `quote` workarounds `syn` makes parsing Rust from proc-macros a lot simpler. `pin-init` has not used `syn` up until now, because the we did not support it. That changed in commit 54e3eae85562 ("Merge patch series "`syn` support""), so we can finally utilize the added ergonomics of parsing proc-macro input with `syn`. Previously we only had the `proc-macro` library available, whereas the user-space version also used `proc-macro2` and `quote`. Now both are available, so remove the workarounds. Due to these changes, clippy emits warnings about unnecessary `.to_string()` as `proc-macro2` provides an additional `PartialEq` impl on `Ident`, so the warnings are fixed. [ Adjusted wording from upstream version and added build system changes for the kernel - Benno ] Co-developed-by: Gary Guo Signed-off-by: Gary Guo Reviewed-by: Tamir Duberstein Tested-by: Andreas Hindborg Signed-off-by: Benno Lossin commit 901f1d73d2c68017065212d75ffbfbffa119921e Author: Benno Lossin Date: Fri Jan 16 11:54:17 2026 +0100 rust: pin-init: allow the crate to refer to itself as `pin-init` in doc tests The `syn` approach requires use of `::pin_init::...` instead of the `$crate::...` construct available to declarative macros. To be able to use the `pin_init` crate from itself (which includes doc tests), we have to declare it as such. Reviewed-by: Gary Guo Tested-by: Andreas Hindborg Signed-off-by: Benno Lossin commit 61d62ab08f0e62f89929f3920c0b6521d849fd57 Author: Benno Lossin Date: Fri Jan 16 11:54:16 2026 +0100 rust: pin-init: remove `try_` versions of the initializer macros The `try_[pin_]init!` versions of the initializer macros are superfluous. Instead of forcing the user to always write an error in `try_[pin_]init!` and not allowing one in `[pin_]init!`, combine them into `[pin_]init!` that defaults the error to `core::convert::Infallible`, but also allows to specify a custom one. Projects using pin-init still can provide their own defaulting initializers using the `try_` prefix by using the `#[default_error]` attribute added in a future patch. [ Adjust the definition of the kernel's version of the `try_` initializer macros - Benno] Reviewed-by: Gary Guo Tested-by: Andreas Hindborg Signed-off-by: Benno Lossin commit eb4ee870747c3a77a9c3c84d84efb64bd481013a Author: Martin Tůma Date: Fri Jan 16 13:55:55 2026 +0100 Documentation: admin-guide: media: mgb4: Add GMSL1 & GMSL3-coax modules info Add the mgb4 GMSL1 and GMSL3-coax modules info. Signed-off-by: Martin Tůma Signed-off-by: Hans Verkuil commit f67adf545f9e7db4731fb7721597557e2571f891 Author: Martin Tůma Date: Fri Jan 16 13:55:54 2026 +0100 media: pci: mgb4: Add support for GMSL3 coaxial modules Add support for GMSL3 modules with a coaxial interface, a variant of the already existing module with the id #4. The FW is the same as for all other GMSL3 modules. Signed-off-by: Martin Tůma Signed-off-by: Hans Verkuil commit a20cf188abe299578d49d229a0cc28a1ef41e558 Author: Martin Tůma Date: Fri Jan 16 13:55:53 2026 +0100 media: pci: mgb4: Add support for GMSL1 modules Add support for GMSL1 modules. GMSL1 modules have 2 inputs, 2 outputs and require a separate FW (id #3). Signed-off-by: Martin Tůma Signed-off-by: Hans Verkuil commit a642165719daa8a1b5aef86dcf6d6454082ac1d1 Author: Marek Vasut Date: Tue Jan 6 20:00:38 2026 +0100 dt-bindings: arm: fsl: Document ifm VHIP4 EvalBoard v1 and v2 Document ifm i.MX8MN VHIP4 EvalBoard v1 and v2 reference design binding. This system exists in two generations, v1 and v2, which share a lot of commonality. The boards come with either single gigabit ethernet or an KSZ8794 fast-ethernet switch, boot from eMMC, and offer CAN interfaces via Microchip MCP25xx SPI CAN controllers, UART, and USB host. The GPU is not available in the SoC populated on these devices. Acked-by: Rob Herring (Arm) Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit 6f55fc60dc2c465b536cd69b71b82266d0da52c9 Author: Marek Vasut Date: Tue Jan 6 20:00:37 2026 +0100 dt-bindings: vendor-prefixes: Document ifm electronic gmbh ifm is a manufacturer of industrial sensors, control technology and automation solutions. Document their vendor prefix, which is already used for ifm,ac14xx and other powerpc devices. Acked-by: Rob Herring (Arm) Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit 42832d01c6114cf503a01983ff4e2512dad926fe Author: Josua Mayer Date: Sun Jan 4 11:38:52 2026 +0200 ARM: imx_v4_v5_defconfig: update for v6.19-rc1 The i.MX ARM v4/v5 defconfig has gone out of sync with some dead options, some removed and some missing. 1. Add missing options no longer enabled by default: - CONFIG_I2C=y - CONFIG_LCD_CLASS_DEVICE=y 2. Remove options enabled by default: - CONFIG_CS89x0=y - CONFIG_MEDIA_CAMERA_SUPPORT=y 3. Remove options that have no effect: - # CONFIG_INET_XFRM_MODE_TRANSPORT is not set - # CONFIG_INET_XFRM_MODE_TUNNEL is not set - # CONFIG_INET_XFRM_MODE_BEET is not set 4. Remove options that have been removed completely from the kernel: - CONFIG_USB_EHCI_MXC=y Removed by commit e7018751d2e6 ("usb: host: ehci-mxc: Remove the driver"). - CONFIG_SMC911X=y Removed by commit a2fd08448f2b ("net: remove smc911x driver"). - -CONFIG_SND_SOC_MX27VIS_AIC32X4=y Removed by commit 3fbb01fb583f ("ASoC: mx27vis-aic32x4: Remove unused driver"). - CONFIG_SND_SOC_PHYCORE_AC97=y Removed by commit 440534a0ecfd ("ASoC: phycore-ac97: Remove unused driver"). - CONFIG_SND_SOC_IMX_MC13783=y Removed by commit 83e7e2278680 ("ASoC: imx-mc13783: Remove unused driver"). Reviewed-by: Fabio Estevam Signed-off-by: Josua Mayer Signed-off-by: Shawn Guo commit 4acaf8b293c8b03301508764dc3e586658186730 Author: Peng Fan Date: Wed Dec 17 20:42:09 2025 +0800 soc: imx: Spport i.MX9[4,52] Add i.MX9[4,52] machine compatible to allow soc device could be created. SOC_ID is 16bit format data: - i.MX943: 0x9430 - i.MX952: 0x9520 Update SOC_ID macro to get the accurate data. Co-developed-by: Jacky Bai Signed-off-by: Jacky Bai Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 36ca5298fc426f7c69111c7d4ef9310d2dc2d296 Author: Peng Fan Date: Wed Dec 17 20:42:08 2025 +0800 soc: imx: Use dev_err_probe() for i.MX9 Use dev_err_probe() to simplify code. No functional changes. Signed-off-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit ab382a6ee25f0b571cffad66b2e6aaf0d2d245ec Author: Peng Fan Date: Wed Dec 17 20:42:07 2025 +0800 soc: imx: Use device-managed APIs for i.MX9 Use device-managed APi to simplify code. Signed-off-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit fc61fdfdc4dd03fa5cea784e1969ed3df049c6c8 Author: Marek Vasut Date: Sat Nov 29 15:31:30 2025 +0100 arm64: dts: imx95: Use GPU_CGC as core clock for GPU The i.MX95 imx-sm introduced new GPU_CGC clock since imx-sm commit ca5e078833fa ("SM-128: Add clock management via CCM LPCG direct control") which are downstream clock of GPU clock. These new GPU_CGC clock gate the existing GPU clock. Currently, without clk_ignore_unused on kernel command line, those new GPU_CGC clock are unused and the kernel will disable them. This has no impact on i.MX95 A0/A1, but does prevent GPU register access from working at all on i.MX95 B0. The GPU_CGC clock are present on both i.MX95 A0/A1/B0, therefore update the DT such, that the GPU core clock are the GPU_CGC clock. When the panthor driver enables the GPU core clock, it enables both the GPU_CGC as well as its parent GPU clock. Fixes: 67934f248e64 ("arm64: dts: imx95: Describe Mali G310 GPU") Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit a9e03ec01ef2633288fd1b506980f54ae41c5a85 Merge: 695df7ea6099aa cb429866a82597 Author: Martin K. Petersen Date: Fri Jan 16 23:16:32 2026 -0500 Merge patch series "Clean up the SCSI disk driver source code" Bart Van Assche says: Hi Martin, This patch series removes multiple forward declarations from the SCSI disk (sd) driver and also makes error messages easier to find with grep. Please consider this patch series for the next merge window. Thanks, Bart. Link: https://patch.msgid.link/20260114175054.4118163-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit cb429866a8259705e4dec104585bfba517f2ebc2 Author: Bart Van Assche Date: Wed Jan 14 09:50:53 2026 -0800 scsi: sd: Do not split error messages Make it easier to find these error messages with grep. This patch has been created as follows: * Delete all occurrences of the following regular expression: "[[:blank:]]*\\*\n[[:blank:]]*" * Split long lines manually where necessary. Reviewed-by: Damien Le Moal Reviewed-by: Himanshu Madhani Reviewed-by: Johannes Thumshirn Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260114175054.4118163-6-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 6e07e5333cc3154e042a5e7de073459765616fa7 Author: Bart Van Assche Date: Wed Jan 14 09:50:52 2026 -0800 scsi: sd: Move the sd_fops definition Move the sd_fops definition such that the sd_unlock_native_capacity() forward declaration can be removed. Reviewed-by: Damien Le Moal Reviewed-by: Himanshu Madhani Reviewed-by: Johannes Thumshirn Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260114175054.4118163-5-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 3899cff5056f417071c74371a4a9744225823a40 Author: Bart Van Assche Date: Wed Jan 14 09:50:51 2026 -0800 scsi: sd: Move the scsi_disk_release() function definition Move the scsi_disk_release() function definition such that its forward declaration can be removed. Reviewed-by: Damien Le Moal Reviewed-by: Himanshu Madhani Reviewed-by: Johannes Thumshirn Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260114175054.4118163-4-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit c0daf4836114fcbdf64bf817cab00b75ce712945 Author: Bart Van Assche Date: Wed Jan 14 09:50:50 2026 -0800 scsi: sd: Move the sd_config_discard() function definition Move the sd_config_discard() function definition such that its forward declaration can be removed. Reviewed-by: Damien Le Moal Reviewed-by: Himanshu Madhani Reviewed-by: Johannes Thumshirn Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260114175054.4118163-3-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 4f39a4870a59971797be86fed72423b83b6b4e00 Author: Bart Van Assche Date: Wed Jan 14 09:50:49 2026 -0800 scsi: sd: Move the sd_remove() function definition Move the sd_remove() function definition such that the sd_shutdown() forward declaration can be removed. Reviewed-by: Damien Le Moal Reviewed-by: Himanshu Madhani Reviewed-by: Johannes Thumshirn Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20260114175054.4118163-2-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 695df7ea6099aadc11fac8d510e4b7c5839508e3 Author: Keoseong Park Date: Fri Dec 26 13:28:25 2025 +0900 scsi: ufs: core: Handle sentinel value for dHIDAvailableSize JEDEC UFS spec defines 0xFFFFFFFF for dHIDAvailableSize as indicating no valid fragmented size information. Returning the raw value can mislead userspace. Return -ENODATA instead when the value is unavailable. Signed-off-by: Keoseong Park Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251226042825epcms2p6f02ba12fa97ff4a69c00f6fb9ff55603@epcms2p6 Signed-off-by: Martin K. Petersen commit 07959ef517b853e834eadd0647d3860252af8f99 Author: Peter Griffin Date: Fri Jan 9 11:40:14 2026 +0000 scsi: ufs: exynos: Call phy_notify_state() from hibern8 callbacks Notify the UFS phy of the hibern8 link state so that it can program the appropriate values. Signed-off-by: Peter Griffin Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260109-ufs-exynos-phy_notify_pmstate-v3-1-7eb692e271af@linaro.org Signed-off-by: Martin K. Petersen commit 8124b4a4a96b57d6cc3705a9df9623c52baa047b Author: Frank Li Date: Tue Nov 4 17:27:14 2025 -0500 ARM: dts: imx: move nand related property under nand@0 Add child node nand@0 and move NAND related property under it to align modern nand-controller.yaml. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6ull-colibri-aster.dtb: nand-controller@1806000 (fsl,imx6q-gpmi-nand): Unevaluated properties are not allowed ('nand-ecc-mode', 'nand-ecc-step-size', 'nand-ecc-strength', 'nand-on-flash-bbt' were unexpected) from schema $id: http://devicetree.org/schemas/mtd/gpmi-nand.yaml# Since 2019 year, commit (212e496935929 dt-bindings: mtd: Add YAML schemas for the generic NAND options) NAND related property is preferred located under nand@ even though only one NAND chip supported. Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit af6c4ea19df9a6612c15f7647d47397e4314d4e7 Author: Frank Li Date: Tue Nov 4 17:27:13 2025 -0500 ARM: dts: imx6sx: update gpmi #size-cells to 0 Update gpmi #size-cells to 0 to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/imx/imx6sx-nitrogen6sx.dtb: nand-controller@1806000 (fsl,imx6sx-gpmi-nand): #size-cells: 0 was expected from schema $id: http://devicetree.org/schemas/mtd/gpmi-nand.yaml# Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 54397e9844a4d1231a2aa2a6042b9fab279772b7 Author: Frank Li Date: Tue Nov 4 17:27:12 2025 -0500 ARM: dts: imx6qdl: add '#address-cells' and '#size-cells' for gpmi-nand Add '#address-cells' and '#size-cells' for gpmi-nand to below CHECK_DTBS warings: arm/boot/dts/nxp/imx/imx6dl-aristainetos_4.dtb: nand-controller@112000 (fsl,imx6q-gpmi-nand): '#address-cells' is a required property from schema $id: http://devicetree.org/schemas/mtd/gpmi-nand.yaml# Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 80a4062e8821861c3ce7407ea5b23afa959917e2 Author: Peng Fan Date: Wed Oct 29 20:07:02 2025 +0800 firmware: imx: sm-misc: Dump syslog info Add debugfs interface to read System Manager syslog info Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 4fa62e80c7dba7ff419dea23f10bcb125e38bde3 Author: Peng Fan Date: Wed Oct 29 20:07:01 2025 +0800 firmware: arm_scmi: imx: Support getting syslog of MISC protocol MISC protocol supports getting system log regarding system sleep latency, wakeup interrupt and etc. Add the API for user to retrieve the information from SM. Signed-off-by: Peng Fan Acked-by: Sudeep Holla Signed-off-by: Shawn Guo commit f0ed0e84445245e56aa73c4df8d99936a2ce8549 Author: Frank Li Date: Mon Oct 20 15:00:42 2025 -0400 arm64: dts: imx91: Add thermal-sensor and thermal-zone support Add thermal-sensor and thermal-zone support. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit e897e86711b28f815fbbe542fe87a66b39123d1e Author: Svyatoslav Ryhel Date: Wed Oct 22 17:20:31 2025 +0300 clk: tegra30: Add CSI pad clock gates Tegra30 has CSI pad bits in both PLLD and PLLD2 clocks that are required for the correct work of the CSI block. Add CSI pad A and pad B clock gates with PLLD/PLLD2 parents, respectively. Add a plld2 spinlock, like one plld uses, to prevent simultaneous access since both the PLLDx and CSIx_PAD clocks use the same registers Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Thierry Reding commit a6d8abf5b4549f8dafe68777f54436d3ab2fbacd Author: Svyatoslav Ryhel Date: Wed Oct 22 17:20:29 2025 +0300 clk: tegra: Set CSUS as vi_sensor's gate for Tegra20, Tegra30 and Tegra114 The CSUS clock is a clock gate for the output clock signal primarily sourced from the VI_SENSOR clock. This clock signal is used as an input MCLK clock for cameras. Unlike later Tegra SoCs, the Tegra 20 can change its CSUS parent, which is why csus_mux is added in a similar way to how CDEV1 and CDEV2 are handled. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Thierry Reding commit d262d030baef287da33344a932639aab5f913c3a Author: Svyatoslav Ryhel Date: Wed Oct 22 17:20:32 2025 +0300 dt-bindings: display: tegra: document Tegra30 VI and VIP Existing Parallel VI interface schema for Tegra20 is fully compatible with Tegra30; hence, lets reuse it by setting fallback for Tegra30. Adjust existing VI schema to reflect that Tegra20 VI is compatible with Tegra30 by setting a fallback for Tegra30. Additionally, switch to using an enum instead of list of const. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Thierry Reding commit d6e8b796d0d67699c74ee3cbc46601cf9ec925bb Author: Svyatoslav Ryhel Date: Wed Oct 22 17:20:38 2025 +0300 dt-bindings: display: tegra: document Tegra132 MIPI calibration device Document MIPI calibration device found in Tegra132. This compatible already exists in the Linux kernel, I have just documented it to satisfy warnings. Each Tegra SoC generation has unique set of registers which should be configured. They all differ, hence fallback is not suitable here. Signed-off-by: Svyatoslav Ryhel Acked-by: Conor Dooley Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Thierry Reding commit 4d93678236678c4b6b0076fd11f4611a22b7e70b Author: Svyatoslav Ryhel Date: Thu Dec 4 08:17:03 2025 +0200 ARM: tegra: Adjust DSI nodes for Tegra20/Tegra30 Add missing nvidia,mipi-calibrate and cells properties to DSI nodes. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit f521678d1921e0c1a206fa03a87b318d3e97d89b Author: Svyatoslav Ryhel Date: Thu Dec 4 08:17:00 2025 +0200 clk: tegra20: Reparent dsi clock to pll_d_out0 Reparent DSI clock to PLLD_OUT0 instead of directly descend from PLLD. Signed-off-by: Svyatoslav Ryhel Acked-by: Stephen Boyd Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b Author: Diogo Ivo Date: Thu Dec 4 21:27:21 2025 +0000 arm64: tegra: smaug: Add usb-role-switch support The USB2 port on Smaug is configured for OTG operation but lacked the required 'usb-role-switch' property, leading to a failed probe and a non-functioning USB port. Add the property along with setting the default role to host. Signed-off-by: Diogo Ivo Signed-off-by: Thierry Reding commit c256740c4b1ff5f3e6cbad48d5d4081849672b76 Author: Diogo Ivo Date: Thu Dec 4 21:27:20 2025 +0000 arm64: tegra: smaug: Complete and enable tegra-udc node Complete the missing properties in the tegra-udc node and enable it for Smaug. Signed-off-by: Diogo Ivo Signed-off-by: Thierry Reding commit 8acdb94dcfd37ad974abbf3209ed49821e8a5686 Author: Diogo Ivo Date: Fri Dec 26 12:17:32 2025 +0000 arm64: tegra: smaug: Enable DisplayPort via USB-C port Enable both SOR and DPAUX modules allowing the USB-C port to transmit video in DP altmode. Tested on several monitors with USB-C to HDMI adapter. Signed-off-by: Diogo Ivo Signed-off-by: Thierry Reding commit 2ea99dade57e094625726de1ced1e99b48fc767a Author: Krzysztof Kozlowski Date: Fri Jan 2 13:50:20 2026 +0100 clk: tegra: tegra124-emc: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Jon Hunter Signed-off-by: Thierry Reding commit 1acce02756a3be28b405744bce09075160fdd31d Author: Rafael J. Wysocki Date: Tue Jan 6 13:19:47 2026 +0100 clk: tegra: Adjust callbacks in tegra_clock_pm System suspend and resume callbacks run after the core has bumped up the runtime PM usage counters of all devices, so these callbacks need not worry about runtime PM reference counting. Accordingly, to eliminate useless overhead related to runtime PM usage counter manipulation, set the suspend callback pointer in tegra_clock_pm to a wrapper around pm_runtime_resume() called tegra_clock_suspend() and do not set the resume callback in it at all. This will also facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki Acked-by: Jon Hunter Tested-by: Jon Hunter Signed-off-by: Thierry Reding commit 79643afdd985ee14f9dddd66da262314f04d1640 Author: Nícolas F. R. A. Prado Date: Wed Dec 17 11:19:02 2025 +0100 dt-bindings: phy: mediatek,hdmi-phy: Document extra clocks for MT8195 MT8195's HDMI PHY block has 4 clocks instead of just a single one. Describe the extra clocks for it. Signed-off-by: Nícolas F. R. A. Prado Signed-off-by: Louis-Alexis Eyraud Reviewed-by: Rob Herring (Arm) Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251217-mtk-genio-evk-hdmi-support-v2-3-a994976bb39a@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 8a25ab7a57e67baddee185c3fd565df1062e4807 Author: Louis-Alexis Eyraud Date: Wed Dec 17 11:19:01 2025 +0100 dt-bindings: phy: mediatek,hdmi-phy: Add support for MT8188 SoC Add compatible string for the HDMI PHY IP on MT8188 SoC, that is compatible with the one found on MT8195 SoC. Signed-off-by: Louis-Alexis Eyraud Reviewed-by: Rob Herring (Arm) Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251217-mtk-genio-evk-hdmi-support-v2-2-a994976bb39a@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 7263d6a8b8743e6022f44d9dc367213c7695a8f2 Author: Krzysztof Kozlowski Date: Thu Jan 15 19:48:45 2026 +0100 arm64: tegra: Correct CPU compatibles on Tegra264 "arm,armv8" CPU compatible is only for software models and must not be used in DTS for actual hardware. Replace them with Neoverse V3AE compatible, based what is written on Wikipedia [1]. Link: https://en.wikipedia.org/wiki/Tegra#Thor [1] Reported-by: Konrad Dybcio Closes: https://lore.kernel.org/all/59ae6b16-7866-413a-a1d2-4a735024c108@oss.qualcomm.com/ Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 42cbac7dc900aca83878c1c35a1b60725ba327dc Author: Krzysztof Kozlowski Date: Thu Jan 15 19:48:44 2026 +0100 arm64: tegra: Drop unneeded status=okay on Tegra264 Device nodes are enabled by default and this DTSI file does not include anything else, thus it is impossible that nodes were disabled before and need to be re-enabled. Adding redundant status=okay is just confusing and suggests some other code flow. Verified with dtx_diff. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 8f9c967e8eb0d6f7053fa9b68f7dc51cee118872 Author: Krzysztof Kozlowski Date: Thu Jan 15 19:48:43 2026 +0100 arm64: tegra: Drop unneeded status=okay on Tegra234 Device nodes are enabled by default and this DTSI file does not include anything else, thus it is impossible that nodes were disabled before and need to be re-enabled. Adding redundant status=okay is just confusing and suggests some other code flow. Verified with dtx_diff. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 9ff1e819b0a6056de68cd96760d21b0c68e1b7d3 Author: Krzysztof Kozlowski Date: Thu Jan 15 19:48:42 2026 +0100 arm64: tegra: Drop unneeded status=okay on Tegra194 Device nodes are enabled by default and this DTSI file does not include anything else, thus it is impossible that nodes were disabled before and need to be re-enabled. Adding redundant status=okay is just confusing and suggests some other code flow. Verified with dtx_diff. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 6e71a4b88752a6dbab17d410bb10880fba2c890a Author: Krzysztof Kozlowski Date: Thu Jan 15 19:48:41 2026 +0100 arm64: tegra: Drop unneeded status=okay on Tegra186 Device nodes are enabled by default and this DTSI file does not include anything else, thus it is impossible that nodes were disabled before and need to be re-enabled. Adding redundant status=okay is just confusing and suggests some other code flow. Verified with dtx_diff. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit fe57d0ac48350be4b5c069c37665279e6c35d7b7 Author: Ashish Mhetre Date: Tue Jan 13 05:49:35 2026 +0000 arm64: tegra: Add nodes for CMDQV The Command Queue Virtualization (CMDQV) hardware is part of the SMMUv3 implementation on NVIDIA Tegra SoCs. It assists in virtualizing the command queue for the SMMU. Update SMMU compatible strings to use nvidia,tegra264-smmu to enable CMDQV support. Add device tree nodes for the CMDQV hardware and enable them on the tegra264-p3834 platform where SMMUs are enabled. Each SMMU instance is paired with its corresponding CMDQV instance via the nvidia,cmdqv property. Acked-by: Nicolin Chen Signed-off-by: Ashish Mhetre Reviewed-by: Jon Hunter Signed-off-by: Thierry Reding commit fbde94c13bea40d3b7ac6416b93e4c00bb9b1880 Author: Thierry Reding Date: Wed Nov 5 20:53:42 2025 +0100 arm64: tegra: Add DBB clock to EMC on Tegra264 The DBB clock is used by the EMC to enable the data path from various IP blocks to external memory. Signed-off-by: Thierry Reding commit 01c430b1cfa8a6ce0cbf99edc38dac3bfc51e464 Author: AngeloGioacchino Del Regno Date: Wed Dec 17 11:19:00 2025 +0100 dt-bindings: phy: mediatek,hdmi-phy: Fix clock output names for MT8195 For all of the HDMI PHYs compatible with the one found on MT8195 the output clock has a different datasheet name and specifically it is called "hdmi_txpll", differently from the older HDMI PHYs which output block is called "hdmitx_dig_cts". Replace clock output name string check by max item number one to allow the new name on all of the HDMI PHY IPs that are perfectly compatible with MT8195. [Louis-Alexis Eyraud: split patch, addressed previous feedback from mailing list, and reworded description] Fixes: c78fe548b062 ("dt-bindings: phy: mediatek: hdmi-phy: Add mt8195 compatible") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251217-mtk-genio-evk-hdmi-support-v2-1-a994976bb39a@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 6142b726e6e64870ab0c7ffb158bffa141f83bb6 Author: Srinivas Pandruvada Date: Fri Jan 16 15:48:50 2026 -0800 tools/power/x86/intel-speed-select: v1.25 release This version includes the following changes: - Allow read only commands for non root users when permitted - Fix file descriptor leak in isolate_cpus() - Replace hardcoded libnl3 include path Signed-off-by: Srinivas Pandruvada commit 56c17ee151c6e1a73d77e15b82a8e2130cd8dd16 Author: Malaya Kumar Rout Date: Thu Jan 15 15:33:33 2026 +0530 tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() The file descriptor opened in isolate_cpus() when (!level) is true was not being closed before returning, causing a file descriptor leak in both the error path and the success path. When write() fails at line 950, the function returns at line 953 without closing the file descriptor. Similarly, on success, the function returns at line 956 without closing the file descriptor. Add close(fd) calls before both return statements to fix the resource leak. This follows the same pattern used elsewhere in the same function where file descriptors are properly closed before returning (see lines 1005 and 1027). Fixes: 997074df658e ("tools/power/x86/intel-speed-select: Use cgroup v2 isolation") Signed-off-by: Malaya Kumar Rout Signed-off-by: Srinivas Pandruvada commit 21adcd5ec99f342489a49e9d237a987b1bd9fab5 Author: Khem Raj Date: Mon Dec 29 12:45:06 2025 -0800 tools/power/x86/intel-speed-select: Use pkg-config for libnl-3.0 detection Replace hardcoded libnl3 include path with pkg-config detection to improve portability across different distributions and build environments. The previous implementation used a fixed path constructed from the compiler's sysroot, which could fail on systems with non-standard library installations. Now the build system: - Attempts to detect libnl-3.0 include paths using pkg-config - Falls back to /usr/include/libnl3 if pkg-config is unavailable - Maintains backward compatibility with existing build configurations This ensures the tool builds correctly on a wider range of systems while preserving existing behavior when pkg-config is not present. Closes:https://bugzilla.kernel.org/show_bug.cgi?id=220819 Signed-off-by: Khem Raj Signed-off-by: Srinivas Pandruvada commit 6588b8845e7387438d4b91ea86e7cb6d838b3108 Author: Srinivas Pandruvada Date: Fri Jan 16 15:30:23 2026 -0800 tools/power/x86/intel-speed-select: Allow non root users When permitted by the file /dev/isst_interface, allow to issue commands for non root users. When user id is non root, check if "/dev/isst_interface" can still be opened. If this file can be opened, allow all read only commands. Signed-off-by: Srinivas Pandruvada commit ec8bb999dc0c5d64a3366ce8765a479305a82029 Author: Jaegeuk Kim Date: Fri Jan 16 04:25:43 2026 +0000 f2fs: use folio_end_read No logic change. Suggested-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5c145c03188bc9ba1c29e0bc4d527a5978fc47f9 Author: Chao Yu Date: Tue Jan 13 14:22:29 2026 +0800 f2fs: fix to avoid mapping wrong physical block for swapfile Xiaolong Guo reported a f2fs bug in bugzilla [1] [1] https://bugzilla.kernel.org/show_bug.cgi?id=220951 Quoted: "When using stress-ng's swap stress test on F2FS filesystem with kernel 6.6+, the system experiences data corruption leading to either: 1 dm-verity corruption errors and device reboot 2 F2FS node corruption errors and boot hangs The issue occurs specifically when: 1 Using F2FS filesystem (ext4 is unaffected) 2 Swapfile size is less than F2FS section size (2MB) 3 Swapfile has fragmented physical layout (multiple non-contiguous extents) 4 Kernel version is 6.6+ (6.1 is unaffected) The root cause is in check_swap_activate() function in fs/f2fs/data.c. When the first extent of a small swapfile (< 2MB) is not aligned to section boundaries, the function incorrectly treats it as the last extent, failing to map subsequent extents. This results in incorrect swap_extent creation where only the first extent is mapped, causing subsequent swap writes to overwrite wrong physical locations (other files' data). Steps to Reproduce 1 Setup a device with F2FS-formatted userdata partition 2 Compile stress-ng from https://github.com/ColinIanKing/stress-ng 3 Run swap stress test: (Android devices) adb shell "cd /data/stressng; ./stress-ng-64 --metrics-brief --timeout 60 --swap 0" Log: 1 Ftrace shows in kernel 6.6, only first extent is mapped during second f2fs_map_blocks call in check_swap_activate(): stress-ng-swap-8990: f2fs_map_blocks: ino=11002, file offset=0, start blkaddr=0x43143, len=0x1 (Only 4KB mapped, not the full swapfile) 2 in kernel 6.1, both extents are correctly mapped: stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=0, start blkaddr=0x13cd4, len=0x1 stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=1, start blkaddr=0x60c84b, len=0xff The problematic code is in check_swap_activate(): if ((pblock - SM_I(sbi)->main_blkaddr) % blks_per_sec || nr_pblocks % blks_per_sec || !f2fs_valid_pinned_area(sbi, pblock)) { bool last_extent = false; not_aligned++; nr_pblocks = roundup(nr_pblocks, blks_per_sec); if (cur_lblock + nr_pblocks > sis->max) nr_pblocks -= blks_per_sec; /* this extent is last one */ if (!nr_pblocks) { nr_pblocks = last_lblock - cur_lblock; last_extent = true; } ret = f2fs_migrate_blocks(inode, cur_lblock, nr_pblocks); if (ret) { if (ret == -ENOENT) ret = -EINVAL; goto out; } if (!last_extent) goto retry; } When the first extent is unaligned and roundup(nr_pblocks, blks_per_sec) exceeds sis->max, we subtract blks_per_sec resulting in nr_pblocks = 0. The code then incorrectly assumes this is the last extent, sets nr_pblocks = last_lblock - cur_lblock (entire swapfile), and performs migration. After migration, it doesn't retry mapping, so subsequent extents are never processed. " In order to fix this issue, we need to lookup block mapping info after we migrate all blocks in the tail of swapfile. Cc: stable@kernel.org Fixes: 9703d69d9d15 ("f2fs: support file pinning for zoned devices") Cc: Daeho Jeong Reported-and-tested-by: Xiaolong Guo Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220951 Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fe2961fb77e4784261976ca887135b1aecd8a9f1 Author: Chao Yu Date: Mon Jan 12 09:33:20 2026 +0800 f2fs: avoid f2fs_map_blocks() for consecutive holes in readpages For consecutive large hole mapping across {d,id,did}nodes , we don't need to call f2fs_map_blocks() to check one hole block per one time, instead, we can use map.m_next_pgofs as a hint of next potential valid block, so that we can skip calling f2fs_map_blocks the range of [cur_pgofs + 1, .m_next_pgofs). 1) regular case touch /mnt/f2fs/file truncate -s $((1024*1024*1024)) /mnt/f2fs/file time dd if=/mnt/f2fs/file of=/dev/null bs=1M count=1024 Before: real 0m0.706s user 0m0.000s sys 0m0.706s After: real 0m0.620s user 0m0.008s sys 0m0.611s 2) large folio case touch /mnt/f2fs/file truncate -s $((1024*1024*1024)) /mnt/f2fs/file f2fs_io setflags immutable /mnt/f2fs/file sync echo 3 > /proc/sys/vm/drop_caches time dd if=/mnt/f2fs/file of=/dev/null bs=1M count=1024 Before: real 0m0.438s user 0m0.004s sys 0m0.433s After: real 0m0.368s user 0m0.004s sys 0m0.364s Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d194f112a9e6504ea23bd4a7b350c089fae9defd Author: Nanzhe Zhao Date: Sun Jan 11 18:09:41 2026 +0800 f2fs: advance index and offset after zeroing in large folio read In f2fs_read_data_large_folio(), the block zeroing path calls folio_zero_range() and then continues the loop. However, it fails to advance index and offset before continuing. This can cause the loop to repeatedly process the same subpage of the folio, leading to stalls/hangs and incorrect progress when reading large folios with holes/zeroed blocks. Fix it by advancing index and offset unconditionally in the loop iteration, so they are updated even when the zeroing path continues. Signed-off-by: Nanzhe Zhao Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6afd05ca6d45b834af36c8e1257e7203b2604583 Author: Nanzhe Zhao Date: Sun Jan 11 18:09:40 2026 +0800 f2fs: add 'folio_in_bio' to handle readahead folios with no BIO submission f2fs_read_data_large_folio() can build a single read BIO across multiple folios during readahead. If a folio ends up having none of its subpages added to the BIO (e.g. all subpages are zeroed / treated as holes), it will never be seen by f2fs_finish_read_bio(), so folio_end_read() is never called. This leaves the folio locked and not marked uptodate. Track whether the current folio has been added to a BIO via a local 'folio_in_bio' bool flag, and when iterating readahead folios, explicitly mark the folio uptodate (on success) and unlock it when nothing was added. Signed-off-by: Nanzhe Zhao Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 540d34c18272d124ef3113b7dbe499304ce0023c Author: Yongpeng Yang Date: Fri Jan 9 22:46:18 2026 +0800 f2fs: avoid unnecessary block mapping lookups in f2fs_read_data_large_folio In the second call to f2fs_map_blocks within f2fs_read_data_large_folio, map.m_len exceeds the logical address space to be read. This patch ensures map.m_len does not exceed the required address space. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 93ffb6c28ff180560d2d7313ac106efcd9e012b8 Author: Chao Yu Date: Mon Jan 12 15:49:17 2026 +0800 f2fs: detect more inconsistent cases in sanity_check_node_footer() Let's enhance sanity_check_node_footer() to detect more inconsistent cases as below: Node Type Node Footer Info =================== ============================= NODE_TYPE_REGULAR inode = true and xnode = true NODE_TYPE_INODE inode = false or xnode = true NODE_TYPE_XATTR inode = true or xnode = false NODE_TYPE_NON_INODE inode = false Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4 Author: Chao Yu Date: Mon Jan 12 15:49:16 2026 +0800 f2fs: fix to do sanity check on node footer in {read,write}_end_io -----------[ cut here ]------------ kernel BUG at fs/f2fs/data.c:358! Call Trace: blk_update_request+0x5eb/0xe70 block/blk-mq.c:987 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1149 blk_complete_reqs block/blk-mq.c:1224 [inline] blk_done_softirq+0x107/0x160 block/blk-mq.c:1229 handle_softirqs+0x283/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050 In f2fs_write_end_io(), it detects there is inconsistency in between node page index (nid) and footer.nid of node page. If footer of node page is corrupted in fuzzed image, then we load corrupted node page w/ async method, e.g. f2fs_ra_node_pages() or f2fs_ra_node_page(), in where we won't do sanity check on node footer, once node page becomes dirty, we will encounter this bug after node page writeback. Cc: stable@kernel.org Reported-by: syzbot+803dd716c4310d16ff3a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=803dd716c4310d16ff3a Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 0a736109c9d29de0c26567e42cb99b27861aa8ba Author: Chao Yu Date: Mon Jan 12 15:49:15 2026 +0800 f2fs: fix to do sanity check on node footer in __write_node_folio() Add node footer sanity check during node folio's writeback, if sanity check fails, let's shutdown filesystem to avoid looping to redirty and writeback in .writepages. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f7b929eda1f1c28ec80ab613cb23410d84755591 Author: Yangyang Zang Date: Mon Jan 12 15:46:35 2026 +0800 f2fs: clean up the type parameter in f2fs_sync_meta_pages() Clean up code to improve readability, no logic changes. Signed-off-by: Yangyang Zang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e48e16f3e37fac76e2f0c14c58df2b0398a323b0 Author: Daeho Jeong Date: Sat Jan 10 15:54:05 2026 -0800 f2fs: support non-4KB block size without packed_ssa feature Currently, F2FS requires the packed_ssa feature to be enabled when utilizing non-4KB block sizes (e.g., 16KB). This restriction limits the flexibility of filesystem formatting options. This patch allows F2FS to support non-4KB block sizes even when the packed_ssa feature is disabled. It adjusts the SSA calculation logic to correctly handle summary entries in larger blocks without the packed layout. Cc: stable@kernel.org Fixes: 7ee8bc3942f2 ("f2fs: revert summary entry count from 2048 to 512 in 16kb block support") Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1dd3b437d49ce09f0bd72acc1d694e212f26d1fe Author: Chao Yu Date: Mon Dec 15 20:28:03 2025 +0800 f2fs: make FAULT_DISCARD obsolete __blkdev_issue_discard() in __submit_discard_cmd() will never fail, so let's make FAULT_DISCARD fault injection obsolete. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ce2739e482bce8d2c014d76c4531c877f382aa54 Author: Chao Yu Date: Wed Jan 7 19:22:18 2026 +0800 f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an use-after-free issue in f2fs_write_end_io(). It is caused by below race condition: loop device umount - worker_thread - loop_process_work - do_req_filebacked - lo_rw_aio - lo_rw_aio_complete - blk_mq_end_request - blk_update_request - f2fs_write_end_io - dec_page_count - folio_end_writeback - kill_f2fs_super - kill_block_super - f2fs_put_super : free(sbi) : get_pages(, F2FS_WB_CP_DATA) accessed sbi which is freed In kill_f2fs_super(), we will drop all page caches of f2fs inodes before call free(sbi), it guarantee that all folios should end its writeback, so it should be safe to access sbi before last folio_end_writeback(). Let's relocate ckpt thread wakeup flow before folio_end_writeback() to resolve this issue. Cc: stable@kernel.org Fixes: e234088758fc ("f2fs: avoid wait if IO end up when do_checkpoint for better performance") Reported-by: syzbot+b4444e3c972a7a124187@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b4444e3c972a7a124187 Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8b00951402f7420365b5697269b190f616bd116a Author: AngeloGioacchino Del Regno Date: Thu Jan 8 11:19:59 2026 +0100 drm/mediatek: mtk_dsi: Add support for High Speed (HS) mode Up until now, the MediaTek DSI Controller has always been working in Low Power Mode (LPM), as this driver has always ignored the MIPI_DSI_MSG_USE_LPM flag hence never setting HS mode. In the current state of the driver the only thing that is needed to add support for DSI High Speed (HS) transmit is to simply set the "HSTX" config bit in the configuration register. Check if flag MIPI_DSI_MSG_USE_LPM is set and, if not, set HSTX. Signed-off-by: AngeloGioacchino Del Regno Tested-by: Gary Bisson Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20260108101959.14872-1-angelogioacchino.delregno@collabora.com/ Signed-off-by: Chun-Kuang Hu commit efad162f5a840ae178e7761c176c49f433c7bb68 Author: Yonghong Song Date: Thu Jan 15 21:22:45 2026 -0800 selftests/bpf: Fix map_kptr test failure On my arm64 machine, I get the following failure: ... tester_init:PASS:tester_log_buf 0 nsec process_subtest:PASS:obj_open_mem 0 nsec process_subtest:PASS:specs_alloc 0 nsec serial_test_map_kptr:PASS:rcu_tasks_trace_gp__open_and_load 0 nsec ... test_map_kptr_success:PASS:map_kptr__open_and_load 0 nsec test_map_kptr_success:PASS:test_map_kptr_ref1 refcount 0 nsec test_map_kptr_success:FAIL:test_map_kptr_ref1 retval unexpected error: 2 (errno 2) test_map_kptr_success:PASS:test_map_kptr_ref2 refcount 0 nsec test_map_kptr_success:FAIL:test_map_kptr_ref2 retval unexpected error: 1 (errno 2) ... #201/21 map_kptr/success-map:FAIL In serial_test_map_kptr(), before test_map_kptr_success(), one kern_sync_rcu() is used to have some delay for freeing the map. But in my environment, one kern_sync_rcu() seems not enough and caused the test failure. In bpf_map_free_in_work() in syscall.c, the queue time for queue_work(system_dfl_wq, &map->work) may be longer than expected. This may cause the test failure since test_map_kptr_success() expects all previous maps having been freed. Since it is not clear how long queue_work() time takes, a bpf prog is added to count the reference after bpf_kfunc_call_test_acquire(). If the number of references is 2 (for initial ref and the one just acquired), all previous maps should have been released. This will resolve the above 'retval unexpected error' issue. Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/bpf/20260116052245.3692405-1-yonghong.song@linux.dev commit 47d440d0a5bb822f3f4e4b2479246da5efb765e6 Author: Alan Maguire Date: Thu Jan 15 16:34:57 2026 +0000 selftests/bpf: Support when CONFIG_VXLAN=m If CONFIG_VXLAN is 'm', struct vxlanhdr will not be in vmlinux.h. Add a ___local variant to support cases where vxlan is a module. Fixes: 8517b1abe5ea ("selftests/bpf: Integrate test_tc_tunnel.sh tests into test_progs") Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260115163457.146267-1-alan.maguire@oracle.com commit 999b2395e3c32273dec98f811f0ab5c8a7441850 Author: Gyutae Bae Date: Mon Jan 12 12:45:16 2026 +0900 bpftool: Add 'prepend' option for tcx attach to insert at chain start Add support for the 'prepend' option when attaching tcx_ingress and tcx_egress programs. This option allows inserting a BPF program at the beginning of the TCX chain instead of appending it at the end. The implementation uses BPF_F_BEFORE flag which automatically inserts the program at the beginning of the chain when no relative reference is specified. This change includes: - Modify do_attach_tcx() to support prepend insertion using BPF_F_BEFORE - Update documentation to describe the new 'prepend' option - Add bash completion support for the 'prepend' option on tcx attach types - Add example usage in the documentation - Add validation to reject 'overwrite' for non-XDP attach types The 'prepend' option is only valid for tcx_ingress and tcx_egress attach types. For XDP attach types, the existing 'overwrite' option remains available. Example usage: # bpftool net attach tcx_ingress name tc_prog dev lo prepend This feature is useful when the order of program execution in the TCX chain matters and users need to ensure certain programs run first. Co-developed-by: Siwan Kim Signed-off-by: Siwan Kim Signed-off-by: Gyutae Bae Signed-off-by: Andrii Nakryiko Reviewed-by: Quentin Monnet Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20260112034516.22723-1-gyutae.opensource@navercorp.com commit 4787eaf7c17131bf0cce93336f8f411f832ad05a Author: Tim Bird Date: Wed Jan 14 18:31:29 2026 -0700 bpf: Add SPDX license identifiers to a few files Add GPL-2.0 SPDX-License-Identifier lines to some files, and remove a reference to COPYING, and boilerplate warranty text, from offload.c. Signed-off-by: Tim Bird Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260115013129.598705-1-tim.bird@sony.com commit 1700147697618a57ed0a2a97d9a477d131b8fc54 Author: Mykyta Yatsenko Date: Thu Jan 15 18:45:09 2026 +0000 bpf: Add __force annotations to silence sparse warnings Add __force annotations to casts that convert between __user and kernel address spaces. These casts are intentional: - In bpf_send_signal_common(), the value is stored in si_value.sival_ptr which is typed as void __user *, but the value comes from a BPF program parameter. - In the bpf_*_dynptr() kfuncs, user pointers are cast to const void * before being passed to copy helper functions that correctly handle the user address space through copy_from_user variants. Without __force, sparse reports: warning: cast removes address space '__user' of expression Reported-by: kernel test robot Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260115184509.3585759-1-mykyta.yatsenko5@gmail.com Closes: https://lore.kernel.org/oe-kbuild-all/202601131740.6C3BdBaB-lkp@intel.com/ commit d4271702ab2fb0e4474ce66e3c68dfbdf8dc3e4c Merge: 379b749add7eff 2a0a30805a7d27 Author: Nathan Chancellor Date: Fri Jan 16 15:02:22 2026 -0700 Merge UAPI header testing improvements into kbuild-next Signed-off-by: Nathan Chancellor commit 2a0a30805a7d27470e02137cae72f7c3188e44eb Author: Thomas Weißschuh Date: Tue Dec 23 08:04:12 2025 +0100 kbuild: uapi: drop dependency on CC_CAN_LINK The header tests try to compile each header. Some UAPI headers depend on libc headers so they need a full userspace toolchain to build. This dependency is expressed in kconfig as a dependency on CC_CAN_LINK. Many kernel builds do not satisfy CC_CAN_LINK as they only use a minimal kernel (cross-) compiler. In those configurations the UAPI headers are not tested at all. However most UAPI headers do not even depend on any libc headers, and such dependencies are undesired in any case. Also the static analysis performed by headers_check.pl does not need CC_CAN_LINK. Drop the hard dependency on CC_CAN_LINK and instead skip the affected compilation step for exactly those headers which require libc. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251223-uapi-nostdinc-v1-5-d91545d794f7@linutronix.de Signed-off-by: Nathan Chancellor commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 Author: Thomas Weißschuh Date: Thu Jan 15 08:35:45 2026 +0100 virt: vbox: uapi: Mark inner unions in packed structs as packed The unpacked unions within a packed struct generates alignment warnings on clang for 32-bit ARM: ./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32' is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)' and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] 239 | } u; | ^ ./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to 'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] With the recent changes to compile-test the UAPI headers in more cases, these warning in combination with CONFIG_WERROR breaks the build. Fix the warnings. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ Signed-off-by: Thomas Weißschuh Tested-by: Nicolas Schier Reviewed-by: Nicolas Schier Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de Signed-off-by: Nathan Chancellor commit 1e5271393d777f6159d896943b4c44c4f3ecff52 Author: Thomas Weißschuh Date: Thu Jan 15 08:35:44 2026 +0100 hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed The unpacked union within a packed struct generates alignment warnings on clang for 32-bit ARM: ./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value' is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)' and is usually due to 'struct hv_kvp_exchg_msg_value' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] 361 | union { | ^ With the recent changes to compile-test the UAPI headers in more cases, this warning in combination with CONFIG_WERROR breaks the build. Fix the warning. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/ Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/ Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/ Signed-off-by: Thomas Weißschuh Acked-by: Wei Liu (Microsoft) Tested-by: Nicolas Schier Reviewed-by: Nicolas Schier Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de Signed-off-by: Nathan Chancellor commit a95e1d848972dd7d5cbabd62921b9b85501d891e Author: Rob Herring (Arm) Date: Thu Jan 8 17:15:58 2026 -0600 arm64: dts: broadcom: bcm4906-netgear-r8000p: Drop unnecessary "ranges" in partition node "ranges" is only valid for MMIO addresses as it is used for translating addresses to CPU address. Even if a partial translation was supported, the DT is incorrect here as the nvmem-layout node would also need "ranges". So drop "ranges" and the associated cell size properties. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260108231558.1422454-2-robh@kernel.org Signed-off-by: Florian Fainelli commit 9a19a2c7b2b065d2060a9d95c4cfcc4d4d31b925 Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:52 2026 -0600 arm64: dts: broadcom: northstar2: Drop "arm,cci-400-pmu" fallback compatible The "arm,cci-400-pmu" compatible is not documented as a valid fallback nor is it used, so drop it. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-13-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit 172711e80a70d2ee267958062428c471ed7e77f2 Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:51 2026 -0600 arm64: dts: broadcom: northstar2: Drop QSPI "clock-names" The "clock-names" property is not documented for the "brcm,spi-bcm-qspi" binding nor in use by the kernel driver, so drop it. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-12-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit 9c316b5a097304cb65becf0201275fbb1f927e89 Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:50 2026 -0600 arm64: dts: broadcom: northstar2: Drop unused and undocumented "brcm,pcie-ob-oarr-size" properties The "brcm,pcie-ob-oarr-size" property is unused and undocumented, so drop them. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-11-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit 407940f2578e9ab917eab0bf1f0c43200f48881a Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:49 2026 -0600 arm64: dts: broadcom: northstar2: Rework clock nodes The nd2-clocks.dtsi is oddly included in the middle of a bus node and is only included in one place, so collapse it into ns2.dtsi. Move the fixed and fixed-factor clock nodes to the root as they are not part of the bus. Rename the node names to use preferred names. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-10-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit b871ac873a82f0ca2b273e454e5e775f562ca021 Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:48 2026 -0600 arm64: dts: broadcom: ns2-svk: Use non-deprecated at25 properties The at25,* properties have been deprecated since 2012. This board wasn't upstream until 2014, so it should be safe to switch over to the "new" properties. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-9-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit fcaa61afdfcf3a5ee9a684ac8310b40b13c670b0 Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:47 2026 -0600 arm64: dts: broadcom: Use preferred node names Update various node names to use the documented preferred names. Node names/path aren't considered ABI, so changing them should be safe. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-8-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit 8a4cac07eaf243a33e1256671a1864cdd994138f Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:46 2026 -0600 arm64: dts: broadcom: stingray: Move raid nodes out of bus The 'raid' nodes are not MMIO devices and are not part of a bus, so move them to the root level. Drop the unit-addresses as they don't have any address. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-7-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit 71220e15f38823dcc21b7297fc9161fd42d08d96 Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:45 2026 -0600 arm64: dts: broadcom: stingray: Fix 'simple-bus' node names Fix 'simple-bus' node names to follow the defined pattern. Nodes with 'reg' or 'ranges' addresses should also have a unit-address. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-6-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit dd19c37519aa82d615fee53b7f68adc726ab4ae6 Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:44 2026 -0600 arm64: dts: broadcom: stingray: Rework clock nodes The stringray-clocks.dtsi is oddly included in the middle of a bus node and is only included in one place, so collapse it into stingray.dtsi. Move the fixed and fixed-factor clock nodes to the root as they are not part of the bus. Rename the node names to use preferred names. Drop the unnecessary 1:1 fixed-factor clock providers. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-5-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit ea2b1a4f192d8e3a435a03d8e8ae21cf9ab7e112 Author: Rob Herring (Arm) Date: Tue Jan 6 20:09:43 2026 -0600 arm64: dts: broadcom: Remove unused and undocumented nodes The "silabs,si3226x" and "brcm,bdc-v0.16" nodes have no documentation and no driver in the kernel, so remove them. They can be added back with proper documentation if there is a need for them. Note that if both USB ports have similar memory maps in relationship to their USB PHY nodes, it looks like the device controller should have been at 0x12000, not 0x21000? Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-4-ba45874e4553@kernel.org Signed-off-by: Florian Fainelli commit db7855c96d4216b2ed45e2781fae9293b323c7ef Author: H. Peter Anvin Date: Fri Jan 16 12:40:56 2026 -0800 x86/entry/vdso/selftest: Update location of vgetrandom-chacha.S As part of the vdso build restructuring, vgetrandom-chacha.S moved into the vdso/vdso64 subdirectory. Update the selftest #include to match. Closes: https://lore.kernel.org/oe-lkp/202601161608.5cd5af9a-lkp@intel.com Fixes: 693c819fedcd ("x86/entry/vdso: Refactor the vdso build") Reported-by: kernel test robot Signed-off-by: H. Peter Anvin (Intel) Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20260116204057.386268-4-hpa@zytor.com commit a48acbaf99d239e60a09a9e2b7d0f7e9feb62769 Author: H. Peter Anvin Date: Fri Jan 16 12:40:55 2026 -0800 x86/entry/vdso: Fix filtering of vdso compiler flags This fixes several typos in the filtering of compiler flags for vdso, discovered by Chris Mason using an AI script: 1. "-fno-PIE" was written as "fno-PIE". 2. "CC_PLUGINS_FLAGS" was written as "CC_PLUGIN_FLAGS" To the best of my knowledge, none of these actually had any real impact on the build at this time but they are genuine bugs which could break things at any point in the future. Chris's script also found that "CONFIG_X86_USER_SHADOW_STACK" was missing "CONFIG_", but it needs a different fix. [ dhansen: remove CONFIG_X86_USER_SHADOW_STACK munging, add mention in changelog. ] Closes: https://lore.kernel.org/20260116035807.2307742-1-clm@meta.com Fixes: 693c819fedcd ("x86/entry/vdso: Refactor the vdso build") Reported-by: Chris Mason Signed-off-by: H. Peter Anvin (Intel) Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20260116204057.386268-3-hpa@zytor.com commit d8300e6e078a3a44ac0c75c6d8ba46d78ab94035 Author: Brian Masney Date: Thu Jan 8 16:16:34 2026 -0500 clk: qcom: regmap-divider: convert from divider_round_rate() to divider_determine_rate() The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: b6f90511c165 ("clk: qcom: regmap-divider: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260108-clk-divider-round-rate-v1-16-535a3ed73bf3@redhat.com Signed-off-by: Bjorn Andersson commit 349f02c0f5d4ee147c582b89cadd553bd534028a Author: Brian Masney Date: Thu Jan 8 16:16:33 2026 -0500 clk: qcom: regmap-divider: convert from divider_ro_round_rate() to divider_ro_determine_rate() The divider_ro_round_rate() function is now deprecated, so let's migrate to divider_ro_determine_rate() instead so that this deprecated API can be removed. Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to: req->rate = divider_round_rate(...) This is invalid in the case when an error occurs since it can set the rate to a negative value. Fixes: b6f90511c165 ("clk: qcom: regmap-divider: convert from round_rate() to determine_rate()") Signed-off-by: Brian Masney Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260108-clk-divider-round-rate-v1-15-535a3ed73bf3@redhat.com Signed-off-by: Bjorn Andersson commit 954fc7ac15c18fc21c4a423e542f6df5dc727cad Author: Hou Wenlong Date: Thu Jan 15 11:38:34 2026 +0800 x86/mm: Hide mm_free_global_asid() definition under CONFIG_BROADCAST_TLB_FLUSH When CONFIG_BROADCAST_TLB_FLUSH is not enabled, mm_free_global_asid() remains a globally visible symbol and generates a useless function call to it in destroy_context(). Therefore, hide the mm_free_global_asid() definition under CONFIG_BROADCAST_TLB_FLUSH and provide a static inline empty version when it is not enabled to remove the function call. Signed-off-by: Hou Wenlong Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Rik van Riel Link: https://patch.msgid.link/b262a8ec8076fb26bb692aaf113848b1e6f40e40.1768448079.git.houwenlong.hwl@antgroup.com commit b3683f3ba079940f91f4a26004250559f170eda9 Author: H. Peter Anvin Date: Fri Jan 16 12:40:54 2026 -0800 x86/entry/vdso: Update the object paths for "make vdso_install" The location of the vdso binary files in the object tree has changed; update "make vdso_install" to match. Closes: https://lore.kernel.org/16ea64d1-2a9b-46f9-9fcc-42958f599eb6@leemhuis.info Fixes: 693c819fedcd ("x86/entry/vdso: Refactor the vdso build") Reported-by: Thorsten Leemhuis Signed-off-by: H. Peter Anvin (Intel) Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20260116204057.386268-2-hpa@zytor.com commit 3ec6cefc398b93e5f28500f80e7321a80fffee8a Author: Ricardo B. Marlière Date: Fri Jan 16 11:20:54 2026 -0300 selftests/run_kselftest.sh: Add `--skip` argument option Currently the only way of excluding certain tests from a collection is by passing all the other tests explicitly via `--test`. Therefore, if the user wants to skip a single test the resulting command line might be too big, depending on the collection. Add an option `--skip` that takes care of that. Link: https://lore.kernel.org/r/20260116-selftests-add_skip_opt-v1-1-ab54afaae81b@suse.com Signed-off-by: Ricardo B. Marlière Signed-off-by: Shuah Khan commit 7799ba2160e4919913ecabca8a7fc1aa4c576fb4 Author: João Marcos Costa Date: Tue Jan 13 14:27:53 2026 +0100 cpupower: make systemd unit installation optional cpupower currently installs a cpupower.service unit file into unitdir unconditionally, regardless of whether systemd is used by the host. Improve the installation procedure by making this systemd step optional: a 'SYSTEMD' build parameter that defaults to 'true' and can be set to 'false' to disable the installation of systemd's unit file. Since 'SYSTEMD' defaults to true, the current behavior is kept as the default. Link: https://lore.kernel.org/r/20260113132753.1730020-2-joaomarcos.costa@bootlin.com Signed-off-by: João Marcos Costa Signed-off-by: Shuah Khan commit a35df4c1182eec27f13922e963b8df0b88594fe2 Author: Shrikant Raskar Date: Thu Jan 15 13:57:37 2026 +0530 iio: proximity: rfd77402: Reorder header includes Reorder header includes to follow kernel include ordering conventions. Signed-off-by: Shrikant Raskar Signed-off-by: Jonathan Cameron commit f9c08bc13eb267a1b0dd557212f654f46f5e6989 Merge: 065b273098db37 e8e46378825b05 Author: Marc Kleine-Budde Date: Fri Jan 16 20:51:25 2026 +0100 Merge patch series "Add CANFD support to R9A09G056/057/077/087 SoCs" Prabhakar says: From: Lad Prabhakar This patch series adds CANFD support to RZ/V2H(P), RZ/V2N, RZ/T2H and RZ/N2H SoCs. The CANFD controller on RZ/V2H(P) and RZ/V2N SoCs is similar to the one on RZ/G3E SoC, while the CANFD controller on RZ/T2H and RZ/N2H SoCs is similar to R-Car Gen 4 SoCs but with some differences in terms of number of channels and AFLPN and CFTML bits. The patch series includes: - Specifying reset-names for RZ/G2L and RZ/G3E CANFD controllers. - Documenting the CANFD controller on RZ/V2H(P) and RZ/V2N SoCs. - Documenting the CANFD controller on RZ/T2H and RZ/N2H SoCs. - Adding RZ/T2H SoC support in the rcar_canfd driver.c file. Note this patch series applies on top of: https://lore.kernel.org/all/20251126155911.320563-1-biju.das.jz@bp.renesas.com/ v3->v4: - Added Reviewed-by tag for patch 1/4. - No changes made for patches 2/4 and 4/4. - For patch 3/4: * Dropped Reviewed-by from Geert due to below changes. * Moved single compatible entries into an enum and to below oneOf. * Synced the resets/reset-names handling with other similar SoCs. v2->v3: - Updated commit message to clarify that reset-names existed previously but was dropped for patch 1/4. - Grouped single compatible entries into an enum in patch 3/4. - Updated commit message about disallowing reset-names property for patch 3/4. - Added Acked-by and Reviewed-by tags. v1->v2: - Moved reset-names to top-level properties. Link: https://patch.msgid.link/20260114154525.3169992-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit e8e46378825b058feefff799537e797fae321858 Author: Lad Prabhakar Date: Wed Jan 14 15:45:25 2026 +0000 can: rcar_canfd: Add RZ/T2H support The CAN-FD IP on the RZ/T2H SoC is similar to R-Car Gen4, but differs in the AFLPN and CFTML bits and supports two channels with eight interrupts. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260114154525.3169992-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 1e3710b1fe915e24ff78f6b7a838eb9557c5baca Author: Lad Prabhakar Date: Wed Jan 14 15:45:24 2026 +0000 dt-bindings: can: renesas,rcar-canfd: Document RZ/T2H and RZ/N2H SoCs Document the CAN-FD controller used on the RZ/T2H and RZ/N2H SoCs. The CAN-FD IP is largely compatible with the R-Car Gen4 block, but differs in that AFLPN and CFTML are different, there is no reset line for the IP, and it only supports two channels. Sync the resets and reset-names schema handling with other CAN-FD SoCs so DT validation stays consistent and maintainable. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260114154525.3169992-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit c74ab6275c34315b3987750760c900136b1009fe Author: Lad Prabhakar Date: Wed Jan 14 15:45:23 2026 +0000 dt-bindings: can: renesas,rcar-canfd: Document RZ/V2H(P) and RZ/V2N SoCs Document CANFD IP found on the Renesas RZ/V2H(P) (R9A09G057) and RZ/V2N (R9A09G056) SoCs. The CANFD IP on these SoCs are identical to that found on the RZ/G3E (R9A09G047) SoC. Signed-off-by: Lad Prabhakar Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260114154525.3169992-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit af6b427c7ad096724da7399b180dc3bb9f033322 Author: Lad Prabhakar Date: Wed Jan 14 15:45:22 2026 +0000 dt-bindings: can: renesas,rcar-canfd: Specify reset-names Specify the expected reset-names for the Renesas CAN-FD controller on RZ/G2L and RZ/G3E SoCs. The reset names rstp_n and rstc_n are defined in the SoC hardware manual and are already used by the driver since commit 76e9353a80e9 ("can: rcar_canfd: Add support for RZ/G2L family"). The reset-names property existed previously but was dropped by commit 466c8ef7b66b ("dt-bindings: can: renesas,rcar-canfd: Simplify the conditional schema"). Restore and constrain reset-names in the binding so DT schema checks match the actual hardware requirements and driver expectations. Signed-off-by: Lad Prabhakar Reviewed-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260114154525.3169992-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 065b273098db37e15aaea4962f3fab74c8ee17de Merge: 74ecff77dace0f 9a2b56a48c219d Author: Marc Kleine-Budde Date: Fri Jan 16 20:50:25 2026 +0100 Merge patch series "Add FD-Only mode support for R-Car CANFD" Biju says: From: Biju Das The RZ/{G2L,G3E} and R-Car Gen4 SoCs support additional CAN FD mode called FD-only mode. In this mode, communication in Classical CAN frame format is disabled. Update binding/driver to support this mode. v3->v4: * Dropped the node added in example for just testing. * Dropped the dependencies from covering letter. v2->v3: * Added check to disallow the usage of both fd-only and no-can-fd. v1->v2: * Added conditional check to disallow fd-only mode for R-Car Gen3 in bindings. * Dropped has_fd_only_mode variable from the struct rcar_canfd_hw_info as it is checked by the dt schema validation. Logs: root@smarc-rzg3e:~# /cip-test-scripts/canfd_validation.sh FD-ONLY [ 13.914196] rcar_canfd 12440000.can: global operational state (canfd clk, fd-only mode) FD-ONLY [INFO] Testing can0<->can1 with bitrate 1000000 and dbitrate 4000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer FD-ONLY [INFO] Testing can0<->can1 with bitrate 500000 and dbitrate 2000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer FD-ONLY [INFO] Testing can0<->can1 with bitrate 250000 and dbitrate 1000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer EXIT|PASS|canfd_validation.sh|[00:00:19] || root@smarc-rzg3e:~# /cip-test-scripts/canfd_validation.sh CANFD [ 13.914196] rcar_canfd 12440000.can: global operational state (canfd clk, fd-only mode) CANFD [INFO] Testing can0<->can1 with bitrate 1000000 and dbitrate 4000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [ 37.246104] can: controller area network core [ 37.250607] NET: Registered PF_CAN protocol family [ 37.291606] can: raw protocol EXIT|FAIL|canfd_validation.sh|[00:00:04] Problems while producing data from can1 and consuming from can0|| root@smarc-rzg3e:~# /cip-test-scripts/canfd_validation.sh CAN [ 13.914196] rcar_canfd 12440000.can: global operational state (canfd clk, fd-only mode) CAN [INFO] Testing can0<->can1 with bitrate 1000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer EXIT|FAIL|canfd_validation.sh|[00:00:03] Problems sending data from can1 to can0|| Link: https://patch.msgid.link/20251126155911.320563-1-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 9a2b56a48c219d189366dd9bf4c2b42afde2f361 Author: Biju Das Date: Wed Nov 26 15:59:07 2025 +0000 can: rcar_canfd: Add support for FD-Only mode The RZ/{G2L,G3E} and R-Car Gen4 SoCs support additional CAN FD mode called FD-only mode. In this mode, communication in Classical CAN frame format is disabled. Signed-off-by: Biju Das Link: https://patch.msgid.link/20251126155911.320563-3-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 1766de15a571662fcd9c0a870de3a06890142a1e Author: Biju Das Date: Wed Nov 26 15:59:06 2025 +0000 dt-bindings: can: renesas,rcar-canfd: Document renesas,fd-only property The CANFD on RZ/{G2L,G3E} and R-Car Gen4 support 3 modes FD-Only mode, Classical CAN mode and CAN-FD mode. In FD-Only mode, communication in Classical CAN frame format is disabled. Document renesas,fd-only to handle this mode. As these SoCs support 3 modes, update the description of renesas,no-can-fd property and disallow it for R-Car Gen3. Signed-off-by: Biju Das Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126155911.320563-2-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 188c33824098ced363676b4e63f062b7a747ed81 Author: Geert Uytterhoeven Date: Thu Jan 15 15:24:16 2026 +0100 iio: imu: smi330: Convert to common field_{get,prep}() helpers Drop the driver-specific smi330_field_get() and smi330_field_prep() macros, in favor of the globally available variants from . Signed-off-by: Geert Uytterhoeven Signed-off-by: Jonathan Cameron commit f65de31fb6aba70133a0cb57bba6f84b5fb4d695 Author: Francesco Lavra Date: Thu Jan 15 18:53:50 2026 +0100 iio: accel: adxl380: Add support for 1 kHz sampling frequency In sensor variants (such as ADXL380 and ADXL382) that support low-power mode, the SAR signal path allows sampling acceleration data at lower rates; more specifically, when the sensor operates in VLP mode, the sampling frequency is 1 kHz. To add support for the 1kHz sampling frequency value, modify the operating mode selection logic to take into account the sampling frequency, and configure the decimation filters only when applicable (i.e. when using a sampling frequency that relies on the DSM signal path); in addition, constrain the available sampling frequency values based on whether the sensor is operating in low-power mode. Signed-off-by: Francesco Lavra Signed-off-by: Jonathan Cameron commit fabae7558722dcf41a9137f6f0f82462867d7c96 Author: Francesco Lavra Date: Thu Jan 15 18:53:49 2026 +0100 iio: accel: adxl380: Introduce helper function for activity detection Motion detection functionalities (such as activity and inactivity detection) are only available when the chip is in a low-power mode; this affects the available sampling frequency values. In preparation for adding support for a new frequency value, introduce a helper function that checks whether activity/inactivity detection is currently enabled; this function will be reused in a future commit to determine what frequency values are available at any given time. No functional changes. Signed-off-by: Francesco Lavra Signed-off-by: Jonathan Cameron commit a99b000f92413f254a6dc0f6ab88b310152f9485 Author: Francesco Lavra Date: Thu Jan 15 18:53:48 2026 +0100 iio: accel: adxl380: Store sampling frequency index in odr struct member The ADXL380 driver assumes that acceleration samples are always retrieved via the high-performance DSM signal path; as a result, the sampling frequency value depends exclusively on the decimation filter settings in the TRIG_CFG register. In preparation for adding support for sampling frequency values that rely on the low-power SAR signal path (on which the decimation filters are not supported), use the (currently unused) 'odr' member of struct adxl380_state to store the sampling frequency value, and when userspace requests the current frequency value, retrieve it from the struct instead of calculating it from the decimation filter settings. Signed-off-by: Francesco Lavra Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron commit 58e69e8f9c9a4df948dfc554c26b8f4adf505636 Author: Jingyi Wang Date: Tue Oct 21 23:32:30 2025 -0700 dt-bindings: mailbox: qcom: Add CPUCP mailbox controller bindings for Kaanapali Document CPUSS Control Processor (CPUCP) mailbox controller for Qualcomm Kaanapali, which is compatible with X1E80100, use fallback to indicate this. Signed-off-by: Jingyi Wang Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251021-knp-cpufreq-v2-1-95391d66c84e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 61f5ec54c8a64c8b2d035215294389dd021318c7 Author: Danilo Krummrich Date: Thu Jan 15 23:03:31 2026 +0100 MAINTAINERS: driver-core: add driver-model documentation Documentation/driver-api/driver-model/ is missing in the driver-core MAINTAINERS entry, hence add it. Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260115220350.6806-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 75e8635832a2e45d2a910c247eddd6b65d5ce6e1 Author: Rafael J. Wysocki Date: Thu Jan 8 16:17:17 2026 +0100 drm: Discard pm_runtime_put() return value Multiple DRM drivers use the pm_runtime_put() return value for printing debug or even error messages and all of those messages are at least somewhat misleading. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. It also happens when the kernel has been configured with CONFIG_PM unset. For this reason, modify all of those drivers to simply discard the pm_runtime_put() return value which is what they should be doing. This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki Acked-by: Dave Stevenson Acked-by: Liviu Dudau Link: https://patch.msgid.link/2256082.irdbgypaU6@rafael.j.wysocki commit e9df6eba060c6db2f7f3fd8666d1af0a369d6f7b Author: Rafael J. Wysocki Date: Thu Jan 8 16:05:37 2026 +0100 genirq/chip: Change irq_chip_pm_put() return type to void The irq_chip_pm_put() return value is only used in __irq_do_set_handler() to trigger a WARN_ON() if it is negative, but doing so is not useful because irq_chip_pm_put() simply passes the pm_runtime_put() return value to its callers. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. For this reason, modify irq_chip_pm_put() to discard the pm_runtime_put() return value, change its return type to void, and drop the WARN_ON() around the irq_chip_pm_put() invocation from __irq_do_set_handler(). Also update the irq_chip_pm_put() kerneldoc comment to be more accurate. This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/5075294.31r3eYUQgx@rafael.j.wysocki commit 54786d9806b2720659b4fc64af0ebde148780229 Author: Manivannan Sadhasivam Date: Thu Jan 15 12:59:06 2026 +0530 PCI: Drop the assert_perst() callback Now since all .assert_callback() implementations have been removed from the controller drivers, drop the .assert_callback callback from pci.h. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-14-9d26da3ce903@oss.qualcomm.com commit 58614046254f5a82a23a02b6e8893282cca6a8fe Author: Manivannan Sadhasivam Date: Thu Jan 15 12:59:05 2026 +0530 PCI: qcom: Drop the assert_perst() callbacks Previously, the pcie-qcom driver probed first, deasserted PERST#, enabled link training and scanned the bus. By the time the pwrctrl driver probe got called, link training was already enabled by the controller driver. Thus the pwrctrl drivers had to call the .assert_perst() callback, to assert PERST#, power on the needed resources, and then call the .assert_perst() callback to deassert PERST#. Now since all pwrctrl drivers and this controller driver have been converted to the new pwrctrl design where the pwrctrl drivers will first power on the devices before this driver deasserts PERST# and scan the bus. So there is no longer a need for .assert_perst() callback in this driver and in DWC core driver. Hence, drop them. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-13-9d26da3ce903@oss.qualcomm.com commit b921aa3f8decae440009134d65399ee9b2425300 Author: Manivannan Sadhasivam Date: Thu Jan 15 12:59:04 2026 +0530 PCI/pwrctrl: Switch to pwrctrl create, power on/off, destroy APIs Adopt pwrctrl APIs to create, power on/off, and destroy pwrctrl devices. In qcom_pcie_host_init(), call pci_pwrctrl_create_devices() to create devices, then pci_pwrctrl_power_on_devices() to power them on, both after controller resource initialization. Once successful, deassert PERST# for all devices. In qcom_pcie_host_deinit(), call pci_pwrctrl_power_off_devices() after asserting PERST#. Note that pci_pwrctrl_destroy_devices() is not called here, as deinit is only invoked during system suspend where device destruction is unnecessary. If the driver becomes removable in future, pci_pwrctrl_destroy_devices() should be called in the remove() handler. Remove the old pwrctrl framework code from the PCI core (including devlinks) as the new APIs are now the sole consumer of pwrctrl functionality. And also do not power on the pwrctrl drivers during probe() as this is now handled by the APIs. Co-developed-by: Krishna Chaitanya Chundru Signed-off-by: Krishna Chaitanya Chundru Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Chen-Yu Tsai Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-12-9d26da3ce903@oss.qualcomm.com commit b35cf3b6aa1eb08909f58c2d1e2f8ef7d000809a Author: Manivannan Sadhasivam Date: Thu Jan 15 12:59:03 2026 +0530 PCI/pwrctrl: Add APIs to power on/off pwrctrl devices To fix bridge resource allocation issues when powering PCI bridges with the pwrctrl driver, introduce APIs to explicitly power on and off all related devices simultaneously. Previously, the individual pwrctrl drivers powered on/off the PCI devices autonomously, without any control from the controller drivers. But to enforce ordering with respect to powering on the devices, these APIs will power on/off all the devices at the same time. The pci_pwrctrl_power_on_devices() API recursively scans the PCI child nodes, makes sure that pwrctrl drivers are bound to devices, and calls their power_on() callbacks. If any pwrctrl driver is not bound, it will return -EPROBE_DEFER. Similarly, pci_pwrctrl_power_off_devices() API powers off devices recursively via their power_off() callbacks. These APIs are expected to be called during the controller probe and suspend/resume time to power on/off the devices. But before calling these APIs, the pwrctrl devices should be created using the pci_pwrctrl_{create/destroy}_devices() APIs. Co-developed-by: Krishna Chaitanya Chundru Signed-off-by: Krishna Chaitanya Chundru Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Chen-Yu Tsai Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-11-9d26da3ce903@oss.qualcomm.com commit 4c413248920106393b35b5e014e6ac525405437e Author: Krishna Chaitanya Chundru Date: Thu Jan 15 12:59:02 2026 +0530 PCI/pwrctrl: Add APIs to create, destroy pwrctrl devices Previously, the PCI core created pwrctrl devices during pci_scan_device() on its own and then skipped enumeration of those devices, hoping the pwrctrl driver would power them on and trigger a bus rescan. This approach works for endpoint devices directly connected to Root Ports, but it fails for PCIe switches acting as bus extenders. When the switch requires pwrctrl support and the pwrctrl driver is not available during the pwrctrl device creation, its enumeration will be skipped during the initial PCI bus scan. This premature scan leads the PCI core to allocate resources (bridge windows, bus numbers) for the upstream bridge based on available downstream buses at scan time. For non-hotplug capable bridges, PCI core typically allocates resources based on the number of buses available during the initial bus scan, which happens to be just one if the switch is not powered on and enumerated at that time. When the switch gets enumerated later on, it will fail due to the lack of upstream resources. As a result, a PCIe switch powered on by the pwrctrl driver cannot be reliably enumerated currently. Either the switch has to be enabled in the bootloader or the switch pwrctrl driver has to be loaded during the pwrctrl device creation time to work around these issues. Introduce new APIs to explicitly create and destroy pwrctrl devices from controller drivers by recursively scanning the PCI child nodes of the controller. These APIs allow creating pwrctrl devices based on the original criteria and are intended to be called during controller probe and removal. These APIs, together with the upcoming APIs for power on/off will allow the controller drivers to power on all the devices before starting the initial bus scan, thereby solving the resource allocation issue. Signed-off-by: Krishna Chaitanya Chundru [mani: splitted the patch, cleaned up the code, and rewrote description] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Chen-Yu Tsai Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-10-9d26da3ce903@oss.qualcomm.com commit 113f44ed50d274447a3b76cf250989a423f179a5 Author: Manivannan Sadhasivam Date: Thu Jan 15 12:59:01 2026 +0530 PCI/pwrctrl: Add 'struct pci_pwrctrl::power_{on/off}' callbacks To allow the pwrctrl core to control the power on/off sequences of the pwrctrl drivers, add the 'struct pci_pwrctrl::power_{on/off}' callbacks and populate them in the respective pwrctrl drivers. The pwrctrl drivers still power on the resources on their own now. So there is no functional change. Co-developed-by: Krishna Chaitanya Chundru Signed-off-by: Krishna Chaitanya Chundru Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Chen-Yu Tsai Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-9-9d26da3ce903@oss.qualcomm.com commit 2045c352812e5a2eec0aa9d2b1e5d2fe1127b919 Author: Manivannan Sadhasivam Date: Fri Jan 16 12:23:04 2026 -0600 PCI/pwrctrl: pwrseq: Factor out power on/off code to helpers In order to allow the pwrctrl core to control the power on/off logic of the pwrctrl pwrseq driver, move the power on/off code to pci_pwrctrl_pwrseq_power_{off/on} helper functions. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-8-9d26da3ce903@oss.qualcomm.com commit 0afc90ced0955d1ad2b65379e6771e4fb19ce769 Author: Manivannan Sadhasivam Date: Fri Jan 16 12:14:55 2026 -0600 PCI/pwrctrl: slot: Factor out power on/off code to helpers In order to allow the pwrctrl core to control the power on/off logic of the pwrctrl slot driver, move the power on/off code to pci_pwrctrl_slot_power_{off/on} helper functions. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-7-9d26da3ce903@oss.qualcomm.com commit 370d2de0fb65ed954c0b6375e36d0fa12c9323be Author: Bjorn Helgaas Date: Thu Jan 15 12:58:58 2026 +0530 PCI/pwrctrl: tc9563: Rename private struct and pointers for consistency Previously the pwrseq, tc9563, and slot pwrctrl drivers used different naming conventions for their private data structs and pointers to them, which makes patches hard to read. Rename struct and variables to be shorter and more specific: struct tc9563_pwrctrl_ctx -> struct tc9563_pwrctrl struct tc9563_pwrctrl_ctx *ctx -> struct tc9563_pwrctrl *tc9563 No functional change intended. Signed-off-by: Bjorn Helgaas Signed-off-by: Manivannan Sadhasivam Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-6-9d26da3ce903@oss.qualcomm.com commit c105a3ed6167b6776076a6d3d046568121d2f14b Author: Bjorn Helgaas Date: Thu Jan 15 12:58:57 2026 +0530 PCI/pwrctrl: tc9563: Add local variables to reduce repetition Add local struct device * and struct device_node * variables to reduce repetitive pointer chasing. No functional changes intended. Signed-off-by: Bjorn Helgaas Signed-off-by: Manivannan Sadhasivam Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-5-9d26da3ce903@oss.qualcomm.com commit dc534bdc388b72de3038f2c104fdbfc5428967ac Author: Bjorn Helgaas Date: Thu Jan 15 12:58:56 2026 +0530 PCI/pwrctrl: tc9563: Clean up whitespace Most of pci-pwrctrl-tc9563.c fits in 80 columns. Wrap lines that are gratuitously longer. Whitespace changes only. Signed-off-by: Bjorn Helgaas Signed-off-by: Manivannan Sadhasivam Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-4-9d26da3ce903@oss.qualcomm.com commit 99ee5837c63d1000f9ce7508591486a7bd8bdedb Author: Manivannan Sadhasivam Date: Thu Jan 15 12:58:55 2026 +0530 PCI/pwrctrl: tc9563: Use put_device() instead of i2c_put_adapter() The API comment for of_find_i2c_adapter_by_node() recommends using put_device() to drop the reference count of I2C adapter instead of using i2c_put_adapter(). So replace i2c_put_adapter() with put_device(). Fixes: 4c9c7be47310 ("PCI: pwrctrl: Add power control driver for TC9563") Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-3-9d26da3ce903@oss.qualcomm.com commit e40d16e6c23994b28894179b87f9747edd63062a Author: Bjorn Helgaas Date: Thu Jan 15 12:58:54 2026 +0530 PCI/pwrctrl: slot: Rename private struct and pointers for consistency Previously the pwrseq, tc9563, and slot pwrctrl drivers used different naming conventions for their private data structs and pointers to them, which makes patches hard to read. Rename structs, variables, and functions to reduce boiler-plate and start with "slot": struct pci_pwrctrl_slot_data -> struct slot_pwrctrl struct pci_pwrctrl ctx -> struct pci_pwrctrl pwrctrl pci_pwrctrl_slot_probe() -> slot_pwrctrl_probe() pci_pwrctrl_slot_of_match[] -> slot_pwrctrl_of_match[] pci_pwrctrl_slot_driver -> slot_pwrctrl_driver devm_pci_pwrctrl_slot_power_off() -> devm_slot_pwrctrl_power_off() No functional change intended. [bhelgaas: move "slot" to beginning, also rename functions, etc] Signed-off-by: Bjorn Helgaas Signed-off-by: Manivannan Sadhasivam Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-2-9d26da3ce903@oss.qualcomm.com commit 2ba7c7bd2b0e22cca9a21e243a88bf407e7d0260 Author: Bjorn Helgaas Date: Thu Jan 15 12:58:53 2026 +0530 PCI/pwrctrl: pwrseq: Rename private struct and pointers for consistency Previously the pwrseq, tc9563, and slot pwrctrl drivers used different naming conventions for their private data structs and pointers to them, which makes patches hard to read. Rename structs, variables, and functions to reduce boiler-plate and start with "pwrseq": struct pci_pwrctrl_pwrseq_data -> struct pwrseq_pwrctrl struct pci_pwrctrl ctx -> struct pci_pwrctrl pwrctrl struct pci_pwrctrl_pwrseq_data *data -> struct pwrseq_pwrctrl *pwrseq struct pci_pwrctrl_pwrseq_pdata -> struct pwrseq_pwrctrl_pdata pci_pwrctrl_pwrseq_qcom_wcn_pdata -> pwrseq_pwrctrl_qcom_wcn_pdata pci_pwrctrl_pwrseq_probe() -> pwrseq_pwrctrl_probe() devm_pci_pwrctrl_pwrseq_power_off() -> devm_pwrseq_pwrctrl_power_off() pci_pwrctrl_pwrseq_qcm_wcn_validate_device() -> pwrseq_pwrctrl_qcm_wcn_validate_device() No functional change intended. [bhelgaas: move "pwrseq" to beginning, also rename functions] Signed-off-by: Bjorn Helgaas Signed-off-by: Manivannan Sadhasivam Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260115-pci-pwrctrl-rework-v5-1-9d26da3ce903@oss.qualcomm.com commit dff8af7c5220c691661ca4b3e2348b58d050092c Author: Charan Pedumuru Date: Sun Jan 4 11:23:04 2026 +0000 dt-bindings: mtd: nvidia,tegra20-nand: convert to DT schema Convert NVIDIA Tegra NAND Flash Controller binding to YAML format. Changes during Conversion: - Define new properties `power-domains` and `operating-points-v2` because the existing in tree DTS uses them. - Modify MAINTAINERS references to point the created YAML file. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit 086714bbb96f63785da251e1f8d1ce3e716a6e42 Merge: 8304c44631c370 0f61b1860cc3f5 Author: Danilo Krummrich Date: Fri Jan 16 20:02:30 2026 +0100 Merge tag 'v6.19-rc5' into drm-rust-next We need the drm-rust fixes from -rc5 in here for nova-core to build on top of. Signed-off-by: Danilo Krummrich commit 919f6cd469c605f1de2269d46d04ebf80a1af568 Author: sheetal Date: Mon Sep 29 16:29:27 2025 +0530 dt-bindings: dma: Update ADMA bindings for tegra264 - Update ADMA device tree bindings for tegra264 to support up to 64 interrupt channels by setting 'interrupts' property maxItems to 64. - Also, update the 'allOf' conditional schema to ensure correct maxItems for 'interrupts' based on compatible string, including tegra210 (22) and tegra186 (32) ADMA controllers. Signed-off-by: sheetal Reviewed-by: Rob Herring (Arm) Acked-by: Thierry Reding Signed-off-by: Thierry Reding commit 7db8c3c738118b6d9e5c3eb54e352fdae1bb0faf Author: Thorsten Blum Date: Sat Nov 22 12:54:46 2025 +0100 apparmor: replace sprintf with snprintf in aa_new_learning_profile Replace unbounded sprintf() calls with snprintf() to prevent potential buffer overflows in aa_new_learning_profile(). While the current code works correctly, snprintf() is safer and follows secure coding best practices. No functional changes. Signed-off-by: Thorsten Blum Signed-off-by: John Johansen commit bac5e3d20c45392120c4298c2f66fc4387776b80 Author: Tomas Melin Date: Wed Jan 14 10:45:50 2026 +0000 iio: adc: ad9467: include two's complement in default mode All supported drivers currently implicitly use two's complement mode. Make this clear by declaring two's complement in the default output mode. Calibration mode uses offset binary, so change the output mode only when running the calibration or other test mode. Reviewed-by: Nuno Sá Signed-off-by: Tomas Melin Signed-off-by: Jonathan Cameron commit fce0d0bd9c20fefd180ea9e8362d619182f97a1d Author: Haoxiang Li Date: Thu Jan 15 13:05:42 2026 +0800 clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() If clk_register() fails, call kfree to release "tegra". Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Brian Masney Signed-off-by: Thierry Reding commit f2d46684be2201e54c088728e741b71aa33b2aa5 Author: Randy Dunlap Date: Sun Jan 4 12:45:30 2026 -0800 docs: filesystems: add fs/open.c to api-summary Include fs/open.c in filesystems/api-summary.rst to provide its exported APIs. Suggested-by: Matthew Wilcox Signed-off-by: Randy Dunlap Reviewed-by: Christian Brauner Signed-off-by: Jonathan Corbet Message-ID: <20260104204530.518206-1-rdunlap@infradead.org> commit d9d25684e98d45322a9b7ff44beb4275ffdf1d74 Author: Marc Herbert Date: Wed Jan 7 20:21:32 2026 +0000 docs: make kptr_restrict and hash_pointers reference each other vsprintf.c uses a mix of the `kernel.kptr_restrict` sysctl and the `hash_pointers` boot param to control pointer hashing. But that wasn't possible to tell without looking at the source code. They have a different focus and purpose. To avoid wasting the time of users trying to use one instead of the other, simply have them reference each other in the Documentation. Signed-off-by: Marc Herbert Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20260107-doc-hash-ptr-v2-1-cb4c161218d7@linux.intel.com> commit 1bce1a664ac25d37a327c433a01bc347f0a81bd6 Merge: 51a146e0595c63 b8f7622aa6e32d Author: Christian Brauner Date: Mon Jan 12 13:51:32 2026 +0100 Merge patch series "mount: add OPEN_TREE_NAMESPACE" Christian Brauner says: When creating containers the setup usually involves using CLONE_NEWNS via clone3() or unshare(). This copies the caller's complete mount namespace. The runtime will also assemble a new rootfs and then use pivot_root() to switch the old mount tree with the new rootfs. Afterward it will recursively umount the old mount tree thereby getting rid of all mounts. On a basic system here where the mount table isn't particularly large this still copies about 30 mounts. Copying all of these mounts only to get rid of them later is pretty wasteful. This is exacerbated if intermediary mount namespaces are used that only exist for a very short amount of time and are immediately destroyed again causing a ton of mounts to be copied and destroyed needlessly. With a large mount table and a system where thousands or ten-thousands of namespaces are spawned in parallel this quickly becomes a bottleneck increasing contention on the semaphore. Extend open_tree() with a new OPEN_TREE_NAMESPACE flag. Similar to OPEN_TREE_CLONE only the indicated mount tree is copied. Instead of returning a file descriptor referring to that mount tree OPEN_TREE_NAMESPACE will cause open_tree() to return a file descriptor to a new mount namespace. In that new mount namespace the copied mount tree has been mounted on top of a copy of the real rootfs. The caller can setns() into that mount namespace and perform any additionally setup such as move_mount()ing detached mounts in there. This allows OPEN_TREE_NAMESPACE to function as a combined unshare(CLONE_NEWNS) and pivot_root(). A caller may for example choose to create an extremely minimal rootfs: fd_mntns = open_tree(-EBADF, "/var/lib/containers/wootwoot", OPEN_TREE_NAMESPACE); This will create a mount namespace where "wootwoot" has become the rootfs mounted on top of the real rootfs. The caller can now setns() into this new mount namespace and assemble additional mounts. This also works with user namespaces: unshare(CLONE_NEWUSER); fd_mntns = open_tree(-EBADF, "/var/lib/containers/wootwoot", OPEN_TREE_NAMESPACE); which creates a new mount namespace owned by the earlier created user namespace with "wootwoot" as the rootfs mounted on top of the real rootfs. This will scale a lot better when creating tons of mount namespaces and will allow to get rid of a lot of unnecessary mount and umount cycles. It also allows to create mount namespaces without needing to spawn throwaway helper processes. * patches from https://patch.msgid.link/20251229-work-empty-namespace-v1-0-bfb24c7b061f@kernel.org: selftests/open_tree: add OPEN_TREE_NAMESPACE tests mount: add OPEN_TREE_NAMESPACE Link: https://patch.msgid.link/20251229-work-empty-namespace-v1-0-bfb24c7b061f@kernel.org Signed-off-by: Christian Brauner commit b8f7622aa6e32d6fd750697b99d8ce19ad8e66d0 Author: Christian Brauner Date: Mon Dec 29 14:03:25 2025 +0100 selftests/open_tree: add OPEN_TREE_NAMESPACE tests Add tests for OPEN_TREE_NAMESPACE. Link: https://patch.msgid.link/20251229-work-empty-namespace-v1-2-bfb24c7b061f@kernel.org Tested-by: Jeff Layton Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit 9b8a0ba68246a61d903ce62c35c303b1501df28b Author: Christian Brauner Date: Mon Dec 29 14:03:24 2025 +0100 mount: add OPEN_TREE_NAMESPACE When creating containers the setup usually involves using CLONE_NEWNS via clone3() or unshare(). This copies the caller's complete mount namespace. The runtime will also assemble a new rootfs and then use pivot_root() to switch the old mount tree with the new rootfs. Afterward it will recursively umount the old mount tree thereby getting rid of all mounts. On a basic system here where the mount table isn't particularly large this still copies about 30 mounts. Copying all of these mounts only to get rid of them later is pretty wasteful. This is exacerbated if intermediary mount namespaces are used that only exist for a very short amount of time and are immediately destroyed again causing a ton of mounts to be copied and destroyed needlessly. With a large mount table and a system where thousands or ten-thousands of containers are spawned in parallel this quickly becomes a bottleneck increasing contention on the semaphore. Extend open_tree() with a new OPEN_TREE_NAMESPACE flag. Similar to OPEN_TREE_CLONE only the indicated mount tree is copied. Instead of returning a file descriptor referring to that mount tree OPEN_TREE_NAMESPACE will cause open_tree() to return a file descriptor to a new mount namespace. In that new mount namespace the copied mount tree has been mounted on top of a copy of the real rootfs. The caller can setns() into that mount namespace and perform any additionally required setup such as move_mount() detached mounts in there. This allows OPEN_TREE_NAMESPACE to function as a combined unshare(CLONE_NEWNS) and pivot_root(). A caller may for example choose to create an extremely minimal rootfs: fd_mntns = open_tree(-EBADF, "/var/lib/containers/wootwoot", OPEN_TREE_NAMESPACE); This will create a mount namespace where "wootwoot" has become the rootfs mounted on top of the real rootfs. The caller can now setns() into this new mount namespace and assemble additional mounts. This also works with user namespaces: unshare(CLONE_NEWUSER); fd_mntns = open_tree(-EBADF, "/var/lib/containers/wootwoot", OPEN_TREE_NAMESPACE); which creates a new mount namespace owned by the earlier created user namespace with "wootwoot" as the rootfs mounted on top of the real rootfs. Link: https://patch.msgid.link/20251229-work-empty-namespace-v1-1-bfb24c7b061f@kernel.org Tested-by: Jeff Layton Reviewed-by: Aleksa Sarai Reviewed-by: Jeff Layton Suggested-by: Christian Brauner Suggested-by: Aleksa Sarai Signed-off-by: Christian Brauner commit 653793b8a3e502fe379daef5995d5a052fb1b04f Author: Petr Vorel Date: Tue Jan 13 12:36:10 2026 +0100 Documentation: CSS: Improve man page font Define man page font as monospace and bold, i.e. the same as what is used for .code and 
.
    
    Signed-off-by: Petr Vorel 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260113113612.315748-4-pvorel@suse.cz>

commit 9088a767e745ca6bc72cba565090f678c5934650
Author: Petr Vorel 
Date:   Tue Jan 13 12:36:09 2026 +0100

    Documentation: Link man pages to https://man7.org/
    
    Configure manpages_url to link man pages to https://man7.org/.
    https://www.sphinx-doc.org/en/master/usage/configuration.html#confval-manpages_url
    
    Acked-by: Alejandro Colomar 
    Signed-off-by: Petr Vorel 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260113113612.315748-3-pvorel@suse.cz>

commit e5b1c0fa4ff21185b29fd4202407bbde37478c91
Author: Petr Vorel 
Date:   Tue Jan 13 12:36:08 2026 +0100

    Documentation: Remove :manpage: from non-existing man pages
    
    Removing :manpage: from non-existing man pages (xyzzy(2), xyzzyat(2),
    fxyzzy(3) in adding-syscalls.rst, including translations) prevent
    adding link to nonexisting man pages when using manpages_url in next
    commit.
    
    While at it, add also missing '(2)' in sp_SP translation.
    
    Reviewed-by: Alejandro Colomar 
    Signed-off-by: Petr Vorel 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260113113612.315748-2-pvorel@suse.cz>

commit 07265c326b40be866826d759d2aec40cfcb59ac4
Author: Danilo Krummrich 
Date:   Thu Jan 15 22:56:57 2026 +0100

    driver-core: improve driver binding documentation
    
    The driver binding documentation (still) mentions that "When a driver is
    attached to a device, the device is inserted into the driver's list of
    devices.".
    
    While it is true that the driver-core keeps track of all the devices
    that are attached to a driver, this is purely for internal purposes
    (i.e. it is an implementation detail) and has no relevance for user
    facing documentation.
    
    In fact, it is even misleading, since it could be read as if it were
    valid for driver implementations to keep track of all the devices bound
    to it.
    
    Instead, drivers operate on a per-device basis, with a separate
    per-device instance created when the driver is bound to a device.
    
    Hence, remove the mention of a driver's list of devices and instead add
    some documentation of the relationship between drivers and devices.
    
    Signed-off-by: Danilo Krummrich 
    Reviewed-by: Greg Kroah-Hartman 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260115215718.6405-1-dakr@kernel.org>

commit 8913632998fcda1793d04fd4ae2327b4bee9b106
Author: Nauman Sabir 
Date:   Fri Jan 16 00:01:10 2026 +0100

    Documentation: Fix typos and grammatical errors
    
    Fix various typos and grammatical errors across documentation files:
    
    - Fix missing preposition 'in' in process/changes.rst
    - Correct 'result by' to 'result from' in admin-guide/README.rst
    - Fix 'before hand' to 'beforehand' in cgroup-v1/hugetlb.rst
    - Correct 'allows to limit' to 'allows limiting' in hugetlb.rst,
      cgroup-v2.rst, and kconfig-language.rst
    - Fix 'needs precisely know' to 'needs to precisely know'
    - Correct 'overcommited' to 'overcommitted' in hugetlb.rst
    - Fix subject-verb agreement: 'never causes' to 'never cause'
    - Fix 'there is enough' to 'there are enough' in hugetlb.rst
    - Fix 'metadatas' to 'metadata' in filesystems/erofs.rst
    - Fix 'hardwares' to 'hardware' in scsi/ChangeLog.sym53c8xx
    
    Signed-off-by: Nauman Sabir 
    Acked-by: Tejun Heo 
    Message-ID: <20260115230110.7734-1-officialnaumansabir@gmail.com>
    Signed-off-by: Jonathan Corbet 

commit 2acbd053c8463c005a0671b2d14a78f38be77c5c
Merge: 934d9746ed0206 086c99fbe45070
Author: Alexei Starovoitov 
Date:   Fri Jan 16 10:08:59 2026 -0800

    Merge branch 'bpf-fix-linked-register-tracking'
    
    Puranjay Mohan says:
    
    ====================
    bpf: Fix linked register tracking
    
    This patch fixes the linked register tracking when multiple links from
    the same register are created with a sync between the creation of these
    links. The sync corrupts the id of the register and therefore the second
    link is not created properly. See the patch description to understand
    more.
    
    The fix is to preserve the id while doing the sync similar to the off.
    ====================
    
    Link: https://patch.msgid.link/20260115151143.1344724-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 086c99fbe45070d02851427eab5ae26fe7d0f3c0
Author: Puranjay Mohan 
Date:   Thu Jan 15 07:11:41 2026 -0800

    selftests: bpf: Add test for multiple syncs from linked register
    
    Before the last commit, sync_linked_regs() corrupted the register whose
    bounds are being updated by copying known_reg's id to it. The ids are
    the same in value but known_reg has the BPF_ADD_CONST flag which is
    wrongly copied to reg.
    
    This later causes issues when creating new links to this reg.
    assign_scalar_id_before_mov() sees this BPF_ADD_CONST and gives a new id
    to this register and breaks the old links. This is exposed by the added
    selftest.
    
    Signed-off-by: Puranjay Mohan 
    Tested-by: Eduard Zingerman 
    Link: https://lore.kernel.org/r/20260115151143.1344724-3-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit af9e89d8dd39530c8bd14c33ddf6b502df1071b6
Author: Puranjay Mohan 
Date:   Thu Jan 15 07:11:40 2026 -0800

    bpf: Preserve id of register in sync_linked_regs()
    
    sync_linked_regs() copies the id of known_reg to reg when propagating
    bounds of known_reg to reg using the off of known_reg, but when
    known_reg was linked to reg like:
    
    known_reg = reg         ; both known_reg and reg get same id
    known_reg += 4          ; known_reg gets off = 4, and its id gets BPF_ADD_CONST
    
    now when a call to sync_linked_regs() happens, let's say with the following:
    
    if known_reg >= 10 goto pc+2
    
    known_reg's new bounds are propagated to reg but now reg gets
    BPF_ADD_CONST from the copy.
    
    This means if another link to reg is created like:
    
    another_reg = reg       ; another_reg should get the id of reg but
                              assign_scalar_id_before_mov() sees
                              BPF_ADD_CONST on reg and assigns a new id to it.
    
    As reg has a new id now, known_reg's link to reg is broken. If we find
    new bounds for known_reg, they will not be propagated to reg.
    
    This can be seen in the selftest added in the next commit:
    
    0: (85) call bpf_get_prandom_u32#7    ; R0=scalar()
    1: (57) r0 &= 255                     ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
    2: (bf) r1 = r0                       ; R0=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R1=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
    3: (07) r1 += 4                       ; R1=scalar(id=1+4,smin=umin=smin32=umin32=4,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))
    4: (a5) if r1 < 0xa goto pc+4         ; R1=scalar(id=1+4,smin=umin=smin32=umin32=10,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))
    5: (bf) r2 = r0                       ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255) R2=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255)
    6: (a5) if r1 < 0xe goto pc+2         ; R1=scalar(id=1+4,smin=umin=smin32=umin32=14,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))
    7: (35) if r0 >= 0xa goto pc+1        ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=9,var_off=(0x0; 0xf))
    8: (37) r0 /= 0
    div by zero
    
    When 4 is verified, r1's bounds are propagated to r0 but r0 also gets
    BPF_ADD_CONST (bug).
    When 5 is verified, r0 gets a new id (2) and its link with r1 is broken.
    
    After 6 we know r1 has bounds [14, 259] and therefore r0 should have
    bounds [10, 255], therefore the branch at 7 is always taken. But because
    r0's id was changed to 2, r1's new bounds are not propagated to r0.
    The verifier still thinks r0 has bounds [6, 255] before 7 and execution
    can reach div by zero.
    
    Fix this by preserving id in sync_linked_regs() like off and subreg_def.
    
    Fixes: 98d7ca374ba4 ("bpf: Track delta between "linked" registers.")
    Signed-off-by: Puranjay Mohan 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/r/20260115151143.1344724-2-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 0787a93baa1aab9fd0cb8500105d11d3d3a58f7a
Author: Al Viro 
Date:   Sun Dec 14 03:32:45 2025 -0500

    sysfs(2): fs_index() argument is _not_ a pathname
    
    ... it's a filesystem type name.
    
    Signed-off-by: Al Viro 

commit 9b323d2f474071cc6c627f73af301ba6f5e2b83f
Author: Al Viro 
Date:   Sun Dec 14 03:26:56 2025 -0500

    alpha: switch osf_mount() to strndup_user()
    
    ... same as native mount(2) is doing for devname argument.  While we
    are at it, fix misspelling ufs_args as cdfs_args in osf_ufs_mount() -
    layouts are identical, so it doesn't change anything, but the current
    variant is confusing for no reason.
    
    Signed-off-by: Al Viro 

commit 39537a335a61894bbfd3dbb413f0c52bdf03772e
Author: Al Viro 
Date:   Sun Dec 14 03:21:15 2025 -0500

    ksmbd: use CLASS(filename_kernel)
    
    Signed-off-by: Al Viro 

commit abb0434496c4299223f69bcb07174dee2e764bec
Author: Al Viro 
Date:   Sun Dec 14 03:20:01 2025 -0500

    mqueue: switch to CLASS(filename)
    
    Signed-off-by: Al Viro 

commit a0c3d1f3de375da1bcf2fb15d4d5a1e5ebf7b277
Author: Al Viro 
Date:   Sun Dec 14 03:19:28 2025 -0500

    user_statfs(): switch to CLASS(filename)
    
    Signed-off-by: Al Viro 

commit a4503461fb6b72c68dd341c4a8e286e1bf2ec265
Author: Al Viro 
Date:   Sun Dec 14 03:18:33 2025 -0500

    statx: switch to CLASS(filename_maybe_null)
    
    Signed-off-by: Al Viro 

commit ef7282e84934d54249abc745fc1cbc8b727a81cf
Author: Al Viro 
Date:   Sun Dec 14 03:17:33 2025 -0500

    quotactl_block(): switch to CLASS(filename)
    
    Signed-off-by: Al Viro 

commit 57483461e19c55da9cd9433aed2d47949e8c1c11
Author: Al Viro 
Date:   Sun Dec 14 03:13:59 2025 -0500

    chroot(2): switch to CLASS(filename)
    
    Signed-off-by: Al Viro 

commit cbe9e300a2c196ecb47d83e1665901603aca4126
Author: Al Viro 
Date:   Sun Dec 14 03:10:05 2025 -0500

    move_mount(2): switch to CLASS(filename_maybe_null)
    
    Signed-off-by: Al Viro 

commit 904f58b50711babeb6e1383701e27d40a336908c
Author: Al Viro 
Date:   Sat Dec 6 13:01:06 2025 -0500

    namei.c: switch user pathname imports to CLASS(filename{,_flags})
    
    filename_flags is used by user_path_at().  I suspect that mixing
    LOOKUP_EMPTY with real lookup flags had been a mistake all along; the
    former belongs to pathname import, the latter - to pathwalk.  Right now
    none of the remaining in-tree callers of user_path_at() are getting
    LOOKUP_EMPTY in flags, so user_path_at() could probably be switched
    to CLASS(filename)...
    
    Signed-off-by: Al Viro 

commit e9817d5b8c32b64d40b0c0ffcd0dc67ce77e2aca
Author: Al Viro 
Date:   Sat Dec 6 12:51:13 2025 -0500

    namei.c: convert getname_kernel() callers to CLASS(filename_kernel)
    
    Signed-off-by: Al Viro 

commit 33b54bc7998940c1dd4770c5ed0e182504302032
Author: Al Viro 
Date:   Thu Oct 10 20:45:08 2024 -0400

    do_f{chmod,chown,access}at(): use CLASS(filename_uflags)
    
    Signed-off-by: Al Viro 

commit d4ffeabea744a772cbce40c41f94accf9841d6e5
Author: Al Viro 
Date:   Fri Sep 20 12:35:42 2024 -0400

    do_readlinkat(): switch to CLASS(filename_flags)
    
    Signed-off-by: Al Viro 

commit 97ed55d2f503d42aefc9695cf69954c10366588c
Author: Al Viro 
Date:   Fri Oct 11 00:07:03 2024 -0400

    do_sys_truncate(): switch to CLASS(filename)
    
    Note that failures from filename_lookup() are final - ESTALE returned
    by it means that retry had been done by filename_lookup() and it failed
    there.
    
    Signed-off-by: Al Viro 

commit 7273ed4e780c64fae127b8c1de4b5000f9e0bac1
Author: Al Viro 
Date:   Thu Dec 4 18:07:19 2025 -0500

    do_utimes_path(): switch to CLASS(filename_uflags)
    
    Signed-off-by: Al Viro 

commit 4e9654c2bb468ce15df2ec3db27d35b3d7f85ca3
Author: Al Viro 
Date:   Fri Oct 31 13:56:45 2025 -0400

    chdir(2): unspaghettify a bit...
    
    Signed-off-by: Al Viro 

commit f770e4c1a488edb5ea96cce67f41607c259d704c
Author: Al Viro 
Date:   Fri Oct 31 13:50:33 2025 -0400

    do_fchownat(): unspaghettify a bit...
    
    Signed-off-by: Al Viro 

commit 7f583ad97c6a87e8ea7b7b875dabe2f84fedfd5e
Author: Al Viro 
Date:   Sat Nov 1 17:53:48 2025 -0400

    fspick(2): use CLASS(filename_flags)
    
    That kills the last place where we mix LOOKUP_EMPTY with lookup
    flags proper.
    
    Signed-off-by: Al Viro 

commit 154ef7dce6a4d6afd1cf94de2098eb6f60821345
Author: Al Viro 
Date:   Fri Sep 20 14:12:14 2024 -0400

    name_to_handle_at(): use CLASS(filename_uflags)
    
    Signed-off-by: Al Viro 

commit b79b3c1f66131bd1ee705e9e42afe377373563be
Author: Al Viro 
Date:   Sat Nov 1 17:48:06 2025 -0400

    vfs_open_tree(): use CLASS(filename_uflags)
    
    Signed-off-by: Al Viro 

commit 819cb2c1dd8dc1168d5f1810182f1cf1925b4d2f
Author: Al Viro 
Date:   Fri Sep 20 00:48:51 2024 -0400

    do_open_execat(): don't care about LOOKUP_EMPTY
    
    do_file_open() doesn't.
    
    Signed-off-by: Al Viro 

commit 57cd2072bda9d15df427f3d38b9cab4aad3cb55f
Author: Al Viro 
Date:   Fri Sep 20 14:08:37 2024 -0400

    mount_setattr(2): don't mess with LOOKUP_EMPTY
    
    just use CLASS(filename_uflags) + filename_lookup()
    
    Signed-off-by: Al Viro 

commit 70772cafff8b8f02a33a56660f84d8b4011ddeb5
Author: Al Viro 
Date:   Thu Dec 4 14:43:24 2025 -0500

    file_[gs]etattr(2): switch to CLASS(filename_maybe_null)
    
    Signed-off-by: Al Viro 

commit 5b9d406ff7cfde3f0367cac209d5bb2ac1c6e6b3
Author: Al Viro 
Date:   Sat Dec 6 14:33:29 2025 -0500

    filename_...xattr(): don't consume filename reference
    
    Callers switched to CLASS(filename_maybe_null) (in fs/xattr.c)
    and CLASS(filename_complete_delayed) (in io_uring/xattr.c).
    
    Signed-off-by: Al Viro 

commit e50aae1d39ac37a95f453a699456b73dd07e3913
Author: Al Viro 
Date:   Tue Jan 6 23:33:31 2026 -0500

    non-consuming variants of do_{unlinkat,rmdir}()
    
    similar to previous commit; replacements are filename_{unlinkat,rmdir}()
    
    Signed-off-by: Al Viro 

commit 88fdc2761797ee7a537f92a84a4d4ac2e04436a4
Author: Al Viro 
Date:   Tue Jan 6 23:30:02 2026 -0500

    non-consuming variant of do_mknodat()
    
    similar to previous commit; replacement is filename_mknodat()
    
    Signed-off-by: Al Viro 

commit dc912db15ab19d366c56d34a4f06fe49334450b8
Author: Al Viro 
Date:   Tue Jan 6 23:28:57 2026 -0500

    non-consuming variant of do_mkdirat()
    
    similar to previous commit; replacement is filename_mkdirat()
    
    Signed-off-by: Al Viro 

commit da72b76aaeaa2bc67ccedd6e539fabc04aff3ecd
Author: Al Viro 
Date:   Tue Jan 6 23:26:43 2026 -0500

    non-consuming variant of do_symlinkat()
    
    similar to previous commit; replacement is filename_symlinkat()
    
    Signed-off-by: Al Viro 

commit 037193b0ae833c922881f0bf188b4ed49874e6c9
Author: Al Viro 
Date:   Tue Jan 6 23:23:05 2026 -0500

    non-consuming variant of do_linkat()
    
    similar to previous commit; replacement is filename_linkat()
    
    Signed-off-by: Al Viro 

commit e6d50234ccb9ff54addd579032a146aef52e7541
Author: Al Viro 
Date:   Tue Jan 6 23:19:10 2026 -0500

    non-consuming variant of do_renameat2()
    
    filename_renameat2() replaces do_renameat2(); unlike the latter,
    it does not drop filename references - these days it can be just
    as easily arranged in the caller.
    
    Signed-off-by: Al Viro 

commit 0b6a86a049f558bf2496c91b1259e1dc34aed938
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:42 2026 +0200

    iio: pressure: mprls0025pa: add copyright line
    
    Add copyright line to the core driver.
    
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 500b36ee448c0e533acaa186383f0311bbb3dfa5
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:41 2026 +0200

    iio: pressure: mprls0025pa: change measurement sequence
    
    Implement a measurement sequence that does not involve a one byte read of
    the status byte before reading the conversion.
    
    The sensor's conversions should be read either once the EoC interrupt
    has triggered or 5ms after the 0xaa command. See Options 1 and 2
    respectively in Tables 16 (page 15) and 18 (page 18) of the datasheet.
    Note that Honeywell's example code also covered in the datasheet follows
    Option 2 for both i2c and SPI.
    
    The datasheet does not specify any of the retry parameters that are
    currently implemented in the driver. A simple 5+ms sleep as specified in
    Option 2 is enough for a valid measurement sequence.
    
    The change also gets rid of the code duplication tied to the verification
    of the status byte.
    
    This change only affects users that do not define the EoC interrupt in
    the device tree.
    
    Datasheet: https://prod-edam.honeywell.com/content/dam/honeywell-edam/sps/siot/en-us/products/sensors/pressure-sensors/board-mount-pressure-sensors/micropressure-mpr-series/documents/sps-siot-mpr-series-datasheet-32332628-ciid-172626.pdf?download=false
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 84e15e1a6e103e5b57852d90ac686d7f0d0d8b0a
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:40 2026 +0200

    iio: pressure: mprls0025pa: stricter checks for the status byte
    
    Make sure a valid conversion comes with a status byte that only has
    the MPR_ST_POWER bit set.
    Return -EBUSY if also MPR_ST_BUSY is set or -EIO otherwise.
    
    Reviewed-by: Marcelo Schmitt 
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 4edab7b08783f06679de0d24318d92ffc1dfd537
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:39 2026 +0200

    iio: pressure: mprls0025pa: move memset to core
    
    Move memset() from the bus specific code into core.
    
    Zeroing out the buffer is performed because the sensor has noticeable
    latch-up sensitivity and in some cases it clamps the MISO signal to GND
    in sync with SCLK [1]. A raw conversion of zero is out of bounds since
    valid values have to be between output_min and output_max (and the
    smallest output_min is 2.5% of 2^24 = 419430).
    
    The user is expected to discard out of bounds pressure values.
    
    Given the fact that we can't follow the behaviour of all SPI controllers
    when faced to this clamping of an output signal, a raw conversion of zero
    is used as an early warning in case the low level SPI API reacts
    unexpectedly.
    
    Link: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1588325/am3358-spi-tx-data-corruption [1]
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit cf322f806d83b3e221b2b72550c4132b87fa15d9
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:38 2026 +0200

    iio: pressure: mprls0025pa: introduce tx buffer
    
    Use a tx_buf that is part of the priv struct for transferring data to
    the sensor instead of relying on a devm_kzalloc()-ed array.
    Remove the .init operation in the process.
    
    Reviewed-by: Marcelo Schmitt 
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 7071f9f06210c6c828a5db205fa18dfd187ba529
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:37 2026 +0200

    iio: pressure: mprls0025pa: rename buffer variable
    
    For the reason of better naming consistency rename priv->buffer into
    priv->rx_buf since tx_buf will get introduced in the next patch.
    
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 77261502ea5c87498f10bbb763b5b8a64fb5d7e5
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:36 2026 +0200

    iio: pressure: mprls0025pa: remove redundant declarations
    
    Remove the iio_chan_spec and iio_dev structs which are already defined in
    the included iio.h header.
    
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 448889d3abbba5a6444e21fe3bd64e115d147020
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:35 2026 +0200

    iio: pressure: mprls0025pa: cleanup includes
    
    Remove unused headers and add required headers as needed.
    
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit d63403d4e31ae537fefc5c0ee9d90f29b4fc532b
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:34 2026 +0200

    iio: pressure: mprls0025pa: fix pressure calculation
    
    A sign change is needed for proper calculation of the pressure.
    
    This is a minor fix since it only affects users that might have custom
    silicon from Honeywell that has honeywell,pmin-pascal != 0.
    
    Also due to the fact that raw pressure values can not be lower
    than output_min (400k-3.3M) there is no need to calculate a decimal for
    the offset.
    
    Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor")
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 8a228e036926f7e57421d750c3724e63f11b808a
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:33 2026 +0200

    iio: pressure: mprls0025pa: fix scan_type struct
    
    Fix the scan_type sign and realbits assignment.
    
    The pressure is a 24bit unsigned int between output_min and output_max.
    
     transfer function A: 10%   to 90%   of 2^24
     transfer function B:  2.5% to 22.5% of 2^24
     transfer function C: 20%   to 80%   of 2^24
    [MPR_FUNCTION_A] = { .output_min = 1677722, .output_max = 15099494 }
    [MPR_FUNCTION_B] = { .output_min =  419430, .output_max =  3774874 }
    [MPR_FUNCTION_C] = { .output_min = 3355443, .output_max = 13421773 }
    
    Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor")
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit fff3f1a7d805684e4701a70bfaeba39622b59dbc
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:32 2026 +0200

    iio: pressure: mprls0025pa: fix interrupt flag
    
    Interrupt falling/rising flags should only be defined in the device tree.
    
    Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor")
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 583fa86ca581595b1f534a8de6d49ba8b3bf7196
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:31 2026 +0200

    iio: pressure: mprls0025pa: fix SPI CS delay violation
    
    Based on the sensor datasheet in chapter 7.6 SPI timing, Table 20,
    during the SPI transfer there is a minimum time interval requirement
    between the CS being asserted and the first clock edge (tHDSS).
    This minimum interval of 2.5us is being violated if two consecutive SPI
    transfers are queued up.
    
    Fixes: a0858f0cd28e ("iio: pressure: mprls0025pa add SPI driver")
    Datasheet: https://prod-edam.honeywell.com/content/dam/honeywell-edam/sps/siot/en-us/products/sensors/pressure-sensors/board-mount-pressure-sensors/micropressure-mpr-series/documents/sps-siot-mpr-series-datasheet-32332628-ciid-172626.pdf?download=false
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 1e0ac56c92e26115cbc8cfc639843725cb3a7d6a
Author: Petre Rodan 
Date:   Wed Jan 14 18:55:30 2026 +0200

    iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
    
    Make sure that the spi_transfer struct is zeroed out before use.
    
    Fixes: a0858f0cd28e ("iio: pressure: mprls0025pa add SPI driver")
    Signed-off-by: Petre Rodan 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit e318f5721da8c47c95171b810427fba995c67c24
Author: Stafford Horne 
Date:   Sun Dec 14 07:44:33 2025 +0000

    openrisc: dts: Add de0 nano multicore config and devicetree
    
    Add a multicore configuration for the Terasic de0 nano FPGA development
    board.  This SoC runs 2 OpenRISC CPUs at 50Mhz with 32MB ram, UART for
    console and GPIOs for LEDs.
    
    This FPGA SoC is based on the simple-smp reference board and brings in
    devices from the de0 nano common DTSI file.
    
    A default config is added that brings together the device tree and
    driver setup.
    
    Link: https://github.com/stffrdhrn/de0_nano-multicore
    
    Signed-off-by: Stafford Horne 

commit 11659e4c3a1463ba8e49078c009228d7e1f54955
Author: Stafford Horne 
Date:   Sun Dec 14 07:40:03 2025 +0000

    openrisc: dts: Split simple smp dts to dts and dtsi
    
    Split out the common memory, CPU and PIC definitions of the simple SMP
    system to a DTSI file which we will later use for our De0 Nano multicore
    board device tree.  We also take this opportunity to swich underscores
    to dashes as that seems to be the more common convention for DTS files.
    
    Signed-off-by: Stafford Horne 

commit eea1a28f93c8c78b961aca2012dedfd5c528fcac
Author: Stafford Horne 
Date:   Wed Dec 10 17:08:27 2025 +0000

    openrisc: Fix IPIs on simple multicore systems
    
    Commit c05671846451 ("openrisc: sleep instead of spin on secondary
    wait") fixed OpenRISC SMP Linux for QEMU. However, stability was never
    achieved on FPGA development boards.  This is because the above patch
    has a step to unmask IPIs on non-boot cpu's but on hardware without
    power management, IPIs remain masked.
    
    This meant that IPI's were never actually working on the simple SMP
    systems we run on development boards.  The systems booted but stability
    was very suspect.
    
    Add the ability to unmask IPI's on the non-boot cores.  This is done by
    making the OMPIC IRQs proper percpu IRQs.  We can then use the
    enabled_percpu_irq() to unmask IRQ on the non-boot cpus.
    
    Update the or1k PIC driver to use a flow handler that can switch between
    percpu and the configured level or edge flow handlers at runtime.
    This mechanism is inspired by that done in the J-Core AIC driver.
    
    Signed-off-by: Stafford Horne 
    Acked-by: Thomas Gleixner 

commit 111005cafb53efdaf00436bc678f5372a7e06c55
Author: Stafford Horne 
Date:   Sun Sep 7 14:19:33 2025 +0100

    openrisc: dts: Add de0 nano config and devicetree
    
    The de0 nano from Terasic is an FPGA board that we use in the OpenRISC
    community to test OpenRISC configurations.  Add a base configuration for
    the board that runs an OpenRISC CPU at 50Mhz with 32MB ram, UART for
    console and some GPIOs for LEDs and switches.
    
    There is an older version of this floating around that defines all of
    the hardware on the board including SPI's, flash devices, sram, ADCs
    etc.  Eventually it would be good to get the full version upstream
    but for now I think a minimal board is good to start with.
    
    Link: https://openrisc.io/tutorials/de0_nano/
    Link: https://github.com/olofk/de0_nano
    
    Signed-off-by: Stafford Horne 

commit bc62f5b308cbdedf29132fe96e9d591e526527e1
Author: Dan Williams 
Date:   Thu Nov 20 03:19:17 2025 +0000

    dax/hmem, e820, resource: Defer Soft Reserved insertion until hmem is ready
    
    Insert Soft Reserved memory into a dedicated soft_reserve_resource tree
    instead of the iomem_resource tree at boot. Delay publishing these ranges
    into the iomem hierarchy until ownership is resolved and the HMEM path
    is ready to consume them.
    
    Publishing Soft Reserved ranges into iomem too early conflicts with CXL
    hotplug and prevents region assembly when those ranges overlap CXL
    windows.
    
    Follow up patches will reinsert Soft Reserved ranges into iomem after CXL
    window publication is complete and HMEM is ready to claim the memory. This
    provides a cleaner handoff between EFI-defined memory ranges and CXL
    resource management without trimming or deleting resources later.
    
    In the meantime "Soft Reserved" resources will no longer appear in
    /proc/iomem, only their results. I.e. with "memmap=4G%4G+0xefffffff"
    
    Before:
    100000000-1ffffffff : Soft Reserved
      100000000-1ffffffff : dax1.0
        100000000-1ffffffff : System RAM (kmem)
    
    After:
    100000000-1ffffffff : dax1.0
      100000000-1ffffffff : System RAM (kmem)
    
    The expectation is that this does not lead to a user visible regression
    because the dax1.0 device is created in both instances.
    
    Co-developed-by: Smita Koralahalli 
    [Smita: incorporate feedback from x86 maintainer review]
    Signed-off-by: Smita Koralahalli 
    Link: https://patch.msgid.link/20251120031925.87762-2-Smita.KoralahalliChannabasappa@amd.com
    [djbw: cleanups and clarifications]
    Link: https://lore.kernel.org/69443f707b025_1cee10022@dwillia2-mobl4.notmuch
    Signed-off-by: Dan Williams 
    Signed-off-by: Dave Jiang 

commit a91cc48246605af9aeef1edd32232976d74d9502
Author: Sean Christopherson 
Date:   Thu Jan 15 09:21:54 2026 -0800

    KVM: selftests: Test READ=>WRITE dirty logging behavior for shadow MMU
    
    Update the nested dirty log test to validate KVM's handling of READ faults
    when dirty logging is enabled.  Specifically, set the Dirty bit in the
    guest PTEs used to map L2 GPAs, so that KVM will create writable SPTEs
    when handling L2 read faults.  When handling read faults in the shadow MMU,
    KVM opportunistically creates a writable SPTE if the mapping can be
    writable *and* the gPTE is dirty (or doesn't support the Dirty bit), i.e.
    if KVM doesn't need to intercept writes in order to emulate Dirty-bit
    updates.
    
    To actually test the L2 READ=>WRITE sequence, e.g. without masking a false
    pass by other test activity, route the READ=>WRITE and WRITE=>WRITE
    sequences to separate L1 pages, and differentiate between "marked dirty
    due to a WRITE access/fault" and "marked dirty due to creating a writable
    SPTE for a READ access/fault".  The updated sequence exposes the bug fixed
    by KVM commit 1f4e5fc83a42 ("KVM: x86: fix nested guest live migration
    with PML") when the guest performs a READ=>WRITE sequence with dirty guest
    PTEs.
    
    Opportunistically tweak and rename the address macros, and add comments,
    to make it more obvious what the test is doing.  E.g. NESTED_TEST_MEM1
    vs. GUEST_TEST_MEM doesn't make it all that obvious that the test is
    creating aliases in both the L2 GPA and GVA address spaces, but only when
    L1 is using TDP to run L2.
    
    Cc: Yosry Ahmed 
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20260115172154.709024-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit c68feb605cc47431b3d86e6c2fe4f8342ebc87eb
Author: Sean Christopherson 
Date:   Thu Jan 15 09:34:25 2026 -0800

    KVM: VMX: Add a wrapper around ROL16() to get a vmcs12 from a field encoding
    
    Add a wrapper macro, ENC_TO_VMCS12_IDX(), to get a vmcs12 index given a
    field encoding in anticipation of adding a macro to get from a vmcs12 index
    back to the field encoding.  And because open coding ROL16(n, 6) everywhere
    is gross.
    
    No functional change intended.
    
    Suggested-by: Xiaoyao Li 
    Reviewed-by: Xiaoyao Li 
    Link: https://patch.msgid.link/20260115173427.716021-3-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 26304e0e694f4cacc30bcf757663f26533351fbd
Author: Sean Christopherson 
Date:   Thu Jan 15 09:34:24 2026 -0800

    KVM: nVMX: Setup VMX MSRs on loading CPU during nested_vmx_hardware_setup()
    
    Move the call to nested_vmx_setup_ctls_msrs() from vmx_hardware_setup() to
    nested_vmx_hardware_setup() so that the nested code can deal with ordering
    dependencies without having to straddle vmx_hardware_setup() and
    nested_vmx_hardware_setup().  Specifically, an upcoming change will
    sanitize the vmcs12 fields based on hardware support, and that code needs
    to run _before_ the MSRs are configured, because the lovely vmcs_enum MSR
    depends on the max support vmcs12 field.
    
    No functional change intended.
    
    Reviewed-by: Xiaoyao Li 
    Link: https://patch.msgid.link/20260115173427.716021-2-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 7a96ccc82c106b763dd561cb87f9c7261dff4f0d
Author: Daniel Gomez 
Date:   Sat Dec 20 04:45:34 2025 +0100

    driver core: attribute_container: change return type to void
    
    attribute_container_register() has always returned 0 since its
    introduction in commit 06ff5a987e ("Add attribute container to generic
    device model") in the historical Linux tree [1]. Convert the return type
    to void and update all callers.
    
    This removes dead code where callers checked for errors that could never
    occur.
    
    Link: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git [1]
    
    Signed-off-by: Daniel Gomez 
    Link: https://patch.msgid.link/20251220-dev-attribute-container-linux-scsi-v1-1-d58fcd03bf21@samsung.com
    Signed-off-by: Greg Kroah-Hartman 

commit 5f62af9fd20bea5e3b543cf69655c043cea298bb
Author: Thorsten Blum 
Date:   Sat Dec 20 13:59:31 2025 +0100

    devtmpfs: Replace simple_strtoul with kstrtoint in mount_param
    
    Replace simple_strtoul() with the recommended kstrtoint() for parsing
    the 'devtmpfs.mount=' boot parameter. Unlike simple_strtoul(), which
    returns an unsigned long, kstrtoint() converts the string directly to
    int and avoids implicit casting.
    
    Check the return value of kstrtoint() and reject invalid values. This
    adds error handling while preserving behavior for existing values, and
    removes use of the deprecated simple_strtoul() helper. The current code
    silently sets 'mount_dev = 0' if parsing fails, instead of leaving the
    default value (IS_ENABLED(CONFIG_DEVTMPFS_MOUNT)) unchanged.
    
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20251220125930.76836-2-thorsten.blum@linux.dev
    Signed-off-by: Greg Kroah-Hartman 

commit 99aa03f98ce56804f2e8936f9dabf8c4f117a661
Author: Ben Dooks 
Date:   Fri Jan 16 15:07:45 2026 +0000

    devtmpfs: make 'devtmpfs_context_ops' static
    
    The 'devtmpfs_context_ops' object is not exported outside the
    devtmpfs.c file nor defined anywhere for use outside. Make this
    static to remove the following sparse warning:
    
    drivers/base/devtmpfs.c:88:30: warning: symbol 'devtmpfs_context_ops' was not declared. Should it be static?
    
    Signed-off-by: Ben Dooks 
    Link: https://patch.msgid.link/20260116150745.1330145-1-ben.dooks@codethink.co.uk
    Signed-off-by: Greg Kroah-Hartman 

commit aced969e9bf3701dc75cfca57c78c031b7875b9d
Author: Matthew Schwartz 
Date:   Sun Jan 4 22:02:36 2026 -0800

    mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
    
    The existing 1ms delay in sd_power_on is insufficient and causes resume
    errors around 4% of the time.
    
    Increasing the delay to 5ms resolves this issue after testing 300
    s2idle cycles.
    
    Fixes: 1f311c94aabd ("mmc: rtsx: add 74 Clocks in power on flow")
    Signed-off-by: Matthew Schwartz 
    Link: https://patch.msgid.link/20260105060236.400366-3-matthew.schwartz@linux.dev
    Signed-off-by: Greg Kroah-Hartman 

commit eac85fbd0867c25ac517f58fae401d65c627edff
Author: Matthew Schwartz 
Date:   Sun Jan 4 22:02:35 2026 -0800

    mmc: rtsx: reset power state on suspend
    
    When rtsx_pci suspends, the card reader hardware powers off but the sdmmc
    driver's prev_power_state remains as MMC_POWER_ON. This causes sd_power_on
    to skip reinitialization on the next I/O request, leading to DMA transfer
    timeouts and errors on resume 20% of the time.
    
    Add a power_off slot callback so the PCR can notify the sdmmc driver
    during suspend. The sdmmc driver resets prev_power_state, and sd_request
    checks this to reinitialize the card before the next I/O.
    
    Signed-off-by: Matthew Schwartz 
    Link: https://patch.msgid.link/20260105060236.400366-2-matthew.schwartz@linux.dev
    Signed-off-by: Greg Kroah-Hartman 

commit 5f0bf80cc5e04d31eeb201683e0b477c24bd18e7
Author: Matthew Schwartz 
Date:   Sat Jan 3 12:42:26 2026 -0800

    mmc: rtsx_pci: add quirk to disable MMC_CAP_AGGRESSIVE_PM for RTS525A
    
    Using MMC_CAP_AGGRESSIVE_PM on RTS525A card readers causes game
    performance issues when the card reader comes back from idle into active
    use. This can be observed in Hades II when loading new sections of the
    game or menu after the card reader puts itself into idle, and presents
    as a 1-2 second hang.
    
    Add EXTRA_CAPS_NO_AGGRESSIVE_PM quirk to allow cardreader drivers to
    opt-out of aggressive PM, and set it for RTS525A.
    
    Closes: https://lore.kernel.org/linux-mmc/ff9a7c20-f465-4afa-bf29-708d4a52974a@linux.dev/
    Signed-off-by: Matthew Schwartz 
    Link: https://patch.msgid.link/20260103204226.71752-1-matthew.schwartz@linux.dev
    Signed-off-by: Greg Kroah-Hartman 

commit ed1613fc18834b5ec38d3534e96e4bc990289aa2
Author: Randy Dunlap 
Date:   Sun Dec 28 11:05:02 2025 -0800

    stm class: Kconfig: correct symbol name
    
    Drop the leading "CONFIG_" when referring to Kconfig symbols--
    it is supplied by the kconfig software.
    This make the default values work as (apparently) expected.
    
    Fixes: a02509f301c6 ("stm class: Factor out default framing protocol")
    Fixes: d69d5e83110f ("stm class: Add MIPI SyS-T protocol support")
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251228190502.2480758-1-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit 68a9459a5c4e8b978c3eb5d75be5446799e483de
Author: Greg Kroah-Hartman 
Date:   Wed Dec 17 13:32:47 2025 +0100

    kunit: fix up const mis-match in many assert functions
    
    In many kunit assert functions a const pointer is passed to
    container_of() and out pops a non-const pointer, which really isn't the
    correct thing to do at all.  Fix this up by correctly marking the
    casted-to pointer as const to preserve the marking.
    
    Cc: Brendan Higgins 
    Cc: David Gow 
    Cc: Rae Moar 
    Cc: linux-kselftest@vger.kernel.org
    Cc: kunit-dev@googlegroups.com
    Reviewed-by: David Gow 
    Link: https://patch.msgid.link/2025121746-result-staleness-5a68@gregkh
    Signed-off-by: Greg Kroah-Hartman 

commit 86b31a2c81817d09cb5cbea9457a9f294ed9bb7d
Author: Greg Kroah-Hartman 
Date:   Wed Dec 17 13:36:52 2025 +0100

    test_list_sort: fix up const mismatch
    
    In the internal cmp function, a const pointer is cast out to a non-const
    pointer by using container_of().  This is probably not what is intended
    at all, so fix up the const marking to properly preserve what is really
    happening (i.e. the const should flow through the container_of() call)
    
    Cc: Jakub Kicinski 
    Cc: David Gow 
    Cc: Masami Hiramatsu (Google) 
    Cc: Vlastimil Babka 
    Cc: Kees Cook 
    Cc: linux-kernel@vger.kernel.org
    Reviewed-by: David Gow 
    Link: https://patch.msgid.link/2025121751-backtrack-manifesto-7c57@gregkh
    Signed-off-by: Greg Kroah-Hartman 

commit bd87458c163820ad8f8c65bb24a0e35f145b8ace
Author: Randy Dunlap 
Date:   Sun Dec 14 11:17:50 2025 -0800

    xilinx_hwicap: fifo_icap.c: fix all kernel-doc warnings
    
    Modify comments in fifo_icap.c to prevent all kernel-doc warnings:
    
    Warning: fifo_icap.c:51 This comment starts with '/**', but isn't a
     kernel-doc comment.
     * HwIcap Device Interrupt Status/Enable Registers
    Warning: fifo_icap.c:106 No description found for return value
     of 'fifo_icap_fifo_read'
    Warning: fifo_icap.c:160 No description found for return value
     of 'fifo_icap_get_status'
    Warning: fifo_icap.c:171 No description found for return value
     of 'fifo_icap_busy'
    Warning: fifo_icap.c:184 No description found for return value
     of 'fifo_icap_write_fifo_vacancy'
    Warning: fifo_icap.c:196 No description found for return value
     of 'fifo_icap_read_fifo_occupancy'
    Warning: fifo_icap.c:207 bad line:
    Warning: fifo_icap.c:214 No description found for return value
     of 'fifo_icap_set_configuration'
    Warning: fifo_icap.c:290 function parameter 'frame_buffer' not described
     in 'fifo_icap_get_configuration'
    Warning: fifo_icap.c:290 function parameter 'num_words' not described
     in 'fifo_icap_get_configuration'
    Warning: fifo_icap.c:290 No description found for return value
     of 'fifo_icap_get_configuration'
    Warning: fifo_icap.c:357 expecting prototype for buffer_icap_reset().
     Prototype was for fifo_icap_reset() instead
    
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Michal Simek 
    Link: https://patch.msgid.link/20251214191750.2173225-1-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit a2450bddb75f4c0da86ed02adbc9477e49edd311
Author: Randy Dunlap 
Date:   Sun Dec 14 12:27:39 2025 -0800

    eeprom_93cx6: fix struct member kernel-doc
    
    Remove the function parameter parts of the struct member descriptions
    to prevent kernel-doc warnings:
    
    Warning: include/linux/eeprom_93cx6.h:64 struct member 'register_read'
     not described in 'eeprom_93cx6'
    Warning: ../include/linux/eeprom_93cx6.h:64 struct member 'register_write'
     not described in 'eeprom_93cx6'
    
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251214202739.2216904-1-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit 38a5a54f6d8560d349d76a3fb9bc51499a9d0cda
Author: Can Peng 
Date:   Mon Dec 8 21:05:25 2025 +0800

    kgdbts: mark kgdbts_option_setup() with __init to free init memory
    
    The kgdbts_option_setup() function is invoked only once early in boot
    via the __setup("kgdbts=", ...) mechanism to parse the kernel
    command-line option.After init is complete, it is never called again.
    
    Annotating it with __init places the function in the .init.text section,
    enabling the kernel to free its code memory during the init memory
    cleanup phase (free_initmem()). This reduces the kernel’s runtime
    memory footprint with no functional side effects.
    
    Signed-off-by: Can Peng 
    Link: https://patch.msgid.link/20251208130525.2775885-1-pengcan@kylinos.cn
    Signed-off-by: Greg Kroah-Hartman 

commit 578d62a2e51614ea117ccf05fce6aaa6257dfd60
Author: Randy Dunlap 
Date:   Sun Dec 14 12:27:27 2025 -0800

    comedi: comedi_8254: correct kernel-doc warnings
    
    Correct typos in 3 struct member descriptions to eliminate all
    kernel-doc warnings in comedi_8254.h:
    
    Warning: include/linux/comedi/comedi_8254.h:112 struct member 'next_div'
     not described in 'comedi_8254'
    Warning: include/linux/comedi/comedi_8254.h:112 struct member 'clock_src'
     not described in 'comedi_8254'
    Warning: include/linux/comedi/comedi_8254.h:112 struct member 'gate_src'
     not described in 'comedi_8254'
    
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Ian Abbott 
    Link: https://patch.msgid.link/20251214202727.2215461-1-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit b842f8c6397ab59786ad5d5bb8c6899d2fc55ae9
Author: Ian Abbott 
Date:   Wed Dec 10 12:44:55 2025 +0000

    comedi: comedi_test: add a DIO subdevice
    
    The fake "comedi_test" device currently has two subdevices: an analog
    input subdevice, and an analog output subdevice.  To make it a bit more
    useful for testing, add a third subdevice for digital I/O.
    
    The new DIO subdevice has 32 channels with each channel individually
    programmable as an input or an output.  To add a bit of interaction,
    channels 0 to 15 are wired to channels 16 to 31 (0 to 16, 1 to 17,
    etc.), and the state of each wire can be read back on both of the
    channels connected to it.  The outputs are modelled as NPN open
    collector outputs with a pull-up resistor on the wire, so the state of
    each wire (and the value read back from each channel connected to it)
    will be logic level 1 unless either channel is configured as an output
    at logic level 0.
    
    Signed-off-by: Ian Abbott 
    Link: https://patch.msgid.link/20251210124455.69131-1-abbotti@mev.co.uk
    Signed-off-by: Greg Kroah-Hartman 

commit d63cf1eea10c904c1b31b22ff3e118033ec7edfb
Author: Ian Abbott 
Date:   Fri Dec 5 13:13:32 2025 +0000

    comedi: don't use mutex for COMEDI_BUFINFO ioctl
    
    The main mutex in a comedi device can get held for quite a while when
    processing comedi instructions, so for performance reasons, the "read",
    "write", and "poll" file operations do not use it; they use the
    `attach_lock` rwsemaphore to protect against the comedi device becoming
    detached at an inopportune moment.  As an alternative to using the
    "read" and "write" operations, user-space can mmap the data buffer and
    use the `COMEDI_BUFINFO` ioctl to manage data transfer through the
    buffer.  However, the "ioctl" file handler currently locks the main
    mutex for all ioctl commands.  Make the handling of the `COMEDI_BUFINFO`
    an exception, using the `attach_lock` rwsemaphore during normal
    operation.  However, before it calls `do_become_nonbusy()` at the end of
    acquisition, it does need to lock the main mutex, but it needs to unlock
    the `attach_lock` rwsemaphore first to avoid deadlock.  After locking
    the main mutex, it needs to check that it is still in a suitable state
    to become non-busy, because things may have changed while unlocked.
    
    Signed-off-by: Ian Abbott 
    Link: https://patch.msgid.link/20251205131332.16672-1-abbotti@mev.co.uk
    Signed-off-by: Greg Kroah-Hartman 

commit 45edeece5abe146b1188ef9af3cde0609997493b
Author: Christophe Leroy (CS GROUP) 
Date:   Fri Jan 16 13:23:33 2026 +0100

    bus: fsl-mc: declare fsl_mc_bus_dpdbg_type static
    
    Fix following sparse warning:
    
      CHECK   drivers/bus/fsl-mc/fsl-mc-bus.c
    drivers/bus/fsl-mc/fsl-mc-bus.c:435:26: warning: symbol 'fsl_mc_bus_dpdbg_type' was not declared. Should it be static?
    
    fsl_mc_bus_dpdbg_type is not used outside of fsl-mc-bus.c
    
    Remove the EXPORT_SYMBOL and declare it static.
    
    Signed-off-by: Christophe Leroy (CS GROUP) 
    Link: https://patch.msgid.link/628c49881b3a1df76cfd2f8fd2aad976692a465a.1768566053.git.chleroy@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit 986d388e6779800080d13b555c9aaf6900614387
Author: Uwe Kleine-König 
Date:   Tue Jan 13 15:50:09 2026 +0100

    greybus: Use bus methods for .probe() and .remove()
    
    These are nearly identical to the respective driver callbacks. The only
    difference is that .remove() returns void instead of int.
    
    The objective is to get rid of users of struct device_driver callbacks
    .probe() and .remove() to eventually remove these.
    
    Acked-by: Johan Hovold 
    Signed-off-by: Uwe Kleine-König 
    Link: https://patch.msgid.link/20260113145012.2379944-2-u.kleine-koenig@baylibre.com
    Signed-off-by: Greg Kroah-Hartman 

commit b89921eed8cf2d97250bac4be38dbcfbf048b586
Author: Zilin Guan 
Date:   Tue Dec 30 03:45:46 2025 +0000

    gpib: Fix memory leak in ni_usb_init()
    
    In ni_usb_init(), if ni_usb_setup_init() fails, the function returns
    -EFAULT without freeing the allocated writes buffer, leading to a
    memory leak.
    
    Additionally, ni_usb_setup_init() returns 0 on failure, which causes
    ni_usb_init() to return -EFAULT, an inappropriate error code for this
    situation.
    
    Fix the leak by freeing writes in the error path. Modify
    ni_usb_setup_init() to return -EINVAL on failure and propagate this
    error code in ni_usb_init().
    
    Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver")
    Suggested-by: Greg KH 
    Suggested-by: Dave Penkler 
    Co-developed-by: Jianhao Xu 
    Signed-off-by: Jianhao Xu 
    Signed-off-by: Zilin Guan 
    Link: https://patch.msgid.link/20251230034546.929452-1-zilin@seu.edu.cn
    Signed-off-by: Greg Kroah-Hartman 

commit 484e62252212c5b5fc62eaee5e4977143cb159c6
Author: Dan Carpenter 
Date:   Fri Nov 28 10:17:57 2025 +0300

    gpib: Fix error code in ni_usb_write_registers()
    
    If ni_usb_receive_bulk_msg() succeeds but without reading 16 bytes, then
    the error code needs to be set.  The current code returns success.
    
    Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver")
    Signed-off-by: Dan Carpenter 
    Link: https://patch.msgid.link/aSlMpbE4IrQuBGFS@stanley.mountain
    Signed-off-by: Greg Kroah-Hartman 

commit 96118565d24e7691e423d73be224b3a3fffc4680
Author: Dan Carpenter 
Date:   Fri Nov 28 10:17:49 2025 +0300

    gpib: Fix error code in ibonline()
    
    This accidentally returns 1 on error, but it should return negative
    error codes.
    
    Fixes: 9dde4559e939 ("staging: gpib: Add GPIB common core driver")
    Signed-off-by: Dan Carpenter 
    Link: https://patch.msgid.link/aSlMnaT1M104NJb2@stanley.mountain
    Signed-off-by: Greg Kroah-Hartman 

commit 327e987e5166a407554e8cccba8e5f8d51f1c868
Author: Simon Richter 
Date:   Thu Jan 8 03:26:05 2026 +0900

    misc/mei: gsc_proxy: add dependency on Xe driver
    
    This driver is useful if at least one DRM driver registers an auxiliary device
    for the ME interface. With the addition of Xe, this is no longer just i915.
    
    Cc: Usyskin, Alexander 
    Cc: Greg Kroah-Hartman 
    Signed-off-by: Simon Richter 
    Link: https://patch.msgid.link/20260107182615.488194-5-Simon.Richter@hogyros.de
    Signed-off-by: Greg Kroah-Hartman 

commit 6d5dca5f9e37741f5e50c31c81b497f875dca6c8
Author: Simon Richter 
Date:   Thu Jan 8 03:26:04 2026 +0900

    misc/mei: Allow building standalone for compile testing
    
    While this is not a particularly useful configuration, the MEI code should
    compile even when no drivers for a GPU containing a management engine are
    built.
    
    Cc: Usyskin, Alexander 
    Cc: Greg Kroah-Hartman 
    Signed-off-by: Simon Richter 
    Link: https://patch.msgid.link/20260107182615.488194-4-Simon.Richter@hogyros.de
    Signed-off-by: Greg Kroah-Hartman 

commit d876cb978058a57b5d28b2b3e16197f678ce8311
Author: Simon Richter 
Date:   Thu Jan 8 03:26:03 2026 +0900

    misc/mei: Decouple ME interfaces from GPU drivers
    
    These are enumerated via an auxiliary bus, so there is no functional
    dependency between these drivers, therefore allow compiling MEI as builtin
    even when i915/xe are built as modules.
    
    Cc: Usyskin, Alexander 
    Cc: Greg Kroah-Hartman 
    Signed-off-by: Simon Richter 
    Link: https://patch.msgid.link/20260107182615.488194-3-Simon.Richter@hogyros.de
    Signed-off-by: Greg Kroah-Hartman 

commit 25f9b0d351552f63ac3f72e6c655bc8f9994f7d2
Author: Simon Richter 
Date:   Thu Jan 8 03:26:02 2026 +0900

    misc/mei: Allow building Intel ME interface on non-x86
    
    The xe driver supports dGPUs which can be plugged into non-x86 machines,
    and exposes a MEI GSC interface, so this driver is no longer x86 only.
    
    Cc: Usyskin, Alexander 
    Cc: Greg Kroah-Hartman 
    Signed-off-by: Simon Richter 
    Link: https://patch.msgid.link/20260107182615.488194-2-Simon.Richter@hogyros.de
    Signed-off-by: Greg Kroah-Hartman 

commit d55c571e4333fac71826e8db3b9753fadfbead6a
Author: Oleg Nesterov 
Date:   Sun Jan 11 16:00:37 2026 +0100

    x86/uprobes: Fix XOL allocation failure for 32-bit tasks
    
    This script
    
            #!/usr/bin/bash
    
            echo 0 > /proc/sys/kernel/randomize_va_space
    
            echo 'void main(void) {}' > TEST.c
    
            # -fcf-protection to ensure that the 1st endbr32 insn can't be emulated
            gcc -m32 -fcf-protection=branch TEST.c -o test
    
            bpftrace -e 'uprobe:./test:main {}' -c ./test
    
    "hangs", the probed ./test task enters an endless loop.
    
    The problem is that with randomize_va_space == 0
    get_unmapped_area(TASK_SIZE - PAGE_SIZE) called by xol_add_vma() can not
    just return the "addr == TASK_SIZE - PAGE_SIZE" hint, this addr is used
    by the stack vma.
    
    arch_get_unmapped_area_topdown() doesn't take TIF_ADDR32 into account and
    in_32bit_syscall() is false, this leads to info.high_limit > TASK_SIZE.
    vm_unmapped_area() happily returns the high address > TASK_SIZE and then
    get_unmapped_area() returns -ENOMEM after the "if (addr > TASK_SIZE - len)"
    check.
    
    handle_swbp() doesn't report this failure (probably it should) and silently
    restarts the probed insn. Endless loop.
    
    I think that the right fix should change the x86 get_unmapped_area() paths
    to rely on TIF_ADDR32 rather than in_32bit_syscall(). Note also that if
    CONFIG_X86_X32_ABI=y, in_x32_syscall() falsely returns true in this case
    because ->orig_ax = -1.
    
    But we need a simple fix for -stable, so this patch just sets TS_COMPAT if
    the probed task is 32-bit to make in_ia32_syscall() true.
    
    Fixes: 1b028f784e8c ("x86/mm: Introduce mmap_compat_base() for 32-bit mmap()")
    Reported-by: Paulo Andrade 
    Signed-off-by: Oleg Nesterov 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://lore.kernel.org/all/aV5uldEvV7pb4RA8@redhat.com/
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/aWO7Fdxn39piQnxu@redhat.com

commit 9d4502fef00fa7a798d3c0806d4da4466a7ffc6f
Author: Tzung-Bi Shih 
Date:   Fri Jan 16 08:02:35 2026 +0000

    selftests: revocable: Add kselftest cases
    
    Add kselftest cases for the revocable API.
    
    The test consists of three parts:
    - A kernel module (revocable_test.ko) that creates a debugfs interface
      with `/provider` and `/consumer` files.
    - A user-space C program (revocable_test) that uses the kselftest
      harness to interact with the debugfs files.
    - An orchestrating shell script (test-revocable.sh) that loads the
      module, runs the C program, and unloads the module.
    
    The test cases cover the following scenarios:
    - Basic: Verifies that a consumer can successfully access the resource
      provided via the provider.
    - Revocation: Verifies that after the provider revokes the resource,
      the consumer correctly receives a NULL pointer on a subsequent access.
    - Try Access Macro: Same as "Revocation" but uses the
      REVOCABLE_TRY_ACCESS_WITH() and REVOCABLE_TRY_ACCESS_SCOPED().
    
    Signed-off-by: Tzung-Bi Shih 
    Link: https://patch.msgid.link/20260116080235.350305-4-tzungbi@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit cd7693419bb5abd91ad2f407dab69c480e417a61
Author: Tzung-Bi Shih 
Date:   Fri Jan 16 08:02:34 2026 +0000

    revocable: Add Kunit test cases
    
    Add Kunit test cases for the revocable API.
    
    The test cases cover the following scenarios:
    - Basic: Verifies that a consumer can successfully access the resource
      provided via the provider.
    - Revocation: Verifies that after the provider revokes the resource,
      the consumer correctly receives a NULL pointer on a subsequent access.
    - Try Access Macro: Same as "Revocation" but uses the
      REVOCABLE_TRY_ACCESS_WITH() and REVOCABLE_TRY_ACCESS_SCOPED().
    
    A way to run the test:
    $ ./tools/testing/kunit/kunit.py run \
            --kconfig_add CONFIG_REVOCABLE_KUNIT_TEST=y \
            revocable_test
    
    Signed-off-by: Tzung-Bi Shih 
    Link: https://patch.msgid.link/20260116080235.350305-3-tzungbi@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit 62eb557580eb2177cf16c3fd2b6efadff297b29a
Author: Tzung-Bi Shih 
Date:   Fri Jan 16 08:02:33 2026 +0000

    revocable: Revocable resource management
    
    Some resources can be removed asynchronously, for example, resources
    provided by a hot-pluggable device like USB.  When holding a reference
    to such a resource, it's possible for the resource to be removed and
    its memory freed, leading to use-after-free errors on subsequent access.
    
    The "revocable" mechanism addresses this by establishing a weak reference
    to a resource that might be freed at any time.  It allows a resource
    consumer to safely attempt to access the resource, guaranteeing that the
    access is valid for the duration of its use, or it fails safely if the
    resource has already been revoked.
    
    The implementation uses a provider/consumer model built on Sleepable
    RCU (SRCU) to guarantee safe memory access:
    
    - A resource provider, such as a driver for a hot-pluggable device,
      allocates a struct revocable_provider and initializes it with a pointer
      to the resource.
    
    - A resource consumer that wants to access the resource allocates a
      struct revocable which acts as a handle containing a reference to the
      provider.
    
    - To access the resource, the consumer uses revocable_try_access().
      This function enters an SRCU read-side critical section and returns
      the pointer to the resource.  If the provider has already freed the
      resource, it returns NULL.  After use, the consumer calls
      revocable_withdraw_access() to exit the SRCU critical section.  The
      REVOCABLE_TRY_ACCESS_WITH() and REVOCABLE_TRY_ACCESS_SCOPED() are
      convenient helpers for doing that.
    
    - When the provider needs to remove the resource, it calls
      revocable_provider_revoke().  This function sets the internal resource
      pointer to NULL and then calls synchronize_srcu() to wait for all
      current readers to finish before the resource can be completely torn
      down.
    
    Acked-by: Danilo Krummrich 
    Signed-off-by: Tzung-Bi Shih 
    Link: https://patch.msgid.link/20260116080235.350305-2-tzungbi@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit a91b64f55d0697cfa554a1c112479d66db6b0ed4
Author: Jie Gan 
Date:   Tue Oct 28 18:11:42 2025 +0800

    arm64: dts: qcom: lemans: enable static TPDM
    
    Enable static TPDM device for lemans.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Jie Gan 
    Acked-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251028-add_static_tpdm_support-v4-3-84e21b98e727@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 56d21267663bad91e8b10121224ec46366a7937e
Author: Thomas Weißschuh 
Date:   Wed Jan 7 15:29:50 2026 +0100

    binder: don't use %pK through printk
    
    In the past %pK was preferable to %p as it would not leak raw pointer
    values into the kernel log. Since commit ad67b74d2469 ("printk: hash
    addresses printed with %p") the regular %p has been improved to avoid
    this issue. Furthermore, restricted pointers ("%pK") were never meant
    to be used through printk(). They can still unintentionally leak raw
    pointers or acquire sleeping locks in atomic contexts.
    
    Switch to the regular pointer formatting which is safer and
    easier to reason about.
    
    There are still a few users of %pK left, but these use it through
    seq_file, for which its usage is safe.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Carlos Llamas 
    Reviewed-by: Alice Ryhl 
    Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de
    Signed-off-by: Greg Kroah-Hartman 

commit 330eb955ea9e7c74e72caadffe39ccc838a66267
Author: Tim Bird 
Date:   Tue Jan 13 16:44:05 2026 -0700

    kernel: add SPDX-License-Identifier lines
    
    Add SPDX-License-Identifier lines to some old kernel
    files.
    
    Signed-off-by: Tim Bird 
    Acked-by: Karim Yaghmour 
    Signed-off-by: Greg Kroah-Hartman 

commit fe099c387e06b566840449ac21008db1b25ad1f4
Author: Alexander Wilhelm 
Date:   Wed Nov 19 11:40:07 2025 +0100

    soc: qcom: preserve CPU endianness for QMI_DATA_LEN
    
    To ensure correct handling of endianness in the QMI subsystem, the
    QMI_DATA_LEN field used in host-side drivers remains in CPU-native byte
    order. Remove unnecessary endianness conversions, considering that
    QMI_DATA_LEN is always of type `u32` on the host. On the QMI wire
    interface, however, its representation is variable and may use either 1 or
    2 bytes.
    
    Signed-off-by: Alexander Wilhelm 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251119104008.3505152-4-alexander.wilhelm@westermo.com
    Signed-off-by: Bjorn Andersson 

commit d9c83903be080a6bc25ccabaafe5487836a7e1a7
Author: Alexander Wilhelm 
Date:   Wed Nov 19 11:40:06 2025 +0100

    soc: qcom: fix QMI encoding/decoding for basic elements
    
    Extend the QMI byte encoding and decoding logic to support multiple basic
    data type sizes (u8, u16, u32, u64) using differnet macros for each type.
    Ensure correct handling of data sizes and proper byte order conversion on
    big-endian platforms by consistently applying these macros during encoding
    and decoding of basic elements.
    
    Signed-off-by: Alexander Wilhelm 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251119104008.3505152-3-alexander.wilhelm@westermo.com
    Signed-off-by: Bjorn Andersson 

commit 5a6d033c4905d78c9c05b1cab36c7e03951fab9e
Author: Alexander Wilhelm 
Date:   Wed Nov 19 11:40:05 2025 +0100

    soc: qcom: check QMI basic element error codes
    
    Extend handling of QMI basic element types to also capture error codes.
    This is required for big-endian platforms where a simple memcpy is not
    sufficient and exact data type knowledge is necessary.
    
    Signed-off-by: Alexander Wilhelm 
    Link: https://lore.kernel.org/r/20251119104008.3505152-2-alexander.wilhelm@westermo.com
    Signed-off-by: Bjorn Andersson 

commit b799d165bc572b86000a2862713e275d69e6d78c
Author: Richard Fitzgerald 
Date:   Thu Jan 15 14:39:20 2026 +0000

    ALSA: hda/cirrus_scodec_test: Use faux_device instead of platform_device
    
    The dummy GPIO driver doesn't need to be a platform device. So make it a
    faux_device driver.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20260115143920.1553783-1-rf@opensource.cirrus.com
    Signed-off-by: Takashi Iwai 

commit a654de9d73fdd844d5644cc5527a362d7cf634fb
Merge: 78e35b0156c3d9 46b8d0888f01f2
Author: Takashi Iwai 
Date:   Fri Jan 16 15:17:16 2026 +0100

    Merge branch 'for-linus' into for-next
    
    Pull 6.19-devel branch for applying cirrus scodec test patches.
    
    Signed-off-by: Takashi Iwai 

commit 90a58ffa9c55831b557ae4819adbe280ea04d3e8
Author: Jianping Li 
Date:   Mon Nov 17 15:08:19 2025 +0800

    arm64: dts: qcom: kodiak: Add memory region for audiopd
    
    Add reserved memory region for audio PD dynamic loading and remote
    heap requirement. Also add LPASS and ADSP_HEAP VMIDs.
    
    Signed-off-by: Jianping Li 
    Link: https://lore.kernel.org/r/20251117070819.492-1-jianping.li@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a1338b39c14ddf50b841e891833786037dec6de4
Author: Neil Armstrong 
Date:   Wed Nov 19 09:45:42 2025 +0100

    arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: add HDMI nodes
    
    The Thinkpad T14s embeds a transparent 4lanes DP->HDMI transceiver
    connected to the third QMP Combo PHY 4 lanes.
    
    Add all the data routing, disable mode switching and specify the
    QMP Combo PHY should be in DP-Only mode to route the 4 lanes to
    the underlying DP phy.
    
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Neil Armstrong 
    Link: https://lore.kernel.org/r/20251119-topic-x1e80100-hdmi-v7-3-2bee0e66cc1b@linaro.org
    Signed-off-by: Bjorn Andersson 

commit b38dd256e11a4c8bd5a893e11fc42d493939c907
Author: Jonathan Marek 
Date:   Thu Nov 27 16:29:42 2025 -0500

    arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models)
    
    Unlike the phone SoCs this was copied from, x1e has a 40-bit physical bus.
    The upper address space is used to support more than 32GB of memory.
    
    This fixes issues when DMA buffers are allocated outside the 36-bit range.
    
    Fixes: af16b00578a7 ("arm64: dts: qcom: Add base X1E80100 dtsi and the QCP dts")
    Signed-off-by: Jonathan Marek 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251127212943.24480-1-jonathan@marek.ca
    Signed-off-by: Bjorn Andersson 

commit 68aabb29a5469e4b7358e70e64a7fac433e27f06
Author: Alice Ryhl 
Date:   Mon Jan 5 14:25:03 2026 +0000

    rust: redefine `bindings::compat_ptr_ioctl` in Rust
    
    There is currently an inconsistency between C and Rust, which is that
    when Rust requires cfg(CONFIG_COMPAT) on compat_ioctl when using the
    compat_ptr_ioctl symbol because '#define compat_ptr_ioctl NULL' does not
    get translated to anything by bindgen.
    
    But it's not *just* a matter of translating the '#define' into Rust when
    CONFIG_COMPAT=n. This is because when CONFIG_COMPAT=y, the type of
    compat_ptr_ioctl is a non-nullable function pointer, and to seamlessly
    use it regardless of the config, we need a nullable function pointer.
    
    I think it's important to do something about this; I've seen the mistake
    of accidentally forgetting '#[cfg(CONFIG_COMPAT)]' when compat_ptr_ioctl
    is used multiple times now.
    
    This explicitly declares 'bindings::compat_ptr_ioctl' as an Option that
    is always defined but might be None. This matches C, but isn't ideal:
    it modifies the bindings crate. But I'm not sure if there's a better way
    to do it. If we just redefine in kernel/, then people may still use the
    one in bindings::, since that is where you would normally find it. I am
    open to suggestions.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Link: https://patch.msgid.link/20260105-redefine-compat_ptr_ioctl-v1-1-25edb3d91acc@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit 7f43ac104af7d3d4158ec306d4ca1c897ecce78c
Author: Heiko Stuebner 
Date:   Thu Jan 15 00:07:07 2026 +0100

    arm64: dts: rockchip: Add the Video-Demo overlay for Lion Haikou
    
    The video-demo adapter also works on the Lion SoM when running
    on a Haikou baseboard, so add an overlay for it.
    
    Tested-by: Quentin Schulz 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20260114230707.4175162-6-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit f03f3e0a77a72f6f6284aff0da6d21d6508e57ac
Author: Heiko Stuebner 
Date:   Thu Jan 15 00:07:06 2026 +0100

    arm64: dts: rockchip: Enable pwm1 on rk3368-lion-haikou
    
    The pwm1 is exposed as BLT_CTRL signal on the MISC I/O pin header of the
    haikou baseboard and the Qseven  standard specifies this signal is only
    for PWM (either for a panel backlight or generic PWM).
    
    So enable it in the Haikou baseboard for Lion.
    
    Suggested-by: Quentin Schulz 
    Signed-off-by: Heiko Stuebner 
    Reviewed-by: Quentin Schulz 
    Link: https://patch.msgid.link/20260114230707.4175162-5-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit 385430244e85e245f071ab158f7e4c7b2b5d99cb
Author: Heiko Stuebner 
Date:   Thu Jan 15 00:07:05 2026 +0100

    arm64: dts: rockchip: Enable HDMI output on RK3368-Lion-Haikou
    
    Enable the VOP and HDMI controller on the Lion-Haikou board.
    
    Signed-off-by: Heiko Stuebner 
    Reviewed-by: Quentin Schulz 
    Link: https://patch.msgid.link/20260114230707.4175162-4-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit 6d60168c6d2f76917b3f71d2a6807c6d8dd24363
Author: Heiko Stuebner 
Date:   Thu Jan 15 00:07:04 2026 +0100

    arm64: dts: rockchip: Add HDMI node to RK3368
    
    Add the HDMI controller node to the main SoC devicetree and hook
    it into the VOP.
    
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20260114230707.4175162-3-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit 4f3df9abf44bd92ecd5d8c3018ddefa7f5bf74d0
Author: Heiko Stuebner 
Date:   Thu Jan 15 00:07:03 2026 +0100

    arm64: dts: rockchip: Use phandle for i2c_lvds_blc on rk3368-lion haikou
    
    i2c@0 on i2cmux2 does already have a phandle i2c_lvds_blc defined.
    
    Use this one instead of replicating the hierarchy again, as this might
    result in strange errors if the lion dtsi is changed at some point
    in the future.
    
    Reviewed-by: Quentin Schulz 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20260114230707.4175162-2-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit a9c1acebfe0484343a443d082e039ca77186ed22
Author: Shawn Lin 
Date:   Fri Jan 16 08:55:32 2026 +0800

    arm64: dts: rockchip: Fix SD card support for RK3576 Nanopi R76s
    
    When runtime suspend is enabled, the associated power domain is powered
    off, which resets the registers, including the power control bit. As a result,
    the card loses power during runtime suspend. The card should still be able
    to process I/O with the help of mmc_blk_mq_rw_recovery(), which is suboptimal.
    To address this issue, we must use vmmc-supply with a GPIO based method to
    maintain power to the card and store valid tuning phases. Also, add cd-gpios
    method to make hot-plug work correctly during idle periods.
    
    Fixes: 7fee88882704 ("arm64: dts: rockchip: Add devicetree for the FriendlyElec NanoPi R76S")
    Cc: stable@vger.kernel.org
    Signed-off-by: Shawn Lin 
    Tested-by: Marco Schirrmeister 
    Link: https://patch.msgid.link/1768524932-163929-6-git-send-email-shawn.lin@rock-chips.com
    Signed-off-by: Heiko Stuebner 

commit 7226664bf952c4cfddccd74b154a7d994608d153
Author: Shawn Lin 
Date:   Fri Jan 16 08:55:31 2026 +0800

    arm64: dts: rockchip: Fix SD card support for RK3576 EVB1
    
    When runtime suspend is enabled, the associated power domain is powered
    off, which resets the registers, including the power control bit. As a result,
    the card loses power during runtime suspend. The card should still be able
    to process I/O with the help of mmc_blk_mq_rw_recovery(), which is suboptimal.
    To address this issue, we must use vmmc-supply with a GPIO based method to
    maintain power to the card. Also, add cd-gpios method to make hot-plug work
    correctly during idle periods.
    
    Fixes: f135a1a07352 ("arm64: dts: rockchip: Add rk3576 evb1 board")
    Cc: stable@vger.kernel.org
    Signed-off-by: Shawn Lin 
    Link: https://patch.msgid.link/1768524932-163929-5-git-send-email-shawn.lin@rock-chips.com
    Signed-off-by: Heiko Stuebner 

commit 0e19f73ffde187458fadfff60eb4771bff704296
Author: Heiko Carstens 
Date:   Wed Nov 26 15:29:09 2025 +0100

    tty: hvc-iucv: Remove KMSG_COMPONENT macro
    
    The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel message
    catalog" from 2008 [1] which never made it upstream.
    
    The macro was added to s390 code to allow for an out-of-tree patch which
    used this to generate unique message ids. Also this out-of-tree doesn't
    exist anymore.
    
    Remove the macro in order to get rid of a pointless indirection.
    
    [1] https://lwn.net/Articles/292650/
    
    Acked-by: Hendrik Brueckner 
    Signed-off-by: Heiko Carstens 
    Link: https://patch.msgid.link/20251126142909.2140015-1-hca@linux.ibm.com
    Signed-off-by: Greg Kroah-Hartman 

commit c7d8b85b98f749725ac1d0575f7a44007fde0c94
Author: Kuan-Wei Chiu 
Date:   Tue Jan 13 09:25:57 2026 +0000

    dt-bindings: serial: google,goldfish-tty: Convert to DT schema
    
    Convert the Google Goldfish TTY binding to DT schema format.
    Move the file to the serial directory to match the subsystem.
    Update the example node name to 'serial' to comply with generic node
    naming standards.
    
    Signed-off-by: Kuan-Wei Chiu 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260113092602.3197681-2-visitorckw@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 9e0313435c2d077f9eb432439228e57c36e6422d
Author: Lad Prabhakar 
Date:   Mon Jan 12 09:57:22 2026 +0000

    dt-bindings: serial: sh-sci: Fold single-entry compatibles into enum
    
    Group single compatibles into enum.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260112095722.25556-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit a5fd8945a478ff9be14812693891d7c9b4185a50
Author: Moteen Shah 
Date:   Mon Jan 12 13:48:29 2026 +0530

    serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done
    
    Clear rx_running flag only after DMA teardown polling completes. In the
    previous implementation the flag was being cleared while hardware teardown
    was still in progress, creating a mismatch between software state
    (flag = 0, "ready") and hardware state (still terminating).
    
    Signed-off-by: Moteen Shah 
    Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com
    Signed-off-by: Greg Kroah-Hartman 

commit 623b07b370e9963122d167e04fdc1dc713ebfbaf
Author: Moteen Shah 
Date:   Mon Jan 12 13:48:28 2026 +0530

    serial: 8250: 8250_omap.c: Add support for handling UART error conditions
    
    The DMA IRQ handler does not accounts for the overrun(OE) or any other
    errors being reported by the IP before triggering a DMA transaction which
    leads to the interrupts not being handled resulting into an IRQ storm.
    
    The way to handle OE is to:
    1. Reset the RX FIFO.
    2. Read the UART_RESUME register, which clears the internal flag
    
    Earlier, the driver issued DMA transations even in case of OE which shouldn't
    be done according to the OE handling mechanism mentioned above, as we are
    resetting the FIFO's, refer section: "12.1.6.4.8.1.3.6 Overrun During
    Receive" [0].
    
    [0] https://www.ti.com/lit/pdf/spruiu1
    
    Signed-off-by: Moteen Shah 
    Link: https://patch.msgid.link/20260112081829.63049-2-m-shah@ti.com
    Signed-off-by: Greg Kroah-Hartman 

commit 93bb95a11238d66a4c9aa6eabf9774b073a5895c
Author: Randy Dunlap 
Date:   Sat Jan 10 15:26:43 2026 -0800

    serial: SH_SCI: improve "DMA support" prompt
    
    Having a prompt of "DMA support" suddenly appear during a
    "make oldconfig" can be confusing. Add a little helpful text to
    the prompt message.
    
    Fixes: 73a19e4c0301 ("serial: sh-sci: Add DMA support.")
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20260110232643.3533351-5-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit 2c468edb6b19ad00c247fc52dc6074e4012b46ed
Author: Randy Dunlap 
Date:   Sat Jan 10 15:26:42 2026 -0800

    serial: Kconfig: fix ordering of entries for menu display
    
    Improve the "Non-8250 serial port support" menu so that entries in it
    are displayed in a better order (_CONSOLE after its driver) and so that
    intervening symbols don't break up the dependency list, allowing menu
    entries to be displayed with proper indentation.
    
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20260110232643.3533351-4-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit 1ec8891402a6f755e2750a9be39434702d616146
Author: Randy Dunlap 
Date:   Sat Jan 10 15:26:41 2026 -0800

    serial: 8250: fix ordering of entries for menu display
    
    Improve the "8250/16550 serial support" menu so that entries in it
    are displayed in a better order (reorder a few symbols) and so that
    intervening symbols don't break up the dependency list, allowing menu
    entries to be displayed with proper indentation.
    
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20260110232643.3533351-3-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit 79527d86ba91c2d9354832d19fd12b3baa66bd10
Author: Randy Dunlap 
Date:   Sat Jan 10 15:26:40 2026 -0800

    serial: imx: change SERIAL_IMX_CONSOLE to bool
    
    SERIAL_IMX_CONSOLE is a build option for the imx driver (SERIAL_IMX).
    It does not build a separate console driver file, so it can't be built
    as a module since it isn't built at all.
    
    Change the Kconfig symbol from tristate to bool and update the help
    text accordingly.
    
    Fixes: 0db4f9b91c86 ("tty: serial: imx: enable imx serial console port as module")
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20260110232643.3533351-2-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit 79dd246c6eb305f13566739f9b1f34e092fec5e5
Author: Jose Javier Rodriguez Barbarin 
Date:   Thu Jan 8 14:41:10 2026 +0100

    8250_men_mcb: drop unneeded MODULE_ALIAS
    
    Since commit 1f4ea4838b13 ("mcb: Add missing modpost build support")
    the MODULE_ALIAS() is redundant as the module alias is now
    automatically generated from the MODULE_DEVICE_TABLE().
    
    Remove the explicit alias.
    
    No functional change intended.
    
    Reviewed-by: Jorge Sanjuan Garcia 
    Signed-off-by: Jose Javier Rodriguez Barbarin 
    Link: https://patch.msgid.link/20260108134110.25278-3-dev-josejavier.rodriguez@duagon.com
    Signed-off-by: Greg Kroah-Hartman 

commit afc57d096f897bd5244ed8e81700d5ad7c829a27
Author: Jose Javier Rodriguez Barbarin 
Date:   Thu Jan 8 14:41:09 2026 +0100

    serial: men_z135_uart: drop unneeded MODULE_ALIAS
    
    Since commit 1f4ea4838b13 ("mcb: Add missing modpost build support")
    the MODULE_ALIAS() is redundant as the module alias is now
    automatically generated from the MODULE_DEVICE_TABLE().
    
    Remove the explicit alias.
    
    No functional change intended.
    
    Reviewed-by: Jorge Sanjuan Garcia 
    Signed-off-by: Jose Javier Rodriguez Barbarin 
    Link: https://patch.msgid.link/20260108134110.25278-2-dev-josejavier.rodriguez@duagon.com
    Signed-off-by: Greg Kroah-Hartman 

commit 21566457614fc52b5799f96b996618709f74e419
Author: Lad Prabhakar 
Date:   Mon Dec 22 16:29:09 2025 +0000

    dt-bindings: serial: renesas,rsci: Document RZ/V2H(P) and RZ/V2N SoCs
    
    Document the serial communication interface (RSCI) used on the Renesas
    RZ/V2H(P) (R9A09G057) and RZ/V2N (R9A09G056) SoCs. These SoCs integrate
    the same RSCI IP block as the RZ/G3E (R9A09G047), so the RZ/G3E
    compatible is used as a fallback for both.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251222162909.155279-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit e74887035fba99ead63235740908debeb1326dad
Author: Prudhvi Yarlagadda 
Date:   Mon Aug 25 23:01:48 2025 -0700

    dt-bindings: PCI: qcom: Document the Glymur PCIe Controller
    
    On the Qualcomm Glymur platform the PCIe host is compatible with the DWC
    controller present on the X1E80100 platform. So document the PCIe
    controllers found on Glymur and use the X1E80100 compatible string as a
    fallback in the schema.
    
    Signed-off-by: Prudhvi Yarlagadda 
    Signed-off-by: Wenbin Yao 
    Signed-off-by: Manivannan Sadhasivam 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20250825-glymur_pcie5-v3-2-5c1d1730c16f@oss.qualcomm.com

commit b0e930a6360ff5f81045146f0a8fcac4f7897eda
Author: Kuan-Wei Chiu 
Date:   Tue Jan 13 09:25:58 2026 +0000

    dt-bindings: misc: google,android-pipe: Convert to DT schema
    
    Convert the Android Goldfish QEMU Pipe binding to DT schema format.
    Move the file to the misc directory as it represents a miscellaneous
    communication device.
    Update the example node name to 'pipe' to comply with generic node
    naming standards and fix the mismatch between unit address and reg
    property in the original example.
    
    Signed-off-by: Kuan-Wei Chiu 
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260113092602.3197681-3-visitorckw@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit ca1ceddfaa99e91da8b7ac24785b27d400b88309
Author: Nathan Chancellor 
Date:   Mon Jan 5 12:17:10 2026 -0700

    ntfs3: Restore NULL folio initialization in ntfs_writepages()
    
    Clang warns (or errors with CONFIG_WERROR=y):
    
      fs/ntfs3/inode.c:1021:6: error: variable 'folio' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
       1021 |         if (is_resident(ni)) {
            |             ^~~~~~~~~~~~~~~
      fs/ntfs3/inode.c:1024:48: note: uninitialized use occurs here
       1024 |                 while ((folio = writeback_iter(mapping, wbc, folio, &err)))
            |                                                              ^~~~~
    
    folio should be initialized to NULL for the first iteration of
    writeback_iter() to start the loop properly. Restore the NULL
    initialization of folio that was lost in the recent iomap conversion to
    clear up the warning.
    
    Fixes: 099ef9a ("fs/ntfs3: implement iomap-based file operations")
    Reported-by: kernel test robot 
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/oe-kbuild-all/202601010644.FIhOXy6Y-lkp@intel.com/
    Closes: https://lore.kernel.org/r/202601010513.axd56bks-lkp@intel.com/
    Signed-off-by: Nathan Chancellor 
    [almaz.alexandrovich@paragon-software.com: added a few more tags]
    Signed-off-by: Konstantin Komarov 

commit 5080a15d755be4ff72bc92df97475cf69ccf5e58
Author: Nayana Mariyappa 
Date:   Fri Jan 16 12:05:11 2026 +0000

    staging: rtl8723bs: expand multiple assignment into separate statements
    
    Split multiple assignments in a single line into separate statements in
    osdep_service.c to follow kernel coding style.
    No functional change.
    
    Signed-off-by: Nayana Mariyappa 
    Link: https://patch.msgid.link/20260116120511.48272-5-nayana.mariyappa@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 48f3cb74a1c1056fcbb3cf2b58233af512ea5c69
Author: Nayana Mariyappa 
Date:   Fri Jan 16 12:05:10 2026 +0000

    staging: rtl8723bs: add blank lines after declarations
    
    Added blank lines after variable declarations in osdep_service.c and related
    files to improve readability and follow kernel coding style.
    No functional change.
    
    Signed-off-by: Nayana Mariyappa 
    Link: https://patch.msgid.link/20260116120511.48272-4-nayana.mariyappa@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 79c2b4714040fe8fe9d811cde3cb7cae325089fe
Author: Nayana Mariyappa 
Date:   Fri Jan 16 12:05:09 2026 +0000

    staging: rtl8723bs: remove extra blank lines
    
    Removed unnecessary blank lines in osdep_service.c and related files
    to follow kernel coding style.
    No functional change.
    
    Signed-off-by: Nayana Mariyappa 
    Link: https://patch.msgid.link/20260116120511.48272-3-nayana.mariyappa@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 97ba152cd30cdb7ab0e017c4af497b39008649eb
Author: Nayana Mariyappa 
Date:   Fri Jan 16 12:05:08 2026 +0000

    staging: rtl8723bs: fix block comment style
    
    Fixed multi-line block comments in osdep_service.c to follow kernel
    coding style. Fixing the non-kernel-doc comment has been merged into this
    patch.
    No functional change.
    
    Signed-off-by: Nayana Mariyappa 
    Link: https://patch.msgid.link/20260116120511.48272-2-nayana.mariyappa@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 53e0181ee7225e3a1958c51b2f00f648878e91e1
Author: Khushal Chitturi 
Date:   Fri Jan 16 11:00:49 2026 +0530

    staging: rtl8723bs: fix operator and type cast spacing
    
    Fix spacing around operators and type casts in rtw_xmit.c to
    comply with the kernel coding style.
    
    Signed-off-by: Khushal Chitturi 
    
    Link: https://patch.msgid.link/20260116053052.4198-2-khushalchitturi@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit abe850d82c8cb72d28700673678724e779b1826e
Author: Diksha Kumari 
Date:   Tue Jan 13 14:47:12 2026 +0530

    staging: rtl8723bs: fix memory leak on failure path
    
    cfg80211_inform_bss_frame() may return NULL on failure. In that case,
    the allocated buffer 'buf' is not freed and the function returns early,
    leading to potential memory leak.
    Fix this by ensuring that 'buf' is freed on both success and failure paths.
    
    Signed-off-by: Diksha Kumari 
    Reviewed-by: Mukesh Kumar Chaurasiya 
    Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit f422140e5a17557af48b10ea76a8b29777ce4e4b
Author: Himanshu Bhavani 
Date:   Thu Jan 8 11:24:54 2026 +0530

    media: i2c: os05b10: Few minor improvements
    
    Return 0 from disable_streams, use div_u64() instead of do_div(), use
    dev_dbg() for a debug message and move loop variable definition into the
    loop itself.
    
    Signed-off-by: Himanshu Bhavani 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit df60764ea52102f433b76cfa4fc873229e60e76c
Author: Richard Leitner 
Date:   Tue Dec 9 23:44:43 2025 +0100

    media: i2c: ov9282: dynamic flash_duration maximum
    
    This patch sets the current exposure time as maximum for the
    flash_duration control. As Flash/Strobes which are longer than the
    exposure time have no effect.
    
    Signed-off-by: Richard Leitner 
    [Sakari Ailus: Some lines rewrapped.]
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit b95d8058a2786a8b42e32f383f8df45097675d00
Author: Richard Leitner 
Date:   Tue Dec 9 23:44:42 2025 +0100

    media: i2c: ov9282: implement try_ctrl for strobe_duration
    
    As the granularity of the hardware supported values is lower than the
    control value, implement a try_ctrl() function for
    V4L2_CID_FLASH_DURATION. This function calculates the nearest possible
    µs strobe duration for the given value and returns it back to the
    caller.
    
    Signed-off-by: Richard Leitner 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 84ec7597ae1afb9430c55044f318d1d40f8ecef0
Author: Richard Leitner 
Date:   Tue Dec 9 23:44:41 2025 +0100

    media: i2c: ov9282: add strobe_duration v4l2 control
    
    Add V4L2_CID_FLASH_DURATION support using the "strobe_frame_span"
    feature of the sensor. This is implemented by transforming the given µs
    value by an interpolated formula to a "span step width" value and
    writing it to register PWM_CTRL_25, PWM_CTRL_26, PWM_CTRL_27,
    PWM_CTRL_28 (0x3925, 0x3926, 0x3927, 0x3928).
    
    The maximum control value is set to the period of the current default
    framerate.
    
    All register values are based on the OV9281 datasheet v1.53 (jan 2019)
    and tested using an ov9281 VisionComponents module.
    
    Signed-off-by: Richard Leitner 
    [Sakari Ailus: Remove redundant assignment of ret, declare ret as last.]
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit f007ad65d7246d6b616541a3c7685ec688ca6beb
Author: Richard Leitner 
Date:   Tue Dec 9 23:44:40 2025 +0100

    media: i2c: ov9282: add strobe output enable v4l2 control
    
    Add V4L2_CID_FLASH_STROBE_OE enable/disable support using the
    "strobe output enable" feature of the sensor.
    
    All values are based on the OV9281 datasheet v1.53 (january 2019) and
    tested using an ov9281 VisionComponents module.
    
    Signed-off-by: Richard Leitner 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 47bc0d294d66a7019f13aa65e8b32aee4532869e
Author: Richard Leitner 
Date:   Tue Dec 9 23:44:39 2025 +0100

    media: i2c: ov9282: add output enable register definitions
    
    Add #define's for the output enable registers (0x3004, 0x3005, 0x3006),
    also known as SC_CTRL_04, SC_CTRL_05, SC_CTRL_04. Use those register
    definitions instead of the raw values in the `common_regs` struct.
    
    All values are based on the OV9281 datasheet v1.53 (january 2019).
    
    Reviewed-by: Dave Stevenson 
    Signed-off-by: Richard Leitner 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit fa0e06f2fe00fa9e283a15d85e7542a4b72a14a7
Author: Richard Leitner 
Date:   Tue Dec 9 23:44:38 2025 +0100

    Documentation: uAPI: media: add V4L2_CID_FLASH_{DURATION,STROBE_OE}
    
    Add the new strobe duration and hardware strobe output enable to v4l
    uAPI documentation. Additionally add labels for cross-referencing v4l
    controls.
    
    Signed-off-by: Richard Leitner 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 5be4154f6255d92d9d2ad5da658d7d33a655386f
Author: Richard Leitner 
Date:   Tue Dec 9 23:44:37 2025 +0100

    media: v4l: ctrls: add a control for enabling strobe output
    
    Add a control V4L2_CID_FLASH_STROBE_OE to en- or disable the
    strobe output of v4l2 devices (most likely sensors).
    
    Signed-off-by: Richard Leitner 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit d89ccbf3dde727d91a242a5a3f3b70a90579b057
Author: Richard Leitner 
Date:   Tue Dec 9 23:44:36 2025 +0100

    media: v4l: ctrls: add a control for flash/strobe duration
    
    Add a V4L2_CID_FLASH_DURATION control to set the duration of a
    flash/strobe pulse. This controls the length of the flash/strobe pulse
    output by device (typically a camera sensor) and connected to the flash
    controller. This is different to the V4L2_CID_FLASH_TIMEOUT control,
    which is implemented by the flash controller and defines a limit after
    which the flash is "forcefully" turned off again.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Richard Leitner 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 59b9548e50d2c5ea4209733f919a35675cd78f28
Author: Laurent Pinchart 
Date:   Sat Aug 19 02:40:28 2023 +0300

    media: i2c: imx219: Inline imx219_update_pad_format() in its caller
    
    The imx219_update_pad_format() is short and called from a single place,
    in imx219_set_pad_format(). Inline the code in the caller to keep all
    format adjustments grouped in a single place and improve readability.
    
    Signed-off-by: Laurent Pinchart 
    Reviewed-by: Jacopo Mondi 
    Reviewed-by: Dave Stevenson 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 0b216f7f172bfa10281dd2e7ef57292415b41849
Author: Sakari Ailus 
Date:   Wed Jan 7 14:55:40 2026 +0200

    media: ccs: Make supported mbus code bitmask a u64
    
    Prepare for adding more media bus codes.
    
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 026d02ea142deb56fe997df8d29417ca6cc3b862
Author: Sakari Ailus 
Date:   Wed Oct 11 14:57:52 2023 +0300

    media: ccs: Remove which parameter from ccs_propagate
    
    ccs_propagate() no longer stores information in the driver's context
    struct. The which parameter can thus be removed.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit ce7b25c0170a0942b56e566b95bdc1e5efcc40f8
Author: Sakari Ailus 
Date:   Tue Oct 10 22:57:00 2023 +0300

    media: ccs: Compute scaling configuration from sub-device state
    
    Compute scaling configuration from sub-device state instead of storing it
    to the driver's device context struct.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 7858ac7a8a6415eafb5ac027aaa9acf3ec78cc31
Author: Sakari Ailus 
Date:   Tue Oct 10 22:53:04 2023 +0300

    media: ccs: Compute binning configuration from sub-device state
    
    Calculate binning configuration from sub-device state so the state related
    configuration can be removed from the driver's device context struct.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit ea3674c4465c11ab5181820405fcc9361f1d000a
Author: Sakari Ailus 
Date:   Fri Jan 16 12:56:56 2026 +0200

    media: ccs: Switch to guard and scoped_guard
    
    Replace the use of mutex_{,un}lock() by guard() and scoped_guard() where
    it makes sense (i.e. everywhere).
    
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit a88883d1209c3c759ebaa7886d9a7098d5ed1132
Author: Sakari Ailus 
Date:   Wed Sep 6 11:04:31 2023 +0300

    media: ccs: Rely on sub-device state locking
    
    Rely on sub-device state locking to serialise access to driver's data
    structures. The driver-provided mutex is used as the state lock for all
    driver sub-devices.
    
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 0fc3caab96c9e713e897ff4cf3b42b1b409236d1
Author: Sakari Ailus 
Date:   Mon Sep 25 11:23:08 2023 +0300

    media: ccs: Remove ccs_get_crop_compose helper
    
    As it's now easier to obtain the necessary information on crop and compose
    rectangles after moving to sub-device state, remove the
    ccs_get_crop_compose helper.
    
    Also remove the comp arguments of the compose goodness calculators and
    make related local variables and function arguments const where
    applicable.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 91848c99ed6a98daf77f4cb7d44cf3f13bc6998f
Author: Mehdi Djait 
Date:   Thu Jan 8 14:57:38 2026 +0100

    media: i2c: ov01a10: Fix digital gain range
    
    Digital gain wraps-around at the maximum of 16838 / 0x3fff.
    Fix the maximum digital gain by setting it to 0x3fff.
    
    Signed-off-by: Mehdi Djait 
    Reviewed-by: Hans de Goede 
    Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 90002a0ba29ebda54853f2113e769d651f509309
Author: Sakari Ailus 
Date:   Mon Jan 12 22:45:56 2026 +0200

    media: ov01a10: Fix indentation
    
    Fix indentation in ov01a10_get_pm_resources().
    
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 2eeefb22f9409ad24213184e967f63fe77f21194
Author: Sakari Ailus 
Date:   Wed Jan 14 11:54:15 2026 +0200

    media: ipu6: Update e-mail addresses
    
    Remove Hongju's e-mail address that no longer works.
    
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 8e3c7238481bb36485935151ce4ee0dc4cb72dca
Author: Alain Volmat 
Date:   Fri Dec 19 15:30:40 2025 +0100

    media: stm32: dcmipp: bytecap: remove useless cmier variable
    
    The struct dcmipp_bytecap_device embeds a cmier variable which is
    actually only set once and then used in several places for interrupt
    mask or interrupt enable/disable. Use the DCMIPP_CMIER_P0ALL
    bitfield macro directly instead of using it through the cmier
    variable.
    
    There is also no need to mask again vcap->cmsr2 against enabled
    interrupts bit since this has already been done when storing the
    interrupt status into the cmsr2 variable.
    
    Signed-off-by: Alain Volmat 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 8a71f1f8d91fb10d306857c0f198a940c1d22e06
Author: Alain Volmat 
Date:   Fri Dec 19 15:30:39 2025 +0100

    media: stm32: dcmipp: byteproc: only allow compose with 8/16bit fmts
    
    Since the byteproc is working at byte level, it is not possible to
    perform decimation with formats other than 8 or 16 bit per pixel.
    Ensure any other format won't be able to set a compose.
    
    Signed-off-by: Alain Volmat 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 0085da1315898ea27bcb323e456ca1d39d43e96a
Author: Alain Volmat 
Date:   Fri Dec 19 15:30:38 2025 +0100

    media: stm32: dcmipp: add Y10-Y12-Y14 in all subdevs
    
    DCMIPP can handle Y8 to Y14 input formats however until now only
    Y8 was handled. Add support for Y10-Y12-Y14 in all relevant
    subdevs.
    
    Signed-off-by: Alain Volmat 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit f29f8bfcb0555801e22e29acd2c83c3d3ee9d20d
Author: Alain Volmat 
Date:   Fri Dec 19 15:30:37 2025 +0100

    media: stm32: dcmipp: Add RGB888 format support overall
    
    Add entries within several subdevs in order to handle RGB888 format.
    
    Signed-off-by: Alain Volmat 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 3363aa2640f1738ad7fc56ea56f5e0301ad97196
Author: Alain Volmat 
Date:   Fri Dec 19 15:30:36 2025 +0100

    media: stm32: dcmipp: byteproc: disable compose for all bayers
    
    Avoid possibility to perform compose on all frames which mbus code is
    within the bayer range or jpeg format.
    
    Fixes: 822c72eb1519 ("media: stm32: dcmipp: add bayer 10~14 bits formats")
    Cc: stable@vger.kernel.org
    Signed-off-by: Alain Volmat 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 222f1279edd9008ee35b62de156ddac84e31443c
Author: Alain Volmat 
Date:   Fri Dec 19 15:30:35 2025 +0100

    media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
    
    Ensure that there are no pending interrupts after we have stopped the
    pipeline. Indeed, it could happen that new interrupt has been generated
    during the stop_streaming processing hence clear them in order to avoid
    getting a new interrupt right from the start of a next start_streaming.
    
    Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Alain Volmat 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 5152437f7610eb522fd233ab548a19d4601cbc2a
Author: Krzysztof Kozlowski 
Date:   Tue Dec 30 09:34:36 2025 +0100

    media: i2c: Add note to prevent buggy code re-use
    
    adv7604 and et8ek8 sensor drivers have mixed up logical and line level
    for reset/powerdown signal.  They call it a reset signal (it indeed
    behaves like that), but drivers assert the reset to operate which is
    clearly incorrect and relies on wrong ACTIVE_HIGH flag in the DTS.
    
    People in discussions copy existing poor code and claim they can repeat
    same mistake, so add a note to prevent that.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 2f130245f2143fa8f4da77071f844911d2c69319
Author: Alain Volmat 
Date:   Mon Dec 15 13:10:19 2025 +0100

    media: stm32: dcmipp: avoid naming clock if only one is needed
    
    When DCMIPP requires only a single clock (kclk), avoid relying on its
    name to obtain it. The introduction of MP25 support added the mclk,
    which necessitated naming the first clock kclk. However, this breaks
    backward compatibility with existing MP13 device trees that do not
    specify clock names.
    
    Fixes: 686f27f7ea37 ("media: stm32: dcmipp: add core support for the stm32mp25")
    Signed-off-by: Alain Volmat 
    Cc: Stable@vger.kernel.org # 6.14.x: 7f487562af49 media: stm32: dcmipp: correct ret type in dcmipp_graph_notify_bound
    Cc: Stable@vger.kernel.org # 6.14.x: c715dd62da30 media: stm32: dcmipp: add has_csi2 & needs_mclk in match data
    Cc: Stable@vger.kernel.org # 6.14.x:
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 4d4135dd953395c311cd630d69658d7b8af9d39d
Author: Frank Li 
Date:   Mon Dec 15 10:19:30 2025 -0500

    MAINTAINERS: Promote Frank Li as i.MX7/8 media maintainer
    
    Move Rui Miguel Silva to reviewer since he does not have sufficient time to
    maintain i.MX7/8 media drivers. Frank Li has the hardware, complete
    documentation, and has participated actively in patch review. Promote him
    as the i.MX7/8 media drivers maintainer.
    
    Reviewed-by: Rui Miguel Silva 
    Signed-off-by: Frank Li 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 3085977e734dab74adebb1dda195befce25addff
Author: David Heidelberg 
Date:   Fri Jan 9 18:57:07 2026 +0100

    media: ccs: Accommodate C-PHY into the calculation
    
    We need to set correct mode for PLL to calculate correct frequency.
    Signalling mode is known at this point, so use it for that.
    
    Fixes: 47b6eaf36eba ("media: ccs-pll: Differentiate between CSI-2 D-PHY and C-PHY")
    Reviewed-by: Mehdi Djait 
    Signed-off-by: David Heidelberg 
    [Sakari Ailus: Drop extra newline.]
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 08e47937637e7255509efa421260f46d212ddf96
Author: Sakari Ailus 
Date:   Fri Jan 9 11:00:21 2026 +0200

    media: ccs: Use devm_v4l2_sensor_clk_get()
    
    Rely on devm_v4l2_sensor_clk_get() to obtain the sensor's external clock.
    
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit bc6af7695a511b93f43e5ab4f872bcbccb580380
Author: Sakari Ailus 
Date:   Fri Jan 9 10:53:40 2026 +0200

    media: ccs: Clean up ccs_get_hwcfg() a little
    
    Fix coding style issues and do other small cleanups in ccs_get_hwcfg().
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: David Heidelberg 
    Signed-off-by: Hans Verkuil 

commit 98cf5594c2fbe07f47e861ceb942327681207fbe
Author: Xiaolei Wang 
Date:   Thu Jan 8 13:21:59 2026 +0800

    media: i2c: ov5647: switch to {enable,disable}_streams
    
    Switch from s_stream to enable_streams and disable_streams callbacks.
    
    Signed-off-by: Xiaolei Wang 
    Reviewed-by: Laurent Pinchart 
    Reviewed-by: Tarang Raval 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit ebcb6cafd10fe601bd7e55f1ce07c17c62f877be
Author: Xiaolei Wang 
Date:   Thu Jan 8 13:21:58 2026 +0800

    media: i2c: ov5647: Switch to using the sub-device state lock
    
    Switch to using the sub-device state lock and properly call
    v4l2_subdev_init_finalize() / v4l2_subdev_cleanup() on probe() /
    remove().
    
    Signed-off-by: Xiaolei Wang 
    Reviewed-by: Tarang Raval 
    [Sakari Ailus: Remove now-redundant assignment of control handler lock.]
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 4f66f36388d5668c215f107a4e1ce1a707251ff5
Author: Xiaolei Wang 
Date:   Thu Jan 8 13:21:57 2026 +0800

    media: i2c: ov5647: Convert to CCI register access helpers
    
    Use the new common CCI register access helpers to replace the private
    register access helpers in the ov5647 driver. This simplifies the driver
    by reducing the amount of code.
    
    Signed-off-by: Xiaolei Wang 
    Reviewed-by: Tarang Raval 
    Reviewed-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 6cb679d8fe309e94f46943678d8ee965e4b42c5f
Author: ArchitAnant 
Date:   Wed Jan 14 15:19:48 2026 +0530

    staging: rtl8723bs: remove unnecessary blank lines
    
    Remove blank lines before closing braces to comply with
    the Linux kernel coding style.
    
    Issue identified by checkpatch.pl.
    
    Signed-off-by: ArchitAnant 
    Link: https://patch.msgid.link/20260114094949.14825-3-architanant5@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit f51af069a96b8541fe302913a894a1e76f74c626
Author: William Hansen-Baird 
Date:   Tue Jan 13 16:14:33 2026 -0500

    staging: rtl8723bs: core/rtw_mlme_ext.c: flatten indentation with early loop continue in OnAssocReq()
    
    Replace large if (memcmp(p+2, WMM_IE, 6)) inside the for (;;) loop,
    which ends with a break, with an early continue.
    This reduces deep nesting and is purely stylistic.
    
    Signed-off-by: William Hansen-Baird 
    Link: https://patch.msgid.link/20260113211433.89512-2-william.hansen.baird@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit ccfab310ee181ab03f46c53413d57468199e29eb
Author: William Hansen-Baird 
Date:   Tue Jan 13 16:14:32 2026 -0500

    staging: rtl8723bs: core/rtw_mlme_ext.c: flatten control flow in OnAssocReq()
    
    Rewrite if-else construct with an early exit to reduce indentation,
    and make the execution clearer.
    
    Signed-off-by: William Hansen-Baird 
    Link: https://patch.msgid.link/20260113211433.89512-1-william.hansen.baird@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit fbe360699266d0fb3072a81175ea656f313418ed
Author: Matous Jarolim 
Date:   Tue Jan 13 18:03:46 2026 +0100

    staging: rtl8723bs: Rename supportRate and SupportRateNum to snake_case
    
    renamed variables supportRate and supportRateNum to support_rate and
    support_rate_num to adhere to the linux kernel coding style which mandates
    snake_case for variable names.
    
    This fixes the following checkpatch.pl warning:
        CHECK: Avoid CamelCase: 
        CHECK: Avoid CamelCase: 
    
    Signed-off-by: Matous Jarolim 
    Link: https://patch.msgid.link/20260113170346.557634-1-matous.jarolim.lkml@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 4e4d7aebabc2eb16b37c4cadb0e61b8d52ddd112
Author: Mahad Ibrahim 
Date:   Mon Jan 12 22:42:24 2026 +0500

    staging: rtl8723bs: Fix block comment alignment in HalHWImg8723B_RF.c
    
    Fix checkpatch.pl warnings regarding block comment alignment.
    
    Adhere to kernel coding style by fixing block comments.
    
    Signed-off-by: Mahad Ibrahim 
    Link: https://patch.msgid.link/20260112174227.14922-8-mahad.ibrahim.dev@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 6e5225924c607e528f584e3f17dfa73cf8c8893b
Author: Mahad Ibrahim 
Date:   Mon Jan 12 22:42:22 2026 +0500

    staging: rtl8723bs: Fix spacing coding style issues in HalHWImg8723B_BB.c
    
    Fix checkpatch.pl checks regarding "spaces preferred around that"
    operator.
    
    Adhere to kernel coding standards by adding spaces around arithmetic and
    bitwise operations.
    
    Signed-off-by: Mahad Ibrahim 
    Link: https://patch.msgid.link/20260112174227.14922-6-mahad.ibrahim.dev@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit e21373781392e7159d4b27fb66c32afdc8e3e165
Author: Mahad Ibrahim 
Date:   Mon Jan 12 22:42:21 2026 +0500

    staging: rtl8723bs: Fix block comment alignment in HalHWImg8723B_BB.c
    
    Fix checkpatch.pl warnings regarding block comment alignment.
    The warnings were: "Block comments should align the * on each line".
    
    This patch aligns the asterisks in the block comments so they adhere to
    the kernel coding style.
    
    Signed-off-by: Mahad Ibrahim 
    Link: https://patch.msgid.link/20260112174227.14922-5-mahad.ibrahim.dev@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 557913e85d232a6074c2ece42bb211f281868000
Author: Mahad Ibrahim 
Date:   Mon Jan 12 22:42:19 2026 +0500

    staging: rtl8723bs: Fix spaces around operator checks in HalHWImg8723B_MAC.c
    
    Fix checkpatch.pl checks in HalHWImg8723B_MAC.c regarding:
    -Spaces preferred around that operator
    
    Adhere to kernel coding style by adding spaces around operators.
    
    Signed-off-by: Mahad Ibrahim 
    Link: https://patch.msgid.link/20260112174227.14922-3-mahad.ibrahim.dev@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit b3c36acadc5b81678db37ff0e986435d720e89f7
Author: Mahad Ibrahim 
Date:   Mon Jan 12 22:42:18 2026 +0500

    staging: rtl8723bs: Fix block comment alignment in HalHWImg8723B_MAC.c
    
    Fix checkpatch warnings regarding block comment alignment.
    The warnings were: "Block comments should align the * on each line".
    
    This patch aligns the asterisks in the block comments to match the
    kernel coding style.
    
    Signed-off-by: Mahad Ibrahim 
    Link: https://patch.msgid.link/20260112174227.14922-2-mahad.ibrahim.dev@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit b98bdc55a10c8d26f826c2cceb6cfc1d0392429c
Author: Marco Crivellari 
Date:   Tue Jan 13 14:57:37 2026 +0100

    staging: greybus: add WQ_PERCPU to alloc_workqueue users
    
    This continues the effort to refactor workqueue APIs, which began with
    the introduction of new workqueues and a new alloc_workqueue flag in:
    
       commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
       commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    The refactoring is going to alter the default behavior of
    alloc_workqueue() to be unbound by default.
    
    With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
    any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
    must now use WQ_PERCPU. For more details see the Link tag below.
    
    In order to keep alloc_workqueue() behavior identical, explicitly request
    WQ_PERCPU.
    
    Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Link: https://patch.msgid.link/20260113135737.190636-1-marco.crivellari@suse.com
    Signed-off-by: Greg Kroah-Hartman 

commit 45432aa97a5e249c6fc815d8c44c7066e3c855bd
Author: Vo Thanh Cong 
Date:   Tue Jan 13 17:37:38 2026 +0700

    staging: rtl8723bs: remove unnecessary else after break
    
    This patch fixes the checkpatch.pl warning:
    "WARNING: else is not generally useful after a break or return"
    
    In sdio_ops_linux.c, the else blocks after break statements are
    redundant. Removing them reduces indentation level and improves
    code readability.
    
    Signed-off-by: Vo Thanh Cong 
    Link: https://patch.msgid.link/20260113103738.207570-1-thanhcongvo079@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit fa3bb5011f33cccd246072954e64d64483d0d774
Author: Chaoyi Chen 
Date:   Tue Jan 13 17:58:27 2026 +0800

    usb: misc: onboard_dev: Add WCH CH334 USB2.0 Hub (1a86:8091)
    
    The WCH CH334/CH335[0] are USB2.0 protocol compliant 4-port USB HUB
    controller chips, supporting USB2.0 high-speed and full-speed for
    upstream ports, and USB2.0 high-speed 480Mbps, full-speed 12Mbps and
    low-speed 1.5Mbps for downstream ports, supporting not only low-cost STT
    mode (single TT schedules 4 downstream ports in time share), but also
    supports high performance MTT mode (4 TTs each corresponding to 1 port,
    concurrent processing).
    
    [0]: https://www.wch-ic.com/downloads/CH334DS1_PDF.html
    
    Signed-off-by: Chaoyi Chen 
    Link: https://patch.msgid.link/20260113095827.115-3-kernel@airkyi.com
    Signed-off-by: Greg Kroah-Hartman 

commit 00fcc9c86a134c488fd857b5460a7925228272c1
Author: Chaoyi Chen 
Date:   Tue Jan 13 17:58:26 2026 +0800

    dt-bindings: usb: Add binding for WCH CH334/CH335 hub controller
    
    The WCH CH334/CH335[0] are USB2.0 protocol compliant 4-port USB HUB
    controller chips, supporting USB2.0 high-speed and full-speed for
    upstream ports, and USB2.0 high-speed 480Mbps, full-speed 12Mbps and
    low-speed 1.5Mbps for downstream ports, supporting not only low-cost STT
    mode (single TT schedules 4 downstream ports in time share), but also
    supports high performance MTT mode (4 TTs each corresponding to 1 port,
    concurrent processing).
    
    Add a device tree binding for it.
    
    [0]: https://www.wch-ic.com/downloads/CH334DS1_PDF.html
    
    Signed-off-by: Chaoyi Chen 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260113095827.115-2-kernel@airkyi.com
    Signed-off-by: Greg Kroah-Hartman 

commit 9accc68b1cf0a2b220f51d53641128bb32598070
Author: Prashanth K 
Date:   Wed Jan 14 15:37:47 2026 +0530

    usb: dwc3: Add dwc pointer to dwc3_readl/writel
    
    Use dwc pointer in dwc3_readl() dwc3_writel() instead of passing
    the dwc->regs. This would help us access the dwc structure and
    log the base address in traces. There's no functional changes in
    this patch, just refactoring existing APIs.
    
    Signed-off-by: Prashanth K 
    Acked-by: Thinh Nguyen 
    Link: https://patch.msgid.link/20260114100748.2950103-3-prashanth.k@oss.qualcomm.com
    Signed-off-by: Greg Kroah-Hartman 

commit abdd1eef04f0cb3b1707cd1fa243d574d5e07024
Author: Prashanth K 
Date:   Wed Jan 14 15:37:46 2026 +0530

    usb: dwc3: Remove of dep->regs
    
    Remove dep->regs from struct dwc3_ep and reuse dwc->regs instead.
    Thus eliminating redundant iomem addresses and making register
    access more consistent across the driver.
    
    Signed-off-by: Prashanth K 
    Acked-by: Thinh Nguyen 
    Link: https://patch.msgid.link/20260114100748.2950103-2-prashanth.k@oss.qualcomm.com
    Signed-off-by: Greg Kroah-Hartman 

commit 7021f6c038d0ecd1535e279dfd18dc4bf2dd899e
Author: Johan Hovold 
Date:   Wed Dec 10 13:02:58 2025 +0900

    i2c: amd-mp2: clean up amd_mp2_find_device()
    
    Rename the driver data pointer for consistency with the rest of the
    driver and drop a redundant cast.
    
    Signed-off-by: Johan Hovold 
    Reviewed-by: Shyam Sundar S K 
    Link: https://lore.kernel.org/r/20251210040258.60106-1-johan@kernel.org
    Signed-off-by: Andi Shyti 

commit 8a59954192eba2d9dd2248dcc7b1f458c082eff2
Author: Ashish Mhetre 
Date:   Tue Jan 13 05:49:34 2026 +0000

    dt-bindings: iommu: Add NVIDIA Tegra CMDQV support
    
    The Command Queue Virtualization (CMDQV) hardware is part of the
    SMMUv3 implementation on NVIDIA Tegra SoCs. It assists in
    virtualizing the command queue for the SMMU.
    
    Add a new device tree binding document for nvidia,tegra264-cmdqv.
    
    Also update the arm,smmu-v3 binding to include an optional nvidia,cmdqv
    property. This property is a phandle to the CMDQV device node, allowing
    the SMMU driver to associate with its corresponding CMDQV instance.
    Restrict this property usage to Nvidia Tegra264 only.
    
    Reviewed-by: Rob Herring (Arm) 
    Acked-by: Nicolin Chen 
    Signed-off-by: Ashish Mhetre 
    Reviewed-by: Jon Hunter 
    Signed-off-by: Thierry Reding 

commit 77449e453dfc006ad738dec55374c4cbc056fd39
Author: Abhishek Bapat 
Date:   Thu Jan 15 21:31:03 2026 +0000

    quota: fix livelock between quotactl and freeze_super
    
    When a filesystem is frozen, quotactl_block() enters a retry loop
    waiting for the filesystem to thaw. It acquires s_umount, checks the
    freeze state, drops s_umount and uses sb_start_write() - sb_end_write()
    pair to wait for the unfreeze.
    
    However, this retry loop can trigger a livelock issue, specifically on
    kernels with preemption disabled.
    
    The mechanism is as follows:
    1. freeze_super() sets SB_FREEZE_WRITE and calls sb_wait_write().
    2. sb_wait_write() calls percpu_down_write(), which initiates
       synchronize_rcu().
    3. Simultaneously, quotactl_block() spins in its retry loop, immediately
       executing the sb_start_write() - sb_end_write() pair.
    4. Because the kernel is non-preemptible and the loop contains no
       scheduling points, quotactl_block() never yields the CPU. This
       prevents that CPU from reaching an RCU quiescent state.
    5. synchronize_rcu() in the freezer thread waits indefinitely for the
       quotactl_block() CPU to report a quiescent state.
    6. quotactl_block() spins indefinitely waiting for the freezer to
       advance, which it cannot do as it is blocked on the RCU sync.
    
    This results in a hang of the freezer process and 100% CPU usage by the
    quota process.
    
    While this can occur intermittently on multi-core systems, it is
    reliably reproducing on a node with the following script, running both
    the freezer and the quota toggle on the same CPU:
    
      # mkfs.ext4 -O quota /dev/sda 2g && mkdir a_mount
      # mount /dev/sda -o quota,usrquota,grpquota a_mount
      # taskset -c 3 bash -c "while true; do xfs_freeze -f a_mount; \
        xfs_freeze -u a_mount; done" &
      # taskset -c 3 bash -c "while true; do quotaon a_mount; \
        quotaoff a_mount; done" &
    
    Adding cond_resched() to the retry loop fixes the issue. It acts as an
    RCU quiescent state, allowing synchronize_rcu() in percpu_down_write()
    to complete.
    
    Fixes: 576215cffdef ("fs: Drop wait_unfrozen wait queue")
    Signed-off-by: Abhishek Bapat 
    Link: https://patch.msgid.link/20260115213103.1089129-1-abhishekbapat@google.com
    Signed-off-by: Jan Kara 

commit d3b9e6d5b4da3961d8cc4fce1d867f89621420cb
Author: Thierry Reding 
Date:   Wed Nov 5 20:53:40 2025 +0100

    dt-bindings: memory: tegra: Document DBB clock for Tegra264
    
    Accesses to external memory are routed through the data backbone (DBB)
    on Tegra264. A separate clock feeds this path and needs to be enabled
    whenever an IP block makes an access to external memory. The external
    memory controller driver is the best place to control this clock since
    it knows how many devices are actively accessing memory.
    
    Document the presence of this clock on Tegra264 only.
    
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Thierry Reding 

commit a3ceeadb287ce35eedc4cf0f55e1295d69617354
Author: Jon Hunter 
Date:   Wed Nov 19 09:37:28 2025 +0000

    dt-bindings: tegra: pmc: Update aotag as an optional aperture
    
    Not all Tegra SoCs or all versions of a particular Tegra SoC may include
    the AOTAG aperture. This change makes "aotag" as an optional aperture for
    Tegra234 and Tegra264.
    
    Co-developed-by: Prathamesh Shete 
    Signed-off-by: Prathamesh Shete 
    Signed-off-by: Jon Hunter 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Thierry Reding 

commit 53289af62b66812d07a7b0f5f9d62f429c94d317
Author: Michael Walle 
Date:   Thu Jan 15 14:14:19 2026 +0100

    arm64: dts: ti: k3-am67a-kontron-sa67-base: Fix SD card regulator
    
    The property "enable-active-high" was missing, as the default is
    active-low. Add it.
    
    Fixes: 1c3c4df06f9d ("arm64: dts: ti: Add support for Kontron SMARC-sAM67")
    Signed-off-by: Michael Walle 
    Link: https://patch.msgid.link/20260115131431.1521102-3-mwalle@kernel.org
    Signed-off-by: Nishanth Menon 

commit 8304c44631c370646de35d343ddba078738d1719
Author: Deborah Brouwer 
Date:   Thu Jan 15 11:38:43 2026 -0800

    drm/tyr: use generated bindings for GpuInfo
    
    Currently Tyr's struct GpuInfo is manually copied and updated from
    include/uapi/drm/panthor_drm.h. But an auto generated struct is
    available, so use that instead to avoid copy/paste errors and to stay
    up-to-date with the panthor uapi.
    
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Daniel Almeida 
    Signed-off-by: Deborah Brouwer 
    Link: https://patch.msgid.link/20260115193843.34878-1-deborah.brouwer@collabora.com
    Signed-off-by: Alice Ryhl 

commit dc23806a7c47ec5f1293aba407fb69519f976ee0
Author: Gui-Dong Han 
Date:   Wed Jan 14 00:28:43 2026 +0800

    driver core: enforce device_lock for driver_match_device()
    
    Currently, driver_match_device() is called from three sites. One site
    (__device_attach_driver) holds device_lock(dev), but the other two
    (bind_store and __driver_attach) do not. This inconsistency means that
    bus match() callbacks are not guaranteed to be called with the lock
    held.
    
    Fix this by introducing driver_match_device_locked(), which guarantees
    holding the device lock using a scoped guard. Replace the unlocked calls
    in bind_store() and __driver_attach() with this new helper. Also add a
    lock assertion to driver_match_device() to enforce this guarantee.
    
    This consistency also fixes a known race condition. The driver_override
    implementation relies on the device_lock, so the missing lock led to the
    use-after-free (UAF) reported in Bugzilla for buses using this field.
    
    Stress testing the two newly locked paths for 24 hours with
    CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence
    and no lockdep warnings.
    
    Cc: stable@vger.kernel.org
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
    Suggested-by: Qiu-ji Chen 
    Signed-off-by: Gui-Dong Han 
    Fixes: 49b420a13ff9 ("driver core: check bus->match without holding device lock")
    Reviewed-by: Danilo Krummrich 
    Reviewed-by: Greg Kroah-Hartman 
    Reviewed-by: Rafael J. Wysocki (Intel) 
    Link: https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com
    Signed-off-by: Danilo Krummrich 

commit 11a6a5bb72ce271de24330fd859e83f7bc281609
Author: Michael Walle 
Date:   Thu Jan 15 14:14:18 2026 +0100

    arm64: dts: ti: k3-am67a-kontron-sa67-base: Fix CMA node
    
    Fix the size of the CMA node by making it a 64bit size. This was
    probably a copy&paste mistake. Also drop the unneeded alignment.
    
    Fixes: 1c3c4df06f9d ("arm64: dts: ti: Add support for Kontron SMARC-sAM67")
    Signed-off-by: Michael Walle 
    Link: https://patch.msgid.link/20260115131431.1521102-2-mwalle@kernel.org
    Signed-off-by: Nishanth Menon 

commit ac838e45b46f33ae8ab7195892f4dcf1143a161b
Author: Beleswar Padhi 
Date:   Wed Jan 14 23:05:51 2026 +0530

    arm64: dts: ti: k3-am62p-j722s-common-main: Add HSM M4F node
    
    The TI K3 AM62P and J722S SoCs have a HSM (High Security Module) M4F
    core in the MAIN Voltage Domain which could be used to run secure
    services like Authentication. Add Device Tree Node definitions for the
    HSM core in the respective SoC common main dtsi file.
    
    The HSM node is reserved to be loaded and booted by the early-stage
    bootloader. The firmware-name property is defined at the SoC level
    since the HSM is not a general-purpose remote core and boards are
    unlikely to use separate firmware. If needed in exceptional cases,
    board-specific device trees can override this property.
    
    The corresponding reg ranges of HSM node has also been added to its
    parent node's (cbass_main bus) ranges property.
    
    Signed-off-by: Beleswar Padhi 
    Reviewed-by: Udit Kumar 
    Reviewed-by: Bryan Brattlof 
    Link: https://patch.msgid.link/20260114173551.2545088-3-b-padhi@ti.com
    Signed-off-by: Nishanth Menon 

commit 474530ef050b77482365de8c595b491f1d4ba683
Author: Beleswar Padhi 
Date:   Wed Jan 14 23:05:50 2026 +0530

    arm64: dts: ti: k3-{j784s4-j742s2/j721s2}-mcu-wakeup: Add HSM M4F node
    
    The TI K3 J721S2, J784S4 and J742S2 SoCs have a HSM (High Security
    Module) M4F core in the Wakeup Voltage Domain which could be used to run
    secure services like Authentication. Add Device Tree Node definitions
    for the HSM core in the respective SoC wakeup dtsi files.
    
    The HSM node is reserved to be loaded and booted by the early-stage
    bootloader. The firmware-name property is defined at the SoC level
    since the HSM is not a general-purpose remote core and boards are
    unlikely to use separate firmware. If needed in exceptional cases,
    board-specific device trees can override this property.
    
    Signed-off-by: Beleswar Padhi 
    Reviewed-by: Bryan Brattlof 
    Link: https://patch.msgid.link/20260114173551.2545088-2-b-padhi@ti.com
    Signed-off-by: Nishanth Menon 

commit 75fb63ae031211e9264ac888fabc2ca9cd3fcccf
Author: Shawn Lin 
Date:   Fri Jan 16 08:55:29 2026 +0800

    soc: rockchip: grf: Support multiple grf to be handled
    
    Currently, only the first matched node will be handled. This leads
    to jtag switching broken for RK3576, as rk3576-sys-grf is found before
    rk3576-ioc-grf. Change the code to scan all the possible node to fix
    the problem.
    
    Fixes: e1aaecacfa13 ("soc: rockchip: grf: Add rk3576 default GRF values")
    Cc: stable@vger.kernel.org
    Cc: Detlev Casanova 
    Signed-off-by: Shawn Lin 
    Tested-by: Marco Schirrmeister 
    Link: https://patch.msgid.link/1768524932-163929-3-git-send-email-shawn.lin@rock-chips.com
    Signed-off-by: Heiko Stuebner 

commit 3cdc30c42d4a87444f6c7afbefd6a9381c4caa27
Author: Shawn Lin 
Date:   Fri Jan 16 08:55:28 2026 +0800

    soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition
    
    RK3576_IOCGRF_MISC_CON is IOC_GRF + 0x40F0, fix it.
    
    Fixes: e1aaecacfa13 ("soc: rockchip: grf: Add rk3576 default GRF values")
    Cc: stable@vger.kernel.org
    Cc: Detlev Casanova 
    Signed-off-by: Shawn Lin 
    Reviewed-by: Chaoyi Chen 
    Tested-by: Marco Schirrmeister 
    Link: https://patch.msgid.link/1768524932-163929-2-git-send-email-shawn.lin@rock-chips.com
    Signed-off-by: Heiko Stuebner 

commit 26b4309a3ab82a0697751cde52eb336c29c19035
Author: Xiao Kan <814091656@qq.com>
Date:   Wed Jan 14 08:22:26 2026 -0500

    drm: Account property blob allocations to memcg
    
    DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
    property blobs backed by kernel memory.
    
    Currently, the blob data allocation is not accounted to the allocating
    process's memory cgroup, allowing unprivileged users to trigger unbounded
    kernel memory consumption and potentially cause system-wide OOM.
    
    Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
    is properly charged to the caller's memcg. This ensures existing cgroup
    memory limits apply and prevents uncontrolled kernel memory growth without
    introducing additional policy or per-file limits.
    
    Signed-off-by: Xiao Kan <814091656@qq.com>
    Signed-off-by: Xiao Kan 
    Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com
    Signed-off-by: Maxime Ripard 

commit 5979010bcc665e9bcf41b22f111b3fe7fc4eadb1
Author: Lad Prabhakar 
Date:   Thu Jan 15 12:22:10 2026 +0000

    arm64: dts: renesas: rzt2h-rzn2h-evk: Reorder ADC nodes
    
    Reorder the ADC nodes in the dts/i files so they follow the same
    alphabetical ordering used elsewhere in these files.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20260115122210.3971063-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 6cbfdf89470ef3c2110f376a507d135e7a7a7378
Author: Miklos Szeredi 
Date:   Thu Jan 15 13:23:40 2026 +0100

    posix_acl: make posix_acl_to_xattr() alloc the buffer
    
    Without exception all caller do that.  So move the allocation into the
    helper.
    
    This reduces boilerplate and removes unnecessary error checking.
    
    Signed-off-by: Miklos Szeredi 
    Link: https://patch.msgid.link/20260115122341.556026-1-mszeredi@redhat.com
    Signed-off-by: Christian Brauner 

commit 4fef3fd633be4a1a18c490a63f4131284f6ee0f4
Author: Geert Uytterhoeven 
Date:   Thu Jan 15 13:36:56 2026 +0100

    clk: renesas: Add missing log message terminators
    
    Complete printed messages should be terminated by newline characters.
    
    Signed-off-by: Geert Uytterhoeven 
    Reviewed-by: Brian Masney 
    Link: https://patch.msgid.link/cd0b3624066b80ed0bb00d489c99e2c1a06d755f.1768480559.git.geert+renesas@glider.be

commit 582234b0d8419e0b6cbfd87ae3f80568c8d0917e
Author: Kornel Dulęba 
Date:   Fri Nov 14 11:11:53 2025 +0000

    KVM: arm64: Fix error checking for FFA_VERSION
    
    According to section 13.2 of the DEN0077 FF-A specification, when
    firmware does not support the requested version, it should reply with
    FFA_RET_NOT_SUPPORTED(-1). Table 13.6 specifies the type of the error
    code as int32.
    Currently, the error checking logic compares the unsigned long return
    value it got from the SMC layer, against a "-1" literal. This fails due
    to a type mismatch: the literal is extended to 64 bits, whereas the
    register contains only 32 bits of ones(0x00000000ffffffff).
    Consequently, hyp_ffa_init misinterprets the "-1" return value as an
    invalid FF-A version. This prevents pKVM initialization on devices where
    FF-A is not supported in firmware.
    Fix this by explicitly casting res.a0 to s32.
    
    Signed-off-by: Kornel Dulęba 
    Acked-by: Will Deacon 
    Link: https://patch.msgid.link/20251114-pkvm_init_noffa-v1-1-87a82e87c345@google.com
    Signed-off-by: Marc Zyngier 

commit 5a4326f2e3b1edfb3329c1bee59035dc9f048b59
Author: Chris Brandt 
Date:   Mon Nov 24 08:10:02 2025 -0500

    clk: renesas: rzg2l: Remove DSI clock rate restrictions
    
    Convert the limited MIPI clock calculations to a full range of settings
    based on math including H/W limitation validation.
    Since the required DSI division setting must be specified from external
    sources before calculations, expose a new API to set it.
    
    Signed-off-by: Chris Brandt 
    Reviewed-by: Biju Das 
    Tested-by: Biju Das 
    Reviewed-by: Hugo Villeneuve 
    Tested-by: Hugo Villeneuve 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251124131003.992554-2-chris.brandt@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 94ea7063fae835e800768d3b0507f0994ef03878
Author: Colin Ian King 
Date:   Fri Jan 9 15:44:42 2026 +0000

    optee: make read-only array attr static const
    
    Don't populate the read-only array attr on the stack at run
    time, instead make it static const.
    
    Signed-off-by: Colin Ian King 
    Reviewed-by: Sumit Garg 
    Signed-off-by: Jens Wiklander 

commit 518edab3ad4f61204af788b3dcf9ed4087cdc275
Author: Artem Shimko 
Date:   Thu Dec 11 15:29:47 2025 +0300

    i2c: designware: Replace magic numbers with named constants
    
    Replace various magic numbers with properly named constants to improve
    code readability and maintainability. This includes constants for
    register access, timing adjustments, timeouts, FIFO parameters,
    and default values.
    
    This makes the code more self-documenting without altering any
    functionality.
    
    Signed-off-by: Artem Shimko 
    Acked-by: Mika Westerberg 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251211122947.1469666-1-a.shimko.dev@gmail.com

commit 73503de518bdb3adaaeee5d4551d4675a5e054bc
Author: Geert Uytterhoeven 
Date:   Thu Jan 15 15:22:42 2026 +0100

    MAINTAINERS: Mark the OP-TEE mailing list moderated
    
    After sending a patch to op-tee@lists.trustedfirmware.org, I got the
    typical response for a moderated list:
    
        Your mail to 'op-tee@lists.trustedfirmware.org' with the subject
    
            [...]
    
        Is being held until the list moderator can review it for approval.
    
        The message is being held because:
    
            The message is not from a list member
    
        Either the message will get posted to the list, or you will receive
        notification of the moderator's decision.
    
    Mark this mailing list moderated in MAINTAINERS.
    
    Signed-off-by: Geert Uytterhoeven 
    Reviewed-by: Jens Wiklander 
    Reviewed-by: Sumit Garg 
    Signed-off-by: Jens Wiklander 

commit 64aa8b3a60a825134f7d866adf05c024bbe0c24c
Author: Hugo Villeneuve 
Date:   Mon Jan 12 10:43:18 2026 -0500

    drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
    
    Since commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L")
    we may get the following kernel panic, for some panels, when rebooting:
    
      systemd-shutdown[1]: Rebooting.
      Call trace:
       ...
       do_serror+0x28/0x68
       el1h_64_error_handler+0x34/0x50
       el1h_64_error+0x6c/0x70
       rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)
       mipi_dsi_device_transfer+0x44/0x58
       mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4
       ili9881c_unprepare+0x38/0x88
       drm_panel_unprepare+0xbc/0x108
    
    This happens for panels that need to send MIPI-DSI commands in their
    unprepare() callback. Since the MIPI-DSI interface is stopped at that
    point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.
    
    Fix by moving rzg2l_mipi_dsi_stop() to new callback function
    rzg2l_mipi_dsi_atomic_post_disable().
    
    With this change we now have the correct power-down/stop sequence:
    
      systemd-shutdown[1]: Rebooting.
      rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry
      ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry
      rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry
      reboot: Restarting system
    
    Suggested-by: Biju Das 
    Signed-off-by: Hugo Villeneuve 
    Tested-by: Biju Das 
    Link: https://patch.msgid.link/20260112154333.655352-1-hugo@hugovil.com
    Signed-off-by: Biju Das 

commit ec8c1f35b5aa7aa63bd398add63a8633adad532c
Author: Pierre-Henry Moussay 
Date:   Tue Jan 13 22:11:47 2026 +0000

    dt-bindings: clock: mpfs-clkcfg: Add pic64gx compatibility
    
    pic64gx has a clock controller compatible with mpfs-clkcfg. Don't permit
    the deprecated configuration that was never supported for this SoC.
    
    Signed-off-by: Pierre-Henry Moussay 
    Acked-by: Krzysztof Kozlowski 
    Reviewed-by: Claudiu Beznea 
    Co-developed-by: Conor Dooley 
    Signed-off-by: Conor Dooley 
    Link: https://lore.kernel.org/r/20260113-glue-justifier-566ffab2ffd3@spud
    Signed-off-by: Claudiu Beznea 

commit e6584bda8d4584a58f020b559617ae7cfde51644
Author: Pierre-Henry Moussay 
Date:   Tue Jan 13 22:11:46 2026 +0000

    dt-bindings: clock: mpfs-ccc: Add pic64gx compatibility
    
    pic64gx SoC Clock Conditioning Circuitry is compatibles
    with the Polarfire SoC
    
    Signed-off-by: Pierre-Henry Moussay 
    Acked-by: Conor Dooley 
    Reviewed-by: Claudiu Beznea 
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Conor Dooley 
    Link: https://lore.kernel.org/r/20260113-guise-conceded-88030697b831@spud
    Signed-off-by: Claudiu Beznea 

commit dfb208b9aebb32dece9ceddfecf84b35a876fbd3
Author: Conor Dooley 
Date:   Tue Jan 13 22:11:45 2026 +0000

    clk: microchip: drop POLARFIRE from ARCH_MICROCHIP_POLARFIRE
    
    This driver is used by non-polarfire devices now, and the ARCH_MICROCHIP
    symbol has been defined for some time on RISCV so drop it without any
    functional change.
    
    Signed-off-by: Conor Dooley 
    Link: https://lore.kernel.org/r/20260113-doing-surplus-dc45866f71d4@spud
    Signed-off-by: Claudiu Beznea 

commit 4154f7d3b1c133b909d20c44ecb8277e8482aa6b
Author: Chenghai Huang 
Date:   Fri Dec 19 11:36:19 2025 +0800

    crypto: hisilicon/sgl - fix inconsistent map/unmap direction issue
    
    Ensure that the direction for dma_map_sg and dma_unmap_sg is
    consistent.
    
    Fixes: 2566de3e06a3 ("crypto: hisilicon - Use fine grained DMA mapping direction")
    Signed-off-by: Chenghai Huang 
    Reviewed-by: Zenghui Yu 
    Signed-off-by: Herbert Xu 

commit e7507439628052363500d717caffb5c2241854dc
Author: Qi Tao 
Date:   Thu Dec 18 21:44:52 2025 +0800

    crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable
    
    When all hardware queues are busy and no shareable queue,
    new processes fail to apply for queues. To avoid affecting
    tasks, support fallback mechanism when hardware queues are
    unavailable.
    
    Fixes: c16a70c1f253 ("crypto: hisilicon/sec - add new algorithm mode for AEAD")
    Signed-off-by: Qi Tao 
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Herbert Xu 

commit 6aff4d977e2d582c5d6ff6afd5646c1a459490fa
Author: Weili Qian 
Date:   Thu Dec 18 21:44:51 2025 +0800

    crypto: hisilicon/hpre - support the hpre algorithm fallback
    
    When all hardware queues are busy and no shareable queue,
    new processes fail to apply for queues. To avoid affecting
    tasks, support fallback mechanism when hardware queues are
    unavailable.
    
    HPRE driver supports DH algorithm, limited to prime numbers up to 4K.
    It supports prime numbers larger than 4K via fallback mechanism.
    
    Fixes: 05e7b906aa7c ("crypto: hisilicon/hpre - add 'ECDH' algorithm")
    Signed-off-by: Weili Qian 
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Herbert Xu 

commit 73398f85a430cfebc2ff06ab836d6d9eb1484c79
Author: Chenghai Huang 
Date:   Thu Dec 18 21:44:50 2025 +0800

    crypto: hisilicon/zip - support fallback for zip
    
    When the hardware queue resource busy(no shareable queue)
    or memery alloc fail in initialization of acomp_alg, use
    soft algorithm to complete the work.
    
    Fixes: 1a9e6f59caee ("crypto: hisilicon/zip - remove zlib and gzip")
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Herbert Xu 

commit 2a75decec1193c2fca1833d7f740796a72b925f1
Author: Chenghai Huang 
Date:   Thu Dec 18 21:44:49 2025 +0800

    crypto: hisilicon/qm - optimize device selection priority based on queue ref count and NUMA distance
    
    Add device sorting criteria to prioritize devices with fewer
    references and closer NUMA distances. Devices that are fully
    occupied will not be prioritized for use.
    
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Weili Qian 
    Signed-off-by: Herbert Xu 

commit 4705489742fdc294fe3de7bd9855432fb3cfe3cd
Author: Chenghai Huang 
Date:   Thu Dec 18 21:44:48 2025 +0800

    crypto: hisilicon/qm - add reference counting to queues for tfm kernel reuse
    
    Add reference counting to queues. When all queues are occupied, tfm
    will reuse queues with the same algorithm type that have already
    been allocated in the kernel. The corresponding queue will be
    released when the reference count reaches 1.
    
    Reviewed-by: Longfang Liu 
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Weili Qian 
    Signed-off-by: Herbert Xu 

commit 72f3bbebff15e87171271d643ee2672fb8e92031
Author: Chenghai Huang 
Date:   Thu Dec 18 21:44:47 2025 +0800

    crypto: hisilicon - consolidate qp creation and start in hisi_qm_alloc_qps_node
    
    Consolidate the creation and start of qp into the function
    hisi_qm_alloc_qps_node. This change eliminates the need for
    each module to perform these steps in two separate phases
    (creation and start).
    
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Weili Qian 
    Signed-off-by: Herbert Xu 

commit 8cd9b608ee8dea78cac3f373bd5e3b3de2755d46
Author: Chenghai Huang 
Date:   Thu Dec 18 21:44:46 2025 +0800

    crypto: hisilicon/qm - centralize the sending locks of each module into qm
    
    When a single queue used by multiple tfms, the protection of shared
    resources by individual module driver programs is no longer
    sufficient. The hisi_qp_send needs to be ensured by the lock in qp.
    
    Fixes: 5fdb4b345cfb ("crypto: hisilicon - add a lock for the qp send operation")
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Weili Qian 
    Signed-off-by: Herbert Xu 

commit 21452eaa06edb5f6038720e643aed0bbfffad9c3
Author: Chenghai Huang 
Date:   Thu Dec 18 21:44:45 2025 +0800

    crypto: hisilicon/qm - enhance the configuration of req_type in queue attributes
    
    Originally, when a queue was requested, it could only be configured
    with the default algorithm type of 0. Now, when multiple tfms use
    the same queue, the queue must be selected based on its attributes
    to meet the requirements of tfm tasks. So the algorithm type
    attribute of queue need to be distinguished. Just like a queue used
    for compression in ZIP cannot be used for decompression tasks.
    
    Fixes: 3f1ec97aacf1 ("crypto: hisilicon/qm - Put device finding logic into QM")
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Weili Qian 
    Signed-off-by: Herbert Xu 

commit 3a1984758197f7fd4c557dd98090e8e0cf9f498e
Author: lizhi 
Date:   Thu Dec 18 21:44:44 2025 +0800

    crypto: hisilicon/hpre: extend tag field to 64 bits for better performance
    
    This commit expands the tag field in hpre_sqe structure from 16-bit
    to 64-bit. The change enables storing request addresses directly
    in the tag field, allowing callback functions to access request messages
    without the previous indirection mechanism.
    
    By eliminating the need for lookup tables, this modification reduces lock
    contention and associated overhead, leading to improved efficiency and
    simplified code.
    
    Fixes: c8b4b477079d ("crypto: hisilicon - add HiSilicon HPRE accelerator")
    Signed-off-by: lizhi 
    Signed-off-by: Weili Qian 
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Herbert Xu 

commit 08eb67d23e5172a5d1e60f1f0acccee569fe10ba
Author: Chenghai Huang 
Date:   Thu Dec 18 21:44:43 2025 +0800

    crypto: hisilicon/sec - move backlog management to qp and store sqe in qp for callback
    
    When multiple tfm use a same qp, the backlog data should be managed
    centrally by the qp, rather than in the qp_ctx of each req.
    
    Additionally, since SEC_BD_TYPE1 and SEC_BD_TYPE2 cannot use the
    tag of the sqe to carry the virtual address of the req, the sent
    sqe is stored in the qp. This allows the callback function to get
    the req address. To handle the differences between hardware types,
    the callback functions are split into two separate implementations.
    
    Fixes: f0ae287c5045 ("crypto: hisilicon/sec2 - implement full backlog mode for sec")
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Weili Qian 
    Signed-off-by: Herbert Xu 

commit 19c2475ce1984cf675ebfbbeaa5509b2fb1887d6
Author: Chenghai Huang 
Date:   Thu Dec 18 21:44:42 2025 +0800

    crypto: hisilicon/zip - adjust the way to obtain the req in the callback function
    
    In the shared queue design, multiple tfms use same qp, and one qp
    need to corresponds to multiple qp_ctx. So use tag to obtain the
    req virtual address. Build a one-to-one relationship between tfm
    and qp_ctx. finaly remove the old get_tag operation.
    
    Fixes: 2bcf36348ce5 ("crypto: hisilicon/zip - initialize operations about 'sqe' in 'acomp_alg.init'")
    Signed-off-by: Chenghai Huang 
    Signed-off-by: Weili Qian 
    Signed-off-by: Herbert Xu 

commit 624a6760bf8464965c17c8df10b40b557eaa3002
Author: Thomas Fourier 
Date:   Thu Dec 18 11:12:57 2025 +0100

    crypto: octeontx - fix dma_free_coherent() size
    
    The size of the buffer in alloc_command_queues() is
    curr->size + OTX_CPT_NEXT_CHUNK_PTR_SIZE, so used that length for
    dma_free_coherent().
    
    Fixes: 10b4f09491bf ("crypto: marvell - add the Virtual Function driver for CPT")
    Signed-off-by: Thomas Fourier 
    Signed-off-by: Herbert Xu 

commit 941676c30ba5b40a01bed92448f457ce62fd1f07
Author: Thomas Fourier 
Date:   Thu Dec 18 10:56:45 2025 +0100

    crypto: cavium - fix dma_free_coherent() size
    
    The size of the buffer in alloc_command_queues() is
    curr->size + CPT_NEXT_CHUNK_PTR_SIZE, so used that length for
    dma_free_coherent().
    
    Fixes: c694b233295b ("crypto: cavium - Add the Virtual Function driver for CPT")
    Signed-off-by: Thomas Fourier 
    Signed-off-by: Herbert Xu 

commit 74ecff77dace0f9aead6aac852b57af5d4ad3b85
Author: Vishal Badole 
Date:   Wed Jan 14 13:33:57 2026 +0530

    xgbe: Use netlink extack to report errors to ethtool
    
    Upgrade XGBE driver to report errors via netlink extack instead
    of netdev_error so ethtool userspace can be aware of failures.
    
    Signed-off-by: Vishal Badole 
    Reviewed-by: Shyam Sundar S K 
    Reviewed-by: Vadim Fedorenko 
    Signed-off-by: Raju Rangoju 
    Link: https://patch.msgid.link/20260114080357.1778132-1-Raju.Rangoju@amd.com
    Signed-off-by: Jakub Kicinski 

commit dc634118aaa09a539163fce8f19db67b8ec29f92
Author: Pavan Chebbi 
Date:   Tue Jan 13 10:34:22 2026 -0800

    bnxt_en: Fix build break on non-x86 platforms
    
    Commit c470195b989fe added .getcrosststamp() interface where
    the code uses boot_cpu_has() function which is available only
    in x86 platforms. This fails the build on any other platform.
    
    Since the interface is going to be supported only on x86 anyway,
    we can simply compile out the entire support on non-x86 platforms.
    
    Cover the .getcrosststamp support under CONFIG_X86
    
    Fixes: c470195b989f ("bnxt_en: Add PTP .getcrosststamp() interface to get device/host times")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202601111808.WnBJCuWI-lkp@intel.com
    Signed-off-by: Pavan Chebbi 
    Signed-off-by: Michael Chan 
    Reviewed-by: Vadim Fedorenko 
    Link: https://patch.msgid.link/20260113183422.508851-1-michael.chan@broadcom.com
    Signed-off-by: Jakub Kicinski 

commit 48b0126da665ea7628ed475086e1f6f75f1e4638
Author: Marco Crivellari 
Date:   Tue Jan 13 16:14:33 2026 +0100

    hinic3: add WQ_PERCPU to alloc_workqueue users
    
    This continues the effort to refactor workqueue APIs, which began with
    the introduction of new workqueues and a new alloc_workqueue flag in:
    
       commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
       commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    The refactoring is going to alter the default behavior of
    alloc_workqueue() to be unbound by default.
    
    With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
    any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
    must now use WQ_PERCPU. For more details see the Link tag below.
    
    In order to keep alloc_workqueue() behavior identical, explicitly request
    WQ_PERCPU.
    
    Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Reviewed-by: Fan Gong 
    Link: https://patch.msgid.link/20260113151433.257320-1-marco.crivellari@suse.com
    Signed-off-by: Jakub Kicinski 

commit 8744b63e8a9ac4a3c30b557ca6bc115851a980e9
Author: Jan Hoffmann 
Date:   Tue Jan 13 21:55:44 2026 +0100

    net: phy: realtek: fix in-band capabilities for 2.5G PHYs
    
    It looks like the configuration of in-band AN only affects SGMII, and it
    is always disabled for 2500Base-X. Adjust the reported capabilities
    accordingly.
    
    This is based on testing using OpenWrt on Zyxel XGS1010-12 rev A1 with
    RTL8226-CG, and Zyxel XGS1210-12 rev B1 with RTL8221B-VB-CG. On these
    devices, 2500Base-X in-band AN is known to work with some SFP modules
    (containing an unknown PHY). However, with the built-in Realtek PHYs,
    no auto-negotiation takes place, irrespective of the configuration of
    the PHY.
    
    Fixes: 10fbd71fc5f9b ("net: phy: realtek: implement configuring in-band an")
    Signed-off-by: Jan Hoffmann 
    Reviewed-by: Daniel Golle 
    Link: https://patch.msgid.link/20260113205557.503409-1-jan@3e8.eu
    Signed-off-by: Jakub Kicinski 

commit 2db009e4c8d6dc76d98fa691a35586f98506fc63
Author: Eric Dumazet 
Date:   Tue Jan 13 13:10:17 2026 +0000

    net: minor __alloc_skb() optimization
    
    We can directly call __finalize_skb_around()
    instead of __build_skb_around() because @size is not zero.
    
    Signed-off-by: Eric Dumazet 
    Link: https://patch.msgid.link/20260113131017.2310584-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski 

commit 3996b70209f145bfcf2afc7d05dd92c27b233b48
Author: Chao Yu 
Date:   Fri Jan 16 11:38:16 2026 +0800

    Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()"
    
    This reverts commit 196c81fdd438f7ac429d5639090a9816abb9760a.
    
    Original patch may cause below deadlock, revert it.
    
    write                           remount
    - write_begin
     - lock_page  --- lock A
     - prepare_write_begin
      - f2fs_map_lock
                                    - f2fs_enable_checkpoint
                                     - down_write(cp_enable_rwsem)  --- lock B
                                     - sync_inode_sb
                                      - writepages
                                       - lock_page                  --- lock A
       - down_read(cp_enable_rwsem)  --- lock A
    
    Cc: stable@kernel.org
    Fixes: 196c81fdd438 ("f2fs: block cache/dio write during f2fs_enable_checkpoint()")
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit b1b77c82cec16668571b0d2587d19d4204d432e0
Author: Heiner Kallweit 
Date:   Tue Jan 13 08:23:17 2026 +0100

    net: phy: remove unused fixup unregistering functions
    
    No user of PHY fixups unregisters these. IOW: The fixup unregistering
    functions are unused and can be removed. Remove also documentation
    for these functions. Whilst at it, remove also mentioning of
    phy_register_fixup() from the Documentation, as this function has been
    static since ea47e70e476f ("net: phy: remove fixup-related definitions
    from phy.h which are not used outside phylib").
    
    Fixup unregistering functions were added with f38e7a32ee4f
    ("phy: add phy fixup unregister functions") in 2016, and last user
    was removed with 6782d06a47ad ("net: usb: lan78xx: Remove KSZ9031 PHY
    fixup") in 2024.
    
    Signed-off-by: Heiner Kallweit 
    Link: https://patch.msgid.link/ff8ac321-435c-48d0-b376-fbca80c0c22e@gmail.com
    Signed-off-by: Jakub Kicinski 

commit acbe4a141e89eef8dab4b2840037ee70fbf59578
Author: Ethan Nelson-Moore 
Date:   Mon Jan 12 23:53:21 2026 -0800

    net: usb: sr9700: fix byte numbering in comments
    
    The comments describing the RX/TX headers and status response use
    a combination of 0- and 1-based indexing, leading to confusion. Correct
    the numbering and make it consistent. Also fix a typo "pm" for "pn".
    
    This issue also existed in dm9601 and was fixed in commit 61189c78bda8
    ("dm9601: trivial comment fixes").
    
    Signed-off-by: Ethan Nelson-Moore 
    Reviewed-by: Simon Horman 
    Acked-by: Peter Korsgaard 
    Link: https://patch.msgid.link/20260113075327.85435-1-enelsonmoore@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 971c2b68bddb87f4929e66cd4563fca78b722210
Merge: 9d10cd526111a9 83675851547e83
Author: Dave Airlie 
Date:   Fri Jan 16 13:39:15 2026 +1000

    Merge tag 'drm-xe-next-2026-01-15' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next
    
    UAPI Changes:
     - Remove unused KEEP_ACTIVE flag in the new multi queue uAPI (Niranjana)
     - Expose new temperature attributes in HWMON (Karthik)
    
    Driver Changes:
     - Force i2c into polling mode when in survivability (Raag)
     - Validate preferred system memory placement in xe_svm_range_validate (Brost)
     - Adjust page count tracepoints in shrinker (Brost)
     - Fix a couple drm_pagemap issues with multi-GPU (Brost)
     - Define GuC firmware for NVL-S (Roper)
     - Handle GT resume failure (Raag)
     - Improve wedged mode handling (Lukasz)
     - Add missing newlines to drm_warn messages (Osama)
     - Fix WQ_MEM_RECLAIM passed as max_active to alloc_workqueue (Marco)
     - Page-reclaim fixes and PRL stats addition (Brian)
     - Fix struct guc_lfd_file_header kernel-doc (Jani)
     - Allow compressible surfaces to be 1-way coherent (Xin)
     - Fix DRM scheduler layering violations in Xe (Brost)
     - Minor improvements to MERT code (Michal)
     - Privatize struct xe_ggtt_node (Maarten)
     - Convert wait for lmem init into an assert (Bala)
     - Enable GSC loading and PXP for PTL (Daniele)
     - Replace use of system_wq with tlb_inval->timeout_wq (Marco)
     - VRAM addr range bit expansion (Fei)
     - Cleanup unused header includes (Roper)
    
    Signed-off-by: Dave Airlie 
    
    From: Rodrigo Vivi 
    Link: https://patch.msgid.link/aWkSxRQK7VhTlP32@intel.com

commit 2c297957912bdfaadbf91b3353e3af87c6c41cbe
Author: Heiner Kallweit 
Date:   Mon Jan 12 21:11:04 2026 +0100

    net: ethernet: dnet: remove driver
    
    This legacy platform driver was used with some Qong board.
    Support for this board was removed with
    commit c93197b0041d ("ARM: imx: Remove i.MX31 board files")
    in 2020. So remove this now orphaned driver.
    
    Signed-off-by: Heiner Kallweit 
    Reviewed-by: Simon Horman 
    Link: https://patch.msgid.link/cef7c728-28ee-439f-b747-eb1c9394fe51@gmail.com
    Signed-off-by: Jakub Kicinski 

commit e76994c561cfb380e681832548b40891deff9a93
Merge: aeb4ceb1e76628 875a59c9a9e584
Author: Jakub Kicinski 
Date:   Thu Jan 15 19:36:26 2026 -0800

    Merge branch 'net-airoha-init-block-ack-memory-region-for-mt7996-npu-offloading'
    
    Lorenzo Bianconi says:
    
    ====================
    net: airoha: Init Block Ack memory region for MT7996 NPU offloading
    
    This is a preliminary series in order to enable NPU offloading for
    MT7996 (Eagle) chipset.
    ====================
    
    Link: https://patch.msgid.link/20260108-airoha-ba-memory-region-v3-0-bf1814e5dcc4@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 875a59c9a9e584d99d8e9e5aa8435ec9300bfe91
Author: Lorenzo Bianconi 
Date:   Thu Jan 8 16:05:08 2026 +0100

    net: airoha: npu: Init BA memory region if provided via DTS
    
    Initialize NPU Block Ack memory region if reserved via DTS.
    Block Ack memory region is used by NPU MT7996 (Eagle) offloading.
    
    Signed-off-by: Lorenzo Bianconi 
    Link: https://patch.msgid.link/20260108-airoha-ba-memory-region-v3-2-bf1814e5dcc4@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 40f9e446033e3aef3bc230858c98f57bbcc53f5a
Author: Lorenzo Bianconi 
Date:   Thu Jan 8 16:05:07 2026 +0100

    dt-bindings: net: airoha: npu: Add BA memory region
    
    Introduce Block Ack memory region used by NPU MT7996 (Eagle) offloading.
    
    Signed-off-by: Lorenzo Bianconi 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260108-airoha-ba-memory-region-v3-1-bf1814e5dcc4@kernel.org
    Signed-off-by: Jakub Kicinski 

commit aeb4ceb1e7662854d2688f94f04e8f0e12a4baa4
Merge: 96a2d53f24787d a6733836527da9
Author: Jakub Kicinski 
Date:   Thu Jan 15 19:36:06 2026 -0800

    Merge branch 'net-phy-adin-enable-configuration-of-the-lp-termination-register'
    
    Osose Itua says:
    
    ====================
    net: phy: adin: enable configuration of the LP Termination Register
    ====================
    
    Link: https://patch.msgid.link/20260107221913.1334157-1-osose.itua@savoirfairelinux.com
    Signed-off-by: Jakub Kicinski 

commit a6733836527da97767aa7cdd2d3c6984460afdb3
Author: Osose Itua 
Date:   Wed Jan 7 17:16:53 2026 -0500

    net: phy: adin: enable configuration of the LP Termination Register
    
    The ADIN1200/ADIN1300 provide a control bit that selects between normal
    receive termination and the lowest common mode impedance for 100BASE-TX
    operation. This behavior is controlled through the Low Power Termination
    register (B_100_ZPTM_EN_DIMRX).
    
    Bit 0 of this register enables normal termination when set (this is the
    default), and selects the lowest common mode impedance when cleared.
    
    Signed-off-by: Osose Itua 
    Acked-by: Nuno Sá 
    Link: https://patch.msgid.link/20260107221913.1334157-3-osose.itua@savoirfairelinux.com
    Signed-off-by: Jakub Kicinski 

commit 7376ba2db168c9e83f90e68f5f85c7d7f5645164
Author: Osose Itua 
Date:   Wed Jan 7 17:16:52 2026 -0500

    dt-bindings: net: adi,adin: document LP Termination property
    
    Add "adi,low-cmode-impedance" boolean property which, when present,
    configures the PHY for the lowest common-mode impedance on the receive
    pair for 100BASE-TX operation by clearing the B_100_ZPTM_EN_DIMRX bit.
    This is suited for capacitive coupled applications and other
    applications where there may be a path for high common-mode noise to
    reach the PHY.
    
    If this value is not present, the value of the bit by default is 1,
    which is normal termination (zero-power termination) mode.
    
    Signed-off-by: Osose Itua 
    Acked-by: Rob Herring (Arm) 
    Acked-by: Nuno Sá 
    Link: https://patch.msgid.link/20260107221913.1334157-2-osose.itua@savoirfairelinux.com
    Signed-off-by: Jakub Kicinski 

commit 96a2d53f24787df907e8bab388cc3e8f180a2314
Merge: 567873005dca1b e7556b59ba6517
Author: Jakub Kicinski 
Date:   Thu Jan 15 19:14:28 2026 -0800

    Merge tag 'phy_common_properties' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
    
    Vinod Koul says:
    
    ====================
    phy common properties
    
    Introduce "rx-polarity" and "tx-polarity" device tree properties
    with Kunit tests (from Vladimir Oltean).
    
    * tag 'phy_common_properties' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
      phy: add phy_get_rx_polarity() and phy_get_tx_polarity()
      dt-bindings: phy-common-props: RX and TX lane polarity inversion
      dt-bindings: phy-common-props: ensure protocol-names are unique
      dt-bindings: phy-common-props: create a reusable "protocol-names" definition
      dt-bindings: phy: rename transmit-amplitude.yaml to phy-common-props.yaml
    ====================
    
    Link: https://patch.msgid.link/aWeXvFcGNK5T6As9@vaman
    Signed-off-by: Jakub Kicinski 

commit 567873005dca1be0a3b3e2e309a8f0de14d2b827
Author: Gal Pressman 
Date:   Thu Jan 15 08:05:44 2026 +0200

    ethtool: Clarify len/n_stats fields in/out semantics
    
    Document that the 'len' field in ethtool_gstrings and 'n_stats' field in
    ethtool_stats optionally serve dual purposes: on entry they specify the
    number of items requested, and on return they indicate the number
    actually returned (which is not necessarily the same).
    
    Signed-off-by: Gal Pressman 
    Reviewed-by: Dragos Tatulea 
    Link: https://patch.msgid.link/20260115060544.481550-1-gal@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit 9d10cd526111a989eb353c3a4df9d4c79695ea8d
Merge: 37b812b7fdc2f1 d30f75d2dba913
Author: Dave Airlie 
Date:   Fri Jan 16 12:57:20 2026 +1000

    Merge tag 'drm-intel-next-2026-01-15' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next
    
    Beyond Display:
     - Make 'guc_hw_reg_state' static as it isn't exported (Ben)
     - Fix doc build on mei related interface header (Jani)
    
    Display related:
     - Fix ggtt fb alignment on Xe display (Tvrtko)
     - More display clean-up towards deduplication and full separation (Jani)
     - Use the consolidated HDMI tables (Suraj)
     - Account for DSC slice overhead (Ankit)
     - Prepare GVT for display modularization (Ankit, Jani)
     - Enable/Disable DC balance along with VRR DSB (Mitul, Ville)
     - Protection against unsupported modes in LT PHY (Suraj)
     - Display W/a addition and fixes (Gustavo)
     - Fix many SPDX identifier comments (Ankit)
     - Incorporate Xe3_LPD changes for CD2X divider (Gustavo)
     - Clean up link BW/DSC slice config computation (Imre)
    
    Signed-off-by: Dave Airlie 
    
    From: Rodrigo Vivi 
    Link: https://patch.msgid.link/aWkNThVRSkGAfUVv@intel.com

commit abe368db117ea61ace90880c80a12ee3c0d619e6
Author: Geert Uytterhoeven 
Date:   Mon Dec 1 10:42:28 2025 +0100

    clk: Annotate #else and #endif
    
    Annotate the #else and #endif keywords in large #ifdef/#else/#endif
    sections, to improve readability.
    
    Signed-off-by: Geert Uytterhoeven 
    Signed-off-by: Stephen Boyd 

commit d94f0f096ccf83b1a212788c62122c4b97ac8907
Author: Geert Uytterhoeven 
Date:   Mon Dec 1 10:42:27 2025 +0100

    clk: Merge prepare and unprepare sections
    
     contains two consecutive #ifdef/#else/#endif sections
    that check for CONFIG_HAVE_CLK_PREPARE: one for prepare-related
    functionality, and a second for unprepare-related functionality.
    Reduce #ifdef clutter by merging them.
    
    Signed-off-by: Geert Uytterhoeven 
    Signed-off-by: Stephen Boyd 

commit f47c1b77d0a2a9c0d49ec14302e74f933398d1a3
Author: Geert Uytterhoeven 
Date:   Mon Dec 1 10:42:26 2025 +0100

    clk: Move clk_{save,restore}_context() to COMMON_CLK section
    
    The clk_save_context() and clk_restore_context() helpers are only
    implemented by the Common Clock Framework.  They are not available when
    using legacy clock frameworks.  Dummy implementations are provided, but
    only if no clock support is available at all.
    
    Hence when CONFIG_HAVE_CLK=y, but CONFIG_COMMON_CLK is not enabled:
    
        m68k-linux-gnu-ld: drivers/net/phy/air_en8811h.o: in function `en8811h_resume':
        air_en8811h.c:(.text+0x83e): undefined reference to `clk_restore_context'
        m68k-linux-gnu-ld: drivers/net/phy/air_en8811h.o: in function `en8811h_suspend':
        air_en8811h.c:(.text+0x856): undefined reference to `clk_save_context'
    
    Fix this by moving forward declarations and dummy implementions from the
    HAVE_CLK to the COMMON_CLK section.
    
    Fixes: 8b95d1ce3300c411 ("clk: Add functions to save/restore clock context en-masse")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202511301553.eaEz1nEW-lkp@intel.com/
    Signed-off-by: Geert Uytterhoeven 
    Signed-off-by: Stephen Boyd 

commit ef9b3b4dbe767e4ac642a88dc0507927ac545047
Author: Janne Grunau 
Date:   Wed Dec 31 13:22:00 2025 +0100

    clk: clk-apple-nco: Add "apple,t8103-nco" compatible
    
    After discussion with the devicetree maintainers we agreed to not extend
    lists with the generic compatible "apple,nco" anymore [1]. Use
    "apple,t8103-nco" as base compatible as it is the SoC the driver and
    bindings were written for.
    
    [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
    
    Fixes: 6641057d5dba ("clk: clk-apple-nco: Add driver for Apple NCO")
    Cc: stable@vger.kernel.org
    Acked-by: Stephen Boyd 
    Reviewed-by: Neal Gompa 
    Signed-off-by: Janne Grunau 
    Signed-off-by: Stephen Boyd 

commit faee3e39e647d79897e15fc74146758ce09b0806
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 12:22:42 2025 +0100

    clk: versatile: impd1: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Sudeep Holla 
    Reviewed-by: Linus Walleij 
    Signed-off-by: Stephen Boyd 

commit 9925fda8258d68878d58513b344ec9783599e26b
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 12:22:41 2025 +0100

    clk: scpi: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Sudeep Holla 
    Signed-off-by: Stephen Boyd 

commit 47231ba4cb225c991a6a9db7420e2607d1108a95
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 12:22:40 2025 +0100

    clk: lmk04832: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Stephen Boyd 

commit a46a9cd19beefdca7f4f55674a380b1a91f9fa77
Merge: 8f0b4cce4481fb ebb3acf4d7c95b
Author: Stephen Boyd 
Date:   Thu Jan 15 18:31:49 2026 -0800

    Merge tag 'renesas-clk-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas
    
    Pull Renesas clk driver updates from Geert Uytterhoeven:
    
     - Add Expanded Serial Peripheral Interface (xSPI) clocks and resets on
       Renesas RZ/T21H and RZ/N2H
     - Add DMAC, interrupt controller (ICU), SPI, and thermal (TSU) clocks
       and resets on Renesas RZ/V2N
     - Add more serial (RSCI) clocks and resets on Renesas RZ/V2H and RZ/V2N
    
    * tag 'renesas-clk-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers:
      clk: renesas: r9a09g056: Add clock and reset entries for TSU
      clk: renesas: r9a09g057: Add entries for RSCIs
      clk: renesas: r9a09g056: Add entries for RSCIs
      clk: renesas: r9a09g056: Add entries for the RSPIs
      clk: renesas: r9a09g056: Add entries for ICU
      clk: renesas: r9a09g056: Add entries for the DMACs
      clk: renesas: r9a09g077: Propagate rate changes through mux parents
      clk: renesas: r9a09g077: Add xSPI core and module clocks
      clk: renesas: rzg2l: Select correct div round macro
      clk: renesas: rzg2l: Fix intin variable size
      dt-bindings: clock: renesas,r9a09g077/87: Add XSPI0/1 IDs

commit c27022497dd9b8a8922dbb878c255e4260a90e6c
Merge: d4596891e72cbf 9e995c573b6345
Author: Jakub Kicinski 
Date:   Thu Jan 8 11:37:07 2026 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
    
    Cross-merge networking fixes after downstream PR (net-6.19-rc6).
    
    No conflicts, or adjacent changes.
    
    Signed-off-by: Jakub Kicinski 

commit d8e1f4a193101a72235416f189b01131a57e26e9
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:38 2026 +0800

    wifi: ath12k: enable QCC2072 support
    
    QCC2072 is a PCI based device that is very much like WCN7850, the major
    difference is that QCC2072 has only one phy hence does not support DBS.
    With previous patches handling such similarity and difference, it is now
    ready to finally enable supporting this device.
    
    Add QCC2072's ID to the PCI device ID table, to allow it getting probed
    hence enable support. Also populate some necessary parameters when probing.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-18-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 853deed04be384fde9138e0442630b5bddf2e418
Author: Miaoqing Pan 
Date:   Mon Jan 12 15:36:37 2026 +0800

    wifi: ath12k: fix PCIE_LOCAL_REG_QRTR_NODE_ID definition for QCC2072
    
    The definition of PCIE_LOCAL_REG_QRTR_NODE_ID in QCC2072 is
    incorrect, which causes the QMI connection to fail when
    ATH12K_FW_FEATURE_MULTI_QRTR_ID is enabled. To resolve this
    issue, move it to the hardware register table.
    
    Note IPQ5332 is not affected as it is not PCIe based device.
    
    Tested-on: QCC2072 hw1.0 PCI CI_WLAN.COL.1.0-01668.1-QCACOLSWPL_V1_TO_SILICONZ-9
    
    Signed-off-by: Miaoqing Pan 
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-17-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit d6c5d412f60007e23bebc4eba1de2530a7651962
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:36 2026 +0800

    wifi: ath12k: send peer meta data version to firmware
    
    Peer meta data version is currently not delivered to firmware, resulting
    in QCC2072 data path issues.
    
    Parse it from service ready ext2 event and send to firmware in WMI init
    command.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-16-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit d518b2d601acffdea6d50ff951cb1344a4807976
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:35 2026 +0800

    wifi: ath12k: limit number of channels per WMI command
    
    Currently the number of channels can be sent in a single WMI command is
    calculated based on the maximum message length of the target, this results
    in WMI exchange hang for QCC2072 as its firmware can not support those
    many channels in a single command.
    
    Add a limit to avoid this issue.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-15-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 37b34a1c545aa2ab94f3ce1aceec3f00d6f8e039
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:34 2026 +0800

    wifi: ath12k: handle REO status ring for QCC2072
    
    For QCC2072 below REO status descriptors are different compared with
    QCN9274/WCN7850:
    
            hal_reo_get_queue_stats_status
            hal_reo_flush_queue_status
            hal_reo_flush_cache_status
            hal_reo_unblock_cache_status
            hal_reo_flush_timeout_list_status
            hal_reo_desc_thresh_reached_status
    
    Take hal_reo_get_queue_stats_status as an example:
    
    QCC2072:
    struct hal_reo_get_queue_stats_status_qcc2072 {
            __le32 tlv32_padding;
            struct hal_reo_get_queue_stats_status status;
    } __packed;
    
    QCN9274/WCN7850:
    struct hal_reo_get_queue_stats_status;
    
    Besides, QCC2072 has a 32 bits TLV header while QCN9274/WCN7850 has 64.
    
    This means that there is no difference between these 3 devices in layout
    of actual fields, because they all start after a 8 bytes offset
    
    QCC2072:
            {
                    struct hal_tlv_hdr tlv;
                    __le32 tlv32_padding;
                    struct hal_reo_get_queue_stats_status status;
            }
    
    QCN9274/WCN7850:
            {
                    struct hal_tlv_64_hdr tlv;
                    struct hal_reo_get_queue_stats_status status;
            }
    
    Therefore current implementation luckily works for QCC2072 as well.
    However it leads to misunderstanding, which should be avoided.
    
    So add individual REO status ring handling for QCC2072.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-14-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit b7ffeb0f62fddc5f21c6ff610d28e08247b6b9b5
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:33 2026 +0800

    wifi: ath12k: handle REO CMD ring for QCC2072
    
    As far as REO CMD ring is concerned, there are two differences between
    QCC2072 and the existing chips:
    
    For the first, the TLV header of ring descriptor for QCC2072 is 32 bits
    while 64 bits for existing chips.
    
    For the second, QCC2072 has different hal_reo_get_queue_stats,
    hal_reo_flush_cache and hal_reo_update_rx_queue structures. Take
    hal_reo_get_queue_stats as an example:
    
    QCC2072:
    struct hal_reo_get_queue_stats_qcc2072 {
            struct hal_reo_cmd_hdr cmd;
            [...]
            __le32 rsvd0[6];
    } __packed;
    
    QCN9274/WCN7850:
    struct hal_reo_get_queue_stats {
            struct hal_reo_cmd_hdr cmd;
            [...]
            __le32 rsvd0[6];
            __le32 tlv64_pad;
    } __packed;
    
    Note there is no tlv64_pad at the end for QCC2072, but all other
    former fields share the same layout.
    
    These make different ring entry size, so that parameter has to be updated
    with respect to existing chips. This is done in the newly introduced
    ath12k_hal_srng_create_config_qcc2072() function, which first creates all
    ring configs by utilizing ath12k_hal_srng_create_config_wcn7850() and then
    updates the individual field.
    
    Besides, the REO command TLV encoding also need to be corrected because of
    the different TLV bits. This is done by introducing a 32 bit variant for
    each of the existing 64 bit callback.
    
    Note the hal_reo_get_queue_stats_qcc2072 structure is introduced for the
    purpose of calculating ring entry size. Existing hal_reo_get_queue_stats
    structure gets used elsewhere even for QCC2072. This is working because
    the only difference is the tlv64_pad field that is located at the end and
    not getting used, hence can be ignored.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-13-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 023ace9f9232d43137f346d908996a6fee4de70a
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:32 2026 +0800

    wifi: ath12k: add hardware ops support for QCC2072
    
    Due to HAL descriptors, QCC2027 has different offsets of MPDU start tag
    and MSDU end tag, compared with other chips. Hence add new hardware
    ops structure for QCC2072. All ops are directly taken from WCN7850, with
    the exception to rxdma_ring_sel_config, which needs a new function
    ath12k_dp_rxdma_ring_sel_config_qcc2072() to handle the difference
    mentioned above.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-12-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 28badc78142e4750136ae51da474cdc150a8b3ff
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:31 2026 +0800

    wifi: ath12k: add HAL descriptor and ops for QCC2072
    
    QCC2072 has different HAL descriptors hence require different HAL
    handling, compared to other chips. Add support for this.
    
    REO CMD/status ring handling is currently using the 64 bit ops
    
            .reo_init_cmd_ring = ath12k_wifi7_hal_reo_init_cmd_ring_tlv64,
            .reo_cmd_enc_tlv_hdr = ath12k_hal_encode_tlv64_hdr,
            .reo_status_dec_tlv_hdr = ath12k_hal_decode_tlv64_hdr,
    
    these will be updated to use 32 bit variants in upcoming patches.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-11-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit b065ccf4193ed5f0c224b53fc2cb829a0e2b701e
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:30 2026 +0800

    wifi: ath12k: support downloading auxiliary ucode image for QCC2072
    
    QCC2072 requires another firmware image named aux_ucode.bin, add support
    to download it.
    
    Add a new hardware parameter download_aux_ucode to make sure other chips
    are not affected.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-10-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 68cc3ac88118ee9ab797aadf15dd30a8145b4be7
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:29 2026 +0800

    wifi: ath12k: support LPASS_SHARED target memory type
    
    QCC2072 requires a new type of QMI target memory named LPASS_SHARED_V01,
    add support for it.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-9-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 12048e2c052b1992857fb71a86d13e0e5b65e5da
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:28 2026 +0800

    wifi: ath12k: add hardware parameters for QCC2072
    
    Add hardware parameters for QCC2072, these parameters are directly taken
    from WCN7850, with exceptions to hardware name, revision, firmware
    directory, iova_mask and RFKILL parameter set.
    
    Compared to WCN7850, QCC2072 doesn't require aligned IOVA when
    transmitting packets, hence iova_mask is set to zero.
    
    Besides, WCN7850 has a dedicated GPIO for RFKILL purpose, however QCC2072
    has it coupled with WLAN_EN pin. For QCC2072, host is not allowed to send
    any RFKILL configuration info to firmware, or firmware crashes. Hence
    those parameters are all cleared to skip configuring command.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-8-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 089e0e746d598b5d305dae366e022dd90e1bd4f2
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:27 2026 +0800

    wifi: ath12k: add hardware registers for QCC2072
    
    Add hardware registers and populate hw_regs field in
    ath12k_wifi7_hw_ver_map for QCC2072. Note for some registers not
    defined and not used by QCC2072, a magic value is assigned.
    
    Also populate other fields to be the same with WCN7850. Among them,
    however, QCC2072 requires different HAL ops and descriptor size, both
    will be updated in upcoming patches.
    
    Tested-on: QCC2072 hw1.0 PCI WLAN.COL.1.0-01560-QCACOLSWPL_V1_TO_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-7-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit b5151c9b6e3a347416a4b4b55fc00195526d8771
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:26 2026 +0800

    wifi: ath12k: fix mac phy capability parsing
    
    Currently ath12k_pull_mac_phy_cap_svc_ready_ext() assumes only one band
    supported in each phy, hence it skips 5 GHz band if 2 GHz band support
    is detected. This does not work for device which gets only one phy but
    has both bands supported, such as QCC2072.
    
    Change to check each band individually to fix this issue.
    
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-6-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 6281d4f4df228b3588eeb3186d97e195fed07d35
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:25 2026 +0800

    wifi: ath12k: refactor 320 MHz bandwidth support parsing
    
    For single pdev device, 320 MHz bandwidth support is reported only in
    capability of WMI_HOST_HW_MODE_SINGLE mode, hence commit d4e244c85e45
    ("wifi: ath12k: enable 320 MHz bandwidth for 6 GHz band in EHT PHY
    capability for WCN7850") relaxed the condition check in
    ath12k_wmi_tlv_mac_phy_caps_ext() to allow SINGLE mode getting parsed in
    ath12k_wmi_tlv_mac_phy_caps_ext_parse(). Since SINGLE mode is not assumed
    to be preferred, the function returns unconditionally after parsing 320
    MHz support.
    
    This works for WCN7850 because it prefers another mode indeed, while it
    breaks QCC2072 since it prefers SINGLE mode. Due to the unconditional
    return, the subsequent EHT parsing is skipped. Consequently EHT related
    features are disabled.
    
    Refactor it by moving 320 MHz parsing to ath12k_wmi_tlv_mac_phy_caps_ext(),
    before the mode checking. This makes the code more straightforward, and
    work for both WCN7850 and QCC2072.
    
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-5-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 7f852de0003219c431a6f2ffd951fd82a4673660
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:24 2026 +0800

    wifi: ath12k: fix preferred hardware mode calculation
    
    For single pdev device like WCN7850/QCC2072, preferred_hw_mode is
    initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends
    supported modes to host, each mode is compared with the initial one
    and if the priority of the new mode is higher, update the parameter
    and store mode capability.
    
    For WCN7850, this does not result in issue, as one of the supported
    mode indeed has a higher priority. However the only available mode of
    QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the
    comparison, hence mode capability is not stored. Subsequently driver
    initialization fails.
    
    Fix it by accepting a mode with the same priority.
    
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 1f165022d5f06a420a2257d7c38e3d19e16ef071
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:23 2026 +0800

    wifi: ath12k: refactor REO status ring handling
    
    The entry of REO status ring of existing chips has a 64 bit TLV header,
    hence below functions take a 64 bit TLV assumption by default
    
            ath12k_wifi7_dp_rx_process_reo_status()
            ath12k_wifi7_hal_reo_status_queue_stats()
            ath12k_wifi7_hal_reo_flush_queue_status()
            ath12k_wifi7_hal_reo_flush_cache_status()
            ath12k_wifi7_hal_reo_unblk_cache_status()
            ath12k_wifi7_hal_reo_flush_timeout_list_status()
            ath12k_wifi7_hal_reo_desc_thresh_reached_status()
            ath12k_wifi7_hal_reo_update_rx_reo_queue_status()
    
    However this is not the case for QCC2072 of which the TLV is 32 bit.
    
    Refactor above functions to prepare for QCC2072 support, this is done by
    removing TLV length assumption and offloading TLV decoding work to a newly
    added callback _reo_status_dec_tlv_hdr. This way each chip can register
    its own handler hence can do the work accordingly.
    
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-3-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 9615a6727e9d836e60dd4c7442bc8c16f0382203
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:22 2026 +0800

    wifi: ath12k: refactor REO CMD ring handling
    
    The entry of REO CMD ring of existing chips has a 64 bit TLV header, hence
    below functions take a 64 bit TLV assumption by default
    
            ath12k_wifi7_hal_reo_init_cmd_ring()
            ath12k_wifi7_hal_reo_cmd_queue_stats()
            ath12k_wifi7_hal_reo_cmd_flush_cache()
            ath12k_wifi7_hal_reo_cmd_update_rx_queue()
    
    However this is not the case for QCC2072 of which the TLV is 32 bit,
    meaning above functions don't work for it.
    
    Rename/refactor above functions to prepare for QCC2072 support:
    
    Rename the first one to ath12k_wifi7_hal_reo_init_cmd_ring_tlv64() to
    better reflect what it is doing. There will be a 32 bit variant when
    QCC2072 support is in place.
    
    For the last ones, remove TLV length assumption and offload TLV encoding
    work to a newly added callback _reo_cmd_enc_tlv_hdr. This way each chip
    can register its own handler hence can do the work accordingly.
    
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-2-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 7a6b6386deb71908181adc26c6ddbe9bc6cef169
Author: Baochen Qiang 
Date:   Mon Jan 12 15:36:21 2026 +0800

    wifi: ath12k: refactor PCI window register access
    
    Currently offset of PCI window register address is defined as 0x310c which
    is same across existing chips. However QCC2072 has a different offset
    0x3278.
    
    In order to make the window selection logic work for QCC2072 as well,
    change to initialize this parameter per device at the probe time.
    
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-1-fc8ce1e43969@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit b515730ec3d231aa36b6177524532fc7d94f1750
Author: Alexandru Gagniuc 
Date:   Sun Dec 28 09:14:05 2025 -0600

    wifi: ath11k: move .max_tx_ring to struct ath11k_hw_hal_params
    
    ".max_tx_ring" is an upper bounds to indexing ".tcl2wbm_rbm_map". It
    is initialized in, core.c, a different file than the array. This
    spaghetti-like relation is fragile and not obvious. Accidentally
    setting ".max_tx_ring" too high leads to a hard to track out-of-
    bounds access and memory corruption.
    
    There is a small ambiguity on the meaning of "max_tx_ring":
     - The highest ring, max=3 implies there are 4 rings (0, 1, 2, 3)
     - The highest number to use for array indexing (there are 3 rings)
    
    Clarify this dependency by moving ".max_tx_ring" adjacent to the array
    ".tcl2wbm_rbm_map", and name it "num_tx_rings". Use ARRAY_SIZE()
    instead of #defines to initialize the length field.
    
    The intent is to make the code easier to understand rather than fix
    an existing bug.
    
    Signed-off-by: Alexandru Gagniuc 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251228151408.2116108-1-mr.nuke.me@gmail.com
    Signed-off-by: Jeff Johnson 

commit ca765beda7084ebad7630bc403bc0b2598d34e98
Author: Venkateswara Naralasetty 
Date:   Tue Dec 30 13:55:20 2025 +0530

    wifi: ath11k: Register handler for CFR capture event
    
    Firmware sends CFR meta data through the WMI event
    WMI_PEER_CFR_CAPTURE_EVENT. Parse the meta data coming from the firmware
    and invoke correlate_and_relay function to correlate the CFR meta data
    with the CFR payload coming from the other WMI event
    WMI_PDEV_DMA_RING_BUF_RELEASE_EVENT.
    
    Release the buffer to user space once correlate and relay return
    success.
    
    Tested-on: IPQ8074 hw2.0 PCI IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
    
    Signed-off-by: Venkateswara Naralasetty 
    Co-developed-by: Yu Zhang (Yuriy) 
    Signed-off-by: Yu Zhang (Yuriy) 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Signed-off-by: Qian Zhang 
    Link: https://patch.msgid.link/20251230082520.3401007-7-qian.zhang@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 99cf756831d203fcdd3f9a8833355fb86611a1f2
Author: Venkateswara Naralasetty 
Date:   Tue Dec 30 13:55:19 2025 +0530

    wifi: ath11k: Register DBR event handler for CFR data
    
    Add handler for WMI_PDEV_DMA_RING_BUF_RELEASE_EVENT which indicates CFR
    data availability in the DB ring.
    
    Add CFR data processing from DB ring buffers. Use correlate_and_relay
    API to match CFR data with metadata from WMI_PEER_CFR_CAPTURE_EVENT.
    
    Release buffer to userspace through relayfs on successful correlation,
    otherwise hold buffer waiting for matching WMI event from firmware.
    
    Add new debug masks:
     - ATH11K_DBG_CFR:      Enables CFR-related debug logs.
     - ATH11K_DBG_CFR_DUMP: Enables detailed CFR data dump for analysis.
    
    Tested-on: IPQ8074 hw2.0 PCI IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
    
    Signed-off-by: Venkateswara Naralasetty 
    Co-developed-by: Yu Zhang (Yuriy) 
    Signed-off-by: Yu Zhang (Yuriy) 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Signed-off-by: Qian Zhang 
    Link: https://patch.msgid.link/20251230082520.3401007-6-qian.zhang@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit c1bf6959dd81949ebcdeef53fbc9bfff91ec241a
Author: Venkateswara Naralasetty 
Date:   Tue Dec 30 13:55:18 2025 +0530

    wifi: ath11k: Register relayfs entries for CFR dump
    
    Provide a relayfs interface to collect the CFR dump from the user space.
    
    '/sys/kernel/debug/ieee80211/phyX/ath11k/cfr_capture' is exposed to user
    space to get CFR data.
    
    CFR format to user space:
     ___________________________________________
    | CFR header | CFR payload | CFR tail data |
    |____________|_____________|_______________|
    
    CFR header contains the following fields,
    
    * Start magic number 0xDEADBEAF - 4 bytes
    * vendor id - 4 bytes
    * cfr metadata version - 1 byte
    * cfr data version - 1 byte
    * device type - 1 byte
    * platform type - 1 byte
    * CFR metadata length - 4 bytes
    * metadata - 92 bytes
            peer mac - 6 bytes
            capture status - 1 byte (1 for success 0 for failure)
            capture_bw - 1 byte
            channel_bw - 1 byte
            phy_mode - 1 byte
            prim20_chan - 2 bytes
            center_freq1 - 2 bytes
            center_freq2 - 2 bytes
            capture_mode - 1 byte
            capture_type - 1 byte
            sts_count - 1 byte
            num_rx_chain - 1 byte
            timestamp - 4 bytes
            length - 4 bytes
            chain_rssi - 32 bytes (4 bytes for each chain)
            chain_phase - 16 bytes (2 bytes for each chain)
            cfo_measurement - 4 bytes
            agc_gain - 8 bytes (1 bytes for each chain)
            rx_start_ts - 4 bytes
    
    CFR payload:
    
    CFR payload contains 8bytes of ucode header followed by the tone
    information. Tone order is positive tones, followed by PHY memory
    garbage, followed by negative tones. Dummy tones are uploaded to make
    number of tones always integer number of 64. Number of tones is not
    preamble type dependent.
    
    Each CFR tone has 14-bit I component and 14-bit Q component and is sign
    extended to 16-bit I/Q. Two tones are packed into one 64-bit unit as:
    
    [63:0] = [Tone1_Q(63:48) Tone1_I(47:32) Tone0_Q(31:16) Tone0_I(15:0)]
    
    CFR tail: end magic number 0xBEAFDEAD
    
    Tested-on: IPQ8074 hw2.0 PCI IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
    
    Signed-off-by: Venkateswara Naralasetty 
    Co-developed-by: Yu Zhang (Yuriy) 
    Signed-off-by: Yu Zhang (Yuriy) 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Signed-off-by: Qian Zhang 
    Link: https://patch.msgid.link/20251230082520.3401007-5-qian.zhang@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit b3d43d890399e4f49f31d90083bfe9b349cce6dc
Author: Venkateswara Naralasetty 
Date:   Tue Dec 30 13:55:17 2025 +0530

    wifi: ath11k: Add support unassociated client CFR
    
    Provide debugfs interfaces support to config unassociated client CFR
    from the user space.
    
    To enable CFR capture for unassociated clients,
    
    echo "  "
     > /sys/kernel/debug/ieee80211/phyX/ath11k/cfr_unassoc
    
    Mac address: mac address of the client.
    Val: 0 - start CFR capture
         1 - stop CFR capture
    Periodicity: Periodicity at which hardware is expected to collect CFR
    dump.
         0 - single shot capture.
         non zero - for Periodic captures (value must be multiple of 10 ms)
    
    Tested-on: IPQ8074 hw2.0 PCI IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
    
    Signed-off-by: Venkateswara Naralasetty 
    Co-developed-by: Yu Zhang (Yuriy) 
    Signed-off-by: Yu Zhang (Yuriy) 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Signed-off-by: Qian Zhang 
    Link: https://patch.msgid.link/20251230082520.3401007-4-qian.zhang@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 9754d4ba4df7e63ab271abb8190008c3a4dfcd26
Author: Venkateswara Naralasetty 
Date:   Tue Dec 30 13:55:16 2025 +0530

    wifi: ath11k: Register debugfs for CFR configuration
    
    Provide debugfs interfaces support to config CFR from the user space.
    
    To enable/disable cfr feature use command,
    
    echo  > /sys/kernel/debug/ieee80211/phyX/ath11k/enable_cfr
    
    where, val: 0 to disable CFR and 1 to enable CFR.
    
    To enable CFR capture for associated peers,
    
    echo "   "
     >
    /sys/kernel/debug/ieee80211/phyX/netdev\:wlanx/stations//cfr_capture
    
    val: 0 - stop CFR capture
         1 - start CFR capture
    bw: CFR capture bandwidth
         0 - 20MHZ
         1 - 40MHZ
         2 - 80MHZ
    Periodicity: Periodicity at which hardware is expected to collect CFR
    dump.
         0 - single shot capture.
         non zero - for Periodic captures (value must be multiple of 10 ms)
    method: Method used by hardware to collect the CFR dump.
         0 - from the ACKs of QOS NULL packets.
    
    Also, send the required WMI commands to the firmware based on the CFR
    configurations.
    
    Tested-on: IPQ8074 hw2.0 PCI IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
    
    Signed-off-by: Venkateswara Naralasetty 
    Co-developed-by: Yu Zhang (Yuriy) 
    Signed-off-by: Yu Zhang (Yuriy) 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Signed-off-by: Qian Zhang 
    Link: https://patch.msgid.link/20251230082520.3401007-3-qian.zhang@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 9b2e3b4ebec7f23a552de4ee6f2e5da8028a2920
Author: Venkateswara Naralasetty 
Date:   Tue Dec 30 13:55:15 2025 +0530

    wifi: ath11k: Add initialization and deinitialization sequence for CFR module
    
    Channel Frequency Response (CFR) module will be initialized only when
    the following criteria passes:
     * Enabled CFR support for the hardware through the hardware param
       'cfr_support'
     * WMI service enabled for the CFR support
       'WMI_TLV_SERVICE_CFR_CAPTURE_SUPPORT'
    
    Also, provide a configuration option CONFIG_ATH11K_CFR to enable CFR
    feature support during the compilation time.
    
    CFR module initialization includes Direct Buffer(DB) ring initialization
    where hardware uses the DB ring buffers to copy CFR data to host.
    Number of buffers and buffer size of the ring is based on the DB ring
    capabilities advertised by the firmware through WMI service ready.
    Also ring configurations are sent to firmware through
    ath11k_dbring_wmi_cfg_setup().
    
    Predefine ath11k_cfr_dma_hdr, ath11k_look_up_table, and ath11k_cfr
    structs and fields for subsequent patches.
    
    Tested-on: IPQ8074 hw2.0 PCI IPQ8074 WLAN.HK.2.5.0.1-00991-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
    
    Signed-off-by: Venkateswara Naralasetty 
    Co-developed-by: Yu Zhang (Yuriy) 
    Signed-off-by: Yu Zhang (Yuriy) 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Signed-off-by: Qian Zhang 
    Link: https://patch.msgid.link/20251230082520.3401007-2-qian.zhang@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit e62102ac9b773bdb08475aa9ca24dea61ae98708
Author: Baochen Qiang 
Date:   Mon Nov 3 10:44:49 2025 +0800

    wifi: ath12k: do WoW offloads only on primary link
    
    In case of multi-link connection, WCN7850 firmware crashes due to WoW
    offloads enabled on both primary and secondary links.
    
    Change to do it only on primary link to fix it.
    
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
    
    Fixes: 32f7b19668bd ("wifi: ath12k: support MLO as well if single_chip_mlo_support flag is set")
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251103-ath12-primary-link-wow-v1-1-3cf523dc09f0@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 40feb23c726369700918b9c35db987f9fe3c6498
Author: Dan Carpenter 
Date:   Thu Dec 18 10:44:20 2025 +0300

    wifi: ath12k: clean up on error in ath12k_dp_setup()
    
    Destroy the rhash_tbl before returning the error code.
    
    Fixes: a88cf5f71adf ("wifi: ath12k: Add hash table for ath12k_dp_link_peer")
    Signed-off-by: Dan Carpenter 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/aUOw1J0TU4VgeXj6@stanley.mountain
    Signed-off-by: Jeff Johnson 

commit 8fb264d1a0c5b3feae5f492ee2bc2997b71b63e3
Author: Alexander Minchev 
Date:   Thu Nov 27 07:29:37 2025 +0000

    wifi: ath12k: remove redundant pci_set_drvdata() call
    
    pci_set_drvdata() is called twice in ath12k_pci_probe() with the
    same pointer. Remove the earlier call so drvdata is set after
    ath12k_base and ath12k_pci initialization is complete.
    
    Having two calls might suggest that drvdata needs to be set early for
    some reason, even though it is not used until after the 'ab' struct
    ath12k_base is fully populated. Even though exact placement is
    not critical, keeping a single pci_set_drvdata() at the end of
    the initialization makes it clearer that drvdata points to a
    fully initialized structure and avoids confusion for future changes.
    
    Tested on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Reviewed-by: Baochen Qiang 
    Signed-off-by: Alexander Minchev 
    Link: https://patch.msgid.link/20251127072839.14167-2-adminchev@proton.me
    Signed-off-by: Jeff Johnson 

commit 9269caf5a7ff2c0b1f37e06f10eee68d5bf1049e
Author: Chien Wong 
Date:   Thu Oct 30 22:30:41 2025 +0800

    wifi: ath11k: fix comment typo in monitor mode handling
    
    Correct a typo in the monitor mode comment where "it make" was mistakenly
    used instead of "it doesn't make". The comment explains that the brief
    period where monitor mode appears enabled before being removed is harmless
    in practice.
    Also, use more common phrase "in practice" instead of "in practise".
    
    Signed-off-by: Chien Wong 
    Link: https://patch.msgid.link/20251030143041.12027-1-m@xv97.com
    Signed-off-by: Jeff Johnson 

commit 0bc8c48de6f06c0cac52dde024ffda4433de6234
Author: Qian Zhang 
Date:   Thu Jan 8 11:46:07 2026 +0800

    wifi: ath11k: Fix failure to connect to a 6 GHz AP
    
    STA fails to connect to a 6 GHz AP with the following errors:
     ath11k_pci 0000:01:00.0: failed to handle chan list with power type 1
     wlp1s0: deauthenticating from c8:a3:e8:dd:41:e3 by local choice (Reason: 3=DEAUTH_LEAVING)
    
    ath11k_reg_handle_chan_list() treats the update as redundant and
    returns -EINVAL. That causes the connection attempt to fail.
    
    Avoid unnecessary validation during association. Apply the regulatory
    redundant check only when the power type is IEEE80211_REG_UNSET_AP,
    which only occurs during core initialization.
    
    Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
    
    Signed-off-by: Qian Zhang 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20260108034607.812885-1-qian.zhang@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 4015b1972763d7d513172276e51439f37e622a92
Author: Ross Vandegrift 
Date:   Sat Jan 3 17:00:34 2026 -0800

    wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
    
    Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added
    to the appropriate quirk list.  I've tested this patch on top of 6.18.2,
    it fixes the issue for me on 21D4
    
    Mark Pearson provided the other product IDs covering the second Z16 Gen1
    and both Z13 Gen1 identifiers.  They share the same firmware, and folks
    in the bugzilla report do indeed see the problem on Z13.
    
    [1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196
    
    Signed-off-by: Ross Vandegrift 
    Reviewed-by: Baochen Qiang 
    Tested-by: Mark Pearson 
    Reviewed-by: Mark Pearson 
    Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd
    Signed-off-by: Jeff Johnson 

commit dec6a3c6d6dfc6402118529de230e76e65df9a9b
Author: Randy Dunlap 
Date:   Sun Nov 16 18:02:13 2025 -0800

    wifi: wil6210: fix a bunch of kernel-doc warnings
    
    scripts/kernel-doc.py reports 51 kernel-doc warnings in wil6210.h.
    Fix all kernel-doc warnings reported in wil6210.h.
    
    Several comments are changed from "/**" to "/*" since it appears that
    "/**" was used for many non-kernel-doc comments.
    
    - add kernel-doc for missing function parameters
    - add one function "Returns:"
    - correct kernel-doc struct name to match actual struct name in 2 places
    
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Simon Horman 
    Link: https://patch.msgid.link/20251117020213.443126-1-rdunlap@infradead.org
    Signed-off-by: Jeff Johnson 

commit 125e7b31f041cc0a4ede1e42bef69915f0a63a35
Author: Rosen Penev 
Date:   Fri Aug 1 17:04:32 2025 -0700

    wifi: ath9k: add OF dependency to AHB
    
    The conversion to OF missed adding a Kconfig dependency.
    
    Fixes: 2fa490c0d759 ("wifi: ath9k: ahb: replace id_table with of")
    Signed-off-by: Rosen Penev 
    Acked-by: Toke Høiland-Jørgensen 
    Link: https://patch.msgid.link/20250802000432.3079550-1-rosenp@gmail.com
    Signed-off-by: Jeff Johnson 

commit b9909c19965dc9e5a3a898fef09b437fcc3a9494
Author: Randy Dunlap 
Date:   Sun Nov 16 18:02:50 2025 -0800

    wifi: ath9k: fix kernel-doc warnings in common-debug.h
    
    Modify kernel-doc comments in common-debug.h to avoid warnings:
    
    Warning: drivers/net/wireless/ath/ath9k/common-debug.h:21 bad line:
      may have had errors.
    Warning: ../drivers/net/wireless/ath/ath9k/common-debug.h:23 bad line:
      may have had errors.
    Warning: ../drivers/net/wireless/ath/ath9k/common-debug.h:26 bad line:
      decryption process completed
    Warning: ../drivers/net/wireless/ath/ath9k/common-debug.h:28 bad line:
      encountered an error
    
    Fixes: 99c15bf575b1 ("ath9k: Report total tx/rx bytes and packets in debugfs.")
    Fixes: 1395d3f00a41 ("ath9k: Add debugfs file for RX errors")
    Signed-off-by: Randy Dunlap 
    Acked-by: Toke Høiland-Jørgensen 
    Link: https://patch.msgid.link/20251117020251.447692-1-rdunlap@infradead.org
    Signed-off-by: Jeff Johnson 

commit c6131765a2c0052b2c5a2310ff92191ff33aec8b
Author: Randy Dunlap 
Date:   Sun Nov 16 18:03:03 2025 -0800

    wifi: ath9k: debug.h: fix kernel-doc bad lines and struct ath_tx_stats
    
    Repair "bad line" warnings by starting each line with " *".
    Add or correct kernel-doc entries for missing struct members in
    struct ath_tx_stats.
    
    Warning: ../drivers/net/wireless/ath/ath9k/debug.h:144 bad line:
      may have had errors.
    Warning: ../drivers/net/wireless/ath/ath9k/debug.h:146 bad line:
      may have had errors.
    Warning: ../drivers/net/wireless/ath/ath9k/debug.h:156 bad line:
      Valid only for:
    Warning: ../drivers/net/wireless/ath/ath9k/debug.h:157 bad line:
      - non-aggregate condition.
    Warning: ../drivers/net/wireless/ath/ath9k/debug.h:158 bad line:
      - first packet of aggregate.
    Warning: drivers/net/wireless/ath/ath9k/debug.h:191 struct member
     'xretries' not described in 'ath_tx_stats'
    Warning: drivers/net/wireless/ath/ath9k/debug.h:191 struct member
     'data_underrun' not described in 'ath_tx_stats'
    Warning: drivers/net/wireless/ath/ath9k/debug.h:191 struct member
     'delim_underrun' not described in 'ath_tx_stats'
    
    Fixes: 99c15bf575b1 ("ath9k: Report total tx/rx bytes and packets in debugfs.")
    Fixes: fec247c0d5bf ("ath9k: Add debug counters for TX")
    Fixes: 5a6f78afdabe ("ath9k: show excessive-retry MPDUs in debugfs")
    Signed-off-by: Randy Dunlap 
    Acked-by: Toke Høiland-Jørgensen 
    Link: https://patch.msgid.link/20251117020304.448687-1-rdunlap@infradead.org
    Signed-off-by: Jeff Johnson 

commit b1e542b6f0775d35bf546f3de33644b4f761fc3c
Author: Randy Dunlap 
Date:   Thu Nov 27 17:04:01 2025 -0800

    wifi: ath5k: debug.h: fix enum ath5k_debug_level kernel-doc
    
    Add a description for ATH5K_DEBUG_ANI and delete the descriptions for
    3 undefined enum descriptions to prevent these warnings:
    
    Warning: drivers/net/wireless/ath/ath5k/debug.h:111 Enum value
     'ATH5K_DEBUG_ANI' not described in enum 'ath5k_debug_level'
    Warning: drivers/net/wireless/ath/ath5k/debug.h:111 Excess enum value
     '%ATH5K_DEBUG_DUMP_RX' description in 'ath5k_debug_level'
    Warning: drivers/net/wireless/ath/ath5k/debug.h:111 Excess enum value
     '%ATH5K_DEBUG_DUMP_TX' description in 'ath5k_debug_level'
    Warning: drivers/net/wireless/ath/ath5k/debug.h:111 Excess enum value
     '%ATH5K_DEBUG_TRACE' description in 'ath5k_debug_level'
    
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Simon Horman 
    Link: https://patch.msgid.link/20251128010401.546506-1-rdunlap@infradead.org
    Signed-off-by: Jeff Johnson 

commit 2125381d60c572684cc4ca61a2b1cf44c7eab059
Author: Krzysztof Kozlowski 
Date:   Tue Dec 30 12:48:36 2025 +0100

    dt-bindings: net: wireless: ath11k: Combine two if:then: clauses
    
    Simplify the binding by combining two if:then: clauses which have
    exactly the same conditional part.
    
    Signed-off-by: Krzysztof Kozlowski 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251230114835.52504-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 37b812b7fdc2f1c7cb9e22c888776be7347097b0
Merge: 83dc0ba2755296 b36178488d479e
Author: Dave Airlie 
Date:   Fri Jan 16 11:03:44 2026 +1000

    Merge tag 'drm-misc-next-2026-01-15' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next
    
    drm-misc-next for 6.20:
    
    Core Changes:
    
    - atomic: Introduce Gamma/Degamma LUT size check
    - gem: Fix a leak in drm_gem_get_unmapped_area
    - gpuvm: API sanitation for Rust bindings
    - panic: Few corner-cases fixes
    
    Driver Changes:
    
    - Replace system workqueue with percpu equivalent
    
    - amdxdna: Update message buffer allocation requirements, Update
      firmware version check
    - imagination: Add AM62P support
    - ivpu: Implement warm boot flow
    - rockchip: Get rid of atomic_check fixups, Add Rockchip RK3506 Support
    - rocket: Cleanups
    
    - bridge:
      - dw-hdmi-qp: Add support for HPD-less setups
    - panel:
      - mantix: Various power management related improvements
      - new panels: Innolux G150XGE-L05,
    
    - dma-buf:
      - cma: Call clear_page instead of memset
    
    Signed-off-by: Dave Airlie 
    
    From: Maxime Ripard 
    Link: https://patch.msgid.link/20260115-lilac-dragon-of-opposition-ac0a30@houat

commit 934d9746ed0206e93506a68c838fe82ef748576a
Author: Jiri Olsa 
Date:   Mon Jan 12 13:11:57 2026 +0100

    selftests/bpf: Add test for bpf_override_return helper
    
    We do not actually test the bpf_override_return helper functionality
    itself at the moment, only the bpf program being able to attach it.
    
    Adding test that override prctl syscall return value on top of
    kprobe and kprobe.multi.
    
    Signed-off-by: Jiri Olsa 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Song Liu 
    Link: https://lore.kernel.org/bpf/20260112121157.854473-2-jolsa@kernel.org

commit 276f3b6daf6024ae2742afd161e7418a5584a660
Author: Jiri Olsa 
Date:   Mon Jan 12 13:11:56 2026 +0100

    arm64/ftrace,bpf: Fix partial regs after bpf_prog_run
    
    Mahe reported issue with bpf_override_return helper not working when
    executed from kprobe.multi bpf program on arm.
    
    The problem is that on arm we use alternate storage for pt_regs object
    that is passed to bpf_prog_run and if any register is changed (which
    is the case of bpf_override_return) it's not propagated back to actual
    pt_regs object.
    
    Fixing this by introducing and calling ftrace_partial_regs_update function
    to propagate the values of changed registers (ip and stack).
    
    Reported-by: Mahe Tardy 
    Signed-off-by: Jiri Olsa 
    Signed-off-by: Andrii Nakryiko 
    Reviewed-by: Steven Rostedt (Google) 
    Acked-by: Will Deacon 
    Link: https://lore.kernel.org/bpf/20260112121157.854473-1-jolsa@kernel.org

commit 0df529f466bd6ee62b296c1e7f015e5f39fbd480
Author: Jie Zhang 
Date:   Wed Dec 31 14:15:25 2025 +0530

    dt-bindings: display/msm/rgmu: Document A612 RGMU
    
    RGMU a.k.a Reduced Graphics Management Unit is a small state machine
    with the sole purpose of providing IFPC (Inter Frame Power Collapse)
    support. Compared to GMU, it doesn't manage GPU clock, voltage
    scaling, bw voting or any other functionalities. All it does is detect
    an idle GPU and toggle the GDSC switch. As it doesn't access DDR space,
    it doesn't require iommu.
    
    So far, only Adreno 612 GPU has an RGMU core. Document it in
    qcom,adreno-rgmu.yaml.
    
    Signed-off-by: Jie Zhang 
    Signed-off-by: Akhil P Oommen 
    Reviewed-by: Krzysztof Kozlowski 
    Patchwork: https://patchwork.freedesktop.org/patch/696679/
    Message-ID: <20251231-qcs615-spin-2-v6-4-da87debf6883@oss.qualcomm.com>
    Signed-off-by: Rob Clark 

commit fa4525799d6016e4eb9a7bb3b333ce09d4d9ac30
Author: Akhil P Oommen 
Date:   Wed Dec 31 14:15:24 2025 +0530

    dt-bindings: display/msm: gpu: Document A612 GPU
    
    A612 GPU has a new IP called RGMU (Reduced Graphics Management Unit)
    which replaces GMU. But it doesn't do clock or voltage scaling. So we
    need the gpu core clock in the GPU node along with the power domain to
    do clock and voltage scaling from the kernel. Update the bindings to
    describe this GPU.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Akhil P Oommen 
    Patchwork: https://patchwork.freedesktop.org/patch/696676/
    Message-ID: <20251231-qcs615-spin-2-v6-3-da87debf6883@oss.qualcomm.com>
    Signed-off-by: Rob Clark 

commit 158927e1f63e23ade5d099ed013eab411979775e
Author: Akhil P Oommen 
Date:   Wed Dec 31 14:15:23 2025 +0530

    dt-bindings: display/msm: gpu: Simplify conditional schema logic
    
    JSON Schema conditionals can become complex and error-prone when combined
    with regex patterns. To improve readability and maintainability, replace
    nested if-else blocks with a flattened structure using explicit enums.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Akhil P Oommen 
    Patchwork: https://patchwork.freedesktop.org/patch/696674/
    Message-ID: <20251231-qcs615-spin-2-v6-2-da87debf6883@oss.qualcomm.com>
    Signed-off-by: Rob Clark 

commit e39333a81eeff310fd651e2e6de3680cb7906a32
Author: Akhil P Oommen 
Date:   Wed Dec 31 14:15:22 2025 +0530

    drm/msm/a6xx: Retrieve gmu core range by index
    
    Some GPUs like A612 doesn't use a named register range resource. This
    is because the reg-name property is discouraged when there is just a
    single resource.
    
    To address this, retrieve the 'gmu' register range by its index. It is
    always guaranteed to be at index 0.
    
    Signed-off-by: Akhil P Oommen 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Patchwork: https://patchwork.freedesktop.org/patch/696673/
    Message-ID: <20251231-qcs615-spin-2-v6-1-da87debf6883@oss.qualcomm.com>
    Signed-off-by: Rob Clark 

commit fbfeca74043777b48add294089cd4c4f68ed3377
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:33 2026 -0800

    lib/crypto: aes: Drop 'volatile' from aes_sbox and aes_inv_sbox
    
    The volatile keyword is no longer necessary or useful on aes_sbox and
    aes_inv_sbox, since the table prefetching is now done using a helper
    function that casts to volatile itself and also includes an optimization
    barrier.  Since it prevents some compiler optimizations, remove it.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-36-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 953f2db0bfc2ab68e69f385441d0f4b54aee0cd1
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:32 2026 -0800

    lib/crypto: aes: Remove old AES en/decryption functions
    
    Now that all callers of the aes_encrypt() and aes_decrypt() type-generic
    macros are using the new types, remove the old functions.
    
    Then, replace the macro with direct calls to the new functions, dropping
    the "_new" suffix from them.
    
    This completes the change in the type of the key struct that is passed
    to aes_encrypt() and aes_decrypt().
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-35-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit bc79efa08c038846b962edf04dc00922b48efdc7
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:31 2026 -0800

    lib/crypto: aesgcm: Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-34-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 7fcb22dc7765185a86077f65179ec4fa3f30b910
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:30 2026 -0800

    lib/crypto: aescfb: Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-33-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 86120434712314077fc7aeeaaf732521d1446736
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:29 2026 -0800

    crypto: omap - Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-32-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 65c7022be112b05c4da6e19a4b4635da45b6434d
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:28 2026 -0800

    crypto: inside-secure - Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    This driver used crypto_aes_ctx::key_enc, but only to access the copy of
    the raw key that is stored at the beginning of the expanded key.  To
    eliminate the dependency on this field, instead just access the raw key
    directly, which is already available in the relevant functions.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-31-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit b2c15db74a379a50d723002799c3db0c6781c75a
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:27 2026 -0800

    crypto: drbg - Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-30-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 9b95f3a4c9b8baf9fc4c2b8776f8285c05e594f5
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:26 2026 -0800

    crypto: crypto4xx - Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-29-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit cafa7a0b6c90b5ef75ae8ffbdd5ff0f7191709d8
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:25 2026 -0800

    crypto: chelsio - Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_key and struct
    aes_enckey).  In encryption-only use cases, this eliminates the
    unnecessary computation and caching of the decryption round keys.  The
    new AES en/decryption functions are also much faster and use AES
    instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.  Likewise
    for decryption.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-28-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 0f5f4961ae53d41da5c3d3d37be796d72b38b4af
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:24 2026 -0800

    crypto: ccp - Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-27-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 104a9526e1448dc45b96534e2d78d41b3ecac3f9
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:23 2026 -0800

    crypto: x86/aes-gcm - Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Since this changes the format of the AES-GCM key structures that are
    used by the AES-GCM assembly code, the offsets in the assembly code had
    to be updated to match.  Note that the new key structures are smaller,
    since the decryption round keys are no longer unnecessarily included.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-26-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 370960c153db82fbdd55539be4d4eb41ef3a7e40
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:22 2026 -0800

    crypto: arm64/ghash - Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-25-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit cf4b7b99a6058227351164edc8f81d90771ac4ef
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:21 2026 -0800

    crypto: arm/ghash - Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-24-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 60fb28ca028634210e12a4e674d3563f741e617c
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:20 2026 -0800

    staging: rtl8723bs: core: Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-23-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 12b03936a02fd17fd7c7a9711c225f34332c6c57
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:19 2026 -0800

    net: phy: mscc: macsec: Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-22-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 1f161437c6738ed59ad67a2c67f30b2e9fdf81b4
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:18 2026 -0800

    chelsio: Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-21-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 7f6dfeb943bf06dd55a588e992dcc108ffe3db2c
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:17 2026 -0800

    Bluetooth: SMP: Use new AES library API
    
    Switch from the old AES library functions (which use struct
    crypto_aes_ctx) to the new ones (which use struct aes_enckey).  This
    eliminates the unnecessary computation and caching of the decryption
    round keys.  The new AES en/decryption functions are also much faster
    and use AES instructions when supported by the CPU.
    
    Note that in addition to the change in the key preparation function and
    the key struct type itself, the change in the type of the key struct
    results in aes_encrypt() (which is temporarily a type-generic macro)
    calling the new encryption function rather than the old one.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-20-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 9c941c94bcba851eb8e688a3cf7d59ce29c4eb25
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:16 2026 -0800

    crypto: x86/aes - Remove the superseded AES-NI crypto_cipher
    
    Remove the "aes-aesni" crypto_cipher algorithm and the code specific to
    its implementation.  It is no longer necessary because the AES library
    is now optimized with x86 AES-NI, and crypto/aes.c exposes the AES
    library via the crypto_cipher API.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-19-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 24eb22d8161380eba65edc5b499299639cbe8bf9
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:15 2026 -0800

    lib/crypto: x86/aes: Add AES-NI optimization
    
    Optimize the AES library with x86 AES-NI instructions.
    
    The relevant existing assembly functions, aesni_set_key(), aesni_enc(),
    and aesni_dec(), are a bit difficult to extract into the library:
    
    - They're coupled to the code for the AES modes.
    - They operate on struct crypto_aes_ctx.  The AES library now uses
      different structs.
    - They assume the key is 16-byte aligned.  The AES library only
      *prefers* 16-byte alignment; it doesn't require it.
    
    Moreover, they're not all that great in the first place:
    
    - They use unrolled loops, which isn't a great choice on x86.
    - They use the 'aeskeygenassist' instruction, which is unnecessary, is
      slow on Intel CPUs, and forces the loop to be unrolled.
    - They have special code for AES-192 key expansion, despite that being
      kind of useless.  AES-128 and AES-256 are the ones used in practice.
    
    These are small functions anyway.
    
    Therefore, I opted to just write replacements of these functions for the
    library.  They address all the above issues.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-18-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 293c7cd5c6c00f3b6fa0072fc4b017a3a13ad1e7
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:14 2026 -0800

    lib/crypto: sparc/aes: Migrate optimized code into library
    
    Move the SPARC64 AES assembly code into lib/crypto/, wire the key
    expansion and single-block en/decryption functions up to the AES library
    API, and remove the "aes-sparc64" crypto_cipher algorithm.
    
    The result is that both the AES library and crypto_cipher APIs use the
    SPARC64 AES opcodes, whereas previously only crypto_cipher did (and it
    wasn't enabled by default, which this commit fixes as well).
    
    Note that some of the functions in the SPARC64 AES assembly code are
    still used by the AES mode implementations in
    arch/sparc/crypto/aes_glue.c.  For now, just export these functions.
    These exports will go away once the AES mode implementations are
    migrated to the library as well.  (Trying to split up the assembly file
    seemed like much more trouble than it would be worth.)
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-17-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 0cab15611e839142f4fd3c8a366acd1f7334b30b
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:13 2026 -0800

    lib/crypto: s390/aes: Migrate optimized code into library
    
    Implement aes_preparekey_arch(), aes_encrypt_arch(), and
    aes_decrypt_arch() using the CPACF AES instructions.
    
    Then, remove the superseded "aes-s390" crypto_cipher.
    
    The result is that both the AES library and crypto_cipher APIs use the
    CPACF AES instructions, whereas previously only crypto_cipher did (and
    it wasn't enabled by default, which this commit fixes as well).
    
    Note that this preserves the optimization where the AES key is stored in
    raw form rather than expanded form.  CPACF just takes the raw key.
    
    Acked-by: Ard Biesheuvel 
    Tested-by: Holger Dengler 
    Reviewed-by: Holger Dengler 
    Link: https://lore.kernel.org/r/20260112192035.10427-16-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit dc220915ddb2d1c646a7d0816b398e73ed5a5d50
Author: Rob Clark 
Date:   Fri Jan 9 07:37:29 2026 -0800

    drm/msm: Fix GMEM_BASE for gen8
    
    This should also be zero for gen8.  This does change a7xx-gen1 to zero.
    It was almost certainly incorrect before, but we have no such devices in
    CI currently.
    
    Fixes: 288a93200892 ("drm/msm/adreno: Introduce A8x GPU Support")
    Signed-off-by: Rob Clark 
    Patchwork: https://patchwork.freedesktop.org/patch/697779/
    Message-ID: <20260109153730.130462-3-robin.clark@oss.qualcomm.com>

commit 56cd8adff8cbe82a13a1db998f1353d68ed84305
Author: Rob Clark 
Date:   Fri Jan 9 07:37:28 2026 -0800

    drm/msm: Fix x2-85 TPL1_DBG_ECO_CNTL1
    
    We actually need to set b26, just claiming to do so is not enough :-)
    
    Fixes: 01ff3bf27215 ("drm/msm/a8xx: Add support for Adreno X2-85 GPU")
    Signed-off-by: Rob Clark 
    Reviewed-by: Dmitry Baryshkov 
    Patchwork: https://patchwork.freedesktop.org/patch/697778/
    Message-ID: <20260109153730.130462-2-robin.clark@oss.qualcomm.com>

commit dcbd2f8280eea2c965453ed8c3c69d6f121e950b
Author: Johan Hovold 
Date:   Sun Dec 21 17:45:52 2025 +0100

    drm/msm/a6xx: fix bogus hwcg register updates
    
    The hw clock gating register sequence consists of register value pairs
    that are written to the GPU during initialisation.
    
    The a690 hwcg sequence has two GMU registers in it that used to amount
    to random writes in the GPU mapping, but since commit 188db3d7fe66
    ("drm/msm/a6xx: Rebase GMU register offsets") they trigger a fault as
    the updated offsets now lie outside the mapping. This in turn breaks
    boot of machines like the Lenovo ThinkPad X13s.
    
    Note that the updates of these GMU registers is already taken care of
    properly since commit 40c297eb245b ("drm/msm/a6xx: Set GMU CGC
    properties on a6xx too"), but for some reason these two entries were
    left in the table.
    
    Fixes: 5e7665b5e484 ("drm/msm/adreno: Add Adreno A690 support")
    Cc: stable@vger.kernel.org      # 6.5
    Cc: Bjorn Andersson 
    Cc: Konrad Dybcio 
    Signed-off-by: Johan Hovold 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Akhil P Oommen 
    Fixes: 188db3d7fe66 ("drm/msm/a6xx: Rebase GMU register offsets")
    Patchwork: https://patchwork.freedesktop.org/patch/695778/
    Message-ID: <20251221164552.19990-1-johan@kernel.org>
    Signed-off-by: Rob Clark 

commit 5d86d542f68fda7ef6d543ac631b741db734101a
Author: Shrikanth Hegde 
Date:   Thu Jan 15 13:05:24 2026 +0530

    sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead
    
    nohz.nr_cpus was observed as contended cacheline when running
    enterprise workload on large systems.
    
    Fundamental scalability challenge with nohz.idle_cpus_mask
    and nohz.nr_cpus is the following:
    
     (1) nohz_balancer_kick() observes (reads) nohz.nr_cpus
         (or nohz.idle_cpu_mask) and nohz.has_blocked to  see whether there's
         any nohz balancing work to do, in every scheduler tick.
    
     (2) nohz_balance_enter_idle() and nohz_balance_exit_idle()
         (through nohz_balancer_kick() via sched_tick()) modify (write)
         nohz.nr_cpus (and/or nohz.idle_cpu_mask) and nohz.has_blocked.
    
    The characteristic frequencies are the following:
    
     (1) nohz_balancer_kick() happens at scheduler (busy)tick frequency
         on CPU(which has not gone idle). This is a relatively constant
         frequency  in the ~1 kHz range or lower.
    
     (2) happens at idle enter/exit frequency on every CPU that goes to idle.
         This is workload dependent, but can easily be hundreds of kHz for
         IO-bound loads and high CPU counts. Ie. can be orders of magnitude
         higher than (1), in which case a cachemiss at every invocation of (1)
         is almost inevitable. idle exit will trigger (1) on the CPU
         which is coming out of idle.
    
    There's two types of costs from these functions:
    
     (A) scheduler tick cost via (1): this happens on busy CPUs too, and is
         thus a primary scalability cost. But the rate here is constant and
         typically much lower than (B), hence the absolute benefit to workload
         scalability will be lower as well.
    
     (B) idle cost via (2): going-to-idle and coming-from-idle costs are
         secondary concerns, because they impact power efficiency more than
         they impact scalability. But in terms of absolute cost this scales
         up with nr_cpus as well, and a much faster rate, and thus may also
         approach and negatively impact system limits like
         memory bus/fabric bandwidth.
    
    Note that nohz.idle_cpus_mask and nohz.nr_cpus may appear to reside in the
    same cacheline, however under CONFIG_CPUMASK_OFFSTACK=y the backing storage
    for nohz.idle_cpus_mask will be elsewhere. With CPUMASK_OFFSTACK=n,
    the nohz.idle_cpus_mask and rest of nohz fields are in different cachelines
    under typical NR_CPUS=512/2048. This implies two separate cachelines
    being dirtied upon idle entry / exit.
    
    nohz.nr_cpus can be derived from the mask itself. Its usage doesn't warrant
    a functionally correct value. This means one less cacheline being dirtied in
    idle entry/exit path which helps to save some bus bandwidth w.r.t to those
    nohz functions(approx 50%). This in turn helps to improve enterprise
    workload throughput.
    
    On system with 480 CPUs, running "hackbench 40 process 10000 loops"
    (Avg of 3 runs)
    baseline:
         0.81%  hackbench          [k] nohz_balance_exit_idle
         0.21%  hackbench          [k] nohz_balancer_kick
         0.09%  swapper            [k] nohz_run_idle_balance
    
    With patch:
         0.35%  hackbench          [k] nohz_balance_exit_idle
         0.09%  hackbench          [k] nohz_balancer_kick
         0.07%  swapper            [k] nohz_run_idle_balance
    
    [Ingo Molnar: scalability analysis changlog]
    
    Reviewed-and-tested-by: K Prateek Nayak 
    Signed-off-by: Shrikanth Hegde 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Valentin Schneider 
    Reviewed-by: Vincent Guittot 
    Link: https://patch.msgid.link/20260115073524.376643-4-sshegde@linux.ibm.com

commit 94e70734b4d034b9df795bd1ad3452ea96e742ca
Author: Shrikanth Hegde 
Date:   Thu Jan 15 13:05:23 2026 +0530

    sched/fair: Change likelyhood of nohz.nr_cpus
    
    These days most of the system have multi cores. The likelyhood of
    at least one or more CPUs in nohz (idle state) is higher.
    
    Give accurate hint to the branch predictor.
    
    Reviewed-and-tested-by: K Prateek Nayak 
    Signed-off-by: Shrikanth Hegde 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Vincent Guittot 
    Link: https://patch.msgid.link/20260115073524.376643-3-sshegde@linux.ibm.com

commit 6b67c8a72e56041f91f70ae5995bdb769761869a
Author: Shrikanth Hegde 
Date:   Thu Jan 15 13:05:22 2026 +0530

    sched/fair: Move checking for nohz cpus after time check
    
    Current code does.
    - Read nohz.nr_cpus
    - Check if the time has passed to do NOHZ idle balance
    
    Instead do this.
    - Check if the time has passed to do NOHZ idle balance
    - Read nohz.nr_cpus
    
    This will skip the read most of the time in normal system usage.
    i.e when there are nohz.nr_cpus (system is not 100% busy).
    
    Note that when there are no idle CPUs(100% busy), even if the flag gets
    set to NOHZ_STATS_KICK | NOHZ_NEXT_KICK, find_new_ilb will fail and
    there will be no NOHZ idle balance. In such cases there will be a very
    narrow window where, kick_ilb will be called un-necessarily.
    However current functionality is still retained.
    
    Note: This patch doesn't solve any cacheline overheads. No improvement
    in performance apart from saving a few cycles of reading nohz.nr_cpus
    
    Reviewed-and-tested-by: K Prateek Nayak 
    Signed-off-by: Shrikanth Hegde 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Vincent Guittot 
    Link: https://patch.msgid.link/20260115073524.376643-2-sshegde@linux.ibm.com

commit 553255cc857c08d72658b57d01c04f76cde9a83a
Author: Zhan Xusheng 
Date:   Wed Jan 14 17:00:35 2026 +0800

    sched/fair: Fix math notation errors in avg_vruntime comment
    
    The avg_vruntime comment contains a couple of mathematical notation
    issues:
    
     - The summation over w_i * (V - v_i) is written in an ambiguous form
     - The delta term refers to v instead of v0, which is inconsistent
       with the code and preceding explanation
    
    Fix these to make the comment mathematically correct and consistent
    with the implementation.
    
    Signed-off-by: Zhan Xusheng 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260114090035.19033-1-zhanxusheng@xiaomi.com

commit 8d737320166bd145af70a3133a9964b00ca81cba
Author: Gabriele Monaco 
Date:   Mon Jan 12 15:04:13 2026 +0100

    sched: Fix build for modules using set_tsk_need_resched()
    
    Commit adcc3bfa8806 ("sched: Adapt sched tracepoints for RV task model")
    added a tracepoint to the need_resched action that can be triggered also
    by set_tsk_need_resched.
    This function was previously accessible from out-of-tree modules but
    it's no longer available because the __trace_set_need_resched() symbol
    is not exported (together with the tracepoint itself, which was exported
    in a separate patch) and building such modules fails.
    
    Export __trace_set_need_resched to modules to fix those build issues.
    
    Fixes: adcc3bfa8806 ("sched: Adapt sched tracepoints for RV task model")
    Signed-off-by: Gabriele Monaco 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Phil Auld 
    Link: https://patch.msgid.link/20260112140413.362202-1-gmonaco@redhat.com

commit d27267558fd25acb07d7ff28a7ff44eacf799eaf
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:53:02 2026 +0530

    arm64: dts: qcom: lemans; Add EL2 overlay
    
    All the Lemans IOT variants boards are using Gunyah hypervisor which
    means that, so far, Linux-based OS could only boot in EL1 on those
    devices.  However, it is possible for us to boot Linux at EL2 on these
    devices [1].
    
    When running under Gunyah, the remote processor firmware IOMMU streams
    are controlled by Gunyah. However, without Gunyah, the IOMMU is managed
    by the consumer of this DeviceTree. Therefore, describe the firmware
    streams for each remote processor.
    
    Add a EL2-specific DT overlay and apply it to Lemans IOT variant
    devices to create -el2.dtb for each of them alongside "normal" dtb.
    
    [1]
    https://docs.qualcomm.com/bundle/publicresource/topics/80-70020-4/boot-developer-touchpoints.html#uefi
    
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-14-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 2a62345b30529e488beb6a1220577b3495933724
Author: Michael Roth 
Date:   Thu Jan 8 15:46:22 2026 -0600

    KVM: guest_memfd: GUP source pages prior to populating guest memory
    
    Currently the post-populate callbacks handle copying source pages into
    private GPA ranges backed by guest_memfd, where kvm_gmem_populate()
    acquires the filemap invalidate lock, then calls a post-populate
    callback which may issue a get_user_pages() on the source pages prior to
    copying them into the private GPA (e.g. TDX).
    
    This will not be compatible with in-place conversion, where the
    userspace page fault path will attempt to acquire the filemap invalidate
    lock while holding the mm->mmap_lock, leading to a potential ABBA
    deadlock.
    
    Address this by hoisting the GUP above the filemap invalidate lock so
    that these page faults path can be taken early, prior to acquiring the
    filemap invalidate lock.
    
    It's not currently clear whether this issue is reachable with the
    current implementation of guest_memfd, which doesn't support in-place
    conversion, however it does provide a consistent mechanism to provide
    stable source/target PFNs to callbacks rather than punting to
    vendor-specific code, which allows for more commonality across
    architectures, which may be worthwhile even without in-place conversion.
    
    As part of this change, also begin enforcing that the 'src' argument to
    kvm_gmem_populate() must be page-aligned, as this greatly reduces the
    complexity around how the post-populate callbacks are implemented, and
    since no current in-tree users support using a non-page-aligned 'src'
    argument.
    
    Suggested-by: Sean Christopherson 
    Co-developed-by: Sean Christopherson 
    Co-developed-by: Vishal Annapurve 
    Signed-off-by: Vishal Annapurve 
    Tested-by: Vishal Annapurve 
    Tested-by: Kai Huang 
    Signed-off-by: Michael Roth 
    Tested-by: Yan Zhao 
    Reviewed-by: Yan Zhao 
    Link: https://patch.msgid.link/20260108214622.1084057-7-michael.roth@amd.com
    [sean: avoid local "p" variable]
    Signed-off-by: Sean Christopherson 

commit 189fd1b059a9c7ed22750bc8a4a1182c58ccf138
Author: Michael Roth 
Date:   Thu Jan 8 15:46:21 2026 -0600

    KVM: TDX: Document alignment requirements for KVM_TDX_INIT_MEM_REGION
    
    Since it was never possible to use a non-PAGE_SIZE-aligned @source_addr,
    go ahead and document this as a requirement. This is in preparation for
    enforcing page-aligned @source_addr for all architectures in
    guest_memfd.
    
    Reviewed-by: Vishal Annapurve 
    Tested-by: Kai Huang 
    Signed-off-by: Michael Roth 
    Reviewed-by: Yan Zhao 
    Link: https://patch.msgid.link/20260108214622.1084057-6-michael.roth@amd.com
    Signed-off-by: Sean Christopherson 

commit dcbcc2323c806b55939d765c13d0728421756017
Author: Michael Roth 
Date:   Thu Jan 8 15:46:20 2026 -0600

    KVM: SEV: Document/enforce page-alignment for KVM_SEV_SNP_LAUNCH_UPDATE
    
    In the past, KVM_SEV_SNP_LAUNCH_UPDATE accepted a non-page-aligned
    'uaddr' parameter to copy data from, but continuing to support this with
    new functionality like in-place conversion and hugepages in the pipeline
    has proven to be more trouble than it is worth, since there are no known
    users that have been identified who use a non-page-aligned 'uaddr'
    parameter.
    
    Rather than locking guest_memfd into continuing to support this, go
    ahead and document page-alignment as a requirement and begin enforcing
    this in the handling function.
    
    Reviewed-by: Vishal Annapurve 
    Tested-by: Kai Huang 
    Signed-off-by: Michael Roth 
    Link: https://patch.msgid.link/20260108214622.1084057-5-michael.roth@amd.com
    Signed-off-by: Sean Christopherson 

commit 8622ef05709fbc4903f54cdf1ac8c3725e479dd8
Author: Michael Roth 
Date:   Thu Jan 8 15:46:19 2026 -0600

    KVM: guest_memfd: Remove preparation tracking
    
    guest_memfd currently uses the folio uptodate flag to track:
    
      1) whether or not a page has been cleared before initial usage
      2) whether or not the architecture hooks have been issued to put the
         page in a private state as defined by the architecture
    
    In practice, (2) is only actually being tracked for SEV-SNP VMs, and
    there do not seem to be any plans/reasons that would suggest this will
    change in the future, so this additional tracking/complexity is not
    really providing any general benefit to guest_memfd users.  On the other
    hand, future plans around in-place conversion and hugepage support will
    make the burden of tracking this information within guest_memfd even more
    complex.
    
    With in-place conversion and hugepage support, the plan is to use the
    per-folio uptodate flag purely to track the initial clearing of folios,
    whereas conversion operations could trigger multiple transitions between
    'prepared' and 'unprepared' and thus need separate tracking.  Since
    preparation generally happens during fault time, i.e. on the "read-side"
    of any VM-wide locks that might protect state tracked by guest_memfd,
    supporting concurrent handling of page faults would likely require more
    complex locking schemes if the "preparedness" state were tracked by
    guest_memfd, i.e. if it needs to be updated as part of handling the fault.
    
    Instead of keeping this current/future complexity within guest_memfd for
    what is essentially just SEV-SNP, just drop the tracking for (2) and have
    the arch-specific preparation hooks get triggered unconditionally on
    every fault so the arch-specific hooks can check the preparation state
    directly and decide whether or not a folio still needs additional
    preparation. In the case of SEV-SNP, the preparation state is already
    checked again via the preparation hooks to avoid double-preparation, so
    nothing extra needs to be done to update the handling of things there.
    
    Reviewed-by: Vishal Annapurve 
    Tested-by: Vishal Annapurve 
    Reviewed-by: Pankaj Gupta 
    Tested-by: Kai Huang 
    Signed-off-by: Michael Roth 
    Link: https://patch.msgid.link/20260108214622.1084057-4-michael.roth@amd.com
    [sean: massage changelog]
    Signed-off-by: Sean Christopherson 

commit 6538b6221cc2feda415ca1946e66a5ef02dc6a0a
Author: Michael Roth 
Date:   Thu Jan 8 15:46:18 2026 -0600

    KVM: guest_memfd: Remove partial hugepage handling from kvm_gmem_populate()
    
    kvm_gmem_populate(), and the associated post-populate callbacks, have
    some limited support for dealing with guests backed by hugepages by
    passing the order information along to each post-populate callback and
    iterating through the pages passed to kvm_gmem_populate() in
    hugepage-chunks.
    
    However, guest_memfd doesn't yet support hugepages, and in most cases
    additional changes in the kvm_gmem_populate() path would also be needed
    to actually allow for this functionality.
    
    This makes the existing code unnecessarily complex, and makes changes
    difficult to work through upstream due to theoretical impacts on
    hugepage support that can't be considered properly without an actual
    hugepage implementation to reference. So for now, remove what's there
    so changes for things like in-place conversion can be
    implemented/reviewed more efficiently.
    
    Suggested-by: Vishal Annapurve 
    Co-developed-by: Vishal Annapurve 
    Signed-off-by: Vishal Annapurve 
    Tested-by: Vishal Annapurve 
    Tested-by: Kai Huang 
    Signed-off-by: Michael Roth 
    Tested-by: Yan Zhao 
    Reviewed-by: Yan Zhao 
    Link: https://patch.msgid.link/20260108214622.1084057-3-michael.roth@amd.com
    [sean: check for !IS_ERR() before checking folio_order()]
    Signed-off-by: Sean Christopherson 

commit 75faabf6b92ad1d14fce8d45cf40f6db53cf96fd
Author: Thorsten Blum 
Date:   Tue Jan 13 09:21:26 2026 +0100

    thermal: intel: Use sysfs_emit() in a sysfs show function
    
    Replace sprintf() with sysfs_emit() in sysfs show functions.
    
    sysfs_emit() is preferred to format sysfs output as it provides better
    bounds checking.
    
    Signed-off-by: Thorsten Blum 
    [ rjw: Subject tweaks ]
    Link: https://patch.msgid.link/20260113082130.789891-2-thorsten.blum@linux.dev
    Signed-off-by: Rafael J. Wysocki 

commit 47c9ef95a79a72653a5e5274e46f013df6b04626
Author: Sumeet Pawnikar 
Date:   Sun Jan 11 21:37:39 2026 +0530

    thermal: intel: fix typo "nagative" in comment for cpu argument
    
    Fix typo "nagative" -> "negative" for cpu argument value in
    comment section.
    
    Signed-off-by: Sumeet Pawnikar 
    [ rjw: Subject tweak ]
    Link: https://patch.msgid.link/20260111160739.15984-1-sumeet4linux@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit 54b3cd55a515c7c0fcfa0c1f0b10d62c11d64bcc
Author: Daniel Tang 
Date:   Wed Jan 14 21:01:52 2026 -0500

    powercap: intel_rapl: Add PL4 support for Ice Lake
    
    Microsoft Surface Pro 7 firmware throttles the processor upon
    boot/resume. Userspace needs to be able to restore the correct value.
    
    Link: https://github.com/linux-surface/linux-surface/issues/706
    Signed-off-by: Daniel Tang 
    Link: https://patch.msgid.link/6088605.ChMirdbgyp@daniel-desktop3
    Signed-off-by: Rafael J. Wysocki 

commit 07e5e811f86dcd6f595c3bbd71cde294e8545889
Author: Sumeet Pawnikar 
Date:   Sun Jan 11 19:42:36 2026 +0530

    powercap: Replace sprintf() with sysfs_emit() in sysfs show functions
    
    Replace all sprintf() calls with sysfs_emit() in sysfs show functions.
    
    sysfs_emit() is preferred over sprintf() for formatting sysfs output
    as it provides better bounds checking and prevents potential buffer
    overflows.
    
    Also, replace sprintf() with sysfs_emit() in show_constraint_name()
    and simplify the code by removing the redundant strlen() call since
    sysfs_emit() returns the length.
    
    Signed-off-by: Sumeet Pawnikar 
    Link: https://patch.msgid.link/20260111141237.12340-1-sumeet4linux@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit 1ccc3bec14b85fd67f30272bc6d14b2aada25203
Author: Thorsten Blum 
Date:   Mon Jan 12 18:49:00 2026 +0100

    thermal: sysfs: Replace snprintf() with strscpy() in policy_store()
    
    There is no need to use snprintf() with a format specifier to copy 'buf'
    to 'name'; use strscpy() directly instead.
    
    Signed-off-by: Thorsten Blum 
    [ rjw: Subject and changelog tweaks ]
    Link: https://patch.msgid.link/20260112174901.767434-1-thorsten.blum@linux.dev
    Signed-off-by: Rafael J. Wysocki 

commit 0404b98c6bbca7a3b1e59a20d173fa149ac20194
Author: Dmitry Baryshkov 
Date:   Tue Jan 6 03:01:19 2026 +0200

    arm64: dts: qcom: sm8150: add uart13
    
    Add UART13, typically used for Bluetooth connection on SM8150.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-9-0386204328be@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit c303e89f7f17c29981d09f8beaaf60937ae8b1f2
Author: Dmitry Baryshkov 
Date:   Tue Jan 6 03:01:18 2026 +0200

    arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1
    
    Specify power supply for the second chain / antenna output of the
    onboard WiFi chip.
    
    Fixes: 3f72e2d3e682 ("arm64: dts: qcom: Add Dragonboard 845c")
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-8-0386204328be@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 8bfb696ccdc5bcfad7a45b84c2c8a36757070e19
Author: Dmitry Baryshkov 
Date:   Tue Jan 6 03:01:17 2026 +0200

    arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0
    
    On SDM845 SPI uses hardware-provided chip select, while specifying
    cs-gpio makes the driver request GPIO pin, which on DB845c conflicts
    with the normal host controllers pinctrl entry.
    
    Drop the cs-gpios property to restore SPI functionality.
    
    Fixes: cb29e7106d4e ("arm64: dts: qcom: db845c: Add support for MCP2517FD")
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-7-0386204328be@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit c5dc4812f6bf397b82290c540085e9ec98b47b30
Author: Dmitry Baryshkov 
Date:   Tue Jan 6 03:01:16 2026 +0200

    arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
    
    Follow commit 9c92d36b0b1e ("arm64: dts: qcom: qrb2210-rb1: Fix UART3
    wakeup IRQ storm") and apply the similar fix to the RB2 platform.
    
    Having RX / TX pins as pull up and wakup interrupt as high-level
    triggered generates an interrupt storm when trying to suspend the
    device. Avoid the storm by using the falling edge trigger (as all other
    platforms do).
    
    Fixes: cab60b166575 ("arm64: dts: qcom: qrb4210-rb2: Enable bluetooth")
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-6-0386204328be@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit c116cab81513858e46e54f1788c5fb8ec231cc9a
Author: Sumeet Pawnikar 
Date:   Sun Jan 11 00:08:34 2026 +0530

    thermal: debugfs: Use seq_puts() for constant string output
    
    Replace seq_printf() with seq_puts() when outputting a constant string
    without format specifiers in the thermal mitigation debugfs interface.
    
    seq_puts() is more appropriate and efficient as it avoids unnecessary
    format string parsing overhead.
    
    No functional change.
    
    Signed-off-by: Sumeet Pawnikar 
    Link: https://patch.msgid.link/20260110183912.372215-1-sumeet4linux@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit 7cb776b74c666c04c9fa10482b0e4d9f049d4fc2
Author: Sumeet Pawnikar 
Date:   Sat Jan 10 14:58:51 2026 +0530

    thermal: Replace sprintf() with sysfs_emit() for sysfs show functions
    
    Replace all sprintf() calls with sysfs_emit() and sysfs_emit_at() in
    sysfs show functions.
    
    sysfs_emit() and sysfs_emit_at() are preferred over sprintf() for
    formatting sysfs output as they provide better bounds checking and
    prevent potential buffer overflows.
    
    Signed-off-by: Sumeet Pawnikar 
    Link: https://patch.msgid.link/20260110092851.9078-1-sumeet4linux@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit 5a741f8cc6fe62542f955cd8d24933a1b6589cbd
Author: Zilin Guan 
Date:   Sun Dec 28 12:48:36 2025 +0000

    soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe()
    
    In mpfs_sys_controller_probe(), if of_get_mtd_device_by_node() fails,
    the function returns immediately without freeing the allocated memory
    for sys_controller, leading to a memory leak.
    
    Fix this by jumping to the out_free label to ensure the memory is
    properly freed.
    
    Also, consolidate the error handling for the mbox_request_channel()
    failure case to use the same label.
    
    Fixes: 742aa6c563d2 ("soc: microchip: mpfs: enable access to the system controller's flash")
    Co-developed-by: Jianhao Xu 
    Signed-off-by: Jianhao Xu 
    Signed-off-by: Zilin Guan 
    Signed-off-by: Conor Dooley 

commit dccc66b0e92d48d9a1908a3ccb8142e0ee3381f5
Author: Geert Uytterhoeven 
Date:   Thu Jan 15 17:24:02 2026 +0100

    regmap: Enable REGMAP when REGMAP_SLIMBUS is enabled
    
    Invisible symbol REGMAP defaults to y when any of the REGMAP_* symbols
    is enabled, effectively auto-enabling it when needed.  However,
    REGMAP_SLIMBUS is missing from the list.
    
    Currently this does not cause any issues, as all symbols selecting
    REGMAP_SLIMBUS also select REGMAP and/or REGMAP_IRQ.  Add REGMAP_SLIMBUS
    to the list for consistency, and to prevent any future issues.
    
    Signed-off-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/47872f8f4cf613e9710963bf871c6ac7b2ce81e8.1768494166.git.geert+renesas@glider.be
    Signed-off-by: Mark Brown 

commit 7a3d1b04d938f31e112fe09c0ffc1af830ba1f6d
Author: Charles Keepax 
Date:   Thu Jan 15 14:11:06 2026 +0000

    ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set
    
    If CONFIG_PM_SLEEP is not set the completion used will not exist. Update
    the code to avoid the build error this introduces, without PM_SLEEP it
    should be safe to always run the conditional code.
    
    Fixes: ffd7e8a10111 ("ASoC: SDCA: Device boot into the system suspend process")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202601151803.XY7KryHC-lkp@intel.com/
    Signed-off-by: Charles Keepax 
    Link: https://patch.msgid.link/20260115141107.564929-1-ckeepax@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 60e8451be1f7af4b51540f2cfd65c9c85af752e9
Author: AngeloGioacchino Del Regno 
Date:   Thu Jan 15 13:56:22 2026 +0100

    ASoC: dt-bindings: mt8192-afe-pcm: Fix clocks and clock-names
    
    Both clocks and clock-names are missing (a lot of) entries: add
    all the used audio clocks and their description and also fix the
    example node.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Fixes: c861af7861aa ("ASoC: dt-bindings: mediatek: mt8192: re-add audio afe document")
    Link: https://patch.msgid.link/20260115125624.73598-3-angelogioacchino.delregno@collabora.com
    Signed-off-by: Mark Brown 

commit 4711b292b440a8404833df0e0ba96dad86600a84
Author: Hsieh Hung-En 
Date:   Fri Jan 16 00:13:59 2026 +0800

    ASoC: es8328: Propagate error codes from regmap updates
    
    In es8328_hw_params(), the return value of
    snd_soc_component_update_bits() was ignored. This could lead to silent
    failures where the hardware is left in an inconsistent state if a
    regmap write fails.
    
    Check the return value of regmap updates and propagate any errors back
    to the ALSA core. Return 0 on success to match the DAI ops convention.
    
    Signed-off-by: Hsieh Hung-En 
    Link: https://patch.msgid.link/20260115161359.41979-1-hungen3108@gmail.com
    Signed-off-by: Mark Brown 

commit f6551f7861aca09cb2fdf675d6bb9ca2ffa9038a
Author: Rosen Penev 
Date:   Tue Dec 16 22:30:27 2025 -0800

    i2c: rtl9300: use of instead of fwnode
    
    Avoids having to use to_of_node and just assign directly. This is an OF
    only driver anyway.
    
    Use _scoped for the for each loop to avoid refcount leaks.
    
    Signed-off-by: Rosen Penev 
    Reviewed-by: Chris Packham 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251217063027.37987-3-rosenp@gmail.com

commit fc31008d5f57e71afa124550ca01b4399434435e
Author: Rosen Penev 
Date:   Tue Dec 16 22:30:26 2025 -0800

    i2c: rtl9300: remove const cast
    
    These casts are used to remove const for no good reason. Fix the types
    instead.
    
    Signed-off-by: Rosen Penev 
    Reviewed-by: Chris Packham 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251217063027.37987-2-rosenp@gmail.com

commit 5e35a24c96185e1be4c24a713e53a49e92ab925b
Author: Damien Le Moal 
Date:   Tue Jan 6 16:00:57 2026 +0900

    block: improve blk_op_str() comment
    
    Replace XXX with what it actually means.
    
    Signed-off-by: Damien Le Moal 
    Reviewed-by: Christoph Hellwig 
    Reviewed-by: Chaitanya Kulkarni 
    Reviewed-by: Bart Van Assche 
    Signed-off-by: Jens Axboe 

commit 41ee77b75308354054f4fe03a05b8016a0d41573
Author: Damien Le Moal 
Date:   Tue Jan 6 16:00:56 2026 +0900

    block: fix blk_zone_cond_str() comment
    
    Fix the comment for blk_zone_cond_str() by replacing the meaningless
    BLK_ZONE_ZONE_XXX comment with the correct BLK_ZONE_COND_name, thus also
    replacing the XXX with what that actually means.
    
    Signed-off-by: Damien Le Moal 
    Reviewed-by: Christoph Hellwig 
    Reviewed-by: Chaitanya Kulkarni 
    Reviewed-by: Bart Van Assche 
    Signed-off-by: Jens Axboe 

commit e8f614dabd2238e462e4543abd1eb5c59e612836
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:40:06 2026 +0100

    ACPICA: Refactor for TPR Base/Limit registers bitmasks
    
    Link: https://github.com/acpica/acpica/commit/5cb62a1d4970
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3193976.CbtlEUcBR6@rafael.j.wysocki

commit 3b8907925a7964903955b59d974d98c7ae707d7a
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:39:10 2026 +0100

    ACPICA: Replace TPRn Base and Limit registers
    
    Replace TPRn Base and Limit registers with compatible bitmasks for them.
    
    Link: https://github.com/acpica/acpica/commit/be91c5813936
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/1871109.TLkxdtWsSY@rafael.j.wysocki

commit 099b050699c739797f6dd2bf47f6e15f11504db4
Author: Saket Dumbre 
Date:   Wed Jan 14 13:38:12 2026 +0100

    ACPICA: Logfile: Changes for version 20251212
    
    Link: https://github.com/acpica/acpica/commit/446be438238e
    Signed-off-by: Saket Dumbre 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/15657187.tv2OnDr8pf@rafael.j.wysocki

commit 691474b1ae63845044a28debe0e06b88a836770b
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:37:19 2026 +0100

    ACPICA: Align comments in TPRn-related structures
    
    Align comments in ACPI_TPRN_BASE_REG and ACPI_TPRN_LIMIT_REG structures.
    
    Link: https://github.com/acpica/acpica/commit/95815d550969
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2286538.NgBsaNRSFp@rafael.j.wysocki

commit 9b02cf9ee67b284020d051da126694d555977e12
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:36:32 2026 +0100

    ACPICA: Cleanup comments and DTPR Table handle functions
    
    Link: https://github.com/acpica/acpica/commit/cc480264335e
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2042656.yKVeVyVuyW@rafael.j.wysocki

commit 9565d4713ba6d3711d7b47fee9dde6725721ac06
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:35:31 2026 +0100

    ACPICA: Verify DTPR and TPR Instance buffer pointers
    
    Verify DTPR and TPR Instance buffer pointers and refactor comments.
    
    Link: https://github.com/acpica/acpica/commit/bdec5b61cf5b
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/884204745.0ifERbkFSE@rafael.j.wysocki

commit b110e28c3bf52c984c232ee633139ea10f754c0c
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:34:43 2026 +0100

    ACPICA: Fix Segmentation Fault error related to DTPR
    
    Fix Segmentation Fault error, caused by invalid buffer lenght in DTPR
    Table Template:
    
     * Update buffer length for TPR Table, which invalid value caused
       Segmentation Fault, during ASL file production.
    
     * Refactor invalid values of TPR instances, arrays and serialization
       requests count and TPR Base addresses in the DTPR table template.
    
     * Fix offset updating in the acpi_dm_dump_dtpr function.
    
    Link: https://github.com/acpica/acpica/commit/f75850bc4717
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2541195.jE0xQCEvom@rafael.j.wysocki

commit 6f99d3fe224feefabc012869e10cbff52eb5f5f8
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:33:49 2026 +0100

    ACPICA: Create auxiliary ACPI_TPR_AUX_SR structure for iASL compiler
    
    Define unofficial structure ACPI_TPR_AUX_SR, which holds information
    about the number of serialization registers for TPRs.
    
    It simplifies DTPR Serialization Request Info Table compilation.
    
    Link: https://github.com/acpica/acpica/commit/31f470e708a9
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2266165.Icojqenx9y@rafael.j.wysocki

commit f259664b8853981035d5fc5297e785c99f159618
Author: Pawel Chmielewski 
Date:   Wed Jan 14 13:32:55 2026 +0100

    ACPICA: ACPI 6.6: Add _VDM (Voltage Domain) object
    
    A processor voltage domain is an identifier that specifies the voltage
    plane associated with a given group of processors.
    
    Refer to section 6.2.10. _VDM (Voltage Domain) of ACPI 6.6 specification
    for more information.
    
    Link: https://github.com/acpica/acpica/commit/d0dbb157646d
    Signed-off-by: Pawel Chmielewski 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/1921526.atdPhlSkOF@rafael.j.wysocki

commit 146b5e78b3ea6ae1594f5029109c2ddaf251b1cb
Author: Pawel Chmielewski 
Date:   Wed Jan 14 13:31:59 2026 +0100

    ACPICA: actbl3.h: ACPI 6.6: SRAT: New flag in Memory Affinity Structure
    
    ACPI 6.6 introduces Specific-Purpose flag to Memory Affinity structure.
    
    Link: https://github.com/acpica/acpica/commit/cfce3b689b5e
    Signed-off-by: Pawel Chmielewski 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3868802.MHq7AAxBmi@rafael.j.wysocki

commit 8059c6230617b7f69c36958d59e1025a62f7185b
Author: Pawel Chmielewski 
Date:   Wed Jan 14 13:31:06 2026 +0100

    ACPICA: actbl2.h: ACPI 6.6: RAS2: Update Parameter Block structure
    
    ACPI 6.6 introduces RAS2 enhancements for patrol scrub functionality,
    adding new fields to the Parameter Block structure. These fields are
    applicable only in the response to the GET_PATROL_PARAMETERS command.
    
    Link: https://github.com/acpica/acpica/commit/062842024000
    Signed-off-by: Pawel Chmielewski 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2263284.Mh6RI2rZIc@rafael.j.wysocki

commit 522ceeceff12426b5d9e0f577921c873b9d6af6a
Author: Jose Marinho 
Date:   Wed Jan 14 13:29:59 2026 +0100

    ACPICA: Add Arm IORT IWB node definitions
    
    The IORT IUWB node is defined in IORT issue E.g
    See https://developer.arm.com/documentation/den0049/eg
    
    Link: https://github.com/acpica/acpica/commit/a90dc2f5380c
    Signed-off-by: Jose Marinho 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2691130.Lt9SDvczpP@rafael.j.wysocki

commit 0cc5b091ecf8d3695551b654863c3a05cdd69089
Author: Jose Marinho 
Date:   Wed Jan 14 13:29:05 2026 +0100

    ACPICA: Add GICv5 MADT structures
    
    The GICv5 adds the following MADT structures:
     - IRS
     - ITS Config Frame
     - ITS Translate Frame
    
    The ACPI spec ECR is at https://github.com/tianocore/edk2/issues/11148
    
    Link: https://github.com/acpica/acpica/commit/69cca52ddf04
    Signed-off-by: Jose Marinho 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/1953107.CQOukoFCf9@rafael.j.wysocki

commit c3bc5f6d893b8e42890bf0a1097e6cc4ec33fe0b
Author: Armin Wolf 
Date:   Wed Jan 14 13:27:47 2026 +0100

    ACPICA: Fix asltests using the Fatal() opcode
    
    Some asltests test the behavior of the Fatal() opcode and thus require
    that said opcode does not return an error when called.
    
    Introduce a compile-time option called ACPI_CONTINUE_ON_FATAL to
    instruct the executor to continue the execution of AML bytecode when
    encountering a Fatal() opcode. Also update the asltest to use this
    new option.
    
    Fixes: ("Abort AML bytecode execution when executing AML_FATAL_OP")
    Link: https://github.com/acpica/acpica/commit/428b3410c490
    Signed-off-by: Armin Wolf 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2052065.usQuhbGJ8B@rafael.j.wysocki

commit 091c4af3562d0b8484c7098fd16cf3cf9f39e7c9
Author: Ben Horgan 
Date:   Wed Jan 14 13:26:26 2026 +0100

    ACPICA: ACPI 6.4: PPTT: include all fields in subtable type1
    
    In PPTT version 3 an extra field, Cache ID, was added to the Cache Type
    Structure.  The struct, struct acpi_pptt_cache_v1, contains only this field. This
    differs from the treatment of other versioned structures and is unexpected
    for linux which reuses the actbl2.h header file. Include all the fields of
    the new Cache Type Structure in struct acpi_pptt_cache_v1 and fix up all uses.
    
    Link: https://github.com/acpica/acpica/commit/a9ec9105f552
    Signed-off-by: Ben Horgan 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/1851677.VLH7GnMWUR@rafael.j.wysocki

commit 026ad376a6a48538b576f3589331daa94daae6f0
Author: Armin Wolf 
Date:   Wed Jan 14 13:25:33 2026 +0100

    ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
    
    The ACPI specification states that when executing AML_FATAL_OP,
    the OS should log the fatal error event and shutdown in a timely
    fashion.
    
    Windows complies with this requirement by immediatly entering a
    Bso_d, effectively aborting the execution of the AML bytecode in
    question.
    
    ACPICA however might continue with the AML bytecode execution
    should acpi_os_signal() simply return AE_OK. This will cause issues
    because ACPI BIOS implementations might assume that the Fatal()
    operator does not return.
    
    Fix this by aborting the AML bytecode execution in such a case
    by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a
    local variable because of its small size (12 bytes) and to ensure
    that acpi_os_signal() always receives valid information about the
    fatal ACPI BIOS error.
    
    Link: https://github.com/acpica/acpica/commit/d516c7758ba6
    Signed-off-by: Armin Wolf 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki

commit 30c2a333aa90c4265bed7629980eb0df72f56dfb
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:24:38 2026 +0100

    ACPICA: Define DTPR structure related info tables and data template
    
     * DTPR Table Info
     * TPR Instance Table Info
     * TPR Array Table Info
     * TPR Serialize Request Table Info
     * DTPR Table Data Template
    
    Link: https://github.com/acpica/acpica/commit/abadf1d34732
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3676546.iIbC2pHGDl@rafael.j.wysocki

commit c5ecbc65bb2287b66b3b8adbdbe0fddb81bc297f
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:23:40 2026 +0100

    ACPICA: Add DTPR table support for the ASL compiler
    
    Define DTPR related structures offsets.
    
    Link: https://github.com/acpica/acpica/commit/c6fc16c8936d
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/7902293.EvYhyI6sBW@rafael.j.wysocki

commit 75c3b2d97c2a7e2197437e673c5140731dd0004a
Author: Xianglai Li 
Date:   Wed Jan 14 13:22:50 2026 +0100

    ACPICA: iASL: Add definitions for the IOVT table
    
    Add definitions for the IOVT table and its subtables.
    
    Link: https://github.com/acpica/acpica/commit/14c0def532ac
    Signed-off-by: Xianglai Li 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2031013.PYKUYFuaPT@rafael.j.wysocki

commit 78ebefd2cbcbaa3ff6d13754d104f38827ae7de9
Author: Armin Wolf 
Date:   Wed Jan 14 13:21:59 2026 +0100

    ACPICA: Add support for the Microsoft display mux _OSI string
    
    As per [1].
    
    Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/display/automatic-display-switch [1]
    Link: https://github.com/acpica/acpica/commit/28b644211ff2
    Signed-off-by: Armin Wolf 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/10790566.nUPlyArG6x@rafael.j.wysocki

commit 55e81991e1e4f8e220e83677919a65e919a407bc
Author: Dave Jiang 
Date:   Wed Jan 14 13:21:05 2026 +0100

    ACPICA: Add KEYP table definition
    
    Software uses this table to discover the base address of the Key
    Configuration Unit (KCU) register block associated with each IDE capable
    host bridge.
    
    [1]: Root Complex IDE Key Configuration Unit Software Programming Guide
         https://cdrdv2.intel.com/v1/dl/getContent/732838
    
    Link: https://github.com/acpica/acpica/commit/af970172e2dd
    Signed-off-by: Dave Jiang 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3401908.44csPzL39Z@rafael.j.wysocki

commit f851e03bce968ff9b3faad1b616062e1244fd38d
Author: Alexey Simakov 
Date:   Wed Jan 14 13:20:17 2026 +0100

    ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
    
    Cover a missed execution path with a new check.
    
    Fixes: 0acf24ad7e10 ("ACPICA: Add support for PCC Opregion special context data")
    Link: https://github.com/acpica/acpica/commit/f421dd9dd897
    Signed-off-by: Alexey Simakov 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3030574.e9J7NaK4W3@rafael.j.wysocki

commit ce04af0a1bf96a6adbbe57b2d1548491cd59772b
Author: Armin Wolf 
Date:   Wed Jan 14 13:19:22 2026 +0100

    ACPICA: Add UUIDs associated with TPM 2.0 devices
    
    The Trusted Computing Group has designed multiple interface extensions
    around TPM 2.0 devices including the ACPI start method, hardware
    information and memory clear features. Add the associated UUIDs to the
    list of known UUIDs so that the ASL compiler stops complaining about
    them.
    
    Link: https://github.com/acpica/acpica/commit/0e8b10b05825
    Signed-off-by: Armin Wolf 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2254685.irdbgypaU6@rafael.j.wysocki

commit 19df9f21ca1a2f728deb880a526db0742059ca9f
Author: Armin Wolf 
Date:   Wed Jan 14 13:18:33 2026 +0100

    ACPICA: Add UUID for Microsoft fan extensions
    
    Microsoft has designed an interface for reading/writing fan speed
    trip points. Add the associated UUID to the list of known UUIDs so
    that the ASL compiler stops complaining about it.
    
    Link: https://github.com/acpica/acpica/commit/67f0202c0fb4
    Signed-off-by: Armin Wolf 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/5045837.GXAFRqVoOG@rafael.j.wysocki

commit 05390d31d77ebd4cbd0bff54cbdcfd4283c9a93f
Author: Zilin Guan 
Date:   Wed Jan 14 13:17:36 2026 +0100

    ACPICA: ACPICA: replace ACPI_FREE() with acpi_ut_delete_object_desc()
    
    acpi_ut_create_internal_object() may allocate memory from a slab cache
    via kmem_cache_zalloc(), but the code currently frees it with ACPI_FREE(),
    which calls kfree().
    
    This mismatch prevents the object from being released properly and may
    lead to memory leaks or other issues.
    
    Fix this by replacing ACPI_FREE() with acpi_ut_delete_object_desc(),
    which matches the allocation method used for internal objects.
    
    Link: https://github.com/acpica/acpica/commit/a1c55dfea194
    Signed-off-by: Zilin Guan 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/4710853.LvFx2qVVIh@rafael.j.wysocki

commit d6f6bae3ecba665e18a6b6cfcd575f8e9f46b204
Author: Michal Camacho Romero 
Date:   Wed Jan 14 13:16:23 2026 +0100

    ACPICA: Add support for the new ACPI Table: DTPR
    
    Define a new the ACPI Table, structure and registers, related with it, according
    to the latest version of the Intel TXT DMA Protection Ranges (TPR) specification
    (Revision 0.73):
    
    *    DTPR ACPI Table
    *    TPR Base Register
    *    TPR Serialize Request Register
    *    TPR Limit Register
    *    TPR Instance Structure
    *    DMAR TXT Protected Reporting Structure
    
    These structures will be used to handle TPRs on the Intel CPU's.
    
    Link: https://github.com/acpica/acpica/commit/10e7a88f70da
    Link: https://uefi.org/sites/default/files/resources/633933_Intel_TXT_DMA_Protection_Ranges_rev_0p73.pdf
    Signed-off-by: Michal Camacho Romero 
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/6234415.lOV4Wx5bFT@rafael.j.wysocki

commit f7d05ee84a6a8d3775e0f0c3070d9380bed844a9
Author: Fuad Tabba 
Date:   Thu Dec 11 10:47:09 2025 +0000

    KVM: arm64: Prevent host from managing timer offsets for protected VMs
    
    For protected VMs, the guest's timer offset state should not be
    controlled by the host and must always run with a virtual counter offset
    of 0. The existing timer logic allowed the host to set and manage the
    timer counter offsets for protected VMs in certain cases.
    
    Disable all host-side management of timer offsets for protected VMs by
    adding checks in the relevant code paths.
    
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251211104710.151771-10-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit b12b3b04f6ba072ca5a618a75e546c996be94bd1
Author: Fuad Tabba 
Date:   Thu Dec 11 10:47:08 2025 +0000

    KVM: arm64: Check whether a VM IOCTL is allowed in pKVM
    
    Certain VM IOCTLs are tied to specific VM features. Since pKVM does not
    support all features, restrict which IOCTLs are allowed depending on
    whether the associated feature is supported.
    
    Use the existing VM capability check as the source of truth to whether
    an IOCTL is allowed for a particular VM by mapping the IOCTLs with their
    associated capabilities.
    
    Suggested-by: Oliver Upton 
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251211104710.151771-9-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit 8823485a697de5c280a7a2632620338722f16663
Author: Fuad Tabba 
Date:   Thu Dec 11 10:47:07 2025 +0000

    KVM: arm64: Track KVM IOCTLs and their associated KVM caps
    
    Track KVM IOCTLs (VM IOCTLs for now), and the associated KVM capability
    that enables that IOCTL. Add a function that performs the lookup.
    
    This will be used by CoCo VM Hypervisors (e.g., pKVM) to determine
    whether a particular KVM IOCTL is allowed for its VMs.
    
    Suggested-by: Oliver Upton 
    Signed-off-by: Fuad Tabba 
    [maz: don't expose KVM_CAP_BASIC to userspace, and rely on NR_VCPUS
          as a proxy for this]
    Link: https://patch.msgid.link/20251211104710.151771-8-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit f4eee308c8f4013a52bd7d7735e64b5127c1b4a8
Author: Fuad Tabba 
Date:   Thu Dec 11 10:47:06 2025 +0000

    KVM: arm64: Do not allow KVM_CAP_ARM_MTE for any guest in pKVM
    
    Supporting MTE in pKVM introduces significant complexity to the
    hypervisor at EL2, even for non-protected VMs, since it would require
    EL2 to handle tag management.
    
    For now, do not allow KVM_CAP_ARM_MTE for any VM type in protected mode.
    
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251211104710.151771-7-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit 43a21a0f0c4ab7de755f2cee2ff4700f26fe0bba
Author: Fuad Tabba 
Date:   Thu Dec 11 10:47:05 2025 +0000

    KVM: arm64: Include VM type when checking VM capabilities in pKVM
    
    Certain features and capabilities are restricted in protected mode. Most
    of these features are restricted only for protected VMs, but some
    are restricted for ALL VMs in protected mode.
    
    Extend the pKVM capability check to pass the VM (kvm), and use that when
    determining supported features.
    
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251211104710.151771-6-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit c273feee70bd3d8c6c4d5efaf6b3ae945c839378
Author: Fuad Tabba 
Date:   Thu Dec 11 10:47:04 2025 +0000

    KVM: arm64: Introduce helper to calculate fault IPA offset
    
    This 12-bit FAR fault IPA offset mask is hard-coded as 'GENMASK(11, 0)'
    in several places to reconstruct the full fault IPA.
    
    Introduce FAR_TO_FIPA_OFFSET() to calculate this value in a shared
    header and replace all open-coded instances to improve readability.
    
    No functional change intended.
    
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251211104710.151771-5-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit ebbcaece84738f71b35f32339bdeb8776004e641
Author: Fuad Tabba 
Date:   Thu Dec 11 10:47:03 2025 +0000

    KVM: arm64: Fix MTE flag initialization for protected VMs
    
    The function pkvm_init_features_from_host() initializes guest
    features, propagating them from the host. The logic to propagate
    KVM_ARCH_FLAG_MTE_ENABLED (Memory Tagging Extension)
    has a couple of issues.
    
    First, the check was in the common path, before the divergence for
    protected and non-protected VMs. For non-protected VMs, this was
    unnecessary, as 'kvm->arch.flags' is completely overwritten by
    host_arch_flags immediately after, which already contains the MTE flag.
    For protected VMs, this was setting the flag even if the feature is not
    allowed.
    
    Second, the check was reading 'host_kvm->arch.flags' instead of using
    the local 'host_arch_flags', which is read once from the host flags.
    
    Fix these by moving the MTE flag check inside the protected-VM-only
    path, checking if the feature is allowed, and changing it to use the
    correct host_arch_flags local variable. This ensures non-protected VMs
    get the flag via the bulk copy, and protected VMs get it via an explicit
    check.
    
    Fixes: b7f345fbc32a ("KVM: arm64: Fix FEAT_MTE in pKVM")
    Reviewed-by: Ben Horgan 
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251211104710.151771-4-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit e913c7ce9e6f62038a486218f43f699fc443e3e1
Author: Fuad Tabba 
Date:   Thu Dec 11 10:47:02 2025 +0000

    KVM: arm64: Fix Trace Buffer trap polarity for protected VMs
    
    The E2TB bits in MDCR_EL2 control trapping of Trace Buffer system
    register accesses. These accesses are trapped to EL2 when the bits are
    clear.
    
    The trap initialization logic for protected VMs in pvm_init_traps_mdcr()
    had the polarity inverted. When a guest did not support the Trace Buffer
    feature, the code was setting E2TB. This incorrectly disabled the trap,
    potentially allowing a protected guest to access registers for a feature
    it was not given.
    
    Fix this by inverting the operation.
    
    Fixes: f50758260bff ("KVM: arm64: Group setting traps for protected VMs by control register")
    Reviewed-by: Suzuki K Poulose 
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251211104710.151771-3-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit 288eb55483c05bc37379a781d0d18b8e6c280f92
Author: Fuad Tabba 
Date:   Thu Dec 11 10:47:01 2025 +0000

    KVM: arm64: Fix Trace Buffer trapping for protected VMs
    
    For protected VMs in pKVM, the hypervisor should trap accesses to trace
    buffer system registers if Trace Buffer isn't supported by the VM.
    However, the current code only traps if Trace Buffer External Mode isn't
    supported.
    
    Fix this by checking for FEAT_TRBE (Trace Buffer) rather than
    FEAT_TRBE_EXT.
    
    Fixes: 9d5261269098 ("KVM: arm64: Trap external trace for protected VMs")
    Reported-by: Suzuki K Poulose 
    Reviewed-by: Suzuki K Poulose 
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251211104710.151771-2-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit 3a6a36a3fc4e18e202eaf6c258553b5a17b91677
Author: Stafford Horne 
Date:   Thu Jan 15 15:09:58 2026 +0000

    gpio: mmio: Add compatible for opencores GPIO
    
    On FPGA Development boards with GPIOs the OpenRISC architecture uses the
    opencores gpio verilog rtl.  This is compatible with the gpio-mmio.  Add
    the compatible string to allow probing this driver from the devicetree.
    
    Link: https://opencores.org/projects/gpio
    Signed-off-by: Stafford Horne 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://lore.kernel.org/r/20260115151014.3956805-3-shorne@gmail.com
    Signed-off-by: Bartosz Golaszewski 

commit b2b8d247ad8ee1abe860598cae70e2dbe8a09128
Author: Stafford Horne 
Date:   Thu Jan 15 15:09:57 2026 +0000

    dt-bindings: gpio-mmio: Correct opencores GPIO
    
    In commit f48b5e8bc2e1 ("dt-bindings: gpio-mmio: Add compatible string
    for opencores,gpio") we marked opencores,gpio to be allowed with
    brcm,bcm6345-gpio. This was wrong, opencores,gpio is not compatible with
    brcm,bcm6345-gpio. It has a different register map and is 8-bit vs
    Broadcom which is 32-bit. Change opencores,gpio to be a separate
    compatible string for MMIO GPIO.
    
    Also, as this change rewrote the entire enum, I took this opportunity to
    alphabetically sort the list.
    
    Fixes: f48b5e8bc2e1 ("dt-bindings: gpio-mmio: Add compatible string for opencores,gpio")
    Signed-off-by: Stafford Horne 
    Reviewed-by: Geert Uytterhoeven 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20260115151014.3956805-2-shorne@gmail.com
    Signed-off-by: Bartosz Golaszewski 

commit bdc0c634612e3a9ecf318387a2c9cc0321ebf212
Author: Guixin Liu 
Date:   Wed Dec 17 16:16:01 2025 +0800

    i2c: tegra: remove unused rst
    
    Since commit 56344e241c54 ("i2c: tegra: Fix reset error handling with
    ACPI") replace reset_control_reset() with device_reset(), the rst
    is no longer used, remove it.
    
    Signed-off-by: Guixin Liu 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251217081601.93856-1-kanie@linux.alibaba.com

commit 6acd0e82ca8303b5c09ef7870bd40dbfd8dd53d3
Merge: 4aa573002ba688 e39951f8ad5006
Author: Bartosz Golaszewski 
Date:   Thu Jan 15 16:37:34 2026 +0100

    Merge tag 'ib-mfd-clk-gpio-power-regulator-rtc-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into gpio/for-next
    
    Immutable branch between MFD, Clk, GPIO, Power, Regulator and RTC due for the v6.20 merge window

commit d70f60ad964dc773bfcf73d52099472228629cac
Author: Andy Shevchenko 
Date:   Wed Jan 14 09:17:50 2026 +0100

    i2c: designware: Remove not-going-to-be-supported code for Baikal SoC
    
    As noticed in the discussion [1] the Baikal SoC and platforms
    are not going to be finalized, hence remove stale code.
    
    Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1]
    Signed-off-by: Andy Shevchenko 
    Acked-by: Mika Westerberg 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260114081954.252160-2-andriy.shevchenko@linux.intel.com

commit 83675851547e835c15252c601f41acf269c351d9
Author: Matt Roper 
Date:   Wed Jan 14 19:28:02 2026 -0800

    drm/xe: Cleanup unused header includes
    
    clangd reports many "unused header" warnings throughout the Xe driver.
    Start working to clean this up by removing unnecessary includes in our
    .c files and/or replacing them with explicit includes of other headers
    that were previously being included indirectly.
    
    By far the most common offender here was unnecessary inclusion of
    xe_gt.h.  That likely originates from the early days of xe.ko when
    xe_mmio did not exist and all register accesses, including those
    unrelated to GTs, were done with GT functions.
    
    There's still a lot of additional #include cleanup that can be done in
    the headers themselves; that will come as a followup series.
    
    v2:
     - Squash the 79-patch series down to a single patch.  (MattB)
    
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20260115032803.4067824-2-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit e0a99a2b72f3c6365d9f4d6943ed45f7fc286b70
Author: Fuad Tabba 
Date:   Fri Jan 9 08:22:18 2026 +0000

    KVM: selftests: Fix typos and stale comments in kvm_util
    
    Fix minor documentation errors in `kvm_util.h` and `kvm_util.c`.
    
    - Correct the argument description for `vcpu_args_set` in `kvm_util.h`,
      which incorrectly listed `vm` instead of `vcpu`.
    - Fix a typo in the comment for `kvm_selftest_arch_init` ("exeucting" ->
      "executing").
    - Correct the return value description for `vm_vaddr_unused_gap` in
      `kvm_util.c` to match the implementation, which returns an address "at
      or above" `vaddr_min`, not "at or below".
    
    No functional change intended.
    
    Reviewed-by: Andrew Jones 
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20260109082218.3236580-6-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit de00d07321cf3f182762de2308c08062d5b824c0
Author: Fuad Tabba 
Date:   Fri Jan 9 08:22:17 2026 +0000

    KVM: selftests: Move page_align() to shared header
    
    To avoid code duplication, move page_align() to the shared `kvm_util.h`
    header file. Rename it to vm_page_align(), to make it clear that the
    alignment is done with respect to the guest's base page size.
    
    No functional change intended.
    
    Reviewed-by: Andrew Jones 
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20260109082218.3236580-5-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit 582b39463f1c0774e0b3cb5be2118e8564b7941e
Author: Fuad Tabba 
Date:   Fri Jan 9 08:22:16 2026 +0000

    KVM: riscv: selftests: Fix incorrect rounding in page_align()
    
    The implementation of `page_align()` in `processor.c` calculates
    alignment incorrectly for values that are already aligned. Specifically,
    `(v + vm->page_size) & ~(vm->page_size - 1)` aligns to the *next* page
    boundary even if `v` is already page-aligned, potentially wasting a page
    of memory.
    
    Fix the calculation to use standard alignment logic: `(v + vm->page_size
    - 1) & ~(vm->page_size - 1)`.
    
    Fixes: 3e06cdf10520 ("KVM: selftests: Add initial support for RISC-V 64-bit")
    Reviewed-by: Andrew Jones 
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20260109082218.3236580-4-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit dd0c5d04d13cae8ff2694ef83d1ae5804d6d9798
Author: Fuad Tabba 
Date:   Fri Jan 9 08:22:15 2026 +0000

    KVM: arm64: selftests: Fix incorrect rounding in page_align()
    
    The implementation of `page_align()` in `processor.c` calculates
    alignment incorrectly for values that are already aligned. Specifically,
    `(v + vm->page_size) & ~(vm->page_size - 1)` aligns to the *next* page
    boundary even if `v` is already page-aligned, potentially wasting a page
    of memory.
    
    Fix the calculation to use standard alignment logic: `(v + vm->page_size
    - 1) & ~(vm->page_size - 1)`.
    
    Fixes: 7a6629ef746d ("kvm: selftests: add virt mem support for aarch64")
    Reviewed-by: Andrew Jones 
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20260109082218.3236580-3-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit 7e03d07d03a486c66d5c084c7185b1bef29049e9
Author: Fuad Tabba 
Date:   Fri Jan 9 08:22:14 2026 +0000

    KVM: arm64: selftests: Disable unused TTBR1_EL1 translations
    
    KVM selftests map all guest code and data into the lower virtual address
    range (0x0000...) managed by TTBR0_EL1. The upper range (0xFFFF...)
    managed by TTBR1_EL1 is unused and uninitialized.
    
    If a guest accesses the upper range, the MMU attempts a translation
    table walk using uninitialized registers, leading to unpredictable
    behavior.
    
    Set `TCR_EL1.EPD1` to disable translation table walks for TTBR1_EL1,
    ensuring that any access to the upper range generates an immediate
    Translation Fault. Additionally, set `TCR_EL1.TBI1` (Top Byte Ignore) to
    ensure that tagged pointers in the upper range also deterministically
    trigger a Translation Fault via EPD1.
    
    Define `TCR_EPD1_MASK`, `TCR_EPD1_SHIFT`, and `TCR_TBI1` in
    `processor.h` to support this configuration. These are based on their
    definitions in `arch/arm64/include/asm/pgtable-hwdef.h`.
    
    Suggested-by: Will Deacon 
    Reviewed-by: Itaru Kitayama 
    Signed-off-by: Fuad Tabba 
    Link: https://patch.msgid.link/20260109082218.3236580-2-tabba@google.com
    Signed-off-by: Marc Zyngier 

commit b862e66a9c2e3e1b55d2192b0dc8f80535e11eee
Author: Rafael J. Wysocki 
Date:   Sat Jan 10 12:50:54 2026 +0100

    ACPI: scan: Clean up after recent changes
    
    Use LIST_HEAD() for initializing an on-stack list head in two places and
    remove an empty code line added by mistake.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Mario Limonciello (AMD) 
    Link: https://patch.msgid.link/12825056.O9o76ZdvQC@rafael.j.wysocki

commit 57c31e6d620f132dcf610b2c52b4cdbd203c6f4a
Author: Rafael J. Wysocki 
Date:   Sat Jan 10 12:58:38 2026 +0100

    ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons
    
    After starting to use platform devices for representing buttons
    enumerated via ACPI, acpi_mark_gpe_for_wake() is insufficient for
    preparing their GPEs to wake up the system from sleep because it
    does not change the "dispatch type" of the given GPE to
    ACPI_GPE_DISPATCH_NOTIFY.  Subsequently, this causes acpi_enable_gpe()
    in __acpi_device_wakeup_enable() to fail and system suspend transitions
    to be aborted.
    
    Address this by updating acpi_wakeup_gpe_init() to use
    acpi_setup_gpe_for_wake() for buttons like for any other devices.
    
    This allows acpi_setup_gpe_for_wake() to be simplified further because
    buttons are not a special case in it any more, so do that as well.
    
    Fixes: 52d864019636 ("ACPI: button: Convert the driver to a platform one")
    Signed-off-by: Rafael J. Wysocki 
    Tested-by: Xi Pardee 
    Link: https://patch.msgid.link/2259694.irdbgypaU6@rafael.j.wysocki

commit 88fad6ce090b395af4c654594a54589a386bf24b
Author: Rafael J. Wysocki 
Date:   Sat Jan 10 12:57:00 2026 +0100

    ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM
    
    It is pointless to attach the generic ACPI PM domain to devices whose
    ACPI companions don't support ACPI power management and don't have a
    wakeup GPE, so update acpi_dev_pm_attach() to skip such devices.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/5050298.GXAFRqVoOG@rafael.j.wysocki

commit b8c8a8ea18ad679e29b6970ae0b5707bc061b5e7
Author: Rafael J. Wysocki 
Date:   Tue Jan 6 13:27:14 2026 +0100

    ACPI: Documentation: driver-api: Disapprove of using ACPI drivers
    
    Sadly, there is quite a bit of technical debt related to the
    kernel's ACPI support subsystem and one of the most significant
    pieces of it is the existence and use of ACPI drivers represented
    by struct acpi_driver objects.
    
    Those drivers are bound directly to struct acpi_device objects, also
    referred to as "ACPI device nodes", representing device objects in the
    ACPI namespace defined as:
    
     A hierarchical tree structure in OS-controlled memory that contains
     named objects. These objects may be data objects, control method
     objects, bus/device package objects, and so on.
    
    according to the ACPI specification [1].
    
    The above definition implies, although rather indirectly, that the
    objects in question don't really represent hardware.  They are just
    "device package objects" containing some information on the devices
    present in the given platform that is known to the platform firmware.
    
    Although the platform firmware can be the only source of information on
    some devices, the information provided by it alone may be insufficient
    for device enumeration in general.  If that is the case, binding a
    driver directly to a given ACPI device node clearly doesn't make sense.
    If the device in question is enumerated through a hardware interface, it
    will be represented by a device object matching that interface, like
    a struct pci_dev, and the ACPI device node corresponding to it will be
    treated as its "ACPI companions" whose role is to amend the "native"
    enumeratiom mechanism.
    
    For the sake of consistency and confusion avoidance, it is better to
    treat ACPI device nodes in general as ACPI companions of other device
    objects representing hardware.  In some cases though it appeared easier
    to take a shortcut and use an ACPI driver binding directly to an ACPI
    device node.  Moreover, there were corner cases in which that was the
    only choice, but they all have been addressed now.
    
    In all cases in which an ACPI driver might be used, the ACPI device
    node it might bind to is an ACPI companion of another device object
    representing a piece of hardware.  It is thus better to use a driver
    binding to the latter than to use an ACPI driver and leave the other
    device object alone, not just because doing so is more consistent and
    less confusing, but also because using ACPI drivers may lead to
    potential functional deficiencies, like possible ordering issues
    related to power management.
    
    Unfortunately, there are quite a few ACPI drivers in use and, as a rule,
    they bind to ACPI device nodes that are ACPI companions of platform
    devices, so in fact they play the role of platform drivers although in
    a kind of convoluted way.  An effort has been under way to replace them
    with platform drivers, which is relatively straightforward in the vast
    majority of cases, but it has not been pursued very aggressively so far,
    mostly due to the existence of the corner cases mentioned above.
    However, since those corner cases are gone now, it makes sense to spend
    more time on driver conversions with the ultimate goal to get rid of
    struct acpi_driver and the related code from the kernel.
    
    To that end, add a document explaining why using ACPI drivers is not
    a good idea, so it need not be explained from scratch on every attempt
    to convert an ACPI driver to a platform one.
    
    Link: https://uefi.org/specs/ACPI/6.6/02_Definition_of_Terms.html#term-ACPI-Namespace [1]
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Andy Shevchenko 
    Reviewed-by: Armin Wolf 
    Reviewed-by: Randy Dunlap 
    Reviewed-by: Danilo Krummrich 
    Reviewed-by: Mario Limonciello (AMD) 
    Link: https://patch.msgid.link/2396510.ElGaqSPkdT@rafael.j.wysocki

commit 02c057ddefef592a882c5815f22630901d9ab344
Author: Rafael J. Wysocki 
Date:   Fri Jan 2 12:53:53 2026 +0100

    ACPI: video: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI video driver to a platform one.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Armin Wolf 
    Link: https://patch.msgid.link/1957556.tdWV9SEqCh@rafael.j.wysocki

commit d91a624a69631f852efc2ec7d910d5439277e47f
Author: Rafael J. Wysocki 
Date:   Fri Jan 2 12:52:15 2026 +0100

    ACPI: video: Adjust event notification routine
    
    Adjust acpi_video_bus_notify() to cast its "data" argument to a struct
    acpi_video_bus pointer instead of a struct acpi_device one, which allows
    the use of acpi_driver_data() to be limited and will facilitate
    subsequent changes.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Armin Wolf 
    Link: https://patch.msgid.link/2409089.ElGaqSPkdT@rafael.j.wysocki

commit 336aae5c4e1a473018136524b18a74877310c0a3
Author: Rafael J. Wysocki 
Date:   Fri Jan 2 12:50:57 2026 +0100

    ACPI: scan: Register platform devices for backlight device objects
    
    ACPI device objects associated with backlight interfaces are special
    because they are ACPI companions of PCI devices (GPUs), but the
    interfaces exposed by them resemble platform device one.
    
    Currently, the ACPI video driver binds to them with the help of a
    special "synthetic" device ID regardless of the pairing with the PCI
    devices, but since it is generally better to use platform drivers for
    handling such interfaces, the plan is to convert that drviver into a
    platform one.
    
    However, for this purpose, platform devices corresponding to the
    ACPI backlight device objects need to be registered, so update
    acpi_bus_attach() to apply the default ACPI enumeration to them
    and modify acpi_create_platform_device() to avoid bailing out early
    if a "physical" device is already attached to a backlight ACPI device
    object.
    
    In addition, update acpi_companion_match() to return a valid struct
    acpi_device pointer if the ACPI companion of the given device is a
    backlight ACPI device object, which will facilitate driver matching
    for platform devices corresponding to those objects.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Armin Wolf 
    Link: https://patch.msgid.link/5081593.31r3eYUQgx@rafael.j.wysocki

commit e1c9223adf1c2b7d84f29f2e7e6d9a4f749da2c0
Author: AngeloGioacchino Del Regno 
Date:   Thu Jan 15 14:10:35 2026 +0100

    arm64: dts: mediatek: mt7988a: Fix PCI-Express T-PHY node address
    
    The PCIe and USB TPHYs are under the soc bus, which provides MMIO,
    and all nodes under that must use the bus, otherwise those would
    clearly be out of place.
    
    Add ranges to both the tphy(s) and assign the address to the main
    node to silence a dtbs_check warning, and fix the children to
    use the MMIO range of t-phy.
    
    Fixes: ("f693e6ba55ae arm64: dts: mediatek: mt7988: Add t-phy for ssusb1")
    Signed-off-by: AngeloGioacchino Del Regno 

commit 44e3f867fd3f75123b0e8e460f723a115b0d8cd4
Author: Nick Xie 
Date:   Thu Jan 15 11:00:15 2026 +0800

    arm64: dts: meson-s4-s905y4-khadas-vim1s: add initial device tree
    
    The Khadas VIM1S uses the Amlogic S905Y4 SoC, based on the
    Amlogic S4 SoC family, on a board with the same form factor as the
    VIM/VIM2/VIM3/VIM4 models. Serial debug console, ethernet, SD card
    work with this initial device tree.
    
    It features:
     - 2GB LPDDR4 RAM
     - 16GB eMMC 5.1 storage
     - 32MB SPI flash
     - 100M Ethernet
     - AP6256 Wireless (802.11 a/b/g/n/ac, BT5.0)
     - HDMI 2.1 video
     - 2x USB 2.0 ports
     - 1x USB-C (power) with USB 2.0 OTG
     - 2x LED's (1x red, 1x white)
     - 3x buttons (power, function, reset)
     - IR receiver
     - 40pin GPIO Header
     - 1x micro SD card slot
    
    Signed-off-by: Nick Xie 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260115030015.1334517-4-nick@khadas.com
    Signed-off-by: Neil Armstrong 

commit 31b72cc32c48205b4f9cf4b0531055be6a028607
Author: Nick Xie 
Date:   Thu Jan 15 11:00:14 2026 +0800

    arm64: dts: meson-s4-aq222: update compatible string with s805x2
    
    Update the compatible string for the Amlogic AQ222 board to include
    the specific SoC compatible "amlogic,s805x2".
    
    This aligns the device tree with the updated bindings which now
    differentiate between S4 family members (S805X2 vs S905Y4).
    
    Signed-off-by: Nick Xie 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260115030015.1334517-3-nick@khadas.com
    Signed-off-by: Neil Armstrong 

commit 10a46a7f6ecc243fb9f745c4ec5e1955b49d77b4
Author: Nick Xie 
Date:   Thu Jan 15 11:00:13 2026 +0800

    dt-bindings: arm: amlogic: introduce specific compatibles for S4 family
    
    The Amlogic S4 SoC family includes multiple variants, such as the S805X2
    and S905Y4. Currently, the bindings only define the generic "amlogic,s4"
    compatible.
    
    This patch introduces specific compatibles "amlogic,s805x2" and
    "amlogic,s905y4" to properly differentiate these SoCs while keeping
    "amlogic,s4" as the family fallback.
    
    This allows for more precise hardware description and future-proofing
    if SoC-specific quirks arise.
    
    Signed-off-by: Nick Xie 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260115030015.1334517-2-nick@khadas.com
    Signed-off-by: Neil Armstrong 

commit 61d2a7699ab39d448f44919ef15c16187e6f70ec
Author: Charles Keepax 
Date:   Thu Jan 15 11:46:07 2026 +0000

    ASoC: SDCA: Tidy up some memory allocations
    
    It is slightly better to deference the type being allocate for a sizeof
    rather than manually using the type. Saves effort if types change in the
    future. This results in no functional changes, just tidies up the style
    of the code a little.
    
    Signed-off-by: Charles Keepax 
    Link: https://patch.msgid.link/20260115114607.271990-1-ckeepax@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit a4cd9860fa085f0d04d2065f4c151fcde9fcdf4a
Author: Takashi Sakamoto 
Date:   Wed Jan 14 22:17:29 2026 +0900

    firewire: ohci: fix index of pages for dma address to 1394 OHCI IT context
    
    The index of pages for dma address was changed wrongly. This commit
    corrents it.
    
    Fixes: ef6bdffbb88d ("firewire: core: stop using page private to store DMA mapping address")
    Link: https://lore.kernel.org/r/20260114131729.16133-1-o-takashi@sakamocchi.jp
    Signed-off-by: Takashi Sakamoto 

commit 8ca7515d3c76a8b629f703ff8301a75f503bcc50
Author: Krishna Chomal 
Date:   Tue Jan 13 23:56:03 2026 +0530

    platform/x86: hp-wmi: fix platform profile values for Omen 16-wf1xxx
    
    HP Omen 16-wf1xxx (board ID 8C78) currently sends the incorrect
    Victus-specific thermal profile values via WMI, leading to a logical
    inconsistency when switching between platform profiles.
    
    The driver currently uses Victus S values:
    0x00 => Balanced / Low-Power
    0x01 => Performance
    
    However, Omen Gaming Hub logs / EC register inspection on Windows shows
    that this board is intended to use:
    0x30 => Balanced / Low-Power
    0x31 => Performance
    
    This patch corrects the thermal profile command values to match the
    values observed from Omen Gaming Hub logs. The performance benchmarks
    and peak power draw (from both CPU and GPU) show no observable change
    with this correction (suggesting that the firmware is currently tolerant
    of the incorrect values). However sending the correct values prevents
    potential regressions after future firmware updates.
    
    Refactor victus_s_thermal_profile_boards from a list of strings to a
    dmi_system_id table and move the lookup to module init. The new struct
    thermal_profile_params is used to store board-specific WMI parameters,
    allowing the driver to cache these values in a static pointer. This
    avoids repeated DMI string comparisons and allows marking of DMI table as
    __initconst.
    
    Testing on HP Omen 16-wf1xxx (board 8C78) confirmed WMI codes 0x30/0x31
    are now sent, resolving the logical inconsistency and ensuring the value
    visible in EC registers match the Windows state for this profile.
    
    Fixes: fb146a38cb11 ("platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support")
    Signed-off-by: Krishna Chomal 
    Link: https://patch.msgid.link/20260113182604.115211-2-krishna.chomal108@gmail.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit c203c59fb5de1b1b8947d61176e868da1130cbeb
Author: Krishna Chomal 
Date:   Tue Jan 13 18:07:38 2026 +0530

    platform/x86: hp-wmi: implement fan keep-alive
    
    The firmware on some HP laptops automatically reverts the fan speed
    control to "Auto" mode after a 120 second timeout window.
    
    To ensure that the user-selected fan profile (Max/Manual) persists,
    implement a keep-alive mechanism that periodically refreshes the fan
    mode trigger before the timeout occurs.
    
    - Introduce a delayed workqueue to trigger the fan mode refresh every 90
      seconds, ensuring the system maintains the correct fan mode setting.
    - Integrate the refresh mechanism into hp_wmi_apply_fan_settings() to
      start, update or cancel the keep-alive process based on the current
      fan mode.
    
    This ensures that the driver stays in sync with the hardware.
    
    Tested on: HP Omen 16-wf1xxx (board ID 8C78)
    
    Signed-off-by: Krishna Chomal 
    Link: https://patch.msgid.link/20260113123738.222244-4-krishna.chomal108@gmail.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 46be1453e6e61884b4840a768d1e8ffaf01a4c1c
Author: Krishna Chomal 
Date:   Tue Jan 13 18:07:37 2026 +0530

    platform/x86: hp-wmi: add manual fan control for Victus S models
    
    Add manual fan speed control and PWM reporting for HP Victus S-series
    laptops.
    
    While HPWMI_FAN_SPEED_SET_QUERY was previously added to reset max fan
    mode, it is actually capable of individual fan control. This patch
    implements hp_wmi_fan_speed_set() to allow manual control and hides
    PWM inputs for non-Victus devices as the query is Victus specific.
    
    The existing hp_wmi_fan_speed_max_get() query is unreliable on Victus S
    firmware, often incorrectly reporting "Auto" mode even when "Max" is
    active. To resolve this synchronization issue, move state tracking to
    a per-device private context and apply "Auto" mode during driver
    initialization to ensure a consistent starting point.
    
    Refactor hp_wmi_apply_fan_settings() to use an intermediate ret
    variable. This prepares the switch block for keep-alive logic being
    added in a later patch, avoiding the need for duplicated mode check.
    
    Tested on: HP Omen 16-wf1xxx (board ID 8C78)
    
    Signed-off-by: Krishna Chomal 
    Link: https://patch.msgid.link/20260113123738.222244-3-krishna.chomal108@gmail.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 60f2d5d0f04365c41ad4f9eddf48c80dcd0b01c9
Author: Krishna Chomal 
Date:   Tue Jan 13 18:07:36 2026 +0530

    platform/x86: hp-wmi: order include headers
    
    The include headers in hp-wmi driver are currently not in any specific
    order. As the driver continues to grow, keep the header block organized
    by sorting them alphabetically.
    
    Signed-off-by: Krishna Chomal 
    Link: https://patch.msgid.link/20260113123738.222244-2-krishna.chomal108@gmail.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit b638a9d0f8965b98403022cb91d8f3b31170eb35
Author: Marc Zyngier 
Date:   Thu Jan 8 17:32:33 2026 +0000

    KVM: arm64: selftests: Add a test for FEAT_IDST
    
    Add a very basic test checking that FEAT_IDST actually works for
    the {GMID,SMIDR,CSSIDR2}_EL1 registers.
    
    Link: https://patch.msgid.link/20260108173233.2911955-10-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit 592dc2c020686536dae1c427c78cf558a3df4414
Author: Marc Zyngier 
Date:   Thu Jan 8 17:32:32 2026 +0000

    KVM: arm64: pkvm: Report optional ID register traps with a 0x18 syndrome
    
    With FEAT_IDST, unimplemented system registers in the feature ID space
    must be reported using EC=0x18 at the closest handling EL, rather than
    with an UNDEF.
    
    Most of these system registers are always implemented thanks to their
    dependency on FEAT_AA64, except for a set of (currently) three registers:
    GMID_EL1 (depending on MTE2), CCSIDR2_EL1 (depending on FEAT_CCIDX),
    and SMIDR_EL1 (depending on SME).
    
    For these three registers, report their trap as EC=0x18 if they
    end-up trapping into KVM and that FEAT_IDST is implemented in the guest.
    Otherwise, just make them UNDEF.
    
    Link: https://patch.msgid.link/20260108173233.2911955-9-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit e5d40a5a97c1d57e89aa5f324734065c6580b436
Author: Marc Zyngier 
Date:   Thu Jan 8 17:32:31 2026 +0000

    KVM: arm64: pkvm: Add a generic synchronous exception injection primitive
    
    Similarly to the "classic" KVM code, pKVM doesn't have an "anything
    goes" synchronous exception injection primitive.
    
    Carve one out of the UNDEF injection code.
    
    Link: https://patch.msgid.link/20260108173233.2911955-8-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit 70a5ce4efc0e1194718aad6f26332c99e6a119db
Author: Marc Zyngier 
Date:   Thu Jan 8 17:32:30 2026 +0000

    KVM: arm64: Force trap of GMID_EL1 when the guest doesn't have MTE
    
    If our host has MTE, but the guest doesn't, make sure we set HCR_EL2.TID5
    to force GMID_EL1 being trapped. Such trap will be handled by the
    FEAT_IDST handling.
    
    Reviewed-by: Joey Gouly 
    Reviewed-by: Yuan Yao 
    Link: https://patch.msgid.link/20260108173233.2911955-7-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit f07ef1bef67ca08799df262cc901971ac274783d
Author: Marc Zyngier 
Date:   Thu Jan 8 17:32:29 2026 +0000

    KVM: arm64: Handle CSSIDR2_EL1 and SMIDR_EL1 in a generic way
    
    Now that we can handle ID registers using the FEAT_IDST infrastrcuture,
    get rid of the handling of CSSIDR2_EL1 and SMIDR_EL1.
    
    Reviewed-by: Yuan Yao 
    Link: https://patch.msgid.link/20260108173233.2911955-6-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit d78a14decd494caf72ea0144624621e7e43ae451
Author: Marc Zyngier 
Date:   Thu Jan 8 17:32:28 2026 +0000

    KVM: arm64: Handle FEAT_IDST for sysregs without specific handlers
    
    Add a bit of infrastrtcture to triage_sysreg_trap() to handle the
    case of registers falling into the Feature ID space that do not
    have a local handler.
    
    For these, we can directly apply the FEAT_IDST semantics and inject
    an EC=0x18 exception. Otherwise, an UNDEF will do.
    
    Reviewed-by: Joey Gouly 
    Reviewed-by: Yuan Yao 
    Link: https://patch.msgid.link/20260108173233.2911955-5-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit 19f75678238734ef383f9e10d8e1020873e97170
Author: Marc Zyngier 
Date:   Thu Jan 8 17:32:27 2026 +0000

    KVM: arm64: Add a generic synchronous exception injection primitive
    
    Maybe in a surprising way, we don't currently have a generic way
    to inject a synchronous exception at the EL the vcpu is currently
    running at.
    
    Extract such primitive from the UNDEF injection code.
    
    Reviewed-by: Ben Horgan 
    Reviewed-by: Yuan Yao 
    Link: https://patch.msgid.link/20260108173233.2911955-4-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit 1ad9767accfcb81f404aa3d37d46b3eb494dce2f
Author: Marc Zyngier 
Date:   Thu Jan 8 17:32:26 2026 +0000

    KVM: arm64: Add trap routing for GMID_EL1
    
    HCR_EL2.TID5 is currently ignored by the trap routing infrastructure.
    Wire it in the routing table so that GMID_EL1, the sole register
    trapped by this bit, is correctly handled in the NV case.
    
    Link: https://patch.msgid.link/20260108173233.2911955-3-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit 4a7fe842b8a3f3c173c3075f03c60c3f9f62e299
Author: Marc Zyngier 
Date:   Thu Jan 8 17:32:25 2026 +0000

    arm64: Repaint ID_AA64MMFR2_EL1.IDS description
    
    ID_AA64MMFR2_EL1.IDS, as described in the sysreg file, is pretty horrible
    as it diesctly give the ESR value. Repaint it using the usual NI/IMP
    identifiers to describe the absence/presence of FEAT_IDST.
    
    Also add the new EL3 routing feature, even if we really don't care about it.
    
    Reviewed-by: Joey Gouly 
    Link: https://patch.msgid.link/20260108173233.2911955-2-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit 615962473ba6ecde7da61d89adf85062972c2c4c
Author: AngeloGioacchino Del Regno 
Date:   Thu Jan 15 12:36:08 2026 +0100

    arm64: dts: mediatek: mt8186-evb: Add vproc fixed regulator
    
    This board at the moment has no support for PMIC regulators, but
    the CCI requires a vproc regulator in order to both stop giving
    dtbs_check warnings and to actually probe.
    
    Since vproc is a system-critical regulator and the bootloader
    enables it at max voltage, model it (at least temporarily) as
    a regulator-fixed and assign it to CCI.
    
    Signed-off-by: AngeloGioacchino Del Regno 

commit d4596891e72cbf155d61798a81ce9d36b69bfaf4
Author: Eric Dumazet 
Date:   Mon Jan 12 13:15:15 2026 +0000

    net: inline napi_skb_cache_get()
    
    clang is inlining it already, gcc (14.2) does not.
    
    Small space cost (215 bytes on x86_64) but faster sk_buff allocations.
    
    $ scripts/bloat-o-meter -t net/core/skbuff.gcc.before.o net/core/skbuff.gcc.after.o
    add/remove: 0/1 grow/shrink: 4/1 up/down: 359/-144 (215)
    Function                                     old     new   delta
    __alloc_skb                                  471     611    +140
    napi_build_skb                               245     363    +118
    napi_alloc_skb                               331     416     +85
    skb_copy_ubufs                              1869    1885     +16
    skb_shift                                   1445    1413     -32
    napi_skb_cache_get                           112       -    -112
    Total: Before=59941, After=60156, chg +0.36%
    
    Signed-off-by: Eric Dumazet 
    Link: https://patch.msgid.link/20260112131515.4051589-1-edumazet@google.com
    Signed-off-by: Paolo Abeni 

commit d281dff93a2c7df6903e89f779ac1af477a88abf
Merge: 8138fc46d9a44c 1c8910f50350b4
Author: Paolo Abeni 
Date:   Thu Jan 15 12:10:29 2026 +0100

    Merge branch 'net-mlx5-hws-single-flow-counter-support'
    
    Tariq Toukan says:
    
    ====================
    net/mlx5: HWS single flow counter support
    
    This small series refactors the flow counter bulk initialization code
    and extends it so that single flow counters are also usable by hardware
    steering (HWS) rules.
    
    Patches 1-2 refactor the bulk init path: first by factoring out common
    flow counter bulk initialization into mlx5_fc_bulk_init(), then by
    splitting the bitmap allocation into mlx5_fs_bulk_bitmap_alloc(), with
    no functional changes.
    
    Patch 3 initializes bulk data for counters allocated via
    mlx5_fc_single_alloc(), so they can be safely used by HWS rules.
    ====================
    
    Link: https://patch.msgid.link/1768210825-1598472-1-git-send-email-tariqt@nvidia.com
    Signed-off-by: Paolo Abeni 

commit 1c8910f50350b46eb184f77e5af7bc09e57e8aed
Author: Moshe Shemesh 
Date:   Mon Jan 12 11:40:25 2026 +0200

    net/mlx5: Initialize bulk for single flow counters
    
    Ensure that flow counters allocated with mlx5_fc_single_alloc() have
    bulk correctly initialized so they can safely be used in HWS rules.
    
    Signed-off-by: Moshe Shemesh 
    Reviewed-by: Mark Bloch 
    Reviewed-by: Yevgeny Kliteynik 
    Signed-off-by: Tariq Toukan 
    Link: https://patch.msgid.link/1768210825-1598472-4-git-send-email-tariqt@nvidia.com
    Signed-off-by: Paolo Abeni 

commit 6a6c4dd7c0190acff25e221b204ac8652ef07dae
Author: Mark Bloch 
Date:   Mon Jan 12 11:40:24 2026 +0200

    net/mlx5: fs, split bulk init
    
    Refactor mlx5_fs_bulk_init() by moving bitmap allocation logic into a
    new helper function mlx5_fs_bulk_bitmap_alloc(). This change does not
    alter any logic.
    
    Signed-off-by: Mark Bloch 
    Signed-off-by: Moshe Shemesh 
    Reviewed-by: Yevgeny Kliteynik 
    Signed-off-by: Tariq Toukan 
    Link: https://patch.msgid.link/1768210825-1598472-3-git-send-email-tariqt@nvidia.com
    Signed-off-by: Paolo Abeni 

commit 96e89982a68c36a5cca6c7078ebdf48b11dd5515
Author: Mark Bloch 
Date:   Mon Jan 12 11:40:23 2026 +0200

    net/mlx5: fs, factor out flow counter bulk init
    
    Add mlx5_fc_bulk_init() to handle bulk initialization of flow counters.
    This change does not alter any logic, but refactors the code to remove
    duplicate initialization logic by centralizing it in a single function.
    
    Signed-off-by: Mark Bloch 
    Signed-off-by: Moshe Shemesh 
    Reviewed-by: Yevgeny Kliteynik 
    Signed-off-by: Tariq Toukan 
    Link: https://patch.msgid.link/1768210825-1598472-2-git-send-email-tariqt@nvidia.com
    Signed-off-by: Paolo Abeni 

commit 49261f479d45714692587ff0abe0c5279c6068d6
Author: Herve Codina (Schneider Electric) 
Date:   Wed Jan 14 10:39:36 2026 +0100

    soc: renesas: Add support for RZ/N1 GPIO Interrupt Multiplexer
    
    On the Renesas RZ/N1 SoC, GPIOs can generate interruptions. Those
    interruption lines are multiplexed by the GPIO Interrupt Multiplexer in
    order to map 32 * 3 GPIO interrupt lines to 8 GIC interrupt lines.
    
    The GPIO interrupt multiplexer IP does nothing but select 8 GPIO
    IRQ lines out of the 96 available to wire them to the GIC input lines.
    
    Signed-off-by: Herve Codina (Schneider Electric) 
    Reviewed-by: Linus Walleij 
    Tested-by: Wolfram Sang 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20260114093938.1089936-8-herve.codina@bootlin.com
    Signed-off-by: Geert Uytterhoeven 

commit 94ed03a00571cd7e648b1dfa0136103d8a14fd10
Author: Herve Codina (Schneider Electric) 
Date:   Wed Jan 14 10:39:33 2026 +0100

    irqchip/renesas-rza1: Use for_each_of_imap_item iterator
    
    The renesas-rza1 driver parses the interrupt-map property. It does it
    using open code.
    
    Recently for_each_of_imap_item iterator has been introduce to help
    drivers in this parsing.
    
    Convert the renesas-rza1 driver to use the for_each_of_imap_item
    iterator instead of open code.
    
    Signed-off-by: Herve Codina (Schneider Electric) 
    Tested-by: Wolfram Sang 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20260114093938.1089936-5-herve.codina@bootlin.com
    Signed-off-by: Geert Uytterhoeven 

commit 3ac6dfe3d7a2396602b67667249b146504dfbd2a
Author: Herve Codina (Schneider Electric) 
Date:   Wed Jan 14 10:39:32 2026 +0100

    irqchip/ls-extirq: Use for_each_of_imap_item iterator
    
    The ls-extirq driver parses the interrupt-map property. It does it using
    open code.
    
    Recently for_each_of_imap_item iterator has been introduce to help
    drivers in this parsing.
    
    Convert the ls-extirq driver to use the for_each_of_imap_item
    iterator instead of open code.
    
    Signed-off-by: Herve Codina (Schneider Electric) 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20260114093938.1089936-4-herve.codina@bootlin.com
    Signed-off-by: Geert Uytterhoeven 

commit a9811aeb42f85bd423725996ef7dce5cd51f8ff7
Author: Herve Codina (Schneider Electric) 
Date:   Wed Jan 14 10:39:31 2026 +0100

    of: unittest: Add a test case for for_each_of_imap_item iterator
    
    Recently for_each_of_imap_item iterator has been introduce to help
    drivers in parsing the interrupt-map property.
    
    Add a test case for this iterator.
    
    Signed-off-by: Herve Codina (Schneider Electric) 
    Reviewed-by: Rob Herring (Arm) 
    Reviewed-by: Linus Walleij 
    Link: https://patch.msgid.link/20260114093938.1089936-3-herve.codina@bootlin.com
    Signed-off-by: Geert Uytterhoeven 

commit 49d2cda7ca2e8e287617e7a5b7fae523eaece955
Author: Herve Codina (Schneider Electric) 
Date:   Wed Jan 14 10:39:30 2026 +0100

    of/irq: Introduce for_each_of_imap_item
    
    for_each_of_imap_item is an iterator designed to help a driver to parse
    an interrupt-map property.
    
    Indeed some drivers need to know details about the interrupt mapping
    described in the device-tree in order to set internal registers
    accordingly.
    
    Signed-off-by: Herve Codina (Schneider Electric) 
    Tested-by: Wolfram Sang 
    Reviewed-by: Rob Herring (Arm) 
    Reviewed-by: Linus Walleij 
    Link: https://patch.msgid.link/20260114093938.1089936-2-herve.codina@bootlin.com
    Signed-off-by: Geert Uytterhoeven 

commit f972bde7326e9cd3498c137a052f2034f975ebae
Author: Konstantin Taranov 
Date:   Thu Jan 15 01:36:25 2026 -0800

    RDMA/mana_ib: Take CQ type from the device type
    
    Get CQ type from the used gdma device. The MANA_IB_CREATE_RNIC_CQ
    flag is ignored. It was used in older kernel versions where
    the mana_ib was shared between ethernet and rnic.
    
    Fixes: d4293f96ce0b ("RDMA/mana_ib: unify mana_ib functions to support any gdma device")
    Signed-off-by: Konstantin Taranov 
    Link: https://patch.msgid.link/20260115093625.177306-1-kotaranov@linux.microsoft.com
    Signed-off-by: Leon Romanovsky 

commit a684fa4d2270a6465b0c6e165ac28bd36614c9cf
Author: Herve Codina (Schneider Electric) 
Date:   Wed Jan 14 10:39:37 2026 +0100

    ARM: dts: r9a06g032: Add support for GPIO interrupts
    
    In the RZ/N1 SoC, the GPIO interrupts are multiplexed using the GPIO
    Interrupt Multiplexer.
    
    Add the multiplexer node and connect GPIO interrupt lines to the
    multiplexer.
    
    The interrupt-map available in the multiplexer node has to be updated in
    dts files depending on the GPIO usage. Indeed, the usage of an interrupt
    for a GPIO is board dependent.
    
    Up to 8 GPIOs can be used as an interrupt line (one per multiplexer
    output interrupt).
    
    Signed-off-by: Herve Codina (Schneider Electric) 
    Reviewed-by: Bartosz Golaszewski 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Wolfram Sang 
    Tested-by: Wolfram Sang 
    Link: https://patch.msgid.link/20260114093938.1089936-9-herve.codina@bootlin.com
    Signed-off-by: Geert Uytterhoeven 

commit ca91def749cea0cd8916f289c550c341b2d774dd
Author: Herve Codina (Schneider Electric) 
Date:   Wed Jan 14 10:39:34 2026 +0100

    ARM: dts: r9a06g032: Add GPIO controllers
    
    Add GPIO controllers (Synopsys DesignWare IPs) available in the
    r9a06g032 (RZ/N1D) SoC.
    
    Signed-off-by: Herve Codina (Schneider Electric) 
    Reviewed-by: Wolfram Sang 
    Tested-by: Wolfram Sang 
    Reviewed-by: Bartosz Golaszewski 
    Reviewed-by: Geert Uytterhoeven 
    Reviewed-by: Linus Walleij 
    Link: https://patch.msgid.link/20260114093938.1089936-6-herve.codina@bootlin.com
    Signed-off-by: Geert Uytterhoeven 

commit 4ef81dcac8f6e08b29c359ab147dd87a488d178c
Author: Tommaso Merciai 
Date:   Thu Nov 20 12:51:39 2025 +0100

    arm64: dts: renesas: rzg3e-smarc-som: Enable I3C support
    
    Enable I3C on RZ/G3E SMARC SoM.
    
    Signed-off-by: Tommaso Merciai 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/9d1cf2cdb1c11f24378404142e4c8aff680c6961.1763638659.git.tommaso.merciai.xr@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 80cbfd7174f31010982f065e8ae73bf337992105
Author: Marc Zyngier 
Date:   Wed Dec 10 17:30:24 2025 +0000

    KVM: arm64: Honor UX/PX attributes for EL2 S1 mappings
    
    Now that we potentially have two bits to deal with when setting
    execution permissions, make sure we correctly handle them when both
    when building the page tables and when reading back from them.
    
    Reported-by: Alexandru Elisei 
    Reviewed-by: Fuad Tabba 
    Reviewed-by: Joey Gouly 
    Tested-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251210173024.561160-7-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit 9d2de51825598fc8e76f596c16368362753d8021
Author: Marc Zyngier 
Date:   Wed Dec 10 17:30:23 2025 +0000

    KVM: arm64: Convert VTCR_EL2 to config-driven sanitisation
    
    Describe all the VTCR_EL2 fields and their respective configurations,
    making sure that we correctly ignore the bits that are not defined
    for a given guest configuration.
    
    Reviewed-by: Alexandru Elisei 
    Reviewed-by: Fuad Tabba 
    Tested-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251210173024.561160-6-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit c259d763e6b09a463c85ff6b1d20ede92da48d24
Author: Marc Zyngier 
Date:   Wed Dec 10 17:30:22 2025 +0000

    KVM: arm64: Account for RES1 bits in DECLARE_FEAT_MAP() and co
    
    None of the registers we manage in the feature dependency infrastructure
    so far has any RES1 bit. This is about to change, as VTCR_EL2 has
    its bit 31 being RES1.
    
    In order to not fail the consistency checks by not describing a bit,
    add RES1 bits to the set of immutable bits. This requires some extra
    surgery for the FGT handling, as we now need to track RES1 bits there
    as well.
    
    There are no RES1 FGT bits *yet*. Watch this space.
    
    Reviewed-by: Fuad Tabba 
    Tested-by: Sascha Bischoff 
    Reviewed-by: Jonathan Cameron 
    Tested-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251210173024.561160-5-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit a035001dea37b885efb934e25057430ae1193d0a
Author: Marc Zyngier 
Date:   Wed Dec 10 17:30:21 2025 +0000

    arm64: Convert VTCR_EL2 to sysreg infratructure
    
    Our definition of VTCR_EL2 is both partial (tons of fields are
    missing) and totally inconsistent (some constants are shifted,
    some are not). They are also expressed in terms of TCR, which is
    rather inconvenient.
    
    Replace the ad-hoc definitions with the the generated version.
    This results in a bunch of additional changes to make the code
    with the unshifted nature of generated enumerations.
    
    The register data was extracted from the BSD licenced AARCHMRS
    (AARCHMRS_OPENSOURCE_A_profile_FAT-2025-09_ASL0).
    
    Reviewed-by: Alexandru Elisei 
    Reviewed-by: Fuad Tabba 
    Tested-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251210173024.561160-4-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit f1640174c8a769511641bfd5b7da16c4943e2c64
Author: Marc Zyngier 
Date:   Wed Dec 10 17:30:20 2025 +0000

    arm64: Convert ID_AA64MMFR0_EL1.TGRAN{4,16,64}_2 to UnsignedEnum
    
    ID_AA64MMFR0_EL1.TGRAN{4,16,64}_2 are currently represented as unordered
    enumerations. However, the architecture treats them as Unsigned,
    as hinted to by the MRS data:
    
    (FEAT_S2TGran4K <=> (((UInt(ID_AA64MMFR0_EL1.TGran4_2) == 0) &&
                           FEAT_TGran4K) ||
                         (UInt(ID_AA64MMFR0_EL1.TGran4_2) >= 2))))
    
    and similar descriptions exist for 16 and 64k.
    
    This is also confirmed by D24.1.3.3 ("Alternative ID scheme used for
    ID_AA64MMFR0_EL1 stage 2 granule sizes") in the L.b revision of
    the ARM ARM.
    
    Turn these fields into UnsignedEnum so that we can use the above
    description more or less literally.
    
    Reviewed-by: Fuad Tabba 
    Tested-by: Fuad Tabba 
    Link: https://patch.msgid.link/20251210173024.561160-3-maz@kernel.org
    Signed-off-by: Marc Zyngier 

commit f3b795d298a280687ed70211d51043ed5fc7a96a
Author: Herve Codina (Schneider Electric) 
Date:   Wed Jan 14 10:39:35 2026 +0100

    dt-bindings: soc: renesas: Document RZ/N1 GPIO Interrupt Multiplexer
    
    On the Renesas RZ/N1 SoC, GPIOs can generate interruptions. Those
    interruption lines are multiplexed by the GPIO Interrupt Multiplexer in
    order to map 32 * 3 GPIO interrupt lines to 8 GIC interrupt lines.
    
    The GPIO interrupt multiplexer IP does nothing but select 8 GPIO
    IRQ lines out of the 96 available to wire them to the GIC input lines.
    
    Signed-off-by: Herve Codina (Schneider Electric) 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: Rob Herring (Arm) 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20260114093938.1089936-7-herve.codina@bootlin.com
    Signed-off-by: Geert Uytterhoeven 

commit 8138fc46d9a44c0a3457028b9912cfd4406b35d1
Merge: cc75d43783f74f b0ba734516d201
Author: Paolo Abeni 
Date:   Thu Jan 15 11:55:09 2026 +0100

    Merge branch 'introduce-and-use-netif_xmit_timeout_ms-helper'
    
    Tariq Toukan says:
    
    ====================
    Introduce and use netif_xmit_timeout_ms() helper
    
    This is V2, find V1 here:
    https://lore.kernel.org/all/1764054776-1308696-1-git-send-email-tariqt@nvidia.com/
    
    This series by Shahar introduces a new helper function
    netif_xmit_timeout_ms() to check if a TX queue has timed out and report
    the timeout duration.
    It also encapsulates the check for whether the TX queue is stopped.
    
    Replace duplicated open-coded timeout check in hns3 driver with the new
    helper.
    
    For mlx5e, refine the TX timeout recovery flow to act only on SQs whose
    transmit timestamp indicates an actual timeout, as determined by the
    helper. This prevents unnecessary channel reopen events caused by
    attempting recovery on queues that are merely stopped but not truly
    timed out.
    ====================
    
    Link: https://patch.msgid.link/1768209383-1546791-1-git-send-email-tariqt@nvidia.com
    Signed-off-by: Paolo Abeni 

commit b0ba734516d201c217b23bf39782792b5404fb1c
Author: Shahar Shitrit 
Date:   Mon Jan 12 11:16:23 2026 +0200

    net/mlx5e: Refine TX timeout handling to skip non-timed-out SQ
    
    mlx5e_tx_timeout_work() is invoked when the dev_watchdog reports a
    timed-out TX queue. Currently, the recovery flow is triggered for all
    stopped SQs, which is not always correct — some SQs may be temporarily
    stopped without actually timing out. Attempting to recover such SQs
    results in no EQE being polled (since no real timeout occurred), which
    the driver misinterprets as a recovery failure, unnecessarily causing
    channel reopening.
    
    Improve the logic to initiate recovery only for SQs that are both
    stopped and timed out. Utilize the helper introduced in the previous
    patch to determine whether the netdevice watchdog timeout period has
    elapsed since the SQ’s last transmit timestamp.
    
    Signed-off-by: Shahar Shitrit 
    Reviewed-by: Yael Chemla 
    Signed-off-by: Tariq Toukan 
    Link: https://patch.msgid.link/1768209383-1546791-4-git-send-email-tariqt@nvidia.com
    Reviewed-by: Simon Horman 
    Signed-off-by: Paolo Abeni 

commit 3ae02d659773f8f3aa0cebe04d42c88113a2dd0d
Author: Shahar Shitrit 
Date:   Mon Jan 12 11:16:22 2026 +0200

    net: hns3: Use netif_xmit_timeout_ms() helper
    
    Replace the open-coded TX queue timeout check
    in hns3_get_timeout_queue() with a call to
    netif_xmit_timeout_ms() helper.
    
    Signed-off-by: Shahar Shitrit 
    Reviewed-by: Yael Chemla 
    Signed-off-by: Tariq Toukan 
    Reviewed-by: Jijie Shao 
    Link: https://patch.msgid.link/1768209383-1546791-3-git-send-email-tariqt@nvidia.com
    Reviewed-by: Simon Horman 
    Signed-off-by: Paolo Abeni 

commit cfbc8b6babf24ab252b6b5db936adbb5f3ca45dd
Author: Shahar Shitrit 
Date:   Mon Jan 12 11:16:21 2026 +0200

    net: Introduce netif_xmit_timeout_ms() helper
    
    Introduce a new helper function netif_xmit_timeout_ms() to check
    if a TX queue is stopped and has timed out and report the timeout
    duration. This makes the timeout logic reusable, and will be used
    in several places in subsequent patches.
    
    Signed-off-by: Shahar Shitrit 
    Reviewed-by: Yael Chemla 
    Signed-off-by: Tariq Toukan 
    Link: https://patch.msgid.link/1768209383-1546791-2-git-send-email-tariqt@nvidia.com
    Reviewed-by: Simon Horman 
    Signed-off-by: Paolo Abeni 

commit a98cd5c298af2f4030ca261a12ea001254d6bedb
Merge: 9ace4753a5202b 19cffd16ed6489
Author: Marc Zyngier 
Date:   Thu Jan 15 10:53:31 2026 +0000

    Merge branch kvmarm-fixes-6.19-1 into kvm-arm64/vtcr
    
    KVM/arm64 fixes for 6.19
    
     - Ensure early return semantics are preserved for pKVM fault handlers
    
     - Fix case where the kernel runs with the guest's PAN value when
       CONFIG_ARM64_PAN is not set
    
     - Make stage-1 walks to set the access flag respect the access
       permission of the underlying stage-2, when enabled
    
     - Propagate computed FGT values to the pKVM view of the vCPU at
       vcpu_load()
    
     - Correctly program PXN and UXN privilege bits for hVHE's stage-1 page
       tables
    
     - Check that the VM is actually using VGICv3 before accessing the GICv3
       CPU interface
    
     - Delete some unused code
    
    # -----BEGIN PGP SIGNATURE-----
    #
    # iI0EABYKADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCaWiyJBccb2xpdmVyLnVw
    # dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFqVhAQDM4Lbrq0F80X+YzvO7oxWioOy4
    # JiTATSii9Lit8KY6fgEAvLD4qaggLdF3+WY+V37YmTj3UDgI31ClBr+xSvSengA=
    # =XaL0
    # -----END PGP SIGNATURE-----
    # gpg: Signature made Thu 15 Jan 2026 09:23:48 GMT
    # gpg:                using EDDSA key 8D5C78D65EECCC66EB6B28D2A2BE7588247CDD16
    # gpg:                issuer "oliver.upton@linux.dev"
    # gpg: Can't check signature: No public key
    
    * tag 'kvmarm-fixes-6.19-1':
      KVM: arm64: Invert KVM_PGTABLE_WALK_HANDLE_FAULT to fix pKVM walkers
      KVM: arm64: Don't blindly set set PSTATE.PAN on guest exit
      KVM: arm64: nv: Respect stage-2 write permssion when setting stage-1 AF
      KVM: arm64: Remove unused vcpu_{clear,set}_wfx_traps()
      KVM: arm64: Remove unused parameter in synchronize_vcpu_pstate()
      KVM: arm64: Remove extra argument for __pvkm_host_{share,unshare}_hyp()
      KVM: arm64: Inject UNDEF for a register trap without accessor
      KVM: arm64: Copy FGT traps to unprotected pKVM VCPU on VCPU load
      KVM: arm64: Fix EL2 S1 XN handling for hVHE setups
      KVM: arm64: gic: Check for vGICv3 when clearing TWI
    
    Signed-off-by: Marc Zyngier 

commit 31911d3c394d6556a67ff63cf0093049ef6dcdd7
Author: Uros Bizjak 
Date:   Wed Jan 14 22:18:15 2026 +0100

    x86/paravirt: Use XOR r32,r32 to clear register in pv_vcpu_is_preempted()
    
    x86_64 zero extends 32bit operations, so for 64bit operands, XOR r32,r32 is
    functionally equal to XOR r64,r64, but avoids a REX prefix byte when legacy
    registers are used.
    
    Signed-off-by: Uros Bizjak 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Juergen Gross 
    Acked-by: H. Peter Anvin 
    Acked-by: Alexey Makhalov 
    Link: https://patch.msgid.link/20260114211948.74774-2-ubizjak@gmail.com

commit e9858fba558ced73133a685c8e76c04cb66d8244
Author: AngeloGioacchino Del Regno 
Date:   Thu Jan 15 11:41:12 2026 +0100

    arm64: dts: mediatek: mt7981b-openwrt-one: Add address/size cells to eth
    
    The ethernet node has two MAC subnodes and cannot use the default
    address/size cells: set address cells to 1 and size cells to 0.
    
    Signed-off-by: AngeloGioacchino Del Regno 

commit baea32b242be8ff857cc27b910c6c325c24a7247
Author: Uros Bizjak 
Date:   Wed Jan 14 22:18:14 2026 +0100

    x86/paravirt: Remove trailing semicolons from alternative asm templates
    
    GCC inline asm treats semicolons as instruction separators, so a
    semicolon after the last instruction is not required.
    
    Signed-off-by: Uros Bizjak 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Juergen Gross 
    Acked-by: Alexey Makhalov 
    Link: https://patch.msgid.link/20260114211948.74774-1-ubizjak@gmail.com

commit 7874eeacfa42177565c01d5198726671acf7adf2
Author: Jacob Moroni 
Date:   Mon Jan 12 02:00:06 2026 +0000

    RDMA/iwcm: Fix workqueue list corruption by removing work_list
    
    The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()")
    changed the work submission logic to unconditionally call
    queue_work() with the expectation that queue_work() would
    have no effect if work was already pending. The problem is
    that a free list of struct iwcm_work is used (for which
    struct work_struct is embedded), so each call to queue_work()
    is basically unique and therefore does indeed queue the work.
    
    This causes a problem in the work handler which walks the work_list
    until it's empty to process entries. This means that a single
    run of the work handler could process item N+1 and release it
    back to the free list while the actual workqueue entry is still
    queued. It could then get reused (INIT_WORK...) and lead to
    list corruption in the workqueue logic.
    
    Fix this by just removing the work_list. The workqueue already
    does this for us.
    
    This fixes the following error that was observed when stress
    testing with ucmatose on an Intel E830 in iWARP mode:
    
    [  151.465780] list_del corruption. next->prev should be ffff9f0915c69c08, but was ffff9f0a1116be08. (next=ffff9f0a15b11c08)
    [  151.466639] ------------[ cut here ]------------
    [  151.466986] kernel BUG at lib/list_debug.c:67!
    [  151.467349] Oops: invalid opcode: 0000 [#1] SMP NOPTI
    [  151.467753] CPU: 14 UID: 0 PID: 2306 Comm: kworker/u64:18 Not tainted 6.19.0-rc4+ #1 PREEMPT(voluntary)
    [  151.468466] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    [  151.469192] Workqueue:  0x0 (iw_cm_wq)
    [  151.469478] RIP: 0010:__list_del_entry_valid_or_report+0xf0/0x100
    [  151.469942] Code: c7 58 5f 4c b2 e8 10 50 aa ff 0f 0b 48 89 ef e8 36 57 cb ff 48 8b 55 08 48 89 e9 48 89 de 48 c7 c7 a8 5f 4c b2 e8 f0 4f aa ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90
    [  151.471323] RSP: 0000:ffffb15644e7bd68 EFLAGS: 00010046
    [  151.471712] RAX: 000000000000006d RBX: ffff9f0915c69c08 RCX: 0000000000000027
    [  151.472243] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f0a37d9c600
    [  151.472768] RBP: ffff9f0a15b11c08 R08: 0000000000000000 R09: c0000000ffff7fff
    [  151.473294] R10: 0000000000000001 R11: ffffb15644e7bba8 R12: ffff9f092339ee68
    [  151.473817] R13: ffff9f0900059c28 R14: ffff9f092339ee78 R15: 0000000000000000
    [  151.474344] FS:  0000000000000000(0000) GS:ffff9f0a847b5000(0000) knlGS:0000000000000000
    [  151.474934] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [  151.475362] CR2: 0000559e233a9088 CR3: 000000020296b004 CR4: 0000000000770ef0
    [  151.475895] PKRU: 55555554
    [  151.476118] Call Trace:
    [  151.476331]  
    [  151.476497]  move_linked_works+0x49/0xa0
    [  151.476792]  __pwq_activate_work.isra.46+0x2f/0xa0
    [  151.477151]  pwq_dec_nr_in_flight+0x1e0/0x2f0
    [  151.477479]  process_scheduled_works+0x1c8/0x410
    [  151.477823]  worker_thread+0x125/0x260
    [  151.478108]  ? __pfx_worker_thread+0x10/0x10
    [  151.478430]  kthread+0xfe/0x240
    [  151.478671]  ? __pfx_kthread+0x10/0x10
    [  151.478955]  ? __pfx_kthread+0x10/0x10
    [  151.479240]  ret_from_fork+0x208/0x270
    [  151.479523]  ? __pfx_kthread+0x10/0x10
    [  151.479806]  ret_from_fork_asm+0x1a/0x30
    [  151.480103]  
    
    Fixes: e1168f09b331 ("RDMA/iwcm: Simplify cm_event_handler()")
    Signed-off-by: Jacob Moroni 
    Link: https://patch.msgid.link/20260112020006.1352438-1-jmoroni@google.com
    Reviewed-by: Bart Van Assche 
    Signed-off-by: Leon Romanovsky 

commit 0beefd0e15d962f497aad750b2d5e9c3570b66d1
Author: Jiasheng Jiang 
Date:   Mon Jan 12 01:54:12 2026 +0000

    RDMA/rxe: Fix double free in rxe_srq_from_init
    
    In rxe_srq_from_init(), the queue pointer 'q' is assigned to
    'srq->rq.queue' before copying the SRQ number to user space.
    If copy_to_user() fails, the function calls rxe_queue_cleanup()
    to free the queue, but leaves the now-invalid pointer in
    'srq->rq.queue'.
    
    The caller of rxe_srq_from_init() (rxe_create_srq) eventually
    calls rxe_srq_cleanup() upon receiving the error, which triggers
    a second rxe_queue_cleanup() on the same memory, leading to a
    double free.
    
    The call trace looks like this:
       kmem_cache_free+0x.../0x...
       rxe_queue_cleanup+0x1a/0x30 [rdma_rxe]
       rxe_srq_cleanup+0x42/0x60 [rdma_rxe]
       rxe_elem_release+0x31/0x70 [rdma_rxe]
       rxe_create_srq+0x12b/0x1a0 [rdma_rxe]
       ib_create_srq_user+0x9a/0x150 [ib_core]
    
    Fix this by moving 'srq->rq.queue = q' after copy_to_user.
    
    Fixes: aae0484e15f0 ("IB/rxe: avoid srq memory leak")
    Signed-off-by: Jiasheng Jiang 
    Link: https://patch.msgid.link/20260112015412.29458-1-jiashengjiangcool@gmail.com
    Reviewed-by: Zhu Yanjun 
    Signed-off-by: Leon Romanovsky 

commit 354e7a6d448b5744362bf33a24315d4d1d0bb7ef
Author: Chengchang Tang 
Date:   Thu Jan 8 19:30:32 2026 +0800

    RDMA/hns: Support drain SQ and RQ
    
    Some ULPs, e.g. rpcrdma, rely on drain_qp() to ensure all outstanding
    requests are completed before releasing related memory. If drain_qp()
    fails, ULPs may release memory directly, and in-flight WRs may later be
    flushed after the memory is freed, potentially leading to UAF.
    
    drain_qp() failures can happen when HW enters an error state or is
    reset. Add support to drain SQ and RQ in such cases by posting a
    fake WR during reset, so the driver can process all remaining WRs in
    sequence and generate corresponding completions.
    
    Always invoke comp_handler() in drain process to ensure completions
    are not lost under concurrency (e.g. concurrent post_send() and
    reset, or QPs created during reset). If the CQ is already processed,
    cancel any already scheduled comp_handler() to avoid concurrency
    issues.
    
    Signed-off-by: Chengchang Tang 
    Signed-off-by: Junxian Huang 
    Link: https://patch.msgid.link/20260108113032.856306-1-huangjunxian6@hisilicon.com
    Signed-off-by: Leon Romanovsky 

commit c19faf5a62315d5e0e65dde49b7b59e30330b9c2
Author: Aristo Chen 
Date:   Mon Jan 12 23:48:30 2026 +0800

    tee: optee: store OS revision for TEE core
    
    Collect OP-TEE OS revision from secure world for both SMC and FF-A
    ABIs, store it in the OP-TEE driver, and expose it through the
    generic get_tee_revision() callback.
    
    Signed-off-by: Aristo Chen 
    Signed-off-by: Jens Wiklander 
    Reviewed-by: Sumit Garg 

commit e82d0477fd80707221c3d110f56d05506de2698c
Author: Uwe Kleine-König 
Date:   Tue Jan 13 15:38:15 2026 +0100

    tpm/tpm_ftpm_tee: Fix kdoc after function renames
    
    Recently ftpm_tee_probe() and ftpm_tee_remove() grew a suffix in their
    function name but I failed to adapt the kernel doc when doing so. This
    change aligns the kernel doc to the actual function name (again).
    
    Fixes: 92fad96aea24 ("tpm/tpm_ftpm_tee: Make use of tee bus methods")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202601132105.9lgSsC4U-lkp@intel.com/
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Jarkko Sakkinen 
    Signed-off-by: Jens Wiklander 

commit a85503d541eafce9b4d73d509c1e341401a86d85
Author: Nitin Joshi 
Date:   Wed Jan 7 02:45:19 2026 +0900

    platform/x86: thinkpad_acpi: Add sysfs to display details of damaged device.
    
    Add new sysfs interface to identify the impacted component with location of
    device.
    
    Reviewed-by: Mark Pearson 
    Signed-off-by: Nitin Joshi 
    Link: https://patch.msgid.link/20260106174519.6402-2-nitjoshi@gmail.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit cc75d43783f74fe0a1c288aba9e6ac55f1444977
Merge: 3b194343c25084 a2cb2e23b2bcc5
Author: Paolo Abeni 
Date:   Thu Jan 15 10:07:49 2026 +0100

    Merge branch 'xsk-move-cq_cached_prod_lock'
    
    Jason Xing says:
    
    ====================
    xsk: move cq_cached_prod_lock
    
    From: Jason Xing 
    
    Move cq_cached_prod_lock to avoid touching new cacheline.
    
    Acked-by: Stanislav Fomichev 
    ====================
    
    Link: https://patch.msgid.link/20260104012125.44003-1-kerneljasonxing@gmail.com
    Signed-off-by: Paolo Abeni 

commit a2cb2e23b2bcc5e376a7aa63964e04a5b059d7a1
Author: Jason Xing 
Date:   Sun Jan 4 09:21:25 2026 +0800

    xsk: move cq_cached_prod_lock to avoid touching a cacheline in sending path
    
    We (Paolo and I) noticed that in the sending path touching an extra
    cacheline due to cq_cached_prod_lock will impact the performance. After
    moving the lock from struct xsk_buff_pool to struct xsk_queue, the
    performance is increased by ~5% which can be observed by xdpsock.
    
    An alternative approach [1] can be using atomic_try_cmpxchg() to have the
    same effect. But unfortunately I don't have evident performance numbers to
    prove the atomic approach is better than the current patch. The advantage
    is to save the contention time among multiple xsks sharing the same pool
    while the disadvantage is losing good maintenance. The full discussion can
    be found at the following link.
    
    [1]: https://lore.kernel.org/all/20251128134601.54678-1-kerneljasonxing@gmail.com/
    
    Suggested-by: Paolo Abeni 
    Signed-off-by: Jason Xing 
    Link: https://patch.msgid.link/20260104012125.44003-3-kerneljasonxing@gmail.com
    Acked-by: Stanislav Fomichev 
    Signed-off-by: Paolo Abeni 

commit cee715d907d0f93411542f19a4eb9161450e782b
Author: Jason Xing 
Date:   Sun Jan 4 09:21:24 2026 +0800

    xsk: advance cq/fq check when shared umem is used
    
    In the shared umem mode with different queues or devices, either
    uninitialized cq or fq is not allowed which was previously done in
    xp_assign_dev_shared(). The patch advances the check at the beginning
    so that 1) we can avoid a few memory allocation and stuff if cq or fq
    is NULL, 2) it can be regarded as preparation for the next patch in
    the series.
    
    Signed-off-by: Jason Xing 
    Link: https://patch.msgid.link/20260104012125.44003-2-kerneljasonxing@gmail.com
    Acked-by: Stanislav Fomichev 
    Signed-off-by: Paolo Abeni 

commit 28c43bddd0fa8999533feba8be9dc0583eaed281
Author: Nitin Joshi 
Date:   Wed Jan 7 02:45:18 2026 +0900

    platform/x86: thinkpad_acpi: Add support to detect hardware damage detection capability.
    
    Thinkpads are adding the ability to detect and report hardware damage
    status. Add new sysfs interface to identify whether hardware damage
    is detected or not.
    
    Initial support is available for the USB-C replaceable connector.
    
    Reviewed-by: Mark Pearson 
    Signed-off-by: Nitin Joshi 
    Link: https://patch.msgid.link/20260106174519.6402-1-nitjoshi@gmail.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 10d6d2416db2137a5a0ef9162662e5b7fee56dd4
Author: Chen Ni 
Date:   Wed Jan 14 10:36:52 2026 +0800

    perf/x86/intel/uncore: Convert comma to semicolon
    
    Replace comma between expressions with semicolons.
    
    Using a ',' in place of a ';' can have unintended side effects.
    Although that is not the case here, it is seems best to use ';'
    unless ',' is intended.
    
    Found by inspection.
    No functional change intended.
    Compile tested only.
    
    Fixes: e7d5f2ea0923 ("perf/x86/intel/uncore: Add Nova Lake support")
    Signed-off-by: Chen Ni 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20260114023652.3926117-1-nichen@iscas.ac.cn

commit 59af95e028d4114991b9bd96a39ad855b399cc07
Author: Dapeng Mi 
Date:   Wed Jan 14 09:17:50 2026 +0800

    perf/x86/intel: Add support for rdpmc user disable feature
    
    Starting with Panther Cove, the rdpmc user disable feature is supported.
    This feature allows the perf system to disable user space rdpmc reads at
    the counter level.
    
    Currently, when a global counter is active, any user with rdpmc rights
    can read it, even if perf access permissions forbid it (e.g., disallow
    reading ring 0 counters). The rdpmc user disable feature mitigates this
    security concern.
    
    Details:
    
    - A new RDPMC_USR_DISABLE bit (bit 37) in each EVNTSELx MSR indicates
      that the GP counter cannot be read by RDPMC in ring 3.
    - New RDPMC_USR_DISABLE bits in IA32_FIXED_CTR_CTRL MSR (bits 33, 37,
      41, 45, etc.) for fixed counters 0, 1, 2, 3, etc.
    - When calling rdpmc instruction for counter x, the following pseudo
      code demonstrates how the counter value is obtained:
            If (!CPL0 && RDPMC_USR_DISABLE[x] == 1) ? 0 : counter_value;
    - RDPMC_USR_DISABLE is enumerated by CPUID.0x23.0.EBX[2].
    
    This patch extends the current global user space rdpmc control logic via
    the sysfs interface (/sys/devices/cpu/rdpmc) as follows:
    
    - rdpmc = 0:
      Global user space rdpmc and counter-level user space rdpmc for all
      counters are both disabled.
    - rdpmc = 1:
      Global user space rdpmc is enabled during the mmap-enabled time window,
      and counter-level user space rdpmc is enabled only for non-system-wide
      events. This prevents counter data leaks as count data is cleared
      during context switches.
    - rdpmc = 2:
      Global user space rdpmc and counter-level user space rdpmc for all
      counters are enabled unconditionally.
    
    The new rdpmc settings only affect newly activated perf events; currently
    active perf events remain unaffected. This simplifies and cleans up the
    code. The default value of rdpmc remains unchanged at 1.
    
    For more details about rdpmc user disable, please refer to chapter 15
    "RDPMC USER DISABLE" in ISE documentation.
    
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260114011750.350569-8-dapeng1.mi@linux.intel.com

commit 8c74e4e3e0596950554962229582260f1501d899
Author: Dapeng Mi 
Date:   Wed Jan 14 09:17:49 2026 +0800

    perf/x86: Use macros to replace magic numbers in attr_rdpmc
    
    Replace magic numbers in attr_rdpmc with macros to improve readability
    and make their meanings clearer for users.
    
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260114011750.350569-7-dapeng1.mi@linux.intel.com

commit c847a208f43bfeb56943f2ca6fe2baf1db9dee7a
Author: Dapeng Mi 
Date:   Wed Jan 14 09:17:48 2026 +0800

    perf/x86/intel: Add core PMU support for Novalake
    
    This patch enables core PMU support for Novalake, covering both P-core
    and E-core. It includes Arctic Wolf-specific counters and PEBS
    constraints, and the model-specific OMR extra registers table.
    
    Since Coyote Cove shares the same PMU capabilities as Panther Cove, the
    existing Panther Cove PMU enabling functions are reused for Coyote Cove.
    
    For detailed information about counter constraints, please refer to
    section 16.3 "COUNTER RESTRICTIONS" in the ISE documentation.
    
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260114011750.350569-6-dapeng1.mi@linux.intel.com

commit 7cd264d1972d13177acc1ac9fb11ee0a7003e2e6
Author: Dapeng Mi 
Date:   Wed Jan 14 09:17:47 2026 +0800

    perf/x86/intel: Add support for PEBS memory auxiliary info field in NVL
    
    Similar to DMR (Panther Cove uarch), both P-core (Coyote Cove uarch) and
    E-core (Arctic Wolf uarch) of NVL adopt the new PEBS memory auxiliary
    info layout.
    
    Coyote Cove microarchitecture shares the same PMU capabilities, including
    the memory auxiliary info layout, with Panther Cove. Arctic Wolf
    microarchitecture has a similar layout to Panther Cove, with the only
    difference being specific data source encoding for L2 hit cases (up to
    the L2 cache level). The OMR encoding remains the same as in Panther Cove.
    
    For detailed information on the memory auxiliary info encoding, please
    refer to section 16.2 "PEBS LOAD LATENCY AND STORE LATENCY FACILITY" in
    the latest ISE documentation.
    
    This patch defines Arctic Wolf specific data source encoding and then
    supports PEBS memory auxiliary info field for NVL.
    
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260114011750.350569-5-dapeng1.mi@linux.intel.com

commit d345b6bb886004ac1018da0348b5da7d9906071b
Author: Dapeng Mi 
Date:   Wed Jan 14 09:17:46 2026 +0800

    perf/x86/intel: Add core PMU support for DMR
    
    This patch enables core PMU features for Diamond Rapids (Panther Cove
    microarchitecture), including Panther Cove specific counter and PEBS
    constraints, a new cache events ID table, and the model-specific OMR
    events extra registers table.
    
    For detailed information about counter constraints, please refer to
    section 16.3 "COUNTER RESTRICTIONS" in the ISE documentation.
    
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260114011750.350569-4-dapeng1.mi@linux.intel.com

commit d2bdcde9626cbea0c44a6aaa33b440c8adf81e09
Author: Dapeng Mi 
Date:   Wed Jan 14 09:17:45 2026 +0800

    perf/x86/intel: Add support for PEBS memory auxiliary info field in DMR
    
    With the introduction of the OMR feature, the PEBS memory auxiliary info
    field for load and store latency events has been restructured for DMR.
    
    The memory auxiliary info field's bit[8] indicates whether a L2 cache
    miss occurred for a memory load or store instruction. If bit[8] is 0,
    it signifies no L2 cache miss, and bits[7:0] specify the exact cache data
    source (up to the L2 cache level). If bit[8] is 1, bits[7:0] represent
    the OMR encoding, indicating the specific L3 cache or memory region
    involved in the memory access. A significant enhancement is OMR encoding
    provides up to 8 fine-grained memory regions besides the cache region.
    
    A significant enhancement for OMR encoding is the ability to provide
    up to 8 fine-grained memory regions in addition to the cache region,
    offering more detailed insights into memory access regions.
    
    For detailed information on the memory auxiliary info encoding, please
    refer to section 16.2 "PEBS LOAD LATENCY AND STORE LATENCY FACILITY" in
    the ISE documentation.
    
    This patch ensures that the PEBS memory auxiliary info field is correctly
    interpreted and utilized in DMR.
    
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260114011750.350569-3-dapeng1.mi@linux.intel.com

commit 4e955c08d6dc76fb60cda9af955ddcebedaa7f69
Author: Dapeng Mi 
Date:   Wed Jan 14 09:17:44 2026 +0800

    perf/x86/intel: Support the 4 new OMR MSRs introduced in DMR and NVL
    
    Diamond Rapids (DMR) and Nova Lake (NVL) introduce an enhanced
    Off-Module Response (OMR) facility, replacing the Off-Core Response (OCR)
    Performance Monitoring of previous processors.
    
    Legacy microarchitectures used the OCR facility to evaluate off-core and
    multi-core off-module transactions. The newly named OMR facility improves
    OCR capabilities for scalable coverage of new memory systems in
    multi-core module systems.
    
    Similar to OCR, 4 additional off-module configuration MSRs
    (OFFMODULE_RSP_0 to OFFMODULE_RSP_3) are introduced to specify attributes
    of off-module transactions. When multiple identical OMR events are
    created, they need to occupy the same OFFMODULE_RSP_x MSR. To ensure
    these multiple identical OMR events can work simultaneously, the
    intel_alt_er() and intel_fixup_er() helpers are enhanced to rotate these
    OMR events across different OFFMODULE_RSP_* MSRs, similar to previous OCR
    events.
    
    For more details about OMR, please refer to section 16.1 "OFF-MODULE
     RESPONSE (OMR) FACILITY" in ISE documentation.
    
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260114011750.350569-2-dapeng1.mi@linux.intel.com

commit 4960626f956d63dce57f099016c2ecbe637a8229
Author: Namhyung Kim 
Date:   Mon Jan 12 08:51:57 2026 -0800

    perf/core: Fix slow perf_event_task_exit() with LBR callstacks
    
    I got a report that a task is stuck in perf_event_exit_task() waiting
    for global_ctx_data_rwsem.  On large systems with lots threads, it'd
    have performance issues when it grabs the lock to iterate all threads
    in the system to allocate the context data.
    
    And it'd block task exit path which is problematic especially under
    memory pressure.
    
      perf_event_open
        perf_event_alloc
          attach_perf_ctx_data
            attach_global_ctx_data
              percpu_down_write (global_ctx_data_rwsem)
                for_each_process_thread
                  alloc_task_ctx_data
                                                   do_exit
                                                     perf_event_exit_task
                                                       percpu_down_read (global_ctx_data_rwsem)
    
    It should not hold the global_ctx_data_rwsem on the exit path.  Let's
    skip allocation for exiting tasks and free the data carefully.
    
    Reported-by: Rosalie Fang 
    Suggested-by: Peter Zijlstra 
    Signed-off-by: Namhyung Kim 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260112165157.1919624-1-namhyung@kernel.org

commit c455f19bbe6104debd980bb15515faf716bd81b8
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:40 2026 +0000

    rust: xarray: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Acked-by: Tamir Duberstein 
    Link: https://lore.kernel.org/r/20260105-define-rust-helper-v2-27-51da5f454a67@google.com
    Signed-off-by: Andreas Hindborg 

commit 6363844fdbbb76afe1d44d678fe0746390204a5f
Author: Christophe JAILLET 
Date:   Mon Dec 29 12:23:51 2025 +0100

    samples: configfs: Constify struct configfs_item_operations and configfs_group_operations
    
    'struct configfs_item_operations' and 'configfs_group_operations' are not
    modified in this driver.
    
    Constifying these structures moves some data to a read-only section, so
    increases overall security, especially when the structure holds some
    function pointers.
    
    On a x86_64, with allmodconfig:
    Before:
    ======
       text    data     bss     dec     hex filename
       7507    6504      64   14075    36fb samples/configfs/configfs_sample.o
    
    After:
    =====
       text    data     bss     dec     hex filename
       7827    6184      64   14075    36fb samples/configfs/configfs_sample.o
    
    Signed-off-by: Christophe JAILLET 
    Link: https://lore.kernel.org/r/70c5fd68fcc4d3ba1f18002012fae19acf4ce50b.1767007414.git.christophe.jaillet@wanadoo.fr
    Signed-off-by: Andreas Hindborg 

commit 1d40cb05e077bb294f128c6a52630b93e452a8ed
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:12:20 2025 +0100

    rust: configfs: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Tamir Duberstein 
    Acked-by: Andreas Hindborg 
    Link: https://lore.kernel.org/r/20251222-cstr-configfs-v1-1-cc1665c51c43@gmail.com
    Signed-off-by: Andreas Hindborg 

commit 29deec49146162d06b17739c627d062191e03814
Author: Ricardo Pardini 
Date:   Wed Jan 14 23:48:36 2026 +0100

    arm64: dts: amlogic: Enable the npu node on Radxa Zero 2
    
    The Zero2 is also an A311D just like the VIM3, enable its npu.
    
    Signed-off-by: Ricardo Pardini 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-arm64-dts-amlogic-radxa-zero2-additions-v1-1-8b5cdf328fde@pardini.net
    Signed-off-by: Neil Armstrong 

commit 3c941feaa363f1573a501452391ddf513394c84b
Author: Jerome Brunet 
Date:   Wed Jan 14 18:08:53 2026 +0100

    arm64: dts: amlogic: g12: assign the MMC A signal clock
    
    The amlogic MMC driver operate with the assumption that MMC clock
    is configured to provide 24MHz. It uses this path for low
    rates such as 400kHz.
    
    Assign the clock to make sure it is properly configured
    
    Fixes: 8a6b3ca2d361 ("arm64: dts: meson: g12a: add SDIO controller")
    Signed-off-by: Jerome Brunet 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-amlogic-mmc-clocks-followup-v1-6-a999fafbe0aa@baylibre.com
    Signed-off-by: Neil Armstrong 

commit be2ff5fdb0e83e32d4ec4e68a69875cec0d14621
Author: Jerome Brunet 
Date:   Wed Jan 14 18:08:52 2026 +0100

    arm64: dts: amlogic: g12: assign the MMC B and C signal clocks
    
    The amlogic MMC driver operate with the assumption that MMC clock
    is configured to provide 24MHz. It uses this path for low
    rates such as 400kHz.
    
    Assign the clocks to make sure they are properly configured
    
    Fixes: 4759fd87b928 ("arm64: dts: meson: g12a: add mmc nodes")
    Signed-off-by: Jerome Brunet 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-amlogic-mmc-clocks-followup-v1-5-a999fafbe0aa@baylibre.com
    Signed-off-by: Neil Armstrong 

commit 406706559046eebc09a31e8ae5e78620bfd746fe
Author: Jerome Brunet 
Date:   Wed Jan 14 18:08:51 2026 +0100

    arm64: dts: amlogic: gx: assign the MMC signal clocks
    
    The amlogic MMC driver operate with the assumption that MMC clock
    is configured to provide 24MHz. It uses this path for low
    rates such as 400kHz.
    
    Assign the clocks to make sure they are properly configured
    
    Fixes: 50662499f911 ("ARM64: dts: meson-gx: Use correct mmc clock source 0")
    Signed-off-by: Jerome Brunet 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-amlogic-mmc-clocks-followup-v1-4-a999fafbe0aa@baylibre.com
    Signed-off-by: Neil Armstrong 

commit 13d3fe2318ef6e46d6fcfe13bc373827fdf2aeac
Author: Jerome Brunet 
Date:   Wed Jan 14 18:08:50 2026 +0100

    arm64: dts: amlogic: axg: assign the MMC signal clocks
    
    The amlogic MMC driver operate with the assumption that MMC clock
    is configured to provide 24MHz. It uses this path for low
    rates such as 400kHz.
    
    Assign the clocks to make sure they are properly configured
    
    Fixes: 221cf34bac54 ("ARM64: dts: meson-axg: enable the eMMC controller")
    Signed-off-by: Jerome Brunet 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-amlogic-mmc-clocks-followup-v1-3-a999fafbe0aa@baylibre.com
    Signed-off-by: Neil Armstrong 

commit c6ccd0d9a253b59125e5c625139799b41f0de3e0
Author: Jerome Brunet 
Date:   Wed Jan 14 18:08:49 2026 +0100

    arm64: dts: amlogic: a1: align the mmc clock setup
    
    The amlogic MMC driver operate with the assumption that MMC clock
    is configured to provide 24MHz. It uses this path for low
    rates such as 400kHz.
    
    A1 is particular in the way that is already has the mmc clock set
    to 24MHz by forcing the mux to select the board crystal. It works
    too, it is just slightly less readable.
    
    Align with what is being done with the other Amlogic platforms.
    
    Signed-off-by: Jerome Brunet 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-amlogic-mmc-clocks-followup-v1-2-a999fafbe0aa@baylibre.com
    Signed-off-by: Neil Armstrong 

commit 69330fd2368371c4eb47d60ace6bca09763d24a0
Author: Jerome Brunet 
Date:   Wed Jan 14 18:08:48 2026 +0100

    arm64: dts: amlogic: c3: assign the MMC signal clocks
    
    The amlogic MMC driver operate with the assumption that MMC clock
    is configured to provide 24MHz. It uses this path for low
    rates such as 400kHz.
    
    Assign the clocks to make sure they are properly configured
    
    Fixes: 520b792e8317 ("arm64: dts: amlogic: add some device nodes for C3")
    Signed-off-by: Jerome Brunet 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-amlogic-mmc-clocks-followup-v1-1-a999fafbe0aa@baylibre.com
    Signed-off-by: Neil Armstrong 

commit 8661d0b142bccfa19bb542ee21ec45a5423899ea
Author: Jens Axboe 
Date:   Wed Jan 14 08:51:02 2026 -0700

    io_uring/uring_cmd: explicitly disallow cancelations for IOPOLL
    
    This currently isn't supported, and due to a recent commit, it also
    cannot easily be supported by io_uring due to hash_node and IOPOLL
    completion data overlapping.
    
    This can be revisited if we ever do support cancelations of requests
    that have gone to the block stack.
    
    Suggested-by: Ming Lei 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 697a5284ad9697609324739e38e341612cd342a6
Author: Jens Axboe 
Date:   Wed Jan 14 07:59:08 2026 -0700

    io_uring: fix IOPOLL with passthrough I/O
    
    A previous commit improving IOPOLL made an incorrect assumption that
    task_work isn't used with IOPOLL. This can cause crashes when doing
    passthrough I/O on nvme, where queueing the completion task_work will
    trample on the same memory that holds the completed list of requests.
    
    Fix it up by shuffling the members around, so we're not sharing any
    parts that end up getting used in this path.
    
    Fixes: 3c7d76d6128a ("io_uring: IOPOLL polling improvements")
    Reported-by: Yi Zhang 
    Link: https://lore.kernel.org/linux-block/CAHj4cs_SLPj9v9w5MgfzHKy+983enPx3ZQY2kMuMJ1202DBefw@mail.gmail.com/
    Tested-by: Yi Zhang 
    Cc: Ming Lei 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 6b3c83df9a0a61eb7a11beb1cef7ae5c2eb3efb6
Author: Baolin Liu 
Date:   Tue Jan 6 14:34:25 2026 +0800

    ntfs3: Refactor duplicate kmemdup pattern in do_action()
    
    Extract the repeated pattern of duplicating attribute and updating
    OpenAttr into a helper function to reduce code duplication and improve
    maintainability.
    
    Signed-off-by: Baolin Liu 
    Signed-off-by: Konstantin Komarov 

commit 27b75ca4e51e3e4554dc85dbf1a0246c66106fd3
Author: Edward Adam Davis 
Date:   Sun Dec 28 11:53:25 2025 +0800

    fs/ntfs3: prevent infinite loops caused by the next valid being the same
    
    When processing valid within the range [valid : pos), if valid cannot
    be retrieved correctly, for example, if the retrieved valid value is
    always the same, this can trigger a potential infinite loop, similar
    to the hung problem reported by syzbot [1].
    
    Adding a check for the valid value within the loop body, and terminating
    the loop and returning -EINVAL if the value is the same as the current
    value, can prevent this.
    
    [1]
    INFO: task syz.4.21:6056 blocked for more than 143 seconds.
    Call Trace:
     rwbase_write_lock+0x14f/0x750 kernel/locking/rwbase_rt.c:244
     inode_lock include/linux/fs.h:1027 [inline]
     ntfs_file_write_iter+0xe6/0x870 fs/ntfs3/file.c:1284
    
    Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
    Reported-by: syzbot+bcf9e1868c1a0c7e04f1@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=bcf9e1868c1a0c7e04f1
    Signed-off-by: Edward Adam Davis 
    Signed-off-by: Konstantin Komarov 

commit 1dad2fff0261568e7fa6a1760619d88d0ef0aff3
Author: sunliming 
Date:   Wed Jan 7 15:37:09 2026 +0800

    fs/ntfs3: make ntfs_writeback_ops static
    
    Fix below sparse warnings:
    fs/ntfs3/inode.c:972:34: sparse: sparse: symbol 'ntfs_writeback_ops' was not declared.
    Should it be static?
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202601061424.nbKLNwC5-lkp@intel.com/
    Signed-off-by: sunliming 
    Signed-off-by: Konstantin Komarov 

commit 08ce2fee1b869ecbfbd94e0eb2630e52203a2e03
Author: Szymon Wilczek 
Date:   Sat Dec 27 15:43:07 2025 +0100

    ntfs3: fix circular locking dependency in run_unpack_ex
    
    Syzbot reported a circular locking dependency between wnd->rw_lock
    (sbi->used.bitmap) and ni->file.run_lock.
    
    The deadlock scenario:
    1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock.
    2. run_unpack_ex() takes wnd->rw_lock then tries to acquire
       ni->file.run_lock inside ntfs_refresh_zone().
    
    This creates an AB-BA deadlock.
    
    Fix this by using down_read_trylock() instead of down_read() when
    acquiring run_lock in run_unpack_ex(). If the lock is contended,
    skip ntfs_refresh_zone() - the MFT zone will be refreshed on the
    next MFT operation. This breaks the circular dependency since we
    never block waiting for run_lock while holding wnd->rw_lock.
    
    Reported-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com
    Tested-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=d27edf9f96ae85939222
    Signed-off-by: Szymon Wilczek 
    Signed-off-by: Konstantin Komarov 

commit 83dc0ba2755296b5e5882e044c80973b7c3fce9e
Merge: a87fef0880c4f5 38a0f4cf8c6147
Author: Dave Airlie 
Date:   Thu Jan 15 14:49:33 2026 +1000

    Merge tag 'amd-drm-next-6.20-2026-01-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-next
    
    amd-drm-next-6.20-2026-01-09:
    
    amdgpu:
    - GPUVM updates
    - Initial support for larger GPU address spaces
    - Initial SMUIO 15.x support
    - Documentation updates
    - Initial PSP 15.x support
    - Initial IH 7.1 support
    - Initial IH 6.1.1 support
    - SMU 13.0.12 updates
    - RAS updates
    - Initial MMHUB 3.4 support
    - Initial MMHUB 4.2 support
    - Initial GC 12.1 support
    - Initial GC 11.5.4 support
    - HDMI fixes
    - Panel replay improvements
    - DML updates
    - DC FP fixes
    - Initial SDMA 6.1.4 support
    - Initial SDMA 7.1 support
    - Userq updates
    - DC HPD refactor
    - SwSMU cleanups and refactoring
    - TTM memory ops parallelization
    - DCN 3.5 fixes
    - DP audio fixes
    - Clang fixes
    - Misc spelling fixes and cleanups
    - Initial SDMA 7.11.4 support
    - Convert legacy DRM logging helpers to new drm logging helpers
    - Initial JPEG 5.3 support
    - Add support for changing UMA size via the driver
    - DC analog fixes
    - GC 9 gfx queue reset support
    - Initial SMU 15.x support
    
    amdkfd:
    - Reserved SDMA rework
    - Refactor SPM
    - Initial GC 12.1 support
    - Initial GC 11.5.4 support
    - Initial SDMA 7.1 support
    - Initial SDMA 6.1.4 support
    - Increase the kfd process hash table
    - Per context support
    - Topology fixes
    
    radeon:
    - Convert legacy DRM logging helpers to new drm logging helpers
    - Use devm for i2c adapters
    - Variable sized array fix
    - Misc cleanups
    
    UAPI:
    - KFD context support.  Proposed userspace:
      https://github.com/ROCm/rocm-systems/pull/1705
      https://github.com/ROCm/rocm-systems/pull/1701
    - Add userq metadata queries for more queue types.  Proposed userspace:
      https://gitlab.freedesktop.org/yogeshmohan/mesa/-/commits/userq_query
    
    From: Alex Deucher 
    Link: https://patch.msgid.link/20260109154713.3242957-1-alexander.deucher@amd.com
    Signed-off-by: Dave Airlie 

commit 9f54ab83cb2a17071be70a80b94db6c36e597696
Author: Nicolas Schier 
Date:   Wed Jan 14 14:57:15 2026 +0100

    fortify: Cleanup temp file also on non-successful exit
    
    Ensure cleanup of test_fortify.sh's temporary file also on script
    interruption, or some common signals.
    
    Reported-by: WangYuli 
    Closes: https://lore.kernel.org/linux-kbuild/20251112114725.287349-1-wangyuli@aosc.io/
    Reviewed-by: Nathan Chancellor 
    Reviewed-by: WangYuli 
    Signed-off-by: Nicolas Schier 
    Link: https://patch.msgid.link/20260114-fortify-improve-handling-of-tempfile-v2-2-63b86c4dbd0e@kernel.org
    Signed-off-by: Kees Cook 

commit ccfe7d6251f4e140e6ebdc87a9ecb33d86e2019e
Author: Nicolas Schier 
Date:   Wed Jan 14 14:57:14 2026 +0100

    fortify: Rename temporary file to match ignore pattern
    
    test_fortify.sh uses a temporary file that might appear as untracked
    file in some rare sitations.  Rename it to match one of top-level's
    gitignore patterns.
    
    Reported-by: WangYuli 
    Closes: https://lore.kernel.org/linux-kbuild/20251112114725.287349-1-wangyuli@aosc.io/
    Reviewed-by: Nathan Chancellor 
    Reviewed-by: WangYuli 
    Signed-off-by: Nicolas Schier 
    Link: https://patch.msgid.link/20260114-fortify-improve-handling-of-tempfile-v2-1-63b86c4dbd0e@kernel.org
    Signed-off-by: Kees Cook 

commit 995ddc58d791bb85b1b044d295e1fe4fad48ba72
Author: David Laight 
Date:   Sun Dec 14 12:58:57 2025 +0000

    fortify: Use C arithmetic not FIELD_xxx() in FORTIFY_REASON defines
    
    FIELD_GET() and FIELD_PREP() are mainly useful for hardware register
    accesses, but here they are being used for some very simple oprations.
    
    This wouldn't matter much, but they contain a lot of compile-time
    checks (that really aren't needed here) that bloat the expansion
    of FIELD_GET(GENMASK(7, 1), func) to over 18KB.
    Even with the 'bloat reduced' FIELD_GET/PREP they are still hundreds of
    characters.
    
    Replace FIELD_GET(BIT(0), r) with ((r) & 1), FIELD_GET(GENMASK(7, 1), r) with
    (r) >> 1), and (FIELD_PREP(BIT(0), write) | FIELD_PREP(GENMASK(7, 1), func))
    with ((func) << 1 | (write)).
    
    The generated code is the same, but it makes the .c file less obfuctaced,
    the .i file much easier to read, and should marginally decrease compilation
    time.
    
    Signed-off-by: David Laight 
    Link: https://patch.msgid.link/20251214125857.3308-1-david.laight.linux@gmail.com
    Signed-off-by: Kees Cook 

commit 9a403a4aea32f1801a7f29b2385ec345d4faaf78
Merge: e3d0dbb3b5e898 7c8e817e443c11
Author: Alexei Starovoitov 
Date:   Wed Jan 14 19:08:10 2026 -0800

    Merge branch 'bpf-live-registers-computation-with-gotox'
    
    Anton Protopopov says:
    
    ====================
    bpf: Live registers computation with gotox
    
    While adding a selftest for live registers computation with gotox,
    I've noticed that the code is actually incomplete. Namely, the
    destination register rX in `gotox rX` wasn't actually considered
    as used. Fix this and add a selftest.
    
    v1 -> v2:
      * only enable the new selftest on x86 and arm64
    
    v1: https://lore.kernel.org/bpf/20260114113314.32649-1-a.s.protopopov@gmail.com/T/#t
    ====================
    
    Acked-by: Eduard Zingerman 
    Link: https://patch.msgid.link/20260114162544.83253-1-a.s.protopopov@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit 7c8e817e443c118aa303f1bbcec33df8d9e3487a
Author: Anton Protopopov 
Date:   Wed Jan 14 16:25:44 2026 +0000

    selftests/bpf: Extend live regs tests with a test for gotox
    
    Add a test which checks that the destination register of a gotox
    instruction is marked as used and that the union of jump targets
    is considered as live.
    
    Signed-off-by: Anton Protopopov 
    Link: https://lore.kernel.org/r/20260114162544.83253-3-a.s.protopopov@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit d1aab1ca576c90192ba961094d51b0be6355a4d6
Author: Anton Protopopov 
Date:   Wed Jan 14 16:25:43 2026 +0000

    bpf: Properly mark live registers for indirect jumps
    
    For a `gotox rX` instruction the rX register should be marked as used
    in the compute_insn_live_regs() function. Fix this.
    
    Signed-off-by: Anton Protopopov 
    Link: https://lore.kernel.org/r/20260114162544.83253-2-a.s.protopopov@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit 571d29baa07e83e637075239f379f91353c24ec9
Author: James Clark 
Date:   Wed Jan 14 15:57:26 2026 +0000

    perf arm-spe: Don't hard code config attribute
    
    Use the config attribute that's published by the driver instead of
    hard coding "attr.config".
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 5e63706f1bc1446e40a8643d05a9842ebad4ec34
Author: James Clark 
Date:   Wed Jan 14 15:57:25 2026 +0000

    perf cs-etm: Don't hard code config attribute when configuring the event
    
    These instances of hard coded config attributes are used for configuring
    and validating the event options. Use the config attribute that's
    published by the driver by replacing the open coded operations with
    evsel__get_config_val() and evsel__set_config_if_unset().
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 3f620f26576526ccc9e5cb1164bd1cf33a7c70bd
Author: James Clark 
Date:   Wed Jan 14 15:57:24 2026 +0000

    perf cs-etm: Don't use hard coded config bits when setting up TRCCONFIGR
    
    Perf only looks at attr.config when determining what was programmed into
    TRCCONFIGR. These bits could theoretically be in any of the config
    fields. Use the evsel__get_config_val() helper so it's agnostic to
    which config field they are in.
    
    The kernel will also stop publishing the TRCCONFIGR register bits in a
    header [1] so preempt that by defining them here.
    
    [1]: https://lore.kernel.org/linux-arm-kernel/20251128-james-cs-syncfreq-v8-10-4d319764cc58@linaro.org/
    
    Reviewed-by: Ian Rogers 
    Reviewed-by: Leo Yan 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 4ffd443f5d1fc85740ac60f9ccd0200fab42f95e
Author: James Clark 
Date:   Wed Jan 14 15:57:23 2026 +0000

    perf cs-etm: Don't use hard coded config bits when setting up ETMCR
    
    Perf only looks at attr.config when determining what was programmed into
    ETMCR. These bits could theoretically be in any of the config fields.
    Add a generic helper to find the value of any named format field in any
    config field and then use it to get the attributes relevant to ETMCR.
    
    The kernel will also stop publishing the ETMCR register bits in a header
    [1] so preempt that by defining them here.
    
    Move field_prep() to util.h so we can define it along side field_get().
    Unfortunately FIELD_PREP() and FIELD_GET() from the kernel can't be used
    as they require the mask to be a compile time constant.
    
    [1]: https://lore.kernel.org/linux-arm-kernel/20251128-james-cs-syncfreq-v8-10-4d319764cc58@linaro.org/
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 4c2efb230a76d9dcdf0e4c39d1116df08312e740
Author: James Clark 
Date:   Wed Jan 14 15:57:22 2026 +0000

    perf cs-etm: Make a helper to find the Coresight evsel
    
    This pattern occurs a few times and we'll add another one later, so add
    a helper function for it.
    
    Reviewed-by: Ian Rogers 
    Reviewed-by: Leo Yan 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 8e2ef85c66dc65b61ca16be2650936387dc0d583
Author: James Clark 
Date:   Wed Jan 14 15:57:21 2026 +0000

    perf tests: Test evsel__set_config_if_unset() and config change tracking
    
    Test that evsel__set_config_if_unset() behaves as expected. This also
    tests the user config change tracking mechanism as it depends on it.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 6f87719b8ae170448348e56a82228ca39a3336a6
Author: James Clark 
Date:   Wed Jan 14 15:57:20 2026 +0000

    perf parse-events: Always track user config changes
    
    Requiring the 'pmu->perf_event_attr_init_default' callback to be set to
    track user changes is a bit of a trap to fall in. It's hard to see that
    this is required when depending on the user change tracking.
    
    It's possible to want all 0 defaults so not set it, but at the same time
    still do some programmatic setting of configs with
    evsel__set_config_if_unset(). Also if a PMU reverts to 0 defaults and
    deletes its existing callback, it will silently break existing uses of
    evsel__set_config_if_unset().
    
    One way to fix this would be to assert in evsel__set_config_if_unset()
    if the changes weren't tracked, but that would be a possibly untested
    runtime failure. Instead, always track it as it's harmless and
    simplifies testing too.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 34b4cfbe5cb03328a3330ea47dd8df00715dd627
Author: James Clark 
Date:   Wed Jan 14 15:57:19 2026 +0000

    perf evsel: Add a helper to get the value of a config field
    
    This will be used by aux PMUs to read an already written value for
    configuring their events and for also testing.
    
    Its helper perf_pmu__format_unpack() does the opposite of the existing
    pmu_format_value() so rename that one to perf_pmu__format_pack() so it's
    clear how they are related.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 87775abac8733f5a4856cd59122c6dc8c8032a13
Author: James Clark 
Date:   Wed Jan 14 15:57:18 2026 +0000

    perf evsel: apply evsel__set_config_if_unset() to all config fields
    
    Misleadingly, evsel__set_config_if_unset() only works with the config
    field and not config1, config2, etc. This is fine at the moment because
    all users of it happen to operate on bits that are in that config field.
    Fix it before there are any new users of the function which operate on
    bits in different config fields.
    
    In theory it's also possible for a driver to move an existing bit to
    another config field and this fixes that scenario too, although this
    hasn't happened yet either.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit a2441cf3a5930370aa02d14f2c90fcc4c2ba26f7
Author: James Clark 
Date:   Wed Jan 14 15:57:17 2026 +0000

    perf parse-events: Track all user changed config bits
    
    Currently we only track which bits were set by the user in attr->config.
    But all configN fields should be treated equally as they can all have
    default and user overridden values.
    
    Track them all by making get_config_chgs() generic and calling it once
    for each config value.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 5b5e01304f13a53daec000b28ba60e51b149cdf4
Author: James Clark 
Date:   Wed Jan 14 15:57:16 2026 +0000

    perf evsel: Support sparse fields in evsel__set_config_if_unset()
    
    Sparse config fields are technically supported although currently
    unused. field_prep() only works for contiguous bitfields so replace it
    with pmu_format_value().
    
    pmu_format_value() also takes a bitmap rather than a u64 so replace
    'u64 bits' with format->bits.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 11ac46060512f6ef1caedabf9a1a129157d0e8a5
Author: James Clark 
Date:   Wed Jan 14 15:57:15 2026 +0000

    perf evsel: Move evsel__* functions to evsel.c
    
    At least one of these were put here to avoid a Python binding linking
    issue which is no longer present. Put them back in their correct
    location to avoid confusion about which file to add a new evsel__*
    function to later.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Link: https://lore.kernel.org/all/ZEbAS2yx2fguW60w@kernel.org/
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 4563e23bd9e4057d6d22ae6631f9dee781fd22bd
Author: James Clark 
Date:   Wed Jan 14 15:57:14 2026 +0000

    perf evsel: Refactor evsel__set_config_if_unset() arguments
    
    Make the evsel argument first to match the other evsel__* functions
    and remove the redundant pmu argument, which can be accessed via evsel.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 159ca97cd97ce8cc65364fee37319823b5ffb5bd
Author: James Clark 
Date:   Wed Jan 14 15:57:13 2026 +0000

    perf parse-events: Refactor get_config_terms() to remove macros
    
    The ADD_CONFIG_TERM() macros build the __type argument out of a partial
    EVSEL__CONFIG_TERM_x enum name. This means that they can't be called
    from a function where __type is a variable and it's also impossible to
    grep the codebase to find usages of these enums as they're never typed
    in full.
    
    Fix this by removing the macros and replacing them with an
    add_config_term() function. It seems the main reason these existed in
    the first place was to avoid type punning and to write to a specific
    field in the union, but the same thing can be achieved with a single
    write to a u64 'val' field.
    
    Running the Perf tests with "-fsanitize=undefined -fno-sanitize-recover"
    results in no new issues as a result of this change.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Suzuki Poulouse 
    Cc: Will Deacon 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit baf4fc7c03bd0f68c768cfe27829674bd060c6b4
Author: Yao Zi 
Date:   Thu Nov 20 13:14:15 2025 +0000

    clk: thead: th1520-ap: Support CPU frequency scaling
    
    On TH1520 SoC, c910_clk feeds the CPU cluster. It could be glitchlessly
    reparented to one of the two PLLs: either to cpu_pll0 indirectly through
    c910_i0_clk, or to cpu_pll1 directly.
    
    To achieve glitchless rate change, customized clock operations are
    implemented for c910_clk: on rate change, the PLL not currently in use
    is configured to the requested rate first, then c910_clk reparents to
    it.
    
    Additionally, c910_bus_clk, which in turn takes c910_clk as parent,
    has a frequency limit of 750MHz. A clock notifier is registered on
    c910_clk to adjust c910_bus_clk on c910_clk rate change.
    
    Reviewed-by: Drew Fustini 
    Signed-off-by: Yao Zi 
    Signed-off-by: Drew Fustini 

commit 5e632c7ca9e15a1bc1e114bcfd5210add909e7a4
Author: Ping-Ke Shih 
Date:   Sat Jan 10 10:20:19 2026 +0800

    wifi: rtw89: pci: consider RTL8922D in PCI common flow
    
    Clear TX/RX ring index, PCI operating mode, SER setting, PCI LTR and
    preinit settings.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260110022019.2254969-9-pkshih@realtek.com

commit 8e47ae0786933d467ed89a803501da9e7c781325
Author: Ping-Ke Shih 
Date:   Sat Jan 10 10:20:18 2026 +0800

    wifi: rtw89: mac: consider RTL8922D in MAC common flow
    
    The MAC settings are different from RTL8922A to RTL8922D, including
    scheduler, DLE, DCPU, MLO, NAV, TMAC, TX/RX protocol, RMAC, IMR, host RPT,
    AMSDU. Update them accordingly.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260110022019.2254969-8-pkshih@realtek.com

commit aa2a44d0d22d45d659b9f01638809b1735e46cff
Author: Ping-Ke Shih 
Date:   Sat Jan 10 10:20:17 2026 +0800

    wifi: rtw89: mac: correct page number for CSI response
    
    For beamforming procedure, hardware reserve memory page for CSI response.
    The unit of register is (value - 1), so add one accordingly as expected.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260110022019.2254969-7-pkshih@realtek.com

commit 91fb4007018f5b59d810d894cc1d73c2af312f66
Author: Ping-Ke Shih 
Date:   Sat Jan 10 10:20:16 2026 +0800

    wifi: rtw89: align CUSTID defined by firmware
    
    Firmware does customized features by CUSTID, so align the ID definition
    to have expected features enabled.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260110022019.2254969-6-pkshih@realtek.com

commit 7fd36ffedeedc97c44a10249a3f12d471bb2dc26
Author: Ping-Ke Shih 
Date:   Sat Jan 10 10:20:15 2026 +0800

    wifi: rtw89: disable EHT protocol by chip capabilities
    
    For certain chip models, EHT protocol is disabled, and driver must follow
    the capabilities. Otherwise, chips become unusable.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260110022019.2254969-5-pkshih@realtek.com

commit 432b26382db2163b88db557ce91d20c18724be8a
Author: Kuan-Chung Chen 
Date:   Sat Jan 10 10:20:14 2026 +0800

    wifi: rtw89: support EHT GI/LTF setting
    
    Add support for fixed EHT GI/LTF via nl80211.
    
    The command example:
      iw wlan0 set bitrates eht-gi-6 0.8 eht-ltf-6 2
    
    Signed-off-by: Kuan-Chung Chen 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260110022019.2254969-4-pkshih@realtek.com

commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b
Author: Chin-Yen Lee 
Date:   Sat Jan 10 10:20:13 2026 +0800

    wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
    
    Some APs disconnect clients by sending a Disassociation frame
    rather than a Deauthentication frame. Since these frames use
    different reason codes in WoWLAN mode, this commit adds support
    for handling Disassociation to prevent missed disconnection events.
    
    Signed-off-by: Chin-Yen Lee 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com

commit 957eda596c7665f2966970fd1dcc35fe299b38e8
Author: Ping-Ke Shih 
Date:   Sat Jan 10 10:20:12 2026 +0800

    wifi: rtw89: pci: validate sequence number of TX release report
    
    Hardware rarely reports abnormal sequence number in TX release report,
    which will access out-of-bounds of wd_ring->pages array, causing NULL
    pointer dereference.
    
      BUG: kernel NULL pointer dereference, address: 0000000000000000
      #PF: supervisor read access in kernel mode
      #PF: error_code(0x0000) - not-present page
      PGD 0 P4D 0
      Oops: 0000 [#1] PREEMPT SMP NOPTI
      CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S   U
                 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)
      Call Trace:
       
       rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]
       rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]
       net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759
       handle_softirqs+0xbe/0x290 kernel/softirq.c:601
       ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]
       __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423
       
       
       rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]
       ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0
       irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314
       ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202
       ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220
       kthread+0xea/0x110 kernel/kthread.c:376
       ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287
       ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
       
    
    To prevent crash, validate rpp_info.seq before using.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260110022019.2254969-2-pkshih@realtek.com

commit 9e81c522680db5998c872fb91ff7877cf3d8ff42
Author: Michael Orlitzky 
Date:   Wed Jan 7 06:29:22 2026 -0500

    riscv: dts: sophgo: enable hardware clock (RTC) on the Milk-V Pioneer
    
    These boards have a working hardware clock if you put a CR-1220
    battery in them. We enable it using information from a 6.1.x vendor
    kernel.
    
    Reviewed-by: Chen Wang 
    Signed-off-by: Michael Orlitzky 
    Link: https://lore.kernel.org/r/20260107112922.20013-2-michael@orlitzky.com
    Signed-off-by: Inochi Amaoto 
    Signed-off-by: Chen Wang 
    Signed-off-by: Chen Wang 

commit e3d0dbb3b5e8983d3be780199af1e5134c8a9c17
Merge: 46c76760febfb1 c537e12daeecae
Author: Alexei Starovoitov 
Date:   Wed Jan 14 15:20:46 2026 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after rc5
    
    Cross-merge BPF and other fixes after downstream PR.
    
    No conflicts.
    
    Adjacent:
    Auto-merging MAINTAINERS
    Auto-merging Makefile
    Auto-merging kernel/bpf/verifier.c
    Auto-merging kernel/sched/ext.c
    Auto-merging mm/memcontrol.c
    
    Signed-off-by: Alexei Starovoitov 

commit 7b5073f9897f67af58b5bf17232bf60fc42e7ecd
Author: Troy Mitchell 
Date:   Fri Dec 26 16:31:59 2025 +0800

    i2c: spacemit: drop useless spaces
    
    Previously, the I2C driver had an extra leading space in column 0 of
    included header lines. This commit removes the redundant whitespace.
    
    Signed-off-by: Troy Mitchell 
    Reviewed-by: Alex Elder 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251226-k1-i2c-ilcr-v5-1-b5807b7dd0e6@linux.spacemit.com

commit cc34c669abe0c198daec20de5185c8187f4b240d
Author: Thorsten Blum 
Date:   Mon Jan 12 12:53:11 2026 +0100

    ecryptfs: Annotate struct ecryptfs_message with __counted_by
    
    Add the __counted_by() compiler attribute to the flexible array member
    'data' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and
    CONFIG_FORTIFY_SOURCE.
    
    Signed-off-by: Thorsten Blum 
    Acked-by: Tyler Hicks 
    Link: https://patch.msgid.link/20260112115314.739612-2-thorsten.blum@linux.dev
    Signed-off-by: Kees Cook 

commit 7583873c31147be9869902e3274e3faa67e06176
Author: Thorsten Blum 
Date:   Mon Jan 5 13:20:53 2026 +0100

    fs/xattr: Annotate struct simple_xattr with __counted_by
    
    Add the __counted_by() compiler attribute to the flexible array member
    'value' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and
    CONFIG_FORTIFY_SOURCE.
    
    Reviewed-by: Jan Kara 
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20260105122057.2347-2-thorsten.blum@linux.dev
    Signed-off-by: Kees Cook 

commit dacbfc16780837aa3e00c684d89492d211fd809f
Author: Thorsten Blum 
Date:   Mon Jan 5 13:24:03 2026 +0100

    crypto: af_alg - Annotate struct af_alg_iv with __counted_by
    
    Add the __counted_by() compiler attribute to the flexible array member
    'iv' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and
    CONFIG_FORTIFY_SOURCE.
    
    Reviewed-by: Simon Horman 
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20260105122402.2685-2-thorsten.blum@linux.dev
    Signed-off-by: Kees Cook 

commit e4c8b46b924eb8de66c6f0accc9cdd0c2e8fa23b
Author: Kees Cook 
Date:   Wed Dec 3 15:30:34 2025 -0800

    slab: Introduce kmalloc_flex() and family
    
    As done for kmalloc_obj*(), introduce a type-aware allocator for flexible
    arrays, which may also have "counted_by" annotations:
    
            ptr = kmalloc(struct_size(ptr, flex_member, count), gfp);
    
    becomes:
    
            ptr = kmalloc_flex(*ptr, flex_member, count, gfp);
    
    The internal use of __flex_counter() allows for automatically setting
    the counter member of a struct's flexible array member when it has
    been annotated with __counted_by(), avoiding any missed early size
    initializations while __counted_by() annotations are added to the
    kernel. Additionally, this also checks for "too large" allocations based
    on the type size of the counter variable. For example:
    
            if (count > type_max(ptr->flex_counter))
                    fail...;
            size = struct_size(ptr, flex_member, count);
            ptr = kmalloc(size, gfp);
            if (!ptr)
                    fail...;
            ptr->flex_counter = count;
    
    becomes (n.b. unchanged from earlier example):
    
            ptr = kmalloc_flex(*ptr, flex_member, count, gfp);
            if (!ptr)
                    fail...;
            ptr->flex_counter = count;
    
    Note that manual initialization of the flexible array counter is still
    required (at some point) after allocation as not all compiler versions
    support the __counted_by annotation yet. But doing it internally makes
    sure they cannot be missed when __counted_by _is_ available, meaning
    that the bounds checker will not trip due to the lack of "early enough"
    initializations that used to work before enabling the stricter bounds
    checking. For example:
    
            ptr = kmalloc_flex(*ptr, flex_member, count, gfp);
            fill(ptr->flex, count);
            ptr->flex_count = count;
    
    This works correctly before adding a __counted_by annotation (since
    nothing is checking ptr->flex accesses against ptr->flex_count). After
    adding the annotation, the bounds sanitizer would trip during fill()
    because ptr->flex_count wasn't set yet. But with kmalloc_flex() setting
    ptr->flex_count internally at allocation time, the existing code works
    without needing to move the ptr->flex_count assignment before the call
    to fill(). (This has been a stumbling block for __counted_by adoption.)
    
    Link: https://patch.msgid.link/20251203233036.3212363-4-kees@kernel.org
    Acked-by: Vlastimil Babka 
    Signed-off-by: Kees Cook 

commit 81cee9166a9073b4da28e970e75d7f89c98ed966
Author: Kees Cook 
Date:   Wed Dec 3 15:30:33 2025 -0800

    compiler_types: Introduce __flex_counter() and family
    
    Introduce __flex_counter() which wraps __builtin_counted_by_ref(),
    as newly introduced by GCC[1] and Clang[2]. Use of __flex_counter()
    allows access to the counter member of a struct's flexible array member
    when it has been annotated with __counted_by().
    
    Introduce typeof_flex_counter(), overflows_flex_counter_type(), and
    __set_flex_counter() to provide the needed _Generic() wrappers to get
    sane results out of __flex_counter().
    
    For example, with:
    
            struct foo {
                    int counter;
                    short array[] __counted_by(counter);
            } *p;
    
    __flex_counter(p->array) will resolve to: &p->counter
    
    typeof_flex_counter(p->array) will resolve to "int". (If p->array was not
    annotated, it would resolve to "size_t".)
    
    overflows_flex_counter_type(typeof(*p), array, COUNT) is the same as:
    
            COUNT <= type_max(p->counter) && COUNT >= type_min(p->counter)
    
    (If p->array was not annotated it would return true since everything
    fits in size_t.)
    
    __set_flex_counter(p->array, COUNT) is the same as:
    
            p->counter = COUNT;
    
    (It is a no-op if p->array is not annotated with __counted_by().)
    
    Link: https://patch.msgid.link/20251203233036.3212363-3-kees@kernel.org
    Signed-off-by: Kees Cook 

commit 070580b0b1740a4b930f367d21fdb5b253a8b3fb
Author: Kees Cook 
Date:   Wed Dec 3 15:30:32 2025 -0800

    checkpatch: Suggest kmalloc_obj family for sizeof allocations
    
    To support shifting away from sized allocation towards typed
    allocations, suggest the kmalloc_obj family of macros when a sizeof() is
    present in the argument lists.
    
    Link: https://patch.msgid.link/20251203233036.3212363-2-kees@kernel.org
    Signed-off-by: Kees Cook 

commit 2932ba8d9c99875b98c951d9d3fd6d651d35df3a
Author: Kees Cook 
Date:   Wed Dec 3 15:30:31 2025 -0800

    slab: Introduce kmalloc_obj() and family
    
    Introduce type-aware kmalloc-family helpers to replace the common
    idioms for single object and arrays of objects allocation:
    
            ptr = kmalloc(sizeof(*ptr), gfp);
            ptr = kmalloc(sizeof(struct some_obj_name), gfp);
            ptr = kzalloc(sizeof(*ptr), gfp);
            ptr = kmalloc_array(count, sizeof(*ptr), gfp);
            ptr = kcalloc(count, sizeof(*ptr), gfp);
    
    These become, respectively:
    
            ptr = kmalloc_obj(*ptr, gfp);
            ptr = kmalloc_obj(*ptr, gfp);
            ptr = kzalloc_obj(*ptr, gfp);
            ptr = kmalloc_objs(*ptr, count, gfp);
            ptr = kzalloc_objs(*ptr, count, gfp);
    
    Beyond the other benefits outlined below, the primary ergonomic benefit
    is the elimination of needing "sizeof" nor the type name, and the
    enforcement of assignment types (they do not return "void *", but rather
    a pointer to the type of the first argument). The type name _can_ be
    used, though, in the case where an assignment is indirect (e.g. via
    "return"). This additionally allows[1] variables to be declared via
    __auto_type:
    
            __auto_type ptr = kmalloc_obj(struct foo, gfp);
    
    Internal introspection of the allocated type now becomes possible,
    allowing for future alignment-aware choices to be made by the allocator
    and future hardening work that can be type sensitive. For example,
    adding __alignof(*ptr) as an argument to the internal allocators so that
    appropriate/efficient alignment choices can be made, or being able to
    correctly choose per-allocation offset randomization within a bucket
    that does not break alignment requirements.
    
    Link: https://lore.kernel.org/all/CAHk-=wiCOTW5UftUrAnvJkr6769D29tF7Of79gUjdQHS_TkF5A@mail.gmail.com/ [1]
    Acked-by: Vlastimil Babka 
    Link: https://patch.msgid.link/20251203233036.3212363-1-kees@kernel.org
    Signed-off-by: Kees Cook 

commit 3bd4edd67b034f8e1f61c86e0eb098de6179e3f2
Author: Haotian Zhang 
Date:   Mon Nov 24 18:48:05 2025 +0800

    hwspinlock: omap: Handle devm_pm_runtime_enable() errors
    
    Although unlikely, devm_pm_runtime_enable() can fail due to memory
    allocations. Without proper error handling, the subsequent
    pm_runtime_resume_and_get() call may operate on incorrectly
    initialized runtime PM state.
    
    Add error handling to check the return value of
    devm_pm_runtime_enable() and return on failure.
    
    Fixes: 25f7d74d4514 ("hwspinlock: omap: Use devm_pm_runtime_enable() helper")
    Signed-off-by: Haotian Zhang 
    Link: https://patch.msgid.link/20251124104805.135-1-vulab@iscas.ac.cn
    Signed-off-by: Kevin Hilman 

commit 5e2d6fa48a841e419848a811a015f61128a149ce
Author: Johan Hovold 
Date:   Fri Dec 19 12:02:59 2025 +0100

    bus: omap-ocp2scp: enable compile testing
    
    There seems to be nothing preventing the driver from being compile
    tested so enable that for wider build coverage.
    
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251219110259.23630-1-johan@kernel.org
    Signed-off-by: Kevin Hilman 

commit 5eb63e9bb65d88abde647ced50fe6ad40c11de1a
Author: Johan Hovold 
Date:   Fri Dec 19 12:01:19 2025 +0100

    bus: omap-ocp2scp: fix OF populate on driver rebind
    
    Since commit c6e126de43e7 ("of: Keep track of populated platform
    devices") child devices will not be created by of_platform_populate()
    if the devices had previously been deregistered individually so that the
    OF_POPULATED flag is still set in the corresponding OF nodes.
    
    Switch to using of_platform_depopulate() instead of open coding so that
    the child devices are created if the driver is rebound.
    
    Fixes: c6e126de43e7 ("of: Keep track of populated platform devices")
    Cc: stable@vger.kernel.org      # 3.16
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251219110119.23507-1-johan@kernel.org
    Signed-off-by: Kevin Hilman 

commit 2c3b8260d1a0d9a388f2d30e3bbe50d93edfa2aa
Author: Krzysztof Kozlowski 
Date:   Mon Dec 29 15:28:07 2025 +0100

    arm64: dts: qcom: sm6125-ginkgo: Fix missing msm-id subtype
    
    qcom,msm-id property must consist of two numbers, where the second
    number is the subtype, as reported by dtbs_check:
    
      sm6125-xiaomi-ginkgo.dtb: / (xiaomi,ginkgo): qcom,msm-id:0: [394] is too short
    
    Xiaomi vendor DTS for Trinket IDP and QRD boards uses value of 0x10000,
    so put it here as well.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251229142806.241088-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit ccef4b2703ff5b0de0b1bda30a0de3026d52eb19
Author: Dmitry Baryshkov 
Date:   Sat Jan 10 21:37:53 2026 +0200

    soc: qcom: ubwc: add missing include
    
    The header has a function which calls pr_err(). Don't require users of
    the header to include  and include it here.
    
    Fixes: 87cfc79dcd60 ("drm/msm/a6xx: Resolve the meaning of UBWC_MODE")
    Signed-off-by: Dmitry Baryshkov 
    Reviewed-by: Bryan O'Donoghue 
    Link: https://lore.kernel.org/r/20260110-iris-ubwc-v1-1-dd70494dcd7b@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 55058e32151f95dc5badd62381d184e89f15de99
Author: Yosry Ahmed 
Date:   Sat Jan 10 00:48:20 2026 +0000

    KVM: selftests: Add a selftests for nested VMLOAD/VMSAVE
    
    Add a test for VMLOAD/VMSAVE in an L2 guest. The test verifies that L1
    intercepts for VMSAVE/VMLOAD always work regardless of
    VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK.
    
    Then, more interestingly, it makes sure that when L1 does not intercept
    VMLOAD/VMSAVE, they work as intended in L2. When
    VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK is enabled by L1, VMSAVE/VMLOAD from
    L2 should interpret the GPA as an L2 GPA and translate it through the
    NPT. When VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK is disabled by L1,
    VMSAVE/VMLOAD from L2 should interpret the GPA as an L1 GPA.
    
    To test this, put two VMCBs (0 and 1) in L1's physical address space,
    and have a single L2 GPA where:
    - L2 VMCB GPA == L1 VMCB(0) GPA
    - L2 VMCB GPA maps to L1 VMCB(1) via the NPT in L1.
    
    This setup allows detecting how the GPA is interpreted based on which L1
    VMCB is actually accessed.
    
    In both cases, L2 sets KERNEL_GS_BASE (one of the fields handled by
    VMSAVE/VMLOAD), and executes VMSAVE to write its value to the VMCB. The
    test userspace code then checks that the write was made to the correct
    VMCB (based on whether VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK is set by L1),
    and writes a new value to that VMCB. L2 then executes VMLOAD to load the
    new value and makes sure it's reflected correctly in KERNERL_GS_BASE.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20260110004821.3411245-4-yosry.ahmed@linux.dev
    Signed-off-by: Sean Christopherson 

commit 55780d8a1dcc93d2c4b33c565ada88df12c9f206
Author: Yosry Ahmed 
Date:   Sat Jan 10 00:48:19 2026 +0000

    KVM: SVM: Stop toggling virtual VMSAVE/VMLOAD on intercept recalc
    
    Virtual VMSAVE/VMLOAD enablement (i.e.
    VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK) is set/cleared by
    svm_recalc_instruction_intercepts() when the intercepts are cleared/set.
    This is unnecessary because the bit is meaningless when intercepts are
    set and KVM emulates the instructions. Initialize the bit in vmcb01 base
    on vls, and keep it unchanged.
    
    This is similar-ish to how vGIF is handled. It is enabled in init_vmcb()
    if vgif=1 and remains unchanged when the STGI intercept is enabled (e.g.
    for NMI windows).
    
    This fixes a bug in svm_recalc_instruction_intercepts(). The intercepts
    for VMSAVE/VMLOAD are always toggled in vmcb01, but
    VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK is toggled in the current VMCB, which
    could be vmcb02 instead of vmcb01 if L2 is active.
    
    Virtual VMSAVE/VMLOAD enablement in vmcb02 is separately controlled by
    nested_vmcb02_prepare_control() based on the vCPU features and VMCB12,
    and if intercepts are needed they are set by recalc_intercepts().
    
    The bug is benign though. Not toggling the bit for vmcb01 is harmless
    because it's useless anyway. For vmcb02:
    
    - The bit could be incorrectly cleared when intercepts are set in
      vmcb01. This is harmless because VMSAVE/VMLOAD will be emulated by KVM
      anyway.
    
    - The bit could be incorrectly set when the intercepts are cleared in
      vmcb01. However, if the bit was originally clear in vmcb02, then
      recalc_intercepts() will enable in the intercepts in vmcb02 anyway and
      VMSAVE/VMLOAD will be emulated by KVM.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20260110004821.3411245-3-yosry.ahmed@linux.dev
    Signed-off-by: Sean Christopherson 

commit 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619
Author: Yosry Ahmed 
Date:   Sat Jan 10 00:48:18 2026 +0000

    KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
    
    Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload
    of guest state") made KVM always use vmcb01 for the fields controlled by
    VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code
    to always use vmcb01.
    
    As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not
    intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01
    instead of the current VMCB.
    
    Fixes: cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state")
    Cc: Maxim Levitsky 
    Cc: stable@vger.kernel.org
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20260110004821.3411245-2-yosry.ahmed@linux.dev
    Signed-off-by: Sean Christopherson 

commit ea64aa57d596c4cbe518ffd043c52ef64089708d
Author: Paul Moore 
Date:   Wed Jan 14 16:23:47 2026 -0500

    selinux: drop the BUG() in cred_has_capability()
    
    With the compile time check located immediately above the
    cred_has_capability() function ensuring that we will notice if the
    capability set grows beyond 63 capabilities, we can safely remove
    the BUG() call from the cred_has_capability().
    
    Signed-off-by: Paul Moore 

commit 379b749add7eff1d1e9fdd53206e1ec5e7cd2266
Author: Thomas Weißschuh 
Date:   Tue Jan 13 08:29:58 2026 +0100

    kbuild: Drop superfluous compiler option checks
    
    Many of the compiler option checks are not necessary anymore with the
    current supported versions of compilers (clang 15+, GCC 8.1+).
    
    Remove them.
    
    Signed-off-by: Thomas Weißschuh 
    Link: https://patch.msgid.link/20260113-kbuild-cc-option-v1-1-011314a0f7f1@weissschuh.net
    [nathan: Add minor note about currently supported compilers]
    Signed-off-by: Nathan Chancellor 

commit 6c8512a5b7f44caf981cee4ffa2a4ac73e627732
Author: Hou Wenlong 
Date:   Tue Jan 13 19:56:50 2026 +0800

    KVM: VMX: Don't register posted interrupt wakeup handler if alloc_kvm_area() fails
    
    Unregistering the posted interrupt wakeup handler only happens during
    hardware unsetup. Therefore, if alloc_kvm_area() fails and continue to
    register the posted interrupt wakeup handler, this will leave the global
    posted interrupt wakeup handler pointer in an incorrect state. Although
    it should not be an issue, it's still better to change it.
    
    Signed-off-by: Hou Wenlong 
    Fixes: ec5a4919fa7b ("KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup")
    Link: https://patch.msgid.link/0ac6908b608cf80eab7437004334fedd0f5f5317.1768304590.git.houwenlong.hwl@antgroup.com
    [sean: use a goto]
    Signed-off-by: Sean Christopherson 

commit b07b6f0c5d27fafb12ae98d889ae944d308fe9f6
Author: Paul Moore 
Date:   Wed Jan 14 16:00:14 2026 -0500

    selinux: fix a capabilities parsing typo in selinux_bpf_token_capable()
    
    There was a typo, likely a cut-n-paste bug, where we were checking for
    SECCLASS_CAPABILITY instead of SECCLASS_CAPABILITY2.
    
    Fixes: 5473a722f782 ("selinux: add support for BPF token access control")
    Reported-by: Christian Göttsche 
    Signed-off-by: Paul Moore 

commit bac74dcbd48b5b441e47841fd0fe507c7b0bcbaf
Author: Ian Rogers 
Date:   Wed Nov 19 15:36:21 2025 -0800

    perf tools: Switch printf("...%s", strerror(errno)) to printf("...%m")
    
    strerror() has thread safety issues, strerror_r() requires stack
    allocated buffers.
    
    Code in perf has already been using the "%m" formatting flag that is a
    widely support glibc extension to print the current errno's description.
    
    Expand the usage of this formatting flag and remove usage of
    strerror()/strerror_r().
    
    Signed-off-by: Ian Rogers 
    Acked-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Alexandre Ghiti 
    Cc: Blake Jones 
    Cc: Chun-Tse Shao 
    Cc: Dmitriy Vyukov 
    Cc: Dr. David Alan Gilbert 
    Cc: Haibo Xu 
    Cc: Howard Chu 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Leo Yan 
    Cc: Peter Zijlstra 
    Cc: Stephen Brennan 
    Cc: Thomas Falcon 
    Cc: Yunseong Kim 
    Cc: Zhongqiu Han 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 47d3545faeeb6822f404ddb237985e1824a8bd70
Author: Ian Rogers 
Date:   Thu Dec 4 13:11:43 2025 -0800

    perf help: Move common_cmds into builtin-help
    
    There's a lot of infrastructure for generating a relatively simple
    array used by one function.
    
    Move the array into the function and remove the supporting build logic.
    
    At the same time opportunistically const-ify the array.
    
    Signed-off-by: Ian Rogers 
    Acked-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Charlie Jenkins 
    Cc: Howard Chu 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit d0a3df886d777180322a254176c40fd4a4a23cbe
Author: Sandipan Das 
Date:   Thu Jan 8 13:22:16 2026 +0530

    perf vendor events amd: Add Zen 6 metrics
    
    Add metrics taken from Section 1.2 "Performance Measurement" of the
    Performance Monitor Counters for AMD Family 1Ah Model 50h-57h Processors
    document available at the link below.
    
    The recommended metrics are sourced from Table 1 "Guidance for Common
    Performance Statistics with Complex Event Selects".
    
    The pipeline utilization metrics are sourced from Table 2 "Guidance
    for Pipeline Utilization Analysis Statistics". These are useful for
    finding performance bottlenecks by analyzing activity at different
    stages of the pipeline. There are metric groups available for Level 1
    and Level 2 analysis.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Sandipan Das 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ananth Narayan 
    Cc: Caleb Biggers 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Kan Liang 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Ravi Bangoria 
    Cc: Stephane Eranian 
    Link: https://bugzilla.kernel.org/attachment.cgi?id=309149
    Signed-off-by: Arnaldo Carvalho de Melo 

commit de18394f8f69e4cb86e1561f3dd86e9f724b8f25
Author: Sandipan Das 
Date:   Thu Jan 8 13:22:15 2026 +0530

    perf vendor events amd: Add Zen 6 uncore events
    
    Add uncore events taken from Section 1.6 "L3 Cache Performance Monitor
    Counters" and Section 2.2 "UMC Performance Monitor Events" of the
    Performance Monitor Counters for AMD Family 1Ah Model 50h-57h Processors
    document available at the link below.
    
    This constitutes events which capture L3 cache and UMC command activity.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Sandipan Das 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ananth Narayan 
    Cc: Caleb Biggers 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Kan Liang 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Ravi Bangoria 
    Cc: Stephane Eranian 
    Link: https://bugzilla.kernel.org/attachment.cgi?id=309149
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 2f42fb0661d9a979800a506b6a91dc3a7d1fb162
Author: Sandipan Das 
Date:   Thu Jan 8 13:22:14 2026 +0530

    perf vendor events amd: Add Zen 6 core events
    
    Add core events taken from Section 1.5 "Core Performance Monitor
    Counters" of the Performance Monitor Counters for AMD Family 1Ah Model
    50h-57h Processors document available at the link below.
    
    This constitutes events which capture information on op dispatch,
    execution and retirement, branch prediction, L1 and L2 cache activity,
    TLB activity, etc.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Sandipan Das 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ananth Narayan 
    Cc: Caleb Biggers 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Kan Liang 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Ravi Bangoria 
    Cc: Stephane Eranian 
    Link: https://bugzilla.kernel.org/attachment.cgi?id=309149
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 2c3cd43d27c1148fae05b50870f970ab24464fd5
Author: Sandipan Das 
Date:   Thu Jan 8 13:22:17 2026 +0530

    perf vendor events amd: Add Zen 6 mapping
    
    Add a regular expression in the map file so that appropriate JSON event
    files are used for AMD Zen 6 processors. Restrict the regular expression
    for AMD Zen 5 processors to known model ranges since they also belong to
    Family 1Ah.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Sandipan Das 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ananth Narayan 
    Cc: Caleb Biggers 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Kan Liang 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Ravi Bangoria 
    Cc: Stephane Eranian 
    [ Moved this one to the front of the series to keep the tree bisectable, as per Ian Rogers suggestion ]
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 240156b25a397d3b26ef95b3f13bddb2db6038ab
Author: Manuel Hernández Méndez 
Date:   Thu Dec 4 16:40:38 2025 +0000

    perf vendor events riscv: Add CVA6 JSON file
    
    This patch add the OpenHW Core-V CVA6 Risc-V JSON file.
    
    For more info:
    
    https://openhwfoundation.org/news/2023/11/07/openhw-group-announces-core-v-cva6-platform-project-for-risc-v-software-development-and-testing/
    
    Signed-off-by: Manuel Hernández Méndez 
    Reviewed-by: Ian Rogers 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 57aa7735a536adfdf4a0e535a95a2ed3e34c7c9a
Merge: 32bc4e7dde407b 8a98e7f55f9753
Author: Mark Brown 
Date:   Wed Jan 14 20:11:26 2026 +0000

    sound: codecs: tlv320adcx140: assorted patches
    
    Merge series from Sascha Hauer :
    
    These are some patches for the tlv320adcx140 codec we are carrying
    around for a while, time to upstream them.

commit 32bc4e7dde407b7c2287915bfcb30c84e8e6ad46
Merge: 6e22f08989f9be da7afdc79cba00
Author: Mark Brown 
Date:   Wed Jan 14 20:11:22 2026 +0000

    SDCA System Suspend Support
    
    Merge series from Charles Keepax :
    
    Add support for system suspend into the class driver, now split
    out into a separate patch series.
    
    Where we got to on the previous discussion, was we don't currently
    have any parts requiring download on runtime resume, doing so
    will add noticeable delay to the runtime resume, and we are not
    blocking someone from adding support for firmware download on
    runtime resume in the future. Also as runtime resume is really
    a kernel concept and power rails are primarily controlled by
    ACPI it is quite unlikely anyone will actually power down the
    part on a runtime suspend anyway. So this version of the chain
    still only downloads firmware on probe and system resume.

commit 6e22f08989f9bebd9c0c5e982165164e75091e7f
Merge: 10303b32519f52 519d0a6b2ca5a8
Author: Mark Brown 
Date:   Wed Jan 14 20:11:17 2026 +0000

    ASoC: codecs: aw88261: add dvdd-supply property
    
    Merge series from Bharadwaj Raju :
    
    The AW88261 has a DVDD chip which needs to be powered on for it to
    function correctly. The property for this was missing, so this patchset
    adds the dvdd-supply property which enables a regulator to be bound
    to it in a device tree.

commit 6a681cd9034587fe3550868bacfbd639d1c6891f
Author: Ivan Lipski 
Date:   Tue Jan 13 17:29:59 2026 -0500

    drm/amd/display: Add an hdmi_hpd_debounce_delay_ms module
    
    [Why&How]
    Right now, the HDMI HPD filter is enabled by default at 1500ms.
    
    We want to disable it by default, as most modern displays with HDMI do
    not require it for DPMS mode.
    
    The HPD can instead be enabled as a driver parameter with a custom delay
    value in ms (up to 5000ms).
    
    Fixes: c918e75e1ed9 ("drm/amd/display: Add an HPD filter for HDMI")
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4859
    Signed-off-by: Ivan Lipski 
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Alex Deucher 

commit 0cba5b27f1924e9248b096fc746a1210be9c32c8
Author: Philip Yang 
Date:   Wed Nov 26 14:35:11 2025 -0500

    drm/amdkfd: Add domain parameter to alloc kernel BO
    
    To allocate kernel BO from VRAM domain for MQD in the following patch.
    No functional change because kernel BO allocate all from GTT domain.
    
    Rename amdgpu_amdkfd_alloc_gtt_mem to amdgpu_amdkfd_alloc_kernel_mem
    Rename amdgpu_amdkfd_free_gtt_mem to amdgpu_amdkfd_free_kernel_mem
    Rename mem_kfd_mem_obj gtt_mem to mem
    
    Signed-off-by: Philip Yang 
    Reviewed-by: Kent Russell 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 8e051e38a8d45caf6a866d4ff842105b577953bb
Author: Srinivasan Shanmugam 
Date:   Wed Jan 14 16:14:53 2026 +0530

    drm/amdgpu/userq: Fix fence reference leak on queue teardown v2
    
    The user mode queue keeps a pointer to the most recent fence in
    userq->last_fence. This pointer holds an extra dma_fence reference.
    
    When the queue is destroyed, we free the fence driver and its xarray,
    but we forgot to drop the last_fence reference.
    
    Because of the missing dma_fence_put(), the last fence object can stay
    alive when the driver unloads. This leaves an allocated object in the
    amdgpu_userq_fence slab cache and triggers
    
    This is visible during driver unload as:
    
      BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()
      kmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects
      Call Trace:
        kmem_cache_destroy
        amdgpu_userq_fence_slab_fini
        amdgpu_exit
        __do_sys_delete_module
    
    Fix this by putting userq->last_fence and clearing the pointer during
    amdgpu_userq_fence_driver_free().
    
    This makes sure the fence reference is released and the slab cache is
    empty when the module exits.
    
    v2: Update to only release userq->last_fence with dma_fence_put()
        (Christian)
    
    Fixes: edc762a51c71 ("drm/amdgpu/userq: move some code around")
    Cc: Alex Deucher 
    Cc: Christian König 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 3fd20580b96a6e9da65b94ac3b58ee288239b731
Author: Harish Kasiviswanathan 
Date:   Sun Jan 11 16:53:18 2026 -0500

    drm/amdkfd: No need to suspend whole MES to evict process
    
    Each queue of the process is individually removed and there is not need
    to suspend whole mes. Suspending mes stops kernel mode queues also
    causing unnecessary timeouts when running mixed work loads
    
    Fixes: 079ae5118e1f ("drm/amdkfd: fix suspend/resume all calls in mes based eviction path")
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4765
    Signed-off-by: Harish Kasiviswanathan 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit e921a5f7875da8e82cd8857269bdf60541f7a517
Author: Lijo Lazar 
Date:   Mon Jan 12 18:22:58 2026 +0530

    drm/amd/pm: Deprecate print_clk_levels callback
    
    Use emit_clk_levels instead. Also, remove the unused helper function for
    getting sysfs buffer offset.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 22d6d1b5868665fa10de94d310ae77bd809eb5e9
Author: Lijo Lazar 
Date:   Mon Jan 12 18:19:48 2026 +0530

    drm/amd/pm: Use emit clock levels in SMU v15.0.0
    
    print_clk_levels is no longer used, use emit_clk_levels instead.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 9163fe4d790fb4e16d6b0e23f55b43cddd3d4a65
Author: Prike Liang 
Date:   Fri Jan 9 16:15:11 2026 +0800

    Revert "drm/amdgpu: don't attach the tlb fence for SI"
    
    This reverts commit 820b3d376e8a102c6aeab737ec6edebbbb710e04.
    
    It’s better to validate VM TLB flushes in the flush‑TLB backend
    rather than in the generic VM layer.
    
    Reverting this patch depends on
    commit fa7c231fc2b0 ("drm/amdgpu: validate the flush_gpu_tlb_pasid()")
    being present in the tree.
    
    Signed-off-by: Prike Liang 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit f4db9913e4d3dabe9ff3ea6178f2c1bc286012b8
Author: Prike Liang 
Date:   Tue Jan 6 17:00:57 2026 +0800

    drm/amdgpu: validate the flush_gpu_tlb_pasid()
    
    Validate flush_gpu_tlb_pasid() availability before flushing tlb.
    
    Signed-off-by: Prike Liang 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit bcd600ab7f2e8ebf7eb5b6ab28dd479341c389e0
Author: Lang Yu 
Date:   Wed Dec 17 11:01:39 2025 +0800

    drm/amdkfd: Switch to using GC VERSION to decide LDS/Scratch base
    
    Next generation GC IP with 4-level page table needs to use the
    same LDS/Scratch base with 5-level page table, use GC VERSION
    to decide is more appropriate.
    
    Signed-off-by: Lang Yu 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit e3a03d0ae16d6b56e893cce8e52b44140e1ed985
Author: Yang Wang 
Date:   Tue Jan 6 14:42:40 2026 +0800

    drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2
    
    resolving the issue of incorrect type definitions potentially causing calculation errors.
    
    Fixes: 54f7f3ca982a ("drm/amdgpu/swm14: Update power limit logic")
    Signed-off-by: Yang Wang 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 6cca686dfce79bf5bd5c1a680ed38a9f20669e39
Author: Xiaogang Chen 
Date:   Tue Jan 13 20:45:14 2026 -0600

    drm/amdkfd: kfd driver supports hot unplug/replug amdgpu devices
    
    This patch allows kfd driver function correctly when AMD gpu devices got
    unplug/replug at run time.
    
    When an AMD gpu device got unplug kfd driver gracefully terminates existing
    kfd processes after stops all queues by sending SIGBUS to user process. After
    that user space can still use remaining AMD gpu devices. When all AMD gpu
    devices at system got removed kfd driver will not response new requests.
    
    Unplugged AMD gpu devices can be re-plugged. kfd driver will use added devices
    to function as usual.
    
    The purpose of this patch is having kfd driver behavior as expected during and
    after AMD gpu devices unplug/replug at run time.
    
    Signed-off-by: Xiaogang Chen 
    Acked-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit d81e52fc61fb98dc98f9fdb166ab21f502cb701c
Author: Yang Wang 
Date:   Mon Jan 12 17:48:26 2026 +0800

    drm/amd/pm: fix issue of missing '*' on pp_dpm_xxx nodes
    
    refine the code to fix '*' missing on pp_dpm_xxx series node.
    
    e.g.: missing '*' on navi10 pp_dpm_sclk
    $ cat /sys/class/drm/card0/device/pp_dpm_sclk
    0: 300Mhz
    1: 1930Mhz (missing symbol '*')
    
    Fixes: a08ea4bc7711 ("drm/amd/pm: Add a helper to show dpm table")
    Signed-off-by: Yang Wang 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 6c160001661b6c4e20f5c31909c722741e14c2d8
Author: Donet Tom 
Date:   Mon Jan 12 19:36:56 2026 +0530

    drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
    
    In svm_migrate_gart_map(), while migrating GART mapping, the number of
    bytes copied for the GART table only accounts for CPU pages. On non-4K
    systems, each CPU page can contain multiple GPU pages, and the GART
    requires one 8-byte PTE per GPU page. As a result, an incorrect size was
    passed to the DMA, causing only a partial update of the GART table.
    
    Fix this function to work correctly on non-4K page-size systems by
    accounting for the number of GPU pages per CPU page when calculating the
    number of bytes to be copied.
    
    Acked-by: Christian König 
    Reviewed-by: Philip Yang 
    Signed-off-by: Ritesh Harjani (IBM) 
    Signed-off-by: Donet Tom 
    Signed-off-by: Felix Kuehling 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit fb361a520a5861368c6c36717ff1900a35dde093
Author: Donet Tom 
Date:   Mon Jan 12 19:36:55 2026 +0530

    drm/amdkfd: Fix SVM map/unmap address conversion for non-4k page sizes
    
    SVM range size is tracked using the system page size. The range start and
    end are aligned to system page-sized PFNs, so the total SVM range size
    equals the total number of pages in the SVM range multiplied by the system
    page size.
    
    The SVM range map/unmap functions pass these system page-sized PFN numbers
    to amdgpu_vm_update_range(), which expects PFNs based on the GPU page size
    (4K). On non-4K page systems, this mismatch causes only part of the SVM
    range to be mapped in the GPU page table, while the rest remains unmapped.
    If the GPU accesses an unmapped address within the same range, it results
    in a GPU page fault.
    
    To fix this, the required conversion has been added in both
    svm_range_map_to_gpu() and svm_range_unmap_from_gpu(), ensuring that all
    pages in the SVM range are correctly mapped on non-4K systems.
    
    Acked-by: Christian König 
    Reviewed-by: Philip Yang 
    Signed-off-by: Ritesh Harjani (IBM) 
    Signed-off-by: Donet Tom 
    Signed-off-by: Felix Kuehling 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 42ea9cf2f16b7131cb7302acb3dac510968f8bdc
Author: Donet Tom 
Date:   Mon Jan 12 19:36:54 2026 +0530

    drm/amdkfd: Relax size checking during queue buffer get
    
    HW-supported EOP buffer sizes are 4K and 32K. On systems that do not
    use 4K pages, the minimum buffer object (BO) allocation size is
    PAGE_SIZE (for example, 64K). During queue buffer acquisition, the driver
    currently checks the allocated BO size against the supported EOP buffer
    size. Since the allocated BO is larger than the expected size, this check
    fails, preventing queue creation.
    
    Relax the strict size validation and allow PAGE_SIZE-sized BOs to be used.
    Only the required 4K region of the buffer will be used as the EOP buffer
    and avoids queue creation failures on non-4K page systems.
    
    Acked-by: Christian König 
    Suggested-by: Philip Yang 
    Signed-off-by: Donet Tom 
    Signed-off-by: Felix Kuehling 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 318b1c36d82a0cd2b06a4bb43272fa6f1bc8adc1
Author: Vivek Das Mohapatra 
Date:   Mon Jan 12 15:28:56 2026 +0000

    drm/amd/display: Initialise backlight level values from hw
    
    Internal backlight levels are initialised from ACPI but the values
    are sometimes out of sync with the levels in effect until there has
    been a read from hardware (eg triggered by reading from sysfs).
    
    This means that the first drm_commit can cause the levels to be set
    to a different value than the actual starting one, which results in
    a sudden change in brightness.
    
    This path shows the problem (when the values are out of sync):
    
       amdgpu_dm_atomic_commit_tail()
       -> amdgpu_dm_commit_streams()
       -> amdgpu_dm_backlight_set_level(..., dm->brightness[n])
    
    This patch calls the backlight ops get_brightness explicitly
    at the end of backlight registration to make sure dm->brightness[n]
    is in sync with the actual hardware levels.
    
    Fixes: 2fe87f54abdc ("drm/amd/display: Set default brightness according to ACPI")
    Signed-off-by: Vivek Das Mohapatra 
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Alex Deucher 

commit b36178488d479e9a53bbef2b01280378b5586e60
Author: Lizhi Hou 
Date:   Tue Jan 13 09:36:24 2026 -0800

    accel/amdxdna: Fix notifier_wq flushing warning
    
    Create notifier_wq with WQ_MEM_RECLAIM flag to fix the possible warning.
    
      workqueue: WQ_MEM_RECLAIM amdxdna_js:drm_sched_free_job_work [gpu_sched] is flushing !WQ_MEM_RECLAIM notifier_wq:0x0
    
    Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
    Reviewed-by: Mario Limonciello (AMD) 
    Reviewed-by: Maciej Falkowski 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20260113173624.256053-1-lizhi.hou@amd.com

commit 83014d82a1100abc89f7712ad67c3e5accaddc43
Author: Alistair Popple 
Date:   Mon Jan 12 11:54:40 2026 +1100

    PCI/P2PDMA: Reset page reference count when page mapping fails
    
    When mapping a p2pdma page the page reference count is initialised to 1
    prior to calling vm_insert_page(). This is to avoid vm_insert_page()
    warning if the page refcount is zero. Prior to setting the page count there
    is a check to ensure the page is currently free (ie. has a zero reference
    count).
    
    However vm_insert_page() can fail. In this case the pages are freed back to
    the genalloc pool, but that does not reset the page refcount.  So a future
    allocation of the same page will see the elevated page refcount from the
    previous set_page_count() call triggering the VM_WARN_ON_ONCE_PAGE checking
    that the page is free.
    
    Fix this by resetting the page refcount to zero using set_page_count().
    Note that put_page() is not used because that would result in freeing the
    page twice due to implicitly calling p2pdma_folio_free().
    
    Fixes: b7e282378773 ("mm/mm_init: move p2pdma page refcount initialisation to p2pdma")
    Signed-off-by: Alistair Popple 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Logan Gunthorpe 
    Acked-by: Balbir Singh 
    Link: https://patch.msgid.link/20260112005440.998543-1-apopple@nvidia.com

commit f00ccdede3c84df2287e59b546fd92d58b7e07af
Author: Yosry Ahmed 
Date:   Tue Jan 13 17:28:07 2026 +0000

    KVM: nSVM: Drop redundant/wrong comment in nested_vmcb02_prepare_save()
    
    The comment above DR6 and DR7 initializations is redundant, because the
    entire function follows the same pattern of only initializing the fields
    in vmcb02 if the vmcb12 changed or the fields are dirty, which handles
    the first execution case.
    
    Also, the comment refers to new_vmcb12 as new_vmcs12. Just drop the
    comment.
    
    No functional change intended.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20260113172807.2178526-1-yosry.ahmed@linux.dev
    Signed-off-by: Sean Christopherson 

commit 61acc4428a7f52e0a13e226ba76f2ce2ca66c065
Author: Abhash Kumar Jha 
Date:   Mon Jan 12 14:21:13 2026 +0530

    arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4
    
    Each A72 core has one watchdog instance associated with it. Since j742s2
    has 4 A72 cores, the common file should not define 8 watchdog instances.
    
    Refactor the last 4 extra watchdogs from the common file to j784s4
    specific file, as j784s4 has 8 A72 cores and thus hardware description
    requires 8 watchdog instances.
    
    Fixes: 9cc161a4509c ("arm64: dts: ti: Refactor J784s4 SoC files to a common file")
    Signed-off-by: Abhash Kumar Jha 
    Reviewed-by: Udit Kumar 
    Link: https://patch.msgid.link/20260112085113.3476193-3-a-kumar2@ti.com
    Signed-off-by: Nishanth Menon 

commit f756ed82c62aa2725757ac011710492d4cc8c7d8
Author: Yosry Ahmed 
Date:   Tue Jan 13 17:14:56 2026 +0000

    KVM: selftests: Slightly simplify memstress_setup_nested()
    
    Instead of calling memstress_setup_ept_mappings() only in the first
    iteration in the loop, move it before the loop.
    
    The call needed to happen within the loop before commit e40e72fec0de
    ("KVM: selftests: Stop passing VMX metadata to TDP mapping functions"),
    as memstress_setup_ept_mappings() used to take in a pointer to vmx_pages
    and pass it into tdp_identity_map_1g() (to get the EPT root GPA). This
    is no longer the case, as tdp_identity_map_1g() gets the EPT root
    through stage2 MMU.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20260113171456.2097312-1-yosry.ahmed@linux.dev
    Signed-off-by: Sean Christopherson 

commit 24c9d5fb8bbf5e8c9e6fc2beffeb80ac2da83de4
Author: Abhash Kumar Jha 
Date:   Mon Jan 12 14:21:12 2026 +0530

    arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order
    
    The device tree nodes should be ordered by unit addresses in ascending
    order.
    
    Correct the order by moving the c71_3 DSP node at the end as it has a
    higher unit address.
    
    Signed-off-by: Abhash Kumar Jha 
    Reviewed-by: Udit Kumar 
    Link: https://patch.msgid.link/20260112085113.3476193-2-a-kumar2@ti.com
    Signed-off-by: Nishanth Menon 

commit 319fff9c7d620af83d8ab67050a54f63f16ae4e8
Author: Vitor Soares 
Date:   Mon Jan 12 17:53:47 2026 +0000

    arm64: dts: ti: k3-am69-aquila-clover: Change main_spi2 CS0 to GPIO mode
    
    Change CS0 from hardware chip select to GPIO-based chip select to
    align with the base aquila device tree configuration.
    
    Fixes: 9f748a6177e1 ("arm64: dts: ti: am69-aquila: Add Clover")
    Cc: stable@vger.kernel.org
    Signed-off-by: Vitor Soares 
    Reviewed-by: Francesco Dolcini 
    Link: https://patch.msgid.link/20260112175350.79270-3-ivitro@gmail.com
    Signed-off-by: Nishanth Menon 

commit 78a123f45a7e9ac2a59f0eff8a37d31773e7a021
Author: Vitor Soares 
Date:   Mon Jan 12 17:53:46 2026 +0000

    arm64: dts: ti: k3-am69-aquila: Change main_spi0/2 CS to GPIO mode
    
    Hardware chip select does not work correctly on main_spi0 and
    main_spi2 controllers. Testing shows main_spi2 loses CS state
    during runtime PM suspend, while main_spi0 cannot drive CS HIGH
    when bus is idle.
    
    Use GPIO-based chip select for both controllers.
    
    Fixes: 39ac6623b1d8 ("arm64: dts: ti: Add Aquila AM69 Support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Vitor Soares 
    Reviewed-by: Francesco Dolcini 
    Link: https://patch.msgid.link/20260112175350.79270-2-ivitro@gmail.com
    Signed-off-by: Nishanth Menon 

commit 80db65d4acfb9ff12d00172aed39ea8b98261aad
Author: Wentao Liang 
Date:   Tue Jan 13 01:47:16 2026 +0000

    soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
    
    In the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly
    calls pruss_of_free_clk_provider(), which calls of_node_put(clk_mux_np)
    on the error path. However, after the devm_add_action_or_reset()
    returns, the of_node_put(clk_mux_np) is called again, causing a double
    free.
    
    Fix by returning directly, to avoid the duplicate of_node_put().
    
    Fixes: ba59c9b43c86 ("soc: ti: pruss: support CORECLK_MUX and IEPCLK_MUX")
    Cc: stable@vger.kernel.org
    Signed-off-by: Wentao Liang 
    Link: https://patch.msgid.link/20260113014716.2464741-1-vulab@iscas.ac.cn
    Signed-off-by: Nishanth Menon 

commit 94cf23f6b7c3d6551af513b5f3ddba7838312494
Author: Philipp Stanner 
Date:   Thu Dec 18 10:28:20 2025 +0100

    PCI: Remove useless WARN_ON() from devres
    
    PCI's devres implementation contains a WARN_ON() which served to inform
    users relying on the legacy devres iomap table that this table does not
    support multiple mappings per BAR.
    
    The WARN_ON() can be regarded as useless by now, since mapping a BAR
    multiple times is legal behavior and old users of pcim_iomap_table(), the
    accessor function for that table, did not break in the past PCI devres
    cleanup. New PCI users will hopefully notice that pcim_iomap_table() is
    deprecated and are unlikely to use it for mapping the same BAR multiple
    times.
    
    Moreover, WARN_ON()s create noisy, difficult to read error messages which
    can be more confusing than helpful, since they don't inform the user about
    what precisely the problem is.
    
    Remove the WARN_ON().
    
    Reported-by: Guenter Roeck 
    Signed-off-by: Philipp Stanner 
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20251218092819.149665-2-phasta@kernel.org

commit c933138d45176780fabbbe7da263e04d5b3e525d
Author: Johan Hovold 
Date:   Thu Nov 27 14:49:42 2025 +0100

    soc: ti: k3-socinfo: Fix regmap leak on probe failure
    
    The mmio regmap allocated during probe is never freed.
    
    Switch to using the device managed allocator so that the regmap is
    released on probe failures (e.g. probe deferral) and on driver unbind.
    
    Fixes: a5caf03188e4 ("soc: ti: k3-socinfo: Do not use syscon helper to build regmap")
    Cc: stable@vger.kernel.org      # 6.15
    Cc: Andrew Davis 
    Signed-off-by: Johan Hovold 
    Acked-by: Andrew Davis 
    Link: https://patch.msgid.link/20251127134942.2121-1-johan@kernel.org
    Signed-off-by: Nishanth Menon 

commit 3fec51b89d603f2d8ebf50f815b5e159efc381da
Author: Johan Hovold 
Date:   Thu Nov 27 14:54:54 2025 +0100

    soc: ti: k3-socinfo: Fix compile testing
    
    There seems to be nothing preventing this driver from being compile
    tested so enable that by adding the missing input prompt.
    
    Fixes: 907a2b7e2fc7 ("soc: ti: add k3 platforms chipid module driver")
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251127135455.2497-1-johan@kernel.org
    Signed-off-by: Nishanth Menon 

commit 9be35201579c8b96071cc49bfd382a0036de1d87
Author: Huisong Li 
Date:   Tue Nov 25 14:47:02 2025 +0800

    ACPI: processor: idle: Add debug log for states with invalid entry methods
    
    According to ACPI spec, entry method in LPI sub-package must be a
    buffer or an integer.
    
    The driver will disable the state whose the entry method is invalid
    by zeroing flags in struct acpi_lpi_state.
    
    The entry method is very key in cpuidle. A debug log is very useful
    for developers.
    
    Signed-off-by: Huisong Li 
    Reviewed-by: Jonathan Cameron 
    [ rjw: Subject and changelog edits, changed "illegal" to "invalid" ]
    Link: https://patch.msgid.link/20251125064702.3666149-1-lihuisong@huawei.com
    Signed-off-by: Rafael J. Wysocki 

commit 62171369cf17794ddd88f602c2c84d008ecafcff
Author: Aadityarangan Shridhar Iyengar 
Date:   Sun Jan 11 22:06:50 2026 +0530

    PCI/PTM: Fix pcie_ptm_create_debugfs() memory leak
    
    In pcie_ptm_create_debugfs(), if devm_kasprintf() fails after successfully
    allocating ptm_debugfs with kzalloc(), the function returns without freeing
    the allocated memory, resulting in a memory leak.
    
    Free ptm_debugfs before returning in the devm_kasprintf() error path and in
    pcie_ptm_destroy_debugfs().
    
    Fixes: 132833405e61 ("PCI: Add debugfs support for exposing PTM context")
    Signed-off-by: Aadityarangan Shridhar Iyengar 
    [bhelgaas: squash additional fix from Mani:
    https://lore.kernel.org/r/pdp4xc4d5ee3e547mmdro5riui3mclduqdl7j6iclfbozo2a4c@7m3qdm6yrhuv]
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20260111163650.33168-1-adiyenga@cisco.com

commit f132e089fe89cadc2098991f0a3cb05c3f824ac6
Author: Tuo Li 
Date:   Mon Jan 12 00:32:14 2026 +0800

    ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()
    
    In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
    device and then reassigned an ISA device:
    
      dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
      dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
    
    If the first lookup succeeds but the second fails, dev becomes NULL. This
    leads to a potential null-pointer dereference when dev_dbg() is called:
    
      if (errata.piix4.bmisx)
        dev_dbg(&dev->dev, ...);
    
    To prevent this, use two temporary pointers and retrieve each device
    independently, avoiding overwriting dev with a possible NULL value.
    
    Signed-off-by: Tuo Li 
    [ rjw: Subject adjustment, added an empty code line ]
    Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit ba6ded26dffe511b862a98a25955955e7154bfa8
Author: Ai Chao 
Date:   Tue Jan 13 15:27:19 2026 +0800

    ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
    
    Like the JWIPC JVC9100 has its serial IRQ (10 and 11) described
    as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which
    breaks the serial.
    
    irq 10, level, active-low, shared, skip-override
    irq 11, level, active-low, shared, skip-override
    
    Add the JVC9100 to the irq1_level_low_skip_override[] quirk table to fix
    this.
    
    Signed-off-by: Ai Chao 
    Link: https://patch.msgid.link/20260113072719.4154485-1-aichao@kylinos.cn
    Signed-off-by: Rafael J. Wysocki 

commit 95cb1935168ab8f637bd0bf64b9ec6f5667d1d8e
Author: Adrian Hunter 
Date:   Tue Jan 13 09:27:02 2026 +0200

    i3c: mipi-i3c-hci-pci: Add Runtime PM support
    
    Enable Runtime PM for the mipi_i3c_hci_pci driver. Introduce helpers to
    allow and forbid Runtime PM during probe and remove, using pm_runtime APIs.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-22-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit b9a15012a14520b2b006ecb770f32eb9a57d4b8b
Author: Adrian Hunter 
Date:   Tue Jan 13 09:27:01 2026 +0200

    i3c: mipi-i3c-hci: Add optional Runtime PM support
    
    Implement optional Runtime PM support for the MIPI I3C HCI driver.
    Introduce runtime suspend and resume callbacks to manage bus state and
    restore hardware configuration after resume.  Optionally enable autosuspend
    with a default delay of 1 second, and add helper functions to control
    Runtime PM during probe and remove.
    
    Read quirks from i3c_hci_driver_ids[] and set new quirk
    HCI_QUIRK_RPM_ALLOWED for intel-lpss-i3c devices to enable runtime PM for
    them.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-21-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 990c149c61ee45da4fb6372e6b2fdd9808414e7a
Author: Adrian Hunter 
Date:   Tue Jan 13 09:27:00 2026 +0200

    i3c: master: Introduce optional Runtime PM support
    
    Master drivers currently manage Runtime PM individually, but all require
    runtime resume for bus operations.  This can be centralized in common code.
    
    Add optional Runtime PM support to ensure the parent device is runtime
    resumed before bus operations and auto-suspended afterward.
    
    Notably, do not call ->bus_cleanup() if runtime resume fails.  Master
    drivers that opt-in to core runtime PM support must take that into account.
    
    Also provide an option to allow IBIs and hot-joins while runtime suspended.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-20-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 3c3de6803a7d90faba0387ba248ac71e627ca827
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:59 2026 +0200

    i3c: mipi-i3c-hci: Factor out master dynamic address setting into helper
    
    Prepare for future reuse.  Move master dynamic address setting logic from
    i3c_hci_bus_init() into a dedicated helper function,
    i3c_hci_set_master_dyn_addr().
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-19-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit f2b5d43c93e0a642f7bba970dbc5a24c9605ecd3
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:58 2026 +0200

    i3c: mipi-i3c-hci: Allow core re-initialization for Runtime PM support
    
    Prepare i3c_hci_reset_and_init() to support runtime resume.  Update it to
    handle the case where the I/O mode has already been selected.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-18-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 7f91e0e6aa3f1e6e461dd5f95b5bcc3567abfa51
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:57 2026 +0200

    i3c: mipi-i3c-hci: Factor out core initialization into helper
    
    Prepare for future reuse.  Move core initialization logic from
    i3c_hci_init() into a dedicated helper function,
    i3c_hci_reset_and_init().
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-17-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit e4269df518d62527ff6a8f3cd4740d754c4257cd
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:56 2026 +0200

    i3c: mipi-i3c-hci: Factor out IO mode setting into helper
    
    Prepare for future reuse.  Move the IO mode setting logic from
    i3c_hci_init() into a dedicated helper function, i3c_hci_set_io_mode().
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-16-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 57a2f976ac18b909e43cca51a63be26cbd62ab88
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:55 2026 +0200

    i3c: mipi-i3c-hci: Factor out software reset into helper
    
    Prepare for future reuse of the reset sequence in other contexts, such as
    power management.  Move the software reset logic from i3c_hci_init() into a
    dedicated helper function, i3c_hci_software_reset().
    
    Software reset should never fail.  Print an error message if it does.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-15-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 8afa0dd83b608a344b967dc1ef1b4f282662416d
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:54 2026 +0200

    i3c: mipi-i3c-hci: Add PIO suspend and resume support
    
    Introduce helper functions to suspend and resume PIO operations.  These
    are required to prepare for upcoming Runtime PM support, ensuring that
    PIO state is properly managed during power transitions.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-14-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit ca4d4682d353bf4e7e5db7b025e9ecd80bc67b27
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:53 2026 +0200

    i3c: mipi-i3c-hci: Refactor PIO register initialization
    
    Move the PIO register setup logic out of hci_pio_init() into a new
    helper, __hci_pio_init().  This refactoring prepares for Runtime PM
    support by allowing PIO registers to be reinitialized independently
    after resume.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-13-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 8169587204431ce23df9522c2e859b5238934c42
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:52 2026 +0200

    i3c: mipi-i3c-hci: Add DMA suspend and resume support
    
    Introduce helper functions to suspend and resume DMA operations.  These
    are required to prepare for upcoming Runtime PM support, ensuring that
    DMA state is properly managed during power transitions.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-12-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit f5401c973e7f08cdd921c62079ac2514a9b69397
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:51 2026 +0200

    i3c: mipi-i3c-hci: Extract ring initialization from hci_dma_init()
    
    Split the ring setup logic out of hci_dma_init() into a new helper
    hci_dma_init_rings().  This refactoring prepares for Runtime PM support
    by allowing DMA rings to be reinitialized independently after resume.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-11-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit f180524a4877329bca4285e36f1fad63b70577ea
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:50 2026 +0200

    i3c: mipi-i3c-hci: Introduce helper to restore DAT
    
    Add a dedicated function to restore the Device Address Table (DAT) in
    preparation for Runtime PM support.  This will allow reprogramming the DAT
    after the controller resumes from a low-power state.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-10-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit a372cfac056abb555d6c70c08af548aea0ab5cde
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:49 2026 +0200

    i3c: mipi-i3c-hci: Cache DAT in memory for Runtime PM restore
    
    Prepare for Runtime PM support, which requires restoring the Device Address
    Table (DAT) registers after resume.  Maintain a copy of DAT in memory so it
    can be reprogrammed when the controller is powered back up.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-9-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 29bf98a6346ad7a80136ba58116c2a0f8a3cb03f
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:48 2026 +0200

    i3c: mipi-i3c-hci: Manage DMA deallocation via devres action
    
    The driver already uses devres for resource management, but the standard
    resource-managed DMA allocation helpers cannot be used because they assume
    the DMA device matches the managed device.
    
    To address this, factor out the deallocation logic from hci_dma_cleanup()
    into a new helper, hci_dma_free(), and register it as a devres action.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-8-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 11d17c2855bfc04550557017eae02e92f3eeab1c
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:47 2026 +0200

    i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
    
    The driver already uses managed resources, so convert the PIO data
    structure allocation to devm_zalloc().  Remove the manual kfree().
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-7-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit f64c1a46ea7c40bbab57a0cb1665a1c1e11da6af
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:46 2026 +0200

    i3c: mipi-i3c-hci: Switch DAT bitmap allocation to devm_bitmap_zalloc()
    
    The driver already uses managed resources, so convert the Device Address
    Table (DAT) bitmap allocation to use devm_bitmap_zalloc().  Remove the
    manual cleanup routine.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-6-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 471895799c2f46688792e175ced936ffeb6cdf01
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:45 2026 +0200

    i3c: master: Replace WARN_ON() with dev_err() in i3c_dev_free_ibi_locked()
    
    IBI disable failures are not indicative of a software bug, so using
    WARN_ON() is not appropriate.  Replace these warnings with dev_err().
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-5-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit f0775157b9f9a28ae3eabc8d05b0bc52e8056c80
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:44 2026 +0200

    i3c: master: Update hot-join flag only on success
    
    To prevent inconsistent state when an error occurs, ensure the hot-join
    flag is updated only when enabling or disabling hot-join succeeds.
    
    Fixes: 317bacf960a48 ("i3c: master: add enable(disable) hot join in sys entry")
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-4-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 8bb96575883d3b201ce37046b3903ea1d2d50bbc
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:43 2026 +0200

    i3c: mipi-i3c-hci: Ensure proper bus clean-up
    
    Wait for the bus to fully disable before proceeding, ensuring that no
    operations are still in progress.  Synchronize the IRQ handler only after
    interrupt signals have been disabled.  This approach also handles cases
    where bus disable might fail, preventing race conditions and ensuring a
    consistent shutdown sequence.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-3-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 78f63ae4a82db173f93adca462e63d11ba06b126
Author: Adrian Hunter 
Date:   Tue Jan 13 09:26:42 2026 +0200

    i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
    
    The MIPI I3C HCI specification does not define reset values for
    RING_OPERATION1 fields, and some controllers (e.g., Intel) do not clear
    them during a software reset.  Ensure the ring pointers are explicitly
    set to zero during bus initialization to avoid inconsistent state.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260113072702.16268-2-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit f97f020075e83d05695d3f86469d50e21eccffab
Merge: 8f0b4cce4481fb 6c91c776a92315
Author: Christian Brauner 
Date:   Wed Jan 14 17:17:53 2026 +0100

    Merge patch series "btrfs: stop duplicating VFS code for subvolume/snapshot dentry"
    
    Filipe Manana  says:
    
    Currently btrfs has copies of two unexported functions from fs/namei.c
    used in the snapshot/subvolume creation and deletion. This patchset
    exports those functions and makes btrfs use them, to avoid duplication
    and the burden of keeping the copies up to date.
    
    * patches from https://patch.msgid.link/cover.1768307858.git.fdmanana@suse.com:
      btrfs: use may_create_dentry() in btrfs_mksubvol()
      btrfs: use may_delete_dentry() in btrfs_ioctl_snap_destroy()
      fs: export may_create() as may_create_dentry()
      fs: export may_delete() as may_delete_dentry()
    
    Link: https://patch.msgid.link/cover.1768307858.git.fdmanana@suse.com
    Signed-off-by: Christian Brauner 

commit 6c91c776a92315a02e020fd558c5319864f1f104
Author: Filipe Manana 
Date:   Tue Jan 13 12:39:53 2026 +0000

    btrfs: use may_create_dentry() in btrfs_mksubvol()
    
    There is no longer the need to use btrfs_may_create(), which was a copy
    of the VFS private function may_create(), since now that functionality
    is exported by the VFS as a function named may_create_dentry(). So change
    btrfs_mksubvol() to use the VFS function and remove btrfs_may_create().
    
    Note that the btrfs copy was missing an audit_inode_child() call that we
    have in the VFS function. This only reinforces the need to use a common
    function, as it's very easy for the btrfs copy to get out of sync and
    therefore a maintenance burden.
    
    Signed-off-by: Filipe Manana 
    Link: https://patch.msgid.link/adf8c802c77ec1c855ea9fe12491120ccc29a294.1768307858.git.fdmanana@suse.com
    Reviewed-by: David Sterba 
    Signed-off-by: Christian Brauner 

commit 5f84a1092dee7b2687804d71c0dd50edd6f2d32a
Author: Filipe Manana 
Date:   Tue Jan 13 12:39:52 2026 +0000

    btrfs: use may_delete_dentry() in btrfs_ioctl_snap_destroy()
    
    There is no longer the need to use btrfs_may_delete(), which was a copy
    of the VFS private function may_delete(), since now that functionality
    is exported by the VFS as a function named may_delete_dentry(). In fact
    our local copy of may_delete() lacks an update that happened to that
    function which is point number 7 in that function's comment:
    
      "7. If the victim has an unknown uid or gid we can't change the inode."
    
    which corresponds to this code:
    
            /* Inode writeback is not safe when the uid or gid are invalid. */
            if (!vfsuid_valid(i_uid_into_vfsuid(idmap, inode)) ||
                !vfsgid_valid(i_gid_into_vfsgid(idmap, inode)))
                    return -EOVERFLOW;
    
    As long as we keep a separate copy, duplicating code, we are also prone
    to updates to the VFS being missed in our local copy.
    
    So change btrfs_ioctl_snap_destroy() to use the VFS function and remove
    btrfs_may_delete().
    
    Signed-off-by: Filipe Manana 
    Link: https://patch.msgid.link/46b13dc5c957deb72a7f085916757a20878a8e73.1768307858.git.fdmanana@suse.com
    Reviewed-by: David Sterba 
    Signed-off-by: Christian Brauner 

commit 26aab3a485d500cb89ef7340797982bd066f63a5
Author: Filipe Manana 
Date:   Tue Jan 13 12:39:51 2026 +0000

    fs: export may_create() as may_create_dentry()
    
    For many years btrfs as been using a copy of may_create() in
    fs/btrfs/ioctl.c:btrfs_may_create(). Everytime may_create() is updated we
    need to update the btrfs copy, and this is a maintenance burden. Currently
    there are minor differences between both because the btrfs side lacks
    updates done in may_create().
    
    Export may_create() so that btrfs can use it and with the less generic
    name may_create_dentry().
    
    Signed-off-by: Filipe Manana 
    Link: https://patch.msgid.link/ce5174bca079f4cdcbb8dd145f0924feb1f227cd.1768307858.git.fdmanana@suse.com
    Reviewed-by: David Sterba 
    Signed-off-by: Christian Brauner 

commit 173e937552432db9406f04eb7905541b774ac7cd
Author: Filipe Manana 
Date:   Tue Jan 13 12:39:50 2026 +0000

    fs: export may_delete() as may_delete_dentry()
    
    For many years btrfs as been using a copy of may_delete() in
    fs/btrfs/ioctl.c:btrfs_may_delete(). Everytime may_delete() is updated we
    need to update the btrfs copy, and this is a maintenance burden. Currently
    there are minor differences between both because the btrfs side lacks
    updates done in may_delete().
    
    Export may_delete() so that btrfs can use it and with the less generic
    name may_delete_dentry(). While at it change the calls in vfs_rmdir() to
    pass a boolean literal instead of 1 and 0 as the last argument since the
    argument has a bool type.
    
    Signed-off-by: Filipe Manana 
    Link: https://patch.msgid.link/e09128fd53f01b19d0a58f0e7d24739f79f47f6d.1768307858.git.fdmanana@suse.com
    Reviewed-by: David Sterba 
    Signed-off-by: Christian Brauner 

commit 8567b5733715e959474851dbec666aafcdba86e8
Author: Kartik Rajput 
Date:   Wed Jan 14 13:53:06 2026 +0530

    ACPI: bus: Align acpi_device_get_match_data() with driver match order
    
    During pre-production development, drivers may provide both ACPI and OF
    match tables while a formal ACPI HID for the device is not yet
    allocated. Such devices are enumerated via PRP0001. In this case,
    acpi_device_get_match_data() consults only the driver’s ACPI match table
    and returns NULL, even though the device was successfully matched via
    PRP0001.
    
    This behavior also risks breaking existing PRP0001 setups if a driver
    later gains an ACPI HID, as the presence of an ACPI match table changes
    the match-data lookup path.
    
    Make acpi_device_get_match_data() use the same precedence as driver
    matching by using __acpi_match_device(). Return match data from the
    acpi_id or of_id that was actually matched.
    
    Remove now-unused acpi_of_device_get_match_data().
    
    Signed-off-by: Kartik Rajput 
    Reviewed-by: Andy Shevchenko 
    Reviewed-by: Sakari Ailus 
    Link: https://patch.msgid.link/20260114082306.48119-1-kkartik@nvidia.com
    Signed-off-by: Rafael J. Wysocki 

commit 95350effc3ad62582411f59fd08a7621ac82f314
Author: Fabio M. De Francesco 
Date:   Wed Jan 14 11:14:25 2026 +0100

    ACPI: extlog: Trace CPER CXL Protocol Error Section
    
    When Firmware First is enabled, BIOS handles errors first and then it
    makes them available to the kernel via the Common Platform Error Record
    (CPER) sections (UEFI 2.11 Appendix N.2.13). Linux parses the CPER
    sections via one of two similar paths, either ELOG or GHES. The errors
    managed by ELOG are signaled to the BIOS by the I/O Machine Check
    Architecture (I/O MCA).
    
    Currently, ELOG and GHES show some inconsistencies in how they report to
    userspace via trace events.
    
    Therefore, make the two mentioned paths act similarly by tracing the CPER
    CXL Protocol Error Section.
    
    Reviewed-by: Dave Jiang 
    Reviewed-by: Jonathan Cameron 
    Reviewed-by: Kuppuswamy Sathyanarayanan 
    Signed-off-by: Fabio M. De Francesco 
    Link: https://patch.msgid.link/20260114101543.85926-6-fabio.m.de.francesco@linux.intel.com
    Signed-off-by: Rafael J. Wysocki 

commit ba8af8e1f1de32f14c98bd4a7da8b270284ffce3
Author: Fabio M. De Francesco 
Date:   Wed Jan 14 11:14:24 2026 +0100

    ACPI: APEI: GHES: Add helper to copy CPER CXL protocol error info to work struct
    
    Make a helper out of cxl_cper_post_prot_err() that checks the CXL agent
    type and copy the CPER CXL protocol errors information to a work data
    structure.
    
    Export the new symbol for reuse by ELOG.
    
    Reviewed-by: Dave Jiang 
    Reviewed-by: Jonathan Cameron 
    Reviewed-by: Hanjun Guo 
    Signed-off-by: Fabio M. De Francesco 
    [ rjw: Subject tweak ]
    Link: https://patch.msgid.link/20260114101543.85926-5-fabio.m.de.francesco@linux.intel.com
    Signed-off-by: Rafael J. Wysocki 

commit 70205869686212eb8e4cddf02bf87fd5fd597bc2
Author: Fabio M. De Francesco 
Date:   Wed Jan 14 11:14:23 2026 +0100

    ACPI: APEI: GHES: Add helper for CPER CXL protocol errors checks
    
    Move the CPER CXL protocol errors validity check out of
    cxl_cper_post_prot_err() to new cxl_cper_sec_prot_err_valid() and limit
    the serial number check only to CXL agents that are CXL devices (UEFI
    v2.10, Appendix N.2.13).
    
    Export the new symbol for reuse by ELOG.
    
    Reviewed-by: Dave Jiang 
    Reviewed-by: Hanjun Guo 
    Reviewed-by: Jonathan Cameron 
    Signed-off-by: Fabio M. De Francesco 
    [ rjw: Subject tweak ]
    Link: https://patch.msgid.link/20260114101543.85926-4-fabio.m.de.francesco@linux.intel.com
    Signed-off-by: Rafael J. Wysocki 

commit e778ffefa34ddcdc32a260452627e390941812eb
Author: Fabio M. De Francesco 
Date:   Wed Jan 14 11:14:22 2026 +0100

    ACPI: extlog: Trace CPER PCI Express Error Section
    
    I/O Machine Check Architecture events may signal failing PCIe components
    or links. The AER event contains details on what was happening on the wire
    when the error was signaled.
    
    Trace the CPER PCIe Error section (UEFI v2.11, Appendix N.2.7) reported
    by the I/O MCA.
    
    Reviewed-by: Dave Jiang 
    Reviewed-by: Jonathan Cameron 
    Signed-off-by: Fabio M. De Francesco 
    Link: https://patch.msgid.link/20260114101543.85926-3-fabio.m.de.francesco@linux.intel.com
    Signed-off-by: Rafael J. Wysocki 

commit a2995f7dab51bc0cfabd750f9848a5ee7612099d
Author: Fabio M. De Francesco 
Date:   Wed Jan 14 11:14:21 2026 +0100

    ACPI: extlog: Trace CPER Non-standard Section Body
    
    ghes_do_proc() has a catch-all for unknown or unhandled CPER formats
    (UEFI v2.11 Appendix N 2.3), extlog_print() does not. This gap was
    noticed by a RAS test that injected CXL protocol errors which were
    notified to extlog_print() via the IOMCA (I/O Machine Check
    Architecture) mechanism. Bring parity to the extlog_print() path by
    including a similar log_non_standard_event().
    
    Reviewed-by: Dan Williams 
    Reviewed-by: Dave Jiang 
    Reviewed-by: Jonathan Cameron 
    Reviewed-by: Kuppuswamy Sathyanarayanan 
    Reviewed-by: Qiuxu Zhuo 
    Reviewed-by: Shuai Xue 
    Signed-off-by: Fabio M. De Francesco 
    Link: https://patch.msgid.link/20260114101543.85926-2-fabio.m.de.francesco@linux.intel.com
    Signed-off-by: Rafael J. Wysocki 

commit 88ec797c468097a8ce97694ed11ea9c982598ec0
Author: Mateusz Guzik 
Date:   Wed Jan 14 10:47:16 2026 +0100

    fs: make insert_inode_locked() wait for inode destruction
    
    This is the only routine which instead skipped instead of waiting.
    
    The current behavior is arguably a bug as it results in a corner case
    where the inode hash can have *two* matching inodes, one of which is on
    its way out.
    
    Ironing out this difference is an incremental step towards sanitizing
    the API.
    
    Signed-off-by: Mateusz Guzik 
    Link: https://patch.msgid.link/20260114094717.236202-1-mjguzik@gmail.com
    Signed-off-by: Christian Brauner 

commit aaf76839616a3cff7bfff6a888e1762bc1d0c235
Author: David Disseldorp 
Date:   Thu Jan 15 00:50:52 2026 +1100

    initramfs_test: kunit test for cpio.filesize > PATH_MAX
    
    initramfs unpack skips over cpio entries where namesize > PATH_MAX,
    instead of returning an error. Add coverage for this behaviour.
    
    Signed-off-by: David Disseldorp 
    Link: https://patch.msgid.link/20260114135051.4943-2-ddiss@suse.de
    Signed-off-by: Christian Brauner 

commit b73cf7eaa6ee77f030667531245e1635c1b6fc9a
Author: Shuai Xue 
Date:   Mon Jan 12 11:22:39 2026 +0800

    ACPI: APEI: GHES: Improve ghes_notify_sea() status check
    
    Performance testing on ARMv8 systems shows significant overhead in error
    status handling in SEA error handling.
    
    - ghes_peek_estatus(): 8,138.3 ns (21,160 cycles).
    - ghes_clear_estatus(): 2,038.3 ns (5,300 cycles).
    
    Apply the same optimization used in ghes_notify_nmi() to
    ghes_notify_sea() by checking for active errors before processing,
    
    Tested-by: Tony Luck 
    Reviewed-by: Tony Luck 
    Signed-off-by: Shuai Xue 
    Reviewed-by: Hanjun Guo 
    Link: https://patch.msgid.link/20260112032239.30023-4-xueshuai@linux.alibaba.com
    Signed-off-by: Rafael J. Wysocki 

commit feb2d38013ddfc8ea4b53134d194582dc1e4de2c
Author: Shuai Xue 
Date:   Mon Jan 12 11:22:38 2026 +0800

    ACPI: APEI: GHES: Extract helper functions for error status handling
    
    Refactors the GHES driver by extracting common functionality into
    reusable helper functions:
    
    1. ghes_has_active_errors() - Checks if any error sources in a given list
       have active errors
    2. ghes_map_error_status() - Maps error status address to virtual address
    3. ghes_unmap_error_status() - Unmaps error status virtual address
    4. Use `guard(rcu)()` instead of explicit `rcu_read_lock()`/`rcu_read_unlock()`.
    
    These helpers eliminate code duplication in the NMI path and prepare for
    similar usage in the SEA path in a subsequent patch.
    
    No functional change intended.
    
    Tested-by: Tony Luck 
    Reviewed-by: Tony Luck 
    Signed-off-by: Shuai Xue 
    Reviewed-by: Breno Leitao 
    Reviewed-by: Hanjun Guo 
    Link: https://patch.msgid.link/20260112032239.30023-3-xueshuai@linux.alibaba.com
    Signed-off-by: Rafael J. Wysocki 

commit f2edc1fb9c81b7b57a092204455e4d159a10873e
Author: Tony Luck 
Date:   Mon Jan 12 11:22:37 2026 +0800

    ACPI: APEI: GHES: Improve ghes_notify_nmi() status check
    
    ghes_notify_nmi() is called for every NMI and must check whether the NMI was
    generated because an error was signalled by platform firmware.
    
    This check is very expensive as for each registered GHES NMI source it reads
    from the acpi generic address attached to this error source to get the physical
    address of the acpi_hest_generic_status block.  It then checks the "block_status"
    to see if an error was logged.
    
    The ACPI/APEI code must create virtual mappings for each of those physical
    addresses, and tear them down afterwards. On an Icelake system this takes around
    15,000 TSC cycles. Enough to disturb efforts to profile system performance.
    
    If that were not bad enough, there are some atomic accesses in the code path
    that will cause cache line bounces between CPUs. A problem that gets worse as
    the core count increases.
    
    But BIOS changes neither the acpi generic address nor the physical address of
    the acpi_hest_generic_status block. So this walk can be done once when the NMI is
    registered to save the virtual address (unmapping if the NMI is ever unregistered).
    The "block_status" can be checked directly in the NMI handler. This can be done
    without any atomic accesses.
    
    Resulting time to check that there is not an error record is around 900 cycles.
    
    Reported-by: Andi Kleen 
    Signed-off-by: Tony Luck 
    Tested-by: Tony Luck 
    Signed-off-by: Shuai Xue 
    Reviewed-by: Hanjun Guo 
    Link: https://patch.msgid.link/20260112032239.30023-2-xueshuai@linux.alibaba.com
    Signed-off-by: Rafael J. Wysocki 

commit 55cc6fe5716f678f06bcb95140882dfa684464ec
Author: Mauro Carvalho Chehab 
Date:   Thu Jan 8 12:35:06 2026 +0100

    EFI/CPER: don't dump the entire memory region
    
    The current logic at cper_print_fw_err() doesn't check if the
    error record length is big enough to handle offset. On a bad firmware,
    if the ofset is above the actual record, length -= offset will
    underflow, making it dump the entire memory.
    
    The end result can be:
    
     - the logic taking a lot of time dumping large regions of memory;
     - data disclosure due to the memory dumps;
     - an OOPS, if it tries to dump an unmapped memory region.
    
    Fix it by checking if the section length is too small before doing
    a hex dump.
    
    Signed-off-by: Mauro Carvalho Chehab 
    Reviewed-by: Jonathan Cameron 
    Acked-by: Ard Biesheuvel 
    Reviewed-by: Hanjun Guo 
    [ rjw: Subject tweaks ]
    Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
    Signed-off-by: Rafael J. Wysocki 

commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4
Author: Mauro Carvalho Chehab 
Date:   Thu Jan 8 12:35:05 2026 +0100

    APEI/GHES: ensure that won't go past CPER allocated record
    
    The logic at ghes_new() prevents allocating too large records, by
    checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
    Yet, the allocation is done with the actual number of pages from the
    CPER bios table location, which can be smaller.
    
    Yet, a bad firmware could send data with a different size, which might
    be bigger than the allocated memory, causing an OOPS:
    
        Unable to handle kernel paging request at virtual address fff00000f9b40000
        Mem abort info:
          ESR = 0x0000000096000007
          EC = 0x25: DABT (current EL), IL = 32 bits
          SET = 0, FnV = 0
          EA = 0, S1PTW = 0
          FSC = 0x07: level 3 translation fault
        Data abort info:
          ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
          CM = 0, WnR = 0, TnD = 0, TagAccess = 0
          GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
        swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
        [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
        Internal error: Oops: 0000000096000007 [#1]  SMP
        Modules linked in:
        CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
        Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
        Workqueue: kacpi_notify acpi_os_execute_deferred
        pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
        pc : hex_dump_to_buffer+0x30c/0x4a0
        lr : hex_dump_to_buffer+0x328/0x4a0
        sp : ffff800080e13880
        x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
        x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
        x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
        x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
        x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
        x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
        x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
        x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
        x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
        x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
        Call trace:
         hex_dump_to_buffer+0x30c/0x4a0 (P)
         print_hex_dump+0xac/0x170
         cper_estatus_print_section+0x90c/0x968
         cper_estatus_print+0xf0/0x158
         __ghes_print_estatus+0xa0/0x148
         ghes_proc+0x1bc/0x220
         ghes_notify_hed+0x5c/0xb8
         notifier_call_chain+0x78/0x148
         blocking_notifier_call_chain+0x4c/0x80
         acpi_hed_notify+0x28/0x40
         acpi_ev_notify_dispatch+0x50/0x80
         acpi_os_execute_deferred+0x24/0x48
         process_one_work+0x15c/0x3b0
         worker_thread+0x2d0/0x400
         kthread+0x148/0x228
         ret_from_fork+0x10/0x20
        Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
        ---[ end trace 0000000000000000 ]---
    
    Prevent that by taking the actual allocated are into account when
    checking for CPER length.
    
    Signed-off-by: Mauro Carvalho Chehab 
    Reviewed-by: Jonathan Cameron 
    Acked-by: Ard Biesheuvel 
    Reviewed-by: Hanjun Guo 
    [ rjw: Subject tweaks ]
    Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
    Signed-off-by: Rafael J. Wysocki 

commit eae21beecb95a3b69ee5c38a659f774e171d730e
Author: Mauro Carvalho Chehab 
Date:   Thu Jan 8 12:35:04 2026 +0100

    EFI/CPER: don't go past the ARM processor CPER record buffer
    
    There's a logic inside GHES/CPER to detect if the section_length
    is too small, but it doesn't detect if it is too big.
    
    Currently, if the firmware receives an ARM processor CPER record
    stating that a section length is big, kernel will blindly trust
    section_length, producing a very long dump. For instance, a 67
    bytes record with ERR_INFO_NUM set 46198 and section length
    set to 854918320 would dump a lot of data going a way past the
    firmware memory-mapped area.
    
    Fix it by adding a logic to prevent it to go past the buffer
    if ERR_INFO_NUM is too big, making it report instead:
    
            [Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
            [Hardware Error]: event severity: recoverable
            [Hardware Error]:  Error 0, type: recoverable
            [Hardware Error]:   section_type: ARM processor error
            [Hardware Error]:   MIDR: 0xff304b2f8476870a
            [Hardware Error]:   section length: 854918320, CPER size: 67
            [Hardware Error]:   section length is too big
            [Hardware Error]:   firmware-generated error record is incorrect
            [Hardware Error]:   ERR_INFO_NUM is 46198
    
    Signed-off-by: Mauro Carvalho Chehab 
    Reviewed-by: Jonathan Cameron 
    Acked-by: Ard Biesheuvel 
    Reviewed-by: Hanjun Guo 
    [ rjw: Subject and changelog tweaks ]
    Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org
    Signed-off-by: Rafael J. Wysocki 

commit 87880af2d24e62a84ed19943dbdd524f097172f2
Author: Mauro Carvalho Chehab 
Date:   Thu Jan 8 12:35:03 2026 +0100

    APEI/GHES: ARM processor Error: don't go past allocated memory
    
    If the BIOS generates a very small ARM Processor Error, or
    an incomplete one, the current logic will fail to deferrence
    
            err->section_length
    and
            ctx_info->size
    
    Add checks to avoid that. With such changes, such GHESv2
    records won't cause OOPSes like this:
    
    [    1.492129] Internal error: Oops: 0000000096000005 [#1]  SMP
    [    1.495449] Modules linked in:
    [    1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT
    [    1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
    [    1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred
    [    1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
    [    1.497199] pc : log_arm_hw_error+0x5c/0x200
    [    1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220
    
    0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75).
    70              err_info = (struct cper_arm_err_info *)(err + 1);
    71              ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num);
    72              ctx_err = (u8 *)ctx_info;
    73
    74              for (n = 0; n < err->context_info_num; n++) {
    75                      sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
    76                      ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
    77                      ctx_len += sz;
    78              }
    79
    
    and similar ones while trying to access section_length on an
    error dump with too small size.
    
    Signed-off-by: Mauro Carvalho Chehab 
    Reviewed-by: Jonathan Cameron 
    Acked-by: Ard Biesheuvel 
    Reviewed-by: Hanjun Guo 
    [ rjw: Subject tweaks ]
    Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.1767871950.git.mchehab+huawei@kernel.org
    Signed-off-by: Rafael J. Wysocki 

commit 7c0225003317bd6e2107784a83c7099de8b2b28c
Author: Yuto Ohnuki 
Date:   Mon Jan 12 18:14:43 2026 +0000

    fs: improve dump_inode() to safely access inode fields
    
    Use get_kernel_nofault() to safely access inode and related structures
    (superblock, file_system_type) to avoid crashing when the inode pointer
    is invalid. This allows the same pattern as dump_mapping().
    
    Note: The original access method for i_state and i_count is preserved,
    as get_kernel_nofault() is unnecessary once the inode structure is
    verified accessible.
    
    Reviewed-by: Jan Kara 
    Signed-off-by: Yuto Ohnuki 
    Link: https://patch.msgid.link/20260112181443.81286-1-ytohnuki@amazon.com
    Reviewed-by: Mateusz Guzik 
    Signed-off-by: Christian Brauner 

commit 58ecde96e8b8d85754c664c3d9814e6ffd38a788
Merge: 589cff4975afe1 f9a6a3fec23a85
Author: Christian Brauner 
Date:   Tue Jan 13 09:44:52 2026 +0100

    Merge patch series "exportfs: Some kernel-doc fixes"
    
    André Almeida  says:
    
    This short series removes some duplicated documentation and address some
    kernel-doc issues.
    
    * patches from https://patch.msgid.link/20260112-tonyk-fs_uuid-v1-0-acc1889de772@igalia.com:
      docs: exportfs: Use source code struct documentation
      exportfs: Complete kernel-doc for struct export_operations
      exportfs: Mark struct export_operations functions at kernel-doc
      exportfs: Fix kernel-doc output for get_name()
    
    Link: https://patch.msgid.link/20260112-tonyk-fs_uuid-v1-0-acc1889de772@igalia.com
    Signed-off-by: Christian Brauner 

commit 589cff4975afe1a4eaaa1d961652f50b1628d78d
Author: Ben Dooks 
Date:   Thu Jan 8 11:58:56 2026 +0000

    fs: add  for 'init_fs'
    
    The init_fs symbol is defined in  but was
    not included in fs/fs_struct.c so fix by adding the include.
    
    Fixes the following sparse warning:
    fs/fs_struct.c:150:18: warning: symbol 'init_fs' was not declared. Should it be static?
    
    Fixes: 3e93cd671813e ("Take fs_struct handling to new file")
    Signed-off-by: Ben Dooks 
    Link: https://patch.msgid.link/20260108115856.238027-1-ben.dooks@codethink.co.uk
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit f9a6a3fec23a852851049847f2ba3be6eb6eb0b7
Author: André Almeida 
Date:   Mon Jan 12 22:51:27 2026 -0300

    docs: exportfs: Use source code struct documentation
    
    Instead of duplicating struct export_operations documentation in both
    ReST file and in the C source code, just use the kernel-doc in the docs.
    
    While here, make the sentence preceding the paragraph less redundant.
    
    Signed-off-by: André Almeida 
    Link: https://patch.msgid.link/20260112-tonyk-fs_uuid-v1-4-acc1889de772@igalia.com
    Reviewed-by: Chuck Lever 
    Signed-off-by: Christian Brauner 

commit 1219e0feaefc9697f738b223540e8e8906291cb3
Author: Amir Goldstein 
Date:   Fri Jan 9 22:15:36 2026 +0100

    fs: move initializing f_mode before file_ref_init()
    
    The comment above file_ref_init() says:
    "We're SLAB_TYPESAFE_BY_RCU so initialize f_ref last."
    but file_set_fsnotify_mode() was added after file_ref_init().
    
    Move it right after setting f_mode, where it makes more sense.
    
    Fixes: 711f9b8fbe4f4 ("fsnotify: disable pre-content and permission events by default")
    Signed-off-by: Amir Goldstein 
    Link: https://patch.msgid.link/20260109211536.3565697-1-amir73il@gmail.com
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 7a6f811e2c06d656996776771f0498df129a0cc2
Author: André Almeida 
Date:   Mon Jan 12 22:51:26 2026 -0300

    exportfs: Complete kernel-doc for struct export_operations
    
    Write down the missing members definitions for struct export_operations,
    using as a reference the commit messages that created the members.
    
    Signed-off-by: André Almeida 
    Link: https://patch.msgid.link/20260112-tonyk-fs_uuid-v1-3-acc1889de772@igalia.com
    Reviewed-by: Chuck Lever 
    Signed-off-by: Christian Brauner 

commit fc76b5968a435894062ad4160c2e81c32cc4972e
Author: André Almeida 
Date:   Mon Jan 12 22:51:25 2026 -0300

    exportfs: Mark struct export_operations functions at kernel-doc
    
    Adding a `@` before the function names make then recognizable as
    kernel-docs, so they get correctly rendered in the documentation.
    
    Even if they are already marked with `@` in the short one-line summary,
    the kernel-docs will correctly favor the more detailed definition here.
    
    Signed-off-by: André Almeida 
    Link: https://patch.msgid.link/20260112-tonyk-fs_uuid-v1-2-acc1889de772@igalia.com
    Reviewed-by: Chuck Lever 
    Signed-off-by: Christian Brauner 

commit 5e7fa6bfa9b5ced6868fc652d5c40fe0eac154d9
Author: André Almeida 
Date:   Mon Jan 12 22:51:24 2026 -0300

    exportfs: Fix kernel-doc output for get_name()
    
    Without a space between %NAME_MAX and the plus sign, kernel-doc will
    output ``NAME_MAX``+1, which scapes the last backtick and make Sphinx
    format a much larger string as monospaced text.
    
    Signed-off-by: André Almeida 
    Link: https://patch.msgid.link/20260112-tonyk-fs_uuid-v1-1-acc1889de772@igalia.com
    Reviewed-by: Chuck Lever 
    Signed-off-by: Christian Brauner 

commit 46329a9dd74bd12e92fb7cc8afe70dad32875758
Author: Jeff Layton 
Date:   Tue Jan 6 09:38:22 2026 -0500

    acct(2): begin the deprecation of legacy BSD process accounting
    
    As Christian points out [1], even though it's privileged, this interface
    has a lot of footguns. There are better options these days (e.g. eBPF),
    so it would be good to start discouraging its use and mark it as
    deprecated.
    
    [1]: https://lore.kernel.org/linux-fsdevel/20250212-giert-spannend-8893f1eaba7d@brauner/
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260106-bsd-acct-v1-1-d15564b52c83@kernel.org
    Signed-off-by: Christian Brauner 

commit 6784f274722559c0cdaaa418bc8b7b1d61c314f9
Author: Breno Leitao 
Date:   Wed Jan 7 06:06:36 2026 -0800

    device_cgroup: remove branch hint after code refactor
    
    commit 4ef4ac360101 ("device_cgroup: avoid access to ->i_rdev in the
    common case in devcgroup_inode_permission()") reordered the checks in
    devcgroup_inode_permission() to check the inode mode before checking
    i_rdev, for better cache behavior.
    
    However, the likely() annotation on the i_rdev check was not updated
    to reflect the new code flow. Originally, when i_rdev was checked
    first, likely(!inode->i_rdev) made sense because most inodes were(?)
    regular files/directories, thus i_rdev == 0.
    
    After the reorder, by the time we reach the i_rdev check, we have
    already confirmed the inode IS a block or character device. Block and
    character special files are precisely defined by having a device number
    (i_rdev), so !inode->i_rdev is now the rare edge case, not the common
    case.
    
    Branch profiling confirmed this is 100% mispredicted:
    
      correct incorrect  %    Function                      File              Line
      ------- ---------  -    --------                      ----              ----
            0   2631904 100   devcgroup_inode_permission    device_cgroup.h   24
    
    Remove likely() to avoid giving the wrong hint to the CPU.
    
    Fixes: 4ef4ac360101 ("device_cgroup: avoid access to ->i_rdev in the common case in devcgroup_inode_permission()")
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260107-likely_device-v1-1-0c55f83a7e47@debian.org
    Reviewed-by: Mateusz Guzik 
    Signed-off-by: Christian Brauner 

commit 6b32c93560cb194e10279bd3be3c1d0fa30df3e7
Author: Ryosuke Yasuoka 
Date:   Wed Dec 24 16:07:32 2025 +0900

    x86/traps: Print unhashed pointers on stack overflow
    
    When a stack overflow occurs, the kernel prints hashed fault address and the
    stack range using %p. The actual addresses are required for debugging and
    hashed pointers provide no useful information in this context.
    
    Use %px to print the unhashed, raw addresses.
    
    Signed-off-by: Ryosuke Yasuoka 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251224070735.454816-1-ryasuoka@redhat.com

commit 3431d387a7042c754e27152c287c6e706b46f139
Merge: 8f0b4cce4481fb 8d407bb32186f4
Author: Christian Brauner 
Date:   Wed Jan 14 16:31:46 2026 +0100

    Merge patch series "iomap: erofs page cache sharing preliminaries"
    
    Bring in the two changes needed in iomap and erofs to enable the page
    cache sharing work.
    
    * patches from https://patch.msgid.link/20260109102856.598531-1-lihongbo22@huawei.com:
      erofs: hold read context in iomap_iter if needed
      iomap: stash iomap read ctx in the private field of iomap_iter
    
    Link: https://patch.msgid.link/20260109102856.598531-1-lihongbo22@huawei.com
    Signed-off-by: Christian Brauner 

commit 8d407bb32186f4a06a97871af4d5cc45444602fb
Author: Hongbo Li 
Date:   Fri Jan 9 10:28:48 2026 +0000

    erofs: hold read context in iomap_iter if needed
    
    Introduce `struct erofs_iomap_iter_ctx` to hold both `struct page *`
    and `void *base`, avoiding bogus use of `kmap_to_page()` in
    `erofs_iomap_end()`.
    
    With this change, fiemap and bmap no longer need to read inline data.
    
    Additionally, the upcoming page cache sharing mechanism requires
    passing the backing inode pointer to `erofs_iomap_{begin,end}()`, as
    I/O accesses must apply to backing inodes rather than anon inodes.
    
    Signed-off-by: Hongbo Li 
    Link: https://patch.msgid.link/20260109102856.598531-3-lihongbo22@huawei.com
    Reviewed-by: Gao Xiang 
    Signed-off-by: Christian Brauner 

commit 8806f279244bf300dca2c99735d5a51cd24b86df
Author: Hongbo Li 
Date:   Fri Jan 9 10:28:47 2026 +0000

    iomap: stash iomap read ctx in the private field of iomap_iter
    
    It's useful to get filesystem-specific information using the
    existing private field in the @iomap_iter passed to iomap_{begin,end}
    for advanced usage for iomap buffered reads, which is much like the
    current iomap DIO.
    
    For example, EROFS needs it to:
    
     - implement an efficient page cache sharing feature, since iomap
       needs to apply to anon inode page cache but we'd like to get the
       backing inode/fs instead, so filesystem-specific private data is
       needed to keep such information;
    
     - pass in both struct page * and void * for inline data to avoid
       kmap_to_page() usage (which is bogus).
    
    Signed-off-by: Hongbo Li 
    Link: https://patch.msgid.link/20260109102856.598531-2-lihongbo22@huawei.com
    Reviewed-by: Gao Xiang 
    Reviewed-by: Darrick J. Wong 
    Signed-off-by: Christian Brauner 

commit def675cf3f107ba8da78ca0b8650997fdf667538
Author: Michal Wajdeczko 
Date:   Mon Jan 12 19:37:16 2026 +0100

    drm/xe/mert: Improve handling of MERT CAT errors
    
    All MERT catastrophic errors but VF's LMTT fault are serious, so
    we shouldn't limit our handling only to print debug messages.
    
    Change CATERR message to error level and then declare the device
    as wedged to match expectation from the design document. For the
    LMTT faults, add a note about adding tracking of this unexpected
    VF activity.
    
    While at it, rename register fields defnitions to match the BSpec.
    Also drop trailing include guard name from the regs.h file.
    
    BSpec: 74625
    Signed-off-by: Michal Wajdeczko 
    Cc: Lukasz Laguna 
    Reviewed-by: Lukasz Laguna 
    Link: https://patch.msgid.link/20260112183716.28700-1-michal.wajdeczko@intel.com

commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123
Author: Mario Peter 
Date:   Thu Jan 8 16:59:02 2026 +0000

    usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
    
    The ChipIdea UDC driver can encounter "not page aligned sg buffer"
    errors when a USB device is reconnected after being disconnected
    during an active transfer. This occurs because _ep_nuke() returns
    requests to the gadget layer without properly unmapping DMA buffers
    or cleaning up scatter-gather bounce buffers.
    
    Root cause:
    When a disconnect happens during a multi-segment DMA transfer, the
    request's num_mapped_sgs field and sgt.sgl pointer remain set with
    stale values. The request is returned to the gadget driver with status
    -ESHUTDOWN but still has active DMA state. If the gadget driver reuses
    this request on reconnect without reinitializing it, the stale DMA
    state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero
    num_mapped_sgs) and attempt to use freed/invalid DMA addresses,
    leading to alignment errors and potential memory corruption.
    
    The normal completion path via _hardware_dequeue() properly calls
    usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before
    returning the request. The _ep_nuke() path must do the same cleanup
    to ensure requests are returned in a clean, reusable state.
    
    Fix:
    Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror
    the cleanup sequence in _hardware_dequeue():
    - Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set
    - Call sglist_do_debounce() with copy=false if bounce buffer exists
    
    This ensures that when requests are returned due to endpoint shutdown,
    they don't retain stale DMA mappings. The 'false' parameter to
    sglist_do_debounce() prevents copying data back (appropriate for
    shutdown path where transfer was aborted).
    
    Signed-off-by: Mario Peter 
    Reviewed-by: Xu Yang 
    Acked-by: Peter Chen 
    Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com
    Signed-off-by: Greg Kroah-Hartman 

commit 2e9762f45efb53e7e7fc61f4ebf7a3507f5daa45
Author: Xu Yang 
Date:   Mon Jan 12 19:04:08 2026 +0800

    usb: chipidea: ci_hdrc_imx: use "wakeup" suffix for wakeup interrupt name
    
    Currently the wakeup and controller interrupt name are same. It's not
    easy to find the correct one in /proc/interrupt at the first glance.
    Rename the wakeup interrupt name for better distinction.
    
    Signed-off-by: Xu Yang 
    Reviewed-by: Frank Li 
    Acked-by: Peter Chen 
    Link: https://patch.msgid.link/20260112110408.3263954-1-xu.yang_2@nxp.com
    Signed-off-by: Greg Kroah-Hartman 

commit ec06c8039d396a1b558cc138f5c5aba17698e175
Author: Sean Anderson 
Date:   Tue Jan 6 12:10:18 2026 -0500

    usb: dwc3: Always deassert xilinx resets
    
    If we don't have a usb3 phy we don't need to assert the core resets.
    Deassert them even if we didn't assert them to support booting when the
    bootloader never released the core from reset.
    
    Signed-off-by: Sean Anderson 
    Acked-by: Thinh Nguyen 
    Link: https://patch.msgid.link/20260106171018.501612-1-sean.anderson@linux.dev
    Signed-off-by: Greg Kroah-Hartman 

commit 7a7930c0f934fb0c46de6e7ca08e14e11df35dd6
Author: Randy Dunlap 
Date:   Mon Jan 12 23:18:31 2026 -0800

    usb: gadget: u_ether: use  header file
    
    Since  no longer includes , any users
    of the hex interfaces need to include  themselves, so
    add the header file here as needed.
    
    Suggested-by: Stephen Rothwell 
    Fixes: e065c6a7e46c ("usb: gadget: u_ether: add gether_opts for config caching")
    Reported-by: Stephen Rothwell 
    Closes: https://lore.kernel.org/linux-next/2768c835-7ac9-4540-a665-5dd516a80eee@infradead.org/T/#t
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20260113071831.4158296-1-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit f9de0dd246ed14996e62c731ebccf162cb015ff9
Author: Greg Kroah-Hartman 
Date:   Wed Jan 7 16:25:40 2026 +0100

    USB: HCD: remove logic about which hcd is loaded
    
    It turns out that warning about which USB host controller is loaded
    before another one doesn't really matter.  All that really is needed is
    the PCI softdep module loading logic, which has been present in the
    kernel ever since commit 05c92da0c524 ("usb: ohci/uhci - add soft
    dependencies on ehci_pci")
    
    So remove the warning messages, they are not useful, not needed, and
    only confuse people.  As can be seen in the discussion at
    https://lore.kernel.org/r/20251230080014.3934590-1-chenhuacai@loongson.cn
    
    Cc: Huacai Chen 
    Suggested-by: Alan Stern 
    Reviewed-by: Huacai Chen 
    Link: https://patch.msgid.link/2026010739-diffuser-shelter-e31c@gregkh
    Signed-off-by: Greg Kroah-Hartman 

commit 86767625f525431642fa64b16ce84bdb2d8d1dc4
Author: Xu Yang 
Date:   Thu Jan 8 16:14:33 2026 +0800

    usb: dwc3: imx8mp: disable auto suspend for host role
    
    Do dwc3 core auto suspend enable for device and disable for host
    , this can make sure dwc3 core device auto suspend setting is
    correct all the time, the background of disable dwc3 core device
    auto suspend is to make its parent device suspend immediately
    (so wakeup enable can be enabled) after xhci-plat device suspended,
    for device mode, we keep the dwc3 core device auto suspend is to
    give some wait for gadget to be enumerated.
    
    Note: It's a temporary solution until we switch to using the new
          flatten model.
    
    Acked-by: Thinh Nguyen 
    Signed-off-by: Xu Yang 
    Link: https://patch.msgid.link/20260108081433.2119328-3-xu.yang_2@nxp.com
    Signed-off-by: Greg Kroah-Hartman 

commit ab785d6bd02b854d15c8eb53769fed8b4831b390
Author: Xu Yang 
Date:   Thu Jan 8 16:14:32 2026 +0800

    usb: dwc3: imx8mp: rename dwc3 to dwc3_pdev in struct dwc3_imx8mp
    
    It's confuse to let "dwc3" represent a platform_device, because "dwc3"
    may also represent a dwc3 core structure. Rename it for better
    distinction.
    
    Reviewed-by: Frank Li 
    Acked-by: Thinh Nguyen 
    Signed-off-by: Xu Yang 
    Link: https://patch.msgid.link/20260108081433.2119328-2-xu.yang_2@nxp.com
    Signed-off-by: Greg Kroah-Hartman 

commit e02264af6b49d21bbc2223b19c2ddfd2ae8260a6
Author: Xu Yang 
Date:   Thu Jan 8 16:14:31 2026 +0800

    usb: dwc3: drd: extend dwc3_pre_set_role() to extcon and otg usecase
    
    Call dwc3_pre_set_role() to support both extcon and otg usecase, so that
    the glue driver can do proper action in case of role changes.
    
    Reviewed-by: Frank Li 
    Acked-by: Thinh Nguyen 
    Signed-off-by: Xu Yang 
    Link: https://patch.msgid.link/20260108081433.2119328-1-xu.yang_2@nxp.com
    Signed-off-by: Greg Kroah-Hartman 

commit 0145e7acd29855dfba4a2f387d455b5d9a520f0e
Author: Sam Day 
Date:   Thu Jan 8 08:30:21 2026 +1000

    usb: gadget: f_fs: fix DMA-BUF OUT queues
    
    Currently, DMA_FROM_DEVICE is used when attaching DMABUFs to IN
    endpoints and DMA_TO_DEVICE for OUT endpoints. This is inverted from
    how it should be.
    
    The result is IOMMU read-only mappings placed on OUT queues,
    triggering arm-smmu write faults.
    
    Put differently, OUT endpoints flow data from host -> gadget, meaning
    the UDC peripheral needs to have write access to the buffer to fill it
    with the incoming data.
    
    This commit flips the directions and updates the implicit-sync helpers
    so IN endpoints act as readers and OUT endpoints as writers.
    
    Signed-off-by: Sam Day 
    Tested-by: David Heidelberg   # OnePlus 6T on sdm845-next-20251119
    Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-2-e51633891a81@samcday.com
    Signed-off-by: Greg Kroah-Hartman 

commit 8e4c1d06183c25022f6b0002a5cab84979ca6337
Author: Sam Day 
Date:   Thu Jan 8 08:30:20 2026 +1000

    usb: gadget: f_fs: Fix ioctl error handling
    
    When ffs_epfile_ioctl handles FUNCTIONFS_DMABUF_* ioctls, it's currently
    falling through when copy_from_user fails.
    
    However, this fallthrough isn't being checked properly, so the handler
    continues executing further than it should. It then tries the secondary
    dispatch where it ultimately gives up and returns -ENOTTY.
    
    The end result is invalid ioctl invocations will yield a -ENOTTY rather
    than an -EFAULT.
    
    It's a common pattern elsewhere in the kernel code to directly return
    -EFAULT when copy_from_user fails. So we update ffs_epfile_ioctl to do
    the same and fix this issue.
    
    Signed-off-by: Sam Day 
    Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-1-e51633891a81@samcday.com
    Signed-off-by: Greg Kroah-Hartman 

commit da0faa257f10da39052ca7f1cfa35179ca8749e5
Author: Jiasheng Jiang 
Date:   Wed Jan 7 19:06:22 2026 +0000

    usb: gadget: f_tcm: initialize data_len in UAS path for consistency
    
    In usbg_submit_command(), which handles the UAS protocol, the 'data_len'
    member of the 'usbg_cmd' structure was left uninitialized by the
    logic, relying instead on the zeroing performed by usbg_get_cmd().
    
    In contrast, the BOT path (bot_submit_command) explicitly initializes
    this field from the Command Block Wrapper (CBW). This discrepancy is
    evident in error handling paths where __target_init_cmd() is called
    using cmd->data_len.
    
    Explicitly initialize cmd->data_len to 0 in the UAS path and use this
    variable when calling target_submit_cmd(). This ensures architectural
    consistency between the UAS and BOT protocols within the driver and
    avoids reliance on implicit memory state during error transitions.
    
    Signed-off-by: Jiasheng Jiang 
    Link: https://patch.msgid.link/20260107190622.26070-1-jiashengjiangcool@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 3502cea99c7ceb331458cbd34ef6792c83144687
Author: Billy Tsai 
Date:   Mon Jan 12 14:07:22 2026 +0800

    i3c: Move device name assignment after i3c_bus_init
    
    Move device name initialization to occur after i3c_bus_init()
    so that i3cbus->id is guaranteed to be assigned before it is used.
    
    Fixes: 9d4f219807d5 ("i3c: fix refcount inconsistency in i3c_master_register")
    Signed-off-by: Billy Tsai 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260112-upstream_i3c_fix-v1-1-cbbf2cb71809@aspeedtech.com
    Signed-off-by: Alexandre Belloni 

commit e7218986319b4e903dfb4642dcbd1087cf16aaec
Author: Tommaso Merciai 
Date:   Wed Jan 7 11:33:50 2026 +0100

    i3c: renesas: Add suspend/resume support
    
    The Renesas I3C controller does not retain its register state across system
    suspend, requiring the driver to explicitly save and restore hardware
    configuration.
    
    Add suspend and resume NOIRQ callbacks to handle system sleep transitions.
    
    During suspend, save the Device Address Table (DAT) entries, assert reset
    lines, and disable all related clocks to allow the controller to enter a
    low-power state.
    
    On resume, re-enable clocks and reset lines in the proper order. Restore
    the REFCKCTL register, master dynamic address, and all DAT entries, then
    reinitialize the controller.
    
    Store the REFCLK divider value, and the master dynamic address to restore
    timing and addressing configuration after resume.
    
    Reviewed-by: Frank Li 
    Signed-off-by: Tommaso Merciai 
    Link: https://patch.msgid.link/c469ef89e0156d37746a85bfc314232847d1185a.1767781092.git.tommaso.merciai.xr@bp.renesas.com
    Signed-off-by: Alexandre Belloni 

commit 5eb3e8763e076a47ab145c5fafcf39f1ac7c7aee
Author: Tommaso Merciai 
Date:   Wed Jan 7 11:33:49 2026 +0100

    i3c: renesas: Factor out hardware initialization to separate function
    
    Move the hardware initialization sequence in renesas_i3c_bus_init()
    into a dedicated renesas_i3c_hw_init() helper.
    
    Simplify the code and prepare the driver for upcoming suspend/resume
    support.
    
    No functional change intended.
    
    Reviewed-by: Frank Li 
    Signed-off-by: Tommaso Merciai 
    Link: https://patch.msgid.link/795327270a6ceb23e15513a2619a19ae4876cfba.1767781092.git.tommaso.merciai.xr@bp.renesas.com
    Signed-off-by: Alexandre Belloni 

commit ff4e4f03f0089635b3476d68f5b8833ea67adad6
Author: Tommaso Merciai 
Date:   Wed Jan 7 11:33:48 2026 +0100

    i3c: renesas: Store clock rate and reset controls in struct renesas_i3c
    
    Update the struct renesas_i3c to store the clock rate, presetn and
    tresetn handlers. Replace local usage of the clock rate and reset
    controls with these structure fields.
    
    Simplify the code and prepare the driver for upcoming suspend/resume
    support.
    
    No functional change intended.
    
    Reviewed-by: Frank Li 
    Signed-off-by: Tommaso Merciai 
    Link: https://patch.msgid.link/9e1da95dd9137590c752ecd9429925afcbeb918b.1767781092.git.tommaso.merciai.xr@bp.renesas.com
    Signed-off-by: Alexandre Belloni 

commit 579c7255922a3e0ba432eb608deb7d0fed896052
Author: Tommaso Merciai 
Date:   Wed Jan 7 11:33:47 2026 +0100

    i3c: renesas: Switch to clk_bulk API and store clocks in private data
    
    Replace individual devm_clk_get_enabled() calls with the clk_bulk API
    and store the clock handles in the driver's private data structure.
    
    All clocks required by the controller are now acquired and enabled using
    devm_clk_bulk_get_all_enabled(), removing the need for per-SoC clock
    handling and the renesas_i3c_config data.
    The TCLK is accessed via a fixed index in the bulk clock array.
    
    Simplify the code and prepare the driver for upcoming suspend/resume
    support.
    
    No functional change intended.
    
    Reviewed-by: Biju Das 
    Signed-off-by: Tommaso Merciai 
    Link: https://patch.msgid.link/1286f8600b542da55facf9920fed7c06b2b0e4d5.1767781092.git.tommaso.merciai.xr@bp.renesas.com
    Signed-off-by: Alexandre Belloni 

commit 540a55a5bafd0ddbeb87672fe569c15954b47038
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:16 2026 +0200

    i3c: mipi-i3c-hci-pci: Define Multi-Bus instances for supported controllers
    
    Define Multi-Bus Instances at offset 0x400 for Intel controllers.
    
    Intel SoCs include two I3C PCI devices in the Low Power Subsystem (LPSS),
    each capable of hosting two I3C buses. Panther Lake and Wildcat Lake
    support three buses in total (IDs 0–2), while Nova Lake supports four
    (IDs 0–3).
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-12-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 9b1679028e760259eaf817b8ceecad9b03a60118
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:15 2026 +0200

    i3c: mipi-i3c-hci-pci: Add support for Multi-Bus Instances
    
    Add support for MIPI I3C Host Controllers with the Multi-Bus Instance
    capability.  These controllers can host multiple I3C buses (up to 15)
    within a single hardware function (e.g., PCIe B/D/F), providing one
    indepedent HCI register set and corresponding I3C bus controller logic
    per bus.
    
    Create an MFD cell for each instance and use platform_data to pass the
    starting address of the instance's register set.
    
    The MIPI I3C HCI specification defines an Extended Capability that holds
    the offset of each instance register set.  Parsing this information is
    relatively complex, so include the offsets in driver data for now.
    
    Driver data for additional instances beyond instance 0 will be added in a
    subsequent patch.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-11-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 0590fe32f9040bccb5481915b32bba1595946b16
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:14 2026 +0200

    i3c: mipi-i3c-hci-pci: Convert to MFD driver
    
    Prepare for Multi-Bus instance support.  Convert to MFD driver but still
    support only 1 instance.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-10-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 9a4d56b42ff019bbff1e3d0940ebfd3e292326fa
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:13 2026 +0200

    i3c: mipi-i3c-hci-pci: Pass base regs as platform data to i3c core device
    
    Use the parent's MMIO mapping for multi-bus instances to avoid overlapping
    regions.  These instances share the same MMIO address space, but the ranges
    are not guaranteed to be contiguous.  By passing base_regs from the parent
    mapping, child devices can access their registers without creating
    conflicting mappings.
    
    Prepare for multi-bus instance support by passing base_regs to child
    devices.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-9-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit b8460480f62e16751876a1f367dc14fb62867463
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:12 2026 +0200

    i3c: mipi-i3c-hci: Allow for Multi-Bus Instances
    
    Add support for MIPI I3C Host Controllers with the Multi-Bus Instance
    capability.  These controllers can host multiple I3C buses (up to 15)
    within a single hardware function (e.g., PCIe B/D/F), providing one
    indepedent HCI register set and corresponding I3C bus controller logic
    per bus.
    
    A separate platform device will represent each instance, but it is
    necessary to allow for shared resources.
    
    Multi-bus instances share the same MMIO address space, but the ranges are
    not guaranteed to be contiguous. To avoid overlapping mappings, pass
    base_regs from the parent mapping to child devices.
    
    Allow the IRQ to be shared among instances.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-8-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 35c0bfe8fd1066c61420b076e7bcd3cfa54b9d92
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:11 2026 +0200

    i3c: mipi-i3c-hci-pci: Assign unique device names and IDs for Intel LPSS I3C
    
    Simplify the code and ensure names and IDs align with device documentation.
    Use explicit device names and IDs for Intel LPSS I3C controllers instead of
    dynamically allocated values.
    
    Add "intel-lpss-i3c" to the platform_device_id table in the mipi-i3c-hci
    driver and use the same name for Intel I3C controllers in the
    mipi_i3c_hci_pci driver.  Assign hard-coded IDs to reflect the hardware
    layout.
    
    Intel SoCs include two I3C PCI devices in the Low Power Subsystem (LPSS),
    each supporting up to two I3C buses. The second PCI device is assigned ID 2
    (not 1) to match this topology.  Additional IDs will be introduced when
    Multi-Bus Instance support is implemented.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-7-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit b43181b724e8b98f1c42d44db8f3c132a932773e
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:10 2026 +0200

    i3c: mipi-i3c-hci-pci: Enable MSI support
    
    Enable MSI support by using pci_alloc_irq_vectors() to request all
    supported IRQ types.  Do not call pci_free_irq_vectors() because for
    resource-managed devices (those initialized with pcim_enable_device()),
    IRQ vector allocation is automatically managed. See
    pci_setup_msi_context() and pcim_setup_msi_release() for details.
    
    Note: The current documentation for pci_alloc_irq_vectors() does not
    mention this behavior.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-6-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit d540d090be8fd2be2dc2b1e0b2818a4a48abcc3e
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:09 2026 +0200

    i3c: mipi-i3c-hci-pci: Do not repeatedly check for NULL driver_data
    
    All entries in the id_table have driver_data. Do not repeatedly check for
    NULL driver_data.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-5-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 581d5b7953b8f24d2f379c8c56ceaa7d163488ce
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:08 2026 +0200

    i3c: mipi-i3c-hci: Quieten initialization messages
    
    The copious initialization messages are at most useful only for debugging.
    Change them from dev_info() or dev_notice() to dev_dbg().
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-4-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 0818e4aa8fdeeed5973e0a8faeddc9da599fc897
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:07 2026 +0200

    i3c: mipi-i3c-hci: Stop reading Extended Capabilities if capability ID is 0
    
    Extended Capability ID value 0 is special.  It signifies the end of the
    list.  Stop reading Extended Capabilities if capability ID is 0.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-3-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 840688d8e65cc6b0d1ac1aa01b9374ae56ff3dfc
Author: Adrian Hunter 
Date:   Tue Jan 6 18:44:06 2026 +0200

    i3c: mipi-i3c-hci: Remove duplicate blank lines
    
    Remove duplicate blank lines from mipi-i3c-hci code.
    
    Signed-off-by: Adrian Hunter 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20260106164416.67074-2-adrian.hunter@intel.com
    Signed-off-by: Alexandre Belloni 

commit 8564f88df2020357430280e3e1d8e8da5d1b19e1
Author: Frank Li 
Date:   Tue Dec 30 09:57:18 2025 -0500

    i3c: Add stub functions when I3C support is disabled
    
    When I3C is disabled, unused functions are removed by the linker because
    the driver relies on regmap and no I3C devices are registered, so normal
    I3C paths are never called.
    
    However, some drivers may still call low-level I3C transfer helpers.
    Provide stub implementations to avoid adding conditional ifdefs everywhere.
    
    Add stubs for i3c_device_do_xfers() and
    i3c_device_get_supported_xfer_mode() only. Other stubs will be introduced
    when they are actually needed.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512230418.nu3V6Yua-lkp@intel.com/
    Signed-off-by: Frank Li 
    Link: https://patch.msgid.link/20251230145718.4088694-1-Frank.Li@nxp.com
    Signed-off-by: Alexandre Belloni 

commit ceff3bc1518a6f3c897e6187ae6e1213d53a611a
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 13:45:52 2025 +0100

    i3c: master: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251224124551.208778-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Alexandre Belloni 

commit 3c9ffb4db787428a5851d5865823ab23842d5103
Author: Frank Li 
Date:   Mon Dec 15 15:08:51 2025 -0500

    i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
    
    Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add
    a NULL check in the error path.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/
    Signed-off-by: Frank Li 
    Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com
    Signed-off-by: Alexandre Belloni 

commit 9904232ae30bc65d7822f50c885987a7876f0beb
Author: Frank Li 
Date:   Mon Dec 15 12:24:04 2025 -0500

    i3c: drop i3c_priv_xfer and i3c_device_do_priv_xfers()
    
    Drop i3c_priv_xfer and i3c_device_do_priv_xfers() after all driver switch
    to use new API.
    
    Signed-off-by: Frank Li 
    Link: https://patch.msgid.link/20251215172405.2982801-1-Frank.Li@nxp.com
    Signed-off-by: Alexandre Belloni 

commit cbce66669c82ee9ae0e26523c0fcd3c721fcfe85
Author: Roy Luo 
Date:   Sat Dec 27 00:53:29 2025 +0000

    phy: Add Google Tensor SoC USB PHY driver
    
    Support the USB PHY found on Google Tensor G5 (Laguna). This
    particular USB PHY supports both high-speed and super-speed
    operations, and is integrated with the SNPS DWC3 controller that's
    also on the SoC. This initial patch specifically adds functionality
    for high-speed.
    
    Co-developed-by: Joy Chakraborty 
    Signed-off-by: Joy Chakraborty 
    Co-developed-by: Naveen Kumar 
    Signed-off-by: Naveen Kumar 
    Signed-off-by: Roy Luo 
    Link: https://patch.msgid.link/20251227-phyb4-v10-2-e8caf6b93fe7@google.com
    Signed-off-by: Vinod Koul 

commit 876dc58c3fa532e38cd1b287a7b8143a1a4c5dc7
Author: Roy Luo 
Date:   Sat Dec 27 00:53:28 2025 +0000

    dt-bindings: phy: google: Add Google Tensor G5 USB PHY
    
    Document the device tree bindings for the USB PHY interfaces integrated
    with the DWC3 controller on Google Tensor SoCs, starting with G5
    generation (Laguna). The USB PHY on Tensor G5 includes two integrated
    Synopsys PHY IPs: the eUSB 2.0 PHY IP and the USB 3.2/DisplayPort combo
    PHY IP.
    
    Due to a complete architectural overhaul in the Google Tensor G5, the
    existing Samsung/Exynos USB PHY binding for older generations of Google
    silicons such as gs101 are no longer compatible, necessitating this new
    device tree binding.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Roy Luo 
    Link: https://patch.msgid.link/20251227-phyb4-v10-1-e8caf6b93fe7@google.com
    Signed-off-by: Vinod Koul 

commit bfef062695570842cf96358f2f46f4c6642c6689
Author: Johan Hovold 
Date:   Fri Nov 21 17:42:01 2025 +0100

    drm/tegra: dsi: fix device leak on probe
    
    Make sure to drop the reference taken when looking up the companion
    (ganged) device and its driver data during probe().
    
    Note that holding a reference to a device does not prevent its driver
    data from going away so there is no point in keeping the reference.
    
    Fixes: e94236cde4d5 ("drm/tegra: dsi: Add ganged mode support")
    Fixes: 221e3638feb8 ("drm/tegra: Fix reference leak in tegra_dsi_ganged_probe")
    Cc: stable@vger.kernel.org      # 3.19: 221e3638feb8
    Cc: Thierry Reding 
    Signed-off-by: Johan Hovold 
    Signed-off-by: Thierry Reding 
    Link: https://patch.msgid.link/20251121164201.13188-1-johan@kernel.org

commit f16741314f68091a8edf116ad5c134a72ffab854
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:48:49 2026 +0100

    phy: socionext: usb2: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Neil Armstrong 
    Reviewed-by: Kunihiko Hayashi 
    Link: https://patch.msgid.link/20260102124848.64474-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit bc148def8924e43245c353c52ced47079a5026da
Author: Sven Peter 
Date:   Thu Jan 8 20:12:06 2026 +0100

    phy: apple: atc: Reset USB2 PHY during probe as well
    
    Now that the upstream Type-C PHY code is getting broader test coverage we
    got reports of USB devices plugged in during boot or those plugged in for
    the first time after boot occasionally not working correctly.
    This is partially caused by the USB2 parts of the PHY being left in an
    unknown state by the previous boot stages. We reset all other parts during
    probe but forgot about the USB2 PHY so let's fix that and actually reset
    and power off the USB2 PHY as well.
    
    Reported-by: James Calligeros 
    Reported-by: Janne Grunau 
    Fixes: 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY")
    Signed-off-by: Sven Peter 
    Reviewed-by: Janne Grunau 
    Tested-by: Janne Grunau 
    Link: https://patch.msgid.link/20260108-atcphy-coldboot-fix-v1-1-01c41c6e84f2@kernel.org
    Signed-off-by: Vinod Koul 

commit 7d55b44e2be1069504e22253d26d08982884f930
Author: Sven Peter 
Date:   Sun Jan 4 22:56:39 2026 +0100

    phy: apple: atc: Actually check return value of devm_apple_tunable_parse
    
    Let's actually check the return value of devm_apple_tunable_parse
    instead of trying to check IS_ERR on a pointer to the return value which
    is always going to be valid. This prevent a oops when the tunables are
    invalid or when they don't exist:
    
    [   57.664567] Unable to handle kernel paging request at virtual address fffffffffffffffe
    [   57.664584] Mem abort info:
    [   57.664589]   ESR = 0x0000000096000007
    [   57.664595]   EC = 0x25: DABT (current EL), IL = 32 bits
    [   57.664602]   SET = 0, FnV = 0
    [   57.664607]   EA = 0, S1PTW = 0
    [   57.664611]   FSC = 0x07: level 3 translation fault
    [   57.664617] Data abort info:
    [   57.664621]   ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
    [   57.664626]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
    [   57.664631]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
    [   57.664640] swapper pgtable: 16k pages, 47-bit VAs, pgdp=0000000b4391c000
    [   57.664647] [fffffffffffffffe] pgd=0000000000000000, p4d=0000000000000000, pud=0000000b44188403, pmd=0000000b4418c403, pte=0000000000000000
    [   57.664670] Internal error: Oops: 0000000096000007 [#1]  SMP
    [   57.665047] CPU: 1 UID: 0 PID: 23 Comm: kworker/1:0 Tainted: G S                  6.18.2+ #2 PREEMPTLAZY
    [   57.665061] Tainted: [S]=CPU_OUT_OF_SPEC
    [   57.665066] Hardware name: Apple Mac mini (M1, 2020) (DT)
    [   57.665072] Workqueue: events cd321x_update_work [tps6598x]
    [   57.665100] pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
    [   57.665111] pc : apple_tunable_apply+0x8/0x80 [apple_tunable]
    [   57.665121] lr : atcphy_mux_set+0x3e0/0x1138 [phy_apple_atc]
    [   57.665133] sp : ffffc000802a7c00
    [   57.665138] x29: ffffc000802a7c00 x28: 0000000000000003 x27: ffff800016c84080
    [   57.665151] x26: 0000000000000002 x25: ffff800016c84090 x24: ffff800016c8408f
    [   57.665163] x23: 0000000000020004 x22: 0000000000000001 x21: 0000000000000006
    [   57.665175] x20: ffff80000d6da9b0 x19: ffff80000d6da880 x18: 0000000000000002
    [   57.665188] x17: 0000000000000000 x16: ffffe22de59e0e38 x15: 0000000000000002
    [   57.665199] x14: ffffe22de76ecff8 x13: 0000000000000001 x12: ffff9dd5f90bc000
    [   57.665211] x11: 00000000000000c0 x10: 048abc15ceba0919 x9 : ffffe22dbc5fde10
    [   57.665223] x8 : ffff80000175e0d8 x7 : 0000000000000004 x6 : 0000000000000000
    [   57.665234] x5 : 0000000000000001 x4 : 0000000d6d132db7 x3 : 00000000000155db
    [   57.665246] x2 : 0000000000000000 x1 : fffffffffffffffe x0 : ffffc00082b80000
    [   57.665258] Call trace:
    [   57.665265]  apple_tunable_apply+0x8/0x80 [apple_tunable] (P)
    [   57.665276]  typec_mux_set+0x74/0xe0 [typec]
    [   57.665315]  cd321x_update_work+0x440/0x8c0 [tps6598x]
    [   57.665332]  process_one_work+0x178/0x3d0
    [   57.665346]  worker_thread+0x260/0x390
    [   57.665354]  kthread+0x150/0x250
    [   57.665369]  ret_from_fork+0x10/0x20
    [   57.665386] Code: e69a0ae8 ffffe22d aa1e03e9 d503201f (f9400022)
    [   57.665394] ---[ end trace 0000000000000000 ]---
    
    Reported-by: Thomas Glanzmann 
    Fixes: 8e98ca1e74db ("phy: apple: Add Apple Type-C PHY")
    Signed-off-by: Sven Peter 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260104-atcphy-tunable-fix-v2-1-84e5c2a57aaa@kernel.org
    Signed-off-by: Vinod Koul 

commit ac4f869c56301831a60706a84acbf13b4f0f9886
Author: Binbin Wu 
Date:   Tue Jan 13 16:47:48 2026 +0800

    KVM: VMX: Remove declaration of nested_mark_vmcs12_pages_dirty()
    
    Remove the declaration of nested_mark_vmcs12_pages_dirty() from the
    header file since it has been moved and renamed to
    nested_vmx_mark_all_vmcs12_pages_dirty(), which is a static function.
    
    Signed-off-by: Binbin Wu 
    Link: https://patch.msgid.link/20260113084748.1714633-1-binbin.wu@linux.intel.com
    Signed-off-by: Sean Christopherson 

commit 759a1f97373f25770cf438d9fb5f2bddf4d77a54
Author: Thomas Weißschuh 
Date:   Wed Jan 14 08:26:05 2026 +0100

    powerpc/vdso: Provide clock_getres_time64()
    
    For consistency with __vdso_clock_gettime64() there should also be a
    64-bit variant of clock_getres(). This will allow the extension of
    CONFIG_COMPAT_32BIT_TIME to the vDSO and finally the removal of 32-bit
    time types from the kernel and UAPI.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Reviewed-by: Christophe Leroy (CS GROUP) 
    Link: https://patch.msgid.link/20260114-vdso-powerpc-align-v1-1-acf09373d568@linutronix.de

commit 3d2515fdd336b2c785f0568c3b015920261cca10
Author: Kavita Kavita 
Date:   Wed Jan 14 16:48:59 2026 +0530

    wifi: mac80211: add support for encryption/decryption of (Re)Association frames
    
    Currently, mac80211 does not encrypt or decrypt (Re)Association frames
    (Request and Response) because temporal keys are not yet available at
    that stage.
    
    With extensions from IEEE P802.11bi, e.g. EPPKE, temporal keys can be
    established before association. This enables the encryption and
    decryption of (Re)Association Request/Response frames.
    
    Add support to unset the IEEE80211_TX_INTFL_DONT_ENCRYPT flag when
    the peer is marked as an Enhanced Privacy Protection (EPP) peer and
    encryption keys are available for the connection in non-AP STA mode,
    allowing secure transmission of (Re)Association Request frames.
    
    Drop unprotected (Re)Association Request/Response frames received from
    an EPP peer.
    
    Co-developed-by: Sai Pratyusha Magam 
    Signed-off-by: Sai Pratyusha Magam 
    Signed-off-by: Kavita Kavita 
    Link: https://patch.msgid.link/20260114111900.2196941-9-kavita.kavita@oss.qualcomm.com
    [remove useless parentheses]
    Signed-off-by: Johannes Berg 

commit 69555130dccb39df4d40f90fafc7fc79a5d55b8a
Author: Sean Christopherson 
Date:   Thu Jan 8 19:50:37 2026 -0800

    KVM: SVM: Fix an off-by-one typo in the comment for enabling AVIC by default
    
    Fix a goof in the comment that documents KVM's logic for enabling AVIC by
    default to reference Zen5+ as family 0x1A (Zen5), not family 0x19 (Zen4).
    The code is correct (checks for _greater_ than 0x19), only the comment is
    flawed.
    
    Opportunistically tweak the check too, even though it's already correct,
    so that both the comment and the code reference 0x1A, and so that the
    checks are "ascending", i.e. check Zen4 and then Zen5+.
    
    No functional change intended.
    
    Fixes: ca2967de5a5b ("KVM: SVM: Enable AVIC by default for Zen4+ if x2AVIC is support")
    Acked-by: Naveen N Rao (AMD) 
    Link: https://patch.msgid.link/20260109035037.1015073-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit ba7693014d52e709797ae430cfe6ac1c8cadd3e6
Author: Yixun Lan 
Date:   Wed Jan 14 08:17:42 2026 +0800

    dt-bindings: pinctrl: spacemit: k3: fix drive-strength doc
    
    Fix a typo in DT documentation, it should describe the 3.3V drive strength
    table of SpacemiT k3 SoC.
    
    Fixes: 5adaa1a8c088 ("dt-bindings: pinctrl: spacemit: add K3 SoC support")
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Yixun Lan 
    Signed-off-by: Linus Walleij 

commit 0e7e509963d5952980e3fdba7f8bf22dec8eda12
Author: Kavita Kavita 
Date:   Wed Jan 14 16:48:58 2026 +0530

    wifi: mac80211: add support for EPPKE authentication protocol in non-AP STA mode
    
    Add support for the Enhanced Privacy Protection Key Exchange (EPPKE)
    authentication protocol in non-AP STA mode, as specified in
    "IEEE P802.11bi/D3.0, 12.16.9".
    
    EPPKE is an RSNA authentication protocol that operates using
    Pre-Association Security Negotiation (PASN) procedures. It consists
    of three Authentication frames with transaction sequence numbers 1, 2,
    and 3. The first and third from the non-AP STA and the second from the
    AP STA.
    
    Extend mac80211 to process EPPKE Authentication frames during the
    authentication phase. Currently, mac80211 processes only frames with
    the expected transaction number. In the case of EPPKE, process the
    Authentication frame from the AP only if the transaction number matches
    the expected value, which is 2.
    
    After receiving the final Authentication frame with transaction number 3
    from the non-AP STA, it indicates that both the non-AP STA and the AP
    confirm there are no issues with authentication. Since this is the final
    confirmation frame to send out, mark the state as authenticated in
    mac80211.
    
    For EPPKE authentication, the Multi-Link element (MLE) must be included
    in the Authentication frame body by userspace in case of MLO connection.
    If the MLE is not present, reject the Authentication frame.
    
    Signed-off-by: Kavita Kavita 
    Link: https://patch.msgid.link/20260114111900.2196941-8-kavita.kavita@oss.qualcomm.com
    [remove a single stray space]
    Signed-off-by: Johannes Berg 

commit ac44a110c18ad7bd9de0b809e861479ba97157d2
Author: Borislav Petkov (AMD) 
Date:   Mon Oct 6 17:50:10 2025 +0200

    x86/microcode/AMD: Allow loader debugging to be enabled on baremetal too
    
    Debugging the loader on baremetal does make sense, so enable it there
    too.
    
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260108165028.27417-1-bp@kernel.org

commit 763baca7bf8b36b8ff0e1ec6eb30dbfe99b18fd8
Author: Stefano Stabellini 
Date:   Tue Jan 13 15:24:20 2026 -0800

    xen: introduce xen_console_io option
    
    Xen can support console_io hypercalls for any domains, not just dom0,
    depending on DEBUG and XSM policies. These hypercalls can be very useful
    for development and debugging.
    
    Introduce a kernel command line option xen_console_io to enable the
    usage of console_io hypercalls for any domain upon request. When
    xen_console_io is not specified, the current behavior is retained.
    
    Signed-off-by: Stefano Stabellini 
    Reviewed-by: Juergen Gross 
    Signed-off-by: Juergen Gross 
    Message-ID: 

commit 70812056fbfb9348788e35b7641ff959b711840e
Author: Val Packett 
Date:   Sun Jan 11 05:25:59 2026 -0300

    phy: qcom: edp: Fix NULL pointer dereference for phy v6 (x1e80100)
    
    For Glymur SoC support, the com_clk_fwd_cfg callback was added, and a
    stub implementation was added for the v4 of the hardware. However it
    was omitted for the v6, causing a NULL pointer dereference oops on
    Hamoa/Purwa (X1E/X1P) SoC devices. Fix by adding the appropriate stub.
    
    Fixes: add66a6673bc ("phy: qcom: edp: Add Glymur platform support")
    Reviewed-by: Abel Vesa 
    Signed-off-by: Val Packett 
    Reviewed-by: Neil Armstrong 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Tested-by: Yijie Yang  # Purwa-IoT-EVK
    Link: https://patch.msgid.link/20260111083317.604754-1-val@packett.cool
    Signed-off-by: Vinod Koul 

commit 10303b32519f52a5afd40593a507543143c8ec6a
Author: Kuan-Wei Chiu 
Date:   Tue Jan 13 09:26:01 2026 +0000

    dt-bindings: sound: google,goldfish-audio: Convert to DT schema
    
    Convert the Android Goldfish Audio binding to DT schema format.
    Move the file to the sound directory to match the subsystem.
    Update the example node name to 'sound' to comply with generic node
    naming standards.
    
    Signed-off-by: Kuan-Wei Chiu 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260113092602.3197681-6-visitorckw@gmail.com
    Signed-off-by: Mark Brown 

commit 850c9884b917f440e659a09dd309a46a136adada
Author: Kuninori Morimoto 
Date:   Fri Jan 9 01:15:11 2026 +0000

    ASoC: intel: convert to snd_soc_dapm_xxx()
    
    This patch uses snd_soc_card_to_dapm() to get dapm from card
    
    Signed-off-by: Kuninori Morimoto 
    Link: https://patch.msgid.link/87tswv1t9c.wl-kuninori.morimoto.gx@renesas.com
    Signed-off-by: Mark Brown 

commit da7afdc79cba00f952df12cd579e44832d829c0a
Author: Charles Keepax 
Date:   Fri Jan 9 14:52:06 2026 +0000

    ASoC: SDCA: Add lock to serialise the Function initialisation
    
    To avoid issues on some devices serialise the boot of each SDCA Function
    from the others.
    
    Signed-off-by: Charles Keepax 
    Reviewed-by: Pierre-Louis Bossart 
    Link: https://patch.msgid.link/20260109145206.3456151-5-ckeepax@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit ffd7e8a101110cba86925a2906d925e0db7102f3
Author: Charles Keepax 
Date:   Fri Jan 9 14:52:05 2026 +0000

    ASoC: SDCA: Device boot into the system suspend process
    
    When system suspending the device may be powered off, this means all
    state will be lost and the firmware may need to be re-downloaded. Add
    the necessary calls to bring the device back up. This also requires that
    that the FDL (firmware download) IRQ handler is modified to allow it to
    run before runtime PM has been fully restored.
    
    Signed-off-by: Charles Keepax 
    Reviewed-by: Pierre-Louis Bossart 
    Link: https://patch.msgid.link/20260109145206.3456151-4-ckeepax@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 7a5214f769c7c953c58971027a762f2e191057d4
Author: Charles Keepax 
Date:   Fri Jan 9 14:52:04 2026 +0000

    ASoC: SDCA: Add basic system suspend support
    
    Add basic system suspend support. Disable the IRQs and force runtime
    suspend, during system suspend, because the device will likely fully
    power down during suspend.
    
    Signed-off-by: Charles Keepax 
    Reviewed-by: Pierre-Louis Bossart 
    Link: https://patch.msgid.link/20260109145206.3456151-3-ckeepax@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 9e3d4f794cbe9a4e286b3052cb97908005807aee
Author: Charles Keepax 
Date:   Fri Jan 9 14:52:03 2026 +0000

    ASoC: SDCA: Add SDCA IRQ enable/disable helpers
    
    Add helpers to enable and disable the SDCA IRQs by Function. These are
    useful to sequence the powering down and up around system suspend.
    
    Signed-off-by: Charles Keepax 
    Reviewed-by: Pierre-Louis Bossart 
    Link: https://patch.msgid.link/20260109145206.3456151-2-ckeepax@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 519d0a6b2ca5a891340b6c24a4c40545f518e1a8
Author: Bharadwaj Raju 
Date:   Wed Jan 14 16:03:25 2026 +0530

    ASoC: codecs: aw88261: use dvdd-supply regulator
    
    The AW88261 needs the DVDD pin to be powered on to start up. Get and
    enable the dvdd-supply regulator.
    
    Signed-off-by: Bharadwaj Raju 
    Link: https://patch.msgid.link/20260114-aw88261-dvdd-v2-2-ef485b82a7a7@machinesoul.in
    Signed-off-by: Mark Brown 

commit 18d524de812ff37e7de12a2acddfe7eee6b4ca3c
Author: Bharadwaj Raju 
Date:   Wed Jan 14 16:03:24 2026 +0530

    ASoC: dt-bindings: document dvdd-supply property for awinic,aw88261
    
    Add (and require) the dvdd-supply property for awinic,aw88261 in
    the awinic,aw88395.yaml binding.
    
    The chip needs DVDD to power on, and currently there are no users of
    this compatible in the kernel device trees, so we should be fine to
    change the ABI in this case.
    
    Signed-off-by: Bharadwaj Raju 
    Link: https://patch.msgid.link/20260114-aw88261-dvdd-v2-1-ef485b82a7a7@machinesoul.in
    Signed-off-by: Mark Brown 

commit 8a98e7f55f975360975083166e21982ef307b8fd
Author: Emil Svendsen 
Date:   Tue Jan 13 11:58:53 2026 +0100

    ASoC: tlv320adcx140: add channel sum control
    
    Add control for channel summation.
    
    3 modes are supported:
    
    1. "Disabled": Normal operation
    
    2. "2 Channel": Every two channels are summed and divided by 2
    
      Out 1 <- (CH1 + CH2) / 2
      Out 2 <- (CH1 + CH2) / 2
      Out 3 <- (CH3 + CH4) / 2
      Out 4 <- (CH3 + CH4) / 2
    
    3. "4 Channel": Every four channels are summed and divided by 4
    
      Out 1 <- (CH1 + CH2 + CH3 + CH4) / 4
      Out 2 <- (CH1 + CH2 + CH3 + CH4) / 4
      Out 3 <- (CH1 + CH2 + CH3 + CH4) / 4
      Out 4 <- (CH1 + CH2 + CH3 + CH4) / 4
    
    Signed-off-by: Emil Svendsen 
    Signed-off-by: Sascha Hauer 
    Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-10-8f7ecec525c8@pengutronix.de
    Signed-off-by: Mark Brown 

commit 2219823f7d6ac01c8eb55b90e954b4466146c397
Author: Emil-Juhl 
Date:   Tue Jan 13 11:58:52 2026 +0100

    ASoC: tlv320adcx140: add kcontrol for num biquads
    
    The tlv320adcx140 chips have a configurable amount of biquad filters
    enabled per input channel. Currently this number is always left at the
    default value of 2 biquads per channel.
    This commit adds a kcontrol to allow runtime configuration of the amount
    of biquads per channel.
    
    The configuration is controlled by bits [5-6] in the DSP_CFG1 register.
    
    Signed-off-by: Emil-Juhl 
    Signed-off-by: Sascha Hauer 
    Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-9-8f7ecec525c8@pengutronix.de
    Signed-off-by: Mark Brown 

commit 4a1bc07e6d9ecd29b95c41e34402793619f1874a
Author: Sascha Hauer 
Date:   Tue Jan 13 11:58:51 2026 +0100

    ASoC: dt-bindings: add avdd and iovdd supply
    
    Add bindings for the avdd-supply and iovdd-supply which are named after
    the corresponding pins on the tlv320adcx140 chips.
    
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Sascha Hauer 
    Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-8-8f7ecec525c8@pengutronix.de
    Signed-off-by: Mark Brown 

commit 5682093fc80674ee7f4a96dd9f0f1919111ab16d
Author: Emil-Juhl 
Date:   Tue Jan 13 11:58:50 2026 +0100

    ASoC: dt-bindings: clarify areg-supply documentation
    
    The documentation for areg-supply could cause confusion mainly in terms
    of the relationship between AREG and AVDD.
    According to the datasheet[1] the AREG can be one of two cases:
    
    1) an external 1.8V supply
    2) generated by an internal regulator (hence a 1.8V output)
    
    [1] https://www.ti.com/lit/ds/symlink/tlv320adc5140.pdf
    
    Signed-off-by: Emil-Juhl 
    Signed-off-by: Sascha Hauer 
    Acked-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-7-8f7ecec525c8@pengutronix.de
    Signed-off-by: Mark Brown 

commit 57be1f67401005e33e8c88db6707b4482b509589
Author: Emil-Juhl 
Date:   Tue Jan 13 11:58:49 2026 +0100

    ASoC: tlv320adcx140: add avdd and iovdd supply
    
    The datasheet, under "10 Power Supply Recommendations" section,
    specifies that both the AVDD and IOVDD supplies must be up and stable
    for at least 100us before the SHDNZ can be released. After that, the
    chip is ready to receive commands after another 2ms.
    Currently the driver doesn't contain any options to bind AVDD and IOVDD
    supplies to the tlv320adcx140.
    
    This commit adds bindings for AVDD and IOVDD supplies which the driver
    will enable when used.
    
    Signed-off-by: Emil-Juhl 
    Signed-off-by: Sascha Hauer 
    Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-6-8f7ecec525c8@pengutronix.de
    Signed-off-by: Mark Brown 

commit 24175015263d3c72166902a5a4451c18dc836d56
Author: Emil-Juhl 
Date:   Tue Jan 13 11:58:48 2026 +0100

    ASoC: tlv320adcx140: power on/off the device on demand
    
    The tlv320adcx140 can be connected to controllable AVDD/IOVDD regulators
    which when disabled will reset the registers to their default.  In
    preparation for that switch to register writes to cache only when
    powered off and sync the cached values to the registers when powered
    back on.
    
    Signed-off-by: Emil-Juhl 
    Signed-off-by: Sascha Hauer 
    Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-5-8f7ecec525c8@pengutronix.de
    Signed-off-by: Mark Brown 

commit 5329ed8fced301ce1e0748a46932f4446fe6fc86
Author: Kavita Kavita 
Date:   Wed Jan 14 16:48:57 2026 +0530

    wifi: mac80211: Check for MLE before appending in Authentication frame
    
    Currently, in MLO connections, userspace constructs most of the
    Authentication frame body, excluding the Multi-Link element (MLE),
    which mac80211 appends later in ieee80211_send_auth(). At present,
    mac80211 always adds the MLE itself, since userspace
    (e.g. wpa_supplicant) does not yet include it.
    
    However, for new authentication protocols such as Enhanced Privacy
    Protection Key Exchange (EPPKE), as specified in
    "IEEE P802.11bi/D3.0 section 12.16.9", the MLE must be included in
    userspace so that the Message Integrity Code (MIC) can be computed
    correctly over the complete frame body. Table 9-71 specifies that
    the MIC is mandatory. If mac80211 appends the MLE again, the
    Authentication frame becomes invalid.
    
    Add a check in ieee80211_send_auth() to detect whether the MLE is
    already present in the Authentication frame body before appending.
    Skip the append if the MLE exists, otherwise add it as before.
    
    Signed-off-by: Kavita Kavita 
    Link: https://patch.msgid.link/20260114111900.2196941-7-kavita.kavita@oss.qualcomm.com
    Signed-off-by: Johannes Berg 

commit 63e7e3b6433f634d54dacc39cda4fcc613501715
Author: Kavita Kavita 
Date:   Wed Jan 14 16:48:56 2026 +0530

    wifi: mac80211: allow key installation before association
    
    Currently, mac80211 allows key installation only after association
    completes. However, Enhanced Privacy Protection Key Exchange (EPPKE)
    requires key installation before association to enable encryption and
    decryption of (Re)Association Request and Response frames.
    
    Add support to install keys prior to association when the peer is an
    Enhanced Privacy Protection (EPP) peer that requires encryption and
    decryption of (Re)Association Request and Response frames.
    
    Introduce a new boolean parameter "epp_peer" in the "ieee80211_sta"
    profile to indicate that the peer supports the Enhanced Privacy
    Protection Key Exchange (EPPKE) protocol. For non-AP STA mode, it
    is set when the authentication algorithm is WLAN_AUTH_EPPKE during
    station profile initialization. For AP mode, it is set during
    NL80211_CMD_NEW_STA and NL80211_CMD_ADD_LINK_STA.
    
    When "epp_peer" parameter is set, mac80211 now accepts keys before
    association and enables encryption of the (Re)Association
    Request/Response frames.
    
    Co-developed-by: Sai Pratyusha Magam 
    Signed-off-by: Sai Pratyusha Magam 
    Signed-off-by: Kavita Kavita 
    Link: https://patch.msgid.link/20260114111900.2196941-6-kavita.kavita@oss.qualcomm.com
    Signed-off-by: Johannes Berg 

commit 6ee3a22c61cdf57d71592ec9f3b9439cd5d0c75f
Author: Sai Pratyusha Magam 
Date:   Wed Jan 14 16:48:55 2026 +0530

    wifi: nl80211: Add support for EPP peer indication
    
    Introduce a new netlink attribute NL80211_ATTR_EPP_PEER
    to be used with NL80211_CMD_NEW_STA and
    NL80211_CMD_ADD_LINK_STA for the userspace to indicate
    that a non-AP STA is an Enhanced Privacy Protection (EPP)
    peer.
    
    Co-developed-by: Rohan Dutta 
    Signed-off-by: Rohan Dutta 
    Signed-off-by: Sai Pratyusha Magam 
    Signed-off-by: Kavita Kavita 
    Link: https://patch.msgid.link/20260114111900.2196941-5-kavita.kavita@oss.qualcomm.com
    Signed-off-by: Johannes Berg 

commit dc54de8db669793d54f1ec0629659309299eec8d
Author: Kavita Kavita 
Date:   Wed Jan 14 16:48:54 2026 +0530

    wifi: cfg80211: add support for key configuration before association
    
    Currently, cfg80211 does not allow key installation, removal, or
    modification prior to association in non-AP STA mode. However,
    Enhanced Privacy Protection Key Exchange (EPPKE) requires encryption
    keys to be managed before association.
    
    Add support to manage keys before association in non-AP STA mode when
    the NL80211_EXT_FEATURE_ASSOC_FRAME_ENCRYPTION feature flag is set.
    If the flag is not set, reject the encryption keys.
    
    Signed-off-by: Kavita Kavita 
    Link: https://patch.msgid.link/20260114111900.2196941-4-kavita.kavita@oss.qualcomm.com
    Signed-off-by: Johannes Berg 

commit 9d17a040c15d4b99484f13cf08dd45a9e308beeb
Author: Ainy Kumari 
Date:   Wed Jan 14 16:48:53 2026 +0530

    wifi: cfg80211: add feature flag for (re)association frame encryption
    
    Introduce an extended feature flag that allows drivers to signal
    support for encryption of (Re)Association Request and Response frames
    in both non-AP STA and AP mode, as specified in specification
    "IEEE P802.11bi/D3.0, 12.16.6".
    
    Signed-off-by: Ainy Kumari 
    Signed-off-by: Kavita Kavita 
    Link: https://patch.msgid.link/20260114111900.2196941-3-kavita.kavita@oss.qualcomm.com
    Signed-off-by: Johannes Berg 

commit f29c852149f94dc1975c64fa919b3dd62db04d23
Author: Ainy Kumari 
Date:   Wed Jan 14 16:48:52 2026 +0530

    wifi: cfg80211: add support for EPPKE Authentication Protocol
    
    Add an extended feature flag NL80211_EXT_FEATURE_EPPKE to allow a
    driver to indicate support for the Enhanced Privacy Protection Key
    Exchange (EPPKE) authentication protocol in non-AP STA mode, as
    defined in "IEEE P802.11bi/D3.0, 12.16.9".
    
    In case of SME in userspace, the Authentication frame body is prepared
    in userspace while the driver finalizes the Authentication frame once
    it receives the required fields and elements. The driver indicates
    support for EPPKE using the extended feature flag so that userspace
    can initiate EPPKE authentication.
    
    When the feature flag is set, process EPPKE Authentication frames from
    userspace in non-AP STA mode. If the flag is not set, reject EPPKE
    Authentication frames.
    
    Define a new authentication type NL80211_AUTHTYPE_EPPKE for EPPKE.
    
    Signed-off-by: Ainy Kumari 
    Co-developed-by: Kavita Kavita 
    Signed-off-by: Kavita Kavita 
    Link: https://patch.msgid.link/20260114111900.2196941-2-kavita.kavita@oss.qualcomm.com
    Signed-off-by: Johannes Berg 

commit a699808928937000e550a7cd5355db93ef99e236
Merge: be9d2cf10b46bc e7556b59ba6517
Author: Vinod Koul 
Date:   Wed Jan 14 18:52:57 2026 +0530

    Merge tag 'phy_common_properties' into next
    
    phy common properties
    
    Vladimir Oltean  wrote:
    
    Introduce "rx-polarity" and "tx-polarity" device tree properties with
    Kunit tests

commit e7556b59ba65179612bce3fa56bb53d1b4fb20db
Author: Vladimir Oltean 
Date:   Sun Jan 11 11:39:34 2026 +0200

    phy: add phy_get_rx_polarity() and phy_get_tx_polarity()
    
    Add helpers in the generic PHY folder which can be used using 'select
    PHY_COMMON_PROPS' from Kconfig, without otherwise needing to
    enable GENERIC_PHY.
    
    These helpers need to deal with the slight messiness of the fact that
    the polarity properties are arrays per protocol, and with the fact that
    there is no default value mandated by the standard properties, all
    default values depend on driver and protocol (PHY_POL_NORMAL may be a
    good default for SGMII, whereas PHY_POL_AUTO may be a good default for
    PCIe).
    
    Push the supported mask of polarities to these helpers, to simplify
    drivers such that they don't need to validate what's in the device tree
    (or other firmware description).
    
    Add a KUnit test suite to make sure that the API produces the expected
    results. The fact that we use fwnode structures means we can validate
    with software nodes, and as opposed to the device_property API, we can
    bypass the need to have a device structure.
    
    Co-developed-by: Bjørn Mork 
    Signed-off-by: Bjørn Mork 
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20260111093940.975359-6-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit fceb17ac05e772ffc82f1f008e876bf7752f0576
Author: Vladimir Oltean 
Date:   Sun Jan 11 11:39:33 2026 +0200

    dt-bindings: phy-common-props: RX and TX lane polarity inversion
    
    Differential signaling is a technique for high-speed protocols to be
    more resilient to noise. At the transmit side we have a positive and a
    negative signal which are mirror images of each other. At the receiver,
    if we subtract the negative signal (say of amplitude -A) from the
    positive signal (say +A), we recover the original single-ended signal at
    twice its original amplitude. But any noise, like one coming from EMI
    from outside sources, is supposed to have an almost equal impact upon
    the positive (A + E, E being for "error") and negative signal (-A + E).
    So (A + E) - (-A + E) eliminates this noise, and this is what makes
    differential signaling useful.
    
    Except that in order to work, there must be strict requirements observed
    during PCB design and layout, like the signal traces needing to have the
    same length and be physically close to each other, and many others.
    
    Sometimes it is not easy to fulfill all these requirements, a simple
    case to understand is when on chip A's pins, the positive pin is on the
    left and the negative is on the right, but on the chip B's pins (with
    which A tries to communicate), positive is on the right and negative on
    the left. The signals would need to cross, using vias and other ugly
    stuff that affects signal integrity (introduces impedance
    discontinuities which cause reflections, etc).
    
    So sometimes, board designers intentionally connect differential lanes
    the wrong way, and expect somebody else to invert that signal to recover
    useful data. This is where RX and TX polarity inversion comes in as a
    generic concept that applies to any high-speed serial protocol as long
    as it uses differential signaling.
    
    I've stopped two attempts to introduce more vendor-specific descriptions
    of this only in the past month:
    https://lore.kernel.org/linux-phy/20251110110536.2596490-1-horatiu.vultur@microchip.com/
    https://lore.kernel.org/netdev/20251028000959.3kiac5kwo5pcl4ft@skbuf/
    
    and in the kernel we already have merged:
    - "st,px_rx_pol_inv"
    - "st,pcie-tx-pol-inv"
    - "st,sata-tx-pol-inv"
    - "mediatek,pnswap"
    - "airoha,pnswap-rx"
    - "airoha,pnswap-tx"
    
    and maybe more. So it is pretty general.
    
    One additional element of complexity is introduced by the fact that for
    some protocols, receivers can automatically detect and correct for an
    inverted lane polarity (example: the PCIe LTSSM does this in the
    Polling.Configuration state; the USB 3.1 Link Layer Test Specification
    says that the detection and correction of the lane polarity inversion in
    SuperSpeed operation shall be enabled in Polling.RxEQ.). Whereas for
    other protocols (SGMII, SATA, 10GBase-R, etc etc), the polarity is all
    manual and there is no detection mechanism mandated by their respective
    standards.
    
    So why would one even describe rx-polarity and tx-polarity for protocols
    like PCIe, if it had to always be PHY_POL_AUTO?
    
    Related question: why would we define the polarity as an array per
    protocol? Isn't the physical PCB layout protocol-agnostic, and aren't we
    describing the same physical reality from the lens of different protocols?
    
    The answer to both questions is because multi-protocol PHYs exist
    (supporting e.g. USB2 and USB3, or SATA and PCIe, or PCIe and Ethernet
    over the same lane), one would need to manually set the polarity for
    SATA/Ethernet, while leaving it at auto for PCIe/USB 3.0+.
    
    I also investigated from another angle: what if polarity inversion in
    the PHY is one layer, and then the PCIe/USB3 LTSSM polarity detection is
    another layer on top? Then rx-polarity =  doesn't make
    sense, it can still be rx-polarity =  or ,
    and the link training state machine figures things out on top of that.
    This would radically simplify the design, as the elimination of
    PHY_POL_AUTO inherently means that the need for a property array per
    protocol also goes away.
    
    I don't know how things are in the general case, but at least in the 10G
    and 28G Lynx SerDes blocks from NXP Layerscape devices, this isn't the
    case, and there's only a single level of RX polarity inversion: in the
    SerDes lane. In the case of PCIe, the controller is in charge of driving
    the RDAT_INV bit autonomously, and it is read-only to software.
    
    So the existence of this kind of SerDes lane proves the need for
    PHY_POL_AUTO to be a third state.
    
    Signed-off-by: Vladimir Oltean 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260111093940.975359-5-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 01fc2215940c20bbb22fa196a331ec9d50e45452
Author: Vladimir Oltean 
Date:   Sun Jan 11 11:39:32 2026 +0200

    dt-bindings: phy-common-props: ensure protocol-names are unique
    
    Rob Herring points out that "The default for .*-names is the entries
    don't have to be unique.":
    https://lore.kernel.org/linux-phy/20251204155219.GA1533839-robh@kernel.org/
    
    Let's use uniqueItems: true to make sure the schema enforces this. It
    doesn't make sense in this case to have duplicate properties for the
    same SerDes protocol.
    
    Note that this can only be done with the $defs + $ref pattern as
    established by the previous commit. When the tx-p2p-microvolt-names
    constraints were expressed directly under "properties", it would have
    been validated by the string-array meta-schema, which does not support
    the 'uniqueItems' keyword as can be seen below.
    
    properties:tx-p2p-microvolt-names: Additional properties are not allowed ('uniqueItems' was unexpected)
            from schema $id: http://devicetree.org/meta-schemas/string-array.yaml
    
    Suggested-by: Rob Herring 
    Signed-off-by: Vladimir Oltean 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260111093940.975359-4-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 33c79865c7d3cc84705ed133c101794902e60269
Author: Vladimir Oltean 
Date:   Sun Jan 11 11:39:31 2026 +0200

    dt-bindings: phy-common-props: create a reusable "protocol-names" definition
    
    Other properties also need to be defined per protocol than just
    tx-p2p-microvolt-names. Create a common definition to avoid copying a 55
    line property.
    
    Signed-off-by: Vladimir Oltean 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260111093940.975359-3-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit b7b4dcd96e3dfbb955d152c9ce4b490498b0f4b4
Author: Vladimir Oltean 
Date:   Sun Jan 11 11:39:30 2026 +0200

    dt-bindings: phy: rename transmit-amplitude.yaml to phy-common-props.yaml
    
    I would like to add more properties similar to tx-p2p-microvolt, and I
    don't think it makes sense to create one schema for each such property
    (transmit-amplitude.yaml, lane-polarity.yaml, transmit-equalization.yaml
    etc).
    
    Instead, let's rename to phy-common-props.yaml, which makes it a more
    adequate host schema for all the above properties.
    
    Signed-off-by: Vladimir Oltean 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260111093940.975359-2-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit fb8a6c18fb9a6561f7a15b58b272442b77a242dd
Author: Michael Liang 
Date:   Fri Jan 9 15:52:54 2026 -0700

    dm: clear cloned request bio pointer when last clone bio completes
    
    Stale rq->bio values have been observed to cause double-initialization of
    cloned bios in request-based device-mapper targets, leading to
    use-after-free and double-free scenarios.
    
    One such case occurs when using dm-multipath on top of a PCIe NVMe
    namespace, where cloned request bios are freed during
    blk_complete_request(), but rq->bio is left intact. Subsequent clone
    teardown then attempts to free the same bios again via
    blk_rq_unprep_clone().
    
    The resulting double-free path looks like:
    
      nvme_pci_complete_batch()
        nvme_complete_batch()
          blk_mq_end_request_batch()
            blk_complete_request()        // called on a DM clone request
              bio_endio()                 // first free of all clone bios
              ...
            rq->end_io()                  // end_clone_request()
              dm_complete_request(tio->orig)
                dm_softirq_done()
                  dm_done()
                    dm_end_request()
                      blk_rq_unprep_clone()  // second free of clone bios
    
    Fix this by clearing the clone request's bio pointer when the last cloned
    bio completes, ensuring that later teardown paths do not attempt to free
    already-released bios.
    
    Signed-off-by: Michael Liang 
    Reviewed-by: Mohamed Khalfella 
    Signed-off-by: Mikulas Patocka 
    Cc: stable@vger.kernel.org

commit c84e21a89b77731d69d27c74e92f99b39a5a54ef
Author: Eric Biggers 
Date:   Sun Jan 11 12:26:42 2026 -0800

    dm-verity: fix up various workqueue-related comments
    
    Replace obsolete mentions of "tasklets" with "softirq context", and
    "workqueue" with "kworker".
    
    This reflects the fact that the implementation of the
    "try_verify_in_tasklet" dm-verity option now accesses softirq context
    using either the BH workqueue API or inline execution, not the tasklet
    API.  The old names conflated the API with the intended execution
    context, so they became outdated when the APIs changed.
    
    Signed-off-by: Eric Biggers 
    Signed-off-by: Mikulas Patocka 

commit 17c0e16069765b319debba264c978c9a5c106e08
Author: Eric Biggers 
Date:   Sun Jan 11 12:27:49 2026 -0800

    dm-verity: switch to bio_advance_iter_single()
    
    dm-verity doesn't support data blocks that span pages, and it sets
    dma_alignment accordingly.  As such, instead of using
    bio_advance_iter(), it can use the more lightweight function
    bio_advance_iter_single() to get the same result.
    
    Signed-off-by: Eric Biggers 
    Signed-off-by: Mikulas Patocka 

commit 569e785957d7d27224e39d92bff4d20ab6aab324
Author: Eric Biggers 
Date:   Sun Jan 11 12:25:30 2026 -0800

    dm-verity: consolidate the BH and normal work structs
    
    Since each dm_verity_io is never on both the BH and normal workqueues at
    the same time, there's no need for two different work_structs.  Replace
    the 'bh_work' and 'work' fields with just 'work'.
    
    Note: this is correct even though it means 'work' may be reused while
    verity_bh_work() is running.  The workqueue API allows work functions to
    reuse or free their work_struct, and many workqueue users rely on that.
    
    Signed-off-by: Eric Biggers 
    Signed-off-by: Mikulas Patocka 

commit d4880868670198df321627a949e7b7f2d76cf54e
Author: Marco Crivellari 
Date:   Tue Jan 13 12:03:02 2026 +0100

    dm: add WQ_PERCPU to alloc_workqueue users
    
    This continues the effort to refactor workqueue APIs, which began with
    the introduction of new workqueues and a new alloc_workqueue flag in:
    
       commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
       commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    The refactoring is going to alter the default behavior of
    alloc_workqueue() to be unbound by default.
    
    With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
    any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
    must now use WQ_PERCPU. For more details see the Link tag below.
    
    In order to keep alloc_workqueue() behavior identical, explicitly request
    WQ_PERCPU.
    
    Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Signed-off-by: Mikulas Patocka 

commit c698b7f417801fcd79f0dc844250b3361d38e6b8
Author: Mikulas Patocka 
Date:   Mon Jan 12 21:15:27 2026 +0100

    dm-integrity: fix a typo in the code for write/discard race
    
    If we send a write followed by a discard, it may be possible that the
    discarded data end up being overwritten by the previous write from the
    journal. The code tries to prevent that, but there was a typo in this
    logic that made it not being activated as it should be.
    
    Note that if we end up here the second time (when discard_retried is
    true), it means that the write bio is actually racing with the discard
    bio, and in this situation it is not specified which of them should win.
    
    Cc: stable@vger.kernel.org
    Fixes: 31843edab7cb ("dm integrity: improve discard in journal mode")
    Signed-off-by: Mikulas Patocka 

commit e9f5a55b70ae6187ab64ef2d1232ae2738e31d1f
Author: Mikulas Patocka 
Date:   Thu Jan 8 20:56:20 2026 +0100

    dm: use READ_ONCE in dm_blk_report_zones
    
    The functon dm_blk_report_zones reads md->zone_revalidate_map, however it
    may change while the function is running. Use READ_ONCE.
    
    Signed-off-by: Mikulas Patocka 
    Fixes: 37f53a2c60d0 ("dm: fix dm_blk_report_zones")
    Reviewed-by: Benjamin Marzinski 

commit 24c405fdbe215c45e57bba672cc42859038491ee
Author: Mikulas Patocka 
Date:   Thu Jan 8 20:55:08 2026 +0100

    dm: fix unlocked test for dm_suspended_md
    
    The function dm_blk_report_zones tests if the device is suspended with
    the "dm_suspended_md" call. However, this function is called without
    holding any locks, so the device may be suspended just after it.
    
    Move the call to dm_suspended_md after dm_get_live_table, so that the
    device can't be suspended after the suspended state was tested.
    
    Signed-off-by: Mikulas Patocka 
    Fixes: 37f53a2c60d0 ("dm: fix dm_blk_report_zones")
    Reviewed-by: Benjamin Marzinski 

commit 3a115d42922cffc91b303992eadf220111d66c31
Author: Jerome Brunet 
Date:   Wed Jan 14 11:43:12 2026 +0100

    arm64: dts: amlogic: s4: fix mmc clock assignment
    
    MMC A and C are mis-represented as having their "clkin0" input connected to
    xtal while it is actually connected to the MMC clock, probably in an
    attempt to provide 24MHz to the device on this input.
    
    Fix this and assign the clock to 24MHz to actually provide the required
    rate.
    
    Fixes: 3ab9d54b5d84 ("arm64: dts: amlogic: enable some device nodes for S4")
    Tested-by: Nick Xie 
    Signed-off-by: Jerome Brunet 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-amlogic-s4-mmc-fixup-v3-2-a4d3e136b3f2@baylibre.com
    Signed-off-by: Neil Armstrong 

commit 86124a8becb43eed3103f2459399daee8af2c99d
Author: Jerome Brunet 
Date:   Wed Jan 14 11:43:11 2026 +0100

    arm64: dts: amlogic: s4: assign mmc b clock to 24MHz
    
    The amlogic MMC driver operate with the assumption that MMC clock
    is configured to provide 24MHz. It uses this path for low
    rates such as 400kHz.
    
    This assumption did hold true until but it now, but it is apparently
    not the case with s4. The clock has been reported to provide 1GHz
    instead. This is most likely due to how the bootloader is using the MMC
    clock on this platform.
    
    Regardless of why the MMC clock rate is 1GHz, if the MMC driver expects
    24MHz, the clock should be properly assigned, so assign it.
    
    Reported-by: Nick Xie 
    Closes: https://lore.kernel.org/linux-amlogic/20260113011931.40424-1-nick@khadas.com/
    Fixes: 3ab9d54b5d84 ("arm64: dts: amlogic: enable some device nodes for S4")
    Tested-by: Nick Xie 
    Signed-off-by: Jerome Brunet 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-amlogic-s4-mmc-fixup-v3-1-a4d3e136b3f2@baylibre.com
    Signed-off-by: Neil Armstrong 

commit 126058f8d80aa7176bb230ca03ec939a70435177
Author: Jerome Brunet 
Date:   Wed Jan 14 11:57:40 2026 +0100

    arm64: dts: amlogic: drop useless assigned-clock-parents
    
    Amlogic sound card assigned-clock-parents only have <0> and are useless.
    Remove them.
    
    Signed-off-by: Jerome Brunet 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260114-amlogic-parent-clock-cleanup-v1-1-31078b1e4a2c@baylibre.com
    Signed-off-by: Neil Armstrong 

commit e48407ba576c5bc8b4324df41de5507f7928771e
Merge: e92d336eaf244d ad415677b7e3b7
Author: Greg Kroah-Hartman 
Date:   Wed Jan 14 12:25:50 2026 +0100

    Merge tag 'counter-updates-for-6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-next
    
    William writes:
    
    Counter updates for 6.20
    
    Update MAINTAINERS file to reflect new Intel Quadrature Encoder
    Peripheral counter driver maintainer.
    
    * tag 'counter-updates-for-6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter:
      MAINTAINERS: Update Intel Quadrature Encoder Peripheral maintainer

commit 4b16ad0bf821d4aceb050e9f569dc329883f1c5b
Author: Ben Dooks 
Date:   Mon Jan 12 16:04:13 2026 +0000

    KVM: arm64: Fix missing  include
    
    Include  for kvm_arm_hyp_stack_base
    declaration which fixes the following sparse warning:
    
    arch/arm64/kvm/arm.c:63:1: warning: symbol 'kvm_arm_hyp_stack_base' was not declared. Should it be static?
    
    Signed-off-by: Ben Dooks 
    Link: https://patch.msgid.link/20260112160413.603493-1-ben.dooks@codethink.co.uk
    Signed-off-by: Marc Zyngier 

commit 241bdf7253502c56251ef8b25ab9cad5b6547422
Author: Aristo Chen 
Date:   Mon Jan 12 23:48:29 2026 +0800

    tee: add revision sysfs attribute
    
    Add a generic TEE revision sysfs attribute backed by a new
    optional get_tee_revision() callback. The revision string is
    diagnostic-only and must not be used to infer feature support.
    
    Signed-off-by: Aristo Chen 
    Reviewed-by: Sumit Garg 
    Signed-off-by: Jens Wiklander 

commit cd98e73492102a2ff54923f08c37a2780979ac4c
Author: Geert Uytterhoeven 
Date:   Tue Jan 13 14:15:01 2026 +0100

    drm/rockchip: DRM_ROCKCHIP should depend on ARCH_ROCKCHIP
    
    Rockchip display hardware is only available on Rockchip SoCs.  Hence add
    a dependency on ARCH_ROCKCHIP, to prevent asking the user about this
    driver when configuring a kernel without Rockchip platform support.
    
    Before, this dependency was implicit through a hard dependency on
    ROCKCHIP_IOMMU.
    
    Fixes: 0244539f9a4f3b56 ("drm/rockchip: Drop ROCKCHIP_IOMMU depend for DRM_ROCKCHIP")
    Signed-off-by: Geert Uytterhoeven 
    Reviewed-by: Chaoyi Chen 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/5db192d31cc51f027f107c01c01a353a0569ebf4.1768310045.git.geert+renesas@glider.be

commit 8e8eb10c107e67f22f87cd8c963d30ea73f04d5f
Author: Petteri Kangaslampi 
Date:   Tue Jan 13 19:44:09 2026 +0000

    KVM: arm64: Calculate hyp VA size only once
    
    Calculate the hypervisor's VA size only once to maintain consistency
    between the memory layout and MMU initialization logic. Previously the
    two would be inconsistent when the kernel is configured for less than
    IDMAP_VA_BITS of VA space.
    
    Signed-off-by: Petteri Kangaslampi 
    Tested-by: Vincent Donnefort 
    Link: https://patch.msgid.link/20260113194409.2970324-2-pekangas@google.com
    Signed-off-by: Marc Zyngier 

commit 313c47f4fe4d07eb2969f429a66ad331fe2b3b6f
Author: Christian Brauner 
Date:   Wed Jan 14 11:22:54 2026 +0100

    fs: use nullfs unconditionally as the real rootfs
    
    Remove the "nullfs_rootfs" boot parameter and simply always use nullfs.
    The mutable rootfs will be mounted on top of it. Systems that don't use
    pivot_root() to pivot away from the real rootfs will have an additional
    mount stick around but that shouldn't be a problem at all. If it is
    we'll rever this commit.
    
    This also simplifies the boot process and removes the need for the
    traditional switch_root workarounds.
    
    Suggested-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit bcbd8ef484773580edfcaa3f54d7f27986c7cd1c
Author: Manivannan Sadhasivam 
Date:   Wed Jan 7 19:41:23 2026 +0530

    dt-bindings: ata: sata: Document the graph port
    
    An external connector like M.2 could expose the SATA interface to the
    plugin cards. So add the graph port to establish link between the SATA
    port and the connector node.
    
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Damien Le Moal 

commit 900131320bc9a9ec1d84702b2694b813c11c91b7
Author: Vladimir Zapolskiy 
Date:   Mon Jan 12 23:15:54 2026 +0200

    ARM: s3c: remove a leftover hwmon-s3c.h header file
    
    The last user of defined structures s3c_hwmon_pdata and s3c_hwmon_chcfg
    was removed in commit 0d297df03890 ("ARM: s3c: simplify platform code"),
    thus the platform data header file itself can be removed also.
    
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://patch.msgid.link/20260112211554.3755188-1-vz@mleia.com
    Signed-off-by: Krzysztof Kozlowski 

commit 0ea84089dbf62a92dc7889c79e6b18fc89260808
Author: Damien Le Moal 
Date:   Wed Dec 17 16:40:48 2025 +0900

    ata: libata-scsi: avoid Non-NCQ command starvation
    
    When a non-NCQ command is issued while NCQ commands are being executed,
    ata_scsi_qc_issue() indicates to the SCSI layer that the command issuing
    should be deferred by returning SCSI_MLQUEUE_XXX_BUSY.  This command
    deferring is correct and as mandated by the ACS specifications since
    NCQ and non-NCQ commands cannot be mixed.
    
    However, in the case of a host adapter using multiple submission queues,
    when the target device is under a constant load of NCQ commands, there
    are no guarantees that requeueing the non-NCQ command will be executed
    later and it may be deferred again repeatedly as other submission queues
    can constantly issue NCQ commands from different CPUs ahead of the
    non-NCQ command. This can lead to very long delays for the execution of
    non-NCQ commands, and even complete starvation for these commands in the
    worst case scenario.
    
    Since the block layer and the SCSI layer do not distinguish between
    queueable (NCQ) and non queueable (non-NCQ) commands, libata-scsi SAT
    implementation must ensure forward progress for non-NCQ commands in the
    presence of NCQ command traffic. This is similar to what SAS HBAs with a
    hardware/firmware based SAT implementation do.
    
    Implement such forward progress guarantee by limiting requeueing of
    non-NCQ commands from ata_scsi_qc_issue(): when a non-NCQ command is
    received and NCQ commands are in-flight, do not force a requeue of the
    non-NCQ command by returning SCSI_MLQUEUE_XXX_BUSY and instead return 0
    to indicate that the command was accepted but hold on to the qc using
    the new deferred_qc field of struct ata_port.
    
    This deferred qc will be issued using the work item deferred_qc_work
    running the function ata_scsi_deferred_qc_work() once all in-flight
    commands complete, which is checked with the port qc_defer() callback
    return value indicating that no further delay is necessary. This check
    is done using the helper function ata_scsi_schedule_deferred_qc() which
    is called from ata_scsi_qc_complete(). This thus excludes this mechanism
    from all internal non-NCQ commands issued by ATA EH.
    
    When a port deferred_qc is non NULL, that is, the port has a command
    waiting for the device queue to drain, the issuing of all incoming
    commands (both NCQ and non-NCQ) is deferred using the regular busy
    mechanism. This simplifies the code and also avoids potential denial of
    service problems if a user issues too many non-NCQ commands.
    
    Finally, whenever ata EH is scheduled, regardless of the reason, a
    deferred qc is always requeued so that it can be retried once EH
    completes. This is done by calling the function
    ata_scsi_requeue_deferred_qc() from ata_eh_set_pending(). This avoids
    the need for any special processing for the deferred qc in case of NCQ
    error, link or device reset, or device timeout.
    
    Reported-by: Xingui Yang 
    Reported-by: Igor Pylypiv 
    Fixes: bdb01301f3ea ("scsi: Add host and host template flag 'host_tagset'")
    Cc: stable@vger.kernel.org
    Signed-off-by: Damien Le Moal 
    Reviewed-by: Niklas Cassel 
    Reviewed-by: Martin K. Petersen 
    Reviewed-by: John Garry 
    Tested-by: Igor Pylypiv 
    Tested-by: Xingui Yang 

commit be9d2cf10b46bc2c177aa9cb27b71d665d1e0e7e
Author: Pradeep P V K 
Date:   Tue Jan 6 21:12:04 2026 +0530

    dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: Add QMP UFS PHY compatible
    
    Document QMP UFS PHY compatible for x1e80100 SoC. Use SM8550 as a
    fallback since x1e80100 is fully compatible with it.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Pradeep P V K 
    Link: https://patch.msgid.link/20260106154207.1871487-2-pradeep.pragallapati@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit a6a9aeaba36f42ed6dc4cdb865ae6b7ded4e855b
Author: Ronak Raheja 
Date:   Thu Jan 8 10:54:59 2026 +0530

    dt-bindings: phy: qcom,m31-eusb2-phy: Document M31 eUSB2 PHY for Kaanapali
    
    Document M31 eUSB2 PHY for Kaanapali which handles the USB2 path. Use
    fallback to indicate the compatibility of the M31 eUSB2 PHY on the
    Kaanapali with that on the SM8750.
    
    Signed-off-by: Ronak Raheja 
    Co-developed-by: Jingyi Wang 
    Signed-off-by: Jingyi Wang 
    Signed-off-by: Krishna Kurapati 
    Acked-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260108052459.1819970-3-krishna.kurapati@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 69efc71162b5742381de29f661c913013b254c2b
Author: Ronak Raheja 
Date:   Thu Jan 8 10:54:58 2026 +0530

    dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: Add Kaanapali QMP PHY
    
    Document QMP combo PHY for Kaanapali. Use fallback to indicate the
    compatibility of the QMP PHY on the Kaanapali with that on the SM8750.
    
    Signed-off-by: Ronak Raheja 
    Co-developed-by: Jingyi Wang 
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Krishna Kurapati 
    Link: https://patch.msgid.link/20260108052459.1819970-2-krishna.kurapati@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 02cf3710c55d55d956f080e6610b841e2b6ddca0
Author: Swapnil Jakhade 
Date:   Mon Jan 12 11:16:31 2026 +0530

    phy: cadence-torrent: Add PCIe + XAUI multilink configuration for 100MHz refclk
    
    Add register sequences for PCIe + XAUI multilink configuration for
    100MHz reference clock.
    
    The register sequences are fetched from a table by indexing entries based
    on unique 'keys' generated by the Bitwise OR defined below:
            REFCLK0_RATE | REFCLK1_RATE | LINK0_TYPE | LINK1_TYPE | SSC_TYPE
    
    As of now, LINK_TYPE is a 3-bit value corresponding to the PHY type.
    With the introduction of TYPE_XAUI, we need a 4-bit value to represent
    the LINK_TYPE as TYPE_XAUI has the numerical value 8. Hence, extend the
    LINKx_MASK macros to 4-bit masks. While at it, extend REFCLKx_MASK macros
    as well to 4-bit masks to support reference clock frequencies that will be
    added in the future.
    
    Adjust the 'LINKx_SHIFT' and the 'REFCLKx_SHIFT' macros to account for
    the aforementioned changes made to the masks.
    
    Signed-off-by: Swapnil Jakhade 
    [s-vadapalli: elaborated on changes made to macros in the commit message]
    Signed-off-by: Siddharth Vadapalli 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/20260112054636.108027-3-s-vadapalli@ti.com
    Signed-off-by: Vinod Koul 

commit a632a2a0db8b4d24076a03889efa25c6058d0746
Author: Swapnil Jakhade 
Date:   Mon Jan 12 11:16:30 2026 +0530

    dt-bindings: phy: Add PHY_TYPE_XAUI definition
    
    XAUI (eXtended Attachment Unit Interface) is a high-speed serial interface
    standard for 10 Gigabit Ethernet (10GbE). It uses four lanes with each
    lane operating at 3.125 Gbps (totaling 10 Gbps), to extend the XGMII
    interface across circuit boards, commonly used in backplanes for
    networking switches and high-performance computing. XAUI is defined as a
    standardized instantiation of XGMII Extender in the IEEE 802.3
    specification.
    
    Add definition for XAUI PHY type.
    
    Signed-off-by: Swapnil Jakhade 
    [s-vadapalli: added detailed description of XAUI in the commit message]
    Signed-off-by: Siddharth Vadapalli 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260112054636.108027-2-s-vadapalli@ti.com
    Signed-off-by: Vinod Koul 

commit d33d77044c37aa97f24e3e3adf2f781aba774db2
Author: Chen-Yu Tsai 
Date:   Wed Jan 14 17:26:04 2026 +0800

    arm64: dts: mediatek: mt8183-kukui: Clean up IT6505 regulator supply
    
    Align the name of the regulator with the design schematic. Also fix up
    the gpio property to the new "gpios" property name, and add the
    GPIO_ACTIVE_HIGH flag. The flag is actively ignored in Linux in favor of
    the old "enable-active-high" property; nevertheless it is the correct
    description.
    
    Signed-off-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 24991bfbbd84d68d5710e1563752047914db941a
Author: Krishna Kurapati 
Date:   Sat Oct 18 02:04:38 2025 +0530

    phy: qcom: qmp-combo: Add polarity inversion support for SAR2130P
    
    On SAR2130P QXR Platform, the CC Lines are inverted and the lane
    programming is to be done reverse compared to other targets.
    
    As per the HW specifics, Bit-2 of TYPEC_CTRL register indicates
    port select polarity. This bit is to be set for SAR2130P.
    
    Signed-off-by: Krishna Kurapati 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://patch.msgid.link/20251017203438.744197-1-krishna.kurapati@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 3554ded4f02aa8e95af66911aa666b2cd192022d
Author: Luca Weiss 
Date:   Mon Jan 12 14:53:17 2026 +0100

    phy: qcom-qmp-ufs: Add Milos support
    
    Add the init sequence tables and config for the UFS QMP phy found in the
    Milos SoC.
    
    Reviewed-by: Abel Vesa 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Luca Weiss 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260112-milos-ufs-v2-4-d3ce4f61f030@fairphone.com
    Signed-off-by: Vinod Koul 

commit ed0a26aa453b6ec7faec32ddb4fb3d4360e1676c
Author: Luca Weiss 
Date:   Mon Jan 12 14:53:16 2026 +0100

    dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: document the Milos QMP UFS PHY
    
    Document the QMP UFS PHY on the Milos SoC.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Luca Weiss 
    Link: https://patch.msgid.link/20260112-milos-ufs-v2-3-d3ce4f61f030@fairphone.com
    Signed-off-by: Vinod Koul 

commit 877686f9f42b58b04e4e25d07034bc95cadc20f3
Author: Marco Crivellari 
Date:   Wed Nov 5 16:20:23 2025 +0100

    phy: sun4i-usb: replace use of system_wq with system_percpu_wq
    
    Currently if a user enqueues a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    
    This lack of consistency cannot be addressed without refactoring the API.
    
    This patch continues the effort to refactor worqueue APIs, which has begun
    with the change introducing new workqueues and a new alloc_workqueue flag:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    Replace system_wq with system_percpu_wq, keeping the same behavior.
    The old wq (system_wq) will be kept for a few release cycles.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Reviewed-by: Jernej Skrabec 
    Link: https://patch.msgid.link/20251105152023.259813-1-marco.crivellari@suse.com
    Signed-off-by: Vinod Koul 

commit a0db08f47c836251fbaccf711e12fe8428235465
Author: Thorsten Blum 
Date:   Mon Jan 5 13:49:41 2026 +0100

    tee: amdtee: Remove unused return variables
    
    In tee_params_to_amd_params() and amd_params_to_tee_params(), return 0
    directly and remove the unused return variables.
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Jens Wiklander 

commit b82f3047dae4aba38cb26c55c28444db4d77f521
Author: Petre Rodan 
Date:   Wed Jan 14 09:51:38 2026 +0200

    iio: pressure: abp2030pa: remove error message
    
    Do not print a duplicate error message if devm_request_irq() fails.
    
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Petre Rodan 
    Signed-off-by: Jonathan Cameron 

commit 1ec5e098ef5f9cefdaccca3747b5e3802fb8b2bf
Author: Petre Rodan 
Date:   Wed Jan 14 09:51:37 2026 +0200

    iio: pressure: abp2030pa: fix typo in Kconfig description
    
    Replace "I2C" with "SPI" in the SPI module description.
    
    Signed-off-by: Petre Rodan 
    Signed-off-by: Jonathan Cameron 

commit 32c5491a8d73713578560f515cccd4e9460d156d
Author: AngeloGioacchino Del Regno 
Date:   Mon Jan 12 15:55:58 2026 +0100

    arm64: dts: mediatek: mt7986a: Change compatible for SafeXcel crypto
    
    Following the changes in the binding for the SafeXcel crypto
    engine, add a SoC specific compatible to the existing crypto
    node and, while at it, also change the fallback compatible to
    inside-secure,safexcel-eip97ies as the eip97 one is deprecated.
    
    Signed-off-by: AngeloGioacchino Del Regno 

commit 093d6e332259583a94d630897bdb07d6141bff57
Author: AngeloGioacchino Del Regno 
Date:   Tue Jan 13 12:00:26 2026 +0100

    arm64: dts: mediatek: mt8173-evb: Add interrupts to DA9211 regulator
    
    Add the required pinmux and assign the right interrupts-extended
    to the DA9211 regulator (PIO pin 15).
    
    Reviewed-by: Matthias Brugger 
    Signed-off-by: AngeloGioacchino Del Regno 

commit a40901fe6f5c27856b7112a6e635b13446ec4c7b
Author: AngeloGioacchino Del Regno 
Date:   Tue Jan 13 12:00:00 2026 +0100

    arm64: dts: mediatek: mt6795-xperia-m5: Rename PMIC leds node
    
    The MT6332 PMIC leds node was named "mt6332-led", however, the
    binding rightfully enforces using the generic node name "leds".
    
    Change it to the latter to resolve dtbs_check warnings.
    
    Signed-off-by: AngeloGioacchino Del Regno 

commit aec5445dd7c8c6c84d46f2dbf07967ac54393595
Author: AngeloGioacchino Del Regno 
Date:   Tue Jan 13 11:59:59 2026 +0100

    arm64: dts: mediatek: mt6795: Fix issues in SCPSYS node
    
    Add the "mediatek,mt6795-scpsys" compatible to the SCPSYS node
    and remove #power-domain-cells (retaining it only in the power
    controller subnode) to resolve dtbs_check warnings.
    
    Signed-off-by: AngeloGioacchino Del Regno 

commit 178c08fd8ce53c77910fb16cc99e932049b6c6e8
Author: AngeloGioacchino Del Regno 
Date:   Tue Jan 13 11:59:58 2026 +0100

    arm64: dts: mediatek: mt6331: Fix VCAM IO regulator name
    
    The ldo-vcamio regulator is named "vcam_io", however, the binding
    only allows "vcamio" as name: change it to the latter to resolve
    a dtbs_check warning.
    
    Signed-off-by: AngeloGioacchino Del Regno 

commit 10a62a0611f5544d209446acfde5beb7b27773c7
Author: Ian Rogers 
Date:   Thu Oct 16 13:51:26 2025 -0700

    tools headers: Remove unneeded ignoring of warnings in unaligned.h
    
    Now that get/put_unaligned() use memcpy() the -Wpacked and -Wattributes
    warnings don't need disabling anymore.
    
    Signed-off-by: Ian Rogers 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251016205126.2882625-5-irogers@google.com

commit 1d7cf255eefbb479d0eea9aa3b6372a1e52f8c62
Author: Ian Rogers 
Date:   Thu Oct 16 13:51:25 2025 -0700

    tools headers: Update the linux/unaligned.h copy with the kernel sources
    
    To pick up the changes in:
    
      vdso: Switch get/put_unaligned() from packed struct to memcpy
    
    As the code is dependent on __unqual_scalar_typeof, update also the tools
    version of compiler_types.h to include this.
    
    Signed-off-by: Ian Rogers 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251016205126.2882625-4-irogers@google.com

commit a339671db64b12bb02492557d2b0658811286277
Author: Ian Rogers 
Date:   Thu Oct 16 13:51:24 2025 -0700

    vdso: Switch get/put_unaligned() from packed struct to memcpy()
    
    Type punning is necessary for get/put_unaligned() but the use of a packed
    struct violates strict aliasing rules, requiring -fno-strict-aliasing to be
    passed to the C compiler.
    
    Switch to using memcpy() so that -fno-strict-aliasing isn't necessary.
    
    Signed-off-by: Ian Rogers 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251016205126.2882625-3-irogers@google.com

commit df0f9a664be55a8529362a1ada847a19a91e4807
Author: Ian Rogers 
Date:   Thu Oct 16 13:51:23 2025 -0700

    parisc: Inline a type punning version of get_unaligned_le32()
    
    Reading the byte/char output_len with get_unaligned_le32() can trigger
    compiler warnings due to the size read. Avoid these warnings by using
    type punning. This avoids issues when switching get_unaligned_t() to
    __builtin_memcpy().
    
    Signed-off-by: Ian Rogers 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251016205126.2882625-2-irogers@google.com

commit 7158fc54b2c6f124eec0d7cd13bff69da0172e59
Author: Thomas Weißschuh 
Date:   Tue Dec 30 08:08:44 2025 +0100

    vdso: Remove struct getcpu_cache
    
    The cache parameter of getcpu() is useless nowadays for various reasons.
    
      * It is never passed by userspace for either the vDSO or syscalls.
      * It is never used by the kernel.
      * It could not be made to work on the current vDSO architecture.
      * The structure definition is not part of the UAPI headers.
      * vdso_getcpu() is superseded by restartable sequences in any case.
    
    Remove the struct and its header.
    
    As a side-effect this gets rid of an unwanted inclusion of the linux/
    header namespace from vDSO code.
    
    [ tglx: Adapt to s390 upstream changes */
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Acked-by: Arnd Bergmann 
    Acked-by: Heiko Carstens  # s390
    Link: https://patch.msgid.link/20251230-getcpu_cache-v3-1-fb9c5f880ebe@linutronix.de

commit 6b2ff1d7c57ef49cd17ffe132173e05ab11a5213
Author: Fei Yang 
Date:   Mon Jan 12 14:03:30 2026 -0800

    drm/xe: vram addr range is expanded to bit[17:8]
    
    The bit field used to be [14:8] with [17:15] marked as SPARE and
    defaulted to 0. So, simply expand the read to bit[17:8] assuming
    the platforms using only bit[14:8] have zeros in the expanded bits.
    
    BSpec: 54991
    
    Signed-off-by: Fei Yang 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20260112220330.2267122-2-fei.yang@intel.com

commit a3753a331989d84024dcc0e3f301e4d0ebf4fda1
Author: Marco Crivellari 
Date:   Mon Jan 12 10:44:06 2026 +0100

    drm/xe: Replace use of system_wq with tlb_inval->timeout_wq
    
    This patch continues the effort to refactor workqueue APIs, which has begun
    with the changes introducing new workqueues and a new alloc_workqueue flag:
    
       commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
       commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    The point of the refactoring is to eventually alter the default behavior of
    workqueues to become unbound by default so that their workload placement is
    optimized by the scheduler.
    
    Before that to happen, workqueue users must be converted to the better named
    new workqueues with no intended behaviour changes:
    
       system_wq -> system_percpu_wq
       system_unbound_wq -> system_dfl_wq
    
    This way the old obsolete workqueues (system_wq, system_unbound_wq) can be
    removed in the future.
    
    After a carefully evaluation, because this is the fence signaling path, we
    changed the code in order to use one of the Xe's workqueue.
    
    So, a new workqueue named 'timeout_wq' has been added to
    'struct xe_tlb_inval' and has been initialized with 'gt->ordered_wq'
    changing the system_wq uses with tlb_inval->timeout_wq.
    
    Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20260112094406.82641-1-marco.crivellari@suse.com

commit b5d712e5b87fc56ff838684afb1bae359eb8069f
Author: Shawn Lin 
Date:   Wed Dec 24 18:01:01 2025 +0800

    PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
    
    Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR
    memories and they cause below resource allocation issue during probe.
    
      pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port
      pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff]
      pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff]
      pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref]
            ...
      pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
      pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
      pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
      pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned
      pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing
      pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing
      pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
      pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
      pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
    
    Since there is no use of the Root Port BAR memories, disable both of them.
    
    Signed-off-by: Shawn Lin 
    [mani: reworded the description and comment]
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com

commit 8c4ef23bbc60123d7b566672ec2da564f5cd545c
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:55:11 2026 +0100

    i2c: mlxbf: Use HZ_PER_KHZ in the driver
    
    Use predefined HZ_PER_MHZ constant where it is appropriate.
    
    Signed-off-by: Andy Shevchenko 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260112135603.4150952-3-andriy.shevchenko@linux.intel.com

commit bc78670a29769458e31536693170dcfb755cf4d2
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:55:10 2026 +0100

    i2c: mlxbf: Remove unused bus speed definitions
    
    The driver had been converted to use standard constants for the bus speed
    a long time ago. Remove the leftover definitions.
    
    Signed-off-by: Andy Shevchenko 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260112135603.4150952-2-andriy.shevchenko@linux.intel.com

commit 71ebc45fa052c2c20e4255f01176a54c437eecd2
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:22:42 2026 +0100

    i2c: core: Use dev_fwnode()
    
    irq_domain_create_linear() takes fwnode as the first argument. It can be
    extracted from the struct device using dev_fwnode() helper instead of using
    direct dereference().
    
    So use the dev_fwnode() helper.
    
    Signed-off-by: Andy Shevchenko 
    Signed-off-by: Wolfram Sang 

commit 861e0f8d81d727389311b58539952d0ca2095b9d
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:22:41 2026 +0100

    i2c: core: Replace custom implementation of device_match_fwnode()
    
    Replace custom implementation of the device_match_fwnode().
    
    Signed-off-by: Andy Shevchenko 
    Signed-off-by: Wolfram Sang 

commit 1a1c74b66af815c5eacf73d5ec6e79e21e102fcf
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:22:40 2026 +0100

    i2c: core: Check for error pointer for fwnode
    
    Theoretically it's possible that fwnode is returned by some API,
    that may return an error pointer (and we have, for example,
    fwnode_find_reference() which does that). If such an fwnode
    is supplied to the i2c core APIs the functions will perform
    unneeded loops and checks. Avoid this by preventively checking
    for an error pointer and bail out immediately.
    
    Signed-off-by: Andy Shevchenko 
    Signed-off-by: Wolfram Sang 

commit aa1292d109a65c9145e3311057ee28098fad78a8
Author: Louis-Alexis Eyraud 
Date:   Thu Oct 30 08:56:29 2025 +0100

    dt-bindings: i2c: i2c-mt65xx: Add compatible for MT8189 SoC
    
    Add compatible string for MT8189 SoC.
    Its multiple I2C controller instances are compatible with the ones
    found in the MT8188 SoC.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Reviewed-by: AngeloGioacchino Del Regno 
    Acked-by: Conor Dooley 
    Signed-off-by: Wolfram Sang 

commit 1ac9e16dd226a26a479c7392c9ec28f1c9eec61c
Author: Akhil R 
Date:   Tue Nov 18 19:36:20 2025 +0530

    i2c: tegra: Add Tegra264 support
    
    Add support for Tegra264 SoC which supports 17 generic I2C controllers,
    two of which are in the AON (always-on) partition of the SoC. In
    addition to the features supported by Tegra194 it also supports a
    SW mutex register to allow sharing the same I2C instance across
    multiple firmware.
    
    Signed-off-by: Akhil R 
    Signed-off-by: Kartik Rajput 
    Reviewed-by: Jon Hunter 
    Acked-by: Thierry Reding 
    Signed-off-by: Wolfram Sang 

commit 6077cfd716fbd4d1f2a3702e49ae8bf65c072685
Author: Kartik Rajput 
Date:   Tue Nov 18 19:36:19 2025 +0530

    i2c: tegra: Add support for SW mutex register
    
    Add support for SW mutex register introduced in Tegra264 to provide
    an option to share the interface between multiple firmwares and/or
    VMs. This involves following steps:
    
     - A firmware/OS writes its unique ID to the mutex REQUEST field.
     - Ownership is established when reading the GRANT field returns the
       same ID.
     - If GRANT shows a different non-zero ID, the firmware/OS retries
       until timeout.
     - After completing access, it releases the mutex by writing 0.
    
    However, the hardware does not ensure any protection based on the
    values. The driver/firmware should honor the peer who already holds
    the mutex.
    
    Signed-off-by: Kartik Rajput 
    Signed-off-by: Akhil R 
    Reviewed-by: Jon Hunter 
    Acked-by: Thierry Reding 
    Signed-off-by: Wolfram Sang 

commit 978b3ccbbac326cc5fe48c98a0440bdc79d9fd93
Author: Akhil R 
Date:   Tue Nov 18 19:36:18 2025 +0530

    i2c: tegra: Add HS mode support
    
    Add support for High Speed (HS) mode transfers for Tegra194 and later
    chips. While HS mode has been documented in the technical reference
    manuals since Tegra20, the hardware implementation appears to be broken
    on all chips prior to Tegra194.
    
    When HS mode is not supported, set the frequency to FM+ instead.
    
    Signed-off-by: Akhil R 
    Signed-off-by: Kartik Rajput 
    Reviewed-by: Jon Hunter 
    Acked-by: Thierry Reding 
    Signed-off-by: Wolfram Sang 

commit 81d4c5350f0148543bd4541a6d1fb06d9c835aeb
Author: Akhil R 
Date:   Tue Nov 18 19:36:17 2025 +0530

    i2c: tegra: Update Tegra256 timing parameters
    
    Update the timing parameters of Tegra256 so that the signals are complaint
    with the I2C specification for SCL low time.
    
    Signed-off-by: Akhil R 
    Reviewed-by: Jon Hunter 
    Acked-by: Thierry Reding 
    Signed-off-by: Wolfram Sang 

commit 8b80b61e6f4fea1fab4f48ed6af2d9b8946f8049
Author: Akhil R 
Date:   Tue Nov 18 19:36:16 2025 +0530

    i2c: tegra: Use separate variables for fast and fastplus
    
    The current implementation uses a single value of THIGH, TLOW and setup
    hold time for both fast and fastplus. But these values can be different
    for each speed mode and should be using separate variables. Split the
    variables used for fast and fast plus mode.
    
    Signed-off-by: Akhil R 
    Reviewed-by: Jon Hunter 
    Acked-by: Thierry Reding 
    Signed-off-by: Wolfram Sang 

commit b53232fd220ad5ecc29b1cb4d4e1355365bc5026
Author: Kartik Rajput 
Date:   Tue Nov 18 19:36:15 2025 +0530

    i2c: tegra: Do not configure DMA if not supported
    
    On Tegra264, not all I2C controllers have the necessary interface to
    GPC DMA, this causes failures when function tegra_i2c_init_dma()
    is called.
    
    Ensure that "dmas" device-tree property is present before initializing
    DMA in function tegra_i2c_init_dma().
    
    Signed-off-by: Kartik Rajput 
    Reviewed-by: Jon Hunter 
    Acked-by: Thierry Reding 
    Signed-off-by: Wolfram Sang 

commit f8a6e5eac701369afb5d69aba875dc5fec93003d
Author: Vladimir Zapolskiy 
Date:   Tue Jan 13 17:11:40 2026 +0200

    Input: adp5589 - remove a leftover header file
    
    In commit 3bdbd0858df6 ("Input: adp5589: remove the driver") the last user
    of include/linux/input/adp5589.h was removed along with the whole driver,
    thus the header file can be also removed.
    
    Signed-off-by: Vladimir Zapolskiy 
    Reviewed-by: Laurent Pinchart 
    Reviewed-by: Nuno Sá 
    Fixes: 3bdbd0858df6 ("Input: adp5589: remove the driver")
    Link: https://patch.msgid.link/20260113151140.3843753-1-vz@mleia.com
    Signed-off-by: Dmitry Torokhov 

commit 1aab44c02ad26f0c59bf015bc01cc63c4f9e2d68
Merge: a3bf6ee15a59d2 5c720260e840b5
Author: Bjorn Andersson 
Date:   Tue Jan 13 21:44:18 2026 -0600

    Merge branch '20260105-kvmrprocv10-v10-0-022e96815380@oss.qualcomm.com' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into rproc-next
    
    Merge the support for loading and managing TustZone-based remote
    processors found in the Qualcomm Glymur platform from a shared topic
    branch, as it's a mix of qcom-soc and remoteproc patches.

commit 46c76760febfb14618d88f6a01fca2d93d003082
Merge: bbdbed193bcf57 c656807675e096
Author: Alexei Starovoitov 
Date:   Tue Jan 13 19:35:14 2026 -0800

    Merge branch 'properly-load-insn-array-values-with-offsets'
    
    Anton Protopopov says:
    
    ====================
    properly load insn array values with offsets
    
    As was reported by the BPF CI bot in [1] the direct address
    of an instruction array returned by map_direct_value_addr()
    is incorrect if the offset is non-zero. Fix this bug and
    add selftests.
    
    Also (commit 2), return EACCES instead of EINVAL when offsets
    aren't correct.
    
      [1] https://lore.kernel.org/bpf/0447c47ac58306546a5dbdbad2601f3e77fa8eb24f3a4254dda3a39f6133e68f@mail.kernel.org/
    ====================
    
    Link: https://patch.msgid.link/20260111153047.8388-1-a.s.protopopov@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit c656807675e09604af09a4b9f3ea466af91b7b7a
Author: Anton Protopopov 
Date:   Sun Jan 11 15:30:47 2026 +0000

    selftests/bpf: Add tests for loading insn array values with offsets
    
    The ldimm64 instruction for map value supports an offset.
    For insn array maps it wasn't tested before, as normally
    such instructions aren't generated. However, this is still
    possible to pass such instructions, so add a few tests to
    check that correct offsets work properly and incorrect
    offsets are rejected.
    
    Signed-off-by: Anton Protopopov 
    Link: https://lore.kernel.org/r/20260111153047.8388-4-a.s.protopopov@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit 7e525860e7250355bcb01ae9779154512b5e5e88
Author: Anton Protopopov 
Date:   Sun Jan 11 15:30:46 2026 +0000

    bpf: Return EACCES for incorrect access to insn array
    
    The insn_array_map_direct_value_addr() function currently returns
    -EINVAL when the offset within the map is invalid. Change this to
    return -EACCES, so that it is consistent with similar boundary access
    checks in the verifier.
    
    Signed-off-by: Anton Protopopov 
    Reviewed-by: Emil Tsalapatis 
    Link: https://lore.kernel.org/r/20260111153047.8388-3-a.s.protopopov@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit e3bd7bdf5ffe49d8381e42843f6e98cd0c78a1e8
Author: Anton Protopopov 
Date:   Sun Jan 11 15:30:45 2026 +0000

    bpf: Return proper address for non-zero offsets in insn array
    
    The map_direct_value_addr() function of the instruction
    array map incorrectly adds offset to the resulting address.
    This is a bug, because later the resolve_pseudo_ldimm64()
    function adds the offset. Fix it. Corresponding selftests
    are added in a consequent commit.
    
    Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps")
    Signed-off-by: Anton Protopopov 
    Reviewed-by: Emil Tsalapatis 
    Link: https://lore.kernel.org/r/20260111153047.8388-2-a.s.protopopov@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit 29b3a61e4e74725dd55311177da38ce8b186e523
Merge: 0da7824734d8d8 5c720260e840b5
Author: Bjorn Andersson 
Date:   Tue Jan 13 21:31:31 2026 -0600

    Merge branch '20260105-kvmrprocv10-v10-0-022e96815380@oss.qualcomm.com' into drivers-for-6.20
    
    Merge the support for loading and managing the TrustZone-based remote
    processors found in the Glymur platform through a topic branch, as it's
    a mix of qcom-soc and remoteproc patches.

commit bbdbed193bcf57f1e9c0d9d58c3ad3350bfd0bd1
Author: Matt Bobrowski 
Date:   Tue Jan 13 08:39:49 2026 +0000

    selftests/bpf: assert BPF kfunc default trusted pointer semantics
    
    The BPF verifier was recently updated to treat pointers to struct types
    returned from BPF kfuncs as implicitly trusted by default. Add a new
    test case to exercise this new implicit trust semantic.
    
    The KF_ACQUIRE flag was dropped from the bpf_get_root_mem_cgroup()
    kfunc because it returns a global pointer to root_mem_cgroup without
    performing any explicit reference counting. This makes it an ideal
    candidate to verify the new implicit trusted pointer semantics.
    
    Signed-off-by: Matt Bobrowski 
    Acked-by: Kumar Kartikeya Dwivedi 
    Link: https://lore.kernel.org/r/20260113083949.2502978-3-mattbobrowski@google.com
    Signed-off-by: Alexei Starovoitov 

commit e463b6de9da17995a2ddabf199cc00c65a8a5392
Author: Matt Bobrowski 
Date:   Tue Jan 13 08:39:48 2026 +0000

    bpf: drop KF_ACQUIRE flag on BPF kfunc bpf_get_root_mem_cgroup()
    
    With the BPF verifier now treating pointers to struct types returned
    from BPF kfuncs as implicitly trusted by default, there is no need for
    bpf_get_root_mem_cgroup() to be annotated with the KF_ACQUIRE flag.
    
    bpf_get_root_mem_cgroup() does not acquire any references, but rather
    simply returns a NULL pointer or a pointer to a struct mem_cgroup
    object that is valid for the entire lifetime of the kernel.
    
    This simplifies BPF programs using this kfunc by removing the
    requirement to pair the call with bpf_put_mem_cgroup().
    
    Signed-off-by: Matt Bobrowski 
    Acked-by: Kumar Kartikeya Dwivedi 
    Link: https://lore.kernel.org/r/20260113083949.2502978-2-mattbobrowski@google.com
    Signed-off-by: Alexei Starovoitov 

commit f8ade2342e22e7dbc71af496f07c900f8c69dd54
Author: Matt Bobrowski 
Date:   Tue Jan 13 08:39:47 2026 +0000

    bpf: return PTR_TO_BTF_ID | PTR_TRUSTED from BPF kfuncs by default
    
    Teach the BPF verifier to treat pointers to struct types returned from
    BPF kfuncs as implicitly trusted (PTR_TO_BTF_ID | PTR_TRUSTED) by
    default. Returning untrusted pointers to struct types from BPF kfuncs
    should be considered an exception only, and certainly not the norm.
    
    Update existing selftests to reflect the change in register type
    printing (e.g. `ptr_` becoming `trusted_ptr_` in verifier error
    messages).
    
    Link: https://lore.kernel.org/bpf/aV4nbCaMfIoM0awM@google.com/
    Signed-off-by: Matt Bobrowski 
    Acked-by: Kumar Kartikeya Dwivedi 
    Link: https://lore.kernel.org/r/20260113083949.2502978-1-mattbobrowski@google.com
    Signed-off-by: Alexei Starovoitov 

commit 3b194343c25084a8d2fa0c0f2c9e80f3080fd732
Author: Dipayaan Roy 
Date:   Mon Jan 12 05:05:52 2026 -0800

    net: mana: Implement ndo_tx_timeout and serialize queue resets per port.
    
    Implement .ndo_tx_timeout for MANA so any stalled TX queue can be detected
    and a device-controlled port reset for all queues can be scheduled to a
    ordered workqueue. The reset for all queues on stall detection is
    recomended by hardware team.
    
    Reviewed-by: Pavan Chebbi 
    Reviewed-by: Haiyang Zhang 
    Signed-off-by: Dipayaan Roy 
    Link: https://patch.msgid.link/20260112130552.GA11785@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net
    Signed-off-by: Jakub Kicinski 

commit 969994f03237aa99c1add0606fa4343245d9a2cc
Author: Jinseok Kim 
Date:   Sun Jan 11 20:41:47 2026 -0800

    net: sxgbe: fix typo in comment
    
    Fix a misspelling in the sxgbe_mtl_init() function comment.
    "Algorith" should be spelled as "Algorithm".
    
    Signed-off-by: Jinseok Kim 
    Link: https://patch.msgid.link/20260112044147.2844-1-always.starving0@gmail.com
    Signed-off-by: Jakub Kicinski 

commit f5d5c17b5fe59112370b11e0cc19497b7bb8a399
Merge: 8619e429d62f17 ca8934f80c4f38
Author: Jakub Kicinski 
Date:   Tue Jan 13 18:58:52 2026 -0800

    Merge branch 'net-phy-fixed_phy-replace-list-of-fixed-phys-with-static-array'
    
    Heiner Kallweit says:
    
    ====================
    net: phy: fixed_phy: replace list of fixed PHYs with static array
    
    Due to max 32 PHY addresses being available per mii bus, using a list
    can't support more fixed PHY's. And there's no known use case for as
    much as 32 fixed PHY's on a system. 8 should be plenty of fixed PHY's,
    so use an array of that size instead of a list. This allows to
    significantly reduce the code size and complexity.
    In addition replace heavy-weight IDA with a simple bitmap.
    ====================
    
    Link: https://patch.msgid.link/110f676d-727c-4575-abe4-e383f98fc38f@gmail.com
    Signed-off-by: Jakub Kicinski 

commit ca8934f80c4f386a08a4e6132a8943a8b0380ec7
Author: Heiner Kallweit 
Date:   Sun Jan 11 13:43:22 2026 +0100

    net: phy: fixed_phy: replace IDA with a bitmap
    
    Size of array fmb_fixed_phys is small, so we can use a simple bitmap
    instead of an IDA to manage dynamic allocation of fixed PHY's.
    find_first_zero_bit() isn't atomic, so we need the loop to rule out
    double allocation of a PHY address.
    
    Suggested-by: Jakub Kicinski 
    Signed-off-by: Heiner Kallweit 
    Tested-by: Maxime Chevallier 
    Reviewed-by: Maxime Chevallier 
    Link: https://patch.msgid.link/d4614463-d532-41fc-92e9-ef97107aceb5@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 511cb45260228e19c4659d67251267d5dadceaac
Author: Heiner Kallweit 
Date:   Sun Jan 11 13:41:39 2026 +0100

    net: phy: fixed_phy: replace list of fixed PHYs with static array
    
    Due to max 32 PHY addresses being available per mii bus, using a list
    can't support more fixed PHY's. And there's no known use case for as
    much as 32 fixed PHY's on a system. 8 should be plenty of fixed PHY's,
    so use an array of that size instead of a list. This allows to
    significantly reduce the code size and complexity.
    
    Signed-off-by: Heiner Kallweit 
    Tested-by: Maxime Chevallier 
    Reviewed-by: Maxime Chevallier 
    Link: https://patch.msgid.link/8610d30c-eac7-4100-9008-d3b6cee6a5cd@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 8619e429d62f1706440a8efb91399395c4c4bdf3
Merge: 75fe2b7adc2e93 f8f9ee9d8b2ed1
Author: Jakub Kicinski 
Date:   Tue Jan 13 18:57:38 2026 -0800

    Merge branch 'ipv6-allow-for-nexthop-device-mismatch-with-onlink'
    
    Ido Schimmel says:
    
    ====================
    ipv6: Allow for nexthop device mismatch with "onlink"
    
    This patchset aligns IPv6 with IPv4 with respect to the "onlink" keyword
    and allows IPv6 routes to be configured with a gateway address that is
    resolved out of a different interface than the one specified.
    
    Patches #1-#3 are small preparations in the existing "onlink" selftest.
    
    Patch #4 is the actual change. See the commit message for detailed
    description and motivation.
    
    Patch #5 adds test cases for both address families, to make sure that
    this use case does not regress.
    ====================
    
    Link: https://patch.msgid.link/20260111120813.159799-1-idosch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit f8f9ee9d8b2ed1f29309399020f2fc30f7f93035
Author: Ido Schimmel 
Date:   Sun Jan 11 14:08:13 2026 +0200

    selftests: fib-onlink: Add test cases for nexthop device mismatch
    
    Add test cases that verify that when the "onlink" keyword is specified,
    both address families (with and without VRF) accept routes with a
    gateway address that is reachable via a different interface than the one
    specified.
    
    Output without "ipv6: Allow for nexthop device mismatch with "onlink"":
    
     # ./fib-onlink-tests.sh | grep mismatch
     TEST: nexthop device mismatch                             [ OK ]
     TEST: nexthop device mismatch                             [ OK ]
     TEST: nexthop device mismatch                             [FAIL]
     TEST: nexthop device mismatch                             [FAIL]
    
    Output with "ipv6: Allow for nexthop device mismatch with "onlink"":
    
     # ./fib-onlink-tests.sh | grep mismatch
     TEST: nexthop device mismatch                             [ OK ]
     TEST: nexthop device mismatch                             [ OK ]
     TEST: nexthop device mismatch                             [ OK ]
     TEST: nexthop device mismatch                             [ OK ]
    
    That is, the IPv4 tests were always passing, but the IPv6 ones only pass
    after the specified patch.
    
    Reviewed-by: Petr Machata 
    Signed-off-by: Ido Schimmel 
    Reviewed-by: David Ahern 
    Link: https://patch.msgid.link/20260111120813.159799-6-idosch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit b853b94e848216b82ecaa0d5d3c7f6c9066e32a4
Author: Ido Schimmel 
Date:   Sun Jan 11 14:08:12 2026 +0200

    ipv6: Allow for nexthop device mismatch with "onlink"
    
    IPv4 allows for a nexthop device mismatch when the "onlink" keyword is
    specified:
    
     # ip link add name dummy1 up type dummy
     # ip address add 192.0.2.1/24 dev dummy1
     # ip link add name dummy2 up type dummy
     # ip route add 198.51.100.0/24 nexthop via 192.0.2.2 dev dummy2
     Error: Nexthop has invalid gateway.
     # ip route add 198.51.100.0/24 nexthop via 192.0.2.2 dev dummy2 onlink
     # echo $?
     0
    
    This seems to be consistent with the description of "onlink" in the
    ip-route man page: "Pretend that the nexthop is directly attached to
    this link, even if it does not match any interface prefix".
    
    On the other hand, IPv6 rejects a nexthop device mismatch, even when
    "onlink" is specified:
    
     # ip link add name dummy1 up type dummy
     # ip address add 2001:db8:1::1/64 dev dummy1
     # ip link add name dummy2 up type dummy
     # ip route add 2001:db8:10::/64 nexthop via 2001:db8:1::2 dev dummy2
     RTNETLINK answers: No route to host
     # ip route add 2001:db8:10::/64 nexthop via 2001:db8:1::2 dev dummy2 onlink
     Error: Nexthop has invalid gateway or device mismatch.
    
    This is intentional according to commit fc1e64e1092f ("net/ipv6: Add
    support for onlink flag") which added IPv6 "onlink" support and states
    that "any unicast gateway is allowed as long as the gateway is not a
    local address and if it resolves it must match the given device".
    
    The condition was later relaxed in commit 4ed591c8ab44 ("net/ipv6: Allow
    onlink routes to have a device mismatch if it is the default route") to
    allow for a nexthop device mismatch if the gateway address is resolved
    via the default route:
    
     # ip link add name dummy1 up type dummy
     # ip route add ::/0 dev dummy1
     # ip link add name dummy2 up type dummy
     # ip route add 2001:db8:10::/64 nexthop via 2001:db8:1::2 dev dummy2
     RTNETLINK answers: No route to host
     # ip route add 2001:db8:10::/64 nexthop via 2001:db8:1::2 dev dummy2 onlink
     # echo $?
     0
    
    While the decision to forbid a nexthop device mismatch in IPv6 seems to
    be intentional, it is unclear why it was made. Especially when it
    differs from IPv4 and seems to go against the intended behavior of
    "onlink".
    
    Therefore, relax the condition further and allow for a nexthop device
    mismatch when "onlink" is specified:
    
     # ip link add name dummy1 up type dummy
     # ip address add 2001:db8:1::1/64 dev dummy1
     # ip link add name dummy2 up type dummy
     # ip route add 2001:db8:10::/64 nexthop via 2001:db8:1::2 dev dummy2 onlink
     # echo $?
     0
    
    The motivating use case is the fact that FRR would like to be able to
    configure overlay routes of the following form:
    
     # ip route add  vrf  encap ip id  src  dst  via  dev vxlan0 onlink
    
    Where vxlan0 is in the default VRF in which "VTEP-Z" is reachable via
    one of the underlay routes (e.g., via swpX). Without this patch, the
    above only works with IPv4, but not with IPv6.
    
    Reviewed-by: Petr Machata 
    Signed-off-by: Ido Schimmel 
    Reviewed-by: David Ahern 
    Link: https://patch.msgid.link/20260111120813.159799-5-idosch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit 9bf8345fb38ab9bd771bd430073cbd3e912fcf75
Author: Ido Schimmel 
Date:   Sun Jan 11 14:08:11 2026 +0200

    selftests: fib-onlink: Add a test case for IPv4 multicast gateway
    
    A multicast gateway address should be rejected when "onlink" is
    specified, but it is only tested as part of the IPv6 tests. Add an
    equivalent IPv4 test.
    
     # ./fib-onlink-tests.sh -v
     [...]
     COMMAND: ip ro add table 254 169.254.101.12/32 via 233.252.0.1 dev veth1 onlink
     Error: Nexthop has invalid gateway.
    
     TEST: Invalid gw - multicast address                      [ OK ]
     [...]
     COMMAND: ip ro add table 1101 169.254.102.12/32 via 233.252.0.1 dev veth5 onlink
     Error: Nexthop has invalid gateway.
    
     TEST: Invalid gw - multicast address, VRF                 [ OK ]
     [...]
     Tests passed:  37
     Tests failed:   0
    
    Reviewed-by: Petr Machata 
    Signed-off-by: Ido Schimmel 
    Reviewed-by: David Ahern 
    Link: https://patch.msgid.link/20260111120813.159799-4-idosch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit 0a3419f4ba407b9624c315bfd6f0056caf536898
Author: Ido Schimmel 
Date:   Sun Jan 11 14:08:10 2026 +0200

    selftests: fib-onlink: Remove "wrong nexthop device" IPv6 tests
    
    The command in the test fails as expected because IPv6 forbids a nexthop
    device mismatch:
    
     # ./fib-onlink-tests.sh -v
     [...]
     COMMAND: ip -6 ro add table 1101 2001:db8:102::103/128 via 2001:db8:701::64 dev veth5 onlink
     Error: Nexthop has invalid gateway or device mismatch.
    
     TEST: Gateway resolves to wrong nexthop device - VRF      [ OK ]
     [...]
    
    Where:
    
     # ip route get 2001:db8:701::64 vrf lisa
     2001:db8:701::64 dev veth7 table 1101 proto kernel src 2001:db8:701::1 metric 256 pref medium
    
    This is in contrast to IPv4 where a nexthop device mismatch is allowed
    when "onlink" is specified:
    
     # ip route get 169.254.7.2 vrf lisa
     169.254.7.2 dev veth7 table 1101 src 169.254.7.1 uid 0
     # ip ro add table 1101 169.254.102.103/32 via 169.254.7.2 dev veth5 onlink
     # echo $?
     0
    
    Remove these tests in preparation for aligning IPv6 with IPv4 and
    allowing nexthop device mismatch when "onlink" is specified.
    
    A subsequent patch will add tests that verify that both address families
    allow a nexthop device mismatch with "onlink".
    
    Reviewed-by: Petr Machata 
    Signed-off-by: Ido Schimmel 
    Reviewed-by: David Ahern 
    Link: https://patch.msgid.link/20260111120813.159799-3-idosch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit e5566f6b1d13e9bc0a458babb880916e212c45fb
Author: Ido Schimmel 
Date:   Sun Jan 11 14:08:09 2026 +0200

    selftests: fib-onlink: Remove "wrong nexthop device" IPv4 tests
    
    According to the test description, these tests fail because of a wrong
    nexthop device:
    
     # ./fib-onlink-tests.sh -v
     [...]
     COMMAND: ip ro add table 254 169.254.101.102/32 via 169.254.3.1 dev veth1 onlink
     Error: Nexthop has invalid gateway.
    
     TEST: Gateway resolves to wrong nexthop device            [ OK ]
     COMMAND: ip ro add table 1101 169.254.102.103/32 via 169.254.7.1 dev veth5 onlink
     Error: Nexthop has invalid gateway.
    
     TEST: Gateway resolves to wrong nexthop device - VRF      [ OK ]
     [...]
    
    But this is incorrect. They fail because the gateway addresses are local
    addresses:
    
     # ip -4 address show
     [...]
     28: veth3@if27:  mtu 1500 qdisc noqueue state UP group default qlen 1000 link-netns peer_ns-Urqh3o
         inet 169.254.3.1/24 scope global veth3
     [...]
     32: veth7@if31:  mtu 1500 qdisc noqueue master lisa state UP group default qlen 1000 link-netns peer_ns-Urqh3o
         inet 169.254.7.1/24 scope global veth7
    
    Therefore, using a local address that matches the nexthop device fails
    as well:
    
     # ip ro add table 254 169.254.101.102/32 via 169.254.3.1 dev veth3 onlink
     Error: Nexthop has invalid gateway.
    
    Using a gateway address with a "wrong" nexthop device is actually valid
    and allowed:
    
     # ip route get 169.254.1.2
     169.254.1.2 dev veth1 src 169.254.1.1 uid 0
     # ip ro add table 254 169.254.101.102/32 via 169.254.1.2 dev veth3 onlink
     # echo $?
     0
    
    Remove these tests given that their output is confusing and that the
    scenario that they are testing is already covered by other tests.
    
    A subsequent patch will add tests for the nexthop device mismatch
    scenario.
    
    Reviewed-by: Petr Machata 
    Signed-off-by: Ido Schimmel 
    Reviewed-by: David Ahern 
    Link: https://patch.msgid.link/20260111120813.159799-2-idosch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit 75fe2b7adc2e9359357184b9eb17f0cff3ba46d8
Merge: 8d48d92eab053b 62518b5b3d8e3a
Author: Jakub Kicinski 
Date:   Tue Jan 13 18:52:37 2026 -0800

    Merge branch 'net-phy-introduce-phy-ports-representation'
    
    Maxime Chevallier says:
    
    ====================
    net: phy: Introduce PHY ports representation
    
    A few important notes:
    
     - This is only a first phase. It instantiates the port, and leverage
       that to make the MAC <-> PHY <-> SFP usecase simpler.
    
     - Next phase will deal with controlling the port state, as well as the
       netlink uAPI for that.
    
     - The end-goal is to enable support for complex port MUX. This
       preliminary work focuses on PHY-driven ports, but this will be
       extended to support muxing at the MII level (Multi-phy, or compo PHY
       + SFP as found on Turris Omnia for example).
    
     - The naming is definitely not set in stone. I named that "phy_port",
       but this may convey the false sense that this is phylib-specific.
       Even the word "port" is not that great, as it already has several
       different meanings in the net world (switch port, devlink port,
       etc.). I used the term "connector" in the binding.
    
    A bit of history on that work :
    
    The end goal that I personnaly want to achieve is :
    
                + PHY - RJ45
                |
     MAC - MUX -+ PHY - RJ45
    
    After many discussions here on netdev@, but also at netdevconf[1] and
    LPC[2], there appears to be several analoguous designs that exist out
    there.
    
    [1] : https://netdevconf.info/0x17/sessions/talk/improving-multi-phy-and-multi-port-interfaces.html
    [2] : https://lpc.events/event/18/contributions/1964/ (video isn't the
    right one)
    
    Take the MAchiatobin, it has 2 interfaces that looks like this :
    
     MAC - PHY -+ RJ45
                |
                + SFP - Whatever the module does
    
    Now, looking at the Turris Omnia, we have :
    
     MAC - MUX -+ PHY - RJ45
                |
                + SFP - Whatever the module does
    
    We can find more example of this kind of designs, the common part is
    that we expose multiple front-facing media ports. This is what this
    current work aims at supporting. As of right now, it does'nt add any
    support for muxing, but this will come later on.
    
    This first phase focuses on phy-driven ports only, but there are already
    quite some challenges already. For one, we can't really autodetect how
    many ports are sitting behind a PHY. That's why this series introduces a
    new binding. Describing ports in DT should however be a last-resort
    thing when we need to clear some ambiguity about the PHY media-side.
    
    The only use-cases that we have today for multi-port PHYs are combo PHYs
    that drive both a Copper port and an SFP (the Macchiatobin case). This
    in itself is challenging and this series only addresses part of this
    support, by registering a phy_port for the PHY <-> SFP connection. The
    SFP module should in the end be considered as a port as well, but that's
    not yet the case.
    
    However, because now PHYs can register phy_ports for every media-side
    interface they have, they can register the capabilities of their ports,
    which allows making the PHY-driver SFP case much more generic.
    ====================
    
    Link: https://patch.msgid.link/20260108080041.553250-1-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit 62518b5b3d8e3a29a64c28e91ae3ec624b46ccd2
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:39 2026 +0100

    Documentation: networking: Document the phy_port infrastructure
    
    This documentation aims at describing the main goal of the phy_port
    infrastructure.
    
    Reviewed-by: Christophe Leroy 
    Reviewed-by: Andrew Lunn 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-15-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit bad869b5e41a08424ff130fd6bb41b854be70095
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:38 2026 +0100

    net: phy: Only rely on phy_port for PHY-driven SFP
    
    Now that all PHY drivers that support downstream SFP have been converted
    to phy_port serdes handling, we can make the generic PHY SFP handling
    mandatory, thus making all phylib sfp helpers static.
    
    Reviewed-by: Christophe Leroy 
    Reviewed-by: Andrew Lunn 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-14-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit 154bc3b66c313c6213dbc75defeb2fbe19e49dc8
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:37 2026 +0100

    net: phy: qca807x: Support SFP through phy_port interface
    
    QCA8072/8075 may be used as combo-port PHYs, with Serdes (100/1000BaseX)
     and Copper interfaces. The PHY has the ability to read the configuration
    it's in.  If the configuration indicates the PHY is in combo mode, allow
    registering up to 2 ports.
    
    Register a dedicated set of port ops to handle the serdes port, and rely
    on generic phylib SFP support for the SFP handling.
    
    Reviewed-by: Christophe Leroy 
    Reviewed-by: Andrew Lunn 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-13-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit 4e26a284b9be6ee99d2e0924a708299f8264e483
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:36 2026 +0100

    net: phy: at803x: Support SFP through phy_port interface
    
    Convert the at803x driver to use the generic phylib SFP handling, via a
    dedicated .attach_port() callback, populating the supported interfaces.
    
    As these devices are limited to 1000BaseX, a workaround is used to also
    support, in a very limited way, copper modules. This is done by
    supporting SGMII but limiting it to 1G full duplex (in which case it's
    somewhat compatible with 1000BaseX).
    
    Reviewed-by: Christophe Leroy 
    Reviewed-by: Andrew Lunn 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-12-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit 35d1a5464b476aa98b7b76ce41bb4de748cebfc2
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:35 2026 +0100

    net: phy: marvell10g: Support SFP through phy_port
    
    Convert the Marvell10G driver to use the generic SFP handling, through a
    dedicated .attach_port() handler to populate the port's supported
    interfaces.
    
    As the 88x3310 supports multiple MDI, the .attach_port() logic handles
    both SFP attach with 10GBaseR support, and support for the "regular"
    port that usually is a BaseT port.
    
    Reviewed-by: Andrew Lunn 
    Reviewed-by: Christophe Leroy 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-11-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit 1384e138382991b226364f4915128998c25d6a36
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:34 2026 +0100

    net: phy: marvell: Support SFP through phy_port interface
    
    Convert the Marvell driver (especially the 88e1512 driver) to use the
    phy_port interface to handle SFPs. This means registering a
    .attach_port() handler to detect when a serdes line interface is used
    (most likely, and SFP module).
    
    Reviewed-by: Christophe Leroy 
    Reviewed-by: Andrew Lunn 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-10-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit ea317f077a38d42e88851f236556dd4e167476e8
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:33 2026 +0100

    net: phy: marvell-88x2222: Support SFP through phy_port interface
    
    The 88x2222 PHY from Marvell only supports serialised modes as its
    line-facing interfaces. Convert that driver to the generic phylib SFP
    handling.
    
    Reviewed-by: Christophe Leroy 
    Reviewed-by: Andrew Lunn 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-9-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit d7c6082f7e7771dcc999ea07dba32658b2ed0dfd
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:32 2026 +0100

    net: phy: Introduce generic SFP handling for PHY drivers
    
    There are currently 4 PHY drivers that can drive downstream SFPs:
    marvell.c, marvell10g.c, at803x.c and marvell-88x2222.c. Most of the
    logic is boilerplate, either calling into generic phylib helpers (for
    SFP PHY attach, bus attach, etc.) or performing the same tasks with a
    bit of validation :
     - Getting the module's expected interface mode
     - Making sure the PHY supports it
     - Optionaly perform some configuration to make sure the PHY outputs
       the right mode
    
    This can be made more generic by leveraging the phy_port, and its
    configure_mii() callback which allows setting a port's interfaces when
    the port is a serdes.
    
    Introduce a generic PHY SFP support. If a driver doesn't probe the SFP
    bus itself, but an SFP phandle is found in devicetree/firmware, then the
    generic PHY SFP support will be used, relying on port ops.
    
    PHY driver need to :
     - Register a .attach_port() callback
     - When a serdes port is registered to the PHY, drivers must set
       port->interfaces to the set of PHY_INTERFACE_MODE the port can output
     - If the port has limitations regarding speed, duplex and aneg, the
       port can also fine-tune the final linkmodes that can be supported
     - The port may register a set of ops, including .configure_mii(), that
       will be called at module_insert time to adjust the interface based on
       the module detected.
    
    Reviewed-by: Christophe Leroy 
    Reviewed-by: Andrew Lunn 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-8-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit 07f3ca9e092cb881466da0d726431a977f33858f
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:31 2026 +0100

    net: phy: Create a phy_port for PHY-driven SFPs
    
    Some PHY devices may be used as media-converters to drive SFP ports (for
    example, to allow using SFP when the SoC can only output RGMII). This is
    already supported to some extend by allowing PHY drivers to registers
    themselves as being SFP upstream.
    
    However, the logic to drive the SFP can actually be split to a per-port
    control logic, allowing support for multi-port PHYs, or PHYs that can
    either drive SFPs or Copper.
    
    To that extent, create a phy_port when registering an SFP bus onto a
    PHY. This port is considered a "serdes" port, in that it can feed data
    to another entity on the link. The PHY driver needs to specify the
    various PHY_INTERFACE_MODE_XXX that this port supports.
    
    Reviewed-by: Andrew Lunn 
    Reviewed-by: Christophe Leroy 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-7-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit ffb8587363a3567131fdf3f49e4e3d7e9f8b48d5
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:30 2026 +0100

    dt-bindings: net: dp83822: Deprecate ti,fiber-mode
    
    The newly added ethernet-connector binding allows describing an Ethernet
    connector with greater precision, and in a more generic manner, than
    ti,fiber-mode. Deprecate this property.
    
    Reviewed-by: Rob Herring (Arm) 
    Reviewed-by: Christophe Leroy 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-6-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit 333c29a27f96bfe1577af68fc3856bb17034f755
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:29 2026 +0100

    net: phy: dp83822: Add support for phy_port representation
    
    With the phy_port representation introduced, we can use .attach_port to
    populate the port information based on either the straps or the
    ti,fiber-mode property. This allows simplifying the probe function and
    allow users to override the strapping configuration.
    
    Reviewed-by: Christophe Leroy 
    Reviewed-by: Andrew Lunn 
    Tested-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Link: https://patch.msgid.link/20260108080041.553250-5-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit 589e934d2735b55fbe68517128668df7af3ac4ae
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:28 2026 +0100

    net: phy: Introduce PHY ports representation
    
    Ethernet provides a wide variety of layer 1 protocols and standards for
    data transmission. The front-facing ports of an interface have their own
    complexity and configurability.
    
    Introduce a representation of these front-facing ports. The current code
    is minimalistic and only support ports controlled by PHY devices, but
    the plan is to extend that to SFP as well as raw Ethernet MACs that
    don't use PHY devices.
    
    This minimal port representation allows describing the media and number
    of pairs of a BaseT port. From that information, we can derive the
    linkmodes usable on the port, which can be used to limit the
    capabilities of an interface.
    
    For now, the port pairs and medium is derived from devicetree, defined
    by the PHY driver, or populated with default values (as we assume that
    all PHYs expose at least one port).
    
    The typical example is 100M ethernet. 100BaseTX works using only 2
    pairs on a Cat 5 cables. However, in the situation where a 10/100/1000
    capable PHY is wired to its RJ45 port through 2 pairs only, we have no
    way of detecting that. The "max-speed" DT property can be used, but a
    more accurate representation can be used :
    
    mdi {
            connector-0 {
                    media = "BaseT";
                    pairs = <2>;
            };
    };
    
    From that information, we can derive the max speed reachable on the
    port.
    
    Another benefit of having that is to avoid vendor-specific DT properties
    (micrel,fiber-mode or ti,fiber-mode).
    
    This basic representation is meant to be expanded, by the introduction
    of port ops, userspace listing of ports, and support for multi-port
    devices.
    
    Reviewed-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/20260108080041.553250-4-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit 3f25ff740950b8e850a8b6e637c48f1d23ecf388
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:27 2026 +0100

    net: ethtool: Introduce ETHTOOL_LINK_MEDIUM_* values
    
    In an effort to have a better representation of Ethernet ports,
    introduce enumeration values representing the various ethernet Mediums.
    
    This is part of the 802.3 naming convention, for example :
    
    1000 Base T 4
     |    |   | |
     |    |   | \_ pairs (4)
     |    |   \___ Medium (T == Twisted Copper Pairs)
     |    \_______ Baseband transmission
     \____________ Speed
    
     Other example :
    
    10000 Base K X 4
               | | \_ lanes (4)
               | \___ encoding (BaseX is 8b/10b while BaseR is 66b/64b)
               \_____ Medium (K is backplane ethernet)
    
    In the case of representing a physical port, only the medium and number
    of pairs should be relevant. One exception would be 1000BaseX, which is
    currently also used as a medium in what appears to be any of 1000BaseSX,
    1000BaseCX, 1000BaseLX, 1000BaseEX, 1000BaseBX10 and some other.
    
    This was reflected in the mediums associated with the 1000BaseX linkmode.
    
    These mediums are set in the net/ethtool/common.c lookup table that
    maintains a list of all linkmodes with their number of pairs, medium,
    encoding, speed and duplex.
    
    One notable exception to this is 100BaseT Ethernet. It emcompasses 100BaseTX,
    which is a 2-pairs protocol but also 100BaseT4, that will also work on 4-pairs
    cables. As we don't make a disctinction between these,  the lookup table
    contains 2 sets of pair numbers, indicating the min number of pairs for a
    protocol to work and the "nominal" number of pairs as well.
    
    Another set of exceptions are linkmodes such 100000baseLR4_ER4, where
    the same link mode seems to represent 100GBaseLR4 and 100GBaseER4. The
    macro __DEFINE_LINK_MODE_PARAMS_MEDIUMS is here used to populate the
    .mediums bitfield with all appropriate mediums.
    
    Reviewed-by: Christophe Leroy 
    Signed-off-by: Maxime Chevallier 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/20260108080041.553250-3-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit fb7a8d0786e491e8dbd5fd72d5a5d042901c8076
Author: Maxime Chevallier 
Date:   Thu Jan 8 09:00:26 2026 +0100

    dt-bindings: net: Introduce the ethernet-connector description
    
    The ability to describe the physical ports of Ethernet devices is useful
    to describe multi-port devices, as well as to remove any ambiguity with
    regard to the nature of the port.
    
    Moreover, describing ports allows for a better description of features
    that are tied to connectors, such as PoE through the PSE-PD devices.
    
    Introduce a binding to allow describing the ports, for now with 2
    attributes :
    
     - The number of pairs, which is a quite generic property that allows
       differentating between multiple similar technologies such as BaseT1
       and "regular" BaseT (which usually means BaseT4).
    
     - The media that can be used on that port, such as BaseT for Twisted
       Copper, BaseC for coax copper, BaseS/L for Fiber, BaseK for backplane
       ethernet, etc. This allows defining the nature of the port, and
       therefore avoids the need for vendor-specific properties such as
       "micrel,fiber-mode" or "ti,fiber-mode".
    
    The port description lives in its own file, as it is intended in the
    future to allow describing the ports for phy-less devices.
    
    Signed-off-by: Maxime Chevallier 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260108080041.553250-2-maxime.chevallier@bootlin.com
    Signed-off-by: Jakub Kicinski 

commit d1de61db1536727c1cad049c09decff22e8b6dd7
Author: Pavel Begunkov 
Date:   Wed Nov 19 15:53:55 2025 +0000

    io_uring/zcrx: document area chunking parameter
    
    struct io_uring_zcrx_ifq_reg::rx_buf_len is used as a hint specifying
    the kernel what buffer size it should use. Document the API and
    limitations.
    
    Signed-off-by: Pavel Begunkov 

commit a32bb32d019332394aee9e2befea4fec05a672e4
Author: Pavel Begunkov 
Date:   Wed Nov 19 12:15:20 2025 +0000

    selftests: iou-zcrx: test large chunk sizes
    
    Add a test using large chunks for zcrx memory area.
    
    Signed-off-by: Pavel Begunkov 

commit f96e1b35779e153be266fd7de50bda0c5553ad21
Author: Pavel Begunkov 
Date:   Mon Oct 13 23:10:32 2025 +0100

    eth: bnxt: support qcfg provided rx page size
    
    Implement support for qcfg provided rx page sizes. For that, implement
    the ndo_default_qcfg callback and validate the config on restart. Also,
    use the current config's value in bnxt_init_ring_struct to retain the
    correct size across resets.
    
    Signed-off-by: Pavel Begunkov 

commit c55bf90a2112d7a831d8427034b71ff9fbb78285
Author: Jakub Kicinski 
Date:   Mon Apr 21 15:28:21 2025 -0700

    eth: bnxt: adjust the fill level of agg queues with larger buffers
    
    The driver tries to provision more agg buffers than header buffers
    since multiple agg segments can reuse the same header. The calculation
    / heuristic tries to provide enough pages for 65k of data for each header
    (or 4 frags per header if the result is too big). This calculation is
    currently global to the adapter. If we increase the buffer sizes 8x
    we don't want 8x the amount of memory sitting on the rings.
    Luckily we don't have to fill the rings completely, adjust
    the fill level dynamically in case particular queue has buffers
    larger than the global size.
    
    Signed-off-by: Jakub Kicinski 
    [pavel: rebase on top of agg_size_fac]
    Signed-off-by: Pavel Begunkov 

commit f57efb32aae1da5c0a25acf473ef4ab559894adf
Author: Pavel Begunkov 
Date:   Mon Apr 21 15:28:11 2025 -0700

    eth: bnxt: store rx buffer size per queue
    
    Instead of using a constant buffer length, allow configuring the size
    for each queue separately. There is no way to change the length yet, and
    it'll be passed from memory providers in a later patch.
    
    Suggested-by: Jakub Kicinski 
    Signed-off-by: Pavel Begunkov 

commit c0b709bf438ba9d197d369f55e4a97603fd4a705
Author: Pavel Begunkov 
Date:   Tue Jan 6 13:25:40 2026 +0000

    net: pass queue rx page size from memory provider
    
    Allow memory providers to configure rx queues with a custom receive
    page size. It's passed in struct pp_memory_provider_params, which is
    copied into the queue, so it's preserved across queue restarts. Then,
    it's propagated to the driver in a new queue config parameter.
    
    Drivers should explicitly opt into using it by setting
    QCFG_RX_PAGE_SIZE, in which case they should implement ndo_default_qcfg,
    validate the size on queue restart and honour the current config in case
    of a reset.
    
    Signed-off-by: Pavel Begunkov 

commit efcb9a4d32d3d9b924642c086b868bfbb9a07c13
Author: Pavel Begunkov 
Date:   Tue Jan 6 13:25:40 2026 +0000

    net: add bare bone queue configs
    
    We'll need to pass extra parameters when allocating a queue for memory
    providers. Define a new structure for queue configurations, and pass it
    to qapi callbacks. It's empty for now, actual parameters will be added
    in following patches.
    
    Configurations should persist across resets, and for that they're
    default-initialised on device registration and stored in struct
    netdev_rx_queue. We also add a new qapi callback for defaulting a given
    config. It must be implemented if a driver wants to use queue configs
    and is optional otherwise.
    
    Suggested-by: Jakub Kicinski 
    Signed-off-by: Pavel Begunkov 

commit 92d76cf96dcbc3c58daa84dbbf71a3ca8d9de53d
Author: Jakub Kicinski 
Date:   Mon Apr 21 15:28:15 2025 -0700

    net: reduce indent of struct netdev_queue_mgmt_ops members
    
    Trivial change, reduce the indent. I think the original is copied
    from real NDOs. It's unnecessarily deep, makes passing struct args
    problematic.
    
    Signed-off-by: Jakub Kicinski 
    Reviewed-by: Mina Almasry 
    Signed-off-by: Pavel Begunkov 

commit 7073bb4b696f5593c1f2e0b9451f0120ca624182
Author: Pavel Begunkov 
Date:   Mon Oct 13 22:03:45 2025 +0100

    net: memzero mp params when closing a queue
    
    Instead of resetting memory provider parameters one by one in
    __net_mp_{open,close}_rxq, memzero the entire structure. It'll be used
    to extend the structure.
    
    Signed-off-by: Pavel Begunkov 

commit 8d48d92eab053bd0b9f53134902fe7b5c63095fd
Merge: 69cb6ca52da095 fe074aaa532924
Author: Jakub Kicinski 
Date:   Tue Jan 13 17:54:03 2026 -0800

    Merge branch 'selftests-drv-net-gro-enable-hw-gro-and-lro-testing'
    
    Jakub Kicinski says:
    
    ====================
    selftests: drv-net: gro: enable HW GRO and LRO testing
    
    Add support for running our existing GRO test against HW GRO
    and LRO implementation. The first 3 patches are just ksft lib
    nice-to-haves, and patch 4 cleans up the existing gro Python.
    
    Patches 5 and 6 are of most practical interest. The support
    reconfiguring the NIC to disable SW GRO and enable HW GRO and LRO.
    Additionally last patch breaks up the existing GRO cases to
    track HW compliance at finer granularity.
    ====================
    
    Link: https://patch.msgid.link/20260113000740.255360-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit fe074aaa5329246706c652ccba6602eecbed80a8
Author: Jakub Kicinski 
Date:   Mon Jan 12 16:07:40 2026 -0800

    selftests: drv-net: gro: break out all individual test cases
    
    GRO test groups the cases into categories, e.g. "tcp" case
    checks coalescing in presence of:
     - packets with bad csum,
     - sequence number mismatch,
     - timestamp option value mismatch,
     - different TCP options.
    
    Since we now have TAP support grouping the cases like that
    lowers our reporting granularity. This matters even more for
    NICs performing HW GRO and LRO since it appears that most
    implementation have _some_ bugs. Flagging the whole group
    of tests as failed prevents us from catching regressions
    in the things that work today.
    
    Reviewed-by: Willem de Bruijn 
    Link: https://patch.msgid.link/20260113000740.255360-7-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit d3b35898de024796c43415f9535fd0bc69cb8f1b
Author: Jakub Kicinski 
Date:   Mon Jan 12 16:07:39 2026 -0800

    selftests: drv-net: gro: run the test against HW GRO and LRO
    
    Run the test against HW GRO and LRO. NICs I have pass the base cases.
    Interestingly all are happy to build GROs larger than 64k.
    
    Reviewed-by: Willem de Bruijn 
    Link: https://patch.msgid.link/20260113000740.255360-6-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 8171f6a76b2250d93a550566af6b915dc92edc75
Author: Jakub Kicinski 
Date:   Mon Jan 12 16:07:38 2026 -0800

    selftests: drv-net: gro: improve feature config
    
    We'll need to do a lot more feature handling to test HW-GRO and LRO.
    Clean up the feature handling for SW GRO a bit to let the next commit
    focus on the new test cases, only.
    
    Make sure HW GRO-like features are not enabled for the SW tests.
    Be more careful about changing features as "nothing changed"
    situations may result in non-zero error code from ethtool.
    
    Don't disable TSO on the local interface (receiver) when running over
    netdevsim, we just want GSO to break up the segments on the sender.
    
    Reviewed-by: Willem de Bruijn 
    Link: https://patch.msgid.link/20260113000740.255360-5-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit d131da6d7282829c775cf70f5f1db1576e5c1273
Author: Jakub Kicinski 
Date:   Mon Jan 12 16:07:37 2026 -0800

    selftests: drv-net: gro: use cmd print
    
    Now that cmd() can be printed directly remove the old formatting.
    
    Before:
    
      # fragmented ip6 doesn't coalesce:
      # Expected {200 100 100 }, Total 3 packets
      # Received {200 100 }, Total 2 packets.
      # /root/ksft-net-drv/drivers/net/gro: incorrect number of packets
    
    Now:
    
      # CMD: drivers/net/gro --ipv6 --dmac 9e:[...]
      #   EXIT: 1
      #   STDOUT: fragmented ip6 doesn't coalesce:
      #   STDERR: Expected {200 100 100 }, Total 3 packets
      #           Received {200 100 }, Total 2 packets.
      #           /root/ksft-net-drv/drivers/net/gro: incorrect number of packets
    
    Reviewed-by: Petr Machata 
    Link: https://patch.msgid.link/20260113000740.255360-4-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit ce0f92dc737c65d705d83ea9529d8fb9a2194241
Author: Jakub Kicinski 
Date:   Mon Jan 12 16:07:36 2026 -0800

    selftests: net: py: teach cmd() how to print itself
    
    Teach cmd() how to print itself, to make debug prints easier.
    Example output (leading # due to ksft_pr()):
    
      # CMD: /root/ksft-net-drv/drivers/net/gro
      #   EXIT: 1
      #   STDOUT: ipv6 with ext header does coalesce:
      #   STDERR: Expected {200 }, Total 1 packets
      #           Received {100 [!=200]100 [!=0]}, Total 2 packets.
    
    Reviewed-by: Petr Machata 
    Link: https://patch.msgid.link/20260113000740.255360-3-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit b324192e36ecea472077f9c9e32bcac8bbafeed6
Author: Jakub Kicinski 
Date:   Mon Jan 12 16:07:35 2026 -0800

    selftests: net: py: teach ksft_pr() multi-line safety
    
    Make printing multi-line logs easier by automatically prefixing
    each line in ksft_pr(). Make use of this when formatting exceptions.
    
    Reviewed-by: Petr Machata 
    Link: https://patch.msgid.link/20260113000740.255360-2-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 69cb6ca52da095d300cf42666c903ae787a762dd
Author: Bobby Eshleman 
Date:   Mon Jan 12 19:56:31 2026 -0800

    tools/net/ynl: suppress jobserver warning in ynltool version detection
    
    When building ynltool with parallel make (-jN), a warning is emitted:
    
      make[1]: warning: jobserver unavailable: using -j1.
      Add '+' to parent make rule.
    
    The warning trips up local runs of NIPA's ingest_mdir.py, which
    correctly fails on make warnings.
    
    This occurs because SRC_VERSION uses $(shell make ...) to make
    kernelversion. The $(shell) function inherits make's MAKEFLAGS env var
    which specifies "--jobserver-auth=R,W" pointing to file descriptors that
    the invoked make sub-shell does not have access to.
    
    Observed with:
    
    $ make --version | head -1
    GNU Make 4.3
    
    Instead of suppressing MAKEFLAGS and foregoing all future MAKEFLAGS
    (some of which may be desirable, such as variable overrides) or
    introducing a new make target, we instead just ignore the warning by
    piping stderr to /dev/null. If 'make kernelversion' fails, the ' || echo
    "unknown"' phrase will catch the failure.
    
    Before:
            NIPA ingest_mdir.py:
    
            ynl
             Full series FAIL   (1)
               Generated files up to date; build has 1 warnings/errors; no diff in
               generated;
    
    After:
            NIPA ingest_mdir.py:
    
            Series level tests:
             ynl                             OKAY
    
    Validated output:
            $ ./ynltool/ynltool --version
            ynltool 6.19.0-rc4
    
    Signed-off-by: Bobby Eshleman 
    Link: https://patch.msgid.link/20260112-ynl-make-fix-v1-1-c399e76925ad@meta.com
    Signed-off-by: Jakub Kicinski 

commit 9d405911a577ac92b3f6e99ad5ae385ff2a2ded2
Merge: c65182ef9df6bb 49e41f3ea3f754
Author: Jakub Kicinski 
Date:   Tue Jan 13 17:46:19 2026 -0800

    Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux
    
    Tariq Toukan says:
    
    ====================
    mlx5-next updates 2026-01-13
    
    * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux:
      net/mlx5: Add IFC bits for extended ETS rate limit bandwidth value
      net/mlx5: Add support for querying bond speed
      net/mlx5: Handle port and vport speed change events in MPESW
      net/mlx5: Propagate LAG effective max_tx_speed to vports
      net/mlx5: Add max_tx_speed and its CAP bit to IFC
    ====================
    
    Link: https://patch.msgid.link/1768299471-1603093-1-git-send-email-tariqt@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit d6c20d19f7d3de14d02b47221988cdb19504bb84
Author: Sean Christopherson 
Date:   Tue Dec 30 13:13:47 2025 -0800

    KVM: SVM: Assert that Hyper-V's HV_SVM_EXITCODE_ENL == SVM_EXIT_SW
    
    Add a build-time assertiont that Hyper-V's "enlightened" exit code is that,
    same as the AMD-defined "Reserved for Host" exit code, mostly to help
    readers connect the dots and understand why synthesizing a software-defined
    exit code is safe/ok.
    
    Reviewed-by: Vitaly Kuznetsov 
    Link: https://patch.msgid.link/20251230211347.4099600-9-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 1e3dddafeceeb8d2cd182b78456cb9ca9d042a01
Author: Sean Christopherson 
Date:   Tue Dec 30 13:13:46 2025 -0800

    KVM: SVM: Harden exit_code against being used in Spectre-like attacks
    
    Explicitly clamp the exit code used to index KVM's exit handlers to guard
    against Spectre-like attacks, mainly to provide consistency between VMX
    and SVM (VMX was given the same treatment by commit c926f2f7230b ("KVM:
    x86: Protect exit_reason from being used in Spectre-v1/L1TF attacks").
    
    For normal VMs, it's _extremely_ unlikely the exit code could be used to
    exploit a speculation vulnerability, as the exit code is set by hardware
    and unexpected/unknown exit codes should be quite well bounded (as is/was
    the case with VMX).  But with SEV-ES+, the exit code is guest-controlled
    as it comes from the GHCB, not from hardware, i.e. an attack from the
    guest is at least somewhat plausible.
    
    Irrespective of SEV-ES+, hardening KVM is easy and inexpensive, and such
    an attack is theoretically possible.
    
    Link: https://patch.msgid.link/20251230211347.4099600-8-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit a08ca6691fd3ab40e40eb6600193672d50c7a7ba
Author: Sean Christopherson 
Date:   Tue Dec 30 13:13:45 2025 -0800

    KVM: SVM: Limit incorrect check on SVM_EXIT_ERR to running as a VM
    
    Limit KVM's incorrect check for VMXEXIT_INVALID, a.k.a. SVM_EXIT_ERR, to
    running as a VM, as detected by X86_FEATURE_HYPERVISOR.  The exit_code and
    all failure codes, e.g. VMXEXIT_INVALID, are 64-bit values, and so checking
    only bits 31:0 could result in false positives when running on non-broken
    hardware, e.g. in the extremely unlikely scenario exit code 0xffffffffull
    is ever generated by hardware.
    
    Keep the 32-bit check to play nice with running on broken KVM (for years,
    KVM has not set bits 63:32 when synthesizing nested SVM VM-Exits).
    
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230211347.4099600-7-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit d7507a94a07202234236d7f94bed6015ca645ae6
Author: Sean Christopherson 
Date:   Tue Dec 30 13:13:44 2025 -0800

    KVM: SVM: Treat exit_code as an unsigned 64-bit value through all of KVM
    
    Fix KVM's long-standing buggy handling of SVM's exit_code as a 32-bit
    value.  Per the APM and Xen commit d1bd157fbc ("Big merge the HVM
    full-virtualisation abstractions.") (which is arguably more trustworthy
    than KVM), offset 0x70 is a single 64-bit value:
    
      070h 63:0 EXITCODE
    
    Track exit_code as a single u64 to prevent reintroducing bugs where KVM
    neglects to correctly set bits 63:32.
    
    Fixes: 6aa8b732ca01 ("[PATCH] kvm: userspace interface")
    Cc: Jim Mattson 
    Cc: Yosry Ahmed 
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230211347.4099600-6-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 405fce694bd1589082a7ffd500b5a4b841c22f0d
Author: Sean Christopherson 
Date:   Tue Dec 30 13:13:43 2025 -0800

    KVM: SVM: Filter out 64-bit exit codes when invoking exit handlers on bare metal
    
    Explicitly filter out 64-bit exit codes when invoking exit handlers, as
    svm_exit_handlers[] will never be sized with entries that use bits 63:32.
    
    Processing the non-failing exit code as a 32-bit value will allow tracking
    exit_code as a single 64-bit value (which it is, architecturally).  This
    will also allow hardening KVM against Spectre-like attacks without needing
    to do silly things to avoid build failures on 32-bit kernels
    (array_index_nospec() rightly asserts that the index fits in an "unsigned
    long").
    
    Omit the check when running as a VM, as KVM has historically failed to set
    bits 63:32 appropriately when synthesizing VM-Exits, i.e. KVM could get
    false positives when running as a VM on an older, broken KVM/kernel.  From
    a functional perspective, omitting the check is "fine", as any unwanted
    collision between e.g. VMEXIT_INVALID and a 32-bit exit code will be
    fatal to KVM-on-KVM regardless of what KVM-as-L1 does.
    
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230211347.4099600-5-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 194c17bf5ebadd2fcf52ac641793e3d755a7af55
Author: Sean Christopherson 
Date:   Tue Dec 30 13:13:42 2025 -0800

    KVM: SVM: Check for an unexpected VM-Exit after RETPOLINE "fast" handling
    
    Check for an unexpected/unhandled VM-Exit after the manual RETPOLINE=y
    handling.  The entire point of the RETPOLINE checks is to optimize for
    common VM-Exits, i.e. checking for the rare case of an unsupported
    VM-Exit is counter-productive.  This also aligns SVM and VMX exit handling.
    
    No functional change intended.
    
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230211347.4099600-4-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 2450c9774510e45c506df4a1b46d129435993ff6
Author: Sean Christopherson 
Date:   Tue Dec 30 13:13:41 2025 -0800

    KVM: SVM: Open code handling of unexpected exits in svm_invoke_exit_handler()
    
    Fold svm_check_exit_valid() and svm_handle_invalid_exit() into their sole
    caller, svm_invoke_exit_handler(), as having tiny single-use helpers makes
    the code unncessarily difficult to follow.  This will also allow for
    additional cleanups in svm_invoke_exit_handler().
    
    No functional change intended.
    
    Suggested-by: Yosry Ahmed 
    Reviewed-by: Yosry Ahmed 
    Reviewed-by: Pankaj Gupta 
    Link: https://patch.msgid.link/20251230211347.4099600-3-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 217463aa329ea9a2efafd1bbfa6787e8df9091b9
Author: Sean Christopherson 
Date:   Tue Dec 30 13:13:40 2025 -0800

    KVM: SVM: Add a helper to detect VMRUN failures
    
    Add a helper to detect VMRUN failures so that KVM can guard against its
    own long-standing bug, where KVM neglects to set exitcode[63:32] when
    synthesizing a nested VMFAIL_INVALID VM-Exit.  This will allow fixing
    KVM's mess of treating exitcode as two separate 32-bit values without
    breaking KVM-on-KVM when running on an older, unfixed KVM.
    
    Cc: Jim Mattson 
    Cc: Yosry Ahmed 
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230211347.4099600-2-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit de0dc71188ca54cfe13fac5c4334715fb37fe8ce
Author: Jun Miao 
Date:   Mon Jan 5 14:54:23 2026 +0800

    KVM: x86: align the code with kvm_x86_call()
    
    The use of static_call_cond() is essentially the same as static_call() on
    x86 (e.g. static_call() now handles a NULL pointer as a NOP), and then the
    kvm_x86_call() is added to improve code readability and maintainability
    for keeping consistent code style.
    
    Fixes 8d032b683c29 ("KVM: TDX: create/destroy VM structure")
    
    Link: https://lore.kernel.org/all/3916caa1dcd114301a49beafa5030eca396745c1.1679456900.git.jpoimboe@kernel.org/
    Link: https://lore.kernel.org/r/20240507133103.15052-3-wei.w.wang@intel.com
    Signed-off-by: Jun Miao 
    Link: https://patch.msgid.link/20260105065423.1870622-1-jun.miao@intel.com
    Signed-off-by: Sean Christopherson 

commit ead63640d4e72e6f6d464f4e31f7fecb79af8869
Author: Sean Christopherson 
Date:   Thu Jan 8 19:06:57 2026 -0800

    KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
    
    Ignore -EBUSY when checking nested events after exiting a blocking state
    while L2 is active, as exiting to userspace will generate a spurious
    userspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM's
    demise.  Continuing with the wakeup isn't perfect either, as *something*
    has gone sideways if a vCPU is awakened in L2 with an injected event (or
    worse, a nested run pending), but continuing on gives the VM a decent
    chance of surviving without any major side effects.
    
    As explained in the Fixes commits, it _should_ be impossible for a vCPU to
    be put into a blocking state with an already-injected event (exception,
    IRQ, or NMI).  Unfortunately, userspace can stuff MP_STATE and/or injected
    events, and thus put the vCPU into what should be an impossible state.
    
    Don't bother trying to preserve the WARN, e.g. with an anti-syzkaller
    Kconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be
    violating x86 architecture, e.g. by WARNing if KVM attempts to inject an
    exception or interrupt while the vCPU isn't running.
    
    Cc: Alessandro Ratti 
    Cc: stable@vger.kernel.org
    Fixes: 26844fee6ade ("KVM: x86: never write to memory from kvm_vcpu_check_block()")
    Fixes: 45405155d876 ("KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject")
    Link: https://syzkaller.appspot.com/text?tag=ReproC&x=10d4261a580000
    Reported-by: syzbot+1522459a74d26b0ac33a@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/671bc7a7.050a0220.455e8.022a.GAE@google.com
    Link: https://patch.msgid.link/20260109030657.994759-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit d23051f59a5b4eb1f6163cf27e07b8cfcaeb4758
Author: Sean Christopherson 
Date:   Thu Jan 8 19:31:01 2026 -0800

    KVM: SVM: Tag sev_supported_vmsa_features as read-only after init
    
    Tag sev_supported_vmsa_features with __ro_after_init as it's configured by
    sev_hardware_setup() and never written after initial configuration (and if
    it were, that'd be a blatant bug).
    
    Opportunistically relocate the variable out of the module params area now
    that sev_es_debug_swap_enabled is gone (which largely motivated its
    original location).
    
    Reviewed-by: Tom Lendacky 
    Link: https://patch.msgid.link/20260109033101.1005769-3-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 9587dd7a7ebd7be3c36815a4c4f90f7e2cedbe03
Author: Sean Christopherson 
Date:   Thu Jan 8 19:31:00 2026 -0800

    KVM: SVM: Drop the module param to control SEV-ES DebugSwap
    
    Rip out the DebugSwap module param, as the sequence of events that led to
    its inclusion was one big mistake, the param no longer serves any purpose.
    
    Commit d1f85fbe836e ("KVM: SEV: Enable data breakpoints in SEV-ES") goofed
    by not adding a way for the userspace VMM to control the feature.
    Functionally, that was fine, but it broke attestation signatures because
    SEV_FEATURES are included in the signature.
    
    Commit 5abf6dceb066 ("SEV: disable SEV-ES DebugSwap by default") fixed that
    issue, but the underlying flaw of userspace not having a way to control
    SEV_FEATURES was still there.
    
    That flaw was addressed by commit 4f5defae7089 ("KVM: SEV: introduce
    KVM_SEV_INIT2 operation"), and so then 4dd5ecacb9a4 ("KVM: SEV: allow
    SEV-ES DebugSwap again") re-enabled DebugSwap by default.
    
    Now that the dust has settled, the module param doesn't serve any
    meaningful purpose.
    
    Cc: Tom Lendacky 
    Reviewed-by: Tom Lendacky 
    Link: https://patch.msgid.link/20260109033101.1005769-2-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 000d75b0b18622e7454c3955631a3cf39e0353e7
Author: Sean Christopherson 
Date:   Thu Jan 8 19:45:32 2026 -0800

    KVM: x86: Update APICv ISR (a.k.a. SVI) as part of kvm_apic_update_apicv()
    
    Fold the calls to .hwapic_isr_update() in kvm_apic_set_state(),
    kvm_lapic_reset(), and __kvm_vcpu_update_apicv() into
    kvm_apic_update_apicv(), as updating SVI is directly related to updating
    KVM's own cache of ISR information, e.g. SVI is more or less the APICv
    equivalent of highest_isr_cache.
    
    Note, calling .hwapic_isr_update() during kvm_apic_update_apicv() has
    benign side effects, as doing so changes the orders of the calls in
    kvm_lapic_reset() and kvm_apic_set_state(), specifically with respect to
    to the order between .hwapic_isr_update() and .apicv_post_state_restore().
    However, the changes in ordering are glorified nops as the former hook is
    VMX-only and the latter is SVM-only.
    
    Reviewed-by: Chao Gao 
    Link: https://patch.msgid.link/20260109034532.1012993-9-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 249cc1ab4b9a5caa63d7e9c5a5b7862046089dd4
Author: Sean Christopherson 
Date:   Thu Jan 8 19:45:31 2026 -0800

    KVM: nVMX: Switch to vmcs01 to set virtual APICv mode on-demand if L2 is active
    
    If L1's virtual APIC mode changes while L2 is active, e.g. because L1
    doesn't intercept writes to the APIC_BASE MSR and L2 changes the mode,
    temporarily load vmcs01 and do all of the necessary actions instead of
    deferring the update until the next nested VM-Exit.
    
    This will help in fixing yet more issues related to updates while L2 is
    active, e.g. KVM neglects to update vmcs02 MSR intercepts if vmcs01's MSR
    intercepts are modified while L2 is active.  Not updating x2APIC MSRs is
    benign because vmcs01's settings are not factored into vmcs02's bitmap, but
    deferring the x2APIC MSR updates would create a weird, inconsistent state.
    
    Reviewed-by: Chao Gao 
    Link: https://patch.msgid.link/20260109034532.1012993-8-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 51c821d6d0ba038506d8b1c522f0b2b0ed756dd3
Author: Sean Christopherson 
Date:   Thu Jan 8 19:45:30 2026 -0800

    KVM: nVMX: Switch to vmcs01 to update APIC page on-demand if L2 is active
    
    If the KVM-owned APIC-access page is migrated while L2 is running,
    temporarily load vmcs01 and immediately update APIC_ACCESS_ADDR instead
    of deferring the update until the next nested VM-Exit.  Once changing
    the virtual APIC mode is converted to always do on-demand updates, all
    of the "defer until vmcs01 is active" logic will be gone.
    
    Reviewed-by: Chao Gao 
    Link: https://patch.msgid.link/20260109034532.1012993-7-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 2bf889a68fbab33133ef9ec1000399913b2c65c4
Author: Sean Christopherson 
Date:   Thu Jan 8 19:45:29 2026 -0800

    KVM: nVMX: Switch to vmcs01 to refresh APICv controls on-demand if L2 is active
    
    If APICv is (un)inhibited while L2 is running, temporarily load vmcs01 and
    immediately refresh the APICv controls in vmcs01 instead of deferring the
    update until the next nested VM-Exit.  This all but eliminates potential
    ordering issues due to vmcs01 not being synchronized with
    kvm_lapic.apicv_active, e.g. where KVM _thinks_ it refreshed APICv, but
    vmcs01 still contains stale state.
    
    Reviewed-by: Chao Gao 
    Link: https://patch.msgid.link/20260109034532.1012993-6-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit f0044429b257c015f95b8e110c652446d4fcfe4c
Author: Sean Christopherson 
Date:   Thu Jan 8 19:45:28 2026 -0800

    KVM: nVMX: Switch to vmcs01 to update SVI on-demand if L2 is active
    
    If APICv is activated while L2 is running and triggers an SVI update,
    temporarily load vmcs01 and immediately update SVI instead of deferring
    the update until the next nested VM-Exit.  This will eventually allow
    killing off kvm_apic_update_hwapic_isr(), and all of nVMX's deferred
    APICv updates.
    
    Reviewed-by: Chao Gao 
    Link: https://patch.msgid.link/20260109034532.1012993-5-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 51ca2746078ef9390db91251805e54eff3601d63
Author: Sean Christopherson 
Date:   Thu Jan 8 19:45:27 2026 -0800

    KVM: nVMX: Switch to vmcs01 to update TPR threshold on-demand if L2 is active
    
    If KVM updates L1's TPR Threshold while L2 is active, temporarily load
    vmcs01 and immediately update TPR_THRESHOLD instead of deferring the
    update until the next nested VM-Exit.  Deferring the TPR Threshold update
    is relatively straightforward, but for several APICv related updates,
    deferring updates creates ordering and state consistency problems, e.g.
    KVM at-large thinks APICv is enabled, but vmcs01 is still running with
    stale (and effectively unknown) state.
    
    Reviewed-by: Chao Gao 
    Link: https://patch.msgid.link/20260109034532.1012993-4-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 3e013d0a70994df2c2ba78d599a6c039ab0977a5
Author: Sean Christopherson 
Date:   Thu Jan 8 19:45:26 2026 -0800

    KVM: nVMX: Switch to vmcs01 to update PML controls on-demand if L2 is active
    
    If KVM toggles "CPU dirty logging", a.k.a. Page-Modification Logging (PML),
    while L2 is active, temporarily load vmcs01 and immediately update the
    relevant controls instead of deferring the update until the next nested
    VM-Exit.  For PML, deferring the update is relatively straightforward, but
    for several APICv related updates, deferring updates creates ordering and
    state consistency problems, e.g. KVM at-large thinks APICv is enabled, but
    vmcs01 is still running with stale (and effectively unknown) state.
    
    Convert PML first precisely because it's the simplest case to handle: if
    something is broken with the vmcs01 <=> vmcs02 dance, then hopefully bugs
    will bisect here.
    
    Reviewed-by: Chao Gao 
    Link: https://patch.msgid.link/20260109034532.1012993-3-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit c3a9a27c79e4e5d8bdb20a26d16230111207e98e
Author: Sean Christopherson 
Date:   Thu Jan 8 19:45:25 2026 -0800

    KVM: selftests: Add a test to verify APICv updates (while L2 is active)
    
    Add a test to verify KVM correctly handles a variety of edge cases related
    to APICv updates, and in particular updates that are triggered while L2 is
    actively running.
    
    Reviewed-by: Chao Gao 
    Link: https://patch.msgid.link/20260109034532.1012993-2-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 36d83c249e0395a915144eceeb528ddc19b1fbe6
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:26:04 2025 -0800

    x86/entry/vdso32: When using int $0x80, use it directly
    
    When neither sysenter32 nor syscall32 is available (on either
    FRED-capable 64-bit hardware or old 32-bit hardware), there is no
    reason to do a bunch of stack shuffling in __kernel_vsyscall.
    Unfortunately, just overwriting the initial "push" instructions will
    mess up the CFI annotations, so suffer the 3-byte NOP if not
    applicable.
    
    Similarly, inline the int $0x80 when doing inline system calls in the
    vdso instead of calling __kernel_vsyscall.
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251216212606.1325678-11-hpa@zytor.com

commit f49ecf5e110ab0ed255ddea5e321689faf4e50e6
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:26:03 2025 -0800

    x86/cpufeature: Replace X86_FEATURE_SYSENTER32 with X86_FEATURE_SYSFAST32
    
    In most cases, the use of "fast 32-bit system call" depends either on
    X86_FEATURE_SEP or X86_FEATURE_SYSENTER32 || X86_FEATURE_SYSCALL32.
    However, nearly all the logic for both is identical.
    
    Define X86_FEATURE_SYSFAST32 which indicates that *either* SYSENTER32 or
    SYSCALL32 should be used, for either 32- or 64-bit kernels.  This
    defaults to SYSENTER; use SYSCALL if the SYSCALL32 bit is also set.
    
    As this removes ALL existing uses of X86_FEATURE_SYSENTER32, which is
    a kernel-only synthetic feature bit, simply remove it and replace it
    with X86_FEATURE_SYSFAST32.
    
    This leaves an unused alternative for a true 32-bit kernel, but that
    should really not matter in any way.
    
    The clearing of X86_FEATURE_SYSCALL32 can be removed once the patches
    for automatically clearing disabled features has been merged.
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251216212606.1325678-10-hpa@zytor.com

commit a0636d4c3ad0da0cd6069eb6fef5d2b7d3449378
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:26:02 2025 -0800

    x86/vdso: Abstract out vdso system call internals
    
    Abstract out the calling of true system calls from the vdso into
    macros.
    
    It has been a very long time since gcc did not allow %ebx or %ebp in
    inline asm in 32-bit PIC mode; remove the corresponding hacks.
    
    Remove the use of memory output constraints in gettimeofday.h in favor
    of "memory" clobbers. The resulting code is identical for the current
    use cases, as the system call is usually a terminal fallback anyway,
    and it merely complicates the macroization.
    
    This patch adds only a handful of more lines of code than it removes,
    and in fact could be made substantially smaller by removing the macros
    for the argument counts that aren't currently used, however, it seems
    better to be general from the start.
    
    [ v3: remove stray comment from prototyping; remove VDSO_SYSCALL6()
          since it would require special handling on 32 bits and is
          currently unused. (Uros Biszjak)
    
          Indent nested preprocessor directives. ]
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Acked-by: Uros Bizjak 
    Link: https://patch.msgid.link/20251216212606.1325678-9-hpa@zytor.com

commit 8717b02b8c030dc0c4b55781b59e88def0a1a92f
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:26:01 2025 -0800

    x86/entry/vdso: Include GNU_PROPERTY and GNU_STACK PHDRs
    
    Currently the vdso doesn't include .note.gnu.property or a GNU noexec
    stack annotation (the -z noexecstack in the linker script is
    ineffective because we specify PHDRs explicitly.)
    
    The motivation is that the dynamic linker currently do not check
    these.
    
    However, this is a weak excuse: the vdso*.so are also supposed to be
    usable at link libraries, and there is no reason why the dynamic
    linker might not want or need to check these in the future, so add
    them back in -- it is trivial enough.
    
    Use symbolic constants for the PHDR permission flags.
    
    [ v4: drop unrelated formatting changes ]
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251216212606.1325678-8-hpa@zytor.com

commit 884961618ee51307cc63ab620a0bdd710fa0b0af
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:26:00 2025 -0800

    x86/entry/vdso32: Remove open-coded DWARF in sigreturn.S
    
    The vdso32 sigreturn.S contains open-coded DWARF bytecode, which
    includes a hack for gdb to not try to step back to a previous call
    instruction when backtracing from a signal handler.
    
    Neither of those are necessary anymore: the backtracing issue is
    handled by ".cfi_entry simple" and ".cfi_signal_frame", both of which
    have been supported for a very long time now, which allows the
    remaining frame to be built using regular .cfi annotations.
    
    Add a few more register offsets to the signal frame just for good
    measure.
    
    Replace the nop on fallthrough of the system call (which should never,
    ever happen) with a ud2a trap.
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251216212606.1325678-7-hpa@zytor.com

commit 98d3e996513ad00b7824ea3bece506fc645547dd
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:25:59 2025 -0800

    x86/entry/vdso32: Remove SYSCALL_ENTER_KERNEL macro in sigreturn.S
    
    A macro SYSCALL_ENTER_KERNEL was defined in sigreturn.S, with the
    ability of overriding it. The override capability, however, is not
    used anywhere, and the macro name is potentially confusing because it
    seems to imply that sysenter/syscall could be used here, which is NOT
    true: the sigreturn system calls MUST use int $0x80.
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251216212606.1325678-6-hpa@zytor.com

commit 6e150b71019f386a021004fafea9ef7189bc6aea
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:25:58 2025 -0800

    x86/entry/vdso32: Don't rely on int80_landing_pad for adjusting ip
    
    There is no fundamental reason to use the int80_landing_pad symbol to
    adjust ip when moving the vdso. If ip falls within the vdso, and the
    vdso is moved, we should change the ip accordingly, regardless of mode
    or location within the vdso. This *currently* can only happen on 32
    bits, but there isn't any reason not to do so generically.
    
    Note that if this is ever possible from a vdso-internal call, then the
    user space stack will also needed to be adjusted (as well as the
    shadow stack, if enabled.) Fortunately this is not currently the case.
    
    At the moment, we don't even consider other threads when moving the
    vdso. The assumption is that it is only used by process freeze/thaw
    for migration, where this is not an issue.
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251216212606.1325678-5-hpa@zytor.com

commit b9da17391e135f65df0eaa73e7c3fd09a1d45f6d
Merge: c9c9f6bf7fbcec 9282a42a1fe16c
Author: Andrii Nakryiko 
Date:   Tue Jan 13 16:10:40 2026 -0800

    Merge branch 'improve-the-performance-of-btf-type-lookups-with-binary-search'
    
    Donglin Peng says:
    
    ====================
    Improve the performance of BTF type lookups with binary search
    
    From: Donglin Peng 
    
    The series addresses the performance limitations of linear search in large
    BTFs by:
    1. Adding BTF permutation support
    2. Using resolve_btfids to sort BTF during the build phase
    3. Checking BTF sorting
    4. Using binary search when looking up types
    
    Patch #1 introduces an interface for btf__permute in libbpf to relay out BTF.
    Patch #2 adds test cases to validate the functionality of btf__permute in base
    and split BTF scenarios.
    Patch #3 introduces a new phase in the resolve_btfids tool to sort BTF by name
    in ascending order.
    Patches #4-#7 implement the sorting check and binary search.
    Patches #8-#10 optimize type lookup performance of some functions by skipping
    anonymous types or invoking btf_find_by_name_kind.
    Patch #11 refactors the code by calling str_is_empty.
    
    Here is a simple performance test result [1] for lookups to find 87,584 named
    types in vmlinux BTF:
    
    ./vmtest.sh -- ./test_progs -t btf_permute/perf -v
    
    Results:
    | Condition          | Lookup Time | Improvement  |
    |--------------------|-------------|--------------|
    | Unsorted (Linear)  |  36,534 ms  | Baseline     |
    | Sorted (Binary)    |      15 ms  | 2437x faster |
    
    The binary search implementation reduces lookup time from 36.5 seconds to 15
    milliseconds, achieving a **2437x** speedup for large-scale type queries.
    
    Changelog:
    v12:
    - Set the start_id to 1 instead of btf->start_id in the btf__find_by_name (AI)
    
    v11:
    - Link: https://lore.kernel.org/bpf/20260108031645.1350069-1-dolinux.peng@gmail.com/
    - PATCH #1: Modify implementation of btf__permute: id_map[0] must be 0 for base BTF (Andrii)
    - PATCH #3: Refactor the code (Andrii)
    - PATCH #4~8:
      - Revert to using the binary search in v7 to simplify the code (Andrii)
      - Refactor the code of btf_check_sorted (Andrii, Eduard)
      - Rename sorted_start_id to named_start_id
      - Rename btf_sorted_start_id to btf_named_start_id, and add comments (Andrii, Eduard)
    
    v10:
    - Link: https://lore.kernel.org/all/20251218113051.455293-1-dolinux.peng@gmail.com/
    - Improve btf__permute() documentation (Eduard)
    - Fall back to linear search when locating anonymous types (Eduard)
    - Remove redundant NULL name check in libbpf's linear search path (Eduard)
    - Simplify btf_check_sorted() implementation (Eduard)
    - Treat kernel modules as unsorted by default
    - Introduce btf_is_sorted and btf_sorted_start_id for clarity (Eduard)
    - Fix optimizations in btf_find_decl_tag_value() and btf_prepare_func_args()
      to support split BTF
    - Remove linear search branch in determine_ptr_size()
    - Rebase onto Ihor's v4 patch series [4]
    
    v9:
    - Link: https://lore.kernel.org/bpf/20251208062353.1702672-1-dolinux.peng@gmail.com/
    - Optimize the performance of the function determine_ptr_size by invoking
      btf__find_by_name_kind
    - Optimize the performance of btf_find_decl_tag_value/btf_prepare_func_args/
      bpf_core_add_cands by skipping anonymous types
    - Rebase the patch series onto Ihor's v3 patch series [3]
    
    v8
    - Link: https://lore.kernel.org/bpf/20251126085025.784288-1-dolinux.peng@gmail.com/
    - Remove the type dropping feature of btf__permute (Andrii)
    - Refactor the code of btf__permute (Andrii, Eduard)
    - Make the self-test code cleaner (Eduard)
    - Reconstruct the BTF sorting patch based on Ihor's patch series [2]
    - Simplify the sorting logic and place anonymous types before named types
      (Andrii, Eduard)
    - Optimize type lookup performance of two kernel functions
    - Refactoring the binary search and type lookup logic achieves a 4.2%
      performance gain, reducing the average lookup time (via the perf test
      code in [1] for 60,995 named types in vmlinux BTF) from 10,217 us (v7) to
      9,783 us (v8).
    
    v7:
    - Link: https://lore.kernel.org/all/20251119031531.1817099-1-dolinux.peng@gmail.com/
    - btf__permute API refinement: Adjusted id_map and id_map_cnt parameter
      usage so that for base BTF, id_map[0] now contains the new id of original
      type id 1 (instead of VOID type id 0), improving logical consistency
    - Selftest updates: Modified test cases to align with the API usage changes
    - Refactor the code of resolve_btfids
    
    v6:
    - Link: https://lore.kernel.org/all/20251117132623.3807094-1-dolinux.peng@gmail.com/
    - ID Map-based reimplementation of btf__permute (Andrii)
    - Build-time BTF sorting using resolve_btfids (Alexei, Eduard)
    - Binary search method refactoring (Andrii)
    - Enhanced selftest coverage
    
    v5:
    - Link: https://lore.kernel.org/all/20251106131956.1222864-1-dolinux.peng@gmail.com/
    - Refactor binary search implementation for improved efficiency
      (Thanks to Andrii and Eduard)
    - Extend btf__permute interface with 'ids_sz' parameter to support
      type dropping feature (suggested by Andrii). Plan subsequent reimplementation of
      id_map version for comparative analysis with current sequence interface
    - Add comprehensive test coverage for type dropping functionality
    - Enhance function comment clarity and accuracy
    
    v4:
    - Link: https://lore.kernel.org/all/20251104134033.344807-1-dolinux.peng@gmail.com/
    - Abstracted btf_dedup_remap_types logic into a helper function (suggested by Eduard).
    - Removed btf_sort.c and implemented sorting separately for libbpf and kernel (suggested by Andrii).
    - Added test cases for both base BTF and split BTF scenarios (suggested by Eduard).
    - Added validation for name-only sorting of types (suggested by Andrii)
    - Refactored btf__permute implementation to reduce complexity (suggested by Andrii)
    - Add doc comments for btf__permute (suggested by Andrii)
    
    v3:
    - Link: https://lore.kernel.org/all/20251027135423.3098490-1-dolinux.peng@gmail.com/
    - Remove sorting logic from libbpf and provide a generic btf__permute() interface (suggested
      by Andrii)
    - Omitted the search direction patch to avoid conflicts with base BTF (suggested by Eduard).
    - Include btf_sort.c directly in btf.c to reduce function call overhead
    
    v2:
    - Link: https://lore.kernel.org/all/20251020093941.548058-1-dolinux.peng@gmail.com/
    - Moved sorting to the build phase to reduce overhead (suggested by Alexei).
    - Integrated sorting into btf_dedup_compact_and_sort_types (suggested by Eduard).
    - Added sorting checks during BTF parsing.
    - Consolidated common logic into btf_sort.c for sharing (suggested by Alan).
    
    v1:
    - Link: https://lore.kernel.org/all/20251013131537.1927035-1-dolinux.peng@gmail.com/
    
    [1] https://github.com/pengdonglin137/btf_sort_test
    [2] https://lore.kernel.org/bpf/20251126012656.3546071-1-ihor.solodrai@linux.dev/
    [3] https://lore.kernel.org/bpf/20251205223046.4155870-1-ihor.solodrai@linux.dev/
    [4] https://lore.kernel.org/bpf/20251218003314.260269-1-ihor.solodrai@linux.dev/
    ====================
    
    Link: https://patch.msgid.link/20260109130003.3313716-1-dolinux.peng@gmail.com
    Signed-off-by: Andrii Nakryiko 

commit 9282a42a1fe16c61a253293af439d6fecd8b5b6c
Author: Donglin Peng 
Date:   Fri Jan 9 21:00:03 2026 +0800

    btf: Refactor the code by calling str_is_empty
    
    Calling the str_is_empty function to clarify the code and
    no functional changes are introduced.
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-12-dolinux.peng@gmail.com

commit 434bcbc837a69baa2720b2ae5baba8b6e36898c0
Author: Donglin Peng 
Date:   Fri Jan 9 21:00:01 2026 +0800

    bpf: Optimize the performance of find_bpffs_btf_enums
    
    Currently, vmlinux BTF is unconditionally sorted during
    the build phase. The function btf_find_by_name_kind
    executes the binary search branch, so find_bpffs_btf_enums
    can be optimized by using btf_find_by_name_kind.
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-10-dolinux.peng@gmail.com

commit dc893cfa390aa9d5fc83c908ea5e37a36e531892
Author: Donglin Peng 
Date:   Fri Jan 9 21:00:00 2026 +0800

    bpf: Skip anonymous types in type lookup for performance
    
    Currently, vmlinux and kernel module BTFs are unconditionally
    sorted during the build phase, with named types placed at the
    end. Thus, anonymous types should be skipped when starting the
    search. In my vmlinux BTF, the number of anonymous types is
    61,747, which means the loop count can be reduced by 61,747.
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-9-dolinux.peng@gmail.com

commit 342bf525ba0d83374f318e19186d50b1e7160d0e
Author: Donglin Peng 
Date:   Fri Jan 9 20:59:59 2026 +0800

    btf: Verify BTF sorting
    
    This patch checks whether the BTF is sorted by name in ascending order.
    If sorted, binary search will be used when looking up types.
    
    Specifically, vmlinux and kernel module BTFs are always sorted during
    the build phase with anonymous types placed before named types, so we
    only need to identify the starting ID of named types.
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-8-dolinux.peng@gmail.com

commit 8c3070e159ba00424f0389ead694cacd85af260e
Author: Donglin Peng 
Date:   Fri Jan 9 20:59:58 2026 +0800

    btf: Optimize type lookup with binary search
    
    Improve btf_find_by_name_kind() performance by adding binary search
    support for sorted types. Falls back to linear search for compatibility.
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-7-dolinux.peng@gmail.com

commit cea6e6e8717e81de266aa496f44088b2b960aa32
Author: Dmitry Baryshkov 
Date:   Tue Jan 6 05:09:57 2026 +0200

    drm/atomic: verify that gamma/degamma LUTs are not too big
    
    The kernel specifies LUT table sizes in a separate property, however it
    doesn't enforce it as a maximum. Some drivers implement max size check
    on their own in the atomic_check path. Other drivers simply ignore the
    issue. Perform LUT size validation in the generic place.
    
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/20260106-drm-fix-lut-checks-v3-3-f7f979eb73c8@oss.qualcomm.com
    Signed-off-by: Dmitry Baryshkov 

commit ca59e33f5a1f642d13ae0e558fdbdd9aaa9fe203
Author: Dmitry Baryshkov 
Date:   Tue Jan 6 05:09:56 2026 +0200

    drm/atomic: add max_size check to drm_property_replace_blob_from_id()
    
    The function drm_property_replace_blob_from_id() allows checking whether
    the blob size is equal to a predefined value. In case of variable-size
    properties (like the gamma / degamma LUTs) we might want to check for
    the blob size against the maximum, allowing properties of the size
    lesser than the max supported by the hardware. Extend the function in
    order to support such checks.
    
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/20260106-drm-fix-lut-checks-v3-2-f7f979eb73c8@oss.qualcomm.com
    Signed-off-by: Dmitry Baryshkov 

commit 66c9c0cfe765af7f30eac880da0fa047aea8617d
Author: Dmitry Baryshkov 
Date:   Tue Jan 6 05:09:55 2026 +0200

    drm/mode_object: add drm_object_immutable_property_get_value()
    
    We have a helper to get property values for non-atomic drivers and
    another one default property values for atomic drivers. In some cases we
    need the ability to get value of immutable property, no matter what kind
    of driver it is. Implement new property-related helper,
    drm_object_immutable_property_get_value(), which lets the caller to get
    the value of the immutable property.
    
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/20260106-drm-fix-lut-checks-v3-1-f7f979eb73c8@oss.qualcomm.com
    Signed-off-by: Dmitry Baryshkov 

commit 33ecca574f1c27cbf560aee9c1b3045dcb9f8de5
Author: Donglin Peng 
Date:   Fri Jan 9 20:59:57 2026 +0800

    libbpf: Verify BTF sorting
    
    This patch checks whether the BTF is sorted by name in ascending
    order. If sorted, binary search will be used when looking up types.
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-6-dolinux.peng@gmail.com

commit d836e5e64992363b5fa9b121f1ab4a1a1b89162d
Author: Donglin Peng 
Date:   Fri Jan 9 20:59:56 2026 +0800

    libbpf: Optimize type lookup with binary search for sorted BTF
    
    This patch introduces binary search optimization for BTF type lookups
    when the BTF instance contains sorted types.
    
    The optimization significantly improves performance when searching for
    types in large BTF instances with sorted types. For unsorted BTF, the
    implementation falls back to the original linear search.
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-5-dolinux.peng@gmail.com

commit 230e7d7de5a8d2bcda2a5cdcc8c176c09a63e331
Author: Donglin Peng 
Date:   Fri Jan 9 20:59:55 2026 +0800

    tools/resolve_btfids: Support BTF sorting feature
    
    This introduces a new BTF sorting phase that specifically sorts
    BTF types by name in ascending order, so that the binary search
    can be used to look up types.
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-4-dolinux.peng@gmail.com

commit a3acd7d43462a7f7429301afad3c0059276f427e
Author: Donglin Peng 
Date:   Fri Jan 9 20:59:54 2026 +0800

    selftests/bpf: Add test cases for btf__permute functionality
    
    This patch introduces test cases for the btf__permute function to ensure
    it works correctly with both base BTF and split BTF scenarios.
    
    The test suite includes:
    - test_permute_base: Validates permutation on base BTF
    - test_permute_split: Tests permutation on split BTF
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-3-dolinux.peng@gmail.com

commit 6fbf129c49905e9e34801b362c9c30ae383d7a90
Author: Donglin Peng 
Date:   Fri Jan 9 20:59:53 2026 +0800

    libbpf: Add BTF permutation support for type reordering
    
    Introduce btf__permute() API to allow in-place rearrangement of BTF types.
    This function reorganizes BTF type order according to a provided array of
    type IDs, updating all type references to maintain consistency.
    
    Signed-off-by: Donglin Peng 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20260109130003.3313716-2-dolinux.peng@gmail.com

commit 693c819fedcdcabfda7488e2d5e355a84c2fd1b0
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:25:57 2025 -0800

    x86/entry/vdso: Refactor the vdso build
    
    - Separate out the vdso sources into common, vdso32, and vdso64
      directories.
    - Build the 32- and 64-bit vdsos in their respective subdirectories;
      this greatly simplifies the build flags handling.
    - Unify the mangling of Makefile flags between the 32- and 64-bit
      vdso code as much as possible; all common rules are put in
      arch/x86/entry/vdso/common/Makefile.include. The remaining
      is very simple for 32 bits; the 64-bit one is only slightly more
      complicated because it contains the x32 generation rule.
    - Define __DISABLE_EXPORTS when building the vdso. This need seems to
      have been masked by different ordering compile flags before.
    - Change CONFIG_X86_64 to BUILD_VDSO32_64 in vdso32/system_call.S,
      to make it compatible with including fake_32bit_build.h.
    - The -fcf-protection= option was "leaking" from the kernel build,
      for reasons that was not clear to me. Furthermore, several
      distributions ship with it set to a default value other than
      "-fcf-protection=none". Make it match the configuration options
      for *user space*.
    
    Note that this patch may seem large, but the vast majority of it is
    simply code movement.
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251216212606.1325678-4-hpa@zytor.com

commit a76108d05ee13cddb72b620752a80b2c3e87aee1
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:25:56 2025 -0800

    x86/entry/vdso: Move vdso2c to arch/x86/tools
    
    It is generally better to build tools in arch/x86/tools to keep host
    cflags proliferation down, and to reduce makefile sequencing issues.
    Move the vdso build tool vdso2c into arch/x86/tools in preparation for
    refactoring the vdso makefiles.
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251216212606.1325678-3-hpa@zytor.com

commit 93d73005bff4f600696ce30e366e742c3373b13d
Author: H. Peter Anvin 
Date:   Tue Dec 16 13:25:55 2025 -0800

    x86/entry/vdso: Rename vdso_image_* to vdso*_image
    
    The vdso .so files are named vdso*.so. These structures are binary
    images and descriptions of these files, so it is more consistent for
    them to have a naming that more directly mirrors the filenames.
    
    It is also very slightly more compact (by one character...) and
    simplifies the Makefile just a little bit.
    
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251216212606.1325678-2-hpa@zytor.com

commit a36b2aaae742dd2253063ee0cc447aa86f94b4fb
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 15:29:09 2026 -0600

    dt-bindings: riscv: extensions: Drop unnecessary select schema
    
    The "select" schema is not necessary because this schema is referenced by
    riscv/cpus.yaml schema.
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Conor Dooley 

commit 89febd6a02768200fcfc86ee57f1ece632805bff
Author: Guodong Xu 
Date:   Sat Jan 10 13:18:21 2026 +0800

    dt-bindings: riscv: Add Sha and its comprised extensions
    
    Add descriptions for the Sha extension and the seven extensions it
    comprises: Shcounterenw, Shgatpa, Shtvala, Shvsatpa, Shvstvala, Shvstvecd,
    and Ssstateen.
    
    Sha is ratified in the RVA23 Profiles Version 1.0 (commit 0273f3c921b6
    "rva23/rvb23 ratified") as a new profile-defined extension that captures
    the full set of features that are mandated to be supported along with
    the H extension.
    
    Extensions Shcounterenw, Shgatpa, Shtvala, Shvsatpa, Shvstvala, Shvstvecd,
    and Ssstateen are ratified in the RISC-V Profiles Version 1.0 (commit
    b1d806605f87 "Updated to ratified state").
    
    The requirement status for Sha and its comprised extension in RISC-V
    Profiles are:
     - Sha: Mandatory in RVA23S64
     - H: Optional in RVA22S64; Mandatory in RVA23S64
     - Shcounterenw: Optional in RVA22S64; Mandatory in RVA23S64
     - Shgatpa: Optional in RVA22S64; Mandatory in RVA23S64
     - Shtvala: Optional in RVA22S64; Mandatory in RVA23S64
     - Shvsatpa: Optional in RVA22S64; Mandatory in RVA23S64
     - Shvstvala: Optional in RVA22S64; Mandatory in RVA23S64
     - Shvstvecd: Optional in RVA22S64; Mandatory in RVA23S64
     - Ssstateen: Optional in RVA22S64; Mandatory in RVA23S64
    
    Signed-off-by: Guodong Xu 
    Acked-by: Conor Dooley 
    Signed-off-by: Conor Dooley 

commit c712413333f8e19cc3de4e9cd1a3ed8a53169cc9
Author: Guodong Xu 
Date:   Sat Jan 10 13:18:20 2026 +0800

    dt-bindings: riscv: Add Ssccptr, Sscounterenw, Sstvala, Sstvecd, Ssu64xl
    
    Add descriptions for five new extensions: Ssccptr, Sscounterenw, Sstvala,
    Sstvecd, and Ssu64xl. These extensions are ratified in RISC-V Profiles
    Version 1.0 (commit b1d806605f87 "Updated to ratified state.").
    
    They are introduced as new extension names for existing features and
    regulate implementation details for RISC-V Profile compliance. According
    to RISC-V Profiles Version 1.0 and RVA23 Profiles Version 1.0, their
    requirement status are:
    
     - Ssccptr: Mandatory in RVA20S64, RVA22S64, RVA23S64
     - Sscounterenw: Mandatory in RVA22S64, RVA23S64
     - Sstvala: Mandatory in RVA20S64, RVA22S64, RVA23S64
     - Sstvecd: Mandatory in RVA20S64, RVA22S64, RVA23S64
     - Ssu64xl: Optional in RVA20S64, RVA22S64; Mandatory in RVA23S64
    
    Signed-off-by: Guodong Xu 
    Acked-by: Conor Dooley 
    Signed-off-by: Conor Dooley 

commit b321256a4f36227e0c1ae54e8c6c48524dcba83d
Author: Guodong Xu 
Date:   Sat Jan 10 13:18:19 2026 +0800

    dt-bindings: riscv: Add descriptions for Za64rs, Ziccamoa, Ziccif, and Zicclsm
    
    Add descriptions for four extensions: Za64rs, Ziccamoa, Ziccif, and
    Zicclsm. These extensions are ratified in RISC-V Profiles Version 1.0
    (commit b1d806605f87 "Updated to ratified state.").
    
    They are introduced as new extension names for existing features and
    regulate implementation details for RISC-V Profile compliance. According
    to RISC-V Profiles Version 1.0 and RVA23 Profiles Version 1.0, they are
    mandatory for the following profiles:
    
     - za64rs: Mandatory in RVA22U64, RVA23U64
     - ziccamoa: Mandatory in RVA20U64, RVA22U64, RVA23U64
     - ziccif: Mandatory in RVA20U64, RVA22U64, RVA23U64
     - zicclsm: Mandatory in RVA20U64, RVA22U64, RVA23U64
    
    Ziccrse specifies the main memory must support "RsrvEventual", which is
    one (totally there are four) of the support level for Load-Reserved/
    Store-Conditional (LR/SC) atomic instructions. Thus it depends on Zalrsc.
    
    Ziccamoa specifies the main memory must support AMOArithmetic, among the
    four levels of PMA support defined for AMOs in the A extension. Thus it
    depends on Zaamo.
    
    Za64rs defines reservation sets are contiguous, naturally aligned, and a
    maximum of 64 bytes. Za64rs is consumed by two extensions: Zalrsc and
    Zawrs. Zawrs itself depends on Zalrsc too.
    
    Based on the relationship that  "A" = Zaamo + Zalrsc, add the following
    dependencies checks:
     Za64rs -> Zalrsc or A
     Ziccrse -> Zalrsc or A
     Ziccamoa -> Zaamo or A
    
    Signed-off-by: Guodong Xu 
    Acked-by: Conor Dooley 
    Signed-off-by: Conor Dooley 

commit 0cdb7fc1879b1b858463125630f4dd5af6b111ad
Author: Guodong Xu 
Date:   Sat Jan 10 13:18:18 2026 +0800

    dt-bindings: riscv: Add B ISA extension description
    
    Add description of the single-letter B extension for Bit Manipulation.
    B is mandatory for RVA23U64.
    
    The B extension is ratified in the 20240411 version of the unprivileged
    ISA specification. According to the ratified spec, the B standard
    extension comprises instructions provided by the Zba, Zbb, and Zbs
    extensions.
    
    Add two-way dependency check to enforce that B implies Zba/Zbb/Zbs; and
    when Zba/Zbb/Zbs (all of them) are specified, then B must be added too.
    
    The reason why B/Zba/Zbb/Zbs must coexist at the same time is that
    unlike other single-letter extensions, B was ratified (Apr/2024) much
    later than its component extensions Zba/Zbb/Zbs (Jun/2021).
    
    When "b" is specified, zba/zbb/zbs must be present to ensure
    backward compatibility with existing software and kernels that only
    look for the explicit component strings.
    
    When all three components zba/zbb/zbs are specified, "b" should also be
    present. Making "b" mandatory when all three components are present.
    
    Existing devicetrees with zba/zbb/zbs but without "b" will generate
    warnings that can be fixed in follow-up patches.
    
    Signed-off-by: Guodong Xu 
    Signed-off-by: Conor Dooley 

commit fff010c776f715904ba0823bb347eac00dccffa2
Author: Guodong Xu 
Date:   Thu Dec 25 14:24:20 2025 +0800

    dt-bindings: riscv: update ratified version of h, svinval, svnapot, svpbmt
    
    The descriptions for h, svinval, svnapot, and svpbmt extensions currently
    reference the "20191213 version of the privileged ISA specification".
    While an Unprivileged ISA document exists with that date, there is no
    corresponding ratified Privileged ISA specification.
    
    These extensions were ratified in the RISC-V Instruction Set Manual,
    Volume II: Privileged Architecture, Version 20211203. Update the
    descriptions to reference the correct specification version.
    
    RISC-V International hosts a website [1] for ratified specifications.
    Following the "Ratified ISA Specifications", historical versions of
    Volume II Privileged ISA can be found.
    
    Link: https://riscv.org/specifications/ratified/ [1]
    Fixes: aeb71e42caae ("dt-bindings: riscv: deprecate riscv,isa")
    Acked-by: Conor Dooley 
    Signed-off-by: Guodong Xu 
    Signed-off-by: Conor Dooley 

commit ddfb8b322bbd8ae996f4ac0192f0190feb0a01ce
Author: Maurizio Lombardi 
Date:   Mon Nov 3 15:44:06 2025 +0100

    nvme: expose active quirks in sysfs
    
    Currently, there is no straightforward way for a user to inspect
    which quirks are active for a given device from userspace.
    
    Add a new "quirks" sysfs attribute to the nvme controller device.
    
    Reading this file will display a human-readable list
    of all active quirks, with each quirk name on a new line.
    If no quirks are active, it will display "none".
    
    Tested-by: John Meneghini 
    Reviewed-by: John Meneghini 
    Reviewed-by: Sagi Grimberg 
    Reviewed-by: Martin K. Petersen 
    Reviewed-by: Chaitanya Kulkarni 
    Signed-off-by: Maurizio Lombardi 
    Signed-off-by: Keith Busch 

commit cba202aa355d2c6297d55c9d5dacceae01266b9c
Author: Uwe Kleine-König 
Date:   Tue Dec 2 16:13:54 2025 +0100

    PCI/portdrv: Use bus-type functions
    
    Instead of assigning the probe function for each driver individually, use
    .probe() and .remove() from the pci_express bus. Rename the functions for
    consistency.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/83d1edc7d619423331fa6802f0e7da3919a308a9.1764688034.git.u.kleine-koenig@baylibre.com

commit 9d29a9c06f3e88e47ae43a26b61eebe7372dbee3
Author: Uwe Kleine-König 
Date:   Tue Dec 2 16:13:53 2025 +0100

    PCI/portdrv: Don't check for valid device and driver in bus callbacks
    
    The driver core ensures that in .probe() and .remove() both dev and
    dev->driver are valid. So drop the respective check.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/2cc2e15e05318b9f0d7b6a2b69b3169d2a6f0bd3.1764688034.git.u.kleine-koenig@baylibre.com

commit f947d9e77b26238b821b5227afb4fee8c7ea0d5a
Author: Wilfred Mallawa 
Date:   Mon Jan 12 09:39:03 2026 +1000

    nvme/host: fixup some typos
    
    Fix up some minor typos in the nvme host driver and a comment
    style to conform to the standard kernel style.
    
    Signed-off-by: Wilfred Mallawa 
    Reviewed-by: Damien Le Moal 
    Reviewed-by: Christoph Hellwig 
    Signed-off-by: Keith Busch 

commit 61df4929a74bfd4aed712d09b681378b470b6224
Author: Uwe Kleine-König 
Date:   Tue Dec 2 16:13:52 2025 +0100

    PCI/portdrv: Move pcie_port_bus_type to pcie source file
    
    Conceptually the pci_express bus doesn't belong in generic PCI code.
    Move pcie_port_bus_match() and pcie_port_bus_type to pcie/portdrv.c.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/420d771f0091dea7cf18f445b94301576dcee4c8.1764688034.git.u.kleine-koenig@baylibre.com

commit 0c1594df40a00a1e3ce8d4ce8c17838de1ec29f2
Author: Uwe Kleine-König 
Date:   Tue Dec 2 16:13:51 2025 +0100

    PCI/portdrv: Don't check for the driver's and device's bus
    
    The driver core ensures that the match function is only called for drivers
    and devices of the right bus. So drop the useless check.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/09ca261912a37d2b253f43359a5dfeec42c016dc.1764688034.git.u.kleine-koenig@baylibre.com

commit 15fff3b799ffa38970c6d58dc8dd0aaf3317fab7
Author: Uwe Kleine-König 
Date:   Tue Dec 2 16:13:50 2025 +0100

    PCI/portdrv: Drop empty shutdown callback
    
    .shutdown() is an optional callback and the core only calls it if the
    pointer in struct device_driver is non-NULL. So make nothing in a bit
    shorter time and remove the empty function.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Jonathan Cameron 
    Reviewed-by: Ilpo Järvinen 
    Link: https://patch.msgid.link/283fef06ac51efbb7df25f347d6f3a2967f96429.1764688034.git.u.kleine-koenig@baylibre.com

commit 01464a3fdf91c041a381d93a1b6fefbdb819a46f
Author: Uwe Kleine-König 
Date:   Tue Dec 2 16:13:49 2025 +0100

    PCI/portdrv: Fix potential resource leak
    
    pcie_port_probe_service() unconditionally calls get_device() (unless it
    fails). So drop that reference also unconditionally as it's fine for a
    PCIe driver to not have a remove callback.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Ilpo Järvinen 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/e1c68c3b3f1af8427e98ca5e2c79f8bf0ebe2ce4.1764688034.git.u.kleine-koenig@baylibre.com

commit bfec8ce11af00971909b454fafc07341620bfa9f
Author: Andy Shevchenko 
Date:   Tue Jan 13 11:07:26 2026 +0100

    pinctrl: lynxpoint: Convert to use intel_gpio_add_pin_ranges()
    
    Driver is ready to use intel_gpio_add_pin_ranges() directly instead of
    custom approach. Convert it now.
    
    Acked-by: Mika Westerberg 
    Signed-off-by: Andy Shevchenko 

commit 57db74bdaa546881f8351a35c9b6b4e9da4e0cc8
Author: Andy Shevchenko 
Date:   Tue Jan 13 11:07:34 2026 +0100

    pinctrl: baytrail: Convert to use intel_gpio_add_pin_ranges()
    
    Driver is ready to use intel_gpio_add_pin_ranges() directly instead of
    custom approach. Convert it now.
    
    Acked-by: Mika Westerberg 
    Signed-off-by: Andy Shevchenko 

commit 5473a722f782f79f96b4691400d681c01fcacc2f
Author: Eric Suen 
Date:   Thu Dec 4 18:42:59 2025 -0800

    selinux: add support for BPF token access control
    
    BPF token support was introduced to allow a privileged process to delegate
    limited BPF functionality—such as map creation and program loading—to
    an unprivileged process:
      https://lore.kernel.org/linux-security-module/20231130185229.2688956-1-andrii@kernel.org/
    
    This patch adds SELinux support for controlling BPF token access. With
    this change, SELinux policies can now enforce constraints on BPF token
    usage based on both the delegating (privileged) process and the recipient
    (unprivileged) process.
    
    Supported operations currently include:
      - map_create
      - prog_load
    
    High-level workflow:
      1. An unprivileged process creates a VFS context via `fsopen()` and
         obtains a file descriptor.
      2. This descriptor is passed to a privileged process, which configures
         BPF token delegation options and mounts a BPF filesystem.
      3. SELinux records the `creator_sid` of the privileged process during
         mount setup.
      4. The unprivileged process then uses this BPF fs mount to create a
         token and attach it to subsequent BPF syscalls.
      5. During verification of `map_create` and `prog_load`, SELinux uses
         `creator_sid` and the current SID to check policy permissions via:
           avc_has_perm(creator_sid, current_sid, SECCLASS_BPF,
                        BPF__MAP_CREATE, NULL);
    
    The implementation introduces two new permissions:
      - map_create_as
      - prog_load_as
    
    At token creation time, SELinux verifies that the current process has the
    appropriate `*_as` permission (depending on the `allowed_cmds` value in
    the bpf_token) to act on behalf of the `creator_sid`.
    
    Example SELinux policy:
      allow test_bpf_t self:bpf {
          map_create map_read map_write prog_load prog_run
          map_create_as prog_load_as
      };
    
    Additionally, a new policy capability bpf_token_perms is added to ensure
    backward compatibility. If disabled, previous behavior ((checks based on
    current process SID)) is preserved.
    
    Signed-off-by: Eric Suen 
    Tested-by: Daniel Durning 
    Reviewed-by: Daniel Durning 
    [PM: merge fuzz, subject tweaks, whitespace tweaks, line length tweaks]
    Signed-off-by: Paul Moore 

commit c55741148294700115ecacd19cb9c173721c1b6a
Author: Julia Lawall 
Date:   Tue Dec 30 17:52:13 2025 +0100

    perf addr_location: Update outdated comment
    
    The function addr_location__put() was renamed addr_location__exit() in
    commit 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy
    functions").  Make the comment preceding the function consistent with
    the function itself.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Julia Lawall 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Kexin Sun 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Ratnadira Widyasari 
    Cc: Xutong Ma 
    Cc: Yumbo Lyu 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit eebe6446ccb75ecb36cb145ab1cbc3db06cbc8d6
Author: Jan H. Schönherr 
Date:   Tue Jan 13 21:34:46 2026 +0100

    perf/core: Speed up kexec shutdown by avoiding unnecessary cross CPU calls
    
    There are typically a lot of PMUs registered, but in many cases only few
    of them have an event registered (like the "cpu" PMU in the presence of
    the watchdog). As the mutex is already held, it's safe to just check for
    existing events before doing the cross CPU call.
    
    This change saves tens of milliseconds from kexec time (perceived as
    steal time during a hypervisor host update), with <2ms remaining for
    this step in the shutdown. There might be additional potential for
    parallelization or we could just disable performance monitoring during
    the actual shutdown and be less graceful about it.
    
    Signed-off-by: Jan H. Schönherr 
    Signed-off-by: David Woodhouse 
    Signed-off-by: Peter Zijlstra (Intel) 

commit 6e052cfe47c7fea0ac7cae271c69c69f0db3ca0e
Author: James Clark 
Date:   Fri Jan 2 12:15:43 2026 +0000

    perf tools: Dump callchain context marker names
    
    These are hard to interpret in the raw output because they are printed
    as hex but are defined in perf_event.h as decimal. Make it much easier
    to read the raw callchains by just printing their names.
    
    For example:
    
      $ perf report -D
    
      1798195372321 0x4638 [0xb0]: PERF_RECORD_SAMPLE(IP, 0x4002): 44922/44922: 0x7c8046dd3400 period: 120218 addr: 0
      ... FP chain: nr:12
      .....  0: fffffffffffffe00 (PERF_CONTEXT_USER)
      .....  1: 00007c8046dd3400
      .....  2: 00007c8046db86d3
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    [ Add PERF_CONTEXT_USER_DEFERRED too, as per Namhyung's review comment ]
    Signed-off-by: Arnaldo Carvalho de Melo 

commit a66f6242fbf521f8371d6cda5eaee6dc7668683b
Author: James Clark 
Date:   Wed Dec 31 12:12:28 2025 +0000

    perf vendor events arm64: Remove uncountable events
    
    These events are never countable by the PMU and are only intended to
    be used as external inputs to trace. Therefore showing them in 'perf
    list' is misleading so remove them.
    
    The generator script doesn't emit these events when used with the new
    telemetry-solution input files [1].
    
    'perf list' should only show countable events because there are events
    that are sometimes implemented, sometimes countable and sometimes not,
    for example TRB_TRIG. If we always include any implemented events
    whether they are countable or not then it's not possible to tell whether
    they are usable in perf without going to the docs, defeating the point
    of 'perf list'.
    
    It's also not useful yet to display implemented events that are not
    countable (for help in using trace rather than perf stat), because
    PMU_OVFS and PMU_HOVFS are practically always implemented and TRB_TRIG
    is always implemented when there is TRBE.
    
    [1]: https://gitlab.arm.com/telemetry-solution/telemetry-solution/-/tree/main/data/pmu/cpu
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Akio Kakuno 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Garry 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Mike Leach 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Will Deacon 
    Cc: Yoshihiro Furudera 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit d1f9dc67238e716a4cc0ffd7014f501775d5f3ed
Author: Dapeng Mi 
Date:   Tue Dec 16 09:39:49 2025 +0800

    perf Documentation: Correct branch stack sampling call-stack option
    
    The correct call-stack option for branch stack sampling should be "stack"
    instead of "call_stack". Correct it.
    
    $perf record -e instructions -j call_stack -- sleep 1
    unknown branch filter call_stack, check man page
    
     Usage: perf record [] []
        or: perf record [] --  []
    
        -j, --branch-filter 
                              branch stack filter modes
    
    Fixes: 955f6def5590ce6c ("perf record: Add remaining branch filters: "no_cycles", "no_flags" & "hw_index"")
    Reviewed-by: Namhyung Kim 
    Signed-off-by: Dapeng Mi 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Anshuman Khandual 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: Peter Zijlstra 
    Cc: Thomas Falcon 
    Cc: Xudong Hao 
    Cc: Zide Chen 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 84010f9bcf5389717b4ad02b6f2124ff59413bdf
Author: Namhyung Kim 
Date:   Thu Dec 18 17:18:20 2025 -0800

    perf test: Do not skip when some metric-group tests succeed
    
    I think the return value of SKIP (2) should be used when it skipped the
    entire test suite rather than a few of them.  While the FAIL should be
    reserved if any of test failed.
    
      $ perf test -vv 109
      109: perf all metricgroups test:
      --- start ---
      test child forked, pid 2493003
      Testing Backend
      Testing Bad
      Testing BadSpec
      Testing BigFootprint
      Testing BrMispredicts
      Testing Branches
      Testing BvBC
      Testing BvBO
      Testing BvCB
      Testing BvFB
      Testing BvIO
      Testing BvMB
      Testing BvML
      Testing BvMP
      Testing BvMS
      Testing BvMT
      Testing BvOB
      Testing BvUW
      Testing CacheHits
      Testing CacheMisses
      Testing CodeGen
      Testing Compute
      Testing Cor
      Testing DSB
      Testing DSBmiss
      Testing DataSharing
      Testing Default
      Testing Default2
      Testing Default3
      Testing Default4
      Ignoring failures in Default4 that may contain unsupported legacy events
      Testing Fed
      Testing FetchBW
      Testing FetchLat
      Testing Flops
      Testing FpScalar
      Testing FpVector
      Testing Frontend
      Testing HPC
      Testing IcMiss
      Testing InsType
      Testing LSD
      Testing LockCont
      Testing MachineClears
      Testing Machine_Clears
      Testing Mem
      Testing MemOffcore
      Testing MemoryBW
      Testing MemoryBound
      Testing MemoryLat
      Testing MemoryTLB
      Testing Memory_BW
      Testing Memory_Lat
      Testing MicroSeq
      Testing OS
      Testing Offcore
      Testing PGO
      Testing Pipeline
      Testing PortsUtil
      Testing Power
      Testing Prefetches
      Testing Ret
      Testing Retire
      Testing SMT
      Testing Snoop
      Testing SoC
      Testing Summary
      Testing TmaL1
      Testing TmaL2
      Testing TmaL3mem
      Testing TopdownL1
      Testing TopdownL2
      Testing TopdownL3
      Testing TopdownL4
      Testing TopdownL5
      Testing TopdownL6
      Testing smi
      Testing tma_L1_group
      Testing tma_L2_group
      Testing tma_L3_group
      Testing tma_L4_group
      Testing tma_L5_group
      Testing tma_L6_group
      Testing tma_alu_op_utilization_group
      Testing tma_assists_group
      Testing tma_backend_bound_group
      Testing tma_bad_speculation_group
      Testing tma_branch_mispredicts_group
      Testing tma_branch_resteers_group
      Testing tma_code_stlb_miss_group
      Testing tma_core_bound_group
      Testing tma_divider_group
      Testing tma_dram_bound_group
      Testing tma_dtlb_load_group
      Testing tma_dtlb_store_group
      Testing tma_fetch_bandwidth_group
      Testing tma_fetch_latency_group
      Testing tma_fp_arith_group
      Testing tma_fp_vector_group
      Testing tma_frontend_bound_group
      Testing tma_heavy_operations_group
      Testing tma_icache_misses_group
      Testing tma_issue2P
      Testing tma_issueBM
      Testing tma_issueBW
      Testing tma_issueComp
      Testing tma_issueD0
      Testing tma_issueFB
      Testing tma_issueFL
      Testing tma_issueL1
      Testing tma_issueLat
      Testing tma_issueMC
      Testing tma_issueMS
      Testing tma_issueMV
      Testing tma_issueRFO
      Testing tma_issueSL
      Testing tma_issueSO
      Testing tma_issueSmSt
      Testing tma_issueSpSt
      Testing tma_issueSyncxn
      Testing tma_issueTLB
      Testing tma_itlb_misses_group
      Testing tma_l1_bound_group
      Testing tma_l2_bound_group
      Testing tma_l3_bound_group
      Testing tma_light_operations_group
      Testing tma_load_stlb_miss_group
      Testing tma_machine_clears_group
      Testing tma_memory_bound_group
      Testing tma_microcode_sequencer_group
      Testing tma_mite_group
      Testing tma_other_light_ops_group
      Testing tma_ports_utilization_group
      Testing tma_ports_utilized_0_group
      Testing tma_ports_utilized_3m_group
      Testing tma_retiring_group
      Testing tma_serializing_operation_group
      Testing tma_store_bound_group
      Testing tma_store_stlb_miss_group
      Testing transaction
      ---- end(0) ----
      109: perf all metricgroups test                                      : Ok
    
    Signed-off-by: Namhyung Kim 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 1c89bc1b95fa9058f3e7cd37f1142939261417d5
Author: Namhyung Kim 
Date:   Thu Dec 18 17:18:19 2025 -0800

    perf test: Do not skip when some metrics tests succeeded
    
    I think the return value of SKIP (2) should be used when it skipped the
    entire test suite rather than a few of them.  While the FAIL should be
    reserved if any of test failed.
    
      $ perf test -vv 110
      110: perf all metrics test:
      --- start ---
      test child forked, pid 2496399
      Testing tma_core_bound
      Testing tma_info_core_ilp
      Testing tma_info_memory_l2mpki
      Testing tma_memory_bound
      Testing tma_bottleneck_irregular_overhead
      Testing tma_bottleneck_mispredictions
      Testing tma_info_bad_spec_branch_misprediction_cost
      Testing tma_info_bad_spec_ipmisp_cond_ntaken
      Testing tma_info_bad_spec_ipmisp_cond_taken
      Testing tma_info_bad_spec_ipmisp_indirect
      Testing tma_info_bad_spec_ipmisp_ret
      Testing tma_info_bad_spec_ipmispredict
      Testing tma_info_branches_callret
      Testing tma_info_branches_cond_nt
      Testing tma_info_branches_cond_tk
      Testing tma_info_branches_jump
      Testing tma_info_branches_other_branches
      Testing tma_branch_mispredicts
      Testing tma_clears_resteers
      Testing tma_machine_clears
      Testing tma_mispredicts_resteers
      Testing tma_bottleneck_big_code
      Testing tma_icache_misses
      Testing tma_itlb_misses
      Testing tma_unknown_branches
      Testing tma_info_bad_spec_spec_clears_ratio
      Testing tma_other_mispredicts
      Testing tma_branch_instructions
      Testing tma_info_frontend_tbpc
      Testing tma_info_inst_mix_bptkbranch
      Testing tma_info_inst_mix_ipbranch
      Testing tma_info_inst_mix_ipcall
      Testing tma_info_inst_mix_iptb
      Testing tma_info_system_ipfarbranch
      Testing tma_info_thread_uptb
      Testing tma_bottleneck_branching_overhead
      Testing tma_nop_instructions
      Testing tma_bottleneck_compute_bound_est
      Testing tma_divider
      Testing tma_ports_utilized_3m
      Testing tma_bottleneck_instruction_fetch_bw
      Testing tma_frontend_bound
      Testing tma_assists
      Testing tma_other_nukes
      Testing tma_serializing_operation
      Testing tma_bottleneck_data_cache_memory_bandwidth
      Testing tma_fb_full
      Testing tma_mem_bandwidth
      Testing tma_sq_full
      Testing tma_bottleneck_data_cache_memory_latency
      Testing tma_l1_latency_dependency
      Testing tma_l2_bound
      Testing tma_l3_hit_latency
      Testing tma_mem_latency
      Testing tma_store_latency
      Testing tma_bottleneck_memory_synchronization
      Testing tma_contested_accesses
      Testing tma_data_sharing
      Testing tma_false_sharing
      Testing tma_bottleneck_memory_data_tlbs
      Testing tma_dtlb_load
      Testing tma_dtlb_store
      Testing tma_backend_bound
      Testing tma_bottleneck_other_bottlenecks
      Testing tma_bottleneck_useful_work
      Testing tma_retiring
      Testing tma_info_memory_fb_hpki
      Testing tma_info_memory_l1mpki
      Testing tma_info_memory_l1mpki_load
      Testing tma_info_memory_l2hpki_all
      Testing tma_info_memory_l2hpki_load
      Testing tma_info_memory_l2mpki_all
      Testing tma_info_memory_l2mpki_load
      Testing tma_l1_bound
      Testing tma_l3_bound
      Testing tma_info_memory_l2mpki_rfo
      Testing tma_fp_scalar
      Testing tma_fp_vector
      Testing tma_fp_vector_128b
      Testing tma_fp_vector_256b
      Testing tma_fp_vector_512b
      Testing tma_port_0
      Testing tma_x87_use
      Testing tma_info_botlnk_l0_core_bound_likely
      Testing tma_info_core_fp_arith_utilization
      Testing tma_info_pipeline_execute
      Testing tma_info_system_gflops
      Testing tma_info_thread_execute_per_issue
      Testing tma_dsb
      Testing tma_info_botlnk_l2_dsb_bandwidth
      Testing tma_info_frontend_dsb_coverage
      Testing tma_decoder0_alone
      Testing tma_dsb_switches
      Testing tma_info_botlnk_l2_dsb_misses
      Testing tma_info_frontend_dsb_switch_cost
      Testing tma_info_frontend_ipdsb_miss_ret
      Testing tma_mite
      Testing tma_mite_4wide
      Testing CPUs_utilized
      Testing backend_cycles_idle
      [Ignored backend_cycles_idle] failed but as a Default metric this can be expected
      Performance counter stats for 'perf test -w noploop':  cpu-cycles:u  stalled-cycles-backend:u 1.014051473 seconds time elapsed 1.005718000 seconds user 0.008013000 seconds sys
      Testing branch_frequency
      Testing branch_miss_rate
      Testing cs_per_second
      Testing cycles_frequency
      Testing frontend_cycles_idle
      [Ignored frontend_cycles_idle] failed but as a Default metric this can be expected
      Performance counter stats for 'perf test -w noploop':  cpu-cycles:u  stalled-cycles-frontend:u 1.012813656 seconds time elapsed 1.004603000 seconds user 0.008004000 seconds sys
      Testing insn_per_cycle
      Testing migrations_per_second
      Testing page_faults_per_second
      Testing stalled_cycles_per_instruction
      [Ignored stalled_cycles_per_instruction] failed but as a Default metric this can be expected
      Error: No supported events found. The stalled-cycles-backend:u event is not supported.
      Testing tma_bad_speculation
      Testing l1d_miss_rate
      Testing llc_miss_rate
      Testing dtlb_miss_rate
      Testing itlb_miss_rate
      [Ignored itlb_miss_rate] failed but as a Default metric this can be expected
      Performance counter stats for 'perf test -w noploop':  iTLB-loads:u 3,097 iTLB-load-misses:u 1.012766732 seconds time elapsed 1.004318000 seconds user 0.008002000 seconds sys
      Testing l1i_miss_rate
      [Ignored l1i_miss_rate] failed but as a Default metric this can be expected
      Performance counter stats for 'perf test -w noploop':  L1-icache-load-misses:u  L1-icache-loads:u 1.013606395 seconds time elapsed 1.001371000 seconds user 0.011968000 seconds sys
      Testing l1_prefetch_miss_rate
      [Ignored l1_prefetch_miss_rate] failed but as a Default metric this can be expected
      Error: No supported events found. The L1-dcache-prefetches:u event is not supported.
      Testing tma_info_botlnk_l2_ic_misses
      Testing tma_info_frontend_fetch_upc
      Testing tma_info_frontend_icache_miss_latency
      Testing tma_info_frontend_ipunknown_branch
      Testing tma_info_frontend_lsd_coverage
      Testing tma_info_memory_tlb_code_stlb_mpki
      Testing tma_info_pipeline_fetch_dsb
      Testing tma_info_pipeline_fetch_lsd
      Testing tma_info_pipeline_fetch_mite
      Testing tma_info_pipeline_fetch_ms
      Testing tma_fetch_bandwidth
      Testing tma_lsd
      Testing tma_branch_resteers
      Testing tma_code_l2_hit
      Testing tma_code_l2_miss
      Testing tma_code_stlb_hit
      Testing tma_code_stlb_miss
      Testing tma_code_stlb_miss_2m
      Testing tma_code_stlb_miss_4k
      Testing tma_lcp
      Testing tma_ms_switches
      Testing tma_info_core_flopc
      Testing tma_info_inst_mix_iparith
      Testing tma_info_inst_mix_iparith_avx128
      Testing tma_info_inst_mix_iparith_avx256
      Testing tma_info_inst_mix_iparith_avx512
      Testing tma_info_inst_mix_iparith_scalar_dp
      Testing tma_info_inst_mix_iparith_scalar_sp
      Testing tma_info_inst_mix_ipflop
      Testing tma_info_inst_mix_ippause
      Testing tma_fetch_latency
      Testing tma_fp_arith
      Testing tma_fp_assists
      Testing tma_info_system_cpu_utilization
      Testing tma_info_system_dram_bw_use
      [Skipped tma_info_system_dram_bw_use] Not supported events
      Performance counter stats for 'perf test -w noploop':  UNC_ARB_TRK_REQUESTS.ALL:u  UNC_ARB_COH_TRK_REQUESTS.ALL:u 1,013,554,749 duration_time 1.013527265 seconds time elapsed 1.005417000 seconds user 0.008011000 seconds sys
      Testing tma_info_frontend_l2mpki_code
      Testing tma_info_frontend_l2mpki_code_all
      Testing tma_info_inst_mix_ipload
      Testing tma_info_inst_mix_ipstore
      Testing tma_info_memory_latency_load_l2_miss_latency
      Testing tma_lock_latency
      Testing tma_info_memory_core_l1d_cache_fill_bw_2t
      Testing tma_info_memory_core_l2_cache_fill_bw_2t
      Testing tma_info_memory_core_l3_cache_access_bw_2t
      Testing tma_info_memory_core_l3_cache_fill_bw_2t
      Testing tma_info_memory_l1d_cache_fill_bw
      Testing tma_info_memory_l2_cache_fill_bw
      Testing tma_info_memory_l3_cache_access_bw
      Testing tma_info_memory_l3_cache_fill_bw
      Testing tma_info_memory_l3mpki
      Testing tma_info_memory_load_miss_real_latency
      Testing tma_info_memory_mix_bus_lock_pki
      Testing tma_info_memory_mix_uc_load_pki
      Testing tma_info_memory_mlp
      Testing tma_info_memory_tlb_load_stlb_mpki
      Testing tma_info_memory_tlb_page_walks_utilization
      Testing tma_info_memory_tlb_store_stlb_mpki
      Testing tma_info_system_mem_parallel_reads
      [Skipped tma_info_system_mem_parallel_reads] Not supported events
      Performance counter stats for 'perf test -w noploop':  UNC_ARB_DAT_OCCUPANCY.RD:u  UNC_ARB_DAT_OCCUPANCY.RD/cmask=1/ 1.013354884 seconds time elapsed 1.009239000 seconds user 0.004004000 seconds sys
      Testing tma_info_system_mem_read_latency
      [Skipped tma_info_system_mem_read_latency] Not supported events
      Performance counter stats for 'perf test -w noploop':  UNC_ARB_DAT_OCCUPANCY.RD:u  UNC_ARB_TRK_OCCUPANCY.RD  UNC_ARB_TRK_REQUESTS.RD 1.012882143 seconds time elapsed 1.004600000 seconds user 0.008036000 seconds sys
      Testing tma_info_thread_cpi
      Testing tma_streaming_stores
      Testing tma_dram_bound
      Testing tma_store_bound
      Testing tma_l2_hit_latency
      Testing tma_load_stlb_hit
      Testing tma_load_stlb_miss
      Testing tma_load_stlb_miss_1g
      Testing tma_load_stlb_miss_2m
      Testing tma_load_stlb_miss_4k
      Testing tma_store_stlb_hit
      Testing tma_store_stlb_miss
      Testing tma_store_stlb_miss_1g
      Testing tma_store_stlb_miss_2m
      Testing tma_store_stlb_miss_4k
      Testing tma_info_memory_latency_data_l2_mlp
      Testing tma_info_memory_latency_load_l2_mlp
      Testing tma_info_pipeline_ipassist
      Testing tma_microcode_sequencer
      Testing tma_ms
      Testing tma_info_system_kernel_cpi
      [Failed tma_info_system_kernel_cpi] Metric contains missing events
      Error: No supported events found. Access to performance monitoring and observability operations is limited. Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open access to performance monitoring and observability operations for processes without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability. More information can be found at 'Perf events and tool security' document: https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html perf_event_paranoid setting is 2: -1: Allow use of (almost) all events by all users Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK >= 0: Disallow raw and ftrace function tracepoint access >= 1: Disallow CPU event access >= 2: Disallow kernel profiling To make the adjusted perf_event_paranoid setting permanent preserve it in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = )
      Testing tma_info_system_kernel_utilization
      [Failed tma_info_system_kernel_utilization] Metric contains missing events
      Error: No supported events found. Access to performance monitoring and observability operations is limited. Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open access to performance monitoring and observability operations for processes without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability. More information can be found at 'Perf events and tool security' document: https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html perf_event_paranoid setting is 2: -1: Allow use of (almost) all events by all users Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK >= 0: Disallow raw and ftrace function tracepoint access >= 1: Disallow CPU event access >= 2: Disallow kernel profiling To make the adjusted perf_event_paranoid setting permanent preserve it in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = )
      Testing tma_info_pipeline_retire
      Testing tma_info_thread_clks
      Testing tma_info_thread_uoppi
      Testing tma_memory_operations
      Testing tma_other_light_ops
      Testing tma_ports_utilization
      Testing tma_ports_utilized_0
      Testing tma_ports_utilized_1
      Testing tma_ports_utilized_2
      Testing C10_Pkg_Residency
      [Failed C10_Pkg_Residency] Metric contains missing events
      WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c10-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c10-residency/u) in per-thread mode, enable system wide with '-a'.
      Testing C2_Pkg_Residency
      [Failed C2_Pkg_Residency] Metric contains missing events
      WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c2-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c2-residency/u) in per-thread mode, enable system wide with '-a'.
      Testing C3_Pkg_Residency
      [Failed C3_Pkg_Residency] Metric contains missing events
      WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { msr/tsc/, cstate_pkg/c3-residency/ } Error: No supported events found. Invalid event (msr/tsc/u) in per-thread mode, enable system wide with '-a'.
      Testing C6_Core_Residency
      [Failed C6_Core_Residency] Metric contains missing events
      WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_core/c6-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_core/c6-residency/u) in per-thread mode, enable system wide with '-a'.
      Testing C6_Pkg_Residency
      [Failed C6_Pkg_Residency] Metric contains missing events
      WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c6-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c6-residency/u) in per-thread mode, enable system wide with '-a'.
      Testing C7_Core_Residency
      [Failed C7_Core_Residency] Metric contains missing events
      WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_core/c7-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_core/c7-residency/u) in per-thread mode, enable system wide with '-a'.
      Testing C7_Pkg_Residency
      [Failed C7_Pkg_Residency] Metric contains missing events
      WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c7-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c7-residency/u) in per-thread mode, enable system wide with '-a'.
      Testing C8_Pkg_Residency
      [Failed C8_Pkg_Residency] Metric contains missing events
      WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c8-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c8-residency/u) in per-thread mode, enable system wide with '-a'.
      Testing C9_Pkg_Residency
      [Failed C9_Pkg_Residency] Metric contains missing events
      WARNING: grouped events cpus do not match. Events with CPUs not matching the leader will be removed from the group. anon group { cstate_pkg/c9-residency/, msr/tsc/ } Error: No supported events found. Invalid event (cstate_pkg/c9-residency/u) in per-thread mode, enable system wide with '-a'.
      Testing tma_info_core_epc
      Testing tma_info_system_core_frequency
      Testing tma_info_system_power
      [Skipped tma_info_system_power] Not supported events
      Performance counter stats for 'perf test -w noploop':  Joules power/energy-pkg/u 1,013,238,256 duration_time 1.013223072 seconds time elapsed 0.995924000 seconds user 0.011903000 seconds sys
      Testing tma_info_system_power_license0_utilization
      Testing tma_info_system_power_license1_utilization
      Testing tma_info_system_power_license2_utilization
      Testing tma_info_system_turbo_utilization
      Testing tma_info_inst_mix_ipswpf
      Testing tma_info_memory_prefetches_useless_hwpf
      Testing tma_info_core_coreipc
      Testing tma_info_thread_ipc
      Testing tma_heavy_operations
      Testing tma_light_operations
      Testing tma_info_core_core_clks
      Testing tma_info_system_smt_2t_utilization
      Testing tma_info_thread_slots_utilization
      Testing UNCORE_FREQ
      [Skipped UNCORE_FREQ] Not supported events
      Performance counter stats for 'perf test -w noploop':  UNC_CLOCK.SOCKET:u 1,015,993,466 duration_time 1.015949387 seconds time elapsed 1.007676000 seconds user 0.008029000 seconds sys
      Testing tma_info_system_socket_clks
      [Failed tma_info_system_socket_clks] Metric contains missing events
      Error: No supported events found. Invalid event (UNC_CLOCK.SOCKET:u) in per-thread mode, enable system wide with '-a'.
      Testing tma_info_inst_mix_instructions
      Testing tma_info_system_cpus_utilized
      Testing tma_info_system_mux
      Testing tma_info_system_time
      Testing tma_info_thread_slots
      Testing tma_few_uops_instructions
      Testing tma_4k_aliasing
      Testing tma_cisc
      Testing tma_fp_divider
      Testing tma_int_divider
      Testing tma_slow_pause
      Testing tma_split_loads
      Testing tma_split_stores
      Testing tma_store_fwd_blk
      Testing tma_alu_op_utilization
      Testing tma_load_op_utilization
      Testing tma_mixing_vectors
      Testing tma_store_op_utilization
      Testing tma_port_1
      Testing tma_port_5
      Testing tma_port_6
      Testing smi_cycles
      [Skipped smi_cycles] Not supported events
      Performance counter stats for 'perf test -w noploop':  msr/smi/u  msr/aperf/u 3,965,789,327 cycles:u 1.012779591 seconds time elapsed 1.004579000 seconds user 0.007972000 seconds sys
      Testing smi_num
      [Failed smi_num] Metric contains missing events
      Error: No supported events found. Invalid event (msr/smi/u) in per-thread mode, enable system wide with '-a'.
      Testing tsx_aborted_cycles
      Testing tsx_cycles_per_elision
      Testing tsx_cycles_per_transaction
      Testing tsx_transactional_cycles
      ---- end(-1) ----
      110: perf all metrics test                                           : FAILED!
    
    Signed-off-by: Namhyung Kim 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit f552878a720bf765cc1616ee4a4e243cc03e4b27
Author: Namhyung Kim 
Date:   Thu Dec 18 17:18:18 2025 -0800

    perf test: Use shelldir to refer perf source location
    
    It uses tools/perf/include which assumes it's running from the root of
    the linux kernel source tree.  But you can run perf from other places
    like tools/perf, then the include path won't match.  We can use the
    shelldir variable to locate the test script in the tree.
    
      $ cd tools/perf
    
      $ ./perf test dlfilter
       63: dlfilter C API                                                  : Ok
      101: perf script --dlfilter tests                                    : Ok
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit b2629e7846e35dbf12de6d7b8e81f0049f6a50ea
Author: Namhyung Kim 
Date:   Thu Dec 18 17:18:17 2025 -0800

    perf test: Skip dlfilter test for build failures
    
    For some reason, it may fail to build the dlfilter.  Let's skip the test
    as it's not an error in the perf.  This can happen when you run the perf
    test without source code or in a different directory.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit dd9f6d30c64001ca4dde973ac04d8d155e856743
Author: Imran Khan 
Date:   Tue Jan 13 22:37:27 2026 +0800

    genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask
    
    During CPU offlining the interrupts affined to that CPU are moved to other
    online CPUs, which might break the original affinity mask if the outgoing
    CPU was the last online CPU in that mask. This change is not propagated to
    irq_desc::affinity_notify(), which leaves users of the affinity notifier
    mechanism with stale information.
    
    Avoid this by scheduling affinity change notification work for interrupts
    that were affined to the CPU being offlined, if the new target CPU is not
    part of the original affinity mask.
    
    Since irq_set_affinity_locked() uses the same logic to schedule affinity
    change notification work, split out this logic into a dedicated function
    and use that at both places.
    
    [ tglx: Removed the EXPORT(), removed the !SMP stub, moved the prototype,
            added a lockdep assert instead of a comment, fixed up coding style
            and name space. Polished and clarified the change log ]
    
    Signed-off-by: Imran Khan 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20260113143727.1041265-1-imran.f.khan@oracle.com

commit 0697b4f400696c1311cbd14421698b340dd8f7d4
Author: Al Viro 
Date:   Tue Oct 28 02:29:04 2025 -0400

    switch {alloc,free}_bprm() to CLASS()
    
    All linux_binprm instances come from alloc_bprm() and are unconditionally
    destroyed by free_bprm() in the end of the same scope.  IOW, CLASS()
    machinery is a decent fit for those.
    
    Signed-off-by: Al Viro 

commit 194c760b6acd214e47f2504cede9a9dbadd8fcba
Author: Al Viro 
Date:   Wed Jan 7 15:20:45 2026 -0500

    do_execveat_common(): don't consume filename reference
    
    ... and convert its callers to CLASS(filename...)
    
    Signed-off-by: Al Viro 

commit 88b33614f9ca09a0f6471b1790f5f718d01d84a6
Author: Al Viro 
Date:   Wed Jan 7 15:16:24 2026 -0500

    execve: fold {compat_,}do_execve{,at}() into their sole callers
    
    All of them are wrappers for do_execveat_common() and each has
    exactly one caller.  The only difference is in the way they are
    constructing argv/envp arguments for do_execveat_common() and
    that's easy to do with less boilerplate.
    
    Signed-off-by: Al Viro 

commit bb850584aaa2f31bc6c494f973047a325961b333
Author: Al Viro 
Date:   Thu Sep 25 17:18:42 2025 -0400

    simplify the callers of alloc_bprm()
    
    alloc_bprm() starts with do_open_execat() and it will do the right
    thing if given ERR_PTR() for name.  Allows to drop such checks in
    its callers...
    
    Signed-off-by: Al Viro 

commit 2c941f26c6abc032fd7800ac7dcbfaf3cb586e21
Author: Al Viro 
Date:   Thu Sep 25 17:14:20 2025 -0400

    simplify the callers of do_open_execat()
    
    Signed-off-by: Al Viro 

commit 47b3b9bf93ec66ec2443f553c22e12e0475f1395
Author: Al Viro 
Date:   Thu Sep 25 17:11:36 2025 -0400

    simplify the callers of file_open_name()
    
    It accepts ERR_PTR() for name and does the right thing in that case.
    That allows to simplify the logics in callers, making them trivial
    to switch to CLASS(filename).
    
    Signed-off-by: Al Viro 

commit 151e3257d61941ac07a7daacdb66ddc645f6ca34
Author: Al Viro 
Date:   Tue Oct 28 00:11:45 2025 -0400

    do_sys_openat2(): get rid of useless check, switch to CLASS(filename)
    
    do_file_open() will do the right thing when given ERR_PTR() as name...
    
    Signed-off-by: Al Viro 

commit 541003b576c3e3c328314398a6df76eb3cebf847
Author: Al Viro 
Date:   Tue Oct 28 00:11:45 2025 -0400

    rename do_filp_open() to do_file_open()
    
    "filp" thing never made sense; seeing that there are exactly 4 callers
    in the entire tree (and it's neither exported nor even declared in
    linux/*/*.h), there's no point keeping that ugliness.
    
    FWIW, the 'filp' thing did originate in OSD&I; for some reason Tanenbaum
    decided to call the object representing an opened file 'struct filp',
    the last letter standing for 'position'.  In all Unices, Linux included,
    the corresponding object had always been 'struct file'...
    
    Signed-off-by: Al Viro 

commit 2e2d64aea5c59ba976fced4bf44832ea425a3f3f
Author: Al Viro 
Date:   Thu Sep 25 17:02:28 2025 -0400

    do_filp_open(): DTRT when getting ERR_PTR() as pathname
    
    The rest of the set_nameidata() callers treat IS_ERR(pathname) as
    "bail out immediately with PTR_ERR(pathname) as error".  Makes
    life simpler for callers; do_filp_open() is the only exception
    and its callers would also benefit from such calling conventions
    change.
    
    Signed-off-by: Al Viro 

commit ba33ac100d3feb1efb43b32e63cc0c6430936aa3
Author: Al Viro 
Date:   Fri Oct 31 01:13:32 2025 -0400

    ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name
    
    no need to check in the caller
    
    Signed-off-by: Al Viro 

commit edefe6bda719d49384b22c524ef8102ce9c632e9
Author: Al Viro 
Date:   Fri Oct 31 01:12:04 2025 -0400

    ksmbd_vfs_path_lookup(): vfs_path_parent_lookup() accepts ERR_PTR() as name
    
    no need to check in the caller
    
    Signed-off-by: Al Viro 

commit 1c38f1f9b0a62651db5afcd37b964eb6b377fe66
Author: Al Viro 
Date:   Fri Oct 31 01:06:29 2025 -0400

    move_mount(): filename_lookup() accepts ERR_PTR() as filename
    
    no need to check it in the caller
    
    Signed-off-by: Al Viro 

commit def2a02a4cdce359084ba7f3ddc5ea204177a3de
Author: Al Viro 
Date:   Fri Oct 31 01:03:58 2025 -0400

    file_setattr(): filename_lookup() accepts ERR_PTR() as filename
    
    no need to check it in the caller
    
    Signed-off-by: Al Viro 

commit 58a49cc9ebb13efd1c56c3466b09240779ac46a2
Author: Al Viro 
Date:   Fri Oct 31 01:02:50 2025 -0400

    file_getattr(): filename_lookup() accepts ERR_PTR() as filename
    
    no need to check it in the caller
    
    Signed-off-by: Al Viro 

commit 741c97fecb6a4160014a76759e9b8c0880fc44f1
Author: Al Viro 
Date:   Sun Nov 2 01:01:47 2025 -0400

    struct filename ->refcnt doesn't need to be atomic
    
    ... or visible outside of audit, really.  Note that references
    held in delayed_filename always have refcount 1, and from the
    moment of complete_getname() or equivalent point in getname...()
    there won't be any references to struct filename instance left
    in places visible to other threads.
    
    Acked-by: Paul Moore 
    Signed-off-by: Al Viro 

commit 9fa3ec84587c5eca7580eafc27eee332bc3a5a0e
Author: Al Viro 
Date:   Sat Nov 1 20:29:06 2025 -0400

    allow incomplete imports of filenames
    
    There are two filename-related problems in io_uring and its
    interplay with audit.
    
    Filenames are imported when request is submitted and used when
    it is processed.  Unfortunately, the latter may very well
    happen in a different thread.  In that case the reference to
    filename is put into the wrong audit_context - that of submitting
    thread, not the processing one.  Audit logics is called by
    the latter, and it really wants to be able to find the names
    in audit_context current (== processing) thread.
    
    Another related problem is the headache with refcounts -
    normally all references to given struct filename are visible
    only to one thread (the one that uses that struct filename).
    io_uring violates that - an extra reference is stashed in
    audit_context of submitter.  It gets dropped when submitter
    returns to userland, which can happen simultaneously with
    processing thread deciding to drop the reference it got.
    
    We paper over that by making refcount atomic, but that means
    pointless headache for everyone.
    
    Solution: the notion of partially imported filenames.  Namely,
    already copied from userland, but *not* exposed to audit yet.
    
    io_uring can create that in submitter thread, and complete the
    import (obtaining the usual reference to struct filename) in
    processing thread.
    
    Object: struct delayed_filename.
    
    Primitives for working with it:
    
    delayed_getname(&delayed_filename, user_string) - copies the name from
    userland, returning 0 and stashing the address of (still incomplete)
    struct filename in delayed_filename on success and returning -E... on
    error.
    
    delayed_getname_uflags(&delayed_filename, user_string, atflags) -
    similar, in the same relation to delayed_getname() as getname_uflags()
    is to getname()
    
    complete_getname(&delayed_filename) - completes the import of filename
    stashed in delayed_filename and returns struct filename to caller,
    emptying delayed_filename.
    
    CLASS(filename_complete_delayed, name)(&delayed_filename) - variant of
    CLASS(filename) with complete_getname() for constructor.
    
    dismiss_delayed_filename(&delayed_filename) - destructor; drops whatever
    might be stashed in delayed_filename, emptying it.
    
    putname_to_delayed(&delayed_filename, name) - if name is shared, stashes
    its copy into delayed_filename and drops the reference to name, otherwise
    stashes the name itself in there.
    
    Signed-off-by: Al Viro 

commit a9900a27dfe58e638690a6c3e8d477daa548d192
Author: Al Viro 
Date:   Tue Jan 6 21:00:10 2026 -0500

    switch __getname_maybe_null() to CLASS(filename_flags)
    
    Signed-off-by: Al Viro 

commit 7ca83f8ebe86706c4164ac21871f4a5adb86a430
Author: Mateusz Guzik 
Date:   Mon Dec 1 09:32:26 2025 +0100

    fs: hide names_cache behind runtime const machinery
    
    s/names_cachep/names_cache/ for consistency with dentry cache.
    
    Signed-off-by: Mateusz Guzik 
    Signed-off-by: Al Viro 

commit 8c888b31903cc2acfbf054c23d702caf68857810
Author: Al Viro 
Date:   Wed Nov 19 19:45:04 2025 -0500

    struct filename: saner handling of long names
    
    Always allocate struct filename from names_cachep, long name or short;
    short names would be embedded into struct filename.  Longer ones do
    not cannibalize the original struct filename - put them into kmalloc'ed
    buffers (PATH_MAX-sized for import from userland, strlen() + 1 - for
    ones originating kernel-side, where we know the length beforehand).
    
    Cutoff length for short names is chosen so that struct filename would be
    192 bytes long - that's both a multiple of 64 and large enough to cover
    the majority of real-world uses.
    
    Simplifies logics in getname()/putname() and friends.
    
    [fixed an embarrassing braino in EMBEDDED_NAME_MAX, first reported by
    Dan Carpenter]
    
    Signed-off-by: Al Viro 

commit c3a3577cdb351e74d6ff6bc328c3bee18ce69298
Author: Al Viro 
Date:   Wed Nov 19 19:19:24 2025 -0500

    struct filename: use names_cachep only for getname() and friends
    
            Instances of struct filename come from names_cachep (via
    __getname()).  That is done by getname_flags() and getname_kernel()
    and these two are the main callers of __getname().  However, there are
    other callers that simply want to allocate PATH_MAX bytes for uses that
    have nothing to do with struct filename.
    
            We want saner allocation rules for long pathnames, so that struct
    filename would *always* come from names_cachep, with the out-of-line
    pathname getting kmalloc'ed.  For that we need to be able to change the
    size of objects allocated by getname_flags()/getname_kernel().
    
            That requires the rest of __getname() users to stop using
    names_cachep; we could explicitly switch all of those to kmalloc(),
    but that would cause quite a bit of noise.  So the plan is to switch
    getname_...() to new helpers and turn __getname() into a wrapper for
    kmalloc().  Remaining __getname() users could be converted to explicit
    kmalloc() at leisure, hopefully along with figuring out what size do
    they really want - PATH_MAX is an overkill for some of them, used out
    of laziness ("we have a convenient helper that does 4K allocations and
    that's large enough, let's use it").
    
            As a side benefit, names_cachep is no longer used outside
    of fs/namei.c, so we can move it there and be done with that.
    
    Signed-off-by: Al Viro 

commit 8f2ac8481731fb5d01ad54f66aa0334a8913b3c2
Author: Al Viro 
Date:   Wed Nov 19 17:28:04 2025 -0500

    getname_flags() massage, part 2
    
    Take the "long name" case into a helper (getname_long()). In
    case of failure have the caller deal with freeing the original
    struct filename.
    
    Signed-off-by: Al Viro 

commit 8ba29c85e2ef24764a05b557ebeca32f9bfafada
Author: Al Viro 
Date:   Wed Nov 19 17:15:23 2025 -0500

    getname_flags() massage, part 1
    
    In case of long name don't reread what we'd already copied.
    memmove() it instead.  That avoids the possibility of ending
    up with empty name there and the need to look at the flags
    on the slow path.
    
    Signed-off-by: Al Viro 

commit ca2a04e84af79596e5cd9cfe697d5122ec39c8ce
Author: Al Viro 
Date:   Wed Nov 19 16:15:04 2025 -0500

    ntfs: ->d_compare() must not block
    
    ... so don't use __getname() there.  Switch it (and ntfs_d_hash(), while
    we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT).  Yes, ntfs_d_hash()
    almost certainly can do with smaller allocations, but let ntfs folks
    deal with that - keep the allocation size as-is for now.
    
    Stop abusing names_cachep in ntfs, period - various uses of that thing
    in there have nothing to do with pathnames; just use k[mz]alloc() and
    be done with that.  For now let's keep sizes as-in, but AFAICS none of
    the users actually want PATH_MAX.
    
    Signed-off-by: Al Viro 

commit 41670a5900a8866b8cab52ab5936b5e9ef06fe91
Author: Al Viro 
Date:   Sat Nov 1 01:54:52 2025 -0400

    get rid of audit_reusename()
    
    Originally we tried to avoid multiple insertions into audit names array
    during retry loop by a cute hack - memorize the userland pointer and
    if there already is a match, just grab an extra reference to it.
    
    Cute as it had been, it had problems - two identical pointers had
    audit aux entries merged, two identical strings did not.  Having
    different behaviour for syscalls that differ only by addresses of
    otherwise identical string arguments is obviously wrong - if nothing
    else, compiler can decide to merge identical string literals.
    
    Besides, this hack does nothing for non-audited processes - they get
    a fresh copy for retry.  It's not time-critical, but having behaviour
    subtly differ that way is bogus.
    
    These days we have very few places that import filename more than once
    (9 functions total) and it's easy to massage them so we get rid of all
    re-imports.  With that done, we don't need audit_reusename() anymore.
    There's no need to memorize userland pointer either.
    
    Acked-by: Paul Moore 
    Signed-off-by: Al Viro 

commit 1ee5220eb364f7ac22fc6102e61c7b33e593f365
Author: Al Viro 
Date:   Sat Nov 1 00:48:31 2025 -0400

    do_readlinkat(): import pathname only once
    
    Take getname_flags() and putname() outside of retry loop.
    
    Since getname_flags() is the only thing that cares about LOOKUP_EMPTY,
    don't bother with setting LOOKUP_EMPTY in lookup_flags - just pass it
    to getname_flags() and be done with that.
    
    The things could be further simplified by use of cleanup.h stuff, but
    let's not clutter the patch with that.
    
    Signed-off-by: Al Viro 

commit cf6b819c229af0d692a0e288261b4d8d73554a0d
Author: Al Viro 
Date:   Sat Nov 1 00:48:31 2025 -0400

    do_sys_truncate(): import pathname only once
    
    Convert the user_path_at() call inside a retry loop into getname_flags() +
    filename_lookup() + putname() and leave only filename_lookup() inside
    the loop.
    
    In this case we never pass LOOKUP_EMPTY, so getname_flags() is equivalent
    to plain getname().
    
    The things could be further simplified by use of cleanup.h stuff, but
    let's not clutter the patch with that.
    
    Signed-off-by: Al Viro 

commit 85a4fe3c99a78999e5ce41d51292a1b665f314be
Author: Al Viro 
Date:   Sat Nov 1 00:48:31 2025 -0400

    user_statfs(): import pathname only once
    
    Convert the user_path_at() call inside a retry loop into getname_flags() +
    filename_lookup() + putname() and leave only filename_lookup() inside
    the loop.
    
    In this case we never pass LOOKUP_EMPTY, so getname_flags() is equivalent
    to plain getname().
    
    The things could be further simplified by use of cleanup.h stuff, but
    let's not clutter the patch with that.
    
    Signed-off-by: Al Viro 

commit c3fa2b7cf5dda5a73480361303441db4ba7f0e6a
Author: Al Viro 
Date:   Sat Nov 1 00:48:31 2025 -0400

    chroot(2): import pathname only once
    
    Convert the user_path_at() call inside a retry loop into getname_flags() +
    filename_lookup() + putname() and leave only filename_lookup() inside
    the loop.
    
    In this case we never pass LOOKUP_EMPTY, so getname_flags() is equivalent
    to plain getname().
    
    The things could be further simplified by use of cleanup.h stuff, but
    let's not clutter the patch with that.
    
    Signed-off-by: Al Viro 

commit 592ab7fbb83ffe78378d7d25e15d8799d1f1df29
Author: Al Viro 
Date:   Sat Nov 1 00:48:31 2025 -0400

    chdir(2): import pathname only once
    
    Convert the user_path_at() call inside a retry loop into getname_flags() +
    filename_lookup() + putname() and leave only filename_lookup() inside
    the loop.
    
    In this case we never pass LOOKUP_EMPTY, so getname_flags() is equivalent
    to plain getname().
    
    The things could be further simplified by use of cleanup.h stuff, but
    let's not clutter the patch with that.
    
    Signed-off-by: Al Viro 

commit b756d8ba831036ad5b385576d0bf20daf0beca7c
Author: Al Viro 
Date:   Sat Nov 1 00:48:31 2025 -0400

    do_utimes_path(): import pathname only once
    
    Convert the user_path_at() call inside a retry loop into getname_flags() +
    filename_lookup() + putname() and leave only filename_lookup() inside
    the loop.
    
    Since we have the default logics for use of LOOKUP_EMPTY (passed iff
    AT_EMPTY_PATH is present in flags), just use getname_uflags() and
    don't bother with setting LOOKUP_EMPTY in lookup_flags - getname_uflags()
    will pass the right thing to getname_flags() and filename_lookup()
    doesn't care about LOOKUP_EMPTY at all.
    
    The things could be further simplified by use of cleanup.h stuff, but
    let's not clutter the patch with that.
    
    Signed-off-by: Al Viro 

commit 2e2d892fe9b7c27a415813019e5b4f86c761c9ab
Author: Al Viro 
Date:   Sat Nov 1 00:48:31 2025 -0400

    do_fchownat(): import pathname only once
    
    Convert the user_path_at() call inside a retry loop into getname_flags() +
    filename_lookup() + putname() and leave only filename_lookup() inside
    the loop.
    
    Since we have the default logics for use of LOOKUP_EMPTY (passed iff
    AT_EMPTY_PATH is present in flags), just use getname_uflags() and
    don't bother with setting LOOKUP_EMPTY in lookup_flags - getname_uflags()
    will pass the right thing to getname_flags() and filename_lookup()
    doesn't care about LOOKUP_EMPTY at all.
    
    The things could be further simplified by use of cleanup.h stuff, but
    let's not clutter the patch with that.
    
    Signed-off-by: Al Viro 

commit 67591df968f4ceb12c1f5d7f9caebc668200856b
Author: Al Viro 
Date:   Sat Nov 1 00:48:31 2025 -0400

    do_fchmodat(): import pathname only once
    
    Convert the user_path_at() call inside a retry loop into getname_flags() +
    filename_lookup() + putname() and leave only filename_lookup() inside
    the loop.
    
    Since we have the default logics for use of LOOKUP_EMPTY (passed iff
    AT_EMPTY_PATH is present in flags), just use getname_uflags() and
    don't bother with setting LOOKUP_EMPTY in lookup_flags - getname_uflags()
    will pass the right thing to getname_flags() and filename_lookup()
    doesn't care about LOOKUP_EMPTY at all.
    
    The things could be further simplified by use of cleanup.h stuff, but
    let's not clutter the patch with that.
    
    Signed-off-by: Al Viro 

commit 0cf1149673da1153d32eeea67771a002530fda42
Author: Al Viro 
Date:   Sat Nov 1 00:48:31 2025 -0400

    do_faccessat(): import pathname only once
    
    Convert the user_path_at() call inside a retry loop into getname_flags() +
    filename_lookup() + putname() and leave only filename_lookup() inside
    the loop.
    
    Since we have the default logics for use of LOOKUP_EMPTY (passed iff
    AT_EMPTY_PATH is present in flags), just use getname_uflags() and
    don't bother with setting LOOKUP_EMPTY in lookup_flags - getname_uflags()
    will pass the right thing to getname_flags() and filename_lookup()
    doesn't care about LOOKUP_EMPTY at all.
    
    The things could be further simplified by use of cleanup.h stuff, but
    let's not clutter the patch with that.
    
    Signed-off-by: Al Viro 

commit 24df85ffb9712cd6060588f6e08defcda5986efe
Author: Al Viro 
Date:   Fri Oct 31 13:16:03 2025 -0400

    allow to use CLASS() for struct filename *
    
    Not all users match that model, but most of them do.  By the end of
    the series we'll be left with very few irregular ones...
    
    Added:
    CLASS(filename, name)(user_path) =>
            getname(user_path)
    CLASS(filename_kernel, name)(string) =>
            getname_kernel(string)
    CLASS(filename_flags, name)(user_path, flags) =>
            getname_flags(user_path, flags)
    CLASS(filename_uflags, name)(user_path, flags) =>
            getname_uflags(user_path, flags)
    CLASS(filename_maybe_null, name)(user_path, flags) =>
            getname_maybe_null(user_path, flags)
    all with putname() as destructor.
    
    "flags" in filename_flags is in LOOKUP_... space, only LOOKUP_EMPTY matters.
    "flags" in filename_uflags and filename_maybe_null is in AT_...... space,
    and only AT_EMPTY_PATH matters.
    
    filename_flags conventions might be worth reconsidering later (it might or
    might not be better off with boolean instead)
    
    Signed-off-by: Al Viro 

commit 9f8f5edc79b6f22d0b4510d08b6a9c6e7f2c96e5
Author: Namhyung Kim 
Date:   Wed Dec 17 10:39:27 2025 -0800

    perf inject: Keep build-ID data if no option is used
    
    The keep_feat() determines which header features will be kept or
    discarded.  Usually 'perf inject' will add build-IDs based on -b, -B or
    other related options.  But it lose build-ID when none of those options
    are used.  This is meaningful only when --buildid-mmap is not used.
    
    The following example shows the impact of this change.
    
      $ perf record --no-buildid-mmap true
      [ perf record: Woken up 1 times to write data ]
      [ perf record: Captured and wrote 0.037 MB perf.data (5 samples) ]
    
      $ perf inject -i perf.data -o perf.data.inject
    
      $ perf buildid-list -i perf.data
      08cccc2a9388d5247ccb3e864f3063b975b0a15d /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
      fd5c4d5673256cd6bda51725dba048dabb0f854e [kernel.kallsyms]
      97a36ce1140071be5c36b147fa0bed173e05a602 [vdso]
    
      $ perf buildid-list -i perf.data.inject
      97a36ce1140071be5c36b147fa0bed173e05a602 [vdso]
    
    With this change, perf.data.inject would show the same list (of course,
    you need to run perf inject again).
    
    Reported-by: Gabriel Marin 
    Reviewed-by: Ian Rogers 
    Signed-off-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 12b5bc2a0d337d31d681682401d624338e168bcd
Author: Al Viro 
Date:   Tue Jan 13 15:03:32 2026 -0500

    init_link(): turn into a trivial wrapper for do_linkat()
    
    Signed-off-by: Al Viro 

commit e35dd81017011be0fb0cbb2ae80a6bc24962f0f7
Author: Eric Biggers 
Date:   Mon Dec 8 17:57:29 2025 -0800

    perf util: Remove SHA-1 code
    
    Now that the SHA-1 code is no longer used, remove it.
    
    Signed-off-by: Eric Biggers 
    Tested-by: Ian Rogers 
    Acked-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Fangrui Song 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jason A. Donenfeld 
    Cc: Jiri Olsa 
    Cc: Mark Rutland 
    Cc: Pablo Galindo 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit f136fc491b2a48dbfcb98cac372303dc0e18f0c1
Author: Eric Biggers 
Date:   Mon Dec 8 17:57:28 2025 -0800

    perf genelf: Switch from SHA-1 to BLAKE2s for build ID generation
    
    Recent patches [1] [2] added an implementation of SHA-1 to perf and made
    it be used for build ID generation.
    
    I had understood the choice of SHA-1, which is a legacy algorithm, to be
    for backwards compatibility.
    
    It turns out, though, that there's no backwards compatibility
    requirement here other than the size of the build ID field, which is
    fixed at 20 bytes.  Not only did the hash algorithm already change (from
    MD5 to SHA-1), but the inputs to the hash changed too: from 'load_addr
    || code' to just 'code', and now again to 'code || symtab || strsym'
    [3].  Different linkers generate different build IDs, with the LLVM
    linker using BLAKE3 hashes for example [4].
    
    Therefore, we might as well switch to a more modern algorithm.  Let's go
    with BLAKE2s.  It's faster than SHA-1, isn't cryptographically broken,
    is easier to implement than BLAKE3, and the kernel's implementation in
    lib/crypto/blake2s.c is easily borrowed.  It also natively supports
    variable-length hashes, so it can directly produce the needed 20 bytes.
    
    Also make the following additional improvements:
    
    - Hash the three inputs incrementally, so they don't all have to be
      concatenated into one buffer.
    
    - Add tag/length prefixes to each of the three inputs, so that distinct
      input tuples reliably result in distinct hashes.
    
    [1] https://lore.kernel.org/linux-perf-users/20250521225307.743726-1-yuzhuo@google.com/
    [2] https://lore.kernel.org/linux-perf-users/20250625202311.23244-1-ebiggers@kernel.org/
    [3] https://lore.kernel.org/linux-perf-users/20251125080748.461014-1-namhyung@kernel.org/
    [4] https://github.com/llvm/llvm-project/commit/d3e5b6f7539b86995aef6e2075c1edb3059385ce
    
    Signed-off-by: Eric Biggers 
    Tested-by: Ian Rogers 
    Acked-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Fangrui Song 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jason A. Donenfeld 
    Cc: Jiri Olsa 
    Cc: Mark Rutland 
    Cc: Pablo Galindo 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 8d3b6649499edd85e88b763e77bbce2ab016eb47
Author: Eric Biggers 
Date:   Mon Dec 8 17:57:27 2025 -0800

    perf util: Add BLAKE2s support
    
    Add BLAKE2s support to the perf utility library.  The code is borrowed
    from the kernel.  This will replace the use of SHA-1 in genelf.c.
    
    Signed-off-by: Eric Biggers 
    Tested-by: Ian Rogers 
    Acked-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Fangrui Song 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jason A. Donenfeld 
    Cc: Jiri Olsa 
    Cc: Mark Rutland 
    Cc: Pablo Galindo 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 8714a249da48cb6758a7980b1edc53ffc9024251
Author: Al Viro 
Date:   Tue Jan 13 15:02:36 2026 -0500

    init_symlink(): turn into a trivial wrapper for do_symlinkat()
    
    Signed-off-by: Al Viro 

commit b0f27ace0812bf7551fa16acff9b4670c65190b8
Author: Al Viro 
Date:   Tue Jan 13 15:01:38 2026 -0500

    init_mkdir(): turn into a trivial wrapper for do_mkdirat()
    
    Signed-off-by: Al Viro 

commit 4bfe0692d698f86fa033ae07c4b4f035fb6a74c4
Author: Al Viro 
Date:   Tue Jan 13 14:58:44 2026 -0500

    init_mknod(): turn into a trivial wrapper for do_mknodat()
    
    Same as init_unlink() and init_rmdir() already are; the only obstacle
    is do_mknodat() being static.
    
    Signed-off-by: Al Viro 

commit c65182ef9df6bb96fd85b56a2bcdd18d64c4d3b5
Author: Willem de Bruijn 
Date:   Mon Jan 12 11:33:39 2026 -0500

    selftests: net: reduce txtimestamp deschedule flakes
    
    This test occasionally fails due to exceeding timing bounds, as
    run in continuous testing on netdev.bots:
    
      https://netdev.bots.linux.dev/contest.html?test=txtimestamp-sh
    
    A common pattern is a single elevated delay between USR and SND.
    
        # 8.36 [+0.00] test SND
        # 8.36 [+0.00]     USR: 1767864384 s 240994 us (seq=0, len=0)
        # 8.44 [+0.08] ERROR: 18461 us expected between 10000 and 18000
        # 8.44 [+0.00]     SND: 1767864384 s 259455 us (seq=42, len=10)  (USR +18460 us)
        # 8.52 [+0.07]     SND: 1767864384 s 339523 us (seq=42, len=10)  (USR +10005 us)
        # 8.52 [+0.00]     USR: 1767864384 s 409580 us (seq=0, len=0)
        # 8.60 [+0.08]     SND: 1767864384 s 419586 us (seq=42, len=10)  (USR +10005 us)
        # 8.60 [+0.00]     USR: 1767864384 s 489645 us (seq=0, len=0)
        # 8.68 [+0.08]     SND: 1767864384 s 499651 us (seq=42, len=10)  (USR +10005 us)
        # 8.68 [+0.00]     USR-SND: count=4, avg=12119 us, min=10005 us, max=18460 us
    
    (Note that other delays are nowhere near the large 8ms tolerance.)
    
    One hypothesis is that the task is descheduled between taking the USR
    timestamp and sending the packet. Possibly in printing.
    
    Delay taking the timestamp closer to sendmsg, and delay printing until
    after sendmsg.
    
    With this change, failure rate is significantly lower in current runs.
    
    Link: https://lore.kernel.org/netdev/20260107110521.1aab55e9@kernel.org/
    Suggested-by: Jakub Kicinski 
    Signed-off-by: Willem de Bruijn 
    Link: https://patch.msgid.link/20260112163355.3510150-1-willemdebruijn.kernel@gmail.com
    Signed-off-by: Jakub Kicinski 

commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8
Author: Sri Jayaramappa 
Date:   Tue Dec 2 16:36:32 2025 -0500

    libsubcmd: Fix null intersection case in exclude_cmds()
    
    When there is no exclusion occurring from the cmds list - for example -
    cmds contains ["read-vdso32"] and excludes contains ["archive"] - the
    main loop completes with ci == cj == 0. In the original code the loop
    processing the remaining elements in the list was conditional:
    
        if (ci != cj) { ...}
    
    So we end up in the assertion loop since ci < cmds->cnt and we
    incorrectly try to assert the list elements to be NULL and fail with
    the following error
    
       help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
    
    Fix this by moving the if (ci != cj) check inside of a broader loop.
    If ci != cj, left shift the list elements, as before, and then
    unconditionally advance the ci and cj indicies which also covers the
    ci == cj case.
    
    Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()")
    Reviewed-by: Guilherme Amadio 
    Signed-off-by: Sri Jayaramappa 
    Tested-by: Guilherme Amadio 
    Tested-by: Ian Rogers 
    Cc: Joshua Hunt 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 54a23bff770961e024e2c61cd1f46888190c3e79
Author: Ian Rogers 
Date:   Sat Jan 10 20:13:38 2026 -0800

    perf test: Test addr2line unwinding works with inline functions
    
    Add a test that seeks to see inline functions correctly displayed in
    'perf script' from the inlineloop workload.
    
    Committer testing:
    
      # perf test 'addr2line inline unwinding'
       76: test addr2line inline unwinding                                 : Ok
      # perf test -vv 'addr2line inline unwinding'
       76: test addr2line inline unwinding:
      --- start ---
      test child forked, pid 1508628
      Inline unwinding verification test
      [ perf record: Woken up 129 times to write data ]
      [ perf record: Captured and wrote 32.282 MB /tmp/perf-test-inline-addr2line.L4Sz8QtADJ/perf.data (4014 samples) ]
      Inline unwinding verification test [Success]
      ---- end(0) ----
       76: test addr2line inline unwinding                                 : Ok
      #
    
    Reviewed-by: James Clark 
    Signed-off-by: Ian Rogers 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Howard Chu 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Stephen Brennan 
    Cc: Tony Jones 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 60b590de8b30dad8b11e9e4fba0df2eae81afb98
Author: Yan Zhao 
Date:   Thu Jan 8 15:46:17 2026 -0600

    KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate()
    
    sev_gmem_post_populate() needs to unmap the target vaddr after
    copy_from_user() to the vaddr fails.
    
    Fixes: dee5a47cc7a4 ("KVM: SEV: Add KVM_SEV_SNP_LAUNCH_UPDATE command")
    Signed-off-by: Yan Zhao 
    Signed-off-by: Michael Roth 
    Link: https://patch.msgid.link/20260108214622.1084057-2-michael.roth@amd.com
    Signed-off-by: Sean Christopherson 

commit abec464767b5d26f0612250d511c18f420826ca1
Author: Ian Rogers 
Date:   Sat Jan 10 20:13:36 2026 -0800

    perf callchain: Fix srcline printing with inlines
    
    sample__fprintf_callchain() was using map__fprintf_srcline() which won't
    report inline line numbers.
    
    Fix by using the srcline from the callchain and falling back to the map
    variant.
    
    Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file")
    Reviewed-by: James Clark 
    Signed-off-by: Ian Rogers 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Howard Chu 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Stephen Brennan 
    Cc: Tony Jones 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit a2297e74a07d21eb498d8549ae6fddc35cf26ec6
Author: Ian Rogers 
Date:   Sat Jan 10 20:13:35 2026 -0800

    perf srcline: Add configuration support for the addr2line style
    
    Allow the addr2line style to be specified on the `perf report` command
    line or in the .perfconfig file.
    
    Committer testing:
    
    The methods:
    
      # perf probe -x ~/bin/perf -F *__addr2line
      cmd__addr2line
      libbfd__addr2line
      libdw__addr2line
      llvm__addr2line
      #
    
    So if we configure one of them, say 'addr2line':
    
      # perf config addr2line.style=addr2line
      # perf config addr2line.style
      addr2line.style=addr2line
      #
    
    And have probes on all of them:
    
      # perf probe -x ~/bin/perf *__addr2line
      Added new events:
        probe_perf:cmd__addr2line (on *__addr2line in /home/acme/bin/perf)
        probe_perf:llvm__addr2line (on *__addr2line in /home/acme/bin/perf)
        probe_perf:libbfd__addr2line (on *__addr2line in /home/acme/bin/perf)
        probe_perf:libdw__addr2line (on *__addr2line in /home/acme/bin/perf)
    
      You can now use it in all perf tools, such as:
    
            perf record -e probe_perf:libdw__addr2line -aR sleep 1
    
      #
    
    Only the selected method should be used:
    
      # perf stat -e probe_perf:*_addr2line perf report -f --dso perf --stdio -s srcfile,srcline
      # Total Lost Samples: 0
      #
      # Samples: 4K of event 'cpu/cycles/Pu'
      # Event count (approx.): 5535180842
      #
      # Overhead  Source File   Source:Line
      # ........  ............  ...............
      #
          99.04%  inlineloop.c  inlineloop.c:21
           0.46%  inlineloop.c  inlineloop.c:20
    
      #
      # (Tip: For hierarchical output, try: perf report --hierarchy)
      #
    
       Performance counter stats for 'perf report -f --dso perf --stdio -s srcfile,srcline':
    
                      44      probe_perf:cmd__addr2line
                       0      probe_perf:llvm__addr2line
                       0      probe_perf:libbfd__addr2line
                       0      probe_perf:libdw__addr2line
    
             0.035915611 seconds time elapsed
    
             0.028008000 seconds user
             0.009051000 seconds sys
      #
    
    I checked and that is the case for the other methods.
    
    Also when using:
    
      # perf config addr2line.style=libdw,llvm
    
     Performance counter stats for 'perf report -f --dso perf --stdio -s srcfile,srcline':
    
                     0      probe_perf:cmd__addr2line
                    23      probe_perf:llvm__addr2line
                     0      probe_perf:libbfd__addr2line
                    44      probe_perf:libdw__addr2line
    
    Reviewed-by: James Clark 
    Signed-off-by: Ian Rogers 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Howard Chu 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Stephen Brennan 
    Cc: Tony Jones 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 68e25613ed4d06c987a42b0589f54ce88c13477c
Author: Alex Shi 
Date:   Wed Jan 7 14:40:09 2026 +0800

    arch/um: remove unused varible err in remove_files_and_dir()
    
    err is duplicated with errno, and never used; remove it.
    
    Reported-by: kernel test robot 
    Signed-off-by: Alex Shi 
    Link: https://patch.msgid.link/20260107064009.15380-1-alexs@kernel.org
    Signed-off-by: Johannes Berg 

commit 7ede6f1494cb148e42f893dd43e4911508814510
Author: Tiwei Bie 
Date:   Tue Jan 6 08:42:59 2026 +0800

    um: virtio_uml: Support adding devices via mconsole
    
    It can be used when we want to add virtio devices to UML while
    it's up and running. Virtio devices can be added to UML using
    the same syntax as the command line option:
    
    (mconsole) config virtio_uml.device=:[:]
    
    Signed-off-by: Tiwei Bie 
    Link: https://patch.msgid.link/20260106004259.1604736-1-tiwei.btw@antgroup.com
    Signed-off-by: Johannes Berg 

commit 656be28321e2262dd645128e22ec7625f27a6f9d
Author: Tiwei Bie 
Date:   Tue Jan 6 08:12:28 2026 +0800

    um: Handle SIGCHLD in seccomp mode like other IRQ signals
    
    In seccomp mode, SIGCHLD serves as the child reaper IRQ. So, let's
    handle it in the same way as other IRQ signals, including preventing
    them from nesting with each other and allowing interrupted syscalls
    to be automatically restarted.
    
    Signed-off-by: Tiwei Bie 
    Link: https://patch.msgid.link/20260106001228.1531146-3-tiwei.btw@antgroup.com
    Signed-off-by: Johannes Berg 

commit f68b2d5a907b53eed99cf2efcaaae116df73c298
Author: Tiwei Bie 
Date:   Tue Jan 6 08:12:27 2026 +0800

    um: Preserve errno within signal handler
    
    We rely on errno to determine whether a syscall has failed, so we
    need to ensure that accessing errno is async-signal-safe. Currently,
    we preserve the errno in sig_handler_common(), but it doesn't cover
    every possible case. Let's do it in hard_handler() instead, which
    is the signal handler we actually register.
    
    Signed-off-by: Tiwei Bie 
    Link: https://patch.msgid.link/20260106001228.1531146-2-tiwei.btw@antgroup.com
    Signed-off-by: Johannes Berg 

commit 5c720260e840b508053dd5338577e0175ef31739
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:53:01 2026 +0530

    remoteproc: qcom: pas: Enable Secure PAS support with IOMMU managed by Linux
    
    Most Qualcomm platforms feature Gunyah hypervisor, which typically
    handles IOMMU configuration. This includes mapping memory regions and
    device memory resources for remote processors by intercepting
    qcom_scm_pas_auth_and_reset() calls. These mappings are later removed
    during teardown. Additionally, SHM bridge setup is required to enable
    memory protection for both remoteproc metadata and its memory regions.
    When the aforementioned hypervisor is absent, the operating system must
    perform these configurations instead.
    
    When Linux runs as the hypervisor (@ EL2) on a SoC, it will have its
    own device tree overlay file that specifies the firmware stream ID now
    managed by Linux for a particular remote processor. If the iommus
    property is specified in the remoteproc device tree node, it indicates
    that IOMMU configuration must be handled by Linux. In this case, the
    has_iommu flag is set for the remote processor, which ensures that the
    resource table, carveouts, and SHM bridge are properly configured before
    memory is passed to TrustZone for authentication. Otherwise, the
    has_iommu flag remains unset, which indicates default behavior.
    
    Enables Secure PAS support for remote processors when IOMMU configuration
    is managed by Linux.
    
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-13-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a4584bff63c8aba994c8cbccc36748226f8f4b21
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:53:00 2026 +0530

    remoteproc: pas: Extend parse_fw callback to fetch resources via SMC call
    
    Qualcomm remote processor may rely on static and dynamic resources for
    it to be functional. For most of the Qualcomm SoCs, when run with Gunyah
    or older QHEE hypervisor, all the resources whether it is static or
    dynamic, is managed by the hypervisor. Dynamic resources if it is
    present for a remote processor will always be coming from secure world
    via SMC call while static resources may be present in remote processor
    firmware binary or it may be coming from SMC call along with dynamic
    resources.
    
    Remoteproc already has method like rproc_elf_load_rsc_table() to check
    firmware binary has resources or not and if it is not having then we
    pass NULL and zero as input resource table and its size argument
    respectively to qcom_scm_pas_get_rsc_table() and while it has resource
    present then it should pass the present resources to Trustzone(TZ) so that
    it could authenticate the present resources and append dynamic resource
    to return in output_rt argument along with authenticated resources.
    
    Extend parse_fw callback to include SMC call to get resources from
    Trustzone and to leverage resource table parsing and mapping and
    unmapping code from the remoteproc framework.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-12-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 8b9d2050cfa0c22c05622df103e366933fc045ed
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:59 2026 +0530

    firmware: qcom_scm: Add qcom_scm_pas_get_rsc_table() to get resource table
    
    Qualcomm remote processor may rely on Static and Dynamic resources for
    it to be functional. Static resources are fixed like for example,
    memory-mapped addresses required by the subsystem and dynamic
    resources, such as shared memory in DDR etc., are determined at
    runtime during the boot process.
    
    For most of the Qualcomm SoCs, when run with Gunyah or older QHEE
    hypervisor, all the resources whether it is static or dynamic, is
    managed by the hypervisor. Dynamic resources if it is present for a
    remote processor will always be coming from secure world via SMC call
    while static resources may be present in remote processor firmware
    binary or it may be coming qcom_scm_pas_get_rsc_table() SMC call along
    with dynamic resources.
    
    Some of the remote processor drivers, such as video, GPU, IPA, etc., do
    not check whether resources are present in their remote processor
    firmware binary. In such cases, the caller of this function should set
    input_rt and input_rt_size as NULL and zero respectively. Remoteproc
    framework has method to check whether firmware binary contain resources
    or not and they should be pass resource table pointer to input_rt and
    resource table size to input_rt_size and this will be forwarded to
    TrustZone for authentication. TrustZone will then append the dynamic
    resources and return the complete resource table in the passed output
    buffer.
    
    More about documentation on resource table format can be found in
    include/linux/remoteproc.h
    
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-11-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit b019925838bca1599fa443b34c8ed5876f14f144
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:58 2026 +0530

    firmware: qcom_scm: Add SHM bridge handling for PAS when running without QHEE
    
    On SoCs running with a non-Gunyah-based hypervisor, Linux must take
    responsibility for creating the SHM bridge both for metadata (before
    calling qcom_scm_pas_init_image()) and for remoteproc memory (before
    calling qcom_scm_pas_auth_and_reset()). We have taken care the things
    required for qcom_scm_pas_auth_and_reset(). Lets put these awareness
    of above conditions into qcom_scm_pas_init_image() and
    qcom_scm_pas_metadata_release().
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-10-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 223a87168030b422dda44c21319122f6328b5867
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:57 2026 +0530

    firmware: qcom_scm: Refactor qcom_scm_pas_init_image()
    
    Refactor qcom_scm_pas_init_image() by moving the memory allocation,
    copy, and free operations to a higher-level function, and isolate the
    actual SMC call in a separate function. The main intention is to allow
    flexibility for different allocators and to respect any constraints that
    the allocator API may impose before invoking the actual SCM function.
    
    Reviewed-by: Bryan O'Donoghue 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-9-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 4a7d6a78fbc6527fb1b61944aab00d9cdd1d4f01
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:56 2026 +0530

    firmware: qcom_scm: Add a prep version of auth_and_reset function
    
    For memory passed to TrustZone (TZ), it must either be part of a pool
    registered with TZ or explicitly registered via SHMbridge SMC calls.
    When Gunyah hypervisor is present, PAS SMC calls from Linux running at
    EL1 are trapped by Gunyah running @ EL2, which handles SHMbridge
    creation for both metadata and remoteproc carveout memory before
    invoking the calls to TZ.
    
    On SoCs running with a non-Gunyah-based hypervisor, Linux must take
    responsibility for creating the SHM bridge before invoking PAS SMC
    calls. For the auth_and_reset() call, the remoteproc carveout memory
    must first be registered with TZ via a SHMbridge SMC call and once
    authentication and reset are complete, the SHMbridge memory can be
    deregistered.
    
    Introduce qcom_scm_pas_prepare_and_auth_reset(), which sets up the SHM
    bridge over the remoteproc carveout memory when Linux operates at EL2.
    This behavior is indicated by a new field added to the PAS context data
    structure. The function then invokes the auth_and_reset SMC call.
    
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-8-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 928dbaaa9d89363d79e309ec00c5527ddfbe47c8
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:55 2026 +0530

    soc: qcom: mdtloader: Remove qcom_mdt_pas_init() from exported symbols
    
    qcom_mdt_pas_init() was previously used only by the remoteproc driver
    (drivers/remoteproc/qcom_q6v5_pas.c). Since that driver has now
    transitioned to using PAS context-based qcom_mdt_pas_load() function,
    making qcom_mdt_pas_init() obsolete for external use.
    
    Removes qcom_mdt_pas_init() from the list of exported symbols and make
    it static to limit its scope to internal use within mdtloader.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-7-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 8a4fcffde6c860c4e9164cf3530c9d97972781dc
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:54 2026 +0530

    soc: qcom: mdtloader: Add PAS context aware qcom_mdt_pas_load() function
    
    Introduce a new PAS context-aware function, qcom_mdt_pas_load(), for
    remote processor drivers. This function utilizes the PAS context
    pointer returned from qcom_scm_pas_ctx_init() to perform firmware
    metadata verification and memory setup via SMC calls.
    
    The qcom_mdt_pas_load() and qcom_mdt_load() functions are largely
    similar, but the former is designed for clients using the PAS
    context-based data structure. Over time, all users of qcom_mdt_load()
    can be migrated to use qcom_mdt_pas_load() for consistency and
    improved abstraction.
    
    As the remoteproc PAS driver (qcom_q6v5_pas) has already adopted the
    PAS context-based approach, update it to use qcom_mdt_pas_load().
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-6-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit b13d8baf56016e7eec29395b52d18b91df081d48
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:53 2026 +0530

    remoteproc: pas: Replace metadata context with PAS context structure
    
    As a superset of the existing metadata context, the PAS context
    structure enables both remoteproc and non-remoteproc subsystems to
    better support scenarios where the SoC runs with or without the Gunyah
    hypervisor. To reflect this, relevant SCM and metadata functions are
    updated to incorporate PAS context awareness and remove metadata context
    data structure completely.
    
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-5-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit ccb7bde5f7cc794dee0cd66fd451cb0e0715712d
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:52 2026 +0530

    firmware: qcom_scm: Introduce PAS context allocator helper function
    
    When the Peripheral Authentication Service (PAS) method runs on a SoC
    where Linux operates at EL2 (i.e., without the Gunyah hypervisor), the
    reset sequences are handled by TrustZone. In such cases, Linux must
    perform additional steps before invoking PAS SMC calls, such as creating
    a SHM bridge. Therefore, PAS SMC calls require awareness and handling of
    these additional steps when Linux runs at EL2.
    
    To support this, there is a need for a data structure that can be
    initialized prior to invoking any SMC or MDT functions. This structure
    allows those functions to determine whether they are operating in the
    presence or absence of the Gunyah hypervisor and behave accordingly.
    
    Currently, remoteproc and non-remoteproc subsystems use different
    variants of the MDT loader helper API, primarily due to differences in
    metadata context handling. Remoteproc subsystems retain the metadata
    context until authentication and reset are completed, while
    non-remoteproc subsystems (e.g., video, graphics, IPA, etc.) do not
    retain the metadata context and can free it within the
    qcom_scm_pas_init() call by passing a NULL context parameter and due to
    these differences, it is not possible to extend metadata context
    handling to support remoteproc and non remoteproc subsystem use PAS
    operations, when Linux operates at EL2.
    
    Add PAS context data structure allocator helper function.
    
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-4-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 69054348cc1c2d87acad90aec5e6e0d191012aff
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:51 2026 +0530

    firmware: qcom_scm: Rename peripheral as pas_id
    
    Peripheral and pas_id refers to unique id for a subsystem and used only
    when peripheral authentication service from secure world is utilized.
    
    Lets rename peripheral to pas_id to reflect closer to its meaning.
    
    Reviewed-by: Bryan O'Donoghue 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-3-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 25906ae9b28af23de509cb290a49ddd314f6c432
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:50 2026 +0530

    firmware: qcom_scm: Remove redundant piece of code
    
    The qcom_scm_pas_metadata_release() function already frees the allocated
    memory and sets ctx->ptr to NULL. Resetting ctx->phys and ctx->size to
    zero is unnecessary because the context is expected to be discarded
    after release.
    
    Lets removes redundant assignments.
    
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-2-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit ebb0bbef88b3276c01e2d42b71d67c26b4eb938a
Author: Mukesh Ojha 
Date:   Mon Jan 5 18:52:49 2026 +0530

    dt-bindings: remoteproc: qcom,pas: Add iommus property
    
    On most Qualcomm platforms, the Qualcomm Hypervisor Execution
    Environment (QHEE) is either used as a standalone hypervisor or
    co-exists as a module with the Gunyah hypervisor. When QHEE is
    present, it configures firmware streams for remote processors.
    If QHEE is not available, the operating system must perform
    these configurations instead and for that remote processor
    firmware stream should be presented to the operating system.
    To support this, add the iommus property as an optional property
    for PAS-supported devices.
    
    Acked-by: Rob Herring (Arm) 
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20260105-kvmrprocv10-v10-1-022e96815380@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 96ea45304d786f6bcf4b553a05eb90675bc0f2f3
Author: Gaurav Kohli 
Date:   Wed Sep 3 12:49:55 2025 +0530

    arm64: dts: qcom: qcs8300: Add GPU cooling
    
    Unlike the CPU, the GPU does not throttle its speed automatically when it
    reaches high temperatures.
    
    Set up GPU cooling by throttling the GPU speed
    when reaching 115°C.
    
    Signed-off-by: Gaurav Kohli 
    Signed-off-by: Akhil P Oommen 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20250903-a623-gpu-support-v5-4-5398585e2981@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit c9c9f6bf7fbcec4bc1cba845633e48035b883630
Author: Song Chen 
Date:   Mon Jan 5 23:50:09 2026 +0800

    bpf: Remove an unused parameter in check_func_proto
    
    The func_id parameter is not needed in check_func_proto.
    This patch removes it.
    
    Signed-off-by: Song Chen 
    Signed-off-by: Martin KaFai Lau 
    Link: https://patch.msgid.link/20260105155009.4581-1-chensong_2000@189.cn

commit 550a190494a0d3e933dd6f3b2e9c430f94a30a8c
Author: Nirmoy Das 
Date:   Wed Dec 17 07:45:29 2025 -0800

    PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150
    
    ASPEED BMC controllers have VGA and USB functions behind a PCIe-to-PCI
    bridge that causes them to share the same StreamID:
    
      [e0]---00.0-[e1-e2]----00.0-[e2]--+-00.0  ASPEED Graphics Family
                                        \-02.0  ASPEED USB Controller
    
    Both devices get StreamID 0x5e200 due to bridge aliasing, causing the USB
    controller to be rejected with 'Aliasing StreamID unsupported'.
    
    Per ASPEED, the AST1150 doesn't use a real PCI bus and always forwards
    the original Requester ID from downstream devices rather than replacing
    it with any alias.
    
    Add a new PCI_DEV_FLAGS_PCI_BRIDGE_NO_ALIAS flag and apply it to the
    AST1150.
    
    Suggested-by: Jason Gunthorpe 
    Signed-off-by: Nirmoy Das 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Robin Murphy 
    Reviewed-by: Jason Gunthorpe 
    Link: https://patch.msgid.link/20251217154529.377586-2-nirmoyd@nvidia.com

commit 361ad74a549d99c613d423e1ed0baebfbc493503
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:46:15 2026 +0100

    i2c: synquacer: Use HZ_PER_GHZ constant instead of plain number
    
    Use defined constant to avoid the possible mistakes and to provide
    an additional information on the units.
    
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260112134900.4142954-8-andriy.shevchenko@linux.intel.com

commit b77f0370b072af3275970e0b314cc20a159ca1c1
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:46:14 2026 +0100

    i2c: st: Use HZ_PER_GHZ constant instead of plain number
    
    Use defined constant to avoid the possible mistakes and to provide
    an additional information on the units.
    
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Patrice Chotard 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260112134900.4142954-7-andriy.shevchenko@linux.intel.com

commit 65db3bf4f6afb9910cd55e98b547d844130c4d82
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:46:13 2026 +0100

    i2c: rk3x: Use HZ_PER_GHZ constant instead of plain number
    
    Use defined constant to avoid the possible mistakes and to provide
    an additional information on the units.
    
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Heiko Stuebner 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260112134900.4142954-6-andriy.shevchenko@linux.intel.com

commit f83aa451460683c33824571269216e52154615da
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:46:12 2026 +0100

    i2c: nomadik: Use HZ_PER_GHZ constant instead of plain number
    
    Use defined constant to avoid the possible mistakes and to provide
    an additional information on the units.
    
    While at it, drop unneeded 64-bit division, all operands fit 32-bit.
    
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260112134900.4142954-5-andriy.shevchenko@linux.intel.com

commit ec416d46910153b4faf41eef2be72778c18c7adb
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:46:11 2026 +0100

    i2c: mt65xx: Use HZ_PER_GHZ constant instead of plain number
    
    Use defined constant to avoid the possible mistakes and to provide
    an additional information on the units.
    
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260112134900.4142954-4-andriy.shevchenko@linux.intel.com

commit f23669f874c0147727f87db61f50224d9b4f3071
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:46:10 2026 +0100

    i2c: mlxbf: Use HZ_PER_GHZ constant instead of custom one
    
    Use HZ_PER_GHZ constant instead of custom one. No functional changes.
    
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260112134900.4142954-3-andriy.shevchenko@linux.intel.com

commit da4ab5dcc975d5221611f36467eadc5e32b5a1ad
Merge: 1fffe1f4b9763b 9160335317cb40
Author: Alexei Starovoitov 
Date:   Tue Jan 13 09:33:38 2026 -0800

    Merge branch 'bpf-recognize-special-arithmetic-shift-in-the-verifier'
    
    Puranjay Mohan says:
    
    ====================
    bpf: Recognize special arithmetic shift in the verifier
    
    v3: https://lore.kernel.org/all/20260103022310.935686-1-puranjay@kernel.org/
    Changes in v3->v4:
    - Fork verifier state while processing BPF_OR when src_reg has [-1,0]
      range and 2nd operand is a constant. This is to detect the following pattern:
            i32 X > -1 ? C1 : -1 --> (X >>s 31) | C1
    - Add selftests for above.
    - Remove __description("s>>=63") (Eduard in another patchset)
    
    v2: https://lore.kernel.org/bpf/20251115022611.64898-1-alexei.starovoitov@gmail.com/
    Changes in v2->v3:
    - fork verifier state while processing BPF_AND when src_reg has [-1,0]
      range and 2nd operand is a constant.
    
    v1->v2:
    Use __mark_reg32_known() or __mark_reg_known() for zero too.
    Add comment to selftest.
    
    v1:
    https://lore.kernel.org/bpf/20251114031039.63852-1-alexei.starovoitov@gmail.com/
    ====================
    
    Link: https://patch.msgid.link/20260112201424.816836-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 9160335317cb404f54ad2f509546c666ddd4d0eb
Author: Alexei Starovoitov 
Date:   Mon Jan 12 12:13:58 2026 -0800

    selftests/bpf: Add tests for s>>=31 and s>>=63
    
    Add tests for special arithmetic shift right.
    
    Signed-off-by: Alexei Starovoitov 
    Co-developed-by: Puranjay Mohan 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260112201424.816836-3-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7
Author: Alexei Starovoitov 
Date:   Mon Jan 12 12:13:57 2026 -0800

    bpf: Recognize special arithmetic shift in the verifier
    
    cilium bpf_wiregard.bpf.c when compiled with -O1 fails to load
    with the following verifier log:
    
    192: (79) r2 = *(u64 *)(r10 -304)     ; R2=pkt(r=40) R10=fp0 fp-304=pkt(r=40)
    ...
    227: (85) call bpf_skb_store_bytes#9          ; R0=scalar()
    228: (bc) w2 = w0                     ; R0=scalar() R2=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
    229: (c4) w2 s>>= 31                  ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
    230: (54) w2 &= -134                  ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
    ...
    232: (66) if w2 s> 0xffffffff goto pc+125     ; R2=scalar(smin=umin=umin32=0x80000000,smax=umax=umax32=0xffffff7a,smax32=-134,var_off=(0x80000000; 0x7fffff7a))
    ...
    238: (79) r4 = *(u64 *)(r10 -304)     ; R4=scalar() R10=fp0 fp-304=scalar()
    239: (56) if w2 != 0xffffff78 goto pc+210     ; R2=0xffffff78 // -136
    ...
    258: (71) r1 = *(u8 *)(r4 +0)
    R4 invalid mem access 'scalar'
    
    The error might confuse most bpf authors, since fp-304 slot had 'pkt'
    pointer at insn 192 and became 'scalar' at 238. That happened because
    bpf_skb_store_bytes() clears all packet pointers including those in
    the stack. On the first glance it might look like a bug in the source
    code, since ctx->data pointer should have been reloaded after the call
    to bpf_skb_store_bytes().
    
    The relevant part of cilium source code looks like this:
    
    // bpf/lib/nodeport.h
    int dsr_set_ipip6()
    {
            if (ctx_adjust_hroom(...))
                    return DROP_INVALID; // -134
            if (ctx_store_bytes(...))
                    return DROP_WRITE_ERROR; // -141
            return 0;
    }
    
    bool dsr_fail_needs_reply(int code)
    {
            if (code == DROP_FRAG_NEEDED) // -136
                    return true;
            return false;
    }
    
    tail_nodeport_ipv6_dsr()
    {
            ret = dsr_set_ipip6(...);
            if (!IS_ERR(ret)) {
                    ...
            } else {
                    if (dsr_fail_needs_reply(ret))
                            return dsr_reply_icmp6(...);
            }
    }
    
    The code doesn't have arithmetic shift by 31 and it reloads ctx->data
    every time it needs to access it. So it's not a bug in the source code.
    
    The reason is DAGCombiner::foldSelectCCToShiftAnd() LLVM transformation:
    
      // If this is a select where the false operand is zero and the compare is a
      // check of the sign bit, see if we can perform the "gzip trick":
      // select_cc setlt X, 0, A, 0 -> and (sra X, size(X)-1), A
      // select_cc setgt X, 0, A, 0 -> and (not (sra X, size(X)-1)), A
    
    The conditional branch in dsr_set_ipip6() and its return values
    are optimized into BPF_ARSH plus BPF_AND:
    
    227: (85) call bpf_skb_store_bytes#9
    228: (bc) w2 = w0
    229: (c4) w2 s>>= 31   ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
    230: (54) w2 &= -134   ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
    
    after insn 230 the register w2 can only be 0 or -134,
    but the verifier approximates it, since there is no way to
    represent two scalars in bpf_reg_state.
    After fallthough at insn 232 the w2 can only be -134,
    hence the branch at insn
    239: (56) if w2 != -136 goto pc+210
    should be always taken, and trapping insn 258 should never execute.
    LLVM generated correct code, but the verifier follows impossible
    path and rejects valid program. To fix this issue recognize this
    special LLVM optimization and fork the verifier state.
    So after insn 229: (c4) w2 s>>= 31
    the verifier has two states to explore:
    one with w2 = 0 and another with w2 = 0xffffffff
    which makes the verifier accept bpf_wiregard.c
    
    A similar pattern exists were OR operation is used in place of the AND
    operation, the verifier detects that pattern as well by forking the
    state before the OR operation with a scalar in range [-1,0].
    
    Note there are 20+ such patterns in bpf_wiregard.o compiled
    with -O1 and -O2, but they're rarely seen in other production
    bpf programs, so push_stack() approach is not a concern.
    
    Reported-by: Hao Sun 
    Signed-off-by: Alexei Starovoitov 
    Co-developed-by: Puranjay Mohan 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260112201424.816836-2-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 5083dba0fde5446c00ee1a82a3911c8f88a2c72e
Author: Andy Shevchenko 
Date:   Mon Jan 12 14:46:09 2026 +0100

    units: Add HZ_PER_GHZ
    
    The is going to be a new user of the HZ_PER_GHZ definition besides
    possibly existing ones. Add that one to the header.
    
    While at it, split Hz and kHz groups of the multipliers for better
    maintenance and readability.
    
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Andi Shyti 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Wolfram Sang 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20260112134900.4142954-2-andriy.shevchenko@linux.intel.com

commit 1fffe1f4b9763b5f8093493056e31783b646b36c
Merge: 7af3339948601e 951d79017e8a0a
Author: Alexei Starovoitov 
Date:   Tue Jan 13 09:32:16 2026 -0800

    Merge branch 'fix-a-few-selftest-failure-due-to-64k-page'
    
    Yonghong Song says:
    
    ====================
    Fix a few selftest failure due to 64K page
    
    Fix a few arm64 selftest failures due to 64K page. Please see each
    indvidual patch for why the test failed and how the test gets fixed.
    ====================
    
    Link: https://patch.msgid.link/20260113061018.3797051-1-yonghong.song@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 951d79017e8a0af6db4a167a89746b4a0924626b
Author: Yonghong Song 
Date:   Mon Jan 12 22:10:33 2026 -0800

    selftests/bpf: Fix verifier_arena_globals1 failure with 64K page
    
    With 64K page on arm64, verifier_arena_globals1 failed like below:
      ...
      libbpf: map 'arena': failed to create: -E2BIG
      ...
      #509/1   verifier_arena_globals1/check_reserve1:FAIL
      ...
    
    For 64K page, if the number of arena pages is (1UL << 20), the total
    memory will exceed 4G and this will cause map creation failure.
    Adjusting ARENA_PAGES based on the actual page size fixed the problem.
    
    Cc: Emil Tsalapatis 
    Signed-off-by: Yonghong Song 
    Reviewed-by: Emil Tsalapatis 
    Link: https://lore.kernel.org/r/20260113061033.3798549-1-yonghong.song@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit d2f7cd20a7c7742b83d2c899044d4f2a851a4a7d
Author: Yonghong Song 
Date:   Mon Jan 12 22:10:28 2026 -0800

    selftests/bpf: Fix sk_bypass_prot_mem failure with 64K page
    
    The current selftest sk_bypass_prot_mem only supports 4K page.
    When running with 64K page on arm64, the following failure happens:
      ...
      check_bypass:FAIL:no bypass unexpected no bypass: actual 3 <= expected 32
      ...
      #385/1   sk_bypass_prot_mem/TCP  :FAIL
      ...
      check_bypass:FAIL:no bypass unexpected no bypass: actual 4 <= expected 32
      ...
      #385/2   sk_bypass_prot_mem/UDP  :FAIL
      ...
    
    Adding support to 64K page as well fixed the failure.
    
    Cc: Kuniyuki Iwashima 
    Signed-off-by: Yonghong Song 
    Link: https://lore.kernel.org/r/20260113061028.3798326-1-yonghong.song@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 2465a08d433dd4ae0c4eecdb8e79c54b7c5e5a55
Author: Yonghong Song 
Date:   Mon Jan 12 22:10:23 2026 -0800

    selftests/bpf: Fix dmabuf_iter/lots_of_buffers failure with 64K page
    
    On arm64 with 64K page , I observed the following test failure:
      ...
      subtest_dmabuf_iter_check_lots_of_buffers:FAIL:total_bytes_read unexpected total_bytes_read:
          actual 4696 <= expected 65536
      #97/3    dmabuf_iter/lots_of_buffers:FAIL
    
    With 4K page on x86, the total_bytes_read is 4593.
    With 64K page on arm64, the total_byte_read is 4696.
    
    In progs/dmabuf_iter.c, for each iteration, the output is
      BPF_SEQ_PRINTF(seq, "%lu\n%llu\n%s\n%s\n", inode, size, name, exporter);
    
    The only difference between 4K and 64K page is 'size' in
    the above BPF_SEQ_PRINTF. The 4K page will output '4096' and
    the 64K page will output '65536'. So the total_bytes_read with 64K page
    is slighter greater than 4K page.
    
    Adjusting the total_bytes_read from 65536 to 4096 fixed the issue.
    
    Cc: T.J. Mercier 
    Signed-off-by: Yonghong Song 
    Link: https://lore.kernel.org/r/20260113061023.3798085-1-yonghong.song@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit d6406c45f14842019cfaaba19fe2a76ef9fa831c
Author: Jens Axboe 
Date:   Mon Jan 12 08:14:45 2026 -0700

    io_uring: track restrictions separately for IORING_OP and IORING_REGISTER
    
    It's quite likely that only register opcode restrictions exists, in
    which case we'd never need to check the normal opcodes. Split
    ctx->restricted into two separate fields, one for I/O opcodes, and one
    for register opcodes.
    
    Reviewed-by: Gabriel Krisman Bertazi 
    Signed-off-by: Jens Axboe 

commit 991fb85a1d43f0d0237a405d5535024f78a873e5
Author: Jens Axboe 
Date:   Mon Jan 12 08:14:44 2026 -0700

    io_uring: move ctx->restricted check into io_check_restriction()
    
    Just a cleanup, makes the code easier to read without too many dependent
    nested checks.
    
    Reviewed-by: Gabriel Krisman Bertazi 
    Signed-off-by: Jens Axboe 

commit 09bd84421defa0a9dcebdcdaf8b7deb1870855d0
Author: Jens Axboe 
Date:   Mon Jan 12 08:14:43 2026 -0700

    io_uring/register: set ctx->restricted when restrictions are parsed
    
    Rather than defer this until the rings are enabled, just set it
    upfront when the restrictions are parsed and enabled anyway. There's
    no reason to defer this setting until the rings are enabled.
    
    Reviewed-by: Gabriel Krisman Bertazi 
    Signed-off-by: Jens Axboe 

commit 7af3339948601e188d93d7e03326aeb8fcbd6bea
Author: Mykyta Yatsenko 
Date:   Tue Jan 13 13:48:26 2026 +0000

    bpf: Consistently use reg_state() for register access in the verifier
    
    Replace the pattern of declaring a local regs array from cur_regs()
    and then indexing into it with the more concise reg_state() helper.
    This simplifies the code by eliminating intermediate variables and
    makes register access more consistent throughout the verifier.
    
    Signed-off-by: Mykyta Yatsenko 
    Acked-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/r/20260113134826.2214860-1-mykyta.yatsenko5@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit e6ed0f051d557be5a782a42f74dddbc8ed5309ec
Author: Jens Axboe 
Date:   Mon Jan 12 08:14:42 2026 -0700

    io_uring/register: have io_parse_restrictions() set restrictions enabled
    
    Rather than leave this to the caller, have io_parse_restrictions() set
    ->registered = true if restrictions have been enabled. This is in
    preparation for having finer grained restrictions.
    
    Reviewed-by: Gabriel Krisman Bertazi 
    Signed-off-by: Jens Axboe 

commit 51fff55a66d89d76fcaeaa277d53bdf5b19efa0e
Author: Jens Axboe 
Date:   Mon Jan 12 08:14:41 2026 -0700

    io_uring/register: have io_parse_restrictions() return number of ops
    
    Rather than return 0 on success, return >= 0 for success, where the
    return value is that number of parsed entries. As before, any < 0
    return is an error.
    
    Reviewed-by: Gabriel Krisman Bertazi 
    Signed-off-by: Jens Axboe 

commit de28e002df2e2d44138174a158883e703e216a06
Author: Adrian Ng Ho Yin 
Date:   Fri Dec 12 17:02:58 2025 +0800

    i3c: dw: Preserve DAT entry bits when restoring addresses
    
    Update dw_i3c_master_restore_addrs() to preserve existing bits in each
    Device Address Table (DAT) entry when restoring addresses. This prevents
    overwriting configuration bits during PM runtime resumes.
    
    Signed-off-by: Adrian Ng Ho Yin 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/46112c0da44110f46709cb0e7a4595e312b95c10.1765529948.git.adrianhoyin.ng@altera.com
    Signed-off-by: Alexandre Belloni 

commit 4cd9d2bf0b56f98347ca1046e4d8acea95bd7ffa
Author: Adrian Ng Ho Yin 
Date:   Fri Dec 12 17:02:57 2025 +0800

    i3c: dw: use FIELD_PREP for device address table macros
    
    Add DEV_ADDR_TABLE_DYNAMIC_MASK / DEV_ADDR_TABLE_DYNAMIC_ADDR(x) for
    dynamic device addresses and DEV_ADDR_TABLE_STATIC_MASK /
    DEV_ADDR_TABLE_STATIC_ADDR(x) for static device addresses in the I3C
    address table. Replace manual shift-and-mask with FIELD_PREP() for both
    dynamic and static addresses for clarity and maintainability.
    
    Signed-off-by: Adrian Ng Ho Yin 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/d72896e510db1870d26a794f131f600c7e42cf00.1765529948.git.adrianhoyin.ng@altera.com
    Signed-off-by: Alexandre Belloni 

commit ec17f14309481318df4af2a0c7f2aa7da9e7ebcb
Author: Adrian Ng Ho Yin 
Date:   Fri Dec 12 17:02:56 2025 +0800

    i3c: dw: Add support for Device NACK Retry configuration
    
    The DesignWare I3C controller supports automatically retrying transactions
    when a device NACKs. This is useful for slave devices that may be
    temporarily busy and not ready to respond immediately.
    
    Add new ops to configure all active DAT entry with dev_nack_retry during
    runtime. Returns error when value exceeds hw specified limit.
    
    Signed-off-by: Adrian Ng Ho Yin 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/f09ee67e61d31f0a12a0bf48f01e9057ca9e2fb7.1765529948.git.adrianhoyin.ng@altera.com
    Signed-off-by: Alexandre Belloni 

commit b58f47eb392680d4c6626c8b3b1fcf6412a0a02c
Author: Adrian Ng Ho Yin 
Date:   Fri Dec 12 17:02:55 2025 +0800

    i3c: add sysfs entry and attribute for Device NACK Retry count
    
    Document sysfs attribute dev_nack_retry_cnt that controls the number of
    automatic retries performed by the I3C controller when a target device
    returns a NACK
    
    Add a `dev_nack_retry_count` sysfs attribute to allow reading and updating
    the device NACK retry count. A new `dev_nack_retry_count` field and an
    optional `set_dev_nack_retry()` callback are added to
    i3c_master_controller. The attribute is created only when the callback is
    implemented.
    
    Updates are applied under the I3C bus maintenance lock to ensure safe
    hardware reconfiguration.
    
    Signed-off-by: Adrian Ng Ho Yin 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/3c4b5082bde64024fc383c44bebeef89ad3c7ed3.1765529948.git.adrianhoyin.ng@altera.com
    Signed-off-by: Alexandre Belloni 

commit 3db5306b0bd562ac0fe7eddad26c60ebb6f5fdd4
Author: Thomas Gleixner 
Date:   Tue Jan 13 17:47:37 2026 +0100

    time/sched_clock: Use ACCESS_PRIVATE() to evaluate hrtimer::function
    
    This dereference of sched_clock_timer::function was missed when the
    hrtimer callback function pointer was marked private.
    
    Fixes: 04257da0c99c ("hrtimers: Make callback function pointer private")
    Reported-by: kernel test robot 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/875x95jw7q.ffs@tglx
    Closes: https://lore.kernel.org/oe-kbuild-all/202601131713.KsxhXQ0M-lkp@intel.com/

commit 78e35b0156c3d98e9a61c673fd585a9a01acc6dc
Author: fenugrec 
Date:   Sun Jan 11 16:36:41 2026 -0500

    ALSA: usb-audio: clean up presonus s1810 consts
    
    - Reorder some #define blocks
    - Document mixer/volume levels
    - Document some Ctl request fields (tag, len)
    - replace some magic numbers with macros
    
    No functional change intended. The information is based on reverse
    engineering.
    
    Signed-off-by: fenugrec 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20260111-preso_clean1-v2-2-44b4e5129a75@mail.com

commit 3ce03297baff0ba116769044e4594fb324d4a551
Author: fenugrec 
Date:   Sun Jan 11 16:36:40 2026 -0500

    ALSA: usb-audio: presonus s18xx uses little-endian
    
    Use __le32 types for USB control transfers
    
    Signed-off-by: fenugrec 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20260111-preso_clean1-v2-1-44b4e5129a75@mail.com

commit a3bf6ee15a59d25724746f284de167af6dc76baf
Author: Peng Fan 
Date:   Fri Jan 9 20:08:06 2026 +0800

    remoteproc: imx_rproc: Add support for i.MX95
    
    Add imx_rproc_cfg_imx95_m7 and address(TCM and DDR) mapping.
    Add i.MX95 of_device_id entry.
    
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Frank Li 
    Signed-off-by: Peng Fan 
    Link: https://lore.kernel.org/r/20260109-imx95-rproc-2026-1-8-v6-6-d2fefb36263d@nxp.com
    Signed-off-by: Mathieu Poirier 

commit 1ae680bbe77fe124916bd28a1dd6548847c56914
Author: Peng Fan 
Date:   Fri Jan 9 20:08:05 2026 +0800

    remoteproc: imx_rproc: Add support for System Manager CPU API
    
    When the System Manager configuration places the M7 core in the same
    Logical Machine(LM) as the A55 cores (M7 LM ID equals A55 LM ID), Linux
    can control M7 using the CPU protocol API. For more details, see the
    previous patch that adds LMM API support.
    
    Changes include:
    - Introduce imx_rproc_ops_sm_cpu for CPU API operations.
    - Reuse imx_rproc_sm_detect_mode to detect shared LM and set priv->ops to
      imx_rproc_ops_sm_cpu.
    - Implement imx_rproc_sm_cpu_{start,stop} to handle M7 start and stop.
    
    Signed-off-by: Peng Fan 
    Reviewed-by: Daniel Baluta 
    Link: https://lore.kernel.org/r/20260109-imx95-rproc-2026-1-8-v6-5-d2fefb36263d@nxp.com
    Signed-off-by: Mathieu Poirier 

commit 27a7cef9c3646e36f56f48c0ad43df3b821ffc96
Author: Paul Moore 
Date:   Fri Jan 9 17:37:28 2026 -0500

    selinux: move the selinux_blob_sizes struct
    
    Move the selinux_blob_sizes struct so it adjacent to the rest of the
    SELinux initialization code and not in the middle of the LSM hook
    callbacks.
    
    Signed-off-by: Paul Moore 

commit d8ab94fa4370337158e96ea08d41e6e2d8fcb2a2
Author: Peng Fan 
Date:   Fri Jan 9 20:08:04 2026 +0800

    remoteproc: imx_rproc: Add support for System Manager LMM API
    
    i.MX95 features a Cortex-M33 core, six Cortex-A55 cores, and
    one Cortex-M7 core. The System Control Management Interface(SCMI)
    firmware runs on the M33 core. The i.MX95 SCMI firmware named System
    Manager(SM) includes vendor extension protocols, Logical Machine
    Management(LMM) protocol and CPU protocol and etc.
    
    Depending on SM configuration, M7 can be used as follows:
     (1) M7 in a separate Logical Machine (LM) from A55 cores, that Linux
         can't control
     (2) M7 in a separate LM from A55 cores that Linux can control using LMM
         protocol.
     (3) M7 runs in same Logical Machine as A55 cores, so Linux can control it
         using CPU protocol
    
    So extend the driver to using LMM and CPU protocol to manage the M7 core.
     - Compare linux LM ID(got using scmi_imx_lmm_info) and M7 LM ID(the ID
       is fixed as 1 in SM firmware if M7 is in a separate LM),
       if Linux LM ID is not same as M7 LM ID(linux and M7 in same LM), use
       LMM protocol to start/stop. CPU protocol support will be added in the
       following patch. Whether using CPU or LMM protocol to start/stop, the
       M7 status detection could use CPU protocol to detect started or not. So
       in imx_rproc_detect_mode, use scmi_imx_cpu_started to check the
       status of M7.
     - For above case (1) and (2), Use SCMI_IMX_LMM_POWER_ON to detect whether
       the M7 LM is under control of A55 LM.
     - For above case , after using SCMI_IMX_LMM_POWER_ON to check
       permission, SCMI_IMX_LMM_SHUTDOWN API should be called to shutdown
       the M7 LM to save power only when M7 LM is going to be started by
       remoteproc framework. Otherwise bypass SCMI_IMX_LMM_SHUTDOWN API if
       M7 LM is started before booting Linux.
    
    Current setup relies on pre-Linux software(U-Boot) to do M7 TCM ECC
    initialization. In future, we could add the support in Linux to decouple
    U-Boot and Linux.
    
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Frank Li 
    Signed-off-by: Peng Fan 
    Link: https://lore.kernel.org/r/20260109-imx95-rproc-2026-1-8-v6-4-d2fefb36263d@nxp.com
    Signed-off-by: Mathieu Poirier 

commit edd2a9956055ecb50e230cd02c7791205fc8d009
Author: Peng Fan 
Date:   Fri Jan 9 20:08:03 2026 +0800

    remoteproc: imx_rproc: Introduce prepare ops for imx_rproc_dcfg
    
    Allow each platform to provide its own prepare operations, preparing
    for i.MX95 LMM and CPU ops support.
    
    No functional changes.
    
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Frank Li 
    Signed-off-by: Peng Fan 
    Link: https://lore.kernel.org/r/20260109-imx95-rproc-2026-1-8-v6-3-d2fefb36263d@nxp.com
    Signed-off-by: Mathieu Poirier 

commit 454cb78611479bd5da4f191480456f42aca7f07b
Author: Peng Fan 
Date:   Fri Jan 9 20:08:02 2026 +0800

    remoteproc: imx_rproc: Add runtime ops copy to support dynamic behavior
    
    Structure imx_rproc_dcfg contains a const pointer to imx_rproc_plat_ops,
    which defines the start/stop/detect_mode operations for a remote processor.
    To preserve the const correctness of the static configuration while
    allowing runtime modification of ops behavior, introduce a new
    imx_rproc_plat_ops member in struct imx_rproc named `ops`.
    
    During initialization, dcfg->ops is assigned to priv->ops.
    Enable the driver to safely override ops at runtime without affecting the
    original const configuration.
    
    Improve flexibility for platforms that require dynamic operation switching
    (e.g. i.MX95 Logical Machine ops and CPU ops).
    
    Reviewed-by: Frank Li 
    Reviewed-by: Daniel Baluta 
    Signed-off-by: Peng Fan 
    Link: https://lore.kernel.org/r/20260109-imx95-rproc-2026-1-8-v6-2-d2fefb36263d@nxp.com
    Signed-off-by: Mathieu Poirier 

commit ac3ea0730a1380f00109e69149f3be1a058c4ba9
Author: Peng Fan 
Date:   Fri Jan 9 20:08:01 2026 +0800

    dt-bindings: remoteproc: fsl,imx-rproc: Add support for i.MX95
    
    Add compatible string for the Cortex-M7 core in i.MX95
    
    Reviewed-by: Frank Li 
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Peng Fan 
    Link: https://lore.kernel.org/r/20260109-imx95-rproc-2026-1-8-v6-1-d2fefb36263d@nxp.com
    Signed-off-by: Mathieu Poirier 

commit d30f75d2dba913754dbacb982b19b783a30253ea
Author: Imre Deak 
Date:   Mon Dec 22 17:35:47 2025 +0200

    drm/i915/dp: Simplify computing the DSC compressed BPP for DP-MST
    
    The minimum/maximum DSC input (i.e. pipe) and compressed (i.e. link) BPP
    limits are computed already in intel_dp_compute_config_limits(), so
    there is no need to do this again in
    mst_stream_dsc_compute_link_config() called later. Remove the
    corresponding alignments from the latter function and use the
    precomputed (aligned and within bounds) maximum pipe BPP and the min/max
    compressed BPP values instead as-is.
    
    Reviewed-by: Jouni Högander 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-21-imre.deak@intel.com

commit 3045a4eb12e9affb526cf24fb4a41d3487d55978
Author: Imre Deak 
Date:   Mon Dec 22 17:35:46 2025 +0200

    drm/i915/dp: Simplify eDP vs. DP compressed BPP computation
    
    intel_edp_dsc_compute_pipe_bpp() matches now
    intel_dp_dsc_compute_pipe_bpp(), remove the former function.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-20-imre.deak@intel.com

commit 2b601460d1291310e4f04418eae2de93d0cc18d1
Author: Imre Deak 
Date:   Mon Dec 22 17:35:45 2025 +0200

    drm/i915/dp: Unify computing compressed BPP for DP-SST and eDP
    
    Move computing the eDP compressed BPP value to the function computing
    this for DP, allowing further simplifications later.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-19-imre.deak@intel.com

commit 2b68b9b80f9ee75d4e7e159aa082dcd8c1e4e05c
Author: Imre Deak 
Date:   Mon Dec 22 17:35:44 2025 +0200

    drm/i915/dp: Simplify computing forced DSC BPP for DP-SST
    
    If dsc_compute_compressed_bpp() failed with a forced pipe BPP value
    (where the forced pipe BPP value itself is valid within the min/max pipe
    BPP limits), the function will also fail when called with the maximum
    pipe BPP value: dsc_compute_compressed_bpp() will try all compressed
    BPPs below the passed in pipe BPP value and if the function failed with
    a given (low) compressed BPP value it will also fail with a compressed
    BPP value higher than the one which failed already.
    
    Based on the above remove the logic to retry computing a compressed BPP
    value with the maximum pipe BPP value if computing the compressed BPP
    failed already with the (lower) forced pipe BPP value.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-18-imre.deak@intel.com

commit ce46682f89111fd0ded74a90c1ea04b36780221b
Author: Imre Deak 
Date:   Mon Dec 22 17:35:43 2025 +0200

    drm/i915/dp: Simplify computing DSC BPPs for DP-SST
    
    The maximum pipe BPP value (used as the DSC input BPP) has been aligned
    already to the corresponding source/sink input BPP capabilities in
    intel_dp_compute_config_limits(). So it isn't needed to perform the same
    alignment again in intel_dp_dsc_compute_pipe_bpp() called later, this
    function can simply use the already aligned maximum pipe BPP value, do
    that.
    
    Also, there is no point in trying pipe BPP values lower than the
    maximum: this would only make dsc_compute_compressed_bpp() start with a
    lower _compressed_ BPP value, but this lower compressed BPP value has
    been tried already when dsc_compute_compressed_bpp() was called with the
    higher pipe BPP value (i.e. the first dsc_compute_compressed_bpp() call
    tries already all the possible compressed BPP values which are all below
    the pipe BPP value passed to it). Simplify the function accordingly
    trying only the maximum pipe BPP value.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-17-imre.deak@intel.com

commit 8193ce906a8656892334b17e60e19ae7aeea220f
Author: Imre Deak 
Date:   Mon Dec 22 17:35:42 2025 +0200

    drm/i915/dp: Simplify computing DSC BPPs for eDP
    
    The maximum pipe BPP value (used as the DSC input BPP) has been aligned
    already to the corresponding source/sink input BPP capabilities in
    intel_dp_compute_config_limits(). So it isn't needed to perform the same
    alignment again in intel_edp_dsc_compute_pipe_bpp() called later, this
    function can simply use the already aligned maximum pipe BPP value, do
    that.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-16-imre.deak@intel.com

commit 4d2dd780970d33d4dd66c718077ee703938b0a71
Author: Imre Deak 
Date:   Mon Dec 22 17:35:41 2025 +0200

    drm/i915/dp: Use helpers to align min/max compressed BPPs
    
    The minimum/maximum compressed BPP values are aligned/bounded in
    intel_dp_compute_link_bpp_limits() to the corresponding source limits.
    The minimum compressed BPP value doesn't change afterwards, so no need
    to align it again, remove that.
    
    The maximum compressed BPP, which depends on the pipe BPP value still
    needs to be aligned, since the pipe BPP value could change after the
    above limits were computed, via intel_dp_force_dsc_pipe_bpp(). Use the
    corresponding helper for this alignment instead of open-coding the same.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-15-imre.deak@intel.com

commit 2bd5dd6e720952778233636e0d0dd1ede3563634
Author: Imre Deak 
Date:   Mon Dec 22 17:35:40 2025 +0200

    drm/i915/dp: Unify detect and compute time DSC mode BW validation
    
    Atm, a DP DSC video mode's required BW vs. the available BW is
    determined by calculating the maximum compressed BPP value allowed by
    the available BW. Doing that using a closed-form formula as it's done
    atm (vs. an iterative way) is problematic, since the overhead of the
    required BW itself depends on the BPP value being calculated. Instead of
    that calculate the required BW for the minimum compressed BPP value
    supported both by the source and the sink and check this BW against the
    available BW. This change also aligns the BW calculation during mode
    validation with how this is done during state computation, calculating
    the required effective data rate with the corresponding BW overhead.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-14-imre.deak@intel.com

commit 745395b51c26766b070f5761d97f9fbad15618c3
Author: Imre Deak 
Date:   Mon Dec 22 17:35:39 2025 +0200

    drm/i915/dp: Add intel_dp_mode_valid_with_dsc()
    
    Add intel_dp_mode_valid_with_dsc() and call this for an SST/MST mode
    validation to prepare for a follow-up change using a way to verify the
    mode's required BW the same way this is done elsewhere during state
    computation (which in turn depends on the mode's effective data rate
    with the corresponding BW overhead).
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-13-imre.deak@intel.com

commit e68aecf473449d625bc5e3e2f0c754711d5f680d
Author: Imre Deak 
Date:   Mon Dec 22 17:35:38 2025 +0200

    drm/i915/dp: Factor out compute_max_compressed_bpp_x16()
    
    Factor out compute_max_compressed_bpp_x16() also used during mode
    validation in a follow-up change.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-12-imre.deak@intel.com

commit 28e59c7e24ea1189bd925bf0efede4324ca3aaa6
Author: Imre Deak 
Date:   Mon Dec 22 17:35:37 2025 +0200

    drm/i915/dp: Factor out compute_min_compressed_bpp_x16()
    
    Factor out compute_min_compressed_bpp_x16() also used during mode
    validation in a follow-up change.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-11-imre.deak@intel.com

commit 07b34db2a0982480a30fe001d5f480d9e58e24db
Author: Imre Deak 
Date:   Mon Dec 22 17:35:36 2025 +0200

    drm/i915/dp: Pass mode clock to dsc_throughput_quirk_max_bpp_x16()
    
    Prepare for follow-up changes using dsc_throughput_quirk_max_bpp_x16()
    without an intel_crtc_state pointer.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-10-imre.deak@intel.com

commit 9212733a30e349536e2c17baa5ac9b279b948877
Author: Imre Deak 
Date:   Mon Dec 22 17:35:35 2025 +0200

    drm/i915/dp: Pass intel_output_format to intel_dp_dsc_sink_{min_max}_compressed_bpp()
    
    Prepare for follow-up changes also calling
    intel_dp_dsc_min_sink_compressed_bpp() /
    intel_dp_dsc_max_sink_compressed_bpp_x16()
    without an intel_crtc_state.
    
    While at it remove the stale function declarations from the header file.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-9-imre.deak@intel.com

commit 756009d0fdfa15b5536de138aab0e5f15ab69f6d
Author: Imre Deak 
Date:   Mon Dec 22 17:35:34 2025 +0200

    drm/i915/dp: Drop intel_dp parameter from intel_dp_compute_config_link_bpp_limits()
    
    The intel_dp pointer can be deducted from the connector pointer, so it's
    enough to pass only connector to
    intel_dp_compute_config_link_bpp_limits(), do so.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-8-imre.deak@intel.com

commit f55c1f62b6ce801d40b524bef97108d274a252b7
Author: Imre Deak 
Date:   Mon Dec 22 17:35:33 2025 +0200

    drm/i915/dp: Align min/max compressed BPPs when calculating BPP limits
    
    Align the minimum/maximum DSC compressed BPPs to the corresponding
    source compressed BPP limits already when computing the BPP limits. This
    alignment is also performed later during state computation, however
    there is no reason to initialize the limits to an unaligned/incorrect
    value.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-7-imre.deak@intel.com

commit 753d6b404e12ac950a6b9207ba788f7f2e0a6303
Author: Imre Deak 
Date:   Mon Dec 22 17:35:32 2025 +0200

    drm/i915/dp: Align min/max DSC input BPPs to sink caps
    
    Align the minimum/maximum DSC input BPPs to the corresponding sink DSC
    input BPP capability limits already when computing the BPP limits. This
    alignment is also performed later during state computation, however
    there is no reason to initialize the limits to an unaligned/incorrect
    value.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-6-imre.deak@intel.com

commit 44a95ffe685d3b9428ab81f632e9b34bb2e4641c
Author: Imre Deak 
Date:   Mon Dec 22 17:35:31 2025 +0200

    drm/i915/dp: Factor out align_max_vesa_compressed_bpp_x16()
    
    Factor out align_max_vesa_compressed_bpp_x16(), also used later for
    computing the maximum DSC compressed BPP limit.
    
    Reviewed-by: Vinod Govindapillai 
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-5-imre.deak@intel.com

commit 85b4360d2b72b4a38497f5267da5cb817dd91b34
Author: Imre Deak 
Date:   Mon Dec 22 17:35:30 2025 +0200

    drm/i915/dp: Factor out align_max_sink_dsc_input_bpp()
    
    Factor out align_max_sink_dsc_input_bpp(), also used later for computing
    the maximum DSC input BPP limit.
    
    Reviewed-by: Vinod Govindapillai 
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-4-imre.deak@intel.com

commit 7427f30e5c4938ebe813aa46e578cb5afc375de4
Author: Imre Deak 
Date:   Mon Dec 22 17:35:28 2025 +0200

    drm/i915/dp: Drop unused timeslots param from dsc_compute_link_config()
    
    Drop the unused timeslots parameter from dsc_compute_link_config() and
    other functions calling it.
    
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251222153547.713360-2-imre.deak@intel.com

commit f8ad8bbb8827c5bfd83bdf5e1ab512d2dc5db643
Author: Samuel Holland 
Date:   Sun Oct 29 16:26:59 2023 -0500

    riscv: dts: allwinner: d1: Add RGB LEDs to boards
    
    Some D1-based boards feature an onboard RGB LED. Enable them.
    
    Acked-by: Guo Ren 
    Acked-by: Jernej Skrabec 
    Tested-by: Trevor Woerner 
    Signed-off-by: Samuel Holland 
    Link: https://patch.msgid.link/20231029212738.7871-6-samuel@sholland.org
    Signed-off-by: Chen-Yu Tsai 

commit c8e75e0cecd277fb585d4491a6eeaaff64546f10
Author: Samuel Holland 
Date:   Sun Oct 29 16:26:58 2023 -0500

    riscv: dts: allwinner: d1: Add LED controller node
    
    Allwinner D1 contains an LED controller. Add its devicetree node, as
    well as the pinmux used by the reference board design.
    
    Acked-by: Guo Ren 
    Reviewed-by: Jernej Skrabec 
    Tested-by: Trevor Woerner 
    Signed-off-by: Samuel Holland 
    Link: https://patch.msgid.link/20231029212738.7871-5-samuel@sholland.org
    [wens@kernel.org: move "status" to end of properties]
    Signed-off-by: Chen-Yu Tsai 

commit 62b04225e99a5d1c71c5c73d2aa6618bc2c0738f
Author: Marek Vasut 
Date:   Wed Jan 7 22:36:25 2026 +0100

    regulator: dt-bindings: rpi-panel: Mark 7" Raspberry Pi as GPIO controller
    
    Mark the Raspberry Pi 7" Display 1 ATTINY based regulator
    as GPIO controller, because the hardware behaves that way
    in addition to being a regulator. Add fixed gpio-cells as
    well.
    
    Signed-off-by: Marek Vasut 
    Link: https://patch.msgid.link/20260107213638.505319-1-marex@nabladev.com
    Signed-off-by: Mark Brown 

commit 4d9af1e12cd6462c53aa91b6a0b6af7861e1c0ce
Author: Samuel Holland 
Date:   Sun Oct 29 16:26:57 2023 -0500

    arm64: dts: allwinner: a100: Add LED controller node
    
    Allwinner A100 contains an LED controller. Add it to the devicetree.
    
    Acked-by: Guo Ren 
    Reviewed-by: Jernej Skrabec 
    Signed-off-by: Samuel Holland 
    Link: https://patch.msgid.link/20231029212738.7871-4-samuel@sholland.org
    [wens@kernel.org: resolve conflict; move "status" to end of properties]
    Signed-off-by: Chen-Yu Tsai 

commit 0f93dddb038ee1688d1a03f68d476902053dfa1b
Merge: 26cbb4dd58ae1c 8618271887ca10
Author: Mark Brown 
Date:   Tue Jan 13 16:40:00 2026 +0000

    mtd: spinand: Octal DTR support
    
    Merge series from Miquel Raynal :
    
    This series adds support for 8D-8D-8D in SPI NAND, which can already be
    leveraged without any SPI changes as controllers already have this
    support for some SPI NOR devices.
    
    Among the few spi-mem patches, they are needed for building the SPI NAND
    changes (especially the ODTR introduction at the end) and therefore an
    immutable tag will be needed for merging in the MTD tree (unless all the
    series goes through MTD directly ofc).

commit c40b50c3cfbe274f054c6a2d2fa62cd7c4650460
Author: Nicolas Frattaroli 
Date:   Sat Dec 20 19:49:54 2025 +0100

    drm/panthor: Implement reading shader_present from nvmem
    
    On some platforms, notably MediaTek MT8196, the shader_present bitmask
    in the Mali GPU register for it has cores enabled that may be faulty.
    The true shader_present bitmask is found in an efuse instead.
    
    Implement reading shader_present from an nvmem cell if one is present,
    falling back to the Mali register if it's absent. The error codes are
    trickled up through to the probe function so that probe deferral works.
    
    Signed-off-by: Nicolas Frattaroli 
    Reviewed-by: Liviu Dudau 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251220-mt8196-shader-present-v2-3-45b1ff1dfab0@collabora.com
    Signed-off-by: Boris Brezillon 

commit 2568b8b0860eede10b39109aaa3e51900737b5d6
Author: Nicolas Frattaroli 
Date:   Sat Dec 20 19:49:52 2025 +0100

    dt-bindings: gpu: mali-valhall-csf: Add shader-present nvmem cell
    
    On the MediaTek MT8196 SoC, the bitmask for which shader cores are
    present and functional is not the one in the Mali GPU's registers, but
    in an external efuse.
    
    Add the nvmem cell properties to describe such a setup, and make them
    required on MT8196.
    
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Nicolas Frattaroli 
    Link: https://patch.msgid.link/20251220-mt8196-shader-present-v2-1-45b1ff1dfab0@collabora.com
    Signed-off-by: Boris Brezillon 

commit 303db924fe0bb298242694c0c36fa1890cc9cf33
Author: Danilo Krummrich 
Date:   Tue Jan 13 13:03:42 2026 +0100

    MAINTAINERS: update auxiliary bus entry
    
    The auxiliary bus is part of the driver-core infrastructure, hence add
    missing driver-core maintainers to the auxiliary bus entry.
    
    Signed-off-by: Danilo Krummrich 
    Acked-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/20260113120345.4639-1-dakr@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit e7fc2fee4212714485d0efb12cdd9fbb51dde078
Author: Odelu Kukatla 
Date:   Wed Oct 1 13:03:44 2025 +0530

    arm64: dts: qcom: sa8775p: Add reg and clocks for QoS configuration
    
    Add register addresses and clocks which need to be enabled for
    configuring QoS on sa8775p SoC.
    
    Signed-off-by: Odelu Kukatla 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251001073344.6599-4-odelu.kukatla@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 50e194b6da721e4fa1fc6ebcf5969803c214929a
Author: Aleksander Jan Bajkowski 
Date:   Sat Jan 10 18:02:05 2026 +0100

    net: airoha: implement get_link_ksettings
    
    Implement the .get_link_ksettings to get the rate, duplex, and
    auto-negotiation status.
    
    Signed-off-by: Aleksander Jan Bajkowski 
    Tested-by: Lorenzo Bianconi 
    Link: https://patch.msgid.link/20260110170212.570793-1-olek2@wp.pl
    Signed-off-by: Paolo Abeni 

commit 5b026a9e714d33bb61f6041b9e1bffa2dcc66ff6
Author: Mrinmay Sarkar 
Date:   Tue Jan 6 18:04:46 2026 +0530

    PCI: qcom-ep: Add support for firmware-managed PCIe Endpoint
    
    Some Qualcomm platforms use firmware to manage PCIe resources such as
    clocks, resets, and PHY through the SCMI interface. In these cases,
    the Linux driver should not perform resource enable or disable
    operations directly.
    
    So introduce a `firmware_managed` flag in 'struct qcom_pcie_ep_cfg', and
    set it to true for SA8255p SoC. When this flag is set, the driver will skip
    the resource handling and rely on runtime PM APIs to let the firmware
    handle the resources with the help of power domain.
    
    Signed-off-by: Mrinmay Sarkar 
    [mani: reworded description and tiny code cleanup]
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20260106-firmware_managed_ep-v5-2-1933432127ec@oss.qualcomm.com

commit 20165a8ac68ff375e4955b3f9fda0404229131bd
Author: Mrinmay Sarkar 
Date:   Tue Jan 6 18:04:45 2026 +0530

    dt-bindings: PCI: qcom,sa8255p-pcie-ep: Document firmware managed PCIe endpoint
    
    Document the required configuration to enable the PCIe Endpoint controller
    on SA8255p which is managed by firmware using power-domain based handling.
    
    Signed-off-by: Mrinmay Sarkar 
    [mani: added MAINTAINERS entry]
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260106-firmware_managed_ep-v5-1-1933432127ec@oss.qualcomm.com

commit 24abe1f238e7d7ac56be6374c52a3c13dab84f69
Author: Abhishek Rajput 
Date:   Tue Dec 23 15:24:34 2025 +0530

    drm/mediatek: Convert legacy DRM logging to drm_* helpers in mtk_crtc.c
    
    Replace DRM_ERROR() and DRM_DEBUG_DRIVER() calls in
    drivers/gpu/drm/mediatek/mtk_crtc.c with the corresponding drm_err()
    and drm_dbg_driver() helpers.
    
    The drm_*() logging helpers take a struct drm_device * argument,
    allowing the DRM core to prefix log messages with the correct device
    name and instance. This is required to correctly distinguish log
    messages on systems with multiple GPUs.
    
    This change aligns the Mediatek DRM driver with the DRM TODO item:
    "Convert logging to drm_* functions with drm_device parameter".
    
    Reported-by: kernel test robot 
    Closes:
    https://lore.kernel.org/oe-kbuild-all/202512220515.z3QybJ8I-lkp@intel.com/
    Signed-off-by: Abhishek Rajput 
    Reviewed-by: CK Hu 
    Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251223095434.492041-1-abhiraj21put@gmail.com/
    Signed-off-by: Chun-Kuang Hu 

commit 613f3255a35a95f52575dd8c60b7ac9d711639ce
Author: Inochi Amaoto 
Date:   Fri Jan 9 12:07:53 2026 +0800

    PCI: sophgo: Disable L0s and L1 on Sophgo 2044 PCIe Root Ports
    
    Sophgo 2044 Root Ports advertise L0 and L1 capabilities without supporting
    them. Since commit f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM
    states for devicetree platforms") force enabled ASPM on all device tree
    platforms, the issue became evident and the SG2044 Root Port started
    breaking.
    
    Hence, disable the L0s and L1 capabilities in the LINKCAP register for the
    SG2044 Root Ports, so that these states won't get enabled.
    
    Fixes: 467d9c0348d6 ("PCI: dwc: Add Sophgo SG2044 PCIe controller driver in Root Complex mode")
    Signed-off-by: Inochi Amaoto 
    [mani: reworded description and corrected fixes tag]
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Han Gao 
    Link: https://patch.msgid.link/20260109040756.731169-1-inochiama@gmail.com

commit ceeb5c9835696065323cc4c2ab48b1a7a46d8269
Author: Xi Pardee 
Date:   Thu Jan 8 14:31:42 2026 -0800

    platform/x86/intel/pmc: Remove double empty line
    
    Remove double empty line to improve readability.
    
    Signed-off-by: Xi Pardee 
    Link: https://patch.msgid.link/20260108223144.504267-5-xi.pardee@linux.intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 99e243c2b170c59f349e1b2a772a6f6a30430b4d
Author: Xi Pardee 
Date:   Thu Jan 8 14:31:41 2026 -0800

    platform/x86/intel/pmc: Enable substate residencies for multiple PMCs
    
    Enable substate residencies support for multiple PMCs. Previously
    substate residencies were shown only for the primary PMC. This
    change enables substate residencies for all available PMCs.
    
    The output of substate_residencies with this patch will be similar
    to this:
    pmc0   Substate       Residency
             S0i2.0               0
             S0i2.1               0
             S0i2.2               0
    pmc1   Substate       Residency
             S0i2.0               0
             S0i2.1               0
             S0i2.2               0
    pmc2   Substate       Residency
             S0i2.0               0
    
    Signed-off-by: Xi Pardee 
    Link: https://patch.msgid.link/20260108223144.504267-4-xi.pardee@linux.intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 92911c91b5b7049cb634ef912feab086fd54ed43
Author: Xi Pardee 
Date:   Thu Jan 8 14:31:40 2026 -0800

    platform/x86/intel/pmc: Move LPM mode attributes to PMC
    
    Move LPM modes attributes from the pmc_dev to the pmc structure. LPM
    modes are PMC-specific and should be stored within the pmc structure.
    
    After the change, LPM mode information will be retrieved and stored per
    PMC. The substate_requirements attribute in debugfs will display the
    requirements for each enabled LPM substate.
    
    Signed-off-by: Xi Pardee 
    Link: https://patch.msgid.link/20260108223144.504267-3-xi.pardee@linux.intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 65b3a9220345f5dd37ff0227673c95755dbe5c2f
Author: Xi Pardee 
Date:   Thu Jan 8 14:31:39 2026 -0800

    platform/x86/intel/pmc: Change LPM mode fields to u8
    
    Change the datatypes of num_lpm_modes and lpm_en_modes[] from int
    to u8. The u8 type is more appropriate and improves the readability
    and maintainability of the code.
    
    Signed-off-by: Xi Pardee 
    Link: https://patch.msgid.link/20260108223144.504267-2-xi.pardee@linux.intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 932ca9b7b47c08479e52c1605f73474ed27e3e4f
Author: Srinivas Pandruvada 
Date:   Tue Jan 6 22:16:49 2026 -0800

    platform/x86: ISST: Optimize suspend/resume callbacks
    
    If SST-CP or SST-PP is not supported then don't store configuration
    during suspend callback and restore during resume callback.
    
    Signed-off-by: Srinivas Pandruvada 
    Link: https://patch.msgid.link/20260107061649.1634737-1-srinivas.pandruvada@linux.intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 69cd1ca440a96c85dcedcddfa5e0af6012f60b8b
Author: Srinivas Pandruvada 
Date:   Tue Jan 6 22:07:29 2026 -0800

    platform/x86: ISST: Check for admin capability for write commands
    
    In some SST deployments, administrators want to allow reading SST
    capabilities for non-root users. This can be achieved by changing file
    permissions for "/dev/isst_interface", but they still want to prevent
    any changes to the SST configuration by non-root users.
    
    This capability was available before for non-TPMI SST. Extend the same
    capability for TPMI SST by adding a check for CAP_SYS_ADMIN for all
    write commands.
    
    Signed-off-by: Srinivas Pandruvada 
    Link: https://patch.msgid.link/20260107060729.1634420-1-srinivas.pandruvada@linux.intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit dc7901b5a1563a9c9eb29b3b0b0dac3162065cd8
Author: Srinivas Pandruvada 
Date:   Tue Jan 6 22:02:56 2026 -0800

    platform/x86: ISST: Store and restore all domains data
    
    The suspend/resume callbacks currently only store and restore the
    configuration for power domain 0. However, other power domains may also
    have modified configurations that need to be preserved across suspend/
    resume cycles.
    
    Extend the store/restore functionality to handle all power domains.
    
    Fixes: 91576acab020 ("platform/x86: ISST: Add suspend/resume callbacks")
    Signed-off-by: Srinivas Pandruvada 
    CC: stable@vger.kernel.org
    Link: https://patch.msgid.link/20260107060256.1634188-3-srinivas.pandruvada@linux.intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 0e5aef2795008c80c515f6fa04e377c6e5715958
Author: Srinivas Pandruvada 
Date:   Tue Jan 6 22:02:55 2026 -0800

    platform/x86: ISST: Add missing write block check
    
    If writes are blocked, then return error during SST-CP enable command.
    Add missing write block check in this code path.
    
    Fixes: 8bed9ff7dbcc ("platform/x86: ISST: Process read/write blocked feature status")
    Signed-off-by: Srinivas Pandruvada 
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20260107060256.1634188-2-srinivas.pandruvada@linux.intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 8a4e92b3260ae7664d0531e1b42c38d336e7717a
Author: Coiby Xu 
Date:   Tue Jan 6 17:50:58 2026 +0800

    x86/crash: Use set_memory_p() instead of __set_memory_prot()
    
    set_memory_p() is available to use outside of its compilation unit since:
    
      030ad7af9437 ("x86/mm: Regularize set_memory_p() parameters and make non-static").
    
    There is no use for __set_memory_prot() anymore so drop it too.
    
      [ bp: Massage commit message. ]
    
    Signed-off-by: Coiby Xu 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260106095100.656292-1-coxu@redhat.com

commit 91e1c1bcf0f2376f40ac859cf17d0a64a605e662
Author: Nitesh Shetty 
Date:   Mon Jan 12 20:08:08 2026 +0530

    block, nvme: remove unused dma_iova_state function parameter
    
    DMA IOVA state is not used inside blk_rq_dma_map_iter_next, get
    rid of the argument.
    
    Signed-off-by: Nitesh Shetty 
    Reviewed-by: Christoph Hellwig 
    Signed-off-by: Jens Axboe 

commit dba6f54a053235b2beda8e57cbe3523ce340caf2
Merge: 06ebbe719bb022 6ffd02b82243d9
Author: Georgi Djakov 
Date:   Tue Jan 13 16:19:34 2026 +0200

    Merge branch 'icc-mtk' into icc-next
    
    This series is a combination of binding changes, driver cleanups and new
    driver code to enable the interconnect on the MediaTek MT8196 SoC.
    
    * icc-mtk
      dt-bindings: interconnect: mt8183-emi: Add support for MT8196 EMI
      interconnect: mediatek: Add support for MediaTek MT8196 EMI ICC
      interconnect: mediatek: Don't hijack parent device
      interconnect: mediatek: Aggregate bandwidth with saturating add
    
    Link: https://lore.kernel.org/r/20251124-mt8196-dvfsrc-v2-0-d9c1334db9f3@collabora.com
    Signed-off-by: Georgi Djakov 

commit 06ebbe719bb022795cd9def0606a6805b1f2f755
Author: Kuan-Wei Chiu 
Date:   Sat Jan 10 18:43:09 2026 +0000

    interconnect: Add kunit tests for core functionality
    
    The interconnect framework currently lacks in-tree unit tests to verify
    the core logic in isolation. This makes it difficult to validate
    regression stability when modifying the provider/consumer APIs or
    aggregation logic.
    
    Introduce a kunit test suite that verifies the fundamental behavior of
    the subsystem. The tests cover:
    - Provider API (node creation, linking, topology construction).
    - Consumer API (path enabling/disabling, bandwidth requests).
    - Standard aggregation logic (accumulating bandwidth across links).
    - Bulk operations for setting bandwidth on multiple paths.
    
    The suite simulates a simple SoC topology with multiple masters and a
    shared bus to validate traffic aggregation behavior in a controlled
    software environment, without requiring specific hardware or Device
    Tree support.
    
    Signed-off-by: Kuan-Wei Chiu 
    Link: https://lore.kernel.org/r/20260110184309.906735-1-visitorckw@gmail.com
    Signed-off-by: Georgi Djakov 

commit 4aa573002ba6884d392dbfce24c3ce057f2dbb6a
Author: Andy Shevchenko 
Date:   Tue Jan 13 12:10:54 2026 +0100

    gpio: pca9570: use lock guards
    
    Shrink the code by a couple lines and improve lock management by using
    lock guards from cleanup.h.
    
    Reviewed-by: Linus Walleij 
    Signed-off-by: Andy Shevchenko 
    Link: https://lore.kernel.org/r/20260113111156.188051-4-andriy.shevchenko@linux.intel.com
    Signed-off-by: Bartosz Golaszewski 

commit 053578d329e58cca98f084439e14cc2895c82b9c
Author: Andy Shevchenko 
Date:   Tue Jan 13 12:10:53 2026 +0100

    gpio: pca9570: Don't use "proxy" headers
    
    Update header inclusions to follow IWYU (Include What You Use)
    principle.
    
    Note that kernel.h is discouraged to be included as it's written
    at the top of that file.
    
    Reviewed-by: Linus Walleij 
    Signed-off-by: Andy Shevchenko 
    Link: https://lore.kernel.org/r/20260113111156.188051-3-andriy.shevchenko@linux.intel.com
    Signed-off-by: Bartosz Golaszewski 

commit e05ef046ebb1ca879d885593130fa822ff664ca1
Author: Andy Shevchenko 
Date:   Tue Jan 13 12:10:52 2026 +0100

    gpio: pca9570: Use devm_mutex_init() for mutex initialization
    
    Use devm_mutex_init() since it brings some benefits when
    CONFIG_DEBUG_MUTEXES is enabled.
    
    Reviewed-by: Linus Walleij 
    Signed-off-by: Andy Shevchenko 
    Link: https://lore.kernel.org/r/20260113111156.188051-2-andriy.shevchenko@linux.intel.com
    Signed-off-by: Bartosz Golaszewski 

commit a3e2ea7935c5a6f571d43f02b64ebb92e5cfae87
Author: Konrad Dybcio 
Date:   Fri Jun 27 21:37:57 2025 +0200

    dt-bindings: interconnect: qcom,qcs615-rpmh: Drop IPA interconnects
    
    This has been agreed to be characterized as a clock resource, not an
    interconnect provider. Bring QCS615 in line with the expectation.
    
    Signed-off-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20250627-topic-qcs615_icc_ipa-v1-3-dc47596cde69@oss.qualcomm.com
    Signed-off-by: Georgi Djakov 

commit 05a75df4182e301a1b0059606f77b65c74deaa9b
Author: Hal Feng 
Date:   Thu Dec 18 18:21:49 2025 +0800

    PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots
    
    The driver has been using the "enable-gpios" property to control the 3v3
    power supply of PCIe slots. But it is not documented in the dt-bindings and
    also using GPIO APIs is not a standard way to control PCIe slot power, so
    use the documented "vpcie3v3-supply" property and regulator APIs to control
    the slot supply.
    
    This change will break the DTs which used "enable-gpio" or "enable-gpios"
    property under the controller node. Since these properties were not defined
    in the bindings, it is safe to switch to "vpcie3v3-supply". Any out-of-tree
    DTS impacted by this change should migrate to "vpcie3v3-supply" instead.
    
    Signed-off-by: Hal Feng 
    [mani: reworded description]
    Signed-off-by: Manivannan Sadhasivam 
    Acked-by: Kevin Xie 
    Link: https://patch.msgid.link/20251218102149.28062-1-hal.feng@starfivetech.com

commit 26cbb4dd58ae1ca83319e73e9397b06a8ca961c6
Merge: a014c203b54d90 db4371d13f82fb
Author: Mark Brown 
Date:   Tue Jan 13 14:02:17 2026 +0000

    Axiado AX3000 SoC SPI DB controller driver
    
    Merge series from Vladimir Moravcevic :
    
    This series introduces new SPI controller driver for Axiado AX3000 SoC
    and its evaluation board.
    
    The SPI controller provides:
    - Full-duplex and half-duplex transfer support
    - Configurable clock polarity and phase
    - Interrupt-driven
    
    Functionality has been verified using the `jedec,spi-nor` interface to
    access onboard flash memory. This ensures compatibility with common NOR
    flash devices used in boot and storage subsystem.
    
    Further improvements, including performance tuning and extended hardware
    feature support, will be submitted in follow-up patches.

commit d813ddc0b348febf32fc9d7737ba82d2955051ac
Author: FUKAUMI Naoki 
Date:   Thu Jan 8 11:33:41 2026 +0000

    arm64: dts: rockchip: Add Radxa CM3J on RPi CM4 IO Board
    
    The Raspberry Pi Compute Module 4 IO Board is an application board for
    the Compute Module 4. [1]
    
    This patch adds support for the Radxa CM3J mounted on the RPi CM4 IO
    Board.
    
    Specification:
    - 12V 5521 DC jack
    - 2x full-size HDMI 2.0 connectors (only HDMI0 is supported with CM3J)
    - Gigabit Ethernet RJ45 with PoE support
    - 2x USB 2.0 connectors, with header for two more connectors
    - Micro USB connector
    - microSD card socket
    - PCIe Gen 2 x1 socket
    - 12V 4-pin PWM fan connector
    - External power connector (+5V, +12V)
    - 2x MIPI DSI connectors
    - 2x MIPI CSI-2 connectors
    - 40-pin GPIO header
    - RTC with battery socket
    - Red (power) and green (heartbeat) LEDs
    
    [1] https://datasheets.raspberrypi.com/cm4io/cm4io-datasheet.pdf
    
    Signed-off-by: FUKAUMI Naoki 
    Link: https://patch.msgid.link/20260108113341.14037-3-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit 9103e21ee45f8cdeaa86b2c356a3ad451c140c9f
Author: FUKAUMI Naoki 
Date:   Thu Jan 8 11:33:40 2026 +0000

    arm64: dts: rockchip: Add Radxa CM3J
    
    The Radxa CM3J is a feature rich industrial compute module based on
    the Rockchip RK3568J SoC. [1]
    
    Specification:
    - Quad-core Cortex-A55 CPU
    - Mali-G52 2EE GPU
    - 1TOPS NPU
    - Up to 8GB LPDDR4x RAM
    - Up to 32GB eMMC (optional)
    - 16MB SPI flash (optional)
    - Wi-Fi 5 / BT 5.0 with external antenna connector
    - Gigabit Ethernet PHY
    - RK809 PMIC
    - Green (power) LED
    
    [1] https://dl.radxa.com/cm3j/docs/hw/radxa_cm3j_schematic_v1.2_20250115.pdf
    
    Signed-off-by: FUKAUMI Naoki 
    Link: https://patch.msgid.link/20260108113341.14037-2-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit 90d88da849393c8353c98bee443410bb32838828
Author: FUKAUMI Naoki 
Date:   Thu Jan 8 11:33:39 2026 +0000

    dt-bindings: arm: rockchip: Add Radxa CM3J on RPi CM4 IO Board
    
    The Radxa CM3J is a feature rich industrial compute module developed
    by Radxa, based on the Rockchip RK3568 SoC. [1]
    
    Add devicetree binding documentation for the Radxa CM3J on RPi CM4 IO
    Board.
    
    [1] https://dl.radxa.com/cm3j/docs/hw/radxa_cm3j_product_brief_Revision_1.0.pdf
    
    Signed-off-by: FUKAUMI Naoki 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260108113341.14037-1-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit b0b449e6fec4cd182bd4384f7eb9002596079f68
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:20 2026 +0100

    x86/pvlocks: Move paravirt spinlock functions into own header
    
    Instead of having the pv spinlock function definitions in paravirt.h,
    move them into the new header paravirt-spinlock.h.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260105110520.21356-22-jgross@suse.com

commit 4ad1a7548080e9e9ac1a1e78672ce2acb25e69d8
Author: FUKAUMI Naoki 
Date:   Thu Jan 8 03:42:52 2026 +0000

    arm64: dts: rockchip: Make eeprom read-only for Radxa ROCK 3C/5A/5C
    
    The BL24C16 EEPROM implemented on the Radxa ROCK 3C, 5A, and 5C [1]
    [2] [3] is designed to have data written during factory programming
    (regardless of whether data is actually written or not), and we at
    Radxa permit users to read the data but not write to it. [4]
    Therefore, we will add a read-only property to the eeprom node.
    
    [1] https://dl.radxa.com/rock3/docs/hw/3c/v1400/radxa_rock_3c_v1400_schematic.pdf p.13
    [2] https://dl.radxa.com/rock5/5a/docs/hw/radxa_rock5a_V1.1_sch.pdf p.19
    [3] https://dl.radxa.com/rock5/5c/docs/hw/v1100/radxa_rock_5c_schematic_v1100.pdf p.18
    [4] https://github.com/radxa/u-boot/blob/next-dev-v2024.10/drivers/misc/radxa-i2c-eeprom.c
    
    Signed-off-by: FUKAUMI Naoki 
    Link: https://patch.msgid.link/20260108034252.2713-1-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit 26cfaee2972c95a6d3ad85549df089a4ee93a551
Author: Heiko Stuebner 
Date:   Sun Jan 4 20:14:48 2026 +0100

    arm64: dts: rockchip: Add TS133 variant of the QNAP NAS series
    
    The TS133 is a one-bay NAS mostly similar to the other devices in the
    series. The main difference is that it is build around the RK3566 SoC
    instead of the RK3568 variant.
    
    The RK3566/RK3568 are mostly similar with only slight variants in both
    speed and some specific peripherals - the RK3568 has more.
    
    The specific for the NAS series stay the same though.
    
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20260104191448.2693309-6-heiko@sntech.de

commit ae2208dfa2ac3872f2a0d4c72f1a29fcce7b56a8
Author: Heiko Stuebner 
Date:   Sun Jan 4 20:14:47 2026 +0100

    dt-bindings: arm: rockchip: add TS133 to RK356x-based QNAP NAS devices
    
    QNAP builds a number of variants of the RK356x-based NAS design.
    
    Add the 1-bay TS133 variant.
    
    This one is a tiny bit special as it is based around the RK3566 variant
    of the mostly similar RK3566/RK3568 SoCs.
    
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20260104191448.2693309-5-heiko@sntech.de

commit a81a2d211344675de4d945eb2070e3ef1202060f
Author: Heiko Stuebner 
Date:   Sun Jan 4 20:14:46 2026 +0100

    arm64: dts: rockchip: Move copy-key to TSx33 board files
    
    The copy-key is not present on all device variants, so move it to
    the individual boards that have this key.
    
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20260104191448.2693309-4-heiko@sntech.de

commit 5a16e131ddbacdd7acfb8cab6ff0ca1c57339600
Author: Heiko Stuebner 
Date:   Sun Jan 4 20:14:45 2026 +0100

    arm64: dts: rockchip: Fix the common combophy + SATA on QNAP TSx33 devices
    
    The common used SATA controller on all TSx33 devices is actually SATA2.
    So move the SATA controller + combophy enablement to their correct
    position between shared dtsi and board devicetrees.
    
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20260104191448.2693309-3-heiko@sntech.de

commit f0761f6be5ed62bc282349c46784d676571ace83
Author: Heiko Stuebner 
Date:   Sun Jan 4 20:14:44 2026 +0100

    arm64: dts: rockchip: Move SoC include to individual QNAP TSx33 boards
    
    The TS133 while mostly similar, is based around the RK3566 variant, so
    needs a different SoC include.
    
    By moving the SoC include to the board devicetrees, we can still keep
    the shared common setup, while supporting the different base SoCs.
    
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20260104191448.2693309-2-heiko@sntech.de

commit 392afe83165a54080ec48e50d45049bd5aaad332
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:19 2026 +0100

    x86/paravirt: Specify pv_ops array in paravirt macros
    
    In order to prepare having multiple pv_ops arrays, specify the array in the
    paravirt macros.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260105110520.21356-21-jgross@suse.com

commit bec06cd6a140ceb62ee4634c9550212f5f05bcfd
Author: Thomas Weißschuh 
Date:   Tue Dec 23 07:59:20 2025 +0100

    MIPS: vdso: Provide getres_time64() for 32-bit ABIs
    
    For consistency with __vdso_clock_gettime64() there should also be a
    64-bit variant of clock_getres(). This will allow the extension of
    CONFIG_COMPAT_32BIT_TIME to the vDSO and finally the removal of 32-bit
    time types from the kernel and UAPI.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251223-vdso-compat-time32-v1-9-97ea7a06a543@linutronix.de

commit f10c2e72b5dea0bc7485a05da8e21781b69d5508
Author: Thomas Weißschuh 
Date:   Tue Dec 23 07:59:19 2025 +0100

    arm64: vdso32: Provide clock_getres_time64()
    
    For consistency with __vdso_clock_gettime64() there should also be a
    64-bit variant of clock_getres(). This will allow the extension of
    CONFIG_COMPAT_32BIT_TIME to the vDSO and finally the removal of 32-bit
    time types from the kernel and UAPI.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Acked-by: Will Deacon 
    Link: https://patch.msgid.link/20251223-vdso-compat-time32-v1-8-97ea7a06a543@linutronix.de

commit 1149dcdfc9ef4b3fa90b431a5752da53dcadb0d2
Author: Thomas Weißschuh 
Date:   Tue Dec 23 07:59:18 2025 +0100

    ARM: VDSO: Provide clock_getres_time64()
    
    For consistency with __vdso_clock_gettime64() there should also be a
    64-bit variant of clock_getres(). This will allow the extension of
    CONFIG_COMPAT_32BIT_TIME to the vDSO and finally the removal of 32-bit
    time types from the kernel and UAPI.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251223-vdso-compat-time32-v1-7-97ea7a06a543@linutronix.de

commit b9fecf0dddfc55cd7d02b0011494da3c613f7cde
Author: Thomas Weißschuh 
Date:   Tue Dec 23 07:59:17 2025 +0100

    ARM: VDSO: Patch out __vdso_clock_getres() if unavailable
    
    The vDSO code hides symbols which are non-functional.
    __vdso_clock_getres() was not added to this list when it got introduced.
    
    Fixes: 052e76a31b4a ("ARM: 8931/1: Add clock_getres entry point")
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251223-vdso-compat-time32-v1-6-97ea7a06a543@linutronix.de

commit 21bbfd74044f77a98bbc27ea9e6cb04f4dfd8ee6
Author: Thomas Weißschuh 
Date:   Tue Dec 23 07:59:16 2025 +0100

    x86/vdso: Provide clock_getres_time64() for x86-32
    
    For consistency with __vdso_clock_gettime64() there should also be a
    64-bit variant of clock_getres(). This will allow the extension of
    CONFIG_COMPAT_32BIT_TIME to the vDSO and finally the removal of 32-bit
    time types from the kernel and UAPI.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251223-vdso-compat-time32-v1-5-97ea7a06a543@linutronix.de

commit 4e6a2312986d437cc22805b9e08f86b15fee0318
Author: Thomas Weißschuh 
Date:   Tue Dec 23 07:59:15 2025 +0100

    selftests: vDSO: vdso_test_abi: Add test for clock_getres_time64()
    
    Some architectures will start to implement this function.
    Make sure it works correctly.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251223-vdso-compat-time32-v1-4-97ea7a06a543@linutronix.de

commit 1dcd1273add368c2b7c65135e22b416e1b374781
Author: Thomas Weißschuh 
Date:   Tue Dec 23 07:59:14 2025 +0100

    selftests: vDSO: vdso_test_abi: Use UAPI system call numbers
    
    SYS_clock_getres might have been redirected by libc to some other system
    call than the actual clock_getres. For testing it is required to use
    exactly this system call.
    
    Use the system call number exported by the UAPI headers which is always
    correct.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251223-vdso-compat-time32-v1-3-97ea7a06a543@linutronix.de

commit 609e359ab904698f1e5aa0ab2fee2f4c29ee0886
Author: Thomas Weißschuh 
Date:   Tue Dec 23 07:59:13 2025 +0100

    selftests: vDSO: vdso_config: Add configurations for clock_getres_time64()
    
    Some architectures will start to implement this function.
    Make sure that tests can be written for it.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251223-vdso-compat-time32-v1-2-97ea7a06a543@linutronix.de

commit b205656daf932c06aff424de5d6d01faf60faa5b
Author: Thomas Weißschuh 
Date:   Tue Dec 23 07:59:12 2025 +0100

    vdso: Add prototype for __vdso_clock_getres_time64()
    
    For consistency with __vdso_clock_gettime64() there should also be a
    64-bit variant of clock_getres(). This will allow the extension of
    CONFIG_COMPAT_32BIT_TIME to the vDSO and finally the removal of 32-bit
    time types from the kernel and UAPI. The generic vDSO library already
    provides nearly all necessary building blocks for architectures to
    provide this function. Only a prototype is missing.
    
    Add the prototype to the generic header so architectures can start
    providing this function.
    
    Suggested-by: Arnd Bergmann 
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251223-vdso-compat-time32-v1-1-97ea7a06a543@linutronix.de

commit d782e6e7aa798a2c28f30f984ea6dcdb63f51674
Author: Yao Zi 
Date:   Tue Dec 9 14:00:06 2025 +0000

    dt-bindings: PCI: loongson: Document msi-parent property
    
    Loongson PCI controllers found in LS2K1000/2000 SoCs
    (loongson,ls2k-pci), 7A1000/2000 bridge chips (loongson,ls7a-pci), and
    RS780E bridge chips (loongson,rs780e-pci) all have their paired MSI
    controllers.
    
    Though only the one in LS2K2000 SoC is described in devicetree, we
    should document the property for all variants. For the same reason, it
    isn't marked as required for now.
    
    Fixes: 83e757ecfd5d ("dt-bindings: Document Loongson PCI Host Controller")
    Signed-off-by: Yao Zi 
    Signed-off-by: Manivannan Sadhasivam 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251209140006.54821-3-me@ziyao.cc

commit 5c3f795d17dc57a58a1fc1c1b449812e26ad85a3
Author: Jacob Moroni 
Date:   Mon Jan 5 18:05:50 2026 +0000

    RDMA/irdma: Remove fixed 1 ms delay during AH wait loop
    
    The AH CQP command wait loop executes in an atomic context and was
    using a fixed 1 ms delay. Since many AH create commands can complete
    much faster than 1 ms, use poll_timeout_us_atomic with a 1 us delay.
    
    Also, use the timeout value indicated during the capability exchange
    rather than a hard-coded value.
    
    Signed-off-by: Jacob Moroni 
    Link: https://patch.msgid.link/20260105180550.2907858-1-jmoroni@google.com
    Signed-off-by: Leon Romanovsky 

commit 52f3d34c292b62ec151c6a487d267341d47eefa4
Author: Jacob Moroni 
Date:   Sat Jan 3 17:25:17 2026 +0000

    RDMA/irdma: Remove redundant dma_wmb() before writel()
    
    A dma_wmb() is not necessary before a writel() because writel()
    already has an even stronger store barrier. A dma_wmb() is only
    required to order writes to consistent/DMA memory whereas the
    barrier in writel() is specified to order writes to DMA memory as
    well as MMIO.
    
    Signed-off-by: Jacob Moroni 
    Link: https://patch.msgid.link/20260103172517.2088895-1-jmoroni@google.com
    Signed-off-by: Leon Romanovsky 

commit 88f2bf22d99b4a89f5ec3d3dec07271368499c3c
Author: Grzegorz Prajsner 
Date:   Wed Jan 7 17:15:17 2026 +0100

    RDMA/rtrs-srv: Fix error print in process_info_req()
    
    rtrs_srv_change_state() returns bool (true on success) therefore
    there is no reason to print error when it fails as it always will
    be 0.
    
    Signed-off-by: Grzegorz Prajsner 
    Signed-off-by: Md Haris Iqbal 
    Link: https://patch.msgid.link/20260107161517.56357-11-haris.iqbal@ionos.com
    Signed-off-by: Leon Romanovsky 

commit fc290630702b530c2969061e7ef0d869a5b6dc4f
Author: Md Haris Iqbal 
Date:   Wed Jan 7 17:15:16 2026 +0100

    RDMA/rtrs-clt: For conn rejection use actual err number
    
    When the connection establishment request is rejected from the server
    side, then the actual error number sent back should be used.
    
    Signed-off-by: Md Haris Iqbal 
    Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com
    Reviewed-by: Grzegorz Prajsner 
    Reviewed-by: Jack Wang 
    Signed-off-by: Leon Romanovsky 

commit 6405f72e7a3ad7567d16ad5b52d086f573c39548
Author: Kim Zhu 
Date:   Wed Jan 7 17:15:15 2026 +0100

    RDMA/rtrs: Extend log message when a port fails
    
    Add HCA name and port of this HCA.
    This would help with analysing and debugging the logs.
    
    The logs would looks something like this,
    
    rtrs_server L2516: Handling event: port error (10).
                       HCA name: mlx4_0, port num: 2
    rtrs_client L3326: Handling event: port error (10).
                       HCA name: mlx4_0, port num: 1
    
    Signed-off-by: Kim Zhu 
    Signed-off-by: Md Haris Iqbal 
    Signed-off-by: Grzegorz Prajsner 
    Link: https://patch.msgid.link/20260107161517.56357-9-haris.iqbal@ionos.com
    Signed-off-by: Leon Romanovsky 

commit b034a10fdfc4fff547a4ee0602538a214534c426
Author: Kim Zhu 
Date:   Wed Jan 7 17:15:14 2026 +0100

    RDMA/rtrs-srv: Rate-limit I/O path error logging
    
    Excessive error logging is making it difficult to identify the root
    cause of issues. Implement rate limiting to improve log clarity.
    
    Signed-off-by: Kim Zhu 
    Signed-off-by: Jack Wang 
    Signed-off-by: Grzegorz Prajsner 
    Link: https://patch.msgid.link/20260107161517.56357-8-haris.iqbal@ionos.com
    Signed-off-by: Leon Romanovsky 

commit c32eaba2d760ef0ec5426b207cf0ce750064cf36
Author: Md Haris Iqbal 
Date:   Wed Jan 7 17:15:13 2026 +0100

    RDMA/rtrs-srv: Add check and closure for possible zombie paths
    
    During several network incidents, a number of RTRS paths for a session
    went through disconnect and reconnect phase. However, some of those did
    not auto-reconnect successfully. Instead they failed with the following
    logs,
    
    On client,
    kernel: rtrs_client L1991: : Connect rejected: status 28
      (consumer defined), rtrs errno -104
    kernel: rtrs_client L2698: : init_conns() failed: err=-104
      path=gid:@gid: [mlx4_0:1]
    
    On server, (log a)
    kernel: ibtrs_server L1868: <>: Connection already exists: 0
    
    When the misbehaving path was removed, and add_path was called to re-add
    the path, the log on client side changed to, (log b)
    kernel: rtrs_client L1991: : Connect rejected: status 28
      (consumer defined), rtrs errno -17
    
    There was no log on the server side for this, which is expected since
    there is no logging in that path,
    if (unlikely(__is_path_w_addr_exists(srv, &cm_id->route.addr))) {
            err = -EEXIST;
            goto err;
    
    Because of the following check on server side,
    if (unlikely(sess->state != IBTRS_SRV_CONNECTING)) {
            ibtrs_err(s, "Session in wrong state: %s\n",
    
    .. we know that the path in (log a) was in CONNECTING state.
    
    The above state of the path persists for as long as we leave the session
    be. This means that the path is in some zombie state, probably waiting
    for the info_req packet to arrive, which never does.
    
    The changes in this commits does 2 things.
    
    1) Add logs at places where we see the errors happening. The logs would
    shed more light at the state and lifetime of such zombie paths.
    
    2) Close such zombie sessions, only if they are in CONNECTING state, and
    after an inactivity period of 30 seconds.
      i) The state check prevents closure of paths which are CONNECTED.
    Also, from the above logs and code, we already know that the path could
    only be on CONNECTING state, so we play safe and narrow our impact surface
    area by closing only CONNECTING paths.
      ii) The inactivity period is to allow requests for other cid to finish
    processing, or for any stray packets to arrive/fail.
    
    Signed-off-by: Md Haris Iqbal 
    Signed-off-by: Jack Wang 
    Signed-off-by: Grzegorz Prajsner 
    Link: https://patch.msgid.link/20260107161517.56357-7-haris.iqbal@ionos.com
    Signed-off-by: Leon Romanovsky 

commit 781c35b5d570d3dd242cf0578a92c93ca63fc14f
Author: Jack Wang 
Date:   Wed Jan 7 17:15:12 2026 +0100

    RDMA/rtrs-clt: Remove unused members in rtrs_clt_io_req
    
    Remove unused members from rtrs_clt_io_req.
    
    Signed-off-by: Jack Wang 
    Signed-off-by: Grzegorz Prajsner 
    Link: https://patch.msgid.link/20260107161517.56357-6-haris.iqbal@ionos.com
    Signed-off-by: Leon Romanovsky 

commit f85febf57bb567b59b41a13c9bf845a73b616d10
Author: Kim Zhu 
Date:   Wed Jan 7 17:15:11 2026 +0100

    RDMA/rtrs: Improve error logging for RDMA cm events
    
    The member variable status in the struct rdma_cm_event is used for both
    linux errors and the errors definded in rdma stack.
    
    Signed-off-by: Kim Zhu 
    Reviewed-by: Md Haris Iqbal 
    Signed-off-by: Grzegorz Prajsner 
    Link: https://patch.msgid.link/20260107161517.56357-5-haris.iqbal@ionos.com
    Signed-off-by: Leon Romanovsky 

commit 9293e042782df38434191de8f3703fe2cb808ad6
Author: Md Haris Iqbal 
Date:   Wed Jan 7 17:15:10 2026 +0100

    RDMA/rtrs: Add optional support for IB_MR_TYPE_SG_GAPS
    
    Support IB_MR_TYPE_SG_GAPS, which has less limitations
    than standard IB_MR_TYPE_MEM_REG, a few ULP support this.
    
    Signed-off-by: Md Haris Iqbal 
    Signed-off-by: Kim Zhu 
    Signed-off-by: Jack Wang 
    Signed-off-by: Grzegorz Prajsner 
    Link: https://patch.msgid.link/20260107161517.56357-4-haris.iqbal@ionos.com
    Signed-off-by: Leon Romanovsky 

commit d6cc7b0d6191e3762296dd32a8d9c2e276b950dd
Author: Kim Zhu 
Date:   Wed Jan 7 17:15:09 2026 +0100

    RDMA/rtrs: Add error description to the logs
    
    Print error description instead of the error number.
    
    Signed-off-by: Kim Zhu 
    Signed-off-by: Jack Wang 
    Signed-off-by: Grzegorz Prajsner 
    Link: https://patch.msgid.link/20260107161517.56357-3-haris.iqbal@ionos.com
    Signed-off-by: Leon Romanovsky 

commit 83835f7c07b523c7ca2a5ad0a511670b5810539e
Author: Roman Penyaev 
Date:   Wed Jan 7 17:15:08 2026 +0100

    RDMA/rtrs-srv: fix SG mapping
    
    This fixes the following error on the server side:
    
       RTRS server session allocation failed: -EINVAL
    
    caused by the caller of the `ib_dma_map_sg()`, which does not expect
    less mapped entries, than requested, which is in the order of things
    and can be easily reproduced on the machine with enabled IOMMU.
    
    The fix is to treat any positive number of mapped sg entries as a
    successful mapping and cache DMA addresses by traversing modified
    SG table.
    
    Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
    Signed-off-by: Roman Penyaev 
    Signed-off-by: Jack Wang 
    Signed-off-by: Grzegorz Prajsner 
    Link: https://patch.msgid.link/20260107161517.56357-2-haris.iqbal@ionos.com
    Signed-off-by: Leon Romanovsky 

commit bb3a8154b1a1dc2c86d037482c0a2cf9186829ed
Author: Damien Le Moal 
Date:   Wed Dec 17 14:05:25 2025 +0900

    ata: libata-scsi: refactor ata_scsi_translate()
    
    Factor out of ata_scsi_translate() the code handling queued command
    deferral using the port qc_defer callback and issuing the queued
    command with ata_qc_issue() into the new function ata_scsi_qc_issue(),
    and simplify the goto used in ata_scsi_translate().
    While at it, also add a lockdep annotation to check that the port lock
    is held when ata_scsi_translate() is called.
    
    No functional changes.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Damien Le Moal 
    Reviewed-by: Niklas Cassel 
    Reviewed-by: Martin K. Petersen 
    Reviewed-by: John Garry 
    Reviewed-by: Igor Pylypiv 

commit de9f1b1583aecb246b659effb03f2456604fab64
Author: AngeloGioacchino Del Regno 
Date:   Tue Jan 13 11:59:57 2026 +0100

    regulator: dt-bindings: mediatek,mt6331: Add missing ldo-vio28 vreg
    
    The MT6331 has a "ldo-vio28" regulator but this was missing in the
    list: add it to resolve a dtbs_check warning.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Link: https://patch.msgid.link/20260113110000.36953-4-angelogioacchino.delregno@collabora.com
    Signed-off-by: Mark Brown 

commit e39951f8ad500648b9ab132f8042d6e47da441cf
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:21:37 2025 +0200

    MAINTAINERS: Add ROHM BD72720 PMIC
    
    Add the ROHM BD72720 PMIC driver files to be maintained by undersigned.
    
    Signed-off-by: Matti Vaittinen 
    Link: https://patch.msgid.link/5ab04df42d8fddab4c2b0b86414314c6bb815ffd.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit bcb5bb59b83642bb242aaf6b018bebb1325a50ba
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:21:19 2025 +0200

    power: supply: bd71828-power: Support ROHM BD72720
    
    The ROHM BD72720 is a power management IC with a charger and coulomb
    counter block which is closely related to the charger / coulomb counter
    found from the BD71815, BD71828, BD71879 which are all supported by the
    bd71828-power driver. Due to the similarities it makes sense to support
    also the BD72720 with the same driver.
    
    Add basic support for the charger logic on ROHM BD72720.
    
    Signed-off-by: Matti Vaittinen 
    Link: https://patch.msgid.link/fb74c0cab3dfe534135d26dbbb9c66699678c2de.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit de8f20afb00469c4fc0bb4191cdef7a95c2f847e
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:21:03 2025 +0200

    power: supply: bd71828: Support wider register addresses
    
    The BD71828 power-supply driver assumes register addresses to be 8-bit.
    The new BD72720 will use stacked register maps to hide paging which is
    done using secondary I2C slave address. This requires use of 9-bit
    register addresses in the power-supply driver (added offset 0x100 to
    the 8-bit hardware register addresses).
    
    The cost is slightly used memory consumption as the members in the
    struct pwr_regs will be changed from u8 to unsigned int, which means 3
    byte increase / member / instance.
    This is currently 14 members (expected to possibly be increased when
    adding new variants / new functionality which may introduce new
    registers, but not expected to grow much) and 2 instances (will be 3
    instances when BD72720 gets added).
    
    So, even if the number of registers grew to 50 it'd be 150 bytes /
    instance. Assuming we eventually supported 5 variants, it'd be
    5 * 150 bytes, which stays very reasonable considering systems we are
    dealing with.
    
    As a side note, we can reduce the "wasted space / member / instance" from
    3 bytes to 1 byte, by using u16 instead of the unsigned int if needed. I
    rather use unsigned int to be initially prepared for devices with 32 bit
    registers if there is no need to count bytes.
    
    Signed-off-by: Matti Vaittinen 
    Reviewed-by: Sebastian Reichel 
    Link: https://patch.msgid.link/57c87f7e2082a666f0adeafcd11f673c0af7d326.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit 560db12560d4d0fb24ee0c32dc32975e18a88ed4
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:18 2026 +0100

    x86/paravirt: Allow pv-calls outside paravirt.h
    
    In order to prepare for defining paravirt functions outside of paravirt.h,
    don't #undef the paravirt call macros.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260105110520.21356-20-jgross@suse.com

commit 0234e0033e62c1043b602e699580c843c4457486
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:20:50 2025 +0200

    rtc: bd70528: Support BD72720 rtc
    
    The BD72720 has similar RTC block as a few other ROHM PMICs.
    
    Add support for BD72720 RTC.
    
    Signed-off-by: Matti Vaittinen 
    Acked-by: Alexandre Belloni 
    Link: https://patch.msgid.link/3241773f0f8e8d8e591a8e948495686cfdee4875.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit da4950b5911197813e62b2347caf3bd525cb35a2
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:20:37 2025 +0200

    clk: clk-bd718x7: Support BD72720 clk gate
    
    The BD72720 has similar simple clk gate as a few other ROHM PMICs.
    
    Add support for BD72720 clk gate.
    
    Signed-off-by: Matti Vaittinen 
    Acked-by: Stephen Boyd 
    Link: https://patch.msgid.link/742e76cd0b87e726818d4fddc534a29298697b6b.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit 6b367741e01430947f66ad863bfc1e57ad42b7bc
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:20:24 2025 +0200

    gpio: Support ROHM BD72720 gpios
    
    The ROHM BD72720 has 6 pins which may be configured as GPIOs. The
    GPIO1 ... GPIO5 and EPDEN pins. The configuration is done to OTP at the
    manufacturing, and it can't be read at runtime. The device-tree is
    required to tell the software which of the pins are used as GPIOs.
    
    Keep the pin mapping static regardless the OTP. This way the user-space
    can always access the BASE+N for GPIO(N+1) (N = 0 to 4), and BASE + 5
    for the EPDEN pin. Do this by setting always the number of GPIOs to 6,
    and by using the valid-mask to invalidate the pins which aren't configured
    as GPIOs.
    
    First two pins can be set to be either input or output by OTP. Direction
    can't be changed by software. Rest of the pins can be set as outputs
    only. All of the pins support generating interrupts.
    
    Support the Input/Output state getting/setting and the output mode
    configuration (open-drain/push-pull).
    
    Signed-off-by: Matti Vaittinen 
    Reviewed-by: Linus Walleij 
    Acked-by: Bartosz Golaszewski 
    Link: https://patch.msgid.link/22e095ca92f0677ca3d3a768ad749629fc3c2006.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit f16a9d76a71df5038fc8e6dae44caa1e5e76b041
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:20:06 2025 +0200

    regulator: bd71828: Support ROHM BD72720
    
    ROHM BD72720 is a power management IC which integrates 10 buck and 11 LDO
    regulators. This PMIC has plenty of commonalities with the BD71828 and
    BD71879.
    
    The BD72720 does also have similar 'run-level'-concept as the BD71828 had.
    It allows controlling the regulator's 'en masse', although only BUCK1
    and LDO1 can utilize this in BD72720. Similar to BD71828, this 'en
    masse' -control is not supported by this driver.
    
    Support the voltage and enable/disable state control for the BD72720.
    
    Signed-off-by: Matti Vaittinen 
    Reviewed-by: Mark Brown 
    Link: https://patch.msgid.link/88b82128648516d9dbb173044042f2a7a5dfdf1c.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit 8dc33b7c995e3e08087053b79cf919fba61e3669
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:19:53 2025 +0200

    regulator: bd71828: rename IC specific entities
    
    The new ROHM BD72720 PMIC has similarities with the BD71828. It makes
    sense to support the regulator control for both PMICs using the same
    driver. It is often more clear to have the IC specific functions and
    globals named starting with the chip-name. So, as a preparatory step,
    prefix the BD71828 specific functions and globals with the bd71828.
    
    It would be tempting to try also removing the chip ID from those
    functions which will be common for both PMICs. I have bad experiences on
    this as it tends to lead to problems when yet another IC is being
    supported with the same driver, and we will have some functions used for
    all, some for two of the three, and some for just one. At this point
    I used to start inventing wildcards like BD718XX or BD7272X. This
    approach is pretty much always failing as we tend to eventually have
    something like BD73900 - where all the wildcard stuff will break down.
    
    So, my approach these days is to:
     - keep the original chip-id prefix for anything that had it already
       (and avoid the churn).
     - use same prefix for all things that are used by multiple ICs -
       typically the chip-ID of the first chip. This typically matches also
       the driver and file names.
     - use specific chip-ID as a prefix for anything which is specific to
       just one chip.
    
    As a preparatory step to adding the BD72720, add bd71828 prefix to all
    commonly usable functions and globals.
    
    Signed-off-by: Matti Vaittinen 
    Acked-by: Mark Brown 
    Link: https://patch.msgid.link/df5c98c6392c3b52cd41e3d98d60b65a1585b2dd.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit af25277b1ddc6c65879247387d127c38c51ba9f0
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:19:35 2025 +0200

    mfd: rohm-bd71828: Support ROHM BD72720
    
    The ROHM BD72720 is a power management IC which continues the BD71828
    family of PMICs. Similarly to the BD71815 and BD71828, the BD72720
    integrates regulators, charger, RTC, clock gate and GPIOs.
    
    The main difference to the earlier PMICs is that the BD72720 has two
    different I2C slave addresses. In addition to the registers behind the
    'main I2C address', most of the charger (and to some extent LED) control
    is done via registers behind a 'secondary I2C slave address', 0x4c.
    
    Signed-off-by: Matti Vaittinen 
    Link: https://patch.msgid.link/c7b3f1b25616a0add21cea38019e50a89873b6ac.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit ea6806346080098b68674b933e76a76f0a49a79f
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:19:20 2025 +0200

    mfd: rohm-bd71828: Use standard file header format
    
    The MFD subsystem uses C-style comments also in the 'file header'
    section. Switch to this for the sake of the consistency. The header
    content is not changed.
    
    Suggested-by: Lee Jones 
    Signed-off-by: Matti Vaittinen 
    Link: https://patch.msgid.link/3cc6176eee16a7edc75c94d967a1de67be400e97.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit 016e95b1473798f1e755a9e20f81391119ae7399
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:19:00 2025 +0200

    mfd: rohm-bd71828: Use regmap_reg_range()
    
    The regmap range tables tend to be somewhat verbose. Using the
    regmap_reg_range() can make the definitions slightly mode compact.
    
    Tidy the regmap range tables by using the regmap_reg_range().
    
    Signed-off-by: Matti Vaittinen 
    Link: https://patch.msgid.link/49607e65ca117b096a50c5784b760bf62553e29a.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit 9144a761bf167d6e0ed827e5816e2ba68b2fc2f0
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:18:42 2025 +0200

    dt-bindings: leds: bd72720: Add BD72720
    
    Add the ROHM BD72720 documentation to the binding documents.
    
    Signed-off-by: Matti Vaittinen 
    Acked-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/b9854f77ee1dca8c99a9a9a198b79fbc76f8da67.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit e816df1d3714d20c21a4fcdf3a5193ba12394642
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:18:27 2025 +0200

    dt-bindings: mfd: ROHM BD72720
    
    The ROHM BD72720 is a power management IC integrating regulators, GPIOs,
    charger, LEDs, RTC and a clock gate.
    
    Add dt-binding doc for ROHM BD72720.
    
    Signed-off-by: Matti Vaittinen 
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Linus Walleij 
    Link: https://patch.msgid.link/44cd4fcb2834ed613dd2d958cf4a4a34b3a316ab.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit 16056396b7709b0ee33d88329e9a41166bc8d6a0
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:18:11 2025 +0200

    dt-bindings: battery: Voltage drop properties
    
    ROHM has developed a so called "zero-correction" -algorithm to improve
    the fuel-gauging accuracy close to the point where battery is depleted.
    This relies on battery specific "VDR" (voltage drop rate) tables, which
    are measured from the battery, and which describe the voltage drop rate.
    More thorough explanation about the "zero correction" and "VDR"
    parameters is here:
    https://lore.kernel.org/all/676253b9-ff69-7891-1f26-a8b5bb5a421b@fi.rohmeurope.com/
    
    Document the VDR zero-correction specific battery properties used by the
    BD71815, BD71828, BD72720 and some other ROHM chargers. (Note, charger
    drivers aren't upstream yet).
    
    Signed-off-by: Matti Vaittinen 
    Reviewed-by: Rob Herring (Arm) 
    Reviewed-by: Linus Walleij 
    Link: https://patch.msgid.link/461f2840a03e0189ecd4f1a7c261014342ddee91.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit a43309745a5ff3682f6a3d02459729824b5221e1
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:17:53 2025 +0200

    dt-bindings: battery: Add trickle-charge upper limit
    
    Some of the chargers for lithium-ion batteries use a trickle-charging as
    a first charging phase for very empty batteries, to "wake-up" the battery.
    Trickle-charging is a low current, constant current phase. After the
    voltage of the very empty battery has reached an upper limit for
    trickle charging, the pre-charge phase is started with a higher current.
    
    Allow defining the upper limit for trickle charging voltage, after which
    the charging should be changed to the pre-charging.
    
    Signed-off-by: Matti Vaittinen 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/9c3064ec7e32cda442336bf633fb93355ce6a97d.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit dc74d1107f1506176c1f4f32dbef0417f3e678e1
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:17:38 2025 +0200

    dt-bindings: battery: Clarify trickle-charge
    
    The term 'trickle-charging' is used to describe a very slow charging
    phase, where electrons "trickle-in" the battery.
    
    There are two different use-cases for this type of charging. At least
    some Li-Ion batteries can benefit from very slow, constant current,
    pre-pre phase 'trickle-charging', if a battery is very empty.
    
    Some other batteries use top-off phase 'trickle-charging', which is
    different from the above case.
    
    The battery bindings use the term 'trickle-charge' without specifying
    which of the use-cases properties are addressing. This has already
    caused some confusion.
    
    Clarify that the 'trickle-charge-current-microamp' refers to the first
    one, the "pre-pre" -charging use-case.
    
    Suggested-by: Krzysztof Kozlowski 
    Signed-off-by: Matti Vaittinen 
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Linus Walleij 
    Link: https://patch.msgid.link/e2794140343103245410c3301f8994e1babaeb96.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit 4d08b3634fe824409e75696635fb27204b8d4720
Author: Matti Vaittinen 
Date:   Mon Dec 15 15:17:17 2025 +0200

    dt-bindings: regulator: ROHM BD72720
    
    The ROHM BD72720 is a new PMIC with 10 BUCk and 11 LDO regulators.
    
    The BD72720 is designed to support using the BUCK10 as a supply for
    the LDOs 1 to 4. When the BUCK10 is used for this, it can be set to a
    LDON_HEAD mode. In this mode, the BUCK10 voltage can't be controlled by
    software, but the voltage is adjusted by PMIC to match the LDO1 .. LDO4
    voltages with a given offset. Offset can be 50mV .. 300mV and is
    changeable at 50mV steps.
    
    Add 'ldon-head-microvolt' property to denote a board which is designed
    to utilize the LDON_HEAD mode.
    
    All other properties are already existing.
    
    Add dt-binding doc for ROHM BD72720 regulators to make it usable.
    
    Signed-off-by: Matti Vaittinen 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/81cb38d0ae1b3fa426e40d5b0a93f69a0f374657.1765804226.git.mazziesaccount@gmail.com
    Signed-off-by: Lee Jones 

commit f88dc319fcb6d6a155e94469a355ce456dd85441
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:17 2026 +0100

    objtool: Allow multiple pv_ops arrays
    
    Having a single large pv_ops array has the main disadvantage of needing all
    prototypes of the single array members in one header file. This is adding up
    to the need to include lots of otherwise unrelated headers.
    
    In order to allow multiple smaller pv_ops arrays dedicated to one area of the
    kernel each, allow multiple arrays in objtool.
    
    For better performance limit the possible names of the arrays to start with
    "pv_ops".
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260105110520.21356-19-jgross@suse.com

commit 72919c57a055f6d7b79d66731dc398e9b433f47c
Author: Bharat Dev Burman 
Date:   Tue Jan 13 00:12:40 2026 +0530

    ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
    
    HP Victus 16-e0xxx with ALC245 codec does not handle the toggling of
    the mute LED.
    This patch adds a quirk entry for subsystem ID 0x88eb using a new
    ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT fixup, enabling correct mute LED
    behavior.
    
    Signed-off-by: Bharat Dev Burman 
    Link: https://patch.msgid.link/20260112184253.33376-1-bharat.singh7924@gmail.com
    Signed-off-by: Takashi Iwai 

commit 0924c6bb67b67384c53c63df4a3f4a86cd2c2624
Author: Simon Trimmer 
Date:   Mon Jan 12 14:28:50 2026 +0000

    ALSA: hda/cs8409: Add quirk for CDB35L56-FOUR-HD
    
    Adds quirkiness for the Cirrus Logic CDB35L56-FOUR-HD board.
    The quirk must be forced by model name "CDB35L56-FOUR-HD"
    because there isn't a unique SSID that can be used. For example
    in /etc/modprobe.d:
    
    options snd-hda-intel model="CDB35L56-FOUR-HD"
    
    The CDB35L56-FOUR-HD is not a complete PC. It is an add-on audio
    board that requires a host system and replaces the normal HDA codec
    on the host. Because of this there isn't an SSID that uniquely
    identifies this configuration. Also, the usual host board is an
    Aaeon UpXtreme, which doesn't have a unique SSID.
    
    Because of this, the quirk must be forced by a module param.
    This is acceptable because it is a development board, not an
    end-user system, so there is no need for it to be detected
    automatically.
    
    Signed-off-by: Simon Trimmer 
    Co-developed-by: Richard Fitzgerald 
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20260112142850.243054-1-rf@opensource.cirrus.com
    Signed-off-by: Takashi Iwai 

commit 8978da8e51ed648a5ad5da3d4c0fffde46757cf2
Merge: 9dc2e2b63e5aee 6be9ea62afedef
Author: Mark Brown 
Date:   Tue Jan 13 12:18:52 2026 +0000

    ASoC: Update rtq9128 document and source file
    
    Merge series from cy_huang@richtek.com:
    
    This patch series include two parts
    - Update initial setting for rtq9128 specific feature
    - Add rtq9154 backward compatible with rtq9128

commit f1fcc2689fd8dcb6a23fdf7a4c4c9cfda10329ef
Merge: 09dc08b396c954 b0fc1e7701940d
Author: Mark Brown 
Date:   Tue Jan 13 12:07:09 2026 +0000

    regulator: Add TPS65185
    
    Merge series from Andreas Kemnade :
    
    Add a driver for the TPS65185 regulator which provides the
    comparatively high voltages needed for electronic paper displays.
    
    Datasheet for the TPS65185 is at https://www.ti.com/lit/gpn/tps65185
    
    To simplify things, include the hwmon part directly which is only
    one temperature sensor and there are no other functions besides regulators
    in this chip.

commit 9dc2e2b63e5aeebbf0467aa8914f120bb6dbe7b2
Merge: eb4cd1a4a9ef11 b9198ce5c6dfee
Author: Mark Brown 
Date:   Tue Jan 13 11:55:44 2026 +0000

    Add devicetree support for aw88261 amplifier driver &
    
    Merge series from Luca Weiss :
    
    A series with a small cleanup and then a patch adding devicetree support
    for the aw88261 driver.

commit eb4cd1a4a9ef115193a9bef447b5db11bb7defc9
Merge: 28e5a3de9858a4 e590752119029d
Author: Mark Brown 
Date:   Tue Jan 13 11:55:40 2026 +0000

    sound: codecs: wm8962: Assorted fixes
    
    Merge series from Sebastian Krzyszkowiak :
    
    Bunch of patches developed while working on Purism's Librem 5 phone.

commit 28e5a3de9858a4189e48b2cbdf3d06e6fd806a3d
Merge: dd808d6b1565a0 83aee46dc2142e
Author: Mark Brown 
Date:   Tue Jan 13 11:55:35 2026 +0000

    ASoC: SOF: Use guard()/scoped_guard() for locks when
    
    Merge series from Peter Ujfalusi :
    
    Only code refactoring, and no behavior change.
    
    Replace most of the manual *lock/*unlock handling with guard use.

commit dd808d6b1565a0a345178af7db5f35b26bbb125a
Merge: e7c30ac379b429 fc6ceb7e4ea746
Author: Mark Brown 
Date:   Tue Jan 13 11:55:31 2026 +0000

    ASoC: SOF: ipc4: Send heap/stack bytes via new
    
    Merge series from Peter Ujfalusi :
    
    Add new module init payload (this has already been partly specified in
    SOF FW src/include/ipc4/module.h) and use that to pass new topology widget
    properties to FW.
    
    The original ext_init payload extension for this is already already
    supported by the firmware.

commit dc6c52205bdaddf1dc259497a958402b35c01fe2
Author: Sakari Ailus 
Date:   Thu Dec 11 14:20:22 2025 +0200

    media: ipu6: Always call video_device_pipeline_alloc_start()
    
    Even if a video device is part of a pipeline already,
    video_device_pipeline_alloc_start() handles that case gracefully. Don't
    explicitly differentiate between video_device_pipeline_start() and
    video_device_pipeline_alloc_start() based on the existence of a pipeline.
    
    Signed-off-by: Sakari Ailus 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit 58410f62e25d5981fcca7e2e768e4e182ce2200e
Author: Sakari Ailus 
Date:   Mon Nov 10 13:26:57 2025 +0200

    media: ipu6: Drop custom functions to obtain sd state information
    
    Drop the custom functions that are used to obtain information from the
    sub-device state.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit e660207a1d080c019959a0d98638b1efa7bfb700
Author: Sakari Ailus 
Date:   Fri Nov 7 10:03:15 2025 +0200

    media: ipu6: Remove source_entity from struct ipu6_isys_stream
    
    Remove source_entity from struct ipu6_isys_stream and instead pass it on
    in function arguments.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit 7c305850912ea153808b95475ce5acd0f934891d
Author: Sakari Ailus 
Date:   Thu Nov 6 11:56:40 2025 +0200

    media: ipu6: Obtain unique source pad from remote sub-device
    
    Obtain unique source pad from a remote sub-device, instead of the first
    one. This means that only one link may be active at stream start. There's
    no functional change in practice, unless multiple CSI-2 transmitters are
    directly connected to the receiver.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit b613b2fedb299b54492921f6a81835aae9b11f36
Author: Sakari Ailus 
Date:   Tue Nov 25 15:27:54 2025 +0200

    media: ipu6: Obtain remote pad using media_pad_remote_pad_unique()
    
    There's no reason to use media_entity_remote_source_pad_unique() as we
    know our pads. Use media_pad_remote_pad_unique() instead.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit 6d9f46bc3038041ccc58fe4d4955da0347a7b56d
Author: Sakari Ailus 
Date:   Tue Nov 4 11:53:55 2025 +0200

    media: ipu6: Drop error argument from ipu6_isys_stream_start()
    
    error argument for ipu6_isys_stream_start() is always false, remove the
    argument. The IPU6_ISYS_BUFFER_LIST_FL_SET_STATE buffer flag also becomes
    redundant as a result, remove it as well.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit 2b08b7007e55bd1793a58478d3ecea4fd95849a5
Author: Sakari Ailus 
Date:   Wed Jan 7 23:55:31 2026 +0200

    media: ipu6: Always close firmware stream
    
    Close the firmware stream even when disabling a stream on an upstream
    sub-device fails. This allows the firmware to release resources related to
    a stream that is stopped in any case.
    
    Suggested-by: Bingbu Cao 
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit 5925a92cc70d10c7d3124923c36da09b9c1a6eeb
Author: Sakari Ailus 
Date:   Thu Dec 18 00:05:38 2025 +0200

    media: ipu6: Close firmware streams on streaming enable failure
    
    When enabling streaming fails, the stream is stopped in firmware but not
    closed. Do this to release resources on firmware side.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit 04d59cc06af6eb297d2d4c85354da2d562ce83f9
Author: Sakari Ailus 
Date:   Fri Nov 7 12:46:51 2025 +0200

    media: ipu6: Don't check pipeline in stream_start
    
    A pipeline exists when start_streaming has returned so the check for
    start_streaming_called is equivalent to having media_pipeline. Use
    vb2_start_streaming_called() to perform the check.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit b0087483682fb97ea57086875ff860d618a7182d
Author: Sakari Ailus 
Date:   Thu Oct 30 12:01:48 2025 +0200

    media: ipu6: Remove redundant streaming start via buffer queueing
    
    The videobuf2 framework will ensure buffers are queued before streaming is
    started. Remove support for starting streaming via the buf_queue()
    callback.
    
    Signed-off-by: Sakari Ailus 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit e5af254e446a9d33c4f256105580e4c1ad822fc0
Author: Sakari Ailus 
Date:   Wed Dec 3 10:27:28 2025 +0200

    media: ipu6: Make symbols static
    
    Make isys_setup_hw and isys_isr static as they're only used in a single
    file.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit 312c74e6d360eaa871b66b417868c63728e5170b
Author: Sakari Ailus 
Date:   Fri Dec 19 00:52:43 2025 +0200

    media: ipu6: Remove redundant driver data checks
    
    Both runtime PM resume and suspend callbacks check whether the driver's
    data is set for the device. This is done in probe(); drop the redundant
    checks.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit 5b18b3816f7f0573c8f764f88d403250dd528ca5
Author: Sakari Ailus 
Date:   Fri Dec 19 00:54:35 2025 +0200

    media: ipu6: Drop MMU hardware initialisation in probe()
    
    The MMU hardware is initialised and cleaned up in the runtime PM resume
    callbacks. Do not do this in probe().
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Bingbu Cao 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Hans Verkuil 

commit 779bdaad2abf718fb8116839e818e58852874b4d
Author: Sakari Ailus 
Date:   Thu Nov 27 14:14:22 2025 +0200

    media: ipu6: Ensure stream_mutex is acquired when dealing with node list
    
    The ipu6 isys driver maintains the list of video buffer queues related to
    a stream (in ipu6 context streams on the same CSI-2 virtual channel) and
    this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs.
    Ensure the common mutex is acquired when accessing the linked list, i.e.
    the isys device context's stream_mutex.
    
    Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard()
    while at it as the error handling becomes more simple this way.
    
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 98cc19a353abc8b48b7d58fd7a455e09e7c3aba3
Author: Bingbu Cao 
Date:   Tue Dec 23 15:23:03 2025 +0800

    media: staging/ipu7: Fix the loop bound in l2 table alloc
    
    This patch fixes the incorrect loop bound in alloc_l2_pt(). When
    initializing L2 page table entries, the loop was incorrectly using
    ISP_L1PT_PTES instead of ISP_L2PT_PTES though the ISP_L1PT_PTES is
    equal to ISP_L2PT_PTES.
    
    Fixes: 71d81c25683a ("media: staging/ipu7: add IPU7 DMA APIs and MMU mapping")
    Cc: stable@vger.kernel.org
    Signed-off-by: Bingbu Cao 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit f7923e6bafcad686adb51cc100ba1860f8b43922
Author: Bingbu Cao 
Date:   Tue Dec 23 15:23:02 2025 +0800

    media: staging/ipu7: Update CDPHY register settings
    
    Some CPHY settings needs to updated according to the latest guide from
    SNPS. This patch program 45ohm for tuning resistance to fix CPHY problem
    and update the ITMINRX and GMODE for CPHY.
    
    Cc: Stable@vger.kernel.org
    Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver")
    Signed-off-by: Bingbu Cao 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 1433e6ccc25e9ea596683ab66e1c51f37fc7d491
Author: Bingbu Cao 
Date:   Tue Dec 23 15:23:01 2025 +0800

    media: staging/ipu7: Call synchronous RPM suspend in probe failure
    
    If firmware authentication failed during driver probe, driver call an
    asynchronous API to suspend the psys device but the bus device will be
    removed soon, thus runtime PM of bus device will be disabled soon, that
    will cancel the suspend request, so use synchronous suspend to make
    sure the runtime suspend before disabling its RPM.
    
    IPU7 hardware has constraints that the PSYS device must be powered off
    before ISYS, otherwise it will cause machine check error.
    
    Cc: Stable@vger.kernel.org
    Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
    Signed-off-by: Bingbu Cao 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 9ad65684b9285c5d66fb417d50e91a25ef8c994d
Author: Bingbu Cao 
Date:   Tue Dec 23 15:23:00 2025 +0800

    media: staging/ipu7: Ignore interrupts when device is suspended
    
    IPU7 devices have shared interrupts with others. In some case when IPU7
    device is suspended, driver get unexpected interrupt and invalid irq
    status 0xffffffff from ISR_STATUS and PB LOCAL_STATUS registers as
    interrupt is triggered from other device on shared irq line.
    
    In order to avoid this issue use pm_runtime_get_if_active() to check if
    IPU7 device is resumed, ignore the invalid irq status and use
    synchronize_irq() in suspend.
    
    Cc: Stable@vger.kernel.org
    Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
    Signed-off-by: Bingbu Cao 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 6099f78e4c9223f4de4169d2fd1cded01279da1a
Author: Bingbu Cao 
Date:   Tue Dec 23 15:22:59 2025 +0800

    media: ipu6: Fix RPM reference leak in probe error paths
    
    Several error paths in ipu6_pci_probe() were jumping directly to
    out_ipu6_bus_del_devices without releasing the runtime PM reference.
    Add pm_runtime_put_sync() before cleaning up other resources.
    
    Cc: Stable@vger.kernel.org
    Fixes: 25fedc021985 ("media: intel/ipu6: add Intel IPU6 PCI device driver")
    Signed-off-by: Bingbu Cao 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 3e0fcc91277d5af114a58aaa68f34b44e8d8a411
Author: Bingbu Cao 
Date:   Tue Dec 23 15:22:58 2025 +0800

    media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
    
    Fix two coding errors in ipu6-mmu.c:
    
    1. Fix syntax error in page_table_dump() where the closing parenthesis
       and semicolon were swapped in the TBL_PHYS_ADDR macro call.
    
    2. Fix incorrect loop bound in alloc_l2_pt(). When initializing L2 page
       table entries, the loop was incorrectly using ISP_L1PT_PTES instead
       of ISP_L2PT_PTES.
    
    Fixes: 9163d83573e4 ("media: intel/ipu6: add IPU6 DMA mapping API and MMU table")
    Cc: stable@vger.kernel.org
    Signed-off-by: Bingbu Cao 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 401aec35ac7bd04b4018a519257b945abb88e26c
Author: Ricardo Ribalda 
Date:   Wed Dec 10 07:53:43 2025 +0000

    media: dw9714: Fix powerup sequence
    
    We have experienced seen multiple I2C errors while doing stress test on
    the module:
    
    dw9714 i2c-PRP0001:01: dw9714_vcm_resume I2C failure: -5
    dw9714 i2c-PRP0001:01: I2C write fail
    
    Inspecting the powerup sequence we found that it does not match the
    documentation at:
    https://blog.arducam.com/downloads/DW9714A-DONGWOON(Autofocus_motor_manual).pdf
    
    """
    (2) DW9714A requires waiting time of 12ms after power on. During this
    waiting time, the offset calibration of internal amplifier is
    operating for minimization of output offset current .
    """
    
    This patch increases the powerup delay to follow the documentation.
    
    Fixes: 9d00ccabfbb5 ("media: i2c: dw9714: Fix occasional probe errors")
    Signed-off-by: Ricardo Ribalda 
    Reviewed-by: Hans de Goede 
    Tested-by: Neil Sun 
    Reported-by: Naomi Huang 
    Cc: stable@vger.kernel.org
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 973e42fd5d2b397bff34f0c249014902dbf65912
Author: Xiaolei Wang 
Date:   Fri Dec 5 15:19:18 2025 +0800

    media: i2c: ov5647: use our own mutex for the ctrl lock
    
    __v4l2_ctrl_handler_setup() and __v4l2_ctrl_modify_range() contains an
    assertion to verify that the v4l2_ctrl_handler::lock is held, as it should
    only be called when the lock has already been acquired. Therefore use our
    own mutex for the ctrl lock, otherwise a warning will be reported.
    
    Fixes: 4974c2f19fd8 ("media: ov5647: Support gain, exposure and AWB controls")
    Cc: stable@vger.kernel.org
    Signed-off-by: Xiaolei Wang 
    [Sakari Ailus: Fix a minor conflict.]
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit ac9f4a5e49a0e276a951983cd2c9c050e2f63799
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:11 2025 +0100

    media: mt9m114: Add ACPI enumeration support
    
    Add support for the mt9m114 sensor being enumerated through ACPI
    using the INT33F0 HID as found on the Asus T100TA.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 437e1f6a960035166495a5117aacbc596115eeb6
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:10 2025 +0100

    media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
    
    With IPU# bridges, endpoints may only be created when the IPU bridge is
    initialized. This may happen after the sensor driver's first probe().
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 46c96eec9a763813e4592d72ecb38a6a33113258
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:09 2025 +0100

    media: mt9m114: Drop start-, stop-streaming sequence from initialize
    
    Drop the start-, stop-streaming sequence from initialize.
    
    When streaming is started with a runtime-suspended sensor,
    mt9m114_start_streaming() will runtime-resume the sensor which calls
    mt9m114_initialize() immediately followed by calling
    mt9m114_set_state(ENTER_CONFIG_CHANGE).
    
    This results in the following state changes in quick succession:
    
    mt9m114_set_state(ENTER_CONFIG_CHANGE) -> transitions to STREAMING
    mt9m114_set_state(ENTER_SUSPEND)       -> transitions to SUSPENDED
    mt9m114_set_state(ENTER_CONFIG_CHANGE) -> transitions to STREAMING
    
    these quick state changes confuses the CSI receiver on atomisp devices
    causing streaming to not work.
    
    Drop the state changes from mt9m114_initialize() and move
    the mt9m114_initialize() call to mt9m114_start_streaming()
    so that only a single mt9m114_set_state(ENTER_CONFIG_CHANGE) call
    is made when streaming is started with a runtime-suspend sensor.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit ceb485b3378bf59d3ed23726e9effff9c2d6792d
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:08 2025 +0100

    media: mt9m114: Don't allow changing the IFP crop/compose selections when bypassing the scaler
    
    The scaler is bypassed when the ISP source/output pad's pixel-format is
    set to MEDIA_BUS_FMT_SGRBG10_1X10. Don't allow changing the IFP crop and/or
    compose selections when in this mode.
    
    Instead of returning -EINVAL simply return the current (noop) crop and
    compose rectangles.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit df0090002c56b154ac543167fa92ba7b77f2b09f
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:07 2025 +0100

    media: mt9m114: Update source pad selection and format when sink pad format changes
    
    Call mt9m114_ifp_update_sel_and_src_fmt() on sink pad format changes to
    propagate these downstream.
    
    This is necessary in 2 different scenarios:
    
    1. When passing through RAW10 bypassing the scaler then any sink pad format
    changes must be propagated to the crop/compose selections and to the source
    pad format.
    
    2. When the scaler is active, then the crop-rectangle cannot be bigger then
    the sink pad format minus a 4 pixel border all around. If the sink format
    change reduces the size then things also needs to be propagated downstream.
    
    Rather then adding extra code to check for these conditions, simply always
    propagate sink pad format changes downstream.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 5e3c0bd3f864fec9f895bd42c172f56ac4cdeb63
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:06 2025 +0100

    media: mt9m114: Adjust IFP selections and source format when source format changes to/from RAW10
    
    Changing the IFP source pad format to RAW10 means disabling the scaler,
    which means that the crop and compose rectangles must be reset to
    match the sink format size with no border.
    
    And when changing the source pad format back from RAW10 to another format
    which require demosaicing the crop and compose rectangles must be reset
    to the sink format size minus a 4 pixels border all around it.
    
    Also when changing the source pad format back from RAW10 to another format
    the colorspace, ycbcr_enc and quantization need to be updated too.
    
    Add a new mt9m114_ifp_update_sel_and_src_fmt() helper which resets all
    these taking the bordersize for the new source format into account and
    call this helper whenever the source pad format changes to/from RAW10.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 633deb131082f41a3467f8a77abb9c95fb390008
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:05 2025 +0100

    media: mt9m114: Add and use mt9m114_ifp_get_border() helper function
    
    Normally the IFP removes a 4 pixel border all around its sink format
    size for demosaicing. But in RAW10 mode it does not do this.
    
    Add a new mt9m114_ifp_get_border() helper function to get the border size
    (4 or 0) and use this where applicable instead of hardcoding a border
    of 4 pixels everywhere.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit d6b6a23bb487958e7e1540c0cb6aaccf82f136c9
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:04 2025 +0100

    media: mt9m114: Put sensor in reset on power down
    
    Put the sensor back in reset on power down. Putting the sensor in reset
    reduces power-consumption by putting all the data / ctrl pins in High-Z
    mode. This helps save power on designs where the regulators may need to
    stay on while the sensor is powered down.
    
    This also ensures that the sensor is properly reset on power up,
    since now the sensor will see a reset high to low transition after
    the regulators have been turned on.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 84359d0a5e3afce5e3e3b6562efadff690614d5b
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:03 2025 +0100

    media: mt9m114: Avoid a reset low spike during probe()
    
    mt9m114_probe() requests the reset GPIO in output low state:
    
            sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
    
    and then almost immediately afterwards calls mt9m114_power_on() which does:
    
                    gpiod_set_value(sensor->reset, 1);
                    fsleep(duration);
                    gpiod_set_value(sensor->reset, 0);
    
    which means that if the reset pin was high before this code runs that
    it will very briefly be driven low because of passing GPIOD_OUT_LOW when
    requesting the GPIO only to be driven high again possibly directly after
    that. Such a very brief driving low of the reset pin may put the chip in
    a confused state.
    
    Request the GPIO in high (reset the chip) state instead to avoid this,
    turning the initial gpiod_set_value() in mt9m114_power_on() into a no-op.
    and the fsleep() ensures that it will stay high long enough to properly
    reset the chip.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 432d109333afd674a416a061b98264bfcd5f0515
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:02 2025 +0100

    media: mt9m114: Tweak default hblank and vblank for more accurate fps
    
    The PLL gets programmed to achieve a 48 MHz pixelclock, with the current
    vblank + hblank defaults this results in a fps of:
    
    48000000 / ((1296 + 307) * (976 + 23) = 29.974 fps
    
    Tweak the defaults to get closer to 30 fps:
    
    48000000 / ((1296 + 308) * (976 + 21) = 30.015 fps
    
    This improves things from being 0.026 fps too low to 0.015 fps too high.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 0fa4baded5ef5ff51d96bee4fe233ad6aa35a833
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:01 2025 +0100

    media: mt9m114: Fix default hblank and vblank values
    
    The current default hblank and vblank values are based on reaching 30 fps
    with the pixel-array outputting 1280x960, but the default format for
    the pixel-array source pad and the isp sink pad is 1296x976, correct
    the default hblank and vblank values to take this into account.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 71087c9b814994541154d667d88aac9682be63db
Author: Hans de Goede 
Date:   Tue Dec 30 18:03:00 2025 +0100

    media: mt9m114: Lower minimum vblank value
    
    As the comment above the defines says, the minimum values are undocumented
    so the lowest values seen in register lists are used.
    
    The version of the mt9m114 driver shipped together with the atomisp code
    uses 21 for vblank in its register lists, lower MT9M114_MIN_VBLANK
    accordingly.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 1df58b9ddaac468154083af6e1d7ddaf8769e964
Author: Hans de Goede 
Date:   Tue Dec 30 18:02:59 2025 +0100

    media: mt9m114: Use aptina-PLL helper to get PLL values
    
    Before this change the driver used hardcoded PLL m, n and p values to
    achieve a 48MHz pixclock when used with an external clock with a frequency
    of 24 MHz.
    
    Use aptina_pll_calculate() to allow the driver to work with different
    external clock frequencies. The m, n, and p values will be unchanged
    with a 24 MHz extclk and this has also been tested with a 19.2 MHz
    clock where m gets increased from 32 to 40.
    
    Suggested-by: Laurent Pinchart 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    [Sakari Ailus: Fix capitalisation of "MHz".]
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit d57348c1bb8df069f992b3478fea642045712212
Author: Hans de Goede 
Date:   Tue Dec 30 18:02:58 2025 +0100

    media: aptina-pll: Debug log p1 min and max values
    
    Make aptina_pll_calculate() debug log the calculated p1 min and max values,
    this makes it easier to see how the m, n and p1 values were chosen.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 1a84924258b9554ad5b857d2729bb2f553b8fed1
Author: Elgin Perumbilly 
Date:   Mon Jan 5 17:04:30 2026 +0530

    media: i2c: ov2735: request reset GPIO as initially asserted
    
    The reset GPIO must be requested in the asserted (HIGH) state to keep
    the sensor in standby during probe and power sequencing.
    
    Signed-off-by: Elgin Perumbilly 
    Acked-by: Tarang Raval 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 290fb5a1b4209d3bf1ee95f3990dda08a9850177
Author: Sakari Ailus 
Date:   Mon Sep 5 14:20:05 2016 +0300

    media: ccs: Support frame descriptors
    
    Provide information on the frame layout using frame descriptors.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Julien Massot 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 24b2208053d2262f554edc3fc721f1fdbac8ec7a
Author: Sakari Ailus 
Date:   Tue Oct 3 12:46:19 2023 +0300

    media: ccs: Track streaming state
    
    With enable_streams and disable_streams, the driver for a device where
    streams are not independently started and stopped needs to maintain state
    information on streams that have been requested to be started. Do that
    now.
    
    In the future, a helper function in the framework is a desirable way to do
    this instead.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Julien Massot 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 7d2909830e69257843d8def3ea9f839891c118e3
Author: Sakari Ailus 
Date:   Fri Sep 29 14:28:57 2023 +0300

    media: ccs: Use {enable,disable}_streams operations
    
    Switch from s_stream() video op to enable_streams() and disable_streams()
    pad operations. They are preferred and required for streams support.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 31e5191aa11931b53e1242acef4f4375f00ca523
Author: Sakari Ailus 
Date:   Tue Dec 30 19:22:02 2025 +0200

    media: ccs: Fix setting initial sub-device state
    
    Fix setting sub-device state for non-source sub-devices.
    
    Fixes: 5755be5f15d9 ("media: v4l2-subdev: Rename .init_cfg() operation to .init_state()")
    Cc: stable@vger.kernel.org # for v6.8 and later
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 89bb7d3c404d45a26889104c7787fd03d032a29f
Author: Vladimir Zapolskiy 
Date:   Mon Dec 22 05:09:47 2025 +0200

    media: i2c: og0ve1b: make configurable vblank control of the sensor
    
    Configurable vertical blanking size control allows users to set a wanted
    image frame rate.
    
    Reviewed-by: Tarang Raval 
    Signed-off-by: Vladimir Zapolskiy 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit d9d64cd17d0e4e1f40eb1a137429014a127a9953
Author: Vladimir Zapolskiy 
Date:   Mon Dec 22 05:09:46 2025 +0200

    media: i2c: ov6211: make configurable vblank control of the sensor
    
    Configurable vertical blanking size control allows users to set a wanted
    image frame rate.
    
    Reviewed-by: Tarang Raval 
    Signed-off-by: Vladimir Zapolskiy 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit c16b58a4557370efdcf99ab6f978cb676b391579
Author: Alex Tran 
Date:   Thu Dec 25 13:03:08 2025 -0800

    media: dt-bindings: ti,omap3isp: Convert to DT schema
    
    Convert binding for ti,omap3isp from TXT to YAML format.
    
    Signed-off-by: Alex Tran 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit d71bd243ef4849013a9ea6ba3a6359894435aacf
Author: Alex Tran 
Date:   Thu Dec 25 13:03:07 2025 -0800

    media: dt-bindings: i2c: toshiba,et8ek8: Convert to DT schema
    
    Convert binding for toshiba,et8ek8 from TXT to YAML format.
    Update MAINTAINERS file accordingly. The binding references
    video-interface-devices.yaml at top level to inherit flash-leds
    property.
    
    Signed-off-by: Alex Tran 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 4f84155e4a7e16ddfb3fb630d637a863829a0e80
Author: Arjun Changla 
Date:   Thu Dec 11 05:26:51 2025 +0000

    staging: media: atomisp: fix trailing statement
    
    Fix checkpatch error "trailing statements should be on next line"
    by moving the return statement to a new line.
    
    Signed-off-by: Arjun Changla 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit acc483fad79ecd1f5fb0adfd605f276383b678cd
Author: Zixuan Dong 
Date:   Mon Dec 15 13:53:32 2025 +0800

    media: staging: atomisp: remove redundant OOM error messages
    
    The memory allocation functions (kvzalloc) already emit a stack dump
    on failure when GFP_KERNEL is used. Printing an extra error message
    is redundant and increases code size.
    
    This resolves the checkpatch warnings:
    WARNING: Possible unnecessary 'out of memory' message
    
    Signed-off-by: Zixuan Dong 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit c6e115144b500039b9ece39c3aaf3e61e1f761af
Author: Dave Stevenson 
Date:   Mon Dec 22 13:45:41 2025 +0530

    media: i2c: ov5647: Add V4L2_CID_LINK_FREQUENCY control
    
    The link frequency can vary between modes, so add it as a control.
    
    Signed-off-by: Dave Stevenson 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit dda59680f24fdd490546830b0108dfb81cbc853b
Author: Jai Luthra 
Date:   Mon Dec 22 13:45:40 2025 +0530

    media: i2c: ov5647: Tidy up PIXEL_RATE control
    
    The pixel rate control is marked as read-only by the framework itself,
    so no need to mark it explicitly in the driver. Also, we can set the ops
    to NULL to avoid checking for it in the s_ctrl implementation.
    
    Suggested-by: Jacopo Mondi 
    Reviewed-by: Dave Stevenson 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 8bc977e2c51b3fcfaf787915620efc62b4166bbf
Author: Dave Stevenson 
Date:   Mon Dec 22 13:45:39 2025 +0530

    media: i2c: ov5647: Use the same PLL config for full, 1080p, and binned modes
    
    In order to simplify the driver slightly, use the same PLL
    configuration, and hence pixel rate and link frequency (to be
    added) for the full, 1080p, and binned modes.
    
    Signed-off-by: Dave Stevenson 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit d06a6dc90675aaec1f5749765bdc37b64fdd031c
Author: Dave Stevenson 
Date:   Mon Dec 22 13:45:38 2025 +0530

    media: i2c: ov5647: Separate out the common registers.
    
    There are many registers in common between all the modes.
    Pull those out into one common table.
    
    Signed-off-by: Dave Stevenson 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 46e972383a998c2645b528b04188ea2fcfbb8e22
Author: Dave Stevenson 
Date:   Mon Dec 22 13:45:37 2025 +0530

    media: i2c: ov5647: Tidy up mode registers to make the order common
    
    To make comparisons of the mode registers easier, put the registers
    for the binned and VGA modes in the same order as the others.
    
    Signed-off-by: Dave Stevenson 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 87b2b6cef20885f45bbbc9412e30ca3f79f8245b
Author: Dave Stevenson 
Date:   Mon Dec 22 13:45:36 2025 +0530

    media: i2c: ov5647: Add control of V4L2_CID_HBLANK
    
    The driver did expose V4L2_CID_HBLANK, but as a READ_ONLY control.
    
    The sensor only uses the HTS register to control the line length,
    so convert this control to read/write, with the appropriate ranges.
    Adopt the old fixed values as the minimum values permitted in each
    mode to avoid issues of it not streaming.
    
    This should allow exposure times up to ~3 seconds (up from ~1sec).
    
    Signed-off-by: Dave Stevenson 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit b9ca9ef3f0471d8c7a4ef978304ebbbc6489e2e1
Author: Dave Stevenson 
Date:   Mon Dec 22 13:45:35 2025 +0530

    media: i2c: ov5647: Use v4l2_async_register_subdev_sensor for lens binding
    
    v4l2_async_register_subdev doesn't bind in lens or flash drivers,
    but v4l2_async_register_subdev_sensor does.
    Switch to using v4l2_async_register_subdev_sensor.
    
    Signed-off-by: Dave Stevenson 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit ebde37e5ef1a0b34c170118eaa22ff86c3ed5b40
Author: David Plowman 
Date:   Mon Dec 22 13:45:34 2025 +0530

    media: i2c: ov5647: Support HFLIP and VFLIP
    
    Add missing controls for horizontal and vertical flipping.
    
    The sensor readout mirrors in the horizontal direction by default (if
    0x3821[1] = 0) which can make things unnecessarily difficult for
    applications. The register table prior to this commit was setting that
    bit explicitly, to achieve a normally oriented image.
    
    Now that we have userspace controls for HFLIP, we keep the convention
    and report the non-mirrored image (with 0x3821[1] = 1) as
    horizontal_flip=0, and vice versa.
    
    Signed-off-by: David Plowman 
    Reviewed-by: Jacopo Mondi 
    Co-developed-by: Jai Luthra 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 4885fb98350f76dd05c0f352925a53e2c20d390a
Author: Laurent Pinchart 
Date:   Mon Dec 22 13:45:33 2025 +0530

    media: i2c: ov5647: Parse and register properties
    
    Parse device properties and register controls for them using the V4L2
    fwnode properties helpers.
    
    Signed-off-by: Laurent Pinchart 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 03f2af9ef431fff89ef2239bdd9ac30112a0fe9c
Author: Jai Luthra 
Date:   Mon Dec 22 13:45:32 2025 +0530

    dt-bindings: media: ov5647: Allow props from video-interface-devices
    
    Allow properties from video-interface-devices. The change is identical to
    commit 08fbd355be3d ("media: dt-bindings: sony,imx219: Allow props from
    video-interface-devices")
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit e7696f27f8df96ef6b4f72d288c0b2d63aef23c3
Author: Dave Stevenson 
Date:   Mon Dec 22 13:45:31 2025 +0530

    media: i2c: ov5647: Add support for regulator control
    
    The driver supported using GPIOs to control the shutdown line,
    but no regulator control.
    
    Add regulator hooks.
    
    Signed-off-by: Dave Stevenson 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit d240430664adc0925042bd671a98668c5d399fe7
Author: Jai Luthra 
Date:   Mon Dec 22 13:45:30 2025 +0530

    dt-bindings: media: ov5647: Add optional regulators
    
    The OV5647 camera sensor takes 3 voltage supplies. So define those in
    the bindings as optional regulators, to not break existing users.
    
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit c063632b494b02e891442d10f17e37b7fcfab9b3
Author: Jai Luthra 
Date:   Mon Dec 22 13:45:29 2025 +0530

    media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
    
    The pixel rate for VGA (640x480) mode is configured in the mode's table
    to be 58.333 MPix/s instead of 55 MPix/s, so fix it.
    
    Fixes: 911f4516ee2b ("media: ov5647: Support V4L2_CID_PIXEL_RATE")
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/all/CAPY8ntA2TCf9FuB6Nk%2BOn%2By6N_PMuYPAOAr3Yx8YESwe4skWvw@mail.gmail.com/
    Suggested-by: Dave Stevenson 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit f007586b1e89dcea40168415d0422cb7a0fc31b1
Author: David Plowman 
Date:   Mon Dec 22 13:45:28 2025 +0530

    media: i2c: ov5647: Sensor should report RAW color space
    
    As this sensor captures RAW bayer frames, the colorspace should be
    V4L2_COLORSPACE_RAW instead of SRGB.
    
    Fixes: a8df5af695a1 ("media: ov5647: Add SGGBR10_1X10 modes")
    Cc: stable@vger.kernel.org
    Signed-off-by: David Plowman 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 1438248c5a82c86b4e1f0311c3bb827af747a8cf
Author: David Plowman 
Date:   Mon Dec 22 13:45:27 2025 +0530

    media: i2c: ov5647: Correct minimum VBLANK value
    
    Trial and error reveals that the minimum vblank value appears to be 24
    (the OV5647 data sheet does not give any clues). This fixes streaming
    lock-ups in full resolution mode.
    
    Fixes: 2512c06441e3 ("media: ov5647: Support V4L2_CID_VBLANK control")
    Cc: stable@vger.kernel.org
    Signed-off-by: David Plowman 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit a4e62e597f21bb37db0ad13aca486094e9188167
Author: David Plowman 
Date:   Mon Dec 22 13:45:26 2025 +0530

    media: i2c: ov5647: Correct pixel array offset
    
    The top offset in the pixel array is actually 6 (see page 3-1 of the
    OV5647 data sheet).
    
    Fixes: 14f70a3232aa ("media: ov5647: Add support for get_selection()")
    Cc: stable@vger.kernel.org
    Signed-off-by: David Plowman 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit eee13cbccacb6d0a3120c126b8544030905b069d
Author: Jai Luthra 
Date:   Mon Dec 22 13:45:25 2025 +0530

    media: i2c: ov5647: Initialize subdev before controls
    
    In ov5647_init_controls() we call v4l2_get_subdevdata, but it is
    initialized by v4l2_i2c_subdev_init() in the probe, which currently
    happens after init_controls(). This can result in a segfault if the
    error condition is hit, and we try to access i2c_client, so fix the
    order.
    
    Fixes: 4974c2f19fd8 ("media: ov5647: Support gain, exposure and AWB controls")
    Cc: stable@vger.kernel.org
    Suggested-by: Jacopo Mondi 
    Signed-off-by: Jai Luthra 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit ee71368a5666cedb0c603d9eea3a6f0c079f88cc
Author: Sakari Ailus 
Date:   Tue Sep 5 10:42:49 2023 +0300

    media: ccs: Move ccs_validate_csi_data_format up
    
    ccs_validate_csi_data_format() will soon be needed elsewhere, above its
    current location. Move it up.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Julien Massot 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 021baf99c259da2f0c705423dd5cb73082bbb052
Author: Sakari Ailus 
Date:   Tue Apr 16 11:12:52 2024 +0300

    media: ccs: Rename out label of ccs_start_streaming
    
    In preparation for upcoming changes in the function, rename the out label
    as err_pm_put. The purpose of the label is changed to match its name in
    the next patch.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit de927934dd900207f0881e496bdf1d26fd371463
Author: Sakari Ailus 
Date:   Tue Apr 16 11:09:57 2024 +0300

    media: ccs: Move ccs_pm_get_init function up
    
    Prepare for using ccs_pm_get_init from locations earlier than its the
    current place.
    
    Also add a missing newline while at it.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 02cab4a097b7b1094783a1634e2daaf0888d6e50
Author: Sakari Ailus 
Date:   Tue Oct 3 12:48:22 2023 +0300

    media: ccs: No need to set streaming to false in power off
    
    Streaming will have been stopped before the sensor is powered off, and so
    sensor->streaming is also false already. Do not set it as part of the
    runtime suspend callback.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Kieran Bingham 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 04ec8572f8689f577781ba0229b5bb1671c520e0
Author: Sakari Ailus 
Date:   Mon Aug 25 10:28:52 2025 +0300

    media: v4l2-subdev: Extend VIDIOC_SUBDEV_S_ROUTING error codes
    
    Return -ENXIO from routing configuration errors other than generic IOCTL
    argument validation.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Jacopo Mondi 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit e87ebb4e4f71a3a51af67509280a0ba0c89083c4
Author: Sakari Ailus 
Date:   Mon Aug 25 10:52:54 2025 +0300

    media: Documentation: Document -ENXIO for VIDIOC_SUBDEV_S_ROUTING
    
    Document that -ENXIO is returned when the user tries to set a routing
    configuration not supported by the hardware (or rather the driver). The
    documentation details the exact cases of this, besides -EINVAL that is
    already documented for VIDIOC_SUBDEV_S_ROUTING.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Laurent Pinchart 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Hans Verkuil 

commit 9369f001c8ab97e6ab5554d43c84dd75e713fd2c
Author: Sakari Ailus 
Date:   Tue Jul 15 16:24:45 2025 +0300

    media: Documentation: Fix routing documentation flag references
    
    The routing flag indicating an active route is called
    V4L2_SUBDEV_ROUTE_FL_ACTIVE, not V4L2_SUBDEV_STREAM_FL_ACTIVE. Fix this.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Jacopo Mondi 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit c228fb1fc2559c83528cb6eb19ef4ad600d83126
Author: Sakari Ailus 
Date:   Fri Sep 6 09:28:05 2024 +0300

    media: Documentation: Clean up figure titles
    
    Remove DocBook (?) conversion leftovers from figure titles, including
    obsolete numbering and highlighting. This aligns these titles with others.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Jacopo Mondi 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 7345d6d356336c448d6b9230ed8704f39679fd12
Author: Sakari Ailus 
Date:   Fri Nov 21 13:48:40 2025 +0200

    media: v4l2-async: Fix error handling on steps after finding a match
    
    Once an async connection is found to be matching with an fwnode, a
    sub-device may be registered (in case it wasn't already), its bound
    operation is called, ancillary links are created, the async connection
    is added to the sub-device's list of connections and removed from the
    global waiting connection list. Further on, the sub-device's possible own
    notifier is searched for possible additional matches.
    
    Fix these specific issues:
    
    - If v4l2_async_match_notify() failed before the sub-notifier handling,
      the async connection was unbound and its entry removed from the
      sub-device's async connection list. The latter part was also done in
      v4l2_async_match_notify().
    
    - The async connection's sd field was only set after creating ancillary
      links in v4l2_async_match_notify(). It was however dereferenced in
      v4l2_async_unbind_subdev_one(), which was called on error path of
      v4l2_async_match_notify() failure.
    
    Signed-off-by: Sakari Ailus 
    Tested-by: "Yew, Chang Ching" 
    Signed-off-by: Hans Verkuil 

commit 679f0b7b6a409750a25754c8833e268e5fdde742
Author: Sakari Ailus 
Date:   Tue Nov 25 00:24:48 2025 +0200

    media: ccs: Avoid possible division by zero
    
    Calculating maximum M for scaler configuration involves dividing by
    MIN_X_OUTPUT_SIZE limit register's value. Albeit the value is presumably
    non-zero, the driver was missing the check it in fact was. Fix this.
    
    Reported-by: Josh Poimboeuf 
    Closes: https://lore.kernel.org/all/ahukd6b3wonye3zgtptvwzvrxldcruazs2exfvll6etjhmcxyj@vq3eh6pd375b/
    Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver")
    Cc: stable@vger.kernel.org # for 5.15 and later
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Nathan Chancellor 
    Tested-by: Nathan Chancellor  # build
    Signed-off-by: Hans Verkuil 

commit 37a5b80a94cc6ca3b6a5c2999a6ad008ca2e6277
Author: Sakari Ailus 
Date:   Wed Nov 12 09:57:57 2025 +0200

    media: v4l2-fwnode: Allow passing NULL fwnode to endpoint parsers
    
    v4l2_fwnode_endpoint_parse() and v4l2_fwnode_endpoint_alloc_parse() take
    a fwnode as the first argument and leave it up to the caller to check a
    valid fwnode has been obtained through various means. Instead, add a check
    here so the callers won't need to do that anymore.
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Michael Riesch 
    Signed-off-by: Hans Verkuil 

commit e3d5436c7099881e3604826757c8d65acc2d94f3
Author: Sakari Ailus 
Date:   Tue Nov 11 13:07:29 2025 +0200

    media: v4l2-ctrls: Set error v4l2_ctrl_new_fwnode_properties consistently
    
    The vast majority of the callers of v4l2_ctrl_new_fwnode_properties() do
    check the returned error code but the function does not set the control
    handler's error on failure. This will make error handling more complicated
    and prone for bugs.
    
    Always assign the control handler's error field on error in
    v4l2_ctrl_new_fwnode_properties().
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Jacopo Mondi 
    Signed-off-by: Hans Verkuil 

commit a014c203b54d9013ad52ad8a531cf46e71028f2b
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 12:02:41 2025 +0100

    spi: fsi: Simplify with scoped for each OF child loop
    
    Use scoped for_each_available_child_of_node_scoped() when iterating over
    device nodes to make code a bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251224110240.56803-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 585e8a26abfd0c453f01ef78bd637cb7600e9b04
Author: Alok Tiwari 
Date:   Sat Jan 10 03:51:56 2026 -0800

    rust: platform: fix remove_callback invariant comment
    
    Correct copy-paste errors where remove_callback safety invariants
    incorrectly referenced probe_callback().
    
    Signed-off-by: Alok Tiwari 
    Reviewed-by: Alice Ryhl 
    Link: https://patch.msgid.link/20260110115159.2313116-1-alok.a.tiwari@oracle.com
    Signed-off-by: Danilo Krummrich 

commit 601cd264a31d198d5710846c9b53dfa92f1c4268
Author: Alok Tiwari 
Date:   Sat Jan 10 03:48:13 2026 -0800

    rust: auxiliary: fix remove_callback invariant comment
    
    Correct copy-paste errors where remove_callback safety invariants
    incorrectly referenced probe_callback().
    
    Signed-off-by: Alok Tiwari 
    Reviewed-by: Alice Ryhl 
    Link: https://patch.msgid.link/20260110114817.2312828-1-alok.a.tiwari@oracle.com
    Signed-off-by: Danilo Krummrich 

commit cd64d10b76f958b5a1b7bd7d9f022a96db56160c
Merge: ff420c568b4cda 4716af3897e959
Author: Paolo Abeni 
Date:   Tue Jan 13 12:27:05 2026 +0100

    Merge branch 'net-rds-rds-tcp-bug-fix-collection-subset-1-work-queue-scalability'
    
    Allison Henderson says:
    
    ====================
    net/rds: RDS-TCP bug fix collection, subset 1: Work queue scalability
    
    This is subset 1 of the RDS-TCP bug fix collection series I posted last
    Oct.  The greater series aims to correct multiple rds-tcp bugs that
    can cause dropped or out of sequence messages.  The set was starting to
    get a bit large, so I've broken it down into smaller sets to make
    reviews more manageable.
    
    In this subset, we focus on work queue scalability.  Messages queues
    are refactored to operate in parallel across multiple connections,
    which improves response times and avoids timeouts.
    
    The entire set can be viewed in the rfc here:
    https://lore.kernel.org/netdev/20251022191715.157755-1-achender@kernel.org/
    
    Questions, comments, flames appreciated!
    ====================
    
    Link: https://patch.msgid.link/20260109224843.128076-1-achender@kernel.org
    Signed-off-by: Paolo Abeni 

commit 4716af3897e95997d08183d351cece2dec9ee0c0
Author: Allison Henderson 
Date:   Fri Jan 9 15:48:43 2026 -0700

    net/rds: Give each connection path its own workqueue
    
    RDS was written to require ordered workqueues for "cp->cp_wq":
    Work is executed in the order scheduled, one item at a time.
    
    If these workqueues are shared across connections,
    then work executed on behalf of one connection blocks work
    scheduled for a different and unrelated connection.
    
    Luckily we don't need to share these workqueues.
    While it obviously makes sense to limit the number of
    workers (processes) that ought to be allocated on a system,
    a workqueue that doesn't have a rescue worker attached,
    has a tiny footprint compared to the connection as a whole:
    A workqueue costs ~900 bytes, including the workqueue_struct,
    pool_workqueue, workqueue_attrs, wq_node_nr_active and the
    node_nr_active flex array.  Each connection can have up to 8
    (RDS_MPATH_WORKERS) paths for a worst case of ~7 KBytes per
    connection.  While an RDS/IB connection totals only ~5 MBytes.
    
    So we're getting a signficant performance gain
    (90% of connections fail over under 3 seconds vs. 40%)
    for a less than 0.02% overhead.
    
    RDS doesn't even benefit from the additional rescue workers:
    of all the reasons that RDS blocks workers, allocation under
    memory pressue is the least of our concerns. And even if RDS
    was stalling due to the memory-reclaim process, the work
    executed by the rescue workers are highly unlikely to free up
    any memory. If anything, they might try to allocate even more.
    
    By giving each connection path its own workqueues, we allow
    RDS to better utilize the unbound workers that the system
    has available.
    
    Signed-off-by: Somasundaram Krishnasamy 
    Signed-off-by: Allison Henderson 
    Link: https://patch.msgid.link/20260109224843.128076-3-achender@kernel.org
    Signed-off-by: Paolo Abeni 

commit d327e2e74aedbe77e1dd716ec77b9aa828ef6812
Author: Allison Henderson 
Date:   Fri Jan 9 15:48:42 2026 -0700

    net/rds: Add per cp work queue
    
    This patch adds a per connection workqueue which can be initialized
    and used independently of the globally shared rds_wq.
    
    This patch is the first in a series that aims to address tcp ack
    timeouts during the tcp socket shutdown sequence.
    
    This initial refactoring lays the ground work needed to alleviate
    queue congestion during heavy reads and writes.  The independently
    managed queues will allow shutdowns and reconnects respond more quickly
    before the peer(s) timeout waiting for the proper acks.
    
    Signed-off-by: Allison Henderson 
    Link: https://patch.msgid.link/20260109224843.128076-2-achender@kernel.org
    Signed-off-by: Paolo Abeni 

commit 1f61d735b8595f80ae5cfbbe11390a49b7f45911
Author: Uwe Kleine-König 
Date:   Wed Dec 10 09:31:38 2025 +0100

    host1x: Convert to bus methods
    
    The callbacks .probe(), .remove() and .shutdown() for device_drivers
    should go away. So migrate to bus methods. There are two differences
    that need addressing:
    
     - The bus remove callback returns void while the driver remove callback
       returns int (the actual value is ignored by the core).
     - The bus shutdown callback is also called for unbound devices, so an
       additional check for dev->driver != NULL is needed.
    
    Signed-off-by: Uwe Kleine-König 
    Tested-by: Luca Ceresoli  # tegra20 tegra-video
    Reviewed-by: Luca Ceresoli 
    Signed-off-by: Thierry Reding 
    Link: https://patch.msgid.link/dd55d034c68953268ea416aa5c13e41b158fcbb4.1765355236.git.u.kleine-koenig@baylibre.com

commit ba3588410cedb1696cfe56ebefcc4401c6d0bb36
Author: Uwe Kleine-König 
Date:   Wed Dec 10 09:31:37 2025 +0100

    host1x: Make remove callback return void
    
    The return value of struct device_driver::remove is ignored by the core
    (see device_remove() in drivers/base/dd.c). So it doesn't make sense to
    let the host1x remove callback return an int just to ignore it later.
    
    So make the callback return void. All current implementors return 0, so
    they are easily converted.
    
    Signed-off-by: Uwe Kleine-König 
    Tested-by: Luca Ceresoli  # tegra20 tegra-video
    Reviewed-by: Luca Ceresoli 
    Signed-off-by: Thierry Reding 
    Link: https://patch.msgid.link/d364fd4ec043d36ee12e46eaef98c57658884f63.1765355236.git.u.kleine-koenig@baylibre.com

commit 693142d4d761dd188ead136a7bca1e870a6af8cd
Author: Andy Shevchenko 
Date:   Tue Jan 13 11:22:03 2026 +0100

    auxdisplay: max6959: Replace slab.h with device/devres.h
    
    Replace slab.h with device/devres.h as the devm_*() APIs are defined
    in the latter.
    
    Signed-off-by: Andy Shevchenko 

commit ff420c568b4cda293d9ef516a85c2f29fafc41d6
Merge: de746f8f53410a 8d61f1a9f2541c
Author: Paolo Abeni 
Date:   Tue Jan 13 11:54:31 2026 +0100

    Merge branch 'multi-queue-aware-sch_cake'
    
     says:
    
    ====================
    Multi-queue aware sch_cake
    
    This series adds a multi-queue aware variant of the sch_cake scheduler,
    called 'cake_mq'. Using this makes it possible to scale the rate shaper
    of sch_cake across multiple CPUs, while still enforcing a single global
    rate on the interface.
    
    The approach taken in this patch series is to implement a separate qdisc
    called 'cake_mq', which is based on the existing 'mq' qdisc, but differs
    in a couple of aspects:
    
    - It will always install a cake instance on each hardware queue (instead
      of using the default qdisc for each queue like 'mq' does).
    
    - The cake instances on the queues will share their configuration, which
      can only be modified through the parent cake_mq instance.
    
    Doing things this way simplifies user configuration by centralising
    all configuration through the cake_mq qdisc (which also serves as an
    obvious way of opting into the multi-queue aware behaviour). The cake_mq
    qdisc takes all the same configuration parameters as the cake qdisc.
    
    An earlier version of this work was presented at this year's Netdevconf:
    https://netdevconf.info/0x19/sessions/talk/mq-cake-scaling-software-rate-limiting-across-cpu-cores.html
    
    The patch series is structured as follows:
    
    - Patch 1 exports the mq qdisc functions for reuse.
    
    - Patch 2 factors out the sch_cake configuration variables into a
      separate struct that can be shared between instances.
    
    - Patch 3 adds the basic cake_mq qdisc, reusing the exported mq code
    
    - Patch 4 adds configuration sharing across the cake instances installed
      under cake_mq
    
    - Patch 5 adds the shared shaper state that enables the multi-core rate
      shaping
    
    - Patch 6 adds selftests for cake_mq
    
    A patch to iproute2 to make it aware of the cake_mq qdisc were submitted
    separately with a previous patch version:
    
    https://lore.kernel.org/r/20260105162902.1432940-1-toke@redhat.com
    ====================
    
    Link: https://patch.msgid.link/20260109-mq-cake-sub-qdisc-v8-0-8d613fece5d8@redhat.com
    Signed-off-by: Paolo Abeni 

commit 8d61f1a9f2541c6ef51d4997e6a4c5a1c0d8b27c
Author: Jonas Köppeler 
Date:   Fri Jan 9 14:15:35 2026 +0100

    selftests/tc-testing: add selftests for cake_mq qdisc
    
    Test 684b: Create CAKE_MQ with default setting (4 queues)
    Test 7ee8: Create CAKE_MQ with bandwidth limit (4 queues)
    Test 1f87: Create CAKE_MQ with rtt time (4 queues)
    Test e9cf: Create CAKE_MQ with besteffort flag (4 queues)
    Test 7c05: Create CAKE_MQ with diffserv8 flag (4 queues)
    Test 5a77: Create CAKE_MQ with diffserv4 flag (4 queues)
    Test 8f7a: Create CAKE_MQ with flowblind flag (4 queues)
    Test 7ef7: Create CAKE_MQ with dsthost and nat flag (4 queues)
    Test 2e4d: Create CAKE_MQ with wash flag (4 queues)
    Test b3e6: Create CAKE_MQ with flowblind and no-split-gso flag (4 queues)
    Test 62cd: Create CAKE_MQ with dual-srchost and ack-filter flag (4 queues)
    Test 0df3: Create CAKE_MQ with dual-dsthost and ack-filter-aggressive flag (4 queues)
    Test 9a75: Create CAKE_MQ with memlimit and ptm flag (4 queues)
    Test cdef: Create CAKE_MQ with fwmark and atm flag (4 queues)
    Test 93dd: Create CAKE_MQ with overhead 0 and mpu (4 queues)
    Test 1475: Create CAKE_MQ with conservative and ingress flag (4 queues)
    Test 7bf1: Delete CAKE_MQ with conservative and ingress flag (4 queues)
    Test ee55: Replace CAKE_MQ with mpu (4 queues)
    Test 6df9: Change CAKE_MQ with mpu (4 queues)
    Test 67e2: Show CAKE_MQ class (4 queues)
    Test 2de4: Change bandwidth of CAKE_MQ (4 queues)
    Test 5f62: Fail to create CAKE_MQ with autorate-ingress flag (4 queues)
    Test 038e: Fail to change setting of sub-qdisc under CAKE_MQ
    Test 7bdc: Fail to replace sub-qdisc under CAKE_MQ
    Test 18e0: Fail to install CAKE_MQ on single queue device
    
    Reviewed-by: Victor Nogueira 
    Signed-off-by: Jonas Köppeler 
    Signed-off-by: Toke Høiland-Jørgensen 
    Link: https://patch.msgid.link/20260109-mq-cake-sub-qdisc-v8-6-8d613fece5d8@redhat.com
    Signed-off-by: Paolo Abeni 

commit 1bddd758bac21fbbd8a06af746ec7b6d878a9d2c
Author: Jonas Köppeler 
Date:   Fri Jan 9 14:15:34 2026 +0100

    net/sched: sch_cake: share shaper state across sub-instances of cake_mq
    
    This commit adds shared shaper state across the cake instances beneath a
    cake_mq qdisc. It works by periodically tracking the number of active
    instances, and scaling the configured rate by the number of active
    queues.
    
    The scan is lockless and simply reads the qlen and the last_active state
    variable of each of the instances configured beneath the parent cake_mq
    instance. Locking is not required since the values are only updated by
    the owning instance, and eventual consistency is sufficient for the
    purpose of estimating the number of active queues.
    
    The interval for scanning the number of active queues is set to 200 us.
    We found this to be a good tradeoff between overhead and response time.
    For a detailed analysis of this aspect see the Netdevconf talk:
    
    https://netdevconf.info/0x19/docs/netdev-0x19-paper16-talk-paper.pdf
    
    Reviewed-by: Jamal Hadi Salim 
    Signed-off-by: Jonas Köppeler 
    Signed-off-by: Toke Høiland-Jørgensen 
    Link: https://patch.msgid.link/20260109-mq-cake-sub-qdisc-v8-5-8d613fece5d8@redhat.com
    Signed-off-by: Paolo Abeni 

commit 87826c01837c314c3caada33524fc769e58364a9
Author: Toke Høiland-Jørgensen 
Date:   Fri Jan 9 14:15:33 2026 +0100

    net/sched: sch_cake: Share config across cake_mq sub-qdiscs
    
    This adds support for configuring the cake_mq instance directly, sharing
    the config across the cake sub-qdiscs.
    
    Signed-off-by: Toke Høiland-Jørgensen 
    Link: https://patch.msgid.link/20260109-mq-cake-sub-qdisc-v8-4-8d613fece5d8@redhat.com
    Signed-off-by: Paolo Abeni 

commit ebc65a873effc8a076edcec34b1ad719525205b5
Author: Toke Høiland-Jørgensen 
Date:   Fri Jan 9 14:15:32 2026 +0100

    net/sched: sch_cake: Add cake_mq qdisc for using cake on mq devices
    
    Add a cake_mq qdisc which installs cake instances on each hardware
    queue on a multi-queue device.
    
    This is just a copy of sch_mq that installs cake instead of the default
    qdisc on each queue. Subsequent commits will add sharing of the config
    between cake instances, as well as a multi-queue aware shaper algorithm.
    
    Reviewed-by: Willem de Bruijn 
    Signed-off-by: Toke Høiland-Jørgensen 
    Link: https://patch.msgid.link/20260109-mq-cake-sub-qdisc-v8-3-8d613fece5d8@redhat.com
    Signed-off-by: Paolo Abeni 

commit bc0ce2bad36c28a3d13c5b9b5894e1f86831d917
Author: Toke Høiland-Jørgensen 
Date:   Fri Jan 9 14:15:31 2026 +0100

    net/sched: sch_cake: Factor out config variables into separate struct
    
    Factor out all the user-configurable variables into a separate struct
    and embed it into struct cake_sched_data. This is done in preparation
    for sharing the configuration across multiple instances of cake in an mq
    setup.
    
    No functional change is intended with this patch.
    
    Reviewed-by: Jamal Hadi Salim 
    Reviewed-by: Willem de Bruijn 
    Signed-off-by: Toke Høiland-Jørgensen 
    Link: https://patch.msgid.link/20260109-mq-cake-sub-qdisc-v8-2-8d613fece5d8@redhat.com
    Signed-off-by: Paolo Abeni 

commit 8b27fd66f519858a4899c9c6d213e6fad7592ead
Author: Toke Høiland-Jørgensen 
Date:   Fri Jan 9 14:15:30 2026 +0100

    net/sched: Export mq functions for reuse
    
    To enable the cake_mq qdisc to reuse code from the mq qdisc, export a
    bunch of functions from sch_mq. Split common functionality out from some
    functions so it can be composed with other code, and export other
    functions wholesale. To discourage wanton reuse, put the symbols into a
    new NET_SCHED_INTERNAL namespace, and a sch_priv.h header file.
    
    No functional change intended.
    
    Reviewed-by: Willem de Bruijn 
    Signed-off-by: Toke Høiland-Jørgensen 
    Link: https://patch.msgid.link/20260109-mq-cake-sub-qdisc-v8-1-8d613fece5d8@redhat.com
    Signed-off-by: Paolo Abeni 

commit 6c125b85f3c87b4bf7dba91af6f27d9600b9dba0
Author: Gabriele Monaco 
Date:   Fri Dec 5 14:16:16 2025 +0100

    sched: Export hidden tracepoints to modules
    
    The tracepoints sched_entry, sched_exit and sched_set_need_resched
    are not exported to tracefs as trace events, this allows only kernel
    code to access them. Helper modules like [1] can be used to still have
    the tracepoints available to ftrace for debugging purposes, but they do
    rely on the tracepoints being exported.
    
    Export the 3 not exported tracepoints.
    Note that sched_set_state is already exported as the macro is called
    from modules.
    
    [1] - https://github.com/qais-yousef/sched_tp.git
    
    Fixes: adcc3bfa8806 ("sched: Adapt sched tracepoints for RV task model")
    Signed-off-by: Gabriele Monaco 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Phil Auld 
    Link: https://patch.msgid.link/20251205131621.135513-9-gmonaco@redhat.com

commit 881238a8525a35484e768347de1442581d6bf309
Author: Linus Walleij 
Date:   Mon Jan 12 11:20:32 2026 +0100

    pinctrl: apple: Implement GPIO func check callback
    
    This function will check if the indicated function enumerator
    i.e. the value set into bits 5 and 6 of the pin configuration
    register, is zero and thus corresponds to the GPIO mode of the
    pin.
    
    This may be necessary to know since the pin controller is
    flagged as "strict": once you set a pin *explicitly* to GPIO
    mode using function 0, the core is unaware that this is
    actually the GPIO mode, and clients may be denied to
    retrieve the pin as a GPIO.
    
    Currently none of the in-kernel device trees sets any pin to
    GPIO mode, but this may happen any day.
    
    Reviewed-by: Sven Peter 
    Reviewed-by: Bartosz Golaszewski 
    Signed-off-by: Linus Walleij 

commit 7b9a9cafc4437b8f3be3bd05f0fb39935760a570
Author: Linus Walleij 
Date:   Mon Jan 12 11:20:31 2026 +0100

    pinctrl: apple: Use unsigned int instead of unsigned
    
    It is discouraged to use the ambiguous "unsigned" type, use
    explicit unsigned int in the driver.
    
    Reviewed-by: Sven Peter 
    Reviewed-by: Bartosz Golaszewski 
    Signed-off-by: Linus Walleij 

commit ae4535b0d9372ca90a24f2d9970310ee48eb3cc2
Author: Thomas Weißschuh 
Date:   Wed Jan 7 11:36:58 2026 +0100

    hrtimer: Drop _tv64() helpers
    
    Since ktime_t has become an alias to s64, these helpers are unnecessary.
    
    Migrate the few remaining users to the regular helpers and remove the
    now dead code.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20260107-hrtimer-header-cleanup-v1-3-1a698ef0ddae@linutronix.de

commit 84663a5ad6333e8dcb57be9bb113f592e05b33c6
Author: Thomas Weißschuh 
Date:   Wed Jan 7 11:36:57 2026 +0100

    hrtimer: Remove public definition of HIGH_RES_NSEC
    
    This constant is only used in a single place and is has a very generic
    name polluting the global namespace.
    
    Move the constant closer to its only user.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20260107-hrtimer-header-cleanup-v1-2-1a698ef0ddae@linutronix.de

commit 0483e5e1dc78f53c540b19231e9cf5571ce01d50
Author: Thomas Weißschuh 
Date:   Wed Jan 7 11:36:56 2026 +0100

    hrtimer: Remove unused resolution constants
    
    These constants are never used, remove them.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20260107-hrtimer-header-cleanup-v1-1-1a698ef0ddae@linutronix.de

commit 24a57985670e9dac5547e5b7731bf8e7b03d5be8
Author: Lachlan Hodges 
Date:   Tue Jan 13 14:09:34 2026 +1100

    wifi: cfg80211: don't apply HT flags to S1G channels
    
    HT flags don't really make sense when applied to S1G channels
    especially given the bandwidths both used for calculations and
    conveyed (i.e 20MHz). Similarly with the 80/160/..MHz channels,
    each bonded subchannel is validated individually within
    cfg80211_s1g_usable(), so the regulatory validation is similarly
    redundant. Additionally, usermode application output (such as iwinfo
    below) doesn't particularly make sense when enumerating S1G channels:
    
    before:
    
    925.500 MHz (Band: 900 MHz, Channel 47) [NO_HT40+, NO_HT40-, NO_16MHZ]
    926.500 MHz (Band: 900 MHz, Channel 49) [NO_HT40+, NO_HT40-, NO_16MHZ]
    927.500 MHz (Band: 900 MHz, Channel 51) [NO_HT40+, NO_HT40-, NO_16MHZ, NO_PRIMARY]
    
    after:
    
    925.500 MHz (Band: 900 MHz, Channel 47) [NO_16MHZ]
    926.500 MHz (Band: 900 MHz, Channel 49) [NO_16MHZ]
    927.500 MHz (Band: 900 MHz, Channel 51) [NO_16MHZ, NO_PRIMARY]
    
    Don't process the S1G band when applying HT flags as both the regulatory
    component is redundant and the flags don't make sense for S1G channels.
    
    Signed-off-by: Lachlan Hodges 
    Link: https://patch.msgid.link/20260113030934.18726-1-lachlan.hodges@morsemicro.com
    Signed-off-by: Johannes Berg 

commit de746f8f53410a0e31d8e5d145745332ee77d321
Merge: cbe8e6bef6a3b4 9ab94a32af704f
Author: Paolo Abeni 
Date:   Tue Jan 13 10:44:20 2026 +0100

    Merge branch 'r8169-add-dash-and-ltr-support'
    
    Javen Xu says:
    
    ====================
    r8169: add dash and LTR support
    
    From: Javen Xu 
    
    This series patch adds dash support for RTL8127AP and LTR support for
    RTL8168FP/RTL8168EP/RTL8168H/RTL8125/RTL8126/RTL8127.
    ====================
    
    Link: https://patch.msgid.link/20260109070415.1115-1-javen_xu@realsil.com.cn
    Signed-off-by: Paolo Abeni 

commit 9ab94a32af704fa9c873094283ae8744a07baf25
Author: Javen Xu 
Date:   Fri Jan 9 15:04:15 2026 +0800

    r8169: enable LTR support
    
    This patch will enable
    RTL8168FP/RTL8168EP/RTL8168H/RTL8125/RTL8126/RTL8127 LTR support.
    
    Signed-off-by: Javen Xu 
    Link: https://patch.msgid.link/20260109070415.1115-3-javen_xu@realsil.com.cn
    Signed-off-by: Paolo Abeni 

commit 3259d2cf94276d92bb49b782d3e138703208e353
Author: Javen Xu 
Date:   Fri Jan 9 15:04:14 2026 +0800

    r8169: add DASH support for RTL8127AP
    
    This adds DASH support for chip RTL8127AP. Its mac version is
    RTL_GIGA_MAC_VER_80 and revision id is 0x04. DASH is a standard for
    remote management of network device, allowing out-of-band control.
    
    Signed-off-by: Javen Xu 
    Link: https://patch.msgid.link/20260109070415.1115-2-javen_xu@realsil.com.cn
    Signed-off-by: Paolo Abeni 

commit 568ea51e61f7da72ee290d24d6ee952586a3e168
Author: Bartosz Golaszewski 
Date:   Mon Jan 12 10:36:51 2026 +0100

    gpio: shared: use device_is_compatible() for reset-gpio
    
    reset-gpio devices now can be identified with device_is_compatible() so
    use it instead of checking the device name string.
    
    Reviewed-by: Linus Walleij 
    Link: https://lore.kernel.org/r/20260112093651.23639-1-bartosz.golaszewski@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit 2759816f1682ca6a269064b7b9d50a65bc3afd5d
Author: Wenmeng Liu 
Date:   Mon Jan 12 16:04:53 2026 +0800

    media: qcom: camss: add support for SM6150 camss
    
    The camera subsystem for SM6150 which is based on Spectra 230.
    
    For SM6150:
    - VFE and CSID version: 170 (vfe170, csid170)
    - CSIPHY version: csiphy-v2.0.1 (14nm)
    
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Wenmeng Liu 
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit c88c5441f7ba030644b65dbd2dfbff811dbe19a3
Author: Wenmeng Liu 
Date:   Mon Jan 12 16:04:52 2026 +0800

    dt-bindings: media: Add qcom,sm6150-camss
    
    Add bindings for the Camera Subsystem on the SM6150 SoC
    
    The SM6150 platform provides:
    - 2 x VFE (version 170), each with 3 RDI
    - 1 x VFE Lite (version 170), each with 4 RDI
    - 2 x CSID (version 170)
    - 1 x CSID Lite (version 170)
    - 3 x CSIPHY (version 2.0.0)
    - 1 x BPS (Bayer Processing Segment)
    - 1 x ICP (Imaging Control Processor)
    - 1 x IPE (Image Postprocessing Engine)
    - 1 x JPEG Encoder/Decoder
    - 1 x LRME (Low Resolution Motion Estimation)
    
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Wenmeng Liu 
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 77a2ff40c51d170402f76e4e76640bfd4139a901
Author: Vladimir Zapolskiy 
Date:   Thu Nov 20 02:46:04 2025 +0200

    media: qcom: camss: use a handy v4l2_async_nf_add_fwnode_remote() function
    
    Another code simplification makes parsing of remote endpoints easy.
    
    Tested-by: Loic Poulain 
    Signed-off-by: Vladimir Zapolskiy 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit eccf5fa8e3fef5f986dc42e0d15a56b74f5ee128
Author: Vladimir Zapolskiy 
Date:   Thu Nov 20 02:46:03 2025 +0200

    media: qcom: camss: change internals of endpoint parsing to fwnode handling
    
    Since a few called V4L2 functions operate with fwnode arguments the change
    from OF device nodes to fwnodes brings a simplification to the code.
    
    The camss_parse_endpoint_node() function is called once by camss_probe(),
    and there is no use of knowing a number of asynchronously registered
    remote devices, so it makes sense to remove the related computation from
    the function.
    
    Tested-by: Loic Poulain 
    Signed-off-by: Vladimir Zapolskiy 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit d965919af524e68cb2ab1a685872050ad2ee933d
Author: Alper Ak 
Date:   Mon Dec 29 10:52:17 2025 +0300

    media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
    
    vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop
    bound and passes the index to vfe_isr_reg_update(). However,
    vfe->line[] array is defined with VFE_LINE_NUM_MAX(4):
    
        struct vfe_line line[VFE_LINE_NUM_MAX];
    
    When index is 4, 5, 6, the access to vfe->line[line_id] exceeds
    the array bounds and resulting in out-of-bounds memory access.
    
    Fix this by using separate loops for output lines and write masters.
    
    Fixes: 4edc8eae715c ("media: camss: Add initial support for VFE hardware version Titan 480")
    Signed-off-by: Alper Ak 
    Cc: stable@vger.kernel.org
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 0b61ce8dc4a71ea7baa19275c655677c612dde6d
Author: Loic Poulain 
Date:   Thu Dec 11 14:59:39 2025 +0100

    media: qcom: camss: csid-340: Fix unused variables
    
    The CSID driver has some unused variables and function parameters
    that are no longer needed (due to refactoring). Clean up those
    unused elements:
    
    - Remove the `vc` parameter from `__csid_configure_rx()`.
    - Drop the unused `lane_cnt` variable.
    - Adjust call to `__csid_configure_rx()` accordingly.
    
    Signed-off-by: Loic Poulain 
    Reviewed-by: Bryan O'Donoghue 
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit a89e490ba3551823511588b7b3828d67f8b82954
Author: Vladimir Zapolskiy 
Date:   Mon Oct 20 17:02:27 2025 +0300

    media: qcom: camss: Do not enable cpas fast ahb clock for SM8550 VFE lite
    
    The clock is needed to stream images over a full VFE IP on SM8550 CAMSS,
    and it should not be enabled, when an image stream is routed over any of
    two lite VFE IPs on the SoC.
    
    Signed-off-by: Vladimir Zapolskiy 
    Acked-by: Bryan O'Donoghue 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 17bc0e288224f793a5a97408b7ce0b80c178bfaa
Author: Wenmeng Liu 
Date:   Fri Nov 14 16:26:49 2025 +0800

    media: qcom: camss: Add support for regulator init_load_uA in CSIPHY
    
    Some Qualcomm regulators are configured with initial mode as
    HPM (High Power Mode), which may lead to higher power consumption.
    To reduce power usage, it's preferable to set the initial mode
    to LPM (Low Power Mode).
    
    To ensure the regulator can switch from LPM to HPM when needed,
    this patch adds current load configuration for CAMSS CSIPHY.
    This allows the regulator framework to scale the mode dynamically
    based on the load requirement.
    
    The current default value for current is uninitialized or random.
    To address this, initial current values are added for the
    following platforms:
    MSM8916, MSM8939, MSM8953, MSM8996, QCM2290, SDM670, SM8250, SC7280,
    SM8550, SM8650, QCS8300, SA8775P and X1E80100.
    
    For SDM660, SDM845, SC8280XP the value is set to 0,
    indicating that no default current value is configured,
    the other values are derived from the power grid.
    
    Signed-off-by: Wenmeng Liu 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 26efe43f2ecd11de15c430a5e5069a6fc1372a5c
Author: Hangxiang Ma 
Date:   Sun Nov 30 22:25:36 2025 -0800

    media: camss: csiphy: Make CSIPHY status macro cross-platform
    
    The current value of '0xb0' that represents the offset to the status
    registers within the common registers of the CSIPHY has been changed on
    the newer SOCs and it requires generalizing the macro using a new
    variable 'common_status_offset'. This variable is initialized in the
    csiphy_init() function.
    
    Signed-off-by: Hangxiang Ma 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 94d14ac1f2d385e57b651b3bef1026a7b8f9cf38
Author: David Heidelberg 
Date:   Mon Dec 22 15:16:05 2025 +0100

    dt-bindings: media: Correct camss supply description
    
    Usually, the supply is around 1.2 V, not 1.8 V, and also correct wording.
    
    Signed-off-by: David Heidelberg 
    Reviewed-by: Bryan O'Donoghue 
    Reviewed-by: Vladimir Zapolskiy 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 555e882051a3a7ecc2bcee2b2047822249dcd074
Author: Vikram Sharma 
Date:   Fri Nov 7 21:55:20 2025 +0530

    dt-bindings: media: qcom,qcs8300-camss: Add missing power supplies
    
    Add missing vdda-phy-supply and vdda-pll-supply in the (monaco)qcs8300
    camss binding. While enabling imx412 sensor for qcs8300 we see a need
    to add these supplies which were missing in initial submission.
    
    Fixes: 634a2958fae30 ("media: dt-bindings: Add qcom,qcs8300-camss compatible")
    Cc: stable@vger.kernel.org
    Co-developed-by: Nihal Kumar Gupta 
    Signed-off-by: Nihal Kumar Gupta 
    Signed-off-by: Vikram Sharma 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit fc2873aa4a21355593b55eb49ff534d31f81c584
Author: Dale Farnsworth 
Date:   Wed Dec 24 15:50:27 2025 +0530

    media: ti: vpe: Add the VIP driver
    
    VIP stands for Video Input Port. It can be found on devices such as DRA7xx
    and provides a parallel interface to a video source such as a sensor or TV
    decoder. Each VIP can support two inputs (slices) and an SoC can be
    configured with a variable number of VIPs. Each slice can support two
    ports, each connected to its own sub-device.
    
    Signed-off-by: Dale Farnsworth 
    Signed-off-by: Benoit Parrot 
    Signed-off-by: Sukrut Bellary 
    Signed-off-by: Yemike Abhilash Chandra 
    Signed-off-by: Hans Verkuil 

commit 7c0b084c04b69225ad38ac35a52047598af5bbbb
Author: Dale Farnsworth 
Date:   Wed Dec 24 15:50:26 2025 +0530

    dt-bindings: media: ti: vpe: Add support for Video Input Port
    
    Add device tree bindings for the Video Input Port. Video Input Port (VIP)
    can be found on devices such as DRA7xx and provides a parallel interface
    to a video source such as a sensor or TV decoder.
    
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Dale Farnsworth 
    Signed-off-by: Benoit Parrot 
    Signed-off-by: Sukrut Bellary 
    Signed-off-by: Yemike Abhilash Chandra 
    Signed-off-by: Hans Verkuil 

commit 4c97845712874447702af83eb7db6e16d4259639
Author: Yemike Abhilash Chandra 
Date:   Wed Dec 24 15:50:25 2025 +0530

    media: ti: vpe: Export vpdma_load_firmware() function
    
    Export vpdma_load_firmware() function which is needed by TI VIP to load
    the VPDMA firmware.
    
    Signed-off-by: Yemike Abhilash Chandra 
    Signed-off-by: Hans Verkuil 

commit 4011e67a989b828cbf885131933d322dfe80f33a
Author: Yemike Abhilash Chandra 
Date:   Wed Dec 24 15:50:24 2025 +0530

    media: ti: vpe: Re-introduce multi-instance and multi-client support
    
    vpdma_update_dma_addr() was originally added to support multi-instance and
    multi-client in vpdma. However it was dropped as it was unused.
    
    We are adding support for TI VIP. Some devices may have multiple VIP
    instances each with its own VPDMA engine. Within VIP, two slices can use a
    single VPDMA engine simultaneously. So support for multi instances and
    multiple clients is needed. Hence reintroduce multi-instance and
    multi-client support. Also add kernel doc and switch to GPL version of
    EXPORT_SYMBOL.
    
    This reverts commit 9314891df119442a6ec1518b3d872c330e2bf1a1.
    
    Signed-off-by: Yemike Abhilash Chandra 
    Signed-off-by: Hans Verkuil 

commit 36eab90d3f4f4c38d1e9635af40cdd40c7675471
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:31 2025 +0200

    media: i2c: ov01a10: Add ov01a1b support
    
    Add support for the ov01a1b model which is the exact same sensor as
    the ov01a10 without a color-filter.
    
    Note since there is no color-filter there is also no need to shift
    the crop-window when flipping, so the crop window set by userspace may
    cover the full sensor (border_size=0).
    
    Signed-off-by: Hans de Goede 
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 0c5ebba56b10cf6b09da6d90c7be8ad3b0c5c083
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:30 2025 +0200

    media: i2c: ov01a10: Optimize setting h/vflip values
    
    Since ov01a10_global_setting[] sets the initial format1 register value,
    there is no need to do a read-write-modify when setting the flip controls.
    
    Only write format1 when setting the flip-controls and remove the now
    unnecessary format1 register init from ov01a10_global_setting[].
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 12d3c5ffe298d99b4c0d87f8d381ae701bd71462
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:29 2025 +0200

    media: i2c: ov01a10: Add ov01a10_sensor_cfg struct
    
    Add a struct with some sensor variant (ov01a10 / ov01a1b / ov01a1s)
    specific settings.
    
    This is a preparation patch for adding support for the ov01a1s sensor
    which uses the same sensor with a different (RGBI) color-filter.
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit a9aafc571a2aed699b1a88f2c30203e173838600
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:28 2025 +0200

    media: i2c: ov01a10: Remove values set by controls from global_setting[]
    
    Registers 0x3501 (exposure), 0x3508 (analogue-gain) and 0x4503 (test-
    pattern) are already set through __v4l2_ctrl_handler_setup() drop them
    from ov01a10_global_setting[].
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit b9315439680f83caef233a6aea8a7126ecf02bcc
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:27 2025 +0200

    media: i2c: ov01a10: Only set register 0x0305 once
    
    Stop setting register 0x0305 to one value from mipi_data_rate_720mbps
    only to override it with a different value from sensor_1280x800_setting.
    
    Instead directly set it to 0xf4.
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit e8fefc67f2d9df05524b182ac9d3f3f712315e3b
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:26 2025 +0200

    media: i2c: ov01a10: Replace exposure->min/step with direct define use
    
    The exposure minimum and step are constant use the defines for this
    instead of retrieving these from the exposure-control.
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit d4fdb4e6e05c46a2746b96811345f45c937c41c9
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:25 2025 +0200

    media: i2c: ov01a10: Remove struct ov01a10_reg_list
    
    After the conversion to the CCI register access helpers, struct
    ov01a10_reg_list is only used inside struct ov01a10_link_freq_config.
    
    Simplify things by embedding the ov01a10_reg_list members directly into
    struct ov01a10_link_freq_config.
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 896f4e21af4f53719f841b647d084f4689d5ad6c
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:24 2025 +0200

    media: i2c: ov01a10: Add cropping support / allow arbitrary sizes
    
    Remove the fixed mode list and add cropping support. The main reason for
    doing this is to allow libcamera to select 1292x812 instead of 1280x800
    so that after the extra border which the CPU debayer code needs libcamera
    can output 1280x720 instead of 1276x720.
    
    This in turn allows google-meet to use 720p instead of it falling back
    to a pretty bad 360p.
    
    This has been tested on a Dell XPS 9320, with both libcamera as well as
    with Intel's out-of-tree psys driver + proprietary userspace stack.
    
    Libcamera asks for 1292x812 where as the Intel stack asks for 1280x800
    and neither stack explicitly sets the crop-window. Hence the need for
    ov01a10_set_format() to adjust the crop-window if necessary.
    
    Note the differentiating between pattern_size and border_size is done in
    preparation for adding support for the monochrome OV01A1B model where
    coordinates still need to be aligned to a multiple of 2, but there will
    be no need for a border (border_size=0).
    
    Link: https://bugzilla.redhat.com/show_bug.cgi?id=2337593
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 299b82078696ac14325a605b3d2727ff00d6e73e
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:23 2025 +0200

    media: i2c: ov01a10: Use native and default for pixel-array size names
    
    According to the OV01A10 product-brief PDF the OV01A10 has an active pixel
    array size of 1296x816. In otherwords the native and active sizes are
    the same.
    
    Replace the (misspelled) ACTIVE defines for the default resolution of
    1280x800 with DEFAULT to avoid giving the impression that the active pixel
    array size is only 1280x800.
    
    And replace PIXEL_ARRAY with NATIVE to make clear this is the native pixel
    array size / to match the V4L2_SEL_TGT_NATIVE_SIZE naming.
    
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 7f0912eaca4678b8fa86916024c11c84759245e8
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:22 2025 +0200

    media: i2c: ov01a10: Move setting of ctrl->flags to after checking ctrl_hdlr->error
    
    Instead of checking successful creation of the link_freq and vblank
    controls, set their flags after checking ctrl_hdlr->error where it
    is guaranteed that the controls will exist.
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 82d1ab15cb16a249bc0995040837b198f18e0972
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:21 2025 +0200

    media: i2c: ov01a10: Don't update pixel_rate and link_freq from set_fmt
    
    The pixel_rate and link_freq never change, stop updating them on every
    set_fmt.
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 4fbbdabb0c7db066eea17a4a2034816051c73888
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:20 2025 +0200

    media: i2c: ov01a10: Add power on/off sequencing support
    
    So far the ov01a10 driver has only been used on laptops with an IVSC chip
    where the IVSC chip controls the power on/off sequencing of the sensor.
    
    But there are also designs with an ov01a10 sensor where the kernel needs
    to directly take care of the power-sequencing, controlling clks, regulators
    and GPIOs. Add support for these designs.
    
    The 2 ms minimum reset assertion time is taken from other Omnivision sensor
    drivers like the ov5675. The 20 ms delay after reset de-assert comes from
    the out of tree ov01a1s driver.
    
    Signed-off-by: Hans de Goede 
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 6b0a5d40a36828f62fea6340f1691fee64df7f83
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:19 2025 +0200

    media: i2c: ov01a10: Add ov01a10_check_hwcfg() function
    
    Add a function to check that the number of mipi-lanes and there frequency
    are what the driver expects.
    
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit ad134ffad2efcb490a75fa1720f9aa43d0f84fe0
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:18 2025 +0200

    media: i2c: ov01a10: Store dev pointer in struct ov01a10
    
    Now that the cci_* register access helpers are used we no longer need
    the i2c_client in various functions.
    
    Some code is still getting the client just to be able to get to the device
    pointer. Directly store a struct device *dev pointing to &client->dev
    inside struct ov01a10 to make the code simpler.
    
    This also fixes a mismatch of using dev vs &client->dev in the
    runtime_pm_*() calls in probe().
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit f60e94ed1aa110e48c7798a2fc99022e3b03239b
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:17 2025 +0200

    media: i2c: ov01a10: Remove overly verbose probe() error reporting
    
    Many of the functions called from ov01a10_probe() are expected to never
    fail and they should all already log some message if they fail. Remove
    the unnecessarily verbose dev_err[_probe]() calls from the error-exit
    paths in probe().
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 50b52b6d420e85f86a579ea197b569b31bc6de43
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:16 2025 +0200

    media: i2c: ov01a10: Convert to new CCI register access helpers
    
    Use the new comon CCI register access helpers to replace the private
    register access helpers in the ov01a10 driver.
    
    Signed-off-by: Hans de Goede 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit ea444f30f6e37048939a0e1056749d7afc190dd5
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:15 2025 +0200

    media: i2c: ov01a10: Change default vblank value to a vblank resulting in 30 fps
    
    The ov01a10 is quite a small sensor, which does not capture a lot of
    light, increase the default vblank so that the sensor runs at 30 fps
    by default, doubling the default exposure.
    
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 409fb57c1b3deada4b8e153eb6344afb3c2dfb9c
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:14 2025 +0200

    media: i2c: ov01a10: Fix test-pattern disabling
    
    When the test-pattern control gets set to 0 (Disabled) 0 should be written
    to the test-pattern register, rather then doing nothing.
    
    Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Reviewed-by: Bingbu Cao 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit f8563a375e7fba7c776eb591d4498be592c19098
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:13 2025 +0200

    media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format()
    
    The 2 argument version of v4l2_subdev_state_get_format() takes the pad
    as second argument, not the stream.
    
    Fixes: bc0e8d91feec ("media: v4l: subdev: Switch to stream-aware state functions")
    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 0dfec6e30c334364145d0acb38bb8c216b9a7a78
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:12 2025 +0200

    media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
    
    Add missing v4l2_subdev_cleanup() calls to cleanup after
    v4l2_subdev_init_finalize().
    
    Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Reviewed-by: Bingbu Cao 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 109e0feacaeca5ec2dd71d7d17c73232ce5cbddc
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:11 2025 +0200

    media: i2c: ov01a10: Fix analogue gain range
    
    A analogue maximum gain of 0xffff / 65525 seems unlikely and testing
    indeed shows that the gain control wraps-around at 16383, so set the
    maximum gain to 0x3fff / 16383.
    
    The minimum gain of 0x100 is correct. Setting bits 8-11 to 0x0 results
    in the same gain values as setting these bits to 0x1, with bits 0-7
    still increasing the gain when going from 0x000 - 0x0ff in the exact
    same range as when going from 0x100 - 0x1ff.
    
    Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    [Sakari Ailus: mention analogue gain and update the limit from 4096.]
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 9c632eebf6af4cb7b0f85503fe1ebc5176ff0db1
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:10 2025 +0200

    media: i2c: ov01a10: Fix reported pixel-rate value
    
    CSI lanes are double-clocked so with a single lane at 400MHZ the resulting
    pixel-rate for 10-bits pixels is 400 MHz * 2 / 10 = 80 MHz, not 40 MHz.
    
    This also matches with the observed frame-rate of 60 fps with the default
    vblank setting: 80000000 / (1488 * 896) = 60.
    
    Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit ada20c3db0db4f2834d9515f6105111871f04a4d
Author: Hans de Goede 
Date:   Tue Oct 14 19:40:09 2025 +0200

    media: i2c: ov01a10: Fix the horizontal flip control
    
    During sensor calibration I noticed that with the hflip control set
    to false/disabled the image was mirrored.
    
    So it seems that the horizontal flip control is inverted and needs to
    be set to 1 to not flip (just like the similar problem recently fixed
    on the ov08x40 sensor).
    
    Invert the hflip control to fix the sensor mirroring by default.
    
    As the comment above the newly added OV01A10_MEDIA_BUS_FMT define explains
    the control being inverted also means that the native Bayer-order of
    the sensor actually is GBRG not BGGR, but so as to not break userspace
    the Bayer-order is kept at BGGR.
    
    Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede 
    Tested-by: Mehdi Djait  # Dell XPS 9315
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 819fcf0554388bb54b64184902cebfed5260437d
Author: Deepa Guthyappa Madivalara 
Date:   Wed Dec 10 10:59:08 2025 -0800

    media: iris: Add internal buffer calculation for AV1 decoder
    
    Implement internal buffer count and size calculations for AV1 decoder
    for all the buffer types required by the AV1 decoder, including BIN,
    COMV, PERSIST, LINE, and PARTIAL.
    
    This ensures the hardware decoder has properly allocated memory for AV1
    decoding operations, enabling correct AV1 video playback.
    
    Reviewed-by: Dikshita Agarwal 
    Signed-off-by: Deepa Guthyappa Madivalara 
    Tested-by: Val Packett 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 2af481a459a4740c402d2b3346bc4f7b013d74b4
Author: Deepa Guthyappa Madivalara 
Date:   Wed Dec 10 10:59:07 2025 -0800

    media: iris: Define AV1-specific platform capabilities and properties
    
    Defining platform specific capabilities specific to AV1 decoder.
    Set and subscribe to manadatory properties to firmware for AV1.
    
    Reviewed-by: Bryan O'Donoghue 
    Reviewed-by: Dikshita Agarwal 
    Signed-off-by: Deepa Guthyappa Madivalara 
    Tested-by: Val Packett 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 10ac84abd48186b4c20719a7985c8df30d3b5f7a
Author: Deepa Guthyappa Madivalara 
Date:   Wed Dec 10 10:59:06 2025 -0800

    media: iris: Add support for AV1 format in iris decoder
    
    Extend iris decoder driver to support format V4L2_PIX_FMT_AV1.
    This change updates the format enumeration (VIDIOC_ENUM_FMT)
    and allows setting AV1 format via VIDIOC_S_FMT for gen2 and beyond.
    Gen1 iris hardware decoder does not support AV1 format.
    
    Reviewed-by: Bryan O'Donoghue 
    Reviewed-by: Dikshita Agarwal 
    Signed-off-by: Deepa Guthyappa Madivalara 
    Tested-by: Val Packett 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 151096542e937e7336dc0d50192b855f5b490e22
Author: Deepa Guthyappa Madivalara 
Date:   Wed Dec 10 10:59:05 2025 -0800

    media: v4l2: Add description for V4L2_PIX_FMT_AV1 in v4l_fill_fmtdesc()
    
    Add a descriptive string for the AV1 pixel format to v4l_fill_fmtdesc(),
    enabling proper reporting of AV1 support via VIDIOC_ENUM_FMT.
    
    Reviewed-by: Bryan O'Donoghue 
    Reviewed-by: Nicolas Dufresne 
    Reviewed-by: Hans Verkuil 
    Signed-off-by: Deepa Guthyappa Madivalara 
    Tested-by: Val Packett 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 406fc2e9ca65e0df345ebf4ce95aa87cb6416f35
Author: Deepa Guthyappa Madivalara 
Date:   Wed Dec 10 10:59:04 2025 -0800

    media: uapi: videodev2: Add support for AV1 stateful decoder
    
    Introduce a new pixel format, V4L2_PIX_FMT_AV1, to the
    Video4Linux2(V4L2) API. This format is intended for AV1
    bitstreams in stateful decoding/encoding workflows.
    The fourcc code 'AV10' is used to distinguish
    this format from the existing V4L2_PIX_FMT_AV1_FRAME,
    which is used for stateless AV1 decoder implementation.
    
    Reviewed-by: Bryan O'Donoghue 
    Reviewed-by: Nicolas Dufresne 
    Reviewed-by: Hans Verkuil 
    Signed-off-by: Deepa Guthyappa Madivalara 
    Tested-by: Val Packett 
    Signed-off-by: Bryan O'Donoghue 
    Signed-off-by: Hans Verkuil 

commit 17526c7e69d07395e9d39794aacba42dcb02ff49
Author: Ricardo Ribalda 
Date:   Tue Jan 13 13:29:46 2026 +0000

    Revert "media: uvcvideo: Remove nodrop parameter"
    
    This reverts commit 27ccc44a511b0cd76dc607e2a4893b876192ee1b.
    
    A user has reported that the Zoom Video Conferencing tool is not capable
    of handling invalid frames. Due to this, he has to continue using this
    parameter.
    
    We will keep working with Zoom so they can handle invalid frames
    correctly, but for this cycle the safest option is to revert this
    parameter drop.
    
    Fixes: 27ccc44a511b ("media: uvcvideo: Remove nodrop parameter")
    Reported-by: Ralf Jung 
    Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121718
    Closes: https://lore.kernel.org/linux-media/uboug5ectzm4s32yfgopjbcxq2uhsoc4kluaby7a4b7nzfjave@boco7oocnftr/
    Signed-off-by: Ricardo Ribalda 
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Hans Verkuil 

commit 68cd8ac994cac38a305200f638b30e13c690753b
Author: Haoxiang Li 
Date:   Sat Jan 3 15:46:47 2026 +0800

    media: cx25821: Fix a resource leak in cx25821_dev_setup()
    
    Add release_mem_region() if ioremap() fails to release the memory
    region obtained by cx25821_get_resources().
    
    Signed-off-by: Haoxiang Li 
    Signed-off-by: Hans Verkuil 

commit 597f8851c9343aad7c070818f20c61aab5fb74f0
Author: Sun Jian 
Date:   Fri Jan 2 19:45:01 2026 +0800

    staging: media: tegra-video: move tegra20_vip_soc declaration to vip.h
    
    tegra20_vip_soc is shared across translation units but is currently
    declared via an extern in vip.c. Move the declaration to vip.h so users get
    it via the header and we avoid extern declarations in .c files, matching
    the pattern already used by tegra20_vi_soc and tegra210_vi_soc.
    
    Suggested-by: Luca Ceresoli 
    Signed-off-by: Sun Jian 
    Signed-off-by: Hans Verkuil 

commit ee138a2cfc425edb3e3890ee0c9a1d395b6b08f1
Author: Sun Jian 
Date:   Fri Jan 2 19:45:00 2026 +0800

    staging: media: tegra-video: move tegra210_csi_soc declaration to csi.h
    
    Sparse warns that tegra210_csi_soc is not declared in tegra210.c.
    The symbol is referenced from csi.c, so it must remain global. Move the
    declaration to csi.h so users see it via the header and avoid extern
    declarations in .c files.
    
    SPARSE: drivers/staging/media/tegra-video/tegra210.c:1214:28: warning:
     symbol 'tegra210_csi_soc' was not declared. Should it be static?
    
    No functional change intended.
    
    Suggested-by: Luca Ceresoli 
    Signed-off-by: Sun Jian 
    Signed-off-by: Hans Verkuil 

commit cad237b6c875fbee5d353a2b289e98d240d17ec8
Author: Abdun Nihaal 
Date:   Tue Dec 23 11:19:01 2025 +0530

    media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
    
    In one of the error paths in tw9906_probe(), the memory allocated in
    v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that
    by calling v4l2_ctrl_handler_free() on the handler in that error path.
    
    Cc: stable@vger.kernel.org
    Fixes: a000e9a02b58 ("[media] tw9906: add Techwell tw9906 video decoder")
    Signed-off-by: Abdun Nihaal 
    Signed-off-by: Hans Verkuil 

commit 9cea16fea47e5553f51d10957677ff735b1eff03
Author: Abdun Nihaal 
Date:   Tue Dec 23 11:18:13 2025 +0530

    media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
    
    In one of the error paths in tw9903_probe(), the memory allocated in
    v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that
    by calling v4l2_ctrl_handler_free() on the handler in that error path.
    
    Cc: stable@vger.kernel.org
    Fixes: 0890ec19c65d ("[media] tw9903: add new tw9903 video decoder")
    Signed-off-by: Abdun Nihaal 
    Signed-off-by: Hans Verkuil 

commit a8333c8262aed2aedf608c18edd39cf5342680a7
Author: Szymon Wilczek 
Date:   Sat Dec 20 19:24:19 2025 +0100

    media: pvrusb2: fix URB leak in pvr2_send_request_ex
    
    When pvr2_send_request_ex() submits a write URB successfully but fails to
    submit the read URB (e.g. returns -ENOMEM), it returns immediately without
    waiting for the write URB to complete. Since the driver reuses the same
    URB structure, a subsequent call to pvr2_send_request_ex() attempts to
    submit the still-active write URB, triggering a 'URB submitted while
    active' warning in usb_submit_urb().
    
    Fix this by ensuring the write URB is unlinked and waited upon if the read
    URB submission fails.
    
    Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
    Signed-off-by: Szymon Wilczek 
    Acked-by: Mike Isely 
    Signed-off-by: Hans Verkuil 

commit 63bf2f71712c458239f44bb25cf581a06f9770dc
Author: Preyas Sharma 
Date:   Sat Dec 20 09:55:21 2025 +0000

    staging: media: av7110: use usleep_range in sp8870.c
    
    Use usleep_range instead of udelay to fix checkpatch warning.
    
    Signed-off-by: Preyas Sharma 
    Signed-off-by: Hans Verkuil 
    [hverkuil: added commit message]

commit 7422eca89d60d85b698e85b4627ba1d9bf49b1c0
Author: Preyas Sharma 
Date:   Sat Dec 20 09:55:19 2025 +0000

    staging: media: av7110: use usleep_range in av7110_hw.c
    
    Use usleep_range instead of msleep to fix checkpatch warnings.
    
    Signed-off-by: Preyas Sharma 
    Signed-off-by: Hans Verkuil 
    [hverkuil: added commit message]

commit 0fdf6323c35a134f206dcad5babb4ff488552076
Author: Kees Cook 
Date:   Thu Dec 11 19:00:35 2025 -0800

    media: solo6x10: Check for out of bounds chip_id
    
    Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
    (literal "1" is an "int") could end up being shifted beyond 32 bits,
    so instrumentation was added (and due to the double is_tw286x() call
    seen via inlining), Clang decides the second one must now be undefined
    behavior and elides the rest of the function[1]. This is a known problem
    with Clang (that is still being worked on), but we can avoid the entire
    problem by actually checking the existing max chip ID, and now there is
    no runtime instrumentation added at all since everything is known to be
    within bounds.
    
    Additionally use an unsigned value for the shift to remove the
    instrumentation even without the explicit bounds checking.
    
    Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
    Suggested-by: Nathan Chancellor 
    Signed-off-by: Kees Cook 
    Signed-off-by: Hans Verkuil 
    [hverkuil: fix checkpatch warning for is_tw286x]

commit a813338d910b49375018ebe960f912ca7672f88c
Author: Dmitry Osipenko 
Date:   Wed Dec 10 19:00:06 2025 +0300

    media: synopsys: hdmirx: Detect broken interrupt
    
    Downstream version of RK3588 U-Boot uses customized TF-A that remaps
    HDMIRX hardware interrupt, routing it via firmware that isn't supported
    by upstream driver.
    
    Detect broken interrupt and print a clarifying error message about a need
    to use open-source TF-A with this driver.
    
    Reviewed-by: Sebastian Reichel 
    Signed-off-by: Dmitry Osipenko 
    Signed-off-by: Hans Verkuil 

commit 863f50d583445c3c8b28a0fc4bb9c18fd9656f41
Author: Haoxiang Li 
Date:   Wed Dec 10 16:52:30 2025 +0800

    media: cx25821: Add missing unmap in snd_cx25821_hw_params()
    
    In error path, add cx25821_alsa_dma_unmap() to release the
    resource acquired by cx25821_alsa_dma_map()
    
    Fixes: 8d8e6d6005de ("[media] cx28521: drop videobuf abuse in cx25821-alsa")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haoxiang Li 
    Signed-off-by: Hans Verkuil 

commit 141c81849fab2ad4d6e3fdaff7cbaa873e8b5eb2
Author: Haoxiang Li 
Date:   Wed Dec 10 11:02:17 2025 +0800

    media: cx23885: Add missing unmap in snd_cx23885_hw_params()
    
    In error path, add cx23885_alsa_dma_unmap() to release the
    resource acquired by cx23885_alsa_dma_map().
    
    Fixes: 9529a4b0cf49 ("[media] cx23885: drop videobuf abuse in cx23885-alsa")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haoxiang Li 
    Signed-off-by: Hans Verkuil 

commit dbc527d980f7ba8559de38f8c1e4158c71a78915
Author: Haoxiang Li 
Date:   Wed Dec 10 10:53:48 2025 +0800

    media: cx88: Add missing unmap in snd_cx88_hw_params()
    
    In error path, add cx88_alsa_dma_unmap() to release
    resource acquired by cx88_alsa_dma_map().
    
    Fixes: b2c75abde0de ("[media] cx88: drop videobuf abuse in cx88-alsa")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haoxiang Li 
    Signed-off-by: Hans Verkuil 

commit b8bf939d77c0cd01118e953bbf554e0fa15e9006
Author: Shaurya Rane 
Date:   Thu Nov 27 00:34:10 2025 +0530

    media: radio-keene: fix memory leak in error path
    
    Fix a memory leak in usb_keene_probe(). The v4l2 control handler is
    initialized and controls are added, but if v4l2_device_register() or
    video_register_device() fails afterward, the handler was never freed,
    leaking memory.
    
    Add v4l2_ctrl_handler_free() call in the err_v4l2 error path to ensure
    the control handler is properly freed for all error paths after it is
    initialized.
    
    Reported-by: syzbot+a41b73dce23962a74c72@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=a41b73dce23962a74c72
    Fixes: 1bf20c3a0c61 ("[media] radio-keene: add a driver for the Keene FM Transmitter")
    Cc: stable@vger.kernel.org
    Signed-off-by: Shaurya Rane 
    Signed-off-by: Hans Verkuil 

commit 90289b67c5c1d4c18784059b27460d292e16d208
Author: Thorsten Schmelzer 
Date:   Tue Nov 25 15:29:57 2025 +0100

    media: adv7180: fix frame interval in progressive mode
    
    The ADV7280-M may internally convert interlaced video input to
    progressive video. If this mode is enabled, the ADV7280-M delivers
    progressive video frames at the field rate of 50 fields per second (PAL)
    or 60 fields per second (NTSC).
    
    Fix the reported frame interval if progressive video is enabled.
    
    Signed-off-by: Thorsten Schmelzer 
    Reviewed-by: Niklas Söderlund 
    Signed-off-by: Michael Tretter 
    Signed-off-by: Hans Verkuil 

commit 2473b46c480d53e6b20d29b4d497a88747e3e280
Author: Thorsten Schmelzer 
Date:   Tue Nov 25 15:29:56 2025 +0100

    media: adv7180: implement g_register and s_register
    
    The g_register and s_register callbacks are useful for debugging the
    adv7180.
    
    Implement the callbacks to expose the register debugging to userspace.
    
    Signed-off-by: Thorsten Schmelzer 
    Reviewed-by: Niklas Söderlund 
    Signed-off-by: Michael Tretter 
    Signed-off-by: Hans Verkuil 

commit 57b96d4a23c7088127fbd228750bd0b6a1686169
Author: Thorsten Schmelzer 
Date:   Tue Nov 25 15:29:55 2025 +0100

    media: adv7180: add support for ancillary devices
    
    Depending on other devices on the i2c bus, using a non-default address
    for the CSI and VPP devices may be necessary.
    
    Replace calls to i2c_new_dummy_device with i2c_new_ancillary_device,
    which can directly use an i2c address from the device tree.
    
    Program the actual addresses of the sub-devices when configuring the
    chip.
    
    Signed-off-by: Thorsten Schmelzer 
    Signed-off-by: Michael Tretter 
    Signed-off-by: Hans Verkuil 

commit 8e2421e1977ab594011849bbfe028f81ed2ab886
Author: Michael Tretter 
Date:   Tue Nov 25 15:29:54 2025 +0100

    media: dt-bindings: adi,adv7180: add VPP and CSI register maps
    
    Different variants of the ADV7280 chip have up to three register maps.
    The availability of the CSI and VPP register maps depends on the chip
    variant. The address of the additional register maps depends on the
    board design and other chips on the I2C but. They may be programmed via
    registers in the main register map.
    
    Allow to specify the addresses of the VPP and CSI register maps in the
    device tree to solve I2C address conflicts on a board level.
    
    The CSI and VPP register maps are always optional to allow backwards
    compatibility with existing device trees which may rely on the default
    address.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Michael Tretter 
    Signed-off-by: Hans Verkuil 

commit e83f8dd668eaf18f408169e1006f61dc5ebaa00e
Author: Jammy Huang 
Date:   Mon Nov 24 11:05:14 2025 +0800

    media: aspeed: Fix dram hang at res-change
    
    Dram hang could happen in the steps below:
    1. start capture/compression
    2. out-of-lock watchdog raise irq because of res-change.
    3. aspeed_video_irq_res_change do clk-off
    
    At step3, capture/compression could be not accomplished yet. If clk-off
    in the middle of video operation, dram controller could hang at ast2500.
    
    Use reset rather than clk-off/on to avoid this problem.
    
    Signed-off-by: Jammy Huang 
    Signed-off-by: Hans Verkuil 

commit 43e5302d22334f1183dec3e0d5d8007eefe2817c
Author: Zilin Guan 
Date:   Fri Nov 14 09:12:57 2025 +0000

    media: tegra-video: Fix memory leak in __tegra_channel_try_format()
    
    The state object allocated by __v4l2_subdev_state_alloc() must be freed
    with __v4l2_subdev_state_free() when it is no longer needed.
    
    In __tegra_channel_try_format(), two error paths return directly after
    v4l2_subdev_call() fails, without freeing the allocated 'sd_state'
    object. This violates the requirement and causes a memory leak.
    
    Fix this by introducing a cleanup label and using goto statements in the
    error paths to ensure that __v4l2_subdev_state_free() is always called
    before the function returns.
    
    Fixes: 56f64b82356b7 ("media: tegra-video: Use zero crop settings if subdev has no get_selection")
    Fixes: 1ebaeb09830f3 ("media: tegra-video: Add support for external sensor capture")
    Cc: stable@vger.kernel.org
    Signed-off-by: Zilin Guan 
    Signed-off-by: Hans Verkuil 

commit 42bf68dfef7e737933674bd56e1159950247b094
Author: Dmitry Antipov 
Date:   Sat Nov 1 12:08:00 2025 +0300

    media: v4l2-core: simplify v4l2_m2m_register_entity()
    
    Avoid 'strlen()'/'kmalloc()'/'snprintf()' sequence by using
    the convenient 'kasprintf()' in 'v4l2_m2m_register_entity()'.
    
    Signed-off-by: Dmitry Antipov 
    Signed-off-by: Hans Verkuil 

commit ceff18405f6bd7cf87bd4f47648d902ca9fc0e01
Author: Shrikant Raskar 
Date:   Fri Oct 31 22:26:45 2025 +0530

    media: saa6588: Remove dprintk macro and use v4l2_info()
    
    The existing 'dprintk' macro used an unwrapped 'if' statement which was
    flagged by checkpatch, but instead of wrapping it, the debug handling
    can be simplified.
    
    This patch removes the 'dprintk' macro entirely and replaces all its
    usages with v4l2_info() helper. The unused 'PREFIX' macro is also
    removed.
    
    Signed-off-by: Shrikant Raskar 
    Signed-off-by: Hans Verkuil 

commit 56a8676456e1eb6882ec90e3544b3622979c0a11
Author: Lukas Bulwahn 
Date:   Wed Oct 29 12:06:23 2025 +0100

    MAINTAINERS: adjust file entry in MEDIATEK MDP DRIVER
    
    Commit fbf97d6c1dd4 ("dt-bindings: media: Convert MediaTek mt8173-mdp
    bindings to DT schema") renames mediatek-mdp.txt to
    mediatek,mt8173-mdp.yaml as part of this dt-binding conversion, but misses
    to adjust the file entry in MEDIATEK MDP DRIVER.
    
    Adjust the file entry after the conversion.
    
    Signed-off-by: Lukas Bulwahn 
    Reviewed-by: Hans Verkuil 
    Signed-off-by: Hans Verkuil 

commit 1c1b79f40ee4444fa1ac96079751608b724c6b2b
Author: Benjamin Gaignard 
Date:   Thu Jan 8 14:29:46 2026 +0100

    media: verisilicon: AV1: Set IDR flag for intra_only frame type
    
    Intra_only frame could be considered as a key frame so Instantaneous
    Decoding Refresh (IDR) flag must be set of the both case and not only
    for key frames.
    
    Signed-off-by: Benjamin Gaignard 
    Reported-by: Jianfeng Liu 
    Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder")
    Cc: stable@vger.kernel.org
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 829dde3369a91ad637ac15629ea8d73f3db2c562
Author: Cosmin Tanislav 
Date:   Fri Jan 9 16:39:10 2026 +0200

    pinctrl: renesas: rzt2h: Add GPIO IRQ chip to handle interrupts
    
    The Renesas RZ/T2H (R9A09G077) and Renesas RZ/N2H (R9A09G087) SoCs have
    IRQ-capable pins handled by the ICU, which forwards them to the GIC.
    
    The ICU supports 16 IRQ lines, the pins map to these lines arbitrarily,
    and the mapping is not configurable.
    
    Add a GPIO IRQ chip to the pin controller that can be used to configure
    these pins as IRQ lines.
    
    The pin controller places the requested pins into IRQ function,
    disabling GPIO mode. A hierarchical IRQ domain is used to forward other
    functionality to the parent IRQ domain, the ICU. The ICU does level
    translation and then forwards other functionality to the GIC.
    
    Wakeup capability is implemented by placing the entire pin controller on
    the wakeup path if any pins are requested to be wakeup-capable.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20260109143910.645628-2-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit fb11a2493e685d0b733c2346f5b26f2e372584fb
Author: Luigi Rizzo 
Date:   Mon Jan 12 08:32:33 2026 +0000

    genirq: Move clear of kstat_irqs to free_desc()
    
    desc_set_defaults() has a loop to clear the per-cpu counters kstats_irq.
    
    This is only needed in free_desc(), which is used with non-sparse IRQs so
    that the interrupt descriptor can be recycled. For newly allocated
    descriptors, the memory comes from alloc_percpu() and is already zeroed
    out.
    
    Move the loop to free_desc() to avoid wasting time unnecessarily.
    
    Signed-off-by: Luigi Rizzo 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20260112083234.2665832-1-lrizzo@google.com

commit df439718afaf23b5aa7b5711b6c14e87b5836cae
Author: Radu Rendec 
Date:   Mon Jan 12 16:14:02 2026 -0500

    genirq: Update effective affinity for redirected interrupts
    
    For redirected interrupts, irq_chip_redirect_set_affinity() does not
    update the effective affinity mask, which then triggers the warning in
    irq_validate_effective_affinity(). Also, because the effective affinity
    mask is empty, the cpumask_test_cpu(smp_processor_id(), m) condition in
    demux_redirect_remote() is always false, and the interrupt is always
    redirected, even if it's already running on the target CPU.
    
    Set the effective affinity mask to be the same as the requested affinity
    mask. It's worth noting that irq_do_set_affinity() filters out offline
    CPUs before calling chip->irq_set_affinity() (unless `force` is set), so
    the mask passed to irq_chip_redirect_set_affinity() is already filtered.
    
    The solution is not ideal because it may lie about the effective
    affinity of the demultiplexed ("child") interrupt. If the requested
    affinity mask includes multiple CPUs, the effective affinity, in
    reality, is the intersection between the requested mask and the
    demultiplexing ("parent") interrupt's effective affinity mask, plus
    the first CPU in the requested mask.
    
    Accurately describing the effective affinity of the demultiplexed
    interrupt is not trivial because it requires keeping track of the
    demultiplexing interrupt's effective affinity. That is tricky in the
    context of CPU hot(un)plugging, where interrupt migration ordering is
    not guaranteed. The solution in the initial version of the fixed patch,
    which stored the first CPU of the demultiplexing interrupt's effective
    affinity in the `target_cpu` field, has its own drawbacks and
    limitations.
    
    Fixes: fcc1d0dabdb6 ("genirq: Add interrupt redirection infrastructure")
    Reported-by: Jon Hunter 
    Signed-off-by: Radu Rendec 
    Signed-off-by: Thomas Gleixner 
    Tested-by: Jon Hunter 
    Link: https://patch.msgid.link/20260112211402.2927336-1-rrendec@redhat.com
    Closes: https://lore.kernel.org/all/44509520-f29b-4b8a-8986-5eae3e022eb7@nvidia.com/

commit 347b7042fb26beaae1ea46d0f6c47251fb52985f
Merge: 8f0b4cce4481fb 81d2e13a57c9d7
Author: Christian Brauner 
Date:   Tue Jan 13 09:58:07 2026 +0100

    Merge patch series "fs: generic file IO error reporting"
    
    Darrick J. Wong  says:
    
    This patchset adds some generic helpers so that filesystems can report
    errors to fsnotify in a standard way.  Then it adapts iomap to use the
    generic helpers so that any iomap-enabled filesystem can report I/O
    errors through this mechanism as well.  Finally, it makes XFS report
    metadata errors through this mechanism in much the same way that ext4
    does now.
    
    These are a prerequisite for the XFS self-healing series which will
    come at a later time.
    
    * patches from https://patch.msgid.link/176826402528.3490369.2415315475116356277.stgit@frogsfrogsfrogs:
      ext4: convert to new fserror helpers
      xfs: translate fsdax media errors into file "data lost" errors when convenient
      xfs: report fs metadata errors via fsnotify
      iomap: report file I/O errors to the VFS
      fs: report filesystem and file I/O errors to fsnotify
      uapi: promote EFSCORRUPTED and EUCLEAN to errno.h
    
    Link: https://patch.msgid.link/176826402528.3490369.2415315475116356277.stgit@frogsfrogsfrogs
    Signed-off-by: Christian Brauner 

commit 81d2e13a57c9d73582527966fae24d4fd73826ca
Author: Darrick J. Wong 
Date:   Mon Jan 12 16:32:27 2026 -0800

    ext4: convert to new fserror helpers
    
    Use the new fserror functions to report metadata errors to fsnotify.
    Note that ext4 inconsistently passes around negative and positive error
    numbers all over the codebase, so we force them all to negative for
    consistency in what we report to fserror, and fserror ensures that only
    positive error numbers are passed to fanotify, per the fanotify(7)
    manpage.
    
    Signed-off-by: Darrick J. Wong 
    Link: https://patch.msgid.link/176826402693.3490369.5875002879192895558.stgit@frogsfrogsfrogs
    Reviewed-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 94503211d2fdcc5183d01c2719258a7795cdecb0
Author: Darrick J. Wong 
Date:   Mon Jan 12 16:32:12 2026 -0800

    xfs: translate fsdax media errors into file "data lost" errors when convenient
    
    Translate fsdax persistent failure notifications into file data loss
    events when it's convenient, aka when the inode is already incore.
    
    Signed-off-by: Darrick J. Wong 
    Link: https://patch.msgid.link/176826402673.3490369.1672039530408369208.stgit@frogsfrogsfrogs
    Reviewed-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit efd87a10072966e1555e1288a570c883c73182c3
Author: Darrick J. Wong 
Date:   Mon Jan 12 16:31:56 2026 -0800

    xfs: report fs metadata errors via fsnotify
    
    Report filesystem corruption problems to the fserror helpers so that
    fsnotify can also convey metadata problems to userspace.
    
    Signed-off-by: Darrick J. Wong 
    Link: https://patch.msgid.link/176826402652.3490369.2609467634858507969.stgit@frogsfrogsfrogs
    Reviewed-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit a9d573ee88af980f14fdadb5c12bbf6a195fb3f1
Author: Darrick J. Wong 
Date:   Mon Jan 12 16:31:40 2026 -0800

    iomap: report file I/O errors to the VFS
    
    Wire up iomap so that it reports all file read and write errors to the
    VFS (and hence fsnotify) via the new fserror mechanism.
    
    Signed-off-by: Darrick J. Wong 
    Link: https://patch.msgid.link/176826402631.3490369.729008983502742314.stgit@frogsfrogsfrogs
    Reviewed-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 21945e6cb5168395d7d6f9052cd16ec4eac13973
Author: Darrick J. Wong 
Date:   Mon Jan 12 16:31:25 2026 -0800

    fs: report filesystem and file I/O errors to fsnotify
    
    Create some wrapper code around struct super_block so that filesystems
    have a standard way to queue filesystem metadata and file I/O error
    reports to have them sent to fsnotify.
    
    If a filesystem wants to provide an error number, it must supply only
    negative error numbers.  These are stored internally as negative
    numbers, but they are converted to positive error numbers before being
    passed to fanotify, per the fanotify(7) manpage.  Implementations of
    super_operations::report_error are passed the raw internal event data.
    
    Note that we have to play some shenanigans with mempools and queue_work
    so that the error handling doesn't happen outside of process context,
    and the event handler functions (both ->report_error and fsnotify) can
    handle file I/O error messages without having to worry about whatever
    locks might be held.  This asynchronicity requires that unmount wait for
    pending events to clear.
    
    Add a new callback to the superblock operations structure so that
    filesystem drivers can themselves respond to file I/O errors if they so
    desire.  This will be used for an upcoming self-healing patchset for
    XFS.
    
    Suggested-by: Christoph Hellwig 
    Signed-off-by: Darrick J. Wong 
    Link: https://patch.msgid.link/176826402610.3490369.4378391061533403171.stgit@frogsfrogsfrogs
    Reviewed-by: Jan Kara 
    Reviewed-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 602544773763da411ffa67567fa1d146f3a40231
Author: Darrick J. Wong 
Date:   Mon Jan 12 16:31:09 2026 -0800

    uapi: promote EFSCORRUPTED and EUCLEAN to errno.h
    
    Stop definining these privately and instead move them to the uapi
    errno.h so that they become canonical instead of copy pasta.
    
    Cc: linux-api@vger.kernel.org
    Signed-off-by: Darrick J. Wong 
    Link: https://patch.msgid.link/176826402587.3490369.17659117524205214600.stgit@frogsfrogsfrogs
    Reviewed-by: Gao Xiang 
    Reviewed-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit aef30c8d569c0f31715447525640044c74feb26f
Author: Sebastian Andrzej Siewior 
Date:   Mon Jan 12 14:40:13 2026 +0100

    genirq: Warn about using IRQF_ONESHOT without a threaded handler
    
    IRQF_ONESHOT disables the interrupt source until after the threaded
    handler completed its work. This is needed to allow the threaded handler
    to run - otherwise the CPU will get back to the interrupt handler
    because the interrupt source remains active and the threaded handler
    will not able to do its work.
    
    Specifying IRQF_ONESHOT without a threaded handler does not make sense.
    It could be a leftover if the handler _was_ threaded and changed back to
    primary and the flag was not removed. This can be problematic in the
    `threadirqs' case because the handler is exempt from forced-threading.
    This in turn can become a problem on a PREEMPT_RT system if the handler
    attempts to acquire sleeping locks.
    
    Warn about missing threaded handlers with the IRQF_ONESHOT flag.
    
    Signed-off-by: Sebastian Andrzej Siewior 
    Signed-off-by: Thomas Gleixner 
    Reviewed-by: Laurent Pinchart 
    Link: https://patch.msgid.link/20260112134013.eQWyReHR@linutronix.de

commit 056a96e65f3e2a3293b99a336de92376407af5fa
Author: Jeff Layton 
Date:   Mon Jan 12 08:01:21 2026 -0500

    fuse: add setlease file operation
    
    Add the setlease file_operation to fuse_file_operations, pointing to
    generic_setlease.  A future patch will change the default behavior to
    reject lease attempts with -EINVAL when there is no setlease file
    operation defined. Add generic_setlease to retain the ability to set
    leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260112130121.25965-1-jlayton@kernel.org
    Signed-off-by: Christian Brauner 

commit 4a768c544f64eaa2fc7cfa91e46f43aa4aad0c40
Author: Vladimir Yakovlev 
Date:   Mon Dec 8 19:16:13 2025 +0300

    drm/panel: himax-hx83102: change to gpiod_set_value_cansleep
    
    It's better to use gpiod_set_value_cansleep because the panel can be
    connected via i2c/spi expander or similar external devices
    
    for reference see Documentation/driver-api/gpio/consumer.rst
    
    Signed-off-by: Vladimir Yakovlev 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251208161613.3763049-1-vovchkir@gmail.com

commit 94ccf742309be5373314a865a7d6512b9665eae4
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 13:32:19 2026 -0600

    dt-bindings: display: panel-simple: Allow "data-mapping" for "yes-optoelectronics,ytc700tlag-05-201c"
    
    The "data-mapping" property is in use already with the
    "yes-optoelectronics,ytc700tlag-05-201c" panel, so allow it in the
    schema.
    
    Signed-off-by: Rob Herring (Arm) 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260105193220.3166778-1-robh@kernel.org

commit 8096e71bc875485dd34aa8bf5af15ab3c443cb54
Author: Sebastian Krzyszkowiak 
Date:   Mon Jan 5 21:24:44 2026 +0100

    drm/panel: mantix: Don't turn on MIPI peripheral
    
    It's not necessary with these panels.
    
    Signed-off-by: Sebastian Krzyszkowiak 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260105-mantix-halo-fixes-v1-5-1ebc9b195a34@puri.sm

commit c8b59651ebe678da004b71e8c20f79ed6881ea8d
Author: Sebastian Krzyszkowiak 
Date:   Mon Jan 5 21:24:43 2026 +0100

    drm/panel: mantix: Drop bank 9 initialization
    
    This command is part of LIC sequence included in FT8006P firmware.
    There's no need to repeat it here.
    
    Signed-off-by: Sebastian Krzyszkowiak 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260105-mantix-halo-fixes-v1-4-1ebc9b195a34@puri.sm

commit 61f028c13c42495964afb61974ec60c22230d81b
Author: Sebastian Krzyszkowiak 
Date:   Mon Jan 5 21:24:42 2026 +0100

    drm/panel: mantix: Improve power off sequence
    
    According to the sequence from section 7.3.4 of FT8006P datasheet,
    TP_RSTN and RESX should be asserted after disabling AVDD and AVEE and
    together with VDDI.
    
    Also, AVEE power down needs to happen at least 150ms after entering
    sleep mode.
    
    Signed-off-by: Sebastian Krzyszkowiak 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260105-mantix-halo-fixes-v1-3-1ebc9b195a34@puri.sm

commit dca84cc795df7f0cf790fbc2afcde53e6abd403a
Author: Sebastian Krzyszkowiak 
Date:   Mon Jan 5 21:24:41 2026 +0100

    drm/panel: mantix: Improve power on sequence timings
    
    FP8006P datasheet mentions:
    
    > It is necessary to wait 15msec after releasing RESX before sending
    > commands. Also Sleep Out command cannot be sent for 120 msec.
    
    This hasn't been respected by the driver so far, which could interfere
    with the LCD init code sequence performed by the controller. In some cases
    this leads to VCOM voltage being set to a wrong value, causing "halo"
    effects, temporary burn-in around the edges of the screen and degraded
    image contrast.
    
    T3 and T4 are counted from when VDDI is enabled. There's no need to add
    them when we've already waited more than that in T2 and T2d.
    
    While FT8006P datasheet does not mention a delay between exiting sleep
    mode and turning the display on, code provided by the vendor uses 120ms
    there and it happens to be the same value as required in newer datasheets
    for newer controllers from the same family, so it seems appropriate to
    use it here as well.
    
    Signed-off-by: Sebastian Krzyszkowiak 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260105-mantix-halo-fixes-v1-2-1ebc9b195a34@puri.sm

commit ef789ce4980b2bf9d61c53207f2b0aa1d32d9da8
Author: Sebastian Krzyszkowiak 
Date:   Mon Jan 5 21:24:40 2026 +0100

    drm/panel: mantix: Enable DSI LPM
    
    This improves reliability of sending DSI commands.
    
    Signed-off-by: Sebastian Krzyszkowiak 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260105-mantix-halo-fixes-v1-1-1ebc9b195a34@puri.sm

commit 95eed73b871111123a8b1d31cb1fce7e902e49ea
Author: Tuo Li 
Date:   Thu Dec 18 20:09:55 2025 +0800

    drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove()
    
    In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it
    may be NULL:
    
      if (!jdi)
        mipi_dsi_detach(dsi);
    
    However, when jdi is NULL, the function does not return and continues by
    calling jdi_panel_disable():
    
      err = jdi_panel_disable(&jdi->base);
    
    Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can
    lead to a NULL-pointer dereference:
    
      struct jdi_panel *jdi = to_panel_jdi(panel);
      backlight_disable(jdi->backlight);
    
    To prevent such a potential NULL-pointer dereference, return early from
    jdi_panel_dsi_remove() when jdi is NULL.
    
    Signed-off-by: Tuo Li 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251218120955.11185-1-islituo@gmail.com

commit ed7417e5b889769ef7f66edfd0f836fa812655bc
Author: Fabio Estevam 
Date:   Fri Jan 2 11:17:06 2026 -0300

    drm/panel: simple: Add Innolux G150XGE-L05 panel entry
    
    Add support for the Innolux G150XGE-L05 15.0" TFT 1024x768 LVDS panel.
    
    Signed-off-by: Fabio Estevam 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260102141706.36842-2-festevam@gmail.com

commit e7ec00be22d6563430f8e7bc44117cbcbf0fc1ee
Author: Fabio Estevam 
Date:   Fri Jan 2 11:17:05 2026 -0300

    dt-bindings: display: simple: Add Innolux G150XGE-L05 panel
    
    Add Innolux G150XGE-L05 15.0" TFT 1024x768 LVDS panel compatible string.
    
    Signed-off-by: Fabio Estevam 
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260102141706.36842-1-festevam@gmail.com

commit 65ce1f5834e9598e5120048010b4fe220e70473c
Author: Langyan Ye 
Date:   Tue Dec 16 15:55:30 2025 +0800

    drm/panel: ilitek-ili9882t: Switch Tianma TL121BVMS07 to DSC 120Hz mode
    
    Migrate the TL121BVMS07 panel from non-DSC 60 Hz to DSC-enabled 120 Hz,
    including updated init sequence, DSC configuration, and display timings.
    
    Signed-off-by: Langyan Ye 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251216075530.1966327-1-yelangyan@huaqin.corp-partner.google.com

commit 49e41f3ea3f7545c732a0b399cb123173afc5cfe
Author: Alexei Lazar 
Date:   Mon Jan 12 08:50:08 2026 +0200

    net/mlx5: Add IFC bits for extended ETS rate limit bandwidth value
    
    Add hardware interface definitions to support extended bandwidth rate
    limiting in the QoS Enhanced Transmission Selection (ETS) configuration.
    
    The new fields include:
    - max_bw_value: extended from 8-bit to 16-bit in ets_tcn_config_reg,
      simplifying the implementation by using a single field instead of
      separate MSB/LSB fields.
    - qetcr_qshr_max_bw_val_msb: capability bit in qcam_qos_feature_cap_mask
      indicating device support for the extended 16-bit max_bw_value field.
    
    These interface additions are prerequisites for increasing the per-TC
    rate limit beyond 255 Gbps to support higher-bandwidth NICs.
    
    Signed-off-by: Alexei Lazar 
    Reviewed-by: Dragos Tatulea 
    Reviewed-by: Gal Pressman 
    Signed-off-by: Tariq Toukan 
    Link: https://patch.msgid.link/1768200608-1543180-1-git-send-email-tariqt@nvidia.com
    Signed-off-by: Leon Romanovsky 

commit c5760e35d3a4b80c5e557a65d78b3bf6139f9419
Author: Rafael J. Wysocki 
Date:   Thu Jan 8 16:23:21 2026 +0100

    media: mediatek: vcodec: Discard pm_runtime_put() return value
    
    Printing error messages on pm_runtime_put() returning negative values
    is not particularly useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.
    
    Accordingly, update mtk_vcodec_enc_pw_off() and mtk_vcodec_dec_pw_off()
    to simply discard the return value of pm_runtime_put().
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 81f8e0e6a2e115df9274d0289779f8fca694479c
Author: Alper Ak 
Date:   Sat Dec 27 11:40:37 2025 +0300

    media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
    
    rga_get_frame() can return ERR_PTR(-EINVAL) when buffer type is
    unsupported or invalid. rga_buf_init() does not check the return value
    and unconditionally dereferences the pointer when accessing f->size.
    
    Add proper ERR_PTR checking and return the error to prevent
    dereferencing an invalid pointer.
    
    Fixes: 6040702ade23 ("media: rockchip: rga: allocate DMA descriptors per buffer")
    Cc: stable@vger.kernel.org
    Signed-off-by: Alper Ak 
    Reviewed-by: Michael Tretter 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 5633ec763a2a18cef6c5ac9250e4f4b8786e7999
Author: Ming Qian 
Date:   Tue Dec 23 14:27:52 2025 +0800

    media: amphion: Drop min_queued_buffers assignment
    
    The min_queued_buffers field controls when start_streaming() is called
    by the vb2 core (it delays the callback until at least N buffers are
    queued). Setting it to 1 affects the timing of start_streaming(), which
    breaks the seek flow in decoder scenarios and causes test failures.
    
    The current driver implementation does not rely on this minimum buffer
    requirement and handles streaming start correctly with the default
    value of 0, so remove these assignments.
    
    Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ming Qian 
    Reviewed-by: Nicolas Dufresne 
    Reviewed-by: Frank Li 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit d79c2165a48e87fc21136c323cb7822da69f8691
Author: Ming Qian 
Date:   Mon Dec 22 16:49:10 2025 +0800

    media: amphion: Use kmalloc instead of vmalloc
    
    Replace vmalloc/vfree with kmalloc/kfree for allocating small
    driver structures (vpu_inst, vdec_t, venc_t, vpu_cmd_t, and
    frame objects).
    
    vmalloc() is designed for large memory allocations and incurs
    unnecessary overhead for small objects due to virtual memory
    mapping. kmalloc() is more appropriate as it allocates physically
    contiguous memory with lower overhead.
    
    ftrace measurements of vpu_alloc_cmd() show significant improvement:
    
      Before (vmalloc):  35-72 us   (avg ~45.7 us)
      After (kmalloc):   11-26 us   (avg ~16.8 us)
    
    This reduces allocation time by approximately 63%.
    
    No functional changes are intended.
    
    Signed-off-by: Ming Qian 
    Reviewed-by: Nicolas Dufresne 
    Reviewed-by: Frank Li 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit bb22847d1134723d6ed67ef0aaeb44c6af53e3da
Author: Ming Qian 
Date:   Wed Dec 17 11:02:23 2025 +0800

    media: amphion: Trigger source change if colorspace changed
    
    After encountering a colorspace change in the stream, the decoder
    sends a V4L2_EVENT_SOURCE_CHANGE event with changes set to
    V4L2_EVENT_SRC_CH_RESOLUTION.
    
    Then the client can detect and handle the colorspace change without any
    buffer reallocation
    
    Signed-off-by: Ming Qian 
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit d85f3207d75df6d7a08be6526b15ff398668206c
Author: Ming Qian 
Date:   Wed Dec 17 11:02:22 2025 +0800

    media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
    
    The V4L2_DEC_CMD_START command may be used to handle the dynamic source
    change, which will triggers an implicit decoder drain.
    The last_buffer_dequeued flag is set in the implicit decoder drain,
    so driver need to clear it to continue the following decoding flow.
    
    Signed-off-by: Ming Qian 
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 8f1fd70fc7c3cad2faf0a1adde5e4399ecfae691
Author: Ming Qian 
Date:   Wed Dec 17 11:02:21 2025 +0800

    media: docs: dev-decoder: Trigger dynamic source change for colorspace
    
    If colorspace changes, the client needs to renegotiate the pipeline,
    otherwise the decoded frame may not be displayed correctly.
    
    So add colorspace as a trigger parameter for dynamic resolution change.
    
    Signed-off-by: Ming Qian 
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit d7b70ebf2bf4a9983fe64b8c221db55f15c4c56c
Author: Martin Blumenstingl 
Date:   Fri Jan 9 22:02:17 2026 +0100

    arm64: dts: amlogic: move CPU OPP table and clock assignment to SoC.dtsi
    
    Move the assignment of the CPU clocks and the CPU OPP table(s) from
    board.dts to SoC.dtsi to reduce the code duplication.
    
    Signed-off-by: Martin Blumenstingl 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260109210217.828961-1-martin.blumenstingl@googlemail.com
    Signed-off-by: Neil Armstrong 

commit 31fce0d2b13e6a4a12c9ba016e961418f8c82e34
Author: Nick Xie 
Date:   Tue Jan 13 09:25:27 2026 +0800

    soc: amlogic: meson-gx-socinfo: add new SoC id for S905Y4
    
    Add new definition for Amlogic S4 S905Y4.
    
    Signed-off-by: Nick Xie 
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20260113012527.40725-1-nick@khadas.com
    Signed-off-by: Neil Armstrong 

commit 6ea8a206108fe8b5940c2797afc54ae9f5a7bbdd
Author: Costa Shulyupin 
Date:   Mon Jan 12 21:26:41 2026 +0200

    rtla: Fix parse_cpu_set() bug introduced by strtoi()
    
    The patch 'Replace atoi() with a robust strtoi()' introduced a bug
    in parse_cpu_set(), which relies on partial parsing of the input string.
    
    The function parses CPU specifications like '0-3,5' by incrementing
    a pointer through the string. strtoi() rejects strings with trailing
    characters, causing parse_cpu_set() to fail on any CPU list with
    multiple entries.
    
    Restore the original use of atoi() in parse_cpu_set().
    
    Fixes: 7e9dfccf8f11 ("rtla: Replace atoi() with a robust strtoi()")
    Signed-off-by: Costa Shulyupin 
    Reviewed-by: Masami Hiramatsu (Google) 
    Link: https://lore.kernel.org/r/20260112192642.212848-2-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit 1d232f793d4dbffd329ad48b52954d4c8ca24db5
Author: Brian Masney 
Date:   Thu Jan 8 16:16:42 2026 -0500

    drm/msm/dsi_phy_14nm: convert from divider_round_rate() to divider_determine_rate()
    
    The divider_round_rate() function is now deprecated, so let's migrate
    to divider_determine_rate() instead so that this deprecated API can be
    removed.
    
    Note that when the main function itself was migrated to use
    determine_rate, this was mistakenly converted to:
    
        req->rate = divider_round_rate(...)
    
    This is invalid in the case when an error occurs since it can set the
    rate to a negative value.
    
    Fixes: cc41f29a6b04 ("drm/msm/dsi_phy_14nm: convert from round_rate() to determine_rate()")
    Signed-off-by: Brian Masney 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Abel Vesa 
    Patchwork: https://patchwork.freedesktop.org/patch/697613/
    Link: https://lore.kernel.org/r/20260108-clk-divider-round-rate-v1-24-535a3ed73bf3@redhat.com
    Signed-off-by: Dmitry Baryshkov 

commit 1a1b4d40b8e4566b6e55ca5c588c5a1943aa2f8e
Merge: 84220bfe9b794c e21c8e2e027633
Author: Sven Peter 
Date:   Tue Jan 13 08:03:14 2026 +0100

    Merge patch series "arm64: dts: apple: Add integrated USB Type-C ports"
    
    Janne Grunau  says:
    
    Now that all dependencies for USB 2.0 and 3.x support are either merged
    (tipd changes in v6.18, dwc3-apple in v6.19-rc1) or in linux-next (Apple
    Type-C PHY) prepare device tree changes to expose the ports.
    
    Each port on Apple silicon devices is driven by a separate collection of
    hardware blocks. For USB 2.0 and 3.x the collection consists of:
    - Apple Type-C PHY, combo PHY for USB 2.0, USB 3.x, USB4/Thunderbolt and
      DisplayPort
    - Synopsys Designware dwc3 USB controller
    - two DART iommu instances for dwc3
    - CD321x USB PD controller (similar to Ti's TPS6598x series)
    
    The CD321x nodes are already present so this series add the remaining
    devices nodes, typec connector nodes and connections between all
    components.
    
    The devices expose except for a few exceptions noted below all ports. M1
    and M2 have two ports, M1 and M2 Pro and Max have four ports and
    M1 and M2 Ultra have eight ports.
    The Pro and Max based Macbook Pros use only three ports. The fourth port
    is used as DisplayPort PHY to drive a HDMI output via an integrated
    DP to HDMI converter.
    The Ultra based Mac studio devices only use six ports. The third and
    fourth port on the second die is completely fused off.
    
    The changes for t600x and t602x are in a single commit since the devices
    share .dtsi files across SoC generations due to their similarity.
    
    Depends on commit c1538b87caef ("dt-bindings: phy: Add Apple Type-C
    PHY") in linux-phy's [1] next branch for `make dtbs_check` to pass.
    checkpatch warns about the undocumented DT compatible strings
    "apple,t8112-atcphy", "apple,t6000-atcphy" and "apple,t6020-atcphy" but
    not about "apple,t8103-atcphy". I don't under why it doesn't warn about
    the last. "apple,t8103-atcphy" is only found in the added devicetree
    files and nowhere else in v6.19-rc1.
    
    Tested on top of next-20260106 on M1, M2, M1 Max and M2 Pro Mac mini /
    Mac studio and a few fixes for dwc3-apple and atc [2, 3, 4, 5].
    
    Link: https://patch.msgid.link/20260109-apple-dt-usb-c-atc-dwc3-v1-0-ce0e92c1a016@jannau.net
    Signed-off-by: Sven Peter 

commit e21c8e2e027633875e874a3bd38318c940416b0f
Author: Janne Grunau 
Date:   Fri Jan 9 15:07:06 2026 +0100

    arm64: dts: apple: t60xx: Add nodes for integrated USB Type-C ports
    
    Add device nodes and connections to support USB 3.x on the SoC's
    integrated Type-C ports of M1 and M2 Pro, Max and Ultra based devices.
    Each Type-C port has an Apple Type-C PHY for USB 2.0, USB 3.x,
    USB4/Thunderbolt, and DisplayPort, a Synopsys Designware USB 3.x
    controller, two DART iommu instances and a CD321x USB PD controller.
    M1 and M2 Max based Mac Studio device have two additional USB Type-C
    ports on the front which are driven by an AsMedia PCIe USB controller
    and integrated USB hub. These ports are not covered by this change.
    The port labels use Apple's established naming scheme for the ports.
    
    Co-developed-by: R 
    Signed-off-by: R 
    Co-developed-by: Hector Martin 
    Signed-off-by: Hector Martin 
    Signed-off-by: Janne Grunau 
    Tested-by: Sven Peter  # M1 mac mini and macbook air
    Reviewed-by: Sven Peter 
    Reviewed-by: Neal Gompa 
    Link: https://patch.msgid.link/20260109-apple-dt-usb-c-atc-dwc3-v1-3-ce0e92c1a016@jannau.net
    Signed-off-by: Sven Peter 

commit b4f4054864e6395672c06efd0bbfcf6777d43c97
Author: Hector Martin 
Date:   Fri Jan 9 15:07:05 2026 +0100

    arm64: dts: apple: t8112: Add nodes for integrated USB Type-C ports
    
    Add device nodes and connections to support USB 3.x on the SoC's
    integrated USBi Type-C ports of M2-based devices.
    Each Type-C port has an Apple Type-C PHY for USB 2.0, USB 3.x,
    USB4/Thunderbolt, and DisplayPort, a Synopsys Designware USB 3.x
    controller, two DART iommu instances and a CD321x USB PD controller.
    The port labels use Apple's established naming scheme for the ports.
    
    Signed-off-by: Hector Martin 
    Co-developed-by: Janne Grunau 
    Signed-off-by: Janne Grunau 
    Tested-by: Sven Peter  # M1 mac mini and macbook air
    Reviewed-by: Sven Peter 
    Reviewed-by: Neal Gompa 
    Link: https://patch.msgid.link/20260109-apple-dt-usb-c-atc-dwc3-v1-2-ce0e92c1a016@jannau.net
    Signed-off-by: Sven Peter 

commit 2b737cc5be70b280cd6f8e25c306bc94d4189b41
Author: Hector Martin 
Date:   Fri Jan 9 15:07:04 2026 +0100

    arm64: dts: apple: t8103: Add nodes for integrated USB Type-C ports
    
    Add device nodes and connections to support USB 3.x on the SoC's
    integrated USB-C ports of M1-based devices.
    Each Type-C port has an Apple Type-C PHY for USB 2.0, USB 3.x,
    USB4/Thunderbolt, and DisplayPort, a Synopsys Designware USB 3.x
    controller, two DART iommu instances and a CD321x USB PD controller.
    The iMac variant with four USB-C ports has two SoC integrated USB-C
    ports and two additional USB-C ports driven by an AsMedia PCIe USB
    controller. The latter ports are not covered by this change.
    The port labels use Apple's established naming scheme for the ports.
    
    Signed-off-by: Hector Martin 
    Co-developed-by: Sven Peter 
    Signed-off-by: Janne Grunau 
    Tested-by: Sven Peter  # M1 mac mini and macbook air
    Reviewed-by: Sven Peter 
    Reviewed-by: Neal Gompa 
    Link: https://patch.msgid.link/20260109-apple-dt-usb-c-atc-dwc3-v1-1-ce0e92c1a016@jannau.net
    Signed-off-by: Sven Peter 

commit 84220bfe9b794c051f927e1374c90ce288295b96
Author: Janne Grunau 
Date:   Thu Jan 8 22:04:03 2026 +0100

    arm64: dts: apple: t8103: Add ps_pmp dependency to ps_gfx
    
    AGX appears to have a hidden communication channel to pmp, a power
    management related co-processor already brought up by Apple's
    bootloader. As there is not driver for this co-processor its
    power-domain gets shut down after the initial boot.
    This crashes the firmware running on AGX immediately.
    Until there is a pmp driver and the dependency between AGX and pmp is
    understood keep "ps_pmp" as dependency of "ps_gfx".
    
    Signed-off-by: Janne Grunau 
    Link: https://patch.msgid.link/20260108-apple-dt-pmgr-fixes-v1-3-cfdce629c0a8@jannau.net
    Signed-off-by: Sven Peter 

commit 54347056828d9a0d92c1696cf1571a3ed4b6010f
Author: Hector Martin 
Date:   Thu Jan 8 22:04:02 2026 +0100

    arm64: dts: apple: t8103: Mark ATC USB AON domains as always-on
    
    Shutting these down breaks dwc3 init done by the firmware. We probably
    never want to do this anyway. "always-on" is a plausible interpretation
    of the "aon" suffix.
    The t8112, t600x and t602x "ps_atc?_usb_aon" power-controller nodes are
    have already "apple,always-on" properties.
    
    Signed-off-by: Hector Martin 
    Signed-off-by: Janne Grunau 
    Link: https://patch.msgid.link/20260108-apple-dt-pmgr-fixes-v1-2-cfdce629c0a8@jannau.net
    [sven: removed stale comment about PHY from commit message]
    Signed-off-by: Sven Peter 

commit 3e4e729325131fe6f7473a0673f7d8cdde53f5a0
Author: Janne Grunau 
Date:   Thu Jan 8 22:04:01 2026 +0100

    arm64: dts: apple: t8112-j473: Keep the HDMI port powered on
    
    Add the display controller and DPTX phy power-domains to the framebuffer
    node to keep the framebuffer and display out working after device probing
    finished.
    The OS has more control about the display pipeline used for the HDMI
    output on M2 based devices. The HDMI output is driven by an integrated
    DisplayPort to HDMI converter (Parade PS190). The DPTX phy is now
    controlled by the OS and no longer by firmware running on the display
    co-processor. This allows using the second display controller on the
    second USB type-c port or tunneling 2 DisplayPort connections over
    USB4/Thunderbolt.
    The m1n1 bootloader uses the second display controller to drive the HDMI
    output. Adjust for this difference compared to the notebooks as well.
    
    Fixes: 2d5ce3fbef32 ("arm64: dts: apple: t8112: Initial t8112 (M2) device trees")
    Cc: stable@vger.kernel.org
    Signed-off-by: Janne Grunau 
    Link: https://patch.msgid.link/20260108-apple-dt-pmgr-fixes-v1-1-cfdce629c0a8@jannau.net
    Signed-off-by: Sven Peter 

commit ba9dbb701e9fd3a8411be72ca22dc51f52fa2eee
Author: Janne Grunau 
Date:   Fri Jan 9 16:25:46 2026 +0100

    arm64: dts: apple: Add chassis-type property for Apple iMacs
    
    Apple iMac (M1, 2021) are all-in-one devices with an integrated display.
    
    Signed-off-by: Janne Grunau 
    Reviewed-by: Neal Gompa 
    Reviewed-by: Mark Kettenis 
    Link: https://patch.msgid.link/20260109-apple-dt-chassis-type-v1-4-c215503734c5@jannau.net
    Signed-off-by: Sven Peter 

commit 126ee92bff557853d15f57997c2cb16c14259c00
Author: Janne Grunau 
Date:   Fri Jan 9 16:25:45 2026 +0100

    arm64: dts: apple: Add chassis-type property for Mac Pro
    
    The tower and rack mount Mac Pro variants share the same .dts file and
    are identical except for the chassis. There doesn't appear to be a
    property in Apple's device tree to distinguish these two devices so use
    "server" as chassis type which describes both if one doesn't look too
    carefully.
    
    Signed-off-by: Janne Grunau 
    Reviewed-by: Neal Gompa 
    Reviewed-by: Mark Kettenis 
    Link: https://patch.msgid.link/20260109-apple-dt-chassis-type-v1-3-c215503734c5@jannau.net
    Signed-off-by: Sven Peter 

commit 5a7277c1bc19624b0644ab3e89b215a1d480e781
Author: Janne Grunau 
Date:   Fri Jan 9 16:25:44 2026 +0100

    arm64: dts: apple: Add chassis-type property for Apple desktop devices
    
    Apple's Mac mini and Studio are desktop devices. The SMBIOS has chassis
    types which might be more accurate like "low profile desktop" or "mini
    pc" but without clear definition what those are use plain "desktop" as
    chassis-type in the root node.
    
    Signed-off-by: Janne Grunau 
    Reviewed-by: Neal Gompa 
    Reviewed-by: Mark Kettenis 
    Link: https://patch.msgid.link/20260109-apple-dt-chassis-type-v1-2-c215503734c5@jannau.net
    Signed-off-by: Sven Peter 

commit e9ea7552eb5ebff9f22a8517ac074277b9ddca95
Author: Janne Grunau 
Date:   Fri Jan 9 16:25:43 2026 +0100

    arm64: dts: apple: Add chassis-type property for all Macbooks
    
    All Macbook Air and Pro devices are laptops so annotate this as
    chassis-tpe in the root node.
    
    Signed-off-by: Janne Grunau 
    Reviewed-by: Neal Gompa 
    Reviewed-by: Mark Kettenis 
    Link: https://patch.msgid.link/20260109-apple-dt-chassis-type-v1-1-c215503734c5@jannau.net
    Signed-off-by: Sven Peter 

commit 23c39217d933380ee25f591b5e928780e9e69ec6
Author: Dmitry Baryshkov 
Date:   Sun Dec 28 06:02:29 2025 +0200

    drm/msm/mdp5: drop support for MSM8998, SDM630 and SDM660
    
    Currently MDP5 3.x (MSM8998, SDM630 and SDM660) platforms are support
    by both DPU and MDP5 drivers. Support for them in the DPU driver is
    mature enough, so it's no longer sensible to keep them enabled in the
    MDP5 driver. Not to mention that MSM8998 never used an MDP5 compatible
    string. Drop support for the MDP5 3.x genration inside the MDP5
    driver and migrate those to the DPU driver only.
    
    Note: this will break if one uses the DT generated before v6.3 as they
    had only the generic, "qcom,mdp5" compatible string for SDM630 and
    SDM660. However granted that we had two LTS releases inbetween I don't
    think it is an issue.
    
    Patchwork: https://patchwork.freedesktop.org/patch/696491/
    Link: https://lore.kernel.org/r/20251228-mdp5-drop-dpu3-v4-3-7497c3d39179@oss.qualcomm.com
    Tested-by: Alexey Minnekhanov 
    Signed-off-by: Dmitry Baryshkov 

commit 59ca3d11f5311d9167015fe4f431701614ae0048
Author: Dmitry Baryshkov 
Date:   Sun Dec 28 06:02:28 2025 +0200

    drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
    
    DPU units before 4.x don't have a separate CTL_START IRQ to mark the
    begin of the data transfer. In such a case, wait for the frame transfer
    to complete rather than trying to wait for the CTL_START interrupt (and
    obviously hitting the timeout).
    
    Fixes: 050770cbbd26 ("drm/msm/dpu: Fix timeout issues on command mode panels")
    Reported-by: Alexey Minnekhanov 
    Closes: https://lore.kernel.org/r/8e1d33ff-d902-4ae9-9162-e00d17a5e6d1@postmarketos.org
    Patchwork: https://patchwork.freedesktop.org/patch/696490/
    Link: https://lore.kernel.org/r/20251228-mdp5-drop-dpu3-v4-2-7497c3d39179@oss.qualcomm.com
    Tested-by: Alexey Minnekhanov 
    Signed-off-by: Dmitry Baryshkov 

commit f4a8e3a34ea4129c743c0d1d050b91b6511abf11
Author: Dmitry Baryshkov 
Date:   Sun Dec 28 06:02:27 2025 +0200

    drm/msm/dpu: drop intr_start from DPU 3.x catalog files
    
    DPU 3.x don't have separate intr_start interrupt, drop it from catalog
    files.
    
    Fixes: 94391a14fc27 ("drm/msm/dpu1: Add MSM8998 to hw catalog")
    Fixes: 7204df5e7e68 ("drm/msm/dpu: add support for SDM660 and SDM630 platforms")
    Patchwork: https://patchwork.freedesktop.org/patch/696488/
    Link: https://lore.kernel.org/r/20251228-mdp5-drop-dpu3-v4-1-7497c3d39179@oss.qualcomm.com
    Tested-by: Alexey Minnekhanov 
    Signed-off-by: Dmitry Baryshkov 

commit 2f3ff6ab8f5cd6359348999a34315eb3f6d52915
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:39 2025 +0200

    drm/msm/dpu: use standard functions in _dpu_format_populate_plane_sizes_ubwc()
    
    The _dpu_format_populate_plane_sizes_ubwc() used MSM_MEDIA_ALIGN() and
    MSM_MEDIA_ROUNDUP(), macros inherited from the previous implementation,
    msm_media_info.h. Replace them with the standard Linux macros,
    round_up() and DIV_ROUND_UP() respectively.
    
    Patchwork: https://patchwork.freedesktop.org/patch/688182/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-12-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit ada4a19ed21c350fe39bbcdf92d16bf68e825dd4
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:38 2025 +0200

    drm/msm/dpu: rewrite _dpu_format_populate_plane_sizes_ubwc()
    
    Drop extra wrapping layer (msm_media_info.h) and inline all VENUS_*()
    functions, simplifying the code.
    
    Patchwork: https://patchwork.freedesktop.org/patch/688184/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-11-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit d4db3a06c5baa11e170a1999c6a0aaa110ffd972
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:37 2025 +0200

    drm/msm/dpu: drop redundant num_planes assignment in _dpu_format_populate_plane_sizes*()
    
    Drop redundant layout->num_planes assignments, using the value assigned
    from the formats table. RGB UBWC formats need special handling: they use
    two planes (per the format table), but the uAPI defines plane[1] as
    empty.
    
    Reviewed-by: Jessica Zhang 
    Patchwork: https://patchwork.freedesktop.org/patch/688180/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-10-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit 72f20360d4cc5c78dc6be0b8d0d8f33b45a4b9a1
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:36 2025 +0200

    drm/msm/dpu: simplify _dpu_format_populate_plane_sizes_*
    
    Move common bits of _dpu_format_populate_plane_sizes_ubwc() and
    _linear() to dpu_format_populate_plane_sizes(), reducing unnecessary
    duplication and simplifying code flow fror the UBWC function.
    
    Reviewed-by: Jessica Zhang 
    Patchwork: https://patchwork.freedesktop.org/patch/688178/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-9-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit 3705de1965df85701c486b6c21304abfbd80ad93
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:35 2025 +0200

    drm/msm/disp: drop PSEUDO_YUV_FMT_LOOSE_TILED
    
    Drop PSEUDO_YUV_FMT_LOOSE_TILED(), the macro is unused.
    
    Reviewed-by: Jessica Zhang 
    Patchwork: https://patchwork.freedesktop.org/patch/688176/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-8-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit a4378e4bb138bf065e720ac9dc57efbf5ac60afd
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:34 2025 +0200

    drm/msm/disp: pull in common tiled YUV format parameters
    
    Pull common params of tiled YUV formats into corresponding macro
    definitions, simplifying format table.
    
    Patchwork: https://patchwork.freedesktop.org/patch/688174/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-7-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit 72ca4e9d0410b1a21ea0d0dc142a11817f274c47
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:33 2025 +0200

    drm/msm/disp: pull in common YUV format parameters
    
    Pull common params of YUV formats into corresponding macro definitions,
    simplifying format table.
    
    Reviewed-by: Jessica Zhang 
    Patchwork: https://patchwork.freedesktop.org/patch/688171/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-6-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit 2bd6ae0edf76dd1aa02c6ec0ae71fa21c389a7af
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:32 2025 +0200

    drm/msm/disp: simplify tiled RGB{,A,X} formats definitions
    
    Define several additional macros, capturing tiled RGB format classes, in
    order to simplify defining particular RGB* format.
    
    Reviewed-by: Jessica Zhang 
    Patchwork: https://patchwork.freedesktop.org/patch/688169/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-5-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit 8549e95a4b54eef1b4bf65956b1621ffaa7253ac
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:31 2025 +0200

    drm/msm/disp: simplify RGB{,A,X} formats definitions
    
    Define several additional macros, capturing RGB format classes, in order
    to simplify defining particular RGB* format.
    
    Reviewed-by: Jessica Zhang 
    Patchwork: https://patchwork.freedesktop.org/patch/688168/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-4-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit adcd6dfea82ec6083ad5bb80cad6e90b34f06e59
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:30 2025 +0200

    drm/msm/disp: set num_planes, fetch_mode and tile_height in INTERLEAVED_RGB_FMT_TILED
    
    All interleaved compressed RGB formats use only 2 planes,
    MDP_FETCH_LINEAR and MDP_TILE_HEIGHT_UBWC. Specify num_planes,
    fetch_mode and tile_height directly in the macro and remove unused
    parameters.
    
    Patchwork: https://patchwork.freedesktop.org/patch/688166/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-3-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit 4066b57678b09d55c3ce8784e552006d592b4ad8
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:29 2025 +0200

    drm/msm/disp: set num_planes and fetch_mode in INTERLEAVED_RGB_FMT
    
    All interleaved RGB formats use only 1 plane and MDP_FETCH_LINEAR.
    Specify num_planes and fetch_mode directly in the macro and remove
    unused parameters.
    
    Reviewed-by: Jessica Zhang 
    Patchwork: https://patchwork.freedesktop.org/patch/688163/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-2-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit 6421e1c5075b7e1536a8fcbe6b4086db07103048
Author: Dmitry Baryshkov 
Date:   Fri Nov 14 05:43:28 2025 +0200

    drm/msm/disp: set num_planes to 1 for interleaved YUV formats
    
    Interleaved YUV formats use only one plane for all pixel data. Specify
    num_planes = 1 for those formats. This was left unnoticed since
    _dpu_format_populate_plane_sizes_linear() overrides layout->num_planes.
    
    Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
    Reviewed-by: Jessica Zhang 
    Patchwork: https://patchwork.freedesktop.org/patch/688162/
    Link: https://lore.kernel.org/r/20251114-dpu-formats-v3-1-cae312379d49@oss.qualcomm.com
    Tested-by: Luca Weiss  # qcm6490-fairphone-fp5
    Signed-off-by: Dmitry Baryshkov 

commit 62a8efafefc24c2faaf2b5d8185b980c2269c2a6
Author: Arunpravin Paneer Selvam 
Date:   Mon Jan 12 17:10:22 2026 +0530

    MAINTAINERS: drm: add maintainers for DRM buddy allocator
    
    The DRM buddy allocator is a shared DRM memory management
    component used by multiple DRM drivers.
    
    Matthew Auld and Arun Pravin have been actively involved in
    maintaining this code, including patch review and functional
    changes.
    
    Add a dedicated MAINTAINERS entry to reflect the current
    maintainership.
    
    v2: Include drivers/gpu/drm/tests/drm_buddy_test.c file (Matthew).
    
    Signed-off-by: Arunpravin Paneer Selvam 
    Acked-by: Matthew Auld 
    Acked-by: Christian König 
    Link: https://patch.msgid.link/20260112114022.315139-1-Arunpravin.PaneerSelvam@amd.com

commit cbe8e6bef6a3b4b895b47ea56f5952f1936aacb6
Merge: 0391ab577c6e2e ce24299b5b7791
Author: Jakub Kicinski 
Date:   Mon Jan 12 19:36:51 2026 -0800

    Merge branch 'net-stmmac-pcs-clean-up-pcs-interrupt-handling'
    
    Russell King says:
    
    ====================
    net: stmmac: pcs: clean up pcs interrupt handling
    
    Clean up the stmmac PCS interrupt handling:
    
    - Avoid promotion to unsigned long from unsigned int by defining PCS
      register bits/fields using u32 macros.
    - Pass struct stmmac_priv into the host_irq_status MAC core method.
    - Move the existing PCS interrupt handler (dwmac_pcs_isr) into
      stmmac_pcs.c, change it's arguments, use dev_info() rather than
      pr_info()
    - arrange to call phylink_pcs_change() on link state changes.
    ====================
    
    Link: https://patch.msgid.link/aWOiOfDQkMXDwtPp@shell.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit ce24299b5b7791a94c67f4d87eb07de0ef2cb5e0
Author: Russell King (Oracle) 
Date:   Sun Jan 11 13:15:29 2026 +0000

    net: stmmac: report PCS link changes to phylink
    
    Report PCS link changes to phylink, which will allow phylink's inband
    support to respoind to link events once the PCS is appropriately
    configured.
    
    An expected behavioural change is that should the PCS report that its
    link has failed, but phylink is operating in outband mode and the PHY
    reports that link is up, this event will cause the netdev's link to
    momentarily drop, making the event more noticable, rather than just
    producing a "stmmac_pcs: Link Down" message.
    
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vevI1-00000002Yp8-3cM3@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 52f37fd9f4dc93733c910282e761732f45f2921c
Author: Russell King (Oracle) 
Date:   Sun Jan 11 13:15:24 2026 +0000

    net: stmmac: change arguments to PCS handler and use dev_info()
    
    Change the arguments to the PCS handler so that it can access the
    struct device pointer and integrated PCS pointers.
    
    This allows us to use the PCS register offset stored in struct
    stmmac_pcs rather than passing it into the function, and also allows
    the messages to be printed using dev_info() rather than pr_info(),
    thereby allowing the stmmac instance to be identified.
    
    Finally, as dev_info() identifies the driver/device, prefixing with
    "stmmac_pcs: " is now redundant, so replace this with just "PCS ".
    
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vevHw-00000002Yoz-35A7@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit aa9061269215e4733c2a5e7a5581a5d848165959
Author: Russell King (Oracle) 
Date:   Sun Jan 11 13:15:19 2026 +0000

    net: stmmac: pass struct stmmac_priv to host_irq_status() method
    
    Rather than passing struct mac_device_info to the host_irq_status()
    method, pass struct stmmac_priv so that we can pass the integrated
    PCS to the PCS interrupt handler.
    
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vevHr-00000002YoY-2X2i@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 879070eb4cf7d7fb29fef65de209a73a8cd178b2
Author: Russell King (Oracle) 
Date:   Sun Jan 11 13:15:14 2026 +0000

    net: stmmac: move and rename dwmac_pcs_isr()
    
    dwmac_pcs_isr() doesn't need to be inlined into the MAC's
    host_irq_status method, as handling PCS interrupts isn't performance
    critical. However, there is little point calling this function unless
    an interrupt is pending for the PCS.
    
    Rename it to stmmac_integrated_pcs_irq() while moving it.
    
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vevHm-00000002YoS-23RX@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit a2745a99ca4ebe6cb7839441685fd8cd82fc4b11
Author: Russell King (Oracle) 
Date:   Sun Jan 11 13:15:09 2026 +0000

    net: stmmac: use BIT_U32() and GENMASK_U32() for PCS registers
    
    stmmac registers a 32-bit. u32 is unsigned int. The use of BIT() and
    GENMASK() leads to integer promotion to unsigned long in expressions
    such as:
    
            u32 old = foo;
    
            dev_info(dev, "%08x %08x\n", old, old & BIT(1));
    
    resulting in arg2 being accepted as compatible with the format string
    and arg3 warning that the argument does not match (because the former
    is unsigned int, and the latter is unsigned long.)
    
    Fix this by defining 32-bit register bits using BIT_U32() and
    GENMASK_U32() macros.
    
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vevHh-00000002YoM-1TYL@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 0391ab577c6e2ed7a0d8cb3e7a1da58497b6ff4f
Author: Eric Dumazet 
Date:   Fri Jan 9 20:38:36 2026 +0000

    net: add skbuff_clear() helper
    
    clang is unable to inline the memset() calls in net/core/skbuff.c
    when initializing allocated sk_buff.
    
    memset(skb, 0, offsetof(struct sk_buff, tail));
    
    This is unfortunate, because:
    
    1) calling external memset_orig() helper adds a call/ret and
       typical setup cost.
    
    2) offsetof(struct sk_buff, tail) == 0xb8 = 0x80 + 0x38
    
       On x86_64, memset_orig() performs two 64 bytes clear,
       then has to loop 7 times to clear the final 56 bytes.
    
    skbuff_clear() makes sure the minimal and optimal code
    is generated.
    
    Signed-off-by: Eric Dumazet 
    Link: https://patch.msgid.link/20260109203836.1667441-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski 

commit d7161b07904797563023cc48822c86d3c41abf2c
Merge: ae4744e173fadd fef0f545511f72
Author: Jakub Kicinski 
Date:   Mon Jan 12 19:29:13 2026 -0800

    Merge branch 'r8169-add-support-for-rtl8127atf-10g-fiber-sfp'
    
    Heiner Kallweit says:
    
    ====================
    r8169: add support for RTL8127ATF (10G Fiber SFP)
    
    RTL8127ATF supports a SFP+ port for fiber modules (10GBASE-SR/LR/ER/ZR and
    DAC). The list of supported modes was provided by Realtek. According to the
    r8127 vendor driver also 1G modules are supported, but this needs some more
    complexity in the driver, and only 10G mode has been tested so far.
    Therefore mainline support will be limited to 10G for now.
    The SFP port signals are hidden in the chip IP and driven by firmware.
    Therefore mainline SFP support can't be used here.
    The PHY driver is used by the RTL8127ATF support in r8169.
    RTL8127ATF reports the same PHY ID as the TP version. Therefore use a dummy
    PHY ID.
    ====================
    
    Link: https://patch.msgid.link/c2ad7819-85f5-4df8-8ecf-571dbee8931b@gmail.com
    Signed-off-by: Jakub Kicinski 

commit fef0f545511f72223481aab1fd24d5f8f1c9d774
Author: Heiner Kallweit 
Date:   Sat Jan 10 16:15:32 2026 +0100

    r8169: add support for RTL8127ATF (Fiber SFP)
    
    RTL8127ATF supports a SFP+ port for fiber modules (10GBASE-SR/LR/ER/ZR and
    DAC). The list of supported modes was provided by Realtek. According to the
    r8127 vendor driver also 1G modules are supported, but this needs some more
    complexity in the driver, and only 10G mode has been tested so far.
    Therefore mainline support will be limited to 10G for now.
    The SFP port signals are hidden in the chip IP and driven by firmware.
    Therefore mainline SFP support can't be used here.
    
    Signed-off-by: Heiner Kallweit 
    Tested-by: Fabio Baltieri 
    Link: https://patch.msgid.link/5c390273-458f-4d92-896b-3d85f2998d7d@gmail.com
    Signed-off-by: Jakub Kicinski 

commit c4277d21ab694c7964a48759a5452e5bbbe12965
Author: Heiner Kallweit 
Date:   Sat Jan 10 16:14:05 2026 +0100

    net: phy: realtek: add dummy PHY driver for RTL8127ATF
    
    RTL8127ATF supports a SFP+ port for fiber modules (10GBASE-SR/LR/ER/ZR and
    DAC). The list of supported modes was provided by Realtek. According to the
    r8127 vendor driver also 1G modules are supported, but this needs some more
    complexity in the driver, and only 10G mode has been tested so far.
    Therefore mainline support will be limited to 10G for now.
    The SFP port signals are hidden in the chip IP and driven by firmware.
    Therefore mainline SFP support can't be used here.
    This PHY driver is used by the RTL8127ATF support in r8169.
    RTL8127ATF reports the same PHY ID as the TP version. Therefore use a dummy
    PHY ID.  This PHY driver is used by the RTL8127ATF support in r8169.
    
    Signed-off-by: Heiner Kallweit 
    Link: https://patch.msgid.link/e3d55162-210a-4fab-9abf-99c6954eee10@gmail.com
    Signed-off-by: Jakub Kicinski 

commit ae4744e173fadd092c43eda4ca92dcb74645225a
Author: Jian Zhang 
Date:   Thu Jan 8 18:18:29 2026 +0800

    net: mctp-i2c: fix duplicate reception of old data
    
    The MCTP I2C slave callback did not handle I2C_SLAVE_READ_REQUESTED
    events. As a result, i2c read event will trigger repeated reception of
    old data, reset rx_pos when a read request is received.
    
    Signed-off-by: Jian Zhang 
    Link: https://patch.msgid.link/20260108101829.1140448-1-zhangjian.3032@bytedance.com
    Signed-off-by: Jakub Kicinski 

commit aab8aa1b8a1892ccbd2d2d54f93bb273223d7546
Merge: 088f35ab9fd4a0 40ca42c8429b5d
Author: Jakub Kicinski 
Date:   Mon Jan 12 19:20:59 2026 -0800

    Merge branch 'add-dwmac-glue-driver-for-motorcomm-yt6801'
    
    Yao Zi says:
    
    ====================
    Add DWMAC glue driver for Motorcomm YT6801
    
    This series adds glue driver for Motorcomm YT6801 PCIe ethernet
    controller, which is considered mostly compatible with DWMAC-4 IP by
    inspecting the register layout[1]. It integrates a Motorcomm YT8531S PHY
    (confirmed by reading PHY ID) and GMII is used to connect the PHY to
    MAC[2].
    
    The initialization logic of the MAC is mostly based on previous upstream
    effort for the controller[3] and the Deepin-maintained downstream Linux
    driver[4] licensed under GPL-2.0 according to its SPDX headers. However,
    this series is a completely re-write of the previous patch series,
    utilizing the existing DWMAC4 driver and introducing a glue driver only.
    
    This series only aims to add basic networking functions for the
    controller, features like WoL, RSS and LED control are omitted for now.
    Testing is done on i3-4170, it reaches 939Mbps (TX)/933Mbps (RX) on
    average,
    
    YT6801 TX
    
    Connecting to host 192.168.114.51, port 5201
    [  5] local 192.168.114.50 port 52986 connected to 192.168.114.51 port 5201
    [ ID] Interval           Transfer     Bitrate         Retr  Cwnd
    [  5]   0.00-1.00   sec   112 MBytes   938 Mbits/sec    0    950 KBytes
    [  5]   1.00-2.00   sec   113 MBytes   949 Mbits/sec    0   1.08 MBytes
    [  5]   2.00-3.00   sec   112 MBytes   938 Mbits/sec    0   1.08 MBytes
    [  5]   3.00-4.00   sec   111 MBytes   932 Mbits/sec    0   1.13 MBytes
    [  5]   4.00-5.00   sec   113 MBytes   945 Mbits/sec    0   1.13 MBytes
    [  5]   5.00-6.00   sec   112 MBytes   936 Mbits/sec    0   1.13 MBytes
    [  5]   6.00-7.00   sec   112 MBytes   942 Mbits/sec    0   1.19 MBytes
    [  5]   7.00-8.00   sec   112 MBytes   935 Mbits/sec    0   1.19 MBytes
    [  5]   8.00-9.00   sec   113 MBytes   948 Mbits/sec    0   1.19 MBytes
    [  5]   9.00-10.00  sec   111 MBytes   931 Mbits/sec    0   1.19 MBytes
    
    YT6801 RX
    
    Connecting to host 192.168.114.50, port 5201
    [  5] local 192.168.114.51 port 41578 connected to 192.168.114.50 port 5201
    [ ID] Interval           Transfer     Bitrate         Retr  Cwnd
    [  5]   0.00-1.00   sec   113 MBytes   944 Mbits/sec    0    542 KBytes
    [  5]   1.00-2.00   sec   111 MBytes   934 Mbits/sec    0    850 KBytes
    [  5]   2.00-3.00   sec   111 MBytes   933 Mbits/sec    0   1.01 MBytes
    [  5]   3.00-4.00   sec   112 MBytes   943 Mbits/sec    0   1.01 MBytes
    [  5]   4.00-5.00   sec   111 MBytes   932 Mbits/sec    0   1.01 MBytes
    [  5]   5.00-6.00   sec   111 MBytes   929 Mbits/sec    0   1.01 MBytes
    [  5]   6.00-7.00   sec   112 MBytes   937 Mbits/sec    0   1.01 MBytes
    [  5]   7.00-8.00   sec   112 MBytes   941 Mbits/sec    0   1.01 MBytes
    [  5]   8.00-9.00   sec   111 MBytes   929 Mbits/sec    0   1.01 MBytes
    [  5]   9.00-10.00  sec   111 MBytes   932 Mbits/sec    0   1.01 MBytes
    ====================
    
    Link: https://patch.msgid.link/20260109093445.46791-2-me@ziyao.cc
    Signed-off-by: Jakub Kicinski 

commit 40ca42c8429b5d38e8f51f4e1794c2d3c8a9b1c7
Author: Yao Zi 
Date:   Fri Jan 9 09:34:46 2026 +0000

    MAINTAINERS: Assign myself as maintainer of Motorcomm DWMAC glue driver
    
    I volunteer to maintain the DWMAC glue driver for Motorcomm ethernet
    controllers.
    
    Signed-off-by: Yao Zi 
    Link: https://patch.msgid.link/20260109093445.46791-5-me@ziyao.cc
    Signed-off-by: Jakub Kicinski 

commit 02ff155ea2812ea25a086665522fd4fa196ef0ce
Author: Yao Zi 
Date:   Fri Jan 9 09:34:45 2026 +0000

    net: stmmac: Add glue driver for Motorcomm YT6801 ethernet controller
    
    Motorcomm YT6801 is a PCIe ethernet controller based on DWMAC4 IP. It
    integrates an GbE phy, supporting WOL, VLAN tagging and various types
    of offloading. It ships an on-chip eFuse for storing various vendor
    configuration, including MAC address.
    
    This patch adds basic glue code for the controller, allowing it to be
    set up and transmit data at a reasonable speed. Features like WOL could
    be implemented in the future.
    
    Signed-off-by: Yao Zi 
    Tested-by: Mingcong Bai 
    Tested-by: Runhua He 
    Tested-by: Xi Ruoyao 
    Reviewed-by: Sai Krishna 
    Link: https://patch.msgid.link/20260109093445.46791-4-me@ziyao.cc
    Signed-off-by: Jakub Kicinski 

commit 365e649361cde842c720ffa4b6a22fe092287990
Author: Yao Zi 
Date:   Fri Jan 9 09:34:44 2026 +0000

    net: phy: motorcomm: Support YT8531S PHY in YT6801 Ethernet controller
    
    YT6801's internal PHY is confirmed as a GMII-capable variant of YT8531S
    by a previous series[1] and reading PHY ID. Add support for
    PHY_INTERFACE_MODE_GMII for YT8531S to allow the Ethernet driver to
    reuse the PHY code for its internal PHY.
    
    Link: https://lore.kernel.org/all/a48d76ac-db08-46d5-9528-f046a7b541dc@motor-comm.com/ # [1]
    Co-developed-by: Frank Sae 
    Signed-off-by: Frank Sae 
    Signed-off-by: Yao Zi 
    Reviewed-by: Andrew Lunn 
    Reviewed-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/20260109093445.46791-3-me@ziyao.cc
    Signed-off-by: Jakub Kicinski 

commit 088f35ab9fd4a03b8c6ccdda7b92461d92bf7b8b
Author: Ankit Khushwaha 
Date:   Fri Jan 9 20:52:01 2026 +0530

    selftests/net/ipsec: Fix variable size type not at the end of struct
    
    The "struct alg" object contains a union of 3 xfrm structures:
    
            union {
                    struct xfrm_algo;
                    struct xfrm_algo_aead;
                    struct xfrm_algo_auth;
            }
    
    All of them end with a flexible array member used to store key material,
    but the flexible array appears at *different offsets* in each struct.
    bcz of this, union itself is of variable-sized & Placing it above
    char buf[...] triggers:
    
    ipsec.c:835:5: warning: field 'u' with variable sized type 'union
    (unnamed union at ipsec.c:831:3)' not at the end of a struct or class
    is a GNU extension [-Wgnu-variable-sized-type-not-at-end]
      835 |                 } u;
          |                   ^
    
    one fix is to use "TRAILING_OVERLAP()" which works with one flexible
    array member only.
    
    But In "struct alg" flexible array member exists in all union members,
    but not at the same offset, so TRAILING_OVERLAP cannot be applied.
    
    so the fix is to explicitly overlay the key buffer at the correct offset
    for the largest union member (xfrm_algo_auth). This ensures that the
    flexible-array region and the fixed buffer line up.
    
    No functional change.
    
    Reviewed-by: Simon Horman 
    Signed-off-by: Ankit Khushwaha 
    Link: https://patch.msgid.link/20260109152201.15668-1-ankitkhushwaha.linux@gmail.com
    Signed-off-by: Jakub Kicinski 

commit e405b3c9d4aaa10972525fe2ea5cf94224020561
Author: Thorsten Blum 
Date:   Fri Jan 9 13:11:29 2026 +0100

    net: ipconfig: Remove outdated comment and indent code block
    
    The comment has been around ever since commit 1da177e4c3f4
    ("Linux-2.6.12-rc2") and can be removed. Remove it and indent the code
    block accordingly.
    
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20260109121128.170020-2-thorsten.blum@linux.dev
    Signed-off-by: Jakub Kicinski 

commit 9c1a3525fd64839d71e0c1a21170003a4621e6e8
Merge: 5714ca8cba5ed7 99fde4d0626176
Author: Alexei Starovoitov 
Date:   Mon Jan 12 18:53:57 2026 -0800

    Merge branch 'use-correct-destructor-kfunc-types'
    
    Sami Tolvanen says:
    
    ====================
    While running BPF self-tests with CONFIG_CFI (Control Flow
    Integrity) enabled, I ran into a couple of failures in
    bpf_obj_free_fields() caused by type mismatches between the
    btf_dtor_kfunc_t function pointer type and the registered
    destructor functions.
    
    It looks like we can't change the argument type for these
    functions to match btf_dtor_kfunc_t because the verifier doesn't
    like void pointer arguments for functions used in BPF programs,
    so this series fixes the issue by adding stubs with correct types
    to use as destructors for each instance of this I found in the
    kernel tree.
    
    The last patch changes btf_check_dtor_kfuncs() to enforce the
    function type when CFI is enabled, so we don't end up registering
    destructors that panic the kernel.
    
    v5:
    - Rebased on bpf-next/master again.
    
    v4: https://lore.kernel.org/bpf/20251126221724.897221-6-samitolvanen@google.com/
    - Rebased on bpf-next/master.
    - Renamed CONFIG_CFI_CLANG to CONFIG_CFI.
    - Picked up Acked/Tested-by tags.
    
    v3: https://lore.kernel.org/bpf/20250728202656.559071-6-samitolvanen@google.com/
    - Renamed the functions and went back to __bpf_kfunc based
      on review feedback.
    
    v2: https://lore.kernel.org/bpf/20250725214401.1475224-6-samitolvanen@google.com/
    - Annotated the stubs with CFI_NOSEAL to fix issues with IBT
      sealing on x86.
    - Changed __bpf_kfunc to explicit __used __retain.
    
    v1: https://lore.kernel.org/bpf/20250724223225.1481960-6-samitolvanen@google.com/
    ====================
    
    Acked-by: Martin KaFai Lau 
    Link: https://patch.msgid.link/20260110082548.113748-6-samitolvanen@google.com
    Signed-off-by: Alexei Starovoitov 

commit 99fde4d0626176d03cea35c64a063df73816e64d
Author: Sami Tolvanen 
Date:   Sat Jan 10 08:25:53 2026 +0000

    bpf, btf: Enforce destructor kfunc type with CFI
    
    Ensure that registered destructor kfuncs have the same type
    as btf_dtor_kfunc_t to avoid a kernel panic on systems with
    CONFIG_CFI enabled.
    
    Signed-off-by: Sami Tolvanen 
    Acked-by: Yonghong Song 
    Link: https://lore.kernel.org/r/20260110082548.113748-10-samitolvanen@google.com
    Signed-off-by: Alexei Starovoitov 

commit ba7f1024a1024f219a18c40b4ab2d7d900fd2d15
Author: Sami Tolvanen 
Date:   Sat Jan 10 08:25:52 2026 +0000

    selftests/bpf: Use the correct destructor kfunc type
    
    With CONFIG_CFI enabled, the kernel strictly enforces that indirect
    function calls use a function pointer type that matches the target
    function. As bpf_testmod_ctx_release() signature differs from the
    btf_dtor_kfunc_t pointer type used for the destructor calls in
    bpf_obj_free_fields(), add a stub function with the correct type to
    fix the type mismatch.
    
    Signed-off-by: Sami Tolvanen 
    Acked-by: Yonghong Song 
    Link: https://lore.kernel.org/r/20260110082548.113748-9-samitolvanen@google.com
    Signed-off-by: Alexei Starovoitov 

commit c99d97b46631c4bea0c14b7581b7a59214601e63
Author: Sami Tolvanen 
Date:   Sat Jan 10 08:25:51 2026 +0000

    bpf: net_sched: Use the correct destructor kfunc type
    
    With CONFIG_CFI enabled, the kernel strictly enforces that indirect
    function calls use a function pointer type that matches the
    target function. As bpf_kfree_skb() signature differs from the
    btf_dtor_kfunc_t pointer type used for the destructor calls in
    bpf_obj_free_fields(), add a stub function with the correct type to
    fix the type mismatch.
    
    Signed-off-by: Sami Tolvanen 
    Acked-by: Yonghong Song 
    Link: https://lore.kernel.org/r/20260110082548.113748-8-samitolvanen@google.com
    Signed-off-by: Alexei Starovoitov 

commit b40a5d724f29fc2eed23ff353808a9aae616b48a
Author: Sami Tolvanen 
Date:   Sat Jan 10 08:25:50 2026 +0000

    bpf: crypto: Use the correct destructor kfunc type
    
    With CONFIG_CFI enabled, the kernel strictly enforces that indirect
    function calls use a function pointer type that matches the target
    function. I ran into the following type mismatch when running BPF
    self-tests:
    
      CFI failure at bpf_obj_free_fields+0x190/0x238 (target:
        bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc)
      Internal error: Oops - CFI: 00000000f2008228 [#1]  SMP
      ...
    
    As bpf_crypto_ctx_release() is also used in BPF programs and using
    a void pointer as the argument would make the verifier unhappy, add
    a simple stub function with the correct type and register it as the
    destructor kfunc instead.
    
    Signed-off-by: Sami Tolvanen 
    Acked-by: Yonghong Song 
    Tested-by: Viktor Malik 
    Link: https://lore.kernel.org/r/20260110082548.113748-7-samitolvanen@google.com
    Signed-off-by: Alexei Starovoitov 

commit 292c0bc8acb687de7e83fc454bb98af19187b6bf
Author: Zenm Chen 
Date:   Mon Jan 12 08:47:59 2026 +0800

    wifi: rtw89: Add support for D-Link VR Air Bridge (DWA-F18)
    
    Add the ID 2001:3323 to the table to support an additional RTL8832AU
    adapter: D-Link VR Air Bridge (DWA-F18).
    
    Compile tested only.
    
    Link: https://github.com/morrownr/rtw89/pull/44
    Signed-off-by: Zenm Chen 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260112004759.6028-1-zenmchen@gmail.com

commit 3116f287b81fe777a00b93ab07ec3c270093b185
Author: Zenm Chen 
Date:   Mon Jan 12 08:43:58 2026 +0800

    wifi: rtw89: Add support for MSI AX1800 Nano (GUAX18N)
    
    Add the ID 0db0:f0c8 to the table to support an additional RTL8832BU
    adapter: MSI AX1800 Nano (GUAX18N).
    
    Compile tested only.
    
    Link: https://github.com/morrownr/rtl8852bu-20250826/pull/2
    Signed-off-by: Zenm Chen 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260112004358.5516-1-zenmchen@gmail.com

commit 40714b8a21377817529e584130715ff97da8fccf
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:20 2026 +0800

    wifi: rtw89: mac: set EDCCA configurations for RTL8922D
    
    Update EDCCA settings of MAC part for RTL8922D to consider EDCCA state
    signaled by BB circuit.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-14-pkshih@realtek.com

commit 6996a4c97ad6c7bf8a8672924444fb623869cdd3
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:19 2026 +0800

    wifi: rtw89: mac: add an entry to enable MAC function in preinit
    
    The preinit is to initialize partial MAC hardware needed before
    downloading firmware, and then does post-init after firmware runs.
    
    For RTL8922D, initialize some DMAC and CMAC at this step.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-13-pkshih@realtek.com

commit c16673247b404ad4a004268fc079737531078fcb
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:18 2026 +0800

    wifi: rtw89: mac: separate functions of CMAC power and function enable
    
    To enable/disable CMAC function somewhere, separate controls of CMAC power
    and function into individual functions. Also correct the hardware settings
    by the way.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-12-pkshih@realtek.com

commit baf38631460b741ff21ee74246e5a17772290510
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:17 2026 +0800

    wifi: rtw89: mac: configure DMA_STOP1 by predefined mask
    
    For coming chip 8922DE, the DMA channel set is different from existing one,
    so use predefined mask to handle the difference.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-11-pkshih@realtek.com

commit 7ded59e69ab31ff91fafaa6820caaf17f464e291
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:16 2026 +0800

    wifi: rtw89: mac: define preload_init for generations
    
    The preload_init is to define preload size from memory to transmitting
    buffer. The different generations should call its callback respectively
    but suddenly it is missed. However, the register definitions of WiFi 6/7
    are the same, things are well. For the coming RTL8922D, settings are
    different, so abstract it.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-10-pkshih@realtek.com

commit a69c2c9a587d91941fcb041ccb77eef6cb892423
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:15 2026 +0800

    wifi: rtw89: mac: update WP quota for RTL8922D
    
    WP (WiFi payload) quota is to point to payload being transmitting in
    memory. Assign quota to indicate WP page full.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-9-pkshih@realtek.com

commit 9cf039ee49b5d4d7424697227a522b2dd40c2a34
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:14 2026 +0800

    wifi: rtw89: mac: update MPDU quota according to chip DLE definition
    
    MPDU quota is to define number of memory used to handle packets in DLE
    (Data Link Engine). All chips use the same value before, but the RTL8922D
    need to use chip specific value.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-8-pkshih@realtek.com

commit 70cd273aae23c1a583efefbf3a86c7a45d4e3c7e
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:13 2026 +0800

    wifi: rtw89: mac: set quota 13 for PLE SNRPT
    
    The RTL8922D has additional quota 13 of SNRPT for PLE (payload engine).
    Set value to the quota according to predefined tables.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-7-pkshih@realtek.com

commit 5afb451bb5e0b1c95965975da60c196a6d2ec228
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:12 2026 +0800

    wifi: rtw89: mac: add dle_mem and ple_{min,max}_qt quota for RTL8922D
    
    The quota of DLE and PLE depends on hardware design and consideration of
    performance and application. Define them accordingly.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-6-pkshih@realtek.com

commit 9d6a2a636c9f8609f55f9682a8f875458d823b41
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:11 2026 +0800

    wifi: rtw89: mac: remove unnecessary return from rtw89_fwdl_secure_idmem_share_mode()
    
    The return type of rtw89_fwdl_secure_idmem_share_mode() is void, so no need
    a return.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-5-pkshih@realtek.com

commit 99853d9daef240a45e161d0e33487cda4810b999
Author: Thorsten Blum 
Date:   Sun Jan 11 14:12:58 2026 +0100

    ecryptfs: Replace memcpy + NUL termination in ecryptfs_copy_filename
    
    Use kmemdup_nul() to copy 'name' instead of using memcpy() followed by a
    manual NUL termination.  Remove the local return variable and the goto
    label to simplify the code.  No functional changes.
    
    Signed-off-by: Thorsten Blum 
    Acked-by: Tyler Hicks 
    Signed-off-by: Tyler Hicks 

commit 286bb07889c1b8d1a7aaf212841c4472aab85ba7
Author: Chia-Yuan Li 
Date:   Thu Jan 8 20:03:10 2026 +0800

    wifi: rtw89: coex: update coex software control for RTL8922D
    
    Update software control API due to 8922D PTA hardware changes.
    
    Signed-off-by: Chia-Yuan Li 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-4-pkshih@realtek.com

commit ed2feda12f36a9c3916c0059c26b8b48cc0a9b6a
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:09 2026 +0800

    wifi: rtw89: coex: update scoreboard value according to power state for two BT
    
    Assign timeslot to WiFi if power state is on. Since firmware isn't working
    at this moment, write scoreboard register to notify BT. Extend the code to
    support two BT for coming chips.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-3-pkshih@realtek.com

commit 95052ab2d7949e5b1b1bee4fe87f059182dbcf11
Author: Ping-Ke Shih 
Date:   Thu Jan 8 20:03:08 2026 +0800

    wifi: rtw89: coex: make coex scoreboard as chip info
    
    The coex scoreboard is to exchange WiFi and BT profiles, and the coming
    chip 8922D changes the design including extend to two scoreboards and
    individual register for cfg/get. Follow the changes to abstract current
    code, but not change logic for existing chips at all.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260108120320.2217402-2-pkshih@realtek.com

commit d2f59bf97579404c3735a6d0bc1739cf2d387925
Merge: 5c024716f52bb8 5a78fd3debad05
Author: Jakub Kicinski 
Date:   Mon Jan 12 18:02:13 2026 -0800

    Merge branch 'net-stmmac-cleanups-and-low-priority-fixes'
    
    Russell King says:
    
    ====================
    net: stmmac: cleanups and low priority fixes
    
    Further cleanups and a few low priority fixes:
    
    - Remove duplicated register definitions from header files
    - Fix harmless wrong definition used for PTP message type in
      descriptors
    - Fix norm_set_tx_desc_len_on_ring() off-by-one error (and make
      enh_set_tx_desc_len_on_ring() follow a similar pattern.)
      Document the buffer size limits. I believe we never call
      norm_set_tx_desc_len_on_ring() with 2KiB lengths.
    - use u32 rather than unsigned int for 32-bit quantities in
      descriptors
    - modernise: convert to use FIELD_PREP() rather than separate mask
      and shift definitions.
    - Reorganise register and register field definitions: registers
      defined in address offset order followed by their register field
      definitions.
    - Remove lots of unused register definitions.
    ====================
    
    Link: https://patch.msgid.link/aV_q2Kneinrk3Z-W@shell.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 5a78fd3debad050f9fe4aa701d93457cc288bdf9
Author: Russell King (Oracle) 
Date:   Thu Jan 8 17:36:50 2026 +0000

    net: stmmac: remove unused definitions
    
    Potentially unused definitions were discovered using:
    
    $ for m in $(grep '#define ' $header | sed -e 's,#define[  ]*\([^  ]*\)[   ].*,\1,;s,(.*,,'); do if ! grep -q $m *.c; then echo $m; fi; done
    
    Each was verified, and then removed where truly unused.
    
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vdtwI-00000002Gu6-1HYu@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 58bc0f0bfc1b591a142ea1f84d1377d3dc0d58d6
Author: Russell King (Oracle) 
Date:   Thu Jan 8 17:36:45 2026 +0000

    net: stmmac: arrange register fields after register offsets
    
    Arrange the register fields to be after their corresponding register
    offset definitions, which groups all the definitions for a register
    together.
    
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vdtwD-00000002Gu0-0nTN@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 8409495bf6c907a5bc9632464dbdd8fb619f9ceb
Author: Russell King (Oracle) 
Date:   Thu Jan 8 17:36:40 2026 +0000

    net: stmmac: cores: remove many xxx_SHIFT definitions
    
    We have many xxx_SHIFT definitions along side their corresponding
    xxx_MASK definitions for the various cores. Manually using the
    shift and mask can be error prone, as shown with the dwmac4 RXFSTS
    fix patch.
    
    Convert sites that use xxx_SHIFT and xxx_MASK directly to use
    FIELD_GET(), FIELD_PREP(), and u32_replace_bits() as appropriate.
    
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vdtw8-00000002Gtu-0Hyu@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 670d10509f857883cda193126e48f4e30a9b9bd1
Author: Russell King (Oracle) 
Date:   Thu Jan 8 17:36:34 2026 +0000

    net: stmmac: descs: remove many xxx_SHIFT definitions
    
    Remove many xxx_SHIFT definitions for descriptors, isntead using
    FIELD_PREP(), FIELD_GET(), and u32_replace_bits() as appropriate to
    manipulate the bitfields. This avoids potential errors where an
    incorrect shift is used with a mask.
    
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vdtw2-00000002Gto-3ZPt@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit d3b8c9b39356ac1166703c8f179768a36eef1407
Author: Russell King (Oracle) 
Date:   Thu Jan 8 17:36:29 2026 +0000

    net: stmmac: descs: use u32 for descriptors
    
    Use u32 rather than unsigned int for 32-bit descriptor variables.
    This will allow the u32 bitfield helpers to be used. Note, we use
    __le32 for the in-memory descriptor structures.
    
    Reviewed-by: Maxime Chevallier 
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vdtvx-00000002Gth-32RU@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit ec3fde9eead03bc944ad14d32de11f17c2291306
Author: Russell King (Oracle) 
Date:   Thu Jan 8 17:36:24 2026 +0000

    net: stmmac: descs: fix buffer 1 off-by-one error
    
    norm_set_tx_desc_len_on_ring() incorrectly tests the buffer length,
    leading to a length of 2048 being squeezed into a bitfield covering
    bits 10:0 - which results in the buffer 1 size being zero.
    
    If this field is zero, buffer 1 is ignored, and thus is equivalent to
    transmitting a zero length buffer.
    
    The path to norm_set_tx_desc_len_on_ring() is only possible when the
    hardware does not support enhanced descriptors (plat->enh_desc clear)
    which is dependent on the hardware.
    
    Reviewed-by: Maxime Chevallier 
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vdtvs-00000002Gtb-2U9G@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit e91a7e45bf0b013dd63bc3311c25e95b498d27f0
Author: Russell King (Oracle) 
Date:   Thu Jan 8 17:36:19 2026 +0000

    net: stmmac: dwmac4: fix PTP message type field extraction
    
    In dwmac4_wrback_get_rx_status(), the code extracts the PTP message
    type from receive descriptor 1 using the dwmac enhanced descriptor
    definitions:
    
            message_type = (rdes1 & ERDES4_MSG_TYPE_MASK) >> 8;
    
    This is defined as:
    
     #define ERDES4_MSG_TYPE_MASK            GENMASK(11, 8)
    
    The correct definition is RDES1_PTP_MSG_TYPE_MASK, which is also
    defined as:
    
     #define RDES1_PTP_MSG_TYPE_MASK         GENMASK(11, 8)
    
    Use the correct definition, converting to use FIELD_GET() to extract
    it without needing an open-coded shift right that is dependent on the
    mask definition.
    
    As this change has no effect on the generated code, there is no need
    to treat this as a bug fix.
    
    Reviewed-by: Maxime Chevallier 
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vdtvn-00000002GtV-1wCS@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 65b21a7d4de48f5fede3c78495b4fdf61762005e
Author: Russell King (Oracle) 
Date:   Thu Jan 8 17:36:14 2026 +0000

    net: stmmac: dwmac4: fix RX FIFO fill statistics
    
    In dwmac4_debug(), the wrong shift is used with the RXFSTS mask:
    
     #define MTL_DEBUG_RXFSTS_MASK          GENMASK(5, 4)
     #define MTL_DEBUG_RXFSTS_SHIFT         4
     #define MTL_DEBUG_RRCSTS_SHIFT         1
    
                           u32 rxfsts = (value & MTL_DEBUG_RXFSTS_MASK)
                                        >> MTL_DEBUG_RRCSTS_SHIFT;
    
    where rxfsts is tested against small integers 1 .. 3. This results in
    the tests always failing, causing the "mtl_rx_fifo__fill_level_empty"
    statistic counter to always be incremented no matter what the fill
    level actually is.
    
    Fix this by using FIELD_GET() and remove the unnecessary
    MTL_DEBUG_RXFSTS_SHIFT definition as FIELD_GET() will shift according
    to the least siginificant set bit in the supplied field mask.
    
    Reviewed-by: Maxime Chevallier 
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vdtvi-00000002GtP-1Os1@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 1fd3b573713a91bc65cb90b919f17786fe7f147a
Author: Russell King (Oracle) 
Date:   Thu Jan 8 17:36:09 2026 +0000

    net: stmmac: dwmac4: remove duplicated definitions
    
    dwmac4.h duplicates some of the debug register definitions. Remove
    the second copy.
    
    Reviewed-by: Maxime Chevallier 
    Signed-off-by: Russell King (Oracle) 
    Link: https://patch.msgid.link/E1vdtvd-00000002GtJ-0qFI@rmk-PC.armlinux.org.uk
    Signed-off-by: Jakub Kicinski 

commit 5c024716f52bb8b683ff7c85c574a49644a1f299
Author: Bobby Eshleman 
Date:   Wed Jan 7 17:29:38 2026 -0800

    net: devmem: convert binding refcount to percpu_ref
    
    Convert net_devmem_dmabuf_binding refcount from refcount_t to percpu_ref
    to optimize common-case reference counting on the hot path.
    
    The typical devmem workflow involves binding a dmabuf to a queue
    (acquiring the initial reference on binding->ref), followed by
    high-volume traffic where every skb fragment acquires a reference.
    Eventually traffic stops and the unbind operation releases the initial
    reference. Additionally, the high traffic hot path is often multi-core.
    This access pattern is ideal for percpu_ref as the first and last
    reference during bind/unbind normally book-ends activity in the hot
    path.
    
    __net_devmem_dmabuf_binding_free becomes the percpu_ref callback invoked
    when the last reference is dropped.
    
    kperf test:
    - 4MB message sizes
    - 60s of workload each run
    - 5 runs
    - 4 flows
    
    Throughput:
            Before: 45.31 GB/s (+/- 3.17 GB/s)
            After: 48.67 GB/s (+/- 0.01 GB/s)
    
    Picking throughput-matched kperf runs (both before and after matched at
    ~48 GB/s) for apples-to-apples comparison:
    
    Summary (averaged across 4 workers):
    
      TX worker CPU idle %:
        Before: 34.44%
        After: 87.13%
    
      RX worker CPU idle %:
        Before: 5.38%
        After: 9.73%
    
    kperf before:
    
    client: == Source
    client:   Tx 98.100 Gbps (735764807680 bytes in 60001149 usec)
    client:   Tx102.798 Gbps (770996961280 bytes in 60001149 usec)
    client:   Tx101.534 Gbps (761517834240 bytes in 60001149 usec)
    client:   Tx 82.794 Gbps (620966707200 bytes in 60001149 usec)
    client:   net CPU 56: usr: 0.01% sys: 0.12% idle:17.06% iow: 0.00% irq: 9.89% sirq:72.91%
    client:   app CPU 60: usr: 0.08% sys:63.30% idle:36.24% iow: 0.00% irq: 0.30% sirq: 0.06%
    client:   net CPU 57: usr: 0.03% sys: 0.08% idle:75.68% iow: 0.00% irq: 2.96% sirq:21.23%
    client:   app CPU 61: usr: 0.06% sys:67.67% idle:31.94% iow: 0.00% irq: 0.28% sirq: 0.03%
    client:   net CPU 58: usr: 0.01% sys: 0.06% idle:76.87% iow: 0.00% irq: 2.84% sirq:20.19%
    client:   app CPU 62: usr: 0.06% sys:69.78% idle:29.79% iow: 0.00% irq: 0.30% sirq: 0.05%
    client:   net CPU 59: usr: 0.06% sys: 0.16% idle:74.97% iow: 0.00% irq: 3.76% sirq:21.03%
    client:   app CPU 63: usr: 0.06% sys:59.82% idle:39.80% iow: 0.00% irq: 0.25% sirq: 0.05%
    client: == Target
    client:   Rx 98.092 Gbps (735764807680 bytes in 60006084 usec)
    client:   Rx102.785 Gbps (770962161664 bytes in 60006084 usec)
    client:   Rx101.523 Gbps (761499566080 bytes in 60006084 usec)
    client:   Rx 82.783 Gbps (620933136384 bytes in 60006084 usec)
    client:   net CPU  2: usr: 0.00% sys: 0.01% idle:24.51% iow: 0.00% irq: 1.67% sirq:73.79%
    client:   app CPU  6: usr: 1.51% sys:96.43% idle: 1.13% iow: 0.00% irq: 0.36% sirq: 0.55%
    client:   net CPU  1: usr: 0.00% sys: 0.01% idle:25.18% iow: 0.00% irq: 1.99% sirq:72.80%
    client:   app CPU  5: usr: 2.21% sys:94.54% idle: 2.54% iow: 0.00% irq: 0.38% sirq: 0.30%
    client:   net CPU  3: usr: 0.00% sys: 0.01% idle:26.34% iow: 0.00% irq: 2.12% sirq:71.51%
    client:   app CPU  7: usr: 2.22% sys:94.28% idle: 2.52% iow: 0.00% irq: 0.59% sirq: 0.37%
    client:   net CPU  0: usr: 0.00% sys: 0.03% idle: 0.00% iow: 0.00% irq:10.44% sirq:89.51%
    client:   app CPU  4: usr: 2.39% sys:81.46% idle:15.33% iow: 0.00% irq: 0.50% sirq: 0.30%
    
    kperf after:
    
    client: == Source
    client:   Tx 99.257 Gbps (744447016960 bytes in 60001303 usec)
    client:   Tx101.013 Gbps (757617131520 bytes in 60001303 usec)
    client:   Tx 88.179 Gbps (661357854720 bytes in 60001303 usec)
    client:   Tx101.002 Gbps (757533245440 bytes in 60001303 usec)
    client:   net CPU 56: usr: 0.00% sys: 0.01% idle: 6.22% iow: 0.00% irq: 8.68% sirq:85.06%
    client:   app CPU 60: usr: 0.08% sys:12.56% idle:87.21% iow: 0.00% irq: 0.08% sirq: 0.05%
    client:   net CPU 57: usr: 0.00% sys: 0.05% idle:69.53% iow: 0.00% irq: 2.02% sirq:28.38%
    client:   app CPU 61: usr: 0.11% sys:13.40% idle:86.36% iow: 0.00% irq: 0.08% sirq: 0.03%
    client:   net CPU 58: usr: 0.00% sys: 0.03% idle:70.04% iow: 0.00% irq: 3.38% sirq:26.53%
    client:   app CPU 62: usr: 0.10% sys:11.46% idle:88.31% iow: 0.00% irq: 0.08% sirq: 0.03%
    client:   net CPU 59: usr: 0.01% sys: 0.06% idle:71.18% iow: 0.00% irq: 1.97% sirq:26.75%
    client:   app CPU 63: usr: 0.10% sys:13.10% idle:86.64% iow: 0.00% irq: 0.10% sirq: 0.05%
    client: == Target
    client:   Rx 99.250 Gbps (744415182848 bytes in 60003297 usec)
    client:   Rx101.006 Gbps (757589737472 bytes in 60003297 usec)
    client:   Rx 88.171 Gbps (661319475200 bytes in 60003297 usec)
    client:   Rx100.996 Gbps (757514792960 bytes in 60003297 usec)
    client:   net CPU  2: usr: 0.00% sys: 0.01% idle:28.02% iow: 0.00% irq: 1.95% sirq:70.00%
    client:   app CPU  6: usr: 2.03% sys:87.20% idle:10.04% iow: 0.00% irq: 0.37% sirq: 0.33%
    client:   net CPU  3: usr: 0.00% sys: 0.00% idle:27.63% iow: 0.00% irq: 1.90% sirq:70.45%
    client:   app CPU  7: usr: 1.78% sys:89.70% idle: 7.79% iow: 0.00% irq: 0.37% sirq: 0.34%
    client:   net CPU  0: usr: 0.00% sys: 0.01% idle: 0.00% iow: 0.00% irq: 9.96% sirq:90.01%
    client:   app CPU  4: usr: 2.33% sys:83.51% idle:13.24% iow: 0.00% irq: 0.64% sirq: 0.26%
    client:   net CPU  1: usr: 0.00% sys: 0.01% idle:27.60% iow: 0.00% irq: 1.94% sirq:70.43%
    client:   app CPU  5: usr: 1.88% sys:89.61% idle: 7.86% iow: 0.00% irq: 0.35% sirq: 0.27%
    
    Signed-off-by: Bobby Eshleman 
    Acked-by: Stanislav Fomichev 
    Link: https://patch.msgid.link/20260107-upstream-precpu-ref-v2-v2-1-a709f098b3dc@meta.com
    Signed-off-by: Jakub Kicinski 

commit 218f8dc9c2c1ec684927f3450ba09c4defaaf2e9
Merge: 669aa3e3faa8ae 7fe9c81aa24a23
Author: Jakub Kicinski 
Date:   Mon Jan 12 17:26:45 2026 -0800

    Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue
    
    Tony Nguyen says:
    
    ====================
    Intel Wired LAN Driver Updates 2026-01-09 (ice, ixgbe, idpf)
    
    For ice:
    Grzegorz commonizes firmware loading process across all ice devices.
    
    Michal adjusts default queue allocation to be based on
    netif_get_num_default_rss_queues() rather than num_online_cpus().
    
    For ixgbe:
    Birger Koblitz adds support for 10G-BX modules.
    
    For idpf:
    Sreedevi converts always successful function to return void.
    
    Andy Shevchenko fixes kdocs for missing 'Return:' in idpf_txrx.c file.
    
    * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue:
      idpf: Fix kernel-doc descriptions to avoid warnings
      idpf: update idpf_up_complete() return type to void
      ice: use netif_get_num_default_rss_queues()
      ixgbe: Add 10G-BX support
      ice: unify PHY FW loading status handler for E800 devices
    ====================
    
    Link: https://patch.msgid.link/20260109210647.3849008-1-anthony.l.nguyen@intel.com
    Signed-off-by: Jakub Kicinski 

commit 669aa3e3faa8ae876c169cde5b234828275caef8
Merge: 2f2d896ec59a11 46e7ced3ef5b56
Author: Jakub Kicinski 
Date:   Mon Jan 12 17:02:02 2026 -0800

    Merge tag 'wireless-next-2026-01-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next
    
    Johannes Berg says:
    
    ====================
    First set of changes for the current -next cycle, of note:
    
     - ath12k gets an overhaul to support multi-wiphy device
       wiphy and pave the way for future device support in
       the same driver (rather than splitting to ath13k)
    
     - mac80211 gets some better iteration macros
    
    * tag 'wireless-next-2026-01-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (120 commits)
      wifi: mac80211: remove width argument from ieee80211_parse_bitrates
      wifi: mac80211_hwsim: remove NAN by default
      wifi: mac80211: improve station iteration ergonomics
      wifi: mac80211: improve interface iteration ergonomics
      wifi: cfg80211: include S1G_NO_PRIMARY flag when sending channel
      wifi: mac80211: unexport ieee80211_get_bssid()
      wl1251: Replace strncpy with strscpy in wl1251_acx_fw_version
      wifi: iwlegacy: 3945-rs: remove redundant pointer check in il3945_rs_tx_status() and il3945_rs_get_rate()
      wifi: mac80211: don't send an unused argument to ieee80211_check_combinations
      wifi: libertas: fix WARNING in usb_tx_block
      wifi: mwifiex: Allocate dev name earlier for interface workqueue name
      wifi: wlcore: sdio: Use pm_ptr instead of #ifdef CONFIG_PM
      wifi: cfg80211: Fix use_for flag update on BSS refresh
      wifi: brcmfmac: rename function that frees vif
      wifi: brcmfmac: fix/add kernel-doc comments
      wifi: mac80211: Update csa_finalize to use link_id
      wifi: cfg80211: add cfg80211_stop_link() for per-link teardown
      wifi: ath12k: Skip DP peer creation for scan vdev
      wifi: ath12k: move firmware stats request outside of atomic context
      wifi: ath12k: add the missing RCU lock in ath12k_dp_tx_free_txbuf()
      ...
    ====================
    
    Link: https://patch.msgid.link/20260112185836.378736-3-johannes@sipsolutions.net
    Signed-off-by: Jakub Kicinski 

commit 9512d9fc2a7a4fee14854fbb3af89a8bf599f361
Author: Julia Filipchuk 
Date:   Wed Nov 12 10:25:44 2025 -0800

    drm/i915/guc: Recommend GuC v70.53.0 for DG2, MTL
    
    UAPI compatibility version 1.26.0
    
    Update recommended GuC version for DG2, MTL.
    
    Signed-off-by: Julia Filipchuk 
    Reviewed-by: Daniele Ceraolo Spurio 
    Signed-off-by: Daniele Ceraolo Spurio 
    Link: https://patch.msgid.link/20251112182606.1470733-2-julia.filipchuk@intel.com

commit 65955a0993a0a9536263fea2eaae8aed496dcc9c
Author: Ming Lei 
Date:   Tue Jan 13 00:05:02 2026 +0200

    selftests: ublk: add stop command with --safe option
    
    Add 'stop' subcommand to kublk utility that uses the new
    UBLK_CMD_TRY_STOP_DEV command when --safe option is specified.
    This allows stopping a device only if it has no active openers,
    returning -EBUSY otherwise.
    
    Also add test_generic_16.sh to test the new functionality.
    
    Signed-off-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 93ada1b3da398b492c45429cef1a1c9651d5c7ba
Author: Yoav Cohen 
Date:   Tue Jan 13 00:05:01 2026 +0200

    ublk: add UBLK_CMD_TRY_STOP_DEV command
    
    Add a best-effort stop command, UBLK_CMD_TRY_STOP_DEV, which only stops a
    ublk device when it has no active openers.
    
    Unlike UBLK_CMD_STOP_DEV, this command does not disrupt existing users.
    New opens are blocked only after disk_openers has reached zero; if the
    device is busy, the command returns -EBUSY and leaves it running.
    
    The ub->block_open flag is used only to close a race with an in-progress
    open and does not otherwise change open behavior.
    
    Advertise support via the UBLK_F_SAFE_STOP_DEV feature flag.
    
    Signed-off-by: Yoav Cohen 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 9e386f49fa269298490b303c423c6af4645f184e
Author: Yoav Cohen 
Date:   Tue Jan 13 00:05:00 2026 +0200

    ublk: make ublk_ctrl_stop_dev return void
    
    This function always returns 0, so there is no need to return a value.
    
    Signed-off-by: Yoav Cohen 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 49a498338417281f78594294c83707b140afde85
Author: Karthik Poosa 
Date:   Tue Jan 13 02:05:21 2026 +0530

    drm/xe/hwmon: Expose individual VRAM channel temperature
    
    Expose individual VRAM temperature attributes.
    Update Xe hwmon documentation for this entry.
    
    v2:
     - Avoid using default switch case for VRAM individual temperatures.
     - Append labels with VRAM channel number.
     - Update kernel version in Xe hwmon documentation.
    
    v3:
     - Add missing brackets in Xe hwmon documentation from VRAM channel sysfs.
     - Reorder BMG_VRAM_TEMPERATURE_N macro in xe_pcode_regs.h.
     - Add api to check if VRAM is available on the channel.
    
    v4:
     - Improve VRAM label handling to eliminate temp variable by
       introducing a dedicated array vram_label in xe_hwmon_thermal_info.
     - Remove a magic number.
     - Change the label from vram_X to vram_ch_X.
    
    v5:
     - Address review comments from Raag.
     - Change vram to VRAM in commit title and subject.
     - Refactor BMG_VRAM_TEMPERATURE_N macro.
     - Refactor is_vram_ch_available().
     - Rephrase a comment.
     - Check individual VRAM temperature limits in addition to VRAM
       availability in xe_hwmon_temp_is_visible. (Raag)
     - Move VRAM label change out of this patch.
    
    v6:
     - Use in_range() for VRAM_N index check instead of if check. (Raag)
     - Minor aesthetic changes.
    
    Signed-off-by: Karthik Poosa 
    Reviewed-by: Raag Jadav 
    Link: https://patch.msgid.link/20260112203521.1014388-5-karthik.poosa@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 8d2511686ef55cfbdcc14d2f051224c3a16741d6
Author: Karthik Poosa 
Date:   Tue Jan 13 02:05:20 2026 +0530

    drm/xe/hwmon: Expose GPU PCIe temperature
    
    Expose GPU PCIe average temperature and its limits via hwmon sysfs entry
    temp5_xxx.
    Update Xe hwmon sysfs documentation for this.
    
    v2: Update kernel version in Xe hwmon documentation. (Raag)
    
    v3:
     - Address review comments from Raag.
     - Remove redundant debug log.
     - Update kernel version in Xe hwmon documentation. (Raag)
    
    v4:
     - Address review comments from Raag.
     - Group new temperature attributes with existing temperature attributes
       as per channel index in Xe hwmon documentation.
     - Use TEMP_MASK instead of TEMP_MASK_MAILBOX.
     - Add PCIE_SENSOR_MASK which uses REG_FIELD_GET as replacement of
       PCIE_SENSOR_SHIFT.
    
    v5:
     - Address review comments from Raag.
     - Use REG_FIELD_GET to get PCIe temperature.
     - Move PCIE_SENSOR_GROUP_ID and PCIE_SENSOR_MASK to xe_pcode_api.h
     - Cosmetic change.
    
    Signed-off-by: Karthik Poosa 
    Reviewed-by: Raag Jadav 
    Link: https://patch.msgid.link/20260112203521.1014388-4-karthik.poosa@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 3a0cb885e111db34b22058a3b82e99e49f02ac94
Author: Karthik Poosa 
Date:   Tue Jan 13 02:05:19 2026 +0530

    drm/xe/hwmon: Expose memory controller temperature
    
    Expose GPU memory controller average temperature and its limits under
    temp4_xxx.
    Update Xe hwmon documentation for this.
    
    v2:
     - Rephrase commit message. (Badal)
     - Update kernel version in Xe hwmon documentation. (Raag)
    
    v3:
     - Update kernel version in Xe hwmon documentation.
     - Address review comments from Raag.
     - Remove obvious comments.
     - Remove redundant debug logs.
     - Remove unnecessary checks.
     - Avoid magic numbers.
     - Add new comments.
     - Use temperature sensors count to make memory controller visible.
     - Use temperature limits of package for memory controller.
    
    v4:
     - Address review comments from Raag.
     - Group new temperature attributes with existing temperature attributes
       as per channel index in Xe hwmon documentation.
     - Use DIV_ROUND_UP to calculate dwords needed for temperature limits.
     - Minor aesthetic refinements.
     - Remove unused TEMP_MASK_MAILBOX.
    
    v5:
     - Use REG_FIELD_GET to get count from READ_THERMAL_DATA output. (Raag)
     - Change count print from decimal to hexadecimal.
     - Cosmetic changes.
    
    Signed-off-by: Karthik Poosa 
    Reviewed-by: Raag Jadav 
    Link: https://patch.msgid.link/20260112203521.1014388-3-karthik.poosa@intel.com
    Signed-off-by: Rodrigo Vivi 

commit c332fba805d659eca1f8e3a41d259c03421e81f1
Author: Karthik Poosa 
Date:   Tue Jan 13 02:05:18 2026 +0530

    drm/xe/hwmon: Expose temperature limits
    
    Read temperature limits using pcode mailbox and expose shutdown
    temperature limit as tempX_emergency, critical temperature limit as
    tempX_crit and GPU max temperature limit as temp2_max.
    
    Update Xe hwmon documentation with above entries.
    
    v2:
     - Resolve a documentation warning.
     - Address below review comments from Raag.
     - Update date and kernel version in Xe hwmon documentation.
     - Remove explicit disable of has_mbx_thermal_info for unsupported
       platforms.
     - Remove unnecessary default case in switches.
     - Remove obvious comments.
     - Use TEMP_LIMIT_MAX to compute number of dwords needed in
       xe_hwmon_thermal_info.
     - Remove THERMAL_LIMITS_DWORDS macro.
     - Use has_mbx_thermal_info for checking thermal mailbox support.
    
    v3:
     - Address below minor comments. (Raag)
     - Group new temperature attributes with existing temperature attributes
       as per channel index in Xe hwmon documentation.
     - Rename enums of xe_temp_limit to improve clarity.
     - Use DIV_ROUND_UP to calculate dwords needed for temperature limits.
     - Use return instead of breaks in xe_hwmon_temp_read.
     - Minor aesthetic refinements.
    
    v4:
     - Remove a redundant break. (Raag)
     - Update drm_dbg to drm_warn to inform user of unavailability for
       thermal mailbox on expected platforms.
    
    Signed-off-by: Karthik Poosa 
    Reviewed-by: Raag Jadav 
    Link: https://patch.msgid.link/20260112203521.1014388-2-karthik.poosa@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 2f2d896ec59a11a9baaa56818466db7a3178c041
Merge: 60d8484c4cec81 60411adedf70ab
Author: Jakub Kicinski 
Date:   Mon Jan 12 13:30:38 2026 -0800

    Merge branch 'tools-ynl-cli-improve-the-help-and-doc'
    
    Jakub Kicinski says:
    
    ====================
    tools: ynl: cli: improve the help and doc
    
    I had some time on the plane to LPC, so here are improvements
    to the --help and --list-attrs handling of YNL CLI which seem
    in order given growing use of YNL as a real CLI tool.
    ====================
    
    Link: https://patch.msgid.link/20260110233142.3921386-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 60411adedf70abec0ac221ec3d88f6453b031dd2
Author: Jakub Kicinski 
Date:   Sat Jan 10 15:31:42 2026 -0800

    tools: ynl: cli: print reply in combined format if possible
    
    As pointed out during review of the --list-attrs support the GET
    ops very often return the same attrs from do and dump. Make the
    output more readable by combining the reply information, from:
    
      Do request attributes:
        - ifindex: u32
          netdev ifindex
    
      Do reply attributes:
        - ifindex: u32
          netdev ifindex
        [ .. other attrs .. ]
    
      Dump reply attributes:
        - ifindex: u32
          netdev ifindex
        [ .. other attrs .. ]
    
    To, after:
    
      Do request attributes:
        - ifindex: u32
          netdev ifindex
    
      Do and Dump reply attributes:
        - ifindex: u32
          netdev ifindex
        [ .. other attrs .. ]
    
    Tested-by: Gal Pressman 
    Acked-by: Stanislav Fomichev 
    Reviewed-by: Donald Hunter 
    Link: https://patch.msgid.link/20260110233142.3921386-8-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 6ccc421b14613aac32b2647462ae4d40f5dd43b8
Author: Jakub Kicinski 
Date:   Sat Jan 10 15:31:41 2026 -0800

    tools: ynl: cli: extract the event/notify handling in --list-attrs
    
    Event and notify handling is quite different from do / dump
    handling. Forcing it into print_mode_attrs() doesn't really
    buy us anything as events and notifications do not have requests.
    Call print_attr_list() directly. Apart form subjective code
    clarity this also removes the word "reply" from the output:
    
    Before:
    
      Event reply attributes:
    
    Now:
    
      Event attributes:
    
    Tested-by: Gal Pressman 
    Acked-by: Stanislav Fomichev 
    Reviewed-by: Donald Hunter 
    Link: https://patch.msgid.link/20260110233142.3921386-7-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 45b99bb464eb62da555ecbef31583d9701881d43
Author: Jakub Kicinski 
Date:   Sat Jan 10 15:31:40 2026 -0800

    tools: ynl: cli: factor out --list-attrs / --doc handling
    
    We'll soon add more code to the --doc handling. Factor it out
    to avoid making main() too long.
    
    Tested-by: Gal Pressman 
    Acked-by: Stanislav Fomichev 
    Reviewed-by: Donald Hunter 
    Link: https://patch.msgid.link/20260110233142.3921386-6-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit aca1fe235c10f7d06e9ebab4534852f109e6a8e9
Author: Jakub Kicinski 
Date:   Sat Jan 10 15:31:39 2026 -0800

    tools: ynl: cli: add --doc as alias to --list-attrs
    
    --list-attrs also provides information about the operation itself.
    So --doc seems more appropriate. Add an alias.
    
    Tested-by: Gal Pressman 
    Acked-by: Stanislav Fomichev 
    Reviewed-by: Donald Hunter 
    Link: https://patch.msgid.link/20260110233142.3921386-5-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 1b7fbf62ad8b404e55d195021724067b5122b630
Author: Jakub Kicinski 
Date:   Sat Jan 10 15:31:38 2026 -0800

    tools: ynl: cli: improve --help
    
    Improve the clarity of --help. Reorder, provide some grouping and
    add help messages to most of the options.
    
    No functional changes intended.
    
    Tested-by: Gal Pressman 
    Acked-by: Stanislav Fomichev 
    Reviewed-by: Donald Hunter 
    Link: https://patch.msgid.link/20260110233142.3921386-4-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 101a7d57d518c0c9e9eefc3768909ae02b96b3ef
Author: Jakub Kicinski 
Date:   Sat Jan 10 15:31:37 2026 -0800

    tools: ynl: cli: wrap the doc text if it's long
    
    We already use textwrap when printing "doc" section about an attribute,
    but only to indent the text. Switch to using fill() to split and indent
    all the lines. While at it indent the text by 2 more spaces, so that it
    doesn't align with the name of the attribute.
    
    Before (I'm drawing a "box" at ~60 cols here, in an attempt for clarity):
    
     |  - irq-suspend-timeout: uint                              |
     |    The timeout, in nanoseconds, of how long to suspend irq|
     |processing, if event polling finds events                  |
    
    After:
    
     |  - irq-suspend-timeout: uint                              |
     |      The timeout, in nanoseconds, of how long to suspend  |
     |      irq processing, if event polling finds events        |
    
    Tested-by: Gal Pressman 
    Acked-by: Stanislav Fomichev 
    Reviewed-by: Donald Hunter 
    Link: https://patch.msgid.link/20260110233142.3921386-3-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 21eb90fb5fbc939eb68262efc0e916293d8299d2
Author: Jakub Kicinski 
Date:   Sat Jan 10 15:31:36 2026 -0800

    tools: ynl: cli: introduce formatting for attr names in --list-attrs
    
    It's a little hard to make sense of the output of --list-attrs,
    it looks like a wall of text. Sprinkle a little bit of formatting -
    make op and attr names bold, and Enum: / Flags: keywords italics.
    
    Tested-by: Gal Pressman 
    Acked-by: Stanislav Fomichev 
    Reviewed-by: Donald Hunter 
    Link: https://patch.msgid.link/20260110233142.3921386-2-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 7aef17f367c94d6cef00f45b193e37d30ff4a3b5
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:16 2026 +0100

    x86/xen: Drop xen_mmu_ops
    
    Instead of having a pre-filled array xen_mmu_ops for Xen PV paravirt
    functions, drop the array and assign each element individually.
    
    This is in preparation of reducing the paravirt include hell by
    splitting paravirt.h into multiple more fine grained header files,
    which will in turn require to split up the pv_ops vector as well.
    Dropping the pre-filled array makes life easier for objtool to
    detect missing initializers in multiple pv_ops_ arrays.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Boris Ostrovsky 
    Link: https://patch.msgid.link/20260105110520.21356-18-jgross@suse.com

commit e7c30ac379b429d439eb62ae1bb69720a6701e26
Author: Vijendar Mukunda 
Date:   Sat Jan 10 12:14:14 2026 +0530

    ASoC: amd: acp: soc-acpi: add is_device_rt712_vb() helper
    
    Add a filter to skip the RT172 VB configuration if a SmartMic Function
    is not found in the SDCA descriptors.
    
    If the ACPI information is incorrect this can only be quirked further
    with DMI information.
    
    Signed-off-by: Vijendar Mukunda 
    Link: https://patch.msgid.link/20260110064505.1485927-1-Vijendar.Mukunda@amd.com
    Signed-off-by: Mark Brown 

commit 0bef51df7cf882e2b4ec0f7d52c311b09c850b9a
Author: Randy Dunlap 
Date:   Sun Dec 28 11:05:42 2025 -0800

    ASoC: amd: drop unused Kconfig symbols
    
    Remove the dangling Kconfig references to CLK_FIXED_FCH since they
    are not used anywhere else in the kernel source tree.
    
    Fixes: 281ddf62f551 ("ASoC: amd: Kconfig: Select fch clock support with machine driver")
    Fixes: d4c750f2c7d4 ("ASoC: amd: acp: Add generic machine driver support for ACP cards")
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251228190542.2482910-1-rdunlap@infradead.org
    Signed-off-by: Mark Brown 

commit 7af9e30a0c8bb05b7254fdca857c1a1126b652eb
Author: Randy Dunlap 
Date:   Sat Dec 27 23:10:41 2025 -0800

    ASoC: pxa: drop unused Kconfig symbol
    
    Drop a bogus dangling Kconfig symbol for select SND_SOC_AC97_BUS_NEW.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216748
    Fixes: 1c8bc7b3de5e ("ASoC: pxa: switch to new ac97 bus support")
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251228071041.2246718-1-rdunlap@infradead.org
    Signed-off-by: Mark Brown 

commit ec9426655dcee3e337735935dcc2dea7684a5bf8
Author: Ian Rogers 
Date:   Sat Jan 10 20:13:34 2026 -0800

    perf addr2line.c: Rename a2l_style to cmd_a2l_style
    
    The a2l_style is only relevant to the command line version, so rename
    to make this clearer.
    
    Reviewed-by: James Clark 
    Signed-off-by: Ian Rogers 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Howard Chu 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Stephen Brennan 
    Cc: Tony Jones 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit a4e573db06a4e8c519ec4c42f8e1249a0853367a
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:12 2026 -0800

    lib/crypto: riscv/aes: Migrate optimized code into library
    
    Move the aes_encrypt_zvkned() and aes_decrypt_zvkned() assembly
    functions into lib/crypto/, wire them up to the AES library API, and
    remove the "aes-riscv64-zvkned" crypto_cipher algorithm.
    
    To make this possible, change the prototypes of these functions to
    take (rndkeys, key_len) instead of a pointer to crypto_aes_ctx, and
    change the RISC-V AES-XTS code to implement tweak encryption using the
    AES library instead of directly calling aes_encrypt_zvkned().
    
    The result is that both the AES library and crypto_cipher APIs use
    RISC-V's AES instructions, whereas previously only crypto_cipher did
    (and it wasn't enabled by default, which this commit fixes as well).
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-15-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 7cf2082e74ce7f4f4b5e14cbe67a194d75e257ef
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:11 2026 -0800

    lib/crypto: powerpc/aes: Migrate POWER8 optimized code into library
    
    Move the POWER8 AES assembly code into lib/crypto/, wire the key
    expansion and single-block en/decryption functions up to the AES library
    API, and remove the superseded "p8_aes" crypto_cipher algorithm.
    
    The result is that both the AES library and crypto_cipher APIs are now
    optimized for POWER8, whereas previously only crypto_cipher was (and
    optimizations weren't enabled by default, which this commit fixes too).
    
    Note that many of the functions in the POWER8 assembly code are still
    used by the AES mode implementations in arch/powerpc/crypto/.  For now,
    just export these functions.  These exports will go away once the AES
    modes are migrated to the library as well.  (Trying to split up the
    assembly file seemed like much more trouble than it would be worth.)
    
    Another challenge with this code is that the POWER8 assembly code uses a
    custom format for the expanded AES key.  Since that code is imported
    from OpenSSL and is also targeted to POWER8 (rather than POWER9 which
    has better data movement and byteswap instructions), that is not easily
    changed.  For now I've just kept the custom format.  To maintain full
    correctness, this requires executing some slow fallback code in the case
    where the usability of VSX changes between key expansion and use.  This
    should be tolerable, as this case shouldn't happen in practice.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-14-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 0892c91b81cc889c95dc03b095b9f4a6fdf93106
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:10 2026 -0800

    lib/crypto: powerpc/aes: Migrate SPE optimized code into library
    
    Move the PowerPC SPE AES assembly code into lib/crypto/, wire the key
    expansion and single-block en/decryption functions up to the AES library
    API, and remove the superseded "aes-ppc-spe" crypto_cipher algorithm.
    
    The result is that both the AES library and crypto_cipher APIs are now
    optimized with SPE, whereas previously only crypto_cipher was (and
    optimizations weren't enabled by default, which this commit fixes too).
    
    Note that many of the functions in the PowerPC SPE assembly code are
    still used by the AES mode implementations in arch/powerpc/crypto/.  For
    now, just export these functions.  These exports will go away once the
    AES modes are migrated to the library as well.  (Trying to split up the
    assembly files seemed like much more trouble than it would be worth.)
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-13-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 2b1ef7aeeb184ee78523f3d24e221296574c6f2d
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:09 2026 -0800

    lib/crypto: arm64/aes: Migrate optimized code into library
    
    Move the ARM64 optimized AES key expansion and single-block AES
    en/decryption code into lib/crypto/, wire it up to the AES library API,
    and remove the superseded crypto_cipher algorithms.
    
    The result is that both the AES library and crypto_cipher APIs are now
    optimized for ARM64, whereas previously only crypto_cipher was (and the
    optimizations weren't enabled by default, which this fixes as well).
    
    Note: to see the diff from arch/arm64/crypto/aes-ce-glue.c to
    lib/crypto/arm64/aes.h, view this commit with 'git show -M10'.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-12-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit fa2297750c2cc61788d1843f358dbfecaa42944f
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:08 2026 -0800

    lib/crypto: arm/aes: Migrate optimized code into library
    
    Move the ARM optimized single-block AES en/decryption code into
    lib/crypto/, wire it up to the AES library API, and remove the
    superseded "aes-arm" crypto_cipher algorithm.
    
    The result is that both the AES library and crypto_cipher APIs are now
    optimized for ARM, whereas previously only crypto_cipher was (and the
    optimizations weren't enabled by default, which this fixes as well).
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-11-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit a2484474272ef98d9580d8c610b0f7c6ed2f146c
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:07 2026 -0800

    crypto: aes - Replace aes-generic with wrapper around lib
    
    Now that the AES library's performance has been improved, replace
    aes_generic.c with a new file aes.c which wraps the AES library.
    
    In preparation for making the AES library actually utilize the kernel's
    existing architecture-optimized AES code including AES instructions, set
    the driver name to "aes-lib" instead of "aes-generic".  This mirrors
    what's been done for the hash algorithms.  Update testmgr.c accordingly.
    
    Since this removes the crypto_aes_set_key() helper function, add
    temporary replacements for it to arch/arm/crypto/aes-cipher-glue.c and
    arch/arm64/crypto/aes-cipher-glue.c.  This is temporary, as that code
    will be migrated into lib/crypto/ in later commits.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-10-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 641e70563ac1cc498b31f4016c1f5dde8e0e4d71
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:06 2026 -0800

    crypto: aes - Remove aes-fixed-time / CONFIG_CRYPTO_AES_TI
    
    Remove aes-fixed-time, i.e. CONFIG_CRYPTO_AES_TI.  This was a wrapper
    around the 256-byte-table-based AES implementation in lib/crypto/aes.c,
    with extra code to enable and disable IRQs for constant-time hardening.
    
    While nice in theory, in practice this had the following issues:
    
    - For bulk en/decryption it was 2-4 times slower than aes-generic.  This
      resulted in aes-generic still being needed, creating fragmentation.
    
    - Having both aes-generic and aes-fixed-time punted an AES
      implementation decision to distros and users who are generally
      unprepared to handle it.  In practice, whether aes-fixed-time gets
      used tends to be incidental and not match an explicit distro or user
      intent.  (While aes-fixed-time has a higher priority than aes-generic,
      whether it actually gets enabled, loaded, and used depends on the
      kconfig and whether a modprobe of "aes" happens to be done.  It also
      has a lower priority than aes-arm and aes-arm64.)
    
    - My changes to the generic AES code (in other commits) significantly
      close the gap with aes-fixed-time anyway.  The table size is reduced
      from 8192 bytes to 1024 bytes, and prefetching is added.
    
    - While AES code *should* be constant-time, the real solutions for that
      are AES instructions (which most CPUs have now) or bit-slicing.  arm
      and arm64 already have bit-sliced AES code for many modes; generic
      bit-sliced code could be written but would be very slow for single
      blocks.  Overall, I suggest that trying to write constant-time
      table-based AES code is a bit futile anyway, and in the rare cases
      where a proper AES implementation is still unavailable it's reasonable
      to compromise with an implementation that simply prefetches the table.
    
    Thus, this commit removes aes-fixed-time and CONFIG_CRYPTO_AES_TI.  The
    replacement is just the existing CONFIG_CRYPTO_AES, which for now maps
    to the existing aes-generic code, but I'll soon be changing to use the
    improved AES library code instead.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-9-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 637e73ef99930b2d55b91868e7297689ca06f37d
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:05 2026 -0800

    crypto: aegis - Switch from crypto_ft_tab[] to aes_enc_tab[]
    
    Instead of crypto_ft_tab[0] from aes_generic.c, use aes_enc_tab from
    lib/crypto/aes.c.  These contain the same data, so the result is the
    same.  This will allow aes_generic.c to eventually be removed.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-8-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 5be8dcc1d0dd5b4bd431d1d052e79f01dd2e33c4
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:04 2026 -0800

    crypto: arm64/aes - Select CRYPTO_LIB_SHA256 from correct places
    
    The call to sha256() occurs in code that is built when either
    CRYPTO_AES_ARM64_CE_BLK or CRYPTO_AES_ARM64_NEON_BLK.  The option
    CRYPTO_AES_ARM64 is unrelated, notwithstanding its documentation.  I'll
    be removing CRYPTO_AES_ARM64 soon anyway, but before doing that, fix
    where CRYPTO_LIB_SHA256 is selected from.
    
    Fixes: 01834444d972 ("crypto: arm64/aes - use SHA-256 library instead of crypto_shash")
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-7-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 1cb2fcb61c6d58c59a01da1fa8330e3101818759
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:03 2026 -0800

    crypto: arm64/aes - Switch to aes_enc_tab[] and aes_dec_tab[]
    
    Instead of crypto_ft_tab and crypto_it_tab from aes_generic.c, use
    aes_enc_tab and aes_dec_tab from lib/crypto/aes.c.  These contain the
    same data in the first 1024 bytes (which is the part that this code
    uses), so the result is the same.  This will allow aes_generic.c to
    eventually be removed.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-6-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit f367305a5d0f72d2e8c656f144db424f791dc5e1
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:02 2026 -0800

    crypto: arm/aes - Switch to aes_enc_tab[] and aes_dec_tab[]
    
    Instead of crypto_ft_tab and crypto_it_tab from aes_generic.c, use
    aes_enc_tab and aes_dec_tab from lib/crypto/aes.c.  These contain the
    same data in the first 1024 bytes (which is the part that this code
    uses), so the result is the same.  This will allow aes_generic.c to
    eventually be removed.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-5-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit a4e4e44649ba5f2d59f056ba59885fb080caa22e
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:01 2026 -0800

    crypto: arm/aes-neonbs - Use AES library for single blocks
    
    aes-neonbs-glue.c calls __aes_arm_encrypt() and __aes_arm_decrypt() to
    en/decrypt single blocks for CBC encryption, XTS tweak encryption, and
    XTS ciphertext stealing.  In preparation for making the AES library use
    this same ARM-optimized single-block AES en/decryption code and making
    it an internal implementation detail of the AES library, replace the
    calls to these functions with calls to the AES library.
    
    Note that this reduces the size of the aesbs_cbc_ctx and aesbs_xts_ctx
    structs, since unnecessary decryption round keys are no longer included.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-4-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit a22fd0e3c495dd2d706c49c26663476e24d96e7d
Author: Eric Biggers 
Date:   Mon Jan 12 11:20:00 2026 -0800

    lib/crypto: aes: Introduce improved AES library
    
    The kernel's AES library currently has the following issues:
    
    - It doesn't take advantage of the architecture-optimized AES code,
      including the implementations using AES instructions.
    
    - It's much slower than even the other software AES implementations: 2-4
      times slower than "aes-generic", "aes-arm", and "aes-arm64".
    
    - It requires that both the encryption and decryption round keys be
      computed and cached.  This is wasteful for users that need only the
      forward (encryption) direction of the cipher: the key struct is 484
      bytes when only 244 are actually needed.  This missed optimization is
      very common, as many AES modes (e.g. GCM, CFB, CTR, CMAC, and even the
      tweak key in XTS) use the cipher only in the forward (encryption)
      direction even when doing decryption.
    
    - It doesn't provide the flexibility to customize the prepared key
      format.  The API is defined to do key expansion, and several callers
      in drivers/crypto/ use it specifically to expand the key.  This is an
      issue when integrating the existing powerpc, s390, and sparc code,
      which is necessary to provide full parity with the traditional API.
    
    To resolve these issues, I'm proposing the following changes:
    
    1. New structs 'aes_key' and 'aes_enckey' are introduced, with
       corresponding functions aes_preparekey() and aes_prepareenckey().
    
       Generally these structs will include the encryption+decryption round
       keys and the encryption round keys, respectively.  However, the exact
       format will be under control of the architecture-specific AES code.
    
       (The verb "prepare" is chosen over "expand" since key expansion isn't
       necessarily done.  It's also consistent with hmac*_preparekey().)
    
    2. aes_encrypt() and aes_decrypt() will be changed to operate on the new
       structs instead of struct crypto_aes_ctx.
    
    3. aes_encrypt() and aes_decrypt() will use architecture-optimized code
       when available, or else fall back to a new generic AES implementation
       that unifies the existing two fragmented generic AES implementations.
    
       The new generic AES implementation uses tables for both SubBytes and
       MixColumns, making it almost as fast as "aes-generic".  However,
       instead of aes-generic's huge 8192-byte tables per direction, it uses
       only 1024 bytes for encryption and 1280 bytes for decryption (similar
       to "aes-arm").  The cost is just some extra rotations.
    
       The new generic AES implementation also includes table prefetching,
       making it have some "constant-time hardening".  That's an improvement
       from aes-generic which has no constant-time hardening.
    
       It does slightly regress in constant-time hardening vs. the old
       lib/crypto/aes.c which had smaller tables, and from aes-fixed-time
       which disabled IRQs on top of that.  But I think this is tolerable.
       The real solutions for constant-time AES are AES instructions or
       bit-slicing.  The table-based code remains a best-effort fallback for
       the increasingly-rare case where a real solution is unavailable.
    
    4. crypto_aes_ctx and aes_expandkey() will remain for now, but only for
       callers that are using them specifically for the AES key expansion
       (as opposed to en/decrypting data with the AES library).
    
    This commit begins the migration process by introducing the new structs
    and functions, backed by the new generic AES implementation.
    
    To allow callers to be incrementally converted, aes_encrypt() and
    aes_decrypt() are temporarily changed into macros that use a _Generic
    expression to call either the old functions (which take crypto_aes_ctx)
    or the new functions (which take the new types).  Once all callers have
    been updated, these macros will go away, the old functions will be
    removed, and the "_new" suffix will be dropped from the new functions.
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-3-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit b599aacf12620b6964f140d2833860affc0ab676
Author: Eric Biggers 
Date:   Mon Jan 12 11:19:59 2026 -0800

    crypto: powerpc/aes - Rename struct aes_key
    
    Rename struct aes_key in aesp8-ppc.h and aes-gcm-p10-glue.c to
    p8_aes_key and p10_aes_key, respectively.  This frees up the name to use
    in the library API in .
    
    Acked-by: Ard Biesheuvel 
    Link: https://lore.kernel.org/r/20260112192035.10427-2-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 090e0ae303c76d4026b4bf50b2543690741730ae
Author: Zhao Mengmeng 
Date:   Mon Jan 12 09:25:11 2026 -1000

    cpuset: replace direct lockdep_assert_held() with lockdep_assert_cpuset_lock_held()
    
    We already added lockdep_assert_cpuset_lock_held(), use this new function
    to keep consistency.
    
    Signed-off-by: Zhao Mengmeng 
    Signed-off-by: Tejun Heo 

commit 88c51002d06f9a68a2b666f7e2c262b6e198f566
Author: Ian Rogers 
Date:   Sat Jan 10 20:13:33 2026 -0800

    perf addr2line: Add a libdw implementation
    
    Add an implementation of addr2line that uses libdw.
    
    Other addr2line implementations are slow, particularly in the case of
    forking addr2line.
    
    Add an implementation that caches the libdw information in the dso and
    uses it to find the file and line number information.
    
    Inline information is supported but because cu_walk_functions_at visits
    the leaf function last add a inline_list__append_tail to reverse the
    lists order.
    
    Committer testing:
    
      # perf probe -x ~/bin/perf libdw__addr2line
      Added new event:
        probe_perf:libdw_addr2line (on libdw__addr2line in /home/acme/bin/perf)
    
      You can now use it in all perf tools, such as:
    
            perf record -e probe_perf:libdw_addr2line -aR sleep 1
    
      #
      # perf stat -e probe_perf:libdw_addr2line perf report -f --dso perf --stdio -s srcfile,srcline
      # To display the perf.data header info, please use --header/--header-only options.
      #
      #
      # Total Lost Samples: 0
      #
      # Samples: 4K of event 'cpu/cycles/Pu'
      # Event count (approx.): 5535180842
      #
      # Overhead  Source File   Source:Line
      # ........  ............  ...............
      #
          99.04%  inlineloop.c  inlineloop.c:21
           0.46%  inlineloop.c  inlineloop.c:20
    
      #
      # (Tip: For tracepoint events, try: perf report -s trace_fields)
      #
    
       Performance counter stats for 'perf report -f --dso perf --stdio -s srcfile,srcline':
    
                      44      probe_perf:libdw_addr2line
    
             0.037260744 seconds time elapsed
    
             0.025299000 seconds user
             0.011918000 seconds sys
      #
    
    Adding probes to the other addr2line implementations (llvm__addr2line,
    libbfd__addr2line and cmd__addr2line) I noticed some fallbacks to the
    llvm one:
    
     Performance counter stats for 'perf report -f --dso perf --stdio -s srcfile,srcline':
    
                    44      probe_perf:libdw_addr2line
                    23      probe_perf:llvm_addr2line
                     0      probe_perf:libbfd_addr2line
                     0      probe_perf:cmd_addr2line
    
    Something to investigate further, but at least we don't fallback to the
    cmd based one :-)
    
    Reviewed-by: James Clark 
    Signed-off-by: Ian Rogers 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Howard Chu 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Stephen Brennan 
    Cc: Tony Jones 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 27fc6f565d06837e71001368c84ee71e5221ce48
Author: Ian Rogers 
Date:   Sat Jan 10 20:13:37 2026 -0800

    perf test workload: Add inlineloop test workload
    
    The purpose of this workload is to gather samples in an inlined
    function. This can be used to test whether inlined addr2line works
    correctly.
    
    Committer testing:
    
      $ perf record perf test -w inlineloop 1
      [ perf record: Woken up 2 times to write data ]
      [ perf record: Captured and wrote 0.161 MB perf.data (4005 samples) ]
      $ perf report --stdio --dso perf -s srcfile,srcline
      #
      # Total Lost Samples: 0
      #
      # Samples: 4K of event 'cpu/cycles/Pu'
      # Event count (approx.): 5535180842
      #
      # Overhead  Source File   Source:Line
      # ........  ............  ...............
      #
          99.04%  inlineloop.c  inlineloop.c:21
           0.46%  inlineloop.c  inlineloop.c:20
      #
      $
    
    Reviewed-by: James Clark 
    Signed-off-by: Ian Rogers 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Howard Chu 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Stephen Brennan 
    Cc: Tony Jones 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit f815fc0c66e777c727689666cfb46b8d461c2f99
Author: Ian Rogers 
Date:   Sat Jan 10 20:13:32 2026 -0800

    perf unwind-libdw: Fix invalid reference counts
    
    The addition of addr_location__exit() causes use-after put on the maps
    and map references in the unwind info. Add the gets and then add the
    map_symbol__exit() calls.
    
    Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions")
    Reviewed-by: James Clark 
    Signed-off-by: Ian Rogers 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Howard Chu 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Stephen Brennan 
    Cc: Tony Jones 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 959a634ebcda02e0add101024a5793323d66cda5
Author: Eric Biggers 
Date:   Tue Jan 6 20:42:15 2026 -0800

    lib/crypto: mldsa: Add FIPS cryptographic algorithm self-test
    
    Since ML-DSA is FIPS-approved, add the boot-time self-test which is
    apparently required.
    
    Just add a test vector manually for now, borrowed from
    lib/crypto/tests/mldsa-testvecs.h (where in turn it's borrowed from
    leancrypto).  The SHA-* FIPS test vectors are generated by
    scripts/crypto/gen-fips-testvecs.py instead, but the common Python
    libraries don't support ML-DSA yet.
    
    Acked-by: Ard Biesheuvel 
    Reviewed-by: David Howells 
    Link: https://lore.kernel.org/r/20260107044215.109930-1-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 0d92c555320ad34e67523063e32630cfad13af5f
Author: Eric Biggers 
Date:   Sun Jan 4 21:36:52 2026 -0800

    lib/crypto: nh: Restore dependency of arch code on !KMSAN
    
    Since the architecture-specific implementations of NH initialize memory
    in assembly code, they aren't compatible with KMSAN as-is.
    
    Fixes: 382de740759a ("lib/crypto: nh: Add NH library")
    Link: https://lore.kernel.org/r/20260105053652.1708299-1-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit c8bf0b969d274036e82381818630eb8651c294f2
Author: Rusydi H. Makarim 
Date:   Sun Dec 14 18:15:12 2025 +0700

    lib/crypto: md5: Use rol32() instead of open-coding it
    
    For the bitwise left rotation in MD5STEP, use rol32() from
     instead of open-coding it.
    
    Signed-off-by: Rusydi H. Makarim 
    Link: https://lore.kernel.org/r/20251214-rol32_in_md5-v1-1-20f5f11a92b2@kriptograf.id
    Signed-off-by: Eric Biggers 

commit 0d8e6c0a1178cbe88e38113bf2a4277b4b21a76f
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:44 2025 -0800

    fscrypt: Drop obsolete recommendation to enable optimized NHPoly1305
    
    CONFIG_CRYPTO_NHPOLY1305_NEON, CONFIG_CRYPTO_NHPOLY1305_SSE2, and
    CONFIG_CRYPTO_NHPOLY1305_AVX2 no longer exist.  The equivalent
    optimizations are now just enabled automatically when Adiantum support
    is enabled.  Update the fscrypt documentation accordingly.
    
    Link: https://lore.kernel.org/r/20251211011846.8179-13-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 719316ad8eb0c2cb5120ad6098af22ce73726853
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:43 2025 -0800

    crypto: testmgr - Remove nhpoly1305 tests
    
    These are no longer used, since nhpoly1305 support has been removed from
    the crypto_shash API.
    
    Acked-by: Herbert Xu 
    Link: https://lore.kernel.org/r/20251211011846.8179-12-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit f676740c426535d0d2097e0b9adedb085634039b
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:42 2025 -0800

    crypto: nhpoly1305 - Remove crypto_shash support
    
    Remove nhpoly1305 support from crypto_shash.  It no longer has any user
    now that crypto/adiantum.c no longer uses it.
    
    Acked-by: Herbert Xu 
    Link: https://lore.kernel.org/r/20251211011846.8179-11-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 2f64821329d82ad2646efe59a40aaf40099bc9c3
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:41 2025 -0800

    crypto: adiantum - Drop support for asynchronous xchacha ciphers
    
    This feature isn't useful in practice.  Simplify and streamline the code
    in the synchronous case, i.e. the case that actually matters, instead.
    
    For example, by no longer having to support resuming the calculation
    after an asynchronous return of the xchacha cipher, we can just keep
    more of the state on the stack instead of in the request context.
    
    Link: https://lore.kernel.org/r/20251211011846.8179-10-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 73c203fe5564e6e4ec37b7e140214a334d584369
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:40 2025 -0800

    crypto: adiantum - Use memcpy_{to,from}_sglist()
    
    Call the newer, easier-to-read functions memcpy_to_sglist() and
    memcpy_from_sglist() directly instead of calling
    scatterwalk_map_and_copy().  No change in behavior.
    
    Acked-by: Herbert Xu 
    Link: https://lore.kernel.org/r/20251211011846.8179-9-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit cd912b3452d14c40e77b3be82854df00bfd38a41
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:39 2025 -0800

    crypto: adiantum - Use scatter_walk API instead of sg_miter
    
    Make adiantum_hash_message() use the scatter_walk API instead of
    sg_miter.  scatter_walk is a bit simpler and also more efficient.  For
    example, unlike sg_miter, scatter_walk doesn't require that the number
    of scatterlist entries be calculated up-front.
    
    Link: https://lore.kernel.org/r/20251211011846.8179-8-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 76987479c1a66f60126afe28e3cff01f3fc0f1ae
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:38 2025 -0800

    crypto: adiantum - Convert to use NH library
    
    Reimplement the Adiantum message hashing using the nh() library
    function, combined with some code which directly handles the Poly1305
    stage.  The latter code is derived from crypto/nhpoly1305.c.
    
    This eliminates the dependency on the "nhpoly1305" crypto_shash
    algorithm, which existed only to fit Adiantum message hashing into the
    traditional Linux crypto API paradigm.  Now that simple,
    architecture-optimized library functions are a well-established option
    too, we can switch to this simpler implementation.
    
    Note: I've dropped the support for the optional third parameter of the
    adiantum template, which specified the nhpoly1305 implementation.  We
    could keep accepting some strings in this parameter for backwards
    compatibility, but I don't think it's being used.  I believe only
    "adiantum(xchacha12,aes)" and "adiantum(xchacha20,aes)" are used.
    
    Link: https://lore.kernel.org/r/20251211011846.8179-7-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit a229d83235c7627c490deb7dd4744a72567cea12
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:37 2025 -0800

    lib/crypto: x86/nh: Migrate optimized code into library
    
    Migrate the x86_64 implementations of NH into lib/crypto/.  This makes
    the nh() function be optimized on x86_64 kernels.
    
    Note: this temporarily makes the adiantum template not utilize the
    x86_64 optimized NH code.  This is resolved in a later commit that
    converts the adiantum template to use nh() instead of "nhpoly1305".
    
    Link: https://lore.kernel.org/r/20251211011846.8179-6-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit b4a8528d17fbcd9027290c168efd6ba7ac4d4cd2
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:36 2025 -0800

    lib/crypto: arm64/nh: Migrate optimized code into library
    
    Migrate the arm64 NEON implementation of NH into lib/crypto/.  This
    makes the nh() function be optimized on arm64 kernels.
    
    Note: this temporarily makes the adiantum template not utilize the arm64
    optimized NH code.  This is resolved in a later commit that converts the
    adiantum template to use nh() instead of "nhpoly1305".
    
    Link: https://lore.kernel.org/r/20251211011846.8179-5-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 29e39a11f541d068ed7155368f4a79aa0ddf9c52
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:35 2025 -0800

    lib/crypto: arm/nh: Migrate optimized code into library
    
    Migrate the arm32 NEON implementation of NH into lib/crypto/.  This
    makes the nh() function be optimized on arm32 kernels.
    
    Note: this temporarily makes the adiantum template not utilize the arm32
    optimized NH code.  This is resolved in a later commit that converts the
    adiantum template to use nh() instead of "nhpoly1305".
    
    Link: https://lore.kernel.org/r/20251211011846.8179-4-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 7246fe6cd64475d8126a85eef6a3a425f105c203
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:34 2025 -0800

    lib/crypto: tests: Add KUnit tests for NH
    
    Add some simple KUnit tests for the nh() function.
    
    These replace the test coverage which will be lost by removing the
    nhpoly1305 crypto_shash.
    
    Note that the NH code also continues to be tested indirectly as well,
    via the tests for the "adiantum(xchacha12,aes)" crypto_skcipher.
    
    Link: https://lore.kernel.org/r/20251211011846.8179-3-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 14e15c71d7bb591fd08f527669717694810d3973
Author: Eric Biggers 
Date:   Wed Dec 10 17:18:33 2025 -0800

    lib/crypto: nh: Add NH library
    
    Add support for the NH "almost-universal hash function" to lib/crypto/,
    specifically the variant of NH used in Adiantum.
    
    This will replace the need for the "nhpoly1305" crypto_shash algorithm.
    All the implementations of "nhpoly1305" use architecture-optimized code
    only for the NH stage; they just use the generic C Poly1305 code for the
    Poly1305 stage.  We can achieve the same result in a simpler way using
    an (architecture-optimized) nh() function combined with code in
    crypto/adiantum.c that passes the results to the Poly1305 library.
    
    This commit begins this cleanup by adding the nh() function.  The code
    is derived from crypto/nhpoly1305.c and include/crypto/nhpoly1305.h.
    
    Link: https://lore.kernel.org/r/20251211011846.8179-2-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit ed894faccb8de55cd755e093c4b0971f190d384d
Author: Eric Biggers 
Date:   Sun Dec 14 10:17:12 2025 -0800

    lib/crypto: tests: Add KUnit tests for ML-DSA verification
    
    Add a KUnit test suite for ML-DSA verification, including the following
    for each ML-DSA parameter set (ML-DSA-44, ML-DSA-65, and ML-DSA-87):
    
    - Positive test (valid signature), using vector imported from leancrypto
    - Various negative tests:
        - Wrong length for signature, message, or public key
        - Out-of-range coefficients in z vector
        - Invalid encoded hint vector
        - Any bit flipped in signature, message, or public key
    - Unit test for the internal function use_hint()
    - A benchmark
    
    ML-DSA inputs and outputs are very large.  To keep the size of the tests
    down, use just one valid test vector per parameter set, and generate the
    negative tests at runtime by mutating the valid test vector.
    
    I also considered importing the test vectors from Wycheproof.  I've
    tested that mldsa_verify() indeed passes all of Wycheproof's ML-DSA test
    vectors that use an empty context string.  However, importing these
    permanently would add over 6 MB of source.  That's too much to be a
    reasonable addition to the Linux kernel tree for one algorithm.  It also
    wouldn't actually provide much better test coverage than this commit.
    Another potential issue is that Wycheproof uses the Apache license.
    
    Similarly, this also differs from the earlier proposal to import a long
    list of test vectors from leancrypto.  I retained only one valid
    signature for each algorithm, and I also added (runtime-generated)
    negative tests which were missing.  I think this is a better tradeoff.
    
    Reviewed-by: David Howells 
    Tested-by: David Howells 
    Link: https://lore.kernel.org/r/20251214181712.29132-3-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 64edccea594cf7cb1e2975fdf44531e3377b32db
Author: Eric Biggers 
Date:   Sun Dec 14 10:17:11 2025 -0800

    lib/crypto: Add ML-DSA verification support
    
    Add support for verifying ML-DSA signatures.
    
    ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is specified
    in FIPS 204 and is the standard version of Dilithium.  Unlike RSA and
    elliptic-curve cryptography, ML-DSA is believed to be secure even
    against adversaries in possession of a large-scale quantum computer.
    
    Compared to the earlier patch
    (https://lore.kernel.org/r/20251117145606.2155773-3-dhowells@redhat.com/)
    that was based on "leancrypto", this implementation:
    
      - Is about 700 lines of source code instead of 4800.
    
      - Generates about 4 KB of object code instead of 28 KB.
    
      - Uses 9-13 KB of memory to verify a signature instead of 31-84 KB.
    
      - Is at least about the same speed, with a microbenchmark showing 3-5%
        improvements on one x86_64 CPU and -1% to 1% changes on another.
        When memory is a bottleneck, it's likely much faster.
    
      - Correctly implements the RejNTTPoly step of the algorithm.
    
    The API just consists of a single function mldsa_verify(), supporting
    pure ML-DSA with any standard parameter set (ML-DSA-44, ML-DSA-65, or
    ML-DSA-87) as selected by an enum.  That's all that's actually needed.
    
    The following four potential features are unneeded and aren't included.
    However, any that ever become needed could fairly easily be added later,
    as they only affect how the message representative mu is calculated:
    
      - Nonempty context strings
      - Incremental message hashing
      - HashML-DSA
      - External mu
    
    Signing support would, of course, be a larger and more complex addition.
    However, the kernel doesn't, and shouldn't, need ML-DSA signing support.
    
    Note that mldsa_verify() allocates memory, so it can sleep and can fail
    with ENOMEM.  Unfortunately we don't have much choice about that, since
    ML-DSA needs a lot of memory.  At least callers have to check for errors
    anyway, since the signature could be invalid.
    
    Note that verification doesn't require constant-time code, and in fact
    some steps are inherently variable-time.  I've used constant-time
    patterns in some places anyway, but technically they're not needed.
    
    Reviewed-by: David Howells 
    Tested-by: David Howells 
    Link: https://lore.kernel.org/r/20251214181712.29132-2-ebiggers@kernel.org
    Signed-off-by: Eric Biggers 

commit 272bd8183376a9e20fe08bacbaa44003d7c8acaa
Author: Waiman Long 
Date:   Mon Jan 12 11:00:21 2026 -0500

    cgroup/cpuset: Move the v1 empty cpus/mems check to cpuset1_validate_change()
    
    As stated in commit 1c09b195d37f ("cpuset: fix a regression in validating
    config change"), it is not allowed to clear masks of a cpuset if
    there're tasks in it. This is specific to v1 since empty "cpuset.cpus"
    or "cpuset.mems" will cause the v2 cpuset to inherit the effective CPUs
    or memory nodes from its parent. So it is OK to have empty cpus or mems
    even if there are tasks in the cpuset.
    
    Move this empty cpus/mems check in validate_change() to
    cpuset1_validate_change() to allow more flexibility in setting
    cpus or mems in v2. cpuset_is_populated() needs to be moved into
    cpuset-internal.h as it is needed by the empty cpus/mems checking code.
    
    Also add a test case to test_cpuset_prs.sh to verify that.
    
    Reported-by: Chen Ridong 
    Closes: https://lore.kernel.org/lkml/7a3ec392-2e86-4693-aa9f-1e668a668b9c@huaweicloud.com/
    Signed-off-by: Waiman Long 
    Reviewed-by: Chen Ridong 
    Signed-off-by: Tejun Heo 

commit 2a3602030d800b6600ef55c31e21bc54611f7770
Author: Waiman Long 
Date:   Mon Jan 12 11:00:20 2026 -0500

    cgroup/cpuset: Don't invalidate sibling partitions on cpuset.cpus conflict
    
    Currently, when setting a cpuset's cpuset.cpus to a value that conflicts
    with the cpuset.cpus/cpuset.cpus.exclusive of a sibling partition,
    the sibling's partition state becomes invalid. This is overly harsh and
    is probably not necessary.
    
    The cpuset.cpus.exclusive control file, if set, will override the
    cpuset.cpus of the same cpuset when creating a cpuset partition.
    So cpuset.cpus has less priority than cpuset.cpus.exclusive in setting up
    a partition.  However, it cannot override a conflicting cpuset.cpus file
    in a sibling cpuset and the partition creation process will fail. This
    is inconsistent.  That will also make using cpuset.cpus.exclusive less
    valuable as a tool to set up cpuset partitions as the users have to
    check if such a cpuset.cpus conflict exists or not.
    
    Fix these problems by making sure that once a cpuset.cpus.exclusive
    is set without failure, it will always be allowed to form a valid
    partition as long as at least one CPU can be granted from its parent
    irrespective of the state of the siblings' cpuset.cpus values. Of
    course, setting cpuset.cpus.exclusive will fail if it conflicts with
    the cpuset.cpus.exclusive or the cpuset.cpus.exclusive.effective value
    of a sibling.
    
    Partition can still be created by setting only cpuset.cpus without
    setting cpuset.cpus.exclusive. However, any conflicting CPUs in sibling's
    cpuset.cpus.exclusive.effective and cpuset.cpus.exclusive values will
    be removed from its cpuset.cpus.exclusive.effective as long as there
    is still one or more CPUs left and can be granted from its parent. This
    CPU stripping is currently done in rm_siblings_excl_cpus().
    
    The new code will now try its best to enable the creation of new
    partitions with only cpuset.cpus set without invalidating existing ones.
    However it is not guaranteed that all the CPUs requested in cpuset.cpus
    will be used in the new partition even when all these CPUs can be
    granted from the parent.
    
    This is similar to the fact that cpuset.cpus.effective may not be
    able to include all the CPUs requested in cpuset.cpus. In this case,
    the parent may not able to grant all the exclusive CPUs requested in
    cpuset.cpus to cpuset.cpus.exclusive.effective if some of them have
    already been granted to other partitions earlier.
    
    With the creation of multiple sibling partitions by setting
    only cpuset.cpus, this does have the side effect that their exact
    cpuset.cpus.exclusive.effective settings will depend on the order of
    partition creation if there are conflicts. Due to the exclusive nature
    of the CPUs in a partition, it is not easy to make it fair other than
    the old behavior of invalidating all the conflicting partitions.
    
    For example,
      # echo "0-2" > A1/cpuset.cpus
      # echo "root" > A1/cpuset.cpus.partition
      # cat A1/cpuset.cpus.partition
      root
      # cat A1/cpuset.cpus.exclusive.effective
      0-2
      # echo "2-4" > B1/cpuset.cpus
      # echo "root" > B1/cpuset.cpus.partition
      # cat B1/cpuset.cpus.partition
      root
      # cat B1/cpuset.cpus.exclusive.effective
      3-4
      # cat B1/cpuset.cpus.effective
      3-4
    
    For users who want to be sure that they can get most of the CPUs they
    want, cpuset.cpus.exclusive should be used instead if they can set
    it successfully without failure. Setting cpuset.cpus.exclusive will
    guarantee that sibling conflicts from then onward is no longer possible.
    
    To make this change, we have to separate out the is_cpu_exclusive()
    check in cpus_excl_conflict() into a cgroup v1 only
    cpuset1_cpus_excl_conflict() helper. The cpus_allowed_validate_change()
    helper is now no longer needed and can be removed.
    
    Some existing tests in test_cpuset_prs.sh are updated and new ones are
    added to reflect the new behavior. The cgroup-v2.rst doc file is also
    updated the clarify what exclusive CPUs will be used when a partition
    is created.
    
    Reported-by: Sun Shaojie 
    Closes: https://lore.kernel.org/lkml/20251117015708.977585-1-sunshaojie@kylinos.cn/
    Signed-off-by: Waiman Long 
    Reviewed-by: Chen Ridong 
    Signed-off-by: Tejun Heo 

commit 6e6f13f6d5095f3a432da421e78f4d7d51ef39c8
Author: Waiman Long 
Date:   Mon Jan 12 11:00:19 2026 -0500

    cgroup/cpuset: Don't fail cpuset.cpus change in v2
    
    Commit fe8cd2736e75 ("cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE
    until valid partition") introduced a new check to disallow the setting
    of a new cpuset.cpus.exclusive value that is a superset of a sibling's
    cpuset.cpus value so that there will at least be one CPU left in the
    sibling in case the cpuset becomes a valid partition root. This new
    check does have the side effect of failing a cpuset.cpus change that
    make it a subset of a sibling's cpuset.cpus.exclusive value.
    
    With v2, users are supposed to be allowed to set whatever value they
    want in cpuset.cpus without failure. To maintain this rule, the check
    is now restricted to only when cpuset.cpus.exclusive is being changed
    not when cpuset.cpus is changed.
    
    The cgroup-v2.rst doc file is also updated to reflect this change.
    
    Signed-off-by: Waiman Long 
    Reviewed-by: Chen Ridong 
    Signed-off-by: Tejun Heo 

commit a1a01793ae1f6f99fd7174988d49b43cd1cb36c3
Author: Waiman Long 
Date:   Mon Jan 12 11:00:18 2026 -0500

    cgroup/cpuset: Consistently compute effective_xcpus in update_cpumasks_hier()
    
    Since commit f62a5d39368e ("cgroup/cpuset: Remove remote_partition_check()
    & make update_cpumasks_hier() handle remote partition"), the
    compute_effective_exclusive_cpumask() helper was extended to
    strip exclusive CPUs from siblings when computing effective_xcpus
    (cpuset.cpus.exclusive.effective). This helper was later renamed to
    compute_excpus() in commit 86bbbd1f33ab ("cpuset: Refactor exclusive
    CPU mask computation logic").
    
    This helper is supposed to be used consistently to compute
    effective_xcpus. However, there is an exception within the callback
    critical section in update_cpumasks_hier() when exclusive_cpus of a
    valid partition root is empty. This can cause effective_xcpus value to
    differ depending on where exactly it is last computed. Fix this by using
    compute_excpus() in this case to give a consistent result.
    
    Signed-off-by: Waiman Long 
    Reviewed-by: Chen Ridong 
    Signed-off-by: Tejun Heo 

commit 18bc2425a877c45b59c0972df30afb46084f8816
Author: Waiman Long 
Date:   Mon Jan 12 11:00:17 2026 -0500

    cgroup/cpuset: Streamline rm_siblings_excl_cpus()
    
    If exclusive_cpus is set, effective_xcpus must be a subset of
    exclusive_cpus. Currently, rm_siblings_excl_cpus() checks both
    exclusive_cpus and effective_xcpus consecutively. It is simpler
    to check only exclusive_cpus if non-empty or just effective_xcpus
    otherwise.
    
    No functional change is expected.
    
    Signed-off-by: Waiman Long 
    Reviewed-by: Chen Ridong 
    Signed-off-by: Tejun Heo 

commit ef92c4351ec75bcfb8a1cc3a88109b5339f296ef
Author: Ian Rogers 
Date:   Mon Dec 8 09:23:39 2025 -0800

    perf test subcmd help: Add exclude disjoint subcmd names
    
    The test is based on an error/fix posted to linux-perf-users.
    
    Reported-by: Sri Jayaramappa 
    Reviewed-by: Sri Jayaramappa 
    Signed-off-by: Ian Rogers 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Guilherme Amadio 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Closes: https://lore.kernel.org/linux-perf-users/20251202213632.2873731-1-sjayaram@akamai.com/
    Closes: https://urldefense.com/v3/__https://lore.kernel.org/linux-perf-users/20251202213632.2873731-1-sjayaram@akamai.com/__;!!GjvTz_vk!XehekKNUE4Ib_tvqIH6PMIIhly4X3BZ-Y40RC1HKMQ-6OdYEFvUPQhyWv_gk9vsRRN4_RcOLS2Bh0CQ$
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 6e5f2ad6bb74fd743c2162e32ac15e9061591ab1
Author: Ian Rogers 
Date:   Tue Dec 9 09:36:10 2025 -0800

    perf stat display: Make %f precision consistent
    
    Commit bc22de9bcdb22491 ("perf stat: Display time in precision based on
    std deviation") added multirun workload elapsed time. There was an
    effort to make the precision in the output most useful for the user,
    however, when gathering over runs it means the formatting varies. This
    change just makes the output format fixed.
    
    Before:
    ```
    $ while :; do perf stat --null --repeat 3 sleep 0.1 2>&1 | grep elapsed; done
              0.101140 +- 0.000149 seconds time elapsed  ( +-  0.15% )
             0.1011396 +- 0.0000218 seconds time elapsed  ( +-  0.02% )
              0.101331 +- 0.000124 seconds time elapsed  ( +-  0.12% )
    ^C
    $ while :; do perf stat --null --repeat 3 sleep 1 2>&1 | grep elapsed; done
              1.001317 +- 0.000146 seconds time elapsed  ( +-  0.01% )
              1.001377 +- 0.000172 seconds time elapsed  ( +-  0.02% )
               1.00253 +- 0.00131 seconds time elapsed  ( +-  0.13% )
    ```
    
    After:
    ```
    $ while :; do perf stat --null --repeat 3 sleep 0.1 2>&1 | grep elapsed; done
           0.101406408 +- 0.000064778 seconds time elapsed  ( +-  0.06% )
           0.101367315 +- 0.000027253 seconds time elapsed  ( +-  0.03% )
           0.101434164 +- 0.000084750 seconds time elapsed  ( +-  0.08% )
    ^C
    $ while :; do perf stat --null --repeat 3 sleep 1 2>&1 | grep elapsed; done
           1.001525467 +- 0.000051703 seconds time elapsed  ( +-  0.01% )
           1.001375093 +- 0.000116200 seconds time elapsed  ( +-  0.01% )
           1.001141025 +- 0.000046361 seconds time elapsed  ( +-  0.00% )
    ```
    
    Closes: https://lore.kernel.org/lkml/aTQRgAOpKyI53TEq@gmail.com/
    Suggested-by: Ingo Molnar 
    Signed-off-by: Ian Rogers 
    Tested-by: Ingo Molnar 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Chun-Tse Shao 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 817f66e39e39b914aac25065a34f4462ab45ed26
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:15 2026 +0100

    x86/xen: Drop xen_cpu_ops
    
    Instead of having a pre-filled array xen_cpu_ops for Xen PV paravirt
    functions, drop the array and assign each element individually.
    
    This is in preparation of reducing the paravirt include hell by
    splitting paravirt.h into multiple more fine grained header files,
    which will in turn require to split up the pv_ops vector as well.
    Dropping the pre-filled array makes life easier for objtool to
    detect missing initializers in multiple pv_ops_ arrays.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Boris Ostrovsky 
    Link: https://patch.msgid.link/20260105110520.21356-17-jgross@suse.com

commit 383f8e26e2c483e25453f8c3d0839877708ac701
Author: Nicolas Schier 
Date:   Thu Jan 8 12:29:10 2026 +0100

    perf build: Raise minimum shellcheck version to 0.7.2
    
    Raise the minimum shellcheck version for perf builds to 0.7.2, so that
    systems with shellcheck versions below 0.7.2 will automatically skip the
    shell script checking, even if NO_SHELLCHECK is unset.
    
    Since commit 241f21be7d0fdf3c ("perf test perftool_testsuite: Use
    absolute paths"), shellcheck versions before 0.7.2 break the perf build
    with several SC1090 [2] warnings due to its too strict dynamic source
    handling [1], e.g.:
    
      In tests/shell/base_probe/test_line_semantics.sh line 20:
      . "$DIR_PATH/../common/init.sh"
        ^---------------------------^ SC1090: Can't follow non-constant source. Use a directive to specify location.
    
    Fixes: 241f21be7d0fdf3c ("perf test perftool_testsuite: Use absolute paths")
    Signed-off-by: Nicolas Schier 
    Acked-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: Jakub Brnak 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Mark Rutland 
    Cc: Michael Petlan 
    Cc: Nicolas Schier 
    Cc: Peter Zijlstra 
    Cc: Philipp Hahn 
    Cc: Veronika Molnarova 
    Link: https://github.com/koalaman/shellcheck/issues/1998 # [1]
    Link: https://www.shellcheck.net/wiki/SC1090
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 46e7ced3ef5b56c90ae30634aade96d241a2dfef
Author: Miri Korenblit 
Date:   Thu Jan 8 14:32:57 2026 +0100

    wifi: mac80211: remove width argument from ieee80211_parse_bitrates
    
    The width parameter in ieee80211_parse_bitrates() is unused. Remove it.
    While at it, use the already fetched sband pointer as an argument
    instead of dereferencing it once again.
    
    Signed-off-by: Miri Korenblit 
    Link: https://patch.msgid.link/20260108143257.d13dbbda93f0.Ie70b24af583e3812883b4004ce227e7af1646855@changeid
    Signed-off-by: Johannes Berg 

commit 583f65f64b7748523da41e4c2d782a8c667c9214
Author: Johannes Berg 
Date:   Thu Jan 8 14:31:38 2026 +0100

    wifi: mac80211_hwsim: remove NAN by default
    
    We're improving NAN support, but NAN datapath support also
    means we need to change some other things, e.g. related to
    rate control. Remove NAN by default again from hwsim since
    it's the much newer feature.
    
    Link: https://patch.msgid.link/20260108143139.0d4af6ae3609.Ie444b9f5aedabc713c6a1279b5b55976cfb4c465@changeid
    Signed-off-by: Johannes Berg 

commit e272628902c1c96731e2d9f62a7fc77767686eb0
Author: Thomas Richter 
Date:   Wed Jan 7 14:32:16 2026 +0100

    perf test stat tests: Fix for virtualized machines
    
    On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for
    z/VM systems.  The root cause is this statement:
    
      $(perf stat -a -- sleep 0.1 2>&1 |\
                      grep -E "/cpu-cycles/[uH]*|  cpu-cycles[:uH]* -c)
    
    The 'perf stat' output on a s390 z/VM system is
    
      # perf stat -a -- sleep 0.1 2>&1
      Performance counter stats for 'system wide':
    
            56      context-switches  #     46.3 cs/sec  cs_per_second
      1,210.41 msec cpu-clock         #     11.9 CPUs  CPUs_utilized
            12      cpu-migrations    #      9.9 migrations/sec ...
            81      page-faults       #     66.9 faults/sec ...
    
            0.100891009 seconds time elapsed
    
    The grep command does not match any single line and exits with error
    code 1.
    
    As the bash script is executed with 'set -e', it aborts with the first
    error code being non-zero.
    
    Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'.
    
    Output before:
    
      # perf test 102
      102: perf stat tests                      : FAILED!
      #
    
    Output after:
    
      # perf test 102
      102: perf stat tests                      : Ok
      #
    
    Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest")
    Reviewed-by: Ian Rogers 
    Reviewed-by: James Clark 
    Signed-off-by: Thomas Richter 
    Cc: Alexander Gordeev 
    Cc: Heiko Carstens 
    Cc: Jan Polensky 
    Cc: linux-s390@vger.kernel.org
    Cc: Namhyung Kim 
    Cc: Sumanth Korikkar 
    Cc: Vasily Gorbik 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit f813117f200b5a7d12cdfc38482aa6e75af89e6f
Author: Johannes Berg 
Date:   Thu Jan 8 14:34:32 2026 +0100

    wifi: mac80211: improve station iteration ergonomics
    
    Right now, the only way to iterate stations is to declare an
    iterator function, possibly data structure to use, and pass all
    that to the iteration helper function. This is annoying, and
    there's really no inherent need for it.
    
    Add a new for_each_station() macro that does the iteration in
    a more ergonomic way. To avoid even more exported functions, do
    the old ieee80211_iterate_stations_mtx() as an inline using the
    new way, which may also let the compiler optimise it a bit more,
    e.g. via inlining the iterator function.
    
    Link: https://patch.msgid.link/20260108143431.d2b641f6f6af.I4470024f7404446052564b15bcf8b3f1ada33655@changeid
    Signed-off-by: Johannes Berg 

commit 6b3bafa2bd6b778a92884834b7382ed39b692155
Author: Johannes Berg 
Date:   Thu Jan 8 14:34:31 2026 +0100

    wifi: mac80211: improve interface iteration ergonomics
    
    Right now, the only way to iterate interfaces is to declare an
    iterator function, possibly data structure to use, and pass all
    that to the iteration helper function. This is annoying, and
    there's really no inherent need for it, except it was easier to
    implement with the iflist mutex, but that's not used much now.
    
    Add a new for_each_interface() macro that does the iteration in
    a more ergonomic way. To avoid even more exported functions, do
    the old ieee80211_iterate_active_interfaces_mtx() as an inline
    using the new way, which may also let the compiler optimise it
    a bit more, e.g. via inlining the iterator function.
    
    Also provide for_each_active_interface() for the common case of
    just iterating active interfaces.
    
    Link: https://patch.msgid.link/20260108143431.f2581e0c381a.Ie387227504c975c109c125b3c57f0bb3fdab2835@changeid
    Signed-off-by: Johannes Berg 

commit e1cbdf78f60c35a1a320ca401852fd6a73624a4a
Author: Lachlan Hodges 
Date:   Fri Jan 9 19:14:39 2026 +1100

    wifi: cfg80211: include S1G_NO_PRIMARY flag when sending channel
    
    When sending a channel ensure we include the IEEE80211_CHAN_S1G_NO_PRIMARY
    flag.
    
    Signed-off-by: Lachlan Hodges 
    Link: https://patch.msgid.link/20260109081439.3168-1-lachlan.hodges@morsemicro.com
    Signed-off-by: Johannes Berg 

commit 391234eb483152a81dfd7977e8f4d22867394d95
Author: Johannes Berg 
Date:   Fri Jan 9 09:50:30 2026 +0100

    wifi: mac80211: unexport ieee80211_get_bssid()
    
    This is only used within mac80211, and not even declared in
    a public header file. Don't export it.
    
    Link: https://patch.msgid.link/20260109095029.2b4d2fe53fc9.I9f5fa5c84cd42f749be0b87cc61dac8631c4c6d0@changeid
    Signed-off-by: Johannes Berg 

commit 2f8d489897ae7183b535b1881478b2c6b66d520b
Author: George Guo 
Date:   Sat Jan 10 00:12:14 2026 +0800

    sched_ext: Add error logging for dsq creation failures
    
    Add scx_bpf_error() calls when scx_bpf_create_dsq() fails in multiple
    schedulers to improve debuggability:
    
    - scx_central.bpf.c: central_init()
    - scx_flatcg.bpf.c: fcg_cgroup_init() and fcg_init()
    - scx_qmap.bpf.c: qmap_init()
    
    Signed-off-by: George Guo 
    Signed-off-by: Tejun Heo 

commit c2510a165056b67cded071ca76297620d022259f
Author: Thorsten Blum 
Date:   Sun Jan 11 14:42:57 2026 +0100

    wl1251: Replace strncpy with strscpy in wl1251_acx_fw_version
    
    strncpy() is deprecated [1] for NUL-terminated destination buffers since
    it does not guarantee NUL termination. Remove the manual NUL termination
    and replace strncpy() with strscpy() to ensure NUL termination of the
    destination buffer.
    
    Using strscpy_pad() to retain the NUL-padding behavior of strncpy() is
    not needed because ->fw_ver is only used as a C-string.
    
    Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20260111134301.598839-1-thorsten.blum@linux.dev
    Signed-off-by: Johannes Berg 

commit 710b9195ab125d51d746ab3080eb9ce769188d4b
Author: Tuo Li 
Date:   Mon Jan 12 01:11:18 2026 +0800

    wifi: iwlegacy: 3945-rs: remove redundant pointer check in il3945_rs_tx_status() and il3945_rs_get_rate()
    
    The variable il_sta passed into these two functions cannot be NULL, so
    remove the related null checks.
    
    Signed-off-by: Tuo Li 
    Acked-by: Stanislaw Gruszka 
    Link: https://patch.msgid.link/20260111171118.203249-1-islituo@gmail.com
    Signed-off-by: Johannes Berg 

commit 33821a2b20b96886e8821ab7cd75b9e26c41b43d
Author: Miri Korenblit 
Date:   Sun Jan 11 19:25:32 2026 +0200

    wifi: mac80211: don't send an unused argument to ieee80211_check_combinations
    
    When ieee80211_check_combinations is called with NULL as the chandef,
    the chanmode argument is not relevant. Send a don't care (0) instead.
    
    Reviewed-by: Johannes Berg 
    Signed-off-by: Miri Korenblit 
    Link: https://patch.msgid.link/20260111192411.9aa743647b43.I407b3d878d94464ce01e25f16c6e2b687bcd8b5a@changeid
    Signed-off-by: Johannes Berg 

commit bc5e8e2fa2e28ef6c2a55ae294d04100d4b1bffe
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:14 2026 +0100

    x86/xen: Drop xen_irq_ops
    
    Instead of having a pre-filled array xen_irq_ops for Xen PV paravirt
    functions, drop the array and assign each element individually.
    
    This is in preparation of reducing the paravirt include hell by
    splitting paravirt.h into multiple more fine grained header files,
    which will in turn require to split up the pv_ops vector as well.
    Dropping the pre-filled array makes life easier for objtool to
    detect missing initializers in multiple pv_ops_ arrays.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Boris Ostrovsky 
    Link: https://patch.msgid.link/20260105110520.21356-16-jgross@suse.com

commit 2a7151942e8b1c92f3b71c0c5cb385df9a3df5e8
Merge: 7966cf0ebe32c9 10c3ab8cd8975c
Author: Rafael J. Wysocki 
Date:   Mon Jan 12 19:37:19 2026 +0100

    Merge back material related to system sleep for 6.20

commit 130a82760718997806a618490f5b7ab06932bd9c
Author: Caleb Sander Mateos 
Date:   Mon Jan 5 14:05:42 2026 -0700

    io_uring/register: drop io_register_enable_rings() submitter_task check
    
    io_register_enable_rings() checks that the io_ring_ctx is
    IORING_SETUP_R_DISABLED, which ensures submitter_task hasn't been
    assigned by io_uring_create() or a previous io_register_enable_rings()
    call. So drop the redundant check that submitter_task is NULL.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Joanne Koong 
    Reviewed-by: Gabriel Krisman Bertazi 
    Signed-off-by: Jens Axboe 

commit bcd4c95737d15fa1a85152b8862dec146b11c214
Author: Caleb Sander Mateos 
Date:   Mon Jan 5 14:05:41 2026 -0700

    io_uring/msg_ring: drop unnecessary submitter_task checks
    
    __io_msg_ring_data() checks that the target_ctx isn't
    IORING_SETUP_R_DISABLED before calling io_msg_data_remote(), which calls
    io_msg_remote_post(). So submitter_task can't be modified concurrently
    with the read in io_msg_remote_post(). Additionally, submitter_task must
    exist, as io_msg_data_remote() is only called for io_msg_need_remote(),
    i.e. task_complete is set, which requires IORING_SETUP_DEFER_TASKRUN,
    which in turn requires IORING_SETUP_SINGLE_ISSUER. And submitter_task is
    assigned in io_uring_create() or io_register_enable_rings() before
    enabling any IORING_SETUP_SINGLE_ISSUER io_ring_ctx.
    Similarly, io_msg_send_fd() checks IORING_SETUP_R_DISABLED and
    io_msg_need_remote() before calling io_msg_fd_remote(). submitter_task
    therefore can't be modified concurrently with the read in
    io_msg_fd_remote() and must be non-null.
    io_register_enable_rings() can't run concurrently because it's called
    from io_uring_register() -> __io_uring_register() with uring_lock held.
    Thus, replace the READ_ONCE() and WRITE_ONCE() of submitter_task with
    plain loads and stores. And remove the NULL checks of submitter_task in
    io_msg_remote_post() and io_msg_fd_remote().
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Joanne Koong 
    Reviewed-by: Gabriel Krisman Bertazi 
    Signed-off-by: Jens Axboe 

commit 7a8737e1132ff07ca225aa7a4008f87319b5b1ca
Author: Caleb Sander Mateos 
Date:   Mon Jan 5 14:05:40 2026 -0700

    io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
    
    io_uring_enter(), __io_msg_ring_data(), and io_msg_send_fd() read
    ctx->flags and ctx->submitter_task without holding the ctx's uring_lock.
    This means they may race with the assignment to ctx->submitter_task and
    the clearing of IORING_SETUP_R_DISABLED from ctx->flags in
    io_register_enable_rings(). Ensure the correct ordering of the
    ctx->flags and ctx->submitter_task memory accesses by storing to
    ctx->flags using release ordering and loading it using acquire ordering.
    
    Signed-off-by: Caleb Sander Mateos 
    Fixes: 4add705e4eeb ("io_uring: remove io_register_submitter")
    Reviewed-by: Joanne Koong 
    Reviewed-by: Gabriel Krisman Bertazi 
    Signed-off-by: Jens Axboe 

commit 574b3eb843dea1ad99162e115abdb610b6780cbd
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:13 2026 +0100

    x86/paravirt: Move pv_native_*() prototypes to paravirt.c
    
    The only reason the pv_native_*() prototypes are needed is the complete
    definition of those functions via an asm() statement, which makes it
    impossible to have those functions as static ones.
    
    Move the prototypes from paravirt_types.h into paravirt.c, which is the
    only source referencing the functions.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260105110520.21356-15-jgross@suse.com

commit b1dcec9bd8a1de5fe04ecb3831f8db0a5c059970
Author: Daniele Ceraolo Spurio 
Date:   Wed Jan 7 17:13:44 2026 -0800

    drm/xe/ptl: Enable PXP for PTL
    
    Now that the GSC FW is defined, we can enable PXP for PTL. The feature
    will only be turned on if the binary is found on disk.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Rodrigo Vivi 
    Cc: Julia Filipchuk 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20260108011340.2562349-8-daniele.ceraolospurio@intel.com

commit 6d24027d555e46e9f302523c95b3816198779f4d
Author: Daniele Ceraolo Spurio 
Date:   Wed Jan 7 17:13:43 2026 -0800

    drm/xe/ptl: Define GSC for PTL
    
    PTL is identified by GSC major version 105. The compatibility version is
    still 1.0.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Rodrigo Vivi 
    Cc: Julia Filipchuk 
    Reviewed-by: Julia Filipchuk 
    Link: https://patch.msgid.link/20260108011340.2562349-7-daniele.ceraolospurio@intel.com

commit 65b65ffcf669c37e120bcfd3d9cef62ac961bc60
Author: Daniele Ceraolo Spurio 
Date:   Wed Jan 7 17:13:42 2026 -0800

    drm/xe/gsc: Make GSC FW load optional for newer platforms
    
    On newer platforms GSC FW is only required for content protection
    features, so the core driver features work perfectly fine without it
    (and we did in fact not enable it to start with on PTL). Therefore, we
    can selectively enable the GSC only if the FW is found on disk, without
    failing if it is not found.
    
    Note that this means that the FW can now be enabled (i.e., we're looking
    for it) but not available (i.e., we haven't found it), so checks on FW
    support should use the latter state to decide whether to go on or not.
    
    As part of the rework, the message for FW not found has been cleaned up
    to be more readable.
    
    While at it, drop the comment about xe_uc_fw_init() since the code has
    been reworked and the statement no longer applies.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Rodrigo Vivi 
    Cc: Julia Filipchuk 
    Reviewed-by: Rodrigo Vivi 
    Reviewed-by: Julia Filipchuk 
    Link: https://patch.msgid.link/20260108011340.2562349-6-daniele.ceraolospurio@intel.com

commit f01b4f4a60191fa2a78931e2a3986983ec4f5334
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:12 2026 +0100

    x86/paravirt: Introduce new paravirt-base.h header
    
    Move the pv_info related definitions and the declarations of the global
    paravirt function primitives into a new header file paravirt-base.h.
    
    Use that header instead of paravirt_types.h in ptrace.h.
    
    Additionally, this is a preparation to reduce the include hell with paravirt
    enabled.
    
      [ bp: Massage commit message. ]
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260105110520.21356-14-jgross@suse.com

commit 39965afb11511003cf7d8f34579bd592b8b70b80
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:11 2026 +0100

    x86/paravirt: Move paravirt_sched_clock() related code into tsc.c
    
    The only user of paravirt_sched_clock() is in tsc.c, so move the code
    from paravirt.c and paravirt.h to tsc.c.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-13-jgross@suse.com

commit fd09d259c161086849774f9261cab16c58ba7dff
Author: Sean Christopherson 
Date:   Fri Dec 5 16:43:11 2025 -0800

    KVM: x86: Hide KVM_IRQCHIP_KERNEL behind CONFIG_KVM_IOAPIC=y
    
    Enumerate KVM_IRQCHIP_KERNEL if and only if support for an in-kernel I/O
    APIC is enabled, as all usage is likewise guarded by CONFIG_KVM_IOAPIC=y.
    
    Link: https://patch.msgid.link/20251206004311.479939-10-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 59c3e0603d8614e0f5e17089182ca596cf3fc552
Author: Sean Christopherson 
Date:   Fri Dec 5 16:43:10 2025 -0800

    KVM: x86: Bury ioapic.h definitions behind CONFIG_KVM_IOAPIC
    
    Now that almost everything in ioapic.h is used only by code guarded by
    CONFIG_KVM_IOAPIC=y, bury (almost) the entire thing behind the Kconfig.
    
    Link: https://patch.msgid.link/20251206004311.479939-9-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 5cd6b1a6eebd564104897ca87be2812d8feafad4
Author: Sean Christopherson 
Date:   Fri Dec 5 16:43:09 2025 -0800

    KVM: x86: Fold "struct dest_map" into "struct rtc_status"
    
    Drop "struct dest_map" and fold its members into its one and only user,
    "struct rtc_status".  Tracking "pending" EOIs and associated vCPUs is very
    much a hack for legacy RTC behavior, and should never be needed for other
    IRQ delivery.  In addition to making it more obvious why KVM tracks target
    vCPUs, this will allow burying the "struct rtc_status" definition behind
    CONFIG_KVM_IOAPIC=y, which in turn will make it even harder for KVM to
    misuse the structure.
    
    No functional change intended.
    
    Link: https://patch.msgid.link/20251206004311.479939-8-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 1a5d7f9540af1416402887435e4537dcef36a4b2
Author: Sean Christopherson 
Date:   Fri Dec 5 16:43:08 2025 -0800

    KVM: x86: Add a wrapper to handle common case of IRQ delivery without dest_map
    
    Turn kvm_irq_delivery_to_apic() into a wrapper that passes NULL for the
    @dest_map param, as only the ugly I/O APIC RTC hackery needs to know which
    vCPUs received the IRQ.
    
    No functional change intended.
    
    Link: https://patch.msgid.link/20251206004311.479939-7-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 4d846f183897606ba5e9c76494d19acbe1ba88f9
Author: Sean Christopherson 
Date:   Fri Dec 5 16:43:07 2025 -0800

    KVM: x86: Drop MAX_NR_RESERVED_IOAPIC_PINS, use KVM_MAX_IRQ_ROUTES directly
    
    Directly use KVM_MAX_IRQ_ROUTES when checking the number of routes being
    defined by userspace when creating a split IRQCHIP.  The restriction has
    nothing to do with the I/O APIC, e.g. most modern userspace usage is for
    routing MSIs.  Breaking the unnecessary dependency on the I/O APIC will
    allow burying all of ioapic.h behind CONFIG_KVM_IOAPIC=y.
    
    No functional change intended.
    
    Link: https://patch.msgid.link/20251206004311.479939-6-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 9eabb2a5e499ec3e5a013157844335a487c7cb5e
Author: Sean Christopherson 
Date:   Fri Dec 5 16:43:06 2025 -0800

    KVM: x86: Drop guest-triggerable ASSERT()s on I/O APIC access alignment
    
    Drop the asserts on the guest-controlled address being 16-byte aligned
    when emulating I/O APIC accesses, as the ASSERT()s are guest-triggerable
    and ultimately pointless since KVM requires exact register matches, i.e.
    will ultimately ignore unaligned accesses anyways.
    
    Drop the ASSERT() definition itself now that all users are gone.
    
    For all intents and purposes, no functional change intended.
    
    Link: https://patch.msgid.link/20251206004311.479939-5-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit ca909f9ea8cb19032c9d9d7841a8e2395b6a9e8b
Author: Sean Christopherson 
Date:   Fri Dec 5 16:43:05 2025 -0800

    KVM: x86: Drop ASSERT() on I/O APIC EOIs being only for LEVEL_to WARN_ON_ONCE
    
    Remove kvm_ioapic_update_eoi_one()'s ASSERT() that the vector's entry is
    configured to be level-triggered, as KVM intercepts and forward EOIs to
    the I/O APIC even for edge-triggered IRQs (see kvm_ioapic_scan_entry()),
    and nothing guarantees the local APIC's TMR register is synchronized with
    the I/O APIC redirection table, i.e. the @trigger_mode check just out of
    sight doesn't provide any meaningful protection.
    
    Given that roughly half of the historic ASSERT()s are/were guest- and/or
    user-triggerable, it's safe to assume no one has run meaningful workloads
    with DEBUG=1, i.e. that the ASSERT() has been dead code since it was
    added 18+ years ago.
    
    Opportunistically drop the unnecessary forward declaration of
    kvm_ioapic_update_eoi_one().
    
    For all intents and purposes, no functional change intended.
    
    Link: https://patch.msgid.link/20251206004311.479939-4-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 37187992dd821e0283da3f7664ef3d6ab4220ef8
Author: Sean Christopherson 
Date:   Fri Dec 5 16:43:04 2025 -0800

    KVM: x86: Drop guest/user-triggerable asserts on IRR/ISR vectors
    
    Remove the ASSERT()s in apic_find_highest_i{r,s}r() that exist to detect
    illegal vectors (0-15 are reserved and never recognized by the local APIC),
    as the asserts, if they were ever to be enabled by #defining DEBUG, can be
    trivially triggered from both the guest and from userspace, and ultimately
    because the ASSERT()s are useless.
    
    In large part due to lack of emulation for the Error Status Register and
    its "delayed" read semantics, KVM doesn't filter out bad IRQs (IPIs or
    otherwise) when IRQs are sent or received.  Instead, probably by dumb
    luck on KVM's part, KVM effectively ignores pending illegal vectors in
    the IRR due vector 0-15 having priority '0', and thus never being higher
    priority than PPR.
    
    As for ISR, a misbehaving userspace could stuff illegal vector bits, but
    again the end result is mostly benign (aside from userspace likely
    breaking the VM), as processing illegal vectors "works" and doesn't cause
    functional problems.
    
    Regardless of the safety and correctness of KVM's illegal vector handling,
    one thing is for certain: the ASSERT()s have done absolutely nothing to
    help detect such issues since they were added 18+ years ago by commit
    97222cc83163 ("KVM: Emulate local APIC in kernel").
    
    For all intents and purposes, no functional change intended.
    
    Link: https://patch.msgid.link/20251206004311.479939-3-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit a4978324e4bd80427313e0baa16e53709e14d878
Author: Sean Christopherson 
Date:   Fri Dec 5 16:43:03 2025 -0800

    KVM: x86: Drop ASSERT()s on APIC/vCPU being non-NULL
    
    Remove ASSERT()s on vCPU and APIC structures being non-NULL in the local
    APIC code as the DEBUG=1 path of ASSERT() ends with BUG(), i.e. isn't
    meaningfully better for debugging than a NULL pointer dereference.
    
    For all intents and purposes, no functional change intended.
    
    Link: https://patch.msgid.link/20251206004311.479939-2-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit fc4d3a6558af99e7b6a2ede6a6e6605be41da0ee
Author: Sean Christopherson 
Date:   Fri Nov 21 11:05:14 2025 -0800

    KVM: x86: Enforce use of EXPORT_SYMBOL_FOR_KVM_INTERNAL
    
    Add a (gnarly) inline "script" in the Makefile to fail the build if there
    is EXPORT_SYMBOL_GPL or EXPORT_SYMBOL usage in virt/kvm or arch/x86/kvm
    beyond the known-good/expected exports for other modules.  Remembering to
    use EXPORT_SYMBOL_FOR_KVM_INTERNAL is surprisingly difficult, and hoping
    to detect "bad" exports via code review is not a robust long-term strategy.
    
    Jump through a pile of hoops to coerce make into printing a human-friendly
    error message, with the offending files+lines cleanly separated.
    
    E.g. where  is the resolution of $(srctree), i.e. '.' for in-tree
    builds, and the absolute path for out-of-tree-builds:
    
      /arch/x86/kvm/Makefile:97: *** ERROR ***
      found 2 unwanted occurrences of EXPORT_SYMBOL_GPL:
        /arch/x86/kvm/x86.c:686:EXPORT_SYMBOL_GPL(__kvm_set_user_return_msr);
        /arch/x86/kvm/x86.c:703:EXPORT_SYMBOL_GPL(kvm_set_user_return_msr);
      in directories:
        /arch/x86/kvm
        /virt/kvm
      Use EXPORT_SYMBOL_FOR_KVM_INTERNAL, not EXPORT_SYMBOL_GPL.  Stop.
    
    and
    
      /arch/x86/kvm/Makefile:98: *** ERROR ***
      found 1 unwanted occurrences of EXPORT_SYMBOL:
        /arch/x86/kvm/x86.c:709:EXPORT_SYMBOL(kvm_get_user_return_msr);
      in directories:
        /arch/x86/kvm
        /virt/kvm
      Use EXPORT_SYMBOL_FOR_KVM_INTERNAL, not EXPORT_SYMBOL.  Stop.
    
    Put the enforcement in x86's Makefile even though the rule itself applies
    to virt/kvm, as putting the enforcement in virt/kvm/Makefile.kvm would
    effectively require exempting every architecture except x86.  PPC is the
    only other architecture with sub-modules, and PPC hasn't been switched to
    use EXPORT_SYMBOL_FOR_KVM_INTERNAL (and given its nearly-orphaned state,
    likely never will).  And for KVM architectures without sub-modules, that
    means that, barring truly spurious exports, the exports are intended for
    non-KVM usage and thus shouldn't be using EXPORT_SYMBOL_FOR_KVM_INTERNAL.
    
    Tested-by: Chao Gao 
    Link: https://patch.msgid.link/20251121190514.293385-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit d758c8d6e2624d7be12a6c070a3387d6703e4a7c
Author: Balasubramani Vivekanandan 
Date:   Fri Dec 19 20:20:25 2025 +0530

    drm/xe/device: Convert wait for lmem init into an assert
    
    Prior to lmem init check, driver is waiting for the pcode uncore_init
    status. uncore_init status will be flagged after the complete boot and
    initialization of the SoC by the pcode. uncore_init confirms that lmem
    init and mmio unblock has been already completed.
    It makes no sense to check for lmem init after the pcode uncore_init
    check. So change the wait for lmem init check into an assert which
    confirms lmem init is set.
    
    Signed-off-by: Balasubramani Vivekanandan 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20251219145024.2955946-2-balasubramani.vivekanandan@intel.com
    Signed-off-by: Matt Roper 

commit 2e18e787edddd8a21b3022d55dd0f6be7c422191
Author: Rosalie Wanders 
Date:   Sun Jan 11 22:00:50 2026 +0100

    HID: sony: add support for bluetooth Rock Band 4 PS4 guitars
    
    This commit adds support for the PDP Jaguar and MadCatz Stratocaster.
    
    Signed-off-by: Rosalie Wanders 
    Signed-off-by: Jiri Kosina 

commit a02857e73494a0c4dbeba16d8e6567de4ba1ca97
Author: Petr Vorel 
Date:   Sun Jan 11 23:36:43 2026 +0100

    Documentation/trace: Fix links to other documents
    
    Link to another document does not require 'file:'. Removing it fixes
    links in generated html docs.
    
    Signed-off-by: Petr Vorel 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260111223643.174812-2-pvorel@suse.cz>

commit 829656c3e263e4517a97ae02e5d60600339ed789
Author: Petr Vorel 
Date:   Sun Jan 11 23:36:42 2026 +0100

    Documentation: bug-hunting.rst: Remove wrong 'file:' syntax
    
    Link to another document does not require 'file:', therefore it was
    shown in generated html.
    
    Preformatted text requires just ``...``.
    
    Signed-off-by: Petr Vorel 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260111223643.174812-1-pvorel@suse.cz>

commit b0ada75879c253af1146cc9d70aaa7860776198c
Author: Shuah Khan 
Date:   Tue Jan 6 16:13:14 2026 -0700

    MAINTAINERS: Update for the doc subsystem
    
    Adding myself as a reviewer for doc subsystem.
    
    Signed-off-by: Shuah Khan 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260106231316.24474-1-skhan@linuxfoundation.org>

commit 41dc31ad21eafa0e104fdc36b6ed61407e46f238
Author: Diego Viola 
Date:   Wed Jan 7 05:04:09 2026 -0300

    CREDITS: add whitespace before opening parentheses
    
    in order to maintain consistent formatting across the file.
    
    Signed-off-by: Diego Viola 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260107080411.59483-1-diego.viola@gmail.com>

commit 09dc08b396c954820f119e1ab0c7d72333c18323
Author: Ben Dooks 
Date:   Mon Jan 12 15:49:09 2026 +0000

    regulator: dummy, make dummy_regulator_driver static
    
    When converting to faux_device the dummy_regulator_driver was
    made non-static however it isn't exported or defined anywhere
    outside the file it is in. Make it static to avoid the following
    sparse warning:
    
    drivers/regulator/dummy.c:59:24: warning: symbol 'dummy_regulator_driver' was not declared. Should it be static?
    
    Fixes: dcd2a9a5550ef556c8 ("regulator: dummy: convert to use the faux device interface")
    Signed-off-by: Ben Dooks 
    Link: https://patch.msgid.link/20260112154909.601987-1-ben.dooks@codethink.co.uk
    Signed-off-by: Mark Brown 

commit 6be9ea62afedef0f976eb3dba4c117be0c1d3809
Author: ChiYuan Huang 
Date:   Mon Jan 12 09:27:34 2026 +0800

    ASoC: codecs: rtq9128: Add compatible changes for rtq9154
    
    Although rtq9154 only modify the outter package, some register settings
    related to the channel order definition are still different. Use the chip
    model ID code to seperate these changes.
    
    Signed-off-by: ChiYuan Huang 
    Link: https://patch.msgid.link/ca3a07c8987a033c3d505f5d79956d0e935ea03f.1768180827.git.cy_huang@richtek.com
    Signed-off-by: Mark Brown 

commit b7d53fe53cb57db1ca5743d2ac2db28140c37647
Author: ChiYuan Huang 
Date:   Mon Jan 12 09:27:33 2026 +0800

    ASoC: dt-bindings: rtq9128: Add rtq9154 backward compatible
    
    Add rtq9154 backward compatible support.
    
    Signed-off-by: ChiYuan Huang 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/ab31e3965e9cb50ecdc14d5ea90d70dc26d1d187.1768180827.git.cy_huang@richtek.com
    Signed-off-by: Mark Brown 

commit daf86dcdbb40c4a0e4b8e579c6eecf148560711f
Author: ChiYuan Huang 
Date:   Mon Jan 12 09:27:32 2026 +0800

    ASoC: codecs: rtq9128: Modify the chip initial setting
    
    Modify the chip initial setting to default enable DC load detection
    function. This function is the chip specific feature that can detect
    the output open/short.
    
    Signed-off-by: ChiYuan Huang 
    Link: https://patch.msgid.link/340c88ae78edeb76cde812453c9a72d28b73e9f4.1768180827.git.cy_huang@richtek.com
    Signed-off-by: Mark Brown 

commit ef12d0573a7f5e7a495e81d773ae5f3e98230cd4
Merge: 8f0b4cce4481fb e6ce36ccc86f6d
Author: Christian Brauner 
Date:   Tue Nov 25 10:40:50 2025 +0100

    Merge patch series "initrd: remove half of classic initrd support"
    
    Askar Safin  says:
    
    This patchset will not affect anyone, who showed up in these lists.
    See [5] for details.
    
    Intro
    ====
    This patchset removes half of classic initrd (initial RAM disk) support,
    i. e. linuxrc code path, which was deprecated in 2020.
    Initramfs still stays, RAM disk itself (brd) still stays.
    And other half of initrd stays, too.
    init/do_mounts* are listed in VFS entry in
    MAINTAINERS, so I think this patchset should go through VFS tree.
    I tested the patchset on 8 (!!!) archs in Qemu (see details below).
    If you still use initrd, see below for workaround.
    
    In 2020 deprecation notice was put to linuxrc initrd code path.
    In v1 I tried to remove initrd
    fully, but Nicolas Schichan reported that he still uses
    other code path (root=/dev/ram0 one) on million devices [4].
    root=/dev/ram0 code path did not contain deprecation notice.
    
    So, in this version of patchset I remove deprecated code path,
    i. e. linuxrc one, while keeping other, i. e. root=/dev/ram0 one.
    
    Also I put deprecation notice to remaining code path, i. e. to
    root=/dev/ram0 one. I plan to send patches for full removal
    of initrd after one year, i. e. in January 2027 (of course,
    initramfs will still work).
    
    Also, I tried to make this patchset small to make sure it
    can be reverted easily. I plan to send cleanups later.
    
    Details
    ====
    Other user-visible changes:
    
    - Removed kernel command line parameters "load_ramdisk" and
    "prompt_ramdisk", which did nothing and were deprecated
    - Removed /proc/sys/kernel/real-root-dev . It was used
    for initrd only
    - Command line parameters "noinitrd" and "ramdisk_start=" are deprecated
    
    Testing
    ====
    I tested my patchset on many architectures in Qemu using my Rust
    program, heavily based on mkroot [1].
    
    I used the following cross-compilers:
    
    aarch64-linux-musleabi
    armv4l-linux-musleabihf
    armv5l-linux-musleabihf
    armv7l-linux-musleabihf
    i486-linux-musl
    i686-linux-musl
    mips-linux-musl
    mips64-linux-musl
    mipsel-linux-musl
    powerpc-linux-musl
    powerpc64-linux-musl
    powerpc64le-linux-musl
    riscv32-linux-musl
    riscv64-linux-musl
    s390x-linux-musl
    sh4-linux-musl
    sh4eb-linux-musl
    x86_64-linux-musl
    
    taken from this directory [2].
    
    So, as you can see, there are 18 triplets, which correspond to 8 subdirs in arch/.
    
    For every triplet I tested that:
    - Initramfs still works (both builtin and external)
    - Direct boot from disk still works
    - Remaining initrd code path (root=/dev/ram0) still works
    
    Workaround
    ====
    If "retain_initrd" is passed to kernel, then initramfs/initrd,
    passed by bootloader, is retained and becomes available after boot
    as read-only magic file /sys/firmware/initrd [3].
    
    No copies are involved. I. e. /sys/firmware/initrd is simply
    a reference to original blob passed by bootloader.
    
    This works even if initrd/initramfs is not recognized by kernel
    in any way, i. e. even if it is not valid cpio archive, nor
    a fs image supported by classic initrd.
    
    This works both with my patchset and without it.
    
    This means that you can emulate classic initrd so:
    link builtin initramfs to kernel; in /init in this initramfs
    copy /sys/firmware/initrd to some file in / and loop-mount it.
    
    This is even better than classic initrd, because:
    - You can use fs not supported by classic initrd, for example erofs
    - One copy is involved (from /sys/firmware/initrd to some file in /)
    as opposed to two when using classic initrd
    
    Still, I don't recommend using this workaround, because
    I want everyone to migrate to proper modern initramfs.
    But still you can use this workaround if you want.
    
    Also: it is not possible to directly loop-mount
    /sys/firmware/initrd . Theoretically kernel can be changed
    to allow this (and/or to make it writable), but I think nobody needs this.
    And I don't want to implement this.
    
    On Qemu's -initrd and GRUB's initrd
    ====
    Don't panic, this patchset doesn't remove initramfs
    (which is used by nearly all Linux distros). And I don't
    have plans to remove it.
    
    Qemu's -initrd option and GRUB's initrd command refer
    to initrd bootloader mechanism, which is used to
    load both initrd and (external) initramfs.
    
    So, if you use Qemu's -initrd or GRUB's initrd,
    then you likely use them to pass initramfs, and thus
    you are safe.
    
    v1: https://lore.kernel.org/lkml/20250913003842.41944-1-safinaskar@gmail.com/
    
    v1 -> v2 changes:
    - A lot. I removed most patches, see cover letter for details
    
    v2: https://lore.kernel.org/lkml/20251010094047.3111495-1-safinaskar@gmail.com/
    
    v2 -> v3 changes:
    - Commit messages
    - Expanded docs for "noinitrd"
    - Added link to /sys/firmware/initrd workaround to pr_warn
    
    v3: https://lore.kernel.org/lkml/20251017060956.1151347-1-safinaskar@gmail.com/
    
    v3 -> v4 changes:
    - Changed "September 2026" to "January 2027" (i. e. after 2026 LTS release)
    
    [1] https://github.com/landley/toybox/tree/master/mkroot
    [2] https://landley.net/toybox/downloads/binaries/toolchains/latest
    [3] https://lore.kernel.org/all/20231207235654.16622-1-graf@amazon.com/
    [4] https://lore.kernel.org/lkml/20250918152830.438554-1-nschichan@freebox.fr/
    [5] https://lore.kernel.org/lkml/20251022082604.25437-1-safinaskar@gmail.com/
    
    * patches from https://patch.msgid.link/20251119222407.3333257-1-safinaskar@gmail.com:
      init: remove /proc/sys/kernel/real-root-dev
      initrd: remove deprecated code path (linuxrc)
      init: remove deprecated "load_ramdisk" and "prompt_ramdisk" command line parameters
    
    Link: https://patch.msgid.link/20251119222407.3333257-1-safinaskar@gmail.com
    Signed-off-by: Christian Brauner 

commit e6ce36ccc86f6d447808a6e620f56d440d74aa19
Author: Askar Safin 
Date:   Wed Nov 19 22:24:07 2025 +0000

    init: remove /proc/sys/kernel/real-root-dev
    
    It is not used anymore.
    
    Signed-off-by: Askar Safin 
    Link: https://patch.msgid.link/20251119222407.3333257-4-safinaskar@gmail.com
    Reviewed-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit c350a65b566b527874b7ace5d904c57c107fae4f
Author: Askar Safin 
Date:   Wed Nov 19 22:24:06 2025 +0000

    initrd: remove deprecated code path (linuxrc)
    
    Remove linuxrc initrd code path, which was deprecated in 2020.
    
    Initramfs and (non-initial) RAM disks (i. e. brd) still work.
    
    Both built-in and bootloader-supplied initramfs still work.
    
    Non-linuxrc initrd code path (i. e. using /dev/ram as final root
    filesystem) still works, but I put deprecation message into it.
    
    Also I deprecate command line parameters "noinitrd" and "ramdisk_start=".
    
    Signed-off-by: Askar Safin 
    Link: https://patch.msgid.link/20251119222407.3333257-3-safinaskar@gmail.com
    Reviewed-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 78796b6bae8684b753b658f431b5b1ee24300d64
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:47 2026 -0700

    selftests: ublk: add end-to-end integrity test
    
    Add test case loop_08 to verify the ublk integrity data flow. It uses
    the kublk loop target to create a ublk device with integrity on top of
    backing data and integrity files. It then writes to the whole device
    with fio configured to generate integrity data. Then it reads back the
    whole device with fio configured to verify the integrity data.
    It also verifies that injected guard, reftag, and apptag corruptions are
    correctly detected.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 9e9f635525b12f055558a7cfe2e54d109839d030
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:46 2026 -0700

    selftests: ublk: add integrity params test
    
    Add test case null_04 to exercise all the different integrity params. It
    creates 4 different ublk devices with different combinations of
    integrity arguments and verifies their integrity limits via sysfs and
    the metadata_size utility.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit f48250dc5ba8368ccb587093eb20d1c7baecaacf
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:45 2026 -0700

    selftests: ublk: add integrity data support to loop target
    
    To perform and end-to-end test of integrity information through a ublk
    device, we need to actually store it somewhere and retrieve it. Add this
    support to kublk's loop target. It uses a second backing file for the
    integrity data corresponding to the data stored in the first file.
    The integrity file is initialized with byte 0xFF, which ensures the app
    and reference tags are set to the "escape" pattern to disable the
    bio-integrity-auto guard and reftag checks until the blocks are written.
    The integrity file is opened without O_DIRECT since it will be accessed
    at sub-block granularity. Each incoming read/write results in a pair of
    reads/writes, one to the data file, and one to the integrity file. If
    either backing I/O fails, the error is propagated to the ublk request.
    If both backing I/Os read/write some bytes, the ublk request is
    completed with the smaller of the number of blocks accessed by each I/O.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit a1805442674b85ff9d626965f828e4fd71a82b28
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:44 2026 -0700

    selftests: ublk: support non-O_DIRECT backing files
    
    A subsequent commit will add support for using a backing file to store
    integrity data. Since integrity data is accessed in intervals of
    metadata_size, which may be much smaller than a logical block on the
    backing device, direct I/O cannot be used. Add an argument to
    backing_file_tgt_init() to specify the number of files to open for
    direct I/O. The remaining files will use buffered I/O. For now, continue
    to request direct I/O for all the files.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 24f8a44b797f03dfadb455138930523599d3c22a
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:43 2026 -0700

    selftests: ublk: implement integrity user copy in kublk
    
    If integrity data is enabled for kublk, allocate an integrity buffer for
    each I/O. Extend ublk_user_copy() to copy the integrity data between the
    ublk request and the integrity buffer if the ublksrv_io_desc indicates
    that the request has integrity data.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 6ed6476c4aefa9ee3ba90f39bcc002dd034f6e03
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:42 2026 -0700

    selftests: ublk: add kublk support for integrity params
    
    Add integrity param command line arguments to kublk. Plumb these to
    struct ublk_params for the null and fault_inject targets, as they don't
    need to actually read or write the integrity data. Forbid the integrity
    params for loop or stripe until the integrity data copy is implemented.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 261b67f4e34716e793b0b95d2722b2fe780ed5f4
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:41 2026 -0700

    selftests: ublk: add utility to get block device metadata size
    
    Some block device integrity parameters are available in sysfs, but
    others are only accessible using the FS_IOC_GETLBMD_CAP ioctl. Add a
    metadata_size utility program to print out the logical block metadata
    size, PI offset, and PI size within the metadata. Example output:
    $ metadata_size /dev/ublkb0
    metadata_size: 64
    pi_offset: 56
    pi_tuple_size: 8
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit c1d7c0f9cdf6690eff4518f1c17a37d5ee647cd1
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:40 2026 -0700

    selftests: ublk: display UBLK_F_INTEGRITY support
    
    Add support for printing the UBLK_F_INTEGRITY feature flag in the
    human-readable kublk features output.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit bfe1255712a3b1c1f7418c5504a1bf53735d3848
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:39 2026 -0700

    ublk: optimize ublk_user_copy() on daemon task
    
    ublk user copy syscalls may be issued from any task, so they take a
    reference count on the struct ublk_io to check whether it is owned by
    the ublk server and prevent a concurrent UBLK_IO_COMMIT_AND_FETCH_REQ
    from completing the request. However, if the user copy syscall is issued
    on the io's daemon task, a concurrent UBLK_IO_COMMIT_AND_FETCH_REQ isn't
    possible, so the atomic reference count dance is unnecessary. Check for
    UBLK_IO_FLAG_OWNED_BY_SRV to ensure the request is dispatched to the
    sever and obtain the request from ublk_io's req field instead of looking
    it up on the tagset. Skip the reference count increment and decrement.
    Commit 8a8fe42d765b ("ublk: optimize UBLK_IO_REGISTER_IO_BUF on daemon
    task") made an analogous optimization for ublk zero copy buffer
    registration.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit b2503e936b598b993cb09005194dc77d2fa3f082
Author: Stanley Zhang 
Date:   Thu Jan 8 02:19:38 2026 -0700

    ublk: support UBLK_F_INTEGRITY
    
    Now that all the components of the ublk integrity feature have been
    implemented, add UBLK_F_INTEGRITY to UBLK_F_ALL, conditional on block
    layer integrity support (CONFIG_BLK_DEV_INTEGRITY). This allows ublk
    servers to create ublk devices with UBLK_F_INTEGRITY set and
    UBLK_U_CMD_GET_FEATURES to report the feature as supported.
    
    Signed-off-by: Stanley Zhang 
    [csander: make feature conditional on CONFIG_BLK_DEV_INTEGRITY]
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit be82a89066d595da334f6e153ababcedc3f92ad6
Author: Stanley Zhang 
Date:   Thu Jan 8 02:19:37 2026 -0700

    ublk: implement integrity user copy
    
    Add a function ublk_copy_user_integrity() to copy integrity information
    between a request and a user iov_iter. This mirrors the existing
    ublk_copy_user_pages() but operates on request integrity data instead of
    regular data. Check UBLKSRV_IO_INTEGRITY_FLAG in iocb->ki_pos in
    ublk_user_copy() to choose between copying data or integrity data.
    
    [csander: change offset units from data bytes to integrity data bytes,
     fix CONFIG_BLK_DEV_INTEGRITY=n build, rebase on user copy refactor]
    
    Signed-off-by: Stanley Zhang 
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit fd5a005fa6a261762292a2d89ef8d0174b66f541
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:36 2026 -0700

    ublk: move offset check out of __ublk_check_and_get_req()
    
    __ublk_check_and_get_req() checks that the passed in offset is within
    the data length of the specified ublk request. However, only user copy
    (ublk_check_and_get_req()) supports accessing ublk request data at a
    nonzero offset. Zero-copy buffer registration (ublk_register_io_buf())
    always passes 0 for the offset, so the check is unnecessary. Move the
    check from __ublk_check_and_get_req() to ublk_check_and_get_req().
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit ca80afd8708fa22f6d3a1e0306ae12a64e5291b5
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:35 2026 -0700

    ublk: inline ublk_check_and_get_req() into ublk_user_copy()
    
    ublk_check_and_get_req() has a single callsite in ublk_user_copy(). It
    takes a ton of arguments in order to pass local variables from
    ublk_user_copy() to ublk_check_and_get_req() and vice versa. And more
    are about to be added. Combine the functions to reduce the argument
    passing noise.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 5bfbbc9938f5dee7f252ef05f47b9a26f05f281a
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:34 2026 -0700

    ublk: split out ublk_user_copy() helper
    
    ublk_ch_read_iter() and ublk_ch_write_iter() are nearly identical except
    for the iter direction. Split out a helper function ublk_user_copy() to
    reduce the code duplication as these functions are about to get larger.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit fc652d415cd8b45e9a534d1c019da175cca4c95a
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:33 2026 -0700

    ublk: split out ublk_copy_user_bvec() helper
    
    Factor a helper function ublk_copy_user_bvec() out of
    ublk_copy_user_pages(). It will be used for copying integrity data too.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit f82f0a16a8270b17211254beeb123d11a0f279cd
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:32 2026 -0700

    ublk: set UBLK_IO_F_INTEGRITY in ublksrv_io_desc
    
    Indicate to the ublk server when an incoming request has integrity data
    by setting UBLK_IO_F_INTEGRITY in the ublksrv_io_desc's op_flags field.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 98bf2256855eb682433a33e6a7c4bce35191ca99
Author: Stanley Zhang 
Date:   Thu Jan 8 02:19:31 2026 -0700

    ublk: support UBLK_PARAM_TYPE_INTEGRITY in device creation
    
    Add a feature flag UBLK_F_INTEGRITY for a ublk server to request
    integrity/metadata support when creating a ublk device. The ublk server
    can also check for the feature flag on the created device or the result
    of UBLK_U_CMD_GET_FEATURES to tell if the ublk driver supports it.
    UBLK_F_INTEGRITY requires UBLK_F_USER_COPY, as user copy is the only
    data copy mode initially supported for integrity data.
    Add UBLK_PARAM_TYPE_INTEGRITY and struct ublk_param_integrity to struct
    ublk_params to specify the integrity params of a ublk device.
    UBLK_PARAM_TYPE_INTEGRITY requires UBLK_F_INTEGRITY and a nonzero
    metadata_size. The LBMD_PI_CAP_* and LBMD_PI_CSUM_* values from the
    linux/fs.h UAPI header are used for the flags and csum_type fields.
    If the UBLK_PARAM_TYPE_INTEGRITY flag is set, validate the integrity
    parameters and apply them to the blk_integrity limits.
    The struct ublk_param_integrity validations are based on the checks in
    blk_validate_integrity_limits(). Any invalid parameters should be
    rejected before being applied to struct blk_integrity.
    
    [csander: drop redundant pi_tuple_size field, use block metadata UAPI
     constants, add param validation]
    
    Signed-off-by: Stanley Zhang 
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit e859e7c26a5c4689083f161a52d039b9b454e403
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:30 2026 -0700

    ublk: move ublk flag check functions earlier
    
    ublk_dev_support_user_copy() will be used in ublk_validate_params().
    Move these functions next to ublk_{dev,queue}_is_zoned() to avoid
    needing to forward-declare them.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit 835042fb1971b1cc6acb46d53b8862643fd7d0a8
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 02:19:29 2026 -0700

    blk-integrity: take const pointer in blk_integrity_rq()
    
    blk_integrity_rq() doesn't modify the struct request passed in, so allow
    a const pointer to be passed. Use a matching signature for the
    !CONFIG_BLK_DEV_INTEGRITY version.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Ming Lei 
    Reviewed-by: Martin K. Petersen 
    Signed-off-by: Jens Axboe 

commit 7416634fd6f18762edf60ed8524bc241eceae1f3
Merge: 8f0b4cce4481fb 649cb20b7a0189
Author: Christian Brauner 
Date:   Mon Jan 12 16:52:15 2026 +0100

    Merge patch series "fs: add immutable rootfs"
    
    Christian Brauner  says:
    
    Currently pivot_root() doesn't work on the real rootfs because it
    cannot be unmounted. Userspace has to do a recursive removal of the
    initramfs contents manually before continuing the boot.
    
    Really all we want from the real rootfs is to serve as the parent mount
    for anything that is actually useful such as the tmpfs or ramfs for
    initramfs unpacking or the rootfs itself. There's no need for the real
    rootfs to actually be anything meaningful or useful. Add a immutable
    rootfs called "nullfs" that can be selected via the "nullfs_rootfs"
    kernel command line option.
    
    The kernel will mount a tmpfs/ramfs on top of it, unpack the initramfs
    and fire up userspace which mounts the rootfs and can then just do:
    
      chdir(rootfs);
      pivot_root(".", ".");
      umount2(".", MNT_DETACH);
    
    and be done with it. (Ofc, userspace can also choose to retain the
    initramfs contents by using something like pivot_root(".", "/initramfs")
    without unmounting it.)
    
    Technically this also means that the rootfs mount in unprivileged
    namespaces doesn't need to become MNT_LOCKED anymore as it's guaranteed
    that the immutable rootfs remains permanently empty so there cannot be
    anything revealed by unmounting the covering mount.
    
    In the future this will also allow us to create completely empty mount
    namespaces without risking to leak anything.
    
    systemd already handles this all correctly as it tries to pivot_root()
    first and falls back to MS_MOVE only when that fails.
    
    This goes back to various discussion in previous years and a LPC 2024
    presentation about this very topic.
    
    * patches from https://patch.msgid.link/20260112-work-immutable-rootfs-v2-0-88dd1c34a204@kernel.org:
      docs: mention nullfs
      fs: add immutable rootfs
      fs: add init_pivot_root()
      fs: ensure that internal tmpfs mount gets mount id zero
    
    Link: https://patch.msgid.link/20260112-work-immutable-rootfs-v2-0-88dd1c34a204@kernel.org
    Signed-off-by: Christian Brauner 

commit 649cb20b7a0189cddf1ca2790f0c12a2c570697a
Author: Christian Brauner 
Date:   Mon Jan 12 16:47:11 2026 +0100

    docs: mention nullfs
    
    Add a section about nullfs and how it enables pivot_root() to work.
    
    Link: https://patch.msgid.link/20260112-work-immutable-rootfs-v2-4-88dd1c34a204@kernel.org
    Signed-off-by: Christian Brauner 

commit 576ee5dfd459abe8e29bee8b204cd259e60b4e18
Author: Christian Brauner 
Date:   Mon Jan 12 16:47:10 2026 +0100

    fs: add immutable rootfs
    
    Currently pivot_root() doesn't work on the real rootfs because it
    cannot be unmounted. Userspace has to do a recursive removal of the
    initramfs contents manually before continuing the boot.
    
    Really all we want from the real rootfs is to serve as the parent mount
    for anything that is actually useful such as the tmpfs or ramfs for
    initramfs unpacking or the rootfs itself. There's no need for the real
    rootfs to actually be anything meaningful or useful. Add a immutable
    rootfs called "nullfs" that can be selected via the "nullfs_rootfs"
    kernel command line option.
    
    The kernel will mount a tmpfs/ramfs on top of it, unpack the initramfs
    and fire up userspace which mounts the rootfs and can then just do:
    
      chdir(rootfs);
      pivot_root(".", ".");
      umount2(".", MNT_DETACH);
    
    and be done with it. (Ofc, userspace can also choose to retain the
    initramfs contents by using something like pivot_root(".", "/initramfs")
    without unmounting it.)
    
    Technically this also means that the rootfs mount in unprivileged
    namespaces doesn't need to become MNT_LOCKED anymore as it's guaranteed
    that the immutable rootfs remains permanently empty so there cannot be
    anything revealed by unmounting the covering mount.
    
    In the future this will also allow us to create completely empty mount
    namespaces without risking to leak anything.
    
    systemd already handles this all correctly as it tries to pivot_root()
    first and falls back to MS_MOVE only when that fails.
    
    This goes back to various discussion in previous years and a LPC 2024
    presentation about this very topic.
    
    Link: https://patch.msgid.link/20260112-work-immutable-rootfs-v2-3-88dd1c34a204@kernel.org
    Signed-off-by: Christian Brauner 

commit 3c1b73fc6a4d7bc5469ab2679ef954f7b754d34b
Author: Christian Brauner 
Date:   Mon Jan 12 16:47:09 2026 +0100

    fs: add init_pivot_root()
    
    We will soon be able to pivot_root() with the introduction of the
    immutable rootfs. Add a wrapper for kernel internal usage.
    
    Link: https://patch.msgid.link/20260112-work-immutable-rootfs-v2-2-88dd1c34a204@kernel.org
    Signed-off-by: Christian Brauner 

commit a2062463e894039a6fdc2334b96afd91d44b64a8
Author: Christian Brauner 
Date:   Mon Jan 12 16:47:08 2026 +0100

    fs: ensure that internal tmpfs mount gets mount id zero
    
    and the rootfs get mount id one as it always has. Before we actually
    mount the rootfs we create an internal tmpfs mount which has mount id
    zero but is never exposed anywhere. Continue that "tradition".
    
    Link: https://patch.msgid.link/20260112-work-immutable-rootfs-v2-1-88dd1c34a204@kernel.org
    Fixes: 7f9bfafc5f49 ("fs: use xarray for old mount id")
    Reviewed-by: Jeff Layton 
    Cc: stable@vger.kernel.org
    Signed-off-by: Christian Brauner 

commit 589f41f2f08bb48e041b513e49f9f61eec232d64
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:10 2026 +0100

    x86/paravirt: Use common code for paravirt_steal_clock()
    
    Remove the arch-specific variant of paravirt_steal_clock() and use
    the common one instead.
    
    With all archs supporting Xen now having been switched to the common
    variant, including paravirt.h can be dropped from drivers/xen/time.c.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-12-jgross@suse.com

commit ee9ffcf99f0758b612d48ee3ff03340da4d173f3
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:09 2026 +0100

    riscv/paravirt: Use common code for paravirt_steal_clock()
    
    Remove the arch specific variant of paravirt_steal_clock() and use
    the common one instead.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Andrew Jones 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-11-jgross@suse.com

commit b8431b901e825222281bbd156ea8ee8dd60b58de
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:08 2026 +0100

    loongarch/paravirt: Use common code for paravirt_steal_clock()
    
    Remove the arch specific variant of paravirt_steal_clock() and use
    the common one instead.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Bibo Mao 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-10-jgross@suse.com

commit bbf8c67aa6ae8bd588f097510d887dad071f9f43
Author: Changbin Du 
Date:   Thu Jan 8 19:38:36 2026 +0800

    tools: jobserver: Prevent deadlock caused by incorrect jobserver configuration and enhance error reporting
    
    When using GNU Make's jobserver feature in kernel builds, a bug in MAKEFLAGS
    propagation caused "--jobserver-auth=r,w" to reference an unintended file
    descriptor. This led to infinite loops in jobserver-exec's os.read() calls
    due to empty token.
    
    My shell opened /etc/passwd for some reason without closing it, and as a
    result, all child processes inherited this fd 3.
    
    $ ls -l /proc/self/fd
    total 0
    lrwx------ 1 changbin changbin 64 Dec 25 13:03 0 -> /dev/pts/1
    lrwx------ 1 changbin changbin 64 Dec 25 13:03 1 -> /dev/pts/1
    lrwx------ 1 changbin changbin 64 Dec 25 13:03 2 -> /dev/pts/1
    lr-x------ 1 changbin changbin 64 Dec 25 13:03 3 -> /etc/passwd
    lr-x------ 1 changbin changbin 64 Dec 25 13:03 4 -> /proc/1421383/fd
    
    In this case, the `make` should open a new file descriptor for jobserver
    control, but clearly, it did not do so and instead still passed fd 3 as
    "--jobserver-auth=3,4" in MAKEFLAGS. (The version of my gnu make is 4.3)
    
    This update ensures robustness against invalid jobserver configurations,
    even when `make` incorrectly pass non-pipe file descriptors.
     * Rejecting empty reads to prevent infinite loops on EOF.
     * Clearing `self.jobs` to avoid writing to incorrect files if invalid tokens
       are detected.
     * Printing detailed error messages to stderr to inform the user.
    
    Cc: Mauro Carvalho Chehab 
    Reviewed-by: Mauro Carvalho Chehab 
    Signed-off-by: Changbin Du 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260108113836.2976527-1-changbin.du@huawei.com>

commit ad892c4851577ab03c9a297f5addb8450cf844fd
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:07 2026 +0100

    arm64/paravirt: Use common code for paravirt_steal_clock()
    
    Remove the arch-specific variant of paravirt_steal_clock() and use
    the common one instead.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-9-jgross@suse.com

commit 987167b1199c428765b0f76b9b6587dd4ccde3e6
Author: Maarten Lankhorst 
Date:   Thu Jan 8 11:10:22 2026 +0100

    drm/xe: Privatize xe_ggtt_node
    
    Nothing requires it any more, make the member private.
    
    Reviewed-by: Matthew Brost 
    Signed-off-by: Maarten Lankhorst 
    Link: https://patch.msgid.link/20260108101014.579906-16-dev@lankhorst.se

commit 8d88aa149a297a179d8381ccf6170e48d666dc63
Author: Maarten Lankhorst 
Date:   Thu Jan 8 11:10:21 2026 +0100

    drm/xe: Improve xe_gt_sriov_pf_config GGTT handling
    
    Do not directly dereference xe_ggtt_node, and add
    a function to retrieve the allocated GGTT size.
    
    Reviewed-by: Matthew.brost@intel.com
    Reviewed-by: Michal Wajdeczko 
    Signed-off-by: Maarten Lankhorst 
    Link: https://patch.msgid.link/20260108101014.579906-15-dev@lankhorst.se

commit 9086170bfb925c90e298134791a9851ed626b873
Author: Maarten Lankhorst 
Date:   Thu Jan 8 11:10:20 2026 +0100

    drm/xe: Do not dereference ggtt_node in xe_bo.c
    
    A careful inspection of __xe_ggtt_insert_bo_at() shows that
    the ggtt_node can always be seen as inserted from xe_bo.c
    due to the way error handling is performed.
    
    The checks are also a little bit too paranoid, since we
    never create a bo with ggtt_node[id] initialised but not
    inserted into the GGTT, which can be seen by looking at
    __xe_ggtt_insert_bo_at()
    
    Additionally, the size of the GGTT is never bigger than 4 GB,
    so adding a check at that level is incorrect.
    
    Signed-off-by: Maarten Lankhorst 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20260108101014.579906-14-dev@lankhorst.se

commit a7ae0836917ca617434c416f9c61dc6024d04949
Author: Maarten Lankhorst 
Date:   Thu Jan 8 11:10:19 2026 +0100

    drm/xe/display: Avoid dereferencing xe_ggtt_node
    
    Start using xe_ggtt_node_addr, and avoid comparing the base offset
    as vma->node is dynamically allocated.
    
    Also sneak in a xe_bo_size() for stolen, too small to put as separate
    commit.
    
    Reviewed-by: Matthew Brost 
    Signed-off-by: Maarten Lankhorst 
    Acked-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20260108101014.579906-13-dev@lankhorst.se

commit c818b2651573b2ab3e5dc71dcbfe89b5e0fe9c13
Author: Maarten Lankhorst 
Date:   Thu Jan 8 11:10:18 2026 +0100

    drm/xe: Add xe_ggtt_node_addr() to avoid dereferencing xe_ggtt_node
    
    This function makes it possible to add an offset that is applied to
    all xe_ggtt_node's, and hides the internals from all its users.
    
    Signed-off-by: Maarten Lankhorst 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20260108101014.579906-12-dev@lankhorst.se

commit 004311aa7d7ae1f591dff996232b15f2b480e93b
Author: Maarten Lankhorst 
Date:   Thu Jan 8 11:10:17 2026 +0100

    drm/xe: Convert xe_fb_pin to use a callback for insertion into GGTT
    
    The rotation details belong in xe_fb_pin.c, while the operations involving
    GGTT belong to xe_ggtt.c. As directly locking xe_ggtt etc results in
    exposing all of xe_ggtt details anyway, create a special function that
    allocates a ggtt_node, and allow display to populate it using a callback
    as a compromise.
    
    Signed-off-by: Maarten Lankhorst 
    Reviewed-by: Matthew Brost 
    Reviewed-by: Juha-Pekka Heikkila 
    Signed-off-by: Maarten Lankhorst 
    Link: https://patch.msgid.link/20260108101014.579906-11-dev@lankhorst.se

commit 22437f30d2f0265095eb1e14bf44d30e6663e676
Author: Maarten Lankhorst 
Date:   Thu Jan 8 11:10:16 2026 +0100

    drm/xe: Start using ggtt->start in preparation of balloon removal
    
    Instead of having ggtt->size point to the end of ggtt, have ggtt->size
    be the actual size of the GGTT, and introduce ggtt->start to point to
    the beginning of GGTT.
    
    This will allow a massive cleanup of GGTT in case of SRIOV-VF.
    
    Reviewed-by: Stuart Summers 
    Signed-off-by: Maarten Lankhorst 
    Link: https://patch.msgid.link/20260108101014.579906-10-dev@lankhorst.se

commit 15518e633b7c1780d866365a9ee660af5c2ce9a1
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:06 2026 +0100

    arm/paravirt: Use common code for paravirt_steal_clock()
    
    Remove the arch-specific variant of paravirt_steal_clock() and use
    the common one instead.
    
    This allows to remove paravirt.c and paravirt.h from arch/arm.
    
    Until all archs supporting Xen have been switched to the common code
    of paravirt_steal_clock(), drivers/xen/time.c needs to include
    asm/paravirt.h for those archs, while this is not necessary for arm
    any longer.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-8-jgross@suse.com

commit e6b2aa6d40045a3149071ca3af950ea8e6ff79c4
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:05 2026 +0100

    sched: Move clock related paravirt code to kernel/sched
    
    Paravirt clock related functions are available in multiple archs.
    
    In order to share the common parts, move the common static keys
    to kernel/sched/ and remove them from the arch specific files.
    
    Make a common paravirt_steal_clock() implementation available in
    kernel/sched/cputime.c, guarding it with a new config option
    CONFIG_HAVE_PV_STEAL_CLOCK_GEN, which can be selected by an arch
    in case it wants to use that common variant.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-7-jgross@suse.com

commit 68b10fd40d492ebfaebe716dbe21fc559a128065
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:04 2026 +0100

    paravirt: Remove asm/paravirt_api_clock.h
    
    All architectures supporting CONFIG_PARAVIRT share the same contents
    of asm/paravirt_api_clock.h:
    
      #include 
    
    So remove all incarnations of asm/paravirt_api_clock.h and remove the
    only place where it is included, as there asm/paravirt.h is included
    anyway.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Shrikanth Hegde  # powerpc, scheduler bits
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-6-jgross@suse.com

commit b49c63eea526ecfd0321ecfd0dbf6e31c85b5592
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:03 2026 +0100

    x86/paravirt: Move thunk macros to paravirt_types.h
    
    The macros for generating PV-thunks are part of the generic paravirt
    infrastructure, so they should be in paravirt_types.h.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-5-jgross@suse.com

commit d73298f015341530da84b96d8310854af90dc425
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:02 2026 +0100

    x86/paravirt: Remove PARAVIRT_DEBUG config option
    
    The only effect of CONFIG_PARAVIRT_DEBUG set is that instead of doing a call
    using a NULL pointer a BUG() is being raised.
    
    While the BUG() will be a little bit easier to analyse, the call of NULL isn't
    really that difficult to find the reason for.
    
    Remove the config option to make paravirt coding a little bit less annoying.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-4-jgross@suse.com

commit e0b4904a401fad8593b85c698677dda95bec51a6
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:01 2026 +0100

    x86/paravirt: Remove some unneeded struct declarations
    
    In paravirt_types.h and paravirt.h there are some struct declarations which
    are not needed. Remove them.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-3-jgross@suse.com

commit 654826aa4a8f25cf825ad9254f37e6cb5092098f
Author: Timur Tabi 
Date:   Wed Jan 7 14:16:47 2026 -0600

    gpu: nova-core: add missing newlines to several print strings
    
    Although the dev_xx!() macro calls do not technically require terminating
    newlines for the format strings, they should be added anyway to maintain
    consistency, both within Rust code and with the C versions.
    
    Signed-off-by: Timur Tabi 
    Reviewed-by: John Hubbard 
    Link: https://patch.msgid.link/20260107201647.2490140-2-ttabi@nvidia.com
    Signed-off-by: Danilo Krummrich 

commit 5cf76277cdec872aef9ff2e9008ae129bb303787
Author: Timur Tabi 
Date:   Wed Jan 7 14:16:46 2026 -0600

    gpu: nova-core: check for overflow to DMATRFBASE1
    
    The NV_PFALCON_FALCON_DMATRFBASE/1 register pair supports DMA addresses
    up to 49 bits only, but the write to DMATRFBASE1 could exceed that.
    To mitigate, check first that the DMA address will fit.
    
    Reviewed-by: John Hubbard 
    Reviewed-by: Joel Fernandes 
    Fixes: 69f5cd67ce41 ("gpu: nova-core: add falcon register definitions and base code")
    Signed-off-by: Timur Tabi 
    Link: https://patch.msgid.link/20260107201647.2490140-1-ttabi@nvidia.com
    [ Import ::kernel::dma::DmaMask. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 7970e04d1705075e01f1e168e5b32c9c7680118b
Author: Michal Wajdeczko 
Date:   Fri Jan 9 16:12:19 2026 +0100

    drm/xe/mert: Move MERT initialization to xe_mert.c
    
    Most of the MERT code is already in dedicated file, no reason to
    keep internal MERT data structure initialization elsewhere.
    
    Signed-off-by: Michal Wajdeczko 
    Cc: Lukasz Laguna 
    Reviewed-by: Lukasz Laguna 
    Link: https://patch.msgid.link/20260109151219.26206-6-michal.wajdeczko@intel.com

commit 401fabd6e2767e92cb5b23ec38948cec1d52c754
Author: Michal Wajdeczko 
Date:   Fri Jan 9 16:12:18 2026 +0100

    drm/xe/mert: Use local mert variable to simplify the code
    
    There is no need to always refer to MERT data using tile pointer.
    Use of local mert pointer will simplify the code and make it look
    like other existing MERT function.
    
    Signed-off-by: Michal Wajdeczko 
    Cc: Lukasz Laguna 
    Reviewed-by: Lukasz Laguna 
    Link: https://patch.msgid.link/20260109151219.26206-5-michal.wajdeczko@intel.com

commit ff4eca1f46f3c2c485055e2c31432ab1ec5dbb96
Author: Michal Wajdeczko 
Date:   Sun Jan 11 22:38:47 2026 +0100

    drm/xe/mert: Always refer to MERT using xe_device
    
    There is only one MERT instance and while it is located on the root
    tile, it is safer to refer to it using xe_device rather than xe_tile.
    This will also allow to align signature with other MERT function.
    
    Signed-off-by: Michal Wajdeczko 
    Cc: Lukasz Laguna 
    Reviewed-by: Lukasz Laguna 
    Link: https://patch.msgid.link/20260111213847.27869-1-michal.wajdeczko@intel.com

commit a92c68eb1e19de9ea8de6c7d3bcfff6c3fcb3c10
Author: Michal Wajdeczko 
Date:   Fri Jan 9 16:12:16 2026 +0100

    drm/xe/mert: Fix kernel-doc for struct xe_mert
    
    Add simple top level kernel-doc for the struct itself to allow the
    script recognize that and fix tag of the one member.
    
    Signed-off-by: Michal Wajdeczko 
    Cc: Lukasz Laguna 
    Reviewed-by: Lukasz Laguna 
    Link: https://patch.msgid.link/20260109151219.26206-3-michal.wajdeczko@intel.com

commit e7994954c2bea9e754c5da546846fb1cd79f5151
Author: Michal Wajdeczko 
Date:   Fri Jan 9 16:12:15 2026 +0100

    drm/xe/mert: Normalize xe_mert.h include guards
    
    Most of our header files are using include guard names with single
    underscore and we don't use trailing comments on final #endif.
    
    Signed-off-by: Michal Wajdeczko 
    Cc: Lukasz Laguna 
    Reviewed-by: Lukasz Laguna 
    Link: https://patch.msgid.link/20260109151219.26206-2-michal.wajdeczko@intel.com

commit ab3a124fe08948bb217d1e146f4a8ecd066f63d7
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:47 2026 +0100

    arm64: dts: mediatek: mt6795-xperia-m5: Add UHS pins for MMC1 and 2
    
    Add the UHS state pins for the MMC1 and MMC2 controllers and,
    while at it, also add the correct drive strength parameters
    for the default pin states for those two.
    
    Reviewed-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 96cb8d6257d65e74f9c91a382f71a830393467a5
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:46 2026 +0100

    arm64: dts: mediatek: mt8192-asurada: Remove unused clock-stretch-ns
    
    Remove the clock-stretch-ns property from i2c2, as it has always
    been (and still is) unused.
    
    Reviewed-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 04ccbc5325ccd2b96ef5c3dde1a50495980404c8
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:45 2026 +0100

    arm64: dts: mediatek: mt8173-elm: Remove regulators from thermal node
    
    The only reason to have a regulator in the thermal node is to keep
    the CPU cores up while reading temperatures, but this is incorrect
    because the AUXADC Thermal IP doesn't need any regulators to work,
    at all.
    
    Since the thermal node was inherited only for adding vregs, remove
    it entirely.
    This change is safe also because, among other things, the actual
    driver never used those regulators anyway.
    
    This also fixes a dtbs_check warning.
    
    Reviewed-by: Chen-Yu Tsai 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 6c0ecd0ae8f64b8d70ba3522ef6903753425e2c4
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:44 2026 +0100

    arm64: dts: mediatek: mt8173-elm: Fix dsi0 ports warning
    
    Since only a single port is present, remove the inner `ports`
    parent node and just declare the single port as `port`.
    
    Reviewed-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 870ffe2999b5b558e2e6bfc7e7c6324130f08e47
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:43 2026 +0100

    arm64: dts: mediatek: mt8173-elm: Fix bluetooth node name and reorder
    
    Change the node name for Marvell SD8897 SDIO Bluetooth from
    `btmrvl@2` to `bluetooth@2` to fix a dtbs_check warning.
    
    While at it, also change the WiFi one from `mwifiex@1" to a
    generic "wifi@1" and reorder the nodes so that wifi@1 comes
    before bluetooth@2.
    
    Reviewed-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 08076645d9ac216b5d78930f52d4fc4d6807cd22
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:42 2026 +0100

    arm64: dts: mediatek: mt8183-pumpkin: Fix pinmux node names
    
    Change all of the pinmux main nodes to have a "-pins" suffix to
    satisfy devicetree bindings checks.
    
    Reviewed-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit b1fc81a986c9b8089db31e21a372cc8b6514e900
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:41 2026 +0100

    arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
    
    Rename "piins-bt-wakeup" to "pins-bt-wakeup" to fix a dtbs_check
    warning happening due to this typo.
    
    Fixes: 055ef10ccdd4 ("arm64: dts: mt8183: Add jacuzzi pico/pico6 board")
    Reviewed-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 55828e41e7398b630b036eabf3329828706491a0
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:40 2026 +0100

    arm64: dts: mediatek: mt7981b-openwrt-one: Remove useless cells from flash@0
    
    In spi2's flash@0 there is only one `partitions` subnode: this
    alone makes specifying address and size cells useless, but then
    this subnode has no address and no size, which even makes the
    currently declared address/size cells wrong.
    
    Fixes: 869b3bb5ada2 ("arm64: dts: mediatek: mt7981b-openwrt-one: Enable SPI NOR")
    Reviewed-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 846348a699f9cf9fba4188870b929f88e7556cc1
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:39 2026 +0100

    arm64: dts: mediatek: mt8183-evb: Fix dtbs_check warnings
    
    Change the Murata NCM03WF104 node name from "thermal-sensor" to
    "thermistor" (as that's what it is, after all), and change all
    of the pinmux main nodes to have a "-pins" suffix to satisfy
    devicetree bindings checks.
    
    Reviewed-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit c68a509320a635f5bfa6c43d0c91c964a8fa678f
Author: AngeloGioacchino Del Regno 
Date:   Fri Jan 9 12:47:37 2026 +0100

    arm64: dts: mediatek: mt8173: Fix pinctrl node names and cleanup
    
    Fix the pinctrl node names to adhere to the bindings, as the main
    pin node is supposed to be named like "uart0-pins" and the pinmux
    node named like "pins-bus".
    
    While at it, also cleanup all of the MTK_DRIVE_(x)mA by changing
    that to just the (x) number.
    
    Reviewed-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit c3f6d533b76e27a6dd4264b0240f7742a4d79323
Author: Chen-Yu Tsai 
Date:   Mon Jan 12 16:55:42 2026 +0800

    arm64: dts: mediatek: mt8188-geralt: drop firmware-name from first SCP core
    
    Arnd pointed out that having firmware-name in the device tree is wrong.
    Drop it.
    
    Signed-off-by: Chen-Yu Tsai 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 0cc83fc23debf3e2df19c4510a77fe2d60ab2693
Author: John Hubbard 
Date:   Wed Jan 7 16:58:11 2026 -0800

    gpu: nova-core: don't print raw PMU table entries
    
    Remove the (large) raw form of the PMU table entries. The resulting
    PMULookupTable is still getting printed (in more useful form) later,
    anyway, so this was redundant, even for debugging. This output (the
    example is from an Ampere GPU) is what is being removed:
    
    NovaCore 0000:e1:00.0: PMU entry: [01, 01, 54, 54, 01, 00]
    NovaCore 0000:e1:00.0: PMU entry: [00, 00, 00, 00, 00, 00]
    NovaCore 0000:e1:00.0: PMU entry: [00, 00, 00, 00, 00, 00]
    NovaCore 0000:e1:00.0: PMU entry: [00, 00, 00, 00, 00, 00]
    NovaCore 0000:e1:00.0: PMU entry: [00, 00, 00, 00, 00, 00]
    NovaCore 0000:e1:00.0: PMU entry: [07, 06, e0, b7, 03, 00]
    NovaCore 0000:e1:00.0: PMU entry: [08, 01, bc, 56, 05, 00]
    NovaCore 0000:e1:00.0: PMU entry: [00, 00, 00, 00, 00, 00]
    NovaCore 0000:e1:00.0: PMU entry: [45, 07, 88, da, 01, 00]
    NovaCore 0000:e1:00.0: PMU entry: [85, 07, 34, c9, 02, 00]
    NovaCore 0000:e1:00.0: PMU entry: [49, 05, 7c, b3, 04, 00]
    NovaCore 0000:e1:00.0: PMU entry: [89, 05, 1c, 05, 05, 00]
    NovaCore 0000:e1:00.0: PMU entry: [00, 00, 00, 00, 00, 00]
    NovaCore 0000:e1:00.0: PMU entry: [00, 00, 00, 00, 00, 00]
    NovaCore 0000:e1:00.0: PMU entry: [00, 00, 00, 00, 00, 00]
    NovaCore 0000:e1:00.0: PMU entry: [00, 00, 00, 00, 00, 00]
    
    And it is immediately followed by a more useful, interpreted list of
    selected PMU table data, which is *not* being removed as part of this
    commit. That looks like this:
    
    NovaCore 0000:e1:00.0: PmuLookupTableEntry desc: FalconUCodeDescV3 {
        hdr: 78381825,
        stored_size: 59904,
        pkc_data_offset: 1444,
        interface_offset: 28,
        imem_phys_base: 0,
        imem_load_size: 57856,
        imem_virt_base: 0,
        dmem_phys_base: 0,
        dmem_load_size: 2048,
        engine_id_mask: 1024,
        ucode_id: 9,
        signature_count: 3,
        signature_versions: 7,
        _reserved: 37449,
    }
    
    Signed-off-by: John Hubbard 
    Acked-by: Joel Fernandes 
    Link: https://patch.msgid.link/20260108005811.86014-3-jhubbard@nvidia.com
    Signed-off-by: Danilo Krummrich 

commit 8d6a8e79226d5e0907c7554235113afa06479029
Author: John Hubbard 
Date:   Wed Jan 7 16:58:10 2026 -0800

    gpu: nova-core: preserve error information in gpu_name()
    
    Change gpu_name() to return a Result instead of an Option. This avoids
    silently discarding error information when parsing the GPU name string
    from the GSP.
    
    Update the callsite to log a warning with the error details on failure,
    rather than just displaying "invalid GPU name".
    
    Suggested-by: Danilo Krummrich 
    Signed-off-by: John Hubbard 
    Link: https://patch.msgid.link/20260108005811.86014-2-jhubbard@nvidia.com
    Signed-off-by: Danilo Krummrich 

commit 77ef2c3ff5916d358c436911ca6a961060709f04
Merge: 8f0b4cce4481fb 08489c4f413339
Author: Christian Brauner 
Date:   Mon Jan 12 14:01:42 2026 +0100

    Merge patch series "re-enable IOCB_NOWAIT writes to files v6"
    
    Christoph Hellwig  says:
    
    Hi all,
    
    commit 66fa3cedf16a ("fs: Add async write file modification handling.")
    effectively disabled IOCB_NOWAIT writes as timestamp updates currently
    always require blocking, and the modern timestamp resolution means we
    always update timestamps.  This leads to a lot of context switches from
    applications using io_uring to submit file writes, making it often worse
    than using the legacy aio code that is not using IOCB_NOWAIT.
    
    This series allows non-blocking updates for lazytime if the file system
    supports it, and adds that support for XFS.
    
    * patches from https://patch.msgid.link/20260108141934.2052404-1-hch@lst.de:
      xfs: enable non-blocking timestamp updates
      xfs: implement ->sync_lazytime
      fs: refactor file_update_time_flags
      fs: add support for non-blocking timestamp updates
      fs: add a ->sync_lazytime method
      fs: factor out a sync_lazytime helper
      fs: refactor ->update_time handling
      fat: cleanup the flags for fat_truncate_time
      nfs: split nfs_update_timestamps
      fs: allow error returns from generic_update_time
      fs: remove inode_update_time
    
    Link: https://patch.msgid.link/20260108141934.2052404-1-hch@lst.de
    Signed-off-by: Christian Brauner 

commit 08489c4f41333913c9be27a031b070f4452e9374
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:11 2026 +0100

    xfs: enable non-blocking timestamp updates
    
    The lazytime path using the generic helpers can never block in XFS
    because there is no ->dirty_inode method that could block.  Allow
    non-blocking timestamp updates for this case by replacing
    generic_update_time with the open coded version without the S_NOWAIT
    check.
    
    Fixes: 66fa3cedf16a ("fs: Add async write file modification handling.")
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-12-hch@lst.de
    Reviewed-by: Chaitanya Kulkarni 
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit f92f8eddbbfbf83b7263cbd995fb91256dbd4d71
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:10 2026 +0100

    xfs: implement ->sync_lazytime
    
    Switch to the new explicit lazytime syncing method instead of trying
    to second guess what could be a lazytime update in ->dirty_inode.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-11-hch@lst.de
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit 2d72003ba2440dfd43d8a0ebe2a9a36d971771e5
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:09 2026 +0100

    fs: refactor file_update_time_flags
    
    Split all the inode timestamp flags into a helper.  This not only
    makes the code a bit more readable, but also optimizes away the
    further checks as soon as know we need an update.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-10-hch@lst.de
    Reviewed-by: Jan Kara 
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit 85c871a02b0305f568d5aba6144fc6b2c96bd87d
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:08 2026 +0100

    fs: add support for non-blocking timestamp updates
    
    Currently file_update_time_flags unconditionally returns -EAGAIN if any
    timestamp needs to be updated and IOCB_NOWAIT is passed.  This makes
    non-blocking direct writes impossible on file systems with granular
    enough timestamps.
    
    Pass IOCB_NOWAIT to ->update_time and return -EAGAIN if it could block.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-9-hch@lst.de
    Reviewed-by: Jan Kara 
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit 5cf06ea56ee67209d4e9a0b381641fb062ecd2c3
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:07 2026 +0100

    fs: add a ->sync_lazytime method
    
    Allow the file system to explicitly implement lazytime syncing instead
    of pigging back on generic inode dirtying.  This allows to simplify
    the XFS implementation and prepares for non-blocking lazytime timestamp
    updates.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-8-hch@lst.de
    Reviewed-by: Chaitanya Kulkarni 
    Reviewed-by: Jeff Layton 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 188344c8ac0b740ee2e5deebda2004b39ccbee74
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:06 2026 +0100

    fs: factor out a sync_lazytime helper
    
    Centralize how we synchronize a lazytime update into the actual on-disk
    timestamp into a single helper.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-7-hch@lst.de
    Reviewed-by: Jan Kara 
    Reviewed-by: Chaitanya Kulkarni 
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit 761475268fa8e322fe6b80bcf557dc65517df71e
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:05 2026 +0100

    fs: refactor ->update_time handling
    
    Pass the type of update (atime vs c/mtime plus version) as an enum
    instead of a set of flags that caused all kinds of confusion.
    Because inode_update_timestamps now can't return a modified version
    of those flags, return the I_DIRTY_* flags needed to persist the
    update, which is what the main caller in generic_update_time wants
    anyway, and which is suitable for the other callers that only want
    to know if an update happened.
    
    The whole update_time path keeps the flags argument, which will be used
    to support non-blocking updates soon even if it is unused, and (the
    slightly renamed) inode_update_time also gains the possibility to return
    a negative errno to support this.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-6-hch@lst.de
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 1cbc822816758b2678e94800ce8eecc7b706fb84
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:04 2026 +0100

    fat: cleanup the flags for fat_truncate_time
    
    Fat only has a single on-disk timestamp covering ctime and mtime.  Add
    fat-specific flags that indicate which timestamp fat_truncate_time should
    update to make this more clear.  This allows removing no-op
    fat_truncate_time calls with the S_CTIME flag and prepares for removing
    the S_* flags.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-5-hch@lst.de
    Acked-by: OGAWA Hirofumi 
    Signed-off-by: Christian Brauner 

commit b8b3002fbfef005cc7c00bfb1dcc9c1d0eecba8a
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:03 2026 +0100

    nfs: split nfs_update_timestamps
    
    The VFS paths update either the atime or ctime and mtime but never mix
    between atime and the others.  Split nfs_update_timestamps to match this
    to prepare for cleaning up the VFS interfaces.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-4-hch@lst.de
    Reviewed-by: Jan Kara 
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit dc9629faef0a3d3cd35aff22806376700275a8b6
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:02 2026 +0100

    fs: allow error returns from generic_update_time
    
    Now that no caller looks at the updated flags, switch generic_update_time
    to the same calling convention as the ->update_time method and return 0
    or a negative errno.
    
    This prepares for adding non-blocking timestamp updates that could return
    -EAGAIN.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-3-hch@lst.de
    Reviewed-by: Jan Kara 
    Reviewed-by: Chaitanya Kulkarni 
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit 20b781834ea0037b63c657e15b5aa4cfb4dd9b8b
Author: Christoph Hellwig 
Date:   Thu Jan 8 15:19:01 2026 +0100

    fs: remove inode_update_time
    
    The only external user is gone now, open code it in the two VFS
    callers.
    
    Signed-off-by: Christoph Hellwig 
    Link: https://patch.msgid.link/20260108141934.2052404-2-hch@lst.de
    Reviewed-by: Jan Kara 
    Reviewed-by: Chaitanya Kulkarni 
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9
Author: Miquel Raynal 
Date:   Fri Jan 9 18:18:01 2026 +0100

    spi: spi-mem: Limit octal DTR constraints to octal DTR situations
    
    In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is
    considered requiring a duplicated command opcode. This is wrong as this
    constraint only applies to octal DTR operations (8D-8D-8D).
    
    Narrow the application of this constraint to the concerned bus
    interface.
    
    Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2,
    4} would benefit from this check either as there is only in octal DTR
    mode that a single clock edge would be enough to transmit the full
    opcode.
    
    Make sure the constraint of expecting two bytes for the command is
    applied to the relevant bus interface.
    
    Reviewed-by: Tudor Ambarus 
    Signed-off-by: Miquel Raynal 
    Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com
    Signed-off-by: Mark Brown 

commit af4b2dc4810380a469dcd7508923b70892c2996a
Author: Miquel Raynal 
Date:   Fri Jan 9 18:18:00 2026 +0100

    spi: spi-mem: Create a repeated address operation
    
    In octal DTR mode addresses may either be long enough to cover at least
    two bytes (in which case the existing macro works), or otherwise for
    single byte addresses, the byte must also be duplicated and sent twice:
    on each front of the clock.
    
    Create a macro for this common case.
    
    Signed-off-by: Miquel Raynal 
    Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-2-1fff6a2ddb80@bootlin.com
    Signed-off-by: Mark Brown 

commit 0196932f539e306e122b6edf24c9f5e30d1f73ee
Author: Miquel Raynal 
Date:   Fri Jan 9 18:17:59 2026 +0100

    spi: spi-mem: Make the DTR command operation macro more suitable
    
    In order to introduce DTR support in SPI NAND, a number of macros had to
    be created in the spi-mem layer. One of them remained unused at this
    point, SPI_MEM_DTR_OP_CMD. Being in the process of introducing octal DTR
    support now, experience shows that as-is the macro is not useful. In
    order to be really useful in octal DTR mode, the command opcode (one
    byte) must always be transmitted on the 8 data lines on both the rising
    and falling edge of the clock. Align the macro with the real needs by
    duplicating the opcode in the buffer and doubling its size.
    
    Reviewed-by: Tudor Ambarus 
    Signed-off-by: Miquel Raynal 
    Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-1-1fff6a2ddb80@bootlin.com
    Signed-off-by: Mark Brown 

commit e590752119029d87ce46d725e11245a52d22e1fe
Author: Sebastian Krzyszkowiak 
Date:   Mon Jan 5 04:02:10 2026 +0100

    ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
    
    This usually means that a TRS plug with no microphone pin has been plugged
    into a TRRS socket. Cases where a user is plugging in a microphone while
    pressing a button will be handled via incoming interrupt after the user
    releases the button, so the microphone will still be detected once it
    becomes usable.
    
    Signed-off-by: Sebastian Krzyszkowiak 
    Reviewed-by: Charles Keepax 
    Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm
    Signed-off-by: Mark Brown 

commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f
Author: Sebastian Krzyszkowiak 
Date:   Mon Jan 5 04:02:08 2026 +0100

    ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
    
    This bit is handled by a separate control.
    
    Signed-off-by: Sebastian Krzyszkowiak 
    Reviewed-by: Charles Keepax 
    Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm
    Signed-off-by: Mark Brown 

commit 8f799b4e8cc0cf926019e40405dc3eab330ac643
Merge: e254b758976f65 0f61b1860cc3f5
Author: Danilo Krummrich 
Date:   Mon Jan 12 13:32:43 2026 +0100

    Merge tag 'v6.19-rc5' into driver-core-next
    
    We need the driver-core fixes in here as well to build on top of.
    
    Signed-off-by: Danilo Krummrich 

commit 4d944187a1288bb48b21715e95098e81bc0e28f6
Merge: 43f37d44f2b8a7 b3d8508351af7f
Author: Bartosz Golaszewski 
Date:   Mon Jan 12 13:28:51 2026 +0100

    Merge branch 'reset/gpio-compatible' of https://git.pengutronix.de/git/pza/linux into gpio/for-next
    
    Pull in reset changes adding the "compatible" property to reset-gpio
    devices.

commit b0fc1e7701940d12ea2c41f386aa552bc4cc3629
Author: Andreas Kemnade 
Date:   Fri Jan 2 11:13:57 2026 +0100

    regulator: Add TPS65185 driver
    
    Add a driver for the TPS65185 regulator. Implement handling of the various
    gpio pins. Because the PWRUP (=enable) pin functionality can be achieved
    by just using two bits instead, just ensure that it is set to a stable
    value.
    Implement the pair of symmetric LDOs as a single regulator because they
    share a single voltage set register. As the VCOM regulator sits behind that
    machinery, just define that one as a supply.
    For simplicity, just add the temperature sensor (depending on external NTC)
    directly.
    
    There is a mechanism to measure some kick-back voltage during a defined EPD
    operation, to calibrate the VCOM voltage setting and store that
    non-volatile in the chip to be the power up default setup. That is not
    implemented yet in the driver, but that also means that there is a
    non-factory default value in these registers after power-up.
    
    Tested-by: Josua Mayer 
    Signed-off-by: Andreas Kemnade 
    Link: https://patch.msgid.link/20260102-tps65185-submit-v3-2-23bda35772f2@kemnade.info
    Signed-off-by: Mark Brown 

commit da1456e435ae84852bda484cd4d60f47228d52fc
Author: Andreas Kemnade 
Date:   Fri Jan 2 11:13:56 2026 +0100

    regulator: dt-bindings: Document TI TPS65185
    
    Document the TPS65185. GPIO names are same as in the datasheet except for
    the PWRUP pad which is described as "enable". That pin is optional because
    the rising edge corresponds to setting one register bit and falling edge
    to another register bit.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Andreas Kemnade 
    Link: https://patch.msgid.link/20260102-tps65185-submit-v3-1-23bda35772f2@kemnade.info
    Signed-off-by: Mark Brown 

commit 6eb6b62f002f1cbc538c2e773539d1d4c37749cb
Merge: b0655377aa5a41 8d38423d9dea73
Author: Mark Brown 
Date:   Mon Jan 12 12:15:35 2026 +0000

    regulator: core: allow regulator_register() with
    
    Merge series from André Draszik :
    
    With these attached patches it becomes possible again to support
    hardware designs with multiple PMICs where individual rails of each act
    as required supplies for rails of the other (due to the latter being
    e.g. always-on), and vice-versa.
    
    Google Pixel 6 and 6 Pro (oriole and raven) are examples of such
    designs.
    
    Rather than returning -EPORBE_DEFER in regulator_register() when
    set_machine_constraints() fails with -EPROBE_DEFER (due to missing
    required supplies), we still allow rail registration and try to
    reresolve supplies each time a new rail gets registered.
    
    This is implemented using a bus (regulator bus), which allows the core
    to reresolve supplies for regulators that still need them whenever new
    regulators (i.e. devices) are added.
    
    Using a bus also solves existing problems around late resolution of
    supplies as mentioned in the commit message introducing that bus.
    
    The series starts with a few bug fixes and the last two commits
    implement the changes mentioned above, but do depend on the bug fixes.

commit dc8ea8714311e549ee93a2b0bdd5487d20bfadbf
Author: Teddy Astie 
Date:   Tue Jan 6 17:36:50 2026 +0000

    xen/virtio: Don't use grant-dma-ops when running as Dom0
    
    Dom0 inherit devices from the machine and is usually in PV mode.
    If we are running in a virtual that has virtio devices, these devices
    would be considered as using grants with Dom0 as backend, while being
    the said Dom0 itself, while we want to use these devices like regular
    PCI devices.
    
    Fix this by preventing grant-dma-ops from being used when running as Dom0
    (initial domain). We still keep the device-tree logic as-is.
    
    Signed-off-by: Teddy Astie 
    Fixes: 61367688f1fb0 ("xen/virtio: enable grant based virtio on x86")
    Reviewed-by: Juergen Gross 
    Signed-off-by: Juergen Gross 
    Message-ID: <6698564dd2270a9f7377b78ebfb20cb425cabbe8.1767720955.git.teddy.astie@vates.tech>

commit db9aded979b491a24871e1621cd4e8822dbca859
Author: Hou Wenlong 
Date:   Sat Jan 10 12:00:08 2026 +0800

    x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set
    
    The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests
    do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds
    different pagetables depending on whether CONFIG_X86_PAE is set.
    Therefore, enabling PAE mode for 32-bit KVM guests without
    CONFIG_X86_PAE being set would result in a boot failure during CR3
    loading.
    
    Signed-off-by: Hou Wenlong 
    Reviewed-by: Juergen Gross 
    Signed-off-by: Juergen Gross 
    Message-ID: 

commit fc6ceb7e4ea746e663ff8c5593e67ad8ccbee34a
Author: Jyri Sarha 
Date:   Mon Jan 12 13:32:21 2026 +0200

    ASoC: sof ipc4: Add sof_ipc4_widget_setup_msg_payload() and call it
    
    Add of_ipc4_widget_setup_msg_payload() for adding struct
    sof_ipc4_module_init_ext_init payload with associated objects. The
    function allocates memory for the additional payload, sets up the
    payload according to data collected from topology, and copies
    pre-encoded module specific payload after the ext_init payload. The
    function is called in sof_ipc4_widget_setup().
    
    Signed-off-by: Jyri Sarha 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Guennadi Liakhovetski 
    Reviewed-by: Péter Ujfalusi 
    Signed-off-by: Peter Ujfalusi 
    Link: https://patch.msgid.link/20260112113221.4442-5-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 1cd8fbec6dfa9a9c25400b775fed887b59153afd
Author: Jyri Sarha 
Date:   Mon Jan 12 13:32:20 2026 +0200

    ASoC: SOF: ipc4: sof_ipc4_module_init_ext_init structs and macros
    
    Add structs and macros for struct sof_ipc4_module_init_ext_init,
    following struct sof_ipc4_module_init_ext_object array, and
    struct sof_ipc4_mod_init_ext_dp_memory_data as object payload.
    
    Signed-off-by: Jyri Sarha 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Guennadi Liakhovetski 
    Reviewed-by: Péter Ujfalusi 
    Signed-off-by: Peter Ujfalusi 
    Link: https://patch.msgid.link/20260112113221.4442-4-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 854d4389f20f07b646981ebb1ef44b7503658e9c
Author: Jyri Sarha 
Date:   Mon Jan 12 13:32:19 2026 +0200

    ASoC: sof: Add domain_id, heap_bytes and stack_bytes to snd_sof_widget
    
    Add dp_domain_id, dp_heap_bytes and dp_stack_bytes to struct
    snd_sof_widget and fill the values from topology tuples with
    SOF_TKN_COMP_DOMAIN_ID, SOF_TKN_COMP_STACK_BYTES_REQUIREMENT and
    SOF_TKN_COMP_HEAP_BYTES_REQUIREMENT tokens.
    
    Signed-off-by: Jyri Sarha 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Guennadi Liakhovetski 
    Reviewed-by: Péter Ujfalusi 
    Signed-off-by: Peter Ujfalusi 
    Link: https://patch.msgid.link/20260112113221.4442-3-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 0432fe32c129780f89fd5426059cb1ddd8e50858
Author: Jyri Sarha 
Date:   Mon Jan 12 13:32:18 2026 +0200

    ASoC: sof: ipc4-topology: Add topology tokens domain_in stack & heap_bytes
    
    Add topology tokens for defining user-space domain_id, required stack
    and heap size byte for a component. The new topology tokens are
    SOF_TKN_COMP_DOMAIN_ID, SOF_TKN_COMP_HEAP_BYTES_REQUIREMENT and
    SOF_TKN_COMP_STACK_BYTES_REQUIREMENT for defining required stack and
    heap size for a component.
    
    Signed-off-by: Jyri Sarha 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Guennadi Liakhovetski 
    Reviewed-by: Péter Ujfalusi 
    Signed-off-by: Peter Ujfalusi 
    Link: https://patch.msgid.link/20260112113221.4442-2-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 83aee46dc2142eed2dc40b5cef0e9e08e14cac42
Author: Peter Ujfalusi 
Date:   Mon Jan 12 12:10:04 2026 +0200

    ASoC: SOF: ipc/ops: Use guard() for spinlocks
    
    Replace the manual spinlock lock/unlock pairs with guard().
    
    Only code refactoring, and no behavior change.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Ranjani Sridharan 
    Link: https://patch.msgid.link/20260112101004.7648-8-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 294b9e7e8ecafd4dd4b1cc13d7585082451be0e7
Author: Peter Ujfalusi 
Date:   Mon Jan 12 12:10:03 2026 +0200

    ASoC: SOF: Intel: Use guard() for spinlocks where it makes sense
    
    Replace the manual spinlock lock/unlock pairs with guard().
    
    Only code refactoring, and no behavior change.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Ranjani Sridharan 
    Link: https://patch.msgid.link/20260112101004.7648-7-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 36fabc449a055547960712c164bfa3fe77cf0a88
Author: Peter Ujfalusi 
Date:   Mon Jan 12 12:10:02 2026 +0200

    ASoC: SOF: mediatek: mtk-adsp-common: Use guard() for spinlock_irqsave
    
    Replace the manual spinlock_irqsave lock/unlock pairs with guard().
    
    Only code refactoring, and no behavior change.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Ranjani Sridharan 
    Link: https://patch.msgid.link/20260112101004.7648-6-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit aa234886c7263e8c78031a20e33a9725acdbcf5d
Author: Peter Ujfalusi 
Date:   Mon Jan 12 12:10:01 2026 +0200

    ASoC: SOF: imx: imx-common: Use guard() for spinlock_irqsafe()
    
    Replace the manual spinlock_irqsafe lock/unlock pairs with guard().
    
    Only code refactoring, and no behavior change.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Ranjani Sridharan 
    Link: https://patch.msgid.link/20260112101004.7648-5-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 58a581c38babe5ae2fa96b9a8387418f3275993e
Author: Peter Ujfalusi 
Date:   Mon Jan 12 12:10:00 2026 +0200

    ASoC: SOF: amd: acp-ipc: Use guard() for spinlock_irq()
    
    Replace the manual spinlock_irq lock/unlock pairs with guard().
    
    Only code refactoring, and no behavior change.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Ranjani Sridharan 
    Link: https://patch.msgid.link/20260112101004.7648-4-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 599a5b00a1bf2fdc5abb42985eb21c1ce3489416
Author: Peter Ujfalusi 
Date:   Mon Jan 12 12:09:59 2026 +0200

    ASoC: SOF: Intel: Use guard()/scoped_guard() for mutex locks where it makes sense
    
    Replace the manual mutex lock/unlock pairs with guard()/scoped_guard().
    
    Only code refactoring, and no behavior change.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Ranjani Sridharan 
    Link: https://patch.msgid.link/20260112101004.7648-3-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 5c19da34df029fdc29fec1bedf210af7d2c4fccf
Author: Peter Ujfalusi 
Date:   Mon Jan 12 12:09:58 2026 +0200

    ASoC: SOF: Use guard()/scoped_guard() for mutex locks where it makes sense
    
    Replace the manual mutex lock/unlock pairs with guard()/scoped_guard().
    
    Only code refactoring, and no behavior change.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Ranjani Sridharan 
    Link: https://patch.msgid.link/20260112101004.7648-2-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 8672e4b51adfc57150f3862b1665faff0acf1bad
Author: Vladimir Zapolskiy 
Date:   Fri Jan 9 09:50:32 2026 +0200

    spi: dt-bindings: nxp,lpc3220-spi: Add DMA specific properties
    
    NXP LPC32xx SPI controllers supports DMA operations over rx-tx channel,
    which is muxed with SSP SPI controller DMA.
    
    For additional reference see Table 69 in NXP LPC32xx User Manual.
    
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://patch.msgid.link/20260109075032.3287109-1-vz@mleia.com
    Signed-off-by: Mark Brown 

commit 77157cb45c66bd652a08a360693fcced558c5ef9
Author: Kuninori Morimoto 
Date:   Thu Jan 8 23:54:15 2026 +0000

    ASoC: codecs: rt1320-sdw: convert to snd_soc_dapm_xxx()
    
    This patch converts below functions.
    
    snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level()
    snd_soc_component_get_dapm()       -> snd_soc_component_to_dapm()
    
    Signed-off-by: Kuninori Morimoto 
    Link: https://patch.msgid.link/87344f3bko.wl-kuninori.morimoto.gx@renesas.com
    Signed-off-by: Mark Brown 

commit 35bffbe49dfd3395c65d76f14d773a1225f3489f
Author: Rob Herring (Arm) 
Date:   Thu Jan 8 15:44:40 2026 -0600

    ASoC: dt-bindings: Convert realtek,rt5651 to DT schema
    
    Convert the Realtek RT5661 codec binding to DT schema format. Add
    missing clocks/clock-names for MCLK which is in use already. Also add
    the standard "#sound-dai-cells" property.
    
    Signed-off-by: Rob Herring (Arm) 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260108214443.1127685-1-robh@kernel.org
    Signed-off-by: Mark Brown 

commit 43f37d44f2b8a75a896e218bac1e43d75063f8d3
Author: Tzu-Hao Wei 
Date:   Fri Jan 9 01:26:07 2026 -0800

    gpio: cadence: Add support for edge-triggered interrupts
    
    The Cadence GPIO controller (CDNS IP6508) supports edge-triggered
    interrupts (rising, falling, and both) via IRQ_TYPE, IRQ_VALUE,
    and IRQ_ANY_EDGE registers. This commit enables support for these
    modes in cdns_gpio_irq_set_type().
    
    Although the interrupt status register is cleared on read and lacks
    per-pin acknowledgment, the driver already handles this safely by
    reading the ISR once and dispatching all pending interrupts immediately.
    This allows edge IRQs to be used reliably in controlled environments.
    
    Signed-off-by: Tzu-Hao Wei 
    Reviewed-by: Linus Walleij 
    Signed-off-by: Swark Yang 
    Link: https://lore.kernel.org/r/20260109-axiado-ax3000-cadence-gpio-support-v2-2-fc1e28edf68a@axiado.com
    Signed-off-by: Bartosz Golaszewski 

commit ea5b4c68e097412f2d3ca13314b672837718a446
Author: Swark Yang 
Date:   Fri Jan 9 01:26:06 2026 -0800

    gpio: cadence: Add quirk for Axiado AX3000 platform
    
    On the Axiado AX3000 platform, pinmux and pin configuration (such as
    direction and output enable) are configured by the hardware/firmware
    at boot time before Linux boots.
    
    To prevent conflicts, introduce a platform-specific quirk triggered by
    the "axiado,ax3000-gpio" compatible string.
    
    When this quirk is active, the driver will skip its default
    initialization of pinmux configuration and direction settings during
    probe.
    
    Co-developed-by: Tzu-Hao Wei 
    Signed-off-by: Tzu-Hao Wei 
    Signed-off-by: Swark Yang 
    Reviewed-by: Linus Walleij 
    Link: https://lore.kernel.org/r/20260109-axiado-ax3000-cadence-gpio-support-v2-1-fc1e28edf68a@axiado.com
    Signed-off-by: Bartosz Golaszewski 

commit a88d9589125a4d2d1cc2e0e6ba794be30f4de44f
Author: Jose Javier Rodriguez Barbarin 
Date:   Thu Jan 8 14:48:43 2026 +0100

    gpio: menz127: drop unneeded MODULE_ALIAS
    
    Since commit 1f4ea4838b13 ("mcb: Add missing modpost build support")
    the MODULE_ALIAS() is redundant as the module alias is now
    automatically generated from the MODULE_DEVICE_TABLE().
    
    Remove the explicit alias.
    
    No functional change intended.
    
    Reviewed-by: Jorge Sanjuan Garcia 
    Signed-off-by: Jose Javier Rodriguez Barbarin 
    Link: https://lore.kernel.org/r/20260108134843.25903-2-dev-josejavier.rodriguez@duagon.com
    Signed-off-by: Bartosz Golaszewski 

commit 2b84bd93eda9f08ab57cd4322387fc0ca44a9fb9
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:24:00 2025 +0100

    arm64: dts: renesas: Use lowercase hex
    
    The DTS code coding style expects lowercase hex for values and unit
    addresses.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251223152358.152533-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Geert Uytterhoeven 

commit 3cf9dc2c7c93f9fa452574af18f26b7eb70614df
Merge: e034e058897a12 0f61b1860cc3f5
Author: Bartosz Golaszewski 
Date:   Mon Jan 12 11:33:31 2026 +0100

    Merge tag 'v6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next
    
    Linux 6.19-rc5
    
    Pull in upstream shared GPIO fixes into the v7.0 branch.

commit fd4be5de4594a3f045a51b749a770b3d5a8e4368
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:23:59 2025 +0100

    arm64: dts: renesas: Use hyphens in node names
    
    DTS coding style prefers hyphens instead of underscores in the node
    names.  Change should be safe, because node names are not considered an
    ABI.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251223152358.152533-3-krzysztof.kozlowski@oss.qualcomm.com
    [geert: Fix'em all]
    Signed-off-by: Geert Uytterhoeven 

commit 13e566e8df89b5521f8d60297c629c00f28e49ea
Author: Rob Herring (Arm) 
Date:   Fri Dec 12 14:32:07 2025 -0600

    arm/arm64: dts: renesas: Drop unused .dtsi
    
    These .dtsi files are not included anywhere in the tree and can't be
    tested.
    
    Signed-off-by: Rob Herring (Arm) 
    Acked-by: Jacopo Mondi 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251212203226.458694-1-robh@kernel.org
    Signed-off-by: Geert Uytterhoeven 

commit 378f1dc3d6472f9bd437f564daf5a1a2f32505e7
Author: Marco Crivellari 
Date:   Thu Nov 6 16:58:31 2025 +0100

    xen: privcmd: WQ_PERCPU added to alloc_workqueue users
    
    Currently if a user enqueue a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    This lack of consistentcy cannot be addressed without refactoring the API.
    
    alloc_workqueue() treats all queues as per-CPU by default, while unbound
    workqueues must opt-in via WQ_UNBOUND.
    
    This default is suboptimal: most workloads benefit from unbound queues,
    allowing the scheduler to place worker threads where they’re needed and
    reducing noise when CPUs are isolated.
    
    This continues the effort to refactor workqueue APIs, which began with
    the introduction of new workqueues and a new alloc_workqueue flag in:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue()
    to be per-cpu when WQ_UNBOUND has not been specified.
    
    With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
    any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
    must now use WQ_PERCPU.
    
    Once migration is complete, WQ_UNBOUND can be removed and unbound will
    become the implicit default.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Reviewed-by: Juergen Gross 
    Signed-off-by: Juergen Gross 
    Message-ID: <20251106155831.306248-3-marco.crivellari@suse.com>

commit 842df741a4e464f65cf1a2056cd51e9a86a68a20
Author: Marco Crivellari 
Date:   Thu Nov 6 16:58:30 2025 +0100

    xen/events: replace use of system_wq with system_percpu_wq
    
    Currently if a user enqueues a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    
    This lack of consistency cannot be addressed without refactoring the API.
    
    This continues the effort to refactor workqueue APIs, which began with
    the introduction of new workqueues and a new alloc_workqueue flag in:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    Switch to using system_percpu_wq because system_wq is going away as part of
    a workqueue restructuring.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Reviewed-by: Juergen Gross 
    Signed-off-by: Juergen Gross 
    Message-ID: <20251106155831.306248-2-marco.crivellari@suse.com>

commit 07f2961235ac26da12479535cf19a82cde529865
Author: Juergen Gross 
Date:   Mon Jan 5 12:05:00 2026 +0100

    x86/paravirt: Remove not needed includes of paravirt.h
    
    In some places asm/paravirt.h is included without really being needed.
    
    Remove the related #include statements.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Acked-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260105110520.21356-2-jgross@suse.com

commit 7e463614c97b643f60caa66caf13ce5f94ea91c1
Merge: 7d42f2b1cc3a60 51e49111c00bee
Author: Christian Brauner 
Date:   Mon Jan 12 10:55:54 2026 +0100

    Merge patch series "vfs: require filesystems to explicitly opt-in to lease support"
    
    Jeff Layton  says:
    
    Yesterday, I sent patches to fix how directory delegation support is
    handled on filesystems where the should be disabled [1]. That set is
    appropriate for v6.19. For v7.0, I want to make lease support be more
    opt-in, rather than opt-out:
    
    For historical reasons, when ->setlease() file_operation is set to NULL,
    the default is to use the kernel-internal lease implementation. This
    means that if you want to disable them, you need to explicitly set the
    ->setlease() file_operation to simple_nosetlease() or the equivalent.
    
    This has caused a number of problems over the years as some filesystems
    have inadvertantly allowed leases to be acquired simply by having left
    it set to NULL. It would be better if filesystems had to opt-in to lease
    support, particularly with the advent of directory delegations.
    
    This series has sets the ->setlease() operation in a pile of existing
    local filesystems to generic_setlease() and then changes
    kernel_setlease() to return -EINVAL when the setlease() operation is not
    set.
    
    With this change, new filesystems will need to explicitly set the
    ->setlease() operations in order to provide lease and delegation
    support.
    
    I mainly focused on filesystems that are NFS exportable, since NFS and
    SMB are the main users of file leases, and they tend to end up exporting
    the same filesystem types. Let me know if I've missed any.
    
    [1]: https://lore.kernel.org/linux-fsdevel/20260107-setlease-6-19-v1-0-85f034abcc57@kernel.org/
    
    * patches from https://patch.msgid.link/20260108-setlease-6-20-v1-0-ea4dec9b67fa@kernel.org: (24 commits)
      fs: remove simple_nosetlease()
      filelock: default to returning -EINVAL when ->setlease operation is NULL
      xfs: add setlease file operation
      ufs: add setlease file operation
      udf: add setlease file operation
      tmpfs: add setlease file operation
      squashfs: add setlease file operation
      overlayfs: add setlease file operation
      orangefs: add setlease file operation
      ocfs2: add setlease file operation
      ntfs3: add setlease file operation
      nilfs2: add setlease file operation
      jfs: add setlease file operation
      jffs2: add setlease file operation
      gfs2: add a setlease file operation
      fat: add setlease file operation
      f2fs: add setlease file operation
      exfat: add setlease file operation
      ext4: add setlease file operation
      ext2: add setlease file operation
      ...
    
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-0-ea4dec9b67fa@kernel.org
    Signed-off-by: Christian Brauner 

commit 51e49111c00bee76ca403adf7cd617b71a9a0da4
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:19 2026 -0500

    fs: remove simple_nosetlease()
    
    Setting ->setlease() to a NULL pointer now has the same effect as
    setting it to simple_nosetlease(). Remove all of the setlease
    file_operations that are set to simple_nosetlease, and the function
    itself.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-24-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 2b10994be716b07d881ad0f966d6a4bb13b20750
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:18 2026 -0500

    filelock: default to returning -EINVAL when ->setlease operation is NULL
    
    Now that most filesystems where we expect to need lease support have
    their ->setlease() operations explicitly set, change kernel_setlease()
    to return -EINVAL when the setlease is a NULL pointer.
    
    Also update the Documentation/ with info about this change.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-23-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 6163b5da2f5eff5fdad6bad9fa1ca37c7d2d0d5d
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:17 2026 -0500

    xfs: add setlease file operation
    
    Add the setlease file_operation pointing to generic_setlease to the xfs
    file_operations structures. A future patch will change the default
    behavior to reject lease attempts with -EINVAL when there is no
    setlease file operation defined. Add generic_setlease to retain the
    ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-22-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 545b4144d804604126c369dd5bd66ff1e668c7d9
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:16 2026 -0500

    ufs: add setlease file operation
    
    Add the setlease file_operation pointing to generic_setlease to the ufs
    file_operations structures. A future patch will change the default
    behavior to reject lease attempts with -EINVAL when there is no
    setlease file operation defined. Add generic_setlease to retain the
    ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-21-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit dbe8d57d148327a39dc4921aa1d3434ea259945e
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:15 2026 -0500

    udf: add setlease file operation
    
    Add the setlease file_operation pointing to generic_setlease to the udf
    file_operations structures. A future patch will change the default
    behavior to reject lease attempts with -EINVAL when there is no
    setlease file operation defined. Add generic_setlease to retain the
    ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-20-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit f5a3446be277f70ee330e214546e354be639ab01
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:14 2026 -0500

    tmpfs: add setlease file operation
    
    Add the setlease file_operation pointing to generic_setlease to the
    tmpfs file_operations structures. A future patch will change the
    default behavior to reject lease attempts with -EINVAL when there is no
    setlease file operation defined. Add generic_setlease to retain the
    ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-19-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit dfd8676efe436859300f22a6b7a445e7448321b6
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:13 2026 -0500

    squashfs: add setlease file operation
    
    Add the setlease file_operation pointing to generic_setlease to the
    squashfs file_operations structures. A future patch will change the
    default behavior to reject lease attempts with -EINVAL when there is no
    setlease file operation defined. Add generic_setlease to retain the
    ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-18-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 94a3f60af5dca72fffc041a64d4c3de5a066f98e
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:12 2026 -0500

    overlayfs: add setlease file operation
    
    Add the setlease file_operation to ovl_file_operations and
    ovl_dir_operations, pointing to generic_setlease.  A future patch will
    change the default behavior to reject lease attempts with -EINVAL when
    there is no setlease file operation defined. Add generic_setlease to
    retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-17-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 136b43aa4b16563c8010c90c53303b745340d70f
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:11 2026 -0500

    orangefs: add setlease file operation
    
    Add the setlease file_operation to orangefs_file_operations and
    orangefs_dir_operations, pointing to generic_setlease.  A future patch
    will change the default behavior to reject lease attempts with -EINVAL
    when there is no setlease file operation defined. Add generic_setlease
    to retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-16-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit f15d3150279d6c54a97eaac0c8f3c438c525c2f2
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:10 2026 -0500

    ocfs2: add setlease file operation
    
    Add the setlease file_operation to ocfs2_fops, ocfs2_dops,
    ocfs2_fops_no_plocks, and ocfs2_dops_no_plocks, pointing to
    generic_setlease.  A future patch will change the default behavior to
    reject lease attempts with -EINVAL when there is no setlease file
    operation defined. Add generic_setlease to retain the ability to set
    leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-15-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 6aaa1d6337b5721ede04385444e5796392419241
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:09 2026 -0500

    ntfs3: add setlease file operation
    
    Add the setlease file_operation to ntfs_file_operations,
    ntfs_legacy_file_operations, ntfs_dir_operations, and
    ntfs_legacy_dir_operations, pointing to generic_setlease.  A future
    patch will change the default behavior to reject lease attempts with
    -EINVAL when there is no setlease file operation defined. Add
    generic_setlease to retain the ability to set leases on this
    filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-14-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit f46bb13dc5d94471507ff9aed7a62a04d406b8b8
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:08 2026 -0500

    nilfs2: add setlease file operation
    
    Add the setlease file_operation to nilfs_file_operations and
    nilfs_dir_operations, pointing to generic_setlease.  A future patch
    will change the default behavior to reject lease attempts with -EINVAL
    when there is no setlease file operation defined. Add generic_setlease
    to retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-13-ea4dec9b67fa@kernel.org
    Acked-by: Ryusuke Konishi 
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 7dd596bb35e579916576677b51c15171012a7854
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:07 2026 -0500

    jfs: add setlease file operation
    
    Add the setlease file_operation to jfs_file_operations and
    jfs_dir_operations, pointing to generic_setlease.  A future patch will
    change the default behavior to reject lease attempts with -EINVAL when
    there is no setlease file operation defined. Add generic_setlease to
    retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-12-ea4dec9b67fa@kernel.org
    Acked-by: Richard Weinberger 
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Dave Kleikamp 
    Signed-off-by: Christian Brauner 

commit c275e6e7c085d9f1e9be01a05d984a8c2cba5b34
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:06 2026 -0500

    jffs2: add setlease file operation
    
    Add the setlease file_operation to jffs2_file_operations and
    jffs2_dir_operations, pointing to generic_setlease.  A future patch
    will change the default behavior to reject lease attempts with -EINVAL
    when there is no setlease file operation defined. Add generic_setlease
    to retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-11-ea4dec9b67fa@kernel.org
    Acked-by: Richard Weinberger 
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 3b514c333390746ce6dd1ebaa130dc534bda3b80
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:05 2026 -0500

    gfs2: add a setlease file operation
    
    gfs2_file_fops_nolock() already has this explicitly set, so it's only
    necessary to set this in gfs2_dir_fops_nolock().  A future patch
    will change the default behavior to reject lease attempts with -EINVAL
    when there is no setlease file operation defined.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-10-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit a9acc8422ffbaa018337a4bcb6fabbddb6b9e18c
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:04 2026 -0500

    fat: add setlease file operation
    
    Add the setlease file_operation to fat_file_operations and
    fat_dir_operations, pointing to generic_setlease.  A future patch will
    change the default behavior to reject lease attempts with -EINVAL when
    there is no setlease file operation defined. Add generic_setlease to
    retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-9-ea4dec9b67fa@kernel.org
    Acked-by: OGAWA Hirofumi 
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 9e2ac6ddb397408a77781b0de8525068f51a81cd
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:03 2026 -0500

    f2fs: add setlease file operation
    
    Add the setlease file_operation to f2fs_file_operations and
    f2fs_dir_operations, pointing to generic_setlease.  A future patch will
    change the default behavior to reject lease attempts with -EINVAL when
    there is no setlease file operation defined. Add generic_setlease to
    retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-8-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Chao Yu 
    Signed-off-by: Christian Brauner 

commit b8ca026675520441bebc2be3c1d35cc106c3c0ff
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:02 2026 -0500

    exfat: add setlease file operation
    
    Add the setlease file_operation to exfat_file_operations and
    exfat_dir_operations, pointing to generic_setlease.  A future patch
    will change the default behavior to reject lease attempts with -EINVAL
    when there is no setlease file operation defined. Add generic_setlease
    to retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-7-ea4dec9b67fa@kernel.org
    Acked-by: Namjae Jeon 
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 20747a2a29c6a7ccc54fd3f3159bcfe86a0dae6e
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:01 2026 -0500

    ext4: add setlease file operation
    
    Add the setlease file_operation to ext4_file_operations and
    ext4_dir_operations, pointing to generic_setlease.  A future patch will
    change the default behavior to reject lease attempts with -EINVAL when
    there is no setlease file operation defined. Add generic_setlease to
    retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-6-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit ccdc2e0569f5ff83cd1c6a5c7bb214e33e21bdec
Author: Jeff Layton 
Date:   Thu Jan 8 12:13:00 2026 -0500

    ext2: add setlease file operation
    
    Add the setlease file_operation to ext2_file_operations and
    ext2_dir_operations, pointing to generic_setlease.  A future patch will
    change the default behavior to reject lease attempts with -EINVAL when
    there is no setlease file operation defined. Add generic_setlease to
    retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-5-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit f8902d3df8930099f0adec2cc4dd6d8cd3ebcbe7
Author: Jeff Layton 
Date:   Thu Jan 8 12:12:59 2026 -0500

    erofs: add setlease file operation
    
    Add the setlease file_operation to erofs_file_fops and erofs_dir_fops,
    pointing to generic_setlease.  A future patch will change the default
    behavior to reject lease attempts with -EINVAL when there is no
    setlease file operation defined. Add generic_setlease to retain the
    ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-4-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Chao Yu 
    Signed-off-by: Christian Brauner 

commit f9688474e413f607f1a4e047d970b50dc268c84c
Author: Jeff Layton 
Date:   Thu Jan 8 12:12:58 2026 -0500

    btrfs: add setlease file operation
    
    Add the setlease file_operation to btrfs_file_operations and
    btrfs_dir_file_operations, pointing to generic_setlease.  A future
    patch will change the default behavior to reject lease attempts with
    -EINVAL when there is no setlease file operation defined. Add
    generic_setlease to retain the ability to set leases on this
    filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-3-ea4dec9b67fa@kernel.org
    Acked-by: David Sterba 
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit 663cdef61a27bf593e48cedc37f28ed5cfbf8c11
Author: Jeff Layton 
Date:   Thu Jan 8 12:12:57 2026 -0500

    affs: add setlease file operation
    
    Add the setlease file_operation to affs_file_operations and
    affs_dir_operations, pointing to generic_setlease.  A future patch will
    change the default behavior to reject lease attempts with -EINVAL when
    there is no setlease file operation defined. Add generic_setlease to
    retain the ability to set leases on this filesystem.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-2-ea4dec9b67fa@kernel.org
    Acked-by: David Sterba 
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Signed-off-by: Christian Brauner 

commit ca4388bf1d9e1daa849ea0550b83a6566e65502a
Author: Jeff Layton 
Date:   Thu Jan 8 12:12:56 2026 -0500

    fs: add setlease to generic_ro_fops and read-only filesystem directory operations
    
    Add the setlease file_operation to generic_ro_fops, which covers file
    operations for several read-only filesystems (BEFS, EFS, ISOFS, QNX4,
    QNX6, CRAMFS, FREEVXFS). Also add setlease to the directory
    file_operations for these filesystems.  A future patch will change the
    default behavior to reject lease attempts with -EINVAL when there is no
    setlease file operation defined. Add generic_setlease to retain the
    ability to set leases on these filesystems.
    
    Signed-off-by: Jeff Layton 
    Link: https://patch.msgid.link/20260108-setlease-6-20-v1-1-ea4dec9b67fa@kernel.org
    Acked-by: Al Viro 
    Acked-by: Christoph Hellwig 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 1f58ad77a8b49638ad2b95b364cddc12f20cd011
Author: Michal Simek 
Date:   Mon Dec 15 09:28:00 2025 +0100

    cpuidle: zynq: Switch Michal Simek's email to new one
    
    @xilinx.com is still working but better to switch to new amd.com after
    AMD/Xilinx acquisition.
    
    Signed-off-by: Michal Simek 
    Link: https://lore.kernel.org/r/ebfbf945d90b0efff3ce0dc17fb7f1f0db5b6628.1765787278.git.michal.simek@amd.com

commit e92d336eaf244d27b88f6d8742b776ae72173992
Merge: 8314d2c28d3369 0f61b1860cc3f5
Author: Greg Kroah-Hartman 
Date:   Mon Jan 12 08:51:13 2026 +0100

    Merge 6.19-rc5 into char-misc-next
    
    We need the char/misc fixes in here as well.
    
    Signed-off-by: Greg Kroah-Hartman 

commit 3aa9296a23ec41a8424e9a2346eea59fb6cb7d8c
Author: Himanshu Bhavani 
Date:   Mon Jan 5 15:04:14 2026 +0530

    media: i2c: add os05b10 image sensor driver
    
    Add a v4l2 subdevice driver for the Omnivision OS05B10 sensor.
    
    The Omnivision OS05B10 image sensor with an active
    array size of 2592 x 1944.
    
    The following features are supported:
    - Manual exposure an gain control support
    - vblank/hblank control support
    - Supported resolution: 2592 x 1944 @ 60fps (SBGGR10)
    
    Co-developed-by: Elgin Perumbilly 
    Signed-off-by: Elgin Perumbilly 
    Signed-off-by: Himanshu Bhavani 
    Reviewed-by: Vladimir Zapolskiy 
    Reviewed-by: Mehdi Djait 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 555db89381c008c9b2e9b33bc0087961da575bfd
Author: Elgin Perumbilly 
Date:   Mon Jan 5 15:04:13 2026 +0530

    dt-bindings: media: i2c: Add os05b10 sensor
    
    Add bindings for Omnivision OS05B10 sensor.
    
    Add MAINTAINERS entry for Omnivision OS05B10 binding documentation
    
    Signed-off-by: Elgin Perumbilly 
    Signed-off-by: Himanshu Bhavani 
    Reviewed-by: Vladimir Zapolskiy 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 7d402666094ce25d2b52da679b8d7210cde01a34
Author: Vladimir Zapolskiy 
Date:   Wed Dec 3 06:02:40 2025 +0200

    media: i2c: Add Samsung S5K3M5 13MP camera sensor driver
    
    Samsung S5K3M5 (ISOCELL 3M5) is a 13MP image sensor, it produces
    Bayer GRBG (2x2) frames in RAW10 output format, the maximum supported
    output resolution is 4208x3120 at 30 frames per second.
    
    Tested-by: Neil Armstrong  # on SM8550-QRD
    Signed-off-by: Vladimir Zapolskiy 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit d855e1279b2734d1567ddf8fa1a0c62180dd3cbb
Author: Vladimir Zapolskiy 
Date:   Wed Dec 3 06:02:39 2025 +0200

    dt-bindings: media: i2c: Add Samsung S5K3M5 image sensor
    
    Add device tree bindings documentation for Samsung S5K3M5 image sensor.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Vladimir Zapolskiy 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit e38fd0933c759bfd51aafbee07f11e8d69da4366
Author: Vladimir Zapolskiy 
Date:   Thu Dec 4 06:11:34 2025 +0200

    media: i2c: add Samsung S5KJN1 image sensor device driver
    
    Samsung S5KJN1 is a 50MP image sensor, it produces Bayer GRBG (2x2)
    frames in RAW10 output format, the maximum supported output resolution
    is 8160x6144 at 10 frames per second.
    
    Tested-by: Neil Armstrong  # on SM8650-QRD
    Signed-off-by: Vladimir Zapolskiy 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 59cbe9436de67c5592467587dd39a4879c002d4d
Author: Vladimir Zapolskiy 
Date:   Thu Dec 4 06:11:33 2025 +0200

    dt-bindings: media: i2c: Add Samsung S5KJN1 image sensor
    
    Add device tree bindings documentation for Samsung S5KJN1 image sensor.
    
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Vladimir Zapolskiy 
    Signed-off-by: Sakari Ailus 
    Signed-off-by: Hans Verkuil 

commit 403faa575738a7f92267b2ca2ee56cd1b9373078
Author: Shubham Sharma 
Date:   Tue Dec 30 13:23:37 2025 +0530

    rv: Fix documentation reference in da_monitor.h
    
    Update documentation reference to reflect the file rename.
    Monitor synthesis documentation was renamed in commit f40a7c060207
    ("Documentation/rv: Prepare monitor synthesis document for LTL inclusion")
    from da_monitor_synthesis.rst to monitor_synthesis.rst.
    
    Signed-off-by: Shubham Sharma 
    Reviewed-by: Gabriele Monaco 
    Link: https://lore.kernel.org/r/20251230075337.11993-1-slopixelz@gmail.com
    Signed-off-by: Gabriele Monaco 

commit 3fee5b320c15c8f61e44729a9513347de6a93735
Author: Gabriele Monaco 
Date:   Wed Nov 26 11:42:39 2025 +0100

    verification/rvgen: Remove unused variable declaration from containers
    
    The monitor container source files contained a declaration and a
    definition for the rv_monitor variable. The former is superfluous and
    can be removed.
    
    Remove the variable declaration from the template as well as the
    existing monitor containers.
    
    Reviewed-by: Nam Cao 
    Link: https://lore.kernel.org/r/20251126104241.291258-9-gmonaco@redhat.com
    Signed-off-by: Gabriele Monaco 

commit 3d2bfeeef340c8494eba80e7a005159cac69c2f7
Author: Gabriele Monaco 
Date:   Wed Nov 26 11:42:38 2025 +0100

    verification/dot2c: Remove superfluous enum assignment and add last comma
    
    The header files generated by dot2c currently create enums for states
    and events assigning the first element to 0. This is superfluous as it
    happens automatically if no value is specified.
    Also it doesn't add a comma to the last enum elements, which slightly
    complicates the diff if states or events are added.
    
    Remove the assignment to 0 and add a comma to last elements, this
    simplifies the logic for the code generator.
    
    Reviewed-by: Nam Cao 
    Link: https://lore.kernel.org/r/20251126104241.291258-8-gmonaco@redhat.com
    Signed-off-by: Gabriele Monaco 

commit 0d2405a086a035cce1e0ba1aa0849bd2104a4d6b
Author: Gabriele Monaco 
Date:   Wed Nov 26 11:42:37 2025 +0100

    verification/dot2c: Remove __buff_to_string() and cleanup
    
    str.join() can do what __buff_to_string() does. Therefore replace
    __buff_to_string() to make the scripts more pythonic.
    
    Also clean and remove some intermediate functions.
    
    Reviewed-by: Nam Cao 
    Link: https://lore.kernel.org/r/20251126104241.291258-7-gmonaco@redhat.com
    Signed-off-by: Gabriele Monaco 

commit 3c5720b9ba3ee9b3ae238aeaf0340e4c9666330e
Author: Gabriele Monaco 
Date:   Wed Nov 26 11:42:36 2025 +0100

    verification/rvgen: Annotate DA functions with types
    
    Functions in automata.py, dot2c.py and dot2k.py don't have type
    annotations and it can get complicated to remember how to use them.
    
    Add minimal type annotations.
    
    Reviewed-by: Nam Cao 
    Link: https://lore.kernel.org/r/20251126104241.291258-6-gmonaco@redhat.com
    Signed-off-by: Gabriele Monaco 

commit 531b50e06aa7600f854a90b0f714f4e49ea2c1ac
Author: Gabriele Monaco 
Date:   Wed Nov 26 11:42:35 2025 +0100

    verification/rvgen: Adapt dot2k and templates after refactoring da_monitor.h
    
    Previous changes refactored the da_monitor header file to avoid using
    macros. This implies a few changes in how to import and use da_monitor
    helpers:
    
     DECLARE_DA_MON_(name, type) is substituted by
     #define RV_MON_TYPE RV_MON_
    
    Update the rvgen templates to reflect the changes.
    
    Reviewed-by: Nam Cao 
    Link: https://lore.kernel.org/r/20251126104241.291258-5-gmonaco@redhat.com
    Signed-off-by: Gabriele Monaco 

commit e4a1e415eb184e0b93fe43c5604bb7287e94ac0d
Author: Gabriele Monaco 
Date:   Wed Nov 26 11:42:34 2025 +0100

    Documentation/rv: Adapt documentation after da_monitor refactoring
    
    Previous changes refactored the da_monitor header file to avoid using
    macros. This implies a few changes in how to import and use da_monitor
    helpers:
    
     DECLARE_DA_MON_(name, type) is substituted by
     #define RV_MON_TYPE RV_MON_
    
     da_handle_event_() is substituted by
     da_handle_event()
    
    Update the documentation to reflect the changes.
    
    Reviewed-by: Nam Cao 
    Link: https://lore.kernel.org/r/20251126104241.291258-4-gmonaco@redhat.com
    Signed-off-by: Gabriele Monaco 

commit fa9b26dfa172d145447fc1fca0337dfcf8588d19
Author: Gabriele Monaco 
Date:   Wed Nov 26 11:42:33 2025 +0100

    rv: Cleanup da_monitor after refactor
    
    Previous changes refactored the da_monitor header file to avoid using
    macros, however empty macros (e.g. DECLARE_DA_FUNCTION) were left to
    ease review with diff tools.
    Most macros also get the argument type which doesn't really have a
    purpose since states have their own enum and the storage in struct
    da_monitor is fixed to unsigned int.
    
    Remove empty and no longer required macros and substitute the type
    parameter with the appropriate enum.
    Additionally break long line and adjust the format overall.
    
    Reviewed-by: Nam Cao 
    Link: https://lore.kernel.org/r/20251126104241.291258-3-gmonaco@redhat.com
    Signed-off-by: Gabriele Monaco 

commit 30984ccf31b7f0678fad05a22e06bb9f6014c1ce
Author: Gabriele Monaco 
Date:   Wed Nov 26 11:42:32 2025 +0100

    rv: Refactor da_monitor to minimise macros
    
    The da_monitor helper functions are generated from macros of the type:
    
    DECLARE_DA_FUNCTION(name, type) \
    static void da_func_x_##name(type arg) {} \
    static void da_func_y_##name(type arg) {} \
    
    This is good to minimise code duplication but the long macros made of
    skipped end of lines is rather hard to parse. Since functions are
    static, the advantage of naming them differently for each monitor is
    minimal.
    
    Refactor the da_monitor.h file to minimise macros, instead of declaring
    functions from macros, we simply declare them with the same name for all
    monitors (e.g. da_func_x) and for any remaining reference to the monitor
    name (e.g. tracepoints, enums, global variables) we use the CONCATENATE
    macro.
    In this way the file is much easier to maintain while keeping the same
    generality.
    Functions depending on the monitor types are now conditionally compiled
    according to the value of RV_MON_TYPE, which must be defined in the
    monitor source.
    The monitor type can be specified as in the original implementation,
    although it's best to keep the default implementation (unsigned char) as
    not all parts of code support larger data types, and likely there's no
    need.
    
    We keep the empty macro definitions to ease review of this change with
    diff tools, but cleanup is required.
    
    Also adapt existing monitors to keep the build working.
    
    Reviewed-by: Nam Cao 
    Link: https://lore.kernel.org/r/20251126104241.291258-2-gmonaco@redhat.com
    Signed-off-by: Gabriele Monaco 

commit ee8112a2e0f96d7a125c6ad3a7851e0d598c28a8
Merge: 309b23a1553acd e60b579720993b
Author: Martin K. Petersen 
Date:   Sun Jan 11 22:08:12 2026 -0500

    Merge patch series "Call scsi_host_busy() after the SCSI host has been added"
    
    Bart Van Assche  says:
    
    Hi Martin,
    
    The UFS driver is the only SCSI driver I know of that may call
    scsi_host_busy() before the SCSI host has been added. This patch series
    modifies the UFS driver such that scsi_host_busy() is only called after the
    SCSI host has been added. Additionally, commit a0b7780602b1 ("scsi: core: Fix
    a regression triggered by scsi_host_busy()") is reverted because all
    scsi_host_busy() calls now happen after the corresponding SCSI host has been
    added.
    
    Please consider this patch series for the next merge window.
    
    Thanks,
    
    Bart.
    
    Link: https://patch.msgid.link/20260109205104.496478-1-bvanassche@acm.org
    Signed-off-by: Martin K. Petersen 

commit e60b579720993bd813dbfe77411ab63e721fe189
Author: Bart Van Assche 
Date:   Fri Jan 9 12:51:02 2026 -0800

    scsi: core: Revert "Fix a regression triggered by scsi_host_busy()"
    
    Revert commit a0b7780602b1 ("scsi: core: Fix a regression triggered by
    scsi_host_busy()") because all scsi_host_busy() calls now happen after
    the corresponding SCSI host has been added.
    
    Signed-off-by: Bart Van Assche 
    Reviewed-by: John Garry 
    Link: https://patch.msgid.link/20260109205104.496478-3-bvanassche@acm.org
    Signed-off-by: Martin K. Petersen 

commit 202d5dadd3a0fada6aa756c9fdeb2062aad89f79
Author: Bart Van Assche 
Date:   Fri Jan 9 12:51:01 2026 -0800

    scsi: ufs: core: Only call scsi_host_busy() after the SCSI host has been added
    
    scsi_host_busy() iterates over the host tag set. The host tag set is
    initialized by scsi_mq_setup_tags(). The latter function is called by
    scsi_add_host(). Hence only call scsi_host_busy() after the SCSI host
    has been added. This patch prepares for reverting commit a0b7780602b1
    ("scsi: core: Fix a regression triggered by scsi_host_busy()").
    
    Reviewed-by: John Garry 
    Signed-off-by: Bart Van Assche 
    Link: https://patch.msgid.link/20260109205104.496478-2-bvanassche@acm.org
    Signed-off-by: Martin K. Petersen 

commit 309b23a1553acdc6b8534682ee1782c9598e0e2e
Author: Bart Van Assche 
Date:   Tue Jan 6 12:00:17 2026 -0700

    scsi: ufs: core: Improve the documentation of UFS data frames
    
    In source code comments, use terminology that comes from the JEDEC UFS
    standard. This makes it easier to compare the UFS driver code with the
    JEDEC UFS standard. Add static_assert() statements that verify the size
    of data structures defined in the UFS standard.
    
    Signed-off-by: Bart Van Assche 
    Link: https://patch.msgid.link/20260106190017.2527978-1-bvanassche@acm.org
    Signed-off-by: Martin K. Petersen 

commit bf286f5558bfade5b746646b8b94685648f4b49a
Author: Bart Van Assche 
Date:   Tue Jan 6 11:56:54 2026 -0700

    scsi: mpt3sas: Simplify the workqueue allocation code
    
    Let alloc_ordered_workqueue() format the workqueue name instead of
    calling scnprintf() explicitly. Compile-tested only.
    
    Cc: Ranjan Kumar 
    Signed-off-by: Bart Van Assche 
    Link: https://patch.msgid.link/20260106185655.2526800-1-bvanassche@acm.org
    Signed-off-by: Martin K. Petersen 

commit 8d0aecdebc0f3c123221e67d2f64ff0982f76cb3
Author: Bart Van Assche 
Date:   Tue Jan 6 11:57:22 2026 -0700

    scsi: mpi3mr: Simplify the workqueue allocation code
    
    Let alloc_ordered_workqueue() format the workqueue name instead of
    calling scnprintf() explicitly. Compile-tested only.
    
    Cc: Chandrakanth Patil 
    Signed-off-by: Bart Van Assche 
    Link: https://patch.msgid.link/20260106185723.2526901-1-bvanassche@acm.org
    Signed-off-by: Martin K. Petersen 

commit 993ab48006b3016cdd3f2b33905e8e167f955495
Author: Takashi Sakamoto 
Date:   Sat Jan 10 10:39:11 2026 +0900

    firewire: ohci: stop using page private to store DMA mapping address
    
    There is a long discussion about the use of private field in page
    structure between Linux kernel developers.
    
    This commit stop using page private to store DMA mapping address for
    AR context, to prepare for mm future change.
    
    Link: https://lore.kernel.org/r/20260110013911.19160-9-o-takashi@sakamocchi.jp
    Signed-off-by: Takashi Sakamoto 

commit f2ae92780ab93ed7e59e469cfd5c7269bd68ddb4
Author: Takashi Sakamoto 
Date:   Sat Jan 10 10:39:10 2026 +0900

    firewire: ohci: split page allocation from dma mapping
    
    1394 OHCI PCI driver had long been the only user of dma_alloc_pages().
    Although tee subsystem recently started using it, they are still a few
    users of the infrequently-used function.
    
    In the discussion for dma-mapping function, Jason Gunthorpe shows his
    opinion about the design of public API for the function. According to it,
    the users provide physical address to the function, then receive DMA
    mapping address, regardless of the location of mapping target.
    
    With the above aspects, this commit eliminates the use of
    dma_alloc_pages() from this subsystem.
    
    Link: https://lore.kernel.org/lkml/20250905174324.GI616306@nvidia.com/
    Link: https://lore.kernel.org/r/20260110013911.19160-8-o-takashi@sakamocchi.jp
    Signed-off-by: Takashi Sakamoto 

commit e62b46cdd3ea8117ec6e39cec5cb8d53f96adb7c
Author: Takashi Sakamoto 
Date:   Sat Jan 10 10:39:09 2026 +0900

    firewire: ohci: use MAX macro to guarantee minimum count of pages for AR contexts
    
    The computation of page size for AR DMA context can be simplified by MAX
    macro.
    
    Link: https://lore.kernel.org/r/20260110013911.19160-7-o-takashi@sakamocchi.jp
    Signed-off-by: Takashi Sakamoto 

commit ef6bdffbb88d86c8a2906fc8a13ae90eb5a6b64e
Author: Takashi Sakamoto 
Date:   Sat Jan 10 10:39:08 2026 +0900

    firewire: core: stop using page private to store DMA mapping address
    
    There is a long discussion about the use of private field in page
    structure between Linux kernel developers.
    
    This commit stop using page private to store DMA mapping address for
    isochronous context, to prepare for mm future change.
    
    Link: https://lore.kernel.org/r/20260110013911.19160-6-o-takashi@sakamocchi.jp
    Signed-off-by: Takashi Sakamoto 

commit c2f60aa1602d8bdf2cd44bbaef2c862a356ce414
Author: Takashi Sakamoto 
Date:   Sat Jan 10 10:39:07 2026 +0900

    firewire: core: use common kernel API to allocate and release a batch of pages
    
    The pair of alloc_pages_bulk() and release_pages() are convenient to
    allocate and release a batch of pages.
    
    This commit utilizes the pair to maintain pages for isochronous DMA
    context.
    
    Link: https://lore.kernel.org/r/20260110013911.19160-5-o-takashi@sakamocchi.jp
    Signed-off-by: Takashi Sakamoto 

commit a69a9e630d49e2b990486360c371278d42993df0
Author: Takashi Sakamoto 
Date:   Sat Jan 10 10:39:06 2026 +0900

    firewire: core: code refactoring with cleanup function for isoc pages
    
    This commit refactors the implementation to allocate pages for isochronous
    DMA contexts with cleanup function.
    
    Link: https://lore.kernel.org/r/20260110013911.19160-4-o-takashi@sakamocchi.jp
    Signed-off-by: Takashi Sakamoto 

commit adc839ae7d0f6c1a823e9731e45abfd87c6cf28b
Author: Takashi Sakamoto 
Date:   Sat Jan 10 10:39:05 2026 +0900

    firewire: core: use mutex instead of spinlock for client isochronous context
    
    There is a restriction that the userspace client associated to a file
    descriptor can hold one isochronous context. The client-level spinning
    lock is used to guarantee it, however the lock is also used for
    multi-purposes. Additionally, there is no need to use this type of lock,
    and the mutex is available, instead.
    
    Link: https://lore.kernel.org/r/20260110013911.19160-3-o-takashi@sakamocchi.jp
    Signed-off-by: Takashi Sakamoto 

commit c91adaddb0740c5a436084c85bedfe07b6d0c157
Author: Takashi Sakamoto 
Date:   Sat Jan 10 10:39:04 2026 +0900

    firewire: core: move private function declaration from public header to internal header
    
    The fw_iso_buffer_lookup function is used by core module only, thus no
    need to describe its prototype in kernel internal header.
    
    Link: https://lore.kernel.org/r/20260110013911.19160-2-o-takashi@sakamocchi.jp
    Signed-off-by: Takashi Sakamoto 

commit 37d2e108de4d39172aa0c371ec991855d4cc0241
Author: Dan Carpenter 
Date:   Thu Jan 8 22:57:22 2026 +0300

    drm/msm: remove some dead code
    
    This is supposed to test for integer overflow but it is wrong and
    unnecessary.  The size_add()/mul() macros return SIZE_MAX when there is
    an integer overflow.  This code saves the SIZE_MAX to a u64 and then
    tests if the result is greater than SIZE_MAX which it never will be.
    Fortunately, when we try to allocate SIZE_MAX bytes the allocation
    will fail.  We even pass __GFP_NOWARN so the allocation fails
    harmlessly and quietly.
    
    Signed-off-by: Dan Carpenter 
    Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl")
    Reviewed-by: Dmitry Baryshkov 
    Patchwork: https://patchwork.freedesktop.org/patch/697596/
    Link: https://lore.kernel.org/r/aWAMIhZLxUcecbLd@stanley.mountain
    Signed-off-by: Dmitry Baryshkov 

commit 3a8a4ee99cb603aa889de18dd4d1cadb7de331a5
Merge: ae62d62b1c740f 44859905375ff4
Author: Martin K. Petersen 
Date:   Sun Jan 11 21:33:19 2026 -0500

    Merge patch series "scsi: Make use of bus callbacks"
    
    Uwe Kleine-König  says:
    
    Hello,
    
    this is v2 of the series to make the scsi subsystem stop using the
    callbacks .probe(), .remove() and .shutdown() of struct device_driver.
    Instead use their designated alternatives in struct bus_type.
    
    The eventual goal is to drop the callbacks from struct device_driver.
    
    The 2nd patch introduces some legacy handling for drivers still using
    the device_driver callbacks. This results in a runtime warning (in
    driver_register()). The following patches convert all in-tree drivers
    (and thus fix the warnings one after another).
    Conceptually this legacy handling could be dropped at the end of the
    series, but I think this is a bad idea because this silently breaks
    out-of-tree drivers (which also covers drivers that are currently
    prepared for mainline submission) and in-tree drivers I might have
    missed (though I'm convinced I catched them all). That convinces me that
    keeping the legacy handling for at least one development cycle is the
    right choice. I'll care for that at the latest when I remove the
    callbacks from struct device_driver.
    
    Link: https://patch.msgid.link/cover.1766133330.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Martin K. Petersen 

commit 44859905375ff4d739cca2113408336a90ed227d
Author: Uwe Kleine-König 
Date:   Fri Dec 19 10:25:37 2025 +0100

    scsi: ufs: core: Convert to SCSI bus methods
    
    The SCSI subsystem has implemented dedicated callbacks for probe, remove
    and shutdown. Make use of them. This fixes a runtime warning about the
    driver needing to be converted to the bus probe method.
    
    Reviewed-by: Peter Wang 
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/69f17c7d4f8f587e2a56e3ea268d441d98a6a895.1766133330.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Martin K. Petersen 

commit 4bc2205be4609b7a224c78e12852a672cbf80d3d
Author: Uwe Kleine-König 
Date:   Fri Dec 19 10:25:36 2025 +0100

    scsi: st: Convert to SCSI bus methods
    
    The SCSI subsystem has implemented dedicated callbacks for probe, remove
    and shutdown. Make use of them. This fixes a runtime warning about the
    driver needing to be converted to the bus probe method.
    
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/6da44731f77e8fdcd18e5f438643d58c98945db4.1766133330.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Martin K. Petersen 

commit 9ccda35df7d5cf46649d02696278c7cd4464a16d
Author: Uwe Kleine-König 
Date:   Fri Dec 19 10:25:35 2025 +0100

    scsi: sr: Convert to SCSI bus methods
    
    The SCSI subsystem has implemented dedicated callbacks for probe, remove
    and shutdown. Make use of them. This fixes a runtime warning about the
    driver needing to be converted to the bus probe method.
    
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/ff6e8421f9efa84be3c37a11637aa435899160bf.1766133330.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Martin K. Petersen 

commit a71d5deea6e95b6155ea22e5db6feb92634307b4
Author: Uwe Kleine-König 
Date:   Fri Dec 19 10:25:34 2025 +0100

    scsi: ses: Convert to SCSI bus methods
    
    The SCSI subsystem has implemented dedicated callbacks for probe, remove
    and shutdown. Make use of them. This fixes a runtime warning about the
    driver needing to be converted to the bus probe method.
    
    There is no need for an empty remove callback, no remove callback has
    the same semantics. So instead of converting the remove callback, drop
    it.
    
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/7124bf21c02a116bca13940e40e97373fd776590.1766133330.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Martin K. Petersen 

commit 63b541f054e7147f5a19fcd964677c189bad7cff
Author: Uwe Kleine-König 
Date:   Fri Dec 19 10:25:33 2025 +0100

    scsi: sd: Convert to SCSI bus methods
    
    The SCSI subsystem has implemented dedicated callbacks for probe, remove
    and shutdown. Make use of them. This fixes a runtime warning about the
    driver needing to be converted to the bus probe method.
    
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/8ad5a00c2ad2a64b81350ae3fab02fbe430f306d.1766133330.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Martin K. Petersen 

commit fba333569c8a59928e9e6bb4e20cc6151daeaff8
Author: Uwe Kleine-König 
Date:   Fri Dec 19 10:25:32 2025 +0100

    scsi: ch: Convert to SCSI bus methods
    
    The SCSI subsystem has implemented dedicated callbacks for probe, remove
    and shutdown. Make use of them. This fixes a runtime warning about the
    driver needing to be converted to the bus probe method.
    
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/b36de11cbc32265a52264da5c813dd6e1abd21fd.1766133330.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Martin K. Petersen 

commit f7d4f1bf5724e52de049c619beddd53c62206624
Author: Uwe Kleine-König 
Date:   Fri Dec 19 10:25:31 2025 +0100

    scsi: core: sysfs: Make use of bus callbacks
    
    Introduce a bus-specific probe, remove and shutdown function. For now
    this only allows to get rid of a cast of the generic device to a SCSI
    device in the drivers and changes the remove prototype to return
    void---a non-zero return value is ignored anyhow.
    
    The objective is to get rid of users of struct device_driver callbacks
    .probe(), .remove() and .shutdown() to eventually remove these. Until
    all SCSI drivers are converted, this results in a runtime warning about
    the drivers needing an update because there is a bus probe function and
    a driver probe function. The in-tree drivers are fixed by the following
    commits.
    
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Peter Wang 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/a54e363a3fd2054fb924afd7df44bca7f444b5f1.1766133330.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Martin K. Petersen 

commit 7d42bcea57ae139e2ed754425cc5fc44e260c890
Author: Uwe Kleine-König 
Date:   Fri Dec 19 10:25:30 2025 +0100

    scsi: core: Pass a struct scsi_driver to scsi_{,un}register_driver()
    
    This aligns with what other subsystems do, reduces boilerplate a bit for
    device drivers and is less error prone.
    
    Reviewed-by: Peter Wang 
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/ac17fdea58e384cb514c639306d48ce0005820b0.1766133330.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Martin K. Petersen 

commit 432b119ab8d8bf1f550c247f7fbe960e87ba6c92
Author: Julia Lawall 
Date:   Sun Jan 4 18:16:44 2026 +0100

    docs: power: update documentation about removed function
    
    The function cm_notify_event() was removed in commit 9584051f3cf3
    ("power: supply: charger-manager: Remove cm_notify_event function").
    Remove the documentation that suggests how it can be used.
    
    Signed-off-by: Julia Lawall 
    Link: https://patch.msgid.link/20260104171644.292437-1-Julia.Lawall@inria.fr
    Signed-off-by: Sebastian Reichel 

commit 39fe0eac6d755ef215026518985fcf8de9360e9e
Author: Waqar Hameed 
Date:   Sat Dec 20 23:46:24 2025 +0100

    power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()
    
    In `probe()`, `request_irq()` is called before allocating/registering a
    `power_supply` handle. If an interrupt is fired between the call to
    `request_irq()` and `power_supply_register()`, the `power_supply` handle
    will be used uninitialized in `power_supply_changed()` in
    `wm97xx_bat_update()` (triggered from the interrupt handler). This will
    lead to a `NULL` pointer dereference since
    
    Fix this racy `NULL` pointer dereference by making sure the IRQ is
    requested _after_ the registration of the `power_supply` handle. Since
    the IRQ is the last thing requests in the `probe()` now, remove the
    error path for freeing it. Instead add one for unregistering the
    `power_supply` handle when IRQ request fails.
    
    Fixes: 7c87942aef52 ("wm97xx_battery: Use irq to detect charger state")
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/97b55f0479a932eea7213844bf66f28a974e27a2.1766270196.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 04aa3d6dddaf39ecc9735d0b62f46899db71d35e
Author: Lukas Bulwahn 
Date:   Fri Nov 7 13:36:21 2025 +0100

    MAINTAINERS: adjust file entry in ROHM BD71828 CHARGER
    
    Commit 5bff79dad20a ("power: supply: Add bd718(15/28/78) charger driver")
    adds the file bd71828-power.c in drivers/power/supply/, whereas commit
    b838cecc2291 ("MAINTAINERS: Add entry for BD71828 charger") from the same
    patch series, adds a section referring to the non-existing file
    bd71828-charger.c in the directory above.
    
    Adjust the file entry to refer to the intended existing file.
    
    Signed-off-by: Lukas Bulwahn 
    Reviewed-by: Matti Vaittinen 
    Link: https://patch.msgid.link/20251107123621.425633-1-lukas.bulwahn@redhat.com
    Signed-off-by: Sebastian Reichel 

commit 81963d1c5689168731dca0652093c73b90bed1d3
Author: Randy Dunlap 
Date:   Mon Nov 10 22:00:09 2025 -0800

    power: supply: ab8500_chargalg: improve kernel-doc
    
    Correct "bad line" warnings and add descriptions for missing entries
    to avoid these warnings:
    
    ab8500_chargalg.c:173: warning: bad line:  is set
    ab8500_chargalg.c:179: warning: bad line:  increased
    ab8500_chargalg.c:247: warning: Function parameter or struct member
     't_hyst_norm' not described in 'ab8500_chargalg'
    ab8500_chargalg.c:247: warning: Function parameter or struct member
     't_hyst_lowhigh' not described in 'ab8500_chargalg'
    ab8500_chargalg.c:247: warning: Function parameter or struct member
     'ccm' not described in 'ab8500_chargalg'
    ab8500_chargalg.c:247: warning: Function parameter or struct member
     'ac_chg' not described in 'ab8500_chargalg'
    ab8500_chargalg.c:247: warning: Function parameter or struct member
     'usb_chg' not described in 'ab8500_chargalg'
    ab8500_chargalg.c:308: warning: Function parameter or struct member
     'state' not described in 'ab8500_chargalg_state_to'
    ab8500_chargalg.c:773: warning: Function parameter or struct member
     'di' not described in 'ab8500_chargalg_chg_curr_maxim'
    
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Linus Walleij 
    Link: https://patch.msgid.link/20251111060009.1959425-1-rdunlap@infradead.org
    Signed-off-by: Sebastian Reichel 

commit 2c7e46e1318d4fbf514f454d5a746a1b76d06ebe
Author: Krzysztof Kozlowski 
Date:   Wed Nov 26 18:19:00 2025 +0100

    power: supply: sysfs: Constify pointer passed to dev_attr_psp()
    
    Memory pointer by pointer passed to dev_attr_psp() is not modified, so
    with help of container_of_const() (preferred than container_of()) can be
    made pointer to const for code safety.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251126171859.72465-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Sebastian Reichel 

commit 688364a11647dc09ba1e4429313e0008066ec790
Author: Haotian Zhang 
Date:   Thu Dec 4 16:34:36 2025 +0800

    power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
    
    bq27xxx_write(), bq27xxx_read_block(), and bq27xxx_write_block()
    return -EPERM when the bus callback pointer is NULL. A NULL callback
    indicates the operation is not supported by the bus/driver,
    not that permission is denied.
    
    Return -EOPNOTSUPP instead of -EPERM when di->bus.write/
    read_bulk/write_bulk is NULL.
    
    Fixes: 14073f6614f6 ("power: supply: bq27xxx: Add bulk transfer bus methods")
    Signed-off-by: Haotian Zhang 
    Reviewed-by: Matt Ranostay 
    Link: https://patch.msgid.link/20251204083436.1367-1-vulab@iscas.ac.cn
    Signed-off-by: Sebastian Reichel 

commit 36b05629226413836cfbb3fbe6689cd188bca156
Author: Alexander Koskovich 
Date:   Sun Dec 14 19:16:18 2025 +0000

    power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
    
    Some platforms expose reboot mode cells that are smaller than an
    unsigned int, in which cases lead to write failures. Read the cell
    first to determine actual size and only write the number of bytes the
    cell can hold.
    
    Fixes: 7a78a7f7695b ("power: reset: nvmem-reboot-mode: use NVMEM as reboot mode write interface")
    Signed-off-by: Alexander Koskovich 
    Link: https://patch.msgid.link/20251214191529.2470580-1-akoskovich@pm.me
    Signed-off-by: Sebastian Reichel 

commit 8d59cf3887fbabacef53bfba473e33e8a8d9d07b
Author: Waqar Hameed 
Date:   Sat Dec 20 23:36:02 2025 +0100

    power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle. Keep the old behavior of
    just printing a warning in case of any failures during the IRQ request
    and finishing the probe successfully.
    
    Fixes: d2cec82c2880 ("power: sbs-battery: Request threaded irq and fix dev callback cookie")
    Signed-off-by: Waqar Hameed 
    Reviewed-by: Phil Reid 
    Link: https://patch.msgid.link/0ef896e002495e615157b482d18a437af19ddcd0.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit e2febe375e5ea5afed92f4cd9711bde8f24ee6d2
Author: Waqar Hameed 
Date:   Sat Dec 20 23:36:02 2025 +0100

    power: supply: rt9455: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle.
    
    Fixes: e86d69dd786e ("power_supply: Add support for Richtek RT9455 battery charger")
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/1567d831e04c3e2fcb9e18dd36b7bcba4634581a.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit b7508129978ae1e2ed9b0410396abc05def9c4eb
Author: Waqar Hameed 
Date:   Sat Dec 20 23:36:01 2025 +0100

    power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle.
    
    Fixes: f8d7a3d21160 ("power: supply: Add driver for pm8916 lbc")
    Signed-off-by: Waqar Hameed 
    Reviewed-by: Nikita Travkin 
    Link: https://patch.msgid.link/64d8dd3675a4e59fa32c3e0ef451f12d1f7ed18f.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 62914959b35e9a1e29cc0f64cb8cfc5075a5366f
Author: Waqar Hameed 
Date:   Sat Dec 20 23:36:01 2025 +0100

    power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle.
    
    Fixes: 098bce1838e0 ("power: supply: Add pm8916 VM-BMS support")
    Signed-off-by: Waqar Hameed 
    Reviewed-by: Nikita Travkin 
    Link: https://patch.msgid.link/2749c09ff81fcac87ae48147e216135450d8c067.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 838767f5074700552d3f006d867caed65edc7328
Author: Waqar Hameed 
Date:   Sat Dec 20 23:36:01 2025 +0100

    power: supply: pf1550: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle.
    
    Fixes: 4b6b6433a97d ("power: supply: pf1550: add battery charger support")
    Signed-off-by: Waqar Hameed 
    Reviewed-by: Samuel Kayode 
    Link: https://patch.msgid.link/ae5a71b7e4dd2967d8fdcc531065cc71b17c86f5.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit b2ce982e2e0c888dc55c888ad0e20ea04daf2e6b
Author: Waqar Hameed 
Date:   Sat Dec 20 23:36:00 2025 +0100

    power: supply: goldfish: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle.
    
    Fixes: 84d7b7687489 ("power: Add battery driver for goldfish emulator")
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/500a606bb6fb6f2bb8d797e19a00cea9dd7b03c1.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 642f33e34b969eedec334738fd5df95d2dc42742
Author: Waqar Hameed 
Date:   Sat Dec 20 23:36:00 2025 +0100

    power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle.
    
    Fixes: 874b2adbed12 ("power: supply: cpcap-battery: Add a battery driver")
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/81db58d610c9a51a68184f856cd431a934cccee2.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 5f0b1cb41906e86b64bf69f5ededb83b0d757c27
Author: Waqar Hameed 
Date:   Sat Dec 20 23:35:59 2025 +0100

    power: supply: bq25980: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle.
    
    Fixes: 5069185fc18e ("power: supply: bq25980: Add support for the BQ259xx family")
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/8763035cadb959e14787b3837f2d3db61f6e1c34.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 8005843369723d9c8975b7c4202d1b85d6125302
Author: Waqar Hameed 
Date:   Sat Dec 20 23:35:59 2025 +0100

    power: supply: bq256xx: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle.
    
    Fixes: 32e4978bb920 ("power: supply: bq256xx: Introduce the BQ256XX charger driver")
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/39da6da8cc060fa0382ca859f65071e791cb6119.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 3291c51d4684d048dd2eb91b5b65fcfdaf72141f
Author: Waqar Hameed 
Date:   Sat Dec 20 23:35:59 2025 +0100

    power: supply: act8945a: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Fix this racy use-after-free by making sure the IRQ is requested _after_
    the registration of the `power_supply` handle.
    
    Fixes: a09209acd6a8 ("power: supply: act8945a_charger: Add status change update support")
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/bcf3a23b5187df0bba54a8c8fe09f8b8a0031dee.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit c4af8a98bb52825a5331ae1d0604c0ea6956ba4b
Author: Waqar Hameed 
Date:   Sat Dec 20 23:35:58 2025 +0100

    power: supply: ab8500: Fix use-after-free in power_supply_changed()
    
    Using the `devm_` variant for requesting IRQ _before_ the `devm_`
    variant for allocating/registering the `power_supply` handle, means that
    the `power_supply` handle will be deallocated/unregistered _before_ the
    interrupt handler (since `devm_` naturally deallocates in reverse
    allocation order). This means that during removal, there is a race
    condition where an interrupt can fire just _after_ the `power_supply`
    handle has been freed, *but* just _before_ the corresponding
    unregistration of the IRQ handler has run.
    
    This will lead to the IRQ handler calling `power_supply_changed()` with
    a freed `power_supply` handle. Which usually crashes the system or
    otherwise silently corrupts the memory...
    
    Note that there is a similar situation which can also happen during
    `probe()`; the possibility of an interrupt firing _before_ registering
    the `power_supply` handle. This would then lead to the nasty situation
    of using the `power_supply` handle *uninitialized* in
    `power_supply_changed()`.
    
    Commit 1c1f13a006ed ("power: supply: ab8500: Move to componentized
    binding") introduced this issue during a refactorization. Fix this racy
    use-after-free by making sure the IRQ is requested _after_ the
    registration of the `power_supply` handle.
    
    Fixes: 1c1f13a006ed ("power: supply: ab8500: Move to componentized binding")
    Signed-off-by: Waqar Hameed 
    Reviewed-by: Linus Walleij 
    Link: https://patch.msgid.link/ccf83a09942cb8dda3dff70b2682f2c2e9cb97f2.1766268280.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit ce3bc8469e4c387fd937e2ef96a6d45b7e22afc7
Author: Waqar Hameed 
Date:   Sat Dec 20 22:54:09 2025 +0100

    power: supply: ucs1002: Remove unused gpio include header
    
    This header file is not used anywhere in the driver. Remove it.
    
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/dcff57bfbf0510c8b5bfd9d39de021607567a6e8.1766266985.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 91a4f92de8454621e9d4e77a58c19c9d60a69581
Author: Waqar Hameed 
Date:   Sat Dec 20 22:54:09 2025 +0100

    power: supply: cw2015: Remove unused gpio include header
    
    This header file is not used anywhere in the driver. Remove it.
    
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/6c6ea228f39f3c01c0a89d8ba545be6f3ec13c2a.1766266985.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 3d74b6dfd703ba812c624c689451b0ae573b4f0b
Author: Waqar Hameed 
Date:   Sat Dec 20 22:54:08 2025 +0100

    power: supply: bq25980: Remove unused gpio include header
    
    This header file is not used anywhere in the driver. Remove it.
    
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/94cf6d7dc464e20abea543983b24828e51c64f93.1766266985.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit 38673fd9d622318eed1e35cfad5998b4056edc1e
Author: Waqar Hameed 
Date:   Sat Dec 20 22:54:08 2025 +0100

    power: supply: bq256xx: Remove unused gpio include header
    
    This header file is not used anywhere in the driver. Remove it.
    
    Signed-off-by: Waqar Hameed 
    Link: https://patch.msgid.link/730eb504f7ae9d3fcdfeebb544bfe115c32e1064.1766266985.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit e312b7e3183d2d806609ee0e905da807ff5d891f
Author: Waqar Hameed 
Date:   Sat Dec 20 22:54:08 2025 +0100

    power: supply: bd99954: Remove unused gpio include header
    
    This header file is not used anywhere in the driver. Remove it.
    
    Signed-off-by: Waqar Hameed 
    Acked-by: Matti Vaittinen 
    Link: https://patch.msgid.link/ee74b461a8b8f02093e0beb519a1f0b8de7b64bc.1766266985.git.waqar.hameed@axis.com
    Signed-off-by: Sebastian Reichel 

commit e39fadd6ef7b797e1db7bb7bf2ed9a1784632a8b
Author: Gary Yang 
Date:   Sat Jan 10 17:34:06 2026 +0800

    arm64: dts: cix: Add OrangePi 6 Plus board support
    
    OrangePi 6 Plus adopts CIX CD8180/CD8160 SoC, built-in 12-core 64-bit
    processor + NPU processor,integrated graphics processor, equipped with
    16GB/32GB/64GB LPDDR5, and provides two M.2 KEY-M interfaces 2280 for NVMe
    SSD,as well as SPI FLASH and TF slots to meet the needs of fast read/write
    and high-capacity storage
    
    Signed-off-by: Gary Yang 
    Link: https://lore.kernel.org/r/20260110093406.2700505-3-gary.yang@cixtech.com
    Signed-off-by: Peter Chen 

commit 01a08fd967301e75b2a9350b28a3f09fa2c3b838
Author: Gary Yang 
Date:   Sat Jan 10 17:34:05 2026 +0800

    dt-bindings: arm: cix: add OrangePi 6 Plus board
    
    OrangePi 6 Plus adopts CIX CD8180/CD8160 SoC, built-in 12-core 64-bit
    processor + NPU processor,integrated graphics processor, equipped with
    16GB/32GB/64GB LPDDR5, and provides two M.2 KEY-M interfaces 2280 for NVMe
    SSD,as well as SPI FLASH and TF slots to meet the needs of fast read/write
    and high-capacity storage
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Gary Yang 
    Link: https://lore.kernel.org/r/20260110093406.2700505-2-gary.yang@cixtech.com
    Signed-off-by: Peter Chen 

commit 5df832ba5f9ddc498e424ba859cb6ab7611b0384
Merge: bb8e2019ad613d ca22c566b89164
Author: Jens Axboe 
Date:   Sun Jan 11 13:16:36 2026 -0700

    Merge branch 'block-6.19' into for-7.0/block
    
    Merge in fixes that went to 6.19 after for-7.0/block was branched.
    Pending ublk changes depend on particularly the async scan work.
    
    * block-6.19:
      block: zero non-PI portion of auto integrity buffer
      ublk: fix use-after-free in ublk_partition_scan_work
      blk-mq: avoid stall during boot due to synchronize_rcu_expedited
      loop: add missing bd_abort_claiming in loop_set_status
      block: don't merge bios with different app_tags
      blk-rq-qos: Remove unlikely() hints from QoS checks
      loop: don't change loop device under exclusive opener in loop_set_status
      block, bfq: update outdated comment
      blk-mq: skip CPU offline notify on unmapped hctx
      selftests/ublk: fix Makefile to rebuild on header changes
      selftests/ublk: add test for async partition scan
      ublk: scan partition in async way
      block,bfq: fix aux stat accumulation destination
      md: Fix forward incompatibility from configurable logical block size
      md: Fix logical_block_size configuration being overwritten
      md: suspend array while updating raid_disks via sysfs
      md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()
      md: Fix static checker warning in analyze_sbs

commit bb8e2019ad613dd023a59bf91d1768018d17e09b
Author: Christoph Hellwig 
Date:   Fri Jan 9 07:07:49 2026 +0100

    blk-crypto: handle the fallback above the block layer
    
    Add a blk_crypto_submit_bio helper that either submits the bio when
    it is not encrypted or inline encryption is provided, but otherwise
    handles the encryption before going down into the low-level driver.
    This reduces the risk from bio reordering and keeps memory allocation
    as high up in the stack as possible.
    
    Note that if the submitter knows that inline enctryption is known to
    be supported by the underyling driver, it can still use plain
    submit_bio.
    
    Signed-off-by: Christoph Hellwig 
    Reviewed-by: Eric Biggers 
    Signed-off-by: Jens Axboe 

commit 66e5a11d2ed6d58006d5cd8276de28751daaa230
Author: Christoph Hellwig 
Date:   Fri Jan 9 07:07:48 2026 +0100

    blk-crypto: optimize data unit alignment checking
    
    Avoid the relatively high overhead of constructing and walking per-page
    segment bio_vecs for data unit alignment checking by merging the checks
    into existing loops.
    
    For hardware support crypto, perform the check in bio_split_io_at, which
    already contains a similar alignment check applied for all I/O.  This
    means bio-based drivers that do not call bio_split_to_limits, should they
    ever grow blk-crypto support, need to implement the check themselves,
    just like all other queue limits checks.
    
    For blk-crypto-fallback do it in the encryption/decryption loops.  This
    means alignment errors for decryption will only be detected after I/O
    has completed, but that seems like a worthwhile trade off.
    
    Signed-off-by: Christoph Hellwig 
    Reviewed-by: Eric Biggers 
    Signed-off-by: Jens Axboe 

commit 3d939695e68218d420be2b5dbb2fa39ccb7e97ed
Author: Christoph Hellwig 
Date:   Fri Jan 9 07:07:47 2026 +0100

    blk-crypto: use mempool_alloc_bulk for encrypted bio page allocation
    
    Calling mempool_alloc in a loop is not safe unless the maximum allocation
    size times the maximum number of threads using it is less than the
    minimum pool size.  Use the new mempool_alloc_bulk helper to allocate
    all missing elements in one pass to remove this deadlock risk.  This
    also means that non-pool allocations now use alloc_pages_bulk which can
    be significantly faster than a loop over individual page allocations.
    
    Signed-off-by: Christoph Hellwig 
    Reviewed-by: Eric Biggers 
    Signed-off-by: Jens Axboe 

commit 2f655dcb2d925b55deb8c1ec8f42b522c6bc5698
Author: Christoph Hellwig 
Date:   Fri Jan 9 07:07:46 2026 +0100

    blk-crypto: use on-stack skcipher requests for fallback en/decryption
    
    Allocating a skcipher request dynamically can deadlock or cause
    unexpected I/O failures when called from writeback context.  Avoid the
    allocation entirely by using on-stack skciphers, similar to what the
    non-blk-crypto fscrypt path already does.
    
    This drops the incomplete support for asynchronous algorithms, which
    previously could be used, but only synchronously.
    
    Signed-off-by: Christoph Hellwig 
    Reviewed-by: Eric Biggers 
    Signed-off-by: Jens Axboe 

commit b37fbce460ad60b0c4449c1c7566cf24f3016713
Author: Christoph Hellwig 
Date:   Fri Jan 9 07:07:45 2026 +0100

    blk-crypto: optimize bio splitting in blk_crypto_fallback_encrypt_bio
    
    The current code in blk_crypto_fallback_encrypt_bio is inefficient and
    prone to deadlocks under memory pressure: It first walks the passed in
    plaintext bio to see how much of it can fit into a single encrypted
    bio using up to BIO_MAX_VEC PAGE_SIZE segments, and then allocates a
    plaintext clone that fits the size, only to allocate another bio for
    the ciphertext later.  While the plaintext clone uses a bioset to avoid
    deadlocks when allocations could fail, the ciphertex one uses bio_kmalloc
    which is a no-go in the file system I/O path.
    
    Switch blk_crypto_fallback_encrypt_bio to walk the source plaintext bio
    while consuming bi_iter without cloning it, and instead allocate a
    ciphertext bio at the beginning and whenever we fille up the previous
    one.  The existing bio_set for the plaintext clones is reused for the
    ciphertext bios to remove the deadlock risk.
    
    Signed-off-by: Christoph Hellwig 
    Reviewed-by: Eric Biggers 
    Signed-off-by: Jens Axboe 

commit aefc2a1fa2edc2a486aaf857e48b3fd13062b0eb
Author: Christoph Hellwig 
Date:   Fri Jan 9 07:07:44 2026 +0100

    blk-crypto: submit the encrypted bio in blk_crypto_fallback_bio_prep
    
    Restructure blk_crypto_fallback_bio_prep so that it always submits the
    encrypted bio instead of passing it back to the caller, which allows
    to simplify the calling conventions for blk_crypto_fallback_bio_prep and
    blk_crypto_bio_prep so that they never have to return a bio, and can
    use a true return value to indicate that the caller should submit the
    bio, and false that the blk-crypto code consumed it.
    
    The submission is handled by the on-stack bio list in the current
    task_struct by the block layer and does not cause additional stack
    usage or major overhead.  It also prepares for the following optimization
    and fixes for the blk-crypto fallback write path.
    
    Signed-off-by: Christoph Hellwig 
    Reviewed-by: Eric Biggers 
    Signed-off-by: Jens Axboe 

commit a3cc978e61f5c909ca94a38d2daeeddc051a18e0
Author: Christoph Hellwig 
Date:   Fri Jan 9 07:07:43 2026 +0100

    blk-crypto: add a bio_crypt_ctx() helper
    
    This returns the bio_crypt_ctx if CONFIG_BLK_INLINE_ENCRYPTION is enabled
    and a crypto context is attached to the bio, else NULL.
    
    The use case is to allow safely dereferencing the context in common code
    without needed #ifdef CONFIG_BLK_INLINE_ENCRYPTION.
    
    Signed-off-by: Christoph Hellwig 
    Reviewed-by: Eric Biggers 
    Signed-off-by: Jens Axboe 

commit bc26e2efa2c5bb9289fa894834446840dea0bc31
Author: Christoph Hellwig 
Date:   Fri Jan 9 07:07:42 2026 +0100

    fscrypt: keep multiple bios in flight in fscrypt_zeroout_range_inline_crypt
    
    This should slightly improve performance for large zeroing operations,
    but more importantly prepares for blk-crypto refactoring that requires
    all fscrypt users to call submit_bio directly.
    
    Signed-off-by: Christoph Hellwig 
    Reviewed-by: Eric Biggers 
    Signed-off-by: Jens Axboe 

commit c22756a9978e8f5917ff41cf17fc8db00d09e776
Author: Christoph Hellwig 
Date:   Fri Jan 9 07:07:41 2026 +0100

    fscrypt: pass a real sector_t to fscrypt_zeroout_range_inline_crypt
    
    While the pblk argument to fscrypt_zeroout_range_inline_crypt is
    declared as a sector_t it actually is interpreted as a logical block
    size unit, which is highly unusual.  Switch to passing the 512 byte
    units that sector_t is defined for.
    
    Signed-off-by: Christoph Hellwig 
    Reviewed-by: Eric Biggers 
    Signed-off-by: Jens Axboe 

commit f7e0867561f0d17630608f57512fbb8da155e1e2
Author: Romain Gantois 
Date:   Tue Dec 9 09:25:55 2025 +0100

    iio: dac: ds4424: drop unused include IIO consumer header
    
    To prepare for the introduction of namespaced exports for the IIO consumer
    API, remove this include directive which isn't actually used by the driver.
    
    Signed-off-by: Romain Gantois 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit e0bc6d7e258486c10bb11e31fd4421c134063b1d
Author: Marcelo Schmitt 
Date:   Wed Jan 7 11:47:59 2026 -0300

    iio: adc: Initial support for AD4134
    
    AD4134 is a 24-bit, 4-channel, simultaneous sampling, precision
    analog-to-digital converter (ADC). The device can be managed through SPI or
    direct control of pin logical levels (pin control mode). The AD4134 design
    also features a dedicated bus for ADC sample data output. Though, this
    initial driver for AD4134 only supports usual SPI connections.
    
    Add basic support for AD4134 that enables single-shot ADC sample read.
    
    Signed-off-by: Marcelo Schmitt 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 8b59bcf8d5cacbd0688ccdb87616704c04ae6ee3
Author: Marcelo Schmitt 
Date:   Wed Jan 7 11:47:37 2026 -0300

    dt-bindings: iio: adc: Add AD4134
    
    Add device tree documentation for AD4134 24-Bit, 4-channel simultaneous
    sampling, precision ADC.
    
    Reviewed-by: Conor Dooley 
    Signed-off-by: Marcelo Schmitt 
    Signed-off-by: Jonathan Cameron 

commit b8d1936d052cf932b5cb4e44e79e864cbd9e9941
Author: Chen Ni 
Date:   Wed Jan 7 16:29:20 2026 +0800

    iio: adc: ad7476: Remove duplicate include
    
    Remove duplicate inclusion of linux/bitops.h.
    
    Signed-off-by: Chen Ni 
    Reviewed-by: Matti Vaittinen 
    Signed-off-by: Jonathan Cameron 

commit b96261d7be11f5a92998f5a5952d625d9f3ca6d6
Author: Kurt Borja 
Date:   Tue Jan 6 03:17:32 2026 -0500

    iio: adc: ti-ads1018: Drop stale kernel-doc function context
    
    The driver no longer uses iio_device_claim_buffer_mode(). Drop it from
    ads1018_spi_read_exclusive() context remark.
    
    Signed-off-by: Kurt Borja 
    Signed-off-by: Jonathan Cameron 

commit f69b5ac682dbc61e6aca806c22ce2ae74d598e45
Author: Derek J. Clark 
Date:   Tue Jan 6 05:45:19 2026 +0000

    iio: bmi270_i2c: Add MODULE_DEVICE_TABLE for BMI260/270
    
    Currently BMI260 & BMI270 devices do not automatically load this
    driver. To fix this, add missing MODULE_DEVICE_TABLE for the i2c,
    acpi, and of device tables so the driver will load when the hardware
    is detected.
    
    Tested on my OneXPlayer F1 Pro.
    
    Signed-off-by: Derek J. Clark 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit c84cde33b00451c7380482d19feef67d04deae7d
Author: Michael Harris 
Date:   Tue Jan 6 06:50:55 2026 -0800

    staging: iio: adt7316: modernize power management
    
    Replaced use of deprecated function SIMPLE_DEV_PM_OPS() with
    EXPORT_GPL_SIMPLE_DEV_PM_OPS().
    
    Removed PM preprocessor conditions with usage of pm_sleep_ptr().
    
    Signed-off-by: Michael Harris 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit efcffd9a6ad8d190651498d5eda53bfc7cf683a7
Author: Chaitanya Mishra 
Date:   Thu Jan 8 20:42:54 2026 +0530

    staging: greybus: lights: avoid NULL deref
    
    gb_lights_light_config() stores channel_count before allocating the
    channels array. If kcalloc() fails, gb_lights_release() iterates the
    non-zero count and dereferences light->channels, which is NULL.
    
    Allocate channels first and only then publish channels_count so the
    cleanup path can't walk a NULL pointer.
    
    Fixes: 2870b52bae4c ("greybus: lights: add lights implementation")
    Link: https://lore.kernel.org/all/20260108103700.15384-1-chaitanyamishra.ai@gmail.com/
    Reviewed-by: Rui Miguel Silva 
    Signed-off-by: Chaitanya Mishra 
    Link: https://patch.msgid.link/20260108151254.81553-1-chaitanyamishra.ai@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 36a795e7eed3a8ba7afcb8eed248efb5e0962697
Author: Philip Thayer 
Date:   Mon Jan 5 14:42:27 2026 -0500

    staging: rtl8723bs: fix spacing around arithmetic operators
    
    Fixed coding style checks where spaces were missing around subtraction
    and addition operators in rtw_cmd.c.
    
    This aligns with the Linux Kernel coding style standards.
    
    Signed-off-by: Philip Thayer 
    Link: https://patch.msgid.link/20260105194226.57035-2-thayerscirez@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 230f72823f8ed7e6192b289ab4bc7496f11c8972
Author: Holden Hsu 
Date:   Mon Jan 5 02:45:05 2026 -0800

    staging: greybus: arche-platform: fix spelling mistake in comment
    
    Fix 'premits' -> 'permits' in a comment to improve code readability.
    
    Signed-off-by: Holden Hsu 
    Link: https://patch.msgid.link/20260105104505.8120-3-holden_hsu@163.com
    Signed-off-by: Greg Kroah-Hartman 

commit c6ca88ba429de1a157c0985555618eec921425c6
Author: Holden Hsu 
Date:   Mon Jan 5 02:45:04 2026 -0800

    staging: greybus: arche-platform: clarify TODO comment
    
    The TODO comment 'sequence ??' is unclear and provides little context
    about what needs to be implemented. Replace it with 'TODO: define shutdown
    sequence' to better describe the required implementation.
    
    Signed-off-by: Holden Hsu 
    Link: https://patch.msgid.link/20260105104505.8120-2-holden_hsu@163.com
    Signed-off-by: Greg Kroah-Hartman 

commit 80fd2297d72adaf89ce661c702d0965a364c537b
Author: Ovidiu Panait 
Date:   Sat Dec 27 23:26:40 2025 +0200

    staging: axis-fifo: Clean up register and mask definitions
    
    Improve readability and consistency of hardware register definitions:
    - Remove unnecessary leading zeros from register offset values
    - Use BIT() macro for single-bit interrupt mask definitions
    - Align values and comments for better readability
    
    No functional change.
    
    Signed-off-by: Ovidiu Panait 
    Link: https://patch.msgid.link/20251227212640.3321310-9-ovidiu.panait.oss@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 02b2a366a64f22cc367911d479297772d6269200
Author: Ovidiu Panait 
Date:   Sat Dec 27 23:26:39 2025 +0200

    staging: axis-fifo: Remove redundant comments
    
    Drop banner-style section header comments and also remove comments
    around self-explanatory code to reduce clutter and improve
    readability.
    
    No functional changes.
    
    Signed-off-by: Ovidiu Panait 
    Link: https://patch.msgid.link/20251227212640.3321310-8-ovidiu.panait.oss@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 04efe3aa5fa0f81fe38a0ff8e03c0d5bdfcbad5f
Author: Ovidiu Panait 
Date:   Sat Dec 27 23:26:38 2025 +0200

    staging: axis-fifo: Remove noisy error messages for user errors
    
    Remove dev_err() calls for conditions caused by invalid userspace
    input. Logging them clutters the kernel log, especially if userspace
    repeatedly makes invalid calls.
    
    Also, consolidate the write validation checks into a single condition.
    
    Signed-off-by: Ovidiu Panait 
    Link: https://patch.msgid.link/20251227212640.3321310-7-ovidiu.panait.oss@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit ab517a047b4ef6b62e4ddabfdd3549f19e4bc4c9
Author: Ovidiu Panait 
Date:   Sat Dec 27 23:26:37 2025 +0200

    staging: axis-fifo: Remove unnecessary zero-length packet check
    
    Remove the check for zero-length packets as this condition cannot
    occur during normal operation. According to the Xilinx AXI4-Stream
    FIFO Product Guide (PG080), in the Receive Length Register (RLR)
    description: "The smallest packet that can be received is 1 byte."
    
    A zero-length packet would indicate a bug in the IP core itself.
    
    Signed-off-by: Ovidiu Panait 
    Link: https://patch.msgid.link/20251227212640.3321310-6-ovidiu.panait.oss@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit eb757312ac1743e9b54b070f6cdc4b32bbe0c8ef
Author: Ovidiu Panait 
Date:   Sat Dec 27 23:26:36 2025 +0200

    staging: axis-fifo: Remove unnecessary casts from file->private_data
    
    Drop explicit casts when accessing file->private_data in the read() and
    write() paths, as they are not needed.
    
    Signed-off-by: Ovidiu Panait 
    Link: https://patch.msgid.link/20251227212640.3321310-5-ovidiu.panait.oss@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit d1a3cfec3aba1d59090486a4fb2572040aa07d3e
Author: Ovidiu Panait 
Date:   Sat Dec 27 23:26:35 2025 +0200

    staging: axis-fifo: Drop unneeded release callback
    
    The release function only clears file->private_data, which is not
    needed. Remove the callback.
    
    Signed-off-by: Ovidiu Panait 
    Link: https://patch.msgid.link/20251227212640.3321310-4-ovidiu.panait.oss@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit eb12093d42bae0522c3358cdae44319f9ada1b56
Author: Ovidiu Panait 
Date:   Sat Dec 27 23:26:34 2025 +0200

    staging: axis-fifo: Use devm_kasprintf for device name allocation
    
    Replace manual kzalloc + snprintf with devm_kasprintf, which is
    cleaner and purpose-built for this use case.
    
    Signed-off-by: Ovidiu Panait 
    Link: https://patch.msgid.link/20251227212640.3321310-3-ovidiu.panait.oss@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit c83d8445f3b6272f712494e0ab2124c000903811
Author: Ovidiu Panait 
Date:   Sat Dec 27 23:26:33 2025 +0200

    staging: axis-fifo: Add poll() support
    
    Implement poll() file operation to allow userspace applications to
    wait for FIFO readiness using select()/poll()/epoll().
    
    This replaces the module parameter-based timeouts removed in the
    previous commit.
    
    Signed-off-by: Ovidiu Panait 
    Link: https://patch.msgid.link/20251227212640.3321310-2-ovidiu.panait.oss@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 87d653a894a43adaf74637f175e86df79b399be4
Author: Ovidiu Panait 
Date:   Sat Dec 27 23:26:32 2025 +0200

    staging: axis-fifo: Remove read/write timeout module parameters
    
    Module parameters for timeouts are a poor interface choice as they
    affect all device instances globally rather than being configurable
    per file descriptor.
    
    The current implementation also returns -EAGAIN on timeout, requiring
    userspace to implement retry loops around blocking operations.
    
    Remove the read_timeout and write_timeout module parameters. The next
    commit adds poll() support, allowing applications to implement timeout
    handling using standard poll()/select() interfaces.
    
    Signed-off-by: Ovidiu Panait 
    Link: https://patch.msgid.link/20251227212640.3321310-1-ovidiu.panait.oss@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit d78870274b497cf0dd4836d8effce8dcf0a0e12d
Author: Akiyoshi Kurita 
Date:   Sat Jan 3 21:08:24 2026 +0900

    staging: sm750fb: fix typo 'resetted' -> 'reset'
    
    Fix a typo in a comment.
    
    Signed-off-by: Akiyoshi Kurita 
    Link: https://patch.msgid.link/20260103120824.1275574-1-weibu@redadmin.org
    Signed-off-by: Greg Kroah-Hartman 

commit db9b736bce3dd897fe4602c8279f9811112fd82a
Author: Marc Dietrich 
Date:   Sat Jan 3 11:14:39 2026 +0100

    staging: nvec: apply udelay only after the first byte has been sent
    
    Due to a HW bug in the Tegra20 SoC a udelay needs to be added after
    the first byte has been sent to the EC (I2C master). Move it to the
    correct position and add a comment that it should not be replaced by
    usleep_range.
    
    Signed-off-by: Marc Dietrich 
    Link: https://patch.msgid.link/20260103101439.14863-1-marvin24@gmx.de
    Signed-off-by: Greg Kroah-Hartman 

commit 42d8dc5a9d85c28ca3b5d3b239f211c92aa2996c
Author: Diksha Kumari 
Date:   Fri Jan 2 00:01:24 2026 +0530

    staging: rtl8723bs: fix spacing around operators
    
    Fix missing spaces around arithmetic operators to address coding
    style issues reported by checkpatch.pl.
    
    Signed-off-by: Diksha Kumari 
    Link: https://patch.msgid.link/20260101183124.10322-1-dikshakdevgan@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 69dc48dc550640b1c33e30f32620fe5ef1b068e9
Author: Minu Jin 
Date:   Sun Dec 28 23:58:23 2025 +0900

    staging: rtl8723bs: use PTR_ALIGN for buffer alignment
    
    Replace manual pointer alignment calculation with the standard PTR_ALIGN
    macro in rtw_init_cmd_priv()
    
    This improves code readability and ensures the use of kernel's
    preferred alignment mechanism instead of manual calculation
    
    Signed-off-by: Minu Jin 
    Link: https://patch.msgid.link/20251228145823.3250174-1-s9430939@naver.com
    Signed-off-by: Greg Kroah-Hartman 

commit 2e2d0c710cc18dd38521d6b127708b210ecd2e12
Author: Ofir Mirovsky 
Date:   Sun Dec 28 01:45:50 2025 +0200

    staging: rtl8723bs: remove unnecessary blank lines
    
    Remove unnecessary blank lines to fix checkpatch checks:
    - "Blank lines aren't necessary before a close brace '}'"
    - "Blank lines aren't necessary after an open brace '{'"
    
    This improves code readability and adheres to the kernel coding style.
    
    Signed-off-by: Ofir Mirovsky 
    Link: https://patch.msgid.link/20251227234550.3034-1-ofirmirovsky@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 44b225bf0738e7b0644be1cc638871e930ffe1e5
Author: Karthikey D Kadati 
Date:   Sat Dec 27 17:03:48 2025 +0530

    staging: rtl8723bs: fix missing transmission lock in rtw_xmit
    
    The packet transmission path in rtw_xmit.c contained TODO comments
    indicating a missing lock. This patch implements spin_lock_bh and
    spin_unlock_bh around the station attribute update section.
    
    This prevents a potential race condition where station security and
    PHY information could be modified on another CPU core during
    transmission. The use of _bh variants ensures safety in bottom-half
    contexts common in network transmit paths.
    
    Verified that psta is NULL-checked prior to acquisition and that no
    double-unlocks occur on the exit path.
    
    Signed-off-by: Karthikey D Kadati 
    Link: https://patch.msgid.link/20251227113348.26272-1-karthikey3608@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 20530f561a7bc481889f4ab4f8ee218efcdfb072
Author: Sun Jian 
Date:   Fri Dec 26 17:43:49 2025 +0800

    staging: rtl8723bs: fix missing blank line warning
    
    Fix the following checkpatch warning:
    
      WARNING: Missing a blank line after declarations
    
    This adds a blank line between the variable declaration and
    the code logic to improve readability and adhere to the
    kernel coding style.
    
    Signed-off-by: Sun Jian 
    Link: https://patch.msgid.link/20251226094349.156538-1-sun.jian.kdev@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 0cbf955a296657a874da94e1d19b05f4ca4987c9
Author: Yuvraj Singh Chauhan 
Date:   Fri Dec 26 07:00:35 2025 +0530

    staging: rtl8723bs: Remove redundant MAC_ARG macro
    
    The MAC_ARG(x) macro is a useless identity macro that just returns its
    argument unchanged. It was used alongside the %pM format specifier for
    printing MAC addresses, but %pM already handles MAC address formatting
    directly without needing any wrapper macro.
    
    This commit removes the macro definition from both:
    
    include/osdep_service.h
    include/ieee80211.h
    
    And removes all 6 usages throughout the driver
    
    Signed-off-by: Yuvraj Singh Chauhan 
    Link: https://patch.msgid.link/20251226013035.206284-1-ysinghcin@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit cf0f2680c30d4b438a5e84b73dc70be405936b54
Author: William Hansen-Baird 
Date:   Wed Dec 24 05:02:56 2025 -0500

    staging: rtl8723bs: core: move constants to right side in comparison
    
    Move constants to right side in if-statement conditions.
    
    Signed-off-by: William Hansen-Baird 
    Link: https://patch.msgid.link/20251224100329.762141-3-william.hansen.baird@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 09a9c4bde41c09f930fb2c5c437ba55eb513d058
Author: William Hansen-Baird 
Date:   Wed Dec 24 05:02:55 2025 -0500

    staging: rtl8723bs: core: remove unnecessary else-statements
    
    Remove else statements where the preceding if-statement returns or breaks.
    
    In rtw_mlme.c the if either continues or breaks.
    The else-if always breaks, so the else is useless.
    
    Signed-off-by: William Hansen-Baird 
    Link: https://patch.msgid.link/20251224100329.762141-2-william.hansen.baird@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit f8a916c8ca0ed584ddc7c07e3a80fe92efce35db
Author: William Hansen-Baird 
Date:   Wed Dec 24 05:02:54 2025 -0500

    staging: rtl8723bs: core: remove empty if-statements
    
    This patch removes if-statements with no body in rtw_recv.c and rtw_xmit.c.
    If-statement conditions have no side-effect and can be safely removed.
    
    Signed-off-by: William Hansen-Baird 
    Link: https://patch.msgid.link/20251224100329.762141-1-william.hansen.baird@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 780f18732a96e3be470bab01c214b42b2202319c
Author: Jennifer Guo 
Date:   Tue Dec 23 10:49:43 2025 -0800

    staging: rtl8723bs: fix block comment whitespace
    
    Add leading whitespace to block comments in
    HalHWImg8723B_BB.h to fix a checkpatch warning.
    
    Signed-off-by: Jennifer Guo 
    Link: https://patch.msgid.link/20251223184943.83688-1-guojy.bj@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit d9c2a003912044b8adb695223c2a8ceb3b0bdf2d
Author: Rupesh Majhi 
Date:   Mon Dec 22 23:35:56 2025 +0200

    staging: rtl8723bs: rename shortGIrate to short_gi_rate
    
    Rename the CamelCase variable 'shortGIrate' to 'short_gi_rate'
    to comply with Linux kernel coding sytle guidelines.
    
    Issue found by checkpatch.
    
    Signed-off-by: Rupesh Majhi 
    Link: https://patch.msgid.link/20251222213556.36070-1-zoone.rupert@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 4c1ee347f8b77b9815a020821e6162fbb4fdeef6
Author: William Hansen-Baird 
Date:   Mon Dec 22 16:28:50 2025 -0500

    staging/sm750fb: remove outdated TODO lines
    
    The TODO lines about "checkpatch cleanup" and "kernel coding style"
    are no longer needed as all files conform to the kernel coding style,
    as verified with checkpatch.pl
    
    Note: checkpatch reports a false positive WARNING for sm750.c line 36
    about missing const in static const char *g_fbmode[].
    checkpatch suggests static const char * const g_fbmode[].
    This was intentional, as the array is modified throughout the code,
    while the inner strings remain unchanged.
    
    Signed-off-by: William Hansen-Baird 
    Link: https://patch.msgid.link/20251222212849.555571-2-william.hansen.baird@icloud.com
    Signed-off-by: Greg Kroah-Hartman 

commit e3d723f70b32c9d748610c0b483fbcdf915d73ac
Author: Zhan Xusheng 
Date:   Mon Dec 22 23:24:31 2025 +0800

    staging: greybus: gb-camera: fix configure_streams indentation
    
    Adjust the indentation of gb_camera_ops->configure_streams
    parameters to match kernel coding style.
    
    Signed-off-by: Zhan Xusheng 
    Link: https://patch.msgid.link/20251222152432.68555-3-zhanxusheng@xiaomi.com
    Signed-off-by: Greg Kroah-Hartman 

commit 81a4ecb9faabe843f4152e2ff209daa52dda88c8
Author: Zhan Xusheng 
Date:   Mon Dec 22 23:24:30 2025 +0800

    staging: greybus: gb-camera: use BIT() macro for flags
    
    Replace (1 << 0) with the BIT(0) macro for input/output flags
    to follow Linux kernel coding style.
    
    Signed-off-by: Zhan Xusheng 
    Link: https://patch.msgid.link/20251222152432.68555-2-zhanxusheng@xiaomi.com
    Signed-off-by: Greg Kroah-Hartman 

commit e6900ce28cd312f8872ed3794b3e5e12fe911ecd
Author: Rupesh Majhi 
Date:   Mon Dec 22 15:24:30 2025 +0200

    staging: rtl8723bs: rename shortGIrate to short_gi_rate
    
    Rename the CamelCase variable 'shortGIrate' to 'short_gi_rate'
    to comply with Linux kernel coding style guidelines.
    
    Signed-off-by: Rupesh Majhi 
    Link: https://patch.msgid.link/20251222132430.24491-1-zoone.rupert@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit a750088883da1d21502d26bf5852a0d49efb1604
Author: Shrikant Raskar 
Date:   Thu Jan 1 21:47:39 2026 +0530

    iio: proximity: rfd77402: Add OF device ID for enumeration via DT
    
    Add an OF device ID table so the driver can bind automatically when
    the RFD77402 sensor is described in Device Tree. This enables proper
    enumeration via its compatible string and allows instantiation on
    DT-based platforms.
    
    Signed-off-by: Shrikant Raskar 
    Signed-off-by: Jonathan Cameron 

commit e4d0e63e2442de43421a5e8ace8eb36b997345b9
Author: Shrikant Raskar 
Date:   Thu Jan 1 21:47:38 2026 +0530

    dt-bindings: iio: proximity: Add RF Digital RFD77402 ToF sensor
    
    The RF Digital RFD77402 is a Time-of-Flight (ToF) proximity and distance
    sensor that provides absolute and highly accurate distance measurements
    from 100 mm up to 2000 mm over an I2C interface. It includes an optional
    interrupt pin that signals when new measurement data is ready.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Shrikant Raskar 
    Signed-off-by: Jonathan Cameron 

commit b92489be8048b236e1f44e3b1c7100f4296859e7
Author: Jose Javier Rodriguez Barbarin 
Date:   Thu Jan 8 14:53:01 2026 +0100

    iio: adc: men_z188_adc: drop unneeded MODULE_ALIAS
    
    Since commit 1f4ea4838b13 ("mcb: Add missing modpost build support")
    the MODULE_ALIAS() is redundant as the module alias is now
    automatically generated from the MODULE_DEVICE_TABLE().
    
    Remove the explicit alias.
    
    No functional change intended.
    
    Reviewed-by: Jorge Sanjuan Garcia 
    Signed-off-by: Jose Javier Rodriguez Barbarin 
    Signed-off-by: Jonathan Cameron 

commit fe1d4828846f025e42ca5e2112c01084c8aa8ab2
Merge: acb0b2f5d6472b bc3705e2098877
Author: Boqun Feng 
Date:   Sun Jan 11 20:15:07 2026 +0800

    Merge branch 'rcu-misc.20260111a'
    
    * rcu-misc.20260111a:
      rcu: Reduce synchronize_rcu() latency by reporting GP kthread's CPU QS early
      srcu: Use suitable gfp_flags for the init_srcu_struct_nodes()
      rcu: Fix rcu_read_unlock() deadloop due to softirq
      rcutorture: Correctly compute probability to invoke ->exp_current()
      rcu: Make expedited RCU CPU stall warnings detect stall-end races

commit bc3705e20988778791a4a5e9e2700fbc22cc942d
Author: Joel Fernandes 
Date:   Thu Jan 1 11:34:15 2026 -0500

    rcu: Reduce synchronize_rcu() latency by reporting GP kthread's CPU QS early
    
    The RCU grace period mechanism uses a two-phase FQS (Force Quiescent
    State) design where the first FQS saves dyntick-idle snapshots and
    the second FQS compares them. This results in long and unnecessary latency
    for synchronize_rcu() on idle systems (two FQS waits of ~3ms each with
    1000HZ) whenever one FQS wait sufficed.
    
    Some investigations showed that the GP kthread's CPU is the holdout CPU
    a lot of times after the first FQS as - it cannot be detected as "idle"
    because it's actively running the FQS scan in the GP kthread.
    
    Therefore, at the end of rcu_gp_init(), immediately report a quiescent
    state for the GP kthread's CPU using rcu_qs() + rcu_report_qs_rdp(). The
    GP kthread cannot be in an RCU read-side critical section while running
    GP initialization, so this is safe and results in significant latency
    improvements.
    
    The following tests were performed:
    
    (1) synchronize_rcu() benchmarking
    
        100 synchronize_rcu() calls with 32 CPUs, 10 runs each (default fqs
        jiffies settings):
    
        Baseline (without fix):
        | Run | Mean      | Min      | Max       |
        |-----|-----------|----------|-----------|
        | 1   | 10.088 ms | 9.989 ms | 18.848 ms |
        | 2   | 10.064 ms | 9.982 ms | 16.470 ms |
        | 3   | 10.051 ms | 9.988 ms | 15.113 ms |
        | 4   | 10.125 ms | 9.929 ms | 22.411 ms |
        | 5   |  8.695 ms | 5.996 ms | 15.471 ms |
        | 6   | 10.157 ms | 9.977 ms | 25.723 ms |
        | 7   | 10.102 ms | 9.990 ms | 20.224 ms |
        | 8   |  8.050 ms | 5.985 ms | 10.007 ms |
        | 9   | 10.059 ms | 9.978 ms | 15.934 ms |
        | 10  | 10.077 ms | 9.984 ms | 17.703 ms |
    
        With fix:
        | Run | Mean     | Min      | Max       |
        |-----|----------|----------|-----------|
        | 1   | 6.027 ms | 5.915 ms |  8.589 ms |
        | 2   | 6.032 ms | 5.984 ms |  9.241 ms |
        | 3   | 6.010 ms | 5.986 ms |  7.004 ms |
        | 4   | 6.076 ms | 5.993 ms | 10.001 ms |
        | 5   | 6.084 ms | 5.893 ms | 10.250 ms |
        | 6   | 6.034 ms | 5.908 ms |  9.456 ms |
        | 7   | 6.051 ms | 5.993 ms | 10.000 ms |
        | 8   | 6.057 ms | 5.941 ms | 10.001 ms |
        | 9   | 6.016 ms | 5.927 ms |  7.540 ms |
        | 10  | 6.036 ms | 5.993 ms |  9.579 ms |
    
        Summary:
        - Mean latency: 9.75 ms -> 6.04 ms (38% improvement)
        - Max latency:  25.72 ms -> 10.25 ms (60% improvement)
    
    (2) Bridge setup/teardown latency (Uladzislau Rezki)
    
        x86_64 with 64 CPUs, 100 iterations of bridge add/configure/delete:
    
                                       real time
        1 - default:                   24.221s
        2 - this patch:                20.754s  (14% faster)
        3 - this patch + wake_from_gp: 15.895s  (34% faster)
        4 - wake_from_gp only:         18.947s  (22% faster)
    
        Per-synchronize_rcu() latency (in usec):
                      1         2         3       4
        median: 37249.5   31540.5   15765   22480
        min:    7881      7918      9803    7857
        max:    63651     55639     31861   32040
    
        This patch combined with rcu_normal_wake_from_gp reduces bridge
        setup/teardown time from 24 seconds to 16 seconds.
    
    (3) CPU overhead verification (Uladzislau Rezki)
    
        System CPU time across 5 runs showed no measurable increase:
          default:     1.698s - 1.937s
          this patch:  1.667s - 1.930s
        Conclusion: variations are within noise, no CPU overhead regression.
    
    (4) rcutorture
    
        Tested TREE and SRCU configurations - no regressions.
    
    Reviewed-by: "Paul E. McKenney" 
    Tested-by: Uladzislau Rezki (Sony) 
    Tested-by: Paul E. McKenney 
    Tested-by: Samir M 
    Signed-off-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit a5f00be9b3b07d92c6689997403851a32e1874cc
Author: Daniel Palmer 
Date:   Mon Jan 5 11:36:29 2026 +0900

    tools/nolibc: Add a simple test for writing to a FILE and reading it back
    
    Add a test that exercises create->write->seek->read to check that using the
    stream functions (fwrite() etc) is not totally broken.
    
    The only edge cases this is testing for are:
    - Reading the file after writing but without rewinding reads nothing.
    - Trying to read more items than the file contains returns the count of
      fully read items.
    
    Signed-off-by: Daniel Palmer 
    Link: https://patch.msgid.link/20260105023629.1502801-4-daniel@thingy.jp
    Signed-off-by: Thomas Weißschuh 

commit 109770cc81680b802ee983b09b61c3979240fd09
Author: Daniel Palmer 
Date:   Mon Jan 5 11:36:28 2026 +0900

    tools/nolibc: Add fseek() to stdio.h
    
    A very basic wrapper around lseek() that implements fseek().
    
    Signed-off-by: Daniel Palmer 
    Link: https://patch.msgid.link/20260105023629.1502801-3-daniel@thingy.jp
    Signed-off-by: Thomas Weißschuh 

commit edaf30743185f6ed8e29dcb2f1d01e183c0b807b
Author: Daniel Palmer 
Date:   Mon Jan 5 11:36:27 2026 +0900

    tools/nolibc: Add fread() to stdio.h
    
    Add a very basic version of fread() like we already have for fwrite().
    
    Signed-off-by: Daniel Palmer 
    Link: https://patch.msgid.link/20260105023629.1502801-2-daniel@thingy.jp
    Signed-off-by: Thomas Weißschuh 

commit 8c483209a6fc71a555fec4a0c99b05e46a5bd38c
Author: Alexandru Chimac 
Date:   Fri Jan 2 11:29:59 2026 +0000

    pinctrl: samsung: Add Exynos9610 pinctrl configuration
    
    Add pinctrl configuration for Exynos9610. The bank types used are the
    same as on Exynos850 and gs101, so we can reuse the macros.
    
    Signed-off-by: Alexandru Chimac 
    Link: https://patch.msgid.link/20260102-exynos9610-pinctrl-v3-3-3f21f2cfb651@chimac.ro
    Signed-off-by: Krzysztof Kozlowski 

commit 2efbc4cf874403e635234c0289eada12ca7e9c4c
Author: Alexandru Chimac 
Date:   Fri Jan 2 11:29:49 2026 +0000

    dt-bindings: pinctrl: samsung: Add exynos9610-wakeup-eint node
    
    Add a dedicated compatible for the exynos9610-wakeup-eint node, which is
    compatbile with Exynos850's implementation (and the Exynos7 fallback).
    
    Signed-off-by: Alexandru Chimac 
    Link: https://patch.msgid.link/20260102-exynos9610-pinctrl-v3-2-3f21f2cfb651@chimac.ro
    Signed-off-by: Krzysztof Kozlowski 

commit 4ab3ec8baa41cf503cd358e27696d68ace0902ba
Author: Alexandru Chimac 
Date:   Fri Jan 2 11:29:40 2026 +0000

    dt-bindings: pinctrl: samsung: Add exynos9610-pinctrl compatible
    
    Document pin controller support on Exynos9610-series SoCs.
    
    Signed-off-by: Alexandru Chimac 
    Link: https://patch.msgid.link/20260102-exynos9610-pinctrl-v3-1-3f21f2cfb651@chimac.ro
    Signed-off-by: Krzysztof Kozlowski 

commit 6fe8360b16acbfb50c703f52568cad46759be2ed
Author: Thomas Weißschuh 
Date:   Tue Jan 6 12:44:59 2026 +0100

    selftests/nolibc: also test libc-test through regular selftest framework
    
    Hook up libc-test to the regular selftest build to make sure
    nolibc-test.c stays compatible with a normal libc.
    
    As the pattern rule from lib.mk does not handle compiling a target from
    a differently named source file, add an explicit rule definition.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Link: https://patch.msgid.link/20260106-nolibc-selftests-v1-3-f82101c2c505@weissschuh.net

commit 20c72de1f8a9e338531579bd784371aba4b7dd2c
Author: Thomas Weißschuh 
Date:   Tue Jan 6 12:44:58 2026 +0100

    selftests/nolibc: scope custom flags to the nolibc-test target
    
    A new target for 'libc-test' is going to be added which should not be
    affected by these options.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Link: https://patch.msgid.link/20260106-nolibc-selftests-v1-2-f82101c2c505@weissschuh.net

commit 4203c6fb5e9d2e4fb9a48b421d92efd4429a4d55
Author: Thomas Weißschuh 
Date:   Tue Jan 6 12:44:57 2026 +0100

    selftests/nolibc: try to read from stdin in readv_zero test
    
    When stdout is redirected to a file this test fails.
    This happens when running through the kselftest runner since
    commit d9e6269e3303 ("selftests/run_kselftest.sh: exit with
    error if tests fail").
    
    For consistency with other tests that read from a file descriptor,
    switch to stdin over stdout. The tests are still brittle against
    a redirected stdin, but at least they are now consistently so.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Link: https://patch.msgid.link/20260106-nolibc-selftests-v1-1-f82101c2c505@weissschuh.net

commit 60d8484c4cec811f5ceb6550655df74490d1a165
Merge: 7a1ff3545adeec bc87b14594e307
Author: Jakub Kicinski 
Date:   Sat Jan 10 15:19:54 2026 -0800

    Merge branch 'bnxt_en-updates-for-net-next'
    
    Michael Chan says:
    
    ====================
    bnxt_en: Updates for net-next
    
    This patchset updates the driver with a FW interface update to support
    FEC stats histogram and NVRAM defragmentation.  Patch #2 adds PTP
    cross timestamps [1].  Patch #3 adds FEC histogram stats.  Patch #4 adds
    NVRAM defragmentation support that prevents FW update failure when NVRAM
    is fragmented.  Patch #5 improves RSS distribution accuracy when certain
    number of rings is in use.  The last patch adds ethtool
    .get_link_ext_state() support.
    ====================
    
    Link: https://patch.msgid.link/20260108183521.215610-1-michael.chan@broadcom.com
    Signed-off-by: Jakub Kicinski 

commit bc87b14594e30720a5c1546c24e0f5f08d34eb40
Author: Michael Chan 
Date:   Thu Jan 8 10:35:21 2026 -0800

    bnxt_en: Implement ethtool_ops -> get_link_ext_state()
    
    Map the link_down_reason from the FW to the ethtool link_ext_state
    when it is available.  Also log it to the link down dmesg when it is
    available.  Add 2 new link_ext_state enums to the UAPI:
    
    ETHTOOL_LINK_EXT_STATE_OTP_SPEED_VIOLATION
    ETHTOOL_LINK_EXT_STATE_BMC_REQUEST_DOWN
    
    to cover OTP (one-time-programmable) speed restrictions and
    BMC (Baseboard management controller) forcing the link down.
    
    Reviewed-by: Andy Gospodarek 
    Reviewed-by: Kalesh AP 
    Reviewed-by: Pavan Chebbi 
    Signed-off-by: Michael Chan 
    Link: https://patch.msgid.link/20260108183521.215610-7-michael.chan@broadcom.com
    Signed-off-by: Jakub Kicinski 

commit 51b9d3f948b8182a52c1711755ca41b9e9fd166f
Author: Michael Chan 
Date:   Thu Jan 8 10:35:20 2026 -0800

    bnxt_en: Use a larger RSS indirection table on P5_PLUS chips
    
    The driver currently uses a chip supported RSS indirection table size
    just big enough to cover the number of RX rings.  Each table with 64
    entries requires one HW RSS context.  The HW supported table sizes are
    64, 128, 256, and 512 entries.  Using the smallest table size can cause
    unbalanced RSS packet distributions.  For example, if the number of
    rings is 48, the table size using existing logic will be 64.  32 rings
    will have a weight of 1 and 16 rings will have a weight of 2 when
    set to default even distribution.  This represents a 100% difference in
    weights between some of the rings.
    
    Newer FW has increased the RSS indirection table resource.  When the
    increased resource is detected, use the largest RSS indirection table
    size (512 entries) supported by the chip.  Using the same example
    above, the weights of the 48 rings will be either 10 or 11 when set to
    default even distribution.  The weight difference is only 10%.
    
    If there are thousands of VFs, there is a possiblity that we may not
    be able to allocate this larger RSS indirection table from the FW, so
    we add a check to fall back to the legacy scheme.
    
    Reviewed-by: Somnath Kotur 
    Signed-off-by: Michael Chan 
    Link: https://patch.msgid.link/20260108183521.215610-6-michael.chan@broadcom.com
    Signed-off-by: Jakub Kicinski 

commit 743e683596fa3c1f8d7dfb3f84fadfbdd396ef1a
Author: Pavan Chebbi 
Date:   Thu Jan 8 10:35:19 2026 -0800

    bnxt_en: Defrag the NVRAM region when resizing UPDATE region fails
    
    When updating to a new firmware pkg, the driver checks if the UPDATE
    region is big enough for the pkg and if it's not big enough, it
    issues an NVM_WRITE cmd to update with the requested size.
    
    This NVM_WRITE cmd can fail indicating fragmented region. Currently
    the driver fails the fw update when this happens. We can improve the
    situation by defragmenting the region and try the NVM_WRITE cmd
    again. This will make firmware update more reliable.
    
    Reviewed-by: Somnath Kotur 
    Reviewed-by: Kalesh AP 
    Signed-off-by: Pavan Chebbi 
    Signed-off-by: Michael Chan 
    Link: https://patch.msgid.link/20260108183521.215610-5-michael.chan@broadcom.com
    Signed-off-by: Jakub Kicinski 

commit e1c9c8928b5b447dfd9e70cb2007567b0b72d487
Author: Michael Chan 
Date:   Thu Jan 8 10:35:18 2026 -0800

    bnxt_en: Add support for FEC bin histograms
    
    Fill in the struct ethtool_fec_hist passed to the bnxt_get_fec_stats()
    callback if the FW supports the feature.  Bins 0 to 15 inclusive are
    available when the feature is supported.
    
    Reviewed-by: Hongguang Gao 
    Reviewed-by: Damodharam Ammepalli 
    Reviewed-by: Vadim Fedorenko 
    Signed-off-by: Michael Chan 
    Link: https://patch.msgid.link/20260108183521.215610-4-michael.chan@broadcom.com
    Signed-off-by: Jakub Kicinski 

commit c470195b989fe7b9f92297e465c4e8a2363c0bb3
Author: Pavan Chebbi 
Date:   Thu Jan 8 10:35:17 2026 -0800

    bnxt_en: Add PTP .getcrosststamp() interface to get device/host times
    
    .getcrosststamp() helps the applications to obtain a snapshot of
    device and host time almost taken at the same time. This function
    will report PCIe PTM device and host times to any application using
    the ioctl PTP_SYS_OFFSET_PRECISE. The device time from the HW is
    48-bit and needs to be converted to 64-bit.
    
    Reviewed-by: Somnath Kotur 
    Reviewed-by: Vadim Fedorenko 
    Signed-off-by: Pavan Chebbi 
    Signed-off-by: Michael Chan 
    Link: https://patch.msgid.link/20260108183521.215610-3-michael.chan@broadcom.com
    Signed-off-by: Jakub Kicinski 

commit fdb573d675e3ac50f0b58aaa35bfe7e8c585ba5f
Author: Michael Chan 
Date:   Thu Jan 8 10:35:16 2026 -0800

    bnxt_en: Update FW interface to 1.10.3.151
    
    The main changes are the new HWRM_PORT_PHY_FDRSTAT command to collect
    FEC histogram bins and the new HWRM_NVM_DEFRAG command to defragment the
    NVRAM.  There is also a minor name change in struct hwrm_vnic_cfg_input
    that requires updating the bnxt_re driver's main.c.
    
    Signed-off-by: Michael Chan 
    Link: https://patch.msgid.link/20260108183521.215610-2-michael.chan@broadcom.com
    Signed-off-by: Jakub Kicinski 

commit 7a1ff3545adeec5dc65c3063c2f084500d6f7014
Author: Jakub Kicinski 
Date:   Thu Jan 8 14:52:57 2026 -0800

    selftests: net: py: ensure defer() is only used within a test case
    
    I wasted a couple of hours recently after accidentally adding
    a defer() from within a function which itself was called as
    part of defer(). This leads to an infinite loop of defer().
    Make sure this cannot happen and raise a helpful exception.
    
    I understand that the pair of _ksft_defer_arm() calls may
    not be the most Pythonic way to implement this, but it's
    easy enough to understand.
    
    Reviewed-by: Petr Machata 
    Link: https://patch.msgid.link/20260108225257.2684238-2-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 799a4912eea74c667da1c8167f93bf2d1508a89e
Author: Jakub Kicinski 
Date:   Thu Jan 8 14:52:56 2026 -0800

    selftests: net: py: capitalize defer queue and improve import
    
    Import utils and refer to the global defer queue that way instead
    of importing the queue. This will make it possible to assign value
    to the global variable. While at it capitalize the name, to comply
    with the Python coding style.
    
    Reviewed-by: Petr Machata 
    Link: https://patch.msgid.link/20260108225257.2684238-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit de7c600e2d5b501c0c04bde8ebab89ac5888a69f
Author: David Wei 
Date:   Thu Jan 8 15:45:21 2026 -0800

    selftests/net: parametrise iou-zcrx.py with ksft_variants
    
    Use ksft_variants to parametrise tests in iou-zcrx.py to either use
    single queues or RSS contexts, reducing duplication.
    
    Signed-off-by: David Wei 
    Link: https://patch.msgid.link/20260108234521.3619621-1-dw@davidwei.uk
    Signed-off-by: Jakub Kicinski 

commit 9086984ff52e703cd7ce47ae19f12d8d31914396
Author: Cosmin Ratiu 
Date:   Fri Jan 9 13:08:51 2026 +0200

    selftests: drv-net: psp: Better control the used PSP dev
    
    The PSP responder fails when zero or multiple PSP devices are detected.
    There's an option to select the device id to use (-d) but it's
    currently not used from the PSP self test. It's also hard to use because
    the PSP test doesn't dump the PSP devices so can't choose one.
    When zero devices are detected, psp_responder fails which will cause the
    parent test to fail as well instead of skipping PSP tests.
    
    Fix both of these problems. Change psp_responder to:
    - not fail when no PSP devs are detected.
    - get an optional -i ifindex argument instead of -d.
    - select the correct PSP dev from the dump corresponding to ifindex or
    - select the first PSP dev when -i is not given.
    - fail when multiple devs are found and -i is not given.
    - warn and continue when the requested ifindex is not found.
    
    Also plumb the ifindex from the Python test.
    
    With these, when there are no PSP devs found or the wrong one is chosen,
    psp_responder opens the server socket, listens for control connections
    normally, and leaves the skipping of the various test cases which
    require a PSP device (~most, but not all of them) to the parent test.
    This results in output like:
    
    ok 1 psp.test_case # SKIP No PSP devices found
    [...]
    ok 12 psp.dev_get_device # SKIP No PSP devices found
    ok 13 psp.dev_get_device_bad
    ok 14 psp.dev_rotate # SKIP No PSP devices found
    [...]
    
    Signed-off-by: Cosmin Ratiu 
    Reviewed-by: Carolina Jubran 
    Link: https://patch.msgid.link/20260109110851.2952906-2-cratiu@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit bb63e7257e6341aa1e48da07b13d2d00fd899fb3
Author: Matthew Brost 
Date:   Fri Jan 9 17:27:39 2026 -0800

    drm/xe: Avoid toggling schedule state to check LRC timestamp in TDR
    
    We now have proper infrastructure to accurately check the LRC timestamp
    without toggling the scheduling state for non-VFs. For VFs, it is still
    possible to get an inaccurate view if the context is on hardware. We
    guard against free-running contexts on VFs by banning jobs whose
    timestamps are not moving. In addition, VFs have a timeslice quantum
    that naturally triggers context switches when more than one VF is
    running, thus updating the LRC timestamp.
    
    For multi-queue, it is desirable to avoid scheduling toggling in the TDR
    because this scheduling state is shared among many queues. Furthermore,
    this change simplifies the GuC state machine. The trade-off for VF cases
    seems worthwhile.
    
    v5:
     - Add xe_lrc_timestamp helper (Umesh)
    v6:
     - Reduce number of tries on stuck timestamp (VF testing)
     - Convert job timestamp save to a memory copy (VF testing)
    v7:
     - Save ctx timestamp to LRC when start VF job (VF testing)
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Umesh Nerlige Ramappa 
    Link: https://patch.msgid.link/20260110012739.2888434-8-matthew.brost@intel.com

commit efffd56e4bd894e0935eea00e437f233b6cebc0d
Author: Matthew Brost 
Date:   Fri Jan 9 17:27:38 2026 -0800

    drm/xe: Disable timestamp WA on VFs
    
    The timestamp WA does not work on a VF because it requires reading MMIO
    registers, which are inaccessible on a VF. This timestamp WA confuses
    LRC sampling on a VF during TDR, as the LRC timestamp would always read
    as 1 for any active context. Disable the timestamp WA on VFs to avoid
    this confusion.
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Umesh Nerlige Ramappa 
    Fixes: 617d824c5323 ("drm/xe: Add WA BB to capture active context utilization")
    Link: https://patch.msgid.link/20260110012739.2888434-7-matthew.brost@intel.com

commit ddb5cf9b90c5201a833d5d65f96b359bf3acdd90
Author: Matthew Brost 
Date:   Fri Jan 9 17:27:37 2026 -0800

    drm/xe: Remove special casing for LR queues in submission
    
    Now that LR jobs are tracked by the DRM scheduler, there's no longer a
    need to special-case LR queues. This change removes all LR
    queue-specific handling, including dedicated TDR logic, reference
    counting schemes, and other related mechanisms.
    
    v4:
     - Remove xe_exec_queue_lr_cleanup tracepoint (Niranjana)
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Niranjana Vishwanathapura 
    Link: https://patch.msgid.link/20260110012739.2888434-6-matthew.brost@intel.com

commit 58624c195b9a90950ebff166b72ee712f8d5a4c7
Author: Matthew Brost 
Date:   Fri Jan 9 17:27:36 2026 -0800

    drm/xe: Do not deregister queues in TDR
    
    Deregistering queues in the TDR introduces unnecessary complexity,
    requiring reference-counting techniques to function correctly,
    particularly to prevent use-after-free (UAF) issues while a
    deregistration initiated from the TDR is in progress.
    
    All that's needed in the TDR is to kick the queue off the hardware,
    which is achieved by disabling scheduling. Queue deregistration should
    be handled in a single, well-defined point in the cleanup path, tied to
    the queue's reference count.
    
    v4:
     - Explain why extra ref were needed prior to this patch (Niranjana)
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Niranjana Vishwanathapura 
    Link: https://patch.msgid.link/20260110012739.2888434-5-matthew.brost@intel.com

commit dd1ef5e2456558876244795bb22a4d90cb24f160
Author: Matthew Brost 
Date:   Fri Jan 9 17:27:35 2026 -0800

    drm/xe: Only toggle scheduling in TDR if GuC is running
    
    If the firmware is not running during TDR (e.g., when the driver is
    unloading), there's no need to toggle scheduling in the GuC. In such
    cases, skip this step.
    
    v4:
     - Bail on wait UC not running (Niranjana)
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Niranjana Vishwanathapura 
    Link: https://patch.msgid.link/20260110012739.2888434-4-matthew.brost@intel.com

commit 95f27831ee3c6afc2e3b7386c32545eba1f096d7
Author: Matthew Brost 
Date:   Fri Jan 9 17:27:34 2026 -0800

    drm/xe: Stop abusing DRM scheduler internals
    
    Use new pending job list iterator and new helper functions in Xe to
    avoid reaching into DRM scheduler internals.
    
    Part of this change involves removing pending jobs debug information
    from debugfs and devcoredump. As agreed, the pending job list should
    only be accessed when the scheduler is stopped. However, it's not
    straightforward to determine whether the scheduler is stopped from the
    shared debugfs/devcoredump code path. Additionally, the pending job list
    provides little useful information, as pending jobs can be inferred from
    seqnos and ring head/tail positions. Therefore, this debug information
    is being removed.
    
    v4:
     - Add comment around DRM_GPU_SCHED_STAT_NO_HANG (Niranjana)
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Niranjana Vishwanathapura 
    Link: https://patch.msgid.link/20260110012739.2888434-3-matthew.brost@intel.com

commit e70f43c21dbfa305a304028577a8565379089768
Author: Matthew Brost 
Date:   Fri Jan 9 17:27:33 2026 -0800

    drm/xe: Add dedicated message lock
    
    Stop abusing DRM scheduler job list lock for messages, add dedicated
    message lock.
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Niranjana Vishwanathapura 
    Acked-by: Philipp Stanner 
    Link: https://patch.msgid.link/20260110012739.2888434-2-matthew.brost@intel.com

commit d0c2d28cfd7ebc20bc582061402c603d00f0dd39
Merge: 959728f9931e75 cf8c4e1f08ec6c
Author: Jakub Kicinski 
Date:   Sat Jan 10 12:21:08 2026 -0800

    Merge branch 'net-convert-drivers-to-get_rx_ring_count'
    
    Breno Leitao says:
    
    ====================
    net: convert drivers to .get_rx_ring_count()
    
    Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to
    optimize RX ring queries") added specific support for GRXRINGS callback,
    simplifying .get_rxnfc.
    
    Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new
    .get_rx_ring_count().
    
    This simplifies the RX ring count retrieval and aligns the following
    drivers with the new ethtool API for querying RX ring parameters.
      * hns3
      * hns
      * qede
      * niu
      * funeth
      * enic
      * hinic
      * octeontx2
    
    PS: all of these change were compile-tested only.
    ====================
    
    Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-0-a0f77f732006@debian.org
    Signed-off-by: Jakub Kicinski 

commit cf8c4e1f08ec6c5dac24916378b8e006b30582ff
Author: Breno Leitao 
Date:   Fri Jan 9 09:40:59 2026 -0800

    net: hns3: convert to use .get_rx_ring_count
    
    Use the newly introduced .get_rx_ring_count ethtool ops callback instead
    of handling ETHTOOL_GRXRINGS directly in .get_rxnfc().
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-8-a0f77f732006@debian.org
    Signed-off-by: Jakub Kicinski 

commit 2103a5ed1b5b83f708da3dd9c2e5c8ddbd3ea7ce
Author: Breno Leitao 
Date:   Fri Jan 9 09:40:58 2026 -0800

    net: hns: convert to use .get_rx_ring_count
    
    Use the newly introduced .get_rx_ring_count ethtool ops callback instead
    of handling ETHTOOL_GRXRINGS directly in .get_rxnfc().
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-7-a0f77f732006@debian.org
    Signed-off-by: Jakub Kicinski 

commit a64f302022ba2f7e7b1cc185cbc95b454ae4ae8f
Author: Breno Leitao 
Date:   Fri Jan 9 09:40:57 2026 -0800

    net: qede: convert to use .get_rx_ring_count
    
    Use the newly introduced .get_rx_ring_count ethtool ops callback instead
    of handling ETHTOOL_GRXRINGS directly in .get_rxnfc().
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-6-a0f77f732006@debian.org
    Signed-off-by: Jakub Kicinski 

commit 5baf736ba4f3cd64d3a664c2c5c259375418d424
Author: Breno Leitao 
Date:   Fri Jan 9 09:40:56 2026 -0800

    net: niu: convert to use .get_rx_ring_count
    
    Use the newly introduced .get_rx_ring_count ethtool ops callback instead
    of handling ETHTOOL_GRXRINGS directly in .get_rxnfc().
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-5-a0f77f732006@debian.org
    Signed-off-by: Jakub Kicinski 

commit 983d4b8ec519bf10cb174b8aefd0257b46cf4396
Author: Breno Leitao 
Date:   Fri Jan 9 09:40:55 2026 -0800

    net: funeth: convert to use .get_rx_ring_count
    
    Use the newly introduced .get_rx_ring_count ethtool ops callback instead
    of handling ETHTOOL_GRXRINGS directly in .get_rxnfc().
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-4-a0f77f732006@debian.org
    Signed-off-by: Jakub Kicinski 

commit 415a9d10d1802123249fffc3a553b8c813a2af88
Author: Breno Leitao 
Date:   Fri Jan 9 09:40:54 2026 -0800

    net: enic: convert to use .get_rx_ring_count
    
    Use the newly introduced .get_rx_ring_count ethtool ops callback instead
    of handling ETHTOOL_GRXRINGS directly in .get_rxnfc().
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-3-a0f77f732006@debian.org
    Signed-off-by: Jakub Kicinski 

commit 08cbb4a3de08e17df3ad00ad7ee02345cb90dd3d
Author: Breno Leitao 
Date:   Fri Jan 9 09:40:53 2026 -0800

    net: hinic: convert to use .get_rx_ring_count
    
    Use the newly introduced .get_rx_ring_count ethtool ops callback instead
    of handling ETHTOOL_GRXRINGS directly in .get_rxnfc().
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-2-a0f77f732006@debian.org
    Signed-off-by: Jakub Kicinski 

commit 623b213825fdee1a3047774593f2fa2435947756
Author: Breno Leitao 
Date:   Fri Jan 9 09:40:52 2026 -0800

    net: octeontx2: convert to use .get_rx_ring_count
    
    Use the newly introduced .get_rx_ring_count ethtool ops callback instead
    of handling ETHTOOL_GRXRINGS directly in .get_rxnfc().
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-1-a0f77f732006@debian.org
    Signed-off-by: Jakub Kicinski 

commit 959728f9931e754deb10b51bf208a5e567f9034b
Author: Breno Leitao 
Date:   Thu Jan 8 03:43:00 2026 -0800

    net: stmmac: convert to use .get_rx_ring_count
    
    Convert the stmmac driver to use the new .get_rx_ring_count
    ethtool operation instead of implementing .get_rxnfc for handling
    ETHTOOL_GRXRINGS command.
    
    Since stmmac_get_rxnfc() only handled ETHTOOL_GRXRINGS (returning
    -EOPNOTSUPP for all other commands), remove it entirely and replace
    it with the simpler stmmac_get_rx_ring_count() callback.
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260108-gxring_stmicro-v2-1-3dcadc8ed29b@debian.org
    Signed-off-by: Jakub Kicinski 

commit 6c7ff659d883c2753863f90549b2a5d83562fb43
Merge: 11ed2195887d41 b30ba673058d96
Author: Jakub Kicinski 
Date:   Sat Jan 10 12:03:57 2026 -0800

    Merge branch 'mlx5-add-tso-support-for-udp-over-gre-over-vlan'
    
    Mark Bloch says:
    
    ====================
    mlx5: Add TSO support for UDP over GRE over VLAN
    
    The following 3 small patches by Gal add support for TSO for
    UDP over GRE over VLAN packets.
    ====================
    
    Link: https://patch.msgid.link/20260107091848.621884-1-mbloch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit b30ba673058d9657f03ef55a9efa2db544d244b5
Author: Gal Pressman 
Date:   Wed Jan 7 11:18:48 2026 +0200

    net/mlx5e: Remove GSO_PARTIAL for non _CSUM GRE
    
    The hardware can do TSO for GRE packets without an outer checksum, it
    doesn't need GSO_PARTIAL's help.
    
    Signed-off-by: Gal Pressman 
    Reviewed-by: Tariq Toukan 
    Reviewed-by: Dragos Tatulea 
    Signed-off-by: Mark Bloch 
    Link: https://patch.msgid.link/20260107091848.621884-4-mbloch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit 5f410e1224e49c68818475289ed4a943461f00c3
Author: Gal Pressman 
Date:   Wed Jan 7 11:18:47 2026 +0200

    net/mlx5e: TSO for UDP over GRE over vlan packets
    
    The hardware supports segmentation offload of UDP over GRE over vlan
    packets, allow it by adding NETIF_F_GSO_UDP_L4 to hw_enc_features which
    will make the vlan device inherit it to its own hw_enc_features.
    
    Side note: it is quite confusing that this change wasn't needed to
    offload encapsulated UDP packets regardless of vlan, but that's the way
    that the stack handles gso partial features, it assumes they're
    supported without caring if the feature is supported in hw_enc_features.
    
    Signed-off-by: Gal Pressman 
    Reviewed-by: Cosmin Ratiu 
    Reviewed-by: Tariq Toukan 
    Signed-off-by: Mark Bloch 
    Link: https://patch.msgid.link/20260107091848.621884-3-mbloch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit 6e6c751b41a8113f4bd9626ccc95a06e307c7a79
Author: Gal Pressman 
Date:   Wed Jan 7 11:18:46 2026 +0200

    net/mlx5e: TSO for GRE over vlan
    
    The hardware supports segmentation offload of GRE tunnel over vlan,
    allow it by adding it to vlan_features.
    
    Signed-off-by: Gal Pressman 
    Reviewed-by: Cosmin Ratiu 
    Reviewed-by: Tariq Toukan 
    Signed-off-by: Mark Bloch 
    Link: https://patch.msgid.link/20260107091848.621884-2-mbloch@nvidia.com
    Signed-off-by: Jakub Kicinski 

commit 11ed2195887d419ed889f2140fcf3b5ec7bf1177
Author: Kunihiko Hayashi 
Date:   Fri Jan 9 19:39:15 2026 +0900

    net: ethernet: ave: Remove unnecessary 'out of memory' message
    
    Follow the warning from checkpatch.pl and remove 'out of memory' message.
    
        WARNING: Possible unnecessary 'out of memory' message
        #590: FILE: drivers/net/ethernet/socionext/sni_ave.c:590:
        +               if (!skb) {
        +                       netdev_err(ndev, "can't allocate skb for Rx\n");
    
    Signed-off-by: Kunihiko Hayashi 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/20260109103915.2764380-1-hayashi.kunihiko@socionext.com
    Signed-off-by: Jakub Kicinski 

commit 9da9633f2f02df7da67ab3b6f84eda4956ae1c5a
Author: Daniel Golle 
Date:   Wed Jan 7 15:39:16 2026 +0000

    net: phy: mxl-gpy: implement SGMII in-band configuration
    
    SGMII in-band autonegotiation was previously kept untouched (and restored
    after switching back from 2500Base-X to SGMII). Now that the kernel offers
    a way to announce in-band capabilities and nable/disable in-band AN,
    implement the .inband_caps and .config_inband driver ops.
    This moves the responsibility to configure SGMII in-band AN from the PHY
    driver to phylink.
    
    Signed-off-by: Daniel Golle 
    Link: https://patch.msgid.link/70f07e46dd96e239a9711e6073e8c04c1d8672d4.1767800226.git.daniel@makrotopia.org
    Signed-off-by: Jakub Kicinski 

commit a8848c4b43ad00c8a18db080206e3ffa53a08b91
Author: Tony Luck 
Date:   Wed Dec 17 09:21:19 2025 -0800

    x86,fs/resctrl: Update documentation for telemetry events
    
    Update resctrl filesystem documentation with the details about the resctrl
    files that support telemetry events.
    
      [ bp: Drop the debugfs hunk of the documentation until a better debugging
        solution is found. ]
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit fff90bb3d4e56586e06d405b683af67d6271023b
Author: Taimur Hassan 
Date:   Fri Jan 2 16:33:41 2026 -0500

    drm/amd/display: Promote DC to 3.2.365
    
    This version brings along the following updates:
    
    - Cleanup, refactoring of panel replay code to prepare for non-eDP
      replay
    - Switch to drm_dbg_macros instead of DRM_DEBUG variants
    - Add pwait status to DMCUB debug logging
    - Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
    - Always update divider settings for DP tunnel
    - correct clip x assignment in cursor programming
    - Bump the HDMI clock to 340MHz
    
    Signed-off-by: Taimur Hassan 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Acked-by: Leo Li 
    Signed-off-by: Alex Deucher 

commit 15acb306c9efb98eaf760c76e3b02a6b7e2b974f
Author: Taimur Hassan 
Date:   Fri Jan 2 16:30:05 2026 -0500

    drm/amd/display: [FW Promotion] Release 0.1.42.0
    
    Summary for changes in firmware:
    
    * Fix 24/30FPS full screen video low residency
    * Fix 60Hz video playback freeze
    * Add Panel Replay command for VESA replay
    
    Signed-off-by: Taimur Hassan 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Acked-by: Leo Li 
    Signed-off-by: Alex Deucher 

commit 71573db5ad74b2087a4688cd1dda73ff082620f6
Author: Aurabindo Pillai 
Date:   Tue Dec 30 15:21:18 2025 -0500

    drm/amd/display: switch to drm_dbg_ macros instead of DRM_DEBUG_ variants
    
    Device pointer sources used:
            - connector->dev - when a DRM connector was available
            - old_plane_crtc->dev / new_plane_crtc->dev - for plane state functions
            - pass in drm_device - for the stream scaling function
            - aconnector->base.dev - for the VSDB parsing function
    
    Reviewed-by: Sun peng (Leo) Li 
    Signed-off-by: Aurabindo Pillai 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 869e3869b9303ba104f14b70814cc5b4bb7ad7a9
Author: Aurabindo Pillai 
Date:   Tue Dec 30 15:14:26 2025 -0500

    drm/amd/display: switch to drm_dbg_kms() from DRM_DEBUG_KMS
    
    DRM_DEBUG_ class of macros are depricated. Recommended drm_dbg_kms() has
    the advantage of being able to distinguish the logs from devices in a
    multi-gpu environment.
    
    Where a pointer to struct amdgpu_device is available, use that to get
    the drm device.
    
    Reviewed-by: Sun peng (Leo) Li 
    Signed-off-by: Aurabindo Pillai 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit e9306b69e77574c676ebf3eeaa428da685cc6a25
Author: Nicholas Kazlauskas 
Date:   Fri Jan 2 10:25:03 2026 -0500

    drm/amd/display: Add pwait status to DMCUB debug logging
    
    [Why]
    To know if DMCUB is idle at the time of the debug data being collected.
    
    [How]
    Extend the logging to include the field.
    
    It's already captured as part of each ASIC's get_diagnostic_data.
    
    Reviewed-by: Dillon Varone 
    Signed-off-by: Nicholas Kazlauskas 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 75372d75a4e23783583998ed99d5009d555850da
Author: Nicholas Kazlauskas 
Date:   Wed Dec 17 13:21:59 2025 -0500

    drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
    
    [Why]
    A backport of the change made for DCN401 that addresses an issue where
    we turn off the PHY PLL when disabling TMDS output, which causes the
    OTG to remain stuck.
    
    The OTG being stuck can lead to a hang in the DCHVM's ability to ACK
    invalidations when it thinks the HUBP is still on but it's not receiving
    global sync.
    
    The transition to PLL_ON needs to be atomic as there's no guarantee
    that the thread isn't pre-empted or is able to complete before the
    IOMMU watchdog times out.
    
    [How]
    Backport the implementation from dcn401 back to dcn35.
    
    There's a functional difference in when the eDP output is disabled in
    dcn401 code so we don't want to utilize it directly.
    
    Reviewed-by: Yihan Zhu 
    Signed-off-by: Nicholas Kazlauskas 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit cb958039323634631126cdbc94216b4037fee243
Author: Peichen Huang 
Date:   Wed Dec 24 11:43:18 2025 +0800

    drm/amd/display: Add replay_events in replay settings
    
    Add a new field to replay_settings.
    
    Reviewed-by: Robin Chen 
    Signed-off-by: Peichen Huang 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 5a113e15d15605c07d57d923c9f4a0d52d403ecc
Author: Peichen Huang 
Date:   Mon Dec 15 15:38:26 2025 +0800

    drm/amd/display: init code for external panel replay
    
    Prepare for supporting panel replay on external monitors.
    
    Reviewed-by: Robin Chen 
    Reviewed-by: Wenjing Liu 
    Signed-off-by: Peichen Huang 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit a036db3953140d5c2816b056aa3e73b8e98d9bc0
Author: Ray Wu 
Date:   Tue Dec 16 18:09:45 2025 +0800

    drm/amd/display: disable replay when crc source is enabled
    
    [Why]
    IGT CRC tests fail on replay panels due to invalid CRC values
    captured when replay is active.
    
    [How]
    - Disable replay when CRC source is enabled; set flag to
      prevent unexpected re-enable
    - Reset flag when CRC source is disabled to allow replay
    
    Reviewed-by: ChiaHsuan (Tom) Chung 
    Signed-off-by: Ray Wu 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit cdd9b2d7e4091cc549deadf3e160e41e795b8e26
Author: Cruise Hung 
Date:   Wed Dec 17 18:11:43 2025 +0800

    drm/amd/display: Always update divider settings for DP tunnel
    
    [Why]
    When transitioning from 640x480 at RBRx1 to HBR3x1,
    both output pixel mode and pixel rate divider should update.
    The needs_divider_update flag was only for 8b10b and 128b132b transition.
    
    [How]
    For DP tunneling, always update divider settings.
    
    Reviewed-by: Jerry Zuo 
    Signed-off-by: Cruise Hung 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 1758cf3cfd3152530d875b9e5cb84eedafdb2e0b
Author: Derek Lai 
Date:   Thu Dec 18 11:44:50 2025 +0800

    drm/amd/display: revert "write default Vesa Aux backlight control in dmub"
    
    This reverts commit 08f133e932cc.
    
    Commit causing backlight darker when the system wakes up
    from standby mode, and green screen w/ secondary screen only
    when the system wakes up from standby mode.
    
    Reviewed-by: Charlene Liu 
    Signed-off-by: Derek Lai 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit e7b09b766ae2c2d0cb8e9a2d81b7b9dfca04a9b1
Author: Ausef Yousof 
Date:   Mon Dec 1 15:03:10 2025 -0500

    drm/amd/display: correct clip x assignment in cursor programming
    
    [why&how]
    primary planes for external displays getting incorrect clip
    values, detect such a scenario and pass correct parameters
    
    Reviewed-by: Ovidiu (Ovi) Bunea 
    Signed-off-by: Ausef Yousof 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 1883b2578df3e3577b429fd46776e788b2107ec0
Author: Leo Chen 
Date:   Wed Dec 17 19:32:45 2025 -0500

    drm/amd/display: Add global fgcg function prototype to DCCG
    
    [Why & How]
    Add the ability to enable/disable global fine grain clock gating within DCCG.
    
    Reviewed-by: Charlene Liu 
    Signed-off-by: Leo Chen 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 0839d8d24e6f1fc2587c4a976f44da9fa69ae3d0
Author: Dmytro Laktyushkin 
Date:   Tue Dec 16 16:38:50 2025 -0500

    drm/amd/display: only power down dig on phy endpoints
    
    This avoids any issues with dpia endpoints
    
    Reviewed-by: Charlene Liu 
    Signed-off-by: Dmytro Laktyushkin 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 53edf8604a7c594d1d5091deb7c11d2c3b2e6b79
Author: Jack Chang 
Date:   Thu Nov 6 10:58:26 2025 +0800

    drm/amd/display: PR error HPD_IRQ handling
    
    [Why & How]
    Add error handling for IRQ_HPD in Panel Replay
    
    Reviewed-by: Robin Chen 
    Reviewed-by: Wenjing Liu 
    Signed-off-by: Jack Chang 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit a230696d4e009abb22b7a2f9d434f1555bfa08ca
Author: Jack Chang 
Date:   Thu Dec 4 16:57:47 2025 +0800

    drm/amd/display: DPCD for Selective Update
    
    [Why&How]
    Add flow to read selective update related info from DPCD,
    and pass the info to DMUB.
    
    Reviewed-by: Robin Chen 
    Reviewed-by: Wenjing Liu 
    Signed-off-by: Jack Chang 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit ac1e65d8ade46c09fb184579b81acadf36dcb91e
Author: Mario Limonciello 
Date:   Mon Dec 15 14:08:30 2025 -0600

    drm/amd/display: Bump the HDMI clock to 340MHz
    
    [Why]
    DP-HDMI dongles can execeed bandwidth requirements on high resolution
    monitors. This can lead to pruning the high resolution modes.
    
    HDMI 1.3 bumped the clock to 340MHz, but display code never matched it.
    
    [How]
    Set default to (DVI) 165MHz.  Once HDMI display is identified update
    to 340MHz.
    
    Reported-by: Dianne Skoll 
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4780
    Reviewed-by: Chris Park 
    Signed-off-by: Mario Limonciello 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 99f77f6229c0766b980ae05affcf9f742d97de6a
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 08:59:16 2025 -0600

    drm/amd/display: Show link name in PSR status message
    
    [Why]
    The PSR message was moved in commit 4321742c394e ("drm/amd/display:
    Move PSR support message into amdgpu_dm"). This message however shows
    for every single link without showing which link is which.  This can
    send a confusing message to the user.
    
    [How]
    Add link name into the message.
    
    Fixes: 4321742c394e ("drm/amd/display: Move PSR support message into amdgpu_dm")
    Reviewed-by: Alex Hung 
    Signed-off-by: Mario Limonciello (AMD) 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 16ac1b6a6b52ff0bbd87b6361b8b01d358dfdadc
Author: Robin Chen 
Date:   Tue Dec 16 18:03:45 2025 +0800

    drm/amd/display: Remove unused DMUB replay commands
    
    [WHY]
    Remove unused DMUB Replay set version command and related code.
    
    Reviewed-by: Jack Chang 
    Signed-off-by: Robin Chen 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 872818e2357b026462b21e90aad115aa369966ba
Author: Joshua Aberback 
Date:   Fri Dec 12 04:23:03 2025 -0500

    drm/amd/display: Re-implement minimal transition deferral
    
    [Why]
    The update v3 path got refactored into new functions, which happened just
    before the previous implementation was submitted, which resulted in the
    optimizations not executing. This commit re-implements the same logic in
    the new codepath.
    
    Reviewed-by: Aric Cyr 
    Signed-off-by: Joshua Aberback 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 1e5cd4adfc547bc0d0d69896e7696b96697ad0aa
Author: Peichen Huang 
Date:   Tue Dec 9 10:47:06 2025 +0800

    drm/amd/display: move panel replay out from edp
    
    [WHY]
    Panel Replay is not an eDP-specific function.
    
    [HOW]
    Create new Panel Replay source files and move the Panel Replay
    functions from the eDP files to the new files. Additionally, create
    a new link_service construct function to assign the related
    function pointers.
    
    Reviewed-by: Robin Chen 
    Signed-off-by: Peichen Huang 
    Signed-off-by: Matthew Stewart 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 0f744593adecfa12ce7c4bfc4a6c2850458c4e88
Author: Lang Yu 
Date:   Fri Dec 19 20:27:00 2025 +0800

    drm/amdgpu/mes: Simplify hqd mask initialization
    
    "adev->mes.compute_hqd_mask[i] = adev->gfx.disable_kq ? 0xF"
    is actually incorrect for MEC with 8 queues per pipe.
    Let's get rid of version check and hardcode, calculate hqd
    mask with number of queues per pipe and number of gfx/compute
    queues kernel used.
    
    Currently, only MEC1 is used for both kernel/user compute queue.
    To enable other MEC, we need to redistribute queues per pipe and
    adjust queue resource shared with kfd that needs a separate patch.
    Just skip other MEC for now to avoid potential issues.
    
    v2: Force reserved queues to 0 if kernel queue is explicitly disabled.
    
    Signed-off-by: Lang Yu 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit efdc66fe12b07e7b7d28650bd8d4f7e3bb92c5d4
Author: Srinivasan Shanmugam 
Date:   Fri Jan 9 18:01:23 2026 +0530

    drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7
    
    When GPU memory mappings are updated, the driver returns a fence so
    userspace knows when the update is finished.
    
    The previous refactor could pick the wrong fence or rely on checks that
    are not safe for GPU mappings that stay valid even when memory is
    missing. In some cases this could return an invalid fence or cause fence
    reference counting problems.
    
    Fix this by (v5,v6, per Christian):
    - Starting from the VM’s existing last update fence, so a valid and
      meaningful fence is always returned even when no new work is required.
    - Selecting the VM-level fence only for always-valid / PRT mappings using
      the required combined bo_va + bo guard.
    - Using the per-BO page table update fence for normal MAP and REPLACE
      operations.
    - For UNMAP and CLEAR, returning the fence provided by
      amdgpu_vm_clear_freed(), which may remain unchanged when nothing needs
      clearing.
    - Keeping fence reference counting balanced.
    
    v7: Drop the extra bo_va/bo NULL guard since
        amdgpu_vm_is_bo_always_valid() handles NULL BOs correctly (including
        PRT). (Christian)
    
    This makes VM timeline fences correct and prevents crashes caused by
    incorrect fence handling.
    
    Fixes: bd8150a1b337 ("drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4")
    Suggested-by: Christian König 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit b7cccc8286bb9919a0952c812872da1dcfe9d390
Author: Haoxiang Li 
Date:   Thu Jan 8 15:18:22 2026 +0800

    drm/amdkfd: fix a memory leak in device_queue_manager_init()
    
    If dqm->ops.initialize() fails, add deallocate_hiq_sdma_mqd()
    to release the memory allocated by allocate_hiq_sdma_mqd().
    Move deallocate_hiq_sdma_mqd() up to ensure proper function
    visibility at the point of use.
    
    Fixes: 11614c36bc8f ("drm/amdkfd: Allocate MQD trunk for HIQ and SDMA")
    Signed-off-by: Haoxiang Li 
    Signed-off-by: Felix Kuehling 
    Reviewed-by: Oak Zeng 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit d967509651601cddce7ff2a9f09479f3636f684d
Author: Alex Deucher 
Date:   Fri Jan 9 08:54:55 2026 -0500

    drm/amdgpu: make sure userqs are enabled in userq IOCTLs
    
    These IOCTLs shouldn't be called when userqs are not
    enabled.  Make sure they are enabled before executing
    the IOCTLs.
    
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 9858810e62ca6a85bd2e7795a92e00a4ffa1c545
Author: Christophe JAILLET 
Date:   Sun Dec 21 16:13:48 2025 +0100

    drm/amdgpu: Slightly simplify base_addr_show()
    
    sysfs_emit_at() never returns a negative error code. It returns 0 or the
    number of characters written in the buffer.
    
    Remove the useless tests. This simplifies the logic and saves a few lines
    of code.
    
    Signed-off-by: Christophe JAILLET 
    Signed-off-by: Alex Deucher 

commit 96e97a562d067a6d867862db79864cc66aae99c2
Author: Christian König 
Date:   Tue Dec 2 16:12:41 2025 +0100

    drm/amdgpu: Drop MMIO_REMAP domain bit and keep it Internal
    
    "AMDGPU_GEM_DOMAIN_MMIO_REMAP" - Never activated as UAPI and it turned
    out that this was to inflexible.
    
    Allocate the MMIO_REMAP buffer object as a regular GEM BO and explicitly
    move it into the fixed AMDGPU_PL_MMIO_REMAP placement at the TTM level.
    
    This avoids relying on GEM domain bits for MMIO_REMAP, keeps the
    placement purely internal, and makes the lifetime and pinning of the
    global MMIO_REMAP BO explicit. The BO is pinned in TTM so it cannot be
    migrated or evicted.
    
    The corresponding free path relies on normal DRM teardown ordering,
    where no further user ioctls can access the global BO once TTM teardown
    begins.
    
    v2 (Srini):
    - Updated patch title.
    - Drop use of AMDGPU_GEM_DOMAIN_MMIO_REMAP in amdgpu_ttm.c. The
      MMIO_REMAP domain bit is removed from UAPI, so keep the MMIO_REMAP BO
      allocation domain-less (bp.domain = 0) and rely on the TTM placement
      (AMDGPU_PL_MMIO_REMAP) for backing/pinning.
    - Keep fdinfo/mem-stats visibility for MMIO_REMAP by classifying BOs
      based on bo->tbo.resource->mem_type == AMDGPU_PL_MMIO_REMAP, since the
      domain bit is removed.
    
    v3: Squash patches #1 & #3
    
    Fixes: 056132483724 ("drm/amdgpu/uapi: Introduce AMDGPU_GEM_DOMAIN_MMIO_REMAP")
    Fixes: 2a7a794eb82c ("drm/amdgpu/ttm: Allocate/Free 4K MMIO_REMAP Singleton")
    Cc: Alex Deucher 
    Cc: Christian König 
    Cc: Leo Liu 
    Cc: Ruijing Dong 
    Cc: David (Ming Qiang) Wu 
    Signed-off-by: Srinivasan Shanmugam 
    Signed-off-by: Christian König 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit cf3f100cec0192630e37e9cc9232186c61c0703b
Author: Lijo Lazar 
Date:   Wed Dec 17 16:55:09 2025 +0530

    drm/amd/pm: Use message control for debug mailbox
    
    Migrate existing debug message mechanism so that it uses debug message
    callbacks in message control block.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 2f0d5ecae0f5604c87075237a919b68d38cc9500
Author: Lijo Lazar 
Date:   Wed Dec 17 16:39:11 2025 +0530

    drm/amd/pm: Add debug message callback
    
    Add callback in message control to send message through debug mailbox.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit b9b393c68a10940b26d7a9c5d5d294bba887d440
Author: Lijo Lazar 
Date:   Tue Dec 16 14:41:12 2025 +0530

    drm/amd/pm: Drop unused ppt callback definitions
    
    SMU message related ppt callbacks are not used. Drop from ppt_funcs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 72838568bddc935a3626c67c85940efa3a1e76c9
Author: Lijo Lazar 
Date:   Thu Jan 8 10:09:39 2026 +0530

    drm/amd/pm: Drop unused ppt callback from SMUv15
    
    SMU message related ppt callbacks are not used. Drop from SMUv15.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 28aff13304196f4c6900602e8407a4b96147bef0
Author: Lijo Lazar 
Date:   Tue Dec 16 14:39:49 2025 +0530

    drm/amd/pm: Drop unused ppt callback from SMUv14
    
    SMU message related ppt callbacks are not used. Drop from SMUv14.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit ca184ac28af0e1b033fdd432ce79a1225751f360
Author: Lijo Lazar 
Date:   Tue Dec 16 14:38:59 2025 +0530

    drm/amd/pm: Drop unused ppt callback from SMUv13
    
    SMU message related ppt callbacks are not used. Drop from SMUv13.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit c3c61d11419c6c8de0f0156c95d4dfb829121b3f
Author: Lijo Lazar 
Date:   Tue Dec 16 14:35:59 2025 +0530

    drm/amd/pm: Drop unused ppt callback from SMUv12
    
    SMU message related ppt callbacks are not used. Drop from SMUv12.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 8376acce43aa958c2fff107a1d3d3a689a4eb85d
Author: Lijo Lazar 
Date:   Tue Dec 16 14:34:43 2025 +0530

    drm/amd/pm: Drop unused ppt callback from SMUv11
    
    SMU message related ppt callbacks are not used. Drop from SMUv11.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit a45eef15a2170b411ac441254fcd8d58b57bc92f
Author: Lijo Lazar 
Date:   Tue Dec 16 14:26:46 2025 +0530

    drm/amd/pm: Drop legacy message related fields
    
    Remove legacy message related fields from smu context.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 97cf0aace8eae6daa9e8f19047d36b741f022e3a
Author: Lijo Lazar 
Date:   Thu Jan 8 10:06:48 2026 +0530

    drm/amd/pm: Drop legacy message fields from SMUv15
    
    Remove usage of legacy message related fields from SMUv15 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 4068f195d1385d8b36440d7d9e92eb718fb423fd
Author: Lijo Lazar 
Date:   Tue Dec 16 14:19:42 2025 +0530

    drm/amd/pm: Drop legacy message fields from SMUv14
    
    Remove usage of legacy message related fields from SMUv14 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 8d623384894cc04ae8637ba2137d168909c83f8a
Author: Lijo Lazar 
Date:   Tue Dec 16 14:17:45 2025 +0530

    drm/amd/pm: Drop legacy message fields from SMUv13
    
    Remove usage of legacy message related fields from SMUv13 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 8ba2a9a987d047288b7b9b6617b3c3879b1e9731
Author: Lijo Lazar 
Date:   Tue Dec 16 13:48:30 2025 +0530

    drm/amd/pm: Drop legacy message fields from SMUv12
    
    Remove usage of legacy message related fields from SMUv12 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 8c502fd5b6e3831d8f138e8b1000c17b3add1929
Author: Lijo Lazar 
Date:   Tue Dec 16 13:45:52 2025 +0530

    drm/amd/pm: Drop legacy message fields from SMUv11
    
    Remove usage of legacy message related fields from SMUv11 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 359b9f088f53a3e0ff90e094cf1f4b32dc1d86f3
Author: Lijo Lazar 
Date:   Tue Dec 16 13:39:39 2025 +0530

    drm/amd/pm: Remove unused legacy message functions
    
    Messaging functions are now moved to message control block. Remove
    unused legacy functions around messaging.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 3b7743701969e29d1956c40822e09acb3850d422
Author: Lijo Lazar 
Date:   Tue Dec 16 12:55:26 2025 +0530

    drm/amd/pm: Replace without wait with async calls
    
    Use the new async locked message function instead of without_waiting
    messaging function.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit c42852d83d0154cdb41626246a90aa64d1e4fb52
Author: Lijo Lazar 
Date:   Tue Dec 16 12:46:40 2025 +0530

    drm/amd/pm: Add async message call support
    
    Add asynchronous messaging (message which doesn't wait for response)
    using message control block.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 28665cad86f2830b966547afa996c3c20a432dfb
Author: Lijo Lazar 
Date:   Tue Dec 16 12:32:05 2025 +0530

    drm/amd/pm: Use message control in messaging
    
    Use message control block operations in common message functions.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 34199fde4a8604d9d3ad2d939c5eed530460cc79
Author: Lijo Lazar 
Date:   Thu Jan 8 09:54:59 2026 +0530

    drm/amd/pm: Add message control for SMUv15
    
    Initialize smu message control in SMUv15 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 0d81c3982d32e4572fc91d5b8aca9e1a808a1820
Author: Lijo Lazar 
Date:   Tue Dec 16 12:06:04 2025 +0530

    drm/amd/pm: Add message control for SMUv14
    
    Initialize smu message control in SMUv14 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 667912bbabc2044e00eecf7d0b5e00ad81ac2dfa
Author: Lijo Lazar 
Date:   Tue Dec 16 12:03:09 2025 +0530

    drm/amd/pm: Add message control for SMUv13
    
    Initialize smu message control in SMUv13 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 067e46a36bfc6897ebb0bd8a7f50ed98ca068ef2
Author: Lijo Lazar 
Date:   Tue Dec 16 11:37:11 2025 +0530

    drm/amd/pm: Add message control for SMUv12
    
    Initialize smu message control in SMUv12 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 6d74c9ff6ae5d246d601f855aab234b1cbaf4e15
Author: Lijo Lazar 
Date:   Tue Jan 6 13:29:25 2026 +0530

    drm/amd/pm: Add message control for SMUv11
    
    Initialize smu message control in SMUv11 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 4f379370a49ccb747d8d87f2d8ee9bba965e1897
Author: Lijo Lazar 
Date:   Tue Dec 16 11:20:54 2025 +0530

    drm/amd/pm: Add smu message control block
    
    Add message control block to abstract PMFW message protocol. Message
    control block primarily carries message config which is set of register
    addresses and message ops which abstracts the protocol of sending messages.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit ca5d4db8db843be7ed35fc9334737490c2b58d32
Author: Xiaogang Chen 
Date:   Thu Jan 8 09:50:36 2026 -0600

    drm/amdgpu: Use correct address to setup gart page table for vram access
    
    Use dst input parameter to setup gart page table entries instead of using fixed
    location.
    
    Fixes: 237d623ae659 ("drm/amdgpu/gart: Add helper to bind VRAM pages (v2)")
    Signed-off-by: Xiaogang Chen 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 39c21b81112321cbe1267b02c77ecd2161ce19aa
Author: YuBiao Wang 
Date:   Wed Nov 12 15:16:27 2025 +0800

    drm/amdgpu: Skip loading SDMA_RS64 in VF
    
    VFs use the PF SDMA ucode and are unable to load SDMA_RS64.
    
    Signed-off-by: YuBiao Wang 
    Signed-off-by: Victor Skvortsov 
    Reviewed-by: Gavin Wan 
    Signed-off-by: Alex Deucher 

commit f7ba87dfa8e42642d43faf29a71cee338086218b
Author: Ming Lei 
Date:   Sat Jan 10 21:42:36 2026 +0800

    block: account for bi_bvec_done in bio_may_need_split()
    
    When checking if a bio fits in a single segment, bio_may_need_split()
    compares bi_size against the current bvec's bv_len. However, for
    partially consumed bvecs (bi_bvec_done > 0), such as in cloned or
    split bios, the remaining bytes in the current bvec is actually
    (bv_len - bi_bvec_done), not bv_len.
    
    This could cause bio_may_need_split() to incorrectly return false,
    leading to nr_phys_segments being set to 1 when the bio actually
    spans multiple segments. This triggers the WARN_ON in __blk_rq_map_sg()
    when the actual mapped segments exceed the expected count.
    
    Fix by subtracting bi_bvec_done from bv_len in the comparison.
    
    Reported-by: Venkat Rao Bagalkote 
    Close: https://lore.kernel.org/linux-block/9687cf2b-1f32-44e1-b58d-2492dc6e7185@linux.ibm.com/
    Repored-and-bisected-by: Christoph Hellwig 
    Tested-by: Venkat Rao Bagalkote 
    Tested-by: Christoph Hellwig 
    Fixes: ee623c892aa5 ("block: use bvec iterator helper for bio_may_need_split()")
    Cc: Nitesh Shetty 
    Signed-off-by: Ming Lei 
    Signed-off-by: Jens Axboe 

commit a31bde687b10b1a3db9c61eba5abb662dda15277
Author: Caleb Sander Mateos 
Date:   Thu Jan 8 10:22:12 2026 -0700

    block: use pi_tuple_size in bi_offload_capable()
    
    bi_offload_capable() returns whether a block device's metadata size
    matches its PI tuple size. Use pi_tuple_size instead of switching on
    csum_type. This makes the code considerably simpler and less branchy.
    
    Signed-off-by: Caleb Sander Mateos 
    Reviewed-by: Christoph Hellwig 
    Reviewed-by: Anuj Gupta 
    Reviewed-by: Martin K. Petersen 
    Signed-off-by: Jens Axboe 

commit 38feb171b3f92d77e8061fafb5ddfffc2c13b672
Author: Randy Dunlap 
Date:   Wed Oct 22 23:24:40 2025 -0700

    accel/rocket: rocket_accel.h: fix kernel-doc warnings
    
    Fix all kernel-doc warnings in rocket_accel.h:
    
    Warning: include/uapi/drm/rocket_accel.h:35 Incorrect use of kernel-doc
     format:  * Output: DMA address for the BO in the NPU address space.
     This address
    
    and 22 warnings like these:
    
    Warning: include/uapi/drm/rocket_accel.h:43 struct member 'size'
     not described in 'drm_rocket_create_bo'
    Warning: include/uapi/drm/rocket_accel.h:60 struct member 'handle'
     not described in 'drm_rocket_prep_bo'
    Warning: include/uapi/drm/rocket_accel.h:73 struct member 'handle'
     not described in 'drm_rocket_fini_bo'
    Warning: include/uapi/drm/rocket_accel.h:86 struct member 'regcmd'
     not described in 'drm_rocket_task'
    Warning: include/uapi/drm/rocket_accel.h:116 struct member 'tasks'
     not described in 'drm_rocket_job'
    Warning: include/uapi/drm/rocket_accel.h:135 struct member 'jobs'
     not described in 'drm_rocket_submit'
    
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Tomeu Vizoso 
    Signed-off-by: Tomeu Vizoso 
    Link: https://patch.msgid.link/20251023062440.4093661-1-rdunlap@infradead.org

commit 57d8ae156935b311e068759682eb12a2a6c48a9a
Author: Quentin Schulz 
Date:   Mon Dec 15 18:07:56 2025 +0100

    accel/rocket: factor out code with find_core_for_dev in rocket_remove
    
    There already is a function to return the offset of the core for a given
    struct device, so let's reuse that function instead of reimplementing
    the same logic.
    
    There's one change in behavior when a struct device is passed which
    doesn't match any core's. Before, we would continue through
    rocket_remove() but now we exit early, to match what other callers of
    find_core_for_dev() (rocket_device_runtime_resume/suspend()) are doing.
    This however should never happen. Aside from that, no intended change in
    behavior.
    
    Signed-off-by: Quentin Schulz 
    Reviewed-by: Tomeu Vizoso 
    Signed-off-by: Tomeu Vizoso 
    Link: https://patch.msgid.link/20251215-rocket-reuse-find-core-v1-1-be86a1d2734c@cherry.de

commit 34f4495a7f72895776b81969639f527c99eb12b9
Author: Quentin Schulz 
Date:   Mon Dec 15 17:36:15 2025 +0100

    accel/rocket: fix unwinding in error path in rocket_probe
    
    When rocket_core_init() fails (as could be the case with EPROBE_DEFER),
    we need to properly unwind by decrementing the counter we just
    incremented and if this is the first core we failed to probe, remove the
    rocket DRM device with rocket_device_fini() as well. This matches the
    logic in rocket_remove(). Failing to properly unwind results in
    out-of-bounds accesses.
    
    Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
    Cc: stable@vger.kernel.org
    Signed-off-by: Quentin Schulz 
    Reviewed-by: Tomeu Vizoso 
    Signed-off-by: Tomeu Vizoso 
    Link: https://patch.msgid.link/20251215-rocket-error-path-v1-2-eec3bf29dc3b@cherry.de

commit f509a081f6a289f7c66856333b3becce7a33c97e
Author: Quentin Schulz 
Date:   Mon Dec 15 17:36:14 2025 +0100

    accel/rocket: fix unwinding in error path in rocket_core_init
    
    When rocket_job_init() is called, iommu_group_get() has already been
    called, therefore we should call iommu_group_put() and make the
    iommu_group pointer NULL. This aligns with what's done in
    rocket_core_fini().
    
    If pm_runtime_resume_and_get() somehow fails, not only should
    rocket_job_fini() be called but we should also unwind everything done
    before that, that is, disable PM, put the iommu_group, NULLify it and
    then call rocket_job_fini(). This is exactly what's done in
    rocket_core_fini() so let's call that function instead of duplicating
    the code.
    
    Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
    Cc: stable@vger.kernel.org
    Signed-off-by: Quentin Schulz 
    Reviewed-by: Tomeu Vizoso 
    Signed-off-by: Tomeu Vizoso 
    Link: https://patch.msgid.link/20251215-rocket-error-path-v1-1-eec3bf29dc3b@cherry.de

commit 69ccb0f338ea00732d51c164ccfcfdb703bf3839
Author: Brian Masney 
Date:   Fri Dec 5 14:46:29 2025 -0500

    clk: microchip: core: remove unused include asm/traps.h
    
    The asm/traps.h include file is not actually used, so let's go ahead and
    remove it.
    
    Signed-off-by: Brian Masney 
    Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-3-a02190705e47@redhat.com
    Signed-off-by: Claudiu Beznea 

commit 5df96d141cccb37f0c3112a22fc1112ea48e9246
Author: Brian Masney 
Date:   Fri Dec 5 14:46:28 2025 -0500

    clk: microchip: core: correct return value on *_get_parent()
    
    roclk_get_parent() and sclk_get_parent() has the possibility of
    returning -EINVAL, however the framework expects this call to always
    succeed since the return value is unsigned.
    
    If there is no parent map defined, then the current value programmed in
    the hardware is used. Let's use that same value in the case where
    -EINVAL is currently returned.
    
    This index is only used by clk_core_get_parent_by_index(), and it
    validates that it doesn't overflow the number of available parents.
    
    Reported-by: kernel test robot 
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/
    Signed-off-by: Brian Masney 
    Reviewed-by: Claudiu Beznea 
    Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com
    Signed-off-by: Claudiu Beznea 

commit 0b0f7e6539a7507689445f8a0cace17305272bfe
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 15:06:45 2026 -0600

    ARM: at91: remove unnecessary of_platform_default_populate calls
    
    The DT core will call of_platform_default_populate, so it is not
    necessary for machine specific code to call it unless there are custom
    match entries, auxdata or parent device. Neither of those apply here, so
    remove the call.
    
    Acked-by: Alexandre Belloni 
    Tested-by: Alexandre Belloni 
    Signed-off-by: Rob Herring (Arm) 
    Link: https://lore.kernel.org/r/20260105-at91-probe-v3-3-594013ff2965@kernel.org
    Signed-off-by: Claudiu Beznea 

commit ef45b853ed8c3a904eaeeccea02b8c2c49891955
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 15:06:44 2026 -0600

    ARM: at91: Move PM init functions to .init_late hook
    
    Move the AT91 PM init functions to .init_late hook to ensure driver
    dependencies have probed.
    
    Acked-by: Alexandre Belloni 
    Tested-by: Alexandre Belloni 
    Signed-off-by: Rob Herring (Arm) 
    Link: https://lore.kernel.org/r/20260105-at91-probe-v3-2-594013ff2965@kernel.org
    Signed-off-by: Claudiu Beznea 

commit d93faac66dc04650d924f8f9584216d14f48fb14
Author: Brian Masney 
Date:   Fri Dec 5 14:46:27 2025 -0500

    clk: microchip: core: remove duplicate determine_rate on pic32_sclk_ops
    
    pic32_sclk_ops previously had a sclk_round_rate() member, and this was
    recently converted over to sclk_determine_rate() with the help of a
    Coccinelle semantic patch. pic32_sclk_ops now has two conflicting
    determine_rate ops members.
    
    Prior to the conversion, pic32_sclk_ops already had a determine_rate
    member that points to __clk_mux_determine_rate(). When both the
    round_rate() and determine_rate() ops are defined, the clk core only
    uses the determine_rate() op. Let's go ahead and drop the recently
    converted sclk_determine_rate() to match the previous functionality
    prior to the conversion.
    
    Fixes: e9f039c08cdc ("clk: microchip: core: convert from round_rate() to determine_rate()")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202511222115.uvHrP95A-lkp@intel.com/
    Signed-off-by: Brian Masney 
    Reviewed-by: Claudiu Beznea 
    Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-1-a02190705e47@redhat.com
    Signed-off-by: Claudiu Beznea 

commit c4a069095395ecd1e936f488511dfd9016b9c479
Author: Dale Whinham 
Date:   Sat Dec 20 16:26:31 2025 +0100

    platform/surface: aggregator_registry: Add Surface Pro 11 (QCOM)
    
    This enables support for the Qualcomm-based Surface Pro 11.
    
    Signed-off-by: Dale Whinham 
    Signed-off-by: Jérôme de Bretagne 
    Reviewed-by: Maximilian Luz 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20251220-surface-sp11-for-next-v6-3-81f7451edb77@gmail.com
    Signed-off-by: Ilpo Järvinen 

commit 4bbfc90122e974ccbd9aa80c964413052b9519f3
Author: Tony Luck 
Date:   Thu Jan 8 09:42:27 2026 -0800

    x86/resctrl: Enable RDT_RESOURCE_PERF_PKG
    
    Since telemetry events are enumerated on resctrl mount the RDT_RESOURCE_PERF_PKG
    resource is not considered "monitoring capable" during early resctrl initialization.
    This means that the domain list for RDT_RESOURCE_PERF_PKG is not built when the CPU
    hotplug notifiers are registered and run for the first time right after resctrl
    initialization.
    
    Mark the RDT_RESOURCE_PERF_PKG as "monitoring capable" upon successful telemetry
    event enumeration to ensure future CPU hotplug events include this resource and
    initialize its domain list for CPUs that are already online.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit d0891647fbc6e931f27517364cbc4ee1811d76db
Author: Tony Luck 
Date:   Wed Dec 17 09:21:15 2025 -0800

    fs/resctrl: Move RMID initialization to first mount
    
    L3 monitor features are enumerated during resctrl initialization and
    rmid_ptrs[] that tracks all RMIDs and depends on the number of supported
    RMIDs is allocated during this time.
    
    Telemetry monitor features are enumerated during first resctrl mount and
    may support a different number of RMIDs compared to L3 monitor features.
    
    Delay allocation and initialization of rmid_ptrs[] until first mount.
    Since the number of RMIDs cannot change on later mounts, keep the same set of
    rmid_ptrs[] until resctrl_exit(). This is required because the limbo handler
    keeps running after resctrl is unmounted and needs to access rmid_ptrs[]
    as it keeps tracking busy RMIDs after unmount.
    
    Rename routines to match what they now do:
    dom_data_init() -> setup_rmid_lru_list()
    dom_data_exit() -> free_rmid_lru_list()
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 0ecc988b0232259cbdb2b7e452bda74f550f0911
Author: Tony Luck 
Date:   Wed Dec 17 09:21:14 2025 -0800

    x86,fs/resctrl: Compute number of RMIDs as minimum across resources
    
    resctrl assumes that only the L3 resource supports monitor events, so it
    simply takes the rdt_resource::num_rmid from RDT_RESOURCE_L3 as the system's
    number of RMIDs.
    
    The addition of telemetry events in a different resource breaks that
    assumption.
    
    Compute the number of available RMIDs as the minimum value across all
    mon_capable resources (analogous to how the number of CLOSIDs is computed
    across alloc_capable resources).
    
    Note that mount time enumeration of the telemetry resource means that
    this number can be reduced. If this happens, then some memory will
    be wasted as the allocations for rdt_l3_mon_domain::mbm_states[] and
    rdt_l3_mon_domain::rmid_busy_llc created during resctrl initialization will
    be larger than needed.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit ee7f6af79f0916b6c49e15edd4cba020b3e4c4ac
Author: Tony Luck 
Date:   Wed Dec 17 09:21:13 2025 -0800

    fs/resctrl: Move allocation/free of closid_num_dirty_rmid[]
    
    closid_num_dirty_rmid[] and rmid_ptrs[] are allocated together during resctrl
    initialization and freed together during resctrl exit.
    
    Telemetry events are enumerated on resctrl mount so only at resctrl mount will
    the number of RMID supported by all monitoring resources and needed as size
    for rmid_ptrs[] be known.
    
    Separate closid_num_dirty_rmid[] and rmid_ptrs[] allocation and free in
    preparation for rmid_ptrs[] to be allocated on resctrl mount.
    
    Keep the rdtgroup_mutex protection around the allocation and free of
    closid_num_dirty_rmid[] as ARM needs this to guarantee memory ordering.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 67640e333b983298be624a41c43e3a8ed4713a73
Author: Tony Luck 
Date:   Wed Dec 17 09:21:12 2025 -0800

    x86/resctrl: Handle number of RMIDs supported by RDT_RESOURCE_PERF_PKG
    
    There are now three meanings for "number of RMIDs":
    
    1) The number for legacy features enumerated by CPUID leaf 0xF. This is the
       maximum number of distinct values that can be loaded into MSR_IA32_PQR_ASSOC.
       Note that systems with Sub-NUMA Cluster mode enabled will force scaling down
       the CPUID enumerated value by the number of SNC nodes per L3-cache.
    
    2) The number of registers in MMIO space for each event. This is enumerated in
       the XML files and is the value initialized into event_group::num_rmid.
    
    3) The number of "hardware counters" (this isn't a strictly accurate
       description of how things work, but serves as a useful analogy that does
       describe the limitations) feeding to those MMIO registers. This is enumerated
       in telemetry_region::num_rmids returned by intel_pmt_get_regions_by_feature().
    
    Event groups with insufficient "hardware counters" to track all RMIDs are
    difficult for users to use, since the system may reassign "hardware counters"
    at any time. This means that users cannot reliably collect two consecutive
    event counts to compute the rate at which events are occurring.
    
    Disable such event groups by default. The user may override this with
    a command line "rdt=" option. In this case limit an under-resourced event
    group's number of possible monitor resource groups to the lowest number of
    "hardware counters".
    
    Scan all enabled event groups and assign the RDT_RESOURCE_PERF_PKG resource
    "num_rmid" value to the smallest of these values as this value will be used
    later to compare against the number of RMIDs supported by other resources to
    determine how many monitoring resource groups are supported.
    
    N.B. Change type of resctrl_mon::num_rmid to u32 to match its usage and the
    type of event_group::num_rmid so that min(r->num_rmid, e->num_rmid) won't
    complain about mixing signed and unsigned types.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 2e666595651ba02128b13e9029d5248cfc2fb702
Author: Rakuram Eswaran 
Date:   Mon Dec 22 22:40:08 2025 +0530

    iommu/amd: Drop incorrect NULL check for iommu in alloc_irq_table()
    
    alloc_irq_table() contains a conditional check for a NULL iommu pointer
    when computing the NUMA node, but the function dereferences iommu
    in multiple places afterwards.
    
    All callers ensure that a valid iommu pointer is passed in, and a NULL
    iommu is not expected by the current callers. Remove the incorrect
    NULL check to make the assumptions consistent and address the Smatch
    warning.
    
    Reported-by: kernel test robot 
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/r/202512191724.meqJENXe-lkp@intel.com/
    Signed-off-by: Rakuram Eswaran 
    Reviewed-by: Ankit Soni 
    Signed-off-by: Joerg Roedel 

commit 16e3423fc755cf9ddcceefaf70869311046928e2
Author: Can Peng 
Date:   Tue Dec 9 15:15:13 2025 +0800

    iommu: simplify list initialization in iommu_create_device_direct_mappings()
    
    Use LIST_HEAD() to declare and initialize the 'mappings' list head in
    iommu_create_device_direct_mappings() instead of separate declaration and
    INIT_LIST_HEAD(). This simplifies the code by combining declaration and
    initialization into a single idiomatic form, improving readability without
    changing functionality.
    
    Signed-off-by: Can Peng 
    Signed-off-by: Joerg Roedel 

commit 0d069bb381839ba252ecca4031f7eb6f2fc72ab4
Author: Christophe Leroy (CS GROUP) 
Date:   Wed Jan 7 17:59:10 2026 +0100

    dt-bindings: soc: fsl: qe: Add an interrupt controller for QUICC Engine Ports
    
    The QUICC Engine provides interrupts for a few I/O ports. This is
    handled via a separate interrupt ID and managed via a triplet of
    dedicated registers hosted by the SoC.
    
    Implement an interrupt driver for it so that those IRQs can then
    be linked to the related GPIOs.
    
    Acked-by: Conor Dooley 
    Link: https://lore.kernel.org/r/7708243d6cca21004de8b3da87369c06dbee3848.1767804922.git.chleroy@kernel.org
    Signed-off-by: Christophe Leroy (CS GROUP) 
    [moved from bindings/soc/fsl/cpm_qe/ to bindings/interrupt-controller/ while applying]

commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf
Author: Ankit Soni 
Date:   Mon Dec 1 14:39:40 2025 +0000

    iommu/amd: move wait_on_sem() out of spinlock
    
    With iommu.strict=1, the existing completion wait path can cause soft
    lockups under stressed environment, as wait_on_sem() busy-waits under the
    spinlock with interrupts disabled.
    
    Move the completion wait in iommu_completion_wait() out of the spinlock.
    wait_on_sem() only polls the hardware-updated cmd_sem and does not require
    iommu->lock, so holding the lock during the busy wait unnecessarily
    increases contention and extends the time with interrupts disabled.
    
    Signed-off-by: Ankit Soni 
    Reviewed-by: Vasant Hegde 
    Signed-off-by: Joerg Roedel 

commit f0bcd784e1b76bc3918433f2bd7e52f56f0dcf22
Author: Christophe Leroy (CS GROUP) 
Date:   Wed Jan 7 17:59:09 2026 +0100

    soc: fsl: qe: Add an interrupt controller for QUICC Engine Ports
    
    The QUICC Engine provides interrupts for a few I/O ports. This is
    handled via a separate interrupt ID and managed via a triplet of
    dedicated registers hosted by the SoC.
    
    Implement an interrupt driver for it so that those IRQs can then
    be linked to the related GPIOs.
    
    Link: https://lore.kernel.org/r/63f19db21a91729d91b3df336a56a7eb4206e561.1767804922.git.chleroy@kernel.org
    Signed-off-by: Christophe Leroy (CS GROUP) 

commit a8258ffed2efdf533bdc756141eeb7bc5301ad4f
Author: Mostafa Saleh 
Date:   Fri Jan 9 17:18:05 2026 +0000

    iommu: debug-pagealloc: Check mapped/unmapped kernel memory
    
    Now, as the page_ext holds count of IOMMU mappings, we can use it to
    assert that any page allocated/freed is indeed not in the IOMMU.
    
    The sanitizer doesn’t protect against mapping/unmapping during this
    period. However, that’s less harmful as the page is not used by the
    kernel.
    
    Reviewed-by: Samiullah Khawaja 
    Reviewed-by: Lu Baolu 
    Signed-off-by: Mostafa Saleh 
    Reviewed-by: Pranjal Shrivastava 
    Signed-off-by: Joerg Roedel 

commit 7e84593795b3c05ca682b8aa74cceeceae636ec7
Author: Mostafa Saleh 
Date:   Fri Jan 9 17:18:04 2026 +0000

    iommu: debug-pagealloc: Track IOMMU pages
    
    Using the new calls, use an atomic refcount to track how many times
    a page is mapped in any of the IOMMUs.
    
    For unmap we need to use iova_to_phys() to get the physical address
    of the pages.
    
    We use the smallest supported page size as the granularity of tracking
    per domain.
    This is important as it is possible to map pages and unmap them with
    larger sizes (as in map_sg()) cases.
    
    Reviewed-by: Samiullah Khawaja 
    Reviewed-by: Lu Baolu 
    Signed-off-by: Mostafa Saleh 
    Reviewed-by: Pranjal Shrivastava 
    Signed-off-by: Joerg Roedel 

commit ccc21213f013834b484cdcc738e282f963fcfc97
Author: Mostafa Saleh 
Date:   Fri Jan 9 17:18:03 2026 +0000

    iommu: Add calls for IOMMU_DEBUG_PAGEALLOC
    
    Add calls for the new iommu debug config IOMMU_DEBUG_PAGEALLOC:
    - iommu_debug_init: Enable the debug mode if configured by the user.
    - iommu_debug_map: Track iommu pages mapped, using physical address.
    - iommu_debug_unmap_begin: Track start of iommu unmap operation, with
      IOVA and size.
    - iommu_debug_unmap_end: Track the end of unmap operation, passing the
      actual unmapped size versus the tracked one at unmap_begin.
    
    We have to do the unmap_begin/end as once pages are unmapped we lose
    the information of the physical address.
    This is racy, but the API is racy by construction as it uses refcounts
    and doesn't attempt to lock/synchronize with the IOMMU API as that will
    be costly, meaning that possibility of false negative exists.
    
    Reviewed-by: Samiullah Khawaja 
    Reviewed-by: Lu Baolu 
    Reviewed-by: Pranjal Shrivastava 
    Signed-off-by: Mostafa Saleh 
    Signed-off-by: Joerg Roedel 

commit 466ae6978a5b8c6022bd4537fbfd00e94bb07219
Author: Mostafa Saleh 
Date:   Fri Jan 9 17:18:02 2026 +0000

    iommu: Add page_ext for IOMMU_DEBUG_PAGEALLOC
    
    Add a new config IOMMU_DEBUG_PAGEALLOC, which registers new data to
    page_ext.
    
    This config will be used by the IOMMU API to track pages mapped in
    the IOMMU to catch drivers trying to free kernel memory that they
    still map in their domains, causing all types of memory corruption.
    
    This behaviour is disabled by default and can be enabled using
    kernel cmdline iommu.debug_pagealloc.
    
    Acked-by: David Hildenbrand (Red Hat) 
    Reviewed-by: Pranjal Shrivastava 
    Reviewed-by: Lu Baolu 
    Signed-off-by: Mostafa Saleh 
    Signed-off-by: Joerg Roedel 

commit 1547d41f9f19d691c2c9ce4c29f746297baef9e9
Author: Günther Noack 
Date:   Fri Jan 9 13:25:58 2026 +0100

    HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
    
    Do not crash when a report has no fields.
    
    Fake USB gadgets can send their own HID report descriptors and can define report
    structures without valid fields.  This can be used to crash the kernel over USB.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Günther Noack 
    Signed-off-by: Jiri Kosina 

commit cee8337e1bad168136aecfe6416ecd7d3aa7529a
Author: Günther Noack 
Date:   Fri Jan 9 11:58:08 2026 +0100

    HID: prodikeys: Check presence of pm->input_ep82
    
    Fake USB devices can send their own report descriptors for which the
    input_mapping() hook does not get called.  In this case, pm->input_ep82 stays
    NULL, which leads to a crash later.
    
    This does not happen with the real device, but can be provoked by imposing as
    one.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Günther Noack 
    Signed-off-by: Jiri Kosina 

commit f5b16b802174fe2b67e2b6a27fa793b749981816
Author: Nicolin Chen 
Date:   Mon Dec 15 13:42:20 2025 -0800

    PCI: Suspend iommu function prior to resetting a device
    
    PCIe permits a device to ignore ATS invalidation TLPs while processing a
    reset. This creates a problem visible to the OS where an ATS invalidation
    command will time out: e.g. an SVA domain will have no coordination with a
    reset event and can racily issue ATS invalidations to a resetting device.
    
    The PCIe r6.0, sec 10.3.1 IMPLEMENTATION NOTE recommends SW to disable and
    block ATS before initiating a Function Level Reset. It also mentions that
    other reset methods could have the same vulnerability as well.
    
    The IOMMU subsystem provides pci_dev_reset_iommu_prepare/done() callback
    helpers for this matter. Use them in all the existing reset functions.
    
    This will attach the device to its iommu_group->blocking_domain during the
    device reset, so as to allow IOMMU driver to:
     - invoke pci_disable_ats() and pci_enable_ats(), if necessary
     - wait for all ATS invalidations to complete
     - stop issuing new ATS invalidations
     - fence any incoming ATS queries
    
    Reviewed-by: Kevin Tian 
    Reviewed-by: Jason Gunthorpe 
    Acked-by: Bjorn Helgaas 
    Tested-by: Dheeraj Kumar Srivastava 
    Signed-off-by: Nicolin Chen 
    Signed-off-by: Joerg Roedel 

commit c279e83953d937470f8a6e69b69f62608714f13f
Author: Nicolin Chen 
Date:   Mon Dec 15 13:42:19 2025 -0800

    iommu: Introduce pci_dev_reset_iommu_prepare/done()
    
    PCIe permits a device to ignore ATS invalidation TLPs while processing a
    reset. This creates a problem visible to the OS where an ATS invalidation
    command will time out. E.g. an SVA domain will have no coordination with a
    reset event and can racily issue ATS invalidations to a resetting device.
    
    The OS should do something to mitigate this as we do not want production
    systems to be reporting critical ATS failures, especially in a hypervisor
    environment. Broadly, OS could arrange to ignore the timeouts, block page
    table mutations to prevent invalidations, or disable and block ATS.
    
    The PCIe r6.0, sec 10.3.1 IMPLEMENTATION NOTE recommends SW to disable and
    block ATS before initiating a Function Level Reset. It also mentions that
    other reset methods could have the same vulnerability as well.
    
    Provide a callback from the PCI subsystem that will enclose the reset and
    have the iommu core temporarily change all the attached RID/PASID domains
    group->blocking_domain so that the IOMMU hardware would fence any incoming
    ATS queries. And IOMMU drivers should also synchronously stop issuing new
    ATS invalidations and wait for all ATS invalidations to complete. This can
    avoid any ATS invaliation timeouts.
    
    However, if there is a domain attachment/replacement happening during an
    ongoing reset, ATS routines may be re-activated between the two function
    calls. So, introduce a new resetting_domain in the iommu_group structure
    to reject any concurrent attach_dev/set_dev_pasid call during a reset for
    a concern of compatibility failure. Since this changes the behavior of an
    attach operation, update the uAPI accordingly.
    
    Note that there are two corner cases:
     1. Devices in the same iommu_group
        Since an attachment is always per iommu_group, this means that any
        sibling devices in the iommu_group cannot change domain, to prevent
        race conditions.
     2. An SR-IOV PF that is being reset while its VF is not
        In such case, the VF itself is already broken. So, there is no point
        in preventing PF from going through the iommu reset.
    
    Reviewed-by: Lu Baolu 
    Reviewed-by: Kevin Tian 
    Reviewed-by: Jason Gunthorpe 
    Tested-by: Dheeraj Kumar Srivastava 
    Signed-off-by: Nicolin Chen 
    Signed-off-by: Joerg Roedel 

commit a75b2be249d60eff6015737f6c3e94935b541068
Author: Nicolin Chen 
Date:   Mon Dec 15 13:42:18 2025 -0800

    iommu: Add iommu_driver_get_domain_for_dev() helper
    
    There is a need to stage a resetting PCI device to temporarily the blocked
    domain and then attach back to its previously attached domain after reset.
    
    This can be simply done by keeping the "previously attached domain" in the
    iommu_group->domain pointer while adding an iommu_group->resetting_domain,
    which gives troubles to IOMMU drivers using the iommu_get_domain_for_dev()
    for a device's physical domain in order to program IOMMU hardware.
    
    And in such for-driver use cases, the iommu_group->mutex must be held, so
    it doesn't fit in external callers that don't hold the iommu_group->mutex.
    
    Introduce a new iommu_driver_get_domain_for_dev() helper, exclusively for
    driver use cases that hold the iommu_group->mutex, to separate from those
    external use cases.
    
    Add a lockdep_assert_not_held to the existing iommu_get_domain_for_dev()
    and highlight that in a kdoc.
    
    Reviewed-by: Kevin Tian 
    Reviewed-by: Lu Baolu 
    Reviewed-by: Jason Gunthorpe 
    Tested-by: Dheeraj Kumar Srivastava 
    Signed-off-by: Nicolin Chen 
    Signed-off-by: Joerg Roedel 

commit 4a73abb965b7546864957d2bde428f1e72bc3bb5
Author: Nicolin Chen 
Date:   Mon Dec 15 13:42:17 2025 -0800

    iommu: Tidy domain for iommu_setup_dma_ops()
    
    This function can only be called on the default_domain. Trivally pass it
    in. In all three existing cases, the default domain was just attached to
    the device.
    
    This avoids iommu_setup_dma_ops() calling iommu_get_domain_for_dev() that
    will be used by external callers.
    
    Suggested-by: Jason Gunthorpe 
    Reviewed-by: Kevin Tian 
    Reviewed-by: Lu Baolu 
    Reviewed-by: Jason Gunthorpe 
    Tested-by: Dheeraj Kumar Srivastava 
    Signed-off-by: Nicolin Chen 
    Signed-off-by: Joerg Roedel 

commit 5d5388b0e190b6decb964d3711473b7010bf1f6f
Author: Nicolin Chen 
Date:   Mon Dec 15 13:42:16 2025 -0800

    iommu: Lock group->mutex in iommu_deferred_attach()
    
    The iommu_deferred_attach() function invokes __iommu_attach_device(), but
    doesn't hold the group->mutex like other __iommu_attach_device() callers.
    
    Though there is no pratical bug being triggered so far, it would be better
    to apply the same locking to this __iommu_attach_device(), since the IOMMU
    drivers nowaday are more aware of the group->mutex -- some of them use the
    iommu_group_mutex_assert() function that could be potentially in the path
    of an attach_dev callback function invoked by the __iommu_attach_device().
    
    Worth mentioning that the iommu_deferred_attach() will soon need to check
    group->resetting_domain that must be locked also.
    
    Thus, grab the mutex to guard __iommu_attach_device() like other callers.
    
    Reviewed-by: Jason Gunthorpe 
    Reviewed-by: Kevin Tian 
    Reviewed-by: Lu Baolu 
    Tested-by: Dheeraj Kumar Srivastava 
    Signed-off-by: Nicolin Chen 
    Reviewed-by: Samiullah Khawaja 
    Signed-off-by: Joerg Roedel 

commit 17abd396548035fbd6179ee1a431bd75d49676a7
Author: Günther Noack 
Date:   Fri Jan 9 11:57:14 2026 +0100

    HID: magicmouse: Do not crash on missing msc->input
    
    Fake USB devices can send their own report descriptors for which the
    input_mapping() hook does not get called.  In this case, msc->input stays NULL,
    leading to a crash at a later time.
    
    Detect this condition in the input_configured() hook and reject the device.
    
    This is not supposed to happen with actual magic mouse devices, but can be
    provoked by imposing as a magic mouse USB device.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Günther Noack 
    Signed-off-by: Jiri Kosina 

commit bbf992775faa66d6c94097c2be9a0d254681a419
Author: Rosalie Wanders 
Date:   Fri Jan 2 22:12:28 2026 +0100

    HID: sony: add support for Rock Band 4 PS4 and PS5 guitars
    
    This commit adds support for the PDP RiffMaster and the CRKD Gibson SG
    in both their PS4 and PS5 modes.
    
    These devices aren't mapped correctly without these changes, they also
    lack support for their whammy and tilt functionality which this patch
    adds support for by binding them to the left and right triggers.
    
    Signed-off-by: Rosalie Wanders 
    Signed-off-by: Jiri Kosina 

commit f631011e36b87b173b71c7592b558ad05d791228
Author: Connor Belli 
Date:   Mon Dec 8 19:00:08 2025 -0500

    HID: hid-asus: Implement fn lock for Asus ProArt P16
    
    This patch implements support for the fn lock key on the 2025 Asus
    ProArt P16. The implementation for this is based on how fn lock is
    implemented in the hid-lenovo driver.
    
    Signed-off-by: Connor Belli 
    Signed-off-by: Jiri Kosina 

commit 3756a272d2cf356d2203da8474d173257f5f8521
Author: Oliver Neukum 
Date:   Wed Nov 19 10:09:57 2025 +0100

    HID: hid-pl: handle probe errors
    
    Errors in init must be reported back or we'll
    follow a NULL pointer the first time FF is used.
    
    Fixes: 20eb127906709 ("hid: force feedback driver for PantherLord USB/PS2 2in1 Adapter")
    Cc: stable@vger.kernel.org
    Signed-off-by: Oliver Neukum 
    Signed-off-by: Jiri Kosina 

commit e01a029654f7fb67d7151365410aa22be4e63dbe
Author: Tomasz Pakuła 
Date:   Sat Nov 29 19:46:14 2025 +0100

    HID: pidff: Do not set out of range trigger button
    
    Some games (mainly observed with Kylotonn's WRC Serises) set trigger
    button to a random value, or always the same one, out of range.
    I observed 307 and other values but, for example, my Moza R9 only
    exposes 128 buttons AND it's trigger button field is 8-bit. This causes
    errors to appear in dmesg.
    
    Only set the trigger button and trigger interval in the trigger button
    is in range of the field.
    
    Signed-off-by: Tomasz Pakuła 
    Signed-off-by: Jiri Kosina 

commit 822bc5b3744b0b2c2c9678aa1d80b2cf04fdfabf
Author: Brian Howard 
Date:   Tue Dec 2 21:35:47 2025 -0500

    HID: multitouch: add quirks for Lenovo Yoga Book 9i
    
    The Lenovo Yoga Book 9i is a dual-screen laptop, with a single composite
    USB device providing both touch and tablet interfaces for both screens.
    All inputs report through a single device, differentiated solely by report
    numbers. As there is no way for udev to differentiate the inputs based on
    USB vendor/product ID or interface numbers, custom naming is required to
    match against for downstream configuration. A firmware bug also results
    in an erroneous InRange message report being received after the stylus
    leaves proximity, blocking later touch events. Add required quirks for
    Gen 8 to Gen 10 models, including a new quirk providing for custom input
    device naming and dropping erroneous InRange reports.
    
    Signed-off-by: Brian Howard 
    Tested-by: Brian Howard 
    Tested-by: Kris Fredrick 
    Reported-by: Andrei Shumailov 
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220386
    Signed-off-by: Jiri Kosina 

commit e6807641ac94e832988655a1c0e60ccc806b76dc
Author: Haotian Zhang 
Date:   Mon Nov 17 16:28:08 2025 +0800

    HID: playstation: Add missing check for input_ff_create_memless
    
    The ps_gamepad_create() function calls input_ff_create_memless()
    without verifying its return value,  which can lead to incorrect
    behavior or potential crashes when FF effects are triggered.
    
    Add a check for the return value of input_ff_create_memless().
    
    Fixes: 51151098d7ab ("HID: playstation: add DualSense classic rumble support.")
    Signed-off-by: Haotian Zhang 
    Signed-off-by: Jiri Kosina 

commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799
Author: Joey Bednar 
Date:   Wed Nov 12 06:06:23 2025 +0000

    HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
    
    The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium
    Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX
    KN85 Keyboard" to the list of non-apple keyboards fixes the function
    keys.
    
    Signed-off-by: Joey Bednar 
    Signed-off-by: Jiri Kosina 

commit b3b1c68fb726907ea35ac172906705fe62c7fdaf
Author: Nguyen Dinh Dang Duong 
Date:   Sat Jun 28 00:04:23 2025 +0700

    HID: rapoo: Add support for side buttons on RAPOO 0x2015 mouse
    
    This patch adds support for handling the side buttons
    on the RAPOO 0x2015 wireless mouse. These buttons were
    previously not generating input events due to missing
    driver logic.
    
    The new code handles raw HID input report with Report
    ID 1 and maps the side buttons to KEY_BACK and KEY_FORWARD
    using the input subsystem.
    
    Tested on a RAPOO mouse with USB ID 24AE:2015.
    
    Signed-off-by: Nguyen Dinh Dang Duong 
    Signed-off-by: Jiri Kosina 

commit ccf9e070116a81d29aae30db501d562c8efd1ed8
Author: Alice Ryhl 
Date:   Thu Dec 18 12:10:23 2025 +0000

    rust: sync: Inline various lock related methods
    
    While debugging a different issue [1], the following relocation was
    noticed in the rust_binder.ko file:
    
            R_AARCH64_CALL26        _RNvXNtNtNtCsdfZWD8DztAw_6kernel4sync4lock8spinlockNtB2_15SpinLockBackendNtB4_7Backend6unlock
    
    This relocation (and a similar one for lock) occurred many times
    throughout the module. That is not really useful because all this
    function does is call spin_unlock(), so what we actually want here is
    that a call to spin_unlock() dirctly is generated in favor of this
    wrapper method.
    
    Thus, mark these methods inline.
    
    [boqun: Reword the commit message a bit]
    
    Link: https://lore.kernel.org/p/20251111-binder-fix-list-remove-v1-0-8ed14a0da63d@google.com
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Daniel Almeida 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251218-inline-lock-unlock-v2-1-fbadac8bd61b@google.com

commit 2940a49ab7e31e9fc4f43637dc9ef75b5e8951d4
Author: Vladimir Zapolskiy 
Date:   Sat Jan 10 03:45:24 2026 +0200

    arm: dts: lpc32xx: add interrupts property to Motor Control PWM
    
    Motor Control PWM shares an interrupt line with TIMER4 on MIC interrupt
    controller, the interrupt serves as period (timer limit), pulse-width (match)
    and capture event interrupt.
    
    Signed-off-by: Vladimir Zapolskiy 

commit 71630e581a0e34c03757f5c1706f57c853b92555
Author: Vladimir Zapolskiy 
Date:   Mon Dec 29 00:49:07 2025 +0200

    arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node
    
    Motor Control PWM depends on its own supply clock, the clock gate control
    is present in TIMCLK_CTRL1 register.
    
    Fixes: b7d41c937ed7 ("ARM: LPC32xx: Add the motor PWM to base dts file")
    Signed-off-by: Vladimir Zapolskiy 

commit 72dc44679b14dc62a588b1b18a1ae98284329515
Author: Rob Herring (Arm) 
Date:   Thu Jan 8 16:53:18 2026 -0600

    dt-bindings: net: rockchip-dwmac: Allow "dma-coherent"
    
    The GMAC is coherent on RK3576, so allow the "dma-coherent" property.
    
    Signed-off-by: Rob Herring (Arm) 
    Reviewed-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20260108225318.1325114-2-robh@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 68ec2b9fc59e8053f17ee1d1a5b1959c43a19202
Author: Jakub Kicinski 
Date:   Wed Jan 7 06:53:19 2026 -0800

    selftests: forwarding: update PTP tcpdump patterns
    
    Recent version of tcpdump (tcpdump-4.99.6-1.fc43.x86_64) seems to have
    removed the spurious space after msg type in PTP info, e.g.:
    
     before:  PTPv2, majorSdoId: 0x0, msg type : sync msg, length: 44
     after:   PTPv2, majorSdoId: 0x0, msg type: sync msg, length: 44
    
    Update our patterns to match both.
    
    Reviewed-by: Alexander Sverdlin 
    Link: https://patch.msgid.link/20260107145320.1837464-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit a0ac0ff382767a5dbde266fb5f7997a5d6b70e10
Author: Jakub Kicinski 
Date:   Wed Jan 7 15:25:57 2026 -0800

    selftests: drv-net: gro: increase the rcvbuf size
    
    The gro.py test (testing software GRO) is slightly flaky when
    running against fbnic. We see one flake per roughly 20 runs in NIPA,
    mostly in ipip.large, and always including some EAGAIN:
    
      # Shouldn't coalesce if exceed IP max pkt size: Test succeeded
      # Expected {65475 899 }, Total 2 packets
      # Received {65475 899 }, Total 2 packets.
      # Expected {64576 900 900 }, Total 3 packets
      # Received {64576 /home/virtme/testing/wt-24/tools/testing/selftests/drivers/net/gro: could not receive: Resource temporarily unavailable
    
    The test sends 2 large frames (64k + change). Looks like the default
    packet socket rcvbuf (~200kB) may not be large enough to hold them.
    Bump the rcvbuf to 1MB.
    
    Add a debug print showing socket statistics to make debugging this
    issue easier in the future. Without the rcvbuf increase we see:
    
      # Shouldn't coalesce if exceed IP max pkt size: Test succeeded
      # Expected {65475 899 }, Total 2 packets
      # Received {65475 899 }, Total 2 packets.
      # Expected {64576 900 900 }, Total 3 packets
      # Received {64576 Socket stats: packets=7, drops=3
                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      # /home/virtme/testing/wt-24/tools/testing/selftests/drivers/net/gro: could not receive: Resource temporarily unavailable
    
    Reviewed-by: Willem de Bruijn 
    Link: https://patch.msgid.link/20260107232557.2147760-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit 96ea4fa60c4528d95bdbce7f4212c015ab3e8113
Author: Jakub Kicinski 
Date:   Tue Jan 6 12:02:05 2026 -0800

    selftests: tls: avoid flakiness in data_steal
    
    We see the following failure a few times a week:
    
      #  RUN           global.data_steal ...
      # tls.c:3280:data_steal:Expected recv(cfd, buf2, sizeof(buf2), MSG_DONTWAIT) (10000) == -1 (-1)
      # data_steal: Test failed
      #          FAIL  global.data_steal
      not ok 8 global.data_steal
    
    The 10000 bytes read suggests that the child process did a recv()
    of half of the data using the TLS ULP and we're now getting the
    remaining half. The intent of the test is to get the child to
    enter _TCP_ recvmsg handler, so it needs to enter the syscall before
    parent installed the TLS recvmsg with setsockopt(SOL_TLS).
    
    Instead of the 10msec sleep send 1 byte of data and wait for the
    child to consume it.
    
    Reviewed-by: Sabrina Dubroca 
    Link: https://patch.msgid.link/20260106200205.1593915-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit e254b758976f651c47ec902d92306bd49f452ab0
Author: Andy Shevchenko 
Date:   Mon Dec 29 15:43:25 2025 +0100

    driver core: make bus_find_device_by_acpi_dev() stub prototype aligned
    
    Currently the bus_find_device_by_acpi_dev() stub for !CONFIG_ACPI case
    takes a const void * parameter instead of const struct acpi_device *.
    As long as it's a pointer, we may named it as we want to with the help
    of a forward declaration. Hence move the declaration out of the
    ifdeffery and use the same prototype in both cases. This adds a bit of
    an additional type checking at a compilation time.
    
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20251229144325.1252197-1-andriy.shevchenko@linux.intel.com
    [ Fix minor typo in the commit message. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 5714ca8cba5ed736f3733663c446cbee63a10a64
Author: Varun R Mallya 
Date:   Wed Jan 7 05:05:27 2026 +0530

    libbpf: Fix OOB read in btf_dump_get_bitfield_value
    
    When dumping bitfield data, btf_dump_get_bitfield_value() reads data
    based on the underlying type's size (t->size). However, it does not
    verify that the provided data buffer (data_sz) is large enough to
    contain these bytes.
    
    If btf_dump__dump_type_data() is called with a buffer smaller than
    the type's size, this leads to an out-of-bounds read. This was
    confirmed by AddressSanitizer in the linked issue.
    
    Fix this by ensuring we do not read past the provided data_sz limit.
    
    Fixes: a1d3cc3c5eca ("libbpf: Avoid use of __int128 in typed dump display")
    Reported-by: Harrison Green 
    Suggested-by: Alan Maguire 
    Signed-off-by: Varun R Mallya 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20260106233527.163487-1-varunrmallya@gmail.com
    
    Closes: https://github.com/libbpf/libbpf/issues/928

commit 86063a2568b8f2eeb68da1411b320c0ff778f852
Author: Xiaochen Shen 
Date:   Wed Dec 17 11:04:56 2025 +0800

    selftests/resctrl: Fix non-contiguous CBM check for Hygon
    
    The resctrl selftest currently fails on Hygon CPUs that always supports
    non-contiguous CBM, printing the error:
    
      "# Hardware and kernel differ on non-contiguous CBM support!"
    
    This occurs because the arch_supports_noncont_cat() function lacks
    vendor detection for Hygon CPUs, preventing proper identification of
    their non-contiguous CBM capability.
    
    Fix this by adding Hygon vendor ID detection to
    arch_supports_noncont_cat().
    
    Link: https://lore.kernel.org/r/20251217030456.3834956-5-shenxiaochen@open-hieco.net
    Signed-off-by: Xiaochen Shen 
    Reviewed-by: Reinette Chatre 
    Reviewed-by: Fenghua Yu 
    Signed-off-by: Shuah Khan 

commit 367f931e6476747edbde4e7c7b95fc5d5b724934
Author: Xiaochen Shen 
Date:   Wed Dec 17 11:04:55 2025 +0800

    selftests/resctrl: Add CPU vendor detection for Hygon
    
    The resctrl selftest currently fails on Hygon CPUs that support Platform
    QoS features, printing the error:
    
      "# Can not get vendor info..."
    
    This occurs because vendor detection is missing for Hygon CPUs.
    
    Fix this by extending the CPU vendor detection logic to include
    Hygon's vendor ID.
    
    Link: https://lore.kernel.org/r/20251217030456.3834956-4-shenxiaochen@open-hieco.net
    Signed-off-by: Xiaochen Shen 
    Reviewed-by: Reinette Chatre 
    Signed-off-by: Shuah Khan 

commit 4f4f01cc333e97b0e63b61ed1a65c928aa662f99
Author: Xiaochen Shen 
Date:   Wed Dec 17 11:04:54 2025 +0800

    selftests/resctrl: Define CPU vendor IDs as bits to match usage
    
    The CPU vendor IDs are required to be unique bits because they're used
    for vendor_specific bitmask in the struct resctrl_test.
    Consider for example their usage in test_vendor_specific_check():
            return get_vendor() & test->vendor_specific
    
    However, the definitions of CPU vendor IDs in file resctrl.h is quite
    subtle as a bitmask value:
      #define ARCH_INTEL     1
      #define ARCH_AMD       2
    
    A clearer and more maintainable approach is to define these CPU vendor
    IDs using BIT(). This ensures each vendor corresponds to a distinct bit
    and makes it obvious when adding new vendor IDs.
    
    Accordingly, update the return types of detect_vendor() and get_vendor()
    from 'int' to 'unsigned int' to align with their usage as bitmask values
    and to prevent potentially risky type conversions.
    
    Furthermore, introduce a bool flag 'initialized' to simplify the
    get_vendor() -> detect_vendor() logic. This ensures the vendor ID is
    detected only once and resolves the ambiguity of using the same variable
    'vendor' both as a value and as a state.
    
    Link: https://lore.kernel.org/r/20251217030456.3834956-3-shenxiaochen@open-hieco.net
    Suggested-by: Reinette Chatre 
    Suggested-by: Fenghua Yu 
    Signed-off-by: Xiaochen Shen 
    Reviewed-by: Reinette Chatre 
    Signed-off-by: Shuah Khan 

commit 671ef08d9455f5754d1fc96f5a14e357d6b80936
Author: Xiaochen Shen 
Date:   Wed Dec 17 11:04:53 2025 +0800

    selftests/resctrl: Fix a division by zero error on Hygon
    
    Change to adjust effective L3 cache size with SNC enabled change
    introduced the snc_nodes_per_l3_cache() function to detect the Intel
    Sub-NUMA Clustering (SNC) feature by comparing #CPUs in node0 with #CPUs
    sharing LLC with CPU0. The function was designed to return:
      (1) >1: SNC mode is enabled.
      (2)  1: SNC mode is not enabled or not supported.
    
    However, on certain Hygon CPUs, #CPUs sharing LLC with CPU0 is actually
    less than #CPUs in node0. This results in snc_nodes_per_l3_cache()
    returning 0 (calculated as cache_cpus / node_cpus).
    
    This leads to a division by zero error in get_cache_size():
      *cache_size /= snc_nodes_per_l3_cache();
    
    Causing the resctrl selftest to fail with:
      "Floating point exception (core dumped)"
    
    Fix the issue by ensuring snc_nodes_per_l3_cache() returns 1 when SNC
    mode is not supported on the platform.
    
    Updated commit log to fix commit has issues:
    Shuah Khan 
    
    Link: https://lore.kernel.org/r/20251217030456.3834956-2-shenxiaochen@open-hieco.net
    Fixes: a1cd99e700ec ("selftests/resctrl: Adjust effective L3 cache size with SNC enabled")
    Signed-off-by: Xiaochen Shen 
    Reviewed-by: Reinette Chatre 
    Reviewed-by: Fenghua Yu 
    Signed-off-by: Shuah Khan 

commit 98466abe4ed949d6ae40bf3e2b1739e9ddd74af9
Author: Xin Wang 
Date:   Fri Jan 9 09:30:06 2026 +0000

    drm/xe: Allow compressible surfaces to be 1-way coherent
    
    Previously, compressible surfaces were required to be non-coherent
    (allocated as WC) because compression and coherency were mutually
    exclusive. Starting with Xe3, hardware supports combining compression
    with 1-way coherency, allowing compressible surfaces to be allocated as
    WB memory. This provides applications with more efficient memory
    allocation by avoiding WC allocation overhead that can cause system
    stuttering and memory management challenges.
    
    The implementation adds support for compressed+coherent PAT entry for
    the xe3_lpg devices and updates the driver logic to handle the new
    compression capabilities.
    
    v2: (Matthew Auld)
     - Improved error handling with XE_IOCTL_DBG()
     - Enhanced documentation and comments
     - Fixed xe_bo_needs_ccs_pages() outdated compression assumptions
    
    v3:
     - Improve WB compression support detection by checking PAT table
       instead of version check
    
    v4:
     - Add XE_CACHE_WB_COMPRESSION, which simplifies the logic.
    
    v5:
     - Use U16_MAX for the invalid PAT index. (Matthew Auld)
    
    Bspec: 71582, 59361, 59399
    Cc: Matthew Auld 
    Cc: Matt Roper 
    Signed-off-by: Xin Wang 
    Reviewed-by: Matthew Auld 
    Link: https://patch.msgid.link/20260109093007.546784-1-x.wang@intel.com
    Signed-off-by: Matt Roper 

commit 842e7f97d71a4116a650ec0045d6444b4377b512
Author: Tony Luck 
Date:   Wed Dec 17 09:21:11 2025 -0800

    x86/resctrl: Add energy/perf choices to rdt boot option
    
    Legacy resctrl features are enumerated by X86_FEATURE_* flags. These may be
    overridden by quirks to disable features in the case of errata.  Users can use
    kernel command line options to either disable a feature, or to force enable
    a feature that was disabled by a quirk.
    
    A different approach is needed for hardware features that do not have an
    X86_FEATURE_* flag.
    
    Update parsing of the "rdt=" boot parameter to call the telemetry driver
    directly to handle new "perf" and "energy" options that controls activation of
    telemetry monitoring of the named type. By itself a "perf" or "energy" option
    controls the forced enabling or disabling (with ! prefix) of all event groups
    of the named type. A ":guid" suffix allows for fine grained control per event
    group.
    
      [ bp: s/intel_aet_option/intel_handle_aet_option/g ]
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit f4e0cd80d3e7c31327459008b01d63804838a89d
Author: Tony Luck 
Date:   Wed Dec 17 09:21:10 2025 -0800

    x86,fs/resctrl: Handle domain creation/deletion for RDT_RESOURCE_PERF_PKG
    
    The L3 resource has several requirements for domains. There are per-domain
    structures that hold the 64-bit values of counters, and elements to keep
    track of the overflow and limbo threads.
    
    None of these are needed for the PERF_PKG resource. The hardware counters
    are wide enough that they do not wrap around for decades.
    
    Define a new rdt_perf_pkg_mon_domain structure which just consists of the
    standard rdt_domain_hdr to keep track of domain id and CPU mask.
    
    Update resctrl_online_mon_domain() for RDT_RESOURCE_PERF_PKG. The only action
    needed for this resource is to create and populate domain directories if a
    domain is added while resctrl is mounted.
    
    Similarly resctrl_offline_mon_domain() only needs to remove domain directories.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 93d9fd89995181d7ff420752328cc8b4b228f100
Author: Tony Luck 
Date:   Wed Dec 17 09:21:09 2025 -0800

    fs/resctrl: Refactor rmdir_mondata_subdir_allrdtgrp()
    
    Clearing a monitor group's mon_data directory is complicated because of the
    support for Sub-NUMA Cluster (SNC) mode.
    
    Refactor the SNC case into a helper function to make it easier to add support
    for a new telemetry resource.
    
    Suggested-by: Reinette Chatre 
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 0ec1db4cac8239bb32da87586c3638200b65dd8c
Author: Tony Luck 
Date:   Wed Dec 17 09:21:08 2025 -0800

    fs/resctrl: Refactor mkdir_mondata_subdir()
    
    Population of a monitor group's mon_data directory is unreasonably complicated
    because of the support for Sub-NUMA Cluster (SNC) mode.
    
    Split out the SNC code into a helper function to make it easier to add support
    for a new telemetry resource.
    
    Move all the duplicated code to make and set owner of domain directories into
    the mon_add_all_files() helper and rename to _mkdir_mondata_subdir().
    
    Suggested-by: Reinette Chatre 
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 51541f6ca7718d8278e12fe80af80033268743b2
Author: Tony Luck 
Date:   Wed Dec 17 09:21:07 2025 -0800

    x86/resctrl: Read telemetry events
    
    Introduce intel_aet_read_event() to read telemetry events for resource
    RDT_RESOURCE_PERF_PKG. There may be multiple aggregators tracking each
    package, so scan all of them and add up all counters. Aggregators may return
    an invalid data indication if they have received no records for a given RMID.
    The user will see "Unavailable" if none of the aggregators on a package
    provide valid counts.
    
    Resctrl now uses readq() so depends on X86_64. Update Kconfig.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 7e6df9614546ae7eb1f1b2074d7b6039bb01540d
Author: Tony Luck 
Date:   Wed Dec 17 09:21:06 2025 -0800

    x86/resctrl: Find and enable usable telemetry events
    
    Every event group has a private copy of the data of all telemetry event
    aggregators (aka "telemetry regions") tracking its feature type. Included
    may be regions that have the same feature type but tracking different GUID
    from the event group's.
    
    Traverse the event group's telemetry region data and mark all regions that
    are not usable by the event group as unusable by clearing those regions'
    MMIO addresses. A region is considered unusable if:
    1) GUID does not match the GUID of the event group.
    2) Package ID is invalid.
    3) The enumerated size of the MMIO region does not match the expected
       value from the XML description file.
    
    Hereafter any telemetry region with an MMIO address is considered valid for
    the event group it is associated with.
    
    Enable all the event group's events as long as there is at least one usable
    region from where data for its events can be read. Enabling of an event can
    fail if the same event has already been enabled as part of another event
    group. It should never happen that the same event is described by different
    GUID supported by the same system so just WARN (via resctrl_enable_mon_event())
    and skip the event.
    
    Note that it is architecturally possible that some telemetry events are only
    supported by a subset of the packages in the system. It is not expected that
    systems will ever do this. If they do the user will see event files in resctrl
    that always return "Unavailable".
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 24b09e849139f92bce0bb966f21409c95c60564a
Author: Huisong Li 
Date:   Tue Dec 23 18:09:14 2025 +0800

    ACPI: processor: Do not expose global variable acpi_idle_driver
    
    Move the cpuidle driver check from __acpi_processor_start() to
    acpi_processor_power_init() which allows variable acpi_idle_driver to
    become static.
    
    No intentional functional impact.
    
    Signed-off-by: Huisong Li 
    Tested-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251223100914.2407069-7-lihuisong@huawei.com
    Signed-off-by: Rafael J. Wysocki 

commit d8e43c89cf08ffea4825a24fb8dfd8bde4de9bb1
Author: Huisong Li 
Date:   Tue Dec 23 18:09:13 2025 +0800

    ACPI: processor: idle: Rearrange declarations in header file
    
    Group all of the declarations of functions that belong to the ACPI
    processor idle driver together in one place in processor.h.
    
    While at it, drop the unnecessary extern modifier from the declaraions
    of two functions.
    
    Signed-off-by: Huisong Li 
    Tested-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251223100914.2407069-6-lihuisong@huawei.com
    Signed-off-by: Rafael J. Wysocki 

commit 31612f3642b1ec813c9c5915b4704e669630db28
Author: Rafael J. Wysocki 
Date:   Tue Dec 23 18:09:12 2025 +0800

    ACPI: processor: idle: Redefine two functions as void
    
    Notice that acpi_processor_power_init() and acpi_processor_power_exit()
    don't need to return any values because their callers don't check them
    anyway, so redefine those functions as void.
    
    While at it, rearrange the code in acpi_processor_power_init() to
    reduce the indentation level, get rid of a redundant local variable
    in that function, and rephrase a code comment in it.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Mario Limonciello (AMD) 
    Tested-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251223100914.2407069-5-lihuisong@huawei.com
    Signed-off-by: Rafael J. Wysocki 

commit 0089ce1c056aee547115bdc25c223f8f88c08498
Author: Rafael J. Wysocki 
Date:   Tue Dec 23 18:09:11 2025 +0800

    ACPI: processor: Update cpuidle driver check in __acpi_processor_start()
    
    Commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle
    driver registration") moved the ACPI idle driver registration to
    acpi_processor_driver_init() and acpi_processor_power_init() does
    not register an idle driver any more.
    
    Accordingly, the cpuidle driver check in __acpi_processor_start() needs
    to be updated to avoid calling acpi_processor_power_init() without a
    cpuidle driver, in which case the registration of the cpuidle device
    in that function would lead to a NULL pointer dereference in
    __cpuidle_register_device().
    
    Fixes: 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration")
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Mario Limonciello (AMD) 
    Tested-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251223100914.2407069-4-lihuisong@huawei.com
    Signed-off-by: Rafael J. Wysocki 

commit 8ada9e11b3fc5d9e21c3a45c6c136944f7b28a14
Author: Huisong Li 
Date:   Tue Dec 23 18:09:10 2025 +0800

    ACPI: processor: Remove unused empty stubs of some functions
    
    Empty stubs are defined in processor.h for some functions provided by
    the ACPI processor idle driver, but those functions are only used in
    the main ACPI processor driver which requires the ACPI processor idle
    driver to be present (selecting CONFIG_ACPI_PROCESSOR causes
    CONFIG_ACPI_PROCESSOR_IDLE to be selected too automatically).
    
    This means that the empty stubs in question are not really necessary and
    if both CONFIG_ACPI_PROCESSOR and CONFIG_ACPI_PROCESSOR_IDLE are unset,
    the compiler complains that they are defined, but not used.  Drop them
    to get rid of the compiler warning.
    
    Signed-off-by: Huisong Li 
    Tested-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251223100914.2407069-3-lihuisong@huawei.com
    Signed-off-by: Rafael J. Wysocki 

commit 13ebeef6a1b9c4e5c9789f835cc4ec34873f0bb1
Author: Huisong Li 
Date:   Tue Dec 23 18:09:09 2025 +0800

    ACPI: processor: idle: Optimize ACPI idle driver registration
    
    Currently, the ACPI idle driver is registered from within a CPU
    hotplug callback. Although this didn't cause any functional issues,
    this is questionable and confusing. And it is better to register
    the cpuidle driver when all of the CPUs have been brought up.
    
    So add a new function to initialize acpi_idle_driver based on the
    power management information of an available CPU and register cpuidle
    driver in acpi_processor_driver_init().
    
    This commit has four changes under the commit 7a8c994cbb2d (ACPI:
    processor: idle: Optimize ACPI idle driver registration):
    
     1) move acpi_processor_register_idle_driver() ahead of the
        driver_register().
     2) add acpi_processor_cstate_first_run_checks() before calling
        acpi_processor_get_power_info().
     3) squash the commit 9d68320b2bca (ACPI: processor: idle: Fix
        function defined but not used warning) into this change.
     4) use for_each_possible_cpu(cpu) to scan all possible cpus.
    
    Signed-off-by: Huisong Li 
    Tested-by: Borislav Petkov (AMD) 
    [ rjw: New comment edits, changelog tweak ]
    Link: https://patch.msgid.link/20251223100914.2407069-2-lihuisong@huawei.com
    Signed-off-by: Rafael J. Wysocki 

commit 76489955c6d4a065ca69dc88faf7a50a59b66f35
Author: Ben Dooks 
Date:   Fri Jan 9 13:39:38 2026 +0000

    audit: move the compat_xxx_class[] extern declarations to audit_arch.h
    
    The comapt_xxx_class symbols aren't declared in anything that
    lib/comapt_audit.c is including (arm64 build) which is causing
    the following sparse warnings:
    
    lib/compat_audit.c:7:10: warning: symbol 'compat_dir_class'
      was not declared. Should it be static?
    lib/compat_audit.c:12:10: warning: symbol 'compat_read_class'
      was not declared. Should it be static?
    lib/compat_audit.c:17:10: warning: symbol 'compat_write_class'
      was not declared. Should it be static?
    lib/compat_audit.c:22:10: warning: symbol 'compat_chattr_class'
      was not declared. Should it be static?
    lib/compat_audit.c:27:10: warning: symbol 'compat_signal_class'
      was not declared. Should it be static?
    
    Trying to fix this by chaning compat_audit.c to inclde 
    does not work on arm64 due to compile errors with the extra includes
    that changing this header makes. The simpler thing would be just to
    move the definitons of these symbols out of  into
     which is included.
    
    Fixes: 4b58841149dca ("audit: Add generic compat syscall support")
    Signed-off-by: Ben Dooks 
    [PM: rewrite subject line, fixed line length in description]
    Signed-off-by: Paul Moore 

commit fd0d2872dc53fe55f66842767e952457348b8d18
Author: Christian Loehle 
Date:   Tue Jan 6 13:36:53 2026 +0000

    MAINTAINERS: Add myself as cpuidle reviewer
    
    I've been reviewing cpuidle changes, for governors in particular, for
    the last couple of years and will continue to do so.
    
    Signed-off-by: Christian Loehle 
    Link: https://patch.msgid.link/71f63cb7-2d9b-49a3-9b04-a47e2edef5e0@arm.com
    Signed-off-by: Rafael J. Wysocki 

commit fcbd7897b871e157ee5c595e950c8466d86c0cd5
Author: Breno Leitao 
Date:   Mon Jan 5 06:37:06 2026 -0800

    cpuidle: menu: Remove incorrect unlikely() annotation
    
    The unlikely() annotation on the early-return condition in menu_select()
    is incorrect on systems with only one idle state (e.g., ARM64 servers
    with a single ACPI LPI state). Branch profiling shows 100% misprediction
    on such systems since drv->state_count <= 1 is always true.
    
    On platforms where only state0 is available, this path is the common
    case, not an unlikely edge case. Remove the misleading annotation to
    let the branch predictor learn the actual behavior.
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260105-annotated_idle-v1-1-10ddf0771b58@debian.org
    Signed-off-by: Rafael J. Wysocki 

commit eeb95c07d5fcaafb1829d5307ce4290cf1dc3190
Author: Nirmoy Das 
Date:   Wed Dec 17 07:45:28 2025 -0800

    PCI: Add ASPEED vendor ID to pci_ids.h
    
    Add PCI_VENDOR_ID_ASPEED to the shared pci_ids.h header and remove the
    duplicate local definition from ehci-pci.c.
    
    This prepares for adding a PCI quirk for ASPEED devices.
    
    Signed-off-by: Nirmoy Das 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Jason Gunthorpe 
    Link: https://patch.msgid.link/20251217154529.377586-1-nirmoyd@nvidia.com

commit a8d722f03923b1c6166d39482c6df8f017e185d9
Author: Miaoqian Lin 
Date:   Tue Aug 5 07:03:58 2025 +0400

    clk: rockchip: Fix error pointer check after rockchip_clk_register_gate_link()
    
    Replace NULL check with IS_ERR_OR_NULL() check after calling
    rockchip_clk_register_gate_link() since this function
    returns error pointers (ERR_PTR).
    
    Fixes: c62fa612cfa6 ("clk: rockchip: implement linked gate clock support")
    Signed-off-by: Miaoqian Lin 
    Link: https://patch.msgid.link/20250805030358.3665878-1-linmq006@gmail.com
    Signed-off-by: Heiko Stuebner 

commit da0de806d8b46238ac3891a894806da4d1c26cdf
Author: Detlev Casanova 
Date:   Mon Oct 20 17:20:09 2025 -0400

    arm64: dts: rockchip: Add the vdpu383 Video Decoder on rk3576
    
    Add the vdpu383 Video Decoder variant to the RK3576 device tree.
    
    Also allow using the dedicated SRAM as a pool.
    
    Signed-off-by: Detlev Casanova 
    Link: https://patch.msgid.link/20251020212009.8852-3-detlev.casanova@collabora.com
    Signed-off-by: Heiko Stuebner 

commit f61731bd60627b129b688c2d7b2071a5fe7f01d7
Author: Detlev Casanova 
Date:   Mon Oct 20 17:20:08 2025 -0400

    arm64: dts: rockchip: Add the vdpu381 Video Decoders on RK3588
    
    Add the vdpu381 Video Decoders to the rk3588-base devicetree.
    
    The RK3588 based SoCs all embed 2 vdpu381 decoders.
    This also adds the dedicated IOMMU controllers.
    
    Signed-off-by: Detlev Casanova 
    Link: https://patch.msgid.link/20251020212009.8852-2-detlev.casanova@collabora.com
    Signed-off-by: Heiko Stuebner 

commit 54b5415739300c89cdd6b1db152bb5acf047ce40
Author: Khalid Faisal Ansari 
Date:   Wed Nov 12 13:12:09 2025 +0530

    arm64: dts: qcom: hamoa-iot-evk: Enable TPM (ST33) on SPI11
    
    Enable ST33HTPM TPM over SPI11 on the Hamoa IoT EVK by adding the
    required SPI and TPM nodes.
    
    Signed-off-by: Khalid Faisal Ansari 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251112-arm64-dts-qcom-hamoa-iot-evk-enable-st33-tpm-on-spi11-v3-1-39b19eb55cc3@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 3cdaec4d5e8c24ce3298c93bac80c31820b91aff
Author: Laurent Pinchart 
Date:   Mon Oct 27 23:56:36 2025 +0200

    arm64: dts: rockchip: Add rk3588s-orangepi-cm5-base device tree
    
    The Orange Pi CM5 Base board is a carrier board for the Orange Pi CM5
    compute module. It has 3 ethernet ports, 2 USB ports, one HDMI output
    and 4 CSI-2 inputs.
    
    The device tree is split in two files, a .dtsi for the compute module
    and a .dts for the carrier board. All the devices present on the carrier
    board are enabled and tested, with the exception of the IR receiver due
    to missing support for input capture in the PWM device's DT binding (and
    driver).
    
    This work is based on a combination of the Orange Pi 5 device tree from
    the upstream kernel and the Orange Pi CM5 device tree from the BSP
    kernel. All nodes and properties have been carefully checked to the best
    of my abilities against the schematics of the carrier board. The
    schematics of the compute module is not available publicly, so the
    configuration of the PMIC hasn't been double-checked.
    
    Signed-off-by: Laurent Pinchart 
    Link: https://patch.msgid.link/20251027215637.20715-3-laurent.pinchart@ideasonboard.com
    Signed-off-by: Heiko Stuebner 

commit 5d719a4703566267492129d13516d87066f288f8
Author: Laurent Pinchart 
Date:   Mon Oct 27 23:56:35 2025 +0200

    dt-bindings: arm: rockchip: Add Orange Pi CM5 Base
    
    The Orange Pi CM5 Base board is a carrier board for the Orange Pi CM5
    compute module. It has 3 ethernet ports, 2 USB ports, one HDMI output
    and 4 CSI-2 inputs.
    
    Signed-off-by: Laurent Pinchart 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251027215637.20715-2-laurent.pinchart@ideasonboard.com
    Signed-off-by: Heiko Stuebner 

commit a770eb1f3219dfc4c28dac66c96735fa8acba4e6
Author: David Petry 
Date:   Tue Oct 21 18:06:02 2025 +0200

    arm64: dts: rockchip: Enable second HDMI output on CM3588
    
    Enable the second HDMI output port found on FriendlyElec CM3588 and CM3588 Plus
    
    Signed-off-by: David Petry 
    Link: https://patch.msgid.link/20251021160603.96934-1-petry103@gmail.com
    Signed-off-by: Heiko Stuebner 

commit 97a9b5edcdd4179063773f17a00904a464b8aa7c
Author: Chris Morgan 
Date:   Wed Nov 19 16:55:26 2025 -0600

    arm64: dts: rockchip: Add HDMI to Gameforce Ace
    
    Add support for the HDMI port for the Gameforce Ace. The HDMI port
    has no HPD pin present (the manufacturer's devicetree states the pin
    is reused for an additional face button) so add the attribute of
    no-hpd to poll for connected devices.
    
    Signed-off-by: Chris Morgan 
    Link: https://patch.msgid.link/20251119225526.70588-4-macroalpha82@gmail.com
    Signed-off-by: Heiko Stuebner 

commit bafb6863dd8cea94e7dc2f90979b30292e8ea31c
Author: Chris Morgan 
Date:   Wed Nov 19 16:55:25 2025 -0600

    drm/bridge: dw-hdmi-qp: Add support for missing HPD
    
    Add support for the dw-hdmi-qp driver to handle devices with missing
    HPD pins.
    
    Since in this situation we are now polling for the EDID data via i2c
    change the error message to a rate limited debug message when we are
    unable to complete an i2c read, as a disconnected device would
    otherwise fill dmesg with i2c read errors.
    
    Reviewed-by: Cristian Ciocaltea 
    Signed-off-by: Chris Morgan 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251119225526.70588-3-macroalpha82@gmail.com

commit db04f0d47dd1f18cf506a7dfa00035901be328a1
Author: Chris Morgan 
Date:   Wed Nov 19 16:55:24 2025 -0600

    dt-bindings: display: rockchip: Add no-hpd for dw-hdmi-qp controller
    
    Add an attribute of "no-hpd" for the Rockchip dw-hdmi-qp controller.
    This is used to describe implementations where the HPD pin is not
    connected or used for other purposes, such as in the RK3588S based
    Gameforce Ace which repurposed the GPIO for an additional face
    button.
    
    The "no-hpd" option was chosen to be consistent with other devices
    which already define this parameter for broken or missing hpd
    functionality.
    
    Acked-by: Conor Dooley 
    Signed-off-by: Chris Morgan 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251119225526.70588-2-macroalpha82@gmail.com

commit ab8559d44de5750e03778c42311aec8dd41a61f5
Author: Marco Crivellari 
Date:   Fri Oct 31 11:48:46 2025 +0100

    drm/rockchip: replace use of system_wq with system_percpu_wq
    
    Currently if a user enqueue a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    
    This lack of consistency cannot be addressed without refactoring the API.
    
    system_wq should be the per-cpu workqueue, yet in this name nothing makes
    that clear, so replace system_wq with system_percpu_wq.
    
    The old wq (system_wq) will be kept for a few release cycles.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251031104846.119503-3-marco.crivellari@suse.com

commit 0650f4909af2bafe49322c91dd8dd0f68abfdf4f
Author: Marco Crivellari 
Date:   Fri Oct 31 11:48:45 2025 +0100

    drm/rockchip: replace use of system_unbound_wq with system_dfl_wq
    
    Currently if a user enqueue a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    
    This lack of consistency cannot be addressed without refactoring the API.
    
    system_unbound_wq should be the default workqueue so as not to enforce
    locality constraints for random work whenever it's not required.
    
    Adding system_dfl_wq to encourage its use when unbound work should be used.
    
    The old system_unbound_wq will be kept for a few release cycles.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251031104846.119503-2-marco.crivellari@suse.com

commit 63a47fc13cbef0a4fc5e011f07f47a921312fc81
Author: Yuanjie Yang 
Date:   Thu Jan 8 17:25:42 2026 +0800

    arm64: dts: qcom: talos: Add PMU support
    
    Add the PMU node for talos platforms.
    
    Signed-off-by: Yuanjie Yang 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20260108092542.1371-3-yuanjie.yang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit ca25bb421bdc81849dd527641cd7405fb5eba8fc
Author: Yuanjie Yang 
Date:   Thu Jan 8 17:25:41 2026 +0800

    arm64: dts: qcom: talos: switch to interrupt-cells 4 to add PPI partitions
    
    The ARM PMUs shares the same per-cpu (PPI) interrupt, so we need to switch
    to interrupt-cells = <4> in the GIC node to allow adding an interrupt
    partition map phandle as the 4th cell value for GIC_PPI interrupts.
    
    Signed-off-by: Yuanjie Yang 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20260108092542.1371-2-yuanjie.yang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 4effccde0a0521b220c3585c9a0d8e677d345209
Author: WanLi Niu 
Date:   Tue Jan 6 10:31:23 2026 +0800

    bpftool: Make skeleton C++ compatible with explicit casts
    
    Fix C++ compilation errors in generated skeleton by adding explicit
    pointer casts and use char * subtraction for offset calculation
    
    error: invalid conversion from 'void*' to '*' [-fpermissive]
          |         skel = skel_alloc(sizeof(*skel));
          |                ~~~~~~~~~~^~~~~~~~~~~~~~~
          |                          |
          |                          void*
    
    error: arithmetic on pointers to void
          |         skel->ctx.sz = (void *)&skel->links - (void *)skel;
          |                        ~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~
    
    error: assigning to 'struct __ *' from incompatible type 'void *'
          |                 skel-> = skel_prep_map_data((void *)data, 4096,
          |                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          |                                                 sizeof(data) - 1);
          |                                                 ~~~~~~~~~~~~~~~~~
    
    error: assigning to 'struct __ *' from incompatible type 'void *'
          |         skel-> = skel_finalize_map_data(&skel->maps..initial_value,
          |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          |                                         4096, PROT_READ | PROT_WRITE, skel->maps..map_fd);
          |                                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    Minimum reproducer:
    
            $ cat test.bpf.c
            int val; // placed in .bss section
    
            #include "vmlinux.h"
            #include 
    
            SEC("raw_tracepoint/sched_wakeup_new") int handle(void *ctx) { return 0; }
    
            $ cat test.cpp
            #include 
    
            extern "C" {
            #include "test.bpf.skel.h"
            }
    
            $ bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h
            $ clang -g -O2 -target bpf -c test.bpf.c -o test.bpf.o
            $ bpftool gen skeleton test.bpf.o -L  > test.bpf.skel.h
            $ g++ -c test.cpp -I.
    
    Co-developed-by: Menglong Dong 
    Signed-off-by: WanLi Niu 
    Signed-off-by: Menglong Dong 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20260106023123.2928-1-kiraskyler@163.com

commit bd2dc325db8c8cb29b65b0c636e31babc2bfeddf
Author: Krzysztof Kozlowski 
Date:   Tue Jan 6 19:51:25 2026 +0100

    arm64: dts: qcom: ipq9574: Complete USB DWC3 wrapper interrupts
    
    Complete interrupts for DWC3 node to match what is required by
    Devicetree bindings, as reported by dtbs_check:
    
      ipq9574-rdp433.dtb: usb@8af8800 (qcom,ipq9574-dwc3): interrupt-names: ['pwr_event'] is too short
    
    The actual interrupt numbers are taken from reference manual of similar
    chip, but not IPQ9574, due to lack of access to it.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Kathiravan Thirumoorthy 
    Tested-by: Kathiravan Thirumoorthy 
    Link: https://lore.kernel.org/r/20260106185123.19929-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit d106f9681d1952b7c19726b0713cee6ae11211f5
Author: Krzysztof Kozlowski 
Date:   Tue Jan 6 19:51:24 2026 +0100

    arm64: dts: qcom: ipq5018: Correct USB DWC3 wrapper interrupts
    
    Interrupts for DWC3 node were completely mixed up - SPI interrupt 62 is
    not listed in reference manual at all.  It was also causing dtbs_check
    warnings:
    
      ipq5018-rdp432-c2.dtb: usb@8af8800 (qcom,ipq5018-dwc3): interrupt-names:0: 'pwr_event' was expected
      ipq5018-rdp432-c2.dtb: usb@8af8800 (qcom,ipq5018-dwc3): interrupt-names: ['hs_phy_irq'] is too short
    
    Warning itself was introduced by commit 53c6d854be4e ("dt-bindings: usb:
    dwc3: Clean up hs_phy_irq in binding"), but this was trying to bring
    sanity to the interrupts overall, although did a mistake for IPQ5018.
    IPQ5018 does not have QUSB2 PHY and its interrupts should rather match
    ones used in IPQ5332.
    
    Correct it by using interrupts matching the bindings and reference
    manual.
    
    Signed-off-by: Krzysztof Kozlowski 
    Tested-by: George Moussalem 
    Link: https://lore.kernel.org/r/20260106185123.19929-3-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e1f08613e113f02a3ec18c9a7964de97f940acbf
Author: Brian Masney 
Date:   Thu Jan 8 16:16:32 2026 -0500

    clk: qcom: alpha-pll: convert from divider_round_rate() to divider_determine_rate()
    
    The divider_round_rate() function is now deprecated, so let's migrate
    to divider_determine_rate() instead so that this deprecated API can be
    removed.
    
    Note that when the main function itself was migrated to use
    determine_rate, this was mistakenly converted to:
    
        req->rate = divider_round_rate(...)
    
    This is invalid in the case when an error occurs since it can set the
    rate to a negative value.
    
    Fixes: 0e56e3369b60 ("clk: qcom: alpha-pll: convert from round_rate() to determine_rate()")
    Signed-off-by: Brian Masney 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20260108-clk-divider-round-rate-v1-14-535a3ed73bf3@redhat.com
    Signed-off-by: Bjorn Andersson 

commit 4f791e008807a1e7743cf6048822bab259b2ad0c
Author: Jie Gan 
Date:   Mon Nov 3 15:06:22 2025 +0800

    arm64: dts: qcom: monaco: Add CTCU and ETR nodes
    
    Add CTCU and ETR nodes in DT to enable expected functionalities.
    
    Acked-by: Konrad Dybcio 
    Signed-off-by: Jie Gan 
    Link: https://lore.kernel.org/r/20251103-enable-ctcu-for-monaco-v4-2-92ff83201584@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit ac62730dbc71e4e2320b368e86e0c6ea3e41f1f5
Author: Ziyue Zhang 
Date:   Fri Jan 9 18:45:04 2026 +0800

    arm64: dts: qcom: Add PCIe3 and PCIe5 regulators for HAMAO-IOT-EVK board
    
    HAMAO IoT EVK uses PCIe5 to connect an SDX65 module for WWAN functionality
    and PCIe3 to connect a SATA controller. These interfaces require multiple
    voltage rails: PCIe5 needs 3.3V supplied by vreg_wwan, while PCIe3 requires
    12V, 3.3V, and 3.3V AUX rails, controlled via PMIC GPIOs.
    
    Add the required fixed regulators with related pin configuration, and
    connect them to the PCIe3 and PCIe5 ports to ensure proper power for the
    SDX65 module and SATA controller.
    
    Move reset and wake GPIO properties from RC nodes to port nodes.
    
    Signed-off-by: Ziyue Zhang 
    Reviewed-by: Krishna Chaitanya Chundru 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260109104504.3147745-4-ziyue.zhang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a395b859ecacedc6ff28e6b62e43a7cd1abc34ee
Author: Ziyue Zhang 
Date:   Fri Jan 9 18:45:03 2026 +0800

    arm64: dts: qcom: Add PCIe3 and PCIe5 support for HAMOA-IOT-SOM platform
    
    HAMOA IoT SOM requires PCIe3 and PCIe5 connectivity for SATA controller
    and SDX65.
    
    Add the required sideband signals (PERST#, WAKE#, CLKREQ#), pinctrl states
    and power supply properties in the device tree, which PCIe3 and PCIe5
    require.
    
    Signed-off-by: Ziyue Zhang 
    Reviewed-by: Krishna Chaitanya Chundru 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260109104504.3147745-3-ziyue.zhang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 960609b22be58baa16823103894de3c6858e6cf4
Author: Ziyue Zhang 
Date:   Fri Jan 9 18:45:02 2026 +0800

    arm64: dts: qcom: hamoa: Move PHY, PERST, and Wake GPIOs to PCIe port nodes and add port Nodes for all PCIe ports
    
    Since describing the PCIe PHY directly under the RC node is now
    deprecated, move the references to the respective PCIe port nodes,
    creating them where necessary.Also add port nodes for PCIe5 and PCIe6a
    with proper PHY references.
    
    And also move the PCIe PERST and wake GPIOs from the controller nodes to
    the corresponding PCIe port nodes on Hamoa-based platforms:
    
     - x1e001de-devkit
     - x1e78100-lenovo-thinkpad-t14s
     - x1e80100-asus-vivobook-s15
     - x1e80100-asus-zenbook-a14
     - x1e80100-dell-xps13-9345
     - x1e80100-lenovo-yoga-slim7x
     - x1e80100-microsoft-romulus
     - x1e80100-qcp
    
    Signed-off-by: Ziyue Zhang 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260109104504.3147745-2-ziyue.zhang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 24e9b431b5837bc9d2cf2c2fde4abf507e2fae19
Author: Ryan Foster 
Date:   Wed Jan 7 13:51:28 2026 -0800

    security: Add KUnit tests for kuid_root_in_ns and vfsuid_root_in_currentns
    
    Add comprehensive KUnit tests for the namespace-related capability
    functions that Serge Hallyn refactored in commit 9891d2f79a9f
    ("Clarify the rootid_owns_currentns").
    
    The tests verify:
    - Basic functionality: UID 0 in init namespace, invalid vfsuid,
      non-zero UIDs
    - Actual namespace traversal: Creating user namespaces with different
      UID mappings where uid 0 maps to different kuids (e.g., 1000, 2000,
      3000)
    - Hierarchy traversal: Testing multiple nested namespaces to verify
      correct namespace hierarchy traversal
    
    This addresses the feedback to "test the actual functionality" by
    creating real user namespaces with different values for the
    namespace's uid 0, rather than just basic input validation.
    
    The test file is included at the end of commoncap.c when
    CONFIG_SECURITY_COMMONCAP_KUNIT_TEST is enabled, following the
    standard kernel pattern (e.g., scsi_lib.c, ext4/mballoc.c). This
    allows tests to access static functions in the same compilation unit
    without modifying production code based on test configuration.
    
    The tests require CONFIG_USER_NS to be enabled since they rely on user
    namespace mapping functionality. The Kconfig dependency ensures the
    tests only build when this requirement is met.
    
    All 7 tests pass:
    - test_vfsuid_root_in_currentns_init_ns
    - test_vfsuid_root_in_currentns_invalid
    - test_vfsuid_root_in_currentns_nonzero
    - test_kuid_root_in_ns_init_ns_uid0
    - test_kuid_root_in_ns_init_ns_nonzero
    - test_kuid_root_in_ns_with_mapping
    - test_kuid_root_in_ns_with_different_mappings
    
    Updated MAINTAINER capabilities to include commoncap test
    
    Signed-off-by: Ryan Foster 
    Signed-off-by: Serge Hallyn 

commit 7fe9c81aa24a2374b1a9a2160d44f4afbf8ab80d
Author: Andy Shevchenko 
Date:   Thu Nov 27 08:44:52 2025 +0100

    idpf: Fix kernel-doc descriptions to avoid warnings
    
    In many functions the Return section is missing. Fix kernel-doc
    descriptions to address that and other warnings.
    
    Before the change:
    
    $ scripts/kernel-doc -none -Wreturn drivers/net/ethernet/intel/idpf/idpf_txrx.c 2>&1 | wc -l
    85
    
    Reviewed-by: Przemek Kitszel 
    Reviewed-by: Aleksandr Loktionov 
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Paul Menzel 
    Tested-by: Krishneil Singh 
    Signed-off-by: Tony Nguyen 

commit 72dae6ad55df91adc68327b3ad5e69904d2136e0
Author: Sreedevi Joshi 
Date:   Wed Nov 26 11:02:16 2025 -0600

    idpf: update idpf_up_complete() return type to void
    
    idpf_up_complete() function always returns 0 and no callers use this return
    value. Although idpf_vport_open() checks the return value, it only handles
    error cases which never occur. Change the return type to void to simplify
    the code.
    
    Signed-off-by: Sreedevi Joshi 
    Reviewed-by: Aleksandr Loktionov 
    Reviewed-by: Simon Horman 
    Signed-off-by: Tony Nguyen 

commit ee13aa1a2c5a68943a730ddbde300ba11b84229c
Author: Michal Swiatkowski 
Date:   Thu Oct 30 09:30:53 2025 +0100

    ice: use netif_get_num_default_rss_queues()
    
    On some high-core systems (like AMD EPYC Bergamo, Intel Clearwater
    Forest) loading ice driver with default values can lead to queue/irq
    exhaustion. It will result in no additional resources for SR-IOV.
    
    In most cases there is no performance reason for more than half
    num_cpus(). Limit the default value to it using generic
    netif_get_num_default_rss_queues().
    
    Still, using ethtool the number of queues can be changed up to
    num_online_cpus(). It can be done by calling:
    $ethtool -L ethX combined $(nproc)
    
    This change affects only the default queue amount.
    
    Reviewed-by: Aleksandr Loktionov 
    Signed-off-by: Michal Swiatkowski 
    Tested-by: Rafal Romanowski 
    Signed-off-by: Tony Nguyen 

commit 483dd5f36f891a2c3c2bc3231dd136891e75b744
Author: Birger Koblitz 
Date:   Tue Dec 2 06:57:48 2025 +0100

    ixgbe: Add 10G-BX support
    
    Add support for 10G-BX modules, i.e. 10GBit Ethernet over a single strand
    Single-Mode fiber.
    The initialization of a 10G-BX SFP+ is the same as for a 10G SX/LX module,
    and is identified according to SFF-8472 table 5-3, footnote 3 by the
    10G Ethernet Compliance Codes field being empty, the Nominal Bit
    Rate being compatible with 12.5GBit, and the module being a fiber module
    with a Single Mode fiber link length.
    
    This was tested using a Lightron WSPXG-HS3LC-IEA 1270/1330nm 10km
    transceiver:
    $ sudo ethtool -m enp1s0f1
       Identifier                          : 0x03 (SFP)
       Extended identifier                 : 0x04 (GBIC/SFP defined by 2-wire interface ID)
       Connector                           : 0x07 (LC)
       Transceiver codes                   : 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
       Encoding                            : 0x01 (8B/10B)
       BR Nominal                          : 10300MBd
       Rate identifier                     : 0x00 (unspecified)
       Length (SMF)                        : 10km
       Length (OM2)                        : 0m
       Length (OM1)                        : 0m
       Length (Copper or Active cable)     : 0m
       Length (OM3)                        : 0m
       Laser wavelength                    : 1330nm
       Vendor name                         : Lightron Inc.
       Vendor OUI                          : 00:13:c5
       Vendor PN                           : WSPXG-HS3LC-IEA
       Vendor rev                          : 0000
       Option values                       : 0x00 0x1a
       Option                              : TX_DISABLE implemented
       BR margin max                       : 0%
       BR margin min                       : 0%
       Vendor SN                           : S142228617
       Date code                           : 140611
       Optical diagnostics support         : Yes
    
    Signed-off-by: Birger Koblitz 
    Reviewed-by: Andrew Lunn 
    Reviewed-by: Paul Menzel 
    Reviewed-by: Aleksandr Loktionov 
    Tested-by: Rinitha S 
    Signed-off-by: Tony Nguyen 

commit 2769e6c3a1bdf9b4d0c30809a9e4361ab32ad414
Author: Grzegorz Nitka 
Date:   Fri Oct 17 10:42:28 2025 +0200

    ice: unify PHY FW loading status handler for E800 devices
    
    Unify handling of PHY firmware load delays across all E800 family
    devices. There is an existing mechanism to poll GL_MNG_FWSM_FW_LOADING_M
    bit of GL_MNG_FWSM register in order to verify whether PHY FW loading
    completed or not. Previously, this logic was limited to E827 variants
    only.
    
    Also, inform a user of possible delay in initialization process, by
    dumping informational message in dmesg log ("Link initialization is
    blocked by PHY FW initialization. Link initialization will continue
    after PHY FW initialization completes.").
    
    Signed-off-by: Grzegorz Nitka 
    Reviewed-by: Aleksandr Loktionov 
    Reviewed-by: Simon Horman 
    Reviewed-by: Paul Menzel 
    Tested-by: Rinitha S  (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen 

commit 1ba1b04e1a3e82b6bb6783e2975306fbb0fae285
Merge: fc65403d55c3be 1ecc8ae876c41b
Author: Jakub Kicinski 
Date:   Fri Jan 9 08:56:02 2026 -0800

    Merge branch 'tools-ynl-clean-up-pylint-issues'
    
    Donald Hunter says:
    
    ====================
    tools: ynl: clean up pylint issues
    
    pylint tools/net/ynl/pyynl reports >850 issues, with a rating of
    8.59/10. It's hard to spot new issues or genuine code smells in
    all that noise.
    
    Fix the easily fixable issues and suppress the noisy warnings.
    
      pylint tools/net/ynl/pyynl
      ************* Module pyynl.ethtool
      tools/net/ynl/pyynl/ethtool.py:159:5: W0511: TODO: --show-tunnels        tunnel-info-get (fixme)
      tools/net/ynl/pyynl/ethtool.py:160:5: W0511: TODO: --show-module         module-get (fixme)
      tools/net/ynl/pyynl/ethtool.py:161:5: W0511: TODO: --get-plca-cfg        plca-get (fixme)
      tools/net/ynl/pyynl/ethtool.py:162:5: W0511: TODO: --get-plca-status     plca-get-status (fixme)
      tools/net/ynl/pyynl/ethtool.py:163:5: W0511: TODO: --show-mm             mm-get (fixme)
      tools/net/ynl/pyynl/ethtool.py:164:5: W0511: TODO: --show-fec            fec-get (fixme)
      tools/net/ynl/pyynl/ethtool.py:165:5: W0511: TODO: --dump-module-eerpom  module-eeprom-get (fixme)
      tools/net/ynl/pyynl/ethtool.py:166:5: W0511: TODO:                       pse-get (fixme)
      tools/net/ynl/pyynl/ethtool.py:167:5: W0511: TODO:                       rss-get (fixme)
      tools/net/ynl/pyynl/ethtool.py:179:9: W0511: TODO: parse the bitmask (fixme)
      tools/net/ynl/pyynl/ethtool.py:196:9: W0511: TODO: parse the bitmask (fixme)
      tools/net/ynl/pyynl/ethtool.py:321:9: W0511: TODO: pass id? (fixme)
      tools/net/ynl/pyynl/ethtool.py:330:17: W0511: TODO: support passing the bitmask (fixme)
      tools/net/ynl/pyynl/ethtool.py:459:5: W0511: TODO: wol-get (fixme)
    
      ------------------------------------------------------------------
      Your code has been rated at 9.97/10 (previous run: 8.59/10, +1.38)
    ====================
    
    Link: https://patch.msgid.link/20260108161339.29166-1-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 1ecc8ae876c41befc4d4f4f85c7abd42387d06e0
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:39 2026 +0000

    tools: ynl-gen-c: Fix remaining pylint warnings
    
    Fix the following pylint warning instances:
    
    ynl_gen_c.py:575:15: E0606: Possibly using variable 'mem' before
    assignment (possibly-used-before-assignment)
    
    ynl_gen_c.py:888:0: R1707: Disallow trailing comma tuple
    (trailing-comma-tuple)
    
    ynl_gen_c.py:944:21: C0209: Formatting a regular string which could be an
    f-string (consider-using-f-string)
    
    ynl_gen_c.py:1450:14: C1802: Do not use `len(SEQUENCE)` without comparison
    to determine if a sequence is empty (use-implicit-booleaness-not-len)
    
    ynl_gen_c.py:1688:13: W1514: Using open without explicitly specifying an
    encoding (unspecified-encoding)
    
    ynl_gen_c.py:3446:0: C0325: Unnecessary parens after '=' keyword
    (superfluous-parens)
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-14-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit a587f592d6c49903457c1d06876ddb071907850d
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:38 2026 +0000

    tools: ynl-gen-c: fix pylint None, type, dict, generators, init
    
    Fix the following pylint warnings that are trivial one-liners:
    
    - unsubscriptable-object
    - unidiomatic-typecheck
    - use-dict-literal
    - attribute-defined-outside-init
    - consider-using-in
    - consider-using-generator
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-13-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 93ef84292959e14fac8aa49079ae951e0078dc6e
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:37 2026 +0000

    tools: ynl-gen-c: fix pylint warnings for returns, unused, redefined
    
    Fix the following pylint warnings:
    
    - unused-argument
    - unused-variable
    - no-else-return
    - inconsistent-return-statements
    - redefined-outer-name
    - unreachable
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-12-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit c2fa97c509ec5d0d9b3134132b90c117a961f2b6
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:36 2026 +0000

    tools: ynl-gen-c: suppress unhelpful pylint messages
    
    Disable pylint messages for too-many-*, too-few-*, docstrings,
    broad-exception-* and messages for specific code that won't get changed.
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-11-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 9a130471f854aa2146e74a8dec47478d9e6d0654
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:35 2026 +0000

    tools: ynl: fix pylint issues in ynl_gen_rst
    
    Add a couple of pylint suppressions to ynl_gen_rst.py:
    
    - no-name-in-module,wrong-import-position
    - broad-exception-caught
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-10-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 301da4cfea5fef6dfc82a37031b84c89e06c5c7b
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:34 2026 +0000

    tools: ynl: ethtool: fix pylint issues
    
    Fix or suppress all the pylint issues in ethtool.py, except for
    TODO (fixme) items.
    
    Suppress:
    
    - too-many-locals
    - too-many-branches
    - too-many-statements
    - too-many-return-statements
    - import-error
    
    Fix:
    
    - missing-module-docstring
    - redefined-outer-name
    - dangerous-default-value
    - use-dict-literal
    - missing-function-docstring
    - global-variable-undefined
    - expression-not-assigned
    - inconsistent-return-statements
    - wrong-import-order
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-9-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 9b6b016df4c2902cd6acd2673bffea6c1e8f643d
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:33 2026 +0000

    tools: ynl: fix logic errors reported by pylint
    
    Fix the following logic errors:
    
    tools/net/ynl/pyynl/lib/nlspec.py:299:15: E1101: Instance of 'list' has no
    'items' member (no-member)
    
    tools/net/ynl/pyynl/lib/nlspec.py:580:22: E0606: Possibly using variable 'op'
    before assignment (possibly-used-before-assignment)
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-8-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 00ef9f153ed899e26382fc7918c1d087b20ef2c5
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:32 2026 +0000

    tools: ynl: fix pylint global variable related warnings
    
    Refactor to avoid using global variables to fix the following pylint
    issues:
    
    - invalid-name
    - global-statement
    - global-variable-not-assigned
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-7-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 542ba2de32fb7ad6b8c51a05a4f0d6ca3cc66d67
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:31 2026 +0000

    tools: ynl: fix pylint misc warnings
    
    Fix pylint warnings for:
    
    - unused-argument
    - consider-using-in
    - consider-using-get
    - consider-using-f-string
    - protected-access
    - unidiomatic-typecheck
    - no-else-return
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-6-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 04b0b64e86b7ee9923099d141f8e2ed74389c435
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:30 2026 +0000

    tools: ynl: fix pylint dict, indentation, long lines, uninitialised
    
    Fix pylint warnings for:
    
    - use-dict-literal
    - bad-indentation
    - line-too-long
    - possibly-used-before-assignment
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-5-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit b6270a10b0f8727fea3005eecd9907ddaf38dc3f
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:29 2026 +0000

    tools: ynl: fix pylint exception warnings
    
    Fix pylint warnings for:
    
    - broad-exception-raised
    - broad-exception-caught
    - raise-missing-from
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-4-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit bcdd8ea73f750a4a6c38859a3f06027aa40b84c5
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:28 2026 +0000

    tools: ynl: fix pylint redefinition, encoding errors
    
    Fix pylint warnings for:
    
    - invalid-name
    - arguments-renamed
    - redefined-outer-name
    - unspecified-encoding
    - consider-using-sys-exit
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-3-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 37488ae6ceff9c912dab1a7b2217c563b43f99d2
Author: Donald Hunter 
Date:   Thu Jan 8 16:13:27 2026 +0000

    tools: ynl: pylint suppressions and docstrings
    
    Add some docstrings and suppress all the pylint warnings that won't get
    fixed yet:
    
    - no-name-in-module,wrong-import-position
    - too-many-locals
    - too-many-branches
    - too-many-statements
    - too-many-nested-blocks
    - too-many-instance-attributes
    - too-many-arguments
    - too-many-positional-arguments
    - too-few-public-methods
    - missing-class-docstring
    - missing-function-docstring
    
    Signed-off-by: Donald Hunter 
    Link: https://patch.msgid.link/20260108161339.29166-2-donald.hunter@gmail.com
    Signed-off-by: Jakub Kicinski 

commit b49c35ba0ce1ce1779a2ad563c85fbf87d03689f
Author: Boris Brezillon 
Date:   Thu Jan 8 13:33:25 2026 +0100

    drm/panfrost: Fix a page leak in panfrost_mmu_map_fault_addr() when THP is on
    
    drm_gem_put_pages(), which we rely on for returning BO pages to shmem,
    assume per-folio refcounting and not per-page. If we call
    shmem_read_mapping_page() per-page, we break this assumption and leak
    pages every time we get a huge page allocated.
    
    v2:
    - Rework the logic for() loop to better match the folio-granular
      allocation scheme
    
    Cc: Loïc Molinari 
    Fixes: c12e9fcb5a5a ("drm/panfrost: Introduce huge tmpfs mountpoint option")
    Signed-off-by: Boris Brezillon 
    Reviewed-by: Adrián Larumbe 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20260108123325.1088195-1-boris.brezillon@collabora.com
    Signed-off-by: Adrián Larumbe 

commit 29f4e7301910d7d1ece249cf34dfbe4dd7c2c6c4
Author: Alice Ryhl 
Date:   Fri Jan 9 08:20:18 2026 +0000

    drm/gpuvm: fix name in kernel doc of drm_gpuvm_bo_obtain_locked()
    
    When renaming this function, the name in the docs was not updated. This
    causes a KernelDoc warning. Thus, fix it.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202601091113.0b0WuRML-lkp@intel.com/
    Fixes: 9bf4ca1e699c ("drm/gpuvm: drm_gpuvm_bo_obtain() requires lock and staged mode")
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20260109082019.3999814-1-aliceryhl@google.com
    Signed-off-by: Danilo Krummrich 

commit 701c47493328a8173996e7590733be3493af572f
Author: Ben Dooks 
Date:   Thu Jan 8 15:12:03 2026 -0500

    drm/i915/guc: make 'guc_hw_reg_state' static as it isn't exported
    
    The guc_hw_reg_state array is not exported, so make it static.
    Fixes the following sparse warning:
    drivers/gpu/drm/i915/i915_gpu_error.c:692:3: warning: symbol 'guc_hw_reg_state' was not declared. Should it be static?
    
    Fixes: ba391a102ec11 ("drm/i915/guc: Include the GuC registers in the error state")
    Signed-off-by: Ben Dooks 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20260108201202.59250-2-rodrigo.vivi@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 0e09a596ad2e23d62e2707d5d1a68eaa76787f1b
Author: Richard Acayan 
Date:   Fri Jan 9 17:03:59 2026 +0300

    arm64: dts: qcom: sdm630: Add LPASS LPI TLMM
    
    The LPASS LPI TLMM pin controller controls pins for use by the analog
    and digital codecs, such as the PDM bus, the digital microphone pins,
    and the compander pins. Add it to support the codecs.
    
    Signed-off-by: Richard Acayan 
    Co-developed-by: Nickolay Goppen 
    Signed-off-by: Nickolay Goppen 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260109-qcom-sdm660-lpass-lpi-dts-v1-1-d3eb84f10a39@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit ee021b27333b657d0799ac791c1a6b9ddb293547
Author: Luca Weiss 
Date:   Fri Jan 9 16:14:34 2026 +0100

    arm64: dts: qcom: kodiak: Add missing clock votes for lpass_tlmm
    
    Without the correct clock votes set, we may be hitting a synchronous
    external abort error when touching the lpi registers.
    
      Internal error: synchronous external abort: 0000000096000010 [#1]  SMP
      <...>
      Call trace:
       lpi_gpio_read.isra.0+0x2c/0x58 (P)
       pinmux_enable_setting+0x218/0x300
       pinctrl_commit_state+0xb0/0x280
       pinctrl_select_state+0x28/0x48
       pinctrl_bind_pins+0x1f4/0x2a0
       really_probe+0x64/0x3a8
    
    Add the clocks to fix that.
    
    Platforms with this SoC using AudioReach won't be impacted due to
    qcs6490-audioreach.dtsi already setting clocks & clock-names for
    q6prmcc. The sc7280-chrome-common.dtsi has also been adjusted to keep
    the behavior the same as they also do not use Elite with q6afecc.
    
    Signed-off-by: Luca Weiss 
    Tested-by: Bhushan Shah  # On fairphone-fp5
    Link: https://lore.kernel.org/r/20260109-kodiak-lpass-tlmm-clocks-v1-1-746112687772@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit 8ccb1f8fa6a3dfde32cf33e7ded3558014e6cca2
Author: Tony Luck 
Date:   Wed Dec 17 09:21:05 2025 -0800

    x86,fs/resctrl: Add architectural event pointer
    
    The resctrl file system layer passes the domain, RMID, and event id to the
    architecture to fetch an event counter.
    
    Fetching a telemetry event counter requires additional information that is
    private to the architecture, for example, the offset into MMIO space from
    where the counter should be read.
    
    Add mon_evt::arch_priv that architecture can use for any private data related
    to the event. The resctrl filesystem initializes mon_evt::arch_priv when the
    architecture enables the event and passes it back to architecture when needing
    to fetch an event counter.
    
    Suggested-by: Reinette Chatre 
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 8f6b6ad69b50bf16bb762ffafbfa44a4884f9a17
Author: Tony Luck 
Date:   Wed Dec 17 09:21:04 2025 -0800

    x86,fs/resctrl: Fill in details of events for performance and energy GUIDs
    
    The telemetry event aggregators of the Intel Clearwater Forest CPU support two
    RMID-based feature types: "energy" with GUID 0x26696143¹, and "perf" with
    GUID 0x26557651².
    
    The event counter offsets in an aggregator's MMIO space are arranged in groups
    for each RMID.
    
    E.g., the "energy" counters for GUID 0x26696143 are arranged like this:
    
      MMIO offset:0x0000 Counter for RMID 0 PMT_EVENT_ENERGY
      MMIO offset:0x0008 Counter for RMID 0 PMT_EVENT_ACTIVITY
      MMIO offset:0x0010 Counter for RMID 1 PMT_EVENT_ENERGY
      MMIO offset:0x0018 Counter for RMID 1 PMT_EVENT_ACTIVITY
      ...
      MMIO offset:0x23F0 Counter for RMID 575 PMT_EVENT_ENERGY
      MMIO offset:0x23F8 Counter for RMID 575 PMT_EVENT_ACTIVITY
    
    After all counters there are three status registers that provide indications
    of how many times an aggregator was unable to process event counts, the time
    stamp for the most recent loss of data, and the time stamp of the most recent
    successful update.
    
      MMIO offset:0x2400 AGG_DATA_LOSS_COUNT
      MMIO offset:0x2408 AGG_DATA_LOSS_TIMESTAMP
      MMIO offset:0x2410 LAST_UPDATE_TIMESTAMP
    
    Define event_group structures for both of these aggregator types and define
    the events tracked by the aggregators in the file system code.
    
    PMT_EVENT_ENERGY and PMT_EVENT_ACTIVITY are produced in fixed point format.
    File system code must output as floating point values.
    
      ¹https://github.com/intel/Intel-PMT/blob/main/xml/CWF/OOBMSM/RMID-ENERGY/cwf_aggregator.xml
      ²https://github.com/intel/Intel-PMT/blob/main/xml/CWF/OOBMSM/RMID-PERF/cwf_aggregator.xml
    
      [ bp: Massage commit message. ]
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 1fb2daa60de640efb13f907d43d72d28763f696c
Author: Tony Luck 
Date:   Thu Jan 8 09:42:26 2026 -0800

    x86/resctrl: Discover hardware telemetry events
    
    Each CPU collects data for telemetry events that it sends to the nearest
    telemetry event aggregator either when the value of MSR_IA32_PQR_ASSOC.RMID
    changes, or when a two millisecond timer expires.
    
    There is a feature type ("energy" or "perf"), GUID, and MMIO region associated
    with each aggregator. This combination links to an XML description of the
    set of telemetry events tracked by the aggregator. XML files are published
    by Intel in a GitHub repository¹.
    
    The telemetry event aggregators maintain per-RMID per-event counts of the
    total seen for all the CPUs. There may be multiple telemetry event aggregators
    per package.
    
    There are separate sets of aggregators for each feature type. Aggregators
    in a set may have different GUIDs. All aggregators with the same feature
    type and GUID are symmetric keeping counts for the same set of events for
    the CPUs that provide data to them.
    
    The XML file for each aggregator provides the following information:
    0) Feature type of the events ("perf" or "energy")
    1) Which telemetry events are tracked by the aggregator.
    2) The order in which the event counters appear for each RMID.
    3) The value type of each event counter (integer or fixed-point).
    4) The number of RMIDs supported.
    5) Which additional aggregator status registers are included.
    6) The total size of the MMIO region for an aggregator.
    
    Introduce struct event_group that condenses the relevant information from
    an XML file. Hereafter an "event group" refers to a group of events of a
    particular feature type (event_group::pfname set to "energy" or "perf") with
    a particular GUID.
    
    Use event_group::pfname to determine the feature id needed to obtain the
    aggregator details. It will later be used in console messages and with the
    rdt= boot parameter.
    
    The INTEL_PMT_TELEMETRY driver enumerates support for telemetry events.
    This driver provides intel_pmt_get_regions_by_feature() to list all available
    telemetry event aggregators of a given feature type. The list includes the
    "guid", the base address in MMIO space for the region where the event counters
    are exposed, and the package id where the all the CPUs that report to this
    aggregator are located.
    
    Call INTEL_PMT_TELEMETRY's intel_pmt_get_regions_by_feature() for each event
    group to obtain a private copy of that event group's aggregator data. Duplicate
    the aggregator data between event groups that have the same feature type
    but different GUID. Further processing on this private copy will be unique
    to the event group.
    
      ¹https://github.com/intel/Intel-PMT
    
      [ bp: Zap text explaining the code, s/guid/GUID/g ]
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit db64994d115e7c2cd72fec11b854467e97169379
Author: Tony Luck 
Date:   Wed Dec 17 09:21:02 2025 -0800

    fs/resctrl: Emphasize that L3 monitoring resource is required for summing domains
    
    The feature to sum event data across multiple domains supports systems with
    Sub-NUMA Cluster (SNC) mode enabled. The top-level monitoring files in each
    "mon_L3_XX" directory provide the sum of data across all SNC nodes sharing an
    L3 cache instance while the "mon_sub_L3_YY" sub-directories provide the event
    data of the individual nodes.
    
    SNC is only associated with the L3 resource and domains and as a result the
    flow handling the sum of event data implicitly assumes it is working with
    the L3 resource and domains.
    
    Reading of telemetry events does not require to sum event data so this feature
    can remain dedicated to SNC and keep the implicit assumption of working with
    the L3 resource and domains.
    
    Add a WARN to where the implicit assumption of working with the L3 resource
    is made and add comments on how the structure controlling the event sum
    feature is used.
    
    Suggested-by: Reinette Chatre 
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 2e53ad66686a46b141c3395719afeee3057ffe2f
Author: Tony Luck 
Date:   Wed Dec 17 09:21:01 2025 -0800

    x86,fs/resctrl: Add and initialize a resource for package scope monitoring
    
    Add a new PERF_PKG resource and introduce package level scope for monitoring
    telemetry events so that CPU hotplug notifiers can build domains at the
    package granularity.
    
    Use the physical package ID available via topology_physical_package_id()
    to identify the monitoring domains with package level scope. This enables
    user space to use:
    
      /sys/devices/system/cpu/cpuX/topology/physical_package_id
    
    to identify the monitoring domain a CPU is associated with.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 39208e73a40e0e81a5b12ddc11157c0a414df307
Author: Tony Luck 
Date:   Thu Jan 8 09:42:25 2026 -0800

    x86,fs/resctrl: Add an architectural hook called for first mount
    
    Enumeration of Intel telemetry events is an asynchronous process involving
    several mutually dependent drivers added as auxiliary devices during the
    device_initcall() phase of Linux boot. The process finishes after the probe
    functions of these drivers completes. But this happens after
    resctrl_arch_late_init() is executed.
    
    Tracing the enumeration process shows that it does complete a full seven
    seconds before the earliest possible mount of the resctrl file system (when
    included in /etc/fstab for automatic mount by systemd).
    
    Add a hook for use by telemetry event enumeration and initialization and
    run it once at the beginning of resctrl mount without any locks held.
    The architecture is responsible for any required locking.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://lore.kernel.org/r/20260105191711.GBaVwON5nZn-uO6Sqg@fat_crate.local

commit b9198ce5c6dfee19b9662dda95ba559af9cdf53f
Author: Luca Weiss 
Date:   Fri Jan 9 16:02:06 2026 +0100

    ASoC: codecs: aw88261: Add devicetree support
    
    Add the compatible "awinic,aw88261" so that module autoloading will work
    based on the compatible from devicetree.
    
    Signed-off-by: Luca Weiss 
    Link: https://patch.msgid.link/20260109-aw88261-dt-v1-2-45840c7632a3@fairphone.com
    Signed-off-by: Mark Brown 

commit e76f8c269e3558d02e19515cd3cc470e42ddbd36
Author: Luca Weiss 
Date:   Fri Jan 9 16:02:05 2026 +0100

    ASoC: codecs: aw88261: Remove AW88261_I2C_NAME macro
    
    Replace the macro by its simple string value, to make the code less
    unnecessarily complicated.
    
    Signed-off-by: Luca Weiss 
    Link: https://patch.msgid.link/20260109-aw88261-dt-v1-1-45840c7632a3@fairphone.com
    Signed-off-by: Mark Brown 

commit 72f654f4247fbf0b0ddb9092052531deb6fb895b
Author: Jani Nikula 
Date:   Wed Jan 7 17:54:01 2026 +0200

    drm/xe: improve header check
    
    Improve header check: Remove unused -DHDRTEST. Include the header twice
    to check for include guards. Run kernel-doc on the header.
    
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20260107155401.2379127-5-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit b3a7767989e6519127ac5e0cde682c50ad587f3b
Author: Jani Nikula 
Date:   Wed Jan 7 17:54:00 2026 +0200

    drm/xe/vm: fix xe_vm_validation_exec() kernel-doc
    
    Fix kernel-doc warnings on xe_vm_validation_exec():
    
    Warning: ../drivers/gpu/drm/xe/xe_vm.h:392 expecting prototype for
      xe_vm_set_validation_exec(). Prototype was for xe_vm_validation_exec()
      instead
    
    Fixes: 0131514f9789 ("drm/xe: Pass down drm_exec context to validation")
    Cc: Thomas Hellström 
    Cc: Matthew Brost 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20260107155401.2379127-4-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit a857e6102970c7bd8f2db967fe02d76741179d14
Author: Jani Nikula 
Date:   Wed Jan 7 17:53:59 2026 +0200

    drm/xe/xe_late_bind_fw: fix enum xe_late_bind_fw_id kernel-doc
    
    Fix kernel-doc warnings on enum xe_late_bind_fw_id:
    
    Warning: ../drivers/gpu/drm/xe/xe_late_bind_fw_types.h:19 cannot
      understand function prototype: 'enum xe_late_bind_fw_id'
    
    Fixes: 45832bf9c10f ("drm/xe/xe_late_bind_fw: Initialize late binding firmware")
    Cc: Badal Nilawar 
    Cc: Daniele Ceraolo Spurio 
    Cc: Rodrigo Vivi 
    Reviewed-by: Badal Nilawar 
    Link: https://patch.msgid.link/20260107155401.2379127-3-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 44393331c79f5df14c1ff25f4a355f439a2dc8a2
Author: Jani Nikula 
Date:   Wed Jan 7 17:53:58 2026 +0200

    drm/xe/vf: fix struct xe_gt_sriov_vf_migration kernel-doc
    
    Fix kernel-doc warnings on struct xe_gt_sriov_vf_migration:
    
    Warning: ../drivers/gpu/drm/xe/xe_gt_sriov_vf_types.h:47 cannot
      understand function prototype: 'struct xe_gt_sriov_vf_migration'
    
    Fixes: e1d2e2d878bf ("drm/xe/vf: Add xe_gt_recovery_pending helper")
    Cc: Matthew Brost 
    Cc: Michal Wajdeczko 
    Cc: Tomasz Lis 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20260107155401.2379127-2-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 4cdcfa64b6032ec68cdaa6c424b3b293cf7ff45c
Author: Jani Nikula 
Date:   Wed Jan 7 17:53:57 2026 +0200

    drm/xe/guc: fix struct guc_lfd_file_header kernel-doc
    
    Fix kernel-doc warnings on struct guc_lfd_file_header:
    
    Warning: ../drivers/gpu/drm/xe/abi/guc_lfd_abi.h:168 expecting prototype
      for struct guc_logfile_header. Prototype was for struct
      guc_lfd_file_header instead
    
    Fixes: 7eeb0e5408bd ("drm/xe/guc: Add LFD related abi definitions")
    Cc: Zhanjun Dong 
    Cc: Julia Filipchuk 
    Cc: Ashutosh Dixit 
    Reviewed-by: Zhanjun Dong 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20260107155401.2379127-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 0f8d0d764cc936cb834f39f0279c7776e0c1209d
Author: Gustavo Sousa 
Date:   Tue Jan 6 18:40:21 2026 -0300

    drm/i915/cdclk: Incorporate Xe3_LPD changes for CD2X divider
    
    On Xe3_LPD, there is no instruction to program the CD2X divider anymore
    and the hardware is expected to always use the default value of 0b00,
    meaning "divide by 1".
    
    With that, the CDCLK_CTL register was changed so that:
    
      (1) The field "CD2X Divider Select" became a debug-only field.
          Because we are programming CDCLK_CTL with a direct write instead
          of read-modify-write operation, we still need to program "CD2X
          Divider Select" in order to keep the field from deviating from its
          default value.  Let's, however, throw a warning if we encounter a
          CDCLK value that would result in an unexpected value for that
          field.
    
      (2) The field "CD2X Pipe Select" has been removed. In fact, some
          debugging in a PTL machine showed that such field comes back as
          zero after writing a non-zero value to it.  As such, do not
          program it starting with Xe3_LPD.
    
    v2:
      - Add missing "val |= " when calling bxt_cdclk_cd2x_pipe().
        (Dnyaneshwar)
    
    Bspec: 68864, 69090
    Reviewed-by: Dnyaneshwar Bhadane 
    Link: https://patch.msgid.link/20260106-xe3_lpd-no-cd2x-divider-v2-1-06e5cbc9dabb@intel.com
    Signed-off-by: Gustavo Sousa 

commit 8d38423d9dea7353a8a54a3ab2e0d0aa04ed34d0
Author: André Draszik 
Date:   Fri Jan 9 08:38:44 2026 +0000

    regulator: core: don't fail regulator_register() with missing required supply
    
    Since commit 98e48cd9283d ("regulator: core: resolve supply for
    boot-on/always-on regulators"), the regulator core returns
    -EPROBE_DEFER if a supply can not be resolved at regulator_register()
    time due to set_machine_constraints() requiring that supply (e.g.
    because of always-on or boot-on).
    
    In some hardware designs, multiple PMICs are used where individual
    rails of each act as supplies for rails of the other, and vice-versa.
    In such a design no PMIC driver can probe when registering one top-
    level regulator device (as is common practice for almost all regulator
    drivers in Linux) since that commit. Supplies are only considered when
    their driver has fully bound, but because in a design like the above
    two drivers / devices depend on each other, neither will have fully
    bound while the other probes. The Google Pixel 6 and 6 Pro (oriole and
    raven) are examples of such a design.
    
    One way to make this work would be to register each rail as an
    individual device, rather than just one top-level regulator device.
    Then, fw-devlink and Linux' driver core could do their usual handling
    of deferred device probe as each rail would be probed individually.
    This approach was dismissed in [1] as each regulator driver would have
    to take care of this itself.
    
    Alternatively, we can change the regulator core to not fail
    regulator_register() if a rail's required supply can not be resolved
    while keeping the intended change from above mentioned commit, and
    instead retry whenever a new rail is registered. This commit implements
    such an approach:
    
        If set_machine_constraints() requests probe deferral,
        regulator_register() still succeeds and we retry setting
        constraints as part of regulator_resolve_supply().
        We still do not enable the regulator or allow consumers to use it
        until constraints have been set (including resolution of the
        supply) to prevent enabling of a regulator before its supply.
    
    With this change, we keep track of regulators with missing required
    supplies and can therefore try to resolve them again and try to set
    the constraints again once more regulators become available.
    
    Care has to be taken to not allow consumers to use regulators that
    haven't had their constraints set yet. regulator_get() ensures that
    and now returns -EPROBE_DEFER in that case.
    
    The implementation is straight-forward, thanks to our newly introduced
    regulator-bus. Locking in regulator_resolve_supply() has to be done
    carefully, as a combination of regulator_(un)lock_two() and
    regulator_(un)lock_dependent() is needed. The reason is that
    set_machine_constraints() might call regulator_enable() which needs
    rdev and all its dependents locked, but everything else requires to
    only have rdev and its supply locked.
    
    Link: https://lore.kernel.org/all/aRn_-o-vie_QoDXD@sirena.co.uk/ [1]
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20260109-regulators-defer-v2-8-1a25dc968e60@linaro.org
    Signed-off-by: Mark Brown 

commit 304f5784e97281f18ef4bed574cbe5fcf6ce2f2e
Author: André Draszik 
Date:   Fri Jan 9 08:38:43 2026 +0000

    regulator: core: reresolve unresolved supplies when available
    
    When a regulator A and its supply B are provided by different devices,
    the driver implementing B might be last to probe (with A still
    pending resolution of its supply B). While we try to resolve all
    pending supplies for all regulators (including A) during
    regulator_register() of B via regulator_register_resolve_supply(),
    supply resolution will still not work for A as the driver for B hasn't
    finished binding to the PMIC device corresponding to B at that stage
    yet. The regulator core explicitly only allows supplies from other
    devices to be used once the relevant driver has fully bound, mainly to
    avoid having to deal with cases where B itself might -EPROBE_DEFER.
    
    In this case, A's supply will only be resolved as part of the core's
    regulator_init_complete_work_function(), which currently is scheduled
    to run after 30s. This was added as a work-around in
    commit 3827b64dba27 ("regulator: core: Resolve supplies before
    disabling unused regulators") to cover this situation.
    
    There are two problems with that approach:
    * it potentially runs long after all our consumers have probed
    * an upcoming change will allow regulator_register() to complete
      successfully even when required supplies (e.g. due to always-on or
      boot-on) are missing at register time, deferring full configuration
      of the regulator (and usability by consumers, i.e. usually consumer
      probe) until the supply becomes available.
      Resolving supplies in the late work func can therefore make it
      impossible for consumers to probe at all, as the driver core will not
      know to reprobe consumers when supplies have resolved.
    
    We could schedule an earlier work to try to resolve supplies sooner,
    but that'd be racy as consumers of A might try to probe before A's
    supply gets fully resolved via this extra work.
    
    Instead, add a very simple regulator bus and add a dummy device with a
    corresponding driver to it for each regulator that is missing its
    supply during regulator_register(). This way, the driver core will call
    our bus' probe whenever a new (regulator) device was successfully
    bound, allowing us to retry resolving the supply during (our bus) probe
    and to bind this dummy device if successful. In turn this means the
    driver core will see a newly bound device and retry probing of all
    pending consumers, if any.
    
    With that in place, we can avoid walking the full list of all known
    regulators to try resolve missing supplies during regulator_register(),
    as the driver core will invoke the bus probe for regulators that are
    still pending their supplies. We can also drop the code trying to
    resolve supplies one last time before unused regulators get disabled,
    as all supplies should have resolved at that point in time, and if they
    haven't then there's no point in trying again, as the outcome won't
    change.
    
    Note: We can not reuse the existing struct device created for each
    rail, as a device can not be part of a class and a bus simultaneously.
    
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20260109-regulators-defer-v2-7-1a25dc968e60@linaro.org
    Signed-off-by: Mark Brown 

commit e23c0a59dabae9166bbea26fc05d08e7d9e900b7
Author: André Draszik 
Date:   Fri Jan 9 08:38:42 2026 +0000

    regulator: core: don't ignore errors from event forwarding setup
    
    Receiving and forwarding critical supply events seems like they're
    important information and we shouldn't ignore errors occurring during
    registration for such events.
    
    With this change the supply is unset on event registration failure,
    allowing us to potentially retry another time.
    
    Fixes: 433e294c3c5b ("regulator: core: forward undervoltage events downstream by default")
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20260109-regulators-defer-v2-6-1a25dc968e60@linaro.org
    Signed-off-by: Mark Brown 

commit bdbdc4b398254597c9b6ac279f336750996bc0a6
Author: André Draszik 
Date:   Fri Jan 9 08:38:41 2026 +0000

    regulator: core: remove dead code in regulator_resolve_supply()
    
    Since commit 98e48cd9283d ("regulator: core: resolve supply for
    boot-on/always-on regulators") we require that a regulator's supply has
    been resolved before enabling the regulator. Furthermore,
    regulator_get() also fails if the supply hasn't been resolved yet
    (preventing consumers from enabling a regulator without its supply
    known). In combination this means that regulator_resolve_supply() now
    always runs before the regulator has been enabled via
    set_machine_constraints().
    
    The code here was meant to run after enabling the regulator in case the
    supply hadn't been resolved at that time and can therefore never
    execute anymore since that commit.
    
    Remove it.
    
    No functional change intended.
    
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20260109-regulators-defer-v2-5-1a25dc968e60@linaro.org
    Signed-off-by: Mark Brown 

commit 4f3323b752bfcc185c98ce4fb841cca8b700a7c0
Author: André Draszik 
Date:   Fri Jan 9 08:38:40 2026 +0000

    regulator: core: streamline supply resolution for always-on/boot-on regulators
    
    For always-on and boot-on regulators, regulator_register() is currently
    trying to anticipate the requirement to resolve a supply early.
    
    Unfortunately, this code executes too early, before we have potentially
    updated the regulator's always_on constraint as part of
    set_machine_constraints(), causing it to miss cases.
    
    Rather than trying to hack it more, just defer to the outcome of
    set_machine_constraints(). The latter returns early (without doing any
    regulator initialisation) with -EPROBE_DEFER as of commit 'regulator:
    core: move supply check earlier in set_machine_constraints()' and is
    therefore safe to call multiple times to determine if supplies need to
    be resolved early.
    
    Commit 8a866d527ac0 ("regulator: core: Resolve supply name earlier to
    prevent double-init") (later updated by
    commit 520fb178212d ("regulator: core: Fix regulator supply
    registration with sysfs")) added these tests originally to avoid
    calling set_machine_constraints() multiple times to try to avoid
    voltage glitches due to all the regulator initialisation happening each
    time. This isn't an issue anymore as per above.
    
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20260109-regulators-defer-v2-4-1a25dc968e60@linaro.org
    Signed-off-by: Mark Brown 

commit 86a8eeb0e913f4b6a55dabba5122098d4e805e55
Author: André Draszik 
Date:   Fri Jan 9 08:38:39 2026 +0000

    regulator: core: move supply check earlier in set_machine_constraints()
    
    Since commit 98e48cd9283d ("regulator: core: resolve supply for
    boot-on/always-on regulators"), set_machine_constraints() can return
    -EPROBE_DEFER very late, after it has done a lot of work and
    configuration of the regulator.
    
    This means that configuration will happen multiple times for no
    benefit in that case. Furthermore, this can lead to timing-dependent
    voltage glitches as mentioned e.g. in commit 8a866d527ac0 ("regulator:
    core: Resolve supply name earlier to prevent double-init").
    
    We can know that it's going to fail very early, in particular before
    going through the complete regulator configuration by moving some code
    around a little.
    
    Do so to avoid re-configuring the regulator multiple times, also
    avoiding the voltage glitches if we can.
    
    Fixes: 98e48cd9283d ("regulator: core: resolve supply for boot-on/always-on regulators")
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20260109-regulators-defer-v2-3-1a25dc968e60@linaro.org
    Signed-off-by: Mark Brown 

commit 497330b203d2c59c5ff3fa4c34d14494d7203bc3
Author: André Draszik 
Date:   Fri Jan 9 08:38:38 2026 +0000

    regulator: core: fix locking in regulator_resolve_supply() error path
    
    If late enabling of a supply regulator fails in
    regulator_resolve_supply(), the code currently triggers a lockdep
    warning:
    
        WARNING: drivers/regulator/core.c:2649 at _regulator_put+0x80/0xa0, CPU#6: kworker/u32:4/596
        ...
        Call trace:
         _regulator_put+0x80/0xa0 (P)
         regulator_resolve_supply+0x7cc/0xbe0
         regulator_register_resolve_supply+0x28/0xb8
    
    as the regulator_list_mutex must be held when calling _regulator_put().
    
    To solve this, simply switch to using regulator_put().
    
    While at it, we should also make sure that no concurrent access happens
    to our rdev while we clear out the supply pointer. Add appropriate
    locking to ensure that.
    
    While the code in question will be removed altogether in a follow-up
    commit, I believe it is still beneficial to have this corrected before
    removal for future reference.
    
    Fixes: 36a1f1b6ddc6 ("regulator: core: Fix memory leak in regulator_resolve_supply()")
    Fixes: 8e5356a73604 ("regulator: core: Clear the supply pointer if enabling fails")
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20260109-regulators-defer-v2-2-1a25dc968e60@linaro.org
    Signed-off-by: Mark Brown 

commit 96e7a88d32de2554a5d7e54e87eb03d445dd6924
Author: André Draszik 
Date:   Fri Jan 9 08:38:37 2026 +0000

    regulator: core: update two debug messages
    
    1)
    In print_constraints_debug(), the power budget is printed as:
    
       lldo2: 450 <--> 1300 mV at 900 mV 2147483647 mW budge, enabled
    
    (note the missing t in budget). This is because there is a --count just
    below the call to scnprintf(), to make space for the comma. All similar
    calls to scnprintf() above add an extra space to the format string to
    allow for that, but this one doesn't, so the last character t is
    stripped instead. Update the format string to fix the message.
    
    2)
    Add the name of the supply to the failure message printed when the
    supply can not be resolved when debug messages are enabled to help with
    debug.
    
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20260109-regulators-defer-v2-1-1a25dc968e60@linaro.org
    Signed-off-by: Mark Brown 

commit 608c8030d32254917bee136234948f5f02221d0f
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:44 2025 +0900

    pinctrl: aspeed: g5: Constrain LPC binding revision workaround to AST2500
    
    Discovering a phandle to an AST2400 or AST2600 LPC node indicates an
    error for the purpose of the AST2500 pinctrl driver.
    
    Signed-off-by: Andrew Jeffery 
    Reviewed-by: Linus Walleij 
    Signed-off-by: Linus Walleij 

commit 5abffd7ff012c1950d52313327fea44eaaefc64a
Author: Michael Walle 
Date:   Tue Dec 23 13:47:13 2025 +0100

    dt-bindings: gpu: img: Add AM62P SoC specific compatible
    
    The AM62P and the J722S features the same BXS-4 GPU as the J721S2. Add a
    new SoC specific compatible.
    
    Signed-off-by: Michael Walle 
    Acked-by: Conor Dooley 
    Reviewed-by: Matt Coster 
    Link: https://patch.msgid.link/20251223124729.2482877-2-mwalle@kernel.org
    Signed-off-by: Matt Coster 

commit db4371d13f82fb12463fe053f4864980a2af2106
Author: Vladimir Moravcevic 
Date:   Wed Jan 7 23:44:39 2026 -0800

    MAINTAINERS: Add entries for the Axiado SPI DB controller
    
    Add the MAINTAINERS entries for the Axiado SPI DB controller.
    
    Acked-by: Tzu-Hao Wei 
    Co-developed-by: Prasad Bolisetty 
    Signed-off-by: Prasad Bolisetty 
    Signed-off-by: Vladimir Moravcevic 
    Link: https://patch.msgid.link/20260107-axiado-ax3000-soc-spi-db-controller-driver-v3-3-726e70cf19ad@axiado.com
    Signed-off-by: Mark Brown 

commit e75a6b00ad7962a7ed1c9c777e9ab1eb29043ec8
Author: Vladimir Moravcevic 
Date:   Wed Jan 7 23:44:38 2026 -0800

    spi: axiado: Add driver for Axiado SPI DB controller
    
    The Axiado SPI controller is present in AX3000 SoC and Evaluation Board.
    This controller is operating in Host only mode.
    
    Co-developed-by: Prasad Bolisetty 
    Signed-off-by: Prasad Bolisetty 
    Signed-off-by: Vladimir Moravcevic 
    Link: https://patch.msgid.link/20260107-axiado-ax3000-soc-spi-db-controller-driver-v3-2-726e70cf19ad@axiado.com
    Signed-off-by: Mark Brown 

commit 7b122b1eb627059bd331d5119124a2da5e142c01
Author: Vladimir Moravcevic 
Date:   Wed Jan 7 23:44:37 2026 -0800

    spi: dt-bindings: axiado,ax3000-spi: Add binding for Axiado SPI DB controller
    
    Add documentation for Axiado Digital Block SPI controller.
    
    Co-developed-by: Prasad Bolisetty 
    Signed-off-by: Prasad Bolisetty 
    Signed-off-by: Vladimir Moravcevic 
    Link: https://patch.msgid.link/20260107-axiado-ax3000-soc-spi-db-controller-driver-v3-1-726e70cf19ad@axiado.com
    Signed-off-by: Mark Brown 

commit 5f8d6f29c51ab8572fc1d3891952ca445e75a610
Author: Boris Brezillon 
Date:   Tue Jan 6 17:49:35 2026 +0100

    drm/gem: Fix a GEM leak in drm_gem_get_unmapped_area()
    
    drm_gem_object_lookup_at_offset() can return a valid object with
    filp or filp->f_op->get_unmapped_area set to NULL. Make sure we still
    release the ref we acquired on such objects.
    
    Cc: Loïc Molinari 
    Fixes: 99bda20d6d4c ("drm/gem: Introduce drm_gem_get_unmapped_area() fop")
    Reviewed-by: Loïc Molinari 
    Link: https://patch.msgid.link/20260106164935.409765-1-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit a1b1ee0348f889ec262482e16e9ff670617db7b0
Author: Lad Prabhakar 
Date:   Tue Jan 6 13:13:19 2026 +0000

    arm64: dts: renesas: rzt2h-n2h-evk-common: Use GPIO for SD0 write protect
    
    Switch SD0 write-protect detection to a GPIO on the RZ/T2H and RZ/N2H
    EVKs. Both boards use a full-size SD card slot on the SD0 channel with
    a dedicated WP pin.
    
    The RZ/T2H and RZ/N2H SoCs use of_data_rcar_gen3, which sets
    MMC_CAP2_NO_WRITE_PROTECT and causes the core to ignore the WP signal
    unless a wp-gpios property is provided. Describe the WP pin as a GPIO
    to allow the MMC core to evaluate the write-protect status correctly.
    
    Fixes: d065453e5ee0 ("arm64: dts: renesas: rzt2h-rzn2h-evk: Enable SD card slot")
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20260106131319.643084-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 688fded2fc74b0539cd848b775418200c52a1fc2
Author: Lad Prabhakar 
Date:   Wed Dec 24 17:52:04 2025 +0000

    arm64: dts: renesas: r9a09g057: Add CANFD node
    
    Add CANFD node to RZ/V2H(P) ("R9A09G057") SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224175204.3400062-7-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit edd0ce2e33ce2dae0c31e3b39108d0c327b8fb2b
Author: Lad Prabhakar 
Date:   Wed Dec 24 17:52:03 2025 +0000

    arm64: dts: renesas: r9a09g056: Add CANFD node
    
    Add CANFD node to RZ/V2N ("R9A09G056") SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224175204.3400062-6-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 3e6c313f4f996ce73b80873b8172610003e90f35
Author: Lad Prabhakar 
Date:   Wed Dec 24 17:52:02 2025 +0000

    arm64: dts: renesas: r9a09g087m44-rzn2h-evk: Enable CANFD
    
    Enable CANFD channel 1, which is available on the CN35 connector.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224175204.3400062-5-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit d3112a820ccfe9a39c171fe3bc313794f1325711
Author: Lad Prabhakar 
Date:   Wed Dec 24 17:52:01 2025 +0000

    arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Enable CANFD
    
    Enable CANFD channel 0, which is available on the CN55 connector.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224175204.3400062-4-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 3fcf1e255e0d97b42e7d003596ae987fb193bcf0
Author: Lad Prabhakar 
Date:   Wed Dec 24 17:52:00 2025 +0000

    arm64: dts: renesas: r9a09g087: Add CANFD node
    
    Add support for the CANFD controller on the Renesas RZ/N2H Soc.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224175204.3400062-3-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit ff108a26c91631bef465702d04bcd8d910af7f0e
Author: Lad Prabhakar 
Date:   Wed Dec 24 17:51:59 2025 +0000

    arm64: dts: renesas: r9a09g077: Add CANFD node
    
    Add support for the CANFD controller on the Renesas RZ/T2H Soc.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224175204.3400062-2-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 69a134769c78d93cf53cabca0641125f29bda441
Merge: 03301175a6febb 481b64376c3fb7
Author: Geert Uytterhoeven 
Date:   Fri Jan 9 12:12:20 2026 +0100

    Merge tag 'renesas-r9a09g077-dt-binding-defs-tag6' into renesas-dts-for-v6.20
    
    Renesas RZ/T2H and RZ/N2H PCLKCAN Clock DT Binding Definitions
    
    PCLKCAN Clock DT binding definitions for the Renesas RZ/T2H (R9A09G077)
    and RZ/N2H (R9A09G087) SoCs, shared by driver and DT source files.

commit abf2111d8d900c834993d443f59b836291b8d0fc
Author: Alice Ryhl 
Date:   Wed Jan 7 14:14:13 2026 +0000

    rust: helpers: Move #define __rust_helper out of atomic.c
    
    In order to support inline helpers [1], we need to have __rust_helper
    defined for all helper files. Current we are lucky that atomic.c is the
    first file in helpers.c, but this is fragile. Thus, move it to
    helpers.c.
    
    [boqun: Reword the commit message and apply file hash changes]
    
    Link: https://lore.kernel.org/r/20260105-define-rust-helper-v2-0-51da5f454a67@google.com [1]
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260107-move-rust_helper-define-v1-1-4109d58ef275@google.com

commit 5628f0510a4c64908c5d2f36a676b092e1e5d174
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:38 2026 +0000

    rust: wait: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-25-51da5f454a67@google.com

commit 75b6034780e8dc8c71096313534ccb720fa633f9
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:35 2026 +0000

    rust: time: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-22-51da5f454a67@google.com

commit 5f1193d55a4311780136044355b1f09e7b5abac7
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:34 2026 +0000

    rust: task: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-21-51da5f454a67@google.com

commit d4ad4de929ba27ed241c6ef1098b1687001ced1f
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:33 2026 +0000

    rust: sync: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-20-51da5f454a67@google.com

commit 9ba1aaf25ab7dadb910348b6857865e87b4c5689
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:30 2026 +0000

    rust: refcount: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-17-51da5f454a67@google.com

commit 5e03edaed373f41e7a3c8617e01891eb680d62aa
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:29 2026 +0000

    rust: rcu: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Joel Fernandes (NVIDIA) 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-16-51da5f454a67@google.com

commit a87e6fe8738fabf9881758b79b0db592c057acbd
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:26 2026 +0000

    rust: processor: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-13-51da5f454a67@google.com

commit 9f658bd5378d5c357d5eeb1e699f1504a7498dbf
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:19 2026 +0000

    rust: cpu: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-6-51da5f454a67@google.com

commit 1c7a6f48f7eeb3014584d2fc55fc67f0cbaeef69
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:18 2026 +0000

    rust: completion: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-5-51da5f454a67@google.com

commit 71a4d13fa1cf2b7a4f45a6ee41548c27783f7940
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:15 2026 +0000

    rust: blk: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-2-51da5f454a67@google.com

commit aa574e0f21a6e7a28e4b8794ad4238d3bfd4f9df
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:14 2026 +0000

    rust: barrier: Add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-1-51da5f454a67@google.com

commit 7f4c8b4dcde7174a3bd5d001790d8453c9aefa3c
Author: FUJITA Tomonori 
Date:   Tue Dec 30 18:37:18 2025 +0900

    rust_binder: Switch to kernel::sync atomic primitives
    
    Convert uses of AtomicBool, AtomicUsize, and AtomicU32.
    
    Signed-off-by: FUJITA Tomonori 
    Acked-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251230093718.1852322-4-fujita.tomonori@gmail.com

commit 323e4bfcbe2dc6c6cac6e007dded0ba4f89a6458
Author: FUJITA Tomonori 
Date:   Tue Dec 30 18:37:17 2025 +0900

    rust: list: Switch to kernel::sync atomic primitives
    
    Convert uses of `AtomicBool` to `Atomic`.
    
    Note that the compare_exchange migration simplifies to
    `try_cmpxchg()`, since `try_cmpxchg()` provides relaxed ordering on
    failure, making the explicit failure ordering unnecessary.
    
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251230093718.1852322-3-fujita.tomonori@gmail.com

commit 4bac28727a2b3f33e6375aeafdf31df67deff5d0
Author: FUJITA Tomonori 
Date:   Thu Jan 1 12:49:22 2026 +0900

    rust: sync: atomic: Add atomic bool tests
    
    Add tests for Atomic operations.
    
    Atomic does not fit into the existing u8/16/32/64 tests so
    introduce a dedicated test for it.
    
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260101034922.2020334-3-fujita.tomonori@gmail.com

commit 06bd0e52bfd78eae1c7dd5db163ce64161b495e7
Author: FUJITA Tomonori 
Date:   Thu Jan 1 12:49:21 2026 +0900

    rust: sync: atomic: Add atomic bool support via i8 representation
    
    Add `bool` support, `Atomic` by using `i8` as its underlying
    representation.
    
    Rust specifies that `bool` has size 1 and alignment 1 [1], so it
    matches `i8` on layout; keep `static_assert!()` checks to enforce this
    assumption at build time.
    
    [boqun: Remove the unnecessary impl AtomicImpl for bool]
    
    Link: https://doc.rust-lang.org/reference/types/boolean.html [1]
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260101034922.2020334-2-fujita.tomonori@gmail.com

commit 584f286f822afecc1a6521a27b3caf3e2f515d41
Author: FUJITA Tomonori 
Date:   Sun Dec 28 21:05:46 2025 +0900

    rust: sync: atomic: Add i8/i16 xchg and cmpxchg support
    
    Add atomic xchg and cmpxchg operation support for i8 and i16 types
    with tests.
    
    Note that since the current implementation of
    Atomic::<{i8,i16}>::{load,store}() is READ_ONCE()/WRITE_ONCE()-based.
    The atomicity between load/store and xchg/cmpxchg is only guaranteed if
    the architecture has native RmW support, hence i8/i16 is currently
    AtomicImpl only when CONFIG_ARCH_SUPPORTS_ATOMIC_RWM=y.
    
    [boqun: Make i8/i16 AtomicImpl only when
    CONFIG_ARCH_SUPPORTS_ATOMIC_RWM=y]
    
    Signed-off-by: FUJITA Tomonori 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251228120546.1602275-4-fujita.tomonori@gmail.com

commit 7b001c97d9bdaea50e1e1834040c58f7ef9f4e89
Author: FUJITA Tomonori 
Date:   Thu Dec 11 20:38:26 2025 +0900

    rust: sync: atomic: Add store_release/load_acquire tests
    
    Add minimum store_release/load_acquire tests.
    
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251211113826.1299077-5-fujita.tomonori@gmail.com

commit b33796d554f270e19141c0c1fa0a90705a511d2b
Author: FUJITA Tomonori 
Date:   Thu Dec 11 20:38:25 2025 +0900

    rust: sync: atomic: Add i8/i16 load and store support
    
    Add atomic operation support for i8 and i16 types using volatile
    read/write and smp_load_acquire/smp_store_release helpers.
    
    [boqun: Adjust [1] to avoid introduction of
    impl_atomic_only_load_and_store_ops!() in the middle]
    
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Reviewed-by: Joel Fernandes 
    Link: https://lore.kernel.org/all/20251228120546.1602275-1-fujita.tomonori@gmail.com/ [1]
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251211113826.1299077-4-fujita.tomonori@gmail.com

commit cf4c3bc1445152c1949a4b5fef56d07579fadb1e
Author: Boqun Feng 
Date:   Tue Jan 6 11:40:34 2026 +0800

    arch: um/x86: Select ARCH_SUPPORTS_ATOMIC_RMW for UML_X86
    
    x86 atomic instructions are used for um on UML_X86, therefore atomics
    on UML_X86 support native atomic RmW as x86 does, hence select
    ARCH_SUPPORTS_ATOMIC_RMW.
    
    Reviewed-by: FUJITA Tomonori 
    Acked-by: Richard Weinberger 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20260106034034.60074-1-boqun.feng@gmail.com

commit 2bb8c41e61b29ccdf7b6d716c3a8fe8488aa202a
Author: FUJITA Tomonori 
Date:   Sun Dec 28 21:05:44 2025 +0900

    rust: sync: atomic: Prepare AtomicOps macros for i8/i16 support
    
    Rework the internal AtomicOps macro plumbing to generate per-type
    implementations from a mapping list.
    
    Capture the trait definition once and reuse it for both declaration
    and per-type impl expansion to reduce duplication and keep future
    extensions simple.
    
    This is a preparatory refactor for enabling i8/i16 atomics cleanly.
    
    Signed-off-by: FUJITA Tomonori 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251228120546.1602275-2-fujita.tomonori@gmail.com

commit 8de731a6c75547602601a5d219b5cf259ce2b38b
Author: FUJITA Tomonori 
Date:   Sat Dec 27 20:59:51 2025 +0900

    rust: helpers: Add i8/i16 atomic try_cmpxchg_relaxed helpers
    
    Add i8/i16 atomic try_cmpxchg_relaxed helpers that call
    try_cmpxchg_relaxed() macro implementing atomic try_cmpxchg_relaxed
    using architecture-specific instructions.
    
    [boqun: Use try_cmpxchg_relaxed() instead of raw_try_cmpxchg_relaxed()]
    
    Signed-off-by: FUJITA Tomonori 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251227115951.1424458-5-fujita.tomonori@gmail.com

commit b5992f07a9736ab6279181c848f42227af9945bf
Author: FUJITA Tomonori 
Date:   Sat Dec 27 20:59:50 2025 +0900

    rust: helpers: Add i8/i16 atomic try_cmpxchg_release helpers
    
    Add i8/i16 atomic try_cmpxchg_release helpers that call
    try_cmpxchg_release() macro implementing atomic try_cmpxchg_release
    using architecture-specific instructions.
    
    [boqun: Use try_cmpxchg_release() instead of raw_try_cmpxchg_release()]
    
    Signed-off-by: FUJITA Tomonori 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251227115951.1424458-4-fujita.tomonori@gmail.com

commit fed6aaa392c301721144303d64b7c68575d9d5ef
Author: FUJITA Tomonori 
Date:   Sat Dec 27 20:59:49 2025 +0900

    rust: helpers: Add i8/i16 atomic try_cmpxchg_acquire helpers
    
    Add i8/i16 atomic try_cmpxchg_acquire helpers that call
    try_cmpxchg_acquire() macro implementing atomic try_cmpxchg_acquire
    using architecture-specific instructions.
    
    [boqun: Use try_cmpxchg_acquire() instead of raw_try_cmpxchg_acquire()]
    
    Signed-off-by: FUJITA Tomonori 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251227115951.1424458-3-fujita.tomonori@gmail.com

commit 164e4b5600b32b4ddeac58bb5b37bc1490a1dce4
Author: FUJITA Tomonori 
Date:   Sat Dec 27 20:59:48 2025 +0900

    rust: helpers: Add i8/i16 atomic try_cmpxchg helpers
    
    Add i8/i16 atomic try_cmpxchg helpers that call try_cmpxchg() macro
    implementing atomic try_cmpxchg using architecture-specific
    instructions.
    
    [boqun: Add comments explaining CONFIG_ARCH_SUPPORTS_ATOMIC_RMW and use
    try_cmpxchg() instead of raw_try_cmpxchg()]
    
    Signed-off-by: FUJITA Tomonori 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251227115951.1424458-2-fujita.tomonori@gmail.com

commit 910cbddc416cc30d83966baf378f44e59f3dc5d7
Author: FUJITA Tomonori 
Date:   Tue Dec 23 15:21:40 2025 +0900

    rust: helpers: Add i8/i16 atomic xchg_relaxed helpers
    
    Add i8/i16 atomic xchg_relaxed helpers that call xchg_relaxed() macro
    implementing atomic xchg_relaxed using architecture-specific
    instructions.
    
    [boqun: Use xchg_relaxed() instead of raw_xchg_relaxed()]
    
    Reviewed-by: Alice Ryhl 
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251223062140.938325-5-fujita.tomonori@gmail.com

commit 1bfca1e7e845a55fa82046727666f713d24ebdad
Author: FUJITA Tomonori 
Date:   Tue Dec 23 15:21:39 2025 +0900

    rust: helpers: Add i8/i16 atomic xchg_release helpers
    
    Add i8/i16 atomic xchg_release helpers that call xchg_release() macro
    implementing atomic xchg_release using architecture-specific
    instructions.
    
    [boqun: Use xchg_release() instead of raw_xchg_release()]
    
    Reviewed-by: Alice Ryhl 
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251223062140.938325-4-fujita.tomonori@gmail.com

commit ab717dd98bee964add2161d94193d756fdef614c
Author: FUJITA Tomonori 
Date:   Tue Dec 23 15:21:38 2025 +0900

    rust: helpers: Add i8/i16 atomic xchg_acquire helpers
    
    Add i8/i16 atomic xchg_acquire helpers that call xchg_acquire() macro
    implementing atomic xchg_acquire using architecture-specific
    instructions.
    
    [boqun: Use xchg_acquire() instead of raw_xchg_acquire()]
    
    Reviewed-by: Alice Ryhl 
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251223062140.938325-3-fujita.tomonori@gmail.com

commit 5dbc0a692459bc49cdb7add281086291da547750
Author: FUJITA Tomonori 
Date:   Tue Dec 23 15:21:37 2025 +0900

    rust: helpers: Add i8/i16 atomic xchg helpers
    
    Add i8/i16 atomic xchg helpers that call xchg() macro implementing
    atomic xchg using architecture-specific instructions.
    
    [boqun: Use xchg() instead of raw_xchg()]
    
    Reviewed-by: Alice Ryhl 
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251223062140.938325-2-fujita.tomonori@gmail.com

commit 300e53b3d3b59e72a972a12ee5c6438aab4860a4
Author: FUJITA Tomonori 
Date:   Thu Dec 11 20:38:24 2025 +0900

    rust: helpers: Add i8/i16 relaxed atomic helpers
    
    Add READ_ONCE/WRITE_ONCE based helpers for i8 and i16 types to support
    relaxed atomic operations in Rust.
    
    While relaxed operations could be implemented purely in Rust using
    read_volatile() and write_volatile(), using C's READ_ONCE() and
    WRITE_ONCE() macros ensures complete consistency with the kernel
    memory model.
    
    These helpers expose different symbol names than their C counterparts
    so they are split into atomic_ext.c instead of atomic.c. The symbol
    names; the names make the interface Rust/C clear, consistent with
    i32/i64.
    
    [boqun: Rename the functions from {load,store} to {read,set} to avoid
    future adjustment]
    
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251211113826.1299077-3-fujita.tomonori@gmail.com

commit 2cc3d5d6adbee058858f2e66de701a203b032746
Author: FUJITA Tomonori 
Date:   Thu Dec 11 20:38:23 2025 +0900

    rust: helpers: Add i8/i16 atomic_read_acquire/atomic_set_release helpers
    
    Add helper functions to expose smp_load_acquire() and
    smp_store_release() for i8 and i16 types.
    
    The smp_load_acquire() and smp_store_release() macros require type
    information (sizeof) to generate appropriate architecture-specific
    memory ordering instructions. Therefore, separate helper functions are
    needed for each type size.
    
    These helpers expose different symbol names than their C counterparts
    so they are split into atomic_ext.c instead of atomic.c. The symbol
    names; atomic_[i8|i16]_read_acquire and atomic_[i8|i16]_set_release
    makes the interface Rust/C clear, consistent with i32/i64.
    
    These helpers will be used by the upcoming Atomic and Atomic
    implementation to provide proper Acquire/Release semantics across all
    architectures.
    
    [boqun: Rename the functions from {load,store} to {read,set} to avoid
    future adjustment]
    
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Gary Guo 
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251211113826.1299077-2-fujita.tomonori@gmail.com

commit 09248ed8cdb6345afc883c02aecd79dfbd9c2a9c
Author: Alice Ryhl 
Date:   Thu Dec 18 08:25:13 2025 +0000

    rust: sync: Implement Unpin for ARef
    
    The default implementation of Unpin for ARef is conditional on T
    being Unpin due to its PhantomData field. However, this is overly
    strict as pointers to T are legal to move even if T itself cannot move.
    
    Since commit 66f1ea83d9f8 ("rust: lock: Add a Pin<&mut T> accessor")
    this causes build failures when combined with a Mutex that contains an
    field ARef, because almost any type that ARef is used with is !Unpin.
    
    Reviewed-by: Daniel Almeida 
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Alexandre Courbot 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251218-unpin-for-aref-v2-1-30d77129cbc6@google.com

commit 8a581130b1cbc17c702298b8325e3df98c792760
Author: FUJITA Tomonori 
Date:   Tue Dec 16 09:09:01 2025 +0900

    rust: sync: set_once: Implement Send and Sync
    
    Implement Send and Sync for SetOnce to allow it to be used across
    thread boundaries.
    
    Send: SetOnce can be transferred across threads when T: Send, as
    the contained value is also transferred and will be dropped on the
    destination thread.
    
    Sync: SetOnce can be shared across threads when T: Sync, as
    as_ref() provides shared references &T and atomic operations ensure
    proper synchronization. Since the inner T may be dropped on any
    thread, we also require T: Send.
    
    Signed-off-by: FUJITA Tomonori 
    Reviewed-by: Andreas Hindborg 
    Reviewed-by: Gary Guo 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20251216000901.221375-1-fujita.tomonori@gmail.com

commit 106ab474e5a711ea08e0908a42cfa89d691e57ad
Author: Alice Ryhl 
Date:   Mon Aug 11 12:14:42 2025 +0000

    rust: sync: Clean up LockClassKey and its docs
    
    Several aspects of the code and documentation for this type is
    incomplete. Also several things are hidden from the docs. Thus, clean it
    up and make it easier to read the rendered html docs.
    
    Reviewed-by: Daniel Almeida 
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20250811-lock-class-key-cleanup-v3-2-b12967ee1ca2@google.com

commit 86f4a271dc1962e389ea512d07a77626dbd8c1d8
Author: Alice Ryhl 
Date:   Mon Aug 11 12:14:41 2025 +0000

    rust: sync: Refactor static_lock_class!() macro
    
    By introducing a new_static() constructor, the macro does not need to go
    through MaybeUninit::uninit().assume_init(), which is a pattern that is
    best avoided when possible.
    
    The safety comment not only requires that the value is leaked, but also
    that it is stored in the right portion of memory. This is so that the
    lockdep static_obj() check will succeed when using this constructor. One
    could argue that lockdep detects this scenario, so that safety
    requirement isn't needed. However, it simplifies matters to require that
    static_obj() will succeed and it's not a burdensome requirement on the
    caller.
    
    Suggested-by: Benno Lossin 
    Reviewed-by: Daniel Almeida 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Boqun Feng 
    Link: https://patch.msgid.link/20250811-lock-class-key-cleanup-v3-1-b12967ee1ca2@google.com

commit 8b12070746854a70bd43d5763562561efc1840de
Author: Cosmin Tanislav 
Date:   Fri Dec 5 17:02:29 2025 +0200

    dt-bindings: pinctrl: renesas,r9a09g077-pinctrl: Document GPIO IRQ
    
    The Renesas RZ/T2H (R9A09G077) and Renesas RZ/N2H (R9A09G087) SoCs have
    IRQ-capable pins handled by the ICU, which forwards them to the GIC.
    
    The ICU supports 16 IRQ lines, the pins map to these lines arbitrarily,
    and the mapping is not configurable.
    
    Document the required properties to handle GPIO IRQ.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Rob Herring (Arm) 
    Reviewed-by: Linus Walleij 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251205150234.2958140-4-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 49b039a61a314c18074c15a7047705399e1240e6
Author: Cosmin Tanislav 
Date:   Fri Dec 5 17:02:28 2025 +0200

    pinctrl: renesas: rzt2h: Allow .get_direction() for IRQ function GPIOs
    
    Setting up an IRQ would normally be done in the .activate() and
    .deactivate() ops of the IRQ domain, but for hierarchical IRQ domains
    the .activate() and .deactivate() ops are overridden in the
    gpiochip_hierarchy_setup_domain_ops() function.
    
    As such, activating and deactivating need to be done in the .translate()
    and .free() ops of the IRQ domain.
    
    For RZ/T2H and RZ/N2H, interrupts go through the pin controller, into
    the ICU, which level-translates them and forwards them to the GIC.
    
    To use a GPIO as an interrupt it needs to be put into peripheral
    function mode 0, which will connect it to the IRQ lines of the ICU.
    
    The IRQ chip .child_to_parent_hwirq() callback is called as part of the
    IRQ fwspec parsing logic (as part of irq_create_of_mapping()) which
    happens before the IRQ is requested (as part of gpiochip_lock_as_irq()).
    
    gpiochip_lock_as_irq() calls gpiod_get_direction() if the
    .get_direction() callback is provided to ensure that the GPIO line is
    set up as input.
    
    In our case, IRQ function is separate from GPIO, and both cannot be true
    at the same time.
    
    Return GPIO_LINE_DIRECTION_IN even if pin is in IRQ function to allow
    this setup to work.
    
    Hold the spinlock to ensure atomicity between reading the PMC register
    (which determines whether the pin is in GPIO mode or not) and reading
    the function of the pin when it is not in GPIO mode.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251205150234.2958140-3-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit ba4a92372bea29aa2f0294a215e04ff77d98cbe7
Author: Cosmin Tanislav 
Date:   Fri Dec 5 17:02:27 2025 +0200

    pinctrl: renesas: rzt2h: Move GPIO enable/disable into separate function
    
    GPIO is enabled or disabled in multiple places, simplify code by moving
    this logic into a separate function.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251205150234.2958140-2-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 0244539f9a4f3b564604dfe4d639f61cecec381a
Author: Chaoyi Chen 
Date:   Thu Nov 6 10:06:31 2025 +0800

    drm/rockchip: Drop ROCKCHIP_IOMMU depend for DRM_ROCKCHIP
    
    On the RK3506 platform, there is no iommu hardware. And even on
    platform that have iommu hardware, it should be possible to use
    VOP without enabling iommu. In this case, a contiguous memory
    space like CMA should be used.
    
    So this patch removes the dependency on ROCKCHIP_IOMMU
    with an 'optional-dependency'.
    
    Signed-off-by: Chaoyi Chen 
    [added reference to optional-dependies description]
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251106020632.92-9-kernel@airkyi.com

commit 03301175a6febb2faf7984e7a2396c345d8774a0
Author: Lad Prabhakar 
Date:   Mon Dec 22 16:42:38 2025 +0000

    arm64: dts: renesas: r9a09g057: Add RSCI nodes
    
    Add RSCI nodes to RZ/V2H(P) ("R9A09G057") SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251222164238.156985-3-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit cda350fbd275acae7cf2edb04b4691c2b9af4fb2
Author: Lad Prabhakar 
Date:   Mon Dec 22 16:42:37 2025 +0000

    arm64: dts: renesas: r9a09g056: Add RSCI nodes
    
    Add RSCI nodes to RZ/V2N ("R9A09G056") SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251222164238.156985-2-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 2c089ad703527f5ae08c7c362a9dfe5a660ab16d
Author: Cosmin Tanislav 
Date:   Fri Dec 5 17:02:34 2025 +0200

    arm64: dts: renesas: r9a09g087m44-rzn2h-evk: Add GPIO keys
    
    The Renesas RZ/N2H Evaluation Kit has three user buttons connected to
    GPIOs that can be used as input keys.
    
    Add support for them.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251205150234.2958140-9-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit fcec728e1599f45f7956c1f7694706cf77cdf29e
Author: Cosmin Tanislav 
Date:   Fri Dec 5 17:02:33 2025 +0200

    arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Add GPIO keys
    
    The Renesas RZ/T2H Evaluation Kit has three user buttons connected to
    GPIOs that can be used as input keys.
    
    Add support for them.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251205150234.2958140-8-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 7c9cf4eb9d600a51e4770e6ab876e123dd6b5165
Author: Cosmin Tanislav 
Date:   Fri Dec 5 17:02:32 2025 +0200

    arm64: dts: renesas: r9a09g087: Add GPIO IRQ support
    
    The Renesas RZ/N2H (R9A09G087) SoC includes pins which can be routed via
    the ICU to generate interrupts.
    
    Add support for using the pin controller as an interrupt chip.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251205150234.2958140-7-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit a0c0b921b63902b3993bf60bd0ab8c3041a23481
Author: Cosmin Tanislav 
Date:   Fri Dec 5 17:02:31 2025 +0200

    arm64: dts: renesas: r9a09g077: Add GPIO IRQ support
    
    The Renesas RZ/T2H (R9A09G077) SoC includes pins which can be routed via
    the ICU to generate interrupts.
    
    Add support for using the pin controller as an interrupt chip.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251205150234.2958140-6-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 5c4c34ea8dc02350fad11bc5423ca065595bbd54
Author: Cosmin Tanislav 
Date:   Wed Nov 26 15:03:56 2025 +0200

    arm64: dts: renesas: r9a09g087: Add TSU and thermal zones support
    
    The Renesas RZ/N2H (R9A09G087) SoC includes a Temperature Sensor Unit
    (TSU). The device provides real-time temperature measurements for
    thermal management, utilizing a single dedicated channel for temperature
    sensing.
    
    The TSU loads calibration data via SMC SIP.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251126130356.2768625-10-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit aea73cb10ec5bf8e24ff688eba8aeb9c7d1b4cd0
Author: Cosmin Tanislav 
Date:   Wed Nov 26 15:03:55 2025 +0200

    arm64: dts: renesas: r9a09g077: Add TSU and thermal zones support
    
    The Renesas RZ/T2H (R9A09G077) SoC includes a Temperature Sensor Unit
    (TSU). The device provides real-time temperature measurements for
    thermal management, utilizing a single dedicated channel for temperature
    sensing.
    
    The TSU loads calibration data via SMC SIP.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251126130356.2768625-9-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit ffcc240e3680e77d36c99026f5da81553d559246
Author: Cosmin Tanislav 
Date:   Wed Nov 26 15:03:54 2025 +0200

    arm64: dts: renesas: r9a09g087: Add OPP table
    
    Add OPP table for RZ/N2H SoC.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251126130356.2768625-8-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 98aa86525051bbb974818cd27f9a6fbaf255975b
Author: Cosmin Tanislav 
Date:   Wed Nov 26 15:03:53 2025 +0200

    arm64: dts: renesas: r9a09g077: Add OPP table
    
    Add OPP table for RZ/T2H SoC.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251126130356.2768625-7-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 736a2dcfdae72483a36793bc92182f33bd61d30e
Author: Borislav Petkov (AMD) 
Date:   Tue Dec 30 12:07:31 2025 +0100

    x86/CPU/AMD: Simplify the spectral chicken fix
    
    msr_set_bit() takes a bit number to set but MSR_ZEN2_SPECTRAL_CHICKEN_BIT
    is a bit mask. The usual pattern that code uses is a _BIT-named type
    macro instead of a mask.
    
    So convert it to a bit number to reflect that.
    
    Also, msr_set_bit() already does the reading and checking whether the
    bit needs to be set so use that instead of a local variable.
    
    Fixup tabbing while at it.
    
    No functional changes.
    
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Nikolay Borisov 
    Link: https://patch.msgid.link/20251230110731.28108-1-bp@kernel.org

commit 879e9fc8f689cbd890f2f79b9da098697746316d
Author: Biju Das 
Date:   Thu Jan 8 12:34:28 2026 +0000

    clk: renesas: rzv2h: Deassert reset on assert timeout
    
    If the assert() fails due to timeout error, set the reset register bit
    back to deasserted state. This change is needed especially for handling
    assert error in suspend() callback that expect the device to be in
    operational state in case of failure.
    
    Signed-off-by: Biju Das 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20260108123433.104464-3-biju.das.jz@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 0b0201f259e1158a875c5fd01adf318ae5d32352
Author: Biju Das 
Date:   Thu Jan 8 12:34:27 2026 +0000

    clk: renesas: rzg2l: Deassert reset on assert timeout
    
    If the assert() fails due to timeout error, set the reset register bit
    back to deasserted state. This change is needed especially for handling
    assert error in suspend() callback that expect the device to be in
    operational state in case of failure.
    
    Signed-off-by: Biju Das 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20260108123433.104464-2-biju.das.jz@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit cda6a5def5917c6c23af1003d323ecdc5f2960a9
Author: Lad Prabhakar 
Date:   Mon Jan 5 14:06:25 2026 +0000

    clk: renesas: cpg-mssr: Unlock before reset verification
    
    Move spin_unlock_irqrestore() before verifying the reset result and
    printing errors. The verification condition only uses local variables
    and does not require locking.
    
    Reported-by: Pavel Machek 
    Closes: https://lore.kernel.org/all/aVujAQJSDn6WyORK@duo.ucw.cz/
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20260105140625.2590685-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit c2922664613277c61922bbe577f25092a85fb27e
Author: Lad Prabhakar 
Date:   Wed Dec 24 16:50:49 2025 +0000

    clk: renesas: r9a09g056: Add entries for CANFD
    
    Add clock and reset entries for the CANFD IP.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224165049.3384870-5-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 26cc40e82230a776ead2ef6a6ed83bf80f94bb01
Author: Lad Prabhakar 
Date:   Wed Dec 24 16:50:48 2025 +0000

    clk: renesas: r9a09g057: Add entries for CANFD
    
    Add clock and reset entries for the CANFD IP.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224165049.3384870-4-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 535677e920f09c6e478e671e4527ff9af6ffc6c7
Author: Lad Prabhakar 
Date:   Wed Dec 24 16:50:47 2025 +0000

    clk: renesas: r9a09g077: Add CANFD clocks
    
    The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have a CANFD
    peripheral which has three input clocks PCLKM (peripheral clock),
    PCLKH (RAM clock) and PCLKCAN (CANFD clock).
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224165049.3384870-3-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit c07dd5ac0e2834bffc70409401e3bccac8abbbb4
Merge: 3132ec8c8c2c28 481b64376c3fb7
Author: Geert Uytterhoeven 
Date:   Fri Jan 9 11:25:29 2026 +0100

    Merge tag 'renesas-r9a09g077-dt-binding-defs-tag6' into renesas-clk-for-v6.20
    
    Renesas RZ/T2H and RZ/N2H PCLKCAN Clock DT Binding Definitions
    
    PCLKCAN Clock DT binding definitions for the Renesas RZ/T2H (R9A09G077)
    and RZ/N2H (R9A09G087) SoCs, shared by driver and DT source files.

commit 3132ec8c8c2c28787d0ad80e53db296713155f12
Author: Cosmin Tanislav 
Date:   Thu Nov 27 16:56:54 2025 +0200

    clk: renesas: cpg-mssr: Handle RZ/T2H register layout in PM callbacks
    
    The register layout for RZ/T2H is not handled inside
    cpg_mssr_suspend_noirq() and cpg_mssr_resume_noirq(), causing a memory
    abort because the wrong code path is taken, as shown below.
    
    Explicitly handle the RZ/T2H register layout in cpg_mssr_suspend_noirq()
    and cpg_mssr_resume_noirq(), similar to how it is done inside
    cpg_mstp_clock_is_enabled() and cpg_mstp_clock_endisable().
    
    [   90.052296] Mem abort info:
    [   90.055420]   ESR = 0x0000000096000007
    [   90.059553]   EC = 0x25: DABT (current EL), IL = 32 bits
    [   90.065697]   SET = 0, FnV = 0
    [   90.069211]   EA = 0, S1PTW = 0
    [   90.072834]   FSC = 0x07: level 3 translation fault
    [   90.078109] Data abort info:
    [   90.081405]   ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
    [   90.087427]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
    [   90.093169]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
    [   90.099008] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000c60b4000
    [   90.106756] [ffff800082816318] pgd=0000000000000000, p4d=10000000c69ef003, pud=10000000c69f0003, pmd=100000024002b403, pte=0000000000000000
    [   90.120727] Internal error: Oops: 0000000096000007 [#1]  SMP
    [   90.127058] Modules linked in: sha256 cfg80211 spi_nor at24 renesas_usbhs bluetooth ecdh_generic ecc rfkill rzt2h_adc spi_rzv2h_rspi industrialio_adc gpio_keys fuse drm backlight ipv6
    [   90.145201] CPU: 0 UID: 0 PID: 307 Comm: sh Not tainted 6.18.0-rc1-next-20251016+ #47 PREEMPT
    [   90.155006] Hardware name: Renesas RZ/T2H EVK Board based on r9a09g077m44 (DT)
    [   90.163041] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [   90.170777] pc : cpg_mssr_suspend_noirq+0x4c/0xc0
    [   90.175983] lr : device_suspend_noirq+0x6c/0x22c
    [   90.181309] sp : ffff8000838d3af0
    [   90.185026] x29: ffff8000838d3af0 x28: ffff8000825c016f x27: ffff8000825c01a0
    [   90.192973] x26: ffff8000809feeec x25: ffff8000827bebb8 x24: 0000000000000002
    [   90.200815] x23: ffff8000825c0190 x22: 0000000000000002 x21: 0000000000000000
    [   90.209058] x20: ffff8000827bebb8 x19: ffff000180128010 x18: ffff00033ef92a80
    [   90.217100] x17: ffff000180051700 x16: 0000000000000001 x15: ffff000187afc310
    [   90.224847] x14: 0000000000000254 x13: 0000000000000001 x12: 0000000000000001
    [   90.232793] x11: 00000000000000c0 x10: 0000000000000ab0 x9 : ffff8000838d38b0
    [   90.240540] x8 : ffff000186387410 x7 : 0000000000000001 x6 : 0000000000000000
    [   90.248600] x5 : ffff0001803240d4 x4 : 0000000000000003 x3 : ffff0001803240d0
    [   90.256460] x2 : ffff800082816318 x1 : 000000000000000c x0 : ffff000180324000
    [   90.264208] Call trace:
    [   90.267019]  cpg_mssr_suspend_noirq+0x4c/0xc0 (P)
    [   90.272450]  device_suspend_noirq+0x6c/0x22c
    [   90.277375]  dpm_noirq_suspend_devices+0x1a8/0x2a0
    [   90.282902]  dpm_suspend_noirq+0x24/0xa0
    [   90.287428]  suspend_devices_and_enter+0x310/0x590
    [   90.292790]  pm_suspend+0x1b4/0x200
    [   90.296811]  state_store+0x80/0xf4
    [   90.300676]  kobj_attr_store+0x18/0x34
    [   90.305002]  sysfs_kf_write+0x7c/0x94
    [   90.309232]  kernfs_fop_write_iter+0x12c/0x200
    [   90.314115]  vfs_write+0x240/0x380
    [   90.318041]  ksys_write+0x64/0x100
    [   90.321862]  __arm64_sys_write+0x18/0x24
    [   90.326013]  invoke_syscall.constprop.0+0x40/0xf0
    [   90.331445]  el0_svc_common.constprop.0+0xb8/0xd8
    [   90.336554]  do_el0_svc+0x1c/0x28
    [   90.340375]  el0_svc+0x34/0xe8
    [   90.343900]  el0t_64_sync_handler+0xa0/0xe4
    [   90.348426]  el0t_64_sync+0x198/0x19c
    [   90.352609] Code: 8b040042 b9409004 7100049f 54000240 (b9400042)
    [   90.359639] ---[ end trace 0000000000000000 ]---
    
    Fixes: 065fe720eec6 ("clk: renesas: Add support for R9A09G077 SoC")
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251127145654.3253992-3-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit f56ccc32468ee7885d3a9175e7d2cb608d301521
Author: Kevin Lourenco 
Date:   Mon Dec 29 17:13:21 2025 +0100

    mm/memtest: add underflow detection for size calculation
    
    The computation:
    
            end = start + (size - (start_phys_aligned - start_phys)) / incr
    
    could theoretically underflow if size < offset, leading to a massive
    iteration.
    
    Add VM_WARN_ON_ONCE() to detect cases where the region size is smaller
    than the alignment offset. While this should never happen in practice
    due to memblock guarantees, the warning helps catch potential bugs in
    early memory initialization code.
    
    Suggested-by: Mike Rapoport 
    Signed-off-by: Kevin Lourenco 
    Link: https://patch.msgid.link/20251229161321.9079-1-klourencodev@gmail.com
    Signed-off-by: Mike Rapoport (Microsoft) 

commit 58e3e5265484a1bf39569903630a45a924621aaa
Author: Shengming Hu 
Date:   Mon Dec 29 21:52:27 2025 +0800

    memblock: drop redundant 'struct page *' argument from memblock_free_pages()
    
    memblock_free_pages() currently takes both a struct page * and the
    corresponding PFN. The page pointer is always derived from the PFN at
    call sites (pfn_to_page(pfn)), making the parameter redundant and also
    allowing accidental mismatches between the two arguments.
    
    Simplify the interface by removing the struct page * argument and
    deriving the page locally from the PFN, after the deferred struct page
    initialization check. This keeps the behavior unchanged while making
    the helper harder to misuse.
    
    Signed-off-by: Shengming Hu 
    Reviewed-by: David Hildenbrand (Red Hat) 
    Link: https://patch.msgid.link/tencent_F741CE6ECC49EE099736685E60C0DBD4A209@qq.com
    Signed-off-by: Mike Rapoport (Microsoft) 

commit d6df4abe95a409e812c5d9af9657fe63ac299e3a
Author: Bartosz Golaszewski 
Date:   Tue Jan 6 09:52:53 2026 +0100

    pinctrl: meson: amlogic-a4: mark the GPIO controller as sleeping
    
    The GPIO controller is configured as non-sleeping but it uses generic
    pinctrl helpers which use a mutex for synchronization. This will cause
    lockdep splats when used together with shared GPIOs going through the
    GPIO shared proxy driver.
    
    Fixes: 6e9be3abb78c ("pinctrl: Add driver support for Amlogic SoCs")
    Cc: stable@vger.kernel.org
    Reported-by: Martin Blumenstingl 
    Closes: https://lore.kernel.org/all/CAFBinCAc7CO8gfNQakCu3LfkYXuyTd2iRpMRm8EKXSL0mwOnJw@mail.gmail.com/
    Signed-off-by: Bartosz Golaszewski 
    Reviewed-by: Martin Blumenstingl 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Linus Walleij 

commit d184b5fef6178e721c8c3d0f65eed63aba419f74
Author: Bartosz Golaszewski 
Date:   Tue Jan 6 09:55:20 2026 +0100

    pinctrl: meson: extend build coverage with COMPILE_TEST=y
    
    We currently only build these drivers on ARM but there's nothing that
    should stop us from building it with allmodconfig on other
    architectures. Extend the build coverage for all meson drivers.
    
    Signed-off-by: Bartosz Golaszewski 
    Reviewed-by: Martin Blumenstingl 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Linus Walleij 

commit 940e9b835ab7f7228e6eefc7a649fcb417119b7e
Author: Akiyoshi Kurita 
Date:   Wed Dec 24 21:37:48 2025 +0900

    dt-bindings: pinctrl: intel: keembay: fix typo
    
    Fix a typo in the documentation ("upto" -> "up to").
    
    Signed-off-by: Akiyoshi Kurita 
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Linus Walleij 

commit e034e058897a12bc856f8b22d1796964c742f732
Author: Bartosz Golaszewski 
Date:   Wed Jan 7 09:58:33 2026 +0100

    gpio: line-mux: remove bits already handled by GPIO core
    
    GPIO core already handles checking the offset against the number of
    GPIOs as well as missing any of the GPIO chip callbacks. Remove the
    unnecessary bits.
    
    Also, the offset check was off-by-one as reported by Dan.
    
    Fixes: 2b03d9a40cd1 ("gpio: add gpio-line-mux driver")
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/all/aV4b6GAGz1zyf8Xy@stanley.mountain/
    Tested-by: Jonas Jelonek 
    Reviewed-by: Jonas Jelonek 
    Link: https://lore.kernel.org/r/20260107085833.17338-1-bartosz.golaszewski@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit 6abb6a0e1104279763d1561b8110c1db442c5fac
Author: Nathan Chancellor 
Date:   Mon Jan 5 23:19:27 2026 -0700

    drm/panic: Fix expected string for QR_CODE in drm_panic_type_map
    
    The help text of CONFIG_DRM_PANIC_SCREEN_QR_CODE documents the expected
    value to CONFIG_DRM_PANIC_SCREEN as "qr_code" but drm_panic_type_map
    checks for "qr". Adjust drm_panic_type_map and the module description to
    match so that existing configurations do not stop working.
    
    Fixes: e85e9ccf3f84 ("drm/panic: Report invalid or unsupported panic modes")
    Signed-off-by: Nathan Chancellor 
    Reviewed-by: Tvrtko Ursulin 
    Reviewed-by: Jocelyn Falempe 
    Signed-off-by: Tvrtko Ursulin 
    Link: https://lore.kernel.org/r/20260105-drm_panic-handle-invalid-drm_panic_screen-v1-2-55228bd4b0f8@kernel.org

commit 6419fc157e55665dc8680deb1737dc4c53c33f94
Author: Nathan Chancellor 
Date:   Mon Jan 5 23:19:26 2026 -0700

    drm/panic: Ensure drm_panic_type is initialized to a valid value
    
    If a user has set an invalid CONFIG_DRM_PANIC_SCREEN value (such as
    "qr_code" without CONFIG_DRM_PANIC_SCREEN_QR_CODE=y due to missing or
    incorrect Rust dependencies), there is a panic when accessing
    /sys/module/drm/parameters/panic_screen:
    
      [   12.218375] BUG: unable to handle page fault for address: 0000000796dd8818
      [   12.219737] #PF: supervisor read access in kernel mode
      ...
      [   12.227167] RIP: 0010:drm_panic_type_get+0x1b/0x30
    
    If drm_panic_type_set() does not find a valid drm_panic_type enumeration
    in drm_panic_type_map based on the provided value, it does not change
    drm_panic_type from the default -1 value, which is not a valid index for
    accessing drm_panic_type_map in drm_panic_type_get(), resulting in the
    crash.
    
    Validate the value of CONFIG_DRM_PANIC_SCREEN at boot time via the
    return value of drm_panic_type_set() in drm_panic_init() and explicitly
    fall back to the default of "user" with a message to the user so that
    they can adjust their configuration or fix missing dependencies.
    
      [    0.800697] Unsupported value for CONFIG_DRM_PANIC_SCREEN ('qr_code'), falling back to 'user'...
    
    Fixes: e85e9ccf3f84 ("drm/panic: Report invalid or unsupported panic modes")
    Signed-off-by: Nathan Chancellor 
    Reviewed-by: Tvrtko Ursulin 
    Reviewed-by: Jocelyn Falempe 
    Signed-off-by: Tvrtko Ursulin 
    Link: https://lore.kernel.org/r/20260105-drm_panic-handle-invalid-drm_panic_screen-v1-1-55228bd4b0f8@kernel.org

commit c23ac0f9325ee5b3755ff9b7c3143fed7bbaebd8
Author: Piotr Wojtaszczyk 
Date:   Wed Dec 31 23:57:54 2025 +0200

    ARM: dts: lpc32xx: Add missing properties to I2S device tree nodes
    
    Add NXP LPC32xx I2S controller device tree properties in accordance to
    nxp,lpc3220-i2s.yaml.
    
    Link to the original change:
    * https://lore.kernel.org/linux-arm-kernel/20240627150046.258795-7-piotr.wojtaszczyk@timesys.com/
    
    Signed-off-by: Piotr Wojtaszczyk 
    [vzapolskiy: changes to the commit message]
    Signed-off-by: Vladimir Zapolskiy 

commit 14c877ddffe9d69da2c92eec390d2d0eadc8c1c6
Author: Vladimir Zapolskiy 
Date:   Wed Dec 31 23:57:53 2025 +0200

    ARM: dts: lpc32xx: Declare the second AHB master support on PL080 DMA controller
    
    Add 'lli-bus-interface-ahb2' and 'mem-bus-interface-ahb2' properties to
    the PL080 DMA controller device tree node, tested with dmatest utility.
    
    Signed-off-by: Vladimir Zapolskiy 

commit 6b7e0f1c2a3eb66f561fdc5643752b190692e5cd
Author: Piotr Wojtaszczyk 
Date:   Wed Dec 31 23:57:52 2025 +0200

    ARM: dts: lpc32xx: Add missing DMA properties
    
    Add properties declared in the new DT binding nxp,lpc3220-dmamux.yaml
    and corresponding phandles.
    
    [vzapolskiy]:
    1. rebased the change,
    2. dmamux unit address shall be 0x78 instead of 0x7c,
    3. removed unsupported 'dmas' properties from sd, ssp0, ssp1 and HS UARTs,
    4. more non-functional updates by reordering properies,
    5. minor updates to the commit message.
    
    Link to the original change:
    * https://lore.kernel.org/linux-arm-kernel/20240627150046.258795-6-piotr.wojtaszczyk@timesys.com/
    
    Signed-off-by: Piotr Wojtaszczyk 
    Signed-off-by: Vladimir Zapolskiy 

commit 8754c6e19b902416816057bcf38af8af52a91103
Author: Piotr Wojtaszczyk 
Date:   Wed Dec 31 23:57:51 2025 +0200

    ARM: dts: lpc32xx: Use syscon for system control block
    
    The clock controller is a part of NXP LPC32xx system control block (SCB),
    and SCB provides a number of controllers apart of the clock controller.
    
    [vzapolskiy]:
    1. kept a simple comment,
    2. renamed SoC specific compatible to 'nxp,lpc3220-scb' due to the SoC UM,
    3. changed size in 'ranges', since it should cover more SCB functions,
    4. updated the commit message.
    
    Link to the original change:
    * https://lore.kernel.org/linux-arm-kernel/20240627150046.258795-5-piotr.wojtaszczyk@timesys.com/
    
    Signed-off-by: Piotr Wojtaszczyk 
    Signed-off-by: Vladimir Zapolskiy 

commit d8bb9ef26e9c223c2113d08d89c2f912b22d518a
Author: Vladimir Zapolskiy 
Date:   Wed Dec 24 18:58:45 2025 +0200

    ARM: dts: lpc32xx: describe FLASH_INT of SLC NAND controller
    
    SLC and MLC NAND flash controllers fire the muxed interrupt FLASH_INT to
    the SoC, add the interrupt property to the SLC device tree node.
    
    Signed-off-by: Vladimir Zapolskiy 

commit 1594e575924c614bb376b4f0b749cef8e3fa4e29
Author: Vladimir Zapolskiy 
Date:   Wed Dec 24 18:58:44 2025 +0200

    ARM: dts: lpc32xx: change NAND controllers node names
    
    The device tree node name of NAND controllers shall be 'nand-controller',
    while 'flash' name is the name of NAND chip device tree nodes.
    
    Signed-off-by: Vladimir Zapolskiy 

commit d2bfa3f72d4762f5e531bfe29781d9a62fea5847
Author: Kuldeep Singh 
Date:   Wed Dec 24 06:52:05 2025 +0200

    ARM: dts: lpc32xx: Update spi clock properties
    
    PL022 binding require two clocks to be defined but NXP LPC32xx platform
    doesn't comply with the bindings and define only one clock i.e apb_pclk.
    
    Update SPI clocks and clocks-names property by adding appropriate clock
    reference to make it compliant with the bindings.
    
    Noteworthy, strictly speaking the change tackles DT ABI by changing
    the order in the list of clock-names property values, however this level
    of impact is considered as acceptable.
    
    Cc: Vladimir Zapolskiy 
    Signed-off-by: Kuldeep Singh 
    [vzapolskiy: rebased and minor update to the commit message]
    Reviewed-by: Frank Li 
    Signed-off-by: Vladimir Zapolskiy 

commit a8e30c9d856ddebad75abaec55c019a7a85b16da
Author: Horatiu Vultur 
Date:   Mon Dec 8 09:35:45 2025 +0100

    ARM: dts: Add support for pcb8385
    
    Add basic support for pcb8385 [1]. It is a modular board which allows
    to add different daughter cards on which there are different PHYs.
    This adds support for UART, LEDs and I2C.
    
    [1] https://www.microchip.com/en-us/development-tool/ev83e85a
    
    Signed-off-by: Horatiu Vultur 
    Link: https://lore.kernel.org/r/20251208083545.3642168-3-horatiu.vultur@microchip.com
    Signed-off-by: Claudiu Beznea 

commit d9802af199ad4e9a498879e4cb73763bddd4ae76
Author: Horatiu Vultur 
Date:   Mon Dec 8 09:35:44 2025 +0100

    dt-bindings: arm: at91: add lan966 pcb8385 board
    
    Add documentation for Microchip LAN9668 PCB8385
    
    Acked-by: Rob Herring (Arm) 
    Reviewed-by: Claudiu Beznea 
    Signed-off-by: Horatiu Vultur 
    Link: https://lore.kernel.org/r/20251208083545.3642168-2-horatiu.vultur@microchip.com
    Signed-off-by: Claudiu Beznea 

commit 5fbc19b0f62b21abfef55c55258146bc014ba3f9
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:11 2026 +0800

    wifi: rtw89: fw: set RACK bit every 4 H2C command for WiFi 6 chips only
    
    RACK is to ask firmware send received ACK to driver when a H2C command
    is received. This is necessary for WiFi 6 chips only.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-11-pkshih@realtek.com

commit 483539d891105195dca519c117895d74e7de7bc9
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:10 2026 +0800

    wifi: rtw89: fw: consider hardware AID for firmware elements
    
    The coming chip RTL8922D has variant of hardware with different AID. Add
    AID field to header of firmware elements, and compare AID with the value
    read from hardware.
    
    Currently, apply this rule to BB and RF parameters.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-10-pkshih@realtek.com

commit 1ddebb8f6e0476f335ce951b21bdf63a31d86ac9
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:09 2026 +0800

    wifi: rtw89: fw: add CMAC H2C command for punctured for RTL8922D
    
    CMAC H2C command is to configure CMAC such as TX retry and padding. Add to
    update CMAC function block while puncturing is changing.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-9-pkshih@realtek.com

commit eccf7b10785b7e9b32b5a7fcbf1f45b6db9a5ac5
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:08 2026 +0800

    wifi: rtw89: fw: add CMAC H2C command for TX time for RTL8922D
    
    CMAC H2C command is to configure CMAC such as TX retry and padding. Add to
    update CMAC function block when BT-coex want shorter TX time due to
    timeslot assignment, or when MCC want higher retry time to improve
    connection rate.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-8-pkshih@realtek.com

commit dfe3dea6b9a2d5756127e7ef9fa06042e2d0c648
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:07 2026 +0800

    wifi: rtw89: fw: add CMAC H2C command for TX AMPDU for RTL8922D
    
    CMAC H2C command is to configure CMAC such as TX retry and padding. Add to
    update CMAC function block while AMPDU is established.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-7-pkshih@realtek.com

commit 96f5ceb44875c3e243a3a62120dca0a78776efac
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:06 2026 +0800

    wifi: rtw89: fw: add CMAC H2C command for association for RTL8922D
    
    CMAC H2C command is to configure CMAC such as TX retry and padding. Add to
    update CMAC function block according to associated peer.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-6-pkshih@realtek.com

commit c73607b3a8ef537636deccda5eb3619554269350
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:05 2026 +0800

    wifi: rtw89: fw: add CMAC H2C command to initialize default value for RTL8922D
    
    CMAC H2C command is to configure CMAC such as TX retry and padding. Add to
    reset CMAC function block to default value.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-5-pkshih@realtek.com

commit 49218572f3312c7ff2fa3fb13e1e13b108aa856c
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:04 2026 +0800

    wifi: rtw89: fw: add DMAC v3 H2C command for RTL8922D
    
    Write association data including address and security key of peer to
    hardware. Add the command for RTL8922D accordingly.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-4-pkshih@realtek.com

commit 2b4a2fc32a475f3a3489cdb30889afe879c42429
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:03 2026 +0800

    wifi: rtw89: update query RXDESC v3 for RTL8922D
    
    Add RXDESC v3 to parse meta data of receiving packets for RTL8922D.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-3-pkshih@realtek.com

commit 2adaa4b36b55261c9d94ed911078071063dea12a
Author: Ping-Ke Shih 
Date:   Tue Jan 6 11:09:02 2026 +0800

    wifi: rtw89: update TXWD v3 for RTL8922D
    
    Add TXWD v3 to assist in transmitting for RTL8922D according to hardware
    design.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20260106030911.15528-2-pkshih@realtek.com

commit a87fef0880c4f52769b5a3c2fc1b2d73aaa04eb3
Merge: 59260fe5821ad1 6a0b99e9fb45f4
Author: Dave Airlie 
Date:   Fri Jan 9 12:57:30 2026 +1000

    Merge tag 'drm-misc-next-2026-01-08' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next
    
    drm-misc-next for 6.20:
    
    UAPI Changes:
    
    Cross-subsystem Changes:
    
    Core Changes:
      - draw: Add API to check if a format conversion can be done
      - panic: Rename draw_panic_static_* to draw_panic_screen_*, Add kunit
        tests
      - shmem: Improve tests
    
    Driver Changes:
      - ast: Big endian fixes
      - etnaviv: Add PPU flop reset support
      - panfrost: Add GPU_PM_RT support for RZ/G3E SoC
      - panthor: multiple fixes around VM termination, huge page support
      - pl111: Fix build regression
      - v3d: Fix DMA segment size
    
      - bridge:
        - Add connector argument to .hpd_notify
        - Plenty of patches to convert existing drivers to refcounting
        - Convert Rockchip's inno hdmi support to a proper bridge
        - lontium-lt9611uxc: Switch to HDMI audio helpers
    
      - panel:
        - New panel: BOE NV140WUM-T08
    
    Signed-off-by: Dave Airlie 
    
    From: Maxime Ripard 
    Link: https://patch.msgid.link/20260108-literate-nyala-of-courtesy-de501a@houat

commit 3c8a86ed002ab8fb287ee4ec92f0fd6ac5b291d2
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:24 2026 +0100

    dmaengine: xilinx: xdma: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-14-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit ac326dca6870f0d8e0787e94b1d9c2c91bb358d7
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:23 2026 +0100

    dmaengine: sh: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-13-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit d7785661010e2fe113aec2500f988a8e73ac3e7b
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:22 2026 +0100

    dmaengine: sa11x0: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-12-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 107fdf0c4e944030bf544aea98e8ae8537914177
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:21 2026 +0100

    dmaengine: qcom: bam_dma: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-11-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 425f871d7acdb521d67c2578e6ae688a751d1e80
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:20 2026 +0100

    dmaengine: qcom: adm: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-10-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 068942eaa232ba752b744d98ff8ab22b26c8bff4
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:19 2026 +0100

    dmaengine: pxa-dma: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-9-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit f9b0274f53a2d464e71f37e8f4d0d0dc41321259
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:18 2026 +0100

    dmaengine: lgm: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-8-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 3fc49d21f3a46866724ff8ef8a79c6e2cd9d7676
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:17 2026 +0100

    dmaengine: k3dma: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-7-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 5d6ceb254fa9ac1f50932c42a0a9a8bedaa3190d
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:16 2026 +0100

    dmaengine: dw-axi-dmac: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-6-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 39110c68500a149664bafb0c174baef0d42e2129
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:15 2026 +0100

    dmaengine: bcm2835-dma: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-5-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 024ae9d3092c425f3ea6eae92086a2001ca2e0c7
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:14 2026 +0100

    dmaengine: axi-dmac: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Nuno Sá 
    Link: https://patch.msgid.link/20260108105619.3513561-4-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 47f5cb7878cc62ed95981c5d02862b253eddb590
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:13 2026 +0100

    dmaengine: altera-msgdma: use sg_nents_for_dma() helper
    
    Instead of open coded variant let's use recently introduced helper.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-3-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 80c70bfb95cdbe0c644070f4ca4754a60f0a4830
Author: Andy Shevchenko 
Date:   Thu Jan 8 11:50:12 2026 +0100

    scatterlist: introduce sg_nents_for_dma() helper
    
    Sometimes the user needs to split each entry on the mapped scatter list
    due to DMA length constrains. This helper returns a number of entities
    assuming that each of them is not bigger than supplied maximum length.
    
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108105619.3513561-2-andriy.shevchenko@linux.intel.com
    Signed-off-by: Vinod Koul 

commit fe7b87d908da33326fbf6fe2b3830426432ec66c
Author: Yi Sun 
Date:   Wed Jan 7 16:02:23 2026 -0800

    dmaengine: idxd: Add Max SGL Size Support for DSA3.0
    
    Certain DSA 3.0 opcodes, such as Gather copy and Gather reduce, require max
    SGL configured for workqueues prior to supporting these opcodes.
    
    Configure the maximum scatter-gather list (SGL) size for workqueues during
    setup on the supported HW. Application can then properly handle the SGL
    size without explicitly setting it.
    
    Signed-off-by: Yi Sun 
    Co-developed-by: Anil S Keshavamurthy 
    Signed-off-by: Anil S Keshavamurthy 
    Reviewed-by: Dave Jiang 
    Tested-by: Yi Lai 
    Acked-by: Vinicius Costa Gomes 
    Link: https://patch.msgid.link/20260107-idxd-yi-sun-dsa3-sgl-size-v2-2-dbef8f559e48@intel.com
    Signed-off-by: Vinod Koul 

commit 8308510b93650dcd83a7c6b9753dec1f90ca3e0c
Author: Yi Sun 
Date:   Wed Jan 7 16:02:22 2026 -0800

    dmaengine: idxd: Expose DSA3.0 capabilities through sysfs
    
    Introduce sysfs interfaces for 3 new Data Streaming Accelerator (DSA)
    capability registers (dsacap0-2) to enable userspace awareness of hardware
    features in DSA version 3 and later devices.
    
    Userspace components (e.g. configure libraries, workload Apps) require this
    information to:
    1. Select optimal data transfer strategies based on SGL capabilities
    2. Enable hardware-specific optimizations for floating-point operations
    3. Configure memory operations with proper numerical handling
    4. Verify compute operation compatibility before submitting jobs
    
    The output format is ,,, where each DSA
    capability value is a 64-bit hexadecimal number, separated by commas.
    The ordering follows the DSA 3.0 specification layout:
     Offset:    0x190    0x188    0x180
     Reg:       dsacap2  dsacap1  dsacap0
    
    Example:
    cat /sys/bus/dsa/devices/dsa0/dsacaps
     000000000000f18d,0014000e000007aa,00fa01ff01ff03ff
    
    According to the DSA 3.0 specification, there are 15 fields defined for
    the three dsacap registers. However, there's no need to define all
    register structures unless a use case requires them. At this point,
    support for the Scatter-Gather List (SGL) located in dsacap0 is necessary,
    so only dsacap0 is defined accordingly.
    
    For reference, the DSA 3.0 specification is available at:
    Link: https://software.intel.com/content/www/us/en/develop/articles/intel-data-streaming-accelerator-architecture-specification.html
    
    Signed-off-by: Yi Sun 
    Co-developed-by: Anil S Keshavamurthy 
    Signed-off-by: Anil S Keshavamurthy 
    Reviewed-by: Dave Jiang 
    Tested-by: Yi Lai 
    Acked-by: Vinicius Costa Gomes 
    Link: https://patch.msgid.link/20260107-idxd-yi-sun-dsa3-sgl-size-v2-1-dbef8f559e48@intel.com
    Signed-off-by: Vinod Koul 

commit e371a77255b837f5d64c9d2520f87e41ea5350b9
Author: Yixun Lan 
Date:   Sun Nov 2 21:17:17 2025 +0800

    clk: spacemit: k3: add the clock tree
    
    Add clock support to SpacemiT K3 SoC, the clock tree consist of several
    blocks which are APBC, APBS, APMU, DCIU, MPUM.
    
    Link: https://lore.kernel.org/r/20260108-k3-clk-v5-5-42a11b74ad58@gentoo.org
    Signed-off-by: Yixun Lan 

commit ffadd62d93ea752cdb26c6291127f07c58e8523c
Merge: 3a086236c60073 091d19cc24018f
Author: Yixun Lan 
Date:   Fri Jan 9 10:47:51 2026 +0800

    Merge tag 'spacemit-clkrst-v6.20-3' into spacemit-clk-for-6.20

commit 091d19cc24018f2bd783e932fb2403cb7a2bdb3c
Author: Yixun Lan 
Date:   Sat Dec 20 21:28:15 2025 +0800

    clk: spacemit: k3: extract common header
    
    Extracting common header file, which will be shared by clock and reset
    drivers. So will make it easy to add reset driver for K3 SoC later.
    
    Link: https://lore.kernel.org/r/20260108-k3-clk-v5-4-42a11b74ad58@gentoo.org
    Signed-off-by: Yixun Lan 

commit 3a086236c600739d6653c0405d86aff7d6f03c06
Author: Yixun Lan 
Date:   Mon Oct 27 21:41:24 2025 +0800

    clk: spacemit: ccu_pll: add plla type clock
    
    Introduce a new clock PLLA for SpacemiT's K3 SoC which has a different
    register layout comparing to previous PPL type. And, It is configured
    by swcr1, swcr3 and swcr2 BIT[15:8].
    
    Link: https://lore.kernel.org/r/20260108-k3-clk-v5-3-42a11b74ad58@gentoo.org
    Signed-off-by: Yixun Lan 

commit ace73b7e27633ec770cfb24cd4ff42c24815a9aa
Author: Yixun Lan 
Date:   Fri Oct 31 20:40:46 2025 +0800

    clk: spacemit: ccu_mix: add inverted enable gate clock
    
    K3 SoC has the clock IP which support to write value 0 for enabling the
    clock, while write 1 for disabling it, thus the enable BIT is inverted.
    So, introduce a flag to support the inverted gate clock.
    
    Link: https://lore.kernel.org/r/20260108-k3-clk-v5-2-42a11b74ad58@gentoo.org
    Signed-off-by: Yixun Lan 

commit e0c51fd02f9cfab341907f6764d2f15c134eea55
Author: Geert Uytterhoeven 
Date:   Tue Jan 6 17:59:25 2026 +0100

    dmaengine: sh: rz-dmac: Make channel irq local
    
    The channel IRQ is only used inside the function rz_dmac_chan_probe(),
    so there is no need to store it in the rz_dmac_chan structure for later
    use.
    
    Signed-off-by: Geert Uytterhoeven 
    Reviewed-by: Biju Das 
    Link: https://patch.msgid.link/312c2e3349f4747e0bca861632bfc3592224b012.1767718556.git.geert+renesas@glider.be
    Signed-off-by: Vinod Koul 

commit efe897b557e211a09f51d749eae5eca933e8bf56
Author: Yixun Lan 
Date:   Sat Nov 1 20:56:42 2025 +0800

    dt-bindings: soc: spacemit: k3: add clock support
    
    Add compatible strings for clock drivers to support Spacemit K3 SoC,
    also includes all the defined clock IDs.
    
    The SpacemiT K3 SoC clock IP is scattered over several different blocks,
    which are APBC, APBS, APMU, DCIU, MPMU, all of them are capable of
    generating clock and reset signals. APMU and MPMU have additional Power
    Domain management functionality.
    
    Following is a brief list that shows devices managed in each block:
    
    APBC: UART, GPIO, PWM, SPI, TIMER, I2S, IR, DR, TSEN, IPC, CAN
    APBS: various PPL clocks control
    APMU: CCI, CPU, CSI, ISP, LCD, USB, QSPI, DMA, VPU, GPU, DSI, PCIe, EMAC..
    DCID: SRAM, DMA, TCM
    MPMU: various PLL1 derived clocks, UART, WATCHDOG, I2S
    
    Link: https://lore.kernel.org/r/20260108-k3-clk-v5-1-42a11b74ad58@gentoo.org
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Yixun Lan 

commit fc65403d55c3be44d19e6290e641433201345a5e
Merge: a45ed8db62f805 f529893f404be8
Author: Jakub Kicinski 
Date:   Thu Jan 8 18:13:14 2026 -0800

    Merge branch 'support-for-hwtstamp_get-in-phy-part-2'
    
    Vadim Fedorenko says:
    
    ====================
    support for hwtstamp_get in phy - part 2
    
    There are 2 drivers which had some inconsistency in HW timestamping
    configuration logic. Improve both of them and add hwtstamp_get()
    callback.
    ====================
    
    Link: https://patch.msgid.link/20260106160723.3925872-1-vadim.fedorenko@linux.dev
    Signed-off-by: Jakub Kicinski 

commit f529893f404be8e820c104e278c58f37686d9137
Author: Vadim Fedorenko 
Date:   Tue Jan 6 16:07:23 2026 +0000

    net: phy: microchip_rds_ptp: add HW timestamp configuration reporting
    
    The driver stores HW timestamping configuration and can technically
    report it. Add callback to do it.
    
    Reviewed-by: Kory Maincent 
    Signed-off-by: Vadim Fedorenko 
    Link: https://patch.msgid.link/20260106160723.3925872-5-vadim.fedorenko@linux.dev
    Signed-off-by: Jakub Kicinski 

commit ffde97f8ff6a2aa33eb197897031b9d32f79d76c
Author: Vadim Fedorenko 
Date:   Tue Jan 6 16:07:22 2026 +0000

    net: phy: microchip_rds_ptp: improve HW ts config logic
    
    The driver stores new HW timestamping configuration values
    unconditionally and may create inconsistency with what is actually
    configured in case of error. Improve the logic to store new values only
    once everything is configured.
    
    Reviewed-by: Andrew Lunn 
    Signed-off-by: Vadim Fedorenko 
    Reviewed-by: Kory Maincent 
    Link: https://patch.msgid.link/20260106160723.3925872-4-vadim.fedorenko@linux.dev
    Signed-off-by: Jakub Kicinski 

commit 32d83db3aaf62561879ca7356ab863f88c953b0b
Author: Vadim Fedorenko 
Date:   Tue Jan 6 16:07:21 2026 +0000

    net: phy: micrel: add HW timestamp configuration reporting
    
    The driver stores HW timestamping configuration and can technically
    report it. Add callback to do it.
    
    Reviewed-by: Andrew Lunn 
    Reviewed-by: Kory Maincent 
    Signed-off-by: Vadim Fedorenko 
    Link: https://patch.msgid.link/20260106160723.3925872-3-vadim.fedorenko@linux.dev
    Signed-off-by: Jakub Kicinski 

commit 88c7ed2fb0711c413fda29f2f437003e71445812
Author: Vadim Fedorenko 
Date:   Tue Jan 6 16:07:20 2026 +0000

    net: phy: micrel: improve HW timestamping config logic
    
    The driver was adjusting stored values independently of what was
    actually supported and configured. Improve logic to store values
    once all checks are passing
    
    Reviewed-by: Andrew Lunn 
    Signed-off-by: Vadim Fedorenko 
    Reviewed-by: Kory Maincent 
    Link: https://patch.msgid.link/20260106160723.3925872-2-vadim.fedorenko@linux.dev
    Signed-off-by: Jakub Kicinski 

commit a45ed8db62f8051275112babb271f53a13aec02e
Author: Randy Dunlap 
Date:   Tue Jan 6 09:32:24 2026 -0800

    sfc: correct kernel-doc complaints
    
    Fix kernel-doc warnings by adding 3 missing struct member descriptions
    in struct efx_ef10_nic_data and removing preprocessor directives (which
    are not handled by kernel-doc).
    
    Fixes these 5 warnings:
    Warning: drivers/net/ethernet/sfc/nic.h:158 bad line: #ifdef CONFIG_SFC_SRIOV
    Warning: drivers/net/ethernet/sfc/nic.h:160 bad line: #endif
    Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'port_id'
     not described in 'efx_ef10_nic_data'
    Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'vf_index'
     not described in 'efx_ef10_nic_data'
    Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'licensed_features'
     not described in 'efx_ef10_nic_data'
    
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Edward Cree 
    Link: https://patch.msgid.link/20260106173224.2010703-1-rdunlap@infradead.org
    Signed-off-by: Jakub Kicinski 

commit 092c2353f9ba42a3c534bccf91ea7af5b6e9bb23
Merge: 0664a46f93e2fb ecff77f7c04141
Author: Yixun Lan 
Date:   Fri Jan 9 10:01:08 2026 +0800

    Merge tag 'spacemit-clkrst-v6.20-2' into spacemit-clk-for-6.20

commit 0664a46f93e2fb2f75fa05b5f08949600cce88f9
Author: Yixun Lan 
Date:   Sat Jan 3 14:14:36 2026 +0800

    clk: spacemit: add platform SoC prefix to reset name
    
    This change is needed for adding future new SpacemiT K3 reset driver.
    
    Since both K1 and K3 reset code register via the same module which its
    name changed to spacemit_ccu, it's necessary to encode the platform/SoC
    in the reset auxiliary device name to distinguish them, otherwise two
    reset drivers will claim to support same "compatible" auxiliary device
    even in the case of only one CCU clock driver got registered, which in
    the end lead to a broken reset driver.
    
    This change will introduce a runtime break to reset driver, and will be
    fixed in follow-up commit:
    ecff77f7c041 ("reset: spacemit: fix auxiliary device id")
    
    Link: https://lore.kernel.org/r/20260108-06-k1-clk-common-v4-3-badf635993d3@gentoo.org
    Reviewed-by: Alex Elder 
    Signed-off-by: Yixun Lan 

commit 99669468d24ce21be12f3751e7381c47ab2c9ecd
Author: Yixun Lan 
Date:   Fri Dec 19 08:07:23 2025 +0800

    clk: spacemit: extract common ccu functions
    
    Refactor the probe function of SpacemiT's clock, and extract a common ccu
    file, so new clock driver added in the future can share the same code,
    which would lower the burden of maintenance. Since this commit changes the
    module name from spacemit_ccu_k1 to spacemit_ccu where the auxiliary device
    registered, the auxiliary device id need to be adjusted. Idea of the patch
    comes from the review of K3 clock driver, please refer to this disucssion[1]
    for more detail.
    
    This change will introduce a runtime break to reset driver, and will be
    fixed in follow-up commit:
    ecff77f7c041 ("reset: spacemit: fix auxiliary device id")
    
    Link: https://lore.kernel.org/all/aTo8sCPpVM1o9PKX@pie/ [1]
    Link: https://lore.kernel.org/r/20260108-06-k1-clk-common-v4-2-badf635993d3@gentoo.org
    Suggested-by: Yao Zi 
    Reviewed-by: Alex Elder 
    Signed-off-by: Yixun Lan 

commit f56bcc0425cb5aeac3557444e0f7538178daba05
Author: Frank Li 
Date:   Tue Jan 6 09:36:19 2026 -0500

    dt-bindings: net: dsa: microchip: Make pinctrl 'reset' optional
    
    Commit e469b87e0fb0d ("dt-bindings: net: dsa: microchip: Add strap
    description to set SPI mode") required both 'default' and 'reset' pinctrl
    states for all compatible devices. However, this requirement should be only
    applicable to KSZ8463.
    
    Make the 'reset' pinctrl state optional for all other Microchip DSA
    devices while keeping it mandatory for KSZ8463.
    
    Fix below CHECK_DTBS warnings:
      arch/arm64/boot/dts/freescale/imx8mp-skov-basic.dtb: switch@5f (microchip,ksz9893): pinctrl-names: ['default'] is too short
            from schema $id: http://devicetree.org/schemas/net/dsa/microchip,ksz.yaml#
    
    Signed-off-by: Frank Li 
    Reviewed-by: Marco Felsch 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260106143620.126212-1-Frank.Li@nxp.com
    Signed-off-by: Jakub Kicinski 

commit b61571fdefc4faa9dd5bb5b49ee7d10dc3719780
Merge: 99735a742f7e9a 2b7a02c322922a
Author: Yixun Lan 
Date:   Fri Jan 9 10:00:03 2026 +0800

    Merge tag 'spacemit-clkrst-v6.20-1' into spacemit-clk-for-6.20

commit b2a61006c9940e092a8af16e787790c1f84b05c7
Merge: 2b7a02c322922a ecff77f7c04141
Author: Yixun Lan 
Date:   Fri Jan 9 09:47:30 2026 +0800

    Merge tags 'spacemit-clkrst-v6.20-1' and 'spacemit-clkrst-v6.20-2' into spacemit-clkrst-v6.20

commit ecff77f7c04141cc18ee2482936c96117060c0f2
Author: Yixun Lan 
Date:   Fri Dec 19 05:34:39 2025 +0800

    reset: spacemit: fix auxiliary device id
    
    Due to the auxiliary register procedure moved to ccu common module where
    the module name changed to spacemit_ccu, then the reset auxiliary device
    register id also need to be adjusted in order to prepare for adding new
    K3 reset driver, otherwise two reset drivers will claim to support same
    "compatible" auxiliary device.
    
    In order to prevent the reset driver breakage, this commit is necessary
    as a post-fix for changes introduced by two patches below, and should be
    merged with them to make the patch series runtime bisectable.
    ("clk: spacemit: add platform SoC prefix to reset name")
    ("clk: spacemit: extract common ccu functions")
    
    Link: https://lore.kernel.org/r/20260108-06-k1-clk-common-v4-4-badf635993d3@gentoo.org
    Acked-by: Philipp Zabel 
    Reviewed-by: Alex Elder 
    Signed-off-by: Yixun Lan 

commit 2b7a02c322922a37cc5fc15d055b794cc2193062
Author: Yixun Lan 
Date:   Fri Dec 19 21:52:08 2025 +0800

    clk: spacemit: prepare common ccu header
    
    In order to prepare adding clock driver for new K3 SoC, extract generic
    code to a separate common ccu header file, so they are not defined
    in K1 SoC-specific file, and then can be shared by all clock drivers.
    
    Link: https://lore.kernel.org/r/20260108-06-k1-clk-common-v4-1-badf635993d3@gentoo.org
    Reviewed-by: Alex Elder 
    Signed-off-by: Yixun Lan 

commit 73711730a1128d91ebca1a6994ceeb18f36cb0cd
Author: Håkon Bugge 
Date:   Wed Nov 12 10:54:40 2025 +0100

    PCI: Do not attempt to set ExtTag for VFs
    
    The bit for enabling extended tags is Reserved and Preserved (RsvdP) for
    VFs, according to PCIe r7.0 section 7.5.3.4 table 7.21.  Hence, bail out
    early from pci_configure_extended_tags() if the device is a VF.
    
    Otherwise, we may see incorrect log messages such as:
    
      kernel: pci 0000:af:00.2: enabling Extended Tags
    
    (af:00.2 is a VF)
    
    Fixes: 60db3a4d8cc9 ("PCI: Enable PCIe Extended Tags if supported")
    Signed-off-by: Håkon Bugge 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Zhu Yanjun 
    Link: https://patch.msgid.link/20251112095442.1913258-1-haakon.bugge@oracle.com

commit 2e08feebe0353320651013c5bdab58c2a19a716b
Author: Brian Nguyen 
Date:   Wed Jan 7 09:04:52 2026 +0800

    drm/xe: Add page reclamation related stats
    
    Add page reclaim list (PRL) related stats to GT stats to assist in
    debugging and tuning of page reclaim related actions. Include counters
    of page sizes added to PRL and if PRL action is issued.
    
    v2:
     - Add PRL_ABORTED_COUNT stats and corresponding changes. (Matthew B)
    
    Signed-off-by: Brian Nguyen 
    Cc: Matthew Brost 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20260107010447.4125005-10-brian3.nguyen@intel.com

commit 83b914f972bb706536edd2b84230b9c1ce39f275
Author: Brian Nguyen 
Date:   Wed Jan 7 09:04:51 2026 +0800

    drm/xe: Fix page reclaim entry handling for large pages
    
    For 64KB pages, XE_PTE_PS64 is defined for all consecutive 4KB pages and
    are all considered leaf nodes, so existing check was falsely adding
    multiple 64KB pages to PRL.
    
    For larger entries such as 2MB PDE, the check for pte->base.children is
    insufficient since this array is always  defined for page directory,
    level 1 and above, so perform a check on the entry itself pointing to
    the correct page.
    
    For unmaps, if the range is properly covered by the page full directory,
    page walker may finish without walking to the leaf nodes.
    
    For example, a 1G range can be fully covered by 512 2MB pages if
    alignment allows. In this case, the page walker will walk until
    it reaches this corresponding directory which can correlate to the 1GB
    range. Page walker will simply complete its walk and the individual 2MB
    PDE leaves won't get accessed.
    
    In this case, PRL invalidation is also required, so add a check to see if
    pt entry cover the entire range since the walker will complete the walk.
    
    There are possible race conditions that will cause driver to read a pte
    that hasn't been written to yet. The 2 scenarios are:
     - Another issued TLB invalidation such as from userptr or MMU notifier.
     - Dependencies on original bind that has yet to be executed with an
       unbind on that job.
    
    The expectation is these race conditions are likely rare cases so simply
    perform a fallback to full PPC flush invalidation instead.
    
    v2:
     - Reword commit and updated zero-pte handling. (Matthew B)
    
    v3:
     - Rework if statement for abort case with additional comments. (Matthew B)
    
    Fixes: b912138df299 ("drm/xe: Create page reclaim list on unbind")
    Signed-off-by: Brian Nguyen 
    Cc: Matthew Brost 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20260107010447.4125005-9-brian3.nguyen@intel.com

commit 7a0e86e3c9298c28f7bbbbb628bf1b7dd2de2916
Author: Brian Nguyen 
Date:   Wed Jan 7 09:04:50 2026 +0800

    drm/xe: Add explicit abort page reclaim list
    
    PRLs could be invalidated to indicate its getting dropped from current
    scope but are still valid. So standardize calls and add abort to clearly
    define when an invalidation is a real abort and PRL should fallback.
    
    v3:
     - Update abort function to macro. (Matthew B)
    
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20260107010447.4125005-8-brian3.nguyen@intel.com

commit 52cb4a595fbce93b1ef940f9d1097be9245d9179
Author: Brian Nguyen 
Date:   Wed Jan 7 09:04:49 2026 +0800

    drm/xe: Remove debug comment in page reclaim
    
    Drop debug comment erronenously added in patch commit.
    
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20260107010447.4125005-7-brian3.nguyen@intel.com

commit aa39abc08e77d66ebb0c8c9ec4cc8d38ded34dc9
Author: Marco Crivellari 
Date:   Thu Jan 8 19:01:48 2026 +0100

    drm/xe: fix WQ_MEM_RECLAIM passed as max_active to alloc_workqueue()
    
    Workqueue xe-ggtt-wq has been allocated using WQ_MEM_RECLAIM, but
    the flag has been passed as 3rd parameter (max_active) instead
    of 2nd (flags) creating the workqueue as per-cpu with max_active = 8
    (the WQ_MEM_RECLAIM value).
    
    So change this by set WQ_MEM_RECLAIM as the 2nd parameter with a
    default max_active.
    
    Fixes: 60df57e496e4 ("drm/xe: Mark GGTT work queue with WQ_MEM_RECLAIM")
    Cc: stable@vger.kernel.org
    Signed-off-by: Marco Crivellari 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20260108180148.423062-1-marco.crivellari@suse.com

commit f7d5e9e70302c06c04599919770f3e0cb339342e
Author: Kazuhiro Abe 
Date:   Thu Jan 8 16:56:09 2026 +0900

    ACPI: AGDI: Add interrupt signaling mode support
    
    AGDI has two types of signaling modes: SDEI and interrupt.
    Currently, the AGDI driver only supports SDEI.
    Therefore, add support for interrupt signaling mode.
    The interrupt vector is retrieved from the AGDI table, and call panic
    function when an interrupt occurs.
    
    Acked-by: Hanjun Guo 
    Reviewed-by: Ilkka Koskinen 
    Signed-off-by: Kazuhiro Abe 
    Signed-off-by: Will Deacon 

commit f22c81bebf8bda6e54dc132df0ed54f6bf8756f9
Author: Breno Leitao 
Date:   Tue Jan 6 02:16:35 2026 -0800

    arm64: Disable branch profiling for all arm64 code
    
    The arm64 kernel doesn't boot with annotated branches
    (PROFILE_ANNOTATED_BRANCHES) enabled and CONFIG_DEBUG_VIRTUAL together.
    
    Bisecting it, I found that disabling branch profiling in arch/arm64/mm
    solved the problem. Narrowing down a bit further, I found that
    physaddr.c is the file that needs to have branch profiling disabled to
    get the machine to boot.
    
    I suspect that it might invoke some ftrace helper very early in the boot
    process and ftrace is still not enabled(!?).
    
    Rather than playing whack-a-mole with individual files, disable branch
    profiling for the entire arch/arm64 tree, similar to what x86 already
    does in arch/x86/Kbuild.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Breno Leitao 
    Acked-by: Mark Rutland 
    Signed-off-by: Will Deacon 

commit 89daf7b9a8205d58ea934e3a51a4f1f892ab0ed6
Author: Loic Poulain 
Date:   Thu Jan 8 18:05:50 2026 +0100

    arm64: dts: qcom: qrb2210-rb1: Add overlay for vision mezzanine
    
    This initial version includes support for OV9282 camera sensor.
    
    Signed-off-by: Loic Poulain 
    Reviewed-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20260108170550.359968-4-loic.poulain@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 141f384413fbeada38f3fa46e2beed9bf8c0f6fe
Author: Loic Poulain 
Date:   Thu Jan 8 18:05:49 2026 +0100

    arm64: dts: qcom: qrb2210-rb1: Add PM8008 node
    
    The PM8008 device is a dedicated camera PMIC integrating all the necessary
    camera power management features.
    
    Signed-off-by: Loic Poulain 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20260108170550.359968-3-loic.poulain@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 165287f761aaf7f5c2d4d8b19343569b6a26f8bf
Author: Loic Poulain 
Date:   Thu Jan 8 18:05:48 2026 +0100

    arm64: dts: qcom: qcm2290: Add pin configuration for mclks
    
    Add pinctrl configuration for the four available camera master clocks.
    
    Signed-off-by: Loic Poulain 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20260108170550.359968-2-loic.poulain@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 351fa2ff098eccb2a98640d02f31319c3ceca0bc
Author: Osama Abdelkader 
Date:   Wed Dec 24 22:21:16 2025 +0100

    drm/xe: Add missing newlines to drm_warn messages
    
    The drm_warn() calls in the default cases of various switch statements
    in xe_vm.c were missing trailing newlines, which can cause log messages
    to be concatenated with subsequent output. Add '\n' to all affected
    messages.
    
    Signed-off-by: Osama Abdelkader 
    Link: https://patch.msgid.link/20251224212116.59021-1-osama.abdelkader@gmail.com
    Signed-off-by: Rodrigo Vivi 

commit 96d45e34f8f9a459ae1a8d7a74638a96375d8597
Author: Lukasz Laguna 
Date:   Wed Jan 7 18:47:41 2026 +0100

    drm/xe/pf: Allow upon-any-hang wedged mode only in debug config
    
    The GuC reset policy is global, so disabling it on PF can affect all
    running VFs. To avoid unintended side effects, restrict setting
    upon-any-hang (2) wedged mode on the PF to debug builds only.
    
    Signed-off-by: Lukasz Laguna 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20260107174741.29163-5-lukasz.laguna@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 43d78aca8ed01a643f198b831231a6231f52d9d5
Author: Lukasz Laguna 
Date:   Wed Jan 7 18:47:40 2026 +0100

    drm/xe/vf: Disallow setting wedged mode to upon-any-hang
    
    In upon-any-hang (2) wedged mode, engine resets need to be disabled,
    which requires changing the GuC reset policy. VFs are not permitted to
    do that.
    
    Signed-off-by: Lukasz Laguna 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20260107174741.29163-4-lukasz.laguna@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 0f13dead4e0385859f5c9c3625a19df116b389d3
Author: Lukasz Laguna 
Date:   Wed Jan 7 18:47:39 2026 +0100

    drm/xe: Update wedged.mode only after successful reset policy change
    
    Previously, the driver's internal wedged.mode state was updated without
    verifying whether the corresponding engine reset policy update in GuC
    succeeded. This could leave the driver reporting a wedged.mode state
    that doesn't match the actual reset behavior programmed in GuC.
    
    With this change, the reset policy is updated first, and the driver's
    wedged.mode state is modified only if the policy update succeeds on all
    available GTs.
    
    This patch also introduces two functional improvements:
    
     - The policy is sent to GuC only when a change is required. An update
       is needed only when entering or leaving XE_WEDGED_MODE_UPON_ANY_HANG,
       because only in that case the reset policy changes. For example,
       switching between XE_WEDGED_MODE_UPON_CRITICAL_ERROR and
       XE_WEDGED_MODE_NEVER doesn't affect the reset policy, so there is no
       need to send the same value to GuC.
    
     - An inconsistent_reset flag is added to track cases where reset policy
       update succeeds only on a subset of GTs. If such inconsistency is
       detected, future wedged mode configuration will force a retry of the
       reset policy update to restore a consistent state across all GTs.
    
    Fixes: 6b8ef44cc0a9 ("drm/xe: Introduce the wedged_mode debugfs")
    Signed-off-by: Lukasz Laguna 
    Link: https://patch.msgid.link/20260107174741.29163-3-lukasz.laguna@intel.com
    Reviewed-by: Rodrigo Vivi 
    Signed-off-by: Rodrigo Vivi 

commit 17d3c3365ba9e52596855d6acb71c3159be1b9c3
Author: Lukasz Laguna 
Date:   Wed Jan 7 18:47:38 2026 +0100

    drm/xe: Validate wedged_mode parameter and define enum for modes
    
    Check correctness of the wedged_mode parameter input to ensure only
    supported values are accepted. Additionally, replace magic numbers with
    a clearly defined enum.
    
    Signed-off-by: Lukasz Laguna 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20260107174741.29163-2-lukasz.laguna@intel.com
    Signed-off-by: Rodrigo Vivi 

commit ca2eccb953fd33ef38701e33e660b21f7e84aa14
Author: Yosry Ahmed 
Date:   Fri Nov 21 20:48:03 2025 +0000

    KVM: selftests: Extend vmx_set_nested_state_test to cover SVM
    
    Add test cases for the validation checks in svm_set_nested_state(), and
    allow the test to run with SVM as well as VMX. The SVM test also makes
    sure that KVM_SET_NESTED_STATE accepts GIF being set or cleared if
    EFER.SVME is cleared, verifying a recently fixed bug where GIF was
    incorrectly expected to always be set when EFER.SVME is cleared.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251121204803.991707-5-yosry.ahmed@linux.dev
    Signed-off-by: Sean Christopherson 

commit bda6ae6f29664b659671f872a2adda3c1c2f5dd6
Author: Yosry Ahmed 
Date:   Fri Nov 21 20:48:02 2025 +0000

    KVM: selftests: Use TEST_ASSERT_EQ() in test_vmx_nested_state()
    
    The assert messages do not add much value, so use TEST_ASSERT_EQ(),
    which also nicely displays the addresses in hex. While at it, also
    assert the values of state->flags.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251121204803.991707-4-yosry.ahmed@linux.dev
    Signed-off-by: Sean Christopherson 

commit 6f4d3ebc24c6ef92e196ebbd389a3f2bfdc7a144
Author: Jim Mattson 
Date:   Fri Nov 21 20:48:00 2025 +0000

    KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0
    
    GIF==0 together with EFER.SVME==0 is a valid architectural
    state. Don't return -EINVAL for KVM_SET_NESTED_STATE when this
    combination is specified.
    
    Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE")
    Signed-off-by: Jim Mattson 
    Reviewed-by: Yosry Ahmed 
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251121204803.991707-2-yosry.ahmed@linux.dev
    [sean: disallow KVM_STATE_NESTED_RUN_PENDING with SVME=0]
    Signed-off-by: Sean Christopherson 

commit 8312f1b9dd71340b5fff65e56c6c163187bfa5d0
Author: Jim Mattson 
Date:   Fri Nov 21 20:48:01 2025 +0000

    KVM: SVM: Don't set GIF when clearing EFER.SVME
    
    Clearing EFER.SVME is not architected to set GIF. Don't set GIF when
    emulating a change to EFER that clears EFER.SVME.
    
    However, keep setting GIF if clearing EFER.SVME causes force-leaving the
    nested guest through svm_leave_nested(), to maintain a sane behavior of
    not leaving GIF cleared after exiting the guest.  In every other path,
    setting GIF is either correct/desirable, or irrelevant because the
    caller immediately and unconditionally sets/clears GIF.
    
    This is more-or-less KVM defining HW behavior, but leaving GIF cleared
    would also be defining HW behavior anyway.
    
    Note that if force-leaving the nested guest is considered a SHUTDOWN,
    then this could violate the APM-specified behavior:
    
      If the processor enters the shutdown state (due to a triple fault for
      instance) while GIF is clear, it can only be restarted by means of a
      RESET.
    
    However, a SHUTDOWN leaves the VMCB undefined, so there's not a lot that
    KVM can do in this case. Also, if vGIF is enabled on SHUTDOWN, KVM has
    no way of finding out of GIF was cleared.
    
    The only way for KVM to handle this without making up HW behavior is to
    completely terminate the VM, so settle for doing the relatively "sane"
    thing of setting GIF when force-leaving nested.
    
    Fixes: c513f484c558 ("KVM: nSVM: leave guest mode when clearing EFER.SVME")
    Signed-off-by: Jim Mattson 
    Co-developed-by: Sean Christopherson 
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251121204803.991707-3-yosry.ahmed@linux.dev
    Signed-off-by: Sean Christopherson 

commit bf91b35a46ceef08a1e64c54b0e611fcae531e7a
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:31:45 2025 +0100

    scsi: ufs: core: Discard pm_runtime_put() return values
    
    The ufshcd driver defines ufshcd_rpm_put() to return an int, but that
    return value is never used.  It also passes the return value of
    pm_runtime_put() to the caller which is not very useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.
    
    Modify ufshcd_rpm_put() to discard the pm_runtime_put() return value
    and change its return type to void.
    
    No intentional functional impact.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Bart Van Assche 
    Reviewed-by: Martin K. Petersen 
    Link: https://patch.msgid.link/2781685.BddDVKsqQX@rafael.j.wysocki

commit 6401e43479a809b7a5a930d76c363f4b5705ed00
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:27:44 2025 +0100

    platform/chrome: cros_hps_i2c: Discard pm_runtime_put() return value
    
    Passing pm_runtime_put() return value to the callers is not particularly
    useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.  It also happens when the kernel is
    configured with CONFIG_PM unset.
    
    Accordingly, update hps_release() to simply discard the return value of
    pm_runtime_put() and always return success to the caller.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Acked-by: Tzung-Bi Shih 
    Link: https://patch.msgid.link/2302270.NgBsaNRSFp@rafael.j.wysocki

commit 01eafccacc707da2db2a9eb4be56c9367e42323f
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:25:57 2025 +0100

    coresight: Discard pm_runtime_put() return values
    
    Failing a debugfs write due to pm_runtime_put() returning a negative
    value is not particularly useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.  It also happens when the kernel
    has been configured with CONFIG_PM unset, in which case
    debug_disable_func() in the coresight driver will always return an
    error.
    
    For this reason, update debug_disable_func() to simply discard the
    return value of pm_runtime_put(), change its return type to void, and
    propagate that change to debug_func_knob_write().
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Acked-by: Suzuki K Poulose 
    Link: https://patch.msgid.link/2058657.yKVeVyVuyW@rafael.j.wysocki

commit d33976be6cecfe340a52b365ecf706a0c55d543d
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:24:19 2025 +0100

    hwspinlock: omap: Discard pm_runtime_put() return value
    
    Failing driver probe due to pm_runtime_put() returning a negative value
    is not particularly useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.  It also happens when the kernel
    has been configured with CONFIG_PM unset.
    
    Accordingly, update omap_hwspinlock_probe() to simply discard the
    return value of pm_runtime_put().
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Acked-by: Bjorn Andersson 
    Link: https://patch.msgid.link/883243465.0ifERbkFSE@rafael.j.wysocki

commit 7b8de72b4001a7e2071c69b6bcc95ac21ca01094
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:09:22 2025 +0100

    watchdog: rzv2h_wdt: Discard pm_runtime_put() return value
    
    Failing device probe due to pm_runtime_put() returning an error is not
    particularly useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.  It also happens when the kernel is
    configured with CONFIG_PM unset.
    
    Accordingly, update rzt2h_wdt_wdtdcr_init() to simply discard the return
    value of pm_runtime_put() and return success to the caller after
    invoking that function.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Guenter Roeck 
    Link: https://patch.msgid.link/1867890.VLH7GnMWUR@rafael.j.wysocki

commit f52defa7b830abbba6b26df503ca42c0b2f20abe
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:07:46 2025 +0100

    watchdog: rz: Discard pm_runtime_put() return values
    
    Failing a watchdog stop due to pm_runtime_put() returning a negative
    value is not particularly useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.  It also happens when the kernel is
    configured with CONFIG_PM unset.
    
    Accordingly, update rzg2l_wdt_stop() and rzv2h_wdt_stop() to simply
    discard the return value of pm_runtime_put().
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Guenter Roeck 
    Link: https://patch.msgid.link/3340071.5fSG56mABF@rafael.j.wysocki

commit c9f7b0e6b903a68780684c30773e3b591b10deaa
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:03:25 2025 +0100

    media: ccs: Discard pm_runtime_put() return value
    
    Passing the pm_runtime_put() return value to callers is not particularly
    useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.  It also happens when the kernel is
    configured with CONFIG_PM unset.
    
    Accordingly, update ccs_post_streamoff() to simply discard the return
    value of pm_runtime_put() and always return success to the caller.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Acked-by: Sakari Ailus 
    Link: https://patch.msgid.link/22966634.EfDdHjke4D@rafael.j.wysocki

commit 644673a69f2b6b7359c78b4a42c5ab17473545f9
Author: Raag Jadav 
Date:   Sat Dec 20 13:06:56 2025 +0530

    drm/xe/pm: Handle GT resume failure
    
    We've been historically ignoring GT resume failure. Since the function
    can return error, handle it properly.
    
    v2: Bring up display before bailing (Matt Roper, Rodrigo)
    
    Signed-off-by: Raag Jadav 
    Link: https://patch.msgid.link/20251220073657.166810-1-raag.jadav@intel.com
    Reviewed-by: Rodrigo Vivi 
    Signed-off-by: Rodrigo Vivi 

commit 80b49829ba1776d3593998293d457397e349b765
Author: Andreas Kemnade 
Date:   Thu Jan 8 09:26:13 2026 +0100

    MAINTAINERS: remove omap-cpufreq
    
    Remove entry for omap-cpufreq, since it is removed.
    
    Signed-off-by: Andreas Kemnade 
    Acked-by: Kevin Hilman 
    Link: https://patch.msgid.link/20260108-omap-cpufreq-removal-v1-2-8fe42f130f48@kemnade.info
    Signed-off-by: Rafael J. Wysocki 

commit 0cc7933cbec80900bdbe658b72e2ba99187fe628
Author: Andreas Kemnade 
Date:   Thu Jan 8 09:26:12 2026 +0100

    cpufreq: omap: remove driver
    
    The omap-cpufreq driver is not used in the corresponding defconfigs.
    The pseudo platform device to use it was removed by
    commit cb6675d6a868 ("ARM: OMAP2+: Remove legacy PM init")
    10 years ago.
    
    Checking if there is any need to reactivate it:
    For omap3, dra7 there is ti-cpufreq to create cpufreq-dt device
    For omap2/4/5 there is cpufreq-dt-plat to create cpufreq-dt device.
    For omap1 this driver cannot be selected at all.
    
    So no users, no need to reactivate the driver somehow. So remove it.
    
    Signed-off-by: Andreas Kemnade 
    Acked-by: Kevin Hilman 
    Link: https://patch.msgid.link/20260108-omap-cpufreq-removal-v1-1-8fe42f130f48@kemnade.info
    Signed-off-by: Rafael J. Wysocki 

commit 8c7a1d258d88b5d8e5b78f86d59cfac8eb361a61
Author: Sven Peter 
Date:   Wed Dec 31 16:42:39 2025 +0100

    arm64: defconfig: Enable Apple Silicon drivers
    
    Enable drivers for hardware present on Apple Silicon machines. None of
    these drivers are critical so build them as modules. The reset and RTC
    macsmc drivers would be useful as built-in drivers but they have large
    dependencies so keep them as modules.
    
    The size increases are minor and are offsetted by already merged
    "default ARCH_APPLE" removals from the linked original submission.
    
    vmlinux 157782640 -> 157902032 (+119392)
    Image    41007616 ->  41073152 (+ 65536)
    
    Link: https://lore.kernel.org/asahi/20250612-apple-kconfig-defconfig-v1-0-0e6f9cb512c1@kernel.org/
    Signed-off-by: Janne Grunau 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251231-arch-arm64-apple-defconfig-v1-2-4ff19805ba39@jannau.net
    Signed-off-by: Sven Peter 

commit 92d3935e63df8a3beb0500025240d8a6093f89cb
Author: Janne Grunau 
Date:   Wed Dec 31 16:42:38 2025 +0100

    arm64: select APPLE_PMGR_PWRSTATE for ARCH_APPLE
    
    Critical devices like the NVMe on Apple silicon systems depend on
    APPLE_PMGR_PWRSTATE and others are powered down coming out of reset so
    select APPLE_PMGR_PWRSTATE to ensure these devices work. Since the
    systems are not totally unsusable (boot to initramfs is expected to
    work) allow !PM builds without APPLE_PMGR_PWRSTATE.
    
    Link: https://lore.kernel.org/asahi/2e022f4e-4c87-4da1-9d02-f7a3ae7c5798@arm.com/
    Suggested-by: Robin Murphy 
    Signed-off-by: Janne Grunau 
    Link: https://patch.msgid.link/20251231-arch-arm64-apple-defconfig-v1-1-4ff19805ba39@jannau.net
    Signed-off-by: Sven Peter 

commit 38a0f4cf8c6147fd10baa206ab349f8ff724e391
Author: Peter Colberg 
Date:   Mon Dec 22 12:42:48 2025 -0500

    Revert duplicate "drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces"
    
    This reverts commit 22a36e660d014925114feb09a2680bb3c2d1e279 once,
    which was merged twice due to an incorrect backmerge resolution.
    
    Fixes: ce0478b02ed2 ("Merge tag 'v6.18-rc6' into drm-next")
    Signed-off-by: Peter Colberg 
    Signed-off-by: Alex Deucher 

commit 4e88de313ff4d1c67b644b1f39f9fb4089711b71
Author: Matt Roper 
Date:   Thu Jan 8 10:19:45 2026 -0800

    drm/xe/nvls: Define GuC firmware for NVL-S
    
    Although NVL-S has a similar Xe3 to PTL/WCL, it requires a unique GuC
    firmware.
    
    Signed-off-by: Matt Roper 
    Reviewed-by: Lucas De Marchi 
    Link: https://lore.kernel.org/r/20251016-xe3p-v3-12-3dd173a3097a@intel.com
    Signed-off-by: Lucas De Marchi 
    Signed-off-by: Julia Filipchuk 
    Link: https://patch.msgid.link/20260108181956.1254908-9-julia.filipchuk@intel.com
    Signed-off-by: Rodrigo Vivi 

commit db5e82496492b4890b1c3356581c016767ed527f
Author: Amit Shah 
Date:   Fri Nov 7 10:32:39 2025 +0100

    KVM: SVM: Virtualize and advertise support for ERAPS
    
    AMD CPUs with the Enhanced Return Address Predictor Security (ERAPS)
    feature (available on Zen5+) obviate the need for FILL_RETURN_BUFFER
    sequences right after VMEXITs.  ERAPS adds guest/host tags to entries in
    the RSB (a.k.a. RAP).  This helps with speculation protection across the
    VM boundary, and it also preserves host and guest entries in the RSB that
    can improve software performance (which would otherwise be flushed due to
    the FILL_RETURN_BUFFER sequences).
    
    Importantly, ERAPS also improves cross-domain security by clearing the RAP
    in certain situations.  Specifically, the RAP is cleared in response to
    actions that are typically tied to software context switching between
    tasks.  Per the APM:
    
      The ERAPS feature eliminates the need to execute CALL instructions to
      clear the return address predictor in most cases. On processors that
      support ERAPS, return addresses from CALL instructions executed in host
      mode are not used in guest mode, and vice versa. Additionally, the
      return address predictor is cleared in all cases when the TLB is
      implicitly invalidated and in the following cases:
    
      • MOV CR3 instruction
      • INVPCID other than single address invalidation (operation type 0)
    
    ERAPS also allows CPUs to extends the size of the RSB/RAP from the older
    standard (of 32 entries) to a new size, enumerated in CPUID leaf
    0x80000021:EBX bits 23:16 (64 entries in Zen5 CPUs).
    
    In hardware, ERAPS is always-on, when running in host context, the CPU
    uses the full RSB/RAP size without any software changes necessary.
    However, when running in guest context, the CPU utilizes the full size of
    the RSB/RAP if and only if the new ALLOW_LARGER_RAP flag is set in the
    VMCB; if the flag is not set, the CPU limits itself to the historical size
    of 32 entires.
    
    Requiring software to opt-in for guest usage of RAPs larger than 32 entries
    allows hypervisors, i.e. KVM, to emulate the aforementioned conditions in
    which the RAP is cleared as well as the guest/host split.  E.g. if the CPU
    unconditionally used the full RAP for guests, failure to clear the RAP on
    transitions between L1 or L2, or on emulated guest TLB flushes, would
    expose the guest to RAP-based attacks as a guest without support for ERAPS
    wouldn't know that its FILL_RETURN_BUFFER sequence is insufficient.
    
    Address the ~two broad categories of ERAPS emulation, and advertise
    ERAPS support to userspace, along with the RAP size enumerated in CPUID.
    
    1. Architectural RAP clearing: as above, CPUs with ERAPS clear RAP entries
       on several conditions, including CR3 updates.  To handle scenarios
       where a relevant operation is handled in common code (emulation of
       INVPCID and to a lesser extent MOV CR3), piggyback VCPU_EXREG_CR3 and
       create an alias, VCPU_EXREG_ERAPS.  SVM doesn't utilize CR3 dirty
       tracking, and so for all intents and purposes VCPU_EXREG_CR3 is unused.
       Aliasing VCPU_EXREG_ERAPS ensures that any flow that writes CR3 will
       also clear the guest's RAP, and allows common x86 to mark ERAPS vCPUs
       as needing a RAP clear without having to add a new request (or other
       mechanism).
    
    2. Nested guests: the ERAPS feature adds host/guest tagging to entries
       in the RSB, but does not distinguish between the guest ASIDs.  To
       prevent the case of an L2 guest poisoning the RSB to attack the L1
       guest, the CPU exposes a new VMCB bit (CLEAR_RAP).  The next
       VMRUN with a VMCB that has this bit set causes the CPU to flush the
       RSB before entering the guest context.  Set the bit in VMCB01 after a
       nested #VMEXIT to ensure the next time the L1 guest runs, its RSB
       contents aren't polluted by the L2's contents.  Similarly, before
       entry into a nested guest, set the bit for VMCB02, so that the L1
       guest's RSB contents are not leaked/used in the L2 context.
    
    Enable ALLOW_LARGER_RAP (and emulate RAP clears) if and only if ERAPS is
    exposed to the guest.  Enabling ALLOW_LARGER_RAP unconditionally wouldn't
    cause any functional issues, but ignoring userspace's (and L1's) desires
    would put KVM into a grey area, which is especially undesirable due to the
    potential security implications.  E.g. if a use case wants to have L1 do
    manual RAP clearing even when ERAPS is present in hardware, enabling
    ALLOW_LARGER_RAP could result in L1 leaving stale entries in the RAP.
    
    ERAPS is documented in AMD APM Vol 2 (Pub 24593), in revisions 3.43 and
    later.
    
    Signed-off-by: Amit Shah 
    Co-developed-by: Sean Christopherson 
    Signed-off-by: Sean Christopherson 
    Reviewed-by: Amit Shah 
    Link: https://patch.msgid.link/aR913X8EqO6meCqa@google.com

commit 1d1722e52fcd70deb53d8c192f958fe34be14f5e
Author: Kevin Cheng 
Date:   Mon Dec 15 19:25:10 2025 +0000

    KVM: SVM: Don't allow L1 intercepts for instructions not advertised
    
    If a feature is not advertised in the guest's CPUID, prevent L1 from
    intercepting the unsupported instructions by clearing the corresponding
    intercept in KVM's cached vmcb12.
    
    When an L2 guest executes an instruction that is not advertised to L1,
    we expect a #UD exception to be injected by L0. However, the nested svm
    exit handler first checks if the instruction intercept is set in vmcb12,
    and if so, synthesizes an exit from L2 to L1 instead of a #UD exception.
    If a feature is not advertised, the L1 intercept should be ignored.
    
    While creating KVM's cached vmcb12, sanitize the intercepts for
    instructions that are not advertised in the guest CPUID. This
    effectively ignores the L1 intercept on nested vm exit handling. It also
    ignores the L1 intercept when computing the intercepts in vmcb02, so if
    L0 (for some reason) does not intercept the instruction, KVM won't
    intercept it at all.
    
    Signed-off-by: Kevin Cheng 
    Co-developed-by: Sean Christopherson 
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251215192510.2300816-1-chengkev@google.com
    Signed-off-by: Sean Christopherson 

commit 01cde4eaaecaf5df158234f0a52b4a1c55796858
Author: Sean Christopherson 
Date:   Thu Nov 13 14:16:42 2025 -0800

    KVM: SVM: Add support for expedited writes to the fast MMIO bus
    
    Wire up SVM's #NPF handler to fast MMIO.  While SVM doesn't provide a
    dedicated exit reason, it's trivial to key off PFERR_RSVD_MASK.  Like VMX,
    restrict the fast path to L1 to avoid having to deal with nGPA=>GPA
    translations.
    
    For simplicity, use the fast path if and only if the next RIP is known.
    While KVM could utilize EMULTYPE_SKIP, doing so would require additional
    logic to deal with SEV guests, e.g. to go down the slow path if the
    instruction buffer is empty.  All modern CPUs support next RIP, and in
    practice the next RIP will be available for any guest fast path.
    
    Copy+paste the kvm_io_bus_write() + trace_kvm_fast_mmio() logic even
    though KVM would ideally provide a small helper, as such a helper would
    need to either be a macro or non-inline to avoid including trace.h in a
    header (trace.h must not be included by x86.c prior to CREATE_TRACE_POINTS
    being defined).
    
    Link: https://patch.msgid.link/20251113221642.1673023-3-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 737f2a382f89f2ff3d9d6a737004d97bfb98dc56
Author: Sean Christopherson 
Date:   Thu Nov 13 14:16:41 2025 -0800

    KVM: SVM: Rename "fault_address" to "gpa" in npf_interception()
    
    Rename "fault_address" to "gpa" in KVM's #NPF handler and track it as a
    gpa_t to more precisely document what type of address is being captured,
    and because "gpa" is much more succinct.
    
    No functional change intended.
    
    Link: https://patch.msgid.link/20251113221642.1673023-2-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit fc3ba56385d03501eb582e4b86691ba378e556f9
Author: Sean Christopherson 
Date:   Tue Dec 16 08:17:54 2025 -0800

    KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding
    
    Drop the WARN in svm_set_nested_state() on nested_svm_load_cr3() failing
    as it is trivially easy to trigger from userspace by modifying CPUID after
    loading CR3.  E.g. modifying the state restoration selftest like so:
    
      --- tools/testing/selftests/kvm/x86/state_test.c
      +++ tools/testing/selftests/kvm/x86/state_test.c
      @@ -280,7 +280,16 @@ int main(int argc, char *argv[])
    
                     /* Restore state in a new VM.  */
                      vcpu = vm_recreate_with_one_vcpu(vm);
      -               vcpu_load_state(vcpu, state);
      +
      +               if (stage == 4) {
      +                       state->sregs.cr3 = BIT(44);
      +                       vcpu_load_state(vcpu, state);
      +
      +                       vcpu_set_cpuid_property(vcpu, X86_PROPERTY_MAX_PHY_ADDR, 36);
      +                       __vcpu_nested_state_set(vcpu, &state->nested);
      +               } else {
      +                       vcpu_load_state(vcpu, state);
      +               }
    
                      /*
                       * Restore XSAVE state in a dummy vCPU, first without doing
    
    generates:
    
      WARNING: CPU: 30 PID: 938 at arch/x86/kvm/svm/nested.c:1877 svm_set_nested_state+0x34a/0x360 [kvm_amd]
      Modules linked in: kvm_amd kvm irqbypass [last unloaded: kvm]
      CPU: 30 UID: 1000 PID: 938 Comm: state_test Tainted: G        W           6.18.0-rc7-58e10b63777d-next-vm
      Tainted: [W]=WARN
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
      RIP: 0010:svm_set_nested_state+0x34a/0x360 [kvm_amd]
      Call Trace:
       
       kvm_arch_vcpu_ioctl+0xf33/0x1700 [kvm]
       kvm_vcpu_ioctl+0x4e6/0x8f0 [kvm]
       __x64_sys_ioctl+0x8f/0xd0
       do_syscall_64+0x61/0xad0
       entry_SYSCALL_64_after_hwframe+0x4b/0x53
    
    Simply delete the WARN instead of trying to prevent userspace from shoving
    "illegal" state into CR3.  For better or worse, KVM's ABI allows userspace
    to set CPUID after SREGS, and vice versa, and KVM is very permissive when
    it comes to guest CPUID.  I.e. attempting to enforce the virtual CPU model
    when setting CPUID could break userspace.  Given that the WARN doesn't
    provide any meaningful protection for KVM or benefit for userspace, simply
    drop it even though the odds of breaking userspace are minuscule.
    
    Opportunistically delete a spurious newline.
    
    Fixes: b222b0b88162 ("KVM: nSVM: refactor the CR3 reload on migration")
    Cc: stable@vger.kernel.org
    Cc: Yosry Ahmed 
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251216161755.1775409-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 591cf7900da577a9ac7777b74b697bf3d61687d0
Author: Nick Chan 
Date:   Wed Dec 31 02:30:42 2025 +0800

    arm64: dts: apple: s8001: Add DWI backlight for J98a, J99a
    
    iPad Pro (12.9-inch) uses DWI backlight, while the 9.7-inch model does not.
    Add DWI backlight node for s8001 and enable it for J98a and J99a.
    
    Signed-off-by: Nick Chan 
    Link: https://patch.msgid.link/20251231-b4-j98a-j99a-dwi-bl-v1-1-24793c2b99fc@gmail.com
    Signed-off-by: Sven Peter 

commit b6376dbed8e173f9571583b5d358b08ff394e864
Author: Andy Shevchenko 
Date:   Thu Jan 8 18:51:45 2026 +0100

    spi: Simplify devm_spi_*_controller()
    
    Use devm_add_action_or_reset() instead of devres_alloc() and
    devres_add(), which works the same. This will simplify the
    code. There is no functional changes.
    
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108175145.3535441-1-andriy.shevchenko@linux.intel.com
    Signed-off-by: Mark Brown 

commit 19a4505a7a5d4eea70f1a42d601c25d730922fdf
Author: Andy Shevchenko 
Date:   Thu Jan 8 18:49:40 2026 +0100

    spi: microchip-core: use XOR instead of ANDNOT to fix the logic
    
    Use XOR instead of ANDNOT to fix the logic. The current approach with
    (foo & BAR & ~baz) is harder to process, and it proved to be wrong,
    than more usual pattern for the comparing misconfiguration using
    ((foo ^ baz) & BAR) which can be read as "find all different bits
    between foo and baz that are related to BAR (mask)". Besides that
    it makes the binary code shorter.
    
    Function                                     old     new   delta
    mchp_corespi_setup                           103      99      -4
    
    Fixes: 059f545832be ("spi: add support for microchip "soft" spi controller")
    Reviewed-by: Conor Dooley 
    Tested-by: Prajna Rajendra Kumar 
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20260108175100.3535306-1-andriy.shevchenko@linux.intel.com
    Signed-off-by: Mark Brown 

commit 57a7b47ab30f6201769988392dc8b1c0822a3369
Author: Xiaoyao Li 
Date:   Fri Dec 12 21:50:51 2025 +0800

    KVM: x86: Don't read guest CR3 when doing async pf while the MMU is direct
    
    Don't read guest CR3 in kvm_arch_setup_async_pf() if the MMU is direct
    and use INVALID_GPA instead.
    
    When KVM tries to perform the host-only async page fault for the shared
    memory of TDX guests, the following WARNING is triggered:
    
      WARNING: CPU: 1 PID: 90922 at arch/x86/kvm/vmx/main.c:483 vt_cache_reg+0x16/0x20
      Call Trace:
      __kvm_mmu_faultin_pfn
      kvm_mmu_faultin_pfn
      kvm_tdp_page_fault
      kvm_mmu_do_page_fault
      kvm_mmu_page_fault
      tdx_handle_ept_violation
    
    This WARNING is triggered when calling kvm_mmu_get_guest_pgd() to cache
    the guest CR3 in kvm_arch_setup_async_pf() for later use in
    kvm_arch_async_page_ready() to determine if it's possible to fix the
    page fault in the current vCPU context to save one VM exit. However, when
    guest state is protected, KVM cannot read the guest CR3.
    
    Since protected guests aren't compatible with shadow paging, i.e, they
    must use direct MMU, avoid calling kvm_mmu_get_guest_pgd() to read guest
    CR3 when the MMU is direct and use INVALID_GPA instead.
    
    Note that for protected guests mmu->root_role.direct is always true, so
    that kvm_mmu_get_guest_pgd() in kvm_arch_async_page_ready() won't be
    reached.
    
    Reported-by: Farrah Chen 
    Suggested-by: Sean Christopherson 
    Signed-off-by: Xiaoyao Li 
    Link: https://patch.msgid.link/20251212135051.2155280-1-xiaoyao.li@intel.com
    [sean: explicitly cast to "unsigned long" to make 32-bit builds happy]
    Signed-off-by: Sean Christopherson 

commit e353850499c717f1f984f7c208f49a8618beff2f
Author: Sean Christopherson 
Date:   Tue Dec 30 15:01:49 2025 -0800

    KVM: selftests: Rename vm_get_page_table_entry() to vm_get_pte()
    
    Shorten the API to get a PTE as the "PTE" acronym is ubiquitous, and the
    "page table entry" makes it unnecessarily difficult to quickly understand
    what callers are doing.
    
    No functional change intended.
    
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-21-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 59eef1a47b8c264d09ee84c909a1da60b4e70bd7
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:48 2025 -0800

    KVM: selftests: Extend memstress to run on nested SVM
    
    Add L1 SVM code and generalize the setup code to work for both VMX and
    SVM. This allows running 'dirty_log_perf_test -n' on AMD CPUs.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-20-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 6794d916f87e0a6cd51a3d8c2c0e6ffd48fa7a79
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:47 2025 -0800

    KVM: selftests: Extend vmx_dirty_log_test to cover SVM
    
    Generalize the code in vmx_dirty_log_test.c by adding SVM-specific L1
    code, doing some renaming (e.g. EPT -> TDP), and having setup code for
    both SVM and VMX in test_dirty_log().
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-19-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 251e4849a79b258fd3e889ff095ba083ce301c13
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:46 2025 -0800

    KVM: selftests: Set the user bit on nested NPT PTEs
    
    According to the APM, NPT walks are treated as user accesses. In
    preparation for supporting NPT mappings, set the 'user' bit on NPTs by
    adding a mask of bits to always be set on PTEs in kvm_mmu.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-18-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 753c0d5a507b939d6efc60c7b437d5330880cce3
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:45 2025 -0800

    KVM: selftests: Add support for nested NPTs
    
    Implement nCR3 and NPT initialization functions, similar to the EPT
    equivalents, and create common TDP helpers for enablement checking and
    initialization. Enable NPT for nested guests by default if the TDP MMU
    was initialized, similar to VMX.
    
    Reuse the PTE masks from the main MMU in the NPT MMU, except for the C
    and S bits related to confidential VMs.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-17-seanjc@google.com
    [sean: apply Yosry's fixup for ncr3_gpa]
    Signed-off-by: Sean Christopherson 

commit 9cb1944f6bf09ecebcc7609f35178b85aa26f165
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:44 2025 -0800

    KVM: selftests: Allow kvm_cpu_has_ept() to be called on AMD CPUs
    
    In preparation for generalizing the nested dirty logging test, checking
    if either EPT or NPT is enabled will be needed. To avoid needing to gate
    the kvm_cpu_has_ept() call by the CPU type, make sure the function
    returns false if VMX is not available instead of trying to read VMX-only
    MSRs.
    
    No functional change intended.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-16-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 07676c04bd753f32a9fe2f247b0ba2d213dd7a99
Author: Sean Christopherson 
Date:   Tue Dec 30 15:01:43 2025 -0800

    KVM: selftests: Move TDP mapping functions outside of vmx.c
    
    Now that the functions are no longer VMX-specific, move them to
    processor.c. Do a minor comment tweak replacing 'EPT' with 'TDP'.
    
    No functional change intended.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-15-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 508d1cc3ca0ac428b1d5d614519bc497868c2e9f
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:42 2025 -0800

    KVM: selftests: Reuse virt mapping functions for nested EPTs
    
    Rework tdp_map() and friends to use __virt_pg_map() and drop the custom
    EPT code in __tdp_pg_map() and tdp_create_pte().  The EPT code and
    __virt_pg_map() are practically identical, the main differences are:
      - EPT uses the EPT struct overlay instead of the PTE masks.
      - EPT always assumes 4-level EPTs.
    
    To reuse __virt_pg_map(), extend the PTE masks to work with EPT's RWX and
    X-only capabilities, and provide a tdp_mmu_init() API so that EPT can pass
    in the EPT PTE masks along with the root page level (which is currently
    hardcoded to '4').
    
    Don't reuse KVM's insane overloading of the USER bit for EPT_R as there's
    no reason to multiplex bits in the selftests, e.g. selftests aren't trying
    to shadow guest PTEs and thus don't care about funnelling protections into
    a common permissions check.
    
    Another benefit of reusing the code is having separate handling for
    upper-level PTEs vs 4K PTEs, which avoids some quirks like setting the
    large bit on a 4K PTE in the EPTs.
    
    For all intents and purposes, no functional change intended.
    
    Suggested-by: Sean Christopherson 
    Signed-off-by: Yosry Ahmed 
    Co-developed-by: Sean Christopherson 
    Link: https://patch.msgid.link/20251230230150.4150236-14-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 8296b16c0a2ba018c3235db5325d679e603899d6
Author: Sean Christopherson 
Date:   Tue Dec 30 15:01:41 2025 -0800

    KVM: selftests: Add a stage-2 MMU instance to kvm_vm
    
    Add a stage-2 MMU instance so that architectures that support nested
    virtualization (more specifically, nested stage-2 page tables) can create
    and track stage-2 page tables for running L2 guests.  Plumb the structure
    into common code to avoid cyclical dependencies, and to provide some line
    of sight to having common APIs for creating stage-2 mappings.
    
    As a bonus, putting the member in common code justifies using stage2_mmu
    instead of tdp_mmu for x86.
    
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-13-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit e40e72fec0dea9ac55aea84a0d76ccb7d7f32204
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:40 2025 -0800

    KVM: selftests: Stop passing VMX metadata to TDP mapping functions
    
    The root GPA is now retrieved from the nested MMU, stop passing VMX
    metadata. This is in preparation for making these functions work for
    NPTs as well.
    
    Opportunistically drop tdp_pg_map() since it's unused.
    
    No functional change intended.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-12-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit f00f519cebcd4280c4ce4fab8133ed2dcfa8f95a
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:39 2025 -0800

    KVM: selftests: Use a TDP MMU to share EPT page tables between vCPUs
    
    prepare_eptp() currently allocates new EPTs for each vCPU.  memstress has
    its own hack to share the EPTs between vCPUs.  Currently, there is no
    reason to have separate EPTs for each vCPU, and the complexity is
    significant.  The only reason it doesn't matter now is because memstress
    is the only user with multiple vCPUs.
    
    Add vm_enable_ept() to allocate EPT page tables for an entire VM, and use
    it everywhere to replace prepare_eptp().  Drop 'eptp' and 'eptp_hva' from
    'struct vmx_pages' as they serve no purpose (e.g. the EPTP can be built
    from the PGD), but keep 'eptp_gpa' so that the MMU structure doesn't need
    to be passed in along with vmx_pages.  Dynamically allocate the TDP MMU
    structure to avoid a cyclical dependency between kvm_util_arch.h and
    kvm_util.h.
    
    Remove the workaround in memstress to copy the EPT root between vCPUs
    since that's now the default behavior.
    
    Name the MMU tdp_mmu instead of e.g. nested_mmu or nested.mmu to avoid
    recreating the same mess that KVM has with respect to "nested" MMUs, e.g.
    does nested refer to the stage-2 page tables created by L1, or the stage-1
    page tables created by L2?
    
    Signed-off-by: Yosry Ahmed 
    Co-developed-by: Sean Christopherson 
    Link: https://patch.msgid.link/20251230230150.4150236-11-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 6dd70757213fc046e5f86901e4baf11ed894da6b
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:38 2025 -0800

    KVM: selftests: Move PTE bitmasks to kvm_mmu
    
    Move the PTE bitmasks into kvm_mmu to parameterize them for virt mapping
    functions. Introduce helpers to read/write different PTE bits given a
    kvm_mmu.
    
    Drop the 'global' bit definition as it's currently unused, but leave the
    'user' bit as it will be used in coming changes. Opportunisitcally
    rename 'large' to 'huge' as it's more consistent with the kernel naming.
    
    Leave PHYSICAL_PAGE_MASK alone, it's fixed in all page table formats and
    a lot of other macros depend on it. It's tempting to move all the other
    macros to be per-struct instead, but it would be too much noise for
    little benefit.
    
    Keep c_bit and s_bit in vm->arch as they used before the MMU is
    initialized, through  __vmcreate() -> vm_userspace_mem_region_add() ->
    vm_mem_add() -> vm_arch_has_protected_memory().
    
    No functional change intended.
    
    Signed-off-by: Yosry Ahmed 
    [sean: rename accessors to is__pte()]
    Link: https://patch.msgid.link/20251230230150.4150236-10-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 3d0e7595e81017558189d2252ae9453c57ab3436
Author: Sean Christopherson 
Date:   Tue Dec 30 15:01:37 2025 -0800

    KVM: selftests: Add a "struct kvm_mmu_arch arch" member to kvm_mmu
    
    Add an arch structure+field in "struct kvm_mmu" so that architectures can
    track arch-specific information for a given MMU.
    
    No functional change intended.
    
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-9-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 11825209f5494098da6cab666d8a767650c1c0cb
Author: Sean Christopherson 
Date:   Tue Dec 30 15:01:36 2025 -0800

    KVM: selftests: Plumb "struct kvm_mmu" into x86's MMU APIs
    
    In preparation for generalizing the x86 virt mapping APIs to work with
    TDP (stage-2) page tables, plumb "struct kvm_mmu" into all of the helper
    functions instead of operating on vm->mmu directly.
    
    Opportunistically swap the order of the check in virt_get_pte() to first
    assert that the parent is the PGD, and then check that the PTE is present,
    as it makes more sense to check if the parent PTE is the PGD/root (i.e.
    not a PTE) before checking that the PTE is PRESENT.
    
    No functional change intended.
    
    Suggested-by: Sean Christopherson 
    Signed-off-by: Yosry Ahmed 
    [sean: rebase on common kvm_mmu structure, rewrite changelog]
    Link: https://patch.msgid.link/20251230230150.4150236-8-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 9f073ac25b4c4cf3b3ea13b155035108c54148bb
Author: Sean Christopherson 
Date:   Tue Dec 30 15:01:35 2025 -0800

    KVM: selftests: Add "struct kvm_mmu" to track a given MMU instance
    
    Add a "struct kvm_mmu" to track a given MMU instance, e.g. a VM's stage-1
    MMU versus a VM's stage-2 MMU, so that x86 can share MMU functionality for
    both stage-1 and stage-2 MMUs, without creating the potential for subtle
    bugs, e.g. due to consuming on vm->pgtable_levels when operating a stage-2
    MMU.
    
    Encapsulate the existing de facto MMU in "struct kvm_vm", e.g instead of
    burying the MMU details in "struct kvm_vm_arch", to avoid more #ifdefs in
    ____vm_create(), and in the hopes that other architectures can utilize the
    formalized MMU structure if/when they too support stage-2 page tables.
    
    No functional change intended.
    
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-7-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 3cd5002807bebf504cbb6645e73d01204324e54a
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:34 2025 -0800

    KVM: selftests: Stop setting A/D bits when creating EPT PTEs
    
    Stop setting Accessed/Dirty bits when creating EPT entries for L2 so that
    the stage-1 and stage-2 (a.k.a. TDP) page table APIs can use common code
    without bleeding the EPT hack into the common APIs.
    
    While commit 094444204570 ("selftests: kvm: add test for dirty logging
    inside nested guests") is _very_ light on details, the most likely
    explanation is that vmx_dirty_log_test was attempting to avoid taking an
    EPT Violation on the first _write_ from L2.
    
      static void l2_guest_code(u64 *a, u64 *b)
      {
            READ_ONCE(*a);
            WRITE_ONCE(*a, 1);   <===
            GUEST_SYNC(true);
    
            ...
      }
    
    When handling read faults in the shadow MMU, KVM opportunistically creates
    a writable SPTE if the mapping can be writable *and* the gPTE is dirty (or
    doesn't support the Dirty bit), i.e. if KVM doesn't need to intercept
    writes in order to emulate Dirty-bit updates.  By setting A/D bits in the
    test's EPT entries, the above READ+WRITE will fault only on the read, and
    in theory expose the bug fixed by KVM commit 1f4e5fc83a42 ("KVM: x86: fix
    nested guest live migration with PML").  If the Dirty bit is NOT set, the
    test will get a false pass due; though again, in theory.
    
    However, the test is flawed (and always was, at least in the versions
    posted publicly), as KVM (correctly) marks the corresponding L1 GFN as
    dirty (in the dirty bitmap) when creating the writable SPTE.  I.e. without
    a check on the dirty bitmap after the READ_ONCE(), the check after the
    first WRITE_ONCE() will get a false pass due to the dirty bitmap/log having
    been updated by the read fault, not by PML.
    
    Furthermore, the subsequent behavior in the test's l2_guest_code()
    effectively hides the flawed test behavior, as the straight writes to a
    new L2 GPA fault also trigger the KVM bug, and so the test will still
    detect the failure due to lack of isolation between the two testcases
    (Read=>Write vs. Write=>Write).
    
            WRITE_ONCE(*b, 1);
            GUEST_SYNC(true);
            WRITE_ONCE(*b, 1);
            GUEST_SYNC(true);
            GUEST_SYNC(false);
    
    Punt on fixing vmx_dirty_log_test for the moment as it will be easier to
    properly fix the test once the TDP code uses the common MMU APIs, at which
    point it will be trivially easy for the test to retrieve the EPT PTE and
    set the Dirty bit as needed.
    
    Signed-off-by: Yosry Ahmed 
    [sean: rewrite changelog to explain the situation]
    Link: https://patch.msgid.link/20251230230150.4150236-6-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit b320c03d685704df51cf0774edd799e96c505c74
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:33 2025 -0800

    KVM: selftests: Kill eptPageTablePointer
    
    Replace the struct overlay with explicit bitmasks, which is clearer and
    less error-prone. See commit f18b4aebe107 ("kvm: selftests: do not use
    bitfields larger than 32-bits for PTEs") for an example of why bitfields
    are not preferable.
    
    Remove the unused PAGE_SHIFT_4K definition while at it.
    
    No functional change intended.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-5-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 60de423781ad9967bfdd3a2f02ba0a31787b0d2c
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:32 2025 -0800

    KVM: selftests: Rename nested TDP mapping functions
    
    Rename the functions from nested_* to tdp_* to make their purpose
    clearer.
    
    No functional change intended.
    
    Suggested-by: Sean Christopherson 
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-4-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 97dfbdfea405a0820ccfcf00afdda4c0f47c3df8
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:31 2025 -0800

    KVM: selftests: Stop passing a memslot to nested_map_memslot()
    
    On x86, KVM selftests use memslot 0 for all the default regions used by
    the test infrastructure. This is an implementation detail.
    nested_map_memslot() is currently used to map the default regions by
    explicitly passing slot 0, which leaks the library implementation into
    the caller.
    
    Rename the function to a very verbose
    nested_identity_map_default_memslots() to reflect what it actually does.
    Add an assertion that only memslot 0 is being used so that the
    implementation does not change from under us.
    
    No functional change intended.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-3-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 69e81ed5e6a59c12c0c6756c3f0524e2ddb023f4
Author: Yosry Ahmed 
Date:   Tue Dec 30 15:01:30 2025 -0800

    KVM: selftests: Make __vm_get_page_table_entry() static
    
    The function is only used in processor.c, drop the declaration in
    processor.h and make it static.
    
    No functional change intended.
    
    Signed-off-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230230150.4150236-2-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 7fe9f5366bd5d7ee3cfd9f66868a4410d6e4792d
Author: MJ Pooladkhay 
Date:   Mon Dec 22 17:42:07 2025 +0000

    KVM: selftests: Fix sign extension bug in get_desc64_base()
    
    The function get_desc64_base() performs a series of bitwise left shifts on
    fields of various sizes. More specifically, when performing '<< 24' on
    'desc->base2' (which is a u8), 'base2' is promoted to a signed integer
    before shifting.
    
    In a scenario where base2 >= 0x80, the shift places a 1 into bit 31,
    causing the 32-bit intermediate value to become negative. When this
    result is cast to uint64_t or ORed into the return value, sign extension
    occurs, corrupting the upper 32 bits of the address (base3).
    
    Example:
    Given:
      base0 = 0x5000
      base1 = 0xd6
      base2 = 0xf8
      base3 = 0xfffffe7c
    
    Expected return: 0xfffffe7cf8d65000
    Actual return:   0xfffffffff8d65000
    
    Fix this by explicitly casting the fields to 'uint64_t' before shifting
    to prevent sign extension.
    
    Signed-off-by: MJ Pooladkhay 
    Link: https://patch.msgid.link/20251222174207.107331-1-mj@pooladkhay.com
    Signed-off-by: Sean Christopherson 

commit 5bb9ac1865123356337a389af935d3913ee917ed
Author: Sean Christopherson 
Date:   Tue Dec 30 12:59:48 2025 -0800

    KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR
    
    Return KVM_MSR_RET_UNSUPPORTED instead of '1' (which for all intents and
    purposes means "invalid") when rejecting accesses to KVM PV MSRs to adhere
    to KVM's ABI of allowing host reads and writes of '0' to MSRs that are
    advertised to userspace via KVM_GET_MSR_INDEX_LIST, even if the vCPU model
    doesn't support the MSR.
    
    E.g. running a QEMU VM with
    
      -cpu host,-kvmclock,kvm-pv-enforce-cpuid
    
    yields:
    
      qemu: error: failed to set MSR 0x12 to 0x0
      qemu: target/i386/kvm/kvm.c:3301: kvm_buf_set_msrs:
            Assertion `ret == cpu->kvm_msr_buf->nmsrs' failed.
    
    Fixes: 66570e966dd9 ("kvm: x86: only provide PV features if enabled in guest's CPUID")
    Cc: stable@vger.kernel.org
    Reviewed-by: Jim Mattson 
    Link: https://patch.msgid.link/20251230205948.4094097-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit c9d7134679ebf038c3d1d0b324e378dfc464d198
Author: Fred Griffoul 
Date:   Fri Nov 21 14:34:44 2025 -0800

    KVM: nVMX: Mark APIC access page dirty when syncing vmcs12 pages
    
    For consistency with commit 7afe79f5734a ("KVM: nVMX: Mark vmcs12's APIC
    access page dirty when unmapping"), which marks the page dirty during
    unmap operations, also mark it dirty during vmcs12 page synchronization.
    
    Signed-off-by: Fred Griffoul 
    [sean: use kvm_vcpu_map_mark_dirty()]
    Link: https://patch.msgid.link/20251121223444.355422-6-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 57dfa61f6248e0fb23a3f767a7dc9c8fcecec5d7
Author: Sean Christopherson 
Date:   Fri Nov 21 14:34:43 2025 -0800

    KVM: VMX: Move nested_mark_vmcs12_pages_dirty() to vmx.c, and rename
    
    Move nested_mark_vmcs12_pages_dirty() to vmx.c now that it's only used in
    the VM-Exit path, and add "all" to its name to document that its purpose
    is to mark all (mapped-out-of-band) vmcs12 pages as dirty.
    
    No functional change intended.
    
    Link: https://patch.msgid.link/20251121223444.355422-5-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit f74bb1d2eda1b77c37f35876ca0c44be345e2b1f
Author: Sean Christopherson 
Date:   Fri Nov 21 14:34:42 2025 -0800

    KVM: nVMX: Precisely mark vAPIC and PID maps dirty when delivering nested PI
    
    Explicitly mark the vmcs12 vAPIC and PI descriptor pages as dirty when
    delivering a nested posted interrupt instead of marking all vmcs12 pages
    as dirty.  This will allow marking the APIC access page (and any future
     vmcs12 pages) as dirty in nested_mark_vmcs12_pages_dirty() without over-
    dirtying in the nested PI case.  Manually marking the vAPIC and PID pages
    as dirty also makes the flow a bit more self-documenting, e.g. it's not
    obvious at first glance that vmx->nested.pi_desc is actually a host kernel
    mapping of a vmcs12 page.
    
    No functional change intended.
    
    Link: https://patch.msgid.link/20251121223444.355422-4-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 70b02809ded96ec790721cd5061e20b63b622310
Author: Sean Christopherson 
Date:   Fri Nov 21 14:34:41 2025 -0800

    KVM: x86: Mark vmcs12 pages as dirty if and only if they're mapped
    
    Mark vmcs12 pages as dirty (in KVM's dirty log bitmap) if and only if the
    page is mapped, i.e. if the page is actually "active" in vmcs02.  For some
    pages, KVM simply disables the associated VMCS control if the vmcs12 page
    is unreachable, i.e. it's possible for nested VM-Enter to succeed with a
    "bad" vmcs12 page.
    
    Link: https://patch.msgid.link/20251121223444.355422-3-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 44da6629d2820c8fd9ffa58cc7e46c2215828cb8
Author: Sean Christopherson 
Date:   Fri Nov 21 14:34:40 2025 -0800

    KVM: Use vCPU specific memslots in __kvm_vcpu_map()
    
    When establishing a "host access map", lookup the gfn in the vCPU specific
    memslots, as the intent is that the mapping will be established for the
    current vCPU context.  Specifically, using __kvm_vcpu_map() in x86's SMM
    context should create mappings based on the SMM memslots, not the non-SMM
    memslots.
    
    Luckily, the bug is benign as x86 is the only architecture with multiple
    memslot address spaces, and all of x86's usage is limited to non-SMM.  The
    calls in (or reachable by) {svm,vmx}_enter_smm() are made before
    enter_smm() sets HF_SMM_MASK, and the calls in {svm,vmx}_leave_smm() are
    made after emulator_leave_smm() clears HF_SMM_MASK.
    
    Note, kvm_vcpu_unmap() uses the vCPU specific memslots, only the map() side
    of things is broken.
    
    Fixes: 357a18ad230f ("KVM: Kill kvm_map_gfn() / kvm_unmap_gfn() and gfn_to_pfn_cache")
    Link: https://patch.msgid.link/20251121223444.355422-2-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit d374b89edbb9a8d552e03348f59287ff779b4c9d
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:20 2025 -0800

    KVM: VMX: Add mediated PMU support for CPUs without "save perf global ctrl"
    
    Extend mediated PMU support for Intel CPUs without support for saving
    PERF_GLOBAL_CONTROL into the guest VMCS field on VM-Exit, e.g. for Skylake
    and its derivatives, as well as Icelake.  While supporting CPUs without
    VM_EXIT_SAVE_IA32_PERF_GLOBAL_CTRL isn't completely trivial, it's not that
    complex either.  And not supporting such CPUs would mean not supporting 7+
    years of Intel CPUs released in the past 10 years.
    
    On VM-Exit, immediately propagate the saved PERF_GLOBAL_CTRL to the VMCS
    as well as KVM's software cache so that KVM doesn't need to add full EXREG
    tracking of PERF_GLOBAL_CTRL.  In practice, the vast majority of VM-Exits
    won't trigger software writes to guest PERF_GLOBAL_CTRL, so deferring the
    VMWRITE to the next VM-Enter would only delay the inevitable without
    batching/avoiding VMWRITEs.
    
    Note!  Take care to refresh VM_EXIT_MSR_STORE_COUNT on nested VM-Exit, as
    it's unfortunately possible that KVM could recalculate MSR intercepts
    while L2 is active, e.g. if userspace loads nested state and _then_ sets
    PERF_CAPABILITIES.  Eating the VMWRITE on every nested VM-Exit is
    unfortunate, but that's a pre-existing problem and can/should be solved
    separately, e.g. modifying the number of auto-load entries while L2 is
    active is also uncommon on modern CPUs.
    
    Reviewed-by: Dapeng Mi 
    Tested-by: Dapeng Mi 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-45-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 9757a5aebcd6ca808d5b80831649438a017478ad
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:19 2025 -0800

    KVM: VMX: Initialize vmcs01.VM_EXIT_MSR_STORE_ADDR with list address
    
    Initialize vmcs01.VM_EXIT_MSR_STORE_ADDR to point at the vCPU's
    msr_autostore list in anticipation of utilizing the auto-store
    functionality, and to harden KVM against stray reads to pfn 0 (or, in
    theory, a random pfn if the underlying CPU uses a complex scheme for
    encoding VMCS data).  The MSR auto lists are supposed to be ignored if the
    associated COUNT VMCS field is '0', but leaving the ADDR field
    zero-initialized in memory is an unnecessary risk (albeit a minuscule risk)
    given that the cost is a single VMWRITE during vCPU creation.
    
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-44-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit c3d6a7210a4de909683a36779f5b8567f79a3688
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:18 2025 -0800

    KVM: VMX: Dedup code for adding MSR to VMCS's auto list
    
    Add a helper to add an MSR to a VMCS's "auto" list to deduplicate the code
    in add_atomic_switch_msr(), and so that the functionality can be used in
    the future for managing the MSR auto-store list.
    
    No functional change intended.
    
    Reviewed-by: Dapeng Mi 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-43-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 2239d137a71d77c7610434473b0c8cfde90d4116
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:17 2025 -0800

    KVM: VMX: Compartmentalize adding MSRs to host vs. guest auto-load list
    
    Undo the bundling of the "host" and "guest" MSR auto-load list logic so
    that the code can be deduplicated by factoring out the logic to a separate
    helper.  Now that "list full" situations are treated as fatal to the VM,
    there is no need to pre-check both lists.
    
    For all intents and purposes, this reverts the add_atomic_switch_msr()
    changes made by commit 3190709335dd ("x86/KVM/VMX: Separate the VMX
    AUTOLOAD guest/host number accounting").
    
    Reviewed-by: Dapeng Mi 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-42-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 0c4ff0866fc1b0bf8c1d8d5f27fedc6dd9c51183
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:16 2025 -0800

    KVM: VMX: Set MSR index auto-load entry if and only if entry is "new"
    
    When adding an MSR to the auto-load lists, update the MSR index in the
    list entry if and only if a new entry is being inserted, as 'i' can only
    be non-negative if vmx_find_loadstore_msr_slot() found an entry with the
    MSR's index.  Unnecessarily setting the index is benign, but it makes it
    harder to see that updating the value is necessary even when an existing
    entry for the MSR was found.
    
    No functional change intended.
    
    Reviewed-by: Dapeng Mi 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-41-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 2ed57bb8997610b33cb92c26ccb9a91b2966fff8
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:15 2025 -0800

    KVM: VMX: Bug the VM if either MSR auto-load list is full
    
    WARN and bug the VM if either MSR auto-load list is full when adding an
    MSR to the lists, as the set of MSRs that KVM loads via the lists is
    finite and entirely KVM controlled, i.e. overflowing the lists shouldn't
    be possible in a fully released version of KVM.  Terminate the VM as the
    core KVM infrastructure has no insight as to _why_ an MSR is being added
    to the list, and failure to load an MSR on VM-Enter and/or VM-Exit could
    be fatal to the host.  E.g. running the host with a guest-controlled PEBS
    MSR could generate unexpected writes to the DS buffer and crash the host.
    
    Reviewed-by: Dapeng Mi 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-40-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 84ac00042a28642cc974a0a250fab7df050a5dd5
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:14 2025 -0800

    KVM: VMX: Drop unused @entry_only param from add_atomic_switch_msr()
    
    Drop the "on VM-Enter only" parameter from add_atomic_switch_msr() as it
    is no longer used, and for all intents and purposes was never used.  The
    functionality was added, under embargo, by commit 989e3992d2ec
    ("x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs"),
    and then ripped out by commit 2f055947ae5e ("x86/kvm: Drop L1TF MSR list
    approach") just a few commits later.
    
      2f055947ae5e x86/kvm: Drop L1TF MSR list approach
      72c6d2db64fa x86/litf: Introduce vmx status variable
      215af5499d9e cpu/hotplug: Online siblings when SMT control is turned on
      390d975e0c4e x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required
      989e3992d2ec x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs
    
    Furthermore, it's extremely unlikely KVM will ever _need_ to load an MSR
    value via the auto-load lists only on VM-Enter.  MSRs writes via the lists
    aren't optimized in any way, and so the only reason to use the lists
    instead of a WRMSR are for cases where the MSR _must_ be load atomically
    with respect to VM-Enter (and/or VM-Exit).  While one could argue that
    command MSRs, e.g. IA32_FLUSH_CMD, "need" to be done exact at VM-Enter, in
    practice doing such flushes within a few instructons of VM-Enter is more
    than sufficient.
    
    Note, the shortlog and changelog for commit 390d975e0c4e ("x86/KVM/VMX: Use
    MSR save list for IA32_FLUSH_CMD if required") are misleading and wrong.
    That commit added MSR_IA32_FLUSH_CMD to the VM-Enter _load_ list, not the
    VM-Enter save list (which doesn't exist, only VM-Exit has a store/save
    list).
    
    Reviewed-by: Dapeng Mi 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-39-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 0bd29379114b9c669cdabf7d6c08c0c1ea41861c
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:13 2025 -0800

    KVM: VMX: Dedup code for removing MSR from VMCS's auto-load list
    
    Add a helper to remove an MSR from an auto-{load,store} list to dedup the
    msr_autoload code, and in anticipation of adding similar functionality for
    msr_autostore.
    
    No functional change intended.
    
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-38-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 58f21a01417f273b4246c885558c252e345681b3
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:12 2025 -0800

    KVM: nVMX: Don't update msr_autostore count when saving TSC for vmcs12
    
    Rework nVMX's use of the MSR auto-store list to snapshot TSC to sneak
    MSR_IA32_TSC into the list _without_ updating KVM's software tracking,
    and drop the generic functionality so that future usage of the store list
    for nested specific logic needs to consider the implications of modifying
    the list.  Updating the list only for vmcs02 and only on nested VM-Enter
    is a disaster waiting to happen, as it means vmcs01 is stale relative to
    the software tracking, and KVM could unintentionally leave an MSR in the
    store list in perpetuity while running L1, e.g. if KVM addressed the first
    issue and updated vmcs01 on nested VM-Exit without removing TSC from the
    list.
    
    Furthermore, mixing KVM's desire to save an MSR with L1's desire to save
    an MSR result KVM clobbering/ignoring the needs of vmcs01 or vmcs02.
    E.g. if KVM added MSR_IA32_TSC to the store list for its own purposes, and
    then _removed_ MSR_IA32_TSC from the list after emulating nested VM-Enter,
    then KVM would remove MSR_IA32_TSC from the list even though saving TSC on
    VM-Exit from L2 is still desirable (to provide L1 with an accurate TSC).
    
    Similarly, removing an MSR from the list based on vmcs12's settings could
    drop an MSR that KVM wants to save for its own purposes.
    
    In practice, the issues are currently benign, because KVM doesn't use the
    store list for vmcs01.  But that will change with upcoming mediated PMU
    support.
    
    Alternatively, a "full" solution would be to track MSR list entries for
    vmcs12 separately from KVM's standard lists, but MSR_IA32_TSC is likely
    the only MSR that KVM would ever want to save on _every_ VM-Exit purely
    based on vmcs12.  I.e. the added complexity isn't remotely justified at
    this time.
    
    Opportunistically escalate from a pr_warn_ratelimited() to a full WARN as
    KVM reserves eight entries in each MSR list, and as above KVM uses at most
    one entry.
    
    Opportunistically make vmx_find_loadstore_msr_slot() local to vmx.c as
    using it directly from nested code is unsafe due to the potential for
    mixing vmcs01 and vmcs02 state (see above).
    
    Cc: Jim Mattson 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-37-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 462f092dc55c0eb97da02dd0c773a4394850dd1b
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:11 2025 -0800

    KVM: VMX: Drop intermediate "guest" field from msr_autostore
    
    Drop the intermediate "guest" field from vcpu_vmx.msr_autostore as the
    value saved on VM-Exit isn't guaranteed to be the guest's value, it's
    purely whatever is in hardware at the time of VM-Exit.  E.g. KVM's only
    use of the store list at the momemnt is to snapshot TSC at VM-Exit, and
    the value saved is always the raw TSC even if TSC-offseting and/or
    TSC-scaling is enabled for the guest.
    
    And unlike msr_autoload, there is no need differentiate between "on-entry"
    and "on-exit".
    
    No functional change intended.
    
    Cc: Jim Mattson 
    Reviewed-by: Dapeng Mi 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-36-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit b0b6a8d3be16ea742bf835407e9968378c0c753c
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:10 2025 -0800

    KVM: x86/pmu: Elide WRMSRs when loading guest PMCs if values already match
    
    When loading a mediated PMU state, elide the WRMSRs to load PMCs with the
    guest's value if the value in hardware already matches the guest's value.
    For the relatively common case where neither the guest nor the host is
    actively using the PMU, i.e. when all/many counters are '0', eliding the
    WRMSRs reduces the latency of handling VM-Exit by a measurable amount
    (WRMSR is significantly more expensive than RDPMC).
    
    As measured by KVM-Unit-Tests' CPUID VM-Exit testcase, this provides a
    a ~25% reduction in latency (4k => 3k cycles) on Intel Emerald Rapids,
    and a ~13% reduction (6.2k => 5.3k cycles) on AMD Turin.
    
    Cc: Manali Shukla 
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-35-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 860bcb1021f5234820592853d56ca12f69e9c81f
Author: Dapeng Mi 
Date:   Fri Dec 5 16:17:09 2025 -0800

    KVM: x86/pmu: Expose enable_mediated_pmu parameter to user space
    
    Expose enable_mediated_pmu parameter to user space, i.e. allow userspace
    to enable/disable mediated vPMU support.
    
    Document the mediated versus perf-based behavior as part of the
    kernel-parameters.txt entry, and opportunistically add an entry for the
    core enable_pmu param as well.
    
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Mingwei Zhang 
    Tested-by: Xudong Hao 
    Co-developed-by: Sean Christopherson 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-34-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 3b36160d9406863812883c96c1efc8bc5c04e2cc
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:08 2025 -0800

    KVM: nSVM: Disable PMU MSR interception as appropriate while running L2
    
    Add MSRs that might be passed through to L1 when running with a mediated
    PMU to the nested SVM's set of to-be-merged MSR indices, i.e. disable
    interception of PMU MSRs when running L2 if both KVM (L0) and L1 disable
    interception.  There is no need for KVM to interpose on such MSR accesses,
    e.g. if L1 exposes a mediated PMU (or equivalent) to L2.
    
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-33-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 88ebc2a3199cb5f16aff20673ed97b63a4295989
Author: Mingwei Zhang 
Date:   Fri Dec 5 16:17:07 2025 -0800

    KVM: nVMX: Disable PMU MSR interception as appropriate while running L2
    
    Merge KVM's PMU MSR interception bitmaps with those of L1, i.e. merge the
    bitmaps of vmcs01 and vmcs12, e.g. so that KVM doesn't interpose on MSR
    accesses unnecessarily if L1 exposes a mediated PMU (or equivalent) to L2.
    
    Signed-off-by: Mingwei Zhang 
    Co-developed-by: Dapeng Mi 
    Signed-off-by: Dapeng Mi 
    [sean: rewrite changelog and comment, omit MSRs that are always intercepted]
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-32-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit cb58327c4c8ad9e81d3a2f17adaf3ab57066f369
Author: Dapeng Mi 
Date:   Fri Dec 5 16:17:06 2025 -0800

    KVM: nVMX: Add macros to simplify nested MSR interception setting
    
    Add macros nested_vmx_merge_msr_bitmaps_xxx() to simplify nested MSR
    interception setting. No function change intended.
    
    Suggested-by: Sean Christopherson 
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Mingwei Zhang 
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-31-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 283a5aa57b2223abf2f73afcc714c4d4553660f2
Author: Dapeng Mi 
Date:   Fri Dec 5 16:17:05 2025 -0800

    KVM: x86/pmu: Handle emulated instruction for mediated vPMU
    
    Mediated vPMU needs to accumulate the emulated instructions into counter
    and load the counter into HW at vm-entry.
    
    Moreover, if the accumulation leads to counter overflow, KVM needs to
    update GLOBAL_STATUS and inject PMI into guest as well.
    
    Suggested-by: Sean Christopherson 
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Mingwei Zhang 
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-30-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit f7a65e58d64340c3c0e390ea4e1c4857cd451f1f
Author: Sean Christopherson 
Date:   Fri Dec 5 16:17:04 2025 -0800

    KVM: x86/pmu: Disallow emulation in the fastpath if mediated PMCs are active
    
    Don't handle exits in the fastpath if emulation is required, i.e. if an
    instruction needs to be skipped, the mediated PMU is enabled, and one or
    more PMCs is counting instructions.  With the mediated PMU, KVM's cache of
    PMU state is inconsistent with respect to hardware until KVM exits the
    inner run loop (when the mediated PMU is "put").
    
    Reviewed-by: Sandipan Das 
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-29-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 56bb2736975068cc03648718bb8e50a456ce7173
Author: Dapeng Mi 
Date:   Fri Dec 5 16:17:03 2025 -0800

    KVM: x86/pmu: Load/put mediated PMU context when entering/exiting guest
    
    Implement the PMU "world switch" between host perf and guest mediated PMU.
    When loading guest state, call into perf to switch from host to guest, and
    then load guest state into hardware, and then reverse those actions when
    putting guest state.
    
    On the KVM side, when loading guest state, zero PERF_GLOBAL_CTRL to ensure
    all counters are disabled, then load selectors and counters, and finally
    call into vendor code to load control/status information.  While VMX and
    SVM use different mechanisms to avoid counting host activity while guest
    controls are loaded, both implementations require PERF_GLOBAL_CTRL to be
    zeroed when the event selectors are in flux.
    
    When putting guest state, reverse the order, and save and zero controls
    and status prior to saving+zeroing selectors and counters.  Defer clearing
    PERF_GLOBAL_CTRL to vendor code, as only SVM needs to manually clear the
    MSR; VMX configures PERF_GLOBAL_CTRL to be atomically cleared by the CPU
    on VM-Exit.
    
    Handle the difference in MSR layouts between Intel and AMD by communicating
    the bases and stride via kvm_pmu_ops.  Because KVM requires Intel v4 (and
    full-width writes) and AMD v2, the MSRs to load/save are constant for a
    given vendor, i.e. do not vary based on the guest PMU, and do not vary
    based on host PMU (because KVM will simply disable mediated PMU support if
    the necessary MSRs are unsupported).
    
    Except for retrieving the guest's PERF_GLOBAL_CTRL, which needs to be read
    before invoking any fastpath handler (spoiler alert), perform the context
    switch around KVM's inner run loop.  State only needs to be synchronized
    from hardware before KVM can access the software "caches".
    
    Note, VMX already grabs the guest's PERF_GLOBAL_CTRL immediately after
    VM-Exit, as hardware saves value into the VMCS.
    
    Co-developed-by: Mingwei Zhang 
    Signed-off-by: Mingwei Zhang 
    Co-developed-by: Sandipan Das 
    Signed-off-by: Sandipan Das 
    Signed-off-by: Dapeng Mi 
    Tested-by: Xudong Hao 
    Co-developed-by: Sean Christopherson 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-28-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit a2f4ba534cc5d681a2d017c82e282bb32d8447df
Author: Sandipan Das 
Date:   Fri Dec 5 16:17:02 2025 -0800

    KVM: x86/pmu: Always stuff GuestOnly=1,HostOnly=0 for mediated PMCs on AMD
    
    On AMD platforms, there is no way to restore PerfCntrGlobalCtl at
    VM-Entry or clear it at VM-Exit. Since the register states will be
    restored before entering and saved after exiting guest context, the
    counters can keep ticking and even overflow leading to chaos while
    still in host context.
    
    To avoid this, intecept event selectors, which is already done by mediated
    PMU. In addition, always set the GuestOnly bit and clear the HostOnly bit
    for PMU selectors on AMD. Doing so allows the counters run only in guest
    context even if their enable bits are still set after VM exit and before
    host/guest PMU context switch.
    
    Signed-off-by: Sandipan Das 
    Signed-off-by: Mingwei Zhang 
    [sean: massage shortlog]
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-27-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 3db871fe185baca66e78b56a230e236af40f1027
Author: Dapeng Mi 
Date:   Fri Dec 5 16:17:01 2025 -0800

    KVM: x86/pmu: Reprogram mediated PMU event selectors on event filter updates
    
    Refresh the event selectors that are programmed into hardware when a PMC
    is "reprogrammed" for a mediated PMU, i.e. if userspace changes the PMU
    event filters
    
    Note, KVM doesn't utilize the reprogramming infrastructure to handle
    counter overflow for mediated PMUs, as there's no need to reprogram a
    non-existent perf event.
    
    Suggested-by: Sean Christopherson 
    Signed-off-by: Dapeng Mi 
    Co-developed-by: Mingwei Zhang 
    Signed-off-by: Mingwei Zhang 
    [sean: add a helper to document behavior, split patch and rewrite changelog]
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-26-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 02918f0077925994b04be147875b6de8b63ca249
Author: Mingwei Zhang 
Date:   Fri Dec 5 16:17:00 2025 -0800

    KVM: x86/pmu: Introduce eventsel_hw to prepare for pmu event filtering
    
    Introduce eventsel_hw and fixed_ctr_ctrl_hw to store the actual HW value in
    PMU event selector MSRs. In mediated PMU checks events before allowing the
    event values written to the PMU MSRs. However, to match the HW behavior,
    when PMU event checks fails, KVM should allow guest to read the value back.
    
    This essentially requires an extra variable to separate the guest requested
    value from actual PMU MSR value. Note this only applies to event selectors.
    
    Signed-off-by: Mingwei Zhang 
    Co-developed-by: Dapeng Mi 
    Signed-off-by: Dapeng Mi 
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-25-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 0ea0d6314870493ac723afefb6257be71f4c636f
Author: Dapeng Mi 
Date:   Fri Dec 5 16:16:59 2025 -0800

    KVM: x86/pmu: Bypass perf checks when emulating mediated PMU counter accesses
    
    When emulating a PMC counter read or write for a mediated PMU, bypass the
    perf checks and emulated_counter logic as the counters aren't proxied
    through perf, i.e. pmc->counter always holds the guest's up-to-date value,
    and thus there's no need to defer emulated overflow checks.
    
    Suggested-by: Sean Christopherson 
    Signed-off-by: Dapeng Mi 
    Co-developed-by: Mingwei Zhang 
    Signed-off-by: Mingwei Zhang 
    [sean: split from event filtering change, write shortlog+changelog]
    Reviewed-by: Sandipan Das 
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-24-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 2904df6692f429853cf99b4b47c8592b2f49edaa
Author: Dapeng Mi 
Date:   Fri Dec 5 16:16:58 2025 -0800

    KVM: x86/pmu: Disable interception of select PMU MSRs for mediated vPMUs
    
    For vCPUs with a mediated vPMU, disable interception of counter MSRs for
    PMCs that are exposed to the guest, and for GLOBAL_CTRL and related MSRs
    if they are fully supported according to the vCPU model, i.e. if the MSRs
    and all bits supported by hardware exist from the guest's point of view.
    
    Do NOT passthrough event selector or fixed counter control MSRs, so that
    KVM can enforce userspace-defined event filters, e.g. to prevent use of
    AnyThread events (which is unfortunately a setting in the fixed counter
    control MSR).
    
    Defer support for nested passthrough of mediated PMU MSRs to the future,
    as the logic for nested MSR interception is unfortunately vendor specific.
    
    Suggested-by: Sean Christopherson 
    Co-developed-by: Mingwei Zhang 
    Signed-off-by: Mingwei Zhang 
    Co-developed-by: Sandipan Das 
    Signed-off-by: Sandipan Das 
    Signed-off-by: Dapeng Mi 
    [sean: squash patches, massage changelog, refresh VMX MSRs on filter change]
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-23-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit d3ba32d1ff2a206621475325c009ab5b51882de1
Author: Dapeng Mi 
Date:   Fri Dec 5 16:16:57 2025 -0800

    KVM: x86/pmu: Load/save GLOBAL_CTRL via entry/exit fields for mediated PMU
    
    When running a guest with a mediated PMU, context switch PERF_GLOBAL_CTRL
    via the dedicated VMCS fields for both host and guest.  For the host,
    always zero GLOBAL_CTRL on exit as the guest's state will still be loaded
    in hardware (KVM will context switch the bulk of PMU state outside of the
    inner run loop).  For the guest, use the dedicated fields to atomically
    load and save PERF_GLOBAL_CTRL on all entry/exits.
    
    For now, require VM_EXIT_SAVE_IA32_PERF_GLOBAL_CTRL support (introduced by
    Sapphire Rapids).  KVM can support such CPUs by saving PERF_GLOBAL_CTRL
    via the MSR save list, a.k.a. the MSR auto-store list, but defer that
    support as it adds a small amount of complexity and is somewhat unique.
    
    To minimize VM-Entry latency, propagate IA32_PERF_GLOBAL_CTRL to the VMCS
    on-demand.  But to minimize complexity, read IA32_PERF_GLOBAL_CTRL out of
    the VMCS on all non-failing VM-Exits.  I.e. partially cache the MSR.
    KVM could track GLOBAL_CTRL as an EXREG and defer all reads, but writes
    are rare, i.e. the dirty tracking for an EXREG is unnecessary, and it's
    not obvious that shaving ~15-20 cycles per exit is meaningful given the
    total overhead associated with mediated PMU context switches.
    
    Suggested-by: Sean Christopherson 
    Signed-off-by: Dapeng Mi 
    Co-developed-by: Mingwei Zhang 
    Signed-off-by: Mingwei Zhang 
    Tested-by: Xudong Hao 
    Co-developed-by: Sean Christopherson 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-22-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 80624272129eacc10cecb30f004cfa611be04770
Author: Dapeng Mi 
Date:   Fri Dec 5 16:16:56 2025 -0800

    KVM: x86/pmu: Disable RDPMC interception for compatible mediated vPMU
    
    Disable RDPMC interception for vCPUs with a mediated vPMU that is
    compatible with the host PMU, i.e. that doesn't require KVM emulation of
    RDPMC to honor the guest's vCPU model.  With a mediated vPMU, all guest
    state accessible via RDPMC is loaded into hardware while the guest is
    running.
    
    Adust RDPMC interception only for non-TDX guests, as the TDX module is
    responsible for managing RDPMC intercepts based on the TD configuration.
    
    Co-developed-by: Mingwei Zhang 
    Signed-off-by: Mingwei Zhang 
    Co-developed-by: Sandipan Das 
    Signed-off-by: Sandipan Das 
    Signed-off-by: Dapeng Mi 
    Tested-by: Xudong Hao 
    Co-developed-by: Sean Christopherson 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-21-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 1c4ba7286afba9842f295fc7a3dbe74acc6a92af
Author: Xiong Zhang 
Date:   Fri Dec 5 16:16:55 2025 -0800

    KVM: x86/pmu: Register PMI handler for mediated vPMU
    
    Register a dedicated PMI handler with perf's callback when mediated PMU
    support is enabled.  Perf routes PMIs that arrive while guest context is
    loaded to the provided callback, by modifying the CPU's LVTPC to point at
    a dedicated mediated PMI IRQ vector.
    
    WARN upon receipt of a mediated PMI if there is no active vCPU, or if the
    vCPU doesn't have a mediated PMU.  Even if a PMI manages to skid past
    VM-Exit, it should never be delayed all the way beyond unloading the vCPU.
    And while running vCPUs without a mediated PMU, the LVTPC should never be
    wired up to the mediated PMI IRQ vector, i.e. should always be routed
    through perf's NMI handler.
    
    Signed-off-by: Xiong Zhang 
    Signed-off-by: Mingwei Zhang 
    Tested-by: Xudong Hao 
    Co-developed-by: Sean Christopherson 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-20-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 9ba0bb4ae76a8ee037257499165a4370306c0eac
Author: Sean Christopherson 
Date:   Fri Dec 5 16:16:54 2025 -0800

    KVM: x86/pmu: Implement AMD mediated PMU requirements
    
    Require host PMU version 2+ for AMD mediated PMU support, as
    PERF_GLOBAL_CTRL and friends are hard requirements for the mediated PMU.
    
    Signed-off-by: Dapeng Mi 
    Co-developed-by: Mingwei Zhang 
    Signed-off-by: Mingwei Zhang 
    [sean: extract to separate patch, write changelog]
    Reviewed-by: Sandipan Das 
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-19-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit bfee4f07d88038f7e662652718e21c60b62ef3a1
Author: Dapeng Mi 
Date:   Fri Dec 5 16:16:53 2025 -0800

    KVM: x86/pmu: Implement Intel mediated PMU requirements and constraints
    
    Implement Intel PMU requirements and constraints for mediated PMU support.
    Require host PMU version 4+ so that PERF_GLOBAL_STATUS_SET can be used to
    precisely load the guest's status value into hardware, and require full-
    width writes so that KVM can precisely load guest counter values.
    
    Disable PEBS and LBRs if mediated PMU support is enabled, as they won't be
    supported in the initial implementation.
    
    Signed-off-by: Dapeng Mi 
    Co-developed-by: Mingwei Zhang 
    Signed-off-by: Mingwei Zhang 
    [sean: split to separate patch, add full-width writes dependency]
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-18-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 3e51822b2fdf695bda50c2c3f88d6ab022a9e6f3
Author: Dapeng Mi 
Date:   Fri Dec 5 16:16:52 2025 -0800

    KVM: x86/pmu: Start stubbing in mediated PMU support
    
    Introduce enable_mediated_pmu as a global variable, with the intent of
    exposing it to userspace a vendor module parameter, to control and reflect
    mediated vPMU support.  Wire up the perf plumbing to create+release a
    mediated PMU, but defer exposing the parameter to userspace until KVM
    support for a mediated PMUs is fully landed.
    
    To (a) minimize compatibility issues, (b) to give userspace a chance to
    opt out of the restrictive side-effects of perf_create_mediated_pmu(),
    and (c) to avoid adding new dependencies between enabling an in-kernel
    irqchip and a mediated vPMU, defer "creating" a mediated PMU in perf
    until the first vCPU is created.
    
    Regarding userspace compatibility, an alternative solution would be to
    make the mediated PMU fully opt-in, e.g. to avoid unexpected failure due
    to perf_create_mediated_pmu() failing.  Ironically, that approach creates
    an even bigger compatibility issue, as turning on enable_mediated_pmu
    would silently break VMMs that don't utilize KVM_CAP_PMU_CAPABILITY (well,
    silently until the guest tried to access PMU assets).
    
    Regarding an in-kernel irqchip, create a mediated PMU if and only if the
    VM has an in-kernel local APIC, as the mediated PMU will take a hard
    dependency on forwarding PMIs to the guest without bouncing through host
    userspace.  Silently "drop" the PMU instead of rejecting KVM_CREATE_VCPU,
    as KVM's existing vPMU support doesn't function correctly if the local
    APIC is emulated by userspace, e.g. PMIs will never be delivered.  I.e.
    it's far, far more likely that rejecting KVM_CREATE_VCPU would cause
    problems, e.g. for tests or userspace daemons that just want to probe
    basic KVM functionality.
    
    Note!  Deliberately make mediated PMU creation "sticky", i.e. don't unwind
    it on failure to create a vCPU.  Practically speaking, there's no harm to
    having a VM with a mediated PMU and no vCPUs.  To avoid an "impossible" VM
    setup, reject KVM_CAP_PMU_CAPABILITY if a mediated PMU has been created,
    i.e. don't let userspace disable PMU support after failed vCPU creation
    (with PMU support enabled).
    
    Defer vendor specific requirements and constraints to the future.
    
    Suggested-by: Sean Christopherson 
    Signed-off-by: Dapeng Mi 
    Co-developed-by: Mingwei Zhang 
    Signed-off-by: Mingwei Zhang 
    Tested-by: Xudong Hao 
    Co-developed-by: Sean Christopherson 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-17-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 4b24910c056995c0c0fa7c1b142696443b05fd8e
Author: Sean Christopherson 
Date:   Fri Dec 5 16:16:50 2025 -0800

    KVM: Add a simplified wrapper for registering perf callbacks
    
    Add a parameter-less API for registering perf callbacks in anticipation of
    introducing another x86-only parameter for handling mediated PMU PMIs.
    
    No functional change intended.
    
    Acked-by: Anup Patel 
    Tested-by: Xudong Hao 
    Tested-by: Manali Shukla 
    Link: https://patch.msgid.link/20251206001720.468579-15-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 59ba823e689f832f389ea6af6e7ae5842b3c860a
Merge: 76de4e1594b7df f2a3b12b305c7b
Author: Jakub Kicinski 
Date:   Thu Jan 8 11:37:07 2026 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
    
    Cross-merge networking fixes after downstream PR (net-6.19-rc5).
    
    No conflicts, or adjacent changes.
    
    Signed-off-by: Jakub Kicinski 

commit ec27500c8f2b65a3be6ce39a5844d6d246d1b2b0
Author: Chaoyi Chen 
Date:   Thu Nov 6 10:06:32 2025 +0800

    drm/rockchip: vop: Add support for rk3506
    
    The VOP on rk3506:
    - Support 2 lane MIPI DSI interface, 1.5Gbps/lane.
    - Support RGB interface.
    - Max output resolution is 1280x1280@60fps.
    - WIN1 layer support RGB888/ARGB8888/RGB565.
    - Support Gamma LUT.
    
    Signed-off-by: Chaoyi Chen 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251106020632.92-10-kernel@airkyi.com

commit cabeacc7eadc2d0033a2fc7304dfb900f9a32095
Author: Chaoyi Chen 
Date:   Thu Nov 6 10:06:30 2025 +0800

    drm/rockchip: dsi: Add support for rk3506
    
    The dsi controller found on RK3506 supports up to 2 lanes.
    
    Signed-off-by: Hongming Zou 
    Signed-off-by: Chaoyi Chen 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251106020632.92-8-kernel@airkyi.com

commit 7919273e495b9154cc7e5f7713f002290f4d9597
Author: Chaoyi Chen 
Date:   Thu Nov 6 10:06:27 2025 +0800

    dt-bindings: display: rockchip,vop: Add compatible for rk3506
    
    The rk3506 VOP has adopted a new implementation.
    Add a new compatible string for it.
    
    Signed-off-by: Chaoyi Chen 
    Acked-by: Conor Dooley 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251106020632.92-5-kernel@airkyi.com

commit 3af0f4d5d433921fa399bbe6396221c8a9985869
Author: Chaoyi Chen 
Date:   Thu Nov 6 10:06:26 2025 +0800

    dt-bindings: display: rockchip,dw-mipi-dsi: Add compatible for rk3506
    
    Document a compatible string for the rk3506 mipi-dsi.
    
    Signed-off-by: Chaoyi Chen 
    Acked-by: Conor Dooley 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251106020632.92-4-kernel@airkyi.com

commit 28c2490458ca935b2d793ec0e6c22265855255a2
Author: Daniel Stone 
Date:   Mon Dec 15 15:09:24 2025 +0100

    drm/rockchip: vop2: Simplify format_mod_supported
    
    Make it a little less convoluted, and just directly check if the
    combination of plane + format + modifier is supported.
    
    Signed-off-by: Daniel Stone 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251215-vop2-atomic-fixups-v5-8-83463c075a8d@collabora.com

commit c8c85c0a7fc2a545749da1ab8dc866de025c2314
Author: Daniel Stone 
Date:   Mon Dec 15 15:09:23 2025 +0100

    drm/rockchip: vop2: Use drm_is_afbc helper function
    
    We don't need to do a long open-coded walk here; we can simply check the
    modifier value.
    
    Signed-off-by: Daniel Stone 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251215-vop2-atomic-fixups-v5-7-83463c075a8d@collabora.com

commit 081676de4a22341a877ce81c4d5364737d167859
Author: Daniel Stone 
Date:   Mon Dec 15 15:09:22 2025 +0100

    drm/rockchip: vop2: Enforce AFBC transform stride align in plane_check
    
    Make sure we can't break the hardware by requesting an unsupported
    configuration.
    
    Signed-off-by: Daniel Stone 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251215-vop2-atomic-fixups-v5-6-83463c075a8d@collabora.com

commit 8cdd4d858d7aaeb583ae2b4e5a0378936b18f0f0
Author: Daniel Stone 
Date:   Mon Dec 15 15:09:21 2025 +0100

    drm/rockchip: vop2: Enforce AFBC source alignment in plane_check
    
    Planes can only source AFBC framebuffers at multiples of 4px wide on
    RK3566/RK3568. Instead of clipping on all SoCs when the user asks for an
    unaligned source rectangle, reject the configuration in the plane's
    atomic check on RK3566/RK3568 only.
    
    Signed-off-by: Daniel Stone 
    [Make RK3566/RK3568 specific, reword message, s/byte/pixel/]
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251215-vop2-atomic-fixups-v5-5-83463c075a8d@collabora.com

commit dfb673c71fc0039a6495731d0c0fcefa8a97541d
Author: Daniel Stone 
Date:   Mon Dec 15 15:09:20 2025 +0100

    drm/rockchip: vop2: Enforce scaling workaround in plane_check
    
    It seems only cluster windows are capable of applying downscaling when
    the source region has an odd width. Instead of applying a workaround
    inside atomic_update, fail the plane check if this is requested.
    
    Signed-off-by: Daniel Stone 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251215-vop2-atomic-fixups-v5-4-83463c075a8d@collabora.com

commit f403945d240417761d404cb1ce8fa2c1ec02daf5
Author: Daniel Stone 
Date:   Mon Dec 15 15:09:19 2025 +0100

    drm/rockchip: vop2: Fix Esmart test condition
    
    If we want to find out if a window is Esmart or not, test for not being
    a cluster window, rather than AFBDC presence.
    
    No functional effect as only cluster windows support AFBC decode.
    
    Signed-off-by: Daniel Stone 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251215-vop2-atomic-fixups-v5-3-83463c075a8d@collabora.com

commit 2f4e3f2bef45d1eb4d8204c5f204cf274e8a6ca6
Author: Daniel Stone 
Date:   Mon Dec 15 15:09:18 2025 +0100

    drm/rockchip: vop2: Switch impossible pos conditional to WARN_ON
    
    We already clip the plane to the display bounds in atomic_check, and
    ensure that it is sufficiently sized. Instead of trying to catch this
    and adjust for it in atomic_update, just assert that atomic_check has
    done its job.
    
    Signed-off-by: Daniel Stone 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251215-vop2-atomic-fixups-v5-2-83463c075a8d@collabora.com

commit 78de5d28d7207f816565fa43ec44e6735c319ddf
Author: Daniel Stone 
Date:   Mon Dec 15 15:09:17 2025 +0100

    drm/rockchip: vop2: Switch impossible format conditional to WARN_ON
    
    We should never be able to create a framebuffer with an unsupported
    format, so throw a warning if this ever happens.
    
    Signed-off-by: Daniel Stone 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251215-vop2-atomic-fixups-v5-1-83463c075a8d@collabora.com

commit ff8071eb3aa54e96336ecce7c88b25f9a4d62383
Author: Sean Christopherson 
Date:   Fri Nov 21 14:20:18 2025 -0800

    KVM: VMX: Always reflect SGX EPCM #PFs back into the guest
    
    When handling intercepted #PFs, reflect EPCM (Enclave Page Cache Map)
    violations, i.e. #PFs with the SGX flag set, back into the guest.  KVM
    doesn't shadow EPCM entries (the EPCM deals only with virtual/linear
    addresses), and so EPCM violation cannot be due to KVM interference,
    and more importantly can't be resolved by KVM.
    
    On pre-SGX2 hardware, EPCM violations are delivered as #GP(0) faults, but
    on SGX2+ hardware, they are delivered as #PF(SGX).  Failure to account for
    the SGX2 behavior could put a vCPU into an infinite loop due to KVM not
    realizing the #PF is the guest's responsibility.
    
    Take care to deliver the EPCM violation as a #GP(0) if the _guest_ CPU
    model is only SGX1.
    
    Fixes: 72add915fbd5 ("KVM: VMX: Enable SGX virtualization for SGX1, SGX2 and LC")
    Cc: Kai Huang 
    Reviewed-by: Richard Lyu 
    Reviewed-by: Kai Huang 
    Link: https://patch.msgid.link/20251121222018.348987-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 0b28194c4c8e3a6c2552bfa6451f71b1879dd61f
Author: Maciej S. Szmigiero 
Date:   Fri Dec 5 14:49:37 2025 -0800

    KVM: selftests: Test TPR / CR8 sync and interrupt masking
    
    Add a few extra TPR / CR8 tests to x86's xapic_state_test to see if:
      * TPR is 0 on reset,
      * TPR, PPR and CR8 are equal inside the guest,
      * TPR and CR8 read equal by the host after a VMExit
      * TPR borderline values set by the host correctly mask interrupts in the
        guest.
    
    These hopefully will catch the most obvious cases of improper TPR sync or
    interrupt masking.
    
    Do these tests both in x2APIC and xAPIC modes.
    The x2APIC mode uses SELF_IPI register to trigger interrupts to give it a
    bit of exercise too.
    
    Signed-off-by: Maciej S. Szmigiero 
    Acked-by: Naveen N Rao (AMD) 
    [sean: put code in separate test]
    Link: https://patch.msgid.link/20251205224937.428122-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit da142f3d373a6ddaca0119615a8db2175ddc4121
Author: Sean Christopherson 
Date:   Fri Dec 5 15:26:55 2025 -0800

    KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
    
    Remove KVM's internal pseudo-overlay of kvm_stats_desc, which subtly
    aliases the flexible name[] in the uAPI definition with a fixed-size array
    of the same name.  The unusual embedded structure results in compiler
    warnings due to -Wflex-array-member-not-at-end, and also necessitates an
    extra level of dereferencing in KVM.  To avoid the "overlay", define the
    uAPI structure to have a fixed-size name when building for the kernel.
    
    Opportunistically clean up the indentation for the stats macros, and
    replace spaces with tabs.
    
    No functional change intended.
    
    Reported-by: Gustavo A. R. Silva 
    Closes: https://lore.kernel.org/all/aPfNKRpLfhmhYqfP@kspp
    Acked-by: Marc Zyngier 
    Acked-by: Christian Borntraeger 
    [..]
    Acked-by: Anup Patel 
    Reviewed-by: Bibo Mao 
    Acked-by: Gustavo A. R. Silva 
    Link: https://patch.msgid.link/20251205232655.445294-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit f1eac46fe5f7d4569681a648440d0f416a50c476
Author: Lizhi Hou 
Date:   Thu Dec 18 17:43:56 2025 -0800

    accel/amdxdna: Update firmware version check for latest firmware
    
    The latest firmware increases the major version number. Update
    aie2_check_protocol() to accept and support the new firmware version.
    
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251219014356.2234241-2-lizhi.hou@amd.com

commit 1222e06934bd6ffa8fe7da0342412f864f6dbddf
Author: Lizhi Hou 
Date:   Thu Dec 18 17:43:55 2025 -0800

    accel/amdxdna: Update message DMA buffer allocation
    
    The latest firmware requires the message DMA buffer to
      - have a minimum size of 8K
      - use a power-of-two size
      - be aligned to the buffer size
      - not cross 64M boundary
    
    Update the buffer allocation logic to meet these requirements and support
    the latest firmware.
    
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251219014356.2234241-1-lizhi.hou@amd.com

commit 87a6c3c03d46d78719672332ffad00f520231dbc
Author: Stanimir Varbanov 
Date:   Fri Oct 31 20:33:09 2025 +0200

    arm64: dts: broadcom: bcm2712: Add watchdog DT node
    
    Add watchdog device-tree node for bcm2712 SoC.
    
    Signed-off-by: Stanimir Varbanov 
    Link: https://lore.kernel.org/r/20251031183309.1163384-5-svarbanov@suse.de
    Signed-off-by: Florian Fainelli 

commit 05f790b3d2359a1e2dcfd157268492e63ae41845
Author: Peter Robinson 
Date:   Sat Sep 27 08:56:31 2025 +0100

    arm64: dts: broadcom: bcm2712: Enable RNG
    
    The RNG is the same IP as in the bcm2711 so add the
    device tree block to enable the device.
    
    Signed-off-by: Peter Robinson 
    Reviewed-by: Stefan Wahren 
    Link: https://lore.kernel.org/r/20250927075643.716179-1-pbrobinson@gmail.com
    Signed-off-by: Florian Fainelli 

commit 929dc5b3e06c54f1d19b01c93042174d0e741b99
Author: Rob Herring (Arm) 
Date:   Tue Jan 6 20:09:40 2026 -0600

    ARM: dts: broadcom: bcm2711: Fix 'simple-bus' node names
    
    Fix 'simple-bus' node names to follow the defined pattern. Nodes with 'reg'
    or 'ranges' addresses should also have a unit-address.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://lore.kernel.org/r/20260106-dt-dtbs-broadcom-fixes-v1-1-ba45874e4553@kernel.org
    Signed-off-by: Florian Fainelli 

commit 0cd9bf6a6d9a1861087236cc5c275b3bea83cfdd
Author: Claudiu Beznea 
Date:   Thu Jan 8 17:44:19 2026 +0200

    ASoC: codecs: da7213: Move comma operator at the end of the line
    
    Move the comma operator to the end of the line to comply with the
    coding style.
    
    Signed-off-by: Claudiu Beznea 
    Link: https://patch.msgid.link/20260108154419.3580562-1-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Mark Brown 

commit adca0ad92717d4752ad520faa667103eafb66195
Author: Alice Ryhl 
Date:   Thu Jan 8 16:07:33 2026 +0000

    drm/gpuvm: use const for drm_gpuva_op_* ptrs
    
    These methods just read the values stored in the op pointers without
    modifying them, so it is appropriate to use const ptrs here.
    
    This allows us to avoid const -> mut pointer casts in Rust.
    
    Reviewed-by: Boris Brezillon 
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20260108-gpuvm-rust-v2-3-dbd014005a0b@google.com
    Signed-off-by: Danilo Krummrich 

commit 9bf4ca1e699c272defe9636f9812ff33a448d650
Author: Alice Ryhl 
Date:   Thu Jan 8 16:07:32 2026 +0000

    drm/gpuvm: drm_gpuvm_bo_obtain() requires lock and staged mode
    
    In commit 9ce4aef9a5b1 ("drm/gpuvm: take GEM lock inside
    drm_gpuvm_bo_obtain_prealloc()") we update
    drm_gpuvm_bo_obtain_prealloc() to take locks internally, which means
    that it's only usable in immediate mode.
    
    In this commit, we notice that drm_gpuvm_bo_obtain() requires you to use
    staged mode. This means that we now have one variant of obtain for each
    mode you might use gpuvm in.
    
    To reflect this information, we add a warning about using it in
    immediate mode, and to make the distinction clearer we rename the method
    with a _locked() suffix so that it's clear that it requires the caller
    to take the locks.
    
    Reviewed-by: Boris Brezillon 
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20260108-gpuvm-rust-v2-2-dbd014005a0b@google.com
    [ Slightly reword commit message to refer to commit 9ce4aef9a5b1
      ("drm/gpuvm: take GEM lock inside drm_gpuvm_bo_obtain_prealloc()").
      - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab
Author: Mario Limonciello (AMD) 
Date:   Wed Jan 7 15:37:28 2026 -0600

    drm/amd: Clean up kfd node on surprise disconnect
    
    When an eGPU is unplugged the KFD topology should also be destroyed
    for that GPU. This never happens because the fini_sw callbacks never
    get to run. Run them manually before calling amdgpu_device_ip_fini_early()
    when a device has already been disconnected.
    
    This location is intentionally chosen to make sure that the kfd locking
    refcount doesn't get incremented unintentionally.
    
    Cc: kent.russell@amd.com
    Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Kent Russell 
    Signed-off-by: Alex Deucher 

commit 17de472698fd5e5d1e7dbd3360434dc7b763e671
Author: Mukesh Ogare 
Date:   Sun Dec 21 02:47:55 2025 +0800

    drm/radeon: convert UVD v1.0 logging to drm_* helpers
    
    Replace legacy DRM_ERROR()/DRM_INFO() logging in the UVD v1.0 code
    with drm_err() and drm_info() helpers that take a struct drm_device.
    
    Using drm_* logging provides proper device context in dmesg, which is
    important for systems with multiple DRM devices, and aligns the radeon
    driver with current DRM logging practices.
    
    No functional change intended.
    
    Reviewed-by: Christian König 
    Signed-off-by: Mukesh Ogare 
    Signed-off-by: Alex Deucher 

commit 5e3f50fda28f8c2912110a4a597021eb05762356
Author: Hawking Zhang 
Date:   Sun Jan 4 22:37:56 2026 +0800

    drm/amdgpu: Extend psp_skip_tmr for bare-metal and sriov
    
    In SRIOV, guest drivers no longer setup/destory
    VMR starting from mp0 v11_0_7.
    
    In bare-metal, if boot-time TMR is enabled, some
    generation (e.g., mp0 v13_0_x) don’t need runtime
    TMR allocation but still require SETUP_TMR command
    with tmr address 0 for backward compatibility.
    some newer generations require neither SETUP_TMR nor
    DESTROY_TMR and will return errors if they are sent.
    Driver relies on boot_time_tmr and autoload_supported
    to handle these cases correctly.
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 698fa62f56aa3600efcfb11dd04f84e938dfc5fa
Author: Philip Yang 
Date:   Tue Dec 9 18:15:23 2025 -0500

    drm/amdgpu: Add helper to alloc GART entries
    
    Add helper amdgpu_gtt_mgr_alloc/free_entries, define
    GART_ENTRY_WITHOUT_BO_COLOR color for GART node not allocated with GTT
    bo, then amdgpu_gtt_mgr_recover skip those mm_node.
    
    Signed-off-by: Philip Yang 
    Reviewed-by: Christian König 
    Reviewed-by: Pierre-Eric Pelloux-Prayer 
    Signed-off-by: Alex Deucher 

commit ec9243d1b4f59ae5365add0f52fac7af2e4c18ce
Author: Lijo Lazar 
Date:   Fri Dec 12 13:56:47 2025 +0530

    drm/amd/pm: Return right size for gpuboard metrics
    
    Change to switch style checks and return the correct size for gpu board
    metrics.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit c812460e69d8448bbf504bdb95d8dbd19f30d5d7
Author: Ben Dooks 
Date:   Fri Jan 2 14:16:29 2026 +0000

    drm/radeon: fix signed v unsigned print formats
    
    Fix several places where %ld or %d has been used in place of
    %lu or %u.
    
    Signed-off-by: Ben Dooks 
    Signed-off-by: Alex Deucher 

commit 2f2a72de673513247cd6fae14e53f6c40c5841ef
Author: Lu Yao 
Date:   Tue Jan 6 10:37:12 2026 +0800

    drm/amdgpu: fix drm panic null pointer when driver not support atomic
    
    When driver not support atomic, fb using plane->fb rather than
    plane->state->fb.
    
    Fixes: fe151ed7af54 ("drm/amdgpu: add generic display panic helper code")
    Signed-off-by: Lu Yao 
    Signed-off-by: Alex Deucher 

commit c7fc0f372374cf463be2ba4b5b21c20c3c051bb6
Author: Pratik Vishwakarma 
Date:   Fri Dec 5 14:12:03 2025 -0500

    drm/amd: Enable SMU 15_0_0 support
    
    Add SMU 15_0_0
    
    v2: rebase (Alex)
    v3: fix clang build (Alex)
    
    Signed-off-by: Pratik Vishwakarma 
    Signed-off-by: Alex Deucher 

commit a68654bfb75cbb9ae878f81877e393b2fd8181ff
Author: Pratik Vishwakarma 
Date:   Fri Dec 5 14:07:26 2025 -0500

    drm/amd: Enable SMU 15_0_0 firmware headers
    
    Add SMU 15_0_0 firmware headers
    
    v2: squash in updates (Alex)
    
    Signed-off-by: Pratik Vishwakarma 
    Signed-off-by: Alex Deucher 

commit 52cd9bc47fdd1cc1a83fcdbca2df6baf2c4226d5
Author: Pratik Vishwakarma 
Date:   Fri Dec 5 14:05:07 2025 -0500

    drm/amd: Enable SMUIO 15_0_0 support
    
    Add SMUIO 15_0_0.
    
    Signed-off-by: Pratik Vishwakarma 
    Signed-off-by: Alex Deucher 

commit 65653210edf35c2472f5c4963b028f67c73e80ae
Author: Alex Deucher 
Date:   Fri Dec 5 10:58:52 2025 -0500

    drm/amdgpu: Add THM 15.0.0 headers
    
    Add headers for THM 15.0.0.
    
    v2: squash in updates (Alex)
    
    Signed-off-by: Alex Deucher 

commit 29f560a5238d6b9170ef9b63b5718e760eec4b24
Author: Alex Deucher 
Date:   Fri Dec 5 10:57:29 2025 -0500

    drm/amdgpu: add SMUIO 15.0.0 headers
    
    Add headers for SMUIO 15.0.0.
    
    v2: squash in updates (Alex)
    
    Signed-off-by: Alex Deucher 

commit fc1366016abe4103c0f0fac882811aea961ef213
Author: Philip Yang 
Date:   Thu Dec 4 12:13:05 2025 -0500

    drm/amdgpu: Fix gfx9 update PTE mtype flag
    
    Fix copy&paste error, that should have been an assignment instead of an or,
    otherwise MTYPE_UC 0x3 can not be updated to MTYPE_RW 0x1.
    
    Signed-off-by: Philip Yang 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 0c0dd10062bd31b3814c169e06e376c28ca42c95
Author: Lijo Lazar 
Date:   Tue Dec 2 15:30:21 2025 +0530

    drm/amd/pm: Use driver table for board temperature
    
    GPU board and Baseboard temperatures come from system metrics table.
    Driver keeps separate metrics table for both. Use the new driver table
    structure to represent them.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 34d65997489fe3485dd698025ea32b8aa74f0af4
Author: Lijo Lazar 
Date:   Tue Dec 2 14:33:28 2025 +0530

    drm/amd/pm: Use cached gpu metrics table
    
    If cached gpu metrics table is available, return it directly. Also,
    deprecate gpu_metrics_table variables as they are no longer used.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 618c144145ad3e409c2c0fa13a0efef1a9473d37
Author: Lijo Lazar 
Date:   Tue Dec 2 14:00:42 2025 +0530

    drm/amd/pm: Use driver table structure in smuv14
    
    Use driver table structure for gpu metrics in smuv14. The default cache
    interval is set at 5ms.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit e3e4f03f256f5a1534174c5453ae98d9f508fb6f
Author: Lijo Lazar 
Date:   Tue Dec 2 13:33:04 2025 +0530

    drm/amd/pm: Use driver table structure in smuv13
    
    Use driver table structure for gpu metrics in smuv13. The default cache
    interval is set at 5ms.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit f8e8d7da251a73d584f87899cb92a27a56f2848d
Author: Lijo Lazar 
Date:   Tue Dec 2 13:25:26 2025 +0530

    drm/amd/pm: Use driver table structure in smuv12
    
    Use driver table structure for gpu metrics in smuv12. The default cache
    interval is set at 5ms.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit d1010ca49b4f59b91cd64903e67b9547bdd2fa42
Author: Lijo Lazar 
Date:   Tue Dec 2 13:20:25 2025 +0530

    drm/amd/pm: Use driver table structure in smuv11
    
    Use driver table structure for gpu metrics in smuv11. The default cache
    interval is set at 5ms.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 76de4e1594b7dfacba549e9db60585811f45dbe5
Merge: fd1de45ad24f24 36775f3d5f7076
Author: Jakub Kicinski 
Date:   Thu Jan 8 08:15:07 2026 -0800

    Merge branch 'net-discard-pm_runtime_put-return-value'
    
    Rafael J. Wysocki says:
    
    ====================
    net: Discard pm_runtime_put() return value
    
    This is mostly was a resend of patches [10-12/23] from:
    
    https://lore.kernel.org/linux-pm/6245770.lOV4Wx5bFT@rafael.j.wysocki/
    
    as requested by Jakub, except for the last patch that has been fixed
    while at it and so the version has been bumped up.
    
    The patches are independent of each other and they are all requisite
    for converting pm_runtime_put() into a void function.
    ====================
    
    Link: https://patch.msgid.link/2816529.mvXUDI8C0e@rafael.j.wysocki
    Signed-off-by: Jakub Kicinski 

commit 36775f3d5f7076e55b01b1f493a02cd467fa2c0d
Author: Rafael J. Wysocki 
Date:   Wed Jan 7 13:37:17 2026 +0100

    net: wan: framer: Discard pm_runtime_put() return values
    
    The framer driver defines framer_pm_runtime_put() to return an int,
    but that return value is never used.  It also passes the return value
    of pm_runtime_put() to the caller which is not very useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.
    
    Modify phy_pm_runtime_put() to discard the pm_runtime_put() return
    value and change its return type to void.
    
    No intentional functional impact.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3027916.e9J7NaK4W3@rafael.j.wysocki
    Signed-off-by: Jakub Kicinski 

commit 46786f66f2cc757a4c4787c731111372b96a847d
Author: Rafael J. Wysocki 
Date:   Wed Jan 7 13:35:58 2026 +0100

    net: cadence: macb: Discard pm_runtime_put() return value
    
    Passing pm_runtime_put() return value to the callers is not particularly
    useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.  It also happens when the kernel is
    configured with CONFIG_PM unset.
    
    Accordingly, update at91ether_close() to simply discard the return
    value of pm_runtime_put() and always return success to the caller.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Acked-by: Nicolas Ferre 
    Link: https://patch.msgid.link/2252292.irdbgypaU6@rafael.j.wysocki
    Signed-off-by: Jakub Kicinski 

commit 6961aa43654b7231ef8e1ed91cbf1da98d20ec1e
Author: Rafael J. Wysocki 
Date:   Wed Jan 7 13:34:02 2026 +0100

    net: ethernet: ti: am65-cpsw: Discard pm_runtime_put() return value
    
    Printing error messages on pm_runtime_put() returning negative values
    is not particularly useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.
    
    Accordingly, update am65_cpsw_ethtool_op_begin() and cpsw_ethtool_op_begin()
    to simply discard the return value of pm_runtime_put().
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/5042490.GXAFRqVoOG@rafael.j.wysocki
    Signed-off-by: Jakub Kicinski 

commit 8236fc613d44e59f6736d6c3e9efffaf26ab7f00
Author: Shuai Xue 
Date:   Wed Dec 10 21:29:07 2025 +0800

    Documentation: tracing: Add PCI tracepoint documentation
    
    The PCI tracing system provides tracepoints to monitor critical hardware
    events that can impact system performance and reliability. Add
    documentation about it.
    
    Signed-off-by: Shuai Xue 
    [bhelgaas: squash fixes:
    https://lore.kernel.org/r/20260108013956.14351-2-bagasdotme@gmail.com
    https://lore.kernel.org/r/20260108013956.14351-3-bagasdotme@gmail.com]
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Ilpo Järvinen 
    Link: https://patch.msgid.link/20251210132907.58799-4-xueshuai@linux.alibaba.com

commit cb500023a75246f60b79af9f7321d6e75330c5b5
Author: Hou Tao 
Date:   Sat Dec 20 12:04:35 2025 +0800

    PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning condition
    
    Commit b7e282378773 has already changed the initial page refcount of
    p2pdma page from one to zero, however, in p2pmem_alloc_mmap() it uses
    "VM_WARN_ON_ONCE_PAGE(!page_ref_count(page))" to assert the initial page
    refcount should not be zero and the following will be reported when
    CONFIG_DEBUG_VM is enabled:
    
      page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x380400000
      flags: 0x20000000002000(reserved|node=0|zone=4)
      raw: 0020000000002000 ff1100015e3ab440 0000000000000000 0000000000000000
      raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
      page dumped because: VM_WARN_ON_ONCE_PAGE(!page_ref_count(page))
      ------------[ cut here ]------------
      WARNING: CPU: 5 PID: 449 at drivers/pci/p2pdma.c:240 p2pmem_alloc_mmap+0x83a/0xa60
    
    Fix by using "page_ref_count(page)" as the assertion condition.
    
    Fixes: b7e282378773 ("mm/mm_init: move p2pdma page refcount initialisation to p2pdma")
    Signed-off-by: Hou Tao 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Logan Gunthorpe 
    Reviewed-by: Alistair Popple 
    Link: https://patch.msgid.link/20251220040446.274991-3-houtao@huaweicloud.com

commit 256d3e55d8ce91eb0b22f7101c02e446cd3dd8f1
Author: Patrice Chotard 
Date:   Thu Nov 13 16:13:52 2025 +0100

    ARM: dts: stm32: reorder nodes for stm32429i-eval
    
    Reorder nodes by alphabetical order.
    
    Signed-off-by: Patrice Chotard 
    Link: https://lore.kernel.org/r/20251113-upstream_update_led_nodes-v2-1-45090db9e2e5@foss.st.com
    Signed-off-by: Alexandre Torgue 

commit 6220694c52a5a04102b48109e4f24e958b559bd3
Author: Hou Tao 
Date:   Sat Dec 20 12:04:34 2025 +0800

    PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
    
    When vm_insert_page() fails in p2pmem_alloc_mmap(), p2pmem_alloc_mmap()
    doesn't invoke percpu_ref_put() to free the per-CPU ref of pgmap acquired
    after gen_pool_alloc_owner(), and memunmap_pages() will hang forever when
    trying to remove the PCI device.
    
    Fix it by adding the missed percpu_ref_put().
    
    Fixes: 7e9c7ef83d78 ("PCI/P2PDMA: Allow userspace VMA allocations through sysfs")
    Signed-off-by: Hou Tao 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Logan Gunthorpe 
    Reviewed-by: Alistair Popple 
    Link: https://patch.msgid.link/20251220040446.274991-2-houtao@huaweicloud.com

commit d08fda2cf2e68b4e0865f1bf0b49010db74da079
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 18:28:28 2025 -0500

    virtio_input: use virtqueue_add_inbuf_cache_clean for events
    
    The evts array contains 64 small (8-byte) input events that share
    cachelines with each other. When CONFIG_DMA_API_DEBUG is enabled,
    this can trigger warnings about overlapping DMA mappings within
    the same cacheline.
    
    Previous patch isolated the array in its own cachelines,
    so the warnings are now spurious.
    
    Use virtqueue_add_inbuf_cache_clean() to indicate that the CPU does not
    write into these cache lines, suppressing these warnings.
    
    Message-ID: <4c885b4046323f68cf5cadc7fbfb00216b11dd20.1767601130.git.mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin 

commit bd2b617c49820a38cefcf512c6d56d30deb59aa9
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 18:27:21 2025 -0500

    virtio-rng: fix DMA alignment for data buffer
    
    The data buffer in struct virtrng_info is used for DMA_FROM_DEVICE via
    virtqueue_add_inbuf() and shares cachelines with the adjacent
    CPU-written fields (data_avail, data_idx).
    
    The device writing to the DMA buffer and the CPU writing to adjacent
    fields could corrupt each other's data on non-cache-coherent platforms.
    
    Add __dma_from_device_group_begin()/end() annotations to place these
    in distinct cache lines.
    
    Message-ID: <157a63b6324d1f1307ddd4faa3b62a8b90a79423.1767601130.git.mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin 

commit 2678369e8efe0c5ac71adb49fbc2c240a222e44d
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 18:25:16 2025 -0500

    virtio_scsi: fix DMA cacheline issues for events
    
    Current struct virtio_scsi_event_node layout has two problems:
    
    The event (DMA_FROM_DEVICE) and work (CPU-written via
    INIT_WORK/queue_work) fields share a cacheline.
    On non-cache-coherent platforms, CPU writes to work can
    corrupt device-written event data.
    
    If ARCH_DMA_MINALIGN is large enough, the 8 events in event_list share
    cachelines, triggering CONFIG_DMA_API_DEBUG warnings.
    
    Fix the corruption by moving event buffers to a separate array and
    aligning using __dma_from_device_group_begin()/end().
    
    Suppress the (now spurious) DMA debug warnings using
    virtqueue_add_inbuf_cache_clean().
    
    Message-ID: <8801aeef7576a155299f19b6887682dd3a272aba.1767601130.git.mst@redhat.com>
    Reviewed-by: Stefan Hajnoczi 
    Signed-off-by: Michael S. Tsirkin 

commit 95c7b0ad6c69d1c0608ff0bbd358a546856beaf3
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 18:24:36 2025 -0500

    virtio_input: fix DMA alignment for evts
    
    On non-cache-coherent platforms, when a structure contains a buffer
    used for DMA alongside fields that the CPU writes to, cacheline sharing
    can cause data corruption.
    
    The evts array is used for DMA_FROM_DEVICE operations via
    virtqueue_add_inbuf(). The adjacent lock and ready fields are written
    by the CPU during normal operation. If these share cachelines with evts,
    CPU writes can corrupt DMA data.
    
    Add __dma_from_device_group_begin()/end() annotations to ensure evts is
    isolated in its own cachelines.
    
    Message-ID: 
    Signed-off-by: Michael S. Tsirkin 

commit db191ba0c8564ff84877e5b1c9553e991feca239
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 18:27:54 2025 -0500

    vsock/virtio: use virtqueue_add_inbuf_cache_clean for events
    
    The event_list array contains 8 small (4-byte) events that share
    cachelines with each other. When CONFIG_DMA_API_DEBUG is enabled,
    this can trigger warnings about overlapping DMA mappings within
    the same cacheline.
    
    The previous patch isolated event_list in its own cache lines
    so the warnings are spurious.
    
    Use virtqueue_add_inbuf_cache_clean() to indicate that the CPU does not
    write into these fields, suppressing the warnings.
    
    Reported-by: Cong Wang 
    Message-ID: <4b5bf63a7ebb782d87f643466b3669df567c9fe1.1767601130.git.mst@redhat.com>
    Acked-by: Stefano Garzarella 
    Signed-off-by: Michael S. Tsirkin 

commit 63dfad0517f0418a5192024fad934be79c2f5902
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 18:23:53 2025 -0500

    vsock/virtio: fix DMA alignment for event_list
    
    On non-cache-coherent platforms, when a structure contains a buffer
    used for DMA alongside fields that the CPU writes to, cacheline sharing
    can cause data corruption.
    
    The event_list array is used for DMA_FROM_DEVICE operations via
    virtqueue_add_inbuf(). The adjacent event_run and guest_cid fields are
    written by the CPU while the buffer is available, so mapped for the
    device. If these share cachelines with event_list, CPU writes can
    corrupt DMA data.
    
    Add __dma_from_device_group_begin()/end() annotations to ensure event_list
    is isolated in its own cachelines.
    
    Message-ID: 
    Acked-by: Stefano Garzarella 
    Signed-off-by: Michael S. Tsirkin 

commit 88dcab0650fd31072ed07a0d26fce5bbbbd8e7a1
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:59:58 2025 +0100

    drm/imagination: Discard pm_runtime_put() return value
    
    The Imagination DRM driver defines pvr_power_put() to pass the return
    value of pm_runtime_put() to the caller, but then it never uses the
    return value of pvr_power_put().
    
    Modify pvr_power_put() to discard the pm_runtime_put() return value and
    change its return type to void.
    
    No intentional functional impact.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Matt Coster 
    Link: https://patch.msgid.link/8642685.T7Z3S40VBb@rafael.j.wysocki

commit 1ade6a4f7f09d5d6f6fc449e6bfa92b5e2d063c2
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:52:33 2025 +0100

    USB: core: Discard pm_runtime_put() return value
    
    To allow the return type of pm_runtime_put() to be changed to void in the
    future, modify usb_autopm_put_interface_async() to discard the return
    value of pm_runtime_put().
    
    That value is merely used in a debug comment printed by the function in
    question and it is not a particularly useful piece of information
    because pm_runtime_put() does not guarantee that the device will be
    suspended even if it successfully queues up a work item to check
    whether or not the device can be suspended.
    
    Signed-off-by: Rafael J. Wysocki 
    Acked-by: Alan Stern 
    Acked-by: Greg Kroah-Hartman 
    Link: https://patch.msgid.link/5058509.GXAFRqVoOG@rafael.j.wysocki

commit 8bf65ec41901ff6b2958576ba4896589d89f6404
Merge: b47ce586300b3c b7e26c8bdae708
Author: Takashi Iwai 
Date:   Thu Jan 8 14:07:33 2026 +0100

    Merge branch 'for-linus' into for-next
    
    Pull 6.19-devel branch.
    
    Signed-off-by: Takashi Iwai 

commit d66676e6ca96bf8680f869a9bd6573b26c634622
Author: Szymon Wilczek 
Date:   Sun Dec 21 16:58:06 2025 +0100

    wifi: libertas: fix WARNING in usb_tx_block
    
    The function usb_tx_block() submits cardp->tx_urb without ensuring that
    any previous transmission on this URB has completed. If a second call
    occurs while the URB is still active (e.g. during rapid firmware loading),
    usb_submit_urb() detects the active state and triggers a warning:
    'URB submitted while active'.
    
    Fix this by enforcing serialization: call usb_kill_urb() before
    submitting the new request. This ensures the URB is idle and safe to reuse.
    
    Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
    Signed-off-by: Szymon Wilczek 
    Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
    Signed-off-by: Johannes Berg 

commit 7bab5bdb81e33cd0bc0aa848931ff47940ad54b0
Author: Chen-Yu Tsai 
Date:   Wed Jan 7 17:27:40 2026 +0800

    wifi: mwifiex: Allocate dev name earlier for interface workqueue name
    
    The interface specific workqueues are allocated with the interface name
    as part of the workqueue name. However when they are allocated, the
    interface name has not been allocated, thus the "name" is actually the
    pattern for the name "mlan%d". This ends up pretty ugly and could
    conflict if multiple interfaces were added.
    
    Allocate the device name earlier and use that to allocate the
    workqueues. Also tweak the workqueue name patterns to add a separator
    between the prefix and the interface name parts for readability.
    
    Signed-off-by: Chen-Yu Tsai 
    Link: https://patch.msgid.link/20260107092744.1131314-1-wenst@chromium.org
    Signed-off-by: Johannes Berg 

commit fe96ff075f960abb9dd1c99c4c4e7f79c4e10172
Author: Gary Bisson 
Date:   Wed Dec 3 22:20:41 2025 +0100

    arm64: dts: mediatek: add device tree for Tungsten 700 board
    
    Add device tree to support Ezurio Tungsten 700 (MT8390) SMARC SOM [1] +
    Universal SMARC carrier board [2].
    It includes support for the MIPI-DSI BD070LIC3 display which uses the
    Tianma TM070JDHG30 panel + TI SN65DSI84 MIPI-DSI to LVDS bridge [3].
    
    [1] https://www.ezurio.com/product/tungsten700-smarc
    [2] https://www.ezurio.com/system-on-module/accessories/universal-smarc-carrier
    [3] https://www.ezurio.com/product/bd070lic3-7-touchscreen-display
    
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Gary Bisson 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 9fda4a8a479f030a2a267b1823ffe0687aea8fd4
Author: Gary Bisson 
Date:   Wed Dec 3 22:20:40 2025 +0100

    arm64: dts: mediatek: add device tree for Tungsten 510 board
    
    Add device tree to support Ezurio Tungsten 510 (MT8370) SMARC SOM [1] +
    Universal SMARC carrier board [2].
    It includes support for the MIPI-DSI BD070LIC3 display which uses the
    Tianma TM070JDHG30 panel + TI SN65DSI84 MIPI-DSI to LVDS bridge [3].
    
    [1] https://www.ezurio.com/product/tungsten510-smarc
    [2] https://www.ezurio.com/system-on-module/accessories/universal-smarc-carrier
    [3] https://www.ezurio.com/product/bd070lic3-7-touchscreen-display
    
    Signed-off-by: Gary Bisson 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 18e1d95faeaca2e1b3887d2c44fe44b8bb2f123c
Author: Gary Bisson 
Date:   Wed Dec 3 22:20:39 2025 +0100

    arm64: dts: mediatek: mt8188: switch mmc nodes to interrupts-extended
    
    No functional change but will allow other dts including this one to
    override the interrupts, for eint support for instance, without having
    to delete the 'interrupts' property.
    
    Signed-off-by: Gary Bisson 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 07a4700f95745671e8f257d56db6aaf244350111
Author: Gary Bisson 
Date:   Wed Dec 3 22:20:38 2025 +0100

    dt-bindings: arm: mediatek: Add Ezurio Tungsten entries
    
    Add device tree bindings support for the Ezurio Tungsten 510 (MT8370)
    SMARC [1] / Ezurio Tungsten 700 (MT8390) SMARC [2] + Universal SMARC
    carrier board [3].
    
    [1] https://www.ezurio.com/product/tungsten510-smarc
    [2] https://www.ezurio.com/product/tungsten700-smarc
    [3] https://www.ezurio.com/system-on-module/accessories/universal-smarc-carrier
    
    Acked-by: Krzysztof Kozlowski 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Gary Bisson 
    Signed-off-by: AngeloGioacchino Del Regno 

commit a7a53f7482f96f88d6ab2064828f6f6bdb93c43e
Author: Gary Bisson 
Date:   Wed Dec 3 22:20:37 2025 +0100

    dt-bindings: vendor-prefixes: Add Ezurio LLC
    
    Ezurio is the new name of Laird Connectivity after it acquired Boundary
    Devices.
    
    Acked-by: Krzysztof Kozlowski 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Gary Bisson 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 7fe8a313e4646ae4c5cb6a6e46b78bf5c9166066
Author: Louis-Alexis Eyraud 
Date:   Wed Dec 17 11:19:10 2025 +0100

    arm64: dts: mediatek: mt8395-genio-common: Add HDMI sound output support
    
    Add in the sound node a new dai-link for ETDM3_OUT_BE to add the sound
    output support through the HDMI TX connector.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Signed-off-by: AngeloGioacchino Del Regno 

commit e1480453aed83e2b0d2e52a0e439c56bd4c3a4c4
Author: Louis-Alexis Eyraud 
Date:   Wed Dec 17 11:19:09 2025 +0100

    arm64: dts: mediatek: mt8395-genio-common: Enable HDMI output
    
    Add a definition for the on-board HDMI connector, enable and add
    the relevant configuration for the HDMI PHY and controller, and
    define the pins used by those.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 0ddfd2f29ae229fb67b710677e7d7004e685d733
Author: Louis-Alexis Eyraud 
Date:   Wed Dec 17 11:19:08 2025 +0100

    arm64: dts: mediatek: mt8395-radxa-nio-12l: Add HDMI sound output support
    
    Add in the sound node a new dai-link for ETDM3_OUT_BE to add the sound
    output support through the HDMI TX connector.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 19a385bd460e97b216c82603c01081f7b5c9e4ef
Author: AngeloGioacchino Del Regno 
Date:   Wed Dec 17 11:19:07 2025 +0100

    arm64: dts: mediatek: mt8395-radxa-nio-12l: Enable HDMI output
    
    Add a definition for the on-board HDMI connector, enable and add
    the relevant configuration for the HDMI PHY and controller, and
    define the pins used by those.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 0ad0f933fc0dad5a51996533d3cdb11a24c83e00
Author: Louis-Alexis Eyraud 
Date:   Wed Dec 17 11:19:06 2025 +0100

    arm64: dts: mediatek: mt8390-genio-common: Add HDMI sound output support
    
    Add in the sound node a new dai-link for ETDM3_OUT_BE to add the sound
    output support through the HDMI connector.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Signed-off-by: AngeloGioacchino Del Regno 

commit ae9198b7a5d64e01632cd450d4408f162f88c3be
Author: AngeloGioacchino Del Regno 
Date:   Wed Dec 17 11:19:05 2025 +0100

    arm64: dts: mediatek: mt8390-genio-common: Enable HDMI output
    
    Add a node for the HDMI-A connector found on this board, then
    configure the display pipeline and enable the required DPI1
    interface, HDMI controller, its integrated DDC and the HDMI
    PHY to enable support for the HDMI output provided by these EVKs.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 5875428ac6c7d687f9a51aef7c8665310f06be64
Author: AngeloGioacchino Del Regno 
Date:   Wed Dec 17 11:19:04 2025 +0100

    arm64: dts: mediatek: mt8188: Add DPI1, HDMI, HDMI PHY/DDC nodes
    
    Add all of the nodes that are required to enable HDMI output,
    including ones describing the HDMI PHY, Controller and DDC,
    and the Digital Parallel Interface instance that is internally
    connected to the HDMI Controller.
    
    All of the added nodes are disabled by default as usage is
    board dependent.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 6c90d33aedd355732062cc96d03fe4adb7609e8b
Author: AngeloGioacchino Del Regno 
Date:   Wed Dec 17 11:19:03 2025 +0100

    arm64: dts: mediatek: mt8195: Add DPI1, HDMI, HDMI PHY/DDC nodes
    
    Add all of the nodes that are required to enable HDMI output,
    including ones describing the HDMI PHY, Controller and DDC,
    and the Digital Parallel Interface instance that is internally
    connected to the HDMI Controller.
    
    All of the added nodes are disabled by default as usage is
    board dependent.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 6fd69ff487c6a4cb3f45e53684937975cb1b67c1
Author: Sjoerd Simons 
Date:   Tue Dec 23 13:37:58 2025 +0100

    arm64: dts: mediatek: mt7981b-openwrt-one: Enable wifi
    
    Enable Dual-band WiFI 6 functionality on the Openwrt One
    
    Signed-off-by: Sjoerd Simons 
    Signed-off-by: AngeloGioacchino Del Regno 

commit c0379b6fa1645401c46a22845bb34d5498a3d1b5
Author: Sjoerd Simons 
Date:   Tue Dec 23 13:37:57 2025 +0100

    arm64: dts: mediatek: mt7981b: Add wifi memory region
    
    Add required memory region for the builtin wifi block.
    
    Signed-off-by: Sjoerd Simons 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 46757ad083ce9a88ea157fe8b2b8f57d4db1801d
Author: Sjoerd Simons 
Date:   Tue Dec 23 13:37:56 2025 +0100

    arm64: dts: mediatek: mt7981b: Disable wifi by default
    
    Disable the wifi block by default as it won't function properly without
    at least pin muxing.
    
    This doesn't enable wifi on any of the existing mt7981b devices as a
    required memory-region property is missing, causing the driver to fail
    probing anyway.
    
    Signed-off-by: Sjoerd Simons 
    Signed-off-by: AngeloGioacchino Del Regno 

commit ecc68d72b50d17241ec9d44dca11633589bd0049
Author: Sjoerd Simons 
Date:   Tue Dec 23 13:37:55 2025 +0100

    arm64: dts: mediatek: mt7981b-openwrt-one: Enable Ethernet
    
    Enable the Ethernet subsystem on OpenWrt One board with dual-MAC
    configuration:
    - GMAC0: Connected to external Airoha EN8811H 2.5GbE PHY via SGMII
      (2500base-x mode) for WAN connectivity with LED indicators
    - GMAC1: Connected to internal MT7981 1GbE PHY (GMII mode) for LAN
    
    Ethernet aliases are defined to provide consistent network interface
    naming (ethernet0 = LAN, ethernet1 = WAN).
    
    Signed-off-by: Sjoerd Simons 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 9846a8c6031855ed9be45b4cc538c2b80965f816
Author: Sjoerd Simons 
Date:   Tue Dec 23 13:37:54 2025 +0100

    arm64: dts: mediatek: mt7981b: Add Ethernet and WiFi offload support
    
    Add device tree nodes for the Ethernet subsystem on MT7981B SoC,
    including:
    - Ethernet MAC controller with dual GMAC support
    - Wireless Ethernet Dispatch (WED)
    - SGMII PHY controllers for high-speed Ethernet interfaces
    - Reserved memory regions for WiFi offload processor
    
    Signed-off-by: Sjoerd Simons 
    [Angelo: Removed useless address/size cells from main eth node]
    Signed-off-by: AngeloGioacchino Del Regno 

commit 4ea5bebe17bad6b1991fa632f2121062066b6dcc
Merge: c874f5fef05365 631ee338f04db7
Author: Johannes Berg 
Date:   Thu Jan 8 13:30:50 2026 +0100

    Merge tag 'ath-next-20260105' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath
    
    Jeff Johnson says:
    ==================
    ath.git patches for v6.20
    
    Propagate the "Next Generation" of the ath12k driver to wireless-next.
    
    NOTE TO MAINTAINERS:
    There is a conflict between this tree and the MHI tree. This conflict
    has already been resolved by Stephen Rothwell in linux-next. Please
    refer to his resolution comments in:
    
    https://lore.kernel.org/all/20260105154243.7cd5d049@canb.auug.org.au/
    ==================
    
    Link: https://patch.msgid.link/4ba3aecf-5194-48e3-a112-31da3a8646aa@oss.qualcomm.com/
    Signed-off-by: Johannes Berg 

commit c874f5fef053652586d2ffa9b4796d021f5c619a
Author: Uwe Kleine-König 
Date:   Wed Dec 17 12:20:34 2025 +0100

    wifi: wlcore: sdio: Use pm_ptr instead of #ifdef CONFIG_PM
    
    This increases build coverage and removes two ugly #ifdefs.
    
    Signed-off-by: Uwe Kleine-König 
    Link: https://patch.msgid.link/20251217112033.3309281-4-u.kleine-koenig@baylibre.com
    Signed-off-by: Johannes Berg 

commit 815a8d2feb5615ae7f0b5befd206af0b0160614c
Author: Narayana Murty N 
Date:   Wed Dec 10 08:25:59 2025 -0600

    powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling
    
    The recent commit 1010b4c012b0 ("powerpc/eeh: Make EEH driver device
    hotplug safe") restructured the EEH driver to improve synchronization
    with the PCI hotplug layer.
    
    However, it inadvertently moved pci_lock_rescan_remove() outside its
    intended scope in eeh_handle_normal_event(), leading to broken PCI
    error reporting and improper EEH event triggering. Specifically,
    eeh_handle_normal_event() acquired pci_lock_rescan_remove() before
    calling eeh_pe_bus_get(), but eeh_pe_bus_get() itself attempts to
    acquire the same lock internally, causing nested locking and disrupting
    normal EEH event handling paths.
    
    This patch adds a boolean parameter do_lock to _eeh_pe_bus_get(),
    with two public wrappers:
        eeh_pe_bus_get() with locking enabled.
        eeh_pe_bus_get_nolock() that skips locking.
    
    Callers that already hold pci_lock_rescan_remove() now use
    eeh_pe_bus_get_nolock() to avoid recursive lock acquisition.
    
    Additionally, pci_lock_rescan_remove() calls are restored to the correct
    position—after eeh_pe_bus_get() and immediately before iterating affected
    PEs and devices. This ensures EEH-triggered PCI removes occur under proper
    bus rescan locking without recursive lock contention.
    
    The eeh_pe_loc_get() function has been split into two functions:
        eeh_pe_loc_get(struct eeh_pe *pe) which retrieves the loc for given PE.
        eeh_pe_loc_get_bus(struct pci_bus *bus) which retrieves the location
        code for given bus.
    
    This resolves lockdep warnings such as:
    
    [   84.964298] [    T928] ============================================
    [   84.964304] [    T928] WARNING: possible recursive locking detected
    [   84.964311] [    T928] 6.18.0-rc3 #51 Not tainted
    [   84.964315] [    T928] --------------------------------------------
    [   84.964320] [    T928] eehd/928 is trying to acquire lock:
    [   84.964324] [    T928] c000000003b29d58 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_lock_rescan_remove+0x28/0x40
    [   84.964342] [    T928]
                           but task is already holding lock:
    [   84.964347] [    T928] c000000003b29d58 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_lock_rescan_remove+0x28/0x40
    [   84.964357] [    T928]
                           other info that might help us debug this:
    [   84.964363] [    T928]  Possible unsafe locking scenario:
    
    [   84.964367] [    T928]        CPU0
    [   84.964370] [    T928]        ----
    [   84.964373] [    T928]   lock(pci_rescan_remove_lock);
    [   84.964378] [    T928]   lock(pci_rescan_remove_lock);
    [   84.964383] [    T928]
                           *** DEADLOCK ***
    
    [   84.964388] [    T928]  May be due to missing lock nesting notation
    
    [   84.964393] [    T928] 1 lock held by eehd/928:
    [   84.964397] [    T928]  #0: c000000003b29d58 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_lock_rescan_remove+0x28/0x40
    [   84.964408] [    T928]
                           stack backtrace:
    [   84.964414] [    T928] CPU: 2 UID: 0 PID: 928 Comm: eehd Not tainted 6.18.0-rc3 #51 VOLUNTARY
    [   84.964417] [    T928] Hardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_022) hv:phyp pSeries
    [   84.964419] [    T928] Call Trace:
    [   84.964420] [    T928] [c0000011a7157990] [c000000001705de4] dump_stack_lvl+0xc8/0x130 (unreliable)
    [   84.964424] [    T928] [c0000011a71579d0] [c0000000002f66e0] print_deadlock_bug+0x430/0x440
    [   84.964428] [    T928] [c0000011a7157a70] [c0000000002fd0c0] __lock_acquire+0x1530/0x2d80
    [   84.964431] [    T928] [c0000011a7157ba0] [c0000000002fea54] lock_acquire+0x144/0x410
    [   84.964433] [    T928] [c0000011a7157cb0] [c0000011a7157cb0] __mutex_lock+0xf4/0x1050
    [   84.964436] [    T928] [c0000011a7157e00] [c000000000de21d8] pci_lock_rescan_remove+0x28/0x40
    [   84.964439] [    T928] [c0000011a7157e20] [c00000000004ed98] eeh_pe_bus_get+0x48/0xc0
    [   84.964442] [    T928] [c0000011a7157e50] [c000000000050434] eeh_handle_normal_event+0x64/0xa60
    [   84.964446] [    T928] [c0000011a7157f30] [c000000000051de8] eeh_event_handler+0xf8/0x190
    [   84.964450] [    T928] [c0000011a7157f90] [c0000000002747ac] kthread+0x16c/0x180
    [   84.964453] [    T928] [c0000011a7157fe0] [c00000000000ded8] start_kernel_thread+0x14/0x18
    
    
    Fixes: 1010b4c012b0 ("powerpc/eeh: Make EEH driver device hotplug safe")
    Signed-off-by: Narayana Murty N 
    Reviewed-by: Sourabh Jain 
    Reviewed-by: Mahesh Salgaonkar 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/20251210142559.8874-1-nnmlinux@linux.ibm.com

commit c0215e2d72debcd9cbc1c002fb012d50a3140387
Author: Nam Cao 
Date:   Wed Jan 7 10:02:30 2026 +0000

    powerpc/pseries: Fix MSI-X allocation failure when quota is exceeded
    
    Nilay reported that since commit daaa574aba6f ("powerpc/pseries/msi: Switch
    to msi_create_parent_irq_domain()"), the NVMe driver cannot enable MSI-X
    when the device's MSI-X table size is larger than the firmware's MSI quota
    for the device.
    
    This is because the commit changes how rtas_prepare_msi_irqs() is called:
    
      - Before, it is called when interrupts are allocated at the global
        interrupt domain with nvec_in being the number of allocated interrupts.
        rtas_prepare_msi_irqs() can return a positive number and the allocation
        will be retried.
    
      - Now, it is called at the creation of per-device interrupt domain with
        nvec_in being the number of interrupts that the device supports. If
        rtas_prepare_msi_irqs() returns positive, domain creation just fails.
    
    For Nilay's NVMe driver case, rtas_prepare_msi_irqs() returns a positive
    number (the quota). This causes per-device interrupt domain creation to
    fail and thus the NVMe driver cannot enable MSI-X.
    
    Rework to make this scenario works again:
    
      - pseries_msi_ops_prepare() only prepares as many interrupts as the quota
        permit.
    
      - pseries_irq_domain_alloc() fails if the device's quota is exceeded.
    
    Now, if the quota is exceeded, pseries_msi_ops_prepare() will only prepare
    as allowed by the quota. If device drivers attempt to allocate more
    interrupts than the quota permits, pseries_irq_domain_alloc() will return
    an error code and msi_handle_pci_fail() will allow device drivers a retry.
    
    Reported-by: Nilay Shroff 
    Closes: https://lore.kernel.org/linuxppc-dev/6af2c4c2-97f6-4758-be33-256638ef39e5@linux.ibm.com/
    Fixes: daaa574aba6f ("powerpc/pseries/msi: Switch to msi_create_parent_irq_domain()")
    Signed-off-by: Nam Cao 
    Cc: stable@vger.kernel.org
    Tested-by: Nilay Shroff 
    Acked-by: Nilay Shroff 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/20260107100230.1466093-1-namcao@linutronix.de

commit 4073ea516106e5f98ed0476f89cdede8baa98d37
Author: Huang Chenming 
Date:   Tue Dec 9 08:27:33 2025 +0530

    wifi: cfg80211: Fix use_for flag update on BSS refresh
    
    Userspace may fail to connect to certain BSS that were initially
    marked as unusable due to regulatory restrictions (use_for = 0,
    e.g., 6 GHz power type mismatch). Even after these restrictions
    are removed and the BSS becomes usable, connection attempts still
    fail.
    
    The issue occurs in cfg80211_update_known_bss() where the use_for
    flag is updated using bitwise AND (&=) instead of direct assignment.
    Once a BSS is marked with use_for = 0, the AND operation masks out
    any subsequent non-zero values, permanently keeping the flag at 0.
    This causes __cfg80211_get_bss(), invoked by nl80211_assoc_bss(), to
    fail the check "(bss->pub.use_for & use_for) != use_for", thereby
    blocking association.
    
    Replace the bitwise AND operation with direct assignment so the use_for
    flag accurately reflects the current BSS state.
    
    Fixes: d02a12b8e4bb ("wifi: cfg80211: add BSS usage reporting")
    Signed-off-by: Huang Chenming 
    Link: https://patch.msgid.link/20251209025733.2098456-1-chenming.huang@oss.qualcomm.com
    Signed-off-by: Johannes Berg 

commit 2e985cfac7e502dc2769b1730985635df7dc86be
Author: Rafał Miłecki 
Date:   Mon Dec 15 11:38:17 2025 +0100

    wifi: brcmfmac: rename function that frees vif
    
    Since the commit cf124db566e6 ("net: Fix inconsistent teardown and
    release of private netdev state.") netdev isn't freed anymore in the
    brcmf_cfg80211_free_netdev(). Adjust this function name to match what it
    actually does (freeing vif).
    
    Signed-off-by: Rafał Miłecki 
    Acked-by: Arend van Spriel 
    Link: https://patch.msgid.link/20251215103817.29598-1-zajec5@gmail.com
    Signed-off-by: Johannes Berg 

commit 4ea4a3d9a22b5429d979f3e3f9870afd97826b17
Author: Randy Dunlap 
Date:   Fri Nov 28 23:38:03 2025 -0800

    wifi: brcmfmac: fix/add kernel-doc comments
    
    Correct or add kernel-doc comments for:
    - an enum name typo
    - missing struct member comments in struct vif_saved_ie and
      struct brcmf_cfg80211_vif
    
    fixing these warnings:
    Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:195
     Enum value 'BRCMF_VIF_STATUS_EAP_SUCCESS' not described in enum
     'brcmf_vif_status'
    Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:195
     Excess enum value '@BRCMF_VIF_STATUS_EAP_SUCCUSS' description in
     'brcmf_vif_status'
    Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:220
     struct member 'assoc_req_ie' not described in 'vif_saved_ie'
    Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:220
     struct member 'assoc_req_ie_len' not described in 'vif_saved_ie'
    Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:255
     struct member 'saved_ie' not described in 'brcmf_cfg80211_vif'
    Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:255
     struct member 'is_11d' not described in 'brcmf_cfg80211_vif'
    
    kernel-doc warnings for missing struct member descriptions in struct
    brcmf_cfg80211_info and struct brcmf_cfg80211_profile are still present.
    
    Signed-off-by: Randy Dunlap 
    Acked-by: Arend van Spriel 
    Link: https://patch.msgid.link/20251129073803.1814384-1-rdunlap@infradead.org
    Signed-off-by: Johannes Berg 

commit fd1de45ad24f24cf0aedee0f64e668674a9bd6c9
Merge: 957346a6877b54 d8489935f5979b
Author: Paolo Abeni 
Date:   Thu Jan 8 13:18:27 2026 +0100

    Merge branch 'net-phy-realtek-various-improvements-for-2-5ge-phys'
    
    Daniel Golle says:
    
    ====================
    net: phy: realtek: various improvements for 2.5GE PHYs
    
    This series improves the RealTek PHY driver, mostly for 2.5GE PHYs.
    It implements configuring SGMII and 2500Base-X in-band auto-negotiation
    and improves using the PHYs in Clause-22-only mode.
    
    Note that the rtl822x_serdes_write() function introduced by this series
    is going to be reused to configure polarities of SerDes RX and TX lanes
    once series "PHY polarity inversion via generic device tree properties"
    has been applied.
    
    Access to other registers on MDIO_MMD_VEND2 is important for more than
    just configuring autonegotiation, it is also used to setup ALDPS or to
    disable the PHY responding to the MDIO broadcast address 0. Both will be
    implemented by follow-up patches.
    
    The address translation function for registers on MDIO_MMD_VEND2 into
    paged registers can potentially also be used to describe other paged
    access in a more consistent way, but that mostly makes sense on PHYs
    which also support Clause-45, so this series doesn't convert all the
    existing paged access on RealTek's 1GE PHYs which do not support
    Clause-45.
    ====================
    
    Link: https://patch.msgid.link/cover.1767630451.git.daniel@makrotopia.org
    Signed-off-by: Paolo Abeni 

commit d8489935f5979b72e73de585037fe6fde7088bc3
Author: Daniel Golle 
Date:   Mon Jan 5 16:39:26 2026 +0000

    net: phy: realtek: get rid of magic number in rtlgen_read_status()
    
    Use newly introduced helper macros RTL822X_VND2_TO_PAGE and
    RTL822X_VND2_TO_PAGE_REG to access RTL_VEND2_PHYSR register over Clause-22
    paged access instead of using magic numbers.
    
    Signed-off-by: Daniel Golle 
    Reviewed-by: Maxime Chevallier 
    Link: https://patch.msgid.link/a53d4577335fdda4d363db9bc4bf614fd3a56c9b.1767630451.git.daniel@makrotopia.org
    Signed-off-by: Paolo Abeni 

commit 1850ec20d6e71218c02329e5975591075dc972d3
Author: Daniel Golle 
Date:   Mon Jan 5 16:38:59 2026 +0000

    net: phy: realtek: use paged access for MDIO_MMD_VEND2 in C22 mode
    
    RTL822x cannot access MDIO_MMD_VEND2 via MII_MMD_CTRL/MII_MMD_DATA. A
    mapping to use paged access needs to be used instead. All other MMD
    devices can be accessed as usual.
    
    Implement phy_read_mmd and phy_write_mmd using paged access for
    MDIO_MMD_VEND2 in Clause-22 mode instead of relying on
    MII_MMD_CTRL/MII_MMD_DATA. This allows eg. rtl822x_config_aneg to work
    as expected in case the MDIO bus doesn't support Clause-45 access.
    
    Suggested-by: Bevan Weiss 
    Signed-off-by: Daniel Golle 
    Reviewed-by: Maxime Chevallier 
    Link: https://patch.msgid.link/25aab7f02dac7c6022171455523e3db1435b0881.1767630451.git.daniel@makrotopia.org
    Signed-off-by: Paolo Abeni 

commit 65de36f5eae1c540115bf8f705f853718e9b6451
Author: Daniel Golle 
Date:   Mon Jan 5 16:38:29 2026 +0000

    net: phy: move mmd_phy_read and mmd_phy_write to phylib.h
    
    Helper functions mmd_phy_read and mmd_phy_write are useful for PHYs
    which require custom MMD access functions for some but not all MMDs.
    Move mmd_phy_read and mmd_phy_write function prototypes from
    phylib-internal.h to phylib.h to make them available for PHY drivers.
    
    Signed-off-by: Daniel Golle 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/79169cd624a3572d426e42c7b13cd2654a35d0cb.1767630451.git.daniel@makrotopia.org
    Signed-off-by: Paolo Abeni 

commit 10fbd71fc5f9bef5018a35103d493307683ddca1
Author: Daniel Golle 
Date:   Mon Jan 5 16:38:12 2026 +0000

    net: phy: realtek: implement configuring in-band an
    
    Implement the inband_caps() and config_inband() PHY driver methods to
    allow configuring the use of in-band-status with SGMII and 2500Base-X on
    RTL8226 and RTL8221B 2.5GE PHYs.
    
    Signed-off-by: Daniel Golle 
    Link: https://patch.msgid.link/82a78a06d67be19e856d646cf880b2021ea9d837.1767630451.git.daniel@makrotopia.org
    Signed-off-by: Paolo Abeni 

commit 50326b48f0cfbd9324668c5d2e08b39b59dc199f
Author: Daniel Golle 
Date:   Mon Jan 5 16:37:54 2026 +0000

    net: phy: realtek: fix whitespace in struct phy_driver initializers
    
    Consistently use tabs instead of spaces in struct phy_driver
    initializers.
    
    Signed-off-by: Daniel Golle 
    Reviewed-by: Maxime Chevallier 
    Link: https://patch.msgid.link/42b0fac53c5c5646707ce3f3a6dacd2bc082a5b2.1767630451.git.daniel@makrotopia.org
    Signed-off-by: Paolo Abeni 

commit bfcc957b6a6d992b4b4f6d9c2d66aabf1912b555
Author: Aditya Kumar Singh 
Date:   Thu Nov 27 15:41:24 2025 +0530

    wifi: mac80211: Update csa_finalize to use link_id
    
    With cfg80211_stop_link() adding support to stop a link in AP/P2P_GO
    mode, in failure cases only the corresponding link can be stopped,
    instead of stopping the whole interface.
    
    Hence, invoke cfg80211_stop_link() directly with the link_id set for
    AP/P2P_GO mode when CSA finalization fails.
    
    Signed-off-by: Aditya Kumar Singh 
    Signed-off-by: Manish Dharanenthiran 
    Link: https://patch.msgid.link/20251127-stop_link-v2-2-43745846c5fd@qti.qualcomm.com
    Signed-off-by: Johannes Berg 

commit dc4b176cce09b8f92ccdc8639feedc7b19e28740
Author: Manish Dharanenthiran 
Date:   Thu Nov 27 15:41:23 2025 +0530

    wifi: cfg80211: add cfg80211_stop_link() for per-link teardown
    
    Currently, whenever cfg80211_stop_iface() is called, the entire iface
    is stopped. However, there could be a need in AP/P2P_GO mode, where
    one would like to stop a single link in MLO operation instead of the
    whole MLD interface.
    
    Hence, introduce cfg80211_stop_link() to allow drivers to tear down
    only a specified AP/P2P_GO link during MLO operation. Passing -1
    preserves the existing behavior of stopping the whole interface. Make
    cfg80211_stop_iface() call this function by passing -1 to keep the
    default behavior the same, that is, to stop all links and use
    cfg80211_stop_link() with the desired link_id for AP/P2P_GO mode, to
    stop only that link.
    
    This brings no behavioral change for single-link/non-MLO interfaces,
    and enables drivers to stop an AP/P2P_GO link without disrupting other
    links on the same interface.
    
    Signed-off-by: Manish Dharanenthiran 
    Link: https://patch.msgid.link/20251127-stop_link-v2-1-43745846c5fd@qti.qualcomm.com
    [make cfg80211_stop_iface() inline]
    Signed-off-by: Johannes Berg 

commit 957346a6877b5457d0974b1c5adea7ed0bfd0ff2
Merge: 8e7148b5602321 3adff276e75105
Author: Paolo Abeni 
Date:   Thu Jan 8 13:01:18 2026 +0100

    Merge branch 'net-dsa-microchip-adjust-ptp-handling-to-ease-ksz8463-integration'
    
    Bastien Curutchet says:
    
    ====================
    net: dsa: microchip: Adjust PTP handling to ease KSZ8463 integration
    
    This series aims to make the PTP handling a bit more generic to ease the
    addition of PTP support for the KSZ8463 in an upcoming series. It is not
    intented to change any behaviour in the driver here.
    
    Patches 1 & 2 focus on IRQ handling.
    Patches 3 to 9 focus on register access.
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    ====================
    
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-0-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit 3adff276e751051e77be4df8d29eab1cf0856fbf
Author: Bastien Curutchet (Schneider Electric) 
Date:   Mon Jan 5 14:08:08 2026 +0100

    net: dsa: microchip: Wrap timestamp reading in a function
    
    Timestamps are directly accessed through a register read in the
    interrupt handler. KSZ8463's logic to access it will be a bit more
    complex because the same interrupt can be triggered by two different
    timestamps being ready.
    
    Wrap the timestamp's reading in a dedicated function to ease the
    KSZ8463's integration in upcoming patches.
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-9-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit b4df828dfc290ffbb59b1172d71fdf34371edc23
Author: Bastien Curutchet (Schneider Electric) 
Date:   Mon Jan 5 14:08:07 2026 +0100

    net: dsa: microchip: Use regs[] to access REG_PTP_MSG_CONF1
    
    Accesses to the PTP_MSG_CONF1 register are done through a hardcoded
    address which doesn't match with the KSZ8463's register layout.
    
    Add a new entry for the PTP_MSG_CONF1 register in the regs[] tables.
    Use the regs[] table to retrieve the PTP_MSG_CONF1 register address
    when accessing it.
    Remove the macro defining the address to prevent further use.
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-8-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit d99c1a01ac8dc43065bc8b239afd554b49d6c5dc
Author: Bastien Curutchet (Schneider Electric) 
Date:   Mon Jan 5 14:08:06 2026 +0100

    net: dsa: microchip: Use regs[] to access REG_PTP_SUBNANOSEC_RATE
    
    Accesses to the PTP_SUBNANOSEC_RATE register are done through a
    hardcoded address which doesn't match with the KSZ8463's register
    layout.
    
    Add a new entry for the PTP_SUBNANOSEC_RATE register in the regs[]
    tables.
    Use the regs[] table to retrieve the PTP_SUBNANOSEC_RATE register
    address when accessing it.
    Remove the macro defining the address to prevent further use.
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-7-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit 5b1fe74facc2abab66cee1d18a74807f457983ff
Author: Bastien Curutchet (Schneider Electric) 
Date:   Mon Jan 5 14:08:05 2026 +0100

    net: dsa: microchip: Use regs[] to access REG_PTP_RTC_SUB_NANOSEC
    
    Accesses to the PTP_RTC_SUB_NANOSEC register are done through a
    hardcoded address which doesn't match with the KSZ8463's register
    layout.
    
    Add a new entry for the PTP_RTC_SUB_NANOSEC register in the regs[]
    tables.
    Use the regs[] table to retrieve the PTP_RTC_SUB_NANOSEC register
    address when accessing it.
    Remove the macro defining the address to prevent further use.
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-6-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit 776ad30de04e26b705ce2c36d7efe99aa6f12d6f
Author: Bastien Curutchet (Schneider Electric) 
Date:   Mon Jan 5 14:08:04 2026 +0100

    net: dsa: microchip: Use regs[] to access REG_PTP_RTC_SEC
    
    Accesses to the PTP_RTC_SEC register are done through a hardcoded
    address which doesn't match with the KSZ8463's register layout.
    
    Add a new entry for the PTP_RTC_SEC register in the regs[] tables.
    Use the regs[] table to retrieve the PTP_RTC_SEC register address
    when accessing it.
    Remove the macro defining the address to prevent further use.
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-5-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit 0ee0566fc234d503e412b97da8c666851b2649aa
Author: Bastien Curutchet (Schneider Electric) 
Date:   Mon Jan 5 14:08:03 2026 +0100

    net: dsa: microchip: Use regs[] to access REG_PTP_RTC_NANOSEC
    
    Accesses to the PTP_RTC_NANOSEC register are done through a hardcoded
    address which doesn't match with the KSZ8463's register layout.
    
    Add a new entry for the PTP_RTC_NANOSEC register in the regs[] tables.
    Use the regs[] table to retrieve the PTP_RTC_NANOSEC register address
    when accessing it.
    Remove the macro defining the address to prevent further use.
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-4-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit 62382d6ffe596efd4ea16edd460ab94d3eba1c21
Author: Bastien Curutchet (Schneider Electric) 
Date:   Mon Jan 5 14:08:02 2026 +0100

    net: dsa: microchip: Use regs[] to access REG_PTP_CLK_CTRL
    
    Accesses to the PTP_CLK_CTRL register are done through a hardcoded
    address which doesn't match with the KSZ8463's register layout.
    
    Add a new entry for the PTP_CLK_CTRL register in the regs[] tables.
    Use the regs[] table to retrieve the PTP_CLK_CTRL register address
    when accessing it.
    Remove the macro defining the address to prevent further use.
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-3-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit 22bde912e80086c51d19c8e99d8267784d076ad4
Author: Bastien Curutchet (Schneider Electric) 
Date:   Mon Jan 5 14:08:01 2026 +0100

    net: dsa: microchip: Use dynamic irq offset
    
    The PTP irq_chip operations use an hardcoded IRQ offset in the bit
    logic. This IRQ offset isn't the same on KSZ8463 than on others switches
    so it can't use the irq_chip operations.
    
    Convey the interrupt bit offset through a new attribute in struct ksz_irq
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-2-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit 813feab1ac5256b423157f005b3a844a4b2841b5
Author: Bastien Curutchet (Schneider Electric) 
Date:   Mon Jan 5 14:08:00 2026 +0100

    net: dsa: microchip: Initialize IRQ's mask outside common_setup()
    
    The IRQ logic of the KSZ8463 differs from that of other KSZ switches.
    It doesn't have a 'mask' register but an 'enable' one instead. The
    common IRQ framework can still be used though as soon as we reverse
    the logic (using '1' to enable interrupts instead of '0') for KSZ8463
    cases.
    
    Move the initialization of the kirq->masked outside of
    ksz_irq_common_setup() to keep this function truly common when
    IRQ support for the KSZ8463 is added.
    
    Signed-off-by: Bastien Curutchet (Schneider Electric) 
    Link: https://patch.msgid.link/20260105-ksz-rework-v1-1-a68df7f57375@bootlin.com
    Signed-off-by: Paolo Abeni 

commit 7dadeaa6e851e7d67733f3e24fc53ee107781d0f
Author: Peter Zijlstra 
Date:   Thu Dec 18 15:25:10 2025 +0100

    sched: Further restrict the preemption modes
    
    The introduction of PREEMPT_LAZY was for multiple reasons:
    
      - PREEMPT_RT suffered from over-scheduling, hurting performance compared to
        !PREEMPT_RT.
    
      - the introduction of (more) features that rely on preemption; like
        folio_zero_user() which can do large memset() without preemption checks.
    
        (Xen already had a horrible hack to deal with long running hypercalls)
    
      - the endless and uncontrolled sprinkling of cond_resched() -- mostly cargo
        cult or in response to poor to replicate workloads.
    
    By moving to a model that is fundamentally preemptable these things become
    managable and avoid needing to introduce more horrible hacks.
    
    Since this is a requirement; limit PREEMPT_NONE to architectures that do not
    support preemption at all. Further limit PREEMPT_VOLUNTARY to those
    architectures that do not yet have PREEMPT_LAZY support (with the eventual goal
    to make this the empty set and completely remove voluntary preemption and
    cond_resched() -- notably VOLUNTARY is already limited to !ARCH_NO_PREEMPT.)
    
    This leaves up-to-date architectures (arm64, loongarch, powerpc, riscv, s390,
    x86) with only two preemption models: full and lazy.
    
    While Lazy has been the recommended setting for a while, not all distributions
    have managed to make the switch yet. Force things along. Keep the patch minimal
    in case of hard to address regressions that might pop up.
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Valentin Schneider 
    Link: https://patch.msgid.link/20251219101502.GB1132199@noisy.programming.kicks-ass.net

commit 89951fc1f8201df27366ac1eed1ddc9ee0f47729
Author: Blake Jones 
Date:   Mon Dec 1 18:37:43 2025 -0800

    sched: Reorder some fields in struct rq
    
    This colocates some hot fields in "struct rq" to be on the same cache line
    as others that are often accessed at the same time or in similar ways.
    
    Using data from a Google-internal fleet-scale profiler, I found three
    distinct groups of hot fields in struct rq:
    
    - (1) The runqueue lock: __lock.
    
    - (2) Those accessed from hot code in pick_next_task_fair():
          nr_running, nr_numa_running, nr_preferred_running,
          ttwu_pending, cpu_capacity, curr, idle.
    
    - (3) Those accessed from some other hot codepaths, e.g.
          update_curr(), update_rq_clock(), and scheduler_tick():
          clock_task, clock_pelt, clock, lost_idle_time,
          clock_update_flags, clock_pelt_idle, clock_idle.
    
    The cycles spent on accessing these different groups of fields broke down
    roughly as follows:
    
    - 50% on group (1) (the runqueue lock, always read-write)
    - 39% on group (2) (load:store ratio around 38:1)
    -  8% on group (3) (load:store ratio around 5:1)
    -  3% on all the other fields
    
    Most of the fields in group (3) are already in a cache line grouping; this
    patch just adds "clock" and "clock_update_flags" to that group. The fields
    in group (2) are scattered across several cache lines; the main effect of
    this patch is to group them together, on a single line at the beginning of
    the structure. A few other less performance-critical fields (nr_switches,
    numa_migrate_on, has_blocked_load, nohz_csd, last_blocked_load_update_tick)
    were also reordered to reduce holes in the data structure.
    
    Since the runqueue lock is acquired from so many different contexts, and is
    basically always accessed using an atomic operation, putting it on either
    of the cache lines for groups (2) or (3) would slow down accesses to those
    fields dramatically, since those groups are read-mostly accesses.
    
    To test this, I wrote a focused load test that would put load on the
    pick_next_task_fair() path. A parent process would fork many child
    processes, and each child would nanosleep() for 1 msec many times in a
    loop. The load test was monitored with "perf", and I looked at the amount
    of cycles that were spent with sched_balance_rq() on the stack. The test
    was reliably spending ~5% of all of its cycles there. I ran it 100 times
    on a pair of 2-socket Intel Haswell machines (72 vCPUs per machine) - one
    running the tip of sched/core, the other running this change - using 360
    child processes and 8192 1-msec sleeps per child.  The mean cycle count
    dropped from 5.14B to 4.91B, or a *4.6% decrease* in relevant scheduler
    cycles.
    
    Given that this change reduces cache misses in a very hot kernel codepath,
    there's likely to be additional application performance improvement due to
    reduced cache conflicts from kernel data structures.
    
    On a Power11 system with 128-byte cache lines, my test showed a ~5%
    decrease in relevant scheduler cycles, along with a slight increase in user
    time - both positive indicators. This data comes from
    https://lore.kernel.org/lkml/affdc6b1-9980-44d1-89db-d90730c1e384@linux.ibm.com/
    This is the case even though the additional "____cacheline_aligned" that
    puts the runqueue lock on the next cache line adds an additional 64 bytes
    of padding on those machines. This patch does not change the size of
    "struct rq" on machines with 64-byte cache lines.
    
    I also ran "hackbench" to try to test this change, but it didn't show
    conclusive results.  Looking at a CPU cycle profile of the hackbench run,
    it was spending 95% of its cycles inside __alloc_skb(), __kfree_skb(), or
    kmem_cache_free() - almost all of which was spent updating memcg counters
    or contending on the list_lock in kmem_cache_node. And it spent less than
    0.5% of its cycles inside either schedule() or try_to_wake_up().  So it's
    not surprising that it didn't show useful results here.
    
    The "__no_randomize_layout" was added to reflect the fact that performance
    of code that references this data structure is unusually sensitive to
    placement of its members.
    
    Signed-off-by: Blake Jones 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Madadi Vineeth Reddy 
    Reviewed-by: Josh Don 
    Tested-by: Madadi Vineeth Reddy 
    Link: https://patch.msgid.link/20251202023743.1524247-1-blakejones@google.com

commit 55b39b0cf183b9c682717a55a2fba06da69bba6b
Author: Yury Norov (NVIDIA) 
Date:   Sat Dec 6 22:42:47 2025 -0500

    sched/fair: Use cpumask_weight_and() in sched_balance_find_dst_group()
    
    In the group_has_spare case, the function creates a temporary cpumask
    to just calculate weight of (p->cpus_ptr & sched_group_span(local)).
    
    We've got a dedicated helper for it.
    
    Signed-off-by: Yury Norov (NVIDIA) 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Vincent Guittot 
    Reviewed-by: K Prateek Nayak 
    Reviewed-by: Fernand Sieber 
    Link: https://patch.msgid.link/20251207034247.402926-1-yury.norov@gmail.com

commit 0ab25ea2a3b3a973fb914d0e47dc9c3c26049e8b
Author: Yury Norov (NVIDIA) 
Date:   Sat Dec 6 22:30:36 2025 -0500

    sched/fair: Simplify task_numa_find_cpu()
    
    Use for_each_cpu_and() and drop some housekeeping code.
    
    Signed-off-by: Yury Norov (NVIDIA) 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: K Prateek Nayak 
    Reviewed-by: Phil Auld 
    Link: https://patch.msgid.link/20251207033037.399608-1-yury.norov@gmail.com

commit ff1de90dd7a69ef43586683535ad87ab899a1214
Author: Yury Norov (NVIDIA) 
Date:   Sat Dec 6 23:05:42 2025 -0500

    sched/fair: Drop useless cpumask_empty() in find_energy_efficient_cpu()
    
    cpumask_empty() call is O(N) and useless because the previous
    cpumask_and() returns false for empty 'cpus'. Drop it.
    
    Signed-off-by: Yury Norov (NVIDIA) 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Madadi Vineeth Reddy 
    Reviewed-by: K Prateek Nayak 
    Reviewed-by: Vincent Guittot 
    Link: https://patch.msgid.link/20251207040543.407695-1-yury.norov@gmail.com

commit b3d8508351af7f6366a0a18068c194b399ead2c3
Author: Bartosz Golaszewski 
Date:   Fri Nov 21 14:57:39 2025 +0100

    reset: gpio: add the "compatible" property
    
    In order to correctly handle the interaction between the reset-gpio
    devices and shared GPIOs managed by GPIOLIB, we need to be able to
    identify the former. Add the "compatible" property to allow us to use
    the device_is_compatible() helper.
    
    Signed-off-by: Bartosz Golaszewski 
    Reviewed-by: Philipp Zabel 
    Signed-off-by: Philipp Zabel 

commit 8f350dbb2e4a7eaa5de97c6502d004caa26eba1a
Author: Sjoerd Simons 
Date:   Tue Dec 23 13:37:53 2025 +0100

    arm64: dts: mediatek: mt7981b-openwrt-one: Enable PCIe and USB
    
    Enable the PCIe controller and USB3 XHCI host on the OpenWrt One
    board. The USB controller is configured for USB 2.0 only mode, as the
    shared USB3/PCIe PHY is dedicated to PCIe functionality on this board.
    
    Signed-off-by: Sjoerd Simons 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 262cb81069c65373d4d6b773413552a65b478f7e
Author: Sjoerd Simons 
Date:   Tue Dec 23 13:37:52 2025 +0100

    arm64: dts: mediatek: mt7981b: Add PCIe and USB support
    
    Add device tree nodes for PCIe controller and USB3 XHCI host
    controller on MT7981B SoC. Both controllers share the USB3 PHY
    which can be configured for either USB3 or PCIe operation.
    
    The USB3 XHCI controller supports USB 2.0 and USB 3.0 SuperSpeed
    operation. The PCIe controller is compatible with PCIe Gen2
    specifications.
    
    Also add the topmisc syscon node required for USB/PCIe PHY
    multiplexing.
    
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Sjoerd Simons 
    Signed-off-by: AngeloGioacchino Del Regno 

commit be0b304eeb8c5f77e4f98f64e58729d879195f2f
Author: Otto Pflüger 
Date:   Tue Jan 6 11:11:12 2026 +0100

    arm64: dts: mediatek: mt8183: Add missing endpoint IDs to display graph
    
    The endpoint IDs in the display graph are expected to match the
    associated display path number, i.e. all endpoints connected to
    mmsys_ep_main must have reg = <0> and all endpoints connected to
    mmsys_ep_ext must have reg = <1>.
    
    Add the missing ID to all endpoints in the display graph, based on
    mt8365.dtsi as an existing example that does this correctly.
    
    Fixes: e72d63fa0563 ("arm64: dts: mediatek: mt8183: Migrate to display controller OF graph")
    Reported-by: Evans Jahja 
    Closes: https://lore.kernel.org/linux-mediatek/CAAq5pW9o3itC0G16LnJO7KMAQ_XoqXUpB=cuJ_7e3-H11zKd5Q@mail.gmail.com/
    Tested-by: Chen-Yu Tsai 
    Signed-off-by: Otto Pflüger 
    [Angelo: Fixed dtbs_check issues]
    Signed-off-by: AngeloGioacchino Del Regno 

commit 1489a34e97efebf583ff08e506ecf9f7d44537d3
Author: Ionut Nechita 
Date:   Wed Jan 7 17:42:24 2026 +0200

    HID: asus: Implement Fn+F5 fan control key handler
    
    On Asus ROG laptops, the Fn+F5 key (HID code 0xae) is used to cycle
    through fan modes. This key press needs to be forwarded to the asus-wmi
    driver to actually change the fan mode.
    
    Add ASUS_FAN_CTRL_KEY_CODE define and implement the handler in
    asus_raw_event() to send WMI events when this key is pressed.
    
    When asus-wmi successfully handles the event, it is blocked from reaching
    userspace. If asus-wmi is unavailable or fails, the event is passed to
    userspace via evdev, allowing userspace implementations of fan control.
    
    Tested on Asus ROG G14/G15 series laptops.
    
    Reviewed-by: Denis Benato 
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Ionut Nechita 
    Signed-off-by: Jiri Kosina 

commit c888d0bd055b57688534a884f8f210a91d15e00f
Author: Ionut Nechita 
Date:   Wed Jan 7 17:42:22 2026 +0200

    HID: asus: Add WMI communication infrastructure
    
    Add infrastructure for the HID driver to communicate with the asus-wmi
    driver for handling special keys that require WMI communication.
    
    This includes:
    - Define ASUS_WMI_METHODID_NOTIF method ID in asus-wmi.h
    - Implement asus_wmi_send_event() function to send events to asus-wmi
    
    Reviewed-by: Denis Benato 
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Ionut Nechita 
    Signed-off-by: Jiri Kosina 

commit 7fe565fb83ba7074dca1d25696f1d30116555528
Author: Ionut Nechita 
Date:   Wed Jan 7 17:42:20 2026 +0200

    HID: asus: Filter spurious HID vendor codes on ROG laptops
    
    On Asus ROG laptops, several HID vendor usage codes (0xea, 0xec, 0x02,
    0x8a, 0x9e) are sent during normal operation without a clear purpose,
    generating unwanted "Unmapped Asus vendor usagepage code" warnings in
    dmesg.
    
    Add definitions for these codes and filter them out in asus_raw_event()
    to prevent kernel log spam.
    
    Tested on Asus ROG series laptops.
    
    Reviewed-by: Denis Benato 
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Ionut Nechita 
    Signed-off-by: Jiri Kosina 

commit 06501b557faec7c4aa1a3188e14c8c3d1e6e15de
Author: Ionut Nechita 
Date:   Wed Jan 7 17:42:18 2026 +0200

    HID: asus: Replace magic number with HID_UP_ASUSVENDOR constant
    
    Use the existing HID_UP_ASUSVENDOR constant instead of the magic number
    0xff310000 for better code clarity and maintainability.
    
    Reviewed-by: Denis Benato 
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Ionut Nechita 
    Signed-off-by: Jiri Kosina 

commit b516456e9f916070fde6aa50cad5680a689687e6
Author: Petri Karhula 
Date:   Fri Dec 5 12:19:47 2025 +0000

    backlight: Add Congatec Board Controller (CGBC) backlight support
    
    This driver provides backlight brightness control through the Linux
    backlight subsystem. It communicates with the board controller to
    adjust LCD backlight using PWM signals. Communication is done
    through Congatec Board Controller core driver.
    
    Tested-by: Thomas Richard 
    Reviewed-by: Thomas Richard 
    Reviewed-by: Daniel Thompson (RISCstar) 
    Signed-off-by: Petri Karhula 
    Link: https://patch.msgid.link/20251205-cgbc-backlight-v6-1-e4175b0bf406@novatron.fi
    Signed-off-by: Lee Jones 

commit 393d56d437c65e4619cadab9f2347167cde99906
Author: Steffen Trumtrar 
Date:   Mon Dec 1 12:19:47 2025 +0100

    dt-bindings: leds: Add LP5860 LED controller
    
    The LP5860 is a LED matrix driver with 18 constant current sinks and 11
    scan switches for 198 LED dots:
    
      * Supply range from 2.7 V to 5.5 V
      * 0.1mA - 50mA per current sink
      * 1MHz I2C and 12MHz SPI control interface
      * 8-bit analog dimming
      * 8/16-bit PWM dimming
      * individual ON and OFF control for each LED dot
      * globat 3-bit Maximum Current setting for all LED dots
      * individual LED dot open/short detection
    
    Signed-off-by: Steffen Trumtrar 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251201-v6-14-topic-ti-lp5860-v6-1-be9a21218157@pengutronix.de
    Signed-off-by: Lee Jones 

commit 44e4c88951fa9c73bfbde8269e443ea5343dd2af
Author: Karol Wachowski 
Date:   Tue Dec 30 15:21:16 2025 +0100

    accel/ivpu: Implement warm boot flow for NPU6 and unify boot handling
    
    Starting from NPU6, the driver can pass boot parameters address through
    the AON retention register and toggle between cold/warm boot types using
    the boot_type parameter, while setting the cold boot entry point in both
    cases.
    
    Refactor the existing cold/warm boot handling to be consistent with the
    new NPU6 boot flow requirements and still maintain compatibility with
    older boot flows.
    
    This will allow firmware to remove support for legacy warm boot starting
    from NPU6.
    
    Fixes: 550f4dd2cedd ("accel/ivpu: Add support for Nova Lake's NPU")
    Signed-off-by: Karol Wachowski 
    Reviewed-by: Jeff Hugo 
    Reviewed-by: Andrzej Kacprowski 
    Signed-off-by: Maciej Falkowski 
    Link: https://patch.msgid.link/20251230142116.540026-1-maciej.falkowski@linux.intel.com

commit 101bc85a19436825e8c94a27e792cd9750aad708
Author: Vivek BalachandharTN 
Date:   Mon Dec 1 04:26:12 2025 +0000

    leds: lm3692x: Fix kernel-doc for struct lm3692x_led
    
    Building with W=1 reports several kernel-doc warnings in
    drivers/leds/leds-lm3692x.c:
    
      Warning: leds-lm3692x.c:122 struct member 'boost_ctrl'
      not described in 'lm3692x_led'
      Warning: leds-lm3692x.c:122 struct member 'brightness_ctrl'
      not described in 'lm3692x_led'
      Warning: leds-lm3692x.c:122 struct member 'enabled'
      not described in 'lm3692x_led'
    
    These fields were added to struct lm3692x_led but the corresponding
    kernel-doc comment was not updated. Convert the kernel-doc block to
    use the "@member: description" style consistently and document the
    boost_ctrl, brightness_ctrl and enabled fields.
    
    This keeps the documentation in sync with the implementation and
    silences the W=1 warnings.
    
    Signed-off-by: Vivek BalachandharTN 
    Link: https://patch.msgid.link/20251201042612.2099239-1-vivek.balachandhar@gmail.com
    Signed-off-by: Lee Jones 

commit 936cae9254e55a39aeaa0c156a764d22f319338b
Author: Jani Nikula 
Date:   Wed Jan 7 18:02:26 2026 +0200

    mei: late_bind: fix struct intel_lb_component_ops kernel-doc
    
    Fix kernel-doc warnings on struct intel_lb_component_ops:
    
    Warning: include/drm/intel/intel_lb_mei_interface.h:55 Incorrect use of
      kernel-doc format: * push_payload - Sends a payload to the
      authentication firmware
    
    And a bunch more. There isn't really support for documenting function
    pointer struct members in kernel-doc, but at least reference the member
    properly.
    
    Fixes: 741eeabb7c78 ("mei: late_bind: add late binding component driver")
    Cc: Alexander Usyskin 
    Reviewed-by: Nitin Gote 
    Link: https://patch.msgid.link/20260107160226.2381388-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit a45026cef17d1080c985adf28234d6c8475ad66f
Author: Peter Zijlstra 
Date:   Thu Jan 8 11:14:24 2026 +0100

    locking/local_lock: Include more missing headers
    
    Ingo reported PREEMPT_RT=y builds fail building
    lib/test_context-analysis.c.
    
    Reported-by: Ingo Molnar 
    Signed-off-by: Peter Zijlstra (Intel) 

commit 4d26d4a158f37cb53b22a23b4dc6c4e5bfa1369e
Author: Marco Elver 
Date:   Wed Jan 7 23:35:49 2026 +0100

    compiler-context-analysys: Fix CONFIG_MODVERSION
    
    The robot reported CONFIG_MODVERSION fails; which Nathan described as
    so:
    
    > Something about the context analysis makes genksyms fall over, running
    > it manually on kernel/sched/core.i with '-w' to show warnings reveals
    > many new "syntax error" instances. I don't see any warnings when using
    > gendwarfksyms. Maybe it is context_lock_struct, as that is the first
    > error I see in the list:
    >
    >   include/linux/spinlock_types_raw.h:14: syntax error
    
    Reported-by: kernel test robot 
    Debugged-by: Nathan Chancellor 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512222219.F6EkVNmQ-lkp@intel.com/
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/aV7fxXjaOBtHhI9X@elver.google.com

commit 8ba379879aa3e8cef871fed4a509d4f0a6370e6c
Author: Ernest Van Hoecke 
Date:   Wed Jan 7 10:31:22 2026 +0100

    Documentation: gpio: pca953x: clarify interrupt source detection
    
    There are multiple design tradeoffs and considerations in how the
    PCA953x driver detects the source(s) of an interrupt. This driver
    supports PCAL variants with input latching, a feature that is
    constrained by the fact that the interrupt status and input port
    registers cannot be read atomically. These limits and the design
    decisions deserve an in-depth explanation.
    
    Update the documentation to clarify these hardware limits and describe
    how the driver determines pending interrupts, and how it makes use of
    the PCAL input latching.
    
    Signed-off-by: Ernest Van Hoecke 
    Reviewed-by: Andy Shevchenko 
    Link: https://lore.kernel.org/r/20260107093125.4053468-1-ernestvanhoecke@gmail.com
    Signed-off-by: Bartosz Golaszewski 

commit e600933b6e518397b3f256dddd233e5d8e6cff93
Author: Rob Herring (Arm) 
Date:   Tue Jan 6 15:31:51 2026 -0600

    ARM: dts: aspeed: ibm: Use non-deprecated AT25 properties
    
    The at25,* properties have been deprecated since 2012. These platforms
    weren't upstream until 2020 and 2023, so it should be safe to switch
    over to the "new" properties and just drop the deprecated ones.
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Andrew Jeffery 

commit 3da293d70005496317d1ff3a49b89c29dd7c21e8
Author: Nicolas Frattaroli 
Date:   Mon Nov 24 12:06:59 2025 +0100

    soc: mediatek: mtk-dvfsrc: Rework bandwidth calculations
    
    The code, as it is, plays fast and loose with bandwidth units. It also
    doesn't specify its constraints in the actual maximum hardware value,
    but as some roundabout thing that then ends up multiplied into the
    actual hardware value constraint after some indirections. In part, this
    is due to the use of individual members for storing each limit, instead
    of making it possible to index them by type.
    
    Rework all of this by adding const array members indexed by the
    bandwidth type enum to the soc_data struct. This array expresses the
    actual hardware value limitations, not a factor thereof.
    
    Use the clamp function macro to clamp the values between the minimum and
    maximum constraints after all the calculations, which also means the
    code doesn't write nonsense to a hardware register when the math is
    wrong, as it'll constrain after all the calculations.
    
    Pass the type as the actual enum type as well, and not as an int. If
    there's some type checking that can be extracted from the function
    signature, then we may as well use it.
    
    Don't needlessly explicitly cast return values to the return type
    either; this is both unnecessary and makes it harder to spot type safety
    issues.
    
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 39aa8c4e762ea9b00d66cc55957527167ed89435
Author: Nicolas Frattaroli 
Date:   Mon Nov 24 12:06:58 2025 +0100

    soc: mediatek: mtk-dvfsrc: Get and Enable DVFSRC clock
    
    The DVFSRC has a clock on all platforms.
    
    Get and enable it in the probe function, so that Linux's common clock
    framework knows we're a user of it.
    
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 75cf308fee7e4b3038741f96fd90afc3bd871e64
Author: AngeloGioacchino Del Regno 
Date:   Mon Nov 24 12:06:57 2025 +0100

    soc: mediatek: mtk-dvfsrc: Add support for DVFSRCv4 and MT8196
    
    Add support for the DVFSRC Version 4 by adding new functions for
    vcore/dram levels (in v4, called gears instead), and for readout
    of pre-programmed dvfsrc_opp entries, corresponding to each gear.
    
    In the probe function, for v4, the curr_opps is initialized from
    the get_hw_opps() function instead of platform data.
    
    In order to make use of the new DVFSRCv4 code, also add support
    for the MediaTek MT8196 SoC.
    
    Co-developed-by: Nicolas Frattaroli 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 7cf9db2aca552f5f537d46f1e52e0ab08ddc2d64
Author: AngeloGioacchino Del Regno 
Date:   Mon Nov 24 12:06:56 2025 +0100

    soc: mediatek: mtk-dvfsrc: Write bandwidth to EMI DDR if present
    
    In preparation for adding support for DVFSRC Version 4, add a new
    `has_emi_ddr` member to struct dvfsrc_soc_data: if true, write the
    DRAM bandwidth both to the BW_AVG and to the newly defined EMI_BW
    register, present only on DVFSRC v4.
    
    Currently supported SoCs will not use this, as has_emi_ddr is left
    out from their platform data, hence reading false.
    
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: AngeloGioacchino Del Regno 

commit ddb5862a43b1f40ca0a5cc16882277d8d07b966a
Author: AngeloGioacchino Del Regno 
Date:   Mon Nov 24 12:06:55 2025 +0100

    soc: mediatek: mtk-dvfsrc: Add a new callback for calc_dram_bw
    
    In preparation for adding support for DVFSRC Version 4, add a new
    callback for calculating the dram bandwidth, assign the current
    calculation algo to all of the currently supported SoCs, and use
    this in __dvfsrc_set_dram_bw_v1().
    
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: AngeloGioacchino Del Regno 

commit c2488fecba681d632a3dbb6b2f33c39df2cb7be9
Author: AngeloGioacchino Del Regno 
Date:   Mon Nov 24 12:06:54 2025 +0100

    soc: mediatek: mtk-dvfsrc: Add and propagate DVFSRC bandwidth type
    
    In preparation for adding support for DVFSRC Version 4, add a new
    mtk_dvfsrc_bw_type enumeration, and propagate it from specific bw
    setting callbacks to __dvfsrc_set_dram_bw_v1(), which will use it
    to choose calculation multipliers and dividers in v4 callbacks.
    
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 23f1b4922a9135515e37d3bbad766e311845071f
Author: AngeloGioacchino Del Regno 
Date:   Mon Nov 24 12:06:53 2025 +0100

    soc: mediatek: mtk-dvfsrc: Change error check for DVFSRCv4 START cmd
    
    In preparation for adding support for DVFSRC Version 4, change the
    error check for the MTK_SIP_DVFSRC_START command in the probe
    function to error out only if BIT(0) is set: this is still valid
    for the previous DVFSRC versions, as those always set this bit in
    a fail reply anyway.
    
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 831ee17036e259da23a6313e28a3cbdda221a88c
Author: Nicolas Frattaroli 
Date:   Mon Nov 24 12:06:51 2025 +0100

    dt-bindings: soc: mediatek: dvfsrc: Document clock
    
    The DVFSRC hardware has a clock on all platforms.
    
    Instead or proliferating the culture of omitting clock descriptions in
    the clock controller drivers or marking them critical instead of
    declaring these types of relationships, add this one to the binding.
    
    Any device that wishes to use this binding should figure out their
    incomplete or incorrect clock situation first before piling more
    features on top.
    
    Acked-by: Rob Herring (Arm) 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Frattaroli 
    Signed-off-by: AngeloGioacchino Del Regno 

commit db6dcaeeb60f97ce9765d50035be23c0901d7348
Author: Louis-Alexis Eyraud 
Date:   Tue Dec 9 10:33:20 2025 +0100

    soc: mediatek: mtk-socinfo: Add entry for MT8371AV/AZA Genio 520
    
    Add an entry for the MT8371 SoC with commercial name Genio 520.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Reviewed-by: Macpaul Lin 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 6259094ee806fb813ca95894c65fb80e2ec98bf1
Author: Zilin Guan 
Date:   Sun Dec 28 16:26:36 2025 +0000

    soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
    
    In svs_enable_debug_write(), the buf allocated by memdup_user_nul()
    is leaked if kstrtoint() fails.
    
    Fix this by using __free(kfree) to automatically free buf, eliminating
    the need for explicit kfree() calls and preventing leaks.
    
    Fixes: 13f1bbcfb582 ("soc: mediatek: SVS: add debug commands")
    Co-developed-by: Jianhao Xu 
    Signed-off-by: Jianhao Xu 
    Signed-off-by: Zilin Guan 
    [Angelo: Added missing cleanup.h inclusion]
    Signed-off-by: AngeloGioacchino Del Regno 

commit 0c3644ac3f8df9a79a59ff980538473d3b57d96c
Author: Geert Uytterhoeven 
Date:   Tue Jan 6 18:14:01 2026 +0100

    riscv: dts: renesas: r9a07g043f: Move interrupt-parent to top node
    
    Move the "interrupt-parent = <&plic>" property from the soc node to the
    top node, for consistency with
    arch/arm64/boot/dts/renesas/r9a07g043u.dtsi.
    
    Signed-off-by: Geert Uytterhoeven 
    Reviewed-by: Lad Prabhakar 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/97d3d70e42832f4ffa3888bec792b692a7ab700f.1767719409.git.geert+renesas@glider.be

commit 481b64376c3fb72557725acf2f4fbc4f73bc3188
Author: Lad Prabhakar 
Date:   Wed Dec 24 16:50:46 2025 +0000

    dt-bindings: clock: renesas,r9a09g077/87: Add PCLKCAN ID
    
    Add PCLKCAN ID for CANFD to both R9A09G077 and R9A09G087 SoCs.
    This definition is required for describing CANFD device in DT.
    
    Signed-off-by: Lad Prabhakar 
    Acked-by: Krzysztof Kozlowski 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251224165049.3384870-2-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 21c1d66a1672573c1934734570bd3b05a301af9e
Author: Cosmin Tanislav 
Date:   Thu Nov 27 16:56:53 2025 +0200

    clk: renesas: cpg-mssr: Simplify pointer math in cpg_rzt2h_mstp_read()
    
    Private state is available in all places where cpg_rzt2h_mstp_read() is
    called, remove the extra pointer math used to find it from clk_hw.
    
    While at it, put these statements on a single line as they do not exceed
    the 80 columns limit.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251127145654.3253992-2-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 97e01439e902b743b8f89497e9c144e3ddda5e59
Author: Krzysztof Kozlowski 
Date:   Mon Jan 5 15:29:47 2026 +0100

    ata: ahci-xgene: Fix Wvoid-pointer-to-enum-cast warning
    
    "version" is an enum, thus cast of pointer on 64-bit compile test with
    clang W=1 causes:
    
      ahci_xgene.c:776:13: error: cast to smaller integer type 'enum xgene_ahci_version' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Damien Le Moal 

commit 4afc71c225130dab95ce15fcb385b5b500c02ed4
Author: Krzysztof Kozlowski 
Date:   Mon Jan 5 15:29:46 2026 +0100

    ata: ahci-imx: Fix Wvoid-pointer-to-enum-cast warning
    
    "imxpriv->type" is an enum, thus cast of pointer on 64-bit compile test
    with clang W=1 causes:
    
      ahci_imx.c:872:18: error: cast to smaller integer type 'enum ahci_imx_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Damien Le Moal 

commit 602f6612826b47f6a70931002172c404db9da872
Author: Krzysztof Kozlowski 
Date:   Mon Jan 5 15:29:45 2026 +0100

    ata: ahci-dwc: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes and switch to
    iterating already over available nodes to make code a bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Damien Le Moal 

commit 2dc8a3295b07261aad614f45175616c8c9cd0a76
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 15:29:16 2026 -0600

    dt-bindings: ata: ahci-platform: Drop unnecessary select schema
    
    The "select" schema is not necessary. It looks like it is there to prevent
    matching on "generic-ahci" compatible, but that's not necessary because
    this is the only place "generic-ahci" compatible is present.
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Damien Le Moal 

commit d42d701e132905d69be3a7808f2ec86bdb4c48d8
Author: Linus Walleij 
Date:   Sun Nov 30 11:54:48 2025 +0100

    dma-buf: heaps: Clear CMA pages with clear_page()
    
    clear_page() translates into memset(*p, 0, PAGE_SIZE) on some
    architectures, but on the major architectures it will call
    an optimized assembly snippet so use this instead of open
    coding a memset().
    
    Signed-off-by: Linus Walleij 
    Reviewed-by: Nirmoy Das 
    Reviewed-by: T.J. Mercier 
    Signed-off-by: Linus Walleij 
    Link: https://patch.msgid.link/20251130-dma-buf-heap-clear-page-v1-1-a8dcea2a88ee@linaro.org

commit d08fc1f551b51816c8d9c4c4a1b8d1cc1e6c0806
Author: Nicolas Ferre 
Date:   Fri Jan 2 18:01:34 2026 +0100

    ARM: dts: microchip: sama7d65: add missing flexcom nodes
    
    Add nodes for usart, spi and i2c when missing to the
    flexcom nodes.
    
    Signed-off-by: Nicolas Ferre 
    Link: https://lore.kernel.org/r/20260102170135.70717-6-nicolas.ferre@microchip.com
    Signed-off-by: Claudiu Beznea 

commit a395da9920b246d8d84dec09c7d6a7b52580ab27
Author: Nicolas Ferre 
Date:   Fri Jan 2 18:01:33 2026 +0100

    ARM: dts: microchip: sama7d65: add fifo-size to usart
    
    When missing, add the atmel,fifo-size = <32> property for usart nodes in
    flexcom.
    
    Signed-off-by: Nicolas Ferre 
    Link: https://lore.kernel.org/r/20260102170135.70717-5-nicolas.ferre@microchip.com
    Signed-off-by: Claudiu Beznea 

commit c76e026616b65e21e115351b1623cae732008c0d
Author: Nicolas Ferre 
Date:   Fri Jan 2 18:01:32 2026 +0100

    ARM: dts: microchip: sama7d65: add dma properties to usart6
    
    Add the dma property and associated dma activation for usart6 as part of
    flx6 node.
    Is useful for usual default console on this product.
    
    Signed-off-by: Nicolas Ferre 
    Link: https://lore.kernel.org/r/20260102170135.70717-4-nicolas.ferre@microchip.com
    Signed-off-by: Claudiu Beznea 

commit c6a40c867467c23d531446c2b11d310b0a6641e7
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 13:32:31 2026 -0600

    arm64: dts: nuvoton: Add missing "device_type" property on memory node
    
    "device_type" is required for memory nodes, but is missing on Nuvoton
    npcm845-evb.
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Andrew Jeffery 

commit 71ed55143d9dba39b564d63d89411b07ef294c58
Author: Andreas Kemnade 
Date:   Wed Jan 7 21:52:14 2026 -0800

    Input: twl4030 - fix warnings without CONFIG_OF
    
    There are unused variables without CONFIG_OF:
    drivers/input/misc/twl4030-pwrbutton.c:41:44: error: unused variable 'twl4030_chipdata' [-Werror,-Wunused-const-variable]
       41 | static const struct twl_pwrbutton_chipdata twl4030_chipdata = {
          |                                            ^~~~~~~~~~~~~~~~
    drivers/input/misc/twl4030-pwrbutton.c:46:44: error: unused variable 'twl6030_chipdata' [-Werror,-Wunused-const-variable]
       46 | static const struct twl_pwrbutton_chipdata twl6030_chipdata = {
    
    Fix that by avoiding some #ifdef CONFIG_OF
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512220251.jDE8tKup-lkp@intel.com/
    Fixes: ec8fce2a57e9 ("Input: twl4030 - add TWL603x power button")
    Signed-off-by: Andreas Kemnade 
    Link: https://patch.msgid.link/20251227115918.76969-1-andreas@kemnade.info
    Signed-off-by: Dmitry Torokhov 

commit c6d3513c90bd1382d11f82b65c6baac9285b1bf0
Author: Rebecca Cran 
Date:   Thu Dec 18 09:18:14 2025 -0700

    ARM: dts: aspeed: add device tree for ASRock Rack ALTRAD8 BMC
    
    The ALTRAD8 BMC is an Aspeed AST2500-based BMC for the ASRock Rack
    ALTRAD8UD-1L2T and ALTRAD8UD2-1L2Q boards.
    
    Signed-off-by: Rebecca Cran 
    Tested-by: Tan Siewert 
    Reviewed-by: Tan Siewert 
    Link: https://patch.msgid.link/20251218161816.38155-3-rebecca@bsdio.com
    Signed-off-by: Andrew Jeffery 

commit c4f6b5d254ef060ba92f060e2354fc03cc0b2ba6
Author: Rebecca Cran 
Date:   Thu Dec 18 09:18:13 2025 -0700

    dt-bindings: arm: aspeed: add ASRock Rack ALTRAD8 board
    
    Document ASRock Rack ALTRAD8 (ALTRAD8UD-1L2T and ALTRAD8UD2-1L2Q)
    compatibles.
    
    Signed-off-by: Rebecca Cran 
    Acked-by: Conor Dooley 
    Reviewed-by: Tan Siewert 
    Acked-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251218161816.38155-2-rebecca@bsdio.com
    [arj: Drop erroneous Tested-by tag from Tan]
    Signed-off-by: Andrew Jeffery 

commit 10dd1eaa80a56d3cf6d7c36b5269c8fed617f001
Author: Matthew Brost 
Date:   Wed Jan 7 10:27:16 2026 -0800

    drm/pagemap: Disable device-to-device migration
    
    Device-to-device migration is causing xe_exec_system_allocator --r
    *race*no* to intermittently fail with engine resets and a kernel hang on
    a page lock. This should work but is clearly buggy somewhere. Disable
    device-to-device migration in the interim until the issue can be
    root-caused.
    
    The only downside of disabling device-to-device migration is that memory
    will bounce through system memory during migration. However, this path
    should be rare, as it only occurs when madvise attributes are changed or
    atomics are used.
    
    Cc: Thomas Hellström 
    Fixes: ec265e1f1cfc ("drm/pagemap: Support source migration over interconnect")
    Signed-off-by: Matthew Brost 
    Reviewed-by: Francois Dugast 
    Link: https://patch.msgid.link/20260107182716.2236607-3-matthew.brost@intel.com

commit 3902846af36beca676735540470a115b3d637263
Author: Matthew Brost 
Date:   Wed Jan 7 10:27:15 2026 -0800

    drm/pagemap Fix error paths in drm_pagemap_migrate_to_devmem
    
    Avoid unlocking and putting device pages unless they were successfully
    locked, and do not calculate migrated_pages on error paths.
    
    Cc: Thomas Hellström 
    Fixes: 75af93b3f5d0 ("drm/pagemap, drm/xe: Support destination migration over interconnect")
    Signed-off-by: Matthew Brost 
    Reviewed-by: Francois Dugast 
    Link: https://patch.msgid.link/20260107182716.2236607-2-matthew.brost@intel.com

commit cc54eabdfbf0c5b6638edc50002cfafac1f1e18b
Author: Matthew Brost 
Date:   Wed Jan 7 12:57:32 2026 -0800

    drm/xe: Adjust page count tracepoints in shrinker
    
    Page accounting can change via the shrinker without calling
    xe_ttm_tt_unpopulate(), which normally updates page count tracepoints
    through update_global_total_pages. Add a call to
    update_global_total_pages when the shrinker successfully shrinks a BO.
    
    v2:
     - Don't adjust global accounting when pinning (Stuart)
    
    Cc: stable@vger.kernel.org
    Fixes: ce3d39fae3d3 ("drm/xe/bo: add GPU memory trace points")
    Signed-off-by: Matthew Brost 
    Reviewed-by: Stuart Summers 
    Link: https://patch.msgid.link/20260107205732.2267541-1-matthew.brost@intel.com

commit 7c2516fc94b80ca38bb32dc57d1ab67224cacc90
Author: Cosmo Chou 
Date:   Fri Dec 19 14:29:48 2025 +0800

    ARM: dts: aspeed: bletchley: Remove try-power-role from connectors
    
    Remove the "try-power-role = sink" property from all USB-C connectors.
    The try mechanism is unnecessary and wastes time during connection.
    Since power-role = "dual" is already configured, standard USB PD
    negotiation is sufficient and more efficient.
    
    Signed-off-by: Cosmo Chou 
    Signed-off-by: Andrew Jeffery 

commit bc83b7353d2bfefba73193335bacc3542d8a7ae2
Author: Peter Shen 
Date:   Fri Dec 19 17:16:32 2025 +0800

    ARM: dts: aspeed: Add Facebook Anacapa platform
    
    The Meta Anacapa BMC is the DC-SCM (Data Center Secure Control
    Module) controller for the Meta OCP Open Rack Wide (ORW) compute tray.
    This platform is a key component of the AMD Helios AI rack reference
    design system, designed for next-generation AI workloads.
    
    The BMC utilizes the Aspeed AST2600 SoC to manage the compute tray, which
    contains up to 4 AMD Instinct MI450 Series GPUs (connected via a Broadcom
    OCP NIC) and host CPUs. Its primary role is to provide essential system
    control, power sequencing, and telemetry reporting for the compute complex
    via the OpenBMC software stack.
    
    For more detail on the AMD Helios reference design:
    
    https://www.amd.com/en/blogs/2025/amd-helios-ai-rack-built-on-metas-2025-ocp-design.html
    
    Signed-off-by: Peter Shen 
    Link: https://patch.msgid.link/20251219091632.1598603-3-sjg168@gmail.com
    Signed-off-by: Andrew Jeffery 

commit 1b3cadbd185a6e8681c3b3b6578d7cf3ea4ca47d
Author: Peter Shen 
Date:   Fri Dec 19 17:16:31 2025 +0800

    dt-bindings: arm: aspeed: Add compatible for Facebook Anacapa BMC
    
    This patch adds the compatible string for the Facebook Anacapa BMC
    which uses an Aspeed AST2600 SoC. This is required before adding
    the board's device tree source file.
    
    Signed-off-by: Peter Shen 
    Acked-by: Krzysztof Kozlowski 
    [arj: Insert provided Acked-by tag from Krzysztof, drop misspelled one]
    Link: https://lore.kernel.org/linux-aspeed/259e917f-0570-40d6-983f-bfe9d77444a7@kernel.org/
    Link: https://patch.msgid.link/20251219091632.1598603-2-sjg168@gmail.com
    Signed-off-by: Andrew Jeffery 

commit 6b5e2f70a95c1f46ed444a54ad4c6ff6b9673b1d
Author: Vidya Sagar 
Date:   Thu May 8 10:49:22 2025 +0530

    PCI: dwc: tegra194: Broaden architecture dependency
    
    Replace ARCH_TEGRA_194_SOC dependency with a more generic ARCH_TEGRA check
    for the Tegra194 PCIe controller, allowing it to be built on Tegra
    platforms beyond Tegra194. Additionally, ensure compatibility by requiring
    ARM64 or COMPILE_TEST since this driver works only for ARM64 Tegra SoCs.
    
    Signed-off-by: Vidya Sagar 
    [mani: moved ARM64 dependency to ARCH_TEGRA]
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Niklas Cassel 
    Acked-by: Krzysztof Wilczyński 
    Acked-by: Thierry Reding 
    Acked-by: Manivannan Sadhasivam 
    Acked-by: Jon Hunter 
    Link: https://patch.msgid.link/20250508051922.4134041-1-vidyas@nvidia.com

commit 8a840ab0567ff2b7d382694ba24a58a893d2c7af
Author: Robin Murphy 
Date:   Tue Jan 6 19:27:53 2026 +0000

    dma-mapping: Remove dma_mark_clean (again)
    
    With IA-64 now gone, there are no users of the dma_mark_clean hook,
    so we can retire it for good.
    
    Signed-off-by: Robin Murphy 
    Signed-off-by: Marek Szyprowski 
    Link: https://lore.kernel.org/r/c004927f01962726ff1dcf94d1b4efff84db805a.1767727673.git.robin.murphy@arm.com

commit 3f0e3af4688deb797232c6ef7b45147601d9000d
Merge: 7c0c19c076ffe8 59260fe5821ad1
Author: Rodrigo Vivi 
Date:   Wed Jan 7 16:49:20 2026 -0500

    Merge drm/drm-next into drm-xe-next
    
    Bring some drm-scheduler patches to Xe.
    
    Signed-off-by: Rodrigo Vivi 

commit 5ac66ed8417fa43f64edbabc5fbac18d2bca9437
Author: Mostafa Saleh 
Date:   Fri Jan 2 20:53:52 2026 +0000

    iommu/arm-smmu-v3: Remove IAS
    
    The driver only supports AArch64 page tables where OAS == IAS.
    
    Remove the extra IAS tracking for AArch32 as this feature was
    never implemented and that was creating BAD_STEs for SMMUv3
    with stage-2 and OAS < 40.
    
    Further discussion on this in:
    https://lore.kernel.org/linux-iommu/20251130194506.593700-1-smostafa@google.com/
    
    Reported-by: Tomasz Nowicki 
    Fixes: f0c453dbcce7 ("iommu/arm-smmu: Ensure IAS is set correctly for AArch32-capable SMMUs")
    Signed-off-by: Mostafa Saleh 
    Signed-off-by: Will Deacon 

commit 698362f1f4644ac5419b047be6c496afff00d851
Author: Vishnu Sankar 
Date:   Mon Dec 22 17:05:12 2025 +0900

    Documentation: hid: intel-ish-hid: Document PRODUCT_FAMILY firmware matching
    
    Document the ISH firmware filename matching rules, including the
    new PRODUCT_FAMILY-based patterns and their search order.
    
    This aligns the documentation with the driver behavior and provides
    clear guidance for vendors supplying custom ISH firmware.
    
    Signed-off-by: Vishnu Sankar 
    Acked-by: Srinivas Pandruvada 
    Signed-off-by: Jiri Kosina 

commit 043251b2dd1c2b0cd23f67830748493fd3d3ed0f
Author: Vishnu Sankar 
Date:   Mon Dec 22 17:05:11 2025 +0900

    HID: intel-ish-hid: loader: Add PRODUCT_FAMILY-based firmware matching
    
    Add support for firmware filenames that include the CRC32 checksum of the
    DMI product_family field. Several OEMs ship ISH firmware variants shared
    across a product family while product_name or product_sku may differ. This
    intermediate matching granularity reduces duplication and improves firmware
    selection for vendor-customized platforms.
    
    The newly supported filename forms are checked before existing patterns:
    
      ish_${gen}_${vendor}_${family}_${name}_${sku}.bin
      ish_${gen}_${vendor}_${family}_${sku}.bin
      ish_${gen}_${vendor}_${family}_${name}.bin
      ish_${gen}_${vendor}_${family}.bin
    
    The legacy product_name/product_sku rules remain unchanged and continue
    to provide fallback matching.
    
    ISH_FW_FILENAME_LEN_MAX is changed to 72 to accommodate the product_family.
    
    Tested with X9 series and X1 series.
    
    Reviewed-by: Mark Pearson 
    Tested-by: Richie Roy Jayme 
    Signed-off-by: Vishnu Sankar 
    Acked-by: Srinivas Pandruvada 
    Signed-off-by: Jiri Kosina 

commit 6761f9ccd6247682430413274e7af955d39cfee4
Author: Even Xu 
Date:   Mon Dec 22 09:41:34 2025 +0800

    HID: Intel-thc-hid: Intel-quicki2c: Add power management for touch device
    
    Send POWER_SLEEP command to touch device when system enters into sleep
    mode or hibernate mode to save more power; and send POWER_ON command to
    take device back when system exits sleep mode.
    
    Signed-off-by: Even Xu 
    Signed-off-by: Jiri Kosina 

commit a788b2057029d831ee610c064bb607984a00367d
Author: Even Xu 
Date:   Tue Dec 9 15:52:15 2025 +0800

    HID: Intel-thc-hid: Intel-quicki2c: Add output report support
    
    Add support for HID output reports in the intel-quicki2c driver by
    implementing the output_report callback in the HID low-level driver
    interface.
    
    This enables proper communication with HID devices that require
    output report functionality, such as setting device configuration or
    updating device firmware.
    
    Tested-by: Rui Zhang 
    Signed-off-by: Even Xu 
    Signed-off-by: Jiri Kosina 

commit e149af9ce108d7b9e39d731b93c9fb55fd9e7842
Author: Even Xu 
Date:   Tue Dec 9 15:52:14 2025 +0800

    HID: Intel-thc-hid: Intel-quicki2c: Support writing output report format
    
    There are two output formats requested in the HID-over-I2C specification:
    - Command format (set feature/set report): encoded command written to
      command register, followed by data written to data register
    - Output report format: all data written directly to output register
    
    Current quicki2c_init_write_buf() implementation only supports the
    command format.
    
    Extend quicki2c_init_write_buf() to automatically detect the output
    format based on the presence of command parameters and prepare the
    appropriate output buffer accordingly.
    
    Tested-by: Rui Zhang 
    Signed-off-by: Even Xu 
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Jiri Kosina 

commit 678cbaa24f09115352be669884f7775ccd28f757
Author: Even Xu 
Date:   Tue Dec 9 15:52:13 2025 +0800

    HID: Intel-thc-hid: Intel-quicki2c: Use put_unaligned_le16 for __le16 writes
    
    Replace memcpy operations with put_unaligned_le16() when writing 16-bit
    little-endian values to the write buffer.
    
    This change improves code clarity and ensures proper handling of unaligned
    memory access.
    
    Signed-off-by: Even Xu 
    Signed-off-by: Jiri Kosina 

commit dabc153c79890911b23c93c1dd65e15b53e87740
Author: Even Xu 
Date:   Tue Dec 9 15:52:12 2025 +0800

    HID: Intel-thc-hid: Intel-quicki2c: Use size_t for all length variables
    
    Convert all length-related variables in the QuickI2C protocol layer to use
    size_t type to follow kernel coding conventions.
    
    This includes:
    - All buffer length parameters and variables
    - Return values of quicki2c_encode_cmd() function which represents
      encoded command buffer size.
    - Return values of quicki2c_init_write_buf() function which represents
      process result: either prepared output buffer size or error code.
    
    This change improves type consistency and aligns with standard kernel
    practices for memory size representation, reducing potential issues
    with size calculations and comparisons.
    
    Signed-off-by: Even Xu 
    Signed-off-by: Jiri Kosina 

commit 2b91b8176d673346ec0604c2ae55575335f4abdf
Author: Thorsten Blum 
Date:   Sat Dec 20 23:30:11 2025 +0100

    thermal: intel: int340x: Use sysfs_emit{_at}() in sysfs show functions
    
    Replace sprintf() with sysfs_emit() and sysfs_emit_at() in sysfs show
    functions.
    
    sysfs_emit() and sysfs_emit_at() are preferred to format sysfs output
    as they provide better bounds checking.
    
    Signed-off-by: Thorsten Blum 
    Reviewed-by: Srinivas Pandruvada 
    [ rjw: Subject adjustment, changelog edits ]
    Link: https://patch.msgid.link/20251220223026.125678-1-thorsten.blum@linux.dev
    Signed-off-by: Rafael J. Wysocki 

commit b47b93c15b12c7a9e560729aa6ad609466f83f0e
Author: Sean Christopherson 
Date:   Tue Dec 30 12:56:41 2025 -0800

    KVM: x86: Disallow setting CPUID and/or feature MSRs if L2 is active
    
    Extend KVM's restriction on CPUID and feature MSR changes to disallow
    updates while L2 is active in addition to rejecting updates after the vCPU
    has run at least once.  Like post-run vCPU model updates, attempting to
    react to model changes while L2 is active is practically infeasible, e.g.
    KVM would need to do _something_ in response to impossible situations where
    userspace has a removed a feature that was consumed as parted of nested
    VM-Enter.
    
    In practice, disallowing vCPU model changes while L2 is active is largely
    uninteresting, as the only way for L2 to be active without the vCPU having
    run at least once is if userspace stuffed state via KVM_SET_NESTED_STATE.
    And because KVM_SET_NESTED_STATE can't put the vCPU into L2 without
    userspace first defining the vCPU model, e.g. to enable SVM/VMX, modifying
    the vCPU model while L2 is active would require deliberately setting the
    vCPU model, then loading nested state, and then changing the model.  I.e.
    no sane VMM should run afoul of the new restriction, and any VMM that does
    encounter problems has likely been running a broken setup for a long time.
    
    Cc: Yosry Ahmed 
    Cc: Kevin Cheng 
    Reviewed-by: Yosry Ahmed 
    Link: https://patch.msgid.link/20251230205641.4092235-1-seanjc@google.com
    Signed-off-by: Sean Christopherson 

commit 8190b9ea30fef5b9067825b91fb3ec6d678ee5e3
Author: Srinivas Pandruvada 
Date:   Thu Dec 18 14:25:59 2025 -0800

    thermal: intel: selftests: workload_hint: Support slow workload hints
    
    Add option to enable slow workload type hints. User can specify
    "slow" as the command line argument to enable slow workload type hints.
    There are two slow workload type hints: "power" and "performance".
    
    Signed-off-by: Srinivas Pandruvada 
    Link: https://patch.msgid.link/20251218222559.4110027-3-srinivas.pandruvada@linux.intel.com
    Signed-off-by: Rafael J. Wysocki 

commit a499c24cc0720258376b6c66d7a0c73b47a0e30a
Author: Srinivas Pandruvada 
Date:   Thu Dec 18 14:25:58 2025 -0800

    thermal: int340x: processor_thermal: Enable slow workload type hints
    
    On processors starting from Panther Lake, additional workload type hints
    are provided.
    
    The hardware analyzes workload residencies over an extended period to
    determine whether the workload classification tends toward idle/battery
    life states or sustained/performance states. Based on this long-term
    analysis, it classifies:
    
     Power Classification: If the workload exhibits more idle or battery
      life residencies, it is classified as "power". This is indicated by
      setting bit 4 of the current workload type.
    
     Performance Classification: If the workload exhibits more sustained
      or performance residencies, it is classified as "performance". This
      is indicated by clearing bit 4 of the current workload type.
    
    This approach enables applications to ignore short-term workload
    fluctuations and instead respond to longer-term power vs. performance
    trends. Hints of this type are called slow workload hints.
    
    To get notifications for slow workload hints, bit 22 in the thermal
    mailbox can be used for configuring workload interrupts. It is possible
    to exclusively enable slow workload hints or enable them in addition to
    the current workload hints.
    
    To enable slow workload hints, a new sysfs attribute is added to the
    existing workload hint attributes:
    
     workload_slow_hint_enable (RW): Write 1 to enable, 0 to disable.
    
    Reading this attribute shows the current state.
    
    This attribute is not present on any previous generation of processors.
    
    Signed-off-by: Srinivas Pandruvada 
    [ rjw: Dropped redundant local variables, changelog edits ]
    Link: https://patch.msgid.link/20251218222559.4110027-2-srinivas.pandruvada@linux.intel.com
    Signed-off-by: Rafael J. Wysocki 

commit 1d97b8e3bfbb4fec99054cb5c413652a0ccfdeec
Author: Thorsten Blum 
Date:   Tue Dec 16 14:09:44 2025 +0100

    thermal: core: Use strnlen() in thermal_zone_device_register_with_trips()
    
    Replace strlen() with the safer strnlen() and calculate the length of
    the thermal zone name 'type' only once.
    
    No functional changes.
    
    Signed-off-by: Thorsten Blum 
    [ rjw: Subject edits ]
    Link: https://patch.msgid.link/20251216130943.40180-2-thorsten.blum@linux.dev
    Signed-off-by: Rafael J. Wysocki 

commit be6a150829b375c1b53d7ea5794ccc9edd2e0c9c
Author: Artem Bityutskiy 
Date:   Tue Dec 16 10:04:02 2025 +0200

    intel_idle: Add C-states validation
    
    Add validation for C-states specified via the "table=" module parameter.
    Treat this module parameter as untrusted input and validate it thoroughly.
    
    Signed-off-by: Artem Bityutskiy 
    Link: https://patch.msgid.link/20251216080402.156988-4-dedekind1@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit 111f77a233484cf39a6317f4d0306387e9ffda7b
Author: Artem Bityutskiy 
Date:   Tue Dec 16 10:04:01 2025 +0200

    intel_idle: Add cmdline option to adjust C-states table
    
    Add a new module parameter that allows adjusting the C-states table used by
    the driver.
    
    Currently, the C-states table is hardcoded in the driver based on the CPU
    model. The goal is to have good enough defaults for most users.
    
    However, C-state characteristics, such as exit latency and residency, can
    vary between different variants of the same CPU model and BIOS settings.
    Moreover, different platform usage models and user preferences may benefit
    from different C-state target_residency values.
    
    Provide a way for users to adjust the C-states table via a module parameter
    "table". The general format is:
    "state1:latency1:target_residency1,state2:latency2:target_residency2,..."
    
    In other words, represent each C-state by its name, exit latency (in
    microseconds), and target residency (in microseconds), separated by colons.
    Separate multiple C-states by commas.
    
    For example, suppose a CPU has 3 C-states with the following
    characteristics:
      C1:  exit_latency=1, target_residency=2
      C1E: exit_latency=10, target_residency=10
      C6:  exit_latency=100, target_residency=500
    
    Users can specify a custom C-states table as follows:
    
    1. intel_idle.table="C1:2:2,C1E:5:20,C6:150:600"
       Result: C1:  exit_latency=2, target_residency=2
               C1E: exit_latency=5, target_residency=20
               C6:  exit_latency=150, target_residency=600
    2. intel_idle.table="C6::400"
       Result: C1:  exit_latency=1, target_residency=2 (unchanged)
               C1E: exit_latency=10, target_residency=10 (unchanged)
               C6:  exit_latency=100, target_residency=400
                    (only target_residency changed)
    
    Signed-off-by: Artem Bityutskiy 
    Link: https://patch.msgid.link/20251216080402.156988-3-dedekind1@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit ff24f314447a25164bac85cb310c382e289afdbe
Author: Artem Bityutskiy 
Date:   Tue Dec 16 10:04:00 2025 +0200

    intel_idle: Initialize sysfs after cpuidle driver initialization
    
    Reorder initialization calls to initialize the internal driver data before
    sysfs:
    
    Was:
    intel_idle_sysfs_init();
    intel_idle_cpuidle_driver_init();
    
    Now:
    intel_idle_cpuidle_driver_init();
    intel_idle_sysfs_init();
    
    Follow the general principle that drivers should initialize internal state
    before registering external interfaces like sysfs, avoiding potential usage
    before full initialization.
    
    Signed-off-by: Artem Bityutskiy 
    Link: https://patch.msgid.link/20251216080402.156988-2-dedekind1@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit 1d1fd188691242fe4a66f7aca91f39a42425d3e8
Author: Stefan Wiehler 
Date:   Wed Jan 7 12:48:33 2026 +0100

    Kconfig.ubsan: Remove CONFIG_UBSAN_REPORT_FULL from documentation
    
    There is no indication in the history that such an option was merged to
    mainline.
    
    Fixes: c637693b20da ("ubsan: remove UBSAN_MISC in favor of individual options")
    Signed-off-by: Stefan Wiehler 
    Link: https://patch.msgid.link/20260107114833.2030995-1-stefan.wiehler@nokia.com
    Signed-off-by: Kees Cook 

commit a36dc37b56722bc114d5dd5657b884334031eb49
Author: Artem Bityutskiy 
Date:   Mon Dec 15 13:13:00 2025 +0200

    intel_idle: Remove the 'preferred_cstates' parameter
    
    Remove the 'preferred_cstates' module parameter as it is not really useful.
    
    The parameter currently only affects Alder Lake, where it controls C1/C1E
    preference, with C1E being the default. The parameter does not support any
    other platform. For example, Meteor Lake has a similar C1/C1E limitation,
    but the parameter does not support Meteor Lake. This indicates that the
    parameter is not very useful.
    
    Generally, independent C1 and C1E are important for server platforms where
    low latency is key. However, they are not as important for client platforms,
    like Alder Lake, where C1E providing better energy savings is generally
    preferred.
    
    The parameter was originally introduced for Sapphire Rapids Xeon:
    da0e58c038e6 intel_idle: add 'preferred_cstates' module argument
    
    Later it was added to Alder Lake:
    d1cf8bbfed1ed ("intel_idle: Add AlderLake support")
    
    But it was removed from Sapphire Rapids when firmware fixed the C1/C1E
    limitation:
    1548fac47a114 ("intel_idle: make SPR C1 and C1E be independent")
    
    So Alder Lake is the only platform left where this parameter has any effect.
    Remove this parameter to simplify the driver and reduce maintenance burden.
    
    Signed-off-by: Artem Bityutskiy 
    Link: https://patch.msgid.link/20251215111300.132803-1-dedekind1@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit 25ff69011ddf9ec73114382dc90040a4cad490b0
Author: Artem Bityutskiy 
Date:   Mon Dec 15 13:12:29 2025 +0200

    intel_idle: Remove unused driver version constant
    
    The INTEL_IDLE_VERSION constant has not been updated since 2020 and serves
    no useful purpose. The driver version is implicitly defined by the kernel
    version, making this constant redundant.
    
    Remove the constant to eliminate potential confusion about version
    tracking.
    
    Signed-off-by: Artem Bityutskiy 
    Reviewed-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20251215111229.132705-1-dedekind1@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit 3e0873527c599b5acae9eee1543806752ed254f7
Author: Kaushlendra Kumar 
Date:   Mon Dec 15 14:43:52 2025 +0530

    thermal: intel: intel_pch_thermal: Drop explicit driver data clearing
    
    The driver uses devm_kzalloc() for device allocation, making the
    pci_set_drvdata(pdev, NULL) call in the remove path unnecessary.
    
    The driver core clears drvdata automatically during device removal.
    
    Signed-off-by: Kaushlendra Kumar 
    [ rjw: Subject rewrite ]
    Link: https://patch.msgid.link/20251215091352.1250531-1-kaushlendra.kumar@intel.com
    Signed-off-by: Rafael J. Wysocki 

commit 2064fe4b8fe0c967dac497c4507f27cba4edf9f4
Merge: 9ace4753a5202b ff72619e11348a
Author: Rafael J. Wysocki 
Date:   Wed Jan 7 21:00:22 2026 +0100

    Merge tag 'linux-cpupower-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux
    
    Pull a cpupower utility update for Linux 6.20-rc1 from Shuah Khan:
    
    "Fixes to miscellaneous problems in cpupower tool:
    
     - idle_monitor: fix incorrect value logged after stop
     - Fix inverted APERF capability check
     - Use strcspn() to strip trailing newline
     - Reset errno before strtoull()
     - Show C0 in idle-info dump"
    
    * tag 'linux-cpupower-6.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux:
      tools/power cpupower: Show C0 in idle-info dump
      tools/power cpupower: Reset errno before strtoull()
      tools/cpupower: Use strcspn() to strip trailing newline
      tools/cpupower: Fix inverted APERF capability check
      cpupower: idle_monitor: fix incorrect value logged after stop

commit cae444e0e2f1a843a34299cbb70875b05b9b6730
Author: Colin Ian King 
Date:   Fri Dec 19 21:59:00 2025 +0000

    ACPI: APEI: EINJ: make read-only array non_mmio_desc static const
    
    Don't populate the read-only array non_mmio_desc on the stack at run
    time, instead make it static const.
    
    Signed-off-by: Colin Ian King 
    Link: https://patch.msgid.link/20251219215900.494211-1-colin.i.king@gmail.com
    Signed-off-by: Rafael J. Wysocki 

commit b0c8ac52da5a1c00bb9ffdc231cbf2222297688d
Author: Can Peng 
Date:   Tue Dec 9 15:27:57 2025 +0800

    ACPI: acpi_watchdog: use LIST_HEAD for stack-allocated list
    
    Replace the separate declaration of 'resource_list' and subsequent
    INIT_LIST_HEAD() call with LIST_HEAD(), which declares and initializes
    the list head in one idiomatic step. This reduces code verbosity and
    aligns with common kernel coding patterns, without functional change.
    
    Signed-off-by: Can Peng 
    [ rjw: Subject edits ]
    Link: https://patch.msgid.link/20251209072757.3110467-1-pengcan@kylinos.cn
    Signed-off-by: Rafael J. Wysocki 

commit d88f27d7f4a1861fe6d548d9a9c203e59489880a
Author: Danilo Krummrich 
Date:   Mon Jan 5 15:19:46 2026 +0100

    rust: faux: use "kernel vertical" style for imports
    
    Convert all imports to use "kernel vertical" style.
    
    With this, subsequent patches neither introduce unrelated changes nor
    leave an inconsistent import pattern.
    
    While at it, drop unnecessary imports covered by prelude::*.
    
    Link: https://docs.kernel.org/rust/coding-guidelines.html#imports
    Reviewed-by: Greg Kroah-Hartman 
    Link: https://patch.msgid.link/20260105142123.95030-5-dakr@kernel.org
    Signed-off-by: Danilo Krummrich 

commit 52563c665b0b0b39f319bee40ecc5e8f25b9050a
Author: Danilo Krummrich 
Date:   Mon Jan 5 15:19:44 2026 +0100

    rust: driver-core: use "kernel vertical" style for imports
    
    Convert all imports to use "kernel vertical" style.
    
    With this, subsequent patches neither introduce unrelated changes nor
    leave an inconsistent import pattern.
    
    While at it, drop unnecessary imports covered by prelude::*.
    
    Link: https://docs.kernel.org/rust/coding-guidelines.html#imports
    Reviewed-by: Greg Kroah-Hartman 
    Link: https://patch.msgid.link/20260105142123.95030-3-dakr@kernel.org
    Signed-off-by: Danilo Krummrich 

commit da74aee2ad0dcae8a5544deace7465869890e8f0
Author: Danilo Krummrich 
Date:   Mon Jan 5 15:19:43 2026 +0100

    rust: platform: use "kernel vertical" style for imports
    
    Convert all imports to use "kernel vertical" style.
    
    With this, subsequent patches neither introduce unrelated changes nor
    leave an inconsistent import pattern.
    
    While at it, drop unnecessary imports covered by prelude::*.
    
    Link: https://docs.kernel.org/rust/coding-guidelines.html#imports
    Reviewed-by: Greg Kroah-Hartman 
    Link: https://patch.msgid.link/20260105142123.95030-2-dakr@kernel.org
    Signed-off-by: Danilo Krummrich 

commit 6506b44e88da265688f786d379987e91b4826bf4
Author: Danilo Krummrich 
Date:   Mon Jan 5 15:19:42 2026 +0100

    rust: auxiliary: use "kernel vertical" style for imports
    
    Convert all imports to use "kernel vertical" style.
    
    With this, subsequent patches neither introduce unrelated changes nor
    leave an inconsistent import pattern.
    
    While at it, drop unnecessary imports covered by prelude::*.
    
    Link: https://docs.kernel.org/rust/coding-guidelines.html#imports
    Reviewed-by: Greg Kroah-Hartman 
    Link: https://patch.msgid.link/20260105142123.95030-1-dakr@kernel.org
    Signed-off-by: Danilo Krummrich 

commit 0da7824734d8d83e6a844dd0207f071cb0c50cf4
Author: Haotian Zhang 
Date:   Tue Dec 16 09:39:32 2025 +0800

    soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe
    
    If cmd_db_magic_matches() fails after memremap() succeeds, the function
    returns -EINVAL without unmapping the memory region, causing a
    potential resource leak.
    
    Switch to devm_memremap to automatically manage the map resource.
    
    Fixes: 312416d9171a ("drivers: qcom: add command DB driver")
    Suggested-by: Dmitry Baryshkov 
    Signed-off-by: Haotian Zhang 
    Link: https://lore.kernel.org/r/20251216013933.773-1-vulab@iscas.ac.cn
    Signed-off-by: Bjorn Andersson 

commit 0539c5a6fdef1b274112638aa5aa722b1df5e711
Author: Konrad Dybcio 
Date:   Mon Oct 27 14:02:14 2025 +0100

    soc: qcom: pmic_glink_altmode: Consume TBT3/USB4 mode notifications
    
    Some compute SoCs support additional operation modes, extending the
    existing set of USB3/safe/DP-alt-mode.
    
    The firmware performs all the necessary handshakes for
    us and there is no room for error on that level (i.e. the sequences
    will match what happens on Windows).
    
    The trade-off with that approach is that the received notifications
    trim some of the PDO/EUDO data (particularly the cable/plug parts),
    offering a set of similar-in-nature-but-not-the-same indicators.
    
    In an attempt to remedy this, I reconstructed some of it, so that the
    connected mux/retimer drivers can continue to behave as expected.
    
    Add support for parsing the aforementioned data coming from PMIC_GLINK
    and passing it on to the various Type-C components.
    
    Reviewed-by: Jack Pham 
    Signed-off-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251027-topic-pg_altmode_usb4-v1-1-2931a3ecc146@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 2d7b4a44fb768e1887e7e4cdd8b86817ccd9c3bf
Author: John Hubbard 
Date:   Mon Jan 5 19:52:26 2026 -0800

    gpu: nova-core: use CStr::from_bytes_until_nul() in elf64_section()
    
    Instead of open-coding the steps for extracting a null-terminated
    string, use the newly available CStr::from_bytes_until_nul().
    
    Suggested-by: Joel Fernandes 
    Signed-off-by: John Hubbard 
    Link: https://patch.msgid.link/20260106035226.48853-3-jhubbard@nvidia.com
    Signed-off-by: Danilo Krummrich 

commit da8264ce6c5c02b78f95d31021e942ab38d8dd39
Author: John Hubbard 
Date:   Mon Jan 5 19:52:25 2026 -0800

    gpu: nova-core: use CStr::from_bytes_until_nul() and remove util.rs
    
    The util.rs module contained a single helper function,
    str_from_null_terminated(), which duplicated functionality that is now
    available in core::ffi::CStr.
    
    Specifically, CStr::from_bytes_until_nul() is available in the kernel's
    minimum supported Rust version (1.78.0), so it time to stop using this
    custom workaround.
    
    Reviewed-by: Joel Fernandes 
    Signed-off-by: John Hubbard 
    Link: https://patch.msgid.link/20260106035226.48853-2-jhubbard@nvidia.com
    Signed-off-by: Danilo Krummrich 

commit e2370b8b2cf1f60747594ec6b52b7c5542523549
Author: Robert Marko 
Date:   Mon Dec 29 19:37:46 2025 +0100

    dt-bindings: i2c: atmel,at91sam: add microchip,lan9691-i2c
    
    Document Microchip LAN969x I2C compatible.
    
    Signed-off-by: Robert Marko 
    Acked-by: Conor Dooley 
    Acked-by: Andi Shyti 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251229184004.571837-6-robert.marko@sartura.hr

commit b96259551b337225bb0e7afb3452b98435dd8b81
Author: Encrow Thorne 
Date:   Tue Dec 30 23:06:52 2025 +0800

    i2c: k1: add reset support
    
    The K1 I2C controller provides a reset line that needs to be deasserted
    before the controller can be accessed.
    
    Add reset support to the driver to ensure the controller starts in the
    required state.
    
    Signed-off-by: Encrow Thorne 
    Reviewed-by: Troy Mitchell 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251230150653.42097-2-jyc0019@gmail.com

commit ad0876a84631fee7b0ad4cd8118b9696aa566671
Author: Encrow Thorne 
Date:   Tue Dec 30 23:06:51 2025 +0800

    dt-bindings: i2c: spacemit: add optional resets
    
    The I2C controller requires a reset to ensure it starts from a clean state.
    
    Add the 'resets' property to support this hardware requirement.
    
    Signed-off-by: Encrow Thorne 
    Reviewed-by: Troy Mitchell 
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251230150653.42097-1-jyc0019@gmail.com

commit 7c0c19c076ffe84b8bcd5f927eb47452837f2c99
Author: Matthew Brost 
Date:   Tue Jan 6 13:34:43 2026 -0800

    drm/xe: Validate preferred system memory placement in xe_svm_range_validate
    
    Ensure preferred system memory placement is checked in
    xe_svm_range_validate when dpagemap is NULL. Without this check, a
    prefetch to system memory may become a no-op because device memory is
    considered a valid placement.
    
    Cc: Thomas Hellström 
    Fixes: 238dbc9d9f4a ("drm/xe: Use the vma attibute drm_pagemap to select where to migrate")
    Signed-off-by: Matthew Brost 
    Reviewed-by: Himal Prasad Ghimiray 
    Link: https://patch.msgid.link/20260106213443.1866797-1-matthew.brost@intel.com

commit aa5f91ce4fd897d7fdc24521650b6de48e834c34
Merge: bc6fe9f0a6430c aca3bbde0fdb26
Author: Arnd Bergmann 
Date:   Wed Jan 7 18:12:47 2026 +0100

    Merge tag 'renesas-dts-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt
    
    Renesas DTS updates for v6.20
    
      - Add USB3.2 host and more RSCI serial support for the RZ/G3E SoC and
        the RZ/G3E SMARC EVK board,
      - Add display and USB3.0 host support for the RZ/V2H and RZ/V2N SoCs
        and their EVK boards,
      - Add SPI NOR Flash support for the Yuridenki-Shokai Kakip board,
      - Add PCIe support for the RZ/G3S SoC and the RZ/G3S SMARC EVK board,
      - Add SPI, interrupt controller, and DMAC support for the RZ/T2H,
        RZ/N2H, and RZ/V2N SoCs,
      - Add NMI wakeup button support for the RZ/V2N EVK board,
      - Add thermal support for the RZ/V2N SoC,
      - Add system watchdog timer support for R-Car V3H, which is reserved
        for secure firmware,
      - Add window watchdog timer support for R-Car V3M, V3H, and Gen4 SoCs,
      - Miscellaneous fixes and improvements.
    
    * tag 'renesas-dts-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (41 commits)
      arm64: dts: renesas: r8a779h0: Add WWDT nodes
      arm64: dts: renesas: r8a779g0: Add WWDT nodes
      arm64: dts: renesas: r8a779f0: Add WWDT nodes
      arm64: dts: renesas: r8a779a0: Add WWDT nodes
      arm64: dts: renesas: r8a77980: Add WWDT nodes
      arm64: dts: renesas: r8a77970: Add WWDT nodes
      arm64: dts: renesas: condor/v3hsk: Mark SWDT as reserved
      arm64: dts: renesas: r8a77980: Add SWDT node
      arm64: dts: renesas: r9a09g056: Add TSU nodes
      arm64: dts: renesas: r9a09g087: Add DMAC support
      arm64: dts: renesas: r9a09g077: Add DMAC support
      arm64: dts: renesas: r9a09g087: Add ICU support
      arm64: dts: renesas: r9a09g077: Add ICU support
      arm64: dts: renesas: r9a09g047e57-smarc: Enable rsci{2,4,9} nodes
      arm64: dts: renesas: renesas-smarc2: Move aliases to board DTS
      arm64: dts: renesas: r9a09g047: Add RSCI nodes
      ARM: dts: renesas: r9a06g032: Add Ethernet switch interrupts
      arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Add NMI wakeup button support
      arm64: dts: renesas: r9a09g056: Add RSPI nodes
      arm64: dts: renesas: r9a09g056: Add DMAC nodes
      ...
    
    Signed-off-by: Arnd Bergmann 

commit 043fc9e961ef088aafc0f545c1efd8620d616c9f
Author: Sk Anirban 
Date:   Tue Dec 23 15:46:06 2025 +0530

    drm/i915/selftest: Add throttle reason diagnostics to RPS selftests
    
    Report GPU throttle reasons when RPS tests fail to reach expected
    frequencies or power levels.
    
    v2: Read the throttle value before the spinner ends (Raag)
        Add a condition before printing throttle value (Krzysztof)
    v3: Extend throttle reasons debug support (Raag)
    v4: Cosmetic changes (Raag)
    
    Signed-off-by: Sk Anirban 
    Reviewed-by: Raag Jadav 
    Reviewed-by: Krzysztof Karas 
    Link: https://patch.msgid.link/20251223101605.3304379-2-sk.anirban@intel.com
    Signed-off-by: Matt Roper 

commit bc6fe9f0a6430ccd732e0f9726f5747c99aa31b4
Merge: 12e491d4f735c7 459a5aa171c0f1
Author: Arnd Bergmann 
Date:   Wed Jan 7 18:05:51 2026 +0100

    Merge tag 'aspeed-6.20-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt
    
    First batch of ASPEED Arm devicetree changes for 6.20
    
    New platforms:
    
    - NVIDIA MSX4 BMC
    
      The NVIDIA MSX4 HPM (host platform module) is a reference board for
      managing up to 8 PCIe connected NVIDIA GPUs via ConnectX-8 (CX8)
      SuperNICs. The BMC manages all GPUs and CX8s for both telemetry and
      firmware update via MCTP over USB. The host CPUs are dual socket Intel
      Granite Rapids processors.
    
      For more detail on this architecture:
    
      https://developer.nvidia.com/blog/nvidia-connectx-8-supernics-advance-ai-platform-architecture-with-pcie-gen6-connectivity/
    
    Updated platforms:
    
    - ast2600-evb (ASPEED): Various tidy-ups to address binding warnings
    - bletchley (Meta): Watchdog fix, tidy-ups to address binding warnings
    - clemente (Meta): HDD LED fix, GPIO line names, EEPROMs
    - harma (Meta): fanboard presence GPIO
    - santabarbara (Meta): IPMB, GPIO line names, additional IO expander
    
    * tag 'aspeed-6.20-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux:
      ARM: dts: aspeed: bletchley: Fix ADC vref property names
      ARM: dts: aspeed: bletchley: Remove unused i2c13 property
      ARM: dts: aspeed: bletchley: Remove unused pca9539 properties
      ARM: dts: aspeed: bletchley: Fix SPI GPIO property names
      ARM: dts: aspeed: bletchley: Use generic node names
      ARM: dts: aspeed: g6: Drop clocks property from arm,armv7-timer
      ARM: dts: aspeed: ast2600-evb: Tidy up A0 work-around for UART5
      ARM: dts: aspeed: g6: Drop unspecified aspeed,ast2600-udma node
      ARM: dts: aspeed: Drop syscon compatible from EDAC in g6 dtsi
      ARM: dts: aspeed: Use specified wp-inverted property for AST2600 EVB
      ARM: dts: aspeed: Remove sdhci-drive-type property from AST2600 EVB
      ARM: dts: aspeed: Add NVIDIA MSX4 HPM
      dt-bindings: arm: aspeed: Add NVIDIA MSX4 board
      ARM: dts: aspeed: clemente: move hdd_led to its own gpio-leds group
      ARM: dts: aspeed: clemente: add gpio line name to io expander
      ARM: dts: aspeed: santabarbara: Enable ipmb device for OCP debug card
      ARM: dts: aspeed: santabarbara: Add swb IO expander and gpio line names
      ARM: dts: aspeed: clemente: Add EEPROMs for boot and data drive FRUs
      ARM: dts: aspeed: harma: add fanboard presence sgpio
      ARM: dts: aspeed: bletchley: remove WDTRST1 assertion from wdt1
    
    Signed-off-by: Arnd Bergmann 

commit 12e491d4f735c7003b73afe6597fb5b223e35b91
Merge: f8f9c1f4d0c7a6 37c3a91e9730e2
Author: Arnd Bergmann 
Date:   Wed Jan 7 18:03:06 2026 +0100

    Merge tag 'arm-soc/for-6.19/devicetree-arm64' of https://github.com/Broadcom/stblinux into soc/dt
    
    This pull request contains Broadcom ARM64-based SoCs Device Tre updates
    for 6.19, please pull the following:
    
    - Peter enables the random number generator on BCM2712
    
    - Stanimir adds the watchdog Device Tree node for BCM2712
    
    * tag 'arm-soc/for-6.19/devicetree-arm64' of https://github.com/Broadcom/stblinux:
      arm64: dts: broadcom: bcm2712: Add watchdog DT node
      arm64: dts: broadcom: bcm2712: Enable RNG
    
    Signed-off-by: Arnd Bergmann 

commit f126d688193b4dd6d0044c19771469724c03f8f8
Author: Thomas Weißschuh 
Date:   Wed Jan 7 09:59:34 2026 +0800

    kunit: tool: test: Don't rely on implicit working directory change
    
    If no kunitconfig_paths are passed to LinuxSourceTree() it falls back to
    DEFAULT_KUNITCONFIG_PATH. This resolution only works when the current
    working directory is the root of the source tree. This works by chance
    when running the full testsuite through the default unittest runner, as
    some tests will change the current working directory as a side-effect of
    'kunit.main()'. When running a single testcase or using pytest, which
    resets the working directory for each test, this assumption breaks.
    
    Explicitly specify an empty kunitconfig for the affected tests.
    
    Link: https://lore.kernel.org/r/20260107015936.2316047-2-davidgow@google.com
    Signed-off-by: Thomas Weißschuh 
    Reviewed-by: David Gow 
    Signed-off-by: David Gow 
    Signed-off-by: Shuah Khan 

commit 1cabad3a00ab2e3d6bf19c5ab8fc9212d0b81e18
Author: Thomas Weißschuh 
Date:   Wed Jan 7 09:59:33 2026 +0800

    kunit: tool: test: Rename test_data_path() to _test_data_path()
    
    Running the KUnit testsuite through pytest fails, as the function
    test_data_path() is recognized as a test function. Its execution fails
    as pytest tries to resolve the 'path' argument as a fixture which does
    not exist.
    
    Rename the function, so the helper function is not incorrectly
    recognized as a test function.
    
    Link: https://lore.kernel.org/r/20260107015936.2316047-1-davidgow@google.com
    Signed-off-by: Thomas Weißschuh 
    Reviewed-by: David Gow 
    Signed-off-by: David Gow 
    Signed-off-by: Shuah Khan 

commit dd1aadd29de3645c08a160c3b3cfc0d7a5c9bf35
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 13:46:52 2026 -0600

    arm64: dts: marvell: change regulator-gpio to regulator-fixed
    
    A "regulator-gpio" must have a GPIO control, hence the name. There's no
    GPIO on a couple of Marvell platforms at least as far as the DT is
    defined, so change the regulator type from GPIO to fixed.
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Gregory CLEMENT 

commit e509bd563114c3730bf4be48436a4741c0ab4dc9
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 13:46:46 2026 -0600

    arm64: dts: marvell: cn9131-cf-solidwan: Add missing GPIO properties on "nxp,pca9536"
    
    The PCA9536 is always a GPIO provider, so add the missing properties.
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Gregory CLEMENT 

commit 5336444472700244147b04601235ca8b7fd1ec16
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 13:46:41 2026 -0600

    arm64: dts: marvell: Fix stray and typo "pinctrl-names" properties
    
    There's several cases of "pinctrl-names" used without any "pinctrl-0"
    properties. Drop them.
    
    Fix the typo "pintrl-names" as well.
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Gregory CLEMENT 

commit e8061ea925314c57248fafc1d0c30b8dc39e23b6
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 13:46:34 2026 -0600

    arm64: dts: marvell: Add missing "#phy-cells" to "usb-nop-xceiv"
    
    The "usb-nop-xceiv" binding requires "#phy-cells" property with a value
    of 0 though it is not really used. Add it where missing from Marvell
    platforms.
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Gregory CLEMENT 

commit 685ec348339b118bec728458d0bc3b3e7da1ef0d
Author: Taniya Das 
Date:   Wed Jan 7 15:13:14 2026 +0530

    clk: qcom: Add support for GPUCC and GXCLK for Kaanapali
    
    Support the graphics clock controller for Kaanapali for Graphics SW
    driver to use the clocks. GXCLKCTL (Graphics GX Clock Controller) is a
    block dedicated to managing clocks for the GPU subsystem on GX power
    domain. The GX clock controller driver manages only the GX GDSC and the
    rest of the resources of the controller are managed by the firmware.
    
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-11-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a4ceaf4b18dd4310c17852efbf880e1c5cd5dc36
Author: Taniya Das 
Date:   Wed Jan 7 15:13:13 2026 +0530

    clk: qcom: Add support for VideoCC driver for Kaanapali
    
    Enable Kaanapali video clock driver for video SW to be able to control
    the clocks from the Video SW driver.
    
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-10-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 92aae35f667cd62359f5938e3259dc72e080e28c
Author: Taniya Das 
Date:   Wed Jan 7 15:13:12 2026 +0530

    clk: qcom: camcc: Add support for camera clock controller for Kaanapali
    
    Add support for the Camera Clock Controller (CAMCC) on the Kaanapali
    platform.
    
    The CAMCC block on Kaanapali includes both the primary camera clock
    controller and the Camera BIST clock controller, which provides the
    functional MCLK required for camera operations.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-9-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 6c6750b7061ca5b12deaeb246439b5b64a84f9c1
Author: Taniya Das 
Date:   Wed Jan 7 15:13:11 2026 +0530

    clk: qcom: dispcc: Add support for display clock controller Kaanapali
    
    Support the clock controller driver for Kaanapali to enable display SW to
    be able to control the clocks.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-8-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 6d3e77facbce8e684321d9ba65137a76f2575372
Author: Taniya Das 
Date:   Wed Jan 7 15:13:05 2026 +0530

    clk: qcom: clk-alpha-pll: Add support for controlling Pongo EKO_T PLL
    
    Add clock ops for Pongo EKO_T PLL, add the pll ops for supporting
    the PLL.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Taniya Das 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-2-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 0f85ef379064b50ad573c6af4c0ffd39673f6968
Author: Taniya Das 
Date:   Wed Jan 7 15:13:04 2026 +0530

    clk: qcom: clk-alpha-pll: Update the PLL support for cal_l
    
    Recent QCOM PLLs require the CAL_L field to be programmed according to
    specific hardware recommendations, rather than using the legacy default
    value of 0x44. Hardcoding this value can lead to suboptimal or incorrect
    behavior on newer platforms.
    
    To address this, introduce a `cal_l` field in the PLL configuration
    structure, allowing CAL_L to be set explicitly based on platform
    requirements. This improves flexibility and ensures correct PLL
    initialization across different hardware variants.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-1-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 86f5c81f24610943844613c865318cc2fc0e5776
Merge: f9580bafd39cff ecc3adefa72748
Author: Bjorn Andersson 
Date:   Wed Jan 7 09:42:21 2026 -0600

    Merge branch '20260107-kaanapali-mmcc-v3-v3-0-8e10adc236a8@oss.qualcomm.com' into clk-for-6.20
    
    Merge the Kaanapali camera, display, GPU, and video clock controller
    bindings through a topic branch, to allow making them available to the
    DeviceTree branch as well.

commit f9580bafd39cff31bd51031e8784ea44acddf20e
Author: Taniya Das 
Date:   Tue Dec 2 15:56:27 2025 +0530

    clk: qcom: camcc: Add camera clock controller driver for SM8750 SoC
    
    Add support for the Camera Clock Controller (CAMCC) on the SM8750
    platform.
    
    The CAMCC block on SM8750 includes both the primary camera clock
    controller and the Camera BIST clock controller, which provides the
    functional MCLK required for camera operations.
    
    Signed-off-by: Taniya Das 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251202-sm8750_camcc-v1-3-b3f7ef6723f1@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a419f7bfb714703b9c12fab387b60cb0e0f7ec47
Author: Taniya Das 
Date:   Tue Dec 2 15:56:25 2025 +0530

    clk: qcom: clk-alpha-pll: Add support for controlling Rivian PLL
    
    Add clock ops for Rivian ELU and EKO_T PLLs, add the register offsets
    for the Rivian ELU PLL. Since ELU and EKO_T shared the same offsets and
    PLL ops, reuse the Rivian EKO_T enum.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Taniya Das 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-3-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit ecc3adefa72748845c63d32e97c56f65560f30ad
Author: Taniya Das 
Date:   Wed Jan 7 15:13:10 2026 +0530

    dt-bindings: clock: qcom: document the Kaanapali GPU Clock Controller
    
    Qualcomm GX(graphics) is a clock controller which has PLLs, clocks and
    Power domains (GDSC), but the requirement from the SW driver is to use
    the GDSC power domain from the clock controller to recover the GPU
    firmware in case of any failure/hangs. The rest of the resources of the
    clock controller are being used by the firmware of GPU. This module
    exposes the GDSC power domains which helps the recovery of Graphics
    subsystem.
    
    Add bindings documentation for the Kaanapali Graphics Clock and Graphics
    power domain Controller for Kaanapali SoC.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-7-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e043131550c4e1f35bf959a35c30c223b6ff5602
Author: Taniya Das 
Date:   Wed Jan 7 15:13:09 2026 +0530

    dt-bindings: clock: qcom: Add Kaanapali video clock controller
    
    Add device tree bindings for the video clock controller on Qualcomm
    Kaanapali SoC.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-6-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 9d566b0431d3d5b9c588eb000dbee5138e6a31cd
Author: Taniya Das 
Date:   Wed Jan 7 15:13:08 2026 +0530

    dt-bindings: clock: qcom: Add support for CAMCC for Kaanapali
    
    Update the compatible and the bindings for CAMCC support on Kaanapali
    SoC.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-5-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 322aad122ce3eebd70e5c07f62cf9081919a30ca
Author: Taniya Das 
Date:   Wed Jan 7 15:13:07 2026 +0530

    dt-bindings: clock: qcom: document Kaanapali DISPCC clock controller
    
    Document device tree bindings for display clock controller for
    Qualcomm Kaanapali SoC.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260107-kaanapali-mmcc-v3-v3-4-8e10adc236a8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 6ff40ddbb4f97c953ecfe044bb7bd175d36f3b15
Merge: 04c4dc1f541135 82efed175bfa23
Author: Bjorn Andersson 
Date:   Wed Jan 7 09:37:15 2026 -0600

    Merge branch '20251202-sm8750_camcc-v1-2-b3f7ef6723f1@oss.qualcomm.com' into clk-for-6.20
    
    Merge the SM8750 camera clock controller binding through a topic branch,
    in order to allow the defines to made availabe to the DeviceTree
    branch as well.

commit 82efed175bfa238035664a3b0f1f53d75f695a6b
Author: Taniya Das 
Date:   Tue Dec 2 15:56:26 2025 +0530

    dt-bindings: clock: qcom: Add camera clock controller for SM8750 SoC
    
    Add device tree bindings for the camera clock controller on
    Qualcomm SM8750 platform. The camera clock controller is split between
    camcc and cambist. The cambist controls the mclks of the camera clock
    controller.
    
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20251202-sm8750_camcc-v1-2-b3f7ef6723f1@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 04c4dc1f541135708d90a9b4632af51136f93ac3
Author: George Moussalem 
Date:   Fri Nov 28 15:03:19 2025 +0400

    clk: qcom: gcc-ipq5018: flag sleep clock as critical
    
    The sleep clock never be disabled. To avoid the kernel trying to disable
    it and keep it always on, flag it as critical.
    
    Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
    Signed-off-by: George Moussalem 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251128-ipq5018-sleep-clk-fix-v1-1-6f4b75ec336c@outlook.com
    Signed-off-by: Bjorn Andersson 

commit e4eb42f290aecac0ba355b1f8d7243be6de11f32
Author: Barnabás Czémán 
Date:   Mon Nov 17 18:58:48 2025 +0100

    clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
    
    cpp_gdsc should not be always on, ALWAYS_ON flag was set accidentally.
    
    Fixes: 33cc27a47d3a ("clk: qcom: Add global clock controller driver for MSM8917")
    Signed-off-by: Barnabás Czémán 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251117-fix-gdsc-cpp-msm8917-msm8953-v1-2-db33adcff28a@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit 5f613e7034187179a9d088ff5fd02b1089d0cf20
Author: Barnabás Czémán 
Date:   Mon Nov 17 18:58:47 2025 +0100

    clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
    
    cpp_gdsc should not be always on, ALWAYS_ON flag was set accidentally.
    
    Fixes: 9bb6cfc3c77e ("clk: qcom: Add Global Clock Controller driver for MSM8953")
    Signed-off-by: Barnabás Czémán 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251117-fix-gdsc-cpp-msm8917-msm8953-v1-1-db33adcff28a@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit a6df111d55ffea7926fc7b136f96f16b314ad362
Author: Daniil Titov 
Date:   Mon Nov 17 17:57:09 2025 +0100

    clk: qcom: gcc: Add support for Global Clock controller found on SDM439
    
    Modify existing MSM8917 driver to support SDM439 SoC. SDM439 SoC has the
    same changes as MSM8937 SoC, but with different gpll3 vco rate and
    different GFX3D clock frequency table.
    
    Signed-off-by: Daniil Titov 
    Signed-off-by: Barnabás Czémán 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251117-gcc-msm8940-sdm439-v2-4-4af57c8bc7eb@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit 7a5a8a67c06ecba23d547a57d9fd317f628e1790
Author: Barnabás Czémán 
Date:   Mon Nov 17 17:57:08 2025 +0100

    dt-bindings: clock: qcom: Add SDM439 Global Clock Controller
    
    Add devicetree bindings for the global clock controller on Qualcomm
    SDM439 platform.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Barnabás Czémán 
    Link: https://lore.kernel.org/r/20251117-gcc-msm8940-sdm439-v2-3-4af57c8bc7eb@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit b97a6150050c7274d72a349afe017fb1fed34799
Author: Daniil Titov 
Date:   Mon Nov 17 17:57:07 2025 +0100

    clk: qcom: gcc: Add support for Global Clock controller found on MSM8940
    
    Modify existing MSM8917 driver to support MSM8940 SoC. MSM8940 SoC has the
    same changes as MSM8937 SoC, but with additional IPA clk and different
    GFX3D clock frequency table.
    
    Signed-off-by: Daniil Titov 
    Signed-off-by: Barnabás Czémán 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251117-gcc-msm8940-sdm439-v2-2-4af57c8bc7eb@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit d88d5bedb502eed6f439838b1e6148942a9232b7
Author: Barnabás Czémán 
Date:   Mon Nov 17 17:57:06 2025 +0100

    dt-bindings: clock: qcom: Add MSM8940 Global Clock Controller
    
    Add devicetree bindings for the global clock controller on Qualcomm
    MSM8940 platform.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Barnabás Czémán 
    Link: https://lore.kernel.org/r/20251117-gcc-msm8940-sdm439-v2-1-4af57c8bc7eb@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit 4df89cb826e0a2d5986a555703af1f98688ca2bf
Author: Beleswar Padhi 
Date:   Tue Jan 6 16:17:53 2026 +0530

    dt-bindings: remoteproc: Add HSM M4F core on TI K3 SoCs
    
    Some of the TI K3 family of SoCs have a HSM (High Security Module) M4F
    core in the Wakeup Voltage Domain which could be used to run secure
    services like Authentication. Add the device tree bindings document for
    this HSM M4F core.
    
    The added example illustrates the DT node for the HSM core present on K3
    J722S SoC.
    
    Signed-off-by: Beleswar Padhi 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20260106104755.948086-2-b-padhi@ti.com
    Signed-off-by: Mathieu Poirier 

commit 8b7f2aa05c02c13aa017a70401b5f8a3ce0c0f57
Author: Konrad Dybcio 
Date:   Fri Jun 27 21:37:55 2025 +0200

    arm64: dts: qcom: qcs615: Drop IPA interconnects
    
    In the same spirit as e.g. Commit 6314184be391 ("arm64: dts: qcom:
    sc8180x: Drop ipa-virt interconnect") drop the resources that should
    be taken care of through the clk-rpmh driver.
    
    Signed-off-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20250627-topic-qcs615_icc_ipa-v1-1-dc47596cde69@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 56a512a9b4107079f68701e7d55da8507eb963d9
Author: Kuen-Han Tsai 
Date:   Tue Dec 30 18:13:16 2025 +0800

    usb: gadget: f_ncm: align net_device lifecycle with bind/unbind
    
    Currently, the net_device is allocated in ncm_alloc_inst() and freed in
    ncm_free_inst(). This ties the network interface's lifetime to the
    configuration instance rather than the USB connection (bind/unbind).
    
    This decoupling causes issues when the USB gadget is disconnected where
    the underlying gadget device is removed. The net_device can outlive its
    parent, leading to dangling sysfs links and NULL pointer dereferences
    when accessing the freed gadget device.
    
    Problem 1: NULL pointer dereference on disconnect
     Unable to handle kernel NULL pointer dereference at virtual address
     0000000000000000
     Call trace:
       __pi_strlen+0x14/0x150
       rtnl_fill_ifinfo+0x6b4/0x708
       rtmsg_ifinfo_build_skb+0xd8/0x13c
       rtmsg_ifinfo+0x50/0xa0
       __dev_notify_flags+0x4c/0x1f0
       dev_change_flags+0x54/0x70
       do_setlink+0x390/0xebc
       rtnl_newlink+0x7d0/0xac8
       rtnetlink_rcv_msg+0x27c/0x410
       netlink_rcv_skb+0x134/0x150
       rtnetlink_rcv+0x18/0x28
       netlink_unicast+0x254/0x3f0
       netlink_sendmsg+0x2e0/0x3d4
    
    Problem 2: Dangling sysfs symlinks
     console:/ # ls -l /sys/class/net/ncm0
     lrwxrwxrwx ... /sys/class/net/ncm0 ->
     /sys/devices/platform/.../gadget.0/net/ncm0
     console:/ # ls -l /sys/devices/platform/.../gadget.0/net/ncm0
     ls: .../gadget.0/net/ncm0: No such file or directory
    
    Move the net_device allocation to ncm_bind() and deallocation to
    ncm_unbind(). This ensures the network interface exists only when the
    gadget function is actually bound to a configuration.
    
    To support pre-bind configuration (e.g., setting interface name or MAC
    address via configfs), cache user-provided options in f_ncm_opts
    using the gether_opts structure. Apply these cached settings to the
    net_device upon creation in ncm_bind().
    
    Preserve the use-after-free fix from commit 6334b8e4553c ("usb: gadget:
    f_ncm: Fix UAF ncm object at re-bind after usb ep transport error").
    Check opts->net in ncm_set_alt() and ncm_disable() to ensure
    gether_disconnect() runs only if a connection was established.
    
    Fixes: 40d133d7f542 ("usb: gadget: f_ncm: convert to new function interface with backward compatibility")
    Cc: stable@kernel.org
    Signed-off-by: Kuen-Han Tsai 
    Link: https://patch.msgid.link/20251230-ncm-refactor-v1-3-793e347bc7a7@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit 0c0981126b99288ed354d3d414c8a5fd42ac9e25
Author: Kuen-Han Tsai 
Date:   Tue Dec 30 18:13:15 2025 +0800

    usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device
    
    The net_device in the u_ether framework currently requires explicit
    calls to unregister and free the device.
    
    Introduce gether_unregister_free_netdev() and the corresponding
    auto-cleanup macro. This ensures that if a net_device is registered, it
    is properly unregistered and the associated work queue is flushed before
    the memory is freed.
    
    This is a preparatory patch to simplify error handling paths in gadget
    drivers by removing the need for explicit goto labels for net_device
    cleanup.
    
    Signed-off-by: Kuen-Han Tsai 
    Link: https://patch.msgid.link/20251230-ncm-refactor-v1-2-793e347bc7a7@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit e065c6a7e46c2ee9c677fdbf50035323d2de1215
Author: Kuen-Han Tsai 
Date:   Tue Dec 30 18:13:14 2025 +0800

    usb: gadget: u_ether: add gether_opts for config caching
    
    Currently, the net_device is allocated when the function instance is
    created (e.g., in ncm_alloc_inst()). While this allows userspace to
    configure the device early, it decouples the net_device lifecycle from
    the actual USB connection state (bind/unbind). The goal is to defer
    net_device creation to the bind callback to properly align the lifecycle
    with its parent gadget device.
    
    However, deferring net_device allocation would prevent userspace from
    configuring parameters (like interface name or MAC address) before the
    net_device exists.
    
    Introduce a new structure, struct gether_opts, associated with the
    usb_function_instance, to cache settings independently of the
    net_device. These settings include the interface name pattern, MAC
    addresses (device and host), queue multiplier, and address assignment
    type.
    
    New helper functions are added:
    - gether_setup_opts_default(): Initializes struct gether_opts with
      defaults, including random MAC addresses.
    - gether_apply_opts(): Applies the cached options from a struct
      gether_opts to a valid net_device.
    
    To expose these options to userspace, new configfs macros
    (USB_ETHER_OPTS_ITEM and USB_ETHER_OPTS_ATTR_*) are defined in
    u_ether_configfs.h. These attributes are part of the function
    instance's configfs group.
    
    This refactoring is a preparatory step. It allows the subsequent patch
    to safely move the net_device allocation from the instance creation
    phase to the bind phase without losing the ability to pre-configure
    the interface via configfs.
    
    Signed-off-by: Kuen-Han Tsai 
    Link: https://patch.msgid.link/20251230-ncm-refactor-v1-1-793e347bc7a7@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit c5177144b561dd4037a6a225d444b3604afbfbf2
Author: Randy Dunlap 
Date:   Sun Dec 28 11:06:03 2025 -0800

    usb: typec: ucsi: drop an unused Kconfig symbol
    
    EXTCON_TCSS_CROS_EC isn't used anywhere else in the kernel tree,
    so drop it from this Kconfig file.
    
    (unless it should be EXTCON_USBC_CROS_EC ?)
    
    Fixes: f1a2241778d9 ("usb: typec: ucsi: Implement ChromeOS UCSI driver")
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Abhishek Pandit-Subedi 
    Reviewed-by: Benson Leung 
    Link: https://patch.msgid.link/20251228190604.2484082-1-rdunlap@infradead.org
    Signed-off-by: Greg Kroah-Hartman 

commit 830b10853396def4ce1fc03b33623bed01034ebf
Author: Bartosz Golaszewski 
Date:   Tue Jan 6 14:27:05 2026 +0100

    USB: host: drop unneeded dependency on OF_GPIO
    
    The fhci-hcd driver does not really depend on any symbols controlled by
    the OF_GPIO switch. It was probably added by accident so remove it.
    
    Signed-off-by: Bartosz Golaszewski 
    Link: https://patch.msgid.link/20260106132706.45433-1-bartosz.golaszewski@oss.qualcomm.com
    Signed-off-by: Greg Kroah-Hartman 

commit f6d7aa617f11b92d762a52dea63fa59c9de7e79a
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 10:24:16 2026 -0600

    dt-bindings: usb: Add Socionext Uniphier DWC3 controller
    
    The Socionext Uniphier DWC3 controller binding is already in use, but
    undocumented. It's a straight-forward binding similar to other DWC3
    bindings.
    
    Signed-off-by: Rob Herring (Arm) 
    Reviewed-by: Kunihiko Hayashi 
    Link: https://patch.msgid.link/20260105162418.2842825-1-robh@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit 6708b117cc49d9d1615c3b1e2ac3611a11b511c5
Author: Robert Marko 
Date:   Mon Dec 29 19:37:42 2025 +0100

    dt-bindings: usb: Add Microchip LAN969x support
    
    Microchip LAN969x has DWC3 compatible controller, though limited to 2.0(HS)
    speed, so document it.
    
    Signed-off-by: Robert Marko 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251229184004.571837-2-robert.marko@sartura.hr
    Signed-off-by: Greg Kroah-Hartman 

commit 090a6c69611b4f3af237814b6fa012a084864589
Author: Krishna Kurapati 
Date:   Sat Dec 27 20:22:24 2025 +0530

    usb: gadget: f_sourcesink: Support maxburst configurability for bulk endpoints
    
    Add support to configure maxburst via configfs for bulk endpoints.
    Update gadget documentation describing the new configfs property.
    
    Signed-off-by: Krishna Kurapati 
    Link: https://patch.msgid.link/20251227145224.2091397-1-krishna.kurapati@oss.qualcomm.com
    Signed-off-by: Greg Kroah-Hartman 

commit 6e0e8375f2e6854e8c35faa638f4448e3b8209af
Author: Vladimir Zapolskiy 
Date:   Fri Dec 26 02:02:37 2025 +0200

    usb: isp1362-hcd: remove Philips ISP1362 USB OTG controller driver
    
    The last user of the platform driver was a Blackfin BF533 powered board,
    and it was removed in commit 4ba66a976072 ("arch: remove blackfin port")
    along with the whole Blackfin architecture support 7 years ago.
    
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://patch.msgid.link/20251226000237.1440642-1-vz@mleia.com
    Signed-off-by: Greg Kroah-Hartman 

commit 065a923dd5837ff7dc87419c5755e26d5b111f3a
Author: Andy Yan 
Date:   Mon Dec 29 09:16:22 2025 +0800

    USB: typec: tcpm: Fix a typo
    
    There should be a space between the two words: Responder and supports.
    
    Signed-off-by: Andy Yan 
    Link: https://patch.msgid.link/20251229011624.146700-1-andyshrk@163.com
    Signed-off-by: Greg Kroah-Hartman 

commit a4233c21e77375494223ade11da72523a0149d97
Author: Juergen Gross 
Date:   Mon Jan 5 09:04:52 2026 +0100

    x86/alternative: Patch a single alternative location only once
    
    Instead of patching a single location potentially multiple times in case of
    nested ALTERNATIVE()s, do the patching only after having evaluated all
    alt_instr instances for that location.
    
    This has multiple advantages:
    
    - In case of replacing an indirect with a direct call using the
      ALT_FLAG_DIRECT_CALL flag, there is no longer the need to have that
      instance before any other instances at the same location (the
      original instruction is needed for finding the target of the direct
      call).
      This issue has been hit when trying to do paravirt patching similar
      to the following:
        ALTERNATIVE_2(PARAVIRT_CALL,    // indirect call
                      instr, feature,   // native instruction
                      ALT_CALL_INSTR, X86_FEATURE_XENPV)  // Xen function
      In case "feature" was true, "instr" replaced the indirect call. Under
      Xen PV the patching to have a direct call failed, as the original
      indirect call was no longer there to find the call target.
    
    - In case of nested ALTERNATIVE()s there is no intermediate replacement
      visible. This avoids any problems in case e.g. an interrupt is
      happening between the single instances and the patched location is
      used during handling the interrupt.
    
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260105080452.5064-3-jgross@suse.com

commit 13f2bd893ae3638c96e7c54a6e477dbceec6e529
Author: Danilo Krummrich 
Date:   Mon Jan 5 15:19:45 2026 +0100

    rust: usb: use "kernel vertical" style for imports
    
    Convert all imports to use "kernel vertical" style.
    
    With this, subsequent patches neither introduce unrelated changes nor
    leave an inconsistent import pattern.
    
    While at it, drop unnecessary imports covered by prelude::*.
    
    Link: https://docs.kernel.org/rust/coding-guidelines.html#imports
    Signed-off-by: Danilo Krummrich 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20260105142123.95030-4-dakr@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit d0f6fc3f7abab441377d5a7f46f11cb981a1679f
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:37 2026 +0000

    rust: usb: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Reviewed-by: Daniel Almeida 
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20260105-define-rust-helper-v2-24-51da5f454a67@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit d5639a6d72810023d257c935cb763aea1ada1abc
Author: Jagadeesh Kona 
Date:   Thu Nov 27 23:27:43 2025 +0530

    clk: qcom: gcc-glymur: Update the SDCC RCGs to use shared_floor_ops
    
    Use shared_floor_ops for the SDCC RCGs so the RCG is safely parked
    during disable and the new parent configuration is programmed in
    hardware only when the new parent is enabled, avoiding cases where
    the RCG configuration fails to update.
    
    Fixes: efe504300a17 ("clk: qcom: gcc: Add support for Global Clock Controller")
    Signed-off-by: Jagadeesh Kona 
    Reviewed-by: Imran Shaik 
    Reviewed-by: Taniya Das 
    Reviewed-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20251127-sdcc_shared_floor_ops-v2-8-473afc86589c@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 947c4b326c1f4dc64aed42170b39c2cf551ba8ca
Author: Jagadeesh Kona 
Date:   Thu Nov 27 23:27:42 2025 +0530

    clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
    
    Use shared_floor_ops for the SDCC RCGs so the RCG is safely parked
    during disable and the new parent configuration is programmed in
    hardware only when the new parent is enabled, avoiding cases where
    the RCG configuration fails to update.
    
    Fixes: baa316580013 ("clk: qcom: gcc-qdu1000: Update the SDCC clock RCG ops")
    Signed-off-by: Jagadeesh Kona 
    Reviewed-by: Imran Shaik 
    Reviewed-by: Taniya Das 
    Reviewed-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20251127-sdcc_shared_floor_ops-v2-7-473afc86589c@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a468047c4e1c56783204a3ac551b843b4277c8fc
Author: Jagadeesh Kona 
Date:   Thu Nov 27 23:27:41 2025 +0530

    clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
    
    Use shared_floor_ops for the SDCC RCGs so the RCG is safely parked
    during disable and the new parent configuration is programmed in
    hardware only when the new parent is enabled, avoiding cases where
    the RCG configuration fails to update.
    
    Fixes: 161b7c401f4b ("clk: qcom: Add Global Clock controller (GCC) driver for X1E80100")
    Signed-off-by: Jagadeesh Kona 
    Reviewed-by: Imran Shaik 
    Reviewed-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20251127-sdcc_shared_floor_ops-v2-6-473afc86589c@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 08da8d7dabb161cea14c6d3ad9b5037aaf6d4b7e
Author: Jagadeesh Kona 
Date:   Thu Nov 27 23:27:40 2025 +0530

    clk: qcom: gcc-milos: Update the SDCC RCGs to use shared_floor_ops
    
    Use shared_floor_ops for the SDCC RCGs to avoid any overclocking
    issues in SDCC usecases.
    
    Fixes: 88174d5d9422 ("clk: qcom: Add Global Clock controller (GCC) driver for Milos")
    Reviewed-by: Taniya Das 
    Reviewed-by: Imran Shaik 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Jagadeesh Kona 
    Link: https://lore.kernel.org/r/20251127-sdcc_shared_floor_ops-v2-5-473afc86589c@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 4b057462bb61a6571608ba393e6e018c9da9c9c3
Author: Jagadeesh Kona 
Date:   Thu Nov 27 23:27:39 2025 +0530

    clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
    
    Use shared_floor_ops for the SDCC RCGs so the RCG is safely parked
    during disable and the new parent configuration is programmed in
    hardware only when the new parent is enabled, avoiding cases where
    the RCG configuration fails to update.
    
    Fixes: 108cdc09b2de ("clk: qcom: Add GCC driver support for SDX75")
    Reviewed-by: Taniya Das 
    Reviewed-by: Imran Shaik 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Jagadeesh Kona 
    Link: https://lore.kernel.org/r/20251127-sdcc_shared_floor_ops-v2-4-473afc86589c@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 458e8a082186335380a9ab83003a385aec9bb254
Author: Jagadeesh Kona 
Date:   Thu Nov 27 23:27:38 2025 +0530

    clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
    
    Use shared_floor_ops for the SDCC RCGs so the RCG is safely parked
    during disable and the new parent configuration is programmed in
    hardware only when the new parent is enabled, avoiding cases where
    the RCG configuration fails to update.
    
    Fixes: c32c4ef98bac ("clk: qcom: Add GCC driver support for SM4450")
    Reviewed-by: Taniya Das 
    Reviewed-by: Imran Shaik 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Jagadeesh Kona 
    Link: https://lore.kernel.org/r/20251127-sdcc_shared_floor_ops-v2-3-473afc86589c@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a7231d4aa084e485394f9214ec9bcb2d1f65dde9
Author: Jagadeesh Kona 
Date:   Thu Nov 27 23:27:37 2025 +0530

    clk: qcom: gcc-sm8750: Update the SDCC RCGs to use shared_floor_ops
    
    Use shared_floor_ops for the SDCC RCGs so the RCG is safely parked
    during disable and the new parent configuration is programmed in
    hardware only when the new parent is enabled, avoiding cases where
    the RCG configuration fails to update.
    
    Fixes: 3267c774f3ff ("clk: qcom: Add support for GCC on SM8750")
    Reviewed-by: Taniya Das 
    Reviewed-by: Imran Shaik 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Jagadeesh Kona 
    Link: https://lore.kernel.org/r/20251127-sdcc_shared_floor_ops-v2-2-473afc86589c@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 89428516f99572a9c37ebbb7859595881e7025a0
Author: Jagadeesh Kona 
Date:   Thu Nov 27 23:27:36 2025 +0530

    clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
    
    Use shared_floor_ops for the SDCC RCGs so the RCG is safely parked
    during disable and the new parent configuration is programmed in
    hardware only when the new parent is enabled, avoiding cases where
    the RCG configuration fails to update.
    
    Fixes: a27ac3806b0a ("clk: qcom: gcc-sm8450: Use floor ops for SDCC RCGs")
    Reviewed-by: Taniya Das 
    Reviewed-by: Imran Shaik 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Jagadeesh Kona 
    Link: https://lore.kernel.org/r/20251127-sdcc_shared_floor_ops-v2-1-473afc86589c@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 15f506a77ad61ac3273ade9b7ef87af9bdba22ad
Author: Ming Lei 
Date:   Wed Dec 31 11:00:57 2025 +0800

    io_uring: remove nr_segs recalculation in io_import_kbuf()
    
    io_import_kbuf() recalculates iter->nr_segs to reflect only the bvecs
    needed for the requested byte range. This was added to provide an
    accurate segment count to bio_iov_bvec_set(), which copied nr_segs to
    bio->bi_vcnt for use as a bio split hint.
    
    The previous two patches eliminated this dependency:
     - bio_may_need_split() now uses bi_iter instead of bi_vcnt for split
       decisions
     - bio_iov_bvec_set() no longer copies nr_segs to bi_vcnt
    
    Since nr_segs is no longer used for bio split decisions, the
    recalculation loop is unnecessary. The iov_iter already has the correct
    bi_size to cap iteration, so an oversized nr_segs is harmless.
    
    Link: https://lkml.org/lkml/2025/4/16/351
    Signed-off-by: Ming Lei 
    Reviewed-by: Nitesh Shetty 
    Signed-off-by: Jens Axboe 

commit 641864314866dff382f64cd8b52fd6bf4c4d84f6
Author: Ming Lei 
Date:   Wed Dec 31 11:00:56 2025 +0800

    block: don't initialize bi_vcnt for cloned bio in bio_iov_bvec_set()
    
    bio_iov_bvec_set() creates a cloned bio that borrows a bvec array from
    an iov_iter. For cloned bios, bi_vcnt is meaningless because iteration
    is controlled entirely by bi_iter (bi_idx, bi_size, bi_bvec_done), not
    by bi_vcnt. Remove the incorrect bi_vcnt assignment.
    
    Explicitly initialize bi_iter.bi_idx to 0 to ensure iteration starts
    at the first bvec. While bi_idx is typically already zero from bio
    initialization, making this explicit improves clarity and correctness.
    
    This change also avoids accessing iter->nr_segs, which is an iov_iter
    implementation detail that block code should not depend on.
    
    Signed-off-by: Ming Lei 
    Reviewed-by: Nitesh Shetty 
    Signed-off-by: Jens Axboe 

commit ee623c892aa59003fca173de0041abc2ccc2c72d
Author: Ming Lei 
Date:   Wed Dec 31 11:00:55 2025 +0800

    block: use bvec iterator helper for bio_may_need_split()
    
    bio_may_need_split() uses bi_vcnt to determine if a bio has a single
    segment, but bi_vcnt is unreliable for cloned bios. Cloned bios share
    the parent's bi_io_vec array but iterate over a subset via bi_iter,
    so bi_vcnt may not reflect the actual segment count being iterated.
    
    Replace the bi_vcnt check with bvec iterator access via
    __bvec_iter_bvec(), comparing bi_iter.bi_size against the current
    bvec's length. This correctly handles both cloned and non-cloned bios.
    
    Move bi_io_vec into the first cache line adjacent to bi_iter. This is
    a sensible layout since bi_io_vec and bi_iter are commonly accessed
    together throughout the block layer - every bvec iteration requires
    both fields. This displaces bi_end_io to the second cache line, which
    is acceptable since bi_end_io and bi_private are always fetched
    together in bio_endio() anyway.
    
    The struct layout change requires bio_reset() to preserve and restore
    bi_io_vec across the memset, since it now falls within BIO_RESET_BYTES.
    
    Nitesh verified that this patch doesn't regress NVMe 512-byte IO perf [1].
    
    Link: https://lore.kernel.org/linux-block/20251220081607.tvnrltcngl3cc2fh@green245.gost/ [1]
    Signed-off-by: Ming Lei 
    Reviewed-by: Nitesh Shetty 
    Signed-off-by: Jens Axboe 

commit 544b4e15ed106b0e8cd2d584f576e3fda13d8f5f
Author: Juergen Gross 
Date:   Mon Jan 5 09:04:51 2026 +0100

    x86/alternative: Use helper functions for patching alternatives
    
    Tidy up apply_alternatives() by moving the main patching action of a single
    alternative instance into 3 helper functions:
    
    - analyze_patch_site() for selection whether patching should occur or not and
      to handle nested alternatives.
    
    - prep_patch_site() for applying any needed relocations and issuing debug
      prints for the site.
    
    - patch_site() doing the real patching action, including optimization of any
      padding NOPs.
    
    In prep_patch_site() use __apply_relocation() instead of
    text_poke_apply_relocation(), as the NOP optimization is now done in
    patch_site() for all cases.
    
    Suggested-by: Borislav Petkov 
    Signed-off-by: Juergen Gross 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20260105080452.5064-2-jgross@suse.com

commit fb8b8183208d8efe824e8d2c73fb1ab5ad1191fd
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:53 2026 -0300

    rtla: Fix parse_cpu_set() return value documentation
    
    Correct the return value documentation for parse_cpu_set() function
    in utils.c. The comment incorrectly stated that the function returns
    1 on success and 0 on failure, but the actual implementation returns
    0 on success and 1 on failure, following the common error-on-nonzero
    convention used throughout the codebase.
    
    This documentation fix ensures that developers reading the code
    understand the correct return value semantics and prevents potential
    misuse of the function's return value in conditional checks.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-18-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit 33e3c807ab22bd4002640c8fe47fa30fd4f44ca0
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:52 2026 -0300

    rtla: Ensure null termination after read operations in utils.c
    
    Add explicit null termination and buffer initialization for read()
    operations in procfs_is_workload_pid() and get_self_cgroup() functions.
    The read() system call does not null-terminate the data it reads, and
    when the buffer is filled to capacity, subsequent string operations
    will read past the buffer boundary searching for a null terminator.
    
    In procfs_is_workload_pid(), explicitly set buffer[MAX_PATH-1] to '\0'
    to ensure the buffer is always null-terminated before passing it to
    strncmp(). In get_self_cgroup(), use memset() to zero the path buffer
    before reading, which ensures null termination when retval is less than
    MAX_PATH. Additionally, set path[MAX_PATH-1] to '\0' after the read to
    handle the case where the buffer is filled completely.
    
    These defensive buffer handling practices prevent potential buffer
    overruns and align with the ongoing buffer safety improvements across
    the rtla codebase.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-17-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit af2962d68b970b15d8910be2b0386b4f147ed78b
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:51 2026 -0300

    rtla: Make stop_tracing variable volatile
    
    The stop_tracing global variable is accessed from both the signal
    handler context and the main program flow without synchronization.
    This creates a potential race condition where compiler optimizations
    could cache the variable value in registers, preventing the signal
    handler's updates from being visible to other parts of the program.
    
    Add the volatile qualifier to stop_tracing in both common.c and
    common.h to ensure all accesses to this variable bypass compiler
    optimizations and read directly from memory. This guarantees that
    when the signal handler sets stop_tracing, the change is immediately
    visible to the main program loop, preventing potential hangs or
    delayed shutdown when termination signals are received.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-16-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit 02689ae385c5e84874620947ac010cf7b4950375
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:50 2026 -0300

    rtla: Add generated output files to gitignore
    
    The rtla tool generates various output files during testing and
    execution, including custom trace outputs and histogram data. These
    files are artifacts of running the tool with different options and
    should not be tracked in version control.
    
    Add gitignore entries for custom_filename.txt, osnoise_irq_noise_hist.txt,
    osnoise_trace.txt, and timerlat_trace.txt to prevent accidentally
    committing these generated files. This aligns with the existing pattern
    of ignoring build artifacts and generated headers like *.skel.h.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-15-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit a0890f9dbd24b302d327fe7dad9b9c5be0e278aa
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:48 2026 -0300

    rtla: Fix NULL pointer dereference in actions_parse
    
    The actions_parse() function uses strtok() to tokenize the trigger
    string, but does not check if the returned token is NULL before
    passing it to strcmp(). If the trigger parameter is an empty string
    or contains only delimiter characters, strtok() returns NULL, causing
    strcmp() to dereference a NULL pointer and crash the program.
    
    This issue can be triggered by malformed user input or edge cases in
    trigger string parsing. Add a NULL check immediately after the strtok()
    call to validate that a token was successfully extracted before using
    it. If no token is found, the function now returns -1 to indicate a
    parsing error.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-13-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit f3cc3e4b5116929ebff27c3b0a565b34ae4969b3
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:47 2026 -0300

    rtla: Remove unused headers
    
    Remove unused includes for  and  to clean up the
    code and reduce unnecessary dependencies.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-12-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit d849f3af1cc7a53e3b150a9bbade8f9629445b36
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:45 2026 -0300

    rtla: Remove redundant memset after calloc
    
    The actions struct is allocated using calloc, which already returns
    zeroed memory. The subsequent memset call to zero the 'present' member
    is therefore redundant.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-10-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit 9bf942f3c370c9b3af639df04cb5f34daf512dab
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:44 2026 -0300

    rtla: Use standard exit codes for result enum
    
    The result enum defines custom values for PASSED, ERROR, and FAILED.
    These values correspond to standard exit codes EXIT_SUCCESS and
    EXIT_FAILURE.
    
    Update the enum to use the standard macros EXIT_SUCCESS and
    EXIT_FAILURE to improve readability and adherence to standard C
    practices.
    
    The FAILED value is implicitly assigned EXIT_FAILURE + 1, so there
    is no need to assign an explicit value.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-9-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit 7e9dfccf8f11c26208211457c4597a466135b56a
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:40 2026 -0300

    rtla: Replace atoi() with a robust strtoi()
    
    The atoi() function does not perform error checking, which can lead to
    undefined behavior when parsing invalid or out-of-range strings. This
    can cause issues when parsing user-provided numerical inputs, such as
    signal numbers, PIDs, or CPU lists.
    
    To address this, introduce a new strtoi() helper function that safely
    converts a string to an integer. This function validates the input and
    checks for overflows, returning a negative value on  failure.
    
    Replace all calls to atoi() with the new strtoi() function and add
    proper error handling to make the parsing more robust and prevent
    potential issues.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-5-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit 648634d17c813b35da775982662e56ea8ce750de
Author: Wander Lairson Costa 
Date:   Tue Jan 6 08:49:39 2026 -0300

    rtla: Introduce for_each_action() helper
    
    The for loop to iterate over the list of actions is used in
    more than one place. To avoid code duplication and improve
    readability, introduce a for_each_action() helper macro.
    
    Replace the open-coded for loops with the new helper.
    
    Signed-off-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20260106133655.249887-4-wander@redhat.com
    Signed-off-by: Tomas Glozar 

commit 2a3a25336b1ba632a0a98249a7d4bbee454065aa
Author: Costa Shulyupin 
Date:   Wed Dec 24 14:50:56 2025 +0200

    tools/rtla: Deduplicate cgroup path opening code
    
    Both set_pid_cgroup() and set_comm_cgroup() functions contain
    identical code for opening the cgroup.procs file.
    
    Extract this common code into a new helper function open_cgroup_procs()
    to reduce code duplication and improve maintainability.
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251224125058.1771519-1-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit 0576be469ef18a9f3460f6f207183033ae8b90c5
Author: Costa Shulyupin 
Date:   Tue Dec 9 12:00:47 2025 +0200

    tools/rtla: Consolidate -H/--house-keeping option parsing
    
    Each rtla tool duplicates parsing of -H/--house-keeping.
    
    Migrate the option parsing from individual tools to the
    common_parse_options().
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251209100047.2692515-8-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit 5cc90b14ee54591b890ad026ad5e01b2960c3a31
Author: Costa Shulyupin 
Date:   Tue Dec 9 12:00:46 2025 +0200

    tools/rtla: Consolidate -P/--priority option parsing
    
    Each rtla tool duplicates parsing of -P/--priority.
    
    Migrate the option parsing from individual tools to the
    common_parse_options().
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251209100047.2692515-7-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit c93c25fca5ab3c27b42f1f941871209573c0b41b
Author: Costa Shulyupin 
Date:   Tue Dec 9 12:00:45 2025 +0200

    tools/rtla: Consolidate -e/--event option parsing
    
    Each rtla tool duplicates parsing of -e/--event.
    
    Migrate the option parsing from individual tools to the
    common_parse_options().
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251209100047.2692515-6-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit 76975581fb0eba03820fe312094981c995c225f9
Author: Costa Shulyupin 
Date:   Tue Dec 9 12:00:44 2025 +0200

    tools/rtla: Consolidate -d/--duration option parsing
    
    Each rtla tool duplicates parsing of -d/--duration.
    
    Migrate the option parsing from individual tools to the
    common_parse_options().
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251209100047.2692515-5-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit fd788c49a90328f5b2edaa87aa5af18648ade718
Author: Costa Shulyupin 
Date:   Tue Dec 9 12:00:43 2025 +0200

    tools/rtla: Consolidate -D/--debug option parsing
    
    Each rtla tool duplicates parsing of -D/--debug.
    
    Migrate the option parsing from individual tools to the
    common_parse_options().
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251209100047.2692515-4-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit edb23c8372222395fd4e4297240cbe2191425dbf
Author: Costa Shulyupin 
Date:   Tue Dec 9 12:00:42 2025 +0200

    tools/rtla: Consolidate -C/--cgroup option parsing
    
    Each rtla tool duplicates parsing of -C/--cgroup.
    
    Migrate the option parsing from individual tools to the
    common_parse_options().
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251209100047.2692515-3-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit 28dc445919bf4019ffdaf65d94bf26ace25d4a5e
Author: Costa Shulyupin 
Date:   Tue Dec 9 12:00:41 2025 +0200

    tools/rtla: Consolidate -c/--cpus option parsing
    
    Each rtla tool duplicates parsing of -c/--cpus.
    
    Migrate the option parsing from individual tools to the
    common_parse_options().
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251209100047.2692515-2-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit 850cd24cb6d648262b994b99e189409b21a2c09b
Author: Costa Shulyupin 
Date:   Tue Dec 9 12:00:40 2025 +0200

    tools/rtla: Add common_parse_options()
    
    Each rtla tool duplicates parsing of many common options. This creates
    maintenance overhead and risks inconsistencies when updating these
    options.
    
    Add common_parse_options() to centralize parsing of options used across
    all tools.
    
    Common options to be migrated in future patches.
    
    Changes since v1:
    - restore opterr
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251209100047.2692515-1-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit 26e1a9bd4dd3c03336b608d8068f045d87c8ee6a
Author: Tomas Glozar 
Date:   Wed Nov 26 15:42:05 2025 +0100

    Documentation/rtla: Document --bpf-action option
    
    Add new option --bpf-action into common_timerlat_options.txt, including
    the format in which it takes the BPF program, and a reference to an
    example.
    
    Link: https://lore.kernel.org/r/20251126144205.331954-8-tglozar@redhat.com
    Signed-off-by: Tomas Glozar 

commit 6627556c16fb1122e71110f57a90a961589ad8bf
Author: Tomas Glozar 
Date:   Wed Nov 26 15:42:04 2025 +0100

    Documentation/rtla: Rename sample/ to example/
    
    The sample/ directory in tools/tracing/rtla was renamed to example/ in
    an earlier commit.
    
    Rename it also in the documentation.
    
    Reviewed-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20251126144205.331954-7-tglozar@redhat.com
    Signed-off-by: Tomas Glozar 

commit fbb8ed6682f84e6e27c798a3117b0bcd4d0623c4
Author: Tomas Glozar 
Date:   Wed Nov 26 15:42:03 2025 +0100

    rtla/tests: Run Test::Harness in verbose mode
    
    Add -v flag to prove command to also print the names of tests that
    succeeded, not only those that failed, to allow easier debugging of the
    test suite.
    
    Also, drop printing the option and value to stdout in
    check_with_osnoise_options, which was a debugging print that was
    accidentally left in the final commit, and which would be otherwise now
    visible in make check output, as stdout is no longer suppressed.
    
    Suggested-by: Crystal Wood 
    Reviewed-by: Wander Lairson Costa 
    Link: https://lore.kernel.org/r/20251126144205.331954-6-tglozar@redhat.com
    Signed-off-by: Tomas Glozar 

commit 5525aebd4e0c6f7d92ec1cb074218bbcf3d46f13
Author: Tomas Glozar 
Date:   Wed Nov 26 15:42:02 2025 +0100

    rtla/tests: Test BPF action program
    
    Add a test that implements a BPF program writing to a test map, which
    is attached to RTLA via --bpf-action to be executed on theshold
    overflow.
    
    A combination of --on-threshold shell with bpftool (which is always
    present if BPF support is enabled) is used to check whether the BPF
    program has executed successfully.
    
    Suggested-by: Crystal Wood 
    Link: https://lore.kernel.org/r/20251126144205.331954-5-tglozar@redhat.com
    Signed-off-by: Tomas Glozar 

commit 0304a3b7ec9a207637ab6f360a41af5fb25e1f44
Author: Tomas Glozar 
Date:   Wed Nov 26 15:42:01 2025 +0100

    rtla/timerlat: Add example for BPF action program
    
    Add an example BPF action program that prints the measured latency to
    the tracefs buffer via bpf_printk().
    
    A new Makefile target, "examples", is added to build the example. In
    addition, "sample/" subfolder is renamed to "example".
    
    If BPF skeleton support is unavailable or disabled, a warning will be
    displayed when building the BPF action program example.
    
    Link: https://lore.kernel.org/r/20251126144205.331954-4-tglozar@redhat.com
    Signed-off-by: Tomas Glozar 

commit f967d1eca7d0bde7c896014577ea876096831c6e
Author: Tomas Glozar 
Date:   Wed Nov 26 15:42:00 2025 +0100

    rtla/timerlat: Add --bpf-action option
    
    Add option --bpf-action that allows the user to attach an external BPF
    program that will be executed via BPF tail call on latency threshold
    overflow.
    
    Executing additional BPF code on latency threshold overflow allows doing
    low-latency and in-kernel troubleshooting of the cause of the overflow.
    
    The option takes an argument, which is a path to a BPF ELF file
    expected to contain a function named "action_handler" in a section named
    "tp/timerlat_action" (the section is necessary for libbpf to assign the
    correct BPF program type to it).
    
    Link: https://lore.kernel.org/r/20251126144205.331954-3-tglozar@redhat.com
    Signed-off-by: Tomas Glozar 

commit 8cd0f08ac72e25e2a048c72d76730676ab0106f3
Author: Tomas Glozar 
Date:   Wed Nov 26 15:41:59 2025 +0100

    rtla/timerlat: Support tail call from BPF program
    
    Add a map to the rtla-timerlat BPF program that holds a file descriptor
    of another BPF program, to be executed on threshold overflow.
    
    timerlat_bpf_set_action() is added as an interface to set the program.
    
    Link: https://lore.kernel.org/r/20251126144205.331954-2-tglozar@redhat.com
    Signed-off-by: Tomas Glozar 

commit a08e012e814d346c191726a877b18901c3bc204f
Author: Costa Shulyupin 
Date:   Mon Nov 24 08:31:46 2025 +0200

    tools/rtla: Add common_usage()
    
    The rtla tools have significant code quadruplication in their usage
    functions. Each tool implements its own version of the same help text
    formatting and option descriptions, leading to maintenance overhead and
    inconsistencies.  Documentation/tools/rtla/common_options.rst lists 14
    common options.
    
    Add common_usage() infrastructure to consolidate help formatting.
    Subsequent patches will extend this to handle other common options.
    
    The refactored output is almost identical to the original, with the
    following changes:
    - add square brackets to specify optionality: `usage: [rtla] ...`
    - remove `-q` from timerlat hist because hist tools don't support it
    - minor spacing
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251124063204.845425-1-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit c219d4ee1d63b772d5fa8ed453b9cec18a9e2f6a
Author: Crystal Wood 
Date:   Wed Nov 12 09:25:29 2025 -0600

    rtla: Set stop threshold after all instances are enabled
    
    This avoids startup races where one of the instances hit a threshold
    before all instances were enabled, and thus tracing stops without
    the relevant event.  In particular, this is not uncommon with the
    tests that set a very tight threshold and then complain if there's
    no analysis.
    
    This also ensures that we don't stop tracing during a warmup.
    
    The downside is a small chance of having an event over the threshold
    early in the output, without stopping on it, which could cause user
    confusion.  This should be less likely if the warmup feature is used, but
    that doesn't eliminate the race window, just the odds of an unusual spike
    right at that moment.
    
    Signed-off-by: Crystal Wood 
    Link: https://lore.kernel.org/r/20251112152529.956778-6-crwood@redhat.com
    Signed-off-by: Tomas Glozar 

commit 0968c81ce9c4b42cfaaee15de53c665064fe7ee3
Author: Ryan Wanner 
Date:   Mon Jan 5 10:59:56 2026 +0100

    pinctrl: at91-pio4: Add sama7d65 pio4 support
    
    Add sama7d65 compatibility string.
    
    Sama7d65 does not have a full last bank of PIO lines similar to the
    Sama7g54 SoC. Sama7d65 only has 14 lines on the last PIO bank not the
    full 32; adjusting the SoC attributes accordingly.
    
    Signed-off-by: Ryan Wanner 
    Signed-off-by: Nicolas Ferre 
    Signed-off-by: Linus Walleij 

commit 6e00258964c3e10e4468cd83368129ca4c4ef1a7
Author: Peng Fan 
Date:   Wed Dec 17 10:40:46 2025 +0800

    pinctrl: imx: Add support for NXP i.MX952
    
    The i.MX952 System Manager (SM) firmware supports the System Control
    Management Interface (SCMI) pinctrl protocol, similar to the i.MX95 SM.
    The base offset for the i.MX952 IOMUXC Daisy input register differs from
    that of the i.MX95. Update the pinctrl-imx-scmi driver to add support for
    i.MX952.
    
    Signed-off-by: Peng Fan 
    Signed-off-by: Linus Walleij 

commit 781609002a77712cfbc0515feb985053320d8ca2
Author: Ranjani Vaidyanathan 
Date:   Wed Dec 17 10:40:45 2025 +0800

    pinctrl: imx: Support NXP scmi extended mux config
    
    i.MX94 has special muxing options for certain pins. Their mux settings
    are not in IOMUXC module. i.MX System Manager Firmware includes new vendor
    defined pinctrl type to SCMI pinctrl driver to handle these pins. The MUX
    value field in the IOMUX table is extended to 16 bits where the lower 8
    bits represent the current IOMUX value and the upper 8 bits represent the
    new extended mux added in i.MX94.
    
    Signed-off-by: Ranjani Vaidyanathan 
    Signed-off-by: Peng Fan 
    Signed-off-by: Linus Walleij 

commit 34f2866b3548608a636a4ab37ede8749f50782f0
Author: Chen-Yu Tsai 
Date:   Thu Dec 25 18:36:13 2025 +0800

    dt-bindings: pinctrl: sunxi: Allow pinmux sub-pattern with leading numbers
    
    The pattern for pinmux node names is typically the peripheral name and
    instance number, followed by pingroup name if there are multiple options.
    
    Normally the instance number is directly appended to the peripheral
    name, like "mmc0" or "i2c2". But if the peripheral name ends with a
    number, then it becomes confusing.
    
    On the A20, the PS2 interface controller has two instances. This
    produces pinmux node names like "ps2-0-pins". Make the sub-pattern
    "[0-9]-" valid to fit this pattern. Avoid having to confusing "ps20-pins"
    name.
    
    Signed-off-by: Chen-Yu Tsai 
    Acked-by: Jernej Skrabec 
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Linus Walleij 

commit 3f20bdf7151834547a85231c28538f49601481ee
Author: Yixun Lan 
Date:   Fri Jan 2 15:00:25 2026 +0800

    pinctrl: spacemit: k3: adjust drive strength and schmitter trigger
    
    K3 SoC expand drive strength to 4 bits which support even larger
    settings table comparing to old SoC generation. Also schmitter trigger
    setting is changed to 1 bit.
    
    Signed-off-by: Yixun Lan 
    Signed-off-by: Linus Walleij 

commit 7412311c4655497b6ab6dd7b802f9390f0f57dc7
Author: Yixun Lan 
Date:   Fri Jan 2 15:00:24 2026 +0800

    pinctrl: spacemit: k3: add initial pin support
    
    For the pinctrl IP of SpacemiT's K3 SoC, it has different register offset
    comparing with previous SoC generation, so introduce a function to do the
    pin to offset mapping. Also add all the pinctrl data.
    
    Signed-off-by: Yixun Lan 
    Signed-off-by: Linus Walleij 

commit 5adaa1a8c08839617e5a6385fe05a8baa63e355f
Author: Yixun Lan 
Date:   Fri Jan 2 15:00:23 2026 +0800

    dt-bindings: pinctrl: spacemit: add K3 SoC support
    
    Add new compatible string for SpacemiT K3 SoC, the pinctrl IP shares
    almost same logic with previous K1 generation, but has different register
    offset and pin configuration, for example the drive strength and
    schmitter trigger settings has been changed.
    
    Signed-off-by: Yixun Lan 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Linus Walleij 

commit c3efac0592f88ab48c8eef028268e6514908be51
Author: Yixun Lan 
Date:   Fri Jan 2 15:00:22 2026 +0800

    dt-bindings: pinctrl: spacemit: convert drive strength to schema format
    
    In order to better extend the pinctrl support for future new SoC, convert
    drive strength setting from free form text to more standard schema format.
    
    Signed-off-by: Yixun Lan 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Linus Walleij 

commit 7bcbedd64ecf5624583140faebfdb0e2e2f6b43e
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:25:12 2025 +0100

    arm64: dts: amlogic: Use lowercase hex
    
    The DTS code coding style expects lowercase hex for values and unit
    addresses.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Martin Blumenstingl 
    Link: https://patch.msgid.link/20251223152510.155463-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Neil Armstrong 

commit 125c3ceadfe02cd4917c5e0bb6707b37870449f2
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:25:11 2025 +0100

    arm64: dts: amlogic: Use hyphen in node names
    
    DTS coding style prefers hyphens instead of underscores in the node
    names.  Change should be safe, because node names are not considered an
    ABI.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Martin Blumenstingl 
    Link: https://patch.msgid.link/20251223152510.155463-3-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Neil Armstrong 

commit 5ea75722eaec226c60472dc578a302aae1d1fa3e
Author: Martin Blumenstingl 
Date:   Sat Nov 8 22:15:03 2025 +0100

    ARM: dts: meson: drop iio-hwmon in favour of generic-adc-thermal
    
    Commit 85b21fdec906e ("thermal/drivers/generic-adc: Register thermal
    zones as hwmon sensors") made "generic-adc-thermal" also register hwmon
    attributes. That means we now have the temperature sensor shown twice:
    - once from iio-hwmon
    - and another time from generic-adc-thermal
    
    We need the latter for SoC temperature control, so simply drop the
    former so userspace doesn't see duplicate sensors. Also
    generic-adc-thermal provides a better name to userspace
    ("soc_thermal-virtual-0") than iio_hwmon.
    
    Signed-off-by: Martin Blumenstingl 
    Link: https://patch.msgid.link/20251108211503.1578711-1-martin.blumenstingl@googlemail.com
    Signed-off-by: Neil Armstrong 

commit cee2557ae3b19e0cdfa09695a4d6ba420cc1fd41
Author: Zqiang 
Date:   Thu Jan 1 11:34:11 2026 -0500

    srcu: Use suitable gfp_flags for the init_srcu_struct_nodes()
    
    For use the init_srcu_struct*() to initialized srcu structure,
    the srcu structure's->srcu_sup and sda use GFP_KERNEL flags to
    allocate memory. similarly, if set SRCU_SIZING_INIT, the
    srcu_sup's->node can still use GFP_KERNEL flags to allocate
    memory, not need to use GFP_ATOMIC flags all the time.
    
    Signed-off-by: Zqiang 
    Reviewed-by: Joel Fernandes 
    Tested-by: Paul E. McKenney 
    Signed-off-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit d41e37f26b3157b3f1d10223863519a943aa239b
Author: Yao Kai 
Date:   Thu Jan 1 11:34:10 2026 -0500

    rcu: Fix rcu_read_unlock() deadloop due to softirq
    
    Commit 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in
    __rcu_read_unlock()") removes the recursion-protection code from
    __rcu_read_unlock(). Therefore, we could invoke the deadloop in
    raise_softirq_irqoff() with ftrace enabled as follows:
    
    WARNING: CPU: 0 PID: 0 at kernel/trace/trace.c:3021 __ftrace_trace_stack.constprop.0+0x172/0x180
    Modules linked in: my_irq_work(O)
    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.18.0-rc7-dirty #23 PREEMPT(full)
    Tainted: [O]=OOT_MODULE
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
    RIP: 0010:__ftrace_trace_stack.constprop.0+0x172/0x180
    RSP: 0018:ffffc900000034a8 EFLAGS: 00010002
    RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000
    RDX: 0000000000000003 RSI: ffffffff826d7b87 RDI: ffffffff826e9329
    RBP: 0000000000090009 R08: 0000000000000005 R09: ffffffff82afbc4c
    R10: 0000000000000008 R11: 0000000000011d7a R12: 0000000000000000
    R13: ffff888003874100 R14: 0000000000000003 R15: ffff8880038c1054
    FS:  0000000000000000(0000) GS:ffff8880fa8ea000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000055b31fa7f540 CR3: 00000000078f4005 CR4: 0000000000770ef0
    PKRU: 55555554
    Call Trace:
     
     trace_buffer_unlock_commit_regs+0x6d/0x220
     trace_event_buffer_commit+0x5c/0x260
     trace_event_raw_event_softirq+0x47/0x80
     raise_softirq_irqoff+0x6e/0xa0
     rcu_read_unlock_special+0xb1/0x160
     unwind_next_frame+0x203/0x9b0
     __unwind_start+0x15d/0x1c0
     arch_stack_walk+0x62/0xf0
     stack_trace_save+0x48/0x70
     __ftrace_trace_stack.constprop.0+0x144/0x180
     trace_buffer_unlock_commit_regs+0x6d/0x220
     trace_event_buffer_commit+0x5c/0x260
     trace_event_raw_event_softirq+0x47/0x80
     raise_softirq_irqoff+0x6e/0xa0
     rcu_read_unlock_special+0xb1/0x160
     unwind_next_frame+0x203/0x9b0
     __unwind_start+0x15d/0x1c0
     arch_stack_walk+0x62/0xf0
     stack_trace_save+0x48/0x70
     __ftrace_trace_stack.constprop.0+0x144/0x180
     trace_buffer_unlock_commit_regs+0x6d/0x220
     trace_event_buffer_commit+0x5c/0x260
     trace_event_raw_event_softirq+0x47/0x80
     raise_softirq_irqoff+0x6e/0xa0
     rcu_read_unlock_special+0xb1/0x160
     unwind_next_frame+0x203/0x9b0
     __unwind_start+0x15d/0x1c0
     arch_stack_walk+0x62/0xf0
     stack_trace_save+0x48/0x70
     __ftrace_trace_stack.constprop.0+0x144/0x180
     trace_buffer_unlock_commit_regs+0x6d/0x220
     trace_event_buffer_commit+0x5c/0x260
     trace_event_raw_event_softirq+0x47/0x80
     raise_softirq_irqoff+0x6e/0xa0
     rcu_read_unlock_special+0xb1/0x160
     __is_insn_slot_addr+0x54/0x70
     kernel_text_address+0x48/0xc0
     __kernel_text_address+0xd/0x40
     unwind_get_return_address+0x1e/0x40
     arch_stack_walk+0x9c/0xf0
     stack_trace_save+0x48/0x70
     __ftrace_trace_stack.constprop.0+0x144/0x180
     trace_buffer_unlock_commit_regs+0x6d/0x220
     trace_event_buffer_commit+0x5c/0x260
     trace_event_raw_event_softirq+0x47/0x80
     __raise_softirq_irqoff+0x61/0x80
     __flush_smp_call_function_queue+0x115/0x420
     __sysvec_call_function_single+0x17/0xb0
     sysvec_call_function_single+0x8c/0xc0
     
    
    Commit b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work")
    fixed the infinite loop in rcu_read_unlock_special() for IRQ work by
    setting a flag before calling irq_work_queue_on(). We fix this issue by
    setting the same flag before calling raise_softirq_irqoff() and rename the
    flag to defer_qs_pending for more common.
    
    Fixes: 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()")
    Reported-by: Tengda Wu 
    Signed-off-by: Yao Kai 
    Reviewed-by: Joel Fernandes 
    Tested-by: Paul E. McKenney 
    Signed-off-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit 37d9b475077b5096d41ebdc416a9019bd4fcfdb9
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:16:16 2025 -0800

    rcutorture: Correctly compute probability to invoke ->exp_current()
    
    Lack of parentheses causes the ->exp_current() function, for example,
    srcu_expedite_current(), to be called only once in four billion times
    instead of the intended once in 256 times.  This commit therefore adds
    the needed parentheses.
    
    Reported-by: Chris Mason 
    Reported-by: Joel Fernandes 
    Fixes: 950063c6e897 ("rcutorture: Test srcu_expedite_current()")
    Signed-off-by: Paul E. McKenney 
    Signed-off-by: Boqun Feng 

commit 255019537cfd63d6adc16a55bcbfd79530d5937e
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:16:15 2025 -0800

    rcu: Make expedited RCU CPU stall warnings detect stall-end races
    
    If an expedited RCU CPU stall ends just at the stall-warning timeout,
    the current code will print an expedited stall-warning message, but one
    that doesn't identify any CPUs or tasks causing the stall.  This is most
    likely to happen for short-timeout stalls, for example, the 20-millisecond
    timeouts that are sometimes used for small embedded devices.  Needless to
    say, these semi-empty stall-warning messages can be rather confusing.
    
    One option would be to suppress the stall-warning message entirely in
    this case, but the near-miss information can be quite valuable.
    
    Detect this race condition and emits a "INFO: Expedited stall ended
    before state dump start" message to clarify matters.
    
    [boqun: Apply feedback from Borislav]
    
    Reported-by: Borislav Petkov 
    Signed-off-by: Paul E. McKenney 
    Acked-by: Borislav Petkov (AMD) 
    Signed-off-by: Boqun Feng 

commit 407cc7ff3e99f6bca9b4ca2561d3f9e7192652fe
Author: Sjoerd Simons 
Date:   Tue Dec 23 13:37:51 2025 +0100

    dt-bindings: PCI: mediatek-gen3: Add MT7981 PCIe compatible
    
    Add compatible string for MediaTek MT7981 PCIe Gen3 controller.
    The MT7981 PCIe controller is compatible with the MT8192 PCIe
    controller.
    
    Signed-off-by: Sjoerd Simons 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: AngeloGioacchino Del Regno 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251223-openwrt-one-network-v5-1-7d1864ea3ad5@collabora.com

commit b1a9a9b96169bf1f9cb94b8aa33601996fad1e9c
Author: Mark Rutland 
Date:   Tue Jan 6 17:37:07 2026 +0000

    KVM: arm64: Remove ISB after writing FPEXC32_EL2
    
    The value of FPEX32_EL2 has no effect on execution in AArch64 state, and
    consequently there's no need for an ISB after writing to it in the hyp
    code (which executes in AArch64 state). When performing an exception
    return to AArch32 state, the exception return will provide the necessary
    context synchronization event.
    
    Remove the redundant ISB.
    
    Signed-off-by: Mark Rutland 
    Cc: Catalin Marinas 
    Cc: Fuad Tabba 
    Cc: Marc Zyngier 
    Cc: Mark Brown 
    Cc: Oliver Upton 
    Cc: Will Deacon 
    Tested-by: Fuad Tabba 
    Reviewed-by: Fuad Tabba 
    Link: https://patch.msgid.link/20260106173707.3292074-4-mark.rutland@arm.com
    Signed-off-by: Marc Zyngier 

commit acd8bfaa9384300a509c8aff5ee4a59a06eb2b2b
Author: Mark Rutland 
Date:   Tue Jan 6 17:37:06 2026 +0000

    KVM: arm64: Shuffle KVM_HOST_DATA_FLAG_* indices
    
    There's a gap in the KVM_HOST_DATA_FLAG_* indices since the removal of
    KVM_HOST_DATA_FLAG_HOST_SVE_ENABLED and
    KVM_HOST_DATA_FLAG_HOST_SME_ENABLED in commits:
    
    * 459f059be702 ("KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN")
    * 407a99c4654e ("KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN")
    
    Shuffle the indices to remove the gap, as Oliver requested at the time of
    the removals:
    
      https://lore.kernel.org/linux-arm-kernel/Z6qC4qn47ONfDCSH@linux.dev/
    
    There should be no functional change as a result of this patch.
    
    Signed-off-by: Mark Rutland 
    Cc: Catalin Marinas 
    Cc: Fuad Tabba 
    Cc: Marc Zyngier 
    Cc: Mark Brown 
    Cc: Oliver Upton 
    Cc: Will Deacon 
    Tested-by: Fuad Tabba 
    Reviewed-by: Fuad Tabba 
    Reviewed-by: Mark Brown 
    Link: https://patch.msgid.link/20260106173707.3292074-3-mark.rutland@arm.com
    Signed-off-by: Marc Zyngier 

commit 334a1a1e1a5f8b4b172683e7507cfec566313a7c
Author: Mark Rutland 
Date:   Tue Jan 6 17:37:05 2026 +0000

    KVM: arm64: Fix comment in fpsimd_lazy_switch_to_host()
    
    The comment in fpsimd_lazy_switch_to_host() erroneously says guest traps
    for FPSIMD/SVE/SME are disabled by fpsimd_lazy_switch_to_guest(). In
    reality, the traps are disabled by __activate_cptr_traps(), and
    fpsimd_lazy_switch_to_guest() only manipulates the SVE vector length.
    
    This was mistake; I accidentally copy+pasted the wrong function name in
    commit:
    
      59419f10045b ("KVM: arm64: Eagerly switch ZCR_EL{1,2}")
    
    Fix the comment.
    
    Fixes: 59419f10045b ("KVM: arm64: Eagerly switch ZCR_EL{1,2}")
    Signed-off-by: Mark Rutland 
    Cc: Catalin Marinas 
    Cc: Fuad Tabba 
    Cc: Marc Zyngier 
    Cc: Mark Brown 
    Cc: Oliver Upton 
    Cc: Will Deacon 
    Tested-by: Fuad Tabba 
    Reviewed-by: Fuad Tabba 
    Link: https://patch.msgid.link/20260106173707.3292074-2-mark.rutland@arm.com
    Signed-off-by: Marc Zyngier 

commit 22a4776a9ce50aa47f602d28f53ba9d613a38f49
Author: Kuninori Morimoto 
Date:   Wed Jan 7 05:18:08 2026 +0000

    ASoC: codecs: es8375: remove unnecessary format check
    
    It already have default for error case (A), no need to have
    SND_SOC_DAIFMT_RIGHT_J for error (B). Remove it.
    
            static int es8375_set_dai_fmt(...)
                    ...
                    switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
                    case SND_SOC_DAIFMT_RIGHT_J:
    (B)                     return -EINVAL;
                    ...
                    default:
    (A)                     return -EINVAL;
                    }
                    ...
            }
    
    Signed-off-by: Kuninori Morimoto 
    Link: https://patch.msgid.link/87eco20zn3.wl-kuninori.morimoto.gx@renesas.com
    Signed-off-by: Mark Brown 

commit 98baf887b1e9ae69178b25ed49cda1a6f01905a3
Author: Suzuki K Poulose 
Date:   Wed Jan 7 11:26:23 2026 +0000

    coresight: tpda: Fix intendation for sysfs interface documentation
    
    linux-next merge complains about build break with make htmldocs :
    
     Documentation/ABI/testing/sysfs-bus-coresight-devices-tpda:45: ERROR: Unexpected indentation. [docutils]
    
    Closes: https://lkml.kernel.org/r/20260106114933.638b073f@canb.auug.org.au
    Reported-by: Stephen Rothwell 
    Cc: Stephen Rothwell 
    Cc: Jie Gan 
    Cc: Tao Zhang 
    Signed-off-by: Suzuki K Poulose 

commit 81841b41a8bcd024f77a15d0634bc229d4d44db1
Author: Louis-Alexis Eyraud 
Date:   Wed Dec 17 11:19:11 2025 +0100

    arm64: defconfig: Enable Mediatek HDMIv2 driver
    
    In order to enable the HDMI output support on Mediatek Genio 510-EVK,
    700-EVK, and 1200-EVK boards, enable the driver for it in the default
    configuration.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 34e7595912cfffdbca8c34d7c321d9937e0201ee
Author: Rob Herring (Arm) 
Date:   Fri Dec 5 22:59:38 2025 +0100

    arm64: dts: mediatek: Apply mt8395-radxa DT overlay at build time
    
    It's a requirement that DT overlays be applied at build time in order to
    validate them as overlays are not validated on their own.
    
    Add missing target for mt8395-radxa hd panel overlay.
    
    Fixes: 4c8ff61199a7 ("arm64: dts: mediatek: mt8395-radxa-nio-12l: Add Radxa 8 HD panel")
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Frank Wunderlich 
    Acked-by: AngeloGioacchino Del Regno 
    Signed-off-by: AngeloGioacchino Del Regno 

commit d977b61d38030f50bae9f634049110af0a364d0d
Author: Frank Wunderlich 
Date:   Wed Nov 19 18:51:23 2025 +0100

    arm64: dts: mediatek: mt7988: add dtbs with applied overlays for bpi-r4 (pro)
    
    Build devicetree binaries for testing overlays and providing users
    full dtb without using overlays for Bananapi R4 (pro) variants.
    
    Signed-off-by: Frank Wunderlich 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 0516c548883bbe58a48d604e81e33b390986cdb6
Author: Frank Wunderlich 
Date:   Wed Nov 19 18:51:22 2025 +0100

    arm64: dts: mediatek: mt7986: add dtbs with applied overlays for bpi-r3
    
    Build devicetree binaries for testing overlays and providing users
    full dtb without using overlays.
    
    Suggested-by: Rob Herring 
    Signed-off-by: Frank Wunderlich 
    Acked-by: Rob Herring (Arm) 
    Acked-by: AngeloGioacchino Del Regno 
    Fixes: a58c36806741 ("arm64: dts: mediatek: mt7988a-bpi-r4pro: Add mmc  overlays")
    Fixes: dec929e61a42 ("arm64: dts: mediatek: mt7988a-bpi-r4-pro: Add PCIe  overlays")
    Fixes: 714a80ced07a ("arm64: dts: mediatek: mt7988a-bpi-r4: Add dt  overlays for sd + emmc")
    Fixes: 312189ebb802 ("arm64: dts: mt7986: add overlay for SATA power  socket on BPI-R3")
    Fixes: 8e01fb15b815 ("arm64: dts: mt7986: add Bananapi R3")
    Signed-off-by: AngeloGioacchino Del Regno 

commit eaada4f56ab366f4c198291aa9d04b8a3348e291
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:25:24 2025 +0100

    arm64: dts: airoha: Use hyphen in node names
    
    DTS coding style prefers hyphens instead of underscores in the node
    names.  Change should be safe, because node names are not considered an
    ABI.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: AngeloGioacchino Del Regno 

commit 0eb85f468ef515fbd2538375ef3884f6dd376382
Author: Dmitry Baryshkov 
Date:   Tue Jan 6 03:01:15 2026 +0200

    power: sequencing: qcom-wcn: add support for WCN39xx
    
    The WCN39xx family of WiFi/BT chips incorporates a simple PMU, spreading
    voltages over internal rails. Implement power sequencing support for
    this generation of WCN chips. Unlike later devices, they don't have
    separate enable GPIO lines, letting the chip figure out the necessary
    parts on its own.
    
    Signed-off-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-5-0386204328be@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit a5fae429ec2ac72372bc874a0334a7fb9eadee83
Author: Dmitry Baryshkov 
Date:   Tue Jan 6 03:01:11 2026 +0200

    regulator: dt-bindings: qcom,wcn3990-pmu: describe PMUs on WCN39xx
    
    WCN3990 and other similar WiFi/BT chips incorporate a simple on-chip PMU
    (clearly described as such in the documentation). Provide DT schema
    covering other Qualcomm WiFi/BT chips to cover these devices too.
    
    Signed-off-by: Dmitry Baryshkov 
    Acked-by: Mark Brown 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20260106-wcn3990-pwrctl-v2-1-0386204328be@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit b1857911d845136cdf627501070dd1b2dc7d0bbe
Author: Bartosz Golaszewski 
Date:   Tue Nov 25 14:47:00 2025 +0100

    power: sequencing: qcom-wcn: use device_get_match_data()
    
    Use the generic fwnode interface for retrieving device match data
    instead of the OF-specific one.
    
    Signed-off-by: Bartosz Golaszewski 
    Reviewed-by: Neil Armstrong 
    Link: https://lore.kernel.org/r/20251125134700.29135-1-brgl@bgdev.pl
    Signed-off-by: Bartosz Golaszewski 

commit b47ce586300b3c2b6650f4c7ac5c0f59c6bf6f4b
Author: Randy Dunlap 
Date:   Tue Jan 6 10:59:51 2026 -0800

    ALSA: hda - fix function names & missing function parameter
    
    Use the correct function names and add a function parameter description
    to avoid kernel-doc warnings:
    
    hda_jack.h:97: warning: Function parameter or struct member 'cb' not
     described in 'snd_hda_jack_detect_enable_callback'
    hda_jack.h:97: warning: expecting prototype for snd_hda_jack_detect_enable().
     Prototype was for snd_hda_jack_detect_enable_callback() instead
    hda_local.h:441: warning: expecting prototype for _snd_hda_set_pin_ctl().
     Prototype was for snd_hda_set_pin_ctl() instead
    
    Fixes: cdd03cedc5b5 ("ALSA: hda - Introduce snd_hda_set_pin_ctl*() helper functions")
    Fixes: 5204a05d70d9 ("ALSA: hda - Add DP-MST jack support")
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20260106185951.2179242-1-rdunlap@infradead.org
    Signed-off-by: Takashi Iwai 

commit 0585c53b21541cd6b17ad5ab41b371a0d52e358c
Author: Nathan Chancellor 
Date:   Tue Jan 6 16:08:18 2026 -0700

    ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl()
    
    When building with clang older than 17 targeting architectures that use
    asm goto for their get_user() and put_user(), such as arm64, after
    commit f3d233daf011 ("ALSA: pcm: Relax __free() variable declarations"),
    there are bogus errors around skipping over a variable declared with the
    cleanup attribute:
    
      sound/core/pcm_native.c:3308:6: error: cannot jump from this asm goto statement to one of its possible targets
              if (put_user(result, &_xfern->result))
                  ^
      ...
      arch/arm64/include/asm/uaccess.h:298:2: note: expanded from macro '__put_mem_asm'
              asm goto(
              ^
      sound/core/pcm_native.c:3295:6: note: possible target of asm goto statement
              if (put_user(0, &_xfern->result))
                  ^
      ...
      sound/core/pcm_native.c:3300:8: note: jump exits scope of variable with __attribute__((cleanup))
              void *bufs __free(kfree) =
                    ^
    
    clang-17 fixed a bug in clang's jump scope checker [1] where all labels
    in a function were checked as valid targets for all asm goto instances
    in a function, regardless of whether they were actual targets in a
    paricular asm goto's provided list of labels.
    
    To workaround this, revert the change done to
    snd_pcm_xfern_frames_ioctl() by commit f3d233daf011 ("ALSA: pcm: Relax
    __free() variable declarations") to avoid a variable declared with
    cleanup from existing between multiple uses of asm goto. There are no
    other uses of cleanup in this function so there should be low risk from
    moving this variable back to the top of the function.
    
    Link: https://github.com/ClangBuiltLinux/linux/issues/1886 [1]
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512190802.i4Jzbcsl-lkp@intel.com/
    Signed-off-by: Nathan Chancellor 
    Link: https://patch.msgid.link/20260106-pcm_native-revert-var-move-free-for-old-clang-v1-1-06a03693423d@kernel.org
    Signed-off-by: Takashi Iwai 

commit baef3d5d96d2f7530011cdebd7aeecdc85cd93a7
Author: Dian-Syuan Yang 
Date:   Wed Dec 31 17:06:47 2025 +0800

    wifi: rtw89: 8852b: refine hardware parameters for RFE type 5
    
    The RFE type 5 should set different DSWR parameters when card power on.
    Therefore, add the corresponding register settings for this type.
    
    Signed-off-by: Dian-Syuan Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-12-pkshih@realtek.com

commit eb57be32f438c57c88d6ce756101c1dfbcc03bba
Author: Kuan-Chung Chen 
Date:   Wed Dec 31 17:06:46 2025 +0800

    wifi: rtw89: fix potential zero beacon interval in beacon tracking
    
    During fuzz testing, it was discovered that bss_conf->beacon_int
    might be zero, which could result in a division by zero error in
    subsequent calculations. Set a default value of 100 TU if the
    interval is zero to ensure stability.
    
    Signed-off-by: Kuan-Chung Chen 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-11-pkshih@realtek.com

commit cd7ce83ff6da0d9a760230f5dbf0c3148c534133
Author: Chih-Kang Chang 
Date:   Wed Dec 31 17:06:45 2025 +0800

    wifi: rtw89: rfk: update rtw89_fw_h2c_rf_pre_ntfy_mcc format
    
    The H2C command rtw89_fw_h2c_rf_pre_ntfy_mcc have different format.
    8922A after FW 0.35.49.0 use v0, after FW 0.35.84.0 use v1. The coming
    8922D will use v2.
    
    Signed-off-by: Chih-Kang Chang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-10-pkshih@realtek.com

commit 6a6b0aac287406228ac1c69a0959f78a721fb8c0
Author: Zong-Zhe Yang 
Date:   Wed Dec 31 17:06:44 2025 +0800

    wifi: rtw89: fw: change WITH_RFK_PRE_NOTIFY to be a FW feature group
    
    Actually, WITH_RFK_PRE_NOTIFY means supporting one of RFK_PRE_NOTIFY_Vx.
    So, change it to be a FW feature group which contains RFK_PRE_NOTIFY_Vx.
    Then, because WITH_RFK_PRE_NOTIFY is abandoned after some FW versions by
    chip, disable WITH_RFK_PRE_NOTIFY correspondingly in FW feature table.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-9-pkshih@realtek.com

commit 449a57911967d038d78f2c04d2effc1af0fdceb7
Author: Zong-Zhe Yang 
Date:   Wed Dec 31 17:06:43 2025 +0800

    wifi: rtw89: refine mis-ordered entries in FW feature table
    
    Make all entries in firmware feature table in increasing order of firmware
    version.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-8-pkshih@realtek.com

commit 29009d98d98f08164aafba2392a778b85e15b43e
Author: Zong-Zhe Yang 
Date:   Wed Dec 31 17:06:42 2025 +0800

    wifi: rtw89: 8922a: tweak RFK_PRE_NOTIFY FW feature configuration to align handling
    
    In the FW feature table, V0 and V1 was configured by lt, less than. So, V1
    flag was also set in the range of V0. However, in RFK_PRE_NOTIFY handling,
    rtw89_fw_h2c_rf_pre_ntfy, V1 is tested before V0. Things would process as
    V1 even if V0 should be used.
    
    Tweak FW feature configuration by ge, greater or equal, to align handling.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-7-pkshih@realtek.com

commit 2d986cf3cc7193147ee20e681bfead4833a5efbf
Author: Zong-Zhe Yang 
Date:   Wed Dec 31 17:06:41 2025 +0800

    wifi: rtw89: fw: introduce helper for disabling FW feature configuration
    
    Some FW features (groups) may be valid only in a range of FW versions,
    i.e. after some FW versions, they can no longer be used. So, introduce
    some helper macros to configure this kind of things in FW feature table.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-6-pkshih@realtek.com

commit c5e5519fd9815f2f87c256c27c6da7b37f63a7ad
Author: Zong-Zhe Yang 
Date:   Wed Dec 31 17:06:40 2025 +0800

    wifi: rtw89: fw: change FW feature map to a BITMAP
    
    Originally, FW feature map was declared as a u32. But, the number of FW
    feature flags is going to be over than 32. So, change it to a BITMAP and
    update the corresponding macros.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-5-pkshih@realtek.com

commit 9485da4e4c9b15311161e33284867d9ee132cc47
Author: Zong-Zhe Yang 
Date:   Wed Dec 31 17:06:39 2025 +0800

    wifi: rtw89: pre-handle RF calibration on link when needed
    
    The Wi-Fi 7 RF calibration flow has a new design which mainly affect
    MLO cases. Before, old RFK H2C command can just send the used channels
    and MLO mode even if there are multiple active links. After, each RFK
    H2C command should send one channel corresponding to one active link.
    
    For example, connect MLD AP (channel X) and then activate second link
    (channel X + channel Y)
    
    Before:
            RFK#1: channel X (path A + path B)
            RFK#2: channel X (path A) + channel Y (path B)
    
    After:
            RFK#1: channel X (path A + path B)
                    [set MLO mode to focus on 2nd link/channel]
            RFK#2: channel Y (path A + path B)
                    [set MLO mode back to target case]
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-4-pkshih@realtek.com

commit ed15dddd75663db05583402a7ff1fc11c7f8e79a
Author: Chih-Kang Chang 
Date:   Wed Dec 31 17:06:38 2025 +0800

    wifi: rtw89: rfk: add rtw89_fw_h2c_rf_pre_ntfy_mcc for new WiFi 7 firmware
    
    The pre-notify is to notify firmware the configured channels, and then
    RF calibration in firmware can use these values to calibrate RF properly.
    
    Since we need more information, change and add the new H2C command format.
    
    Signed-off-by: Chih-Kang Chang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-3-pkshih@realtek.com

commit 8c0ac5791eb9a82426ac1f5b6ea7aa1e3f921815
Author: Ping-Ke Shih 
Date:   Wed Dec 31 17:06:37 2025 +0800

    wifi: rtw89: rfk: update RFK pre info V2 for RTL8922D
    
    The H2C command of RFK pre info is to tell current operating channels to
    firmware, so RF calibrations can rely on these information as arguments
    to configure hardware.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251231090647.56407-2-pkshih@realtek.com

commit 92fad96aea24fc19abe1eae2249402b61de3a3e2
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:47 2025 +0100

    tpm/tpm_ftpm_tee: Make use of tee bus methods
    
    The tee bus got dedicated callbacks for probe and remove.
    Make use of these. This fixes a runtime warning about the driver needing
    to be converted to the bus methods.
    
    Reviewed-by: Sumit Garg 
    Reviewed-by: Jarkko Sakkinen 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Jens Wiklander 

commit 9e4c7808b728daa2f3bd7ee3fb1dec07ac522585
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:46 2025 +0100

    tpm/tpm_ftpm_tee: Make use of tee specific driver registration
    
    tee_client_driver_register() is typed more strongly and cares about
    assigning the driver's bus. Similar for tee_client_driver_unregister().
    
    Make use of these functions.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Jarkko Sakkinen 
    Signed-off-by: Jens Wiklander 

commit c6ef3e90575b727bf711c93a3e3168d88a6c9479
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:45 2025 +0100

    KEYS: trusted: Make use of tee bus methods
    
    The tee bus got dedicated callbacks for probe and remove.
    Make use of these. This fixes a runtime warning about the driver needing
    to be converted to the bus methods.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Jarkko Sakkinen 
    Signed-off-by: Jens Wiklander 

commit 7b7e532b58e89b3318242bfcb57f3f2b3b384855
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:44 2025 +0100

    KEYS: trusted: Migrate to use tee specific driver registration function
    
    The tee subsystem recently got a set of dedicated functions to register
    (and unregister) a tee driver. Make use of them. These care for setting the
    driver's bus (so the explicit assignment can be dropped) and the driver
    owner (which is an improvement this driver benefits from).
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Jarkko Sakkinen 
    Signed-off-by: Jens Wiklander 

commit 2966fa040b4657547bf0cac4e6f02f14b1790e0b
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:43 2025 +0100

    firmware: tee_bnxt: Make use of tee bus methods
    
    The tee bus got dedicated callbacks for probe and remove.
    Make use of these. This fixes a runtime warning about the driver needing
    to be converted to the bus methods.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Jens Wiklander 

commit ae9d338ba7cf2bcdc94d0dead4db36b568b36a05
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:42 2025 +0100

    firmware: tee_bnxt: Make use of module_tee_client_driver()
    
    Reduce boilerplate by using the newly introduced module_tee_client_driver().
    That takes care of assigning the driver's bus, so the explicit assigning
    in this driver can be dropped.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Jens Wiklander 

commit 191ef0c5b3e3b18b976ee6d1215cdcc258f48690
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:41 2025 +0100

    firmware: arm_scmi: Make use of tee bus methods
    
    The tee bus got dedicated callbacks for probe and remove.
    Make use of these. This fixes a runtime warning about the driver needing
    to be converted to the bus methods. Note that the return value of .remove()
    was already ignored before, so there is no problem introduced by dropping
    the error returns.
    
    Reviewed-by: Sumit Garg 
    Reviewed-by: Sudeep Holla 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Jens Wiklander 

commit fe700bc50a9c28ddac2121ddf35e1447d9cd72bd
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:40 2025 +0100

    firmware: arm_scmi: optee: Make use of module_tee_client_driver()
    
    Reduce boilerplate by using the newly introduced module_tee_client_driver().
    That takes care of assigning the driver's bus, so the explicit assigning
    in this driver can be dropped.
    
    Reviewed-by: Sumit Garg 
    Reviewed-by: Sudeep Holla 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Jens Wiklander 

commit 7a5f567ab437acd5b298149c6c963650a9e7cfe9
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:39 2025 +0100

    efi: stmm: Make use of tee bus methods
    
    The tee bus got dedicated callbacks for probe and remove.
    Make use of these. This fixes a runtime warning about the driver needing
    to be converted to the bus methods.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Ilias Apalodimas 
    Signed-off-by: Jens Wiklander 

commit 0a6441a30b839b7e0afd80b7ffe91f1baeb44415
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:38 2025 +0100

    efi: stmm: Make use of module_tee_client_driver()
    
    Reduce boilerplate by using the newly introduced module_tee_client_driver().
    That takes care of assigning the driver's bus, so the explicit assigning
    in this driver can be dropped.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Acked-by: Ilias Apalodimas 
    Signed-off-by: Jens Wiklander 

commit 5e9151cecbbefe60fbe459d9f7c65a32d2bca548
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:35 2025 +0100

    hwrng: optee - Make use of tee bus methods
    
    The tee bus got dedicated callbacks for probe and remove.
    Make use of these. This fixes a runtime warning about the driver needing
    to be converted to the bus methods.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Acked-by: Herbert Xu 
    Signed-off-by: Jens Wiklander 

commit 21ecfe424bf332f02d7cba830466a6e29d6fb847
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:34 2025 +0100

    hwrng: optee - Make use of module_tee_client_driver()
    
    Reduce boilerplate by using the newly introduced module_tee_client_driver().
    That takes care of assigning the driver's bus, so the explicit assigning
    in this driver can be dropped.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Acked-by: Herbert Xu 
    Signed-off-by: Jens Wiklander 

commit 2175ccfb93fd91d0ece74684eb7ab9443de806ec
Merge: 2421649778dca8 681600647c5905
Author: Alexei Starovoitov 
Date:   Tue Jan 6 21:04:11 2026 -0800

    Merge branch 'bpf-selftests-fixes-for-gcc-bpf-16'
    
    Jose E. Marchesi says:
    
    ====================
    bpf: selftests fixes for GCC-BPF 16
    
    Hello.
    
    Just a couple of small fixes to get the BPF selftests build with what
    will become GCC 16 this spring.  One of the regressions is due to a
    change in the behavior of a warning in GCC 16.  The other is due to
    the fact that GCC 16 actually implements btf_decl_tag and
    btf_type_tag.
    
    Salud!
    ====================
    
    Link: https://patch.msgid.link/20260106173650.18191-1-jose.marchesi@oracle.com
    Signed-off-by: Alexei Starovoitov 

commit 681600647c59050546939da5e490c736e567fe91
Author: Jose E. Marchesi 
Date:   Tue Jan 6 18:36:50 2026 +0100

    bpf: GCC requires function attributes before the declarator
    
    GCC insists in placing attributes before the declarators in function
    declarations.  Now that GCC supports btf_decl_tag and therefore __tag1
    and __tag2 expand to actual attributes, the compiler is complaining
    about it for
    
      static __noinline int foo(int x __tag1 __tag2) __tag1 __tag2
    
    progs/test_btf_decl_tag.c:36:1: error: attributes should be specified \
    before the declarator in a function definition
    
    This patch simply places the tags before the declarator.
    
    Signed-off-by: Jose E. Marchesi 
    Cc: david.faust@oracle.com
    Cc: cupertino.miranda@oracle.com
    Cc: Eduard Zingerman 
    Cc: Yonghong Song 
    Link: https://lore.kernel.org/r/20260106173650.18191-3-jose.marchesi@oracle.com
    Signed-off-by: Alexei Starovoitov 

commit 97fb54d86d2194ea8a4cbe6cf074e6ba47b054ea
Author: Jose E. Marchesi 
Date:   Tue Jan 6 18:36:49 2026 +0100

    bpf: adapt selftests to GCC 16 -Wunused-but-set-variable
    
    GCC 16 has changed the semantics of -Wunused-but-set-variable, as well
    as introducing new options -Wunused-but-set-variable={0,1,2,3} to
    adjust the level of support.
    
    One of the changes is that GCC now treats 'sum += 1' and 'sum++' as
    non-usage, whereas clang (and GCC < 16) considers the first as usage
    and the second as non-usage, which is sort of inconsistent.
    
    The GCC 16 -Wunused-but-set-variable=2 option implements the previous
    semantics of -Wunused-but-set-variable, but since it is a new option,
    it cannot be used unconditionally for forward-compatibility, just for
    backwards-compatibility.
    
    So this patch adds pragmas to the two self-tests impacted by this,
    progs/free_timer.c and progs/rcu_read_lock.c, to make gcc to ignore
    -Wunused-but-set-variable warnings when compiling them with GCC > 15.
    
    See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=44677#c25 for details
    on why this regression got introduced in GCC upstream.
    
    Signed-off-by: Jose E. Marchesi 
    Cc: david.faust@oracle.com
    Cc: cupertino.miranda@oracle.com
    Cc: Eduard Zingerman 
    Cc: Yonghong Song 
    Link: https://lore.kernel.org/r/20260106173650.18191-2-jose.marchesi@oracle.com
    Signed-off-by: Alexei Starovoitov 

commit 2421649778dca8fe6e7b166905e97278aa0fdf58
Author: Nathan Chancellor 
Date:   Tue Jan 6 15:44:20 2026 -0700

    scripts/gen-btf.sh: Ensure initial object in gen_btf_o is ELF with correct endianness
    
    After commit 600605853f87 ("scripts/gen-btf.sh: Fix .btf.o generation
    when compiling for RISCV"), there is an error from llvm-objcopy when
    CONFIG_LTO_CLANG is enabled:
    
      llvm-objcopy: error: '.tmp_vmlinux1.btf.o': The file was not recognized as a valid object file
      Failed to generate BTF for vmlinux
    
    KBUILD_CFLAGS includes CC_FLAGS_LTO, which makes clang emit an LLVM IR
    object, rather than an ELF one as expected by llvm-objcopy.
    
    Most areas of the kernel deal with this by filtering out CC_FLAGS_LTO
    from KBUILD_CFLAGS for the particular object or directory but this is
    not so easy to do in bash. Just include '-fno-lto' after KBUILD_CFLAGS
    to ensure an ELF object is consistently created as the initial .o file.
    
    Additionally, while there is no reported or discovered bug yet, the
    absence of KBUILD_CPPFLAGS from this command could result in incorrect
    endianness because KBUILD_CPPFLAGS typically contains '-mbig-endian' and
    '-mlittle-endian' so that biendian toolchains can be used. Include it in
    this ${CC} command to hopefully limit necessary changes to this command
    for the foreseeable future.
    
    Fixes: 600605853f87 ("scripts/gen-btf.sh: Fix .btf.o generation when compiling for RISCV")
    Signed-off-by: Nathan Chancellor 
    Acked-by: Ihor Solodrai 
    Link: https://lore.kernel.org/r/20260106-fix-gen-btf-sh-lto-v2-1-01d3e1c241c4@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit f39703b20b57126b6acbb2ed32bf81e3c8ec9f96
Merge: a8d50675923112 07bf7aa58e5e7f
Author: Alexei Starovoitov 
Date:   Tue Jan 6 20:48:33 2026 -0800

    Merge branch 'bpf-introduce-bpf_f_cpu-and-bpf_f_all_cpus-flags-for-percpu-maps'
    
    Leon Hwang says:
    
    ====================
    bpf: Introduce BPF_F_CPU and BPF_F_ALL_CPUS flags for percpu maps
    
    This patch set introduces the BPF_F_CPU and BPF_F_ALL_CPUS flags for
    percpu maps, as the requirement of BPF_F_ALL_CPUS flag for percpu_array
    maps was discussed in the thread of
    "[PATCH bpf-next v3 0/4] bpf: Introduce global percpu data"[1].
    
    The goal of BPF_F_ALL_CPUS flag is to reduce data caching overhead in light
    skeletons by allowing a single value to be reused to update values across all
    CPUs. This avoids the M:N problem where M cached values are used to update a
    map on N CPUs kernel.
    
    The BPF_F_CPU flag is accompanied by *flags*-embedded cpu info, which
    specifies the target CPU for the operation:
    
    * For lookup operations: the flag field alongside cpu info enable querying
      a value on the specified CPU.
    * For update operations: the flag field alongside cpu info enable
      updating value for specified CPU.
    
    Links:
    [1] https://lore.kernel.org/bpf/20250526162146.24429-1-leon.hwang@linux.dev/
    
    Changes:
    v12 -> v13:
    * No changes, rebased on latest tree.
    
    v11 -> v12:
    * Dropped the v11 changes.
    * Stabilized the lru_percpu_hash map test by keeping an extra spare entry,
      which can be used temporarily during updates to avoid unintended LRU
      evictions.
    
    v10 -> v11:
    * Support the combination of BPF_EXIST and BPF_F_CPU/BPF_F_ALL_CPUS for
      update operations.
    * Fix unstable lru_percpu_hash map test using the combination of
      BPF_EXIST and BPF_F_CPU/BPF_F_ALL_CPUS to avoid LRU eviction
      (reported by Alexei).
    
    v9 -> v10:
    * Add tests to verify array and hash maps do not support BPF_F_CPU and
      BPF_F_ALL_CPUS flags.
    * Address comment from Andrii:
      * Copy map value using copy_map_value_long for percpu_cgroup_storage
        maps in a separate patch.
    
    v8 -> v9:
    * Change value type from u64 to u32 in selftests.
    * Address comments from Andrii:
      * Keep value_size unaligned and update everywhere for consistency when
        cpu flags are specified.
      * Update value by getting pointer for percpu hash and percpu
        cgroup_storage maps.
    
    v7 -> v8:
    * Address comments from Andrii:
      * Check BPF_F_LOCK when update percpu_array, percpu_hash and
        lru_percpu_hash maps.
      * Refactor flags check in __htab_map_lookup_and_delete_batch().
      * Keep value_size unaligned and copy value using copy_map_value() in
        __htab_map_lookup_and_delete_batch() when BPF_F_CPU is specified.
      * Update warn message in libbpf's validate_map_op().
      * Update comment of libbpf's bpf_map__lookup_elem().
    
    v6 -> v7:
    * Get correct value size for percpu_hash and lru_percpu_hash in
      update_batch API.
    * Set 'count' as 'max_entries' in test cases for lookup_batch API.
    * Address comment from Alexei:
      * Move cpu flags check into bpf_map_check_op_flags().
    
    v5 -> v6:
    * Move bpf_map_check_op_flags() from 'bpf.h' to 'syscall.c'.
    * Address comments from Alexei:
      * Drop the refactoring code of data copying logic for percpu maps.
      * Drop bpf_map_check_op_flags() wrappers.
    
    v4 -> v5:
    * Address comments from Andrii:
      * Refactor data copying logic for all percpu maps.
      * Drop this_cpu_ptr() micro-optimization.
      * Drop cpu check in libbpf's validate_map_op().
      * Enhance bpf_map_check_op_flags() using *allowed flags* instead of
        'extra_flags_mask'.
    
    v3 -> v4:
    * Address comments from Andrii:
      * Remove unnecessary map_type check in bpf_map_value_size().
      * Reduce code churn.
      * Remove unnecessary do_delete check in
        __htab_map_lookup_and_delete_batch().
      * Introduce bpf_percpu_copy_to_user() and bpf_percpu_copy_from_user().
      * Rename check_map_flags() to bpf_map_check_op_flags() with
        extra_flags_mask.
      * Add human-readable pr_warn() explanations in validate_map_op().
      * Use flags in bpf_map__delete_elem() and
        bpf_map__lookup_and_delete_elem().
      * Drop "for alignment reasons".
    v3 link: https://lore.kernel.org/bpf/20250821160817.70285-1-leon.hwang@linux.dev/
    
    v2 -> v3:
    * Address comments from Alexei:
      * Use BPF_F_ALL_CPUS instead of BPF_ALL_CPUS magic.
      * Introduce these two cpu flags for all percpu maps.
    * Address comments from Jiri:
      * Reduce some unnecessary u32 cast.
      * Refactor more generic map flags check function.
      * A code style issue.
    v2 link: https://lore.kernel.org/bpf/20250805163017.17015-1-leon.hwang@linux.dev/
    
    v1 -> v2:
    * Address comments from Andrii:
      * Embed cpu info as high 32 bits of *flags* totally.
      * Use ERANGE instead of E2BIG.
      * Few format issues.
    ====================
    
    Link: https://patch.msgid.link/20260107022022.12843-1-leon.hwang@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 07bf7aa58e5e7fb27b8addcc33052400a7d9ce32
Author: Leon Hwang 
Date:   Wed Jan 7 10:20:22 2026 +0800

    selftests/bpf: Add cases to test BPF_F_CPU and BPF_F_ALL_CPUS flags
    
    Add test coverage for the new BPF_F_CPU and BPF_F_ALL_CPUS flags support
    in percpu maps. The following APIs are exercised:
    
    * bpf_map_update_batch()
    * bpf_map_lookup_batch()
    * bpf_map_update_elem()
    * bpf_map__update_elem()
    * bpf_map_lookup_elem_flags()
    * bpf_map__lookup_elem()
    
    For lru_percpu_hash map, set max_entries to
    'libbpf_num_possible_cpus() + 1' and only use the first
    'libbpf_num_possible_cpus()' entries. This ensures a spare entry is always
    available in the LRU free list, avoiding eviction.
    
    When updating an existing key in lru_percpu_hash map:
    
    1. l_new = prealloc_lru_pop();  /* Borrow from free list */
    2. l_old = lookup_elem_raw();   /* Found, key exists */
    3. pcpu_copy_value();           /* In-place update */
    4. bpf_lru_push_free();         /* Return l_new to free list */
    
    Also add negative tests to verify that non-percpu array and hash maps
    reject the BPF_F_CPU and BPF_F_ALL_CPUS flags.
    
    Signed-off-by: Leon Hwang 
    Link: https://lore.kernel.org/r/20260107022022.12843-8-leon.hwang@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 2546863b4a723c96f55af7127827d62632cfbc9c
Author: Leon Hwang 
Date:   Wed Jan 7 10:20:21 2026 +0800

    libbpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support for percpu maps
    
    Add libbpf support for the BPF_F_CPU flag for percpu maps by embedding the
    cpu info into the high 32 bits of:
    
    1. **flags**: bpf_map_lookup_elem_flags(), bpf_map__lookup_elem(),
       bpf_map_update_elem() and bpf_map__update_elem()
    2. **opts->elem_flags**: bpf_map_lookup_batch() and
       bpf_map_update_batch()
    
    And the flag can be BPF_F_ALL_CPUS, but cannot be
    'BPF_F_CPU | BPF_F_ALL_CPUS'.
    
    Behavior:
    
    * If the flag is BPF_F_ALL_CPUS, the update is applied across all CPUs.
    * If the flag is BPF_F_CPU, it updates value only to the specified CPU.
    * If the flag is BPF_F_CPU, lookup value only from the specified CPU.
    * lookup does not support BPF_F_ALL_CPUS.
    
    Acked-by: Andrii Nakryiko 
    Signed-off-by: Leon Hwang 
    Link: https://lore.kernel.org/r/20260107022022.12843-7-leon.hwang@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 47c79f05aa0d289f760caf5ad6521fd8dbae37a1
Author: Leon Hwang 
Date:   Wed Jan 7 10:20:20 2026 +0800

    bpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support for percpu_cgroup_storage maps
    
    Introduce BPF_F_ALL_CPUS flag support for percpu_cgroup_storage maps to
    allow updating values for all CPUs with a single value for update_elem
    API.
    
    Introduce BPF_F_CPU flag support for percpu_cgroup_storage maps to
    allow:
    
    * update value for specified CPU for update_elem API.
    * lookup value for specified CPU for lookup_elem API.
    
    The BPF_F_CPU flag is passed via map_flags along with embedded cpu info.
    
    Signed-off-by: Leon Hwang 
    Link: https://lore.kernel.org/r/20260107022022.12843-6-leon.hwang@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 8526397c3caf8d0289bab69bfb2c889e2b39b30a
Author: Leon Hwang 
Date:   Wed Jan 7 10:20:19 2026 +0800

    bpf: Copy map value using copy_map_value_long for percpu_cgroup_storage maps
    
    Copy map value using 'copy_map_value_long()'. It's to keep consistent
    style with the way of other percpu maps.
    
    No functional change intended.
    
    Signed-off-by: Leon Hwang 
    Link: https://lore.kernel.org/r/20260107022022.12843-5-leon.hwang@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit c6936161fd55d0c6ffde01da726e66ff5f2934e8
Author: Leon Hwang 
Date:   Wed Jan 7 10:20:18 2026 +0800

    bpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support for percpu_hash and lru_percpu_hash maps
    
    Introduce BPF_F_ALL_CPUS flag support for percpu_hash and lru_percpu_hash
    maps to allow updating values for all CPUs with a single value for both
    update_elem and update_batch APIs.
    
    Introduce BPF_F_CPU flag support for percpu_hash and lru_percpu_hash
    maps to allow:
    
    * update value for specified CPU for both update_elem and update_batch
    APIs.
    * lookup value for specified CPU for both lookup_elem and lookup_batch
    APIs.
    
    The BPF_F_CPU flag is passed via:
    
    * map_flags along with embedded cpu info.
    * elem_flags along with embedded cpu info.
    
    Signed-off-by: Leon Hwang 
    Link: https://lore.kernel.org/r/20260107022022.12843-4-leon.hwang@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 8eb76cb03f0f6c2bd7b15cf45dcffcd6bd07a360
Author: Leon Hwang 
Date:   Wed Jan 7 10:20:17 2026 +0800

    bpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support for percpu_array maps
    
    Introduce support for the BPF_F_ALL_CPUS flag in percpu_array maps to
    allow updating values for all CPUs with a single value for both
    update_elem and update_batch APIs.
    
    Introduce support for the BPF_F_CPU flag in percpu_array maps to allow:
    
    * update value for specified CPU for both update_elem and update_batch
    APIs.
    * lookup value for specified CPU for both lookup_elem and lookup_batch
    APIs.
    
    The BPF_F_CPU flag is passed via:
    
    * map_flags of lookup_elem and update_elem APIs along with embedded cpu
    info.
    * elem_flags of lookup_batch and update_batch APIs along with embedded
    cpu info.
    
    Signed-off-by: Leon Hwang 
    Link: https://lore.kernel.org/r/20260107022022.12843-3-leon.hwang@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 2b421662c7887a0649fe409155a1f101562d0fa9
Author: Leon Hwang 
Date:   Wed Jan 7 10:20:16 2026 +0800

    bpf: Introduce BPF_F_CPU and BPF_F_ALL_CPUS flags
    
    Introduce BPF_F_CPU and BPF_F_ALL_CPUS flags and check them for
    following APIs:
    
    * 'map_lookup_elem()'
    * 'map_update_elem()'
    * 'generic_map_lookup_batch()'
    * 'generic_map_update_batch()'
    
    And, get the correct value size for these APIs.
    
    Acked-by: Andrii Nakryiko 
    Signed-off-by: Leon Hwang 
    Link: https://lore.kernel.org/r/20260107022022.12843-2-leon.hwang@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 1471c517cf7dae1a6342fb821d8ed501af956dd0
Author: Gaurav Batra 
Date:   Fri Nov 7 10:11:05 2025 -0600

    powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory
    
    Leverage ARCH_HAS_DMA_MAP_DIRECT config option for coherent allocations as
    well. This will bypass DMA ops for memory allocations that have been
    pre-mapped.
    
    Always set device bus_dma_limit when memory is pre-mapped. In some
    architectures, like PowerPC, pmemory can be converted to regular memory via
    daxctl command. This will gate the coherent allocations to pre-mapped RAM
    only, by dma_coherent_ok().
    
    Signed-off-by: Gaurav Batra 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/20251107161105.85999-1-gbatra@linux.ibm.com

commit 20ab1d11265350a9ea3d315d6c70170b8198f329
Author: Saket Kumar Bhaskar 
Date:   Wed Dec 10 12:20:33 2025 +0530

    powerpc64/bpf: Inline bpf_get_smp_processor_id() and bpf_get_current_task/_btf()
    
    Inline the calls to bpf_get_smp_processor_id() and bpf_get_current_task/_btf()
    in the powerpc bpf jit.
    
    powerpc saves the Logical processor number (paca_index) and pointer
    to current task (__current) in paca.
    
    Here is how the powerpc JITed assembly changes after this commit:
    
    Before:
    
    cpu = bpf_get_smp_processor_id();
    
    addis 12, 2, -517
    addi 12, 12, -29456
    mtctr 12
    bctrl
    mr      8, 3
    
    After:
    
    cpu = bpf_get_smp_processor_id();
    
    lhz 8, 8(13)
    
    To evaluate the performance improvements introduced by this change,
    the benchmark described in [1] was employed.
    
    +---------------+-------------------+-------------------+--------------+
    |      Name     |      Before       |        After      |   % change   |
    |---------------+-------------------+-------------------+--------------|
    | glob-arr-inc  | 40.701 ± 0.008M/s | 55.207 ± 0.021M/s |   + 35.64%   |
    | arr-inc       | 39.401 ± 0.007M/s | 56.275 ± 0.023M/s |   + 42.42%   |
    | hash-inc      | 24.944 ± 0.004M/s | 26.212 ± 0.003M/s |   +  5.08%   |
    +---------------+-------------------+-------------------+--------------+
    
    [1] https://github.com/anakryiko/linux/commit/8dec900975ef
    
    Reviewed-by: Puranjay Mohan 
    Signed-off-by: Saket Kumar Bhaskar 
    Acked-by: Hari Bathini 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/89abfdd6f6721fbe7897865e74f2f691e5f7824a.1765343385.git.skb99@linux.ibm.com

commit 58a075adf3fb1701435d29e0113284dc31d6e43e
Author: Saket Kumar Bhaskar 
Date:   Wed Dec 10 12:20:32 2025 +0530

    powerpc64/bpf: Support internal-only MOV instruction to resolve per-CPU addrs
    
    With the introduction of commit 7bdbf7446305 ("bpf: add special
    internal-only MOV instruction to resolve per-CPU addrs"),
    a new BPF instruction BPF_MOV64_PERCPU_REG has been added to
    resolve absolute addresses of per-CPU data from their per-CPU
    offsets. This update requires enabling support for this
    instruction in the powerpc JIT compiler.
    
    As of commit 7a0268fa1a36 ("[PATCH] powerpc/64: per cpu data
    optimisations"), the per-CPU data offset for the CPU is stored in
    the paca.
    
    To support this BPF instruction in the powerpc JIT, the following
    powerpc instructions are emitted:
    if (IS_ENABLED(CONFIG_SMP))
    ld tmp1_reg, 48(13)             //Load per-CPU data offset from paca(r13) in tmp1_reg.
    add dst_reg, src_reg, tmp1_reg  //Add the per cpu offset to the dst.
    else if (src_reg != dst_reg)
    mr dst_reg, src_reg             //Move src_reg to dst_reg, if src_reg != dst_reg
    
    To evaluate the performance improvements introduced by this change,
    the benchmark described in [1] was employed.
    
    Before Change:
    glob-arr-inc   :   41.580 ± 0.034M/s
    arr-inc        :   39.592 ± 0.055M/s
    hash-inc       :   25.873 ± 0.012M/s
    
    After Change:
    glob-arr-inc   :   42.024 ± 0.049M/s
    arr-inc        :   55.447 ± 0.031M/s
    hash-inc       :   26.565 ± 0.014M/s
    
    [1] https://github.com/anakryiko/linux/commit/8dec900975ef
    
    Reviewed-by: Puranjay Mohan 
    Signed-off-by: Saket Kumar Bhaskar 
    Acked-by: Hari Bathini 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/667fdaa19c1564141f6cd82e75b2be86a42c0f96.1765343385.git.skb99@linux.ibm.com

commit a5a9fd93d2c3c2bd31d27a25a601ae313d4aa74f
Author: Ankit Nautiyal 
Date:   Mon Jan 5 17:05:43 2026 +0530

    drm/i915/lt_phy_regs: Fix the SPDX identifier comment
    
    Fix the SPDX identifier comment as per the licensing rules [1].
    
    [1] https://www.kernel.org/doc/html/latest/process/license-rules.html
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105113544.574323-10-ankit.k.nautiyal@intel.com

commit 152fc133419417bf33cbcd05060fba83dbdb36ad
Author: Ankit Nautiyal 
Date:   Mon Jan 5 17:49:28 2026 +0530

    drm/i915/intel_lt_phy: Fix the SPDX identifier comment
    
    Fix the SPDX identifier comment as per the licensing rules [1].
    
    [1] https://www.kernel.org/doc/html/latest/process/license-rules.html
    
    v2: Drop the superfluous blank line. (Jani)
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105121929.576304-1-ankit.k.nautiyal@intel.com

commit a87a681860e857c9a0d05d084d4357bd2fbe9560
Author: Ankit Nautiyal 
Date:   Mon Jan 5 17:05:41 2026 +0530

    drm/i915/intel_gvt_api: Fix the SPDX identifier comment
    
    Fix the SPDX identifier comment as per the licensing rules [1].
    
    [1] https://www.kernel.org/doc/html/latest/process/license-rules.html
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105113544.574323-8-ankit.k.nautiyal@intel.com

commit 483f06ff8e56423d301a1b46a8b70285c1a8f3a3
Author: Ankit Nautiyal 
Date:   Mon Jan 5 17:05:40 2026 +0530

    drm/i915/intel_dsb_buffer: Fix the SPDX identifier comment
    
    Fix the SPDX identifier comment as per the licensing rules [1].
    
    [1] https://www.kernel.org/doc/html/latest/process/license-rules.html
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105113544.574323-7-ankit.k.nautiyal@intel.com

commit e9d95194bd413b837a57096069bf85d71d48d7af
Author: Ankit Nautiyal 
Date:   Mon Jan 5 17:05:39 2026 +0530

    drm/i915/intel_dsb: Fix the SPDX identifier comment
    
    Fix the SPDX identifier comment as per the licensing rules [1].
    
    [1] https://www.kernel.org/doc/html/latest/process/license-rules.html
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105113544.574323-6-ankit.k.nautiyal@intel.com

commit 8b140ae6d57f35735a33c8ace0ca79272ef1d5c6
Author: Ankit Nautiyal 
Date:   Mon Jan 5 17:05:38 2026 +0530

    drm/i915/intel_display_params: Fix the SPDX identifier comment
    
    Fix the SPDX identifier comment as per the licensing rules [1].
    
    [1] https://www.kernel.org/doc/html/latest/process/license-rules.html
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105113544.574323-5-ankit.k.nautiyal@intel.com

commit babd0b8db9dbf6da541025e76eb58fbba2a2151c
Author: Ankit Nautiyal 
Date:   Mon Jan 5 17:05:37 2026 +0530

    drm/i915/intel_cx0_phy_regs: Fix the SPDX identifier comment
    
    Fix the SPDX identifier comment as per the licensing rules [1].
    
    [1] https://www.kernel.org/doc/html/latest/process/license-rules.html
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105113544.574323-4-ankit.k.nautiyal@intel.com

commit 1d72c4d3a1929c628fe87f50ade2e043b855528c
Author: Ankit Nautiyal 
Date:   Mon Jan 5 17:05:36 2026 +0530

    drm/i915/intel_cx0_phy: Fix the SPDX identifier comment
    
    Fix the SPDX identifier comment as per the licensing rules [1].
    
    [1] https://www.kernel.org/doc/html/latest/process/license-rules.html
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105113544.574323-3-ankit.k.nautiyal@intel.com

commit 692ec65421799fdc4c97d09a1b349a29bc8d8a64
Author: Ankit Nautiyal 
Date:   Mon Jan 5 17:05:35 2026 +0530

    drm/i915/intel_alpm: Fix the SPDX identifier comment
    
    Fix the SPDX identifier comment as per the licensing rules [1].
    
    [1] https://www.kernel.org/doc/html/latest/process/license-rules.html
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105113544.574323-2-ankit.k.nautiyal@intel.com

commit 861574d51bbd7a06dbf07f658a9a8def012c2f74
Author: Christophe Leroy 
Date:   Wed Dec 24 12:20:55 2025 +0100

    powerpc/uaccess: Implement masked user access
    
    Masked user access avoids the address/size verification by access_ok().
    Allthough its main purpose is to skip the speculation in the
    verification of user address and size hence avoid the need of spec
    mitigation, it also has the advantage of reducing the amount of
    instructions required so it even benefits to platforms that don't
    need speculation mitigation, especially when the size of the copy is
    not know at build time.
    
    So implement masked user access on powerpc. The only requirement is
    to have memory gap that faults between the top user space and the
    real start of kernel area.
    
    On 64 bits platforms the address space is divided that way:
    
            0xffffffffffffffff      +------------------+
                                    |                  |
                                    |   kernel space   |
                                    |                  |
            0xc000000000000000      +------------------+  <== PAGE_OFFSET
                                    |//////////////////|
                                    |//////////////////|
            0x8000000000000000      |//////////////////|
                                    |//////////////////|
                                    |//////////////////|
            0x0010000000000000      +------------------+  <== TASK_SIZE_MAX
                                    |                  |
                                    |    user space    |
                                    |                  |
            0x0000000000000000      +------------------+
    
    Kernel is always above 0x8000000000000000 and user always
    below, with a gap in-between. It leads to a 3 instructions sequence:
    
     150:   7c 69 fe 76     sradi   r9,r3,63
     154:   79 29 00 40     clrldi  r9,r9,1
     158:   7c 63 48 78     andc    r3,r3,r9
    
    This sequence leaves r3 unmodified when it is below 0x8000000000000000
    and clamps it to 0x8000000000000000 if it is above.
    
    On 32 bits it is more tricky. In theory user space can go up to
    0xbfffffff while kernel will usually start at 0xc0000000. So a gap
    needs to be added in-between. Allthough in theory a single 4k page
    would suffice, it is easier and more efficient to enforce a 128k gap
    below kernel, as it simplifies the masking.
    
    e500 has the isel instruction which allows selecting one value or
    the other without branch and that instruction is not speculative, so
    use it. Allthough GCC usually generates code using that instruction,
    it is safer to use inline assembly to be sure. The result is:
    
      14:   3d 20 bf fe     lis     r9,-16386
      18:   7c 03 48 40     cmplw   r3,r9
      1c:   7c 69 18 5e     iselgt  r3,r9,r3
    
    On other ones, when kernel space is over 0x80000000 and user space
    is below, the logic in mask_user_address_simple() leads to a
    3 instruction sequence:
    
      64:   7c 69 fe 70     srawi   r9,r3,31
      68:   55 29 00 7e     clrlwi  r9,r9,1
      6c:   7c 63 48 78     andc    r3,r3,r9
    
    This is the default on powerpc 8xx.
    
    When the limit between user space and kernel space is not 0x80000000,
    mask_user_address_32() is used and a 6 instructions sequence is
    generated:
    
      24:   54 69 7c 7e     srwi    r9,r3,17
      28:   21 29 57 ff     subfic  r9,r9,22527
      2c:   7d 29 fe 70     srawi   r9,r9,31
      30:   75 2a b0 00     andis.  r10,r9,45056
      34:   7c 63 48 78     andc    r3,r3,r9
      38:   7c 63 53 78     or      r3,r3,r10
    
    The constraint is that TASK_SIZE be aligned to 128K in order to get
    the most optimal number of instructions.
    
    When CONFIG_PPC_BARRIER_NOSPEC is not defined, fallback on the
    test-based masking as it is quicker than the 6 instructions sequence
    but not quicker than the 3 instructions sequences above.
    
    As an exemple, allthough barrier_nospec() voids on the 8xx, this
    change has the following impact on strncpy_from_user(): the length of
    the function is reduced from 488 to 340 bytes:
    
    Start of the function with the patch:
    
    00000000 :
       0:   7c ab 2b 79     mr.     r11,r5
       4:   40 81 01 40     ble     144 
       8:   7c 89 fe 70     srawi   r9,r4,31
       c:   55 29 00 7e     clrlwi  r9,r9,1
      10:   7c 84 48 78     andc    r4,r4,r9
      14:   3d 20 dc 00     lis     r9,-9216
      18:   7d 3a c3 a6     mtspr   794,r9
      1c:   2f 8b 00 03     cmpwi   cr7,r11,3
      20:   40 9d 00 b4     ble     cr7,d4 
    ...
    
    Start of the function without the patch:
    
    00000000 :
       0:   7c a0 2b 79     mr.     r0,r5
       4:   40 81 01 10     ble     114 
       8:   2f 84 00 00     cmpwi   cr7,r4,0
       c:   41 9c 01 30     blt     cr7,13c 
      10:   3d 20 80 00     lis     r9,-32768
      14:   7d 24 48 50     subf    r9,r4,r9
      18:   7f 80 48 40     cmplw   cr7,r0,r9
      1c:   7c 05 03 78     mr      r5,r0
      20:   41 9d 01 00     bgt     cr7,120 
      24:   3d 20 80 00     lis     r9,-32768
      28:   7d 25 48 50     subf    r9,r5,r9
      2c:   7f 84 48 40     cmplw   cr7,r4,r9
      30:   38 e0 ff f2     li      r7,-14
      34:   41 9d 00 e4     bgt     cr7,118 
      38:   94 21 ff e0     stwu    r1,-32(r1)
      3c:   3d 20 dc 00     lis     r9,-9216
      40:   7d 3a c3 a6     mtspr   794,r9
      44:   2b 85 00 03     cmplwi  cr7,r5,3
      48:   40 9d 01 6c     ble     cr7,1b4 
    ...
     118:   7c e3 3b 78     mr      r3,r7
     11c:   4e 80 00 20     blr
     120:   7d 25 4b 78     mr      r5,r9
     124:   3d 20 80 00     lis     r9,-32768
     128:   7d 25 48 50     subf    r9,r5,r9
     12c:   7f 84 48 40     cmplw   cr7,r4,r9
     130:   38 e0 ff f2     li      r7,-14
     134:   41 bd ff e4     bgt     cr7,118 
     138:   4b ff ff 00     b       38 
     13c:   38 e0 ff f2     li      r7,-14
     140:   4b ff ff d8     b       118 
    ...
    
    Signed-off-by: Christophe Leroy 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/8f418183d9125cc0bf23922bc2ef2a1130d8b63a.1766574657.git.chleroy@kernel.org

commit 370d841929c3b863b7409047e8c84eabc4d0960f
Author: Christophe Leroy 
Date:   Wed Dec 24 12:20:54 2025 +0100

    powerpc/32: Automatically adapt TASK_SIZE based on constraints
    
    At the time being, TASK_SIZE can be customized by the user via Kconfig
    but it is not possible to check all constraints in Kconfig. Impossible
    setups are detected at compile time with BUILD_BUG() but that leads
    to build failure when setting crazy values. It is not a problem on its
    own because the user will usually either use the default value or set
    a well thought value. However build robots generate crazy random
    configs that lead to build failures, and build robots see it as a
    regression every time a patch adds such a constraint.
    
    So instead of failing the build when the custom TASK_SIZE is too
    big, just adjust it to the maximum possible value matching the setup.
    
    Several architectures already calculate TASK_SIZE based on other
    parameters and options.
    
    In order to do so, move MODULES_VADDR calculation into task_size_32.h
    and ensure that:
    - On book3s/32, userspace and module area have their own segments (256M)
    - On 8xx, userspace has its own full PGDIR entries (4M)
    
    Then TASK_SIZE is guaranteed to be correct so remove related
    BUILD_BUG()s.
    
    Signed-off-by: Christophe Leroy 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/6a2575420770d075cd090b5a316730a2ffafdee4.1766574657.git.chleroy@kernel.org

commit fb7903771c107b0358584a359b8545060e23c530
Author: Christophe Leroy 
Date:   Wed Dec 24 12:20:53 2025 +0100

    powerpc/32s: Fix segments setup when TASK_SIZE is not a multiple of 256M
    
    For book3s/32 it is assumed that TASK_SIZE is a multiple of 256 Mbytes,
    but Kconfig allows any value for TASK_SIZE.
    
    In all relevant calculations, align TASK_SIZE to the upper 256 Mbytes
    boundary.
    
    Also use ASM_CONST() in the definition of TASK_SIZE to ensure it is
    seen as an unsigned constant.
    
    Signed-off-by: Christophe Leroy 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/8928d906079e156c59794c41e826a684eaaaebb4.1766574657.git.chleroy@kernel.org

commit 704f4300315396af94e26ec0127ff0cd3fd309bf
Author: Christophe Leroy 
Date:   Wed Dec 24 12:20:52 2025 +0100

    powerpc/uaccess: Refactor user_{read/write/}_access_begin()
    
    user_read_access_begin() and user_write_access_begin() and
    user_access_begin() are now very similar. Create a common
    __user_access_begin() that takes direction as parameter.
    
    In order to avoid a warning with the conditional call of
    barrier_nospec() which is sometimes an empty macro, change it to a
    do {} while (0).
    
    Signed-off-by: Christophe Leroy 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/2b4f9d4e521e0b56bf5cb239916b4a178c4d2007.1766574657.git.chleroy@kernel.org

commit 5458989a0e48c2bd51a7d37a04ff6ae489fe5458
Author: Christophe Leroy 
Date:   Wed Dec 24 12:20:51 2025 +0100

    powerpc/uaccess: Remove {allow/prevent}_{read/write/read_write}_{from/to/}_user()
    
    The six following functions have become simple single-line fonctions
    that do not have much added value anymore:
    - allow_read_from_user()
    - allow_write_to_user()
    - allow_read_write_user()
    - prevent_read_from_user()
    - prevent_write_to_user()
    - prevent_read_write_user()
    
    Directly call allow_user_access() and prevent_user_access(), it doesn't
    reduce the readability and it removes unnecessary middle functions.
    
    Signed-off-by: Christophe Leroy 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/70971f0ba81eab742a120e5bfdeff6b42d08fd98.1766574657.git.chleroy@kernel.org

commit e3efbfbfaaaa739072b2756cfb76cd3de6d91c0f
Author: Christophe Leroy 
Date:   Wed Dec 24 12:20:50 2025 +0100

    powerpc/uaccess: Remove unused size and from parameters from allow_access_user()
    
    Since commit 16132529cee5 ("powerpc/32s: Rework Kernel Userspace
    Access Protection") the size parameter is unused on all platforms.
    
    And the 'from' parameter has never been used.
    
    Remove them.
    
    Signed-off-by: Christophe Leroy 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/4552b00707923b71150ee47b925d6eaae1b03261.1766574657.git.chleroy@kernel.org

commit 5fbc09eb0b4f4b1a4b33abebacbeee0d29f195e9
Author: Christophe Leroy 
Date:   Wed Dec 24 12:20:49 2025 +0100

    powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user()
    
    Commit 74e19ef0ff80 ("uaccess: Add speculation barrier to
    copy_from_user()") added a redundant barrier_nospec() in
    copy_from_user(), because powerpc is already calling
    barrier_nospec() in allow_read_from_user() and
    allow_read_write_user(). But on other architectures that
    call to barrier_nospec() was missing. So change powerpc
    instead of reverting the above commit and having to fix
    other architectures one by one. This is now possible
    because barrier_nospec() has also been added in
    copy_from_user_iter().
    
    Move barrier_nospec() out of allow_read_from_user() and
    allow_read_write_user(). This will also allow reuse of those
    functions when implementing masked user access which doesn't
    require barrier_nospec().
    
    Don't add it back in raw_copy_from_user() as it is already called
    by copy_from_user() and copy_from_user_iter().
    
    Fixes: 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()")
    Signed-off-by: Christophe Leroy 
    Signed-off-by: Madhavan Srinivasan 
    Link: https://patch.msgid.link/f29612105c5fcbc8ceb7303808ddc1a781f0f6b5.1766574657.git.chleroy@kernel.org

commit 0eda086de85e140f53c6123a4c00662f4e614ee4
Author: Chao Yu 
Date:   Tue Jan 6 14:31:17 2026 +0800

    f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly
    
    Sysfs entry name is gc_pin_file_thresh instead of gc_pin_file_threshold,
    fix it.
    
    Cc: stable@kernel.org
    Fixes: c521a6ab4ad7 ("f2fs: fix to limit gc_pin_file_threshold")
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 7633a7387eb4d0259d6bea945e1d3469cd135bbc
Author: Yongpeng Yang 
Date:   Tue Jan 6 20:12:11 2026 +0800

    f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
    
    During SPO tests, when mounting F2FS, an -EINVAL error was returned from
    f2fs_recover_inode_page. The issue occurred under the following scenario
    
    Thread A                                     Thread B
    f2fs_ioc_commit_atomic_write
     - f2fs_do_sync_file // atomic = true
      - f2fs_fsync_node_pages
        : last_folio = inode folio
        : schedule before folio_lock(last_folio) f2fs_write_checkpoint
                                                  - block_operations// writeback last_folio
                                                  - schedule before f2fs_flush_nat_entries
        : set_fsync_mark(last_folio, 1)
        : set_dentry_mark(last_folio, 1)
        : folio_mark_dirty(last_folio)
        - __write_node_folio(last_folio)
          : f2fs_down_read(&sbi->node_write)//block
                                                  - f2fs_flush_nat_entries
                                                    : {struct nat_entry}->flag |= BIT(IS_CHECKPOINTED)
                                                  - unblock_operations
                                                    : f2fs_up_write(&sbi->node_write)
                                                 f2fs_write_checkpoint//return
          : f2fs_do_write_node_page()
    f2fs_ioc_commit_atomic_write//return
                                                 SPO
    
    Thread A calls f2fs_need_dentry_mark(sbi, ino), and the last_folio has
    already been written once. However, the {struct nat_entry}->flag did not
    have the IS_CHECKPOINTED set, causing set_dentry_mark(last_folio, 1) and
    write last_folio again after Thread B finishes f2fs_write_checkpoint.
    
    After SPO and reboot, it was detected that {struct node_info}->blk_addr
    was not NULL_ADDR because Thread B successfully write the checkpoint.
    
    This issue only occurs in atomic write scenarios. For regular file
    fsync operations, the folio must be dirty. If
    block_operations->f2fs_sync_node_pages successfully submit the folio
    write, this path will not be executed. Otherwise, the
    f2fs_write_checkpoint will need to wait for the folio write submission
    to complete, as sbi->nr_pages[F2FS_DIRTY_NODES] > 0. Therefore, the
    situation where f2fs_need_dentry_mark checks that the {struct
    nat_entry}->flag /wo the IS_CHECKPOINTED flag, but the folio write has
    already been submitted, will not occur.
    
    Therefore, for atomic file fsync, sbi->node_write should be acquired
    through __write_node_folio to ensure that the IS_CHECKPOINTED flag
    correctly indicates that the checkpoint write has been completed.
    
    Fixes: 608514deba38 ("f2fs: set fsync mark only for the last dnode")
    Cc: stable@kernel.org
    Signed-off-by: Sheng Yong 
    Signed-off-by: Jinbao Liu 
    Signed-off-by: Yongpeng Yang 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 071e50d61cf2474bec724c10bb1ae8082ef6c237
Author: Yongpeng Yang 
Date:   Wed Jan 7 10:33:47 2026 +0800

    f2fs: change seq_file_ra_mul and max_io_bytes to unsigned int
    
    {struct file_ra_state}->ra_pages and {struct bio}->bi_iter.bi_size is
    defined as unsigned int, so values of seq_file_ra_mul and max_io_bytes
    exceeding UINT_MAX are meaningless.
    
    Signed-off-by: Yongpeng Yang 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 98ea0039dbfdd00e5cc1b9a8afa40434476c0955
Author: Yongpeng Yang 
Date:   Wed Jan 7 10:33:46 2026 +0800

    f2fs: fix out-of-bounds access in sysfs attribute read/write
    
    Some f2fs sysfs attributes suffer from out-of-bounds memory access and
    incorrect handling of integer values whose size is not 4 bytes.
    
    For example:
    vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out
    vm:~# cat /sys/fs/f2fs/vde/carve_out
    65537
    vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold
    vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold
    1
    
    carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit
    integer. However, the sysfs interface allows setting it to a value
    larger than 255, resulting in an out-of-range update.
    
    atgc_age_threshold maps to {struct atgc_management}->age_threshold,
    which is a 64-bit integer, but its sysfs interface cannot correctly set
    values larger than UINT_MAX.
    
    The root causes are:
    1. __sbi_store() treats all default values as unsigned int, which
    prevents updating integers larger than 4 bytes and causes out-of-bounds
    writes for integers smaller than 4 bytes.
    
    2. f2fs_sbi_show() also assumes all default values are unsigned int,
    leading to out-of-bounds reads and incorrect access to integers larger
    than 4 bytes.
    
    This patch introduces {struct f2fs_attr}->size to record the actual size
    of the integer associated with each sysfs attribute. With this
    information, sysfs read and write operations can correctly access and
    update values according to their real data size, avoiding memory
    corruption and truncation.
    
    Fixes: b59d0bae6ca3 ("f2fs: add sysfs support for controlling the gc_thread")
    Cc: stable@kernel.org
    Signed-off-by: Jinbao Liu 
    Signed-off-by: Yongpeng Yang 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit c0c589fa1d17fc13b3be1a4dd2ec62266c2a0659
Author: Nanzhe Zhao 
Date:   Mon Jan 5 23:30:58 2026 +0800

    f2fs: Accounting large folio subpages before bio submission
    
    In f2fs_read_data_large_folio(), read_pages_pending is incremented only
    after the subpage has been added to the BIO.  With a heavily fragmented
    file, each new subpage can force submission of the previous BIO.
    
    If the BIO completes quickly, f2fs_finish_read_bio() may decrement
    read_pages_pending to zero and call folio_end_read() while the read loop
    is still processing other subpages of the same large folio.
    
    Fix the ordering by incrementing read_pages_pending before any possible
    BIO submission for the current subpage, matching the iomap ordering and
    preventing premature folio_end_read().
    
    Signed-off-by: Nanzhe Zhao 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 00feea1dfcea2cc7c22e58b6325f72637c6ea217
Author: Nanzhe Zhao 
Date:   Mon Jan 5 23:30:57 2026 +0800

    f2fs: Zero f2fs_folio_state on allocation
    
    f2fs_folio_state is attached to folio->private and is expected to start
    with read_pages_pending == 0.  However, the structure was allocated from
    ffs_entry_slab without being fully initialized, which can leave
    read_pages_pending with stale values.
    
    Allocate the object with __GFP_ZERO so all fields are reliably zeroed at
    creation time.
    
    Signed-off-by: Nanzhe Zhao 
    Reviewed-by: Barry Song 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit d36de29f4bb59b24e57ff22403baae6fc7e89bd8
Author: Chao Yu 
Date:   Sun Jan 4 10:07:29 2026 +0800

    f2fs: sysfs: introduce inject_lock_timeout
    
    This patch adds a new sysfs node in /sys/fs/f2fs//inject_lock_timeout,
    it relies on CONFIG_F2FS_FAULT_INJECTION kernel config.
    
    It can be used to simulate different type of timeout in lock duration.
    
    ==========     ===============================
    Flag_Value     Flag_Description
    ==========     ===============================
    0x00000000     No timeout (default)
    0x00000001     Simulate running time
    0x00000002     Simulate IO type sleep time
    0x00000003     Simulate Non-IO type sleep time
    0x00000004     Simulate runnable time
    ==========     ===============================
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit c56254e2e04216839699937a04aac18c585e833e
Author: Chao Yu 
Date:   Sun Jan 4 10:07:28 2026 +0800

    f2fs: introduce FAULT_LOCK_TIMEOUT
    
    This patch introduce a new fault type FAULT_LOCK_TIMEOUT, it can
    be used to inject timeout into lock duration.
    
    Timeout type can be set via /sys/fs/f2fs//inject_timeout_type
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 7a127c80b0eec7649b6df14c12e53f859dddbe52
Author: Chao Yu 
Date:   Sun Jan 4 10:07:27 2026 +0800

    f2fs: rename FAULT_TIMEOUT to FAULT_ATOMIC_TIMEOUT
    
    No logic changes.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 6fa116053951d5785ef1a0b060858843e663a31a
Author: Chao Yu 
Date:   Sun Jan 4 10:07:26 2026 +0800

    f2fs: fix timeout precision of f2fs_io_schedule_timeout_killable()
    
    Sometimes, f2fs_io_schedule_timeout_killable(HZ) may delay for about 2
    seconds, this is because __f2fs_schedule_timeout(DEFAULT_SCHEDULE_TIMEOUT)
    may delay for about 2 * DEFAULT_SCHEDULE_TIMEOUT due to its precision, but
    we only account the delay as DEFAULT_SCHEDULE_TIMEOUT as below, fix it.
    
    f2fs_io_schedule_timeout_killable()
    ..
            timeout -= DEFAULT_SCHEDULE_TIMEOUT;
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit da90b6715567e900a3c5d112dfaf8f385b343edc
Author: Chao Yu 
Date:   Sun Jan 4 10:07:25 2026 +0800

    f2fs: fix to use jiffies based precision for DEFAULT_SCHEDULE_TIMEOUT
    
    Due to timeout parameter in {io,}_schedule_timeout() is based on jiffies
    unit precision. It will lose precision when using msecs_to_jiffies(x)
    for conversion.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit b5da276ae6abe95767c3e1eb72f39e0ef8df7d22
Author: Chao Yu 
Date:   Sun Jan 4 10:07:24 2026 +0800

    f2fs: clean up w/ __f2fs_schedule_timeout()
    
    No logic changes.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 67972c2b89749356bc9823bd58f7f14b28e681e4
Author: Chao Yu 
Date:   Sun Jan 4 10:07:23 2026 +0800

    f2fs: trace elapsed time for io_rwsem lock
    
    Use f2fs_{down,up}_{read,write}_trace for io_rwsem to trace lock elapsed time.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit ce9fe67c9cdb21a0321f8ea37b725b3258d2b3cd
Author: Chao Yu 
Date:   Sun Jan 4 10:07:22 2026 +0800

    f2fs: trace elapsed time for cp_global_sem lock
    
    Use f2fs_{down,up}_write_trace for cp_global_sem to trace lock elapsed time.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit e605302c14ffda051dc7fbc5f27e1fecc9f681e3
Author: Chao Yu 
Date:   Sun Jan 4 18:34:12 2026 +0800

    f2fs: trace elapsed time for gc_lock lock
    
    Use f2fs_{down,up}_write_trace for gc_lock to trace lock elapsed time.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit bb28b66875cca72fcb62ee572fb32e0d4267a5f9
Author: Chao Yu 
Date:   Sun Jan 4 10:07:20 2026 +0800

    f2fs: trace elapsed time for node_write lock
    
    Use f2fs_{down,up}_read_trace for node_write to trace lock elapsed time.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit f9f93602512bceb28865942abfab54021e3a3d86
Author: Chao Yu 
Date:   Sun Jan 4 10:07:19 2026 +0800

    f2fs: trace elapsed time for node_change lock
    
    Use f2fs_{down,up}_read_trace for node_change to trace lock elapsed time.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 66e9e0d55d117a7de2c00a9a06fb943ead56e1c2
Author: Chao Yu 
Date:   Sun Jan 4 10:07:18 2026 +0800

    f2fs: trace elapsed time for cp_rwsem lock
    
    Use f2fs_{down,up}_read_trace for cp_rwsem to trace lock elapsed time.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit e4b75621fc439399b94c4265cb54d2bda1177397
Author: Chao Yu 
Date:   Sun Jan 4 10:07:17 2026 +0800

    f2fs: sysfs: introduce max_lock_elapsed_time
    
    This patch add a new sysfs node in /sys/fs/f2fs//max_lock_elapsed_time.
    
    This is a threshold, once a thread enters critical region that lock covers,
    total elapsed time exceeds this threshold, f2fs will print tracepoint to dump
    information of related context. This sysfs entry can be used to control the
    value of threshold, by default, the value is 500 ms.
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 79b3cebc70fcadf914d3ad1ae59d59cc62a47c46
Author: Chao Yu 
Date:   Sun Jan 4 10:07:16 2026 +0800

    f2fs: add lock elapsed time trace facility for f2fs rwsemphore
    
    This patch adds lock elapsed time trace facility for f2fs rwsemphore.
    
    If total elapsed time of critical region covered by lock exceeds a
    threshold, it will print tracepoint to dump information of lock related
    context, including:
    - thread information
    - CPU/IO priority
    - lock information
    - elapsed time
     - total time
     - running time (depend on CONFIG_64BIT)
     - runnable time (depend on CONFIG_SCHED_INFO and CONFIG_SCHEDSTATS)
     - io sleep time (depend on CONFIG_TASK_DELAY_ACCT and
                      /proc/sys/kernel/task_delayacct)
     - other time    (by default other time will account nonio sleep time,
                      but, if above kconfig is not defined, other time will
                      include runnable time and/or io sleep time as wll)
    
    output:
        f2fs_lock_elapsed_time: dev = (254,52), comm: sh, pid: 13855, prio: 120, ioprio_class: 2, ioprio_data: 4, lock_name: cp_rwsem, lock_type: rlock, total: 1000, running: 993, runnable: 2, io_sleep: 0, other: 5
    
    Signed-off-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 7ec199117c32543e0fa8787a6eedd9126523a8d4
Author: Daeho Jeong 
Date:   Tue Dec 30 09:38:45 2025 -0800

    f2fs: flush plug periodically during GC to maximize readahead effect
    
    During the garbage collection process, F2FS submits readahead I/Os for
    valid blocks. However, since the GC loop runs within a single plug scope
    without intermediate flushing, these readahead I/Os often accumulate in
    the block layer's plug list instead of being dispatched to the device
    immediately.
    
    Consequently, when the GC thread attempts to lock the page later, the
    I/O might not have completed (or even started), leading to a "read try
    and wait" scenario. This negates the benefit of readahead and causes
    unnecessary delays in GC latency.
    
    This patch addresses this issue by introducing an intermediate
    blk_finish_plug() and blk_start_plug() pair within the GC loop. This
    forces the dispatch of pending I/Os, ensuring that readahead pages are
    fetched in time, thereby reducing GC latency.
    
    Signed-off-by: Daeho Jeong 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 8e7148b5602321be48614bcde048cbe1c738ce3e
Author: Thomas Fourier 
Date:   Mon Jan 5 22:29:15 2026 +0100

    atm: idt77252: Use sb_pool_remove()
    
    Replacing the manual pool remove with the dedicated function.  This is
    safer and more consistent with the rest of the code[1].
    
    [1]; https://lore.kernel.org/all/20250625094013.GL1562@horms.kernel.org/
    
    Signed-off-by: Thomas Fourier 
    Link: https://patch.msgid.link/20260105212916.26678-2-fourier.thomas@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 472711068fa950642b9b471aaebcc82e9930eb8c
Author: Ben Dooks 
Date:   Tue Jan 6 17:13:32 2026 +0000

    lsm: make keys for static branch static
    
    The key use for static-branches are not refrenced by name outside
    of the security/security.c file, so make them static. This stops
    the sparse warnings about "Should it be static?" such as:
    
    security/security.c: note: in included file:
    ./include/linux/lsm_hook_defs.h:29:1: warning: symbol
      'security_hook_active_binder_set_context_mgr_0' was not declared.
      Should it be static?
    ./include/linux/lsm_hook_defs.h:29:1: warning: symbol
      'security_hook_active_binder_set_context_mgr_1' was not declared.
      Should it be static?
    ...
    
    Signed-off-by: Ben Dooks 
    [PM: trimmed sparse output for line-length, readability]
    Signed-off-by: Paul Moore 

commit 5547598e59d724d805551596b52b1c40120372d8
Author: Casey Schaufler 
Date:   Mon Dec 22 13:01:48 2025 -0800

    cred: remove unused set_security_override_from_ctx()
    
    The function set_security_override_from_ctx() has no in-tree callers
    since 6.14. Remove it.
    
    Signed-off-by: Casey Schaufler 
    [PM: subject tweak, merge fuzz]
    Signed-off-by: Paul Moore 

commit a8d506759231124efb911a3bd14d1ec2d9de15a1
Merge: ea180ffbd27ce5 b81d5e9d965e0a
Author: Alexei Starovoitov 
Date:   Tue Jan 6 17:42:55 2026 -0800

    Merge branch 'bpf-verifier-allow-calling-arena-functions-when-holding-bpf-lock'
    
    Emil Tsalapatis says:
    
    ====================
    bpf/verifier: Allow calling arena functions when holding BPF lock
    
    BPF arena-related kfuncs now cannot sleep, so they are safe to call
    while holding a spinlock. However, the verifier still rejects
    programs that do so. Update the verifier to allow arena kfunc
    calls while holding a lock.
    
    Signed-off-by: Emil Tsalapatis 
    
    Changes v1->v2: (https://lore.kernel.org/r/20260106-arena-under-lock-v1-0-6ca9c121d826@etsalapatis.com)
    - Added patch to account for active locks in_sleepable_context() (AI)
    ====================
    
    Link: https://patch.msgid.link/20260106-arena-under-lock-v2-0-378e9eab3066@etsalapatis.com
    Signed-off-by: Alexei Starovoitov 

commit b81d5e9d965e0af2c1f21fc392a23e598171f9d6
Author: Emil Tsalapatis 
Date:   Tue Jan 6 18:36:45 2026 -0500

    selftests/bpf: add tests for arena kfuncs under lock
    
    Add selftests to ensure the verifier permits calling the arena
    kfunc API while holding a lock.
    
    Signed-off-by: Emil Tsalapatis 
    Link: https://lore.kernel.org/r/20260106-arena-under-lock-v2-3-378e9eab3066@etsalapatis.com
    Signed-off-by: Alexei Starovoitov 

commit 39f77533b6c16e7fbd72e2560e13c9435d2602f5
Author: Emil Tsalapatis 
Date:   Tue Jan 6 18:36:44 2026 -0500

    bpf: Allow calls to arena functions while holding spinlocks
    
    The bpf_arena_*_pages() kfuncs can be called from sleepable contexts,
    but the verifier still prevents BPF programs from calling them while
    holding a spinlock. Amend the verifier to allow for BPF programs
    calling arena page management functions while holding a lock.
    
    Signed-off-by: Emil Tsalapatis 
    Link: https://lore.kernel.org/r/20260106-arena-under-lock-v2-2-378e9eab3066@etsalapatis.com
    Signed-off-by: Alexei Starovoitov 

commit b25b48c7d37617601ebc8cf2633bee95aa82c697
Author: Emil Tsalapatis 
Date:   Tue Jan 6 18:36:43 2026 -0500

    bpf: Check active lock count in in_sleepable_context()
    
    The in_sleepable_context() function is used to specialize the BPF code
    in do_misc_fixups(). With the addition of nonsleepable arena kfuncs,
    there are kfuncs whose specialization depends on whether we are
    holding a lock. We should use the nonsleepable version while
    holding a lock and the sleepable one when not.
    
    Add a check for active_locks to account for locking when specializing
    arena kfuncs.
    
    Signed-off-by: Emil Tsalapatis 
    Link: https://lore.kernel.org/r/20260106-arena-under-lock-v2-1-378e9eab3066@etsalapatis.com
    Signed-off-by: Alexei Starovoitov 

commit 3b7a108c4197f9fd0b593c6b4b0de457d9ed4c87
Author: Willem de Bruijn 
Date:   Mon Jan 5 12:25:02 2026 -0500

    selftests/net: packetdrill: add minimal client and server tests
    
    Introduce minimal tests. These can serve as simple illustrative
    examples, and as templates when writing new tests.
    
    When adding new cases, it can be easier to extend an existing base
    test rather than start from scratch. The existing tests all focus on
    real, often non-trivial, features. It is not obvious which to take as
    starting point, and arguably none really qualify.
    
    Add two tests
    - the client test performs the active open and initial close
    - the server test implements the passive open and final close
    
    Signed-off-by: Willem de Bruijn 
    Link: https://patch.msgid.link/20260105172529.3514786-1-willemdebruijn.kernel@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 55ffb0b14a4d310390ea2dd5a92e6d2e5c80d0ef
Author: Daniel Sedlak 
Date:   Mon Jan 5 12:55:33 2026 +0100

    tcp: clarify tcp_congestion_ops functions comments
    
    The optional and required hints in the tcp_congestion_ops are information
    for the user of this interface to signalize its importance when
    implementing these functions.
    
    However, cong_avoid comment incorrectly tells that it is required,
    in reality congestion control must provide one of either cong_avoid or
    cong_control.
    
    In addition, min_tso_segs has not had any comment optional/required
    hints. So mark it as optional since it is used only in BBR.
    
    Co-developed-by: Neal Cardwell 
    Signed-off-by: Neal Cardwell 
    Signed-off-by: Daniel Sedlak 
    Link: https://patch.msgid.link/20260105115533.1151442-1-daniel.sedlak@cdn77.com
    Signed-off-by: Jakub Kicinski 

commit 2d38a4e3e208da19e23272175e383b917d2fdc0e
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:31 2026 +0000

    rust: security: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Paul Moore 

commit 517fd96cba7bffe23c7ef353a33e2ca12e739e6a
Author: Alice Ryhl 
Date:   Mon Jan 5 12:42:20 2026 +0000

    rust: cred: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Paul Moore 

commit f66086798f91f095ce377ca4f3d2765e305a842e
Author: Vivian Wang 
Date:   Sun Jan 4 14:00:04 2026 +0800

    net: spacemit: Remove broken flow control support
    
    The current flow control implementation doesn't handle autonegotiation
    and ethtool operations properly. Remove it for now so we don't claim
    support for something that doesn't really work. A better implementation
    will be sent in future patches.
    
    Signed-off-by: Vivian Wang 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/20260104-k1-ethernet-actually-remove-fc-v3-1-3871b055064c@iscas.ac.cn
    Signed-off-by: Jakub Kicinski 

commit 48b27ea6239a797b286919d549e8d8a5a54d89f3
Author: Breno Leitao 
Date:   Mon Jan 5 07:28:26 2026 -0800

    net: gve: convert to use .get_rx_ring_count
    
    Convert the Google Virtual Ethernet (GVE) driver to use the new
    .get_rx_ring_count ethtool operation instead of handling
    ETHTOOL_GRXRINGS in .get_rxnfc. This simplifies the code by moving the
    ring count query to a dedicated callback.
    
    The new callback provides the same functionality in a more direct way,
    following the ongoing ethtool API modernization.
    
    Reviewed-by: Subbaraya Sundeep 
    Reviewed-by: Harshitha Ramamurthy 
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260105-gxring_google-v2-1-e7cfe924d429@debian.org
    Signed-off-by: Jakub Kicinski 

commit 27a01c1969a5d5ed4739e45777957445af96322d
Author: Eric Dumazet 
Date:   Mon Jan 5 16:30:54 2026 +0000

    net: fully inline backlog_unlock_irq_restore()
    
    Some arches (like x86) do not inline spin_unlock_irqrestore().
    
    backlog_unlock_irq_restore() is in RPS/RFS critical path,
    we prefer using spin_unlock() + local_irq_restore() for
    optimal performance.
    
    Also change backlog_unlock_irq_restore() second argument
    to avoid a pointless dereference.
    
    No difference in net/core/dev.o code size.
    
    Signed-off-by: Eric Dumazet 
    Link: https://patch.msgid.link/20260105163054.13698-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski 

commit 3f049b6534501be087cbe7c770829c32ff418d39
Author: Francesco Dolcini 
Date:   Mon Jan 5 16:24:50 2026 +0100

    net: fec: Add stop mode support on i.MX8DX/i.MX8QP
    
    Add additional machines that requires communication to the SC firmware
    to set the GPR bit required for stop mode support.
    
    NXP i.MX8DX (fsl,imx8dx) is a low end version of i.MX8QXP (fsl,imx8qxp),
    while NXP i.MX8QP (fsl,imx8qp) is a low end version of i.MX8QM
    (fsl,imx8qm).
    
    Signed-off-by: Francesco Dolcini 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/20260105152452.84338-1-francesco@dolcini.it
    Signed-off-by: Jakub Kicinski 

commit b70c5c49238d038143f00cca35ee749b2d2506d8
Author: Yeounsu Moon 
Date:   Mon Jan 5 22:05:53 2026 +0900

    net: dlink: replace printk() with netdev_{info,dbg}() in rio_probe1()
    
    Replace rio_probe1() printk(KERN_INFO) messages with netdev_{info,dbg}().
    
    Keep one netdev_info() line for device identification; move the rest to
    netdev_dbg() to avoid spamming the kernel log.
    
    Log rx_timeout on a separate line since netdev_*() prefixes each
    message and the multi-line formatting looks broken otherwise.
    
    No functional change intended.
    
    Tested-on: D-Link DGE-550T Rev-A3
    Signed-off-by: Yeounsu Moon 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/20260105130552.8721-2-yyyynoom@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 4d513329b87c1bd0546d9f0288794e244322daa6
Author: Lorenzo Bianconi 
Date:   Mon Jan 5 10:40:47 2026 +0100

    net: airoha: Use gdm port enum value whenever possible
    
    Use AIROHA_GDMx_IDX enum value whenever possible.
    This patch is just cosmetic changes and does not introduce any logic one.
    
    Signed-off-by: Lorenzo Bianconi 
    Link: https://patch.msgid.link/20260105-airoha-use-port-idx-enum-v1-1-503ca5763858@kernel.org
    Signed-off-by: Jakub Kicinski 

commit e9cd04b2816f8ebae9b274f5c52145c8f40d4a6f
Author: Eric Dumazet 
Date:   Mon Jan 5 10:17:19 2026 +0000

    udp: udplite is unlikely
    
    Add some unlikely() annotations to speed up the fast path,
    at least with clang compiler.
    
    Signed-off-by: Eric Dumazet 
    Link: https://patch.msgid.link/20260105101719.2378881-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski 

commit e4bc5dd53bf5d46cd58f081ffccc3809e2be5373
Author: Lorenzo Bianconi 
Date:   Mon Jan 5 09:49:16 2026 +0100

    net: airoha: npu: Dump fw version during probe
    
    Dump firmware version running on the npu during module probe.
    
    Signed-off-by: Lorenzo Bianconi 
    Link: https://patch.msgid.link/20260105-airoha-npu-dump-fw-v1-1-36d8326975f8@kernel.org
    Signed-off-by: Jakub Kicinski 

commit d362f446334c45437107a592c3b15b461211d362
Author: Jiawen Wu 
Date:   Mon Jan 5 15:11:58 2026 +0800

    net: libwx: remove unused rx_buffer_pgcnt
    
    The variable rx_buffer_pgcnt is redundant, just remove it.
    
    Signed-off-by: Jiawen Wu 
    Link: https://patch.msgid.link/F0907C8394B2D4A8+20260105071158.49929-1-jiawenwu@trustnetic.com
    Signed-off-by: Jakub Kicinski 

commit c86af46b9c7af2041495231fd59834da6da1543c
Author: Gustavo A. R. Silva 
Date:   Mon Jan 5 15:45:25 2026 +0900

    ipv4/inet_sock.h: Avoid thousands of -Wflex-array-member-not-at-end warnings
    
    Use DEFINE_RAW_FLEX() to avoid thousands of -Wflex-array-member-not-at-end
    warnings.
    
    Remove struct ip_options_data, and adjust the rest of the code so that
    flexible-array member struct ip_options_rcu::opt.__data[] ends last
    in struct icmp_bxm.
    
    Compensate for this by using the DEFINE_RAW_FLEX() helper to define each
    on-stack struct instance that contained struct ip_options_data as a member,
    and to define struct ip_options_rcu with a fixed on-stack size for its
    nested flexible-array member opt.__data[].
    
    Also, add a couple of code comments to prevent people from adding members
    to a struct after another member that contains a flexible array.
    
    With these changes, fix 2600 warnings of the following type:
    
    include/net/inet_sock.h:65:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
    
    Signed-off-by: Gustavo A. R. Silva 
    Link: https://patch.msgid.link/aVteBadWA6AbTp7X@kspp
    Signed-off-by: Jakub Kicinski 

commit 915a5f60ad947e8dd515d2cc77a96a14dffb3f15
Author: Slark Xiao 
Date:   Mon Jan 5 10:26:46 2026 +0800

    net: wwan: mhi: Add network support for Foxconn T99W760
    
    T99W760 is designed based on Qualcomm SDX35 chip. It use similar
    architecture with SDX72/SDX75 chip. So we need to assign initial
    link id for this device to make sure network available.
    
    Signed-off-by: Slark Xiao 
    Link: https://patch.msgid.link/20260105022646.10630-1-slark_xiao@163.com
    Signed-off-by: Jakub Kicinski 

commit c4df070a57def243dcf5773428dd1b51bc8337ef
Author: Jakub Kicinski 
Date:   Sun Jan 4 10:46:00 2026 -0800

    selftests: hw-net: rss-input-xfrm: try to enable the xfrm at the start
    
    The test currently SKIPs if the symmetric RSS xfrm is not enabled
    by default. This leads to spurious SKIPs in the Intel CI reporting
    results to NIPA.
    
    Testing on CX7:
    
     # ./drivers/net/hw/rss_input_xfrm.py
      TAP version 13
      1..2
      ok 1 rss_input_xfrm.test_rss_input_xfrm_ipv4 # SKIP Test requires IPv4 connectivity
      # Sym input xfrm already enabled: {'sym-or-xor'}
      ok 2 rss_input_xfrm.test_rss_input_xfrm_ipv6
      # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:1 error:0
    
     # ethtool -X eth0 xfrm none
    
     # ./drivers/net/hw/rss_input_xfrm.py
      TAP version 13
      1..2
      ok 1 rss_input_xfrm.test_rss_input_xfrm_ipv4 # SKIP Test requires IPv4 connectivity
      # Sym input xfrm configured: {'sym-or-xor'}
      ok 2 rss_input_xfrm.test_rss_input_xfrm_ipv6
      # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:1 error:0
    
    Link: https://patch.msgid.link/20260104184600.795280-1-kuba@kernel.org
    Signed-off-by: Jakub Kicinski 

commit cb3de96eea66f5e4a580086c6a1be46e765f97f4
Author: Yumei Huang 
Date:   Sun Jan 4 11:23:57 2026 +0800

    ipv6: preserve insertion order for same-scope addresses
    
    IPv6 addresses with the same scope are returned in reverse insertion
    order, unlike IPv4. For example, when adding a -> b -> c, the list is
    reported as c -> b -> a, while IPv4 preserves the original order.
    
    This behavior causes:
    
    a. When using `ip -6 a save` and `ip -6 a restore`, addresses are restored
       in the opposite order from which they were saved. See example below
       showing addresses added as 1::1, 1::2, 1::3 but displayed and saved
       in reverse order.
    
       # ip -6 a a 1::1 dev x
       # ip -6 a a 1::2 dev x
       # ip -6 a a 1::3 dev x
       # ip -6 a s dev x
       2: x:  mtu 1500 qdisc noop state DOWN group default qlen 1000
           inet6 1::3/128 scope global tentative
           valid_lft forever preferred_lft forever
           inet6 1::2/128 scope global tentative
           valid_lft forever preferred_lft forever
           inet6 1::1/128 scope global tentative
           valid_lft forever preferred_lft forever
       # ip -6 a save > dump
       # ip -6 a d 1::1 dev x
       # ip -6 a d 1::2 dev x
       # ip -6 a d 1::3 dev x
       # ip a d ::1 dev lo
       # ip a restore < dump
       # ip -6 a s dev x
       2: x:  mtu 1500 qdisc noop state DOWN group default qlen 1000
           inet6 1::1/128 scope global tentative
           valid_lft forever preferred_lft forever
           inet6 1::2/128 scope global tentative
           valid_lft forever preferred_lft forever
           inet6 1::3/128 scope global tentative
           valid_lft forever preferred_lft forever
       # ip a showdump < dump
        if1:
            inet6 ::1/128 scope host proto kernel_lo
            valid_lft forever preferred_lft forever
        if2:
            inet6 1::3/128 scope global tentative
            valid_lft forever preferred_lft forever
        if2:
            inet6 1::2/128 scope global tentative
            valid_lft forever preferred_lft forever
        if2:
            inet6 1::1/128 scope global tentative
            valid_lft forever preferred_lft forever
    
    b. Addresses in pasta to appear in reversed order compared to host
       addresses.
    
    The ipv6 addresses were added in reverse order by commit e55ffac60117
    ("[IPV6]: order addresses by scope"), then it was changed by commit
    502a2ffd7376 ("ipv6: convert idev_list to list macros"), and restored by
    commit b54c9b98bbfb ("ipv6: Preserve pervious behavior in
    ipv6_link_dev_addr()."). However, this reverse ordering within the same
    scope causes inconsistency with IPv4 and the issues described above.
    
    This patch aligns IPv6 address ordering with IPv4 for consistency
    by changing the comparison from >= to > when inserting addresses
    into the address list. Also updates the ioam6 selftest to reflect
    the new address ordering behavior. Combine these two changes into
    one patch for bisectability.
    
    Link: https://bugs.passt.top/show_bug.cgi?id=175
    Suggested-by: Stefano Brivio 
    Signed-off-by: Yumei Huang 
    Acked-by: Justin Iurman 
    Reviewed-by: David Ahern 
    Link: https://patch.msgid.link/20260104032357.38555-1-yuhuang@redhat.com
    Signed-off-by: Jakub Kicinski 

commit 75326c67aa8c43000819a2ac29f22eb27846d545
Author: Derek Foreman 
Date:   Fri Nov 28 15:50:18 2025 -0600

    perf data: Fix coding style
    
    Adjust some oddly indented fprintf() calls.
    
    Signed-off-by: Derek Foreman 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 4348796233e736147e2e79c58784d0a9fb48867d
Author: Ewan Chorynski 
Date:   Sun Dec 28 17:15:23 2025 +0100

    rust: drm: Improve safety comment when using `Pin::into_inner_unchecked`
    
    The safety requirements for `Pin::into_inner_unchecked` state that the
    returned pointer must be treated as pinned until it is dropped. Such a
    guarantee is provided by the `ARef` type. This patch improves the safety
    comment to better reflect this.
    
    Signed-off-by: Ewan Chorynski 
    Link: https://patch.msgid.link/20251228-drm-gem-safety-comment-v2-1-99bb861c3371@ik.me
    Signed-off-by: Danilo Krummrich 

commit be5c6ec66030b77bc0dbc775e6c0b625f7526545
Author: Yu Liao 
Date:   Thu Dec 25 20:14:38 2025 +0800

    Documentation/kernel-parameters: Add tsa under mitigations=off
    
    On X86 AMD systems, mitigations=off also disables the Transient
    Scheduler Attacks (TSA) mitigation. Add it to the list.
    
    Signed-off-by: Yu Liao 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251225121438.38427-1-liaoyu.ly@bytedance.com>

commit 46b4bb702e87e6bb337a7e0675cc7602431def6b
Author: Akiyoshi Kurita 
Date:   Fri Dec 26 01:16:15 2025 +0900

    docs: spufs: fix ppc64 architecture line break
    
    Fix a broken line break in the word "architecture" in the spufs
    documentation.
    
    Signed-off-by: Akiyoshi Kurita 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251225161615.3107808-1-weibu@redadmin.org>

commit 8e746e95c3e4eb56ae261feb9ae261bce1f96947
Author: Derek Foreman 
Date:   Fri Nov 28 15:50:17 2025 -0600

    perf data: Allow filtering conversion by time range
    
    This adds a feature to allow restricting the range of converted samples
    with a range string like perf-script and perf-report --time.
    
    Committer testing:
    
    Put a probe on the ICMP receive path handling broadcast packets:
    
      # perf probe icmp_rcv:64
      Added new event:
        probe:icmp_rcv_L64   (on icmp_rcv:64)
    
      You can now use it in all perf tools, such as:
    
            perf record -e probe:icmp_rcv_L64 -aR sleep 1
    
      # perf record -e probe:icmp_rcv_L64 ping -c 10 -b 127.255.255.255
      WARNING: pinging broadcast address
      PING 127.255.255.255 (127.255.255.255) 56(84) bytes of data.
      ^C
      --- 127.255.255.255 ping statistics ---
      10 packets transmitted, 0 received, 100% packet loss, time 9217ms
    
      [ perf record: Woken up 1 times to write data ]
      [ perf record: Captured and wrote 0.034 MB perf.data (10 samples) ]
    
      # perf script
                  ping   52785 [009]  5847.300394: probe:icmp_rcv_L64: (ffffffffaadb337e)
                  ping   52785 [009]  5848.325018: probe:icmp_rcv_L64: (ffffffffaadb337e)
                  ping   52785 [009]  5849.349007: probe:icmp_rcv_L64: (ffffffffaadb337e)
                  ping   52785 [009]  5850.372979: probe:icmp_rcv_L64: (ffffffffaadb337e)
                  ping   52785 [009]  5851.396988: probe:icmp_rcv_L64: (ffffffffaadb337e)
                  ping   52785 [009]  5852.420954: probe:icmp_rcv_L64: (ffffffffaadb337e)
                  ping   52785 [009]  5853.444934: probe:icmp_rcv_L64: (ffffffffaadb337e)
                  ping   52785 [009]  5854.468926: probe:icmp_rcv_L64: (ffffffffaadb337e)
                  ping   52785 [009]  5855.492914: probe:icmp_rcv_L64: (ffffffffaadb337e)
                  ping   52785 [009]  5856.516883: probe:icmp_rcv_L64: (ffffffffaadb337e)
      #
    
    Now get some slices using perf script:
    
      # perf script --time 40%
                ping   52785 [009]  5847.300394: probe:icmp_rcv_L64: (ffffffffaadb337e)
                ping   52785 [009]  5848.325018: probe:icmp_rcv_L64: (ffffffffaadb337e)
                ping   52785 [009]  5849.349007: probe:icmp_rcv_L64: (ffffffffaadb337e)
                ping   52785 [009]  5850.372979: probe:icmp_rcv_L64: (ffffffffaadb337e)
      # perf script --time 40%-60%
                ping   52785 [009]  5851.396988: probe:icmp_rcv_L64: (ffffffffaadb337e)
                ping   52785 [009]  5852.420954: probe:icmp_rcv_L64: (ffffffffaadb337e)
      #
    
    And finally use this new feature:
    
      # perf data convert --to-json out.json --time 0%-10%
      [ perf data convert: Converted 'perf.data' into JSON data 'out.json' ]
      [ perf data convert: Converted and wrote 0.001 MB (1 samples) ]
      [ perf data convert: Skipped 9 samples ]
      # cat out.json
      {
            "linux-perf-json-version": 1,
            "headers": {
                    "header-version": 1,
                    "captured-on": "2026-01-06T22:26:40Z",
                    "data-offset": 520,
                    "data-size": 34648,
                    "feat-offset": 35168,
                    "hostname": "number",
                    "os-release": "6.17.12-300.fc43.x86_64",
                    "arch": "x86_64",
                    "cpu-desc": "AMD Ryzen 9 9950X3D 16-Core Processor",
                    "cpuid": "AuthenticAMD,26,68,0",
                    "nrcpus-online": 32,
                    "nrcpus-avail": 32,
                    "perf-version": "6.19.rc4.gf4c270685d3d",
                    "cmdline": [
                            "/home/acme/bin/perf"
                    ]
            },
            "samples": [
                    {
                            "timestamp": 5847300394661,
                            "pid": 52785,
                            "tid": 52785,
                            "cpu": 9,
                            "comm": "ping",
                            "callchain": [
                                    {
                                            "ip": "0xffffffffaadb337f",
                                            "symbol": "icmp_rcv",
                                            "dso": "[kernel.kallsyms]"
                                    }
                            ],
                            "__probe_ip": "ffffffffaadb337e"
                    }
            ]
      }
      #
    
    Signed-off-by: Derek Foreman 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit ae350d71815a72235a2d74478092352c74390ce1
Author: Wu Canhong 
Date:   Sat Dec 27 00:02:19 2025 +0800

    doc: input: fix typos in input.rst
    
    'even codes' should be 'event codes' at the end of input.rst
    
    Signed-off-by: Wu Canhong 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251226160219.64818-1-canhong12@163.com>

commit 80d9411c00e805488b631c91034e9b6c14a6dbdc
Author: Leon Romanovsky 
Date:   Sun Jan 4 14:51:28 2026 +0200

    PCI/P2PDMA: Add missing struct p2pdma_provider documentation
    
    Two fields in struct p2pdma_provider were not documented, which resulted
    in the following kernel-doc warning:
    
      Warning: include/linux/pci-p2pdma.h:26 struct member 'owner' not described in 'p2pdma_provider'
      Warning: include/linux/pci-p2pdma.h:26 struct member 'bus_offset' not described in 'p2pdma_provider'
    
    Repro:
    
      $ scripts/kernel-doc -none include/linux/pci-p2pdma.h
    
    Fixes: f58ef9d1d135 ("PCI/P2PDMA: Separate the mmap() support from the core logic")
    Reported-by: Bjorn Helgaas 
    Closes: https://lore.kernel.org/all/20260102234033.GA246107@bhelgaas
    Signed-off-by: Leon Romanovsky 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Logan Gunthorpe 
    Link: https://patch.msgid.link/20260104-fix-p2p-kdoc-v1-1-6d181233f8bc@nvidia.com

commit edecd1ae594abc8b14ed36c438d1a7db729403ba
Merge: a6b9f5b2f04bd7 ba4c74f80ef39b
Author: Christian Brauner 
Date:   Tue Jan 6 23:17:57 2026 +0100

    Merge patch series "vfs kernel-doc fixes for 6.19"
    
    Bagas Sanjaya  says:
    
    Here are kernel-doc fixes for vfs subsystem targetting 6.19. This small
    series is split from much larger kernel-doc fixes series I posted a while
    ago [1].
    
    * patches from https://patch.msgid.link/20251219024620.22880-1-bagasdotme@gmail.com:
      VFS: fix __start_dirop() kernel-doc warnings
      fs: Describe @isnew parameter in ilookup5_nowait()
    
    Link: https://patch.msgid.link/20251219024620.22880-1-bagasdotme@gmail.com
    Signed-off-by: Christian Brauner 

commit ba4c74f80ef39bb5a387dd3b13422199515efec0
Author: Bagas Sanjaya 
Date:   Fri Dec 19 09:46:20 2025 +0700

    VFS: fix __start_dirop() kernel-doc warnings
    
    Sphinx report kernel-doc warnings:
    
    WARNING: ./fs/namei.c:2853 function parameter 'state' not described in '__start_dirop'
    WARNING: ./fs/namei.c:2853 expecting prototype for start_dirop(). Prototype was for __start_dirop() instead
    
    Fix them up.
    
    Fixes: ff7c4ea11a05c8 ("VFS: add start_creating_killable() and start_removing_killable()")
    Signed-off-by: Bagas Sanjaya 
    Link: https://patch.msgid.link/20251219024620.22880-3-bagasdotme@gmail.com
    Reviewed-by: Jeff Layton 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit b0f5804b41789f99ecf303a48fc0266dc3e24b0e
Author: Bagas Sanjaya 
Date:   Fri Dec 19 09:46:19 2025 +0700

    fs: Describe @isnew parameter in ilookup5_nowait()
    
    Sphinx reports kernel-doc warning:
    
    WARNING: ./fs/inode.c:1607 function parameter 'isnew' not described in 'ilookup5_nowait'
    
    Describe the parameter.
    
    Fixes: a27628f4363435 ("fs: rework I_NEW handling to operate without fences")
    Signed-off-by: Bagas Sanjaya 
    Link: https://patch.msgid.link/20251219024620.22880-2-bagasdotme@gmail.com
    Reviewed-by: Jeff Layton 
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 523471c5163659c61132274123c5470286e407ce
Author: James Clark 
Date:   Tue Dec 23 17:00:28 2025 +0000

    perf build: Skip nondistro build test if libbfd is old
    
    Non distro builds now require a new version of libbfd, so skip the test
    if the library is too old.
    
    The grep test isn't a strong as the feature test in
    test-libbfd-threadsafe.c, but there seems to be precedent for feature
    testing this way here and it's good enough for the build-test rule. If
    the function exists but returns an error it will be picked up by the
    feature test when attempting the build.
    
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Bill Wendling 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Justin Stitt 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Nathan Chancellor 
    Cc: Nick Desaulniers 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 736ea8102637cecca85c05550d7d1c71c8a61ba0
Author: Thorsten Blum 
Date:   Tue Dec 23 00:25:04 2025 +0100

    Documentation: kernel-hacking: Remove :c:func: annotations
    
    Remove the useless :c:func: annotations.
    
    Suggested-by: Jonathan Corbet 
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251222232506.2615-2-thorsten.blum@linux.dev>

commit cff602f65988da48cc1b84f6c3588a25a320fa81
Author: James Clark 
Date:   Tue Dec 23 17:00:27 2025 +0000

    perf build: Feature test for libbfd thread safety API
    
    The non-distro build requires libbfd 2.42 since commit b72b8132d8fd
    ("perf libbfd: Ensure libbfd is initialized prior to use"). Add a
    feature test so that it's obvious why the build fails if this criteria
    isn't met.
    
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Bill Wendling 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Justin Stitt 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Nathan Chancellor 
    Cc: Nick Desaulniers 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit c0cb97a275ffa00d91a0715dce8105ae3f627727
Author: James Clark 
Date:   Tue Dec 23 17:00:26 2025 +0000

    perf build: Remove unused libbfd-buildid feature test
    
    HAVE_LIBBFD_BUILDID_SUPPORT isn't used in the codebase so remove the
    feature test that sets it.
    
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Bill Wendling 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Justin Stitt 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Nathan Chancellor 
    Cc: Nick Desaulniers 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 4f099d09400a190abc12ad3d8fd4e94ebeed57ca
Author: Stephen Smalley 
Date:   Wed Dec 3 14:57:28 2025 -0500

    nfs: unify security_inode_listsecurity() calls
    
    commit 243fea134633 ("NFSv4.2: fix listxattr to return selinux
    security label") introduced a direct call to
    security_inode_listsecurity() in nfs4_listxattr(). However,
    nfs4_listxattr() already indirectly called
    security_inode_listsecurity() via nfs4_listxattr_nfs4_label() if
    CONFIG_NFS_V4_SECURITY_LABEL is enabled and the server has the
    NFS_CAP_SECURITY_LABEL capability enabled. This duplication was fixed
    by commit 9acb237deff7 ("NFSv4.2: another fix for listxattr") by
    making the second call conditional on NFS_CAP_SECURITY_LABEL not being
    set by the server. However, the combination of the two changes
    effectively makes one call to security_inode_listsecurity() in every
    case - which is the desired behavior since getxattr() always returns a
    security xattr even if it has to synthesize one. Further, the two
    different calls produce different xattr name ordering between
    security.* and user.* xattr names. Unify the two separate calls into a
    single call and get rid of nfs4_listxattr_nfs4_label() altogether.
    
    Link: https://lore.kernel.org/selinux/CAEjxPJ6e8z__=MP5NfdUxkOMQ=EnUFSjWFofP4YPwHqK=Ki5nw@mail.gmail.com/
    Signed-off-by: Stephen Smalley 
    Signed-off-by: Paul Moore 

commit ae323bc241d25f5ebc56f0b2a6d580b7233647c0
Author: James Clark 
Date:   Tue Dec 23 17:00:25 2025 +0000

    perf build: Do all non-distro feature checks in one go
    
    None of the if statements or variable assignments in the non-distro
    block actually affect the feature checks. Just do them all in one place
    so the flow isn't obscured.
    
    Signed-off-by: James Clark 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Bill Wendling 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Justin Stitt 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Nathan Chancellor 
    Cc: Nick Desaulniers 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit bb51cf4f6179cb67b8a9daa201a7a8e23d6f5754
Author: Bagas Sanjaya 
Date:   Tue Dec 23 10:52:53 2025 +0700

    Documentation: kernel-hacking: Convert internal links
    
    Convert internal cross-references in "Putting Your Stuff in the kernel"
    section from inline code to internal links.
    
    Signed-off-by: Bagas Sanjaya 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251223035254.22894-4-bagasdotme@gmail.com>

commit 2b79aafb1705cd9d3b4057b4066f4082b674784f
Author: Bagas Sanjaya 
Date:   Tue Dec 23 10:52:52 2025 +0700

    Documentation: kernel-hacking: Do not italicize EXPORT_SYMBOL{,_GPL}() references
    
    Do not italicize EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() references in
    EXPORT_SYMBOL_NS() and EXPORT_SYMBOL_NS_GPL() subsections.
    
    Signed-off-by: Bagas Sanjaya 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251223035254.22894-3-bagasdotme@gmail.com>

commit b47e2b93aa31ca803d8088e5fcd33ca05a003926
Author: Bagas Sanjaya 
Date:   Tue Dec 23 10:52:51 2025 +0700

    Documentation: kernel-hacking: Remove current macro annotation
    
    Remove unneeded :c:macro: annotation of current macro.
    
    Signed-off-by: Bagas Sanjaya 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251223035254.22894-2-bagasdotme@gmail.com>

commit 7fc37b588aaaf72145764b4c3b6184431471b3e0
Author: Roberto Sassu 
Date:   Tue Dec 23 17:00:24 2025 +0000

    perf build: Remove FEATURE_CHECK_LDFLAGS-disassembler-{four-args,init-styled} setting
    
    As the building mechanism is now able to retry detection with different
    combinations of linking flags, setting FEATURE_CHECK_LDFLAGS-disassembler-four-args
    and FEATURE_CHECK_LDFLAGS-disassembler-init-styled is not necessary anymore,
    so remove it.
    
    James Clark notes:
    
    Use the same technique to find the set of bfd-related libraries to link as in:
    
      3308ffc5016e6136 ("tools, build: Retry detection of bfd-related features")
    
    Signed-off-by: Roberto Sassu 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Alexei Starovoitov 
    Cc: Andres Freund 
    Cc: Andrii Nakryiko 
    Cc: Bill Wendling 
    Cc: Daniel Borkmann 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: John Fastabend 
    Cc: Justin Stitt 
    Cc: KP Singh 
    Cc: Leo Yan 
    Cc: Mark Rutland 
    Cc: Martin KaFai Lau 
    Cc: Namhyung Kim 
    Cc: Nathan Chancellor 
    Cc: Nick Desaulniers 
    Cc: Nick Terrell 
    Cc: Peter Zijlstra 
    Cc: Quentin Monnet 
    Cc: Song Liu 
    Cc: Stanislav Fomichev 
    Signed-off-by: James Clark 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 4ac85d9bc73ed38a3bf98a58f9a44087375332b4
Author: Thomas Weißschuh 
Date:   Tue Dec 23 08:04:11 2025 +0100

    kbuild: uapi: split out command conditions into variables
    
    The condition logic will become a bit more complicated.
    
    Split them out into dedicated variables so they stay readable.
    
    Signed-off-by: Thomas Weißschuh 
    Link: https://patch.msgid.link/20251223-uapi-nostdinc-v1-4-d91545d794f7@linutronix.de
    Signed-off-by: Nathan Chancellor 

commit e2772ba5f43df6b13b04041fe52b07e8cac06ce0
Author: Thomas Weißschuh 
Date:   Tue Dec 23 08:04:10 2025 +0100

    kbuild: uapi: don't compile test bpf_perf_event.h on xtensa
    
    The xtensa UAPI headers do not provide 'struct pt_regs',
    triggering an error:
    
    usr/include/linux/bpf_perf_event.h:14:28: error: field 'regs' has incomplete type
    
    Disable the header tests for this file on xtensa.
    
    Signed-off-by: Thomas Weißschuh 
    Link: https://patch.msgid.link/20251223-uapi-nostdinc-v1-3-d91545d794f7@linutronix.de
    Signed-off-by: Nathan Chancellor 

commit cc45d2ea5cfb820fd95cba1fcc3aed18e80a92d3
Author: Thomas Weißschuh 
Date:   Tue Dec 23 08:04:09 2025 +0100

    hexagon: Drop invalid UAPI header asm/signal.h
    
    This UAPI header contains declarations of internal kernel symbols.
    Such declarations are invalid. Normally headers_check.pl would report
    an error, but apparently its dependency on CC_CAN_LINK prevent its
    execution on hexagon so far.
    
    As the header does not expose any additional UAPI, just make it a
    regular internal kernel header. asm-generic/signal.h will be used
    for the UAPI automatically, the same as before.
    
    Signed-off-by: Thomas Weißschuh 
    Link: https://patch.msgid.link/20251223-uapi-nostdinc-v1-2-d91545d794f7@linutronix.de
    Signed-off-by: Nathan Chancellor 

commit 6059b880a93c38a90d178b49fa80403c76d1a89f
Author: Thomas Weißschuh 
Date:   Tue Dec 23 08:04:08 2025 +0100

    kbuild: uapi: validate that headers do not use libc
    
    The UAPI headers should be self-contained. That means they should not
    use other headers from libc. Currently this is not enforced and various
    dependencies have crept in.
    
    Add a check to make sure no new ones are added.
    
    Signed-off-by: Thomas Weißschuh 
    Link: https://patch.msgid.link/20251223-uapi-nostdinc-v1-1-d91545d794f7@linutronix.de
    Signed-off-by: Nathan Chancellor 

commit 3a8501b3a4292d72bc57cc4f4455757985a19151
Author: Max Nikulin 
Date:   Tue Dec 23 18:12:23 2025 +0700

    docs: admin: devices: remove /dev/cdwriter
    
    Remove /dev/cdwriter from the local symlinks table and from the related
    note.
    
    Creation of the symlink was removed from udev in commit [1] that
    became a part of release 115 in 2007 [2].
    
    The altered text was added in 1995 [3].
    
    [1] https://git.kernel.org/pub/scm/linux/hotplug/udev.git/commit/?id=b1a2b83f2d
        2007-08-11 14:06:03 +0200 Kay Sievers.
        rules: update Fedora rules
    
    [2] https://git.kernel.org/pub/scm/linux/hotplug/udev.git/commit/?h=7e599863919
        2007-08-24 01:29:54 +0200 Kay Sievers.
        release 115
    
    [3] https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/diff/Documentation/devices.txt?h=v2.5.45&id=6e995ea941a
        1995-11-21 Linus Torvalds.
        Import 1.3.43
    
    Signed-off-by: Max Nikulin 
    Signed-off-by: Jonathan Corbet 
    Message-ID: 

commit 1ec205e3669c12dfb0adbd2d7099922c195b46ff
Author: Ian Rogers 
Date:   Fri Dec 5 11:01:35 2025 -0800

    perf test java symbol: Additional libperf-jvmti.so path check
    
    If perf is built into an output directory then so is
    libperf-jvmti.so.
    
    If `perf test` is run from that directory then PWD needn't also be that
    directory meaning libperf-jvmti.so won't be found and the test skipped.
    
    Add an additional check for libperf-jvmti.so in the same directory as
    the perf binary for this case, this avoids the test skipping.
    
    Signed-off-by: Ian Rogers 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Ingo Molnar 
    Cc: Jiri Olsa 
    Cc: Leo Yan 
    Cc: Namhyung Kim 
    Cc: Peter Zijlstra 
    Cc: Thomas Richter 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit ae4f42ea4cab1457dd4b7aaa27ab259902d213b6
Author: Akiyoshi Kurita 
Date:   Tue Dec 23 20:29:46 2025 +0900

    docs: keystone: fix typo in knav-qmss documentation
    
    Signed-off-by: Akiyoshi Kurita 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251223112946.2580519-1-weibu@redadmin.org>

commit 76df6815dab76d7890936dc5f6d91cf7e7f88358
Author: Nicolas Pitre 
Date:   Mon Dec 15 15:06:54 2025 -0800

    kconfig: Support conditional deps using "depends on X if Y"
    
    Extend the "depends on" syntax to support conditional dependencies
    using "depends on X if Y". While functionally equivalent to "depends
    on X || (Y == n)", "depends on X if Y" is much more readable and
    makes the kconfig language uniform in supporting the "if "
    suffix.
    This also improves readability for "optional" dependencies, which
    are the subset of conditional dependencies where X is Y.
    Previously such optional dependencies had to be expressed as
    the counterintuitive "depends on X || !X", now this can be
    represented as "depends on X if X".
    
    The change is implemented by converting the "X if Y" syntax into the
    "X || (Y == n)" syntax during "depends on" token processing.
    
    Signed-off-by: Nicolas Pitre 
    [Graham Roff: Rewrote commit message, updated patch, added tests]
    Signed-off-by: Graham Roff 
    Acked-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251215-kconfig_conditional_deps-v3-1-59519af0a5df@qti.qualcomm.com
    [nathan: Minor adjustments to spacing]
    Signed-off-by: Nathan Chancellor 

commit 78d979db6cef557c171d6059cbce06c3db89c7ee
Author: Sasha Levin 
Date:   Tue Dec 23 07:21:10 2025 -0500

    docs: add AI Coding Assistants documentation
    
    Add guidance for AI assistants and developers using AI tools for kernel
    contributions, per the consensus reached at the 2025 Maintainers Summit.
    
    Create Documentation/process/coding-assistants.rst with detailed guidance
    on licensing, Signed-off-by requirements, and attribution format. The
    README points AI tools to this documentation.
    
    This will allow coding assistants to easily parse these instructions and
    comply with guidelines set by the community.
    
    Link: https://lwn.net/Articles/1049830/
    Signed-off-by: Sasha Levin 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251223122110.2496946-1-sashal@kernel.org>

commit 57a63f6549aa57dc007151b398f5b64dd95a41c6
Author: SeongJae Park 
Date:   Wed Dec 24 17:40:22 2025 -0800

    Docs/translations/ko_KR: remove memory-barriers
    
    The memory-barriers.txt Korean translation is quite outdated.  The last
    update on the translation was made on 2022-10-10, by commit ee5a86f451f7
    ("docs/memory-barriers.txt/kokr: Fix confusing name of 'data dependency
    barrier'").  After the date, the original memory-barriers.txt got seven
    more changes so far.  The most recent one was made on 2025-11-05.  But
    none of those are applied to the translation.
    
    Maybe I can work again on keeping it updated.  But, given the
    advancement of translation tools, I think it might not be worth keeping
    it at all.  Remove the outdated translation.
    
    If it turns out to be worthy to keep the translation and someone willing
    to keep it updated steps up, this could be reverted.
    
    This change was inspired from the last kernel summit discussion [1].
    
    [1] https://lpc.events/event/19/contributions/2259/
    
    Cc: Paul E. McKenney 
    Signed-off-by: SeongJae Park 
    Acked-by: Paul E. McKenney 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251225014027.15948-1-sj@kernel.org>

commit 8a12e3fbf2c30cc66bb0be1363c08aca1d33e80a
Author: SeongJae Park 
Date:   Wed Dec 24 17:54:45 2025 -0800

    docs: submitting-patches: suggest adding previous version links
    
    For review of patches that revisioned multiple times, patch changelogs
    are very useful.  Adding actual links to the previous versions can
    further help the review.  Using such links, reviewers can double check
    the changelog by themselves, and find previous discussions.  Nowadays
    having such links (e.g., lore.kernel.org archive links) is easy and
    reliable.  Suggest adding such links if available.
    
    Signed-off-by: SeongJae Park 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251225015447.16387-1-sj@kernel.org>

commit a6b9f5b2f04bd7809cd72c5d33af944758c00ab1
Author: Breno Leitao 
Date:   Mon Jan 5 07:10:27 2026 -0800

    fs/namei: Remove redundant DCACHE_MANAGED_DENTRY check in __follow_mount_rcu
    
    The check for DCACHE_MANAGED_DENTRY at the start of __follow_mount_rcu()
    is redundant because the only caller (handle_mounts) already verifies
    d_managed(dentry) before calling this function, so, dentry in
    __follow_mount_rcu() has always DCACHE_MANAGED_DENTRY set.
    
    This early-out optimization never fires in practice - but it is marking
    as likely().
    
    This was detected with branch profiling, which shows 100% misprediction
    in this likely.
    
    Remove the whole if clause instead of removing the likely, given we
    know for sure that dentry is not DCACHE_MANAGED_DENTRY.
    
    Signed-off-by: Breno Leitao 
    Link: https://patch.msgid.link/20260105-dcache-v1-1-f0d904b4a7c2@debian.org
    Acked-by: Al Viro 
    Signed-off-by: Christian Brauner 

commit 729d015ab230d1d6debd69744c6e0fb70c16a779
Author: Mateusz Guzik 
Date:   Mon Dec 29 13:57:51 2025 +0100

    fs: only assert on LOOKUP_RCU when built with CONFIG_DEBUG_VFS
    
    Calls to the 2 modified routines are explicitly gated with checks for
    the flag, so there is no use for this in production kernels.
    
    Signed-off-by: Mateusz Guzik 
    Link: https://patch.msgid.link/20251229125751.826050-1-mjguzik@gmail.com
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 90f1d896d59f77080e87915dfbd6d9703a37a820
Author: Vincent Mailhol 
Date:   Thu Dec 25 13:47:37 2025 +0100

    doc-guide: kernel-doc: specify that W=n does not check header files
    
    The documentation states that:
    
      make W=n
    
    can be used to verify the documentation format. This is true for .c
    files but not for headers [1].
    
    Modify the documentation to specify that headers files are not covered
    by make W=n and that these need to be checked separately with
    scripts/kernel-doc.
    
    [1] commit 3a025e1d1c2e ("Add optional check for bad kernel-doc comments")
    Link: https://git.kernel.org/torvalds/c/3a025e1d1c2e
    
    Signed-off-by: Vincent Mailhol 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251225-doc-format-check-v1-1-dff637a4d275@kernel.org>

commit bcb90a2834c7393c26df9609b889a3097b7700cd
Author: Jeffrey Bencteux 
Date:   Sat Dec 27 09:39:24 2025 +0100

    audit: add missing syscalls to read class
    
    The "at" variant of getxattr() and listxattr() are missing from the
    audit read class. Calling getxattrat() or listxattrat() on a file to
    read its extended attributes will bypass audit rules such as:
    
    -w /tmp/test -p rwa -k test_rwa
    
    The current patch adds missing syscalls to the audit read class.
    
    Signed-off-by: Jeffrey Bencteux 
    Signed-off-by: Paul Moore 

commit b04d2b9199129f4f0c992a518c0fb78c2efc1064
Author: Thomas Richter 
Date:   Wed Dec 10 08:17:52 2025 +0100

    perf test: Fix test case perf evlist tests for s390x
    
    Perf test case 78: perf evlist tests fails on s390.
    
    The failure is causes by grouping events cycles and instructions because
    sampling does only support event cycles.  Change the group to software
    events to fix this.
    
    Output before:
      # ./perf test 78
      78: perf evlist tests              : FAILED!
      #
    
    Output after:
      # ./perf test 78
      78: perf evlist tests              : Ok
      #
    
    Fixes: db452961de939225 ("perf tests evlist: Add basic evlist test")
    Signed-off-by: Thomas Richter 
    Tested-by: Ian Rogers 
    Cc: Alexander Gordeev 
    Cc: Heiko Carstens 
    Cc: Jan Polensky 
    Cc: Namhyung Kim 
    Cc: Sumanth Korikkar 
    Cc: Vasily Gorbik 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 5ce70894f6cade9dc4d7c2a376724c0d8083ff8a
Author: Volodymyr Kot 
Date:   Thu Dec 25 13:39:11 2025 +0000

    Doc: correct spelling and wording mistakes
    
    Fixed capitalization and punctuation in process documentation.
    
    Signed-off-by: Volodymyr Kot 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251225133911.87512-1-volodymyr.kot.ua@gmail.com>

commit 4971ca2007e3858171982c286421ac1af1d624a9
Author: Vincent Mailhol 
Date:   Fri Dec 26 00:46:48 2025 +0100

    docs: process: email-client: add Thunderbird "Toggle Line Wrap" extension
    
    While reading the git-format-patch manpages [1], I discovered the existence
    of the "Toggle Line Wrap" extension for Thunderbird which I found rather
    convenient.
    
    Looking at the history, the ancestor of this extension was added to the
    documentation in commit e0e34e977a7c ("Documentation/email-clients.txt:
    update Thunderbird docs with wordwrap plugin") but then removed in commit
    f9a0974d3f70 ("Documentation: update thunderbird email client settings").
    
    Extend the paragraph on Thunderbird's mailnews.wraplength register to
    mention the existence of the "Toggle Line Wrap" extension. The goal is not
    to create a war on what is the best option so make it clear that this is
    just an alternative.
    
    [1] man git-format-patch -- §Thunderbird
    Link: https://git-scm.com/docs/git-format-patch#_thunderbird
    
    Signed-off-by: Vincent Mailhol 
    Reviewed-by: Gal Pressman 
    Acked-by: Sotir Danailov   # As past commit author
    Acked-by: Randy Dunlap 
    Tested-by: Randy Dunlap 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251226-docs_thunderbird-toggle-line-wrap-v2-1-aebb8c60025d@kernel.org>

commit 8ee50b15d240d36453ec7274b071310cca349868
Author: Mustafa Elrasheid 
Date:   Sat Dec 27 15:52:44 2025 +0300

    docs: Makefile: wrap SPHINXDIRS help text
    
    When using `make help`, SPHINXDIR doesn't wrap around 80 characters,
    causing text to overflow or wrap in incorrect ways,
    which then makes the text difficult to read
    
    Signed-off-by: Mustafa Elrasheid 
    Acked-by: Randy Dunlap 
    Tested-by: Randy Dunlap 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251227125244.6407-1-mustafaelrasheid@gmail.com>

commit e970637707f4f8e5bd098b09090b755f2f57898b
Author: Randy Dunlap 
Date:   Fri Jan 2 12:06:57 2026 -0800

    docs: find-unused-docs.sh: fixup directory usage
    
    The recent move of this script from scripts/ to tools/docs/
    did not account for the 'cd' directory usage.
    Update "cd .." to "cd ../.." to make the script self-correcting.
    
    This also eliminates a shell warning:
    ./tools/docs/find-unused-docs.sh: line 33: cd: Documentation/: No such file or directory
    
    Fixes: 184414c6a6ca ("docs: move find-unused-docs.sh to tools/docs")
    Signed-off-by: Randy Dunlap 
    Fixes: 184414c6a6ca (docs: move find-unused-docs.sh to tools/docs)
    Signed-off-by: Matthew Wilcox (Oracle) 
    Reviewed-by: Matthew Wilcox (Oracle) 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260102200657.1040234-1-rdunlap@infradead.org>

commit 7f3f258dafa9901f4b583b83e9ba95e6fdae1587
Author: Masaharu Noguchi 
Date:   Sat Jan 3 14:42:39 2026 +0900

    docs/ja_JP: fix typos in submit-checklist.rst
    
    Fix spelling errors in the Japanese translation:
    
    - "Menu attibutes: default value" -> "Menu attributes: default value"
    - "Documentaion/ABI/" -> "Documentation/ABI/"
    
    No change in meaning intended.
    
    Signed-off-by: Masaharu Noguchi 
    Acked-by: Akira Yokosawa 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260103-b4-practice-docs-typo-v1-1-d68ad6a22ab5@gmail.com>

commit c7bba35efa79008643b39611b29ad8ced44a9dac
Author: Masaharu Noguchi 
Date:   Sun Jan 4 20:58:41 2026 +0900

    docs/ja_JP: fix translation of freestanding C environment
    
    The current Japanese translation incorrectly implies that the kernel is
    independent of the C language.
    
    Translate "freestanding C environment" accurately.
    
    Signed-off-by: Masaharu Noguchi 
    Reviewed-by: Akira Yokosawa 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260104-ja-howto-v2-2-8cac525b3dfe@gmail.com>

commit b09ee709a93cc561957288387e3a75f1e0893edf
Author: Masaharu Noguchi 
Date:   Sun Jan 4 20:58:40 2026 +0900

    docs/ja_JP: fix typos and duplicated phrases in kernel development guide
    
    Fix obvious typos and duplicated phrases in the Japanese translation.
    
    No change in meaning intended.
    
    Acked-by: Akira Yokosawa 
    Signed-off-by: Masaharu Noguchi 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20260104-ja-howto-v2-1-8cac525b3dfe@gmail.com>

commit 79448fa1f495c3e3b7119e53bedc3cce273aa95f
Author: Robin Murphy 
Date:   Mon Dec 15 13:05:00 2025 +0000

    perf/arm_dsu: Allow standard cycles events
    
    Since we do not use the divide-by-64 option, there should be no
    significant difference between the dedicated cycle counter and the
    standard cycles event. Since using the latter on DSU-120 now has
    the side-effect of allowing multiple cycles events to be scheduled
    simultaneously (beneficial for multiple cycle-based metrics), there
    seems little reason not to allow the same on older DSUs as well.
    
    Signed-off-by: Robin Murphy 
    Signed-off-by: Will Deacon 

commit 85c0dbd8b6e2ca5e672560c7cd86801bffa0d884
Author: Robin Murphy 
Date:   Mon Dec 15 13:04:59 2025 +0000

    perf/arm_dsu: Support DSU-120
    
    DSU-120 has the same system register interface as previous DSUs, but
    no longer offers a dedicated cycle counter. While this is not directly
    discoverable via PMCR, the PMCCNTR register is still defined to exist
    with RAZ/WI behaviour, allowing for a straightforward heuristic.
    
    Signed-off-by: Robin Murphy 
    Signed-off-by: Will Deacon 

commit 0113affc91014a14251890c3af8f2bade1c20222
Author: Robin Murphy 
Date:   Mon Dec 15 13:04:58 2025 +0000

    perf/arm_dsu: Support DSU-110
    
    DSU-110 sneakily made all the event counters 64-bit, perhaps related
    to no longer having AArch32 EL1 to worry about. While the DSU version
    itself is not easily discoverable, the size of a counter certainly is.
    
    Signed-off-by: Robin Murphy 
    Signed-off-by: Will Deacon 

commit 31bc0aade4e03a056a6b568571e59d3783c97ffc
Author: Marko Turk 
Date:   Mon Jan 5 22:37:42 2026 +0100

    rust: io: remove square brackets from pci::Bar reference
    
    Remove square brackets since this section is not a part of doc-comment
    so the reference will not be converted to a link in the generated docs.
    
    Suggested-by: Danilo Krummrich 
    Signed-off-by: Marko Turk 
    Link: https://patch.msgid.link/20260105213726.73000-1-mt@markoturk.info
    Signed-off-by: Danilo Krummrich 

commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6
Author: Tetsuo Handa 
Date:   Tue Jan 6 18:39:33 2026 +0900

    hfsplus: pretend special inodes as regular files
    
    Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
    requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
    S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
    
    Reported-by: syzbot 
    Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
    Signed-off-by: Tetsuo Handa 
    Reviewed-by: Viacheslav Dubeyko 
    Signed-off-by: Viacheslav Dubeyko 
    Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
    Signed-off-by: Viacheslav Dubeyko 

commit d8a73cc46c8462a969a7516131feb3096f4c49d3
Author: Shardul Bankar 
Date:   Tue Dec 30 02:19:38 2025 +0530

    hfsplus: return error when node already exists in hfs_bnode_create
    
    When hfs_bnode_create() finds that a node is already hashed (which should
    not happen in normal operation), it currently returns the existing node
    without incrementing its reference count. This causes a reference count
    inconsistency that leads to a kernel panic when the node is later freed
    in hfs_bnode_put():
    
        kernel BUG at fs/hfsplus/bnode.c:676!
        BUG_ON(!atomic_read(&node->refcnt))
    
    This scenario can occur when hfs_bmap_alloc() attempts to allocate a node
    that is already in use (e.g., when node 0's bitmap bit is incorrectly
    unset), or due to filesystem corruption.
    
    Returning an existing node from a create path is not normal operation.
    
    Fix this by returning ERR_PTR(-EEXIST) instead of the node when it's
    already hashed. This properly signals the error condition to callers,
    which already check for IS_ERR() return values.
    
    Reported-by: syzbot+1c8ff72d0cd8a50dfeaa@syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?extid=1c8ff72d0cd8a50dfeaa
    Link: https://lore.kernel.org/all/784415834694f39902088fa8946850fc1779a318.camel@ibm.com/
    Fixes: 634725a92938 ("[PATCH] hfs: cleanup HFS+ prints")
    Signed-off-by: Shardul Bankar 
    Reviewed-by: Viacheslav Dubeyko 
    Signed-off-by: Viacheslav Dubeyko 
    Link: https://lore.kernel.org/r/20251229204938.1907089-1-shardul.b@mpiricsoftware.com
    Signed-off-by: Viacheslav Dubeyko 

commit b226804532a875c10276168dc55ce752944096bd
Author: Jori Koolstra 
Date:   Sat Dec 20 20:10:06 2025 +0100

    hfs: Replace BUG_ON with error handling for CNID count checks
    
    In a06ec283e125 next_id, folder_count, and file_count in the super block
    info were expanded to 64 bits, and BUG_ONs were added to detect
    overflow. This triggered an error reported by syzbot: if the MDB is
    corrupted, the BUG_ON is triggered. This patch replaces this mechanism
    with proper error handling and resolves the syzbot reported bug.
    
    Singed-off-by: Jori Koolstra 
    Reported-by: syzbot+17cc9bb6d8d69b4139f0@syzkaller.appspotmail.com
    Closes: https://syzbot.org/bug?extid=17cc9bb6d8d69b4139f0
    Signed-off-by: Jori Koolstra 
    Reviewed-by: Viacheslav Dubeyko 
    Signed-off-by: Viacheslav Dubeyko 
    Link: https://lore.kernel.org/r/20251220191006.2465256-1-jkoolstra@xs4all.nl
    Signed-off-by: Viacheslav Dubeyko 

commit 413466f3f0f84e7356da16c611afd69d2a0872e4
Author: Viacheslav Dubeyko 
Date:   Tue Dec 23 16:28:11 2025 -0800

    hfsplus: fix generic/020 xfstests failure
    
    The xfstests' test-case generic/020 fails to execute
    correctly:
    
    FSTYP -- hfsplus
    PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc4+ #8 SMP PREEMPT_DYNAMIC Thu May 1 16:43:22 PDT 2025
    MKFS_OPTIONS -- /dev/loop51
    MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
    
    generic/020 _check_generic_filesystem: filesystem on /dev/loop50 is inconsistent
    (see xfstests-dev/results//generic/020.full for details)
    
        *** add lots of attributes
        *** check
            *** MAX_ATTRS attribute(s)
            +/mnt/test/attribute_12286: Numerical result out of range
            *** -1 attribute(s)
            *** remove lots of attributes
            ...
            (Run 'diff -u /xfstests-dev/tests/generic/020.out /xfstests-dev/results//generic/020.out.bad' to see the entire diff)
    
    The generic/020 creates more than 100 xattrs and gives its
    the names user.attribute_ (for example, user.attribute_101).
    As the next step, listxattr() is called with the goal to check
    the correctness of xattrs creation. However, it was issue
    in hfsplus_listxattr() logic. This method re-uses
    the fd.key->attr.key_name.unicode and strbuf buffers in the loop
    without re-initialization. As a result, part of the previous
    name could still remain in the buffers. For example,
    user.attribute_101 could be processed before user.attribute_54.
    The issue resulted in formation the name user.attribute_541
    instead of user.attribute_54. This patch adds initialization of
    fd.key->attr.key_name.unicode and strbuf buffers before
    calling hfs_brec_goto() method that prepare next name in
    the buffer.
    
    HFS+ logic supports only inline xattrs. Such extended attributes
    can store values not bigger than 3802 bytes [1]. This limitation
    requires correction of generic/020 logic. Finally, generic/020
    can be executed without any issue:
    
    sudo ./check generic/020
    FSTYP         -- hfsplus
    PLATFORM      -- Linux/x86_64 hfsplus-testing-0001 6.19.0-rc1+ #44 SMP PREEMPT_DYNAMIC Mon Dec 22 15:39:00 PST 2025
    MKFS_OPTIONS  -- /dev/loop51
    MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
    
    generic/020 31s ...  38s
    Ran: generic/020
    Passed all 1 tests
    
    [1] https://elixir.bootlin.com/linux/v6.19-rc2/source/include/linux/hfs_common.h#L626
    
    Signed-off-by: Viacheslav Dubeyko 
    cc: John Paul Adrian Glaubitz 
    cc: Yangtao Li 
    cc: linux-fsdevel@vger.kernel.org
    Link: https://lore.kernel.org/r/20251224002810.1137139-1-slava@dubeyko.com
    Signed-off-by: Viacheslav Dubeyko 

commit 06190e1c86e4a0a30adf47ca20614c29b692dafc
Author: Gustavo A. R. Silva 
Date:   Thu Aug 14 15:01:07 2025 +0900

    drm/nouveau: fifo: Avoid -Wflex-array-member-not-at-end warning
    
    -Wflex-array-member-not-at-end was introduced in GCC-14, and we are
    getting ready to enable it, globally.
    
    Use the new TRAILING_OVERLAP() helper to fix the following warning:
    
    drivers/gpu/drm/nouveau/nvif/fifo.c:29:42: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
    
    This helper creates a union between a flexible-array member (FAM)
    and a set of members that would otherwise follow it. This overlays
    the trailing members onto the FAM while preserving the original
    memory layout.
    
    Signed-off-by: Gustavo A. R. Silva 
    Reviewed-by: Justin Stitt 
    Acked-by: Danilo Krummrich 
    Link: https://patch.msgid.link/aJ17oxJYcqqr3946@kspp
    Signed-off-by: Kees Cook 

commit 051114652b6b78c18720dbc6fef36ddb5e1da55b
Author: Niranjana Vishwanathapura 
Date:   Tue Jan 6 11:10:51 2026 -0800

    drm/xe/doc: Remove KEEP_ACTIVE feature
    
    The KEEP_ACTIVE feature is being reverted, update documentation.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20260106191051.2866538-6-niranjana.vishwanathapura@intel.com

commit caaed1dda7df9b4e21d439bb5e7750d4af4f1e78
Author: Niranjana Vishwanathapura 
Date:   Tue Jan 6 11:10:50 2026 -0800

    Revert "drm/xe/multi_queue: Support active group after primary is destroyed"
    
    This reverts commit 3131a43ecb346ae3b5287ee195779fc38c6fcd11.
    
    There is no must have requirement for this feature from Compute UMD.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20260106191051.2866538-5-niranjana.vishwanathapura@intel.com

commit 9ebc914acd32bea956a73b7dac82d43539204cf6
Merge: c7ac7499ac5bb5 4c5e6d5b31bc62
Author: Mark Brown 
Date:   Tue Jan 6 18:48:39 2026 +0000

    ASoC: ES8389: Add some members and update
    
    Merge series from Zhang Yi :
    
    To improve the codec's performance, add members related to power and version,
    and modify the configuration.

commit c7ac7499ac5bb50ab3e00add121822c5c904bc91
Merge: d7e36da652aca5 420739112e95c9
Author: Mark Brown 
Date:   Tue Jan 6 18:48:35 2026 +0000

    ASoC: rt5575: Add the codec driver for the ALC5575
    
    Merge series from Oder Chiou :
    
    This patch series adds support for the Realtek ALC5575 audio codec.

commit d7e36da652aca579b63b5617de755c2d855393fe
Merge: 49d3bd9fe2d93e 211243b69533e9
Author: Mark Brown 
Date:   Tue Jan 6 18:48:31 2026 +0000

    firmware: cirrus: cs_dsp: Add long-offset WMDR
    
    Merge series from Richard Fitzgerald :
    
    Version 3 of the WMDR file format introduces a new block type that has a
    32-bit address offset.
    
    The first patch of this series adds the support to the cs_dsp driver.
    
    The rest of the series is adding KUnit tests for this.

commit 49d3bd9fe2d93ec6eaf7d550e2eb9608b401c915
Merge: 04b61513dfe40f 9bf0bd7bdea6c4
Author: Mark Brown 
Date:   Tue Jan 6 18:48:26 2026 +0000

    ASoC: nau8821: Fixes and driver cleanup
    
    Merge series from Cristian Ciocaltea :
    
    This series provides several fixes and cleanup patches for the Nuvoton
    NAU88L21 audio codec driver.
    
    Testing and validation has been performed on Valve Steam Deck.

commit d8872b9dd9208c493f1f3811d42997fb968de064
Author: Alexey Charkov 
Date:   Mon Dec 29 14:12:04 2025 +0400

    arm64: dts: rockchip: Enable analog sound on RK3576 EVB1
    
    Rockchip RK3576 EVB1 board uses the typical configuration with an ES8388
    analog codec driven from built-in SAI I2S.
    
    Add device tree nodes for it.
    
    Signed-off-by: Alexey Charkov 
    Link: https://patch.msgid.link/20251229-rk3576-sound-v1-7-2f59ef0d19b1@gmail.com
    Signed-off-by: Heiko Stuebner 

commit f5c9549964adbac931e163693bd17db872976679
Author: Alexey Charkov 
Date:   Mon Dec 29 14:12:03 2025 +0400

    arm64: dts: rockchip: Enable HDMI sound on RK3576 EVB1
    
    All RK3576 boards get their HDMI sound from SAI6, which is internally
    connected to the HDMI codec. Enable this for Rockchip RK3576 EVB1
    
    Signed-off-by: Alexey Charkov 
    Link: https://patch.msgid.link/20251229-rk3576-sound-v1-6-2f59ef0d19b1@gmail.com
    Signed-off-by: Heiko Stuebner 

commit 87af7643234a2b4cb49a97dfe7fb455633b3185d
Author: Alexey Charkov 
Date:   Mon Dec 29 14:12:02 2025 +0400

    arm64: dts: rockchip: Enable HDMI sound on Luckfox Core3576
    
    All RK3576 boards get their HDMI sound from SAI6, which is internally
    connected to the HDMI codec. Enable this for Luckfox Core3576
    
    Signed-off-by: Alexey Charkov 
    Link: https://patch.msgid.link/20251229-rk3576-sound-v1-5-2f59ef0d19b1@gmail.com
    Signed-off-by: Heiko Stuebner 

commit bde555926b61740c6256a38a9cf5a4833be345cc
Author: Alexey Charkov 
Date:   Mon Dec 29 14:12:01 2025 +0400

    arm64: dts: rockchip: Enable HDMI sound on FriendlyElec NanoPi M5
    
    All RK3576 boards get their HDMI sound from SAI6, which is internally
    connected to the HDMI codec. Enable this for FriendlyElec NanoPi M5.
    
    Signed-off-by: Alexey Charkov 
    Link: https://patch.msgid.link/20251229-rk3576-sound-v1-4-2f59ef0d19b1@gmail.com
    Signed-off-by: Heiko Stuebner 

commit 309598fca339abd4e8eef0efe0d630714ca79ac9
Author: Alexey Charkov 
Date:   Mon Dec 29 14:12:00 2025 +0400

    arm64: dts: rockchip: Use a readable audio card name on NanoPi M5
    
    'simple-audio-card,name' ends up in user visible places such as ALSA mixer
    names, so use a more human-readable name instead of realtek,rt5616-codec
    
    Signed-off-by: Alexey Charkov 
    Link: https://patch.msgid.link/20251229-rk3576-sound-v1-3-2f59ef0d19b1@gmail.com
    Signed-off-by: Heiko Stuebner 

commit 843b912c7241ed0259f6234243da05e10ce67c0f
Author: Heiko Stuebner 
Date:   Tue Aug 12 10:52:13 2025 +0200

    arm64: dts: rockchip: enable NPU on rk3588-jaguar
    
    Enable the NPU cores and their mmus and wire up the supply-regulator.
    The regulator itself was already defined, but it does not need to be
    always on - the npu can control it.
    
    Signed-off-by: Heiko Stuebner 
    Reviewed-by: Quentin Schulz 
    Tested-by: Quentin Schulz 
    Link: https://patch.msgid.link/20250812085213.1071106-2-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit 8fd18d9b7b74bbd5ee5c562c2b94fdb7a356867e
Author: Heiko Stuebner 
Date:   Tue Aug 12 10:52:12 2025 +0200

    arm64: dts: rockchip: enable NPU on rk3588-tiger
    
    Enable the NPU cores and their mmus and wire up the supply-regulator.
    The regulator itself was already defined, but it does not need to be
    always on - the npu can control it.
    
    Signed-off-by: Heiko Stuebner 
    Reviewed-by: Quentin Schulz 
    Tested-by: Quentin Schulz 
    Link: https://patch.msgid.link/20250812085213.1071106-1-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit fc808f80cf298caaa403755ca808cf650844f2f5
Author: FUKAUMI Naoki 
Date:   Mon Dec 29 04:58:38 2025 +0000

    dt-bindings: arm: rockchip: fix description for Radxa CM5
    
    "Radxa CM5" is the correct name[1], so fix the description. While at
    it, move the CM5 entry after the CM3I.
    
    [1] https://dl.radxa.com/cm5/radxa_cm5_product_brief.pdf
    
    Signed-off-by: FUKAUMI Naoki 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251229045838.2917-2-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit a1823b88d35f1bf04ec4e4f86b9206f699b362d0
Author: FUKAUMI Naoki 
Date:   Mon Dec 29 04:58:37 2025 +0000

    dt-bindings: arm: rockchip: fix description for Radxa CM3I
    
    "Radxa CM3I" is the correct name[1], so fix the description.
    
    [1] https://dl.radxa.com/cm3i/docs/hw/radxa_cm3i_product_brief.pdf
    
    Signed-off-by: FUKAUMI Naoki 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251229045838.2917-1-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit 77712fe6847b2471a558ec88868311a4784afdce
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 13:32:44 2026 -0600

    arm64: dts: rockchip: Add missing everest,es8388 supplies to rk3399-roc-pc-plus
    
    The regulator supplies for everest,es8388 audio codec are missing and
    are required. Add them based on the schematics found here:
    
    https://personalbsd.org/download/Documents/SCH/ROC-RK3399-PC-PLUS-V20-20210809.pdf
    
    With this, "regulator-always-on" should no longer be necessary for LDO5.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260105193245.3167500-1-robh@kernel.org
    Signed-off-by: Heiko Stuebner 

commit f01f0e0700740dc7a2e5ed1af89d9770c1127d2e
Author: Chukun Pan 
Date:   Tue Jan 6 18:00:00 2026 +0800

    arm64: dts: rockchip: Enable PCIe for ArmSoM Sige1
    
    Enable the RTL8125 network controller and corresponding PHY
    connected via PCIe on the ArmSoM Sige1.
    
    Signed-off-by: Chukun Pan 
    Reviewed-by: Jonas Karlman 
    Link: https://patch.msgid.link/20260106100000.225445-1-amadeus@jmu.edu.cn
    Signed-off-by: Heiko Stuebner 

commit 5360ad495b7bf1e3ea95f0e47961d5447a829f8e
Author: Ricardo Pardini 
Date:   Thu Jan 1 07:43:11 2026 +0100

    arm64: dts: rockchip: Enable the NPU on Turing RK1
    
    Enable the NPU on Turing RK1.
    The regulator vdd_npu_s0 was already in place; since
    the NPU power domain supply is now described, remove the
    regulator's always-on.
    
    Signed-off-by: Ricardo Pardini 
    Link: https://patch.msgid.link/20260101-arm64-dts-rockchip-rk3588-npu-enablements-v2-3-013cf5d5c39d@pardini.net
    Signed-off-by: Heiko Stuebner 

commit 628aea397d81cbec3f2ff9067c5223c927f220a2
Author: Ricardo Pardini 
Date:   Thu Jan 1 07:43:10 2026 +0100

    arm64: dts: rockchip: Enable the NPU on FriendlyElec CM3588
    
    Enable the NPU on FriendlyElec CM3588.
    The regulator vdd_npu_s0 was already in place; since
    the NPU power domain supply is now described, remove the
    regulator's always-on.
    
    Signed-off-by: Ricardo Pardini 
    Link: https://patch.msgid.link/20260101-arm64-dts-rockchip-rk3588-npu-enablements-v2-2-013cf5d5c39d@pardini.net
    Signed-off-by: Heiko Stuebner 

commit 7127b6d899c74a2ba7af09f1755a22cf9c72dba9
Author: Ricardo Pardini 
Date:   Thu Jan 1 07:43:09 2026 +0100

    arm64: dts: rockchip: Enable the NPU on NanoPC T6/T6-LTS
    
    Enable the NPU on FriendlyElec NanoPC T6/T6-LTS boards.
    The regulator vdd_npu_s0 was already in place; since
    the NPU power domain supply is now described, remove the
    regulator's always-on.
    
    Signed-off-by: Ricardo Pardini 
    Link: https://patch.msgid.link/20260101-arm64-dts-rockchip-rk3588-npu-enablements-v2-1-013cf5d5c39d@pardini.net
    Signed-off-by: Heiko Stuebner 

commit cd50298ffc5f98872ddf0ac05c51a014003a34b7
Author: Alexey Charkov 
Date:   Tue Dec 30 17:23:34 2025 +0400

    arm64: dts: rockchip: enable UFS controller on FriendlyElec NanoPi M5
    
    The NanoPi M5 board supports pluggable UFS modules using the UFSHC
    inside its Rockchip RK3576 SoC.
    
    Enable the respective devicetree node and add its supply regulators.
    
    Link: https://wiki.friendlyelec.com/wiki/images/9/97/NanoPi_M5_LP5_2411_SCH.pdf
    Signed-off-by: Alexey Charkov 
    Link: https://patch.msgid.link/20251230-nanopi-m5-ufs-v3-1-ed188ae34fdb@gmail.com
    Signed-off-by: Heiko Stuebner 

commit a3e4bb6c9a2262c87a842d9fa42bdd65a1671edf
Author: Ondrej Jirman 
Date:   Thu Dec 25 19:43:20 2025 -0800

    arm64: dts: rockchip: Add light/proximity sensor to Pinephone Pro
    
    Pinephone Pro uses STK3311 according to the schematics.
    
    Tests:
    ~ $ monitor-sensor --light
        // When the sensor is exposed, it get's fluctating values such as
        Light changed: 1.800000 (lux)
        Light changed: 1.700000 (lux)
        Light changed: 1.800000 (lux)
        Light changed: 1.700000 (lux)
        Light changed: 1.600000 (lux)
        Light changed: 1.100000 (lux)
        // When covering the sensor, it prints a low value and stops printing
        Light changed: 0.200000 (lux)
    
    ~ $ monitor-sensor --proximity
        // When it goes away from an object
        Proximity value changed: 0
        // When it comes near an object
        Proximity value changed: 1
    
    Co-developed-by: Martijn Braam 
    Signed-off-by: Martijn Braam 
    Co-developed-by: Kamil Trzciński 
    Signed-off-by: Kamil Trzciński 
    Signed-off-by: Ondrej Jirman 
    Signed-off-by: Rudraksha Gupta 
    Link: https://patch.msgid.link/20251225-ppp_light_accel_mag_vol-down-v6-2-8c79a4e87001@gmail.com
    Signed-off-by: Heiko Stuebner 

commit 2b8cd99c8cf489d539e1347adb5fd39548c53f19
Author: Ondrej Jirman 
Date:   Thu Dec 25 19:43:19 2025 -0800

    arm64: dts: rockchip: Add magnetometer sensor to Pinephone Pro
    
    Pinephone Pro uses AF8133J according to the schematic.
    
    The mount-matrix was added by Leonardo on top of Ondrej's work of adding
    the magnetometer. It was verified with Leonardo's compass app:
    
    https://gitlab.com/lgtrombetta/compass
    
    Co-developed-by: Leonardo G. Trombetta 
    Signed-off-by: Leonardo G. Trombetta 
    Signed-off-by: Ondrej Jirman 
    Reviewed-by: Pavel Machek 
    Signed-off-by: Rudraksha Gupta 
    Link: https://patch.msgid.link/20251225-ppp_light_accel_mag_vol-down-v6-1-8c79a4e87001@gmail.com
    Signed-off-by: Heiko Stuebner 

commit 66a4ff38d7b213a1278840a754c6d357e7745b24
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:47:55 2026 +0100

    soc: fsl: qe: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Acked-by: Herve Codina 
    Link: https://lore.kernel.org/r/20260102124754.64122-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Christophe Leroy (CS GROUP) 

commit 148891e95014b5dc5878acefa57f1940c281c431
Author: Gui-Dong Han 
Date:   Wed Dec 3 01:44:38 2025 +0800

    bus: fsl-mc: fix use-after-free in driver_override_show()
    
    The driver_override_show() function reads the driver_override string
    without holding the device_lock. However, driver_override_store() uses
    driver_set_override(), which modifies and frees the string while holding
    the device_lock.
    
    This can result in a concurrent use-after-free if the string is freed
    by the store function while being read by the show function.
    
    Fix this by holding the device_lock around the read operation.
    
    Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
    Cc: stable@vger.kernel.org
    Signed-off-by: Gui-Dong Han 
    Reviewed-by: Ioana Ciornei 
    Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com
    Signed-off-by: Christophe Leroy (CS GROUP) 

commit 0b2761eb1287bd9f62367cccf6626eb3107cef6f
Author: Chen-Yu Tsai 
Date:   Thu Dec 25 18:36:14 2025 +0800

    ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
    
    The P66's device tree includes the reference design dtsi files, which
    defines a node and properties for the touchpanel in the common design.
    The P66 dts file then overrides all the properties to match its own
    design, but as the touchpanel model is different, a different schema
    is matched. This other schema uses a different name for the GPIO.
    
    The original submission added the correct GPIO property, but did not
    delete the one inherited from the reference design, causing validation
    errors.
    
    Explicitly delete the incorrect GPIO property.
    
    Fixes: 2a53aff27236 ("ARM: dts: sun5i: Enable touchscreen on Utoo P66")
    Reviewed-by: Jernej Skrabec 
    Link: https://patch.msgid.link/20251225103616.3203473-4-wens@kernel.org
    Signed-off-by: Chen-Yu Tsai 

commit 36227ab99a781a02b3448b79fb15f2a20dc7f10b
Merge: 96d337436fe092 75d208bddcca55
Author: Mark Brown 
Date:   Tue Jan 6 17:39:06 2026 +0000

    spi: st: use pm_ptr and remove __maybe_unused
    
    Merge series from Alain Volmat :
    
    Update ST related SPI drivers in order to remove the __maybe_unused
    statements on pm related functions thanks to the usage of pm_ptr.

commit b5a3112bfd5742a5d831c0bdfac2cf6e6796ac9d
Author: Xiangxu Yin 
Date:   Tue Nov 4 09:33:26 2025 +0800

    arm64: dts: qcom: qcs615-ride: Enable DisplayPort
    
    Add DP connector node and configure MDSS DisplayPort controller for
    QCS615 Ride platform. Include PHY supply settings to support DP output.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Xiangxu Yin 
    Link: https://lore.kernel.org/r/20251104-add-displayport-support-to-qcs615-devicetree-v7-4-e51669170a6f@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit b7ad04269d6825b1c88de17e698a356bac5f3197
Author: Xiangxu Yin 
Date:   Tue Nov 4 09:33:25 2025 +0800

    arm64: dts: qcom: talos: Add DisplayPort and QMP USB3-DP PHY
    
    Introduce DisplayPort controller node and associated QMP USB3-DP PHY
    for SM6150 SoC. Add data-lanes property to the DP endpoint and update
    clock assignments for proper DP integration.
    
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Xiangxu Yin 
    Link: https://lore.kernel.org/r/20251104-add-displayport-support-to-qcs615-devicetree-v7-3-e51669170a6f@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit f8c7600d468bdb6e44ed3b3247c6e53f5be5d8de
Author: Nikolay Borisov 
Date:   Wed Nov 12 21:05:48 2025 +0200

    x86/tsx: Set default TSX mode to auto
    
    At SUSE we've been releasing our kernels with TSX enabled for the past 6
    years and some customers have started to rely on it. Furthermore, the last
    known vulnerability concerning TSX was TAA (CVE-2019-11135) and a
    significant amount time has passed since then without anyone reporting any
    issues. Intel has released numerous processors which do not have the
    TAA vulnerability (Cooper/Ice Lake, Sapphire/Emerald/Granite Rappids)
    yet TSX remains being disabled by default.
    
    The main aim of this patch is to reduce the divergence between SUSE's
    configuration and the upstream by switching the default TSX mode to
    auto. I believe this strikes the right balance between keeping it
    enabled where appropriate (i.e every machine which doesn't contain the
    TAA vulnerability) and disabling it preventively.
    
    Signed-off-by: Nikolay Borisov 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20251112190548.750746-1-nik.borisov@suse.com

commit b4f1ffd63266d9a8785622074b12339535db6a7c
Author: Alice Ryhl 
Date:   Wed Dec 17 13:51:31 2025 +0000

    rust: cpumask: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Yury Norov (NVIDIA) 

commit 8618307b52ef2fa5caa87f1b7938125cb410e777
Author: Alice Ryhl 
Date:   Wed Dec 17 13:51:30 2025 +0000

    rust: bitops: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Yury Norov (NVIDIA) 

commit ac3dc186df4eb53f20bf519b352b8a76328bea12
Author: Alice Ryhl 
Date:   Wed Dec 17 13:51:29 2025 +0000

    rust: bitmap: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Reviewed-by: Boqun Feng 
    Reviewed-by: Gary Guo 
    Signed-off-by: Alice Ryhl 
    Signed-off-by: Yury Norov (NVIDIA) 

commit fa188edc671d4e2b9d88c1b48d2f4e577d6e6983
Author: H. Peter Anvin 
Date:   Tue Dec 16 17:21:53 2025 -0800

    linux/bitfield.h: replace __auto_type with auto
    
    Replace "__auto_type" as described in commit:
    
    2fb6915fa22d compiler_types.h: add "auto" as a macro for "__auto_type"
    
    [Yury: keep inclusions alphabetically ordered]
    
    Cc: Rasmus Villemoes  (reviewer:BITMAP API)
    Signed-off-by: H. Peter Anvin (Intel) 
    Signed-off-by: Yury Norov (NVIDIA) 

commit 18fe1f58623f8c1fddd21a3d044d668ba9d8b0a9
Author: Randy Dunlap 
Date:   Mon Jan 5 17:47:08 2026 -0800

    x86/cpu: Drop unused Kconfig symbol X86_P6_NOP
    
    This symbol was removed in early 2025 but 2 dangling references to it
    were missed. Delete them now.
    
    It should be safe to drop the -mtune=generic32 option since gcc 4.3
    and later do not cause the problem (see 28f7e66fc1da ("x86: prevent
    binutils from being "smart" and generating NOPLs for us")). Also, Arnd
    confirmed this with gcc-8 and gcc-15 (see Link:).
    
    Fixes: f388f60ca904 ("x86/cpu: Drop configuration options for early 64-bit CPUs")
    Signed-off-by: Randy Dunlap 
    Signed-off-by: Dave Hansen 
    Reviewed-by: Nikolay Borisov 
    Link: https://patch.msgid.link/20260106014708.991447-1-rdunlap@infradead.org
    Link: https://lore.kernel.org/all/c0f0814a-8333-49e1-8e50-740e4c88d94b@app.fastmail.com/

commit 6b45ded3f714e78c20708c0f29852fba856fec0c
Author: Richard Lyu 
Date:   Tue Jan 6 13:28:17 2026 +0800

    Documentation/x86: Update IOMMU spec references to use stable identifiers
    
    Direct URLs to vendor specifications for Intel VT-d and AMD IOMMU
    are frequently changed by vendors, leading to broken links in the
    documentation.
    
    Replace the fragile URLs with persistent identifiers, providing the
    official document titles and IDs. This ensures users can locate the
    relevant specifications regardless of vendor website restructuring.
    
    Signed-off-by: Richard Lyu 
    Signed-off-by: Dave Hansen 
    Link: https://patch.msgid.link/20260106052815.46114-1-richard.lyu@suse.com

commit ad0721bba4156d4d06c5f79b0a32e9d876f5ad0f
Author: Krzysztof Kozlowski 
Date:   Tue Jan 6 10:07:41 2026 +0100

    arm64: dts: qcom: sm8750-qrd: Enable Iris codec
    
    Enable on SM8750 QRD the Iris video codec for accelerated video
    encoding/decoding.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Bryan O'Donoghue 
    Link: https://lore.kernel.org/r/20260106-b4-sm8750-iris-dts-v4-3-97db1d1df3dd@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 10d764c8cb1bdaff15020115aa49ee7a0489655b
Author: Krzysztof Kozlowski 
Date:   Tue Jan 6 10:07:40 2026 +0100

    arm64: dts: qcom: sm8750-mtp: Enable Iris codec
    
    Enable on SM8750 MTP the Iris video codec for accelerated video
    encoding/decoding.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Bryan O'Donoghue 
    Link: https://lore.kernel.org/r/20260106-b4-sm8750-iris-dts-v4-2-97db1d1df3dd@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit c0d11ff904753a99e0f6efd29e614268bc6e98db
Author: Krzysztof Kozlowski 
Date:   Tue Jan 6 10:07:39 2026 +0100

    arm64: dts: qcom: sm8750: Add Iris VPU v3.5
    
    Add Iris video codec to SM8750 SoC, which comes with significantly
    different powering up sequence than previous SM8650, thus different
    clocks and resets.  For consistency keep existing clock and clock-names
    naming, so the list shares common part.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Bryan O'Donoghue 
    Link: https://lore.kernel.org/r/20260106-b4-sm8750-iris-dts-v4-1-97db1d1df3dd@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 6a0b99e9fb45f403c3097a9047963d2dd5b0fab2
Author: Gert Wollny 
Date:   Wed Nov 19 17:45:51 2025 +0100

    drm/etnaviv: Add module parameter to force PPU flop reset
    
    v2: Check for feature PIPE_3D when forcing PPU flop reset (Lucas)
    
    v3: - drop use of ppu_flop_reset enum (Christian Gmeiner)
        - don't initialize module parameter to zero (checkpatch)
        - avoid multi-line string in warning message (checkpatch)
    
    Signed-off-by: Gert Wollny 
    Reviewed-by: Christian Gmeiner 
    Tested-by: Marek Vasut  # STM32MP255C DHCOS DHSBC
    Link: https://patch.msgid.link/20251119164624.9297-6-gert.wollny@collabora.com
    Signed-off-by: Christian Gmeiner 

commit 85ba57ad88cf96b2fb4cf6c81639c7907bf3cd94
Author: Gert Wollny 
Date:   Wed Nov 19 17:45:50 2025 +0100

    drm/etnaviv: Add PPU flop reset
    
    The PPU flop reset is required on some hardware to clear the
    temporary registers. This code follows the implementation
    of the PPU flop reset as found in the public galcore kernel
    module. Compared to that code some superfluous parts were
    removed and only the code path for SoC chip_model = 0x8000
    and revision = 0x6205 is implemented and tested.
    
    v2: - Move flop reset data to etnaviv_drm_private and initialize it
          from etnaviv_gpu_bind (Lucas)
        - Prepare code for more chip IDs and other flop reset types
        - Do some cleanups and rename some functions
    
    v3: - Move initialization of flop reset data to etnaviv_gpu_init (Lucas)
        - Free PPU data suballocation (Lucas)
    
    v4: As suggested by
        - replace "asm-generic/int-ll64.h" with "linux/types.h"
        - drop flop reset type enum since we only support one type here
        - move function return parameters on same line with function name
        - replace open coded for loop with memset32
        - add cnost to local static values
        - add a return value to etnaviv_flop_reset_ppu_init; handle and
          pass errors on to the caller
        - handle etnaviv_flop_reset_ppu_init return value
        - use dev_err for flop reset error message
        - fix include guard to be consistent with the other driver code
        - fix license header and formatting
    
    v5: As suggested by Christian Gmeiner:
        - add required header that is no longer pulled in by etnaviv_buffer.h
        - fix include style of linux headers
        - free flop_reset_data_ppu when command buffer initialization fails
        - fix typo in error message
    
    [cgmeiner: fix SPDX comment style, fix line end with a '(' and fix typo]
    
    Signed-off-by: Gert Wollny 
    Reviewed-by: Christian Gmeiner 
    Tested-by: Marek Vasut  # STM32MP255C DHCOS DHSBC
    Link: https://patch.msgid.link/20251119164624.9297-5-gert.wollny@collabora.com
    Signed-off-by: Christian Gmeiner 

commit 9fcdece1a734bc71d2d9f9e3dd301cc9fff23327
Author: Gert Wollny 
Date:   Wed Nov 19 17:45:49 2025 +0100

    drm/etnaviv: Add a new function to emit a series of states to cmd stream
    
    v2: fix formatting and remove superfluous masking (Lucas)
    
    Signed-off-by: Gert Wollny 
    Reviewed-by: Christian Gmeiner 
    Tested-by: Marek Vasut  # STM32MP255C DHCOS DHSBC
    Link: https://patch.msgid.link/20251119164624.9297-4-gert.wollny@collabora.com
    Signed-off-by: Christian Gmeiner 

commit 9934873be03c781e0be7b91168fb6a929b140cd1
Author: Gert Wollny 
Date:   Wed Nov 19 17:45:48 2025 +0100

    drm/etnaviv: move some functions to a header to be able to use them externally
    
    v2: Add license info to header
    
    v3: remove unused headers (Christian Gmainer)
    
    [cgmeiner: improve include guard]
    
    Signed-off-by: Gert Wollny 
    Reviewed-by: Christian Gmeiner 
    Tested-by: Marek Vasut  # STM32MP255C DHCOS DHSBC
    Link: https://patch.msgid.link/20251119164624.9297-3-gert.wollny@collabora.com
    Signed-off-by: Christian Gmeiner 

commit a8fffbe7dec7d2dda19ed8c7cc13bed744546c05
Author: Gert Wollny 
Date:   Wed Nov 19 17:45:47 2025 +0100

    drm/etnaviv: Add command stream definitions required for a PPU flop reset
    
    v2: move some defines that resided in etnaviv_flop_reset.c
        into the header as well
    
    v3: fix spacing/tab stops
    
    [cgmeiner: remove use of multiple blank lines]
    
    Signed-off-by: Gert Wollny 
    Reviewed-by: Christian Gmeiner 
    Tested-by: Marek Vasut  # STM32MP255C DHCOS DHSBC
    Link: https://patch.msgid.link/20251119164624.9297-2-gert.wollny@collabora.com
    Signed-off-by: Christian Gmeiner 

commit a491c02c2770c9c2d02b96fad7e3a176d77bb737
Author: Keke Ming 
Date:   Sat Jan 3 16:42:43 2026 +0800

    uprobes: use kmap_local_page() for temporary page mappings
    
    Replace deprecated kmap_atomic() with kmap_local_page().
    
    Signed-off-by: Keke Ming 
    Signed-off-by: Peter Zijlstra (Intel) 
    Acked-by: Oleg Nesterov 
    Link: https://patch.msgid.link/20260103084243.195125-6-ming.jvle@gmail.com

commit 0e2036a06dcf61dbd100168830287d6c42cd61e1
Author: oldzhu 
Date:   Tue Jan 6 12:01:58 2026 +0800

    scripts/atomic: Fix kerneldoc spelling in try_cmpxchg()
    
    Fix a typo in the kerneldoc comment template.
    
    This changes 'occured' to 'occurred' in generated documentation.
    
    Signed-off-by: oldzhu 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20260106040158.31461-1-oldrunner999@gmail.com

commit 1752a1ad43a1d4fd450a8ef5f8d240f9e228e0a3
Author: Keke Ming 
Date:   Sat Jan 3 16:42:42 2026 +0800

    arm/uprobes: use kmap_local_page() in arch_uprobe_copy_ixol()
    
    Replace deprecated kmap_atomic() with kmap_local_page().
    
    Signed-off-by: Keke Ming 
    Signed-off-by: Peter Zijlstra (Intel) 
    Acked-by: Oleg Nesterov 
    Link: https://patch.msgid.link/20260103084243.195125-5-ming.jvle@gmail.com

commit e6eb9acc024cdad7d1cbb7693ac39afdf9c5193f
Author: Keke Ming 
Date:   Sat Jan 3 16:42:41 2026 +0800

    mips/uprobes: use kmap_local_page() in arch_uprobe_copy_ixol()
    
    Replace deprecated kmap_atomic() with kmap_local_page().
    
    Signed-off-by: Keke Ming 
    Signed-off-by: Peter Zijlstra (Intel) 
    Acked-by: Oleg Nesterov 
    Link: https://patch.msgid.link/20260103084243.195125-4-ming.jvle@gmail.com

commit 094cc7bb5fc3b484614417b4578233a38e3df942
Author: Keke Ming 
Date:   Sat Jan 3 16:42:40 2026 +0800

    arm64/uprobes: use kmap_local_page() in arch_uprobe_copy_ixol()
    
    Replace deprecated kmap_atomic() with kmap_local_page().
    
    Signed-off-by: Keke Ming 
    Signed-off-by: Peter Zijlstra (Intel) 
    Acked-by: Oleg Nesterov 
    Link: https://patch.msgid.link/20260103084243.195125-3-ming.jvle@gmail.com

commit a18dfb5dd33247679a0cc4ff208ad7340d1e08a5
Author: Keke Ming 
Date:   Sat Jan 3 16:42:39 2026 +0800

    riscv/uprobes: use kmap_local_page() in arch_uprobe_copy_ixol()
    
    Replace deprecated kmap_atomic() with kmap_local_page().
    
    Signed-off-by: Keke Ming 
    Signed-off-by: Peter Zijlstra (Intel) 
    Acked-by: Oleg Nesterov 
    Link: https://patch.msgid.link/20260103084243.195125-2-ming.jvle@gmail.com

commit e7d5f2ea0923c5e49ccf94cdaab74a08c865115e
Author: Zide Chen 
Date:   Wed Dec 31 14:42:30 2025 -0800

    perf/x86/intel/uncore: Add Nova Lake support
    
    Nova Lake uncore PMON largely follows Panther Lake and supports CBOX,
    iMC, cNCU, SANTA, sNCU, and HBO units.
    
    As with Panther Lake, CBOX, cNCU, and SANTA are not enumerated via
    discovery tables.  Their programming model matches Panther Lake, with
    differences limited to MSR addresses and the number of boxes or counters
    per box.
    
    The remaining units are enumerated via discovery tables using a new
    base MSR (0x711) and otherwise reuse the Panther Lake implementation.
    Nova Lake also supports iMC free-running counters.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-14-zide.chen@intel.com

commit 46da08a2bb4d07874990579235ff87b41911a412
Author: Zide Chen 
Date:   Wed Dec 31 14:42:29 2025 -0800

    perf/x86/intel/uncore: Add missing PMON units for Panther Lake
    
    Besides CBOX, Panther Lake includes several legacy uncore PMON units
    not enumerated via discovery tables, including cNCU, SANTA, and
    ia_core_bridge.
    
    The cNCU PMON is similar to Meteor Lake but has two boxes with two
    counters each. SANTA and IA Core Bridge PMON units follow the legacy
    model used on Lunar Lake, Meteor Lake, and others.
    
    Panther Lake implements the Global Control Register; the freeze_all bit
    must be cleared before programming counters.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-13-zide.chen@intel.com

commit 2246c24426fbc1069cb2a47e0624ccffe5f2627b
Author: Zide Chen 
Date:   Wed Dec 31 14:42:28 2025 -0800

    perf pmu: Relax uncore wildcard matching to allow numeric suffix
    
    Diamond Rapids introduces two types of PCIe related uncore PMUs:
    "uncore_pcie4_*" and "uncore_pcie6_*".
    
    To ensure that generic PCIe events (e.g., UNC_PCIE_CLOCKTICKS) can match
    and collect events from both PMU types, slightly relax the wildcard
    matching logic in perf_pmu__match_wildcard().
    
    This change allows a wildcard such as "pcie" to match PMU names that
    include a numeric suffix, such as "pcie4_*" and "pcie6_*".
    
    Co-developed-by: Dapeng Mi 
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-12-zide.chen@intel.com

commit 171b5292a82d04e6692f1b19573d15753f21e7fd
Author: Zide Chen 
Date:   Wed Dec 31 14:42:27 2025 -0800

    perf/x86/intel/uncore: Update DMR uncore constraints preliminarily
    
    Update event constraints base on the latest DMR uncore event list.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-11-zide.chen@intel.com

commit aacb0718fddfe7060576c82e47bbda559c2f2d0d
Author: Zide Chen 
Date:   Wed Dec 31 14:42:26 2025 -0800

    perf/x86/intel/uncore: Support uncore constraint ranges
    
    Add UNCORE_EVENT_CONSTRAINT_RANGE macro for uncore constraints,
    similar to INTEL_EVENT_CONSTRAINT_RANGE, to reduce duplication when
    defining consecutive uncore event constraints.
    
    No functional change intended.
    
    Suggested-by: Dapeng Mi 
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-10-zide.chen@intel.com

commit d8987048f6655b38453d00782a256179f082b79c
Author: Zide Chen 
Date:   Wed Dec 31 14:42:25 2025 -0800

    perf/x86/intel/uncore: Support IIO free-running counters on DMR
    
    The free-running counters for IIO uncore blocks on Diamond Rapids are
    similar to Sapphire Rapids IMC freecounters, with the following
    differences:
    
    - The counters are MMIO based.
    - Only a subset of IP blocks implement free-running counters:
      HIOP0 (IP Base Addr: 2E7000h)
      HIOP1 (IP Base Addr: 2EF000h)
      HIOP3 (IP Base Addr: 2FF000h)
      HIOP4 (IP Base Addr: 307000h)
    - IMH2 (Secondary IMH) does not provide free-running counters.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-9-zide.chen@intel.com

commit 8a4bd1c0d6bb64ab4d9e94d83c40326356421a73
Author: Zide Chen 
Date:   Wed Dec 31 14:42:24 2025 -0800

    perf/x86/intel/uncore: Add freerunning event descriptor helper macro
    
    Freerunning counter events are repetitive: the event code is fixed to
    0xff, the unit is always "MiB", and the scale is identical across all
    counters on a given PMON unit.
    
    Introduce a new helper macro, INTEL_UNCORE_FR_EVENT_DESC(), to populate
    the event, scale, and unit descriptor triplet. This reduces duplicated
    lines and improves readability.
    
    No functional change intended.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-8-zide.chen@intel.com

commit b575fc0e33574f3a476b68057e340ebe32d7b750
Author: Zide Chen 
Date:   Wed Dec 31 14:42:23 2025 -0800

    perf/x86/intel/uncore: Add domain global init callback
    
    In the Intel uncore self-describing mechanism, the Global Control
    Register freeze_all bit is SoC-wide and propagates to all uncore PMUs.
    
    On Diamond Rapids, this bit is set at power-on, unlike some prior
    platforms.  Add a global_init callback to unfreeze all PMON units.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-7-zide.chen@intel.com

commit 66e2075426f3220857eb3987c803764c82cef851
Author: Zide Chen 
Date:   Wed Dec 31 14:42:22 2025 -0800

    perf/x86/intel/uncore: Add CBB PMON support for Diamond Rapids
    
    On DMR, PMON units inside the Core Building Block (CBB) are enumerated
    separately from those in the Integrated Memory and I/O Hub (IMH).
    
    A new per-CBB MSR (0x710) is introduced for discovery table enumeration.
    
    For counter control registers, the tid_en bit (bit 16) exists on CBO,
    SBO, and Santa, but it is not used by any events.  Mark this bit as
    reserved.
    
    Similarly, disallow extended umask (bits 32–63) on Santa and sNCU.
    
    Additionally, ignore broken SB2UCIE unit.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-6-zide.chen@intel.com

commit 6daf2c35b835da211bf70606e9f74d1af98613a9
Author: Zide Chen 
Date:   Wed Dec 31 14:42:21 2025 -0800

    perf/x86/intel/uncore: Add IMH PMON support for Diamond Rapids
    
    DMR supports IMH PMON units for PCU, UBox, iMC, and CXL:
    - PCU and UBox are same with SPR.
    - iMC is similar to SPR but uses different offsets for fixed registers.
    - CXL introduces a new port_enable field and changes the position of
      the threshold field.
    
    DMR also introduces additional PMON units: SCA, HAMVF, D2D_ULA, UBR,
    PCIE4, CRS, CPC, ITC, OTC, CMS, and PCIE6.  Among these, PCIE4 and
    PCIE6 use different unit types, but share the same config register
    layout, and the generic PCIe PMON events apply to both.
    
    Additionally, ignore the broken MSE unit.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251231224233.113839-5-zide.chen@intel.com

commit 1897336728b4ab0229fb73bb6f1e94cfe914afa9
Author: Zide Chen 
Date:   Wed Dec 31 14:42:20 2025 -0800

    perf/x86/intel/uncore: Remove has_generic_discovery_table()
    
    In the !x86_match_cpu() fallback path, has_generic_discovery_table()
    is removed because it does not handle multiple PCI devices.  Instead,
    use PCI_ANY_ID in generic_uncore_init[] to probe all PCI devices.
    
    For MSR portals, only probe MSR 0x201e to keep the fallback simple, as
    this path is best-effort only.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-4-zide.chen@intel.com

commit e75462f6c7eaa5affd922c9a14591cdd5e3ab63d
Author: Zide Chen 
Date:   Wed Dec 31 14:42:19 2025 -0800

    perf/x86/intel/uncore: Support per-platform discovery base devices
    
    On DMR platforms, IMH discovery tables are enumerated via PCI, while
    CBB domains use MSRs, unlike earlier platforms which relied on either
    PCI or MSR exclusively.
    
    DMR also uses different MSRs and PCI devices, requiring support for
    multiple, platform-specific discovery bases.
    
    Introduce struct uncore_discovery_domain to hold the discovery base and
    other domain-specific configuration.
    
    Move uncore_units_ignore into uncore_discovery_domain so a single
    structure can be passed to uncore_discovery_[pci/msr].
    
    No functional change intended.
    
    Co-developed-by: Dapeng Mi 
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-3-zide.chen@intel.com

commit 098fe55a450b280d8a8584b2511634e1236ba96d
Author: Zide Chen 
Date:   Wed Dec 31 14:42:18 2025 -0800

    perf/x86/intel/uncore: Move uncore discovery init struct to header
    
    The discovery base MSR or PCI device is platform-specific and must be
    defined statically in the per-platform init table and passed to the
    discovery code.
    
    Move the definition of struct intel_uncore_init_fun to uncore.h so it
    can be accessed by discovery code, and rename it to reflect that it
    now carries more than just init callbacks.
    
    Shorten intel_uncore_has_discovery_tables[_pci/msr] to
    uncore_discovery[_pci/msr] for improved readability and alignment.
    
    Drop the `intel_` prefix from new names since the code is under the
    intel directory and long identifiers make alignment harder.  Further
    cleanups will continue removing `intel_` prefixes.
    
    No functional change intended.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251231224233.113839-2-zide.chen@intel.com

commit 632d89b030f1dac8d91875cd56a08adededba349
Author: Greg Kroah-Hartman 
Date:   Wed Dec 17 13:42:41 2025 +0100

    perf/x86/uncore: clean up const mismatch
    
    In some cmp functions, a const pointer is cast out to a non-const
    pointer by using container_of() which is not correct.  Fix this up by
    properly marking the pointers as const, which preserves the correct
    type of the pointer passed into the functions.
    
    Signed-off-by: Greg Kroah-Hartman 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/2025121741-headstand-stratus-f5eb@gregkh

commit 04b61513dfe40f80f0dcc795003637b510522b3c
Author: Marco Crivellari 
Date:   Tue Dec 30 15:34:29 2025 +0100

    ASoC: SDCA: Replace use of system_wq with system_dfl_wq
    
    This patch continues the effort to refactor workqueue APIs, which has begun
    with the changes introducing new workqueues and a new alloc_workqueue flag:
    
       commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
       commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    The point of the refactoring is to eventually alter the default behavior of
    workqueues to become unbound by default so that their workload placement is
    optimized by the scheduler.
    
    Before that to happen after a careful review and conversion of each individual
    case, workqueue users must be converted to the better named new workqueues with
    no intended behaviour changes:
    
       system_wq -> system_percpu_wq
       system_unbound_wq -> system_dfl_wq
    
    This specific workload has no benefits being per-cpu, so system_wq
    has been replaced with system_dfl_wq (the unbound workqueue).
    
    This way the old obsolete workqueues (system_wq, system_unbound_wq) can be
    removed in the future.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Reviewed-by: Charles Keepax 
    Link: https://patch.msgid.link/20251230143429.179643-1-marco.crivellari@suse.com
    Signed-off-by: Mark Brown 

commit fcf463b92a08686d1aeb1e66674a72eb7a8bfb9b
Author: Leon Romanovsky 
Date:   Wed Dec 17 11:41:24 2025 +0200

    types: move phys_vec definition to common header
    
    Move the struct phys_vec definition from block/blk-mq-dma.c to
    include/linux/types.h to make it available for use across the kernel.
    
    The phys_vec structure represents a physical address range with a
    length, which is used by the new physical address-based DMA mapping
    API. This structure is already used by the block layer and will be
    needed for DMA phys API users.
    
    Moving this definition to types.h provides a centralized location
    for this common data structure and eliminates code duplication
    across subsystems that need to work with physical address ranges.
    
    Signed-off-by: Leon Romanovsky 
    Reviewed-by: Chaitanya Kulkarni 
    Signed-off-by: Jens Axboe 

commit 073b9bf9af463d32555c5ebaf7e28c3a44c715d0
Author: Leon Romanovsky 
Date:   Wed Dec 17 11:41:23 2025 +0200

    nvme-pci: Use size_t for length fields to handle larger sizes
    
    This patch changes the length variables from unsigned int to size_t.
    Using size_t ensures that we can handle larger sizes, as size_t is
    always equal to or larger than the previously used u32 type.
    
    Originally, u32 was used because blk-mq-dma code evolved from
    scatter-gather implementation, which uses unsigned int to describe length.
    This change will also allow us to reuse the existing struct phys_vec in places
    that don't need scatter-gather.
    
    Signed-off-by: Leon Romanovsky 
    Reviewed-by: Chaitanya Kulkarni 
    Signed-off-by: Jens Axboe 

commit da64eb51595bc6073b2fb69c2a3859bba93ed75a
Author: Yixun Lan 
Date:   Tue Jan 6 11:09:33 2026 +0800

    gpio: spacemit: Add GPIO support for K3 SoC
    
    SpacemiT K3 SoC has changed gpio register layout while comparing
    with previous generation, the register offset and bank offset
    need to be adjusted, introduce a compatible data to extend the
    driver to support this.
    
    Signed-off-by: Yixun Lan 
    Link: https://lore.kernel.org/r/20260106-02-k3-gpio-v3-2-4800c214810b@gentoo.org
    Signed-off-by: Bartosz Golaszewski 

commit 48033e4c677be4e3f131df454d44a5d1fb1b334f
Author: Yixun Lan 
Date:   Tue Jan 6 11:09:32 2026 +0800

    dt-bindings: gpio: spacemit: add compatible name for K3 SoC
    
    Add new compatible string for SpacemiT K3 SoC's GPIO controller.
    
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Yixun Lan 
    Link: https://lore.kernel.org/r/20260106-02-k3-gpio-v3-1-4800c214810b@gentoo.org
    Signed-off-by: Bartosz Golaszewski 

commit 69d26698e4fd44935510553809007151b2fe4db5
Author: Md Haris Iqbal 
Date:   Fri Dec 5 13:47:33 2025 +0100

    rnbd-srv: Zero the rsp buffer before using it
    
    Before using the data buffer to send back the response message, zero it
    completely. This prevents any stray bytes to be picked up by the client
    side when there the message is exchanged between different protocol
    versions.
    
    Signed-off-by: Md Haris Iqbal 
    Signed-off-by: Jack Wang 
    Signed-off-by: Grzegorz Prajsner 
    Signed-off-by: Jens Axboe 

commit 4ac9690d4b9456ca1d5276d86547fa2e7cd47684
Author: Florian-Ewald Mueller 
Date:   Fri Dec 5 13:47:32 2025 +0100

    rnbd-srv: Fix server side setting of bi_size for special IOs
    
    On rnbd-srv, the bi_size of the bio is set during the bio_add_page
    function, to which datalen is passed. But for special IOs like DISCARD
    and WRITE_ZEROES, datalen is 0, since there is no data to write. For
    these special IOs, use the bi_size of the rnbd_msg_io.
    
    Fixes: f6f84be089c9 ("block/rnbd-srv: Add sanity check and remove redundant assignment")
    Signed-off-by: Florian-Ewald Mueller 
    Signed-off-by: Md Haris Iqbal 
    Signed-off-by: Grzegorz Prajsner 
    Signed-off-by: Jens Axboe 

commit e1384543e85b11b494051d11728d6d88a93161bc
Author: Jack Wang 
Date:   Fri Dec 5 13:47:31 2025 +0100

    rnbd-srv: fix the trace format for flags
    
    The __print_flags helper meant for bitmask, while the rnbd_rw_flags is
    mixed with bitmask and enum, to avoid confusion, just print the data
    as it is.
    
    Signed-off-by: Jack Wang 
    Reviewed-by: Md Haris Iqbal 
    Signed-off-by: Grzegorz Prajsner 
    Signed-off-by: Jens Axboe 

commit ef63e9ef76c801ac3081811fc6226ffb4c02453a
Author: Md Haris Iqbal 
Date:   Fri Dec 5 13:47:30 2025 +0100

    block/rnbd-proto: Check and retain the NOUNMAP flag for requests
    
    The NOUNMAP flag is in combination with WRITE_ZEROES flag to indicate
    that the upper layers wants the sectors zeroed, but does not want it to
    get freed. This instruction is especially important for storage stacks
    which involves a layer capable of thin provisioning.
    
    This commit makes RNBD block device transfer and retain this NOUNMAP flag
    for requests, so it can be passed onto the backend device on the server
    side.
    
    Since it is a change in the wire protocol, bump the minor version of
    protocol.
    
    Signed-off-by: Md Haris Iqbal 
    Signed-off-by: Jack Wang 
    Signed-off-by: Grzegorz Prajsner 
    Signed-off-by: Jens Axboe 

commit 581cf833cac4461d90ef5da4c5ef4475f440e489
Author: Zhu Yanjun 
Date:   Fri Dec 5 13:47:29 2025 +0100

    block: rnbd: add .release to rnbd_dev_ktype
    
    Every ktype must provides a .release function that will be called after
    the last kobject_put.
    
    Signed-off-by: Zhu Yanjun 
    Reviewed-by: Md Haris Iqbal 
    Signed-off-by: Grzegorz Prajsner 
    Signed-off-by: Jens Axboe 

commit 483cbec3422399aca449265205be3aa83df281f6
Author: Md Haris Iqbal 
Date:   Fri Dec 5 13:47:28 2025 +0100

    block/rnbd-proto: Handle PREFLUSH flag properly for IOs
    
    In RNBD client, for a WRITE request of size 0, with only the REQ_PREFLUSH
    bit set, while converting from bio_opf to rnbd_opf, we do REQ_OP_WRITE to
    RNBD_OP_WRITE, and then check if the rq is flush through function
    op_is_flush. That function checks both REQ_PREFLUSH and REQ_FUA flag, and
    if any of them is set, the RNBD_F_FUA is set.
    On the RNBD server side, while converting the RNBD flags to req flags, if
    the RNBD_F_FUA flag is set, we just set the REQ_FUA flag. This means we
    have lost the PREFLUSH flag, and added the REQ_FUA flag in its place.
    
    This commits adds a new RNBD_F_PREFLUSH flag, and also adds separate
    handling for REQ_PREFLUSH flag. On the server side, if the RNBD_F_PREFLUSH
    is present, the REQ_PREFLUSH is added to the bio.
    
    Since it is a change in the wire protocol, bump the minor version of
    protocol.
    The change is backwards compatible, and does not change the functionality
    if either the client or the server is running older/newer versions.
    If the client side is running the older version, both REQ_PREFLUSH and
    REQ_FUA is converted to RNBD_F_FUA. The server running newer one would
    still add only the REQ_FUA flag which is what happens when both client and
    server is running the older version.
    If the client side is running the newer version, just like before a
    RNBD_F_FUA is added, but now a RNBD_F_PREFLUSH is also added to the
    rnbd_opf. In case the server is running the older version the
    RNBD_F_PREFLUSH is ignored, and only the RNBD_F_FUA is processed.
    
    Signed-off-by: Md Haris Iqbal 
    Reviewed-by: Jack Wang 
    Reviewed-by: Florian-Ewald Mueller 
    Signed-off-by: Grzegorz Prajsner 
    Signed-off-by: Jens Axboe 

commit 75d208bddcca55ec31481420fbb4d6c9703ba195
Author: Alain Volmat 
Date:   Tue Jan 6 13:14:20 2026 +0100

    spi: stm32: avoid __maybe_unused and use pm_ptr
    
    Switch to usage of pm_ptr / SYSTEM_SLEEP_PM_OPS / RUNTIME_PM_OPS
    in order to avoid having to mark the pm related functions as
    __maybe_unused.
    
    Signed-off-by: Alain Volmat 
    Link: https://patch.msgid.link/20260106-spi_st_maybe_unused_removal-v1-4-8f5ca7136e96@foss.st.com
    Signed-off-by: Mark Brown 

commit 10a6d7507791a667fe1d327056ac3f72934cc7de
Author: Alain Volmat 
Date:   Tue Jan 6 13:14:19 2026 +0100

    spi: stm32-qspi: avoid __maybe_unused and use pm_ptr
    
    Switch to usage of pm_ptr / SYSTEM_SLEEP_PM_OPS / RUNTIME_PM_OPS
    in order to avoid having to mark the pm related functions as
    __maybe_unused.
    
    Signed-off-by: Alain Volmat 
    Link: https://patch.msgid.link/20260106-spi_st_maybe_unused_removal-v1-3-8f5ca7136e96@foss.st.com
    Signed-off-by: Mark Brown 

commit 2a2d7187f5a7238582c2bbd4a6da7595c20e55a9
Author: Alain Volmat 
Date:   Tue Jan 6 13:14:18 2026 +0100

    spi: stm32-ospi: avoid __maybe_unused and use pm_ptr
    
    Switch to usage of pm_ptr / SYSTEM_SLEEP_PM_OPS / RUNTIME_PM_OPS
    in order to avoid having to mark the pm related functions as
    __maybe_unused.
    
    Signed-off-by: Alain Volmat 
    Link: https://patch.msgid.link/20260106-spi_st_maybe_unused_removal-v1-2-8f5ca7136e96@foss.st.com
    Signed-off-by: Mark Brown 

commit d4469e4ee5da0a93eabfcb89a8c6ecdf7cf1e9be
Author: Alain Volmat 
Date:   Tue Jan 6 13:14:17 2026 +0100

    spi: st: remove __maybe_unused for suspend/resume
    
    Remove useless __maybe_unused statements for suspend and resume
    functions since this is now used via pm_ptr.
    
    Signed-off-by: Alain Volmat 
    Link: https://patch.msgid.link/20260106-spi_st_maybe_unused_removal-v1-1-8f5ca7136e96@foss.st.com
    Signed-off-by: Mark Brown 

commit 4310a370a323901b42f0ddd119a53af723f3359b
Author: Michal Simek 
Date:   Mon Dec 15 09:02:05 2025 +0100

    arm64: zynqmp: Remove ina260 IIO description
    
    Kernel has only hwmon driver that's why there is no reason to wire iio to
    hwmon converter which was describing out of tree ina260 IIO.
    
    Signed-off-by: Michal Simek 
    Link: https://lore.kernel.org/r/7e57f76deca9e73be3fcb914aed119f567c9bf8a.1765785722.git.michal.simek@amd.com

commit e06a177d819570014ca627a062b38a032a816165
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 11:59:13 2025 -0600

    arm64: dts: xilinx: Drop "label" property on dlg,slg7xl45106
    
    The "label" property is not documented for the dlg,slg7xl45106. Nor is
    it common to use for GPIO controllers. So drop it.
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Michal Simek 
    Link: https://lore.kernel.org/r/20251216175914.2791200-1-robh@kernel.org

commit 6b6dbf3e4ecfd7d1086bd7cd8b31ca8e45d4dc1f
Author: Thomas Weißschuh 
Date:   Tue Jan 6 11:39:55 2026 +0100

    selftests/nolibc: always build sparc32 tests with -mcpu=v8
    
    Since LLVM commit 39e30508a7f6 ("[Driver][Sparc] Default to -mcpu=v9 for
    32-bit Linux/sparc64 (#109278)"), clang defaults to -mcpu=v9 for 32-bit
    SPARC builds. -mcpu=v9 generates instructions which are not recognized
    by qemu-sparc and qemu-system-sparc.
    
    Explicitly enforce -mcpu=v8 to generate compatible code.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Link: https://patch.msgid.link/20260106-nolibc-sparc32-fix-v2-1-7c5cd6b175c2@weissschuh.net

commit 57624b38ce99b906cbb191a1d536bb871ad2d8c2
Author: Thomas Weißschuh 
Date:   Sun Jan 4 23:43:13 2026 +0100

    tools/nolibc: align sys_vfork() with sys_fork()
    
    Currently the generic variants of sys_fork() and sys_vfork() differ in
    both they precedence of used system calls and the usage of sys_clone()
    vs sys_clone3(). While the interface of clone3() in sys_vfork() is more
    consistent over different architectures, qemu-user does not support it,
    making testing harder. We already handle the different clone()
    interfaces for sys_fork() in the architecture-specific headers, and can
    do so also for sys_vfork(). In fact SPARC already has such handling and
    only s390 is currently missing.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Link: https://patch.msgid.link/20260104-nolibc-vfork-v1-1-a63464b9e4e6@weissschuh.net

commit 03139924859f7930cd1667a278a560b5d4c6a672
Author: Thomas Weißschuh 
Date:   Sun Jan 4 15:57:51 2026 +0100

    selftests/nolibc: drop NOLIBC_SYSROOT=0 logic
    
    This logic was added in commit 850fad7de827 ("selftests/nolibc: allow
    test -include /path/to/nolibc.h") to allow the testing of -include
    /path/to/nolibc.h. As it requires as special variable to activate, this
    code is nearly never used. Furthermore it complicates the logic a bit.
    
    Since commit a6a054c8ad32 ("tools/nolibc: add target to check header
    usability") and commit 443c6467fcd6 ("selftests/nolibc: always run
    nolibc header check") the usability of -include /path/to/nolibc.h is
    always checked anyways, making NOLIBC_SYSROOT=0 pointless.
    
    Drop the special logic.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Link: https://patch.msgid.link/20260104-nolibc-nolibc_sysroot-v1-1-98025ad99add@weissschuh.net

commit f3ed932644a671038b31f7f536a066eeef6803b0
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:58 2025 +0100

    selftests/nolibc: add static assertions around time types handling
    
    The nolibc system call wrappers expect the libc types to be compatible
    to the kernel types.
    
    Make sure these expectations hold at compile-time.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-14-c662992f75d7@weissschuh.net

commit 37219aa5b12326cd60f4586779c687f3394e80f5
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:57 2025 +0100

    tools/nolibc: add __nolibc_static_assert()
    
    Add a wrapper for _Static_assert() to use within nolibc.
    While _Static_assert() itself was only standardized in C11,
    in GCC and clang dialects it is also available in older standards.
    
    Link: https://lore.kernel.org/lkml/20251203192330.GA12995@1wt.eu/
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-13-c662992f75d7@weissschuh.net

commit dd6659efe0529e7177e9270a0fc044a0b17deb8a
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:56 2025 +0100

    tools/nolibc: add compiler version detection macros
    
    Some upcoming logic needs to depend on the version of GCC or clang.
    
    Add some helper macros to keep the conditionals readable.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-12-c662992f75d7@weissschuh.net

commit 6c9be90527207f9beca78e698dd45969813f4c0e
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:55 2025 +0100

    tools/nolibc: remove time conversions
    
    Now that 'struct timespec' and 'struct __kernel_timespec' are
    compatible, the conversions are not necessary anymore.
    The same holds true for 'struct itimerspec' and 'struct
    __kernel_itimerspec'.
    
    Remove the conversions.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-11-c662992f75d7@weissschuh.net

commit ca7206b6ad029d2c35e64f1ea81dba385496e630
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:54 2025 +0100

    selftests/nolibc: test compatibility of nolibc and kernel time types
    
    Keeping 'struct timespec' and 'struct __kernel_timespec' compatible
    allows the source code to stay simple.
    
    Validate that the types stay compatible.
    
    The test is specific to nolibc and does not compile on other libcs, so
    skip it there.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-10-c662992f75d7@weissschuh.net

commit d174174c6776a340f5c25aab1ac47a2dd950f380
Author: Joel Granados 
Date:   Thu Dec 4 13:11:58 2025 +0100

    sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions
    
    Remove SYSCTL_INT_CONV_CUSTOM and replace it with proc_int_conv. This
    converter function expects a negp argument as it can take on negative
    values. Update all jiffies converters to use explicit function calls.
    Remove SYSCTL_CONV_IDENTITY as it is no longer used.
    
    Signed-off-by: Joel Granados 

commit ef153851af5b05c23b3484e7eebaadd18f2da6a9
Author: Joel Granados 
Date:   Wed Dec 3 22:42:32 2025 +0100

    sysctl: Replace unidirectional INT converter macros with functions
    
    Replace SYSCTL_USER_TO_KERN_INT_CONV and SYSCTL_KERN_TO_USER_INT_CONV
    macros with function implementing the same logic.This makes debugging
    easier and aligns with the functions preference described in
    coding-style.rst. Update all jiffies converters to use explicit function
    implementations instead of macro-generated versions.
    
    Signed-off-by: Joel Granados 

commit 11aa4a18094f04a8ba7e403c272a9a5d85c9c9fc
Author: Costa Shulyupin 
Date:   Sun Oct 12 10:11:30 2025 +0300

    tools/rtla: Remove unused function declarations
    
    Historically four function declarations remain orphaned or duplicated.
    
    Remove them to keep the source clean.
    
    Signed-off-by: Costa Shulyupin 
    Link: https://lore.kernel.org/r/20251012071133.290225-1-costa.shul@redhat.com
    Signed-off-by: Tomas Glozar 

commit 7b0a51955b0eadacd44350b6f13bf21ba675aed9
Author: Kaushlendra Kumar 
Date:   Tue Dec 30 18:15:16 2025 +0530

    platform/x86/intel/uncore-freq: Replace sprintf() with sysfs_emit()
    
    Replace sprintf() with sysfs_emit() in sysfs show functions. The
    sysfs_emit() function is the preferred way to format sysfs output as
    it ensures proper buffer bounds checking and correct return values.
    
    Signed-off-by: Kaushlendra Kumar 
    Link: https://patch.msgid.link/20251230124516.229125-3-kaushlendra.kumar@intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 050a0aab15da9e1d14cd41073046d12d29f443c6
Author: Kaushlendra Kumar 
Date:   Tue Dec 30 18:15:15 2025 +0530

    platform/x86/intel/uncore-freq: Replace sprintf() with scnprintf()
    
    Replace unbounded sprintf() calls with scnprintf() to prevent potential
    buffer overflows when formatting device names. While the current format
    strings cannot overflow the buffer, using scnprintf() follows kernel
    best practices for string formatting.
    
    Signed-off-by: Kaushlendra Kumar 
    Link: https://patch.msgid.link/20251230124516.229125-2-kaushlendra.kumar@intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 2fe1ef40b58c2256f4682594f48bfbd584501ec5
Author: Martin Blumenstingl 
Date:   Mon Jan 5 21:47:10 2026 +0100

    clk: meson: gxbb: use the existing HHI_HDMI_PLL_CNTL3 macro
    
    There's no need to calculate HHI_HDMI_PLL_CNTL + 8 when we have a
    HHI_HDMI_PLL_CNTL3 macro that has the correct offset already. No
    functional changes, this makes it easier to compare the driver with the
    datasheets.
    
    Signed-off-by: Martin Blumenstingl 
    Link: https://lore.kernel.org/r/20260105204710.447779-4-martin.blumenstingl@googlemail.com
    Signed-off-by: Jerome Brunet 

commit 7aa6c24697ef5db1402dd38743914493cd5b356d
Author: Martin Blumenstingl 
Date:   Mon Jan 5 21:47:09 2026 +0100

    clk: meson: g12a: Limit the HDMI PLL OD to /4
    
    GXBB has the HDMI PLL OD in the HHI_HDMI_PLL_CNTL2 register while for
    G12A/G12B/SM1 the OD has moved to HHI_HDMI_PLL_CNTL0. At first glance
    the rest of the OD setup seems identical.
    
    However, looking at the downstream kernel sources as well as testing
    shows that G12A/G12B/SM1 only supports three OD values:
    - register value 0 means: divide by 1
    - register value 1 means: divide by 2
    - register value 2 means: divide by 4
    
    Downstream sources are also only using OD register values 0, 1 and 2
    for G12A/G12B/SM1 (while for GXBB the downstream kernel sources are also
    using value 3 which means: divide by 8).
    
    Add clk_div_table and have it replace the CLK_DIVIDER_POWER_OF_TWO flag
    to make the kernel's view of this register match with how the hardware
    actually works.
    
    Fixes: 085a4ea93d54 ("clk: meson: g12a: add peripheral clock controller")
    Signed-off-by: Martin Blumenstingl 
    Link: https://lore.kernel.org/r/20260105204710.447779-3-martin.blumenstingl@googlemail.com
    Signed-off-by: Jerome Brunet 

commit 5b1a43950fd3162af0ce52b13c14a2d29b179d4f
Author: Martin Blumenstingl 
Date:   Mon Jan 5 21:47:08 2026 +0100

    clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
    
    GXBB has the HDMI PLL OD in the HHI_HDMI_PLL_CNTL2 register while for
    GXL/GXM the OD has moved to HHI_HDMI_PLL_CNTL3. At first glance the rest
    of the OD setup seems identical.
    
    However, looking at the downstream kernel sources as well as testing
    shows that GXL only supports three OD values:
    - register value 0 means: divide by 1
    - register value 1 means: divide by 2
    - register value 2 means: divide by 4
    
    Using register value 3 (which on GXBB means: divide by 8) still divides
    by 4 as verified using meson-clk-measure. Downstream sources are also
    only using OD register values 0, 1 and 2 for GXL (while for GXBB the
    downstream kernel sources are also using value 3).
    
    Add clk_div_table and have it replace the CLK_DIVIDER_POWER_OF_TWO flag
    to make the kernel's view of this register match with how the hardware
    actually works.
    
    Fixes: 69d92293274b ("clk: meson: add the gxl hdmi pll")
    Signed-off-by: Martin Blumenstingl 
    Link: https://lore.kernel.org/r/20260105204710.447779-2-martin.blumenstingl@googlemail.com
    Signed-off-by: Jerome Brunet 

commit 751e2ebf29a74c0e46144cbb35e5be478bcd7668
Author: Benjamin Philip 
Date:   Thu Jan 1 19:46:57 2026 +0530

    platform/x86: yogabook: Clean up code style
    
    This commit cleans up the following checks flagged by checkpatch in
    yogabook.c:
    
    - CHECK: Prefer kernel type 'u8' over 'uint8_t'
    - CHECK: Comparison to NULL could be written "!data"
    - CHECK: line length of ... exceeds 100 columns
    
    Signed-off-by: Benjamin Philip 
    Reviewed-by: Hans de Goede 
    Reviewed-by: Mark Pearson 
    Link: https://patch.msgid.link/20260101141657.54258-1-benjamin.philip495@gmail.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 1716c1e0860b42980f338b69b974149d035582ca
Author: Thorsten Blum 
Date:   Mon Jan 5 15:50:46 2026 +0100

    platform/surface: Replace deprecated strcpy() in surface_button_add()
    
    strcpy() has been deprecated [1] because it performs no bounds checking
    on the destination buffer, which can lead to buffer overflows. Replace
    it with the safer strscpy().  No functional changes.
    
    Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1]
    Reviewed-by: Chen Yu 
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20260105145045.52764-2-thorsten.blum@linux.dev
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 4acd805157102eef1b98794450d2e599c7497542
Author: Rob Herring (Arm) 
Date:   Mon Jan 5 15:28:57 2026 -0600

    dt-bindings: soc: samsung: exynos-pmu: Drop unnecessary select schema
    
    The "select" schema is not necessary because "syscon" compatible is already
    excluded from the default select logic.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20260105212858.3454174-1-robh@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit ea180ffbd27ce5abf2a06329fe1fc8d20dc9becf
Author: Roman Gushchin 
Date:   Mon Jan 5 20:23:13 2026 -0800

    mm: drop mem_cgroup_usage() declaration from memcontrol.h
    
    mem_cgroup_usage() is not used outside of memcg-v1 code,
    the declaration was added by a mistake.
    
    Signed-off-by: Roman Gushchin 
    Link: https://lore.kernel.org/r/20260106042313.140256-1-roman.gushchin@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 1338e8ae4084e55c0359a79e617b2ae183d01579
Author: Mani Chandana Ballary Kuntumalla 
Date:   Tue Nov 25 16:26:20 2025 +0530

    drm/msm/dp: Update msm_dp_controller IDs for sa8775p
    
    The Qualcomm SA8775P platform comes with 2 DisplayPort controllers
    for each mdss. Update controller id for DPTX0 and DPTX1 of mdss1.
    
    Fixes: dcb380d19e58 ("drm/msm/dp: Add DisplayPort controller for SA8775P")
    Signed-off-by: Mani Chandana Ballary Kuntumalla 
    Reviewed-by: Dmitry Baryshkov 
    Patchwork: https://patchwork.freedesktop.org/patch/690234/
    Link: https://lore.kernel.org/r/20251125105622.1755651-2-quic_mkuntuma@quicinc.com
    Signed-off-by: Dmitry Baryshkov 

commit ed100aa239be6bd7d660873674224cc6f75b3f50
Author: Dale Whinham 
Date:   Thu Dec 18 00:19:32 2025 +0000

    drm/msm/dp: Enable support for eDP v1.4+ link rates table
    
    The MSM DRM driver currently does not support panels which report their
    supported link rates via the SUPPORTED_LINK_RATES table.
    
    For panels which do not offer the optional eDP v1.3 fallback via
    MAX_LINK_RATE, this will cause a panel probe failure (e.g. Samsung
    ATNA30DW01-1 as found in Microsoft Surface Pro 11).
    
    Detect eDP v1.4 panels and parse the SUPPORTED_LINK_RATES table when
    present.
    
    Additionally, set the rate using LINK_RATE_SET instead of LINK_BW_SET,
    but only if LINK_BW_SET hasn't already been written to.
    
    Signed-off-by: Dale Whinham 
    Tested-by: Jérôme de Bretagne 
    Tested-by: Steev Klimaszewski 
    Reviewed-by: Dmitry Baryshkov 
    Patchwork: https://patchwork.freedesktop.org/patch/695064/
    Link: https://lore.kernel.org/r/20251218-drm-msm-edp14-v2-1-2e56c2338ab1@gmail.com
    Signed-off-by: Dmitry Baryshkov 

commit 794b0e68caba49b950b42ec32e364028c2facf57
Author: Dmitry Baryshkov 
Date:   Tue Dec 30 09:17:57 2025 +0200

    drm/msm/dpu: fix WD timer handling on DPU 8.x
    
    Since DPU 8.x Watchdog timer settings were moved from the TOP to the
    INTF block. Support programming the timer in the INTF block. Fixes tag
    points to the commit which removed register access to those registers on
    DPU 8.x+ (and which also should have added proper support for WD timer
    on those devices).
    
    Fixes: 43e3293fc614 ("drm/msm/dpu: add support for MDP_TOP blackhole")
    Reviewed-by: Marijn Suijten 
    Signed-off-by: Dmitry Baryshkov 
    Patchwork: https://patchwork.freedesktop.org/patch/696586/
    Link: https://lore.kernel.org/r/20251230-intf-fix-wd-v6-2-98203d150611@oss.qualcomm.com

commit 1ad9880f059c9b0943e53714f9a59924cb035bbb
Author: Teguh Sobirin 
Date:   Tue Dec 30 09:17:56 2025 +0200

    drm/msm/dpu: Set vsync source irrespective of mdp top support
    
    Since DPU 5.x the vsync source TE setup is split between MDP TOP and
    INTF blocks. Currently all code to setup vsync_source is only executed
    if MDP TOP implements the setup_vsync_source() callback. However on
    DPU >= 8.x this callback is not implemented, making DPU driver skip all
    vsync setup. Move the INTF part out of this condition, letting DPU
    driver to setup TE vsync selection on all new DPU devices.
    
    Signed-off-by: Teguh Sobirin 
    Fixes: 2f69e5458447 ("drm/msm/dpu: skip watchdog timer programming through TOP on >= SM8450")
    [DB: restored top->ops.setup_vsync_source call]
    Reviewed-by: Marijn Suijten 
    Signed-off-by: Dmitry Baryshkov 
    Patchwork: https://patchwork.freedesktop.org/patch/696584/
    Link: https://lore.kernel.org/r/20251230-intf-fix-wd-v6-1-98203d150611@oss.qualcomm.com

commit 2892de3f4f985fa779c330468e2f341fdb762ccd
Author: Mahadevan P 
Date:   Thu Jan 1 10:34:38 2026 +0530

    drm/msm/disp/dpu: add merge3d support for sc7280
    
    On SC7280 targets, display modes with a width greater than the
    max_mixer_width (2400) are rejected during mode validation when
    merge3d is disabled. This limitation exists because, without a
    3D merge block, two layer mixers cannot be combined(non-DSC interface),
    preventing large layers from being split across mixers. As a result,
    higher resolution modes cannot be supported.
    
    Enable merge3d support on SC7280 to allow combining streams from
    two layer mixers into a single non-DSC interface. This capability
    removes the width restriction and enables buffer sizes beyond the
    2400-pixel limit.
    
    Fixes: 591e34a091d1 ("drm/msm/disp/dpu1: add support for display for SC7280 target")
    Signed-off-by: Mahadevan P 
    Reviewed-by: Dmitry Baryshkov 
    Patchwork: https://patchwork.freedesktop.org/patch/696713/
    Link: https://lore.kernel.org/r/20260101-4k-v2-1-712ae3c1f816@oss.qualcomm.com
    Signed-off-by: Dmitry Baryshkov 

commit f5aa414e5c78957d15758416c29dde743f3a1f93
Author: Ayushi Makhija 
Date:   Sun Jan 4 19:14:40 2026 +0530

    dt-bindings: display: msm: document DSI controller and phy on QCS8300
    
    Document DSI controller and phy on QCS8300 platform.
    
    Signed-off-by: Ayushi Makhija 
    Reviewed-by: Krzysztof Kozlowski 
    Patchwork: https://patchwork.freedesktop.org/patch/696787/
    Link: https://lore.kernel.org/r/20260104134442.732876-4-quic_amakhija@quicinc.com
    Signed-off-by: Dmitry Baryshkov 

commit c42973f92974949d31935e4408229522c77d8ad9
Author: Ayushi Makhija 
Date:   Sun Jan 4 19:14:39 2026 +0530

    dt-bindings: msm: dsi-controller-main: document the QCS8300 DSI CTRL
    
    QCS8300 MDSS DSI controller reuses the same IP as SA8775P, with
    identical register layout and programming model. Introduce a
    QCS8300-specific compatible with a fallback to
    `qcom,sa8775p-dsi-ctrl` to reflect this hardware reuse.
    
    Signed-off-by: Ayushi Makhija 
    Reviewed-by: Krzysztof Kozlowski 
    Patchwork: https://patchwork.freedesktop.org/patch/696784/
    Link: https://lore.kernel.org/r/20260104134442.732876-3-quic_amakhija@quicinc.com
    Signed-off-by: Dmitry Baryshkov 

commit 969c948d1392698402043c2a5b4875fba925d0cc
Author: Ayushi Makhija 
Date:   Sun Jan 4 19:14:38 2026 +0530

    dt-bindings: display: msm-dsi-phy-7nm: document the QCS8300 DSI PHY
    
    QCS8300 uses the same 5nm MDSS DSI PHY IP as SA8775P, sharing
    an identical register layout and programming model. Introduce a
    QCS8300-specific compatible with a fallback to `qcom,sa8775p-dsi-phy-5nm`
    to reflect this hardware reuse.
    
    Signed-off-by: Ayushi Makhija 
    Acked-by: Krzysztof Kozlowski 
    Patchwork: https://patchwork.freedesktop.org/patch/696783/
    Link: https://lore.kernel.org/r/20260104134442.732876-2-quic_amakhija@quicinc.com
    Signed-off-by: Dmitry Baryshkov 

commit 956f569c90ab507559342d289f4c923adfbf06f5
Merge: 32291cb0369aa5 5a69d30f30fd33
Author: Jakub Kicinski 
Date:   Mon Jan 5 16:32:40 2026 -0800

    Merge branch 'rust-net-replace-kernel-c_str-with-c-strings'
    
    Tamir Duberstein says:
    
    ====================
    rust: net: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    ====================
    
    Link: https://patch.msgid.link/20260103-cstr-net-v2-0-8688f504b85d@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 5a69d30f30fd339895b576ed1ceaba440d60efcb
Author: Tamir Duberstein 
Date:   Sat Jan 3 21:24:28 2026 -0500

    drivers: net: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Reviewed-by: FUJITA Tomonori 
    Reviewed-by: Daniel Almeida 
    Signed-off-by: Tamir Duberstein 
    Link: https://patch.msgid.link/20260103-cstr-net-v2-2-8688f504b85d@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 7a8461a2a8dad031050ec372d756826e9a40c050
Author: Tamir Duberstein 
Date:   Sat Jan 3 21:24:27 2026 -0500

    rust: net: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Reviewed-by: FUJITA Tomonori 
    Reviewed-by: Daniel Almeida 
    Signed-off-by: Tamir Duberstein 
    Link: https://patch.msgid.link/20260103-cstr-net-v2-1-8688f504b85d@gmail.com
    Signed-off-by: Jakub Kicinski 

commit 32291cb0369aa56946b3a0768a7d54f9490a83ce
Author: Alok Tiwari 
Date:   Sat Jan 3 09:43:10 2026 -0800

    net: marvell: prestera: correct return type of prestera_ldr_wait_buf()
    
    prestera_ldr_wait_buf() returns the result of readl_poll_timeout(),
    which is 0 on success or -ETIMEDOUT on failure. Its current return
    type is u32.
    
    Assigning this u32 value to an int variable works today because the
    bit pattern of (u32)-ETIMEDOUT (0xffffff92) is correctly interpreted
    as -ETIMEDOUT when stored in an int. However, keeping the function
    return type as u32 is misleading and fragile.
    
    Change the return type to int to reflect the actual semantic of
    returning negative error codes and to avoid potential issues with
    unsigned casts. There is no functional change.
    
    Signed-off-by: Alok Tiwari 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/20260103174313.1172197-1-alok.a.tiwari@oracle.com
    Signed-off-by: Jakub Kicinski 

commit 2e229771543b2b20e1fe29da00df80c917469449
Author: Aleksander Jan Bajkowski 
Date:   Fri Jan 2 12:30:06 2026 +0100

    net: phy: mediatek: enable interrupts on AN7581
    
    Interrupts work just like on MT7988.
    
    Suggested-by: Benjamin Larsson 
    Signed-off-by: Aleksander Jan Bajkowski 
    Reviewed-by: Andrew Lunn 
    Link: https://patch.msgid.link/20260102113222.3519900-1-olek2@wp.pl
    Signed-off-by: Jakub Kicinski 

commit 48a4aa9d9c393abf122454bc9050aac15de6d27f
Author: Clara Engler 
Date:   Thu Jan 1 13:51:14 2026 +0100

    ipv4: Improve martian logs
    
    At the current moment, the logs for martian packets are as follows:
    ```
    martian source {DST} from {SRC}, on dev {DEV}
    martian destination {DST} from {SRC}, dev {DEV}
    ```
    
    These messages feel rather hard to understand in production, especially
    the "martian source" one, mostly because it is grammatically ambitious
    to parse which part is now the source address and which part is the
    destination address.  For example, "{DST}" may there be interpreted as
    the actual source address due to following the word "source", thereby
    implying the actual source address to be the destination one.
    
    Personally, I discovered this bug while toying around with TUN
    interfaces and using them as a tunnel (receiving packets via a TUN
    interface and sending them over a TCP stream; receiving packets from a
    TCP stream and writing them to a TUN).[^1]
    
    When these IP addresses contained local IPs (i.e. 10.0.0.0/8 in source
    and destination), everything worked fine.  However, sending them to a
    real routable IP address on the internet led to them being treated as a
    martian packet, obviously.  Using a few sysctl(8) and iptables(8)
    settings[^2] fixed it, but while debugging I found the log message
    starting with "martian source" rather confusing, as I was unsure on
    whether the packet that gets dropped was the packet originating from me
    or the response from the endpoint, as "martian source "
    could also be falsely interpreted as the response packet being martian,
    due to the word "source" followed by the routable IP address, implying
    the source address of that packet is set to this IP, as explained above.
    In the end, I had to look into the source code of the kernel on where
    this error message gets generated, which is usually an indicator of
    there being room for improvement with regard to this error message.
    
    In terms of improvement, this commit changes the error messages for
    martian source and martian destination packets as follows:
    ```
    martian source (src={SRC}, dst={DST}, dev={DEV})
    martian destination (src={SRC}, dst={DST}, dev={DEV})
    ```
    
    These new wordings leave pretty much no room for ambiguity as all
    parameters are prefixed with a respective key explaining their semantic
    meaning.
    
    See also the following thread on LKML.[^3]
    
    [^1]: 
    [^2]: sysctl net.ipv4.ip_forward=1 && \
          iptables -A INPUT -i tun0 -j ACCEPT && \
          iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    [^3]: 
    
    Signed-off-by: Clara Engler 
    Reviewed-by: David Ahern 
    Link: https://patch.msgid.link/20260101125114.2608-1-cve@cve.cx
    Signed-off-by: Jakub Kicinski 

commit 48ed70131e4f3057f819c848d92fe84ba696e2a9
Author: Gabriel Krisman Bertazi 
Date:   Mon Jan 5 18:09:32 2026 -0500

    io_uring: Trim out unused includes
    
    Clean up some left overs of refactoring io_uring into multiple files.
    Compile tested with a few configurations.
    
    Signed-off-by: Gabriel Krisman Bertazi 
    Signed-off-by: Jens Axboe 

commit 5ce3218d4f102aca5e90d3c831259b6e380f88b4
Author: Vincent Mailhol 
Date:   Sat Dec 20 12:02:21 2025 +0100

    overflow: Remove is_non_negative() and is_negative()
    
    The is_non_negative() and is_negative() function-like macros just
    exist as a workaround to silence the -Wtype-limits warning. Now that
    this warning is disabled, those two macros have lost their raison
    d'être. Remove them.
    
    This reverts commit dc7fe518b049 ("overflow: Fix -Wtype-limits
    compilation warnings").
    
    Suggested-by: Nicolas Schier 
    Link: https://lore.kernel.org/all/aUT_yWin_xslnOFh@derry.ads.avm.de
    Signed-off-by: Vincent Mailhol 
    Reviewed-by: Nicolas Schier 
    Link: https://patch.msgid.link/20251220-remove_wtype-limits-v3-3-24b170af700e@kernel.org
    Signed-off-by: Nathan Chancellor 

commit 34a1bd0b6b2c03206f3ca629eafd2cad95fd6b22
Author: Vincent Mailhol 
Date:   Sat Dec 20 12:02:20 2025 +0100

    kbuild: cleanup local -Wno-type-limits exceptions
    
    Now that -Wtype-limits is globally deactivated, there is no need for
    local exceptions anymore.
    
    Acked-by: David Sterba 
    Signed-off-by: Vincent Mailhol 
    Reviewed-by: Nicolas Schier 
    Link: https://patch.msgid.link/20251220-remove_wtype-limits-v3-2-24b170af700e@kernel.org
    Signed-off-by: Nathan Chancellor 

commit 660e899103e29aabcc05447ab20684811ea86107
Author: Vincent Mailhol 
Date:   Sat Dec 20 12:02:19 2025 +0100

    kbuild: remove gcc's -Wtype-limits
    
    W=2 builds are heavily polluted by the -Wtype-limits warning.
    
    Here are some W=12 statistics on Linux v6.19-rc1 for an x86_64
    defconfig (with just CONFIG_WERROR set to "n") using gcc 14.3.1:
    
             Warning name                   count   percent
            -------------------------------------------------
             -Wlogical-op                       2     0.00 %
             -Wmaybe-uninitialized            138     0.20 %
             -Wunused-macros                  869     1.24 %
             -Wmissing-field-initializers    1418     2.02 %
             -Wshadow                        2234     3.19 %
             -Wtype-limits                  65378    93.35 %
            -------------------------------------------------
             Total                          70039   100.00 %
    
    As we can see, -Wtype-limits represents the vast majority of all
    warnings. The reason behind this is that these warnings appear in
    some common header files, meaning that some unique warnings are
    repeated tens of thousands of times (once per header inclusion).
    
    Add to this the fact that each warning is coupled with a dozen lines
    detailing some macro expansion. The end result is that the W=2 output
    is just too bloated and painful to use.
    
    Three years ago, I proposed in [1] modifying one such header to
    silence that noise. Because the code was not faulty, Linus rejected
    the idea and instead suggested simply removing that warning.
    
    At that time, I could not bring myself to send such a patch because,
    despite its problems, -Wtype-limits would still catch the below bug:
    
            unsigned int ret;
    
            ret = check();
            if (ret < 0)
                    error();
    
    Meanwhile, based on another suggestion from Linus, I added a new check
    to sparse [2] that would catch the above bug without the useless spam.
    
    With this, remove gcc's -Wtype-limits. People who still want to catch
    incorrect comparisons between unsigned integers and zero can now use
    sparse instead.
    
    On a side note, clang also has a -Wtype-limits warning but:
    
      * it is not enabled in the kernel at the moment because, contrary to
        gcc, clang did not include it under -Wextra.
    
      * it does not warn if the code results from a macro expansion. So,
        if activated, it would not cause as much spam as gcc does.
    
      * -Wtype-limits is split into four sub-warnings [3] meaning that if
        it were to be activated, we could select which one to keep.
    
    So there is no present need to explicitly disable -Wtype-limits in
    clang.
    
    [1] linux/bits.h: GENMASK_INPUT_CHECK: reduce W=2 noise by 31% treewide
    Link: https://lore.kernel.org/all/20220308141201.2343757-1-mailhol.vincent@wanadoo.fr/
    
    [2] Warn about "unsigned value that used to be signed against zero"
    Link: https://lore.kernel.org/all/20250921061337.3047616-1-mailhol@kernel.org/
    
    [3] clang's -Wtype-limits
    Link: https://clang.llvm.org/docs/DiagnosticsReference.html#wtype-limits
    
    Reviewed-by: Nicolas Schier 
    Signed-off-by: Vincent Mailhol 
    Link: https://patch.msgid.link/20251220-remove_wtype-limits-v3-1-24b170af700e@kernel.org
    Signed-off-by: Nathan Chancellor 

commit 4d982084507d663df160546c4c48066a8887ed89
Author: Brian Norris 
Date:   Fri Oct 3 15:40:09 2025 -0700

    PCI/PM: Avoid redundant delays on D3hot->D3cold
    
    When transitioning to D3cold, __pci_set_power_state() first transitions to
    D3hot. If the device was already in D3hot, this adds excess work:
    
      (a) read/modify/write PMCSR; and
      (b) excess delay (pci_dev_d3_sleep()).
    
    For (b), we already performed the necessary delay on the previous D3hot
    entry; this was extra noticeable when evaluating runtime PM transition
    latency.
    
    Check whether we're already in the target state before continuing.
    
    Note that __pci_set_power_state() already does this same check for other
    state transitions, but D3cold is special because __pci_set_power_state()
    converts it to D3hot for the purposes of PMCSR.
    
    This seems to be an oversight in commit 0aacdc957401 ("PCI/PM: Clean up
    pci_set_low_power_state()").
    
    Fixes: 0aacdc957401 ("PCI/PM: Clean up pci_set_low_power_state()")
    Signed-off-by: Brian Norris 
    Signed-off-by: Brian Norris 
    [bhelgaas: reverse test to match other "dev->current_state == state" cases]
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20251003154008.1.I7a21c240b30062c66471329567a96dceb6274358@changeid

commit ab150c2bbafe9425759eca1e45e08d4ad1456818
Author: Thomas Weißschuh 
Date:   Fri Jan 2 08:20:39 2026 +0100

    kunit: qemu_configs: Add 32-bit big endian ARM configuration
    
    Add a basic config to run kunit tests on 32-bit big endian ARM.
    
    Link: https://lore.kernel.org/r/20260102-kunit-armeb-v1-1-e8e5475d735c@linutronix.de
    Signed-off-by: Thomas Weißschuh 
    Reviewed-by: David Gow 
    Signed-off-by: Shuah Khan 

commit 85aff81b0dba7c42d226d9f7c11c4d30a7906878
Author: Thomas Weißschuh 
Date:   Tue Dec 30 13:26:36 2025 +0100

    kunit: tool: Don't overwrite test status based on subtest counts
    
    If a subtest itself reports success, but the outer testcase fails,
    the whole testcase should be reported as a failure. However the status
    is recalculated based on the test counts, overwriting the outer test
    result. Synthesize a failed test in this case to make sure the failure
    is not swallowed.
    
    Link: https://lore.kernel.org/r/20251230-kunit-nested-failure-v1-2-98cfbeb87823@linutronix.de
    Signed-off-by: Thomas Weißschuh 
    Reviewed-by: David Gow 
    Signed-off-by: Shuah Khan 

commit 0c5b86c67fb6898d02c8f92de884186297fd302f
Author: Thomas Weißschuh 
Date:   Tue Dec 30 13:26:35 2025 +0100

    kunit: tool: Add test for nested test result reporting
    
    Currently there is a lack of tests validating the result reporting from
    nested tests. Add one, it will also be used to validate upcoming changes
    to the nested test parsing.
    
    Link: https://lore.kernel.org/r/20251230-kunit-nested-failure-v1-1-98cfbeb87823@linutronix.de
    Signed-off-by: Thomas Weißschuh 
    Reviewed-by: Rae Moar 
    Reviewed-by: David Gow 
    Signed-off-by: Shuah Khan 

commit 5c7a4741431b0a938dcbd22b90a4dc9a2903fc00
Author: Ryota Sakamoto 
Date:   Tue Jan 6 01:41:01 2026 +0900

    kunit: respect KBUILD_OUTPUT env variable by default
    
    Currently, kunit.py ignores the KBUILD_OUTPUT env variable and always
    defaults to .kunit in the working directory. This behavior is inconsistent
    with standard Kbuild behavior, where KBUILD_OUTPUT defines the build
    artifact location.
    
    This patch modifies kunit.py to respect KBUILD_OUTPUT if set.  A .kunit
    subdirectory is created inside KBUILD_OUTPUT to avoid polluting the build
    directory.
    
    Link: https://lore.kernel.org/r/20260106-kunit-kbuild_output-v2-1-582281797343@gmail.com
    Reviewed-by: David Gow 
    Signed-off-by: Ryota Sakamoto 
    Signed-off-by: Shuah Khan 

commit a7a81655dc90688f9ddff1c0b185d7a6fa8bfc7d
Author: Richard Fitzgerald 
Date:   Fri Dec 19 16:12:12 2025 +0000

    kunit: Protect KUNIT_BINARY_STR_ASSERTION against ERR_PTR values
    
    Replace the NULL checks with IS_ERR_OR_NULL() in
    KUNIT_BINARY_STR_ASSERTION() to prevent the strcmp() faulting if a
    passed pointer is an ERR_PTR.
    
    Commit 7ece381aa72d4 ("kunit: Protect string comparisons against NULL")
    added the checks for NULL on both pointers so that asserts would fail,
    instead of faulting, if either pointer is NULL. But either pointer
    could hold an ERR_PTR value.
    
    This assumes that the assertion is expecting both strings to be valid,
    and is asserting the equality of their _content_.
    
    Link: https://lore.kernel.org/r/20251219161212.1648076-1-rf@opensource.cirrus.com
    Signed-off-by: Richard Fitzgerald 
    Reviewed-by: David Gow 
    Signed-off-by: Shuah Khan 

commit 90b5f2dce9d919a4e37abf29598d23c7f20108ba
Author: Greg Kroah-Hartman 
Date:   Wed Dec 17 13:36:52 2025 +0100

    test_list_sort: fix up const mismatch
    
    In the internal cmp function, a const pointer is cast out to a non-const
    pointer by using container_of().  This is probably not what is intended
    at all, so fix up the const marking to properly preserve what is really
    happening (i.e. the const should flow through the container_of() call)
    
    Cc: Jakub Kicinski 
    Cc: David Gow 
    Cc: "Masami Hiramatsu (Google)" 
    Cc: Vlastimil Babka 
    Cc: Kees Cook 
    Cc: linux-kernel@vger.kernel.org
    
    Link: https://lore.kernel.org/all/2025121751-backtrack-manifesto-7c57@gregkh/#r
    Signed-off-by: Greg Kroah-Hartman 
    Reviewed-by: David Gow 
    Signed-off-by: Shuah Khan 

commit e70a307b852804b2a7aaaafdd37542ca11e6eb00
Author: Greg Kroah-Hartman 
Date:   Wed Dec 17 13:32:47 2025 +0100

    kunit: fix up const mis-match in many assert functions
    
    In many kunit assert functions a const pointer is passed to
    container_of() and out pops a non-const pointer, which really isn't the
    correct thing to do at all.  Fix this up by correctly marking the
    casted-to pointer as const to preserve the marking.
    
    Cc: Brendan Higgins 
    Cc: David Gow 
    Cc: Rae Moar 
    Cc: linux-kselftest@vger.kernel.org
    Cc: kunit-dev@googlegroups.com
    
    Link: https://lore.kernel.org/r/2025121746-result-staleness-5a68@gregkh
    Signed-off-by: Greg Kroah-Hartman 
    Reviewed-by: David Gow 
    Signed-off-by: Shuah Khan 

commit 567b3d3af647fe1e9b9fb306c70850c7066130a8
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:46 2025 +0000

    rust: kunit: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Link: https://lore.kernel.org/r/20251202-define-rust-helper-v1-22-a2e13cbc17a6@google.com
    Signed-off-by: Alice Ryhl 
    Reviewed-by: David Gow 
    Signed-off-by: Shuah Khan 

commit e25834d7691f0661fa9700c167c48d18752f62bf
Author: Luca Weiss 
Date:   Wed Dec 10 10:43:33 2025 +0900

    arm64: dts: qcom: Add The Fairphone (Gen. 6)
    
    Add a devicetree for The Fairphone (Gen. 6) smartphone, which is based
    on the Milos/SM7635 SoC.
    
    Supported functionality as of this initial submission:
    * Debug UART
    * Regulators (PM7550, PM8550VS, PMR735B, PM8008)
    * Remoteprocs (ADSP, CDSP, MPSS, WPSS)
    * Power Button, Volume Keys, Switch
    * PMIC-GLINK (Charger, Fuel gauge, USB-C mode switching)
    * Camera flash/torch LED
    * SD card
    * USB
    
    Signed-off-by: Luca Weiss 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251210-sm7635-fp6-initial-v4-9-b05fddd8b45c@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit d9d59d105f98665187d90a49d9099675491990f6
Author: Luca Weiss 
Date:   Wed Dec 10 10:43:32 2025 +0900

    arm64: dts: qcom: Add initial Milos dtsi
    
    Add a devicetree description for the Milos SoC, which is for example
    Snapdragon 7s Gen 3 (SM7635).
    
    Signed-off-by: Luca Weiss 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251210-sm7635-fp6-initial-v4-8-b05fddd8b45c@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit 8f42f255dfb80e57af98191e7a4e18f7d1cdcb7e
Author: Luca Weiss 
Date:   Wed Dec 10 10:43:31 2025 +0900

    arm64: dts: qcom: Add PMIV0104 PMIC
    
    Add a dts for the PMIC used e.g. on devices with the Milos SoC.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Luca Weiss 
    Link: https://lore.kernel.org/r/20251210-sm7635-fp6-initial-v4-7-b05fddd8b45c@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit 57e89dfdfa28810f8c1a44bdd301fca287ff83d1
Author: Luca Weiss 
Date:   Wed Dec 10 10:43:30 2025 +0900

    arm64: dts: qcom: Add PM7550 PMIC
    
    Add a dts for the PMIC used e.g. with Milos SoC-based devices.
    
    Signed-off-by: Luca Weiss 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251210-sm7635-fp6-initial-v4-6-b05fddd8b45c@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit 446f4802aa6eb972718b8708188df533b38dbabe
Author: Luca Weiss 
Date:   Wed Dec 10 10:43:29 2025 +0900

    arm64: dts: qcom: pm8550vs: Disable different PMIC SIDs by default
    
    Keep the different PMIC definitions in pm8550vs.dtsi disabled by
    default, and only enable them in boards explicitly.
    
    This allows to support boards better which only have pm8550vs_c, like
    the Milos/SM7635-based Fairphone (Gen. 6).
    
    Note: I assume that at least some of these devices with PM8550VS also
    don't have _c, _d, _e and _g, but this patch is keeping the resulting
    devicetree the same as before this change, disabling them on boards that
    don't actually have those is out of scope for this patch.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Luca Weiss 
    Link: https://lore.kernel.org/r/20251210-sm7635-fp6-initial-v4-5-b05fddd8b45c@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit d88771fda13f2e97a056d471b7b7c11bd17da148
Author: Luca Weiss 
Date:   Wed Dec 10 10:43:28 2025 +0900

    dt-bindings: arm: qcom: Add Milos and The Fairphone (Gen. 6)
    
    Document the Milos-based The Fairphone (Gen. 6) smartphone.
    
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Luca Weiss 
    Link: https://lore.kernel.org/r/20251210-sm7635-fp6-initial-v4-4-b05fddd8b45c@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit 42f2799124a4d0081b0c8c50980e37769e8d6880
Author: Luca Weiss 
Date:   Wed Dec 10 10:43:27 2025 +0900

    dt-bindings: qcom,pdc: document the Milos Power Domain Controller
    
    Document the Power Domain Controller on the Milos SoC.
    
    Acked-by: Rob Herring (Arm) 
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Luca Weiss 
    Link: https://lore.kernel.org/r/20251210-sm7635-fp6-initial-v4-3-b05fddd8b45c@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit f50da52e5b2ed73913cc6d0db7c81cd33ced3ae7
Author: Luca Weiss 
Date:   Wed Dec 10 10:43:26 2025 +0900

    dt-bindings: crypto: qcom,prng: document Milos
    
    Document Milos SoC compatible for the True Random Number Generator.
    
    Acked-by: Rob Herring (Arm) 
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Luca Weiss 
    Link: https://lore.kernel.org/r/20251210-sm7635-fp6-initial-v4-2-b05fddd8b45c@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit 5e213a985d103ecd348ed4e9ae71292d86be9a71
Author: Tom St Denis 
Date:   Tue Dec 2 10:05:51 2025 -0500

    drm/amd/amdgpu: Port over some missing registers and bits from GC 10.1 to 10.3 (v2)
    
    v2: Added SPI bits to sh_mask header
    
    Signed-off-by: Tom St Denis 
    Acked-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit b1adfce26ed316cfc2f892615a7fbf4cf0f302ae
Author: Lijo Lazar 
Date:   Tue Dec 2 12:37:32 2025 +0530

    drm/amd/pm: Add smu driver table structure
    
    For interfaces like gpu metrics, driver returns a formatted structure
    based on IP version. Add a separate data structure for such tables which
    also tracks the cache intervals.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit 14b6a73ce1a33e20d6e526415c0af34a9e01f64a
Author: Yang Wang 
Date:   Thu Dec 11 12:46:52 2025 +0800

    drm/amd/pm: fix pp_dpm_pcie wrong state issue for smu v13.0.0
    
    put wrong value into incorrect data into following function,
    which caused it to fail to match the correct item on smu v13.0.0:
    smu_cmn_print_pcie_levels()
    
    Fixes: a95f01edd80b ("drm/amd/pm: Use common helper for smuv13.0.0 dpm")
    Signed-off-by: Yang Wang 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 137a9127759fb6a6c526dece90fa78222c1164d6
Author: Yang Wang 
Date:   Thu Dec 11 12:49:35 2025 +0800

    drm/amd/pm: fix pp_dpm_pcie wrong state issue for smu v13.0.7
    
    put wrong value into incorrect data into following function,
    which caused it to fail to match the correct item on smu v13.0.7:
    smu_cmn_print_pcie_levels()
    
    Fixes: b2debbbb60f1 ("drm/amd/pm: Use common helper for smuv13.0.7 dpm")
    Signed-off-by: Yang Wang 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit c01b52830fdc8e907e9f8462d5d7d798b7ed19dc
Author: Yang Wang 
Date:   Wed Dec 10 20:33:43 2025 +0800

    drm/amd/pm: fix pp_dpm_pcie wrong state issue for smu v14.0.2
    
    put wrong value into incorrect data into following function,
    which caused it to fail to match the correct item on smu v14.0.2:
    smu_cmn_print_pcie_levels()
    
    Fixes: 03d11f8564ca ("drm/amd/pm: Use common helper for smuv14.0.2 dpm")
    Signed-off-by: Yang Wang 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit deacae541a7210c675f1013ed5a276886b2f48d6
Author: Yang Wang 
Date:   Wed Dec 10 20:27:42 2025 +0800

    drm/amd/pm: add smu pcie dpm cap & width convert helper
    
    define following heler to convert pmfw pcie dpm index to smu index.
    - SMU_DPM_PCIE_GEN_IDX(gen)
    - SMU_DPM_PCIE_WIDTH_IDX(width)
    
    Signed-off-by: Yang Wang 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 95b36732fec4a954a107bb07aa4bff8793762938
Author: Julia Lawall 
Date:   Tue Dec 30 17:17:17 2025 +0100

    drm/amdkfd: update outdated comment
    
    The function acquire_packet_buffer() was renamed
    kq_acquire_packet_buffer() by commit a5a4d68c9326 ("drm/amdkfd:
    Eliminate unnecessary kernel queue function pointers").  Update
    the comment accordingly.
    
    Signed-off-by: Julia Lawall 
    Signed-off-by: Felix Kuehling 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit e9009c8b7401d5def4cef9c85200ae25dcb38a5b
Author: Julia Lawall 
Date:   Tue Dec 30 18:53:53 2025 +0100

    drm/amdgpu: update outdated comment
    
    The function amdgpu_amdkfd_gpuvm_import_dmabuf() was split into
    import_obj_create() and amdgpu_amdkfd_gpuvm_import_dmabuf_fd() in
    commit 0188006d7c79 ("drm/amdkfd: Import DMABufs for interop
    through DRM").  import_obj_create() now does the allocation for
    the mem variable discussed in the comment.
    
    Signed-off-by: Julia Lawall 
    Signed-off-by: Felix Kuehling 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 7edb503fe4b6d67f47d8bb0dfafb8e699bb0f8a4
Author: Perry Yuan 
Date:   Thu Dec 25 16:43:49 2025 +0800

    drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
    
    During Mode 1 reset, the ASIC undergoes a reset cycle and becomes
    temporarily inaccessible via PCIe. Any attempt to access MMIO registers
    during this window (e.g., from interrupt handlers or other driver threads)
    can result in uncompleted PCIe transactions, leading to NMI panics or
    system hangs.
    
    To prevent this, set the `no_hw_access` flag to true immediately after
    triggering the reset. This signals other driver components to skip
    register accesses while the device is offline.
    
    A memory barrier `smp_mb()` is added to ensure the flag update is
    globally visible to all cores before the driver enters the sleep/wait
    state.
    
    Signed-off-by: Perry Yuan 
    Reviewed-by: Yifan Zhang 
    Signed-off-by: Alex Deucher 

commit bd8150a1b3370a9f7761c5814202a3fe5a79f44f
Author: Srinivasan Shanmugam 
Date:   Thu Dec 11 21:25:20 2025 +0530

    drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
    
    This commit simplifies the amdgpu_gem_va_ioctl function, key updates
    include:
     - Moved the logic for managing the last update fence directly into
       amdgpu_gem_va_update_vm.
     - Introduced checks for the timeline point to enable conditional
       replacement or addition of fences.
    
    v2: Addressed review comments from Christian.
    v3: Updated comments (Christian).
    v4: The previous version selected the fence too early and did not manage its
        reference correctly, which could lead to stale or freed fences being used.
        This resulted in refcount underflows and could crash when updating GPU
        timelines.
        The fence is now chosen only after the VA mapping work is completed, and its
        reference is taken safely. After exporting it to the VM timeline syncobj, the
        driver always drops its local fence reference, ensuring balanced refcounting
        and avoiding use-after-free on dma_fence.
    
            Crash signature:
            [  205.828135] refcount_t: underflow; use-after-free.
            [  205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
            ...
            [  206.074014] Call Trace:
            [  206.076488]  
            [  206.078608]  amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu]
            [  206.084040]  ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]
            [  206.089994]  drm_ioctl_kernel+0x86/0xe0 [drm]
            [  206.094415]  drm_ioctl+0x26e/0x520 [drm]
            [  206.098424]  ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]
            [  206.104402]  amdgpu_drm_ioctl+0x4b/0x80 [amdgpu]
            [  206.109387]  __x64_sys_ioctl+0x96/0xe0
            [  206.113156]  do_syscall_64+0x66/0x2d0
            ...
            [  206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90
            ...
            [  206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0
            ...
            [  206.553405] Call Trace:
            [  206.553409]  
            [  206.553415]  ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched]
            [  206.553424]  dma_fence_signal+0x30/0x60
            [  206.553427]  drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched]
            [  206.553434]  dma_fence_signal_timestamp_locked+0x6e/0xe0
            [  206.553437]  dma_fence_signal+0x30/0x60
            [  206.553441]  amdgpu_fence_process+0xd8/0x150 [amdgpu]
            [  206.553854]  sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu]
            [  206.554353]  edac_mce_amd(E) ee1004(E)
            [  206.554270]  amdgpu_irq_dispatch+0x150/0x230 [amdgpu]
            [  206.554702]  amdgpu_ih_process+0x6a/0x180 [amdgpu]
            [  206.555101]  amdgpu_irq_handler+0x23/0x60 [amdgpu]
            [  206.555500]  __handle_irq_event_percpu+0x4a/0x1c0
            [  206.555506]  handle_irq_event+0x38/0x80
            [  206.555509]  handle_edge_irq+0x92/0x1e0
            [  206.555513]  __common_interrupt+0x3e/0xb0
            [  206.555519]  common_interrupt+0x80/0xa0
            [  206.555525]  
            [  206.555527]  
            ...
            [  206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0
            ...
            [  206.555667] Kernel panic - not syncing: Fatal exception in interrupt
    
    Link: https://patchwork.freedesktop.org/patch/654669/
    Cc: Alex Deucher 
    Cc: Christian König 
    Suggested-by: Christian König 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit f9f281e839b7518109a4b7efa8dbee425bd8bfad
Author: Gangliang Xie 
Date:   Mon Dec 22 16:48:22 2025 +0800

    drm/amdgpu: only check critical address when it is not reserved
    
    when an address is reserved already, no need to check if it is
    in critical or not, to save time
    
    Signed-off-by: Gangliang Xie 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit a6ea0a430aca5932b9c75d8e38deeb45665dd2ae
Author: Alan Liu 
Date:   Mon Dec 22 12:26:35 2025 +0800

    drm/amdgpu: Fix query for VPE block_type and ip_count
    
    [Why]
    Query for VPE block_type and ip_count is missing.
    
    [How]
    Add VPE case in ip_block_type and hw_ip_count query.
    
    Reviewed-by: Lang Yu 
    Signed-off-by: Alan Liu 
    Signed-off-by: Alex Deucher 

commit 0099f2e92cacff128722c1c66173c3b4962e9b78
Author: Jinzhou Su 
Date:   Tue Dec 23 13:45:16 2025 +0800

    drm/amd/ras: Replace NPS flags in ras module
    
    Replace AMDGPU_NPS8_PARTITION_MODE with
    UMC_MEMORY_PARTITION_MODE_NPS8 to pass sriov
    compilation.
    
    Signed-off-by: Jinzhou Su 
    Reviewed-by: YiPeng Chai 
    Signed-off-by: Alex Deucher 

commit 0d89268d20c961b6226a4aa948fdbe9f93021d95
Author: Timur Kristóf 
Date:   Sat Dec 6 03:31:06 2025 +0100

    drm/amd/display: Don't repeat DAC load detection
    
    The analog link detection code path had already performed the
    DAC load detection by the time the EDID read is attempted.
    So there is no need to repeat the DAC load detection,
    we can know that no display is connected if no EDID is read.
    
    Fixes: ac1bb4952267 ("drm/amd/display: Use DAC load detection on analog connectors (v2)")
    Suggested-by: Alex Hung 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit bb5dfe2f5630ce344c654c705d28b4e20cb9d334
Author: Timur Kristóf 
Date:   Sat Dec 6 03:31:04 2025 +0100

    drm/amd/display: Add missing encoder setup to DACnEncoderControl
    
    Apparently the DAC encoder needs to be set up before use.
    The BIOS parser in DC did not support this so I assumed it was
    not necessary, but the DAC doesn't work without it on some GPUs.
    
    Fixes: 69b29b894660 ("drm/amd/display: Hook up DAC to bios_parser_encoder_control")
    Reviewed-by: Alex Deucher 
    Signed-off-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit cdf6e4c0cdab129ffc4e41a8ac53a0738f805072
Author: Timur Kristóf 
Date:   Sat Dec 6 03:31:03 2025 +0100

    drm/amd/display: Correct color depth for SelectCRTC_Source
    
    Pass the correct enum values as expected by the VBIOS.
    Previously the actual bit depth integer value was passed,
    which was a mistake.
    
    Fixes: 7fb4f254c8eb ("drm/amd/display: Add SelectCRTC_Source to BIOS parser")
    Reviewed-by: Alex Deucher 
    Signed-off-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit 436d0d22aa7035a9f9b24fb14cd0e84d6571ea87
Author: Timur Kristóf 
Date:   Sat Dec 6 03:31:02 2025 +0100

    drm/amd/display: Pass proper DAC encoder ID to VBIOS
    
    Similarly to the analog_engine field, add a new analog_id field
    which contains the encoder ID of the analog encoder that
    corresponds to the link encoder.
    
    Previously, the default encoder ID of the link encoder was used,
    which meant that we passed the wrong ID in case of DVI-I.
    
    Fixes: 5834c33fd3f6 ("drm/amd/display: Add concept of analog encoders (v2)")
    Reviewed-by: Alex Deucher 
    Signed-off-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit 5ab75f98fb6314709a2eae5f8c8450276c94425f
Author: Alex Deucher 
Date:   Wed Aug 20 10:07:38 2025 -0400

    drm/amdgpu/gfx9: Implement KGQ ring reset
    
    GFX ring resets work differently on pre-GFX10 hardware since
    there is no MQD managed by the scheduler.
    For ring reset, you need issue the reset via CP_VMID_RESET
    via KIQ or MMIO and submit the following to the gfx ring to
    complete the reset:
    1. EOP packet with EXEC bit set
    2. WAIT_REG_MEM to wait for the fence
    3. Clear CP_VMID_RESET to 0
    4. EVENT_WRITE ENABLE_LEGACY_PIPELINE
    5. EOP packet with EXEC bit set
    6. WAIT_REG_MEM to wait for the fence
    Once those commands have completed the reset should
    be complete and the ring can accept new packets.
    
    Reviewed-by: Timur Kristóf 
    Tested-by: Jiqian Chen  (v1)
    Signed-off-by: Alex Deucher 

commit 9596097be4bac5297acbbdb5f7c4ff2f4e42502e
Author: Alex Deucher 
Date:   Thu Dec 18 15:04:33 2025 -0500

    drm/amdgpu/gfx9: rework pipeline sync packet sequence
    
    Replace WAIT_REG_MEM with EVENT_WRITE flushes for all
    shader types and ACQUIRE_MEM.  That should accomplish
    the same thing and avoid having to wait on a fence
    preventing any issues with pipeline syncs during
    queue resets.
    
    Reviewed-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74
Author: Alex Deucher 
Date:   Fri Dec 12 11:46:48 2025 -0500

    drm/amdgpu: avoid a warning in timedout job handler
    
    Only set an error on the fence if the fence is not
    signalled.  We can end up with a warning if the
    per queue reset path signals the fence and sets an error
    as part of the reset, but fails to recover.
    
    Reviewed-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit 0288a345f19b2162546352161509bb24614729e1
Author: Pratap Nirujogi 
Date:   Tue Dec 9 20:22:15 2025 -0500

    drm/amd/amdgpu: Fix SMU warning during isp suspend-resume
    
    ISP mfd child devices are using genpd and the system suspend-resume
    operations between genpd and amdgpu parent device which uses only
    runtime suspend-resume are not in sync.
    
    Linux power manager during suspend-resume resuming the genpd devices
    earlier than the amdgpu parent device. This is resulting in the below
    warning as SMU is in suspended state when genpd attempts to resume ISP.
    
    WARNING: CPU: 13 PID: 5435 at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/amdgpu_smu.c:398 smu_dpm_set_power_gate+0x36f/0x380 [amdgpu]
    
    To fix this warning isp suspend-resume is handled as part of amdgpu
    parent device suspend-resume instead of genpd sequence. Each ISP MFD
    child device is marked as dev_pm_syscore_device to skip genpd
    suspend-resume and use pm_runtime_force api's to suspend-resume
    the devices when callbacks from amdgpu are received.
    
    Co-developed-by: Gjorgji Rosikopulos 
    Signed-off-by: Gjorgji Rosikopulos 
    Signed-off-by: Bin Du 
    Signed-off-by: Pratap Nirujogi 
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Alex Deucher 

commit c29935e4092c61f57c204e7d61eebb91b0a2fad5
Author: Taimur Hassan 
Date:   Fri Dec 12 21:32:55 2025 -0500

    drm/amd/display: Promote DC to 3.2.364
    
    This version brings along the following updates:
    
     - Add frame skip feature support flag.
     - Add sink EDID data null check.
     - Update function name to link_detect_connection_type_analog.
     - Fix mismatched unlock for DMUB HW lock in HWSS fast path.
     - Fix P010, NV12, YUY2 scale down by four times failure.
     - Fix and reenable UPDATE_V3_FLOW_NEW_CONTEXT_MINIMAL.
     - Consolidate dmub fb info to a single struct.
     - Add new fields to fams2 config.
     - Update timing source enums.
     - Add signal type check for dcn401 get_phyd32clk_src.
     - Fix dsc eDP issue.
     - Remove unnecessary divider update flag.
     - Update dc_connection_dac_load to dc_connection_analog_load.
     - Check NULL before calling dac_load_detection.
     - Replace log macro for analog display detection.
    
    Reviewed-by: Rodrigo Siqueira 
    Signed-off-by: Taimur Hassan 
    Signed-off-by: Chenyu Chen 
    Acked-by: Wayne Lin 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 2b39d48a0ab368bca4c7a0458fa9cdd05ebcacb6
Author: Alex Hung 
Date:   Mon Dec 8 12:18:02 2025 -0700

    drm/amd/display: Replace log macro for analog display detection
    
    link detection should use LINK_INFO() macro.
    
    Reviewed-by: Harry Wentland 
    Signed-off-by: Alex Hung 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 179176134b535246f0b368b30e8ecad50066f896
Author: Alex Hung 
Date:   Mon Dec 8 12:11:43 2025 -0700

    drm/amd/display: Check NULL before calling dac_load_detection
    
    dac_load_detection can be NULL in some scenario, so checking it before
    calling.
    
    Reviewed-by: Harry Wentland 
    Signed-off-by: Alex Hung 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 57c8690a84bec025a8bc22e5f867fd660c4a3e76
Author: Alex Hung 
Date:   Mon Dec 8 12:09:08 2025 -0700

    drm/amd/display: Update dc_connection_dac_load to dc_connection_analog_load
    
    Update to a more accurate name dc_connection_analog_load.
    
    Reviewed-by: Harry Wentland 
    Signed-off-by: Alex Hung 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 73d08a87d6d421aeb973bb2079386e010a792803
Author: Cruise Hung 
Date:   Fri Dec 5 21:22:44 2025 +0800

    drm/amd/display: Remove unnecessary divider update flag
    
    [Why]
    When transitioning from 640x480 at RBRx1 to HBR3x1,
    both output pixel mode and pixel rate divider should update.
    The needs_divider_update flag was only for 8b10b and 128b132b transition.
    
    [How]
    Remove needs_divider_update flag.
    
    Reviewed-by: Michael Strauss 
    Reviewed-by: Wenjing Liu 
    Signed-off-by: Cruise Hung 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 878a4b73c11111ff5f820730f59a7f8c6fd59374
Author: Charlene Liu 
Date:   Wed Dec 10 17:01:17 2025 -0500

    drm/amd/display: Fix dsc eDP issue
    
    [why]
    Need to add function hook check before use
    
    Reviewed-by: Mohit Bawa 
    Signed-off-by: Charlene Liu 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit c979d8db7b0f293111f2e83795ea353c8ed75de9
Author: Dmytro Laktyushkin 
Date:   Wed Dec 10 15:52:39 2025 -0500

    drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
    
    Trying to access link enc on a dpia link will cause a crash otherwise
    
    Reviewed-by: Charlene Liu 
    Signed-off-by: Dmytro Laktyushkin 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 0d2abc02910b10d25684d111f4d8b1265a35e03c
Author: Clay King 
Date:   Wed Dec 10 13:39:04 2025 -0500

    drm/amd/display: Update timing source enums
    
    Added missing enum for CEA VIC
    
    Reviewed-by: Joshua Aberback 
    Signed-off-by: Clay King 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 7fcf8832000702577236fbe9c8ab48135a41a186
Author: Dillon Varone 
Date:   Tue Dec 9 16:12:40 2025 -0500

    drm/amd/display: Add new fields to fams2 config
    
    [WHY&HOW]
    Adds new fields to the fams2 configuration structure.
    
    Reviewed-by: Nicholas Kazlauskas 
    Signed-off-by: Dillon Varone 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 11dbb6d7b2dce45102be0de87fb2514c368e4a53
Author: Dillon Varone 
Date:   Tue Dec 9 15:26:33 2025 -0500

    drm/amd/display: Consolidate dmub fb info to a single struct
    
    [WHY&HOW]
    Consolidate dmub fb info into a single structure to simplify translation
    between components.
    
    Reviewed-by: Nicholas Kazlauskas 
    Signed-off-by: Dillon Varone 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 5ad5b0b7845c973bdec30ea8d486add9cdfdc543
Author: Dominik Kaszewski 
Date:   Wed Nov 26 13:00:44 2025 +0100

    drm/amd/display: Fix and reenable UPDATE_V3_FLOW_NEW_CONTEXT_MINIMAL
    
    [Why]
    Reenable new split implementation, previously partially reverted due
    to issues with ODM on high-bandwidth displays 4k144Hz, resulting
    in a corrupted gray screen.
    
    Minimal flows require two separate commits, with extra intermediate
    commit to enable seamless transitions, each followed by a swap. Since
    new design requires commit to be run in execute and swap in cleanup
    stage, an attempt was made to reorder them from CSCS (Commit-Swap-Commit-Swap)
    to CCSS (Commit-Commit-Swap-Swap). Not only is this not viable, but
    was implemented incorrectly as CCS, one swap missing.
    
    [How]
    * Change UPDATE_V3_FLOW_NEW_CONTEXT_MINIMAL_NEW/CURRENT to execute
    and cleanup one commit, then run UPDATE_V3_FLOW_NEW_CONTEXT_SEAMLESS,
    which closely matches old implementation where minimal flows fall back
    to seamless.
    * Fix uninitialized variable error.
    
    Reviewed-by: Nicholas Kazlauskas 
    Signed-off-by: Dominik Kaszewski 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit fd3fece04db80c8877361bf4c9f59521ce457be0
Author: Kaier Hsueg 
Date:   Fri Dec 5 00:33:59 2025 +0800

    drm/amd/display: Fix P010, NV12, YUY2 scale down by four times failure
    
    [WHY]
    When performing 4:1 downscaling with subsampled formats,
    the SPL remainder distribution logic (+1) overrides the
    upper layer’s aligned width, resulting in odd segment
    widths and causing hang.
    
    The upper layer alignment ensures the width is sufficient
    and even, so SPL should not modify it further.
    
    [HOW]
    In dc_spl.c within calculate_mpc_slice_in_timing_active,
    add an extra condition: Skip the remainder distribution
    (+1) when use_recout_width_aligned is true.This change
    respects the upper layer’s alignment decision, prevents
    odd widths, and is a minimal, safe fix.
    
    Reviewed-by: Joshua Aberback 
    Signed-off-by: Kaier Hsueh 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit af3303970da5ce5bfe6dffdd07f38f42aad603e0
Author: Nicholas Kazlauskas 
Date:   Mon Dec 8 14:08:56 2025 -0500

    drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path
    
    [Why]
    The evaluation for whether we need to use the DMUB HW lock isn't the
    same as whether we need to unlock which results in a hang when the
    fast path is used for ASIC without FAMS support.
    
    [How]
    Store a flag that indicates whether we should use the lock and use
    that same flag to specify whether unlocking is needed.
    
    Reviewed-by: Swapnil Patel 
    Signed-off-by: Nicholas Kazlauskas 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 2c6592221eb7812d7e2afd229c290bc79c2bfd04
Author: Alex Hung 
Date:   Tue Dec 2 11:54:56 2025 -0700

    drm/amd/display: Update function name to link_detect_connection_type_analog
    
    [WHAT]
    Update function "link_detect_analog" to a more accurate name
    "link_detect_connection_type_analog".
    
    Suggested-by: Wenjing Liu 
    Reviewed-by: Harry Wentland 
    Signed-off-by: Alex Hung 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit a8936060a01715552cac818019ca5e88201a3b7b
Author: Richard Chiang 
Date:   Wed Dec 3 22:24:59 2025 +0800

    drm/amd/display: sink EDID data null check
    
    [Why]
    When sink EDID data pointer is NULL, it will cause an
    unexpected error.
    
    [How]
    Check data pointer is not NULL first.
    
    Reviewed-by: Yihan Zhu 
    Signed-off-by: Richard Chiang 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 9862d2ac667a0e731aa75c17c1b146da809bc3ae
Author: ChunTao Tso 
Date:   Mon Dec 8 17:36:57 2025 +0800

    drm/amd/display: Add frame skip feature support flag
    
    [WHY]
    The set_replay_frame_skip_number() function should not execute when
    the link does not support the Frame Skipping feature.
    
    [HOW]
    Add a new field `frame_skip_supported` to struct replay_config to
    indicate whether the link supports frame skipping. Check this flag
    at the beginning of set_replay_frame_skip_number() and return early
    if the feature is not supported.
    
    Reviewed-by: Robin Chen 
    Signed-off-by: ChunTao Tso 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit b0dbd5db7cf1f81e4aaedd25cb5e72ce369387b2
Author: Yang Wang 
Date:   Mon Dec 15 17:51:11 2025 +0800

    drm/amd/pm: force send pcie parmater on navi1x
    
    v1:
    the PMFW didn't initialize the PCIe DPM parameters
    and requires the KMD to actively provide these parameters.
    
    v2:
    clean & remove unused code logic (lijo)
    
    Fixes: 1a18607c07bb ("drm/amd/pm: override pcie dpm parameters only if it is necessary")
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4671
    Signed-off-by: Yang Wang 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit b4ba5c9509e80b8193e91ab103ffbdd304cd4ba7
Author: Alex Deucher 
Date:   Fri Dec 12 11:13:58 2025 -0500

    drm/amdgpu: use dma_fence_get_status() for adapter reset
    
    We need to check if the fence was signaled without an
    error as the per queue resets may have signalled the fence
    while attempting to reset the queue.
    
    Reviewed-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit 5946dbe1c802efef3b12a4eecab1471f725f4ca9
Author: Yo-Jung Leo Lin (AMD) 
Date:   Fri Dec 12 15:59:17 2025 +0800

    Documentation/amdgpu: Add UMA carveout details
    
    Add documentation for the uma/carveout_options and uma/carveout
    attributes in sysfs
    
    Reviewed-by: Mario Limonciello (AMD) 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Yo-Jung Leo Lin (AMD) 
    Signed-off-by: Alex Deucher 

commit 19ba61ac06d2a4f1e58f92879b54a998ab23b4b1
Author: Yo-Jung Leo Lin (AMD) 
Date:   Fri Dec 12 15:59:16 2025 +0800

    drm/amdgpu: add UMA allocation interfaces to sysfs
    
    Add a uma/ directory containing two sysfs files as interfaces to
    inspect or change UMA carveout size. These files are:
    
    - uma/carveout_options: a read-only file listing all the available
      UMA allocation options and their index.
    
    - uma/carveout: a file that is both readable and writable. On read,
      it shows the index of the current setting. Writing a valid index
      into this file allows users to change the UMA carveout size to that
      option on the next boot.
    
    Co-developed-by: Mario Limonciello (AMD) 
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Alex Deucher 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Yo-Jung Leo Lin (AMD) 
    Signed-off-by: Alex Deucher 

commit 379a3160633a469da240f40948464f20582c11e9
Author: Yo-Jung Leo Lin (AMD) 
Date:   Fri Dec 12 15:59:15 2025 +0800

    drm/amdgpu: add UMA allocation setting helpers
    
    On some platforms, UMA allocation size can be set using the ATCS
    methods. Add helper functions to interact with this functionality.
    
    Co-developed-by: Mario Limonciello (AMD) 
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Yo-Jung Leo Lin (AMD) 
    Signed-off-by: Alex Deucher 

commit 685b7113e0a8087f683d61dad1dc1be78e6c57aa
Author: Yo-Jung Leo Lin (AMD) 
Date:   Fri Dec 12 15:59:14 2025 +0800

    drm/amdgpu: add helper to read UMA carveout info
    
    Currently, the available UMA allocation configs in the integrated system
    information table have not been parsed. Add a helper function to retrieve
    and store these configs.
    
    Co-developed-by: Mario Limonciello (AMD) 
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Yo-Jung Leo Lin (AMD) 
    Signed-off-by: Alex Deucher 

commit 6f3b631e395b971c7320830920185a7a2b44090f
Author: Yo-Jung Leo Lin (AMD) 
Date:   Fri Dec 12 15:59:13 2025 +0800

    drm/amdgpu: parse UMA size-getting/setting bits in ATCS mask
    
    The capabilities of getting and setting VRAM carveout size are exposed
    in the ATCS mask. Parse and store these capabilities for future use.
    
    Co-developed-by: Mario Limonciello (AMD) 
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Yo-Jung Leo Lin (AMD) 
    Signed-off-by: Alex Deucher 

commit 155a748f14bc0b72783994dea7c5a12276730342
Author: Alex Deucher 
Date:   Thu Nov 13 14:12:10 2025 -0500

    drm/amdgpu: always backup and reemit fences
    
    If when we backup the ring contents for reemit before a
    ring reset, we skip jobs associated with the bad
    context, however, we need to make sure the fences
    are reemited as unprocessed submissions may depend on
    them.
    
    v2: clean up fence handling, make helpers static
    
    Reviewed-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit fb62a2067ca4555a6572d911e05919a311c010aa
Author: Alex Deucher 
Date:   Thu Nov 13 13:24:10 2025 -0500

    drm/amdgpu: don't reemit ring contents more than once
    
    If we cancel a bad job and reemit the ring contents, and
    we get another timeout, cancel everything rather than reemitting.
    The wptr markers are only relevant for the original emit.  If
    we reemit, the wptr markers are no longer correct.
    
    Reviewed-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit 216779827f8d52a39d94d43c47737a829991ad8c
Author: Le Ma 
Date:   Thu Nov 6 12:03:04 2025 +0800

    drm/amdgpu: add helpers to access cross-die registers smn addr for soc v1_0
    
    Encode die_id/socket_id for upper 32bits of soc v1_0 registers SMN address.
    
    v2: fix logical error caught by clang
    
    Signed-off-by: Le Ma 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 0dd72af5528a404fca78ef0cad26582d34560c9b
Author: Bokun Zhang 
Date:   Mon Oct 27 13:45:33 2025 +0000

    drm/amdgpu: RLC-G VF Register Access Interface
    
    - Implement Gfx v12.1 VFi interface under SRIOV
    - Redirect all RLCG interface access to new function after
      Gfx v12.1
    
    v2: squash in register updates
    
    Signed-off-by: Bokun Zhang 
    Signed-off-by: Alex Deucher 

commit 87046288e8d540a0e893fec7c452ba0e91abf362
Author: Likun Gao 
Date:   Tue Nov 11 14:34:20 2025 +0800

    drm/amdgpu: set aid_mask for soc v1
    
    Set aid_mask via xcc_mask.
    
    v2: squash in follow up change
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 9b24f63d825e771dafa137e6370c6bf44395e748
Author: Pratik Vishwakarma 
Date:   Mon Nov 24 04:40:21 2025 +0000

    drm/amdgpu: Enable support for PSP 15_0_0
    
    Add support for PSP v 15.0.0.
    
    Signed-off-by: Pratik Vishwakarma 
    Signed-off-by: Alex Deucher 

commit 19eeae7600522ca873caf5d9e4d3d4593ea1c349
Author: Alex Deucher 
Date:   Fri Dec 5 10:56:37 2025 -0500

    drm/amdgpu: add MP 15.0.0 headers
    
    Add headers for MP 15.0.0.
    
    v2: squash in updates (Alex)
    
    Signed-off-by: Alex Deucher 

commit 6ee1ee12ff334d50d346dc764b5bf0dd4d61ad7e
Author: Alex Deucher 
Date:   Wed Dec 17 10:31:58 2025 -0500

    drm/amdgpu: add queue reset support for jpeg 5.3
    
    Enable queue reset for JPEG 5.3.
    
    Reviewed-by: Ruijing Dong 
    Signed-off-by: Alex Deucher 

commit 637fd8dedf10f8961782c29482edffaff1ccc7e2
Author: Saleemkhan Jamadar 
Date:   Sun Oct 5 14:27:52 2025 +0530

    drm/amdgpu/discovery: add vcn and jpeg ip block
    
    Add VCN and jpeg IPs v5_3_0 blocks.
    
    Reviewed-by: Ruijing Dong 
    Signed-off-by: Saleemkhan Jamadar 
    Signed-off-by: Alex Deucher 

commit 4aeaf3cbfa9f967e71849c66c6914ab6c2054581
Author: Saleemkhan Jamadar 
Date:   Sun Oct 5 14:21:09 2025 +0530

    drm/amdgpu/jpeg: Add jpeg 5.3.0 support
    
    Add the Jpeg IP v5_3_0 code base.
    
    Reviewed-by: Ruijing Dong 
    Signed-off-by: Saleemkhan Jamadar 
    Signed-off-by: Alex Deucher 

commit c2775aaa0ef666d5cec46850fdd18402071d0e16
Author: Alex Deucher 
Date:   Fri Dec 5 10:59:30 2025 -0500

    drm/amdgpu: add VCN 5.3.0 headers
    
    Add headers for VCN 5.3.0.
    
    v2: Squash in updates (Alex)
    
    Reviewed-by: Ruijing Dong 
    Signed-off-by: Alex Deucher 

commit a26198f12231718fda7edb574858388cd820df55
Author: Le Ma 
Date:   Fri Nov 7 15:23:32 2025 +0800

    drm/amdgpu: reserve umf hole size at vram high end for gfx v12.1
    
    This region is reserved by firmware thus carve it out in driver.
    
    v2: set reserve size based on aid configuration.
    
    Signed-off-by: Le Ma 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit af26fa751c2eef66916acbf0d3c3e9159da56186
Author: Srinivasan Shanmugam 
Date:   Thu Dec 18 15:25:25 2025 +0530

    drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
    
    vcn_v2_0_start_sriov() declares a local variable "i" initialized to zero
    and uses it only as the instance index in SOC15_REG_OFFSET(UVD, i, ...).
    The value is never changed and all other fields are taken from
    adev->vcn.inst[0], so this path only ever programs VCN instance 0.
    
    This triggered a Smatch:
    warn: iterator 'i' not incremented
    
    Replace the dummy iterator with an explicit instance index of 0 in
    SOC15_REG_OFFSET() calls.
    
    Fixes: dd26858a9cd8 ("drm/amdgpu: implement initialization part on VCN2.0 for SRIOV")
    Reported by: Dan Carpenter 
    Cc: darlington Opara 
    Cc: Jinage Zhao 
    Cc: Monk Liu 
    Cc: Emily Deng 
    Cc: Christian König 
    Cc: Alex Deucher 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Emily Deng 
    Signed-off-by: Alex Deucher 

commit 56c0a9c33cfd9c8035737746b7263266c230b80a
Author: Le Ma 
Date:   Fri Nov 7 15:05:56 2025 +0800

    drm/amdgpu: enable CP interrupt for gfx v12_1 in frontdoor loading case
    
    Enable cp interrupt for event detection since GFX CGCG and LS
    has been enabled by firmware.
    
    v2: enable CP INT by merely checking fw_load_type
    
    Signed-off-by: Le Ma 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit ba80939feca0d85ffa272a18c7c4763adf040114
Author: Jay Cornwall 
Date:   Thu Oct 23 15:33:04 2025 -0500

    drm/amdkfd: Apply VGPR bank state fixup on gfx12.1 trap exit
    
    - Identify co-issue of S_SET_VGPR_MSB and VALU with banked VGPR
    - Restore previous bank setting when exiting the trap
    
    v2:
    - Refine VOP3PX2 detection
    - Improve load pipelining
    - Fix a comment typo
    
    Signed-off-by: Jay Cornwall 
    Reviewed-by: Lancelot Six 
    Cc: Joseph Greathouse 
    Signed-off-by: Alex Deucher 

commit 1005ab86cf75aec3462c1c58d6efa87871f2843f
Author: Jay Cornwall 
Date:   Thu Oct 23 15:28:39 2025 -0500

    drm/amdkfd: Fix VGPR bank state save in gfx12.1 trap handler
    
    S_SETREG_IMM32_B32 does not apply a mask to the MODE bank bits.
    SRC2 is consequently unconditonally cleared during context save.
    
    Use S_SETREG_B32 instead to preserve SRC2.
    
    Signed-off-by: Jay Cornwall 
    Reviewed-by: Lancelot Six 
    Signed-off-by: Alex Deucher 

commit 864a8b2c1ff9e5767d6bb19854a671c30b3b268f
Author: Asad Kamal 
Date:   Thu Oct 16 18:58:05 2025 +0800

    drm/amdgpu: Add sysfs up clean for gfx_v12_1
    
    Add sysfs clean up for gfx_v12_1 during gfx fini sequence. This will
    prevent following crash while reloading driver
    
    2645.490824] R13: 000055d0cb186330 R14: 000055d0cb185ed0 R15: 000055d0cb188f40
    [ 2645.490825]  
    [ 2645.490836] amdgpu 0000:02:00.0: amdgpu: failed to create xcp sysfs files
    [ 2645.490937] amdgpu 0000:02:00.0: amdgpu: sw_init of IP block  failed -17
    [ 2645.491018] amdgpu 0000:02:00.0: amdgpu: amdgpu_device_ip_init failed
    [ 2645.491098] amdgpu 0000:02:00.0: amdgpu: Fatal error during GPU init
    [ 2645.491547] amdgpu 0000:02:00.0: amdgpu: amdgpu: finishing device.
    [ 2648.549939] ------------[ cut here ]------------
    [ 2648.549942] WARNING: CPU: 0 PID: 2459 at /tmp/amd.aIpOeG3c/amd/amdgpu/amdgpu_irq.c:
    
    Signed-off-by: Asad Kamal 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit c51bb53d5c68041dd02f66d9b638cda33647623e
Author: David Yat Sin 
Date:   Tue Mar 18 19:49:55 2025 +0000

    drm/amdkfd: Add metadata ring buffer for compute
    
    Add support for separate ring-buffer for metadata packets when using
    compute queues. Userspace application allocate the metadata ring-buffer
    and the queue ring-buffer with a single allocation. The metadata
    ring-buffer starts after the queue ring-buffer.
    
    Signed-off-by: David Yat Sin 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit d0c989a0aad3ff047b72c89c91969a535f72dd2e
Author: Shaoyun Liu 
Date:   Thu Jul 31 22:27:12 2025 -0400

    drm/amd/amdgpu : Use the MES INV_TLBS API for tlb invalidation on gfx12_1
    
    Signed-off-by: Shaoyun Liu 
    Reviewed-by: Prike Liang 
    Signed-off-by: Alex Deucher 

commit 3af6302d8c2ee37b9a791222947052ee2dfdea5b
Author: Mukul Joshi 
Date:   Mon Sep 15 10:48:04 2025 -0400

    drm/amdgpu: Update TCP Control register on GFX 12.1
    
    Update TCP CNTL register to disable some features not supported
    on GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 258cc2b687bf67f7872707061158aefddbc449e1
Author: Mukul Joshi 
Date:   Fri Sep 12 17:48:12 2025 -0400

    drm/amdkfd: Add back CWSR trap handler for GFX 12.1
    
    CWSR Trap handler for GFX 12.1 was missed when merging changes
    from 6.14 NPI branch to 6.16 NPI branch. This change adds back
    the CWSR trap handler for GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 5a8c343d2e87a4d623934e73a0c3a200e2a47a42
Author: Mukul Joshi 
Date:   Wed Sep 10 14:36:09 2025 -0400

    drm/amdgpu: Cleanup gmc_v12_1 after 6.16 merge
    
    After the 6.16 merge, some changes not applicable to GFX 12.1 were
    added in the gmc_v12_1_get_vm_pte function. Additionally, add the
    case for MTYPE RW for GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit fab4099549a050703b87da012e5ebd75463bd654
Author: Mukul Joshi 
Date:   Fri Sep 5 22:22:32 2025 -0400

    drm/amdgpu: Disable TCP Early Write Ack for GFX 12.1
    
    Disable the TCP Early Write Ack feature on GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit e418a8fdb9644712364eb582984eca0905664080
Author: Jonathan Kim 
Date:   Tue Sep 9 15:57:44 2025 -0400

    drm/amdkfd: enable precise memory operations for gfx1250
    
    Enable precise memory for GFX 1250.
    
    Signed-off-by: Jonathan Kim 
    Reviewed-by: Mukul Joshi 
    Signed-off-by: Alex Deucher 

commit c14af4cc24e640e50d4c64b1930093a24402d4ce
Author: Jonathan Kim 
Date:   Mon Sep 8 17:40:01 2025 +0000

    drm/amdkfd: fix partitioned gfx12 address watch enablement
    
    GFX 12 devices that support spatial partitioning should use the WREG32
    per XCC macro when updating address watch settings, similar to GFX 9
    devices that support spatial partitioning.
    
    Signed-off-by: Jonathan Kim 
    Reviewed-by: Mukul Joshi 
    Signed-off-by: Alex Deucher 

commit a0806e7fe7aa67e36b89593a02b2669efa721860
Author: Mukul Joshi 
Date:   Thu Sep 4 18:04:29 2025 -0400

    drm/amdkfd: Implement CU Masking for GFX 12.1
    
    Add CU masking implementation for GFX 12.1. Add a local
    implementation for GFX 12.1 instead of using the generic
    function defined in kfd_mqd_manager.c because of some
    quirks in the way CU mask is handled on GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit acf07acfae919305eb96085dc0b11ab0382ae3e5
Author: Likun Gao 
Date:   Mon Aug 25 14:23:08 2025 +0800

    drm/amdgpu: skip gfxhub tlb flush if gfx is power off
    
    Skip for gfxhub tlb flush for gc v12_1 if gfx is not poweron.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 7bd5d763b8e125bec578ab66ce5d90a4c83e1bff
Author: Likun Gao 
Date:   Wed Aug 27 10:08:46 2025 +0800

    drm/amdkfd: Add gfx_v12_1_kfd2kgd interface for GFX12_1
    
    Create new kfd2kgd interface for gfx v12_1, based on gfx v12.
    Support register program accoding to xcc id.
    V2: Fix SDMA register address for muti-xcc.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Mukul Joshi 
    Signed-off-by: Alex Deucher 

commit 60481d95ad989f556da15fa40bc6edb648324b02
Author: Likun Gao 
Date:   Mon Aug 18 15:29:07 2025 +0800

    drm/amdgpu: update mcm_addr_lut data for imu v12_1
    
    Support for partition mode to program MCM_ADDR_LUT.
    
    v2: clean up (Alex)
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit e7820045fde15d25b5b2706f03499e0cb9ae778e
Author: Hawking Zhang 
Date:   Thu Jun 12 21:52:19 2025 +0800

    drm/amdgpu: Init mcm_addr look up table
    
    Encode mcm address look up table in SPX mode
    as a temp solution.
    
    v2: fill in when interface is ready (Alex)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 2d70a10dd16a5baa3e977c12311d9d8aa2d13819
Author: Mukul Joshi 
Date:   Thu Aug 14 15:23:16 2025 -0400

    drm/amdgpu: Always set PTE.B for device memory on GFX 12.1
    
    On GFX 12.1, we need to set the atomics bit (PTE.B) always for
    device memory.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 80be8286d098dc92cc48ab2d0f459dbb5cfde055
Author: Lang Yu 
Date:   Tue Aug 19 18:54:30 2025 +0800

    drm/amdgpu/gfx12.1: Don't fetch default register values from hardware in mqd init
    
    1. We can't assure the fetched values are always default register values.
       Observing non-zero cp_hqd_pq_rptr in mes_v12_1_self_test->init_mqd()
       where no GRBM_GFX_CNTL is specified.
    
    2. See commit fc3c139cf043 ("drm/amdgpu/gfx12: don't read registers in mqd init").
    
    Signed-off-by: Lang Yu 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit e291729873095262697758c389c8d7affa81bdcc
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 19:12:27 2025 -0600

    drm/amd: Convert DRM_*() to drm_*()
    
    The drm_*() macros include the device which is helpful for debugging
    issues in multi-GPU systems.
    
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit 5fd4fef3f8e6b5be4e1df49f32efc8b200ed07d5
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 19:12:26 2025 -0600

    drm/amd: Drop amdgpu prefix from message prints
    
    Hardcoding the prefix isn't necessary when using drm_* or dev_*
    message prints.
    
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit d4b8d132ce41a51241544cfa1cec8c401ff04002
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 19:12:25 2025 -0600

    drm/amd: Convert amdgpu_display from DRM_* to drm_ macros
    
    drm_* macros show the device they were called with which is helpful
    in multi-GPU systems.
    
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit 217737bb5a17297aa7ac74ca6638628efc74c661
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 19:12:24 2025 -0600

    drm/amd/display: Fix DPMS log printing
    
    [Why]
    Spaces before newline are not necessary. Inserting newlines in
    multi-line strings are harder to follow when tracing messages.
    
    [How]
    Drop extra new lines and split multi-line messages into one print
    per line.
    
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit fe4d39879ad99781a18eb31692cbe02292cbc8f1
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 19:12:23 2025 -0600

    drm/amd: Drop dev_fmt prefix
    
    The `amdgpu:` prefix in dev_fmt() isn't needed because the core
    already includes the driver in the print.
    
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit 9edf6c09c5134f47e52268e6812ff64b416ca56e
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 19:12:22 2025 -0600

    drm/amd: Pass `adev` to amdgpu_gfx_parse_disable_cu()
    
    In order for messages to be attribute to the correct device
    amdgpu_gfx_parse_disable_cu() needs to know what device is being
    operated on.  Pass the argument in.
    
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit e6c7ebeaba4080562e71a59a788ac90b41e09240
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 19:12:21 2025 -0600

    drm/amd: Add correct prefix for VBIOS message
    
    It's not obvious which GPU the ATOM BIOS message goes with. Use
    drm_info() to show the correct one.
    
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit 5847cf1aed00704e8202ffebea86b4f6bd618403
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 19:12:20 2025 -0600

    drm/amdkfd: Correct the topology message for APUs
    
    At bootup on a Strix machine the following message comes up:
    ```
    amdgpu: Topology: Add dGPU node [0x150e:0x1002]
    ```
    
    This is an APU though. Clarify the messaging by only offer a
    "CPU node" or "GPU node" message. Also set the message as
    VID:DID instead which is how other messages work.
    
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit 31dc58adda9874420ab8fa5a2f9c43377745753a
Author: Srinivasan Shanmugam 
Date:   Wed Dec 17 15:21:57 2025 +0530

    drm/amdkfd: Fix signal_eviction_fence() bool return value
    
    signal_eviction_fence() is declared to return bool, but returns -EINVAL
    when no eviction fence is present.  This makes the "no fence" or "the
    NULL-fence" path evaluate to true and triggers a Smatch warning.
    
    v2: Return true instead to explicitly indicate that there is no eviction
    fence to signal and that eviction is already complete. This matches the
    existing caller logic where a NULL fence means "nothing to do" and
    allows restore handling to proceed normally. (Christian)
    
    Fixes the below:
    drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:2099 signal_eviction_fence()
    warn: '(-22)' is not bool
    
    drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c
        2090 static bool signal_eviction_fence(struct kfd_process *p)
                    ^^^^
    
        2091 {
        2092         struct dma_fence *ef;
        2093         bool ret;
        2094
        2095         rcu_read_lock();
        2096         ef = dma_fence_get_rcu_safe(&p->ef);
        2097         rcu_read_unlock();
        2098         if (!ef)
    --> 2099                 return -EINVAL;
    
                    This should be either true or false.
                    Probably true because presumably
                    it has been tested?
    
        2100
        2101         ret = dma_fence_check_and_signal(ef);
        2102         dma_fence_put(ef);
        2103
        2104         return ret;
        2105 }
    
    Fixes: 37865e02e6cc ("drm/amdkfd: Fix eviction fence handling")
    Reported by: Dan Carpenter 
    Cc: Philip Yang 
    Cc: Gang BA 
    Cc: Felix Kuehling 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 5c5189cf4b0cc0a22bac74a40743ee711cff07f8
Author: Yang Wang 
Date:   Thu Dec 11 10:47:18 2025 +0800

    drm/amd/pm: fix wrong pcie parameter on navi1x
    
    fix wrong pcie dpm parameter on navi1x
    
    Fixes: 1a18607c07bb ("drm/amd/pm: override pcie dpm parameters only if it is necessary")
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4671
    Signed-off-by: Yang Wang 
    Co-developed-by: Kenneth Feng 
    Signed-off-by: Kenneth Feng 
    Acked-by: Alex Deucher 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 2026159372bb6ff5e18e63272473eb4549b0779e
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:50:04 2026 +0100

    iommu/qcom: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Will Deacon 

commit f91879fdf70bdf369906a20a8980284d3ef1558f
Author: Charan Teja Kalla 
Date:   Tue Dec 9 10:53:23 2025 +0530

    iommu/arm-smmu-qcom: Add actlr settings for mdss on Qualcomm platforms
    
    Add ACTLR settings for missing MDSS devices on Qualcomm platforms.
    
    These are QoS settings and are specific to per SoC thus different
    settings, eg: some have shallow prefetch while others have no
    prefetch.
    
    Aswell, this prefetch feature is not implemented for all the
    platforms, capturing to those are implemented to the best of my
    knowledge.
    
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Charan Teja Kalla 
    Signed-off-by: Bibek Kumar Patro 
    Signed-off-by: Will Deacon 

commit 88c31f1b31aec2d73261d9565f870e8d14974543
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:48:29 2026 +0100

    remoteproc: xlnx_r5: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20260102124827.64355-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Mathieu Poirier 

commit 6d183d0530b5dc77ddd7d829bdfcb62a365a210f
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:48:28 2026 +0100

    remoteproc: mtk_scp: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20260102124827.64355-3-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Mathieu Poirier 

commit 8644084a74a4573278d6f454c6638ccd5965f4e2
Author: Mario Limonciello (AMD) 
Date:   Sun Dec 14 19:12:19 2025 -0600

    drm/amd: Drop "amdgpu kernel modesetting enabled" message
    
    The behavior for amdgpu was changed with commit e00e5c223878
    ("drm/amdgpu: adjust drm_firmware_drivers_only() handling") to
    potentially allow loading even if nomodeset was set, so the
    message is no longer accurate.
    
    Just drop it to avoid confusion.
    
    Fixes: e00e5c223878 ("drm/amdgpu: adjust drm_firmware_drivers_only() handling")
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit 0621f21cf3830c494bf8db8a7dbf9e24fff118d9
Author: Jinzhou Su 
Date:   Tue Dec 2 16:15:10 2025 +0800

    drm/amdgpu: Add address checking for uniras
    
    Add address checking for uniras
    
    Signed-off-by: Jinzhou Su 
    Reviewed-by: YiPeng Chai 
    Signed-off-by: Alex Deucher 

commit dc135aa73561b5acc74eadf776e48530996529a3
Author: Alex Deucher 
Date:   Mon Jun 30 10:47:09 2025 -0400

    drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
    
    clockInfo[] is a generic uchar pointer to variable sized structures
    which vary from ASIC to ASIC.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4374
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 7aaaca3be44523c689648448dc127a711f0c3cb6
Author: Tim Huang 
Date:   Mon Jan 20 14:11:34 2025 +0800

    drm/amdgpu: add support for MMHUB IP version 3.4.0
    
    This initializes MMHUB IP version 3.4.0.
    
    v2: squash in clients table update (Alex)
    
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Tim Huang 
    Signed-off-by: Alex Deucher 

commit e2fd14f579b841f54a9b7162fef15234d8c0627a
Author: Tim Huang 
Date:   Thu Dec 12 10:46:47 2024 +0800

    drm/amdgpu: add support for HDP IP version 6.1.1
    
    This initializes HDP IP version 6.1.1.
    
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Tim Huang 
    Signed-off-by: Alex Deucher 

commit ca7a44f92d31d539cafb73e839f5177d35b9334b
Author: Tim Huang 
Date:   Thu Dec 12 10:44:04 2024 +0800

    drm/amdgpu: add support for IH IP version 6.1.1
    
    This initializes IH IP version 6.1.1.
    
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Tim Huang 
    Signed-off-by: Alex Deucher 

commit 15dd20dda979ebab72f6df97845828e78d63ab91
Author: Yeoreum Yun 
Date:   Mon Dec 1 10:51:18 2025 +0000

    arm64: kernel: initialize missing kexec_buf->random field
    
    Commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly")
    introduced the kexec_buf->random field to enable random placement of
    kexec_buf.
    
    However, this field was never properly initialized for kexec images
    that do not need to be placed randomly, leading to the following UBSAN
    warning:
    
    [  +0.364528] ------------[ cut here ]------------
    [  +0.000019] UBSAN: invalid-load in ./include/linux/kexec.h:210:12
    [  +0.000131] load of value 2 is not a valid value for type 'bool' (aka '_Bool')
    [  +0.000003] CPU: 4 UID: 0 PID: 927 Comm: kexec Not tainted 6.18.0-rc7+ #3 PREEMPT(full)
    [  +0.000002] Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015
    [  +0.000000] Call trace:
    [  +0.000001]  show_stack+0x24/0x40 (C)
    [  +0.000006]  __dump_stack+0x28/0x48
    [  +0.000002]  dump_stack_lvl+0x7c/0xb0
    [  +0.000002]  dump_stack+0x18/0x34
    [  +0.000001]  ubsan_epilogue+0x10/0x50
    [  +0.000002]  __ubsan_handle_load_invalid_value+0xc8/0xd0
    [  +0.000003]  locate_mem_hole_callback+0x28c/0x2a0
    [  +0.000003]  kexec_locate_mem_hole+0xf4/0x2f0
    [  +0.000001]  kexec_add_buffer+0xa8/0x178
    [  +0.000002]  image_load+0xf0/0x258
    [  +0.000001]  __arm64_sys_kexec_file_load+0x510/0x718
    [  +0.000002]  invoke_syscall+0x68/0xe8
    [  +0.000001]  el0_svc_common+0xb0/0xf8
    [  +0.000002]  do_el0_svc+0x28/0x48
    [  +0.000001]  el0_svc+0x40/0xe8
    [  +0.000002]  el0t_64_sync_handler+0x84/0x140
    [  +0.000002]  el0t_64_sync+0x1bc/0x1c0
    
    To address this, initialise kexec_buf->random field properly.
    
    Fixes: bf454ec31add ("kexec_file: allow to place kexec_buf randomly")
    Suggested-by: Breno Leitao 
    Cc: stable@vger.kernel.org
    Signed-off-by: Yeoreum Yun 
    Reviewed-by: Breno Leitao 
    Link: https://lore.kernel.org/all/oninomspajhxp4omtdapxnckxydbk2nzmrix7rggmpukpnzadw@c67o7njgdgm3/ [1]
    Link: https://lore.kernel.org/all/20250825180531.94bfb86a26a43127c0a1296f@linux-foundation.org/ [2]
    Link: https://lkml.kernel.org/r/20250826-akpm-v1-1-3c831f0e3799@debian.org
    Signed-off-by: Breno Leitao 
    Suggested-by: Andrew Morton 
    Signed-off-by: Andrew Morton 
    Reviewed-by: Pratyush Yadav 
    Signed-off-by: Will Deacon 

commit 0cc0c5e7e4bde1b391d6e486a5f151d5de1a1069
Author: Tim Huang 
Date:   Wed Dec 11 16:23:54 2024 +0800

    drm/amdgpu: add support for NBIO IP version 7.11.4
    
    This initializes NBIO IP version 7.11.4.
    
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Tim Huang 
    Signed-off-by: Pratik Vishwakarma 
    Signed-off-by: Alex Deucher 

commit ab90fd056cf4c7e10c25804eb5c601ee0e73705b
Author: Tim Huang 
Date:   Wed Dec 11 16:20:50 2024 +0800

    drm/amdgpu: add support for SDMA IP version 6.1.4
    
    This initializes SDMA IP version 6.1.4.
    
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Tim Huang 
    Signed-off-by: Alex Deucher 

commit 47ae1f938d1259d1e10e885dc64fe93f92f0ac7c
Author: Tim Huang 
Date:   Wed Dec 11 16:07:09 2024 +0800

    drm/amdgpu: add support for GC IP version 11.5.4
    
    This initializes GC IP version 11.5.4.
    
    v2: squash in RLC offset fix
    
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Tim Huang 
    Signed-off-by: Alex Deucher 

commit bc35ae1a09ca02c25df54327fb1e7a09d2556e1a
Author: Hawking Zhang 
Date:   Tue Aug 19 16:55:32 2025 +0800

    drm/amdgpu: Fix xcc_id input for soc_v1_0_grbm_select
    
    Ensure the GRBM_GFX_CNTL is programmed correctly
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit 09a75a234b21e6564e2c0bac517cf5bd2c6e1905
Author: Hawking Zhang 
Date:   Thu Aug 7 22:49:51 2025 +0800

    drm/amdgpu: Do not initialize imu callback for vf
    
    Not needed in guest environment
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit fcc4fc758e132a4512ba8176222fca61b0b7f1cf
Author: Likun Gao 
Date:   Mon Aug 18 12:45:27 2025 +0800

    drm/amdgpu: make normalize reg addr to common func for soc v1
    
    Normalize registers address to local xcc address for sdma v7_1.
    Merge normalize register address function to an common function
    for soc v1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Feifei Xu 
    Signed-off-by: Alex Deucher 

commit 382dd7d23d1af3be58f07c9fabd571b760a3aff1
Author: Mukul Joshi 
Date:   Wed Aug 13 15:05:37 2025 -0400

    drm/amdgpu: Setup MTYPE on SOC models for GFX 12.1
    
    Fix it to apply for all models.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit fd25254f0bdd8c604052e88a8a77e8e9af8f4c87
Author: Mukul Joshi 
Date:   Fri Aug 8 17:33:59 2025 -0400

    drm/amdgpu: Report correct compute partition mode on GFX 12.1
    
    PSP programs the NBIO partition status register. In the absence of PSP,
    read the current compute partition from the GFX IMU register instead of
    NBIO.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Reviewed-by: Michael Chen 
    Signed-off-by: Alex Deucher 

commit b78ec282bbf6b75f87358e4f634010855b770c8c
Author: Mukul Joshi 
Date:   Thu Aug 7 15:18:00 2025 -0400

    drm/amdkfd: Send MES packets on correct XCC on GFX 12.1
    
    Send the Set_Shader_Debugger packet on the correct MES pipe when
    partition mode is set to non-SPX mode.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Reviewed-by: Michael Chen 
    Signed-off-by: Alex Deucher 

commit b6ac64eed803d421ae53f280a68771b101000281
Author: Mukul Joshi 
Date:   Thu Aug 7 15:12:41 2025 -0400

    drm/amdkfd: Add/remove queues on the correct XCC on GFX 12.1
    
    On GFX 12.1, pass the xcc id of the master XCC to choose the correct
    MES Pipe to send the add_queue/remove_queue requests to MES.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Reviewed-by: Michael Chen 
    Signed-off-by: Alex Deucher 

commit 376fa6c9ac10f492e78af84fbef84bf93213470b
Author: Mukul Joshi 
Date:   Fri Aug 8 11:36:08 2025 -0400

    drm/amdkfd: Don't partition VMID space on GFX 12.1
    
    There is no need to partition VMID space on GFX 12.1 when
    operating in CPX mode as SDMA is not sharing MMHUB on GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Reviewed-by: Michael Chen 
    Signed-off-by: Alex Deucher 

commit aa0f09f93dfb3b9383761a5e4792c2c950623447
Author: Mukul Joshi 
Date:   Thu Aug 7 17:12:43 2025 -0400

    drm/amdgpu: Rework MES initialization on GFX 12.1
    
    Currently, only SPX mode works on GFX 12.1. This patch reworks
    the MES initialization to get other non-SPX modes working. For example,
    for CPX mode, coop_enable bit needs to be set to 0. The shared command
    buffer initialization is also not needed in CPX mode.
    The shared command buffer initialization needs further improvements which
    will be handled in later patches.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Reviewed-by: Michael Chen 
    Signed-off-by: Alex Deucher 

commit b7c4040d0d131de5014fb02bbdbe8fa2b9c5b0b0
Author: Mukul Joshi 
Date:   Thu Aug 7 17:05:28 2025 -0400

    drm/amdgpu: Use correct MES pipe in non-SPX mode on GFX 12.1
    
    On GFX 12.1, use the correct MES pipe instance for readiness before
    sending MES commands on that pipe. Additionally, send the TLB requests
    on the correct MES pipe in non-SPX modes.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Reviewed-by: Michael Chen 
    Signed-off-by: Alex Deucher 

commit 0528287370390a77af9404de38091fe8f502280b
Author: Likun Gao 
Date:   Tue Jul 22 15:35:51 2025 +0800

    drm/amdgpu: adjust xcc_id program logic for sdma v7_1
    
    Adjust program logic for sdam v7_1, only use physical xcc_id
    when program register to support compute partition.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 98320bf3e39e433fb9c2b248bcfe6a5f6a3428f7
Author: Likun Gao 
Date:   Thu Jul 31 12:09:37 2025 +0800

    drm/amdgpu: adjust xcc logic for gfxhub v12_1
    
    Adjust xcc_id logic to only use physical xcc_id when program
    register, (use logic xcc_id by default), to fit for compute
    partition.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 1a856863b6f2830cb4561865cf5a8e28ae58a9f5
Author: Likun Gao 
Date:   Fri Jul 18 15:37:53 2025 +0800

    drm/amdgpu: adjust xcc_cp_resume function for gfx_v12_1
    
    Adjust gfx_v12_1_xcc_cp_resume function to program
    cp resume per xcc_id (logic xcc number) to fix for
    xcp_resume.
    V2: Allocate compute microcode bo when sw init
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit bf93f1fe50af23d670f83f801708bbbb173fc08a
Author: Gang Ba 
Date:   Thu Aug 7 11:14:43 2025 -0400

    drm/amdkfd: Add SDMA queue quantum support for GFX12.1
    
        program SDMAx_QUEUEx_SCHEDULE_CNTL for context switch due to
        quantum in KFD for GFX12.1
    
    Signed-off-by: Gang Ba 
    Reviewed-by: Amber Lin 
    Signed-off-by: Alex Deucher 

commit 16592e75913d6ff7f68e192a7143f23d1dc67ac3
Author: Gang Ba 
Date:   Thu Jul 24 09:20:08 2025 -0400

    drm/amdkfd: Set SDMA_QUEUEx_IB_CNTL/SWITCH_INSIDE_IB
    
        When submitting MQD to CP, set SDMA_QUEUEx_IB_CNTL/SWITCH_INSIDE_IB bit
        so it'll allow SDMA preemption if there is a massive command buffer of
        long-running SDMA commands.
    
    Signed-off-by: Gang Ba 
    Signed-off-by: Alex Deucher 

commit a2a7e75020cbff0af16abae74a90bdff2834a191
Author: Likun Gao 
Date:   Wed Aug 6 10:28:18 2025 +0800

    drm/amdgpu: disable burst for gfx v12_1
    
    Disable burst in GL1A and GLARBA for gfx v12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit a41d94a7bb962fde26c9bccd4d6858b8c6bf507f
Author: Mukul Joshi 
Date:   Mon Jun 16 14:58:33 2025 -0400

    drm/amdgpu: Setup Retry based thrashing prevention on GFX 12.1
    
    Enable the new UTCL0 retry-based thrashing prevention on GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 44fc86f2a338e6c202565611b9725c9428ae7481
Author: Mukul Joshi 
Date:   Wed Jul 23 22:34:11 2025 -0400

    drm/amdgpu: Program IH_VMID_LUT_INDEX register on GFX 12.1
    
    For querying VMID <-> PASID mapping on GFX 12.1, we need to first
    program the IH_VMID_LUT_INDEX before fetching the LUT mapping. Without
    this TLB flush may not work.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Michael Chen 
    Reviewed-by:  Alex Sierra 
    Signed-off-by: Alex Deucher 

commit d3336c935ecebb0185cce50848d9fdea665085f2
Author: Jinzhou Su 
Date:   Tue Dec 2 16:09:10 2025 +0800

    drm/amd/ras: Support physical address convert
    
    Support physical address convert to current NPS
    pages in uniras.
    
    Signed-off-by: Jinzhou Su 
    Reviewed-by: YiPeng Chai 
    Signed-off-by: Alex Deucher 

commit 364f168f6148277ba3344d1c54f9fdffea34816f
Author: Jack Xiao 
Date:   Thu Jun 19 19:42:26 2025 +0800

    drm/amdgpu/gfx_v12_1: add mqd_stride_size input parameter
    
    mqd_stride_size is used to calculate the next mqd offset
    for cooperative dispatch.
    
    Signed-off-by: Jack Xiao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 03a4c89db2ff0caf208e72425280b96762a7ac38
Author: Colin Ian King 
Date:   Mon Dec 15 11:51:50 2025 +0000

    drm/amdkfd: Fix a couple of spelling mistakes
    
    There are a couple of spelling mistakes, one in a pr_warn message
    and one in a seq_printf message. Fix these.
    
    Signed-off-by: Colin Ian King 
    Signed-off-by: Alex Deucher 

commit d8ccbb5e228b093eba19027a281274e7faf2da4c
Author: Bagas Sanjaya 
Date:   Mon Dec 15 18:38:58 2025 +0700

    drm/amdgpu: Describe @AMD_IP_BLOCK_TYPE_RAS in amd_ip_block_type enum
    
    Sphinx reports kernel-doc warning:
    
    WARNING: ./drivers/gpu/drm/amd/include/amd_shared.h:113 Enum value 'AMD_IP_BLOCK_TYPE_RAS' not described in enum 'amd_ip_block_type'
    
    Describe the value to fix it.
    
    Fixes: 7169e706c82d ("drm/amdgpu: Add ras module ip block to amdgpu discovery")
    Signed-off-by: Bagas Sanjaya 
    Signed-off-by: Alex Deucher 

commit b1e2a6a57aa95f8192e8edb9edaecfd326745d32
Author: Bagas Sanjaya 
Date:   Mon Dec 15 18:38:57 2025 +0700

    drm/amd/display: Don't use kernel-doc comment in dc_register_software_state struct
    
    Sphinx reports kernel-doc warning:
    
    WARNING: ./drivers/gpu/drm/amd/display/dc/dc.h:2796 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst
     * Software state variables used to program register fields across the display pipeline
    
    Don't use kernel-doc comment syntax to fix it.
    
    Fixes: b0ff344fe70c ("drm/amd/display: Add interface to capture expected HW state from SW state")
    Signed-off-by: Bagas Sanjaya 
    Signed-off-by: Alex Deucher 

commit 563dfbefdf633c8d958398ddfa3955f9f40e47d9
Author: Nathan Chancellor 
Date:   Sat Dec 13 19:58:11 2025 +0900

    drm/amd/display: Reduce number of arguments of dcn30's CalculateWatermarksAndDRAMSpeedChangeSupport()
    
    CalculateWatermarksAndDRAMSpeedChangeSupport() has a large number of
    parameters, which must be passed on the stack. Most of the parameters
    between the two callsites are the same, so they can be accessed through
    the existing mode_lib pointer, instead of being passed as explicit
    arguments. Doing this reduces the stack size of
    dml30_ModeSupportAndSystemConfigurationFull() from 1912 bytes to 1840
    bytes building for x86_64 with clang-22, helping stay under the 2048
    byte limit for display_mode_vba_30.c.
    
    Additionally, now that there is a pointer to mode_lib->vba available,
    use 'v' consistently throughout the entire function.
    
    Signed-off-by: Nathan Chancellor 
    Signed-off-by: Alex Deucher 

commit b20b3fc4210f83089f835cdb91deec4b0778761a
Author: Nathan Chancellor 
Date:   Sat Dec 13 19:58:10 2025 +0900

    drm/amd/display: Reduce number of arguments of dcn30's CalculatePrefetchSchedule()
    
    After an innocuous optimization change in clang-22,
    dml30_ModeSupportAndSystemConfigurationFull() is over the 2048 byte
    stack limit for display_mode_vba_30.c.
    
      drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_mode_vba_30.c:3529:6: warning: stack frame size (2096) exceeds limit (2048) in 'dml30_ModeSupportAndSystemConfigurationFull' [-Wframe-larger-than]
       3529 | void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib)
            |      ^
    
    With clang-21, this function was already close to the limit:
    
      drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_mode_vba_30.c:3529:6: warning: stack frame size (1912) exceeds limit (1586) in 'dml30_ModeSupportAndSystemConfigurationFull' [-Wframe-larger-than]
       3529 | void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib)
            |      ^
    
    CalculatePrefetchSchedule() has a large number of parameters, which must
    be passed on the stack. Most of the parameters between the two callsites
    are the same, so they can be accessed through the existing mode_lib
    pointer, instead of being passed as explicit arguments. Doing this
    reduces the stack size of dml30_ModeSupportAndSystemConfigurationFull()
    from 2096 bytes to 1912 bytes with clang-22.
    
    Closes: https://github.com/ClangBuiltLinux/linux/issues/2117
    Signed-off-by: Nathan Chancellor 
    Signed-off-by: Alex Deucher 

commit 25314b453cf812150e9951a32007a32bba85707e
Author: Nathan Chancellor 
Date:   Sat Dec 13 15:16:43 2025 +0900

    drm/amd/display: Apply e4479aecf658 to dml
    
    After an innocuous optimization change in clang-22, allmodconfig (which
    enables CONFIG_KASAN and CONFIG_WERROR) breaks with:
    
      drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_32.c:1724:6: error: stack frame size (3144) exceeds limit (3072) in 'dml32_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than]
       1724 | void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib)
            |      ^
    
    With clang-21, this function was already pretty close to the existing
    limit of 3072 bytes.
    
      drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_32.c:1724:6: error: stack frame size (2904) exceeds limit (2048) in 'dml32_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than]
       1724 | void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib)
            |      ^
    
    A similar situation occurred in dml2, which was resolved by
    commit e4479aecf658 ("drm/amd/display: Increase sanitizer frame larger
    than limit when compile testing with clang") by increasing the limit for
    clang when compile testing with certain sanitizer enabled, so that
    allmodconfig (an easy testing target) continues to work.
    
    Apply that same change to the dml folder to clear up the warning for
    allmodconfig, unbreaking the build.
    
    Closes: https://github.com/ClangBuiltLinux/linux/issues/2135
    Signed-off-by: Nathan Chancellor 
    Signed-off-by: Alex Deucher 

commit 2e01c96d8e6cfc654bb4a12efc1b2a9133f10ba0
Author: Erick Karanja 
Date:   Thu Dec 11 11:59:23 2025 +0300

    drm/radeon : Use devm_i2c_add_adapter instead of i2c_add_adapter
    
    Replace i2c_add_adapter() with devm_i2c_add_adapter() and remove all
    associated cleanup, as devm_i2c_add_adapter() handles adapter teardown
    automatically.
    
    Signed-off-by: Erick Karanja 
    Signed-off-by: Alex Deucher 

commit 0030595c3e8b48b32a12b8354ce9dbe00efd632f
Author: Alex Deucher 
Date:   Fri Oct 10 16:47:02 2025 -0400

    drm/amdgpu: Update AMDGPU_INFO_UQ_FW_AREAS query for sdma
    
    Add a query for sdma queues.  Userspace can use this to
    query the size of the CSA buffers for sdma user queues.
    
    Proposed userspace:
    https://gitlab.freedesktop.org/yogeshmohan/mesa/-/commits/userq_query
    
    Reviewed-by: Prike Liang 
    Signed-off-by: Alex Deucher 

commit 44b69cf1d35cad4a846208e769b34a648fd637bb
Author: Alex Deucher 
Date:   Fri Oct 10 16:44:58 2025 -0400

    drm/amdgpu: Update AMDGPU_INFO_UQ_FW_AREAS query for compute
    
    Add a query for compute queues.  Userspace can use this to
    query the size of the EOP buffers for compute user queues.
    
    Proposed userspace:
    https://gitlab.freedesktop.org/yogeshmohan/mesa/-/commits/userq_query
    
    Reviewed-by: Prike Liang 
    Signed-off-by: Alex Deucher 

commit fb36d71308a770268c771d6697f22615e5ddbd6e
Author: Mark Brown 
Date:   Fri Dec 19 15:29:42 2025 +0000

    kselftest/arm64: Support FORCE_TARGETS
    
    The top level kselftest Makefile supports an option FORCE_TARGETS which
    causes any failures during the build to be propagated to the exit status
    of the top level make, useful during build testing. Currently the recursion
    done by the arm64 selftests ignores this option, meaning arm64 failures are
    not reported via this mechanism. Add the logic to implement FORCE_TARGETS
    so that it works for arm64.
    
    Signed-off-by: Mark Brown 
    Acked-by: Shuah Khan 
    Signed-off-by: Will Deacon 

commit 6fd9be0b7b2e957d24b0490b989658c4d18d92c7
Author: Lifeng Zheng 
Date:   Wed Nov 19 16:13:56 2025 +0800

    arm64: topology: Handle AMU FIE setup on CPU hotplug
    
    Currently, when a cpufreq policy is created, the AMU FIE setup process
    checks all CPUs in the policy -- including those that are offline. If any
    of these CPUs are offline at that time, their AMU capability flag hasn't
    been verified yet, leading the check fail. As a result, AMU FIE is not
    enabled, even if the CPUs that are online do support it.
    
    Later, when the previously offline CPUs come online and report AMU support,
    there's no mechanism in place to re-enable AMU FIE for the policy. This
    leaves the entire frequency domain without AMU FIE, despite being eligible.
    
    Restrict the initial AMU FIE check to only those CPUs that are online at
    the time the policy is created, and allow CPUs that come online later to
    join the policy with AMU FIE enabled.
    
    Signed-off-by: Lifeng Zheng 
    Acked-by: Beata Michalska 
    Signed-off-by: Will Deacon 

commit 4221504c4328d4d9e57962bf530fa52913591139
Author: Lifeng Zheng 
Date:   Wed Nov 19 16:13:55 2025 +0800

    cpufreq: Add new helper function returning cpufreq policy
    
    cpufreq_cpu_get_raw() gets cpufreq policy only if the CPU is in
    policy->cpus mask, which means the CPU is already online. But in some
    cases, the policy is needed before the CPU is added to cpus mask. Add a
    function to get the policy in these cases.
    
    Signed-off-by: Lifeng Zheng 
    Reviewed-by: Rafael J. Wysocki (Intel) 
    Reviewed-by: Jie Zhan 
    Acked-by: Beata Michalska 
    Signed-off-by: Will Deacon 

commit af15bc259e260cbe5221c220d56a716b6facf155
Author: Lifeng Zheng 
Date:   Wed Nov 19 16:13:54 2025 +0800

    arm64: topology: Skip already covered CPUs when setting freq source
    
    The scale freq source of the CPUs in 'amu_fie_cpus' mask are already set to
    AMU tick before, so in amu_fie_setup(), only the CPUs in the 'cpus' mask
    should be set.
    
    Signed-off-by: Lifeng Zheng 
    Reviewed-by: Beata Michalska 
    Reviewed-by: Jie Zhan 
    Acked-by: Beata Michalska 
    Signed-off-by: Will Deacon 

commit b490ddf27be28e64a39c08ae643d7b22561beaf6
Author: Shengjiu Wang 
Date:   Thu Dec 18 15:17:50 2025 +0800

    remoteproc: imx_dsp_rproc: Only reset carveout memory at RPROC_OFFLINE state
    
    Do not reset memory at suspend and resume stage, because some
    memory is used to save the software state for resume, if it is cleared,
    the resume operation can fail.
    
    Fixes: c4c432dfb00f ("remoteproc: imx_dsp_rproc: Add support of recovery and coredump process")
    Signed-off-by: Shengjiu Wang 
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Iuliana Prodan 
    Link: https://lore.kernel.org/r/20251218071750.2692132-1-shengjiu.wang@nxp.com
    Signed-off-by: Mathieu Poirier 

commit e3baa5d4b361276efeb87b20d8beced451a7dbd5
Author: Jinqian Yang 
Date:   Sat Dec 27 17:24:48 2025 +0800

    arm64: Add support for TSV110 Spectre-BHB mitigation
    
    The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
    Buffer) attack, which can be exploited to leak information through
    branch prediction side channels. This commit adds the MIDR of TSV110
    to the list for software mitigation.
    
    Signed-off-by: Jinqian Yang 
    Reviewed-by: Zenghui Yu 
    Signed-off-by: Will Deacon 

commit e97e3e31d898833b2396310056cbf82e23956b36
Author: Hanjun Guo 
Date:   Fri Dec 19 22:49:06 2025 +0800

    MAINTAINERS: Update the maintainers for ARM64 ACPI
    
    ARM64 ACPI patches go via ARM64 tree, but the listed maintainers
    for ARM64 ACPI don't include Catalin and Will, and there is no
    F: line under the ARM64 architecture entry, so emails will not
    route to Catalin and Will in an automatic way.
    
    Adding Catalin and Will to the maintainers entry for ARM64 ACPI
    to fix the problem, it will make life easy for merging ARM64 ACPI
    patches.
    
    Adding new maintainer entries for ARM64 ACPI doesn't mean the review
    work will balance to the new maintainer, patches still need to be
    acked by currently listed folks (Lorenzo, Hanjun, Sudeep) before
    merging them.
    
    Link: https://lore.kernel.org/linux-acpi/aS2ZTfS9YVO98Exe@willie-the-truck/
    Signed-off-by: Hanjun Guo 
    Acked-by: Lorenzo Pieralisi 
    Signed-off-by: Will Deacon 

commit 0c7c64146f707ffe7abd5d11c9828d8129903ab5
Author: Yury Norov (NVIDIA) 
Date:   Mon Dec 15 20:20:03 2025 -0500

    drivers: perf: use bitmap_empty() where appropriate
    
    bitmap_empty() is more verbose and efficient, as it stops traversing
    bitmaps as soon as the 1st set bit found.
    
    Switch perf code to using bitmap_empty() where appropriate, and
    correspondingly use boolean types.
    
    Signed-off-by: Yury Norov (NVIDIA) 
    Signed-off-by: Will Deacon 

commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de
Author: Alexander Grest 
Date:   Mon Dec 8 13:28:57 2025 -0800

    iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
    
    The SMMU CMDQ lock is highly contentious when there are multiple CPUs
    issuing commands and the queue is nearly full.
    
    The lock has the following states:
     - 0:           Unlocked
     - >0:          Shared lock held with count
     - INT_MIN+N:   Exclusive lock held, where N is the # of shared waiters
     - INT_MIN:     Exclusive lock held, no shared waiters
    
    When multiple CPUs are polling for space in the queue, they attempt to
    grab the exclusive lock to update the cons pointer from the hardware. If
    they fail to get the lock, they will spin until either the cons pointer
    is updated by another CPU.
    
    The current code allows the possibility of shared lock starvation
    if there is a constant stream of CPUs trying to grab the exclusive lock.
    This leads to severe latency issues and soft lockups.
    
    Consider the following scenario where CPU1's attempt to acquire the
    shared lock is starved by CPU2 and CPU0 contending for the exclusive
    lock.
    
    CPU0 (exclusive)  | CPU1 (shared)     | CPU2 (exclusive)    | `cmdq->lock`
    --------------------------------------------------------------------------
    trylock() //takes |                   |                     | 0
                      | shared_lock()     |                     | INT_MIN
                      | fetch_inc()       |                     | INT_MIN
                      | no return         |                     | INT_MIN + 1
                      | spins // VAL >= 0 |                     | INT_MIN + 1
    unlock()          | spins...          |                     | INT_MIN + 1
    set_release(0)    | spins...          |                     | 0 see[NOTE]
    (done)            | (sees 0)          | trylock() // takes  | 0
                      | *exits loop*      | cmpxchg(0, INT_MIN) | 0
                      |                   | *cuts in*           | INT_MIN
                      | cmpxchg(0, 1)     |                     | INT_MIN
                      | fails // != 0     |                     | INT_MIN
                      | spins // VAL >= 0 |                     | INT_MIN
                      | *starved*         |                     | INT_MIN
    
    [NOTE] The current code resets the exclusive lock to 0 regardless of the
    state of the lock. This causes two problems:
    1. It opens the possibility of back-to-back exclusive locks and the
       downstream effect of starving shared lock.
    2. The count of shared lock waiters are lost.
    
    To mitigate this, we release the exclusive lock by only clearing the sign
    bit while retaining the shared lock waiter count as a way to avoid
    starving the shared lock waiters.
    
    Also deleted cmpxchg loop while trying to acquire the shared lock as it
    is not needed. The waiters can see the positive lock count and proceed
    immediately after the exclusive lock is released.
    
    Exclusive lock is not starved in that submitters will try exclusive lock
    first when new spaces become available.
    
    Reviewed-by: Mostafa Saleh 
    Reviewed-by: Nicolin Chen 
    Signed-off-by: Alexander Grest 
    Signed-off-by: Jacob Pan 
    Signed-off-by: Will Deacon 

commit 76f88d2edd9f21acad7be8422069403118708455
Author: Vladimir Zapolskiy 
Date:   Wed Dec 31 01:40:40 2025 +0200

    ARM: dts: omap: dra7: Remove bogus #syscon-cells property
    
    There is no such dt binding property as '#syscon-cells', remove it.
    
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://patch.msgid.link/20251230234040.2083889-1-vz@mleia.com
    Signed-off-by: Kevin Hilman 

commit dc717e24deb4e626f4ad4896dd722815ef32311a
Author: Randy Dunlap 
Date:   Mon Dec 29 21:52:30 2025 -0800

    ARM: omap1: drop unused Kconfig symbol
    
    "select ARCH_HAS_HOLES_MEMORYMODEL" was mistakenly merged here
    due to a botched rebase (says Arnd [1]).
    
    Drop that line since that symbol is not used anywhere else in the
    kernel source tree.
    
    [1] https://lore.kernel.org/all/5e335232-89b4-4c35-93bd-efad7e4d8995@app.fastmail.com/
    
    Fixes: 7036440eab3e ("ARM: omap1: enable multiplatform")
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Aaro Koskinen 
    Link: https://patch.msgid.link/20251230055230.3212260-1-rdunlap@infradead.org
    Signed-off-by: Kevin Hilman 

commit 1e79c330713efba3f4200c80e4aa68d7393edfac
Author: Andreas Kemnade 
Date:   Wed Dec 24 10:34:57 2025 +0100

    ARM: dts: ti/omap: omap*: fix watchdog node names
    
    Watchdog nodes should be named watchdog@ and not wdg@. Fix that.
    
    Signed-off-by: Andreas Kemnade 
    Link: https://patch.msgid.link/20251224093457.558477-1-andreas@kemnade.info
    Signed-off-by: Kevin Hilman 

commit 93a04ab480c8bbcb7d9004be139c538c8a0c1bc8
Author: Wentao Liang 
Date:   Wed Dec 17 14:21:22 2025 +0000

    ARM: omap2: Fix reference count leaks in omap_control_init()
    
    The of_get_child_by_name() function increments the reference count
    of child nodes, causing multiple reference leaks in omap_control_init():
    
    1. scm_conf node never released in normal/error paths
    2. clocks node leak when checking existence
    3. Missing scm_conf release before np in error paths
    
    Fix these leaks by adding proper of_node_put() calls and separate error
    handling.
    
    Fixes: e5b635742e98 ("ARM: OMAP2+: control: add syscon support for register accesses")
    Cc: stable@vger.kernel.org
    Signed-off-by: Wentao Liang 
    Reviewed-by: Andreas Kemnade 
    Link: https://patch.msgid.link/20251217142122.1861292-1-vulab@iscas.ac.cn
    Signed-off-by: Kevin Hilman 

commit 9da91ec4a6b22238d9178cbc5679467ea4261df3
Author: Rob Herring (Arm) 
Date:   Fri Dec 12 14:32:12 2025 -0600

    ARM: dts: ti: Drop unused .dtsi
    
    These .dtsi files are not included anywhere in the tree and can't be
    tested.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251212203226.458694-6-robh@kernel.org
    Signed-off-by: Kevin Hilman 

commit 3d43205d0efb4da3e799e969c92e70e4d9e4d124
Author: Kory Maincent (TI.com) 
Date:   Thu Dec 4 10:23:44 2025 +0100

    ARM: dts: Drop am335x-base0033 devicetree
    
    Remove the am335x-base0033 devicetree as it has been non-functional since
    2017 (Linunx v4.14) when the ti,tilcdc,slave binding was removed. The HDMI
    output on this board has been broken for over 8 years without any reported
    issues or attempts to fix it, indicating this devicetree is no longer in
    active use.
    
    Signed-off-by: Kory Maincent (TI.com) 
    Acked-by: Enric Balletbo i Serra 
    Link: https://patch.msgid.link/20251204092346.1076836-1-kory.maincent@bootlin.com
    Signed-off-by: Kevin Hilman 

commit 25332069532ac030b1185bb8084c1a5298c12bea
Author: Alexander Stein 
Date:   Tue Nov 18 16:48:55 2025 +0100

    ARM: dts: tps65910: Add gpio & interrupt properties
    
    The binding document ti,tps65910.yaml requires the controller and
    cells properties for both gpio and interrupts. As they have const and
    fixed values a default can be provided for all users.
    
    Signed-off-by: Alexander Stein 
    Link: https://patch.msgid.link/20251118154856.2015184-1-alexander.stein@ew.tq-group.com
    Signed-off-by: Kevin Hilman 

commit 60884f7a982770b1a64d61be7f96214538756390
Author: Yegor Yefremov 
Date:   Mon Nov 17 12:35:35 2025 +0100

    ARM: dts: omap: enable panic-indicator option
    
    Use onrisc:red:power as a panic indicator.
    
    Signed-off-by: Yegor Yefremov 
    Link: https://patch.msgid.link/20251117113535.2248177-1-yegorslists@googlemail.com
    Signed-off-by: Kevin Hilman 

commit 24571ecbda52f7a43a7dad1f7706bfa81fb1fa79
Author: Andreas Kemnade 
Date:   Thu Nov 6 10:00:27 2025 +0100

    ARM: dts: ti/omap: omap4-epson-embt2ws: add powerbutton
    
    There is a power button connected to the PMIC, so describe it to be able
    to power off the device in a convenient manner.
    
    Signed-off-by: Andreas Kemnade 
    Link: https://patch.msgid.link/20251106-twl6030-button-v4-3-fdf1aa6e1e9a@kernel.org
    Signed-off-by: Kevin Hilman 

commit 968290fa8a42d9d2d2fd0fcdeb82d7533e83071d
Author: Gustavo Sousa 
Date:   Mon Dec 22 19:18:48 2025 -0300

    drm/i915/cdclk: Implement Wa_13012396614
    
    A new workaround was defined for Xe3_LPD, which requires a tweak on how
    we handle MDCLK selection.  Implement it.
    
    Reviewed-by: Dnyaneshwar Bhadane 
    Link: https://patch.msgid.link/20251222-display-wa-13012396614-timing-of-mdclk-source-selection-v1-2-a2f7e9447f7a@intel.com
    Signed-off-by: Gustavo Sousa 

commit 67ccf6c60bc324d78c24893e8c1eb6a62973838d
Author: Gustavo Sousa 
Date:   Mon Dec 22 19:18:47 2025 -0300

    drm/i915/display_wa: Keep enum intel_display_wa sorted
    
    For a consistent way of updating enum intel_display_wa, let's sort it by
    lineage number and add a comment asking for future updates to keep it
    sorted.
    
    In the same way, let's also keep __intel_display_wa() sorted.
    
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20251222-display-wa-13012396614-timing-of-mdclk-source-selection-v1-1-a2f7e9447f7a@intel.com
    Signed-off-by: Gustavo Sousa 

commit 126f61528d34658d80ec827f981c540c1230fdc4
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:47:34 2026 +0100

    soc: ti: knav_dma: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260102124729.63964-10-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Nishanth Menon 

commit 6b222f28999c481a6531c7b5fbbf95f877875d23
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:47:33 2026 +0100

    soc: ti: knav: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260102124729.63964-9-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Nishanth Menon 

commit 9a97b2154ef51dd079bbaf247289e6d82210c03b
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:47:32 2026 +0100

    soc: ti: knav_dma: Simplify error messages in probe
    
    Simplify the code by using dev_err_probe() and local 'dev' variable.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260102124729.63964-8-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Nishanth Menon 

commit c076d74383f1ce2c8db4c83c40c714c8751d5d01
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:47:31 2026 +0100

    soc: ti: knav_dma: Remove ENOMEM printks
    
    Printing messages on ENOMEM errors is redundant and discouraged, because
    core already prints detailed report.  Simplify the code by dropping
    such dev_err().
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260102124729.63964-7-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Nishanth Menon 

commit 168d2fb7805510aba3b0871414ec93c2364f9e23
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:47:30 2026 +0100

    soc: ti: knav_qmss: Remove ENOMEM printks
    
    Printing messages on ENOMEM errors is redundant and discouraged, because
    core already prints detailed report.  Simplify the code by dropping
    such dev_err().
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20260102124729.63964-6-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Nishanth Menon 

commit 234a884d67fe3b5741481e6991f7ccf140c206ae
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:25:37 2025 +0100

    arm64: dts: ti: Use lowercase hex
    
    The DTS code coding style expects lowercase hex for values and unit
    addresses.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251223152535.155571-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Nishanth Menon 

commit c84b6dc36b2f81b79145459a9805302fe5e658f8
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:25:36 2025 +0100

    arm64: dts: ti: Minor whitespace cleanup
    
    The DTS code coding style expects exactly one space around '=' and
    before '{' characters.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251223152535.155571-3-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Nishanth Menon 

commit 529676cabcf4a5046d217bba2c8f3b94a3f6a10f
Author: Eric Dumazet 
Date:   Thu Nov 13 15:45:45 2025 +0000

    x86/lib: Inline csum_ipv6_magic()
    
    Inline this small helper. It has been observed to consume up
    to 0.75%, which is significant for such a small function.
    
    This should reduce register pressure, as saddr and daddr are often
    back to back in memory.
    
    For instance code inlined in tcp6_gro_receive() will look like:
    
     55a:   48 03 73 28             add    0x28(%rbx),%rsi
     55e:   8b 43 70                mov    0x70(%rbx),%eax
     561:   29 f8                   sub    %edi,%eax
     563:   0f c8                   bswap  %eax
     565:   89 c0                   mov    %eax,%eax
     567:   48 05 00 06 00 00       add    $0x600,%rax
     56d:   48 03 46 08             add    0x8(%rsi),%rax
     571:   48 13 46 10             adc    0x10(%rsi),%rax
     575:   48 13 46 18             adc    0x18(%rsi),%rax
     579:   48 13 46 20             adc    0x20(%rsi),%rax
     57d:   48 83 d0 00             adc    $0x0,%rax
     581:   48 89 c6                mov    %rax,%rsi
     584:   48 c1 ee 20             shr    $0x20,%rsi
     588:   01 f0                   add    %esi,%eax
     58a:   83 d0 00                adc    $0x0,%eax
     58d:   89 c6                   mov    %eax,%esi
     58f:   66 31 c0                xor    %ax,%ax
    
    Surprisingly, this inlining does not seem to bloat kernel text size.
    It at least two cases[1], it either has no effect or results in a
    slightly smaller kernel.
    
    1. https://lore.kernel.org/all/CANn89iJzcb_XO9oCApKYfRxsMMmg7BHukRDqWTca3ZLQ8HT0iQ@mail.gmail.com/
    
    [ dhansen: add justification and note about lack of kernel bloat ]
    
    Signed-off-by: Eric Dumazet 
    Signed-off-by: Dave Hansen 
    Acked-by: Dave Hansen 
    Link: https://patch.msgid.link/20251113154545.594580-1-edumazet@google.com

commit 29317f8dc6ed601ec54575689c2cd55cc470bcce
Author: Dan Williams 
Date:   Mon Dec 15 16:56:16 2025 -0800

    cxl/mem: Introduce cxl_memdev_attach for CXL-dependent operation
    
    Unlike the cxl_pci class driver that opportunistically enables memory
    expansion with no other dependent functionality, CXL accelerator drivers
    have distinct PCIe-only and CXL-enhanced operation states. If CXL is
    available some additional coherent memory/cache operations can be enabled,
    otherwise traditional DMA+MMIO over PCIe/CXL.io is a fallback.
    
    This constitutes a new mode of operation where the caller of
    devm_cxl_add_memdev() wants to make a "go/no-go" decision about running
    in CXL accelerated mode or falling back to PCIe-only operation. Part of
    that decision making process likely also includes additional
    CXL-acceleration-specific resource setup. Encapsulate both of those
    requirements into 'struct cxl_memdev_attach' that provides a ->probe()
    callback. The probe callback runs in cxl_mem_probe() context, after the
    port topology is successfully attached for the given memdev. It supports
    a contract where, upon successful return from devm_cxl_add_memdev(),
    everything needed for CXL accelerated operation has been enabled.
    
    Additionally the presence of @cxlmd->attach indicates that the accelerator
    driver be detached when CXL operation ends. This conceptually makes a CXL
    link loss event mirror a PCIe link loss event which results in triggering
    the ->remove() callback of affected devices+drivers. A driver can re-attach
    to recover back to PCIe-only operation. Live recovery, i.e. without a
    ->remove()/->probe() cycle, is left as a future consideration.
    
    [ dj: Repalce with updated commit log from Dan ]
    
    Cc: Smita Koralahalli 
    Reviewed-by: Ben Cheatham 
    Reviewed-by: Dave Jiang 
    Tested-by: Alejandro Lucero 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/20251216005616.3090129-7-dan.j.williams@intel.com
    Signed-off-by: Dan Williams 
    Signed-off-by: Dave Jiang 

commit f2546eba53bbe38c4bb950f78625ccf4b1a2cbc8
Author: Dan Williams 
Date:   Mon Dec 15 16:56:15 2025 -0800

    cxl/mem: Drop @host argument to devm_cxl_add_memdev()
    
    In all cases the device that created the 'struct cxl_dev_state' instance is
    also the device to host the devm cleanup of devm_cxl_add_memdev(). This
    simplifies the function prototype, and limits a degree of freedom of the
    API.
    
    Cc: Smita Koralahalli 
    Reviewed-by: Jonathan Cameron 
    Reviewed-by: Alison Schofield 
    Reviewed-by: Dave Jiang 
    Reviewed-by: Ben Cheatham 
    Tested-by: Alejandro Lucero 
    Link: https://patch.msgid.link/20251216005616.3090129-6-dan.j.williams@intel.com
    Signed-off-by: Dan Williams 
    Signed-off-by: Dave Jiang 

commit 6e1d21903ff213f1384ce43daa279c0965904116
Author: Dan Williams 
Date:   Mon Dec 15 16:56:14 2025 -0800

    cxl/mem: Convert devm_cxl_add_memdev() to scope-based-cleanup
    
    In preparation for adding more setup steps, convert the current
    implementation to scope-based cleanup.
    
    The cxl_memdev_shutdown() is only required after cdev_device_add(). With
    that moved to a helper function it precludes the need to add
    scope-based-handler for that cleanup if devm_add_action_or_reset() fails.
    
    Cc: Smita Koralahalli 
    Reviewed-by: Alison Schofield 
    Reviewed-by: Dave Jiang 
    Reviewed-by: Ben Cheatham 
    Tested-by: Alejandro Lucero 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/20251216005616.3090129-5-dan.j.williams@intel.com
    Signed-off-by: Dan Williams 
    Signed-off-by: Dave Jiang 

commit ae201a0092362ffdec7206efa1ec85e260fab8d2
Author: Dan Williams 
Date:   Mon Dec 15 16:56:13 2025 -0800

    cxl/port: Arrange for always synchronous endpoint attach
    
    Make it so that upon return from devm_cxl_add_endpoint() that
    cxl_mem_probe() can assume that the endpoint has had a chance to complete
    cxl_port_probe().  I.e. cxl_port module loading has completed prior to
    device registration.
    
    Delete the MODULE_SOFTDEP() as it is not sufficient for this purpose, but a
    hard link-time dependency is reliable. Specifically MODULE_SOFTDEP() does
    not guarantee that the module loading has completed prior to the completion
    of the current module's init.
    
    Cc: Smita Koralahalli 
    Cc: Alejandro Lucero 
    Reviewed-by: Jonathan Cameron 
    Tested-by: Alison Schofield 
    Reviewed-by: Alison Schofield 
    Reviewed-by: Ben Cheatham 
    Reviewed-by: Dave Jiang 
    Tested-by: Alejandro Lucero 
    Link: https://patch.msgid.link/20251216005616.3090129-4-dan.j.williams@intel.com
    Signed-off-by: Dan Williams 
    Signed-off-by: Dave Jiang 

commit 1f1cb7f0c25574cf51501f8c8cece0047d7e8848
Author: Dan Williams 
Date:   Mon Dec 15 16:56:12 2025 -0800

    cxl/mem: Arrange for always-synchronous memdev attach
    
    In preparation for CXL accelerator drivers that have a hard dependency on
    CXL capability initialization, arrange for cxl_mem_probe() to always run
    synchronous with the device_add() of cxl_memdev instances. I.e.
    cxl_mem_driver registration is always complete before the first memdev
    creation event.
    
    At present, cxl_pci does not care about the attach state of the cxl_memdev
    because all generic memory expansion functionality can be handled by the
    cxl_core. For accelerators, however, that driver needs to perform driver
    specific initialization if CXL is available, or execute a fallback to PCIe
    only operation.
    
    This synchronous attach guarantee is also needed for Soft Reserve Recovery,
    which is an effort that needs to assert that devices have had a chance to
    attach before making a go / no-go decision on proceeding with CXL subsystem
    initialization.
    
    By moving devm_cxl_add_memdev() to cxl_mem.ko it removes async module
    loading as one reason that a memdev may not be attached upon return from
    devm_cxl_add_memdev().
    
    Cc: Smita Koralahalli 
    Cc: Alejandro Lucero 
    Reviewed-by: Jonathan Cameron 
    Tested-by: Alison Schofield 
    Reviewed-by: Alison Schofield 
    Reviewed-by: Ben Cheatham 
    Reviewed-by: Dave Jiang 
    Tested-by: Alejandro Lucero 
    Link: https://patch.msgid.link/20251216005616.3090129-3-dan.j.williams@intel.com
    Signed-off-by: Dan Williams 
    Signed-off-by: Dave Jiang 

commit 10016118b6fade907143a32a7aeaa777063dc79c
Author: Dan Williams 
Date:   Mon Dec 15 16:56:11 2025 -0800

    cxl/mem: Fix devm_cxl_memdev_edac_release() confusion
    
    A device release method is only for undoing allocations on the path to
    preparing the device for device_add(). In contrast, devm allocations are
    post device_add(), are acquired during / after ->probe() and are released
    synchronous with ->remove().
    
    So, a "devm" helper in a "release" method is a clear anti-pattern.
    
    Move this devm release action where it belongs, an action created at edac
    object creation time. Otherwise, this leaks resources until
    cxl_memdev_release() time which may be long after these xarray and error
    record caches have gone idle.
    
    Note, this also fixes up the type of @cxlmd->err_rec_array which needlessly
    dropped type-safety.
    
    Fixes: 0b5ccb0de1e2 ("cxl/edac: Support for finding memory operation attributes from the current boot")
    Cc: Dave Jiang 
    Cc: Jonathan Cameron 
    Cc: Shiju Jose 
    Cc: Alison Schofield 
    Reviewed-by: Alison Schofield 
    Reviewed-by: Ben Cheatham 
    Reviewed-by: Dave Jiang 
    Reviewed-by: Jonathan Cameron 
    Tested-by: Shiju Jose 
    Reviewed-by: Shiju Jose 
    Tested-by: Alejandro Lucero 
    Link: https://patch.msgid.link/20251216005616.3090129-2-dan.j.williams@intel.com
    Signed-off-by: Dan Williams 
    Signed-off-by: Dave Jiang 

commit 349d4efadc1f831ebc0b872ba1e3a2b7dd58b72b
Author: Hans de Goede 
Date:   Mon Jan 5 16:51:34 2026 +0100

    drm/panel: edp: add BOE NV140WUM-T08 panel
    
    Add powerseq timing info for the BOE NV140WUM-T08 panel used on Lenovo
    Thinkpad T14s gen 6 (Snapdragon X1 Elite) laptops.
    
    edid-decode (hex):
    
    00 ff ff ff ff ff ff 00 09 e5 26 0c 00 00 00 00
    0a 21 01 04 a5 1e 13 78 03 d6 62 99 5e 5a 8e 27
    25 53 58 00 00 00 01 01 01 01 01 01 01 01 01 01
    01 01 01 01 01 01 33 3f 80 dc 70 b0 3c 40 30 20
    36 00 2e bc 10 00 00 1a 00 00 00 fd 00 28 3c 4c
    4c 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42
    4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fe
    00 4e 56 31 34 30 57 55 4d 2d 54 30 38 0a 00 fa
    
    Signed-off-by: Hans de Goede 
    Reviewed-by: Douglas Anderson 
    Signed-off-by: Douglas Anderson 
    Link: https://patch.msgid.link/20260105155134.83266-1-johannes.goede@oss.qualcomm.com

commit a089d585a7f4fa85b5e1d78c5308e27a0d875b17
Author: Tao Zhang 
Date:   Tue Dec 23 18:09:53 2025 +0800

    coresight: tpda: add sysfs node to flush specific port
    
    Setting bit i in the TPDA_FLUSH_CR register initiates a flush request
    for port i, forcing the data to synchronize and be transmitted to the
    sink device.
    
    Signed-off-by: Tao Zhang 
    Reviewed-by: James Clark 
    Co-developed-by: Jie Gan 
    Signed-off-by: Jie Gan 
    [ Fix kernel version in Documentation ]
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251223-add_sysfs_nodes_to_configure_tpda-v8-4-4c95db608b62@oss.qualcomm.com

commit 33f04ead7c498f29bca875783f13542e5ccd17ac
Author: Tao Zhang 
Date:   Tue Dec 23 18:09:52 2025 +0800

    coresight: tpda: add logic to configure TPDA_SYNCR register
    
    The TPDA_SYNC counter tracks the number of bytes transferred from the
    aggregator. When this count reaches the value programmed in the
    TPDA_SYNCR register, an ASYNC request is triggered, allowing userspace
    tools to accurately parse each valid packet.
    
    Signed-off-by: Tao Zhang 
    Reviewed-by: James Clark 
    Co-developed-by: Jie Gan 
    Signed-off-by: Jie Gan 
    [ Fix kernel version in Documentation ]
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251223-add_sysfs_nodes_to_configure_tpda-v8-3-4c95db608b62@oss.qualcomm.com

commit 8e1c358a3b0e69eb527bb6723366b92e982235c3
Author: Jie Gan 
Date:   Tue Dec 23 18:09:51 2025 +0800

    coresight: tpda: add global_flush_req sysfs node
    
    Setting the global_flush_req register to 1 initiates a flush request for
    all enabled TPDA input ports. The register remains set until the flush
    operation is complete.
    
    Signed-off-by: Jie Gan 
    [ Fix kernel version in the Documentation ]
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251223-add_sysfs_nodes_to_configure_tpda-v8-2-4c95db608b62@oss.qualcomm.com

commit f9cc5b5a9e9a84d423cdc48882f1c93f1f90a32b
Author: Tao Zhang 
Date:   Tue Dec 23 18:09:50 2025 +0800

    coresight: tpda: add sysfs nodes for tpda cross-trigger configuration
    
    Introduce sysfs nodes to configure cross-trigger parameters for TPDA.
    These registers define the characteristics of cross-trigger packets,
    including generation frequency and flag values.
    
    Signed-off-by: Tao Zhang 
    Reviewed-by: James Clark 
    Co-developed-by: Jie Gan 
    Signed-off-by: Jie Gan 
    [ Fix kernel version in the Documentation ]
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251223-add_sysfs_nodes_to_configure_tpda-v8-1-4c95db608b62@oss.qualcomm.com

commit 41e2424651f7c679382bb9e32225d3b541d4aa8d
Author: Sushrut Shree Trivedi 
Date:   Fri Nov 28 18:49:28 2025 +0800

    arm64: dts: qcom: monaco-evk: Enable PCIe0 and PCIe1.
    
    PCIe0 is routed to an m.2 E key connector on the mainboard for wifi
    attaches while PCIe1 routes to a standard PCIe x4 expansion slot.
    Hence, enable the PCIe0 and PCIe1 controller and phy-nodes.
    
    Signed-off-by: Sushrut Shree Trivedi 
    Signed-off-by: Ziyue Zhang 
    Link: https://lore.kernel.org/r/20251128104928.4070050-7-ziyue.zhang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit cdb613a84527197f88f8bff3c5ee015e611a8373
Author: Ziyue Zhang 
Date:   Fri Nov 28 18:49:27 2025 +0800

    arm64: dts: qcom: qcs8300-ride: enable pcie1 interface
    
    Add configurations in devicetree for PCIe1, board related gpios,
    PMIC regulators, etc for qcs8300-ride platform.
    
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Ziyue Zhang 
    Link: https://lore.kernel.org/r/20251128104928.4070050-6-ziyue.zhang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 7565ec0170201aca07c9e1c3b5b6f213c5024599
Author: Ziyue Zhang 
Date:   Fri Nov 28 18:49:26 2025 +0800

    arm64: dts: qcom: qcs8300: enable pcie1
    
    Add configurations in devicetree for PCIe1, including registers, clocks,
    interrupts and phy setting sequence.
    
    Add PCIe lane equalization preset properties for 8 GT/s and 16GT/s.
    
    Acked-by: Konrad Dybcio 
    Reviewed-by: Manivannan Sadhasivam 
    Signed-off-by: Ziyue Zhang 
    Link: https://lore.kernel.org/r/20251128104928.4070050-5-ziyue.zhang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 33967eadb2153d92ea1de6e9c9ac8ade21c74d86
Author: Ziyue Zhang 
Date:   Fri Nov 28 18:49:25 2025 +0800

    arm64: dts: qcom: qcs8300-ride: enable pcie0 interface
    
    Add configurations in devicetree for PCIe0, board related gpios,
    PMIC regulators, etc for qcs8300-ride board.
    
    Reviewed-by: Manivannan Sadhasivam 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Ziyue Zhang 
    Link: https://lore.kernel.org/r/20251128104928.4070050-4-ziyue.zhang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 46a7c01e7e9d296ba09bad579ae0277cfb558b24
Author: Ziyue Zhang 
Date:   Fri Nov 28 18:49:24 2025 +0800

    arm64: dts: qcom: qcs8300: enable pcie0
    
    Add configurations in devicetree for PCIe0, including registers, clocks,
    interrupts and phy setting sequence.
    
    Add PCIe lane equalization preset properties for 8 GT/s and 16GT/s
    
    Reviewed-by: Manivannan Sadhasivam 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Ziyue Zhang 
    Link: https://lore.kernel.org/r/20251128104928.4070050-3-ziyue.zhang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 8d83fd4f08f655d0fd3c9c1fdfb7243f9116126c
Author: Harshal Dev 
Date:   Tue Dec 23 10:18:16 2025 +0530

    arm64: dts: qcom: x1e80100: add TRNG node
    
    The x1e80100 SoC has a True Random Number Generator, add the node with
    the correct compatible set.
    
    Reviewed-by: Dmitry Baryshkov 
    Tested-by: Wenjia Zhang 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Harshal Dev 
    Reviewed-by: Abel Vesa 
    Link: https://lore.kernel.org/r/20251223-trng_dt_binding_x1e80100-v4-2-5bfe781f9c7b@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 1c6192ec9c4ab8bdb7b2cf8763b7ef7e38671ffe
Author: Krzysztof Kozlowski 
Date:   Mon Dec 29 12:57:35 2025 +0100

    arm64: dts: qcom: sm8750: Fix BAM DMA probing
    
    Bindings always required "qcom,num-ees" and "num-channels" properties,
    as reported by dtbs_check:
    
      sm8750-mtp.dtb: dma-controller@1dc4000 (qcom,bam-v1.7.4): 'anyOf' conditional failed, one must be fixed:
        'qcom,powered-remotely' is a required property
        'num-channels' is a required property
        'qcom,num-ees' is a required property
        'clocks' is a required property
        'clock-names' is a required property
    
    However since commit 5068b5254812 ("dmaengine: qcom: bam_dma: Fix DT
    error handling for num-channels/ees") missing properties are actually
    fatal and BAM does not probe:
    
      bam-dma-engine 1dc4000.dma-controller: num-channels unspecified in dt
      bam-dma-engine 1dc4000.dma-controller: probe with driver bam-dma-engine failed with error -22
    
    Fixes: eeb0f3e4ea67 ("arm64: dts: qcom: sm8750: Add QCrypto nodes")
    Cc: stable@vger.kernel.org
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251229115734.205744-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 12a94953c37e834c3eabb839ce057094946fe67a
Author: Robin Murphy 
Date:   Mon Nov 24 16:39:54 2025 +0000

    perf/arm-cmn: Support CMN-600AE
    
    The functional safety features of CMN-600AE have little to no impact on
    the PMU relative to the base CMN-600 design, so for simplicity we can
    reasonably just treat it as the same thing. The only obvious difference
    is that the revision numbers aren't aligned, so we may hide some aliases
    for events which do actually exist, but those can still be specified via
    the underlying "type,eventid" format so it's not too big a deal.
    
    Signed-off-by: Robin Murphy 
    Reviewed-by: Ilkka Koskinen 
    Tested-by: Michal Simek 
    Signed-off-by: Will Deacon 

commit 98cc091262effcdbdeb1c2ee0a25981aefd2274c
Author: Jinjie Ruan 
Date:   Mon Dec 1 20:06:33 2025 +0800

    arm64: Avoid memcpy() for syscall_get_arguments()
    
    Do not use memcpy() to extract syscall arguments from struct pt_regs
    but rather just perform direct assignments.
    
    Update syscall_set_arguments() too to keep syscall_get_arguments()
    and syscall_set_arguments() in sync.
    
    With Generic Entry patch[1] and turn on audit, the performance
    benchmarks from perf bench basic syscall on kunpeng920 gives roughly
    a 1% performance uplift.
    
    | Metric     | W/O this patch | With this patch | Change    |
    | ---------- | -------------- | --------------- | --------- |
    | Total time | 2.241 [sec]    | 2.211 [sec]     |  ↓1.36%   |
    | usecs/op   | 0.224157       | 0.221146        |  ↓1.36%   |
    | ops/sec    | 4,461,157      | 4,501,409       |  ↑0.9%    |
    
    Disassembly shows that using direct assignment causes
    syscall_set_arguments() to be inlined and cuts the instruction count by
    five or six compared to memcpy(). Because __audit_syscall_entry() only
    uses four syscall arguments, the compiler has also elided the copy of
    regs->regs[4] and regs->regs[5].
    
    Before:
    :
           aa0103e2        mov     x2, x1
           91002003        add     x3, x0, #0x8
           f9408804        ldr     x4, [x0, #272]
           f8008444        str     x4, [x2], #8
           a9409404        ldp     x4, x5, [x0, #8]
           a9009424        stp     x4, x5, [x1, #8]
           a9418400        ldp     x0, x1, [x0, #24]
           a9010440        stp     x0, x1, [x2, #16]
           f9401060        ldr     x0, [x3, #32]
           f9001040        str     x0, [x2, #32]
           d65f03c0        ret
           d503201f        nop
    
    After:
           a9408e82        ldp     x2, x3, [x20, #8]
           2a1603e0        mov     w0, w22
           f9400e84        ldr     x4, [x20, #24]
           f9408a81        ldr     x1, [x20, #272]
           9401c4ba        bl      ffff800080215ca8 <__audit_syscall_entry>
    
    This also aligns the implementation with x86 and RISC-V.
    
    [1]: https://lore.kernel.org/all/20251126071446.3234218-1-ruanjinjie@huawei.com/
    
    Signed-off-by: Jinjie Ruan 
    Signed-off-by: Will Deacon 

commit 35c3dcb1ac2c7e347b38f3b0bccb0a2d1dbda25c
Author: Jinjie Ruan 
Date:   Mon Dec 1 20:06:32 2025 +0800

    syscall.h: Remove unused SYSCALL_MAX_ARGS
    
    The "SYSCALL_MAX_ARGS" appears to have been unused since
    commit 32d92586629a ("syscalls: Remove start and number from
    syscall_set_arguments() args"), so remove it.
    
    Fixes: 32d92586629a ("syscalls: Remove start and number from syscall_set_arguments() args")
    Signed-off-by: Jinjie Ruan 
    Reviewed-by: Russell King (Oracle) 
    Signed-off-by: Will Deacon 

commit 6691966f4afc06c674b7679a772b7423cd16c545
Author: Abhinaba Rakshit 
Date:   Wed Dec 24 14:03:02 2025 +0530

    arm64: dts: qcom: monaco: add QCrypto node
    
    Add Qualcomm Crypto Engine device node for Monaco platform.
    
    QCE and Crypto DMA nodes patch was applied as part of
    commit a86d84409947 ("arm64: dts: qcom: qcs8300: add QCrypto nodes"),
    however was partially reverted by commit cdc117c40537 ("arm64: dts: qcom:
    qcs8300: Partially revert "arm64: dts: qcom: qcs8300: add QCrypto nodes"")
    due to compatible string being mismatched against schema.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Abhinaba Rakshit 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251224-enable-qualcomm-crypto-engine-for-monaco-v3-1-6073430bbc13@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 173c43d0e4a435a95568d6b912d0d45c37d6d75f
Author: Abhinaba Rakshit 
Date:   Wed Dec 24 15:50:24 2025 +0530

    arm64: dts: qcom: lemans: add QCrypto node
    
    Add Qualcomm Crypto Engine device node for LeMans platform.
    
    QCE and Crypto DMA nodes patch was applied as part of the
    commit 7ff3da43ef44 ("arm64: dts: qcom: sa8775p: add QCrypto nodes"),
    however was partially reverted by commit 92979f12a201 ("arm64: dts: qcom:
    sa8775p: Partially revert "arm64: dts: qcom: sa8775p: add QCrypto nodes"")
    due to compatible-string being miss-matched against schema.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Abhinaba Rakshit 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251224-enable-qualcomm-crypto-engine-for-lemans-v2-1-a707e3d38765@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a1a515c21dd70d1b761ccbf6efc9dd1ba6d26d77
Author: Dmitry Baryshkov 
Date:   Wed Dec 24 03:09:13 2025 +0200

    arm64: dts: qcom: x1e80100-medion-sprchrgd-14-s1: correct firmware paths
    
    Per the agreement, the firmware paths (even for devices not supported in
    linux-firmware) should follow the SoC/Vendor/device pattern. Update
    firmware names for Medion SPRCHRGD 14 S1 to follow that pattern.
    
    Fixes: 8cf65490cdb0 ("arm64: dts: qcom: Add dts for Medion SPRCHRGD 14 S1")
    Cc: Georg Gottleuber 
    Signed-off-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251224-fix-medion-v1-1-305747dff79a@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 48462620960069b043cbbf809c48a2bfcffd9368
Author: Osama Abdelkader 
Date:   Thu Nov 27 00:31:30 2025 +0200

    arm64: simplify arch_uprobe_xol_was_trapped return
    
    convert arch_uprobe_xol_was_trapped() from explicit if/return true
    return false pattern to direct boolean expression return in
    arch/arm64/kernel/probes/uprobes.c
    
    Signed-off-by: Osama Abdelkader 
    Reviewed-by: Anshuman Khandual 
    Acked-by: Masami Hiramatsu (Google) 
    Signed-off-by: Will Deacon 

commit 7db5fbe508deedec6c183d5056cf3c504c027f40
Author: Vladimir Zapolskiy 
Date:   Fri Dec 26 02:39:23 2025 +0200

    arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147
    
    Trivial change, Analog Devices vendor prefix is "adi", but there is
    a valid "ad" vendor prefix of another company, this may explain why
    the issue hasn't been discovered by the automatic tests.
    
    A problem of not described compatible value is out of this change scope.
    
    Fixes: c636eeb751f6 ("arm64: dts: qcom: msm8994-octagon: Add AD7147 and APDS9930 sensors")
    Signed-off-by: Vladimir Zapolskiy 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251226003923.3341904-1-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit 0907cab01ff9746ecf08592edd9bd85d2636be58
Author: Abel Vesa 
Date:   Wed Dec 24 12:53:29 2025 +0200

    arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs
    
    The DP PHYs on X1E80100 need the ref clock which is provided by the
    TCSR CC.
    
    The current X Elite devices supported upstream work fine without this
    clock, because the boot firmware leaves this clock enabled. But we should
    not rely on that. Also, even though this change breaks the ABI, it is
    needed in order to make the driver disables this clock along with the
    other ones, for a proper bring-down of the entire PHY.
    
    So lets attach it to each of the DP PHYs in order to do that.
    
    Cc: stable@vger.kernel.org # v6.9
    Fixes: 1940c25eaa63 ("arm64: dts: qcom: x1e80100: Add display nodes")
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Abel Vesa 
    Link: https://lore.kernel.org/r/20251224-phy-qcom-edp-add-missing-refclk-v5-3-3f45d349b5ac@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 09d87fdd83894bf3df4ecb79296d03c7a1ac24c3
Author: Krishna Kurapati 
Date:   Fri Dec 19 23:01:08 2025 +0530

    arm64: dts: qcom: sm8750-mtp: Add eusb2 repeater tuning parameters
    
    Add eusb2 repeater tuning parameters for MTP platform.
    
    Signed-off-by: Krishna Kurapati 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251219173108.2119296-4-krishna.kurapati@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a502697b840d8377742e1f31000cb52695df33e7
Author: Vincent Knecht 
Date:   Sun Jan 4 19:31:53 2026 +0100

    arm64: dts: qcom: msm8939: Add camss and cci
    
    Add the camera subsystem and CCI used to interface with cameras on the
    Snapdragon 615.
    
    Signed-off-by: Vincent Knecht 
    [André: Make order of items the same as in 8916]
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: André Apitzsch 
    Link: https://lore.kernel.org/r/20260104-camss-8x39-vbif-v9-1-0d47c7afbb2f@apitzsch.eu
    Signed-off-by: Bjorn Andersson 

commit 623ba6ea45979fb1d06c5c8f03417ecc3565a851
Author: Gary Guo 
Date:   Mon Jan 5 15:00:57 2026 +0000

    perf symbol: Remove Rust symbol workarounds
    
    Due to an off-by-one error introduced in commit 73bbb94466fd3f8b
    ("kallsyms: support "big" kernel symbols"), long symbols (which are
    currently only produced by Rust) can have their symbol type being
    wrongly parsed by kernel/kallsyms.c.
    
    This has been fixed in commit f3f9f42232dee596 ("kallsyms: Fix wrong
    "big" kernel symbol type read from procfs"), and these symbols are now
    reported correctly.
    
    Drop the workaround in perf symbol that filter out these symbol types.
    
    Specifically, '1' and 'l' can never be generated by nm -- 'u' does
    indicate GNU unique, however such symbols are only generated by G++ for
    C++ templates, and are never generated by LLVM (LLVM generates weak
    symbols in such cases instead).
    
    'N' can appear if symbols exist inside debug sections, and 'n' may
    appear for symbols inside note sections, however these sections do not
    typically have symbol (and they're explicitly filtered out by kallsyms).
    
    Therefore, the previous occurrence of these symbols types must be due to
    the off-by-one error and can be safely removed.
    
    Signed-off-by: Gary Guo 
    Acked-by: Miguel Ojeda 
    Cc: Adrian Hunter 
    Cc: Alexander Shishkin 
    Cc: Alice Ryhl 
    Cc: Andi Kleen 
    Cc: Andreas Hindborg 
    Cc: Benno Lossin 
    Cc: Bill Wendling 
    Cc: Björn Roy Baron 
    Cc: Boqun Feng 
    Cc: Danilo Krummrich 
    Cc: Dmitriy Vyukov 
    Cc: Ian Rogers 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Justin Stitt 
    Cc: Mark Rutland 
    Cc: Namhyung Kim 
    Cc: Nathan Chancellor 
    Cc: Nick Desaulniers 
    Cc: Peter Zijlstra 
    Cc: Stephen Brennan 
    Cc: Trevor Gross 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit c10d860e0baae0853773dc90a94b26adc5687380
Author: Peter Zijlstra 
Date:   Mon Jan 5 16:24:05 2026 +0100

    tags: Add regex for context_lock_struct
    
    With the introduction of compiler context analysis (LLVM
    ThreadSafetyAnalysis) the struct definition of various locks get
    wrapped in a macro. This hides them from tags based navigation,
    although clangd/LSP sees right through it and works as expected.
    
    Add a regex to the tags script to help it along.
    
    Requested-by: Bart Van Assche 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251220133307.GR3707891@noisy.programming.kicks-ass.net

commit 04e49d926f438134b6453505aa206e70f8cf4cb1
Author: Marco Elver 
Date:   Fri Dec 19 16:40:25 2025 +0100

    sched: Enable context analysis for core.c and fair.c
    
    This demonstrates a larger conversion to use Clang's context
    analysis. The benefit is additional static checking of locking rules,
    along with better documentation.
    
    Notably, kernel/sched contains sufficiently complex synchronization
    patterns, and application to core.c & fair.c demonstrates that the
    latest Clang version has become powerful enough to start applying this
    to more complex subsystems (with some modest annotations and changes).
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-37-elver@google.com

commit dc36d55d4e7259ff0f91a154744125ccc2228171
Author: Marco Elver 
Date:   Fri Dec 19 16:40:24 2025 +0100

    crypto: Enable context analysis
    
    Enable context analysis for crypto subsystem.
    
    This demonstrates a larger conversion to use Clang's context
    analysis. The benefit is additional static checking of locking rules,
    along with better documentation.
    
    Note the use of the __acquire_ret macro how to define an API where a
    function returns a pointer to an object (struct scomp_scratch) with a
    lock held. Additionally, the analysis only resolves aliases where the
    analysis unambiguously sees that a variable was not reassigned after
    initialization, requiring minor code changes.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-36-elver@google.com

commit 87335b61a23bd10e4aec132bd3a48a009d406973
Author: Marco Elver 
Date:   Fri Dec 19 16:40:23 2025 +0100

    security/tomoyo: Enable context analysis
    
    Enable context analysis for security/tomoyo.
    
    This demonstrates a larger conversion to use Clang's context
    analysis. The benefit is additional static checking of locking rules,
    along with better documentation.
    
    Tomoyo makes use of several synchronization primitives, yet its clear
    design made it relatively straightforward to enable context analysis.
    
    One notable finding was:
    
      security/tomoyo/gc.c:664:20: error: reading variable 'write_buf' requires holding mutex '&tomoyo_io_buffer::io_sem'
        664 |                 is_write = head->write_buf != NULL;
    
    For which Tetsuo writes:
    
      "Good catch. This should be data_race(), for tomoyo_write_control()
       might concurrently update head->write_buf from non-NULL to non-NULL
       with head->io_sem held."
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-35-elver@google.com

commit 8ec56d9aaba9667b0c6429de7aeb4ec691944a5e
Author: Marco Elver 
Date:   Fri Dec 19 16:40:22 2025 +0100

    printk: Move locking annotation to printk.c
    
    With Sparse support gone, Clang is a bit more strict and warns:
    
    ./include/linux/console.h:492:50: error: use of undeclared identifier 'console_mutex'
      492 | extern void console_list_unlock(void) __releases(console_mutex);
    
    Since it does not make sense to make console_mutex itself global, move
    the annotation to printk.c. Context analysis remains disabled for
    printk.c.
    
    This is needed to enable context analysis for modules that include
    .
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-34-elver@google.com

commit 322366b8f13a8cafe169dc1dc6f6ec0d82ff8734
Author: Marco Elver 
Date:   Fri Dec 19 16:40:21 2025 +0100

    rhashtable: Enable context analysis
    
    Enable context analysis for rhashtable, which was used as an initial
    test as it contains a combination of RCU, mutex, and bit_spinlock usage.
    
    Users of rhashtable now also benefit from annotations on the API, which
    will now warn if the RCU read lock is not held where required.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-33-elver@google.com

commit c3d3023f1cf3de10f2d2f83b0d011fa7cab16cf0
Author: Marco Elver 
Date:   Fri Dec 19 16:40:20 2025 +0100

    stackdepot: Enable context analysis
    
    Enable context analysis for stackdepot.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-32-elver@google.com

commit 0eaa911f890812a7868a44bbfd656636b2c7caf8
Author: Marco Elver 
Date:   Fri Dec 19 16:40:19 2025 +0100

    kcsan: Enable context analysis
    
    Enable context analysis for the KCSAN subsystem.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-31-elver@google.com

commit 6556fde265a7bd408ad8ff15ec08970f99f6201c
Author: Marco Elver 
Date:   Fri Dec 19 16:40:18 2025 +0100

    kcov: Enable context analysis
    
    Enable context analysis for the KCOV subsystem.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-30-elver@google.com

commit 0f5d764862aa7f50d77b8ea2b4f75a48a630487a
Author: Marco Elver 
Date:   Fri Dec 19 16:40:17 2025 +0100

    kfence: Enable context analysis
    
    Enable context analysis for the KFENCE subsystem.
    
    Notable, kfence_handle_page_fault() required minor restructure, which
    also fixed a subtle race; arguably that function is more readable now.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-29-elver@google.com

commit 48eb4b9a3d5c305f93d3cfd0eddffa305884597f
Author: Marco Elver 
Date:   Fri Dec 19 16:40:16 2025 +0100

    MAINTAINERS: Add entry for Context Analysis
    
    Add entry for all new files added for Clang's context analysis.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/20251219154418.3592607-28-elver@google.com

commit 3635ad878242487fc3e8165d0329aedb118e4608
Author: Marco Elver 
Date:   Fri Dec 19 16:40:15 2025 +0100

    compiler: Let data_race() imply disabled context analysis
    
    Many patterns that involve data-racy accesses often deliberately ignore
    normal synchronization rules to avoid taking a lock.
    
    If we have a lock-guarded variable on which we do a lock-less data-racy
    access, rather than having to write context_unsafe(data_race(..)),
    simply make the data_race(..) macro imply context-unsafety. The
    data_race() macro already denotes the intent that something subtly
    unsafe is about to happen, so it should be clear enough as-is.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-27-elver@google.com

commit c237f1ceeef56fa101c2b599a00307b3d690801a
Author: Marco Elver 
Date:   Fri Dec 19 16:40:14 2025 +0100

    compiler-context-analysis: Introduce header suppressions
    
    While we can opt in individual subsystems which add the required
    annotations, such subsystems inevitably include headers from other
    subsystems which may not yet have the right annotations, which then
    result in false positive warnings.
    
    Making compatible by adding annotations across all common headers
    currently requires an excessive number of __no_context_analysis
    annotations, or carefully analyzing non-trivial cases to add the correct
    annotations. While this is desirable long-term, providing an incremental
    path causes less churn and headaches for maintainers not yet interested
    in dealing with such warnings.
    
    Rather than clutter headers unnecessary and mandate all subsystem
    maintainers to keep their headers working with context analysis,
    suppress all -Wthread-safety warnings in headers. Explicitly opt in
    headers with context-enabled primitives.
    
    With this in place, we can start enabling the analysis on more complex
    subsystems in subsequent changes.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-26-elver@google.com

commit e4588c25c9d122b5847b88e18b184404b6959160
Author: Marco Elver 
Date:   Fri Dec 19 16:40:13 2025 +0100

    compiler-context-analysis: Remove __cond_lock() function-like helper
    
    As discussed in [1], removing __cond_lock() will improve the readability
    of trylock code. Now that Sparse context tracking support has been
    removed, we can also remove __cond_lock().
    
    Change existing APIs to either drop __cond_lock() completely, or make
    use of the __cond_acquires() function attribute instead.
    
    In particular, spinlock and rwlock implementations required switching
    over to inline helpers rather than statement-expressions for their
    trylock_* variants.
    
    Suggested-by: Peter Zijlstra 
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://lore.kernel.org/all/20250207082832.GU7145@noisy.programming.kicks-ass.net/ [1]
    Link: https://patch.msgid.link/20251219154418.3592607-25-elver@google.com

commit 5b63d0ae94ccfd64dcbdb693d88eb3650eb3c64c
Author: Marco Elver 
Date:   Fri Dec 19 16:40:12 2025 +0100

    compiler-context-analysis: Remove Sparse support
    
    Remove Sparse support as discussed at [1].
    
    The kernel codebase is still scattered with numerous places that try to
    appease Sparse's context tracking ("annotation for sparse", "fake out
    sparse", "work around sparse", etc.). Eventually, as more subsystems
    enable Clang's context analysis, these places will show up and need
    adjustment or removal of the workarounds altogether.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://lore.kernel.org/all/20250207083335.GW7145@noisy.programming.kicks-ass.net/ [1]
    Link: https://lore.kernel.org/all/Z6XTKTo_LMj9KmbY@elver.google.com/ [2]
    Link: https://patch.msgid.link/20251219154418.3592607-24-elver@google.com

commit 4f109baeea4dc6fa1426ab559159d3bb35e05343
Author: Marco Elver 
Date:   Fri Dec 19 16:40:11 2025 +0100

    um: Fix incorrect __acquires/__releases annotations
    
    With Clang's context analysis, the compiler is a bit more strict about
    what goes into the __acquires/__releases annotations and can't refer to
    non-existent variables.
    
    On an UM build, mm_id.h is transitively included into mm_types.h, and we
    can observe the following error (if context analysis is enabled in e.g.
    stackdepot.c):
    
       In file included from lib/stackdepot.c:17:
       In file included from include/linux/debugfs.h:15:
       In file included from include/linux/fs.h:5:
       In file included from include/linux/fs/super.h:5:
       In file included from include/linux/fs/super_types.h:7:
       In file included from include/linux/list_lru.h:14:
       In file included from include/linux/xarray.h:16:
       In file included from include/linux/gfp.h:7:
       In file included from include/linux/mmzone.h:22:
       In file included from include/linux/mm_types.h:26:
       In file included from arch/um/include/asm/mmu.h:12:
    >> arch/um/include/shared/skas/mm_id.h:24:54: error: use of undeclared identifier 'turnstile'
          24 | void enter_turnstile(struct mm_id *mm_id) __acquires(turnstile);
             |                                                      ^~~~~~~~~
       arch/um/include/shared/skas/mm_id.h:25:53: error: use of undeclared identifier 'turnstile'
          25 | void exit_turnstile(struct mm_id *mm_id) __releases(turnstile);
             |                                                     ^~~~~~~~~
    
    One (discarded) option was to use token_context_lock(turnstile) to just
    define a token with the already used name, but that would not allow the
    compiler to distinguish between different mm_id-dependent instances.
    
    Another constraint is that struct mm_id is only declared and incomplete
    in the header, so even if we tried to construct an expression to get to
    the mutex instance, this would fail (including more headers transitively
    everywhere should also be avoided).
    
    Instead, just declare an mm_id-dependent helper to return the mutex, and
    use the mm_id-dependent call expression in the __acquires/__releases
    attributes; the compiler will consider the identity of the mutex to be
    the call expression. Then using __get_turnstile() in the lock/unlock
    wrappers (with context analysis enabled for mmu.c) the compiler will be
    able to verify the implementation of the wrappers as-is.
    
    We leave context analysis disabled in arch/um/kernel/skas/ for now. This
    change is a preparatory change to allow enabling context analysis in
    subsystems that include any of the above headers.
    
    No functional change intended.
    
    Closes: https://lore.kernel.org/oe-kbuild-all/202512171220.vHlvhpCr-lkp@intel.com/
    Reported-by: kernel test robot 
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-23-elver@google.com

commit 6e530e2e31191d88f692e6c8d3bd245e43416e4f
Author: Marco Elver 
Date:   Fri Dec 19 16:40:10 2025 +0100

    debugfs: Make debugfs_cancellation a context lock struct
    
    When compiling include/linux/debugfs.h with CONTEXT_ANALYSIS enabled, we
    can see this error:
    
    ./include/linux/debugfs.h:239:17: error: use of undeclared identifier 'cancellation'
      239 | void __acquires(cancellation)
    
    Move the __acquires(..) attribute after the declaration, so that the
    compiler can see the cancellation function argument, as well as making
    struct debugfs_cancellation a real context lock to benefit from Clang's
    context analysis.
    
    This change is a preparatory change to allow enabling context analysis
    in subsystems that include the above header.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/20251219154418.3592607-22-elver@google.com

commit 47907461e4f6fcdce8cf91dd164369192deeb7c4
Author: Marco Elver 
Date:   Fri Dec 19 16:40:09 2025 +0100

    locking/ww_mutex: Support Clang's context analysis
    
    Add support for Clang's context analysis for ww_mutex.
    
    The programming model for ww_mutex is subtly more complex than other
    locking primitives when using ww_acquire_ctx. Encoding the respective
    pre-conditions for ww_mutex lock/unlock based on ww_acquire_ctx state
    using Clang's context analysis makes incorrect use of the API harder.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-21-elver@google.com

commit d3febf16dee28a74b01ba43195ee4965edb6208f
Author: Marco Elver 
Date:   Fri Dec 19 16:40:08 2025 +0100

    locking/local_lock: Support Clang's context analysis
    
    Add support for Clang's context analysis for local_lock_t and
    local_trylock_t.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-20-elver@google.com

commit 8c9c8566e139c0f1398245fbe3aa409fc1a79da8
Author: Marco Elver 
Date:   Fri Dec 19 16:40:07 2025 +0100

    locking/local_lock: Include missing headers
    
    Including  into an empty TU will result in the
    compiler complaining:
    
    ./include/linux/local_lock.h: In function ‘class_local_lock_irqsave_constructor’:
    ./include/linux/local_lock_internal.h:95:17: error: implicit declaration of function ‘local_irq_save’; <...>
       95 |                 local_irq_save(flags);                          \
          |                 ^~~~~~~~~~~~~~
    
    As well as (some architectures only, such as 'sh'):
    
    ./include/linux/local_lock_internal.h: In function ‘local_lock_acquire’:
    ./include/linux/local_lock_internal.h:33:20: error: ‘current’ undeclared (first use in this function)
       33 |         l->owner = current;
    
    Include missing headers to allow including local_lock.h where the
    required headers are not otherwise included.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/20251219154418.3592607-19-elver@google.com

commit e4fd3be884cf33a42c5bcde087b0722a5b8f25ca
Author: Marco Elver 
Date:   Fri Dec 19 16:40:06 2025 +0100

    locking/rwsem: Support Clang's context analysis
    
    Add support for Clang's context analysis for rw_semaphore.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-18-elver@google.com

commit 5e256db9325e75e9f000ddd64e4f1dbd2a6d8acd
Author: Marco Elver 
Date:   Fri Dec 19 16:40:05 2025 +0100

    kref: Add context-analysis annotations
    
    Mark functions that conditionally acquire the passed lock.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/20251219154418.3592607-17-elver@google.com

commit f0b7ce22d71810c8c11abcd912fbd6f57c2e9677
Author: Marco Elver 
Date:   Fri Dec 19 16:40:04 2025 +0100

    srcu: Support Clang's context analysis
    
    Add support for Clang's context analysis for SRCU.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Acked-by: Paul E. McKenney 
    Link: https://patch.msgid.link/20251219154418.3592607-16-elver@google.com

commit fe00f6e84621ad441aa99005f2f0fefd0e5e1a2c
Author: Marco Elver 
Date:   Fri Dec 19 16:40:03 2025 +0100

    rcu: Support Clang's context analysis
    
    Improve the existing annotations to properly support Clang's context
    analysis.
    
    The old annotations distinguished between RCU, RCU_BH, and RCU_SCHED;
    however, to more easily be able to express that "hold the RCU read lock"
    without caring if the normal, _bh(), or _sched() variant was used we'd
    have to remove the distinction of the latter variants: change the _bh()
    and _sched() variants to also acquire "RCU".
    
    When (and if) we introduce context locks to denote more generally that
    "IRQ", "BH", "PREEMPT" contexts are disabled, it would make sense to
    acquire these instead of RCU_BH and RCU_SCHED respectively.
    
    The above change also simplified introducing __guarded_by support, where
    only the "RCU" context lock needs to be held: introduce __rcu_guarded,
    where Clang's context analysis warns if a pointer is dereferenced
    without any of the RCU locks held, or updated without the appropriate
    helpers.
    
    The primitives rcu_assign_pointer() and friends are wrapped with
    context_unsafe(), which enforces using them to update RCU-protected
    pointers marked with __rcu_guarded.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Acked-by: Paul E. McKenney 
    Link: https://patch.msgid.link/20251219154418.3592607-15-elver@google.com

commit eb7d96a13bf45f86909006a59e7855d8810f020a
Author: Marco Elver 
Date:   Fri Dec 19 16:40:02 2025 +0100

    bit_spinlock: Support Clang's context analysis
    
    The annotations for bit_spinlock.h have simply been using "bitlock" as
    the token. For Sparse, that was likely sufficient in most cases. But
    Clang's context analysis is more precise, and we need to ensure we
    can distinguish different bitlocks.
    
    To do so, add a token context, and a macro __bitlock(bitnum, addr)
    that is used to construct unique per-bitlock tokens.
    
    Add the appropriate test.
    
     is implicitly included through other includes, and
    requires 2 annotations to indicate that acquisition (without release)
    and release (without prior acquisition) of its bitlock is intended.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-14-elver@google.com

commit 5f7ba059710609bb997d50775ba92fbf29be51da
Author: Marco Elver 
Date:   Fri Dec 19 16:40:01 2025 +0100

    bit_spinlock: Include missing 
    
    Including  into an empty TU will result in the
    compiler complaining:
    
    ./include/linux/bit_spinlock.h:34:4: error: call to undeclared function 'cpu_relax'; <...>
       34 |                         cpu_relax();
          |                         ^
    1 error generated.
    
    Include  to allow including bit_spinlock.h where
     is not otherwise included.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/20251219154418.3592607-13-elver@google.com

commit 8f8a55f49cda5fee914bbea1ab5af8df3a6ba8af
Author: Marco Elver 
Date:   Fri Dec 19 16:40:00 2025 +0100

    locking/seqlock: Support Clang's context analysis
    
    Add support for Clang's context analysis for seqlock_t.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-12-elver@google.com

commit 370f0a345a70fe36d0185abf87c7ee8e70572e06
Author: Marco Elver 
Date:   Fri Dec 19 16:39:59 2025 +0100

    locking/mutex: Support Clang's context analysis
    
    Add support for Clang's context analysis for mutex.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-11-elver@google.com

commit 38f1311a2219220a3962fae464ca6300ef60b4c1
Author: Marco Elver 
Date:   Fri Dec 19 16:39:58 2025 +0100

    compiler-context-analysis: Change __cond_acquires to take return value
    
    While Sparse is oblivious to the return value of conditional acquire
    functions, Clang's context analysis needs to know the return value
    which indicates successful acquisition.
    
    Add the additional argument, and convert existing uses.
    
    Notably, Clang's interpretation of the value merely relates to the use
    in a later conditional branch, i.e. 1 ==> context lock acquired in
    branch taken if condition non-zero, and 0 ==> context lock acquired in
    branch taken if condition is zero. Given the precise value does not
    matter, introduce symbolic variants to use instead of either 0 or 1,
    which should be more intuitive.
    
    No functional change intended.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-10-elver@google.com

commit f16a802d402d735a55731f8c94952b3bbb5ddfe8
Author: Marco Elver 
Date:   Fri Dec 19 16:39:57 2025 +0100

    locking/rwlock, spinlock: Support Clang's context analysis
    
    Add support for Clang's context analysis for raw_spinlock_t,
    spinlock_t, and rwlock. This wholesale conversion is required because
    all three of them are interdependent.
    
    To avoid warnings in constructors, the initialization functions mark a
    lock as acquired when initialized before guarded variables.
    
    The test verifies that common patterns do not generate false positives.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-9-elver@google.com

commit 7c451541743c6c2ef1afc425191f18a23e311019
Author: Marco Elver 
Date:   Fri Dec 19 16:39:56 2025 +0100

    lockdep: Annotate lockdep assertions for context analysis
    
    Clang's context analysis can be made aware of functions that assert that
    locks are held.
    
    Presence of these annotations causes the analysis to assume the context
    lock is held after calls to the annotated function, and avoid false
    positives with complex control-flow; for example, where not all
    control-flow paths in a function require a held lock, and therefore
    marking the function with __must_hold(..) is inappropriate.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-8-elver@google.com

commit 3931d4b980398012b66c8ff203bfa2ab3df71a71
Author: Marco Elver 
Date:   Fri Dec 19 16:39:55 2025 +0100

    cleanup: Basic compatibility with context analysis
    
    Introduce basic compatibility with cleanup.h infrastructure.
    
    We need to allow the compiler to see the acquisition and release of the
    context lock at the start and end of a scope. However, the current
    "cleanup" helpers wrap the lock in a struct passed through separate
    helper functions, which hides the lock alias from the compiler (no
    inter-procedural analysis).
    
    While Clang supports scoped guards in C++, it's not possible to apply in
    C code: https://clang.llvm.org/docs/ThreadSafetyAnalysis.html#scoped-context
    
    However, together with recent improvements to Clang's alias analysis
    abilities, idioms such as this work correctly now:
    
            void spin_unlock_cleanup(spinlock_t **l) __releases(*l) { .. }
            ...
            {
                spinlock_t *lock_scope __cleanup(spin_unlock_cleanup) = &lock;
                spin_lock(&lock);  // lock through &lock
                ... critical section ...
            }  // unlock through lock_scope -[alias]-> &lock (no warnings)
    
    To generalize this pattern and make it work with existing lock guards,
    introduce DECLARE_LOCK_GUARD_1_ATTRS() and WITH_LOCK_GUARD_1_ATTRS().
    
    These allow creating an explicit alias to the context lock instance that
    is "cleaned" up with a separate cleanup helper. This helper is a dummy
    function that does nothing at runtime, but has the release attributes to
    tell the compiler what happens at the end of the scope.
    
    Example usage:
    
      DECLARE_LOCK_GUARD_1_ATTRS(mutex, __acquires(_T), __releases(*(struct mutex **)_T))
      #define class_mutex_constructor(_T) WITH_LOCK_GUARD_1_ATTRS(mutex, _T)
    
    Note: To support the for-loop based scoped helpers, the auxiliary
    variable must be a pointer to the "class" type because it is defined in
    the same statement as the guard variable. However, we initialize it with
    the lock pointer (despite the type mismatch, the compiler's alias
    analysis still works as expected). The "_unlock" attribute receives a
    pointer to the auxiliary variable (a double pointer to the class type),
    and must be cast and dereferenced appropriately.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-7-elver@google.com

commit 25d3b21e1d41f7b58aeb62b97b05d86d43c91801
Author: Marco Elver 
Date:   Fri Dec 19 16:39:54 2025 +0100

    checkpatch: Warn about context_unsafe() without comment
    
    Warn about applications of context_unsafe() without a comment, to
    encourage documenting the reasoning behind why it was deemed safe.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-6-elver@google.com

commit 8f32441d7a532804a8d9e2ae36f9b13c353934d7
Author: Marco Elver 
Date:   Fri Dec 19 16:39:53 2025 +0100

    Documentation: Add documentation for Compiler-Based Context Analysis
    
    Adds documentation in Documentation/dev-tools/context-analysis.rst, and
    adds it to the index.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-5-elver@google.com

commit 9b00c1609deeb7d6f68a61f3ec6988ab7e6f4535
Author: Marco Elver 
Date:   Fri Dec 19 16:39:52 2025 +0100

    compiler-context-analysis: Add test stub
    
    Add a simple test stub where we will add common supported patterns that
    should not generate false positives for each new supported context lock.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-4-elver@google.com

commit 3269701cb25662ae8a9771a864201116626adb50
Author: Marco Elver 
Date:   Fri Dec 19 16:39:51 2025 +0100

    compiler-context-analysis: Add infrastructure for Context Analysis with Clang
    
    Context Analysis is a language extension, which enables statically
    checking that required contexts are active (or inactive), by acquiring
    and releasing user-definable "context locks". An obvious application is
    lock-safety checking for the kernel's various synchronization primitives
    (each of which represents a "context lock"), and checking that locking
    rules are not violated.
    
    Clang originally called the feature "Thread Safety Analysis" [1]. This
    was later changed and the feature became more flexible, gaining the
    ability to define custom "capabilities". Its foundations can be found in
    "Capability Systems" [2], used to specify the permissibility of
    operations to depend on some "capability" being held (or not held).
    
    Because the feature is not just able to express "capabilities" related
    to synchronization primitives, and "capability" is already overloaded in
    the kernel, the naming chosen for the kernel departs from Clang's
    "Thread Safety" and "capability" nomenclature; we refer to the feature
    as "Context Analysis" to avoid confusion. The internal implementation
    still makes references to Clang's terminology in a few places, such as
    `-Wthread-safety` being the warning option that also still appears in
    diagnostic messages.
    
     [1] https://clang.llvm.org/docs/ThreadSafetyAnalysis.html
     [2] https://www.cs.cornell.edu/talc/papers/capabilities.pdf
    
    See more details in the kernel-doc documentation added in this and
    subsequent changes.
    
    Clang version 22+ is required.
    
    [peterz: disable the thing for __CHECKER__ builds]
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251219154418.3592607-3-elver@google.com

commit de15fecae44df8254fa597bad7eb3680a8b1c10c
Author: Marco Elver 
Date:   Fri Dec 19 16:39:50 2025 +0100

    compiler_types: Move lock checking attributes to compiler-context-analysis.h
    
    The conditional definition of lock checking macros and attributes is
    about to become more complex. Factor them out into their own header for
    better readability, and to make it obvious which features are supported
    by which mode (currently only Sparse). This is the first step towards
    generalizing towards "context analysis".
    
    No functional change intended.
    
    Signed-off-by: Marco Elver 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/20251219154418.3592607-2-elver@google.com

commit e70711be0d0ebdd0a9213446b657fe0815e38017
Author: Raag Jadav 
Date:   Mon Jan 5 13:37:50 2026 +0530

    drm/xe/i2c: Force polling mode in survivability
    
    SGUnit interrupts are not initialized in survivability. Force I2C
    controller to polling mode while in survivability.
    
    v2: Use helper function instead of manual check (Riana)
    
    Signed-off-by: Raag Jadav 
    Reviewed-by: Heikki Krogerus 
    Link: https://patch.msgid.link/20260105080750.16605-1-raag.jadav@intel.com
    Signed-off-by: Matt Roper 

commit e37c9a3dc9f9645532780d5ef34ea3b8fcf9ddef
Author: Tony Luck 
Date:   Wed Dec 17 09:20:59 2025 -0800

    x86,fs/resctrl: Support binary fixed point event counters
    
    resctrl assumes that all monitor events can be displayed as unsigned decimal
    integers.
    
    Hardware architecture counters may provide some telemetry events with greater
    precision where the event is not a simple count, but is a measurement of some
    sort (e.g. Joules for energy consumed).
    
    Add a new argument to resctrl_enable_mon_event() for architecture code to
    inform the file system that the value for a counter is a fixed-point value
    with a specific number of binary places.
    
    Only allow architecture to use floating point format on events that the file
    system has marked with mon_evt::is_floating_point which reflects the contract
    with user space on how the event values are displayed.
    
    Display fixed point values with values rounded to ceil(binary_bits * log10(2))
    decimal places. Special case for zero binary bits to print "{value}.0".
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 26ce0b87a815c71d24fd193a81c06daefb60959f
Author: Martin Blumenstingl 
Date:   Sat Nov 8 14:42:36 2025 +0100

    drm/meson: venc: add support for HDMI DMT modes up to 3840x2160
    
    Commit 5d0bfe448481 ("drm/meson: Add HDMI 1.4 4k modes") added support
    for HDMI 1.4 4k modes, which is what TVs need. For computer monitors
    the code is using the DMT code-path, which ends up in
    meson_venc_hdmi_supported_mode(), which does not allow the 4k modes yet.
    
    The datasheet for all supported SoCs mentions "4Kx2K@60". It's not
    clear whether "4K" here means 3840 or 4096 pixels.
    
    Allow resolutions up to 3840x2160 pixels (including middle steps, such
    as WQHD at 2560x1440 pixels) so they can be used with computer monitors
    (using the DMT code-path in the driver).
    
    Signed-off-by: Martin Blumenstingl 
    Acked-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251108134236.1299630-1-martin.blumenstingl@googlemail.com

commit aa7b4bbcb3a1ddf11a94f1500b05a39041efb7b4
Author: Krishna Chaitanya Chundru 
Date:   Mon Jan 5 15:55:24 2026 +0530

    arm64: dts: qcom: qcs6490-rb3gen2: Add TC9563 PCIe switch node
    
    Add a node for the TC9563 PCIe switch, which has three downstream ports.
    Two embedded Ethernet devices are present on one of the downstream ports.
    As all these ports are present in the node represent the downstream
    ports and embedded endpoints.
    
    Power to the TC9563 is supplied through two LDO regulators, controlled by
    two GPIOs, which are added as fixed regulators. Configure the TC9563
    through I2C.
    
    Reviewed-by: Bjorn Andersson 
    Acked-by: Manivannan Sadhasivam 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Krishna Chaitanya Chundru 
    Link: https://lore.kernel.org/r/20260105-tc9563-v1-1-642fd1fe7893@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit d6205a1878dd4cc9664c4b4829b68a29c0426efc
Author: Taniya Das 
Date:   Mon Jan 5 16:09:50 2026 +0530

    clk: qcom: rcg2: compute 2d using duty fraction directly
    
    The duty-cycle calculation in clk_rcg2_set_duty_cycle() currently
    derives an intermediate percentage `duty_per = (num * 100) / den` and
    then computes:
    
        d = DIV_ROUND_CLOSEST(n * duty_per * 2, 100);
    
    This introduces integer truncation at the percentage step (division by
    `den`) and a redundant scaling by 100, which can reduce precision for
    large `den` and skew the final rounding.
    
    Compute `2d` directly from the duty fraction to preserve precision and
    avoid the unnecessary scaling:
    
        d = DIV_ROUND_CLOSEST(n * duty->num * 2, duty->den);
    
    This keeps the intended formula `d ≈ n * 2 * (num/den)` while performing
    a single, final rounded division, improving accuracy especially for small
    duty cycles or large denominators. It also removes the unused `duty_per`
    variable, simplifying the code.
    
    There is no functional changes beyond improved numerical accuracy.
    
    Fixes: 7f891faf596ed ("clk: qcom: clk-rcg2: Add support for duty-cycle for RCG")
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260105-duty_cycle_precision-v2-1-d1d466a6330a@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit c957072d44a735ebbe8385fc3511a4f5e6ccea93
Author: Thorsten Blum 
Date:   Mon Nov 24 13:54:53 2025 +0100

    x86/platform/olpc: Replace strcpy() with strscpy() in xo15_sci_add()
    
    strcpy() has been deprecated¹ because it performs no bounds checking on the
    destination buffer, which can lead to buffer overflows. Use the safer
    strscpy() instead.
    
      ¹ https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251124125455.5495-2-thorsten.blum@linux.dev

commit 5cd2a743ce384a5a4a1b5b09d4983df2592fbe1c
Author: Pankaj Patil 
Date:   Mon Jan 5 18:30:50 2026 +0530

    dt-bindings: cache: qcom,llcc: Remove duplicate llcc7_base for Glymur
    
    Drop redundant llcc7_base entry from Glymur LLCC reg-items
    
    Fixes: bd0b8028ce5f ("dt-bindings: cache: qcom,llcc: Document Glymur LLCC block")
    Signed-off-by: Pankaj Patil 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20260105130050.1062903-1-pankaj.patil@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 336367fab9b96db7b0ee174443c426fc6c53b912
Author: Brandon Brnich 
Date:   Tue Dec 16 15:34:13 2025 -0600

    media: chips-media: wave5: Fix Potential Probe Resource Leak
    
    After kthread creation during probe sequence, a handful of other
    failures could occur. If this were to happen, the kthread is never
    explicitly deleted which results in a resource leak. Add explicit cleanup
    of this resource.
    
    Signed-off-by: Brandon Brnich 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 8e30a27f4aab0a0482630f4283ca2a994fd78d1d
Author: Marco Crivellari 
Date:   Fri Nov 7 15:13:03 2025 +0100

    media: platform: mtk-mdp3: add WQ_PERCPU to alloc_workqueue users
    
    Currently if a user enqueues a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    This lack of consistency cannot be addressed without refactoring the API.
    
    alloc_workqueue() treats all queues as per-CPU by default, while unbound
    workqueues must opt-in via WQ_UNBOUND.
    
    This default is suboptimal: most workloads benefit from unbound queues,
    allowing the scheduler to place worker threads where they’re needed and
    reducing noise when CPUs are isolated.
    
    This continues the effort to refactor workqueue APIs, which began with
    the introduction of new workqueues and a new alloc_workqueue flag in:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    This change adds a new WQ_PERCPU flag to explicitly request
    alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified.
    
    With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
    any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
    must now use WQ_PERCPU.
    
    Once migration is complete, WQ_UNBOUND can be removed and unbound will
    become the implicit default.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit cb3f945c012ab152fd2323e0df34c2b640071738
Author: Benjamin Gaignard 
Date:   Tue Dec 9 11:34:17 2025 +0100

    media: verisilicon: AV1: Fix tx mode bit setting
    
    AV1 specification describes 3 possibles tx modes: 4x4 only, largest and
    select. The hardware allows 5 possibles tx modes: 4x4 only, 8x8, 16x16,
    32x32 and select. Since the both aren't exactly matching we need to add
    a mapping function to set the correct mode on hardware.
    
    Signed-off-by: Benjamin Gaignard 
    Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder")
    Cc: stable@vger.kernel.org
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit e0f99b810e1181374370f91cd996d761549e147f
Author: Benjamin Gaignard 
Date:   Tue Dec 9 11:34:01 2025 +0100

    media: verisilicon: AV1: Fix enable cdef computation
    
    If all the fields of the CDEF parameters are zero (which is the default),
    then av1_enable_cdef register needs to be unset
    (despite the V4L2_AV1_SEQUENCE_FLAG_ENABLE_CDEF possibly being set).
    
    Signed-off-by: Benjamin Gaignard 
    Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder")
    Cc: stable@vger.kernel.org
    Reported-by: Jianfeng Liu 
    Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4786
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 
    [hverkuil: dropped Link tag since it just duplicated the Closes: URL]

commit e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765
Author: Ming Qian 
Date:   Fri Dec 5 09:54:26 2025 +0800

    media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
    
    For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and
    g2 VPU cannot decode simultaneously; otherwise, it will cause below bus
    error and produce corrupted pictures, even potentially lead to system hang.
    
    [  110.527986] hantro-vpu 38310000.video-codec: frame decode timed out.
    [  110.583517] hantro-vpu 38310000.video-codec: bus error detected.
    
    Therefore, it is necessary to ensure that g1 and g2 operate alternately.
    This allows for successful multi-instance decoding of H.264 and HEVC.
    
    To achieve this, g1 and g2 share the same v4l2_m2m_dev, and then the
    v4l2_m2m_dev can handle the scheduling.
    
    Fixes: cb5dd5a0fa518 ("media: hantro: Introduce G2/HEVC decoder")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ming Qian 
    Reviewed-by: Frank Li 
    Co-developed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit db6b97a4f8041e479be9ef4b8b07022636c96f50
Author: Nicolas Dufresne 
Date:   Fri Dec 5 09:54:24 2025 +0800

    media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
    
    Adding a reference count to the v4l2_m2m_dev structure allow safely
    sharing it across multiple hardware nodes. This can be used to prevent
    running jobs concurrently on m2m cores that have some internal resource
    sharing.
    
    Signed-off-by: Ming Qian 
    Reviewed-by: Frank Li 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 
    [hverkuil: fix typos in v4l2_m2m_put documentation]

commit 3e92d7e4935084ecdbdc88880cc4688618ae1557
Author: Nicolas Dufresne 
Date:   Fri Nov 28 14:16:16 2025 -0500

    media: mediatek: vcodec: Don't try to decode 422/444 VP9
    
    This is not supported by the hardware and trying to decode
    these leads to LAT timeout errors.
    
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 1b78aae6313f4131610f5023ae34f2c7502ceeab
Author: Sebastian Fricke 
Date:   Fri Nov 28 14:16:15 2025 -0500

    media: mediatek: vcodec: Implement manual request completion
    
    Rework how requests are completed in the MediaTek VCodec driver, by
    implementing the new manual request completion feature, which allows to
    keep a request open while allowing to add new bitstream data.
    This is useful in this case, because the hardware has a LAT and a core
    decode work, after the LAT decode the bitstream isn't required anymore
    so the source buffer can be set done and the request stays open until
    the core decode work finishes.
    
    Signed-off-by: Sebastian Fricke 
    Co-developed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit de9f0c2a1ce3d97561d5cf4678b80e13943647fd
Author: Hans Verkuil 
Date:   Fri Nov 28 14:16:14 2025 -0500

    media: mc: add debugfs node to keep track of requests
    
    Keep track of the number of requests and request objects of a media
    device. Helps to verify that all request-related memory is freed.
    
    Signed-off-by: Hans Verkuil 
    Signed-off-by: Nicolas Dufresne 

commit d14d93f940763655c23c9a0012648ec42a06f482
Author: Hans Verkuil 
Date:   Fri Nov 28 14:16:13 2025 -0500

    media: vicodec: add support for manual completion
    
    Manually complete the requests: this tests the manual completion
    code.
    
    Signed-off-by: Hans Verkuil 
    Signed-off-by: Nicolas Dufresne 

commit c789a7f40288c19004f786a6da67c3733d38c6af
Author: Hans Verkuil 
Date:   Fri Nov 28 14:16:12 2025 -0500

    media: mc: add manual request completion
    
    By default when the last request object is completed, the whole
    request completes as well.
    
    But sometimes you want to delay this completion to an arbitrary point in
    time so add a manual complete mode for this.
    
    In req_queue the driver marks the request for manual completion by
    calling media_request_mark_manual_completion, and when the driver
    wants to manually complete the request it calls
    media_request_manual_complete().
    
    Signed-off-by: Hans Verkuil 
    Signed-off-by: Nicolas Dufresne 

commit a519e21e32398459ba357e67b541402f7295ee1b
Author: Zilin Guan 
Date:   Tue Nov 11 14:57:06 2025 +0000

    media: chips-media: wave5: Fix memory leak on codec_info allocation failure
    
    In wave5_vpu_open_enc() and wave5_vpu_open_dec(), a vpu instance is
    allocated via kzalloc(). If the subsequent allocation for inst->codec_info
    fails, the functions return -ENOMEM without freeing the previously
    allocated instance, causing a memory leak.
    
    Fix this by calling kfree() on the instance in this error path to ensure
    it is properly released.
    
    Fixes: 9707a6254a8a6 ("media: chips-media: wave5: Add the v4l2 layer")
    Signed-off-by: Zilin Guan 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit a176ac5e701f1ba30843c0d7e0663a761bf9a61a
Author: Jackson Lee 
Date:   Wed Nov 19 15:25:49 2025 +0900

    media: chips-media: wave5: Improve performance of decoder
    
    The current decoding method  was to wait until each frame was
    decoded after feeding a bitstream. As a result, performance was low
    and Wave5 could not achieve max pixel processing rate.
    
    Update driver to use an asynchronous approach for decoding and feeding a
    bitstream in order to achieve full capabilities of the device.
    
    WAVE5 supports command-queueing to maximize performance by pipelining
    internal commands and by hiding wait cycle taken to receive a command
    from Host processor.
    
    Instead of waiting for each command to be executed before sending the
    next command, Host processor just places all the commands in the
    command-queue and goes on doing other things while the commands in the
    queue are processed by VPU.
    
    While Host processor handles its own tasks, it can receive VPU interrupt
    request (IRQ).
    In this case, host processor can simply exit interrupt service routine
    (ISR) without accessing to host interface to read the result of the
    command reported by VPU.
    After host processor completed its tasks, host processor can read the
    command result when host processor needs the reports and does
    response processing.
    
    To achieve this goal, the device_run() calls v4l2_m2m_job_finish
    so that next command can be sent to VPU continuously, if there is
    any result, then irq is triggered and gets decoded frames and returns
    them to upper layer.
    Theses processes work independently each other without waiting
    a decoded frame.
    
    Signed-off-by: Jackson Lee 
    Signed-off-by: Nas Chung 
    Tested-by: Brandon Brnich 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit a07ce1e22d6ec437029ad1868836573376655a0d
Author: Jackson Lee 
Date:   Wed Nov 19 15:25:48 2025 +0900

    media: chips-media: wave5: Add WARN_ON to check if dec_output_info is NULL
    
    The dec_output_info should not be a null pointer, WARN_ON around it to
    indicates a driver issue.
    
    Signed-off-by: Jackson Lee 
    Signed-off-by: Nas Chung 
    Tested-by: Brandon Brnich 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit e66ff2b08e4ee1c4d3b84f24818e5bcc178cc3a4
Author: Jackson Lee 
Date:   Wed Nov 19 15:25:47 2025 +0900

    media: chips-media: wave5: Fix Null reference while testing fluster
    
    When multi instances are created/destroyed, many interrupts happens
    and structures for decoder are removed.
    "struct vpu_instance" this structure is shared for all flow in the decoder,
    so if the structure is not protected by lock, Null dereference
    could happens sometimes.
    IRQ Handler was spilt to two phases and Lock was added as well.
    
    Fixes: 9707a6254a8a ("media: chips-media: wave5: Add the v4l2 layer")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jackson Lee 
    Signed-off-by: Nas Chung 
    Tested-by: Brandon Brnich 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit cbb9c0d50e471483cced55f5b7db4569dcd959a6
Author: Jackson Lee 
Date:   Wed Nov 19 15:25:46 2025 +0900

    media: chips-media: wave5: Fix SError of kernel panic when closed
    
    SError of kernel panic rarely happened while testing fluster.
    The root cause was to enter suspend mode because timeout of autosuspend
    delay happened.
    
    [   48.834439] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError
    [   48.834455] CPU: 0 UID: 0 PID: 1067 Comm: v4l2h265dec0:sr Not tainted 6.12.9-gc9e21a1ebd75-dirty #7
    [   48.834461] Hardware name: ti Texas Instruments J721S2 EVM/Texas Instruments J721S2 EVM, BIOS 2025.01-00345-gbaf3aaa8ecfa 01/01/2025
    [   48.834464] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [   48.834468] pc : wave5_dec_clr_disp_flag+0x40/0x80 [wave5]
    [   48.834488] lr : wave5_dec_clr_disp_flag+0x40/0x80 [wave5]
    [   48.834495] sp : ffff8000856e3a30
    [   48.834497] x29: ffff8000856e3a30 x28: ffff0008093f6010 x27: ffff000809158130
    [   48.834504] x26: 0000000000000000 x25: ffff00080b625000 x24: ffff000804a9ba80
    [   48.834509] x23: ffff000802343028 x22: ffff000809158150 x21: ffff000802218000
    [   48.834513] x20: ffff0008093f6000 x19: ffff0008093f6000 x18: 0000000000000000
    [   48.834518] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff74009618
    [   48.834523] x14: 000000010000000c x13: 0000000000000000 x12: 0000000000000000
    [   48.834527] x11: ffffffffffffffff x10: ffffffffffffffff x9 : ffff000802343028
    [   48.834532] x8 : ffff00080b6252a0 x7 : 0000000000000038 x6 : 0000000000000000
    [   48.834536] x5 : ffff00080b625060 x4 : 0000000000000000 x3 : 0000000000000000
    [   48.834541] x2 : 0000000000000000 x1 : ffff800084bf0118 x0 : ffff800084bf0000
    [   48.834547] Kernel panic - not syncing: Asynchronous SError Interrupt
    [   48.834549] CPU: 0 UID: 0 PID: 1067 Comm: v4l2h265dec0:sr Not tainted 6.12.9-gc9e21a1ebd75-dirty #7
    [   48.834554] Hardware name: ti Texas Instruments J721S2 EVM/Texas Instruments J721S2 EVM, BIOS 2025.01-00345-gbaf3aaa8ecfa 01/01/2025
    [   48.834556] Call trace:
    [   48.834559]  dump_backtrace+0x94/0xec
    [   48.834574]  show_stack+0x18/0x24
    [   48.834579]  dump_stack_lvl+0x38/0x90
    [   48.834585]  dump_stack+0x18/0x24
    [   48.834588]  panic+0x35c/0x3e0
    [   48.834592]  nmi_panic+0x40/0x8c
    [   48.834595]  arm64_serror_panic+0x64/0x70
    [   48.834598]  do_serror+0x3c/0x78
    [   48.834601]  el1h_64_error_handler+0x34/0x4c
    [   48.834605]  el1h_64_error+0x64/0x68
    [   48.834608]  wave5_dec_clr_disp_flag+0x40/0x80 [wave5]
    [   48.834615]  wave5_vpu_dec_clr_disp_flag+0x54/0x80 [wave5]
    [   48.834622]  wave5_vpu_dec_buf_queue+0x19c/0x1a0 [wave5]
    [   48.834628]  __enqueue_in_driver+0x3c/0x74 [videobuf2_common]
    [   48.834639]  vb2_core_qbuf+0x508/0x61c [videobuf2_common]
    [   48.834646]  vb2_qbuf+0xa4/0x168 [videobuf2_v4l2]
    [   48.834656]  v4l2_m2m_qbuf+0x80/0x238 [v4l2_mem2mem]
    [   48.834666]  v4l2_m2m_ioctl_qbuf+0x18/0x24 [v4l2_mem2mem]
    [   48.834673]  v4l_qbuf+0x48/0x5c [videodev]
    [   48.834704]  __video_do_ioctl+0x180/0x3f0 [videodev]
    [   48.834725]  video_usercopy+0x2ec/0x68c [videodev]
    [   48.834745]  video_ioctl2+0x18/0x24 [videodev]
    [   48.834766]  v4l2_ioctl+0x40/0x60 [videodev]
    [   48.834786]  __arm64_sys_ioctl+0xa8/0xec
    [   48.834793]  invoke_syscall+0x44/0x100
    [   48.834800]  el0_svc_common.constprop.0+0xc0/0xe0
    [   48.834804]  do_el0_svc+0x1c/0x28
    [   48.834809]  el0_svc+0x30/0xd0
    [   48.834813]  el0t_64_sync_handler+0xc0/0xc4
    [   48.834816]  el0t_64_sync+0x190/0x194
    [   48.834820] SMP: stopping secondary CPUs
    [   48.834831] Kernel Offset: disabled
    [   48.834833] CPU features: 0x08,00002002,80200000,4200421b
    [   48.834837] Memory Limit: none
    [   49.161404] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---
    
    Fixes: 2092b3833487 ("media: chips-media: wave5: Support runtime suspend/resume")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jackson Lee 
    Signed-off-by: Nas Chung 
    Reviewed-by: Nicolas Dufresne 
    Tested-by: Brandon Brnich 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit b74cedac643b02aefa7da881b58a3792859d9748
Author: Xulin Sun 
Date:   Thu Dec 4 17:41:53 2025 +0800

    media: chips-media: wave5: Fix device cleanup order to prevent kernel panic
    
    Move video device unregistration to the beginning of the remove function
    to ensure all video operations are stopped before cleaning up the worker
    thread and disabling PM runtime. This prevents hardware register access
    after the device has been powered down.
    
    In polling mode, the hrtimer periodically triggers
    wave5_vpu_timer_callback() which queues work to the kthread worker.
    The worker executes wave5_vpu_irq_work_fn() which reads hardware
    registers via wave5_vdi_read_register().
    
    The original cleanup order disabled PM runtime and powered down hardware
    before unregistering video devices. When autosuspend triggers and powers
    off the hardware, the video devices are still registered and the worker
    thread can still be triggered by the hrtimer, causing it to attempt
    reading registers from powered-off hardware. This results in a bus error
    (synchronous external abort) and kernel panic.
    
    This causes random kernel panics during encoding operations:
    
      Internal error: synchronous external abort: 0000000096000010
        [#1] PREEMPT SMP
      Modules linked in: wave5 rpmsg_ctrl rpmsg_char ...
      CPU: 0 UID: 0 PID: 1520 Comm: vpu_irq_thread
        Tainted: G   M    W
      pc : wave5_vdi_read_register+0x10/0x38 [wave5]
      lr : wave5_vpu_irq_work_fn+0x28/0x60 [wave5]
      Call trace:
       wave5_vdi_read_register+0x10/0x38 [wave5]
       kthread_worker_fn+0xd8/0x238
       kthread+0x104/0x120
       ret_from_fork+0x10/0x20
      Code: aa1e03e9 d503201f f9416800 8b214000 (b9400000)
      ---[ end trace 0000000000000000 ]---
      Kernel panic - not syncing: synchronous external abort:
        Fatal exception
    
    Fixes: 9707a6254a8a ("media: chips-media: wave5: Add the v4l2 layer")
    Cc: stable@vger.kernel.org
    Signed-off-by: Xulin Sun 
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 5a0c122e834b2f7f029526422c71be922960bf03
Author: Xulin Sun 
Date:   Thu Dec 4 17:41:52 2025 +0800

    media: chips-media: wave5: Fix kthread worker destruction in polling mode
    
    Fix the cleanup order in polling mode (irq < 0) to prevent kernel warnings
    during module removal. Cancel the hrtimer before destroying the kthread
    worker to ensure work queues are empty.
    
    In polling mode, the driver uses hrtimer to periodically trigger
    wave5_vpu_timer_callback() which queues work via kthread_queue_work().
    The kthread_destroy_worker() function validates that both work queues
    are empty with WARN_ON(!list_empty(&worker->work_list)) and
    WARN_ON(!list_empty(&worker->delayed_work_list)).
    
    The original code called kthread_destroy_worker() before hrtimer_cancel(),
    creating a race condition where the timer could fire during worker
    destruction and queue new work, triggering the WARN_ON.
    
    This causes the following warning on every module unload in polling mode:
    
      ------------[ cut here ]------------
      WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430
        kthread_destroy_worker+0x84/0x98
      Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...
      Call trace:
       kthread_destroy_worker+0x84/0x98
       wave5_vpu_remove+0xc8/0xe0 [wave5]
       platform_remove+0x30/0x58
      ...
      ---[ end trace 0000000000000000 ]---
    
    Fixes: ed7276ed2fd0 ("media: chips-media: wave5: Add hrtimer based polling support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Xulin Sun 
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38
Author: Xulin Sun 
Date:   Thu Dec 4 17:41:51 2025 +0800

    media: chips-media: wave5: Fix PM runtime usage count underflow
    
    Replace pm_runtime_put_sync() with pm_runtime_dont_use_autosuspend() in
    the remove path to properly pair with pm_runtime_use_autosuspend() from
    probe. This allows pm_runtime_disable() to handle reference count cleanup
    correctly regardless of current suspend state.
    
    The driver calls pm_runtime_put_sync() unconditionally in remove, but the
    device may already be suspended due to autosuspend configured in probe.
    When autosuspend has already suspended the device, the usage count is 0,
    and pm_runtime_put_sync() decrements it to -1.
    
    This causes the following warning on module unload:
    
      ------------[ cut here ]------------
      WARNING: CPU: 1 PID: 963 at kernel/kthread.c:1430
        kthread_destroy_worker+0x84/0x98
      ...
      vdec 30210000.video-codec: Runtime PM usage count underflow!
    
    Fixes: 9707a6254a8a ("media: chips-media: wave5: Add the v4l2 layer")
    Cc: stable@vger.kernel.org
    Signed-off-by: Xulin Sun 
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 5da0380de41439ed64ed9a5218850db38544e315
Author: Brandon Brnich 
Date:   Tue Oct 21 15:46:18 2025 -0500

    media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder
    
    CMD_STOP being sent to encoder before last job is executed by device_run
    can lead to an occasional dropped frame. Ensure that remaining ready
    buffers are drained by making a call to v4l2_m2m_try_schedule.
    
    Signed-off-by: Brandon Brnich 
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit b4e26c6fc1b3c225caf80d4a95c6f9fcbe959e17
Author: Brandon Brnich 
Date:   Tue Oct 21 15:46:17 2025 -0500

    media: chips-media: wave5: Fix conditional in start_streaming
    
    When STREAMON(CAP) is called after STREAMON(OUT), the driver was failing to
    switch states from VPU_INST_STATE_OPEN to VPU_INST_STATE_INIT_SEQ and
    VPU_INST_STATE_PIC_RUN because the capture queue streaming boolean had not
    yet been set to true. This led to a hang in the encoder since the state
    was stuck in VPU_INST_STATE_OPEN. During the second call to
    start_streaming, the sequence initialization and frame buffer allocation
    should occur.
    
    Signed-off-by: Brandon Brnich 
    Reviewed-by: Nicolas Dufresne 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 241e75fe6b9db206e8df14d305ea7e42fd3a2846
Author: Marek Vasut 
Date:   Fri Oct 17 17:58:38 2025 +0200

    media: imx-jpeg: Add support for descriptor allocation from SRAM
    
    Add support for optional allocation of bitstream descriptors from SRAM
    instead of DRAM. In case the encoder/decoder DT node contains 'sram'
    property which points to 'mmio-sram', the driver will attempt to use
    the SRAM instead of DRAM for descriptor allocation, which might improve
    performance.
    
    This also helps on i.MX95 rev.A with sporadic SLOTn_STATUS IMG_RD_ERR
    bit 11 being triggered during JPEG encoding, which is caused by a bug
    fixed on later SoC revisions. The bug occurs less often when using the
    SRAM for descriptor storage, but is not entirely mitigated. The following
    pipeline triggers the bug when descriptors get allocated from DRAM, the
    pipeline often hangs after a few seconds and the encoder driver indicates
    "timeout, cancel it":
    
    gst-launch-1.0 videotestsrc ! \
                   video/x-raw,width=256,height=256,format=YUY2 ! \
                   queue ! v4l2jpegenc ! queue ! fakesink
    
    Tested-by: Ming Qian 
    Signed-off-by: Marek Vasut 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 88fe301896596da34847871dbdfe261ed1148676
Author: Marek Vasut 
Date:   Fri Oct 17 17:58:37 2025 +0200

    media: dt-bindings: nxp,imx8-jpeg: Document optional SRAM support
    
    Document optional phandle to mmio-sram, which can describe an SRAM
    region used for descriptor storage instead of regular DRAM region.
    Use of SRAM instead of DRAM for descriptor storage may improve bus
    access pattern and performance.
    
    Reviewed-by: Frank Li 
    Signed-off-by: Marek Vasut 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit f128bab57b8018e526b7eda854ca20069863af47
Author: Haoxiang Li 
Date:   Wed Oct 8 17:01:56 2025 +0800

    media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
    
    In mtk_mdp_probe(), vpu_get_plat_device() increases the reference
    count of the returned platform device. Add platform_device_put()
    to prevent reference leak.
    
    Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haoxiang Li 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 8a8a3232abac5b972058a5f2cb3e33199d2a8648
Author: Haoxiang Li 
Date:   Wed Oct 8 16:55:03 2025 +0800

    media: mtk-mdp: Fix error handling in probe function
    
    Add mtk_mdp_unregister_m2m_device() on the error handling path to prevent
    resource leak.
    
    Add check for the return value of vpu_get_plat_device() to prevent null
    pointer dereference. And vpu_get_plat_device() increases the reference
    count of the returned platform device. Add platform_device_put() to
    prevent reference leak.
    
    Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haoxiang Li 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 8beb7e982fae2f7b37018e522d8b864691bbf4d3
Author: Johan Hovold 
Date:   Tue Oct 28 11:04:54 2025 +0100

    media: mediatek: amend vpu_get_plat_device() documentation
    
    Add a comment to the vpu_get_plat_device() documentation to make it
    clear that the VPU platform device is returned with an incremented
    reference count (which needs to be dropped after use).
    
    Signed-off-by: Johan Hovold 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit e4f63453fd37d79501676c6f32790179909b5042
Author: Qianfeng Rong 
Date:   Sun Sep 7 17:35:57 2025 +0800

    media: mediatek: vcodec: use = { } instead of memset()
    
    Based on testing and recommendations by David Lechner et al. [1][2],
    using = { } to initialize a structure or array is the preferred way
    to do this in the kernel.
    
    Converts memset() to = { }, thereby:
    - Eliminating the risk of sizeof() mismatches.
    - Simplifying the code.
    
    [1]: https://lore.kernel.org/linux-iio/202505090942.48EBF01B@keescook/
    [2]: https://lore.kernel.org/lkml/20250614151844.50524610@jic23-huawei/
    
    Signed-off-by: Qianfeng Rong 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 88e935de7cf8795d7a6a51385db87ecb361a7050
Author: Irui Wang 
Date:   Sun Sep 7 17:35:56 2025 +0800

    media: mediatek: encoder: Fix uninitialized scalar variable issue
    
    UNINIT checker finds some instances of variables that are used
    without being initialized, for example using the uninitialized
    value enc_result.is_key_frm can result in unpredictable behavior,
    so initialize these variables after declaring.
    
    Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Irui Wang 
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Dufresne 
    Signed-off-by: Hans Verkuil 

commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1
Author: Hans Verkuil 
Date:   Tue Oct 7 17:09:18 2025 +0200

    media: omap3isp: isppreview: always clamp in preview_try_format()
    
    If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't
    clamped. Just always clamp.
    
    This fixes a v4l2-compliance error:
    
            fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
            fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
    test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit ccd797968922e5e6d0e59aa4883c432e5c906a4b
Author: Hans Verkuil 
Date:   Tue Oct 7 17:06:43 2025 +0200

    media: omap3isp: ispccp2: always clamp in ccp2_try_format()
    
    If ccp2->input == CCP2_INPUT_NONE, then try_format didn't clamp
    the width and height. This can happen with v4l2-compliance tests.
    
    Always clamp.
    
    This fixes this v4l2-compliance error:
    
            fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
            fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
    test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit 44c383116d3587662661e94e75842d92fb3a4bee
Author: Hans Verkuil 
Date:   Tue Oct 7 16:18:28 2025 +0200

    media: omap3isp: support ctrl events for isppreview
    
    The preview subdev device was missing V4L2_SUBDEV_FL_HAS_EVENTS,
    and that prevented VIDIOC_SUBSCRIBE_EVENT from working.
    
    Fixes a v4l2-compliance error:
    
            fail: v4l2-test-controls.cpp(1128): subscribe event for control 'User Controls' failed
    test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: FAIL
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit 335d7956f739d70f78ae803cb618d85e4444fb36
Author: Hans Verkuil 
Date:   Tue Oct 7 14:05:59 2025 +0200

    media: omap3isp: better VIDIOC_G/S_PARM handling
    
    Fix various v4l2-compliance errors relating to timeperframe.
    
    VIDIOC_G/S_PARM is only supported for Video Output, so disable
    these ioctls for Capture devices.
    
    Ensure numerator and denominator are never 0.
    
    Set missing V4L2_CAP_TIMEPERFRAME capability for VIDIOC_S_PARM.
    
    v4l2-compliance:
    
            fail: v4l2-test-formats.cpp(1388): out->timeperframe.numerator == 0 || out->timeperframe.denominator == 0
    test VIDIOC_G/S_PARM: FAIL
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit 5c1f16ec600c22202a144c2a6a9ddb3678310e63
Author: Hans Verkuil 
Date:   Wed Apr 30 09:27:50 2025 +0200

    media: omap3isp: implement create/prepare_bufs
    
    Add missing ioctls. This makes v4l2-compliance happier:
    
            warn: v4l2-test-buffers.cpp(813): VIDIOC_CREATE_BUFS not supported
    test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit 93ee7d61dc311cfa382cf3461fc7647e0ff62bff
Author: Hans Verkuil 
Date:   Wed Apr 30 09:29:21 2025 +0200

    media: omap3isp: rework isp_video_try/set_format
    
    isp_video_set_format now calls isp_video_try_format first, ensuring
    consistent behavior and removing duplicate code in both functions.
    
    This fixes an v4l2-compliance error:
    
            fail: v4l2-test-formats.cpp(519): !pix.sizeimage
    test VIDIOC_S_FMT: FAIL
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794
Author: Hans Verkuil 
Date:   Wed Apr 30 09:21:53 2025 +0200

    media: omap3isp: set initial format
    
    Initialize the v4l2_format to a default. Empty formats are
    not allowed in V4L2, so this fixes v4l2-compliance issues:
    
            fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height
    test VIDIOC_G_FMT: FAIL
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit 2c422fd1a431feb0d8918b11ff37ec613e111d66
Author: Hans Verkuil 
Date:   Wed Apr 30 09:14:24 2025 +0200

    media: omap3isp: use V4L2_COLORSPACE_SRGB instead of _JPEG
    
    JPEG colorspace should generally not be used unless it is actually
    dealing with JPG data. This fixes v4l2-compliance errors:
    
            fail: v4l2-test-formats.cpp(416): pixelformat != V4L2_PIX_FMT_JPEG && pixelformat != V4L2_PIX_FMT_MJPEG && colorspace == V4L2_COLORSPACE_JPEG
            fail: v4l2-test-formats.cpp(521): testColorspace(!node->is_io_mc, pix.pixelformat, pix.colorspace, pix.ycbcr_enc, pix.quantization)
    test VIDIOC_TRY_FMT: FAIL
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit 5e72c0c94e420bc56373f80ff9313534ab017020
Author: Hans Verkuil 
Date:   Wed Apr 30 09:27:50 2025 +0200

    media: omap3isp: implement enum_fmt_vid_cap/out
    
    Add missing ioctls. This makes v4l2-compliance happier:
    
    fail: v4l2-test-formats.cpp(516): pixelformat 59565955 (UYVY) for buftype 1 not reported by ENUM_FMT
            test VIDIOC_G_FMT: FAIL
    fail: v4l2-test-formats.cpp(516): pixelformat 59565955 (UYVY) for buftype 1 not reported by ENUM_FMT
            test VIDIOC_TRY_FMT: FAIL
    fail: v4l2-test-formats.cpp(516): pixelformat 56595559 (YUYV) for buftype 1 not reported by ENUM_FMT
            test VIDIOC_S_FMT: FAIL
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit 44c03802a5191626996ee9db4bac090b164ca340
Author: Hans Verkuil 
Date:   Fri Oct 17 15:26:40 2025 +0200

    media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
    
    The isp_video_mbus_to_pix/pix_to_mbus functions did not take
    the last empty entry { 0, } of the formats array into account.
    
    As a result, isp_video_mbus_to_pix would accept code 0 and
    isp_video_pix_to_mbus would select code 0 if no match was found.
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit a03c909815639875f214c9d680839d48fa7cb29f
Author: Hans Verkuil 
Date:   Wed Apr 30 09:17:33 2025 +0200

    media: omap3isp: add V4L2_CAP_IO_MC and don't set bus_info
    
    Since this is a media-centric device set the V4L2_CAP_IO_MC
    capability. Also don't set bus_info, leave that to the v4l2 core.
    
    This fixes v4l2-compliance errors:
    
    test MC information (see 'Media Driver Info' above): OK
            fail: v4l2-compliance.cpp(661): missing bus_info prefix ('media')
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit e0ac618fff090ea8fd4423f1e3c7eb7d34d8b184
Author: Hans Verkuil 
Date:   Wed Apr 30 09:12:27 2025 +0200

    media: omap3isp: configure entity functions
    
    For the various subdevices, set the function field.
    
    This fixes v4l2-compliance errors:
    
    $ v4l2-compliance -M0
    v4l2-compliance 1.33.0-5410, 32 bits, 64-bit time_t
    v4l2-compliance SHA: c12c89c5bd70 2025-10-05 09:58:42
    
    Compliance test for omap3isp device /dev/media0:
    
    Media Driver Info:
    Driver name      : omap3isp
    Model            : TI OMAP3 ISP
    Serial           :
    Bus info         : platform:480bc000.isp
    Media version    : 6.17.0
    Hardware revision: 0x000000f0 (240)
    Driver version   : 6.17.0
    
    Required ioctls:
    test MEDIA_IOC_DEVICE_INFO: OK
    test invalid ioctls: OK
    
    Allow for multiple opens:
    test second /dev/media0 open: OK
    test MEDIA_IOC_DEVICE_INFO: OK
    test for unlimited opens: OK
    
    Media Controller ioctls:
    fail: v4l2-test-media.cpp(108): function == MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN
    fail: v4l2-test-media.cpp(196): checkFunction(ent.function, true)
    test MEDIA_IOC_G_TOPOLOGY: FAIL
    fail: v4l2-test-media.cpp(398): num_data_links != num_links
    test MEDIA_IOC_ENUM_ENTITIES/LINKS: FAIL
    test MEDIA_IOC_SETUP_LINK: OK
    
    Total for omap3isp device /dev/media0: 8, Succeeded: 6, Failed: 2, Warnings: 0
    
    Signed-off-by: Hans Verkuil 
    Acked-by: Sakari Ailus 

commit ab0308aee3819a3eccde42f9eb5bb01d6733be38
Author: Tony Luck 
Date:   Wed Dec 17 09:20:58 2025 -0800

    x86,fs/resctrl: Handle events that can be read from any CPU
    
    resctrl assumes that monitor events can only be read from a CPU in the
    cpumask_t set of each domain.  This is true for x86 events accessed with an
    MSR interface, but may not be true for other access methods such as MMIO.
    
    Introduce and use flag mon_evt::any_cpu, settable by architecture, that
    indicates there are no restrictions on which CPU can read that event.  This
    flag is not supported by the L3 event reading that requires to be run on a CPU
    that belongs to the L3 domain of the event being read.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit dd110880e80d35ad07e460e7a8da007c8058e7bf
Author: Tony Luck 
Date:   Wed Dec 17 09:20:57 2025 -0800

    fs/resctrl: Make event details accessible to functions when reading events
    
    Reading monitoring event data from MMIO requires more context than the event id
    to be able to read the correct memory location. struct mon_evt is the appropriate
    place for this event specific context.
    
    Prepare for addition of extra fields to struct mon_evt by changing the calling
    conventions to pass a pointer to the mon_evt structure instead of just the
    event id.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit a1a359e12a4226f3ade63ee1c08cf21ce896a07a
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:48:02 2026 +0100

    soc: dove: pmu: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Andrew Lunn 
    Signed-off-by: Gregory CLEMENT 

commit 898a23193bd860234342eef6ebcc00e9199e3513
Author: Geert Uytterhoeven 
Date:   Mon Dec 22 10:14:27 2025 +0100

    ARM: shmobile: defconfig: Refresh for v6.19-rc1
    
    Refresh the defconfig for Renesas ARM systems:
      - Enable Renesas RZ/N1 ADC support,
      - Drop CONFIG_RPCSEC_GSS_KRB5=n (no longer auto-enabled since now
        commit 324be6dcbf09133a ('Revert "SUNRPC: Make RPCSEC_GSS_KRB5
        select CRYPTO instead of depending on it"')).
    
    Signed-off-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/2dc339bee5bee0a425e2b00bbb784b0ec21a0a33.1766394793.git.geert+renesas@glider.be

commit fc913a1c9df1216db1e33dcea4eb864fd0ca794a
Author: Claudiu Beznea 
Date:   Wed Nov 19 16:35:23 2025 +0200

    arm64: defconfig: Enable PCIe for the Renesas RZ/G3S SoC
    
    Enable PCIe for the Renesas RZ/G3S SoC.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Claudiu Beznea 
    Acked-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251119143523.977085-7-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 4e9153de25bf3c89b90f63cb4d155abc7f1a2117
Author: Biju Das 
Date:   Tue Sep 16 16:02:45 2025 +0100

    arm64: defconfig: Enable RZ/G3E USB3 PHY driver
    
    Enable the RZ/G3E USB3 PHY driver on the Renesas RZ/G3E SMARC EVK board.
    
    Signed-off-by: Biju Das 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20250916150255.4231-10-biju.das.jz@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit aca3bbde0fdb263081b5ff1e60f066704dd1a19e
Author: Wolfram Sang 
Date:   Mon Dec 15 12:47:20 2025 +0900

    arm64: dts: renesas: r8a779h0: Add WWDT nodes
    
    Signed-off-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251215034715.3406-14-wsa+renesas@sang-engineering.com
    Signed-off-by: Geert Uytterhoeven 

commit 2dc4f97074c867e823f3f8b08f04e7d031a8acad
Author: Wolfram Sang 
Date:   Mon Dec 15 12:47:19 2025 +0900

    arm64: dts: renesas: r8a779g0: Add WWDT nodes
    
    Signed-off-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251215034715.3406-13-wsa+renesas@sang-engineering.com
    Signed-off-by: Geert Uytterhoeven 

commit b7c182ff3218ca31f97d102e6c958d184159eb1e
Author: Wolfram Sang 
Date:   Mon Dec 15 12:47:18 2025 +0900

    arm64: dts: renesas: r8a779f0: Add WWDT nodes
    
    Signed-off-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251215034715.3406-12-wsa+renesas@sang-engineering.com
    Signed-off-by: Geert Uytterhoeven 

commit 65be6f4a468c9005b6b28d9fcae21f12a97b9086
Author: Wolfram Sang 
Date:   Mon Dec 15 12:47:17 2025 +0900

    arm64: dts: renesas: r8a779a0: Add WWDT nodes
    
    Tested-by: Niklas Söderlund 
    Signed-off-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251215034715.3406-11-wsa+renesas@sang-engineering.com
    Signed-off-by: Geert Uytterhoeven 

commit 84e41ebccda4577ac9b41040b265e27c8905215d
Author: Wolfram Sang 
Date:   Mon Dec 15 12:47:16 2025 +0900

    arm64: dts: renesas: r8a77980: Add WWDT nodes
    
    Signed-off-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251215034715.3406-10-wsa+renesas@sang-engineering.com
    Signed-off-by: Geert Uytterhoeven 

commit 860d9b042c5d99dacb76f29ea79b74e9a0a1ea84
Author: Wolfram Sang 
Date:   Mon Dec 15 12:47:15 2025 +0900

    arm64: dts: renesas: r8a77970: Add WWDT nodes
    
    Signed-off-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251215034715.3406-9-wsa+renesas@sang-engineering.com
    Signed-off-by: Geert Uytterhoeven 

commit cb12cfa7f650cfa315994a43ce7f795f62d19e15
Author: Wolfram Sang 
Date:   Mon Dec 15 12:13:19 2025 +0900

    arm64: dts: renesas: condor/v3hsk: Mark SWDT as reserved
    
    This watchdog can't be used with Linux because the firmware needs it on
    R-Car V3H boards.  Sadly, it doesn't mark the node as reserved, so this
    is added manually here.
    
    Signed-off-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251215031318.2219-6-wsa+renesas@sang-engineering.com
    Signed-off-by: Geert Uytterhoeven 

commit 556a9d46fd8a5e4455b594570ad01152cb0381be
Author: Wolfram Sang 
Date:   Mon Dec 15 12:13:18 2025 +0900

    arm64: dts: renesas: r8a77980: Add SWDT node
    
    Signed-off-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251215031318.2219-5-wsa+renesas@sang-engineering.com
    Signed-off-by: Geert Uytterhoeven 

commit f3d22e5f6392d05d61438455bce40bfb766bf2b4
Author: Ovidiu Panait 
Date:   Tue Dec 9 09:11:15 2025 +0000

    arm64: dts: renesas: r9a09g056: Add TSU nodes
    
    The Renesas RZ/V2N SoC includes a Thermal Sensor Unit (TSU) block designed
    to measure the junction temperature. The device provides real-time
    temperature measurements for thermal management, utilizing two dedicated
    channels for temperature sensing:
    - TSU0, which is located near the DRP-AI block
    - TSU1, which is located near the CPU and DRP-AI block
    
    Since TSU1 is physically closer the CPU and the highest temperature
    spot, it is used for CPU throttling through a passive trip and cooling
    map. TSU0 is configured only with a critical trip.
    
    Add TSU nodes along with thermal zones and keep them enabled in the SoC
    DTSI.
    
    Signed-off-by: Ovidiu Panait 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251209091115.8541-4-ovidiu.panait.rb@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 57a0c2d36c646a64c117de534b787abe0a0b8bcf
Author: Cosmin Tanislav 
Date:   Fri Dec 5 17:12:54 2025 +0200

    arm64: dts: renesas: r9a09g087: Add DMAC support
    
    The Renesas RZ/N2H (R9A09G087) SoC has three instances of the DMAC IP.
    
    Add support for them.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251205151254.2970669-7-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 50f51092bff57a143906a428056ff103fa75ef21
Author: Cosmin Tanislav 
Date:   Fri Dec 5 17:12:53 2025 +0200

    arm64: dts: renesas: r9a09g077: Add DMAC support
    
    The Renesas RZ/T2H (R9A09G077) SoC has three instances of the DMAC IP.
    
    Add support for them.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251205151254.2970669-6-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit d42c64cf161644929de081e541afbab33acb231a
Author: Cosmin Tanislav 
Date:   Mon Dec 1 13:29:33 2025 +0200

    arm64: dts: renesas: r9a09g087: Add ICU support
    
    The Renesas RZ/N2H (R9A09G087) SoC has an Interrupt Controller (ICU)
    block that routes external interrupts to the GIC's SPIs, with the
    ability of level-translation, and can also produce software and
    aggregate error interrupts.
    
    Add support for it.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251201112933.488801-5-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit f060bbe2c32941acc4738cc27039246593f49a33
Author: Cosmin Tanislav 
Date:   Mon Dec 1 13:29:32 2025 +0200

    arm64: dts: renesas: r9a09g077: Add ICU support
    
    The Renesas RZ/T2H (R9A09G077) SoC has an Interrupt Controller (ICU)
    block that routes external interrupts to the GIC's SPIs, with the
    ability of level-translation, and can also produce software and
    aggregate error interrupts.
    
    Add support for it.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251201112933.488801-4-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 835666e7403c3ddc6f3122888d975464f8272efe
Author: Biju Das 
Date:   Sat Nov 29 18:51:58 2025 +0000

    arm64: dts: renesas: r9a09g047e57-smarc: Enable rsci{2,4,9} nodes
    
    Enable device rsci{2,4,9} nodes for the RZ/G3E SMARC EVK.
    
    Signed-off-by: Biju Das 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251129185203.380002-4-biju.das.jz@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit ccf2044987b41dc589de6a86b35d3a4f8ea14762
Author: Biju Das 
Date:   Sat Nov 29 18:51:57 2025 +0000

    arm64: dts: renesas: renesas-smarc2: Move aliases to board DTS
    
    SMARC2 board dtsi is common for multiple SoCs. So Move aliases
    to board DTS as SoC may have different IPs for a given alias.
    eg: RZ/G3S does not have RSCI interface.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Biju Das 
    Link: https://patch.msgid.link/20251129185203.380002-3-biju.das.jz@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit ef601dbb5b80a0240dc479ca0aa5fbd746f23ca7
Author: Biju Das 
Date:   Sat Nov 29 18:51:56 2025 +0000

    arm64: dts: renesas: r9a09g047: Add RSCI nodes
    
    Add RSCI nodes to RZ/G3E ("R9A09G047") SoC DTSI.
    
    Signed-off-by: Biju Das 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251129185203.380002-2-biju.das.jz@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit f2d5d0ba4cf7a080a4e42f462cbb1bddceac92c7
Author: Geert Uytterhoeven 
Date:   Thu Nov 27 14:13:13 2025 +0100

    ARM: dts: renesas: r9a06g032: Add Ethernet switch interrupts
    
    The Ethernet switch device node still lacks interrupts.  Add them.
    
    Signed-off-by: Geert Uytterhoeven 
    Reviewed-by: Lad Prabhakar 
    Link: https://patch.msgid.link/53d45eed3709cba589a4ef3e9ad198d7e44fd9a5.1764249063.git.geert+renesas@glider.be

commit 41e60d92c88c0085511b38077dad2939bf63ddfc
Author: Lad Prabhakar 
Date:   Tue Nov 25 22:45:33 2025 +0000

    arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Add NMI wakeup button support
    
    Add support for the NMI connected user pushbutton on the RZ/V2N EVK.
    The button is wired to the SoC NMI input and can be used to wake the
    system from low-power states.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251125224533.294235-5-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 4018dfc222a793f6a4fc5dfb98c883ef3782eb0f
Author: Lad Prabhakar 
Date:   Tue Nov 25 22:45:32 2025 +0000

    arm64: dts: renesas: r9a09g056: Add RSPI nodes
    
    Add nodes for the RSPI IPs found in the Renesas RZ/V2N SoC.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251125224533.294235-4-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 7d8b4a6672ecaa8540bf4041fea09b5ea6d78070
Author: Lad Prabhakar 
Date:   Tue Nov 25 22:45:31 2025 +0000

    arm64: dts: renesas: r9a09g056: Add DMAC nodes
    
    Add nodes for the DMAC IPs found on the Renesas RZ/V2N SoC.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251125224533.294235-3-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit b449dbc0bb0301277a6de444901a7122214c090d
Author: Lad Prabhakar 
Date:   Tue Nov 25 22:45:30 2025 +0000

    arm64: dts: renesas: r9a09g056: Add ICU node
    
    Add node for the Interrupt Control Unit IP found on the Renesas
    RZ/V2N SoC, and modify the pinctrl node as its interrupt parent
    is the ICU node.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251125224533.294235-2-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 44cfd102ce28e749a07bb0f1668cf932077b1175
Author: Geert Uytterhoeven 
Date:   Tue Nov 25 17:52:06 2025 +0100

    arm64: dts: renesas: r9a09g047e57-smarc: Remove duplicate SW_LCD_EN
    
    SW_LCD_EN is defined twice.
    
    Fixes: 9e95446b0cf93a91 ("arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys")
    Signed-off-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/1f93558c62f4461f50935644ec831a7d2cb52630.1764089463.git.geert+renesas@glider.be

commit 3c77f58d108c80c464a0676aeaa3dbf791883f19
Author: Cosmin Tanislav 
Date:   Wed Nov 19 18:14:34 2025 +0200

    arm64: dts: renesas: r9a09g087: Add SPI nodes
    
    Add support for the four SPI controllers on the Renesas RZ/N2H Soc.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251119161434.595677-14-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit fb8f11c7975ad6096437e6a6757c98c9c9475551
Author: Cosmin Tanislav 
Date:   Wed Nov 19 18:14:33 2025 +0200

    arm64: dts: renesas: r9a09g077: Add SPI nodes
    
    Add support for the four SPI controllers on the Renesas RZ/T2H Soc.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251119161434.595677-13-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 73b73af99a49fd7bf0515741734660973fa2002a
Author: Claudiu Beznea 
Date:   Wed Nov 19 16:35:22 2025 +0200

    arm64: dts: renesas: rzg3s-smarc: Enable PCIe
    
    The RZ Smarc Carrier-II board has PCIe headers mounted on it. Enable PCIe
    support.
    
    Tested-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Claudiu Beznea 
    Acked-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251119143523.977085-6-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 1a66160fb28abcd228f69e00bb183a4749f23805
Author: Claudiu Beznea 
Date:   Wed Nov 19 16:35:21 2025 +0200

    arm64: dts: renesas: rzg3s-smarc-som: Add PCIe reference clock
    
    Versa3 clock generator available on RZ/G3S SMARC Module provides the
    reference clock for SoC PCIe interface. Update the device tree to reflect
    this connection.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Claudiu Beznea 
    Acked-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251119143523.977085-5-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 40a4c75e7f7170f4dc9f077ae480fe5775a780a1
Author: Claudiu Beznea 
Date:   Wed Nov 19 16:35:20 2025 +0200

    arm64: dts: renesas: r9a08g045: Add PCIe node
    
    The RZ/G3S SoC has a variant (R9A08G045S33) which supports PCIe. Add the
    PCIe node.
    
    Tested-by: Wolfram Sang 
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Claudiu Beznea 
    Acked-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251119143523.977085-4-claudiu.beznea.uj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit f221ce9f7c13ce2c1c9e4fd79743d18fb098f19a
Author: Lad Prabhakar 
Date:   Wed Nov 19 11:05:05 2025 +0000

    arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable USB3.0 PHY and xHCI controller
    
    Enable the USB3.0 (CH0) host controllers on the RZ/V2N Evaluation Kit.
    The CN4 connector on the EVK provides access to the USB3.0 channel.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251119110505.100253-5-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 9dd6097c353cf27e1e144d42030867dc8ed4bf56
Author: Lad Prabhakar 
Date:   Wed Nov 19 11:05:04 2025 +0000

    arm64: dts: renesas: r9a09g056: Add USB3 PHY/Host nodes
    
    Add USB3 PHY/Host nodes to RZ/V2N ("R9A09G056") SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251119110505.100253-4-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 7ef7ba62ec5cd1d32fd282669d0ff947df255408
Author: Lad Prabhakar 
Date:   Wed Nov 19 11:05:03 2025 +0000

    arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable USB3.0 PHYs and xHCI controllers
    
    Enable the USB3.0 (CH0) and USB3.1 (CH1) host controllers on the RZ/V2H
    Evaluation Kit. The CN4 stacked connector on the EVK provides access to
    both channels, with CH0 corresponding to USB3.0 and CH1 to USB3.1.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251119110505.100253-3-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 92279daefc1740961404bca0a7f5149bf6b23dea
Author: Lad Prabhakar 
Date:   Wed Nov 19 11:05:02 2025 +0000

    arm64: dts: renesas: r9a09g057: Add USB3 PHY/Host nodes
    
    Add USB3 PHY/Host nodes to RZ/V2H(P) ("R9A09G057") SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251119110505.100253-2-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 9a5a73dca92aa120ec1ab8b510eb4dbbd653d4e2
Author: Lad Prabhakar 
Date:   Mon Nov 3 20:03:49 2025 +0000

    arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable DU and DSI
    
    Enable DU, DSI and adv7535 HDMI encoder on RZ/V2N Evaluation Kit.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251103200349.62087-4-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit d8332e5f3384c17b55025cfcf35733eeffeac3c5
Author: Lad Prabhakar 
Date:   Mon Nov 3 20:03:48 2025 +0000

    arm64: dts: renesas: r9a09g056: Add DU and DSI nodes
    
    Add DU and DSI nodes to RZ/V2N SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251103200349.62087-3-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 6569dced2b98fc44c55640efc735d301eeac2387
Author: Lad Prabhakar 
Date:   Mon Nov 3 20:03:47 2025 +0000

    arm64: dts: renesas: r9a09g056: Add FCPV and VSPD nodes
    
    Add FCPV and VSPD nodes to RZ/V2N SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251103200349.62087-2-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 71270e792c72da7c0078a0af67f7f15aa24c1403
Author: Nobuhiro Iwamatsu 
Date:   Sat Nov 1 16:29:51 2025 +0900

    arm64: dts: renesas: r9a09g057h48-kakip: Enable SPI NOR Flash
    
    This enables W25Q256JWPIM NOR Flash connected to XSPI.
    Additionally, this adds fixed 1.8V regulator node (`reg_1p8v`) required for
    NOR Flash.
    
    Signed-off-by: Nobuhiro Iwamatsu 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251101072951.2681630-1-iwamatsu@nigauri.org
    Signed-off-by: Geert Uytterhoeven 

commit 947acdadcae0b1759f082266893d277cfb5b29c1
Author: Lad Prabhakar 
Date:   Thu Oct 23 22:23:14 2025 +0100

    arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable DU and DSI
    
    Enable DU, DSI and adv7535 HDMI encoder on RZ/V2H Evaluation Kit.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251023212314.679303-4-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit ebb6adecb992d5c6f16a830b9361092a1e791755
Author: Lad Prabhakar 
Date:   Thu Oct 23 22:23:13 2025 +0100

    arm64: dts: renesas: r9a09g057: Add DU and DSI nodes
    
    Add DU and DSI nodes to RZ/V2H(P) SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251023212314.679303-3-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 0154078db6abbc8f1adc216e1b20472f0b50aaf8
Author: Lad Prabhakar 
Date:   Thu Oct 23 22:23:12 2025 +0100

    arm64: dts: renesas: r9a09g057: Add FCPV and VSPD nodes
    
    Add FCPV and VSPD nodes to RZ/V2H(P) SoC DTSI.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251023212314.679303-2-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 00d3dbc4744dc3213c150fb33c47697a7c60fb2f
Author: Cosmin Tanislav 
Date:   Wed Oct 22 10:31:40 2025 +0300

    arm64: dts: renesas: rzt2h-n2h-evk: Add note about SD1 1.8V modes
    
    1.8V operation of SD1 requires the jumper to be placed on the correct
    pins of a connector on these Evaluation Kits. 1.8V is needed to achieve
    the higher rated speeds like SDR104. Add a note about it to make sure no
    one else spends too much time figuring this out.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251022073141.1989762-1-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 9bf0bd7bdea6c402007ffb784dd0c0f704aa2310
Author: Cristian Ciocaltea 
Date:   Wed Dec 31 22:04:21 2025 +0200

    ASoC: nau8821: Sort #include directives
    
    Make sure #include directives are ordered alphabetically.
    
    Signed-off-by: Cristian Ciocaltea 
    Link: https://patch.msgid.link/20251231-nau8821-cleanup-v1-7-6b0b76cbbb64@collabora.com
    Signed-off-by: Mark Brown 

commit 42ca16e3bace1e76803876358ea908ce9d87e0d4
Author: Cristian Ciocaltea 
Date:   Wed Dec 31 22:04:20 2025 +0200

    ASoC: nau8821: Drop unneeded braces in nau8821_hw_params()
    
    Get rid of the superfluous braces and silent checkpatch complaint:
    
      WARNING: braces {} are not necessary for any arm of this statement
    
    Signed-off-by: Cristian Ciocaltea 
    Link: https://patch.msgid.link/20251231-nau8821-cleanup-v1-6-6b0b76cbbb64@collabora.com
    Signed-off-by: Mark Brown 

commit fd843051b8cad777f69cd09c797b4a2d81d48f4c
Author: Cristian Ciocaltea 
Date:   Wed Dec 31 22:04:19 2025 +0200

    ASoC: nau8821: Simplify conditional in nau8821_get_osr()
    
    Get rid of the unnecessary branch to address checkpatch complaint:
    
      WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Cristian Ciocaltea 
    Link: https://patch.msgid.link/20251231-nau8821-cleanup-v1-5-6b0b76cbbb64@collabora.com
    Signed-off-by: Mark Brown 

commit 2a3dc1bcc75e357e4e68c92ff9b9e7f6e775c3e7
Author: Cristian Ciocaltea 
Date:   Wed Dec 31 22:04:18 2025 +0200

    ASoC: nau8821: Drop superfluous return statement
    
    Simplify error handling in nau8821_enable_jack_detect() by removing the
    unnecessary return after logging the request irq message.
    
    Signed-off-by: Cristian Ciocaltea 
    Link: https://patch.msgid.link/20251231-nau8821-cleanup-v1-4-6b0b76cbbb64@collabora.com
    Signed-off-by: Mark Brown 

commit 7786b10688ac0ebeaff655923cbb2c7d34a98995
Author: Cristian Ciocaltea 
Date:   Wed Dec 31 22:04:17 2025 +0200

    ASoC: nau8821: Cancel pending work before suspend
    
    A jack detection work that is unscheduled or in progress while executing
    the suspend handler could trigger a race condition.
    
    Ensure state consistency by cancelling any pending work or wait for its
    execution to complete before processing the suspend.  Since driver
    (re)enables both insert and eject interrupts on resume, there is no risk
    to miss the related jack events.  Therefore, flush_delayed_work() is not
    required here.
    
    Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
    Fixes: ee70bacef1c6 ("ASoC: nau8821: Avoid unnecessary blocking in IRQ handler")
    Signed-off-by: Cristian Ciocaltea 
    Link: https://patch.msgid.link/20251231-nau8821-cleanup-v1-3-6b0b76cbbb64@collabora.com
    Signed-off-by: Mark Brown 

commit dbd3fd05cddfdeec1e49b0a66269881c09eebd17
Author: Cristian Ciocaltea 
Date:   Wed Dec 31 22:04:16 2025 +0200

    ASoC: nau8821: Cancel delayed work on component remove
    
    Attempting to unload the driver while a jack detection work is pending
    would likely crash the kernel when it is eventually scheduled for
    execution:
    
    [ 1984.896308] BUG: unable to handle page fault for address: ffffffffc10c2a20
    [...]
    [ 1984.896388] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024
    [ 1984.896396] Workqueue: events nau8821_jdet_work [snd_soc_nau8821]
    [ 1984.896414] RIP: 0010:__mutex_lock+0x9f/0x11d0
    [...]
    [ 1984.896504] Call Trace:
    [ 1984.896511]  
    [ 1984.896524]  ? snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core]
    [ 1984.896572]  ? snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core]
    [ 1984.896596]  snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core]
    [ 1984.896622]  nau8821_jdet_work+0xeb/0x1e0 [snd_soc_nau8821]
    [ 1984.896636]  process_one_work+0x211/0x590
    [ 1984.896649]  ? srso_return_thunk+0x5/0x5f
    [ 1984.896670]  worker_thread+0x1cd/0x3a0
    
    Cancel unscheduled jdet_work or wait for its execution to finish before
    the component driver gets removed.
    
    Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
    Fixes: ee70bacef1c6 ("ASoC: nau8821: Avoid unnecessary blocking in IRQ handler")
    Signed-off-by: Cristian Ciocaltea 
    Link: https://patch.msgid.link/20251231-nau8821-cleanup-v1-2-6b0b76cbbb64@collabora.com
    Signed-off-by: Mark Brown 

commit 70237853edf0a69773a7370eb74ea2a44dfe3050
Author: Cristian Ciocaltea 
Date:   Wed Dec 31 22:04:15 2025 +0200

    ASoC: nau8821: Fixup nau8821_enable_jack_detect()
    
    The nau8821_enable_jack_detect() function was supposed to allow enabling
    or disabling jack events reporting.  However, once enabled, any
    subsequent invocation would fail and the following splat is shown:
    
    [ 3136.996771] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024
    [ 3136.996773] Workqueue: events_unbound deferred_probe_work_func
    [ 3136.996780] Call Trace:
    [ 3136.996782]  
    [ 3136.996787]  dump_stack_lvl+0x6e/0xa0
    [ 3136.996796]  __setup_irq.cold+0x9c/0xce
    [ 3136.996803]  ? __pfx_irq_default_primary_handler+0x10/0x10
    [ 3136.996812]  ? __pfx_nau8821_interrupt+0x10/0x10 [snd_soc_nau8821]
    [ 3136.996825]  request_threaded_irq+0xd9/0x160
    [ 3136.996853]  devm_request_threaded_irq+0x71/0xd0
    [ 3136.996859]  ? __pfx_nau8821_interrupt+0x10/0x10 [snd_soc_nau8821]
    [ 3136.996882]  nau8821_enable_jack_detect+0xa5/0xc0 [snd_soc_nau8821]
    [ 3136.996901]  acp5x_8821_init+0x8d/0xa0 [snd_soc_acp5x_mach]
    [ 3136.996917]  snd_soc_link_init+0x25/0x50 [snd_soc_core]
    [ 3136.996958]  snd_soc_bind_card+0x615/0xd00 [snd_soc_core]
    [ 3136.997026]  snd_soc_register_card+0x1b2/0x1c0 [snd_soc_core]
    [ 3136.997064]  devm_snd_soc_register_card+0x47/0x90 [snd_soc_core]
    [ 3136.997108]  acp5x_probe+0x72/0xb0 [snd_soc_acp5x_mach]
    [...]
    [ 3136.997508] nau8821 i2c-NVTN2020:00: Cannot request irq 58 (-16)
    
    Introduce jdet_active flag to driver data structure and use it to
    provide one-time initialization of the jack detection work queue and
    related interrupt line.
    
    Note this is also a prerequisite for additional fixes around module
    unloading and suspend handling.
    
    Fixes: aab1ad11d69f ("ASoC: nau8821: new driver")
    Signed-off-by: Cristian Ciocaltea 
    Link: https://patch.msgid.link/20251231-nau8821-cleanup-v1-1-6b0b76cbbb64@collabora.com
    Signed-off-by: Mark Brown 

commit ba23adb6533149df33b9a247f31a87227b3c86d5
Merge: 6574f01ef95dd9 3609fa95fb0f2c
Author: Arnaldo Carvalho de Melo 
Date:   Mon Jan 5 10:17:53 2026 -0300

    Merge remote-tracking branch 'torvalds/master' into perf-tools-next
    
    To pick up perf-tools fixes.
    
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 96d337436fe0921177a6090aeb5bb214753654fc
Author: Robert Marko 
Date:   Mon Dec 29 19:37:45 2025 +0100

    spi: dt-bindings: at91: add microchip,lan9691-spi
    
    Document Microchip LAN969x SPI compatible.
    
    Signed-off-by: Robert Marko 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251229184004.571837-5-robert.marko@sartura.hr
    Signed-off-by: Mark Brown 

commit 52ddc0106c77ff0eacf07b309833ae6e6a4e8587
Author: Hsieh Hung-En 
Date:   Wed Dec 31 16:45:54 2025 +0800

    ASoC: es8328: Remove duplicate DAPM routes
    
    The DAPM routes for "Left Line Mux" and "Right Line Mux" are defined
    twice in es8328_dapm_routes[]. The redundant entries appear after
    the "Mic Bias" route and duplicate the definitions found earlier in
    the array.
    
    Remove the duplicate entries to clean up the code.
    
    Tested on Rockchip RK3588 with ES8328 codec. Verified that removing
    the duplicate routes does not alter the DAPM graph or the mixer
    controls. Both 'tinymix' output and DAPM widget lists remain
    identical to the baseline.
    
    Signed-off-by: Hsieh Hung-En 
    Link: https://patch.msgid.link/20251231084554.265916-1-hungen3108@gmail.com
    Signed-off-by: Mark Brown 

commit 420739112e95c9bb286b4e87875706925970abd3
Author: Oder Chiou 
Date:   Wed Dec 31 10:37:11 2025 +0800

    ASoC: rt5575: Add the codec driver for the ALC5575
    
    The ALC5575 integrates an audio DSP that typically loads its firmware
    from an external flash via its own SPI host interface. In certain
    hardware configurations, the firmware can alternatively be loaded
    through the SPI client interface. The driver provides basic mute and
    volume control functions. When the SPI client interface is enabled,
    firmware loading is handled by the SPI driver.
    
    Signed-off-by: Oder Chiou 
    Link: https://patch.msgid.link/17c36d07af44ffb1d600977955da95852f8d60f3.1767148150.git.oder_chiou@realtek.com
    Signed-off-by: Mark Brown 

commit af4c0b951b18a8af73fa8541fabf1bf2484bba9b
Author: Oder Chiou 
Date:   Wed Dec 31 10:37:01 2025 +0800

    ASoC: dt-bindings: realtek,rt5575: add support for ALC5575
    
    Audio codec with I2S, I2C and SPI.
    
    Signed-off-by: Oder Chiou 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/cad38383a8f4c7235158779c270fee7f61bf6cfe.1767148150.git.oder_chiou@realtek.com
    Signed-off-by: Mark Brown 

commit 037f8d896688bf3384eb6bf34e24e8fbc9f6e02d
Author: Oder Chiou 
Date:   Wed Dec 31 10:36:49 2025 +0800

    spi: change of_find_spi_controller_by_node() gating to CONFIG_OF
    
    Currently, the helper of_find_spi_controller_by_node() is gated under
    CONFIG_OF_DYNAMIC. This prevents drivers from using it in all CONFIG_OF
    configurations.
    
    This patch moves the gating to CONFIG_OF, keeping the inline fallback
    returning NULL when Device Tree support is disabled.
    
    Signed-off-by: Oder Chiou 
    Link: https://patch.msgid.link/6d8ae977d9f4726ea23ad5382638750593f9a2e4.1767148150.git.oder_chiou@realtek.com
    Signed-off-by: Mark Brown 

commit ee69f55eb183efb43da14cdad72910b1b1cc2932
Author: Oder Chiou 
Date:   Wed Dec 31 10:35:44 2025 +0800

    spi: export of_find_spi_controller_by_node()
    
    Some devices are primarily described on another bus (e.g. I2C) but also
    have an additional SPI connection that serves as a transport for
    firmware loading. Export of_find_spi_controller_by_node() so drivers can
    obtain the SPI controller referenced by a DT phandle.
    
    Signed-off-by: Oder Chiou 
    Reviewed-by: Cezary Rojewski 
    Link: https://patch.msgid.link/0e572a00aa305e588357162d400ba9472ce56dd3.1767148150.git.oder_chiou@realtek.com
    Signed-off-by: Mark Brown 

commit 4c5e6d5b31bc623d89185d551681ab91cfd037c9
Author: Zhang Yi 
Date:   Mon Jan 5 17:15:48 2026 +0800

    ASoC: codecs: ES8389: Update clock configuration
    
    To ensure better performance of the codec, different configurations
    will be employed based on power supply conditions.
    
    Signed-off-by: Zhang Yi 
    Link: https://patch.msgid.link/20260105091548.4196-6-zhangyi@everest-semi.com
    Signed-off-by: Mark Brown 

commit e5077facc770a9348d653dd9f1dbafb747a87e38
Author: Zhang Yi 
Date:   Mon Jan 5 17:15:47 2026 +0800

    ASoC: codecs: ES8389: Add members about the version
    
    Execute different configurations based on version number
    in order to support different versions of es8389.
    
    Signed-off-by: Zhang Yi 
    Link: https://patch.msgid.link/20260105091548.4196-5-zhangyi@everest-semi.com
    Signed-off-by: Mark Brown 

commit b35340e997e0809e045692949a88adf56b0d1ea0
Author: Zhang Yi 
Date:   Mon Jan 5 17:15:46 2026 +0800

    ASoC: codecs: ES8389: Adjust wakeup configuration
    
    Update wake-up configuration to ensure the codec works properly.
    
    Signed-off-by: Zhang Yi 
    Link: https://patch.msgid.link/20260105091548.4196-4-zhangyi@everest-semi.com
    Signed-off-by: Mark Brown 

commit 59e447ca608bf869fed23a9bba8fcb513852f02b
Author: Zhang Yi 
Date:   Mon Jan 5 17:15:45 2026 +0800

    ASoC: codecs: ES8389: Add members related to power supply
    
    Added the members `avdd-supply` and `dvdd-supply` to
    enable the driver to get the power supply status.
    
    Signed-off-by: Zhang Yi 
    Link: https://patch.msgid.link/20260105091548.4196-3-zhangyi@everest-semi.com
    Signed-off-by: Mark Brown 

commit 163eb876a275e6139fcc81122c5d34fa521db25a
Author: Zhang Yi 
Date:   Mon Jan 5 17:15:44 2026 +0800

    ASoC: dt-bindings: ES8389: Add property about power supply
    
    Add VDDA supply and VDDD supply
    
    Signed-off-by: Zhang Yi 
    Link: https://patch.msgid.link/20260105091548.4196-2-zhangyi@everest-semi.com
    Signed-off-by: Mark Brown 

commit 211243b69533e968cc6f0259fb80ffee02fbe0ca
Author: Richard Fitzgerald 
Date:   Wed Dec 31 17:27:11 2025 +0000

    firmware: cs_dsp: test_bin: Add tests for offsets > 0xffff
    
    Add test cases for using the new long-offset block types to patch
    memory that is >0xffff from the algorithm base.
    
    This is just adding entries to the parameter data that have larger
    offset values.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20251231172711.450024-9-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 7fecf0bf1202599920d929704a3787291fc068db
Author: Richard Fitzgerald 
Date:   Wed Dec 31 17:27:10 2025 +0000

    firmware: cs_dsp: test_bin: Run test cases on long-offset blocks
    
    Run the patch block test cases using the new long-offset block type.
    
    This adds a new set of parameterization that uses
    cs_dsp_mock_bin_add_patch_off32() to create the patch blocks in the
    test bin file.
    
    The test cases for Halo Core with V3 file format include another
    run of the tests with the new parameterization, so that the tests
    are run on the standard blocks and the long-offset blocks.
    
    This commit does not add any new cases for offsets > 0xffff.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20251231172711.450024-8-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 6e60c6aa1e4b929f6fbb04dc9fa786aeaedf3693
Author: Richard Fitzgerald 
Date:   Wed Dec 31 17:27:09 2025 +0000

    firmware: cs_dsp: test: Increase size of XM and YM on Halo Core
    
    Increase the size of the XM and YM regions in the mock Halo Core
    register map for testing patch blocks with 32-bit offsets.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20251231172711.450024-7-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 880f1eb5b95ccf250f567927462a7d3fa8f2a727
Author: Richard Fitzgerald 
Date:   Wed Dec 31 17:27:08 2025 +0000

    firmware: cs_dsp: mock_bin: Add function to create long-offset patches
    
    Add cs_dsp_mock_bin_add_patch_off32(). This is the same as
    cs_dsp_mock_bin_add_patch() except that it puts the offset in the
    new 32-bit offset field and modifies the block type to indicate
    that it uses the long offset.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20251231172711.450024-6-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 9e6f4c5b2d3af58390cf554ada9591935c5ac774
Author: Richard Fitzgerald 
Date:   Wed Dec 31 17:27:07 2025 +0000

    firmware: cs_dsp: mock_bin: Pass offset32 to cs_dsp_mock_bin_add_raw_block()
    
    Add an argument to cs_dsp_mock_bin_add_raw_block() to pass a 32-bit
    offset, and change the type of the existing offset argument to u16.
    
    The cs_dsp_test_bin_error.c test uses cs_dsp_mock_bin_add_raw_block()
    so it needs corresponding updates to pass 0 as the 32-bit offset.
    
    Version 1 and 2 of the bin file format had a 16-bit offset on blocks
    and the sample rate field of the blocks was not used. Version 3 adds
    new block types that change the old sample rate field to be a 32-bit
    offset with the old offset currently unused.
    
    cs_dsp_mock_bin_add_raw_block() doesn't attempt to do any magic - its
    purpose is to create a raw block exactly as specified by the calling
    test code. So the test case can pass a value for both offset fields.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20251231172711.450024-5-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit a01816edf11fc9e6c8216bc03870311ce2add5a2
Author: Richard Fitzgerald 
Date:   Wed Dec 31 17:27:06 2025 +0000

    firmware: cs_dsp: test_bin: Make patch function a test parameter
    
    Make the call to cs_dsp_mock_bin_add_patch() a function pointer in
    the test case parameters, instead of calling it directly.
    
    This is to allow for future parameterization by which function to
    call to add a patch.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20251231172711.450024-4-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit afcbb0460e0a9f0e971512c66619fc649bdb86a6
Author: Richard Fitzgerald 
Date:   Wed Dec 31 17:27:05 2025 +0000

    firmware: cs_dsp: test_bin: Run test cases with v3 file format
    
    The new v3 file format has all the same functionality as the earlier
    formats, so run all the existing test cases with a file type of 3.
    This is only done for Halo Core because v3 files are not used with the
    older ADSP cores.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20251231172711.450024-3-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit bc0305cb294c693b2762cf863324defb9e5175e5
Author: Richard Fitzgerald 
Date:   Wed Dec 31 17:27:04 2025 +0000

    firmware: cs_dsp: Handle long-offset data blocks
    
    Handle a new type of data block that has a 32-bit offset. These are
    identical to the normal blocks except that the offset is now in the
    32-bit field that was previously 'sr'.
    
    A new file version of 3 indicates that it is mandatory to process
    the long-offset blocks, so that older code without that support will
    reject the file.
    
    The original 'sr' field was never used by the driver so it has been
    renamed offset32.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20251231172711.450024-2-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit b3af263b8a83f2ed033ae83fe008004b061b84f4
Author: Joel Granados 
Date:   Fri Dec 12 13:44:20 2025 +0100

    sysctl: Add kernel doc to proc_douintvec_conv
    
    This commit is making sure that all the functions that are part of the
    API are documented.
    
    Signed-off-by: Joel Granados 

commit 8fc344a5af7e73178e6ac54d396327655e9ea358
Author: Joel Granados 
Date:   Fri Nov 28 21:53:00 2025 +0100

    sysctl: Replace UINT converter macros with functions
    
    Replace the SYSCTL_USER_TO_KERN_UINT_CONV and SYSCTL_UINT_CONV_CUSTOM
    macros with functions with the same logic. This makes debugging easier
    and aligns with the functions preference described in coding-style.rst.
    Update the only user of this API: pipe.c.
    
    Signed-off-by: Joel Granados 

commit 6036dc03c39a3cb0df14899f29323b6b4b58dfe9
Author: Joel Granados 
Date:   Fri Dec 5 11:18:43 2025 +0100

    sysctl: Add CONFIG_PROC_SYSCTL guards for converter macros
    
    Wrap sysctl converter macros with CONFIG_PROC_SYSCTL conditional
    compilation. When CONFIG_PROC_SYSCTL is disabled, provide stub
    implementations that return -ENOSYS to prevent link errors while
    maintaining API compatibility.
    
    This ensures converter macros are only compiled when procfs sysctl
    support is enabled in the kernel configuration.
    
    Signed-off-by: Joel Granados 

commit ac3d6a4b60ef1b26b29517d35ca28966142fc65e
Author: Joel Granados 
Date:   Fri Nov 28 22:47:54 2025 +0100

    sysctl: clarify proc_douintvec_minmax doc
    
    Specify that the range check is only when assigning kernel variable
    
    Signed-off-by: Joel Granados 

commit 11400f86c28eaeb8d0cc22fef3f16fdd87d46214
Author: Joel Granados 
Date:   Mon Dec 8 14:33:17 2025 +0100

    sysctl: Return -ENOSYS from proc_douintvec_conv when CONFIG_PROC_SYSCTL=n
    
    Ensure an error if prco_douintvec_conv is erroneously called in a system
    with CONFIG_PROC_SYSCTL=n
    
    Signed-off-by: Joel Granados 

commit f7386f545e49e5e6229a14d92b39340d155b0b3f
Author: Joel Granados 
Date:   Mon Nov 3 22:29:08 2025 +0100

    sysctl: Remove unused ctl_table forward declarations
    
    Remove superfluous forward declarations of ctl_table from header files
    where they are no longer needed. These declarations were left behind
    after sysctl code refactoring and cleanup.
    
    Reviewed-by: Jan Kara 
    Acked-by: Muchun Song 
    Reviewed-by: Petr Mladek 
    Acked-by: Paolo Abeni 
    Signed-off-by: Joel Granados 

commit a2564d0688db20a1ee1660f45d7823075feb12a7
Author: Joel Granados 
Date:   Fri Dec 5 09:43:11 2025 +0100

    loadpin: Implement custom proc_handler for enforce
    
    Add a new static variable (loadpin_root_writable) to keep the
    write-ability state of enforce. Remove set_sysctl and const qualify
    loadpin_sysctl_table (moves into .rodata) as there is no longer need to
    change the value of extra1. The new proc_handler_loadpin returns -EINVAL
    when loadpin_root_writable is false and the kernel var (enforce) is
    being written. The old way of modifying the write-ability of enforce
    stays in loadpin_check and is still set by calling sb_is_writable.
    
    Signed-off-by: Joel Granados 

commit b22d81fb683f22304f017b1b1674e6937bdd6d49
Author: Joel Granados 
Date:   Tue Dec 9 12:48:27 2025 +0100

    alloc_tag: move memory_allocation_profiling_sysctls into .rodata
    
    Remove the change in file mode permissions done before initializing the
    sysctl. It is not necessary as the writing of the kernel variable will
    be blocked by the proc_mem_profiling_handler when writing is disallowed
    (also controlled by mem_profiling_support).
    
    Acked-by: Suren Baghdasaryan 
    Signed-off-by: Joel Granados 

commit 486401052432f1ba1628e1eed59b3e6bfb07b5c1
Author: Joel Granados 
Date:   Thu Dec 4 13:36:57 2025 +0100

    sysctl: Add missing kernel-doc for proc_dointvec_conv
    
    Add kernel-doc documentation for the proc_dointvec_conv function to
    describe its parameters and return value.
    
    Reviewed-by: Kees Cook 
    Signed-off-by: Joel Granados 

commit ee5b462b97162dbb6c536e18a37b3048f6520019
Author: Ricardo Ribalda 
Date:   Wed Nov 19 19:37:13 2025 +0000

    media: uvcvideo: Document how to format GUIDs
    
    Manual formatting the GUIDs can lead to errors, document a
    programmatically way to format the GUIDs from lsusb into something that
    the driver can use.
    
    Signed-off-by: Ricardo Ribalda 
    Reviewed-by: Laurent Pinchart 
    Reviewed-by: Hans de Goede 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Hans Verkuil 

commit 27ccc44a511b0cd76dc607e2a4893b876192ee1b
Author: Ricardo Ribalda 
Date:   Wed Nov 19 19:37:10 2025 +0000

    media: uvcvideo: Remove nodrop parameter
    
    We announced the deprecation intentions one year ago in the commit
    commit 40ed9e9b2808 ("media: uvcvideo: Announce the user our deprecation
    intentions").
    
    We have not hear any complains, lets remove the nodrop parameter.
    
    Reviewed-by: Laurent Pinchart 
    Signed-off-by: Ricardo Ribalda 
    Reviewed-by: Hans de Goede 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Hans Verkuil 

commit f0487a90b2c50d4021c578a809144d800a703676
Author: John Bauer 
Date:   Mon Dec 1 17:06:53 2025 +0100

    media: uvcvideo: UVC minimum relative pan/tilt/zoom speed fix.
    
    In Video4Linux, a negative value in V4L2_CID_ZOOM_CONTINUOUS,
    V4L2_CID_PAN_SPEED and V4L2_CID_TILT_SPEED indicates a movement in the
    "opposite" direction to the standard direction.
    
    Currently, we were using -UVC_GET_MIN as the negative value, which
    resulted in the camera moving in the slowest possible speed.
    
    Quirk the driver to return -UVC_GET_MAX for the affected controls.
    
    Note that the get/set function from the mapping cannot be used for
    this, because we need to use the information from GET_MAX for GET_MIN
    and hacking uvc_ctrl_populate_cache seems like a worse alternative.
    
    Tested on OBSBOT Tiny 2.
    
    lsusb -v:
    
    Bus 008 Device 002: ID 3564:fef8 Remo Tech Co., Ltd. OBSBOT Tiny 2
    Negotiated speed: SuperSpeed (5Gbps)
    Device Descriptor:
      bLength                18
      bDescriptorType         1
      bcdUSB               3.10
      bDeviceClass          239 Miscellaneous Device
      bDeviceSubClass         2 [unknown]
      bDeviceProtocol         1 Interface Association
      bMaxPacketSize0         9
      idVendor           0x3564 Remo Tech Co., Ltd.
      idProduct          0xfef8 OBSBOT Tiny 2
      bcdDevice            4.09
      iManufacturer           1 Remo Tech Co., Ltd.
      iProduct                2 OBSBOT Tiny 2
      iSerial                 0
      bNumConfigurations      1
      Configuration Descriptor:
        bLength                 9
        bDescriptorType         2
        wTotalLength       0x04fc
        bNumInterfaces          4
        bConfigurationValue     1
        iConfiguration          4 OBSBOT Multifunction
        bmAttributes         0xc0
          Self Powered
        MaxPower                0mA
        Interface Association:
          bLength                 8
          bDescriptorType        11
          bFirstInterface         0
          bInterfaceCount         2
          bFunctionClass         14 Video
          bFunctionSubClass       3 Video Interface Collection
          bFunctionProtocol       0
          iFunction               5 OBSBOT Tiny 2 StreamCamera
        Interface Descriptor:
          bLength                 9
          bDescriptorType         4
          bInterfaceNumber        0
          bAlternateSetting       0
          bNumEndpoints           1
          bInterfaceClass        14 Video
          bInterfaceSubClass      1 Video Control
          bInterfaceProtocol      0
          iInterface              5 OBSBOT Tiny 2 StreamCamera
          VideoControl Interface Descriptor:
            bLength                13
            bDescriptorType        36
            bDescriptorSubtype      1 (HEADER)
            bcdUVC               1.00
            wTotalLength       0x0050
            dwClockFrequency       48.000000MHz
            bInCollection           1
            baInterfaceNr( 0)       1
          VideoControl Interface Descriptor:
            bLength                18
            bDescriptorType        36
            bDescriptorSubtype      2 (INPUT_TERMINAL)
            bTerminalID             1
            wTerminalType      0x0201 Camera Sensor
            bAssocTerminal          0
            iTerminal               0
            wObjectiveFocalLengthMin      0
            wObjectiveFocalLengthMax      0
            wOcularFocalLength            0
            bControlSize                  3
            bmControls           0x00023e3e
              Auto-Exposure Mode
              Auto-Exposure Priority
              Exposure Time (Absolute)
              Exposure Time (Relative)
              Focus (Absolute)
              Zoom (Absolute)
              Zoom (Relative)
              PanTilt (Absolute)
              PanTilt (Relative)
              Roll (Absolute)
              Focus, Auto
          VideoControl Interface Descriptor:
            bLength                11
            bDescriptorType        36
            bDescriptorSubtype      5 (PROCESSING_UNIT)
          Warning: Descriptor too short
            bUnitID                 3
            bSourceID               1
            wMaxMultiplier        400
            bControlSize            2
            bmControls     0x0000f7df
              Brightness
              Contrast
              Hue
              Saturation
              Sharpness
              White Balance Temperature
              White Balance Component
              Backlight Compensation
              Gain
              Power Line Frequency
              White Balance Temperature, Auto
              White Balance Component, Auto
              Digital Multiplier
              Digital Multiplier Limit
            iProcessing             0
            bmVideoStandards     0x1d
              None
              PAL - 625/50
              SECAM - 625/50
              NTSC - 625/50
          VideoControl Interface Descriptor:
            bLength                29
            bDescriptorType        36
            bDescriptorSubtype      6 (EXTENSION_UNIT)
            bUnitID                 2
            guidExtensionCode         {9a1e7291-6843-4683-6d92-39bc7906ee49}
            bNumControls           19
            bNrInPins               1
            baSourceID( 0)          3
            bControlSize            4
            bmControls( 0)       0xff
            bmControls( 1)       0xff
            bmControls( 2)       0x04
            bmControls( 3)       0x00
            iExtension              0
          VideoControl Interface Descriptor:
            bLength                 9
            bDescriptorType        36
            bDescriptorSubtype      3 (OUTPUT_TERMINAL)
            bTerminalID             7
            wTerminalType      0x0101 USB Streaming
            bAssocTerminal          0
            bSourceID               2
            iTerminal               0
          Endpoint Descriptor:
            bLength                 7
            bDescriptorType         5
            bEndpointAddress     0x84  EP 4 IN
            bmAttributes            3
              Transfer Type            Interrupt
              Synch Type               None
              Usage Type               Data
            wMaxPacketSize     0x0010  1x 16 bytes
            bInterval               8
            bMaxBurst               0
            VideoControl Endpoint Descriptor:
              bLength                 5
              bDescriptorType        37
              bDescriptorSubtype      3 (EP_INTERRUPT)
              wMaxTransferSize       16
        Interface Descriptor:
          bLength                 9
          bDescriptorType         4
          bInterfaceNumber        1
          bAlternateSetting       0
          bNumEndpoints           1
          bInterfaceClass        14 Video
          bInterfaceSubClass      2 Video Streaming
          bInterfaceProtocol      0
          iInterface              6 Video Streaming
          VideoStreaming Interface Descriptor:
            bLength                            16
            bDescriptorType                    36
            bDescriptorSubtype                  1 (INPUT_HEADER)
            bNumFormats                         3
            wTotalLength                   0x03f8
            bEndpointAddress                 0x81  EP 1 IN
            bmInfo                              0
            bTerminalLink                       7
            bStillCaptureMethod                 0
            bTriggerSupport                     0
            bTriggerUsage                       0
            bControlSize                        1
            bmaControls( 0)                     4
            bmaControls( 1)                     0
            bmaControls( 2)                     4
          VideoStreaming Interface Descriptor:
            bLength                            11
            bDescriptorType                    36
            bDescriptorSubtype                  6 (FORMAT_MJPEG)
            bFormatIndex                        1
            bNumFrameDescriptors                6
            bFlags                              0
              Fixed-size samples: No
            bDefaultFrameIndex                  1
            bAspectRatioX                       0
            bAspectRatioY                       0
            bmInterlaceFlags                 0x00
              Interlaced stream or variable: No
              Fields per frame: 1 fields
              Field 1 first: No
              Field pattern: Field 1 only
            bCopyProtect                        0
          VideoStreaming Interface Descriptor:
            bLength                            62
            bDescriptorType                    36
            bDescriptorSubtype                  7 (FRAME_MJPEG)
            bFrameIndex                         1
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1920
            wHeight                          1080
            dwMinBitRate                995328000
            dwMaxBitRate                1990656000
            dwMaxVideoFrameBufferSize     4147200
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  9
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            166833
            dwFrameInterval( 2)            200000
            dwFrameInterval( 3)            333333
            dwFrameInterval( 4)            333666
            dwFrameInterval( 5)            400000
            dwFrameInterval( 6)            416666
            dwFrameInterval( 7)            500000
            dwFrameInterval( 8)            666666
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                  7 (FRAME_MJPEG)
            bFrameIndex                         2
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           3840
            wHeight                          2160
            dwMinBitRate                1327104000
            dwMaxBitRate                1327104000
            dwMaxVideoFrameBufferSize    16588800
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwFrameInterval( 0)            333333
            dwFrameInterval( 1)            333666
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                            62
            bDescriptorType                    36
            bDescriptorSubtype                  7 (FRAME_MJPEG)
            bFrameIndex                         3
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1280
            wHeight                           720
            dwMinBitRate                221184000
            dwMaxBitRate                884736000
            dwMaxVideoFrameBufferSize     1843200
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  9
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            166833
            dwFrameInterval( 2)            200000
            dwFrameInterval( 3)            333333
            dwFrameInterval( 4)            333666
            dwFrameInterval( 5)            400000
            dwFrameInterval( 6)            416666
            dwFrameInterval( 7)            500000
            dwFrameInterval( 8)            666666
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                  7 (FRAME_MJPEG)
            bFrameIndex                         4
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1280
            wHeight                           960
            dwMinBitRate                294912000
            dwMaxBitRate                1179648000
            dwMaxVideoFrameBufferSize     2457600
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            333333
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                  7 (FRAME_MJPEG)
            bFrameIndex                         5
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1920
            wHeight                          1440
            dwMinBitRate                663552000
            dwMaxBitRate                1327104000
            dwMaxVideoFrameBufferSize     5529600
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            333333
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                            46
            bDescriptorType                    36
            bDescriptorSubtype                  7 (FRAME_MJPEG)
            bFrameIndex                         6
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           4000
            wHeight                          3000
            dwMinBitRate                1920000000
            dwMaxBitRate                1920000000
            dwMaxVideoFrameBufferSize    24000000
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  5
            dwFrameInterval( 0)            333333
            dwFrameInterval( 1)            400000
            dwFrameInterval( 2)            416666
            dwFrameInterval( 3)            500000
            dwFrameInterval( 4)            666666
          VideoStreaming Interface Descriptor:
            bLength                             6
            bDescriptorType                    36
            bDescriptorSubtype                 13 (COLORFORMAT)
            bColorPrimaries                     1 (BT.709,sRGB)
            bTransferCharacteristics            1 (BT.709)
            bMatrixCoefficients                 4 (SMPTE 170M (BT.601))
          VideoStreaming Interface Descriptor:
            bLength                            27
            bDescriptorType                    36
            bDescriptorSubtype                  4 (FORMAT_UNCOMPRESSED)
            bFormatIndex                        2
            bNumFrameDescriptors                7
            guidFormat           {32595559-0000-0010-8000-00aa00389b71}
            bBitsPerPixel                      16
            bDefaultFrameIndex                  5
            bAspectRatioX                       0
            bAspectRatioY                       0
            bmInterlaceFlags                 0x00
              Interlaced stream or variable: No
              Fields per frame: 2 fields
              Field 1 first: No
              Field pattern: Field 1 only
            bCopyProtect                        0
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
            bFrameIndex                         1
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                            640
            wHeight                           360
            dwMinBitRate                 55296000
            dwMaxBitRate                221184000
            dwMaxVideoFrameBufferSize      460800
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            333333
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
            bFrameIndex                         2
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                            640
            wHeight                           480
            dwMinBitRate                 73728000
            dwMaxBitRate                294912000
            dwMaxVideoFrameBufferSize      614400
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            333333
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
            bFrameIndex                         3
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1280
            wHeight                           720
            dwMinBitRate                221184000
            dwMaxBitRate                884736000
            dwMaxVideoFrameBufferSize     1843200
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            333333
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
            bFrameIndex                         4
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1280
            wHeight                           960
            dwMinBitRate                294912000
            dwMaxBitRate                1179648000
            dwMaxVideoFrameBufferSize     2457600
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            333333
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                            46
            bDescriptorType                    36
            bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
            bFrameIndex                         5
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1920
            wHeight                          1080
            dwMinBitRate                497664000
            dwMaxBitRate                995328000
            dwMaxVideoFrameBufferSize     4147200
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  5
            dwFrameInterval( 0)            333333
            dwFrameInterval( 1)            400000
            dwFrameInterval( 2)            416666
            dwFrameInterval( 3)            500000
            dwFrameInterval( 4)            666666
          VideoStreaming Interface Descriptor:
            bLength                            46
            bDescriptorType                    36
            bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
            bFrameIndex                         6
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1920
            wHeight                          1440
            dwMinBitRate                663552000
            dwMaxBitRate                1327104000
            dwMaxVideoFrameBufferSize     5529600
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  5
            dwFrameInterval( 0)            333333
            dwFrameInterval( 1)            400000
            dwFrameInterval( 2)            416666
            dwFrameInterval( 3)            500000
            dwFrameInterval( 4)            666666
          VideoStreaming Interface Descriptor:
            bLength                            30
            bDescriptorType                    36
            bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
            bFrameIndex                         7
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           3840
            wHeight                          2160
            dwMinBitRate                1990656000
            dwMaxBitRate                1990656000
            dwMaxVideoFrameBufferSize    16588800
            dwDefaultFrameInterval         666666
            bFrameIntervalType                  1
            dwFrameInterval( 0)            666666
          VideoStreaming Interface Descriptor:
            bLength                             6
            bDescriptorType                    36
            bDescriptorSubtype                 13 (COLORFORMAT)
            bColorPrimaries                     1 (BT.709,sRGB)
            bTransferCharacteristics            1 (BT.709)
            bMatrixCoefficients                 4 (SMPTE 170M (BT.601))
          VideoStreaming Interface Descriptor:
            bLength                            28
            bDescriptorType                    36
            bDescriptorSubtype                 16 (FORMAT_FRAME_BASED)
            bFormatIndex                        3
            bNumFrameDescriptors                5
            guidFormat           {34363248-0000-0010-8000-00aa00389b71}
            bBitsPerPixel                      16
            bDefaultFrameIndex                  1
            bAspectRatioX                       0
            bAspectRatioY                       0
            bmInterlaceFlags                 0x00
              Interlaced stream or variable: No
              Fields per frame: 2 fields
              Field 1 first: No
              Field pattern: Field 1 only
            bCopyProtect                        0
            bVariableSize                     1
          VideoStreaming Interface Descriptor:
            bLength                            62
            bDescriptorType                    36
            bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
            bFrameIndex                         1
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1920
            wHeight                          1080
            dwMinBitRate                497664000
            dwMaxBitRate                1990656000
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  9
            dwBytesPerLine                      0
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            166833
            dwFrameInterval( 2)            200000
            dwFrameInterval( 3)            333333
            dwFrameInterval( 4)            333666
            dwFrameInterval( 5)            400000
            dwFrameInterval( 6)            416666
            dwFrameInterval( 7)            500000
            dwFrameInterval( 8)            666666
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
            bFrameIndex                         2
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           3840
            wHeight                          2160
            dwMinBitRate                1327104000
            dwMaxBitRate                1327104000
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwBytesPerLine                      0
            dwFrameInterval( 0)            333333
            dwFrameInterval( 1)            333666
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                            62
            bDescriptorType                    36
            bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
            bFrameIndex                         4
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1280
            wHeight                           720
            dwMinBitRate                221184000
            dwMaxBitRate                884736000
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  9
            dwBytesPerLine                      0
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            166833
            dwFrameInterval( 2)            200000
            dwFrameInterval( 3)            333333
            dwFrameInterval( 4)            333666
            dwFrameInterval( 5)            400000
            dwFrameInterval( 6)            416666
            dwFrameInterval( 7)            500000
            dwFrameInterval( 8)            666666
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
            bFrameIndex                         5
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1280
            wHeight                           960
            dwMinBitRate                294912000
            dwMaxBitRate                1179648000
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwBytesPerLine                      0
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            333333
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                            50
            bDescriptorType                    36
            bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
            bFrameIndex                         6
            bmCapabilities                   0x00
              Still image unsupported
            wWidth                           1920
            wHeight                          1440
            dwMinBitRate                663552000
            dwMaxBitRate                1327104000
            dwDefaultFrameInterval         333333
            bFrameIntervalType                  6
            dwBytesPerLine                      0
            dwFrameInterval( 0)            166666
            dwFrameInterval( 1)            333333
            dwFrameInterval( 2)            400000
            dwFrameInterval( 3)            416666
            dwFrameInterval( 4)            500000
            dwFrameInterval( 5)            666666
          VideoStreaming Interface Descriptor:
            bLength                             6
            bDescriptorType                    36
            bDescriptorSubtype                 13 (COLORFORMAT)
            bColorPrimaries                     1 (BT.709,sRGB)
            bTransferCharacteristics            1 (BT.709)
            bMatrixCoefficients                 4 (SMPTE 170M (BT.601))
          Endpoint Descriptor:
            bLength                 7
            bDescriptorType         5
            bEndpointAddress     0x81  EP 1 IN
            bmAttributes            2
              Transfer Type            Bulk
              Synch Type               None
              Usage Type               Data
            wMaxPacketSize     0x0400  1x 1024 bytes
            bInterval               0
            bMaxBurst              13
        Interface Association:
          bLength                 8
          bDescriptorType        11
          bFirstInterface         2
          bInterfaceCount         2
          bFunctionClass          1 Audio
          bFunctionSubClass       0 [unknown]
          bFunctionProtocol       0
          iFunction               8 OBSBOT Tiny2 Audio
        Interface Descriptor:
          bLength                 9
          bDescriptorType         4
          bInterfaceNumber        2
          bAlternateSetting       0
          bNumEndpoints           0
          bInterfaceClass         1 Audio
          bInterfaceSubClass      1 Control Device
          bInterfaceProtocol      0
          iInterface              8 OBSBOT Tiny2 Audio
          AudioControl Interface Descriptor:
            bLength                 9
            bDescriptorType        36
            bDescriptorSubtype      1 (HEADER)
            bcdADC               1.00
            wTotalLength       0x0027
            bInCollection           1
            baInterfaceNr(0)        3
          AudioControl Interface Descriptor:
            bLength                12
            bDescriptorType        36
            bDescriptorSubtype      2 (INPUT_TERMINAL)
            bTerminalID             3
            wTerminalType      0x0201 Microphone
            bAssocTerminal          0
            bNrChannels             2
            wChannelConfig     0x0003
              Left Front (L)
              Right Front (R)
            iChannelNames          13 Capture Channels
            iTerminal              12 OBSBOT Tiny2 Microphone
          AudioControl Interface Descriptor:
            bLength                 9
            bDescriptorType        36
            bDescriptorSubtype      3 (OUTPUT_TERMINAL)
            bTerminalID             4
            wTerminalType      0x0101 USB Streaming
            bAssocTerminal          0
            bSourceID               5
            iTerminal              14 Capture Output terminal
          AudioControl Interface Descriptor:
            bLength                 9
            bDescriptorType        36
            bDescriptorSubtype      6 (FEATURE_UNIT)
            bUnitID                 5
            bSourceID               3
            bControlSize            2
            bmaControls(0)     0x0003
              Mute Control
              Volume Control
            iFeature                0
        Interface Descriptor:
          bLength                 9
          bDescriptorType         4
          bInterfaceNumber        3
          bAlternateSetting       0
          bNumEndpoints           0
          bInterfaceClass         1 Audio
          bInterfaceSubClass      2 Streaming
          bInterfaceProtocol      0
          iInterface             17 OBSBOT Tiny2 Microphone
        Interface Descriptor:
          bLength                 9
          bDescriptorType         4
          bInterfaceNumber        3
          bAlternateSetting       1
          bNumEndpoints           1
          bInterfaceClass         1 Audio
          bInterfaceSubClass      2 Streaming
          bInterfaceProtocol      0
          iInterface             18 Capture Active
          AudioStreaming Interface Descriptor:
            bLength                 7
            bDescriptorType        36
            bDescriptorSubtype      1 (AS_GENERAL)
            bTerminalLink           4
            bDelay                  1 frames
            wFormatTag         0x0001 PCM
          AudioStreaming Interface Descriptor:
            bLength                11
            bDescriptorType        36
            bDescriptorSubtype      2 (FORMAT_TYPE)
            bFormatType             1 (FORMAT_TYPE_I)
            bNrChannels             2
            bSubframeSize           2
            bBitResolution         16
            bSamFreqType            1 Discrete
            tSamFreq[ 0]        48000
          Endpoint Descriptor:
            bLength                 9
            bDescriptorType         5
            bEndpointAddress     0x82  EP 2 IN
            bmAttributes            5
              Transfer Type            Isochronous
              Synch Type               Asynchronous
              Usage Type               Data
            wMaxPacketSize     0x00c0  1x 192 bytes
            bInterval               4
            bRefresh                0
            bSynchAddress           0
            bMaxBurst               0
            AudioStreaming Endpoint Descriptor:
              bLength                 7
              bDescriptorType        37
              bDescriptorSubtype      1 (EP_GENERAL)
              bmAttributes         0x01
                Sampling Frequency
              bLockDelayUnits         0 Undefined
              wLockDelay         0x0000
    Binary Object Store Descriptor:
      bLength                 5
      bDescriptorType        15
      wTotalLength       0x0016
      bNumDeviceCaps          2
      USB 2.0 Extension Device Capability:
        bLength                 7
        bDescriptorType        16
        bDevCapabilityType      2
        bmAttributes   0x00000006
          BESL Link Power Management (LPM) Supported
      SuperSpeed USB Device Capability:
        bLength                10
        bDescriptorType        16
        bDevCapabilityType      3
        bmAttributes         0x00
        wSpeedsSupported   0x000f
          Device can operate at Low Speed (1Mbps)
          Device can operate at Full Speed (12Mbps)
          Device can operate at High Speed (480Mbps)
          Device can operate at SuperSpeed (5Gbps)
        bFunctionalitySupport   1
          Lowest fully-functional device speed is Full Speed (12Mbps)
        bU1DevExitLat           1 micro seconds
        bU2DevExitLat         500 micro seconds
    Device Status:     0x0001
      Self Powered
    
    Signed-off-by: John Bauer 
    Signed-off-by: Gergo Koteles 
    Reviewed-by: Ricardo Ribalda 
    Reviewed-by: Hans de Goede 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Hans Verkuil 

commit 4238bd6dc6ba36f44d89a60338223d5a4f708cbf
Author: Ricardo Ribalda 
Date:   Wed Nov 19 20:17:36 2025 +0000

    media: uvcvideo: Fix support for V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX
    
    The VIDIOC_G_EXT_CTRLS with which V4L2_CTRL_WHICH_(MIN|MAX)_VAL can only
    work for controls that have previously announced support for it.
    
    This patch fixes the following v4l2-compliance error:
    
      info: checking extended control 'User Controls' (0x00980001)
      fail: v4l2-test-controls.cpp(980): ret != EINVAL (got 13)
            test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL
    
    Fixes: 39d2c891c96e ("media: uvcvideo: support V4L2_CTRL_WHICH_MIN/MAX_VAL")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ricardo Ribalda 
    Reviewed-by: Hans de Goede 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Hans Verkuil 

commit 85883141d3bea47e5bce688cc300800da7b1ea61
Author: Laurent Pinchart 
Date:   Tue Sep 16 19:10:55 2025 +0300

    media: uvcvideo: Replace dev_dbg() with uvc_dbg()
    
    The uvcvideo driver uses a uvc_dbg() macro that supports enabling debug
    message categories selectively, and prints a KERN_DEBUG message. The
    macro is used through the driver, but one direct dev_dbg() call creeped
    in. Replace it with uvc_dbg().
    
    Signed-off-by: Laurent Pinchart 
    Reviewed-by: Ricardo Ribalda 
    Reviewed-by: Hans de Goede 
    Signed-off-by: Hans de Goede 
    Signed-off-by: Hans Verkuil 

commit 062191adfde0b11b01656ea6db51a9385fa3d104
Author: Chia-Lin Kao (AceLan) 
Date:   Fri Jan 2 11:19:05 2026 +0800

    thunderbolt: Log path activation failures without WARN backtraces
    
    tb_path_activate() currently logs failures with tb_WARN(), which triggers
    a stack trace. Transient conditions such as lane bonding or Type-C link
    hiccups can fail path activation briefly, and the resulting backtraces are
    noisy without aiding diagnosis.
    
    Switch to tb_warn() for all path activation failures. The error code is
    already returned to callers, and the warning still shows the message
    without the backtrace.
    
    Signed-off-by: Chia-Lin Kao (AceLan) 
    Signed-off-by: Mika Westerberg 

commit 10c3ab8cd8975cb42b172224440a567b31617bbd
Merge: 684d3b2670a263 4fb352df14de4b
Author: Rafael J. Wysocki 
Date:   Mon Jan 5 12:01:29 2026 +0100

    Merge back a commit related to system sleep for 6.20

commit 9c214d10c50990c7a61b95887493df9ae713eec5
Author: Tony Luck 
Date:   Wed Dec 17 09:20:56 2025 -0800

    x86,fs/resctrl: Rename some L3 specific functions
    
    With the arrival of monitor events tied to new domains associated with a
    different resource it would be clearer if the L3 resource specific functions
    are more accurately named.
    
    Rename three groups of functions:
    
    Functions that allocate/free architecture per-RMID MBM state information:
    arch_domain_mbm_alloc()         -> l3_mon_domain_mbm_alloc()
    mon_domain_free()               -> l3_mon_domain_free()
    
    Functions that allocate/free filesystem per-RMID MBM state information:
    domain_setup_mon_state()        -> domain_setup_l3_mon_state()
    domain_destroy_mon_state()      -> domain_destroy_l3_mon_state()
    
    Initialization/exit:
    rdt_get_mon_l3_config()         -> rdt_get_l3_mon_config()
    resctrl_mon_resource_init()     -> resctrl_l3_mon_resource_init()
    resctrl_mon_resource_exit()     -> resctrl_l3_mon_resource_exit()
    
    Ensure kernel-doc descriptions of these functions' return values are present
    and correctly formatted.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 4bc3ef46ff41d5e7ba557e56e9cd2031527cd7f8
Author: Tony Luck 
Date:   Wed Dec 17 09:20:55 2025 -0800

    x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain
    
    The upcoming telemetry event monitoring is not tied to the L3 resource and
    will have a new domain structure.
    
    Rename the L3 resource specific domain data structures to include "l3_"
    in their names to avoid confusion between the different resource specific
    domain structures:
    rdt_mon_domain          -> rdt_l3_mon_domain
    rdt_hw_mon_domain       -> rdt_hw_l3_mon_domain
    
    No functional change.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 6b10cf7b6ea857cdf9570e21c077a05803f60575
Author: Tony Luck 
Date:   Wed Dec 17 09:20:54 2025 -0800

    x86,fs/resctrl: Use struct rdt_domain_hdr when reading counters
    
    Convert the whole call sequence from mon_event_read() to resctrl_arch_rmid_read() to
    pass resource independent struct rdt_domain_hdr instead of an L3 specific domain
    structure to prepare for monitoring events in other resources.
    
    This additional layer of indirection obscures which aspects of event counting depend
    on a valid domain. Event initialization, support for assignable counters, and normal
    event counting implicitly depend on a valid domain while summing of domains does not.
    Split summing domains from the core event counting handling to make their respective
    dependencies obvious.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit be05f571464404432a0f8fe1c81a86a0862da283
Author: Mike Rapoport (Microsoft) 
Date:   Sun Dec 28 20:39:42 2025 +0200

    memblock test: include  from tools mm.h stub
    
    memblock test compilation fails:
    
    memblock.c: In function ‘memblock_validate_numa_coverage’:
    memblock.c:784:58: error: ‘SZ_1M’ undeclared (first use in this function)
      784 |                 mem_size_mb = memblock_phys_mem_size() / SZ_1M;
          |                                                          ^~~~~
    
    The SZ_1M is defined in sizes.h, but it is not included by stub version of
    mm.h in tools/include/linux.
    
    Add include of sizes.h to tools/include/linux/mm.h to fix the compilation
    of memblock tests.
    
    Link: https://patch.msgid.link/20251228183942.3628918-1-rppt@kernel.org
    Signed-off-by: Mike Rapoport (Microsoft) 
    Reviewed-by: Anshuman Khandual 

commit 499ea377edde1c085f872d35ffe370f54175bef0
Author: Julia Lawall 
Date:   Sun Jan 4 18:01:19 2026 +0100

    optee: update outdated comment
    
    The function cmd_alloc_suppl() was renamed as
    optee_rpc_cmd_alloc_suppl() in commit c51a564a5b48
    ("optee: isolate smc abi").  Update the comment
    accordingly.
    
    Signed-off-by: Julia Lawall 
    Reviewed-by: Sumit Garg 
    Signed-off-by: Jens Wiklander 

commit 1c05d9a4cab2abfb93ebce5edaa17752126b6d35
Author: Krzysztof Kozlowski 
Date:   Mon Dec 8 03:08:47 2025 +0100

    tee: qcomtee: user: Fix confusing cleanup.h syntax
    
    Initializing automatic __free variables to NULL without need (e.g.
    branches with different allocations), followed by actual allocation is
    in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Amirreza Zarrabi 
    Signed-off-by: Jens Wiklander 

commit 7c4c14ad3d8cbc3507231e3f3bc090dfbfcabf9d
Author: Krzysztof Kozlowski 
Date:   Mon Dec 8 03:08:46 2025 +0100

    tee: qcomtee: mem: Fix confusing cleanup.h syntax
    
    Initializing automatic __free variables to NULL without need (e.g.
    branches with different allocations), followed by actual allocation is
    in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Amirreza Zarrabi 
    Signed-off-by: Jens Wiklander 

commit 4cc19518da40573fc1057c618a5b1acf8a941472
Author: Krzysztof Kozlowski 
Date:   Mon Dec 8 03:08:45 2025 +0100

    tee: qcomtee: call: Fix confusing cleanup.h syntax
    
    Initializing automatic __free variables to NULL without need (e.g.
    branches with different allocations), followed by actual allocation is
    in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Amirreza Zarrabi 
    Signed-off-by: Jens Wiklander 

commit ad5c2ff75e0c53d2588dfc10eb87458e759b6bbe
Author: Tony Luck 
Date:   Wed Dec 17 09:20:53 2025 -0800

    fs/resctrl: Split L3 dependent parts out of __mon_event_count()
    
    Carve out the L3 resource specific event reading code into a separate helper
    to support reading event data from a new monitoring resource.
    
    Suggested-by: Reinette Chatre 
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 98d78c06f54da101c1f2eb79af378cee9e07e102
Author: Bartosz Golaszewski 
Date:   Fri Jan 2 10:33:49 2026 +0100

    gpio: swnode: restore the name of the undefined software node
    
    Commit 6774a66d0e10 ("gpio: swnode: compare the "undefined" swnode by
    its address, not name") switched to comparing the software nodes by
    address instead of names but it's still useful to keep the name of the
    node to expose the relevant information over sysfs. Restore the
    human-readable name.
    
    Suggested-by: Andy Shevchenko 
    Closes: https://lore.kernel.org/all/aVFsjSIwrBw7tFLU@smile.fi.intel.com/
    Reviewed-by: Andy Shevchenko 
    Link: https://lore.kernel.org/r/20260102093349.17822-1-bartosz.golaszewski@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit 325e3b5431ddd27c5f93156b36838a351e3b2f72
Author: Leon Romanovsky 
Date:   Sun Jan 4 15:51:38 2026 +0200

    RDMA/ocrdma: Remove unused OCRDMA_UVERBS definition
    
    The OCRDMA_UVERBS() macro is unused, so remove it to clean up the code.
    
    Link: https://patch.msgid.link/20260104-ib-core-misc-v1-6-00367f77f3a8@nvidia.com
    Reviewed-by: Kalesh AP 
    Signed-off-by: Leon Romanovsky 

commit cc016ebeb146d050f8426ade79d4d71771b643c4
Author: Leon Romanovsky 
Date:   Sun Jan 4 15:51:37 2026 +0200

    RDMA/qedr: Remove unused defines
    
    Perform basic cleanup by removing unused defines from qedr.h.
    
    Link: https://patch.msgid.link/20260104-ib-core-misc-v1-5-00367f77f3a8@nvidia.com
    Reviewed-by: Kalesh AP 
    Signed-off-by: Leon Romanovsky 

commit 91ce41427d468cd103a08970b448a42430f9e52f
Author: Jocelyn Falempe 
Date:   Tue Dec 16 09:20:39 2025 +0100

    drm/panic: Add kunit tests for drm_panic
    
    Add kunit tests for drm_panic.
    They check that drawing the panic screen doesn't crash, but they
    don't check the correctness of the resulting image.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216082524.115980-3-jfalempe@redhat.com
    Signed-off-by: Jocelyn Falempe 

commit 522a5c1c56fbf71693cf2e4c726b200f6d703679
Author: Leon Romanovsky 
Date:   Sun Jan 4 15:51:36 2026 +0200

    RDMA/mlx5: Avoid direct access to DMA device pointer
    
    The dma_device field is marked as internal and must not be accessed by
    drivers or ULPs. Remove all direct mlx5 references to this field.
    
    Link: https://patch.msgid.link/20260104-ib-core-misc-v1-4-00367f77f3a8@nvidia.com
    Reviewed-by: Kalesh AP 
    Signed-off-by: Leon Romanovsky 

commit 6dc78c53de99e4ed9868d4f0fc6da6e46f52fe4d
Author: Maher Sanalla 
Date:   Sun Jan 4 15:51:35 2026 +0200

    RDMA/mlx5: Fix ucaps init error flow
    
    In mlx5_ib_stage_caps_init(), if mlx5_ib_init_ucaps() fails after
    mlx5_ib_init_var_table() succeeds, the VAR bitmap is leaked since
    the function returns without cleanup.
    
    Thus, cleanup the var table bitmap in case of error of initializing
    ucaps before exiting, preventing the leak above.
    
    Fixes: cf7174e8982f ("RDMA/mlx5: Create UCAP char devices for supported device capabilities")
    Signed-off-by: Maher Sanalla 
    Reviewed-by: Yishai Hadas 
    Link: https://patch.msgid.link/20260104-ib-core-misc-v1-3-00367f77f3a8@nvidia.com
    Reviewed-by: Kalesh AP 
    Signed-off-by: Leon Romanovsky 

commit 8d466b155f83890f2f2d4cf6d0f623ac2d455b12
Author: Parav Pandit 
Date:   Sun Jan 4 15:51:34 2026 +0200

    RDMA/core: Avoid exporting module local functions and remove not-used ones
    
    Some of the functions are local to the module and some are not used
    starting from commit 36783dec8d79 ("RDMA/rxe: Delete deprecated module
    parameters interface"). Delete and avoid exporting them.
    
    Signed-off-by: Parav Pandit 
    Link: https://patch.msgid.link/20260104-ib-core-misc-v1-2-00367f77f3a8@nvidia.com
    Reviewed-by: Zhu Yanjun 
    Reviewed-by: Kalesh AP 
    Signed-off-by: Leon Romanovsky 

commit ac7dea328ab52a6dce40361bb478b80d5004abe0
Author: Leon Romanovsky 
Date:   Sun Jan 4 15:51:33 2026 +0200

    RDMA/umem: Remove redundant DMABUF ops check
    
    ib_umem_dmabuf_get_with_dma_device() is an in-kernel function and does
    not require a defensive check for the .move_notify callback. All current
    callers guarantee that this callback is always present.
    
    Link: https://patch.msgid.link/20260104-ib-core-misc-v1-1-00367f77f3a8@nvidia.com
    Reviewed-by: Kalesh AP 
    Signed-off-by: Leon Romanovsky 

commit 5555a3074921285f8ba0346208db29f335e45b95
Author: Jocelyn Falempe 
Date:   Tue Dec 16 09:20:38 2025 +0100

    drm/panic: Rename draw_panic_static_* to draw_panic_screen_*
    
    I called them "static" because the panic screen is drawn only once,
    but this can be confused with the static meaning in C.
    Also remove some unnecessary braces in draw_panic_dispatch().
    No functionnal change.
    
    Reviewed-by: Javier Martinez Canillas 
    Link: https://patch.msgid.link/20251216082524.115980-2-jfalempe@redhat.com
    Signed-off-by: Jocelyn Falempe 

commit 72b39430284fc4a7a960133b70137c24fed63b74
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:18 2025 +0100

    dt-bindings: PCI: qcom,pcie-apq8084: Move APQ8084 to dedicated schema
    
    Move APQ8084 PCIe devices from qcom,pcie.yaml binding to a dedicated
    file to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
    
    After moving the qcom,pcie.yaml becames empty thus can be entirely
    removed.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-12-873721599754@oss.qualcomm.com

commit 0eaa8d1c36f032d6023af96cd84e8b2ece0d6922
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:17 2025 +0100

    dt-bindings: PCI: qcom,pcie-msm8996: Move MSM8996 to dedicated schema
    
    Move MSM8996 PCIe devices from qcom,pcie.yaml binding to a dedicated
    file to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
     - Expecting eight MSI interrupts and one global, instead of only one,
       which was incomplete hardware description.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-11-873721599754@oss.qualcomm.com

commit b673d06ea8449db084cabfee2844f17b6f98f22c
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:16 2025 +0100

    dt-bindings: PCI: qcom,pcie-apq8064: Move APQ8064 to dedicated schema
    
    Move APQ8064 and IPQ8064 PCIe devices from qcom,pcie.yaml binding to a
    dedicated file to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-10-873721599754@oss.qualcomm.com

commit 5e8bf1c1d5b7f1129148d537afc8feb9c9f883a1
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:15 2025 +0100

    dt-bindings: PCI: qcom,pcie-ipq9574: Move IPQ9574 to dedicated schema
    
    Move IPQ9574 and compatible PCIe devices from qcom,pcie.yaml binding to
    a dedicated file to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
     - Make last "reg" entry "mhi" a required one, because all in-tree DTS
       were updated to include it.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-9-873721599754@oss.qualcomm.com

commit 769f6826d5ad8baef1238b10cc97a7b0f678ba43
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:14 2025 +0100

    dt-bindings: PCI: qcom,pcie-ipq4019: Move IPQ4019 to dedicated schema
    
    Move IPQ4019 PCIe devices from qcom,pcie.yaml binding to a dedicated
    file to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-8-873721599754@oss.qualcomm.com

commit edf1701c86c91175c0b978d50cfda418516d8d43
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:13 2025 +0100

    dt-bindings: PCI: qcom,pcie-ipq8074: Move IPQ8074 to dedicated schema
    
    Move IPQ8074 PCIe devices from qcom,pcie.yaml binding to a dedicated
    file to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
     - Expecting eight MSI interrupts and one global, instead of only one,
       which was incomplete hardware description.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-7-873721599754@oss.qualcomm.com

commit 06f4ac1f7673632eaba82d04e578ebb9b783e96b
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:12 2025 +0100

    dt-bindings: PCI: qcom,pcie-ipq6018: Move IPQ6018 and IPQ8074 Gen3 to dedicated schema
    
    Move IPQ6018 and IPQ8074 Gen3 (which is the same as in IPQ6018) PCIe
    devices from qcom,pcie.yaml binding to a dedicated file to make
    reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
     - Disallow legacy/incomplete description with only one interrupt and
       expect exactly nine of them.
     - Do not require power domains on IPQ6018, because old binding already
       does not require them for IPQ8074 Gen3, devices are the same and
       in-tree DTS lacks power domains.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-6-873721599754@oss.qualcomm.com

commit 7366e19379c75add8ac407439bf9ee8473cab7b5
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:11 2025 +0100

    dt-bindings: PCI: qcom,pcie-ipq5018: Move IPQ5018 to dedicated schema
    
    Move IPQ5018 PCIe devices from qcom,pcie.yaml binding to a dedicated
    file to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-5-873721599754@oss.qualcomm.com

commit 78aa7d0d9be697409207309013051d080c243421
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:10 2025 +0100

    dt-bindings: PCI: qcom,pcie-qcs404: Move QCS404 to dedicated schema
    
    Move QCS404 PCIe devices from qcom,pcie.yaml binding to a dedicated file
    to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-4-873721599754@oss.qualcomm.com

commit c80dc8121d3af8f33413bb0f9ed9e81e2c576e1a
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:09 2025 +0100

    dt-bindings: PCI: qcom,pcie-sdm845: Move SDM845 to dedicated schema
    
    Move SDM845 PCIe devices from qcom,pcie.yaml binding to a dedicated file
    to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
     - Expecting eight MSI interrupts and one global, instead of only one,
       which was incomplete hardware description.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-3-873721599754@oss.qualcomm.com

commit c86e1f39f6e4c8425c5b55f276615ae16b5ac57f
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:08 2025 +0100

    dt-bindings: PCI: qcom,pcie-sdx55: Move SDX55 to dedicated schema
    
    Move SDX55 PCIe devices from qcom,pcie.yaml binding to a dedicated file
    to make reviewing and maintenance easier.
    
    New schema is equivalent to the old one with few changes:
     - Adding a required compatible, which is actually redundant.
     - Drop the really obvious comments next to clock/reg/reset-names items.
     - Adding interrupts based on the DTS, which were missing in the
       all-in-one binding.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-2-873721599754@oss.qualcomm.com

commit b73d6672ebc1e3a52b67585f28daca0d2f5bb4f2
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 17:19:07 2025 +0100

    dt-bindings: PCI: qcom,pcie-sm8150: Merge SC8180x into SM8150
    
    After the commit 26daa18e35eb ("dt-bindings: PCI: qcom,pcie-sc8180x:
    Drop unrelated clocks from PCIe hosts") and the
    commit e1cb67ab82aa ("dt-bindings: PCI: qcom,pcie-sm8150: Drop unrelated
    clocks from PCIe hosts"), which dropped two clocks from each of the
    bindings, the devices share entire binding and could be kept in one file
    for simplicity.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-dt-bindings-pci-qcom-v2-1-873721599754@oss.qualcomm.com

commit b3aa6769288303567d5a2f069778f37de32942f1
Author: Suraj Kandpal 
Date:   Mon Jan 5 11:29:37 2026 +0530

    drm/i915/ltphy: Provide protection against unsupported modes
    
    We need to make sure we return some port clock in case we have
    unsupported LT PHY modes or if we were not able to read the LT PHY state
    for whatever reason and the mode ends up being 0.
    
    Signed-off-by: Suraj Kandpal 
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105055937.136522-3-suraj.kandpal@intel.com

commit 73b506e6aa11dd1e8f2bdd3d82280341c510b0a2
Author: Suraj Kandpal 
Date:   Mon Jan 5 11:29:36 2026 +0530

    drm/i915/ltphy: Compare only certain fields in state verify function
    
    Verify only the config[0,2] fields in the LT PHY state since these
    are the only reliable values we can get back when we read the VDR
    registers. The reason being that the state does not persist for other
    VDR registers when power gating comes into picture.
    Though not ideal this change does not hit us badly in perspective of how
    we use the compare function to decide if fastset is required or if we
    wrote the state correctly. VDR0_CONFIG and VDR1_CONFIG hold the values
    that indicate the PLL operating mode and link rate which is usually
    what we need to check if something has changed or not.
    
    Signed-off-by: Suraj Kandpal 
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105055937.136522-2-suraj.kandpal@intel.com

commit c7830b51c77f85b95bd538b2d79a8de02cc05db1
Author: Suraj Kandpal 
Date:   Mon Jan 5 11:29:35 2026 +0530

    drm/i915/ltphy: Remove state verification for LT PHY fields
    
    Currently we do state verification for all VDR Registers.
    Remove LT PHY State verification for all VDR register fields other
    than VDR0_CONFIG and VDR2_CONFIG. The reason being that VDR0_CONFIG
    and VDR2_CONFIG are the only reliable shadow register which hold onto
    their values over the course of power gatings which happen internally
    due to features like PSR/PR.
    
    Signed-off-by: Suraj Kandpal 
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20260105055937.136522-1-suraj.kandpal@intel.com

commit aaecff5e13cd98d9a9260bf2ec83ef3a1bda86a6
Author: Or Har-Toov 
Date:   Thu Dec 18 17:59:00 2025 +0200

    RDMA/mlx5: Implement query_port_speed callback
    
    Implement the query_port_speed callback for mlx5 driver to support
    querying effective port bandwidth.
    
    For LAG configurations, query the aggregated speed from the LAG layer
    or from the modified vport max_tx_speed.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit 3fd984d5cd8f0df8e79337fbd9283c31dee9ed31
Author: Or Har-Toov 
Date:   Thu Dec 18 17:58:53 2025 +0200

    RDMA/mlx5: Raise async event on device speed change
    
    Raise IB_EVENT_DEVICE_SPEED_CHANGE whenever the speed of one of the
    device's ports changes. Usually all ports of the device changes
    together.
    
    This ensures user applications and upper-layer software are immediately
    notified when bandwidth changes, improving traffic management in dynamic
    environments. This is especially useful for vports which are part of a
    LAG configuration, to know if the effective speed of the LAG was
    changed.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit 51a07ce2fefd061edf4ba552a741c85f07b3e6dd
Author: Or Har-Toov 
Date:   Thu Dec 18 17:58:46 2025 +0200

    IB/core: Add query_port_speed verb
    
    Add new ibv_query_port_speed() verb to enable applications to query
    the effective bandwidth of a port.
    
    This verb is particularly useful when the speed is not a multiplication
    of IB speed and width where width is 2^n.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit d4adeff26c3e8f1a9bc86d5dfb14f227c9041070
Author: Or Har-Toov 
Date:   Thu Dec 18 17:58:40 2025 +0200

    IB/core: Refactor rate_show to use ib_port_attr_to_rate()
    
    Update sysfs rate_show() to rely on ib_port_attr_to_speed_info() for
    converting IB port speed and width attributes to data rate and speed
    string.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Maher Sanalla 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit 2941abac6d0bffd6bf8f438135505b39168a0a08
Author: Or Har-Toov 
Date:   Thu Dec 18 17:58:32 2025 +0200

    IB/core: Add helper to convert port attributes to data rate
    
    Introduce ib_port_attr_to_rate() to compute the data rate in 100 Mbps
    units (deci-Gb/sec) from a port's active_speed and active_width
    attributes. This generic helper removes duplicated speed-to-rate
    calculations, which are used by sysfs and the upcoming new verb.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit 263d1d9975b5ac2b813c3107fe21c957b57f0a59
Author: Or Har-Toov 
Date:   Thu Dec 18 17:58:26 2025 +0200

    IB/core: Add async event on device speed change
    
    Add IB_EVENT_DEVICE_SPEED_CHANGE for notifying user applications on
    device's ports speed changes.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit 976cc7ac1264ff52e05769854b472366107104ec
Merge: 0789f929900d85 f0b2fde98065e4
Author: Leon Romanovsky 
Date:   Mon Jan 5 02:39:29 2026 -0500

    Support effective VF bandwidth query in LAG mode
    
    Currently, mlx5 driver exposes only the parent function's speed to VFs,
    providing no way to query the actual effective bandwidth in LAG and
    MPESW configurations. This limitation prevents userspace and
    upper-layer software from obtaining accurate bandwidth information,
    which impacts traffic scheduling decisions.
    
    This series addresses this by:
    
    1. Adding mlx5 internal logic to calculate and propagate the effective
       aggregated LAG speed to all attached vports. The vport speeds are
       dynamically updated when LAG member link states change.
    
    2. Extending RDMA core with a new ib_query_port_speed() verb and an
       IB_EVENT_DEVICE_SPEED_CHANGE async event. These interfaces expose
       the effective port speed to userspace, supporting speeds that are
       not expressible as IB speed * width (where width is 2^n).
    
    This series enables userspace applications to query the effective
    port speed and receive notifications on speed changes in real-time.
    In LAG configurations, each mlx5 port reports the aggregated bandwidth
    of all active LAG members.
    
    Signed-off-by: Leon Romanovsky 

commit f0b2fde98065e49795ce6824837b3f53fdf16e5d
Author: Or Har-Toov 
Date:   Thu Dec 18 17:58:20 2025 +0200

    net/mlx5: Add support for querying bond speed
    
    Add mlx5_lag_query_bond_speed() to query the aggregated speed of
    lag configurations with a bond device.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit 28ea6036dad268a055b693d9c06a6f3d126096d3
Author: Or Har-Toov 
Date:   Thu Dec 18 17:58:13 2025 +0200

    net/mlx5: Handle port and vport speed change events in MPESW
    
    Add port change event handling logic for MPESW LAG mode, ensuring
    VFs are updated when the speed of LAG physical ports changes.
    This triggers a speed update workflow when relevant port state changes
    occur, enabling consistent and accurate reporting of VF bandwidth.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Maher Sanalla 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit 50f1d188c580222d7a73e96a338a5dc82360ccc0
Author: Or Har-Toov 
Date:   Thu Dec 18 17:58:05 2025 +0200

    net/mlx5: Propagate LAG effective max_tx_speed to vports
    
    Currently, vports report only their parent's uplink speed, which in LAG
    setups does not reflect the true aggregated bandwidth. This makes it
    hard for upper-layer software to optimize load balancing decisions
    based on accurate bandwidth information.
    
    Fix the issue by calculating the possible maximum speed of a LAG as
    the sum of speeds of all active uplinks that are part of the LAG.
    Propagate this effective max speed to vports associated with the LAG
    whenever a relevant event occurs, such as physical port link state
    changes or LAG creation/modification.
    
    With this change, upper-layer components receive accurate bandwidth
    information corresponding to the active members of the LAG and can
    make better load balancing decisions.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Maher Sanalla 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit 3df5dd46fca4b20efc4767c61d8ecc7249e83f5b
Author: Or Har-Toov 
Date:   Thu Dec 18 17:57:58 2025 +0200

    net/mlx5: Add max_tx_speed and its CAP bit to IFC
    
    Introduce the max_tx_speed field to the query and modify_vport_state
    structures.
    
    Add the esw_vport_state_max_tx_speed capability bit, indicating
    the firmware support modifying the max_tx_speed field via the
    MODIFY_VPORT_STATE command.
    
    Signed-off-by: Or Har-Toov 
    Reviewed-by: Maher Sanalla 
    Reviewed-by: Mark Bloch 
    Signed-off-by: Edward Srouji 
    Signed-off-by: Leon Romanovsky 

commit 549a1be5cebb7079789e5821d8ad53140e181367
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:49:14 2026 +0100

    OPP: of: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Viresh Kumar 

commit ae62d62b1c740f7a5ea72082dc28f30ebf6b134d
Author: Christophe JAILLET 
Date:   Mon Dec 29 12:35:01 2025 +0100

    scsi: target: Constify struct configfs_item_operations and configfs_group_operations
    
    'struct configfs_item_operations' and 'configfs_group_operations' are
    not modified in this driver.
    
    Constifying these structures moves some data to a read-only section, so
    increases overall security, especially when the structure holds some
    function pointers.
    
    On a x86_64, with allmodconfig:
    Before:
    ======
       text    data     bss     dec     hex filename
     151831   80058    4832  236721   39cb1 drivers/target/target_core_configfs.o
      45200   16658       0   61858    f1a2 drivers/target/target_core_fabric_configfs.o
    
    After:
    =====
       text    data     bss     dec     hex filename
     152599   79290    4832  236721   39cb1 drivers/target/target_core_configfs.o
      46352   15506       0   61858    f1a2 drivers/target/target_core_fabric_configfs.o
    
    Signed-off-by: Christophe JAILLET 
    Link: https://patch.msgid.link/a0f25237ae86b8c4dd7a3876c4ed2dc3de200173.1767008082.git.christophe.jaillet@wanadoo.fr
    Signed-off-by: Martin K. Petersen 

commit 8e8e8e7e8406e96a0189e116eb04f67f776f947f
Author: ReBeating 
Date:   Fri Dec 26 11:19:36 2025 +0800

    scsi: target: sbp: Potential integer overflow in sbp_make_tpg()
    
    The variable tpgt in sbp_make_tpg() is defined as unsigned long and is
    assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an
    integer overflow when tpgt is greater than USHRT_MAX (65535). I haven't
    tried to trigger it myself, but it is possible to trigger it by calling
    sbp_make_tpg() with a large value for tpgt.
    
    Modify the type of tpgt to match tpgt->tport_tpgt and adjusted the
    relevant code accordingly.
    
    This patch is similar to commit 59c816c1f24d ("vhost/scsi: potential
    memory corruption").
    
    Signed-off-by: ReBeating 
    Link: https://patch.msgid.link/20251226031936.852-1-rebeating@163.com
    Signed-off-by: Martin K. Petersen 

commit 8fbb8fe75d4cf92eaa7b21828ec39c1bf79a262f
Author: Eric Biggers 
Date:   Fri Dec 19 11:29:09 2025 -0800

    dm-verity: allow REED_SOLOMON to be 'm' if DM_VERITY is 'm'
    
    The dm-verity kconfig options make the common mistake of selecting a
    dependency from a bool "sub-option" rather than the main tristate
    option.  This unnecessarily forces the dependency to built-in ('y').
    
    Fix this by moving the selections of REED_SOLOMON and REED_SOLOMON_DEC8
    into DM_VERITY, conditional on DM_VERITY_FEC.
    
    This allows REED_SOLOMON to be 'm' if DM_VERITY is 'm'.
    
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Eric Biggers 
    Signed-off-by: Mikulas Patocka 

commit 119f4f04186fa4f33ee6bd39af145cdaff1ff17f
Author: Eric Biggers 
Date:   Fri Dec 19 11:29:08 2025 -0800

    dm-verity: correctly handle dm_bufio_client_create() failure
    
    If either of the calls to dm_bufio_client_create() in verity_fec_ctr()
    fails, then dm_bufio_client_destroy() is later called with an ERR_PTR()
    argument.  That causes a crash.  Fix this.
    
    Fixes: a739ff3f543a ("dm verity: add support for forward error correction")
    Cc: stable@vger.kernel.org
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Eric Biggers 
    Signed-off-by: Mikulas Patocka 

commit 1a257c5fd33a5b641478a7dd851861f64529c7bb
Author: Eric Biggers 
Date:   Fri Dec 19 11:29:07 2025 -0800

    dm-verity: make verity_fec_is_enabled() an inline function
    
    verity_fec_is_enabled() is very short and is called in quite a few
    places, so make it an inline function.
    
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Eric Biggers 
    Signed-off-by: Mikulas Patocka 

commit fa3d53140d430f27b54c2bd91f4faccb99c8fbdd
Author: Eric Biggers 
Date:   Fri Dec 19 11:29:06 2025 -0800

    dm-verity: remove unnecessary ifdef around verity_fec_decode()
    
    Since verity_fec_decode() has a !CONFIG_DM_VERITY_FEC stub, it can just
    be called unconditionally, similar to the other calls in the same file.
    
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Eric Biggers 
    Signed-off-by: Mikulas Patocka 

commit 12f74a157750a05d0285086bef97149c9ea1c257
Author: Eric Biggers 
Date:   Fri Dec 19 11:29:05 2025 -0800

    dm-verity: remove unnecessary condition for verity_fec_finish_io()
    
    Make verity_finish_io() call verity_fec_finish_io() unconditionally,
    instead of skipping it when 'in_bh' is true.
    
    Although FEC can't have been done when 'in_bh' is true,
    verity_fec_finish_io() is a no-op when FEC wasn't done.  An earlier
    change also made verity_fec_finish_io() very lightweight when FEC wasn't
    done.  So it should just be called unconditionally.
    
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Eric Biggers 
    Signed-off-by: Mikulas Patocka 

commit 533e641b4587cfe144f413e50eb771433ea82845
Author: Eric Biggers 
Date:   Fri Dec 19 11:29:04 2025 -0800

    dm-verity: make dm_verity_fec_io::bufs variable-length
    
    When correcting a data block, the FEC code performs optimally when it
    has enough buffers to hold all the needed RS blocks.  That number of
    buffers is '1 << (v->data_dev_block_bits - DM_VERITY_FEC_BUF_RS_BITS)'.
    
    However, since v->data_dev_block_bits isn't a compile-time constant, the
    code actually used PAGE_SHIFT instead.
    
    With the traditional PAGE_SIZE == data_block_size == 4096, this was
    fine.  However, when PAGE_SIZE > data_block_size, this wastes space.
    E.g., with data_block_size == 4096 && PAGE_SIZE == 16384, struct
    dm_verity_fec_io is 9240 bytes, when in fact only 3096 bytes are needed.
    
    Fix this by making dm_verity_fec_io::bufs a variable-length array.
    
    This makes the macros DM_VERITY_FEC_BUF_MAX and
    fec_for_each_extra_buffer() no longer apply, so remove them.  For
    consistency, and because DM_VERITY_FEC_BUF_PREALLOC is fixed at 1 and
    was already assumed to be 1 (considering that mempool_alloc() shouldn't
    be called in a loop), also remove the related macros
    DM_VERITY_FEC_BUF_PREALLOC and fec_for_each_prealloc_buffer().
    
    Signed-off-by: Eric Biggers 
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Mikulas Patocka 

commit b140a921eadfeaf48238a3a6d2da2a5e6946a31b
Author: Eric Biggers 
Date:   Fri Dec 19 11:29:03 2025 -0800

    dm-verity: move dm_verity_fec_io to mempool
    
    Currently, struct dm_verity_fec_io is allocated in the front padding of
    struct bio using dm_target::per_io_data_size.  Unfortunately, struct
    dm_verity_fec_io is very large: 3096 bytes when CONFIG_64BIT=y &&
    PAGE_SIZE == 4096, or 9240 bytes when CONFIG_64BIT=y && PAGE_SIZE ==
    16384.  This makes the bio size very large.
    
    Moreover, most of dm_verity_fec_io gets iterated over up to three times,
    even on I/O requests that don't require any error correction:
    
    1. To zero the memory on allocation, if init_on_alloc=1.  (This happens
       when the bio is allocated, not in dm-verity itself.)
    
    2. To zero the buffers array in verity_fec_init_io().
    
    3. To free the buffers in verity_fec_finish_io().
    
    Fix all of these inefficiencies by moving dm_verity_fec_io to a mempool.
    Replace the embedded dm_verity_fec_io with a pointer
    dm_verity_io::fec_io.  verity_fec_init_io() initializes it to NULL,
    verity_fec_decode() allocates it on the first call, and
    verity_fec_finish_io() cleans it up.  The normal case is that the
    pointer simply stays NULL, so the overhead becomes negligible.
    
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Eric Biggers 
    Signed-off-by: Mikulas Patocka 

commit a23cc8257ecdfdeb25fd26d25fec4539ef377944
Author: Li Chen 
Date:   Wed Dec 10 11:17:57 2025 +0800

    dm clone: drop redundant size checks
    
    The clone target already exposes both source and destination devices via
    clone_iterate_devices(), so dm-table's device_area_is_invalid() helper
    ensures that the mapping does not extend past either underlying block
    device.
    
    The manual comparisons between ti->len and the source/destination device
    sizes in parse_source_dev() and parse_dest_dev() are therefore
    redundant. Remove these checks and rely on the core validation instead.
    This changes the error strings reported when the devices are too small,
    but preserves the failure behaviour.
    
    Signed-off-by: Li Chen 
    Signed-off-by: Mikulas Patocka 

commit a2f0a98b13db005403d026274782ac668b59df32
Author: Li Chen 
Date:   Wed Dec 10 11:17:56 2025 +0800

    dm cache: drop redundant origin size check
    
    The cache target already exposes the origin device through
    cache_iterate_devices(), which allows dm-table to call
    device_area_is_invalid() and verify that the mapping fits inside the
    underlying block device.
    
    The explicit ti->len > origin_sectors test in parse_origin_dev() is
    therefore redundant. Drop this check and rely on the core device
    validation instead. This changes the user-visible error string when the
    origin is too small, but preserves the failure behaviour.
    
    Signed-off-by: Li Chen 
    Signed-off-by: Mikulas Patocka 

commit c303e8b86d9dbd6868f5216272973292f7f3b7f1
Author: Robert Marko 
Date:   Mon Dec 29 19:37:51 2025 +0100

    dt-bindings: net: mscc-miim: add microchip,lan9691-miim
    
    Document Microchip LAN969x MIIM compatible.
    
    Signed-off-by: Robert Marko 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251229184004.571837-11-robert.marko@sartura.hr
    Signed-off-by: Jakub Kicinski 

commit 0789f929900d85b80b343c5f04f8b9444e991384
Author: Chengchang Tang 
Date:   Sun Jan 4 14:40:57 2026 +0800

    RDMA/hns: Notify ULP of remaining soft-WCs during reset
    
    During a reset, software-generated WCs cannot be reported via
    interrupts. This may cause the ULP to miss some WCs.
    
    To avoid this, add check in the CQ arm process: if a hardware reset
    has occurred and there are still unreported soft-WCs, notify the ULP
    to handle the remaining WCs, thereby preventing any loss of completions.
    
    Fixes: 626903e9355b ("RDMA/hns: Add support for reporting wc as software mode")
    Signed-off-by: Chengchang Tang 
    Signed-off-by: Junxian Huang 
    Link: https://patch.msgid.link/20260104064057.1582216-5-huangjunxian6@hisilicon.com
    Signed-off-by: Leon Romanovsky 

commit 84bd5d60f0a2b9c763c5e6d0b3d8f4f61f6c5470
Author: Junxian Huang 
Date:   Sun Jan 4 14:40:56 2026 +0800

    RDMA/hns: Fix RoCEv1 failure due to DSCP
    
    DSCP is not supported in RoCEv1, but get_dscp() is still called. If
    get_dscp() returns an error, it'll eventually cause create_ah to fail
    even when using RoCEv1.
    
    Correct the return value and avoid calling get_dscp() when using
    RoCEv1.
    
    Fixes: ee20cc17e9d8 ("RDMA/hns: Support DSCP")
    Signed-off-by: Junxian Huang 
    Link: https://patch.msgid.link/20260104064057.1582216-4-huangjunxian6@hisilicon.com
    Signed-off-by: Leon Romanovsky 

commit 8cda8acbb1f8c6c0fec45b7166bb558b5af59da8
Author: Junxian Huang 
Date:   Sun Jan 4 14:40:55 2026 +0800

    RDMA/hns: Return actual error code instead of fixed EINVAL
    
    query_cqc() and query_mpt() may return various error codes in
    different cases. Return actual error code instead of fixed EINVAL.
    
    Fixes: f2b070f36d1b ("RDMA/hns: Support CQ's restrack raw ops for hns driver")
    Fixes: 3d67e7e236ad ("RDMA/hns: Support MR's restrack raw ops for hns driver")
    Signed-off-by: Junxian Huang 
    Link: https://patch.msgid.link/20260104064057.1582216-3-huangjunxian6@hisilicon.com
    Signed-off-by: Leon Romanovsky 

commit c0a26bbd3f99b7b03f072e3409aff4e6ec8af6f6
Author: Chengchang Tang 
Date:   Sun Jan 4 14:40:54 2026 +0800

    RDMA/hns: Fix WQ_MEM_RECLAIM warning
    
    When sunrpc is used, if a reset triggered, our wq may lead the
    following trace:
    
    workqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma]
    is flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle
    [hns_roce_hw_v2]
    WARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_flush_dependency+0xe0/0x144
    Call trace:
      check_flush_dependency+0xe0/0x144
      start_flush_work.constprop.0+0x1d0/0x2f0
      __flush_work.isra.0+0x40/0xb0
      flush_work+0x14/0x30
      hns_roce_v2_destroy_qp+0xac/0x1e0 [hns_roce_hw_v2]
      ib_destroy_qp_user+0x9c/0x2b4
      rdma_destroy_qp+0x34/0xb0
      rpcrdma_ep_destroy+0x28/0xcc [rpcrdma]
      rpcrdma_ep_put+0x74/0xb4 [rpcrdma]
      rpcrdma_xprt_disconnect+0x1d8/0x260 [rpcrdma]
      xprt_rdma_connect_worker+0xc0/0x120 [rpcrdma]
      process_one_work+0x1cc/0x4d0
      worker_thread+0x154/0x414
      kthread+0x104/0x144
      ret_from_fork+0x10/0x18
    
    Since QP destruction frees memory, this wq should have the WQ_MEM_RECLAIM.
    
    Fixes: ffd541d45726 ("RDMA/hns: Add the workqueue framework for flush cqe handler")
    Signed-off-by: Chengchang Tang 
    Signed-off-by: Junxian Huang 
    Link: https://patch.msgid.link/20260104064057.1582216-2-huangjunxian6@hisilicon.com
    Signed-off-by: Leon Romanovsky 

commit ddd6c8c873e912cb1ead79def54de5e24ff71c80
Author: Etienne AUJAMES 
Date:   Wed Dec 31 14:07:45 2025 +0100

    IB/cache: update gid cache on client reregister event
    
    Some HCAs (e.g: ConnectX4) do not trigger a IB_EVENT_GID_CHANGE on
    subnet prefix update from SM (PortInfo).
    
    Since the commit d58c23c92548 ("IB/core: Only update PKEY and GID caches
    on respective events"), the GID cache is updated exclusively on
    IB_EVENT_GID_CHANGE. If this event is not emitted, the subnet prefix in the
    IPoIB interface’s hardware address remains set to its default value
    (0xfe80000000000000).
    
    Then rdma_bind_addr() failed because it relies on hardware address to
    find the port GID (subnet_prefix + port GUID).
    
    This patch fixes this issue by updating the GID cache on
    IB_EVENT_CLIENT_REREGISTER event (emitted on PortInfo::ClientReregister=1).
    
    Fixes: d58c23c92548 ("IB/core: Only update PKEY and GID caches on respective events")
    Signed-off-by: Etienne AUJAMES 
    Link: https://patch.msgid.link/aVUfsO58QIDn5bGX@eaujamesFR0130
    Reviewed-by: Parav Pandit 
    Signed-off-by: Leon Romanovsky 

commit 6823f10dcc84f35ca652eff0448f7da3d3b26548
Author: Rong Zhang 
Date:   Tue Dec 16 02:11:51 2025 +0800

    x86/split_lock: Remove dead string when split_lock_detect=fatal
    
    sld_state_show() has a dead str1 below:
    
      if (A) {
            ...
      } else if (B) {
            pr_info(... A ? str1 : str2 ...);
      }
    
    where A is always false in the second block, implied by the "if (A) else"
    pattern. Hence, str2 is always used.
    
    This seems to be some mysterious legacy inherited from the earlier patch
    revisions of
    
      ebb1064e7c2e ("x86/traps: Handle #DB for bus lock").
    
    Earlier revisions¹ did enable both sld and bld at the same time to detect
    non-WB bus_locks when split_lock_detect=fatal, but that's no longer true in
    the merged revision.
    
    Remove it and translate the pr_info() into its equivalent form.
    
    ¹ https://lore.kernel.org/r/20201121023624.3604415-3-fenghua.yu@intel.com
    
      [ bp: Massage commit message; simplify braces ]
    
    Signed-off-by: Rong Zhang 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251215182907.152881-1-i@rong.moe

commit a7c2f143f878ab7a5e60ca68ed71d427fe78ce19
Author: Arnd Bergmann 
Date:   Tue Dec 23 22:49:09 2025 +0100

    drm: pl111: fix build regression
    
    The drm_info() function requires the drm/drm_print.h header to be included
    first:
    
    In file included from drivers/gpu/drm/pl111/pl111_nomadik.c:7:
    drivers/gpu/drm/pl111/pl111_nomadik.h:11:32: error: 'struct drm_device' declared inside parameter list will not be visible outside of this definition or declaration [-Werror]
       11 | void pl111_nomadik_init(struct drm_device *dev);
          |                                ^~~~~~~~~~
    drivers/gpu/drm/pl111/pl111_nomadik.c: In function 'pl111_nomadik_init':
    drivers/gpu/drm/pl111/pl111_nomadik.c:34:9: error: implicit declaration of function 'drm_info'; did you mean 'pr_info'? [-Wimplicit-function-declaration]
       34 |         drm_info(dev, "set Nomadik PMU mux to CLCD mode\n");
          |         ^~~~~~~~
          |         pr_info
    
    Fixes: a1542b8ca6ed ("drm: pl111: replace dev_* print functions with drm_* variants")
    Signed-off-by: Arnd Bergmann 
    Reviewed-by: Eslam Khafagy 
    Signed-off-by: Linus Walleij 
    Link: https://patch.msgid.link/20251223214915.503913-1-arnd@kernel.org

commit 97fec06d35b2c1ce6d80cf3b01bfddd82c720a2d
Author: Tony Luck 
Date:   Wed Dec 17 09:20:52 2025 -0800

    x86,fs/resctrl: Refactor domain create/remove using struct rdt_domain_hdr
    
    Up until now, all monitoring events were associated with the L3 resource and it
    made sense to use the L3 specific "struct rdt_mon_domain *" argument to functions
    operating on domains.
    
    Telemetry events will be tied to a new resource with its instances represented
    by a new domain structure that, just like struct rdt_mon_domain, starts with
    the generic struct rdt_domain_hdr.
    
    Prepare to support domains belonging to different resources by changing the
    calling convention of functions operating on domains.  Pass the generic header
    and use that to find the domain specific structure where needed.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit acb0b2f5d6472b26db1d68f6d7b982d30b8bd8fe
Merge: 60908279164a1d cf587c6ff2d098
Author: Boqun Feng 
Date:   Sun Jan 4 18:53:06 2026 +0800

    Merge branch 'rcu-torture.20260104a' into rcu-next
    
    * rcu-torture.20260104a:
      rcutorture: Add --kill-previous option to terminate previous kvm.sh runs
      rcutorture: Prevent concurrent kvm.sh runs on same source tree
      torture: Include commit discription in testid.txt
      torture: Make config2csv.sh properly handle comments in .boot files
      torture: Make kvm-series.sh give run numbers and totals
      torture: Make kvm-series.sh give build numbers and totals
      torture: Parallelize kvm-series.sh guest-OS execution
      rcutorture: Add context checks to rcu_torture_timer()

commit 60908279164a1dc651b7f4685cfbfe5161a4a797
Merge: 8f0b4cce4481fb 760f05bc830d86
Author: Boqun Feng 
Date:   Sun Jan 4 18:52:53 2026 +0800

    Merge branch 'rcu-tasks-trace.20260101a'
    
    * rcu-tasks-trace.20260101a:
      rcutorture: Test rcu_tasks_trace_expedite_current()
      srcu: Create an rcu_tasks_trace_expedite_current() function
      checkpatch: Deprecate rcu_read_{,un}lock_trace()
      rcu: Update Requirements.rst for RCU Tasks Trace
      rcu: Add noinstr-fast rcu_read_{,un}lock_tasks_trace() APIs
      rcu: Move rcu_tasks_trace_srcu_struct out of #ifdef CONFIG_TASKS_RCU_GENERIC
      rcu: Clean up after the SRCU-fastification of RCU Tasks Trace
      context_tracking: Remove rcu_task_trace_heavyweight_{enter,exit}()
      rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast

commit cf587c6ff2d09866eb53a4620bc1aa561fb0c000
Author: Joel Fernandes 
Date:   Thu Jan 1 11:34:17 2026 -0500

    rcutorture: Add --kill-previous option to terminate previous kvm.sh runs
    
    When kvm.sh is killed, its child processes (make, gcc, qemu, etc.) may
    continue running. This prevents new kvm.sh instances from starting even
    though the parent is gone.
    
    Add a --kill-previous option that uses fuser(1) to terminate all
    processes holding the flock file before attempting to acquire it. This
    provides a clean way to recover from stale/zombie kvm.sh runs which
    sometimes may have lots of qemu and compiler processes still disturbing.
    
    Signed-off-by: Joel Fernandes 
    Tested-by: Paul E. McKenney 
    Signed-off-by: Boqun Feng 

commit a590a79d19046d3e0f2089f83046f3b87f880359
Author: Joel Fernandes 
Date:   Thu Jan 1 11:34:16 2026 -0500

    rcutorture: Prevent concurrent kvm.sh runs on same source tree
    
    Add flock-based locking to kvm.sh to prevent multiple instances from
    running concurrently on the same source tree. This prevents build
    failures caused by one instance's "make clean" deleting generated files
    while another instance is building causing build failures.
    
    The lock file is placed in the rcutorture directory and added to
    .gitignore.
    
    Signed-off-by: Joel Fernandes 
    Tested-by: Paul E. McKenney 
    Signed-off-by: Boqun Feng 

commit bdcfc417f26ffd1a7e214d1cce78500dc4dbc2d5
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:53 2025 +0100

    tools/nolibc: always use 64-bit time types
    
    32-bit time types will stop working in 2038.
    
    Switch to 64-bit time types everywhere.
    
    Suggested-by: Arnd Bergmann 
    Link: https://lore.kernel.org/lkml/cec27d94-c99d-4c57-9a12-275ea663dda8@app.fastmail.com/
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-9-c662992f75d7@weissschuh.net

commit f5aa863aea6c1ec20b85cc0b0a22e99597f0cb50
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:52 2025 +0100

    tools/nolibc: use custom structs timespec and timeval
    
    A custom 'struct timespec' and 'struct timeval' will be necessary for
    64-bit time types on 32-bit architectures.  will define
    other time-related types in terms of the custom 'struct timespec'.
    
    Add custom struct definitions which for now mirror exactly the ones from
    the UAPI headers, but provide the foundation for further changes.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-8-c662992f75d7@weissschuh.net

commit 47c17d97681d9c5d080acfdb273fa0856c930e74
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:51 2025 +0100

    tools/nolibc/select: avoid libgcc 64-bit multiplications
    
    timeval::tv_usec is going to be 64-bit wide even on 32-bit
    architectures. As not all architectures support 64-bit multiplications
    instructions, calls to libgcc (__multi3()) may be emitted by the
    compiler which are not provided by nolibc.
    
    As tv_usec and tv_nsec are guaranteed to always fit into an uint32_t,
    perform a 32-bit multiplication instead.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-7-c662992f75d7@weissschuh.net

commit 7efd15d22a9b7e62d0659471bde25c35ef50c9e5
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:50 2025 +0100

    tools/nolibc/gettimeofday: avoid libgcc 64-bit divisions
    
    timespec::tv_nsec is going to be 64-bit wide even on 32-bit
    architectures. As not all architectures support 64-bit division
    instructions, calls to libgcc (__divdi3()) may be emitted by the
    compiler which are not provided by nolibc.
    
    As tv_nsec is guaranteed to always fit into an uint32_t, perform a
    32-bit division instead.
    
    Signed-off-by: Thomas Weißschuh 
    Reviewed-by: Arnd Bergmann 
    Acked-by: Willy Tarreau 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-6-c662992f75d7@weissschuh.net

commit ba7fd0384530e3dd20ea873aac21c473e3e461ae
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:49 2025 +0100

    tools/nolibc: prefer explicit 64-bit time-related system calls
    
    Make sure to always use the 64-bit safe system calls
    in preparation for 64-bit time_t on 32-bit architectures.
    
    Also prevent issues on kernels which disable CONFIG_COMPAT_32BIT_TIME
    and therefore don't provide the 32-bit system calls anymore.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-5-c662992f75d7@weissschuh.net

commit b8f4f5d1b99e2ae73fd448e9bbd16dc244e6586c
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:48 2025 +0100

    tools/nolibc/time: drop invocation of gettimeofday system call
    
    This invocation uses libc types with a system call. While this works
    now, upcoming changes to 'struct timeval' would require type
    conversions. If types are converted anyways, the clock_gettime() based
    fallback can be used everywhere, simplifying the code.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-4-c662992f75d7@weissschuh.net

commit 668e43737279284318064bdd4eab689a3aaed652
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:47 2025 +0100

    tools/nolibc/select: drop non-pselect based implementations
    
    These implementations use the libc 'struct timeval' with system calls
    which can lead to type mismatches. Currently this is fine, but will
    break with upcoming changes to 'struct timeval'.
    
    If the structure needs to be converted anyways, the implementations
    based on pselect can be used for all architectures. This simplifies the
    logic.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-3-c662992f75d7@weissschuh.net

commit 548d682649f02f4240e8ea4e99f1899978e1cfe4
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:46 2025 +0100

    tools/nolibc/poll: drop __NR_poll fallback
    
    This fallback is never used, remove it.
    
    Suggested-by: Arnd Bergmann 
    Link: https://lore.kernel.org/lkml/fbca1d3e-12e4-4c4e-8091-87464035fe39@app.fastmail.com/
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-2-c662992f75d7@weissschuh.net

commit f675e35dd28f1ac326b1d6520fee3605019b381b
Author: Thomas Weißschuh 
Date:   Sat Dec 20 14:55:45 2025 +0100

    tools/nolibc/poll: use kernel types for system call invocations
    
    The system calls expect 'struct __kernel_old_timespec'.
    While currently 'struct __kernel_old_timespec' and 'struct timespec' are
    compatible, this is confusing. Especially as future patches will change
    the definition of 'struct timespec'.
    
    Use the correct kernel type instead.
    
    Suggested-by: Arnd Bergmann 
    Link: https://lore.kernel.org/lkml/fbca1d3e-12e4-4c4e-8091-87464035fe39@app.fastmail.com/
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Willy Tarreau 
    Reviewed-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251220-nolibc-uapi-types-v3-1-c662992f75d7@weissschuh.net

commit cc6809f6728456c03db6750fcc94ed8b581a2cf8
Author: Thomas Weißschuh 
Date:   Wed Dec 3 20:08:00 2025 +0100

    tools/nolibc: always use 64-bit mode for s390 header checks
    
    32-bit s390 support was recently removed from nolibc.
    If the compiler defaults to 32-bit during the header checks, they fail.
    
    Make sure to always use 64-bit mode for s390 heafer checks.
    
    Fixes: 169ebcbb9082 ("tools: Remove s390 compat support")
    Acked-by: Willy Tarreau 
    Acked-by: Heiko Carstens 
    Link: https://patch.msgid.link/20251203-nolibc-headers-check-s390-v1-1-5d35e52a83ba@weissschuh.net
    Signed-off-by: Thomas Weißschuh 

commit ec4bb8e8dfa060c699b548f62e4d56133aafbbec
Author: Benjamin Berg 
Date:   Wed Sep 24 16:20:58 2025 +0200

    tools/nolibc: add ptrace support
    
    Add ptrace support, as it will be useful in UML.
    
    Signed-off-by: Benjamin Berg 
    [Thomas: drop va_args usage and linux/uio.h inclusion]
    Signed-off-by: Thomas Weißschuh 

commit c1b630573c8ca51a89bd480f7eeaf8754c7609f2
Author: Tony Luck 
Date:   Wed Dec 17 09:20:51 2025 -0800

    x86/resctrl: Clean up domain_remove_cpu_ctrl()
    
    For symmetry with domain_remove_cpu_mon() refactor domain_remove_cpu_ctrl()
    to take an early return when removing a CPU does not empty the domain.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 6396fc5351ea9130a72f6a2fc58eb7298ce6c15a
Author: Tony Luck 
Date:   Wed Dec 17 09:20:50 2025 -0800

    x86/resctrl: Refactor domain_remove_cpu_mon() ready for new domain types
    
    New telemetry events will be associated with a new package scoped resource
    with a new domain structure.
    
    Refactor domain_remove_cpu_mon() so all the L3 domain processing is separate
    from the general domain action of clearing the CPU bit in the mask.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 0d6447623d788806b5504182032a0837ffa2174c
Author: Tony Luck 
Date:   Wed Dec 17 09:20:49 2025 -0800

    x86/resctrl: Move L3 initialization into new helper function
    
    Carve out the resource monitoring domain init code into a separate helper in
    order to be able to initialize new types of monitoring domains besides the
    usual L3 ones.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 03eb578b37659e10bed14c2d9e7cc45dfe24123b
Author: Tony Luck 
Date:   Wed Dec 17 09:20:48 2025 -0800

    x86,fs/resctrl: Improve domain type checking
    
    Every resctrl resource has a list of domain structures. struct rdt_ctrl_domain
    and struct rdt_mon_domain both begin with struct rdt_domain_hdr with
    rdt_domain_hdr::type used in validity checks before accessing the domain of
    a particular type.
    
    Add the resource id to struct rdt_domain_hdr in preparation for a new monitoring
    domain structure that will be associated with a new monitoring resource. Improve
    existing domain validity checks with a new helper domain_header_is_valid()
    that checks both domain type and resource id.  domain_header_is_valid() should
    be used before every call to container_of() that accesses a domain structure.
    
    Signed-off-by: Tony Luck 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Reinette Chatre 
    Link: https://lore.kernel.org/20251217172121.12030-1-tony.luck@intel.com

commit 3af51501e2b8c87564b5cda43b0e5c316cf54717
Author: Abel Vesa 
Date:   Mon Nov 3 18:51:40 2025 +0200

    arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks
    
    It seems the USB combo SS1 and SS2 ref clocks have another gate, unlike
    the SS0. These gates are part of the TCSR clock controller.
    
    At least on Dell XPS 13 (9345), if the ref clock provided by the TCSR
    clock controller for SS1 PHY is disabled on the clk_disable_unused late
    initcall, the PHY fails to initialize. It doesn't happen on the SS0 PHY
    and the SS2 is not used on this device.
    
    This doesn't seem to be a problem on CRD though. It might be that the
    RPMh has a vote for it from some other consumer and does not actually
    disable it when ther kernel drops its vote.
    
    Either way, these TCSR provided clocks seem to be the correct ones for
    the SS1 and SS2, so use them instead.
    
    Fixes: 4af46b7bd66f ("arm64: dts: qcom: x1e80100: Add USB nodes")
    Signed-off-by: Abel Vesa 
    Reviewed-by: Neil Armstrong 
    Reviewed-by: Taniya Das 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251103-dts-qcom-x1e80100-fix-combo-ref-clks-v1-1-f395ec3cb7e8@linaro.org
    Signed-off-by: Bjorn Andersson 

commit ec593a86dfa1bbb5ef02165711f7ed8bb1046e29
Author: Vikram Sharma 
Date:   Fri Nov 7 21:55:21 2025 +0530

    arm64: dts: qcom: qcs8300: Add support for camss
    
    Add changes to support the camera subsystem on the QCS8300.
    
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Bryan O'Donoghue 
    Signed-off-by: Vikram Sharma 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251107162521.511536-3-quic_vikramsa@quicinc.com
    Signed-off-by: Bjorn Andersson 

commit af2ce7296643767a81c96d12a8d367afc5091df2
Author: Nickolay Goppen 
Date:   Mon Nov 10 21:55:08 2025 +0300

    arm64: dts: qcom: sdm630: Add FastRPC nodes to ADSP
    
    Add FastRPC subnode with compute-cb subnodes to ADSP node.
    
    Signed-off-by: Nickolay Goppen 
    Link: https://lore.kernel.org/r/20251110-qcom-sdm660-cdsp-adsp-dts-v3-3-d1f1c86e2e6d@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit a044cc859dc93c7a32f0c24745242bd3f0a04db5
Author: Nickolay Goppen 
Date:   Mon Nov 10 21:55:07 2025 +0300

    arm64: dts: qcom: sdm630: Add missing vote clock and GDSC to lpass_smmu
    
    Add missing vote clock and GDSC to lpass_smmu node to make sure the
    required resources are enabled before attempting to access the hardware.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Nickolay Goppen 
    Link: https://lore.kernel.org/r/20251110-qcom-sdm660-cdsp-adsp-dts-v3-2-d1f1c86e2e6d@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit c0c32a9e3493f9987fd6635bbaf7260dfc09ee29
Author: Nickolay Goppen 
Date:   Mon Nov 10 21:55:06 2025 +0300

    arm64: dts: qcom: sdm630/660: Add CDSP-related nodes
    
    In order to enable CDSP support for SDM660 SoC:
     * add shared memory p2p nodes for CDSP
     * add CDSP-specific smmu node
     * add CDSP peripheral image loader node
    
    Memory region for CDSP in SDM660 occupies the same spot as
    TZ buffer mem defined in sdm630.dtsi (which does not have CDSP).
    In sdm660.dtsi replace buffer_mem inherited from SDM630 with
    cdsp_region, which is also larger in size.
    
    SDM636 also doesn't have CDSP, so remove inherited from sdm660.dtsi
    related nodes and add buffer_mem back.
    
    Signed-off-by: Nickolay Goppen 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251110-qcom-sdm660-cdsp-adsp-dts-v3-1-d1f1c86e2e6d@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit 512716f69610d81db958b781132370731c69e874
Author: Yongxing Mou 
Date:   Wed Nov 12 12:21:23 2025 +0800

    arm64: dts: qcom: hamoa-iot-evk: Add backlight support for eDP panel
    
    The backlight on the Hamoa IoT EVK is controlled through a PWM signal.
    Aligned with other x1e80100-based platforms: the PWM signal is controlled
    by PMK8550, and the backlight enable signal is handled by PMC8380.
    
    Describe the backlight device and connect it to the eDP panel to allow
    for brightness control.
    
    Reviewed-by: Abel Vesa 
    Signed-off-by: Yongxing Mou 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251112-hamoa_dvt_backlight-v3-1-f35b44af7fc4@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e50c63e89236beb249507f986c3458b2b670cfd6
Author: Tingguo Cheng 
Date:   Fri Nov 14 00:13:03 2025 -0800

    arm64: dts: qcom: hamoa-iot-evk: enable PWM RG LEDs
    
    Add RED and GREEN LED channels for the RGB device connected to PMC8380C
    PWM-LED pins. Omit BLUE channel to match default hardware setup where
    it's tied to EDL indicator.
    
    Signed-off-by: Tingguo Cheng 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251114-add-rgb-led-for-hamoa-iot-evk-v3-1-5df1fcd68374@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 3ad80ba51eb931c7fcba0bec5b1c9ca5f6d99cea
Author: Barnabás Czémán 
Date:   Mon Nov 17 18:17:55 2025 +0100

    arm64: dts: qcom: msm8937: add reset for display subsystem
    
    Add reset for display subsystem.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Barnabás Czémán 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251117-mdss-resets-msm8917-msm8937-v2-4-a7e9bbdaac96@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit 2ffe611f896857ef542e60f9e1b3bc1869faabdd
Author: Barnabás Czémán 
Date:   Mon Nov 17 18:17:54 2025 +0100

    arm64: dts: qcom: msm8917: add reset for display subsystem
    
    Add reset for display subsystem.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Barnabás Czémán 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251117-mdss-resets-msm8917-msm8937-v2-3-a7e9bbdaac96@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit e54a69a1bc17408c276fc1192d065ad890476dad
Merge: ad33ee060be467 21dcacabcc7ec6
Author: Bjorn Andersson 
Date:   Sat Jan 3 13:20:56 2026 -0600

    Merge branch '20251117-mdss-resets-msm8917-msm8937-v2-1-a7e9bbdaac96@mainlining.org' into HEAD
    
    Merge the addition of MDSS reset to the MSM8917 GCC binding, in order to
    get access to the introduced constant.

commit 9eb018828b1b30dfba689c060735c50fc5b9f704
Author: Xiaolei Wang 
Date:   Wed Dec 3 21:03:23 2025 +0800

    drm/v3d: Set DMA segment size to avoid debug warnings
    
    When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
    kernel occasionally reports a segment size mismatch. This is because
    'max_seg_size' is not set. The kernel defaults to 64K. setting
    'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
    from complaining about the over-mapping of the V3D segment length.
    
    DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device
     claims to support [len=8290304] [max=65536]
    WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388
    CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1
    Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
    pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : debug_dma_map_sg+0x330/0x388
    lr : debug_dma_map_sg+0x330/0x388
    sp : ffff8000829a3ac0
    x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000
    x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000
    x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002
    x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff
    x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573
    x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000
    x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c
    x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001
    x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008
    x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280
    Call trace:
     debug_dma_map_sg+0x330/0x388
     __dma_map_sg_attrs+0xc0/0x278
     dma_map_sgtable+0x30/0x58
     drm_gem_shmem_get_pages_sgt+0xb4/0x140
     v3d_bo_create_finish+0x28/0x130 [v3d]
     v3d_create_bo_ioctl+0x54/0x180 [v3d]
     drm_ioctl_kernel+0xc8/0x140
     drm_ioctl+0x2d4/0x4d8
    
    Signed-off-by: Xiaolei Wang 
    Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com
    Signed-off-by: Maíra Canal 

commit ad33ee060be46794a03d033894c9db3a9d6c1a0f
Author: Casey Connolly 
Date:   Tue Nov 18 15:52:27 2025 +0100

    arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on
    
    This regulator is used only for the display, which is enabled by the
    bootloader and left on for continuous splash. Mark it as such.
    
    Fixes: 288ef8a42612 ("arm64: dts: sdm845: add oneplus6/6t devices")
    Signed-off-by: Casey Connolly 
    Signed-off-by: David Heidelberg 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251118-dts-oneplus-regulators-v2-3-3e67cea1e4e7@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 45d1f42d3e84b5880cf9fab1eb24a7818320eeb7
Author: Casey Connolly 
Date:   Tue Nov 18 15:52:26 2025 +0100

    arm64: dts: qcom: sdm845-oneplus: Don't keep panel regulator always on
    
    The panel regulator doesn't need to be always on, so remove this
    property.
    
    Fixes: 288ef8a42612 ("arm64: dts: sdm845: add oneplus6/6t devices")
    Signed-off-by: Casey Connolly 
    Signed-off-by: David Heidelberg 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251118-dts-oneplus-regulators-v2-2-3e67cea1e4e7@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit c9b98b9dad9749bf2eb7336a6fca31a6af1039d7
Author: Casey Connolly 
Date:   Tue Nov 18 15:52:25 2025 +0100

    arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
    
    The touchscreen isn't enabled by bootloader and doesn't need to be
    enabled at boot, only when the driver probes, thus remove the
    regulator-boot-on property.
    
    Fixes: 288ef8a42612 ("arm64: dts: sdm845: add oneplus6/6t devices")
    Signed-off-by: Casey Connolly 
    Signed-off-by: David Heidelberg 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251118-dts-oneplus-regulators-v2-1-3e67cea1e4e7@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 0c1d1591f898d54eaa4c8f2a1535ab21bf4e42e4
Author: Alexey Minnekhanov 
Date:   Sun Nov 16 04:12:35 2025 +0300

    arm64: dts: qcom: sdm630: Add missing MDSS reset
    
    If the OS does not support recovering the state left by the
    bootloader it needs a way to reset display hardware, so that it can
    start from a clean state. Add a reference to the relevant reset.
    
    It fixes display init issue appeared in Linux v6.17: without reset
    device boots into black screen and you need to turn display off/on
    to "fix" it. Also sometimes it can boot into solid blue color
    with these messages in kernel log:
    
      hw recovery is not complete for ctl:2
      [drm:dpu_encoder_phys_vid_prepare_for_kickoff:569] [dpu error]enc33
          intf1 ctl 2 reset failure: -22
      [drm:dpu_encoder_frame_done_timeout:2727] [dpu error]enc33 frame
          done timeout
    
    Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state")
    Cc: stable@vger.kernel.org # 6.17
    Signed-off-by: Alexey Minnekhanov 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251116-sdm660-mdss-reset-v2-3-6219bec0a97f@postmarketos.org
    Signed-off-by: Bjorn Andersson 

commit 60fb18fbc234efb2d59472a889282dba2df3402a
Author: George Moussalem 
Date:   Mon Aug 18 15:33:47 2025 +0400

    arm64: dts: qcom: ipq5018: Remove tsens v1 fallback compatible
    
    Remove qcom,tsens-v1 as fallback compatible since this IP has no RPM
    and, as such, must use its own init routine available in the driver.
    
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: George Moussalem 
    Link: https://lore.kernel.org/r/20250818-ipq5018-tsens-fix-v1-2-0f08cf09182d@outlook.com
    Signed-off-by: Bjorn Andersson 

commit 3f745bc0f11f66465e3fa19eb0c808c5b39cb0e5
Author: Riccardo Mereu 
Date:   Thu Nov 20 16:58:25 2025 +0100

    arm64: dts: qcom: qrb2210: add dts for Arduino unoq
    
    Arduino UnoQ is a single-board computer combining Qualcomm
    Dragonwing™ QRB2210 microprocessor with STMicroelectronics STM32U585
    microcontroller.
    Support to a simply boot to shell environment includes:
    - UART, I2C, SPI
    - onboard LEDS
    - eMMC
    - WLAN and BT
    
    Signed-off-by: Riccardo Mereu 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251120155825.121483-7-r.mereu.kernel@arduino.cc
    Signed-off-by: Bjorn Andersson 

commit 925ac1f6ec75a773e0ec8b91673b647f6d456ccb
Author: Riccardo Mereu 
Date:   Thu Nov 20 16:58:24 2025 +0100

    arm64: dts: qcom: agatti: add uart2 node
    
    uart2 is used in Arduino UnoQ as an interface between microprocessor and
    microcontroller.
    
    Signed-off-by: Riccardo Mereu 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251120155825.121483-6-r.mereu.kernel@arduino.cc
    Signed-off-by: Bjorn Andersson 

commit 311d173da672397a58498841299ec613ff9eb96b
Author: Riccardo Mereu 
Date:   Thu Nov 20 16:58:23 2025 +0100

    dt-bindings: arm: qcom: Add arduino imola, UnoQ codename
    
    Document Arduino imola, UnoQ codename.
    Arduino UnoQ combines Qualcomm Dragonwing™ QRB2210 microprocessor
    with STMicroelectronics STM32U585 microcontroller.
    
    Signed-off-by: Riccardo Mereu 
    Acked-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251120155825.121483-5-r.mereu.kernel@arduino.cc
    Signed-off-by: Bjorn Andersson 

commit d16ffac771715a8c94611b6f8088a3e800bcf5bf
Author: Riccardo Mereu 
Date:   Thu Nov 20 16:58:20 2025 +0100

    dt-bindings: vendor-prefixes: Add Arduino name
    
    Add entry for Arduino SRL (https://arduino.cc)
    
    Signed-off-by: Riccardo Mereu 
    Acked-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251120155825.121483-2-r.mereu.kernel@arduino.cc
    Signed-off-by: Bjorn Andersson 

commit f055a39f6874b0e86926fe17f40b676cf287ac11
Author: Hongyang Zhao 
Date:   Wed Nov 26 00:07:03 2025 +0800

    arm64: dts: qcom: Add qcs6490-rubikpi3 board dts
    
    Add DTS for Thundercomm qcs6490-rubikpi3 board which uses
    QCS6490 SoC.
    
    Works:
    - Bluetooth (AP6256)
    - Wi-Fi (AP6256)
    - Ethernet (AX88179B connected to UPD720201)
    - Two USB Type-A 3.0 ports (UPD720201 connected to PCIe0)
    - USB Type-A 2.0 port
    - USB Type-C
    - M.2 M-Key 2280 PCIe 3.0
    - FAN
    - RTC
    - 40PIN: I2C x1, UART x1
    
    Signed-off-by: Hongyang Zhao 
    Reviewed-by: Roger Shimizu 
    Reviewed-by: Christopher Obbard 
    Tested-by: Christopher Obbard 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251126-rubikpi-next-20251125-v7-2-e46095b80529@thundersoft.com
    Signed-off-by: Bjorn Andersson 

commit 640565d3f3654b7e8848c5bcf01843f04bfa769a
Author: Hongyang Zhao 
Date:   Wed Nov 26 00:07:02 2025 +0800

    dt-bindings: arm: qcom: Add Thundercomm RUBIK Pi 3
    
    Add compatible for the Thundercomm RUBIK Pi 3 board,
    which is based on the Qualcomm Dragonwing QCS6490 SoC.
    
    Reviewed-by: Roger Shimizu 
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Hongyang Zhao 
    Link: https://lore.kernel.org/r/20251126-rubikpi-next-20251125-v7-1-e46095b80529@thundersoft.com
    Signed-off-by: Bjorn Andersson 

commit 3b226dc2a0c39de609ecb383a92d9ed99d7aebc8
Author: Krishna Kurapati 
Date:   Fri Nov 28 15:55:07 2025 +0530

    arm64: dts: qcom: lemans-evk: Add OTG support for primary USB controller
    
    Enable OTG support for primary USB controller on EVK Platform. Add
    HD3SS3220 Type-C port controller present between Type-C port and SoC
    that provides role switch notifications to controller.
    
    Signed-off-by: Krishna Kurapati 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251128102507.3206169-1-krishna.kurapati@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 3d852462ecfeccddfe48b0eca2407118ba8efad4
Author: Sarthak Garg 
Date:   Tue Dec 2 13:40:17 2025 +0530

    arm64: dts: qcom: sm8750-qrd: Add SDC2 node for sm8750 qrd board
    
    Enable SD Card host controller for sm8750 qrd board.
    
    Signed-off-by: Sarthak Garg 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251202081017.2234677-4-sarthak.garg@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit add674d84596bfbcef956898327387d0d9489ab5
Author: Sarthak Garg 
Date:   Tue Dec 2 13:40:16 2025 +0530

    arm64: dts: qcom: sm8750-mtp: Add SDC2 node for sm8750 mtp board
    
    Enable SD Card host controller for sm8750 mtp board.
    
    Signed-off-by: Sarthak Garg 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251202081017.2234677-3-sarthak.garg@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 6e6cf8ff9917c7927a0e571a340b4effc45548d5
Author: Sarthak Garg 
Date:   Tue Dec 2 13:40:15 2025 +0530

    arm64: dts: qcom: sm8750: Add SDC2 nodes for sm8750 soc
    
    Add SD Card host controller for sm8750 soc.
    
    Signed-off-by: Sarthak Garg 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Abel Vesa 
    Link: https://lore.kernel.org/r/20251202081017.2234677-2-sarthak.garg@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit fc4795cf96af49a03b72fc0f260f824d969243e8
Author: Gaurav Kohli 
Date:   Thu Dec 4 09:41:58 2025 +0530

    arm64: dts: qcom: monaco-evk: Enable AMC6821 fan controller
    
    Enable AMC6821 fan controller for monaco-evk platform and
    configure pwm polarity as inverted.
    
    Signed-off-by: Gaurav Kohli 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251204041158.2613340-1-gaurav.kohli@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 5bde31dc7b17b668a02857c30359ac86c23c9e55
Author: Robert Eckelmann 
Date:   Fri Dec 5 22:59:01 2025 +0900

    arm64: dts: qcom: sdm845-xiaomi-beryllium: Add placeholders and sort
    
    We know these devices are present, most of them are supported by
    downstream and close to the mainline kernels.
    
    This is very handy when rebasing the integration tree with the support.
    
    No functional changes.
    
    Reviewed-by: David Heidelberg 
    Signed-off-by: Robert Eckelmann 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251205-slpi-v3-3-a1320a074345@gmail.com
    Signed-off-by: Bjorn Andersson 

commit f4e6e3f827a0c53f38b3186335069d855ea9e9ff
Author: Robert Eckelmann 
Date:   Fri Dec 5 22:59:00 2025 +0900

    arm64: dts: qcom: sdm845-xiaomi-beryllium: Adjust firmware paths
    
    Firmware patht adjusted to include device maker "Xiaomi"
    
    Signed-off-by: Robert Eckelmann 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251205-slpi-v3-2-a1320a074345@gmail.com
    Signed-off-by: Bjorn Andersson 

commit 2a7dac907be27bd0b86a6f2df3f5feedcb538263
Author: Robert Eckelmann 
Date:   Fri Dec 5 22:58:59 2025 +0900

    arm64: dts: qcom: sdm845-xiaomi-beryllium: Enable SLPI
    
    Enable the SLPI dsp on the Xiaomi Pocophone F1 with Qualcom SDM845 SoC.
    
    Signed-off-by: Robert Eckelmann 
    Signed-off-by: David Heidelberg 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251205-slpi-v3-1-a1320a074345@gmail.com
    Signed-off-by: Bjorn Andersson 

commit b0d5c96e860c28159541e7bb8ed277b0fee13a0c
Author: Sam Day 
Date:   Sat Dec 6 18:45:43 2025 +0100

    arm64: dts: qcom: sdm845-oneplus: Add framebuffer
    
    Introduce the framebuffer node, mostly useful for the u-boot and early
    boot stages.
    
    Signed-off-by: Sam Day 
    Co-developed-by: David Heidelberg 
    Signed-off-by: David Heidelberg 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251206-sdm845-oneplus-fb-v1-2-19b666b27d6e@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 9bf9c47cd8e54d0653147bc7a7e6c135607286be
Author: David Heidelberg 
Date:   Sat Dec 6 18:45:42 2025 +0100

    arm64: dts: qcom: sdm845-oneplus-enchilada: Sort nodes alphabetically
    
    Sort the nodes by alphabet, no functional changes.
    
    Signed-off-by: David Heidelberg 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251206-sdm845-oneplus-fb-v1-1-19b666b27d6e@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 9f262627a90c3af102e066ad922e966d9f6fa24b
Author: Krzysztof Kozlowski 
Date:   Wed Nov 19 09:24:09 2025 +0100

    arm64: defconfig: Enable EC drivers for Qualcomm-based laptops
    
    Enable the drivers for Embedded Controllers present on laptops with
    Qualcomm SoCs: Acer Aspire 1, Huawei Matebook E Go, Lenovo Yoga C630 and
    Lenovo Thinkpad T14s.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Neil Armstrong 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251119082408.49712-2-krzk@kernel.org
    Signed-off-by: Bjorn Andersson 

commit 8c4415fd17cd5979c31a4bf303acc702e9726033
Author: Vladimir Zapolskiy 
Date:   Mon Nov 24 23:20:12 2025 +0200

    clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
    
    In line with commit a27ac3806b0a ("clk: qcom: gcc-sm8450: Use floor ops
    for SDCC RCGs") done to fix issues with overclocked SD cards on SM8450
    powered boards set floor clock operations for SDCC RCGs on SM8650.
    
    This change fixes initialization of some SD cards, where the problem
    is manifested by the SDHC driver:
    
        mmc0: Card appears overclocked; req 50000000 Hz, actual 100000000 Hz
        mmc0: error -110 whilst initialising SD card
    
    Fixes: c58225b7e3d7 ("clk: qcom: add the SM8650 Global Clock Controller driver, part 1")
    Signed-off-by: Vladimir Zapolskiy 
    Reviewed-by: Neil Armstrong 
    Reviewed-by: Taniya Das 
    Link: https://lore.kernel.org/r/20251124212012.3660189-3-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit 1c06e3956054fb5a0930f07b02726b1774b6c700
Author: Vladimir Zapolskiy 
Date:   Mon Nov 24 23:20:11 2025 +0200

    clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
    
    In line with commit a27ac3806b0a ("clk: qcom: gcc-sm8450: Use floor ops
    for SDCC RCGs") done to fix issues with overclocked SD cards on SM8450
    powered boards set floor clock operations for SDCC RCGs on SM8550.
    
    This change fixes initialization of some SD cards, where the problem
    is manifested by the SDHC driver:
    
        mmc0: Card appears overclocked; req 50000000 Hz, actual 100000000 Hz
        mmc0: error -110 whilst initialising SD card
    
    Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550")
    Signed-off-by: Vladimir Zapolskiy 
    Reviewed-by: Neil Armstrong 
    Reviewed-by: Taniya Das 
    Link: https://lore.kernel.org/r/20251124212012.3660189-2-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit 77d0ea71b30bcb9f06d36a804542851081d4da3c
Author: Krzysztof Kozlowski 
Date:   Mon Dec 8 03:06:22 2025 +0100

    clk: qcom: videocc-sm8750: Constify qcom_cc_desc
    
    Static 'struct qcom_cc_desc' is not modified by drivers and can be made
    const for code safety.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Taniya Das 
    Reviewed-by: Imran Shaik 
    Link: https://lore.kernel.org/r/20251208020621.4514-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e5e22c8ea49e62c390e3843a632727569f6470a2
Author: Luca Weiss 
Date:   Mon Dec 8 21:41:02 2025 +0900

    ARM: dts: qcom: msm8974-hammerhead: Update model property
    
    Many years have passed (more than 9 actually) since the introduction of
    the Nexus 5 dts to Linux and it's high time to update the model property
    to be a proper model name and thereby bringing it to the standards of
    the 2020s.
    
    Signed-off-by: Luca Weiss 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: David Heidelberg 
    Link: https://lore.kernel.org/r/20251208-msm8974-hammerhead-model-v1-1-88975f30cbaa@lucaweiss.eu
    Signed-off-by: Bjorn Andersson 

commit bc11f6f1d2470fa59846be077555f9d4b7c2c0d3
Author: Jingzhou Zhu 
Date:   Mon Dec 8 11:15:11 2025 +0800

    arm64: dts: qcom: sdm850-huawei-matebook-e-2019: Correct ipa_fw_mem for the driver to load successfully
    
    The ipa driver refuses to load with the old ipa_fw_mem in newer kernels.
    Shrinking its size to 0x5a000 fixes the problem.
    
    Fixes: aab69794b55d ("arm64: dts: qcom: Add support for Huawei MateBook E 2019")
    
    Signed-off-by: Jingzhou Zhu 
    Link: https://lore.kernel.org/r/20251208031511.3284-3-newwheatzjz@zohomail.com
    Signed-off-by: Bjorn Andersson 

commit a499c40ccd8e748ef363e2d13fb7a5c0ed6a788a
Author: Jingzhou Zhu 
Date:   Mon Dec 8 11:15:10 2025 +0800

    arm64: dts: qcom: sdm850-huawei-matebook-e-2019: Remove duplicate reserved-memroy nodes
    
    The adsp_mem and slpi_mem defined in sdm845.dtsi work well. Remove these
    nodes here to avoid redefinition.
    
    Signed-off-by: Jingzhou Zhu 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251208031511.3284-2-newwheatzjz@zohomail.com
    Signed-off-by: Bjorn Andersson 

commit 1a5d6d70c3b0b9b2007cd57001266dc018b6098e
Author: Yingying Tang 
Date:   Wed Dec 10 11:28:17 2025 +0800

    arm64: dts: qcom: hamoa-iot-evk: Add WLAN node for Hamoa IoT EVK board
    
    WLAN card is connected to PCIe4 on Hamoa IoT EVK board. Add WLAN node
    to support power sequence for this WLAN card.
    
    Signed-off-by: Yingying Tang 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251210032817.1264850-1-yingying.tang@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit dce54bba172e351777d3ddcec9f7d03bea99ddf7
Author: Khalid Faisal Ansari 
Date:   Fri Nov 14 15:47:37 2025 +0530

    arm64: dts: qcom: monaco-evk: Enable TPM (ST33)
    
    Enable ST33HTPM TPM over SPI10 on the Monaco IoT EVK by adding the
    required SPI and TPM nodes.
    
    Signed-off-by: Khalid Faisal Ansari 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251114-enable-tpm-monaco-v1-1-4ed566838698@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit d46a0900bdb95a4b1175fa821b46abc11664314b
Author: Khalid Faisal Ansari 
Date:   Fri Nov 14 15:45:45 2025 +0530

    arm64: dts: qcom: lemans-evk: Enable TPM (ST33)
    
    Enable ST33HTPM TPM over SPI16 on the LeMans IoT EVK by adding the
    required SPI and TPM nodes.
    
    Signed-off-by: Khalid Faisal Ansari 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251114-enable-tpm-lemans-v1-1-c8d8b580ace7@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e95ddac66a77077a021c9f2e6b3cf6dc236b655c
Author: Gaurav Kohli 
Date:   Mon Dec 15 10:24:51 2025 +0530

    arm64: dts: qcom: lemans: Enable cpufreq cooling devices
    
    Add cooling-cells property to the CPU nodes to support cpufreq
    cooling devices.
    
    Signed-off-by: Gaurav Kohli 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251215045451.3150894-1-gaurav.kohli@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 0f15cbbf315c12a9c1004196d5beed8cce9dcf6d
Author: Gaurav Kohli 
Date:   Mon Dec 8 17:15:58 2025 +0530

    arm64: dts: qcom: monaco: Enable cpufreq cooling devices
    
    Add cooling-cells property to the CPU nodes to support cpufreq
    cooling devices.
    
    Signed-off-by: Gaurav Kohli 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251208114558.2343462-1-gaurav.kohli@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a678adbf2d22edcb9078f8ad56706891a0ac9e80
Author: David Heidelberg 
Date:   Sun Dec 14 15:51:24 2025 +0100

    arm64: dts: qcom: Add support for Pixel 3 and Pixel 3 XL
    
    This adds initial device tree support for the following phones:
    
     - Google Pixel 3 (blueline)
     - Google Pixel 3 XL (crosshatch)
    
    Both phone boards use the same identifiers and differ only slightly
    in their connected peripherals.
    
    Supported functionality includes:
     - Debug UART
     - UFS
     - USB-C (peripheral mode)
     - Framebuffer (both u-boot and Linux)
     - Display (Pixel 3 only, and the driver needs work)
     - GPU
     - Bluetooth
     - Wi-Fi
    
    The rmtfs region is allocated using UIO, making it technically "dynamic."
    
    Its address and size can be read from sysfs:
    
    $ cat /sys/class/uio/uio0/name
    /sys/class/uio/uio0/maps/map0/addr
    0x00000000f2701000
    
    $ cat /sys/class/uio/uio0/maps/map0/size
    0x0000000000200000
    
    Like the OnePlus 6, the Pixel 3 requires 1 kB of reserved memory on either
    side of the rmtfs region to work around an XPU bug that would otherwise
    cause erroneous violations when accessing the rmtfs_mem region.
    
    Co-developed-by: Amit Pundir 
    Signed-off-by: Amit Pundir 
    Co-developed-by: Bjorn Andersson 
    Signed-off-by: Bjorn Andersson 
    Co-developed-by: Casey Connolly 
    Signed-off-by: Casey Connolly 
    Co-developed-by: Joel Selvaraj 
    Signed-off-by: Joel Selvaraj 
    Co-developed-by: Sumit Semwal 
    Signed-off-by: Sumit Semwal 
    Co-developed-by: Vinod Koul 
    Signed-off-by: Vinod Koul 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: David Heidelberg 
    Link: https://lore.kernel.org/r/20251214-pixel-3-v7-8-b1c0cf6f224d@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 3845bc888660a238920fdba2f85fe284f01fb95f
Author: David Heidelberg 
Date:   Sun Dec 14 15:51:17 2025 +0100

    dt-bindings: arm: qcom: Add Pixel 3 and 3 XL
    
    Document the bindings for the Pixel 3 and 3 XL.
    
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: David Heidelberg 
    Link: https://lore.kernel.org/r/20251214-pixel-3-v7-1-b1c0cf6f224d@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 95c121244a5d46435559bc74dbc7b5519394db08
Author: Dmitry Baryshkov 
Date:   Sat Dec 13 11:28:01 2025 +0200

    arm64: dts: qcom: sm8250-hdk: specify ZAP firmware name
    
    The DT file has GPU node enabled, but doesn't specify the file name of
    the ZAP firmware, which means using a default file name. Specify the
    name to the ZAP shader firmware, pointing to the file in the
    linux-firmware repo.
    
    Fixes: 04a3605b184e ("arm64: dts: qcom: add sm8250 GPU nodes")
    Signed-off-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251213-zap-names-v1-2-c889af173911@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit d43019ef200d567454a8f68e60a5b2df01d8c706
Author: Dmitry Baryshkov 
Date:   Sat Dec 13 11:28:00 2025 +0200

    arm64: dts: qcom: sm8150-hdk,mtp: specify ZAP firmware name
    
    The DT file has GPU node enabled, but doesn't specify the file name of
    the ZAP firmware, which means using a default file name. Specify the
    name to the ZAP shader firmware, pointing to the file in the
    linux-firmware repo.
    
    Fixes: f30ac26def18 ("arm64: dts: qcom: add sm8150 GPU nodes")
    Signed-off-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251213-zap-names-v1-1-c889af173911@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e814796dfcae8905682ac3ac2dd57f512a9f6726
Author: Dmitry Baryshkov 
Date:   Thu Dec 11 03:27:45 2025 +0200

    arm64: dts: qcom: sdm630: fix gpu_speed_bin size
    
    Historically sdm630.dtsi has used 1 byte length for the gpu_speed_bin
    cell, although it spans two bytes (offset 5, size 7 bits). It was being
    accepted by the kernel because before the commit 7a06ef751077 ("nvmem:
    core: fix bit offsets of more than one byte") the kernel didn't have
    length check. After this commit nvmem core rejects QFPROM on sdm630 /
    sdm660, making GPU and USB unusable on those platforms.
    
    Set the size of the gpu_speed_bin cell to 2 bytes, fixing the parsing
    error. While we are at it, update the length to 8 bits as pointed out by
    Alexey Minnekhanov.
    
    Fixes: b190fb010664 ("arm64: dts: qcom: sdm630: Add sdm630 dts file")
    Signed-off-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Alexey Minnekhanov 
    Link: https://lore.kernel.org/r/20251211-sdm630-fix-gpu-v2-1-92f0e736dba0@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 31deed7b05079b2eb24589d37778466a2a55f4f2
Author: Dylan Van Assche 
Date:   Mon Nov 10 16:37:48 2025 +0100

    arm64: dts: qcom: sdm845-shift-axolotl: Add ath10k calibration variant
    
    SDM845-based SHIFTPHONES SHIFT6mq has its own calibration files
    for the WCN3990 WiFi/Bluetooth radio with the ath10k driver.
    Add the calibration variant name to the DTS to reflect this to
    allow using the calibration files from linux-firmware.
    
    [David] Adjust the compatible as ath10k-calibration-variant is deprecated
    
    Signed-off-by: Dylan Van Assche 
    Signed-off-by: David Heidelberg 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251110-sdm845-calibration-variants-v1-3-2c536ada77c2@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit ea6926f61a857531d02a72bb5b040e23573fb393
Author: Dylan Van Assche 
Date:   Mon Nov 10 16:37:47 2025 +0100

    arm64: dts: qcom: sdm845-xiaomi-beryllium: Add ath10k calibration variant
    
    SDM845-based Xiaomi POCOPHONE F1 has its own calibration files
    for the WCN3990 WiFi/Bluetooth radio with the ath10k driver.
    Add the calibration variant name to the DTS to reflect this to
    allow using the calibration files from linux-firmware.
    
    [David] Adjust the compatible as ath10k-calibration-variant is deprecated
    
    Signed-off-by: Dylan Van Assche 
    Signed-off-by: David Heidelberg 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251110-sdm845-calibration-variants-v1-2-2c536ada77c2@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 252f98ecb3c71acd818592443496252ecd5ccd6f
Author: Dylan Van Assche 
Date:   Mon Nov 10 16:37:46 2025 +0100

    arm64: dts: qcom: sdm845-oneplus: add ath10k calibration variant
    
    SDM845-based Oneplus 6 and 6T have their own calibration files
    for the WCN3990 WiFi/Bluetooth radio with the ath10k driver.
    Add the calibration variant name to the DTS to reflect this to
    allow using the calibration files from linux-firmware.
    
    [David] Adjust the compatible as ath10k-calibration-variant is deprecated
    
    Signed-off-by: Dylan Van Assche 
    Signed-off-by: David Heidelberg 
    Link: https://lore.kernel.org/r/20251110-sdm845-calibration-variants-v1-1-2c536ada77c2@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 7a53133ac4b5b26924146bc1b044594894ccc400
Author: Luca Weiss 
Date:   Wed Dec 10 10:05:30 2025 +0900

    arm64: dts: qcom: sm7225-fairphone-fp4: Enable CCI pull-up
    
    Enable vreg_l6p, which is the voltage source for the pull-up resistor of
    the CCI busses.
    
    This ensures that I2C communication works as expected.
    
    Signed-off-by: Luca Weiss 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251210-fp4-cam-prep-v1-4-0eacbff271ec@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit e1d3aeff520638d9d286f66e734c2cc8b489d5ee
Author: Luca Weiss 
Date:   Wed Dec 10 10:05:29 2025 +0900

    arm64: dts: qcom: sm7225-fairphone-fp4: Add camera fixed regulators
    
    Add multiple fixed regulators that are found on the phone, which provide
    power to the cameras.
    
    Signed-off-by: Luca Weiss 
    Reviewed-by: Bryan O'Donoghue 
    Link: https://lore.kernel.org/r/20251210-fp4-cam-prep-v1-3-0eacbff271ec@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit 89bce44320b4c39f3ea48591f7c04c961e404eae
Author: Luca Weiss 
Date:   Wed Dec 10 10:05:28 2025 +0900

    arm64: dts: qcom: sm7225-fairphone-fp4: Add camera EEPROMs
    
    Add notes for the EEPROMs found on the main rear camera, ultra-wide rear
    camera and front camera. Also add some comments that act as placeholders
    for other nodes that will be added in the future, for the camera sensors
    and some VCM drivers.
    
    Signed-off-by: Luca Weiss 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251210-fp4-cam-prep-v1-2-0eacbff271ec@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit 1e07ebe744fb522983bd52a4a6148601675330c7
Author: Haotian Zhang 
Date:   Wed Dec 17 12:13:38 2025 +0800

    clk: qcom: Return correct error code in qcom_cc_probe_by_index()
    
    When devm_platform_ioremap_resource() fails, it returns various
    error codes. Returning a hardcoded -ENOMEM masks the actual
    failure reason.
    
    Use PTR_ERR() to propagate the actual error code returned by
    devm_platform_ioremap_resource() instead of -ENOMEM.
    
    Fixes: 75e0a1e30191 ("clk: qcom: define probe by index API as common API")
    Signed-off-by: Haotian Zhang 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251217041338.2432-1-vulab@iscas.ac.cn
    Signed-off-by: Bjorn Andersson 

commit deed369e067b8406714154a6678a3e3d9b1c1131
Author: Jagadeesh Kona 
Date:   Thu Dec 11 00:32:24 2025 +0530

    arm64: dts: qcom: SM8750: Enable CPUFreq support
    
    Add the cpucp mailbox, sram and SCMI nodes required to enable
    the CPUFreq support using the SCMI perf protocol on SM8750 SoCs.
    
    Signed-off-by: Jagadeesh Kona 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Sibi Sankar 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251211-sm8750-cpufreq-v1-2-394609e8d624@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 65ce09d2f164a3d91b5802ecd0783aa2c9a208c0
Author: Jagadeesh Kona 
Date:   Thu Dec 11 00:32:23 2025 +0530

    dt-bindings: mailbox: qcom: Document SM8750 CPUCP mailbox controller
    
    Document CPU Control Processor (CPUCP) mailbox controller for Qualcomm
    SM8750 SoCs. It is software compatible with X1E80100 CPUCP mailbox
    controller hence fallback to it.
    
    Signed-off-by: Jagadeesh Kona 
    Acked-by: Rob Herring (Arm) 
    Link: https://lore.kernel.org/r/20251211-sm8750-cpufreq-v1-1-394609e8d624@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 366f05e348b2ba454869ba7148ace6f25f229540
Author: Unnathi Chalicheemala 
Date:   Wed Dec 17 20:04:21 2025 +0530

    firmware: qcom_scm: Use TASK_IDLE state in wait_for_wq_completion()
    
    When the kernel issues an SMC (Secure Monitor Call) and the firmware
    requests the kernel to wait, the waiting thread enters an
    uninterruptible (D) state. In case of an extended wait request by the
    firmware, any device suspend request, cannot proceed because of the
    thread stuck in D state. This blocks the device suspend.
    
    Replace wait_for_completion() with wait_for_completion_state(...,
    TASK_IDLE), so that the waiting thread, show up in TASK_IDLE state,
    instead of TASK_UNINTERRUPTIBLE (D state). This allows the thread to
    block until completion, without blocking the device suspend.
    
    Reviewed-by: Mukesh Ojha 
    Reviewed-by: Bartosz Golaszewski 
    Signed-off-by: Unnathi Chalicheemala 
    Signed-off-by: Shivendra Pratap 
    Reviewed-by: Bartosz Golaszewski 
    Link: https://lore.kernel.org/r/20251217-multi_waitq_scm-v11-3-f21e50e792b8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit ccd207ec848e768da41465352a0f52081eec6bb1
Author: Unnathi Chalicheemala 
Date:   Wed Dec 17 20:04:20 2025 +0530

    firmware: qcom_scm: Support multiple waitq contexts
    
    Currently, only a single waitqueue context exists in the driver.
    Multi-waitqueue mechanism is added in firmware to support the case,
    when multiple VMs make SMC calls or single VM making multiple calls on
    same CPU. Enhance the driver to support multiple waitqueue when
    support is present in the firmware.
    
    When VMs make a SMC call, firmware allocates a waitqueue context,
    assuming the SMC call to be a blocking call. The SMC calls that cannot
    acquire resources, while execution in firmware, are returned to sleep
    in the calling VM. When the resource becomes available in the
    firmware, the VM gets notified to wake the sleeping thread and resume
    SMC call. The current qcom_scm driver supports single waitqueue as the
    old firmwares support only single waitqueue with waitqueue id zero.
    Multi-waitqueue mechanism is added in firmware starting SM8650 to
    support the case when multiple VMs make SMC calls or single VM making
    multiple calls on same CPU. To enable this support in qcom_scm driver,
    add support for handling multiple waitqueues. For instance, SM8650
    firmware can allocate two such waitq contexts, so the driver needs to
    implement two waitqueue contexts. For a generalized approach, the
    number of supported waitqueues can be queried from the firmware using
    a SMC call.
    
    Introduce qcom_scm_query_waitq_count to get the number of waitqueue
    contexts supported by the firmware and allocate “N” unique waitqueue
    contexts with a dynamic sized array where each unique wq_ctx is
    associated with a struct completion variable for easy lookup. Older
    targets which support only a single waitqueue, may return an error for
    qcom_scm_query_waitq_count, set the wq_cnt to one for such failures.
    
    Reviewed-by: Bartosz Golaszewski 
    Signed-off-by: Unnathi Chalicheemala 
    Signed-off-by: Shivendra Pratap 
    Reviewed-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20251217-multi_waitq_scm-v11-2-f21e50e792b8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit da9e6b1a96b1eef47542ec46b67e3f4f883fed3b
Author: Unnathi Chalicheemala 
Date:   Wed Dec 17 20:04:19 2025 +0530

    firmware: qcom_scm: Add API to get waitqueue IRQ info
    
    Bootloader and firmware for SM8650 and older chipsets expect node
    name as "qcom_scm", in order to patch the wait queue IRQ information.
    However, DeviceTree uses node name "scm" and this mismatch prevents
    firmware from correctly identifying waitqueue IRQ information. Waitqueue
    IRQ is used for signaling between secure and non-secure worlds.
    
    To resolve this, introduce qcom_scm_get_waitq_irq() that'll get the
    hardware IRQ number to be used from firmware instead of relying on data
    provided by devicetree, thereby bypassing the DeviceTree node name
    mismatch.
    
    This hardware IRQ number is converted to a Linux IRQ number using newly
    qcom_scm_fill_irq_fwspec_params(). This Linux IRQ number is then
    supplied to the threaded_irq call.
    
    Reviewed-by: Bartosz Golaszewski 
    Signed-off-by: Unnathi Chalicheemala 
    Signed-off-by: Shivendra Pratap 
    Reviewed-by: Mukesh Ojha 
    Link: https://lore.kernel.org/r/20251217-multi_waitq_scm-v11-1-f21e50e792b8@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 931b763e63b317d65f2555ea396f39bacba35b7d
Author: Erikas Bitovtas 
Date:   Mon Dec 8 16:59:21 2025 +0200

    arm64: dts: qcom: msm8939-asus-z00t: add hall sensor
    
    This device uses ANPEC APX9131 hall sensor. It is a basic GPIO hall
    sensor for which a generic "gpio-keys" device tree node configuration
    suffices.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Erikas Bitovtas 
    Link: https://lore.kernel.org/r/20251208-b4-battery-hall-v3-2-84e2157705a4@gmail.com
    Signed-off-by: Bjorn Andersson 

commit 094a6bbe84d43f04485d565f8174af66d90eb6a7
Author: Erikas Bitovtas 
Date:   Mon Dec 8 16:59:20 2025 +0200

    arm64: dts: qcom: msm8939-asus-z00t: add battery
    
    This device tracks remaining battery capacity percentage using voltage
    mode BMS. This commit enables the pm8916_bms node and adds a battery
    node to track its capacity. Battery properties were taken from the
    information printed on the battery itself and downstream device tree
    for a battery named "nvt+atl_3000mah" [1]
    
    [1] https://github.com/Asus-MSM8916/android_kernel_asus_msm8916/blob/10.x/arch/arm/boot/dts/qcom/ASUS_ZE550KL_1936167_3000mAh_3p4COV_VBMS_Final.dtsi
    
    Signed-off-by: Erikas Bitovtas 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251208-b4-battery-hall-v3-1-84e2157705a4@gmail.com
    Signed-off-by: Bjorn Andersson 

commit 94d5285f2fe5a3e2e9b8de88b73711a1173c4159
Author: Luca Weiss 
Date:   Fri Dec 19 12:39:03 2025 +0100

    arm64: defconfig: Enable options for Qualcomm Milos SoC
    
    Enable the pinctrl, clock and interconnect drivers for the Qualcomm
    Milos SoC. This is required for booting The Fairphone (Gen. 6).
    
    Signed-off-by: Luca Weiss 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251219-milos-defconfig-v1-1-f58012ac8ef6@fairphone.com
    Signed-off-by: Bjorn Andersson 

commit ba439ad9134c8b9ce033056c059cd161d30afec7
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 13:00:53 2025 +0100

    arm64: dts: qcom: x1e78100-t14s: Add audio playback over DisplayPort
    
    Add necessary DAI links and DAI name prefixes to enable audio playback
    over USB/DisplayPort and HDMI.  The HDMI port is not yet enabled, but it
    should carry respective DAI name prefix regardless.
    
    Reviewed-by: Abel Vesa 
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251217120051.98198-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit d12cd85a4ff494bb73e2e8f8af7ed66851241941
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 13:00:52 2025 +0100

    arm64: dts: qcom: hamoa: Add sound DAI prefixes for DP
    
    Sound DAI devices exposing same set of mixers, e.g. each DisplayPort
    controller, need to add dedicated prefix for these mixers to avoid
    conflicts and to allow ALSA to properly configure given instance.
    
    Suggested-by: Konrad Dybcio 
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251217120051.98198-3-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit b7415c490d8d75b8dc7500b9c02cf8e5852110e6
Author: Maud Spierings 
Date:   Sat Dec 20 12:38:59 2025 +0100

    arm64: dts: qcom: x1e80100-vivobook-s15: enable IRIS
    
    Enable IRIS to allow using the hardware-accelerated video codecs. The
    firmware is not upstream in linux-firmware yet, so users need to copy it
    from Windows to qcom/x1e80100/ASUSTeK/vivobook-s15/qcvss8380.mbn (just like
    GPU/ADSP/CDSP firmware).
    
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Maud Spierings 
    Link: https://lore.kernel.org/r/20251220-asus_usbc_dp-v3-3-5e244d420d0f@hotmail.com
    Signed-off-by: Bjorn Andersson 

commit 34d76723c41018ef52480ca3849b3ed3afbd8b22
Author: Maud Spierings 
Date:   Sat Dec 20 12:38:58 2025 +0100

    arm64: dts: qcom: x1e80100-vivobook-s15: add HDMI port
    
    Enable the HDMI port on left side of the laptop.
    
    The display signal is routed through a simple Displayport to HDMI
    bridge.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Maud Spierings 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251220-asus_usbc_dp-v3-2-5e244d420d0f@hotmail.com
    Signed-off-by: Bjorn Andersson 

commit c0d377798d6f6d3efddee5ef7d96b608a071f833
Author: Maud Spierings 
Date:   Sat Dec 20 12:38:57 2025 +0100

    arm64: dts: qcom: x1e80100-vivobook-s15: enable ps8830 retimers
    
    The Asus vivobook s15 has two usb type c ports on the left side, these
    use parade ps8830 retimers like the others, enable them to also enable
    dp altmode
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Maud Spierings 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251220-asus_usbc_dp-v3-1-5e244d420d0f@hotmail.com
    Signed-off-by: Bjorn Andersson 

commit 9494917da576038d754fbecd15b1f1bcd7b2e0ea
Author: Vladimir Zapolskiy 
Date:   Mon Dec 22 04:38:34 2025 +0200

    arm64: dts: qcom: sm8550-hdk-rear-camera-card: remove optional property
    
    Samsung S5K3M5 image sensor supports only 4-lane MIPI CSI-2 interface,
    which makes the sensor data-lanes property redundant, and it can be
    safely removed from the board dts file. Noteworthy that the property
    value is incorrect, because conventionally lanes enumeration of image
    sensors starts from index 1.
    
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20251222023834.3284370-5-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit 4438d377f6d8bcaefe645dd436ab8f8617d815ec
Author: Vladimir Zapolskiy 
Date:   Mon Dec 22 04:38:33 2025 +0200

    arm64: dts: qcom: sm8550-hdk-rear-camera-card: rename supply properties
    
    At first voltage supply properties of Samsung S5K3M5 image sensor got
    names following a pad name convention for Omnivision image sensors. Now
    the property names were corrected in the sensor dt bindings documentation,
    and it should be updated in the SM8550-HDK with the Rear Camera Card
    board dts file.
    
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20251222023834.3284370-4-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit 8cadf9f0bbfcccc639b412b21d347108eddbb58d
Author: Vladimir Zapolskiy 
Date:   Mon Dec 22 04:38:32 2025 +0200

    arm64: dts: qcom: sm8550-qrd: remove data-lanes property of image sensor
    
    Samsung S5K3M5 image sensor supports only 4-lane MIPI CSI-2 interface,
    which makes the sensor data-lanes property redundant, and it can be
    safely removed from the board dts file. Noteworthy that the property
    value is incorrect, because conventionally lanes enumeration of image
    sensors starts from index 1.
    
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20251222023834.3284370-3-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit ff7cb4613b490cce4e213961b91f28b744d82ee1
Author: Vladimir Zapolskiy 
Date:   Mon Dec 22 04:38:31 2025 +0200

    arm64: dts: qcom: sm8550-qrd: rename image sensor supply properties
    
    At first voltage supply properties of Samsung S5K3M5 image sensor got
    names following a pad name convention for Omnivision image sensors. Now
    the property names were corrected in the sensor dt bindings documentation,
    and it should be updated in the SM8550-QRD board dts file.
    
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20251222023834.3284370-2-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit be4a8c25ae3a367eab0ae91ded89a96ae9627b72
Author: Yongxing Mou 
Date:   Mon Nov 17 14:49:33 2025 +0800

    arm64: dts: qcom: qcs8300-ride: Enable Display Port
    
    Enable DPTX0 along with their corresponding PHYs for
    qcs8300-ride platform.
    
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Yongxing Mou 
    Link: https://lore.kernel.org/r/20251117-dts_qcs8300-v7-2-bf42d39e7828@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 6710f10459c159da45e227f50b8db9c33ee906b2
Author: Yongxing Mou 
Date:   Mon Nov 17 14:49:32 2025 +0800

    arm64: dts: qcom: qcs8300: add display dt nodes for MDSS, DPU, DisplayPort and eDP PHY
    
    Add devicetree changes to enable MDSS display-subsystem,
    display-controller(DPU), DisplayPort controller and eDP PHY for
    Qualcomm QCS8300 platform.
    
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Yongxing Mou 
    Link: https://lore.kernel.org/r/20251117-dts_qcs8300-v7-1-bf42d39e7828@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 4df4b572802cac0b0d46ef15379d7319366f3038
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:26:02 2025 +0100

    arm64: dts: qcom: Use lowercase hex
    
    The DTS code coding style expects lowercase hex for values and unit
    addresses.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251223152559.155703-6-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 3d9bebf804b72841c838ca77cf5b783a89b68e85
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:26:01 2025 +0100

    arm64: dts: qcom: Use hyphen in node names
    
    DTS coding style prefers hyphens instead of underscores in the node
    names.  Change should be safe, because node names are not considered an
    ABI.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251223152559.155703-5-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 70101cb09c205e260df918ef367d9fe5098c464f
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:26:00 2025 +0100

    arm64: dts: qcom: Minor whitespace cleanup
    
    The DTS code coding style expects exactly one space around '=' and
    before '{' characters.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251223152559.155703-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 380f8a4c734b029100dea5bc9e2f8982f72da6b9
Author: Dale Whinham 
Date:   Sat Dec 20 16:26:30 2025 +0100

    firmware: qcom: scm: allow QSEECOM on Surface Pro 11
    
    Enables access to EFI variables on this machine.
    
    Signed-off-by: Dale Whinham 
    Signed-off-by: Jérôme de Bretagne 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251220-surface-sp11-for-next-v6-2-81f7451edb77@gmail.com
    Signed-off-by: Bjorn Andersson 

commit 0d72ccaa1e840b4c8723a929b2febbedcf5f80cd
Author: Dale Whinham 
Date:   Sat Dec 20 16:26:32 2025 +0100

    arm64: dts: qcom: Add support for X1-based Surface Pro 11
    
    Add device trees for the Qualcomm X1E and X1P-based Microsoft Surface
    Pro 11 machines (codenamed 'Denali').
    
    This device is very similar to the Surface Laptop 7 ('Romulus').
    
    Use a similar strategy to x1-asus-zenbook-a14.dtsi so that we can create
    x1e and x1p-specific flavors of the device tree without too much code
    duplication.
    
    Hardware support is similar to other X1 machines. The most notable
    missing features are:
    
    - Touchscreen and pen
    - Cameras (and status LEDs)
    
    Signed-off-by: Dale Whinham 
    Signed-off-by: Jérôme de Bretagne 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Abel Vesa 
    Link: https://lore.kernel.org/r/20251220-surface-sp11-for-next-v6-4-81f7451edb77@gmail.com
    Signed-off-by: Bjorn Andersson 

commit 8325294ca9688398ea55843f03ebd1479b9d2334
Author: Jérôme de Bretagne 
Date:   Sat Dec 20 16:26:29 2025 +0100

    dt-bindings: arm: qcom: Document Microsoft Surface Pro 11
    
    Add the compatibles for the Qualcomm-based Microsoft Surface Pro 11,
    using its Denali codename.
    
    The LCD models are using the Qualcomm Snapdragon X1 Plus (X1P64100),
    the OLED ones are using the Qualcomm Snapdragon X1 Elite (X1E80100).
    
    Due to the difference in how the built-in panel is being handled
    between the OLED variant and LCD one, it is required to have two
    separate DTBs, so document the compatible string for both variants.
    
    Signed-off-by: Jérôme de Bretagne 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251220-surface-sp11-for-next-v6-1-81f7451edb77@gmail.com
    Signed-off-by: Bjorn Andersson 

commit 44d1c77a8af492f00d4c36c3641d6386bdc182eb
Author: Krishna Kurapati 
Date:   Fri Dec 19 21:44:07 2025 +0530

    arm64: dts: qcom: hamoa-iot-evk: Add vbus regulator support for Type-A ports
    
    The Multiport controller on Hamoa EVK platform is connected to Two Type-A
    ports. VBUS for each of these ports are provided by a TPS2559QWDRCTQ1
    regulator, controlled from PMIC GPIOs.
    
    Add the necessary regulators and GPIO configuration to power these.
    
    Implement connector nodes to embed the vbus supply within them. Since
    there is no entity currently that can read vbus supply from a Type-A
    connector and control it, mark the supplies as always on.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Krishna Kurapati 
    Reviewed-by: Abel Vesa 
    Link: https://lore.kernel.org/r/20251219161407.2075701-1-krishna.kurapati@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 86057e01967b8eeb8604904322003de044528e7a
Author: David Heidelberg 
Date:   Mon Dec 22 20:05:40 2025 +0100

    arm64: dts: qcom: sdm845-xiaomi-polaris: Update firmware paths
    
    Conform to the new firmware path scheme.
    Includes cosmetic cleanups.
    
    Signed-off-by: David Heidelberg 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251222-oneplus6-new-fw-path-v1-4-a2d366f9eb89@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 7e46a9c78880f4a7589bb31f8887ea3edb0596b4
Author: David Heidelberg 
Date:   Mon Dec 22 20:05:39 2025 +0100

    arm64: dts: qcom: sdm845-samsung-starqltechn: Update firmware paths
    
    Conform to the new firmware path scheme.
    Includes cosmetic cleanups.
    
    Signed-off-by: David Heidelberg 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251222-oneplus6-new-fw-path-v1-3-a2d366f9eb89@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 5eac5422c0c0a8a14800405b658e99beaacf90de
Author: David Heidelberg 
Date:   Mon Dec 22 20:05:38 2025 +0100

    arm64: dts: qcom: sdm845-axolotl: Update firmware paths
    
    Conform to the new firmware path scheme.
    Includes cosmetic cleanups.
    
    Signed-off-by: David Heidelberg 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251222-oneplus6-new-fw-path-v1-2-a2d366f9eb89@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 29e87dc07d705bd92d57fff77703ca272779e6a0
Author: David Heidelberg 
Date:   Mon Dec 22 20:05:37 2025 +0100

    arm64: dts: qcom: sdm845-oneplus: Update firmware paths
    
    Conform to the new firmware path scheme.
    Includes cosmetic cleanups.
    
    Signed-off-by: David Heidelberg 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251222-oneplus6-new-fw-path-v1-1-a2d366f9eb89@ixit.cz
    Signed-off-by: Bjorn Andersson 

commit 332c03279bc81a1a88d8dc5dd23f3c956d99d882
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 14:05:34 2025 +0100

    dt-bindings: remoteproc: qcom,sm8550-pas: Drop SM8750 ADSP from if-branch
    
    The binding for SM8750 ADSP PAS uses SM8550 ADSP as fallback, thus
    "if:then:" block with "contains:" and the fallback does not need to
    mention qcom,sm8750-adsp-pas.
    
    Signed-off-by: Krzysztof Kozlowski 
    Acked-by: Rob Herring (Arm) 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251223130533.58468-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 247b55ddf76ee65b1a63e5c834341a07996de07d
Author: Akhil P Oommen 
Date:   Tue Dec 30 18:03:28 2025 +0530

    arm64: dts: qcom: lemans-ride: Enable Adreno 663 GPU
    
    Enable GPU on both qcs9100-ride platforms and provide the path
    for zap shader.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Akhil P Oommen 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251230-a663-gpu-support-v9-4-186722e25387@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit dbff283922e32eaa3d81233b69c02ef2abe7ee9b
Author: Akhil P Oommen 
Date:   Tue Dec 30 18:03:27 2025 +0530

    arm64: dts: qcom: lemans-evk: Enable Adreno 663 GPU
    
    Enable GPU for lemans-evk platform and provide path for zap
    shader.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Akhil P Oommen 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251230-a663-gpu-support-v9-3-186722e25387@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 4a6488a8070b95702d6f5dec444fbddfaaaff8cf
Author: Gaurav Kohli 
Date:   Tue Dec 30 18:03:26 2025 +0530

    arm64: dts: qcom: lemans: Add GPU cooling
    
    Unlike the CPU, the GPU does not throttle its speed automatically when it
    reaches high temperatures.
    
    Set up GPU cooling by throttling the GPU speed
    when reaching 105°C.
    
    Signed-off-by: Gaurav Kohli 
    Signed-off-by: Akhil P Oommen 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251230-a663-gpu-support-v9-2-186722e25387@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 6940c66825e4c27c53b33e367806ac1dc922583d
Author: Puranam V G Tejaswi 
Date:   Tue Dec 30 18:03:25 2025 +0530

    arm64: dts: qcom: lemans: Add gpu and gmu nodes
    
    Add gpu and gmu nodes for Lemans chipset. Also, add the speedbin
    qfprom node and wire it up with GPU node.
    
    Signed-off-by: Puranam V G Tejaswi 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Akhil P Oommen 
    Link: https://lore.kernel.org/r/20251230-a663-gpu-support-v9-1-186722e25387@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 2cb0c97ce4392d1b76c178bf7c6613b4e89a4b19
Author: Krzysztof Kozlowski 
Date:   Mon Dec 29 16:26:59 2025 +0100

    dt-bindings: remoteproc: qcom,adsp: Allow cx-supply on qcom,sdm845-slpi-pas
    
    One SDM845 board uses cx-supply, which is not allowed by the bindings,
    as reported by dtbs_check:
    
      sdm845-samsung-starqltechn.dtb: remoteproc@5c00000 (qcom,sdm845-slpi-pas): Unevaluated properties are not allowed ('cx-supply' was unexpected)
    
    The SDM845 SLPI binding already allows lcx and lmx domains, thus the
    cx-supply seems like a fake name for something else, e.g. some
    enable pin.  The qcom_q6v5_pas.c driver parses cx-supply, so it is an
    established ABI, therefore document it for this device only.
    
    Signed-off-by: Krzysztof Kozlowski 
    Acked-by: Rob Herring (Arm) 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251229152658.284199-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 1c20a021de58a23bdc264b91d75e944d19e49ba2
Author: Vladimir Zapolskiy 
Date:   Thu Dec 4 06:15:05 2025 +0200

    arm64: dts: qcom: sm8650-hdk: Add support for the Rear Camera Card overlay
    
    To provide access to camera sensors a Rear Camera Card can be connected
    to SM8650-HDK board, the camera sensors are:
    * Samsung S5K33D ToF camera sensor, connected to CSI0 over MIPI D-PHY,
    * Sony IMX766 Wide camera sensor, connected to CSI1 over MIPI C-PHY,
    * Omnivision OV64B Ultrawide camera sensor, connected to CSI2 over MIPI C-PHY,
    * Samsung S5KJN1 Tele camera sensor, connected to CSI3 over MIPI D-PHY).
    
    Get the initial support of Samsung S5KJN1 camera sensor and two flash leds
    on the Rear Camera Card board by adding a board overlay.
    
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://lore.kernel.org/r/20251204041505.131891-5-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit 328407ba89ae6656c143967ba65465c50150aaf8
Author: Vladimir Zapolskiy 
Date:   Thu Dec 4 06:15:04 2025 +0200

    arm64: dts: qcom: sm8650-qrd: Enable CAMSS and Samsung S5KJN1 camera sensor
    
    Add support of Samsung S5KJN1 camera sensor connected to CSIPHY3 over
    MIPI D-PHY interface.
    
    Tested-by: Neil Armstrong  # on SM8650-QRD
    Signed-off-by: Vladimir Zapolskiy 
    Reviewed-by: Bryan O'Donoghue 
    Link: https://lore.kernel.org/r/20251204041505.131891-4-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit 0ddb0d63453f320806727604702b6f6636a645c3
Author: Vladimir Zapolskiy 
Date:   Thu Dec 4 06:15:03 2025 +0200

    arm64: dts: qcom: sm8650: Add description of MCLK pins
    
    Add fixed MCLK pin descriptions for all pins with such supported
    function.
    
    Reviewed-by: Bryan O'Donoghue 
    Tested-by: Neil Armstrong  # on SM8650-QRD
    Signed-off-by: Vladimir Zapolskiy 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251204041505.131891-3-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit e8560ac937d92e16e636bbaf387f638b3198fa9c
Author: Vladimir Zapolskiy 
Date:   Thu Dec 4 06:15:02 2025 +0200

    arm64: dts: qcom: sm8650: Add CAMSS device tree node
    
    Add Qualcomm SM8650 CAMSS device tree node to the platform dtsi file,
    the SM8650 CAMSS IP contains
    * 6 x CSIPHY,
    * 3 x CSID, 2 x CSID Lite,
    * 3 x IFE, 2 x IFE Lite.
    
    Tested-by: Neil Armstrong  # on SM8650-QRD
    Signed-off-by: Vladimir Zapolskiy 
    Reviewed-by: Bryan O'Donoghue 
    Link: https://lore.kernel.org/r/20251204041505.131891-2-vladimir.zapolskiy@linaro.org
    Signed-off-by: Bjorn Andersson 

commit eb1bcc1d3b4b6c7f7dddbe62ac229e4e3d8d5f8d
Author: Gaurav Kohli 
Date:   Fri Aug 22 09:53:16 2025 +0530

    arm64: dts: qcom: qcs8300: Enable TSENS support for QCS8300 SoC
    
    Add TSENS and thermal devicetree node for QCS8300 SoC.
    
    Signed-off-by: Gaurav Kohli 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20250822042316.1762153-3-quic_gkohli@quicinc.com
    Signed-off-by: Bjorn Andersson 

commit 67ce203eee94946768397a6fa16c43ee5292f31a
Author: Jens Glathe 
Date:   Sat Jan 3 10:00:24 2026 +0100

    arm64: dts: qcom: x1p42100-lenovo-thinkbook-16: add hdmi bridge with enable pin
    
    Add TLMM 120 for hdmi bridge enable.
    In general this is the same setup as on the T14s. Since its using simple-bridge
    and also is Lenovo, we also use the same realtek,rtd2171 compatible.
    The real chip identity is not known yet. The bridge is wired with un-swapped
    lanes, though.
    
    Signed-off-by: Jens Glathe 
    Link: https://lore.kernel.org/r/20260103-tb16-hdmi-v2-2-92b0930fa82e@oldschoolsolutions.biz
    Signed-off-by: Bjorn Andersson 

commit 3802966a9c489708228b98b7265d8db87d8f6db3
Author: Jens Glathe 
Date:   Sat Jan 3 10:00:23 2026 +0100

    arm64: dts: qcom: x1p42100-lenovo-thinkbook-16: force usb2-only mode on usb_1_ss2_dwc3
    
    The usb_1_ss2 complex has 2 phys, usb_1_ss2_hsphy and usb_1_ss2_qmpphy. On this
    laptop, they are used for different peripherals: The hsphy for the fingerprint
    reader, the qmpphy to drive a hdmi bridge. The normal logical wiring for the dwc3
    controller is to both phys. Delete the port@1 to the qmpphy.
    
    Signed-off-by: Jens Glathe 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260103-tb16-hdmi-v2-1-92b0930fa82e@oldschoolsolutions.biz
    Signed-off-by: Bjorn Andersson 

commit 65b705cca009ffdf00ad7b649ac8a7e063373ddc
Author: Taniya Das 
Date:   Sat Jan 3 11:27:07 2026 +0530

    arm64: dts: qcom: hamoa: Extend the gcc input clock list
    
    The recent dt-bindings were updated for the missing RX/TX symbol clocks
    for UFS.
    
    Extend the existing list to make sure the DT contains the expected
    amount of 'clocks' entries.
    
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Abel Vesa 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20260103-ufs_symbol_clk-v2-3-51828cc76236@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 0ba9cc9f6ffefb28e55ba8ffe1caed968d863a38
Merge: 0e31dcfefd21ed 5fc25d64c43c1e
Author: Bjorn Andersson 
Date:   Sat Jan 3 08:41:23 2026 -0600

    Merge branch '20260103-ufs_symbol_clk-v2-1-51828cc76236@oss.qualcomm.com' into arm64-for-6.20
    
    Merge the addition of UFS PHY clocks to the Hamoa GCC binding through a
    topic branch, to avoid DeviceTree validation warnings, and later allow
    referencing the added clock constants.

commit bf94404bc7bf9904bfa9334d3115e95b764db12b
Author: Taniya Das 
Date:   Sat Jan 3 11:27:06 2026 +0530

    clk: qcom: gcc-x1e80100: Add missing UFS symbol mux clocks
    
    The UFS symbol RX/TX mux clocks were not defined previously.
    Add these mux clocks so that clock rate propagation reaches
    the muxes correctly.
    
    Fixes: 161b7c401f4b ("clk: qcom: Add Global Clock controller (GCC) driver for X1E80100")
    Reviewed-by: Abel Vesa 
    Signed-off-by: Taniya Das 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20260103-ufs_symbol_clk-v2-2-51828cc76236@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit fd5b470f87dcc9d7acb75f7f6d7ae657edb372ed
Merge: bb466f234f2cfe 5fc25d64c43c1e
Author: Bjorn Andersson 
Date:   Sat Jan 3 08:39:43 2026 -0600

    Merge branch '20260103-ufs_symbol_clk-v2-1-51828cc76236@oss.qualcomm.com' into clk-for-6.20
    
    Merge the addition of missing UFS PHY clocks in Hamoa GCC binding
    through topic branch, to allow it to be merged into DeviceTree branch as
    well.

commit 5fc25d64c43c1e25a1a0184a894ab0721c6a524b
Author: Taniya Das 
Date:   Sat Jan 3 11:27:05 2026 +0530

    dt-bindings: clock: qcom,x1e80100-gcc: Add missing UFS mux clocks
    
    Add some of the UFS symbol rx/tx muxes were not initially described.
    
    Signed-off-by: Taniya Das 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20260103-ufs_symbol_clk-v2-1-51828cc76236@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit a069190b590e108223cd841a1c2d0bfb92230ecc
Author: Puranjay Mohan 
Date:   Fri Jan 2 14:15:12 2026 -0800

    bpf: Replace __opt annotation with __nullable for kfuncs
    
    The __opt annotation was originally introduced specifically for
    buffer/size argument pairs in bpf_dynptr_slice() and
    bpf_dynptr_slice_rdwr(), allowing the buffer pointer to be NULL while
    still validating the size as a constant.  The __nullable annotation
    serves the same purpose but is more general and is already used
    throughout the BPF subsystem for raw tracepoints, struct_ops, and other
    kfuncs.
    
    This patch unifies the two annotations by replacing __opt with
    __nullable.  The key change is in the verifier's
    get_kfunc_ptr_arg_type() function, where mem/size pair detection is now
    performed before the nullable check.  This ensures that buffer/size
    pairs are correctly classified as KF_ARG_PTR_TO_MEM_SIZE even when the
    buffer is nullable, while adding an !arg_mem_size condition to the
    nullable check prevents interference with mem/size pair handling.
    
    When processing KF_ARG_PTR_TO_MEM_SIZE arguments, the verifier now uses
    is_kfunc_arg_nullable() instead of the removed is_kfunc_arg_optional()
    to determine whether to skip size validation for NULL buffers.
    
    This is the first documentation added for the __nullable annotation,
    which has been in use since it was introduced but was previously
    undocumented.
    
    No functional changes to verifier behavior - nullable buffer/size pairs
    continue to work exactly as before.
    
    Acked-by: Eduard Zingerman 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102221513.1961781-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 7694ff8f6ca7f7cdf2e5636ecbe6dacaeb71678d
Merge: e40030a46acc07 e66fe1bc6d25d6
Author: Alexei Starovoitov 
Date:   Fri Jan 2 14:31:59 2026 -0800

    Merge branch 'memcg-accounting-for-bpf-arena'
    
    Puranjay Mohan says:
    
    ====================
    memcg accounting for BPF arena
    
    v4: https://lore.kernel.org/all/20260102181333.3033679-1-puranjay@kernel.org/
    Changes in v4->v5:
    - Remove unused variables from bpf_map_alloc_pages() (CI)
    
    v3: https://lore.kernel.org/all/20260102151852.570285-1-puranjay@kernel.org/
    Changes in v3->v4:
    - Do memcg set/recover in arena_reserve_pages() rather than
      bpf_arena_reserve_pages() for symmetry with other kfuncs (Alexei)
    
    v2: https://lore.kernel.org/all/20251231141434.3416822-1-puranjay@kernel.org/
    Changes in v2->v3:
    - Remove memcg accounting from bpf_map_alloc_pages() as the caller does
      it already. (Alexei)
    - Do memcg set/recover in arena_alloc/free_pages() rather than
      bpf_arena_alloc/free_pages(), it reduces copy pasting in
      sleepable/non_sleepable functions.
    
    v1: https://lore.kernel.org/all/20251230153006.1347742-1-puranjay@kernel.org/
    Changes in v1->v2:
    - Return both pointers through arguments from bpf_map_memcg_enter and
      make it return void. (Alexei)
    - Add memcg accounting in arena_free_worker (AI)
    
    This set adds memcg accounting logic into arena kfuncs and other places
    that do allocations in arena.c.
    ====================
    
    Link: https://patch.msgid.link/20260102200230.25168-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit e66fe1bc6d25d6fbced99de6c377f1b3d961a80e
Author: Puranjay Mohan 
Date:   Fri Jan 2 12:02:28 2026 -0800

    bpf: arena: Reintroduce memcg accounting
    
    When arena allocations were converted from bpf_map_alloc_pages() to
    kmalloc_nolock() to support non-sleepable contexts, memcg accounting was
    inadvertently lost. This commit restores proper memory accounting for
    all arena-related allocations.
    
    All arena related allocations are accounted into memcg of the process
    that created bpf_arena.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102200230.25168-3-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 817593af7b9ba56c23d9dd1858232c5493a14f55
Author: Puranjay Mohan 
Date:   Fri Jan 2 12:02:27 2026 -0800

    bpf: syscall: Introduce memcg enter/exit helpers
    
    Introduce bpf_map_memcg_enter() and bpf_map_memcg_exit() helpers to
    reduce code duplication in memcg context management.
    
    bpf_map_memcg_enter() gets the memcg from the map, sets it as active,
    and returns both the previous and the now active memcg.
    
    bpf_map_memcg_exit() restores the previous active memcg and releases the
    reference obtained during enter.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102200230.25168-2-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit bb466f234f2cfeea1c65b2d777ed878ee783b3ba
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 12:22:59 2025 +0100

    clk: qcom: rpmh: Fix double array initializer on Kaanapali
    
    [RPMH_RF_CLK4] and [RPMH_RF_CLK5_A] elements in clk_hw array are already
    initialized, as reported by W=1 clang warning:
    
      clk-rpmh.c:932:20: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides]
      clk-rpmh.c:934:21: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides]
    
    Fixes: acabfd13859d ("clk: qcom: rpmh: Add support for Kaanapali rpmh clocks")
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251224112257.83874-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e77ff7d32b2029851a3567f1ccf7ab9db5cfa137
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 12:22:58 2025 +0100

    clk: qcom: gcc-kaanapali: Fix double array initializer
    
    [GCC_QMIP_VIDEO_VCODEC_AHB_CLK] element in clk_regmap array is already
    initialized, as reported by W=1 clang warning:
    
      gcc-kaanapali.c:3383:36: error: initializer overrides prior initialization of this subobject [-Werror,-Winitializer-overrides]
    
    Fixes: d1919c375f21 ("clk: qcom: Add support for Global clock controller on Kaanapali")
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251224112257.83874-3-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e40030a46acc07bb956068e59c614f1a17459a18
Merge: c286e7e9d1f1f3 cf503eb2c6c38b
Author: Alexei Starovoitov 
Date:   Fri Jan 2 12:04:29 2026 -0800

    Merge branch 'bpf-make-kf_trusted_args-default'
    
    Puranjay Mohan says:
    
    ====================
    bpf: Make KF_TRUSTED_ARGS default
    
    v2: https://lore.kernel.org/all/20251231171118.1174007-1-puranjay@kernel.org/
    Changes in v2->v3:
    - Fix documentation: add a new section for kfunc parameters (Eduard)
    - Remove all occurances of KF_TRUSTED from comments, etc. (Eduard)
    - Fix the netfilter kfuncs to drop dead NULL checks.
    - Fix selftest for netfilter kfuncs to check for verification failures
      and remove the runtime failure that are not possible after this
      changes
    
    v1: https://lore.kernel.org/all/20251224192448.3176531-1-puranjay@kernel.org/
    Changes in v1->v2:
    - Update kfunc_dynptr_param selftest to use a real pointer that is not
      ptr_to_stack and not CONST_PTR_TO_DYNPTR rather than casting 1
      (Alexei)
    - Thoroughly review all kfuncs in the to find regressions or missing
      annotations. (Eduard)
    - Fix kfuncs found from the above step.
    
    This series makes trusted arguments the default requirement for all BPF
    kfuncs, inverting the current opt-in model. Instead of requiring
    explicit KF_TRUSTED_ARGS flags, kfuncs now require trusted arguments by
    default and must explicitly opt-out using __nullable/__opt annotations
    or the KF_RCU flag.
    
    This improves security and type safety by preventing BPF programs from
    passing untrusted or NULL pointers to kernel functions at verification
    time, while maintaining flexibility for the small number of kfuncs that
    legitimately need to accept NULL or RCU pointers.
    
    MOTIVATION
    
    The current opt-in model is error-prone and inconsistent. Most kfuncs already
    require trusted pointers from sources like KF_ACQUIRE, struct_ops callbacks, or
    tracepoints. Making trusted arguments the default:
    
    - Prevents NULL pointer dereferences at verification time
    - Reduces defensive NULL checks in kernel code
    - Provides better error messages for invalid BPF programs
    - Aligns with existing patterns (context pointers, struct_ops already trusted)
    
    IMPACT ANALYSIS
    
    Comprehensive analysis of all 304+ kfuncs across 37 kernel files found:
    - Most kfuncs (299/304) are already safe and require no changes
    - Only 4 kfuncs required fixes (all included in this series)
    - 0 regressions found in independent verification
    
    All bpf selftests are passing. The hid_bpf tests are also passing:
    # PASSED: 20 / 20 tests passed.
    # Totals: pass:20 fail:0 xfail:0 xpass:0 skip:0 error:0
    
    bpf programs in drivers/hid/bpf/progs/ show no regression as shown by
    veristat:
    
    Done. Processed 24 files, 62 programs. Skipped 0 files, 0 programs.
    
    TECHNICAL DETAILS
    
    The verifier now validates kfunc arguments in this order:
    1. NULL check (runs first): Rejects NULL unless parameter has __nullable/__opt
    2. Trusted check: Rejects untrusted pointers unless kfunc has KF_RCU
    
    Special cases that bypass trusted checking:
    - Context pointers (xdp_md, __sk_buff): Handled via KF_ARG_PTR_TO_CTX
    - Struct_ops callbacks: Pre-marked as PTR_TRUSTED during initialization
    - KF_RCU kfuncs: Have separate validation path for RCU pointers
    
    BACKWARD COMPATIBILITY
    
    This affects BPF program verification, not runtime:
    - Valid programs passing trusted pointers: Continue to work
    - Programs with bugs: May now fail verification (preventing runtime crashes)
    
    This series introduces two intentional breaking changes to the BPF
    verifier's kfunc handling:
    
    1. NULL pointer rejection timing: Kfuncs that previously accepted NULL
    pointers without KF_TRUSTED_ARGS will now reject NULL at verification
    time instead of returning runtime errors. This affects netfilter
    connection tracking functions (bpf_xdp_ct_lookup, bpf_skb_ct_lookup,
    bpf_xdp_ct_alloc, bpf_skb_ct_alloc), which now enforce their documented
    "Cannot be NULL" requirements at load time rather than returning -EINVAL
    at runtime.
    
    2. Fentry/fexit program restrictions: BPF programs using fentry/fexit
    attachment points can no longer pass their callback arguments directly
    to kfuncs, as these arguments are not marked as trusted by default.
    Programs requiring trusted argument semantics should migrate to tp_btf
    (tracepoint with BTF) attachment points where arguments are guaranteed
    trusted by the verifier.
    
    Both changes strengthen the verifier's safety guarantees by catching
    errors earlier in the development cycle and are accompanied by
    comprehensive test updates demonstrating the new expected behaviors.
    ====================
    
    Link: https://patch.msgid.link/20260102180038.2708325-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit cf503eb2c6c38bf449063f33790a96218a067718
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:36 2026 -0800

    selftests: bpf: Fix test_bpf_nf for trusted args becoming default
    
    With trusted args now being the default, passing NULL to kfunc
    parameters that are pointers causes verifier rejection rather than a
    runtime error. The test_bpf_nf test was failing because it attempted to
    pass NULL to bpf_xdp_ct_lookup() to verify runtime error handling.
    
    Since the NULL check now happens at verification time, remove the
    runtime test case that passed NULL to the bpf_tuple parameter and
    instead add verification-time tests to ensure the verifier correctly
    rejects programs that pass NULL to trusted arguments.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-11-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit cf82580c86a91de2aa979260985cadcb39ed28d2
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:35 2026 -0800

    selftests: bpf: fix cgroup_hierarchical_stats
    
    The cgroup_hierarchical_stats selftests uses an fentry program attached
    to cgroup_attach_task and then passes the received &dst_cgrp->self to
    the css_rstat_updated() kfunc. The verifier now assumes that all kfuncs
    only takes trusted pointer arguments, and pointers received by fentry
    are not marked trustes by default.
    
    Use a tp_btf program in place for fentry for this test, pointers
    received by tp_btf programs are marked trusted by the verifier.
    
    Acked-by: Eduard Zingerman 
    Reviewed-by: Emil Tsalapatis 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-10-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 230b0118e416583a53fc0ad5d1fecb37f496fe34
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:34 2026 -0800

    selftests: bpf: fix test_kfunc_dynptr_param
    
    As verifier now assumes that all kfuncs only takes trusted pointer
    arguments, passing 0 (NULL) to a kfunc that doesn't mark the argument as
    __nullable or __opt will be rejected with a failure message of: Possibly
    NULL pointer passed to trusted arg
    
    Pass a non-null value to the kfunc to test the expected failure mode.
    
    Acked-by: Eduard Zingerman 
    Reviewed-by: Emil Tsalapatis 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-9-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 03cc77b10e009ce87f1a8e93454aadf2912a4c15
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:33 2026 -0800

    selftests: bpf: Update failure message for rbtree_fail
    
    The rbtree_api_use_unchecked_remove_retval() selftest passes a pointer
    received from bpf_rbtree_remove() to bpf_rbtree_add() without checking
    for NULL, this was earlier caught by __check_ptr_off_reg() in the
    verifier. Now the verifier assumes every kfunc only takes trusted pointer
    arguments, so it catches this NULL pointer earlier in the path and
    provides a more accurate failure message.
    
    Acked-by: Eduard Zingerman 
    Reviewed-by: Emil Tsalapatis 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-8-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit df5004579bbdfe4c734f2cbbf3f44fe3fac440a3
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:32 2026 -0800

    selftests: bpf: Update kfunc_param_nullable test for new error message
    
    With trusted args now being the default, the NULL pointer check runs
    before type-specific validation. Update test3 to expect the new error
    message "Possibly NULL pointer passed to trusted arg0" instead of the
    old dynptr-specific error message.
    
    Acked-by: Eduard Zingerman 
    Reviewed-by: Emil Tsalapatis 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-7-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 8fe172fa305f14db815bd88133d2030e4a9e107e
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:31 2026 -0800

    HID: bpf: drop dead NULL checks in kfuncs
    
    As KF_TRUSTED_ARGS is now considered default for all kfuns, the verifier
    will not allow passing NULL pointers to these kfuns. These checks for
    NULL pointers can therefore be removed.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-6-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit cd1d60949143b10d8eb7cea111e2b8bfb18fe461
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:30 2026 -0800

    bpf: xfrm: drop dead NULL check in bpf_xdp_get_xfrm_state()
    
    As KF_TRUSTED_ARGS is now considered the default for all kfuncs, the
    opts parameter in bpf_xdp_get_xfrm_state() can never be NULL. Verifier
    will detect this at load time and will not allow passing NULL to this
    function. This matches the documentation above the kfunc that says this
    parameter (opts) Cannot be NULL.
    
    Acked-by: Eduard Zingerman 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-5-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit bddaf9adda72447061a52b328c2d4c64b327fa30
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:29 2026 -0800

    bpf: net: netfilter: drop dead NULL checks
    
    bpf_xdp_ct_lookup() and bpf_skb_ct_lookup() receive bpf_tuple and opts
    parameter that are expected to be not NULL for real usages (see doc
    string above functions). They return an error if NULL is passed for opts
    or tuple.
    
    The verifier will now reject programs that pass NULL to these
    parameters, the kfuns can assume that these are always valid pointer, so
    drop the NULL checks for these parameters.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-4-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 7646c7afd9a95db0b0cb4ad066ed90f6024da67d
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:28 2026 -0800

    bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs
    
    Now that KF_TRUSTED_ARGS is the default for all kfuncs, remove the
    explicit KF_TRUSTED_ARGS flag from all kfunc definitions and remove the
    flag itself.
    
    Acked-by: Eduard Zingerman 
    Reviewed-by: Emil Tsalapatis 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-3-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 1a5c01d2508a845825eece360c6145d7f436dbf8
Author: Puranjay Mohan 
Date:   Fri Jan 2 10:00:27 2026 -0800

    bpf: Make KF_TRUSTED_ARGS the default for all kfuncs
    
    Change the verifier to make trusted args the default requirement for
    all kfuncs by removing is_kfunc_trusted_args() assuming it be to always
    return true.
    
    This works because:
    1. Context pointers (xdp_md, __sk_buff, etc.) are handled through their
       own KF_ARG_PTR_TO_CTX case label and bypass the trusted check
    2. Struct_ops callback arguments are already marked as PTR_TRUSTED during
       initialization and pass is_trusted_reg()
    3. KF_RCU kfuncs are handled separately via is_kfunc_rcu() checks at
       call sites (always checked with || alongside is_kfunc_trusted_args)
    
    This simple change makes all kfuncs require trusted args by default
    while maintaining correct behavior for all existing special cases.
    
    Note: This change means kfuncs that previously accepted NULL pointers
    without KF_TRUSTED_ARGS will now reject NULL at verification time.
    Several netfilter kfuncs are affected: bpf_xdp_ct_lookup(),
    bpf_skb_ct_lookup(), bpf_xdp_ct_alloc(), and bpf_skb_ct_alloc() all
    accept NULL for their bpf_tuple and opts parameters internally (checked
    in __bpf_nf_ct_lookup), but after this change the verifier rejects NULL
    before the kfunc is even called. This is acceptable because these kfuncs
    don't work with NULL parameters in their proper usage. Now they will be
    rejected rather than returning an error, which shouldn't make a
    difference to BPF programs that were using these kfuncs properly.
    
    Acked-by: Eduard Zingerman 
    Reviewed-by: Emil Tsalapatis 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20260102180038.2708325-2-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 9c252f3c8f390fae4ca09de36c9262a35ae88ace
Author: Krzysztof Kozlowski 
Date:   Fri Jan 2 13:50:31 2026 +0100

    bus: qcom-ebi2: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20260102125030.65186-3-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit c1881c74f4dfdadc1bf827d971a605b21ba5a587
Author: Yongpeng Yang 
Date:   Fri Dec 12 21:09:55 2025 +0800

    dm-stripe: adjust max_hw_discard_sectors to avoid unnecessary discard bio splitting
    
    Currently, the max_hw_discard_sectors of a stripe target is set to the
    minimum max_hw_discard_sectors among all sub devices. When the discard
    bio is larger than max_hw_discard_sectors, this may cause the stripe
    device to split discard bios unnecessarily, because the value of
    max_hw_discard_sectors affects max_discard_sectors, which equal to
    min(max_hw_discard_sectors, max_user_discard_sectors).
    
    For example:
    root@vm:~# echo '0 33554432 striped 2 256 /dev/vdd 0 /dev/vde 0' | dmsetup create stripe_dev
    root@vm:~# cat /sys/block/dm-1/queue/discard_max_bytes
    536870912
    root@vm:~# cat /sys/block/dm-1/slaves/vdd/queue/discard_max_bytes
    536870912
    root@vm:~# blkdiscard -o 0 -l 1073741824 -p 1073741824 /dev/mapper/stripe_dev
    
    dm-1 is the stripe device, and its discard_max_bytes is equal to
    each sub device’s discard_max_bytes. Since the requested discard
    length exceeds discard_max_bytes, the block layer splits the discard bio:
    
    block_bio_queue: 252,1 DS 0 + 2097152 [blkdiscard]
    block_split: 252,1 DS 0 / 1048576 [blkdiscard]
    block_rq_issue: 253,48 DS 268435456 () 0 + 524288 be,0,4 [blkdiscard]
    block_bio_queue: 253,64 DS 524288 + 524288 [blkdiscard]
    
    However, both vdd and vde can actually handle a discard bio of 536870912
    bytes, so this split is not necessary.
    
    This patch updates the stripe target’s q->limits.max_hw_discard_sectors
    to be the minimum max_hw_discard_sectors of the sub devices multiplied
    by the # of stripe devices, and max_hw_discard_sectors must round down to
    chunk size multiply # of stripe devices to avoid issue discard bio to sub
    devices which is larger than max_hw_discard_sectors.
    
    This patch enables the stripe device to handle larger discard bios
    without incurring unnecessary splitting.
    
    Signed-off-by: Yongpeng Yang 
    Reviewed-by: Benjamin Marzinski 
    Signed-off-by: Mikulas Patocka 

commit b13ef361d47f09b7aecd18e0383ecc83ff61057e
Author: Daniel Gomez 
Date:   Sat Dec 20 04:49:37 2025 +0100

    dm: replace -EEXIST with -EBUSY
    
    The -EEXIST error code is reserved by the module loading infrastructure
    to indicate that a module is already loaded. When a module's init
    function returns -EEXIST, userspace tools like kmod interpret this as
    "module already loaded" and treat the operation as successful, returning
    0 to the user even though the module initialization actually failed.
    
    This follows the precedent set by commit 54416fd76770 ("netfilter:
    conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
    issue in nf_conntrack_helper_register().
    
    Affected modules:
      * dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache
      * dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity
      * dm_queue_length dm_service_time dm_snapshot
    
    Signed-off-by: Daniel Gomez 
    Signed-off-by: Mikulas Patocka 

commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47
Author: Ding Hui 
Date:   Sat Dec 20 20:03:50 2025 +0800

    dm: remove fake timeout to avoid leak request
    
    Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
    blk_mq_complete_request"), drivers are responsible for calling
    blk_should_fake_timeout() at appropriate code paths and opportunities.
    
    However, the dm driver does not implement its own timeout handler and
    relies on the timeout handling of its slave devices.
    
    If an io-timeout-fail error is injected to a dm device, the request
    will be leaked and never completed, causing tasks to hang indefinitely.
    
    Reproduce:
    1. prepare dm which has iscsi slave device
    2. inject io-timeout-fail to dm
       echo 1 >/sys/class/block/dm-0/io-timeout-fail
       echo 100 >/sys/kernel/debug/fail_io_timeout/probability
       echo 10 >/sys/kernel/debug/fail_io_timeout/times
    3. read/write dm
    4. iscsiadm -m node -u
    
    Result: hang task like below
    [  862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
    [  862.244133]       Tainted: G            E       6.19.0-rc1+ #51
    [  862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    [  862.244718] task:kworker/u514:2  state:D stack:0     pid:151   tgid:151   ppid:2      task_flags:0x4288060 flags:0x00080000
    [  862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
    [  862.245264] Call Trace:
    [  862.245587]  
    [  862.245814]  __schedule+0x810/0x15c0
    [  862.246557]  schedule+0x69/0x180
    [  862.246760]  blk_mq_freeze_queue_wait+0xde/0x120
    [  862.247688]  elevator_change+0x16d/0x460
    [  862.247893]  elevator_set_none+0x87/0xf0
    [  862.248798]  blk_unregister_queue+0x12e/0x2a0
    [  862.248995]  __del_gendisk+0x231/0x7e0
    [  862.250143]  del_gendisk+0x12f/0x1d0
    [  862.250339]  sd_remove+0x85/0x130 [sd_mod]
    [  862.250650]  device_release_driver_internal+0x36d/0x530
    [  862.250849]  bus_remove_device+0x1dd/0x3f0
    [  862.251042]  device_del+0x38a/0x930
    [  862.252095]  __scsi_remove_device+0x293/0x360
    [  862.252291]  scsi_remove_target+0x486/0x760
    [  862.252654]  __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
    [  862.252886]  process_one_work+0x633/0xe50
    [  862.253101]  worker_thread+0x6df/0xf10
    [  862.253647]  kthread+0x36d/0x720
    [  862.254533]  ret_from_fork+0x2a6/0x470
    [  862.255852]  ret_from_fork_asm+0x1a/0x30
    [  862.256037]  
    
    Remove the blk_should_fake_timeout() check from dm, as dm has no
    native timeout handling and should not attempt to fake timeouts.
    
    Signed-off-by: Ding Hui 
    Reviewed-by: Christoph Hellwig 
    Signed-off-by: Mikulas Patocka 

commit a8c3ec7d07a8d458a6b556eecc92010ff906b68a
Author: Julia Lawall 
Date:   Tue Dec 30 16:22:27 2025 +0100

    dm-vdo: adjust function name reference
    
    There is no function advance_compression_stage().  But
    advance_data_vio_compression_stage() does iterate through
    the values of the data_vio_compression_stage enum, so it
    seems to be what was intended.
    
    Signed-off-by: Julia Lawall 
    Signed-off-by: Mikulas Patocka 

commit b735960c02a91d7e4abedde21adf9afb96f35b3f
Author: Akiyoshi Kurita 
Date:   Tue Dec 23 20:11:12 2025 +0900

    dm-raid: fix typo in documentation
    
    Signed-off-by: Akiyoshi Kurita 
    Signed-off-by: Mikulas Patocka 

commit 12ea976f955cefb06eeae4c9e5eb48d08038ccb2
Author: Julia Lawall 
Date:   Tue Dec 30 16:42:39 2025 +0100

    s390/ap: Fix typo in function name reference
    
    Add missing s into ap_intructions_available.
    
    Signed-off-by: Julia Lawall 
    Reviewed-by: Jimmy Brisson 
    Signed-off-by: Heiko Carstens 

commit b2f90ef5ded439cb01fc076a6f66c5cde5e633c5
Author: Julia Lawall 
Date:   Tue Dec 30 17:06:44 2025 +0100

    ACPI: scan: Drop outdated comment regarding removed function
    
    The function acpi_video_get_capabilities() was removed from
    drivers/acpi/video_detect.c by commit 87521e16a7ab ("acpi-video-detect:
    Rewrite backlight interface selection logic") in 2015.  At the time,
    comments about this function were just removed, and no replacement
    seemed to be proposed.
    
    Drop the reference to acpi_video_get_capabilities() here as well.
    
    Signed-off-by: Julia Lawall 
    [ rjw: Subject adjustment, changelog edits ]
    Link: https://patch.msgid.link/20251230160644.100439-1-Julia.Lawall@inria.fr
    Signed-off-by: Rafael J. Wysocki 

commit ff8f624860e1cd31f32d2c18de291ca727f8ddcd
Author: Rafael J. Wysocki 
Date:   Tue Dec 30 10:57:34 2025 +0100

    ACPI: scan: Use resource_type() for resource type checking
    
    To follow a well-established existing pattern, use resource_type() for
    resource type checking in acpi_scan_claim_resources().
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Andy Shevchenko 
    Reviewed-by: Ilpo Järvinen 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/12814730.O9o76ZdvQC@rafael.j.wysocki

commit eed8f21a94f86e1b25d945fabbd50f822781e41d
Author: Rafael J. Wysocki 
Date:   Mon Dec 29 14:27:46 2025 +0100

    ACPI: bus: Fix typo under sizeof() in acpi_run_osc()
    
    The sizeof(32) in acpi_run_osc() should be sizeof(u32), so fix it.
    
    Fixes: e5322888e6bf ("ACPI: bus: Rework the handling of \_SB._OSC platform features")
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/2817106.mvXUDI8C0e@rafael.j.wysocki

commit 06a17f2beab8c7e9eb9e63c7f89a62a4575cd95b
Author: Rafael J. Wysocki 
Date:   Fri Dec 26 14:48:45 2025 +0100

    ACPI: bus: Adjust acpi_osc_handshake() parameter list
    
    For the sake of interface cleanliness, it is better to avoid using
    ACPICA data types in the parameter lists of helper functions that
    don't belong to ACPICA, so adjust the parameter list of recently
    introduced acpi_osc_handshake() to take a capabilities buffer pointer
    and the size of the buffer (in u32 size units) as parameters directly
    instead of a struct acpi_buffer pointer.
    
    This is also somewhat more straightforward on the caller side because
    they won't need to create struct acpi_buffer objects themselves to pass
    them to the helper function and it guarantees that the size of the
    buffer in bytes will always be a multiple of 4 (the size of u32).
    
    Moreover, it addresses a premature cap pointer dereference and
    eliminates a sizeof(32) that should have been sizeof(u32) [1].
    
    Fixes: e5322888e6bf ("ACPI: bus: Rework the handling of \_SB._OSC platform features")
    Reported-by: kernel test robot 
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/linux-acpi/202512242052.W4GhDauV-lkp@intel.com/
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    [ rjw: Fixed typo under sizeof(), used ARRAY_SIZE() in two places ]
    Link: https://patch.msgid.link/12833187.O9o76ZdvQC@rafael.j.wysocki
    Signed-off-by: Rafael J. Wysocki 

commit 5fc6dd158e97d317aeb85ea930613f8db172603b
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 13:25:23 2025 -0500

    virtio: add virtqueue_add_inbuf_cache_clean API
    
    Add virtqueue_add_inbuf_cache_clean() for passing DMA_ATTR_CPU_CACHE_CLEAN
    to virtqueue operations. This suppresses DMA debug cacheline overlap
    warnings for buffers where proper cache management is ensured by the
    caller.
    
    Message-ID: 
    Signed-off-by: Michael S. Tsirkin 

commit d5d846513128c1a3bc2f2d371f6e903177dea443
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 14:38:31 2025 -0500

    dma-debug: track cache clean flag in entries
    
    If a driver is buggy and has 2 overlapping mappings but only
    sets cache clean flag on the 1st one of them, we warn.
    But if it only does it for the 2nd one, we don't.
    
    Fix by tracking cache clean flag in the entry.
    
    Message-ID: <0ffb3513d18614539c108b4548cdfbc64274a7d1.1767601130.git.mst@redhat.com>
    Reviewed-by: Petr Tesarik 
    Signed-off-by: Michael S. Tsirkin 

commit 65f329ff234705b07a6e4429499fdf578cccca49
Author: Jani Nikula 
Date:   Wed Dec 31 13:26:11 2025 +0200

    drm/i915/gvt: include intel_display_limits.h where needed
    
    In this case, it's actually gvt.h that needs I915_MAX_PORTS etc. from
    intel_display_limits.h. Make this more evident by moving the include
    there, instead of getting it via fb_decoder.h.
    
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/30696b712f4beba171c15765632ad9c3e1b8b1d1.1767180318.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 045033fb02e744d577316429aa082e581356b63b
Author: Jani Nikula 
Date:   Wed Dec 31 13:26:10 2025 +0200

    drm/i915/gvt: reduce include of vfio.h
    
    Nothing in dmabuf.h needs vfio.h. Replace with actually needed minimal
    includes.
    
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/fbfca6252798ab58717486d1592fed310f880d42.1767180318.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit fcb6fc87f1a189c4b0141513556ed01419f4d90e
Author: Jani Nikula 
Date:   Wed Dec 31 13:26:09 2025 +0200

    drm/i915/gvt: reduce include of gt/intel_engine_regs.h
    
    Move IS_RESTORE_INHIBIT() to scheduler.c, along with the
    gt/intel_engine_regs.h include.
    
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/2f5440016b5d164a6f3889565761caa17cccd4b7.1767180318.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 0eccf37660aebf9be4b35dac6c30ae729c42a720
Author: Jani Nikula 
Date:   Wed Dec 31 13:26:08 2025 +0200

    drm/i915/gvt: include sched_policy.h only where needed
    
    Not everything needs sched_policy.h. Drop it from gvt.h, and include
    where needed.
    
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/2807f82cf571ed6e736242bdfad786efcad50f02.1767180318.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 1bc99cdc1db9c74204ca3706bb60f0eba58bcb52
Author: Jani Nikula 
Date:   Wed Dec 31 13:26:07 2025 +0200

    drm/i915/gvt: sort and group include directives
    
    The include directives are a bit of a mess in gvt. Sort and group them
    to make them easier to deal with.
    
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/c9f2b5a7367671965a7f5fa4f22b94ce9b980cfd.1767180318.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 9d8107579ce4f2369ea3f670585710c30b14a4b4
Author: André Draszik 
Date:   Wed Dec 17 11:45:06 2025 +0000

    gpio: max77759: drop use of irqd_get_trigger_type
    
    irqd_get_trigger_type() is meant for cases where the driver needs to
    know the configured IRQ trigger type and e.g. wants to change its
    behaviour accordingly. Furthermore, platform support code, e.g. DT
    handling, will configure the hardware based on that, and drivers don't
    need to pass the trigger type into request_irq() and friends.
    
    Drop the use from this driver, as it doesn't need to know the trigger
    type.
    
    Signed-off-by: André Draszik 
    Link: https://lore.kernel.org/r/20251217-max77759-gpio-irq-trigger-v1-1-5738953c1172@linaro.org
    Signed-off-by: Bartosz Golaszewski 

commit 2b03d9a40cd1fea42fd65d2b66df80edc0f374c8
Author: Jonas Jelonek 
Date:   Sat Dec 27 18:01:34 2025 +0000

    gpio: add gpio-line-mux driver
    
    Add a new driver which provides a 1-to-many mapping for a single real
    GPIO using a multiplexer. Each virtual GPIO corresponds to a multiplexer
    state which, if set for the multiplexer, connects the real GPIO to the
    corresponding virtual GPIO.
    
    This can help in various usecases. One practical case is the special
    hardware design of the Realtek-based XS1930-10 switch from Zyxel. It
    features two SFP+ ports/cages whose signals are wired directly to the
    switch SoC. Although Realtek SoCs are short on GPIOs, there are usually
    enough the fit the SFP signals without any hacks.
    
    However, Zyxel did some weird design and connected RX_LOS, MOD_ABS and
    TX_FAULT of one SFP cage onto a single GPIO line controlled by a
    multiplexer (the same for the other SFP cage). The single multiplexer
    controls the lines for both SFP and depending on the state, the
    designated 'signal GPIO lines' are connected to one of the three SFP
    signals.
    
    Because the SFP core/driver doesn't support multiplexer but needs single
    GPIOs for each of the signals, this driver fills the gap between both.
    It registers a gpio_chip, provides multiple virtual GPIOs and sets the
    backing multiplexer accordingly.
    
    Due to several practical issues, this is input-only and doesn't support
    IRQs.
    
    Signed-off-by: Jonas Jelonek 
    Reviewed-by: Thomas Richard 
    Reviewed-by: Linus Walleij 
    Link: https://lore.kernel.org/r/20251227180134.1262138-3-jelonek.jonas@gmail.com
    Signed-off-by: Bartosz Golaszewski 

commit 2a7618ba8698874e9871a8ec5453e0068e94d9e5
Author: Jonas Jelonek 
Date:   Sat Dec 27 18:01:33 2025 +0000

    dt-bindings: gpio: add gpio-line-mux controller
    
    Add dt-schema for a gpio-line-mux controller which exposes virtual
    GPIOs for a shared GPIO controlled by a multiplexer, e.g. a gpio-mux.
    
    The gpio-line-mux controller is a gpio-controller, thus has mostly the
    same semantics. However, it requires a mux-control to be specified upon
    which it will operate.
    
    Signed-off-by: Jonas Jelonek 
    Reviewed-by: Conor Dooley 
    Reviewed-by: Linus Walleij 
    Link: https://lore.kernel.org/r/20251227180134.1262138-2-jelonek.jonas@gmail.com
    Signed-off-by: Bartosz Golaszewski 

commit 9c4a56a8b73aacfaec741b81051eefeac92d8987
Author: Jani Nikula 
Date:   Wed Dec 31 12:32:32 2025 +0200

    drm/i915/display: remove accidentally added empty file
    
    intel_display_limits.c was never supposed to be added. Remove it.
    
    Fixes: f3255cf4490e ("drm/i915/display: Add APIs to be used by gvt to get the register offsets")
    Cc: Ankit Nautiyal 
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251231103232.627666-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit f0d0f087227c4b63538e4ed8292f1fa26f8d6633
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:24:58 2025 +0100

    arm64: dts: arm: Use hyphen in node names
    
    DTS coding style prefers hyphens instead of underscores in the node
    names.  Change should be safe, because node names are not considered an
    ABI.
    
    Signed-off-by: Krzysztof Kozlowski 
    Acked-by: Vincenzo Frascino 
    Message-Id: <20251223152457.155392-3-krzysztof.kozlowski@oss.qualcomm.com>
    Signed-off-by: Sudeep Holla 

commit 78df43b95885eb764666eac2ea8e21e2953175e1
Author: Sebastian Brzezinka 
Date:   Tue Dec 16 16:11:45 2025 +0100

    drm/i915/gt: use designated initializers for intel_gt_debugfs_file
    
    CONFIG_RANDSTRUCT may reorder structure fields, which makes positional
    initializers unsafe. The i915 GT debugfs tables were using positional
    initializers for `struct intel_gt_debugfs_file`, and on configs where
    the layout differs (e.g., presence/absence of the `.eval` callback),
    this can lead to fields being initialized incorrectly and trigger
    randstruct warnings such as:
    
    ```
      drivers/gpu/drm/i915/gt/intel_gt_debugfs.c:75:51: note: randstruct:
      casting between randomized structure pointer types (constructor)
    ```
    
    Switch all the GT debugfs file arrays to designated initializers. This
    binds each value to the intended member regardless of structure
    reordering or optional members and removes the warning while preserving
    the intended initialization. Also drops the '&' from
    intel_eval_slpc_support so .eval receives the function pointer directly.
    
    No functional change, only initialization style is updated.
    
    Signed-off-by: Sebastian Brzezinka 
    Reviewed-by: Krzysztof Karas 
    Reviewed-by: Andi Shyti 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/bae491e8098705a87304a7c94573b377e8c8fa37.1765897826.git.sebastian.brzezinka@intel.com

commit 8049f77fd820f47a2727c805de629a7433538eab
Author: Vladimir Zapolskiy 
Date:   Thu Dec 25 19:38:47 2025 +0200

    dmaengine: pl08x: Fix comment stating the difference between PL080 and PL081
    
    Fix a trivial typo in the comment, otherwise it takes an effort to
    understand what it actually means to say.
    
    Signed-off-by: Vladimir Zapolskiy 
    Link: https://patch.msgid.link/20251225173847.1395928-1-vz@mleia.com
    Signed-off-by: Vinod Koul 

commit d3824968dbd9056844bbd5041020a3e28c748558
Author: Tony Han 
Date:   Wed Dec 3 13:11:43 2025 +0100

    dmaengine: at_xdmac: get the number of DMA channels from device tree
    
    In case of kernel runs in non-secure mode, the number of DMA channels can
    be got from device tree since the value read from GTYPE register is "0" as
    it's always secured.
    
    As the number of channels can never be negative, update them to the type
    "unsigned".
    
    This is required for LAN969x.
    
    Signed-off-by: Tony Han 
    Signed-off-by: Robert Marko 
    Link: https://patch.msgid.link/20251203121208.1269487-1-robert.marko@sartura.hr
    Signed-off-by: Vinod Koul 

commit c47422f4d0a26b25ff59709921eaaf8f916eec7d
Author: Robert Marko 
Date:   Mon Dec 29 19:37:50 2025 +0100

    dt-bindings: dma: atmel: add microchip,lan9691-dma
    
    Document Microchip LAN969x DMA compatible which is compatible to SAMA7G5.
    
    Signed-off-by: Robert Marko 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251229184004.571837-10-robert.marko@sartura.hr
    Signed-off-by: Vinod Koul 

commit 0a6946644f0d1151d31212820497e1a49fe1a0a6
Author: Khairul Anuar Romli 
Date:   Mon Dec 29 11:49:01 2025 +0800

    dt-bindings: dma: snps,dw-axi-dmac: Add compatible string for Agilex5
    
    The address bus on Agilex5 is limited to 40 bits. When SMMU is enable this
    will cause address truncation and translation faults. Hence introducing
    "altr,agilex5-axi-dma" to enable platform specific configuration to
    configure the dma addressable bit mask.
    
    Add a fallback capability for the compatible property to allow driver to
    probe and initialize with a newly added compatible string without requiring
    additional entry in the driver.
    
    Signed-off-by: Khairul Anuar Romli 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/dbc775f114445c06c6e4ce424333e1f3cbb92583.1766966955.git.khairul.anuar.romli@altera.com
    Signed-off-by: Vinod Koul 

commit 99e0728b38da1ee343bd3b57bda72c404c693c45
Author: Vladimir Zapolskiy 
Date:   Thu Dec 25 20:15:19 2025 +0200

    dt-bindings: dma: pl08x: Do not use plural form of a proper noun PrimeCell
    
    As a proper noun PrimeCell is a single entity and it can not have a plural
    form, fix the typo.
    
    Signed-off-by: Vladimir Zapolskiy 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251225181519.1401953-1-vz@mleia.com
    Signed-off-by: Vinod Koul 

commit add66a6673bc4aacd0ef0f3c4a51271501770b17
Author: Abel Vesa 
Date:   Wed Dec 24 13:10:47 2025 +0200

    phy: qcom: edp: Add Glymur platform support
    
    The Qualcomm Glymur platform has the new v8 version of the eDP/DP PHY.
    So rework the driver to support this new version and add the platform
    specific configuration data.
    
    While at it, add the rest of the AUX_CFG reset values for the v4 and v5
    platforms, which makes the handling of the platforms specific array
    cleaner, as they are single sized now.
    
    Signed-off-by: Abel Vesa 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Abel Vesa 
    Link: https://patch.msgid.link/20251224-phy-qcom-edp-add-glymur-support-v6-4-4fcba75a6fa9@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 212cdedcac11c411d0e7c277e1cdcac5f1a20ba2
Author: Abel Vesa 
Date:   Wed Dec 24 13:10:46 2025 +0200

    phy: qcom-qmp: qserdes-com: Add v8 DP-specific qserdes register offsets
    
    Starting with Glymur, the PCIe and DP PHYs qserdes register offsets differ
    for the same version number. So in order to be able to differentiate
    between them, add these ones with DP prefix.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Abel Vesa 
    Signed-off-by: Abel Vesa 
    Link: https://patch.msgid.link/20251224-phy-qcom-edp-add-glymur-support-v6-3-4fcba75a6fa9@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 2d472a675ced00397440caed78168db5fdecf3a3
Author: Abel Vesa 
Date:   Wed Dec 24 13:10:45 2025 +0200

    phy: qcom: edp: Fix the DP_PHY_AUX_CFG registers count
    
    On all platforms supported by this driver, there are 13 DP_PHY_AUX_CFGx
    registers. This hasn't been an issue so far on currently supported
    platforms, because the init sequence never spanned beyond DP_PHY_AUX_CFG9.
    
    However, on the new upcoming Glymur platform, these are updated along
    with the rest of the init sequence.
    
    So update the size of the array holding the config to 13.
    
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Abel Vesa 
    Signed-off-by: Abel Vesa 
    Link: https://patch.msgid.link/20251224-phy-qcom-edp-add-glymur-support-v6-2-4fcba75a6fa9@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 8f97b9b34f0d26339e8b0d26c2f466eeb188939b
Author: Abel Vesa 
Date:   Wed Dec 24 13:10:44 2025 +0200

    dt-bindings: phy: Add DP PHY compatible for Glymur
    
    The Glymur platform is the first one to use the eDP PHY version 8.
    This makes it incompatible with any of the earlier platforms and therefore
    requires a dedicated compatible. So document it.
    
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Abel Vesa 
    Signed-off-by: Abel Vesa 
    Link: https://patch.msgid.link/20251224-phy-qcom-edp-add-glymur-support-v6-1-4fcba75a6fa9@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 7d51b709262c5aa31d2b9cd31444112c1b2dae03
Author: Abel Vesa 
Date:   Wed Dec 24 12:53:28 2025 +0200

    phy: qcom: edp: Make the number of clocks flexible
    
    On X Elite, the DP PHY needs another clock called ref, while all other
    platforms do not.
    
    The current X Elite devices supported upstream work fine without this
    clock, because the boot firmware leaves this clock enabled. But we should
    not rely on that. Also, even though this change breaks the ABI, it is
    needed in order to make the driver disables this clock along with the
    other ones, for a proper bring-down of the entire PHY.
    
    So in order to handle these clocks on different platforms, make the driver
    get all the clocks regardless of how many there are provided.
    
    Cc: stable@vger.kernel.org # v6.10
    Fixes: db83c107dc29 ("phy: qcom: edp: Add v6 specific ops and X1E80100 platform support")
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Abel Vesa 
    Link: https://patch.msgid.link/20251224-phy-qcom-edp-add-missing-refclk-v5-2-3f45d349b5ac@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 6b99eeacf6abb1ff2d6463c84e490343f39cf11a
Author: Abel Vesa 
Date:   Wed Dec 24 12:53:27 2025 +0200

    dt-bindings: phy: qcom-edp: Add missing clock for X Elite
    
    On X Elite platform, the eDP PHY uses one more clock called ref.
    
    The current X Elite devices supported upstream work fine without this
    clock, because the boot firmware leaves this clock enabled. But we should
    not rely on that. Also, even though this change breaks the ABI, it is
    needed in order to make the driver disables this clock along with the
    other ones, for a proper bring-down of the entire PHY.
    
    So attach the this ref clock to the PHY.
    
    Cc: stable@vger.kernel.org # v6.10
    Fixes: 5d5607861350 ("dt-bindings: phy: qcom-edp: Add X1E80100 PHY compatibles")
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Abel Vesa 
    Link: https://patch.msgid.link/20251224-phy-qcom-edp-add-missing-refclk-v5-1-3f45d349b5ac@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 085ba7c91df34e05366f9fecc9fa7a037598c30e
Author: Abel Vesa 
Date:   Wed Dec 24 12:35:02 2025 +0200

    phy: qcom: qmp-pcie: Add support for Glymur PCIe Gen4x2 PHY
    
    Glymur platform has two Gen4 2-lanes controllers, the fourth and
    sixth instances. Add support for their PHYs.
    
    Signed-off-by: Abel Vesa 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20251224-phy-qcom-pcie-add-glymur-v3-2-57396145bc22@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 25671c37821006392ff8c66e980475747bee4cde
Author: Abel Vesa 
Date:   Wed Dec 24 12:35:01 2025 +0200

    dt-bindings: phy: sc8280xp-qmp-pcie: Document Glymur PCIe Gen4 2-lanes PHY
    
    The fourth and sixth PCIe instances on Glymur are both Gen4 2-lane PHY.
    So document the compatible.
    
    Signed-off-by: Abel Vesa 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251224-phy-qcom-pcie-add-glymur-v3-1-57396145bc22@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit b64b32791fb557f922beebddf74c47baf338cef0
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 13:44:10 2025 +0100

    phy: renesas: rcar-gen2: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251224124407.208354-6-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 175b46f31fe60d7772fae19f731f282327cb333f
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 13:44:09 2025 +0100

    phy: core: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251224124407.208354-5-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 943dbe1470529d7191dccdb56ee0bff83d3606c5
Author: Krzysztof Kozlowski 
Date:   Wed Dec 24 13:44:08 2025 +0100

    phy: rockchip: usb: Simplify with scoped for each OF child loop
    
    Use scoped for-each loop when iterating over device nodes to make code a
    bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251224124407.208354-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit fe4bc1a08638309b6be1af37210930b856908eb7
Author: Ze Huang 
Date:   Fri Oct 17 22:49:53 2025 +0800

    phy: spacemit: support K1 USB2.0 PHY controller
    
    The SpacemiT K1 SoC includes three USB ports:
    
    - One USB2.0 OTG port
    - One USB2.0 host-only port
    - One USB3.0 port with an integrated USB2.0 DRD interface
    
    Each of these ports is connected to a USB2.0 PHY responsible for USB2
    transmission.
    
    This commit adds support for the SpacemiT K1 USB2.0 PHY, which is
    compliant with the USB 2.0 specification and supports both 8-bit 60MHz
    and 16-bit 30MHz parallel interfaces.
    
    Signed-off-by: Ze Huang 
    Tested-by: Aurelien Jarno 
    Tested-by: Junzhong Pan 
    Link: https://patch.msgid.link/20251017-k1-usb2phy-v6-2-7cf9ea2477a1@linux.dev
    Signed-off-by: Vinod Koul 

commit 61b84d5b20af2a4c9944972202c1386026598928
Author: Ze Huang 
Date:   Fri Oct 17 22:49:52 2025 +0800

    dt-bindings: phy: spacemit: add K1 USB2 PHY
    
    Add support for USB2 PHY found on SpacemiT K1 SoC.
    
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Ze Huang 
    Tested-by: Aurelien Jarno 
    Tested-by: Junzhong Pan 
    Link: https://patch.msgid.link/20251017-k1-usb2phy-v6-1-7cf9ea2477a1@linux.dev
    Signed-off-by: Vinod Koul 

commit 5068c09db5c9ccd47f531bd3ff7f9fe50400fa13
Author: Julia Lawall 
Date:   Tue Dec 30 15:10:50 2025 +0100

    phy: renesas: phy-rcar-gen2: fix typo in function name reference
    
    Replace cmpxcgh by cmpxchg.
    
    Signed-off-by: Julia Lawall 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251230141050.93856-1-Julia.Lawall@inria.fr
    Signed-off-by: Vinod Koul 

commit 6c1cdea6bafea96a818181e1289e22fbdc09f1d3
Author: Julia Lawall 
Date:   Tue Dec 30 15:06:01 2025 +0100

    phy: adjust function name reference
    
    There is no function clk_bulk_prepare_disable.  Refer instead to
    clk_bulk_disable_unprepare, which is called in the function
    defined just below.
    
    Signed-off-by: Julia Lawall 
    Reviewed-by: Daniel Golle 
    Link: https://patch.msgid.link/20251230140601.93474-1-Julia.Lawall@inria.fr
    Signed-off-by: Vinod Koul 

commit 0287c960b15f27498d85cadf584bb59301ea2382
Author: Geert Uytterhoeven 
Date:   Tue Dec 30 16:04:05 2025 +0100

    phy: core: Reinstate pm_runtime_enabled() check in phy_pm_runtime_put()
    
    On Koelsch (R-Car M2-W), during boot and s2ram:
    
        phy phy-e6590100.usb-phy-controller.0: Runtime PM usage count underflow!
    
    While phy_pm_runtime_get{,_sync}() and phy_pm_runtime_put_sync() still
    contain pm_runtime_enabled() checks, the same check in
    phy_pm_runtime_put() was deemed redundant and removed, causing count
    underflows with PHY drivers like drivers/phy/renesas/phy-rcar-gen2.c
    that do not use Runtime PM yet,
    
    Fix this by reinstating the check.
    
    Fixes: caad07ae07e3fb17 ("phy: core: Discard pm_runtime_put() return values")
    Signed-off-by: Geert Uytterhoeven 
    Reviewed-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3ca9f8166d21685bfbf97535da30172f74822130.1767107014.git.geert+renesas@glider.be
    Signed-off-by: Vinod Koul 

commit c89474b9b2ab8ab2c0d2cddadbed781c0f5e8f0c
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:13:58 2025 -0800

    torture: Include commit discription in testid.txt
    
    Currently, the testid.txt file in the top-level directory of the
    rcutorture results contains the output of "git rev-parse HEAD", which
    just gives the full SHA-1 of the current commit.  This is followed by
    the output of "git status", which is further followed by the output of
    "git diff".  This works, but is less than helpful to human readers
    scanning a list of commits.
    
    This commit therefore instead uses "git show --oneline --no-patch HEAD",
    which provides a short SHA-1, but also the names of any branches and
    the commit's title.
    
    Signed-off-by: Paul E. McKenney 
    Signed-off-by: Boqun Feng 

commit dcd6067322ba6750995fbc5486d7c9ada88489ff
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:13:57 2025 -0800

    torture: Make config2csv.sh properly handle comments in .boot files
    
    As in strip the "#" and everything after it and *then* tokenize.
    
    Signed-off-by: Paul E. McKenney 
    Signed-off-by: Boqun Feng 

commit 3d69b6beb8ba932911096138394b5cd3e21b3b92
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:13:56 2025 -0800

    torture: Make kvm-series.sh give run numbers and totals
    
    The kvm-series.sh script can easily be convinced to run on the order of
    1,000 guest OSes, so some sort of progress indicator would be helpful.
    This commit therefore updates the "Starting" output lines to read as in
    the following example, adding the ("3 of 4"):
    
    Starting TREE02/1.7e0ad1b49057 using 8 CPUs (4 of 4) Sat Nov 8 10:51:06 PM PST 2025
    
    Signed-off-by: Paul E. McKenney 
    Signed-off-by: Boqun Feng 

commit 672621773f7df8cda2ff5635edac4aa5339d097f
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:13:55 2025 -0800

    torture: Make kvm-series.sh give build numbers and totals
    
    The kvm-series.sh script can easily be convinced to do on the order
    of 1,000 builds, so some sort of progress indicator would be helpful.
    This commit therefore updates the "Starting" output lines to read
    as in the following example, adding the ("2 of 4"):
    
    Starting TREE01/1.7e0ad1b49057 (2 of 4) at Sat Nov 8 10:08:21 PM PST 2025
    
    Signed-off-by: Paul E. McKenney 
    Signed-off-by: Boqun Feng 

commit 3ce40539cc0055b2df49303979c5b6a4a8321be4
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:13:54 2025 -0800

    torture: Parallelize kvm-series.sh guest-OS execution
    
    Currently, kvm-series.sh builds and runs serially, which makes for
    long execution times.  This commit changes its logic to build all of
    the needed kernels serially, but then run the corresponding guest OSes
    concurrently in batches using the entire machine.  On large systems,
    this results in order-of-magnitude speedups of the guest-OS execution
    portion of the runtime.
    
    Signed-off-by: Paul E. McKenney 
    Signed-off-by: Boqun Feng 

commit e8a534a6718c3ac99823a61230139555672112a1
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:13:53 2025 -0800

    rcutorture: Add context checks to rcu_torture_timer()
    
    This commit adds irq, NMI, and softirq context checks to the
    rcu_torture_timer() function.  Just because you are paranoid does not
    mean that they are not out to get you...  ;-)
    
    Signed-off-by: Paul E. McKenney 
    Signed-off-by: Boqun Feng 

commit 760f05bc830d86667c07af6c80dc58d599061a67
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:11:04 2025 -0800

    rcutorture: Test rcu_tasks_trace_expedite_current()
    
    This commit adds a ->exp_current member to the tasks_tracing_ops structure
    to test the rcu_tasks_trace_expedite_current() function.
    
    [ paulmck: Apply kernel test robot feedback. ]
    
    Signed-off-by: Paul E. McKenney 
    Cc: Andrii Nakryiko 
    Cc: Alexei Starovoitov 
    Cc: Peter Zijlstra 
    Cc: bpf@vger.kernel.org
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit a525ccd4d3e91ff123960e44a8892fb76c8217ea
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:11:03 2025 -0800

    srcu: Create an rcu_tasks_trace_expedite_current() function
    
    This commit creates an rcu_tasks_trace_expedite_current() function
    that expedites the current (and possibly the next) RCU Tasks Trace
    grace period.
    
    If the current RCU Tasks Trace grace period is already waiting, that wait
    will complete before the expediting takes effect.  If there is no RCU
    Tasks Trace  grace period in flight, this function might well create one.
    
    Signed-off-by: Paul E. McKenney 
    Cc: Andrii Nakryiko 
    Cc: Alexei Starovoitov 
    Cc: Peter Zijlstra 
    Cc: bpf@vger.kernel.org
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit e55c2e287174280ddef47ad58e83567a88ece39d
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:11:02 2025 -0800

    checkpatch: Deprecate rcu_read_{,un}lock_trace()
    
    Uses of rcu_read_lock_trace() and rcu_read_unlock_trace()
    are better served by the new rcu_read_lock_tasks_trace() and
    rcu_read_unlock_tasks_trace() APIs.  Therefore, mark the old APIs as
    deprecated.
    
    Signed-off-by: Paul E. McKenney 
    Acked-by: Joe Perches 
    Cc: Andy Whitcroft 
    Cc: Dwaipayan Ray 
    Cc: Lukas Bulwahn 
    Cc: Andrii Nakryiko 
    Cc: Alexei Starovoitov 
    Cc: Peter Zijlstra 
    Cc: bpf@vger.kernel.org
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit c0872be261f490d02c157051373a31f2df60f64e
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:11:01 2025 -0800

    rcu: Update Requirements.rst for RCU Tasks Trace
    
    This commit updates the documentation to declare that RCU Tasks Trace
    is implemented as a thin wrapper around SRCU-fast.
    
    Signed-off-by: Paul E. McKenney 
    Cc: Andrii Nakryiko 
    Cc: Alexei Starovoitov 
    Cc: Peter Zijlstra 
    Cc: bpf@vger.kernel.org
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit 1a72f4bb6f3eaa5af674cb10802f7064bf71d10a
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:11:00 2025 -0800

    rcu: Add noinstr-fast rcu_read_{,un}lock_tasks_trace() APIs
    
    When expressing RCU Tasks Trace in terms of SRCU-fast, it was
    necessary to keep a nesting count and per-CPU srcu_ctr structure
    pointer in the task_struct structure, which is slow to access.
    But an alternative is to instead make rcu_read_lock_tasks_trace() and
    rcu_read_unlock_tasks_trace(), which match the underlying SRCU-fast
    semantics, avoiding the task_struct accesses.
    
    When all callers have switched to the new API, the previous
    rcu_read_lock_trace() and rcu_read_unlock_trace() APIs will be removed.
    
    The rcu_read_{,un}lock_{,tasks_}trace() functions need to use smp_mb()
    only if invoked where RCU is not watching, that is, from locations where
    a call to rcu_is_watching() would return false.  In architectures that
    define the ARCH_WANTS_NO_INSTR Kconfig option, use of noinstr and friends
    ensures that tracing happens only where RCU is watching, so those
    architectures can dispense entirely with the read-side calls to smp_mb().
    
    Other architectures include these read-side calls by default, but in many
    installations there might be either larger than average tolerance for
    risk, prohibition of removing tracing on a running system, or careful
    review and approval of removing of tracing.  Such installations can
    build their kernels with CONFIG_TASKS_TRACE_RCU_NO_MB=y to avoid those
    read-side calls to smp_mb(), thus accepting responsibility for run-time
    removal of tracing from code regions that RCU is not watching.
    
    Those wishing to disable read-side memory barriers for an entire
    architecture can select this TASKS_TRACE_RCU_NO_MB Kconfig option,
    hence the polarity.
    
    [ paulmck: Apply Peter Zijlstra feedback. ]
    
    Signed-off-by: Paul E. McKenney 
    Cc: Andrii Nakryiko 
    Cc: Alexei Starovoitov 
    Cc: Peter Zijlstra 
    Cc: bpf@vger.kernel.org
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit 176a6aeaf1eb97b8ddf88e324fd1cbf47d52ba28
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:10:59 2025 -0800

    rcu: Move rcu_tasks_trace_srcu_struct out of #ifdef CONFIG_TASKS_RCU_GENERIC
    
    Moving the rcu_tasks_trace_srcu_struct structure instance out
    from under the CONFIG_TASKS_RCU_GENERIC Kconfig option permits
    the CONFIG_TASKS_TRACE_RCU Kconfig option to stop enabling this
    CONFIG_TASKS_RCU_GENERIC Kconfig option.  This commit also therefore
    makes it so.
    
    Signed-off-by: Paul E. McKenney 
    Cc: Andrii Nakryiko 
    Cc: Alexei Starovoitov 
    Cc: Peter Zijlstra 
    Cc: bpf@vger.kernel.org
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit a73fc3dcc60b6d7a2075e2fbdca64fd53600f855
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:10:58 2025 -0800

    rcu: Clean up after the SRCU-fastification of RCU Tasks Trace
    
    Now that RCU Tasks Trace has been re-implemented in terms of SRCU-fast,
    the ->trc_ipi_to_cpu, ->trc_blkd_cpu, ->trc_blkd_node, ->trc_holdout_list,
    and ->trc_reader_special task_struct fields are no longer used.
    
    In addition, the rcu_tasks_trace_qs(), rcu_tasks_trace_qs_blkd(),
    exit_tasks_rcu_finish_trace(), and rcu_spawn_tasks_trace_kthread(),
    show_rcu_tasks_trace_gp_kthread(), rcu_tasks_trace_get_gp_data(),
    rcu_tasks_trace_torture_stats_print(), and get_rcu_tasks_trace_gp_kthread()
    functions and all the other functions that they invoke are no longer used.
    
    Also, the TRC_NEED_QS and TRC_NEED_QS_CHECKED CPP macros are no longer used.
    Neither are the rcu_tasks_trace_lazy_ms and rcu_task_ipi_delay rcupdate
    module parameters and the TASKS_TRACE_RCU_READ_MB Kconfig option.
    
    This commit therefore removes all of them.
    
    [ paulmck: Apply Alexei Starovoitov feedback. ]
    
    Signed-off-by: Paul E. McKenney 
    Cc: Andrii Nakryiko 
    Cc: Alexei Starovoitov 
    Cc: Peter Zijlstra 
    Cc: bpf@vger.kernel.org
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit 46e323599911ddd3368c9993a0572c9876a82ce8
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:10:57 2025 -0800

    context_tracking: Remove rcu_task_trace_heavyweight_{enter,exit}()
    
    Because SRCU-fast does not use IPIs for its grace periods, there is
    no need for real-time workloads to switch to an IPI-free mode, and
    there is in turn no need for either rcu_task_trace_heavyweight_enter()
    or rcu_task_trace_heavyweight_exit().  This commit therefore removes them.
    
    Signed-off-by: Paul E. McKenney 
    Cc: Frederic Weisbecker 
    Cc: Andrii Nakryiko 
    Cc: Alexei Starovoitov 
    Cc: Peter Zijlstra 
    Cc: bpf@vger.kernel.org
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit c27cea4416a396a1c5b6b3529dd925f92a69e7d3
Author: Paul E. McKenney 
Date:   Mon Dec 29 11:10:56 2025 -0800

    rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast
    
    This commit saves more than 500 lines of RCU code by re-implementing
    RCU Tasks Trace in terms of SRCU-fast.  Follow-up work will remove
    more code that does not cause problems by its presence, but that is no
    longer required.
    
    This variant places smp_mb() in rcu_read_{,un}lock_trace(), and in the
    same place that srcu_read_{,un}lock() would put them. These smp_mb()
    calls will be removed on common-case architectures in a later commit.
    In the meantime, it serves to enforce ordering between the underlying
    srcu_read_{,un}lock_fast() markers and the intervening critical section,
    even on architectures that permit attaching tracepoints on regions of
    code not watched by RCU.  Such architectures defeat SRCU-fast's use of
    implicit single-instruction, interrupts-disabled, and atomic-operation
    RCU read-side critical sections, which have no effect when RCU is not
    watching.  The aforementioned later commit will insert these smp_mb()
    calls only on architectures that have not used noinstr to prevent
    attaching tracepoints to code where RCU is not watching.
    
    [ paulmck: Apply kernel test robot, Boqun Feng, and Zqiang feedback. ]
    [ paulmck: Split out Tiny SRCU fixes per Andrii Nakryiko feedback. ]
    
    Signed-off-by: Paul E. McKenney 
    Tested-by: kernel test robot 
    Cc: Andrii Nakryiko 
    Cc: Alexei Starovoitov 
    Cc: Peter Zijlstra 
    Cc: bpf@vger.kernel.org
    Reviewed-by: Joel Fernandes 
    Signed-off-by: Boqun Feng 

commit 59260fe5821ad108d0fda8a4a4fe0448e9821f27
Merge: 9ec3c8ee16a07d 0b075f82935e82
Author: Dave Airlie 
Date:   Thu Jan 1 17:00:22 2026 +1000

    Merge tag 'drm-xe-next-2025-12-30' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next
    
    Core Changes:
    - Dynamic pagemaps and multi-device SVM (Thomas)
    
    Driver Changes:
    - Introduce SRIOV scheduler Groups (Daniele)
    - Configure migration queue as low latency (Francois)
    - Don't use absolute path in generated header comment (Calvin Owens)
    - Add SoC remapper support for system controller (Umesh)
    - Insert compiler barriers in GuC code (Jonathan)
    - Rebar updates (Lucas)
    
    Signed-off-by: Dave Airlie 
    
    From: Thomas Hellstrom 
    Link: https://patch.msgid.link/aVOiULyYdnFbq-JB@fedora

commit 572b1c6f2ade7afe687a385caccb717081ada070
Author: ZhaoYueNan 
Date:   Tue Dec 30 14:26:48 2025 +0800

    f2fs: Update the default value of the documentation ckpt_thread_ioprio
    
    The commit 8a2d9f00d has been updated to set its default value to "rt,3",
    fixing the outdated default value in the F2FS documentation.
    
    Signed-off-by: ZhaoYueNan 
    Signed-off-by: Jaegeuk Kim 

commit 9609dd704725a40cd63d915f2ab6c44248a44598
Author: Yongpeng Yang 
Date:   Sat Dec 27 15:34:31 2025 +0800

    f2fs: remove non-uptodate folio from the page cache in move_data_block
    
    During data movement, move_data_block acquires file folio without
    triggering a file read. Such folio are typically not uptodate, they need
    to be removed from the page cache after gc complete. This patch marks
    folio with the PG_dropbehind flag and uses folio_end_dropbehind to
    remove folio from the page cache.
    
    Signed-off-by: Yunlei He 
    Signed-off-by: Yongpeng Yang 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit db1a8a7813f74968f79bd510fd5f0ae866bf8efd
Author: Yongpeng Yang 
Date:   Sat Dec 27 17:46:10 2025 +0800

    f2fs: return immediately after submitting the specified folio in __submit_merged_write_cond
    
    f2fs_folio_wait_writeback ensures the folio write is submitted to the
    block layer via __submit_merged_write_cond, then waits for the folio to
    complete. Other I/O submissions are irrelevant to
    f2fs_folio_wait_writeback. Thus, if the folio write bio is already
    submitted, the function can return immediately. This patch adds a
    writeback parameter to __submit_merged_write_cond(), which signals an
    immediate return after submitting the target folio, and waitting
    writeback can use this parameter.
    
    Signed-off-by: Yongpeng Yang 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 86c1cf0578c59c8e68185d86d03be846bcaef0e2
Author: Yongpeng Yang 
Date:   Sat Dec 27 17:19:06 2025 +0800

    f2fs: clean up the force parameter in __submit_merged_write_cond()
    
    The force parameter in __submit_merged_write_cond is redundant, where
    `force == true` implies `inode == NULL && folio == NULL && ino == 0` is
    true, and `force == false` implies `inode != NULL || folio != NULL ||
    ino != 0` is true. Thus, this patch replaces the force parameter with
    a stack variable force.
    
    Signed-off-by: Yongpeng Yang 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 761dac9073cd67d4705a94cd1af674945a117f4c
Author: Zhiguo Niu 
Date:   Fri Dec 26 10:56:04 2025 +0800

    f2fs: fix to add gc count stat in f2fs_gc_range
    
    It missed the stat count in f2fs_gc_range.
    
    Cc: stable@kernel.org
    Fixes: 9bf1dcbdfdc8 ("f2fs: fix to account gc stats correctly")
    Signed-off-by: Zhiguo Niu 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 3cb396a2c7905c3daed0b6b2c5806a95386f4581
Author: Chao Yu 
Date:   Fri Dec 19 10:51:04 2025 +0800

    f2fs: fix to do sanity check on nat entry of quota inode
    
    As Zhiguo reported, nat entry of quota inode could be corrupted:
    
    "ino/block_addr=NULL_ADDR in nid=4 entry"
    
    We'd better to do sanity check on quota inode to detect and record
    nat.blk_addr inconsistency, so that we can have a chance to repair
    it w/ later fsck.
    
    Reported-by: Zhiguo Niu 
    Signed-off-by: Chao Yu 
    Reviewed-by: Zhiguo Niu 
    Signed-off-by: Jaegeuk Kim 

commit 3250bd41d95ccdaa157ad5f128c1596e353ee7e0
Author: Zhiguo Niu 
Date:   Wed Dec 17 15:45:29 2025 +0800

    f2fs: remove some redundant codes in f2fs_quota_enable
    
    1. qf_inum has been got and checked in its caller f2fs_enable_quotas
    2. f2fs_sb_has_quota_ino has bee checked in its all callers
    3. use sbi cleanup F2FS_SB(sb)
    
    Signed-off-by: Zhiguo Niu 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit e21dd666e4af829c6a26d830cca8bf4839878297
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 08:11:41 2025 -0500

    docs: dma-api: document DMA_ATTR_CPU_CACHE_CLEAN
    
    Document DMA_ATTR_CPU_CACHE_CLEAN as implemented in the
    previous patch.
    
    Message-ID: <0720b4be31c1b7a38edca67fd0c97983d2a56936.1767601130.git.mst@redhat.com>
    Reviewed-by: Petr Tesarik 
    Acked-by: Marek Szyprowski 
    Signed-off-by: Michael S. Tsirkin 

commit 61868dc55a119a5e4b912d458fc2c48ba80a35fe
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 07:28:43 2025 -0500

    dma-mapping: add DMA_ATTR_CPU_CACHE_CLEAN
    
    When multiple small DMA_FROM_DEVICE or DMA_BIDIRECTIONAL buffers share a
    cacheline, and DMA_API_DEBUG is enabled, we get this warning:
            cacheline tracking EEXIST, overlapping mappings aren't supported.
    
    This is because when one of the mappings is removed, while another one
    is active, CPU might write into the buffer.
    
    Add an attribute for the driver to promise not to do this, making the
    overlapping safe, and suppressing the warning.
    
    Message-ID: <2d5d091f9d84b68ea96abd545b365dd1d00bbf48.1767601130.git.mst@redhat.com>
    Reviewed-by: Petr Tesarik 
    Acked-by: Marek Szyprowski 
    Signed-off-by: Michael S. Tsirkin 

commit 1e8b5d855525e0863198797a67a69774f426e142
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 04:01:21 2025 -0500

    docs: dma-api: document __dma_from_device_group_begin()/end()
    
    Document the __dma_from_device_group_begin()/end() annotations.
    
    Message-ID: <01ea88055ded4d70cac70ba557680fd5fa7d9ff5.1767601130.git.mst@redhat.com>
    Acked-by: Marek Szyprowski 
    Reviewed-by: Petr Tesarik 
    Signed-off-by: Michael S. Tsirkin 

commit ca085faabb42c31ee204235facc5a430cb9e78a9
Author: Michael S. Tsirkin 
Date:   Mon Dec 29 03:53:39 2025 -0500

    dma-mapping: add __dma_from_device_group_begin()/end()
    
    When a structure contains a buffer that DMA writes to alongside fields
    that the CPU writes to, cache line sharing between the DMA buffer and
    CPU-written fields can cause data corruption on non-cache-coherent
    platforms.
    
    Add __dma_from_device_group_begin()/end() annotations to ensure proper
    alignment to prevent this:
    
    struct my_device {
            spinlock_t lock1;
            __dma_from_device_group_begin();
            char dma_buffer1[16];
            char dma_buffer2[16];
            __dma_from_device_group_end();
            spinlock_t lock2;
    };
    
    Message-ID: <19163086d5e4704c316f18f6da06bc1c72968904.1767601130.git.mst@redhat.com>
    Acked-by: Marek Szyprowski 
    Reviewed-by: Petr Tesarik 
    Signed-off-by: Michael S. Tsirkin 

commit c286e7e9d1f1f3d90ad11c37e896f582b02d19c4
Author: Puranjay Mohan 
Date:   Wed Dec 31 14:10:50 2025 -0800

    selftests/bpf: veristat: fix printing order in output_stats()
    
    The order of the variables in the printf() doesn't match the text and
    therefore veristat prints something like this:
    
    Done. Processed 24 files, 0 programs. Skipped 62 files, 0 programs.
    
    When it should print:
    
    Done. Processed 24 files, 62 programs. Skipped 0 files, 0 programs.
    
    Fix the order of variables in the printf() call.
    
    Fixes: 518fee8bfaf2 ("selftests/bpf: make veristat skip non-BPF and failing-to-open BPF objects")
    Tested-by: Eduard Zingerman 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20251231221052.759396-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 17c736a7b58a18e3683df2583b60f0edeaf65070
Author: SungRock Jung 
Date:   Sun Dec 21 07:00:41 2025 +0000

    bpf: Update BPF_PROG_RUN documentation
    
    LWT_SEG6LOCAL no longer supports test_run starting from v6.11
    so remove it from the list of program types supported by BPF_PROG_RUN.
    
    Add TRACING and NETFILTER program types to reflect the
    current set of types that implement test_run.
    
    Signed-off-by: SungRock Jung 
    Acked-by: Yonghong Song 
    Link: https://lore.kernel.org/r/20251221070041.26592-1-tjdfkr2421@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit 453dece55bb1cc6812314497a1c5ecc0513457ed
Author: Ihor Solodrai 
Date:   Wed Dec 31 10:39:29 2025 -0800

    scripts/gen-btf.sh: Reduce log verbosity
    
    Remove info messages from gen-btf.sh, as they are unnecessarily
    detailed and sometimes inaccurate [1].  Verbose log can be produced by
    passing V=1 to make, which will set -x for the shell.
    
    [1] https://lore.kernel.org/bpf/CAADnVQ+biTSDaNtoL=ct9XtBJiXYMUqGYLqu604C3D8N+8YH9A@mail.gmail.com/
    
    Suggested-by: Alexei Starovoitov 
    Signed-off-by: Ihor Solodrai 
    Link: https://lore.kernel.org/r/20251231183929.65668-1-ihor.solodrai@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit d09ba52bfb25ea2ad50349b8de1986681afd6940
Author: Christophe JAILLET 
Date:   Mon Dec 29 12:27:43 2025 +0100

    iio: core: Constify struct configfs_item_operations and configfs_group_operations
    
    'struct configfs_item_operations' and 'configfs_group_operations' are not
    modified in this driver.
    
    Constifying these structures moves some data to a read-only section, so
    increases overall security, especially when the structure holds some
    function pointers.
    
    On a x86_64, with allmodconfig:
    Before:
    ======
       text    data     bss     dec     hex filename
       5037    1528      64    6629    19e5 drivers/iio/industrialio-sw-device.o
       5509    1528      64    7101    1bbd drivers/iio/industrialio-sw-trigger.o
    
    After:
    =====
       text    data     bss     dec     hex filename
       5133    1432      64    6629    19e5 drivers/iio/industrialio-sw-device.o
       5605    1432      64    7101    1bbd drivers/iio/industrialio-sw-trigger.o
    
    Signed-off-by: Christophe JAILLET 
    Signed-off-by: Jonathan Cameron 

commit d63d868b312478523670b76007dcc5eaedc3ee07
Author: Randy Dunlap 
Date:   Sat Dec 27 23:10:29 2025 -0800

    iio: test: drop dangling symbol in gain-time-scale helpers
    
    The code for this never went upstream. It was replaced by other code,
    so this should be dropped.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216748
    Fixes: cf996f039679 ("iio: test: test gain-time-scale helpers")
    Signed-off-by: Randy Dunlap 
    Signed-off-by: Jonathan Cameron 

commit 976df66573f32cea9f02f1f569207b68f08d4ef1
Author: Nuno Sá 
Date:   Mon Dec 22 13:48:02 2025 +0000

    iio: dac: adi-axi-dac: Make use of dev_err_probe()
    
    Be consistent and use dev_err_probe() as in all other places in the
    .probe() path.
    
    While at it, remove the line break in the version condition. Yes, it
    goes over the 80 column limit but I do think the line break hurts
    readability in this case.
    
    Signed-off-by: Nuno Sá 
    Signed-off-by: Jonathan Cameron 

commit fe1846f61a82645f94d13ef2e6751f6cf69c60de
Author: Nuno Sá 
Date:   Mon Dec 22 13:48:01 2025 +0000

    iio: dac: adi-axi-dac: Make use of a local struct device variable
    
    Use a local struct device variable to improve readability in some code
    paths during probe. While at it, fix some line breaks not properly
    aligned to the open parenthesis.
    
    Signed-off-by: Nuno Sá 
    Signed-off-by: Jonathan Cameron 

commit d8011335512f105b38455f2ba4f5589335120261
Author: Krzysztof Kozlowski 
Date:   Sun Dec 21 15:26:05 2025 +0100

    iio: adc: rockchip: Simplify probe() with local 'dev'
    
    Simplify the probe function by using a local 'dev' variable instead of
    full pointer dereference.  This makes several lines shorter, which
    allows to avoid wrapping making code more readable.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Heiko Stuebner 
    Signed-off-by: Jonathan Cameron 

commit 5b758ebc3d59909c6fd75b7b2523ec033c7c415c
Author: Krzysztof Kozlowski 
Date:   Sun Dec 21 15:26:04 2025 +0100

    iio: adc: exynos: Simplify probe() with local 'dev' and 'np'
    
    Simplify the probe function by using local 'dev' and 'np' variables
    instead of full pointer dereferences.  This makes several lines shorter,
    which allows to avoid wrapping making code more readable.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Jonathan Cameron 

commit 48de61f6c135ec03d9a1d644411ea501f7d49dff
Author: Krzysztof Kozlowski 
Date:   Sun Dec 21 15:26:03 2025 +0100

    iio: adc: aspeed: Simplify probe() with local 'dev' and 'np'
    
    Simplify the probe function by using local 'dev' and 'np' variables
    instead of full pointer dereferences.  This makes several lines shorter,
    which allows to avoid wrapping making code more readable.  While
    touching the return line, simplify by avoiding unnecessary 'ret'
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Jonathan Cameron 

commit da1d3596b1e456b5d5d5f719bbf5ce562f4fe22d
Author: Jorge Marques 
Date:   Wed Dec 17 13:13:32 2025 +0100

    iio: adc: ad4062: Add GPIO Controller support
    
    When gp0 or gp1 is not taken as an interrupt, expose them as GPO if
    gpio-contoller is set in the devicetree. gpio-regmap is not used
    because the GPO static low is 'b101 and static high is 0b110; low state
    requires setting bit 0, not fitting the abstraction of low=0 and
    high=mask.
    
    Signed-off-by: Jorge Marques 
    Reviewed-by: Linus Walleij 
    Acked-by: Bartosz Golaszewski 
    Signed-off-by: Jonathan Cameron 

commit d2ca7af298fe4c373bce2d6714649b887f6426d8
Author: Jorge Marques 
Date:   Wed Dec 17 13:13:31 2025 +0100

    docs: iio: ad4062: Add GPIO Controller support
    
    Explains the GPIO controller support with emphasis on the mask
    depending on which GPs are exposed.
    
    Signed-off-by: Jorge Marques 
    Reviewed-by: Linus Walleij 
    Signed-off-by: Jonathan Cameron 

commit ba3a34b1f5cefd51b210659fa5861b23b17ebb57
Author: Jorge Marques 
Date:   Wed Dec 17 13:13:30 2025 +0100

    iio: adc: ad4062: Add IIO Events support
    
    Adds support for IIO Events. Optionally, gp0 is assigned as Threshold
    Either signal, if not present, fallback to an I3C IBI with the same
    role.
    
    Signed-off-by: Jorge Marques 
    Signed-off-by: Jonathan Cameron 

commit c894e05871b4ccd4b0829382aed2c586490c700f
Author: Jorge Marques 
Date:   Wed Dec 17 13:13:29 2025 +0100

    docs: iio: ad4062: Add IIO Events support
    
    Explains the IIO Events support.
    
    Signed-off-by: Jorge Marques 
    Signed-off-by: Jonathan Cameron 

commit 23cc92280302d4e4f5f4253b6ff1dbeeb82a9464
Author: Jorge Marques 
Date:   Wed Dec 17 13:13:28 2025 +0100

    iio: adc: ad4062: Add IIO Trigger support
    
    Adds support for IIO Trigger. Optionally, gp1 is assigned as Data Ready
    signal, if not present, fallback to an I3C IBI with the same role.
    The software trigger is allocated by the device, but must be attached by
    the user before enabling the buffer. The purpose is to not impede
    removing the driver due to the increased reference count when
    iio_trigger_set_immutable() or iio_trigger_get() is used.
    
    Signed-off-by: Jorge Marques 
    Signed-off-by: Jonathan Cameron 

commit c31721dc0bb5aaf1b93f26193fece15b857f5783
Author: Jorge Marques 
Date:   Wed Dec 17 13:13:27 2025 +0100

    docs: iio: ad4062: Add IIO Trigger support
    
    Explains the IIO Trigger support and timings involved.
    
    Signed-off-by: Jorge Marques 
    Signed-off-by: Jonathan Cameron 

commit d5284402d28f30dbbe74b9823a324a998a8306d8
Author: Jorge Marques 
Date:   Wed Dec 17 13:13:26 2025 +0100

    iio: adc: Add support for ad4062
    
    The AD4060/AD4062 are versatile, 16-bit/12-bit, successive approximation
    register (SAR) analog-to-digital converter (ADC) with low-power and
    threshold monitoring modes.
    
    Signed-off-by: Jorge Marques 
    Signed-off-by: Jonathan Cameron 

commit 1b1ddab0249c607ab6fc4388d6c121a23c1b5409
Author: Jorge Marques 
Date:   Wed Dec 17 13:13:25 2025 +0100

    docs: iio: New docs for ad4062 driver
    
    This adds a new page to document how to use the ad4062 ADC driver.
    
    Signed-off-by: Jorge Marques 
    Signed-off-by: Jonathan Cameron 

commit 9e6c7656b9977e902fe7a99d61da00e3f6bc41a4
Author: Jorge Marques 
Date:   Wed Dec 17 13:13:24 2025 +0100

    dt-bindings: iio: adc: Add adi,ad4062
    
    Add dt-bindings for AD4062 family, devices AD4060/AD4062, low-power with
    monitor capabilities SAR ADCs. Each variant of the family differs in
    resolution. The device contains two outputs (gp0, gp1). The outputs can
    be configured for range of options, such as threshold and data ready.
    The device uses a 2-wire I3C interface.
    
    Signed-off-by: Jorge Marques 
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Jonathan Cameron 

commit bf394cc8036989c9cc7d82ddede4c57e24912dc4
Author: Ariana Lazar 
Date:   Tue Dec 16 14:05:51 2025 +0200

    iio: dac: adding support for Microchip MCP47FEB02
    
    This is the iio driver for Microchip MCP47F(E/V)B(0/1/2)1,
    MCP47F(E/V)B(0/1/2)2, MCP47F(E/V)B(0/1/2)4 and MCP47F(E/V)B(0/1/2)8 series
    of buffered voltage output Digital-to-Analog Converters with nonvolatile or
    volatile memory and an I2C Interface.
    
    The families support up to 8 output channels.
    
    The devices can be 8-bit, 10-bit and 12-bit.
    
    Signed-off-by: Ariana Lazar 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 3e6ad272bb8b3199bad952e7b077102af2d8df03
Author: Clint George 
Date:   Mon Dec 15 14:20:22 2025 +0530

    kselftest/kublk: include message in _Static_assert for C11 compatibility
    
    Add descriptive message in the _Static_assert to comply with the C11
    standard requirement to prevent compiler from throwing out error. The
    compiler throws an error when _Static_assert is used without a message as
    that is a C23 extension.
    
    [] Testing:
    The diff between before and after of running the kselftest test of the
    module shows no regression on system with x86 architecture
    
    [] Error log:
    ~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk$ make LLVM=1 W=1
      CC       kublk
    In file included from kublk.c:6:
    ./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
      220 |         _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
          |                                                  ^
          |                                                  , ""
    1 error generated.
    In file included from null.c:3:
    ./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
      220 |         _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
          |                                                  ^
          |                                                  , ""
    1 error generated.
    In file included from file_backed.c:3:
    ./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
      220 |         _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
          |                                                  ^
          |                                                  , ""
    1 error generated.
    In file included from common.c:3:
    ./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
      220 |         _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
          |                                                  ^
          |                                                  , ""
    1 error generated.
    In file included from stripe.c:3:
    ./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
      220 |         _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
          |                                                  ^
          |                                                  , ""
    1 error generated.
    In file included from fault_inject.c:11:
    ./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
      220 |         _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
          |                                                  ^
          |                                                  , ""
    1 error generated.
    make: *** [../lib.mk:225: ~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk/kublk] Error 1
    
    Link: https://lore.kernel.org/r/20251215085022.7642-1-clintbgeorge@gmail.com
    Signed-off-by: Clint George 
    Reviewed-by: Ming Lei 
    Signed-off-by: Shuah Khan 

commit 0aaff7b109037c0a45def1bed7b76ffaf253f7d0
Author: Clint George 
Date:   Mon Dec 15 14:19:00 2025 +0530

    kselftest/anon_inode: replace null pointers with empty arrays
    
    Make use of empty (NULL-terminated) array instead of NULL pointer to
    avoid compiler errors while maintaining the behavior of the function
    intact
    
    [] Testing:
    The diff between before and after of running the kselftest test of the
    module shows no regression on system with x86 architecture
    
    [] Error log:
    ~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/filesystems$ make LLVM=1 W=1
      CC       devpts_pts
      CC       file_stressor
      CC       anon_inode_test
    anon_inode_test.c:45:37: warning: null passed to a callee that requires a non-null argument [-Wnonnull]
       45 |         ASSERT_LT(execveat(fd_context, "", NULL, NULL, AT_EMPTY_PATH), 0);
          |                                            ^~~~
    /usr/lib/llvm-18/lib/clang/18/include/__stddef_null.h:26:14: note: expanded from macro 'NULL'
       26 | #define NULL ((void*)0)
          |              ^~~~~~~~~~
    ../Desktop/kernel-dev/linux-v1/tools/testing/selftests/../../../tools/testing/selftests/kselftest_harness.h:535:11: note: expanded from macro 'ASSERT_LT'
      535 |         __EXPECT(expected, #expected, seen, #seen, <, 1)
          |                  ^~~~~~~~
    ../Desktop/kernel-dev/linux-v1/tools/testing/selftests/../../../tools/testing/selftests/kselftest_harness.h:758:33: note: expanded from macro '__EXPECT'
      758 |         __typeof__(_expected) __exp = (_expected); \
          |                                        ^~~~~~~~~
    1 warning generated.
    
    Link: https://lore.kernel.org/r/20251215084900.7590-1-clintbgeorge@gmail.com
    Signed-off-by: Clint George 
    Signed-off-by: Shuah Khan 

commit 673a55cc49dafe47defb9ad76a73987fe89e5d70
Author: Clint George 
Date:   Mon Dec 15 14:17:37 2025 +0530

    kselftest/coredump: use __builtin_trap() instead of null pointer
    
    Use __builtin_trap() to truly crash the program instead of dereferencing
    null pointer which may be optimized by the compiler preventing the crash
    from occurring
    
    [] Testing:
    The diff between before and after of running the kselftest test of the
    module shows no regression on system with x86 architecture
    
    [] Error log:
    ~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/coredump$ make LLVM=1 W=1
      CC       stackdump_test
    coredump_test_helpers.c:59:6: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference]
       59 |         i = *(int *)NULL;
          |             ^~~~~~~~~~~~
    coredump_test_helpers.c:59:6: note: consider using __builtin_trap() or qualifying pointer with 'volatile'
    1 warning generated.
      CC       coredump_socket_test
    coredump_test_helpers.c:59:6: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference]
       59 |         i = *(int *)NULL;
          |             ^~~~~~~~~~~~
    coredump_test_helpers.c:59:6: note: consider using __builtin_trap() or qualifying pointer with 'volatile'
    1 warning generated.
      CC       coredump_socket_protocol_test
    coredump_test_helpers.c:59:6: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference]
       59 |         i = *(int *)NULL;
          |             ^~~~~~~~~~~~
    coredump_test_helpers.c:59:6: note: consider using __builtin_trap() or qualifying pointer with 'volatile'
    1 warning generated.
    
    Link: https://lore.kernel.org/r/20251215084737.7504-1-clintbgeorge@gmail.com
    Signed-off-by: Clint George 
    Signed-off-by: Shuah Khan 

commit 1a8fa7faf4890d201aad4f5d4943f74d840cd0ba
Author: Ihor Solodrai 
Date:   Tue Dec 30 17:25:57 2025 -0800

    resolve_btfids: Implement --patch_btfids
    
    Recent changes in BTF generation [1] rely on ${OBJCOPY} command to
    update .BTF_ids section data in target ELF files.
    
    This exposed a bug in llvm-objcopy --update-section code path, that
    may lead to corruption of a target ELF file. Specifically, because of
    the bug st_shndx of some symbols may be (incorrectly) set to 0xffff
    (SHN_XINDEX) [2][3].
    
    While there is a pending fix for LLVM, it'll take some time before it
    lands (likely in 22.x). And the kernel build must keep working with
    older LLVM toolchains in the foreseeable future.
    
    Using GNU objcopy for .BTF_ids update would work, but it would require
    changes to LLVM-based build process, likely breaking existing build
    environments as discussed in [2].
    
    To work around llvm-objcopy bug, implement --patch_btfids code path in
    resolve_btfids as a drop-in replacement for:
    
        ${OBJCOPY} --update-section .BTF_ids=${btf_ids} ${elf}
    
    Which works specifically for .BTF_ids section:
    
        ${RESOLVE_BTFIDS} --patch_btfids ${btf_ids} ${elf}
    
    This feature in resolve_btfids can be removed at some point in the
    future, when llvm-objcopy with a relevant bugfix becomes common.
    
    [1] https://lore.kernel.org/bpf/20251219181321.1283664-1-ihor.solodrai@linux.dev/
    [2] https://lore.kernel.org/bpf/20251224005752.201911-1-ihor.solodrai@linux.dev/
    [3] https://github.com/llvm/llvm-project/issues/168060#issuecomment-3533552952
    
    Signed-off-by: Ihor Solodrai 
    Link: https://lore.kernel.org/r/20251231012558.1699758-1-ihor.solodrai@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit c0e4a193ae91e5dcfbb920b2ba74599b05e2b2eb
Merge: ccaa6d2c9635a8 4fd99103eef347
Author: Alexei Starovoitov 
Date:   Wed Dec 31 09:01:13 2025 -0800

    Merge branch 'bpf-unify-state-pruning-handling-of-invalid-misc-stack-slots'
    
    Eduard Zingerman says:
    
    ====================
    bpf: unify state pruning handling of invalid/misc stack slots
    
    This change unifies states pruning handling of NOT_INIT registers,
    STACK_INVALID/STACK_MISC stack slots for regular and iterator/callback
    based loop cases.
    
    The change results in a modest verifier performance improvement:
    
    ========= selftests: master vs loop-stack-misc-pruning =========
    
    File                             Program               Insns (A)  Insns (B)  Insns     (DIFF)
    -------------------------------  --------------------  ---------  ---------  ----------------
    test_tcp_custom_syncookie.bpf.o  tcp_custom_syncookie      38307      18430  -19877 (-51.89%)
    xdp_synproxy_kern.bpf.o          syncookie_tc              23035      19067   -3968 (-17.23%)
    xdp_synproxy_kern.bpf.o          syncookie_xdp             21022      18516   -2506 (-11.92%)
    
    Total progs: 4173
    Old success: 2520
    New success: 2521
    total_insns diff min:  -99.99%
    total_insns diff max:    0.00%
    0 -> value: 0
    value -> 0: 0
    total_insns abs max old: 837,487
    total_insns abs max new: 837,487
    -100 .. -90  %: 1
     -60 .. -50  %: 3
     -50 .. -40  %: 2
     -40 .. -30  %: 2
     -30 .. -20  %: 8
     -20 .. -10  %: 4
     -10 .. 0    %: 5
       0 .. 5    %: 4148
    
    ========= scx: master vs loop-stack-misc-pruning =========
    
    File                       Program           Insns (A)  Insns (B)  Insns     (DIFF)
    -------------------------  ----------------  ---------  ---------  ----------------
    scx_arena_selftests.bpf.o  arena_selftest       257545     243678   -13867 (-5.38%)
    scx_chaos.bpf.o            chaos_dispatch        13989      12804    -1185 (-8.47%)
    scx_layered.bpf.o          layered_dispatch      27600      13925  -13675 (-49.55%)
    
    Total progs: 305
    Old success: 292
    New success: 292
    total_insns diff min:  -49.55%
    total_insns diff max:    0.00%
    0 -> value: 0
    value -> 0: 0
    total_insns abs max old: 257,545
    total_insns abs max new: 243,678
     -50 .. -45  %: 7
     -30 .. -20  %: 5
     -20 .. -10  %: 14
     -10 .. 0    %: 18
       0 .. 5    %: 261
    
    There is also a significant verifier performance improvement for some
    bpf_loop() heavy Meta internal programs (~ -40% processed instructions).
    ====================
    
    Link: https://patch.msgid.link/20251230-loop-stack-misc-pruning-v1-0-585cfd6cec51@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit 4fd99103eef347174b3c9b6071428324a3cf9a60
Author: Eduard Zingerman 
Date:   Tue Dec 30 21:36:04 2025 -0800

    selftests/bpf: iterator based loop and STACK_MISC states pruning
    
    The test case first initializes 9 stack slots as STACK_MISC,
    then conditionally updates each of them to SCALAR spill inside an
    iterator based loop. This leads to 2**9 combinations of MISC/SPILL
    marks for these slots at the iterator next call.
    The loop converges only if the verifier treats such states as
    equivalent, otherwise visited states are evicted from the states cache
    too quickly.
    
    Signed-off-by: Eduard Zingerman 
    Link: https://lore.kernel.org/r/20251230-loop-stack-misc-pruning-v1-2-585cfd6cec51@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit 840692326e92b5deb76c224931e8ca145ce7cfb8
Author: Eduard Zingerman 
Date:   Tue Dec 30 21:36:03 2025 -0800

    bpf: allow states pruning for misc/invalid slots in iterator loops
    
    Within an iterator or callback based loop, it should be safe to prune
    the current state if the old state stack slot is marked as
    STACK_INVALID or STACK_MISC:
    - either all branches of the old state lead to a program exit;
    - or some branch of the old state leads the current state.
    
    This is the same logic as applied in non-loop cases when
    states_equal() is called in NOT_EXACT mode.
    
    The test case that exercises stacksafe() and demonstrates the
    difference in verification performance is included in the next patch.
    I'm not sure if it is possible to prepare a test case that exercises
    regsafe(); it appears that the compute_live_registers() pass makes
    this impossible.
    
    Nevertheless, for code readability reasons, I think that stacksafe()
    and regsafe() should handle STACK_INVALID / NOT_INIT symmetrically.
    Hence, this commit changes both functions.
    
    Signed-off-by: Eduard Zingerman 
    Link: https://lore.kernel.org/r/20251230-loop-stack-misc-pruning-v1-1-585cfd6cec51@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit 94968fc3009d4bd7e7e1300abd7037f3dde585ed
Author: Julia Lawall 
Date:   Wed Dec 31 17:11:16 2025 +0100

    ALSA: echoaudio: adjust function name
    
    The function restore_dsp_rettings sets a lot of things, so change the
    name to the more natural restore_dsp_settings.  This name was indeed
    already used in a comment above the code in
    sound/pci/echoaudio/echoaudio.c.
    
    Signed-off-by: Julia Lawall 
    Link: https://patch.msgid.link/20251231161116.141071-1-Julia.Lawall@inria.fr
    Signed-off-by: Takashi Iwai 

commit 60dd3ace961ec037ecb4c80c3a22627715d9ac71
Author: Julia Lawall 
Date:   Tue Dec 30 15:01:03 2025 +0100

    ALSA: ice1724: adjust function name reference
    
    The code just below the comment is_pro_rate_locked(), so it seems
    like that was what was intended for the comment.
    
    Signed-off-by: Julia Lawall 
    Link: https://patch.msgid.link/20251230140103.93134-1-Julia.Lawall@inria.fr
    Signed-off-by: Takashi Iwai 

commit 537cd8fd3c58525ab407a3e80e170bc86a3e96ca
Author: Julia Lawall 
Date:   Tue Dec 30 14:22:35 2025 +0100

    ALSA: mixart: adjust field name reference
    
    buf_period_pos seems to not have existed in the git history, but the
    buf_period_frag field is used with the buf_periods field in the
    function snd_mixart_stream_pointer in mixart.c, so it seems that
    buf_periods is what was intended.
    
    Signed-off-by: Julia Lawall 
    Link: https://patch.msgid.link/20251230132235.90687-1-Julia.Lawall@inria.fr
    Signed-off-by: Takashi Iwai 

commit e21279b73ef6c7d27237912c914f2db0c5a74786
Author: Borislav Petkov (AMD) 
Date:   Thu Dec 4 13:48:08 2025 +0100

    x86/sev: Carve out the SVSM code into a separate compilation unit
    
    Move the SVSM-related machinery into a separate compilation unit in
    order to keep sev/core.c slim and "on-topic".
    
    No functional changes.
    
    Reviewed-by: Tom Lendacky 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251204124809.31783-4-bp@kernel.org

commit f01c6489ad6ceb8d06eae0c5123fc6cf39276ff1
Author: Borislav Petkov (AMD) 
Date:   Thu Dec 4 13:48:07 2025 +0100

    x86/sev: Add internal header guards
    
    All headers need guards ifdeffery.
    
    Reviewed-by: Tom Lendacky 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251204124809.31783-3-bp@kernel.org

commit c1e8980fabf5d0106992a430284fac28bba053a6
Author: Borislav Petkov (AMD) 
Date:   Thu Dec 4 13:48:06 2025 +0100

    x86/sev: Move the internal header
    
    Move the internal header out of the usual include/asm/ include path
    because having an "internal" header there doesn't really make it
    internal - quite the opposite - that's the normal arch include path.
    
    So move where it belongs and make it really internal.
    
    No functional changes.
    
    Reviewed-by: Tom Lendacky 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://lore.kernel.org/r/20251204145716.GDaTGhTEHNOtSdTkEe@fat_crate.local

commit 91a0b0dce350766675961892ba4431363c4e29f7
Author: Uwe Kleine-König 
Date:   Thu Dec 18 21:42:16 2025 +0100

    bus: mhi: ep: Use bus callbacks for .probe() and .remove()
    
    These are nearly identical to the driver callbacks, the only relevant
    difference is that the bus remove method returns void (instead of an int
    where the value is ignored).
    
    The objective is to get rid of users of struct device_driver callbacks
    .probe(), and .remove() to eventually remove these.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/2a79d99182a5171e83a07bf9f438ae31362f7e5d.1766090211.git.ukleinek@kernel.org

commit 8535df5dd64ec02d85e65dbcf79a59db9c16d921
Author: Uwe Kleine-König 
Date:   Thu Dec 18 21:42:15 2025 +0100

    bus: mhi: host: Use bus callbacks for .probe() and .remove()
    
    These are nearly identical to the driver callbacks, the only relevant
    difference is that the bus remove method returns void (instead of an int
    where the value is ignored).
    
    The objective is to get rid of users of struct device_driver callbacks
    .probe(), and .remove() to eventually remove these.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/e8032b3c2a8953a4a2b84dfa79a260c35f1d71b7.1766090211.git.ukleinek@kernel.org

commit 4a9ba211d0264131dcfca0cbc10bff5ff277ff0a
Author: Manivannan Sadhasivam 
Date:   Thu Dec 18 22:21:45 2025 +0530

    bus: mhi: host: Drop the auto_queue support
    
    Now that the only user of the 'auto_queue' feature, (QRTR) has been
    converted to manage the buffers on its own, drop the code related to it.
    
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Loic Poulain 
    Reviewed-by: Jeff Hugo 
    Link: https://patch.msgid.link/20251218-qrtr-fix-v2-2-c7499bfcfbe0@oss.qualcomm.com

commit 51731792a25cb312ca94cdccfa139eb46de1b2ef
Author: Manivannan Sadhasivam 
Date:   Thu Dec 18 22:21:44 2025 +0530

    net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
    
    MHI stack offers the 'auto_queue' feature, which allows the MHI stack to
    auto queue the buffers for the RX path (DL channel). Though this feature
    simplifies the client driver design, it introduces race between the client
    drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback'
    for the DL channel may get called before the client driver is fully probed.
    This means, by the time the dl_callback gets called, the client driver's
    structures might not be initialized, leading to NULL ptr dereference.
    
    Currently, the drivers have to workaround this issue by initializing the
    internal structures before calling mhi_prepare_for_transfer_autoqueue().
    But even so, there is a chance that the client driver's internal code path
    may call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is
    called, leading to similar NULL ptr dereference. This issue has been
    reported on the Qcom X1E80100 CRD machines affecting boot.
    
    So to properly fix all these races, drop the MHI 'auto_queue' feature
    altogether and let the client driver (QRTR) manage the RX buffers manually.
    In the QRTR driver, queue the RX buffers based on the ring length during
    probe and recycle the buffers in 'dl_callback' once they are consumed. This
    also warrants removing the setting of 'auto_queue' flag from controller
    drivers.
    
    Currently, this 'auto_queue' feature is only enabled for IPCR DL channel.
    So only the QRTR client driver requires the modification.
    
    Fixes: 227fee5fc99e ("bus: mhi: core: Add an API for auto queueing buffers for DL channel")
    Fixes: 68a838b84eff ("net: qrtr: start MHI channel after endpoit creation")
    Reported-by: Johan Hovold 
    Closes: https://lore.kernel.org/linux-arm-msm/ZyTtVdkCCES0lkl4@hovoldconsulting.com
    Suggested-by: Chris Lew 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Jeff Hugo 
    Reviewed-by: Loic Poulain 
    Acked-by: Jeff Johnson  # drivers/net/wireless/ath/...
    Acked-by: Jeff Hugo 
    Acked-by: Paolo Abeni 
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251218-qrtr-fix-v2-1-c7499bfcfbe0@oss.qualcomm.com

commit f6a15d85498614baf121f7e207e6c55524f175a4
Author: Jason Wang 
Date:   Tue Dec 30 14:46:49 2025 +0800

    virtio_ring: add in order support
    
    This patch implements in order support for both split virtqueue and
    packed virtqueue. Performance could be gained for the device where the
    memory access could be expensive (e.g vhost-net or a real PCI device):
    
    Benchmark with KVM guest:
    
    Vhost-net on the host: (pktgen + XDP_DROP):
    
             in_order=off | in_order=on | +%
        TX:  4.51Mpps     | 5.30Mpps    | +17%
        RX:  3.47Mpps     | 3.61Mpps    | + 4%
    
    Vhost-user(testpmd) on the host: (pktgen/XDP_DROP):
    
    For split virtqueue:
    
             in_order=off | in_order=on | +%
        TX:  5.60Mpps     | 5.60Mpps    | +0.0%
        RX:  9.16Mpps     | 9.61Mpps    | +4.9%
    
    For packed virtqueue:
    
             in_order=off | in_order=on | +%
        TX:  5.60Mpps     | 5.70Mpps    | +1.7%
        RX:  10.6Mpps     | 10.8Mpps    | +1.8%
    
    Benchmark also shows no performance impact for in_order=off for queue
    size with 256 and 1024.
    
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-20-jasowang@redhat.com>

commit 519b206e30a37f16cfa88a2f6a508642f7d8fd0c
Author: Jason Wang 
Date:   Tue Dec 30 14:46:48 2025 +0800

    virtio_ring: factor out split detaching logic
    
    This patch factors out the split core detaching logic that could be
    reused by in order feature into a dedicated function.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-19-jasowang@redhat.com>

commit 9dc6b944f16c0904331903ba0ec36e558e1a3537
Author: Jason Wang 
Date:   Tue Dec 30 14:46:47 2025 +0800

    virtio_ring: factor out split indirect detaching logic
    
    Factor out the split indirect descriptor detaching logic in order to
    allow it to be reused by the in order support.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-18-jasowang@redhat.com>

commit fa56d17b9241394aaa77ee622b72a1b765a48d6e
Author: Jason Wang 
Date:   Tue Dec 30 14:46:46 2025 +0800

    virtio_ring: factor out core logic for updating last_used_idx
    
    Factor out the core logic for updating last_used_idx to be reused by
    the packed in order implementation.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Tested-by: Lei Yang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-17-jasowang@redhat.com>

commit c623106c79c811816614dcb687ed5d08b25d5fe5
Author: Jason Wang 
Date:   Tue Dec 30 14:46:45 2025 +0800

    virtio_ring: factor out core logic of buffer detaching
    
    Factor out core logic of buffer detaching and leave the free list
    management to the caller so in_order can just call the core logic.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-16-jasowang@redhat.com>

commit 03f05c4eeb7bc5019deb25f7415a7af8dc3fdd3f
Author: Jason Wang 
Date:   Tue Dec 30 14:46:44 2025 +0800

    virtio_ring: determine descriptor flags at one time
    
    Let's determine the last descriptor by counting the number of sg. This
    would be consistent with packed virtqueue implementation and ease the
    future in-order implementation.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-15-jasowang@redhat.com>

commit 1208473f9b5eb273e787bb1b07a4b2a323692a10
Author: Jason Wang 
Date:   Tue Dec 30 14:46:43 2025 +0800

    virtio_ring: introduce virtqueue ops
    
    This patch introduces virtqueue ops which is a set of callbacks
    that will be called for different queue layout or features. This would
    help to avoid branches for split/packed and will ease the future
    implementation like in order.
    
    Note that in order to eliminate the indirect calls this patch uses
    global array of const ops to allow compiler to avoid indirect
    branches.
    
    Tested with CONFIG_MITIGATION_RETPOLINE, no performance differences
    were noticed.
    
    Acked-by: Eugenio Pérez 
    Suggested-by: Michael S. Tsirkin 
    Signed-off-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-14-jasowang@redhat.com>

commit eff8b47d2832150f96ab706562cef5a754a0d625
Author: Jason Wang 
Date:   Tue Dec 30 14:46:42 2025 +0800

    virtio_ring: switch to use unsigned int for virtqueue_poll_packed()
    
    Switch to use unsigned int for virtqueue_poll_packed() to match
    virtqueue_poll() and virtqueue_poll_split() and to ease the
    abstraction of the virtqueue ops.
    
    Signed-off-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-13-jasowang@redhat.com>

commit f2ad9d6b4eed59f880b1fcaf28e2ddaeb292b2df
Author: Jason Wang 
Date:   Tue Dec 30 14:46:41 2025 +0800

    virtio_ring: switch to use vring_virtqueue for detach_unused_buf variants
    
    Those variants are used internally so let's switch to use
    vring_virtqueue as parameter to be consistent with other internal
    virtqueue helpers.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Tested-by: Lei Yang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-12-jasowang@redhat.com>

commit 7e81017673fefa3726b60ca0a9999e621e99ff27
Author: Jason Wang 
Date:   Tue Dec 30 14:46:40 2025 +0800

    virtio_ring: switch to use vring_virtqueue for disable_cb variants
    
    Those variants are used internally so let's switch to use
    vring_virtqueue as parameter to be consistent with other internal
    virtqueue helpers.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Tested-by: Lei Yang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-11-jasowang@redhat.com>

commit 62fa22cdab7bc07f82e3f5080d7bf35f5f1bf676
Author: Jason Wang 
Date:   Tue Dec 30 14:46:39 2025 +0800

    virtio_ring: use vring_virtqueue for enable_cb_delayed variants
    
    Those variants are used internally so let's switch to use
    vring_virtqueue as parameter to be consistent with other internal
    virtqueue helpers.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-10-jasowang@redhat.com>

commit 74847cb5731760b22ace8e2fe97a330aa0162d1e
Author: Jason Wang 
Date:   Tue Dec 30 14:46:38 2025 +0800

    virtio_ring: switch to use vring_virtqueue for enable_cb_prepare variants
    
    Those variants are used internally so let's switch to use
    vring_virtqueue as parameter to be consistent with other internal
    virtqueue helpers.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Tested-by: Lei Yang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-9-jasowang@redhat.com>

commit ceea1cd0aef23e44c994127d62f51519ae3566fa
Author: Jason Wang 
Date:   Tue Dec 30 14:46:37 2025 +0800

    virtio: switch to use vring_virtqueue for virtqueue_get variants
    
    Those variants are used internally so let's switch to use
    vring_virtqueue as parameter to be consistent with other internal
    virtqueue helpers.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Tested-by: Lei Yang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-8-jasowang@redhat.com>

commit 4a0fa90b10a2b11522bcb808d90022f489b2ab27
Author: Jason Wang 
Date:   Tue Dec 30 14:46:36 2025 +0800

    virtio_ring: switch to use vring_virtqueue for virtqueue_add variants
    
    Those variants are used internally so let's switch to use
    vring_virtqueue as parameter to be consistent with other internal
    virtqueue helpers.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-7-jasowang@redhat.com>

commit 8b8590b70894f5934249f5735e164ee2121d6549
Author: Jason Wang 
Date:   Tue Dec 30 14:46:35 2025 +0800

    virtio_ring: switch to use vring_virtqueue for virtqueue_kick_prepare variants
    
    Those variants are used internally so let's switch to use
    vring_virtqueue as parameter to be consistent with other internal
    virtqueue helpers.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Tested-by: Lei Yang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-6-jasowang@redhat.com>

commit 9552bc05815447e04cc540ea034bb8632392c678
Author: Jason Wang 
Date:   Tue Dec 30 14:46:34 2025 +0800

    virtio_ring: switch to use vring_virtqueue for virtqueue resize variants
    
    Those variants are used internally so let's switch to use
    vring_virtqueue as parameter to be consistent with other internal
    virtqueue helpers.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-5-jasowang@redhat.com>

commit 40da006f137dbbd16b657da37f6ea4fb8ad13671
Author: Jason Wang 
Date:   Tue Dec 30 14:46:33 2025 +0800

    virtio_ring: unify logic of virtqueue_poll() and more_used()
    
    This patch unifies the logic of virtqueue_poll() and more_used() for
    better code reusing and ease the future in order implementation.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Tested-by: Lei Yang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-4-jasowang@redhat.com>

commit 79f6d682937dd91c5ed3a1050fa99cb4369dd720
Author: Jason Wang 
Date:   Tue Dec 30 14:46:32 2025 +0800

    virtio_ring: switch to use vring_virtqueue in virtqueue_poll variants
    
    Those variants are used internally so let's switch to use
    vring_virtqueue as parameter to be consistent with other internal
    virtqueue helpers.
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Tested-by: Lei Yang 
    Reviewed-by: Eugenio Pérez 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-3-jasowang@redhat.com>

commit 8ce8e3e5582e85f6533b5013806299a8efba67f0
Author: Jason Wang 
Date:   Tue Dec 30 14:46:31 2025 +0800

    virtio_ring: rename virtqueue_reinit_xxx to virtqueue_reset_xxx()
    
    To be consistent with virtqueue_reset().
    
    Acked-by: Eugenio Pérez 
    Reviewed-by: Xuan Zhuo 
    Signed-off-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251230064649.55597-2-jasowang@redhat.com>

commit 8818ffb04bfa168dfe5056cd24cee5211dcc4b3c
Author: Lianfa Weng 
Date:   Tue Dec 30 23:49:11 2025 +0800

    RDMA/hns: Introduce limit_bank mode with better performance
    
    In limit_bank mode, QPs/CQs are restricted to using half of the banks.
    HW concentrates resources on these banks, thereby improving performance
    compared to the default mode.
    
    Switch between limit_bank mode and default mode by setting the cap
    flag in FW. Since the number of QPs and CQs will be halved, this mode
    is suitable for scenarios where fewer QPs and CQs are required.
    
    Signed-off-by: Lianfa Weng 
    Signed-off-by: Junxian Huang 
    Link: https://patch.msgid.link/20251230154911.3397584-1-huangjunxian6@hisilicon.com
    Signed-off-by: Leon Romanovsky 

commit 6a0b7392a6f5487fb58704926a24b1e2ee2762e9
Author: Dian-Syuan Yang 
Date:   Mon Dec 29 11:09:26 2025 +0800

    wifi: rtw89: enhance connection stability when triggering beacon loss
    
    If the driver supports ack status reports of TX frames, mac80211 allows it
    to detect AP if it's alive and determine whether the client can maintain
    the connection by sending null-data. Therefore, refine the flow to let
    driver inform mac80211 to enable beacon loss work to track AP's status
    upon receiving beacon loss event.
    
    Signed-off-by: Dian-Syuan Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-13-pkshih@realtek.com

commit 8c96752d99c0b094af68317a8c701b09bd0862d9
Author: Zong-Zhe Yang 
Date:   Mon Dec 29 11:09:25 2025 +0800

    wifi: rtw89: regd: 6 GHz power type marks default when inactive
    
    When inactive, 6 GHz power type has been assigned to the default one,
    but missed to mark the local control variable, dflt, true. Then, this
    might let some 6 GHz power info of disconnected APs keep being taken
    into account under certain cases.
    
    So, mark default when inactive.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-12-pkshih@realtek.com

commit 9587ffbbd9aaf20463927bac17f41ee21e81c494
Author: Chih-Kang Chang 
Date:   Mon Dec 29 11:09:24 2025 +0800

    wifi: rtw89: 8922a: configure FW version for SCAN_OFFLOAD_EXTRA_OP feature
    
    8922a supports SCAN_OFFLOAD_EXTRA_OP feature. Enable it, FW can do
    back-op and TX NULL frames on the second connection.
    
    Signed-off-by: Chih-Kang Chang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-11-pkshih@realtek.com

commit fe17b1852fdfe5c1cb87d4d39b91f09ace7e18ae
Author: Chih-Kang Chang 
Date:   Mon Dec 29 11:09:23 2025 +0800

    wifi: rtw89: refine TX nulldata judgement when scan with 2 OP channels
    
    When scan with 2 OP channels, for the case like
    not-connect(macid 0) + GO(macid 1) or not-connect(macid 0) + GC(macid 1),
    the macid 0 doesn't offload NULL data packet to FW. Therefore, refine the
    NULL data judgement to let interfaces that only connected and non-AP mode
    need to TX nulldata.
    
    Signed-off-by: Chih-Kang Chang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-10-pkshih@realtek.com

commit 8cb147e23712c937820761b4f43f78074b27e6ed
Author: Ping-Ke Shih 
Date:   Mon Dec 29 11:09:22 2025 +0800

    wifi: rtw89: add default quirks as features to chip_info
    
    The coming chip will support thermal protection by default, so add default
    quirks to chip_info.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-9-pkshih@realtek.com

commit d57ec29478d64b191d1dea26f577f9c78920850d
Author: Ping-Ke Shih 
Date:   Mon Dec 29 11:09:21 2025 +0800

    wifi: rtw89: read chip ID for RTL8922D variants
    
    The coming RTL8922D has many kinds of hardware variants. Read chips ID
    ahead, so we can configure proper hardware settings accordingly.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-8-pkshih@realtek.com

commit 9e389ad5d15962636de4e78febf609a954545d49
Author: Ping-Ke Shih 
Date:   Mon Dec 29 11:09:20 2025 +0800

    wifi: rtw89: efuse: read hardware version from efuse for WiFi 7 chips
    
    Hardware version from efuse prioritizes to the version from register.
    For WiFi 7 chips, this becomes required, so implement this in common flow.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-7-pkshih@realtek.com

commit 040af1ac8002cff5bddc5ce7e0d3b41bc0db659d
Author: Kuan-Chung Chen 
Date:   Mon Dec 29 11:09:19 2025 +0800

    wifi: rtw89: define TX/RX aggregation and MPDU capability per chip
    
    Since TX/RX aggregation is different from chip to chip, define individual
    number according to hardware ability. Also the coming chip RTL8922DE
    can get expected performance.
    
    Signed-off-by: Kuan-Chung Chen 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-6-pkshih@realtek.com

commit cfa262efabb7ce9d9f28633efd52115467137a46
Author: Chin-Yen Lee 
Date:   Mon Dec 29 11:09:18 2025 +0800

    wifi: rtw89: wow: abstract DMA check register for RTL8922DE
    
    The coming RTL8922DE use different register and its bit to poll if DMA
    becomes idle before entering WoWLAN. Abstract to share common flow.
    
    Signed-off-by: Chin-Yen Lee 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-5-pkshih@realtek.com

commit 295c47806bc58e6c364790cd780ffa461e1e512b
Author: Chin-Yen Lee 
Date:   Mon Dec 29 11:09:17 2025 +0800

    wifi: rtw89: wow: add WOW_CAM update function for 8922D
    
    For WOW_CAM update function, 8922DE use different H2C command from 8922AE.
    Use chip to distinguish them.
    
    Signed-off-by: Chin-Yen Lee 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-4-pkshih@realtek.com

commit 355f38849e75618ca764686742bbc56ab65e0846
Author: Ping-Ke Shih 
Date:   Mon Dec 29 11:09:16 2025 +0800

    wifi: rtw89: wow: change type of WoWLAN pattern mask to __le32
    
    The WoWLAN pattern mask is generated in byte stream, and actually firmware
    expects to see the same byte stream too. Since these byte stream is sent
    to firmware with 32-bit stream in little-endian order. Change to mask
    to __le32, and just do assignment instead of le32 conversion to wkfm fields
    of H2C command.
    
    For little-endian machine, it doesn't change logic at all.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-3-pkshih@realtek.com

commit 0b92c2cc4856811eaeeac5fdcbbc7bcd8eb05dc8
Author: Chin-Yen Lee 
Date:   Mon Dec 29 11:09:15 2025 +0800

    wifi: rtw89: wow: use struct style to fill WOW CAM H2C command
    
    The WOW CAM H2C command is used to tell firmware the content
    of pattern match. Use struct instead of macros to fill the data.
    
    Signed-off-by: Chin-Yen Lee 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251229030926.27004-2-pkshih@realtek.com

commit 86c946bcc00f6390ef65e9614ae60a9377e454f8
Author: Ali Tariq 
Date:   Thu Dec 25 11:54:29 2025 +0000

    wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
    
    The driver does not set hw->sta_data_size, which causes mac80211 to
    allocate insufficient space for driver private station data in
    __sta_info_alloc(). When rtl8xxxu_sta_add() accesses members of
    struct rtl8xxxu_sta_info through sta->drv_priv, this results in a
    slab-out-of-bounds write.
    
    KASAN report on RISC-V (VisionFive 2) with RTL8192EU adapter:
    
      BUG: KASAN: slab-out-of-bounds in rtl8xxxu_sta_add+0x31c/0x346
      Write of size 8 at addr ffffffd6d3e9ae88 by task kworker/u16:0/12
    
    Set hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during
    probe, similar to how hw->vif_data_size is configured. This ensures
    mac80211 allocates sufficient space for the driver's per-station
    private data.
    
    Tested on StarFive VisionFive 2 v1.2A board.
    
    Fixes: eef55f1545c9 ("wifi: rtl8xxxu: support multiple interfaces in {add,remove}_interface()")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ali Tariq 
    Reviewed-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251225115430.13011-1-alitariq45892@gmail.com

commit b4bf5e55899e8c2662a6f0e221128f590ac5f331
Author: Joseph Guo 
Date:   Tue Dec 30 16:58:54 2025 +0900

    arm64: dts: freescale: Add FRDM-IMX91 basic support
    
    The FRDM i.MX 91 development board is a low-cost and
    compact developmentboard featuring the i.MX 91 applications processor:
    https://www.nxp.com/design/design-center/development-boards-and-designs/FRDM-IMX91
    
    Add FRDM-IMX91 board dts support.
    - Enable ADC1.
    - Enable lpuart1 and lpuart5.
    - Enable network eqos and fec.
    - Enable I2C bus and children nodes under I2C bus.
    - Enable USB and related nodes.
    - Enable uSDHC1, uSDHC2 and uSDHC3.
    - Enable MU1 and MU2.
    - Enable Watchdog3.
    - Enable MQS
    
    Co-developed-by: Tom Zheng 
    Signed-off-by: Tom Zheng 
    Co-developed-by: Steven Yang 
    Signed-off-by: Steven Yang 
    Reviewed-by: Andrew Lunn 
    Reviewed-by: Francesco Valla 
    Tested-by: Francesco Valla 
    Signed-off-by: Joseph Guo 
    Signed-off-by: Shawn Guo 

commit 77e18c63a38bd149f74a53e9c232254431e4de1c
Author: Joseph Guo 
Date:   Tue Dec 30 16:58:53 2025 +0900

    dt-bindings: arm: fsl: Add FRDM-IMX91 board
    
    Add the board FRDM-IMX91 in the binding document.
    
    Reviewed-by: Daniel Baluta 
    Acked-by: Krzysztof Kozlowski 
    Reviewed-by: Francesco Valla 
    Tested-by: Francesco Valla 
    Signed-off-by: Joseph Guo 
    Signed-off-by: Shawn Guo 

commit 00398481e06b53fa120b408a0020d3281cfc8121
Author: Marek Vasut 
Date:   Tue Dec 30 02:40:35 2025 +0100

    arm64: dts: imx8mp: Update Data Modul i.MX8M Plus eDM SBC DT to rev.903
    
    Update the DT to match newest Data Modul i.MX8M Plus eDM SBC rev.903
    board which implements significant changes. Keep some of the rev.900
    and rev.902 nodes in the DT so that a DTO can be used to support old
    rev.900 and rev.902 boards easily.
    
    The changes from rev.900 to rev.902 are:
    - Both ethernet PHYs replaced from AR8031 to BCM54213PE
    - Both ethernet PHYs MDIO address changed
    - PCIe WiFi now comes with dedicated regulator
    - I2C TPM chip address
    - Additional GPIO expander for LVDS panel control added
    - Current EEPROM I2C address changed
    - Another optional EEPROM added onto another I2C bus
    
    The changes from rev.902 to rev.903 are:
    - Additional GPIO expander for WiFi and LVDS panel control added
    - Multiple GPIOs are reassigned
    
    Signed-off-by: Marek Vasut 
    Signed-off-by: Shawn Guo 

commit 1e78a43ec0a0e8e7b291b3320844d6a2b2c8d497
Author: Marek Vasut 
Date:   Tue Dec 30 02:40:34 2025 +0100

    dt-bindings: tpm: Add st,st33tphf2ei2c
    
    Add the ST chip st33tphf2ei2c to the supported compatible strings of the
    TPM TIS I2C schema. The chip is compliant with the TCG PC Client TPM
    Profile specification.
    
    For reference, a databrief is available at:
    https://www.st.com/resource/en/data_brief/st33tphf2ei2c.pdf
    
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Marek Vasut 
    Signed-off-by: Shawn Guo 

commit 6f6c18cba16fe5a8e6d60e5fd277059c2d18dbcc
Author: Frank Li 
Date:   Mon Dec 29 11:31:01 2025 -0500

    arm64: dts: imx8mp-evk: add camera ov5640 and related nodes
    
    Add camera ov5640 and related nodes.
    
    Signed-off-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit abc8424e7f967c8dcbafdd99ff688e7a35441128
Author: Philippe Schenker 
Date:   Fri Oct 31 13:49:43 2025 +0100

    arm64: dts: colibri-imx8x: Add cma memory
    
    Add CMA in device tree and set its size to 416MiB for all
    Colibri iMX8X.
    The size is tuned to be enough to play full HD video using gst-play
    and to fit in the SKU with the lowest amount of RAM (1GB).
    
    Signed-off-by: Philippe Schenker 
    Signed-off-by: Max Krummenacher 
    Signed-off-by: Shawn Guo 

commit d4dc56d8224d1c5a20e06939c817b28a60fbc35e
Author: Max Krummenacher 
Date:   Fri Oct 31 13:49:42 2025 +0100

    arm64: dts: colibri-imx8x: Add wi-fi 32kHz clock
    
    The Wi-Fi module requires a 32kHz clock to support Wi-Fi/BT low power
    operation.
    Setting the pinmuxing option on the connected pin to 32kHz is all
    needed to generated the signal.
    
    Signed-off-by: Max Krummenacher 
    Signed-off-by: Shawn Guo 

commit d703856872d5b875f46d1a781af1df6795780c20
Author: Philippe Schenker 
Date:   Fri Oct 31 13:49:41 2025 +0100

    arm64: dts: colibri-imx8x: Add backlight
    
    Add a backlight node to colibri-imx8x. The node can be enabled from
    an overlay once display output is implemented.
    
    Signed-off-by: Philippe Schenker 
    Signed-off-by: Max Krummenacher 
    Signed-off-by: Shawn Guo 

commit ccaa6d2c9635a8db06a494d67ef123b56b967a78
Merge: 317a5df78f24bd e6f2612f0e7c23
Author: Alexei Starovoitov 
Date:   Tue Dec 30 15:42:42 2025 -0800

    Merge branch 'bpf-calls-to-bpf_loop-should-have-an-scc-and-accumulate-backedges'
    
    Eduard Zingerman says:
    
    ====================
    bpf: calls to bpf_loop() should have an SCC and accumulate backedges
    
    This is a correctness fix for the verification of BPF programs that
    work with callback-calling functions. The problem is the same as the
    issue fixed by series [1] for iterator-based loops: some of the states
    created while processing the callback function body might have
    incomplete read or precision marks.
    
    An example of an unsafe program that is accepted without this fix can
    be found in patch #2.
    
    There is some impact on verification performance:
    
    File                             Program               Insns (A)  Insns (B)  Insns      (DIFF)
    -------------------------------  --------------------  ---------  ---------  -----------------
    pyperf600_bpf_loop.bpf.o         on_event                   4247       9985   +5738 (+135.11%)
    setget_sockopt.bpf.o             skops_sockopt              5719       7446    +1727 (+30.20%)
    setget_sockopt.bpf.o             socket_post_create         1253       1603     +350 (+27.93%)
    strobemeta_bpf_loop.bpf.o        on_event                   3424       7224   +3800 (+110.98%)
    test_tcp_custom_syncookie.bpf.o  tcp_custom_syncookie      11929      38307  +26378 (+221.12%)
    xdp_synproxy_kern.bpf.o          syncookie_tc              13986      23035    +9049 (+64.70%)
    xdp_synproxy_kern.bpf.o          syncookie_xdp             13881      21022    +7141 (+51.44%)
    
    Total progs: 4172
    Old success: 2520
    New success: 2520
    total_insns diff min:    0.00%
    total_insns diff max:  221.12%
    0 -> value: 0
    value -> 0: 0
    total_insns abs max old: 837,487
    total_insns abs max new: 837,487
       0 .. 5    %: 4163
       5 .. 15   %: 2
      25 .. 35   %: 2
      50 .. 60   %: 1
      60 .. 70   %: 1
     110 .. 120  %: 1
     135 .. 145  %: 1
     220 .. 225  %: 1
    
    [1] https://lore.kernel.org/bpf/174968344350.3524559.14906547029551737094.git-patchwork-notify@kernel.org/
    ---
    ====================
    
    Link: https://patch.msgid.link/20251229-scc-for-callbacks-v1-0-ceadfe679900@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit e6f2612f0e7c23ce991d3094b5387caf1a52a4fe
Author: Eduard Zingerman 
Date:   Mon Dec 29 23:13:08 2025 -0800

    selftests/bpf: test cases for bpf_loop SCC and state graph backedges
    
    Test for state graph backedges accumulation for SCCs formed by
    bpf_loop(). Equivalent to the following C program:
    
      int main(void) {
        1: fp[-8] = bpf_get_prandom_u32();
        2: fp[-16] = -32;                       // used in a memory access below
        3: bpf_loop(7, loop_cb4, fp, 0);
        4: return 0;
      }
    
      int loop_cb4(int i, void *ctx) {
        5: if (unlikely(ctx[-8] > bpf_get_prandom_u32()))
        6:   *(u64 *)(fp + ctx[-16]) = 42;      // aligned access expected
        7: if (unlikely(fp[-8] > bpf_get_prandom_u32()))
        8:   ctx[-16] = -31;                    // makes said access unaligned
        9: return 0;
      }
    
    If state graph backedges are not accumulated properly at the SCC
    formed by loop_cb4() call from bpf_loop(), the state {ctx[-16]=-32}
    injected at instruction 9 on verification path 1,2,3,5,7,9,4 would be
    considered fully verified and would lack precision mark for ctx[-16].
    This would lead to early pruning of verification path 1,2,3,5,7,8,9 in
    state {ctx[-16]=-31}, which in turn leads to the incorrect assumption
    that the above program is safe.
    
    Signed-off-by: Eduard Zingerman 
    Link: https://lore.kernel.org/r/20251229-scc-for-callbacks-v1-2-ceadfe679900@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit f597664454bde5ac45ceaf24da55b590ccfa60e3
Author: Eduard Zingerman 
Date:   Mon Dec 29 23:13:07 2025 -0800

    bpf: bpf_scc_visit instance and backedges accumulation for bpf_loop()
    
    Calls like bpf_loop() or bpf_for_each_map_elem() introduce loops that
    are not explicitly present in the control-flow graph. The verifier
    processes such calls by repeatedly interpreting the callback function
    body within the same verification path (until the current state
    converges with a previous state).
    
    Such loops require a bpf_scc_visit instance in order to allow the
    accumulation of the state graph backedges. Otherwise, certain
    checkpoint states created within the bodies of such loops will have
    incomplete precision marks.
    
    See the next patch for an example of a program that leads to the
    verifier accepting an unsafe program.
    
    Fixes: 96c6aa4c63af ("bpf: compute SCCs in program control flow graph")
    Fixes: c9e31900b54c ("bpf: propagate read/precision marks over state graph backedges")
    Reported-by: Breno Leitao 
    Signed-off-by: Eduard Zingerman 
    Tested-by: Breno Leitao 
    Link: https://lore.kernel.org/r/20251229-scc-for-callbacks-v1-1-ceadfe679900@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit 317a5df78f24bd77fb770a26eb85bf39620592e0
Author: Puranjay Mohan 
Date:   Tue Dec 30 11:51:32 2025 -0800

    selftests/bpf: Fix verifier_arena_large/big_alloc3 test
    
    The big_alloc3() test tries to allocate 2051 pages at once in
    non-sleepable context and this can fail sporadically on resource
    contrained systems, so skip this test in case of such failures.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20251230195134.599463-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 33d589ed60ae433b483761987b85e0d24e54584e
Author: Konstantin Andreev 
Date:   Tue Sep 30 15:31:53 2025 +0300

    smack: /smack/doi: accept previously used values
    
    Writing to /smack/doi a value that has ever been
    written there in the past disables networking for
    non-ambient labels.
    E.g.
    
        # cat /smack/doi
        3
        # netlabelctl -p cipso list
        Configured CIPSO mappings (1)
         DOI value : 3
           mapping type : PASS_THROUGH
        # netlabelctl -p map list
        Configured NetLabel domain mappings (3)
         domain: "_" (IPv4)
           protocol: UNLABELED
         domain: DEFAULT (IPv4)
           protocol: CIPSO, DOI = 3
         domain: DEFAULT (IPv6)
           protocol: UNLABELED
    
        # cat /smack/ambient
        _
        # cat /proc/$$/attr/smack/current
        _
        # ping -c1 10.1.95.12
        64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.964 ms
        # echo foo >/proc/$$/attr/smack/current
        # ping -c1 10.1.95.12
        64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.956 ms
        unknown option 86
    
        # echo 4 >/smack/doi
        # echo 3 >/smack/doi
    !>  [  214.050395] smk_cipso_doi:691 cipso add rc = -17
        # echo 3 >/smack/doi
    !>  [  249.402261] smk_cipso_doi:678 remove rc = -2
    !>  [  249.402261] smk_cipso_doi:691 cipso add rc = -17
    
        # ping -c1 10.1.95.12
    !!> ping: 10.1.95.12: Address family for hostname not supported
    
        # echo _ >/proc/$$/attr/smack/current
        # ping -c1 10.1.95.12
        64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.617 ms
    
    This happens because Smack keeps decommissioned DOIs,
    fails to re-add them, and consequently refuses to add
    the “default” domain map:
    
        # netlabelctl -p cipso list
        Configured CIPSO mappings (2)
         DOI value : 3
           mapping type : PASS_THROUGH
         DOI value : 4
           mapping type : PASS_THROUGH
        # netlabelctl -p map list
        Configured NetLabel domain mappings (2)
         domain: "_" (IPv4)
           protocol: UNLABELED
    !>  (no ipv4 map for default domain here)
         domain: DEFAULT (IPv6)
           protocol: UNLABELED
    
    Fix by clearing decommissioned DOI definitions and
    serializing concurrent DOI updates with a new lock.
    
    Also:
    - allow /smack/doi to live unconfigured, since
      adding a map (netlbl_cfg_cipsov4_map_add) may fail.
      CIPSO_V4_DOI_UNKNOWN(0) indicates the unconfigured DOI
    - add new DOI before removing the old default map,
      so the old map remains if the add fails
    
    (2008-02-04, Casey Schaufler)
    Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
    
    Signed-off-by: Konstantin Andreev 
    Signed-off-by: Casey Schaufler 

commit 19c013e1551bf51e1493da1270841d60e4fd3f15
Author: Konstantin Andreev 
Date:   Tue Sep 30 15:16:02 2025 +0300

    smack: /smack/doi must be > 0
    
    /smack/doi allows writing and keeping negative doi values.
    Correct values are 0 < doi <= (max 32-bit positive integer)
    
    (2008-02-04, Casey Schaufler)
    Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
    
    Signed-off-by: Konstantin Andreev 
    Signed-off-by: Casey Schaufler 

commit e877cbb4531c932312b65eeb4f577845482862d1
Author: Taimoor Zaeem 
Date:   Thu Oct 9 16:20:55 2025 +0500

    security: smack: fix indentation in smack_access.c
    
    Replace spaces in code indent with tab character.
    
    Signed-off-by: Taimoor Zaeem 
    Signed-off-by: Casey Schaufler 

commit 1b5e068d598e16b3a4ee3fa632108ea393d4e3f1
Author: Thomas Weißschuh 
Date:   Tue Dec 30 08:09:29 2025 +0100

    kbuild: uapi: Drop check_config()
    
    headers_install.sh already tests for CONFIG symbols. It does so in a
    more comprehensive way, by only checking for references in code and
    also running even if CONFIG_UAPI_HEADER_TEST is disabled.
    And check_config() has been disabled any case.
    
    Drop the pointless check.
    
    Signed-off-by: Thomas Weißschuh 
    Reviewed-by: Nicolas Schier 
    Link: https://patch.msgid.link/20251230-uapi-check_config-v1-1-00ecec109f39@linutronix.de
    Signed-off-by: Nathan Chancellor 

commit bb6a4985680b89653809bc4aa54c940796f14066
Author: Jani Nikula 
Date:   Mon Dec 29 13:54:45 2025 +0200

    drm/i915/utils: drop unnecessary ifdefs
    
    The i915_utils.h and intel_display_utils.h were in some cases included
    from the same files, the former via i915_drv.h and the latter
    directly. This lead to a clash between MISSING_CASE() and
    fetch_and_zero() defined in both, requiring ifdefs.
    
    With the display dependency on i915_drv.h removed, we can also remove
    the now unnecessary ifdefs.
    
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/f40a1fd365cbcfb77bd76ce0041c4523699f6052.1767009044.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 51489bae202f629abb5c896b00099f0de22c875d
Author: Jani Nikula 
Date:   Mon Dec 29 13:54:44 2025 +0200

    drm/xe: remove compat i915_drv.h and -Ddrm_i915_private=xe_device hack
    
    The xe display build no longer needs the compat i915_drv.h or the ugly
    -Ddrm_i915_private=xe_device hack. Remove them, with great pleasure.
    
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/8d2da5404439ed334d7682922b599f36eeb60e9d.1767009044.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit aae766f5d31070284561073086ed0a8d2ae15856
Author: Jani Nikula 
Date:   Mon Dec 29 13:54:43 2025 +0200

    drm/i915: drop i915 param from i915_fence{, _context}_timeout()
    
    The i915_fence_context_timeout() and i915_fence_timeout() functions both
    have the struct drm_i915_private parameter, which is unused. It's likely
    in preparation for something that just didn't end up happening.
    
    Remove them, dropping the last struct drm_i915_private usage for xe
    display build.
    
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/dce86cb031d523a95a96ed2bf9c93bb28e6b20ab.1767009044.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 600605853f87a4b1c3530a63f78a3541633402b0
Author: Ihor Solodrai 
Date:   Mon Dec 29 12:28:23 2025 -0800

    scripts/gen-btf.sh: Fix .btf.o generation when compiling for RISCV
    
    gen-btf.sh emits a .btf.o file with BTF sections to be linked into
    vmlinux in link-vmlinux.sh
    
    This .btf.o file is created by compiling an emptystring with ${CC},
    and then adding BTF sections into it with ${OBJCOPY}.
    
    To ensure the .btf.o is linkable when cross-compiling with LLVM, we
    have to also pass ${KBUILD_FLAGS}, which in particular control the
    target word size.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512240559.2M06DSX7-lkp@intel.com/
    Signed-off-by: Ihor Solodrai 
    Link: https://lore.kernel.org/r/20251229202823.569619-1-ihor.solodrai@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 2fd60a2edb83a6308fffd5ea2a76c221b61a4eb3
Author: Manivannan Sadhasivam 
Date:   Tue Dec 16 18:21:43 2025 +0530

    PCI: qcom: Parse PERST# from all PCIe bridge nodes
    
    Devicetree schema allows the PERST# GPIO to be present in all PCIe bridge
    nodes, not just in Root Port node. But the current logic parses PERST# only
    from the Root Port nodes. Though it is not causing any issue on the current
    platforms, the upcoming platforms will have PERST# in PCIe switch
    downstream ports also. So this requires parsing all the PCIe bridge nodes
    for the PERST# GPIO.
    
    Hence, rework the parsing logic to extend to all PCIe bridge nodes starting
    from the Root Port node. If the 'reset-gpios' property is found for a PCI
    bridge node, the GPIO descriptor will be stored in qcom_pcie_perst::desc
    and added to the qcom_pcie_port::perst list.
    
    It should be noted that if more than one bridge node has the same GPIO for
    PERST# (shared PERST#), the driver will error out. This is due to the
    limitation in the GPIOLIB subsystem that allows only exclusive (non-shared)
    access to GPIOs from consumers. But this is soon going to get fixed. Once
    that happens, it will get incorporated in this driver.
    
    So for now, PERST# sharing is not supported.
    
    Signed-off-by: Manivannan Sadhasivam 
    Signed-off-by: Manivannan Sadhasivam 
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20251216-pci-pwrctrl-rework-v2-1-745a563b9be6@oss.qualcomm.com

commit 62d4911290f9cbb16f5b6ba6782660148a656fc7
Author: Claudiu Beznea 
Date:   Wed Dec 17 13:15:10 2025 +0200

    PCI: rzg3s-host: Drop the lock on RZG3S_PCI_MSIRS and RZG3S_PCI_PINTRCVIS
    
    The RZG3S_PCI_MSIRS and RZG3S_PCI_PINTRCVIS registers are of the R/W1C
    type. According to the RZ/G3S HW Manual, Rev. 1.10, chapter 34.2.1
    Register Type, R/W1C register bits are cleared to 0b by writing 1b, while
    writing 0b has no effect. Therefore, there is no need to take a lock
    around writes to these registers.
    
    Drop the locking.
    
    Along with this, add a note about the R/W1C register type to the register
    offset definitions.
    
    Signed-off-by: Claudiu Beznea 
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Wolfram Sang 
    Link: https://patch.msgid.link/20251217111510.138848-3-claudiu.beznea.uj@bp.renesas.com

commit 4b86eff47e205819eb862097493ec20e25ac8f56
Author: Claudiu Beznea 
Date:   Wed Dec 17 13:15:09 2025 +0200

    PCI: rzg3s-host: Use pci_generic_config_write() for the root bus
    
    The Renesas RZ/G3S host controller allows writing to read-only PCIe
    configuration registers when the RZG3S_PCI_PERM_CFG_HWINIT_EN bit is set in
    the RZG3S_PCI_PERM register. However, callers of struct pci_ops::write
    expect the semantics defined by the PCIe specification, meaning that writes
    to read-only registers must not be allowed.
    
    The previous custom struct pci_ops::write implementation for the root bus
    temporarily enabled write access before calling pci_generic_config_write().
    This breaks the expected semantics.
    
    Remove the custom implementation and simply use pci_generic_config_write().
    
    Along with this change, the updates of the PCI_PRIMARY_BUS,
    PCI_SECONDARY_BUS, and PCI_SUBORDINATE_BUS registers were moved so that
    they no longer depends on the RZG3S_PCI_PERM_CFG_HWINIT_EN bit in the
    RZG3S_PCI_PERM_CFG register, since these registers are R/W.
    
    Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver")
    Suggested-by: Bjorn Helgaas 
    Signed-off-by: Claudiu Beznea 
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Wolfram Sang 
    Link: https://patch.msgid.link/20251217111510.138848-2-claudiu.beznea.uj@bp.renesas.com

commit 2cca8d79709e1debd27da5dcae2abc859f41db70
Author: Rob Herring (Arm) 
Date:   Mon Dec 15 15:24:56 2025 -0600

    dt-bindings: PCI: socionext,uniphier-pcie: Fix interrupt controller node name
    
    The child node name in use by .dts files and the driver is
    "legacy-interrupt-controller", not "interrupt-controller".
    
    Signed-off-by: Rob Herring (Arm) 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Kunihiko Hayashi 
    Link: https://patch.msgid.link/20251215212456.3317558-1-robh@kernel.org

commit c816ba1dcd931b9db8d66c71e1ae34ddcdbf968f
Author: Arnd Bergmann 
Date:   Thu Dec 4 11:02:25 2025 +0100

    EDAC/amd64: Avoid a -Wformat-security warning
    
    Using a variable as a format string causes a (default-disabled) warning:
    
      drivers/edac/amd64_edac.c: In function 'per_family_init':
      drivers/edac/amd64_edac.c:3914:17: error: format not a string literal and no format arguments [-Werror=format-security]
       3914 |                 scnprintf(pvt->ctl_name, sizeof(pvt->ctl_name), tmp_name);
            |                 ^~~~~~~~~
    
    The code here is safe, but in order to enable the warning by default in the
    future, change this instance to pass the name indirectly.
    
    Fixes: e9abd990aefd ("EDAC/amd64: Generate ctl_name string at runtime")
    Signed-off-by: Arnd Bergmann 
    Signed-off-by: Borislav Petkov (AMD) 
    Reviewed-by: Avadhut Naik 
    Reviewed-by: Qiuxu Zhuo 
    Reviewed-by: Yazen Ghannam 
    Link: https://patch.msgid.link/20251204100231.1034557-1-arnd@kernel.org

commit 65155d1682db63ad3e1e54ccfc4b0d415616a38d
Author: Liankun Yang 
Date:   Tue Dec 23 14:16:52 2025 +0800

    drm/mediatek: Move DP training to hotplug thread
    
    By adjusting the order of link training and relocating it to HPD,
    link training can identify the usability of each lane in the current link.
    
    It also supports handling signal instability and weakness due to
    environmental issues, enabling the acquisition of a stable bandwidth
    for the current link. Subsequently, DP work can proceed based on
    the actual maximum bandwidth.
    
    It should training in the hpd event thread.
    Check the mode with lane count and link rate of training.
    
    If we're eDP and capabilities were already parsed we can skip
    reading again because eDP panels aren't hotpluggable hence the
    caps and training information won't ever change in a boot life
    
    Therefore, bridge typec judgment is required for edp training in
    atomic_enable function.
    
    `mtk_dp_parse_capabilities` is related to DP training, it is
    used in `mtk_dp_hpd_event_thread` before DP training, and then only
    used by eDP when read edid.
    
    -Modify part of in `mtk_dp_bridge_atomic_disable`
        if (mtk_dp->train_info.cable_plugged_in) {
           drm_dp_dpcd_writeb(&mtk_dp->aux, DP_SET_POWER, DP_SET_POWER_D3);
           usleep_range(2000, 3000);
        }
    
        /* power off aux */
        mtk_dp_update_bits(mtk_dp, MTK_DP_TOP_PWR_STATE,
                    DP_PWR_STATE_BANDGAP_TPLL,
                    DP_PWR_STATE_MASK);
    
    -Modify part of in `mtk_dp_aux_panel_poweron(mtk_dp, false);`
        if (pwron) {
           ....
        } else {
           /* power off panel */
           drm_dp_dpcd_writeb(&mtk_dp->aux, DP_SET_POWER, DP_SET_POWER_D3);
           usleep_range(2000, 3000);
    
           /* power off aux */
           mtk_dp_update_bits(mtk_dp, MTK_DP_TOP_PWR_STATE,
                            DP_PWR_STATE_BANDGAP_TPLL,
                            DP_PWR_STATE_MASK);
        }
    
    The `mtk_dp_aux_panel_poweron` function fails to align.
    Within the `mtk_dp_hpd_event_thread`, if DP is disconnected,
    the `mtk_dp_aux_panel_poweron` function will write from `aux`
    to `DPRX`, causing a failure and thus preventing symmetry.
    
    This shows the current timings after the DP cable is plugged in,
    as well as the modified timings.
    
    current timings:                Fix timings:
    
    mtk_dp_hpd_event_thread()       mtk_dp_hpd_event_thread()
                                    (including DP link training)
            |                               |
           ...                             ...
    mtk_dp_bridge_mode_valid()      mtk_dp_bridge_mode_valid()
            |
           ...                             ...
    mtk_dp_bridge_atomic_check()    mtk_dp_bridge_atomic_check()
            |
           ...                             ...
    mtk_dp_bridge_atomic_enable()   mtk_dp_bridge_atomic_enable()
    (including DP link training)
    
    PS:
    1. "..." represents ommited steps;
    
    2. `mtk_dp_bridge_mode_valid()` calculates the bandwidth using the
    current lane count and link rate, and then filters each mode to
    determine if it supports returning a status.
    
    3. In the `drm_display_mode_to_videomode(&crtc_state->adjusted_mode,
    &mtk_dp->info.vm);` function, within the `mtk_dp_bridge_atomic_check()`
    function, `adjusted_mode` sets the currently selected display mode for
    the DRM.
    
    4. DP link training tests the signal conditions of the link between
    DPTX and DPRX, and selects the lane count and link rate that meet
    the signal conditions.
    
    5. For example, the platform support DP 4lane 5.4G,
    but panel A support DP 2lane 5.4G.
    
       This is a time sequence:
    
       a).Plug in panel A. According to the platform, it can output 4K60Hz.
       b).Timing mode set 4K 60Hz(Including in mtk_dp_bridge_atomic_check
       function).
       c).Atomic enable(Based on panel A ability, training pass 2lane
       5.4G).
       d).Finally, due to 2lane 5.4G bandwidth limitation, the platform
       cannot output 4K 60Hz, resulting in a black sreen.
    
       If apply this patch.
    
       a).Plug in panel A.
       b).Training pass 2lane 5.4G
       c).Timing mode set 2K 60Hz(Based on the 2lane 5.4G bandwidth limit
       and including in mtk_dp_bridge_atomic_che
    
    Signed-off-by: Liankun Yang 
    Link: https://patchwork.kernel.org/project/dri-devel/patch/20251223061755.7717-1-liankun.yang@mediatek.com/
    Signed-off-by: Chun-Kuang Hu 

commit f9c68b1c5be432e7e18039c3b23a1c107c9cb47f
Author: Chen Ni 
Date:   Tue Nov 25 09:47:40 2025 +0800

    drm/mediatek: mtk_hdmi_v2: Remove unneeded semicolon
    
    Remove unnecessary semicolons reported by Coccinelle/coccicheck and the
    semantic patch at scripts/coccinelle/misc/semicolon.cocci.
    
    Signed-off-by: Chen Ni 
    Link: https://patchwork.kernel.org/project/dri-devel/patch/20251125014740.1059347-1-nichen@iscas.ac.cn/
    Signed-off-by: Chun-Kuang Hu 

commit 73368efe2b47b8b3e579673c8fb11b106898b49c
Author: Andreas Kemnade 
Date:   Tue Dec 23 23:24:35 2025 +0100

    ARM: dts: imx: imx6sl: fix lcdif compatible
    
    Fix lcdif compatible according to bindings doc.
    
    dtbs_check tested only, a glance at the datasheet shows that it should be
    the correct fallback compatible.
    
    Signed-off-by: Andreas Kemnade 
    Signed-off-by: Shawn Guo 

commit 4cd1eadb61de88013f7cdc88dc7293338493fe72
Author: Andreas Kemnade 
Date:   Tue Dec 23 22:34:03 2025 +0100

    ARM: imx_v6_v7_defconfig: enable EPD regulator needed for Kobo Clara 2e
    
    Kobo Clara 2e revision b requires the JD9930/FP9931 regulator driver
    for the EPD, so enable it.
    
    Signed-off-by: Andreas Kemnade 
    Signed-off-by: Shawn Guo 

commit 03bbb39d9c1f98ec9348ba8521aa2ae17c9f396a
Author: Andreas Kemnade 
Date:   Tue Dec 23 22:34:02 2025 +0100

    ARM: dts: imx: imx6sll-kobo-clara2e: add regulator for EPD
    
    Now there is a driver and binding for the JD9930, so add the information
    to the devicetree for revision b.
    
    Signed-off-by: Andreas Kemnade 
    Signed-off-by: Shawn Guo 

commit e8280244464c3534112c30491435754eff749337
Author: Andreas Kemnade 
Date:   Tue Dec 23 21:43:02 2025 +0100

    ARM: dts: imx: imx6sll: fix lcdif compatible
    
    Fix lcdif compatible according to bindings doc.
    
    dtbs_check tested only, a glance at the datasheet shows that it should be
    the correct fallback compatible.
    
    Signed-off-by: Andreas Kemnade 
    Signed-off-by: Shawn Guo 

commit 6b9d8ef2908727dd80eacb307d6a409963e4dfe5
Author: Francesco Dolcini 
Date:   Tue Dec 23 17:28:27 2025 +0100

    dt-bindings: arm: fsl: Add Apalis iMX8QP
    
    Add binding documentation for the Apalis iMX8QP SoM mated with Apalis
    Ixora and Apalis Evaluation board.
    
    Apalis iMX8QP is a variant of the Apalis iMX8QM, using an NXP i.MX8QP
    SoC instead of the i.MX8QM. The two SoCs are pin to pin compatible, with
    the i.MX8QP being a lower end variant, with a slower GPU and one Cortex
    A72 core instead of two.
    
    The two Apalis SoMs variants share the same schematics and PCB, and the
    iMX8QP variant exists only on revision V1.1 of board.
    
    Link: https://www.nxp.com/products/i.MX8
    Link: https://www.toradex.com/computer-on-modules/apalis-arm-family/nxp-imx-8
    Signed-off-by: Francesco Dolcini 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Shawn Guo 

commit db97615aea6602ce0f81f320eced9574f808b091
Author: Francesco Dolcini 
Date:   Tue Dec 23 17:28:30 2025 +0100

    arm64: dts: freescale: Add Apalis iMX8QP
    
    Add support for the Apalis iMX8QP SoM mated with Apalis Ixora and Apalis
    Evaluation board.
    
    Apalis iMX8QP is a variant of the Apalis iMX8QM, using an NXP i.MX8QP
    SoC instead of the i.MX8QM. The two SoCs are pin to pin compatible, with
    the i.MX8QP being a lower end variant, with a slower GPU and one Cortex
    A72 core instead of two.
    
    The two Apalis SoMs variants share the same schematics and PCB, and the
    iMX8QP variant exists only on revision V1.1 of board.
    
    Link: https://www.nxp.com/products/i.MX8
    Link: https://www.toradex.com/computer-on-modules/apalis-arm-family/nxp-imx-8
    Signed-off-by: Francesco Dolcini 
    Signed-off-by: Shawn Guo 

commit 3669332babd0038b714abd3e360be130fd401022
Author: Francesco Dolcini 
Date:   Tue Dec 23 17:28:29 2025 +0100

    arm64: dts: freescale: Add NXP i.MX8QP SoC dtsi
    
    Add support for NXP i.MX8QP SoC, this is pin to pin compatible variant
    of the i.MX8QM, with a slower GPU and one Cortex A72 core instead of
    two.
    
    Link: https://www.nxp.com/products/i.MX8
    Signed-off-by: Francesco Dolcini 
    Signed-off-by: Shawn Guo 

commit eb2615ad4643c9e3fc6a3c9082084cec744402b9
Author: Francesco Dolcini 
Date:   Tue Dec 23 17:28:28 2025 +0100

    arm64: dts: imx8qm: Add CPU cluster labels
    
    Add labels to the cpu cluster nodes to prepare for the addition of the
    i.MX8QP SoC in which these nodes would need to be adjusted from another
    DT file.
    
    Signed-off-by: Francesco Dolcini 
    Signed-off-by: Shawn Guo 

commit 202266aee7d54e90a861fcc364993100414b8148
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:26:27 2025 +0100

    arm64: dts: freescale: Use lowercase hex
    
    The DTS code coding style expects lowercase hex for values and unit
    addresses.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Shawn Guo 

commit 7dce6d3909cb95108d92fc95dedf18d488e9ccae
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:26:26 2025 +0100

    arm64: dts: freescale: Minor whitespace cleanup
    
    The DTS code coding style expects exactly one space around '=' and
    before '{' characters.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Shawn Guo 

commit 5ceddf531b7f5ec4e505f329a9ccc7ef18f7de4e
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:26:25 2025 +0100

    arm64: dts: freescale: Use hyphen in node names
    
    DTS coding style prefers hyphens instead of underscores in the node
    names.  Change should be safe, because node names are not considered an
    ABI.
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Shawn Guo 

commit 5a0ee673a793c977e94c30ff8b5ac81d8e6a3c0f
Author: Haibo Chen 
Date:   Tue Dec 23 17:05:57 2025 +0800

    arm64: dts: imx94: add mt35xu512aba spi nor support
    
    Add mt35xu512aba spi nor support on imx943-evk board.
    This nor chip support OCT DTR mode.
    
    For the reset pin, since the nor chip side need 1.8v IO
    voltage for reset pin, but the IO expander side use 3.3v
    IO voltage, so to make circuit safe, need to config the
    pad as OPEN DRAIN.
    
    Signed-off-by: Haibo Chen 
    Signed-off-by: Shawn Guo 

commit c8614121539494c6dad84df074aa5d89e2d845f7
Author: Haibo Chen 
Date:   Tue Dec 23 17:05:56 2025 +0800

    arm64: dts: imx94: add xspi device node
    
    imx94 has two xspi, add these device nodes.
    
    Signed-off-by: Haibo Chen 
    Signed-off-by: Shawn Guo 

commit a5aa8551d0046ec701e8962f83361165ccf640a4
Author: Peng Fan 
Date:   Mon Dec 22 09:42:16 2025 +0800

    arm64: dts: freescale: Add i.MX952 EVK basic device tree
    
    Add i.MX952 EVK basic device tree, with UART1, SDHC[1,2] supported.
    
    Signed-off-by: Peng Fan 
    Signed-off-by: Shawn Guo 

commit b516a4dd6a1ff7ddbaf3ab30ddec88088a6ec9e6
Author: Peng Fan 
Date:   Mon Dec 22 09:42:15 2025 +0800

    arm64: dts: freescale: Add initial device tree for i.MX952
    
    i.MX952 is designed for AI-powered sensor fusion and vision sensing
    applications, it features 4 Corte-A55, 1 Cortex-M33, 1 Cortex-M7 and
    NXP eIQ NPU and advanced graphics, video and advanced security with
    edgelock. Product info could be found at:
    https://www.nxp.com/products/i.MX-952
    
    The basic device tree includes:
    - clock, pin, power header files
    - device nodes: CPU[0-3], SCMI firmware, Interrupt Controller, Sys counter,
      eDMA, MU, SPI, UART, I2C, USB and etc
    
    Signed-off-by: Peng Fan 
    Signed-off-by: Shawn Guo 

commit 6b4bcef0549e35b777896e5da0ec8af00fa942c1
Author: Peng Fan 
Date:   Mon Dec 22 09:42:14 2025 +0800

    dt-bindings: arm: fsl: add i.MX952 EVK board
    
    Add DT compatible string for NXP i.MX952 EVK board.
    
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Peng Fan 
    Reviewed-by: Daniel Baluta 
    Signed-off-by: Shawn Guo 

commit 0c90fd379bb5d2eb02051f312a7bb45d56e006bf
Author: Jaime Saguillo Revilla 
Date:   Mon Dec 22 16:29:26 2025 +0100

    docs: admin-guide: thunderbolt: Replace ifconfig with ip
    
    ifconfig is a legacy tool and no longer installed by default on many
    modern distributions. Update the documentation to reference ip from
    iproute2 instead.
    
    No functional change.
    
    Signed-off-by: Jaime Saguillo Revilla 
    Signed-off-by: Mika Westerberg 

commit dc3a6a942e9ee3f18560bfcb16c06bb94f37fabf
Author: Arnd Bergmann 
Date:   Tue Dec 23 22:50:01 2025 +0100

    soundwire: intel_ace2x: add SND_HDA_CORE dependency
    
    The ace2x driver can optionally use the HDA infrastructure, but can still
    build without that. However, with SND_HDA_CORE=m and SND_HDA_ALIGNED_MMIO=y,
    it fails to link as built-in:
    
    aarch64-linux-ld: drivers/soundwire/intel_ace2x.o: in function `intel_shim_wake':
    intel_ace2x.c:(.text+0x2518): undefined reference to `snd_hdac_aligned_read'
    aarch64-linux-ld: intel_ace2x.c:(.text+0x25d4): undefined reference to `snd_hdac_aligned_read'
    aarch64-linux-ld: intel_ace2x.c:(.text+0x268c): undefined reference to `snd_hdac_aligned_write'
    
    Add a Kconfig dependency that forces the soundwire driver to be a loadable
    module if necessary.
    
    Fixes: 79e7123c078d ("soundwire: intel_ace2x: fix wakeup handling")
    Signed-off-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251223215014.534756-1-arnd@kernel.org
    Signed-off-by: Vinod Koul 

commit 40630210211a34f0714fe976530ccf1291e5ef78
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:53 2025 +0100

    drm/bridge: imx8qxp-pixel-link: remove excess error message
    
    imx8qxp_pixel_link_find_next_bridge() already emits a DRM_DEV_ERROR() on
    error except for -EPROBE_DEFER. The caller emits another one, which is
    redundant. Remove the message in the caller and keep the one in
    imx8qxp_pixel_link_find_next_bridge() as it is more informative about the
    error cause.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-20-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 900699ba830fd3558ba00f55fbf014022dc7ecdb
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:50 2025 +0100

    drm/bridge: imx8qxp-pxl2dpi: get/put the companion bridge
    
    This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
    function and stores it until driver removal. of_drm_find_bridge() is
    deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
    refcounted and use the destroy hook to put the reference on deallocation.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-17-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 6802c7ee360d98a018962adb8412d42dcca28272
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:49 2025 +0100

    drm/bridge: imx8qxp-pxl2dpi: get/put the next bridge
    
    This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
    function and stores it until driver removal. of_drm_find_bridge() is
    deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
    refcounted and use bridge->next_bridge to put the reference on
    deallocation.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-16-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 0dc4a8d6d096f97a00b10919e8ffe2466666f03c
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:48 2025 +0100

    drm/bridge: imx8qxp-pxl2dpi: imx8qxp_pxl2dpi_find_next_bridge: return int, not ERR_PTR
    
    In preparation for using bridge->next_bridge, we need to ensure that it
    will never contain anything but NULL or a valid bridge pointer. Current
    code stores an ERR_PTR when imx8qxp_pxl2dpi_find_next_bridge() errors
    out. Instead of fixing that after the facts in the caller, change the
    function to internally set the next_pointer and just return an int error
    value.
    
    No functional changes.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-15-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 54af17788629fbf343c5a9ebc55454d6a5486ff8
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:47 2025 +0100

    drm/bridge: imx8qxp-pxl2dpi: remove excess error message
    
    imx8qxp_pxl2dpi_find_next_bridge() already emits a DRM_DEV_ERROR() for
    every error except -EPROBE_DEFER. The caller emits another one, which is
    redundant. Remove the message in the caller and keep the two in
    imx8qxp_pxl2dpi_find_next_bridge() as they are more informative about the
    error cause.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-14-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit ceea3f7806a109baba4a23c9066eb9e86659408b
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:46 2025 +0100

    drm/bridge: imx8qxp-pxl2dpi: simplify put of device_node pointers
    
    Simplify the error-management code in
    imx8qxp_pxl2dpi_get_available_ep_from_port() by using a release action for
    the struct device_node pointers.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-13-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit c87ad784aacb89cf88c00cde78970543010a6d67
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:45 2025 +0100

    drm/meson: encoder_hdmi: get/put the next bridge
    
    This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
    function and stores it until driver removal. of_drm_find_bridge() is
    deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
    refcounted and use bridge->next_bridge to put the reference on
    deallocation.
    
    Reviewed-by: Martin Blumenstingl 
    Tested-by: Martin Blumenstingl 
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-12-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit bfb8f5d0a9e756c57d4fc0f7966e4873bbfb34a5
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:44 2025 +0100

    drm/meson: encoder_dsi: get/put the next bridge
    
    This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
    function and stores it until driver removal. of_drm_find_bridge() is
    deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
    refcounted and use bridge->next_bridge to put the reference on
    deallocation.
    
    Reviewed-by: Martin Blumenstingl 
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-11-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 47fa48b3faa7cae925c9b14b18376cdc4622bae0
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:43 2025 +0100

    drm/meson: encoder_cvbs: get/put the next bridge
    
    This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
    function and stores it until driver removal. of_drm_find_bridge() is
    deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
    refcounted and use bridge->next_bridge to put the reference on
    deallocation.
    
    Reviewed-by: Martin Blumenstingl 
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-10-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit b9a7d5918bd436d64699b80af061f21c168df699
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:42 2025 +0100

    drm/bridge: simple-bridge: get/put the next bridge
    
    This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
    function and stores it until driver removal. of_drm_find_bridge() is
    deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
    refcounted and use bridge->next_bridge to put the reference on
    deallocation.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-9-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit ae754f049ce1c01f09d175f80265970f0d5b4489
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:41 2025 +0100

    drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge
    
    This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
    function and stores it until driver removal. of_drm_find_bridge() is
    deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
    refcounted and use bridge->next_bridge to put the reference on
    deallocation.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-8-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 8f92a5fcbfe33f86b08f5f74dcc58a41425ea8c0
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:40 2025 +0100

    drm/bridge: ite-it66121: get/put the next bridge
    
    This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
    function and stores it until driver removal. of_drm_find_bridge() is
    deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
    refcounted and use bridge->next_bridge to put the reference on
    deallocation.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-7-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 3fdeae134ba956aacbd87d5532c025913c98fc49
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:39 2025 +0100

    drm/bridge: add next_bridge pointer to struct drm_bridge
    
    Many bridge drivers store a next_bridge pointer in their private data and
    use it for attach and sometimes other purposes. This is going to be risky
    when bridge hot-unplug is used.
    
    Considering this example scenario:
    
      1. pipeline: encoder --> bridge A --> bridge B --> bridge C
      2. encoder takes a reference to bridge B
      3. bridge B takes a next_bridge reference to bridge C
      4. encoder calls (bridge B)->b_foo(), which in turns references
         next_bridge, e.g.:
    
           b_foo() {
               bar(b->next_bridge);
           }
    
    If bridges B and C are removed, bridge C can be freed but B is still
    allocated because the encoder holds a reference to B. So when step 4
    happens, 'b->next-bridge' would be a use-after-free.
    
    Calling drm_bridge_put() in the B bridge .remove function does not solve
    the problem as it leaves a (potentially long) risk window between B removal
    and the final deallocation of B. A safe moment to put the B reference is in
    __drm_bridge_free(), when the last reference has been put. This can be done
    by drivers in the .destroy func. However to avoid the need for so many
    drivers to implement a .destroy func, just offer a next_bridge pointer to
    all bridges that is automatically put it in __drm_bridge_free(), exactly
    when the .destroy func is called.
    
    Suggested-by: Maxime Ripard 
    Link: https://lore.kernel.org/all/20251201-thick-jasmine-oarfish-1eceb0@houat/
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-6-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 7282066e55347b26cb31784059ab62c2de8a3e01
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:38 2025 +0100

    drm/arcpgu: convert to of_drm_find_and_get_bridge()
    
    of_drm_find_bridge() is deprecated. Move to its replacement
    of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
    is put it when done.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-5-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 5d7cb36254b5facd2a349331c1a47102d4e66e40
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:37 2025 +0100

    drm/bridge: make of_drm_find_bridge() a wrapper of of_drm_find_and_get_bridge()
    
    of_drm_find_bridge() is identical to of_drm_find_and_get_bridge() except it
    does not increment the refcount. Rewrite it as a wrapper and put the bridge
    being returned so the behaviour is still the same.
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-4-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit c637217efb892ac5d0d5f9aea3df92147c2e24db
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:36 2025 +0100

    drm/todo: add entry about converting to of_drm_find_and_get_bridge()
    
    of_drm_find_bridge() is deprecated, but converting some users is very
    complex and should be reasonably doable only after the DRM panel bridge
    lifetime rework. Add a TODO to track this.
    
    Suggested-by: Maxime Ripard 
    Link: https://lore.kernel.org/dri-devel/20250319-stylish-lime-mongoose-0a18ad@houat/
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-3-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 9da0e06abda87b1f97014113d5231fdeb4700749
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:35 2025 +0100

    drm/bridge: deprecate of_drm_find_bridge()
    
    of_drm_find_bridge() does not increment the returned bridge
    refcount. of_drm_find_and_get_bridge() is to be used as a replacement.
    
    Suggested-by: Maxime Ripard 
    Link: https://lore.kernel.org/dri-devel/20250319-stylish-lime-mongoose-0a18ad@houat/
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-2-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit 293a8fd7721a90987d9bf149feab60e756dac269
Author: Luca Ceresoli 
Date:   Tue Dec 16 18:58:34 2025 +0100

    drm/bridge: add of_drm_find_and_get_bridge()
    
    of_drm_find_bridge() does not increment the refcount for the returned
    bridge, but that is required now. However converting it and all its users
    is not realistically doable at once given the large amount of (direct and
    indirect) callers and the complexity of some.
    
    Solve this issue by creating a new of_drm_find_and_get_bridge() function
    that is identical to of_drm_find_bridge() except also it takes a
    reference. Then of_drm_find_bridge() will be deprecated to be eventually
    removed.
    
    Suggested-by: Maxime Ripard 
    Link: https://lore.kernel.org/dri-devel/20250319-stylish-lime-mongoose-0a18ad@houat/
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251216-drm-bridge-alloc-getput-drm_of_find_bridge-v3-1-b5165fab8058@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit be1e3ea0cf76f2fa613220253a630308d19ae5d0
Author: Teresa Remmet 
Date:   Thu Dec 18 13:00:06 2025 +0100

    arm64: dts: imx8mm-phycore-som: Update eth phy impedance
    
    Update the DP83867 ethernet phy impedance settings to
    to optimize signal quality and reduce potential signal integrity issues.
    
    Signed-off-by: Teresa Remmet 
    Signed-off-by: Shawn Guo 

commit eb2f28413e23c219188d3e1a2ce8bca9894f9832
Author: Fabian Pflug 
Date:   Thu Dec 18 12:39:22 2025 +0100

    arm64: dts: freescale: add support for NXP i.MX93 FRDM
    
    The FRDM i.MX 93 development board is a low-cost and compact development
    board featuring the i.MX93 applications processor.
    
    It features:
    - Dual Cortex-A55
    - 2 GB LPDDR4X / LPDDR4
    - 32 GB eMMC5.1
    - MicroSD slot
    - GbE RJ45 x 2
    - USB2.0 1x Type C, 1x Type A
    
    This file is based upon the one provided by nxp in their own kernel and
    yocto meta layer for the device, but adapted for mainline.
    
    Signed-off-by: Haidong Zheng 
    Signed-off-by: Danwei Luo 
    Signed-off-by: Lei Xu 
    Signed-off-by: Fabian Pflug 
    Reviewed-by: Francesco Valla 
    Tested-by: Francesco Valla 
    Signed-off-by: Shawn Guo 

commit a95260063fb3e01878a28ed23f10241b9e138ae9
Author: Fabian Pflug 
Date:   Thu Dec 18 12:39:21 2025 +0100

    dt-bindings: arm: fsl: add i.MX93 11x11 FRDM board
    
    Add DT compatible string for NXP i.MX93 11x11 FRDM board.
    
    Acked-by: Krzysztof Kozlowski 
    Reviewed-by: Daniel Baluta 
    Signed-off-by: Fabian Pflug 
    Signed-off-by: Shawn Guo 

commit 30e6d444b8dc5ae1f5dee1f3cda3a49864cd10fb
Author: Alexander Stein 
Date:   Wed Dec 17 09:48:04 2025 +0100

    arm64: dts: mb-smarc-2: Add PCIe support
    
    TQMa8XxS on MB-SMARC-2 supports mPCIe on X44.
    
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 239003957eb448369689914fde7b074688419fce
Author: Alexander Stein 
Date:   Tue Dec 16 15:35:21 2025 +0100

    ARM: imx_v6_v7_defconfig: Configure CONFIG_SND_SOC_FSL_ASOC_CARD as module
    
    This option explicitly selects other options, e.g. SND_SOC_FSL_SAI.
    These SAI drivers use DMA which in turn is dependent on CONFIG_IMX_SDMA.
    SDMA needs a firmware which is not yet present if the driver is built-in.
    Thus build CONFIG_SND_SOC_FSL_ASOC_CARD to avoid useless driver probe
    deferrals due to missing DMA channels.
    
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 8adc841d43ebceabec996c9dcff6e82d3e585268
Author: Markus Niebel 
Date:   Tue Dec 16 14:39:25 2025 +0100

    arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off
    
    Fix SD card removal caused by automatic LDO5 power off after boot
    
    To prevent this, add vqmmc regulator for USDHC, using a GPIO-controlled
    regulator that is supplied by LDO5. Since this is implemented on SoM but
    used on baseboards with SD-card interface, implement the functionality
    on SoM part and optionally enable it on baseboards if needed.
    
    Signed-off-by: Markus Niebel 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 8b6ffe54fde2375efdc034e253e71e8988da3c54
Author: Markus Niebel 
Date:   Tue Dec 16 14:39:24 2025 +0100

    arm64: dts: imx8mn-tqma8mqnl: remove virtual 1.8V regulator
    
    BUCK5 regulator supplies the 1.8V rail. Use the actual regulator
    instead of a virtual fixed regulator.
    
    Signed-off-by: Markus Niebel 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit cd09cbebfc8a4c76d74c2e7e1818a4c8cf3ca033
Author: Markus Niebel 
Date:   Tue Dec 16 14:39:23 2025 +0100

    arm64: dts: imx8mn-tqma8mqnl: remove virtual 3.3V regulator
    
    BUCK4 rail supplies the 3.3V rail. Use the actual regulator
    instead of a virtual fixed regulator.
    
    Signed-off-by: Markus Niebel 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit f7a65b08bcf5edb95697cf7a10435a1d051c9268
Author: Markus Niebel 
Date:   Tue Dec 16 14:31:07 2025 +0100

    arm64: dts: imx8mm-tqma8mqml: fix LDO5 power off
    
    Fix SD card removal caused by automatic LDO5 power off after boot.
    
    To prevent this, add vqmmc regulator for USDHC, using a GPIO-controlled
    regulator that is supplied by LDO5. Since this is implemented on SoM but
    used on baseboards with SD-card interface, implement the functionality
    on SoM part and optionally enable it on baseboards if needed.
    
    Signed-off-by: Markus Niebel 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 7c9910ffdadb42428c96fa73715f292a445b3a37
Author: Markus Niebel 
Date:   Tue Dec 16 14:31:06 2025 +0100

    arm64: dts: imx8mm-tqma8mqml: remove superfluous line
    
    Remove one empty line that is not needed.
    
    Signed-off-by: Markus Niebel 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit c5d2ecfe495e102fc6c29b3c76dba6b88153d1e0
Author: Markus Niebel 
Date:   Tue Dec 16 14:31:05 2025 +0100

    arm64: dts: imx8mm-tqma8mqml: remove virtual 1.8V regulator
    
    BUCK5 regulator supplies the 1.8V rail. Use the actual regulator
    instead of a virtual fixed regulator.
    
    Signed-off-by: Markus Niebel 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit fcef3fa00fcecc88b45526f83ea4df73d0e7dc77
Author: Markus Niebel 
Date:   Tue Dec 16 14:31:04 2025 +0100

    arm64: dts: imx8mm-tqma8mqml: remove virtual 3.3V regulator
    
    BUCK4 rail supplies the 3.3V rail. Use the actual regulator
    instead of a virtual fixed regulator.
    
    Signed-off-by: Markus Niebel 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit e583afbe3568c654a221793019e77738ffd2946f
Author: Stefano Radaelli 
Date:   Sun Dec 14 22:52:53 2025 +0100

    arm64: dts: imx8mp-var-som: Add support for TSC2046 touchscreen
    
    The VAR-SOM-MX8MP integrates a TSC2046 resistive touchscreen controller.
    The controller is physically located on the SOM, and its signals are
    routed to the SOM pins, allowing carrier boards to make use of it.
    
    This patch adds the TSC2046 node and the appropriate SPI controller.
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit cb452cc24ade40ebf3f0c592e1bad17c1b3cd693
Author: Stefano Radaelli 
Date:   Sun Dec 14 22:52:52 2025 +0100

    arm64: dts: imx8mp-var-som: Add support for WM8904 audio codec
    
    The VAR-SOM-MX8MP can integrate the WM8904, a high-performance
    ultra-low-power stereo codec optimized for portable audio applications.
    
    This patch adds the WM8904 device to the appropriate I2C bus, enables
    the SAI peripheral, and introduces the sound node to expose the
    sound card to the system.
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit 84095b3bd0cc836a112c8a1774edc7ea6fa43f69
Author: Stefano Radaelli 
Date:   Sun Dec 14 22:52:51 2025 +0100

    arm64: dts: imx8mp-var-som: Add WiFi and Bluetooth support
    
    Add device tree nodes for the WiFi and Bluetooth module mounted on the
    VAR-SOM-MX8MP. The module can be based on either the NXP IW612 or IW611
    chipset, depending on the configuration chosen by the customer.
    
    Regardless of the chipset used, WiFi communicates over SDIO and Bluetooth
    over UART.
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit e5b8c6103a41ada6c40ff052c572cc811b45b32c
Author: Stefano Radaelli 
Date:   Sun Dec 14 22:52:50 2025 +0100

    arm64: dts: imx8mp-var-som: Move UART2 description to Symphony carrier
    
    The VAR-SOM-MX8MP module does not provide an onboard debug console.
    UART2 is routed and exposed only on the Symphony carrier board, while
    custom carrier designs may choose to expose a different UART.
    
    Move the UART2 node from the SOM device tree to the
    imx8mp-var-som-symphony.dts, keeping the SOM dtsi limited to hardware
    present on the module itself.
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit 5ea98ce8b11969bae1441b5648b73242a9b99386
Author: Stefano Radaelli 
Date:   Sun Dec 14 22:52:49 2025 +0100

    arm64: dts: imx8mp-var-som: Move PCA9534 GPIO expander to Symphony carrier
    
    The VAR-SOM-MX8MP module does not include the PCA9534 GPIO expander nor
    the LED connected to it. These components are present only on the
    Symphony carrier board and may vary across custom carrier designs.
    
    Move the PCA9534 GPIO expander node and the associated LED definition
    from the SOM device tree to the Symphony carrier DTS, ensuring the SOM
    dtsi describes only hardware present on the module.
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit 057ffbb1cfffbbf56eee68b5ebdcfdfa89adad40
Author: Stefano Radaelli 
Date:   Sun Dec 14 22:52:48 2025 +0100

    arm64: dts: imx8mp-var-som: Move USDHC2 support to Symphony carrier
    
    The VAR-SOM-MX8MP module does not include a microSD slot connected to
    USDHC2. The USDHC2 interface is routed only on the Symphony carrier
    board, and it may optionally be used or omitted depending on the
    customer's carrier design.
    
    Move the USDHC2 node, its regulators, pinctrl groups and related GPIOs
    from the SOM device tree to the Symphony carrier DTS, keeping the SOM
    description limited to hardware populated on the module.
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit 753f9460a645296f656bf7fd4a85f55c411561fb
Author: Peng Fan 
Date:   Fri Dec 12 17:57:21 2025 +0800

    arm64: dts: imx93-11x11-evk: Use phys to replace xceiver-supply
    
    The TJA1057 used on i.MX93 EVK is actually high-speed CAN
    transceiver, not a regulator supply. So use phys to reflect the truth.
    
    Reviewed-by: Frank Li 
    Acked-by: Marc Kleine-Budde 
    Signed-off-by: Peng Fan 
    Signed-off-by: Shawn Guo 

commit 3563aaa006af39f4072e114c883f2363cd26b51f
Author: Peng Fan 
Date:   Fri Dec 12 17:57:20 2025 +0800

    arm64: dts: imx8mp-evk: Use phys to replace xceiver-supply
    
    The TJA1048 used on i.MX8MP-EVK is actually high-speed CAN transceiver,
    not a regulator supply. So use phys to reflect the truth.
    
    Reviewed-by: Frank Li 
    Acked-by: Marc Kleine-Budde 
    Signed-off-by: Peng Fan 
    Signed-off-by: Shawn Guo 

commit 51eea410b977a071ee99593427e08b421d250188
Author: Peng Fan 
Date:   Fri Dec 12 17:57:19 2025 +0800

    arm64: dts: imx95-15x15-evk: Use phys to replace xceiver-supply
    
    The TJA1051T/3 used on i.MX95-15x15-EVK is actually high-speed CAN
    transceiver, not a regulator supply. So use phys to reflect the truth.
    
    Reviewed-by: Frank Li 
    Acked-by: Marc Kleine-Budde 
    Signed-off-by: Peng Fan 
    Signed-off-by: Shawn Guo 

commit 3c1df79fe708e6e5c321d540fb214ce630a54d85
Author: Alexander Stein 
Date:   Fri Dec 12 09:59:00 2025 +0100

    ARM: dts: imx6qdl: Add default GIC address cells
    
    Add missing address-cells 0 to GPC interrupt node to silence W=1
    warning:
    
      imx6qdl.dtsi:281.4-284.29: Warning (interrupt_map): /soc/pcie@1ffc000:interrupt-map:
        Missing property '#address-cells' in node /soc/bus@2000000/gpc@20dc000, using 0 as fallback
    
    Value '0' is correct because:
    1. GPC interrupt controller children are only power domains,
    2. interrupt-map property (in PCI node) consists of five components and
       the fourth component "parent unit address", which size is defined by
       '#address-cells' of the node pointed to by the interrupt-parent
       component, is not used (=0)
    
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 5d96e8677f75d7811aa1a697978961d320161af6
Author: Alexander Stein 
Date:   Fri Dec 12 09:58:59 2025 +0100

    dt-bindings: power: fsl,imx-gpc: Document address-cells
    
    The GPC power controller is an interrupt controllers and can be referenced
    in interrupt-map properties, e.g. PCIe controller, thus the node should
    have address-cells property.
    
    Signed-off-by: Alexander Stein 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Shawn Guo 

commit 5558192707072d810b2c9792dfa7e4455d163705
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:40 2025 +0530

    drm/i915/vrr: Enable DC Balance
    
    Enable DC Balance from vrr compute config and related hw flag.
    Also to add pipe restrictions along with this.
    
    --v2:
    - Use dc balance check instead of source restriction.
    --v3:
    - Club pipe restriction check with dc balance enablement. (Ankit)
    --v4:
    - Separate out Pipe restrictions to patch#7
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Uma Shankar 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-19-mitulkumar.ajitkumar.golani@intel.com

commit 5786499a42e6baaf27f28b64d3e55fb6b289141d
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:39 2025 +0530

    drm/i915/display: Add function to configure event for dc balance
    
    Configure pipe dmc event for dc balance enable/disable.
    
    --v2:
    - Keeping function and removing unnecessary comments. (Jani, Nikula)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Uma Shankar 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-18-mitulkumar.ajitkumar.golani@intel.com

commit 192bc98c6fcf8c602ceaf712dc0cd616ebd73f9d
Author: Ville Syrjälä 
Date:   Tue Dec 23 16:15:38 2025 +0530

    drm/i915/vrr: Pause DC Balancing for DSB commits
    
    Pause the DMC DC Balancing for the remainder of the
    commit so that vmin/vmax won't change after we've baked
    them into the DSB vblank evasion commands.
    
    --v2:
    - Remove typo. (Ankit)
    - Separate vrr enable structuring. (Ankit)
    
    --v3:
    - Add gaurd before accessing DC balance bits.
    - Remove redundancy checks.
    
    --v4:
    - Move events to separate function.
    
    Signed-off-by: Ville Syrjälä 
    Signed-off-by: Mitul Golani 
    Reviewed-by: Uma Shankar 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-17-mitulkumar.ajitkumar.golani@intel.com

commit 27a4250ca27a0995bbe66fc37c7f9bebc7a61744
Author: Ville Syrjälä 
Date:   Tue Dec 23 16:15:37 2025 +0530

    drm/i915/dsb: Add pipedmc dc balance enable/disable
    
    Add function to control DC balance enable/disable bit via DSB.
    
    --v2:
    Remove redundant forward declaration.
    
    Signed-off-by: Ville Syrjälä 
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-16-mitulkumar.ajitkumar.golani@intel.com

commit c4aba65c26fdf15e00b4591b615f5f30ef33633d
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:36 2025 +0530

    drm/i915/display: Wait for VRR PUSH status update
    
    After VRR Push is sent, need to wait till flipline decision boundary
    to get Push bit to get cleared.
    
    --v2:
    - Adjust delays to vrr vmin vblank delays. (Ankit)
    
    --v3:
    - Change intel_vrr_vmin_safe_window_end() so that
    intel_dsb_wait_for_delayed_vblank() uses correct delay. (Ankit)
    
    --v4:
    - Simplify intel_vrr_vmin_safe_window_end implementation. (Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Uma Shankar 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-15-mitulkumar.ajitkumar.golani@intel.com

commit 5bb6250c34781f3c6856b41454ea83325f2adc1e
Author: Ville Syrjälä 
Date:   Tue Dec 23 16:15:35 2025 +0530

    drm/i915/vrr: Implement vblank evasion with DC balancing
    
    Add vblank evasion logic when vrr is already enabled along with
    dc balance is computed.
    
    Signed-off-by: Ville Syrjälä 
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-14-mitulkumar.ajitkumar.golani@intel.com

commit 5e32a46f56035e329005f9d8fc7a317127e99909
Author: Ville Syrjälä 
Date:   Tue Dec 23 16:15:34 2025 +0530

    drm/i915/vblank: Extract vrr_vblank_start()
    
    Initialise delayed vblank position for evasion logic.
    
    Signed-off-by: Ville Syrjälä 
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-13-mitulkumar.ajitkumar.golani@intel.com

commit 4ca36702d808e67a68cb51163f3101875594d0ba
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:33 2025 +0530

    drm/i915/vrr: Write DC balance params to hw registers
    
    Write DC Balance parameters to hw registers.
    
    --v2:
    - Update commit header.
    - Separate crtc_state params from this patch. (Ankit)
    
    --v3:
    - Write registers at compute config.
    - Update condition for write.
    
    --v4:
    - Address issue with state checker.
    
    --v5:
    - Initialise some more dc balance register while enabling VRR.
    
    --v6:
    - FLIPLINE_CFG need to be configure at last, as it is double buffer
    arming point.
    
    --v7:
    - Initialise and reset live value of vmax and vmin as well.
    
    --v8:
    - Add separate functions while writing hw registers. (Ankit)
    
    --v9:
    - Add DC Balance counter enable bit to this patch. (Ankit)
    
    --v10:
    - Add rigister writes to vrr_enable/disable. (Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-12-mitulkumar.ajitkumar.golani@intel.com

commit d780bbebaac137869ad5d95bd42e525fec812830
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:32 2025 +0530

    drm/i915/display: Add DC Balance flip count operations
    
    Track dc balance flip count with params per crtc. Increment
    DC Balance Flip count before every flip to indicate DMC
    firmware about new flip occurrence which needs to be adjusted
    for dc balancing. This is tracked separately from legacy
    FLIP_COUNT register also Reset DC balance flip count value
    while disabling VRR adaptive mode, this is to start with
    fresh counts when VRR adaptive refresh mode is triggered again.
    
    --v2:
    - Call during intel_update_crtc.(Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-11-mitulkumar.ajitkumar.golani@intel.com

commit 80d14983595ba3bc10d4e1349db295a5645276ce
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:31 2025 +0530

    drm/i915/vrr: Add function to reset DC balance accumulated params
    
    Add function which resets all accumulated DC Balance parameters
    whenever adaptive mode of VRR goes off. This helps to give a
    fresh start when VRR is re-enabled.
    
    --v2:
    - Typo, change crtc_state to old_crtc_state. (Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-10-mitulkumar.ajitkumar.golani@intel.com

commit 7bf11bc2f716f6824b3b3d418319967213aab2a5
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:30 2025 +0530

    drm/i915/vrr: Add function to check if DC Balance Possible
    
    Add a function that checks if DC Balance enabling is possible on the
    requested PIPE. Apart from the DISPLAY_VER check, account for current
    firmware limitations, which only allow DC Balance on PIPE A and PIPE B.
    
    v2: Rephrased commit message. (Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-9-mitulkumar.ajitkumar.golani@intel.com

commit 2873c8eaa1e9020b2cfa7abe39ea69af9f93058a
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:29 2025 +0530

    drm/i915/vrr: Add compute config for DC Balance params
    
    Compute DC Balance parameters and tunable params based on
    experiments.
    
    --v2:
    - Document tunable params. (Ankit)
    
    --v3:
    - Add line spaces to compute config. (Ankit)
    - Remove redundancy checks.
    
    --v4:
    - Separate out conpute config to separate function.
    - As all the valuse are being computed in scanlines, and slope
    is still in usec, convert and store it to scanlines.
    
    --v5:
    - Update and add comments for slope calculation. (Ankit)
    - Update early return conditions for dc balance compute. (Ankit)
    
    --v6:
    - Early return condition simplified for dc balance compute config. (Ankit)
    - Make use of pipe restrictions to this patch. (Ankit)
    
    --v7:
    - Separate out PIPE_A and PIPE_B restrictions to other patch.(Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Uma Shankar 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-8-mitulkumar.ajitkumar.golani@intel.com

commit c09112ca3cc9f0d73a53adf4fe5103f6a06e061b
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:28 2025 +0530

    drm/i915/vrr: Add state dump for DC Balance params
    
    Add state dump for dc balance params to track DC Balance
    crtc state config.
    
    -v1:
    -- nitpick: s/Vblank target/vblank target. (Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-7-mitulkumar.ajitkumar.golani@intel.com

commit be843f34803520341324a8c4487caee6d8e14444
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:27 2025 +0530

    drm/i915/vrr: Add DC Balance params to crtc_state
    
    Add DC Balance params to crtc_state, also add state checker
    params for related properties.
    
    --v3:
    - Seggregate crtc_state params with this patch. (Ankit)
    
    --v4:
    - Update commit message and header. (Ankit)
    - Add +1 to VMIN and VMAX only when it is non-zero. (Ankit)
    
    --v5:
    - Add headers in sorted order. (Jani Nikula)
    
    --v6:
    - Add a separate function to get and check dc_balance params.
    - Avoid repeatative use of MMIO read. (Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-6-mitulkumar.ajitkumar.golani@intel.com

commit 19467b46c219878adfd81b9de3f9cb38a198fbe5
Author: Ville Syrjälä 
Date:   Tue Dec 23 16:15:26 2025 +0530

    drm/i915/vrr: Add functions to read out vmin/vmax stuff
    
    Calculate delayed vblank start position with the help of added
    vmin/vmax stuff for next frame and final computation.
    
    --v2:
    - Correct Author details.
    
    --v3:
    - Separate register details from this  patch.
    
    --v4:
    - Add mask macros.
    
    --v5:
    - As live prefix params indicate timings for current frame,
    read just _live prefix values instead of next frame timings as
    done previously.
    - Squash Refactor vrr params patch.
    
    --v6:
    - Use error code while returning invalid values. (Jani, Nikula)
    
    Signed-off-by: Ville Syrjälä 
    Signed-off-by: Mitul Golani 
    Reviewed-by: Uma Shankar 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-5-mitulkumar.ajitkumar.golani@intel.com

commit be19d803df438880528b20f541638507cbefc7e4
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:25 2025 +0530

    drm/i915/vrr: Add VRR DC balance registers
    
    Add VRR register offsets and bits to access DC Balance configuration.
    
    --v2:
    - Separate register definitions. (Ankit)
    - Remove usage of dev_priv. (Jani, Nikula)
    
    --v3:
    - Convert register address offset, from capital to small. (Ankit)
    - Move mask bits near to register offsets. (Ankit)
    
    --v4:
    - Use _MMIO_TRANS wherever possible. (Jani)
    
    --v5:
    - Added LIVE Value registers for VMAX and FLIPLINE as provided by DMC fw
    - For pipe B it is temporary and expected to change later once finalised.
    
    --v6:
    - Add live value registers for DCB VMAX/FLIPLINE.
    
    --v7:
    - Correct commit message file. (Jani Nikula)
    - Add bits in highest to lowest order. (Jani Nikula)
    
    --v8:
    - Register/bitfields indentation changes as per i915_reg.h
    mentioned format (Jani, Ankit)
    
    --v9:
    - Remove comment. (Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-4-mitulkumar.ajitkumar.golani@intel.com

commit 1dee5a4db242e4e351570b74ab2b5793280eeac9
Author: Ville Syrjälä 
Date:   Tue Dec 23 16:15:24 2025 +0530

    drm/i915/dmc: Add pipe dmc registers and bits for DC Balance
    
    Add pipe dmc registers and  access bits for DC Balance params
    configuration and enablement.
    
    --v2:
    - Separate register definitions for transcoder and
    pipe dmc. (Ankit)
    - Use MMIO pipe macros instead of transcoder ones. (Ankit)
    - Remove dev_priv use. (Jani, Nikula)
    
    --v3:
    - Add all register address, from capital alphabet to small. (Ankit)
    - Add EVT CTL registers.
    - Add co-author tag.
    - Add event flag for Triggering DC Balance.
    
    --v4:
    - Add DCB Flip count and balance reset registers.
    
    --v5:
    - Correct macro usage for flip count. (Ankit)
    - Use register offset in lower case.
    
    Signed-off-by: Ville Syrjälä 
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-3-mitulkumar.ajitkumar.golani@intel.com

commit 6739e03a9affdc3d94134d8734299971ec8d8bf5
Author: Mitul Golani 
Date:   Tue Dec 23 16:15:23 2025 +0530

    drm/i915/display: Add source param for dc balance
    
    Add source param for dc balance enablement.
    
    --v2:
    - Arrange in alphabetic order. (Ankit)
    - Update name. (Ankit)
    
    --v3:
    - Commit message update. (Ankit)
    
    Signed-off-by: Mitul Golani 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223104542.2688548-2-mitulkumar.ajitkumar.golani@intel.com

commit 4f0cee99186c452c7f51f41f6e8f63bf2f990428
Author: Tim Harvey 
Date:   Tue Dec 9 12:58:28 2025 -0800

    arm64: dts: imx8m{m,p}-venice-gw71xx: Add Magetometer
    
    Add support for the optional LIS2MDL magnetometer on GW71xx baseboards.
    
    Signed-off-by: Tim Harvey 
    Signed-off-by: Shawn Guo 

commit ad7b5ed46c6815f2b9930d1a10b0cfa78695b495
Author: Alexander Stein 
Date:   Tue Dec 9 11:53:14 2025 +0100

    arm64: dts: tqma8mpql-mba8mp-ras314: Add HDMI audio output support
    
    Add the HDMI audio soundcard and enable necessary nodes.
    
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 53a5c1d98d1155ece4c9446c0fea55e17d08774a
Author: Alexander Stein 
Date:   Tue Dec 9 11:53:13 2025 +0100

    arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings
    
    As per datasheet of the HDMI protection IC the CEC_IC pin has been
    configured as open-drain.
    
    Fixes: ddabb3ce3f90 ("arm64: dts: freescale: add TQMa8MPQL on MBa8MP-RAS314")
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 38bbf7903e8016587f62b614dffc757ff33889a1
Author: Alexander Stein 
Date:   Tue Dec 9 11:53:12 2025 +0100

    arm64: dts: tqma8mpql-mba8mp-ras314: Fix Ethernet PHY IRQ support
    
    Ethernet PHY interrupt mode is level triggered. Adjust the mode
    accordingly.
    
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 5c50503db36df8ed6d1e54f45ee6ea1bdbb5ca7d
Author: Alexander Stein 
Date:   Tue Dec 9 11:53:11 2025 +0100

    arm64: dts: tqma8mpql-mba8mpxl: Configure IEEE 1588 event out signal
    
    The event out signal on channel 2 is available on pad SAI2_RXD0 which is
    connected to X63 pin 13.
    
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 251f9c7ce592e3556a50a7547928262cbfd6d50e
Author: Alexander Stein 
Date:   Tue Dec 9 11:53:10 2025 +0100

    arm64: dts: tqma8mpql-mba8mpxl: Add HDMI audio output support
    
    Add the HDMI audio soundcard and enable necessary nodes.
    
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 8401527abb5e3a00c867b6597b8e1b29c80c9824
Author: Alexander Stein 
Date:   Tue Dec 9 11:53:09 2025 +0100

    arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
    
    As per datasheet of the HDMI protection IC the CEC_IC pin has been
    configured as open-drain.
    
    Fixes: 418d1d840e42 ("arm64: dts: freescale: add initial device tree for TQMa8MPQL with i.MX8MP")
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 3494d778e8d1eff06f0636531379b2ae40e5a2e1
Author: Alexander Stein 
Date:   Tue Dec 9 11:53:08 2025 +0100

    arm64: dts: tqma8mpql-mba8mpxl: Fix Ethernet PHY IRQ support
    
    Ethernet PHY interrupt mode is level triggered. Adjust the mode
    accordingly.
    
    Reviewed-by: Andrew Lunn 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 2b1f623fc83dcbd8820fed3cec73c9138e27a246
Author: Alexander Stein 
Date:   Tue Dec 9 11:53:07 2025 +0100

    arm64: dts: tqma8mpql-mba8mpxl: Adjust copyright text format
    
    Replace personal mail address by mailing list.
    
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 53fb7a3aa55e7ce3968fa74982847872b08a6830
Author: Francesco Dolcini 
Date:   Tue Dec 9 11:17:51 2025 +0100

    arm64: dts: freescale: imx8mp-toradex-smarc: enable hdmi_pai device
    
    Enable the hdmi_pai device on the Toradex SMARC iMX8M Plus Development
    boards.
    
    The hdmi_pai device, together with aud2htx module, hdmi_pai and hdmi
    controller compose the HDMI audio pipeline.
    
    See commit b21f87b8322f ("arm64: dts: imx8mp-evk: enable hdmi_pai
    device") for the equivalent change on the NXP i.MX8MP EVK board.
    
    Signed-off-by: Francesco Dolcini 
    Signed-off-by: Shawn Guo 

commit 9cd778b49692bcdff5d709bd78190aa61a70193c
Author: Francesco Dolcini 
Date:   Tue Dec 9 11:17:50 2025 +0100

    arm64: dts: freescale: imx8mp-verdin: enable hdmi_pai device
    
    Enable the hdmi_pai device on the various iMX8M Plus Verdin boards that
    feature the related HDMI interface.
    
    The hdmi_pai device, together with aud2htx module, hdmi_pai and hdmi
    controller compose the HDMI audio pipeline.
    
    See commit b21f87b8322f ("arm64: dts: imx8mp-evk: enable hdmi_pai
    device") for the equivalent change on the NXP i.MX8MP EVK board.
    
    Signed-off-by: Francesco Dolcini 
    Signed-off-by: Shawn Guo 

commit 98b8de62e846617cdb75c0f480d35cb37d3bc447
Author: Francesco Dolcini 
Date:   Tue Dec 9 11:17:49 2025 +0100

    arm64: dts: freescale: imx8mp-verdin: Remove obsolete TODO comments
    
    Remove obsolete TODO comments, I2S interface is supported since Linux v6.6.
    
    Signed-off-by: Francesco Dolcini 
    Signed-off-by: Shawn Guo 

commit 99bd26b4e5dc12854404bce585b33a9c28c30d3d
Author: Francesco Dolcini 
Date:   Tue Dec 9 09:57:46 2025 +0100

    arm64: dts: freescale: imx8-apalis: Add ethernet alias
    
    Add alias for the apalis first ethernet interface, this ensures
    consistent interface naming (e.g. `end0`) and this is used by the
    firmware to correctly set the MAC address.
    
    Signed-off-by: Francesco Dolcini 
    Signed-off-by: Shawn Guo 

commit 4139384b586b916c8826483331f0054a65767f97
Author: Stefano Radaelli 
Date:   Fri Dec 5 19:22:57 2025 +0100

    arm64: dts: imx93-var-som-symphony: Enable LPSPI6 controller
    
    Enable the LPSPI6 controller so it can be used by user applications
    through the board’s expansion connector.
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit e35fffafd8a4e960296b017a461081bd6bff7cda
Author: Stefano Radaelli 
Date:   Fri Dec 5 19:22:56 2025 +0100

    arm64: dts: imx93-var-som-symphony: Add USB support
    
    The Symphony carrier board includes a USB Type-C connector on the USB1
    port through an NXP PTN5150 Type-C controller connected on the I2C bus.
    The PTN5150 provides cable orientation detection and role switching
    information to the USB controller.
    
    This patch adds the PTN5150 node, its interrupt line, the required pin
    muxing, and wires the controller to the USB1 OTG dual-role device using
    the USB role-switch framework.
    
    This patch adds also USB2 support, that remains in host-only mode,
    matching the hardware capabilities of the Symphony board.
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit 3860538ff7ee027f152d83084a036a84e2cb220b
Author: Stefano Radaelli 
Date:   Fri Dec 5 19:22:55 2025 +0100

    arm64: dts: imx93-var-som-symphony: Add support for ft5x06 touch controller
    
    The Symphony carrier board exposes a capacitive touch interface through an
    FFC/FPC connector. This interface is wired to an FT5x06 touch controller
    on the I2C bus when using Variscite’s 7-inch capacitive touch display.
    
    This patch adds the FT5x06 device node to describe the actual hardware
    connection and enables touch functionality on the Symphony board
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit 8071668e66e523f36ea57b22f00a73ae63afc5f7
Author: Stefano Radaelli 
Date:   Fri Dec 5 19:22:54 2025 +0100

    arm64: dts: imx93-var-som-symphony: Update gpio aliases
    
    This patch introduces 2 simple aliases:
    
    Add a gpio3->gpio4 alias to allow flexible access to these GPIOs
    
    Add a gpio4 alias for the PCA9534 GPIO expander.
    
    Signed-off-by: Stefano Radaelli 
    Signed-off-by: Shawn Guo 

commit e4d60417f6f654bc5d3e0b074f48983861007d47
Author: Yannic Moog 
Date:   Fri Dec 5 10:33:28 2025 +0100

    arm64: dts: imx8mp-phyboard-pollux: add PEB-WLBT-05 expansion board
    
    PEB-WLBT-05 is an expansion board that provides WIFI and Bluetooth
    functionality. It features the Ezurio Sterling LWB module [1].
    Add missing regulator to baseboard dts.
    
    [1] https://www.ezurio.com/wireless-modules/wifi-modules-bluetooth/sterling-lwb-24-ghz-wifi-4-bt-51-module
    
    Signed-off-by: Yannic Moog 
    Signed-off-by: Shawn Guo 

commit 18c783cf09aadf0eab9d6a75806f7aebe559080e
Author: Stefan Riedmueller 
Date:   Fri Dec 5 10:33:27 2025 +0100

    arm64: dts: imx8mp-phyboard-pollux: Enable i2c3
    
    The i2c3 of the phyBOARD-Pollux is used on the CSI1 interface to connect
    to imaging sensors. Thus define it so it can be easily enabled if
    required.
    
    Signed-off-by: Stefan Riedmueller 
    Signed-off-by: Teresa Remmet 
    Reviewed-by: Frank Li 
    Signed-off-by: Yannic Moog 
    Signed-off-by: Shawn Guo 

commit 26927206df533ef58c0123857fc4d17101e65b0a
Author: Yannic Moog 
Date:   Fri Dec 5 10:33:26 2025 +0100

    arm64: dts: imx8mp-phycore-som: add spi-nor supply vcc
    
    The spi flash on the SoM is missing its vcc supply definition. Add
    missing regulator which supplies the flash with 1.8V.
    
    Signed-off-by: Yannic Moog 
    Signed-off-by: Shawn Guo 

commit 749fdd12321d3fa0fb6118d315a8ec9b126f583f
Author: Yannic Moog 
Date:   Fri Dec 5 10:33:25 2025 +0100

    arm64: dts: imx8mp-phyboard-pollux: add fan-supply
    
    Add 5v regulator to gpio fan node.
    
    Reviewed-by: Frank Li 
    Signed-off-by: Yannic Moog 
    Signed-off-by: Shawn Guo 

commit 7b43479e4e1467ea3750d4cc5b12385ceec0364b
Author: Chancel Liu 
Date:   Wed Dec 3 16:06:05 2025 +0900

    arm64: dts: imx91-11x11-evk: Add audio XCVR sound card support
    
    Add audio XCVR sound card, which supports SPDIF TX & RX only,
    eARC RX, ARC RX are not supported.
    
    Signed-off-by: Chancel Liu 
    Signed-off-by: Shawn Guo 

commit c85b67e2ab5f8f8a03d96cf8e082647066e312de
Author: Chancel Liu 
Date:   Wed Dec 3 16:06:04 2025 +0900

    arm64: dts: imx91-11x11-evk: Add PDM microphone sound card support
    
    Add PDM micphone sound card support.
    
    This sound card supports recording sound from PDM microphone
    and convert the PDM format data to PCM data.
    
    Signed-off-by: Chancel Liu 
    Reviewed-by: Daniel Baluta 
    Signed-off-by: Shawn Guo 

commit 3529bf1c7d9e483967151ddb14c76a38c255a54e
Author: Chancel Liu 
Date:   Wed Dec 3 16:06:03 2025 +0900

    arm64: dts: imx91-11x11-evk: Add WM8962 sound card support
    
    Add WM8962 sound card support which connects to SAI3.
    
    Signed-off-by: Chancel Liu 
    Reviewed-by: Daniel Baluta 
    Signed-off-by: Shawn Guo 

commit 08a4d6fb6488136a96b390534f4f6d6e939a4622
Author: Chancel Liu 
Date:   Wed Dec 3 16:06:02 2025 +0900

    arm64: dts: imx91-11x11-evk: Add bt-sco sound card support
    
    Add bt-sco sound card, which is used by BT HFP case.
    It supports wb profile as default.
    
    Signed-off-by: Chancel Liu 
    Reviewed-by: Daniel Baluta 
    Signed-off-by: Shawn Guo 

commit c3085bef552f9cbf68b6b944bcad332c217fdf16
Author: Chancel Liu 
Date:   Wed Dec 3 16:06:01 2025 +0900

    arm64: dts: imx91-11x11-evk: Refine label and node name of WM8962
    
    Refine label with "wm8962" and node name with "codec" to follow
    devicetree specification.
    
    Signed-off-by: Chancel Liu 
    Reviewed-by: Daniel Baluta 
    Signed-off-by: Shawn Guo 

commit 21335bc94ac3a5ac1d5b4ef36a232256a3da2dbd
Author: Haibo Chen 
Date:   Tue Dec 2 14:04:33 2025 +0800

    arm64: dts: imx93-9x9-qsb: add CAN support overlay file
    
    CAN1 and Micfil share pins on imx93-9x9-qsb board, use TMUX1574RSVR
    to control the connection: put sel to high, select CAN1, put sel to
    low, select Micfil. In default, sel keep low.
    
    To support CAN1, need to put the sel to high. Besides, CAN1 use phy
    TJA1057GT/3.
    
    Signed-off-by: Haibo Chen 
    Reviewed-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit b49f2dece02501c0684de70b7e00d1f7742aac88
Author: Alexander Stein 
Date:   Mon Dec 1 08:03:33 2025 +0100

    arm64: dts: tqmls1046a: Move BMAN/QMAN buffers to DRAM1 area
    
    DRAM1 is only 2GiB in size (0x00_8000_0000 - 0x01_0000_0000) which is
    already used by Linux kernel, etc. Move the allocation area of BMAN and
    QMAN to DRAM1 region. This frees the complete DRAM2 area for e.g. CMA.
    
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit b53eb75f26ddfffd61f4f5d5914a5d47fd1fbbf3
Author: Krzysztof Kozlowski 
Date:   Tue Dec 23 16:24:25 2025 +0100

    arm64: dts: cix: Use lowercase hex
    
    The DTS code coding style expects lowercase hex for values and unit
    addresses.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251223152424.155253-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Peter Chen 

commit 2aa1e462508d73e4fa2de26a3d50c867bb784830
Author: Rafael J. Wysocki 
Date:   Mon Dec 29 14:29:59 2025 +0100

    ACPI: sysfs: Add device cid attribute for exposing _CID lists
    
    Add a new sysfs attribute called "cid" under struct acpi_device for
    exposing the list of compatible device IDs returned by the device's
    _CID object, if present.
    
    The new attribute will be present only if the _CID object is present.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Andy Shevchenko 
    Link: https://patch.msgid.link/5957407.DvuYhMxLoT@rafael.j.wysocki

commit 9460eaae2ee42e7f2267ea12b26aa59c391996a7
Author: Rafael J. Wysocki 
Date:   Thu Dec 11 15:18:33 2025 +0100

    ACPI: SBS: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI smart battery subsystem (SBS)
    driver to a platform one.
    
    After this conversion, acpi_smbus_hc_probe() does not need to populate the
    driver_data pointer of the SMBUS HC platform device's ACPI companion any
    more, so update it accordingly.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3390477.aeNJFYEL58@rafael.j.wysocki

commit 6d2590533cdd057cacb3dc5a022fbe7a631bb99a
Author: Rafael J. Wysocki 
Date:   Thu Dec 11 15:17:58 2025 +0100

    ACPI: SMBUS HC: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI SMBUS HC driver to a platform one.
    
    After this conversion, acpi_ec_probe() does not need to populate the
    driver_data pointer of the EC platform device's ACPI companion any
    more, so update it accordingly.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/13909645.uLZWGnKmhe@rafael.j.wysocki

commit db65a06d10b3bf7153ba80cde6e447d440412b9f
Author: Rafael J. Wysocki 
Date:   Thu Dec 11 15:17:23 2025 +0100

    ACPI: EC: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI embedded controller (EC) driver
    to a platform one.
    
    After this conversion, acpi_bus_register_early_device() does not need
    to attempt to bind an ACPI driver to the struct acpi_device created by
    it, so update it accordingly.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    Signed-off-by: Rafael J. Wysocki 
    [ rjw: Removed excess semicolon ]
    Link: https://patch.msgid.link/1946304.tdWV9SEqCh@rafael.j.wysocki
    Signed-off-by: Rafael J. Wysocki 

commit fe9542b8b53cd72cd6304278052a3d7db3f6c824
Author: Rafael J. Wysocki 
Date:   Thu Dec 11 15:16:37 2025 +0100

    ACPI: EC: Register a platform device for ECDT EC
    
    To facilitate converting the ACPI EC driver into a platform one,
    modify acpi_bus_register_early_device(), used by acpi_ec_ecdt_start()
    for creating a struct acpi_device to represent the "early" EC based
    on the ECDT ACPI table, to carry out the default ACPI enumeration for
    the given device which will cause a platform device to be registered
    for it.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2397353.ElGaqSPkdT@rafael.j.wysocki

commit 6e35ab507c88c358274439745d5e574a7e05d7a1
Author: Rafael J. Wysocki 
Date:   Thu Dec 11 15:19:08 2025 +0100

    ACPI: HED: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI hardware error device (HED) driver
    to a platform one.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/8620378.T7Z3S40VBb@rafael.j.wysocki

commit 560cb3bd9a48115f334c0a127347575ca7c13f6f
Author: Shawn Lin 
Date:   Fri Dec 26 09:45:28 2025 +0800

    Documentation: PCI: Fix typos in msi-howto.rst
    
    Fix subject-verb agreement for "has a requirements" as well as
    "neither...or" conjunction mistake. And convert "Message Signalled
    Interrupts" to "Message Signaled Interrupts" to match the PCIe spec.
    
    Signed-off-by: Shawn Lin 
    Signed-off-by: Bjorn Helgaas 
    Tested-by: Randy Dunlap 
    Reviewed-by: Randy Dunlap 
    Reviewed-by: Bagas Sanjaya 
    Link: https://patch.msgid.link/1766713528-173281-1-git-send-email-shawn.lin@rock-chips.com

commit 8df20813eb01fe29b4507fd470d73675bda3e1dd
Author: Alex Elder 
Date:   Fri Dec 26 11:32:27 2025 -0600

    phy: Kconfig: spacemit: add COMMON_CLK dependency
    
    The SpacemiT PCIe PHY driver depends on the common clock framework.
    Not specifying that led to a failure when doing a COMPILE_TEST build
    for the SPARC architecture.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512251903.sTVZgg6c-lkp@intel.com/
    Signed-off-by: Alex Elder 
    Reviewed-by: Javier Martinez Canillas 
    Link: https://patch.msgid.link/20251226173228.2020411-1-elder@riscstar.com
    Signed-off-by: Vinod Koul 

commit 7acc70476f14661149774ab88d3fe23d83ba4249
Author: Danilo Krummrich 
Date:   Thu Dec 18 16:50:51 2025 +0100

    gpu: nova-core: gsp: move appropriate code into pin initializer
    
    Relocate the code that technically fits in the pin initializer into the
    initializer itself.
    
    While, thanks to pin_init_scope(), it is also possible to keep it as is,
    moving appropriate code into the initializer has the advantage that it
    structures the dependencies of fields naturally.
    
    For instance, intermediate data that is only needed for a single field
    goes into the initializer block of this field, making it obvious that it
    is not needed by anything else.
    
    On the other hand, intermediate data that is needed for multiple fields
    to initialize remains above the initializer, naturally indicating that
    it is needed my multiple fields.
    
    Reviewed-by: Joel Fernandes 
    Link: https://patch.msgid.link/20251218155239.25243-5-dakr@kernel.org
    Signed-off-by: Danilo Krummrich 

commit 032a6772d663a26005f4c17be992a716457f095b
Author: Danilo Krummrich 
Date:   Thu Dec 18 16:50:50 2025 +0100

    gpu: nova-core: gsp: get rid of redundant Result in Gsp::new()
    
    In Gsp::new(), utilize pin_init_scope() to get rid of the Result in the
    returned
    
            Result>
    
    which is unnecessarily redundant.
    
    Reviewed-by: Joel Fernandes 
    Link: https://patch.msgid.link/20251218155239.25243-4-dakr@kernel.org
    Signed-off-by: Danilo Krummrich 

commit 423706aa1c469bfcc3c27a9e8c464f6b88921db7
Author: Danilo Krummrich 
Date:   Thu Dec 18 16:50:49 2025 +0100

    gpu: nova-core: fw: move appropriate code into pin initializer
    
    Relocate the code that technically fits in the pin initializer into the
    initializer itself.
    
    While, thanks to pin_init_scope(), it is also possible to keep it as is,
    moving appropriate code into the initializer has the advantage that it
    structures the dependencies of fields naturally.
    
    For instance, intermediate data that is only needed for a single field
    goes into the initializer block of this field, making it obvious that it
    is not needed by anything else.
    
    On the other hand, intermediate data that is needed for multiple fields
    to initialize remains above the initializer, naturally indicating that
    it is needed my multiple fields.
    
    Reviewed-by: Joel Fernandes 
    Link: https://patch.msgid.link/20251218155239.25243-3-dakr@kernel.org
    Signed-off-by: Danilo Krummrich 

commit db22fbc15a9cea7e3f74a53d36c381503b6ca43e
Author: Danilo Krummrich 
Date:   Thu Dec 18 16:50:48 2025 +0100

    gpu: nova-core: fw: get rid of redundant Result in GspFirmware::new()
    
    In GspFirmware::new(), utilize pin_init_scope() to get rid of the Result
    in the returned
    
            Result>
    
    which is unnecessarily redundant.
    
    Reviewed-by: Joel Fernandes 
    Link: https://patch.msgid.link/20251218155239.25243-2-dakr@kernel.org
    Signed-off-by: Danilo Krummrich 

commit 03f336a869b3a3f119d3ae52ac9723739c7fb7b6
Author: Haotian Zhang 
Date:   Mon Nov 10 12:04:46 2025 +0800

    PCI: endpoint: Add missing NULL check for alloc_workqueue()
    
    alloc_workqueue() can return NULL on memory allocation failure. Without
    proper error checking, this may lead to a NULL pointer dereference when
    queue_work() is later called with the NULL workqueue pointer in
    epf_ntb_epc_init().
    
    Add a NULL check immediately after alloc_workqueue() and return -ENOMEM on
    failure to prevent the driver from loading with an invalid workqueue
    pointer.
    
    Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP")
    Fixes: 8b821cf76150 ("PCI: endpoint: Add EP function driver to provide NTB functionality")
    Signed-off-by: Haotian Zhang 
    Signed-off-by: Manivannan Sadhasivam 
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20251110040446.2065-1-vulab@iscas.ac.cn

commit 0d325cbdc5ce97e6bd391d6a742607814025e69d
Author: Marco Crivellari 
Date:   Wed Nov 5 16:16:49 2025 +0100

    PCI: endpoint: Replace use of system_wq with system_percpu_wq
    
    Currently work items enqueued by schedule_delayed_work() use "system_wq" (a
    per-CPU wq) while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a
    CPU is not specified). The same applies to schedule_work() that is using
    system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND.  This
    lack of consistency cannot be addressed without refactoring the API.
    
    This continues the effort to refactor workqueue APIs, which began with the
    introduction of new workqueues and a new alloc_workqueue() flag in:
    
      128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
      930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    Replace system_wq with system_percpu_wq, keeping the same behavior.  The
    old wq (system_wq) will be kept for a few release cycles.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20251105151649.256274-1-marco.crivellari@suse.com

commit 78f5d0d5a23dd81106cbe999d9dcd522964a8f1a
Author: Marco Crivellari 
Date:   Fri Nov 7 15:25:26 2025 +0100

    PCI: Add WQ_PERCPU to alloc_workqueue() users
    
    Currently work items enqueued by schedule_delayed_work() use "system_wq" (a
    per-CPU wq), while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a
    CPU is not specified). The same applies to schedule_work() that is using
    system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND.  This
    lack of consistency cannot be addressed without refactoring the API.
    
    alloc_workqueue() treats all queues as per-CPU by default, while unbound
    workqueues must opt-in via WQ_UNBOUND.
    
    This default is suboptimal: most workloads benefit from unbound queues,
    allowing the scheduler to place worker threads where they're needed and
    reducing noise when CPUs are isolated.
    
    This continues the effort to refactor workqueue APIs, which began with the
    introduction of new workqueues and a new alloc_workqueue() flag in:
    
      128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
      930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    Add WQ_PERCPU to explicitly request alloc_workqueue() to be per-CPU when
    WQ_UNBOUND has not been specified.
    
    With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
    any alloc_workqueue() caller that doesn't explicitly specify WQ_UNBOUND
    must now use WQ_PERCPU.
    
    Once migration is complete, WQ_UNBOUND can be removed and unbound will
    become the implicit default.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    [bhelgaas: squash similar commits]
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20251107142526.234685-1-marco.crivellari@suse.com
    Link: https://patch.msgid.link/20251107142835.237636-1-marco.crivellari@suse.com
    Link: https://patch.msgid.link/20251107143108.240025-1-marco.crivellari@suse.com
    Link: https://patch.msgid.link/20251107143335.242342-1-marco.crivellari@suse.com
    Link: https://patch.msgid.link/20251107143624.244978-1-marco.crivellari@suse.com

commit 4992ed7813c54f0a676b7707d1f8f16552fdb240
Author: Brendan Jackman 
Date:   Tue Nov 11 17:41:08 2025 +0000

    Documentation/x86: Fix PR_SET_SPECULATION_CTRL error codes
    
    If you force-disable mitigations on the kernel cmdline, for SPEC_STORE_BYPASS
    this ends up with the prctl returning -ENXIO, but contrary to the current docs
    for the other controls it returns -EPERM. Fix that.
    
    Note that this return value should probably be considered a bug. But, making
    the behaviour consistent with the current docs seems more likely to break
    existing users than help anyone out in practice, so just "fix" it by
    specifying it as correct.
    
    Since this is getting more wordy and confusing, also be more explicit about
    "control is not possible" be mentioning the boot configuration, to better
    distinguish this case conceptually from the FORCE_DISABLE failure mode.
    
    Signed-off-by: Brendan Jackman 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20251111-b4-prctl-docs-2-v2-1-bc9d14ec9662@google.com

commit 9e371032cbf0c8fdc757df5510b55e824668b938
Author: Christophe JAILLET 
Date:   Mon Dec 29 11:26:07 2025 +0100

    null_blk: Constify struct configfs_item_operations and configfs_group_operations
    
    'struct configfs_item_operations' and 'configfs_group_operations' are not
    modified in this driver.
    
    Constifying these structures moves some data to a read-only section, so
    increases overall security, especially when the structure holds some
    function pointers.
    
    On a x86_64, with allmodconfig:
    Before:
    ======
       text    data     bss     dec     hex filename
     100263   37808    2752  140823   22617 drivers/block/null_blk/main.o
    
    After:
    =====
       text    data     bss     dec     hex filename
     100423   37648    2752  140823   22617 drivers/block/null_blk/main.o
    
    Signed-off-by: Christophe JAILLET 
    Signed-off-by: Jens Axboe 

commit 255153afbcfdcf30d20048fb76a6d9418537b5d9
Author: Brendan Shephard 
Date:   Mon Dec 15 18:34:16 2025 +1000

    drm/nova: Align GEM memory allocation to system page size
    
    Use page::page_align for GEM object memory allocation to ensure the
    allocation is page aligned. This is important on systems where the
    default page size is not 4k. Such as 16k or 64k aarch64 systems.
    
    This change uses the updated page_align() function which returns
    Option for overflow safety. (See "rust: Return Option from
    page_align and ensure no usize overflow").
    
    Signed-off-by: Brendan Shephard 
    Link: https://patch.msgid.link/20251215083416.266469-1-bshephar@bne-home.net
    [ Import page module only. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit f91ffed95c06e94c835cd7deaea666d69948cde9
Author: Brendan Shephard 
Date:   Tue Dec 23 15:56:47 2025 +1000

    rust: Return Option from page_align and ensure no usize overflow
    
    Change `page_align()` to return `Option` to allow validation
    of the provided `addr` value. This ensures that any value that is
    within one `PAGE_SIZE` of `usize::MAX` will not panic, and instead
    returns `None` to indicate overflow.
    
    Signed-off-by: Brendan Shephard 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Alexandre Courbot 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251223055647.9761-1-bshephar@bne-home.net
    [ Use kernel vertical style for imports; use markdown in comments.
      - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 0923a618a78fe4e329d79d6d50f8db2620845d39
Author: Chen Ni 
Date:   Mon Jul 1 15:21:18 2024 +0800

    RAS/AMD/ATL: Remove an unneeded semicolon
    
    Remove an unneeded semicolon. No functional changes.
    
    Detected by Coccinelle.
    
    Signed-off-by: Chen Ni 
    Signed-off-by: Borislav Petkov (AMD) 
    Link: https://patch.msgid.link/20240701072118.846277-1-nichen@iscas.ac.cn

commit 68ac85fb42cfeb081cf029acdd8aace55ed375a2
Author: Shawn Lin 
Date:   Wed Dec 24 09:38:52 2025 +0800

    PCI: dwc: Use cfg0_base as iMSI-RX target address to support 32-bit MSI devices
    
    commit f3a296405b6e ("PCI: dwc: Strengthen the MSI address allocation
    logic") strengthened the iMSI-RX target address allocation logic to handle
    64-bit addresses for platforms without 32-bit DMA addresses. However, it
    still left 32-bit MSI capable endpoints (EPs) non-functional on such
    platforms.
    
    Per DWC databook r6.21a, sec 3.10.2.3, it states:
    "The iMSI-RX is programmed with an address (MSI_CTRL_ADDR_OFF and
    MSI_CTRL_UPPER_ADDR_OFF) that is used as the system MSI address. When an
    inbound MWr request is passed to the AXI bridge and matches this address
    as well as the conditions specified for an MSI memory write request, an
    MSI interrupt is detected. When this MWr is about to be driven onto the
    AXI bridge master interface1, it is dropped and never appears on the AXI
    bus."
    
    Since iMSI-RX MSI_CTRL_ADDR doesn't require actual system memory mapping,
    any 32-bit address that won't be used for BAR memory allocations can be
    assigned. So assign cfg0_base to the iMSI-RX target address as the first
    option if it's a 32-bit address, which satisfies this requirement.
    Otherwise, fallback to the existing coherent allocation.
    
    cc: Ajay Agarwal 
    cc: Will McVicker 
    Signed-off-by: Shawn Lin 
    [mani: trimmed the description to exclude testbed info and used imperative tone]
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/1766540332-24235-1-git-send-email-shawn.lin@rock-chips.com

commit c18bde85706ddbd7ad1e130498b26d33a3733371
Author: Andy Shevchenko 
Date:   Mon Dec 29 14:51:19 2025 +0100

    auxdisplay: arm-charlcd: Remove redundant ternary operators
    
    For ternary operators in the form of a ? true : false, if a itself returns
    a boolean result, the ternary operator can be omitted. Remove redundant
    ternary operators to clean up the code.
    
    Signed-off-by: Andy Shevchenko 

commit 548d6800fad6b55086addc8450d1f243a9167f35
Author: Andy Shevchenko 
Date:   Fri Mar 17 17:47:08 2023 +0200

    auxdisplay: arm-charlcd: Join string literals back
    
    For easy grepping on debug purposes join string literals back in
    the messages.
    
    No functional change.
    
    Signed-off-by: Andy Shevchenko 

commit b7eda5634e9b1e8bb1930c7b27511fde4ed8efa5
Author: Andy Shevchenko 
Date:   Mon Dec 29 14:42:32 2025 +0100

    auxdisplay: arm-charlcd: Use readl_poll_timeout
    
    Use readl_poll_timeout_atomic() from  instead of using
    custom poll loops.
    
    The timeout settings are different, but that shouldn't be much of a
    problem. Instead of polling 10 times in a close loop, it polls for
    one millisecond.
    
    Signed-off-by: Andy Shevchenko 

commit de2248f7a4965f629390322063a1ff1742014efa
Author: Andy Shevchenko 
Date:   Tue Nov 11 12:18:36 2025 +0100

    auxdisplay: arm-charlcd: Don't use "proxy" headers
    
    Update header inclusions to follow IWYU (Include What You Use) principle.
    
    Signed-off-by: Andy Shevchenko 

commit c77851631c36fa002c72064d4f10d77707b58ca9
Author: Andy Shevchenko 
Date:   Mon Dec 29 13:53:38 2025 +0100

    auxdisplay: arm-charlcd: drop of_match_ptr()
    
    The general recommendation is to not use of_match_ptr(). Drop it.
    
    Signed-off-by: Andy Shevchenko 

commit 099ef9ab9203dff327f2d61e44773f9acbc01f13
Author: Konstantin Komarov 
Date:   Fri Dec 26 16:45:19 2025 +0300

    fs/ntfs3: implement iomap-based file operations
    
    This patch modifies the ntfs3 driver by replacing the buffer_head-based
    operations with the iomap ones.
    
    Implementation details:
    - Implements core iomap operations (ntfs_iomap_begin/end) for block mapping:
        Proper handling of resident attributes via IOMAP_INLINE.
        Support for sparse files through IOMAP_HOLE semantics.
        Correct unwritten extent handling for zeroing operations.
    - Replaces custom implementations with standardized iomap helpers:
        Converts buffered reads to use iomap_read_folio and iomap_readahead.
        Implements iomap_file_buffered_write for write operations.
        Uses iomap_dio_rw for direct I/O paths.
        Migrates zero range operations to iomap_zero_range.
    - Preserves special handling paths for compressed files
    - Implements proper EOF/valid data size management during writes
    
    Signed-off-by: Konstantin Komarov 

commit e37a75bb866c29da954b51d0dd7670406246d9ee
Author: Szymon Wilczek 
Date:   Mon Dec 22 16:10:10 2025 +0100

    fs/ntfs3: fix deadlock in ni_read_folio_cmpr
    
    Syzbot reported a task hung in ni_readpage_cmpr (now ni_read_folio_cmpr).
    This is caused by a lock inversion deadlock involving the inode mutex
    (ni_lock) and page locks.
    
    Scenario:
    1. Task A enters ntfs_read_folio() for page X. It acquires ni_lock.
    2. Task A calls ni_read_folio_cmpr(), which attempts to lock all pages in
       the compressed frame (including page Y).
    3. Concurrently, Task B (e.g., via readahead) has locked page Y and
       calls ntfs_read_folio().
    4. Task B waits for ni_lock (held by A).
    5. Task A waits for page Y lock (held by B).
       -> DEADLOCK.
    
    The fix is to restructure locking: do not take ni_lock in ntfs_read_folio().
    Instead, acquire ni_lock inside ni_read_folio_cmpr() ONLY AFTER all required
    page locks for the frame have been successfully acquired. This restores the
    correct lock ordering (Page Lock -> ni_lock) consistent with VFS.
    
    Reported-by: syzbot+5af33dd272b913b65880@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=5af33dd272b913b65880
    Fixes: f35590ee26f5 ("fs/ntfs3: remove ntfs_bio_pages and use page cache for compressed I/O")
    Signed-off-by: Szymon Wilczek 
    [almaz.alexandrovich@paragon-software.com: ni_readpage_cmpr was renamed to ni_read_folio_cmpr]
    Signed-off-by: Konstantin Komarov 

commit c61326967728392931f8a2240cb2cf4c81b523c1
Author: Konstantin Komarov 
Date:   Fri Dec 26 15:59:47 2025 +0300

    fs/ntfs3: implement llseek SEEK_DATA/SEEK_HOLE by scanning data runs
    
    The generic llseek implementation does not understand ntfs data runs,
    sparse regions, or compression semantics, and therefore cannot correctly
    locate data or holes in files.
    
    Add a filesystem-specific llseek handler that scans attribute data runs
    to find the next data or hole starting at the given offset. Handle
    resident attributes, sparse runs, compressed holes, and the implicit hole
    at end-of-file.
    
    Signed-off-by: Konstantin Komarov 

commit 356fa248168be90109b66f32a61b8eaedc98424a
Author: Konstantin Komarov 
Date:   Fri Dec 12 14:38:10 2025 +0300

    fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
    
    Handle ntfs_read_folio() early when the folio offset is beyond i_valid
    by zero-filling the folio and marking it uptodate. This avoids needless
    I/O and locking, improves read performance.
    
    Signed-off-by: Konstantin Komarov 

commit 576248a34b927e93b2fd3fff7df735ba73ad7d01
Author: Konstantin Komarov 
Date:   Fri Dec 12 14:33:19 2025 +0300

    fs/ntfs3: handle attr_set_size() errors when truncating files
    
    If attr_set_size() fails while truncating down, the error is silently
    ignored and the inode may be left in an inconsistent state.
    
    Signed-off-by: Konstantin Komarov 

commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba
Author: Konstantin Komarov 
Date:   Fri Dec 12 14:27:48 2025 +0300

    fs/ntfs3: drop preallocated clusters for sparse and compressed files
    
    Do not keep preallocated clusters for sparsed and compressed files.
    Preserving preallocation in these cases causes fsx failures when running
    with sparse files and preallocation enabled.
    
    Signed-off-by: Konstantin Komarov 

commit dcd9d6a47199565d83d61a11bbf91fa2ade4d676
Author: Konstantin Komarov 
Date:   Fri Dec 12 14:12:18 2025 +0300

    fs/ntfs3: fsync files by syncing parent inodes
    
    Some xfstests expect fsync() on a file or directory to also persist
    directory metadata up the parent chain. Using generic_file_fsync() is not
    sufficient for ntfs, because parent directories are not explicitly
    written out.
    
    Signed-off-by: Konstantin Komarov 

commit 377cae9851e8559e9d8b82a78c1ac0abeb18839c
Author: Chris J Arges 
Date:   Sat Dec 27 21:18:54 2025 -0600

    ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()
    
    KASAN reported a stack-out-of-bounds access in ima_appraise_measurement
    from is_bprm_creds_for_exec:
    
    BUG: KASAN: stack-out-of-bounds in ima_appraise_measurement+0x12dc/0x16a0
     Read of size 1 at addr ffffc9000160f940 by task sudo/550
    The buggy address belongs to stack of task sudo/550
    and is located at offset 24 in frame:
      ima_appraise_measurement+0x0/0x16a0
    This frame has 2 objects:
      [48, 56) 'file'
      [80, 148) 'hash'
    
    This is caused by using container_of on the *file pointer. This offset
    calculation is what triggers the stack-out-of-bounds error.
    
    In order to fix this, pass in a bprm_is_check boolean which can be set
    depending on how process_measurement is called. If the caller has a
    linux_binprm pointer and the function is BPRM_CHECK we can determine
    is_check and set it then. Otherwise set it to false.
    
    Fixes: 95b3cdafd7cb7 ("ima: instantiate the bprm_creds_for_exec() hook")
    
    Signed-off-by: Chris J Arges 
    Signed-off-by: Mimi Zohar 

commit a8f4a4fb34accd19081484d54631f8cacf1eb06b
Author: Andy Shevchenko 
Date:   Mon Dec 29 14:16:32 2025 +0100

    auxdisplay: arm-charlcd: Remove unneeded info message
    
    When probe succeeds we have other means to check if it was successful,
    no need to pollute kernel log with the practically duplicated info.
    
    Signed-off-by: Andy Shevchenko 

commit 483d86cf4b94f7a390b2a9e5e26a81f3a14bd145
Author: Andy Shevchenko 
Date:   Mon Dec 29 14:03:06 2025 +0100

    auxdisplay: arm-charlcd: convert to use device managed APIs
    
    The current probe function of the driver is implemented by using
    plain old APIs. As Geert noted, one of the error paths has a mistake
    that may lead to a wrong call. Instead of targeting that particular
    issue, convert the driver to use device managed APIs altogether.
    It's not needed per se (driver can never be removed once loaded),
    but it simplifies coding and error handling.
    
    Reported-by: Geert Uytterhoeven 
    Closes: https://lore.kernel.org/r/CAMuHMdVquNEoxRQkcBEH0nC+CDuib6o0H6m3CBk3ZN2267LpQw@mail.gmail.com
    Signed-off-by: Andy Shevchenko 

commit 4e6c3b68c1d51a74b65de9c2dfeb9734fbb8208a
Author: Chancel Liu 
Date:   Mon Dec 1 15:58:44 2025 +0900

    arm64: dts: imx93-14x14-evk: Add audio XCVR sound card
    
    Add audio XCVR sound card, which supports SPDIF TX & RX only,
    eARC RX, ARC RX are not supported.
    
    Signed-off-by: Chancel Liu 
    Reviewed-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit adee0d6614349ab06e4a7766139803609a891fda
Author: Chancel Liu 
Date:   Mon Dec 1 15:58:43 2025 +0900

    arm64: dts: imx93-14x14-evk: Add bt-sco sound card support
    
    Add bt-sco sound card, which is used by BT HFP case.
    It supports wb profile as default.
    
    Signed-off-by: Chancel Liu 
    Reviewed-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit 9915bc977b9829f50cd930811a12b3b4f0c7b048
Author: Dmitry Baryshkov 
Date:   Fri Nov 28 06:02:42 2025 +0200

    ARM: multi_v7_defconfig: enable DA9052 and MC13XXX
    
    Enable PMICs used on i.MX53 Quick-Start Boards: DA9052 for i.MX53 QSB
    and MC13XXX for i.MX53 QSRB (it has Freescale MC34708 PMIC).
    
    Signed-off-by: Dmitry Baryshkov 
    Signed-off-by: Shawn Guo 

commit e00ac93be0121c866163094572d4517f2699ad3f
Author: Laurentiu Mihalcea 
Date:   Wed Nov 26 04:42:18 2025 -0800

    arm64: dts: imx8ulp: add sim lpav node
    
    Add DT node for the SIM LPAV module.
    
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Frank Li 
    Signed-off-by: Laurentiu Mihalcea 
    Signed-off-by: Shawn Guo 

commit a4f7357d5328cf6d005853a783229320d68d1f6a
Author: Haibo Chen 
Date:   Wed Nov 26 16:06:44 2025 +0800

    arm64: dts: imx943-evk: add flexcan support
    
    Add flexcan2 and flexcan4, and related phys support.
    
    Signed-off-by: Haibo Chen 
    Reviewed-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit fb617c00e4ed993e85cb475a863a369fb9a27fe7
Author: Daniel Schultz 
Date:   Mon Nov 24 01:22:42 2025 -0800

    arm64: dts: imx8mm: Add label to thermal-zones
    
    Add 'thermal_zones' as a label to the thermal-zones node.
    
    Without this label, it is not possible to add additional
    trip points in board files. For example, to add an active
    trip point for controlling a fan.
    
    Signed-off-by: Daniel Schultz 
    Signed-off-by: Shawn Guo 

commit bb5b318f11e6f41c8cbb51848555f58b9ef175e6
Author: Rogerio Pimentel 
Date:   Sun Nov 23 13:14:44 2025 -0500

    arm64: dts: add support for NXP i.MX8MP FRDM board
    
    The FRDM-i.MX8MP is an NXP development platform based on the i.MX8M Plus
    SoC, featuring a quad Cortex-A53, Cortex-M7 co-processor, 4GB LPDDR4,
    32GB eMMC, Wi-Fi 6/Bluetooth 5.4/802.15.4 tri-radio, Ethernet, HDMI/MIPI
    display interfaces, camera connectors, and standard expansion headers.
    
    Based on the device tree found in the NXP repository at github
    https://github.com/nxp-imx-support/meta-imx-frdm and on imx8mp-evk
    board kernel mainline device tree.
    
    This is a basic device tree supporting:
    
     - Quad Cortex-A53
     - 4GB LPDDR4 DRAM
     - PCA9450C PMIC with regulators
     - Two NXP PCAL6416 GPIO expanders
     - RGB LEDs via GPIO expander
     - I2C1, I2C2, I2C3 controllers
     - UART2 (console) and UART3 (with RTS/CTS)
     - USDHC3 (8-bit eMMC)
     - SNVS power key (onboard power button)
    
    Co-developed-by: Xiaofeng Wei 
    Signed-off-by: Xiaofeng Wei 
    Signed-off-by: Rogerio Pimentel 
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Shawn Guo 

commit 7834d199a7d7e49e4ccb6a2dd465febb683026f0
Author: Alexander Stein 
Date:   Fri Nov 21 08:31:41 2025 +0100

    arm64: dts: tqma8xxs-mb-smarc-2: replace 0 with IMX_LPCG_CLK_0 for lpcg indices
    
    Replace the 0 with IMX_LPCG_CLK_0 for LPCG clock indices. Although the
    numerical value is identical, the LPCG input is defined as
    IMX_LPCG_CLK_, so using the symbolic constant improves clarity and
    consistency with the LPCG clock naming convention.
    
    Signed-off-by: Alexander Stein 
    Reviewed-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit 81c6b6ffbda1ad077896e719a23c09c8690f2a9b
Author: Alexander Stein 
Date:   Fri Nov 21 08:31:40 2025 +0100

    arm64: dts: tqma8xxs: replace 0 with IMX_LPCG_CLK_0 for lpcg indices
    
    Replace the 0 with IMX_LPCG_CLK_0 for LPCG clock indices. Although the
    numerical value is identical, the LPCG input is defined as
    IMX_LPCG_CLK_, so using the symbolic constant improves clarity and
    consistency with the LPCG clock naming convention.
    
    Signed-off-by: Alexander Stein 
    Reviewed-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit 4ea67ed403d922e9ad6a1289967e6a0aa1b7e73f
Author: Frank Li 
Date:   Thu Nov 20 16:53:50 2025 -0500

    arm64: dts: imx8qxp-mek: Add sensors under i2c1 bus
    
    Add sensors under i2c1 bus.
    
    Signed-off-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit 92ecc94b2786c71d52e193edad9fcb15cf1d923e
Author: Frank Li 
Date:   Thu Nov 20 16:43:18 2025 -0500

    arm64: dts: mba8xx: replace 0 with IMX_LPCG_CLK_0 for lpcg indices
    
    Replace the 0 with IMX_LPCG_CLK_0 for LPCG clock indices. Although the
    numerical value is identical, the LPCG input is defined as
    IMX_LPCG_CLK_, so using the symbolic constant improves clarity and
    consistency with the LPCG clock naming convention.
    
    Signed-off-by: Frank Li 
    Reviewed-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit def8f003d4f3fa5eac34e0d1ba3ba43b681e116a
Author: Rogerio Pimentel 
Date:   Sun Nov 23 13:14:43 2025 -0500

    dt-bindings: arm: fsl: Add i.MX8MP FRDM board
    
    Add device tree compatible string for the i.MX8MP FRDM board.
    
    Acked-by: Conor Dooley 
    Signed-off-by: Rogerio Pimentel 
    Signed-off-by: Shawn Guo 

commit b5c23a4d291d2ac1dfdd574a68a3a68c8da3069e
Author: Thomas Fourier 
Date:   Tue Dec 16 18:47:13 2025 +0100

    auxdisplay: arm-charlcd: fix release_mem_region() size
    
    It seems like, after the request_mem_region(), the corresponding
    release_mem_region() must take the same size. This was done
    in (now removed due to previous refactoring) charlcd_remove()
    but not in the error path in charlcd_probe().
    
    Fixes: ce8962455e90 ("ARM: 6214/2: driver for the character LCD found in ARM refdesigns")
    Signed-off-by: Thomas Fourier 
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Andy Shevchenko 

commit a2e3dda51d550f4226a3e490469fde469ee57189
Author: Ankit Nautiyal 
Date:   Fri Dec 19 11:32:59 2025 +0530

    drm/i915/gvt/display_helper: Get rid of #ifdef/#undefs
    
    Now that i915/display macros have been substituted with wrappers that call
    the new display-device helpers, we can drop the conflicting includes from
    GVT and remove the temporary #ifdef/#undef macro overrides.
    
    Signed-off-by: Ankit Nautiyal 
    Reviewed-by: Jani Nikula 
    Link: https://patch.msgid.link/20251219060302.2365123-7-ankit.k.nautiyal@intel.com

commit 1908784fbc05201e6b969473989dc76d160546c3
Author: Ankit Nautiyal 
Date:   Fri Dec 19 11:32:58 2025 +0530

    drm/i915/gvt: Use the appropriate header for the DPLL macro
    
    The macro `DPLL_ID_SKL_DPLL0` is defined in
    display/intel_dpll_mgr.h. Previously, GVT included the header
    display/intel_display_core.h` because other macros also depended on it.
    After porting those macros to use the new APIs, the only remaining
    dependency was for the DPLL macro.
    
    Replace the indirect include with the correct header and drop
    intel_display_core.h to reduce unnecessary dependencies.
    
    Signed-off-by: Ankit Nautiyal 
    Reviewed-by: Jani Nikula 
    Link: https://patch.msgid.link/20251219060302.2365123-6-ankit.k.nautiyal@intel.com

commit d805e879e15a126a00da2fd02cef0ad353365c6a
Author: Ankit Nautiyal 
Date:   Fri Dec 19 11:32:57 2025 +0530

    drm/i915/gvt: Change for_each_pipe to use pipe_valid API
    
    Add a new API to check if a given pipe is valid using
    DISPLAY_RUNTIME_INFO() for GVT.
    
    Update GVT to use this API instead of accessing
    `DISPLAY_RUNTIME_INFO->pipe_mask` directly in the `for_each_pipe` macro.
    
    Since `for_each_pipe` is defined in i915/display/intel_display.h, which
    also contains other macros used by gvt/display.c, we cannot drop the
    intel_display.h header yet. This causes a build error because
    `for_each_pipe` is included from both i915/display/intel_display.h and
    gvt/display_helpers.h.
    
    To resolve this, rename the GVT macro to `gvt_for_each_pipe` and make it
    call the new API. This avoids exposing display internals and prepares for
    display modularization.
    
    v2:
     - Expose API to check if pipe is valid rather than the runtime info
       pipe mask. (Jani)
     - Rename the macro to `gvt_for_each_pipe` to resolve build error.
    v3:
     - Use EXPORT_SYMBOL_NS_GPL(..., "I915_GVT"); (Jani)
     - Use enum pipe at call sites instead of casting in the macro. (Jani)
    
    Signed-off-by: Ankit Nautiyal 
    Reviewed-by: Jani Nikula 
    Link: https://patch.msgid.link/20251219060302.2365123-5-ankit.k.nautiyal@intel.com

commit d6a3a678569431ed816ac490bf489541bc87b424
Author: Ankit Nautiyal 
Date:   Fri Dec 19 11:32:56 2025 +0530

    drm/i915/gvt: Add header to use display offset functions in macros
    
    Introduce gvt/display_helpers.h to make DISPLAY_MMIO_BASE and
    INTEL_DISPLAY_DEVICE_*_OFFSET macros call exported display functions.
    This lets GVT keep using existing register macros (e.g.,
    TRANSCONF(display, pipe)) while ensuring offset calculations happen
    through functions instead of accessing display internals.
    
    Ideally, we would remove the display headers that define these macros,
    but some macros in GVT still depend on them and have not yet been
    ported. Keeping those headers leads to build conflicts, so as a
    stopgap, we use temporary ifdef/undef blocks to override the macros
    with API-backed versions. These will be removed once all dependent
    macros are ported and the conflicting headers can be safely dropped.
    
    Note:
    TRANSCONF() expects a pipe index but some GVT callers pass a transcoder,
    causing -Werror=enum-conversion.
    Fix: cast to enum pipe in the GVT-side macro override.
    This works for all cases as TRANSCODER_{A,B,C,D} all have 1:1 mapping to
    PIPE_{A,B,C,D} except for TRANSCODER_EDP which is used in one place.
    In any case, the cast preserves the previous behaviour.
    
    v2:
     - Remove prefix `gvt/` while including the header file. (Jani)
     - Explain the rationale behind temporary ifdef/undefs and plan to drop
       them. (Jani).
    v3:
     - Meld the patch to cast argument to enum pipe for the pipe-offset
       macro. (Jani)
     - Add a FIXME to highlight the cast. (Jani)
    
    Signed-off-by: Ankit Nautiyal 
    Reviewed-by: Jani Nikula 
    Link: https://patch.msgid.link/20251219060302.2365123-4-ankit.k.nautiyal@intel.com

commit f3255cf4490ef63b477c1142fc608cf6388e66d4
Author: Ankit Nautiyal 
Date:   Fri Dec 19 11:32:55 2025 +0530

    drm/i915/display: Add APIs to be used by gvt to get the register offsets
    
    GVT code uses macros for register offsets that require display internal
    structures. This makes clean separation of display code and
    modularization difficult.
    
    Introduce APIs to abstract offset calculations:
    - intel_display_device_pipe_offset()
    - intel_display_device_trans_offset()
    - intel_display_device_cursor_offset()
    - intel_display_device_mmio_base()
    
    These APIs return absolute base offsets for the respective register
    groups, allowing GVT to compute MMIO addresses without using internal
    macros or struct fields. This prepares the path to separate
    display-dependent code from i915/gvt/*.
    
    v2:
    - Build GVT APIs only when GVT is actually enabled. (Jani)
    
    Signed-off-by: Ankit Nautiyal 
    Reviewed-by: Jani Nikula  (#v1)
    Link: https://patch.msgid.link/20251219060302.2365123-3-ankit.k.nautiyal@intel.com

commit 71813ecc8436a6b10d528b305a827238e98530c9
Author: Ankit Nautiyal 
Date:   Fri Dec 19 11:32:54 2025 +0530

    drm/i915/display: Abstract pipe/trans/cursor offset calculation
    
    Introduce INTEL_DISPLAY_DEVICE_*_OFFSET() macros to compute absolute
    MMIO offsets for pipe, transcoder, and cursor registers.
    
    Update _MMIO_PIPE2/_MMIO_TRANS2/_MMIO_CURSOR2 to use these macros
    for cleaner abstraction and to prepare for external API usage (e.g. GVT).
    
    Also move DISPLAY_MMIO_BASE() to intel_display_device.h so it can be
    abstracted in GVT, allowing register macros to resolve via
    exported helpers rather than peeking into struct intel_display.
    
    v2: Wrap the macro argument usages in parenthesis. (Jani)
    
    Suggested-by: Jani Nikula 
    Signed-off-by: Ankit Nautiyal 
    Reviewed-by: Jani Nikula 
    Link: https://patch.msgid.link/20251219060302.2365123-2-ankit.k.nautiyal@intel.com

commit 7bf97992afa4e815f4ed84638340e2a93de65504
Merge: d43a12e4743511 f8f9c1f4d0c7a6
Author: Danilo Krummrich 
Date:   Mon Dec 29 12:30:06 2025 +0100

    Merge tag 'v6.19-rc3' into driver-core-next
    
    We need the driver-core fixes in here as well to build on top of.
    
    Signed-off-by: Danilo Krummrich 

commit 8314d2c28d3369bc879af8e848f810292b16d0af
Author: Kumari Pallavi 
Date:   Fri Dec 26 12:35:34 2025 +0530

    misc: fastrpc: Update dma_bits for CDSP support on Kaanapali SoC
    
    DSP currently supports 32-bit IOVA (32-bit PA + 4-bit SID) for
    both Q6 and user DMA (uDMA) access. This is being upgraded to
    34-bit PA + 4-bit SID due to a hardware revision in CDSP for
    Kaanapali SoC, which expands the DMA addressable range.
    Update DMA bits configuration in the driver to support CDSP on
    Kaanapali SoC. Set the default `dma_bits` to 32-bit and update
    it to 34-bit based on CDSP and OF matching on the fastrpc node.
    
    Signed-off-by: Kumari Pallavi 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20251226070534.602021-5-kumari.pallavi@oss.qualcomm.com
    Signed-off-by: Greg Kroah-Hartman 

commit 1d94ce8996d71d77e2d649db9e5c205f423e2c17
Author: Kumari Pallavi 
Date:   Fri Dec 26 12:35:33 2025 +0530

    misc: fastrpc: Add support for new DSP IOVA formatting
    
    Implement the new IOVA formatting required by the DSP architecture change
    on Kaanapali SoC. Place the SID for DSP DMA transactions at bit 56 in the
    physical address. This placement is necessary for the DSPs to correctly
    identify streams and operate as intended.
    To address this, set SID position to bit 56 via OF matching on the fastrpc
    node; otherwise, default to legacy 32-bit placement.
    This change ensures consistent SID placement across DSPs.
    
    Signed-off-by: Kumari Pallavi 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20251226070534.602021-4-kumari.pallavi@oss.qualcomm.com
    Signed-off-by: Greg Kroah-Hartman 

commit 428b2f2b60c37f69e0723a225135da1f352d2602
Author: Kumari Pallavi 
Date:   Fri Dec 26 12:35:32 2025 +0530

    misc: fastrpc: Rename phys to dma_addr for clarity
    
    The fields buf->phys and map->phys currently store DMA addresses
    returned by dma_map_*() APIs, not physical addresses. This naming
    is misleading and may lead to incorrect assumptions about the
    address type and its translation.
    Rename these fields from phys to dma_addr to improve code clarity
    and align with kernel conventions for dma_addr_t usage.
    
    Signed-off-by: Kumari Pallavi 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20251226070534.602021-3-kumari.pallavi@oss.qualcomm.com
    Signed-off-by: Greg Kroah-Hartman 

commit 53da3f51e491c8aeee25004be9d95c30d5efdf5b
Author: Kumari Pallavi 
Date:   Fri Dec 26 12:35:31 2025 +0530

    dt-bindings: misc: qcom,fastrpc: Add compatible for Kaanapali
    
    Kaanapali introduces changes in DSP IOVA layout and CDSP DMA addressing
    that differ from previous SoCs. The SID field moves within the physical
    address, and CDSP now supports a wider DMA range, requiring updated
    sid_pos and DMA mask handling in the driver.
    
    Signed-off-by: Kumari Pallavi 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251226070534.602021-2-kumari.pallavi@oss.qualcomm.com
    Signed-off-by: Greg Kroah-Hartman 

commit 174e2a339bf731e080ced67c215ad609a677560b
Author: Xi Ruoyao 
Date:   Tue Dec 9 20:50:19 2025 +0800

    rust_binder: Fix build failure if !CONFIG_COMPAT
    
    The bindgen utility cannot handle "#define compat_ptr_ioctl NULL" in the
    C header, so we need to handle this case on our own.
    
    Simply skip this field in the initializer when !CONFIG_COMPAT as the
    SAFETY comment above this initializer implies this is allowed.
    
    Reported-by: Miguel Ojeda 
    Closes: https://lore.kernel.org/all/CANiq72mrVzqXnAV=Hy2XBOonLHA6YQgH-ckZoc_h0VBvTGK8rA@mail.gmail.com/
    Signed-off-by: Xi Ruoyao 
    Reviewed-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251209125029.1117897-1-xry111@xry111.site
    Signed-off-by: Greg Kroah-Hartman 

commit 46c549ef78899addd7c6adc407621640778fad1e
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:22:17 2025 +0100

    rust_binder: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Reviewed-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251222-cstr-staging-v1-1-974149ba4a79@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 582ce8ea201292ecc020505ab258991cdc7d0bd2
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:21:23 2025 +0100

    rust: miscdevice: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-char-misc-v1-1-d218537d28ab@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit c1ea31205edf2fd748bc6ceb081033bcfa0a869a
Author: Alice Ryhl 
Date:   Wed Dec 3 14:48:09 2025 +0000

    rust_binder: add binder_transaction tracepoint
    
    This patch adds the binder_transaction tracepoint to Rust Binder. This
    was chosen as the next tracepoint to add as it is the most complex
    tracepoint. (And it's also an important tracepoint known to perfetto.)
    
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251203-binder-trace1-v1-2-22d3ffddb44e@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit c1093b85890693fa2d372468f279854c3624d2b1
Author: Alice Ryhl 
Date:   Wed Dec 3 14:48:08 2025 +0000

    rust: sync: add Arc::DATA_OFFSET
    
    This constant will be used to expose some offset constants from the Rust
    Binder driver to tracepoints which are implemented in C. The constant is
    usually equal to sizeof(refcount_t), but may be larger if T has a large
    alignment.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251203-binder-trace1-v1-1-22d3ffddb44e@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit 0c4ce29612bcd1f74d924cbc4abd133dc002e5e6
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:27 2025 +0000

    rust: binder: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-3-a2e13cbc17a6@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit 953deba747911225bcb936b3fa1cd02014910b17
Author: Atharv Dubey 
Date:   Sat Nov 29 17:45:13 2025 +0530

    rust: miscdevice: use `pin_init::zeroed()` for C type initialization
    
    Replace manual zero-initialization using
    `MaybeUninit::zeroed().assume_init()` with `pin_init::zeroed()`.
    The `pin_init` helper provides a safer and clearer API for
    zero-initializing C structs without requiring an `unsafe` block.
    
    Link: https://github.com/Rust-for-Linux/linux/issues/1189
    Signed-off-by: Atharv Dubey 
    Reviewed-by: Alexandre Courbot 
    Link: https://patch.msgid.link/20251129121513.20738-1-atharvd440@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit e849ada70c6b1ee22e9f4f5c0e38231dcee53f04
Author: Alper Ak 
Date:   Sat Dec 27 02:02:48 2025 +0300

    char: misc: Use IS_ERR() for filp_open() return value
    
    filp_open() never returns NULL, it returns either a valid pointer or an
    error pointer. Using IS_ERR_OR_NULL() is unnecessary. Additionally, if
    filp were NULL, PTR_ERR(NULL) would return 0, leading to a misleading
    error message.
    
    Fixes: 74d8361be344 ("char: misc: add test cases")
    Reported-by: kernel test robot 
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/r/202506132058.thWZHlrb-lkp@intel.com/
    Signed-off-by: Alper Ak 
    Acked-by: Thadeu Lima de Souza Cascardo 
    Link: https://patch.msgid.link/20251226230248.113073-1-alperyasinak1@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit dad9f13d967b4e53e8eaf5f9c690f8e778ad9802
Author: Felix Gu 
Date:   Fri Dec 26 18:22:43 2025 +0800

    misc: ti_fpc202: fix a potential memory leak in probe function
    
    Use for_each_child_of_node_scoped() to simplify the code and ensure the
    device node reference is automatically released when the loop scope
    ends.
    
    Signed-off-by: Felix Gu 
    Reviewed-by: Romain Gantois 
    Link: https://patch.msgid.link/tencent_FA1AC670F5CF49873F88A44424F866994A08@qq.com
    Signed-off-by: Greg Kroah-Hartman 

commit 40fc797ba18328e57ed1cb213b4b5e48f86f4c7c
Author: Carlos Llamas 
Date:   Mon Dec 15 18:17:09 2025 +0000

    binder: fix trivial typo in uapi header
    
    As reported by codespell:
    
      include/uapi/linux/android/binder.h:281: interupted ==> interrupted
    
    Signed-off-by: Carlos Llamas 
    Reviewed-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251215181724.3811977-1-cmllamas@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit ba75ecb97d3f4e95d59002c13afb6519205be6cb
Author: Tuo Li 
Date:   Thu Dec 11 14:36:37 2025 +0800

    misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
    
    In the function bcm_vk_read(), the pointer entry is checked, indicating
    that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
    following code may cause null-pointer dereferences:
    
      struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
      set_msg_id(&tmp_msg, entry->usr_msg_id);
      tmp_msg.size = entry->to_h_blks - 1;
    
    To prevent these possible null-pointer dereferences, copy to_h_msg,
    usr_msg_id, and to_h_blks from iter into temporary variables, and return
    these temporary variables to the application instead of accessing them
    through a potentially NULL entry.
    
    Signed-off-by: Tuo Li 
    Reviewed-by: Scott Branden 
    Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b
Author: Markus Perkins 
Date:   Tue Dec 2 11:48:24 2025 +0100

    misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
    
    commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66
    compatible strings") added support for 93xx56 and 93xx66 eeproms, but
    didn't take into account that the write enable/disable + erase all
    commands are hardcoded for the 6-bit address of the 93xx46.
    
    This commit fixes the command word generation by increasing the number
    of shifts as the address field grows, keeping the command intact.
    
    Also, the check for 8-bit or 16-bit mode is no longer required as this
    is already taken into account in the edev->addrlen field.
    
    Signed-off-by: Markus Perkins 
    Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net
    Signed-off-by: Greg Kroah-Hartman 

commit c0fef45dbab06238e96e221f7c0a8fd2d569f7dd
Author: Jiri Slaby (SUSE) 
Date:   Mon Nov 24 11:39:52 2025 +0100

    char/mwave: drop it
    
    When I tried to clean up the driver a bit, Arnd noted:
    > According to thinkwiki.de, the 3780i modem was only used in a
    > couple of Thinkpad models that are now over 25 years old, using
    > Pentium II processors, and they all have a physical RS232 port
    > that can be used to connect an external modem instead.
    >
    > Maybe we can just retire this driver?
    
    So instead of the clean up, drop the driver altogether.
    
    Signed-off-by: Jiri Slaby (SUSE) 
    Suggested-by: Arnd Bergmann 
    Link: https://lore.kernel.org/all/b8834e5d-fdde-4b1a-8757-288dddc507a9@app.fastmail.com/
    Link: https://patch.msgid.link/20251124103952.995229-1-jirislaby@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit ebb3acf4d7c95b52265084168b59a565bf972883
Author: Ovidiu Panait 
Date:   Tue Dec 9 09:11:14 2025 +0000

    clk: renesas: r9a09g056: Add clock and reset entries for TSU
    
    Add module clock and reset entries for the TSU0 and TSU1 blocks on the
    Renesas RZ/V2N (R9A09G056) SoC.
    
    Signed-off-by: Ovidiu Panait 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251209091115.8541-3-ovidiu.panait.rb@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit fb48cb435500dce125e1ba1640def3df251b7301
Author: Jani Nikula 
Date:   Mon Dec 22 14:34:03 2025 +0200

    drm/i915/display: use to_intel_uncore() to avoid i915_drv.h
    
    A number of places that include i915_drv.h only need it to get from
    display to i915 to uncore. We have to_intel_uncore() for that, use it to
    avoid the i915_drv.h include.
    
    v2: Rebase
    
    Cc: Ville Syrjala 
    Reviewed-by: Ville Syrjälä 
    Reviewed-by: Michał Grzelak 
    Link: https://patch.msgid.link/44a5d526a097ab9276e60162263fa8cd23325ce7.1766406794.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 80d3db9b62d2740b7cd1a10228ec04f6d61f1bae
Author: Jani Nikula 
Date:   Mon Dec 22 14:34:02 2025 +0200

    drm/xe/compat: convert uncore macro to static inlines
    
    Use static inline instead of macro for
    intel_uncore_arm_unclaimed_mmio_detection() to avoid the need for
    __maybe_unused annotations.
    
    v2: Rebase, intel_uncore_arm_unclaimed_mmio_detection()
    
    Cc: Ville Syrjala 
    Reviewed-by: Ville Syrjälä  # v1
    Reviewed-by: Michał Grzelak 
    Link: https://patch.msgid.link/7ddee71952315e70e4a7df23638100b664e293bd.1766406794.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 5f1a87efd60d0d7ca612ea33127bccefbbe07a07
Author: Jani Nikula 
Date:   Mon Dec 22 14:34:01 2025 +0200

    drm/xe/compat: remove unused forcewake get/put macros
    
    Since commit 35ec71285c93 ("drm/i915/pc8: Add parent interface for PC8
    forcewake tricks"), the compat intel_uncore_forcewake_{get,put} and
    FORCEWAKE_ALL macros have become unused. Remove them.
    
    Reviewed-by: Michał Grzelak 
    Link: https://patch.msgid.link/5081b00a6fa20bdbcc1c973c6920cd590e1dc98f.1766406794.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 765ec7411b9d7a4b1f19c5ca3191c9039ac63c09
Author: Jani Nikula 
Date:   Mon Dec 22 14:34:00 2025 +0200

    drm/i915: remove unused dev_priv local variable
    
    Since commit 35ec71285c93 ("drm/i915/pc8: Add parent interface for PC8
    forcewake tricks"), the __maybe_unused dev_priv has become definitely
    unused. Remove, along with the i915_drv.h include.
    
    Reviewed-by: Michał Grzelak 
    Link: https://patch.msgid.link/222871a73efbe1049862d11a03abf253611e46b1.1766406794.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 322fc12949d2658da8c6b2866fffcb1daa7da019
Merge: c14afba60a61bc f8f9c1f4d0c7a6
Author: Greg Kroah-Hartman 
Date:   Mon Dec 29 09:31:39 2025 +0100

    Merge 6.19-rc3 into tty-next
    
    We need the serial fixes in here as well.
    
    Signed-off-by: Greg Kroah-Hartman 

commit e46bcc4e856e0e4352752ff9247af6240334f822
Merge: 8995a37371bf48 f8f9c1f4d0c7a6
Author: Greg Kroah-Hartman 
Date:   Mon Dec 29 09:25:34 2025 +0100

    Merge 6.19-rc3 into usb-next
    
    We need the USB fixes in here as well.
    
    Signed-off-by: Greg Kroah-Hartman 

commit 51d857a0168a0101fb691a9191feed771aa78ecd
Author: Matthias Schiffer 
Date:   Mon Nov 17 14:09:12 2025 +0100

    dt-bindings: arm: fsl: add TQ-Systems boards MBLS1028A and MBLS1028A-IND
    
    Add two mainboards for the TQ-Systems TQMLS1028A SoM, based on the NXP
    Layerscape LS1028A.
    
    Signed-off-by: Matthias Schiffer 
    Reviewed-by: Frank Li 
    Acked-by: Conor Dooley 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 0538ca1f102d87b2e98d38c7ca28915abee44777
Author: Gregor Herburger 
Date:   Mon Nov 17 14:09:13 2025 +0100

    arm64: dts: ls1028a: Add mbls1028a and mbls1028a-ind devicetrees
    
    Add device trees for the MBLS1028A and the MBLS1028A-IND and the SoM
    TQMLS1028A.
    
    Signed-off-by: Gregor Herburger 
    Signed-off-by: Alexander Stein 
    Signed-off-by: Shawn Guo 

commit 345ad34565c371f71aeb37d048c845a0fea7eb3a
Author: Ankit Nautiyal 
Date:   Tue Dec 23 20:38:26 2025 +0530

    drm/i915/vdsc: Account for DSC slice overhead in intel_vdsc_min_cdclk()
    
    When DSC is enabled on a pipe, the pipe pixel rate input to the
    CDCLK frequency and pipe joining calculation needs an adjustment to
    account for compression overhead "bubbles" added at each horizontal
    slice boundary.
    
    Account for this overhead while computing min cdclk required for DSC.
    
    v2:
     - Get rid of the scaling factor and return unchanged pixel-rate
       instead of 0.
    v3:
     - Use mul_u32_u32() for the bubble-adjusted pixel rate to avoid 64x64
       multiplication and drop redundant casts in DIV_ROUND_UP_ULL(). (Imre)
    
    Bspec:68912
    Signed-off-by: Ankit Nautiyal 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251223150826.2591182-1-ankit.k.nautiyal@intel.com

commit b105f62a35a9a2814675b7754a6aa8e4963f4df1
Author: Yashwanth Varakala 
Date:   Mon Nov 17 13:45:15 2025 +0100

    arm64: dts: imx8mp libra: add peb-av-10 expansion board overlay
    
    Add an overlay of expansion board (PEB-AV-10) that supports multimedia
    interfaces, 3.5mm headphone jack, a USB-A port and LVDS, backlight
    connectors can be connected to the imx8mp libra. Audio works when no
    display is connected to expansion board.
    
    A separate overlay for Powertip display, based on peb-av-10.dtsi and
    intended for use with PEB-AV-10 expansion board, will be added
    later as display support is not yet available.
    
    Signed-off-by: Yashwanth Varakala 
    Signed-off-by: Shawn Guo 

commit 3619c5b41ec57e2f6a9eefea1fdc759dbfdc1c67
Author: Yashwanth Varakala 
Date:   Mon Nov 17 13:45:14 2025 +0100

    arm64: dts: imx8mp libra: add and update display overlays
    
    Add imx8mp-libra-rdk-fpsc-lvds-ph128800t006-zhc01.dtso
    devicetree display overlay for the i.MX8MP Libra RDK platform.
    The overlay enable LVDS display configuration.
    
    To keep the consistent style of panel and backlight nodes and labels.
    They are updated in imx8mp-libra base board devicetree and
    etml1010g3dra display overlay.
    
    Signed-off-by: Yashwanth Varakala 
    Signed-off-by: Shawn Guo 

commit bfc1982c660161c4a768b6696dc24b9f608aeea0
Author: Wei Fang 
Date:   Sun Nov 16 09:35:58 2025 +0800

    arm64: dts: imx943-evk: add ENETC, EMDIO and PTP Timer support
    
    Add ENETC instance 1~3, EMDIO and PTP Timer 0~1 support.
    The EMDIO provides MDIO bus for ENETCs to access their external PHYs.
    The PTP Timer provides current time with nanosecond resolution, precise
    periodic pulse, pulse on timeout, and time capture on external pulse
    support. It also provides PTP clock for ENETCs to implement time
    synchronization as required for IEEE 1588 and  IEEE 802.1AS-2020.
    
    Signed-off-by: Wei Fang 
    Signed-off-by: Shawn Guo 

commit c3ea38980ab48c8b86d2f940cd9714b5b8c62d9b
Author: Wei Fang 
Date:   Sun Nov 16 09:35:57 2025 +0800

    arm64: dts: imx94: add basic NETC related nodes
    
    The NETC related nodes for i.MX94, this NETC has two PCIe buses, the bus
    0 has 1 ENETC instance, one PTP timer, one RCEC and a switch, currently,
    the switch is not added due to the DT binding and the driver is not
    ready at the moment. The bus 1 has three ENETC instances, 2 PTP timers,
    1 RCEC and one EMDIO.
    
    Signed-off-by: Wei Fang 
    Signed-off-by: Shawn Guo 

commit 4688fd527c85f63890167b4705a3622488e73781
Author: Jacky Bai 
Date:   Mon Nov 3 16:48:33 2025 -0500

    arm64: dts: imx8dxl-ss-ddr: Add DB (system interconnects) pmu support for i.MX8DXL
    
    Add DB pmu related nodes. This pmu is in DB (system interconnects).
    
    Signed-off-by: Jacky Bai 
    Signed-off-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit 628f6ac792c9a3dace4b6f50d6445f7d5a6af4f2
Author: Frank Li 
Date:   Mon Nov 3 16:48:32 2025 -0500

    arm64: dts: imx8qm: add ddr perf device node
    
    Add ddr perf monitor device node for i.MX8QM. Change imx8-ss-ddr.dtsi's
    compatible string to fsl,imx8qxp-ddr-pmu. i.MX8QM overwrite to
    fsl,imx8qm-ddr-pmu. All fallback to fsl,imx8-ddr-pmu.
    
    Signed-off-by: Joakim Zhang 
    Signed-off-by: Frank Li 
    Signed-off-by: Shawn Guo 

commit c904e459cf73bd379500637b4090a2939d69a85f
Author: Sergey Shtylyov 
Date:   Wed Dec 17 23:21:45 2025 +0300

    crypto: drbg - make drbg_get_random_bytes() return *void*
    
    Now that drbg_get_random_bytes() always returns 0, checking its result at
    the call sites stopped to make sense -- make this function return *void*
    instead of *int*...
    
    Signed-off-by: Sergey Shtylyov 
    Signed-off-by: Herbert Xu 

commit 6acd394367ab145b1cc26e66aac3bb40b968e893
Author: Sergey Shtylyov 
Date:   Wed Dec 17 23:21:44 2025 +0300

    crypto: drbg - make drbg_fips_continuous_test() return bool
    
    Currently, drbg_fips_continuous_test() only returns 0 and -EAGAIN, so an
    early return from the *do*/*while* loop in drbg_get_random_bytes() just
    isn't possible. Make drbg_fips_continuous_test() return bool instead of
    *int* (using true instead of 0 and false instead of -EAGAIN). This way,
    we can further simplify drbg_get_random_bytes()...
    
    Found by Linux Verification Center (linuxtesting.org) with the Svace static
    analysis tool.
    
    Suggested-by: Herbert Xu 
    Signed-off-by: Sergey Shtylyov 
    Signed-off-by: Herbert Xu 

commit eb6449aa7b32259a8b59e0c9602b32dcaf1fba58
Author: Sergey Shtylyov 
Date:   Wed Dec 17 23:21:43 2025 +0300

    crypto: drbg - kill useless variable in drbg_fips_continuous_test()
    
    In drbg_fips_continuous_test(), not only the initializer of the ret local
    variable is useless, the variable itself does not seem needed as it only
    stores the result of memcmp() until it's checked on the next line -- get
    rid of the variable...
    
    Signed-off-by: Sergey Shtylyov 
    Signed-off-by: Herbert Xu 

commit b6aa86c8a50883e2eab6f8a3a9d4e08a42519410
Author: Thorsten Blum 
Date:   Tue Dec 16 15:55:35 2025 +0100

    crypto: khazad - simplify return statement in khazad_mod_init
    
    Return the result of calling crypto_register_alg() directly and remove
    the local return variable.
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Herbert Xu 

commit 37b03cb378177cd575a25da5f2a0a40c6ef639d9
Author: Thorsten Blum 
Date:   Mon Dec 15 13:26:05 2025 +0100

    crypto: octeontx2 - Use sysfs_emit in sysfs show functions
    
    Replace sprintf() with sysfs_emit() in sso_pf_func_ovrd_show() and
    kvf_limits_show(). sysfs_emit() is preferred for formatting sysfs output
    as it performs proper bounds checking.  No functional changes.
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Herbert Xu 

commit bce4678f0235df02bc243ca4c2fc2bd08131166a
Author: Thorsten Blum 
Date:   Mon Dec 15 08:23:52 2025 +0100

    crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions
    
    Replace sprintf() with sysfs_emit() in verify_compress_show() and
    sync_mode_show(). sysfs_emit() is preferred to format sysfs output as it
    provides better bounds checking.  No functional changes.
    
    Signed-off-by: Thorsten Blum 
    Acked-by: Kanchana P Sridhar 
    Signed-off-by: Herbert Xu 

commit 3c7d76d6128a0fef68e6540754bf85a44a29bb59
Author: Jens Axboe 
Date:   Thu Dec 11 03:25:41 2025 -0700

    io_uring: IOPOLL polling improvements
    
    io_uring manages issued and pending IOPOLL read/write requests in a
    singly linked list. One downside of that is that individual items
    cannot easily be removed from that list, and as a result, io_uring
    will only complete a completed request N in that list if 0..N-1 are
    also complete. For homogenous IO this isn't necessarily an issue,
    but if different devices are involved in polling in the same ring, or
    if disparate IO from the same device is being polled for, this can
    defer completion of some requests unnecessarily.
    
    Move to a doubly linked list for iopoll completions instead, making it
    possible to easily complete whatever requests that were polled done
    successfully.
    
    Co-developed-by: Fengnan Chang 
    Link: https://lore.kernel.org/io-uring/20251210085501.84261-1-changfengnan@bytedance.com/
    Signed-off-by: Jens Axboe 

commit e1418af7660f67abc7f6f0cf6867f3989aa45e9a
Author: Thorsten Blum 
Date:   Sun Dec 21 00:59:23 2025 +0100

    brd: replace simple_strtol with kstrtoul in ramdisk_size
    
    Replace simple_strtol() with the recommended kstrtoul() for parsing the
    'ramdisk_size=' boot parameter. Unlike simple_strtol(), which returns a
    long, kstrtoul() converts the string directly to an unsigned long and
    avoids implicit casting.
    
    Check the return value of kstrtoul() and reject invalid values. This
    adds error handling while preserving behavior for existing values, and
    removes use of the deprecated simple_strtol() helper. The current code
    silently sets 'rd_size = 0' if parsing fails, instead of leaving the
    default value (CONFIG_BLK_DEV_RAM_SIZE) unchanged.
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Jens Axboe 

commit 4cef2fcda3adabcf6937170d9b869bf72a6d9dc6
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:26:19 2025 +0100

    rnull: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Signed-off-by: Jens Axboe 

commit 08889b706d4f0b8d2352b7ca29c2d8df4d0787cd
Author: Krzysztof Niemiec 
Date:   Tue Dec 16 19:09:01 2025 +0100

    drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
    
    Initialize the eb.vma array with values of 0 when the eb structure is
    first set up. In particular, this sets the eb->vma[i].vma pointers to
    NULL, simplifying cleanup and getting rid of the bug described below.
    
    During the execution of eb_lookup_vmas(), the eb->vma array is
    successively filled up with struct eb_vma objects. This process includes
    calling eb_add_vma(), which might fail; however, even in the event of
    failure, eb->vma[i].vma is set for the currently processed buffer.
    
    If eb_add_vma() fails, eb_lookup_vmas() returns with an error, which
    prompts a call to eb_release_vmas() to clean up the mess. Since
    eb_lookup_vmas() might fail during processing any (possibly not first)
    buffer, eb_release_vmas() checks whether a buffer's vma is NULL to know
    at what point did the lookup function fail.
    
    In eb_lookup_vmas(), eb->vma[i].vma is set to NULL if either the helper
    function eb_lookup_vma() or eb_validate_vma() fails. eb->vma[i+1].vma is
    set to NULL in case i915_gem_object_userptr_submit_init() fails; the
    current one needs to be cleaned up by eb_release_vmas() at this point,
    so the next one is set. If eb_add_vma() fails, neither the current nor
    the next vma is set to NULL, which is a source of a NULL deref bug
    described in the issue linked in the Closes tag.
    
    When entering eb_lookup_vmas(), the vma pointers are set to the slab
    poison value, instead of NULL. This doesn't matter for the actual
    lookup, since it gets overwritten anyway, however the eb_release_vmas()
    function only recognizes NULL as the stopping value, hence the pointers
    are being set to NULL as they go in case of intermediate failure. This
    patch changes the approach to filling them all with NULL at the start
    instead, rather than handling that manually during failure.
    
    Reported-by: Gangmin Kim 
    Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15062
    Fixes: 544460c33821 ("drm/i915: Multi-BB execbuf")
    Cc: stable@vger.kernel.org # 5.16.x
    Signed-off-by: Krzysztof Niemiec 
    Reviewed-by: Janusz Krzysztofik 
    Reviewed-by: Krzysztof Karas 
    Reviewed-by: Andi Shyti 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251216180900.54294-2-krzysztof.niemiec@intel.com

commit d43a12e474351161bb6d7e2a17ab56f591b9302d
Author: Matthew Maurer 
Date:   Fri Dec 26 20:17:09 2025 +0000

    rust: Add SoC Driver Sample
    
    Shows registration of a SoC device upon receipt of a probe.
    
    Signed-off-by: Matthew Maurer 
    Link: https://patch.msgid.link/20251226-soc-bindings-v4-3-2c2fac08f820@google.com
    Signed-off-by: Danilo Krummrich 

commit 057d44b057755f31a38a3cb040960e8727b93610
Author: Matthew Maurer 
Date:   Fri Dec 26 20:17:07 2025 +0000

    rust: Add soc_device support
    
    Allow SoC drivers in Rust to present metadata about their devices to
    userspace through /sys/devices/socX and other drivers to identify their
    properties through `soc_device_match`.
    
    Signed-off-by: Matthew Maurer 
    Link: https://patch.msgid.link/20251226-soc-bindings-v4-1-2c2fac08f820@google.com
    Signed-off-by: Danilo Krummrich 

commit 9afdf3e1a59e23180540ecb1fe3287c308cc8113
Author: Tudor Ambarus 
Date:   Mon Dec 22 16:30:09 2025 +0000

    arm64: dts: exynos: gs101: add OTP node
    
    Add the OTP controller node.
    
    Signed-off-by: Tudor Ambarus 
    Reviewed-by: André Draszik 
    Link: https://patch.msgid.link/20251222-gs101-chipid-v4-5-aa8e20ce7bb3@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit 732af51910960535382db3f6e0b33e2e2b0ff7b6
Author: Tudor Ambarus 
Date:   Mon Dec 22 16:30:08 2025 +0000

    soc: samsung: exynos-chipid: add google,gs101-otp support
    
    GS101 is different (but also e850 and autov9 I assume) from the SoCs
    that are currently handled by the exynos-chipid driver because the
    chip ID info is part of the OTP registers. GS101 OTP has a clock, an
    interrupt line, a register space (that contains product and chip ID,
    TMU data, ASV, etc) and a 32Kbit memory space that can be
    read/program/locked with specific commands. On GS101 the "ChipID block"
    is just an abstraction, it's not a physical device. When the power-on
    sequence progresses, the OTP chipid values are loaded to the OTP
    registers.
    
    Add the GS101 chip ID support. The support is intentionally added in the
    exynos-chipid driver, and not in a dedicated Exynos OTP driver, because
    we estimate that there will not be any OTP consumers in the kernel other
    than the chip ID/SoC interface. The downstream GS101 drivers confirm
    this supposition.
    
    Signed-off-by: Tudor Ambarus 
    Reviewed-by: André Draszik 
    Link: https://patch.msgid.link/20251222-gs101-chipid-v4-4-aa8e20ce7bb3@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit c38cfc303db9ab4d5f482ae8e36e5a677db8eee6
Author: Tudor Ambarus 
Date:   Mon Dec 22 16:30:07 2025 +0000

    soc: samsung: exynos-chipid: downgrade dev_info to dev_dbg for soc info
    
    The SoC information is exposed to userspace using the standard soc
    interface. Downgrade to dev_dbg to stop polluting the console log.
    
    Signed-off-by: Tudor Ambarus 
    Reviewed-by: André Draszik 
    Link: https://patch.msgid.link/20251222-gs101-chipid-v4-3-aa8e20ce7bb3@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit 9133ae2119cb3c948675dc566eebf11cc4bb1681
Author: Tudor Ambarus 
Date:   Mon Dec 22 16:30:06 2025 +0000

    soc: samsung: exynos-chipid: rename method
    
    s/product_id_to_soc_id/exynos_product_id_to_name.
    Prepend exynos_ to avoid name space pollution. The method translates the
    product id to a name, rename the method to make that clear. While
    touching the code where it is called, add a blank line for readability
    purposes.
    
    Signed-off-by: Tudor Ambarus 
    Reviewed-by: André Draszik 
    Link: https://patch.msgid.link/20251222-gs101-chipid-v4-2-aa8e20ce7bb3@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit 12da6f08a07ddaddd336af878350d30449d23a54
Author: Tudor Ambarus 
Date:   Mon Dec 22 16:30:05 2025 +0000

    dt-bindings: nvmem: add google,gs101-otp
    
    Add binding for the OTP controller found on Google GS101.
    
    Reviewed-by: André Draszik 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Tudor Ambarus 
    Link: https://patch.msgid.link/20251222-gs101-chipid-v4-1-aa8e20ce7bb3@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit a7b79464a5e4b95adf7c3da66d287b1944824b91
Author: Heikki Krogerus 
Date:   Thu Dec 18 16:15:01 2025 +0100

    i2c: designware: Remove unnecessary function exports
    
    The master and slave probe functions are only called from
    the core.
    
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Heikki Krogerus 
    Acked-by: Mika Westerberg 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251218151509.361617-3-heikki.krogerus@linux.intel.com

commit 9f65f8fa18bbfb7d8756f1bfd6d1cbaffe2661df
Author: Heikki Krogerus 
Date:   Thu Dec 18 16:15:00 2025 +0100

    i2c: designware: Remove useless driver specific option for I2C target
    
    The generic option for I2C target is already user selectable,
    which makes the DesignWare specific option completely
    unnecessary. The DesignWare option also silently selected
    I2C_SLAVE instead of depending on it without any real need
    for it.
    
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Heikki Krogerus 
    Acked-by: Mika Westerberg 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251218151509.361617-2-heikki.krogerus@linux.intel.com

commit 24a0ffefe3f097aa8fe6997a731a71487dd0721f
Author: Cristian Marussi 
Date:   Sat Dec 27 16:41:32 2025 +0000

    firmware: arm_scmi: Remove legacy protocol versioning logic
    
    Protocol version negotiation logic is centralized in the SCMI core stack
    so that most of the legacy per-protocol versioning logic is redundant and
    can be removed.
    
    Remove protocol-specific versioning code and refactor all the protocols to
    use the new simplified centralized logic.
    
    Signed-off-by: Cristian Marussi 
    Message-Id: <20251227164132.1311988-3-cristian.marussi@arm.com>
    Signed-off-by: Sudeep Holla 

commit 0fac05fdd9afff6de07a3766db802a3f2d028e2a
Author: Cristian Marussi 
Date:   Sat Dec 27 16:41:31 2025 +0000

    firmware: arm_scmi: Rework protocol version negotiation logic
    
    Protocol version negotiation can be used by an agent to request the server
    to downgrade the version effectively utilized by a specific protocol
    during the current session, if the latest version used by the server is
    newer than the latest version known to the client.
    
    In order for the negotiation process to be fully effective at preventing
    any possible version incompatibility, it must happen early on, well before
    the specific protocol initialization phase takes place.
    
    Delegate protocol version querying to the core SCMI stack and rework the
    protocol negotiation logic in order to execute the needed negotiation
    exchanges upfront, right before the initialization phase takes place.
    
    Signed-off-by: Cristian Marussi 
    Message-Id: <20251227164132.1311988-2-cristian.marussi@arm.com>
    Signed-off-by: Sudeep Holla 

commit 25abdc151a448a17d500ea9468ce32582c479faa
Author: Shuming Fan 
Date:   Fri Dec 26 14:42:55 2025 +0800

    ASoC: rt1320: fix the remainder calculation of r0 value
    
    This patch fixes the remainder calculation of r0 value.
    
    Fixes: 836ecc740ca8 ("ASoC: rt1320: fix 32-bit link failure")
    Signed-off-by: Shuming Fan 
    Link: https://patch.msgid.link/20251226064255.993735-1-shumingf@realtek.com
    Signed-off-by: Mark Brown 

commit fc22dfb13618ce1ae5730840607733a50569a15e
Author: Kuninori Morimoto 
Date:   Thu Dec 25 00:05:51 2025 +0000

    ASoC: alc5623: tidyup clock inversion in alc5623_set_dai_fmt()
    
    It supports inverted bitclock (= _NB_, _IB_), but has no control
    for the frame polarity (= _NF, _IF). Let's tidyup it.
    
    Signed-off-by: Kuninori Morimoto 
    Link: https://patch.msgid.link/87y0mrtogw.wl-kuninori.morimoto.gx@renesas.com
    Signed-off-by: Mark Brown 

commit 4ba12d304175fd7b2d2089899e38428db2d1b189
Author: Ariana Lazar 
Date:   Tue Dec 16 14:05:50 2025 +0200

    dt-bindings: iio: dac: adding support for Microchip MCP47FEB02
    
    This is the device tree schema for iio driver for Microchip
    MCP47F(E/V)B(0/1/2)1, MCP47F(E/V)B(0/1/2)2, MCP47F(E/V)B(0/1/2)4 and
    MCP47F(E/V)B(0/1/2)8 series of buffered voltage output Digital-to-Analog
    Converters with nonvolatile or volatile memory and an I2C Interface.
    
    The families support up to 8 output channels.
    
    The devices can be 8-bit, 10-bit and 12-bit.
    
    Signed-off-by: Ariana Lazar 
    Reviewed-by: Conor Dooley 
    Signed-off-by: Jonathan Cameron 

commit 9ec3c8ee16a07dff8be82aba595dd77c134c03c2
Merge: c5fb82d113c626 844758bd99a86e
Author: Dave Airlie 
Date:   Sat Dec 27 17:17:39 2025 +1000

    Merge tag 'drm-xe-next-2025-12-19' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next
    
    [airlied: fix guc submit double definition]
    UAPI Changes:
    - Multi-Queue support (Niranjana)
    - Add DRM_XE_EXEC_QUEUE_SET_HANG_REPLAY_STATE (Brost)
    - Add NO_COMPRESSION BO flag and query capability (Sanjay)
    - Add gt_id to struct drm_xe_oa_unit (Ashutosh)
    - Expose MERT OA unit (Ashutosh)
    - Sysfs Survivability refactor (Riana)
    
    Cross-subsystem Changes:
    - VFIO: Add device specific vfio_pci driver variant for Intel graphics (Winiarski)
    
    Driver Changes:
    - MAINTAINERS update (Lucas -> Matt)
    - Add helper to query compression enable status (Xin)
    - Xe_VM fixes and updates (Shuicheng, Himal)
    - Documentation fixes (Winiarski, Swaraj, Niranjana)
    - Kunit fix (Roper)
    - Fix potential leaks, uaf, null derref, and oversized
      allocations (Shuicheng, Sanjay, Mika, Tapani)
    - Other minor fixes like kbuild duplication and sysfs_emit (Shuicheng, Madhur)
    - Handle msix vector0 interrupt (Venkata)
    - Scope-based forcewake and runtime PM (Roper, Raag)
    - GuC/HuC related fixes and refactors (Lucas, Zhanjun, Brost, Julia, Wajdeczko)
    - Fix conversion from clock ticks to milliseconds (Harish)
    - SRIOV PF PF: Add support for MERT (Lukasz)
    - Enable SR-IOV VF migration and other SRIOV updates (Winiarski,
      Satya, Brost, Wajdeczko, Piotr, Tomasz, Daniele)
    - Optimize runtime suspend/resume and other PM improvements (Raag)
    - Some W/a additions and updates (Bala, Harish, Roper)
    - Use for_each_tlb_inval() to calculate invalidation fences (Roper)
    - Fix VFIO link error (Arnd)
    - Fix ix drm_gpusvm_init() arguments (Arnd)
    - Other OA refactor (Ashutosh)
    - Refactor PAT and expose debugfs (Xin)
    - Enable Indirect Ring State for xe3p_xpc (Niranjana)
    - MEI interrupt fix (Junxiao)
    - Add stats for mode switching on hw_engine_group (Francois)
    - DMA-Buf related changes (Thomas)
    - Multi Queue feature support (Niranjana)
    - Enable I2C controller for Crescent Island (Raag)
    - Enable NVM for Crescent Island (Sasha)
    - Increase TDF timeout (Jagmeet)
    - Restore engine registers before restarting schedulers after GT reset (Jan)
    - Page Reclamation Support for Xe3p Platforms (Brian, Brost, Oak)
    - Fix performance when pagefaults and 3d/display share resources (Brost)
    - More OA MERT work (Ashutosh)
    - Fix return values (Dan)
    - Some log level and messages improvements (Brost)
    
    Signed-off-by: Dave Airlie 
    
    From: Rodrigo Vivi 
    Link: https://patch.msgid.link/aUXUhEgzs6hDLQuu@intel.com

commit c5fb82d113c6266e65fee2a7e0dc8f48c3bd12cc
Merge: 7bc0f871f992f1 35ec71285c9311
Author: Dave Airlie 
Date:   Sat Dec 27 16:25:56 2025 +1000

    Merge tag 'drm-intel-next-2025-12-19' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next
    
    Beyond Display related:
     - Switch to use kernel standard fault injection in i915 (Juha-Pekka)
    
     Display uAPI related:
     - Display uapi vs. hw state fixes (Ville)
     - Expose sharpness only if num_scalers is >= 2 (Nemesa)
    
     Display related:
     - More display driver refactor and clean-ups, specially towards separation (Jani)
     - Add initial support Xe3p_LPD for NVL (Gustavo, Sai, )
     - BMG FBC W/a (Vinod)
     - RPM fix (Dibin)
     - Add MTL+ platforms to support dpll framework (Mika, Imre)
     - Other PLL related fixes (Imre)
     - Fix DIMM_S DRAM decoding on ICL (Ville)
     - Async flip refactor (Ville, Jouni)
     - Go back to using AUX interrupts (Ville)
     - Reduce severity of failed DII FEC enabling (Grzelak)
     - Enable system cache support for FBC (Vinod)
     - Move PSR/Panel Replay sink data into intel_connector and other PSR changes (Jouni)
     - Detect AuxCCS support via display parent interface (Tvrtko)
     - Clean up link BW/DSC slice config computation(Imre)
     - Toggle powerdown states for C10 on HDMI (Gustavo)
     - Add parent interface for PC8 forcewake tricks (Ville)
    
    Signed-off-by: Dave Airlie 
    
    From: Rodrigo Vivi 
    Link: https://patch.msgid.link/aUW3bVDdE63aSFOJ@intel.com

commit 3b34d6324d1f82a4d35ce461add457e185dc98ac
Author: Jon Kohler 
Date:   Wed Nov 12 17:55:28 2025 -0700

    vhost: use "checked" versions of get_user() and put_user()
    
    vhost_get_user and vhost_put_user leverage __get_user and __put_user,
    respectively, which were both added in 2016 by commit 6b1e6cc7855b
    ("vhost: new device IOTLB API"). In a heavy UDP transmit workload on a
    vhost-net backed tap device, these functions showed up as ~11.6% of
    samples in a flamegraph of the underlying vhost worker thread.
    
    Quoting Linus from [1]:
        Anyway, every single __get_user() call I looked at looked like
        historical garbage. [...] End result: I get the feeling that we
        should just do a global search-and-replace of the __get_user/
        __put_user users, replace them with plain get_user/put_user instead,
        and then fix up any fallout (eg the coco code).
    
    Switch to plain get_user/put_user in vhost, which results in a slight
    throughput speedup. get_user now about ~8.4% of samples in flamegraph.
    
    Basic iperf3 test on a Intel 5416S CPU with Ubuntu 25.10 guest:
    TX: taskset -c 2 iperf3 -c  -t 60 -p 5200 -b 0 -u -i 5
    RX: taskset -c 2 iperf3 -s -p 5200 -D
    Before: 6.08 Gbits/sec
    After:  6.32 Gbits/sec
    
    As to what drives the speedup, Sean's patch [2] explains:
            Use the normal, checked versions for get_user() and put_user() instead of
            the double-underscore versions that omit range checks, as the checked
            versions are actually measurably faster on modern CPUs (12%+ on Intel,
            25%+ on AMD).
    
            The performance hit on the unchecked versions is almost entirely due to
            the added LFENCE on CPUs where LFENCE is serializing (which is effectively
            all modern CPUs), which was added by commit 304ec1b05031 ("x86/uaccess:
            Use __uaccess_begin_nospec() and uaccess_try_nospec").  The small
            optimizations done by commit b19b74bc99b1 ("x86/mm: Rework address range
            check in get_user() and put_user()") likely shave a few cycles off, but
            the bulk of the extra latency comes from the LFENCE.
    
    [1] https://lore.kernel.org/all/CAHk-=wiJiDSPZJTV7z3Q-u4DfLgQTNWqUqqrwSBHp0+Dh016FA@mail.gmail.com/
    [2] https://lore.kernel.org/all/20251106210206.221558-1-seanjc@google.com/
    
    Suggested-by: Linus Torvalds 
    Cc: Borislav Petkov 
    Cc: Sean Christopherson 
    Signed-off-by: Jon Kohler 
    Message-Id: <20251113005529.2494066-1-jon@nutanix.com>
    Acked-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 

commit 4b7bf8d5503287ed3bd661207b9d061999ac494e
Author: zhangdongchuan@eswincomputing.com 
Date:   Wed Nov 26 11:40:16 2025 +0800

    virtio_ring: code cleanup in detach_buf_split
    
    Since the return value of vring_unmap_one_split() is exactly
    vq->split.desc_extra[i].next, 'i = vq->split.desc_extra[i].next' is
    redundant. Assign vring_unmap_one_split() to i instead.
    
    Since vq->split.desc_extra is assigned to extra, use extra[i].next
    instead of vq->split.desc_extra[i].next to improve readability.
    
    No change in functionality.
    
    Signed-off-by: zhangdongchuan 
    Acked-by: Jason Wang 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <202511261140162936986@eswincomputing.com>

commit 3c4629b68dbe18e454cce4b864c530268cffbeed
Author: Thomas Weißschuh 
Date:   Mon Dec 22 09:00:33 2025 +0100

    virtio: uapi: avoid usage of libc types
    
    Using libc types and headers from the UAPI headers is problematic as it
    introduces a dependency on a full C toolchain.
    
    On Linux 'unsigned long' works as a replacement for 'uintptr_t' and does
    not depend on libc.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Arnd Bergmann 
    Signed-off-by: Michael S. Tsirkin 
    Message-Id: <20251222-uapi-virtio-v1-1-29390f87bcad@linutronix.de>

commit 255b721c96046d4c57fa2268e4c72607868ce91f
Author: Liang Jie 
Date:   Tue Dec 9 18:02:17 2025 +0800

    pinctrl: mediatek: make devm allocations safer and clearer in mtk_eint_do_init()
    
    mtk_eint_do_init() allocates several pointer arrays which are then
    populated in a per-instance loop and freed on error. The arrays are
    currently allocated with devm_kmalloc(), so their entries are left
    uninitialised until the per-instance allocations succeed.
    
    On a failure in the middle of the loop, the error path iterates over
    the full nbase range and calls devm_kfree() on each element. For
    indices which were never initialised, the corresponding array entries
    contain stack garbage. If any of those happen to be non-zero,
    devm_kfree() will pass them to devres_destroy(), which will WARN
    because there is no matching devm_kmalloc() resource for such bogus
    pointers.
    
    Improve the robustness and readability by:
    
      - Using devm_kcalloc() for the pointer arrays so that all entries
        start as NULL, ensuring that only genuinely initialised elements
        may be freed and preventing spurious WARN_ON()s in the error path.
      - Switching the allocations to sizeof(*ptr) / sizeof(**ptr) forms,
        avoiding hard-coded element types and making the code more resilient
        to future type changes.
      - Dropping the redundant NULL checks before devm_kfree(), as
        devm_kfree() safely handles NULL pointers.
    
    The functional behaviour in the successful initialisation path remains
    unchanged, while the error handling becomes simpler and less
    error-prone.
    
    Reviewed-by: fanggeng 
    Signed-off-by: Liang Jie 
    Signed-off-by: Linus Walleij 

commit 0297dce758a021ccf2c0f4e164d5403ef722961c
Author: Ian Rogers 
Date:   Tue Dec 9 14:37:56 2025 -0800

    PCI: cadence: Avoid signed 64-bit truncation and invalid sort
    
    The cdns_pcie_host_dma_ranges_cmp() element comparison function used by
    list_sort() is of type list_cmp_func_t, so it returns a 32-bit int.
    
    cdns_pcie_host_dma_ranges_cmp() computes a resource_size_t difference that
    may be a 64-bit value, and truncating that difference to a 32-bit return
    value may change the sign and result in an invalid sort order.
    
    Avoid the truncation and invalid sort order by returning -1, 0, or 1.
    
    Signed-off-by: Ian Rogers 
    Signed-off-by: Manivannan Sadhasivam 
    [bhelgaas: commit log]
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20251209223756.2321578-1-irogers@google.com

commit aac5ba6acc79b37b01dfc9dd23eb457c89cf06f6
Author: Aaron Kling 
Date:   Thu Jul 31 16:59:26 2025 -0500

    PCI: tegra: Allow building as a module
    
    Change the module macro back to builtin, which does not define an exit
    function. This will prevent the module from being unloaded. There are
    concerns with modules not cleaning up IRQs on unload, thus unload must be
    specifically disallowed. Drop the remove callback as it is unused.
    
    Signed-off-by: Aaron Kling 
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20250731-pci-tegra-module-v7-3-cad4b088b8fb@gmail.com

commit eefff3d9f65689610d63ff36bff0b95da9409c2a
Author: Aaron Kling 
Date:   Thu Jul 31 16:59:25 2025 -0500

    cpuidle: tegra: Export tegra_cpuidle_pcie_irqs_in_use()
    
    Export tegra_cpuidle_pcie_irqs_in_use() to allow pci-tegra to be built as a
    module.
    
    Signed-off-by: Aaron Kling 
    Signed-off-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20250731-pci-tegra-module-v7-2-cad4b088b8fb@gmail.com

commit 92d661c36f329bd029c9c442d2ec976f22018c33
Author: Aaron Kling 
Date:   Thu Jul 31 16:59:24 2025 -0500

    irqdomain: Export irq_domain_free_irqs()
    
    Export irq_domain_free_irqs() to allow PCI/MSI drivers like pci-tegra to be
    built as a module.
    
    Signed-off-by: Aaron Kling 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20250731-pci-tegra-module-v7-1-cad4b088b8fb@gmail.com

commit 0a869409a981112565fac055739e9e2fd8575ade
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 15:03:28 2025 +0100

    ACPI: battery: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI battery driver to a platform one.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3187448.CbtlEUcBR6@rafael.j.wysocki

commit 0d17aafa79c6c5693a740a5b6c2693203e4043ee
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 15:02:37 2025 +0100

    ACPI: battery: Reduce code duplication related to cleanup
    
    Notice that sysfs_battery_cleanup() calls sysfs_remove_battery() under
    battery->update_lock which is also done in acpi_battery_remove(), so
    adjust the latter to use it.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/1866517.TLkxdtWsSY@rafael.j.wysocki

commit 08b54fd577825d922a2263f3dcf8481e3720d606
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 15:01:53 2025 +0100

    ACPI: battery: Adjust event notification routine
    
    Adjust acpi_battery_notify() to cast its "data" argument to a struct
    acpi_battery pointer istead of a struct acpi_device one, which allows
    the use of acpi_driver_data() to be limited and will facilitate
    subsequent changes.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/4344406.1IzOArtZ34@rafael.j.wysocki

commit 6cba60361b8922b140ee460220f291d45448d537
Author: Rafael J. Wysocki 
Date:   Wed Dec 10 15:44:30 2025 +0100

    ACPI: thermal: Rework system suspend and resume handling
    
    In the process of handling system resume, acpi_thermal_resume() attempts
    to power up active cooling devices to guarantee that they will be
    operational when the ACPI thermal check queued by it runs.  However,
    the only kind of cooling devices that can be bound to ACPI thermal zones
    is fans and they are already powered up by the ACPI fan driver resume,
    which additionally takes "ACPI 4" fans that don't need to be powered
    up into account.
    
    For this reason, remove the part of acpi_thermal_resume() related to
    fans and in order to ensure that it will run after powering up all fans,
    rename it to acpi_thermal_complete() and point the .complete() driver
    callback to it.  Analogously, rename acpi_thermal_suspend() to
    acpi_thermal_prepare() and point the .prepare() driver callback to it.
    
    Signed-off-by: Rafael J. Wysocki 
    Acked-by: lihuisong@huawei.com
    Link: https://patch.msgid.link/3024049.e9J7NaK4W3@rafael.j.wysocki

commit d1db160da0d1c4711267d311d2461127d7c9a2ba
Author: Rafael J. Wysocki 
Date:   Wed Dec 10 15:43:45 2025 +0100

    ACPI: thermal: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI thermal zone driver to a platform
    one.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    Signed-off-by: Rafael J. Wysocki 
    Tested-by: lihuisong@huawei.com
    Link: https://patch.msgid.link/2249483.irdbgypaU6@rafael.j.wysocki

commit a4975385997a6fa1a69c3e5004a48430830f960f
Author: Rafael J. Wysocki 
Date:   Wed Dec 10 15:43:11 2025 +0100

    ACPI: thermal: Adjust event notification routine
    
    Adjust acpi_thermal_notify() to cast its "data" argument to a struct
    acpi_thermal pointer istead of a struct acpi_device one, which allows
    the use of acpi_driver_data() to be limited and will facilitate
    subsequent changes.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Acked-by: lihuisong@huawei.com
    Link: https://patch.msgid.link/5035876.GXAFRqVoOG@rafael.j.wysocki

commit d27ccaebab98a77c236494e8fc6857c629b5ffdd
Author: Rafael J. Wysocki 
Date:   Wed Dec 10 15:42:21 2025 +0100

    ACPI: scan: Register platform devices for thermal zones
    
    Currently, platform devices are not registered for ACPI thermal zones
    because they are not represented as device objects in the ACPI namespace.
    Instead, they are represented as thermal zone objects, so in particular
    the platform_id flag is not set for them during enumeration because it
    is only set for objects of type ACPI_BUS_TYPE_DEVICE, but otherwise they
    are handled similarly at the ACPI core level.
    
    To facilitate converting the ACPI thermal zone driver into a platform
    one, modify acpi_set_pnp_ids() to set the platform_id flag for thermal
    zones in analogy with device objects to cause platform devices to be
    registered for them.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Acked-by: lihuisong@huawei.com
    Link: https://patch.msgid.link/4701463.LvFx2qVVIh@rafael.j.wysocki

commit 91ba8de81bcb8cea922ee9427e54798a16dfd724
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 15:00:57 2025 +0100

    ACPI: scan: Do not mark button ACPI devices as wakeup-capable
    
    It is generally questionable to mark struct acpi_device "devices" as
    wakeup-capable because they represent firmware entities that by
    themselves have no wakeup capabilities.
    
    It was done for struct acpi_device "devices" corresponding to buttons
    because the ACPI button driver was binding to them directly, but now
    that corresponding platform devices are created for the buttons and
    they are marked as wakeup-capable by the ACPI button driver, there is
    no reason to continue doing it.
    
    Update acpi_wakeup_gpe_init() accordingly.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2891119.BEx9A2HvPv@rafael.j.wysocki

commit 2cf321ef4e8225108b5680dcdfc9429ed965aa30
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 15:00:01 2025 +0100

    ACPI: scan: Do not bind ACPI drivers to fixed event buttons
    
    Both ACPI button drivers have been converted to platform ones, so there
    is no reason to attempt to bind an ACPI driver to a struct acpi_device
    representing a fixed event device button.
    
    Update the relevant code accordingly.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2213073.OBFZWjSADL@rafael.j.wysocki

commit f4203ec64e1155c07c5d95bddc62201af8598c67
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 14:59:00 2025 +0100

    ACPI: tiny-power-button: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI tiny-power-button driver to a
    platform one.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    Signed-off-by: Rafael J. Wysocki 
    [ rjw: White space fixup ]
    Link: https://patch.msgid.link/5629403.Sb9uPGUboI@rafael.j.wysocki
    Signed-off-by: Rafael J. Wysocki 

commit 52d86401963666423cb9a56d117136c846093db0
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 14:57:57 2025 +0100

    ACPI: button: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI button driver to a platform one.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2461734.NG923GbCHz@rafael.j.wysocki

commit 93dc5db6d47aaa3b4b458ddfddfa3369c24e22f4
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 14:55:09 2025 +0100

    ACPI: button: Adjust event notification routines
    
    Adjust the event notification routines in the ACPI button driver to
    take a struct acpi_button pointer as an argument istead of a struct
    acpi_device one where applicable, which allows the use of
    acpi_driver_data() to be limited and will facilitate subsequent
    changes.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2260995.Icojqenx9y@rafael.j.wysocki

commit ddfebb7537cb422eca26ebdc3fe3426b60582c25
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 14:54:17 2025 +0100

    ACPI: scan: Reduce code duplication related to fixed event devices
    
    Move duplicate fixed event device registration code
    from acpi_bus_scan_fixed() into a new function called
    acpi_bus_add_fixed_device_object() and make acpi_bus_scan_fixed()
    invoke that function as needed.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/1916860.atdPhlSkOF@rafael.j.wysocki

commit ab06eb9204010c61e754bf4e71ee6f554584714d
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 14:52:45 2025 +0100

    ACPI: scan: Register platform devices for fixed event buttons
    
    On platforms using ACPI, power and sleep buttons may be so called "fixed
    event devices" in which case they are hooked up directly to the Fixed
    Events register in the platform via dedicated lines and there are no
    corresponding device objects in the ACPI namespace.  Nevertheless, in
    Linux they get corresponding struct acpi_device objects with special
    device IDs, either LNXPWRBN or LNXSLPBN, which are then used for driver
    binding in a ususal way.
    
    However, the function creating those struct acpi_device objects for
    "fixed event device" buttons, acpi_bus_scan_fixed(), does not register
    platform devices for them, unlike the generic code handling device
    enumeration based on the ACPI namespace.  Consequently, if an ACPI power
    or sleep button is represented by a device object in the ACPI namespace,
    it will get a corresponding platform device, but if it is a "fixed event
    device", it will not get one, which is inconsistent and prevents the
    ACPI power button driver from being converted into a platform driver.
    
    For the sake of consistency and to allow the ACPI power button driver to
    become a platform one going forward, modify acpi_bus_scan_fixed() to
    register platform devices for "fixed event device" buttons and update
    ACPI platform device registration code to work with non-device ACPI
    object types, so it can handle the buttons in question.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/3731144.R56niFO833@rafael.j.wysocki

commit 03667e146f815d5de8d2d8c85ced39791fb2b373
Author: Rafael J. Wysocki 
Date:   Sun Dec 14 19:25:37 2025 +0100

    ACPI: NFIT: core: Convert the driver to a platform one
    
    While binding drivers directly to struct acpi_device objects allows
    basic functionality to be provided, at least in the majority of cases,
    there are some problems with it, related to general consistency, sysfs
    layout, power management operation ordering, and code cleanliness.
    
    Overall, it is better to bind drivers to platform devices than to their
    ACPI companions, so convert the ACPI NFIT core driver to a platform one.
    
    While this is not expected to alter functionality, it changes sysfs
    layout and so it will be visible to user space.
    
    This change was mostly developed by Michal Wilczynski [1].
    
    Linu: https://lore.kernel.org/linux-acpi/20231011083334.3987477-6-michal.wilczynski@intel.com/ [1]
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/6221453.lOV4Wx5bFT@rafael.j.wysocki
    Acked-by: Ira Weiny 
    Tested-by: Ira Weiny 

commit 7bc0f871f992f1469229ffcd2b40a45ec5f695b0
Merge: 6c8e404891e105 332070795bd961
Author: Dave Airlie 
Date:   Fri Dec 26 19:00:34 2025 +1000

    Merge tag 'drm-misc-next-2025-12-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next
    
    drm-misc-next for 6.20:
    
    Core Changes:
    
      - dma-buf: Add tracepoints
      - sched: Introduce new helpers
    
    Driver Changes:
    
      - amdxdna: Enable hardware context priority, Remove (obsolete and
        never public) NPU2 Support, Race condition fix
      - rockchip: Add RK3368 HDMI Support
      - rz-du: Add RZ/V2H(P) MIPI-DSI Support
    
      - panels:
        - st7571: Introduce SPI support
        - New panels: Sitronix ST7920, Samsung LTL106HL02, LG LH546WF1-ED01, HannStar HSD156JUW2
    
    Signed-off-by: Dave Airlie 
    
    From: Maxime Ripard 
    Link: https://patch.msgid.link/20251219-arcane-quaint-skunk-e383b0@houat

commit 6c8e404891e1059564d1a15a71d3d76070304dde
Merge: 9448598b22c50c 470cb09a2936d3
Author: Dave Airlie 
Date:   Fri Dec 26 17:58:44 2025 +1000

    Merge tag 'drm-misc-next-2025-12-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next
    
    drm-misc-next for 6.19:
    
    UAPI Changes:
    
      - panfrost: Add PANFROST_BO_SYNC ioctl
      - panthor: Add PANTHOR_BO_SYNC ioctl
    
    Core Changes:
    
      - atomic: Add drm_device pointer to drm_private_obj
      - bridge: Introduce drm_bridge_unplug, drm_bridge_enter, and
        drm_bridge_exit
      - dma-buf: Improve sg_table debugging
      - dma-fence: Add new helpers, and use them when needed
      - dp_mst: Avoid out-of-bounds access with VCPI==0
      - gem: Reduce page table overhead with transparent huge pages
      - panic: Report invalid panic modes
      - sched: Add TODO entries
      - ttm: Various cleanups
      - vblank: Various refactoring and cleanups
    
      - Kconfig cleanups
      - Removed support for kdb
    
    Driver Changes:
    
      - amdxdna: Fix race conditions at suspend, Improve handling of zero
        tail pointers, Fix cu_idx being overwritten during command setup
      - ast: Support imported cursor buffers
      -
      - panthor: Enable timestamp propagation, Multiple improvements and
        fixes to improve the overall robustness, notably of the scheduler.
    
      - panels:
        - panel-edp: Support for CSW MNE007QB3-1, AUO B140HAN06.4, AUO B140QAX01.H
    
    Signed-off-by: Dave Airlie 
    
    [airlied: fix mm conflict]
    From: Maxime Ripard 
    Link: https://patch.msgid.link/20251212-spectacular-agama-of-abracadabra-aaef32@penduick

commit fcac0f23d4d20b11014a39f8e2527cdc12ec9c82
Author: Bitterblue Smith 
Date:   Wed Dec 24 01:26:45 2025 +0200

    wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data
    
    Internally wiphy writes to individual channels in this structure,
    so we must not share one static definition of channel list between
    multiple device instances, because that causes hard to debug
    breakage.
    
    For example, with two rtw88 driven devices in the system, channel
    information may get incoherent, preventing channel use.
    
    Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing
    of struct ieee80211_supported_band data").
    
    Signed-off-by: Bitterblue Smith 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com

commit 2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d
Author: Bitterblue Smith 
Date:   Wed Dec 24 01:25:32 2025 +0200

    wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
    
    Simplify the code by using device managed memory allocations.
    
    This also fixes a memory leak in rtw_register_hw(). The supported bands
    were not freed in the error path.
    
    Copied from commit 145df52a8671 ("wifi: rtw89: Convert
    rtw89_core_set_supported_band to use devm_*").
    
    Signed-off-by: Bitterblue Smith 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com

commit 0177aa828d966117ea30a44f2e1890fdb356118e
Author: Bitterblue Smith 
Date:   Wed Dec 24 01:24:21 2025 +0200

    wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
    
    rtw_core_enable_beacon() reads 4 bytes from an address that is not a
    multiple of 4. This results in a crash on some systems.
    
    Do 1 byte reads/writes instead.
    
    Unable to handle kernel paging request at virtual address ffff8000827e0522
    Mem abort info:
      ESR = 0x0000000096000021
      EC = 0x25: DABT (current EL), IL = 32 bits
      SET = 0, FnV = 0
      EA = 0, S1PTW = 0
      FSC = 0x21: alignment fault
    Data abort info:
      ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000
      CM = 0, WnR = 0, TnD = 0, TagAccess = 0
      GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
    swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000005492000
    [ffff8000827e0522] pgd=0000000000000000, p4d=10000001021d9403, pud=10000001021da403, pmd=100000011061c403, pte=00780000f3200f13
    Internal error: Oops: 0000000096000021 [#1]  SMP
    Modules linked in: [...] rtw88_8822ce rtw88_8822c rtw88_pci rtw88_core [...]
    CPU: 0 UID: 0 PID: 73 Comm: kworker/u32:2 Tainted: G        W           6.17.9 #1-NixOS VOLUNTARY
    Tainted: [W]=WARN
    Hardware name: FriendlyElec NanoPC-T6 LTS (DT)
    Workqueue: phy0 rtw_c2h_work [rtw88_core]
    pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : rtw_pci_read32+0x18/0x40 [rtw88_pci]
    lr : rtw_core_enable_beacon+0xe0/0x148 [rtw88_core]
    sp : ffff800080cc3ca0
    x29: ffff800080cc3ca0 x28: ffff0001031fc240 x27: ffff000102100828
    x26: ffffd2cb7c9b4088 x25: ffff0001031fc2c0 x24: ffff000112fdef00
    x23: ffff000112fdef18 x22: ffff000111c29970 x21: 0000000000000001
    x20: 0000000000000001 x19: ffff000111c22040 x18: 0000000000000000
    x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
    x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
    x11: 0000000000000000 x10: 0000000000000000 x9 : ffffd2cb6507c090
    x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
    x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
    x2 : 0000000000007f10 x1 : 0000000000000522 x0 : ffff8000827e0522
    Call trace:
     rtw_pci_read32+0x18/0x40 [rtw88_pci] (P)
     rtw_hw_scan_chan_switch+0x124/0x1a8 [rtw88_core]
     rtw_fw_c2h_cmd_handle+0x254/0x290 [rtw88_core]
     rtw_c2h_work+0x50/0x98 [rtw88_core]
     process_one_work+0x178/0x3f8
     worker_thread+0x208/0x418
     kthread+0x120/0x220
     ret_from_fork+0x10/0x20
    Code: d28fe202 8b020000 f9524400 8b214000 (b9400000)
    ---[ end trace 0000000000000000 ]---
    
    Fixes: ad6741b1e044 ("wifi: rtw88: Stop high queue during scan")
    Cc: stable@vger.kernel.org
    Closes: https://github.com/lwfinger/rtw88/issues/418
    Signed-off-by: Bitterblue Smith 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/6345300d-8c93-464c-9b05-d0d9af3c97ad@gmail.com

commit 3f90942473d25b3743a95b41af2a24a3fc8f9b79
Author: Martin Hrůza 
Date:   Wed Dec 24 01:19:00 2025 +0200

    wifi: rtw88: Increase the RX gain before scanning
    
    The driver reduces the RX gain while connected to a network located
    close by. In this condition scans return few results because the more
    distant networks can't be heard.
    
    Temporarily increase the RX gain before scanning in order to detect
    all available networks. Reset the RX gain back to the last recorded
    value once the scan finishes.
    
    Link: https://github.com/lwfinger/rtw88/issues/337
    Signed-off-by: Martin Hrůza 
    Signed-off-by: Bitterblue Smith 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/c2e72aff-190d-4f59-9914-2588de756385@gmail.com

commit 1b40c1c7571fcf926095ed92f25bd87900bdc8ed
Author: Chih-Kang Chang 
Date:   Tue Dec 23 11:06:51 2025 +0800

    wifi: rtw89: mcc: reset probe counter when receiving beacon
    
    For BE chips, needs to transmit QoS null data periodically to ensure
    the connection with AP in GC+STA mode. However, in environments
    with interference, the Qos null data might fail to transmit
    successfully. Therefore, when receive the beacon from AP will
    reset the QoS null data failure counter to avoid unnecessary
    disconnection.
    
    Signed-off-by: Chih-Kang Chang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-13-pkshih@realtek.com

commit 5e5f83fba48381098b26a8b2513a6d5fc5c66ccb
Author: Chih-Kang Chang 
Date:   Tue Dec 23 11:06:50 2025 +0800

    wifi: rtw89: setting TBTT AGG number when mac port initialization
    
    When initializing mac port, needs to set TBTT AGG number to trigger TBTT
    related interrupts. Otherwise, after sending join info H2C command with
    disconnection mode, firmware will clear TBTT AGG number. Without the
    setting from mac port initialization after that, this port will not be
    able to transmit beacons.
    
    Signed-off-by: Chih-Kang Chang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-12-pkshih@realtek.com

commit 7b0c36c968369456a0a9ac058d6a01eb135ce45b
Author: Ping-Ke Shih 
Date:   Tue Dec 23 11:06:49 2025 +0800

    wifi: rtw89: warn unexpected polling value of XTAL SI
    
    XTAL SI is an indirect serial interface to access registers in another
    hardware domain. When BT driver initializes UART interface, firmware might
    rarely control XTAL SI at the same time causing access racing.
    
    Current is to adjust initialization flow to avoid the racing. To make
    the racing visible if it still presents, add a message to address this.
    
    USB adapters might be unplugged suddenly, causing flooding messages. Check
    RTW89_FLAG_UNPLUGGED flag to avoid them.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-11-pkshih@realtek.com

commit d38289fd1243996f3ed19620bf9a2022aab5af2e
Author: Chih-Kang Chang 
Date:   Tue Dec 23 11:06:48 2025 +0800

    wifi: rtw89: refine C2H reg event polling timeout for LPS
    
    The each of C2H reg event have different polling timeout. Refine the
    LPS C2H reg event polling timeout. Otherwise, during SER, the FW has
    already crashed, the leave LPS check will wait until timeout expires,
    causing the SER recovery to take too long.
    
    Signed-off-by: Chih-Kang Chang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-10-pkshih@realtek.com

commit 0ca9cb5b8dd287cf5520e1b20e2c95006d856e78
Author: Zong-Zhe Yang 
Date:   Tue Dec 23 11:06:47 2025 +0800

    wifi: rtw89: debug: support SER L0/L1 simulation via halt H2C
    
    Original methods of SER (system error recovery) L0/L1 simulations need
    to leave PS mode before working. Introduce new methods to simulate SER
    L0/L1 and they can work under PS. Since new methods require FW support,
    so add a FW feature flag and configure the supported chips.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-9-pkshih@realtek.com

commit 2ac399c5f54a41d7c6b2c8cc6cb283f743acb0be
Author: Zong-Zhe Yang 
Date:   Tue Dec 23 11:06:46 2025 +0800

    wifi: rtw89: debug: add ser_counters dbgfs
    
    Dump counters of SER (system error recoery) L0/L1 related cases.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-8-pkshih@realtek.com

commit 44ec302e029d82fbe4b28a659eff00fd5ad6f502
Author: Zong-Zhe Yang 
Date:   Tue Dec 23 11:06:45 2025 +0800

    wifi: rtw89: ser: L1 skip polling status if FW runs event mode
    
    Originally, polling FW status was required during recovering from L1.
    Now, because newer FW support event mode, the polling can be skipped.
    Add a FW feature flag and configure the supported chips.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-7-pkshih@realtek.com

commit f4de946bdb379f543e3a599f8f048d741ad4a58e
Author: Zong-Zhe Yang 
Date:   Tue Dec 23 11:06:44 2025 +0800

    wifi: rtw89: ser: enable error IMR after recovering from L1
    
    After recovering from L1, explicitly enable error IMR to ensure next
    L1 SER (system error recovery) can work normally.
    
    Signed-off-by: Zong-Zhe Yang 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-6-pkshih@realtek.com

commit b0f1289fd61763934d8b38f7687178087241cc3e
Author: Ping-Ke Shih 
Date:   Tue Dec 23 11:06:43 2025 +0800

    wifi: rtw89: mac: reset power state before switching to power on
    
    To run power on function properly, reset power states (off/on/PS) to
    initial state. Otherwise, it might be unusable due to fail to power on.
    
    Since a USB adapter might play as USB mass storage with driver and then
    switch to WiFi adapter, causing it stays on power-on state when doing WiFi
    USB probe. Exclude this case.
    
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-5-pkshih@realtek.com

commit de1ba591d9311e84bb969cd47414dca66a94557a
Author: Kuan-Chung Chen 
Date:   Tue Dec 23 11:06:42 2025 +0800

    wifi: rtw89: mlo: fix incorrect link address in management frames
    
    Deauth frames used wrong link address after switching from default link
    to another, causing AP to reject subsequent auth frames. This affected
    not only deauth but all management frames. Fixed by setting correct
    mac_id to let header conversion references correct address CAM.
    
    Signed-off-by: Kuan-Chung Chen 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-4-pkshih@realtek.com

commit fdbff298742e5045a23a10595fca3c8c15cf90a0
Author: Kuan-Chung Chen 
Date:   Tue Dec 23 11:06:41 2025 +0800

    wifi: rtw89: mlo: fix missing TX null-data 1 during link switch
    
    Fix missing null-data 1 when switching links. The FW should send a
    null-data 1 to notify AP before disabling the old link. Adjust the
    position of the H2C rtw89_fw_h2c_mlo_link_cfg to ensure proper FW
    behavior during link transition.
    
    Signed-off-by: Kuan-Chung Chen 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-3-pkshih@realtek.com

commit 6b31738043477c1c5d8461921710bb34a865d5aa
Author: Kuan-Chung Chen 
Date:   Tue Dec 23 11:06:40 2025 +0800

    wifi: rtw89: 8852b: increase beacon loss to 6 seconds
    
    Intermittent beacon loss from a specific AP can lead to
    disconnections. Increasing the beacon loss threshold
    helps stabilize the connection.
    
    Signed-off-by: Kuan-Chung Chen 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251223030651.480633-2-pkshih@realtek.com

commit a035b23b59c54c959cd4b89094aa4c44c6b41383
Author: Johan Hovold 
Date:   Fri Dec 12 11:10:01 2025 +0900

    pinctrl: fix compile test defaults
    
    Enabling compile testing should not enable every individual driver (we
    have "allyesconfig" for that) but two new drivers got this wrong.
    
    Default to n instead of ARCH_MICROCHIP as these drivers are not needed
    in every Microchip build either.
    
    Fixes: 38cf9d641314 ("pinctrl: add pic64gx "gpio2" pinmux driver")
    Fixes: 46397274da22 ("pinctrl: add polarfire soc iomux0 pinmux driver")
    Cc: Conor Dooley 
    Signed-off-by: Johan Hovold 
    Signed-off-by: Linus Walleij 

commit 867589d82f1a0e9f534dfe7bb3bcd08a5306c22e
Author: Frank Li 
Date:   Fri Nov 14 12:47:10 2025 -0500

    ARM: dts: lpc3250-phy3250: replace deprecated at25 properties with new ones
    
    Replace deprecated at25 properties with the required properties (size,
    address-width and pagesize), which duplicate the removed properties.
    
    Fix below CHECK_DTB warning:
      arch/arm/boot/dts/nxp/lpc/lpc3250-phy3250.dtb: at25@0 (atmel,at25): 'pagesize' is a required property
      arch/arm/boot/dts/nxp/lpc/lpc3250-phy3250.dtb: at25@0 (atmel,at25): $nodename: 'anyOf' conditional failed, one must be fixed:
    
    Signed-off-by: Frank Li 
    [vzapolskiy: squashed two changes from the series and updated commit message]
    Signed-off-by: Vladimir Zapolskiy 

commit dd76e20b4c985a170c5b7a9ca781aa72be02e22d
Author: Frank Li 
Date:   Fri Nov 14 12:47:11 2025 -0500

    ARM: dts: lpc3250-phy3250: rename nodename at@0 to eeprom@0
    
    Rename nodename at@0 to eeprom@0 to fix below CHECK_DTBS warnings:
    arch/arm/boot/dts/nxp/lpc/lpc3250-phy3250.dtb: at25@0 (atmel,at25): $nodename: 'anyOf' conditional failed, one must be fixed:
            'at25@0' does not match '^eeprom@[0-9a-f]{1,2}$'
            'at25@0' does not match '^fram@[0-9a-f]{1,2}$'
    
    Signed-off-by: Frank Li 
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Vladimir Zapolskiy 

commit 8f1dae6cf85a823ed065255ad8960890d3d4dc3b
Author: Frank Li 
Date:   Fri Nov 14 12:47:09 2025 -0500

    ARM: dts: lpc3250-ea3250: add key- prefix for gpio-keys
    
    Add key- prefix to fix below CHECK_DTB warning:
      arch/arm/boot/dts/nxp/lpc/lpc3250-ea3250.dtb: gpio-keys (gpio-keys): 'joy0', ... do not match any of the regexes: '^(button|...)$', 'pinctrl-[0-9]+
    
    Reviewed-by: Vladimir Zapolskiy 
    Signed-off-by: Frank Li 
    Signed-off-by: Vladimir Zapolskiy 

commit 4713dc185fa4cc21dcc69e7d35e347adc735126a
Author: Frank Li 
Date:   Fri Nov 14 12:47:08 2025 -0500

    ARM: dts: lpc32xx: remove usb bus and elevate all children nodes
    
    Remove usb bus and elevate all children nodes because usb bus is not
    existed and only group usb devices logically.
    
    Update register address and related full node name.
    
    Fix below CHECK_DTBS warnings:
    arm/boot/dts/nxp/lpc/lpc3250-ea3250.dtb: usb (simple-bus): $nodename:0: 'usb' does not match '^([a-z][a-z0-9\\-]+-bus|bus|localbus|soc|axi|ahb|apb)(@.+)?$'
            from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
    
    Signed-off-by: Frank Li 
    Signed-off-by: Vladimir Zapolskiy 

commit ab5c13d98848d7f61680559f9eae659fbd32b029
Author: Barnabás Czémán 
Date:   Mon Nov 17 18:17:53 2025 +0100

    clk: qcom: gcc-msm8917: Add missing MDSS reset
    
    Add missing MDSS reset can be found on MSM8917 and MSM8937.
    
    Reviewed-by: Taniya Das 
    Signed-off-by: Barnabás Czémán 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251117-mdss-resets-msm8917-msm8937-v2-2-a7e9bbdaac96@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit 1ee0098e2ae6780ced27819ecfa6449e4b8ca0a9
Merge: d1919c375f211a 21dcacabcc7ec6
Author: Bjorn Andersson 
Date:   Wed Dec 24 21:46:14 2025 -0600

    Merge branch '20251117-mdss-resets-msm8917-msm8937-v2-1-a7e9bbdaac96@mainlining.org' into clk-for-6.20
    
    Merge the addition of MSM8916 MDSS reset constant through a topic
    branch, to allow integration in the DeviceTree branch as well.

commit 21dcacabcc7ec6f75a0966738ec368563969baa4
Author: Barnabás Czémán 
Date:   Mon Nov 17 18:17:52 2025 +0100

    dt-bindings: clock: gcc-msm8917: Add missing MDSS reset
    
    Add definition for MDSS reset can be found on MSM8917 and MSM8937.
    
    Signed-off-by: Barnabás Czémán 
    Acked-by: Rob Herring (Arm) 
    Link: https://lore.kernel.org/r/20251117-mdss-resets-msm8917-msm8937-v2-1-a7e9bbdaac96@mainlining.org
    Signed-off-by: Bjorn Andersson 

commit 130343ee6bca9895c47d314467db7dd3dcc8bc35
Author: Andy Yan 
Date:   Thu Oct 16 16:38:32 2025 +0800

    MAINTAINERS: Add entry for Innosilicon hdmi bridge library
    
    Add entry for Innosilicon hdmi bridge library
    
    Signed-off-by: Andy Yan 
    Link: https://patch.msgid.link/20251016083843.76675-3-andyshrk@163.com
    Signed-off-by: Dmitry Baryshkov 

commit 969325a2597ebc4cb001a92992f06f698ab2b467
Author: Andy Yan 
Date:   Thu Oct 16 16:38:31 2025 +0800

    drm/rockchip: inno-hdmi: Convert to drm bridge
    
    Convert it to drm bridge driver, it will be convenient for us to
    migrate the connector part to the display driver later.
    
    Signed-off-by: Andy Yan 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251016083843.76675-2-andyshrk@163.com
    Signed-off-by: Dmitry Baryshkov 

commit c08c123d4cd6ec3ee482d607e29388d0db2d3f1d
Author: Dmitry Baryshkov 
Date:   Sun Aug 3 14:53:52 2025 +0300

    drm/bridge: lontium-lt9611uxc: switch to HDMI audio helpers
    
    While LT9611UXC is a DSI-to-HDMI bridge, it implements all HDMI-related
    functions internally, in the firmware, thus it doesn't make sense to
    implement DRM_BRIDGE_OP_HDMI. However it is possible to implement
    DRM_BRIDGE_OP_HDMI_AUDIO, streamlining HDMI audio plumbing (which
    includes plugged notifications and ELD handling).
    
    Implement corresponding callbacks and trigger EDID read /
    drm_connector_hdmi_audio_plugged_notify() from the hpd_notify callback.
    
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20250803-lt9611uxc-hdmi-v1-2-cb9ce1793acf@oss.qualcomm.com
    Signed-off-by: Dmitry Baryshkov 

commit 8a717c16ddf261118e9128d7f146d68a2567f087
Author: Dmitry Baryshkov 
Date:   Sun Aug 3 14:53:51 2025 +0300

    drm/bridge: add connector argument to .hpd_notify callback
    
    Drivers might need to update DRM connector in the
    drm_bridge_funcs.hpd_notify callback (e.g. it might be necessary to
    update EDID before setting ELD). Add corresponding argument to the
    callback.
    
    Reviewed-by: Neil Armstrong 
    Link: https://patch.msgid.link/20250803-lt9611uxc-hdmi-v1-1-cb9ce1793acf@oss.qualcomm.com
    Signed-off-by: Dmitry Baryshkov 

commit 0b075f82935e82fc9fff90d06d2a161caaebd9c3
Author: Lucas De Marchi 
Date:   Fri Dec 19 13:16:49 2025 -0800

    drm/xe: Improve rebar log messages
    
    Some minor improvements to the log messages in the rebar logic:
    use xe-oriented printk, switch unit from M to MiB in a few places for
    consistency and use ilog2(SZ_1M) for clarity.
    
    Suggested-by: Michal Wajdeczko 
    Suggested-by: Ilpo Järvinen 
    Reviewed-by: Matt Roper 
    Signed-off-by: Lucas De Marchi 
    Link: https://patch.msgid.link/20251219211650.1908961-6-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 382876afa75a292a92ea138f2938a9856056befb
Author: Lucas De Marchi 
Date:   Fri Dec 19 13:16:48 2025 -0800

    drm/xe: Move rebar to its own file
    
    Now that xe_pci.c calls the rebar directly, it doesn't make sense to
    keep it in xe_vram.c since it's closer to the PCI initialization than to
    the VRAM. Move it to its own file.
    
    While at it, add a better comment to document the possible values for
    the vram_bar_size module parameter.
    
    Reviewed-by: Matt Roper 
    Signed-off-by: Lucas De Marchi 
    Link: https://patch.msgid.link/20251219211650.1908961-5-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 0f166bf1d6d82701cc1d94445cc2a9107d1790df
Author: Thomas Weißschuh 
Date:   Tue Dec 23 08:00:39 2025 +0100

    select: store end_time as timespec64 in restart block
    
    Storing the end time seconds as 'unsigned long' can lead to truncation
    on 32-bit architectures if assigned from the 64-bit timespec64::tv_sec.
    As the select() core uses timespec64 consistently, also use that in the
    restart block.
    
    This also allows the simplification of the accessors.
    
    Signed-off-by: Thomas Weißschuh 
    Link: https://patch.msgid.link/20251223-restart-block-expiration-v2-1-8e33e5df7359@linutronix.de
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 3685744afa4a2e65a4a509f1b782af98e929b83f
Author: chen zhang 
Date:   Mon Dec 15 19:15:00 2025 +0800

    chardev: Switch to guard(mutex) and __free(kfree)
    
    Instead of using the 'goto label; mutex_unlock()' pattern use
    'guard(mutex)' which will release the mutex when it goes out of scope.
    Use the __free(kfree) cleanup to replace instances of manually
    calling kfree(). Also make some code path simplifications that this
    allows.
    
    Signed-off-by: chen zhang 
    Link: https://patch.msgid.link/20251215111500.159243-1-chenzhang@kylinos.cn
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 3f320e5c2eca158e3b5dc2e633694ee7f348d970
Author: Thorsten Blum 
Date:   Sun Dec 14 16:31:42 2025 +0100

    namespace: Replace simple_strtoul with kstrtoul to parse boot params
    
    Replace simple_strtoul() with the recommended kstrtoul() for parsing the
    'mhash_entries=' and 'mphash_entries=' boot parameters.
    
    Check the return value of kstrtoul() and reject invalid values. This
    adds error handling while preserving behavior for existing values, and
    removes use of the deprecated simple_strtoul() helper.
    
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20251214153141.218953-2-thorsten.blum@linux.dev
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit b29a0a37f46bbfd2a36eff73eb66249d7baaf71a
Author: Thorsten Blum 
Date:   Tue Dec 16 15:52:37 2025 +0100

    dcache: Replace simple_strtoul with kstrtoul in set_dhash_entries
    
    Replace simple_strtoul() with the recommended kstrtoul() for parsing the
    'dhash_entries=' boot parameter.
    
    Check the return value of kstrtoul() and reject invalid values. This
    adds error handling while preserving behavior for existing values, and
    removes use of the deprecated simple_strtoul() helper.
    
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20251216145236.44520-2-thorsten.blum@linux.dev
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 63ad216fbfe2240da67233e0a0d10af8a12f7bde
Author: Thorsten Blum 
Date:   Thu Dec 18 12:21:45 2025 +0100

    fs: Replace simple_strtoul with kstrtoul in set_ihash_entries
    
    Replace simple_strtoul() with the recommended kstrtoul() for parsing the
    'ihash_entries=' boot parameter.
    
    Check the return value of kstrtoul() and reject invalid values. This
    adds error handling while preserving behavior for existing valid values,
    and removes use of the deprecated simple_strtoul() helper.
    
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20251218112144.225301-2-thorsten.blum@linux.dev
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 284853affe73fe1ca9786bd52b934eb9d420a942
Author: Arnd Bergmann 
Date:   Tue Dec 23 22:53:19 2025 +0100

    ASoC: rt1320: fix size_t format string
    
    Printing a size_t portably requires the use of %z instead of %l:
    
    sound/soc/codecs/rt1320-sdw.c:1494:30: error: format '%lx' expects argument of type 'long unsigned int', but argument 5 has type 'size_t' {aka 'unsigned int'} [-Werror=format=]
     1494 |                 dev_dbg(dev, "%s, rae_fw size=0x%lx\n", __func__, rae_fw->size);
          |                              ^~~~~~~~~~~~~~~~~~~~~~~~~
    
    Fixes: 22937af75abb ("ASoC: rt1320: support RAE parameters loading")
    Signed-off-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251223215322.694265-1-arnd@kernel.org
    Signed-off-by: Mark Brown 

commit 836ecc740ca829040d86a5371f1fcb276110df84
Author: Arnd Bergmann 
Date:   Tue Dec 23 22:52:53 2025 +0100

    ASoC: rt1320: fix 32-bit link failure
    
    A plain 64-bit division causes a link failure in some configurations:
    
    ERROR: modpost: "__aeabi_uldivmod" [sound/soc/codecs/snd-soc-rt1320-sdw.ko] undefined!
    
    Since this divides by a constant, using the div_u64() macro ends up
    turning this into an efficient multiply/shift operation where possible.
    
    In rt1320_calc_r0(), the open-coded shift seems a litle simpler.
    
    Fixes: da1682d5e8b5 ("ASoC: rt1320: support calibration and temperature/r0 loading")
    Signed-off-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251223215259.677762-1-arnd@kernel.org
    Signed-off-by: Mark Brown 

commit a3572bdc3a028ca47f77d7166ac95b719cf77d50
Author: Honggang LI 
Date:   Wed Dec 24 10:38:19 2025 +0800

    RDMA/rtrs: server: remove dead code
    
    As rkey had been initialized to zero, the WARN_ON_ONCE should never been
    triggered. Remove it.
    
    Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
    Signed-off-by: Honggang LI 
    Link: https://patch.msgid.link/20251224023819.138846-1-honggangli@163.com
    Signed-off-by: Leon Romanovsky 

commit 27287e3b52b5954b73203d32ee76ffd5f53f5074
Author: Brian Masney 
Date:   Fri Dec 12 08:16:27 2025 +0900

    phy: ti: phy-j721e-wiz: convert from round_rate() to determine_rate()
    
    The round_rate() clk ops is deprecated, so migrate this driver from
    round_rate() to determine_rate() using the Coccinelle semantic patch
    on the cover letter of this series.
    
    Signed-off-by: Brian Masney 
    Link: https://patch.msgid.link/20251212-phy-clk-round-rate-v3-9-beae3962f767@redhat.com
    Signed-off-by: Vinod Koul 

commit 3d4ffdfcf108e73b7c5bf07e0358d0fe8fac28d4
Author: Brian Masney 
Date:   Fri Dec 12 08:16:26 2025 +0900

    phy: rockchip: phy-rockchip-samsung-hdptx: convert from round_rate() to determine_rate()
    
    The round_rate() clk ops is deprecated, so migrate this driver from
    round_rate() to determine_rate() using the Coccinelle semantic patch
    on the cover letter of this series.
    
    Reviewed-by: Cristian Ciocaltea 
    Reviewed-by: Heiko Stuebner 
    Signed-off-by: Brian Masney 
    Link: https://patch.msgid.link/20251212-phy-clk-round-rate-v3-8-beae3962f767@redhat.com
    Signed-off-by: Vinod Koul 

commit 2f7870297ae073b0fd6e1f875a9b84c5de0dea00
Author: Brian Masney 
Date:   Fri Dec 12 08:16:25 2025 +0900

    phy: rockchip: phy-rockchip-inno-hdmi: convert from round_rate() to determine_rate()
    
    The round_rate() clk ops is deprecated, so migrate this driver from
    round_rate() to determine_rate() using the Coccinelle semantic patch
    on the cover letter of this series.
    
    Reviewed-by: Heiko Stuebner 
    Signed-off-by: Brian Masney 
    Link: https://patch.msgid.link/20251212-phy-clk-round-rate-v3-7-beae3962f767@redhat.com
    Signed-off-by: Vinod Koul 

commit 0484168a352f0f75a82d9917df4b23f5466726b7
Author: Brian Masney 
Date:   Fri Dec 12 08:16:24 2025 +0900

    phy: mediatek: phy-mtk-mipi-dsi-mt8183: convert from round_rate() to determine_rate()
    
    The round_rate() clk ops is deprecated, so migrate this driver from
    round_rate() to determine_rate() using the Coccinelle semantic patch
    on the cover letter of this series.
    
    Signed-off-by: Brian Masney 
    Link: https://patch.msgid.link/20251212-phy-clk-round-rate-v3-6-beae3962f767@redhat.com
    Signed-off-by: Vinod Koul 

commit 8e6bb53203d5c0a0cbc4f5cd90d8b2c6f20818ba
Author: Brian Masney 
Date:   Fri Dec 12 08:16:23 2025 +0900

    phy: mediatek: phy-mtk-mipi-dsi-mt8173: convert from round_rate() to determine_rate()
    
    The round_rate() clk ops is deprecated, so migrate this driver from
    round_rate() to determine_rate() using the Coccinelle semantic patch
    on the cover letter of this series.
    
    Signed-off-by: Brian Masney 
    Link: https://patch.msgid.link/20251212-phy-clk-round-rate-v3-5-beae3962f767@redhat.com
    Signed-off-by: Vinod Koul 

commit 7a4ce5a9b674654ab04961a9ea03d15d71edb2a9
Author: Brian Masney 
Date:   Fri Dec 12 08:16:22 2025 +0900

    phy: mediatek: phy-mtk-hdmi-mt8195: convert from round_rate() to determine_rate()
    
    The round_rate() clk ops is deprecated, so migrate this driver from
    round_rate() to determine_rate() using the Coccinelle semantic patch
    on the cover letter of this series.
    
    Tested-by: Louis-Alexis Eyraud 
    Signed-off-by: Brian Masney 
    Link: https://patch.msgid.link/20251212-phy-clk-round-rate-v3-4-beae3962f767@redhat.com
    Signed-off-by: Vinod Koul 

commit be4267241c196745e1f649afb7d232fe4440073a
Author: Brian Masney 
Date:   Fri Dec 12 08:16:21 2025 +0900

    phy: mediatek: phy-mtk-hdmi-mt8173: convert from round_rate() to determine_rate()
    
    The round_rate() clk ops is deprecated, so migrate this driver from
    round_rate() to determine_rate() using the Coccinelle semantic patch
    on the cover letter of this series.
    
    Signed-off-by: Brian Masney 
    Link: https://patch.msgid.link/20251212-phy-clk-round-rate-v3-3-beae3962f767@redhat.com
    Signed-off-by: Vinod Koul 

commit ebed08490d667141085ed873309aec5806dbb3a9
Author: Brian Masney 
Date:   Fri Dec 12 08:16:20 2025 +0900

    phy: mediatek: phy-mtk-hdmi-mt2701: convert from round_rate() to determine_rate()
    
    The round_rate() clk ops is deprecated, so migrate this driver from
    round_rate() to determine_rate() using the Coccinelle semantic patch
    on the cover letter of this series.
    
    Signed-off-by: Brian Masney 
    Link: https://patch.msgid.link/20251212-phy-clk-round-rate-v3-2-beae3962f767@redhat.com
    Signed-off-by: Vinod Koul 

commit efc389fa00d1b93df8f95974c4f8c11da63671da
Author: Brian Masney 
Date:   Fri Dec 12 08:16:19 2025 +0900

    phy: freescale: phy-fsl-samsung-hdmi: convert from round_rate() to determine_rate()
    
    The round_rate() clk ops is deprecated, so migrate this driver from
    round_rate() to determine_rate() using the Coccinelle semantic patch
    on the cover letter of this series.
    
    Signed-off-by: Brian Masney 
    Link: https://patch.msgid.link/20251212-phy-clk-round-rate-v3-1-beae3962f767@redhat.com
    Signed-off-by: Vinod Koul 

commit 5c87da0308f9395700fd3072fcc45b43234366fb
Author: Krishna Kurapati 
Date:   Fri Dec 19 23:01:07 2025 +0530

    phy: qualcomm: phy-qcom-eusb2-repeater: Add squelch detect param update
    
    Add support for overriding Squelch Detect parameter.
    
    Signed-off-by: Krishna Kurapati 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Konrad Dybcio 
    Link: https://patch.msgid.link/20251219173108.2119296-3-krishna.kurapati@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit a590c0f935349b9f3ae72d9fdec002689915519d
Author: Krishna Kurapati 
Date:   Fri Dec 19 23:01:06 2025 +0530

    dt-bindings: phy: qcom,snps-eusb2-repeater: Add squelch param update
    
    Add squelch detect parameter update for synopsys eusb2 repeater. The
    values (indicated in basis-points) depict a percentage change with
    respect to the nominal value.
    
    Signed-off-by: Krishna Kurapati 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251219173108.2119296-2-krishna.kurapati@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 652a5a9c3f5333fe9f0c43bfd562494464bbc74e
Author: André Draszik 
Date:   Wed Dec 24 06:28:18 2025 +0000

    dt-bindings: phy: samsung,usb3-drd-phy: add power-domains
    
    The USB phy can be part of a power domain, so we need to allow the
    relevant property 'power-domains'.
    
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Peter Griffin 
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20251224-power-domains-dt-bindings-phy-samsung-ufs-phy-v2-2-581089639982@linaro.org
    Signed-off-by: Vinod Koul 

commit 14fd381b632881a8e33108614e71ec253048629b
Author: André Draszik 
Date:   Wed Dec 24 06:28:17 2025 +0000

    dt-bindings: phy: samsung,ufs-phy: add power-domains
    
    The UFS phy can be part of a power domain, so we need to allow the
    relevant property 'power-domains'.
    
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Peter Griffin 
    Signed-off-by: André Draszik 
    Link: https://patch.msgid.link/20251224-power-domains-dt-bindings-phy-samsung-ufs-phy-v2-1-581089639982@linaro.org
    Signed-off-by: Vinod Koul 

commit 03ea8676919af21b99bea01f18ef1a271d19f92f
Author: Anton D. Stavinskii 
Date:   Wed Nov 26 21:21:16 2025 +0400

    riscv: dts: sophgo: cv180x: fix USB dwc2 FIFO sizes
    
    I've tested the current dwc2 FIFO configuration and found that USB
    device mode breaks in ECM mode when transmitting frames larger than
    128 bytes. For example, large ICMP packets or iperf3 traffic cause
    the USB link to hang and eventually disconnect without any messages in
    dmesg.
    
    After switching to more conservative FIFO sizes, ECM becomes stable
    and no longer drops the connection. iperf3 now shows ~130 Mbit/s RX
    and ~100 Mbit/s TX on SG2002 (MilkV Duo 256M).
    
    Fix the FIFO sizes accordingly.
    
    Signed-off-by: Anton D. Stavinskii 
    Reviewed-by: Inochi Amaoto 
    Fixes: e307248a3c2d ("riscv: dts: sophgo: Add USB support for cv18xx")
    Link: https://lore.kernel.org/r/20251126172115.1894190-2-stavinsky@gmail.com
    Signed-off-by: Inochi Amaoto 
    Signed-off-by: Chen Wang 
    Signed-off-by: Chen Wang 

commit 820c866c42de99e7d65c7bd1f591f067dbbe3cae
Author: Qiang Yu 
Date:   Tue Dec 23 19:05:26 2025 -0800

    mhi: host: Add support for loading dual ELF image format
    
    Currently, the FBC image contains a single ELF header followed by segments
    for both SBL and WLAN FW. However, TME-L (Trust Management Engine Lite)
    supported devices (e.g., QCC2072) require separate ELF headers for SBL and
    WLAN FW segments due to TME-L image authentication requirements.
    
    Current image format contains two sections in a single binary:
    - First 512KB: ELF header + SBL segments
    - Remaining: WLAN FW segments (raw data)
    
    The TME-L supported image format contains two complete ELF files in a
    single binary:
    - First 512KB: Complete SBL ELF file (ELF header + SBL segments)
    - Remaining: Complete WLAN FW ELF file (ELF header + WLAN FW segments)
    
    Download behavior:
    - Legacy: 1. First 512KB via BHI (ELF header + SBL)
              2. Full image via BHIe
    
    - TME-L: 1. First 512KB via BHI (SBL ELF file)
             2. Remaining via BHIe (WLAN FW ELF file only)
    
    Add runtime detection to automatically identify the image format by
    checking for the presence of a second ELF header at the 512KB boundary.
    When detected, MHI skips the first 512KB during WLAN FW download over BHIe
    as it is loaded in BHI phase.
    
    Signed-off-by: Qiang Yu 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251223-wlan_image_load_skip_512k-v5-1-8d4459d720b5@oss.qualcomm.com

commit fb3fba6933d169a4a12a7aa33cb68abfeed62ef4
Author: Suraj Kandpal 
Date:   Tue Dec 23 12:04:22 2025 +0530

    drm/i915/cx0: Use the consolidated HDMI tables
    
    Use the consolidated HDMI tables before we try to compute them via
    algorithm. The reason is that these are the ideal values and even
    though the values calculated via the HDMI algorithm are correct but
    not always ideal. This is done for C20 and already exists for C10.
    
    Signed-off-by: Suraj Kandpal 
    Reviewed-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251223063422.1444968-1-suraj.kandpal@intel.com

commit 0be016a4b5d1b927de04e2e7a0a2bce51aacbfff
Author: Alex Elder 
Date:   Thu Dec 18 09:12:31 2025 -0600

    riscv: dts: spacemit: PCIe and PHY-related updates
    
    Define PCIe and PHY-related Device Tree nodes for the SpacemiT K1 SoC.
    
    Enable the combo PHY and the two PCIe-only PHYs on the Banana Pi BPI-F3
    board.  The combo PHY is used for USB on this board, and that will be
    enabled when USB 3 support is accepted.
    
    The combo PHY must perform a calibration step to determine configuration
    values used by the PCIe-only PHYs.  As a result, it must be enabled if
    either of the other two PHYs is enabled.
    
    Signed-off-by: Alex Elder 
    Reviewed-by: Yixun Lan 
    Tested-by: Yixun Lan 
    Link: https://lore.kernel.org/r/20251218151235.454997-6-elder@riscstar.com
    Signed-off-by: Yixun Lan 

commit 73a6c811fa0d07078c9e1eaecea76ce26fb5f10e
Author: Alex Elder 
Date:   Thu Dec 18 09:12:30 2025 -0600

    riscv: dts: spacemit: Add a PCIe regulator
    
    Define a 3.3v fixed voltage regulator to be used by PCIe on the
    Banana Pi BPI-F3.  On this platform, this regulator is always on.
    
    Signed-off-by: Alex Elder 
    Reviewed-by: Yixun Lan 
    Tested-by: Yixun Lan 
    Link: https://lore.kernel.org/r/20251218151235.454997-5-elder@riscstar.com
    Signed-off-by: Yixun Lan 

commit 6574f01ef95dd9029a0230f4f56a62f93fdd8319
Merge: cbd41c6d4c26c1 b927546677c876
Author: Arnaldo Carvalho de Melo 
Date:   Tue Dec 23 22:59:28 2025 -0300

    Merge remote-tracking branch 'torvalds/master' into perf-tools-next
    
    To pick up fixes from perf-tools.
    
    Signed-off-by: Arnaldo Carvalho de Melo 

commit d4318c1a79ac49f0726dd23a01d1961757b5f98d
Author: Shuai Xue 
Date:   Wed Dec 10 21:29:06 2025 +0800

    PCI: trace: Add RAS tracepoint to monitor link speed changes
    
    PCIe link speed degradation directly impacts system performance and often
    indicates hardware issues such as faulty devices, physical layer problems,
    or configuration errors.
    
    To this end, add a RAS tracepoint to monitor link speed changes, enabling
    proactive health checks and diagnostic analysis.
    
    The following output is generated when a device is hotplugged:
    
      $ echo 1 > /sys/kernel/debug/tracing/events/pci/pcie_link_event/enable
      $ cat /sys/kernel/debug/tracing/trace_pipe
         irq/51-pciehp-88      [001] .....   381.545386: pcie_link_event: 0000:00:02.0 type:4, reason:4, cur_bus_speed:20, max_bus_speed:23, width:1, flit_mode:0, status:DLLLA
    
    Suggested-by: Ilpo Järvinen 
    Suggested-by: Matthew W Carlis 
    Suggested-by: Lukas Wunner 
    Signed-off-by: Shuai Xue 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Ilpo Järvinen 
    Link: https://patch.msgid.link/20251210132907.58799-3-xueshuai@linux.alibaba.com

commit 9e541b3cee70a3bbe86b176c903c23b29fe033cd
Author: Shuai Xue 
Date:   Wed Dec 10 21:29:05 2025 +0800

    PCI: trace: Add generic RAS tracepoint for hotplug event
    
    Hotplug events are critical indicators for analyzing hardware health, and
    surprise link downs can significantly impact system performance and
    reliability.
    
    Define a new TRACING_SYSTEM named "pci", add a generic RAS tracepoint
    for hotplug event to help health checks. Add enum pci_hotplug_event in
    include/uapi/linux/pci.h so applications like rasdaemon can register
    tracepoint event handlers for it.
    
    The following output is generated when a device is hotplugged:
    
      $ echo 1 > /sys/kernel/debug/tracing/events/pci/pci_hp_event/enable
      $ cat /sys/kernel/debug/tracing/trace_pipe
         irq/51-pciehp-88      [001] .....  1311.177459: pci_hp_event: 0000:00:02.0 slot:10, event:CARD_PRESENT
    
         irq/51-pciehp-88      [001] .....  1311.177566: pci_hp_event: 0000:00:02.0 slot:10, event:LINK_UP
    
    Suggested-by: Lukas Wunner 
    Signed-off-by: Shuai Xue 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Lukas Wunner 
    Reviewed-by: Jonathan Cameron 
    Reviewed-by: Steven Rostedt (Google)  # for trace event
    Reviewed-by: Ilpo Järvinen 
    Link: https://patch.msgid.link/20251210132907.58799-2-xueshuai@linux.alibaba.com

commit 11721c45a8266a9d0c9684153d20e37159465f96
Author: Ilpo Järvinen 
Date:   Mon Dec 8 16:56:54 2025 +0200

    PCI: Use resource_set_range() that correctly sets ->end
    
    __pci_read_base() sets resource start and end addresses when resource
    is larger than 4G but pci_bus_addr_t or resource_size_t are not capable
    of representing 64-bit PCI addresses. This creates a problematic
    resource that has non-zero flags but the start and end addresses do not
    yield to resource size of 0 but 1.
    
    Replace custom resource addresses setup with resource_set_range()
    that correctly sets end address as -1 which results in resource_size()
    returning 0.
    
    For consistency, also use resource_set_range() in the other branch that
    does size based resource setup.
    
    Fixes: 23b13bc76f35 ("PCI: Fail safely if we can't handle BARs larger than 4GB")
    Link: https://lore.kernel.org/all/20251207215359.28895-1-ansuelsmth@gmail.com/T/#m990492684913c5a158ff0e5fc90697d8ad95351b
    Signed-off-by: Ilpo Järvinen 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Andy Shevchenko 
    Cc: stable@vger.kernel.org
    Cc: Christian Marangi 
    Link: https://patch.msgid.link/20251208145654.5294-1-ilpo.jarvinen@linux.intel.com

commit 7c5c7d06bd1f86d2c3ebe62be903a4ba42db4d2c
Author: Liu Song 
Date:   Thu Jul 10 14:38:45 2025 +0800

    PCI: endpoint: Avoid creating sub-groups asynchronously
    
    The asynchronous creation of sub-groups by a delayed work could lead to a
    NULL pointer dereference when the driver directory is removed before the
    work completes.
    
    The crash can be easily reproduced with the following commands:
    
      # cd /sys/kernel/config/pci_ep/functions/pci_epf_test
      # for i in {1..20}; do mkdir test && rmdir test; done
    
      BUG: kernel NULL pointer dereference, address: 0000000000000088
      ...
      Call Trace:
       configfs_register_group+0x3d/0x190
       pci_epf_cfs_work+0x41/0x110
       process_one_work+0x18f/0x350
       worker_thread+0x25a/0x3a0
    
    Fix this issue by using configfs_add_default_group() API which does not
    have the deadlock problem as configfs_register_group() and does not require
    the delayed work handler.
    
    Fixes: e85a2d783762 ("PCI: endpoint: Add support in configfs to associate two EPCs with EPF")
    Signed-off-by: Liu Song 
    [mani: slightly reworded the description and added stable list]
    Signed-off-by: Manivannan Sadhasivam 
    Signed-off-by: Bjorn Helgaas 
    Cc: stable@kernel.org
    Link: https://patch.msgid.link/20250710143845409gLM6JdlwPhlHG9iX3F6jK@zte.com.cn

commit ad0c6da5be901f5c181490f683d22b416059bccb
Author: Baruch Siach 
Date:   Mon Nov 3 09:28:30 2025 +0200

    Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
    
    Fix copy & paste errors by changing the references from 'ntb' to 'vntb'.
    
    Fixes: 4ac8c8e52cd9 ("Documentation: PCI: Add specification for the PCI vNTB function device")
    Signed-off-by: Baruch Siach 
    [mani: squashed the patches and fixed more errors]
    Signed-off-by: Manivannan Sadhasivam 
    Signed-off-by: Bjorn Helgaas 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/b51c2a69ffdbfa2c359f5cf33f3ad2acc3db87e4.1762154911.git.baruch@tkos.co.il

commit ac1317df039d9e4a05e5acac4159e5c2021600aa
Author: Jonathan Cavitt 
Date:   Mon Dec 22 20:20:00 2025 +0000

    drm/xe/guc: READ/WRITE_ONCE ct->state
    
    Use READ_ONCE and WRITE_ONCE when operating on ct->state
    to prevent the compiler form ignoring important modifications
    to its value.
    
    Suggested-by: Matthew Brost 
    Signed-off-by: Jonathan Cavitt 
    Cc: Rodrigo Vivi 
    Cc: Michal Wajdeczko 
    Cc: Daniele Ceraolo Spurio 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251222201957.63245-6-jonathan.cavitt@intel.com
    Signed-off-by: Rodrigo Vivi 

commit b5179dbd1c14743ae80f0aaa28eaaf35c361608f
Author: Jonathan Cavitt 
Date:   Mon Dec 22 20:19:59 2025 +0000

    drm/xe/guc: READ/WRITE_ONCE g2h_fence->done
    
    Use READ_ONCE and WRITE_ONCE when operating on g2h_fence->done
    to prevent the compiler from ignoring important modifications
    to its value.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Suggested-by: Matthew Brost 
    Signed-off-by: Jonathan Cavitt 
    Cc: Rodrigo Vivi 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251222201957.63245-5-jonathan.cavitt@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 6ba673331340dabcff4a3ca91cc67761ba74c518
Author: Thorsten Blum 
Date:   Thu Nov 20 23:17:57 2025 +0100

    ecryptfs: Drop redundant NUL terminations after calling ecryptfs_to_hex
    
    ecryptfs_to_hex() already NUL-terminates the destination buffers. Drop
    the manual NUL terminations.
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Tyler Hicks 

commit e8fb5ec8934312df0a8f28b5514733acdf7ba722
Author: Thorsten Blum 
Date:   Fri Dec 19 22:32:33 2025 +0100

    ecryptfs: Replace memcpy + NUL termination in ecryptfs_new_file_context
    
    Use strscpy() to copy the NUL-terminated '->global_default_cipher_name'
    to the destination buffer instead of using memcpy() followed by a manual
    NUL termination. Remove the now-unused local variable 'cipher_name_len'.
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Tyler Hicks 

commit 0529a804095b22bf4fe8502d1a1eb09a25a5b954
Author: Thorsten Blum 
Date:   Sat Dec 13 12:04:54 2025 +0100

    ecryptfs: Replace strcpy with strscpy in ecryptfs_validate_options
    
    strcpy() has been deprecated [1] because it performs no bounds checking
    on the destination buffer, which can lead to buffer overflows. Replace
    it with the safer strscpy().
    
    Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1]
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Tyler Hicks 

commit c82f77a4ac9589a5d73d4caaa439fa670c684455
Author: Thorsten Blum 
Date:   Sat Dec 13 12:04:52 2025 +0100

    ecryptfs: Replace strcpy with strscpy in ecryptfs_cipher_code_to_string
    
    strcpy() has been deprecated [1] because it performs no bounds checking
    on the destination buffer, which can lead to buffer overflows. Since
    the parameter 'char *str' is just a pointer with no size information,
    extend the function with a 'size' parameter to pass the destination
    buffer's size as an additional argument. Adjust the call sites
    accordingly.
    
    Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1]
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Tyler Hicks 

commit 3bdc6cace25c3c7adfc073bb763bb52c9d1282c8
Author: Thorsten Blum 
Date:   Sat Dec 13 12:04:50 2025 +0100

    ecryptfs: Replace strcpy with strscpy in ecryptfs_set_default_crypt_stat_vals
    
    strcpy() has been deprecated [1] because it performs no bounds checking
    on the destination buffer, which can lead to buffer overflows. Replace
    it with the safer strscpy().
    
    Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1]
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Tyler Hicks 

commit 5c31c9bf9e2ff0d6c065ff7f2ccf8a1e95ddbb49
Author: Baolin Liu 
Date:   Tue Nov 11 20:13:25 2025 +0800

    ecryptfs: simplify list initialization in ecryptfs_parse_packet_set()
    
    In ecryptfs_parse_packet_set(),use LIST_HEAD() to declare and
    initialize the 'auth_tok_list' list in one step instead of
    using INIT_LIST_HEAD() separately.
    
    No functional change.
    
    Signed-off-by: Baolin Liu 
    Signed-off-by: Tyler Hicks 

commit 111625ba8ab818c68928c8cbfde8775dcd5d6690
Author: Zhang Zekun 
Date:   Fri Sep 6 14:12:41 2024 +0800

    ecryptfs: Remove unused declartion ecryptfs_fill_zeros()
    
    The definition of ecryptfs_fill_zeros() has been removed since
    commit b6c1d8fcbade ("eCryptfs: remove unused functions and kmem_cache")
    So, Remove the empty declartion in header files.
    
    Signed-off-by: Zhang Zekun 
    Signed-off-by: Tyler Hicks 

commit ec25c4cf2db1ab1b91b8b4ba5296fb99e30debbe
Author: Thorsten Blum 
Date:   Fri Oct 18 23:41:42 2024 +0200

    ecryptfs: Fix packet format comment in parse_tag_67_packet()
    
    s/TAG 65/TAG 67/
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Tyler Hicks 

commit 9383d8205c1591f49d66cb53b3a5b0f15e9ff703
Author: Zipeng Zhang 
Date:   Mon Mar 20 10:04:28 2023 +0800

    ecryptfs: comment typo fix
    
    Comment typo fix "vitual" -> "virtual".
    
    Signed-off-by: Zipeng Zhang 
    Signed-off-by: Tyler Hicks 

commit 0f9b0076ff05492aac2fb38129506892b81748cf
Author: Slark Xiao 
Date:   Fri Jul 22 18:02:12 2022 +0800

    ecryptfs: keystore: Fix typo 'the the' in comment
    
    Replace 'the the' with 'the' in the comment.
    
    Signed-off-by: Slark Xiao 
    Signed-off-by: Tyler Hicks 

commit c3a613a03902dc09a9b50d2f6ae67005908f4a7e
Author: Umesh Nerlige Ramappa 
Date:   Tue Dec 23 10:39:47 2025 -0800

    drm/xe/soc_remapper: Add system controller config for SoC remapper
    
    Define system controller config bits and helpers for SoC remapper.
    
    Signed-off-by: Umesh Nerlige Ramappa 
    Reviewed-by: Badal Nilawar 
    Link: https://patch.msgid.link/20251223183943.3175941-8-umesh.nerlige.ramappa@intel.com

commit 32eab46a6160ffdddf476d2924edde7fc34a28f8
Author: Umesh Nerlige Ramappa 
Date:   Tue Dec 23 10:39:46 2025 -0800

    drm/xe/soc_remapper: Use SoC remapper helper from VSEC code
    
    Since different drivers can use SoC remapper, modify VSEC code to
    access SoC remapper via a helper that would synchronize such accesses.
    
    Signed-off-by: Umesh Nerlige Ramappa 
    Reviewed-by: Badal Nilawar 
    Link: https://patch.msgid.link/20251223183943.3175941-7-umesh.nerlige.ramappa@intel.com

commit a9f88c68f861f86f05b1272b0870f2973784616d
Author: Umesh Nerlige Ramappa 
Date:   Tue Dec 23 10:39:45 2025 -0800

    drm/xe/soc_remapper: Initialize SoC remapper during Xe probe
    
    SoC remapper is used to map different HW functions in the SoC to their
    respective drivers. Initialize SoC remapper during driver load.
    
    Signed-off-by: Umesh Nerlige Ramappa 
    Reviewed-by: Badal Nilawar 
    Link: https://patch.msgid.link/20251223183943.3175941-6-umesh.nerlige.ramappa@intel.com

commit f14cdb1367b947d373215e36cfe9c69768dbafc9
Merge: ac1c5bc7c4c7e2 efecc9e825f4aa
Author: Alexei Starovoitov 
Date:   Tue Dec 23 11:30:00 2025 -0800

    Merge branch 'remove-kf_sleepable-from-arena-kfuncs'
    
    Puranjay Mohan says:
    
    ====================
    Remove KF_SLEEPABLE from arena kfuncs
    
    V7: https://lore.kernel.org/all/20251222190815.4112944-1-puranjay@kernel.org/
    Changes in V7->v8:
    - Use clear_lo32(arena->user_vm_start) in place of user_vm_start in patch 3
    
    V6: https://lore.kernel.org/all/20251217184438.3557859-1-puranjay@kernel.org/
    Changes in v6->v7:
    - Fix a deadlock in patch 1, that was being fixed in patch 2. Move the fix to patch 1.
    - Call flush_cache_vmap() after setting up the mappings as it is
      required by some architectures.
    
    V5: https://lore.kernel.org/all/20251212044516.37513-1-puranjay@kernel.org/
    Changes in v5->v6:
    Patch 1:
            - Add a missing ; to make sure this patch builds individually. (AI)
    
    V4: https://lore.kernel.org/all/20251212004350.6520-1-puranjay@kernel.org/
    Changes in v4->v5:
    Patch 1:
            - Fix a memory leak in arena_alloc_pages(), it was being fixed in
              Patch 3 but, every patch should be complete in itself. (AI)
    Patch 3:
            - Don't do useless addition in arena_alloc_pages() (Alexei)
            - Add a comment about kmalloc_nolock() failure and expectations.
    
    v3: https://lore.kernel.org/all/20251117160150.62183-1-puranjay@kernel.org/
    Changes in v3->v4:
            - Coding style changes related to comments in Patch 2/3 (Alexei)
    
    v2: https://lore.kernel.org/all/20251114111700.43292-1-puranjay@kernel.org/
    Changes in v2->v3:
    Patch 1:
            - Call range_tree_destroy() in error path of
              populate_pgtable_except_pte() in arena_map_alloc() (AI)
    Patch 2:
            - Fix double mutex_unlock() in the error path of
              arena_alloc_pages() (AI)
            - Fix coding style issues (Alexei)
    Patch 3:
            - Unlock spinlock before returning from arena_vm_fault() in case
              BPF_F_SEGV_ON_FAULT is set by user. (AI)
            - Use __llist_del_all() in place of llist_del_all for on-stack
              llist (free_pages) (Alexei)
            - Fix build issues on 32-bit systems where arena.c is not compiled.
              (kernel test robot)
            - Make bpf_arena_alloc_pages() polymorphic so it knows if it has
              been called in sleepable or non-sleepable context. This
              information is passed to arena_free_pages() in the error path.
    Patch 4:
            - Add a better comment for the big_alloc3() test that triggers
              kmalloc_nolock()'s limit and if bpf_arena_alloc_pages() works
              correctly above this limit.
    
    v1: https://lore.kernel.org/all/20251111163424.16471-1-puranjay@kernel.org/
    Changes in v1->v2:
    Patch 1:
            - Import tlbflush.h to fix build issue in loongarch. (kernel
              test robot)
            - Fix unused variable error in apply_range_clear_cb() (kernel
              test robot)
            - Call bpf_map_area_free() on error path of
              populate_pgtable_except_pte() (AI)
            - Use PAGE_SIZE in apply_to_existing_page_range() (AI)
    Patch 2:
            - Cap allocation made by kmalloc_nolock() for pages array to
              KMALLOC_MAX_CACHE_SIZE and reuse the array in an explicit loop
              to overcome this limit. (AI)
    Patch 3:
            - Do page_ref_add(page, 1); under the spinlock to mitigate a
              race (AI)
    Patch 4:
            - Add a new testcase big_alloc3() verifier_arena_large.c that
              tries to allocate a large number of pages at once, this is to
              trigger the kmalloc_nolock() limit in Patch 2 and see if the
              loop logic works correctly.
    
    This set allows arena kfuncs to be called from non-sleepable contexts.
    It is acheived by the following changes:
    
    The range_tree is now protected with a rqspinlock and not a mutex,
    this change is enough to make bpf_arena_reserve_pages() any context
    safe.
    
    bpf_arena_alloc_pages() had four points where it could sleep:
    
    1. Mutex to protect range_tree: now replaced with rqspinlock
    
    2. kvcalloc() for allocations: now replaced with kmalloc_nolock()
    
    3. Allocating pages with bpf_map_alloc_pages(): this already calls
       alloc_pages_nolock() in non-sleepable contexts and therefore is safe.
    
    4. Setting up kernel page tables with vm_area_map_pages():
       vm_area_map_pages() may allocate memory while inserting pages into
       bpf arena's vm_area. Now, at arena creation time populate all page
       table levels except the last level and when new pages need to be
       inserted call apply_to_page_range() again which will only do
       set_pte_at() for those pages and will not allocate memory.
    
    The above four changes make bpf_arena_alloc_pages() any context safe.
    
    bpf_arena_free_pages() has to do the following steps:
    
    1. Update the range_tree
    2. vm_area_unmap_pages(): to unmap pages from kernel vm_area
    3. flush the tlb: done in step 2, already.
    4. zap_pages(): to unmap pages from user page tables
    5. free pages.
    
    The third patch in this set makes bpf_arena_free_pages() polymorphic using
    the specialize_kfunc() mechanism. When called from a sleepable context,
    arena_free_pages() remains mostly unchanged except the following:
    1. rqspinlock is taken now instead of the mutex for the range tree
    2. Instead of using vm_area_unmap_pages() that can free intermediate page
       table levels, apply_to_existing_page_range() with a callback is used
       that only does pte_clear() on the last level and leaves the intermediate
       page table levels intact. This is needed to make sure that
       bpf_arena_alloc_pages() can safely do set_pte_at() without allocating
       intermediate page tables.
    
    When arena_free_pages() is called from a non-sleepable context or it fails to
    acquire the rqspinlock in the sleepable case, a lock-less list of struct
    arena_free_span is used to queue the uaddr and page cnt. kmalloc_nolock()
    is used to allocate this arena_free_span, this can fail but we need to make
    this trade-off for frees done from non-sleepable contexts.
    
    arena_free_pages() then raises an irq_work whose handler in turn schedules
    work that iterate this list and clears ptes, flushes tlbs, zap pages, and
    frees pages for the queued uaddr and page cnts.
    
    apply_range_clear_cb() with apply_to_existing_page_range() is used to
    clear PTEs and collect pages to be freed, struct llist_node pcp_llist;
    in the struct page is used to do this.
    ====================
    
    Link: https://patch.msgid.link/20251222195022.431211-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit efecc9e825f4aa3fe616236152604a066a3e776d
Author: Puranjay Mohan 
Date:   Mon Dec 22 11:50:19 2025 -0800

    selftests: bpf: test non-sleepable arena allocations
    
    As arena kfuncs can now be called from non-sleepable contexts, test this
    by adding non-sleepable copies of tests in verifier_arena, this is done
    by using a socket program instead of syscall.
    
    Add a new test case in verifier_arena_large to check that the
    bpf_arena_alloc_pages() works for more than 1024 pages.
    1024 * sizeof(struct page *) is the upper limit of kmalloc_nolock() but
    bpf_arena_alloc_pages() should still succeed because it re-uses this
    array in a loop.
    
    Augment the arena_list selftest to also run in non-sleepable context by
    taking rcu_read_lock.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20251222195022.431211-5-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit b8467290edab4bafae352bf3f317055669a1a458
Author: Puranjay Mohan 
Date:   Mon Dec 22 11:50:18 2025 -0800

    bpf: arena: make arena kfuncs any context safe
    
    Make arena related kfuncs any context safe by the following changes:
    
    bpf_arena_alloc_pages() and bpf_arena_reserve_pages():
    Replace the usage of the mutex with a rqspinlock for range tree and use
    kmalloc_nolock() wherever needed. Use free_pages_nolock() to free pages
    from any context.
    apply_range_set/clear_cb() with apply_to_page_range() has already made
    populating the vm_area in bpf_arena_alloc_pages() any context safe.
    
    bpf_arena_free_pages(): defer the main logic to a workqueue if it is
    called from a non-sleepable context.
    
    specialize_kfunc() is used to replace the sleepable arena_free_pages()
    with bpf_arena_free_pages_non_sleepable() when the verifier detects the
    call is from a non-sleepable context.
    
    In the non-sleepable case, arena_free_pages() queues the address and the
    page count to be freed to a lock-less list of struct arena_free_spans
    and raises an irq_work. The irq_work handler calls schedules_work() as
    it is safe to be called from irq context.  arena_free_worker() (the work
    queue handler) iterates these spans and clears ptes, flushes tlb, zaps
    pages, and calls __free_page().
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20251222195022.431211-4-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 360c35f8ffae0f184805d9eb7d126474345bac9b
Author: Puranjay Mohan 
Date:   Mon Dec 22 11:50:17 2025 -0800

    bpf: arena: use kmalloc_nolock() in place of kvcalloc()
    
    To make arena_alloc_pages() safe to be called from any context, replace
    kvcalloc() with kmalloc_nolock() so as it doesn't sleep or take any
    locks. kmalloc_nolock() returns NULL for allocations larger than
    KMALLOC_MAX_CACHE_SIZE, which is (PAGE_SIZE * 2) = 8KB on systems with
    4KB pages. So, round down the allocation done by kmalloc_nolock to 1024
    * 8 and reuse the array in a loop.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20251222195022.431211-3-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit c336b0b327120052c331f6839ee60069065a7c74
Author: Puranjay Mohan 
Date:   Mon Dec 22 11:50:16 2025 -0800

    bpf: arena: populate vm_area without allocating memory
    
    vm_area_map_pages() may allocate memory while inserting pages into bpf
    arena's vm_area. In order to make bpf_arena_alloc_pages() kfunc
    non-sleepable change bpf arena to populate pages without
    allocating memory:
    - at arena creation time populate all page table levels except
      the last level
    - when new pages need to be inserted call apply_to_page_range() again
      with apply_range_set_cb() which will only set_pte_at() those pages and
      will not allocate memory.
    - when freeing pages call apply_to_existing_page_range with
      apply_range_clear_cb() to clear the pte for the page to be removed. This
      doesn't free intermediate page table levels.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20251222195022.431211-2-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 23c3373af05a3ec268acb02ffe962ac6882c673a
Author: Chukun Pan 
Date:   Wed Sep 10 20:20:00 2025 +0800

    phy: rockchip: naneng-combphy: use existing DT property check for rk3528
    
    The naneng-combphy driver already has DT property checks for
    "rockchip,enable-ssc" and "rockchip,ext-refclk", use it for
    the rk3528_combphy_cfg. Also aligned the indentation of the
    rk3528_combphy_grfcfgs parameters (using tabs).
    
    Signed-off-by: Chukun Pan 
    Reviewed-by: Yao Zi 
    Reviewed-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20250910122000.951100-1-amadeus@jmu.edu.cn
    Signed-off-by: Vinod Koul 

commit d10736db98d25c97bdffacaca69ae0a8d7ca64e3
Author: Abel Vesa 
Date:   Tue Dec 9 15:09:45 2025 -0800

    phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms
    
    Starting with Glymur, the PCIe and DP PHYs qserdes register offsets differ
    for the same version number. So in order to be able to differentiate
    between them, add these ones with DP prefix.
    
    Add the necessary PHY setting tables for enabling the DP path within the
    QMP subsystem.  Introduced some new callbacks for v8 specific sequences,
    such as for clock configurations based on the different link speeds.
    
    Wesley Cheng added some updated settings from the hardware programming
    guides on existing PHY tables and clock settings.
    
    Co-developed-by: Wesley Cheng 
    Signed-off-by: Abel Vesa 
    Signed-off-by: Wesley Cheng 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20251209-linux-next-12825-v8-9-42133596bda0@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 5b289913959b9bc93bab9e0beeab269c33c969b7
Author: Wesley Cheng 
Date:   Tue Dec 9 15:09:44 2025 -0800

    phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings
    
    For SuperSpeed USB to work properly, there is a set of HW settings that
    need to be programmed into the USB blocks within the QMP PHY.  Ensure that
    these settings follow the latest settings mentioned in the HW programming
    guide.  The QMP USB PHY on Glymur is a USB43 based PHY that will have some
    new ways to define certain registers, such as the replacement of TXA/RXA
    and TXB/RXB register sets.  This was replaced with the LALB register set.
    
    There are also some PHY init updates to modify the PCS MISC register space.
    Without these, the QMP PHY PLL locking fails.
    
    Signed-off-by: Wesley Cheng 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20251209-linux-next-12825-v8-8-42133596bda0@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit c9543cca9417d83f8ca6a8ce0a5279a3fba7a02b
Author: Wesley Cheng 
Date:   Tue Dec 9 15:09:43 2025 -0800

    phy: qualcomm: Update the QMP clamp register for V6
    
    QMP combo phy V6 and above use the clamp register from the PCS always on
    (AON) address space.  Update the driver accordingly.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Elson Roy Serrao 
    Signed-off-by: Wesley Cheng 
    Reviewed-by: Abel Vesa 
    Link: https://patch.msgid.link/20251209-linux-next-12825-v8-7-42133596bda0@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 7dbba9fb560f35bdf1eb44035f793e3b7f2cdcdb
Author: Wesley Cheng 
Date:   Tue Dec 9 15:09:42 2025 -0800

    phy: qualcomm: qmp-usb: Add support for Glymur USB UNI PHY
    
    Glymur contains a USB multiport controller which supports a QMP UNI PHY.
    These ports do not have typeC capability, so it needs to be differentiated
    in this manner.  Update the QMP PHY sequence required to bring up the UNI
    PHY for Glymur.  The UNI PHY follows mostly the same register field
    definitions as previous SoCs.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Wesley Cheng 
    Reviewed-by: Abel Vesa 
    Link: https://patch.msgid.link/20251209-linux-next-12825-v8-6-42133596bda0@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 851dd2c9e91f2da1a60050265507a11aa24c767c
Author: Wesley Cheng 
Date:   Tue Dec 9 15:09:41 2025 -0800

    phy: qualcomm: eusb2-repeater: Add SMB2370 eUSB2 repeater support
    
    Introduce support for the SMB2370 based eUSB2 repeater.  Configure the
    proper repeater tuning settings, as if this is not done correctly, it
    can lead to instability on the USB2 link, which leads to USB2
    enumeration failures, or random disconnects.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Wesley Cheng 
    Link: https://patch.msgid.link/20251209-linux-next-12825-v8-5-42133596bda0@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 18da99126ebce8d8ebc1ee0b84fe983faa138451
Author: Wesley Cheng 
Date:   Tue Dec 9 15:09:40 2025 -0800

    dt-bindings: phy: qcom,snps-eusb2-repeater: Add SMB2370 compatible
    
    Add the compatible string for identifying a SMB2370 USB repeater device.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Wesley Cheng 
    Link: https://patch.msgid.link/20251209-linux-next-12825-v8-4-42133596bda0@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 0278bbd30f7c326740fdcbc3039ce42d7d921cf8
Author: Wesley Cheng 
Date:   Tue Dec 9 15:09:39 2025 -0800

    dt-bindings: phy: qcom-m31-eusb2: Add Glymur compatible
    
    Add the Glymur compatible to the M31 eUSB2 PHY, and use the SM8750 as
    the fallback.
    
    Signed-off-by: Wesley Cheng 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251209-linux-next-12825-v8-3-42133596bda0@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 1c0b4539fc6d7cbe352cc12deef8a21d655f9804
Author: Wesley Cheng 
Date:   Tue Dec 9 15:09:38 2025 -0800

    dt-bindings: phy: qcom,qmp-usb: Add Glymur USB UNI PHY compatible
    
    The Glymur USB subsystem contains a multiport controller, which utilizes
    two QMP UNI PHYs.  Add the proper compatible string for the Glymur SoC, and
    the required clkref clock name.
    
    Signed-off-by: Wesley Cheng 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251209-linux-next-12825-v8-2-42133596bda0@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 2fe80ea29f46332eaf76d8435326e68197bcc9bb
Author: Wesley Cheng 
Date:   Tue Dec 9 15:09:37 2025 -0800

    dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: Add Glymur compatible
    
    Define a Glymur compatible string for the QMP combo PHY, along with
    resource requirements.
    
    Signed-off-by: Wesley Cheng 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251209-linux-next-12825-v8-1-42133596bda0@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit aecea96492f52364f852248055921c1b3aacbc91
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:47 2025 +0200

    phy: lynx-28g: improve lynx_28g_probe() sequence
    
    dev_set_drvdata() is called twice, it is sufficient to do it only once.
    
    devm_of_phy_provider_register() can fail, and if it does, the
    &priv->cdr_check work item is queued, but not cancelled, and the device
    probing failed, so it will trigger use after free. This is a minor risk
    though.
    
    Resource initialization should be done a little earlier, in case we need
    to dereference dev_get_drvdata() in lynx_28g_pll_read_configuration() or
    in lynx_28g_lane_read_configuration().
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-16-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 04dceaa3c97d3cdc51e1d78dce32ed7388872d07
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:46 2025 +0200

    phy: lynx-28g: use "dev" argument more in lynx_28g_probe()
    
    We have "dev" which holds &pdev->dev, but we still dereference this
    pointer 4 more times, instead of using the local variable.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-15-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 055d08beea2c1a1d0f4eccabbcf570009969e3ce
Author: Ioana Ciornei 
Date:   Tue Nov 25 13:48:45 2025 +0200

    phy: lynx-28g: configure more equalization params for 1GbE and 10GbE
    
    While adding support for 25GbE, it was noticed that the RCCR0 and TTLCR0
    registers have different values for this protocol than the 10GbE and
    1GbE modes.
    
    Expand the lynx_28g_proto_conf[] array with the expected values for the
    currently supported protocols. These were dumped from a live system, and
    are the out-of-reset values. It will ensure that the lane is configured
    with these values when transitioning from 25GbE back into one of these
    modes.
    
    Signed-off-by: Ioana Ciornei 
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-14-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 55ce1d64aa51baecdd26d56e3efb250c9671e988
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:44 2025 +0200

    phy: lynx-28g: distinguish between 10GBASE-R and USXGMII
    
    The driver does not handle well protocol switching to or from USXGMII,
    because it conflates it with 10GBase-R.
    
    In the expected USXGMII use case, that isn't a problem, because SerDes
    protocol switching performed by the lynx-28g driver is not necessary,
    because USXGMII natively supports multiple speeds, as opposed to SFP
    modules using 1000Base-X or 10GBase-R which require switching between
    the 2.
    
    That being said, let's be explicit, and in case someone requests a
    protocol change which involves USXGMII, let's do the right thing.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-13-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 6a1ae51896284de1a2387aaf2281ac01015277b5
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:43 2025 +0200

    phy: lynx-28g: refactor lane->interface to lane->mode
    
    Lynx 28G is a multi-protocol SerDes - it handles serial Ethernet, PCIe,
    SATA.
    
    The driver should not use the phylib-specific phy_interface_t as an
    internal data representation, but something specific to its internal
    capabilities, and only convert to phy_interface_t when PHY_MODE_ETHERNET
    is selected and used.
    
    Otherwise it has no way of representing the non-Ethernet lanes (which
    was not a short-term goal when the driver was introduced, and is not a
    goal per se right now either, but should nonetheless be possible).
    
    Prefer the "enum lynx_lane_mode" name over "lynx_28g_lane_mode", in
    preparation of future Lynx 10G SerDes support. This SerDes is part of
    the same IP family and has similar capabilities, and will reuse some
    code, hence the common data type.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-12-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 444bb9a7b3ef07ecb96ca7ae30a6c9daaf865de8
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:42 2025 +0200

    phy: lynx-28g: make lynx_28g_set_lane_mode() more systematic
    
    The current approach of transitioning from one SerDes protocol to
    another in lynx_28g_set_lane_mode() is too poetic.
    
    Because the driver only supports 1GbE and 10GbE, it only modifies those
    registers which it knows are different between these two modes. However,
    that is hardly extensible for 25GbE, 40GbE, backplane modes, etc.
    
    We need something more systematic to make sure that all lane and
    protocol converter registers are written to consistent values, no matter
    what was the source lane mode.
    
    For that, we need to introduce tables with register field values, for
    each supported lane mode.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-11-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 6af3b6d365579a0b62d24e687f6d55d17f118172
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:41 2025 +0200

    phy: lynx-28g: restructure protocol configuration register accesses
    
    Eliminate the need to calculate a lane_offset manually, and generate
    some macros which access the protocol converter corresponding to the
    correct lane in the PCC* registers.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-10-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 90d985a0eb33c92aa83a086bd934d885e2f4fd5b
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:40 2025 +0200

    phy: lynx-28g: convert iowrite32() calls with magic values to macros
    
    The driver will need to become more careful with the values it writes to
    the TX and RX equalization registers. As a preliminary step, convert the
    magic numbers to macros defining the register field meanings.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-9-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 3b84377c2a31cf35d33da55c6868281aa3aff71a
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:39 2025 +0200

    phy: lynx-28g: use FIELD_GET() and FIELD_PREP()
    
    Reduce the number of bit field definitions required in this driver (in
    the worst case, a read form and a write form), by defining just the
    mask, and using the FIELD_GET() and FIELD_PREP() API from
     with that.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-8-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 6e3d3e8783ae41a7a678093591a2d93044b94ac0
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:38 2025 +0200

    phy: lynx-28g: don't concatenate lynx_28g_lane_rmw() argument "reg" with "val" and "mask"
    
    The last step in having lynx_28g_lane_rmw() arguments that fully point
    to their definitions is the removal of the current concatenation logic,
    by which e.g. "LNaTGCR0, N_RATE_QUARTER, N_RATE_MSK" is expanded to
    "LNaTGCR0, LNaTGCR0_N_RATE_QUARTER, LNaTGCR0_N_RATE_MSK".
    
    There are pros and cons to the above. An advantage is the impossibility
    to mix up fields of one register with fields of another. For example
    both LNaTGCR0 and LNaRGCR0 contain an N_RATE_QUARTER field (one for the
    lane RX direction, one for the lane TX).
    
    But the two notable disadvantages are:
    
    1. the impossibility to write expressions such as logical OR between
       multiple fields. Practically, this forces us to perform more accesses
       to hardware registers than would otherwise be needed. See the LNaGCR0
       access for example.
    
    2. the necessity to invent fields that don't exist, like SGMIIaCR1_SGPCS_DIS,
       in order to clear SGMIIaCR1_SGPCS_EN (the real field name). This is
       confusing, because sometimes, fields that end with _DIS really exist,
       and it's best to not invent new field names.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-7-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 13a5f7e3fd6dbc49adb950592ba7d76f1211105d
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:37 2025 +0200

    phy: lynx-28g: remove LYNX_28G_ prefix from register names
    
    Currently, in macros such as lynx_28g_lane_rmw(), the driver has
    macros which concatenate the LYNX_28G_ prefix with the "val" and "mask"
    arguments. This is done to shorten function calls and not have to spell
    out LYNX_28G_ everywhere.
    
    But outside of lynx_28g_lane_rmw(), lynx_28g_lane_read() and
    lynx_28g_pll_read(), this is not done, leading to an inconsistency in
    the code.
    
    Also, the concatenation itself has the disadvantage that searching the
    arguments of these functions as full words (like N_RATE_QUARTER) leads
    us nowhere, since the real macro definition is LNaTGCR0_N_RATE_QUARTER.
    
    Some maintainers want register definitions in drivers to contain the
    driver name as a prefix, but here, this has the disadvantages listed
    above, so just remove that prefix.
    
    The only change made here is the removal of LYNX_28G_.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-6-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 2da0b2214f511744a967d370447bb9d511bf1348
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:36 2025 +0200

    phy: lynx-28g: avoid memsetting lane already allocated with kzalloc()
    
    "priv" is allocated by lynx_28g_probe() using devm_kzalloc(), and the
    lane is memory inside that structure (&priv->lane[id]). We don't have to
    zero-initialize it, it is already filled with zeroes.
    
    Suggested-by: Vinod Koul 
    Link: https://lore.kernel.org/linux-phy/aRYMM3ZuyBYH8zEC@vaman/
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-5-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 7df7d58abbd60902751381dcd891a55c8228c523
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:35 2025 +0200

    phy: lynx-28g: support individual lanes as OF PHY providers
    
    Currently, the bindings of this multi-lane SerDes are such that
    consumers specify the lane index in the PHY cell, and the lane itself is
    not described in the device tree.
    
    It is desirable to describe individual Lynx 28G SerDes lanes in the
    device tree, in order to be able to customize electrical properties such
    as those in Documentation/devicetree/bindings/phy/transmit-amplitude.yaml
    (or others).
    
    If each lane may have an OF node, it appears natural for consumers to
    have their "phys" phandle point to that OF node.
    
    The problem is that transitioning between one format and another is a
    breaking change. The bindings of the 28G Lynx SerDes can themselves be
    extended in a backward-compatible way, but the consumers cannot be
    modified without breaking them.
    
    Namely, if we have:
    
    &mac {
            phys = <&serdes1 0>;
    };
    
    we cannot update the device tree to:
    
    &mac {
            phys = <&serdes1_lane_0>;
    };
    
    because old kernels cannot resolve this phandle to a valid PHY.
    
    The proposal here is to keep tolerating existing device trees, which are
    not supposed to be changed, but modify lynx_28g_xlate() to also resolve
    the new format with #phy-cells = <0> in the lanes.
    
    This way we support 3 modes:
    - Legacy device trees, no OF nodes for lanes
    - New device trees, OF nodes for lanes and "phys" phandle points towards
      them
    - Hybrid device trees, OF nodes for lanes (to describe electrical
      parameters), but "phys" phandle points towards the SerDes top-level
      provider
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-4-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit a125feee0774e13914601dd6b39c73a27265f7d4
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:34 2025 +0200

    phy: lynx-28g: refactor lane probing to lynx_28g_probe_lane()
    
    This simplifies the main control flow a little bit and makes the logic
    reusable for probing the lanes with OF nodes if those exist.
    
    Signed-off-by: Vladimir Oltean 
    Link: https://patch.msgid.link/20251125114847.804961-3-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit bd2f0117c2a1310dc6ea4eed8087eb2c6c03fe78
Author: Vladimir Oltean 
Date:   Tue Nov 25 13:48:33 2025 +0200

    dt-bindings: phy: lynx-28g: permit lane OF PHY providers
    
    Josua Mayer requested to have OF nodes for each lane, so that he
    (and other board developers) can further describe electrical parameters
    individually.
    
    For this use case, we need a container node to apply the already
    existing Documentation/devicetree/bindings/phy/transmit-amplitude.yaml,
    plus whatever other schemas might get standardized for TX equalization
    parameters, polarity inversion etc.
    
    When lane OF nodes exist, these are also PHY providers ("phys" phandles
    can point directly to them). Compare that to the existing binding, where
    the PHY provider is the top-level SerDes node, and the second cell in
    the "phys" phandle specifies the lane index.
    
    The new binding format overlaps over the old one without interfering,
    but there is a caveat:
    
    Existing device trees, which already have "phys = <&serdes1 0>" cannot
    be converted to "phys = <&serdes_1_lane_a>", because in doing so, we
    would break compatibility with old kernels which don't understand how to
    translate the latter phandle to a PHY.
    
    The transition to the new phandle format can be performed only after a
    reasonable amount of time has elapsed after this schema change and the
    corresponding driver change have been backported to stable kernels.
    
    However, the aforementioned transition is not strictly necessary, and
    the "hybrid" description (where individual lanes have their own OF node,
    but are not pointed to by the "phys" phandle) can remain for an
    indefinite amount of time, even if a little inelegant.
    
    For newly introduced device trees, where there are no compatibility
    concerns with old kernels to speak of, it is strongly recommended to use
    the "phys = <&serdes_1_lane_a>" format. The same holds for phandles
    towards lanes of LX2160A SerDes #3, which at the time of writing is not
    yet described in fsl-lx2160a.dtsi, so there is no legacy to maintain.
    
    To avoid the strange situation where we have a "phy" (SerDes node) ->
    "phy" (lane node) hierarchy, let's rename the expected name of the
    top-level node to "serdes", and update the example too. This has a
    theoretical chance of causing regressions if bootloaders search for
    hardcoded paths rather than using aliases, but to the best of my
    knowledge, for LX2160A/LX2162A this is not the case.
    
    Link: https://lore.kernel.org/lkml/02270f62-9334-400c-b7b9-7e6a44dbbfc9@solid-run.com/
    Signed-off-by: Vladimir Oltean 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251125114847.804961-2-vladimir.oltean@nxp.com
    Signed-off-by: Vinod Koul 

commit 2fdfc1bb752e393561cf532f5d54607d70e464bc
Author: Pritam Manohar Sutar 
Date:   Mon Nov 24 16:34:53 2025 +0530

    phy: exynos5-usbdrd: support SS combo phy for ExynosAutov920
    
    Update phy driver to enable SS combo phy for this SoC. New registers'
    definitions, phy ops (init/exit), and dedicated phy driver data
    structure are added for SS combo phy. Add these changes in the driver
    to support SS combo phy for this SoC.
    
    Reviewed-by: Alim Akhtar 
    Signed-off-by: Pritam Manohar Sutar 
    Link: https://patch.msgid.link/20251124110453.2887437-7-pritam.sutar@samsung.com
    Signed-off-by: Vinod Koul 

commit 05681c9c7e59c164d7e1fc34696f3130d088bc64
Author: Pritam Manohar Sutar 
Date:   Mon Nov 24 16:34:52 2025 +0530

    dt-bindings: phy: samsung,usb3-drd-phy: add ExynosAutov920 combo ssphy
    
    The USBDRD31 5nm controller consists of Synopsys USB20 femptoPhy and
    USB31 SSP+ combophy. Document support for the USB31 SSP+ phy found on
    combophy of the ExynosAutov920 SoC.
    
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Alim Akhtar 
    Signed-off-by: Pritam Manohar Sutar 
    Link: https://patch.msgid.link/20251124110453.2887437-6-pritam.sutar@samsung.com
    Signed-off-by: Vinod Koul 

commit 22a401c9a2e1e27a136088e4291bec49869cecf5
Author: Pritam Manohar Sutar 
Date:   Mon Nov 24 16:34:51 2025 +0530

    phy: exynos5-usbdrd: support HS combo phy for ExynosAutov920
    
    Support UTMI+ combo phy for this SoC, which is somewhat similar to
    what the existing Exynos850 supports. The difference is that some
    register offsets and bit fields are different from Exynos850.
    
    Add required change in phy driver to support combo HS phy for this SoC.
    
    Reviewed-by: Alim Akhtar 
    Signed-off-by: Pritam Manohar Sutar 
    Link: https://patch.msgid.link/20251124110453.2887437-5-pritam.sutar@samsung.com
    Signed-off-by: Vinod Koul 

commit fc58d4628396e4ae2791ff2396793d04940348e1
Author: Pritam Manohar Sutar 
Date:   Mon Nov 24 16:34:50 2025 +0530

    dt-bindings: phy: samsung,usb3-drd-phy: add ExynosAutov920 combo hsphy
    
    The USBDRD31 5nm controller consists of Synopsys USB2.0 femptophy and
    USBSS combophy. Add-on USB20 femptophy is required to support USB20 data
    rates along with USBSS phy. Document support for the USB2.0 femptophy
    found on combophy of the this SoC.
    
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Alim Akhtar 
    Signed-off-by: Pritam Manohar Sutar 
    Link: https://patch.msgid.link/20251124110453.2887437-4-pritam.sutar@samsung.com
    Signed-off-by: Vinod Koul 

commit 031314bd37cb6ce352b1300ffd4e07a7bebce1ef
Author: Pritam Manohar Sutar 
Date:   Mon Nov 24 16:34:49 2025 +0530

    phy: exynos5-usbdrd: support HS phy for ExynosAutov920
    
    Enable UTMI+ phy support for this SoC which is very similar to what
    the existing Exynos850 supports.
    
    Add required change in phy driver to support HS phy for this SoC.
    
    Reviewed-by: Alim Akhtar 
    Signed-off-by: Pritam Manohar Sutar 
    Link: https://patch.msgid.link/20251124110453.2887437-3-pritam.sutar@samsung.com
    Signed-off-by: Vinod Koul 

commit 28810c0dfe8aa82e6514858bdcd7a83f0848e90a
Author: Pritam Manohar Sutar 
Date:   Mon Nov 24 16:34:48 2025 +0530

    dt-bindings: phy: samsung,usb3-drd-phy: add ExynosAutov920 HS phy compatible
    
    Document support for the USB20 phy found on the ExynosAutov920 SoC. The
    USB20 phy is functionally identical to that on the Exynos850 SoC, so no
    driver changes are needed to support this phy. However, add a dedicated
    compatible string for USB20 phy found in this SoC.
    
    This phy needs 0.75v, 0.18v and 3.3v supplies for its internal
    functionally. Power Supply's names are as per phy's User Data-Book.
    These names, (dvdd, vdd18 and vdd33), are considered  for 0.75v, 1.8v
    and 3.3v respectively.
    
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Alim Akhtar 
    Signed-off-by: Pritam Manohar Sutar 
    Link: https://patch.msgid.link/20251124110453.2887437-2-pritam.sutar@samsung.com
    Signed-off-by: Vinod Koul 

commit 8e98ca1e74db2ae051c9b545d42b879efa5a2f6c
Author: Sven Peter 
Date:   Sun Dec 14 11:51:36 2025 +0000

    phy: apple: Add Apple Type-C PHY
    
    The Apple Type-C PHY (ATCPHY) is a PHY for USB 2.0, USB 3.x,
    USB4/Thunderbolt, and DisplayPort connectivity found in Apple Silicon SoCs.
    The PHY handles muxing between these different protocols and also provides
    the reset controller for the attached dwc3 USB controller.
    
    There is no documentation available for this PHY and the entire sequence
    of MMIO pokes has been figured out by tracing all MMIO access of Apple's
    driver under a thin hypervisor and correlating the register reads/writes
    to their kernel's debug output to find their names. Deviations from this
    sequence generally results in the port not working or, especially when
    the mode is switched to USB4 or Thunderbolt, to some watchdog resetting
    the entire SoC.
    
    This initial commit already introduces support for Display Port and
    USB4/Thunderbolt but the drivers for these are not ready. We cannot
    control the alternate mode negotiation and are stuck with whatever Apple's
    firmware decides such that any DisplayPort or USB4/Thunderbolt device will
    result in a correctly setup PHY but not be usable until the other drivers
    are upstreamed as well.
    
    Co-developed-by: Janne Grunau 
    Signed-off-by: Janne Grunau 
    Co-developed-by: Hector Martin 
    Signed-off-by: Hector Martin 
    Reviewed-by: Philipp Zabel  # for reset controller
    Reviewed-by: Neal Gompa 
    Signed-off-by: Sven Peter 
    Link: https://patch.msgid.link/20251214-b4-atcphy-v3-3-ba82b20e9459@kernel.org
    Signed-off-by: Vinod Koul 

commit c1538b87caef6b2783502c820457be092a7266be
Author: Sven Peter 
Date:   Sun Dec 14 11:51:35 2025 +0000

    dt-bindings: phy: Add Apple Type-C PHY
    
    Apple's Type-C PHY (ATCPHY) is a PHY for USB 2.0, USB 3.x,
    USB4/Thunderbolt, and DisplayPort connectivity found in Apple Silicon
    SoCs.
    
    The PHY handles muxing between these different protocols and also provides
    the reset controller for the attached dwc3 USB controller.
    
    Reviewed-by: Neal Gompa 
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Sven Peter 
    Link: https://patch.msgid.link/20251214-b4-atcphy-v3-2-ba82b20e9459@kernel.org
    Signed-off-by: Vinod Koul 

commit a722de305eacb382a5d306f9f8e502f81bab682d
Author: Sven Peter 
Date:   Sun Dec 14 11:51:34 2025 +0000

    soc: apple: Add hardware tunable support
    
    Various hardware, like the Type-C PHY or the Thunderbolt/USB4 NHI,
    present on Apple SoCs need machine-specific tunables passed from our
    bootloader m1n1 to the device tree. Add generic helpers so that we
    don't have to duplicate this across multiple drivers.
    
    Reviewed-by: Alyssa Rosenzweig 
    Reviewed-by: Neal Gompa 
    Reviewed-by: Janne Grunau 
    Signed-off-by: Sven Peter 
    Link: https://patch.msgid.link/20251214-b4-atcphy-v3-1-ba82b20e9459@kernel.org
    Signed-off-by: Vinod Koul 

commit 81791c45c8e0eaeba9a40927eecd082a8500f709
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:42:08 2025 +0800

    phy: qcom: qmp-usbc: Add QCS615 USB/DP PHY config and DP mode support
    
    Add QCS615-specific configuration for USB/DP PHY, including DP init
    routines, voltage swing tables, and platform data. Add compatible
    "qcs615-qmp-usb3-dp-phy".
    
    Note: SW_PORTSELECT handling for orientation flip is not implemented
    due to QCS615 fixed-orientation design and non-standard lane mapping.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-12-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit c1282d5f85857d72cf947add3f14240fd82da261
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:42:07 2025 +0800

    phy: qcom: qmp: Add DP v2 PHY register definitions
    
    Add dedicated headers for DP v2 PHY, including QSERDES COM and TX/RX
    register definitions.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-11-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 8e7670f7465d46bfa72980b310d39491a3a944d6
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:42:06 2025 +0800

    phy: qcom: qmp-usbc: Add USB/DP exclude handling
    
    When both USB and DP PHY modes are enabled simultaneously on the same
    QMP USBC PHY, it can lead to hardware misconfiguration and undefined
    behavior. This happens because the PHY resources are not designed to
    operate in both modes at the same time.
    
    To prevent this, introduce a mutual exclusion check between USB and DP
    PHY modes.
    
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-10-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit f3198fde573be23de1a8196bc5ebb0abe9c7e02f
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:42:05 2025 +0800

    phy: qcom: qmp-usbc: Add DP PHY ops for USB/DP switchable Type-C PHYs
    
    Define qmp_usbc_dp_phy_ops struct to support DP mode on USB/DP
    switchable PHYs.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-9-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 9ab26cb7e652f3cdfb3d59fb42907c0229f2a93f
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:42:04 2025 +0800

    phy: qcom: qmp-usbc: Add TCSR parsing and PHY mode setting
    
    Extend TCSR parsing to read optional dp_phy_mode_reg and add
    qmp_usbc_set_phy_mode() to switch between USB and DP modes when
    supported.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-8-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit cb2255822509c9dcdd1fad0cd167032dee7dc6c1
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:42:03 2025 +0800

    phy: qcom: qmp-usbc: Move USB-only init to usb_power_on
    
    The current implementation programs USB-specific registers in
    qmp_usbc_com_init(), which is shared by both USB and DP modes. This
    causes unnecessary configuration when the PHY is used for DP.
    
    Move USB-only register setup from com_init to qmp_usbc_usb_power_on,
    so it runs only for USB mode.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-7-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 049e708e7705534a9992b24c5090d133c8efbca6
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:42:02 2025 +0800

    phy: qcom: qmp-usbc: add DP link and vco_div clocks for DP PHY
    
    USB3DP PHY requires link and vco_div clocks when operating in DP mode.
    Extend qmp_usbc_register_clocks and the clock provider logic to register
    these clocks along with the existing pipe clock, to support both USB and
    DP configurations.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-6-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 5b2dd08459ad1f61dc7037032a5230c0efd9d797
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:42:01 2025 +0800

    phy: qcom: qmp-usbc: Move reset config into PHY cfg
    
    The original reset list only works for USB-only PHYs. USB3DP PHYs require
    different reset names such as "dp_phy", so they need a separate list.
    
    Moving reset configuration into qmp_phy_cfg allows per-PHY customization
    without adding special-case logic in DT parsing. The legacy DT path keeps
    using the old hardcoded list, while non-legacy paths use cfg->reset_list.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-5-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 3b19374825676e0b548b808772f5ecbe8af4f9da
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:42:00 2025 +0800

    phy: qcom: qmp-usbc: Add regulator init_load support
    
    QMP USBC PHY drivers previously did not set init_load_uA for regulators,
    which could result in incorrect vote levels. This patch introduces
    regulator definitions with proper init_load_uA values based on each
    chip's power grid design.
    
    QCS615 USB3 PHY was previously reusing qcm2290_usb3phy_cfg, but its
    regulator requirements differ. A new qcs615_usb3phy_cfg is added to
    reflect the correct settings.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-4-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 0599a4b9ee13b10820fa71f058bef8cc6f06b0b6
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:41:59 2025 +0800

    phy: qcom: qmp-usbc: Add DP-related fields for USB/DP switchable PHY
    
    Extend qmp_usbc_offsets and qmp_phy_cfg with DP-specific fields,
    including register offsets, init tables, and callback hooks. Also
    update qmp_usbc struct to track DP-related resources and state.
    This enables support for USB/DP switchable Type-C PHYs that operate
    in either mode.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-3-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 9f5f6083b3bd74c7d25737241e32821adb294e14
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:41:58 2025 +0800

    phy: qcom: qmp-usbc: Rename USB-specific ops to prepare for DP support
    
    To support following DisplayPort (DP) mode over the Type-C PHY, rename
    USB-specific functions and ops to clearly separate them from common or
    DP-related logic.
    
    This is a preparatory cleanup to enable USB + DP dual mode.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-2-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 70f12a4cc6a04869b2185be999e3849a6c17439f
Author: Xiangxu Yin 
Date:   Mon Dec 15 20:41:57 2025 +0800

    dt-bindings: phy: Add QMP USB3+DP PHY for QCS615
    
    Add device tree binding documentation for the Qualcomm QMP USB3+DP PHY
    on QCS615 Platform. This PHY supports both USB3 and DP functionality
    over USB-C, with PHY mode switching capability. It does not support
    combo mode.
    
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Xiangxu Yin 
    Link: https://patch.msgid.link/20251215-add-displayport-support-for-qcs615-platform-v8-1-cbc72c88a44e@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 434e1a0ee145d0389b192252be4c993f86cf1134
Author: Thomas Richard (TI.com) 
Date:   Tue Dec 16 15:24:25 2025 +0100

    phy: cadence-torrent: restore parent clock for refclk during resume
    
    While suspend and resume, parent clock config for refclk was getting lost.
    So save and restore it in suspend and resume operations.
    
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Thomas Richard (TI.com) 
    Link: https://patch.msgid.link/20251216-phy-cadence-torrent-resume-restore-refclk-parent-v3-1-8a7ed84b47e3@bootlin.com
    Signed-off-by: Vinod Koul 

commit 53f6240e88c9e8715e09fc19942f13450db4cb33
Author: Thomas Richard (TI.com) 
Date:   Tue Dec 16 15:26:20 2025 +0100

    phy: ti: phy-j721e-wiz: restore mux selection during resume
    
    While suspend and resume mux selection was getting lost. So save and
    restore these values in suspend and resume operations.
    
    Signed-off-by: Thomas Richard (TI.com) 
    Link: https://patch.msgid.link/20251216-phy-ti-phy-j721e-wiz-resume-restore-mux-sel-v1-1-771d564db966@bootlin.com
    Signed-off-by: Vinod Koul 

commit 5442f9fd8814932e42602670bd013fcbc10a6906
Author: Lad Prabhakar 
Date:   Tue Dec 9 16:21:19 2025 +0000

    dt-bindings: phy: ti,tcan104x-can: Document TI TCAN1046
    
    Document the TI TCAN1046 automotive CAN transceiver. The TCAN1046 is a
    dual high-speed CAN transceiver with sleep-mode support and no EN pin,
    mirroring the behaviour of the NXP TJA1048, which also provides dual
    channels and STB1/2 sleep-control lines.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Marc Kleine-Budde 
    Acked-by: Conor Dooley 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251209162119.2038313-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Vinod Koul 

commit 346ba84646355d651bb301f66137ad4418381a8e
Author: Faisal Hassan 
Date:   Fri Sep 5 15:42:43 2025 +0530

    phy: qcom-qmp-usb: Set regulator load before enabling
    
    Set the regulator load before enabling the regulators to ensure stable
    operation and proper power management on platforms where regulators are
    shared between the QMP USB PHY and other IP blocks.
    
    Introduce a regulator data structure with explicit enable load values and
    use the regulator framework's `init_load_uA` field along with
    `devm_regulator_bulk_get_const()` to ensure that `regulator_set_load()` is
    applied automatically before the first enable, providing consistent power
    management behavior across platforms.
    
    Signed-off-by: Faisal Hassan 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20250905101243.14815-1-faisal.hassan@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit e5b4d5935f758c6d685c624343d7615d76bdc931
Author: Qiang Yu 
Date:   Mon Nov 24 02:24:38 2025 -0800

    phy: qcom: qmp-pcie: add QMP PCIe PHY tables for Kaanapali
    
    Add QMP PCIe PHY support for the Kaanapali platform.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Abel Vesa 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Qiang Yu 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20251124-kaanapali-pcie-phy-v4-5-d04ee9cca83b@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit ba13ff85d3cfb92bd0502a8f93366ddbb5d91105
Author: Qiang Yu 
Date:   Mon Nov 24 02:24:37 2025 -0800

    phy: qcom-qmp: qserdes-com: Add some more v8 register offsets
    
    Some qserdes-com register offsets for the v8 PHY were previously omitted,
    as they were not needed by earlier v8 PHY initialization sequences. Add
    these missing v8 register offsets now required to support PCIe QMP PHY on
    Kaanapali platform.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Qiang Yu 
    Link: https://patch.msgid.link/20251124-kaanapali-pcie-phy-v4-4-d04ee9cca83b@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit ecc12453c8b1aabdedcd663b7e0587f372a2a90d
Author: Qiang Yu 
Date:   Mon Nov 24 02:24:36 2025 -0800

    phy: qcom-qmp: pcs-pcie: Add v8 register offsets
    
    Kaanapali SoC uses QMP phy with version v8 for PCIe Gen3 x2. Add the new
    PCS PCIE specific offsets in a dedicated header file.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Qiang Yu 
    Link: https://patch.msgid.link/20251124-kaanapali-pcie-phy-v4-3-d04ee9cca83b@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 5359da47e066edb3fcd36c7349726913ee8628f2
Author: Qiang Yu 
Date:   Mon Nov 24 02:24:35 2025 -0800

    phy: qcom-qmp: qserdes-txrx: Add complete QMP PCIe PHY v8 register offsets
    
    Kaanapali SoC uses QMP PHY with version v8 for PCIe Gen3 x2, but requires
    a completely unique qserdes-txrx register offsets compared to existing v8
    offsets.
    
    Hence, add a dedicated header file containing the FULL SET of qserdes-txrx
    register definitions required for Kaanapali's PCIe PHY operation.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Qiang Yu 
    Link: https://patch.msgid.link/20251124-kaanapali-pcie-phy-v4-2-d04ee9cca83b@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 4968df19d5dcb22fa2b797b64eb3c2880a239e12
Author: Qiang Yu 
Date:   Mon Nov 24 02:24:34 2025 -0800

    dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Add Kaanapali compatible
    
    Document compatible for the QMP PCIe PHY on Kaanapali platform.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Qiang Yu 
    Link: https://patch.msgid.link/20251124-kaanapali-pcie-phy-v4-1-d04ee9cca83b@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 57e920b92724dd568526990c04e79ed54241c5fc
Author: Alex Elder 
Date:   Thu Dec 18 09:12:29 2025 -0600

    phy: spacemit: Introduce PCIe/combo PHY
    
    Introduce a driver that supports three PHYs found on the SpacemiT
    K1 SoC.  The first PHY is a combo PHY that can be configured for
    use for either USB 3 or PCIe.  The other two PHYs support PCIe
    only.
    
    All three PHYs must be programmed with an 8 bit receiver termination
    value, which must be determined dynamically.  Only the combo PHY is
    able to determine this value.  The combo PHY performs a special
    calibration step at probe time to discover this, and that value is
    used to program each PHY that operates in PCIe mode.  The combo
    PHY must therefore be probed before either of the PCIe-only PHYs
    will be used.
    
    Each PHY has an internal PLL driven from an external oscillator.
    This PLL started when the PHY is first initialized, and stays
    on thereafter.
    
    During normal operation, the USB or PCIe driver using the PHY must
    ensure (other) clocks and resets are set up properly.
    
    However PCIe mode clocks are enabled and resets are de-asserted
    temporarily by this driver to perform the calibration step on the
    combo PHY.
    
    Tested-by: Junzhong Pan 
    Signed-off-by: Alex Elder 
    Reviewed-by: Neil Armstrong 
    Link: https://lore.kernel.org/all/ba532f8d-a452-40e5-af46-b58b89f70a92@linaro.org/ [1]
    Tested-by: Yixun Lan 
    Link: https://patch.msgid.link/20251218151235.454997-4-elder@riscstar.com
    Signed-off-by: Vinod Koul 

commit 326a278a3682d390269699f68e597b5ef5a57d26
Author: Alex Elder 
Date:   Thu Dec 18 09:12:28 2025 -0600

    dt-bindings: phy: spacemit: Introduce PCIe PHY
    
    Add the Device Tree binding for two PCIe PHYs present on the SpacemiT
    K1 SoC.  These PHYs are dependent on a separate combo PHY, which
    determines at probe time the calibration values used by the PCIe-only
    PHYs.
    
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Alex Elder 
    Link: https://lore.kernel.org/all/ba532f8d-a452-40e5-af46-b58b89f70a92@linaro.org/ [1]
    Tested-by: Yixun Lan 
    Link: https://patch.msgid.link/20251218151235.454997-3-elder@riscstar.com
    Signed-off-by: Vinod Koul 

commit f6194de7df023ecfd5156caf8e2762487be07ef7
Author: Alex Elder 
Date:   Thu Dec 18 09:12:27 2025 -0600

    dt-bindings: phy: spacemit: Add SpacemiT PCIe/combo PHY
    
    Add the Device Tree binding for the PCIe/USB 3.0 combo PHY found in
    the SpacemiT K1 SoC.  This is one of three PCIe PHYs, and is unusual
    in that only the combo PHY can perform a calibration step needed to
    determine settings used by the other two PCIe PHYs.
    
    Calibration must be done with the combo PHY in PCIe mode, and to allow
    this to occur independent of the eventual use for the PHY (PCIe or USB)
    some PCIe-related properties must be supplied: clocks; resets; and a
    syscon phandle.
    
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Alex Elder 
    Link: https://lore.kernel.org/all/ba532f8d-a452-40e5-af46-b58b89f70a92@linaro.org/ [1]
    Tested-by: Yixun Lan 
    Link: https://patch.msgid.link/20251218151235.454997-2-elder@riscstar.com
    Signed-off-by: Vinod Koul 

commit ff89cea2385b6236790f3be2727d9ae527daf4a0
Author: Nícolas F. R. A. Prado 
Date:   Wed Dec 17 11:19:02 2025 +0100

    dt-bindings: phy: mediatek,hdmi-phy: Document extra clocks for MT8195
    
    MT8195's HDMI PHY block has 4 clocks instead of just a single one.
    Describe the extra clocks for it.
    
    Signed-off-by: Nícolas F. R. A. Prado 
    [Louis-Alexis Eyraud: addressed feedback from mailing list]
    Signed-off-by: Louis-Alexis Eyraud 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-mtk-genio-evk-hdmi-support-v2-3-a994976bb39a@collabora.com
    Signed-off-by: Vinod Koul 

commit 6226f616c8e9ac30c294b86ff59e3a9566e2a8d0
Author: Louis-Alexis Eyraud 
Date:   Wed Dec 17 11:19:01 2025 +0100

    dt-bindings: phy: mediatek,hdmi-phy: Add support for MT8188 SoC
    
    Add compatible string for the HDMI PHY IP on MT8188 SoC, that is
    compatible with the one found on MT8195 SoC.
    
    Signed-off-by: Louis-Alexis Eyraud 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251217-mtk-genio-evk-hdmi-support-v2-2-a994976bb39a@collabora.com
    Signed-off-by: Vinod Koul 

commit 65790df6dcd2f41fab2288ed3d2c3bca00d8dfd4
Author: AngeloGioacchino Del Regno 
Date:   Wed Dec 17 11:19:00 2025 +0100

    dt-bindings: phy: mediatek,hdmi-phy: Fix clock output names for MT8195
    
    For all of the HDMI PHYs compatible with the one found on MT8195
    the output clock has a different datasheet name and specifically
    it is called "hdmi_txpll", differently from the older HDMI PHYs
    which output block is called "hdmitx_dig_cts".
    
    Replace clock output name string check by max item number one to allow
    the new name on all of the HDMI PHY IPs that are perfectly compatible
    with MT8195.
    
    [Louis-Alexis Eyraud: split patch, addressed previous feedback from
    mailing list, and reworded description]
    
    Fixes: c78fe548b062 ("dt-bindings: phy: mediatek: hdmi-phy: Add mt8195 compatible")
    Signed-off-by: AngeloGioacchino Del Regno 
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Louis-Alexis Eyraud 
    Link: https://patch.msgid.link/20251217-mtk-genio-evk-hdmi-support-v2-1-a994976bb39a@collabora.com
    Signed-off-by: Vinod Koul 

commit 3be8131ee936abb6ff56ca9ec9d38c911251410b
Author: Cristian Ciocaltea 
Date:   Sun Dec 21 12:36:24 2025 +0200

    phy: rockchip: samsung-hdptx: Cleanup TMDS PLL config table
    
    Drop a bunch of unused members from struct ropll_config and make the
    static ropll_tmds_cfg table more readable:
    
    * add a table header
    * sort rows by rate
    * convert hex values to decimal (for consistency)
    
    Signed-off-by: Cristian Ciocaltea 
    Link: https://patch.msgid.link/20251221-phy-hdptx-pll-fix-v2-2-ae4abf7f75a1@collabora.com
    Signed-off-by: Vinod Koul 

commit f2daf0c67a1767ff6536aa3e96599afb42ca42e7
Author: Cristian Ciocaltea 
Date:   Sun Dec 21 12:36:23 2025 +0200

    phy: rockchip: samsung-hdptx: Pre-compute HDMI PLL config for 461.10125 MHz output
    
    Attempting to make use of a 1080p@120Hz display mode with 10 bpc RGB on
    my Acer XV275K P3 monitor results in a blank image.  A similar behavior
    has been reported on Philips 279M1RV.
    
    The faulty modeline is created by drm_gtf_mode_complex() based on the
    following EDID entry from the Standard Timings block:
    
      GTF:  1920x1080  119.999987 Hz  16:9    138.840 kHz    368.759000 MHz
    
    It's worth noting the computed pixel clock ends up being slightly higher
    at 368.881000 MHz.  Nevertheless, this seems to work consistently fine
    with 8 bpc RGB.
    
    After switching to 10 bpc, the TMDS character rate expected for the mode
    increases to 461.101250 MHz, as per drm_hdmi_compute_mode_clock().
    
    Since there is no entry for this rate in the ropll_tmds_cfg table, the
    necessary HDMI PLL configuration parameters are calculated dynamically
    by rk_hdptx_phy_clk_pll_calc().  However, the resulting output rate is
    not quite a perfect match, i.e. 461.100000 MHz.  That proved to be the
    actual root cause of the problem.
    
    Add a new entry to the TMDS configuration table and provide the
    necessary frequency division coefficients for the PHY PLL to generate
    the expected 461.101250 MHz output.
    
    Fixes: 9d0ec51d7c22 ("phy: rockchip: samsung-hdptx: Add high color depth management")
    Tested-by: Derek Foreman 
    Signed-off-by: Cristian Ciocaltea 
    Link: https://patch.msgid.link/20251221-phy-hdptx-pll-fix-v2-1-ae4abf7f75a1@collabora.com
    Signed-off-by: Vinod Koul 

commit c9d03933ea161a5543e15857ee519c60ec04fe9b
Author: Xu Yang 
Date:   Fri Dec 19 16:13:54 2025 +0800

    phy: fsl-imx8mq-usb: change ssc_range value for i.MX8MQ
    
    According to IC engineer suggestion, set ssc_range as -4003 ppm
    will have more tolerance for EMI, and suitable for more boards.
    Besides, it's confirmed that with this setting the TX SSC test
    will pass on one customer board.
    
    Signed-off-by: Li Jun 
    Signed-off-by: Xu Yang 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251219081354.3806806-1-xu.yang_2@nxp.com
    Signed-off-by: Vinod Koul 

commit caad07ae07e3fb173e804abdd53fb96aa7186830
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:22:48 2025 +0100

    phy: core: Discard pm_runtime_put() return values
    
    The PHY core defines phy_pm_runtime_put() to return an int, but that
    return value is never used.  It also passes the return value of
    pm_runtime_put() to the caller which is not very useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.
    
    Modify phy_pm_runtime_put() to discard the pm_runtime_put() return
    value and change its return type to void.  Also drop the redundant
    pm_runtime_enabled() call from there.
    
    No intentional functional impact.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2556645.jE0xQCEvom@rafael.j.wysocki
    Signed-off-by: Vinod Koul 

commit 455bf7d9256495e09fd3fd4a4e8a41e727f1043b
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:21:30 2025 +0100

    phy: rockchip-samsung-dcphy: Discard pm_runtime_put() return value
    
    Passing pm_runtime_put() return value to the callers is not particularly
    useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.  It also happens when the kernel is
    configured with CONFIG_PM unset.
    
    Accordingly, update samsung_mipi_dcphy_exit() to simply discard the
    return value of pm_runtime_put() and always return success to the
    caller.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2281919.Icojqenx9y@rafael.j.wysocki
    Signed-off-by: Vinod Koul 

commit 8bb108e4f6747dcea590710c4b6f95eebf4a04d6
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:18:46 2025 +0100

    phy: freescale: Discard pm_runtime_put() return value
    
    Printing error messages on pm_runtime_put() returning negative values
    is not particularly useful.
    
    Returning an error code from pm_runtime_put() merely means that it has
    not queued up a work item to check whether or not the device can be
    suspended and there are many perfectly valid situations in which that
    can happen, like after writing "on" to the devices' runtime PM "control"
    attribute in sysfs for one example.
    
    Accordingly, update mixel_lvds_phy_reset() to simply discard the return
    value of pm_runtime_put().
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/2012926.taCxCBeP46@rafael.j.wysocki
    Signed-off-by: Vinod Koul 

commit 8a203b0571d0a28e227dff7ab81e64cd7aa18e17
Author: Lad Prabhakar 
Date:   Mon Dec 22 16:18:46 2025 +0000

    dt-bindings: phy: renesas,rzg3e-usb3-phy: Add RZ/V2H(P) and RZ/V2N support
    
    Add compatibles for the USB3.0 PHY used in the RZ/V2H(P) and RZ/V2N SoCs.
    These SoCs integrate the same USB3 PHY IP block as the RZ/G3E, so the
    RZ/G3E compatible is used as a fallback for both.
    
    Signed-off-by: Lad Prabhakar 
    Acked-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251222161846.152952-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Vinod Koul 

commit d9239fdc14bcf69fd153ca5daae22c12bd3f8164
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:26:36 2025 +0100

    ACPI: bus: Rework the handling of \_SB._OSC USB4 features
    
    Use acpi_osc_handshake() introduced previously for implementing the
    \_SB._OSC USB4 features control negotiation.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/3879947.MHq7AAxBmi@rafael.j.wysocki

commit 6485059361923236735f763af3fc9cbb909fc6dd
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:23:29 2025 +0100

    ACPI: bus: Adjust feature mask creation for \_SB._OSC
    
    The feature mask creation for \_SB._OSC is messy and hard to follow,
    so clean it up and make all of the CPPC-related features depend on
    CONFIG_ACPI_CPPC_LIB as they will not work if it is not set anyway.
    
    Also make acpi_bus_osc_negotiate_platform_control() print a message
    including a bit mask representig the features for which control has
    been granted.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/4495088.ejJDZkT8p0@rafael.j.wysocki

commit e5322888e6bf4ec17964a93638c9b14433a2f6f1
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:21:19 2025 +0100

    ACPI: bus: Rework the handling of \_SB._OSC platform features
    
    Both acpi_bus_osc_negotiate_platform_control() and
    acpi_bus_osc_negotiate_usb_control() first call acpi_run_osc() to
    evaluate _OSC in "query mode", with OSC_QUERY_ENABLE set in the
    capabilities buffer, and then use the resultant feature mask as
    the input buffer for requesting control of those features by
    calling acpi_run_osc() to evaluate _OSC with OSC_QUERY_ENABLE clear.
    
    This involves some code duplication and unnecessary memory
    allocations, so introduce a new helper function carrying out an
    _OSC handshake along the lines of the above description in a simpler
    way and update acpi_bus_osc_negotiate_platform_control() to use it.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/1966378.CQOukoFCf9@rafael.j.wysocki

commit 5ada805104d4fd89504206216f297c112382bfd1
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:18:40 2025 +0100

    ACPI: bus: Rename label and use ACPI_FREE() in acpi_run_osc()
    
    Use ACPI_FREE() for freeing an object coming from acpi_eval_osc()
    and rename the "out_free" to "out" because it does not involve
    kfree() any more.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/8682086.NyiUUSuA9g@rafael.j.wysocki

commit d179ae1f06ae1b3c328013f7224ab9ebfd210640
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:17:29 2025 +0100

    ACPI: bus: Split _OSC error processing out of acpi_run_osc()
    
    Split a function for processing _OSC errors called acpi_osc_error_check()
    out of acpi_run_osc() to facilitate subsequent changes.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/6135328.MhkbZ0Pkbq@rafael.j.wysocki

commit 7d703df7f4f5646d9d9f866a930843f838c9979b
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:14:16 2025 +0100

    ACPI: bus: Split _OSC evaluation out of acpi_run_osc()
    
    Split a function for evaluating _OSC called acpi_eval_osc() out of
    acpi_run_osc() to facilitate subsequent changes and add some more
    parameters sanity checks to the latter.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/22963770.EfDdHjke4D@rafael.j.wysocki

commit 06bf78f82f45514416b1d2193f7a45b6c6c1995e
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:11:08 2025 +0100

    ACPI: bus: Rework printing debug messages on _OSC errors
    
    Instead of using one function, acpi_print_osc_error(), for printing a
    debug message and dumping the _OSC request data in one go, use
    acpi_handle_debug() directly for printing messages and a separate
    function called acpi_dump_osc_data() for dumping the _OSC request data
    before printing one or more of them.
    
    This avoids
     * dumping _OSC request data multiple times when there are
       multiple error bits set in the return buffer,
     * wrapping message lines on terminals with 80 character line width,
     * mixing up unrelated messages by printing full lines only,
    and generally helps to make the messages easier to parse.
    
    Also, use %pUL for UUID printing instead of printing UUIDs as strings
    and include the revision number into the dumped _OSC request data.
    
    This is how the debug printout looks like when the
    OSC_REQUEST_ERROR and OSC_INVALID_REVISION_ERROR bits
    are set in the return buffer before the change:
    
     ACPI: \_SB_: ACPI: (0811B06E-4A27-44F9-8D60-3CBBC22E7B48): _OSC request failed
     ACPI: _OSC request data:
     ACPI:  1
     ACPI:  2e7eff
     ACPI:
     ACPI: \_SB_: ACPI: (0811B06E-4A27-44F9-8D60-3CBBC22E7B48): _OSC invalid revision
     ACPI: _OSC request data:
     ACPI:  1
     ACPI:  2e7eff
     ACPI:
    
    and this is how it is going to look like afterward:
    
     ACPI: \_SB_: ACPI: _OSC: UUID: 0811B06E-4A27-44F9-8D60-3CBBC22E7B48, rev: 1
     ACPI: \_SB_: ACPI: _OSC: capabilities DWORD 0: [00000001]
     ACPI: \_SB_: ACPI: _OSC: capabilities DWORD 1: [002e7eff]
     ACPI: \_SB_: ACPI: _OSC: request failed
     ACPI: \_SB_: ACPI: _OSC: invalid revision
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    Link: https://patch.msgid.link/10794028.nUPlyArG6x@rafael.j.wysocki

commit bb203a649c26bbcb39c1d93d020cad77e87c518e
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 20:05:44 2025 +0100

    ACPI: bus: Fix handling of _OSC errors in acpi_run_osc()
    
    The handling of _OSC errors in acpi_run_osc() is inconsistent and
    arguably not compliant with the _OSC definition (cf. Section 6.2.12 of
    ACPI 6.6 [1]).
    
    Namely, if OSC_QUERY_ENABLE is not set in the capabilities buffer and
    any of the error bits are set in the _OSC return buffer, acpi_run_osc()
    returns an error code and the _OSC return buffer is discarded.  However,
    in that case, depending on what error bits are set, the return buffer
    may contain acknowledged bits for features that need to be controlled by
    the kernel going forward.
    
    If the OSC_INVALID_UUID_ERROR bit is set, the request could not be
    processed at all and so in that particular case discarding the _OSC
    return buffer and returning an error is the right thing to do regardless
    of whether or not OSC_QUERY_ENABLE is set in the capabilities buffer.
    
    If OSC_QUERY_ENABLE is set in the capabilities buffer and the
    OSC_REQUEST_ERROR or OSC_INVALID_REVISION_ERROR bits are set in the
    return buffer, acpi_run_osc() may return an error and discard the _OSC
    return buffer because in that case the platform configuration does not
    change.  However, if any of them is set in the return buffer when
    OSC_QUERY_ENABLE is not set in the capabilities buffer, the feature
    mask in the _OSC return buffer still represents a set of acknowleded
    features as per the _OSC definition:
    
     The platform acknowledges the Capabilities Buffer by returning a
     buffer of DWORDs of the same length. Set bits indicate acknowledgment
     that OSPM may take control of the capability and cleared bits indicate
     that the platform either does not support the capability or that OSPM
     may not assume control.
    
    which is not conditional on the error bits being clear, so in that case,
    discarding the _OSC return buffer is questionable.  There is also no
    reason to return an error and discard the _OSC return buffer if the
    OSC_CAPABILITIES_MASK_ERROR bit is set in it, but printing diagnostic
    messages is appropriate when that happens with OSC_QUERY_ENABLE clear
    in the capabilities buffer.
    
    Adress this issue by making acpi_run_osc() follow the rules outlined
    above.
    
    Moreover, make acpi_run_osc() only take the defined _OSC error bits into
    account when checking _OSC errors.
    
    Link: https://uefi.org/specs/ACPI/6.6/06_Device_Configuration.html#osc-operating-system-capabilities [1]
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Jonathan Cameron 
    [ rjw: Corrected typo in the changelog ]
    Link: https://patch.msgid.link/3042649.e9J7NaK4W3@rafael.j.wysocki
    Signed-off-by: Rafael J. Wysocki 

commit e5c2061442dda716fb08cc4eff485220c94e6475
Author: Jacky Chou 
Date:   Tue Dec 16 09:50:06 2025 +0800

    MAINTAINERS: Add ASPEED PCIe RC driver
    
    Add maintainer entry for ASPEED PCIe RC driver.
    
    Signed-off-by: Jacky Chou 
    [mani: removed PHY entries]
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251216-upstream_pcie_rc-v7-7-4aeb0f53c4ce@aspeedtech.com

commit 9aa0cb68fcc16280c8c8bdd22dc770af8dd7349f
Author: Jacky Chou 
Date:   Tue Dec 16 09:50:05 2025 +0800

    PCI: aspeed: Add ASPEED PCIe RC driver
    
    Introduce PCIe Root Complex driver for ASPEED SoCs. Support RC
    initialization, reset, clock, IRQ domain, and MSI domain setup. Implement
    platform-specific setup and register configuration for ASPEED. And provide
    PCI config space read/write and INTx/MSI interrupt handling.
    
    Signed-off-by: Jacky Chou 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251216-upstream_pcie_rc-v7-6-4aeb0f53c4ce@aspeedtech.com

commit 73ce5ba701a53ad89c623a641401288844f526ac
Author: Jacky Chou 
Date:   Tue Dec 16 09:50:04 2025 +0800

    PCI: Add FMT, TYPE and CPL status definition for TLP header
    
    According to PCIe specification, add FMT, TYPE and CPL status
    definition for TLP header.
    
    Signed-off-by: Jacky Chou 
    Signed-off-by: Manivannan Sadhasivam 
    Acked-by: Bjorn Helgaas 
    Link: https://patch.msgid.link/20251216-upstream_pcie_rc-v7-5-4aeb0f53c4ce@aspeedtech.com

commit a20df1a7683d6c1416c0f56fb737554b9abe9959
Author: Jacky Chou 
Date:   Tue Dec 16 09:50:01 2025 +0800

    dt-bindings: PCI: Add ASPEED PCIe RC support
    
    ASPEED AST2600 provides one PCIe RC with 5GT/s and AST2700 provides three
    PCIe RC for two 16GT/s and one 5GT/s. All of these RCs have just one Root
    Port to connect to PCIe device. And also have Mem, I/O access, legacy
    interrupt and MSI.
    
    Signed-off-by: Jacky Chou 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251216-upstream_pcie_rc-v7-2-4aeb0f53c4ce@aspeedtech.com

commit bd14ba160bbe863e7b7bc489fd947ae1cdc03047
Author: Chen-Yu Tsai 
Date:   Sun Dec 21 19:05:11 2025 +0800

    arm64: dts: allwinner: t527: orangepi-4a: Enable SPI-NOR flash
    
    The Orangepi 4A has a SPI-NOR flash connected to spi0 on the PC pins.
    The HOLD and WP pins are not connected, and are instead pulled up by the
    supply rail.
    
    Enable spi0 and add a device node for the SPI-NOR flash.
    
    Acked-by: Jernej Skrabec 
    Link: https://patch.msgid.link/20251221110513.1850535-5-wens@kernel.org
    Signed-off-by: Chen-Yu Tsai 

commit 1bec3bd1f839f269dfdec3c635dd2afe15e30995
Author: Chen-Yu Tsai 
Date:   Sun Dec 21 19:05:10 2025 +0800

    arm64: dts: allwinner: sun55i: Add SPI controllers
    
    The A523 family SoCs have four SPI controllers. One of them also
    supports DBI mode.
    
    Add device nodes for all of them. Also add pinmux nodes for spi0 on the
    PC pins, which is commonly used for SPI-NOR boot flash.
    
    Acked-by: Jernej Skrabec 
    Link: https://patch.msgid.link/20251221110513.1850535-4-wens@kernel.org
    Signed-off-by: Chen-Yu Tsai 

commit e67870321a6af82c66fc41422d5c7af49e8a0234
Author: Calvin Owens 
Date:   Mon Dec 22 11:54:42 2025 -0500

    drm/xe: Don't use absolute path in generated header comment
    
    Building the XE driver through Yocto throws this QA warning:
    
        WARNING: mc:house:linux-stable-6.17-r0 do_package_qa: QA Issue: File /usr/src/debug/linux-stable/6.17/drivers/gpu/drm/xe/generated/xe_device_wa_oob.h in package linux-stable-src contains reference to TMPDIR [buildpaths]
        WARNING: mc:house:linux-stable-6.17-r0 do_package_qa: QA Issue: File /usr/src/debug/linux-stable/6.17/drivers/gpu/drm/xe/generated/xe_wa_oob.h in package linux-stable-src contains reference to TMPDIR [buildpaths]
    
    ...because the comment at the top of the generated header contains the
    absolute path to the rules file at build time:
    
        * This file was generated from rules: /home/calvinow/git/meta-house/build/tmp-house/work-shared/nuc14rvhu7/kernel-source/drivers/gpu/drm/xe/xe_device_wa_oob.rules
    
    Fix this minor annoyance by putting the basename of the rules file in
    the generated comment instead of the absolute path, so the generated
    header contents no longer depend on the location of the kernel source.
    
    Signed-off-by: Calvin Owens 
    Link: https://patch.msgid.link/20251222165441.516102-2-rodrigo.vivi@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 15e096960a7fe6b0163d0f35d908cc08d4ca83e8
Author: Francois Dugast 
Date:   Tue Dec 23 12:53:27 2025 +0100

    drm/xe/migrate: Configure migration queue as low latency
    
    Commit 5488bec96bcc ("drm/xe/uapi: Use hint for guc to set GT frequency")
    introduced low latency hint for use by user space when creating an exec
    queue. This instructs SLPC to ramp the GT frequency aggressively.
    
    SVM relies on an internal exec queue to migrate memory upon page faults.
    This change creates this exec queue with the low latency hint to speed up
    migration.
    
    This should not impact systems where GT frequency is set over sysfs, or
    with long running workloads which give enough time for the frequency to
    ramp up. An example of memory access pattern that shows an improvement of
    SVM performance is running hundreds of times IGT eu-fault-2m-once-device
    in xe_exec_system_allocator. The copy duration provided by GT stats in
    svm_2M_device_copy_us shows per GPU page fault:
        ~ 165 μs without low latency hint
        ~ 130 μs with low latency hint
    
    Suggested-by: Matthew Brost 
    Cc: Rodrigo Vivi 
    Reviewed-by: Rodrigo Vivi 
    Signed-off-by: Francois Dugast 
    Link: https://patch.msgid.link/20251223115327.49555-1-francois.dugast@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 8995a37371bf489ede768271aac56e4e6a55bcb2
Author: Roy Luo 
Date:   Thu Dec 18 19:23:11 2025 +0000

    usb: dwc3: Add Google Tensor SoC DWC3 glue driver
    
    Add support for the DWC3 USB controller found on Google Tensor G5
    (codename: laguna). The controller features dual-role functionality
    and hibernation.
    
    The primary focus is implementing hibernation support in host mode,
    enabling the controller to enter a low-power state (D3). This is
    particularly relevant during system power state transition and
    runtime power management for power efficiency.
    Highlights:
    - Align suspend callback with dwc3_suspend_common() for deciding
      between a full teardown and hibernation in host mode.
    - Integration with `psw` (power switchable) and `top` power domains,
      managing their states and device links to support hibernation.
    - A notifier callback dwc3_google_usb_psw_pd_notifier() for
      `psw` power domain events to manage controller state
      transitions to/from D3.
    - Coordination of the `non_sticky` reset during power state
      transitions, asserting it on D3 entry and deasserting on D0 entry
      in hibernation scenario.
    - Handling of high-speed and super-speed PME interrupts
      that are generated by remote wakeup during hibernation.
    
    Co-developed-by: Joy Chakraborty 
    Signed-off-by: Joy Chakraborty 
    Co-developed-by: Naveen Kumar 
    Signed-off-by: Naveen Kumar 
    Reviewed-by: Peter Griffin 
    Signed-off-by: Roy Luo 
    Acked-by: Thinh Nguyen 
    Link: https://patch.msgid.link/20251218-controller-v10-2-4047c9077274@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit 32bc790a8e495c5c22755644c3e26a7aee03f91f
Author: Roy Luo 
Date:   Thu Dec 18 19:23:10 2025 +0000

    dt-bindings: usb: dwc3: Add Google Tensor G5 DWC3
    
    Document the device tree bindings for the DWC3 USB controller found in
    Google Tensor SoCs, starting with the G5 generation (codename: laguna).
    
    The Tensor G5 silicon represents a complete architectural departure from
    previous generations (like gs101), including entirely new clock/reset
    schemes, top-level wrapper and register interface. Consequently,
    existing Samsung/Exynos DWC3 USB bindings are incompatible, necessitating
    this new device tree binding.
    
    The USB controller on Tensor G5 is based on Synopsys DWC3 IP and features
    Dual-Role Device single port with hibernation support.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Roy Luo 
    Link: https://patch.msgid.link/20251218-controller-v10-1-4047c9077274@google.com
    Signed-off-by: Greg Kroah-Hartman 

commit e715bc42e337b6f54ada7262e1bbc0b7860525c2
Author: Christophe JAILLET 
Date:   Fri Dec 19 18:16:15 2025 +0100

    usb: gadget: Constify struct configfs_item_operations and configfs_group_operations
    
    'struct configfs_item_operations' and 'configfs_group_operations' are not
    modified in these drivers.
    
    Constifying these structures moves some data to a read-only section, so
    increases overall security, especially when the structure holds some
    function pointers.
    
    On a x86_64, with allmodconfig, as an example:
    Before:
    ======
       text    data     bss     dec     hex filename
      65061   20968     256   86285   1510d drivers/usb/gadget/configfs.o
    
    After:
    =====
       text    data     bss     dec     hex filename
      66181   19848     256   86285   1510d drivers/usb/gadget/configfs.o
    
    Signed-off-by: Christophe JAILLET 
    Link: https://patch.msgid.link/49cec1cb84425f854de80b6d69b53a5a3cda8189.1766164523.git.christophe.jaillet@wanadoo.fr
    Signed-off-by: Greg Kroah-Hartman 

commit 45e9066f3a487e9e26b842644364d045af054775
Author: Brahmajit Das 
Date:   Mon Dec 22 00:25:31 2025 +0530

    ASoC: Intel: avs: replace strcmp with sysfs_streq
    
    allmodconfig failes to build with GCC 16 with the following build error
    
    sound/soc/intel/avs/path.c:137:38: error: ‘strcmp’ reading 1 or more bytes from a region of size 0 [-Werror=stringop-overread]
      137 |         return id->id == id2->id && !strcmp(id->tplg_name, id2->tplg_name);
          |                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      ‘avs_condpaths_walk’: events 1-3
      137 |         return id->id == id2->id && !strcmp(id->tplg_name, id2->tplg_name);
          |                ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          |                                  |   |
          |                                  |   (3) warning happens here
          |                                  (1) when the condition is evaluated to true
    ......
      155 |         if (id->id != path->template->owner->id ||
          |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          |                                                 |
          |                                                 (2) when the condition is evaluated to false
      156 |             strcmp(id->tplg_name, path->template->owner->owner->name))
          |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from sound/soc/intel/avs/path.h:14,
                     from sound/soc/intel/avs/path.c:15:
    sound/soc/intel/avs/topology.h: In function ‘avs_condpaths_walk’:
    sound/soc/intel/avs/topology.h:152:13: note: at offset 4 into source object ‘id’ of size 4
      152 |         u32 id;
          |             ^~
    
    Using the sysfs_streq as an alternative to strcmp helps getting around
    this build failure.
    Please also refer
    https://docs.kernel.org/core-api/kernel-api.html#c.__sysfs_match_string
    
    Signed-off-by: Brahmajit Das 
    Link: https://patch.msgid.link/20251221185531.6453-1-listout@listout.xyz
    Signed-off-by: Mark Brown 

commit f92d27a6ee158c43e276712af23c79997780471a
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:35:33 2025 +0100

    ASoC: rockchip: Discard pm_runtime_put() return value
    
    It is better to check directly whether or not CONFIG_PM has
    been enabled instead of relying on an error value returned by
    pm_runtime_put() in that case because pm_runtime_put() may also return
    an error value in other cases, like after writing "on" to the devices'
    runtime PM "control" attribute in sysfs for one example.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/5160923.0VBMTVartN@rafael.j.wysocki
    Signed-off-by: Mark Brown 

commit d8574ce57d760a958623c8f6bc3c55b5187a7bd7
Author: Richard Zhu 
Date:   Thu Dec 11 14:48:20 2025 +0800

    PCI: imx6: Add external reference clock input mode support
    
    i.MX95 PCIes have two reference clock inputs: one from internal PLL, the
    other from off chip crystal oscillator. The "extref" clock refers to a
    reference clock from an external crystal oscillator.
    
    Add external reference clock input mode support for i.MX95 PCIes.
    
    Signed-off-by: Richard Zhu 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251211064821.2707001-4-hongxing.zhu@nxp.com

commit 1352f58d7c8dfb6ba0fbd2041bfc8b4b3966ec67
Author: Richard Zhu 
Date:   Thu Dec 11 14:48:19 2025 +0800

    dt-bindings: PCI: pci-imx6: Add external reference clock input
    
    i.MX95 PCIes have two reference clock inputs: one from internal PLL.
    It's wired inside chip and present as "ref" clock. It's not an optional
    clock. The other from off chip crystal oscillator. The "extref" clock
    refers to a reference clock from an external crystal oscillator through
    the CLKIN_N/P pair PADs. It is an optional clock, relied on the board
    design.
    
    Add additional optional external reference clock input for i.MX95 PCIes.
    
    Signed-off-by: Richard Zhu 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Frank Li 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251211064821.2707001-3-hongxing.zhu@nxp.com

commit 418970983059aa06302ddd5ca76d441973b537c1
Author: Richard Zhu 
Date:   Thu Dec 11 14:48:18 2025 +0800

    dt-bindings: PCI: dwc: Add external reference clock input
    
    Add external reference clock input "extref" for a reference clock that
    comes from external crystal oscillator.
    
    Signed-off-by: Richard Zhu 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Frank Li 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251211064821.2707001-2-hongxing.zhu@nxp.com

commit f42b3c053b1554d66af6fe45bb1ef357464c0456
Author: Haotian Zhang 
Date:   Fri Dec 19 10:16:15 2025 +0800

    PCI: xilinx: Fix INTx IRQ domain leak in error paths
    
    In xilinx_pcie_init_irq_domain(), if xilinx_allocate_msi_domains() fails
    after pcie->leg_domain has been successfully created via
    irq_domain_create_linear(), the function returns directly without cleaning
    up the allocated IRQ domain, resulting in a resource leak. In
    xilinx_free_msi_domains(), pcie->leg_domain is also neglected.
    
    Add irq_domain_remove() call in the error path to properly release the
    IRQ domain before returning the error. Also rename
    xilinx_free_msi_domains() to xilinx_free_irq_domains() and add the release
    of pcie->leg_domain to it.
    
    Fixes: 313b64c3ae52 ("PCI: xilinx: Convert to MSI domains")
    Suggested-by: Manivannan Sadhasivam 
    Signed-off-by: Haotian Zhang 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251219021615.965-1-vulab@iscas.ac.cn

commit 8719c64e76bf258cc8f44109740c854f2e2ead2e
Author: Koichiro Den 
Date:   Mon Dec 22 12:01:44 2025 +0100

    PCI: dwc: ep: Cache MSI outbound iATU mapping
    
    dw_pcie_ep_raise_msi_irq() currently programs an outbound iATU window
    for the MSI target address on every interrupt and tears it down again
    via dw_pcie_ep_unmap_addr().
    
    On systems that heavily use the AXI bridge interface (for example when
    the integrated eDMA engine is active), this means the outbound iATU
    registers are updated while traffic is in flight. The DesignWare
    endpoint databook 5.40a - "3.10.6.1 iATU Outbound Programming Overview"
    warns that updating iATU registers in this situation is not supported,
    and the behavior is undefined.
    
    Under high MSI and eDMA load this pattern results in occasional bogus
    outbound transactions and IOMMU faults, on the RC side, such as:
    
      ipmmu-vmsa eed40000.iommu: Unhandled fault: status 0x00001502 iova 0xfe000000
    
    followed by the system becoming unresponsive. This is the actual output
    observed on Renesas R-Car S4, with its ipmmu_hc used with PCIe ch0.
    
    There is no need to reprogram the iATU region used for MSI on every
    interrupt. The host-provided MSI address is stable while MSI is enabled,
    and the endpoint driver already dedicates a scratch buffer for MSI
    generation.
    
    Cache the aligned MSI address and map size, program the outbound iATU
    once, and keep the window enabled. Subsequent interrupts only perform a
    write to the MSI scratch buffer, avoiding dynamic iATU reprogramming in
    the hot path and fixing the lockups seen under load.
    
    dw_pcie_ep_raise_msix_irq() is not modified, as each vector can have a
    different msg_addr, and because the msg_addr is allowed to be changed
    while the vector is masked. Neither problem is easy to solve with the
    current design. Instead, the plan is for the DWC vendor drivers to
    transition to dw_pcie_ep_raise_msix_irq_doorbell(), which does not rely
    on the iATU.
    
    Signed-off-by: Koichiro Den 
    [cassel: improve commit message]
    Signed-off-by: Niklas Cassel 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251222110144.3299523-2-cassel@kernel.org

commit 0b4f3aeee766fd3cc3bf254a26b9761d9b53818b
Author: sheetal 
Date:   Mon Sep 29 16:29:27 2025 +0530

    dt-bindings: dma: Update ADMA bindings for tegra264
    
    - Update ADMA device tree bindings for tegra264 to support up to 64
      interrupt channels by setting 'interrupts' property maxItems to 64.
    - Also, update the 'allOf' conditional schema to ensure correct maxItems
      for 'interrupts' based on compatible string, including tegra210 (22)
      and tegra186 (32) ADMA controllers.
    
    Signed-off-by: sheetal 
    Reviewed-by: Rob Herring (Arm) 
    Acked-by: Thierry Reding 
    Link: https://patch.msgid.link/20250929105930.1767294-2-sheetal@nvidia.com
    Signed-off-by: Vinod Koul 

commit c23918bedc74a7809e6fa2fd1d09b860625a90b8
Author: Nuno Sá 
Date:   Tue Nov 4 16:22:28 2025 +0000

    dma: dma-axi-dmac: simplify axi_dmac_parse_dt()
    
    Simplify axi_dmac_parse_dt() by using the cleanup device_node class for
    automatically releasing the of_node reference when going out of scope.
    
    Signed-off-by: Nuno Sá 
    base-commit: 398035178503bf662281bbffb4bebce1460a4bc5
    change-id: 20251104-axi-dmac-fixes-and-improvs-e3ad512a329c
    Acked-by: Michael Hennerich 
    Link: https://patch.msgid.link/20251104-axi-dmac-fixes-and-improvs-v1-4-3e6fd9328f72@analog.com
    Signed-off-by: Vinod Koul 

commit b2440442ccb68479fa6d307917419983f3c87e83
Author: Nuno Sá 
Date:   Tue Nov 4 16:22:27 2025 +0000

    dma: dma-axi-dmac: support bigger than 32bits addresses
    
    In some supported platforms as ARCH_ZYNQMP, part of the memory is mapped
    above 32bit addresses and since the DMA mask, by default, is set to 32bits,
    we would need to rely on swiotlb (which incurs a performance penalty)
    for the DMA mappings. Thus, we can write either the SRC or DEST high
    addresses with 1's and read them back. The last bit set on the return
    value will reflect the IP address bus width and so we can update the
    device DMA mask accordingly.
    
    While at it, support bigger that 32 bits transfers in IP without HW
    scatter gather support.
    
    Signed-off-by: Nuno Sá 
    base-commit: 398035178503bf662281bbffb4bebce1460a4bc5
    change-id: 20251104-axi-dmac-fixes-and-improvs-e3ad512a329c
    Acked-by: Michael Hennerich 
    Link: https://patch.msgid.link/20251104-axi-dmac-fixes-and-improvs-v1-3-3e6fd9328f72@analog.com
    Signed-off-by: Vinod Koul 

commit bbcbafb99df41a1d81403eb4f5bb443b38228b57
Author: Nuno Sá 
Date:   Tue Nov 4 16:22:26 2025 +0000

    dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
    
    For HW scatter gather transfers we still need to look for the queue. The
    HW is capable of queueing 3 concurrent transfers and if we try more than
    that we'll get the submit queue full and should return. Otherwise, if we
    go ahead and program the new transfer, we end up discarding it.
    
    Fixes: e97dc7435972 ("dmaengine: axi-dmac: Add support for scatter-gather transfers")
    Signed-off-by: Nuno Sá 
    base-commit: 398035178503bf662281bbffb4bebce1460a4bc5
    change-id: 20251104-axi-dmac-fixes-and-improvs-e3ad512a329c
    Acked-by: Michael Hennerich 
    Link: https://patch.msgid.link/20251104-axi-dmac-fixes-and-improvs-v1-2-3e6fd9328f72@analog.com
    Signed-off-by: Vinod Koul 

commit 9bd257181fd5c996d922e9991500ad27987cfbf4
Author: Nuno Sá 
Date:   Tue Nov 4 16:22:25 2025 +0000

    dma: dma-axi-dmac: fix SW cyclic transfers
    
    If 'hw_cyclic' is false we should still be able to do cyclic transfers in
    "software". That was not working for the case where 'desc->num_sgs' is 1
    because 'chan->next_desc' is never set with the current desc which means
    that the cyclic transfer only runs once and in the next SOT interrupt we
    do nothing since vchan_next_desc() will return NULL.
    
    Fix it by setting 'chan->next_desc' as soon as we get a new desc via
    vchan_next_desc().
    
    Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
    Signed-off-by: Nuno Sá 
    base-commit: 398035178503bf662281bbffb4bebce1460a4bc5
    change-id: 20251104-axi-dmac-fixes-and-improvs-e3ad512a329c
    Acked-by: Michael Hennerich 
    Link: https://patch.msgid.link/20251104-axi-dmac-fixes-and-improvs-v1-1-3e6fd9328f72@analog.com
    Signed-off-by: Vinod Koul 

commit 169934ba2b73f07df59c3371acdc26f45eb99c5e
Author: Srinivas Pandruvada 
Date:   Thu Dec 18 11:51:50 2025 -0800

    thermal: intel: intel_tcc_cooling: Add CPU models in the support list
    
    Add Panther Lake, Wildcat Lake and Nova Lake CPU models in the support
    list.
    
    Signed-off-by: Srinivas Pandruvada 
    Link: https://patch.msgid.link/20251218195150.3872795-1-srinivas.pandruvada@linux.intel.com
    Signed-off-by: Rafael J. Wysocki 

commit c3af05623e079c2a9a9363386796fdea20defa18
Author: Rosen Penev 
Date:   Wed Nov 5 18:20:15 2025 -0800

    dmaengine: st_fdma: add COMPILE_TEST support
    
    Add COMPILE_TEST as an option to allow test building the driver.
    
    Signed-off-by: Rosen Penev 
    Link: https://patch.msgid.link/20251106022015.84970-3-rosenp@gmail.com
    Signed-off-by: Vinod Koul 

commit 19fed6ca15c4c41c28059c25f9cc85c0058cc4fd
Author: Rosen Penev 
Date:   Wed Nov 5 18:20:14 2025 -0800

    dmaengine: st_fdma: change dreg_line to long
    
    The code is encoding a pointer into an int which works fine with a
    32-bit build. Not with a 64-bit one.
    
    Signed-off-by: Rosen Penev 
    Link: https://patch.msgid.link/20251106022015.84970-2-rosenp@gmail.com
    Signed-off-by: Vinod Koul 

commit b729eed5b74eeda36d51d6499f1a06ecc974f31a
Author: Jyothi Kumar Seerapu 
Date:   Wed Nov 5 19:00:42 2025 -0800

    dt-bindings: dma: qcom,gpi: Document GPI DMA engine for Kaanapali and Glymur SoCs
    
    Document the GPI DMA engine on the Kaanapali and Glymur platforms.
    
    Signed-off-by: Jyothi Kumar Seerapu 
    Signed-off-by: Pankaj Patil 
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251105-knp-bus-v2-1-ed3095c7013a@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 3587b2b6bf7681835c7c366c6083e2cd9e4b519d
Author: AngeloGioacchino Del Regno 
Date:   Thu Nov 13 13:22:29 2025 +0100

    dmaengine: mediatek: mtk-uart-apdma: Add support for Dimensity 9200
    
    Add a compatible string and match data for the APDMA IP version
    found in the MediaTek Dimensity 9200 MT6985 SoC; this supports
    extended addressing with up to 35 bits.
    
    Other SoCs with this IP version also include the Dimensity 9400
    MT6991 and Kompanio Ultra MT8196 (which don't need a specific
    compatible in this driver and can reuse the mt6985 one).
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Link: https://patch.msgid.link/20251113122229.23998-9-angelogioacchino.delregno@collabora.com
    Signed-off-by: Vinod Koul 

commit 391e20f21cfdee2f55f2274e83b37c03199062ea
Author: AngeloGioacchino Del Regno 
Date:   Thu Nov 13 13:22:28 2025 +0100

    dmaengine: mediatek: mtk-uart-apdma: Add support for Dimensity 6300
    
    Add a compatible string and match data for the APDMA IP version
    found in the MediaTek Dimensity 6300 MT6835 SoC; this supports
    extended addressing with up to 34 bits.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Link: https://patch.msgid.link/20251113122229.23998-8-angelogioacchino.delregno@collabora.com
    Signed-off-by: Vinod Koul 

commit 7cb173936858f2278d9cf8b2f5d7d52fd000e54e
Author: AngeloGioacchino Del Regno 
Date:   Thu Nov 13 13:22:27 2025 +0100

    dmaengine: mediatek: mtk-uart-apdma: Rename support_33bits to support_ext_addr
    
    In preparation for adding support for SoCs with APDMA IP versions
    supporting more than 33 bits addressing, rename the support_33bits
    variable to support_ext_addr to signal support for extended, above
    4GB, addressing.
    
    This change is cosmetic only, and brings no functional differences.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Link: https://patch.msgid.link/20251113122229.23998-7-angelogioacchino.delregno@collabora.com
    Signed-off-by: Vinod Koul 

commit 58ab9d7b6651d21e1cff1777529f2d3dd0b4e851
Author: AngeloGioacchino Del Regno 
Date:   Thu Nov 13 13:22:26 2025 +0100

    dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
    
    The VFF_4G_SUPPORT register is named differently in datasheets,
    and its name is "VFF_ADDR2"; was this named correctly from the
    beginning it would've been clearer that there was a mistake in
    the programming sequence.
    
    This register is supposed to hold the high bits to support the
    DMA addressing above 4G (so, more than 32 bits) and not a bit
    to "enable" the support for VFF 4G.
    
    Fix the name of this register, and also fix its usage by writing
    the upper 32 bits of the dma_addr_t on it when the SoC supports
    such feature.
    
    Fixes: 9135408c3ace ("dmaengine: mediatek: Add MediaTek UART APDMA support")
    Signed-off-by: AngeloGioacchino Del Regno 
    Link: https://patch.msgid.link/20251113122229.23998-6-angelogioacchino.delregno@collabora.com
    Signed-off-by: Vinod Koul 

commit ff81a68a87b1dbf5c1b819f240f83715c701ef0d
Author: AngeloGioacchino Del Regno 
Date:   Thu Nov 13 13:22:25 2025 +0100

    dmaengine: mediatek: uart-apdma: Get addressing bits from match data
    
    The only SoC that declares mediatek,dma-33bits in its devicetree
    currently is MT6795, which obviously also declares a SoC-specific
    compatible string: in preparation for adding new SoCs with 34 bits
    addressing, replace the parsing of said vendor property with logic
    to get the number of addressing bits from platform data associated
    to compatible strings.
    
    While at it, also make the bit_mask variable unsigned and move the
    `int rc` declaration as last to beautify the code.
    
    Thanks to the correct declaration of the APDMA node is in all of
    the MediaTek device trees that are currently upstream, this commit
    brings no functional differences.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251113122229.23998-5-angelogioacchino.delregno@collabora.com
    Signed-off-by: Vinod Koul 

commit fd7843f0da58b37072c1dafa779d128bb36912bf
Author: AngeloGioacchino Del Regno 
Date:   Thu Nov 13 13:22:24 2025 +0100

    dt-bindings: dma: mediatek,uart-dma: Support all SoC generations
    
    Add support for the APDMA IP found in all of the SoC generations
    that are currently supported upstream; this includes:
     - MT8173, MT8183, fully compatible with MT6577 (32-bits)
     - MT7988, MT8186, MT8188, MT8192, MT8195 and MT6835 (34-bits)
     - MT6991, MT8196 and MT6985 (35-bits)
    
    ...where:
     - MT6835 is the first SoC where the AP_DMA IP supports 34-bits
       addressing; and
     - MT6985 is the first SoC where the AP_DMA IP supports 35-bits
       addressing.
    
    While at it, also add myself in the maintainers list.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251113122229.23998-4-angelogioacchino.delregno@collabora.com
    Signed-off-by: Vinod Koul 

commit ebc5e9176e0f9b7effc259b58a7387019ac8811d
Author: AngeloGioacchino Del Regno 
Date:   Thu Nov 13 13:22:23 2025 +0100

    dt-bindings: dma: mediatek,uart-dma: Deprecate mediatek,dma-33bits
    
    While this property wants to express a capability of the hardware,
    this is only used by the driver itself to vary the DMA bits during
    probe.
    
    Different hardware shall instead have different compatible strings.
    
    Following the driver cleanup and the introduction of a specific
    compatible string for the APDMA IP version found in MT6795, set
    the "mediatek,dma-33bits" vendor property as deprecated.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251113122229.23998-3-angelogioacchino.delregno@collabora.com
    Signed-off-by: Vinod Koul 

commit 4b9ce35ca5924c195df1a6bbccdc9aae4f5cb422
Author: AngeloGioacchino Del Regno 
Date:   Thu Nov 13 13:22:22 2025 +0100

    dt-bindings: dma: mediatek,uart-dma: Allow MT6795 single compatible
    
    While it is true that this SoC is compatible with the MT6577 APDMA
    IP, that is valid only when the IP is used in 32-bits addressing
    mode, and, by the way there is no good reason to do so.
    
    Since the APDMA IP in MT6795 supports 33 bits addressing, this
    means that it is a newer revision compared to the one found in
    MT6577, hence only partially compatible with it.
    
    Allow nodes to specify "mediatek,mt6795-uart-dma" as their only
    compatible in the case of MT6795; this is done in lieu of the fact
    that there are other SoCs integrating the same version of this IP
    as MT6795, and those will eventually get their own compatible that
    expresses full compatibility with this SoC.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251113122229.23998-2-angelogioacchino.delregno@collabora.com
    Signed-off-by: Vinod Koul 

commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71
Author: Navaneeth K 
Date:   Thu Nov 27 16:53:37 2025 +0000

    most: core: fix resource leak in most_register_interface error paths
    
    The function most_register_interface() did not correctly release resources
    if it failed early (before registering the device). In these cases, it
    returned an error code immediately, leaking the memory allocated for the
    interface.
    
    Fix this by initializing the device early via device_initialize() and
    calling put_device() on all error paths.
    
    The most_register_interface() is expected to call put_device() on
    error which frees the resources allocated in the caller. The
    put_device() either calls release_mdev() or dim2_release(),
    depending on the caller.
    
    Switch to using device_add() instead of device_register() to handle
    the split initialization.
    
    Acked-by: Abdun Nihaal 
    Signed-off-by: Navaneeth K 
    Reviewed-by: Dan Carpenter 
    Link: https://patch.msgid.link/20251127165337.19172-1-knavaneeth786@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit aaf3bc0265744adbc2d364964ef409cf118d193d
Author: Clément Le Goffic 
Date:   Wed Dec 17 09:15:03 2025 +0100

    dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
    
    m2m_hw_period is initialized only when chan_config->m2m_hw is true. This
    triggers a warning:
    ‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized]
    Although m2m_hw_period is only used when chan_config->m2m_hw is true and
    ignored otherwise, initialize it unconditionally to 0.
    
    ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not
    empty. This triggers a warning:
    ‘ccr’ may be used uninitialized [-Wmaybe-uninitialized]
    Indeed, it could be used uninitialized if the sg list is empty. Initialize
    it to 0.
    
    Signed-off-by: Clément Le Goffic 
    Reviewed-by: Clément Le Goffic 
    Signed-off-by: Amelie Delaunay 
    Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com
    Signed-off-by: Vinod Koul 

commit 0f698d742f628d02ab2a222f8cf5f793443865d0
Author: Jonas Gorski 
Date:   Wed Dec 17 22:10:26 2025 +0100

    spi: bcm63xx-hsspi: add support for 1-2-2 read ops
    
    Add support for 1-2-2 read ops by separately calculating the switch from
    single-bit to multi-bit, and then switching within the prepend data.
    
    This allows us to support single-bit write followed by multi-bit write
    followed by multi-bit read, and we do not need to reject 1-2-2 read
    operations anymore.
    
    Tested on BCM963268BU_P300 with custom fixup to allow 1-2-2 on the
    non-SDFP capable s25fl129p1 attached (which it actually supports):
    
    root@OpenWrt:~# cat /sys/kernel/debug/spi-nor/spi1.0/params
    name            s25fl129p1
    id              01 20 18 4d 01 01
    size            16.0 MiB
    write size      1
    page size       256
    address nbytes  3
    flags           HAS_16BIT_SR | NO_READ_CR
    
    opcodes
     read           0xbb
      dummy cycles  4
     erase          0xd8
     program        0x02
     8D extension   none
    
    protocols
     read           1S-2S-2S
     write          1S-1S-1S
     register       1S-1S-1S
    
    Reading from flash is still working as expected:
    
    [    1.070000] parser_imagetag: rootfs: CFE image tag found at 0x0 with version 6, board type 963168VX
    [    1.080000] parser_imagetag: Partition 0 is rootfs offset 100 and length 665000
    [    1.090000] parser_imagetag: Partition 1 is kernel offset 665100 and length 136fa1
    [    1.100000] parser_imagetag: Spare partition is offset 7b0000 and length 30000
    
    Signed-off-by: Jonas Gorski 
    Acked-by: William Zhang 
    Tested-by: David Regan 
    Link: https://patch.msgid.link/20251217211026.173946-1-jonas.gorski@gmail.com
    Signed-off-by: Mark Brown 

commit c14afba60a61bc80403a571a67db956aa9800dbb
Author: Geert Uytterhoeven 
Date:   Mon Dec 22 15:02:09 2025 +0100

    serial: rsci: Convert to FIELD_MODIFY()
    
    Use the FIELD_MODIFY() helper instead of open-coding the same operation.
    
    Signed-off-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/ada3faf4698155a618ae6371b35eab121eb8b19c.1766411924.git.geert+renesas@glider.be
    Signed-off-by: Greg Kroah-Hartman 

commit b5024e804ee06330486caf3087e1b0d91e3797a5
Author: Guodong Xu 
Date:   Mon Dec 22 21:04:15 2025 +0800

    dt-bindings: serial: 8250: add SpacemiT K3 UART compatible
    
    The SpacemiT K3 UART controller is compatible with the Intel XScale UART.
    Add K3 UART binding and allow describing it with a fixed clock-frequency
    for now.
    
    The clocks and clock-names properties will be made mandatory in a future
    patch, once the K3 clock driver and device tree are merged.
    
    Acked-by: Conor Dooley 
    Signed-off-by: Guodong Xu 
    Link: https://patch.msgid.link/20251222-k3-basic-dt-v2-5-3af3f3cd0f8a@riscstar.com
    Signed-off-by: Greg Kroah-Hartman 

commit eb2606bba1cbac610701d73af25cbff0f3c5b09b
Author: Thomas Weißschuh 
Date:   Mon Dec 22 09:28:17 2025 +0100

    s390: Implement ARCH_HAS_CC_CAN_LINK
    
    The generic CC_CAN_LINK detection relies on -m32/-m64 compiler flags.
    Some s390 toolchains use -m31 instead but that is not supported in the
    kernel.
    
    Make the logic easier to understand and allow the simplification of the
    generic CC_CAN_LINK by using a tailored implementation.
    
    Signed-off-by: Thomas Weißschuh 
    Signed-off-by: Heiko Carstens 

commit 43e3518582cfc0fc1bb536b62d7f8366ee069ce9
Author: Tamir Duberstein 
Date:   Tue Dec 23 08:40:24 2025 +0100

    samples: rust: faux: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Tamir Duberstein 
    Link: https://patch.msgid.link/20251223-cstr-faux-v1-1-ee0c5cf1be4b@gmail.com
    [ Use kernel vertical import style. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 5c9142a8063f71233b25d94ae0d73e7dcf9d2a1d
Author: Tomi Valkeinen 
Date:   Thu Dec 18 10:39:37 2025 +0200

    dmaengine: xilinx_dma: Add support for residue on direct AXIDMA S2MM
    
    AXIDMA IP supports reporting the amount of bytes transferred on the S2MM
    channel in direct mode (i.e. non-SG), but the driver does not. Thus the
    driver always reports that all of the buffer was filled.
    
    Add xilinx_dma_get_residue_axidma_direct_s2mm() which gets the residue
    amount for direct AXIDMA for S2MM direction.
    
    Signed-off-by: Tomi Valkeinen 
    Reviewed-by: Suraj Gupta 
    Link: https://patch.msgid.link/20251218-xilinx-dma-residue-fix-v1-1-7cd221d69d6b@ideasonboard.com
    Signed-off-by: Vinod Koul 

commit f8c537ff0492eb27c160592702a96ea7cb19b493
Author: Takashi Iwai 
Date:   Tue Dec 16 15:11:50 2025 +0100

    ALSA: x86: Clean up locks and runtime PM with guard() and co
    
    Use PM_RUNTIME_ACQUIRE_*() and guard() for replacing the manual calls
    of runtime PM and mutex lock in had_audio_wq().
    
    Merely code cleanups and no functional changes.
    
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216141154.172218-6-tiwai@suse.de

commit be9dd97060e704e702d508f4a295d06e1197ae08
Author: Takashi Iwai 
Date:   Tue Dec 16 15:11:49 2025 +0100

    ALSA: hda/tegra: Clean up runtime PM with guard()
    
    Use guard(pm_runtime_active) for replacing the manual calls of
    pm_runtime_get_sync() and pm_runtime_put().
    
    Merely code cleanups and no functional changes.
    
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216141154.172218-5-tiwai@suse.de

commit 4a91da4afc7db944d17234e4ecc164df8252b23b
Author: Takashi Iwai 
Date:   Tue Dec 16 15:11:48 2025 +0100

    ALSA: hda/tas2781: Clean up runtime PM with guard()
    
    Use guard(pm_runtime_active_auto) for replacing the manual calls of
    pm_runtime_get_sync() and pm_runtime_put_autosuspend().
    
    Along with this, we can use guard() for the tas_priv->codec_lock mutex
    in tasdev_fw_ready(), too (that aligns both i2c and spi codes).
    
    Merely code cleanups and no functional changes.
    
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216141154.172218-4-tiwai@suse.de

commit 0ff22680e51f4c636f9fa98a1357f21310cb2a9a
Author: Takashi Iwai 
Date:   Tue Dec 16 15:11:47 2025 +0100

    ALSA: hda/cs35l56: Clean up with PM_RUNTIME_ACQUIRE*() macros
    
    Use PM_RUNTIME_ACQUIRE*() macros for replacing the manual
    pm_runtime_resume_and_get() and pm_runtime_put_*() calls.
    
    Merely code cleanups and no functional changes.
    
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216141154.172218-3-tiwai@suse.de

commit e38bdd30708b8bad577b07de5fdb2baa1cae8527
Author: Takashi Iwai 
Date:   Tue Dec 16 15:11:46 2025 +0100

    ALSA: hda/cs35l41: Clean up runtime PM with guard()
    
    Replace the manual pm_runtime_get_sync() and
    pm_runtime_put_autosuspend() calls with the new
    guard(pm_runtime_active_auto) for code simplification.
    
    Along with this change, the former scoped_guard(mutex) can be set back
    to the plain guard(mutex), and the indent level is taken back, too.
    
    Merely code cleanups, and no functional changes.
    
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216141154.172218-2-tiwai@suse.de

commit 5de5db35350d9c4def1de2ae273e224a4eee5ed1
Author: Kailang Yang 
Date:   Mon Dec 22 17:20:06 2025 +0800

    ALSA: hda/realtek - Enable Mute LED for Lenovo platform
    
    Enable SPK Mute Led and Mic Mute Led for Lenovo platform.
    
    Signed-off-by: Kailang Yang 
    Link: https://patch.msgid.link/8a99edffee044e13b6e348d1b69c2b57@realtek.com
    Signed-off-by: Takashi Iwai 

commit 2a2c085de1f3f54a6222fbef5b45f1d3c40e98e3
Author: Shyam Sundar S K 
Date:   Tue Dec 2 09:52:19 2025 +0530

    platform/x86/amd/pmf: Use ring buffer to store custom BIOS input values
    
    Custom BIOS input values can be updated by multiple sources, such as power
    mode changes and sensor events, each triggering a custom BIOS input event.
    When these events occur in rapid succession, new data may overwrite
    previous values before they are processed, resulting in lost updates.
    
    To address this, introduce a fixed-size, power-of-two ring buffer to
    capture every custom BIOS input event, storing both the pending request
    and its associated input values. Access to the ring buffer is synchronized
    using a mutex.
    
    The previous use of memset() to clear the pending request structure after
    each event is removed, as each BIOS input value is now copied into the
    buffer as a snapshot. Consumers now process entries directly from the ring
    buffer, making explicit clearing of the pending request structure
    unnecessary.
    
    Reviewed-by: Mario Limonciello (AMD) 
    Tested-by: Yijun Shen 
    Co-developed-by: Patil Rajesh Reddy 
    Signed-off-by: Patil Rajesh Reddy 
    Signed-off-by: Shyam Sundar S K 
    Reviewed-by: Ilpo Järvinen 
    Link: https://patch.msgid.link/20251202042219.245173-1-Shyam-sundar.S-k@amd.com
    Signed-off-by: Ilpo Järvinen 

commit dd0a2d47cfc4c5ffb3e866c94a80c03ff5ecdd70
Author: Kaushlendra Kumar 
Date:   Thu Dec 18 13:18:33 2025 +0530

    platform/x86: intel/pmt: Replace sprintf() with sysfs_emit()
    
    Replace sprintf() calls with sysfs_emit() in guid_show(), size_show(),
    and offset_show() sysfs attribute handlers. The sysfs_emit() function
    provides automatic buffer bounds checking and is the preferred method
    for formatting sysfs output per Documentation/filesystems/sysfs.rst.
    
    This improves safety by preventing potential buffer overflows and aligns
    with current kernel coding standards for sysfs attribute implementation.
    
    Signed-off-by: Kaushlendra Kumar 
    Link: https://patch.msgid.link/20251218074833.2948801-1-kaushlendra.kumar@intel.com
    Reviewed-by: Ilpo Järvinen 
    Signed-off-by: Ilpo Järvinen 

commit 0620837490e0401cb4e9965a1e0c462dbff1c97b
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:20 2025 +0100

    drm/xe/svm: Serialize migration to device if racing
    
    Introduce an rw-semaphore to serialize migration to device if
    it's likely that migration races with another device migration
    of the same CPU address space range.
    This is a temporary fix to attempt to mitigate a livelock that
    might happen if many devices try to migrate a range at the same
    time, and it affects only devices using the xe driver.
    A longer term fix is probably improvements in the core mm
    migration layer.
    
    Suggested-by: Matthew Brost 
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251219113320.183860-25-thomas.hellstrom@linux.intel.com

commit ec265e1f1cfcce6b03167868cadebf2d831e52b5
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:19 2025 +0100

    drm/pagemap: Support source migration over interconnect
    
    Support source interconnect migration by using the copy_to_ram() op
    of the source device private pages.
    
    Source interconnect migration is required to flush the L2 cache of
    the source device, which among other things is a requirement for
    correct global atomic operation. It also enables the source GPU to
    potentially decompress any compressed content which is not
    understood by peers, and finally for the PCIe case, it's expected
    that writes over PCIe will be faster than reads.
    
    The implementation can probably be improved by coalescing subregions
    with the same source.
    
    v5:
    - Update waiting for the pre_migrate_fence and comments around that,
      previously in another patch. (Himal).
    - Actually select device private pages to migrate when
      source_peer_migrates is true.
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-24-thomas.hellstrom@linux.intel.com

commit 75af93b3f5d0ab760356365064521d9aa7b7fc49
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:18 2025 +0100

    drm/pagemap, drm/xe: Support destination migration over interconnect
    
    Support destination migration over interconnect when migrating from
    device-private pages with the same dev_pagemap owner.
    
    Since we now also collect device-private pages to migrate,
    also abort migration if the range to migrate is already
    fully populated with pages from the desired pagemap.
    
    Finally return -EBUSY from drm_pagemap_populate_mm()
    if the migration can't be completed without first migrating all
    pages in the range to system. It is expected that the caller
    will perform that before retrying the call to
    drm_pagemap_populate_mm().
    
    v3:
    - Fix a bug where the p2p dma-address was never used.
    - Postpone enabling destination interconnect migration,
      since xe devices require source interconnect migration to
      ensure the source L2 cache is flushed at migration time.
    - Update the drm_pagemap_migrate_to_devmem() interface to
      pass migration details.
    v4:
    - Define XE_INTERCONNECT_P2P unconditionally (CI)
    - Include a missing header (CI)
    v5:
    - Use page order increments where possible (Matt Brost).
    - Fix a negated value of can_migrate_same_pagemap.
    - Move removal of some dead code to a separate patch (Matt Brost).
    - Remove an unnecessary zdd get() and put() (Matt Brost).
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-23-thomas.hellstrom@linux.intel.com

commit 0471ed20df6b92133a183d526d8f28592dbf0831
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:17 2025 +0100

    drm/xe: Use drm_gpusvm_scan_mm()
    
    Use drm_gpusvm_scan_mm() to avoid unnecessarily calling into
    drm_pagemap_populate_mm();
    
    v3:
    - New patch.
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Reviewed-by: Himal Prasad Ghimiray 
    Link: https://patch.msgid.link/20251219113320.183860-22-thomas.hellstrom@linux.intel.com

commit f1d08a5864822684773105c60528e2abb577ca6c
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:16 2025 +0100

    drm/gpusvm: Introduce a function to scan the current migration state
    
    With multi-device we are much more likely to have multiple
    drm-gpusvm ranges pointing to the same struct mm range.
    
    To avoid calling into drm_pagemap_populate_mm(), which is always
    very costly, introduce a much less costly drm_gpusvm function,
    drm_gpusvm_scan_mm() to scan the current migration state.
    The device fault-handler and prefetcher can use this function to
    determine whether migration is really necessary.
    
    There are a couple of performance improvements that can be done
    for this function if it turns out to be too costly. Those are
    documented in the code.
    
    v3:
    - New patch.
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Reviewed-by: Himal Prasad Ghimiray 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-21-thomas.hellstrom@linux.intel.com

commit 5b64b23f6f1b1d5b9836ac5a0963998951ba53d8
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:15 2025 +0100

    drm/pagemap, drm/xe: Clean up the use of the device-private page owner
    
    Use the dev_pagemap->owner field wherever possible, simplifying
    the code slightly.
    
    v3: New patch
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Himal Prasad Ghimiray 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-20-thomas.hellstrom@linux.intel.com

commit 1f430b8d68e6d2cdf8825421d5c1e1caa746b483
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:14 2025 +0100

    drm/xe/svm: Document how xe keeps drm_pagemap references
    
    As an aid to understanding the lifetime of the drm_pagemaps used
    by the xe driver, document how the xe driver keeps the
    drm_pagemap references.
    
    v3:
    - Fix formatting (Matt Brost)
    
    Suggested-by: Matthew Brost 
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251219113320.183860-19-thomas.hellstrom@linux.intel.com

commit 54dc5842a81cacc6833c1f897ca332d2f931df01
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:13 2025 +0100

    drm/xe/vm: Add a couple of VM debug printouts
    
    Add debug printouts that are valueable for pagemap prefetch,
    migration and page collection.
    
    v2:
    - Add additional debug prinouts around migration and page collection.
    - Require CONFIG_DRM_XE_DEBUG_VM.
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost  #v1
    Link: https://patch.msgid.link/20251219113320.183860-18-thomas.hellstrom@linux.intel.com

commit 2df55d9e66a2ad845286d15d865fa54117882b22
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:12 2025 +0100

    drm/xe: Support pcie p2p dma as a fast interconnect
    
    Mimic the dma-buf method using dma_[map|unmap]_resource to map
    for pcie-p2p dma.
    
    There's an ongoing area of work upstream to sort out how this best
    should be done. One method proposed is to add an additional
    pci_p2p_dma_pagemap aliasing the device_private pagemap and use
    the corresponding pci_p2p_dma_pagemap page as input for
    dma_map_page(). However, that would incur double the amount of
    memory and latency to set up the drm_pagemap and given the huge
    amount of memory present on modern GPUs, that would really not work.
    Hence the simple approach used in this patch.
    
    v2:
    - Simplify xe_page_to_pcie(). (Matt Brost)
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251219113320.183860-17-thomas.hellstrom@linux.intel.com

commit dff547e137be2f36c6c4d77172a03a54a38230d3
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:11 2025 +0100

    drm/xe/uapi: Extend the madvise functionality to support foreign pagemap placement for svm
    
    Use device file descriptors and regions to represent pagemaps on
    foreign or local devices.
    
    The underlying files are type-checked at madvise time, and
    references are kept on the drm_pagemap as long as there is are
    madvises pointing to it.
    
    Extend the madvise preferred_location UAPI to support the region
    instance to identify the foreign placement.
    
    v2:
    - Improve UAPI documentation. (Matt Brost)
    - Sanitize preferred_mem_loc.region_instance madvise. (Matt Brost)
    - Clarify madvise drm_pagemap vs xe_pagemap refcounting. (Matt Brost)
    - Don't allow a foreign drm_pagemap madvise without a fast
      interconnect.
    v3:
    - Add a comment about reference-counting in xe_devmem_open() and
      remove the reference-count get-and-put. (Matt Brost)
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251219113320.183860-16-thomas.hellstrom@linux.intel.com

commit 4be5f2bc811a5811a8ec42dfbb603dbc12e8948a
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:10 2025 +0100

    drm/xe: Simplify madvise_preferred_mem_loc()
    
    Simplify madvise_preferred_mem_loc by removing repetitive patterns
    in favour of local variables.
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251219113320.183860-15-thomas.hellstrom@linux.intel.com

commit 238dbc9d9f4a7396e87d357567e09dcd270d9e16
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:09 2025 +0100

    drm/xe: Use the vma attibute drm_pagemap to select where to migrate
    
    Honor the drm_pagemap vma attribute when migrating SVM pages.
    Ensure that when the desired placement is validated as device
    memory, that we also check that the requested drm_pagemap is
    consistent with the current.
    
    v2:
    - Initialize a struct drm_pagemap pointer to NULL that could
      otherwise be dereferenced uninitialized. (CI)
    - Remove a redundant assignment (Matt Brost)
    - Slightly improved commit message (Matt Brost)
    - Extended drm_pagemap validation.
    
    v3:
    - Fix a compilation error if CONFIG_DRM_GPUSVM is not enabled.
      (kernel test robot )
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Himal Prasad Ghimiray 
    Link: https://patch.msgid.link/20251219113320.183860-14-thomas.hellstrom@linux.intel.com

commit eb9db59d96ce1ce8a207064f4a098c55ddd23fc3
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:08 2025 +0100

    drm/xe: Pass a drm_pagemap pointer around with the memory advise attributes
    
    As a consequence, struct xe_vma_mem_attr() can't simply be assigned
    or freed without taking the reference count of individual members
    into account. Also add helpers to do that.
    
    v2:
    - Move some calls to xe_vma_mem_attr_fini() to xe_vma_free(). (Matt Brost)
    v3:
    - Rebase.
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost  #v2
    Link: https://patch.msgid.link/20251219113320.183860-13-thomas.hellstrom@linux.intel.com

commit 14b60874c90a61ffb9c32787bc5f3fcde93b9cd4
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:07 2025 +0100

    drm/xe: Use the drm_pagemap_util helper to get a svm pagemap owner
    
    Register a driver-wide owner list, provide a callback to identify
    fast interconnects and use the drm_pagemap_util helper to allocate
    or reuse a suitable owner struct. For now we consider pagemaps on
    different tiles on the same device as having fast interconnect and
    thus the same owner.
    
    v2:
    - Fix up the error onion unwind in xe_pagemap_create(). (Matt Brost)
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251219113320.183860-12-thomas.hellstrom@linux.intel.com

commit e44f47a9bf5104c9b9efcc8fc95a858c66f2d1e6
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:06 2025 +0100

    drm/pagemap_util: Add a utility to assign an owner to a set of interconnected gpus
    
    The hmm_range_fault() and the migration helpers currently need a common
    "owner" to identify pagemaps and clients with fast interconnect.
    Add a drm_pagemap utility to setup such owners by registering
    drm_pagemaps, in a registry, and for each new drm_pagemap,
    query which existing drm_pagemaps have fast interconnects with the new
    drm_pagemap.
    
    The "owner" scheme is limited in that it is static at drm_pagemap creation.
    Ideally one would want the owner to be adjusted at run-time, but that
    requires changes to hmm. If the proposed scheme becomes too limited,
    we need to revisit.
    
    v2:
    - Improve documentation of DRM_PAGEMAP_OWNER_LIST_DEFINE(). (Matt Brost)
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-11-thomas.hellstrom@linux.intel.com

commit 33ac8d150af6be100161ec11106a8dd3f1f5b9e0
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:05 2025 +0100

    drm/pagemap: Remove the drm_pagemap_create() interface
    
    With the drm_pagemap_init() interface, drm_pagemap_create() is not
    used anymore.
    
    v2:
    - Slightly more verbose commit message. (Matt Brost)
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-10-thomas.hellstrom@linux.intel.com

commit 8a52f4d9b1efc90eb338b0d59912e640400b9c63
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:04 2025 +0100

    drm/xe: Use the drm_pagemap cache and shrinker
    
    Define a struct xe_pagemap that embeds all pagemap-related
    data used by xekmd, and use the drm_pagemap cache- and
    shrinker to manage lifetime.
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251219113320.183860-9-thomas.hellstrom@linux.intel.com

commit 77f14f2f2d73f6955b856e7c91ca9fb7046da191
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:03 2025 +0100

    drm/pagemap: Add a drm_pagemap cache and shrinker
    
    Pagemaps are costly to set up and tear down, and they consume a lot
    of system memory for the struct pages. Ideally they should be
    created only when needed.
    
    Add a caching mechanism to allow doing just that: Create the drm_pagemaps
    when needed for migration. Keep them around to avoid destruction and
    re-creation latencies and destroy inactive/unused drm_pagemaps on memory
    pressure using a shrinker.
    
    Only add the helper functions. They will be hooked up to the xe driver
    in the upcoming patch.
    
    v2:
    - Add lockdep checking for drm_pagemap_put(). (Matt Brost)
    - Add a copyright notice. (Matt Brost)
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-8-thomas.hellstrom@linux.intel.com

commit a26084328ac40c12096ef01482a7520346379453
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:02 2025 +0100

    drm/pagemap, drm/xe: Manage drm_pagemap provider lifetimes
    
    If a device holds a reference on a foregin device's drm_pagemap,
    and a device unbind is executed on the foreign device,
    Typically that foreign device would evict its device-private
    pages and then continue its device-managed cleanup eventually
    releasing its drm device and possibly allow for module unload.
    However, since we're still holding a reference on a drm_pagemap,
    when that reference is released and the provider module is
    unloaded we'd execute out of undefined memory.
    
    Therefore keep a reference on the provider device and module until
    the last drm_pagemap reference is gone.
    
    Note that in theory, the drm_gpusvm_helper module may be unloaded
    as soon as the final module_put() of the provider driver module is
    executed, so we need to add a module_exit() function that waits
    for the work item executing the module_put() has completed.
    
    v2:
    - Better commit message (Matt Brost)
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-7-thomas.hellstrom@linux.intel.com

commit 565477dbca6eca0cfa3f6fefede3f6eb1e6e09b3
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:01 2025 +0100

    drm/pagemap: Add a refcounted drm_pagemap backpointer to struct drm_pagemap_zdd
    
    To be able to keep track of drm_pagemap usage, add a refcounted
    backpointer to struct drm_pagemap_zdd. This will keep the drm_pagemap
    reference count from dropping to zero as long as there are drm_pagemap
    pages present in a CPU address space.
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-6-thomas.hellstrom@linux.intel.com

commit a599b98607decdc899630fc99a3a2847f6b72965
Author: Thomas Hellström 
Date:   Fri Dec 19 12:33:00 2025 +0100

    drm/pagemap, drm/xe: Add refcounting to struct drm_pagemap
    
    With the end goal of being able to free unused pagemaps
    and allocate them on demand, add a refcount to struct drm_pagemap,
    remove the xe embedded drm_pagemap, allocating and freeing it
    explicitly.
    
    v2:
    - Make the drm_pagemap pointer in drm_gpusvm_pages reference-counted.
    v3:
    - Call drm_pagemap_get() before drm_pagemap_put() in drm_gpusvm_pages
      (Himal Prasad Ghimiray)
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost  #v1
    Reviewed-by: Himal Prasad Ghimiray 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-5-thomas.hellstrom@linux.intel.com

commit 16b5ad31952476fb925c401897fc171cd37f536b
Author: Thomas Hellström 
Date:   Fri Dec 19 12:32:59 2025 +0100

    drm/pagemap, drm/xe: Ensure that the devmem allocation is idle before use
    
    In situations where no system memory is migrated to devmem, and in
    upcoming patches where another GPU is performing the migration to
    the newly allocated devmem buffer, there is nothing to ensure any
    ongoing clear to the devmem allocation or async eviction from the
    devmem allocation is complete.
    
    Address that by passing a struct dma_fence down to the copy
    functions, and ensure it is waited for before migration is marked
    complete.
    
    v3:
    - New patch.
    v4:
    - Update the logic used for determining when to wait for the
      pre_migrate_fence.
    - Update the logic used for determining when to warn for the
      pre_migrate_fence since the scheduler fences apparently
      can signal out-of-order.
    v5:
    - Fix a UAF (CI)
    - Remove references to source P2P migration (Himal)
    - Put the pre_migrate_fence after migration.
    v6:
    - Pipeline the pre_migrate_fence dependency (Matt Brost)
    
    Fixes: c5b3eb5a906c ("drm/xe: Add GPUSVM device memory copy vfunc functions")
    Cc: Matthew Brost 
    Cc:  # v6.15+
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-4-thomas.hellstrom@linux.intel.com

commit d1a4fc044cfd83741fae06c7e91019d139053f15
Author: Thomas Hellström 
Date:   Fri Dec 19 12:32:58 2025 +0100

    drm/pagemap: Remove some dead code
    
    The page pointer can't be NULL.
    
    v5:
    - New patch. (Matt Brost)
    
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Acked-by: Maarten Lankhorst  # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-3-thomas.hellstrom@linux.intel.com

commit 2efea3b35cc916f04f06b89f2e2557dbd9c48109
Author: Lad Prabhakar 
Date:   Wed Dec 3 09:41:47 2025 +0000

    clk: renesas: r9a09g057: Add entries for RSCIs
    
    Add clock and reset entries for the RSCI IPs.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251203094147.6429-3-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 1f76689d171512e1fd99999faa76040e48420b7b
Author: Lad Prabhakar 
Date:   Wed Dec 3 09:41:46 2025 +0000

    clk: renesas: r9a09g056: Add entries for RSCIs
    
    Add clock and reset entries for the RSCI IPs.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251203094147.6429-2-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 1bea7e94bf09ee6d46051076866a9369f64d302a
Author: Cosmin Tanislav 
Date:   Tue Dec 16 14:34:21 2025 +0200

    soc: renesas: Enable ICU support on RZ/N2H
    
    The Renesas RZ/N2H (R9A09G087) SoC has the same Interrupt Controller
    (ICU) as the Renesas RZ/T2H (R9A09G077) SoC.
    
    Enable support for it by selecting the RENESAS_RZT2H_ICU config.
    
    Signed-off-by: Cosmin Tanislav 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251216123421.124401-1-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 72aee5f70ba47b939345a0d3414b51b0639c5b88
Author: Thomas Hellström 
Date:   Fri Dec 19 12:32:57 2025 +0100

    drm/xe/svm: Fix a debug printout
    
    Avoid spamming the log with drm_info(). Use drm_dbg() instead.
    
    Fixes: cc795e041034 ("drm/xe/svm: Make xe_svm_range_needs_migrate_to_vram() public")
    Cc: Matthew Brost 
    Cc: Himal Prasad Ghimiray 
    Cc:  # v6.17+
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Himal Prasad Ghimiray 
    Link: https://patch.msgid.link/20251219113320.183860-2-thomas.hellstrom@linux.intel.com

commit 7105e968d1f6f6753f8fc3c47b8a705b6dad36d4
Author: Chen-Yu Tsai 
Date:   Sun Dec 21 14:47:52 2025 +0800

    dmaengine: sun6i: Add debug messages for cyclic DMA prepare
    
    The driver already has debug messages for memcpy and linear transfers,
    but is missing them for cyclic transfers.
    
    Cyclic transfers are one of the main uses of the DMA controller, used
    for audio data transfers. And since these are likely the first DMA
    peripherals to be enabled, it helps to have these debug messages.
    
    Acked-by: Jernej Skrabec 
    Signed-off-by: Chen-Yu Tsai 
    Link: https://patch.msgid.link/20251221064754.1783369-1-wens@kernel.org
    Signed-off-by: Vinod Koul 

commit 7178c3586ab42693b28bb81014320a7783e5c435
Author: Chen-Yu Tsai 
Date:   Sun Dec 21 16:04:48 2025 +0800

    dmaengine: sun6i: Choose appropriate burst length under maxburst
    
    maxburst, as provided by the client, specifies the largest amount of
    data that is allowed to be transferred in one burst. This limit is
    normally provided to avoid a data burst overflowing the target FIFO.
    It does not mean that the DMA engine can only do bursts in that size.
    
    Let the driver pick the largest supported burst length within the
    given limit. This lets the driver work correctly with some clients that
    give a large maxburst value. In particular, the 8250_dw driver will give
    a quarter of the UART's FIFO size as maxburst. On some systems the FIFO
    size is 256 bytes, giving a maxburst of 64 bytes, while the hardware
    only supports bursts of up to 16 bytes.
    
    Signed-off-by: Chen-Yu Tsai 
    Reviewed-by: Jernej Skrabec 
    Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org
    Signed-off-by: Vinod Koul 

commit 98b9f207afa53aff2edb0e52910c4348b456b37d
Author: Thomas Weißschuh 
Date:   Mon Dec 22 09:04:13 2025 +0100

    dmaengine: idxd: uapi: use UAPI types
    
    Using libc types and headers from the UAPI headers is problematic as it
    introduces a dependency on a full C toolchain.
    
    Use the fixed-width integer types provided by the UAPI headers instead.
    
    Signed-off-by: Thomas Weißschuh 
    Acked-by: Arnd Bergmann 
    Link: https://patch.msgid.link/20251222-uapi-idxd-v1-1-baa183adb20d@linutronix.de
    Signed-off-by: Vinod Koul 

commit b442377c0ea2044a8f50ffa3fe59448f9ed922c9
Author: Rafael J. Wysocki 
Date:   Mon Dec 22 21:33:25 2025 +0100

    dmaengine: sh: Discard pm_runtime_put() return value
    
    Clobbering an error value to be returned from shdma_tx_submit() with
    a pm_runtime_put() return value is not particularly useful, especially
    if the latter is 0, so stop doing that.
    
    This will facilitate a planned change of the pm_runtime_put() return
    type to void in the future.
    
    Signed-off-by: Rafael J. Wysocki 
    Link: https://patch.msgid.link/9626129.rMLUfLXkoz@rafael.j.wysocki
    Signed-off-by: Vinod Koul 

commit ef8405a4f8ca9b15743d024ce00b99480ce173ea
Author: Prasad Kumpatla 
Date:   Wed Nov 5 17:49:10 2025 +0530

    dt-bindings: soundwire: qcom: Add SoundWire v2.2.0 compatible
    
    Add qcom,soundwire-v2.2.0 to the list of supported Qualcomm
    SoundWire controller versions. This version falls back to
    qcom,soundwire-v2.0.0 if not explicitly handled by the driver.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Prasad Kumpatla 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251105-knp-audio-v2-v4-1-ae0953f02b44@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit 866160a51f5586d53e17ceab36029c8805ffea28
Author: Uwe Kleine-König 
Date:   Mon Dec 15 18:49:26 2025 +0100

    soundwire: Use bus methods for .probe(), .remove() and .shutdown()
    
    These are nearly identical to the respective driver callbacks. The only
    differences are that .remove() returns void instead of int and .shutdown()
    has to cope for unbound devices.
    
    The objective is to get rid of users of struct device_driver callbacks
    .probe(), .remove() and .shutdown() to eventually remove these.
    
    Signed-off-by: Uwe Kleine-König 
    Link: https://patch.msgid.link/20251215174925.1327021-6-u.kleine-koenig@baylibre.com
    Signed-off-by: Vinod Koul 

commit 478f3890709a092a97a0218f61af19ac9b725573
Author: Uwe Kleine-König 
Date:   Mon Dec 15 18:49:25 2025 +0100

    soundwire: Make remove function return no value
    
    All remove functions return zero and the driver core ignores any other
    returned value (just emits a warning about it being ignored). So make all
    remove callbacks return void instead of an ignored int. This is in line
    with most other subsystems.
    
    Signed-off-by: Uwe Kleine-König 
    Link: https://patch.msgid.link/20251215174925.1327021-5-u.kleine-koenig@baylibre.com
    Signed-off-by: Vinod Koul 

commit ac1c5bc7c4c7e20e2070e6eaa673fc3e11619dbb
Author: Daniel Gomez 
Date:   Sat Dec 20 04:48:09 2025 +0100

    bpf: crypto: replace -EEXIST with -EBUSY
    
    The -EEXIST error code is reserved by the module loading infrastructure
    to indicate that a module is already loaded. When a module's init
    function returns -EEXIST, userspace tools like kmod interpret this as
    "module already loaded" and treat the operation as successful, returning
    0 to the user even though the module initialization actually failed.
    
    This follows the precedent set by commit 54416fd76770 ("netfilter:
    conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
    issue in nf_conntrack_helper_register().
    
    This affects bpf_crypto_skcipher module. While the configuration
    required to build it as a module is unlikely in practice, it is
    technically possible, so fix it for correctness.
    
    Signed-off-by: Daniel Gomez 
    Acked-by: Vadim Fedorenko 
    Link: https://lore.kernel.org/r/20251220-dev-module-init-eexists-bpf-v1-1-7f186663dbe7@samsung.com
    Signed-off-by: Alexei Starovoitov 

commit b0004a82239212b4a6ed210c29dcbb4149769c81
Merge: 042d4c0642b35f 83dd46ecb68ecc
Author: Alexei Starovoitov 
Date:   Mon Dec 22 22:23:38 2025 -0800

    Merge branch 'allow-calling-kfuncs-from-raw_tp-programs'
    
    Puranjay Mohan says:
    
    ====================
    Allow calling kfuncs from raw_tp programs
    
    V1: https://lore.kernel.org/all/20251218145514.339819-1-puranjay@kernel.org/
    Changes in V1->V2:
    - Update selftests to allow success for raw_tp programs calling kfuncs.
    
    This set enables calling kfuncs from raw_tp programs.
    ====================
    
    Link: https://patch.msgid.link/20251222133250.1890587-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 83dd46ecb68ecc03cff23e68490ded5d40d79f66
Author: Puranjay Mohan 
Date:   Mon Dec 22 05:32:46 2025 -0800

    selftests: bpf: fix tests with raw_tp calling kfuncs
    
    As the previous commit allowed raw_tp programs to call kfuncs, so of the
    selftests that were expected to fail will now succeed.
    
    Signed-off-by: Puranjay Mohan 
    Acked-by: Yonghong Song 
    Link: https://lore.kernel.org/r/20251222133250.1890587-3-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 342297d51146b1a3184e53925901a0cc282b3f76
Author: Puranjay Mohan 
Date:   Mon Dec 22 05:32:45 2025 -0800

    bpf: allow calling kfuncs from raw_tp programs
    
    Associate raw tracepoint program type with the kfunc tracing hook. This
    allows calling kfuncs from raw_tp programs.
    
    Signed-off-by: Puranjay Mohan 
    Acked-by: Yonghong Song 
    Link: https://lore.kernel.org/r/20251222133250.1890587-2-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 042d4c0642b35facee87628a61d81cc77debbc41
Merge: f785a31395d9ca 6e57cdde70c10f
Author: Alexei Starovoitov 
Date:   Mon Dec 22 22:20:22 2025 -0800

    Merge branch 'mm-bpf-kfuncs-to-access-memcg-data'
    
    Roman Gushchin says:
    
    ====================
    mm: bpf kfuncs to access memcg data
    
    Introduce kfuncs to simplify the access to the memcg data.
    These kfuncs can be used to accelerate monitoring use cases and
    for implementing custom OOM policies once BPF OOM is landed.
    
    This patchset was separated out from the BPF OOM patchset to simplify
    the logistics and accelerate the landing of the part which is useful
    by itself. No functional changes since BPF OOM v2.
    
    v4:
      - refactored memcg vm event and stat item idx checks (by Alexei)
    
    v3:
      - dropped redundant kfuncs flags (by Alexei)
      - fixed kdocs warnings (by Alexei)
      - merged memcg stats access patches into one (by Alexei)
      - restored root memcg usage reporting, added a comment
      - added checks for enum boundaries
      - added Shakeel and JP as co-maintainers (by Shakeel)
    
    v2:
      - added mem_cgroup_disabled() checks (by Shakeel B.)
      - added special handling of the root memcg in bpf_mem_cgroup_usage()
      (by Shakeel B.)
      - minor fixes in the kselftest (by Shakeel B.)
      - added a MAINTAINERS entry (by Shakeel B.)
    
    v1:
      https://lore.kernel.org/bpf/87ike29s5r.fsf@linux.dev/T/#t
    ====================
    
    Link: https://patch.msgid.link/20251223044156.208250-1-roman.gushchin@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 6e57cdde70c10f4654356cc45467ebce0a5c3f88
Author: Roman Gushchin 
Date:   Mon Dec 22 20:41:56 2025 -0800

    MAINTAINERS: add an entry for MM BPF extensions
    
    Let's create a separate entry for MM BPF extensions: these patches
    often require an attention from both bpf and mm communities.
    
    Signed-off-by: Roman Gushchin 
    Link: https://lore.kernel.org/r/20251223044156.208250-7-roman.gushchin@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 6bce6ddbe634bbc6d21672b5bfdbb5ad0409bd8d
Author: JP Kobryn 
Date:   Mon Dec 22 20:41:55 2025 -0800

    bpf: selftests: selftests for memcg stat kfuncs
    
    Add test coverage for the kfuncs that fetch memcg stats. Using some common
    stats, test scenarios ensuring that the given stat increases by some
    arbitrary amount. The stats selected cover the three categories represented
    by the enums: node_stat_item, memcg_stat_item, vm_event_item.
    
    Since only a subset of all stats are queried, use a static struct made up
    of fields for each stat. Write to the struct with the fetched values when
    the bpf program is invoked and read the fields in the user mode program for
    verification.
    
    Signed-off-by: JP Kobryn 
    Signed-off-by: Roman Gushchin 
    Link: https://lore.kernel.org/r/20251223044156.208250-6-roman.gushchin@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 99430ab8b804c26b8a0dec93fcbfe75469f3edc7
Author: Roman Gushchin 
Date:   Mon Dec 22 20:41:54 2025 -0800

    mm: introduce BPF kfuncs to access memcg statistics and events
    
    Introduce BPF kfuncs to conveniently access memcg data:
      - bpf_mem_cgroup_vm_events(),
      - bpf_mem_cgroup_memory_events(),
      - bpf_mem_cgroup_usage(),
      - bpf_mem_cgroup_page_state(),
      - bpf_mem_cgroup_flush_stats().
    
    These functions are useful for implementing BPF OOM policies, but
    also can be used to accelerate access to the memcg data. Reading
    it through cgroupfs is much more expensive, roughly 5x, mostly
    because of the need to convert the data into the text and back.
    
    JP Kobryn:
    An experiment was setup to compare the performance of a program that
    uses the traditional method of reading memory.stat vs a program using
    the new kfuncs. The control program opens up the root memory.stat file
    and for 1M iterations reads, converts the string values to numeric data,
    then seeks back to the beginning. The experimental program sets up the
    requisite libbpf objects and for 1M iterations invokes a bpf program
    which uses the kfuncs to fetch all available stats for node_stat_item,
    memcg_stat_item, and vm_event_item types.
    
    The results showed a significant perf benefit on the experimental side,
    outperforming the control side by a margin of 93%. In kernel mode,
    elapsed time was reduced by 80%, while in user mode, over 99% of time
    was saved.
    
    control: elapsed time
    real    0m38.318s
    user    0m25.131s
    sys     0m13.070s
    
    experiment: elapsed time
    real    0m2.789s
    user    0m0.187s
    sys     0m2.512s
    
    control: perf data
    33.43% a.out libc.so.6         [.] __vfscanf_internal
     6.88% a.out [kernel.kallsyms] [k] vsnprintf
     6.33% a.out libc.so.6         [.] _IO_fgets
     5.51% a.out [kernel.kallsyms] [k] format_decode
     4.31% a.out libc.so.6         [.] __GI_____strtoull_l_internal
     3.78% a.out [kernel.kallsyms] [k] string
     3.53% a.out [kernel.kallsyms] [k] number
     2.71% a.out libc.so.6         [.] _IO_sputbackc
     2.41% a.out [kernel.kallsyms] [k] strlen
     1.98% a.out a.out             [.] main
     1.70% a.out libc.so.6         [.] _IO_getline_info
     1.51% a.out libc.so.6         [.] __isoc99_sscanf
     1.47% a.out [kernel.kallsyms] [k] memory_stat_format
     1.47% a.out [kernel.kallsyms] [k] memcpy_orig
     1.41% a.out [kernel.kallsyms] [k] seq_buf_printf
    
    experiment: perf data
    10.55% memcgstat bpf_prog_..._query [k] bpf_prog_16aab2f19fa982a7_query
     6.90% memcgstat [kernel.kallsyms]  [k] memcg_page_state_output
     3.55% memcgstat [kernel.kallsyms]  [k] _raw_spin_lock
     3.12% memcgstat [kernel.kallsyms]  [k] memcg_events
     2.87% memcgstat [kernel.kallsyms]  [k] __memcg_slab_post_alloc_hook
     2.73% memcgstat [kernel.kallsyms]  [k] kmem_cache_free
     2.70% memcgstat [kernel.kallsyms]  [k] entry_SYSRETQ_unsafe_stack
     2.25% memcgstat [kernel.kallsyms]  [k] __memcg_slab_free_hook
     2.06% memcgstat [kernel.kallsyms]  [k] get_page_from_freelist
    
    Signed-off-by: Roman Gushchin 
    Co-developed-by: JP Kobryn 
    Signed-off-by: JP Kobryn 
    Link: https://lore.kernel.org/r/20251223044156.208250-5-roman.gushchin@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 5c7db3239c9fbe3c62cb0d89b64959ea23af2de9
Author: Roman Gushchin 
Date:   Mon Dec 22 20:41:53 2025 -0800

    mm: introduce bpf_get_root_mem_cgroup() BPF kfunc
    
    Introduce a BPF kfunc to get a trusted pointer to the root memory
    cgroup. It's very handy to traverse the full memcg tree, e.g.
    for handling a system-wide OOM.
    
    It's possible to obtain this pointer by traversing the memcg tree
    up from any known memcg, but it's sub-optimal and makes BPF programs
    more complex and less efficient.
    
    bpf_get_root_mem_cgroup() has a KF_ACQUIRE | KF_RET_NULL semantics,
    however in reality it's not necessary to bump the corresponding
    reference counter - root memory cgroup is immortal, reference counting
    is skipped, see css_get(). Once set, root_mem_cgroup is always a valid
    memcg pointer. It's safe to call bpf_put_mem_cgroup() for the pointer
    obtained with bpf_get_root_mem_cgroup(), it's effectively a no-op.
    
    Signed-off-by: Roman Gushchin 
    Link: https://lore.kernel.org/r/20251223044156.208250-4-roman.gushchin@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 5904db9891f80f84283648121e2d8c8a506296a8
Author: Roman Gushchin 
Date:   Mon Dec 22 20:41:52 2025 -0800

    mm: introduce BPF kfuncs to deal with memcg pointers
    
    To effectively operate with memory cgroups in BPF there is a need
    to convert css pointers to memcg pointers. A simple container_of
    cast which is used in the kernel code can't be used in BPF because
    from the verifier's point of view that's a out-of-bounds memory access.
    
    Introduce helper get/put kfuncs which can be used to get
    a refcounted memcg pointer from the css pointer:
      - bpf_get_mem_cgroup,
      - bpf_put_mem_cgroup.
    
    bpf_get_mem_cgroup() can take both memcg's css and the corresponding
    cgroup's "self" css. It allows it to be used with the existing cgroup
    iterator which iterates over cgroup tree, not memcg tree.
    
    Signed-off-by: Roman Gushchin 
    Link: https://lore.kernel.org/r/20251223044156.208250-3-roman.gushchin@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit 4221de8c410e7adb1114a4374c78fa4269175343
Author: Roman Gushchin 
Date:   Mon Dec 22 20:41:51 2025 -0800

    mm: declare memcg_page_state_output() in memcontrol.h
    
    To use memcg_page_state_output() in bpf_memcontrol.c move the
    declaration from v1-specific memcontrol-v1.h to memcontrol.h.
    
    Signed-off-by: Roman Gushchin 
    Acked-by: Michal Hocko 
    Acked-by: Shakeel Butt 
    Link: https://lore.kernel.org/r/20251223044156.208250-2-roman.gushchin@linux.dev
    Signed-off-by: Alexei Starovoitov 

commit af04c1e8e7a92540ba8649c815c6f35b5a424616
Author: Rohit Chourasia 
Date:   Thu Dec 11 21:49:11 2025 +0530

    wifi: rtlwifi: fix typo 'received' in comment
    
    Fix typo received -> received by review.
    
    Signed-off-by: Rohit Chourasia 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251211161911.30611-1-chourasiarohit27@gmail.com

commit 714d81423e9948fcdb4e3eb948ec188ffd2ac131
Author: Zqiang 
Date:   Mon Dec 22 19:53:18 2025 +0800

    sched_ext: Avoid multiple irq_work_queue() calls in destroy_dsq()
    
    llist_add() returns true only when adding to an empty list, which indicates
    that no IRQ work is currently queued or running. Therefore, we only need to
    call irq_work_queue() when llist_add() returns true, to avoid unnecessarily
    re-queueing IRQ work that is already pending or executing.
    
    Signed-off-by: Zqiang 
    Reviewed-by: Andrea Righi 
    Signed-off-by: Tejun Heo 

commit d3a9e132a4c6273a5254e743da14887502e928c8
Author: Ping-Ke Shih 
Date:   Wed Dec 17 15:26:46 2025 +0800

    wifi: rtw89: correct use sequence of driver_data in skb->info
    
    As ieee80211_tx_info is used to assist filling TX descriptor, and layout of
    IEEE80211_SKB_CB(skb)->driver_data (accessing by RTW89_TX_SKB_CB()) is
    union, so driver_data must be used by/after rtw89_hci_tx_write() or just
    before calling rtw89_hci_tx_write(). Otherwise, ieee80211_tx_info::control
    data is overwritten.
    
    Found this by using injected packets which uses ieee80211_tx_info::control,
    but always sending incorrect data rate.
    
    Cc: Fedor Pchelkin 
    Fixes: d5da3d9fb05f ("wifi: rtw89: process TX wait skbs for USB via C2H handler")
    Signed-off-by: Ping-Ke Shih 
    Tested-by: Fedor Pchelkin 
    Link: https://patch.msgid.link/20251217072646.43209-1-pkshih@realtek.com

commit a2f1fc9ab6fb0d5c9d701a516c342944258fb20e
Author: Jan Gerber 
Date:   Fri Dec 12 01:54:21 2025 +0100

    wifi: rtw89: 8852au: add support for TP TX30U Plus
    
    the device shows up like this and everything seams to work:
    
    Bus 004 Device 003: ID 3625:010d Realtek 802.11ax WLAN Adapter
    
    Signed-off-by: Jan Gerber 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251212005515.2059533-1-j@mailb.org

commit 36f2deb2f55f1d72800758e3eeaac17fe31dffe0
Author: Marco Crivellari 
Date:   Wed Dec 10 11:12:09 2025 +0100

    wifi: rtw89: add WQ_PERCPU to alloc_workqueue users
    
    This continues the effort to refactor workqueue APIs, which began with
    the introduction of new workqueues and a new alloc_workqueue flag in:
    
       commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
       commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    The refactoring is going to alter the default behavior of
    alloc_workqueue() to be unbound by default.
    
    With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
    any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
    must now use WQ_PERCPU. For more details see the Link tag below.
    
    In order to keep alloc_workqueue() behavior identical, explicitly request
    WQ_PERCPU.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251210101209.47176-1-marco.crivellari@suse.com

commit 41be33d3efc120f6a2c02d12742655f2aa09e1b6
Author: Jose Ignacio Tornos Martinez 
Date:   Wed Nov 26 10:18:56 2025 +0100

    wifi: rtw89: 8922a: set random mac if efuse contains zeroes
    
    I have some rtl8922ae devices with no permanent mac stored in efuse.
    
    It could be properly saved and/or configured from user tools like
    NetworkManager, but it would be desirable to be able to initialize it
    somehow to get the device working by default.
    
    So, in the same way as with other devices, if the mac address read from
    efuse contains zeros, a random mac address is assigned to at least allow
    operation, and the user is warned about this in case any action needs to
    be considered.
    
    Signed-off-by: Jose Ignacio Tornos Martinez 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251126091905.217951-1-jtornosm@redhat.com

commit 269679bdd17cdd4dc3f1f2448f76554932d7de3f
Author: Chen Ridong 
Date:   Sat Dec 20 10:15:57 2025 +0000

    cpuset: remove dead code in cpuset-v1.c
    
    The commit 6e1d31ce495c ("cpuset: separate generate_sched_domains for v1
    and v2") introduced dead code that was originally added for cpuset-v2
    partition domain generation. Remove the redundant root_load_balance check.
    
    Fixes: 6e1d31ce495c ("cpuset: separate generate_sched_domains for v1 and v2")
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/cgroups/9a442808-ed53-4657-988b-882cc0014c0d@huaweicloud.com/T/
    Signed-off-by: Chen Ridong 
    Reviewed-by: Waiman Long 
    Signed-off-by: Tejun Heo 

commit 77653c327e11c71c5363b18a53fbf2b92ed21da4
Author: Hsiu-Ming Chang 
Date:   Fri Dec 5 08:32:04 2025 +0800

    wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
    
    Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB
    Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105.
    
    Signed-off-by: Hsiu-Ming Chang 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com

commit 44d1f624bbdd2d60319374ba85f7195a28d00c90
Author: Bitterblue Smith 
Date:   Sun Nov 30 16:50:31 2025 +0200

    wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
    
    rtw8822b_set_antenna() can be called from userspace when the chip is
    powered off. In that case a WARNING is triggered in
    rtw8822b_config_trx_mode() because trying to read the RF registers
    when the chip is powered off returns an unexpected value.
    
    Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when
    the chip is powered on.
    
    ------------[ cut here ]------------
    write RF mode table fail
    WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
    CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G        W  OE       6.17.5-arch1-1 #1 PREEMPT(full)  01c39fc421df2af799dd5e9180b572af860b40c1
    Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
    Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021
    RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
    Call Trace:
     
     rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]
     rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]
     ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]
     nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
     ? netdev_run_todo+0x63/0x550
     genl_family_rcv_msg_doit+0xfc/0x160
     genl_rcv_msg+0x1aa/0x2b0
     ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
     ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
     ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
     ? __pfx_genl_rcv_msg+0x10/0x10
     netlink_rcv_skb+0x59/0x110
     genl_rcv+0x28/0x40
     netlink_unicast+0x285/0x3c0
     ? __alloc_skb+0xdb/0x1a0
     netlink_sendmsg+0x20d/0x430
     ____sys_sendmsg+0x39f/0x3d0
     ? import_iovec+0x2f/0x40
     ___sys_sendmsg+0x99/0xe0
     ? refill_obj_stock+0x12e/0x240
     __sys_sendmsg+0x8a/0xf0
     do_syscall_64+0x81/0x970
     ? do_syscall_64+0x81/0x970
     ? ksys_read+0x73/0xf0
     ? do_syscall_64+0x81/0x970
     ? count_memcg_events+0xc2/0x190
     ? handle_mm_fault+0x1d7/0x2d0
     ? do_user_addr_fault+0x21a/0x690
     ? exc_page_fault+0x7e/0x1a0
     entry_SYSCALL_64_after_hwframe+0x76/0x7e
     
    ---[ end trace 0000000000000000 ]---
    
    Link: https://github.com/lwfinger/rtw88/issues/366
    Signed-off-by: Bitterblue Smith 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com

commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443
Author: Roman Peshkichev 
Date:   Tue Nov 25 23:09:37 2025 +0500

    wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
    
    The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter,
    while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf.
    In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0.
    
    The driver unconditionally wrote (dtim_period - 1) to
    REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This
    caused delays in broadcast/multicast traffic processing and issues with
    ad-hoc operation.
    
    Convert the function parameter to u8 to match ieee80211_bss_conf and avoid
    the underflow by writing 0 when dtim_period is 0.
    
    Link: https://github.com/lwfinger/rtw88/issues/406
    Signed-off-by: Roman Peshkichev 
    Acked-by: Ping-Ke Shih 
    Signed-off-by: Ping-Ke Shih 
    Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com

commit 99735a742f7e9a3e7f4cb6c58edf1b38101e7657
Author: Inochi Amaoto 
Date:   Fri Dec 19 09:28:18 2025 +0800

    clk: spacemit: Hide common clock driver from user controller
    
    Since the common clock driver is only a dependency for other spacemit
    clock driver, it should not be enabled individually, so hide this in
    the Kconfig UI and let other spacemit clock driver select it.
    
    Signed-off-by: Inochi Amaoto 
    Reviewed-by: Yixun Lan 
    Link: https://lore.kernel.org/r/20251219012819.440972-3-inochiama@gmail.com
    Signed-off-by: Yixun Lan 

commit 5ec8cbbc54c82c0bdae4dbf0e5aecf9817bde2b9
Author: Inochi Amaoto 
Date:   Fri Dec 19 09:28:17 2025 +0800

    clk: spacemit: Respect Kconfig setting when building modules
    
    Currently, the SPACEMIT_CCU entry is only a switch for enabling entry
    SPACEMIT_K1_CCU. It does not guide the build for common clock codes
    even if it is a tristate entry. This makes this entry useless.
    
    Change the Makefile to add a separate build for common clock logic,
    so the SPACEMIT_CCU entry takes effect, also add necessary
    MODULE_LICENSE()/MODULE_DESCRIPTION()/EXPORT_SYMBOL() for the module
    build.
    
    Fixes: 1b72c59db0ad ("clk: spacemit: Add clock support for SpacemiT K1 SoC")
    Signed-off-by: Inochi Amaoto 
    Reviewed-by: Yixun Lan 
    Link: https://lore.kernel.org/r/20251219012819.440972-2-inochiama@gmail.com
    Signed-off-by: Yixun Lan 

commit 6fd8a09f48d6fee184207f4e15e939898a3947f9
Author: Ryusuke Konishi 
Date:   Sat Dec 20 03:04:27 2025 +0900

    nilfs2: fix missing struct keywords in nilfs2_api.h kernel-doc
    
    Eliminate the following kernel-doc warnings in nilfs2_api.h:
    
    Warning: include/uapi/linux/nilfs2_api.h:65 cannot understand function
     prototype: 'struct nilfs_suinfo'
    Warning: include/uapi/linux/nilfs2_api.h:101 cannot understand function
     prototype: 'struct nilfs_suinfo_update'
    
    This ensures that the documentation for nilfs_suinfo and
    nilfs_suinfo_update is correctly parsed and generated by adding the
    missing 'struct' keyword to their kernel-doc comments.
    
    Signed-off-by: Ryusuke Konishi 
    Signed-off-by: Viacheslav Dubeyko 

commit cb8fe62f87ad21f4c174aec480694c9b4b8b01c4
Author: Randy Dunlap 
Date:   Sat Dec 20 03:04:26 2025 +0900

    nilfs2: convert nilfs_super_block to kernel-doc
    
    Eliminate 40+ kernel-doc warnings in nilfs2_ondisk.h by converting
    all of the struct member comments to kernel-doc comments.
    
    Fix one misnamed struct member in nilfs_direct_node.
    
    Object files before and after are the same size and content.
    
    Examples of warnings:
    Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member 's_rev_level'
     not described in 'nilfs_super_block'
    Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member
     's_minor_rev_level' not described in 'nilfs_super_block'
    Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member 's_magic'
     not described in 'nilfs_super_block'
    Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member 's_bytes'
     not described in 'nilfs_super_block'
    Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member 's_flags'
     not described in 'nilfs_super_block'
    
    Signed-off-by: Randy Dunlap 
    Signed-off-by: Ryusuke Konishi 
    Signed-off-by: Viacheslav Dubeyko 

commit ed527ef0c264e4bed6c7b2a158ddf516b17f5f66
Author: Edward Adam Davis 
Date:   Sat Dec 20 03:04:25 2025 +0900

    nilfs2: Fix potential block overflow that cause system hang
    
    When a user executes the FITRIM command, an underflow can occur when
    calculating nblocks if end_block is too small. Since nblocks is of
    type sector_t, which is u64, a negative nblocks value will become a
    very large positive integer. This ultimately leads to the block layer
    function __blkdev_issue_discard() taking an excessively long time to
    process the bio chain, and the ns_segctor_sem lock remains held for a
    long period. This prevents other tasks from acquiring the ns_segctor_sem
    lock, resulting in the hang reported by syzbot in [1].
    
    If the ending block is too small, typically if it is smaller than 4KiB
    range, depending on the usage of the segment 0, it may be possible to
    attempt a discard request beyond the device size causing the hang.
    
    Exiting successfully and assign the discarded size (0 in this case)
    to range->len.
    
    Although the start and len values in the user input range are too small,
    a conservative strategy is adopted here to safely ignore them, which is
    equivalent to a no-op; it will not perform any trimming and will not
    throw an error.
    
    [1]
    task:segctord state:D stack:28968 pid:6093 tgid:6093  ppid:2 task_flags:0x200040 flags:0x00080000
    Call Trace:
     rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272
     nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357
     nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline]
     nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684
    
    [ryusuke: corrected part of the commit message about the consequences]
    
    Fixes: 82e11e857be3 ("nilfs2: add nilfs_sufile_trim_fs to trim clean segs")
    Reported-by: syzbot+7eedce5eb281acd832f0@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=7eedce5eb281acd832f0
    Signed-off-by: Edward Adam Davis 
    Signed-off-by: Ryusuke Konishi 
    Cc: stable@vger.kernel.org
    Signed-off-by: Viacheslav Dubeyko 

commit 7f3c3a0a9103dc92c823f27db3284ac2914e7558
Author: Lukas Bulwahn 
Date:   Thu Nov 27 16:43:43 2025 +0100

    MAINTAINERS: Add doc files on real-time support to Real-time Linux
    
    Commit f51fe3b7e48c ("Documentation: Add real-time to core-api") adds new
    documentation on real-time support, i.e., PREEMPT_RT. So, add a file entry
    for that directory to the corresponding section in MAINTAINERS.
    
    Signed-off-by: Lukas Bulwahn 
    Signed-off-by: Sebastian Andrzej Siewior 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251127154343.292156-4-bigeasy@linutronix.de>

commit 6c95f2d67f7da7175b9bbb3e92284412aa074a98
Author: Lukas Bulwahn 
Date:   Thu Nov 27 16:43:42 2025 +0100

    Documentation: update config name in real-time architecture support
    
    Commit 4843a45ef9fe8 ("entry: Rename "kvm" entry code assets to "virt"
    to genericize APIs") renames the config KVM_XFER_TO_GUEST_WORK to
    VIRT_XFER_TO_GUEST_WORK.
    
    Adjust the documentation to the current situation, and specifically
    refer to the new name of the config.
    
    Signed-off-by: Lukas Bulwahn 
    Signed-off-by: Sebastian Andrzej Siewior 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251127154343.292156-3-bigeasy@linutronix.de>

commit 7548c69f5167a00d7bbd43be9b6521351f9bedc6
Author: Sebastian Andrzej Siewior 
Date:   Thu Nov 27 16:43:41 2025 +0100

    Documentation: Add some hardware hints for real-time
    
    Some thoughts on hardware that is used for real-time workload. Certainly
    not complete but should cover some of the import topics such as:
    
    - Main memory, caches and the possiblie control given by the hardware.
    - What could happen by putting critical hardware behind USB or VirtIO.
    - Allowing real-time tasks to consume the CPU entirely without giving
      the system some time to breath.
    - Networking with what the kernel provides.
    
    Reviewed-by: Steven Rostedt (Google) 
    Reviewed-by: Randy Dunlap 
    Signed-off-by: Sebastian Andrzej Siewior 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251127154343.292156-2-bigeasy@linutronix.de>

commit ceddb2c001d9f22fd3712dc0425c3a15bc504461
Author: Willy Tarreau 
Date:   Sat Nov 29 15:17:41 2025 +0100

    Documentation: insist on the plain-text requirement for security reports
    
    As the trend of AI-generated reports is growing, the trend of unreadable
    reports in gimmicky formats is following, and we cannot request that
    developers rely on online viewers to be able to read a security report
    full for formatting tags. Let's just insist on the plain text requirement
    a bit more.
    
    Signed-off-by: Willy Tarreau 
    Signed-off-by: Ingo Molnar 
    Reviewed-by: Greg Kroah-Hartman 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251129141741.19046-1-w@1wt.eu>

commit 273aa250f138c996f351be4a2556043ec8bbc9a5
Author: Uwe Kleine-König 
Date:   Wed Dec 3 08:43:47 2025 +0100

    Documentation: Improve wording on requirements for a free Nitrokey
    
    "listed in MAINTAINERS" is not enough to qualify for the free Nitrokey
    Start. You have to be listed in an M: entry. Mention that to reduce
    confusion for reviewers who wonder why their application fails.
    
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Konstantin Ryabitsev 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251203074349.1826233-2-u.kleine-koenig@baylibre.com>

commit 135739a2a92f9aa08702f01d7d585b34d0b95b16
Author: Geert Uytterhoeven 
Date:   Thu Dec 4 16:14:02 2025 +0100

    Documentation: mailbox: mbox_chan_ops.flush() is optional
    
    When the optional .flush() method was added to the mbox_chan structure,
    the documentation was not updated.
    
    Fixes: a8803d7421cc2be2 ("mailbox: Support blocking transfers in atomic context")
    Signed-off-by: Geert Uytterhoeven 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <6a50a5d4f0d0da26e5cccf348550879e53792e6e.1764861174.git.geert+renesas@glider.be>

commit 7508b208f1c5df75223883be7dbdbcba23425b6e
Author: Soham Metha 
Date:   Thu Dec 4 08:54:52 2025 +0530

    Documentation/rv: Fix dead link to monitor_synthesis.rst
    
    The file 'da_monitor_synthesis.rst' was renamed to 'monitor_synthesis.rst' in
    commit f40a7c06020709
    ("Documentation/rv: Prepare monitor synthesis document for LTL inclusion").
    
    Signed-off-by: Soham Metha 
    Fixes: f40a7c06020709 ("Documentation/rv: Prepare monitor synthesis document for LTL inclusion")
    Acked-by: Gabriele Monaco 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251204032452.9523-1-sohammetha01@gmail.com>

commit 1de54df949535fca2b879cd0bcfd21ce56d2f416
Author: Shubham Sharma 
Date:   Mon Dec 8 01:26:32 2025 +0530

    Documentation: arm: keystone: update DT binding reference
    
    Update the device tree binding reference from .txt to YAML.
    Binding was converted in commit 20b3c9a403ee ("dt-bindings: arm: Convert ti,keystone to DT schema")
    and moved to Documentation/devicetree/bindings/arm/ti/ti,keystone.yaml.
    
    Signed-off-by: Shubham Sharma 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251207195632.68681-1-slopixelz@gmail.com>

commit faa395bcda431961d29c64c9a68645188c76b77f
Author: Addison English 
Date:   Mon Dec 8 01:51:36 2025 -0500

    docs: fix typo in clang-format documentation
    
    The clang-format documentation contains a minor spelling issue where
    "intended" is used instead of "indented" when describing deeply nested
    code. This patch corrects the typo to improve the clarity and consistency.
    
    Signed-off-by: Addison English 
    Acked-by: Randy Dunlap 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251208065136.9092-1-addison.englishw@gmail.com>

commit 9b7688c19c70808a088c9cb3b933d3a5b014d679
Merge: e9af75df38cd7e 4ab48cc63e15cb
Author: Mark Brown 
Date:   Mon Dec 22 22:13:08 2025 +0000

    ASoC: qcom: Constify few things in audioreach and
    
    Merge series from Krzysztof Kozlowski :
    
    Several functions do not modify the pointed memory they receive, so
    marking them as pointers to const would serve as self-explanatory code.
    Also safer a bit.

commit 9dbbd32ecd7bbfa6d3fa150bf8de8bba25e8dab2
Author: Steven Price 
Date:   Thu Dec 11 10:48:49 2025 +0000

    kdoc: allow dots in inline @param names
    
    Inline kernel-doc blocks failed to parse tags containing dots (e.g.
    creator.process_name in panfrost_gem.h) because the @name regex only
    matched word characters. Modify the single-line pattern to match
    doc_inline_sect so it includes \. and parses the same as a multi-line
    comment.
    
    Signed-off-by: Steven Price 
    Acked-by: Randy Dunlap 
    Tested-by: Randy Dunlap 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251211104851.45330-1-steven.price@arm.com>

commit 197bbebd25810c5218e3347d61641be8e49c5404
Author: Andy Shevchenko 
Date:   Wed Nov 26 22:46:07 2025 +0100

    docs: Update documentation to avoid mentioning of kernel.h
    
    For several years, and still ongoing, the kernel.h is being split
    to smaller and narrow headers to avoid "including everything" approach
    which is bad in many ways. Since that, documentation missed a few
    required updates to align with that work. Do it here.
    
    Note, language translations are left untouched and if anybody willing
    to help, please provide path(es) based on the updated English variant.
    
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Randy Dunlap 
    Reviewed-by: Mathieu Poirier 
    Tested-by: Randy Dunlap 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251126214709.2322314-1-andriy.shevchenko@linux.intel.com>

commit 5188f6bd408f937d81c0c37eb59ddc1035cd912c
Author: Max Nikulin 
Date:   Tue Dec 16 21:17:13 2025 +0700

    docs: admin: devices: /dev/sr for SCSI CD-ROM
    
    Don't claim that /dev/sr device names for SCSI CD-ROM drives are
    deprecated and don't recommend /dev/scd alternate names for them.
    
    /dev/scd device names for SCSI CD-ROM drives are not in use for more
    than a decade, see commit [1] that was a part of udev release 174.
    Earlier, related rules were volatile, sometimes /dev/scd were syminks
    to /dev/sr, sometimes vice versa.
    
    Recognizing of root=/dev/scd kernel command line argument was removed
    in kernel 2.5.45 [2].
    
    In the docs /dev/scd became recommended names in 2.6.9 [3].
    Mention of these names appeared much earlier in 1.3.22 [4].
    
    [1] https://git.kernel.org/pub/scm/linux/hotplug/udev.git/commit/?id=d132be4d58
        2011-08-12 14:05:19 +0200 Kay Sievers.
        rules: remove legacy rules for cdrom and usb printer
    
    [2] https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/commit/init?h=v2.5.45&id=51924607bd
        2002-10-29 00:47:58 -0800 Alexander Viro.
        [PATCH] removal of root_dev_names[]
    
    [3] https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/diff/Documentation/devices.txt?h=v2.6.9-rc4&id=a74e11ffeda
        2004-03-16 15:09:38 -0800 Andrew Morton:
        [PATCH] devices.txt: typos and removal of dead devices
    
    [4] https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/tree/Documentation/devices.txt?h=v2.6.9-rc4&id=8f0ec1f9369
        1995-09-01 Linus Torvalds: Import 1.3.22
    
    Signed-off-by: Max Nikulin 
    Reviewed-by: Martin K. Petersen 
    Signed-off-by: Jonathan Corbet 
    Message-ID: 

commit d07e0857dcb647792a939a769fc73c20de20c28a
Merge: 82e87387f6e2af aaacd70fb77afe
Author: Jonathan Corbet 
Date:   Mon Dec 22 14:52:57 2025 -0700

    Merge branch 'mauro-vars' into docs-mw
    
    Mauro says:
    
    As suggested and discussed with Randy, this small series add support
    for documenting variables using kernel-doc.
    
    - patch 1: add support for the new feature;
    - patch 2: extends to support DEFINE_*;
    - patch 3: document two media vars;
    - patch 4: fix an issue on kernel-doc.rst markups and automarkup;
    - patch 5: document it;
    - patch 6: better handle DEFINE_ macros when they don't have static/type;
    
    Since version 5, I'm using "c:macro" to describe variables, as it
    avoids Sphinx C domain to try parse the variable. This makes it more
    flexible and easier to maintain in long term.

commit aaacd70fb77afe75075e8bdf8e493b0af42eeabd
Author: Mauro Carvalho Chehab 
Date:   Tue Dec 16 15:26:17 2025 +0100

    docs: kernel-doc.rst: Parse DEFINE_ macros without prefixes
    
    Currently, the logic for vars require a
            type DEFINE_foo();
    
    where type is usually "static".
    
    Make the logic more generic.
    
    Reported-by: Randy Dunlap 
    Closes: https://lore.kernel.org/linux-doc/e1dad7e4-a0ca-4be6-a33c-97b75175c12f@infradead.org/
    Signed-off-by: Mauro Carvalho Chehab 
    Signed-off-by: Jonathan Corbet 
    Message-ID: 

commit b580fa304c858e35020f02ed733fa1108fa6de48
Author: Mauro Carvalho Chehab 
Date:   Tue Dec 16 15:26:16 2025 +0100

    docs: kernel-doc.rst: document the new "var" kernel-doc markup
    
    Add a description containing the new syntax to document
    variables within kernel-doc markups.
    
    Reviewed-by: Randy Dunlap 
    Signed-off-by: Mauro Carvalho Chehab 
    Signed-off-by: Jonathan Corbet 
    Message-ID: 

commit 8deb5d725b48ccc0af27bbe924a657db288a215e
Author: Mauro Carvalho Chehab 
Date:   Tue Dec 16 15:26:15 2025 +0100

    docs: kernel-doc.rst: don't let automarkup mangle with consts
    
    This document contains several words that tricks automarkup.
    
    Ensure that all of them will be inside a ``const`` markup,
    avoiding automarkup to touch them.
    
    Signed-off-by: Mauro Carvalho Chehab 
    Reviewed-by: Randy Dunlap 
    Signed-off-by: Jonathan Corbet 
    Message-ID: 

commit bea467aa5da1f51834501da3ac3c40204027a221
Author: Mauro Carvalho Chehab 
Date:   Tue Dec 16 15:26:14 2025 +0100

    docs: media: v4l2-ioctl.h: document two global variables
    
    The media kAPI has two global variables at v4l2-ioctl.h. Document
    them.
    
    Acked-by: Randy Dunlap 
    Tested-by: Randy Dunlap 
    Signed-off-by: Mauro Carvalho Chehab 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <8ebe25ff579962fec09b586f00e77fae7802985f.1765894964.git.mchehab+huawei@kernel.org>

commit bdd1cf87847ff6aaadd53a185209d2bb2db72165
Author: Mauro Carvalho Chehab 
Date:   Tue Dec 16 15:26:13 2025 +0100

    kernel-doc: add support to handle DEFINE_ variables
    
    Improve the parser and output plugin to work with macros,
    adding support for the common pattern of using DEFINE_*
    to create variables.
    
    Signed-off-by: Mauro Carvalho Chehab 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <757a45100cfc493984574ff780aa9d90506eecb4.1765894964.git.mchehab+huawei@kernel.org>

commit 1045ec382c6019b63cab24428783749a1cecc439
Author: Mauro Carvalho Chehab 
Date:   Tue Dec 16 15:26:12 2025 +0100

    kernel-doc: add support for handling global variables
    
    Specially on kAPI, sometimes it is desirable to be able to
    describe global variables that are part of kAPI.
    
    Documenting vars with Sphinx is simple, as we don't need
    to parse a data struct. All we need is the variable
    declaration and use native C domain ::c:var: to format it
    for us.
    
    Add support for it.
    
    Link: https://lore.kernel.org/linux-doc/491c3022-cef8-4860-a945-c9c4a3b63c09@infradead.org/T/#m947c25d95cb1d96a394410ab1131dc8e9e5013f1
    Suggested-by: Randy Dunlap 
    Tested-by: Randy Dunlap 
    Acked-by: Randy Dunlap 
    Signed-off-by: Mauro Carvalho Chehab 
    Signed-off-by: Jonathan Corbet 
    Message-ID: 

commit 82e87387f6e2af9f69a7528733e953fd22e815aa
Author: Thorsten Blum 
Date:   Fri Dec 19 18:18:26 2025 +0100

    Documentation: kernel-hacking: Remove comma
    
    The comma is wrong, remove it.
    
    Signed-off-by: Thorsten Blum 
    Acked-by: Randy Dunlap 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251219171827.44015-2-thorsten.blum@linux.dev>

commit f089d9b2c229bc5d565c13d333a6c86ae47e0b6c
Author: Chen Pei 
Date:   Sat Dec 20 20:54:34 2025 +0800

    docs: kbuild: Fix typos in makefiles.rst
    
    The correct command to generate header files is
    make headers_install.
    
    Signed-off-by: Chen Pei 
    Acked-by: Randy Dunlap 
    Signed-off-by: Jonathan Corbet 
    Message-ID: <20251220125434.2430-1-cp0613@linux.alibaba.com>

commit e9af75df38cd7eb037feca29418d30f92fa4cf7f
Merge: 0bd4b0f583e2a3 99a3ef1e81cd17
Author: Mark Brown 
Date:   Mon Dec 22 19:41:23 2025 +0000

    SDCA Jack Fixups
    
    Merge series from Charles Keepax :
    
    Some fixups to the jack handling, adding some necessary hooks to connect
    things with the machine driver. I have split these out from the system
    suspend chain as that has been generating a fair amount of discussion
    and getting these 3 merged is far more important to get basic
    functionality working smoothly. I will do a spin of the system suspend
    stuff soon, if either no new comments pop up, or we reach some consensus
    on how to proceed.

commit 0bd4b0f583e2a318441fa88ea71b3d7530ecb646
Merge: 8db50f0fa43efe a2a631830deb38
Author: Mark Brown 
Date:   Mon Dec 22 19:41:18 2025 +0000

    ASoC / soc/qcom: Constify APR/GPR callback response
    
    Merge series from Krzysztof Kozlowski :
    
    This constifies the response data used for APR/GPR callbacks.

commit f474911fe16b3baad218d5b8cd499cd8dc3eb3fb
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:58 2025 -0800

    drm/xe/pf: Add debugfs to set EQ and PT for scheduler groups
    
    Debugfs files are added to allow a user to provide a comma-separated list
    of values to assign to each group for each VF.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-26-daniele.ceraolospurio@intel.com

commit be4518128a58f61862bec66621e5d3da254a97ce
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:57 2025 -0800

    drm/xe/pf: Add functions to set preempt timeouts for each group
    
    The KLV to set the preemption timeout for each groups works the exact
    same way as the one for the exec quantums, so we add similar functions.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-25-daniele.ceraolospurio@intel.com

commit 46c9e84cd66dbb9c2304e717f6c9fe4aa0ea5354
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:56 2025 -0800

    drm/xe/pf: Add functions to set exec quantums for each group
    
    The GuC has a new dedicated KLV to set the EQs for the groups. The GuC
    always sets the EQs for all the groups (even the ones not enabled). If
    we provide fewer values than the max number of groups (8), the GuC will
    set the remaining ones to 0 (infinity).
    
    Note that the new KLV can be used even when groups are disabled (as the
    GuC always consider group0 to be active), so we can use it when encoding
    the SRIOV config.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-24-daniele.ceraolospurio@intel.com

commit 627508b391ea53eaacf1185e19998b287f69e5c0
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:55 2025 -0800

    drm/xe/pf: Prep for multiple exec quantums and preemption timeouts
    
    Each scheduler group can be independently configured with its own exec
    quantum and preemption timeouts. The existing KLVs to configure those
    parameters will apply the value to all groups (even if they're not
    enabled at the moment).
    
    When scheduler groups are disabled, the GuC uses the values from Group 0.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-23-daniele.ceraolospurio@intel.com

commit 76242b98d4e46f2124caf08b786b657dbc71e5c9
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:54 2025 -0800

    drm/xe/pf: Add debugfs with scheduler groups information
    
    Under a new subfolder, an entry is created for each group to list the
    engines assigned to them. We create enough entries for each possible
    group, with the disabled groups just returning an empty list.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-22-daniele.ceraolospurio@intel.com

commit b7b106f937170eda2c65ecba5e6bd44bc4b40d46
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:53 2025 -0800

    drm/xe/pf: Add debugfs to enable scheduler groups
    
    Reading the debugfs file lists the available configurations by name.
    Writing the name of a configuration to the file will enable it.
    Note that while this debugfs is PF-only, follow up patches will add some
    debugfs files that are applicable to VF as well, so the function accepts
    a vfid parameter to be ready for that.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-21-daniele.ceraolospurio@intel.com

commit dad13af3985c1d096d3141026d5a534f8aacb4e6
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:52 2025 -0800

    drm/xe/vf: Check if scheduler groups are enabled
    
    VF can check if PF has enabled scheduler groups with a dedicated KLV
    query. If scheduler groups are enabled, MLRC queue registrations are
    forbidden.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-20-daniele.ceraolospurio@intel.com

commit b7fa6016a2bb671306ec2cbd9b3134f903e5d83a
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:51 2025 -0800

    drm/xe/pf: Scheduler groups are incompatible with multi-lrc
    
    Since engines in the same class can be divided across multiple groups,
    the GuC does not allow scheduler groups to be active if there are
    multi-lrc contexts. This means that:
    
    1) if a MLRC context is registered when we enable scheduler groups, the
       GuC will silently ignore the configuration
    2) if a MLRC context is registered after scheduler groups are enabled,
       the GuC will disable the groups and generate an adverse event.
    
    The expectation is that the admin will ensure that all apps that use
    MLRC on PF have been terminated before scheduler groups are created. A
    check is added anyway to make sure we don't still have contexts waiting
    to be cleaned up laying around. A check is also added at queue creation
    time to block MLRC queue creation if scheduler groups have been enabled.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-19-daniele.ceraolospurio@intel.com

commit f04feb5b54419443e9937f5cc871f0612608f650
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:50 2025 -0800

    drm/xe/pf: Add support for enabling scheduler groups
    
    Scheduler groups are enabled by sending a specific policy configuration
    KLV to the GuC. We don't allow changing this policy if there are VF
    active, since the expectation is that the VF will only check if the
    feature is enabled during driver initialization.
    
    While the GuC interface supports a maximum of 8 groups, the actual
    number of groups that can be enabled can be lower than that and
    can be different on different devices. For now, all devices support up
    to 2 groups, so we check that we do not have more groups than that.
    
    The functions added by this patch will be used by sysfs/debugfs, coming
    in follow up patches.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-18-daniele.ceraolospurio@intel.com

commit 50290b7a0df54f908cdf3eb87f52ee01664f3ef4
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:49 2025 -0800

    drm/xe/pf: Initialize scheduler groups
    
    Scheduler groups (a.k.a. Engine Groups Scheduling, or EGS) is a GuC
    feature that allows the driver to define groups of engines that are
    independently scheduled across VFs, which allows different VFs to be
    active on the HW at the same time on different groups. The feature is
    available for BMG and newer HW starting on GuC 70.53.0, but some
    required fixes have been added to GuC 70.55.1.
    
    This is intended for specific scenarios where the admin knows that the
    VFs are not going to fully utilize the HW and therefore assigning all of
    it to a single VF would lead to part of it being permanently idle.
    We do not allow the admin to decide how to divide the engines across
    groups, but we instead support specific configurations that are designed
    for specific use-cases. During PF initialization we detect which
    configurations are possible on a given GT and create the relevant
    groups. Since the GuC expect a mask for each class for each group, that
    is what we save when we init the configs.
    
    Right now we only have one use-case on the media GT. If the VFs are
    running a frame render + encoding at a not-too-high resolution (e.g.
    1080@30fps) the render can produce frames faster than the video engine
    can encode them, which means that the maximum number of parallel VFs is
    limited by the VCS bandwidth. Since our products can have multiple VCS
    engines, allowing multiple VFs to be active on the different VCS engines
    at the same time allows us to run more parallel VFs on the same HW.
    Given that engines in the same media slice share some resources (e.g.
    SFC), we assign each media slice to a different scheduling group. We
    refer to this configuration as "media_slices", given that each slice
    gets its own group. Since upcoming products have a different number of
    video engines per-slice, for now we limit the media_slices mode to BMG,
    but we expect to add support for newer HW soon.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-17-daniele.ceraolospurio@intel.com

commit b0c5cf4f5917bf562082c30879d26ccd572df5a3
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:48 2025 -0800

    drm/gt/guc: extract scheduler-related defines from guc_fwif.h
    
    Some upcoming KLVs are sized based on the engine counts, so we need
    those defines to be moved to a separate file to include them from
    guc_klv_abi.h (which is already included by guc_fwif.h).
    Instead of moving just the engine-related defines, it is cleaner to
    move all scheduler-related defines (i.e., everything engine or context
    related). Note that the legacy GuC defines have not been moved and have
    instead been dropped because Xe doesn't support any GuC old enough to
    still use them.
    
    While at it, struct guc_ctxt_registration_info has been moved to
    guc_submit.c since it doesn't come from the GuC specs (we added it to
    make things simpler in our code).
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-16-daniele.ceraolospurio@intel.com

commit 8d87fa19169eece7133db355b50767dcf0386c44
Author: Daniele Ceraolo Spurio 
Date:   Thu Dec 18 14:38:47 2025 -0800

    drm/xe/gt: Add engine masks for each class
    
    Follow up patches will need the engine masks for VCS and VECS engines.
    Since we already have a macro for the CCS engines, just extend the same
    approach to all classes.
    
    To avoid confusion with the XE_HW_ENGINE_*_MASK masks, the new macros
    use the _INSTANCES suffix instead. For consistency, rename CCS_MASK to
    CCS_INSTANCES as well.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251218223846.1146344-15-daniele.ceraolospurio@intel.com

commit 8db50f0fa43efe8799fd40b872dcdd39a90d7549
Author: Shuming Fan 
Date:   Mon Dec 22 18:13:29 2025 +0800

    ASoC: rt1320: fix the warning the string may be truncated
    
    1488 |                          "realtek/rt1320/rt1320_%s_%s_%s.dat", vendor, product, sku);
         |                                                 ^~             ~~~~~~
    sound/soc/codecs/rt1320-sdw.c:1487:17: note: 'snprintf' output between 29 and 410 bytes into a destination of size 128
    1487 |                 snprintf(filename, sizeof(filename),
         |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    1488 |                          "realtek/rt1320/rt1320_%s_%s_%s.dat", vendor, product, sku);
         |
    
    Fixes: da1682d5e8b5 ("ASoC: rt1320: support calibration and temperature/r0 loading")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512191521.RK0edKdX-lkp@intel.com/
    Signed-off-by: Shuming Fan 
    Link: https://patch.msgid.link/20251222101329.558973-1-shumingf@realtek.com
    Signed-off-by: Mark Brown 

commit 142d5869f6eec3110adda0ad2d931f5b3c22371d
Author: Niklas Cassel 
Date:   Mon Dec 22 07:42:13 2025 +0100

    Revert "PCI: dwc: Don't wait for link up if driver can detect Link Up event"
    
    This reverts commit 8d3bf19f1b585a3cc0027f508b64c33484db8d0d.
    
    While this fake hotplugging was a nice idea, it has shown that this feature
    does not handle PCIe switches correctly:
    pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
    pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
    pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
    pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
    pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
    pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
    pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
    pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
    pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
    pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
    pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
    pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
    
    During the initial scan, PCI core doesn't see the switch and since the Root
    Port is not hot plug capable, the secondary bus number gets assigned as the
    subordinate bus number. This means, the PCI core assumes that only one bus
    will appear behind the Root Port since the Root Port is not hot plug
    capable.
    
    This works perfectly fine for PCIe endpoints connected to the Root Port,
    since they don't extend the bus. However, if a PCIe switch is connected,
    then there is a problem when the downstream busses starts showing up and
    the PCI core doesn't extend the subordinate bus number and bridge resources
    after initial scan during boot.
    
    So revert the change that skipped dw_pcie_wait_for_link() if the Link up
    IRQ was used by a vendor glue driver.
    
    Suggested-by: Manivannan Sadhasivam 
    Signed-off-by: Niklas Cassel 
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Shawn Lin 
    Acked-by: Shawn Lin 
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251222064207.3246632-14-cassel@kernel.org

commit 9a9793b55854422652ea92625e48277c4651c0fd
Author: Niklas Cassel 
Date:   Mon Dec 22 07:42:12 2025 +0100

    Revert "PCI: qcom: Enumerate endpoints based on Link up event in 'global_irq' interrupt"
    
    This reverts commit 4581403f67929d02c197cb187c4e1e811c9e762a.
    
    While this fake hotplugging was a nice idea, it has shown that this feature
    does not handle PCIe switches correctly:
    pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
    pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
    pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
    pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
    pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
    pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
    pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
    pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
    pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
    pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
    pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
    pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
    
    During the initial scan, PCI core doesn't see the switch and since the Root
    Port is not hot plug capable, the secondary bus number gets assigned as the
    subordinate bus number. This means, the PCI core assumes that only one bus
    will appear behind the Root Port since the Root Port is not hot plug
    capable.
    
    This works perfectly fine for PCIe endpoints connected to the Root Port,
    since they don't extend the bus. However, if a PCIe switch is connected,
    then there is a problem when the downstream busses starts showing up and
    the PCI core doesn't extend the subordinate bus number and bridge resources
    after initial scan during boot.
    
    The long term plan is to migrate this driver to the upcoming pwrctrl APIs
    that are supposed to handle this problem elegantly.
    
    Suggested-by: Manivannan Sadhasivam 
    Signed-off-by: Niklas Cassel 
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Shawn Lin 
    Acked-by: Shawn Lin 
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251222064207.3246632-13-cassel@kernel.org

commit 7ebdefb87942073679e56cfbc5a72e8fc5441bfc
Author: Niklas Cassel 
Date:   Mon Dec 22 07:42:11 2025 +0100

    Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported"
    
    This reverts commit ba4a2e2317b9faeca9193ed6d3193ddc3cf2aba3.
    
    Since the Link up IRQ support is going away, revert the MSI logic that got
    added for it too.
    
    Suggested-by: Manivannan Sadhasivam 
    Signed-off-by: Niklas Cassel 
    [mani: reworded the description]
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Shawn Lin 
    Acked-by: Shawn Lin 
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251222064207.3246632-12-cassel@kernel.org

commit e9ce5b3804436301ab343bc14203a4c14b336d1b
Author: Niklas Cassel 
Date:   Mon Dec 22 07:42:10 2025 +0100

    Revert "PCI: qcom: Don't wait for link if we can detect Link Up"
    
    This reverts commit 36971d6c5a9a134c15760ae9fd13c6d5f9a36abb.
    
    While this fake hotplugging was a nice idea, it has shown that this feature
    does not handle PCIe switches correctly:
    pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
    pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
    pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
    pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
    pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
    pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
    pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
    pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
    pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
    pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
    pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
    pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
    
    During the initial scan, PCI core doesn't see the switch and since the Root
    Port is not hot plug capable, the secondary bus number gets assigned as the
    subordinate bus number. This means, the PCI core assumes that only one bus
    will appear behind the Root Port since the Root Port is not hot plug
    capable.
    
    This works perfectly fine for PCIe endpoints connected to the Root Port,
    since they don't extend the bus. However, if a PCIe switch is connected,
    then there is a problem when the downstream busses starts showing up and
    the PCI core doesn't extend the subordinate bus number and bridge resources
    after initial scan during boot.
    
    The long term plan is to migrate this driver to the upcoming pwrctrl APIs
    that are supposed to handle this problem elegantly.
    
    Suggested-by: Manivannan Sadhasivam 
    Signed-off-by: Niklas Cassel 
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Shawn Lin 
    Acked-by: Shawn Lin 
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251222064207.3246632-11-cassel@kernel.org

commit 180c3cfe36786d261a55da52a161f9e279b19a6f
Author: Niklas Cassel 
Date:   Mon Dec 22 07:42:09 2025 +0100

    Revert "PCI: dw-rockchip: Enumerate endpoints based on dll_link_up IRQ"
    
    This reverts commit 0e0b45ab5d770a748487ba0ae8f77d1fb0f0de3e.
    
    While this fake hotplugging was a nice idea, it has shown that this feature
    does not handle PCIe switches correctly:
    pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
    pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
    pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
    pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
    pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
    pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
    pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
    pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
    pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
    pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
    pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
    pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
    
    During the initial scan, PCI core doesn't see the switch and since the Root
    Port is not hot plug capable, the secondary bus number gets assigned as the
    subordinate bus number. This means, the PCI core assumes that only one bus
    will appear behind the Root Port since the Root Port is not hot plug
    capable.
    
    This works perfectly fine for PCIe endpoints connected to the Root Port,
    since they don't extend the bus. However, if a PCIe switch is connected,
    then there is a problem when the downstream busses starts showing up and
    the PCI core doesn't extend the subordinate bus number and bridge resources
    after initial scan during boot.
    
    The long term plan is to migrate this driver to the upcoming pwrctrl APIs
    that are supposed to handle this problem elegantly.
    
    Suggested-by: Manivannan Sadhasivam 
    Signed-off-by: Niklas Cassel 
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Shawn Lin 
    Acked-by: Shawn Lin 
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251222064207.3246632-10-cassel@kernel.org

commit fc6298086bfacaa7003b0bd1da4e4f42b29f7d77
Author: Niklas Cassel 
Date:   Mon Dec 22 07:42:08 2025 +0100

    Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up"
    
    This reverts commit ec9fd499b9c60a187ac8d6414c3c343c77d32e42.
    
    While this fake hotplugging was a nice idea, it has shown that this feature
    does not handle PCIe switches correctly:
    pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
    pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
    pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
    pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
    pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
    pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
    pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
    pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
    pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
    pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
    pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
    pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
    pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
    
    During the initial scan, PCI core doesn't see the switch and since the Root
    Port is not hot plug capable, the secondary bus number gets assigned as the
    subordinate bus number. This means, the PCI core assumes that only one bus
    will appear behind the Root Port since the Root Port is not hot plug
    capable.
    
    This works perfectly fine for PCIe endpoints connected to the Root Port,
    since they don't extend the bus. However, if a PCIe switch is connected,
    then there is a problem when the downstream busses starts showing up and
    the PCI core doesn't extend the subordinate bus number and bridge resources
    after initial scan during boot.
    
    The long term plan is to migrate this driver to the upcoming pwrctrl APIs
    that are supposed to handle this problem elegantly.
    
    Suggested-by: Manivannan Sadhasivam 
    Signed-off-by: Niklas Cassel 
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Shawn Lin 
    Acked-by: Shawn Lin 
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251222064207.3246632-9-cassel@kernel.org

commit 51293e589bafb4281a597986b3416471f67a79c2
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:27:24 2025 +0100

    drm: tyr: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-tyr-v1-1-d88ff1a54ae9@gmail.com
    [ Change commit subject prefix to 'drm: tyr:'. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 48befae0d6eee275c3e30d1cd45f39d6ba011e19
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 13:13:14 2025 +0100

    gpio: zynq: Simplify with device_get_match_data()
    
    Driver's probe function matches against driver's of_device_id table,
    where each entry has non-NULL match data, so of_match_node() can be
    simplified with device_get_match_data().
    
    While changing the error message, switch to dev_err_probe() so error
    path is a bit simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251219-gpio-of-match-v3-3-6b84194a02a8@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit da7c18a457c7a32c4ed1e1e326837d9d7cb4483c
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 13:13:13 2025 +0100

    gpio: creg-snps: Simplify with device_get_match_data()
    
    Driver's probe function matches against driver's of_device_id table,
    where each entry has non-NULL match data, so of_match_node() can be
    simplified with device_get_match_data().
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251219-gpio-of-match-v3-2-6b84194a02a8@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit cecf10b700e06a2f2e2b638b1f680e1ae7f343ac
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 13:13:12 2025 +0100

    gpio: aspeed: Simplify with device_get_match_data()
    
    Driver's probe function matches against driver's of_device_id table,
    where each entry has non-NULL match data, so of_match_node() can be
    simplified with device_get_match_data().
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251219-gpio-of-match-v3-1-6b84194a02a8@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit ee47c0ab23a041e0a34848488dee1a23c0940f21
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:20:05 2025 +0100

    gpu: nova: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Reviewed-by: Alexandre Courbot 
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-nova-v1-1-0e2353d5debe@gmail.com
    [ Use 'nova' commit subject prefix; use kernel vertical import style.
      - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 185c81461ff4987d35fdfc4c8da46ae51ee5ada4
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:23:54 2025 +0100

    samples: rust: pci: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-pci-v1-1-a0397c61bbe4@gmail.com
    [ Use kernel vertical import style. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit b68758e6f4307179247126b7641fa7ba7109c820
Author: Randy Dunlap 
Date:   Sun Dec 14 12:23:57 2025 -0800

    modules: moduleparam.h: fix kernel-doc comments
    
    Fix kernel-doc comments to prevent kernel-doc warnings:
    
    Warning: include/linux/moduleparam.h:364 function parameter 'arg' not
     described in '__core_param_cb'
    Warning: include/linux/moduleparam.h:395 No description found for return
     value of 'parameq'
    Warning: include/linux/moduleparam.h:405 No description found for return
     value of 'parameqn'
    
    Signed-off-by: Randy Dunlap 
    Reviewed-by: Petr Pavlu 
    [Sami: Clarified the commit message]
    Signed-off-by: Sami Tolvanen 

commit 1ae719a43b0336678172b3eb55c5187816f9a130
Author: Coiby Xu 
Date:   Mon Dec 1 11:06:05 2025 +0800

    module: Only declare set_module_sig_enforced when CONFIG_MODULE_SIG=y
    
    Currently if set_module_sig_enforced is called with CONFIG_MODULE_SIG=n
    e.g. [1], it can lead to a linking error,
    
        ld: security/integrity/ima/ima_appraise.o: in function `ima_appraise_measurement':
        security/integrity/ima/ima_appraise.c:587:(.text+0xbbb): undefined reference to `set_module_sig_enforced'
    
    This happens because the actual implementation of
    set_module_sig_enforced comes from CONFIG_MODULE_SIG but both the
    function declaration and the empty stub definition are tied to
    CONFIG_MODULES.
    
    So bind set_module_sig_enforced to CONFIG_MODULE_SIG instead. This
    allows (future) users to call set_module_sig_enforced directly without
    the "if IS_ENABLED(CONFIG_MODULE_SIG)" safeguard.
    
    Note this issue hasn't caused a real problem because all current callers
    of set_module_sig_enforced e.g. security/integrity/ima/ima_efi.c
    use "if IS_ENABLED(CONFIG_MODULE_SIG)" safeguard.
    
    [1] https://lore.kernel.org/lkml/20250928030358.3873311-1-coxu@redhat.com/
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202510030029.VRKgik99-lkp@intel.com/
    Reviewed-by: Aaron Tomlin 
    Reviewed-by: Daniel Gomez 
    Signed-off-by: Coiby Xu 
    Signed-off-by: Sami Tolvanen 

commit 68e85558587e6bbb5c3ea3c8b4c71ab852e4b53e
Author: Kees Cook 
Date:   Wed Nov 19 14:54:43 2025 -0800

    module/decompress: Avoid open-coded kvrealloc()
    
    Replace open-coded allocate/copy with kvrealloc().
    
    Signed-off-by: Kees Cook 
    Reviewed-by: Petr Pavlu 
    Signed-off-by: Sami Tolvanen 

commit ddc54f912a551f6eb0bbcfc3880f45fe27a252cb
Author: Sami Tolvanen 
Date:   Mon Nov 17 20:38:07 2025 +0000

    gendwarfksyms: Fix build on 32-bit hosts
    
    We have interchangeably used unsigned long for some of the types
    defined in elfutils, assuming they're always 64-bit. This obviously
    fails when building gendwarfksyms on 32-bit hosts. Fix the types.
    
    Reported-by: Michal Suchánek 
    Closes: https://lore.kernel.org/linux-modules/aRcxzPxtJblVSh1y@kitsune.suse.cz/
    Tested-by: Michal Suchánek 
    Signed-off-by: Sami Tolvanen 

commit d7afd65b4acc775df872af30948dd7c196587169
Author: Petr Pavlu 
Date:   Tue Nov 11 16:48:32 2025 +0100

    sign-file: Use only the OpenSSL CMS API for signing
    
    The USE_PKCS7 code in sign-file utilizes PKCS7_sign(), which allows signing
    only with SHA-1. Since SHA-1 support for module signing has been removed,
    drop the use of the OpenSSL PKCS7 API by the tool in favor of using only
    the newer CMS API.
    
    The use of the PKCS7 API is selected by the following:
    
     #if defined(LIBRESSL_VERSION_NUMBER) || \
            OPENSSL_VERSION_NUMBER < 0x10000000L || \
            defined(OPENSSL_NO_CMS)
     #define USE_PKCS7
     #endif
    
    Looking at the individual ifdefs:
    
    * LIBRESSL_VERSION_NUMBER: LibreSSL added the CMS API implementation from
      OpenSSL in 3.1.0, making the ifdef no longer relevant. This version was
      released on April 8, 2020.
    
    * OPENSSL_VERSION_NUMBER < 0x10000000L: OpenSSL 1.0.0 was released on March
      29, 2010. Supporting earlier versions should no longer be necessary. The
      file Documentation/process/changes.rst already states that at least
      version 1.0.0 is required to build the kernel.
    
    * OPENSSL_NO_CMS: OpenSSL can be configured with "no-cms" to disable CMS
      support. In this case, sign-file will no longer be usable. The CMS API
      support is now required.
    
    In practice, since distributions now typically sign modules with SHA-2, for
    which sign-file already required CMS API support, removing the USE_PKCS7
    code shouldn't cause any issues.
    
    Signed-off-by: Petr Pavlu 
    Reviewed-by: Sami Tolvanen 
    [Sami: Used Petr's updated commit message]
    Signed-off-by: Sami Tolvanen 

commit 148519a06304af4e6fbb82f20e1a4480e2c1b126
Author: Petr Pavlu 
Date:   Tue Nov 11 16:48:31 2025 +0100

    module: Remove SHA-1 support for module signing
    
    SHA-1 is considered deprecated and insecure due to vulnerabilities that can
    lead to hash collisions. Most distributions have already been using SHA-2
    for module signing because of this. The default was also changed last year
    from SHA-1 to SHA-512 in commit f3b93547b91a ("module: sign with sha512
    instead of sha1 by default"). This was not reported to cause any issues.
    Therefore, it now seems to be a good time to remove SHA-1 support for
    module signing.
    
    Commit 16ab7cb5825f ("crypto: pkcs7 - remove sha1 support") previously
    removed support for reading PKCS#7/CMS signed with SHA-1, along with the
    ability to use SHA-1 for module signing. This change broke iwd and was
    subsequently completely reverted in commit 203a6763ab69 ("Revert "crypto:
    pkcs7 - remove sha1 support""). However, dropping only the support for
    using SHA-1 for module signing is unrelated and can still be done
    separately.
    
    Note that this change only removes support for new modules to be SHA-1
    signed, but already signed modules can still be loaded.
    
    Signed-off-by: Petr Pavlu 
    Reviewed-by: Aaron Tomlin 
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Sami Tolvanen 

commit 581ac2d4a58b81669cc6abf645a558bce5cf14ab
Author: Marco Crivellari 
Date:   Tue Nov 11 10:50:49 2025 +0100

    module: replace use of system_wq with system_dfl_wq
    
    Currently if a user enqueues a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    
    This lack of consistency cannot be addressed without refactoring the API.
    
    This continues the effort to refactor workqueue APIs, which began with
    the introduction of new workqueues and a new alloc_workqueue flag in:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    Switch to using system_dfl_wq, the new unbound workqueue, because the
    users do not benefit from a per-cpu workqueue.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Reviewed-by: Petr Pavlu 
    Signed-off-by: Sami Tolvanen 

commit 3cb0c3bdea5388519bc1bf575dca6421b133302b
Author: Petr Pavlu 
Date:   Tue Aug 19 14:12:09 2025 +0200

    params: Replace __modinit with __init_or_module
    
    Remove the custom __modinit macro from kernel/params.c and instead use the
    common __init_or_module macro from include/linux/module.h. Both provide the
    same functionality.
    
    Signed-off-by: Petr Pavlu 
    Reviewed-by: Aaron Tomlin 
    Reviewed-by: Daniel Gomez 
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Sami Tolvanen 

commit f13bff1b6d55de341f37a24781df5a1253377db3
Author: Petr Pavlu 
Date:   Tue Aug 19 14:13:37 2025 +0200

    module: Remove unused __INIT*_OR_MODULE macros
    
    Remove the __INIT_OR_MODULE, __INITDATA_OR_MODULE and
    __INITRODATA_OR_MODULE macros. These were introduced in commit 8b5a10fc6fd0
    ("x86: properly annotate alternatives.c"). Only __INITRODATA_OR_MODULE was
    ever used, in arch/x86/kernel/alternative.c. In 2011, commit dc326fca2b64
    ("x86, cpu: Clean up and unify the NOP selection infrastructure") removed
    this usage.
    
    Signed-off-by: Petr Pavlu 
    Reviewed-by: Aaron Tomlin 
    Reviewed-by: Daniel Gomez 
    Reviewed-by: Sami Tolvanen 
    Signed-off-by: Sami Tolvanen 

commit d8275cdaf20e5262141dcd12b214cf035d07ed9d
Author: Sami Tolvanen 
Date:   Mon Dec 15 21:55:46 2025 +0000

    MAINTAINERS: Update module subsystem maintainers and repository
    
    Add myself as a maintainer for module support as I'll be handling pull
    requests for the next six months according to the previously announced
    rotation [1][2].  Also, update the git repository link to point to the
    modules tree, which is already used by linux-next.
    
    Link: https://lore.kernel.org/linux-modules/Z3gDAnPlA3SZEbgl@bombadil.infradead.org [1]
    Link: https://lore.kernel.org/linux-modules/20251203234840.3720-1-da.gomez@kernel.org/ [2]
    Acked-by: Daniel Gomez 
    Acked-by: Petr Pavlu 
    Reviewed-by: Aaron Tomlin 
    Signed-off-by: Sami Tolvanen 

commit 652ff12476986bb9aa6749b9dc28c305992e81d0
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:35:33 2025 +0100

    samples: rust: debugfs: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-driver-core-v1-7-1142a177d0fd@gmail.com
    Signed-off-by: Danilo Krummrich 

commit f47a8f595a5ed5a9602d71c31671e121da00c0e6
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:35:32 2025 +0100

    rust: debugfs: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-driver-core-v1-6-1142a177d0fd@gmail.com
    Signed-off-by: Danilo Krummrich 

commit 644672e93a1aa6bfc3ebc102cbf9b8efad16e786
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:35:31 2025 +0100

    rust: irq: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-driver-core-v1-5-1142a177d0fd@gmail.com
    Signed-off-by: Danilo Krummrich 

commit 0250ea325cda689525139ae5f069974e7ed6d886
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:35:30 2025 +0100

    rust: io: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-driver-core-v1-4-1142a177d0fd@gmail.com
    [ Use kernel vertical import style. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 1114c87e49642165a224c28ceaa333e8504ff122
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:35:29 2025 +0100

    rust: platform: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-driver-core-v1-3-1142a177d0fd@gmail.com
    [ Use kernel vertical import style; discard unrelated faux changes.
      - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit f0c6ea853bd7f48aeec231e9378fc17cf36b9109
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:35:28 2025 +0100

    rust: device: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-driver-core-v1-2-1142a177d0fd@gmail.com
    Signed-off-by: Danilo Krummrich 

commit 6fc4b5eb63c7c4c1f2251277ad1f0d04ac047d91
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:35:27 2025 +0100

    rust: auxiliary: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Acked-by: Greg Kroah-Hartman 
    Reviewed-by: Alice Ryhl 
    Reviewed-by: Benno Lossin 
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-driver-core-v1-1-1142a177d0fd@gmail.com
    Signed-off-by: Danilo Krummrich 

commit 9202cef05d6b61a03475b744c7f0622cd8be8e90
Author: Danilo Krummrich 
Date:   Thu Dec 18 17:56:11 2025 +0100

    rust: debugfs: use "kernel vertical" style for imports
    
    Convert all imports in the debugfs Rust module to use "kernel vertical"
    style.
    
    With this subsequent patches neither introduce unrelated changes nor
    leave an inconsistent import pattern.
    
    While at it, drop unnecessary imports covered by prelude::*.
    
    Link: https://docs.kernel.org/rust/coding-guidelines.html#imports
    Acked-by: Greg Kroah-Hartman 
    Link: https://patch.msgid.link/20251218165626.450264-1-dakr@kernel.org
    [ Apply the same change to the debugfs sample code. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 19214ad0a4e38c371013cca0b2ea584aa2bee8dd
Author: James Clark 
Date:   Fri Nov 28 11:55:25 2025 +0000

    coresight: docs: Document etm4x timestamp interval option
    
    Document how the new field is used, maximum value and the interaction
    with SYNC timestamps.
    
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Reviewed-by: Leo Yan 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-13-4d319764cc58@linaro.org

commit 6c75940eb76db6ed003eaf8cca296ade9dd1f46d
Author: James Clark 
Date:   Fri Nov 28 11:55:24 2025 +0000

    coresight: Extend width of timestamp format attribute
    
    'timestamp' is currently 1 bit wide for on/off. To enable setting
    different intervals, extend it to 4 bits wide. Keep the old bit position
    for backward compatibility ("deprecated_timestamp") but don't publish in
    the format/ folder. It will be removed from the documentation and can be
    removed completely after enough time has passed.
    
    ETM3x doesn't support different intervals, so validate that the value is
    either 0 or 1.
    
    Tools that read the bit positions from the format/ folder will continue
    to work as before, setting either 0 or 1 for off/on. Tools that
    incorrectly didn't do this and set the ETM_OPT_TS bit directly will also
    continue to work because that old bit is still checked.
    
    This avoids adding a second timestamp attribute for setting the
    interval. This would be awkward to use because tools would have to be
    updated to ensure that the timestamps are always enabled when an
    interval is set, and the driver would have to validate that both options
    are provided together. All this does is implement the semantics of a
    single enum but spread over multiple fields.
    
    Reviewed-by: Leo Yan 
    Tested-by: Leo Yan 
    Tested-by: Jie Gan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-12-4d319764cc58@linaro.org

commit f4d2f5fec06a900214166136d31bdc6fe8ee00d1
Author: James Clark 
Date:   Fri Nov 28 11:55:23 2025 +0000

    coresight: Prepare to allow setting the timestamp interval
    
    Timestamps are currently emitted at the maximum rate possible, which is
    much too frequent for most use cases. In the next commit, the timestamp
    field will be widened to take a value, so set the interval using the
    value now. Granular control is not required, so save space in the config
    by interpreting it as 2 ^ timestamp. And then 4 bits (0 - 15) will be
    enough to set the interval to be larger than the existing SYNC timestamp
    interval.
    
    No sysfs mode support is needed for this attribute because counter
    generated timestamps are only configured for Perf mode.
    
    Reviewed-by: Leo Yan 
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-11-4d319764cc58@linaro.org

commit 3285c471d0c0b991e5efc96c1a8bcc9ace17b9b8
Author: James Clark 
Date:   Fri Nov 28 11:55:22 2025 +0000

    coresight: Remove misleading definitions
    
    ETM_OPT_* definitions duplicate the PMU format attributes that have
    always been published in sysfs. Hardcoding them here makes it misleading
    as to what the 'real' PMU API is and prevents attributes from being
    rearranged in the future.
    
    ETM4_CFG_BIT_* definitions just define what the Arm Architecture is
    which is not the responsibility of the kernel to do and doesn't scale to
    other registers or versions of ETM. It's not an actual software ABI/API
    and these definitions here mislead that it is.
    
    Any tools using the first ones would be broken anyway as they won't work
    when attributes are moved, so removing them is the right thing to do and
    will prompt a fix. Tools using the second ones can trivially redefine
    them locally.
    
    Perf also has its own copy of the headers so both of these things can be
    fixed up at a later date.
    
    Reviewed-by: Leo Yan 
    Reviewed-by: Mike Leach 
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-10-4d319764cc58@linaro.org

commit afed86e6e141faa2c7433517c9d91ab4d7d9d443
Author: James Clark 
Date:   Fri Nov 28 11:55:21 2025 +0000

    coresight: Interpret ETMv4 config with ATTR_CFG_GET_FLD()
    
    Remove hard coded bitfield extractions and shifts and replace with
    ATTR_CFG_GET_FLD().
    
    ETM4_CFG_BIT_BB was defined to give the register bit positions to
    userspace, TRCCONFIGR_BB should be used in the kernel so replace it.
    
    Reviewed-by: Leo Yan 
    Reviewed-by: Mike Leach 
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-9-4d319764cc58@linaro.org

commit b945d3677754dc1031515d9cd1604d0b61bb9fa2
Author: James Clark 
Date:   Fri Nov 28 11:55:20 2025 +0000

    coresight: Interpret perf config with ATTR_CFG_GET_FLD()
    
    The "config:" string construction in format_attr_contextid_show() can be
    removed because it either showed the existing context1 or context2
    formats which have already been generated, so can be called themselves.
    
    The other conversions are straightforward replacements.
    
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-8-4d319764cc58@linaro.org

commit d633fd22e8100d4363b0c44e6e92150d670bab71
Author: James Clark 
Date:   Fri Nov 28 11:55:19 2025 +0000

    coresight: Don't reject unrecognized ETMv3 format attributes
    
    config isn't the only field, there are also config1, config2, etc.
    Rejecting unrecognized attributes is therefore inconsistent as it wasn't
    done for all fields. It was only necessary when we were directly
    programming attr->config into ETMCR and didn't hide the unsupported
    fields, but now it's not needed so remove it.
    
    Reviewed-by: Leo Yan 
    Reviewed-by: Mike Leach 
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-7-4d319764cc58@linaro.org

commit a1d19cd2b1a6c41783caa49fc28e89f434673198
Author: James Clark 
Date:   Fri Nov 28 11:55:18 2025 +0000

    coresight: Interpret ETMv3 config with ATTR_CFG_GET_FLD()
    
    Currently we're programming attr->config directly into ETMCR after some
    validation. This obscures which fields are being used, and also makes it
    impossible to move fields around or use other configN fields in the
    future.
    
    Improve it by only reading the fields that are valid and then setting
    the appropriate ETMCR bits based on each one.
    
    The ETMCR_CTXID_SIZE part can be removed as it was never a valid option
    because it's not in ETM3X_SUPPORTED_OPTIONS.
    
    Reviewed-by: Leo Yan 
    Reviewed-by: Mike Leach 
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-6-4d319764cc58@linaro.org

commit 458db6257149f3959469c880de80eba3e2494479
Author: James Clark 
Date:   Fri Nov 28 11:55:17 2025 +0000

    coresight: Define format attributes with GEN_PMU_FORMAT_ATTR()
    
    This allows us to define and consume them in a unified way in later
    commits.
    
    A lot of the existing code has open coded bit shifts or direct usage of
    whole config values which is error prone and hides which bits are in use
    and which are free.
    
    Reviewed-by: Leo Yan 
    Reviewed-by: Mike Leach 
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-5-4d319764cc58@linaro.org

commit 20bc2ea23774a7655d21ce2243eccfdfd4405279
Author: James Clark 
Date:   Fri Nov 28 11:55:16 2025 +0000

    coresight: Hide unused ETMv3 format attributes
    
    ETMv3 only has a few attributes, and setting unused ones results in an
    error, so hide them to begin with.
    
    Reviewed-by: Mike Leach 
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-4-4d319764cc58@linaro.org

commit b02450de6ba6309c66e2e056ccfbfce4bd3b0352
Author: James Clark 
Date:   Fri Nov 28 11:55:15 2025 +0000

    coresight: Refactor etm4_config_timestamp_event()
    
    Remove some of the magic numbers and try to clarify some of the
    documentation so it's clearer how this sets up the timestamp interval.
    
    Return errors directly instead of jumping to out and returning ret,
    nothing needs to be cleaned up at the end and it only obscures the flow
    and return value.
    
    Add utilities for programming resource selectors that do compile time
    checks for constants or WARN_ONs for non-constant values. FIELD_PREP
    includes compile time checks so we only need to add an additional
    BUILD_BUG_ON for resource == 0 in pair mode.
    
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-3-4d319764cc58@linaro.org

commit 38f4c42734990ddf42ad6d996b14fbff8fdec9d2
Author: James Clark 
Date:   Fri Nov 28 11:55:14 2025 +0000

    coresight: Repack struct etmv4_drvdata
    
    Fix holes and convert the long list of bools to single bits to save
    some space because there's one of these for each ETM.
    
    Reviewed-by: Leo Yan 
    Reviewed-by: Mike Leach 
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-2-4d319764cc58@linaro.org

commit 10d4dbdc8fbce586b17be07b8138e025381453dd
Author: James Clark 
Date:   Fri Nov 28 11:55:13 2025 +0000

    coresight: Change syncfreq to be a u8
    
    TRCSYNCPR.PERIOD is the only functional part of TRCSYNCPR and it only
    has 5 valid bits so it can be stored in a u8.
    
    Reviewed-by: Mike Leach 
    Reviewed-by: Leo Yan 
    Tested-by: Leo Yan 
    Signed-off-by: James Clark 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251128-james-cs-syncfreq-v8-1-4d319764cc58@linaro.org

commit b0655377aa5a410df02d89170c20141a1a5bbc28
Author: Tamir Duberstein 
Date:   Mon Dec 22 13:15:58 2025 +0100

    rust: regulator: replace `kernel::c_str!` with C-Strings
    
    C-String literals were added in Rust 1.77. Replace instances of
    `kernel::c_str!` with C-String literals where possible.
    
    Signed-off-by: Tamir Duberstein 
    Reviewed-by: Daniel Almeida 
    Link: https://patch.msgid.link/20251222-cstr-regulator-v1-1-430e3d517025@gmail.com
    Signed-off-by: Mark Brown 

commit 51babf83f424a695179183204226d453c8af7dc7
Author: Joseph Kogut 
Date:   Fri Dec 5 12:07:03 2025 +0000

    arm64: dts: rockchip: Add support for CM5 IO carrier
    
    Specification:
    - 1x HDMI
    - 2x MIPI DSI
    - 2x MIPI CSI
    - 1x eDP
    - 1x M.2 E key
    - 1x USB 3.0 Host
    - 1x USB 3.0 OTG
    - 2x USB 2.0 Host
    - Headphone jack w/ microphone
    - Gigabit Ethernet w/ PoE
    - microSD slot
    - 40-pin expansion header
    - 12V DC
    
    Signed-off-by: Joseph Kogut 
    Signed-off-by: FUKAUMI Naoki 
    Link: https://patch.msgid.link/20251205120703.14721-4-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit 36ee19ba42dcebe6a15ec6b442a7d32eb327eee4
Author: Joseph Kogut 
Date:   Fri Dec 5 12:07:02 2025 +0000

    arm64: dts: rockchip: Add rk3588 based Radxa CM5
    
    Add initial support for the Radxa Compute Module 5 (CM5). The CM5 uses a
    proprietary connector.
    
    Specification:
    - Rockchip RK3588
    - Up to 32 GB LPDDR4X
    - Up to 128 GB eMMC
    - 1x HDMI TX up to 8k@60 hz
    - 1x eDP TX up to 4k@60 hz
    - Gigabit Ethernet PHY
    
    Signed-off-by: Joseph Kogut 
    Signed-off-by: FUKAUMI Naoki 
    Link: https://patch.msgid.link/20251205120703.14721-3-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit 7beae528ddadd1c3f7d5670f937d993b0f39e0ea
Author: Joseph Kogut 
Date:   Fri Dec 5 12:07:01 2025 +0000

    dt-bindings: arm: rockchip: Add Radxa CM5 IO board
    
    Add device tree binding for the Radxa CM5 IO board.
    
    This board is based on the rk3588s.
    
    Signed-off-by: Joseph Kogut 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: FUKAUMI Naoki 
    Link: https://patch.msgid.link/20251205120703.14721-2-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit 9c68a9483e31a9ad25c5399bb5f066b2e4980ad5
Author: Raphaël Jakse 
Date:   Sun Nov 30 17:12:59 2025 +0100

    arm64: dts: rockchip: Fix Bluetooth on the RockPro64 board
    
    The RockPro64 board has an optional BCM4345C5 Bluetooth device on UART0.
    
    This patch fixes audio stutters by setting its correct max-speed and
    compatible properties.
    
    Signed-off-by: Raphaël Jakse 
    Link: https://patch.msgid.link/20251130161259.9828-1-raphael.kernel@jakse.fr
    Signed-off-by: Heiko Stuebner 

commit 1cb0958a26aeffe315a60b3cbbc56b94246cc25a
Author: Heiko Stuebner 
Date:   Mon Oct 20 12:07:57 2025 +0200

    arm64: dts: rockchip: Correctly describe the ethernet phy on rk3368-lion
    
    So far, the board used the phy implicitly using the deprecated snps reset
    properties. Improve that and describe the PHY correctly under the new
    mdio node.
    
    Signed-off-by: Heiko Stuebner 
    Reviewed-by: Quentin Schulz 
    Link: https://patch.msgid.link/20251020100757.3669681-4-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit bce933a74b8e785a8090da74bee8ec3f38be40b7
Author: Heiko Stuebner 
Date:   Mon Oct 20 12:07:56 2025 +0200

    arm64: dts: rockchip: add mdio subnode to gmac on rk3368
    
    This is needed to actually describe the per-board phys connected
    to the gmac when needed.
    
    Signed-off-by: Heiko Stuebner 
    Reviewed-by: Quentin Schulz 
    Link: https://patch.msgid.link/20251020100757.3669681-3-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit 396870f53c4e736366b4ed2e127874c30ce2f965
Author: Heiko Stuebner 
Date:   Mon Oct 20 12:07:55 2025 +0200

    arm64: dts: rockchip: add gmac reset property to rk3368
    
    Add the reset of the gmac controller block.
    
    Signed-off-by: Heiko Stuebner 
    Reviewed-by: Quentin Schulz 
    Link: https://patch.msgid.link/20251020100757.3669681-2-heiko@sntech.de
    Signed-off-by: Heiko Stuebner 

commit e05b08d7d0162cf77fff119367fb1a2d5ab3e669
Author: Jani Nikula 
Date:   Fri Dec 19 13:49:39 2025 +0200

    drm/atomic: convert drm_atomic_get_{old, new}_colorop_state() into proper functions
    
    There is no real reason to include drm_colorop.h from drm_atomic.h, as
    drm_atomic_get_{old,new}_colorop_state() have no real reason to be
    static inline.
    
    Convert the static inlines to proper functions, and drop the include to
    reduce the include dependencies and improve data hiding.
    
    v2: Fix vkms build failures (Alex)
    
    Fixes: cfc27680ee20 ("drm/colorop: Introduce new drm_colorop mode object")
    Cc: Simon Ser 
    Cc: Alex Hung 
    Cc: Harry Wentland 
    Cc: Daniel Stone 
    Cc: Melissa Wen 
    Cc: Sebastian Wick 
    Cc: Alex Hung 
    Reviewed-by: Alex Hung 
    Link: https://patch.msgid.link/20251219114939.1069851-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 7394321a06638bf5132fec8d817cdfedc26057c2
Author: Jani Nikula 
Date:   Fri Dec 19 12:40:36 2025 +0200

    drm/xe/display: drop i915_utils.h
    
    With the i915 switch to generic fault injection, display no longer needs
    the compat i915_utils.h. Remove it, along with a few includes.
    
    Reviewed-by: Michał Grzelak 
    Link: https://patch.msgid.link/20251219104036.855258-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 2d6fcdcaf42671dd3fb281d7a2e5ea985af11ce5
Author: Shawn Lin 
Date:   Fri Nov 28 15:09:22 2025 +0800

    arm64: dts: rockchip: add dma-coherent for pcie and gmac of RK3576
    
    The RK3576 SoC employs ARM CCI for maintaining cache coherency
    between the CPU cluster and high-speed peripherals including USB3,
    SATA, GMAC, and PCIe controllers. While the USB3 and SATA controllers
    were correctly marked as dma-coherent, the GMAC and PCIe nodes were
    overlooked.
    
    Without dma-coherent, the kernel falls back to software cache maintenance
    for DMA operations, requiring explicit cache flushing and invalidating.
    This adds significant overhead that degrades performance in high-throughput
    workloads.
    
    Add the missing dma-coherent properties to enable hardware coherency and
    avoid unnecessary software cache management overhead.
    
    Signed-off-by: Shawn Lin 
    Link: https://patch.msgid.link/1764313762-78063-1-git-send-email-shawn.lin@rock-chips.com
    Signed-off-by: Heiko Stuebner 

commit e3b12fc3336240e7dee4989b9e8634be3c959c94
Author: FUKAUMI Naoki 
Date:   Tue Dec 2 08:49:41 2025 +0000

    arm64: dts: rockchip: Add EEPROMs for Radxa rk35xx boards
    
    The BL24C16A EEPROM is found in the schematics for Radxa CM3I, Radxa
    ROCK 3A, 3B, 5B+, and 5T. [1] [2] [3] [4] [5]
    
    The BL24C16F EEPROM is found in the schematic for Radxa ROCK 4D. [6]
    
    Add these eeprom nodes.
    
    These are designed to have data written during factory programming
    (regardless of whether data is actually written or not), and we at
    Radxa permit users to read the data but not write to it. [8]
    Therefore, we will add a read-only property to the eeprom node.
    
    [1] https://dl.radxa.com/cm3i/docs/hw/radxa_cm3i_v1310_schematic.pdf p.8
    [2] https://dl.radxa.com/rock3/docs/hw/3a/radxa_rock_3a_v1310_schematic.pdf p.7
    [3] https://dl.radxa.com/rock3/docs/hw/3b/Radxa_ROCK_3B_V1.51_SCH.pdf p.35
    [4] https://dl.radxa.com/rock5/5b+/docs/hw/radxa_rock5bp_v1.2_schematic.pdf p.29
    [5] https://dl.radxa.com/rock5/5t/docs/hw/radxa_rock5t_schematic_v1.2_20250109.pdf p.36
    [6] https://dl.radxa.com/rock4/4d/docs/hw/Radxa_ROCK_4D_SCH_V1.12.pdf p.23
    [7] https://github.com/radxa/u-boot/blob/next-dev-v2024.10/drivers/misc/radxa-i2c-eeprom.c
    
    Signed-off-by: FUKAUMI Naoki 
    Link: https://patch.msgid.link/20251202084941.1785-4-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit 1b2d6b75e2b3374157c9015435381b217a887145
Author: FUKAUMI Naoki 
Date:   Tue Dec 2 08:49:40 2025 +0000

    arm64: dts: rockchip: Add EEPROMs for Radxa ROCK 4 boards
    
    The BL24C04A EEPROM is found in the schematics for Radxa ROCK Pi 4A+
    and 4B+. [1] [2]
    
    The BL24C16A EEPROM is found in the schematics for Radxa ROCK 4C+, 4SE,
    Radxa ROCK Pi 4A, 4B, and 4C. [3] [4] [5] [6] [7]
    
    However, newer boards/batches should have the BL24C16A, but older ones
    may have the BL24C04A. (the ROCK Pi 4B+ I own has a 16Kb EEPROM)
    
    For the ROCK Pi 4s (except the relatively new ROCK 4SE), add the
    BL24C04A eeprom node for backward compatibility.
    For the ROCK 4SE, add the BL24C16A eeprom node.
    
    These are designed to have data written during factory programming
    (regardless of whether data is actually written or not), and we at
    Radxa permit users to read the data but not write to it. [8]
    Therefore, we will add a read-only property to the eeprom node.
    
    [1] https://dl.radxa.com/rockpi4/docs/hw/rockpi4/4ap/radxa_rock_4ap_v1730_schematic.pdf p.17
    [2] https://dl.radxa.com/rockpi4/docs/hw/rockpi4/4bp/radxa_rock_4bp_v1730_schematic.pdf p.17
    [3] https://dl.radxa.com/rockpi4/docs/hw/rockpi4/ROCK-4C+-V1.411-SCH.pdf p.22
    [4] https://dl.radxa.com/rockpi4/docs/hw/rockpi4/ROCK-4-SE-V1.53-SCH.pdf p.17
    [5] https://dl.radxa.com/rockpi4/docs/hw/rockpi4/4a/ROCK_4A_V1.52_SCH.pdf p.17
    [6] https://dl.radxa.com/rockpi4/docs/hw/rockpi4/4b/ROCK_4B_v1.52_SCH.pdf p.17
    [7] https://dl.radxa.com/rockpi4/docs/hw/rockpi4/rockpi4c_v12_sch_20200620.pdf p.17
    [8] https://github.com/radxa/u-boot/blob/next-dev-v2024.10/drivers/misc/radxa-i2c-eeprom.c
    
    Signed-off-by: FUKAUMI Naoki 
    Link: https://patch.msgid.link/20251202084941.1785-3-naoki@radxa.com
    Signed-off-by: Heiko Stuebner 

commit f8a1d7d136f734e8e20e414eaf8aff74e6e0d55c
Author: Shawn Lin 
Date:   Thu Dec 4 08:50:28 2025 +0800

    arm64: dts: rockchip: Add PCIe clkreq stuff for RK3588 EVB1
    
    Add supports-clkreq and pinmux for PCIe ASPM L1 substates.
    
    Signed-off-by: Shawn Lin 
    Acked-by: Manivannan Sadhasivam 
    Reviewed-by: Hans Zhang 
    Link: https://patch.msgid.link/1764809428-183623-1-git-send-email-shawn.lin@rock-chips.com
    Signed-off-by: Heiko Stuebner 

commit 3025d360f03515d3f6396a5cec339e776d62b2da
Author: Chukun Pan 
Date:   Sat Dec 20 18:00:10 2025 +0800

    arm64: dts: rockchip: enable saradc for ArmSoM Sige5
    
    Add ADC support to ArmSoM Sige5 board.
    
    Signed-off-by: Chukun Pan 
    Link: https://patch.msgid.link/20251220100010.26643-3-amadeus@jmu.edu.cn
    Signed-off-by: Heiko Stuebner 

commit 341735d92ff868eb4c46beafb313d66f015809be
Author: Chukun Pan 
Date:   Sat Dec 20 18:00:09 2025 +0800

    arm64: dts: rockchip: fix hp-det pin for ArmSoM Sige5
    
    Although the hp_det pin is not used, according to the schematic,
    the headphone detection pin is GPIO4_B0. Fix the incorrect pin.
    
    Signed-off-by: Chukun Pan 
    Reviewed-by: Sebastian Reichel 
    Link: https://patch.msgid.link/20251220100010.26643-2-amadeus@jmu.edu.cn
    Signed-off-by: Heiko Stuebner 

commit 3fc7029d3009682b27be2fa2cd2269bc6f104c2e
Author: Chukun Pan 
Date:   Sat Dec 20 18:00:08 2025 +0800

    arm64: dts: rockchip: remove rtc regulator for ArmSoM Sige5
    
    According to the schematic, RTC is powered by vcc_3v3_s3.
    The vcc_3v3_rtc_s5 regulator does not exist, remove it.
    
    Signed-off-by: Chukun Pan 
    Reviewed-by: Sebastian Reichel 
    Link: https://patch.msgid.link/20251220100010.26643-1-amadeus@jmu.edu.cn
    Signed-off-by: Heiko Stuebner 

commit a6e6f8b50bbb2b7c12f09a4f9c5f5d9c67b45f8b
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:29 2025 +0200

    drm/i915: drop dependency on struct intel_display from i915 initial plane
    
    The i915 core initial plane handling doesn't actually need struct
    intel_display for anything. Switch to i915 specific data structures in
    i915 core code.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/58d7605a16b360080921ff2af7120b6da2eb042d.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 82eaf3459dbf92ea78243150508740c007e0eea7
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:28 2025 +0200

    drm/{i915, xe}: pass struct drm_device instead of drm_device to ->alloc_obj
    
    The initial plane parent interface ->alloc_obj hook no longer needs the
    crtc for anything. Pass struct drm_device instead.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/7a40381be6d98dc0916a5447be5dd6cba86cfd0a.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 5bad00377ec844d93947fd4c081abd2000a63dfc
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:27 2025 +0200

    drm/{i915, xe}: pass struct drm_plane_state instead of struct drm_crtc to ->setup
    
    The initial plane parent interface ->setup hook no longer needs the crtc
    for anything. Pass the struct drm_plane_state instead.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/c3db101ef5fd13c56cb3a9329adecf521a807abc.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit dcff3266cfc49000b95b461a41031db3cfc55c62
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:26 2025 +0200

    drm/{i915,xe}: deduplicate initial plane setup
    
    Deduplicate more of the identical parts of i915 and xe initial plane
    setup. This lets us reduce the core dependency on display internals.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/1a2abbceedb9e7d03f262c44cd54a24556ef6b61.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 64ee50c6f025c0a62e173bd96c33e48da6012383
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:25 2025 +0200

    drm/{i915, xe}: deduplicate intel_alloc_initial_plane_obj() FB modifier checks
    
    Move the modifier checks into common code to deduplicate.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/3c62ad48595aa2306219b1d6a215cf7680a67da2.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit adf7968e52e8d9f1b76ecc46ac5720c0e61c9d51
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:24 2025 +0200

    drm/i915: further deduplicate intel_find_initial_plane_obj()
    
    Move intel_reuse_initial_plane_obj() into common display code, and split
    the ->find_obj hook into ->alloc_obj and ->setup hooks.
    
    Return the struct drm_gem_object from ->alloc_obj in preparation for
    moving more things to display.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/c71011dbb11afaa5c4da30aa2627833374300d63.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 9a864b5487c6f819488f64bb5ad3f5efcb720330
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:23 2025 +0200

    drm/xe: return plane_state from intel_reuse_initial_plane_obj()
    
    Initialize fb in the same level as the other code path.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/47d3272cff13dc8f5d7323c32bfb3cc34c0c977d.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 3629264e4d7dd255180e99ed6be05af57e4bea6b
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:22 2025 +0200

    drm/i915: return plane_state from intel_reuse_initial_plane_obj()
    
    Initialize fb and vma in the same level as the other code path.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/96985a18593408f07fba131cf49ca0f97bf8fb93.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 1b3cc68df363820537d6c837069db4c303ee58a9
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:21 2025 +0200

    drm/{i915, xe}: start deduplicating intel_find_initial_plane_obj() between i915 and xe
    
    Move some easy common parts to display. Initially, the
    intel_find_initial_plane_obj() error path seems silly, but it'll be more
    helpful this way for later changes.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/950d308172443d5bae975aa1ab72111720134219.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 6bb14ea387fee901b62a29af568f39eeac23e451
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:20 2025 +0200

    drm/{i915, xe}: deduplicate plane_config_fini() between i915 and xe
    
    Move the common code to display. Retain empty xe_plane_config_fini() for
    now, in case it's needed in the future.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/14322386cdb1a0f4f6c7ff74a5a9696ea0ff84bf.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit a13f152a6c09338a7f81efdd414425a9d8d50b16
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:19 2025 +0200

    drm/{i915, xe}: deduplicate intel_initial_plane_config() between i915 and xe
    
    Move the parent interface at one step lower level, allowing
    deduplication.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/0cb4077a5a39274c7a2dae95d548d7b33365a518.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 9dacae143e6ff18e77fbad6f1413fb8f2f975407
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:18 2025 +0200

    drm/{i915, xe}: move initial plane calls to parent interface
    
    Add the initial plane handling functions to the display parent
    interface. Add the call wrappers in dedicated intel_initial_plane.c
    instead of intel_parent.c, as we'll be refactoring the calls heavily.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/ab91c891677fe2bb83bf5aafa5ee984b2442b84d.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit b99690ffbca0994bb66e12deb20e37a34abf0ae6
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:17 2025 +0200

    drm/i915: rename intel_plane_initial.h to intel_initial_plane.h
    
    Follow the more naturally flowing naming. Rename both the header and the
    vblank wait function.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/32c2d68a9ae7d2262ad2c63e873e522e67bc78df.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 6a3e94ff052963dea8585fb7d5a2bb7dcf4140c6
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:16 2025 +0200

    drm/xe/display: rename xe_plane_initial.c to xe_initial_plane.c
    
    Follow i915 with the more naturally flowing naming.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/62eb56fe348a8fe7c17333d784192da701367cc7.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 0734802d6130076fe52d3c75bc618e64048c2765
Author: Jani Nikula 
Date:   Mon Dec 15 17:28:15 2025 +0200

    drm/i915: move display/intel_plane_initial.c to i915_initial_plane.c
    
    intel_plane_initial.c is i915 specific. Move it to i915 core. Start
    renaming stuff with the slightly more natural "initial plane" rather
    than "plane initial".
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/cdad733192690a61fbb44921c57fc68cc1cd809f.1765812266.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 01272f05aae5f6aca4337eb52e6b9290ce12e9f7
Author: Peter Griffin 
Date:   Mon Dec 22 10:22:13 2025 +0000

    arm64: dts: exynos: gs101: add samsung,sysreg property to CMU nodes
    
    With the exception of cmu_top, each CMU has a corresponding sysreg bank
    that contains the BUSCOMPONENT_DRCG_EN and optional MEMCLK registers.
    The BUSCOMPONENT_DRCG_EN register enables dynamic root clock gating of
    bus components and MEMCLK gates the sram clock.
    
    Now the clock driver supports automatic clock mode, provide the
    samsung,sysreg property so the driver can enable dynamic root clock
    gating of bus components and gate sram clock.
    
    Note without the property specified the driver simply falls back to
    previous behaviour of not configuring these registers so it is not an ABI
    break.
    
    Signed-off-by: Peter Griffin 
    Link: https://patch.msgid.link/20251222-automatic-clocks-v7-2-fec86fa89874@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit eaf9206bf3d68f792ecd5e6f488eab1fb5afe900
Author: Peter Griffin 
Date:   Mon Dec 22 10:22:15 2025 +0000

    clk: samsung: gs101: Enable auto_clock_gate mode for each gs101 CMU
    
    Enable auto clock mode, and define the additional fields which are used
    when this mode is enabled.
    
    /sys/kernel/debug/clk/clk_summary now reports approximately 308 running
    clocks and 298 disabled clocks. Prior to this commit 586 clocks were
    running and 17 disabled.
    
    Signed-off-by: Peter Griffin 
    Link: https://patch.msgid.link/20251222-automatic-clocks-v7-4-fec86fa89874@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit 298fac4f4b96448ce7ef8da525a74fd3dba0035d
Author: Peter Griffin 
Date:   Mon Dec 22 10:22:14 2025 +0000

    clk: samsung: Implement automatic clock gating mode for CMUs
    
    Update exynos_arm64_init_clocks() so that it enables the automatic clock
    mode bits in the CMU option register if the auto_clock_gate flag and
    option_offset fields are set for the CMU. To ensure compatibility with
    older DTs (that specified an incorrect CMU reg size), detect this and
    fallback to manual clock gate mode as the auto clock mode feature depends
    on registers in this area.
    
    The CMU option register bits are global and effect every clock component in
    the CMU, as such clearing the GATE_ENABLE_HWACG bit and setting GATE_MANUAL
    bit on every gate register is only required if auto_clock_gate is false.
    
    Additionally if auto_clock_gate is enabled the dynamic root clock gating
    and memclk registers will be configured in the corresponding CMUs sysreg
    bank. These registers are exposed via syscon, so the register
    samsung_clk_save/restore paths are updated to also take a regmap.
    
    As many gates for various Samsung SoCs are already exposed in the Samsung
    clock drivers a new samsung_auto_clk_gate_ops is implemented. This uses
    some CMU debug registers to report whether clocks are enabled or disabled
    when operating in automatic mode. This allows
    /sys/kernel/debug/clk/clk_summary to still dump the entire clock tree and
    correctly report the status of each clock in the system.
    
    Signed-off-by: Peter Griffin 
    Link: https://patch.msgid.link/20251222-automatic-clocks-v7-3-fec86fa89874@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit 2e8e9a2492edbbef54de6ab1c5bf1578ffef4c8c
Author: Peter Griffin 
Date:   Mon Dec 22 10:22:12 2025 +0000

    dt-bindings: clock: google,gs101-clock: add samsung,sysreg property as required
    
    Each CMU (with the exception of cmu_top) has a corresponding sysreg bank
    that contains the BUSCOMPONENT_DRCG_EN and optional MEMCLK registers.
    The BUSCOMPONENT_DRCG_EN register enables dynamic root clock gating of
    bus components and MEMCLK gates the sram clock.
    
    Now the clock driver supports automatic clock mode, to fully enable dynamic
    root clock gating it is required to configure these registers. Update the
    bindings documentation so that all CMUs (with the exception of
    gs101-cmu-top) have samsung,sysreg as a required property.
    
    Note this is NOT an ABI break, as if the property isn't specified the
    clock driver will fallback to the current behaviour of not initializing
    the registers. The system still boots, but bus components won't benefit
    from dynamic root clock gating and dynamic power will be higher (which has
    been the case until now anyway).
    
    Additionally update the DT example to included the correct CMU size as
    registers in that region are used for automatic clock mode.
    
    Acked-by: Rob Herring (Arm) 
    Reviewed-by: André Draszik 
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Peter Griffin 
    Link: https://patch.msgid.link/20251222-automatic-clocks-v7-1-fec86fa89874@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit 71f9bc6f7c25294d79132345f94561469a03c245
Author: Harald Freudenberger 
Date:   Thu Dec 11 11:34:41 2025 +0100

    s390/ap/zcrypt: Revisit module param permissions
    
    Revisit and rework module parameter permissions for AP bus and zcrypt
    device drivers.
    
    In general all sysfs permissions for AP bus and zcrypt parameters should be
    0444 so that user space tools like lszcrypt can read the current value of
    module parameters.
    
    Some exceptions are only for some internal tweak parameters like
    ap_msg_pool_min_items and zcrypt_mempool_threshold which should only be
    readable by an administrator.
    
    Signed-off-by: Harald Freudenberger 
    Reviewed-by: Holger Dengler 
    Signed-off-by: Heiko Carstens 

commit afa8fa52a42c310e418994b3255597efde31b343
Author: Jens Remus 
Date:   Thu Dec 11 13:19:31 2025 +0100

    s390/ptrace: Convert function macros to inline functions
    
    Convert the function macros user_mode(), instruction_pointer(), and
    user_stack_pointer() to inline functions, to align their definition
    with x86 and arm64.
    
    Use const qualifier on struct pt_regs pointer parameters to prevent
    compiler warnings:
    
    arch/s390/kernel/stacktrace.c: In function ‘arch_stack_walk_user_common’:
    arch/s390/kernel/stacktrace.c:114:34: warning: passing argument 1 of
    ‘instruction_pointer’ discards ‘const’ qualifier from pointer target
    type [-Wdiscarded-qualifiers]
    ...
    arch/s390/kernel/stacktrace.c:117:48: warning: passing argument 1 of
    ‘user_stack_pointer’ discards ‘const’ qualifier from pointer target
    type [-Wdiscarded-qualifiers]
    ...
    
    While at it add const qualifier to all struct pt_regs pointer parameters
    that are accessed read-only and use __always_inline instead of inline to
    harmonize the helper functions.
    
    [hca@linux.ibm.com: Use psw_bits() helper]
    
    Reviewed-by: Heiko Carstens 
    Signed-off-by: Jens Remus 
    Signed-off-by: Heiko Carstens 

commit b4780fe4ddf04b51127a33d705f4a2e224df00fa
Author: Heiko Carstens 
Date:   Fri Dec 12 16:47:07 2025 +0100

    s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
    
    Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
    to scripts/Makefile.extrawarn, since clang generates warnings for the
    dummy variable in typecheck():
    
        CC      arch/s390/purgatory/purgatory.o
          arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
            221 |         return psw_bits(regs->psw).pstate;
                |                ^
          arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
             98 |         typecheck(psw_t, __psw);                \
                |         ^
          include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
             11 |         typeof(x) __dummy2; \
                |                   ^
    
    Signed-off-by: Heiko Carstens 

commit 5ba35a6c13fff0929c34aba6b7602dacbe68686c
Author: Heiko Carstens 
Date:   Fri Dec 12 16:43:58 2025 +0100

    s390/boot: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
    
    Add -Wno-default-const-init-unsafe to boot KBUILD_CFLAGS, similar to
    scripts/Makefile.extrawarn, since clang generates warnings for the dummy
    variable in typecheck():
    
        CC      arch/s390/boot/version.o
          arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
            221 |         return psw_bits(regs->psw).pstate;
                |                ^
          arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
             98 |         typecheck(psw_t, __psw);                \
                |         ^
          include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
             11 |         typeof(x) __dummy2; \
                |                   ^
    
    Signed-off-by: Heiko Carstens 

commit ad415677b7e3b733270adaf04e3a7a9c46f1e929
Author: Ilpo Järvinen 
Date:   Tue Oct 14 17:59:05 2025 +0300

    MAINTAINERS: Update Intel Quadrature Encoder Peripheral maintainer
    
    Jarkko's address is going to bounce soon and I agreed to be the new
    maintainer.
    
    Acked-by: Jarkko Nikula 
    Signed-off-by: Ilpo Järvinen 
    Link: https://lore.kernel.org/r/20251014145905.4862-1-ilpo.jarvinen@linux.intel.com
    Signed-off-by: William Breathitt Gray 

commit 5cd532f7f017460395836d8f129ad3ee5ae63110
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 14:27:51 2025 -0600

    arm64: dts: apm: Drop "dma" device_type
    
    The only supported cases of otherwise deprecated for FDT "device_type"
    property are memory, cpu, and pci. "dma" is not valid, so drop it.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251216-dt-apm-v1-4-0bf2bf8b982c@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit a1176f7c5b990244e9a0ee2bdd93c9a36e5fe666
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 14:27:50 2025 -0600

    arm64: dts: apm: Add "reg" to "syscon-reboot" and "syscon-poweroff"
    
    As the nodes already have a unit-address, add the corresponding "reg"
    entry which is preferred over "offset".
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251216-dt-apm-v1-3-0bf2bf8b982c@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit cae405d73986579a88bfb956f1ae9b514c23a7bc
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 14:27:49 2025 -0600

    arm64: dts: apm: Use recommended i2c node names
    
    Use the recommended node name of 'i2c' for the 'i2cslimpro' nodes.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251216-dt-apm-v1-2-0bf2bf8b982c@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit 21bd5fb461eb485768cef99e0ff531a6b84b67d8
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 14:27:48 2025 -0600

    arm64: dts: apm/shadowcat: More clock clean-ups
    
    A fixed-factor-clock only provides 1 clock, so "#clock-cells" must be 0.
    
    The "snps,designware-i2c" node is not a clock provider, so drop
    "#clock-cells.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251216-dt-apm-v1-1-0bf2bf8b982c@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit 7dd84bbec273345bd5735f6917b93eb2a7d9c0c3
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 13:12:12 2025 -0600

    ARM: dts: vexpress/v2m-rs1: Use documented arm,vexpress,config-bus child node names
    
    Update the arm,vexpress,config-bus child node names to use the
    documented ones. Most of these were updated a while back, but I missed
    these.
    
    Signed-off-by: Rob Herring (Arm) 
    Reviewed-by: Liviu Dudau 
    Link: https://patch.msgid.link/20251216191212.2879226-2-robh@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit f25aa20e92305c7ab7a6387b8ef7b6e83f8a49fb
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 12:02:02 2025 -0600

    arm64: dts: cavium: Drop thunder2
    
    The Cavium thunder2 DT support is incomplete. It consists of 4 cores
    (out of 128) and only a serial port. The thunder2 specific drivers in
    the kernel don't have DT support either. The few remaining users of
    this platform likely use ACPI.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251216180202.2794695-2-robh@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit 15e3ce53673289624bab4e6a60207af4775f4a38
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 12:01:37 2025 -0600

    arm64: dts: cavium: thunder-88xx: Add missing PL011 "uartclk"
    
    The PL011 IP has 2 clock inputs for UART core/baud and APB bus. The
    Thunder2 SoC is missing the core "uartclk". In this case, the Linux
    driver uses single clock for both clock inputs. Let's assume that's how
    the h/w is wired and make the DT reflect that.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251216180136.2794105-2-robh@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit 22fbe6e21450d629642e4bdc8d8d329219abeb46
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 12:00:54 2025 -0600

    arm64: dts: toshiba: Use recommended node names
    
    Update Toshiba TMPV7708 node name to the recommended standard node
    names. Generally, node names and paths aren't considered ABI, so it
    is safe to change them.
    
    Signed-off-by: Rob Herring (Arm) 
    Reviewed-by: Nobuhiro Iwamatsu 
    Link: https://patch.msgid.link/20251216180055.2793215-2-robh@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit 714b5a789f957871f18433645aa39d9109f194fb
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 12:00:29 2025 -0600

    arm64: dts: sprd: Use recommended node names
    
    Update Spreadtrum platforms node name to the recommended standard node
    names. Generally, node names and paths aren't considered ABI, so it
    is safe to change them.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251216180029.2792676-2-robh@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit 30ae13173704585f2a3f406e94e0dbaa5cfde69a
Author: Rob Herring (Arm) 
Date:   Tue Dec 16 11:59:52 2025 -0600

    arm64: dts: lg: Use recommended simple-bus node name
    
    Update LG LG131x 'amba' bus node name to 'amba-bus' following the
    standard names for simple-bus nodes. Generally, node names and paths
    aren't considered ABI, so it is safe to change them.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251216175951.2791921-2-robh@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit a61bf068f1fe359203f1af191cb523b77dc32752
Author: Tvrtko Ursulin 
Date:   Mon Dec 8 19:15:50 2025 +0100

    drm/xe: Fix ggtt fb alignment
    
    Pass the correct alignment from intel_fb_pin_to_ggtt() down to
    __xe_pin_fb_vma().
    
    Signed-off-by: Tvrtko Ursulin 
    Reported-by: Ville Syrjälä 
    Closes: https://lore.kernel.org/intel-xe/aNL_RgLy13fXJbYx@intel.com/
    Cc: Juha-Pekka Heikkila 
    Reviewed-by: Ville Syrjälä 
    Fixes: b0228a337de8 ("drm/xe/display: align framebuffers according to hw requirements")
    Cc:  # v6.13+
    Signed-off-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251208181550.6618-1-tursulin@igalia.com

commit 06d65f2d478e49b68701aed18e58713aa178be16
Merge: 2bb202416d3334 32a708ba5db50c
Author: Mark Brown 
Date:   Mon Dec 22 09:12:28 2025 +0000

    Add Richtek RT8092 support
    
    Merge series from cy_huang@richtek.com:
    
    This patch series add rt8092 regulator support.

commit c6bca73d699cfe00d3419566fdb2a45e112f44b0
Author: Dan Carpenter 
Date:   Sat Dec 20 11:45:40 2025 +0300

    ASoC: rt1320: Fix retry checking in rt1320_rae_load()
    
    This loop iterates 200 times and then gives up.  The problem is that
    currently the loop exits with "retry" set to -1 on the failure path but
    the check for failure expects it to be 0.  Change from a post-op to a
    pre-op so that it exits with "retry" set to 0.
    
    Fixes: 22937af75abb ("ASoC: rt1320: support RAE parameters loading")
    Signed-off-by: Dan Carpenter 
    Acked-by: Shuming Fan 
    Link: https://patch.msgid.link/aUZiNJ7pzuahXFYE@stanley.mountain
    Signed-off-by: Mark Brown 

commit 9e692bb5412a7b0e6534ba2d7158a57ed4b00658
Author: Nathan Chancellor 
Date:   Fri Dec 19 16:08:08 2025 -0700

    ASoC: rt1320: Change return type of rt1320_t0_load() to void
    
    Clang warns (or errors with CONFIG_WERROR=y / W=e):
    
      sound/soc/codecs/rt1320-sdw.c:1387:6: error: variable 'ret' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
       1387 |         if (!fw_ready) {
            |             ^~~~~~~~~
      sound/soc/codecs/rt1320-sdw.c:1421:9: note: uninitialized use occurs here
       1421 |         return ret;
            |                ^~~
      sound/soc/codecs/rt1320-sdw.c:1387:2: note: remove the 'if' if its condition is always false
       1387 |         if (!fw_ready) {
            |         ^~~~~~~~~~~~~~~~
       1388 |                 dev_warn(dev, "%s, DSP FW is NOT ready\n", __func__);
            |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       1389 |                 goto _exit_;
            |                 ~~~~~~~~~~~~
       1390 |         }
            |         ~
      sound/soc/codecs/rt1320-sdw.c:1366:9: note: initialize the variable 'ret' to silence this warning
       1366 |         int ret;
            |                ^
            |                 = 0
    
    The return value of rt1320_t0_load() is never actually used, so it can
    just be eliminated altogether by returning void, clearing up the
    warning.
    
    Fixes: da1682d5e8b5 ("ASoC: rt1320: support calibration and temperature/r0 loading")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512191711.wY6XU796-lkp@intel.com/
    Signed-off-by: Nathan Chancellor 
    Acked-by: Shuming Fan 
    Link: https://patch.msgid.link/20251219-rt1320-sdw-avoid-uninit-ret-v1-1-faa3e250ebc4@kernel.org
    Signed-off-by: Mark Brown 

commit 4ab48cc63e15cb619d641d1edf9a15a0a98875b2
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 12:45:48 2025 +0100

    ASoC: qcom: audioreach: Constify function arguments
    
    Several functions receive pointers to parsed Audioreach topology (e.g.
    'struct audioreach_container', 'struct audioreach_module') and they do
    not modify their contents, but copy their data to send to the ADSP.
    Constify the pointers for self-explanatory code (pointed memory is not
    modified by the function) and a bit safer code.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251219-b4-container-of-const-asoc-qcom-v2-5-05fd2ecc06fe@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 49675f5e750a2a5d530c56d130017d0337eed18f
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 12:45:47 2025 +0100

    ASoC: qcom: topology: Constify pointed snd_soc_tplg_dapm_widget
    
    Several functions in topology.c receive pointers to 'struct
    snd_soc_tplg_dapm_widget' and do not modify their contents.  Constify
    the pointers for self-explanatory code (pointed memory is not modified
    by the function) and a bit safer code.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251219-b4-container-of-const-asoc-qcom-v2-4-05fd2ecc06fe@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 61fc95c4e3b26b3d1259a87124bdc25e4f71a8df
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 12:45:46 2025 +0100

    ASoC: qcom: topology: Constify pointed DAPM widget structs
    
    Few functions do not modify the pointed 'struct struct
    snd_soc_dapm_widget', so the pointers can be made as pointers to const
    for self-explanatory code (pointed memory is not modified by the
    function) and a bit safer code.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251219-b4-container-of-const-asoc-qcom-v2-3-05fd2ecc06fe@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 5e357c7e5e0920bd806a4e7c446c83715315f923
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 12:45:45 2025 +0100

    ASoC: qcom: topology: Constify pointed ar control structs
    
    audioreach_route_load() does not modify the pointed 'struct
    audioreach_module' and functions for connecting subgraphs do not change
    pointed 'struct snd_ar_control'.  Constify the pointers for
    self-explanatory code (pointed memory is not modified by the function)
    and a bit safer code.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251219-b4-container-of-const-asoc-qcom-v2-2-05fd2ecc06fe@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit c4be067a7b67f616b9ec85423a20be6be9b8ec37
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 12:45:44 2025 +0100

    ASoC: qcom: topology: Constify pointed topology and vendor structs
    
    Several functions in topology.c receive pointers to 'struct
    snd_soc_tplg_vendor_array' and 'struct snd_soc_tplg_private', and do not
    modify their contents.  Constify the pointers for self-explanatory code
    (pointed memory is not modified by the function) and a bit safer code.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251219-b4-container-of-const-asoc-qcom-v2-1-05fd2ecc06fe@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 99a3ef1e81cd1775bc1f8cc2ad188b1fc755d5cd
Author: Charles Keepax 
Date:   Mon Dec 15 15:36:49 2025 +0000

    ASoC: SDCA: Add ASoC jack hookup in class driver
    
    Add the necessary calls to the class driver to connect the ASoC jack
    from the machine driver.
    
    Signed-off-by: Charles Keepax 
    Link: https://patch.msgid.link/20251215153650.3913117-4-ckeepax@opensource.cirrus.com
    Reviewed-by: Bard Liao 
    Signed-off-by: Mark Brown 

commit 82e12800f563baf663277ef0017f40a335b8e84c
Author: Charles Keepax 
Date:   Mon Dec 15 15:36:48 2025 +0000

    ASoC: SDCA: Add ability to connect SDCA jacks to ASoC jacks
    
    Add handling for the ASoC jack API to SDCA to allow user-space to be
    hooked up normally.
    
    Signed-off-by: Charles Keepax 
    Link: https://patch.msgid.link/20251215153650.3913117-3-ckeepax@opensource.cirrus.com
    Reviewed-by: Bard Liao 
    Signed-off-by: Mark Brown 

commit 3addd63d1fba8d9013e00b06d9420e39271c0c4e
Author: Charles Keepax 
Date:   Mon Dec 15 15:36:47 2025 +0000

    ASoC: SDCA: Factor out jack handling into new c file
    
    The jack code is perhaps a bit large for being in the interrupt
    code directly. Improve the encapsulation by factoring out the
    jack handling code into a new c file, as is already done for HID
    and FDL. Whilst doing so also add a jack_state structure to hold
    the jack state for improved expandability in the future.
    
    Signed-off-by: Charles Keepax 
    Link: https://patch.msgid.link/20251215153650.3913117-2-ckeepax@opensource.cirrus.com
    Reviewed-by: Bard Liao 
    Signed-off-by: Mark Brown 

commit 5d2905f2c6acdd1c553f9b022dee730ab2cced71
Author: Sammy Malik 
Date:   Sat Dec 20 13:56:48 2025 +0000

    staging: greybus: Remove completed PWM TODO item.
    
    The pwm.c driver already uses pwm_ops::apply. This item was completed
    in commit 832ce36f44a2 ("staging: greybus: introduce pwm_ops::apply")
    but never removed from the TODO list.
    
    Removed the outdated TODO item.
    
    Signed-off-by: Sammy Malik 
    Link: https://patch.msgid.link/20251220135613.226912-1-sammy@parkour.is
    Signed-off-by: Greg Kroah-Hartman 

commit 8c475735085a7db53a33583ea7149611bf592233
Author: Tim Wassink 
Date:   Sun Dec 21 16:30:45 2025 +0100

    staging: sm750fb: Rename CamelCase variable fixId to fix_id
    
    The variable fixId violates the kernel coding style, which prefers
    snake_case for variable names. Rename it to fix_id to match the
    standard style.
    
    This is a coding style change only.
    
    Signed-off-by: Tim Wassink 
    Link: https://patch.msgid.link/20251221153102.38178-1-timwassink.dev@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit e31bac6d2c014908d09673c2bb273bc2b4181ebe
Author: Johan Hovold 
Date:   Fri Dec 19 11:59:28 2025 +0100

    staging: greybus: arche-platform: fix OF populate on driver rebind
    
    Since commit c6e126de43e7 ("of: Keep track of populated platform
    devices") child devices will not be created by of_platform_populate()
    if the devices had previously been deregistered individually so that the
    OF_POPULATED flag is still set in the corresponding OF nodes.
    
    Switch to using of_platform_depopulate() instead of open coding so that
    the child devices are created if the driver is rebound.
    
    Fixes: bc142bbb4ceb ("greybus: arche_platform: Remove child's platform device as part of _remove() fn")
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251219105928.23329-4-johan@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit 64c1fbe75951080920c174a875e0850b14f28d09
Author: Johan Hovold 
Date:   Fri Dec 19 11:59:27 2025 +0100

    staging: greybus: arche-platform: fix memleak on probe failure
    
    Make sure to depopulate the child devices in case of late probe
    failures to avoid leaking the corresponding resources.
    
    Fixes: fd60ac585607 ("greybus: arche-platform: Fix boot, poweroff and fw_flashing seq with APBs")
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251219105928.23329-3-johan@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit 2d77f822273ae38d44f46b2d325750239fc71641
Author: Johan Hovold 
Date:   Fri Dec 19 11:59:26 2025 +0100

    staging: greybus: arche-platform: fix coldboot probe error path
    
    Make sure to deregister the PM notifier in case the coldboot sequence
    fails during probe.
    
    Fixes: d29b67d44a7c ("greybus: arche-platform: Add support for init-off feature")
    Reported-by: Haotian Zhang 
    Link: https://lore.kernel.org/lkml/20251104090825.224-1-vulab@iscas.ac.cn/
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251219105928.23329-2-johan@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit bd2675ced141a5529bf08a2542a471f1837e4613
Author: Sanghyeon Lee 
Date:   Wed Dec 17 15:59:44 2025 +0000

    staging: rtl8723bs: remove unnecessary else block
    
    Remove unnecessary else block after return statement in
    odm_CfoTracking.c to fix a checkpatch warning.
    
    Signed-off-by: Sanghyeon Lee 
    Link: https://patch.msgid.link/20251217155944.9000-3-sanghae778@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 33eb12f5d8064f6efc8b790f4c67da01faaf3cdb
Author: Sanghyeon Lee 
Date:   Wed Dec 17 15:59:43 2025 +0000

    staging: rtl8723bs: remove unnecessary braces
    
    Remove unnecessary braces from single-line conditional statements in
    odm_CfoTracking.c to fix a checkpatch warning.
    
    Signed-off-by: Sanghyeon Lee 
    Link: https://patch.msgid.link/20251217155944.9000-2-sanghae778@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit f785a31395d9cafb8b2c42c7358fad72a6463142
Author: Puranjay Mohan 
Date:   Fri Dec 19 11:13:08 2025 -0800

    bpf: arm64: Fix sparse warnings
    
    ctx->image is declared as __le32 because arm64 instructions are LE
    regardless of CPU's runtime endianness. emit_u32_data() emits raw data
    and not instructions so cast the value to __le32 to fix the sparse
    warning.
    
    Cast function pointer to void * before doing arithmetic.
    
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20251219191310.3204425-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 50c26c301c5176cc8b431044390e10ec862b9b77
Author: René Rebe 
Date:   Fri Dec 12 21:05:04 2025 +0100

    drm/ast: Swap framebuffer writes on big-endian machines
    
    Swap the pixel data when writing to framebuffer memory on big-endian
    machines. Fixes incorrect output. Aspeed graphics does not appear to
    support big-endian framebuffers after AST2400, although the feature
    has been documented.
    
    There's a lengthy discussion at [1].
    
    v5:
    - avoid restricted cast from __be16 (kernel test robot)
    
    Signed-off-by: René Rebe 
    Link: https://lore.kernel.org/dri-devel/20251202.170626.2134482663677806825.rene@exactco.de/ # [1]
    Reviewed-by: Thomas Zimmermann 
    Signed-off-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/20251212.210504.1355099120650239629.rene@exactco.de

commit 4e44c635ba8c281f74001d47e20bbcb7f516530c
Author: Yury Norov (NVIDIA) 
Date:   Mon Dec 15 19:18:06 2025 -0500

    iio: adc: ad7606_spi: use bitmap_full() in ad7606_spi_update_scan_mode()
    
    bitmap_full() is less verbose and more efficient, as it stops traversing
    scan_mask as soon as the 1st unset bit found.
    
    Signed-off-by: Yury Norov (NVIDIA) 
    Reviewed-by: David Lechner 
    Signed-off-by: Jonathan Cameron 

commit eec44b04eb0e93143f89a2e2cb04159f62c2e8a3
Author: Tomas Borquez 
Date:   Mon Dec 15 16:08:02 2025 -0300

    staging: iio: ad9832: clean up whitespace
    
    Remove unnecessary blank lines between comment sections to improve
    readability.
    
    Signed-off-by: Tomas Borquez 
    Signed-off-by: Jonathan Cameron 

commit 6e5f6bf2e3f036e6d7466d2a3322445729ea3356
Author: Frank Li 
Date:   Mon Dec 15 11:51:11 2025 -0500

    iio: magnetometer: Add mmc5633 sensor
    
    Add mmc5633 sensor basic support.
    - Support read 20 bits X/Y/Z magnetic.
    - Support I3C HDR mode to send start measurememt command.
    - Support I3C HDR mode to read all sensors data by one command.
    
    Co-developed-by: Carlos Song 
    Signed-off-by: Carlos Song 
    Co-developed-by: Adrian Fluturel 
    Signed-off-by: Adrian Fluturel 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Frank Li 
    Signed-off-by: Jonathan Cameron 

commit 419add567f73dcef9dcc99c67ac8ed89367079b2
Author: Frank Li 
Date:   Mon Dec 15 11:51:10 2025 -0500

    dt-bindings: trivial-devices: add MEMSIC 3-axis magnetometer
    
    Add compatible string 'memsic,mmc5603' and 'memsic,mmc5633' for
    MEMSIC 3-axis magnetometer.
    
    Acked-by: Conor Dooley 
    Signed-off-by: Frank Li 
    Signed-off-by: Jonathan Cameron 

commit d2749ae85aec685e52e0474f445f6a8552363eb0
Author: Matt Bobrowski 
Date:   Tue Dec 16 13:30:00 2025 +0000

    selftests/bpf: add test case for BPF LSM hook bpf_lsm_mmap_file
    
    Add a trivial test case asserting that the BPF verifier enforces
    PTR_MAYBE_NULL semantics on the struct file pointer argument of BPF
    LSM hook bpf_lsm_mmap_file().
    
    Dereferencing the struct file pointer passed into bpf_lsm_mmap_file()
    without explicitly performing a NULL check first should not be
    permitted by the BPF verifier as it can lead to NULL pointer
    dereferences and a kernel crash.
    
    Signed-off-by: Matt Bobrowski 
    Acked-by: Song Liu 
    Link: https://lore.kernel.org/r/20251216133000.3690723-2-mattbobrowski@google.com
    Signed-off-by: Alexei Starovoitov 

commit 94e948b7e684c0465bb3faca8fafee5caf421b84
Author: Matt Bobrowski 
Date:   Tue Dec 16 13:29:59 2025 +0000

    bpf: annotate file argument as __nullable in bpf_lsm_mmap_file
    
    As reported in [0], anonymous memory mappings are not backed by a
    struct file instance. Consequently, the struct file pointer passed to
    the security_mmap_file() LSM hook is NULL in such cases.
    
    The BPF verifier is currently unaware of this, allowing BPF LSM
    programs to dereference this struct file pointer without needing to
    perform an explicit NULL check. This leads to potential NULL pointer
    dereference and a kernel crash.
    
    Add a strong override for bpf_lsm_mmap_file() which annotates the
    struct file pointer parameter with the __nullable suffix. This
    explicitly informs the BPF verifier that this pointer (PTR_MAYBE_NULL)
    can be NULL, forcing BPF LSM programs to perform a check on it before
    dereferencing it.
    
    [0] https://lore.kernel.org/bpf/5e460d3c.4c3e9.19adde547d8.Coremail.kaiyanm@hust.edu.cn/
    
    Reported-by: Kaiyan Mei 
    Reported-by: Yinhao Hu 
    Reviewed-by: Dongliang Mu 
    Closes: https://lore.kernel.org/bpf/5e460d3c.4c3e9.19adde547d8.Coremail.kaiyanm@hust.edu.cn/
    Signed-off-by: Matt Bobrowski 
    Acked-by: Song Liu 
    Link: https://lore.kernel.org/r/20251216133000.3690723-1-mattbobrowski@google.com
    Signed-off-by: Alexei Starovoitov 

commit e09f6be4a3558e01afb4d16705ce57006a6f9712
Author: Uros Bizjak 
Date:   Mon Dec 8 17:33:34 2025 +0100

    x86/bpf: Avoid emitting LOCK prefix for XCHG atomic ops
    
    The x86 XCHG instruction is implicitly locked when one of the
    operands is a memory location, making an explicit LOCK prefix
    unnecessary.
    
    Stop emitting the LOCK prefix for BPF_XCHG in the JIT atomic
    read-modify-write helpers. This avoids redundant instruction
    prefixes while preserving correct atomic semantics.
    
    No functional change for other atomic operations.
    
    Signed-off-by: Uros Bizjak 
    Cc: Alexei Starovoitov 
    Cc: Daniel Borkmann 
    Cc: Andrii Nakryiko 
    Cc: Thomas Gleixner 
    Cc: Ingo Molnar 
    Cc: Borislav Petkov 
    Cc: Dave Hansen 
    Cc: "H. Peter Anvin" 
    Link: https://lore.kernel.org/r/20251208163420.7643-1-ubizjak@gmail.com
    Signed-off-by: Alexei Starovoitov 

commit c2f2f005a1c2e2d06f07511068917fa729614c18
Merge: 3d60306b7bb4a3 c3e34f88f99928
Author: Alexei Starovoitov 
Date:   Sun Dec 21 10:54:37 2025 -0800

    Merge branch 'bpf-optimize-recursion-detection-on-arm64'
    
    Puranjay Mohan says:
    
    ====================
    bpf: Optimize recursion detection on arm64
    
    V2: https://lore.kernel.org/all/20251217233608.2374187-1-puranjay@kernel.org/
    Changes in v2->v3:
    - Added acked by Yonghong
    - Patch 2:
            - Change alignment of active from 8 to 4
            - Use le32_to_cpu in place of get_unaligned_le32()
    
    V1: https://lore.kernel.org/all/20251217162830.2597286-1-puranjay@kernel.org/
    Changes in V1->V2:
    - Patch 2:
            - Put preempt_enable()/disable() around RMW accesses to mitigate
              race conditions. Because on CONFIG_PREEMPT_RCU and sleepable
              bpf programs, preemption can cause no bpf prog to execute in
              case of recursion.
    
    BPF programs detect recursion using a per-CPU 'active' flag in struct
    bpf_prog. The trampoline currently sets/clears this flag with atomic
    operations.
    
    On some arm64 platforms (e.g., Neoverse V2 with LSE), per-CPU atomic
    operations are relatively slow. Unlike x86_64 - where per-CPU updates
    can avoid cross-core atomicity, arm64 LSE atomics are always atomic
    across all cores, which is unnecessary overhead for strictly per-CPU
    state.
    
    This patch removes atomics from the recursion detection path on arm64.
    
    It was discovered in [1] that per-CPU atomics that don't return a value
    were extremely slow on some arm64 platforms, Catalin added a fix in
    commit 535fdfc5a228 ("arm64: Use load LSE atomics for the non-return
    per-CPU atomic operations") to solve this issue, but it seems to have
    caused a regression on the fentry benchmark.
    
    Using the fentry benchmark from the bpf selftests shows the following:
    
      ./tools/testing/selftests/bpf/bench trig-fentry
    
     +---------------------------------------------+------------------------+
     |               Configuration                 | Total Operations (M/s) |
     +---------------------------------------------+------------------------+
     | bpf-next/master with Catalin’s fix reverted |         51.770         |
     |---------------------------------------------|------------------------|
     | bpf-next/master                             |         43.271         |
     | bpf-next/master with this change            |         43.271         |
     +---------------------------------------------+------------------------+
    
    All benchmarks were run on a KVM based vm with Neoverse-V2 and 8 cpus.
    
    This patch yields a 25% improvement in this benchmark compared to
    bpf-next. Notably, reverting Catalin's fix also results in a performance
    gain for this benchmark, which is interesting but expected.
    
    For completeness, this benchmark was also run with the change enabled on
    x86-64, which resulted in a 30% regression in the fentry benchmark. So,
    it is only enabled on arm64.
    
    P.S. - Here is more data with other program types:
    
     +-----------------+-----------+-----------+----------+
     |     Metric      |  Before   |   After   | % Diff   |
     +-----------------+-----------+-----------+----------+
     | fentry          |   43.149  |   53.948  | +25.03%  |
     | fentry.s        |   41.831  |   50.937  | +21.76%  |
     | rawtp           |   50.834  |   58.731  | +15.53%  |
     | fexit           |   31.118  |   34.360  | +10.42%  |
     | tp              |   39.536  |   41.632  |  +5.30%  |
     | syscall-count   |    8.053  |    8.305  |  +3.13%  |
     | fmodret         |   33.940  |   34.769  |  +2.44%  |
     | kprobe          |    9.970  |    9.998  |  +0.28%  |
     | usermode-count  |  224.886  |  224.839  |  -0.02%  |
     | kernel-count    |  154.229  |  153.043  |  -0.77%  |
     +-----------------+-----------+-----------+----------+
    
    [1] https://lore.kernel.org/all/e7d539ed-ced0-4b96-8ecd-048a5b803b85@paulmck-laptop/
    ====================
    
    Link: https://patch.msgid.link/20251219184422.2899902-1-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit c3e34f88f9992866a1fb510850921a8fe299a97b
Author: Puranjay Mohan 
Date:   Fri Dec 19 10:44:18 2025 -0800

    bpf: arm64: Optimize recursion detection by not using atomics
    
    BPF programs detect recursion using a per-CPU 'active' flag in struct
    bpf_prog. The trampoline currently sets/clears this flag with atomic
    operations.
    
    On some arm64 platforms (e.g., Neoverse V2 with LSE), per-CPU atomic
    operations are relatively slow. Unlike x86_64 - where per-CPU updates
    can avoid cross-core atomicity, arm64 LSE atomics are always atomic
    across all cores, which is unnecessary overhead for strictly per-CPU
    state.
    
    This patch removes atomics from the recursion detection path on arm64 by
    changing 'active' to a per-CPU array of four u8 counters, one per
    context: {NMI, hard-irq, soft-irq, normal}. The running context uses a
    non-atomic increment/decrement on its element.  After increment,
    recursion is detected by reading the array as a u32 and verifying that
    only the expected element changed; any change in another element
    indicates inter-context recursion, and a value > 1 in the same element
    indicates same-context recursion.
    
    For example, starting from {0,0,0,0}, a normal-context trigger changes
    the array to {0,0,0,1}.  If an NMI arrives on the same CPU and triggers
    the program, the array becomes {1,0,0,1}. When the NMI context checks
    the u32 against the expected mask for normal (0x00000001), it observes
    0x01000001 and correctly reports recursion. Same-context recursion is
    detected analogously.
    
    Acked-by: Yonghong Song 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20251219184422.2899902-3-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit 93f0d09697613beba922a387d21a09a41eeefef5
Author: Puranjay Mohan 
Date:   Fri Dec 19 10:44:17 2025 -0800

    bpf: move recursion detection logic to helpers
    
    BPF programs detect recursion by doing atomic inc/dec on a per-cpu
    active counter from the trampoline. Create two helpers for operations on
    this active counter, this makes it easy to changes the recursion
    detection logic in future.
    
    This commit makes no functional changes.
    
    Acked-by: Yonghong Song 
    Signed-off-by: Puranjay Mohan 
    Link: https://lore.kernel.org/r/20251219184422.2899902-2-puranjay@kernel.org
    Signed-off-by: Alexei Starovoitov 

commit bf0bba486b5bd5e2d6100ed7dd1e38e0304ba40f
Author: Kurt Borja 
Date:   Thu Dec 11 23:25:44 2025 -0500

    iio: adc: Add ti-ads1018 driver
    
    Add ti-ads1018 driver for Texas Instruments ADS1018 and ADS1118 SPI
    analog-to-digital converters.
    
    This chips' MOSI pin is shared with a data-ready interrupt. Defining
    this interrupt in devicetree is optional, therefore we only create an
    IIO trigger if one is found.
    
    Handling this interrupt requires some considerations. When enabling the
    trigger the CS line is tied low (active), thus we need to hold
    spi_bus_lock() too, to avoid state corruption. This is done inside the
    set_trigger_state() callback, to let users use other triggers without
    wasting a bus lock.
    
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Kurt Borja 
    Reviewed-by: David Lechner 
    Signed-off-by: Jonathan Cameron 

commit 43fabbb9249f4e609ba15533f49c3738344ed801
Author: Kurt Borja 
Date:   Thu Dec 11 23:25:43 2025 -0500

    dt-bindings: iio: adc: Add TI ADS1018/ADS1118
    
    Add documentation for Texas Instruments ADS1018 and ADS1118
    analog-to-digital converters.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Kurt Borja 
    Reviewed-by: David Lechner 
    Signed-off-by: Jonathan Cameron 

commit e23f687c0d81802b54b25c95f23e299ddf0ba28e
Author: Jean-Baptiste Maneyrol 
Date:   Thu Dec 18 10:21:17 2025 +0100

    iio: imu: inv_icm42600: enable temp polling when buffer is on
    
    Delete iio_device_claim_direct_mode() when reading temperature.
    It enables polling of temperature data while buffer is on and it
    doesn't have any impact on the other sensors.
    
    Signed-off-by: Jean-Baptiste Maneyrol 
    Signed-off-by: Jonathan Cameron 

commit 676cc11b70221671b7257c90064ada4192d7baed
Author: Petre Rodan 
Date:   Thu Dec 18 13:05:43 2025 +0200

    iio: pressure: mprls0025pa: Kconfig allow bus selection
    
    Allow the user to select either the SPI or the i2c bus specific
    module and autoselect core if needed.
    
    Signed-off-by: Petre Rodan 
    Reviewed-by: Marcelo Schmitt 
    Signed-off-by: Jonathan Cameron 

commit e7324980fa91f5bc0d1f5adc82d31775d4cab5bd
Author: Fiona Klute 
Date:   Thu Dec 18 16:12:05 2025 +0100

    iio: chemical: scd4x: expose timestamp channel
    
    Timestamps were already written to the buffer in
    scd4x_trigger_handler(), this patch makes them available as a channel.
    
    Signed-off-by: Fiona Klute 
    Signed-off-by: Jonathan Cameron 

commit c83e42990303c05e60001d636212502ed5a2d48a
Author: Thomas Zimmermann 
Date:   Mon Dec 8 11:17:34 2025 +0100

    vt: Remove con_debug_enter/_leave from struct consw
    
    There are no implementations of con_debug_enter and con_debug_leave.
    Remove the callbacks from struct consw and clean up the caller.
    
    This is a functional revert of commit b45cfba4e900 ("vt,console,kdb:
    implement atomic console enter/leave functions").
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Greg Kroah-Hartman 
    Link: https://patch.msgid.link/20251208102851.40894-3-tzimmermann@suse.de

commit 353e72df138aabc8e6dc60e144eebe806fc64428
Author: Thomas Zimmermann 
Date:   Mon Dec 8 11:17:33 2025 +0100

    vt: Remove trailing whitespace
    
    Fix coding style in vt.c
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Greg Kroah-Hartman 
    Link: https://patch.msgid.link/20251208102851.40894-2-tzimmermann@suse.de

commit 3f41307d589c2f25d556d47b165df808124cd0c4
Author: Thomas Zimmermann 
Date:   Fri Dec 12 17:00:36 2025 +0100

    drm/tests: shmem: Hold reservation lock around purge
    
    Acquire and release the GEM object's reservation lock around calls
    to the object's purge operation. The tests use
    drm_gem_shmem_purge_locked(), which led to errors such as show below.
    
    [   58.709128] WARNING: CPU: 1 PID: 1354 at drivers/gpu/drm/drm_gem_shmem_helper.c:515 drm_gem_shmem_purge_locked+0x51c/0x740
    
    Only export the new helper drm_gem_shmem_purge() for Kunit tests.
    This is not an interface for regular drivers.
    
    Signed-off-by: Thomas Zimmermann 
    Fixes: 954907f7147d ("drm/shmem-helper: Refactor locked/unlocked functions")
    Cc: dri-devel@lists.freedesktop.org
    Cc:  # v6.16+
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251212160317.287409-6-tzimmermann@suse.de

commit 607d07d8cc0b835a8701259f08a03dc149b79b4f
Author: Thomas Zimmermann 
Date:   Fri Dec 12 17:00:35 2025 +0100

    drm/tests: shmem: Hold reservation lock around madvise
    
    Acquire and release the GEM object's reservation lock around calls
    to the object's madvide operation. The tests use
    drm_gem_shmem_madvise_locked(), which led to errors such as show below.
    
    [   58.339389] WARNING: CPU: 1 PID: 1352 at drivers/gpu/drm/drm_gem_shmem_helper.c:499 drm_gem_shmem_madvise_locked+0xde/0x140
    
    Only export the new helper drm_gem_shmem_madvise() for Kunit tests.
    This is not an interface for regular drivers.
    
    Signed-off-by: Thomas Zimmermann 
    Fixes: 954907f7147d ("drm/shmem-helper: Refactor locked/unlocked functions")
    Cc: dri-devel@lists.freedesktop.org
    Cc:  # v6.16+
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251212160317.287409-5-tzimmermann@suse.de

commit cda83b099f117f2a28a77bf467af934cb39e49cf
Author: Thomas Zimmermann 
Date:   Fri Dec 12 17:00:34 2025 +0100

    drm/tests: shmem: Hold reservation lock around vmap/vunmap
    
    Acquire and release the GEM object's reservation lock around vmap and
    vunmap operations. The tests use vmap_locked, which led to errors such
    as show below.
    
    [  122.292030] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:390 drm_gem_shmem_vmap_locked+0x3a3/0x6f0
    
    [  122.468066] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:293 drm_gem_shmem_pin_locked+0x1fe/0x350
    
    [  122.563504] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:234 drm_gem_shmem_get_pages_locked+0x23c/0x370
    
    [  122.662248] WARNING: CPU: 2 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:452 drm_gem_shmem_vunmap_locked+0x101/0x330
    
    Only export the new vmap/vunmap helpers for Kunit tests. These are
    not interfaces for regular drivers.
    
    Signed-off-by: Thomas Zimmermann 
    Fixes: 954907f7147d ("drm/shmem-helper: Refactor locked/unlocked functions")
    Cc: dri-devel@lists.freedesktop.org
    Cc:  # v6.16+
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251212160317.287409-4-tzimmermann@suse.de

commit b47b9ecef309459278eb52f02b50eefdeaac4f6d
Author: Thomas Zimmermann 
Date:   Fri Dec 12 17:00:33 2025 +0100

    drm/tests: shmem: Add clean-up action to unpin pages
    
    Automatically unpin pages on cleanup. The test currently fails with
    the error
    
    [   58.246263] drm-kunit-mock-device drm_gem_shmem_test_get_sg_table.drm-kunit-mock-device: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
    
    while cleaning up the GEM object. The pin count has to be zero at this
    point.
    
    Signed-off-by: Thomas Zimmermann 
    Fixes: d586b535f144 ("drm/shmem-helper: Add and use pages_pin_count")
    Cc: dri-devel@lists.freedesktop.org
    Cc:  # v6.16+
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251212160317.287409-3-tzimmermann@suse.de

commit 89f23d42006630dd94c01a8c916f8c648141ad8e
Author: Thomas Zimmermann 
Date:   Fri Dec 12 17:00:32 2025 +0100

    drm/tests: shmem: Swap names of export tests
    
    GEM SHMEM has 2 helpers for exporting S/G tables. Swap the names of
    the rsp. tests, so that each matches the helper it tests.
    
    Signed-off-by: Thomas Zimmermann 
    Fixes: 93032ae634d4 ("drm/test: add a test suite for GEM objects backed by shmem")
    Cc: dri-devel@lists.freedesktop.org
    Cc:  # v6.8+
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251212160317.287409-2-tzimmermann@suse.de

commit 8dfbb5fcb773a6481407ec890280cc3b1ff8e234
Author: Tudor Ambarus 
Date:   Thu Nov 20 11:29:36 2025 +0000

    soc: samsung: exynos-chipid: use dev_err_probe where appropiate
    
    Use dev_err_probe() to benefit of the standardized format of the error
    code (e.g. "ENODEV" instead of -19), to get meanigful error messages, and
    for more compact error paths.
    
    Signed-off-by: Tudor Ambarus 
    Reviewed-by: André Draszik 
    Link: https://patch.msgid.link/20251120-gs101-chipid-v3-2-1aeaa8b7fe35@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit 1b3376d2167766e9f5ac05a03ca4625777090ce7
Author: Tudor Ambarus 
Date:   Thu Nov 20 11:29:35 2025 +0000

    soc: samsung: exynos-chipid: use devm action to unregister soc device
    
    Simplify the unwinding of the soc device by using a devm action.
    Add the action before the exynos_asv_init() to avoid an explicit call
    to soc_device_unregister().
    
    Signed-off-by: Tudor Ambarus 
    Reviewed-by: André Draszik 
    Link: https://patch.msgid.link/20251120-gs101-chipid-v3-1-1aeaa8b7fe35@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit abc6930a3150003e1a436e906ffd1cafd679acfc
Author: Raghav Sharma 
Date:   Wed Nov 19 17:17:44 2025 +0530

    arm64: dts: exynosautov920: add CMU_MFD clock DT nodes
    
    Add required dt node for cmu_mfd block, which provides
    clocks for MFD IP
    
    Signed-off-by: Raghav Sharma 
    Reviewed-by: Alim Akhtar 
    Link: https://patch.msgid.link/20251119114744.1914416-4-raghav.s@samsung.com
    Signed-off-by: Krzysztof Kozlowski 

commit efa45bcc73e1a30705eed28933e341d36a08bb84
Author: Raghav Sharma 
Date:   Wed Nov 19 17:17:43 2025 +0530

    clk: samsung: exynosautov920: add clock support
    
    Add support for CMU_MFD which provides clocks to MFD block, and
    register the required compatible and cmu_info for the same.
    
    Signed-off-by: Raghav Sharma 
    Reviewed-by: Alim Akhtar 
    Link: https://patch.msgid.link/20251119114744.1914416-3-raghav.s@samsung.com
    Signed-off-by: Krzysztof Kozlowski 

commit db1cc4902f2f51977e427f796ea8daf49ba93c69
Author: Raghav Sharma 
Date:   Wed Nov 19 17:17:42 2025 +0530

    dt-bindings: clock: exynosautov920: add MFD clock definitions
    
    Add device tree clock binding definitions for CMU_MFD
    
    Signed-off-by: Raghav Sharma 
    Reviewed-by: Alim Akhtar 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251119114744.1914416-2-raghav.s@samsung.com
    Signed-off-by: Krzysztof Kozlowski 

commit 4ea6e9b507afee522dc2e543400c3949b9d16d7d
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 15:31:54 2025 +0100

    iio: adc: sc27xx: Simplify with dev_err_probe
    
    Use dev_err_probe() to make error code handling simpler and handle
    deferred probe nicely (avoid spamming logs).
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Jonathan Cameron 

commit df2a034aef258ec39524e8fd14440c1b8ce622ff
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 15:31:53 2025 +0100

    iio: adc: rockchip: Simplify with dev_err_probe
    
    Use dev_err_probe() to make error code handling simpler and handle
    deferred probe nicely (avoid spamming logs).
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Shawn Lin 
    Signed-off-by: Jonathan Cameron 

commit f8831384dc8b79d757a3ea0dd7c1dbeb10c3e26f
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 15:31:52 2025 +0100

    iio: adc: qcom-spmi-rradc: Simplify with dev_err_probe
    
    Use dev_err_probe() to make error code handling simpler.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Jonathan Cameron 

commit 0dce3f98a77fec3cd390d655d97cbed1ff23d539
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 15:31:51 2025 +0100

    iio: adc: exynos: Simplify with dev_err_probe
    
    Use dev_err_probe() to make error code handling simpler and handle
    deferred probe nicely (avoid spamming logs).
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Jonathan Cameron 

commit dcc3ac29f46fff6775c0a945afc68fd9dece6d34
Author: Krzysztof Kozlowski 
Date:   Fri Dec 19 15:31:50 2025 +0100

    iio: adc: aspeed: Simplify with dev_err_probe
    
    Use dev_err_probe() to make error code handling simpler and handle
    deferred probe nicely (avoid spamming logs).
    
    Signed-off-by: Krzysztof Kozlowski 
    Signed-off-by: Jonathan Cameron 

commit e358215e0a8e1a593c064ce35e4b116fb27de358
Author: Nuno Sá 
Date:   Fri Dec 19 15:28:17 2025 +0000

    iio: buffer-dmaengine: Fix coding style complains
    
    Just making sure checkpatch is happy. No functional change intended.
    
    Signed-off-by: Nuno Sá 
    Signed-off-by: Jonathan Cameron 

commit a0dcec6aa8ced73edf9c72a853218d56035770ab
Author: Nuno Sá 
Date:   Fri Dec 19 15:28:16 2025 +0000

    iio: buffer-dmaengine: Use the cleanup.h API
    
    Make use of the cleanup.h API for locks in order to simplify some code
    paths.
    
    Signed-off-by: Nuno Sá 
    Signed-off-by: Jonathan Cameron 

commit 0c1316b9521af0801e2502f390a89df5459094ed
Author: Nuno Sá 
Date:   Fri Dec 19 15:28:15 2025 +0000

    iio: buffer-dma: Fix coding style complains
    
    Just making sure checkpatch is happy. No functional change intended.
    
    Signed-off-by: Nuno Sá 
    Signed-off-by: Jonathan Cameron 

commit 6ffd02b82243d9907b5f5d2c7a2fc6a62669eece
Author: Nicolas Frattaroli 
Date:   Mon Nov 24 12:07:02 2025 +0100

    interconnect: mediatek: Aggregate bandwidth with saturating add
    
    By using a regular non-overflow-checking add, the MediaTek icc-emi
    driver will happy wrap at U32_MAX + 1 to 0. As it's common for the
    interconnect core to fill in INT_MAX values, this is not a hypothetical
    situation, but something that actually happens in regular use. This
    would be pretty disasterous if anything used this driver.
    
    Replace the addition with an overflow-checked addition from overflow.h,
    and saturate to U32_MAX if an overflow is detected.
    
    Fixes: b45293799f75 ("interconnect: mediatek: Add MediaTek MT8183/8195 EMI Interconnect driver")
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Frattaroli 
    Link: https://lore.kernel.org/r/20251124-mt8196-dvfsrc-v2-13-d9c1334db9f3@collabora.com
    Signed-off-by: Georgi Djakov 

commit 510f8214440c553e81774c5822437ccf154e9e38
Author: Nicolas Frattaroli 
Date:   Mon Nov 24 12:07:01 2025 +0100

    interconnect: mediatek: Don't hijack parent device
    
    If the intention is that users of the interconnect declare their
    relationship to the child icc_emi node of the dvfsrc controller, then
    this code never worked. That's because it uses the parent dvfsrc device
    as the device it passes to the interconnect core framework, which means
    all the OF parsing is broken.
    
    Use the actual device instead, and pass the dvfsrc parent into the
    dvfsrc calls.
    
    Fixes: b45293799f75 ("interconnect: mediatek: Add MediaTek MT8183/8195 EMI Interconnect driver")
    Reviewed-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Frattaroli 
    Link: https://lore.kernel.org/r/20251124-mt8196-dvfsrc-v2-12-d9c1334db9f3@collabora.com
    Signed-off-by: Georgi Djakov 

commit ce69a970390ce182ccece5dea61083588ca5379a
Author: AngeloGioacchino Del Regno 
Date:   Mon Nov 24 12:07:00 2025 +0100

    interconnect: mediatek: Add support for MediaTek MT8196 EMI ICC
    
    Add a new driver with data to register the External Memory
    Interface (EMI) Interconnect on the MediaTek MT8196 Chromebook
    SoC.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Signed-off-by: Nicolas Frattaroli 
    Link: https://lore.kernel.org/r/20251124-mt8196-dvfsrc-v2-11-d9c1334db9f3@collabora.com
    Signed-off-by: Georgi Djakov 

commit dee49a1860168f912e3b3444626c060e9e72d491
Author: AngeloGioacchino Del Regno 
Date:   Mon Nov 24 12:06:52 2025 +0100

    dt-bindings: interconnect: mt8183-emi: Add support for MT8196 EMI
    
    Add a new compatible for the External Memory Interface Interconnect
    found on the MediaTek MT8196 Chromebook SoC.
    
    Signed-off-by: AngeloGioacchino Del Regno 
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Nicolas Frattaroli 
    Link: https://lore.kernel.org/r/20251124-mt8196-dvfsrc-v2-3-d9c1334db9f3@collabora.com
    Signed-off-by: Georgi Djakov 

commit 247a357a9101b76d832b7e19d85ba8dcfb3e3e8d
Author: Nuno Sá 
Date:   Fri Dec 19 15:28:14 2025 +0000

    iio: buffer-dma: Turn iio_dma_buffer_init() void
    
    iio_dma_buffer_init() always return 0. Therefore there's no point in
    returning int.
    
    While at it, fix a mismatch between the function declaration and definition
    regarding the struct device (dma_dev != dev).
    
    Signed-off-by: Nuno Sá 
    Signed-off-by: Jonathan Cameron 

commit 07d6dc1708838e94e3da7294e601adf8da1d9414
Author: Nuno Sá 
Date:   Fri Dec 19 15:28:13 2025 +0000

    iio: buffer-dma: Use the cleanup.h API
    
    Make use of the cleanup.h API for locks and memory allocation in order
    to simplify some code paths.
    
    Signed-off-by: Nuno Sá 
    Signed-off-by: Jonathan Cameron 

commit 09ccc1b65ca6bb61d05f163e063b98d89d4d7d06
Author: Nuno Sá 
Date:   Fri Dec 19 15:28:12 2025 +0000

    iio: buffer-dma: Use lockdep for locking annotations
    
    Don't use mutex_is_locked() + WARN_ON() for checking if a specif lock is
    taken. Instead use the existing annotations which means
    lockdep_assert_held().
    
    Signed-off-by: Nuno Sá 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 0a272aaf5fc110a34f4a5aeb61db4b6d105c62e9
Author: Nuno Sá 
Date:   Fri Dec 19 15:40:39 2025 +0000

    iio: adc: adi-axi-adc: Slightly simplify axi_adc_create_platform_device()
    
    There's no point in having a ret variable and checking for errors (as we
    do nothing with it). Instead, save some lines of code and directly
    return the devm_add_action_or_reset() call.
    
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Nuno Sá 
    Signed-off-by: Jonathan Cameron 

commit 634a6316617e2ced7016b002d0b284a1502e9601
Author: Nuno Sá 
Date:   Fri Dec 19 15:40:38 2025 +0000

    iio: adc: adi-axi-adc: Make use of dev_err_probe()
    
    Be consistent and use dev_err_probe() as in all other places in the
    .probe() path.
    
    While at it, remove the line break in the version condition. Yes, it
    goes over the 80 column limit but I do think the line break hurts
    readability in this case. And use a struct device *dev helper for
    neater code.
    
    Signed-off-by: Nuno Sá 
    Signed-off-by: Jonathan Cameron 

commit 47d323ce1e8934be36ec475b3bed7ad90d15d35d
Author: Petre Rodan 
Date:   Sun Dec 7 08:00:48 2025 +0200

    iio: pressure: add Honeywell ABP2 driver
    
    Adds driver for digital Honeywell ABP2 series of board mount
    pressure and temperature sensors.
    
    This driver covers 113 different pressure ranges and units on
    both i2c and SPI buses.
    
    The communication protocol involves sending two simple commands
    to the sensor and there is no register access or a memory map.
    For this reason the regmap API was not used.
    
    The i2c address is hardcoded and depends on the part number.
    
    Optional end of conversion interrupt control is present on the
    i2c variants of the chips.
    The EOC can also be defined for the SPI variants if a non-ABP2
    but compatible chip is to be driven.
    
    Tested on two sensors (ABP2MRRT001PDSA3 and ABP2DANT001BA2A3).
    
    ocuments/sps-siot-abp2-series-datasheet-32350268-en.pdf
    
    Datasheet: https://prod-edam.honeywell.com/content/dam/honeywell-edam/sps/siot/en-us/products/sensors/pressure-sensors/board-mount-pressure-sensors/basic-abp2-series/d
    Signed-off-by: Petre Rodan 
    Signed-off-by: Jonathan Cameron 

commit b2192756759308f49fbca435b5a0b9a7de7054a9
Author: Petre Rodan 
Date:   Sun Dec 7 08:00:47 2025 +0200

    dt-bindings: iio: pressure: add honeywell,abp2030pa
    
    Adds binding for digital Honeywell ABP2 series pressure and temperature
    sensors.
    The i2c address is hardcoded and depends on the part number.
    There is an optional interrupt that signals the end of conversion.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Petre Rodan 
    Signed-off-by: Jonathan Cameron 

commit 77a017410b5c59d549fefa76b2fb62173de7b30c
Author: Tomas Melin 
Date:   Tue Dec 9 15:38:12 2025 +0000

    iio: adc: ad9467: add support for ad9211
    
    The AD9211 is a 10-bit monolithic sampling analog-to-digital converter
    optimized for high performance, low power, and ease of use. The product
    operates at up to a 300 MSPS conversion rate and is optimized for
    outstanding dynamic performance in wideband carrier and broadband systems.
    
    The scale table implemented here is not an exact match with the
    datasheet as the table presented there is missing some information.
    The reference presents these values as being linear,
    but that does not add up. There is information missing in the table.
    Implemented scale table matches values at the middle and at the ends,
    smoothing the curve towards middle and end.
    Impact on end result from deviation in scale factor affects only software
    using it for scaling. All the possible hw-settings are also available with
    this implementation.
    
    Datasheet: https://www.analog.com/media/en/technical-documentation/data-sheets/AD9211.pdf
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Tomas Melin 
    Signed-off-by: Jonathan Cameron 

commit 1f0b6415b642b28811c8fe295e85c2a550bf05d1
Author: Tomas Melin 
Date:   Tue Dec 9 15:38:11 2025 +0000

    iio: adc: ad9467: sort header includes
    
    Include headers in ascending order.
    
    Signed-off-by: Tomas Melin 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 34744a6ddf63316db707d090737117c212ce136b
Author: Tomas Melin 
Date:   Tue Dec 9 15:38:10 2025 +0000

    dt-bindings: adc: ad9467: add support for ad9211
    
    This device has e.g. different scaling values than currently
    listed devices.
    
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Tomas Melin 
    Signed-off-by: Jonathan Cameron 

commit 6fa9eb81f32a50fe1953e1b9ab839e7467c94274
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:56 2025 +0900

    dt-bindings: iio: adc: Allow interrupts property for AST2600
    
    The device has interrupts allocated according to the datasheet, and
    the devicetree already defines the interrupt property. Address existing
    warnings by allowing the property.
    
    Signed-off-by: Andrew Jeffery 
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Jonathan Cameron 

commit b8c7340e2c623d1dc628421fd4c1a2d89b6ea694
Author: Antoniu Miclaus 
Date:   Fri Dec 12 17:38:26 2025 +0200

    iio: amplifiers: adl8113: add driver support
    
    Add support for adl8113 10MHz to 12GHz Low Noise Amplifier with
    10MHz to 14GHz bypass switches.
    
    Signed-off-by: Antoniu Miclaus 
    Signed-off-by: Jonathan Cameron 

commit 09140a720e00e7498435796b4ed648ca3a71cf59
Author: Antoniu Miclaus 
Date:   Fri Dec 12 17:38:25 2025 +0200

    dt-bindings: iio: amplifiers: add adl8113
    
    Add devicetree bindings for the ADL8113 Low Noise Amplifier.
    
    The bindings include support for specifying gain values of external
    amplifiers connected to the two external bypass paths (A and B). These
    optional properties allow the gain values to be selectable via the
    hardwaregain attribute, enabling complete devicetree description of
    the signal chain including external components.
    
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Antoniu Miclaus 
    Signed-off-by: Jonathan Cameron 

commit 60e5448ddbec2dc206027a4850604d8fdf9973b7
Author: Antoniu Miclaus 
Date:   Fri Dec 12 16:47:32 2025 +0200

    iio: frequency: adf4377: add clk provider support
    
    Add clk provider feature for the adf4377.
    
    Even though the driver was sent as an IIO driver in most cases the
    device is actually seen as a clock provider.
    
    This patch aims to cover actual usecases requested by users in order to
    completely control the output frequencies from userspace.
    
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Antoniu Miclaus 
    Signed-off-by: Jonathan Cameron 

commit d4f13bc9aacd1f0effd55ef95316c557f8138bba
Author: Antoniu Miclaus 
Date:   Fri Dec 12 16:47:31 2025 +0200

    dt-bindings: iio: frequency: adf4377: add clk provider
    
    Add support for clock provider.
    
    Acked-by: Conor Dooley 
    Signed-off-by: Antoniu Miclaus 
    Signed-off-by: Jonathan Cameron 

commit 4434072a893e4864519c167947083ff3e4cc2d95
Author: Daniel Lezcano 
Date:   Mon Dec 8 03:08:19 2025 +0100

    iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms
    
    The NXP S32G2 and S32G3 platforms integrate a successive approximation
    register (SAR) ADC. Two instances are available, each providing 8
    multiplexed input channels with 12-bit resolution. The conversion rate
    is up to 1 Msps depending on the configuration and sampling window.
    
    The SAR ADC supports raw, buffer, and trigger modes. It can operate
    in both single-shot and continuous conversion modes, with optional
    hardware triggering through the cross-trigger unit (CTU) or external
    events. An internal prescaler allows adjusting the sampling clock,
    while per-channel programmable sampling times provide fine-grained
    trade-offs between accuracy and latency. Automatic calibration is
    performed at probe time to minimize offset and gain errors.
    
    All modes have been validated on the S32G274-RDB2 platform using an
    externally generated square wave captured by the ADC. Tests covered
    buffered streaming via IIO, trigger synchronization, and accuracy
    verification against a precision laboratory signal source.
    
    One potential scenario, not detected during testing, is that in some
    corner cases the DMA may already have been armed for the next
    transfer, which can lead dmaengine_tx_status() to return an incorrect
    residue.  The callback_result() operation—intended to supply the
    residue directly and eliminate the need to call
    dmaengine_tx_status()—also does not work.  Attempting to use
    dmaengine_pause() and dmaengine_resume() to prevent the residue from
    being updated does not work either.
    
    This potential scenario should apply to any driver using cyclic DMA.
    However, no current driver actually handles this case, and they all rely
    on the same acquisition routine (e.g., the STM32 implementation).
    The NXP SAR acquisition routine has been used in production for several
    years, which is a good indication of its robustness.
    
    As the IIO is implementing the cyclic DMA support API, it is not worth
    to do more spins to the current routine as it will go away when the
    new API will be available.
    
    The driver is derived from the BSP implementation and has been partly
    rewritten to comply with upstream requirements. For this reason, all
    contributors to the original code are listed as co-developers.
    
    Originally-by: Stefan-Gabriel Mirea 
    Co-developed-by: Alexandru-Catalin Ionita 
    Signed-off-by: Alexandru-Catalin Ionita 
    Co-developed-by: Ciprian Costea 
    Signed-off-by: Ciprian Costea 
    Co-developed-by: Radu Pirea (NXP OSS) 
    Signed-off-by: Radu Pirea (NXP OSS) 
    Signed-off-by: Daniel Lezcano 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit a19489ca82bb5cedfe348326905fb66d66ffac65
Author: Daniel Lezcano 
Date:   Mon Dec 8 03:08:18 2025 +0100

    dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms
    
    The s32g2 and s32g3 NXP platforms have two instances of a Successive
    Approximation Register ADC. It supports the raw, trigger and scan
    modes which involves the DMA. Add their descriptions.
    
    Signed-off-by: Daniel Lezcano 
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Jonathan Cameron 

commit 048a15b7211ada26d170b5a61248fb3356739976
Author: Jorge Marques 
Date:   Wed Nov 12 23:06:38 2025 +0100

    iio: accel: Change adxl345 depend to negate adxl35x
    
    Change 'depends on INPUT_ADXL34X=n' to '!(INPUT_ADXL34X)' to allow both
    drivers to be compiled as modules. The user then can use the blacklist
    to block loading one.
    
    Signed-off-by: Jorge Marques 
    Signed-off-by: Jonathan Cameron 

commit 4aa91223fd6c9b9e6c73f9dc6ffb55cbf04df4ac
Author: David Jander 
Date:   Tue Nov 18 15:18:21 2025 +0100

    iio: adc: Add TI ADS131M0x ADC driver
    
    Add a new IIO ADC driver for Texas Instruments ADS131M0x devices
    (ADS131M02/03/04/06/08). These are 24-bit, up to 64 kSPS, simultaneous-
    sampling delta-sigma ADCs accessed via SPI.
    
    Highlights:
    - Supports 2/3/4/6/8-channel variants with per-channel RAW and SCALE.
    - Implements device-required full-duplex fixed-frame transfers.
    - Handles both input and output CRC
    
    Note: Despite the almost identical name, this hardware is not
    compatible with the ADS131E0x series handled by
    drivers/iio/adc/ti-ads131e08.c.
    
    Signed-off-by: David Jander 
    Co-developed-by: Oleksij Rempel 
    Signed-off-by: Oleksij Rempel 
    Reviewed-by: David Lechner 
    Signed-off-by: Jonathan Cameron 

commit 1ca733e843ac1340c030b4a8b0060a27cd0843b6
Author: Oleksij Rempel 
Date:   Tue Nov 18 15:18:20 2025 +0100

    bindings: iio: adc: Add bindings for TI ADS131M0x ADCs
    
    Add device tree bindings documentation for the Texas Instruments
    ADS131M0x analog-to-digital converters. This family includes the ADS131M02,
    ADS131M03, ADS131M04, ADS131M06, and ADS131M08 variants.
    
    These variants differ primarily in the number of supported channels
    (2, 3, 4, 6, and 8, respectively), which requires separate compatible
    strings to validate the channel nodes.
    
    Signed-off-by: Oleksij Rempel 
    Reviewed-by: Conor Dooley 
    Reviewed-by: David Lechner 
    Signed-off-by: Jonathan Cameron 

commit 3624f038629d6b9ddf742f419ed7437bba0d2262
Author: Massimiliano Pellizzer 
Date:   Tue Nov 25 18:18:16 2025 +0100

    iio: imu: smi330: remove redundant assignment in smi330_read_avail
    
    In the IIO_CHAN_INFO_OVERSAMPLING_RATIO case, the type parameter
    is assigned from smi330_average_attr.type and then immediately
    overwritten with IIO_VAL_INT on the next line.
    
    Since smi330_average_attr.type is already initialized to IIO_VAL_INT,
    the second assignment is redundant. Remove the hardcoded assignment
    to maintain consistency in the code.
    
    Signed-off-by: Massimiliano Pellizzer 
    Reviewed-by: Jianping Shen 
    Signed-off-by: Jonathan Cameron 

commit 5a306a64bf790ed084601d7f3e89d5dc4a18a5c2
Author: Tomas Borquez 
Date:   Wed Nov 26 17:32:40 2025 -0300

    iio: light: isl29018: replace sprintf() with safer alternatives
    
    This patch replaces sprintf() with sysfs_emit() and sysfs_emit_at() safer
    alternative with no functional changes.
    
    Signed-off-by: Tomas Borquez 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit ce40e01d7ce2a15ba14fde314df30787fa1d58cb
Author: Francesco Lavra 
Date:   Mon Dec 1 11:00:18 2025 +0100

    iio: imu: st_lsm6dsx: add tap event detection
    
    In order to allow sensors to advertise tap event capability and report tap
    events, define a new struct iio_event_spec array that includes a tap event
    spec, and a new struct iio_chan_spec array that references the new
    iio_event_spec array; for the LSM6DSV chip family, use the new
    iio_chan_spec array and define an event source for tap events.
    Tested on LSMDSV16X.
    
    Signed-off-by: Francesco Lavra 
    Reviewed-by: Andy Shevchenko 
    Acked-by: Lorenzo Bianconi 
    Signed-off-by: Jonathan Cameron 

commit 317c9bef82ebe369fd1dac428eac505b5b6ff531
Author: Francesco Lavra 
Date:   Mon Dec 1 11:00:17 2025 +0100

    iio: imu: st_lsm6dsx: add event spec parameter to iio_chan_spec initializer
    
    In preparation for adding support for more event sources, add to the
    ST_LSM6DSX_CHANNEL_ACC() iio_chan_spec initializer macro an iio_event_spec
    array argument, so that this macro can be used with different arrays by
    sensors that support different event sources; change the st_lsm6dsx_event
    struct declaration to an array (renamed as st_lsm6dsx_ev_motion) so that it
    can be passed to the macro (and opportunistically move it from the header
    file where it does not belong to the C file where it is used).
    In addition, remove from this macro the channel type parameter and
    hard-code IIO_ACCEL in the macro definition, since all callers use
    IIO_ACCEL as channel type argument.
    
    Signed-off-by: Francesco Lavra 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 855119fa0a58a0aa1d40fe9c7c5da437167ba9ba
Author: Francesco Lavra 
Date:   Mon Dec 1 11:00:16 2025 +0100

    iio: imu: st_lsm6dsx: add event configurability on a per axis basis
    
    In order to be able to configure event detection on a per axis
    basis (for either setting an event threshold/sensitivity value, or
    enabling/disabling event detection), add new axis-specific fields
    to struct st_lsm6dsx_event_src, and modify the logic that handles
    event configuration to properly handle axis-specific settings when
    supported by a given event source.
    A future commit will add actual event sources with per-axis
    configurability.
    
    Signed-off-by: Francesco Lavra 
    Signed-off-by: Jonathan Cameron 

commit c93e8f091baca406981e0468264ed8747285cae6
Author: Francesco Lavra 
Date:   Mon Dec 1 11:00:15 2025 +0100

    iio: imu: st_lsm6dsx: make event management functions generic
    
    In preparation for adding support for more event types, use an array
    indexed by event ID instead of a scalar value to store enabled events, and
    refactor the functions to configure and report events so that their
    implementation is not specific for wakeup events. Move the logic to update
    the global event interrupt enable flag from st_lsm6dsx_event_setup() to its
    calling function, so that it can take into account also event sources
    different from the source being configured. While changing the signature of
    the st_lsm6dsx_event_setup() function, opportunistically add the currently
    unused `axis` parameter, which will be used when adding support for
    enabling and disabling events on a per axis basis.
    
    Signed-off-by: Francesco Lavra 
    Reviewed-by: Andy Shevchenko 
    Acked-by: Lorenzo Bianconi 
    Signed-off-by: Jonathan Cameron 

commit b008b1ff0ce005e998bb4c7e876ffa2d31a1e511
Author: Francesco Lavra 
Date:   Mon Dec 1 11:00:14 2025 +0100

    iio: imu: st_lsm6dsx: remove event_threshold field from hw struct
    
    This field is used to store the wakeup event detection threshold value.
    When adding support for more event types, some of which may have different
    threshold values for different axes, storing all threshold values for all
    event sources would be cumbersome. Thus, remove this field altogether, and
    read the currently configured value from the sensor when requested by
    userspace.
    
    Signed-off-by: Francesco Lavra 
    Reviewed-by: Andy Shevchenko 
    Acked-by: Lorenzo Bianconi 
    Signed-off-by: Jonathan Cameron 

commit da6279f7587d55171d891ecb3dd1897cad5cad65
Author: Francesco Lavra 
Date:   Mon Dec 1 11:00:13 2025 +0100

    iio: imu: st_lsm6dsx: rework code to check for enabled events
    
    The enable_event field in struct st_lsm6dsx_hw does not lend itself well to
    handling multiple event sources, so it will have to be modified to add
    support for more event sources. As a preparatory step, remove references to
    this field from code that does not deal with event management; rework the
    st_lsm6dsx_check_events() function so that it returns whether any events
    are currently enabled on a given sensor.
    
    Signed-off-by: Francesco Lavra 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit 87c3e0c138a7f01efb5de5e226055ab66345d3d0
Author: Francesco Lavra 
Date:   Mon Dec 1 11:00:12 2025 +0100

    iio: imu: st_lsm6dsx: move wakeup event enable mask to event_src
    
    The mask value being assigned to the irq1_func and irq2_func fields of the
    irq_config struct is specific to a single event source (i.e. the wakeup
    event), and as such it should be separate from the definition of the
    interrupt function registers, which cover multiple event sources.
    In preparation for adding support for more event types, change the
    irq1_func and irq2_func type from an {address, mask} pair to an address,
    and move the mask value to a new field of struct st_lsm6dsx_event_src. No
    functional changes.
    
    Signed-off-by: Francesco Lavra 
    Reviewed-by: Andy Shevchenko 
    Acked-by: Lorenzo Bianconi 
    Signed-off-by: Jonathan Cameron 

commit 212234f7bf8ef93c29a2808bcf60465cc1bfff66
Author: Francesco Lavra 
Date:   Mon Dec 1 11:00:11 2025 +0100

    iio: imu: st_lsm6dsx: make event_settings more generic
    
    The st_lsm6dsx_event_settings structure contains fields specific for one
    event type (wakeup). In preparation for adding support for more event
    types, introduce an event id enum and a generic event source structure, and
    replace wakeup-specific data in struct st_lsm6dsx_event_settings with an
    array of event source structures.
    
    Signed-off-by: Francesco Lavra 
    Reviewed-by: Andy Shevchenko 
    Acked-by: Lorenzo Bianconi 
    Signed-off-by: Jonathan Cameron 

commit 0820dd9f51884828777f68daa30bfacacbceaf36
Author: Tomas Melin 
Date:   Wed Dec 3 09:28:12 2025 +0000

    iio: adc: ad9467: support write/read offset via _calibbias
    
    Support configuring output calibration value. Among the devices
    currently supported by this driver, this setting is specific to
    ad9434. The offset can be used to calibrate the output against
    a known input. The register is called offset, but the procedure
    is best mapped internally with calibbias operation.
    
    Reviewed-by: David Lechner 
    Signed-off-by: Tomas Melin 
    Reviewed-by: Nuno Sá 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit c7f9c36b7921235453828bfff1ad6f081267a7ec
Author: Tomas Borquez 
Date:   Fri Dec 5 17:27:41 2025 -0300

    staging: iio: ad9832: remove platform_data support
    
    Remove legacy platform_data support as there are no in tree users and
    this approach belongs to a long gone era. The policy decision on what
    to output is a userspace problem, not something that should be provided
    from firmware.
    
    The driver now initializes the device to a safe state (SLEEP|RESET|CLR)
    outputting nothing. Userspace can configure the desired frequencies and
    phases via the existing sysfs attributes once the device is ready to be
    used.
    
    Original discussion started here [1].
    
    Link: https://lore.kernel.org/linux-iio/20250628161040.3d21e2c4@jic23-huawei/ #[1]
    Suggested-by: Jonathan Cameron 
    Signed-off-by: Tomas Borquez 
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Jonathan Cameron 

commit cf077db587a9fa1839c9a2c7e44694d09edc8334
Author: Leo Tsai 
Date:   Thu Dec 18 13:51:36 2025 +0800

    ALSA: hda/cm9825: Add GENE_TWL7 support for AAEON
    
    The GENE_TWL7 project is an AAEON platform with a fixed audio
    configuration consisting of line-out, line-in, and mic-in.
    The audio routing and pin assignments are defined according to
    the board-level hardware design and are not intended to be
    dynamically changed.
    
    Signed-off-by: Leo Tsai 
    Link: https://patch.msgid.link/20251218055136.3875-1-antivirus621@gmail.com
    Signed-off-by: Takashi Iwai 

commit 38b91e424c1ca0d6b909f8513509e1f6e938b193
Author: Biju Das 
Date:   Wed Dec 3 12:51:01 2025 +0000

    drm/panfrost: Add GPU_PM_RT support for RZ/G3E SoC
    
    RZ/G3E SoC is embedded with Mali-G52 GPU system. The system hangs after
    STR in the following condition:
    
    STR -> Wakeup from STR -> Unload panfrost using 'modprobe -r panfrost'.
    
    Fix this issue by asserting/deasserting the reset during suspend/resume.
    Rename the variable allwinner_h616_data->default_pm_rt_data for data
    reuse and make it as generic GPU PM runtime data.
    
    Signed-off-by: Biju Das 
    Reviewed-by: Adrián Larumbe 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251203125104.67596-1-biju.das.jz@bp.renesas.com
    Signed-off-by: Adrian Larumbe 

commit 4297ddbf1d148a6007b91b2aec51853454253b96
Author: E Shattow 
Date:   Fri Dec 12 13:19:20 2025 -0800

    riscv: dts: starfive: Append JH-7110 SoC compatible to VisionFive 2 Lite eMMC board
    
    Append "starfive,jh7110" compatible to VisionFive 2 Lite eMMC board in the
    least-compatible end of the list.
    
    Appending "starfive,jh7110" reduces the number of compatible strings to
    check in the OpenSBI platform driver. JH-7110S SoC on this board is the
    same as JH-7110 SoC however rated for thermal, voltage, and frequency
    characteristics for a maximum of 1.25GHz operation.
    
    Link: https://lore.kernel.org/lkml/1f96a267-f5c6-498e-a2c4-7a47a73ea7e7@canonical.com/
    Suggested-by: Heinrich Schuchardt 
    Signed-off-by: E Shattow 
    Signed-off-by: Conor Dooley 

commit 7c9a5fd6bb19d08d687a416705c494eed0c55134
Author: E Shattow 
Date:   Fri Dec 12 13:19:19 2025 -0800

    riscv: dts: starfive: Append JH-7110 SoC compatible to VisionFive 2 Lite board
    
    Append "starfive,jh7110" compatible to VisionFive 2 Lite board in the
    least-compatible end of the list.
    
    Appending "starfive,jh7110" reduces the number of compatible strings to
    check in the OpenSBI platform driver. JH-7110S SoC on this board is the
    same as JH-7110 SoC however rated for thermal, voltage, and frequency
    characteristics for a maximum of 1.25GHz operation.
    
    Link: https://lore.kernel.org/lkml/1f96a267-f5c6-498e-a2c4-7a47a73ea7e7@canonical.com/
    Suggested-by: Heinrich Schuchardt 
    Signed-off-by: E Shattow 
    Signed-off-by: Conor Dooley 

commit d2091990c5c1da38e9cc41240f03c420743af1bf
Author: E Shattow 
Date:   Fri Dec 12 13:19:18 2025 -0800

    dt-bindings: riscv: starfive: Append JH-7110 SoC compatible to VisionFive 2 Lite board
    
    Append "starfive,jh7110" compatible to VisionFive 2 Lite and VisionFive 2
    Lite eMMC boards in the least-compatible end of the list.
    
    Appending "starfive,jh7110" reduces the number of compatible strings to
    check in the OpenSBI platform driver. JH-7110S SoC on these boards is the
    same as JH-7110 SoC however rated for thermal, voltage, and frequency
    characteristics for a maximum of 1.25GHz operation.
    
    Link: https://lore.kernel.org/lkml/1f96a267-f5c6-498e-a2c4-7a47a73ea7e7@canonical.com/
    Suggested-by: Heinrich Schuchardt 
    Signed-off-by: E Shattow 
    Signed-off-by: Conor Dooley 

commit 26535e84449abbf5d207a4b1db12891edf52e35e
Author: Conor Dooley 
Date:   Mon Nov 10 11:23:52 2025 +0000

    riscv: dts: microchip: convert clock and reset to use syscon
    
    The "subblock" clocks and reset registers on PolarFire SoC are located
    in the mss-top-sysreg region, alongside pinctrl and interrupt control
    functionality. Re-write the devicetree to describe the sys explicitly,
    as its own node, rather than as a region of the clock node.
    Correspondingly, the phandles to the reset controller must be updated to
    the new provider. The drivers will continue to support the old way of
    doing things.
    
    Signed-off-by: Conor Dooley 

commit 6f86a41d2162eea97946a952de4032db149d54c8
Author: Conor Dooley 
Date:   Mon Nov 10 11:23:51 2025 +0000

    riscv: dts: microchip: fix mailbox description
    
    When the binding for the mailbox on PolarFire SoC was originally
    written, and later modified, mistakes were made - and the precise
    nature of the later modification should have been a giveaway, but alas
    I was naive at the time.
    
    A more correct modelling of the hardware is to use two syscons and have
    a single reg entry for the mailbox, containing the mailbox region. The
    two syscons contain the general control/status registers for the mailbox
    and the interrupt related registers respectively. The reason for two
    syscons is that the same mailbox is present on the non-SoC version of
    the FPGA, which has no interrupt controller, and the shared part of the
    rtl was unchanged between devices.
    
    Signed-off-by: Conor Dooley 

commit 4f1b30fe9ef550651ea353714d1119431e76824a
Author: Francesco Valla 
Date:   Wed Dec 17 09:06:56 2025 +0100

    drm/panic: avoid WARN when checking format support
    
    Use drm_draw_can_convert_from_xrgb8888() instead of
    drm_draw_color_from_xrgb8888() while checking if a color format is
    usable. This avoids a WARN in case the first format is not usable.
    
    Reviewed-by: Jocelyn Falempe 
    Signed-off-by: Francesco Valla 
    Link: https://patch.msgid.link/20251217-drm_draw_conv_check-v3-3-15b6f8bc1cbc@valla.it
    Signed-off-by: Jocelyn Falempe 

commit 15156936b26f14c403d75a9353c84c5b17312b61
Author: Francesco Valla 
Date:   Wed Dec 17 09:06:55 2025 +0100

    drm/log: avoid WARN when searching for usable format
    
    Use drm_draw_can_convert_from_xrgb8888() instead of
    drm_draw_color_from_xrgb8888() while searching for a usable color
    format. This avoids a WARN in case the first format is not usable.
    
    Reviewed-by: Jocelyn Falempe 
    Signed-off-by: Francesco Valla 
    Link: https://patch.msgid.link/20251217-drm_draw_conv_check-v3-2-15b6f8bc1cbc@valla.it
    Signed-off-by: Jocelyn Falempe 

commit c2b40b1a4fbb0e9c078224bec3ea2e17f8076429
Author: Francesco Valla 
Date:   Wed Dec 17 09:06:54 2025 +0100

    drm/draw: add drm_draw_can_convert_from_xrgb8888
    
    Add drm_draw_can_convert_from_xrgb8888() function that can be used to
    determine if a XRGB8888 color can be converted to the specified format.
    
    Reviewed-by: Jocelyn Falempe 
    Signed-off-by: Francesco Valla 
    Link: https://patch.msgid.link/20251217-drm_draw_conv_check-v3-1-15b6f8bc1cbc@valla.it
    Signed-off-by: Jocelyn Falempe 

commit f8e05c10631e665ccabc8410beec6058d2a07c57
Author: Nicolas Schier 
Date:   Fri Nov 28 21:01:55 2025 +0100

    kbuild: Add top-level target for building gen_init_cpio
    
    Add a top-level target for building gen_init_cpio to prevent re-entering
    kbuild for 'modules-cpio-pkg'.
    
    The recently introduced target 'modules-cpio-pkg' depends on
    gen_init_cpio but there is no simple way to add this dependency as a
    prerequisite that can be built in parallel to other recipes.
    
    Introducing the top-level target, enables fixing this and also prepares
    a possible move of gen_init_cpio from usr/ to scripts/.
    
    Signed-off-by: Nicolas Schier 
    Reviewed-by: Nathan Chancellor 
    Tested-by: Nathan Chancellor 
    Link: https://patch.msgid.link/20251128-kbuild-add-top-level-target-for-building-gen_init_cpio-v1-1-84c63a8fc8d4@kernel.org
    Signed-off-by: Nathan Chancellor 

commit 4c36e6106997b6ad8f4a279b4bdbca3ed6f53c6c
Author: Lili Li 
Date:   Mon Nov 24 21:15:37 2025 +0800

    EDAC/igen6: Add more Intel Panther Lake-H SoCs support
    
    Add more Intel Panther Lake-H SoC compute die IDs for EDAC support.
    
    Signed-off-by: Lili Li 
    Signed-off-by: Tony Luck 
    Reviewed-by: Qiuxu Zhuo 
    Link: https://patch.msgid.link/20251124131537.3633983-1-qiuxu.zhuo@intel.com

commit 4b720906efa34e1f68e3b2f7061c294e1889525b
Author: Qiuxu Zhuo 
Date:   Fri Dec 19 12:29:56 2025 +0800

    EDAC/igen6: Make masks of {MCHBAR, TOM, TOUUD, ECC_ERROR_LOG} configurable
    
    The masks used to retrieve base addresses from {MCHBAR, TOM, TOUUD,
    ECC_ERROR_LOG} registers can be CPU model-specific. Currently,
    igen6_edac hard-codes these masks with the most significant bit at
    38, while some CPUs have extended the most significant bit to bit 41
    or bit 45.
    
    Systems with more than 512GB (2^39) memory need this extension to get
    correct masks. But all CPUs currently supported by igen6_edac support
    max memory less than 512GB (e.g., max memory size for Raptor Lake
    systems is 192GB, for Alder Lake systems is 128GB, ...), which means
    the previous hard-coded most significant bit 38 still works properly.
    So backporting this patch to stable kernels is not necessary.
    
    To make these masks reflect the CPUs' real support and easily support
    future Intel client CPUs supported by igen6_edac that have more than
    512GB memory, add four new fields to structure res_config to make these
    masks CPU model-specific and configure them properly.
    
    Signed-off-by: Qiuxu Zhuo 
    Signed-off-by: Tony Luck 
    Tested-by: Jianfeng Gao 
    Link: https://patch.msgid.link/20251219042956.3232568-3-qiuxu.zhuo@intel.com

commit a2a631830deb382a3d27b6f52b2d654a3e6bb427
Author: Krzysztof Kozlowski 
Date:   Sun Nov 30 10:40:26 2025 +0100

    ASoC: qcom: Constify APR/GPR result structs
    
    APR and GPR callbacks receive pointer to const response packet which
    holds the response result.  That result should not be modified by
    callback, so make it pointer to const for code safety.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251130-asoc-apr-const-v1-4-d0833f3ed423@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit f3a86870c5938fe82ce02c29235326d417010ffb
Author: Krzysztof Kozlowski 
Date:   Sun Nov 30 10:40:25 2025 +0100

    ASoC: qcom: Constify GPR callback response data
    
    GPR bus driver calls each GPR client callback with pointer to the GPR
    response packet.  The callbacks are not suppose to modify that response
    packet, so make it a pointer to const to document that expectation
    explicitly.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251130-asoc-apr-const-v1-3-d0833f3ed423@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit c66cea195d76c7c396c4c565b967d3e2a709e762
Author: Krzysztof Kozlowski 
Date:   Sun Nov 30 10:40:24 2025 +0100

    soc: qcom: apr: Use typedef for GPR callback member
    
    There is already a typedef for GPR callback used in 'struct
    pkt_router_svc', so use it also in 'struct apr_driver', because it is
    the same type - one is assigned to another in apr_device_probe().
    
    Signed-off-by: Krzysztof Kozlowski 
    Acked-by: Bjorn Andersson 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251130-asoc-apr-const-v1-2-d0833f3ed423@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 86af3c229245fe1e59f428fc6abe19127ce15f5f
Author: Krzysztof Kozlowski 
Date:   Sun Nov 30 10:40:23 2025 +0100

    ASoC: qcom: Constify APR callback response data
    
    APR bus driver calls each APR client callback with pointer to the APR
    response packet.  The callbacks are not suppose to modify that response
    packet, so make it a pointer to const to document that expectation
    explicitly.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251130-asoc-apr-const-v1-1-d0833f3ed423@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 18e2d526bf24525995d4312937e82d9b6810f663
Author: Rostislav Krasny 
Date:   Wed Dec 17 03:54:09 2025 +0200

    kconfig: move XPM icons to separate files
    
    Replace deprecated gdk_pixbuf_new_from_xpm_data() with gdk_pixbuf_new_from_file()
    and update both GTK and QT frontends to load XPM icons from separate files
    in scripts/kconfig/icons/ instead of from the code.
    
    xpm_menu_inv and xpm_void were removed and not converted into xpm files
    because they are not used since commit 64285dc5c41f ("kconfig: gconf:
    inline fill_row() into set_node()").
    
    This eliminates the GTK deprecation warnings at compile time and
    improves memory usage and code organization.
    
    Signed-off-by: Rostislav Krasny 
    Acked-by: Randy Dunlap 
    Tested-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251217015409.30102-2-rostiprodev@gmail.com
    [nathan: Minor commit message clean ups]
    Signed-off-by: Nathan Chancellor 

commit 844758bd99a86e6a07247784727fb337c4b979ca
Author: Matthew Brost 
Date:   Thu Dec 18 14:45:46 2025 -0800

    drm/xe: Print GuC queue submission state on engine reset
    
    Print the GuC queue submission state when an engine reset occurs, as
    this provides clues about the cause of the reset.
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251218224546.4057424-1-matthew.brost@intel.com

commit 651065dca3f2a2e2cd2ddd3cdebeb7fe6c0da882
Author: Matthew Brost 
Date:   Thu Dec 18 14:37:45 2025 -0800

    drm/xe: Increase log level for unhandled page faults
    
    Set the kernel log level for unhandled page faults to match the log
    level (info) for engine resets. Currently, dmesg output can be confusing
    because it shows an engine reset without indicating the page fault that
    caused it. Without this change, the GuC log must be examined to
    determine the source of the engine reset.
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Rodrigo Vivi 
    Reviewed-by: Stuart Summers 
    Link: https://patch.msgid.link/20251218223745.4045207-1-matthew.brost@intel.com

commit 35ec71285c9311395b14bedc60fa94f6b7e24d2d
Author: Ville Syrjälä 
Date:   Thu Dec 18 20:20:52 2025 +0200

    drm/i915/pc8: Add parent interface for PC8 forcewake tricks
    
    We use forcewake to prevent the SoC from actually entering
    PC8 while performing the PC8 disable sequence. Hide that
    behind a new parent interface to eliminate the naked
    forcewake/uncore usage from the display power code.
    
    v2: Mark the interface optional and warn if
        someone calls it when not provided (Jani)
        Include the header to make sure the extern
        declaration matches the definition (Jani)
    v3: Rebase due to shuffling
    
    Reviewed-by: Jani Nikula 
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251218182052.18756-1-ville.syrjala@linux.intel.com

commit 3d60306b7bb4a3a3c5f01750a2303f987b7d93fa
Merge: ec439c38013550 522397d05e7d4a
Author: Andrii Nakryiko 
Date:   Fri Dec 19 10:55:40 2025 -0800

    Merge branch 'resolve_btfids-support-for-btf-modifications'
    
    Ihor Solodrai says:
    
    ====================
    resolve_btfids: Support for BTF modifications
    
    This series changes resolve_btfids and kernel build scripts to enable
    BTF transformations in resolve_btfids. Main motivation for enhancing
    resolve_btfids is to reduce dependency of the kernel build on pahole
    capabilities [1] and enable BTF features and optimizations [2][3]
    particular to the kernel.
    
    Patches #1-#4 in the series are non-functional changes in
    resolve_btfids.
    
    Patch #5 makes kernel build notice pahole version changes between
    builds.
    
    Patch #6 changes minimum version of pahole required for
    CONFIG_DEBUG_INFO_BTF to v1.22
    
    Patch #7 makes a small prep change in selftests/bpf build.
    
    The last patch (#8) makes significant changes in resolve_btfids and
    introduces scripts/gen-btf.sh. See implementation details in the patch
    description.
    
    Successful BPF CI run: https://github.com/kernel-patches/bpf/actions/runs/20378061470
    
    [1] https://lore.kernel.org/dwarves/ba1650aa-fafd-49a8-bea4-bdddee7c38c9@linux.dev/
    [2] https://lore.kernel.org/bpf/20251029190113.3323406-1-ihor.solodrai@linux.dev/
    [3] https://lore.kernel.org/bpf/20251119031531.1817099-1-dolinux.peng@gmail.com/
    ---
    
    v6->v7:
      - documentation edits in patches #5 and #6 (Nicolas)
    
    v6: https://lore.kernel.org/bpf/20251219020006.785065-1-ihor.solodrai@linux.dev/
    
    v5->v6:
      - patch #8: fix double free when btf__distill_base fails (reported by AI)
        https://lore.kernel.org/bpf/e269870b8db409800045ee0061fc02d21721e0efadd99ca83960b48f8db7b3f3@mail.kernel.org/
    
    v5: https://lore.kernel.org/bpf/20251219003147.587098-1-ihor.solodrai@linux.dev/
    
    v4->v5:
      - patch #3: fix an off-by-one bug (reported by AI)
        https://lore.kernel.org/bpf/106b6e71bce75b8f12a85f2f99e75129e67af7287f6d81fa912589ece14044f9@mail.kernel.org/
      - patch #8: cleanup GEN_BTF in Makefile.btf
    
    v4: https://lore.kernel.org/bpf/20251218003314.260269-1-ihor.solodrai@linux.dev/
    
    v3->v4:
      - add patch #4: "resolve_btfids: Always build with -Wall -Werror"
      - add patch #5: "kbuild: Sync kconfig when PAHOLE_VERSION changes" (Alan)
      - fix clang cross-compilation (LKP)
        https://lore.kernel.org/bpf/cecb6351-ea9a-4f8a-863a-82c9ef02f012@linux.dev/
      - remove GEN_BTF env variable (Andrii)
      - nits and cleanup in resolve_btfids/main.c (Andrii, Eduard)
      - nits in a patch bumping minimum pahole version (Andrii, AI)
    
    v3: https://lore.kernel.org/bpf/20251205223046.4155870-1-ihor.solodrai@linux.dev/
    
    v2->v3:
      - add patch #4 bumping minimum pahole version (Andrii, Alan)
      - add patch #5 pre-fixing resolve_btfids test (Donglin)
      - add GEN_BTF var and assemble RESOLVE_BTFIDS_FLAGS in Makefile.btf (Alan)
      - implement --distill_base flag in resolve_btfids, set it depending
        on KBUILD_EXTMOD in Makefile.btf (Eduard)
      - various implementation nits, see the v2 thread for details (Andrii, Eduard)
    
    v2: https://lore.kernel.org/bpf/20251127185242.3954132-1-ihor.solodrai@linux.dev/
    
    v1->v2:
      - gen-btf.sh and other shell script fixes (Donglin)
      - update selftests build (Donglin)
      - generate .BTF.base only when KBUILD_EXTMOD is set (Alan)
      - proper endianness handling for cross-compilation
      - change elf_begin mode from ELF_C_RDWR_MMAP to ELF_C_READ_MMAP_PRIVATE
      - remove compressed_section_fix()
      - nit NULL check in patch #3 (suggested by AI)
    
    v1: https://lore.kernel.org/bpf/20251126012656.3546071-1-ihor.solodrai@linux.dev/
    ====================
    
    Link: https://patch.msgid.link/20251219181321.1283664-1-ihor.solodrai@linux.dev
    Signed-off-by: Andrii Nakryiko 

commit 522397d05e7d4a7c30b91841492360336b24f833
Author: Ihor Solodrai 
Date:   Fri Dec 19 10:18:25 2025 -0800

    resolve_btfids: Change in-place update with raw binary output
    
    Currently resolve_btfids updates .BTF_ids section of an ELF file
    in-place, based on the contents of provided BTF, usually within the
    same input file, and optionally a BTF base.
    
    Change resolve_btfids behavior to enable BTF transformations as part
    of its main operation. To achieve this, in-place ELF write in
    resolve_btfids is replaced with generation of the following binaries:
      * ${1}.BTF with .BTF section data
      * ${1}.BTF_ids with .BTF_ids section data if it existed in ${1}
      * ${1}.BTF.base with .BTF.base section data for out-of-tree modules
    
    The execution of resolve_btfids and consumption of its output is
    orchestrated by scripts/gen-btf.sh introduced in this patch.
    
    The motivation for emitting binary data is that it allows simplifying
    resolve_btfids implementation by delegating ELF update to the $OBJCOPY
    tool [1], which is already widely used across the codebase.
    
    There are two distinct paths for BTF generation and resolve_btfids
    application in the kernel build: for vmlinux and for kernel modules.
    
    For the vmlinux binary a .BTF section is added in a roundabout way to
    ensure correct linking. The patch doesn't change this approach, only
    the implementation is a little different.
    
    Before this patch it worked as follows:
    
      * pahole consumed .tmp_vmlinux1 [2] and added .BTF section with
        llvm-objcopy [3] to it
      * then everything except the .BTF section was stripped from .tmp_vmlinux1
        into a .tmp_vmlinux1.bpf.o object [2], later linked into vmlinux
      * resolve_btfids was executed later on vmlinux.unstripped [4],
        updating it in-place
    
    After this patch gen-btf.sh implements the following:
    
      * pahole consumes .tmp_vmlinux1 and produces a *detached* file with
        raw BTF data
      * resolve_btfids consumes .tmp_vmlinux1 and detached BTF to produce
        (potentially modified) .BTF, and .BTF_ids sections data
      * a .tmp_vmlinux1.bpf.o object is then produced with objcopy copying
        BTF output of resolve_btfids
      * .BTF_ids data gets embedded into vmlinux.unstripped in
        link-vmlinux.sh by objcopy --update-section
    
    For kernel modules, creating a special .bpf.o file is not necessary,
    and so embedding of sections data produced by resolve_btfids is
    straightforward with objcopy.
    
    With this patch an ELF file becomes effectively read-only within
    resolve_btfids, which allows deleting elf_update() call and satellite
    code (like compressed_section_fix [5]).
    
    Endianness handling of .BTF_ids data is also changed. Previously the
    "flags" part of the section was bswapped in sets_patch() [6], and then
    Elf_Type was modified before elf_update() to signal to libelf that
    bswap may be necessary. With this patch we explicitly bswap entire
    data buffer on load and on dump.
    
    [1] https://lore.kernel.org/bpf/131b4190-9c49-4f79-a99d-c00fac97fa44@linux.dev/
    [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/link-vmlinux.sh?h=v6.18#n110
    [3] https://git.kernel.org/pub/scm/devel/pahole/pahole.git/tree/btf_encoder.c?h=v1.31#n1803
    [4] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/link-vmlinux.sh?h=v6.18#n284
    [5] https://lore.kernel.org/bpf/20200819092342.259004-1-jolsa@kernel.org/
    [6] https://lore.kernel.org/bpf/cover.1707223196.git.vmalik@redhat.com/
    
    Signed-off-by: Ihor Solodrai 
    Signed-off-by: Andrii Nakryiko 
    Tested-by: Alan Maguire 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20251219181825.1289460-3-ihor.solodrai@linux.dev

commit 014e1cdb5fad8c6034feb3a97468a91edf23d3d0
Author: Ihor Solodrai 
Date:   Fri Dec 19 10:18:24 2025 -0800

    selftests/bpf: Run resolve_btfids only for relevant .test.o objects
    
    A selftest targeting resolve_btfids functionality relies on a resolved
    .BTF_ids section to be available in the TRUNNER_BINARY. The underlying
    BTF data is taken from a special BPF program (btf_data.c), and so
    resolve_btfids is executed as a part of a TRUNNER_BINARY build recipe
    on the final binary.
    
    Subsequent patches in this series allow resolve_btfids to modify BTF
    before resolving the symbols, which means that the test needs access
    to that modified BTF [1]. Currently the test simply reads in
    btf_data.bpf.o on the assumption that BTF hasn't changed.
    
    Implement resolve_btfids call only for particular test objects (just
    resolve_btfids.test.o for now). The test objects are linked into the
    TRUNNER_BINARY, and so .BTF_ids section will be available there.
    
    This will make it trivial for the resolve_btfids test to access BTF
    modified by resolve_btfids.
    
    [1] https://lore.kernel.org/bpf/CAErzpmvsgSDe-QcWH8SFFErL6y3p3zrqNri5-UHJ9iK2ChyiBw@mail.gmail.com/
    
    Signed-off-by: Ihor Solodrai 
    Signed-off-by: Andrii Nakryiko 
    Tested-by: Alan Maguire 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20251219181825.1289460-2-ihor.solodrai@linux.dev

commit 903922cfa0e60573234ff895974c23a000035258
Author: Ihor Solodrai 
Date:   Fri Dec 19 10:18:23 2025 -0800

    lib/Kconfig.debug: Set the minimum required pahole version to v1.22
    
    Subsequent patches in the series change vmlinux linking scripts to
    unconditionally pass --btf_encode_detached to pahole, which was
    introduced in v1.22 [1][2].
    
    This change allows to remove PAHOLE_HAS_SPLIT_BTF Kconfig option and
    other checks of older pahole versions.
    
    [1] https://github.com/acmel/dwarves/releases/tag/v1.22
    [2] https://lore.kernel.org/bpf/cbafbf4e-9073-4383-8ee6-1353f9e5869c@oracle.com/
    
    Signed-off-by: Ihor Solodrai 
    Signed-off-by: Andrii Nakryiko 
    Tested-by: Alan Maguire 
    Acked-by: Eduard Zingerman 
    Acked-by: Nicolas Schier 
    Link: https://lore.kernel.org/bpf/20251219181825.1289460-1-ihor.solodrai@linux.dev

commit 90e5b38a26529391da2d851a9cc5eb9de2ec35ca
Author: Ihor Solodrai 
Date:   Fri Dec 19 10:13:18 2025 -0800

    kbuild: Sync kconfig when PAHOLE_VERSION changes
    
    This patch implements kconfig re-sync when the pahole version changes
    between builds, similar to how it happens for compiler version change
    via CC_VERSION_TEXT.
    
    Define PAHOLE_VERSION in the top-level Makefile and export it for
    config builds. Set CONFIG_PAHOLE_VERSION default to the exported
    variable.
    
    Kconfig records the PAHOLE_VERSION value in
    include/config/auto.conf.cmd [1].
    
    The Makefile includes auto.conf.cmd, so if PAHOLE_VERSION changes
    between builds, make detects a dependency change and triggers
    syncconfig to update the kconfig [2].
    
    For external module builds, add a warning message in the prepare
    target, similar to the existing compiler version mismatch warning.
    
    Note that if pahole is not installed or available, PAHOLE_VERSION is
    set to 0 by pahole-version.sh, so the (un)installation of pahole is
    treated as a version change.
    
    See previous discussions for context [3].
    
    [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/kconfig/preprocess.c?h=v6.18#n91
    [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Makefile?h=v6.18#n815
    [3] https://lore.kernel.org/bpf/8f946abf-dd88-4fac-8bb4-84fcd8d81cf0@oracle.com/
    
    Signed-off-by: Ihor Solodrai 
    Signed-off-by: Andrii Nakryiko 
    Tested-by: Nicolas Schier 
    Tested-by: Alan Maguire 
    Reviewed-by: Nicolas Schier 
    Link: https://lore.kernel.org/bpf/20251219181321.1283664-6-ihor.solodrai@linux.dev

commit fb348d4fdf5ec08aea8b1f686136584f758e4364
Author: Ihor Solodrai 
Date:   Fri Dec 19 10:13:17 2025 -0800

    resolve_btfids: Always build with -Wall -Werror
    
    resolve_btfids builds without compiler warnings currently, so let's
    enforce this for future changes with '-Wall -Werror' flags [1].
    
    [1] https://lore.kernel.org/bpf/1957a60b-6c45-42a7-b525-a6e335a735ff@linux.dev/
    
    Signed-off-by: Ihor Solodrai 
    Signed-off-by: Andrii Nakryiko 
    Tested-by: Alan Maguire 
    Link: https://lore.kernel.org/bpf/20251219181321.1283664-5-ihor.solodrai@linux.dev

commit a4fa885bd52d1711994ad1ef99e989977cd15698
Author: Ihor Solodrai 
Date:   Fri Dec 19 10:13:16 2025 -0800

    resolve_btfids: Introduce enum btf_id_kind
    
    Instead of using multiple flags, make struct btf_id tagged with an
    enum value indicating its kind in the context of resolve_btfids.
    
    Signed-off-by: Ihor Solodrai 
    Signed-off-by: Andrii Nakryiko 
    Tested-by: Alan Maguire 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20251219181321.1283664-4-ihor.solodrai@linux.dev

commit 5f347a0f781a36927a547904dde4c4dac343010b
Author: Ihor Solodrai 
Date:   Fri Dec 19 10:13:15 2025 -0800

    resolve_btfids: Factor out load_btf()
    
    Increase the lifetime of parsed BTF in resolve_btfids by factoring
    load_btf() routine out of symbols_resolve() and storing the base_btf
    and btf pointers in the struct object.
    
    Signed-off-by: Ihor Solodrai 
    Signed-off-by: Andrii Nakryiko 
    Tested-by: Alan Maguire 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20251219181321.1283664-3-ihor.solodrai@linux.dev

commit c1c7d61746f42154bad30bc4adb88f5374969408
Author: Ihor Solodrai 
Date:   Fri Dec 19 10:13:14 2025 -0800

    resolve_btfids: Rename object btf field to btf_path
    
    Rename the member of `struct object` holding the path to BTF data if
    provided via --btf arg. `btf_path` is less ambiguous.
    
    Signed-off-by: Ihor Solodrai 
    Signed-off-by: Andrii Nakryiko 
    Tested-by: Alan Maguire 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20251219181321.1283664-2-ihor.solodrai@linux.dev

commit f7edab0cee03a1cbe0e55a7bcab8d2d8b6b74278
Author: Baokun Li 
Date:   Tue Dec 9 15:21:41 2025 +0800

    fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()
    
    In ntfs_fill_super(), the fc->fs_private pointer is set to NULL without
    first freeing the memory it points to. This causes the subsequent call to
    ntfs_fs_free() to skip freeing the ntfs_mount_options structure.
    
    This results in a kmemleak report:
    
      unreferenced object 0xff1100015378b800 (size 32):
        comm "mount", pid 582, jiffies 4294890685
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          00 00 00 00 00 00 00 00 ed ff ed ff 00 04 00 00  ................
        backtrace (crc ed541d8c):
          __kmalloc_cache_noprof+0x424/0x5a0
          __ntfs_init_fs_context+0x47/0x590
          alloc_fs_context+0x5d8/0x960
          __x64_sys_fsopen+0xb1/0x190
          do_syscall_64+0x50/0x1f0
          entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
    This issue can be reproduced using the following commands:
            fallocate -l 100M test.file
            mount test.file /tmp/test
    
    Since sbi->options is duplicated from fc->fs_private and does not
    directly use the memory allocated for fs_private, it is unnecessary to
    set fc->fs_private to NULL.
    
    Additionally, this patch simplifies the code by utilizing the helper
    function put_mount_options() instead of open-coding the cleanup logic.
    
    Reported-by: syzbot+23aee7afc440fe803545@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=23aee7afc440fe803545
    Fixes: aee4d5a521e9 ("ntfs3: fix double free of sbi->options->nls and clarify ownership of fc->fs_private")
    Signed-off-by: Baokun Li 
    Signed-off-by: Konstantin Komarov 

commit dffc7f2f177b7f1ca52067dc23d0304d7a25d45c
Author: Konstantin Komarov 
Date:   Tue Dec 9 12:08:32 2025 +0300

    fs/ntfs3: allow readdir() to finish after directory mutations without rewinddir()
    
    This patch introduces a per-directory version counter that increments on
    each directory modification (indx_insert_entry() / indx_delete_entry()).
    ntfs_readdir() uses this version to detect whether the directory has
    changed since enumeration began. If readdir() reaches end-of-directory
    but the version has changed, the walk restarts from the beginning of the
    index tree instead of returning prematurely. This provides rmdir-like
    behavior for tools that remove entries as they enumerate them.
    
    Prior to this change, bonnie++ directory operations could fail due to
    premature termination of readdir() during concurrent index updates.
    With this patch applied, bonnie++ completes successfully with no errors.
    
    Signed-off-by: Konstantin Komarov 

commit 989e29450efaf4983c66b7a628f2ffc03b6d02e8
Author: Konstantin Komarov 
Date:   Mon Dec 8 23:27:20 2025 +0300

    fs/ntfs3: improve readahead for bitmap initialization and large directory scans
    
    Previously sequential reads operations relied solely on single-page reads,
    causing the block layer to perform many synchronous I/O requests,
    especially for large volumes or large directories. This patch introduces
    explicit readahead via page_cache_sync_readahead() and file_ra_state to
    reduce I/O latency and improve sequential throughput.
    
    Signed-off-by: Konstantin Komarov 

commit 4248f563f0b76f3fb74b2a28ee068bf66fcbbedf
Author: Konstantin Komarov 
Date:   Mon Dec 8 22:57:46 2025 +0300

    fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
    
    The old "readpage" naming is still used in ni_readpage_cmpr(), even though
    the vfs has transitioned to the folio-based read_folio() API.
    
    This patch performs a straightforward renaming of the helper:
    ni_readpage_cmpr() -> ni_read_folio_cmpr().
    
    Signed-off-by: Konstantin Komarov 

commit 06909b2549d631a47fcda249d34be26f7ca1711d
Author: Jaehun Gou 
Date:   Tue Dec 2 20:01:46 2025 +0900

    fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
    
    We found an infinite loop bug in the ntfs3 file system that can lead to a
    Denial-of-Service (DoS) condition.
    
    A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
    indicates a zero data size while the driver allocates memory for it.
    
    When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
    to zero, it still allocates memory because of al_aligned(0). This creates an
    inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
    non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
    list exists and enumerates only the primary MFT record. When it finds
    ATTR_LIST, the code reloads it and restarts the enumeration, repeating
    indefinitely. The mount operation never completes, hanging the kernel thread.
    
    This patch adds validation to ensure that data_size is non-zero before memory
    allocation. When a zero-sized ATTR_LIST is detected, the function returns
    -EINVAL, preventing a DoS vulnerability.
    
    Co-developed-by: Seunghun Han 
    Signed-off-by: Seunghun Han 
    Co-developed-by: Jihoon Kwon 
    Signed-off-by: Jihoon Kwon 
    Signed-off-by: Jaehun Gou 
    Signed-off-by: Konstantin Komarov 

commit 4b90f16e4bb5607fb35e7802eb67874038da4640
Author: Jaehun Gou 
Date:   Tue Dec 2 20:01:09 2025 +0900

    fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata
    
    We found an infinite loop bug in the ntfs3 file system that can lead to a
    Denial-of-Service (DoS) condition.
    
    A malformed NTFS image can cause an infinite loop when an attribute header
    indicates an empty run list, while directory entries reference it as
    containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way
    to represent an empty run list, and run_unpack() correctly handles this by
    checking if evcn + 1 equals svcn and returning early without parsing any run
    data. However, this creates a problem when there is metadata inconsistency,
    where the attribute header claims to be empty (evcn=-1) but the caller
    expects to read actual data. When run_unpack() immediately returns success
    upon seeing this condition, it leaves the runs_tree uninitialized with
    run->runs as a NULL. The calling function attr_load_runs_range() assumes
    that a successful return means that the runs were loaded and sets clen to 0,
    expecting the next run_lookup_entry() call to succeed. Because runs_tree
    remains uninitialized, run_lookup_entry() continues to fail, and the loop
    increments vcn by zero (vcn += 0), leading to an infinite loop.
    
    This patch adds a retry counter to detect when run_lookup_entry() fails
    consecutively after attr_load_runs_vcn(). If the run is still not found on
    the second attempt, it indicates corrupted metadata and returns -EINVAL,
    preventing the Denial-of-Service (DoS) vulnerability.
    
    Co-developed-by: Seunghun Han 
    Signed-off-by: Seunghun Han 
    Co-developed-by: Jihoon Kwon 
    Signed-off-by: Jihoon Kwon 
    Signed-off-by: Jaehun Gou 
    Signed-off-by: Konstantin Komarov 

commit fac760f52467435bca12a796277bca2aba7ca416
Author: Lalit Shankar Chowdhury 
Date:   Fri Nov 28 10:12:56 2025 +0000

    fs/ntfs3: Use wait_on_buffer() directly
    
    wait_on_buffer() checks buffer_locked() internally
    before calling __wait_on_buffer().
    
    Signed-off-by: Lalit Shankar Chowdhury 
    Signed-off-by: Konstantin Komarov 

commit f223ebffa185cc8da934333c5a31ff2d4f992dc9
Author: Bartlomiej Kubik 
Date:   Wed Nov 26 23:02:51 2025 +0100

    fs/ntfs3: Initialize new folios before use
    
    KMSAN reports an uninitialized value in longest_match_std(), invoked
    from ntfs_compress_write(). When new folios are allocated without being
    marked uptodate and ni_read_frame() is skipped because the caller expects
    the frame to be completely overwritten, some reserved folios may remain
    only partially filled, leaving the rest memory uninitialized.
    
    Fixes: 584f60ba22f7 ("ntfs3: Convert ntfs_get_frame_pages() to use a folio")
    Tested-by: syzbot+08d8956768c96a2c52cf@syzkaller.appspotmail.com
    Reported-by: syzbot+08d8956768c96a2c52cf@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=08d8956768c96a2c52cf
    
    Signed-off-by: Bartlomiej Kubik 
    Signed-off-by: Konstantin Komarov 

commit 1732053c8a6b360e2d5afb1b34fe9779398b072c
Author: Jaehun Gou 
Date:   Tue Dec 2 19:59:59 2025 +0900

    fs: ntfs3: check return value of indx_find to avoid infinite loop
    
    We found an infinite loop bug in the ntfs3 file system that can lead to a
    Denial-of-Service (DoS) condition.
    
    A malformed dentry in the ntfs3 filesystem can cause the kernel to hang
    during the lookup operations. By setting the HAS_SUB_NODE flag in an
    INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the
    VCN pointer, an attacker can cause the indx_find() function to repeatedly
    read the same block, allocating 4 KB of memory each time. The kernel lacks
    VCN loop detection and depth limits, causing memory exhaustion and an OOM
    crash.
    
    This patch adds a return value check for fnd_push() to prevent a memory
    exhaustion vulnerability caused by infinite loops. When the index exceeds the
    size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()
    function checks this return value and stops processing, preventing further
    memory allocation.
    
    Co-developed-by: Seunghun Han 
    Signed-off-by: Seunghun Han 
    Co-developed-by: Jihoon Kwon 
    Signed-off-by: Jihoon Kwon 
    Signed-off-by: Jaehun Gou 
    Signed-off-by: Konstantin Komarov 

commit 9236cf0ade32f5b7fa5424c20663fa7ea40f8bcb
Author: Gustavo Sousa 
Date:   Tue Dec 16 18:12:01 2025 -0300

    drm/i915/cx0: Toggle powerdown states for C10 on HDMI
    
    A new step has been added to Bspec with respect to the C10 PHY, which
    instructs the driver to toggle powerdown value for boths PHY lanes to P0
    and then P2 when driving an HDMI connector. This update in the Bspec
    reflects the changes required by Wa_14026084006, so document it.
    
    Note that, unlike other display workarounds, this one is actually tied
    to the C10 PHY and not to a specific display IP.  As such, let's just
    document it in intel_cx0_phy.c instead of adding it to
    intel_display_wa.c.
    
    Bspec: 64568, 74489
    Reviewed-by: Dnyaneshwar Bhadane 
    Link: https://patch.msgid.link/20251216-wa_14026084006-c10-hdmi-toggle-powerdown-v1-2-08677b03e2f1@intel.com
    Signed-off-by: Gustavo Sousa 

commit c954d3b517a9feb58bc1f7debde9ebfd101bda1a
Author: Gustavo Sousa 
Date:   Tue Dec 16 18:12:00 2025 -0300

    drm/i915/cx0: Use a more accurate message for powerdown change failure
    
    We do not use the function intel_cx0_powerdown_change_sequence()
    exclusively to take the PHY out of reset, hence the warning message on
    failure is misleading.  Furthermore, in an upcoming change, we will also
    use that function to implement a new C10 PHY workaround.
    
    Use a more accurate message by saying that we failed to change the
    powerdown state.
    
    Reviewed-by: Dnyaneshwar Bhadane 
    Link: https://patch.msgid.link/20251216-wa_14026084006-c10-hdmi-toggle-powerdown-v1-1-08677b03e2f1@intel.com
    Signed-off-by: Gustavo Sousa 

commit 13fe9fa7f41a2f3a0ce25d27297a379560e45b2d
Author: Riana Tauro 
Date:   Fri Dec 19 16:22:27 2025 +0530

    drm/xe/xe_survivability: Add index bound check
    
    Fix static analysis tool reported issue. Add index bound check before
    accessing info array to prevent out of bound.
    
    Fixes: f4e9fc967afd ("drm/xe/xe_survivability: Redesign survivability mode")
    Signed-off-by: Riana Tauro 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251219105224.871930-6-riana.tauro@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 3d50c69c5819b20149946fda084bb3d6bfda2c44
Author: Riana Tauro 
Date:   Fri Dec 19 16:22:26 2025 +0530

    drm/xe/xe_survivability: Use static for survivability info attributes
    
    Fix sparse warnings. Use static for survivability info attributes.
    
    Fixes: f4e9fc967afd ("drm/xe/xe_survivability: Redesign survivability mode")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512101919.G12cuhBJ-lkp@intel.com/
    Signed-off-by: Riana Tauro 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251219105224.871930-5-riana.tauro@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 267f53140c9d0bf270bbe0148082e9b8e5011273
Author: Thadeu Lima de Souza Cascardo 
Date:   Mon Dec 15 16:05:50 2025 -0300

    fpga: dfl: use subsys_initcall to allow built-in drivers to be added
    
    The dfl code adds a bus. If it is built-in and there is a built-in driver
    as well, the dfl module_init may be called after the driver module_init,
    leading to a failure to register the driver as the bus has not been added
    yet.
    
    Use subsys_initcall, which guarantees it will be called before the drivers
    init code.
    
    Without the fix, we see failures like this:
    
    [    0.479475] Driver 'intel-m10-bmc' was unable to register with bus_type 'dfl' because the bus was not initialized.
    
    Cc: stable@vger.kernel.org
    Fixes: 9ba3a0aa09fe ("fpga: dfl: create a dfl bus type to support DFL devices")
    Signed-off-by: Thadeu Lima de Souza Cascardo 
    Link: https://lore.kernel.org/r/20251215-dfl_subsys-v1-1-21807bad6b10@igalia.com
    Reviewed-by: Xu Yilun 
    Signed-off-by: Xu Yilun 

commit 996a590dc6905db52e4f70569134ec479e2a9ac4
Author: Michal Simek 
Date:   Mon Dec 15 09:28:29 2025 +0100

    fpga: xilinx: Switch Michal Simek's email to new one
    
    @xilinx.com is still working but better to switch to new amd.com after
    AMD/Xilinx acquisition.
    
    Signed-off-by: Michal Simek 
    Link: https://lore.kernel.org/r/49de9536c9952a3a36bb996f2fb0a1f0efb1ba6f.1765787307.git.michal.simek@amd.com
    Reviewed-by: Xu Yilun 
    Signed-off-by: Xu Yilun 

commit c141c8221bc5089de915d9f26044df892c343c7e
Author: Romain Gantois 
Date:   Thu Nov 27 16:58:48 2025 +0100

    fpga: of-fpga-region: Fail if any bridge is missing
    
    When parsing the region bridge list from the "fpga-bridges" device tree
    property, the of-fpga-region driver will silently ignore bridges which fail
    to be obtained, for example due to a missing bridge driver or invalid
    phandle.
    
    This can lead to hardware issues if a region bridge stays coupled when
    partial programming is performed.
    
    Fail if any of the bridges specified in "fpga-bridges" cannot be obtained.
    
    Signed-off-by: Romain Gantois 
    Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com
    Reviewed-by: Xu Yilun 
    Signed-off-by: Xu Yilun 

commit af90706f0eeca2ec78f73bdc164c5046bd8a9866
Author: Madhur Kumar 
Date:   Sun Dec 14 14:06:59 2025 +0530

    drm/xe/pmu: Replace sprintf() with sysfs_emit()
    
    Replace sprintf() calls with sysfs_emit() to follow current kernel
    coding standards.
    
    sysfs_emit() is the preferred method for formatting sysfs output as it
    provides better bounds checking and is more secure.
    
    Signed-off-by: Madhur Kumar 
    Link: https://patch.msgid.link/20251214083659.2412218-1-madhurkumar004@gmail.com
    Signed-off-by: Rodrigo Vivi 
    [Rodrigo adjusted commit message while pushing it]

commit 338465490cf7bd4a700ecd33e4855fee4622fa5f
Author: Imre Deak 
Date:   Mon Dec 15 21:23:56 2025 +0200

    drm/i915/dp: Fail state computation for invalid DSC source input BPP values
    
    There is no reason to accept an invalid minimum/maximum DSC source input
    BPP value (i.e a minimum DSC input BPP value above the maximum pipe BPP
    or a maximum DSC input BPP value below the minimum pipe BPP value), fail
    the state computation in these cases.
    
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-17-imre.deak@intel.com

commit a63bbb8ddde0f0060683f4a089669a8b2eefe0f1
Author: Imre Deak 
Date:   Mon Dec 15 21:23:55 2025 +0200

    drm/i915/dp: Fail state computation for invalid max sink compressed BPP value
    
    There is no reason to accept an invalid maximum sink compressed BPP
    value (i.e. 0), fail the state computation in this case.
    
    Reviewed-by: Vinod Govindapillai 
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-16-imre.deak@intel.com

commit 5c2d799491f20baca033245dfe86eec1f5b93256
Author: Imre Deak 
Date:   Mon Dec 15 21:23:54 2025 +0200

    drm/i915/dp: Fail state computation for invalid max throughput BPP value
    
    There is no reason to accept a minimum/maximum link BPP value above the
    maximum throughput BPP value, fail the state computation in this case.
    
    Reviewed-by: Vinod Govindapillai 
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-15-imre.deak@intel.com

commit 2018e29176d659a2a1847b266a72288471b1125d
Author: Imre Deak 
Date:   Mon Dec 15 21:23:53 2025 +0200

    drm/i915/dp: Fail state computation for invalid min/max link BPP values
    
    Make sure that state computation fails if the minimum/maximum link BPP
    values got invalid as a result of limiting both of these values
    separately to the corresponding source/sink capability limits.
    
    Reviewed-by: Vinod Govindapillai 
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-14-imre.deak@intel.com

commit 3755e200bc7ffcf56424008f7f97909904968f18
Author: Imre Deak 
Date:   Mon Dec 15 21:23:52 2025 +0200

    drm/i915/dp: Account with pipe joiner max compressed BPP limit for DP-MST and eDP
    
    The pipe joiner maximum compressed BPP must be limited based on the pipe
    joiner memory size and BW, do that for all DP outputs by adjusting the
    max compressed BPP value already in
    intel_dp_compute_config_link_bpp_limits() (which is used by all output
    types).
    
    This way the BPP doesn't need to be adjusted in
    dsc_compute_compressed_bpp() (called for DP-SST after the above limits
    were computed already), so remove the adjustment from there.
    
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-13-imre.deak@intel.com

commit 260aef187f7ffaf03a1f4c51b5b748f1ca026696
Author: Imre Deak 
Date:   Mon Dec 15 21:23:51 2025 +0200

    drm/i915/dp: Account with DSC BW overhead for compressed DP-SST stream BW
    
    A DSC compressed stream requires FEC (except for eDP), which has a BW
    overhead on non-UHBR links that must be accounted for explicitly. Do
    that during computing the required BW.
    
    Note that the overhead doesn't need to be accounted for on UHBR links
    where FEC is always enabled and so the corresponding overhead is part of
    the channel coding efficiency instead (i.e. the overhead is part of the
    available vs. the required BW).
    
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-12-imre.deak@intel.com

commit e25b6f1334463c1dea3972222352f0cca035cb51
Author: Imre Deak 
Date:   Mon Dec 15 21:23:50 2025 +0200

    drm/i915/dp: Account with MST, SSC BW overhead for uncompressed DP-MST stream BW
    
    On MST links the symbol alignment and SSC have a BW overhead, which
    should be accounted for when calculating the required stream BW, do so
    during mode validation for an uncompressed stream.
    
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-11-imre.deak@intel.com

commit 2fb850a6aeb20b6a28c23dbddf1eaa704abb9ce9
Author: Imre Deak 
Date:   Mon Dec 15 21:23:49 2025 +0200

    drm/i915/dp: Use the effective data rate for DP compressed BW calculation
    
    Use intel_dp_effective_data_rate() to calculate the required link BW for
    compressed streams on non-UHBR DP-SST links. This ensures that the BW is
    calculated the same way for all DP output types and DSC/non-DSC modes,
    during mode validation as well as during state computation.
    
    This approach also allows for accounting with BW overhead due to DSC,
    FEC being enabled on a link. Acounting for these will be added by
    follow-up changes.
    
    Reviewed-by: Luca Coelho 
    Reviewed-by: Vinod Govindapillai 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-10-imre.deak@intel.com

commit b1ec2916c929a58b533b7f652d0162299d8a6398
Author: Imre Deak 
Date:   Mon Dec 15 21:23:48 2025 +0200

    drm/i915/dp: Use the effective data rate for DP BW calculation
    
    Use intel_dp_effective_data_rate() to calculate the required link BW for
    eDP, DP-SST and MST links. This ensures that the BW is calculated the
    same way for all DP output types, during mode validation as well as
    during state computation. This approach also allows for accounting with
    BW overheads due to the SSC, DSC, FEC being enabled on a link, as well
    as due to the MST symbol alignment on the link. Accounting for these
    overheads will be added by follow-up changes.
    
    This way also computes the stream BW on a UHBR link correctly, using the
    corresponding symbol size to effective data size ratio (i.e. ~97% link
    BW utilization for UHBR vs. only ~80% for non-UHBR).
    
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-9-imre.deak@intel.com

commit 3999f6d7f588819cd03aa6baa95cac9be7834e45
Author: Imre Deak 
Date:   Mon Dec 15 21:23:47 2025 +0200

    drm/i915/dp: Fix BW check in is_bw_sufficient_for_dsc_config()
    
    is_bw_sufficient_for_dsc_config() should return true if the required BW
    equals the available BW, make it so.
    
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-8-imre.deak@intel.com

commit 78cfaaa11151a85fd3952c4f4f485308ffd3964b
Author: Imre Deak 
Date:   Mon Dec 15 21:23:46 2025 +0200

    drm/i915/dp: Factor out intel_dp_link_bw_overhead()
    
    Factor out intel_dp_link_bw_overhead(), used later for BW calculation
    during DP SST mode validation and state computation.
    
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-7-imre.deak@intel.com

commit 1867564b9080d096445f1c40b3fc360364735bb9
Author: Imre Deak 
Date:   Mon Dec 15 21:23:45 2025 +0200

    drm/i915/dp: Use a mode's crtc_clock vs. clock during state computation
    
    The encoder state computation should use the
    drm_display_mode::crtc_clock member, instead of the clock member, the
    former one possibly having a necessary adjustment wrt. to the latter
    due to driver specific constraints. In practice the two values should
    not differ at spots changed in this patch, since only MSO and 3D modes
    would make them different, neither MSO or 3D relevant here, but still
    use the expected crtc_clock version for consistency.
    
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-6-imre.deak@intel.com

commit 1f28404ad4712cae0f04532e1fb7b26f9c423292
Author: Imre Deak 
Date:   Mon Dec 15 21:23:44 2025 +0200

    drm/i915/dp: Return a fixed point BPP value from intel_dp_output_bpp()
    
    Convert intel_dp_output_bpp() and intel_dp_mode_min_output_bpp() to
    return an x16 fixed point bpp value, as this value will be always the
    link BPP (either compressed or uncompressed) tracked in the same x16
    fixed point format.
    
    While at it rename
    intel_dp_output_bpp() to intel_dp_output_format_link_bpp_x16() and
    intel_dp_mode_min_output_bpp() to intel_dp_mode_min_link_bpp_x16() to
    better reflect that these functions return an x16 link BPP value
    specific to a particular output format or mode.
    
    Also rename intel_dp_output_bpp()'s bpp parameter to pipe_bpp, to
    clarify which kind of (pipe vs. link) BPP the parameter is.
    
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-5-imre.deak@intel.com

commit 0b1499051ab39d8958e43ff292f5e3a7324427bb
Author: Imre Deak 
Date:   Mon Dec 15 21:23:43 2025 +0200

    drm/i915/dp: Fix DSC sink's slice count capability check
    
    A DSC sink supporting DSC slice count N, not necessarily supports slice
    counts less than N. Hence the driver should check the sink's support for
    a particular slice count before using that slice count, fix
    intel_dp_dsc_get_slice_count() accordingly.
    
    Cc: dri-devel@lists.freedesktop.org
    Reviewed-by: Luca Coelho 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-4-imre.deak@intel.com

commit 92a73fec6acdcef3f2da7b2d1d4574308ebbe975
Author: Imre Deak 
Date:   Mon Dec 15 21:23:42 2025 +0200

    drm/dp: Add drm_dp_dsc_sink_slice_count_mask()
    
    A DSC sink supporting DSC slice count N, not necessarily supports slice
    counts less than N. Hence the driver should check the sink's support for
    a particular slice count before using that slice count. Add the helper
    functions required for this.
    
    Cc: dri-devel@lists.freedesktop.org
    Reviewed-by: Luca Coelho 
    Acked-by: Maarten Lankhorst 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-3-imre.deak@intel.com

commit cc1b753487bb23e5a1c96c9864d515690e15b605
Author: Imre Deak 
Date:   Mon Dec 15 21:23:41 2025 +0200

    drm/dp: Parse all DSC slice count caps for eDP 1.5
    
    eDP 1.5 supports all the slice counts reported via DP_DSC_SLICE_CAP_1,
    so adjust drm_dp_dsc_sink_max_slice_count() accordingly.
    
    Cc: dri-devel@lists.freedesktop.org
    Reviewed-by: Luca Coelho 
    Acked-by: Maarten Lankhorst 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251215192357.172201-2-imre.deak@intel.com

commit 7d307daa12b15a97269f577d5dcf50518758b568
Author: Javier Martinez Canillas 
Date:   Sat Dec 6 14:44:55 2025 +0100

    riscv: dts: spacemit: Define the P1 PMIC regulators for Milk-V Jupiter
    
    Define the SpacemiT P1 PMIC voltage regulators and their constraints.
    
    The power management hardware design on the Milk-V Jupiter is identical to
    the Banana Pi BPI-F3, so the DT Nodes were taken from k1-bananapi-f3.dts.
    
    Signed-off-by: Javier Martinez Canillas 
    Reviewed-by: Yixun Lan 
    Link: https://lore.kernel.org/r/20251206134532.1741648-4-javierm@redhat.com
    Signed-off-by: Yixun Lan 

commit ae9d03f8aec76c1bff21083b67c211238d7c57b1
Author: Javier Martinez Canillas 
Date:   Sat Dec 6 14:44:54 2025 +0100

    riscv: dts: spacemit: Define fixed regulators for Milk-V Jupiter
    
    Define the DC power input and the 4v power as fixed regulator supplies.
    
    Signed-off-by: Javier Martinez Canillas 
    Reviewed-by: Yixun Lan 
    Link: https://lore.kernel.org/r/20251206134532.1741648-3-javierm@redhat.com
    Signed-off-by: Yixun Lan 

commit f33ccc2316304f3a71e40e53f1568e75042b0a4b
Author: Javier Martinez Canillas 
Date:   Sat Dec 6 14:44:53 2025 +0100

    riscv: dts: spacemit: Enable i2c8 adapter for Milk-V Jupiter
    
    The adapter is used to access the SpacemiT P1 PMIC present in this board.
    
    Signed-off-by: Javier Martinez Canillas 
    Reviewed-by: Yixun Lan 
    Link: https://lore.kernel.org/r/20251206134532.1741648-2-javierm@redhat.com
    Signed-off-by: Yixun Lan 

commit aa62e130149f9cba53374e4ab51c9a9581dc9764
Author: Ziran Zhang 
Date:   Wed Dec 17 14:17:37 2025 +0800

    doc : fix a broken link in ext2.rst
    
    The original link returns a 404, so I update it to the latest
    accessible url.
    
    No functional change to any code, only documentation updates.
    
    Signed-off-by: Ziran Zhang 
    Link: https://patch.msgid.link/20251217061737.6079-1-zhangcoder@yeah.net
    Signed-off-by: Jan Kara 

commit dc8d1ba537c0bb4da91695b473dbe9a404f7ed7e
Merge: 20c24c1b28310c 02e7af5b6423d2
Author: Mark Brown 
Date:   Fri Dec 19 13:13:57 2025 +0000

    ASoC: Intel: add support for TAS2563 amplifier
    
    Merge series from Bard Liao :
    
    Add support for TAS2563 amplifier on Intel platforms.

commit 20c24c1b28310c08b2a76fd14e5600cb64343005
Merge: 10929de75e6c99 9a6bc0a406608e
Author: Mark Brown 
Date:   Fri Dec 19 13:13:53 2025 +0000

    ASoC: codecs: ES8326 : Add Kcontrol
    
    Merge series from Zhang Yi :
    
    Add some Kcontrols for ES8326

commit 10929de75e6c99cfd91b6fdcd71e9ba5b7b8a572
Merge: 7a8447fc71a090 2a28b5240f2b32
Author: Mark Brown 
Date:   Fri Dec 19 13:13:48 2025 +0000

    ASoC: SOF: ipoc4: Support for generic bytes
    
    Merge series from Peter Ujfalusi :
    
    We support bytes control type for set and get, but these are module specific
    controls and there is no way to handle notifications from them in a generic way.
    Each control have module specific param_id and this param_id is only valid in
    the module's scope, other modules might use the same id for different functions
    for example.
    
    This series will add a new generic control type, similar to the existing ones
    for ENUM and SWITCH, which can be used to create bytes controls which can send
    notifications from firmware on change.
    
    The new param_id is 202 and the sof_ipc4_control_msg_payload is updated to
    describe bytes payload also.
    
    On set, the payload must include the sof_ipc4_control_msg_payload struct with
    the control's ID and data size, followed by the data.
    
    On get, the kernel needs to send the sof_ipc4_control_msg_payload struct along
    with the LARGE_CONFIG_GET message as payload with the ID of the control that
    needs to be retrieved. The raw data is received back without additional header.
    
    A notification might contain data, in this case the num_elems reflects the size
    in bytes, or without data. If no data is received then the control is marked as
    dirty and on read the kernel will refresh the data from firmware.
    
    The series includes mandatory fixes for existing code and adds support for
    sending payload with LARGE_CONFIG_GET when the param_id is either generic ENUM,
    SWITCH or BYTES control.

commit 8e7460eac786c72f48c4e04ce9be692b939428ce
Author: Adrián Larumbe 
Date:   Wed Dec 17 21:32:33 2025 +0000

    drm/panthor: Support partial unmaps of huge pages
    
    Commit 33729a5fc0ca ("iommu/io-pgtable-arm: Remove split on unmap
    behavior") did away with the treatment of partial unmaps of huge IOPTEs.
    
    In the case of Panthor, that means an attempt to run a VM_BIND unmap
    operation on a memory region whose start address and size aren't 2MiB
    aligned, in the event it intersects with a huge page, would lead to ARM
    IOMMU management code to fail and a warning being raised.
    
    Presently, and for lack of a better alternative, it's best to have
    Panthor handle partial unmaps at the driver level, by unmapping entire
    huge pages and remapping the difference between them and the requested
    unmap region.
    
    This could change in the future when the VM_BIND uAPI is expanded to
    enforce huge page alignment and map/unmap operational constraints that
    render this code unnecessary.
    
    When a partial unmap for a huge PTE is attempted, we also need to expand
    the locked region to encompass whole huge pages.
    
    Signed-off-by: Adrián Larumbe 
    Reviewed-by: Boris Brezillon 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251217213252.677020-2-adrian.larumbe@collabora.com
    Signed-off-by: Boris Brezillon 

commit 51cd1fb70e08802904cd990b9b446125ee34de13
Author: Jie Gan 
Date:   Mon Nov 3 15:06:21 2025 +0800

    dt-bindings: arm: add CTCU device for monaco
    
    The CTCU device for monaco shares the same configurations as SA8775p. Add
    a fallback to enable the CTCU for monaco to utilize the compitable of the
    SA8775p.
    
    Reviewed-by: Krzysztof Kozlowski 
    Acked-by: Suzuki K Poulose 
    Reviewed-by: Bjorn Andersson 
    Signed-off-by: Jie Gan 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20251103-enable-ctcu-for-monaco-v4-1-92ff83201584@oss.qualcomm.com

commit 458800ea171b00d9c2af7c8cbf2819fd85af1aff
Merge: 65ccce35fa7a3b b39ef93a2e5b5f
Author: Mark Brown 
Date:   Fri Dec 19 12:16:32 2025 +0000

    spi: stm32: stability & performance enhancements
    
    Merge series from Alain Volmat :
    
    The series fixes a stability issue when dealing with <8bpw
    transfers, as well as enforce an error if the DMA information
    provided within the DT are incorrect.
    
    Performance enhancement is also provided by allowing a polling
    mode which is triggered when the transfer is so short that
    polling mode transfer would lead to faster transfer than
    if it was done in a interrupt driven manner.

commit 565ed40b5fc1242f7538a016fce5a85f802d4fb5
Author: Ketil Johnsen 
Date:   Fri Dec 19 10:35:44 2025 +0100

    drm/panthor: Evict groups before VM termination
    
    Ensure all related groups are evicted and suspended before VM
    destruction takes place.
    
    This fixes an issue where panthor_vm_destroy() destroys and unmaps the
    heap context while there are still on slot groups using this.
    The FW will do a write out to the heap context when a CSG (group) is
    suspended, so a premature unmap of the heap context will cause a
    GPU page fault.
    This page fault is quite harmless, and do not affect the continued
    operation of the GPU.
    
    Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block")
    Reviewed-by: Boris Brezillon 
    Signed-off-by: Ketil Johnsen 
    Reviewed-by: Liviu Dudau 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251219093546.1227697-1-ketil.johnsen@arm.com
    Co-developed-by: Boris Brezillon 
    Signed-off-by: Boris Brezillon 

commit 5add3c3c280a35f7e258e9cef7607db5a2e56fdc
Merge: c7b83a916d62c4 8f0b4cce4481fb
Author: Thomas Hellström 
Date:   Fri Dec 19 11:51:22 2025 +0100

    Merge drm/drm-next into drm-xe-next
    
    Backmerging to bring in 6.19-rc1. An important upstream bugfix and
    to help unblock PTL CI.
    
    Signed-off-by: Thomas Hellström 

commit cfd2fdfd0a8da2e5bbfdc4009b9c4b8bf164c937
Author: Manivannan Sadhasivam 
Date:   Thu Dec 18 17:34:52 2025 +0530

    PCI: dwc: Skip PME_Turn_Off broadcast and L2/L3 transition during suspend if link is not up
    
    During system suspend, if the PCIe link is not up, then there is no need
    to broadcast PME_Turn_Off message and wait for L2/L3 transition. So skip
    them.
    
    Signed-off-by: Manivannan Sadhasivam 
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Vincent Guittot 
    Reviewed-by: Frank Li 
    Reviewed-by: Shawn Lin 
    Link: https://patch.msgid.link/20251218-pci-dwc-suspend-rework-v2-1-5a7778c6094a@oss.qualcomm.com

commit 6a3591522930897c3fdb326c5d48b906b5c30b71
Author: Jani Nikula 
Date:   Thu Dec 18 16:18:07 2025 +0200

    drm/i915/colorop: do not include headers from headers
    
    drm_colorop.h doesn't need the intel_display_types.h include for
    anything. Don't include headers from headers if it can be avoided.
    
    Fixes: 3e9b06559aa1 ("drm/i915: Add intel_color_op")
    Cc: Suraj Kandpal 
    Cc: Chaitanya Kumar Borah 
    Cc: Uma Shankar 
    Reviewed-by: Chaitanya Kumar Borah 
    Link: https://patch.msgid.link/20251218141807.409751-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 32a708ba5db50cf928a1f1b2039ceef33de2c286
Author: ChiYuan Huang 
Date:   Fri Dec 19 14:36:20 2025 +0800

    regulator: Add rt8092 support
    
    RT8092 is a 3MHz 4A efficiency step-down converter with I2C control
    interface. It can support wide output range from 0.7 to 5.5V, based on
    the voltage bank selection.
    
    Signed-off-by: ChiYuan Huang 
    Link: https://patch.msgid.link/d2293c513f396f86e54f9b806fd0195b57db7aae.1766125676.git.cy_huang@richtek.com
    Signed-off-by: Mark Brown 

commit e5eb5638d632cf1180454acf16391ea9450e6295
Author: ChiYuan Huang 
Date:   Fri Dec 19 14:36:19 2025 +0800

    regulator: dt-bindings: rt5739: Add compatible for rt8092
    
    Append rt8092 compatible in rt5739 document.
    
    Compared to rt5739, RT8092 can offer up to 4A output current.
    
    Signed-off-by: ChiYuan Huang 
    Link: https://patch.msgid.link/9b67b2d2b4268d356f41ae2d0c3202e7813ea6b1.1766125676.git.cy_huang@richtek.com
    Signed-off-by: Mark Brown 

commit 6ab7973f254071faf20fe5fcc502a3fe9ca14a47
Author: Peter Zijlstra 
Date:   Fri Dec 19 09:04:45 2025 +0100

    sched/fair: Fix sched_avg fold
    
    After the robot reported a regression wrt commit: 089d84203ad4 ("sched/fair:
    Fold the sched_avg update"), Shrikanth noted that two spots missed a factor
    se_weight().
    
    Fixes: 089d84203ad4 ("sched/fair: Fold the sched_avg update")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-lkp/202512181208.753b9f6e-lkp@intel.com
    Debugged-by: Shrikanth Hegde 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251218102020.GO3707891@noisy.programming.kicks-ass.net

commit 01122b89361e565b3c88b9fbebe92dc5c7420cb7
Author: Peter Zijlstra 
Date:   Wed Dec 17 13:23:59 2025 +0100

    perf: Use EXPORT_SYMBOL_FOR_KVM() for the mediated APIs
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251208115156.GE3707891@noisy.programming.kicks-ass.net

commit cffa413f1c94d8da45b31dd958bfeaa72329991b
Author: Ankit Nautiyal 
Date:   Sat Nov 22 11:06:51 2025 +0530

    drm/i915/dp: Restrict max source rate for WCL to HBR3
    
    WCL supports a maximum of HBR3 8.1 Gbps for both eDP/DP.
    Limit the max source rate to HBR3 for WCL.
    
    v2: Move the check inside mtl_max_source_rate(). (Suraj)
    
    Bspec:74286
    Signed-off-by: Ankit Nautiyal 
    Reviewed-by: Suraj Kandpal 
    Link: https://patch.msgid.link/20251122053651.759389-1-ankit.k.nautiyal@intel.com

commit 32c539884d098345bf0fa8554ff2118be7571879
Author: Thorsten Blum 
Date:   Thu Dec 11 11:15:55 2025 +0100

    crypto: algapi - Use crypto_unregister_algs in crypto_register_algs
    
    Replace the for loop with a call to crypto_unregister_algs(). Return
    'ret' immediately and remove the goto statement to simplify the error
    handling code.
    
    In crypto_unregister_algs(), unregister the algorithms in reverse order.
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Herbert Xu 

commit 0e602c5f04943a0a123aef69076ef9305c484c53
Author: Thorsten Blum 
Date:   Thu Dec 11 09:52:51 2025 +0100

    crypto: scompress - Use crypto_unregister_scomps in crypto_register_scomps
    
    Replace the for loop with a call to crypto_unregister_scomps(). Return
    'ret' immediately and remove the goto statement to simplify the error
    handling code.  No functional changes.
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Herbert Xu 

commit bb571875f77f2af259b6e2cca91b10964bcd0d79
Author: Harshal Dev 
Date:   Thu Dec 11 14:14:59 2025 +0530

    dt-bindings: crypto: qcom,prng: document x1e80100
    
    Document x1e80100 compatible for the True Random Number Generator.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Harshal Dev 
    Signed-off-by: Herbert Xu 

commit 3e8541f98df72046ba788f29b05e5bd2baaa86cb
Author: Thorsten Blum 
Date:   Tue Dec 9 16:30:43 2025 +0100

    crypto: scompress - Remove forward declaration of crypto_scomp_show
    
    Add the __maybe_unused attribute to the crypto_scomp_show() definition
    and remove the now-unnecessary forward declaration.
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Herbert Xu 

commit 97282e2cdecb209b4d19b2a7c52eb71fb8a82435
Author: Can Peng 
Date:   Mon Dec 8 17:50:10 2025 +0800

    crypto: fips - annotate fips_enable() with __init to free init memory after boot
    
    The fips_enable() function is only invoked early during kernel boot via the
    __setup() macro ("fips=" command line parameter), and is never used again
    after initialization completes.
    
    Annotating it with __init places the function in the .init.text section,
    allowing the kernel to free its memory after init (when freeing_initmem()
    runs), reducing runtime memory footprint.
    
    This is a standard practice for setup/early-parse functions and has no
    functional impact — the parsing logic, return values, and fips mode
    setting behavior remain unchanged.
    
    Signed-off-by: Can Peng 
    Signed-off-by: Herbert Xu 

commit e6bba60966bbb31ac54319dac3b9ad41113a8f0a
Author: Thorsten Blum 
Date:   Fri Nov 28 14:54:12 2025 +0100

    crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module
    
    iaa_unregister_compression_device() always returns 0, making the debug
    log message unreachable. Remove the log statement and convert
    iaa_unregister_compression_device() to a void function.
    
    Signed-off-by: Thorsten Blum 
    Acked-by: Kanchana P Sridhar 
    Signed-off-by: Herbert Xu 

commit 375a0168e1ae917692d9175fc0494f74174d0eb2
Author: Thorsten Blum 
Date:   Thu Nov 27 23:20:58 2025 +0100

    crypto: iaa - Simplify init_iaa_device()
    
    Return the result directly to simplify init_iaa_device().
    
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Herbert Xu 

commit 48329301969f6d21b2ef35f678e40f72b59eac94
Author: Thorsten Blum 
Date:   Thu Nov 27 15:01:57 2025 +0100

    crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode
    
    The local variable 'i' is initialized with -EINVAL, but the for loop
    immediately overwrites it and -EINVAL is never returned.
    
    If no empty compression mode can be found, the function would return the
    out-of-bounds index IAA_COMP_MODES_MAX, which would cause an invalid
    array access in add_iaa_compression_mode().
    
    Fix both issues by returning either a valid index or -EINVAL.
    
    Cc: stable@vger.kernel.org
    Fixes: b190447e0fa3 ("crypto: iaa - Add compression mode management along with fixed mode")
    Signed-off-by: Thorsten Blum 
    Acked-by: Kanchana P Sridhar 
    Signed-off-by: Herbert Xu 

commit 5565a72b24fa7935a9f30af386e92c8c9dfb23b9
Author: Thorsten Blum 
Date:   Wed Nov 26 10:46:13 2025 +0100

    crypto: octeontx - Fix length check to avoid truncation in ucode_load_store
    
    OTX_CPT_UCODE_NAME_LENGTH limits the microcode name to 64 bytes. If a
    user writes a string of exactly 64 characters, the original code used
    'strlen(buf) > 64' to check the length, but then strscpy() copies only
    63 characters before adding a NUL terminator, silently truncating the
    copied string.
    
    Fix this off-by-one error by using 'count' directly for the length check
    to ensure long names are rejected early and copied without truncation.
    
    Cc: stable@vger.kernel.org
    Fixes: d9110b0b01ff ("crypto: marvell - add support for OCTEON TX CPT engine")
    Signed-off-by: Thorsten Blum 
    Signed-off-by: Herbert Xu 

commit 352140d396b14d5f4d50b15f3a50020c2c4f337b
Author: Gustavo A. R. Silva 
Date:   Mon Nov 24 18:11:30 2025 +0900

    crypto: sun8i-ss - Avoid -Wflex-array-member-not-at-end warning
    
    -Wflex-array-member-not-at-end was introduced in GCC-14, and we are
    getting ready to enable it, globally.
    
    Move the conflicting declaration to the end of the corresponding
    structure. Notice that `struct ahash_request` is a flexible structure,
    this is a structure that contains a flexible-array member.
    
    With these changes fix the following warning:
    
    drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h:251:30: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
    
    Signed-off-by: Gustavo A. R. Silva 
    Signed-off-by: Herbert Xu 

commit b6f27c0ad00896b6ef20aa78a4282c7cc63ab56b
Author: Gustavo A. R. Silva 
Date:   Fri Nov 21 12:56:21 2025 +0900

    crypto: starfive - Avoid -Wflex-array-member-not-at-end warning
    
    -Wflex-array-member-not-at-end was introduced in GCC-14, and we are
    getting ready to enable it, globally.
    
    Move the conflicting declaration to the end of the corresponding
    structure. Notice that `struct ahash_request` is a flexible structure,
    this is a structure that contains a flexible-array member.
    
    With these changes fix the following warning:
    
    drivers/crypto/starfive/jh7110-cryp.h:219:49: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
    
    Signed-off-by: Gustavo A. R. Silva 
    Signed-off-by: Herbert Xu 

commit 994689b8f91b02fdb5f64cba2412cde5ef3084b5
Author: Giovanni Cabiddu 
Date:   Thu Nov 20 16:30:46 2025 +0000

    crypto: qat - fix warning on adf_pfvf_pf_proto.c
    
    Building the QAT driver with -Wmaybe-uninitialized triggers warnings in
    qat_common/adf_pfvf_pf_proto.c. Specifically, the variables blk_type,
    blk_byte, and byte_max may be used uninitialized in handle_blkmsg_req():
    
      make M=drivers/crypto/intel/qat W=1 C=2 "KCFLAGS=-Werror" \
           KBUILD_CFLAGS_KERNEL=-Wmaybe-uninitialized           \
           CFLAGS_MODULE=-Wmaybe-uninitialized
    
      ...
      warning: ‘byte_max’ may be used uninitialized [-Wmaybe-uninitialized]
      warning: ‘blk_type’ may be used uninitialized [-Wmaybe-uninitialized]
      warning: ‘blk_byte’ may be used uninitialized [-Wmaybe-uninitialized]
    
    Although the caller of handle_blkmsg_req() always provides a req.type
    that is handled by the switch, the compiler cannot guarantee this.
    
    Add a default case to the switch statement to handle an invalid req.type.
    
    Fixes: 673184a2a58f ("crypto: qat - introduce support for PFVF block messages")
    Signed-off-by: Giovanni Cabiddu 
    Reviewed-by: Ahsan Atta 
    Signed-off-by: Herbert Xu 

commit 90ca8d359666d16d11f73f6eb92cb51585efa1bd
Author: Giovanni Cabiddu 
Date:   Thu Nov 20 16:30:19 2025 +0000

    crypto: qat - add bank state save and restore for qat_420xx
    
    Register the functions required to save and restore the state of a ring
    bank on the qat_420xx device.  Since this logic is shared across QAT
    GEN4 devices, reuse the existing GEN4 implementation.
    
    This functionality enables saving and restoring the state of a Virtual
    Function (VF), which is required for supporting VM Live Migration.
    
    Signed-off-by: Giovanni Cabiddu 
    Reviewed-by: Ahsan Atta 
    Signed-off-by: Herbert Xu 

commit e3d036fecd6f89d4d262034de7bef8d6e49b661b
Author: Giovanni Cabiddu 
Date:   Thu Nov 20 16:29:23 2025 +0000

    crypto: qat - fix parameter order used in ICP_QAT_FW_COMN_FLAGS_BUILD
    
    The macro ICP_QAT_FW_COMN_FLAGS_BUILD sets flags in the firmware
    descriptor to indicate:
    
      * Whether the content descriptor is a pointer or contains embedded
        data.
      * Whether the source and destination buffers are scatter-gather lists
        or flat buffers.
    
    The correct parameter order is:
    
      * First: content descriptor type
      * Second: source/destination pointer type
    
    In the asymmetric crypto code, the macro was used with the parameters
    swapped. Although this does not cause functional issues, since both
    macros currently evaluate to 0, it is incorrect.
    
    Fix the parameter order in the Diffie-Hellman and RSA code paths.
    
    Fixes: a990532023b9 ("crypto: qat - Add support for RSA algorithm")
    Fixes: c9839143ebbf ("crypto: qat - Add DH support")
    Reported-by: Qihua Dai  # off-list
    Reviewed-by: Ahsan Atta 
    Signed-off-by: Giovanni Cabiddu 
    Signed-off-by: Herbert Xu 

commit eeb2ea4b59df5fdcb697904fe6f49d5851543808
Author: Dmitry Torokhov 
Date:   Thu Dec 18 21:41:04 2025 -0800

    Input: ilitek_ts_i2c - switch mdelay() to fsleep()
    
    The mdelay() is called in sleeping context and it should be OK to delay
    slightly longer than requested, so switch the code to use fsleep() to
    avoid spinning.
    
    Signed-off-by: Dmitry Torokhov 

commit a2c5ea4235b18781c3926bbb983d8314c45d6345
Author: Josua Mayer 
Date:   Thu Dec 18 21:38:55 2025 -0800

    Input: ilitek_ts_i2c - fix warning with gpio controllers that sleep
    
    The ilitek touchscreen driver uses the non-sleeping gpiod_set_value
    function for reset.
    
    Switch to using gpiod_set_value_cansleep() when controlling reset_gpio to
    support GPIO providers that may sleep, such as I2C GPIO expanders.
    
    Further switch the mdelay calls on the reset path to fsleep (preferred
    in non-atomic contexts).
    
    This fixes noisy complaints in kernel log for gpio providers that do
    sleep.
    
    Signed-off-by: Josua Mayer 
    Link: https://patch.msgid.link/20251201-imx8mp-hb-iiot-v4-2-53a4cd6c21bf@solid-run.com
    Signed-off-by: Dmitry Torokhov 

commit ec8fce2a57e96e07d82d4e884430c2cb6c048998
Author: Andreas Kemnade 
Date:   Thu Dec 18 21:10:50 2025 -0800

    Input: twl4030 - add TWL603x power button
    
    Like the TWL4030, these PMICs also have a power button feature, so extend
    the TWL4030 power button driver. As the irqchip of the TWL6030 mfd driver
    does not provide mask, unmask finctions, do it manually.
    
    Signed-off-by: Andreas Kemnade 
    Link: https://patch.msgid.link/20251106-twl6030-button-v4-2-fdf1aa6e1e9a@kernel.org
    Signed-off-by: Dmitry Torokhov 

commit b72fbdc0807a42201b927112ce526ebf3bf2f391
Author: Marco Crivellari 
Date:   Thu Nov 6 15:19:55 2025 +0100

    Input: psmouse-smbus - add WQ_UNBOUND to alloc_workqueue user
    
    Currently if a user enqueue a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    This lack of consistentcy cannot be addressed without refactoring the API.
    
    alloc_workqueue() treats all queues as per-CPU by default, while unbound
    workqueues must opt-in via WQ_UNBOUND.
    
    This default is suboptimal: most workloads benefit from unbound queues,
    allowing the scheduler to place worker threads where they’re needed and
    reducing noise when CPUs are isolated.
    
    This patch continues the effort to refactor worqueue APIs, which has begun
    with the change introducing new workqueues and a new alloc_workqueue flag:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    This specific workload do not benefit from a per-cpu workqueue, so use
    WQ_UNBOUND on the custom workqueue instead.
    
    With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
    any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
    must now use WQ_PERCPU.
    
    Once migration is complete, WQ_UNBOUND can be removed and unbound will
    become the implicit default.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Link: https://patch.msgid.link/20251106141955.218911-5-marco.crivellari@suse.com
    Signed-off-by: Dmitry Torokhov 

commit b3ee88e27798f0e8dd3a81867804d693da74d57d
Author: Marco Crivellari 
Date:   Thu Nov 6 15:19:54 2025 +0100

    Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
    
    Currently if a user enqueues a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    
    This lack of consistency cannot be addressed without refactoring the API.
    
    This patch continues the effort to refactor worqueue APIs, which has begun
    with the change introducing new workqueues and a new alloc_workqueue flag:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    This specific workload do not benefit from a per-cpu workqueue, so use
    the default unbound workqueue (system_dfl_wq) instead.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Link: https://patch.msgid.link/20251106141955.218911-4-marco.crivellari@suse.com
    Signed-off-by: Dmitry Torokhov 

commit a4fcf43b63b6c319f8b998f461d02a18f584a88b
Author: Marco Crivellari 
Date:   Thu Nov 6 15:19:53 2025 +0100

    Input: palmas-pwrbutton - replace use of system_wq with system_dfl_wq
    
    Currently if a user enqueues a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    
    This lack of consistency cannot be addressed without refactoring the API.
    
    This patch continues the effort to refactor worqueue APIs, which has begun
    with the change introducing new workqueues and a new alloc_workqueue flag:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    This specific workload do not benefit from a per-cpu workqueue, so use
    the default unbound workqueue (system_dfl_wq) instead.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Link: https://patch.msgid.link/20251106141955.218911-3-marco.crivellari@suse.com
    Signed-off-by: Dmitry Torokhov 

commit 3d38e4f9a77e74fd068c3a77820f64d2f5c8a88c
Author: Marco Crivellari 
Date:   Thu Nov 6 15:19:52 2025 +0100

    Input: gpio_keys - replace use of system_wq with system_dfl_wq
    
    Currently if a user enqueues a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    
    This lack of consistency cannot be addressed without refactoring the API.
    
    This patch continues the effort to refactor worqueue APIs, which has begun
    with the change introducing new workqueues and a new alloc_workqueue flag:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    This specific workload do not benefit from a per-cpu workqueue, so use
    the default unbound workqueue (system_dfl_wq) instead.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Link: https://patch.msgid.link/20251106141955.218911-2-marco.crivellari@suse.com
    Signed-off-by: Dmitry Torokhov 

commit 90876d9b37a0db170d5998c6c903eab2d56fd7cb
Author: Greg Kroah-Hartman 
Date:   Wed Dec 17 13:46:32 2025 +0100

    irqdomain: Fix up const problem in irq_domain_set_name()
    
    In irq_domain_set_name() a const pointer is passed in, and then the
    const is "lost" when container_of() is called.  Fix this up by properly
    preserving the const pointer attribute when container_of() is used to
    enforce the fact that this pointer should not have anything at it
    changed.
    
    Signed-off-by: Greg Kroah-Hartman 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/2025121731-facing-unhitched-63ae@gregkh

commit c7b83a916d62c4d4447d7edf0bc5e06dc2afbdf8
Author: Swaraj Gaikwad 
Date:   Tue Dec 9 09:48:36 2025 +0000

    drm/xe: Fix documentation heading levels in xe_guc_pc.c
    
    Sphinx reports htmldocs warnings:
    
      Documentation/gpu/xe/xe_firmware:31: ./drivers/gpu/drm/xe/xe_guc_pc.c:76: ERROR: A level 2 section cannot be used here.
      Documentation/gpu/xe/xe_firmware:31: ./drivers/gpu/drm/xe/xe_guc_pc.c:87: ERROR: A level 2 section cannot be used here.
    
    The xe_guc_pc.c documentation is included inside xe_firmware.rst.
    The headers in the C file currently use '=' underlines, which conflict with
    the parent document's section levels.
    
    Fix this by demoting "Frequency management" and "Render-C States" headers
    from '=' to '-' to correctly nest them as subsections.
    
    Build environment: Python 3.13.7 Sphinx 8.2.3 docutils 0.22.3
    
    Signed-off-by: Swaraj Gaikwad 
    Link: https://patch.msgid.link/20251209094836.18589-1-swarajgaikwad1925@gmail.com
    Signed-off-by: Rodrigo Vivi 

commit fb084e4183e1d79ead103265cafc4b6bc0ecba03
Author: Riana Tauro 
Date:   Thu Dec 18 16:21:53 2025 +0530

    drm/xe/xe_survivability: Remove unused index
    
    Remove unused index variable and fix for loop.
    
    Fixes: f4e9fc967afd ("drm/xe/xe_survivability: Redesign survivability mode")
    Reported-by: Nathan Chancellor 
    Closes: https://lore.kernel.org/intel-xe/20251210075757.GA1206705@ax162/
    Signed-off-by: Riana Tauro 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251218105151.586575-5-riana.tauro@intel.com
    Signed-off-by: Rodrigo Vivi 

commit d441e38a2c87824afc7e656e634e55141d015307
Author: Thomas Gleixner 
Date:   Tue Nov 25 22:50:49 2025 +0100

    x86/irq_remapping: Sanitize posted_msi_supported()
    
    posted_msi_supported() is a misnomer as it actually checks whether it is
    enabled or not. Aside of that this does not take CONFIG_X86_POSTED_MSI into
    account which is required to actually use it.
    
    Rename it to posted_msi_enabled() and make the return value depend on
    CONFIG_X86_POSTED_MSI, which allows the compiler to eliminate the related
    dead code and data if disabled:
    
      text     data     bss     dec     hex filename
      10046     701    3296   14043    36db drivers/iommu/intel/irq_remapping.o
       9904     413    3296   13613    352d drivers/iommu/intel/irq_remapping.o
    
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251125214631.170499997@linutronix.de

commit 4021a6dad720273a95ac3c0816fc48e35e77dace
Author: Thomas Gleixner 
Date:   Tue Nov 25 22:50:47 2025 +0100

    x86/irq: Cleanup posted MSI code
    
    Make code and comments readable and use __this_cpu..() as this is
    guaranteed to be invoked with interrupts disabled.
    
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251125214631.108458942@linutronix.de

commit 9dde74fd9e65ddd952413d98a8a756e12d087627
Author: Alexander Usyskin 
Date:   Tue Dec 16 13:10:34 2025 +0200

    drm/xe/nvm: enable cri platform
    
    Mark CRI as one that have the CSC NVM device.
    Update the writable override flow to take the information from
    the scratch register for CRI.
    
    Signed-off-by: Alexander Usyskin 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251216111034.3093507-1-alexander.usyskin@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 5dbee3503771a36464e0b39a420475a727911c83
Author: Yao Zi 
Date:   Thu Nov 20 13:14:14 2025 +0000

    clk: thead: th1520-ap: Add macro to define multiplexers with flags
    
    The new macro, TH_CCU_MUX_FLAGS, extends TH_CCU_MUX macro by adding two
    parameters to specify clock flags and multiplexer flags.
    
    Reviewed-by: Drew Fustini 
    Signed-off-by: Yao Zi 
    Signed-off-by: Drew Fustini 

commit 238cc6316a885765fd52a6dc65b9ca4e47647b1e
Author: Yao Zi 
Date:   Thu Nov 20 13:14:13 2025 +0000

    clk: thead: th1520-ap: Support setting PLL rates
    
    TH1520 ships several PLLs that could operate in either integer or
    fractional mode. However, the TRM only lists a few configuration whose
    stability is considered guaranteed.
    
    Add a table-lookup rate determination logic to support PLL rate setting,
    and fill up frequency-configuration tables for AP-subsystem PLLs.
    
    Reviewed-by: Drew Fustini 
    Signed-off-by: Yao Zi 
    Signed-off-by: Drew Fustini 

commit b436f8a82aaa3bd54cb79b1219d94a99f7351d33
Author: Yao Zi 
Date:   Thu Nov 20 13:14:12 2025 +0000

    clk: thead: th1520-ap: Add C910 bus clock
    
    This divider takes c910_clk as parent and is essential for the C910
    cluster to operate, thus is marked as CLK_IS_CRITICAL.
    
    Reviewed-by: Drew Fustini 
    Signed-off-by: Yao Zi 
    Signed-off-by: Drew Fustini 

commit 892abfbed71e8e0fc5d6ccee1e975904805c6327
Author: Yao Zi 
Date:   Thu Nov 20 13:14:11 2025 +0000

    clk: thead: th1520-ap: Poll for PLL lock and wait for stability
    
    All PLLs found on TH1520 SoC take 21250ns at maximum to lock, and their
    lock status is indicated by register PLL_STS (offset 0x80 inside AP
    clock controller). We should poll the register to ensure the PLL
    actually locks after enabling it.
    
    Furthermore, a 30us delay is added after enabling the PLL, after which
    the PLL could be considered stable as stated by vendor clock code.
    
    Fixes: 56a48c1833aa ("clk: thead: add support for enabling/disabling PLLs")
    Reviewed-by: Drew Fustini 
    Signed-off-by: Yao Zi 
    Signed-off-by: Drew Fustini 

commit 5f352125f8a0bc906dff8419a2377903012d7f35
Author: Yao Zi 
Date:   Thu Nov 20 13:14:10 2025 +0000

    dt-bindings: clock: thead,th1520-clk-ap: Add ID for C910 bus clock
    
    Add binding ID for C910 bus clock, which takes CLK_C910 as parent and is
    essential for C910 cluster's operation.
    
    Acked-by: Conor Dooley 
    Signed-off-by: Yao Zi 
    Signed-off-by: Drew Fustini 

commit 332070795bd96193756cb4446eddc3ec9ff6a0e8
Author: Lizhi Hou 
Date:   Wed Dec 17 09:17:19 2025 -0800

    accel/amdxdna: Enable hardware context priority
    
    Newer firmware supports hardware context priority. Set the priority based
    on application input.
    
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251217171719.2139025-1-lizhi.hou@amd.com

commit 7818618a09a06320f409571bf28801ccfe7e0a30
Author: Lizhi Hou 
Date:   Wed Dec 17 11:11:50 2025 -0800

    accel/amdxdna: Enable temporal sharing only mode
    
    Newer firmware versions prefer temporal sharing only mode. In this mode,
    the driver no longer needs to manage AIE array column allocation. Instead,
    a new field, num_unused_col, is added to the hardware context creation
    request to specify how many columns will not be used by this hardware
    context.
    
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251217191150.2145937-1-lizhi.hou@amd.com

commit 3ef93841033edc6359146dccd88d2f7ac8d706d1
Author: Lizhi Hou 
Date:   Wed Dec 17 11:08:18 2025 -0800

    accel/amdxdna: Remove NPU2 support
    
    NPU2 hardware was never publicly released and is now obsolete.
    Remove all remaining NPU2 support from the driver.
    
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251217190818.2145781-1-lizhi.hou@amd.com

commit 7cc1720589d8cc78752cdf83a687422bb7838268
Author: Chen Ridong 
Date:   Thu Dec 18 09:31:41 2025 +0000

    cpuset: remove v1-specific code from generate_sched_domains
    
    Following the introduction of cpuset1_generate_sched_domains() for v1
    in the previous patch, v1-specific logic can now be removed from the
    generic generate_sched_domains(). This patch cleans up the v1-only
    code and ensures uf_node is only visible when CONFIG_CPUSETS_V1=y.
    
    Signed-off-by: Chen Ridong 
    Reviewed-by: Waiman Long 
    Signed-off-by: Tejun Heo 

commit 6e1d31ce495c35c12913246586bb04aac019b8e3
Author: Chen Ridong 
Date:   Thu Dec 18 09:31:40 2025 +0000

    cpuset: separate generate_sched_domains for v1 and v2
    
    The generate_sched_domains() function currently handles both v1 and v2
    logic. However, the underlying mechanisms for building scheduler domains
    differ significantly between the two versions. For cpuset v2, scheduler
    domains are straightforwardly derived from valid partitions, whereas
    cpuset v1 employs a more complex union-find algorithm to merge overlapping
    cpusets. Co-locating these implementations complicates maintenance.
    
    This patch, along with subsequent ones, aims to separate the v1 and v2
    logic. For ease of review, this patch first copies the
    generate_sched_domains() function into cpuset-v1.c as
    cpuset1_generate_sched_domains() and removes v2-specific code. Common
    helpers and top_cpuset are declared in cpuset-internal.h. When operating
    in v1 mode, the code now calls cpuset1_generate_sched_domains().
    
    Currently there is some code duplication, which will be largely eliminated
    once v1-specific code is removed from v2 in the following patch.
    
    Signed-off-by: Chen Ridong 
    Reviewed-by: Waiman Long 
    Signed-off-by: Tejun Heo 

commit cb33f8814c4af3c917fa249cd9ef34b17a5ef562
Author: Chen Ridong 
Date:   Thu Dec 18 09:31:39 2025 +0000

    cpuset: move update_domain_attr_tree to cpuset_v1.c
    
    Since relax_domain_level is only applicable to v1, move
    update_domain_attr_tree() to cpuset-v1.c, which solely updates
    relax_domain_level,
    
    Additionally, relax_domain_level is now initialized in cpuset1_inited.
    Accordingly, the initialization of relax_domain_level in top_cpuset is
    removed. The unnecessary remote_partition initialization in top_cpuset
    is also cleaned up.
    
    As a result, relax_domain_level can be defined in cpuset only when
    CONFIG_CPUSETS_V1=y.
    
    Signed-off-by: Chen Ridong 
    Reviewed-by: Waiman Long 
    Signed-off-by: Tejun Heo 

commit 4ef42c645f0ec9b56f0715204013a27c2fec801e
Author: Chen Ridong 
Date:   Thu Dec 18 09:31:38 2025 +0000

    cpuset: add cpuset1_init helper for v1 initialization
    
    This patch introduces the cpuset1_init helper in cpuset_v1.c to initialize
    v1-specific fields, including the fmeter and relax_domain_level members.
    
    The relax_domain_level related code will be moved to cpuset_v1.c in a
    subsequent patch. After this move, v1-specific members will only be
    visible when CONFIG_CPUSETS_V1=y.
    
    Signed-off-by: Chen Ridong 
    Reviewed-by: Waiman Long 
    Signed-off-by: Tejun Heo 

commit 56805c1bb19ea3e40131ecf1485fdfce1bc0366b
Author: Chen Ridong 
Date:   Thu Dec 18 09:31:37 2025 +0000

    cpuset: add cpuset1_online_css helper for v1-specific operations
    
    This commit introduces the cpuset1_online_css helper to centralize
    v1-specific handling during cpuset online. It performs operations such as
    updating the CS_SPREAD_PAGE, CS_SPREAD_SLAB, and CGRP_CPUSET_CLONE_CHILDREN
    flags, which are unique to the cpuset v1 control group interface.
    
    The helper is now placed in cpuset-v1.c to maintain clear separation
    between v1 and v2 logic.
    
    Signed-off-by: Chen Ridong 
    Reviewed-by: Waiman Long 
    Signed-off-by: Tejun Heo 

commit 14c11e1b2ac47fbc51503c7d0f35fad9ea5ea46e
Author: Chen Ridong 
Date:   Thu Dec 18 09:31:36 2025 +0000

    cpuset: add lockdep_assert_cpuset_lock_held helper
    
    Add lockdep_assert_cpuset_lock_held() to allow other subsystems to verify
    that cpuset_mutex is held.
    
    Suggested-by: Waiman Long 
    Signed-off-by: Chen Ridong 
    Reviewed-by: Waiman Long 
    Signed-off-by: Tejun Heo 

commit 425fe550fb513b567bd6d01f397d274092a9c274
Author: Thomas Hellström 
Date:   Wed Dec 17 10:34:41 2025 +0100

    drm/xe: Drop preempt-fences when destroying imported dma-bufs.
    
    When imported dma-bufs are destroyed, TTM is not fully
    individualizing the dma-resv, but it *is* copying the fences that
    need to be waited for before declaring idle. So in the case where
    the bo->resv != bo->_resv we can still drop the preempt-fences, but
    make sure we do that on bo->_resv which contains the fence-pointer
    copy.
    
    In the case where the copying fails, bo->_resv will typically not
    contain any fences pointers at all, so there will be nothing to
    drop. In that case, TTM would have ensured all fences that would
    have been copied are signaled, including any remaining preempt
    fences.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Fixes: fa0af721bd1f ("drm/ttm: test private resv obj on release/destroy")
    Cc: Matthew Brost 
    Cc:  # v6.16+
    Signed-off-by: Thomas Hellström 
    Tested-by: Matthew Brost 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251217093441.5073-1-thomas.hellstrom@linux.intel.com

commit 1b89d4a6bb4cd7cfd7eb2e3621f04fda956e4ef3
Author: Shankari Anand 
Date:   Sun Nov 23 14:54:37 2025 +0530

    samples: rust: debugfs: Update ARef imports to use sync::aref
    
    Update call sites in `rust_debugfs.rs` to import `ARef`
    from `sync::aref` instead of `types`.
    
    This aligns with the ongoing effort to move `ARef` and
    `AlwaysRefCounted` to sync.
    
    Suggested-by: Benno Lossin 
    Link: https://github.com/Rust-for-Linux/linux/issues/1173
    Signed-off-by: Shankari Anand 
    Link: https://patch.msgid.link/20251123092438.182251-10-shankari.ak0208@gmail.com
    [ Add 'debugfs' to the commit subject; be consistent with the existing
      import style for now. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 2da67beda68776842fd0a26f2374e42a5e9b12c8
Author: Shankari Anand 
Date:   Sun Nov 23 14:54:35 2025 +0530

    rust: scatterlist: Update ARef imports to use sync::aref
    
    Update call sites in `scatterlist.rs` to import `ARef`
    from `sync::aref` instead of `types`.
    
    This aligns with the ongoing effort to move `ARef` and
    `AlwaysRefCounted` to sync.
    
    Suggested-by: Benno Lossin 
    Link: https://github.com/Rust-for-Linux/linux/issues/1173
    Signed-off-by: Shankari Anand 
    Link: https://patch.msgid.link/20251123092438.182251-8-shankari.ak0208@gmail.com
    [ Change subject prefix to from 'kernel' to 'scatterlist'. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 2e2b4135d1cb32fc310f21e395ee7313a3681bee
Author: Shankari Anand 
Date:   Sun Nov 23 14:54:31 2025 +0530

    rust: device: Update ARef and AlwaysRefCounted imports from sync::aref
    
    Update call sites to import `ARef` and `AlwaysRefCounted`
    from `sync::aref` instead of `types`.
    
    This aligns with the ongoing effort to move `ARef` and
    `AlwaysRefCounted` to sync.
    
    Suggested-by: Benno Lossin 
    Link: https://github.com/Rust-for-Linux/linux/issues/1173
    Signed-off-by: Shankari Anand 
    Link: https://patch.msgid.link/20251123092438.182251-4-shankari.ak0208@gmail.com
    Signed-off-by: Danilo Krummrich 

commit 9805f2cfc883018f7bf84c84e3af3786c37dac7b
Author: Clément Le Goffic 
Date:   Tue Nov 18 16:08:01 2025 +0100

    dt-bindings: memory: SDRAM channel: standardise node name
    
    Add a pattern for sdram channel node name.
    
    Signed-off-by: Clément Le Goffic 
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Clément Le Goffic 
    Link: https://patch.msgid.link/20251118-b4-ddr-bindings-v9-5-a033ac5144da@gmail.com
    Signed-off-by: Krzysztof Kozlowski 

commit 36ecc8346747b600892e3040e1d0ecb1e939c6e8
Author: Clément Le Goffic 
Date:   Tue Nov 18 16:08:00 2025 +0100

    dt-bindings: memory: add DDR4 channel compatible
    
    Add in the memory channel binding the DDR4 compatible to support DDR4
    memory channel.
    
    Signed-off-by: Clément Le Goffic 
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Clément Le Goffic 
    Link: https://patch.msgid.link/20251118-b4-ddr-bindings-v9-4-a033ac5144da@gmail.com
    Signed-off-by: Krzysztof Kozlowski 

commit 6ab3581ab19fa348b93c85a793e45cd8a80912a8
Author: Clément Le Goffic 
Date:   Tue Nov 18 16:07:59 2025 +0100

    dt-bindings: memory: factorise LPDDR channel binding into SDRAM channel
    
    LPDDR, DDR and so SDRAM channels exist and share the same properties, they
    have a compatible, ranks, and an io-width.
    
    Signed-off-by: Clément Le Goffic 
    Reviewed-by: Rob Herring (Arm) 
    Signed-off-by: Clément Le Goffic 
    Link: https://patch.msgid.link/20251118-b4-ddr-bindings-v9-3-a033ac5144da@gmail.com
    Signed-off-by: Krzysztof Kozlowski 

commit b5c1a217552c3513977a9f1138b05de0bada8a52
Author: Clément Le Goffic 
Date:   Tue Nov 18 16:07:58 2025 +0100

    dt-bindings: memory: introduce DDR4
    
    Introduce JEDEC compliant DDR bindings, that use new memory-props binding.
    
    The DDR4 compatible can be made of explicit vendor names and part
    numbers or be of the form "ddrX-YYYY,AAAA...-ZZ" when associated with an
    SPD, where (according to JEDEC SPD4.1.2.L-6):
    - YYYY is the manufacturer ID
    - AAAA... is the part number
    - ZZ is the revision ID
    
    The former form is useful when the SDRAM vendor and part number are
    known, for example, when memory is soldered on the board.
    The latter form is useful when SDRAM nodes are created at runtime by
    boot firmware that doesn't have access to static part number information.
    
    Signed-off-by: Clément Le Goffic 
    Signed-off-by: Clément Le Goffic 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251118-b4-ddr-bindings-v9-2-a033ac5144da@gmail.com
    Signed-off-by: Krzysztof Kozlowski 

commit dffaa1beea9e7a0d902fc4e25e137afcf1297267
Author: Clément Le Goffic 
Date:   Tue Nov 18 16:07:57 2025 +0100

    dt-bindings: memory: factorise LPDDR props into SDRAM props
    
    LPDDR and DDR bindings are SDRAM types and are likely to share the same
    properties (at least for density, io-width and reg).
    To avoid bindings duplication, factorise the properties.
    
    The compatible description has been updated because the MR (Mode
    registers) used to get manufacturer ID and revision ID are not present
    in case of DDR.
    Those information should be in a SPD (Serial Presence Detect) EEPROM in
    case of DIMM module or are known in case of soldered memory chips as
    they are in the datasheet of the memory chips.
    
    Signed-off-by: Clément Le Goffic 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Clément Le Goffic 
    Link: https://patch.msgid.link/20251118-b4-ddr-bindings-v9-1-a033ac5144da@gmail.com
    Signed-off-by: Krzysztof Kozlowski 

commit 7a8447fc71a09000cee5a2372b6efde45735d2c8
Author: Johan Hovold 
Date:   Mon Dec 1 10:22:59 2025 +0100

    ASoC: codecs: wcd939x-sdw: use devres for regmap allocation
    
    Components are bound inside a new devres group so that any resources
    allocated can be released on bind failure and on unbind without
    affecting anything else.
    
    Switch to using device managed regmap allocation for consistency while
    dropping the misleading comment claiming that devres cannot be used.
    
    Cc: Neil Armstrong 
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251201092259.11761-1-johan@kernel.org
    Signed-off-by: Mark Brown 

commit 47d8cb678081d12704d52ed42b625e96f38470e0
Author: Rosen Penev 
Date:   Wed Dec 17 12:23:31 2025 -0800

    gpio: realtek-otto: use larger type for dev_flags
    
    Fix a build failure on 64-bit systems uncovered by enabling
    COMPILE_TEST:
    
    drivers/gpio/gpio-realtek-otto.c: In function ‘realtek_gpio_probe’:
    drivers/gpio/gpio-realtek-otto.c:375:21: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
      375 |         dev_flags = (unsigned int) device_get_match_data(dev);
          |                     ^
    
    Fixes: 3203d8f573af ("gpio: realtek-otto: add COMPILE_TEST")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512180532.2ykNwYAm-lkp@intel.com/
    Signed-off-by: Rosen Penev 
    Link: https://lore.kernel.org/r/20251217202331.9449-1-rosenp@gmail.com
    [Bartosz: tweaked commit message, changed the cast, added tags]
    Signed-off-by: Bartosz Golaszewski 

commit dab5825491f7b0ea92a09390f39df0a51100f12f
Author: Yonatan Nachum 
Date:   Wed Dec 10 13:06:14 2025 +0000

    RDMA/efa: Improve admin completion context state machine
    
    Add a new unused state to the admin completion contexts state machine
    instead of the occupied field. This improves the completion validity
    check because it now enforce the context to be in submitted state prior
    to completing it. Also add allocated state as a intermediate state
    between unused and submitted.
    
    Reviewed-by: Daniel Kranzdorf 
    Reviewed-by: Michael Margolin 
    Signed-off-by: Yonatan Nachum 
    Link: https://patch.msgid.link/20251210130614.36460-3-ynachum@amazon.com
    Signed-off-by: Leon Romanovsky 

commit 4b01ec0f133b3fe1038dc538d6bfcbd72462d2f0
Author: Yonatan Nachum 
Date:   Wed Dec 10 13:06:13 2025 +0000

    RDMA/efa: Check stored completion CTX command ID with received one
    
    In admin command completion, we receive a CQE with the command ID which
    is constructed from context index and entropy bits from the admin queue
    producer counter. To try to detect memory corruptions in the received
    CQE, validate the full command ID of the fetched context with the CQE
    command ID. If there is a mismatch, complete the CQE with error.
    Also use LSBs of the admin queue producer counter to better detect
    entropy mismatch between smaller number of commands.
    
    Reviewed-by: Daniel Kranzdorf 
    Reviewed-by: Michael Margolin 
    Signed-off-by: Yonatan Nachum 
    Link: https://patch.msgid.link/20251210130614.36460-2-ynachum@amazon.com
    Signed-off-by: Leon Romanovsky 

commit 69f155531baa9c6125aa3b911b3ca820f9108a36
Author: Jingyi Wang 
Date:   Mon Dec 15 01:07:22 2025 -0800

    arm64: defconfig: enable clocks, interconnect and pinctrl for Qualcomm Kaanapali
    
    Enable necessary drivers for booting Qualcomm Kaanapali QRD and MTP
    boards. The serial engine must be properly setup before kernel reach
    "init", so UART driver and its dependencies needs to be built in, enable
    its dependency GCC, interconnect and pinctrl as built-in meanwhile enable
    TCSRCC as module.
    
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Jingyi Wang 
    Link: https://lore.kernel.org/r/20251215-knp-dts-v4-2-1541bebeb89f@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 0e31dcfefd21ed76ff1b2d05647cd34336ab9772
Author: Jingyi Wang 
Date:   Mon Dec 15 01:07:25 2025 -0800

    arm64: dts: qcom: kaanapali: Add base QRD board
    
    Add initial support for Qualcomm Kaanapali QRD board which enables
    SD Card, UFS and booting to shell with UART console.
    
    Written with help from Jishnu Prakash (added RPMhPD nodes), Nitin Rawat
    (added ufs) and Manish Pandey (added SD Card).
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Abel Vesa 
    Link: https://lore.kernel.org/r/20251215-knp-dts-v4-5-1541bebeb89f@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 1cc3a0a0210697a25e96783cf21f93d28a09ebf7
Author: Jingyi Wang 
Date:   Mon Dec 15 01:07:24 2025 -0800

    arm64: dts: qcom: kaanapali: Add base MTP board
    
    Add initial support for Qualcomm Kaanapali MTP board which enables PCIe,
    SD Card, UFS and booting to shell with UART console.
    
    Written with help from Jishnu Prakash (added RPMhPD nodes), Nitin Rawat
    (added UFS), Manish Pandey (added SD Card) and Qiang Yu (added PCIe).
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Abel Vesa 
    Link: https://lore.kernel.org/r/20251215-knp-dts-v4-4-1541bebeb89f@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 2eeb5767d53f457913d2b378a3bd9e2269a4098d
Author: Jingyi Wang 
Date:   Mon Dec 15 01:07:23 2025 -0800

    arm64: dts: qcom: Introduce Kaanapali SoC
    
    Kaanapali is Snapdragon SoC from Qualcomm.
    
    Features added in this patch:
    - CPUs with PSCI idle states and cpufreq
    - Interrupt-controller with PDC wakeup support
    - Timers, TCSR Clock Controllers
    - Reserved Shared memory
    - GCC and RPMHCC
    - TLMM
    - Interconnect with CPU BWMONs
    - QuP with UART
    - SMMU
    - RPMhPD
    - UFS with Inline Crypto Engine
    - LLCC
    - Watchdog
    - SD Card
    - PCIe
    
    Written with help from Raviteja Laggyshetty (added interconnect nodes),
    Taniya Das (added Clock Controllers and cpufreq), Jishnu Prakash
    (added RPMhPD), Nitin Rawat (added UFS), Gaurav Kashyap (added ICE),
    Manish Pandey (added SD Card) and Qiang Yu (added PCIe).
    
    Co-developed-by: Tengfei Fan 
    Signed-off-by: Tengfei Fan 
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251215-knp-dts-v4-3-1541bebeb89f@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 80351761facb63d6fab1e42c77d7565047bc10ad
Author: Jiapeng Chong 
Date:   Thu Dec 4 17:24:13 2025 +0800

    RDMA/irdma: Simplify bool conversion
    
    ./drivers/infiniband/hw/irdma/ctrl.c:5792:10-15: WARNING: conversion to bool not needed here.
    ./drivers/infiniband/hw/irdma/uk.c:1412:6-11: WARNING: conversion to bool not needed here.
    
    Reported-by: Abaci Robot 
    Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=27521
    Signed-off-by: Jiapeng Chong 
    Link: https://patch.msgid.link/20251204092414.1261795-1-jiapeng.chong@linux.alibaba.com
    Signed-off-by: Leon Romanovsky 

commit be4d4543f78074fbebd530ba5109d39a2a34e668
Author: Sudeep Holla 
Date:   Thu Dec 18 14:20:01 2025 +0000

    firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET
    
    The FF-A specification allows NOTIFICATION_INFO_GET to return either a
    64-bit (FFA_FN64_SUCCESS) or a 32-bit (FFA_SUCCESS) response, depending on
    whether the firmware chooses the SMC64 or SMC32 calling convention.
    
    The driver previously detected the response format by checking ret.a0, but
    still interpreted the returned ID lists (x3..x17 or w3..w7) as if they always
    followed the 64-bit SMC64 layout. In the SMC32 case, the upper 32 bits of
    each argument register are undefined by the calling convention, meaning the
    driver could read stale or garbage values when parsing notification IDs.
    
    This resulted in incorrectly decoded partition/VCPU IDs whenever the FF-A
    firmware used an SMC32 return path.
    
    Fix the issue by:
    
    - Introducing logic to map list indices to the correct u16 offsets,
      depending on whether the response width matches the kernel word size
      or is a 32-bit response on a 64-bit kernel.
    - Ensuring that the packed ID list is parsed using the proper layout,
      avoiding reads from undefined upper halves in the SMC32 case.
    
    With this change, NOTIFICATION_INFO_GET now correctly interprets ID list
    entries regardless of the response width, aligning the driver with the FF-A
    specification.
    
    Fixes: 3522be48d82b ("firmware: arm_ffa: Implement the NOTIFICATION_INFO_GET interface")
    Reported-by: Sourav Mohapatra 
    Message-Id: <20251218142001.2457111-1-sudeep.holla@arm.com>
    Signed-off-by: Sudeep Holla 

commit 4f32b6341818be62db1ea41ced68ca2f0cce5700
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:37 2025 +0100

    rtc: optee: Make use of tee bus methods
    
    The tee bus got dedicated callbacks for probe and remove. Make use of
    these. This fixes a runtime warning about the driver needing to be
    converted to the bus methods.
    
    Reviewed-by: Sumit Garg 
    Acked-by: Alexandre Belloni 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Jens Wiklander 

commit 6d8a0031d92d56f0cf57947df408d5cafd57bb22
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:36 2025 +0100

    rtc: optee: Migrate to use tee specific driver registration function
    
    The tee subsystem recently got a set of dedicated functions to register
    (and unregister) a tee driver. Make use of them. These care for setting the
    driver's bus (so the explicit assignment can be dropped) and the driver
    owner (which is an improvement this driver benefits from).
    
    Reviewed-by: Sumit Garg 
    Acked-by: Alexandre Belloni 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Jens Wiklander 

commit f48b5e8bc2e1344f588cc730082aed6ccc5a6b3e
Author: Stafford Horne 
Date:   Wed Dec 17 08:08:27 2025 +0000

    dt-bindings: gpio-mmio: Add compatible string for opencores,gpio
    
    In FPGA Development boards with GPIOs we use the opencores gpio verilog
    rtl.  This is compatible with the gpio-mmio.  Add the compatible string
    to allow as below.
    
    Example:
    
            gpio0: gpio@91000000 {
                    compatible = "opencores,gpio", "brcm,bcm6345-gpio";
                    reg = <0x91000000 0x1>, <0x91000001 0x1>;
                    reg-names = "dat", "dirout";
                    gpio-controller;
                    #gpio-cells = <2>;
                    status = "okay";
            };
    
    Link: https://opencores.org/projects/gpio
    Signed-off-by: Stafford Horne 
    Acked-by: Conor Dooley 
    Link: https://lore.kernel.org/r/20251217080843.70621-2-shorne@gmail.com
    Signed-off-by: Bartosz Golaszewski 

commit 6774a66d0e103d0e3e4c0f37dbd61946ec83edf0
Author: Bartosz Golaszewski 
Date:   Mon Dec 15 16:46:24 2025 +0100

    gpio: swnode: compare the "undefined" swnode by its address, not name
    
    We know the address of the underlying remote software node referenced by
    the GPIO property (if it is a software node). We don't need to compare
    its name, we can compare its address which is more precise anyway.
    
    Reviewed-by: Charles Keepax 
    Tested-by: Charles Keepax 
    Link: https://lore.kernel.org/r/20251215154624.67099-1-bartosz.golaszewski@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit b39ef93a2e5b5f4289a3486d8a94a09a1e6a4c67
Author: Alain Volmat 
Date:   Thu Dec 18 11:48:29 2025 +0100

    spi: stm32: perform small transfer in polling mode
    
    In case of interrupt based transfer, when the transfer is very
    small, relying on interrupts leads to lower performances than if
    the transfer were done using polling on the registers.
    
    Add a module parameter "polling_limit_us" to indicate the threshold
    in us from which a transfer would be done polling the registers rather
    than relying on interrupts.
    
    Signed-off-by: Alain Volmat 
    Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-3-3b69901ca9fe@foss.st.com
    Signed-off-by: Mark Brown 

commit 1ac3be217c01d5df55ec5052f81e4f1708f46552
Author: Deepak Kumar 
Date:   Thu Dec 18 11:48:28 2025 +0100

    spi: stm32: fix Overrun issue at < 8bpw
    
    When SPI communication is suspended by hardware automatically, it could
    happen that few bits of next frame are already clocked out due to
    internal synchronization delay.
    
    To achieve a safe suspension, we need to ensure that each word must be
    at least 8 SPI clock cycles long. That's why, if bpw is less than 8
    bits, we need to use midi to reach 8 SPI clock cycles at least.
    
    This will ensure that each word achieve safe suspension and prevent
    overrun condition.
    
    Signed-off-by: Deepak Kumar 
    Signed-off-by: Alain Volmat 
    Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com
    Signed-off-by: Mark Brown 

commit c266d19b7d4e5ed993ed9fca25ab9d11789c41ee
Author: Alain Volmat 
Date:   Thu Dec 18 11:48:27 2025 +0100

    spi: stm32: properly fail on dma_request_chan error
    
    Correct handling of the dma_request_chan call in order to avoid
    misleading warn message if no DMA is provided within the device-tree
    and moreover fail if dma_request_chan has returned a valid error.
    
    Signed-off-by: Alain Volmat 
    Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-1-3b69901ca9fe@foss.st.com
    Signed-off-by: Mark Brown 

commit 7009646d937f9a1147b401362260939bba52082f
Author: Jie Gan 
Date:   Tue Sep 2 12:21:43 2025 +0800

    dt-binding: Update oss email address for Coresight documents
    
    Update the OSS email addresses across all Coresight documents, as the
    previous addresses have been deprecated.
    
    Signed-off-by: Jie Gan 
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Suzuki K Poulose 
    Link: https://lore.kernel.org/r/20250902042143.1010-1-jie.gan@oss.qualcomm.com

commit a30a9cb9bca4296d25f253619883e7013b6be158
Author: Jan Remmet 
Date:   Tue Dec 16 08:39:35 2025 +0100

    gpio: pca953x: Add support for TCAL6408 TCAL6416
    
    TCAL6408 and TCAL6416 supports latchable inputs and maskable interrupt.
    Tested on a TCAL6416, checked datasheets for the TCAL6408.
    
    They use the same programming model ad the NXP PCAL64xx, but
    support a lower supply power (1.08V to 3.6V) compared to PCAL
    (1.65V to 5.5V)
    
    Datasheet: https://www.ti.com/lit/ds/symlink/tcal6408.pdf
    Datasheet: https://www.ti.com/lit/ds/symlink/tcal6416.pdf
    
    Signed-off-by: Jan Remmet 
    Link: https://lore.kernel.org/r/20251216-wip-jremmet-tcal6416rtw-v2-3-6516d98a9836@phytec.de
    Signed-off-by: Bartosz Golaszewski 

commit 9b5f506ff6c11e82574e7f6aa763c92ddb3afc57
Author: Jan Remmet 
Date:   Tue Dec 16 08:39:34 2025 +0100

    dt-bindings: gpio: gpio-pca95xx: Add tcal6408 and tcal6416
    
    TCAL6408 and TCAL6416 supports latchable inputs and maskable interrupt.
    add compatibles ti,tcal6408 and ti,tcal6416
    
    The TI variants has the same programming model as the NXP PCAL6408 and
    PCAL6416, but supports other supply voltages.
    
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Jan Remmet 
    Link: https://lore.kernel.org/r/20251216-wip-jremmet-tcal6416rtw-v2-2-6516d98a9836@phytec.de
    Signed-off-by: Bartosz Golaszewski 

commit d19c36134fe14647873af5569329489502c174b9
Author: Jan Remmet 
Date:   Tue Dec 16 08:39:33 2025 +0100

    Documentation: gpio: add TCAL6408 and TCAL6416
    
    Checked datasheets, the offsets are identical to pcal6408 and pcal6416.
    
    Signed-off-by: Jan Remmet 
    Link: https://lore.kernel.org/r/20251216-wip-jremmet-tcal6416rtw-v2-1-6516d98a9836@phytec.de
    Signed-off-by: Bartosz Golaszewski 

commit 281a226314238e8adb08d11b765347687ffb38b9
Author: gaoxiang17 
Date:   Thu Dec 18 14:28:53 2025 +0800

    dma-buf: add some tracepoints to debug.
    
    Since we can only inspect dmabuf by iterating over process FDs or the
    dmabuf_list, we need to add our own tracepoints to track its status in
    real time in production.
    
    For example:
       binder:3016_1-3102    [006] ...1.   255.126521: dma_buf_export: exp_name=qcom,system size=12685312 ino=2738
       binder:3016_1-3102    [006] ...1.   255.126528: dma_buf_fd: exp_name=qcom,system size=12685312 ino=2738 fd=8
       binder:3016_1-3102    [006] ...1.   255.126642: dma_buf_mmap_internal: exp_name=qcom,system size=28672 ino=2739
         kworker/6:1-86      [006] ...1.   255.127194: dma_buf_put: exp_name=qcom,system size=12685312 ino=2738
        RenderThread-9293    [006] ...1.   316.618179: dma_buf_get: exp_name=qcom,system size=12771328 ino=2762 fd=176
        RenderThread-9293    [006] ...1.   316.618195: dma_buf_dynamic_attach: exp_name=qcom,system size=12771328 ino=2762 attachment:ffffff880a18dd00 is_dynamic=0 dev_name=kgsl-3d0
        RenderThread-9293    [006] ...1.   318.878220: dma_buf_detach: exp_name=qcom,system size=12771328 ino=2762 attachment:ffffff880a18dd00 is_dynamic=0 dev_name=kgsl-3d0
    
    Signed-off-by: Xiang Gao 
    Reviewed-by: Christian König 
    Link: https://lore.kernel.org/r/20251218062853.819744-1-gxxa03070307@gmail.com
    Signed-off-by: Christian König 

commit b70886ff5833cf499e77af77d2324ce8f68b60ce
Author: Hans Verkuil 
Date:   Thu Jun 5 08:57:39 2025 +0200

    media: vb2: drop wait_prepare/finish callbacks
    
    Drop the wait_prepare/finish callbacks. Instead require that the vb2_queue
    lock field is always set and use that lock when waiting for buffers to
    arrive.
    
    Signed-off-by: Hans Verkuil 
    Signed-off-by: Mauro Carvalho Chehab 

commit d0730006dac2922bcd3cd16818516ddd3ffb7302
Author: Hans Verkuil 
Date:   Thu Jun 5 08:57:38 2025 +0200

    media: vb2: remove vb2_ops_wait_prepare/finish helpers
    
    Since vb2 now relies on the presence of the vb2_queue lock
    field and there are no more drivers that use these helpers, it is safe
    to drop them.
    
    Signed-off-by: Hans Verkuil 
    Signed-off-by: Mauro Carvalho Chehab 

commit cbb5cd440d06a87c2c8c5819c5ad5c2a73021687
Author: Hans Verkuil 
Date:   Thu Jun 5 08:57:37 2025 +0200

    media: dvb-core: dvb_vb2: drop wait_prepare/finish callbacks
    
    Since commit 88785982a19d ("media: vb2: use lock if wait_prepare/finish
    are NULL") it is no longer needed to set the wait_prepare/finish
    vb2_ops callbacks as long as the lock field in vb2_queue is set.
    
    Set the queue lock to &ctx->mutex, which makes it possible to drop
    the wait_prepare/finish callbacks.
    
    This simplifies the code and this is a step towards the goal of deleting
    these callbacks.
    
    Signed-off-by: Hans Verkuil 
    Signed-off-by: Mauro Carvalho Chehab 

commit 37fd4a0306b5309849274b03a6bf2020ed3af95c
Author: Hans Verkuil 
Date:   Thu Jun 5 08:57:36 2025 +0200

    media: dvb-core/dmxdev: drop locks around mmap()
    
    vb2 no longer requires locking around mmap since commit
    f035eb4e976e ("[media] videobuf2: fix lockdep warning").
    
    Since the streaming I/O mode for DVB support is by default off, and
    the dvb utilities were never updated with streaming support, and
    we never had regression tests for this streaming mode, this was
    never noticed before.
    
    Signed-off-by: Hans Verkuil 
    Signed-off-by: Mauro Carvalho Chehab 

commit c4e620eccbef76aa5564ebb295e23d6540e27215
Author: Hans Verkuil 
Date:   Thu Jun 5 08:57:35 2025 +0200

    media: dvb-core: dmxdevfilter must always flush bufs
    
    Currently the buffers are being filled until full, which works fine
    for the transport stream, but not when reading sections, those have
    to be returned to userspace immediately, otherwise dvbv5-scan will
    just wait forever.
    
    Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether
    the buffer must be flushed or wait until it is full.
    
    Signed-off-by: Hans Verkuil 
    Signed-off-by: Mauro Carvalho Chehab 

commit b440baf355912cc5d3664dcc5dac198d24ac1e56
Author: Loïc Molinari 
Date:   Wed Dec 17 18:24:04 2025 +0100

    drm/gem: Fix kerneldoc warnings
    
    Fix incorrect parameters in drm_gem_shmem_init() and missing " *" on
    empty lines in drm_gem_get_huge_mnt().
    
    Signed-off-by: Loïc Molinari 
    Fixes: 6e0b1b82017b ("drm/gem: Add huge tmpfs mountpoint helpers")
    Reported-by: Stephen Rothwell 
    Closes: https://lore.kernel.org/dri-devel/20251216115605.4babbce0@canb.auug.org.au/
    Reviewed-by: Boris Brezillon 
    Reviewed-by: Randy Dunlap 
    Tested-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251217172404.31216-1-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit c57079937bf8dff763ec90a01573b3a1918d959e
Author: Dan Carpenter 
Date:   Thu Dec 18 10:48:22 2025 +0300

    drm/panthor: unlock on error in panthor_ioctl_bo_create()
    
    Call drm_dev_exit() before returning -EINVAL.
    
    Fixes: cd2c9c3015e6 ("drm/panthor: Add flag to map GEM object Write-Back Cacheable")
    Signed-off-by: Dan Carpenter 
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/aUOxxvXXtHHfFCcg@stanley.mountain
    Signed-off-by: Boris Brezillon 

commit 0c8afa67aaa2d6cf523361f493d9b8224448ebea
Author: Juha-Pekka Heikkila 
Date:   Tue Dec 16 10:07:54 2025 +0200

    drm/i915: Add intel_gvt_driver_remove() onto error cleanup path
    
    Add intel_gvt_driver_remove() onto error cleanup path.
    
    Signed-off-by: Juha-Pekka Heikkila 
    Reviewed-by: Zhenyu Wang 
    Signed-off-by: Mika Kahola 
    Link: https://patch.msgid.link/20251216080754.221974-3-juhapekka.heikkila@gmail.com

commit 5e2e6b595d9d4ccd211ab19c0e47fcefdb29efe1
Author: Juha-Pekka Heikkila 
Date:   Tue Dec 16 10:07:53 2025 +0200

    drm/i915: switch to use kernel standard error injection
    
    Switch error injection testing from i915_inject_probe_failure
    to ALLOW_ERROR_INJECTION. Here taken out calls to
    i915_inject_probe_failure and changed to use
    ALLOW_ERROR_INJECTION for the same functions.
    
    Below functions are dropped from testing since I
    couldn't hit those at module bind time, testing
    these would just fail the tests. To include these
    in test would need to find way to cause resetting in i915
    which would trigger these:
    
    intel_gvt_init
    intel_wopcm_init
    intel_uc_fw_upload
    intel_gt_init with expected -EIO (-EINVAL is tested)
    lrc_init_wa_ctx
    intel_huc_auth
    guc_check_version_range
    intel_uc_fw_fetch
    uc_fw_xfer
    __intel_uc_reset_hw
    guc_enable_communication
    uc_init_wopcm
    ..and all stages of __force_fw_fetch_failures
    
    Signed-off-by: Juha-Pekka Heikkila 
    Reviewed-by: Jani Nikula 
    Signed-off-by: Mika Kahola 
    Link: https://patch.msgid.link/20251216080754.221974-2-juhapekka.heikkila@gmail.com

commit 65ccce35fa7a3b52713bd128fd211a80afc08abd
Merge: 8a3eb50d579c85 1303c2903889b0
Author: Mark Brown 
Date:   Thu Dec 18 09:53:54 2025 +0000

    spi: atcspi200: Add support for Andes ATCSPI200 SPI
    
    Merge series from CL Wang :
    
    This series adds support for the Andes ATCSPI200 SPI controller.

commit de2c5a1523fde38411b6259064258a0c0a3c896a
Author: John Stultz 
Date:   Fri Dec 5 01:35:11 2025 +0000

    test-ww_mutex: Allow test to be run (and re-run) from userland
    
    In cases where the ww_mutex test was occasionally tripping on
    hard to find issues, leaving qemu in a reboot loop was my best
    way to reproduce problems. These reboots however wasted time
    when I just wanted to run the test-ww_mutex logic.
    
    So tweak the test-ww_mutex test so that it can be re-triggered
    via a sysfs file, so the test can be run repeatedly without
    doing module loads or restarting.
    
    This has been particularly valuable to stressing and finding
    issues with the proxy-exec series.
    
    To use, run as root:
      echo 1 > /sys/kernel/test_ww_mutex/run_tests
    
    Signed-off-by: John Stultz 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251205013515.759030-4-jstultz@google.com

commit d327e7166efa24c69719890ea332b55a9dea21a7
Author: John Stultz 
Date:   Fri Dec 5 01:35:10 2025 +0000

    test-ww_mutex: Move work to its own UNBOUND workqueue
    
    The test-ww_mutex test already allocates its own workqueue
    so be sure to use it for the mtx.work and abba.work rather
    then the default system workqueue.
    
    This resolves numerous messages of the sort:
    "workqueue: test_abba_work hogged CPU... consider switching to WQ_UNBOUND"
    "workqueue: test_mutex_work hogged CPU... consider switching to WQ_UNBOUND"
    
    Signed-off-by: John Stultz 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251205013515.759030-3-jstultz@google.com

commit 34d80c93a5bbf38938e8c215ec6c938807edeaf0
Author: John Stultz 
Date:   Fri Dec 5 01:35:09 2025 +0000

    test-ww_mutex: Extend ww_mutex tests to test both classes of ww_mutexes
    
    Currently the test-ww_mutex tool only utilizes the wait-die
    class of ww_mutexes, and thus isn't very helpful in exercising
    the wait-wound class of ww_mutexes.
    
    So extend the test to exercise both classes of ww_mutexes for
    all of the subtests.
    
    Signed-off-by: John Stultz 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251205013515.759030-2-jstultz@google.com

commit fec2c3c01f1ca0cd2706941e78b9972e7f9474c0
Author: Tvrtko Ursulin 
Date:   Fri Dec 5 15:09:10 2025 +0000

    drm/syncobj: Convert syncobj idr to xarray
    
    IDR is deprecated and syncobj looks pretty trivial to convert so lets
    just do it.
    
    Signed-off-by: Tvrtko Ursulin 
    Cc: intel-xe@lists.freedesktop.org
    Reviewed-by: Matthew Brost 
    Signed-off-by: Tvrtko Ursulin 
    Link: https://lore.kernel.org/r/20251205150910.92913-1-tvrtko.ursulin@igalia.com

commit f994bb8f1c94726e0124356ccd31c3c23a8a69f4
Author: Shawn Lin 
Date:   Fri Dec 12 09:33:25 2025 +0800

    PCI: dw-rockchip: Change get_ltssm() to provide L1 Substates info
    
    Rename rockchip_pcie_get_ltssm() to rockchip_pcie_get_ltssm_reg() and add
    rockchip_pcie_get_ltssm() to get_ltssm() callback in order to show the
    proper L1 Substates. The PCIE_CLIENT_LTSSM_STATUS[5:0] register returns
    the same LTSSM layout as enum dw_pcie_ltssm. So the driver just need to
    convey L1 PM Substates by returning the proper value defined in
    pcie-designware.h.
    
      cat /sys/kernel/debug/dwc_pcie_a40000000.pcie/ltssm_status
      L1_2 (0x142)
    
    Signed-off-by: Shawn Lin 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/1765503205-22184-2-git-send-email-shawn.lin@rock-chips.com

commit 679ec639f29cbdaf36bd79bf3e98240fffa335ee
Author: Shawn Lin 
Date:   Fri Dec 12 09:33:24 2025 +0800

    PCI: dwc: Add L1 Substates context to ltssm_status of debugfs
    
    DWC core couldn't distinguish LTSSM state among L1.0, L1.1 and L1.2. But
    the vendor glue driver may implement additional logic to convey this
    information. So add two pseudo definitions for vendor glue drivers to
    translate their internal L1 Substates for debugfs to show.
    
    Signed-off-by: Shawn Lin 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/1765503205-22184-1-git-send-email-shawn.lin@rock-chips.com

commit 8a3eb50d579c852d3502334e7afa6da6efe0e578
Merge: 7f7b350e4a6544 29c8c00d9f9db5
Author: Mark Brown 
Date:   Thu Dec 18 08:22:00 2025 +0000

    Add support for NXP XSPI
    
    Merge series from Haibo Chen :
    
    XSPI is a flexible SPI host controller which supports up to
    2 external devices (2 CS). It support Single/Dual/Quad/Octal
    mode data transfer.
    
    The difference between XSPI and Flexspi is XSPI support
    multiple independent execution environments (EENVs) for HW
    virtualization with some limitations. Each EENV has its own
    interrupt and its own set of programming registers that exists
    in a specific offset range in the XSPI memory map.
    The main environment (EENV0) address space contains all of the
    registers for controlling EENV0 plus all of the general XSPI
    control and programming registers. The register mnemonics for
    the user environments (EENV1 to EENV4) have "_SUB_n" appended
    to the mnemonic for the corresponding main-environment register.
    
    Current driver based on EENV0, which means system already give
    EENV0 right to linux.
    
    This driver use SPI memory interface of the SPI framework to issue
    flash memory operations. Tested this driver with mtd_debug and
    UBIFS on NXP i.MX943 EVK board which has one MT35XU512ABA spi nor
    flash. NOw this driver has the following key features:
    - Support up to OCT DDR mode
    - Support AHB read
    - Support IP read and IP write
    - Support two CS

commit 3622dc47a4b13e0ec86358c7b54a0b33bfcaa03c
Author: HariKrishna Sagala 
Date:   Wed Dec 17 11:14:59 2025 +0530

    ASoC: codec: rt286: Use devm_request_threaded_irq to manage IRQ lifetime and fix smatch warning
    
    Replace manual "request_threaded_irq()" with the device managed
    "devm_request_threaded_irq" to manage the IRQ lifetime and also
    it removes the smatch reported warning.
    Remove the manual "free_irq()" in the "remove" function as free_irq
    is tied to device teardown.
    
    Signed-off-by: HariKrishna Sagala 
    Link: https://patch.msgid.link/20251217054458.38257-2-hariconscious@gmail.com
    Signed-off-by: Mark Brown 

commit 961f20faa4b950c449dc98fa95a056ef368a24fc
Author: Niranjan H Y 
Date:   Mon Dec 15 21:02:19 2025 +0530

    ASoC: tas2783A: read slave properties from acpi table
    
    Currently device is using hardcoded slave properties
    using the .read_prop callback from "struct sdw_slave_ops".
    This patch removes this and uses the sdw_slave_read_prop API
    to read the data directly from the ACPI table.
    
    Signed-off-by: Niranjan H Y 
    Reviewed-by: Charles Keepax 
    Link: https://patch.msgid.link/20251215153219.810-8-niranjan.hy@ti.com
    Signed-off-by: Mark Brown 

commit ca8f3611dcf85489cae315f4844cccf858bbe9b3
Author: Niranjan H Y 
Date:   Mon Dec 15 21:02:18 2025 +0530

    ASoC: tas2783A: use acpi initialisation table
    
    This patch adds support for parsing the initilisation
    data from ACPI table. This table is required to configure
    each device correctly so that correct channel's data is
    selected during playback.
    
    Signed-off-by: Niranjan H Y 
    Reviewed-by: Charles Keepax 
    Link: https://patch.msgid.link/20251215153219.810-7-niranjan.hy@ti.com
    Signed-off-by: Mark Brown 

commit a6b5629e131c76c4ab8f2036f09a05f976f7eb73
Author: Niranjan H Y 
Date:   Mon Dec 15 21:02:17 2025 +0530

    ASoc: tas2783A: acpi match for 4 channel for mtl
    
      Add changes to support 4 tas2783A devices on mtl platform.
    The supported unique IDs are updated to 9, a, c, d, where
    c and d are configured to play left channels and 9 and a
    are configured to play right channel.
    
    Signed-off-by: Niranjan H Y 
    Link: https://patch.msgid.link/20251215153219.810-6-niranjan.hy@ti.com
    Signed-off-by: Mark Brown 

commit 2bc4b4f77cb70df3ef05b80d0cb19edba17f04a6
Author: Niranjan H Y 
Date:   Mon Dec 15 21:02:16 2025 +0530

    ASoc: tas2783A: fw name based on system details
    
      The firmware file for tas2783A contains the device
    and algorithm settings. So the firmware files are unique
    for a system and driver should have the ability to
    distinctly identify and pick the right firmware.
    
    This commit adds the method to uniquely identify the
    firmware for a system based on the below format.
     --.bin
    
    * Subsystem is the PCI device subsystem-id
    * Link is the SoundWire link id on which the device recides.
    * Unique is the SoundWire slave unique id in the system.
    
    Signed-off-by: Niranjan H Y 
    Link: https://patch.msgid.link/20251215153219.810-5-niranjan.hy@ti.com
    Signed-off-by: Mark Brown 

commit ce65a90222e94eec1e5b7d0224b4d647af644cdc
Author: Niranjan H Y 
Date:   Mon Dec 15 21:02:15 2025 +0530

    ASoC: tas2783A: fix error log for calibration data
    
    Currently when the calibration is not found, it is wrongly
    logged as device is not found. Fix this error message to
    indicate that calibration data is not valid instead.
    
    Signed-off-by: Niranjan H Y 
    Link: https://patch.msgid.link/20251215153219.810-4-niranjan.hy@ti.com
    Signed-off-by: Mark Brown 

commit f8f1f0d8f0255d1e7c758dba9e3deb5a58a51aa1
Author: Niranjan H Y 
Date:   Mon Dec 15 21:02:14 2025 +0530

    ASoC: tas2783A: update default init writes
    
      Remove unwanted initialistaion writes to the
    device which will now be part of the either firmware
    or acpi table.
    
    Signed-off-by: Niranjan H Y 
    Link: https://patch.msgid.link/20251215153219.810-3-niranjan.hy@ti.com
    Signed-off-by: Mark Brown 

commit a3b0cd63f212686dd57eacd5d685ac259631248f
Author: Niranjan H Y 
Date:   Mon Dec 15 21:02:13 2025 +0530

    ASoC: tas2783A: use custom firmware
    
    Use the firmware version same as in Windows
    projects. The firmware contains algorithm
    parameters and some device configuration
    writes which are part of the same firmware file.
    
    Signed-off-by: Niranjan H Y 
    Link: https://patch.msgid.link/20251215153219.810-2-niranjan.hy@ti.com
    Signed-off-by: Mark Brown 

commit 5965df0670d9f4a092aa111a01c62a450e689c8a
Author: Niranjan H Y 
Date:   Mon Dec 15 21:02:12 2025 +0530

    ASoC: tas2783A: sdw_utils: support ch 3 & 4
    
     Currently the machine driver for tas2783A can only
    support 2 channels. This patch adds support for
    2 channel playback with 4 device setup.
    
    Signed-off-by: Niranjan H Y 
    Link: https://patch.msgid.link/20251215153219.810-1-niranjan.hy@ti.com
    Signed-off-by: Mark Brown 

commit 97cf6bc0abd381fd84e5d8e978322a62a58fb00e
Author: Atharv Dubey 
Date:   Mon Dec 1 20:57:58 2025 +0530

    rust: drm: use `pin_init::zeroed()` for file operations initialization
    
    Replace the manual `unsafe { core::mem::zeroed() }` initialization of
    `bindings::file_operations` with `pin_init::zeroed()`. This removes the
    explicit unsafe
    
    Signed-off-by: Atharv Dubey 
    Link: https://patch.msgid.link/20251201152759.16429-1-atharvd440@gmail.com
    Signed-off-by: Alice Ryhl 

commit 7f0cdcddf8bef1c8c18f9be6708073fd3790a20f
Author: Haotian Zhang 
Date:   Wed Nov 19 10:33:08 2025 +0800

    PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
    
    In mtk_pcie_init_irq_domain(), if mtk_pcie_allocate_msi_domains()
    fails after port->irq_domain has been successfully created via
    irq_domain_create_linear(), the function returns directly without
    cleaning up the allocated IRQ domain, resulting in a resource leak.
    
    Add irq_domain_remove() call in the error path to properly release the
    INTx IRQ domain before returning the error.
    
    Fixes: 43e6409db64d ("PCI: mediatek: Add MSI support for MT2712 and MT7622")
    Signed-off-by: Haotian Zhang 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251119023308.476-1-vulab@iscas.ac.cn

commit 4b361b1e92be255ff923453fe8db74086cc7cf66
Author: Siddharth Vadapalli 
Date:   Mon Nov 17 17:02:06 2025 +0530

    PCI: j721e: Add config guards for Cadence Host and Endpoint library APIs
    
    Commit under Fixes enabled loadable module support for the driver under
    the assumption that it shall be the sole user of the Cadence Host and
    Endpoint library APIs. This assumption guarantees that we won't end up
    in a case where the driver is built-in and the library support is built
    as a loadable module.
    
    With the introduction of [1], this assumption is no longer valid. The
    SG2042 driver could be built as a loadable module, implying that the
    Cadence Host library is also selected as a loadable module. However, the
    pci-j721e.c driver could be built-in as indicated by CONFIG_PCI_J721E=y
    due to which the Cadence Endpoint library is built-in. Despite the
    library drivers being built as specified by their respective consumers,
    since the 'pci-j721e.c' driver has references to the Cadence Host
    library APIs as well, we run into a build error as reported at [0].
    
    Fix this by adding config guards as a temporary workaround. The proper
    fix is to split the 'pci-j721e.c' driver into independent Host and
    Endpoint drivers as aligned at [2].
    
    [0]: https://lore.kernel.org/r/202511111705.MZ7ls8Hm-lkp@intel.com/
    [1]: commit 1c72774df028 ("PCI: sg2042: Add Sophgo SG2042 PCIe driver")
    [2]: https://lore.kernel.org/r/37f6f8ce-12b2-44ee-a94c-f21b29c98821@app.fastmail.com/
    
    Fixes: a2790bf81f0f ("PCI: j721e: Add support to build as a loadable module")
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202511111705.MZ7ls8Hm-lkp@intel.com/
    Suggested-by: Arnd Bergmann 
    Signed-off-by: Siddharth Vadapalli 
    Signed-off-by: Manivannan Sadhasivam 
    Reviewed-by: Arnd Bergmann 
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251117113246.1460644-1-s-vadapalli@ti.com

commit a625a898ea8f74ca0bb55c6e0c2fcff80edb1068
Author: Shankari Anand 
Date:   Sun Nov 23 14:54:32 2025 +0530

    rust: drm: Update AlwaysRefCounted imports to use sync::aref
    
    Update call sites to import `AlwaysRefCounted`
    from `sync::aref` instead of `types`.
    
    This aligns with the ongoing effort to move `ARef` and
    `AlwaysRefCounted` to sync.
    
    Suggested-by: Benno Lossin 
    Link: https://github.com/Rust-for-Linux/linux/issues/1173
    Signed-off-by: Shankari Anand 
    Link: https://patch.msgid.link/20251123092438.182251-5-shankari.ak0208@gmail.com
    Signed-off-by: Alice Ryhl 

commit 8592764933edc9c176e1904527e2190273b41bde
Author: Shankari Anand 
Date:   Sun Nov 23 14:54:30 2025 +0530

    drivers: gpu: Update ARef imports from sync::aref
    
    Update call sites to import `ARef` from `sync::aref`
    instead of `types`.
    
    This aligns with the ongoing effort to move `ARef` and
    `AlwaysRefCounted` to sync.
    
    Suggested-by: Benno Lossin 
    Link: https://github.com/Rust-for-Linux/linux/issues/1173
    Signed-off-by: Shankari Anand 
    Reviewed-by: Joel Fernandes 
    Acked-by: Alexandre Courbot 
    Link: https://patch.msgid.link/20251123092438.182251-3-shankari.ak0208@gmail.com
    [aliceryhl: keep trailing // at last import]
    Signed-off-by: Alice Ryhl 

commit 6a1394990902f0393706d7f96f58c21d88b65df7
Author: Qiang Yu 
Date:   Sun Nov 9 22:59:44 2025 -0800

    PCI: qcom: Remove DPC Extended Capability
    
    Some platforms (e.g., X1E80100) expose Downstream Port Containment (DPC)
    Extended Capability registers in the PCIe Root Port config space, but do
    not fully support it. To prevent undefined behavior and ensure DPC cap is
    not visible to PCI framework and users, remove DPC Extended Capability
    unconditionally, since there is no Qcom platform support DPC till now.
    
    Co-developed-by: Wenbin Yao 
    Signed-off-by: Wenbin Yao 
    Signed-off-by: Qiang Yu 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251109-remove_cap-v1-5-2208f46f4dc2@oss.qualcomm.com

commit 7c29cd0fdc07e5e21202fdeed0b63cba2b4f10c6
Author: Qiang Yu 
Date:   Sun Nov 9 22:59:43 2025 -0800

    PCI: qcom: Remove MSI-X Capability for Root Ports
    
    On some platforms like Glymur, the hardware does not support MSI-X in RC
    mode, yet still exposes the MSI-X capability. However, it omits the
    required MSI-X Table and PBA structures.
    
    This mismatch can lead to issues where the PCIe port driver requests MSI-X
    instead of MSI, causing the Root Port to trigger interrupts by writing to
    an uninitialized address, resulting in SMMU faults.
    
    To address this, remove MSI-X capability unconditionally for Root Ports of
    all SoCs as none of the Qcom PCIe Root Ports support MSI-X.
    
    Signed-off-by: Qiang Yu 
    [mani: updated description]
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251109-remove_cap-v1-4-2208f46f4dc2@oss.qualcomm.com

commit f5cd8a929c825ad4df3972df041ad62ad84ca6c9
Author: Qiang Yu 
Date:   Sun Nov 9 22:59:42 2025 -0800

    PCI: dwc: Remove MSI/MSIX capability for Root Port if iMSI-RX is used as MSI controller
    
    Some platforms may not support ITS (Interrupt Translation Service) and MBI
    (Message Based Interrupt), or there are not enough available empty SPI
    lines for MBI, in which case the msi-map and msi-parent property will not
    be provided in device tree node. For those cases, the DWC PCIe driver
    defaults to using the iMSI-RX module as MSI controller. However, due to
    DWC IP design, iMSI-RX cannot generate MSI interrupts for Root Ports even
    when MSI is properly configured and supported as iMSI-RX will only monitor
    and intercept incoming MSI TLPs from PCIe link, but the memory write
    generated by Root Port are internal system bus transactions instead of
    PCIe TLPs, so they are ignored.
    
    This leads to interrupts such as PME, AER from the Root Port not received
    on the host and the users have to resort to workarounds such as passing
    "pcie_pme=nomsi" cmdline parameter.
    
    To ensure reliable interrupt handling, remove MSI and MSI-X capabilities
    from Root Ports when using iMSI-RX as MSI controller, which is indicated
    by 'dw_pcie_rp::has_msi_ctrl == true'. This forces a fallback to INTx
    interrupts by default, eliminating the need for manual kernel command line
    workarounds.
    
    With this behavior:
    - Platforms with ITS/MBI support use ITS/MBI MSI for interrupts from all
      components.
    - Platforms without ITS/MBI support fall back to INTx for Root Ports and
      use iMSI-RX for other PCI devices.
    
    Signed-off-by: Qiang Yu 
    [mani: reworded the comment]
    Signed-off-by: Manivannan Sadhasivam 
    Tested-by: Brian Norris 
    Reviewed-by: Brian Norris 
    Link: https://patch.msgid.link/20251109-remove_cap-v1-3-2208f46f4dc2@oss.qualcomm.com

commit 0183562f1e824c0ca6c918309a0978e9a269af3e
Author: Qiang Yu 
Date:   Sun Nov 9 22:59:41 2025 -0800

    PCI: dwc: Add new APIs to remove standard and extended Capability
    
    On some platforms, certain PCIe Capabilities may be present in hardware
    but are not fully implemented as defined in PCIe spec. These incomplete
    capabilities should be hidden from the PCI framework to prevent unexpected
    behavior.
    
    Introduce two APIs to remove a specific PCIe Capability and Extended
    Capability by updating the previous capability's next offset field to skip
    over the unwanted capability. These APIs allow RC drivers to easily hide
    unsupported or partially implemented capabilities from software.
    
    Co-developed-by: Wenbin Yao 
    Signed-off-by: Wenbin Yao 
    Signed-off-by: Qiang Yu 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251109-remove_cap-v1-2-2208f46f4dc2@oss.qualcomm.com

commit a2582e05e39adf9ab82a02561cd6f70738540ae0
Author: Qiang Yu 
Date:   Sun Nov 9 22:59:40 2025 -0800

    PCI: Add preceding capability position support in PCI_FIND_NEXT_*_CAP macros
    
    Add support for finding the preceding capability position in PCI
    capability list by extending the capability finding macros with an
    additional parameter. This functionality is essential for modifying PCI
    capability list, as it provides the necessary information to update the
    "next" pointer of the predecessor capability when removing entries.
    
    Modify two macros to accept a new 'prev_ptr' parameter:
    - PCI_FIND_NEXT_CAP - Now accepts 'prev_ptr' parameter for standard
      capabilities
    - PCI_FIND_NEXT_EXT_CAP - Now accepts 'prev_ptr' parameter for extended
      capabilities
    
    When a capability is found, these macros:
    - Store the position of the preceding capability in *prev_ptr
      (if prev_ptr != NULL)
    - Maintain all existing functionality when prev_ptr is NULL
    
    Update current callers to accommodate this API change by passing NULL to
    'prev_ptr' argument if they do not care about the preceding capability
    position.
    
    No functional changes to driver behavior result from this commit as it
    maintains the existing capability finding functionality while adding the
    infrastructure for future capability removal operations.
    
    Signed-off-by: Qiang Yu 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251109-remove_cap-v1-1-2208f46f4dc2@oss.qualcomm.com

commit 57833f84f6f5967134c9c1119289f7acdd1c93e9
Author: Nathan Chancellor 
Date:   Tue Oct 14 11:20:27 2025 -0700

    PCI: rcar-host: Add OF Kconfig dependency to avoid objtool no-cfi warning
    
    After commit 894af4a1cde6 ("objtool: Validate kCFI calls"), compile
    testing pcie-rcar-host.c with CONFIG_FINEIBT=y and CONFIG_OF=n results
    in a no-cfi objtool warning in rcar_pcie_probe():
    
      $ cat allno.config
      CONFIG_CFI=y
      CONFIG_COMPILE_TEST=y
      CONFIG_CPU_MITIGATIONS=y
      CONFIG_GENERIC_PHY=y
      CONFIG_MITIGATION_RETPOLINE=y
      CONFIG_MODULES=y
      CONFIG_PCI=y
      CONFIG_PCI_MSI=y
      CONFIG_PCIE_RCAR_HOST=y
      CONFIG_X86_KERNEL_IBT=y
    
      $ make -skj"$(nproc)" ARCH=x86_64 KCONFIG_ALLCONFIG=1 LLVM=1 clean allnoconfig vmlinux
      vmlinux.o: warning: objtool: rcar_pcie_probe+0x191: no-cfi indirect call!
    
    When CONFIG_OF is unset, of_device_get_match_data() returns NULL, so
    LLVM knows this indirect call has no valid destination and drops the
    kCFI setup before the call, triggering the objtool check that makes sure
    all indirect calls have kCFI setup.
    
    This driver depends on OF for probing with non-NULL data for every match
    so this call will never be NULL in practice. Add a hard Kconfig
    dependency on OF to avoid the warning.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202510092124.O2IX0Jek-lkp@intel.com/
    Closes: https://github.com/ClangBuiltLinux/linux/issues/2134
    Signed-off-by: Nathan Chancellor 
    Signed-off-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251014-rcar_pcie_probe-avoid-nocfi-objtool-warning-v2-1-6e0204b002c6@kernel.org

commit 5bf763e908bf795da4ad538d21c1ec41f8021f76
Author: Ashutosh Dixit 
Date:   Thu Dec 11 22:18:50 2025 -0800

    drm/xe/eustall: Disallow 0 EU stall property values
    
    An EU stall property value of 0 is invalid and will cause a NPD.
    
    Reported-by: Peter Senna Tschudin 
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6453
    Fixes: 1537ec85ebd7 ("drm/xe/uapi: Introduce API for EU stall sampling")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Harish Chegondi 
    Link: https://patch.msgid.link/20251212061850.1565459-4-ashutosh.dixit@intel.com

commit 7a100e6ddcc47c1f6ba7a19402de86ce24790621
Author: Ashutosh Dixit 
Date:   Thu Dec 11 22:18:49 2025 -0800

    drm/xe/oa: Disallow 0 OA property values
    
    An OA property value of 0 is invalid and will cause a NPD.
    
    Reported-by: Peter Senna Tschudin 
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6452
    Fixes: cc4e6994d5a2 ("drm/xe/oa: Move functions up so they can be reused for config ioctl")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Harish Chegondi 
    Link: https://patch.msgid.link/20251212061850.1565459-3-ashutosh.dixit@intel.com

commit 97e16068d77a036908f69aba35486b21dee17a40
Author: Ashutosh Dixit 
Date:   Thu Dec 11 22:18:48 2025 -0800

    drm/xe/oa: Move default oa unit assignment earlier during stream open
    
    De-referencing param.oa_unit, when an OA unit id is not provided during
    stream open, results in NPD below.
    
      Oops: general protection fault, probably for non-canonical address...
      KASAN: null-ptr-deref in range...
      RIP: 0010:xe_oa_stream_open_ioctl+0x169/0x38a0
       xe_observation_ioctl+0x19f/0x270
       drm_ioctl_kernel+0x1f4/0x410
    
    Fix this by moving default oa unit assignment before the dereference.
    
    Reported-by: Peter Senna Tschudin 
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6840
    Fixes: c7e269aa565f ("drm/xe/oa: Allow exec_queue's to be specified only for OAG OA unit")
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Harish Chegondi 
    Link: https://patch.msgid.link/20251212061850.1565459-2-ashutosh.dixit@intel.com

commit 6c4bbcdad042b876c8e480ed75121756b1acfde7
Author: Jingyi Wang 
Date:   Sun Nov 23 23:31:54 2025 -0800

    dt-bindings: sram: Document qcom,kaanapali-imem and its child node
    
    On Qualcomm Kaanapali platform, IMEM is a block of SRAM shared across
    multiple IP blocks which can falk back to "mmio-sram". Documnent it and
    its child node "qcom,pil-reloc-info" which is used for collecting
    remoteproc ramdumps.
    
    Signed-off-by: Jingyi Wang 
    Acked-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251123-knp-soc-binding-v4-1-42b349a66c59@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 5422fad3e1cc2293cb3549f8ec02013ea50a9c80
Author: Jingyi Wang 
Date:   Tue Oct 21 23:00:26 2025 -0700

    dt-bindings: interrupt-controller: qcom,pdc: Document Kaanapali Power Domain Controller
    
    Add a compatible for the Power Domain Controller on Kaanapali platforms.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251021-knp-pdc-v2-1-a38767f5bb8e@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e36c38c91f5f3c07e65c58a0143e3124754a9030
Author: Sibi Sankar 
Date:   Fri Oct 31 00:41:46 2025 -0700

    arm64: dts: qcom: glymur: Add header file for IPCC physical client IDs
    
    Physical client IDs are used on Glymur Inter Process Communication
    Controller (IPCC), add a corresponding header file.
    
    Signed-off-by: Sibi Sankar 
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251031-knp-ipcc-v3-3-62ffb4168dff@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit f4a269eb1328d855314c858b5e903eca92ca3b36
Author: Jingyi Wang 
Date:   Fri Oct 31 00:41:45 2025 -0700

    arm64: dts: qcom: kaanapali: Add header file for IPCC physical client IDs
    
    On earlier platforms, Inter Process Communication Controller (IPCC) used
    virtual client IDs and performed virtual-to-physical mapping in hardware,
    so the IDs defined in dt-bindings/mailbox/qcom-ipcc.h are common across
    platforms. Physical client IDs instead of virtual client IDs are used for
    qcom new platforms like Kaanapali, which will be parsed by the devicetree
    and passed to hardware to use Physical client IDs directly. Since physical
    client IDs could vary across platforms, add a corresponding header file
    for the Kaanapali platform.
    
    Signed-off-by: Jingyi Wang 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251031-knp-ipcc-v3-2-62ffb4168dff@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 725ba2d0e0b9ac1f0bc0c0c166db03201feaa203
Author: Jingyi Wang 
Date:   Mon Dec 15 01:07:21 2025 -0800

    dt-bindings: arm: qcom: Document Kaanapali SoC and its reference boards
    
    Document the Kaanapali SoC binding and the boards which use it.
    
    Acked-by: Krzysztof Kozlowski 
    Signed-off-by: Jingyi Wang 
    Link: https://lore.kernel.org/r/20251215-knp-dts-v4-1-1541bebeb89f@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit d1919c375f211a2aeef898496b6f3efbefebf7f5
Author: Taniya Das 
Date:   Tue Dec 9 14:19:27 2025 +0530

    clk: qcom: Add support for Global clock controller on Kaanapali
    
    Add support for Global clock controller for Kaanapali Qualcomm SoC.
    
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20251209-gcc_kaanapali-v3-v5-4-3af118262289@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit e5682c953f5a9fbaad060ea000beff80f11c4048
Author: Taniya Das 
Date:   Tue Dec 9 14:19:26 2025 +0530

    clk: qcom: Add TCSR clock driver for Kaanapali
    
    Add the TCSR clock controller that provides the refclks on Kaanapali
    platform for PCIe, USB and UFS subsystems.
    
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Abel Vesa 
    Signed-off-by: Taniya Das 
    Link: https://lore.kernel.org/r/20251209-gcc_kaanapali-v3-v5-3-3af118262289@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit acabfd13859dfa343aa5289f7c2d55fddbaf346f
Author: Taniya Das 
Date:   Tue Dec 9 14:19:25 2025 +0530

    clk: qcom: rpmh: Add support for Kaanapali rpmh clocks
    
    Add the RPMH clocks present in Kaanapali SoC.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Taniya Das 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251209-gcc_kaanapali-v3-v5-2-3af118262289@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 3dadc1dc5e85cefc7a2f1c9d428b5622fda12d3d
Author: Taniya Das 
Date:   Tue Dec 9 14:19:24 2025 +0530

    clk: qcom: rpmh: Update the clock suffix for Glymur
    
    The current RPMh VRM clock definitions do not accurately represent the
    hardware mapping of these clocks. While there is no functional impact,
    this update aligns the definitions with the hardware convention by adding
    the appropriate suffix to indicate the clock divider and the E0 variant
    for the C3A_E0, C4A_E0, C5A_E0, and C8A_E0 resources on Glymur.
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Taniya Das 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251209-gcc_kaanapali-v3-v5-1-3af118262289@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 487524c891d3cc21eb6d243c2885273c5b142b44
Author: Daniele Ceraolo Spurio 
Date:   Tue Dec 16 22:48:59 2025 +0100

    drm/xe/pf: Add handling for MLRC adverse event threshold
    
    Since it is illegal to register a MLRC context when scheduler groups are
    enabled, the GuC consider the VF doing so as an adverse event. Like for
    other adverse event, there is a threshold for how many times the event
    can happen before the GuC throws an error, which we need to add support
    for.
    
    Signed-off-by: Daniele Ceraolo Spurio 
    Cc: Michal Wajdeczko 
    Reviewed-by: Michal Wajdeczko 
    Signed-off-by: Michal Wajdeczko 
    Acked-by: Matthew Brost 
    Link: https://patch.msgid.link/20251216214902.1429-5-michal.wajdeczko@intel.com

commit 4cffecaf127ae10ada4da0636f87e0170e347402
Author: Michal Wajdeczko 
Date:   Tue Dec 16 22:48:58 2025 +0100

    drm/xe/pf: Prepare for new threshold KLVs
    
    We want to extend our macro-based KLV list definitions with new
    information about the version from which given KLV is supported.
    Prepare our code generators to emit dedicated version check if
    a KLV was defined with the version information.
    
    Signed-off-by: Michal Wajdeczko 
    Cc: Daniele Ceraolo Spurio 
    Reviewed-by: Daniele Ceraolo Spurio 
    Acked-by: Matthew Brost 
    Link: https://patch.msgid.link/20251216214902.1429-4-michal.wajdeczko@intel.com

commit 09af64eba63ece2d928295e61ab1d56ae264447c
Author: Michal Wajdeczko 
Date:   Tue Dec 16 22:48:57 2025 +0100

    drm/xe/guc: Introduce GUC_FIRMWARE_VER_AT_LEAST helper
    
    There are already few places in the code where we need to check GuC
    firmware version. Wrap existing raw conditions into a named helper
    macro to make it clear and avoid explicit call of the MAKE_GUC_VER.
    
    Suggested-by: Daniele Ceraolo Spurio 
    Signed-off-by: Michal Wajdeczko 
    Cc: Daniele Ceraolo Spurio 
    Cc: Matthew Brost 
    Reviewed-by: Daniele Ceraolo Spurio 
    Acked-by: Matthew Brost 
    Link: https://patch.msgid.link/20251216214902.1429-3-michal.wajdeczko@intel.com

commit ce5971773651ad5c7e26aea29d72ea8887428774
Author: Michal Wajdeczko 
Date:   Wed Dec 17 23:40:18 2025 +0100

    drm/xe: Introduce IF_ARGS macro utility
    
    We want to extend our macro-based KLV list definitions with new
    information about the version from which given KLV is supported.
    Add utility IF_ARGS macro that can be used in code generators to
    emit different code based on the presence of additional arguments.
    
    Introduce macro itself and extend our kunit tests to cover it.
    We will use this macro in next patch.
    
    Signed-off-by: Michal Wajdeczko 
    Reviewed-by: Daniele Ceraolo Spurio 
    Acked-by: Matthew Brost 
    Link: https://patch.msgid.link/20251217224018.3490-1-michal.wajdeczko@intel.com

commit 2f9405aaa4297f95b42c39779e24f74587a0b6bc
Author: Tapani Pälli 
Date:   Wed Dec 17 15:24:12 2025 +0200

    drm/xe: Fix NULL pointer dereference in xe_exec_ioctl
    
    Helper function xe_sync_needs_wait expects sync->fence when accessing
    flags, patch makes sure we call only when sync->fence exists.
    
    v2: move null checking to xe_sync_needs_wait and make
        xe_sync_entry_wait utilize this helper (Matthew Auld)
    v3: further simplify code (Matthew Auld)
    
    Fixes NULL pointer dereference seen with Vulkan workloads:
    
    [  118.410401] RIP: 0010:xe_sync_needs_wait+0x27/0x50 [xe]
    
    Fixes: 4ac9048d0501 ("drm/xe: Wait on in-syncs when swicthing to dma-fence mode")
    Signed-off-by: Tapani Pälli 
    Reviewed-by: Matthew Auld 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251217132412.435755-1-tapani.palli@intel.com

commit a84a1e21c0678032f1185173f816cbb500a87877
Author: Daniel Baluta 
Date:   Wed Dec 10 17:49:06 2025 +0200

    remoteproc: imx_dsp_rproc: Fix multiple start/stop operations
    
    After commit 67a7bc7f0358 ("remoteproc: Use of reserved_mem_region_*
    functions for "memory-region"") following commands with
    imx-dsp-rproc started to fail:
    
    $ echo zephyr.elf > /sys/class/remoteproc/remoteproc0/firmware
    $ echo start > /sys/class/remoteproc/remoteproc0/state
    $ echo stop > /sys/class/remoteproc/remoteproc0/state
    $ echo start > /sys/class/remoteproc/remoteproc0/state #! This fails
    -sh: echo: write error: Device or resource busy
    
    This happens because aforementioned commit replaced devm_ioremap_wc with
    devm_ioremap_resource_wc which will "reserve" the memory region with the
    first start and then will fail at the second start if the memory
    region is already reserved.
    
    Even partially reverting the faulty commit won't fix the
    underlying issue because we map the address in prepare() but we never
    unmap it at unprepare(), so we will keep leaking memory regions.
    
    So, lets use alloc() and release() callbacks for memory carveout
    handling. This will nicely map() the memory region at prepare() time
    and unmap() it at unprepare().
    
    Fixes: 67a7bc7f0358 ("remoteproc: Use of_reserved_mem_region_* functions for "memory-region"")
    Signed-off-by: Daniel Baluta 
    Link: https://lore.kernel.org/r/20251210154906.99210-1-daniel.baluta@nxp.com
    Signed-off-by: Mathieu Poirier 

commit 41ca2155d62b0b0d217f59e1bce18362d0c2446f
Author: Qiuxu Zhuo 
Date:   Mon Nov 24 14:54:56 2025 +0800

    EDAC/igen6: Add two Intel Amston Lake SoCs support
    
    Intel Amston Lake SoCs with IBECC (In-Band ECC) capability share the same
    IBECC registers as Alder Lake-N SoCs. Add two new compute die IDs for
    Amston Lake SoC products to enable EDAC support.
    
    Signed-off-by: Qiuxu Zhuo 
    Signed-off-by: Tony Luck 
    Tested-by: Jianfeng Gao 
    Link: https://patch.msgid.link/20251124065457.3630949-2-qiuxu.zhuo@intel.com

commit 72f12683611344853ab030fe7d19b23970ed2bd8
Author: Dan Carpenter 
Date:   Tue Dec 9 17:37:04 2025 +0300

    EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
    
    The snprintf() can't really overflow because we're writing a max of 42
    bytes to a PAGE_SIZE buffer.  But my static checker complains because
    the limit calculation doesn't take the first 11 space characters that
    we wrote into the buffer into consideration.  Fix this for the sake of
    correctness even though it doesn't affect runtime.
    
    Also delete an earlier "space -= n;" which was not used.
    
    Fixes: 68d086f89b80 ("i5400_edac: improve debug messages to better represent the filled memory")
    Signed-off-by: Dan Carpenter 
    Signed-off-by: Tony Luck 
    Reviewed-by: Qiuxu Zhuo 
    Link: https://patch.msgid.link/ccd06b91748e7ed8e33eeb2ff1e7b98700879304.1765290801.git.dan.carpenter@linaro.org

commit 7b5c7e83ac405ff9ecbdd92b37a477f4288f8814
Author: Dan Carpenter 
Date:   Tue Dec 9 17:36:59 2025 +0300

    EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
    
    The snprintf() can't really overflow because we're writing a max of 42
    bytes to a PAGE_SIZE buffer.  But the limit calculation doesn't take
    the first 11 bytes that we wrote into consideration so the limit is
    not correct.  Just fix it for correctness even though it doesn't
    affect runtime.
    
    Fixes: 64e1fdaf55d6 ("i5000_edac: Fix the logic that retrieves memory information")
    Signed-off-by: Dan Carpenter 
    Signed-off-by: Tony Luck 
    Reviewed-by: Qiuxu Zhuo 
    Link: https://patch.msgid.link/07cd652c51e77aad5a8350e1a7cd9407e5bbe373.1765290801.git.dan.carpenter@linaro.org

commit 71e47245f89502dafb5d944a571ccb5144a52645
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:33 2025 +0100

    tee: Adapt documentation to cover recent additions
    
    The previous commits introduced some helpers to reduce boilerplate
    and bus specific callbacks for probe and remove.
    
    Adapt the reference example to make use of these.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Jens Wiklander 

commit 71a33465726e4125f5ef33705ce5bc7ec1bf5b1f
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:32 2025 +0100

    tee: Add probe, remove and shutdown bus callbacks to tee_client_driver
    
    Introduce a bus specific probe, remove and shutdown function. For now
    this only allows to get rid of a cast of the generic device to a
    tee_client device in the drivers and changes the remove prototype to
    return void---a non-zero return value is ignored anyhow.
    
    The objective is to get rid of users of struct device_driver callbacks
    .probe(), .remove() and .shutdown() to eventually remove these. Until
    all tee_client drivers are converted this results in a runtime warning
    about the drivers needing an update because there is a bus probe
    function and a driver probe function.
    
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Sumit Garg 
    Signed-off-by: Jens Wiklander 

commit a707eda330b932bcf698be9460e54e2f389e24b7
Author: Uwe Kleine-König 
Date:   Mon Dec 15 15:16:31 2025 +0100

    tee: Add some helpers to reduce boilerplate for tee client drivers
    
    Similar to platform drivers (and others) create dedicated register and
    unregister functions and a macro to simplify modules that only need to
    handle driver registration in their init and exit handlers.
    
    Reviewed-by: Sumit Garg 
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Jens Wiklander 

commit 962cdb95b6753c9ef19f2163809091e8baa9085f
Author: Marko Turk 
Date:   Wed Dec 10 12:25:35 2025 +0100

    rust: pci: document Bar's endianness conversion
    
    Document that the Bar's MMIO backend always assumes little-endian
    devices and that its operations automatically convert to CPU endianness.
    
    Signed-off-by: Marko Turk 
    Link: https://lore.kernel.org/lkml/DE7F6RR1NAKW.3DJYO44O73941@kernel.org/
    Link: https://patch.msgid.link/20251210112503.62925-1-mt@markoturk.info
    [ Drop unrelated spelling fix. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit 2a28b5240f2b328495c6565d277f438dbc583d61
Author: Peter Ujfalusi 
Date:   Wed Dec 17 16:39:45 2025 +0200

    ASoC: SOF: ipc4-control: Add support for generic bytes control
    
    The generic byte control can be used in cases when the bytes data can be
    changed by the firmware and it sends a notification about the change,
    similarly to the enum and switch controls.
    
    The generic control support is needed as from the param_id itself it is
    not possible to know which control has changed. The needed information
    is only available via generic control change notification.
    
    Generic bytes controls use param_id 202 and their change notification can
    contain payload with the change embedded or just the header message as
    notification.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Seppo Ingalsuo 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Link: https://patch.msgid.link/20251217143945.2667-9-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 7fd8c216c422c5d42addc3e46d5d26630ff646d1
Author: Peter Ujfalusi 
Date:   Wed Dec 17 16:39:44 2025 +0200

    ASoC: SOF: ipc4: Add definition for generic bytes control
    
    Currently IPC4 only supports module specific custom bytes controls, where
    each control's param_id is module specific.
    These bytes controls cannot be handled in a generic way, there is no clean
    way to support for example notifications from firmware when their data
    has been changed.
    
    Add definition for generic bytes control which should be handled in a
    similar way as the enum/switch controls.
    
    The generic param id for BYTES is selected to be 202
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Seppo Ingalsuo 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Link: https://patch.msgid.link/20251217143945.2667-8-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit d96cb0b86d6e8bbbbfa425771606f6c1aebc318e
Author: Peter Ujfalusi 
Date:   Wed Dec 17 16:39:43 2025 +0200

    ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET
    
    There are message types when we would need to send a payload along with
    the LARGE_CONFIG_GET message to provide information to the firmware on
    what data is requested.
    Such cases are the ALSA Kcontrol related messages when the high level
    param_id tells only the type of the control, but the ID/index of the exact
    control is specified in the payload area.
    
    The caller must place the payload for TX before calling the set_get_data()
    and this payload will be sent alongside with the message to the firmware.
    
    The data area will be overwritten by the received data from firmware.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Seppo Ingalsuo 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Link: https://patch.msgid.link/20251217143945.2667-7-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 2fdde18a2cb1631c01e4ab87d949564c7d134dd8
Author: Peter Ujfalusi 
Date:   Wed Dec 17 16:39:42 2025 +0200

    ASoC: SOF: ipc4-topology: Set initial param_id for bytes control type
    
    Set the param_id in extension based on the information we got from the
    topology.
    If the payload did not present then the param_id will remain 0.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Seppo Ingalsuo 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Link: https://patch.msgid.link/20251217143945.2667-6-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit ebcfdbe4add923dfb690e6fb9d158da87ae0b6bf
Author: Peter Ujfalusi 
Date:   Wed Dec 17 16:39:41 2025 +0200

    ASoC: SOF: ipc4-control: Keep the payload size up to date
    
    When the bytes data is read from the firmware, the size of the payload
    can be different than what it was previously.
    For example when the topology did not contained payload data at all for the
    control, the data size was 0.
    For get operation allow maximum size of payload to be read and then update
    the sizes according to the completed message.
    
    Similarly, keep the size in sync when updating the data in firmware.
    
    With the change we will be able to read data from firmware for bytes
    controls which did not had initial payload defined in topology.
    
    Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put")
    Cc: stable@vger.kernel.org
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Seppo Ingalsuo 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Link: https://patch.msgid.link/20251217143945.2667-5-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit c1876fc33c5976837e4c73719c7582617efc6919
Author: Peter Ujfalusi 
Date:   Wed Dec 17 16:39:40 2025 +0200

    ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data
    
    The size of the data behind scontrol->ipc_control_data is stored in
    scontrol->size, use this when copying data for backup/restore.
    
    Fixes: db38d86d0c54 ("ASoC: sof: Improve sof_ipc4_bytes_ext_put function")
    Cc: stable@vger.kernel.org
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Seppo Ingalsuo 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Link: https://patch.msgid.link/20251217143945.2667-4-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit a653820700b81c9e6f05ac23b7969ecec1a18e85
Author: Peter Ujfalusi 
Date:   Wed Dec 17 16:39:39 2025 +0200

    ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls
    
    The size of the data behind of scontrol->ipc_control_data for bytes
    controls is:
    [1] sizeof(struct sof_ipc4_control_data) + // kernel only struct
    [2] sizeof(struct sof_abi_hdr)) + payload
    
    The max_size specifies the size of [2] and it is coming from topology.
    
    Change the function to take this into account and allocate adequate amount
    of memory behind scontrol->ipc_control_data.
    
    With the change we will allocate [1] amount more memory to be able to hold
    the full size of data.
    
    Fixes: a382082ff74b ("ASoC: SOF: ipc4-topology: Add support for TPLG_CTL_BYTES")
    Cc: stable@vger.kernel.org
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Seppo Ingalsuo 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Link: https://patch.msgid.link/20251217143945.2667-3-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 2fa74713744dc5e908fff851c20f5f89fd665fb7
Author: Peter Ujfalusi 
Date:   Wed Dec 17 16:39:38 2025 +0200

    ASoC: SOF: ipc4-control: If there is no data do not send bytes update
    
    When the bytes control have no data (payload) then there is no need to send
    an IPC message as there is nothing to send.
    
    Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put")
    Cc: stable@vger.kernel.org
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Seppo Ingalsuo 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Link: https://patch.msgid.link/20251217143945.2667-2-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit e8c28e16c3ebd142938aee296032c6b802a5a1d4
Author: Lizhi Hou 
Date:   Mon Dec 15 19:13:11 2025 -0800

    accel/amdxdna: Remove amdxdna_flush()
    
    amdxdna_flush() was introduced to ensure that the device does not access
    a process address space after it has been freed. However, this is no
    longer necessary because the driver now increments the mm reference count
    when a command is submitted and decrements it only after the command has
    completed. This guarantees that the process address space remains valid
    for the entire duration of command execution. Remove amdxdna_flush to
    simplify the teardown path.
    
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251216031311.2033399-1-lizhi.hou@amd.com

commit 5c3c3e7b654df01a69d49551a08b7863c09546f6
Author: Boris Brezillon 
Date:   Wed Dec 17 14:24:03 2025 +0100

    drm/panthor: Fix kerneldoc in uAPI header
    
    Fix a typo in a kerneldoc header.
    
    Reported-by: Stephen Rothwell 
    Closes: https://lore.kernel.org/dri-devel/20251216120049.3ed7e06e@canb.auug.org.au/
    Signed-off-by: Boris Brezillon 
    Reviewed-by: Liviu Dudau 
    Reviewed-by: Steven Price 
    Fixes: ea78ec982653 ("drm/panthor: Expose the selected coherency protocol to the UMD")
    Signed-off-by: Steven Price 
    Link: https://patch.msgid.link/20251217132403.3996014-1-boris.brezillon@collabora.com

commit efe24898485c5c831e629d9c6fb9350c35cb576f
Author: Chia-I Wu 
Date:   Thu Dec 4 09:45:45 2025 -0800

    drm/panthor: fix for dma-fence safe access rules
    
    Commit 506aa8b02a8d6 ("dma-fence: Add safe access helpers and document
    the rules") details the dma-fence safe access rules. The most common
    culprit is that drm_sched_fence_get_timeline_name may race with
    group_free_queue.
    
    Signed-off-by: Chia-I Wu 
    Reviewed-by: Boris Brezillon 
    Reviewed-by: Liviu Dudau 
    Reviewed-by: Steven Price 
    Cc: stable@vger.kernel.org # v6.17+
    Signed-off-by: Steven Price 
    Link: https://patch.msgid.link/20251204174545.399059-1-olvaffe@gmail.com

commit 7b800ab1b7f60dd3652c06b3d518e9458da5b1cd
Author: Rodrigo Vivi 
Date:   Thu Dec 4 14:34:04 2025 -0500

    MAINTAINERS: Update Xe driver maintainers
    
    Add Matt Brost, one of the Xe driver creators, as maintainer.
    
    Cc: Matthew Brost 
    Cc: Thomas Hellström 
    Cc: David Airlie 
    Cc: Simona Vetter 
    Cc: dri-devel@lists.freedesktop.org
    Cc: linux-kernel@vger.kernel.org
    Acked-by: Simona Vetter 
    Acked-by: Matthew Brost 
    Acked-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251204193403.930328-2-rodrigo.vivi@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 400fbf4b5870f42b651371303730290ca7a8dd78
Author: Rob Herring (Arm) 
Date:   Mon Dec 8 16:43:03 2025 -0600

    dt-bindings: kbuild: Support single binding targets
    
    Running the full 'make dt_binding_check' is slow. A shortcut is to set
    DT_SCHEMA_FILES env variable to a substring of DT schema files to test.
    It both limits which examples are validated and which schemas are used
    to validate the examples. This is a problem because errors from other
    schemas are missed. What makes validation slow is checking all examples,
    so we really just need a way to test a single example.
    
    Add a %.yaml target to validate the schema and validate the example:
    
    make example-schema.yaml
    
    The behavior for 'make dt_binding_check DT_SCHEMA_FILES=example-schema'
    is unchanged. Really it should mirror dtbs_check and validate all the
    examples with a subset of schemas, but there are lots of users of
    expecting the existing behavior.
    
    Acked-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251208224304.2907913-1-robh@kernel.org
    Signed-off-by: Rob Herring (Arm) 

commit 284da5de616aaebf9c2c62e5fc7cb464a064eff7
Author: Uwe Kleine-König 
Date:   Fri Dec 12 09:09:09 2025 +0100

    platform/surface: Migrate to serdev specific shutdown function
    
    The motivation is stop using the callback .shutdown in
    qca_serdev_driver.driver to make it possible to drop that.
    
    Signed-off-by: Uwe Kleine-König 
    Link: https://patch.msgid.link/9682d206a1f375cd98e7dbfce4f1a83b4b345178.1765526117.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Greg Kroah-Hartman 

commit 12a6a5726c515455935982429ac35dee2307233d
Author: Uwe Kleine-König 
Date:   Fri Dec 12 09:09:08 2025 +0100

    Bluetooth: hci_qca: Migrate to serdev specific shutdown function
    
    This saves a cast in the driver. The motivation is stop using the callback
    .shutdown in qca_serdev_driver.driver to make it possible to drop that.
    
    Signed-off-by: Uwe Kleine-König 
    Link: https://patch.msgid.link/261a3384e25c4837d4efee87958805f15d7d4e3c.1765526117.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Greg Kroah-Hartman 

commit 673a674c52f01b714316087dd07500e681457912
Author: Uwe Kleine-König 
Date:   Fri Dec 12 09:09:07 2025 +0100

    Bluetooth: hci_aml: Migrate to serdev specific shutdown function
    
    This saves a cast in the driver. The motivation is stop using the callback
    .shutdown in qca_serdev_driver.driver to make it possible to drop that.
    
    Signed-off-by: Uwe Kleine-König 
    Link: https://patch.msgid.link/42ae20ba70ff6fbbbd9b846ac9acd0f7d58451b0.1765526117.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Greg Kroah-Hartman 

commit 6d71c62b13c33ea858ab298fe20beaec5736edc7
Author: Uwe Kleine-König 
Date:   Fri Dec 12 09:09:06 2025 +0100

    serdev: Provide a bustype shutdown function
    
    To prepare serdev driver to migrate away from struct device_driver::shutdown
    (and then eventually remove that callback) create a serdev driver shutdown
    callback and migration code to keep the existing behaviour. Note this
    introduces a warning for each driver at register time that isn't converted
    yet to that callback.
    
    Signed-off-by: Uwe Kleine-König 
    Link: https://patch.msgid.link/ab518883e3ed0976a19cb5b5b5faf42bd3a655b7.1765526117.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Greg Kroah-Hartman 

commit 42eeed6d9f31e6063bf98d71212a6de3aac8cdd3
Author: Biju Das 
Date:   Sat Nov 29 16:43:13 2025 +0000

    serial: sh-sci: Add support for RZ/G3E RSCI
    
    Add support for RZ/G3E RSCI. RSCI IP found on the RZ/G3E SoC is similar
    to RZ/T2H, but it has a 32-stage FIFO. It has 6 clocks(5 module clocks
    + 1 external clock) instead of 3 clocks(2 module clocks + 1 external
    clock) on T2H, has 6 irqs compared to 4 on RZ/T2H and has multiple resets.
    Add support for the hardware flow control.
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-18-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 068b862f5025920e3e10228e9904c2560e08b855
Author: Biju Das 
Date:   Sat Nov 29 16:43:12 2025 +0000

    serial: rsci: Rename early_console data, port_params and callback() names
    
    Rename rsci_early_console_setup()->rsci_rzt2h_early_console_setup(),
    the early_console data of_sci_rsci_data->of_rsci_rzt2h_data and the
    port_params rsci_port_params->rsci_rzt2h_port_params to support RZ/G3E
    RSCI that uses different data and callback().
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-17-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit bbcd508c84d4884c620f4f4bb7d382539466b9a3
Author: Biju Das 
Date:   Sat Nov 29 16:43:11 2025 +0000

    serial: sh-sci: Add finish_console_write() callback
    
    Add finish_console_write() callback as RZ/G3E RSCI IP needs special
    handling compared to other SoCs.
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-16-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 5632bda5e848c4592eefa4451092beb4ce29ab76
Author: Biju Das 
Date:   Sat Nov 29 16:43:10 2025 +0000

    serial: sh-sci: Make sci_scbrr_calc() public
    
    Make the function sci_scbrr_calc() public for code reuse to support RZ/G3E
    RSCI IP.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-15-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 83c405ec3a340a334c46bb59b07e5799f6d205a4
Author: Biju Das 
Date:   Sat Nov 29 16:43:09 2025 +0000

    serial: sh-sci: Add support for RZ/G3E RSCI clks
    
    RZ/G3E RSCI has 6 clocks (5 module clocks + 1 external clock). Add
    support for the module clocks.
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-14-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 4cb2bd1bf41a0d6dbe1fc4bf8d8f83f40b914572
Author: Biju Das 
Date:   Sat Nov 29 16:43:08 2025 +0000

    serial: sh-sci: Add RSCI_PORT_SCIF32 port ID
    
    The RZ/G3E RSCI IP has 32-stage FIFO compared to 16-stage FIFO on RZ/T2H.
    Add RSCI_PORT_SCIF32 port ID to differentiate it from RZ/T2H RSCI and
    update sci_is_rsci_type() and sci_is_fifo_type()
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-13-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit d53f4aa9edaafda28e426d8e5eda7dc50f7ca94e
Author: Biju Das 
Date:   Sat Nov 29 16:43:07 2025 +0000

    serial: sh-sci: Rename port SCI_PORT_RSCI->RSCI_PORT_SCIF16
    
    Rename port SCI_PORT_RSCI->RSCI_PORT_SCIF16 to differentiate it from
    RZ/G3E port that has 32-stage FIFO.
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-12-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 7d8b226bf95cd2b49f15da4f4d40e05932c0d4cc
Author: Biju Das 
Date:   Sat Nov 29 16:43:06 2025 +0000

    serial: sh-sci: Add sci_is_rsci_type()
    
    Add sci_is_rsci_type() for RSCI port type. This will simplify the code
    when the support added for RSCI_PORT_SCIF32 private PORT type.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-11-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 850ec928922fb819c28eb175bf85b01e28afdea7
Author: Biju Das 
Date:   Sat Nov 29 16:43:05 2025 +0000

    serial: sh-sci: Use devm_reset_control_array_get_exclusive()
    
    Replace devm_*_get_exclusive()->devm_*_array_get_exclusive() to support
    existing SoCs along with RZ/G3E as RZ/G3E has 2 resets.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-10-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 507a7ba917cd7ae043ba05db02089b152ae0aaa8
Author: Biju Das 
Date:   Sat Nov 29 16:43:04 2025 +0000

    serial: rsci: Drop unused TDR register
    
    Drop the unused TDR register-related macros.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-9-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 36816a033dd41fda415ae0696931d6bfe87671a2
Author: Biju Das 
Date:   Sat Nov 29 16:43:03 2025 +0000

    serial: rsci: Drop unused macro DCR
    
    Drop unused macro DCR and its bit definition.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-8-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit c17db4d06cabc7746d48d99c6245d19bd55077d4
Author: Biju Das 
Date:   Sat Nov 29 16:43:02 2025 +0000

    serial: sh-sci: Drop extra lines
    
    Shorten the number lines in sci_init_clocks() by fitting the error
    messages within an 100-character length limit.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-7-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 450bd399c8797d2783c73aa6c83f382ac8d5f630
Author: Biju Das 
Date:   Sat Nov 29 16:43:01 2025 +0000

    serial: rsci: Drop rsci_clear_SCxSR()
    
    Drop rsci_clear_SCxSR by reusing rsci_clear_CFC() as the contents of
    both functions are the same.
    
    Reviewed-by: Geert Uytterhoeven 
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-6-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 42f7303c5f668403f06d9b938d3de2bda3736530
Author: Biju Das 
Date:   Sat Nov 29 16:43:00 2025 +0000

    serial: sh-sci: Drop checking port type for device file{create, remove}
    
    Ports that support FIFO has fifosize > 1. Replace checking the port type
    with fifosize for device file{create, remove}.
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-5-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit b346e5d7dbf6696176417923c49838a1beb1d785
Author: Biju Das 
Date:   Sat Nov 29 16:42:59 2025 +0000

    serial: rsci: Add set_rtrg() callback
    
    The rtrg variable is populated in sci_init_single() for RZ/T2H. Add
    set_rtrg() callback for setting the rtrg value.
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-4-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 3a3ab10245b6779e32114bc70052ec7a8a380152
Author: Biju Das 
Date:   Sat Nov 29 16:42:58 2025 +0000

    serial: sh-sci: Update rx_trigger size for RZ/T2H RSCI
    
    The RZ/T2H RSCI has 16-stage FIFO. Like other SoCs, set the default
    rx_trigger as the fifosize.
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-3-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 0774c43c006bf6e411514920cc57a42abe9374c1
Author: Biju Das 
Date:   Sat Nov 29 16:42:57 2025 +0000

    dt-bindings: serial: renesas,rsci: Document RZ/G3E support
    
    Add documentation for the serial communication interface (RSCI) found on
    the Renesas RZ/G3E (R9A09G047) SoC. The RSCI IP on this SoC is identical
    to that on the RZ/T2H (R9A09G077) SoC, but it has a 32-stage FIFO compared
    to 16 on RZ/T2H. It supports both FIFO and non-FIFO mode operation. RZ/G3E
    has 6 clocks(5 module clocks + 1 external clock) compared to 3 clocks
    (2 module clocks + 1 external clock) on RZ/T2H, and it has multiple resets.
    It has 6 interrupts compared to 4 on RZ/T2H.
    
    Signed-off-by: Biju Das 
    Tested-by: Lad Prabhakar 
    Link: https://patch.msgid.link/20251129164325.209213-2-biju.das.jz@bp.renesas.com
    Signed-off-by: Greg Kroah-Hartman 

commit 695f986155d9dd95aef4acfca6dd31bf4b83282d
Author: Bartlomiej Kubik 
Date:   Tue Dec 2 07:37:48 2025 +0100

    tty/n_hdlc: Fix struct n_hdlc kernel-doc warnings
    
    Add missing descriptions for write_work and tty_for_write_work
    members in struct n_hdlc.
    
    This fixes the following warnings:
    drivers/tty/n_hdlc.c: warning: Function parameter or member
                                   'write_work' not described in 'n_hdlc'
    drivers/tty/n_hdlc.c: warning: Function parameter or member
                                   'tty_for_write_work' not described in 'n_hdlc'
    
    Signed-off-by: Bartlomiej Kubik 
    Link: https://patch.msgid.link/20251202063748.1210359-1-kubik.bartlomiej@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit e5484745c4c0c3046d8446484f1e663131ba3ec2
Author: Gerhard Engleder 
Date:   Tue Dec 16 20:37:26 2025 +0100

    serial: 8250_keba: Use dev_err_probe()
    
    Simplify the probe() code by using dev_err_probe().
    
    Suggested-by: Andy Shevchenko 
    Signed-off-by: Gerhard Engleder 
    Link: https://patch.msgid.link/20251216193726.55449-4-gerhard@engleder-embedded.com
    Signed-off-by: Greg Kroah-Hartman 

commit ee086a69c3ba24bad01a9307b44dc58d1a22ad4e
Author: Gerhard Engleder 
Date:   Tue Dec 16 20:37:25 2025 +0100

    serial: 8250_keba: Add ICR defines
    
    Add defines for better readability of the Indexed Control Register (ICR)
    access. In enhanced mode SCR and LSR registers are used for ICR access.
    The behavior of these register is different in this mode and that shall
    be documented with dedicated defines.
    
    Suggested-by: Ilpo Järvinen 
    Signed-off-by: Gerhard Engleder 
    Link: https://patch.msgid.link/20251216193726.55449-3-gerhard@engleder-embedded.com
    Signed-off-by: Greg Kroah-Hartman 

commit d84400dc43a7cc62030c367677f7fd34237a8d80
Author: Gerhard Engleder 
Date:   Tue Dec 16 20:37:24 2025 +0100

    serial: 8250_keba: Add missing includes
    
    Andy and Ilpo suggested to add missing includes, because the code shall
    not rely on indirect includes. Add missing includes and remove one
    include, which only enabled indirect includes.
    
    Suggested-by: Andy Shevchenko 
    Suggested-by: Ilpo Järvinen 
    Signed-off-by: Gerhard Engleder 
    Link: https://patch.msgid.link/20251216193726.55449-2-gerhard@engleder-embedded.com
    Signed-off-by: Greg Kroah-Hartman 

commit 230c33a81e7967791ed75bc3936e94a8b5403617
Author: Filip Jensen 
Date:   Wed Dec 10 17:48:03 2025 +0100

    serial: 8250_men_mcb: Clean defines
    
    The Z125 define is not used anywhere, thus removed. Also used a
    more specific name for the maximum number of ports per unit and
    removed the duplicated define MAX_PORTS
    
    Reviewed-by: Jose Javier Rodriguez Barbarin 
    Signed-off-by: Filip Jensen 
    Link: https://patch.msgid.link/20251210164804.94801-2-dev-Felipe.Jensen@duagon.com
    Signed-off-by: Greg Kroah-Hartman 

commit 0a76a17238f805b231d97b118232a5185bbb7a18
Author: Nathan Chancellor 
Date:   Tue Nov 25 15:54:37 2025 -0700

    tty: vt/keyboard: Split apart vt_do_diacrit()
    
    After commit bfb24564b5fd ("tty: vt/keyboard: use __free()"), builds
    using asm goto for put_user() and get_user() with a version of clang
    older than 17 error with:
    
      drivers/tty/vt/keyboard.c:1709:7: error: cannot jump from this asm goto statement to one of its possible targets
                      if (put_user(asize, &a->kb_cnt))
                          ^
      ...
      arch/arm64/include/asm/uaccess.h:298:2: note: expanded from macro '__put_mem_asm'
              asm goto(                                                       \
              ^
      drivers/tty/vt/keyboard.c:1687:7: note: possible target of asm goto statement
                      if (put_user(asize, &a->kb_cnt))
                          ^
      ...
      arch/arm64/include/asm/uaccess.h:342:2: note: expanded from macro '__raw_put_user'
              __rpu_failed:                                                   \
              ^
      drivers/tty/vt/keyboard.c:1697:23: note: jump exits scope of variable with __attribute__((cleanup))
                      void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc),
                                          ^
      drivers/tty/vt/keyboard.c:1671:33: note: jump bypasses initialization of variable with __attribute__((cleanup))
                      struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr),
                                                    ^
    
    Prior to a fix to clang's scope checker in clang 17 [1], all labels in a
    function were validated as potential targets of all asm gotos in a
    function, regardless of whether they actually were a target of an asm
    goto call, resulting in false positive errors about skipping over
    variables marked with the cleanup attribute.
    
    To workaround this error, split up the bodies of the case statements in
    vt_do_diacrit() into their own functions so that the scope checker does
    not trip up on the multiple instances of __free().
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202509091702.Oc7eCRDw-lkp@intel.com/
    Closes: https://lore.kernel.org/oe-kbuild-all/202511241835.EA8lShgH-lkp@intel.com/
    Link: https://github.com/llvm/llvm-project/commit/f023f5cdb2e6c19026f04a15b5a935c041835d14 [1]
    Signed-off-by: Nathan Chancellor 
    Link: https://patch.msgid.link/20251125-tty-vt-keyboard-wa-clang-scope-check-error-v1-1-f5a5ea55c578@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit 485c13d9bc7a83532c038757c2f155728bb4bb38
Author: Artem Shimko 
Date:   Tue Nov 4 17:54:26 2025 +0300

    serial: 8250_dw: fix runtime PM initialization sequence
    
    Move pm_runtime_set_active() call earlier in probe to simplify error
    handling and add proper error checking to ensure the device is marked
    as active before any runtime PM operations can occur.
    
    Additionally, replace the const struct dev_pm_ops declaration with
    _DEFINE_DEV_PM_OPS macro for better consistency with modern kernel PM
    patterns.
    
    Signed-off-by: Artem Shimko 
    Link: https://patch.msgid.link/20251104145433.2316165-3-a.shimko.dev@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit d31228143a489ba6ba797896a07541ce06828c09
Author: Artem Shimko 
Date:   Tue Nov 4 17:54:25 2025 +0300

    serial: 8250_dw: handle clock enable errors in runtime_resume
    
    Add error checking for clk_prepare_enable() calls in
    dw8250_runtime_resume(). Currently if either clock fails to enable,
    the function returns success while leaving clocks in inconsistent state.
    
    This change implements comprehensive error handling by checking the return
    values of both clk_prepare_enable() calls. If the second clock enable
    operation fails after the first clock has already been successfully
    enabled, the code now properly cleans up by disabling and unpreparing
    the first clock before returning. The error code is then propagated to
    the caller, ensuring that clock enable failures are properly reported
    rather than being silently ignored.
    
    Signed-off-by: Artem Shimko 
    Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 97f419848b1db69fc7ea99f385a7d2fa2b2ca454
Author: Christian König 
Date:   Wed Dec 10 14:47:36 2025 +0100

    dma-buf/selftests: drop the mock_wait implementation
    
    Actually test the documented expectation of dma_fence_wait() instead of
    comming up with a mock_wait implementation which uses undocumented
    and non standard return codes and behavior.
    
    Additional to that increase the timeout to one second, otherwise the
    test case is a bit unreliable.
    
    Signed-off-by: Christian König 
    Reviewed-by: Tvrtko Ursulin 
    Link: https://lore.kernel.org/r/346e3df8-5f3a-4394-9d90-4ba107294161@ursulin.net

commit dd1fbe324a548e8057d5f3c72ce1a64a80f1753e
Author: Yi Cong 
Date:   Tue Dec 2 17:09:48 2025 +0800

    usb: linux/usb.h: Correct the description of the usb_device_driver member
    
    In the current kernel USB device driver code, only the name field is
    required to be provided; all other fields are optional.
    
    Correct this part of the description.
    
    Signed-off-by: Yi Cong 
    Acked-by: Alan Stern 
    Link: https://patch.msgid.link/20251202090948.334809-1-cong.yi@linux.dev
    Signed-off-by: Greg Kroah-Hartman 

commit 6811e0a08bdce6b2767414caf17fda24c2e4e032
Author: Benson Leung 
Date:   Mon Dec 8 17:48:48 2025 +0000

    usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
    
    ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated
    using whichever pdo is in the last position of the src_pdos array, presuming
    it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current
    helpers are used on that last pdo.
    
    However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and
    for PPS) may exist, and are always at the end of the array if they do.
    In the event one of these more advanced chargers are attached the helpers for
    fixed return mangled values.
    
    Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger
    with PPS support:
    POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
    POWER_SUPPLY_TYPE=USB
    POWER_SUPPLY_CHARGE_TYPE=Standard
    POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
    POWER_SUPPLY_ONLINE=1
    POWER_SUPPLY_VOLTAGE_MIN=5000000
    POWER_SUPPLY_VOLTAGE_MAX=13400000
    POWER_SUPPLY_VOLTAGE_NOW=20000000
    POWER_SUPPLY_CURRENT_MAX=5790000
    POWER_SUPPLY_CURRENT_NOW=3250000
    
    Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS
    APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect.
    
    Instead, enumerate through the src_pdos and filter just for Fixed PDOs for
    now, and find the one with the highest voltage and current respectively.
    
    After, from the same charger:
    POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
    POWER_SUPPLY_TYPE=USB
    POWER_SUPPLY_CHARGE_TYPE=Standard
    POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
    POWER_SUPPLY_ONLINE=1
    POWER_SUPPLY_VOLTAGE_MIN=5000000
    POWER_SUPPLY_VOLTAGE_MAX=20000000
    POWER_SUPPLY_VOLTAGE_NOW=20000000
    POWER_SUPPLY_CURRENT_MAX=4000000
    POWER_SUPPLY_CURRENT_NOW=3250000
    
    Signed-off-by: Benson Leung 
    Reviewed-by: Heikki Krogerus 
    Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org
    Signed-off-by: Greg Kroah-Hartman 

commit 165fc0742b9c1d521d9482b9c43ed4755139f52e
Author: Benson Leung 
Date:   Mon Dec 8 17:48:47 2025 +0000

    usb: typec: ucsi: psy: Fix ucsi_psy_get_current_now in non-PD cases
    
    current_now would always return 0 in for non-PD power sources, and the
    negotiated current based on the Request RDO in PD mode.
    
    For USB Type-C current or legacy Default USB cases current_now will present
    the max value of those modes, as that is the equivalent of the Request RDO
    in PD.
    
    Also, current_now will now return 0 when the port is disconnected to match
    the same behavior of current_max.
    
    Signed-off-by: Benson Leung 
    Reviewed-by: Heikki Krogerus 
    Link: https://patch.msgid.link/20251208174918.289394-2-bleung@chromium.org
    Signed-off-by: Greg Kroah-Hartman 

commit c616b709fa2391c48bab4eea3ec586bec27e0808
Author: Rob Herring (Arm) 
Date:   Mon Dec 15 15:25:14 2025 -0600

    dt-bindings: usb: ehci/ohci: Allow "dma-coherent"
    
    EHCI and OHCI controllers can be DMA coherent on some platforms, so
    allow the "dma-coherent" property.
    
    Signed-off-by: Rob Herring (Arm) 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251215212515.3318052-1-robh@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit 1c93738177d3a94d51dcb1c3ea41967f3fe946ba
Author: Victor Krawiec 
Date:   Tue Dec 9 17:40:06 2025 +0100

    usb: gadget: f_midi: allow customizing the USB MIDI interface string through configfs
    
    When using f_midi from configfs the USB MIDI interface string is hardcoded
    to 'MIDI function'.
    
    This USB string descriptor is used by some third-party OS or software to
    display the name of the MIDI device
    
    Since we add an additional string option a new macro block was created to
    factorize declarations
    
    Signed-off-by: Victor Krawiec 
    Reviewed-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251209164006.143219-1-victor.krawiec@arturia.com
    Signed-off-by: Greg Kroah-Hartman 

commit 4dee13db29de6dd869af9b3827e1ff569644e838
Author: Chaoyi Chen 
Date:   Mon Dec 8 09:54:51 2025 +0800

    usb: typec: Export typec bus and typec altmode device type
    
    The DRM may want to register a notifier on the typec bus to know when
    a typec altmode device is added, and distinguish between different
    types of typec altmode device.
    
    Export these things.
    
    Signed-off-by: Chaoyi Chen 
    Reviewed-by: Heikki Krogerus 
    Link: https://patch.msgid.link/20251208015500.94-3-kernel@airkyi.com
    Signed-off-by: Greg Kroah-Hartman 

commit 67ab45426215c7fdccb65aecd4cac15bbe4dfcbb
Author: Heikki Krogerus 
Date:   Mon Dec 8 09:54:50 2025 +0800

    usb: typec: Set the bus also for the port and plug altmodes
    
    The port and plug altmodes can't be bound to the altmode
    drivers because the altmode drivers are meant for partner
    communication using the VDM (vendor defined messages), but
    they can still be part of the bus. The bus will make sure
    that the normal bus notifications are available also with
    the port altmodes.
    
    The previously used common device type for all alternate
    modes is replaced with separate dedicated device types for
    port, plug, and partner alternate modes.
    
    Signed-off-by: Heikki Krogerus 
    Signed-off-by: Chaoyi Chen 
    Link: https://patch.msgid.link/20251208015500.94-2-kernel@airkyi.com
    Signed-off-by: Greg Kroah-Hartman 

commit 36723c6c1ea2d4736540eaa0cb4e59dba40d8573
Author: Ryan Chen 
Date:   Fri Nov 28 08:27:31 2025 +0800

    usb: gadget: aspeed-vhub: Add ast2700 support
    
    Add support for the AST2700 SOC in the vhub gadget driver. AST2700
    uses a 64-bit DMA addressing capability, so select 64-bit DMA mask
    for compatible. AST2700 vhub also requires an reset line, so hook
    up the optional reset control and assert/deassert it during probe
    and remove.
    
    Signed-off-by: Ryan Chen 
    Link: https://patch.msgid.link/20251128-upstream_vhub-v2-2-1fa66a5833c2@aspeedtech.com
    Signed-off-by: Greg Kroah-Hartman 

commit d0f607e4b96b6927ebce08fe2c9dfbf8a64ca614
Author: Ryan Chen 
Date:   Fri Nov 28 08:27:30 2025 +0800

    dt-bindings: usb: aspeed,usb-vhub: Add ast2700 support
    
    Add the "aspeed,ast2700-usb-vhub" compatible. The ast2700 vhub
    controller requires an reset, so make the "resets" property
    mandatory for this compatible to reflect the hardware requirement.
    
    Signed-off-by: Ryan Chen 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251128-upstream_vhub-v2-1-1fa66a5833c2@aspeedtech.com
    Signed-off-by: Greg Kroah-Hartman 

commit 920c6af98e98e6afedf6318a75bac95af8415c6c
Author: Karunika Choo 
Date:   Mon Dec 15 20:33:12 2025 +0000

    drm/panthor: Fix NULL pointer dereference on panthor_fw_unplug
    
    This patch removes the MCU halt and wait for halt procedures during
    panthor_fw_unplug() as the MCU can be in a variety of states or the FW
    may not even be loaded/initialized at all, the latter of which can lead
    to a NULL pointer dereference.
    
    It should be safe on unplug to just disable the MCU without waiting for
    it to halt as it may not be able to.
    
    Fixes: 514072549865 ("drm/panthor: Support GLB_REQ.STATE field for Mali-G1 GPUs")
    Suggested-by: Boris Brezillon 
    Signed-off-by: Karunika Choo 
    Reviewed-by: Liviu Dudau 
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251215203312.1084182-1-karunika.choo@arm.com
    Signed-off-by: Boris Brezillon 

commit bfb44780ee450553a0e55eaa2239c3bf5062a5bd
Author: Adrish Bora 
Date:   Mon Dec 15 06:31:02 2025 +0000

    staging: rtl8723bs: remove dead code in os_intfs.c
    
    Remove commented-out dead code in netdev_close().
    The code was previously commented out and is not needed.
    
    Suggested-by: Dan Carpenter 
    Signed-off-by: Adrish Bora 
    Reviewed-by: Dan Carpenter 
    Link: https://patch.msgid.link/20251215063102.1836-1-adrishbora@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 1b92242888d7162dcd80efe907685394012e9565
Author: Julio Cesar Carvalho de Paula Souza 
Date:   Fri Dec 5 08:21:38 2025 -0300

    staging: greybus: arche-apb-ctrl: switch to device_property_read_bool
    
    Switch from the deprecated of_property_read_bool() to the common
    device_property_read_bool() API. This makes the driver agnostic to
    the underlying firmware interface (DT or ACPI) and simplifies the
    logic.
    
    Since the driver is no longer strictly dependent on Device Tree,
    include  directly for the struct
    of_device_id definition, instead of relying on implicit inclusion
    via , which has been removed as it is unused.
    
    Also rename apb_ctrl_get_devtree_data() to apb_ctrl_get_fw_data()
    to better reflect the agnostic nature of the new implementation.
    
    Signed-off-by: Julio Cesar Carvalho de Paula Souza 
    Link: https://patch.msgid.link/20251205112138.3431-1-julio191096@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 2038fe84b8bdf894b634f777096685e78e8f3774
Author: Vivek BalachandharTN 
Date:   Fri Dec 5 02:14:17 2025 +0000

    staging: rtl8723bs: fix spacing around operators
    
    Fix several instances where operators lacked spaces around them.
    This improves readability and brings the driver closer to kernel
    coding-style guidelines. No functional change.
    
    Signed-off-by: Vivek BalachandharTN 
    Link: https://patch.msgid.link/20251205021417.2705864-3-vivek.balachandhar@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 0a2404c8f6a3a120f79c57ef8a3302c8e8bc34d9
Author: Dan Carpenter 
Date:   Fri Dec 5 14:39:19 2025 +0300

    drm/xe/xe_sriov_vfio: Fix return value in xe_sriov_vfio_migration_supported()
    
    The xe_sriov_vfio_migration_supported() function is type bool so
    returning -EPERM means returning true.  Return false instead.
    
    Fixes: 17f22465c5a5 ("drm/xe/pf: Export helpers for VFIO")
    Signed-off-by: Dan Carpenter 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/aTLEZ4g-FD-iMQ2V@stanley.mountain
    Signed-off-by: Michał Winiarski 

commit f5ee159192a15d13c4dd3a03594c12a219363eed
Author: Arjun Changla 
Date:   Wed Dec 10 08:49:15 2025 +0000

    staging: rtl8723bs: remove trailing whitespace
    
    Fix checkpatch error by removing trailing whitespace at line 2021.
    
    Signed-off-by: Arjun Changla 
    Link: https://patch.msgid.link/20251210084916.4000-1-arjunchangla7@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 618b4aec12faabc7579a6b0df046842d798a4c7c
Author: Liang Jie 
Date:   Mon Dec 8 17:27:28 2025 +0800

    staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
    
    The return value of sdio_alloc_irq() was not stored in status.
    If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds,
    status remains _SUCCESS and the error path skips resource cleanup,
    while rtw_drv_init() still returns success.
    
    Store the return value of sdio_alloc_irq() in status and reuse the
    existing error handling which relies on status.
    
    Reviewed-by: fanggeng 
    Signed-off-by: Liang Jie 
    Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com
    Signed-off-by: Greg Kroah-Hartman 

commit 5ae6cb153abc0448d28e6969f72fa5f7578048c1
Author: Dan Carpenter 
Date:   Fri Dec 5 14:10:31 2025 +0300

    drm/xe/vf: fix return type in vf_migration_init_late()
    
    The vf_migration_init_late() function is supposed to return zero on
    success and negative error codes on failure.  The error code
    eventually gets propagated back to the probe() function and returned.
    The problem is it's declared as type bool so it returns true on
    error.  Change it to type int instead.
    
    Fixes: 2e2dab20dd66 ("drm/xe/vf: Enable VF migration only on supported GuC versions")
    Signed-off-by: Dan Carpenter 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/aTK9pwJ_roc8vpDi@stanley.mountain
    Signed-off-by: Michał Winiarski 

commit ec342420979ebf28b461a43c3d6ca4dc78a7882b
Author: Nazar Kletskii 
Date:   Thu Dec 4 13:53:32 2025 +0200

    staging: rtl8723bs: Remove unnecessary parentheses
    
    checkpatch.pl reported multiple checks about unnecessary parentheses
    when assigning the address of a struct member.
    
    The '->' operator has higher precedence than '&', making the
    parentheses redundant. This patch removes them to clean up the code.
    
    Signed-off-by: Nazar Kletskii 
    Link: https://patch.msgid.link/20251204115332.21909-1-nazar.kletskii@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 91c10b00216cde5ae5754421a0407b778a547b3a
Author: Eric Biggers 
Date:   Wed Dec 3 22:18:31 2025 -0800

    staging: rtl8723bs: select CRYPTO_LIB_UTILS instead of CRYPTO
    
    Since the rtl8723bs driver only uses the crypto library functions and
    not the traditional crypto API, select only the required options.  This
    avoids unnecessary pulling in the full traditional crypto API.
    
    Signed-off-by: Eric Biggers 
    Link: https://patch.msgid.link/20251204061831.499181-1-ebiggers@kernel.org
    Signed-off-by: Greg Kroah-Hartman 

commit a8e77db9927b03b85f2f4a5a124c1f3d95b1521e
Author: SeungJu Cheon 
Date:   Thu Dec 4 01:30:56 2025 +0900

    Staging: rtl8723bs: fix space before tab in rtl8723bs_xmit.c
    
    Fixed a coding style issue - please, no space before tabs
    
    Signed-off-by: SeungJu Cheon 
    Link: https://patch.msgid.link/20251203163056.121915-1-suunj1331@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 7ff9fc55d36ae392626ae8704bd8d22eafd2605a
Author: Artur Stupa 
Date:   Fri Nov 28 00:29:20 2025 -0800

    staging: vme_user: name function parameters
    
    Fix the following checkpatch warning for all unnamed arguments:
    WARNING: function definition argument should also have an identifier name
    
    No functional changes.
    
    Signed-off-by: Artur Stupa 
    Link: https://patch.msgid.link/20251128083018.51315-1-arthur.stupa@gmail.com
    Signed-off-by: Greg Kroah-Hartman 

commit 057edc58aa5926d63840c7f30afe0953d3994fa3
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 13:49:17 2025 +0100

    ACPI: PM: Register wakeup sources under physical devices
    
    Currently, acpi_add_pm_notifier() registers wakeup sources under
    ACPI companions of the devices affected by the handling of wakeup
    events which goes against the rule that a struct acpi_device
    can only be a parent of another struct acpi_device.
    
    Moreover, it would be more logically consistent to register wakeup
    sources under the devices affected by wakeup events handling which
    would cause them to appear in more suitable places in sysfs and would
    help to identify the devices they are associated with more easily.
    
    Accordingly, update acpi_add_pm_notifier() to register wakeup sources
    under the "target" devices directly instead of registering them under
    the ACPI companions of those devices.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Armin Wolf 
    Link: https://patch.msgid.link/1944126.tdWV9SEqCh@rafael.j.wysocki

commit d8a872c810916714067e2089c68d2fd0e65da43c
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 13:48:14 2025 +0100

    ACPI: PCI: PM: Rework root bus notification setup
    
    Since pci_acpi_add_bus_pm_notifier() is only suitable for adding ACPI
    PM notifiers to root buses, rename it to pci_acpi_add_root_pm_notifier()
    and modify it to take an additional "root" argument, which is then used
    for passing a PCI root bridge device pointer to acpi_add_pm_notifier().
    
    That function uses it to populate the "dev" field in the context
    structure attached to the ACPI device object that will receive the
    ACPI "wake" notifications on behalf of the given PCI root bus.  The
    context structure in question is passed to pci_acpi_wake_bus(), so
    the latter can be simplified quite a bit now because the target PCI
    host bridge structure address can be derived from "dev".
    
    No intentional functional impact.
    
    This change will also facilitate a subsequent update related to the
    registration of wakeup sources.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Armin Wolf 
    [ rjw: Kerneldoc comment fixup ]
    Link: https://patch.msgid.link/2395263.ElGaqSPkdT@rafael.j.wysocki
    Signed-off-by: Rafael J. Wysocki 

commit 3cb3c2f6886f9489df13de8efe7a1e803a3f21ea
Author: Peter Zijlstra 
Date:   Wed Dec 17 12:08:01 2025 +0100

    perf: Clean up mediated vPMU accounting
    
    The mediated_pmu_account_event() and perf_create_mediated_pmu()
    functions implement the exclusion between '!exclude_guest' counters
    and mediated vPMUs. Their implementation is basically identical,
    except mirrored in what they count/check.
    
    Make sure the actual implementations reflect this similarity.
    
    Notably:
     - while perf_release_mediated_pmu() has an underflow check;
       mediated_pmu_unaccount_event() did not.
     - while perf_create_mediated_pmu() has an inc_not_zero() path;
       mediated_pmu_account_event() did not.
    
    Also, the inc_not_zero() path can be outsite of
    perf_mediated_pmu_mutex. The mutex must guard the 0->1 (of either
    nr_include_guest_events or nr_mediated_pmu_vms) transition, but once a
    counter is already non-zero, it can safely be incremented further.
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251208115156.GE3707891@noisy.programming.kicks-ass.net

commit 3006911f284d769b0f66c12b39da130325ef1440
Author: Martin Schiller 
Date:   Mon Nov 24 08:48:46 2025 +0100

    perf/x86/cstate: Add Airmont NP
    
    From the perspective of Intel cstate residency counters, the Airmont NP
    (aka Lightning Mountain) is identical to the Airmont.
    
    Signed-off-by: Martin Schiller 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251124074846.9653-4-ms@dev.tdt.de

commit a08340fd291671c54d379d285b2325490ce90ddd
Author: Martin Schiller 
Date:   Mon Nov 24 08:48:45 2025 +0100

    perf/x86/intel: Add Airmont NP
    
    The Intel / MaxLinear Airmont NP (aka Lightning Mountain) supports the
    same architectual and non-architecural events as Airmont.
    
    Signed-off-by: Martin Schiller 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251124074846.9653-3-ms@dev.tdt.de

commit 63dbadcafc1f4d1da796a8e2c0aea1e561f79ece
Author: Martin Schiller 
Date:   Mon Nov 24 08:48:44 2025 +0100

    perf/x86/msr: Add Airmont NP
    
    Like Airmont, the Airmont NP (aka Intel / MaxLinear Lightning Mountain)
    supports SMI_COUNT MSR.
    
    Signed-off-by: Martin Schiller 
    Signed-off-by: Peter Zijlstra (Intel) 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251124074846.9653-2-ms@dev.tdt.de

commit 3c48808408af11d6f173c65eee9bd5ca4c53667c
Author: Jens Remus 
Date:   Mon Dec 8 17:03:52 2025 +0100

    x86/unwind_user: Simplify unwind_user_word_size()
    
    Get rid of superfluous ifdef and return explicit word size depending on
    32-bit or 64-bit mode.
    
    Suggested-by: Linus Torvalds 
    Signed-off-by: Jens Remus 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251208160352.1363040-5-jremus@linux.ibm.com

commit aa6047ef7204ea1faa346b9123439abed0546f7e
Author: Jens Remus 
Date:   Mon Dec 8 17:03:51 2025 +0100

    x86/unwind_user: Guard unwind_user_word_size() by UNWIND_USER
    
    The unwind user framework in general requires an architecture-specific
    implementation of unwind_user_word_size() to be present for any unwind
    method, whether that is fp or a future other method, such as potentially
    sframe.
    
    Guard unwind_user_word_size() by the availability of the UNWIND_USER
    framework instead of the specific HAVE_UNWIND_USER_FP method.
    
    This facilitates to selectively disable HAVE_UNWIND_USER_FP on x86
    (e.g. for test purposes) once a new unwind method is added to unwind
    user.
    
    Signed-off-by: Jens Remus 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251208160352.1363040-4-jremus@linux.ibm.com

commit 2652f9a4b019e34fbbde8dcd1396f1f00ec4844f
Author: Jens Remus 
Date:   Mon Dec 8 17:03:50 2025 +0100

    unwind_user/fp: Use dummies instead of ifdef
    
    This simplifies the code.   unwind_user_next_fp() does not need to
    return -EINVAL if config option HAVE_UNWIND_USER_FP is disabled, as
    unwind_user_start() will then not select this unwind method and
    unwind_user_next() will therefore not call it.
    
    Provide (1) a dummy definition of ARCH_INIT_USER_FP_FRAME, if the unwind
    user method HAVE_UNWIND_USER_FP is not enabled, (2) a common fallback
    definition of unwind_user_at_function_start() which returns false, and
    (3) a common dummy definition of ARCH_INIT_USER_FP_ENTRY_FRAME.
    
    Note that enabling the config option HAVE_UNWIND_USER_FP without
    defining ARCH_INIT_USER_FP_FRAME triggers a compile error, which is
    helpful when implementing support for this unwind user method in an
    architecture.  Enabling the config option when providing an arch-
    specific unwind_user_at_function_start() definition makes it necessary
    to also provide an arch-specific ARCH_INIT_USER_FP_ENTRY_FRAME
    definition.
    
    Signed-off-by: Jens Remus 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251208160352.1363040-3-jremus@linux.ibm.com

commit 2d6ad925fb2386f3ee1d26f5022f7ea71bbc1541
Author: Jens Remus 
Date:   Mon Dec 8 17:03:49 2025 +0100

    unwind_user: Enhance comments on get CFA, FP, and RA
    
    Move the comment "Get the Canonical Frame Address (CFA)" to the top
    of the sequence of statements that actually get the CFA.  Reword the
    comment "Find the Return Address (RA)" to "Get ...", as the statements
    actually get the RA.  Add a respective comment to the statements that
    get the FP.  This will be useful once future commits extend the logic
    to get the RA and FP.
    
    While at it align the comment on the "stack going in wrong direction"
    check to the following one on the "address is word aligned" check.
    
    Signed-off-by: Jens Remus 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251208160352.1363040-2-jremus@linux.ibm.com

commit 65eb3a9a8a34fa9188e0ab5e657d84ce4fa242a7
Author: Sandipan Das 
Date:   Fri Dec 5 16:16:49 2025 -0800

    perf/x86/amd: Support PERF_PMU_CAP_MEDIATED_VPMU for AMD host
    
    Apply the PERF_PMU_CAP_MEDIATED_VPMU flag for version 2 and later
    implementations of the core PMU. Aside from having Global Control and
    Status registers, virtualizing the PMU using the mediated model requires
    an interface to set or clear the overflow bits in the Global Status MSRs
    while restoring or saving the PMU context of a vCPU.
    
    PerfMonV2-capable hardware has additional MSRs for this purpose, namely
    PerfCntrGlobalStatusSet and PerfCntrGlobalStatusClr, thereby making it
    suitable for use with mediated vPMU.
    
    Signed-off-by: Sandipan Das 
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-14-seanjc@google.com

commit 4280d79587a3fd4bf9415705536fe385467c5f44
Author: Kan Liang 
Date:   Fri Dec 5 16:16:48 2025 -0800

    perf/x86/intel: Support PERF_PMU_CAP_MEDIATED_VPMU
    
    Apply the PERF_PMU_CAP_MEDIATED_VPMU for Intel core PMU. It only indicates
    that the perf side of core PMU is ready to support the mediated vPMU.
    Besides the capability, the hypervisor, a.k.a. KVM, still needs to check
    the PMU version and other PMU features/capabilities to decide whether to
    enable support mediated vPMUs.
    
    [sean: massage changelog]
    Signed-off-by: Kan Liang 
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-13-seanjc@google.com

commit c8824a95d9673763a0a9d642f8c79b2162296923
Author: Mingwei Zhang 
Date:   Fri Dec 5 16:16:47 2025 -0800

    perf/x86/core: Plumb mediated PMU capability from x86_pmu to x86_pmu_cap
    
    Plumb mediated PMU capability to x86_pmu_cap in order to let any kernel
    entity such as KVM know that host PMU support mediated PMU mode and has
    the implementation.
    
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-12-seanjc@google.com

commit b456a6ba5756b6fb7e651775343e713bd08418e7
Author: Sandipan Das 
Date:   Fri Dec 5 16:16:46 2025 -0800

    perf/x86/core: Do not set bit width for unavailable counters
    
    Not all x86 processors have fixed counters. It may also be the case that
    a processor has only fixed counters and no general-purpose counters. Set
    the bit widths corresponding to each counter type only if such counters
    are available.
    
    Fixes: b3d9468a8bd2 ("perf, x86: Expose perf capability to other modules")
    Signed-off-by: Sandipan Das 
    Co-developed-by: Dapeng Mi 
    Signed-off-by: Dapeng Mi 
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-11-seanjc@google.com

commit 560ac136f25da2da44a8b68d581adfdc8230b7e2
Author: Sean Christopherson 
Date:   Fri Dec 5 16:16:45 2025 -0800

    perf/x86/core: Add APIs to switch to/from mediated PMI vector (for KVM)
    
    Add APIs (exported only for KVM) to switch PMIs to the dedicated mediated
    PMU IRQ vector when loading guest context, and back to perf's standard NMI
    when the guest context is put.  I.e. route PMIs to
    PERF_GUEST_MEDIATED_PMI_VECTOR when the guest context is active, and to
    NMIs while the host context is active.
    
    While running with guest context loaded, ignore all NMIs (in perf).  Any
    NMI that arrives while the LVTPC points at the mediated PMU IRQ vector
    can't possibly be due to a host perf event.
    
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251206001720.468579-10-seanjc@google.com

commit a05385d84b2af64600fc84b027bea481e8f6261d
Author: Sean Christopherson 
Date:   Fri Dec 5 16:16:44 2025 -0800

    perf/x86/core: Register a new vector for handling mediated guest PMIs
    
    Wire up system vector 0xf5 for handling PMIs (i.e. interrupts delivered
    through the LVTPC) while running KVM guests with a mediated PMU.  Perf
    currently delivers all PMIs as NMIs, e.g. so that events that trigger while
    IRQs are disabled aren't delayed and generate useless records, but due to
    the multiplexing of NMIs throughout the system, correctly identifying NMIs
    for a mediated PMU is practically infeasible.
    
    To (greatly) simplify identifying guest mediated PMU PMIs, perf will
    switch the CPU's LVTPC between PERF_GUEST_MEDIATED_PMI_VECTOR and NMI when
    guest PMU context is loaded/put.  I.e. PMIs that are generated by the CPU
    while the guest is active will be identified purely based on the IRQ
    vector.
    
    Route the vector through perf, e.g. as opposed to letting KVM attach a
    handler directly a la posted interrupt notification vectors, as perf owns
    the LVTPC and thus is the rightful owner of PERF_GUEST_MEDIATED_PMI_VECTOR.
    Functionally, having KVM directly own the vector would be fine (both KVM
    and perf will be completely aware of when a mediated PMU is active), but
    would lead to an undesirable split in ownership: perf would be responsible
    for installing the vector, but not handling the resulting IRQs.
    
    Add a new perf_guest_info_callbacks hook (and static call) to allow KVM to
    register its handler with perf when running guests with mediated PMUs.
    
    Note, because KVM always runs guests with host IRQs enabled, there is no
    danger of a PMI being delayed from the guest's perspective due to using a
    regular IRQ instead of an NMI.
    
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-9-seanjc@google.com

commit 42457a7fb6cacca83be4deaf202ac3e45830daf2
Author: Kan Liang 
Date:   Fri Dec 5 16:16:43 2025 -0800

    perf: Add APIs to load/put guest mediated PMU context
    
    Add exported APIs to load/put a guest mediated PMU context.  KVM will
    load the guest PMU shortly before VM-Enter, and put the guest PMU shortly
    after VM-Exit.
    
    On the perf side of things, schedule out all exclude_guest events when the
    guest context is loaded, and schedule them back in when the guest context
    is put.  I.e. yield the hardware PMU resources to the guest, by way of KVM.
    
    Note, perf is only responsible for managing host context.  KVM is
    responsible for loading/storing guest state to/from hardware.
    
    [sean: shuffle patches around, write changelog]
    Suggested-by: Sean Christopherson 
    Signed-off-by: Kan Liang 
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-8-seanjc@google.com

commit 4593b4b6e218a0f21afbacc8124cf469d2d04094
Author: Kan Liang 
Date:   Fri Dec 5 16:16:42 2025 -0800

    perf: Add a EVENT_GUEST flag
    
    Current perf doesn't explicitly schedule out all exclude_guest events
    while the guest is running. There is no problem with the current
    emulated vPMU. Because perf owns all the PMU counters. It can mask the
    counter which is assigned to an exclude_guest event when a guest is
    running (Intel way), or set the corresponding HOSTONLY bit in evsentsel
    (AMD way). The counter doesn't count when a guest is running.
    
    However, either way doesn't work with the introduced mediated vPMU.
    A guest owns all the PMU counters when it's running. The host should not
    mask any counters. The counter may be used by the guest. The evsentsel
    may be overwritten.
    
    Perf should explicitly schedule out all exclude_guest events to release
    the PMU resources when entering a guest, and resume the counting when
    exiting the guest.
    
    It's possible that an exclude_guest event is created when a guest is
    running. The new event should not be scheduled in as well.
    
    The ctx time is shared among different PMUs. The time cannot be stopped
    when a guest is running. It is required to calculate the time for events
    from other PMUs, e.g., uncore events. Add timeguest to track the guest
    run time. For an exclude_guest event, the elapsed time equals
    the ctx time - guest time.
    Cgroup has dedicated times. Use the same method to deduct the guest time
    from the cgroup time as well.
    
    [sean: massage comments]
    Co-developed-by: Peter Zijlstra (Intel) 
    Signed-off-by: Kan Liang 
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-7-seanjc@google.com

commit f5c7de8f84a152d559256aa4d0fc953118b73ca4
Author: Kan Liang 
Date:   Fri Dec 5 16:16:41 2025 -0800

    perf: Clean up perf ctx time
    
    The current perf tracks two timestamps for the normal ctx and cgroup.
    The same type of variables and similar codes are used to track the
    timestamps. In the following patch, the third timestamp to track the
    guest time will be introduced.
    To avoid the code duplication, add a new struct perf_time_ctx and factor
    out a generic function update_perf_time_ctx().
    
    No functional change.
    
    Suggested-by: Peter Zijlstra (Intel) 
    Signed-off-by: Kan Liang 
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-6-seanjc@google.com

commit eff95e170275d9e80b968f335cd03d0ac250d2d1
Author: Kan Liang 
Date:   Fri Dec 5 16:16:40 2025 -0800

    perf: Add APIs to create/release mediated guest vPMUs
    
    Currently, exposing PMU capabilities to a KVM guest is done by emulating
    guest PMCs via host perf events, i.e. by having KVM be "just" another user
    of perf.  As a result, the guest and host are effectively competing for
    resources, and emulating guest accesses to vPMU resources requires
    expensive actions (expensive relative to the native instruction).  The
    overhead and resource competition results in degraded guest performance
    and ultimately very poor vPMU accuracy.
    
    To address the issues with the perf-emulated vPMU, introduce a "mediated
    vPMU", where the data plane (PMCs and enable/disable knobs) is exposed
    directly to the guest, but the control plane (event selectors and access
    to fixed counters) is managed by KVM (via MSR interceptions).  To allow
    host perf usage of the PMU to (partially) co-exist with KVM/guest usage
    of the PMU, KVM and perf will coordinate to a world switch between host
    perf context and guest vPMU context near VM-Enter/VM-Exit.
    
    Add two exported APIs, perf_{create,release}_mediated_pmu(), to allow KVM
    to create and release a mediated PMU instance (per VM).  Because host perf
    context will be deactivated while the guest is running, mediated PMU usage
    will be mutually exclusive with perf analysis of the guest, i.e. perf
    events that do NOT exclude the guest will not behave as expected.
    
    To avoid silent failure of !exclude_guest perf events, disallow creating a
    mediated PMU if there are active !exclude_guest events, and on the perf
    side, disallowing creating new !exclude_guest perf events while there is
    at least one active mediated PMU.
    
    Exempt PMU resources that do not support mediated PMU usage, i.e. that are
    outside the scope/view of KVM's vPMU and will not be swapped out while the
    guest is running.
    
    Guard mediated PMU with a new kconfig to help readers identify code paths
    that are unique to mediated PMU support, and to allow for adding arch-
    specific hooks without stubs.  KVM x86 is expected to be the only KVM
    architecture to support a mediated PMU in the near future (e.g. arm64 is
    trending toward a partitioned PMU implementation), and KVM x86 will select
    PERF_GUEST_MEDIATED_PMU unconditionally, i.e. won't need stubs.
    
    Immediately select PERF_GUEST_MEDIATED_PMU when KVM x86 is enabled so that
    all paths are compile tested.  Full KVM support is on its way...
    
    [sean: add kconfig and WARNing, rewrite changelog, swizzle patch ordering]
    Suggested-by: Sean Christopherson 
    Signed-off-by: Kan Liang 
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-5-seanjc@google.com

commit 991bdf7e9d6cc74c1de215d1a05c23ff61076bf0
Author: Sean Christopherson 
Date:   Fri Dec 5 16:16:39 2025 -0800

    perf: Move security_perf_event_free() call to __free_event()
    
    Move the freeing of any security state associated with a perf event from
    _free_event() to __free_event(), i.e. invoke security_perf_event_free() in
    the error paths for perf_event_alloc().  This will allow adding potential
    error paths in perf_event_alloc() that can occur after allocating security
    state.
    
    Note, kfree() and thus security_perf_event_free() is a nop if
    event->security is NULL, i.e. calling security_perf_event_free() even if
    security_perf_event_alloc() fails or is never reached is functionality ok.
    
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-4-seanjc@google.com

commit b9e52b11d2e5e403afaf69a7f8d6b29f8380ed38
Author: Kan Liang 
Date:   Fri Dec 5 16:16:38 2025 -0800

    perf: Add generic exclude_guest support
    
    Only KVM knows the exact time when a guest is entering/exiting. Expose
    two interfaces to KVM to switch the ownership of the PMU resources.
    
    All the pinned events must be scheduled in first. Extend the
    perf_event_sched_in() helper to support extra flag, e.g., EVENT_GUEST.
    
    Signed-off-by: Kan Liang 
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-3-seanjc@google.com

commit b825444b6179eb071e66ca3da5ac12d4dbd808d5
Author: Kan Liang 
Date:   Fri Dec 5 16:16:37 2025 -0800

    perf: Skip pmu_ctx based on event_type
    
    To optimize the cgroup context switch, the perf_event_pmu_context
    iteration skips the PMUs without cgroup events. A bool cgroup was
    introduced to indicate the case. It can work, but this way is hard to
    extend for other cases, e.g. skipping non-mediated PMUs. It doesn't
    make sense to keep adding bool variables.
    
    Pass the event_type instead of the specific bool variable. Check both
    the event_type and related pmu_ctx variables to decide whether skipping
    a PMU.
    
    Event flags, e.g., EVENT_CGROUP, should be cleard in the ctx->is_active.
    Add EVENT_FLAGS to indicate such event flags.
    
    No functional change.
    
    Signed-off-by: Kan Liang 
    Signed-off-by: Mingwei Zhang 
    Signed-off-by: Sean Christopherson 
    Signed-off-by: Peter Zijlstra (Intel) 
    Tested-by: Yongwei Ma 
    Tested-by: Xudong Hao 
    Link: https://patch.msgid.link/20251206001720.468579-2-seanjc@google.com

commit cbd41c6d4c26c161a2b0e70ad411d3885ff13507
Author: Namhyung Kim 
Date:   Tue Dec 9 18:33:27 2025 -0800

    perf report: Update sort key state from -F option
    
    Factor out __sort_dimension__update() so that it can be called from -s
    and -F option parsing logics.  Otherwise the following command cannot go
    into the annotation mode.
    
      $ perf report -F overhead,type,sym
    
      Warning: Annotation is only available for symbolic views, include "sym*" in --sort to use it.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Namhyung Kim 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 5d35d829bb0b19ee51be9732e3b5f81abc7ef3bb
Author: Namhyung Kim 
Date:   Tue Dec 9 18:33:26 2025 -0800

    perf report: Fix histogram entry collapsing for -F option
    
    Users can use -F/--fields option to set output fields and sort keys
    together.
    
    But it missed to set perf_hpp_list->need_collapse for sort entries that
    have se_collapse callbacks.
    
    So it ends up with having duplicated entries separately.
    
    For example, let's run this command first.
    
      $ perf mem record -t load -U -- perf test -w datasym
    
    This will record samples for memory access (load) to struct 'buf' and a
    loop condition ('sig_atomic_t') types.
    
    So the following two commands should have identical output.
    
      $ perf report -s type --stdio --percent-limit=1 -q
          87.80%  perf                  buf
          12.17%  perf                  sig_atomic_t
    
    But using -F option didn't collapse the entries based on types so the
    result looked like below:
    
      $ perf report -F overhead,type --stdio --percent-limit=1 -q
          23.31%  perf                  buf
          22.84%  perf                  buf
          21.26%  perf                  buf
          20.39%  perf                  buf
          12.17%  perf                  sig_atomic_t
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Namhyung Kim 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 9cdc9738d169f82bd4abb638b2ac8690bdee5522
Author: Namhyung Kim 
Date:   Tue Dec 9 18:33:25 2025 -0800

    perf report: Enable data-type profiling with -F option too
    
    It checked -s/--sort options only.  As the sort keys can be setup using
    the -F/--fields option as well, it should enable data-type profiling
    with it too.
    
    The following two commands should have the same output.
    
      $ perf report -s type
    
      $ perf report -F overhead,type
    
    But there's another problem on this.  I'll handle it in the next commit.
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Namhyung Kim 
    Cc: Adrian Hunter 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit bdd051e249141c793dec28544e7f5d5bc7690bf3
Author: Namhyung Kim 
Date:   Tue Dec 9 18:33:24 2025 -0800

    perf record: Split --data-mmap option
    
    Currently -d/--data option controls both PERF_SAMPLE_ADDR bit and
    perf_event_attr.mmap_data flag.  Separate them using new --data-mmap
    option to support recording only one of them.
    
    For data-type profiling, data MMAP is unnecessary but it wastes a lot
    of space in the ring buffer and data file.
    
    Committer testing:
    
    On an idle system:
    
      root@x1:~# perf record -d -a sleep 1
      [ perf record: Woken up 1 times to write data ]
      [ perf record: Captured and wrote 5.672 MB perf.data (1075 samples) ]
      root@x1:~# ls -la perf.data
      -rw-------. 1 root root 5982480 Dec 16 15:34 perf.data
      root@x1:~# perf evlist -v
      cpu_atom/cycles/P: type: 0 (PERF_TYPE_HARDWARE), size: 144, config: 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/), { sample_period, sample_freq }: 4000, sample_type: IP|TID|TIME|ADDR|CPU|PERIOD|IDENTIFIER|DATA_SRC, read_format: ID|LOST, disabled: 1, freq: 1, precise_ip: 3, sample_id_all: 1
      cpu_core/cycles/P: type: 0 (PERF_TYPE_HARDWARE), size: 144, config: 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/), { sample_period, sample_freq }: 4000, sample_type: IP|TID|TIME|ADDR|CPU|PERIOD|IDENTIFIER|DATA_SRC, read_format: ID|LOST, disabled: 1, freq: 1, precise_ip: 3, sample_id_all: 1
      dummy:u: type: 1 (PERF_TYPE_SOFTWARE), size: 144, config: 0x9 (PERF_COUNT_SW_DUMMY), { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|ADDR|CPU|IDENTIFIER|DATA_SRC, read_format: ID|LOST, exclude_kernel: 1, exclude_hv: 1, mmap: 1, comm: 1, task: 1, mmap_data: 1, sample_id_all: 1, exclude_guest: 1, mmap2: 1, comm_exec: 1, ksymbol: 1, bpf_event: 1, build_id: 1
      root@x1:~#
    
    Now with just --data-mmap we will not save that much, as only DATA_SRC
    will not be enabled in sample_type:
    
      root@x1:~# perf record --data-mmap -a sleep 1
      [ perf record: Woken up 1 times to write data ]
      [ perf record: Captured and wrote 5.576 MB perf.data (716 samples) ]
      root@x1:~# ls -la perf.data
      -rw-------. 1 root root 5880112 Dec 16 15:37 perf.data
      root@x1:~# perf evlist -v
      cpu_atom/cycles/P: type: 0 (PERF_TYPE_HARDWARE), size: 144, config: 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/), { sample_period, sample_freq }: 4000, sample_type: IP|TID|TIME|CPU|PERIOD|IDENTIFIER, read_format: ID|LOST, disabled: 1, freq: 1, precise_ip: 3, sample_id_all: 1
      cpu_core/cycles/P: type: 0 (PERF_TYPE_HARDWARE), size: 144, config: 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/), { sample_period, sample_freq }: 4000, sample_type: IP|TID|TIME|CPU|PERIOD|IDENTIFIER, read_format: ID|LOST, disabled: 1, freq: 1, precise_ip: 3, sample_id_all: 1
      dummy:u: type: 1 (PERF_TYPE_SOFTWARE), size: 144, config: 0x9 (PERF_COUNT_SW_DUMMY), { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|IDENTIFIER, read_format: ID|LOST, exclude_kernel: 1, exclude_hv: 1, mmap: 1, comm: 1, task: 1, mmap_data: 1, sample_id_all: 1, exclude_guest: 1, mmap2: 1, comm_exec: 1, ksymbol: 1, bpf_event: 1, build_id: 1
      root@x1:~#
    
    To complete, just with DATA_SRC, no mmap_data:
    
      root@x1:~# perf record --sample-mem-info -a sleep 1
      [ perf record: Woken up 1 times to write data ]
      [ perf record: Captured and wrote 1.407 MB perf.data (1311 samples) ]
      root@x1:~# ls -la perf.data
      -rw-------. 1 root root 1509224 Dec 16 15:40 perf.data
      root@x1:~# perf evlist -v
      cpu_atom/cycles/P: type: 0 (PERF_TYPE_HARDWARE), size: 144, config: 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/), { sample_period, sample_freq }: 4000, sample_type: IP|TID|TIME|CPU|PERIOD|IDENTIFIER|DATA_SRC, read_format: ID|LOST, disabled: 1, freq: 1, precise_ip: 3, sample_id_all: 1
      cpu_core/cycles/P: type: 0 (PERF_TYPE_HARDWARE), size: 144, config: 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/), { sample_period, sample_freq }: 4000, sample_type: IP|TID|TIME|CPU|PERIOD|IDENTIFIER|DATA_SRC, read_format: ID|LOST, disabled: 1, freq: 1, precise_ip: 3, sample_id_all: 1
      dummy:u: type: 1 (PERF_TYPE_SOFTWARE), size: 144, config: 0x9 (PERF_COUNT_SW_DUMMY), { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|CPU|IDENTIFIER|DATA_SRC, read_format: ID|LOST, exclude_kernel: 1, exclude_hv: 1, mmap: 1, comm: 1, task: 1, sample_id_all: 1, exclude_guest: 1, mmap2: 1, comm_exec: 1, ksymbol: 1, bpf_event: 1, build_id: 1
      root@x1:~#
    
    Reviewed-by: Ian Rogers 
    Signed-off-by: Namhyung Kim 
    Tested-by: Arnaldo Carvalho de Melo 
    Cc: Adrian Hunter 
    Cc: Ingo Molnar 
    Cc: James Clark 
    Cc: Jiri Olsa 
    Cc: Peter Zijlstra 
    Signed-off-by: Arnaldo Carvalho de Melo 

commit cddfb3611275697b88031c473d656dc27da34480
Author: Ian Rogers 
Date:   Fri Oct 31 09:26:37 2025 -0700

    perf vendor power9 nest metrics: Correct unit from MB to MiB
    
    6.1e-5 is very close to 1/16384, where 16384 is 2^14, i.e. a power of
    2. When units are in powers of 2 the IEC unit is MiB (mebibytes)
    rather than MB (megabytes) where the values are powers of 10.
    
    This patch corrects the unit for uniformity and because such units may
    be pattern matched against.
    
    Reviewed-by: Madhavan Srinivasan 
    Signed-off-by: Ian Rogers 
    Cc: Athira Rajeev 
    Cc: Kajol Jain 
    Link: https://lore.kernel.org/r/20251031162637.1456191-1-irogers@google.com
    Signed-off-by: Arnaldo Carvalho de Melo 

commit c85eff00cf296c146a2b189166eaf85188cd1487
Author: Arnaldo Carvalho de Melo 
Date:   Thu Dec 11 19:17:56 2025 -0300

    perf trace: Don't change const char strings
    
    We got away with this so far but now with fedora 44 complaining about
    the return value of strchr et all, lets use strdup for good measure.
    
    Reviewed-by: Ian Rogers 
    Link: https://lore.kernel.org/r/20251211221756.96294-5-acme@kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 45718bce7daf39c618188b70a52644bb5a2f968a
Author: Arnaldo Carvalho de Melo 
Date:   Thu Dec 11 19:17:55 2025 -0300

    perf tools: Use const for variables receiving str{str,r?chr}() returns
    
    Newer glibc versions return const char for str{str,chr}() where the
    haystack/s is const so to avoid warnings like these on fedora 44 change
    some variables to const:
    
      36     8.17 fedora:44                     : FAIL gcc version 15.2.1 20251111 (Red Hat 15.2.1-4) (GCC)
        libbpf.c: In function 'kallsyms_cb':
        libbpf.c:8489:13: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
         8489 |         res = strstr(sym_name, ".llvm.");
    
    Reviewed-by: Ian Rogers 
    Link: https://lore.kernel.org/r/20251211221756.96294-4-acme@kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo 

commit f6f41aef53761517391b6192fe5b4bc30b2d717a
Author: Arnaldo Carvalho de Melo 
Date:   Thu Dec 11 19:17:54 2025 -0300

    perf diff: Constify strchr() return variables
    
    Newer glibc versions return const char for strchr() when the 's' arg is
    const, change the return variable to const to match that.
    
    Also we don't need to turn that ',' into a '\0', as strtol() will stop
    in the first invalid char. No need to touch read only memory.
    
    First noticed with fedora 44.
    
    Reviewed-by: Ian Rogers 
    Link: https://lore.kernel.org/r/20251211221756.96294-3-acme@kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo 

commit d311783bc68b011c77a4ef81321de2c94d7deffc
Author: Arnaldo Carvalho de Melo 
Date:   Thu Dec 11 19:17:53 2025 -0300

    perf list: Remove unused 'sep' variable
    
    It is just being set to the return of strchr() but never used, just
    ditch it and with it get rid of a warning about it not being const on
    fedora 44.
    
    Reviewed-by: Ian Rogers 
    Link: https://lore.kernel.org/r/20251211221756.96294-2-acme@kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo 

commit 7f7b350e4a65446f5d52ea8ae99e12eac8a972db
Author: Chen Ni 
Date:   Wed Dec 17 10:37:21 2025 +0800

    spi: stm32-qspi: Remove unneeded semicolon
    
    Remove unnecessary semicolons reported by Coccinelle/coccicheck and the
    semantic patch at scripts/coccinelle/misc/semicolon.cocci.
    
    Signed-off-by: Chen Ni 
    Link: https://patch.msgid.link/20251217023721.1684244-1-nichen@iscas.ac.cn
    Signed-off-by: Mark Brown 

commit d8ce99b0d384830b0eb6b907f5a428309c70af82
Author: Chen Ni 
Date:   Tue Dec 16 12:32:10 2025 +0800

    spi: stm32-ospi: Remove unneeded semicolon
    
    Remove unnecessary semicolons reported by Coccinelle/coccicheck and the
    semantic patch at scripts/coccinelle/misc/semicolon.cocci.
    
    Signed-off-by: Chen Ni 
    Reviewed-by: Patrice Chotard 
    Link: https://patch.msgid.link/20251216043210.1521722-1-nichen@iscas.ac.cn
    Signed-off-by: Mark Brown 

commit 1303c2903889b01d581083ed92e439e7544dd3e5
Author: CL Wang 
Date:   Mon Dec 15 21:23:49 2025 +0800

    MAINTAINERS: Add MAINTAINERS entry for the ATCSPI200 SPI controller driver
    
    MAINTAINERS: Add entry for the Andes ATCSPI200 SPI controller driver
    
    Signed-off-by: CL Wang 
    Link: https://patch.msgid.link/20251215132349.513843-4-cl634@andestech.com
    Signed-off-by: Mark Brown 

commit b2f06783081859b200a853f9682d831b6fc9982d
Author: CL Wang 
Date:   Mon Dec 15 21:23:47 2025 +0800

    spi: dt-bindings: Add support for ATCSPI200 SPI controller
    
    Document devicetree bindings for the Andes ATCSPI200 SPI controller.
    
    Signed-off-by: CL Wang 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251215132349.513843-2-cl634@andestech.com
    Signed-off-by: Mark Brown 

commit 34e3815ea4597131d4324a4aa243d2201e672005
Author: CL Wang 
Date:   Mon Dec 15 21:23:48 2025 +0800

    spi: atcspi200: Add ATCSPI200 SPI controller driver
    
    Add driver for the Andes ATCSPI200 SPI controller.
    
    Signed-off-by: CL Wang 
    Link: https://patch.msgid.link/20251215132349.513843-3-cl634@andestech.com
    Signed-off-by: Mark Brown 

commit 29c8c00d9f9db5fb659b6f05f9e8964afc13f3e2
Author: Haibo Chen 
Date:   Tue Dec 16 11:20:14 2025 +0800

    spi: add driver for NXP XSPI controller
    
    Add driver support for NXP XSPI controller.
    
    XSPI is a flexible SPI host controller which supports up to
    2 external devices (2 CS). It support Single/Dual/Quad/Octal
    mode data transfer.
    
    The difference between XSPI and Flexspi:
    1.the register layout is total different.
    2.XSPI support multiple independent execution environments
    (EENVs) for HW virtualization with some limitations. Each EENV
    has its own interrupt and its own set of programming registers
    that exists in a specific offset range in the XSPI memory map.
    The main environment (EENV0) address space contains all of the
    registers for controlling EENV0 plus all of the general XSPI
    control and programming registers. The register mnemonics for
    the user environments (EENV1 to EENV4) have "_SUB_n" appended
    to the mnemonic for the corresponding main-environment register.
    
    Current driver based on EENV0, which means system already give
    EENV0 right to linux.
    
    This driver use SPI memory interface of the SPI framework to
    issue flash memory operations. Tested this driver with UBIFS
    and mtd_debug on NXP i.MX943 EVK board which has one spi nor
    MT35XU512ABA flash. Now this driver has the following key
    features:
    - Support up to OCT DDR mode
    - Support AHB read
    - Support IP read and IP write
    - Support two CS
    
    Reviewed-by: Frank Li 
    Signed-off-by: Haibo Chen 
    Link: https://patch.msgid.link/20251216-xspi-v7-2-282525220979@nxp.com
    Signed-off-by: Mark Brown 

commit 64ba616741bcfc4c7ef1ed856179328300ca0422
Author: Haibo Chen 
Date:   Tue Dec 16 11:20:13 2025 +0800

    spi: dt-bindings: nxp,imx94-xspi: Document imx94 xspi
    
    Document imx94 xspi that supports interface to serial flash
    supporting following features:
    
    - Single-bit SPI, Dual SPI, Quad SPI and Octal SPI.
    - Single Data Rate or Double Data Rate modes.
    - Direct memory mapping of all AHB memory accesses to the
      chip system memory space.
    - Multi-master AHB accesses with priority.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Haibo Chen 
    Link: https://patch.msgid.link/20251216-xspi-v7-1-282525220979@nxp.com
    Signed-off-by: Mark Brown 

commit f764645cb85a8b8f58067289cdfed28f6c1cdf49
Author: Kuninori Morimoto 
Date:   Tue Dec 16 06:24:32 2025 +0000

    ASoC: codecs: tas2780: tidyup format check in tas2780_set_fmt()
    
    Current code is using messy code to check format. Let's cleanup
    it by using switch().
    
    Signed-off-by: Kuninori Morimoto 
    Link: https://patch.msgid.link/87h5trrljz.wl-kuninori.morimoto.gx@renesas.com
    Signed-off-by: Mark Brown 

commit 3e43a8c033c3187e0f441ed5570a0fb5dcc9dafb
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 10:46:04 2025 +0100

    ASoC: qcom: audioreach: Add support for VI Sense module
    
    VI Sense module in ADSP is responsible for feedback loop for measuring
    current and voltage of amplifiers, necessary for proper calibration of
    Speaker Protection algorightms.  Implement parsing
    MODULE_ID_SPEAKER_PROTECTION_VI from Audioreach topology and sending it
    as command to the ADSP.
    
    Reviewed-by: Srinivas Kandagatla 
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251217094602.55117-4-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 0db76f5b2235ab456814ee8e4e2cdf0cef09dd6b
Author: Krzysztof Kozlowski 
Date:   Wed Dec 17 10:46:03 2025 +0100

    ASoC: qcom: audioreach: Add support for Speaker Protection module
    
    Speaker Protection is capability of ADSP to adjust the gain during
    playback to different speakers and their temperature.  This allows good
    playback without blowing the speakers up.
    
    Implement parsing MODULE_ID_SPEAKER_PROTECTION from Audioreach topology
    and sending it as command to the ADSP.
    
    Reviewed-by: Srinivas Kandagatla 
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251217094602.55117-3-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 9a123f222e1889d020d873aa6e0799098d22cdb1
Author: Richard Fitzgerald 
Date:   Mon Dec 1 12:39:06 2025 +0000

    ASoC: cs-amp-lib: Replace __free(kfree) with normal kfree() cleanup
    
    Replace the use of __free(kfree) in _cs_amp_set_efi_calibration_data()
    with normal kfree() at the end of the function.
    
    Krzysztof Kozlowski pointed out that __free() can be dangerous.
    It can introduce new cleanup bugs. These are more subtle and difficult to
    spot than a missing goto in traditional cleanup, because they are triggered
    by writing regular idiomatic C code instead of using C++ conventions. As
    it's regular C style it's more likely to be missed because the code is as
    would be expected for C. The traditional goto also more obviously flags
    to anyone changing the code in the future that they must be careful about
    the cleanup.
    
    Arguably the traditional approach is more readable, and it avoids the
    manipulation of __free() pointers when the buffer is reallocated for
    resizing.
    
    Signed-off-by: Richard Fitzgerald 
    Link: https://patch.msgid.link/20251201123906.86876-1-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 22937af75abb3260c2d563739181f4b61ddac2c1
Author: Shuming Fan 
Date:   Tue Dec 16 17:06:30 2025 +0800

    ASoC: rt1320: support RAE parameters loading
    
    This patch supports the RAE parameters loading.
    The RAE parameters is related to EQ/DRC parameters for each endpoint.
    The driver could load these parameters from the binary file.
    
    Signed-off-by: Shuming Fan 
    Link: https://patch.msgid.link/20251216090630.3955323-1-shumingf@realtek.com
    Signed-off-by: Mark Brown 

commit 87783532d34050e2bff6749a4fe9860e624a0540
Author: Simon Trimmer 
Date:   Tue Dec 16 14:22:04 2025 +0000

    ASoC: SDCA: Allow sample width wild cards in set_usage()
    
    The SDCA spec allows the sample rate and width to be wild cards, but the
    current implementation of set_usage() only checked for a wild card of
    the sample rate.
    
    Fixes: 4ed357f72a0e ("ASoC: SDCA: Add hw_params() helper function")
    Signed-off-by: Simon Trimmer 
    Reviewed-by: Charles Keepax 
    Link: https://patch.msgid.link/20251216142204.183958-1-simont@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit da1682d5e8b53a51072552844c551b1b784e52c2
Author: Shuming Fan 
Date:   Tue Dec 16 17:06:16 2025 +0800

    ASoC: rt1320: support calibration and temperature/r0 loading
    
    This patch adds the functions/controls to support the calibration.
    The mixer controls could trigger a calibration and load temperature/r0 value.
    
    Signed-off-by: Shuming Fan 
    Link: https://patch.msgid.link/20251216090616.3955293-1-shumingf@realtek.com
    Signed-off-by: Mark Brown 

commit 3a4e4e0003678a87600e82d02c9522af282a5c0b
Author: HariKrishna Sagala 
Date:   Wed Dec 17 16:13:58 2025 +0530

    ASoC: codec: rt298: Use devm_request_threaded_irq to manage IRQ lifetime and fix smatch warning
    
    Replace manual "request_threaded_irq()" with the device managed
    "devm_request_threaded_irq" to manage the IRQ lifetime and also
    it removes the smatch reported warning.
    Remove the manual "free_irq()" in the "remove" function as free_irq
    is tied to device teardown.
    
    Signed-off-by: HariKrishna Sagala 
    Link: https://patch.msgid.link/20251217104356.60839-3-hariconscious@gmail.com
    Signed-off-by: Mark Brown 

commit 02e7af5b6423d2dbf82f852572f2fa8c00aafb19
Author: David Lin 
Date:   Wed Dec 17 19:04:32 2025 +0800

    ASoC: Intel: sof_rt5682: add tas2563 speaker amp support
    
    This patch adds tas2563 which supports the RT5682 headset codec
    and TAS2563 speaker amplifier combination on PantherLake platform.
    
    Signed-off-by: David Lin 
    Reviewed-by: Péter Ujfalusi 
    Signed-off-by: Bard Liao 
    Link: https://patch.msgid.link/20251217110433.3558136-3-yung-chuan.liao@linux.intel.com
    Signed-off-by: Mark Brown 

commit 331786db1b464fae42c36f53d6901d1d54975e04
Author: David Lin 
Date:   Wed Dec 17 19:04:31 2025 +0800

    ASoC: Intel: ti-common: support tas2563 amplifier
    
    Implement tas2563 support code in this common module so it could be
    shared between multiple SOF machine drivers.
    
    Signed-off-by: David Lin 
    Reviewed-by: Péter Ujfalusi 
    Signed-off-by: Bard Liao 
    Link: https://patch.msgid.link/20251217110433.3558136-2-yung-chuan.liao@linux.intel.com
    Signed-off-by: Mark Brown 

commit 9a6bc0a406608e2520f18d996483c9d2e4a9fb27
Author: Zhang Yi 
Date:   Tue Dec 16 14:47:21 2025 +0800

    ASoC: codecs: ES8326: Add kcontrol for DRE
    
    Set up a kcontrol to control DRE
    
    Signed-off-by: Zhang Yi 
    Link: https://patch.msgid.link/20251216064721.4622-3-zhangyi@everest-semi.com
    Signed-off-by: Mark Brown 

commit 68970b53890c877c61686c86fe28cc3a142c1584
Author: Zhang Yi 
Date:   Tue Dec 16 14:47:20 2025 +0800

    ASoC: codecs: ES8326: Add a kcontrol for PGAGAIN
    
    set a kcontrol to control bit 7 of ES8326_PGAGAIN
    instead of setting a fixed value in the driver
    
    Signed-off-by: Zhang Yi 
    Link: https://patch.msgid.link/20251216064721.4622-2-zhangyi@everest-semi.com
    Signed-off-by: Mark Brown 

commit 1862d8e264def8425d682f1177e22f9fe7d947ea
Author: Peter Zijlstra 
Date:   Wed Dec 17 11:24:11 2025 +0100

    sched: Fix faulty assertion in sched_change_end()
    
    Commit 47efe2ddccb1f ("sched/core: Add assertions to QUEUE_CLASS") added an
    assert to sched_change_end() verifying that a class demotion would result in a
    reschedule.
    
    As it turns out; rt_mutex_setprio() does not force a resched on class
    demontion. Furthermore, this is only relevant to running tasks.
    
    Change the warning into a reschedule and make sure to only do so for running
    tasks.
    
    Fixes: 47efe2ddccb1f ("sched/core: Add assertions to QUEUE_CLASS")
    Reported-by: Naresh Kamboju 
    Tested-by:  Linux Kernel Functional Testing 
    Signed-off-by: Peter Zijlstra (Intel) 
    Link: https://patch.msgid.link/20251216141725.GW3707837@noisy.programming.kicks-ass.net

commit 704069649b5bfb7bf1fe32c0281fe9036806a59a
Author: Peter Zijlstra 
Date:   Wed Dec 10 09:06:50 2025 +0100

    sched/core: Rework sched_class::wakeup_preempt() and rq_modified_*()
    
    Change sched_class::wakeup_preempt() to also get called for
    cross-class wakeups, specifically those where the woken task
    is of a higher class than the previous highest class.
    
    In order to do this, track the current highest class of the runqueue
    in rq::next_class and have wakeup_preempt() track this upwards for
    each new wakeup. Additionally have schedule() re-set the value on
    pick.
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/20251127154725.901391274@infradead.org

commit 3203d8f573af87d8c967d36e8d5016ef306ff078
Author: Rosen Penev 
Date:   Tue Dec 16 22:32:28 2025 -0800

    gpio: realtek-otto: add COMPILE_TEST
    
    Allows the buildbots to test compilation.
    
    Signed-off-by: Rosen Penev 
    Link: https://lore.kernel.org/r/20251217063229.38175-3-rosenp@gmail.com
    Signed-off-by: Bartosz Golaszewski 

commit 0eaf298143684da68a61b2633121b3deff47b267
Author: Christophe JAILLET 
Date:   Sun Dec 14 10:31:40 2025 +0100

    gpio: Constify struct configfs_item_operations and configfs_group_operations
    
    'struct configfs_item_operations' and 'configfs_group_operations' are not
    modified in these drivers.
    
    Constifying these structures moves some data to a read-only section, so
    increases overall security, especially when the structure holds some
    function pointers.
    
    On a x86_64, with allmodconfig, as an example:
    Before:
    ======
       text    data     bss     dec     hex filename
      43935   11632     384   55951    da8f drivers/gpio/gpio-aggregator.o
    
    After:
    =====
       text    data     bss     dec     hex filename
      44191   11376     384   55951    da8f drivers/gpio/gpio-aggregator.o
    
    Signed-off-by: Christophe JAILLET 
    Link: https://lore.kernel.org/r/ccb5155342ce6dbb89cfbad0687b448860d8e8f0.1765703044.git.christophe.jaillet@wanadoo.fr
    Signed-off-by: Bartosz Golaszewski 

commit 77f25f0c2e1f59b35600b4d29bd6b2c54c31ab75
Author: Daniel Palmer 
Date:   Sun Dec 14 12:40:45 2025 +0900

    gpiolib: of: Only compile in MT2701 quirk when it is needed.
    
    The compiler cannot workout if this is actually needed or not
    so machines that will never need this code also get it.
    
    For example:
    m68k-linux-gnu-nm vmlinux | grep mt27
    00135742 t of_find_mt2701_gpio
    
    Add some ugly ifdef'ery to get rid of it.
    
    Signed-off-by: Daniel Palmer 
    Link: https://lore.kernel.org/r/20251214034045.4029590-1-daniel@thingy.jp
    Signed-off-by: Bartosz Golaszewski 

commit 7a29af24b288eace769ccd9eb8044742dfbd5944
Author: Bartosz Golaszewski 
Date:   Fri Dec 12 04:26:46 2025 +0100

    eeprom: at24: use dev_err_probe() consistently
    
    Save some lines by consistently using dev_err_probe() when bailing out
    with an error message.
    
    Link: https://lore.kernel.org/r/20251212032646.49336-1-bartosz.golaszewski@oss.qualcomm.com
    Signed-off-by: Bartosz Golaszewski 

commit 30116121412b1aef99899bacb51f7ccf2511f223
Author: Luca Weiss 
Date:   Wed Dec 10 10:05:27 2025 +0900

    dt-bindings: eeprom: at24: Add compatible for Giantec GT24P64A
    
    Add the compatible for another 64Kb EEPROM from Giantec.
    
    Signed-off-by: Luca Weiss 
    Acked-by: Rob Herring (Arm) 
    Link: https://lore.kernel.org/r/20251210-fp4-cam-prep-v1-1-0eacbff271ec@fairphone.com
    Signed-off-by: Bartosz Golaszewski 

commit 41acc4dd8a04af332416b59a4cdb4780b7716ff1
Author: FUKAUMI Naoki 
Date:   Tue Dec 2 08:49:39 2025 +0000

    dt-bindings: eeprom: at24: Add compatible for Belling BL24C04A/BL24C16F
    
    Add the compatible for Belling BL24C04A 4Kb EEPROM and BL24C16F 16Kb
    EEPROM.
    
    Signed-off-by: FUKAUMI Naoki 
    Acked-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251202084941.1785-2-naoki@radxa.com
    Signed-off-by: Bartosz Golaszewski 

commit 30eb99dfd3439f25d0f79815f7f859da03fc8fff
Author: Uwe Kleine-König 
Date:   Wed Dec 10 08:02:53 2025 +0100

    gpio: stub: Drop empty probe function
    
    A probe callback that just returns 0 does the same as not having a probe
    callback at all. So gpio_stub_drv_probe() can be dropped without side
    effects.
    
    Signed-off-by: Uwe Kleine-König 
    Link: https://lore.kernel.org/r/20251210070255.484169-2-u.kleine-koenig@baylibre.com
    Signed-off-by: Bartosz Golaszewski 

commit 03f705b9ca58b91c6dffe64875ea3d9a38cad9b5
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:33 2025 +0100

    ALSA: usb-audio: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Note that there are still a few remaining __free(kfree) with NULL
    initializations; they are because of the code complexity (the data
    size calculation).
    
    Fixes: 43d4940c944c ("ALSA: usb: scarlett2: Clean ups with guard() and __free()")
    Fixes: 46757a3e7d50 ("ALSA: FCP: Add Focusrite Control Protocol driver")
    Fixes: f7d306b47a24 ("ALSA: usb-audio: Fix a DMA to stack memory bug")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-12-tiwai@suse.de

commit 43cc944c8e28d26f152198278f81cf7f9955ff85
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:32 2025 +0100

    ALSA: usx2y: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Fixes: 67afec157fe6 ("ALSA: usb-audio: us144mkii: Add MIDI support and mixer controlsj")
    Fixes: a2a2210f2c2e ("ALSA: usb-audio: us144mkii: Implement audio playback and feedback")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-11-tiwai@suse.de

commit 04c654624f41d3c3eee48e9837a52d8a2bbc7332
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:31 2025 +0100

    ALSA: hda: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Fixes: ee0b0f5d32fe ("ALSA: hda/generic: Use auto cleanup for temporary buffers")
    Fixes: 03c5c350e38d ("ALSA: hda/realtek: Add support for new HP G12 laptops")
    Fixes: b0550d4c2dd8 ("ALSA: hda/common: Use auto cleanup for temporary buffers")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-10-tiwai@suse.de

commit 3b7c7bda39e1e48f926fb3d280a5f5d20a939857
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:30 2025 +0100

    ALSA: vmaster: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Fixes: fb9e197f3f27 ("ALSA: vmaster: Use automatic cleanup of kfree()")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-9-tiwai@suse.de

commit b1bf8ac5319010e0f73183bdb78c1daf5552c8cb
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:29 2025 +0100

    ALSA: timer: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Fixes: ed96f6394e1b ("ALSA: timer: Use automatic cleanup of kfree()")
    Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-8-tiwai@suse.de

commit 13bc5c5394b22fd0a0585733bbbd9266159a840c
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:28 2025 +0100

    ALSA: seq: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Note that there is a remaining __free() with NULL initialization; it's
    because of the non-trivial code conditionally assigning the data.
    
    Fixes: 04a86185b785 ("ALSA: seq: Clean up queue locking with auto cleanup")
    Fixes: 0869afc958a0 ("ALSA: seq: Clean up port locking with auto cleanup")
    Fixes: 99e16633958b ("ALSA: seq: Use auto-cleanup for client refcounting")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-7-tiwai@suse.de

commit df27c92753474cc8540e46a476119857ced7ae21
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:27 2025 +0100

    ALSA: seq: oss: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Fixes: 80ccbe91adab ("ALSA: seq: oss/synth: Clean up with guard and auto cleanup")
    Fixes: 895a46e034f9 ("ALSA: seq: oss/midi: Cleanup with guard and auto-cleanup")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-6-tiwai@suse.de

commit 55f98ece9939a0ad5f83c6124dd1f00d678f9f46
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:26 2025 +0100

    ALSA: oss: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Fixes: a55bc334d3df ("ALSA: pcm_oss: ump: Use automatic cleanup of kfree()")
    Fixes: 6c40eec521af ("ALSA: mixer_oss: ump: Use automatic cleanup of kfree()")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-5-tiwai@suse.de

commit f3d233daf011abbad2f6ebd0e545b42d2f378a4f
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:25 2025 +0100

    ALSA: pcm: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Fixes: ae9213984864 ("ALSA: pcm: Use automatic cleanup of kfree()")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-4-tiwai@suse.de

commit 7b4721ca3159bce6338dbdf9188b785083571ed4
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:24 2025 +0100

    ALSA: control: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment (or
    directly assign the allocated result) instead of NULL initializations.
    
    Fixes: 7dba48a474e6 ("ALSA: control_led: Use guard() for locking")
    Fixes: 1052d9882269 ("ALSA: control: Use automatic cleanup of kfree()")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-3-tiwai@suse.de

commit 14324b8f0760ca6f56202bb4ad356ec459ce165b
Author: Takashi Iwai 
Date:   Tue Dec 16 15:06:23 2025 +0100

    ALSA: compress_offload: Relax __free() variable declarations
    
    We used to have a variable declaration with __free() initialized with
    NULL.  This was to keep the old coding style rule, but recently it's
    relaxed and rather recommends to follow the new rule to declare in
    place of use for __free() -- which avoids potential deadlocks or UAFs
    with nested cleanups.
    
    Although the current code has no bug, per se, let's follow the new
    standard and move the declaration to the place of assignment.
    
    Fixes: 9b02221422a5 ("ALSA: compress_offload: Use automatic cleanup of kfree()")
    Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode")
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/20251216140634.171890-2-tiwai@suse.de

commit 1b06942cda6e83c055e4530fec8227f6e2aba13e
Author: Krzysztof Kozlowski 
Date:   Tue Aug 19 15:17:27 2025 +0200

    arm64: dts: nuvoton: npcm845: Minor whitespace cleanup
    
    The DTS code coding style expects exactly one space around '='
    character.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20250819131725.86770-4-krzysztof.kozlowski@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit ec439c38013550420aecc15988ae6acb670838c1
Merge: e7a0adb03dfe18 ea1013c1539270
Author: Alexei Starovoitov 
Date:   Tue Dec 16 21:29:38 2025 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after 6.19-rc1
    
    Cross-merge BPF and other fixes after downstream PR.
    
    Signed-off-by: Alexei Starovoitov 

commit 459a5aa171c0f13fcd78faa9594dc4aa5a95770b
Author: Cosmo Chou 
Date:   Wed Dec 17 10:39:38 2025 +0800

    ARM: dts: aspeed: bletchley: Fix ADC vref property names
    
    Replace non-functional 'vref' with 'aspeed,int-vref-microvolt'
    using the default 2.5V that the driver was already applying.
    
    Signed-off-by: Cosmo Chou 
    Signed-off-by: Andrew Jeffery 

commit 7c98d5c619c44e772402028dd852079aa8950842
Author: Cosmo Chou 
Date:   Wed Dec 17 10:39:37 2025 +0800

    ARM: dts: aspeed: bletchley: Remove unused i2c13 property
    
    Remove 'aspeed,hw-timeout-ms' property which is not supported by
    the driver and causes dt-schema warnings.
    
    Signed-off-by: Cosmo Chou 
    Signed-off-by: Andrew Jeffery 

commit ca6730c4702e9719f4d8621bc76ca31c9bfe2c57
Author: Cosmo Chou 
Date:   Wed Dec 17 10:39:36 2025 +0800

    ARM: dts: aspeed: bletchley: Remove unused pca9539 properties
    
    Remove unused #address-cells and #size-cells properties from
    pca9539 nodes to fix dt-schema warnings.
    
    Signed-off-by: Cosmo Chou 
    Signed-off-by: Andrew Jeffery 

commit 9d2c128ec56696cd7729845f17a4eaf537ae4438
Author: Cosmo Chou 
Date:   Wed Dec 17 10:39:35 2025 +0800

    ARM: dts: aspeed: bletchley: Fix SPI GPIO property names
    
    Update SPI GPIO properties to use "-gpios" suffix:
    - gpio-sck -> sck-gpios
    - gpio-mosi -> mosi-gpios
    - gpio-miso -> miso-gpios
    
    Signed-off-by: Cosmo Chou 
    Signed-off-by: Andrew Jeffery 

commit 6ac23b72cadac23657d466939c4d06cbfdf411cf
Author: Cosmo Chou 
Date:   Wed Dec 17 10:39:34 2025 +0800

    ARM: dts: aspeed: bletchley: Use generic node names
    
    Use generic node names to fix dt-schema warnings:
    - spi1_gpio: rename to generic "spi" node name
    - LED nodes: rename to led-N and move names to label properties
    - GPIO key nodes: add "-switch" suffix to node names
    
    Signed-off-by: Cosmo Chou 
    Signed-off-by: Andrew Jeffery 

commit 8334f93075dce0a4536c096a7d471ef90506a7a4
Merge: 0f9c4be787f786 1732d10fa7edb6
Author: Martin K. Petersen 
Date:   Tue Dec 16 22:35:32 2025 -0500

    Merge patch series "qla2xxx: Misc feature and bug fixes"
    
    Nilesh Javali  says:
    
    Hello Martin,
    
    Please apply the qla2xxx driver load flash FW mailbox support
    along with miscellaneous bug fixes to the scsi tree at your
    earliest convenience.
    
    Link: https://patch.msgid.link/20251210101604.431868-1-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit 1732d10fa7edb611c8384ca0b841d6f79ddf5bed
Author: Nilesh Javali 
Date:   Wed Dec 10 15:46:04 2025 +0530

    scsi: qla2xxx: Update version to 10.02.10.100-k
    
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-13-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0
Author: Anil Gurumurthy 
Date:   Wed Dec 10 15:46:03 2025 +0530

    scsi: qla2xxx: Fix bsg_done() causing double free
    
    Kernel panic observed on system,
    
    [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000
    [5353358.825194] #PF: supervisor write access in kernel mode
    [5353358.825195] #PF: error_code(0x0002) - not-present page
    [5353358.825196] PGD 100006067 P4D 0
    [5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI
    [5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G        W    L    -------  ---  5.14.0-503.34.1.el9_5.x86_64 #1
    [5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025
    [5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10
    [5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246
    [5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000
    [5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000
    [5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000
    [5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090
    [5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000
    [5353358.825218] FS:  00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000
    [5353358.825219] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0
    [5353358.825221] PKRU: 55555554
    [5353358.825222] Call Trace:
    [5353358.825223]  
    [5353358.825224]  ? show_trace_log_lvl+0x1c4/0x2df
    [5353358.825229]  ? show_trace_log_lvl+0x1c4/0x2df
    [5353358.825232]  ? sg_copy_buffer+0xc8/0x110
    [5353358.825236]  ? __die_body.cold+0x8/0xd
    [5353358.825238]  ? page_fault_oops+0x134/0x170
    [5353358.825242]  ? kernelmode_fixup_or_oops+0x84/0x110
    [5353358.825244]  ? exc_page_fault+0xa8/0x150
    [5353358.825247]  ? asm_exc_page_fault+0x22/0x30
    [5353358.825252]  ? memcpy_erms+0x6/0x10
    [5353358.825253]  sg_copy_buffer+0xc8/0x110
    [5353358.825259]  qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx]
    [5353358.825317]  qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx]
    
    Most routines in qla_bsg.c call bsg_done() only for success cases.
    However a few invoke it for failure case as well leading to a double
    free. Validate before calling bsg_done().
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Anil Gurumurthy 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-12-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit 42b2dab4340d39b71334151e10c6d7d9b0040ffa
Author: Anil Gurumurthy 
Date:   Wed Dec 10 15:46:02 2025 +0530

    scsi: qla2xxx: Query FW again before proceeding with login
    
    Issue occurred during a continuous reboot test of several thousand
    iterations specific to a fabric topo with dual mode target where it
    sends a PLOGI/PRLI and then sends a LOGO. The initiator was also in the
    process of discovery and sent a PLOGI to the switch. It then queried a
    list of ports logged in via mbx 75h and the GPDB response indicated that
    the target was logged in. This caused a mismatch in the states between
    the driver and FW.  Requery the FW for the state and proceed with the
    rest of discovery process.
    
    Fixes: a4239945b8ad ("scsi: qla2xxx: Add switch command to simplify fabric discovery")
    Cc: stable@vger.kernel.org
    Signed-off-by: Anil Gurumurthy 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-11-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit b6df15aec8c3441357d4da0eaf4339eb20f5999f
Author: Anil Gurumurthy 
Date:   Wed Dec 10 15:46:01 2025 +0530

    scsi: qla2xxx: Validate sp before freeing associated memory
    
    System crash with the following signature
    [154563.214890] nvme nvme2: NVME-FC{1}: controller connect complete
    [154564.169363] qla2xxx [0000:b0:00.1]-3002:2: nvme: Sched: Set ZIO exchange threshold to 3.
    [154564.169405] qla2xxx [0000:b0:00.1]-ffffff:2: SET ZIO Activity exchange threshold to 5.
    [154565.539974] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 0080 0000.
    [154565.545744] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 00a0 0000.
    [154565.545857] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate).
    [154565.552760] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate).
    [154565.553079] BUG: kernel NULL pointer dereference, address: 00000000000000f8
    [154565.553080] #PF: supervisor read access in kernel mode
    [154565.553082] #PF: error_code(0x0000) - not-present page
    [154565.553084] PGD 80000010488ab067 P4D 80000010488ab067 PUD 104978a067 PMD 0
    [154565.553089] Oops: 0000 1 PREEMPT SMP PTI
    [154565.553092] CPU: 10 PID: 858 Comm: qla2xxx_2_dpc Kdump: loaded Tainted: G           OE     -------  ---  5.14.0-503.11.1.el9_5.x86_64 #1
    [154565.553096] Hardware name: HPE Synergy 660 Gen10/Synergy 660 Gen10 Compute Module, BIOS I43 09/30/2024
    [154565.553097] RIP: 0010:qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx]
    [154565.553141] Code: 00 00 e8 58 a3 ec d4 49 89 e9 ba 12 20 00 00 4c 89 e6 49 c7 c0 00 ee a8 c0 48 c7 c1 66 c0 a9 c0 bf 00 80 00 10 e8 15 69 00 00 <4c> 8b 8d f8 00 00 00 4d 85 c9 74 35 49 8b 84 24 00 19 00 00 48 8b
    [154565.553143] RSP: 0018:ffffb4dbc8aebdd0 EFLAGS: 00010286
    [154565.553145] RAX: 0000000000000000 RBX: ffff8ec2cf0908d0 RCX: 0000000000000002
    [154565.553147] RDX: 0000000000000000 RSI: ffffffffc0a9c896 RDI: ffffb4dbc8aebd47
    [154565.553148] RBP: 0000000000000000 R08: ffffb4dbc8aebd45 R09: 0000000000ffff0a
    [154565.553150] R10: 0000000000000000 R11: 000000000000000f R12: ffff8ec2cf0908d0
    [154565.553151] R13: ffff8ec2cf090900 R14: 0000000000000102 R15: ffff8ec2cf084000
    [154565.553152] FS:  0000000000000000(0000) GS:ffff8ed27f800000(0000) knlGS:0000000000000000
    [154565.553154] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [154565.553155] CR2: 00000000000000f8 CR3: 000000113ae0a005 CR4: 00000000007706f0
    [154565.553157] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [154565.553158] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    [154565.553159] PKRU: 55555554
    [154565.553160] Call Trace:
    [154565.553162]  
    [154565.553165]  ? show_trace_log_lvl+0x1c4/0x2df
    [154565.553172]  ? show_trace_log_lvl+0x1c4/0x2df
    [154565.553177]  ? qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx]
    [154565.553215]  ? __die_body.cold+0x8/0xd
    [154565.553218]  ? page_fault_oops+0x134/0x170
    [154565.553223]  ? snprintf+0x49/0x70
    [154565.553229]  ? exc_page_fault+0x62/0x150
    [154565.553238]  ? asm_exc_page_fault+0x22/0x30
    
    Check for sp being non NULL before freeing any associated memory
    
    Fixes: a4239945b8ad ("scsi: qla2xxx: Add switch command to simplify fabric discovery")
    Cc: stable@vger.kernel.org
    Signed-off-by: Anil Gurumurthy 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-10-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit 7adbd2b7809066c75f0433e5e2a8e114b429f30f
Author: Anil Gurumurthy 
Date:   Wed Dec 10 15:46:00 2025 +0530

    scsi: qla2xxx: Free sp in error path to fix system crash
    
    System crash seen during load/unload test in a loop,
    
    [61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X.
    [61110.467494] =============================================================================
    [61110.467498] BUG qla2xxx_srbs (Tainted: G           OE    --------  --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown()
    [61110.467501] -----------------------------------------------------------------------------
    
    [61110.467502] Slab 0x000000000ffc8162 objects=51 used=1 fp=0x00000000e25d3d85 flags=0x57ffffc0010200(slab|head|node=1|zone=2|lastcpupid=0x1fffff)
    [61110.467509] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G           OE    --------  ---  5.14.0-284.11.1.el9_2.x86_64 #1
    [61110.467513] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023
    [61110.467515] Call Trace:
    [61110.467516]  
    [61110.467519]  dump_stack_lvl+0x34/0x48
    [61110.467526]  slab_err.cold+0x53/0x67
    [61110.467534]  __kmem_cache_shutdown+0x16e/0x320
    [61110.467540]  kmem_cache_destroy+0x51/0x160
    [61110.467544]  qla2x00_module_exit+0x93/0x99 [qla2xxx]
    [61110.467607]  ? __do_sys_delete_module.constprop.0+0x178/0x280
    [61110.467613]  ? syscall_trace_enter.constprop.0+0x145/0x1d0
    [61110.467616]  ? do_syscall_64+0x5c/0x90
    [61110.467619]  ? exc_page_fault+0x62/0x150
    [61110.467622]  ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
    [61110.467626]  
    [61110.467627] Disabling lock debugging due to kernel taint
    [61110.467635] Object 0x0000000026f7e6e6 @offset=16000
    [61110.467639] ------------[ cut here ]------------
    [61110.467639] kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects when called from qla2x00_module_exit+0x93/0x99 [qla2xxx]
    [61110.467659] WARNING: CPU: 53 PID: 455206 at mm/slab_common.c:520 kmem_cache_destroy+0x14d/0x160
    [61110.467718] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G    B      OE    --------  ---  5.14.0-284.11.1.el9_2.x86_64 #1
    [61110.467720] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023
    [61110.467721] RIP: 0010:kmem_cache_destroy+0x14d/0x160
    [61110.467724] Code: 99 7d 07 00 48 89 ef e8 e1 6a 07 00 eb b3 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 70 fc 66 90 48 c7 c7 f8 ef a1 90 e8 e1 ed 7c 00 <0f> 0b eb 93 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 55 48 89
    [61110.467725] RSP: 0018:ffffa304e489fe80 EFLAGS: 00010282
    [61110.467727] RAX: 0000000000000000 RBX: ffffffffc0d9a860 RCX: 0000000000000027
    [61110.467729] RDX: ffff8fd5ff9598a8 RSI: 0000000000000001 RDI: ffff8fd5ff9598a0
    [61110.467730] RBP: ffff8fb6aaf78700 R08: 0000000000000000 R09: 0000000100d863b7
    [61110.467731] R10: ffffa304e489fd20 R11: ffffffff913bef48 R12: 0000000040002000
    [61110.467731] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
    [61110.467733] FS:  00007f64c89fb740(0000) GS:ffff8fd5ff940000(0000) knlGS:0000000000000000
    [61110.467734] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [61110.467735] CR2: 00007f0f02bfe000 CR3: 00000020ad6dc005 CR4: 0000000000770ee0
    [61110.467736] PKRU: 55555554
    [61110.467737] Call Trace:
    [61110.467738]  
    [61110.467739]  qla2x00_module_exit+0x93/0x99 [qla2xxx]
    [61110.467755]  ? __do_sys_delete_module.constprop.0+0x178/0x280
    
    Free sp in the error path to fix the crash.
    
    Fixes: f352eeb75419 ("scsi: qla2xxx: Add ability to use GPNFT/GNNFT for RSCN handling")
    Cc: stable@vger.kernel.org
    Signed-off-by: Anil Gurumurthy 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-9-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit 8890bf450e0b6b283f48ac619fca5ac2f14ddd62
Author: Anil Gurumurthy 
Date:   Wed Dec 10 15:45:59 2025 +0530

    scsi: qla2xxx: Delay module unload while fabric scan in progress
    
    System crash seen during load/unload test in a loop.
    
    [105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086
    [105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0
    [105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000
    [105954.384923] FS:  0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000
    [105954.384925] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0
    [105954.384928] PKRU: 55555554
    [105954.384929] Call Trace:
    [105954.384931]  
    [105954.384934]  qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx]
    [105954.384962]  ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx]
    [105954.384980]  ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx]
    [105954.384999]  ? __wake_up_common+0x80/0x190
    [105954.385004]  ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx]
    [105954.385023]  ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx]
    [105954.385040]  ? __handle_irq_event_percpu+0x3d/0x190
    [105954.385044]  ? handle_irq_event+0x58/0xb0
    [105954.385046]  ? handle_edge_irq+0x93/0x240
    [105954.385050]  ? __common_interrupt+0x41/0xa0
    [105954.385055]  ? common_interrupt+0x3e/0xa0
    [105954.385060]  ? asm_common_interrupt+0x22/0x40
    
    The root cause of this was that there was a free (dma_free_attrs) in the
    interrupt context.  There was a device discovery/fabric scan in
    progress.  A module unload was issued which set the UNLOADING flag.  As
    part of the discovery, after receiving an interrupt a work queue was
    scheduled (which involved a work to be queued).  Since the UNLOADING
    flag is set, the work item was not allocated and the mapped memory had
    to be freed.  The free occurred in interrupt context leading to system
    crash.  Delay the driver unload until the fabric scan is complete to
    avoid the crash.
    
    Reported-by: kernel test robot 
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/all/202512090414.07Waorz0-lkp@intel.com/
    Fixes: 783e0dc4f66a ("qla2xxx: Check for device state before unloading the driver.")
    Cc: stable@vger.kernel.org
    Signed-off-by: Anil Gurumurthy 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-8-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit b0335ee4fb94832a4ef68774ca7e7b33b473c7a6
Author: Shreyas Deodhar 
Date:   Wed Dec 10 15:45:58 2025 +0530

    scsi: qla2xxx: Allow recovery for tape devices
    
    Tape device doesn't show up after RSCNs.  To fix this, remove tape
    device specific checks which allows recovery of tape devices.
    
    Fixes: 44c57f205876 ("scsi: qla2xxx: Changes to support FCP2 Target")
    Cc: stable@vger.kernel.org
    Signed-off-by: Shreyas Deodhar 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-7-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit d74181ca110e3de9d7dc4fba7f9f6026033e2e5d
Author: Manish Rangankar 
Date:   Wed Dec 10 15:45:57 2025 +0530

    scsi: qla2xxx: Add bsg interface to support firmware img validation
    
    Add new bsg interface to issue MPI passthrough sub command to validate
    the new flash firmware image partition.
    
    Signed-off-by: Manish Rangankar 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-6-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit 478b152ab309a3fb94f4955ac661a38c7f150101
Author: Manish Rangankar 
Date:   Wed Dec 10 15:45:56 2025 +0530

    scsi: qla2xxx: Validate MCU signature before executing MBC 03h
    
    FC firmware does not come online during on-the-fly upgrade i.e. on soft
    reset.  To limit Load flash firmware, i.e. MBC 3 changes, validate MCU
    signature before executing MBC 03h
    
    Signed-off-by: Manish Rangankar 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-5-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit b99b04b12214ff5e4a01575c3c6612ae79bc5e76
Author: Manish Rangankar 
Date:   Wed Dec 10 15:45:55 2025 +0530

    scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx
    
    For 28xxx adaptor Load flash firmware mailbox load the operational
    firmware from flash, and also validate the checksum. Driver does not
    need to load the operational firmware anymore, but it still need to read
    fwdt from flash to build and allocate firmware dump template.  Remove
    request_firmware() support for 28xxx adapter.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512031128.XsuvzBv1-lkp@intel.com/
    Signed-off-by: Manish Rangankar 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-4-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit 21ab087cae5000dd084dfb21d0a4d6086f79c445
Author: Manish Rangankar 
Date:   Wed Dec 10 15:45:54 2025 +0530

    scsi: qla2xxx: Add support for 64G SFP speed
    
    Incorrect speed info is shown in driver logs for 64G SFP.  Add support
    for 64G SFP speed as per SFF-8472 specification.
    
    Signed-off-by: Manish Rangankar 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-3-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit 7411f1875a6055abe16e72fa5fc1b731cbfc7d76
Author: Himanshu Madhani 
Date:   Wed Dec 10 15:45:53 2025 +0530

    scsi: qla2xxx: Add Speed in SFP print information
    
    Print additional information about the speed while displaying SFP
    information.
    
    Signed-off-by: Himanshu Madhani 
    Signed-off-by: Nilesh Javali 
    Reviewed-by: Himanshu Madhani 
    Link: https://patch.msgid.link/20251210101604.431868-2-njavali@marvell.com
    Signed-off-by: Martin K. Petersen 

commit 0f9c4be787f786cff0bf2183607e54a552a40cb2
Author: Bart Van Assche 
Date:   Thu Nov 13 10:17:30 2025 -0800

    scsi: core: Introduce an enumeration type for the SCSI_MLQUEUE constants
    
    Multiple functions in the SCSI core accept an 'int reason' argument.
    The 'int' type of these arguments doesn't make it clear what values are
    acceptable for these arguments. Document which values are supported for
    these arguments by introducing the enumeration type scsi_qc_status. 'qc'
    in the type name stands for 'queuecommand' since the values passed as
    the 'reason' argument are the .queuecommand() return values.
    
    Cc: John Garry 
    Cc: Hannes Reinecke 
    Signed-off-by: Bart Van Assche 
    Link: https://patch.msgid.link/20251113181730.1109331-1-bvanassche@acm.org
    Signed-off-by: Martin K. Petersen 

commit c6e9ddc099d0d302eb73e8c63ce89f0d4da1f475
Merge: f5c0386e2c5cd9 39680c59f10c89
Author: Martin K. Petersen 
Date:   Tue Dec 16 22:16:47 2025 -0500

    Merge patch series "mpt3sas: Improve device readiness handling and event recovery"
    
    Ranjan Kumar  says:
    
    This patch series enhances the mpt3sas driver’s device bring-up,
    readiness detection, and event recovery mechanisms to improve
    robustness in environments with slow-responding or transient SAS/PCIe
    devices.
    
    The series introduces optional control over issuing TEST UNIT READY
    (TUR) commands during device unblocking, configurable retry limits,
    and a mechanism to requeue firmware topology events when devices are
    temporarily busy. Together, these updates reduce discovery failures
    and improve recovery reliability following firmware or link events.
    
    Link: https://patch.msgid.link/20251113153712.31850-1-ranjan.kumar@broadcom.com
    Signed-off-by: Martin K. Petersen 

commit 39680c59f10c899e9533a3635b1a201f38461ba0
Author: Ranjan Kumar 
Date:   Thu Nov 13 21:07:10 2025 +0530

    scsi: mpt3sas: Fixed the W=1 compilation warning
    
    Fix W=1 compilation warnings.
    
    Signed-off-by: Ranjan Kumar 
    Link: https://patch.msgid.link/20251113153712.31850-7-ranjan.kumar@broadcom.com
    Signed-off-by: Martin K. Petersen 

commit 72340fecd0c8449dcef1fd07199b0476728aae72
Author: Ranjan Kumar 
Date:   Thu Nov 13 21:07:09 2025 +0530

    scsi: mpt3sas: Add configurable command retry limit for slow-to-respond devices
    
    Add a new module parameter "command_retry_count" to control the number
    of retries during device discovery and readiness checks, improving
    reliability for slow or transient SAS/PCIe devices.
    
    Signed-off-by: Ranjan Kumar 
    Link: https://patch.msgid.link/20251113153712.31850-6-ranjan.kumar@broadcom.com
    Signed-off-by: Martin K. Petersen 

commit ad59571931072e6f77b2bfa7d7fdc564dad6f331
Author: Ranjan Kumar 
Date:   Thu Nov 13 21:07:08 2025 +0530

    scsi: mpt3sas: Add firmware event requeue support for busy devices
    
    Add support to requeue SAS/PCIe topology change events when devices are
    busy or not ready. Introduce delayed work with retry counters so events
    are retried instead of dropped, improving device discovery by retrying
    transient failures instead of dropping events.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202510311720.NiDwRLwp-lkp@intel.com/
    Signed-off-by: Ranjan Kumar 
    Link: https://patch.msgid.link/20251113153712.31850-5-ranjan.kumar@broadcom.com
    Signed-off-by: Martin K. Petersen 

commit aee682fad6cdd9e3482b52fab727f50bc0227fae
Author: Ranjan Kumar 
Date:   Thu Nov 13 21:07:06 2025 +0530

    scsi: mpt3sas: Improve device discovery and readiness handling for slow devices
    
    Introduce a new module parameter "issue_scsi_cmd_to_bringup_drive"
    (default=1) which allows overriding the driver's behavior of issuing
    SCSI TEST_UNIT_READY/START_UNIT commands to bring devices to READY state
    during unblock.
    
    Improve device discovery and I/O unblocking reliability by adding
    robust device readiness checks and separate callback handling for
    discovery I/O.  This introduces new helper routines for SCSI command
    execution and readiness determination, ensuring smoother recovery and
    initialization for slow or transient devices.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202510310924.crvtELzs-lkp@intel.com/
    Signed-off-by: Ranjan Kumar 
    Link: https://patch.msgid.link/20251113153712.31850-4-ranjan.kumar@broadcom.com
    Signed-off-by: Martin K. Petersen 

commit 6b553f2a5c840d38fe2f658bbe18365d40554361
Author: Ranjan Kumar 
Date:   Thu Nov 13 21:07:05 2025 +0530

    scsi: mpt3sas: Added no_turs flag to device unblock logic
    
    Add a "no_turs" flag to _scsih_ublock_io_all_device() to optionally skip
    TEST UNIT READY (TUR) checks while unblocking devices. This is used
    after broadcast events where sending TURs is not required.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202510310216.gerpzbxP-lkp@intel.com/
    Signed-off-by: Ranjan Kumar 
    Link: https://patch.msgid.link/20251113153712.31850-2-ranjan.kumar@broadcom.com
    Signed-off-by: Martin K. Petersen 

commit f5c0386e2c5cd9767fcb53fee660cd7af1ecaa6a
Merge: 1a56e63c82161f 6211644253153e
Author: Martin K. Petersen 
Date:   Tue Dec 16 21:58:08 2025 -0500

    Merge patch series "Update lpfc to revision 14.4.0.13"
    
    Justin Tee  says:
    
    Update lpfc to revision 14.4.0.13
    
    This patch set introduces reporting encryption information for Fibre
    Channel HBAs.
    
    First, the scsi_transport_fc layer is updated to include a new
    fc_encryption_info attribute that is added to struct fc_rport.
    Supporting sysfs and LLDD templates are provided.
    
    Then, the lpfc driver is updated to utilize the new templates for
    reporting encrypted fibre channel connections to upper layer.
    
    The patches were cut against Martin's 6.19/scsi-queue tree.
    
    Link: https://patch.msgid.link/20251211001659.138635-1-justintee8345@gmail.com
    Signed-off-by: Martin K. Petersen 

commit 6211644253153e4a86892112121ea597d02b5e12
Author: Justin Tee 
Date:   Wed Dec 10 16:16:59 2025 -0800

    scsi: lpfc: Update lpfc version to 14.4.0.13
    
    Update lpfc version to 14.4.0.13
    
    Signed-off-by: Justin Tee 
    Link: https://patch.msgid.link/20251211001659.138635-4-justintee8345@gmail.com
    Signed-off-by: Martin K. Petersen 

commit e2dacf8e5e33e9d268874882ad1e0d307f693db0
Author: Sarah Catania 
Date:   Wed Dec 10 16:16:58 2025 -0800

    scsi: lpfc: Add support for reporting encryption events
    
    Support logging encryption events in both point-to-point and fabric
    topologies.  A new LOG_ENCRYPTION flag is defined for reporting
    encryption related events for HBAs that support the FEDIF feature.
    Encryption information is stored in each NDLP object, which is
    determined during the discovery stage after PLOGI completes.
    
    For reporting encryption information to upper layers, the
    .get_fc_rport_enc_info routine is implemented in lpfc_get_enc_info().
    This allows encryption status to be reported through fc_remote_ports
    sysfs.  Debugfs is also updated to report encryption information for all
    NDLP objects.
    
    Signed-off-by: Sarah Catania 
    Signed-off-by: Justin Tee 
    Link: https://patch.msgid.link/20251211001659.138635-3-justintee8345@gmail.com
    Signed-off-by: Martin K. Petersen 

commit bd2bc528691e11ea945fbac485eb84c102a521d8
Author: Sarah Catania 
Date:   Wed Dec 10 16:16:57 2025 -0800

    scsi: scsi_transport_fc: Introduce encryption group in fc_rport attribute
    
    Introduce a new structure for reporting an encrypted session over an
    fc_rport.  The encryption group is added as an attribute in struct
    fc_rport and reports information in fc_encryption_info.  This structure
    contains a status member variable, which stores a bit value indicating
    an encrypted session.
    
    Signed-off-by: Sarah Catania 
    Signed-off-by: Justin Tee 
    Link: https://patch.msgid.link/20251211001659.138635-2-justintee8345@gmail.com
    Signed-off-by: Martin K. Petersen 

commit 1a56e63c82161fca8f8d93b0ce5ce66c7c7d6b6d
Author: Yury Norov (NVIDIA) 
Date:   Fri Dec 5 18:58:08 2025 -0500

    scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get()
    
    The function opencodes for_each_set_bit_wrap(). Use it, and while there
    switch from goto-driven codeflow to more high-level constructions.
    
    Signed-off-by: Yury Norov (NVIDIA) 
    Reviewed-by: Justin Tee 
    Link: https://patch.msgid.link/20251205235808.358258-1-yury.norov@gmail.com
    Signed-off-by: Martin K. Petersen 

commit a8cf5c1bee0fe1b3a829118d636d4f1ea6b408b0
Author: John Garry 
Date:   Thu Nov 13 13:36:42 2025 +0000

    scsi: scsi_debug: Drop NULL scsi_cmnd check in sdebug_q_cmd_complete()
    
    The scp pointer cannot be NULL, as it is evaluated from container_of()
    and pointer offsets (so remove the check in sdebug_q_cmd_complete()).
    
    Signed-off-by: John Garry 
    Link: https://patch.msgid.link/20251113133645.2898748-4-john.g.garry@oracle.com
    Signed-off-by: Martin K. Petersen 

commit 559ae7a26b105f9e0b1279b3ab8029623592e900
Author: John Garry 
Date:   Thu Nov 13 13:36:41 2025 +0000

    scsi: scsi_debug: Stop using READ/WRITE_ONCE() when accessing sdebug_defer.defer_t
    
    Using READ/WRITE_ONCE() means that the read or write is not torn by the
    compiler.
    
    READ/WRITE_ONCE() is always used when accessing sdebug_defer.defer_t.
    
    However, we also guard the access in a spinlock when accessing that
    member, and spinlock already guarantees no tearing, so stop using
    READ/WRITE_ONCE().
    
    Signed-off-by: John Garry 
    Link: https://patch.msgid.link/20251113133645.2898748-3-john.g.garry@oracle.com
    Signed-off-by: Martin K. Petersen 

commit a743b120227a371f37c46738d91cc7a9691dbcf6
Author: John Garry 
Date:   Thu Nov 13 13:36:40 2025 +0000

    scsi: scsi_debug: Stop printing extra function name in debug logs
    
    The driver defines as follows pr_fmt:
    
      #define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
    
    ...meaning that we already get the function name added in any debug
    statements.
    
    Remove using of __func__ in debug logs to avoid the duplication.
    
    For instances of where the function name was being printed, add some
    verbose comment to avoid using "" (which would be a bit silly).
    
    It would be nicer to stop using pr_fmt(), but that would mean rewriting
    approx 100 debug statements to have a sensible and clear message.
    
    Signed-off-by: John Garry 
    Link: https://patch.msgid.link/20251113133645.2898748-2-john.g.garry@oracle.com
    Signed-off-by: Martin K. Petersen 

commit e642331c942003f58dba6e33c8ee93402211b7b6
Author: vamshi gajjela 
Date:   Thu Dec 11 19:02:27 2025 +0530

    scsi: ufs: core: mcq: Use ufshcd_rmwl() instead of open-coding it
    
    Currently, ufshcd_mcq_enable_esi() manually implements a
    read-modify-write sequence using ufshcd_readl() and ufshcd_writel().
    It also utilizes a hardcoded magic number (0x2) for the enable bit.
    
    Use ufshcd_rmwl() helper, replace the magic number with the
    ESI_ENABLE macro to improve code readability.
    
    No functional change intended.
    
    Signed-off-by: vamshi gajjela 
    Reviewed-by: Bart Van Assche 
    Link: https://patch.msgid.link/20251211133227.4159394-1-vamshigajjela@google.com
    Signed-off-by: Martin K. Petersen 

commit 7011e8aafe8c8fcc1c6f8bfcc6796f4530428e13
Author: Gulam Mohamed 
Date:   Mon Dec 1 11:07:16 2025 +0000

    scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION
    
    Add emulation for REPORT IDENTIFYING INFORMATION command using the
    configfs file 'pd_text_id_info' in target core module. The configfs file
    is created in /sys/kernel/config/target/core//
    /wwn/.
    
    An emulation function, spc_emulate_report_id_info(), is defined to
    return the identification string based on the contents of
    'pd_text_id_info'.
    
    The details of the REPORT IDENTIFYING INFORMATION command is defined in
    section 6.32 of SPC4.
    
    [mkp: checkpatch tweaks]
    
    Signed-off-by: Gulam Mohamed 
    Reviewed-by: John Garry 
    Link: https://patch.msgid.link/20251201110716.227588-1-gulam.mohamed@oracle.com
    Signed-off-by: Martin K. Petersen 

commit 88d98e74adf3e20f678bb89581a5c3149fdbdeaa
Author: Ashutosh Dixit 
Date:   Fri Dec 5 13:26:13 2025 -0800

    drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME
    
    Reports can be written out to the OA buffer using ways other than periodic
    sampling. These include mmio trigger and context switches. To support these
    use cases, when periodic sampling is not enabled,
    OAG_OAGLBCTXCTRL_COUNTER_RESUME must be set.
    
    Fixes: 1db9a9dc90ae ("drm/xe/oa: OA stream initialization (OAG)")
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Umesh Nerlige Ramappa 
    Link: https://patch.msgid.link/20251205212613.826224-4-ashutosh.dixit@intel.com

commit ec02e49f21bc161ba19eca4a696613717b2ce2d2
Author: Ashutosh Dixit 
Date:   Fri Dec 5 13:26:12 2025 -0800

    drm/xe/rtp: Whitelist OAMERT MMIO trigger registers
    
    Whitelist OAMERT registers to enable userspace to execute MMIO triggers on
    OAMERT units. Registers are whitelisted for compute and copy class engines.
    
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Umesh Nerlige Ramappa 
    Link: https://patch.msgid.link/20251205212613.826224-3-ashutosh.dixit@intel.com

commit ab39e2a8f7aed72929bfc1d58eb5e8766f1d85db
Author: Ashutosh Dixit 
Date:   Fri Dec 5 13:26:11 2025 -0800

    drm/xe/oa/uapi: Expose MERT OA unit
    
    A MERT OA unit is available in the SoC on some platforms. Add support
    for this OA unit and expose it to userspace. The MERT OA unit does not
    have any HW engines attached, but is otherwise similar to an OAM unit.
    
    Signed-off-by: Lucas De Marchi 
    Reviewed-by: Umesh Nerlige Ramappa 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251205212613.826224-2-ashutosh.dixit@intel.com

commit 23ec0d891e09441b3d0353b56b73e35e3f3c5dad
Author: Georg Gottleuber 
Date:   Thu Dec 4 16:52:08 2025 +0100

    firmware: qcom: scm: QSEECOM on Medion SPRCHRGD 14 S1
    
    This is needed to access EFI variables from Linux.
    
    Signed-off-by: Ettore Chimenti 
    Signed-off-by: Georg Gottleuber 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251204155212.230058-7-ggo@tuxedocomputers.com
    Signed-off-by: Bjorn Andersson 

commit 8cf65490cdb03c0254448a54f9098686bf9029ec
Author: Georg Gottleuber 
Date:   Thu Dec 4 16:52:07 2025 +0100

    arm64: dts: qcom: Add dts for Medion SPRCHRGD 14 S1
    
    Initial support for the Medion SPRCHRGD 14 S1, which is based on the
    Qualcomm Snapdragon X Elite SoC (X1E78100).
    
    Working:
    * Touchpad
    * Keyboard
    * eDP
    * NVMe
    * USB Type-C port
    * USB-C DP altmode
    * HDMI-A port
    * WiFi
    * Bluetooth
    * GPU
    * Video decoding
    * USB Type-A
    * Audio, speakers, microphones
            - 4x speakers.
            - 2x dmic
            - headset
    * Camera
    * Fingerprint reader
    
    Co-developed-by: Srinivas Kandagatla 
    Signed-off-by: Srinivas Kandagatla 
    Co-developed-by: Ettore Chimenti 
    Signed-off-by: Ettore Chimenti 
    Signed-off-by: Georg Gottleuber 
    Reviewed-by: Konrad Dybcio 
    Link: https://lore.kernel.org/r/20251204155212.230058-6-ggo@tuxedocomputers.com
    Signed-off-by: Bjorn Andersson 

commit 5851f2a20c60dd5aa39b99e4872e96ce358598b6
Author: Georg Gottleuber 
Date:   Thu Dec 4 16:52:06 2025 +0100

    dt-bindings: arm: qcom: Add Medion SPRCHRGD device
    
    Introduce new binding for the Medion SPRCHRGD 14 S1 notebook with
    X1E78100 SoC.
    
    Signed-off-by: Georg Gottleuber 
    Acked-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251204155212.230058-5-ggo@tuxedocomputers.com
    Signed-off-by: Bjorn Andersson 

commit a4c5af1a94c401e99d7eb22707dd848d54bff80d
Author: Georg Gottleuber 
Date:   Thu Dec 4 16:52:05 2025 +0100

    dt-bindings: vendor-prefixes: Add Medion AG
    
    Add Medion AG, a German electronics company, to the list of vendor
    prefixes.
    
    Link: https://www.medion.com/
    
    Signed-off-by: Georg Gottleuber 
    Acked-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251204155212.230058-4-ggo@tuxedocomputers.com
    Signed-off-by: Bjorn Andersson 

commit 32d68e51bf492580bc2b84adcad8a20427d4b2a0
Author: Georg Gottleuber 
Date:   Thu Dec 4 16:52:04 2025 +0100

    dt-bindings: arm: qcom: Add TUXEDO Computers device
    
    Introduce new binding for the TUXEDO Elite 14 Gen1 laptop with X1E78100
    SoC.
    
    Signed-off-by: Georg Gottleuber 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251204155212.230058-3-ggo@tuxedocomputers.com
    Signed-off-by: Bjorn Andersson 

commit 9f76530e52b51a93643dfd2aa893caf00047a563
Author: Georg Gottleuber 
Date:   Thu Dec 4 16:52:03 2025 +0100

    dt-bindings: vendor-prefixes: Add prefix for TUXEDO Computers GmbH
    
    TUXEDO Computers GmbH is a German supplier for computers.
    
    Signed-off-by: Georg Gottleuber 
    Acked-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251204155212.230058-2-ggo@tuxedocomputers.com
    Signed-off-by: Bjorn Andersson 

commit 0fe01a7955f4fef97e7cc6d14bfc5931c660402b
Author: Jorge Ramirez-Ortiz 
Date:   Tue Dec 9 08:45:37 2025 +0100

    soc: qcom: smem: handle ENOMEM error during probe
    
    Fail the driver probe if the region can't be mapped
    
    Signed-off-by: Jorge Ramirez-Ortiz 
    Fixes: 20bb6c9de1b7 ("soc: qcom: smem: map only partitions used by local HOST")
    Reviewed-by: Dmitry Baryshkov 
    Link: https://lore.kernel.org/r/20251209074610.3751781-1-jorge.ramirez@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 6a28174326289834c6767bdeb1ba348aa9831e91
Author: Benoît Monin 
Date:   Wed Nov 26 11:46:27 2025 +0100

    i2c: designware: Add dedicated algorithm for AMD NAVI
    
    Apart from runtime PM, there is nothing in common between i2c_dw_xfer()
    and amd_i2c_dw_xfer_quirk(), so give AMD NAVI controller its own algorithm
    instead of calling the quirk from i2c_dw_xfer().
    
    Add runtime PM handling to amd_i2c_dw_xfer_quirk() and a dedicated
    i2c_algorithm for AMD NAVI controllers. The adapter algorithm is set
    during probe based on the device model.
    
    This way we avoid checking for the device model at the start of every
    transfer.
    
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Benoît Monin 
    Acked-by: Mika Westerberg 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251126-i2c-dw-v4-4-b0654598e7c5@bootlin.com

commit ea032b451134e5cc79ed1affc9a237ce5bdda9ed
Author: Benoît Monin 
Date:   Wed Nov 26 11:46:26 2025 +0100

    i2c: designware: Sort compatible strings in alphabetical order
    
    Reorder the of_device_id structures so that they are in alphabetical
    order. Also drop the unneeded inner trailing comma in the
    "snps,designware-i2c" struct.
    
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Benoît Monin 
    Acked-by: Mika Westerberg 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251126-i2c-dw-v4-3-b0654598e7c5@bootlin.com

commit 2b110445b1dfdef34ea7c42c27ddc2ba1bee5753
Author: Benoît Monin 
Date:   Wed Nov 26 11:46:25 2025 +0100

    i2c: designware: Optimize flag reading in i2c_dw_read()
    
    Optimize the i2c_dw_read() function by reading the message flags only
    once per message, rather than for every byte.
    
    The message flags are accessed both in the outer loop and the inner loop,
    so move the declaration of the local flags variable to the outer loop.
    
    The message index is only modified by the outer loop, so reading the
    flags in the inner loop was always getting the same value.
    
    Reviewed-by: Andy Shevchenko 
    Signed-off-by: Benoît Monin 
    Acked-by: Mika Westerberg 
    Signed-off-by: Andi Shyti 
    Link: https://lore.kernel.org/r/20251126-i2c-dw-v4-2-b0654598e7c5@bootlin.com

commit 7d1974ce80fc386834e5667b0f579c2c766c4faa
Author: Harshal Dev 
Date:   Thu Dec 11 14:19:45 2025 +0530

    arm64: dts: qcom: x1e80100: Add crypto engine
    
    On X Elite, there is a crypto engine IP block similar to ones found on
    SM8x50 platforms.
    
    Describe the crypto engine and its BAM.
    
    Tested-by: Wenjia Zhang 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Abel Vesa 
    Signed-off-by: Harshal Dev 
    Link: https://lore.kernel.org/r/20251211-crypto_dt_node_x1e80100-v6-1-03830ed53352@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 0418592550c6a370b2b8a5cbebd53fb7dd63d837
Author: Pankaj Patil 
Date:   Thu Dec 11 14:32:36 2025 +0530

    soc: qcom: llcc-qcom: Add support for Glymur
    
    Add system cache table(SCT) and configs for Glymur SoC
    Updated the list of usecase id's to enable additional clients for Glymur
    
    Reviewed-by: Konrad Dybcio 
    Signed-off-by: Pankaj Patil 
    Link: https://lore.kernel.org/r/20251211-glymur_llcc_enablement-v3-2-43457b354b0d@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit bd0b8028ce5fbc7d9f5c2751c20661b0d8114e60
Author: Pankaj Patil 
Date:   Thu Dec 11 14:32:35 2025 +0530

    dt-bindings: cache: qcom,llcc: Document Glymur LLCC block
    
    Document the Last Level Cache Controller on Glymur SoC
    Glymur LLCC has 12 base register regions and an additional AND, OR
    broadcast region, total 14 register regions
    Increase maxItems for reg and reg-names to allow 14 entries for Glymur
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Pankaj Patil 
    Link: https://lore.kernel.org/r/20251211-glymur_llcc_enablement-v3-1-43457b354b0d@oss.qualcomm.com
    Signed-off-by: Bjorn Andersson 

commit 93f51b9182a107cf5f5e8a7802cd90df0c9a7154
Author: Shenwei Wang 
Date:   Mon Dec 8 17:33:02 2025 -0600

    remoteproc: imx_rproc: Use strstarts for "rsc-table" check
    
    The resource name may include an address suffix, for example:
    rsc-table@1fff8000.
    
    To handle such cases, use strstarts() instead of strcmp() when checking
    for "rsc-table".
    
    Signed-off-by: Shenwei Wang 
    Reviewed-by: Daniel Baluta 
    Reviewed-by: Frank Li 
    Reviewed-by: Zhongqiu Han 
    Reviewed-by: Peng Fan 
    Fixes: 67a7bc7f0358 ("remoteproc: Use of_reserved_mem_region_* functions for "memory-region"")
    Link: https://lore.kernel.org/r/20251208233302.684139-1-shenwei.wang@nxp.com
    Signed-off-by: Mathieu Poirier 

commit dd2fc7b85744e8da5a9fd630e5c030b70eebd293
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 14:36:49 2025 +0100

    ACPI: PNP: Drop acpi_nonpnp_device_ids[]
    
    Now that "system" devices are represented as platform devices, they
    are not claimed by the PNP ACPI scan handler any more and platform
    devices can be created for ACPI device objects listing "system"
    device IDs as their compatible device IDs.
    
    Accordingly, it should not be necessary any more to add device IDs
    to acpi_nonpnp_device_ids[], so drop it.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Mario Limonciello (AMD) 
    Link: https://patch.msgid.link/3587570.QJadu78ljV@rafael.j.wysocki

commit 686e905aeea524b957a8584c8c1e5060111ad4da
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 14:35:44 2025 +0100

    platform/x86/intel/vbtn: Stop creating a platform device
    
    Now that "system" devices are represented as platform devices, they
    are not claimed by the PNP ACPI scan handler any more and the Intel
    virtual button array platform devices should be created by the ACPI
    core, so the driver does not need to attempt to create a platform
    device by itself.
    
    Accordingly, make it stop doing so.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Mario Limonciello (AMD) 
    Link: https://patch.msgid.link/8661724.NyiUUSuA9g@rafael.j.wysocki

commit 61ddc929a162c68f2fedb32767cf8afe54198b56
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 14:35:05 2025 +0100

    platform/x86/intel/hid: Stop creating a platform device
    
    Now that "system" devices are represented as platform devices, they
    are not claimed by the PNP ACPI scan handler any more and the Intel
    HID platform devices should be created by the ACPI core, so the
    driver does not need to attempt to create a platform device by
    itself.
    
    Accordingly, make it stop doing so.
    
    No intentional functional impact.
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Mario Limonciello (AMD) 
    Link: https://patch.msgid.link/6115868.MhkbZ0Pkbq@rafael.j.wysocki

commit 3ad5df2391040d1596ce888c042f99b7c1d7870a
Author: Rafael J. Wysocki 
Date:   Mon Dec 15 14:34:06 2025 +0100

    ACPI: PNP: Drop PNP0C01 and PNP0C02 from acpi_pnp_device_ids[]
    
    There is a long-standing problem with ACPI device enumeration that
    if the given device has a compatible ID which is one of the generic
    system resource device IDs (PNP0C01 and PNP0C02), it will be claimed
    by the PNP scan handler and it will not be represented as a platform
    device, so it cannot be handled by a platform driver.
    
    Drivers have been working around this issue by "manually" creating
    platform devices that they can bind to (see the Intel HID driver for
    one example) or adding their device IDs to acpi_nonpnp_device_ids[].
    None of the above is particularly clean though and the only reason why
    the PNP0C01 and PNP0C02 device IDs are present in acpi_pnp_device_ids[]
    is to allow the legacy PNP system driver to bind to those devices and
    reserve their resources so they are not used going forward.
    
    Obviously, to address this problem PNP0C01 and PNP0C02 need to be
    dropped from acpi_pnp_device_ids[], but doing so without making any
    other changes would be problematic because the ACPI core would then
    create platform devices for the generic system resource device objects
    and that would not work on all systems for two reasons.  First, the
    PNP system driver explicitly avoids reserving I/O resources below the
    "standard PC hardware" boundary, 0x100, to avoid conflicts in that range
    (one possible case when this may happen is when the CMOS RTC driver is
    involved), but the platform device creation code does not do that.
    Second, there may be resource conflicts between the "system" devices and
    the other devices in the system, possibly including conflicts with PCI
    BARs.  Registering the PNP system driver via fs_initcall() helps to
    manage those conflicts, even though it does not make them go away.
    Resource conflicts during the registration of "motherboard resources"
    that occur after PCI has claimed BARs are harmless as a rule and do
    not need to be addressed in any specific way.
    
    To overcome the issues mentioned above, use the observation that it
    is not actually necessary to create any device objects in addition
    to struct acpi_device ones in order to reserve the "system" device
    resources because that can be done directly in the ACPI device
    enumeration code.
    
    Namely, modify acpi_default_enumeration() to add the given ACPI device
    object to a special "system devices" list if its _HID is either PNP0C01
    or PNP0C02 without creating a platform device for it.  Next, add a new
    special acpi_scan_claim_resources() function that will be run via
    fs_initcall() and will walk that list and reserve resources for each
    device in it along the lines of what the PNP system driver does.
    
    Having made the above changes, drop PNP0C01 and PNP0C02 from
    acpi_pnp_device_ids[] which will allow platform devices to be created
    for ACPI device objects whose _CID lists contain PNP0C01 or PNP0C02,
    but the _HID is not in acpi_pnp_device_ids[].
    
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Mario Limonciello (AMD) 
    [ rjw: Drop a leftover comment and add a new one elsewhere ]
    Link: https://patch.msgid.link/9550709.CDJkKcVGEf@rafael.j.wysocki
    Signed-off-by: Rafael J. Wysocki 

commit dab6b6f5fc5aabd3248bdea4d6e200a04b309fd2
Merge: 524ee559948d8d f25c7d709b9360
Author: Mark Brown 
Date:   Tue Dec 16 19:12:22 2025 +0000

    ASoC: SOF: Support for on-demand DSP boot
    
    Merge series from Peter Ujfalusi :
    
    On system suspend / resume we always power up the DSP and boot the
    firmware, which is not strictly needed as right after the firmware booted
    up we power the DSP down again on suspend and we also power it down after
    resume after some inactivity.
    
    Similarly, on jack insert/removal we needlesly boot up the firmware to check
    the jack status, which needs no DSP/firmware communication.
    
    The on-demand DSP boot will make sure that we boot the DSP firmware up only
    when it is needed - for audio activity, in other cases the firmware will be
    not booted up, which saves time.
    
    Out of caution, add a new platform descriptor flag to enable on-demand
    DSP boot since this might not work without changes to platform code on
    certain platforms.
    
    With the on-demand dsp boot enabled we will not boot the DSP and firmware
    up on system or rpm resume, just enable audio subsystem since audio IPs,
    like HDA and SoundWire might be needed (codecs suspend/resume operation).
    Only boot up the DSP during the first hw_params() call when the DSP is
    really going to be needed.
    
    In this way we can handle the audio related use cases:
    normal audio use (rpm suspend/resume)
    system suspend/resume without active audio
    system suspend/resume with active audio
    system suspend/resume without active audio, and audio start before the rpm
    suspend timeout
    
    Add module option to force the on-demand DSP boot to allow it to be
    disabled or enabled without kernel change for testing.
    
    The on-demand boot has been tested in our CI for more than half a year
    and so far no issues have been seen on supported platforms since it's
    introduction to our development tree (sof-dev).

commit e7a0adb03dfe1877a11e45a8707e69ba8f4cf94c
Merge: 6f0b824a61f212 19f12431b6c339
Author: Andrii Nakryiko 
Date:   Tue Dec 16 10:42:55 2025 -0800

    Merge branch 'libbpf-move-arena-variables-out-of-the-zero-page'
    
    Emil Tsalapatis says:
    
    ====================
    libbpf: move arena variables out of the zero page
    
    Modify libbpf to place arena globals at the end of the arena mapping
    instead of the very beginning. This allows programs to leave the
    "zero page" of the arena unmapped, so that NULL arena pointer
    dereferences trigger a page fault and associated backtrace in BPF streams.
    In contrast, the current policy of placing global data in the zero pages
    means that NULL dereferences silently corrupt global data, e.g, arena
    qspinlock state. This makes arena bugs more difficult to debug.
    
    The patchset adds code to libbpf to move global arena data to the end of
    the arena. At load time, libbpf adjusts each symbol's location within
    the arena to point to the right location in the arena. The patchset
    also adjusts the arena skeleton pointer to point to the arena globals,
    now that they are not in the beginning of the arena region.
    
    CHANGESET
    =========
    
    v3->v4: (https://lore.kernel.org/bpf/20251215161313.10120-1-emil@etsalapatis.com/T/#t)
    
    - Added Acks by Eduard
    - Changed jumptable sym_off to unsigned int for consistency (AI)
    - Adjusted selftests to ensure arena globals are actually mapped in (Eduard)
    - (Patch 2) Adjusted selftests that were failing because they were expecting the
      now removed "direct map offset" error message
    
    v2->v3: (https://lore.kernel.org/bpf/20251203162625.13152-1-emil@etsalapatis.com/)
    
    - Remove unnecessary kernel bounds check in resolve_pseudo_ldimm64
      (Andrii)
    - Added patch to turn sym_off unsigned to prevent overflow (AI)
    - Remove obsolete references to offsets from test patch description
      (Andrii)
    - Use size_t for arena_data_off (Andrii)
    - Remove extra mutable variable from offset calculations (Andrii)
    
    v1->v2: (https://lore.kernel.org/bpf/20251118030058.162967-1-emil@etsalapatis.com)
    
    - Moved globals to the end of the mapping: (Andrii)
            - Removed extra parameter for offset and parameter picking logic
            - Removed padding in the skeleton
            - Removed additional libbpf call
    - Added Reviewed-by from Eduard on patch 1
    
    Signed-off-by: Emil Tsalapatis 
    ====================
    
    Link: https://patch.msgid.link/20251216173325.98465-1-emil@etsalapatis.com
    Signed-off-by: Andrii Nakryiko 

commit 19f12431b6c339416e656c794a26ff0ebb2dba56
Author: Emil Tsalapatis 
Date:   Tue Dec 16 12:33:25 2025 -0500

    selftests/bpf: Add tests for the arena offset of globals
    
    Add tests for the new libbpf globals arena offset logic. The
    tests cover the case of globals being as large as the arena
    itself, and being smaller than the arena. In that case, the
    data is placed at the end of the arena, and the beginning
    of the arena is free.
    
    Signed-off-by: Emil Tsalapatis 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20251216173325.98465-6-emil@etsalapatis.com

commit c1f61171d44b19834cf24def2cf832f2688e83df
Author: Emil Tsalapatis 
Date:   Tue Dec 16 12:33:24 2025 -0500

    libbpf: Move arena globals to the end of the arena
    
    Arena globals are currently placed at the beginning of the arena
    by libbpf. This is convenient, but prevents users from reserving
    guard pages in the beginning of the arena to identify NULL pointer
    dereferences. Adjust the load logic to place the globals at the
    end of the arena instead.
    
    Also modify bpftool to set the arena pointer in the program's BPF
    skeleton to point to the globals. Users now call bpf_map__initial_value()
    to find the beginning of the arena mapping and use the arena pointer
    in the skeleton to determine which part of the mapping holds the
    arena globals and which part is free.
    
    Suggested-by: Andrii Nakryiko 
    Signed-off-by: Emil Tsalapatis 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20251216173325.98465-5-emil@etsalapatis.com

commit 0aa721437e4b74d737f58582f1bbf2eea3e038c7
Author: Emil Tsalapatis 
Date:   Tue Dec 16 12:33:23 2025 -0500

    libbpf: Turn relo_core->sym_off unsigned
    
    The symbols' relocation offsets in BPF are stored in an int field,
    but cannot actually be negative. When in the next patch libbpf relocates
    globals to the end of the arena, it is also possible to have valid
    offsets > 2GiB that are used to calculate the final relo offsets.
    Avoid accidentally interpreting large offsets as negative by turning
    the sym_off field unsigned.
    
    Signed-off-by: Emil Tsalapatis 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20251216173325.98465-4-emil@etsalapatis.com

commit 12a1fe6e12dbad39f2f0dad1a385625f0298eff4
Author: Emil Tsalapatis 
Date:   Tue Dec 16 12:33:22 2025 -0500

    bpf/verifier: Do not limit maximum direct offset into arena map
    
    The verifier currently limits direct offsets into a map to 512MiB
    to avoid overflow during pointer arithmetic. However, this prevents
    arena maps from using direct addressing instructions to access data
    at the end of > 512MiB arena maps. This is necessary when moving
    arena globals to the end of the arena instead of the front.
    
    Refactor the verifier code to remove the offset calculation during
    direct value access calculations. This is possible because the only
    two map types that implement .map_direct_value_addr() are arrays and
    arenas, and they both do their own internal checks to ensure the
    offset is within bounds.
    
    Adjust selftests that expect the old error. These tests still fail
    because the verifier identifies the access as out of bounds for the
    map, so change them to expect an "invalid access to map value pointer"
    error instead.
    
    Signed-off-by: Emil Tsalapatis 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20251216173325.98465-3-emil@etsalapatis.com

commit 0355911ac021a424b18d2d746536d70b879cdeab
Author: Emil Tsalapatis 
Date:   Tue Dec 16 12:33:21 2025 -0500

    selftests/bpf: Explicitly account for globals in verifier_arena_large
    
    The big_alloc1 test in verifier_arena_large assumes that the arena base
    and the first page allocated by bpf_arena_alloc_pages are identical.
    This is not the case, because the first page in the arena is populated
    by global arena data. The test still passes because the code makes the
    tacit assumption that the first page is on offset PAGE_SIZE instead of
    0.
    
    Make this distinction explicit in the code, and adjust the page offsets
    requested during the test to count from the beginning of the arena
    instead of using the address of the first allocated page.
    
    Signed-off-by: Emil Tsalapatis 
    Signed-off-by: Andrii Nakryiko 
    Reviewed-by: Eduard Zingerman 
    Link: https://lore.kernel.org/bpf/20251216173325.98465-2-emil@etsalapatis.com

commit 0a54edc19158b3402b6c39cc682789be05e3d47d
Author: Abhishek Rajput 
Date:   Tue Dec 16 16:02:38 2025 +0530

    drm/radeon: Convert legacy DRM logging in evergreen.c to drm_* helpers
    
    Replace DRM_DEBUG(), DRM_ERROR(), and DRM_INFO() calls with the
    corresponding drm_dbg(), drm_err(), and drm_info() helpers in the
    radeon driver.
    
    The drm_*() logging helpers take a struct drm_device * argument,
    allowing the DRM core to prefix log messages with the correct device
    name and instance. This is required to correctly distinguish log
    messages on systems with multiple GPUs.
    
    This change aligns radeon with the DRM TODO item:
    "Convert logging to drm_* functions with drm_device parameter".
    
    Signed-off-by: Abhishek Rajput 
    Signed-off-by: Alex Deucher 

commit e50a6ecebe0841d3dfa4d9415d4fae80bb5d91e8
Author: Hawking Zhang 
Date:   Tue Jul 15 22:02:02 2025 +0800

    drm/amdgpu: Add gfx v12_1 interrupt source header
    
    To acommandate specific interrupt source for gfx v12_1
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 1ded9071c1b1ac2712420009710256bf95e90a80
Author: Mukul Joshi 
Date:   Wed Jul 16 12:42:40 2025 -0400

    drm/amdkfd: Override KFD SVM mappings for GFX 12.1
    
    Override the local MTYPE mappings in KFD SVM code with mtype_local
    modprobe param for GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 005b7f7f93b44ffd93f337c216ddb44d8a7c276b
Author: Likun Gao 
Date:   Thu Jul 10 14:25:03 2025 +0800

    drm/amdgpu: correct rlc autoload for xcc harvest
    
    If the number instances of firmware is RLC_NUM_INS_CODE0(Only 1 inst),
    need to copy it directly for rlcautolad.
    For the firmware which instances number bigger than 1, only copy for
    enabled XCC to save copy time.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 4d70e12796a9d80b5a2bbaa22811e1b7be1c719b
Author: Likun Gao 
Date:   Tue Jul 15 16:52:12 2025 +0800

    drm/amdgpu: add gfx sysfs support for gfx_v12_1
    
    Add gfx sysfs support for gfx_v12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit b9a0716a93abb03be79bdb52d9ac4bb98053f06e
Author: Jack Xiao 
Date:   Thu Jul 10 16:42:01 2025 +0800

    drm/amdgpu/mes_v12_1: fix mes access xcd register
    
    Fix to use local register offset inside die for mes fw accessing
    local/remote xcd register.
    
    Signed-off-by: Jack Xiao 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit c63a52018675e75a19a04c2417ffaaf0ab1856f5
Author: Likun Gao 
Date:   Wed Jul 9 16:50:59 2025 +0800

    drm/amdgpu: normalize reg addr as local xcc for gfx v12_1
    
    Normalize registers address to local xcc address for gfx v12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit c9908d9c988810ad6253a8a1f70cf1baa23facb2
Author: Likun Gao 
Date:   Fri Jul 4 10:45:40 2025 +0800

    drm/amdgpu: support xcc harvest for ih translate
    
    Support xcc harvest for ih translate to logic xcc.
    V2: Only check available instances
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 49f47cbf5f0bf4124988d57e70d4362d01aa2b70
Author: Likun Gao 
Date:   Wed Jul 2 12:50:58 2025 +0800

    drm/amdgpu: Correct inst_id input from physical to logic
    
    Correct inst_id input from physical to logic for sdma v7_1.
    V2: Show real instance number on logic xcc.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 1eb2a5ed196ace28d19c3d17923261053ed51ff9
Author: Likun Gao 
Date:   Fri Jul 4 10:51:50 2025 +0800

    drm/amdgpu: use physical xcc id to get rrmt
    
    Use physical xcc_id to get rrmt on misc_op for mes v12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit c5f91810725c06270c9388f3ebea3ec30dd6b64c
Author: Mukesh Ogare 
Date:   Tue Dec 16 12:12:24 2025 +0530

    drm/radeon: Convert logging in radeon_display.c to drm_* helpers
    
    Replace DRM_ERROR() and DRM_INFO() calls in
    drivers/gpu/drm/radeon/radeon_display.c with the corresponding
    drm_err() and drm_info() helpers.
    
    The drm_*() logging functions take a struct drm_device * argument,
    allowing the DRM core to prefix log messages with the correct device
    name and instance. This is required to correctly distinguish log
    messages on systems with multiple GPUs.
    
    This change aligns radeon with the DRM TODO item:
    "Convert logging to drm_* functions with drm_device parameter".
    
    Acked-by: Christian König 
    Signed-off-by: Mukesh Ogare 
    Signed-off-by: Alex Deucher 

commit 6e7143e5e6e21f9d5572e0390f7089e6d53edf3c
Author: Brian Kocoloski 
Date:   Thu Nov 20 13:57:19 2025 -0500

    drm/amdkfd: Fix improper NULL termination of queue restore SMI event string
    
    Pass character "0" rather than NULL terminator to properly format
    queue restoration SMI events. Currently, the NULL terminator precedes
    the newline character that is intended to delineate separate events
    in the SMI event buffer, which can break userspace parsers.
    
    Signed-off-by: Brian Kocoloski 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit 89745c19c66824e818b970972550c67fc271ec07
Author: Likun Gao 
Date:   Wed Jul 2 13:09:22 2025 +0800

    drm/amdgpu: Correct xcc_id input to GET_INST from physical to logic
    
    Correct xcc_id input to GET_INST from physical to logic for
    gfx_v12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit a056771b30dc3c405cb81e22de96640d047d7097
Author: Michael Chen 
Date:   Wed Jun 11 11:25:37 2025 -0400

    drm/amdgpu: Fix CP_MEC_MDBASE in multi-xcc for gfx v12_1
    
    Need to allocate memory for MEC FW data and program
    registers CP_MEC_MDBASE for each XCC respectively.
    
    Signed-off-by: Michael Chen 
    Acked-by: Harish Kasiviswanathan 
    Reviewed-by: Shaoyun.liu 
    Signed-off-by: Alex Deucher 

commit 8efa1a11e160dbe500b52ce21bf0c3f585e64206
Author: Philip Yang 
Date:   Wed Apr 2 18:03:27 2025 -0400

    drm/amdgpu: Support 57bit fault address for GFX 12.1.0
    
    The gmc fault virtual address is up to 57bit for 5 level page table,
    this also works with 48bit virtual address for 4 level page table.
    
    Signed-off-by: Philip Yang 
    Acked-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit fa0aa517dec92cec9a51d71aaa21c6d1a61c467f
Author: Philip Yang 
Date:   Sun Mar 30 11:03:02 2025 -0400

    drm/amdgpu: Add pde3 table invalidation request for GFX 12.1.0
    
    Set pde3 invalidation request bit during tlb flush for up to 5 level
    page table.
    
    Signed-off-by: Philip Yang 
    Acked-by: Christian König 
    Acked-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit db1882b3ff0c51d3ffdcdeee7ad1f9f01ea78453
Author: Philip Yang 
Date:   Tue Apr 22 16:30:02 2025 -0400

    drm/amdkfd: Update LDS, Scratch base for 57bit address
    
    For 5-level page tables, update compute vmid sh_mem_base LDS aperture
    and Scratch aperture base address to above 57-bit, use the same setting
    from gfx vmid, we can remove the duplicate macro.
    
    Update queue pdd lds_base and scratch_base to the same value as
    sh_mem_base setting. Then application get process apertures return the
    correct value to access LDS and Scratch memory for 57bit address 5-level
    page tables. This may pass to MES in future when mapping queue.
    
    Signed-off-by: Philip Yang 
    Acked-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 6f744d7976e4910e478d1e46666aef96a71386ad
Author: Philip Yang 
Date:   Fri Apr 25 11:08:17 2025 -0400

    drm/amdgpu: Enable 5-level page table for GFX 12.1.0
    
    GFX 12.1.0 support 57bit virtual, 52bit physical address, set PDE
    max_level to 4, min_vm_size to 128PB to enable GPU vm 5-level page
    tables to support 57bit virtual address.
    
    Signed-off-by: Philip Yang 
    Acked-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 2d1fd547902da8ab4c48f542accf769a15bfce04
Author: Feifei Xu 
Date:   Fri Jul 4 22:12:29 2025 +0800

    drm/amdgpu: init RS64_MEC_P2/P3_STACK for gfx12.1
    
    Add GFX12.1 MEC P2/P3 STACK firmware init.
    
    Signed-off-by: Feifei Xu 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit e4643ea3d2034f05e4a45fed2d0a5dab4d2ba600
Author: Mukul Joshi 
Date:   Tue Jun 17 22:10:15 2025 -0400

    drm/amdgpu: Fix CU info calculations for GFX 12.1
    
    This patch fixes the CU info calculations for gfx 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 91689b5a7ce43e3742be6a249c7fc73be26b7d5f
Author: Mukul Joshi 
Date:   Thu Jan 9 22:04:08 2025 -0500

    drm/amdkfd: Update CWSR area calculations for GFX 12.1
    
    Update the SGPR, VGPR, HWREG size and number of waves supported
    for GFX 12.1 CWSR memory limits. The CU calculation changed in
    topology, as a result, the values need to be updated.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Feifei Xu 
    Signed-off-by: Alex Deucher 

commit db9ca58e164a9cb626ab13d22a0ada1a63887f1c
Author: Hawking Zhang 
Date:   Wed Jul 2 16:21:26 2025 +0800

    drm/amdgpu: Add soc v1_0 ih client id table
    
    To acommandate the specific ih client for soc v1_0
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 0c9ad4728687f4e4c8cec290540a9dc0956d3243
Author: Mukul Joshi 
Date:   Mon Jun 23 17:15:32 2025 -0400

    drm/amdgpu: Flush TLB on all XCCs on GFX 12.1
    
    Currently, the driver code is flushing TLB on XCC 0 only.
    Fix it by flushing on all XCCs within the partition.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 20ba98326f4c69e6bf8d1f42942ece485a675b27
Author: mythilam 
Date:   Thu Dec 4 11:04:12 2025 +0530

    drm/amd/pm: restore SCLK settings after S0ix resume
    
    User-configured SCLK(GPU core clock)frequencies were not persisting
    across S0ix suspend/resume cycles on smu v14 hardware.
    The issue occurred because of the code resetting clock frequency
    to zero during resume.
    
    This patch addresses the problem by:
    - Preserving user-configured values in driver and sets the
      clock frequency across resume
    - Preserved settings are sent to the hardware during resume
    
    Signed-off-by: mythilam 
    Acked-by: Alex Deucher 
    Reviewed-by: Yang Wang 
    Signed-off-by: Alex Deucher 

commit 1bc44dee2647b720065b71d57e594f70ea52fb3e
Author: Saleemkhan Jamadar 
Date:   Thu Dec 11 23:06:53 2025 +0530

    drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually
    
    This should not be used indiviually, use amdgpu_bo_gpu_offset
    with bo reserved.
    
    v3 - unpin bo in queue destroy (Christian)
    v2 - pin bo so that offset returned won't change after unlock (Christian)
    
    Signed-off-by: Saleemkhan Jamadar 
    Suggested-by: Christian König 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 81af7f1718a62c4eb9a1fc22263bf8a4f888fd05
Author: Lijo Lazar 
Date:   Mon Dec 8 12:55:29 2025 +0530

    drm/amdgpu: Change set ip clock/power gating param
    
    It's not required to use generic void *, change to struct amdgpu_device *.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 9498d18739b3e93b308809910692dd8eef862679
Author: Lijo Lazar 
Date:   Mon Dec 8 12:41:37 2025 +0530

    drm/amdgpu: Use helper to get ip block
    
    Replace individual searches with the utility function get_ip_block
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit b6b06640a84d59bcebbae9dad2af4f5db7993e07
Author: Lijo Lazar 
Date:   Mon Dec 8 12:32:52 2025 +0530

    drm/amdgpu: Move ip block related functions
    
    Move ip block related functions to amdgpu_ip.c. No functional change
    intended.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 20880a3fd5dd7bca1a079534cf6596bda92e107d
Author: Alex Deucher 
Date:   Wed Dec 10 11:02:30 2025 -0500

    drm/amdgpu: fix a job->pasid access race in gpu recovery
    
    Avoid a possible UAF in GPU recovery due to a race between
    the sched timeout callback and the tdr work queue.
    
    The gpu recovery function calls drm_sched_stop() and
    later drm_sched_start().  drm_sched_start() restarts
    the tdr queue which will eventually free the job.  If
    the tdr queue frees the job before time out callback
    completes, the job will be freed and we'll get a UAF
    when accessing the pasid.  Cache it early to avoid the
    UAF.
    
    Example KASAN trace:
    [  493.058141] BUG: KASAN: slab-use-after-free in amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]
    [  493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323
    [  493.074892]
    [  493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G            E       6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary)
    [  493.076493] Tainted: [E]=UNSIGNED_MODULE
    [  493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019
    [  493.076500] Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]
    [  493.076512] Call Trace:
    [  493.076515]  
    [  493.076518]  dump_stack_lvl+0x64/0x80
    [  493.076529]  print_report+0xce/0x630
    [  493.076536]  ? _raw_spin_lock_irqsave+0x86/0xd0
    [  493.076541]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
    [  493.076545]  ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]
    [  493.077253]  kasan_report+0xb8/0xf0
    [  493.077258]  ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]
    [  493.077965]  amdgpu_device_gpu_recover+0x968/0x990 [amdgpu]
    [  493.078672]  ? __pfx_amdgpu_device_gpu_recover+0x10/0x10 [amdgpu]
    [  493.079378]  ? amdgpu_coredump+0x1fd/0x4c0 [amdgpu]
    [  493.080111]  amdgpu_job_timedout+0x642/0x1400 [amdgpu]
    [  493.080903]  ? pick_task_fair+0x24e/0x330
    [  493.080910]  ? __pfx_amdgpu_job_timedout+0x10/0x10 [amdgpu]
    [  493.081702]  ? _raw_spin_lock+0x75/0xc0
    [  493.081708]  ? __pfx__raw_spin_lock+0x10/0x10
    [  493.081712]  drm_sched_job_timedout+0x1b0/0x4b0 [gpu_sched]
    [  493.081721]  ? __pfx__raw_spin_lock_irq+0x10/0x10
    [  493.081725]  process_one_work+0x679/0xff0
    [  493.081732]  worker_thread+0x6ce/0xfd0
    [  493.081736]  ? __pfx_worker_thread+0x10/0x10
    [  493.081739]  kthread+0x376/0x730
    [  493.081744]  ? __pfx_kthread+0x10/0x10
    [  493.081748]  ? __pfx__raw_spin_lock_irq+0x10/0x10
    [  493.081751]  ? __pfx_kthread+0x10/0x10
    [  493.081755]  ret_from_fork+0x247/0x330
    [  493.081761]  ? __pfx_kthread+0x10/0x10
    [  493.081764]  ret_from_fork_asm+0x1a/0x30
    [  493.081771]  
    
    Fixes: a72002cb181f ("drm/amdgpu: Make use of drm_wedge_task_info")
    Link: https://github.com/HansKristian-Work/vkd3d-proton/pull/2670
    Cc: SRINIVASAN.SHANMUGAM@amd.com
    Cc: vitaly.prosyak@amd.com
    Cc: christian.koenig@amd.com
    Suggested-by: Matthew Brost 
    Reviewed-by: Srinivasan Shanmugam 
    Reviewed-by: Lijo Lazar 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit a1a445f3de8d3fd3f2e1c9e502058ae38531513f
Author: Taimur Hassan 
Date:   Fri Dec 5 19:11:43 2025 -0500

    drm/amd/display: Promote DC to 3.2.363
    
    This version brings along the following updates:
    
    - Replay Video Conferencing V2
    - Fix scratch registers offsets for DCN35 and DCN351
    - Fix DP no audio issue
    - Add use_max_lsw parameter
    - Fix presentation of Z8 efficiency
    - Add USB-C DP Alt Mode lane limitation in DCN32
    - Support DRR granularity
    - Don't disable DPCD mst_en if sink connected
    - Set enable_legacy_fast_update to false for DCN35/351
    - Split update_planes_and_stream_v3 into parts (V2)
    
    Signed-off-by: Taimur Hassan 
    Signed-off-by: Chenyu Chen 
    Acked-by: Wayne Lin 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit d8e4e7086ab1ad7dbe6dee3b9081abe65e86001b
Author: Taimur Hassan 
Date:   Fri Dec 5 16:27:16 2025 -0500

    drm/amd/display: [FW Promotion] Release 0.1.40.0
    
    Summary for changes in firmware:
    * Update DCHVM restore sequence for dcn35
    * Add 2 new debug polling methods for dchvm "busy" during IPS entry for DCN35
    
    Signed-off-by: Taimur Hassan 
    Signed-off-by: Chenyu Chen 
    Acked-by: Wayne Lin 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit d38ec099aa6fb792e0a2064226074e57b17792a3
Author: Dominik Kaszewski 
Date:   Fri Oct 31 13:01:35 2025 +0100

    drm/amd/display: Split update_planes_and_stream_v3 into parts (V2)
    
    [Why]
    Currently all of the preparation and execution of plane update is done
    under a DC lock, blocking other code from accessing DC for longer than
    strictly necessary.
    
    [How]
    Break the v3 update flow into 3 parts:
        * prepare - locked, calculate update flow and modify DC state
        * execute - unlocked, program hardware
        * cleanup - locked, finalize DC state and free temp resources
    Legacy v2 flow too compilicated to break down for now, link new API
    with old by executing everything in slightly misnamed prepare stage.
    
    V2:
    Keep the new code structure, but point all users back at the old code,
    until fully tested.
    
    Reviewed-by: Nicholas Kazlauskas 
    Signed-off-by: Dominik Kaszewski 
    Signed-off-by: Roman Li 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit cb7a978c7c425e2666d6397f1297b3e8fe4f0a5d
Author: Charlene Liu 
Date:   Tue Dec 2 15:51:31 2025 -0500

    drm/amd/display: DPP low mem pwr related adjustment -Part I
    
    [why]
    Default low pwr mem state get chagned.
    SW needs to wake mem up first
    also need to put back to LS again after use: will do in Part II.
    
    Reviewed-by: Leo Chen 
    Signed-off-by: Charlene Liu 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 8ae9d73b3a31f3f0da92973f2672ba7a6347db88
Author: Fudong Wang 
Date:   Fri Dec 5 09:15:35 2025 +0800

    drm/amd/display: Set enable_legacy_fast_update to false for DCN35/351
    
    [Why]
    Existing logic will treat color temperature update = full update, cause
    user color temp adjustment goes wait for update logic and fsleep in that
    cause the adjustment not smooth.
    
    [How]
    Let DCN35/351 to follow DCN401 to set default value to false.
    
    Reviewed-by: Nicholas Kazlauskas 
    Signed-off-by: Fudong Wang 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 9aeb31b2456452257ad1ff7ec566f21bab1f3e8a
Author: Peichen Huang 
Date:   Tue Nov 18 11:19:36 2025 +0800

    drm/amd/display: Don't disable DPCD mst_en if sink connected
    
    [WHY]
    User may connect mst dock with multi monitors and do quick unplug
    and plug in one of the monitor. This operatioin may create CSN from
    dock to display driver. Then display driver would disable and then enable
    mst link and also disable/enable DPCD mst_en bit in dock RX. However,
    when mst_en bit being disabled, if dock has another CSN message to
    transmit then the message would be removed because of the disabling of
    mst_en. In this case, the message is missing and it ends up no display in
    the replugged monitor.
    
    [HOW]
    Don't disable mst_en bit when link still has sink connected.
    
    Reviewed-by: Wenjing Liu 
    Signed-off-by: Peichen Huang 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 2f912935168a3122371f1de85eed8d9cce192d0c
Author: Weiguang Li 
Date:   Thu Nov 27 17:49:49 2025 +0800

    drm/amd/display: Support DRR granularity
    
    [Why&How]
    Support DRR granularity for coasting Vtotal calculation
    
    Reviewed-by: Robin Chen 
    Reviewed-by: Wenjing Liu 
    Signed-off-by: Weiguang Li 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit cea573a8e1ed83840a2173d153dd68e172849d44
Author: LinCheng Ku 
Date:   Wed Dec 3 10:18:16 2025 +0800

    drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
    
    [Why]
    USB-C DisplayPort Alt Mode with concurrent USB data needs lane count
    limitation to prevent incorrect 4-lane DP configuration when only 2 lanes
    are available due to hardware lane sharing between DP and USB3.
    
    [How]
    Query DMUB for Alt Mode status (is_dp_alt_disable, is_usb, is_dp4) in
    dcn32_link_encoder_get_max_link_cap() and cap DP to 2 lanes when USB is
    active on USB-C port. Added inline documentation explaining the USB-C
    lane sharing constraint.
    
    Reviewed-by: PeiChen Huang 
    Signed-off-by: LinCheng Ku 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit db2373ad05d41069f3eb39c6963a131b7fdc9f2b
Author: Austin Zheng 
Date:   Mon Nov 3 18:00:50 2025 -0500

    drm/amd/display: Fix presentation of Z8 efficiency
    
    [Why/How]
    Should differentiate when vblank is or isn't included
    
    Reviewed-by: Dillon Varone 
    Signed-off-by: Austin Zheng 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 2497eda57025abe1349207a9726da02aae699bca
Author: Oleh Kuzhylnyi 
Date:   Tue Nov 25 15:34:37 2025 +0100

    drm/amd/display: Add use_max_lsw parameter
    
    [WHY&HOW]
    Add use_max_lsw parameter to make prefetch for linear surfaces similar to
    tiled.
    
    Reviewed-by: Dillon Varone 
    Signed-off-by: Oleh Kuzhylnyi 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit bf5e396957acafd46003318965500914d5f4edfa
Author: Charlene Liu 
Date:   Fri Nov 28 19:38:31 2025 -0500

    drm/amd/display: Fix DP no audio issue
    
    [why]
    need to enable APG_CLOCK_ENABLE enable first
    also need to wake up az from D3 before access az block
    
    Reviewed-by: Swapnil Patel 
    Signed-off-by: Charlene Liu 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 576e032e909c8a6bb3d907b4ef5f6abe0f644199
Author: Ray Wu 
Date:   Fri Nov 28 09:14:09 2025 +0800

    drm/amd/display: Fix scratch registers offsets for DCN351
    
    [Why]
    Different platforms use different NBIO header files,
    causing display code to use differnt offset and read
    wrong accelerated status.
    
    [How]
    - Unified NBIO offset header file across platform.
    - Correct scratch registers offsets to proper locations.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4667
    Cc: Mario Limonciello 
    Cc: Alex Deucher 
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Ray Wu 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 49a63bc8eda0304ba307f5ba68305f936174f72d
Author: Ray Wu 
Date:   Fri Nov 28 08:58:13 2025 +0800

    drm/amd/display: Fix scratch registers offsets for DCN35
    
    [Why]
    Different platforms use differnet NBIO header files,
    causing display code to use differnt offset and read
    wrong accelerated status.
    
    [How]
    - Unified NBIO offset header file across platform.
    - Correct scratch registers offsets to proper locations.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4667
    Cc: Mario Limonciello 
    Cc: Alex Deucher 
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Ray Wu 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 3679a3ba427853df86de712e016624b4295e0554
Author: ChunTao Tso 
Date:   Mon Dec 1 15:47:50 2025 +0800

    drm/amd/display: Replay Video Conferencing V2
    
    [WHY&HOW]
    Add new coasting vtotal type and an union to optimize
    the video conference for more power saving.
    
    Reviewed-by: Robin Chen 
    Signed-off-by: ChunTao Tso 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 63387cbbb714d9f0d179d9d4560de1408d0906de
Author: Mario Limonciello (AMD) 
Date:   Tue Dec 9 16:00:29 2025 -0600

    drm/amd: Resume the device in thaw() callback when console suspend is disabled
    
    If console suspend has been disabled using `no_console_suspend` also
    wake up during thaw() so that some messages can be seen for debugging.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4191
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit e83f63da2ac776fbc30861e4ce8b798df6ee8a7a
Author: Jonathan Kim 
Date:   Mon Jun 23 14:12:58 2025 -0400

    drm/amdkfd: allow debug subscription to lds violations on gfx 1250
    
    GFX 1250 allows the debugger to subcribe to LDS out-of-range read/write
    memory violations.
    Bump IOCTL minor version and flag KFD capabilities for enablement
    hint.
    
    Signed-off-by: Jonathan Kim 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit bf2951e967fc241804613208268a14f493e9c3d7
Author: Likun Gao 
Date:   Tue Jun 24 10:58:50 2025 +0800

    drm/amdgpu: enable gpu tlb flush for gfxhub
    
    Enable gpu tlb flush for gfxhub without check gfx.is_poweron
    as gfx is power on by default for gfx v12_1 ASIC.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 2db0936438a044b9403dc69140226dfbf89b0b96
Author: Shaoyun Liu 
Date:   Thu Jun 19 12:40:46 2025 -0400

    drm/amd/include : Update MES v12 API header
    
    Add LDS out of range reporting support in mes API
    
    Signed-off-by: Shaoyun Liu 
    Reviewed-by: Jonathan Kim 
    Signed-off-by: Alex Deucher 

commit a1f83bd71376dbf4ca2126b4f6294173356cc5d3
Author: Le Ma 
Date:   Mon Jun 16 18:56:41 2025 +0800

    drm/amdgpu: flush tlb properly for GMC v12.1 in early phase
    
    Flush tlb properly for GMC v12.1
    
    Signed-off-by: Le Ma 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit a848986a384562bd64cf4e37bc128a8d78685add
Author: Le Ma 
Date:   Wed Jun 11 20:35:50 2025 +0800

    drm/amdgpu: Use AMDGPU_IS_GFXHUB to screen out GFXHUB for GMC v12.1
    
    There're multiple gfxhubs on GMC v12.1
    
    Signed-off-by: Le Ma 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit bb562c955e174f028ed06e92fdb23411ad456f0a
Author: Likun Gao 
Date:   Wed Jun 18 17:56:30 2025 +0800

    drm/amdgpu: only copy ucode for enabled xcc
    
    Only copy ucode for enabled xcc instead of copy for all 8 xcc
    for rlc autoload on gfx v12_1 to save time.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 12323f9588ffbea2ef448679b50bf1eabca98b21
Author: chong li 
Date:   Tue Dec 9 11:16:54 2025 +0800

    drm/amdgpu: fix issue when switch NPS1 to NPSX
    
    fix the function execution sequence after removing
    kgd2kfd_init_zone_device out of gpu full access region.
    
    Fixes: c71980a3fc1d ("drm/amdgpu: reduce the full gpu access time in amdgpu_device_init.")
    Signed-off-by: chong li 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 4ec227c1586fedebfe0f50761fc507fc443b089e
Author: Srinivasan Shanmugam 
Date:   Wed Dec 10 12:15:56 2025 +0530

    drm/amd/display: Fix 64-bit state pointer passed as 32-bit GPINT response buffer
    
    edp_pr_get_state() incorrectly casts a uint64_t * to uint32_t * when
    calling dc_wake_and_execute_gpint(). The GPINT path writes only 32 bits,
    leaving the upper 32 bits of the u64 output uninitialized. Replace the
    cast with a u32 temporary and copy the result into the u64 pointer.
    
    Fixes the below:
    drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c
        1448 bool edp_pr_get_state(const struct dc_link *link, uint64_t *state)
                                                               ^^^^^^^^^^^^^^^
        1449 {
    
        ...
    
        1457         do {
        1458                 // Send gpint command and wait for ack
    --> 1459                 if (!dc_wake_and_execute_gpint(dc->ctx, DMUB_GPINT__GET_REPLAY_STATE, panel_inst,
        1460                                                (uint32_t *)state, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY)) {
                                                            ^^^^^^^^^^^^^^^^^
    
    The dc_wake_and_execute_gpint() function doesn't take a u64, it takes a
    u32.  It tries to initialize the state to zero at the start but that's
    not going to work because of the type mismatch.  It suggests that
    callers are allowed to pass uninitialized data to edp_pr_get_state() but
    at present there are no callers so this is only a bug in the code but
    doesn't affect runtime.
    
        1461                         // Return invalid state when GPINT times out
        1462                         *state = PR_STATE_INVALID;
        1463                 }
    
    Fixes: 74ce00932e7e ("drm/amd/display: Refactor panel replay set dmub cmd flow")
    Reported by: Dan Carpenter 
    Cc: Robin Chen 
    Cc: Jack Chang 
    Cc: Leon Huang 
    Cc: Alex Hung 
    Cc: Aurabindo Pillai 
    Cc: Roman Li 
    Cc: Harry Wentland 
    Cc: Tom Chung 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Deucher 

commit 2b950ac91314ee25daafd3be37ca12db2540f80f
Author: Shaoyun Liu 
Date:   Tue Nov 4 11:27:12 2025 -0500

    drm/amd/include : Update MES v12 comments on RESET API
    
    Added comments for the layout of contents that addressed by doorbell_offset_addr
    in RESET API
    
    Signed-off-by: Shaoyun Liu 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 95a8ddde36601d0a645475fb080ed118db59c8c3
Author: Nick Hu 
Date:   Tue Dec 2 14:07:41 2025 +0800

    irqchip/riscv-aplic: Preserve APLIC states across suspend/resume
    
    The APLIC states might be reset when the platform enters a low power
    state, but the register states are not being preserved and restored,
    which prevents interrupt delivery after the platform resumes.
    Solve this by adding a syscore ops and a power management notifier to
    preserve and restore the APLIC states on suspend and resume.
    
    [ tglx: Folded the build fix provided by Geert ]
    
    Signed-off-by: Nick Hu 
    Signed-off-by: Thomas Gleixner 
    Reviewed-by: Yong-Xuan Wang 
    Reviewed-by: Cyan Yang 
    Reviewed-by: Nutty Liu 
    Reviewed-by: Anup Patel 
    Link: https://patch.msgid.link/20251202-preserve-aplic-imsic-v3-2-1844fbf1fe92@sifive.com

commit d400dad620ab146303ba0d5ffd1b3c6639cc4fa1
Author: Jouni Högander 
Date:   Tue Dec 16 15:03:51 2025 +0200

    drm/i915/display: Allow async flip when Selective Fetch is enabled
    
    Fix silent conflict during drm-next backmerge causing async flips being
    rejected when Selective Fetch is enabled.
    
    Fixes: b8304863a399 ("Merge drm/drm-next into drm-intel-next")
    Cc: Rodrigo Vivi 
    Signed-off-by: Jouni Högander 
    Acked-by: Jani Nikula 
    Link: https://patch.msgid.link/20251216130351.2799110-1-jouni.hogander@intel.com
    Signed-off-by: Rodrigo Vivi 

commit de4761fb57f6a71eeb5a4c1167ae3606b08d8f59
Author: Randy Dunlap 
Date:   Mon Nov 3 16:20:01 2025 -0800

    dmaengine: shdma: correct most kernel-doc issues in shdma-base.h
    
    Fix kernel-doc comments in include/linux/shdma-base.h to avoid
    most warnings:
    
    - prefix an enum name with "enum"
    - prefix enum values with '@'
    - prefix struct member names with '@'
    
    shdma-base.h:28: warning: cannot understand function prototype:
     'enum shdma_pm_state '
    Warning: shdma-base.h:103 struct member 'desc_completed' not described
     in 'shdma_ops'
    Warning: shdma-base.h:103 struct member 'halt_channel' not described
     in 'shdma_ops'
    Warning: shdma-base.h:103 struct member 'channel_busy' not described
     in 'shdma_ops'
    Warning: shdma-base.h:103 struct member 'slave_addr' not described
     in 'shdma_ops'
    Warning: shdma-base.h:103 struct member 'desc_setup' not described
     in 'shdma_ops'
    Warning: shdma-base.h:103 struct member 'set_slave' not described
     in 'shdma_ops'
    Warning: shdma-base.h:103 struct member 'setup_xfer' not described
     in 'shdma_ops'
    Warning: shdma-base.h:103 struct member 'start_xfer' not described
     in 'shdma_ops'
    Warning: shdma-base.h:103 struct member 'embedded_desc' not described
     in 'shdma_ops'
    Warning: shdma-base.h:103 struct member 'chan_irq' not described
     in 'shdma_ops'
    
    This one is not fixed: from 4f46f8ac80416:
    Warning: shdma-base.h:103 struct member 'get_partial' not described
     in 'shdma_ops'
    
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251104002001.445297-1-rdunlap@infradead.org
    Signed-off-by: Vinod Koul 

commit f5a4aa643ee968137eea902aa321c58c14c256c7
Author: Randy Dunlap 
Date:   Sat Nov 1 12:15:24 2025 -0700

    dmaengine: dw_edma: correct kernel-doc warnings in 
    
    Use the correct enum name in its kernel-doc heading.
    Add ending ':' to struct member names.
    Drop the @id: kernel-doc entry since there is no struct member named 'id'.
    
    edma.h:46: warning: expecting prototype for struct dw_edma_core_ops.
     Prototype was for struct dw_edma_plat_ops instead
    Warning: edma.h:101 struct member 'ops' not described in 'dw_edma_chip'
    Warning: edma.h:101 struct member 'flags' not described in 'dw_edma_chip'
    Warning: edma.h:101 struct member 'reg_base' not described
     in 'dw_edma_chip'
    Warning: edma.h:101 struct member 'll_wr_cnt' not described
     in 'dw_edma_chip'
    Warning: edma.h:101 struct member 'll_rd_cnt' not described
     in 'dw_edma_chip'
    Warning: edma.h:101 struct member 'll_region_wr' not described
     in 'dw_edma_chip'
    Warning: edma.h:101 struct member 'll_region_rd' not described
     in 'dw_edma_chip'
    Warning: edma.h:101 struct member 'dt_region_wr' not described
     in 'dw_edma_chip'
    Warning: edma.h:101 struct member 'dt_region_rd' not described
     in 'dw_edma_chip'
    Warning: edma.h:101 struct member 'mf' not described in 'dw_edma_chip'
    
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251101191524.1991135-1-rdunlap@infradead.org
    Signed-off-by: Vinod Koul 

commit 3b81235280026c551660c6374ede9599fc82f617
Author: Sakari Ailus 
Date:   Mon Oct 27 15:32:32 2025 +0200

    dmaengine: zynqmp_dma: Remove redundant pm_runtime_mark_last_busy() calls
    
    pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(),
    pm_runtime_autosuspend() and pm_request_autosuspend() now include a call
    to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to
    pm_runtime_mark_last_busy().
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Abin Joseph 
    Link: https://patch.msgid.link/20251027133232.392898-6-sakari.ailus@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 35d522a9612f5ba83192416521725acede02c28f
Author: Sakari Ailus 
Date:   Mon Oct 27 15:32:31 2025 +0200

    dmaengine: ti: Remove redundant pm_runtime_mark_last_busy() calls
    
    pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(),
    pm_runtime_autosuspend() and pm_request_autosuspend() now include a call
    to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to
    pm_runtime_mark_last_busy().
    
    Signed-off-by: Sakari Ailus 
    Link: https://patch.msgid.link/20251027133232.392898-5-sakari.ailus@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 01f2bcf06d7e0e3c4badd03c030cf634ca10a172
Author: Sakari Ailus 
Date:   Mon Oct 27 15:32:30 2025 +0200

    dmaengine: ste_dma40: Remove redundant pm_runtime_mark_last_busy() calls
    
    pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(),
    pm_runtime_autosuspend() and pm_request_autosuspend() now include a call
    to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to
    pm_runtime_mark_last_busy().
    
    Signed-off-by: Sakari Ailus 
    Reviewed-by: Linus Walleij 
    Link: https://patch.msgid.link/20251027133232.392898-4-sakari.ailus@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 5f6f0cad6d2d599b765d572216a290e48bfdcb5f
Author: Sakari Ailus 
Date:   Mon Oct 27 15:32:28 2025 +0200

    dmaengine: pl330: Remove redundant pm_runtime_mark_last_busy() calls
    
    pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(),
    pm_runtime_autosuspend() and pm_request_autosuspend() now include a call
    to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to
    pm_runtime_mark_last_busy().
    
    Signed-off-by: Sakari Ailus 
    Link: https://patch.msgid.link/20251027133232.392898-2-sakari.ailus@linux.intel.com
    Signed-off-by: Vinod Koul 

commit bce33c132a2061c9a7958474c3e2d030c22664de
Author: Sakari Ailus 
Date:   Mon Oct 27 15:32:27 2025 +0200

    dmaengine: at_xdmac: Remove redundant pm_runtime_mark_last_busy() calls
    
    pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(),
    pm_runtime_autosuspend() and pm_request_autosuspend() now include a call
    to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to
    pm_runtime_mark_last_busy().
    
    Signed-off-by: Sakari Ailus 
    Link: https://patch.msgid.link/20251027133232.392898-1-sakari.ailus@linux.intel.com
    Signed-off-by: Vinod Koul 

commit c381f1a38a4c7542cc6ec049d4dcff90a9423e89
Author: Johan Hovold 
Date:   Mon Nov 17 17:18:51 2025 +0100

    dmaengine: ti: k3-udma: enable compile testing
    
    There does not seem to be anything preventing the K3 UDMA drivers from
    being compile tested (on arm64 as one dependency depends on ARM64) so
    enable compile testing for wider build coverage.
    
    Note that the ring accelerator dependency can only be selected when
    "TI SOC drivers support" (SOC_TI) is enabled so select that option too.
    
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251117161851.11242-1-johan@kernel.org
    Signed-off-by: Vinod Koul 

commit 8be4f3cbe263d22053d7afea4efee2e7178eee21
Author: Amelie Delaunay 
Date:   Fri Nov 21 14:36:59 2025 +0100

    dmaengine: stm32-dma3: introduce ddata2dev helper
    
    The purpose of this helper is to 'standardize' device pointer retrieval,
    similar to the chan2dev() helper.
    ddata2dev() helper returns the device pointer from struct dma_device stored
    in stm32_dma3_ddata structure.
    Device pointer from struct dma_device has been initialized with &pdev->dev,
    so the ddata2dev helper returns &pdev->dev.
    
    Signed-off-by: Amelie Delaunay 
    Link: https://patch.msgid.link/20251121-dma3_improv-v2-4-76a207b13ea6@foss.st.com
    Signed-off-by: Vinod Koul 

commit dea737e31c2c62df5a45871bfb4ceb90a112dbd8
Author: Amelie Delaunay 
Date:   Fri Nov 21 14:36:58 2025 +0100

    dmaengine: stm32-dma3: restore channel semaphore status after suspend
    
    Depending on the power state reached during suspend, the CxSEMCR register
    could have been reset, and the semaphore released.
    On resume, try to take the semaphore again. If the semaphore cannot be
    taken, an error log displaying the channel number and channel user is
    generated.
    
    This requires introducing two new functions:
    stm32_dma3_pm_suspend(), where the status of each channel is checked
    because suspension is not allowed if a channel is still running;
    stm32_dma3_pm_resume(), where the channel semaphore is restored if it was
    taken before suspend.
    
    Signed-off-by: Amelie Delaunay 
    Link: https://patch.msgid.link/20251121-dma3_improv-v2-3-76a207b13ea6@foss.st.com
    Signed-off-by: Vinod Koul 

commit d26eb4a75a4a2bbf27305e62ad82cedf5f8c577c
Author: Amelie Delaunay 
Date:   Fri Nov 21 14:36:57 2025 +0100

    dmaengine: stm32-dma3: introduce channel semaphore helpers
    
    Before restoring semaphore status after suspend, introduce new functions
    to handle semaphore operations :
    - stm32_dma3_get_chan_sem() to take the semaphore
    - stm32_dma3_put_chan_sem() to release the semaphore
    Also, use a new boolean variable semaphore_taken, which is true when the
    semaphore has been taken and false when it has been released.
    
    Signed-off-by: Amelie Delaunay 
    Link: https://patch.msgid.link/20251121-dma3_improv-v2-2-76a207b13ea6@foss.st.com
    Signed-off-by: Vinod Koul 

commit 0d41ed4ea496fabbb4dc21171e32d9a924c2a661
Author: Amelie Delaunay 
Date:   Fri Nov 21 14:36:56 2025 +0100

    dmaengine: stm32-dma3: use module_platform_driver
    
    Without module_platform_driver(), stm32-dma3 doesn't have a
    module_exit procedure. Once stm32-dma3 module is inserted, it
    can't be removed, marked busy.
    Use module_platform_driver() instead of subsys_initcall() to register
    (insmod) and unregister (rmmod) stm32-dma3 driver.
    
    Reviewed-by: Eugen Hristev 
    Signed-off-by: Amelie Delaunay 
    Link: https://patch.msgid.link/20251121-dma3_improv-v2-1-76a207b13ea6@foss.st.com
    Signed-off-by: Vinod Koul 

commit 15b0c43aa621fb77b32c46eb642eaf25557e9fdb
Author: Ricardo Robaina 
Date:   Fri Nov 14 09:36:17 2025 -0300

    audit: include source and destination ports to NETFILTER_PKT
    
    NETFILTER_PKT records show both source and destination
    addresses, in addition to the associated networking protocol.
    However, it lacks the ports information, which is often
    valuable for troubleshooting.
    
    This patch adds both source and destination port numbers,
    'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and
    SCTP-related NETFILTER_PKT records.
    
     $ TESTS="netfilter_pkt" make -e test &> /dev/null
     $ ausearch -i -ts recent |grep NETFILTER_PKT
     type=NETFILTER_PKT ... proto=icmp
     type=NETFILTER_PKT ... proto=ipv6-icmp
     type=NETFILTER_PKT ... proto=udp sport=46333 dport=42424
     type=NETFILTER_PKT ... proto=udp sport=35953 dport=42424
     type=NETFILTER_PKT ... proto=tcp sport=50314 dport=42424
     type=NETFILTER_PKT ... proto=tcp sport=57346 dport=42424
    
    Link: https://github.com/linux-audit/audit-kernel/issues/162
    
    Signed-off-by: Ricardo Robaina 
    Acked-by: Florian Westphal 
    Signed-off-by: Paul Moore 

commit f19590b07cb620be1fcd5474c49515e21a05d406
Author: Ricardo Robaina 
Date:   Fri Nov 14 09:36:16 2025 -0300

    audit: add audit_log_nf_skb helper function
    
    Netfilter code (net/netfilter/nft_log.c and net/netfilter/xt_AUDIT.c)
    have to be kept in sync. Both source files had duplicated versions of
    audit_ip4() and audit_ip6() functions, which can result in lack of
    consistency and/or duplicated work.
    
    This patch adds a helper function in audit.c that can be called by
    netfilter code commonly, aiming to improve maintainability and
    consistency.
    
    Suggested-by: Florian Westphal 
    Suggested-by: Paul Moore 
    Signed-off-by: Ricardo Robaina 
    Acked-by: Florian Westphal 
    Signed-off-by: Paul Moore 

commit bbfb8677d31a78a898c8d02e3ca58790b89a6dda
Author: Chu Guangqing 
Date:   Tue Nov 25 09:57:34 2025 +0800

    dmaengine: pl08x: Fix a spelling mistake
    
    "Accound" is an archaic spelling variant of "account". It had completely
    fallen out of formal use as early as the 17th century, when the spelling
    of Modern English became standardized. Here, it is corrected to "account"
    to enhance comprehension.
    
    Signed-off-by: Chu Guangqing 
    Link: https://patch.msgid.link/20251125015734.1572-1-chuguangqing@inspur.com
    Signed-off-by: Vinod Koul 

commit 08be54a9e56f9523b50d1923a94a48ef5890c0bc
Author: Bhanu Seshu Kumar Valluri 
Date:   Thu Nov 13 12:19:37 2025 +0530

    docs: dmaengine: add explanation for phys field in dma_async_tx_descriptor structure
    
    Describe the need to initialize the phys field in the dma_async_tx_descriptor
    structure during its initialization.
    
    Signed-off-by: Bhanu Seshu Kumar Valluri 
    Reviewed-by: Bagas Sanjaya 
    Link: https://patch.msgid.link/20251113064937.8735-1-bhanuseshukumar@gmail.com
    Signed-off-by: Vinod Koul 

commit f94163e950c9568fe2d2d88317d9602ce021e646
Author: Lad Prabhakar 
Date:   Tue Nov 25 21:26:21 2025 +0000

    dt-bindings: dma: rz-dmac: Document RZ/V2N SoC support
    
    Document the DMA controller on the Renesas RZ/V2N SoC, which is
    architecturally identical to the DMAC found on the RZ/V2H(P) SoC.
    
    Signed-off-by: Lad Prabhakar 
    Acked-by: Krzysztof Kozlowski 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251125212621.267397-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Vinod Koul 

commit c5a8f13f1e476c90f4bc184a58751d3e7ff88f2b
Author: Thomas Zimmermann 
Date:   Wed Nov 26 17:03:25 2025 +0100

    efi: Support EDID information
    
    In the EFI config table, rename LINUX_EFI_SCREEN_INFO_TABLE_GUID to
    LINUX_EFI_PRIMARY_DISPLAY_TABLE_GUID. Read sysfb_primary_display from
    the entry. In addition to the screen_info, the entry now also contains
    EDID information.
    
    In libstub, replace struct screen_info with struct sysfb_display_info
    from the kernel's sysfb_primary_display and rename functions
    accordingly.  Transfer it to the runtime kernel using the kernel's
    global state or the LINUX_EFI_PRIMARY_DISPLAY_TABLE_GUID config-table
    entry.
    
    With CONFIG_FIRMWARE_EDID=y, libstub now transfers the GOP device's EDID
    information to the kernel. If CONFIG_FIRMWARE_EDID=n, EDID information
    is disabled. Make the Kconfig symbol CONFIG_FIRMWARE_EDID available with
    EFI. Setting the value to 'n' disables EDID support.
    
    Also rename screen_info.c to primary_display.c and adapt the contained
    comment according to the changes.
    
    Link: https://lore.kernel.org/all/20251126160854.553077-8-tzimmermann@suse.de/
    Signed-off-by: Thomas Zimmermann 
    [ardb: depend on EFI_GENERIC_STUB not EFI, fix conflicts after dropping
           the preceding patch from the series]
    Signed-off-by: Ard Biesheuvel 

commit 7ac422cf7b16ec524bcd8e017459e328a4103f63
Author: Zide Chen 
Date:   Mon Dec 15 10:25:20 2025 -0800

    perf/x86/intel/cstate: Add Diamond Rapids support
    
    From a C-state residency profiling perspective, Diamond Rapids is
    similar to SRF and GNR, supporting core C1/C6, module C6, and
    package C2/C6 residency counters.  Similar to CWF, the C1E residency
    can be accessed via PMT only.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Ingo Molnar 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251215182520.115822-3-zide.chen@intel.com

commit 7e760ac4617b63628edd55a96be2fc85b7eaa435
Author: Zide Chen 
Date:   Mon Dec 15 10:25:19 2025 -0800

    perf/x86/intel/cstate: Add Nova Lake support
    
    Similar to Lunar Lake and Panther Lake, Nova Lake supports CC1/CC6/CC7
    and PC2/PC6/PC10 residency counters; it also adds support for MC6.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Ingo Molnar 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251215182520.115822-2-zide.chen@intel.com

commit 6d4b8d052ff22742c3980fa45f26b0969a9b6163
Author: Zide Chen 
Date:   Mon Dec 15 10:25:18 2025 -0800

    perf/x86/intel/cstate: Add Wildcat Lake support
    
    Wildcat Lake (WCL) is a low-power variant of Panther Lake.  From a
    C-state profiling perspective, it supports the same residency counters:
    CC1/CC6/CC7 and PC2/PC6/PC10.
    
    Signed-off-by: Zide Chen 
    Signed-off-by: Ingo Molnar 
    Reviewed-by: Dapeng Mi 
    Link: https://patch.msgid.link/20251215182520.115822-1-zide.chen@intel.com

commit 4fcae635887195d6ecc427d503d7671ca46bc11b
Author: Thomas Zimmermann 
Date:   Wed Nov 26 17:03:23 2025 +0100

    sysfb: Move edid_info into sysfb_primary_display
    
    Move x86's edid_info into sysfb_primary_display as a new field named
    edid. Adapt all users.
    
    An instance of edid_info has only been defined on x86. With the move
    into sysfb_primary_display, it becomes available on all architectures.
    Therefore remove this contraint from CONFIG_FIRMWARE_EDID.
    
    x86 fills the EDID data from boot_params.edid_info. DRM drivers pick
    up the raw data and make it available to DRM clients. Replace the
    drivers' references to edid_info and instead use the sysfb_display_info
    as passed from sysfb.
    
    Signed-off-by: Thomas Zimmermann 
    Acked-by: Arnd Bergmann 
    Acked-by: Ard Biesheuvel 
    Signed-off-by: Ard Biesheuvel 

commit 08e583ad68577ff5135d2b6fad1d3b4b400074a5
Author: Thomas Zimmermann 
Date:   Wed Nov 26 17:03:22 2025 +0100

    sysfb: Pass sysfb_primary_display to devices
    
    Instead of screen_info, store a copy of sysfb_primary_display as
    device data. Pick it up in drivers. Later changes will add additional
    data to the display info, such as EDID information.
    
    Signed-off-by: Thomas Zimmermann 
    Acked-by: Arnd Bergmann 
    Acked-by: Ard Biesheuvel 
    Reviewed-by: Richard Lyu 
    Signed-off-by: Ard Biesheuvel 

commit a41e0ab394e42c7c09ddd8155d2cc3ca17bdce55
Author: Thomas Zimmermann 
Date:   Wed Nov 26 17:03:21 2025 +0100

    sysfb: Replace screen_info with sysfb_primary_display
    
    Replace the global screen_info with sysfb_primary_display of type
    struct sysfb_display_info. Adapt all users of screen_info.
    
    Instances of screen_info are defined for x86, loongarch and EFI,
    with only one instance compiled into a specific build. Replace all
    of them with sysfb_primary_display.
    
    All existing users of screen_info are updated by pointing them to
    sysfb_primary_display.screen instead. This introduces some churn to
    the code, but has no impact on functionality.
    
    Boot parameters and EFI config tables are unchanged. They transfer
    screen_info as before. The logic in EFI's alloc_screen_info() changes
    slightly, as it now returns the screen field of sysfb_primary_display.
    
    Signed-off-by: Thomas Zimmermann 
    Acked-by: Arnd Bergmann 
    Acked-by: Ard Biesheuvel 
    Acked-by: Bjorn Helgaas  # drivers/pci/
    Reviewed-by: Richard Lyu 
    Signed-off-by: Ard Biesheuvel 

commit b945922619b77b95a48f254582ed86f33d24f560
Author: Thomas Zimmermann 
Date:   Wed Nov 26 17:03:20 2025 +0100

    sysfb: Add struct sysfb_display_info
    
    Add struct sysfb_display_info to wrap display-related state. For now
    it contains only the screen's video mode. Later EDID will be added as
    well.
    
    This struct will be helpful for passing display state to sysfb drivers
    or from the EFI stub library.
    
    Signed-off-by: Thomas Zimmermann 
    Acked-by: Arnd Bergmann 
    Acked-by: Ard Biesheuvel 
    Reviewed-by: Richard Lyu 
    Signed-off-by: Ard Biesheuvel 

commit 54bdafd7780850803385d6faf33034a0fa7cd4cc
Author: Thomas Zimmermann 
Date:   Wed Nov 26 17:03:19 2025 +0100

    efi: sysfb_efi: Reduce number of references to global screen_info
    
    Replace usage of global screen_info with local pointers. This will
    later reduce churn when screen_info is being moved.
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Richard Lyu 
    Acked-by: Arnd Bergmann 
    Acked-by: Ard Biesheuvel 
    Signed-off-by: Ard Biesheuvel 

commit b868070fbc023b254ac46607970612e059efdcd3
Author: Thomas Zimmermann 
Date:   Wed Nov 26 17:03:18 2025 +0100

    efi: earlycon: Reduce number of references to global screen_info
    
    Replace usage of global screen_info with local pointers. This will
    later reduce churn when screen_info is being moved.
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Richard Lyu 
    Acked-by: Arnd Bergmann 
    Acked-by: Ard Biesheuvel 
    Signed-off-by: Ard Biesheuvel 

commit c7c7eb5ed5a3896e57019f7b33e3b7dcb4ab73b4
Author: Tvrtko Ursulin 
Date:   Mon Dec 8 20:39:25 2025 +0100

    efi: sysfb_efi: Fix efidrmfb and simpledrmfb on Valve Steam Deck
    
    Valve Steam Deck has a 800x1280 portrait screen installed in a landscape
    orientation. The firmware offers a software-rotated 1280x800 mode, which
    GRUB can be made to switch to when displaying a boot menu. If this mode
    was selected frame buffer drivers will see this fake mode and fbcon
    rendering will be corrupted.
    
    Let us therefore add a selective quirk inside the current "swap with and
    height" handling, which will detect this exact mode and fix it up back to
    the native one.
    
    This will allow the DRM-based framebuffer drivers to detect the correct
    mode, apply the existing panel orientation quirk, and render the console
    in landscape mode with no corruption.
    
    Signed-off-by: Tvrtko Ursulin 
    Cc: Thomas Zimmermann 
    Cc: Ard Biesheuvel 
    Cc: Melissa Wen 
    Cc: linux-efi@vger.kernel.org
    Tested-by: Melissa Wen  # v3
    Reviewed-by: Thomas Zimmermann 
    [ardb: use local var to refer to screen_info]
    Signed-off-by: Ard Biesheuvel 

commit 7f2f1fd6fc050be874afa9eb52a0ff974f379869
Author: Tvrtko Ursulin 
Date:   Mon Dec 8 20:39:24 2025 +0100

    efi: sysfb_efi: Convert swap width and height quirk to a callback
    
    Convert the swapping of width and height quirk to a callback.
    
    Signed-off-by: Tvrtko Ursulin 
    Suggested-by: Ard Biesheuvel 
    Cc: Thomas Zimmermann 
    Cc: Ard Biesheuvel 
    Cc: Melissa Wen 
    Cc: linux-efi@vger.kernel.org
    Reviewed-by: Thomas Zimmermann 
    Tested-by: Melissa Wen  # v3
    [ardb: use local var to refer to screen_info]
    Signed-off-by: Ard Biesheuvel 

commit 449b87e81f3561bd907d3b9a31cf69590132a2df
Author: Tvrtko Ursulin 
Date:   Mon Dec 8 20:39:23 2025 +0100

    efi: sysfb_efi: Fix lfb_linelength calculation when applying quirks
    
    PIXEL_BIT_MASK formats can have either less or more than four bytes per
    pixel so lets fix the lfb_linelenght calculation when applying the
    swapped width and height quirks.
    
    Signed-off-by: Tvrtko Ursulin 
    Suggested-by: Thomas Zimmermann 
    Cc: Thomas Zimmermann 
    Cc: Ard Biesheuvel 
    Cc: Melissa Wen 
    Cc: linux-efi@vger.kernel.org
    Tested-by: Melissa Wen  # v3
    Reviewed-by: Thomas Zimmermann 
    Signed-off-by: Ard Biesheuvel 

commit bb2c941b3131437185e79c8f2a16469876664572
Author: Tvrtko Ursulin 
Date:   Mon Dec 8 20:39:22 2025 +0100

    efi: sysfb_efi: Replace open coded swap with the macro
    
    Replace the open coded width height swap with the standard macro.
    
    Signed-off-by: Tvrtko Ursulin 
    Suggested-by: Thomas Zimmermann 
    Cc: Thomas Zimmermann 
    Cc: Ard Biesheuvel 
    Cc: Melissa Wen 
    Cc: linux-efi@vger.kernel.org
    Reviewed-by: Thomas Zimmermann 
    Tested-by: Melissa Wen  # v3
    Signed-off-by: Ard Biesheuvel 

commit a4df2071f1a2bb5b003eb179e1a51625d26b04d5
Author: Johan Hovold 
Date:   Mon Oct 20 11:16:13 2025 +0200

    modpost: drop '*_probe' from section check whitelist
    
    Several symbol patterns used to be whitelisted to allow drivers to refer
    to functions annotated with __devinit and __devexit, which have since
    been removed.
    
    Commit e1dc1bfe5b27 ("modpost: remove more symbol patterns from the
    section check whitelist") removed most of these patterns but left
    '*_probe' after a reported warning in an irqchip driver.
    
    Turns out that was indeed an incorrect reference which has now been
    fixed by commit 9b685058ca93 ("irqchip/qcom-irq-combiner: Fix section
    mismatch").
    
    A recently added clocksource driver also relies on this suffix to
    suppress another valid warning, and that is being fixed separately. [1]
    
    Note that drivers with valid reasons for suppressing the warnings can
    use the __ref macros.
    
    Link: https://lore.kernel.org/lkml/20251017054943.7195-1-johan@kernel.org/ [1]
    Signed-off-by: Johan Hovold 
    Reviewed-by: Thomas Gleixner 
    Reviewed-by: Nathan Chancellor 
    Link: https://patch.msgid.link/20251020091613.22562-1-johan@kernel.org
    Signed-off-by: Nathan Chancellor 

commit 20f581834aacd743b3d95bbbb37a802d14cf3690
Author: Bartosz Golaszewski 
Date:   Thu Nov 6 16:44:51 2025 +0100

    dmaengine: qcom: bam_dma: use lock guards
    
    Simplify locking across the driver with lock guards from cleanup.h.
    
    Signed-off-by: Bartosz Golaszewski 
    Link: https://patch.msgid.link/20251106-qcom-bam-dma-refactor-v1-2-0e2baaf3d81a@linaro.org
    Signed-off-by: Vinod Koul 

commit 892f2bb487916cb15432912cd6aae445ab2f48f0
Author: Bartosz Golaszewski 
Date:   Thu Nov 6 16:44:50 2025 +0100

    dmaengine: qcom: bam_dma: order includes alphabetically
    
    For easier maintenance and better readability order all includes
    alphabetically.
    
    Signed-off-by: Bartosz Golaszewski 
    Reviewed-by: Dmitry Baryshkov 
    Link: https://patch.msgid.link/20251106-qcom-bam-dma-refactor-v1-1-0e2baaf3d81a@linaro.org
    Signed-off-by: Vinod Koul 

commit f9ef8dedee34e2d7828d5a6a0643cd969aaa8437
Author: Krzysztof Kozlowski 
Date:   Mon Dec 8 03:07:30 2025 +0100

    dmaengine: dw-edma: Fix confusing cleanup.h syntax
    
    Initializing automatic __free variables to NULL without need (e.g.
    branches with different allocations), followed by actual allocation is
    in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Manivannan Sadhasivam 
    Link: https://patch.msgid.link/20251208020729.4654-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit faf317d4c705b426018fa29a14e411ec037b7560
Author: Sven Peter 
Date:   Mon Dec 15 19:37:50 2025 +1000

    arm64: dts: apple: t8103,t60xx,t8112: Add SMC RTC node
    
    The System Manager Controller of all M1/M2 SoCs supports the RTC
    sub-device.
    
    Reviewed-by: Neal Gompa 
    Signed-off-by: James Calligeros 
    Link: https://patch.msgid.link/20251215-macsmc-subdevs-v6-6-0518cb5f28ae@gmail.com
    Signed-off-by: Sven Peter 

commit 6c2fd7a71e7ab490a0a9d591486d923712012f59
Author: Vivek Aknurwar 
Date:   Tue Oct 14 00:34:54 2025 -0700

    firmware: arm_scmi: Increase performance MAX_OPPS limit to 64
    
    Some platforms expose more than 32 operating performance points (OPPs)
    per performance domain via the SCMI performance protocol, but the
    driver currently limits the number of OPPs it can handle to 32 via
    MAX_OPPS.
    
    Bump MAX_OPPS to 64 so that these platforms can register all their
    performance levels. This is an internal limit in the driver only and
    does not affect the SCMI protocol ABI.
    
    64 is chosen as the next power of two above the existing limit.
    
    Signed-off-by: Vivek Aknurwar 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Alexey Klimov 
    Message-Id: <20251014073454.461999-1-vivek.aknurwar@oss.qualcomm.com>
    (sudeep.holla: Updated commit log to reflect driver limitation rather than spec)
    Signed-off-by: Sudeep Holla 

commit a3c46c82d8a2075dfe2a2af1431486c8b128e93c
Author: Dan Carpenter 
Date:   Mon Oct 27 18:16:06 2025 +0300

    firmware: arm_scmi: Move boiler plate code into the get info functions
    
    This code to check whether the selector is valid and if the item has
    already been recorded in the array can be moved to the
    scmi_pinctrl_get_function_info() type functions.  That way it's in
    one place instead of duplicated in each of the callers.
    
    Remove the check for if "pi->nr_groups == 0" because if that were the
    case then "selector >= pi->nr_groups" would already be true.  It already
    was not checked for the pin case so this makes things a bit more uniform.
    
    Also remove the check for if (!pin) since pin is an offset into the
    middle of an array and can't be NULL.
    
    Signed-off-by: Dan Carpenter 
    Reviewed-by: Cristian Marussi 
    Message-Id: <287b5302f583e3535d50617ec3b0856e38253171.1761576798.git.dan.carpenter@linaro.org>
    Signed-off-by: Sudeep Holla 

commit f6753869a25ebf0022fe531a31e4fd2435d5e1a5
Author: Artem Shimko 
Date:   Sun Nov 23 19:35:57 2025 +0300

    firmware: arm_scmi: Refactor reset domain handling
    
    Introduce scmi_reset_domain_lookup() to centralize domain ID validation
    and unify error reporting behaviour across the SCMI reset protocol.
    
    All reset domain operations are updated to use the new helper, removing
    duplicated validation logic and ensuring consistent handling of invalid
    domain IDs and lookup failures. This simplifies the internal flow and
    improves robustness of the reset protocol implementation.
    
    Suggested-by: Cristian Marussi 
    Signed-off-by: Artem Shimko 
    Message-Id: <20251123163557.230530-1-a.shimko.dev@gmail.com>
    Signed-off-by: Sudeep Holla 

commit 78d83b293891c597cef773eb17d9cc02b386f21a
Author: Lifeng Zheng 
Date:   Tue Dec 2 15:27:27 2025 +0800

    cpufreq: cpufreq_boost_trigger_state() optimization
    
    Optimize the error handling code in cpufreq_boost_trigger_state().
    
    Signed-off-by: Lifeng Zheng 
    Acked-by: Viresh Kumar 
    Reviewed-by: Jie Zhan 
    [ rjw: Changelog edit ]
    Link: https://patch.msgid.link/20251202072727.1368285-3-zhenglifeng1@huawei.com
    Signed-off-by: Rafael J. Wysocki 

commit 77cf053b041fe13d1fdd2e572e16ee7776ff687d
Author: Lifeng Zheng 
Date:   Tue Dec 2 15:27:26 2025 +0800

    cpufreq: Return -EOPNOTSUPP if no policy supports boost
    
    In cpufreq_boost_trigger_state(), if none of the the policies support
    boost, policy_set_boost() will not be called and this function will
    return 0.
    
    But it is better to return an error to indicate that the platform
    doesn't support boost.
    
    Signed-off-by: Lifeng Zheng 
    Acked-by: Viresh Kumar 
    Reviewed-by: Jie Zhan 
    [ rjw: Subject and changelog edits ]
    Link: https://patch.msgid.link/20251202072727.1368285-2-zhenglifeng1@huawei.com
    Signed-off-by: Rafael J. Wysocki 

commit 524696a19e34598c9173fdd5b32fb7e5d16a91d3
Author: Jani Nikula 
Date:   Mon Dec 15 14:09:08 2025 +0200

    drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
    
    Commit 469c1c9eb6c9 ("kernel-doc: Issue warnings that were silently
    discarded") started emitting warnings for cases that were previously
    silently discarded. One such case is in intel_wakeref.h:
    
    Warning: drivers/gpu/drm/i915/intel_wakeref.h:156 expecting prototype
      for __intel_wakeref_put(). Prototype was for INTEL_WAKEREF_PUT_ASYNC()
      instead
    
    Arguably kernel-doc should be able to handle this, as it's valid C, but
    having the flags defined between the function declarator and the body is
    just asking for trouble. Move the INTEL_WAKEREF_PUT_* macros away from
    there, making kernel-doc's life easier.
    
    While at it, reduce the unnecessary abstraction levels by removing the
    enum, and append _MASK to INTEL_WAKEREF_PUT_DELAY for clarity.
    
    Cc: Andy Shevchenko 
    Cc: Jonathan Corbet 
    Acked-by: Randy Dunlap 
    Tested-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251215120908.3515578-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit de86dbc0fb00bd3773db4b05d9f5926f0faa2244
Author: Francesco Dolcini 
Date:   Tue Dec 9 09:41:25 2025 +0100

    arm64: dts: ti: am62p-verdin: Fix SD regulator startup delay
    
    The power switch used to power the SD card interface might have
    more than 2ms turn-on time, increase the startup delay to 20ms to
    prevent failures.
    
    Fixes: 87f95ea316ac ("arm64: dts: ti: Add Toradex Verdin AM62P")
    Cc: stable@vger.kernel.org
    Signed-off-by: Francesco Dolcini 
    Link: https://patch.msgid.link/20251209084126.33282-1-francesco@dolcini.it
    Signed-off-by: Nishanth Menon 

commit b548f3949937b55ee19ab418343f05700fdf7009
Author: Francesco Dolcini 
Date:   Thu Dec 4 14:42:19 2025 +0100

    arm64: dts: ti: k3-am69-aquila-clover: Fix USB-C Sink PDO
    
    Change USB-C Sink PDO and the amount of power that the device can sink
    to zero to maximize compatibility with other USB peers (the Aquila
    Clover Board is not sinking any current, it is self powered).
    
    Fixes: 9f748a6177e1 ("arm64: dts: ti: am69-aquila: Add Clover")
    Signed-off-by: Francesco Dolcini 
    Link: https://patch.msgid.link/20251204134220.129304-3-francesco@dolcini.it
    Signed-off-by: Nishanth Menon 

commit 36ee9f8b1ae07fe82885a7a3553a5be347d3f978
Author: Francesco Dolcini 
Date:   Thu Dec 4 14:42:18 2025 +0100

    arm64: dts: ti: k3-am69-aquila-dev: Fix USB-C Sink PDO
    
    Change USB-C Sink PDO and the amount of power that the device can sink
    to zero to maximize compatibility with other USB peers (the Aquila
    Development Board is not sinking any current, it is self powered).
    
    Fixes: 39ac6623b1d8 ("arm64: dts: ti: Add Aquila AM69 Support")
    Signed-off-by: Francesco Dolcini 
    Link: https://patch.msgid.link/20251204134220.129304-2-francesco@dolcini.it
    Signed-off-by: Nishanth Menon 

commit e05f6566bc778bc1215283e667e18692d16b25f5
Author: Wadim Egorov 
Date:   Mon Nov 24 17:05:48 2025 +0100

    arm64: dts: ti: k3-am62(a)-phycore-som: Add bootphase tag to phy_gmii_sel
    
    Add the bootph-all property to the phy_gmii_sel node to ensure it is
    available during all boot phases. This is required when the bootloader
    is getting booted via network.
    
    Signed-off-by: Wadim Egorov 
    Link: https://patch.msgid.link/20251124160548.2273931-1-w.egorov@phytec.de
    Signed-off-by: Nishanth Menon 

commit a9bd8d35a88e0bf72ebf5a803eb4c7f8e4731e3e
Author: Daniel Schultz 
Date:   Mon Nov 24 01:08:42 2025 -0800

    arm64: dts: ti: k3-am62a-phycore-som: Add bootphase tag to cpsw_mac_syscon
    
    Add the "bootph-all" property to cpsw_mac_syscon.
    
    This fuse region contains the internal MAC address. Without this
    syscon node enabled, this interface will get a random MAC during
    network boot. This is problematic because the AM62Ax network
    boot is using BOOTP protocol for some binaries and this protocol
    does not support dynamic lease expiration. Therefore, the DHCP
    server can run out of free IP addresses.
    
    Signed-off-by: Daniel Schultz 
    Reviewed-by: Wadim Egorov 
    Link: https://patch.msgid.link/20251124090842.3377294-2-d.schultz@phytec.de
    Signed-off-by: Nishanth Menon 

commit d468b7b8a6fe3d21df5a186d04f9d6124ef66d4d
Author: Daniel Schultz 
Date:   Mon Nov 24 01:08:41 2025 -0800

    arm64: dts: ti: k3-am62-phycore-som: Add bootphase tag to cpsw_mac_syscon
    
    Add the "bootph-all" boot phase property to cpsw_mac_syscon.
    
    This fuse region contains the internal MAC address. Without this
    syscon node enabled, this interface will get a random MAC during
    network boot. This is problematic because the AM62x network
    boot is using BOOTP protocol for some binaries and this protocol
    does not support dynamic lease expiration. Therefore, the DHCP
    server can run out of free IP addresses.
    
    Signed-off-by: Daniel Schultz 
    Reviewed-by: Wadim Egorov 
    Link: https://patch.msgid.link/20251124090842.3377294-1-d.schultz@phytec.de
    Signed-off-by: Nishanth Menon 

commit af586cc6df0bd56d4a3d05d5e6db0b193233fc51
Author: Renjun Wang 
Date:   Mon Dec 1 22:22:06 2025 +0800

    drm/panel: simple: Add HannStar HSD156JUW2
    
    Add Hannstar HSD156JUW2 15.6" FHD (1920x1080) TFT LCD panel support.
    
    Signed-off-by: Renjun Wang 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/tencent_FE5819B397B5ECC989623C67A7D68D246907@qq.com

commit b23cd64bda037ad83e18960c8802f3276b7b368e
Author: Renjun Wang 
Date:   Mon Dec 1 22:21:53 2025 +0800

    dt-bindings: display: simple: Add HannStar HSD156JUW2
    
    Add the HannStar HSD156JUW2 15.6" FHD (1920x1080) TFT LCD panel to
    the panel-simple compatible list.
    
    Signed-off-by: Renjun Wang 
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/tencent_8B5693A42B580AB3A5359849CCE23E67B407@qq.com

commit 29e208a08a8ebb0f214e815eee0a7beff778864f
Author: David Heidelberg 
Date:   Sun Dec 14 15:51:23 2025 +0100

    drm/panel: sw43408: Improve wording when reset-gpios aren't available
    
    Choose better wording.
    
    Cosmetic: also inline PTR_ERR.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: David Heidelberg 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251214-pixel-3-v7-7-b1c0cf6f224d@ixit.cz

commit ed2b818a24760d7adc92d2e9b0e135f2c33edd8c
Author: David Heidelberg 
Date:   Sun Dec 14 15:51:22 2025 +0100

    drm/panel: sw43408: Switch to devm_regulator_bulk_get_const
    
    Switch to devm_regulator_bulk_get_const() to stop setting the supplies
    list in probe(), and move the regulator_bulk_data struct in static const.
    
    Cosmetic: adjust comment for regulator from 1.88V to 1.8 V.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: David Heidelberg 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251214-pixel-3-v7-6-b1c0cf6f224d@ixit.cz

commit cbc1e99a9e0a6c8b22ddcbb40ca37457066f9493
Author: David Heidelberg 
Date:   Sun Dec 14 15:51:21 2025 +0100

    drm/panel: sw43408: Remove manual invocation of unprepare at remove
    
    The drm_panel_remove should take care of disable/unprepare. Remove the
    manual call from the sw43408_remove function.
    
    Fixes: 069a6c0e94f9 ("drm: panel: Add LG sw43408 panel driver")
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: David Heidelberg 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251214-pixel-3-v7-5-b1c0cf6f224d@ixit.cz

commit 5f0cc92fa0dab7cbb999dedc653f5857a62b2022
Author: David Heidelberg 
Date:   Sun Dec 14 15:51:20 2025 +0100

    drm/panel: sw43408: Separate reset sequence into own function
    
    Splitting reset() from prepare() follows clean coding practices and lets
    us potentially make reset optional in the future for flicker-less
    takeover from a bootloader or framebuffer driver where the panel is
    already configured.
    
    Signed-off-by: David Heidelberg 
    Reviewed-by: Neil Armstrong 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251214-pixel-3-v7-4-b1c0cf6f224d@ixit.cz

commit be85d4124dbe6ed597c7a6a16e53d8b98684fab6
Author: David Heidelberg 
Date:   Sun Dec 14 15:51:19 2025 +0100

    drm/panel: sw43408: Introduce LH546WF1-ED01 panel compatible
    
    The supported panel is LH546WF1-ED01, add compatible and adjust the
    struct name to reflect that.
    
    The standalone compatible lg,sw43408 will continue to work, even thou
    there are no users yet.
    
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: David Heidelberg 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251214-pixel-3-v7-3-b1c0cf6f224d@ixit.cz

commit dbb5d6010c1ecf01560af405c5b503f4cf2b1149
Author: David Heidelberg 
Date:   Sun Dec 14 15:51:18 2025 +0100

    dt-bindings: panel: sw43408: adjust to reflect the DDIC and panel used
    
    Add compatible for used LG panel.
    SW43408 is not panel, but DDIC. The panel itself is the
    LG LH546WF1-ED01, so introduce combined compatible for it.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: David Heidelberg 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251214-pixel-3-v7-2-b1c0cf6f224d@ixit.cz

commit 4855f26007d97b3dd7331d673d5410f1eaf30e24
Author: Amin GATTOUT 
Date:   Sat Dec 13 15:24:21 2025 +0100

    drm/panel: otm8009a: Switch to mipi_dsi_multi_context helpers
    
    Update the driver to use the non-deprecated mipi_dsi_*_multi()
    helpers, as recommended in Documentation/gpu/todo.rst. The multi
    variants provide proper error accumulation and handle the required
    DCS NOP insertions, which suits the OTM8009A command sequences.
    
    Refactor otm8009a_dcs_write_buf() and the dcs_write_seq/dcs_write_cmd_at
    macros to take a mipi_dsi_multi_context pointer, passing it through
    from callers. This ensures consistent error handling throughout the
    driver.
    
    Replace all mdelay() and msleep() calls within DSI command sequences
    with mipi_dsi_msleep() for proper error accumulation.
    
    The init, disable, and backlight update paths now return dsi_ctx.accum_err,
    ensuring errors are propagated to callers.
    
    Signed-off-by: Amin GATTOUT 
    Reviewed-by: Douglas Anderson 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251213142421.6762-1-amin.gattout@gmail.com

commit ac488854890165b55a973dab7247aa2deea9cc02
Author: Anton Bambura 
Date:   Mon Nov 10 11:14:37 2025 +0200

    gpu/drm: panel: add Samsung LTL106HL02 MIPI DSI panel driver
    
    LTL106HL02 is a color active matrix TFT (Thin Film Transistor) liquid
    crystal display (LCD) that uses amorphous silicon TFT as switching
    devices. This model is composed of a TFT LCD panel, a driver circuit and a
    backlight unit. The resolution of a 10.6" contains 1920 x 1080 pixels and
    can display up to 16,8M color with wide viewing angle.
    
    Signed-off-by: Jonas Schwöbel 
    Signed-off-by: Anton Bambura 
    Signed-off-by: Svyatoslav Ryhel 
    Reviewed-by: Dmitry Baryshkov 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251110091440.5251-8-clamor95@gmail.com

commit 06fb75e2d12ee2b24129acacace044a0ddd2000d
Author: Svyatoslav Ryhel 
Date:   Mon Nov 10 11:14:36 2025 +0200

    dt-bindings: display: panel: document Samsung LTL106HL02 MIPI DSI panel
    
    Samsung LTL106HL02 is a simple DSI which requires only a power supply and
    an optional reset gpio.
    
    Signed-off-by: Svyatoslav Ryhel 
    Acked-by: Rob Herring (Arm) 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251110091440.5251-7-clamor95@gmail.com

commit 2c96689038aeea99c18a95b66dd5a171a07eaab2
Author: David Heidelberg 
Date:   Thu Nov 6 11:53:40 2025 +0100

    dt-bindings: panel: s6e3fc2x01: Sort and remove unnecessary properties
    
    Properties are now sorted, reset-gpio and port property dropped because
    they are already accepted here as part of panel-common and usage of
    unevaluatedProperties.
    
    Suggested-by: Krzysztof Kozlowski 
    Signed-off-by: David Heidelberg 
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Neil Armstrong 
    Link: https://patch.msgid.link/20251106-dt-s6e3fc2x01-v2-1-deb87727152e@ixit.cz

commit 59946373755d71dbd7614ba235e0093159f80b69
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:09:47 2025 +0200

    soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
    
    Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and
    LAPBC710.
    
    Link: https://github.com/thesofproject/linux/issues/5529
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Bard Liao 
    Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com
    Signed-off-by: Vinod Koul 

commit 82ab754d102273f4c974a285aa8025bed7521b15
Author: Krzysztof Kozlowski 
Date:   Mon Dec 1 11:26:28 2025 +0100

    soundwire: qcom: Use guard to avoid mixing cleanup and goto
    
    qcom_swrm_stream_alloc_ports() already uses cleanup.h but also has goto.
    Such combination is error-prone and discouraged:
    
    "... and that the "goto" statement can jump between scopes, the
    expectation is that usage of "goto" and cleanup helpers is never mixed
    in the same function."
    
    Actually simplify the code with a guard which allows to fix the
    discouraged style by removing the goto.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Konrad Dybcio 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251201102627.146182-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Vinod Koul 

commit f87e5575a6bd1925cd55f500b61b661724372e5f
Author: Maciej Strozek 
Date:   Mon Dec 15 15:17:29 2025 +0000

    soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
    
    Add cs42l45 to the wake_capable_list because it can generate jack events
    whilst the bus is stopped.
    
    Signed-off-by: Maciej Strozek 
    Reviewed-by: Bard Liao 
    Signed-off-by: Charles Keepax 
    Link: https://patch.msgid.link/20251215151729.3911077-1-ckeepax@opensource.cirrus.com
    Signed-off-by: Vinod Koul 

commit a75a1dec037ff3de863375fa3a74569619667184
Author: Ahmed Naseef 
Date:   Tue Dec 9 11:16:02 2025 +0400

    mtd: spinand: add support for Dosilicon DS35Q1GA/DS35M1GA
    
    Add support for Dosilicon DS35Q1GA (3.3V) and DS35M1GA (1.8V) SPI NAND.
    
    These are 1Gbit (128MB) devices with:
      - 2048 byte pages + 64 byte OOB
      - 64 pages per block, 1024 blocks
      - On-die 4-bit ECC per 512 byte sector
    
    The 64-byte OOB area is divided into 4 segments of 16 bytes, with each
    segment containing 8 bytes of user data (M2+M1) and 8 bytes of ECC
    parity (R1). This provides 30 bytes of usable OOB space after reserving
    2 bytes for the bad block marker.
    
    Tested on Genexis Platinum 4410 (EcoNet EN751221) by writing known
    patterns to OOB and verifying ECC parity placement in R1 regions.
    
    Datasheet:
      https://www.dosilicon.com/resources/SPI%20NAND/DS35X1GAXXX_rev08.pdf
    
    Signed-off-by: Ahmed Naseef 
    Signed-off-by: Miquel Raynal 

commit 20de1b0080b9889094d703927871da8f21fb624e
Author: Lad Prabhakar 
Date:   Wed Oct 15 20:26:11 2025 +0100

    drm: renesas: rz-du: mipi_dsi: Add support for RZ/V2H(P) SoC
    
    Add MIPI DSI support for the Renesas RZ/V2H(P) SoC. Compared to the
    RZ/G2L family, the RZ/V2H(P) requires dedicated D-PHY PLL programming,
    different clock configuration, and additional timing parameter handling.
    The driver introduces lookup tables and helpers for D-PHY timings
    (TCLK*, THS*, TLPX, and ULPS exit) as specified in the RZ/V2H(P) hardware
    manual. ULPS exit timing depends on the LPCLK rate and is now handled
    explicitly.
    
    The implementation also adds support for 16 bpp RGB format, updates the
    clock setup path to use the RZ/V2H PLL divider limits, and provides new
    .dphy_init, .dphy_conf_clks, and .dphy_startup_late_init callbacks to
    match the RZ/V2H sequence.
    
    With these changes, the RZ/V2H(P) can operate the MIPI DSI interface in
    compliance with its hardware specification while retaining support for
    existing RZ/G2L platforms.
    
    Co-developed-by: Fabrizio Castro 
    Signed-off-by: Fabrizio Castro 
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Tomi Valkeinen 
    Signed-off-by: Biju Das 
    Link: https://patch.msgid.link/20251015192611.241920-8-prabhakar.mahadev-lad.rj@bp.renesas.com

commit 99b98993ae010b86d0ec0d779c1c8be890057568
Author: Lad Prabhakar 
Date:   Wed Oct 15 20:26:10 2025 +0100

    drm: renesas: rz-du: mipi_dsi: Add LPCLK clock support
    
    Add LPCLK clock handling to the RZ/G2L MIPI DSI driver to support proper
    DSI timing parameter configuration on RZ/V2H SoCs. While lpclk is present
    on both RZ/G2L and RZ/V2H SoCs, the RZ/V2H SoC specifically uses the lpclk
    rate to configure the DSI timing parameter ULPSEXIT.
    
    Introduce a new lpclk field in the rzg2l_mipi_dsi structure and acquire
    the "lpclk" clock during probe to enable lpclk rate-based timing
    calculations on RZ/V2H while maintaining compatibility with RZ/G2L.
    
    Co-developed-by: Fabrizio Castro 
    Signed-off-by: Fabrizio Castro 
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Biju Das 
    Reviewed-by: Tomi Valkeinen 
    Signed-off-by: Biju Das 
    Link: https://patch.msgid.link/20251015192611.241920-7-prabhakar.mahadev-lad.rj@bp.renesas.com

commit ddeb8d5c1f97d9112b93a779c9e3dc3eaab68c19
Author: Lad Prabhakar 
Date:   Wed Oct 15 20:26:09 2025 +0100

    dt-bindings: display: bridge: renesas,dsi: Document RZ/V2H(P) and RZ/V2N
    
    Add the compatible string "renesas,r9a09g057-mipi-dsi" for the Renesas
    RZ/V2H(P) (R9A09G057) SoC. While the MIPI DSI LINK registers are shared
    with the RZ/G2L SoC, the D-PHY register layout differs. Additionally, the
    RZ/V2H(P) uses only two resets compared to three on RZ/G2L, and requires
    five clocks instead of six.
    
    To reflect these hardware differences, update the binding schema to
    support the reduced clock and reset requirements for RZ/V2H(P).
    
    Since the RZ/V2N (R9A09G056) SoC integrates an identical DSI IP to
    RZ/V2H(P), the same "renesas,r9a09g057-mipi-dsi" compatible string is
    reused for RZ/V2N.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Krzysztof Kozlowski 
    Reviewed-by: Geert Uytterhoeven 
    Reviewed-by: Tomi Valkeinen 
    Signed-off-by: Biju Das 
    Link: https://patch.msgid.link/20251015192611.241920-6-prabhakar.mahadev-lad.rj@bp.renesas.com

commit 78da7027e2a99edea0d7e97b25d75be4698a8728
Author: Johan Hovold 
Date:   Fri Nov 21 17:46:24 2025 +0100

    memory: mtk-smi: clean up device link creation
    
    Clean up device link creation by bailing out early in case the SMI
    platform device lookup fails.
    
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251121164624.13685-4-johan@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit 9dae65913b32d05dbc8ff4b8a6bf04a0e49a8eb6
Author: Johan Hovold 
Date:   Fri Nov 21 17:46:23 2025 +0100

    memory: mtk-smi: fix device leak on larb probe
    
    Make sure to drop the reference taken when looking up the SMI device
    during larb probe on late probe failure (e.g. probe deferral) and on
    driver unbind.
    
    Fixes: cc8bbe1a8312 ("memory: mediatek: Add SMI driver")
    Fixes: 038ae37c510f ("memory: mtk-smi: add missing put_device() call in mtk_smi_device_link_common")
    Cc: stable@vger.kernel.org      # 4.6: 038ae37c510f
    Cc: stable@vger.kernel.org      # 4.6
    Cc: Yong Wu 
    Cc: Miaoqian Lin 
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251121164624.13685-3-johan@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit 6cfa038bddd710f544076ea2ef7792fc82fbedd6
Author: Johan Hovold 
Date:   Fri Nov 21 17:46:22 2025 +0100

    memory: mtk-smi: fix device leaks on common probe
    
    Make sure to drop the reference taken when looking up the SMI device
    during common probe on late probe failure (e.g. probe deferral) and on
    driver unbind.
    
    Fixes: 47404757702e ("memory: mtk-smi: Add device link for smi-sub-common")
    Fixes: 038ae37c510f ("memory: mtk-smi: add missing put_device() call in mtk_smi_device_link_common")
    Cc: stable@vger.kernel.org      # 5.16: 038ae37c510f
    Cc: stable@vger.kernel.org      # 5.16
    Cc: Yong Wu 
    Cc: Miaoqian Lin 
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251121164624.13685-2-johan@kernel.org
    Signed-off-by: Krzysztof Kozlowski 

commit 2359fe93138d80ca378072d4c743b8c17612f3e3
Author: Karol Wachowski 
Date:   Mon Dec 15 08:09:33 2025 +0100

    accel/ivpu: Validate scatter-gather size against buffer size
    
    Validate scatter-gather table size matches buffer object size before
    mapping. Break mapping early if the table exceeds buffer size to
    prevent overwriting existing mappings. Also validate the table is
    not smaller than buffer size to avoid unmapped regions that trigger
    MMU translation faults.
    
    Log error and fail mapping operation on size mismatch to prevent
    data corruption from mismatched host memory locations and NPU
    addresses. Unmap any partially mapped buffer on failure.
    
    Reviewed-by: Lizhi Hou 
    Signed-off-by: Karol Wachowski 
    Link: https://patch.msgid.link/20251215070933.520377-1-karol.wachowski@linux.intel.com

commit a21d38b5e209c60e73f81e467cc53ad57b5d4080
Author: Peter Griffin 
Date:   Fri Nov 14 12:00:17 2025 +0000

    arm64: dts: exynos: gs101: remove syscon compatible from pmu node
    
    Since commit ba5095ebbc7a ("mfd: syscon: Allow syscon nodes without a
    "syscon" compatible") it is possible to register a regmap without the
    syscon compatible in the node.
    
    As mentioned in that commit, it's not correct to claim we are compatible
    with syscon, as a MMIO regmap created by syscon won't work. Removing the
    syscon compatible means syscon driver won't ever create a mmio regmap.
    
    Note this isn't usually an issue today as exynos-pmu runs at an early
    initcall so the custom regmap will have been registered first. However
    changes proposed in [1] will bring -EPROBE_DEFER support to syscon allowing
    this mechanism to be more robust, especially in highly modularized systems.
    
    Technically this is a ABI break but no other platforms are
    affected. Additionally (with the benefit of hindsight) a MMIO syscon has
    never worked for PMU register writes, thus the ABI break is justified.
    
    Link: https://lore.kernel.org/lkml/aQdHmrchkmOr34r3@stanley.mountain/ [1]
    Signed-off-by: Peter Griffin 
    Link: https://patch.msgid.link/20251114-remove-pmu-syscon-compat-v2-2-9496e8c496c7@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit 411727d9182d7a067fdd16a125d2069f52e8bb7f
Author: Peter Griffin 
Date:   Fri Nov 14 12:00:16 2025 +0000

    dt-bindings: soc: samsung: exynos-pmu: remove syscon for google,gs101-pmu
    
    Since commit ba5095ebbc7a ("mfd: syscon: Allow syscon nodes without a
    "syscon" compatible") it is possible to register a regmap without the
    syscon compatible in the node.
    
    Update the bindings for google,gs101-pmu so that the syscon compatible is
    no longer required. As it isn't really correct to claim we are compatible
    with syscon (as a mmio regmap created by syscon will not work on gs101).
    
    Additionally (with the benefit of hindsight) PMU register writes were never
    working with a MMIO syscon on gs101, so the ABI break is justified.
    
    Signed-off-by: Peter Griffin 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251114-remove-pmu-syscon-compat-v2-1-9496e8c496c7@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit d45eafec01fa31fb9ab30902de35fbbe70f63411
Author: Tudor Ambarus 
Date:   Fri Oct 24 17:57:35 2025 +0000

    arm64: dts: exynos: gs101: add TRNG node
    
    Define the TRNG node. GS101 TRNG works well with the current
    Exynos850 TRNG support. Specify the Google specific compatible
    in front of the Exynos one.
    
    Signed-off-by: Tudor Ambarus 
    Link: https://patch.msgid.link/20251024-gs101-trng-v3-2-5d3403738f39@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit d9465635e051ddc0d9ebb312174ace55d38d2d40
Author: Tudor Ambarus 
Date:   Fri Oct 24 17:57:34 2025 +0000

    dt-bindings: rng: add google,gs101-trng compatible
    
    Add support for the TRNG found on GS101. It works well with the current
    exynos850 TRNG support.
    
    The TRNG controller can be part of a power domain, allow the relevant
    property 'power-domains'.
    
    Signed-off-by: Tudor Ambarus 
    Reviewed-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251024-gs101-trng-v3-1-5d3403738f39@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit af8dbb88188784cfcdc215487e0173a6f62caf52
Author: Krzysztof Kozlowski 
Date:   Tue Dec 16 07:35:47 2025 +0100

    arm64: dts: toshiba: tmpv7708: Align node names with DT bindings
    
    DT bindings expect node names to follow certain pattern, dtbs_check
    warnings:
    
      tmpv7708-rm-mbrc.dtb: pmux@24190000 (toshiba,tmpv7708-pinctrl):
        'pwm_mux' does not match any of the regexes: '-pins$', '^pinctrl-[0-9]+$'
      tmpv7708-rm-mbrc.dtb pmux@24190000 (toshiba,tmpv7708-pinctrl):
        $nodename:0: 'pmux@24190000' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$'
      tmpv7708-rm-mbrc.dtb: wdt@28330000 (toshiba,visconti-wdt):
        $nodename:0: 'wdt@28330000' does not match '^(timer|watchdog)(@.*|-([0-9]|[1-9][0-9]+))?$'
    
    Reviewed-by: Nobuhiro Iwamatsu 
    Link: https://patch.msgid.link/20251022133616.74492-2-krzysztof.kozlowski@linaro.org
    Signed-off-by: Krzysztof Kozlowski 

commit d79f302f2f9829d04b0ab6181c38716c5a68804d
Author: Rob Herring (Arm) 
Date:   Mon Dec 15 15:25:24 2025 -0600

    dt-bindings: input: touchscreen: sitronix,st1232: Add Sitronix ST1624
    
    Add the Sitronix ST1624 which is compatible with ST1633.
    
    Signed-off-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251215212524.3318311-1-robh@kernel.org
    Signed-off-by: Dmitry Torokhov 

commit 995186145d682077470e1d4e657548d872602e6a
Author: Petr Hodina 
Date:   Mon Dec 15 15:30:03 2025 +0100

    Input: stmfts - use sysfs_emit() instead of sprintf()
    
    Follow the advice in Documentation/filesystems/sysfs.rst:
    show() should only use sysfs_emit() or sysfs_emit_at() when formatting
    the value to be returned to user space.
    
    Signed-off-by: Petr Hodina 
    Signed-off-by: David Heidelberg 
    Link: https://patch.msgid.link/20251215-fts-fixes-v1-3-8c1e3a63ebf1@ixit.cz
    Signed-off-by: Dmitry Torokhov 

commit f5c3c77b8661bf6b17fa2246e14cdf13ca94e840
Author: Petr Hodina 
Date:   Mon Dec 15 15:30:02 2025 +0100

    Input: stmfts - make comments correct
    
    No functional change.
    
    Fixes: 78bcac7b2ae1 ("Input: add support for the STMicroelectronics FingerTip touchscreen")
    Signed-off-by: Petr Hodina 
    Signed-off-by: David Heidelberg 
    Link: https://patch.msgid.link/20251215-fts-fixes-v1-2-8c1e3a63ebf1@ixit.cz
    Signed-off-by: Dmitry Torokhov 

commit 385a53867b4af266fb800109d7e1e792cd6bf1aa
Author: David Heidelberg 
Date:   Mon Dec 15 15:30:01 2025 +0100

    Input: stmfts - correct wording for the warning message
    
    We're trying to enable regulator, not disable it.
    
    Fixes: 78bcac7b2ae1 ("Input: add support for the STMicroelectronics FingerTip touchscreen")
    Suggested-by: Petr Hodina 
    Signed-off-by: David Heidelberg 
    Link: https://patch.msgid.link/20251215-fts-fixes-v1-1-8c1e3a63ebf1@ixit.cz
    Signed-off-by: Dmitry Torokhov 

commit 1c0860d4415d52f3ad1c8e0a15c1272869278a06
Author: Randy Dunlap 
Date:   Sun Dec 14 12:15:39 2025 -0800

    lsm: fix kernel-doc struct member names
    
    Use the correct struct member names to avoid kernel-doc warnings:
    
    Warning: include/linux/lsm_hooks.h:83 struct member 'name' not described
     in 'lsm_id'
    Warning: include/linux/lsm_hooks.h:183 struct member 'initcall_device' not
     described in 'lsm_info'
    
    Signed-off-by: Randy Dunlap 
    Signed-off-by: Paul Moore 

commit 4a210a5be279bfd5514dac3f5ef2c737cd984e84
Author: Joanne Chang 
Date:   Fri Dec 12 08:40:34 2025 +0000

    f2fs: improve check for enough free sections
    
    The check for enough sections in segment.h has the following issues:
    
    1. has_not_enough_free_secs() should return "enough secs" when "free_secs
    >= upper_secs", not just structly greater. Conversely, it should only
    return "not enough secs" when "free_secs < lower_secs", not when they are
    equal. This accounts for the possibility that blocks can fit within
    curseg without requiring an additional free section.
    
    2. __get_secs_required() currently separates the needed space to section
    and block parts, checking them against free sections and curseg,
    respectively. This does not consider the case where curseg cannot hold
    the whole block part, but excess free sections beyond the section part
    can accommodate some of the block part.
    
    3. has_curseg_enough_space() only checks CURSEG_HOT_DATA for dentry
    blocks, but when active_logs=6, they may be placed in WARM and COLD
    sections. Also, the current logic does not consider that dentry and data
    blocks can be put in the same section when active_logs=2 or 6.
    
    This patch modifies the three functions to address the above issues:
    
    1. Rename has_curseg_enough_space() to get_additional_blocks_required().
    Calculate the minimum node, dentry, and data blocks curseg can
    accommodate. Then subtract these from the total required blocks of
    respective type to determine the worst-case number of blocks that must
    be placed in free sections.
    
    2. In __get_secs_required(), get the number of blocks needing new
    sections from the new get_additional_blocks_required(). Return the upper
    bound of necessary free sections for these blocks. For active_logs=2 or
    6, dentry blocks are combined with data blocks.
    
    3. In has_not_enough_free_secs(), get the required sections from
    __get_secs_required(), and return “not enough secs” if “free_secs <
    required_secs”.
    
    Signed-off-by: Joanne Chang 
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 903c6e95bc9a4a3556d37e727853fc0ffb7f3acb
Author: Jaegeuk Kim 
Date:   Wed Nov 12 22:00:37 2025 +0000

    f2fs: add a tracepoint to see large folio read submission
    
    For example,
    
    1327.539878: f2fs_preload_pages_start: dev = (252,16), ino = 14, i_size = 4294967296 start: 0, end: 8191
    1327.539878: page_cache_sync_ra: dev=252:16 ino=e index=0 req_count=8192 order=9 size=0 async_size=0 ra_pages=4096 mmap_miss=0 prev_pos=-1
    1327.539879: page_cache_ra_order: dev=252:16 ino=e index=0 order=9 size=4096 async_size=2048 ra_pages=4096
    1327.541895: f2fs_readpages: dev = (252,16), ino = 14, start = 0 nrpage = 4096
    1327.541930: f2fs_lookup_extent_tree_start: dev = (252,16), ino = 14, pgofs = 0, type = Read
    1327.541931: f2fs_lookup_read_extent_tree_end: dev = (252,16), ino = 14, pgofs = 0, read_ext_info(fofs: 0, len: 1048576, blk: 4221440)
    1327.541931: f2fs_map_blocks: dev = (252,16), ino = 14, file offset = 0, start blkaddr = 0x406a00, len = 0x1000, flags = 2, seg_type = 8, may_create = 0, multidevice = 0, flag = 0, err = 0
    1327.541989: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 0, nr_pages = 512, dirty = 0, uptodate = 0
    1327.542012: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 512, nr_pages = 512, dirty = 0, uptodate = 0
    1327.542036: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 1024, nr_pages = 512, dirty = 0, uptodate = 0
    1327.542080: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 1536, nr_pages = 512, dirty = 0, uptodate = 0
    1327.542127: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 2048, nr_pages = 512, dirty = 0, uptodate = 0
    1327.542151: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 2560, nr_pages = 512, dirty = 0, uptodate = 0
    1327.542196: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 3072, nr_pages = 512, dirty = 0, uptodate = 0
    1327.542219: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 3584, nr_pages = 512, dirty = 0, uptodate = 0
    1327.542239: f2fs_submit_read_bio: dev = (252,16)/(252,16), rw = READ(R), DATA, sector = 33771520, size = 16777216
    1327.542269: page_cache_sync_ra: dev=252:16 ino=e index=4096 req_count=8192 order=9 size=4096 async_size=2048 ra_pages=4096 mmap_miss=0 prev_pos=-1
    1327.542289: page_cache_ra_order: dev=252:16 ino=e index=4096 order=9 size=4096 async_size=2048 ra_pages=4096
    1327.544485: f2fs_readpages: dev = (252,16), ino = 14, start = 4096 nrpage = 4096
    1327.544521: f2fs_lookup_extent_tree_start: dev = (252,16), ino = 14, pgofs = 4096, type = Read
    1327.544521: f2fs_lookup_read_extent_tree_end: dev = (252,16), ino = 14, pgofs = 4096, read_ext_info(fofs: 0, len: 1048576, blk: 4221440)
    1327.544522: f2fs_map_blocks: dev = (252,16), ino = 14, file offset = 4096, start blkaddr = 0x407a00, len = 0x1000, flags = 2, seg_type = 8, may_create = 0, multidevice = 0, flag = 0, err = 0
    1327.544550: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 4096, nr_pages = 512, dirty = 0, uptodate = 0
    1327.544575: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 4608, nr_pages = 512, dirty = 0, uptodate = 0
    1327.544601: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 5120, nr_pages = 512, dirty = 0, uptodate = 0
    1327.544647: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 5632, nr_pages = 512, dirty = 0, uptodate = 0
    1327.544692: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 6144, nr_pages = 512, dirty = 0, uptodate = 0
    1327.544734: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 6656, nr_pages = 512, dirty = 0, uptodate = 0
    1327.544777: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 7168, nr_pages = 512, dirty = 0, uptodate = 0
    1327.544805: f2fs_read_folio: dev = (252,16), ino = 14, DATA, FILE, index = 7680, nr_pages = 512, dirty = 0, uptodate = 0
    1327.544826: f2fs_submit_read_bio: dev = (252,16)/(252,16), rw = READ(R), DATA, sector = 33804288, size = 16777216
    1327.544852: f2fs_preload_pages_end: dev = (252,16), ino = 14, i_size = 4294967296 start: 8192, end: 8191
    
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 05e65c14ea59a401cec4284e9d612f9d5dc1b3f8
Author: Jaegeuk Kim 
Date:   Wed Nov 12 21:52:01 2025 +0000

    f2fs: support large folio for immutable non-compressed case
    
    This patch enables large folio for limited case where we can get the high-order
    memory allocation. It supports the encrypted and fsverity files, which are
    essential for Android environment.
    
    How to test:
    - dd if=/dev/zero of=/mnt/test/test bs=1G count=4
    - f2fs_io setflags immutable /mnt/test/test
    - echo 3 > /proc/sys/vm/drop_caches
     : to reload inode with large folio
    - f2fs_io read 32 0 1024 mmap 0 0 /mnt/test/test
    
    Reviewed-by: Chao Yu 
    Signed-off-by: Jaegeuk Kim 

commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe
Author: Viacheslav Dubeyko 
Date:   Sat Dec 6 19:58:22 2025 -0800

    hfsplus: fix volume corruption issue for generic/498
    
    The xfstests' test-case generic/498 leaves HFS+ volume
    in corrupted state:
    
    sudo ./check generic/498
    FSTYP -- hfsplus
    PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
    MKFS_OPTIONS -- /dev/loop51
    MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
    
    generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
    (see XFSTESTS-2/xfstests-dev/results//generic/498.full for details)
    
    Ran: generic/498
    Failures: generic/498
    Failed 1 of 1 tests
    
    sudo fsck.hfsplus -d /dev/loop51
    ** /dev/loop51
    Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
    Executing fsck_hfs (version 540.1-Linux).
    ** Checking non-journaled HFS Plus Volume.
    The volume name is untitled
    ** Checking extents overflow file.
    ** Checking catalog file.
    Invalid leaf record count
    (It should be 16 instead of 2)
    ** Checking multi-linked files.
    CheckHardLinks: found 1 pre-Leopard file inodes.
    ** Checking catalog hierarchy.
    ** Checking extended attributes file.
    ** Checking volume bitmap.
    ** Checking volume information.
    Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
    CBTStat = 0x8000 CatStat = 0x00000000
    ** Repairing volume.
    ** Rechecking volume.
    ** Checking non-journaled HFS Plus Volume.
    The volume name is untitled
    ** Checking extents overflow file.
    ** Checking catalog file.
    ** Checking multi-linked files.
    CheckHardLinks: found 1 pre-Leopard file inodes.
    ** Checking catalog hierarchy.
    ** Checking extended attributes file.
    ** Checking volume bitmap.
    ** Checking volume information.
    ** The volume untitled was repaired successfully.
    
    The generic/498 test executes such steps on final phase:
    
    mkdir $SCRATCH_MNT/A
    mkdir $SCRATCH_MNT/B
    mkdir $SCRATCH_MNT/A/C
    touch $SCRATCH_MNT/B/foo
    $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo
    
    ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo
    $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A
    
    "Simulate a power failure and mount the filesystem
    to check that what we explicitly fsync'ed exists."
    
    _flakey_drop_and_remount
    
    The FSCK tool complains about "Invalid leaf record count".
    HFS+ b-tree header contains leaf_count field is updated
    by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert()
    is involved into hard link creation process. However,
    modified in-core leaf_count field is stored into HFS+
    b-tree header by hfs_btree_write() method. But,
    unfortunately, hfs_btree_write() hasn't been called
    by hfsplus_cat_write_inode() and hfsplus_file_fsync()
    stores not fully consistent state of the Catalog File's
    b-tree.
    
    This patch adds calling hfs_btree_write() method in
    the hfsplus_cat_write_inode() with the goal of
    storing consistent state of Catalog File's b-tree.
    Finally, it makes FSCK tool happy.
    
    sudo ./check generic/498
    FSTYP         -- hfsplus
    PLATFORM      -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec  6 17:01:31 PST 2025
    MKFS_OPTIONS  -- /dev/loop51
    MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
    
    generic/498 33s ...  31s
    Ran: generic/498
    Passed all 1 tests
    
    Signed-off-by: Viacheslav Dubeyko 
    cc: John Paul Adrian Glaubitz 
    cc: Yangtao Li 
    cc: linux-fsdevel@vger.kernel.org
    Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com
    Signed-off-by: Viacheslav Dubeyko 

commit bea4429eb30190c59b5ac7c8ff6c90176c7c110f
Author: Viacheslav Dubeyko 
Date:   Thu Dec 4 16:00:55 2025 -0800

    hfsplus: fix volume corruption issue for generic/480
    
    The xfstests' test-case generic/480 leaves HFS+ volume
    in corrupted state:
    
    sudo ./check generic/480
    FSTYP -- hfsplus
    PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.17.0-rc1+ #4 SMP PREEMPT_DYNAMIC Wed Oct 1 15:02:44 PDT 2025
    MKFS_OPTIONS -- /dev/loop51
    MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
    
    generic/480 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
    (see XFSTESTS-2/xfstests-dev/results//generic/480.full for details)
    
    Ran: generic/480
    Failures: generic/480
    Failed 1 of 1 tests
    
    sudo fsck.hfsplus -d /dev/loop51
    ** /dev/loop51
    Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
    Executing fsck_hfs (version 540.1-Linux).
    ** Checking non-journaled HFS Plus Volume.
    The volume name is untitled
    ** Checking extents overflow file.
    ** Checking catalog file.
    ** Checking multi-linked files.
    CheckHardLinks: found 1 pre-Leopard file inodes.
    Incorrect number of file hard links
    ** Checking catalog hierarchy.
    ** Checking extended attributes file.
    ** Checking volume bitmap.
    ** Checking volume information.
    invalid VHB nextCatalogID
    Volume header needs minor repair
    (2, 0)
    Verify Status: VIStat = 0x8000, ABTStat = 0x0000 EBTStat = 0x0000
    CBTStat = 0x0000 CatStat = 0x00000002
    ** Repairing volume.
    Incorrect flags for file hard link (id = 19)
    (It should be 0x22 instead of 0x2)
    Incorrect flags for file inode (id = 18)
    (It should be 0x22 instead of 0x2)
    first link ID=0 is < 16 for fileinode=18
    Error getting first link ID for inode = 18 (result=2)
    Invalid first link in hard link chain (id = 18)
    (It should be 19 instead of 0)
    Indirect node 18 needs link count adjustment
    (It should be 1 instead of 2)
    ** Rechecking volume.
    ** Checking non-journaled HFS Plus Volume.
    The volume name is untitled
    ** Checking extents overflow file.
    ** Checking catalog file.
    ** Checking multi-linked files.
    ** Checking catalog hierarchy.
    ** Checking extended attributes file.
    ** Checking volume bitmap.
    ** Checking volume information.
    ** The volume untitled was repaired successfully.
    
    The generic/480 test executes such steps on final phase:
    
    "Now remove of the links of our file and create
    a new file with the same name and in the same
    parent directory, and finally fsync this new file."
    
    unlink $SCRATCH_MNT/testdir/bar
    touch $SCRATCH_MNT/testdir/bar
    $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/testdir/bar
    
    "Simulate a power failure and mount the filesystem
    to check that replaying the fsync log/journal
    succeeds, that is the mount operation does not fail."
    
    _flakey_drop_and_remount
    
    The key issue in HFS+ logic is that hfsplus_link(),
    hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(),
    and hfsplus_mknod() methods don't call
    hfsplus_cat_write_inode() for the case of modified
    inode objects. As a result, even if hfsplus_file_fsync()
    is trying to flush the dirty Catalog File, but because of
    not calling hfsplus_cat_write_inode() not all modified
    inodes save the new state into Catalog File's records.
    Finally, simulation of power failure results in inconsistent
    state of Catalog File and FSCK tool reports about
    volume corruption.
    
    This patch adds calling of hfsplus_cat_write_inode()
    method for modified inodes in hfsplus_link(),
    hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(),
    and hfsplus_mknod() methods. Also, it adds debug output
    in several methods.
    
    sudo ./check generic/480
    FSTYP         -- hfsplus
    PLATFORM      -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec  4 12:24:45 PST 2025
    MKFS_OPTIONS  -- /dev/loop51
    MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
    
    generic/480 16s ...  16s
    Ran: generic/480
    Passed all 1 tests
    
    Signed-off-by: Viacheslav Dubeyko 
    cc: John Paul Adrian Glaubitz 
    cc: Yangtao Li 
    cc: linux-fsdevel@vger.kernel.org
    Link: https://lore.kernel.org/r/20251205000054.3670326-1-slava@dubeyko.com
    Signed-off-by: Viacheslav Dubeyko 

commit 126fb0ce99431126b44a6c360192668c818f641f
Author: Mehdi Ben Hadj Khelifa 
Date:   Mon Dec 1 23:23:07 2025 +0100

    hfsplus: ensure sb->s_fs_info is always cleaned up
    
    When hfsplus was converted to the new mount api a bug was introduced by
    changing the allocation pattern of sb->s_fs_info. If setup_bdev_super()
    fails after a new superblock has been allocated by sget_fc(), but before
    hfsplus_fill_super() takes ownership of the filesystem-specific s_fs_info
    data it was leaked.
    
    Fix this by freeing sb->s_fs_info in hfsplus_kill_super().
    
    Cc: stable@vger.kernel.org
    Fixes: 432f7c78cb00 ("hfsplus: convert hfsplus to use the new mount api")
    Reported-by: Viacheslav Dubeyko 
    Tested-by: Viacheslav Dubeyko 
    Signed-off-by: Christian Brauner 
    Signed-off-by: Mehdi Ben Hadj Khelifa 
    Reviewed-by: Viacheslav Dubeyko 
    Signed-off-by: Viacheslav Dubeyko 
    Link: https://lore.kernel.org/r/20251201222843.82310-3-mehdi.benhadjkhelifa@gmail.com
    Signed-off-by: Viacheslav Dubeyko 

commit 05ce49a902be15dc93854cbfc20161205a9ee446
Author: Mehdi Ben Hadj Khelifa 
Date:   Mon Dec 1 23:23:06 2025 +0100

    hfs: ensure sb->s_fs_info is always cleaned up
    
    When hfs was converted to the new mount api a bug was introduced by
    changing the allocation pattern of sb->s_fs_info. If setup_bdev_super()
    fails after a new superblock has been allocated by sget_fc(), but before
    hfs_fill_super() takes ownership of the filesystem-specific s_fs_info
    data it was leaked.
    
    Fix this by freeing sb->s_fs_info in hfs_kill_super().
    
    Cc: stable@vger.kernel.org
    Fixes: ffcd06b6d13b ("hfs: convert hfs to use the new mount api")
    Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
    Tested-by: Viacheslav Dubeyko 
    Signed-off-by: Christian Brauner 
    Signed-off-by: Mehdi Ben Hadj Khelifa 
    Reviewed-by: Viacheslav Dubeyko 
    Signed-off-by: Viacheslav Dubeyko 
    Link: https://lore.kernel.org/r/20251201222843.82310-2-mehdi.benhadjkhelifa@gmail.com
    Signed-off-by: Viacheslav Dubeyko 

commit 2b277b506138f501693f6278e675da259299e8aa
Author: Matthew Brost 
Date:   Fri Dec 12 10:28:47 2025 -0800

    drm/xe: Add more GT stats around pagefault mode switch flows
    
    Add GT stats to measure the time spent switching between pagefault mode
    and dma-fence mode. Also add a GT stat to indicate when pagefault
    suspend is skipped because the system is idle. These metrics will help
    profile pagefault workloads while 3D and display are enabled.
    
    v2:
     - Use GT stats helper functions (Francois)
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Thomas Hellström 
    Reviewed-by: Francois Dugast 
    Link: https://patch.msgid.link/20251212182847.1683222-8-matthew.brost@intel.com

commit ce3d65549c7a4ea4497546f49d18128281258ec5
Author: Matthew Brost 
Date:   Fri Dec 12 10:28:46 2025 -0800

    drm/xe: Add GT stats ktime helpers
    
    Normalize GT stats that record execution periods in code paths by
    adding helpers to perform the ktime calculation. Use these helpers in
    the SVM code.
    
    Suggested-by: Francois Dugast 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251212182847.1683222-7-matthew.brost@intel.com

commit 4ac9048d05017449dde6320694d6e4700a8b9f5f
Author: Matthew Brost 
Date:   Fri Dec 12 10:28:45 2025 -0800

    drm/xe: Wait on in-syncs when swicthing to dma-fence mode
    
    If a dma-fence submission has in-fences and pagefault queues are running
    work, there is little incentive to kick the pagefault queues off the
    hardware until the dma-fence submission is ready to run. Therefore, wait
    on the in-fences of the dma-fence submission before removing the
    pagefault queues from the hardware.
    
    v2:
     - Fix kernel doc (CI)
     - Don't wait under lock (Thomas)
     - Make wait interruptable
    
    Suggested-by: Thomas Hellström 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251212182847.1683222-6-matthew.brost@intel.com

commit 8533051ce92015e9cc6f75e0d52119b9d91610b6
Author: Matthew Brost 
Date:   Fri Dec 12 10:28:44 2025 -0800

    drm/xe: Skip exec queue schedule toggle if queue is idle during suspend
    
    If an exec queue is idle, there is no need to issue a schedule disable
    to the GuC when suspending the queue’s execution. Opportunistically skip
    this step if the queue is idle and not a parallel queue. Parallel queues
    must have their scheduling state flipped in the GuC due to limitations
    in how submission is implemented in run_job().
    
    Also if all pagefault queues can skip the schedule disable during a
    switch to dma-fence mode, do not schedule a resume for the pagefault
    queues after the next submission.
    
    v2:
     - Don't touch the LRC tail is queue is suspended but enabled in run_job
       (CI)
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251212182847.1683222-5-matthew.brost@intel.com

commit 6e608bff259fd1eae5d381c5eb16b88413e16209
Author: Matthew Brost 
Date:   Fri Dec 12 10:28:43 2025 -0800

    drm/xe: Add debugfs knobs to control long running workload timeslicing
    
    Add debugfs knobs to control timeslicing for long-running workloads,
    allowing quick tuning of values when running benchmarks.
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251212182847.1683222-4-matthew.brost@intel.com

commit ca415c4d4c17ad676a2c8981e1fcc432221dce79
Author: Matthew Brost 
Date:   Fri Dec 12 10:28:42 2025 -0800

    drm/xe: Use usleep_range for accurate long-running workload timeslicing
    
    msleep is not very accurate in terms of how long it actually sleeps,
    whereas usleep_range is precise. Replace the timeslice sleep for
    long-running workloads with the more accurate usleep_range to avoid
    jitter if the sleep period is less than 20ms.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Cc: stable@vger.kernel.org
    Signed-off-by: Matthew Brost 
    Reviewed-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251212182847.1683222-3-matthew.brost@intel.com

commit 33a5abd9a68394aa67f9618b20eee65ee8702ff4
Author: Matthew Brost 
Date:   Fri Dec 12 10:28:41 2025 -0800

    drm/xe: Adjust long-running workload timeslices to reasonable values
    
    A 10ms timeslice for long-running workloads is far too long and causes
    significant jitter in benchmarks when the system is shared. Adjust the
    value to 5ms for preempt-fencing VMs, as the resume step there is quite
    costly as memory is moved around, and set it to zero for pagefault VMs,
    since switching back to pagefault mode after dma-fence mode is
    relatively fast.
    
    Also change min_run_period_ms to 'unsiged int' type rather than 's64' as
    only positive values make sense.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Cc: stable@vger.kernel.org
    Signed-off-by: Matthew Brost 
    Reviewed-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251212182847.1683222-2-matthew.brost@intel.com

commit f48b4bd0915bf61ac12b8c65c7939ebd03bc8abf
Author: Nick Hu 
Date:   Tue Dec 2 14:07:40 2025 +0800

    irqchip/riscv-imsic: Add a CPU pm notifier to restore the IMSIC on exit
    
    The IMSIC might be reset when the system enters a low power state, but on
    exit nothing restores the registers, which prevents interrupt delivery.
    
    Solve this by registering a CPU power management notifier, which restores
    the IMSIC on exit.
    
    Signed-off-by: Nick Hu 
    Signed-off-by: Thomas Gleixner 
    Reviewed-by: Yong-Xuan Wang 
    Reviewed-by: Cyan Yang 
    Reviewed-by: Anup Patel 
    Reviewed-by: Nutty Liu 
    Link: https://patch.msgid.link/20251202-preserve-aplic-imsic-v3-1-1844fbf1fe92@sifive.com

commit 97232dc43e83987e2c5fc2fb875b31c745ac9c01
Author: Cosmin Tanislav 
Date:   Mon Dec 1 13:29:33 2025 +0200

    arm64: dts: renesas: r9a09g087: Add ICU support
    
    The Renesas RZ/N2H (R9A09G087) SoC has an Interrupt Controller (ICU) block
    that routes external interrupts to the GIC's SPIs, with the ability of
    level-translation, and can also produce software and aggregate error
    interrupts.
    
    Add support for it.
    
    Signed-off-by: Cosmin Tanislav 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251201112933.488801-5-cosmin-gabriel.tanislav.xa@renesas.com

commit 9b1138aef9a254dfc3412673a2dccfcd7f54c844
Author: Cosmin Tanislav 
Date:   Mon Dec 1 13:29:32 2025 +0200

    arm64: dts: renesas: r9a09g077: Add ICU support
    
    The Renesas RZ/T2H (R9A09G077) SoC has an Interrupt Controller (ICU) block
    that routes external interrupts to the GIC's SPIs, with the ability of
    level-translation, and can also produce software and aggregate error
    interrupts.
    
    Add support for it.
    
    Signed-off-by: Cosmin Tanislav 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251201112933.488801-4-cosmin-gabriel.tanislav.xa@renesas.com

commit 13e7b3305b647cf58c47c979fe8a04e08caa6098
Author: Cosmin Tanislav 
Date:   Mon Dec 1 13:29:31 2025 +0200

    irqchip: Add RZ/{T2H,N2H} Interrupt Controller (ICU) driver
    
    The Renesas RZ/T2H (R9A09G077) and Renesas RZ/N2H (R9A09G087) SoCs have an
    Interrupt Controller (ICU) that supports interrupts from external pins IRQ0
    to IRQ15, and SEI, and software-triggered interrupts INTCPU0 to INTCPU15.
    
    INTCPU0 to INTCPU13, IRQ0 to IRQ13 are non-safety interrupts, while
    INTCPU14, INTCPU15, IRQ14, IRQ15 and SEI are safety interrupts, and are
    exposed via a separate register space.
    
    Signed-off-by: Cosmin Tanislav 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251201112933.488801-3-cosmin-gabriel.tanislav.xa@renesas.com

commit a6568d82091d279c8fbcdb1d30b46c23756b9145
Author: Cosmin Tanislav 
Date:   Mon Dec 1 13:29:30 2025 +0200

    dt-bindings: interrupt-controller: Document RZ/{T2H,N2H} ICU
    
    The Renesas RZ/T2H (R9A09G077) and Renesas RZ/N2H (R9A09G087) SoCs have an
    Interrupt Controller (ICU) block that routes external interrupts to the
    GIC's SPIs, with the ability of level-translation, and can also produce
    software interrupts and aggregate error interrupts.
    
    It has 16 software triggered interrupts (INTCPUn), 16 external pin
    interrupts (IRQn), a System error interrupt (SEI), two Cortex-A55 error
    interrupts (CA55_ERRn), two Cortex-R52 error interrupts for each of the two
    cores (CR52x_ERRn), two Peripheral error interrupts (PERI_ERRn), two DSMIF
    error interrupts (DSMIF_ERRn), and two ENCIF error interrupts (ENCIF_ERRn).
    
    The IRQn and SEI interrupts are exposed externally, while the others are
    software triggered.
    
    INTCPU0 to INTCPU13, IRQ 0 to IRQ13 are non-safety interrupts, while
    INTCPU14, INTCPU15, IRQ14, IRQ15 and SEI are safety interrupts, and are
    exposed via a separate register space.
    
    Document them, and use RZ/T2H as a fallback for RZ/N2H as the ICU is
    entirely compatible.
    
    Signed-off-by: Cosmin Tanislav 
    Signed-off-by: Thomas Gleixner 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251201112933.488801-2-cosmin-gabriel.tanislav.xa@renesas.com

commit 8d4c354bef3cc438db93f362e4657b317db03392
Author: Lad Prabhakar 
Date:   Thu Nov 27 16:24:47 2025 +0000

    irqchip/renesas-rzv2h: Add support for RZ/V2N SoC
    
    Add support for the RZ/V2N Interrupt Control Unit (ICU) by introducing a
    dedicated compatible string in the irqchip driver. While the RZ/V2N ICU
    differs from the RZ/V2H(P) version in its register layout primarily due
    to a reduced set of ECCRAM related registers the irqchip driver does not
    currently access these registers.
    
    As a result, the RZ/V2N ICU can be safely handled by rzv2h_icu_probe for
    now, but it still requires a distinct compatible so that future changes
    can differentiate the SoCs when needed.
    
    [ tglx: Fixed up the made up subject prefix ]
    
    Signed-off-by: Lad Prabhakar 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251127162447.320971-3-prabhakar.mahadev-lad.rj@bp.renesas.com

commit c71869c61d7cf2070421cdcc4dd64c4c860df49d
Author: Lad Prabhakar 
Date:   Thu Nov 27 16:24:46 2025 +0000

    dt-bindings: interrupt-controller: renesas,rzv2h-icu: Document RZ/V2N SoC
    
    Document the Interrupt Control Unit (ICU) used on the Renesas RZ/V2N SoC.
    
    Although the ICU closely matches the design found on the RZ/V2H(P) family,
    it differs in its register layout, particularly in the reduced set of
    ECCRAM related registers. These variations require a distinct compatible
    string so that software can correctly match and handle the RZ/V2N
    implementation.
    
    Signed-off-by: Lad Prabhakar 
    Signed-off-by: Thomas Gleixner 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251127162447.320971-2-prabhakar.mahadev-lad.rj@bp.renesas.com

commit 8a7f030df89746842094334cdf55114d0fbb0234
Author: Vladimir Kondratiev 
Date:   Tue Dec 9 16:23:33 2025 +0200

    irqchip/aslint-sswi: Request IO memory resource
    
    Make an aclint_sswi instance visible in the resource list, i.e. /proc/iomem
    
    Signed-off-by: Vladimir Kondratiev 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251209142336.1061606-1-vladimir.kondratiev@mobileye.com

commit 60c7398bded2e11f0db40a409a241b8be5910ee2
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:40 2025 +0000

    rust: drm: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-16-a2e13cbc17a6@google.com
    Signed-off-by: Danilo Krummrich 

commit e4b3118b61b6d93d4289069b9cccbffe8e714aa0
Author: Alice Ryhl 
Date:   Tue Dec 2 19:38:00 2025 +0000

    rust: scatterlist: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-36-a2e13cbc17a6@google.com
    Signed-off-by: Danilo Krummrich 

commit 74ca60bd85c4b6952f5c7700c89407c4041535a7
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:55 2025 +0000

    rust: property: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-31-a2e13cbc17a6@google.com
    Signed-off-by: Danilo Krummrich 

commit d17772fcb55cf70b7b6ccd78ef6fdefbf66542b8
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:52 2025 +0000

    rust: platform: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-28-a2e13cbc17a6@google.com
    Signed-off-by: Danilo Krummrich 

commit 593e0b22340c3b6aa19c0fa3c466b0809a7ba0d1
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:50 2025 +0000

    rust: pci: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-26-a2e13cbc17a6@google.com
    [ Consider latest helper additions. - Danilo ]
    Signed-off-by: Danilo Krummrich 

commit e057b2d2b8d815df3858a87dffafa2af37e5945b
Author: Shuicheng Lin 
Date:   Fri Dec 5 23:47:18 2025 +0000

    drm/xe/oa: Limit num_syncs to prevent oversized allocations
    
    The OA open parameters did not validate num_syncs, allowing
    userspace to pass arbitrarily large values, potentially
    leading to excessive allocations.
    
    Add check to ensure that num_syncs does not exceed DRM_XE_MAX_SYNCS,
    returning -EINVAL when the limit is violated.
    
    v2: use XE_IOCTL_DBG() and drop duplicated check. (Ashutosh)
    
    Fixes: c8507a25cebd ("drm/xe/oa/uapi: Define and parse OA sync properties")
    Cc: Matthew Brost 
    Cc: Ashutosh Dixit 
    Signed-off-by: Shuicheng Lin 
    Reviewed-by: Ashutosh Dixit 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251205234715.2476561-6-shuicheng.lin@intel.com

commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c
Author: Shuicheng Lin 
Date:   Fri Dec 5 23:47:17 2025 +0000

    drm/xe: Limit num_syncs to prevent oversized allocations
    
    The exec and vm_bind ioctl allow userspace to specify an arbitrary
    num_syncs value. Without bounds checking, a very large num_syncs
    can force an excessively large allocation, leading to kernel warnings
    from the page allocator as below.
    
    Introduce DRM_XE_MAX_SYNCS (set to 1024) and reject any request
    exceeding this limit.
    
    "
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124
    ...
    Call Trace:
     
     alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416
     ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317
     __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348
     __do_kmalloc_node mm/slub.c:4364 [inline]
     __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388
     kmalloc_noprof include/linux/slab.h:909 [inline]
     kmalloc_array_noprof include/linux/slab.h:948 [inline]
     xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158
     drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797
     drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894
     xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224
     vfs_ioctl fs/ioctl.c:51 [inline]
     __do_sys_ioctl fs/ioctl.c:598 [inline]
     __se_sys_ioctl fs/ioctl.c:584 [inline]
     __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    ...
    "
    
    v2: Add "Reported-by" and Cc stable kernels.
    v3: Change XE_MAX_SYNCS from 64 to 1024. (Matt & Ashutosh)
    v4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt)
    v5: Do the check at the top of the exec func. (Matt)
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Reported-by: Koen Koning 
    Reported-by: Peter Senna Tschudin 
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6450
    Cc:  # v6.12+
    Cc: Matthew Brost 
    Cc: Michal Mrozek 
    Cc: Carl Zhang 
    Cc: José Roberto de Souza 
    Cc: Lionel Landwerlin 
    Cc: Ivan Briano 
    Cc: Thomas Hellström 
    Cc: Ashutosh Dixit 
    Signed-off-by: Shuicheng Lin 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251205234715.2476561-5-shuicheng.lin@intel.com

commit 47f5cee4197719f5d06a899a2e827968a4e85d0b
Author: Michal Wajdeczko 
Date:   Mon Dec 15 18:04:33 2025 +0100

    drm/xe/guc: Fix version check for page-reclaim feature
    
    Page reclamation interfaces were introduced in GuC firmware version
    70.31.0 (which corresponds to GuC ABI version 1.14.0), but since this
    feature is also available for the VFs and VFs don't know the firmware
    version, use GuC compatibility version check instead.
    
    Fixes: 77ebc7c10d16 ("drm/xe/guc: Add page reclamation interface to GuC")
    Signed-off-by: Michal Wajdeczko 
    Cc: Brian Nguyen 
    Cc: Matthew Brost 
    Cc: Shuicheng Lin 
    Reviewed-by: Brian Nguyen 
    Reviewed-by: Daniele Ceraolo Spurio 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251215170433.196398-1-michal.wajdeczko@intel.com

commit eaf290c404f7c39f23292e9ce83b8b5b51ab598a
Author: Radu Rendec 
Date:   Fri Nov 28 16:20:55 2025 -0500

    PCI: dwc: Enable MSI affinity support
    
    Leverage the interrupt redirection infrastructure to enable CPU affinity
    support for MSI interrupts. Since the parent interrupt affinity cannot
    be changed, affinity control for the child interrupt (MSI) is achieved
    by redirecting the handler to run in IRQ work context on the target CPU.
    
    This patch was originally prepared by Thomas Gleixner (see Link tag below)
    in a patch series that was never submitted as is, and only parts of that
    series have made it upstream so far.
    
    Originally-by: Thomas Gleixner 
    Signed-off-by: Radu Rendec 
    Signed-off-by: Thomas Gleixner 
    Link: https://lore.kernel.org/linux-pci/878qpg4o4t.ffs@tglx/
    Link: https://patch.msgid.link/20251128212055.1409093-4-rrendec@redhat.com

commit f1875091a01dd634ff5f8b6fc57ab874f755c415
Author: Radu Rendec 
Date:   Fri Nov 28 16:20:54 2025 -0500

    PCI: dwc: Code cleanup
    
    Code cleanup with no functional changes. These changes were originally
    made by Thomas Gleixner (see Link tag below) in a patch that was never
    submitted as is. Other parts of that patch were eventually submitted as
    commit 8e717112caf3 ("PCI: dwc: Switch to msi_create_parent_irq_domain()")
    and the remaining parts are the code cleanup changes:
    
        - Use guard()/scoped_guard() instead of open-coded lock/unlock.
        - Return void in a few functions whose return value is never used.
        - Simplify dw_handle_msi_irq() by using for_each_set_bit().
    
    One notable deviation from the original patch is that it reverts back to a
    simple 1 by 1 iteration over the controllers inside dw_handle_msi_irq.  The
    reason is that with the original changes, the IRQ offset was calculated
    incorrectly.
    
    This prepares the ground for enabling MSI affinity support, which was
    originally part of that same series that Thomas Gleixner prepared.
    
    Originally-by: Thomas Gleixner 
    Signed-off-by: Radu Rendec 
    Signed-off-by: Thomas Gleixner 
    Link: https://lore.kernel.org/linux-pci/878qpg4o4t.ffs@tglx/
    Link: https://patch.msgid.link/20251128212055.1409093-3-rrendec@redhat.com

commit fcc1d0dabdb65ca069f77e5b76d3b20277be4a15
Author: Radu Rendec 
Date:   Fri Nov 28 16:20:53 2025 -0500

    genirq: Add interrupt redirection infrastructure
    
    Add infrastructure to redirect interrupt handler execution to a
    different CPU when the current CPU is not part of the interrupt's CPU
    affinity mask.
    
    This is primarily aimed at (de)multiplexed interrupts, where the child
    interrupt handler runs in the context of the parent interrupt handler,
    and therefore CPU affinity control for the child interrupt is typically
    not available.
    
    With the new infrastructure, the child interrupt is allowed to freely
    change its affinity setting, independently of the parent. If the
    interrupt handler happens to be triggered on an "incompatible" CPU (a
    CPU that's not part of the child interrupt's affinity mask), the handler
    is redirected and runs in IRQ work context on a "compatible" CPU.
    
    No functional change is being made to any existing irqchip driver, and
    irqchip drivers must be explicitly modified to use the newly added
    infrastructure to support interrupt redirection.
    
    Originally-by: Thomas Gleixner 
    Signed-off-by: Radu Rendec 
    Signed-off-by: Thomas Gleixner 
    Link: https://lore.kernel.org/linux-pci/878qpg4o4t.ffs@tglx/
    Link: https://patch.msgid.link/20251128212055.1409093-2-rrendec@redhat.com

commit c7ff956344e4c4cc87de6c1a53a1fcbb5fd5fd78
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:44 2025 +0000

    rust: irq: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-20-a2e13cbc17a6@google.com
    Signed-off-by: Danilo Krummrich 

commit 7aab0122a1497656992cd08c8df5a6e3939f779a
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:43 2025 +0000

    rust: io: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-19-a2e13cbc17a6@google.com
    Signed-off-by: Danilo Krummrich 

commit 8a03afe94763108537e33b48378bbc7472b4cc9d
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:39 2025 +0000

    rust: dma: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-15-a2e13cbc17a6@google.com
    Signed-off-by: Danilo Krummrich 

commit 93c7fa7416126dd29f78321f408044b474de8b8b
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:38 2025 +0000

    rust: device: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-14-a2e13cbc17a6@google.com
    Signed-off-by: Danilo Krummrich 

commit dbcc728e185f8c27fcafa1408ff63fe38c7dc72d
Author: Marc Zyngier 
Date:   Wed Dec 10 08:22:42 2025 +0000

    genirq: Remove setup_percpu_irq()
    
    setup_percpu_irq() was always a bad kludge, and should have never
    been there the first place. Now that the last users are gone,
    remove it for good.
    
    Signed-off-by: Marc Zyngier 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251210082242.360936-7-maz@kernel.org

commit bd04dae0791a8d44adc304d9787916fd4c539bb4
Author: Marc Zyngier 
Date:   Wed Dec 10 08:22:41 2025 +0000

    clocksource/drivers/mips-gic-timer: Move GIC timer to request_percpu_irq()
    
    Teach the MIPS GIC timer about request_percpu_irq(), which ultimately will
    allow for the removal of the antiquated setup_percpu_irq() API.
    
    Signed-off-by: Marc Zyngier 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251210082242.360936-6-maz@kernel.org

commit 7f92b583382a1eb4aaafed90d181464969e41656
Author: Marc Zyngier 
Date:   Wed Dec 10 08:22:40 2025 +0000

    MIPS: Move IP27 timer to request_percpu_irq()
    
    Teach the SGI IP27 timer about request_percpu_irq(), which ultimately will
    allow for the removal of the antiquated setup_percpu_irq() API.
    
    Signed-off-by: Marc Zyngier 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251210082242.360936-5-maz@kernel.org

commit a1eaca410a3cf533f8005d2959a7a8d9d8979f3e
Author: Marc Zyngier 
Date:   Wed Dec 10 08:22:39 2025 +0000

    MIPS: Move IP30 timer to request_percpu_irq()
    
    Teach the SGI IP30 timer about request_percpu_irq(), which ultimately will
    allow for the removal of the antiquated setup_percpu_irq() API.
    
    Signed-off-by: Marc Zyngier 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251210082242.360936-4-maz@kernel.org

commit e9b624ea31cc957b3a7798f89c20a80a8cbb0b73
Author: Marc Zyngier 
Date:   Wed Dec 10 08:22:38 2025 +0000

    genirq: Remove __request_percpu_irq() helper
    
    With the IRQ timing stuff being gone, there is no need to specify a flag
    when requesting a percpu interrupt. Not only IRQF_TIMER was the only flag
    (set of flags actually) allowed, but nobody ever passed it.
    
    Get rid of __request_percpu_irq(), which was only getting 0 as flags, and
    promote request_percpu_irq_affinity() as its replacement.
    
    Signed-off-by: Marc Zyngier 
    Signed-off-by: Thomas Gleixner 
    Reviewed-by: Jinjie Ruan 
    Link: https://patch.msgid.link/20251210082242.360936-3-maz@kernel.org

commit c119e6685311cef0e4a4e0b7752293bea056bac7
Author: Marc Zyngier 
Date:   Wed Dec 10 08:22:37 2025 +0000

    genirq: Remove IRQ timing tracking infrastructure
    
    The IRQ timing tracking infrastructure was merged in 2019, but was never
    plumbed in, is not selectable, and is therefore never used.
    
    As Daniel agrees that there is little hope for this infrastructure to be
    completed in the near term, drop it altogether.
    
    Signed-off-by: Marc Zyngier 
    Signed-off-by: Thomas Gleixner 
    Reviewed-by: Jinjie Ruan 
    Link: https://lore.kernel.org/r/87zf7vex6h.wl-maz@kernel.org
    Link: https://patch.msgid.link/20251210082242.360936-2-maz@kernel.org

commit 3365b71bc4c574dd954e7954595c85bb75b6912c
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:25 2025 +0000

    rust: auxiliary: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-1-a2e13cbc17a6@google.com
    Signed-off-by: Danilo Krummrich 

commit 9e51d1da5b245c9bf97fc49b06cca7e901c0fe94
Author: Dan Carpenter 
Date:   Fri Nov 21 16:34:40 2025 +0300

    firmware: stratix10-svc: Delete some stray tabs
    
    These lines are indented one tab too far.  Delete the extra tabs
    for readability.
    
    Signed-off-by: Dan Carpenter 
    Signed-off-by: Dinh Nguyen 

commit ff72619e11348ab189e232c59515dd5c33780d7c
Author: Kaushlendra Kumar 
Date:   Tue Dec 2 12:24:03 2025 +0530

    tools/power cpupower: Show C0 in idle-info dump
    
    `cpupower idle-info -o` skipped C0 because the loop began at 1:
    
      before:
        states:
          C1 ... latency[002] residency[00002]
          C2 ... latency[010] residency[00020]
          C3 ... latency[133] residency[00600]
    
      after:
        states:
          C0 ... latency[000] residency[00000]
          C1 ... latency[002] residency[00002]
          C2 ... latency[010] residency[00020]
          C3 ... latency[133] residency[00600]
    
    Start iterating at index 0 so the idle report mirrors sysfs and
    includes C0 stats.
    
    Link: https://lore.kernel.org/r/20251202065403.1492807-1-kaushlendra.kumar@intel.com
    Signed-off-by: Kaushlendra Kumar 
    Signed-off-by: Shuah Khan 

commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf
Author: Kaushlendra Kumar 
Date:   Mon Dec 1 17:47:45 2025 +0530

    tools/power cpupower: Reset errno before strtoull()
    
    cpuidle_state_get_one_value() never cleared errno before calling
    strtoull(), so a prior ERANGE caused every cpuidle counter read to
    return zero. Reset errno to 0 before the conversion so each sysfs read
    is evaluated independently.
    
    Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com
    Signed-off-by: Kaushlendra Kumar 
    Signed-off-by: Shuah Khan 

commit 1b9aaf36b7b40235e5a529c15848c3d866362207
Author: Kaushlendra Kumar 
Date:   Thu Nov 27 10:15:36 2025 +0530

    tools/cpupower: Use strcspn() to strip trailing newline
    
    Replace manual newline removal with strcspn() which is safer and
    cleaner. This avoids potential out-of-bounds access on empty strings
    and handles the case where no newline exists.
    
    Link: https://lore.kernel.org/r/20251127044536.715722-1-kaushlendra.kumar@intel.com
    Signed-off-by: Kaushlendra Kumar 
    Signed-off-by: Shuah Khan 

commit 24858a84163c8d04827166b3bcaed80612bb62fc
Author: Kaushlendra Kumar 
Date:   Wed Nov 26 14:46:13 2025 +0530

    tools/cpupower: Fix inverted APERF capability check
    
    The capability check was inverted, causing the function to return
    error when APERF support is available and proceed when it is not.
    
    Negate the condition to return error only when APERF capability
    is absent.
    
    Link: https://lore.kernel.org/r/20251126091613.567480-1-kaushlendra.kumar@intel.com
    Signed-off-by: Kaushlendra Kumar 
    Signed-off-by: Shuah Khan 

commit 6b401a5b2d2acf56ec902f96f6381982457ab339
Author: Kaushlendra Kumar 
Date:   Tue Dec 2 10:10:12 2025 +0530

    cpupower: idle_monitor: fix incorrect value logged after stop
    
    The cpuidle sysfs monitor printed the previous sample’s counter
    value in cpuidle_stop() instead of the freshly read one. The dprint
    line used previous_count[cpu][state] while current_count[cpu][state]
    had just been populated. This caused misleading debug output.
    
    Switch the logging to current_count so the post-interval snapshot
    matches the displayed value.
    
    Link: https://lore.kernel.org/r/20251202044012.3844790-1-kaushlendra.kumar@intel.com
    Signed-off-by: Kaushlendra Kumar 
    Signed-off-by: Shuah Khan 

commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc
Author: Jeffrey Bencteux 
Date:   Mon Nov 24 20:49:30 2025 +0100

    audit: add fchmodat2() to change attributes class
    
    fchmodat2(), introduced in version 6.6 is currently not in the change
    attribute class of audit. Calling fchmodat2() to change a file
    attribute in the same fashion than chmod() or fchmodat() will bypass
    audit rules such as:
    
    -w /tmp/test -p rwa -k test_rwa
    
    The current patch adds fchmodat2() to the change attributes class.
    
    Signed-off-by: Jeffrey Bencteux 
    Signed-off-by: Paul Moore 

commit 0317e0aba5d41ae5e974026bf96899d9ae4bcbdb
Author: Randy Dunlap 
Date:   Sun Dec 14 12:23:41 2025 -0800

    genirq/msi: Correct kernel-doc in 
    
    Eliminate all kernel-doc warnings in :
    
      - add "struct" to struct kernel-doc headers
      - add missing struct member descriptions or correct typos in them
    
    Fixes these warnings:
    Warning: include/linux/msi.h:60 cannot understand function prototype:
     'struct msi_msg'
    Warning: include/linux/msi.h:73 struct member 'arch_addr_lo' not described
     in 'msi_msg'
    Warning: include/linux/msi.h:73 struct member 'arch_addr_hi' not described
     in 'msi_msg'
    Warning: include/linux/msi.h:106 cannot understand function prototype:
     'struct pci_msi_desc'
    Warning: include/linux/msi.h:124 struct member 'msi_attrib' not described
     in 'pci_msi_desc'
    Warning: include/linux/msi.h:204 struct member 'sysfs_attrs' not described
     in 'msi_desc'
    Warning: include/linux/msi.h:227 struct member 'domain' not described in
     'msi_dev_domain'
    
    Signed-off-by: Randy Dunlap 
    Signed-off-by: Thomas Gleixner 
    Link: https://patch.msgid.link/20251214202341.2205675-1-rdunlap@infradead.org

commit 4725344462362e2ce2645f354737a8ea4280fa57
Author: Eric Dumazet 
Date:   Sat Nov 29 09:57:40 2025 +0000

    time/timecounter: Inline timecounter_cyc2time()
    
    New network transport protocols want NIC drivers to get hardware timestamps
    of all incoming packets, and possibly all outgoing packets.
    
    One example is the upcoming 'Swift congestion control' which is used by TCP
    transport and is the primary need for timecounter_cyc2time(). This means
    timecounter_cyc2time() can be called more than 100 million times per second
    on a busy server.
    
    Inlining timecounter_cyc2time() brings a 12% improvement on a UDP receive
    stress test on a 100Gbit NIC.
    
    Note that FDO, LTO, PGO are unable to magically help for this case,
    presumably because NIC drivers are almost exclusively shipped as modules.
    
    Add an unlikely() around the cc_cyc2ns_backwards() case, even if FDO (when
    used) is able to take care of this optimization.
    
    Signed-off-by: Eric Dumazet 
    Signed-off-by: Thomas Gleixner 
    Link: https://research.google/pubs/swift-delay-is-simple-and-effective-for-congestion-control-in-the-datacenter/
    Link: https://patch.msgid.link/20251129095740.3338476-1-edumazet@google.com

commit 97f27573837ef96b4ba42af463cc800cab615c0e
Author: Lizhi Hou 
Date:   Fri Dec 12 10:32:44 2025 -0800

    accel/amdxdna: Fix potential NULL pointer dereference in context cleanup
    
    aie_destroy_context() is invoked during error handling in
    aie2_create_context(). However, aie_destroy_context() assumes that the
    context's mailbox channel pointer is non-NULL. If mailbox channel
    creation fails, the pointer remains NULL and calling aie_destroy_context()
    can lead to a NULL pointer dereference.
    
    In aie2_create_context(), replace aie_destroy_context() with a function
    which request firmware to remove the context created previously.
    
    Fixes: be462c97b7df ("accel/amdxdna: Add hardware context")
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251212183244.1826318-1-lizhi.hou@amd.com

commit 2db2d6813003fd47a3527397b1b3847d91288f62
Author: Iker Pedrosa 
Date:   Mon Dec 15 16:57:56 2025 +0100

    MAINTAINERS: Add entry for Sitronix ST7920 driver
    
    Add Iker as ST7920 driver maintainer.
    
    Reviewed-by: Thomas Zimmermann 
    Signed-off-by: Iker Pedrosa 
    Signed-off-by: Javier Martinez Canillas 
    Link: https://patch.msgid.link/20251215-st7920-v7-3-36771009ec01@gmail.com

commit 88b09229f34a8a2a0c6aa8a62eb6c96011181e3c
Author: Iker Pedrosa 
Date:   Mon Dec 15 16:57:55 2025 +0100

    drm: Add driver for Sitronix ST7920 LCD displays
    
    Add a new DRM/KMS driver for displays using the Sitronix ST7920
    controller connected via the SPI bus. This provides a standard
    framebuffer interface for these common monochrome LCDs.
    
    Reviewed-by: Thomas Zimmermann 
    Reviewed-by: Javier Martinez Canillas 
    Signed-off-by: Iker Pedrosa 
    Signed-off-by: Javier Martinez Canillas 
    Link: https://patch.msgid.link/20251215-st7920-v7-2-36771009ec01@gmail.com

commit 549cf05a21a2c721c55582e87e1b21869d73a5a5
Author: Iker Pedrosa 
Date:   Mon Dec 15 16:57:54 2025 +0100

    dt-bindings: display: sitronix,st7920: Add DT schema
    
    Add binding for Sitronix ST7920 display.
    
    Reviewed-by: Krzysztof Kozlowski 
    Signed-off-by: Iker Pedrosa 
    Signed-off-by: Javier Martinez Canillas 
    Link: https://patch.msgid.link/20251215-st7920-v7-1-36771009ec01@gmail.com

commit 631ee338f04db713ba611883f28e94157ebb68e5
Merge: c99ebb6132595b 5a58414fe107e4
Author: Jeff Johnson 
Date:   Mon Dec 15 08:55:21 2025 -0800

    Merge branch 'ath12k-ng' into ath-next
    
    As originally proposed in [1], the ath12k driver was re-architected in
    the ath12k-ng branch to separate the logic specific to 802.11be (Wi-Fi
    7) from the core logic. This separation will allow ath12k to also
    support 802.11bn (Wi-Fi 8) in the future. Now merge this into ath-next.
    
    Many thanks to everyone who worked on this re-architecture. Special
    thanks to Vasanthakumar Thiagarajan and Baochen Qiang who reviewed
    every patch, and to Ripan Deuri for the ath12k-ng => ath-next merge
    conflict resolution.
    
    Link: https://lore.kernel.org/all/4a17d730-ede8-463e-98d8-9b0291d0ca45@oss.qualcomm.com/ # [1]
    Signed-off-by: Jeff Johnson 

commit c197179990124f991fca220d97fac56779a02c6d
Author: Tomas Melin 
Date:   Tue Nov 25 09:53:54 2025 +0200

    Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
    
    This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.
    
    OP-TEE logic in U-Boot automatically injects a reserved-memory
    node along with optee firmware node to kernel device tree.
    The injection logic is dependent on that there is no manually
    defined optee node. Having the node in zynqmp.dtsi effectively
    breaks OP-TEE's insertion of the reserved-memory node, causing
    memory access violations during runtime.
    
    Signed-off-by: Tomas Melin 
    Signed-off-by: Michal Simek 
    Link: https://lore.kernel.org/r/20251125-revert-zynqmp-optee-v1-1-d2ce4c0fcaf6@vaisala.com

commit ce39d255dea5ff7d618ef44f61776545481793a1
Author: SungMin Park 
Date:   Wed Oct 29 18:37:31 2025 +0530

    dt-bindings: samsung: exynos-pmu: Add compatible for ARTPEC-9 SoC
    
    Add Axis ARTPEC-9 pmu compatible to the bindings documentation.
    It reuses the older samsung,exynos7-pmu design.
    
    Signed-off-by: SungMin Park 
    Signed-off-by: Ravi Patel 
    Acked-by: Conor Dooley 
    Link: https://patch.msgid.link/20251029130731.51305-5-ravi.patel@samsung.com
    Signed-off-by: Krzysztof Kozlowski 

commit 1a0c2bf998bb90e1d7450ad6b3b47f9e428375a7
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:52 2025 +0900

    dt-bindings: crypto: Document aspeed,ahbc property for Aspeed ACRY
    
    The g6 DTSI already provides the property and the driver errors out if
    the AHB controller's syscon can't be located, so define the property and
    mark it as required.
    
    Signed-off-by: Andrew Jeffery 
    Link: https://patch.msgid.link/20251211-dev-dt-warnings-all-v1-10-21b18b9ada77@codeconstruct.com.au
    Signed-off-by: Rob Herring (Arm) 

commit 44f6d951028f121a167347cbf91dd519b5bf5c80
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:51 2025 +0900

    dt-bindings: bus: aspeed: Require syscon for AST2600 AHB controller
    
    The AST2600's ACRY (eliptic curve and RSA crypto engine) requires access
    to configuration exposed by the AHB controller. The devicetree already
    describes the AHB controller node as a syscon, so require this in the
    binding to satisfy the ACRY relationship.
    
    Signed-off-by: Andrew Jeffery 
    Link: https://patch.msgid.link/20251211-dev-dt-warnings-all-v1-9-21b18b9ada77@codeconstruct.com.au
    Signed-off-by: Rob Herring (Arm) 

commit 0d4b3ca115b5436d7e68453527566db3e87ab7f0
Author: Ricky Ringler 
Date:   Mon Dec 15 08:33:23 2025 -0600

    xtensa: align: validate access in fast_load_store
    
    access_ok() is used only in user mode and
    branches to .Linvalid_instruction on fault.
    Kernel mode skips access_ok().
    
    Tested-by: Ricky Ringler 
    
    Signed-off-by: Ricky Ringler 
    Message-ID: <20251215143323.2771889-1-richard.rringler@gmail.com>
    Signed-off-by: Max Filippov 

commit bdfcca65e7a681f7511a5c15501a01dd855f6d23
Author: Marcos Paulo de Souza 
Date:   Mon Dec 8 11:06:16 2025 -0300

    printk: nbcon: Check for device_{lock,unlock} callbacks
    
    These callbacks are necessary to synchronize ->write_thread callback
    against other operations using the same device.
    
    Signed-off-by: Marcos Paulo de Souza 
    Reviewed-by: John Ogness 
    Link: https://patch.msgid.link/20251208-nbcon-device-cb-fix-v2-1-36be8d195123@suse.com
    Signed-off-by: Petr Mladek 

commit f4acea9eef704607d1a950909ce3a52a770d6be2
Author: Alain Volmat 
Date:   Mon Dec 15 13:26:20 2025 +0100

    spi: dt-bindings: st,stm32-spi: add 'power-domains' property
    
    STM32 SPI may be in a power domain which is the case for the STM32MP2x
    based boards. Allow a single 'power-domains' entry for STM32 SPI.
    
    Signed-off-by: Alain Volmat 
    Link: https://patch.msgid.link/20251215-stm32-spi-mp2x-dt-updates-v1-1-464a5fd20f13@foss.st.com
    Signed-off-by: Mark Brown 

commit 524ee559948d8d079b13466e70fa741f909699c0
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:08:19 2025 +0200

    ASoC: SOF: Intel: hda: Only check SSP MCLK mask in case of IPC3
    
    IPC4 is using the NHLT blob itself and sends the SSP blob from it directly
    to the firmware, there is no need for the MCLK quirk based on the SSP blob
    since the SSP blob is in use.
    
    At the same time reword the error, info and debug messages for clarity.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Ranjani Sridharan 
    Reviewed-by: Balamurugan C 
    Link: https://patch.msgid.link/20251215130819.31218-1-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit a1bcb66209a745c9ca18deae9f1c207b009dee1c
Author: Andy Shevchenko 
Date:   Fri Dec 12 19:16:20 2025 +0100

    ASoC: Fix acronym for Intel Gemini Lake
    
    While the used GML is consistent with the pattern for other Intel * Lake
    SoCs, the de facto use is GLK. Update the acronym and users accordingly.
    
    Note, a handful of the drivers for Gemini Lake in the Linux kernel use
    GLK already (LPC, MEI, pin control, SDHCI, ...) and even some in ASoC.
    The only ones in this patch used the inconsistent one.
    
    Acked-by: Bjorn Helgaas  # pci_ids.h
    Signed-off-by: Andy Shevchenko 
    Reviewed-by: Peter Ujfalusi 
    Reviewed-by: Cezary Rojewski 
    Link: https://patch.msgid.link/20251212181742.3944789-1-andriy.shevchenko@linux.intel.com
    Signed-off-by: Mark Brown 

commit f25c7d709b93602ee9a08eba522808a18e1f5d56
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:29:46 2025 +0200

    ASoC: SOF: Intel: pci-nvl: Set on_demand_dsp_boot for NVL-S
    
    NVL-S can be used with on-demand DSP booting, set the flag to enable it.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Ranjani Sridharan 
    Link: https://patch.msgid.link/20251215132946.2155-9-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit aabcb01353013d38533ba4346b6ca84bff1b96f0
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:29:45 2025 +0200

    ASoC: SOF: Intel: pci-ptl: Set on_demand_dsp_boot for PTL and WCL
    
    PTL and WCL can be used with on-demand DSP booting, set the flag to
    enable it.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Liam Girdwood 
    Link: https://patch.msgid.link/20251215132946.2155-8-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 6780fb864d5b80f20694c9141036717b23190150
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:29:44 2025 +0200

    ASoC: SOF: Intel: pci-lnl: Set on_demand_dsp_boot for LNL
    
    LNL can be used with on-demand DSP booting, set the flag to enable it.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Liam Girdwood 
    Link: https://patch.msgid.link/20251215132946.2155-7-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit d4e34f4ef88fc48a09b654bbe1b23c6788e7844a
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:29:43 2025 +0200

    ASoC: SOF: Intel: hda-sdw-bpt: Add support for on-demand DSP boot
    
    If on-demand DSP boot is used we need to make sure that the DSP is booted
    up - which might not be the case - since we need ChainDMA in normal, non
    DSPless mode for the BRA to work.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Liam Girdwood 
    Link: https://patch.msgid.link/20251215132946.2155-6-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 2cf7a9ced3c1a999f7de8711cb2a212557fbd800
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:29:42 2025 +0200

    ASoC: SOF: sof-client: Add support for on-demand DSP boot
    
    With the introduction of on-demand DSP boot the rpm status not necessary
    tells that the DSP firmware is booted up.
    
    Introduce the sof_client_boot_dsp() which can be used to make sure that
    the DSP is booted and it can handle IPCs.
    
    Update the client drivers to use the new function where it is expected that
    the DSP is booted up.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Liam Girdwood 
    Link: https://patch.msgid.link/20251215132946.2155-5-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit c3e1549811747e4b4ff7e4bba691980d9dab2d9e
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:29:41 2025 +0200

    ASoC: SOF: Add support for on-demand DSP boot
    
    On system suspend / resume we always power up the DSP and boot the
    firmware, which is not strictly needed as right after the firmware booted
    up we power the DSP down again on suspend and we also power it down after
    resume after some inactivity.
    
    Out of caution, add a new platform descriptor flag to enable on-demand
    DSP boot since this might not work without changes to platform code on
    certain platforms.
    
    With the on-demand dsp boot enabled we will not boot the DSP and firmware
    up on system or rpm resume, just enable audio subsystem since audio IPs,
    like HDA and SoundWire might be needed (codecs suspend/resume operation).
    Only boot up the DSP during the first hw_params() call when the DSP is
    really going to be needed.
    
    In this way we can handle the audio related use cases:
    normal audio use (rpm suspend/resume)
    system suspend/resume without active audio
    system suspend/resume with active audio
    system suspend/resume without active audio, and audio start before the rpm
    suspend timeout
    
    Add module option to force the on-demand DSP boot to allow it to be
    disabled or enabled without kernel change for testing.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Liam Girdwood 
    Link: https://patch.msgid.link/20251215132946.2155-4-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit 2c77ff200f59103ecdee60c00818a43cee38a6b8
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:29:40 2025 +0200

    ASoC: SOF: control: skip rpm calls in ext_volatile_get if not implemented
    
    Test earlier for the existence of ext_volatile_get callback and if it is
    missing, skip the rpm calls to avoid needles DSP power on.
    
    No change in functionality, we just skip the DSP power on in the unlikely
    case when the ext_volatile _get is not supported and yet the topology adds
    such control.
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Liam Girdwood 
    Link: https://patch.msgid.link/20251215132946.2155-3-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit b8e54b447cdec234f0e0d80487af9540063d17dd
Author: Peter Ujfalusi 
Date:   Mon Dec 15 15:29:39 2025 +0200

    ASoC: SOF: ipc4-loader: Remove redundant rpm resume_and_get from load_library
    
    The initial library loading is happening during topology loading, which is
    already protected with pm_runtime_resume_and_get() via pcm.c
    
    The redundant rpm code can be dropped from sof_ipc4_load_library()
    
    Signed-off-by: Peter Ujfalusi 
    Reviewed-by: Bard Liao 
    Reviewed-by: Kai Vehmanen 
    Reviewed-by: Liam Girdwood 
    Link: https://patch.msgid.link/20251215132946.2155-2-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown 

commit b68f91ef3b3fe82ad78c417de71b675699a8467c
Author: Deepakkumar Karn 
Date:   Thu Dec 11 18:42:11 2025 +0530

    fs/buffer: add alert in try_to_free_buffers() for folios without buffers
    
    try_to_free_buffers() can be called on folios with no buffers attached
    when filemap_release_folio() is invoked on a folio belonging to a mapping
    with AS_RELEASE_ALWAYS set but no release_folio operation defined.
    
    In such cases, folio_needs_release() returns true because of the
    AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This
    causes try_to_free_buffers() to call drop_buffers() on a folio with no
    buffers, leading to a null pointer dereference.
    
    Adding a check in try_to_free_buffers() to return early if the folio has no
    buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.
    This provides defensive hardening.
    
    Signed-off-by: Deepakkumar Karn 
    Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit e7a943f0824b584e42847ad9642d7fb751022cf6
Author: Heiko Stuebner 
Date:   Tue Oct 21 09:42:47 2025 +0200

    drm/rockchip: hdmi: add RK3368 controller variant
    
    The RK3368 has only one VOP, so there is no source selection happening
    and the controller uses an internal PHY for the HDMI output.
    
    Signed-off-by: Heiko Stuebner 
    Reviewed-by: Andy Yan 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251021074254.87065-3-heiko@sntech.de

commit 0edbd43e0c149152b917c0cde61e4bd34a5bd118
Author: Heiko Stuebner 
Date:   Tue Oct 21 09:42:46 2025 +0200

    dt-bindings: display: rockchip: dw-hdmi: Add compatible for RK3368 HDMI
    
    Define a new compatible for RK3368 HDMI.
    
    The RK3368 HDMI also uses a PHY internal to the controller, so works
    similar to other controllers, with the exception that the RK3368
    only has one VOP, so there is no source selection needed.
    
    Acked-by: Conor Dooley 
    Signed-off-by: Heiko Stuebner 
    Signed-off-by: Heiko Stuebner 
    Link: https://patch.msgid.link/20251021074254.87065-2-heiko@sntech.de

commit 51a146e0595c638c58097a1660ff6b6e7d3b72f3
Author: Eric Sandeen 
Date:   Fri Dec 12 11:44:03 2025 -0600

    fs: Remove internal old mount API code
    
    Now that the last in-tree filesystem has been converted to the new mount
    API, remove all legacy mount API code designed to handle un-converted
    filesystems, and remove associated documentation as well.
    
    (The code to handle the legacy mount(2) syscall from userspace is still
    in place, of course.)
    
    Tested with an allmodconfig build on x86_64, and a sanity check of an
    old mount(2) syscall mount.
    
    Signed-off-by: Eric Sandeen 
    Link: https://patch.msgid.link/20251212174403.2882183-1-sandeen@redhat.com
    Signed-off-by: Christian Brauner 

commit 961b2ad1b4131c947cbc75700c83a6deb0c91d02
Merge: 887e97745ec336 6d864a1b182532
Author: Christian Brauner 
Date:   Fri Dec 5 11:11:38 2025 +0100

    Merge patch series "further damage-control lack of clone scalability"
    
    Mateusz Guzik  says:
    
    When spawning and killing threads in separate processes in parallel the
    primary bottleneck on the stock kernel is pidmap_lock, largely because
    of a back-to-back acquire in the common case.
    
    Benchmark code at the end.
    
    With this patchset alloc_pid() only takes the lock once and consequently
    alleviates the problem. While scalability improves, the lock remains the
    primary bottleneck by a large margin.
    
    I believe idr is a poor choice for the task at hand to begin with, but
    sorting out that out beyond the scope of this patchset. At the same time
    any replacement would be best evaluated against a state where the
    above relock problem is fixed.
    
    Performance improvement varies between reboots. When benchmarking with
    20 processes creating and killing threads in a loop, the unpatched
    baseline hovers around 465k ops/s, while patched is anything between
    ~510k ops/s and ~560k depending on false-sharing (which I only minimally
    sanitized). So this is at least 10% if you are unlucky.
    
    bench from will-it-scale:
    
    char *testcase_description = "Thread creation and teardown";
    
    static void *worker(void *arg)
    {
            return (NULL);
    }
    
    void testcase(unsigned long long *iterations, unsigned long nr)
    {
            pthread_t thread[1];
            int error;
    
            while (1) {
                    for (int i = 0; i < 1; i++) {
                            error = pthread_create(&thread[i], NULL, worker, NULL);
                            assert(error == 0);
                    }
                    for (int i = 0; i < 1; i++) {
                            error = pthread_join(thread[i], NULL);
                            assert(error == 0);
                    }
                    (*iterations)++;
            }
    }
    
    v2:
    - cosmetic fixes from Oleg
    - drop idr_preload_many, relock pidmap + call idr_preload again instead
    - write a commit message for the alloc pid patch
    
    * patches from https://patch.msgid.link/20251203092851.287617-1-mjguzik@gmail.com:
      pid: only take pidmap_lock once on alloc
      ns: pad refcount
    
    Link: https://patch.msgid.link/20251203092851.287617-1-mjguzik@gmail.com
    Signed-off-by: Christian Brauner 

commit 887e97745ec336c2f49b6c0af3c4cc00a5df3211
Author: Mateusz Guzik 
Date:   Wed Dec 3 10:48:37 2025 +0100

    fs: track the inode having file locks with a flag in ->i_opflags
    
    Opening and closing an inode dirties the ->i_readcount field.
    
    Depending on the alignment of the inode, it may happen to false-share
    with other fields loaded both for both operations to various extent.
    
    This notably concerns the ->i_flctx field.
    
    Since most inodes don't have the field populated, this bit can be managed
    with a flag in ->i_opflags instead which bypasses the problem.
    
    Here are results I obtained while opening a file read-only in a loop
    with 24 cores doing the work on Sapphire Rapids. Utilizing the flag as
    opposed to reading ->i_flctx field was toggled at runtime as the benchmark
    was running, to make sure both results come from the same alignment.
    
    before: 3233740
    after:  3373346 (+4%)
    
    before: 3284313
    after:  3518711 (+7%)
    
    before: 3505545
    after:  4092806 (+16%)
    
    Or to put it differently, this varies wildly depending on how (un)lucky
    you get.
    
    The primary bottleneck before and after is the avoidable lockref trip in
    do_dentry_open().
    
    Reviewed-by: Jeff Layton 
    Signed-off-by: Mateusz Guzik 
    Link: https://patch.msgid.link/20251203094837.290654-2-mjguzik@gmail.com
    Signed-off-by: Christian Brauner 

commit 6d864a1b182532e7570383af8825fa4ddcd24243
Author: Mateusz Guzik 
Date:   Wed Dec 3 10:28:51 2025 +0100

    pid: only take pidmap_lock once on alloc
    
    When spawning and killing threads in separate processes in parallel the
    primary bottleneck on the stock kernel is pidmap_lock, largely because
    of a back-to-back acquire in the common case. This aspect is fixed with
    the patch.
    
    Performance improvement varies between reboots. When benchmarking with
    20 processes creating and killing threads in a loop, the unpatched
    baseline hovers around 465k ops/s, while patched is anything between
    ~510k ops/s and ~560k depending on false-sharing (which I only minimally
    sanitized). So this is at least 10% if you are unlucky.
    
    The change also facilitated some cosmetic fixes.
    
    It has an unintentional side effect of no longer issuing spurious
    idr_preload() around idr_replace().
    
    Signed-off-by: Mateusz Guzik 
    Link: https://patch.msgid.link/20251203092851.287617-3-mjguzik@gmail.com
    Reviewed-by: Oleg Nesterov 
    Signed-off-by: Christian Brauner 

commit 1fa4e69a54a250fa17d2afd9c5b54a59329033c1
Author: Mateusz Guzik 
Date:   Wed Dec 3 10:48:36 2025 +0100

    filelock: use a consume fence in locks_inode_context()
    
    Matches the idiom of storing a pointer with a release fence and safely
    getting the content with a consume fence after.
    
    Eliminates an actual fence on some archs.
    
    Reviewed-by: Jeff Layton 
    Signed-off-by: Mateusz Guzik 
    Link: https://patch.msgid.link/20251203094837.290654-1-mjguzik@gmail.com
    Signed-off-by: Christian Brauner 

commit c0aac5975bafc86f6817b14e9f71dcb5064a9183
Author: Mateusz Guzik 
Date:   Wed Dec 3 10:28:50 2025 +0100

    ns: pad refcount
    
    Note no effort is made to make sure structs embedding the namespace are
    themselves aligned, so this is not guaranteed to eliminate cacheline
    bouncing due to refcount management.
    
    Signed-off-by: Mateusz Guzik 
    Link: https://patch.msgid.link/20251203092851.287617-2-mjguzik@gmail.com
    Signed-off-by: Christian Brauner 

commit 5854fc6391e9d67c9ebfb4cb618406b5a372db6b
Author: Mateusz Guzik 
Date:   Wed Dec 3 10:55:08 2025 +0100

    fs: annotate cdev_lock with __cacheline_aligned_in_smp
    
    No need for the crapper to be susceptible to false-sharing.
    
    Signed-off-by: Mateusz Guzik 
    Link: https://patch.msgid.link/20251203095508.291073-1-mjguzik@gmail.com
    Reviewed-by: Jan Kara 
    Signed-off-by: Christian Brauner 

commit 0f5bb0cfb0b40a31d2fe146ecbef5727690fa547
Author: David Laight 
Date:   Wed Nov 19 22:41:26 2025 +0000

    fs: use min() or umin() instead of min_t()
    
    min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'.
    Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long'
    and so cannot discard significant bits.
    
    A couple of places need umin() because of loops like:
            nfolios = DIV_ROUND_UP(ret + start, PAGE_SIZE);
    
            for (i = 0; i < nfolios; i++) {
                    struct folio *folio = page_folio(pages[i]);
                    ...
                    unsigned int len = umin(ret, PAGE_SIZE - start);
                    ...
                    ret -= len;
                    ...
            }
    where the compiler doesn't track things well enough to know that
    'ret' is never negative.
    
    The alternate loop:
            for (i = 0; ret > 0; i++) {
                    struct folio *folio = page_folio(pages[i]);
                    ...
                    unsigned int len = min(ret, PAGE_SIZE - start);
                    ...
                    ret -= len;
                    ...
            }
    would be equivalent and doesn't need 'nfolios'.
    
    Most of the 'unsigned long' actually come from PAGE_SIZE.
    
    Detected by an extra check added to min_t().
    
    Signed-off-by: David Laight 
    Link: https://patch.msgid.link/20251119224140.8616-31-david.laight.linux@gmail.com
    Signed-off-by: Christian Brauner 

commit 7f3b33668595ee48722df86831a1df4ee1192269
Author: Askar Safin 
Date:   Wed Nov 19 22:24:05 2025 +0000

    init: remove deprecated "load_ramdisk" and "prompt_ramdisk" command line parameters
    
    ...which do nothing. They were deprecated (in documentation) in
    6b99e6e6aa62 ("Documentation/admin-guide: blockdev/ramdisk: remove use of
    "rdev"") in 2020 and in kernel messages in c8376994c86c ("initrd: remove
    support for multiple floppies") in 2020.
    
    Signed-off-by: Askar Safin 
    Link: https://patch.msgid.link/20251119222407.3333257-2-safinaskar@gmail.com
    Acked-by: Arnd Bergmann 
    Reviewed-by: Christoph Hellwig 
    Reviewed-by: Randy Dunlap 
    Signed-off-by: Christian Brauner 

commit b8304863a3990d0f18c38e5b94191830a63ee1af
Merge: 63cb6443c7a798 8f0b4cce4481fb
Author: Rodrigo Vivi 
Date:   Mon Dec 15 08:24:02 2025 -0500

    Merge drm/drm-next into drm-intel-next
    
    Sync-up some display code needed for Async flips refactor.
    
    Signed-off-by: Rodrigo Vivi 

commit fdce161afe29b40e84853ec821cbd7bbd727bf58
Author: Randy Dunlap 
Date:   Thu Nov 27 21:57:31 2025 -0800

    firmware: ti_sci.h: fix all kernel-doc warnings
    
    Modify kernel-doc comments in ti_sci.h to eliminate all kernel-doc
    warnings:
    
    * use correct/matching struct names in kdoc comments
    * use correct struct member names in kdoc comments
    * add a ':' after struct member names where needed
    * change a blank kdoc line to " *"
    * convert 3 structs to kernel-doc comments:
      struct ti_sci_msg_rm_udmap_tx_ch_cfg_req
      struct ti_sci_msg_rm_udmap_rx_ch_cfg_req
      struct ti_sci_msg_rm_udmap_flow_cfg_req
    
    Fixes 13 kernel-doc warnings:
    
    Warning: drivers/firmware/ti_sci.h:609 expecting prototype for struct
     tisci_msg_req_prepare_sleep. Prototype was for struct
     ti_sci_msg_req_prepare_sleep instead
    Warning: drivers/firmware/ti_sci.h:609 struct member 'hdr' not described
     in 'ti_sci_msg_req_prepare_sleep'
    Warning: drivers/firmware/ti_sci.h:609 struct member 'mode' not described
     in 'ti_sci_msg_req_prepare_sleep'
    Warning: drivers/firmware/ti_sci.h:609 struct member 'ctx_lo' not described
     in 'ti_sci_msg_req_prepare_sleep'
    Warning: drivers/firmware/ti_sci.h:609 struct member 'ctx_hi' not described
     in 'ti_sci_msg_req_prepare_sleep'
    Warning: drivers/firmware/ti_sci.h:609 struct member 'debug_flags' not
     described in 'ti_sci_msg_req_prepare_sleep'
    Warning: drivers/firmware/ti_sci.h:623 expecting prototype for struct
     tisci_msg_set_io_isolation_req. Prototype was for struct
     ti_sci_msg_req_set_io_isolation instead
    Warning: drivers/firmware/ti_sci.h:696 struct member 'latency' not
     described in 'ti_sci_msg_req_lpm_set_latency_constraint'
    Warning: drivers/firmware/ti_sci.h:857 bad line:
    Warning: drivers/firmware/ti_sci.h:1002 This comment starts with '/**', but
     isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst
     * Configures a Navigator Subsystem UDMAP transmit channel
    Warning: drivers/firmware/ti_sci.h:1130 This comment starts with '/**', but
     isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst
     * Configures a Navigator Subsystem UDMAP receive channel
    Warning: drivers/firmware/ti_sci.h:1249 This comment starts with '/**', but
     isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst
     * Configures a Navigator Subsystem UDMAP receive flow
    Warning: drivers/firmware/ti_sci.h:1421 struct member 'valid_params'
     not described in 'ti_sci_msg_rm_udmap_flow_cfg_req'
    
    Signed-off-by: Randy Dunlap 
    Link: https://patch.msgid.link/20251128055731.812460-1-rdunlap@infradead.org
    Signed-off-by: Nishanth Menon 

commit d5bc4e31f2a3f301b4214858bec834c67bb2be5c
Merge: 8f0b4cce4481fb 0c82fdbbbfbee8
Author: Christian Brauner 
Date:   Thu Dec 4 10:18:27 2025 +0100

    Merge patch series "statmount: accept fd as a parameter"
    
    Bhavik Sachdev  says:
    
    We would like to add support for checkpoint/restoring file descriptors
    open on these "unmounted" mounts to CRIU (Checkpoint/Restore in
    Userspace) [1].
    
    Currently, we have no way to get mount info for these "unmounted" mounts
    since they do appear in /proc//mountinfo and statmount does not
    work on them, since they do not belong to any mount namespace.
    
    This patch helps us by providing a way to get mountinfo for these
    "unmounted" mounts by using a fd on the mount.
    
    Changes from v6 [2] to v7:
    * Add kselftests for STATMOUNT_BY_FD flag.
    
    * Instead of renaming mnt_id_req.mnt_ns_fd to mnt_id_req.fd introduce a
    union so struct mnt_id_req looks like this:
    
        struct mnt_id_req {
                __u32 size;
                union {
                        __u32 mnt_ns_fd;
                        __u32 mnt_fd;
                };
                __u64 mnt_id;
                __u64 param;
                __u64 mnt_ns_id;
        };
    
    * In case of STATMOUNT_BY_FD grab mnt_ns inside of do_statmount(),
    since we get mnt_ns from mnt, which should happen under namespace lock.
    
    * Remove the modifications made to grab_requested_mnt_ns, those were
    never needed.
    
    Changes from v5 [3] to v6:
    * Instead of returning "[unmounted]" as the mount point for "unmounted"
    mounts, we unset the STATMOUNT_MNT_POINT flag in statmount.mask.
    
    * Instead of returning 0 as the mnt_ns_id for "unmounted" mounts, we
    unset the STATMOUNT_MNT_NS_ID flag in statmount.mask.
    
    * Added comment in `do_statmount` clarifying that the caller sets s->mnt
    in case of STATMOUNT_BY_FD.
    
    * In `do_statmount` move the mnt_ns_id and mnt_ns_empty() check just
    before lookup_mnt_in_ns().
    
    * We took another look at the capability checks for getting information
    for "unmounted" mounts using an fd and decided to remove them for the
    following reasons:
    
      - All fs related information is available via fstatfs() without any
        capability check.
    
      - Mount information is also available via /proc/pid/mountinfo (without
        any capability check).
    
      - Given that we have access to a fd on the mount which tells us that
        we had access to the mount at some point (or someone that had access
        gave us the fd). So, we should be able to access mount info.
    
    Changes from v4 [4] to v5:
    Check only for s->root.mnt to be NULL instead of checking for both
    s->root.mnt and s->root.dentry (I did not find a case where only one of
    them would be NULL).
    
    * Only allow system root (CAP_SYS_ADMIN in init_user_ns) to call
    statmount() on fd's on "unmounted" mounts. We (mostly Pavel) spent some
    time thinking about how our previous approach (of checking the opener's
    file credentials) caused problems.
    
    Please take a look at the linked pictures they describe everything more
    clearly.
    
    Case 1: A fd is on a normal mount (Link to Picture: [5])
    Consider, a situation where we have two processes P1 and P2 and a file
    F1. F1 is opened on mount ns M1 by P1. P1 is nested inside user
    namespace U1 and U2. P2 is also in U1. P2 is also in a pid namespace and
    mount namespace separate from M1.
    
    P1 sends F1 to P2 (using a unix socket). But, P2 is unable to call
    statmount() on F1 because since it is a separate pid and mount
    namespace. This is good and expected.
    
    Case 2: A fd is on a "unmounted" mount (Link to Picture: [6])
    Consider a similar situation as Case 1. But now F1 is on a mounted that
    has been "unmounted". Now, since we used openers credentials to check
    for permissions P2 ends up having the ability call statmount() and get
    mount info for this "unmounted" mount.
    
    Hence, It is better to restrict the ability to call statmount() on fds
    on "unmounted" mounts to system root only (There could also be other
    cases than the one described above).
    
    Changes from v3 [7] to v4:
    * Change the string returned when there is no mountpoint to be
    "[unmounted]" instead of "[detached]".
    * Remove the new DEFINE_FREE put_file and use the one already present in
    include/linux/file.h (fput) [8].
    * Inside listmount consistently pass 0 in flags to copy_mnt_id_req and
    prepare_klistmount()->grab_requested_mnt_ns() and remove flags from the
    prepare_klistmount prototype.
    * If STATMOUNT_BY_FD is set, check for mnt_ns_id == 0 && mnt_id == 0.
    
    Changes from v2 [9] to v3:
    * Rename STATMOUNT_FD flag to STATMOUNT_BY_FD.
    * Fixed UAF bug caused by the reference to fd_mount being bound by scope
    of CLASS(fd_raw, f)(kreq.fd) by using fget_raw instead.
    * Reused @spare parameter in mnt_id_req instead of adding new fields to
    the struct.
    
    Changes from v1 [10] to v2:
    v1 of this patchset, took a different approach and introduced a new
    umount_mnt_ns, to which "unmounted" mounts would be moved to (instead of
    their namespace being NULL) thus allowing them to be still available via
    statmount.
    
    Introducing umount_mnt_ns complicated namespace locking and modified
    performance sensitive code [11] and it was agreed upon that fd-based
    statmount would be better.
    
    This code is also available on github [12].
    
    [1]: https://github.com/checkpoint-restore/criu/pull/2754
    [2]: https://lore.kernel.org/all/20251118084836.2114503-1-b.sachdev1904@gmail.com/
    [3]: https://lore.kernel.org/criu/20251109053921.1320977-2-b.sachdev1904@gmail.com/T/#u
    [4]: https://lore.kernel.org/all/20251029052037.506273-2-b.sachdev1904@gmail.com/
    [5]: https://github.com/bsach64/linux/blob/statmount-fd-v5/fd_on_normal_mount.png
    [6]: https://github.com/bsach64/linux/blob/statmount-fd-v5/file_on_unmounted_mount.png
    [7]: https://lore.kernel.org/all/20251024181443.786363-1-b.sachdev1904@gmail.com/
    [8]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/file.h#n97
    [9]: https://lore.kernel.org/linux-fsdevel/20251011124753.1820802-1-b.sachdev1904@gmail.com/
    [10]: https://lore.kernel.org/linux-fsdevel/20251002125422.203598-1-b.sachdev1904@gmail.com/
    [11]: https://lore.kernel.org/linux-fsdevel/7e4d9eb5-6dde-4c59-8ee3-358233f082d0@virtuozzo.com/
    [12]: https://github.com/bsach64/linux/tree/statmount-fd-v7
    
    * patches from https://patch.msgid.link/20251129091455.757724-1-b.sachdev1904@gmail.com:
      selftests: statmount: tests for STATMOUNT_BY_FD
      statmount: accept fd as a parameter
      statmount: permission check should return EPERM
    
    Link: https://patch.msgid.link/20251129091455.757724-1-b.sachdev1904@gmail.com
    Signed-off-by: Christian Brauner 

commit 0c82fdbbbfbee878a0a5e884ea5f31dd16138f0d
Author: Bhavik Sachdev 
Date:   Sat Nov 29 14:41:22 2025 +0530

    selftests: statmount: tests for STATMOUNT_BY_FD
    
    Add tests for STATMOUNT_BY_FD flag, which adds support for passing a
    file descriptors to statmount(). The fd can also be on a "unmounted"
    mount (mount unmounted with MNT_DETACH), we also include tests for that.
    
    Co-developed-by: Andrei Vagin 
    Signed-off-by: Andrei Vagin 
    Signed-off-by: Bhavik Sachdev 
    Link: https://patch.msgid.link/20251129091455.757724-4-b.sachdev1904@gmail.com
    Signed-off-by: Christian Brauner 

commit 0e5032237ee5530147fbdf33134297e1490d5ec3
Author: Bhavik Sachdev 
Date:   Sat Nov 29 14:41:21 2025 +0530

    statmount: accept fd as a parameter
    
    Extend `struct mnt_id_req` to take in a fd and introduce STATMOUNT_BY_FD
    flag. When a valid fd is provided and STATMOUNT_BY_FD is set, statmount
    will return mountinfo about the mount the fd is on.
    
    This even works for "unmounted" mounts (mounts that have been umounted
    using umount2(mnt, MNT_DETACH)), if you have access to a file descriptor
    on that mount. These "umounted" mounts will have no mountpoint and no
    valid mount namespace. Hence, we unset the STATMOUNT_MNT_POINT and
    STATMOUNT_MNT_NS_ID in statmount.mask for "unmounted" mounts.
    
    In case of STATMOUNT_BY_FD, given that we already have access to an fd
    on the mount, accessing mount information without a capability check
    seems fine because of the following reasons:
    
    - All fs related information is available via fstatfs() without any
      capability check.
    - Mount information is also available via /proc/pid/mountinfo (without
      any capability check).
    - Given that we have access to a fd on the mount which tells us that we
      had access to the mount at some point (or someone that had access gave
      us the fd). So, we should be able to access mount info.
    
    Co-developed-by: Pavel Tikhomirov 
    Signed-off-by: Pavel Tikhomirov 
    Signed-off-by: Bhavik Sachdev 
    Link: https://patch.msgid.link/20251129091455.757724-3-b.sachdev1904@gmail.com
    Acked-by: Andrei Vagin 
    Signed-off-by: Christian Brauner 

commit fccbe38a5d06dbe44bcd89196fe1d2c2272a1f4a
Author: Bhavik Sachdev 
Date:   Sat Nov 29 14:41:20 2025 +0530

    statmount: permission check should return EPERM
    
    Currently, statmount() returns ENOENT when caller is not CAP_SYS_ADMIN
    in the user namespace owner of target mount namespace. This should be
    EPERM instead.
    
    Suggested-by: Miklos Szeredi 
    Signed-off-by: Bhavik Sachdev 
    Link: https://patch.msgid.link/20251129091455.757724-2-b.sachdev1904@gmail.com
    Signed-off-by: Christian Brauner 

commit 5334fc280735dcf5882511a219a99b5759e14870
Merge: 8f0b4cce4481fb 268eaa8ab4ace3
Author: Christian Brauner 
Date:   Thu Dec 4 11:04:24 2025 +0100

    Merge patch series "Allow inlining C helpers into Rust when using LTO"
    
    Alice Ryhl  says:
    
    This patch series adds __rust_helper to every single rust helper.
    
    These changes were generated by adding __rust_helper and running
    ClangFormat. Unrelated formatting changes were removed manually.
    
    Why is __rust_helper needed?
    ============================
    
    Currently, C helpers cannot be inlined into Rust even when using LTO
    because LLVM detects slightly different options on the codegen units.
    
    * LLVM doesn't want to inline functions compiled with
      `-fno-delete-null-pointer-checks` with code compiled without. The C
      CGUs all have this enabled and Rust CGUs don't. Inlining is okay since
      this is one of the hardening features that does not change the ABI,
      and we shouldn't have null pointer dereferences in these helpers.
    
    * LLVM doesn't want to inline functions with different list of builtins. C
      side has `-fno-builtin-wcslen`; `wcslen` is not a Rust builtin, so
      they should be compatible, but LLVM does not perform inlining due to
      attributes mismatch.
    
    * clang and Rust doesn't have the exact target string. Clang generates
      `+cmov,+cx8,+fxsr` but Rust doesn't enable them (in fact, Rust will
      complain if `-Ctarget-feature=+cmov,+cx8,+fxsr` is used). x86-64
      always enable these features, so they are in fact the same target
      string, but LLVM doesn't understand this and so inlining is inhibited.
      This can be bypassed with `--ignore-tti-inline-compatible`, but this
      is a hidden option.
    
    (This analysis was written by Gary Guo.)
    
    How is this fixed?
    ==================
    
    To fix this we need to add __always_inline to all helpers when compiling
    with LTO. However, it should not be added when running bindgen as
    bindgen will ignore functions marked inline. To achieve this, we are
    using a #define called __rust_helper that is defined differently
    depending on whether bindgen is running or not.
    
    Note that __rust_helper is currently always #defined to nothing.
    Changing it to __always_inline will happen separately in another patch
    series.
    
    * patches from https://patch.msgid.link/20251202-define-rust-helper-v1-0-a2e13cbc17a6@google.com:
      rust: poll: add __rust_helper to helpers
      rust: pid_namespace: add __rust_helper to helpers
      rust: fs: add __rust_helper to helpers
    
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-0-a2e13cbc17a6@google.com
    Signed-off-by: Christian Brauner 

commit 268eaa8ab4ace3f3bc80fd91bb461e6b6c9da29e
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:53 2025 +0000

    rust: poll: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-29-a2e13cbc17a6@google.com
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Signed-off-by: Christian Brauner 

commit fc73d4b4d281c24fe8ffbde2919e039cf8162bef
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:51 2025 +0000

    rust: pid_namespace: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-27-a2e13cbc17a6@google.com
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Signed-off-by: Christian Brauner 

commit b266a39eb2b484fc49866588bd70337b73839a69
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:42 2025 +0000

    rust: fs: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-18-a2e13cbc17a6@google.com
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Signed-off-by: Christian Brauner 

commit 1c921baf4212f68fc4eecc4de4ceffc7fb965265
Merge: 8f0b4cce4481fb 64a989dbd144e0
Author: Christian Brauner 
Date:   Fri Dec 5 10:02:18 2025 +0100

    Merge patch series "Allow knfsd to use atomic_open()"
    
    Benjamin Coddington  says:
    
    We have workloads that will benefit from allowing knfsd to use atomic_open()
    in the open/create path.  There are two benefits; the first is the original
    matter of correctness: when knfsd must perform both vfs_create() and
    vfs_open() in series there can be races or error results that cause the
    caller to receive unexpected results.  The second benefit is that for some
    network filesystems, we can reduce the number of remote round-trip
    operations by using a single atomic_open() path which provides a performance
    benefit.
    
    I've implemented this with the simplest possible change - by modifying
    dentry_create() which has a single user: knfsd.  The changes cause us to
    insert ourselves part-way into the previously closed/static atomic_open()
    path, so I expect VFS folks to have some good ideas about potentially
    superior approaches.
    
    Previous work on commit fb70bf124b05 ("NFSD: Instantiate a struct file when
    creating a regular NFSv4 file") addressed most of the atomicity issues, but
    there are still a few gaps on network filesystems.
    
    The problem was noticed on a test that did open O_CREAT with mode 0 which
    will succeed in creating the file but will return -EACCES from vfs_open() -
    this specific test is mentioned in 3/3 description.
    
    Also, Trond notes that independently of the permissions issues, atomic_open
    also solves races in open(O_CREAT|O_TRUNC). The NFS client now uses it for
    both NFSv4 and NFSv3 for that reason.  See commit 7c6c5249f061 "NFS: add
    atomic_open for NFSv3 to handle O_TRUNC correctly."
    
    * patches from https://patch.msgid.link/cover.1764259052.git.bcodding@hammerspace.com:
      VFS/knfsd: Teach dentry_create() to use atomic_open()
      VFS: Prepare atomic_open() for dentry_create()
      VFS: move dentry_create() from fs/open.c to fs/namei.c
    
    Link: https://patch.msgid.link/cover.1764259052.git.bcodding@hammerspace.com
    Signed-off-by: Christian Brauner 

commit 64a989dbd144e0622371396461b11335459692d2
Author: Benjamin Coddington 
Date:   Thu Nov 27 11:02:05 2025 -0500

    VFS/knfsd: Teach dentry_create() to use atomic_open()
    
    While knfsd offers combined exclusive create and open results to clients,
    on some filesystems those results may not be atomic.  This behavior can be
    observed.  For example, an open O_CREAT with mode 0 will succeed in creating
    the file but unexpectedly return -EACCES from vfs_open().
    
    Additionally reducing the number of remote RPC calls required for O_CREAT
    on network filesystem provides a performance benefit in the open path.
    
    Teach knfsd's helper dentry_create() to use atomic_open() for filesystems
    that support it.  The previously const @path is passed up to atomic_open()
    and may be modified depending on whether an existing entry was found or if
    the atomic_open() returned an error and consumed the passed-in dentry.
    
    Signed-off-by: Benjamin Coddington 
    Link: https://patch.msgid.link/8e449bfb64ab055abb9fd82641a171531415a88c.1764259052.git.bcodding@hammerspace.com
    Reviewed-by: Jeff Layton 
    Reviewed-by: Chuck Lever 
    Signed-off-by: Christian Brauner 

commit 36411554e8895feb4197a3ddd19259c84cbf0511
Author: Benjamin Coddington 
Date:   Thu Nov 27 11:02:04 2025 -0500

    VFS: Prepare atomic_open() for dentry_create()
    
    The next patch allows dentry_create() to call atomic_open(), but it does
    not have fabricated nameidata.  Let atomic_open() take a path instead.
    
    Since atomic_open() currently takes a nameidata of which it only uses the
    path and the flags, and flags are only used to update open_flags, then the
    flag update can happen before calling atomic_open(). Then, only the path
    needs be passed to atomic_open() rather than the whole nameidata.  This
    makes it easier for dentry_create() To call atomic_open().
    
    Signed-off-by: Benjamin Coddington 
    Link: https://patch.msgid.link/e8c1d2ca28de4a972d37e78599502108148fe17d.1764259052.git.bcodding@hammerspace.com
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit 977de00dfcf87e8d95f55dfc247955dc2f9da14d
Author: Benjamin Coddington 
Date:   Thu Nov 27 11:02:03 2025 -0500

    VFS: move dentry_create() from fs/open.c to fs/namei.c
    
    To prepare knfsd's helper dentry_create(), move it to namei.c so that it
    can access static functions within.  Callers of dentry_create() can be
    viewed as being mostly done with lookup, but still need to perform a few
    final checks.  In order to use atomic_open() we want dentry_create() to
    be able to access:
    
            - vfs_prepare_mode
            - may_o_create
            - atomic_open
    
    .. all of which have static declarations.
    
    Signed-off-by: Benjamin Coddington 
    Link: https://patch.msgid.link/42deec53a50e1676e5501f8f1e17967d47b83681.1764259052.git.bcodding@hammerspace.com
    Reviewed-by: Jeff Layton 
    Signed-off-by: Christian Brauner 

commit 8d0d27a79eae720e3625a149c4b3fa0ba8325300
Author: Marcus Folkesson 
Date:   Mon Dec 15 10:46:49 2025 +0100

    dt-bindings: display: sitronix,st7571: add example for SPI
    
    Add example for using st7571 with SPI.
    
    Signed-off-by: Marcus Folkesson 
    Link: https://patch.msgid.link/20251215-st7571-split-v3-7-d5f3205c3138@gmail.com
    Signed-off-by: Javier Martinez Canillas 

commit 052039e3fe51bc1cbe700d5af9be009fb985cfd2
Author: Marcus Folkesson 
Date:   Mon Dec 15 10:46:48 2025 +0100

    drm/sitronix/st7571-spi: add support for SPI interface
    
    Add support for ST7561/ST7571 connected to SPI bus.
    
    Reviewed-by: Javier Martinez Canillas 
    Signed-off-by: Marcus Folkesson 
    Link: https://patch.msgid.link/20251215-st7571-split-v3-6-d5f3205c3138@gmail.com
    Signed-off-by: Javier Martinez Canillas 

commit b362de167daf2f1e42a6d5ea2d4e51e8d9d031fd
Author: Marcus Folkesson 
Date:   Mon Dec 15 10:46:47 2025 +0100

    drm/sitronix/st7571: split up the driver into a common and an i2c part
    
    Split up the driver to make it possible to add support for hw interfaces
    other than I2C.
    
    Reviewed-by: Javier Martinez Canillas 
    Signed-off-by: Marcus Folkesson 
    Link: https://patch.msgid.link/20251215-st7571-split-v3-5-d5f3205c3138@gmail.com
    Signed-off-by: Javier Martinez Canillas 

commit b0c20d827e7773555d999638eac23e53dd358f4f
Author: Marcus Folkesson 
Date:   Mon Dec 15 10:46:46 2025 +0100

    drm/sitronix/st7571-i2c: make probe independent of hw interface
    
    Create an interface independent layer for the probe function. This is to
    make it possible to add support for other interfaces.
    
    Reviewed-by: Javier Martinez Canillas 
    Signed-off-by: Marcus Folkesson 
    Link: https://patch.msgid.link/20251215-st7571-split-v3-4-d5f3205c3138@gmail.com
    Signed-off-by: Javier Martinez Canillas 

commit d93a4354686b9a43d9f825a6859abba334b7ec86
Author: Marcus Folkesson 
Date:   Mon Dec 15 10:46:45 2025 +0100

    drm/sitronix/st7571-i2c: move common structures to st7571.h
    
    Move all structures that will be common for all interfaces (SPI/I2C) to
    a separate header file.
    
    Reviewed-by: Javier Martinez Canillas 
    Signed-off-by: Marcus Folkesson 
    Link: https://patch.msgid.link/20251215-st7571-split-v3-3-d5f3205c3138@gmail.com
    Signed-off-by: Javier Martinez Canillas 

commit bc12f3e1a84f16444aa33f0ee9edf829cf9ba796
Author: Marcus Folkesson 
Date:   Mon Dec 15 10:46:44 2025 +0100

    drm/sitronix/st7571-i2c: add 'struct device' to st7571_device
    
    Keep a copy of the device structure instead of referring to i2c_client.
    This is a preparation step to separate the generic part from all i2c
    stuff.
    
    Reviewed-by: Javier Martinez Canillas 
    Signed-off-by: Marcus Folkesson 
    Link: https://patch.msgid.link/20251215-st7571-split-v3-2-d5f3205c3138@gmail.com
    Signed-off-by: Javier Martinez Canillas 

commit c497e5979084224330cf1e789cc9fdce9097c5f2
Author: Marcus Folkesson 
Date:   Mon Dec 15 10:46:43 2025 +0100

    drm/sitronix/st7571-i2c: rename 'struct drm_device' in st7571_device
    
    Rename st7571_device.dev to st7571_device.drm in preparation to
    introduce a 'struct device' member to this structure.
    
    Reviewed-by: Javier Martinez Canillas 
    Signed-off-by: Marcus Folkesson 
    Link: https://patch.msgid.link/20251215-st7571-split-v3-1-d5f3205c3138@gmail.com
    Signed-off-by: Javier Martinez Canillas 

commit abd9bb7ad5bdbbf76316013cda3812c2719a0210
Author: Ondrej Jirman 
Date:   Mon Nov 24 19:47:01 2025 -0800

    arm64: dts: rockchip: Add accelerometer sensor to Pinephone Pro
    
    Pinephone Pro uses mpu6500 according to the schematic. This was verified
    via `monitor-sensor --accel`. While rotating the device, the output was
    correct (eg. when it was face up, left edge was up, vertical, etc.).
    
    Co-developed-by: Martijn Braam 
    Signed-off-by: Martijn Braam 
    Co-developed-by: Kamil Trzciński 
    Signed-off-by: Kamil Trzciński 
    Signed-off-by: Ondrej Jirman 
    Signed-off-by: Rudraksha Gupta 
    Reviewed-by: Pavel Machek 
    Link: https://patch.msgid.link/20251124-ppp_light_accel_mag_vol-down-v5-2-f9a10a0a50eb@gmail.com
    Signed-off-by: Heiko Stuebner 

commit 2cc30da80a28a8a5d1337230c3586eb2f9580120
Author: Torsten Duwe 
Date:   Mon Nov 24 19:30:56 2025 +0100

    arm64: dts: rockchip: Enable SPDIF audio on Rock 5 ITX
    
    The Rock5 ITX has an S/PDIF (TOSLINK) socket in its I/O-shield, whose
    TX signal is wired to GPIO4 C1. Activate SPDIF TX unit 1 and select
    the proper pinmux (M2).
    
    Signed-off-by: Torsten Duwe 
    Link: https://patch.msgid.link/20251124183056.B853068C4E@verein.lst.de
    Signed-off-by: Heiko Stuebner 

commit 47b5d3697f6b9f53a0db30a99656a2f8f919e246
Author: Alexey Charkov 
Date:   Tue Dec 2 13:54:31 2025 +0400

    arm64: dts: rockchip: Add overlay for the PCIe slot on RK3576 EVB1
    
    Rockchip RK3576 EVB1 has an onboard PCIe slot (PCIe 2.1, x4 mechanically,
    x1 electrically), but it shares pins and PHY with the only USB3 Type-A
    port.
    
    There is a physical switch next to the slot to transfer respective pins
    connection from the USB3 port to the PCIe slot, but apart from flipping
    the switch one must also disable the USB3 host controller to prevent it
    from claiming the PHY before the PCIe slot can become usable.
    
    Add an overlay to disable the USB3 host port and instead enable the
    PCIe slot, along with its pin configs. The physical switch must still be
    flipped to the "ON - PCIe1" position for this to work.
    
    Signed-off-by: Alexey Charkov 
    Link: https://patch.msgid.link/20251202-evb1-pcie1-v2-1-810693b1b72f@gmail.com
    Signed-off-by: Heiko Stuebner 

commit e74470cf3101da79666f20186c9406192223e9a8
Author: Alex Bee 
Date:   Fri Sep 5 16:19:25 2025 +0000

    ARM: dts: rockchip: Add vdec node for RK3288
    
    RK3288 contains a Rockchip VDEC block that only support HEVC
    decoding. Add a vdec node for this.
    
    Signed-off-by: Alex Bee 
    Signed-off-by: Jonas Karlman 
    Link: https://patch.msgid.link/20250905161942.3759717-8-jonas@kwiboo.se
    Signed-off-by: Heiko Stuebner 

commit 4fb352df14de4b5277f38a9874f7c19cf641ae4d
Author: Rafael J. Wysocki 
Date:   Fri Dec 5 16:24:05 2025 +0100

    PM: sleep: Do not flag runtime PM workqueue as freezable
    
    Till now, the runtime PM workqueue has been flagged as freezable, so it
    does not process work items during system-wide PM transitions like
    system suspend and resume.  The original reason to do that was to
    reduce the likelihood of runtime PM getting in the way of system-wide
    PM processing, but now it is mostly an optimization because (1) runtime
    suspend of devices is prevented by bumping up their runtime PM usage
    counters in device_prepare() and (2) device drivers are expected to
    disable runtime PM for the devices handled by them before they embark
    on system-wide PM activities that may change the state of the hardware
    or otherwise interfere with runtime PM.  However, it prevents
    asynchronous runtime resume of devices from working during system-wide
    PM transitions, which is confusing because synchronous runtime resume
    is not prevented at the same time, and it also sometimes turns out to
    be problematic.
    
    For example, it has been reported that blk_queue_enter() may deadlock
    during a system suspend transition because of the pm_request_resume()
    usage in it [1].  It may also deadlock during a system resume transition
    in a similar way.  That happens because the asynchronous runtime resume
    of the given device is not processed due to the freezing of the runtime
    PM workqueue.  While it may be better to address this particular issue
    in the block layer, the very presence of it means that similar problems
    may be expected to occur elsewhere.
    
    For this reason, remove the WQ_FREEZABLE flag from the runtime PM
    workqueue and make device_suspend_late() use the generic variant of
    pm_runtime_disable() that will carry out runtime PM of the device
    synchronously if there is pending resume work for it.
    
    Also update the comment before the pm_runtime_disable() call in
    device_suspend_late(), to document the fact that the runtime PM
    should not be expected to work for the device until the end of
    device_resume_early(), and update the related documentation.
    
    This change may, even though it is not expected to, uncover some
    latent issues related to queuing up asynchronous runtime resume
    work items during system suspend or hibernation.  However, they
    should be limited to the interference between runtime resume and
    system-wide PM callbacks in the cases when device drivers start
    to handle system-wide PM before disabling runtime PM as described
    above.
    
    Link: https://lore.kernel.org/linux-pm/20251126101636.205505-2-yang.yang@vivo.com/
    Signed-off-by: Rafael J. Wysocki 
    Reviewed-by: Ulf Hansson 
    Link: https://patch.msgid.link/12794222.O9o76ZdvQC@rafael.j.wysocki

commit d8921e42a1983024227c0e64253ea96b25a1ae9a
Author: Lad Prabhakar 
Date:   Tue Nov 25 22:14:20 2025 +0000

    clk: renesas: r9a09g056: Add entries for the RSPIs
    
    Add clock and reset entries for the RSPI IPs.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251125221420.288809-4-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 94cdeca6a17a3e2ba617c8a03e17d989de005a20
Author: Lad Prabhakar 
Date:   Tue Nov 25 22:14:19 2025 +0000

    clk: renesas: r9a09g056: Add entries for ICU
    
    Add clock and reset entries for the ICU IP block.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251125221420.288809-3-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 75faf216112a69cdbf415fa057abbe7ed2ae6da6
Author: Lad Prabhakar 
Date:   Tue Nov 25 22:14:18 2025 +0000

    clk: renesas: r9a09g056: Add entries for the DMACs
    
    Add clock and reset entries for the DMAC IPs.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251125221420.288809-2-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit e68100006bedc361197e6cb9da1cced87ee3e5b0
Author: Lad Prabhakar 
Date:   Fri Nov 21 09:08:53 2025 +0000

    clk: renesas: r9a09g077: Propagate rate changes through mux parents
    
    Enable CLK_SET_RATE_PARENT for mux clocks so that rate changes can properly
    propagate to their parent clocks. Several clocks in the R9A09G077 CPG tree
    depend on upstream PLL or divider outputs being recalculated when a child
    requests a new frequency. Without this flag, rate adjustments stop at the
    mux layer, leaving parent rates unchanged and preventing the clock tree
    from converging on the intended values.
    
    Set the flag in DEF_MUX to ensure that parent clocks participate in rate
    negotiation, which is required for correct operation of the display and
    peripheral related clocks being added for RZ/T2H support.
    
    Fixes: 065fe720eec6e ("clk: renesas: Add support for R9A09G077 SoC")
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251121090853.5220-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit ec74d201e697503d8460597e2c3cc5ade222c4fb
Author: Lad Prabhakar 
Date:   Mon Nov 17 20:56:27 2025 +0000

    clk: renesas: r9a09g077: Add xSPI core and module clocks
    
    Add core clocks and module clock definitions required by the xSPI
    (Expanded SPI) IP on the R9A09G077 SoC.
    
    Define the new SCKCR fields FSELXSPI0/FSELXSPI1 and DIVSEL_XSPI0/1 and
    add two new core clocks XSPI_CLK0 and XSPI_CLK1. The xSPI block uses
    PCLKH as its bus clock (use as module clock parent) while the operation
    clock (XSPI_CLKn) is derived from PLL4. To support this arrangement
    provide mux/div selectors and divider tables for the supported
    XSPI operating rates.
    
    Add CLK_TYPE_RZT2H_FSELXSPI to implement a custom divider/mux clock
    where the determine_rate() callback enforces the hardware constraint:
    when the parent output is 600MHz only dividers 8 and 16 are valid,
    whereas for 800MHz operation the full divider set (6,8,16,32,64) may
    be used. The custom determine_rate() picks the best parent/divider pair
    to match the requested rate and programs the appropriate SCKCR fields.
    
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251117205627.39376-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit eede457b4c823d183e1c95d7286ca08614baa36a
Merge: f9451374dcfdfe 7c0b8360a4e289
Author: Geert Uytterhoeven 
Date:   Mon Dec 15 11:48:57 2025 +0100

    Merge tag 'renesas-r9a09g077-dt-binding-defs-tag5' into renesas-clk-for-v6.20
    
    Renesas RZ/T2H and RZ/N2H XSPI Clock DT Binding Definitions
    
    XSPI Clock DT binding definitions for the Renesas RZ/T2H (R9A09G077) and
    RZ/N2H (R9A09G087) SoCs, shared by driver and DT source files.

commit f9451374dcfdfe669ee55b58ee6c11e8638980e4
Author: Chris Brandt 
Date:   Fri Nov 14 14:45:29 2025 -0500

    clk: renesas: rzg2l: Select correct div round macro
    
    Variable foutvco_rate is an unsigned long, not an unsigned long long.
    
    Cc: stable@kernel.org
    Reported-by: Geert Uytterhoeven 
    Closes: https://lore.kernel.org/CAMuHMdVf7dSeqAhtyxDCFuCheQRzwS-8996Rr2Ntui21uiBgdA@mail.gmail.com
    Fixes: dabf72b85f29 ("clk: renesas: rzg2l: Fix FOUTPOSTDIV clk")
    Signed-off-by: Chris Brandt 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251114194529.3304361-1-chris.brandt@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit a00655d98cd885472c311f01dff3e668d1288d0a
Author: Chris Brandt 
Date:   Fri Nov 14 14:37:11 2025 -0500

    clk: renesas: rzg2l: Fix intin variable size
    
    INTIN is a 12-bit register value, so u8 is too small.
    
    Fixes: 1561380ee72f ("clk: renesas: rzg2l: Add FOUTPOSTDIV clk support")
    Cc: stable@vger.kernel.org
    Reported-by: Hugo Villeneuve 
    Closes: https://lore.kernel.org/20251107113058.f334957151d1a8dd94dd740b@hugovil.com
    Signed-off-by: Chris Brandt 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251114193711.3277912-1-chris.brandt@renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 6ea91acf0f67a7e6dd1e899955346e00778d7b0f
Author: Biju Das 
Date:   Tue Sep 16 16:02:44 2025 +0100

    arm64: dts: renesas: r9a09g047e57-smarc: Enable USB3HOST
    
    Enable USB3.2 Gen2 Host controller(a.k.a USB3HOST) on the RZ/G3E SMARC EVK
    platform.
    
    Signed-off-by: Biju Das 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20250916150255.4231-9-biju.das.jz@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 87c83a27b80062d0ca5dca408b7a7db42027a582
Author: Biju Das 
Date:   Tue Sep 16 16:02:43 2025 +0100

    arm64: dts: renesas: r9a09g047: Add USB3 PHY/Host nodes
    
    Add USB3 PHY/Host nodes to RZ/G3E ("R9A09G047") SoC DTSI.
    
    Signed-off-by: Biju Das 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20250916150255.4231-8-biju.das.jz@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 01a23e376e2afd578c5ecb8c8263e107de3240b9
Author: Robin Murphy 
Date:   Tue May 27 13:55:39 2025 +0100

    arm64: dts: morello: Add CMN PMU
    
    Although CMN-Skeena is mildly modified for the Morello hardware
    architecture, it still identifies itself as CMN-600 r3p1. Since
    there are also no documented changes to its PMU functionality,
    we can make the PMU accessible via the standard CMN-600 binding.
    In general, PMU registers are non-functional on CMN Fast Models,
    so this is only meaningful for the real SDP hardware.
    
    Signed-off-by: Robin Murphy 
    Acked-by: Vincenzo Frascino 
    Message-Id: 
    Signed-off-by: Sudeep Holla 

commit 78b74136affd7aabb7a578b86e26099872861841
Author: Ally Heev 
Date:   Wed Nov 5 19:37:52 2025 +0530

    firmware: arm_scmi: Fix uninitialized pointers with __free attr
    
    Uninitialized pointers with `__free` attribute can cause undefined
    behaviour as the memory assigned(randomly) to the pointer is freed
    automatically when the pointer goes out of scope
    
    arm doesn't have any bugs related to this as of now, but
    it is better to initialize and assign pointers with `__free` attr
    in one statement to ensure proper scope-based cleanup
    
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
    Signed-off-by: Ally Heev 
    Reviewed-by: Cristian Marussi 
    Message-Id: <20251105-aheev-uninitialized-free-attr-arm-v1-1-f7b6cb5d3361@gmail.com>
    Signed-off-by: Sudeep Holla 

commit f183b1dda4fc0348c4016f6289588d5853ab7936
Author: Sudeep Holla 
Date:   Thu Oct 16 10:41:11 2025 +0100

    firmware: arm_ffa: Tie FF-A version checks to specific features
    
    The FF-A driver currently performs loose comparisons when checking the
    supported FF-A feature, which can inadvertently treat future or
    intermediate revisions as compatible.
    
    Replace generic `version {>,<} FFA_VERSION_1_*` pattern checks with
    feature-specific macros that clearly express which functionality
    depends on FF-A versioning.
    
    This improves readability and future maintainability by tying each
    feature (e.g. GET_COUNT_ONLY, size/UUID/exec state in responses) to
    explicit version requirements instead of relying on generic version
    comparisons. This improves robustness and clarity as the FF-A
    specification evolves.
    
    No functional change, only improves code readability.
    
    Message-Id: <20251016094111.946236-1-sudeep.holla@arm.com>
    Signed-off-by: Sudeep Holla 

commit 9fda364cb78c8b9e1abe4029f877300c94655742
Author: Haoxiang Li 
Date:   Wed Dec 10 11:16:56 2025 +0800

    firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
    
    ffa_init() maps the Rx/Tx buffers via ffa_rxtx_map() but on the
    partition setup failure path it never unmaps them.
    
    Add the missing ffa_rxtx_unmap() call in the error path so that
    the Rx/Tx buffers are properly released before freeing the backing
    pages.
    
    Signed-off-by: Haoxiang Li 
    Message-Id: <20251210031656.56194-1-lihaoxiang@isrc.iscas.ac.cn>
    Signed-off-by: Sudeep Holla 

commit 0df70ce615c78f8d16d96ef18960f365200fc5d6
Author: Jani Nikula 
Date:   Mon Dec 15 11:27:06 2025 +0200

    drm/gem: fix build for mm_get_unmapped_area() call after backmerge
    
    Commit 9ac09bb9feac ("mm: consistently use current->mm in
    mm_get_unmapped_area()") upstream dropped a parameter from
    mm_get_unmapped_area() while commit 99bda20d6d4c ("drm/gem: Introduce
    drm_gem_get_unmapped_area() fop") in drm-misc-next added a new user.
    
    Drop the extra parameter from the call.
    
    Fixes: 7f790dd21a93 ("Merge drm/drm-next into drm-misc-next")
    Cc: Maxime Ripard 
    Reviewed-by: Francois Dugast 
    Reviewed-by: Badal Nilawar 
    Link: https://patch.msgid.link/20251215092706.3218018-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 4aca7e92023cac5018b4053bae324450f884c937
Author: Chuan Liu 
Date:   Fri Sep 19 13:59:01 2025 +0800

    clk: amlogic: remove potentially unsafe flags from S4 video clocks
    
    The video clocks enci, encp, vdac and hdmitx share the same clock
    source. Adding CLK_SET_RATE_PARENT to the mux may unintentionally change
    the shared parent clock, which could affect other video clocks.
    
    Signed-off-by: Chuan Liu 
    Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-3-fe223161fb3f@amlogic.com
    Signed-off-by: Jerome Brunet 

commit c78c9dbe2bb950939b3a1fe171c40cfba4f8c520
Author: Chuan Liu 
Date:   Fri Sep 19 13:59:00 2025 +0800

    clk: amlogic: add video-related clocks for S4 SoC
    
    Add video encoder, demodulator and CVBS clocks.
    
    Signed-off-by: Chuan Liu 
    Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-2-fe223161fb3f@amlogic.com
    Signed-off-by: Jerome Brunet 

commit 29c4f32095d01ec570b05141d20945f22d50da26
Author: Chuan Liu 
Date:   Fri Sep 19 13:58:59 2025 +0800

    dt-bindings: clock: add video clock indices for Amlogic S4 SoC
    
    Add indices for video encoder, demodulator and CVBS clocks.
    
    Acked-by: Rob Herring (Arm) 
    Acked-by: Krzysztof Kozlowski 
    Acked-by: Conor Dooley 
    Signed-off-by: Chuan Liu 
    Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-1-fe223161fb3f@amlogic.com
    Signed-off-by: Jerome Brunet 

commit fab4d651b592b3ebc836e410ae27b8b832a5bff2
Author: Jian Hu 
Date:   Fri Dec 12 10:26:18 2025 +0800

    clk: meson: t7: add t7 clock peripherals controller driver
    
    Add Peripheral clock controller driver for the Amlogic T7 SoC family.
    
    Signed-off-by: Jian Hu 
    Link: https://lore.kernel.org/r/20251212022619.3072132-6-jian.hu@amlogic.com
    Signed-off-by: Jerome Brunet 

commit 140f074c312702a1837136e024f5df1309e37251
Author: Jian Hu 
Date:   Fri Dec 12 10:26:17 2025 +0800

    clk: meson: t7: add support for the T7 SoC PLL clock
    
    Add PLL clock controller driver for the Amlogic T7 SoC family.
    
    Signed-off-by: Jian Hu 
    Link: https://lore.kernel.org/r/20251212022619.3072132-5-jian.hu@amlogic.com
    Signed-off-by: Jerome Brunet 

commit b4156204e0f5d66e5943d9836e42d01d6e5e12fb
Author: Jian Hu 
Date:   Fri Dec 12 10:26:16 2025 +0800

    dt-bindings: clock: add Amlogic T7 peripherals clock controller
    
    Add DT bindings for the peripheral clock controller of the Amlogic T7
    SoC family.
    
    Signed-off-by: Jian Hu 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://lore.kernel.org/r/20251212022619.3072132-4-jian.hu@amlogic.com
    Signed-off-by: Jerome Brunet 

commit f5d473e96fe0ae46a2da79c96b3623b3be37b5a0
Author: Jian Hu 
Date:   Fri Dec 12 10:26:15 2025 +0800

    dt-bindings: clock: add Amlogic T7 SCMI clock controller
    
    Add DT bindings for the SCMI clock controller of the Amlogic T7 SoC family.
    
    Signed-off-by: Jian Hu 
    Acked-by: Rob Herring (Arm) 
    Link: https://lore.kernel.org/r/20251212022619.3072132-3-jian.hu@amlogic.com
    Signed-off-by: Jerome Brunet 

commit 5437753728ac40a0410f3a4c6c471d0ab9919ceb
Author: Jian Hu 
Date:   Fri Dec 12 10:26:14 2025 +0800

    dt-bindings: clock: add Amlogic T7 PLL clock controller
    
    Add DT bindings for the PLL clock controller of the Amlogic T7 SoC family.
    
    Signed-off-by: Jian Hu 
    Reviewed-by: Conor Dooley 
    Link: https://lore.kernel.org/r/20251212022619.3072132-2-jian.hu@amlogic.com
    Signed-off-by: Jerome Brunet 

commit 63cb6443c7a798467e0a8b154dd8f1f950a5d1d5
Author: Jani Nikula 
Date:   Fri Dec 12 16:14:09 2025 +0200

    drm/i915/display: group and sort the parent interface wrappers better
    
    Aligning with the parent interface struct definitions, also group and
    sort the parent interface wrappers to improve clarity on where to add
    new stuff.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/b61af1d33d0448cd904cccccb2714f0d07d85b07.1765548786.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 3b8fdaed8f57c93e7e6827328eeb05d4e770bba1
Author: Jani Nikula 
Date:   Fri Dec 12 16:14:08 2025 +0200

    drm/xe: sort parent interface initialization
    
    Sort the member initializers to improve clarity.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/0af6654afb2174c472f75710cea328eb443f4b73.1765548786.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 29551bf191005a6a61f2406e85b5017ccfbf221a
Author: Jani Nikula 
Date:   Fri Dec 12 16:14:07 2025 +0200

    drm/i915: sort parent interface initialization
    
    Sort the member initializers to improve clarity. Separate individual
    function initializers with a blank line in between.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/7f5deefc30703006bc2daa1ce1093a4947f6e049.1765548786.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 07d46ada28813393af461d9b739995d00368b93b
Author: Jani Nikula 
Date:   Fri Dec 12 16:14:06 2025 +0200

    drm/intel: sort parent interface struct definitions and members
    
    Sort the parent interface struct definitions and members to improve
    clarity on where to add new stuff.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/7f2e45d030e78928ebc8cf0a6d0fb47a3aa13c48.1765548786.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 8c88104ac6b8bdf5099a22165ff79348f84a0d77
Author: Jani Nikula 
Date:   Fri Dec 12 16:14:05 2025 +0200

    drm/intel: group individual funcs in parent interface
    
    There are a handful of function pointers that don't really warrant a
    dedicated sub-struct for the functionality. Group all of them together
    in a single anonymous sub-struct.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/4305b09a93ce2c8ca83bf1fbb3cc7ef5a29d1567.1765548786.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 4e899d9b4ea7798debb0c24e201a27fe2694d222
Author: Jani Nikula 
Date:   Fri Dec 12 16:14:04 2025 +0200

    drm/intel: fix parent interface kernel-doc
    
    Fix some typos in the kernel-doc.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/b293e25aa00418908e67576e8adcab325319705a.1765548786.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 7f790dd21a931c61167f7bdc327aecf2cebad327
Merge: d8684ae1cdcf84 8f0b4cce4481fb
Author: Maxime Ripard 
Date:   Mon Dec 15 09:27:39 2025 +0100

    Merge drm/drm-next into drm-misc-next
    
    Let's kickstart the v6.20 (7.0?) release cycle.
    
    Signed-off-by: Maxime Ripard 

commit 43cb48478719707b3ab115112b9e0168292c8270
Author: Lad Prabhakar 
Date:   Wed Oct 15 16:07:28 2025 +0100

    arm64: defconfig: Drop duplicate CONFIG_OMAP_USB2 entry
    
    CONFIG_OMAP_USB2 is already enabled as a module in the default defconfig
    since commit 8a703a728a745 ("arm64: defconfig: Enable USB2 PHY Driver").
    Remove the duplicate entry to fix the following warning:
    
        arch/arm64/configs/defconfig:1705:warning: override: reassigning to symbol OMAP_USB2
    
    Fixes: 91fe3315cdf9f ("arm64: defconfig: Enable missing AMD/Xilinx drivers")
    Signed-off-by: Lad Prabhakar 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://lore.kernel.org/r/20251015150728.118296-1-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Michal Simek 

commit 41de0de8033e75fa672df677088aec21fa50afeb
Author: Michal Simek 
Date:   Wed Sep 17 10:50:52 2025 +0200

    arm64: defconfig: Enable missing AMD/Xilinx drivers
    
    Over years number of upstream drivers have grown for AMD/Xilinx SOCs
    (ZynqMP, Versal, Versal NET) but they are not enabled by default in
    defconfig that's why enable all drivers for these SOCs including USB5744
    on board USB hub available on Kria ZynqMP based SOMs and Carrier Cards.
    
    Signed-off-by: Michal Simek 
    Link: https://lore.kernel.org/r/457c3a128e300241afd20da693d1d80a35d1ece6.1758099050.git.michal.simek@amd.com

commit 138cb5c1bc67058542ea83109dd6e2d0d2451528
Author: Neal Frager 
Date:   Tue Nov 11 07:05:55 2025 +0000

    arm64: dts: xilinx: fix zynqmp opp-table-cpu
    
    Since the following commit, the zynqmp clk driver uses the common
    divider_round_rate() when determining the appropriate clock divider for a
    requested clock frequency:
    https://github.com/torvalds/linux/commit/1fe15be1fb613534ecbac5f8c3f8744f757d237d
    
    This means that all the calculations will be in kHz when determining the
    appropriate clock divider for a given cpufreq request. The problem with this
    is that the zynqmp.dtsi and zynqmp-clk-ccf.dtsi files have frequency
    definitions in Hz, so when dividing requested values in kHz, errors can occur
    with the rounding.
    
    For example, the current pss_ref_clk frequency is 33333333 Hz which generates
    a cpufreq parent clock frequency of 1199999988 Hz which is the same as the
    highest opp-table-cpu frequency in the zynqmp.dtsi.
    
    But if a user requests the value 1199999 kHz as recommended in the available
    frequencies:
    
    root@zynqmp:/sys/kernel/tracing# cat /sys/devices/system/cpu/cpufreq/policy0/scaling_available_frequencies
    299999 399999 599999 1199999
    root@zynqmp:/ # echo 1199999 > /sys/devices/system/cpu/cpufreq/policy0/scaling_setspeed
    
    The calculation will be:
    1199999988 / 1199999000 = 1.000001
    
    This will get rounded up to a divider value of 2 giving the following result.
    
    root@zynqmp:/ # cat /sys/devices/system/cpu/cpufreq/policy0/cpuinfo_cur_freq
    599999
    
    Also, if a user tries to work around this calculation by using any larger
    values, it still will not fix the problem because the driver will use the
    largest opp in kHz which leads to the same calculation error.
    
    User requests 1200000
    root@zynqmp:/ # echo 1200000 > /sys/devices/system/cpu/cpufreq/policy0/scaling_setspeed
    
    Driver converts any value greater than 1199999 to the largest opp which is
    1199999 and then calculates the divider value with the same calculation.
    
    The calculation will still be:
    1199999988 / 1199999000 = 1.000001
    
    This will get rounded up to a divider value of 2 giving the following result.
    
    root@zynqmp:/ # cat /sys/devices/system/cpu/cpufreq/policy0/cpuinfo_cur_freq
    599999
    
    This means there is no way to configure the zynqmp for the fastest opp using
    the current dtsi files.
    
    To fix this issue, this patch updates the zynqmp opp-table-cpu and
    pss_ref_clk, so the clock rates are calculated correctly.
    
    root@zynqmp:/sys/kernel/tracing# cat /sys/devices/system/cpu/cpufreq/policy0/scaling_available_frequencies
    300000 400000 600000 1200000
    root@zynqmp:/ # echo 1200000 > /sys/devices/system/cpu/cpufreq/policy0/scaling_setspeed
    root@zynqmp:/ # cat /sys/devices/system/cpu/cpufreq/policy0/cpuinfo_cur_freq
    1200000
    
    Signed-off-by: Neal Frager 
    Acked-by: Jay Buddhabhatti 
    Signed-off-by: Michal Simek 
    Link: https://lore.kernel.org/r/20251111070555.1169130-1-neal.frager@amd.com

commit dc5aef63c037562500723d0041e863a092997124
Author: Marco Crivellari 
Date:   Tue Nov 4 11:39:42 2025 +0100

    soc/xilinx: replace use of system_unbound_wq with system_dfl_wq
    
    Currently if a user enqueue a work item using schedule_delayed_work() the
    used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
    WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
    schedule_work() that is using system_wq and queue_work(), that makes use
    again of WORK_CPU_UNBOUND.
    
    This lack of consistentcy cannot be addressed without refactoring the API.
    
    This patch continues the effort to refactor worqueue APIs, which has begun
    with the change introducing new workqueues and a new alloc_workqueue flag:
    
    commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq")
    commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
    
    system_dfl_wq should be the default workqueue so as not to enforce
    locality constraints for random work whenever it's not required.
    
    The old system_unbound_wq will be kept for a few release cycles.
    
    Suggested-by: Tejun Heo 
    Signed-off-by: Marco Crivellari 
    Signed-off-by: Michal Simek 
    Link: https://lore.kernel.org/r/20251104103942.96647-1-marco.crivellari@suse.com

commit 801c03446205af4c94736b4892805c10697e6f61
Author: Harini T 
Date:   Thu Jan 30 17:32:33 2025 +0530

    dt-bindings: watchdog: xlnx,versal-wwdt: Add optional power-domains property
    
    AMD/Xilinx Versal Window Watchdog Timer has its own power domain, so add
    an optional property to describe it.
    
    Signed-off-by: Harini T 
    Acked-by: Conor Dooley 
    Signed-off-by: Michal Simek 
    Link: https://lore.kernel.org/r/20250130120233.742879-1-harini.t@amd.com

commit 796010d53f992efcb549381d4055d5ff7226154c
Author: Conor Dooley 
Date:   Wed Oct 1 19:31:13 2025 +0100

    arm64: dts: xilinx: add soc-specific spi compatibles for zynqmp/versal-net
    
    Unlike zynq, which has a specific compatible for the Cadence spi
    controller, zynqmp and versal-net do not have specific compatibles.
    In order to "encourage" people to use soc-specific compatibles for new
    devices using this IP, add specific compatibles for these devices, with
    a fallback to the existing compatible for the r1p6 version of the IP so
    that there will be no functional change.
    
    Signed-off-by: Conor Dooley 
    Acked-by: Michal Simek 
    Link: https://lore.kernel.org/r/20251001-cheesy-shucking-c55431bbcae3@spud
    Signed-off-by: Michal Simek 

commit f474c70065e14bac928716100eebfcfb15e1a725
Author: Niklas Cassel 
Date:   Tue Dec 2 13:21:36 2025 +0100

    ata: libata: Allow more quirks
    
    We have currently used up 30 out of the 32-bits in the struct ata_device
    struct member quirks. Thus, it is only possible to add two more quirks.
    
    Change the struct ata_device struct member quirks from an unsigned int to
    an u64.
    
    Doing this core level change now, will make it easier for us now, as we
    will not need to also do core level changes once the final two bits are
    used as well.
    
    Signed-off-by: Niklas Cassel 
    Reviewed-by: Martin K. Petersen 
    Reviewed-by: Damien Le Moal 
    Signed-off-by: Damien Le Moal 

commit ad50d922f4857ca58dbda172d5d6356ab53e7845
Author: Niklas Cassel 
Date:   Tue Dec 2 13:21:35 2025 +0100

    ata: libata: Add libata.force parameter max_sec
    
    Add a new libata.force parameter called max_sec.
    
    The parameter can take an arbitrary value using the format:
    libata.force=max_sec=
    
    e.g. libata.force=max_sec=8191
    or
    libata.force=max_sec=2048
    
    This will allow the user to set an arbitrary maximum command size
    (dev->max_sectors) using libata.force.
    
    We cannot remove the existing libata.force parameters "max_sec_128" and
    "max_sec_1024", as these are a part of the exising user facing API.
    
    Signed-off-by: Niklas Cassel 
    Reviewed-by: Martin K. Petersen 
    Reviewed-by: Damien Le Moal 
    Signed-off-by: Damien Le Moal 

commit 45c4c5a6156a5ab450a7595dd1c8985e2d459403
Author: Niklas Cassel 
Date:   Tue Dec 2 13:21:34 2025 +0100

    ata: libata: Add support to parse equal sign in libata.force
    
    Currently, no libata.force parameter supports an arbitrary value.
    
    All allowed values, e.g. udma/16, udma/25, udma/33, udma/44, udma/66,
    udma/100, udma/133 have hardcoded entries in the force_tbl table.
    
    Add code to allow a libata.force param with the format
    libata.force=param=param_value, where param_value can be an arbitrary
    value.
    
    This code will be used in a follow up commit.
    
    Signed-off-by: Niklas Cassel 
    Reviewed-by: Martin K. Petersen 
    Reviewed-by: Damien Le Moal 
    Signed-off-by: Damien Le Moal 

commit dfd975151df9f8ec69e14466f18c4b4af9823f88
Author: Niklas Cassel 
Date:   Tue Dec 2 13:21:33 2025 +0100

    ata: libata: Change libata.force to use the generic ATA_QUIRK_MAX_SEC quirk
    
    Modify the existing libata.force parameters "max_sec_128" and
    "max_sec_1024" to use the generic ATA_QUIRK_MAX_SEC quirk rather than
    individual quirks.
    
    This also allows us to remove the individual quirks ATA_QUIRK_MAX_SEC_128
    and ATA_QUIRK_MAX_SEC_1024.
    
    Signed-off-by: Niklas Cassel 
    Reviewed-by: Martin K. Petersen 
    Reviewed-by: Damien Le Moal 
    Signed-off-by: Damien Le Moal 

commit 873abd72b8b54443ac7783d207be7333289f8287
Author: Niklas Cassel 
Date:   Tue Dec 2 13:21:32 2025 +0100

    ata: libata: Add ata_force_get_fe_for_dev() helper
    
    Add ata_force_get_fe_for_dev() helper to get the struct ata_force_ent for
    a struct ata_device.
    
    Use the helper in ata_force_quirks().
    The helper will also be used in follow up commits.
    
    No functional change intended.
    
    Signed-off-by: Niklas Cassel 
    Reviewed-by: Martin K. Petersen 
    Reviewed-by: Damien Le Moal 
    Signed-off-by: Damien Le Moal 

commit 59b7bb3d48333889adb1dd2aac3ab0cf26714390
Author: Niklas Cassel 
Date:   Tue Dec 2 13:21:31 2025 +0100

    ata: libata: Add ATA_QUIRK_MAX_SEC and convert all device quirks
    
    Add a new quirk ATA_QUIRK_MAX_SEC, which has a separate table with device
    specific values.
    
    Convert all existing ATA_QUIRK_MAX_SEC_XXX device quirks in
    __ata_dev_quirks to the new format.
    
    Quirks ATA_QUIRK_MAX_SEC_128 and ATA_QUIRK_MAX_SEC_1024 cannot be removed
    yet, since they are also used by libata.force, which functionally, is a
    separate user of the quirks. The quirks will be removed once all users
    have been converted to use the new format.
    
    The quirk ATA_QUIRK_MAX_SEC_8191 can be removed since it has no equivalent
    libata.force parameter.
    
    Signed-off-by: Niklas Cassel 
    Reviewed-by: Damien Le Moal 
    Reviewed-by: Martin K. Petersen 
    Signed-off-by: Damien Le Moal 

commit 151cabd140322205e27dae5c4bbf261ede0056e3
Author: Henry Tseng 
Date:   Mon Dec 1 17:46:22 2025 +0800

    ata: libata: avoid long timeouts on hot-unplugged SATA DAS
    
    When a SATA DAS enclosure is connected behind a Thunderbolt PCIe
    switch, hot-unplugging the whole enclosure causes pciehp to tear down
    the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and
    START STOP UNIT for the disks.
    
    libata still queues these commands and the AHCI driver tries to access
    the HBA registers even though the PCI channel is already offline. This
    results in a series of timeouts and error recovery attempts, e.g.:
    
      [  824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
      [  891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec)
      [  902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec)
      [  934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec)
      [  936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
          Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
      ...
      [ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec)
      [ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec)
      [ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec)
      [ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
          Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
    
    With this patch applied, the same hot-unplug looks like:
    
      [   59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
      [   60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
          Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
      ...
      [   60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
          Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
    
    In this test setup with two disks, the hot-unplug sequence shrinks from
    about 226 seconds (~3.8 minutes) between the Link Down event and the
    last SYNCHRONIZE CACHE failure to under a second. Without this patch the
    total delay grows roughly with the number of disks, because each disk
    gets its own SYNCHRONIZE CACHE and qc timeout series.
    
    If the underlying PCI device is already gone, these commands cannot
    succeed anyway. Avoid issuing them by introducing
    ata_adapter_is_online(), which checks pci_channel_offline() for
    PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL,
    causing the SCSI layer to fail new commands with DID_BAD_TARGET
    immediately, and from ata_qc_issue() to bail out before touching the
    HBA registers.
    
    Since such failures would otherwise trigger libata error handling,
    ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler().
    When the adapter is offline, libata skips ap->ops->error_handler(ap) and
    completes error handling using the existing path, rather than running
    a full EH sequence against a dead adapter.
    
    With this change, SYNCHRONIZE CACHE and START STOP UNIT commands
    issued during hot-unplug fail quickly once the PCI channel is offline,
    without qc timeout spam or long libata EH delays.
    
    Suggested-by: Damien Le Moal 
    Signed-off-by: Henry Tseng 
    Signed-off-by: Damien Le Moal 

commit e8fe098170142416f11a0cae201254cd779f7fe9
Author: Niklas Cassel 
Date:   Thu Dec 4 14:18:04 2025 +0100

    ata: libata-scsi: Remove superfluous local_irq_save()
    
    Commit 28a3fc2295a7 ("libata: implement ZBC IN translation") added
    ata_scsi_report_zones_complete(). Since the beginning, this function
    has disabled IRQs on the local CPU using local_irq_save().
    
    qc->complete_fn is always called with ap->lock held, and the ap->lock
    is always taken using spin_lock_irq*().
    
    Thus, this local_irq_save() is superfluous and can be removed.
    
    Signed-off-by: Niklas Cassel 
    Reviewed-by: Hannes Reinecke 
    Signed-off-by: Damien Le Moal 

commit 527a521029c3edd38fb9fc96cd58e3fd7393d28e
Author: Ingo Molnar 
Date:   Tue Dec 2 10:35:06 2025 +0100

    sched/fair: Sort out 'blocked_load*' namespace noise
    
    There's three layers of logic in the scheduler that
    deal with 'has_blocked' (load) handling of the NOHZ code:
    
      (1) nohz.has_blocked,
      (2) rq->has_blocked_load, deal with NOHZ idle balancing,
      (3) and cfs_rq_has_blocked(), which is part of the layer
          that is passing the SMP load-balancing signal to the
          NOHZ layers.
    
    The 'has_blocked' and 'has_blocked_load' names are used
    in a mixed fashion, sometimes within the same function.
    
    Standardize on 'has_blocked_load' to make it all easy
    to read and easy to grep.
    
    No change in functionality.
    
    Suggested-by: Vincent Guittot 
    Signed-off-by: Ingo Molnar 
    Reviewed-by: Vincent Guittot 
    Cc: Peter Zijlstra 
    Cc: Frederic Weisbecker 
    Cc: Shrikanth Hegde 
    Link: https://patch.msgid.link/aS6yvxyc3JfMxxQW@gmail.com

commit 5758e48eefaf111d7764d8f1c8b666140fe5fa27
Author: Ingo Molnar 
Date:   Tue Dec 2 16:10:32 2025 +0100

    sched/fair: Introduce and use the vruntime_cmp() and vruntime_op() wrappers for wrapped-signed aritmetics
    
    We have to be careful with vruntime comparisons and subtraction,
    due to the possibility of wrapping, so we have macros like:
    
       #define vruntime_gt(field, lse, rse) ({ (s64)((lse)->field - (rse)->field) > 0; })
    
    Which is used like this:
    
                    if (vruntime_gt(min_vruntime, se, rse))
                            se->min_vruntime = rse->min_vruntime;
    
    Replace this with an easier to read pattern that uses the regular
    arithmetics operators:
    
                    if (vruntime_cmp(se->min_vruntime, ">", rse->min_vruntime))
                            se->min_vruntime = rse->min_vruntime;
    
    Also replace vruntime subtractions with vruntime_op():
    
            -       delta = (s64)(sea->vruntime - seb->vruntime) +
            -               (s64)(cfs_rqb->zero_vruntime_fi - cfs_rqa->zero_vruntime_fi);
            +       delta = vruntime_op(sea->vruntime, "-", seb->vruntime) +
            +               vruntime_op(cfs_rqb->zero_vruntime_fi, "-", cfs_rqa->zero_vruntime_fi);
    
    In the vruntime_cmp() and vruntime_op() macros use Use __builtin_strcmp(),
    because of __HAVE_ARCH_STRCMP might turn off the compiler optimizations
    we rely on here to catch usage bugs.
    
    No change in functionality.
    
    Signed-off-by: Ingo Molnar 

commit dcbc9d3f0e594223275a18f7016001889ad35eff
Author: Ingo Molnar 
Date:   Tue Dec 2 16:09:23 2025 +0100

    sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper functions
    
    The ::avg_vruntime field is a  misnomer: it says it's an
    'average vruntime', but in reality it's the momentary sum
    of the weighted vruntimes of all queued tasks, which is
    at least a division away from being an average.
    
    This is clear from comments about the math of fair scheduling:
    
        * \Sum (v_i - v0) * w_i := cfs_rq->avg_vruntime
    
    This confusion is increased by the cfs_avg_vruntime() function,
    which does perform the division and returns a true average.
    
    The sum of all weighted vruntimes should be named thusly,
    so rename the field to ::sum_w_vruntime. (As arguably
    ::sum_weighted_vruntime would be a bit of a mouthful.)
    
    Understanding the scheduler is hard enough already, without
    extra layers of obfuscated naming. ;-)
    
    Also rename related helper functions:
    
      sum_vruntime_add()    => sum_w_vruntime_add()
      sum_vruntime_sub()    => sum_w_vruntime_sub()
      sum_vruntime_update() => sum_w_vruntime_update()
    
    With the notable exception of cfs_avg_vruntime(), which
    was named accurately.
    
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/20251201064647.1851919-7-mingo@kernel.org

commit 4ff674fa986c27ec8a0542479258c92d361a2566
Author: Ingo Molnar 
Date:   Wed Nov 26 12:09:16 2025 +0100

    sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight
    
    The ::avg_load field is a long-standing misnomer: it says it's an
    'average load', but in reality it's the momentary sum of the load
    of all currently runnable tasks. We'd have to also perform a
    division by nr_running (or use time-decay) to arrive at any sort
    of average value.
    
    This is clear from comments about the math of fair scheduling:
    
        *              \Sum w_i := cfs_rq->avg_load
    
    The sum of all weights is ... the sum of all weights, not
    the average of all weights.
    
    To make it doubly confusing, there's also an ::avg_load
    in the load-balancing struct sg_lb_stats, which *is* a
    true average.
    
    The second part of the field's name is a minor misnomer
    as well: it says 'load', and it is indeed a load_weight
    structure as it shares code with the load-balancer - but
    it's only in an SMP load-balancing context where
    load = weight, in the fair scheduling context the primary
    purpose is the weighting of different nice levels.
    
    So rename the field to ::sum_weight instead, which makes
    the terminology of the EEVDF math match up with our
    implementation of it:
    
        *              \Sum w_i := cfs_rq->sum_weight
    
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/20251201064647.1851919-6-mingo@kernel.org

commit 80390ead2080071cbd6f427ff8deb94d10a4a50f
Author: Ingo Molnar 
Date:   Wed Nov 26 05:31:28 2025 +0100

    sched/fair: Separate se->vlag from se->vprot
    
    There's no real space concerns here and keeping these fields
    in a union makes reading (and tracing) the scheduler code harder.
    
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/20251201064647.1851919-4-mingo@kernel.org

commit fb9a7458e508ef1beae8d80ee40c2cd1b5b45f3a
Author: Ingo Molnar 
Date:   Wed Nov 26 11:29:18 2025 +0100

    sched/fair: Clean up comments in 'struct cfs_rq'
    
     - Fix vertical alignment
     - Fix typos
     - Fix capitalization
    
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/20251201064647.1851919-3-mingo@kernel.org

commit 2b8c3d3dc9b1ee323e2982945088e3f5eebdf3dd
Author: Ingo Molnar 
Date:   Wed Nov 26 11:31:09 2025 +0100

    sched/fair: Join two #ifdef CONFIG_FAIR_GROUP_SCHED blocks
    
    Join two identical #ifdef blocks:
    
      #ifdef CONFIG_FAIR_GROUP_SCHED
      ...
      #endif
    
      #ifdef CONFIG_FAIR_GROUP_SCHED
      ...
      #endif
    
    Also mark nested #ifdef blocks in the usual fashion, to make
    it more apparent where in a nested hierarchy of #ifdefs we
    are at a glance.
    
    Signed-off-by: Ingo Molnar 
    Reviewed-by: Shrikanth Hegde 
    Link: https://patch.msgid.link/20251201064647.1851919-2-mingo@kernel.org

commit 7cd2bdb5501c2073efba9bd50cc8bc6dc6295317
Merge: 7445dfb5500637 aa30193af8873b
Author: Mark Brown 
Date:   Mon Dec 15 11:17:42 2025 +0900

    ASoC: Intel: catpt: IPC log improvements and code
    
    Merge series from Cezary Rojewski :
    
    Entire patchset provides no new features and does not alter the code
    from functional (user) perspective.
    
    The first two improve IPC-error logging 'mechanism' and align the
    catpt-driver with what's done in another Intel's driver: the avs-driver.
    In essence, no need to log the error in every function, let the common
    handler do so instead.
    
    The last three simplify the code, and fix some spacing issues.  All in
    all, we get better readability with lower LOC.

commit 4200f873c4c4c35befca288fd299a41f9544cece
Author: Iuliana Prodan 
Date:   Thu Dec 4 14:28:25 2025 +0200

    remoteproc: imx_dsp_rproc: Wait for suspend ACK only if WAIT_FW_CONFIRMATION is set
    
    The DSP suspend path currently waits unconditionally for a suspend ack
    from the firmware. This breaks firmwares that do not implement the
    mailbox-based CONFIRMATION handshake, as the DSP never responds and
    system suspend fails with -EBUSY.
    
    The driver already uses the WAIT_FW_CONFIRMATION flag to indicate that
    the firmware supports the CONFIRMATION handshake at boot. Apply the same
    logic during suspend: only send the suspend message and wait for the
    suspend ack when the firmware is expected to support it.
    
    Signed-off-by: Iuliana Prodan 
    Reviewed-by: Frank Li 
    Reviewed-by: Daniel Baluta 
    Link: https://lore.kernel.org/r/20251204122825.756106-3-iuliana.prodan@oss.nxp.com
    Signed-off-by: Mathieu Poirier 

commit 424f22b48ca38f2071c9dab6ac733f79542c98c5
Author: Iuliana Prodan 
Date:   Thu Dec 4 14:28:24 2025 +0200

    remoteproc: imx_dsp_rproc: Rename macro to reflect multiple contexts
    
    Rename WAIT_FW_READY to WAIT_FW_CONFIRMATION and FEATURE_DONT_WAIT_FW_READY
    to FEATURE_SKIP_FW_CONFIRMATION. This way, the term CONFIRMATION covers:
    - waiting for firmware to confirm it is ready to start;
    - waiting for any other confirmation from firmware.
    
    Signed-off-by: Iuliana Prodan 
    Reviewed-by: Frank Li 
    Reviewed-by: Daniel Baluta 
    Link: https://lore.kernel.org/r/20251204122825.756106-2-iuliana.prodan@oss.nxp.com
    Signed-off-by: Mathieu Poirier 

commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e
Author: Iuliana Prodan 
Date:   Thu Dec 4 14:28:23 2025 +0200

    remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized
    
    Firmwares that do not use mailbox communication (e.g., the hello_world
    sample) leave priv->tx_ch as NULL. The current suspend logic
    unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without
    an initialized TX channel.
    
    Detect the no_mailboxes case early and skip sending the suspend
    message. Instead, proceed directly to the runtime PM suspend path,
    which is the correct behavior for firmwares that cannot respond to
    mailbox requests.
    
    Signed-off-by: Iuliana Prodan 
    Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com
    Signed-off-by: Mathieu Poirier 

commit 70eaa8efaa4c6f5196c4151f865d29c5ec3e5004
Author: Soham Metha 
Date:   Wed Dec 3 23:33:37 2025 +0530

    dt-bindings: remoteproc: Fix dead link to Keystone DSP GPIO binding
    
    The old text binding 'gpio-dsp-keystone.txt' was replaced by a DT schema in
    commit aff0a1701b020c8e6b172f28828fd4f3e6eed41a
    ("dt-bindings: gpio: Convert ti,keystone-dsp-gpio to DT schema").
    
    Update the reference to point to the new file.
    
    Signed-off-by: Soham Metha 
    Acked-by: Krzysztof Kozlowski 
    Link: https://lore.kernel.org/r/20251203180337.50831-1-sohammetha01@gmail.com
    Signed-off-by: Mathieu Poirier 

commit 42023d4b6d2661a40ee2dcf7e1a3528a35c638ca
Author: Gui-Dong Han 
Date:   Wed Dec 3 01:49:48 2025 +0800

    rpmsg: core: fix race in driver_override_show() and use core helper
    
    The driver_override_show function reads the driver_override string
    without holding the device_lock. However, the store function modifies
    and frees the string while holding the device_lock. This creates a race
    condition where the string can be freed by the store function while
    being read by the show function, leading to a use-after-free.
    
    To fix this, replace the rpmsg_string_attr macro with explicit show and
    store functions. The new driver_override_store uses the standard
    driver_set_override helper. Since the introduction of
    driver_set_override, the comments in include/linux/rpmsg.h have stated
    that this helper must be used to set or clear driver_override, but the
    implementation was not updated until now.
    
    Because driver_set_override modifies and frees the string while holding
    the device_lock, the new driver_override_show now correctly holds the
    device_lock during the read operation to prevent the race.
    
    Additionally, since rpmsg_string_attr has only ever been used for
    driver_override, removing the macro simplifies the code.
    
    Fixes: 39e47767ec9b ("rpmsg: Add driver_override device attribute for rpmsg_device")
    Cc: stable@vger.kernel.org
    Signed-off-by: Gui-Dong Han 
    Link: https://lore.kernel.org/r/20251202174948.12693-1-hanguidong02@gmail.com
    Signed-off-by: Mathieu Poirier 

commit c38d8b66c82c585199e2ad67282295f21cfa489f
Author: Patrick Oppenlander 
Date:   Wed Oct 22 14:28:17 2025 +1100

    rpmsg: virtio: EPOLLOUT support
    
    Previously, polling an rpmsg endpoint (e.g. /dev/ttyRPMSGx) would
    generate EPOLLIN events but no EPOLLOUT events.
    
    Unfortunately, poll support means that we can no longer disable
    tx-complete interrupts as there is no way to know whether a poller is
    waiting in sendq, so we always need notifications.
    
    Signed-off-by: Patrick Oppenlander 
    Link: https://lore.kernel.org/r/20251022032817.320378-1-patrick.oppenlander@gmail.com
    Signed-off-by: Mathieu Poirier 

commit 2bb202416d33347102b12bbd1db4837fb6685617
Merge: 03d281f3847686 9e92c559d49d6f
Author: Mark Brown 
Date:   Mon Dec 15 10:20:04 2025 +0900

    Add support for MAX77675 device
    
    Merge series from Joan Na :
    
    MAX77675 regulator driver and device tree bindings

commit 7445dfb5500637a156f5f1d920d1705ac747b68e
Merge: 34bf40c2755636 e39011184f23de
Author: Mark Brown 
Date:   Mon Dec 15 10:10:39 2025 +0900

    ASoC: amd/sdw: Fix confusing cleanup.h
    
    Merge series from Krzysztof Kozlowski :
    
    cleanup.h coding style asks to avoid having constructors with redundant
    values (= NULL). On purpose, because it is just not making the code
    simpler. The constructor should be meaningful not just NULL.
    
    If you do not agree in declaration-in-place-of-use (fair!), then do not
    use cleanup.h. If you want to use cleanup.h, then please read cleanup.h
    before.

commit 34bf40c2755636309cbf6bba01ecd390ba6ede97
Merge: c5224b8a1ba52d 124f6155f3d97b
Author: Mark Brown 
Date:   Mon Dec 15 10:10:21 2025 +0900

    Add {24,32}-bit sample width support for RZ/G2L SSI
    
    Merge series from Biju :
    
    Add support for 24 and 32-bit sample format width for RZ/G2L SoCs. Apart
    from this, the patch series includes some code cleanups.

commit c5224b8a1ba52d70b3fc2548109bd04bbbc0c8a6
Merge: 81acbdc51bbbec 0bb160c92ad400
Author: Mark Brown 
Date:   Mon Dec 15 10:10:13 2025 +0900

    ASoC: qcom: Fix confusing cleanup.h
    
    Merge series from Krzysztof Kozlowski :
    
    Please, please stop ending cleanup.h patches for very simple code like:
    
      foo = kzalloc();
      kfree(foo);
      return;
    
    ... *if you do not intend to read cleanup.h*. These changes are making
    simple code not necessarily simpler. But worse, if you do not read
    cleanup.h then you introduce actually undesired, error-prone and wrong
    style of having constructors with redundant values (= NULL).
    
    This is actually worse code.
    
    If you do not agree in declaration-in-place-of-use (fair!), then do not
    use cleanup.h. If you want to use cleanup.h, then please read cleanup.h
    before.
    
    This is second mixup I see recently around Qualcomm files.

commit c20fce4ad137e2150b4b383750f86a36d929e36c
Merge: c73618541c68f4 fa08b566860bca
Author: Mark Brown 
Date:   Mon Dec 15 10:09:58 2025 +0900

    Add DMA support for RZ/T2H RSPI
    
    Merge series from Cosmin Tanislav :
    
    The DMA controller can be used to transfer data to and from the SPI
    controller without involving the CPU for each word of a SPI transfer.
    
    Add support for DMA mode, and do some other cleanups while touching the
    same code.

commit c73618541c68f4b3c9b40de3a0f926447a9a9e72
Merge: 403a4f3c27736f ba9b28652c75b0
Author: Mark Brown 
Date:   Mon Dec 15 10:09:50 2025 +0900

    Support ECSPI dynamic burst feature for DMA mode
    
    Merge series from Carlos Song :
    
    ECSPI has a low throughput because of no dynamic burst support, it
    transfers only one word per frame in DMA mode, causing SCLK stalls
    between words due to BURST_LENGTH updates.
    
    This patch set is to support ECSPI dynamic burst feature to help improve
    the ECSPI DMA mode performance.
    
    Performance test (spidev_test @10MHz, 4KB):
      Before: tx/rx ~6651.9 kbps
      After:  tx/rx ~9922.2 kbps (~50% improvement)
    
    For compatibility with slow SPI devices, add configurable word delay in
    DMA mode. When word delay is set, dynamic burst is disabled and
    BURST_LENGTH equals word length.
    
    Also support target DMA mode with enabled dynamic burst.
    
    ---
    Changes since v2:
    * Patch1~4: no change
    * Patch5: remove __counted_by from *dma_data, because spi_imx struct
      is allocated with a fixed memory in probe, flexible array is not
      suitable, so just remove it to avoid the build error. Also add
      review-by tag
    * Patch6: add review-by tag
    Changes since v1:
    * Patch1~3:
    * Add review-by tag
    * Patch4:
      * Add review-by tag
      * Improve patch commit log
    * Patch5:
      * Clean up tab instead of space for dma_tx_addr and dma_rx_addr
      * Add  __counted_by(dma_package_num) for dma_data_package *dma_data
      * Move temp and bytes_per_word to if()
      * Add comment for spi_imx_dma_rx_data_handle() and
        spi_imx_dma_tx_data_handle()
      * Use kzalloc instead of kmalloc(x, x | __GFP_ZERO)
      * Use sizeof(*temp) instead of BYTES_PER_32BITS_WORD in suitable place
      * Add comments and fix comments according to discussion
      * Propagate the error value of dma_mapping_error()
      * Use round_down() to replace DIV_ROUND_DOWN_ULL()
      * Improve transfer->error |= SPI_TRANS_FAIL_NO_START judgment for
        better readability
    * Patch6:
      * Improve patch commit log
      * Add READ_ONCE for spi_imx->target_aborted
      * Add comments for data length limit
      * Move data length limit to spi_imx_can_dma()
    
    Carlos Song (6):
      spi: imx: group spi_imx_dma_configure() with spi_imx_dma_transfer()
      spi: imx: introduce helper to clear DMA mode logic
      spi: imx: avoid dmaengine_terminate_all() on TX prep failure
      spi: imx: handle DMA submission errors with dma_submit_error()
      spi: imx: support dynamic burst length for ECSPI DMA mode
      spi: imx: enable DMA mode for target operation
    
     drivers/spi/spi-imx.c | 625 +++++++++++++++++++++++++++++++++++-------
     1 file changed, 519 insertions(+), 106 deletions(-)
    
    --
    2.34.1

commit 403a4f3c27736f7b2e8e28aa1ab64708b0bd6bcb
Merge: b884e34994ca41 fee876b2ec75dc
Author: Mark Brown 
Date:   Mon Dec 15 10:09:43 2025 +0900

    spi: stm32: Update for OSPI and QSPI drivers
    
    Merge series from Patrice Chotard :
    
    This serie applies the following updates on the spi-stm32-ospi and
    spi-stm32-qspi dirvers :
    
      _ Update FIFO accesses using u16 and u32 when possible instead of u8
        only to optimize throughput.
      _ Replace Transmit Complete and Transmit Error interrupt management by
        usage of read_poll_timeout_atomic() to optimize throughtput.
      _ Simplify Status Match interrupt check.
      _ Set DMA burst configuration dynamically.
    
    Signed-off-by: Patrice Chotard 
    ---
    Changes in v2:
    - Fix compilation error in stm32_ospi_wait_cmd()
    - Link to v1: https://lore.kernel.org/r/20251205-upstream_qspi_ospi_updates-v1-0-7e6c8b9f5141@foss.st.com
    
    ---
    Patrice Chotard (8):
          spi: stm32-ospi: Set DMA maxburst dynamically
          spi: stm32-ospi: Optimize FIFO accesses using u16 or u32
          spi: stm32-ospi: Remove CR_TCIE and CR_TEIE irq usage
          spi: stm32-ospi: Simplify SMIE interrupt test
          spi: stm32-qspi: Set DMA maxburst dynamically
          spi: stm32-qspi: Optimize FIFO accesses using u16 or u32
          spi: stm32-qspi: Remove CR_TCIE and CR_TEIE irq usage
          spi: stm32-qspi: Simplify SMIE interrupt test
    
     drivers/spi/spi-stm32-ospi.c | 107 +++++++++++++++++++++++++----------------
     drivers/spi/spi-stm32-qspi.c | 111 +++++++++++++++++++++++++------------------
     2 files changed, 132 insertions(+), 86 deletions(-)
    ---
    base-commit: 7d0a66e4bb9081d75c82ec4957c50034cb0ea449
    change-id: 20251205-upstream_qspi_ospi_updates-4faf7a3b098c
    
    Best regards,
    --
    Patrice Chotard 

commit b884e34994ca41f7b7819f3c41b78ff494787b27
Author: Carlos Song 
Date:   Wed Dec 10 18:50:01 2025 +0800

    spi: spi-fsl-lpspi: convert min_t() to simple min()
    
    Current min() has supported comparison by normal integer promotion rules,
    so explicit type casts or min_t() are not needed.
    
    Signed-off-by: Carlos Song 
    Reviewed-by: David Laight 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251210105001.3891776-1-carlos.song@nxp.com
    Signed-off-by: Mark Brown 

commit e6268db46c173b18e5b2f4fc0c8a5c0aaaee61ea
Author: Krzysztof Kozlowski 
Date:   Mon Dec 8 03:08:31 2025 +0100

    spi: virtio: Fix confusing cleanup.h syntax
    
    Initializing automatic __free variables to NULL without need (e.g.
    branches with different allocations), followed by actual allocation is
    in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251208020830.5225-2-krzysztof.kozlowski@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 9f0736a4e136a6eb61e0cf530ddc18ab6d816ba3
Author: Mark Brown 
Date:   Thu Dec 4 19:13:35 2025 +0000

    spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing
    
    The recent refactoring of where runtime PM is enabled done in commit
    f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to
    avoid imbalance") made the fact that when we do a pm_runtime_disable()
    in the error paths of probe() we can trigger a runtime disable which in
    turn results in duplicate clock disables.  This is particularly likely
    to happen when there is missing or broken DT description for the flashes
    attached to the controller.
    
    Early on in the probe function we do a pm_runtime_get_noresume() since
    the probe function leaves the device in a powered up state but in the
    error path we can't assume that PM is enabled so we also manually
    disable everything, including clocks. This means that when runtime PM is
    active both it and the probe function release the same reference to the
    main clock for the IP, triggering warnings from the clock subsystem:
    
    [    8.693719] clk:75:7 already disabled
    [    8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb
    ...
    [    8.694261]  clk_core_disable+0xa0/0xb4 (P)
    [    8.694272]  clk_disable+0x38/0x60
    [    8.694283]  cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi]
    [    8.694309]  platform_probe+0x5c/0xa4
    
    Dealing with this issue properly is complicated by the fact that we
    don't know if runtime PM is active so can't tell if it will disable the
    clocks or not.  We can, however, sidestep the issue for the flash
    descriptions by moving their parsing to when we parse the controller
    properties which also save us doing a bunch of setup which can never be
    used so let's do that.
    
    Reported-by: Francesco Dolcini 
    Closes: https://lore.kernel.org/r/20251201072844.GA6785@francesco-nb
    Signed-off-by: Mark Brown 
    Link: https://patch.msgid.link/20251204-spi-cadence-qspi-runtime-pm-imbalance-v2-1-10af9115d531@kernel.org
    Signed-off-by: Mark Brown 

commit cde4e63e847b4d41f017c2beb119c2668106a88a
Author: Gabor Juhos 
Date:   Sat Nov 29 11:29:27 2025 +0100

    spi: spi-qpic-snand: remove superfluous qcom_spi_set_read_loc() calls
    
    Before configuring the registers related to page read, both the
    qcom_spi_read_page_ecc() and the qcom_spi_read_page_oob() functions
    are calling qcom_spi_set_read_loc() to set the read location for the
    first codeword.
    
    However the qcom_spi_set_read_loc() function puts the passed value
    into the register write cache only, from where those gets written
    to the corresponding register later via DMA.
    
    Yet, the qcom_spi_set_read_loc() is also gets called within the
    internal loops, and during the first iteration the read location
    register values written by the initial call gets overwritten in
    the register cache.
    
    This means that the values written by the first calls are never
    getting used in practice, so remove the calls as those are
    superfluous.
    
    Signed-off-by: Gabor Juhos 
    Link: https://patch.msgid.link/20251129-qpic-snand-superfluous-readloc-v1-1-b84ca17095d9@gmail.com
    Signed-off-by: Mark Brown 

commit 781c3e71c94c80e1b33a7d84b970907dd32abc10
Author: Jonathan Marek 
Date:   Thu Nov 20 16:12:02 2025 -0500

    spi-geni-qcom: rework setup_fifo_params
    
    Update each register only if it changes.
    
    This also fixes the chipselect related registers not being changed when
    chipselect changes but not the mode.
    
    Signed-off-by: Jonathan Marek 
    Link: https://patch.msgid.link/20251120211204.24078-5-jonathan@marek.ca
    Signed-off-by: Mark Brown 

commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be
Author: Jonathan Marek 
Date:   Thu Nov 20 16:12:01 2025 -0500

    spi-geni-qcom: initialize mode related registers to 0
    
    setup_fifo_params assumes these will be zero, it won't write these
    registers if the initial mode is zero.
    
    Signed-off-by: Jonathan Marek 
    Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca
    Signed-off-by: Mark Brown 

commit fb2bbe3838728f572485706677590e4fc41eec5c
Author: Jonathan Marek 
Date:   Thu Nov 20 16:12:00 2025 -0500

    spi-geni-qcom: use xfer->bits_per_word for can_dma()
    
    mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word
    when can_dma() is called. Use the right value instead.
    
    Signed-off-by: Jonathan Marek 
    Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca
    Signed-off-by: Mark Brown 

commit 7ba2e0edb18b3ccee7339315be47080832a3c355
Author: Jonathan Marek 
Date:   Thu Nov 20 16:11:59 2025 -0500

    spi-geni-qcom: don't set max clock in setup_fifo_params
    
    setup_se_xfer() already sets the correct clock (xfer->speed_hz). Setting
    the clock to max_speed_hz here makes the driver change the clock rate
    between speed_hz and max_speed_hz for every message (if not equal),
    slowing it down significantly.
    
    Signed-off-by: Jonathan Marek 
    Link: https://patch.msgid.link/20251120211204.24078-2-jonathan@marek.ca
    Signed-off-by: Mark Brown 

commit b99181cdf9fa0247dda3ba1228b4578286ab7ecd
Author: Jonathan Marek 
Date:   Thu Nov 20 16:11:58 2025 -0500

    spi-geni-qcom: remove manual CS control
    
    The GPI_DMA mode already uses automatic CS control, to use automatic CS
    control for non-GPI case all that's needed is to set the FRAGMENTATION flag
    using the same logic as setup_gsi_xfer(). (note clearing SPI_TRANS_CFG's
    CS_TOGGLE bit enables automatic CS control, the comment was wrong)
    
    spi_geni_set_cs() is slow, so this is a big performance improvement.
    
    Signed-off-by: Jonathan Marek 
    Link: https://patch.msgid.link/20251120211204.24078-1-jonathan@marek.ca
    Signed-off-by: Mark Brown 

commit 28d21dfcea0121afec04451733a6c553fd319c8e
Author: Akif Ejaz 
Date:   Wed Dec 3 23:19:21 2025 +0500

    spi: cadence-qspi: Remove redundant pm_runtime_mark_last_busy call
    
    The pm_runtime_mark_last_busy() call is redundant in probe function
    as pm_runtime_put_autosuspend() already calls pm_runtime_mark_last_busy()
    internally to update the last access time of the device before queuing
    autosuspend.
    
    Remove the pm_runtime_mark_last_busy() call from the probe function.
    
    Tested on StarFive VisionFive 2 v1.2A board.
    
    Fixes: e1f2e77624db ("spi: cadence-qspi: Fix runtime PM imbalance in probe")
    
    Signed-off-by: Akif Ejaz 
    Link: https://patch.msgid.link/20251203181921.97171-1-akifejaz40@gmail.com
    Signed-off-by: Mark Brown 

commit e83ba2e698aafa052d0df82564f7c8cd777fd5c7
Author: Andy Shevchenko 
Date:   Sat Nov 29 16:07:04 2025 +0100

    spi: cadence-xspi: Replace OF/ACPI specifics by agnostic APIs
    
    Replace OF/ACPI specific call to get matched driver data with
    the agnostic one. This doesn't change functionality. While at
    it, add missing property.h include, and drop now unneeded of.h.
    
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20251129150704.3998301-1-andriy.shevchenko@linux.intel.com
    Signed-off-by: Mark Brown 

commit 6f9e4740e8591176eb90bb1dae95bbbb5c7d789e
Author: Andy Shevchenko 
Date:   Sat Nov 29 16:17:39 2025 +0100

    spi: cadence-xspi: Replace ACPI specifics by agnostic APIs
    
    Replace ACPI specific calls to get device property with the agnostic one.
    The code looses the direct dependency to the ACPI APIs and get cleaner.
    This doesn't change functionality.
    
    While at it, drop now unneeded acpi.h.
    
    Signed-off-by: Andy Shevchenko 
    Link: https://patch.msgid.link/20251129151739.3998668-1-andriy.shevchenko@linux.intel.com
    Signed-off-by: Mark Brown 

commit fee876b2ec75dcc18fdea154eae1f5bf14d82659
Author: Patrice Chotard 
Date:   Mon Dec 8 08:29:15 2025 +0100

    spi: stm32-qspi: Simplify SMIE interrupt test
    
    SR_SMF status bit can only be set if CR_SMIE was previously set,
    keep status bit check only.
    
    Signed-off-by: Patrice Chotard 
    Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-8-62526c9467dc@foss.st.com
    Signed-off-by: Mark Brown 

commit c5f76d888810bca2d46297a7b942e10bc8cc69dd
Author: Patrice Chotard 
Date:   Mon Dec 8 08:29:14 2025 +0100

    spi: stm32-qspi: Remove CR_TCIE and CR_TEIE irq usage
    
    Replace CR_TCIE and CR_TEIE irq usage by a read_poll_timeout_atomic() in
    stm32_qspi_wait_cmd(). It will reduce the time waiting for TCF or TEF flags
    to optimize throughput.
                                                    before          after
    average time spent in stm32_qspi_wait_cmd:      2615 ns         712 ns
    
    Signed-off-by: Patrice Chotard 
    Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-7-62526c9467dc@foss.st.com
    Signed-off-by: Mark Brown 

commit 1ca91281649547efa4be34584a304974c9601df1
Author: Patrice Chotard 
Date:   Mon Dec 8 08:29:13 2025 +0100

    spi: stm32-qspi: Optimize FIFO accesses using u16 or u32
    
    FIFO accesses uses u8 only for read/write.
    In order to optimize throughput, add u16 or u32 read/write
    accesses when possible.
    
    Running mtd_speedtest on a 4MB sNOR partition using a
    stm32mp257f-ev1 board gives the following results:
    
               before        after   gain
    Read :  5773 KiB/s  22170 KiB/s   384%
    Write:   796 KiB/s    890 KiB/s    12%
    
    Signed-off-by: Patrice Chotard 
    Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-6-62526c9467dc@foss.st.com
    Signed-off-by: Mark Brown 

commit 4ef80c71c62ab841db9b1a9d74ffe043c60f6222
Author: Patrice Chotard 
Date:   Mon Dec 8 08:29:12 2025 +0100

    spi: stm32-qspi: Set DMA maxburst dynamically
    
    Set src_maxburst and dst_maxburst dynamically from DMA
    capabilities.
    
    Signed-off-by: Patrice Chotard 
    Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-5-62526c9467dc@foss.st.com
    Signed-off-by: Mark Brown 

commit e2f0ea18e560e5fa6180f52dffe434525a0cf86b
Author: Patrice Chotard 
Date:   Mon Dec 8 08:29:11 2025 +0100

    spi: stm32-ospi: Simplify SMIE interrupt test
    
    SR_SMF status bit can only be set if CR_SMIE was previously set,
    keep status bit check only.
    
    Signed-off-by: Patrice Chotard 
    Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-4-62526c9467dc@foss.st.com
    Signed-off-by: Mark Brown 

commit f6ed06926b510f54a0817567ffd458194ed90bd6
Author: Patrice Chotard 
Date:   Mon Dec 8 08:29:10 2025 +0100

    spi: stm32-ospi: Remove CR_TCIE and CR_TEIE irq usage
    
    Replace CR_TCIE and CR_TEIE irq usage by a read_poll_timeout_atomic() in
    stm32_ospi_wait_cmd(). It will reduce the time waiting for TCF or TEF flags
    to optimize throughput.
    
                                               before     after
    average time spent in stm32_omi_wait_cmd:  5685 ns    923 ns
    
    Signed-off-by: Patrice Chotard 
    Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-3-62526c9467dc@foss.st.com
    Signed-off-by: Mark Brown 

commit cfe58ffc95a601988702df6f3462cb54dde467e9
Author: Patrice Chotard 
Date:   Mon Dec 8 08:29:09 2025 +0100

    spi: stm32-ospi: Optimize FIFO accesses using u16 or u32
    
    FIFO accesses uses u8 only for read/write.
    In order to optimize throughput, add u16 or u32 read/write
    accesses when possible.
    
    Running mtd_speedtest on a 4MB sNOR partition using a
    stm32mp257f-ev1 board gives the following results:
    
               before        after   gain
    Read :  5693 KiB/s  21139 KiB/s   371%
    Write:   765 KiB/s    910 KiB/s    19%
    
    Signed-off-by: Patrice Chotard 
    Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-2-62526c9467dc@foss.st.com
    Signed-off-by: Mark Brown 

commit e35a7607e05d59d35e937b80532ae93d1dd2493f
Author: Patrice Chotard 
Date:   Mon Dec 8 08:29:08 2025 +0100

    spi: stm32-ospi: Set DMA maxburst dynamically
    
    Set src_maxburst and dst_maxburst dynamically from DMA
    capabilities.
    
    Signed-off-by: Patrice Chotard 
    Link: https://patch.msgid.link/20251208-upstream_qspi_ospi_updates-v2-1-62526c9467dc@foss.st.com
    Signed-off-by: Mark Brown 

commit ba9b28652c75b07383e267328f1759195d5430f7
Author: Carlos Song 
Date:   Wed Dec 3 16:59:49 2025 +0800

    spi: imx: enable DMA mode for target operation
    
    Enable DMA mode for SPI IMX in target mode. Disable the word delay feature
    for target mode, because target mode should always keep high performance
    to make sure it can follow the master. Target mode continues to operate in
    dynamic burst mode.
    
    Signed-off-by: Carlos Song 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251203085949.2922166-7-carlos.song@nxp.com
    Signed-off-by: Mark Brown 

commit faa8e404ad8e686cb98c51dc507fdcacfb8020ce
Author: Carlos Song 
Date:   Wed Dec 3 16:59:48 2025 +0800

    spi: imx: support dynamic burst length for ECSPI DMA mode
    
    ECSPI transfers only one word per frame in DMA mode, causing SCLK stalls
    between words due to BURST_LENGTH updates, which significantly impacts
    performance.
    
    To improve throughput, configure BURST_LENGTH as large as possible (up to
    512 bytes per frame) instead of word length. This avoids delays between
    words. When transfer length is not 4-byte aligned, use bounce buffers to
    align data for DMA. TX uses aligned words for TXFIFO, while RX trims DMA
    buffer data after transfer completion.
    
    Introduce a new dma_package structure to store:
      1. BURST_LENGTH values for each DMA request
      2. Variables for DMA submission
      3. DMA transmission length and actual data length
    
    Handle three cases:
      - len <= 512 bytes: one package, BURST_LENGTH = len * 8 - 1
      - len > 512 and aligned: one package, BURST_LENGTH = max (512 bytes)
      - len > 512 and unaligned: two packages, second for tail data
    
    Performance test (spidev_test @10MHz, 4KB):
      Before: tx/rx ~6651.9 kbps
      After:  tx/rx ~9922.2 kbps (~50% improvement)
    
    For compatibility with slow SPI devices, add configurable word delay in
    DMA mode. When word delay is set, dynamic burst is disabled and
    BURST_LENGTH equals word length.
    
    Signed-off-by: Carlos Song 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251203085949.2922166-6-carlos.song@nxp.com
    Signed-off-by: Mark Brown 

commit a450c8b77f929f5f9f5236861761a8c5cab22023
Author: Carlos Song 
Date:   Wed Dec 3 16:59:47 2025 +0800

    spi: imx: handle DMA submission errors with dma_submit_error()
    
    Add error handling for DMA request submission by checking the return
    cookie with dma_submit_error(). This prevents propagating submission
    failures through the DMA transfer process, which could lead to
    unexpected behavior.
    
    Signed-off-by: Carlos Song 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251203085949.2922166-5-carlos.song@nxp.com
    Signed-off-by: Mark Brown 

commit a5f298581d454c5ea77c5fb6f4ee1bff61eb2b2c
Author: Carlos Song 
Date:   Wed Dec 3 16:59:46 2025 +0800

    spi: imx: avoid dmaengine_terminate_all() on TX prep failure
    
    If dmaengine_prep_slave_sg() fails, no descriptor is submitted to the TX
    channel and DMA is never started. Therefore, calling
    dmaengine_terminate_all() for the TX DMA channel is unnecessary.
    
    Signed-off-by: Carlos Song 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251203085949.2922166-4-carlos.song@nxp.com
    Signed-off-by: Mark Brown 

commit 5395bb7f7c361310d0f329c8169d2190809b05c1
Author: Carlos Song 
Date:   Wed Dec 3 16:59:45 2025 +0800

    spi: imx: introduce helper to clear DMA mode logic
    
    Add a helper function to handle clearing DMA mode, including getting the
    maximum watermark length and submitting the DMA request. This refactoring
    makes the code more concise and improves readability.
    No functional changes.
    
    Signed-off-by: Carlos Song 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251203085949.2922166-3-carlos.song@nxp.com
    Signed-off-by: Mark Brown 

commit c64f62b036aed30626cb30fa82d3ec4a13fa83df
Author: Carlos Song 
Date:   Wed Dec 3 16:59:44 2025 +0800

    spi: imx: group spi_imx_dma_configure() with spi_imx_dma_transfer()
    
    Relocate spi_imx_dma_configure() next to spi_imx_dma_transfer() so that
    all DMA-related functions are grouped together for better readability.
    No functional changes.
    
    Signed-off-by: Carlos Song 
    Reviewed-by: Frank Li 
    Link: https://patch.msgid.link/20251203085949.2922166-2-carlos.song@nxp.com
    Signed-off-by: Mark Brown 

commit fa08b566860bca8ebf9300090b85174c34de7ca5
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:27 2025 +0200

    spi: rzv2h-rspi: add support for DMA mode
    
    The DMA controller can be used to transfer data to and from the SPI
    controller without involving the CPU for each word of a SPI transfer.
    
    Add support for DMA mode.
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-12-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit 163345e356722e98ba57cd120787d6e991da7b1d
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:26 2025 +0200

    spi: dt-bindings: renesas,rzv2h-rspi: document optional support for DMA
    
    The IP supports using DMA for reading and writing data from the FIFO,
    document it.
    
    Signed-off-by: Cosmin Tanislav 
    Acked-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251201134229.600817-11-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit 1e5e10df8b9be71ca64435cbe7c96b189e5ee293
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:25 2025 +0200

    spi: rzv2h-rspi: split out PIO transfer
    
    In preparation for implementing DMA support, split out the PIO transfer
    code into its own function.
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-10-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit d49eea07de5851e1b8941ad6b6179be7ec36a986
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:24 2025 +0200

    spi: rzv2h-rspi: enable TX buffer empty interrupt
    
    In preparation for implementing DMA support, enable the transmit buffer
    empty interrupt, which is necessary for DMA to write more data to the
    FIFO.
    
    This does not affect the PIO mode as we do not even request the TX
    interrupt line.
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-9-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit a886baaaa6e12a9b7d5a9687d11d3b895f1b87c9
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:23 2025 +0200

    spi: rzv2h-rspi: set TX FIFO threshold to 0
    
    In PIO mode we send data word-by-word, and wait for the received data
    to be available after each sent word, making no use of the TX interrupt.
    
    In DMA mode, we need to set the RX and TX FIFO thresholds to 0, as
    described in the User Manual.
    
    In preparation for implementing DMA support, set TX FIFO threshold to 0,
    as RX FIFO threshold is already 0.
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-8-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit 6f9026b5a18acdf190d1622831b100aacfca0eb3
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:22 2025 +0200

    spi: rzv2h-rspi: set MUST_RX/MUST_TX
    
    In preparation for implementing DMA support, set MUST_RX and MUST_TX
    flags on the controller so that we always receive non-NULL buffers.
    
    The PIO mode already handles this manually by checking if rx_buf/tx_buf
    are set on the transfer, and doing a dummy read/write if not.
    
    DMA will not be able to implement this special handling, and although
    the SPI controller advertises support for transmit-only or receive-only
    transfers via SPCR's register TXMD bitfield, it does not seem to work.
    
    Remove the special handling for PIO and let the SPI controller core
    handle it.
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-7-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit 28b590bd4c6a051ec61cf286a46a8b14846e6fcf
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:21 2025 +0200

    spi: rzv2h-rspi: store RX interrupt in state
    
    In preparation for implementing DMA support, store the RX interrupt
    number in the private state, to allow disabling it during DMA.
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-6-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit b73ac782828f27c2217a17bd26aa8710769f032d
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:20 2025 +0200

    spi: rzv2h-rspi: use device-managed APIs
    
    Non-device-managed APIs were initially used here to avoid the buggy
    interaction between PM domains and device-managed actions.
    
    Commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()")
    fixed the interaction between PM domains and device-managed actions.
    
    Simplify the code by using device-managed actions to unregister the SPI
    controller and to assert and release the resets.
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-5-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit 218917659df165cff72439480929e68a6e127b55
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:19 2025 +0200

    spi: rzv2h-rspi: do not set SPI_TRANS_FAIL_IO
    
    Setting SPI_TRANS_FAIL_IO has no effect if the transfer completes in the
    current context, as it is only handled when .transfer_one() returns > 0,
    when the SPI core must wait for the SPI transfer to complete.
    
    Do not set SPI_TRANS_FAIL_IO as we either return an error or 0, since we
    do our own waiting.
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-4-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit 9e4830b35dc0d522f45e1ec3ee5b1ff1648afe1b
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:18 2025 +0200

    spi: rzv2h-rspi: remove call to spi_finalize_current_transfer()
    
    A call to spi_finalize_current_transfer() is only needed when the SPI
    transfer is completed outside of the current context, when the
    .transfer_one() implementation returns > 0.
    
    Since the SPI transfer is completed in the current context, and we
    return 0 from .transfer_one(), the SPI core assumes that the transfer
    has completed and it does not wait for the completion variable that
    would be set by a call to spi_finalize_current_transfer().
    
    Remove the call to spi_finalize_current_transfer().
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-3-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit fb0140774aff45b8dc326987cc1da89484ecb081
Author: Cosmin Tanislav 
Date:   Mon Dec 1 15:42:17 2025 +0200

    spi: rzv2h-rspi: fix rzv2h_rspi_transfer_one() indentation
    
    Add the missing space to align to open pararenthesis.
    
    Signed-off-by: Cosmin Tanislav 
    Link: https://patch.msgid.link/20251201134229.600817-2-cosmin-gabriel.tanislav.xa@renesas.com
    Signed-off-by: Mark Brown 

commit 03d281f384768610bf90697bce9e35d3d596de77
Author: Alice Ryhl 
Date:   Tue Dec 2 19:37:59 2025 +0000

    rust: regulator: add __rust_helper to helpers
    
    This is needed to inline these helpers into Rust code.
    
    Signed-off-by: Alice Ryhl 
    Link: https://patch.msgid.link/20251202-define-rust-helper-v1-35-a2e13cbc17a6@google.com
    Reviewed-by: Gary Guo 
    Reviewed-by: Boqun Feng 
    Signed-off-by: Mark Brown 

commit 9e92c559d49d6fb903af17a31a469aac51b1766d
Author: Joan Na 
Date:   Sun Dec 7 12:29:07 2025 +0900

    regulator: max77675: Add MAX77675 regulator driver
    
    Add support for the Maxim Integrated MAX77675 PMIC regulator.
    
    The MAX77675 is a compact, highly efficient SIMO (Single Inductor Multiple Output)
    power management IC that provides four programmable buck-boost switching regulators
    with only one inductor. It supports up to 700mA total output current and operates
    from a single-cell Li-ion battery.
    
    An integrated power-up sequencer and I2C interface allow flexible startup
    configuration and runtime control.
    
    Signed-off-by: Joan Na 
    Link: https://patch.msgid.link/20251207032907.4850-3-joan.na@analog.com
    Signed-off-by: Mark Brown 

commit 05a0fe8e43c876ffd2befb5a406d3baf3179b9fe
Author: Joan Na 
Date:   Sun Dec 7 12:29:06 2025 +0900

    regulator: dt-bindings: Add MAX77675 regulator
    
    Add device tree binding YAML schema for the Maxim MAX77675 PMIC regulator.
    
    Signed-off-by: Joan Na 
    Reviewed-by: Rob Herring (Arm) 
    Link: https://patch.msgid.link/20251207032907.4850-2-joan.na@analog.com
    Signed-off-by: Mark Brown 

commit 81acbdc51bbbec822a1525481f2f70677c47aee0
Author: Uwe Kleine-König 
Date:   Fri Dec 12 08:35:53 2025 +0100

    ASoC: sdw-mockup: Drop dummy remove function
    
    A remove callback is optional and having no such function has the same
    semantic as one returning zero (and other return values are effectively
    ignored).
    
    This allows to remove the remove function without replacement.
    
    Signed-off-by: Uwe Kleine-König 
    Link: https://patch.msgid.link/20251212073555.1065284-2-u.kleine-koenig@baylibre.com
    Signed-off-by: Mark Brown 

commit ae9ccaed3f6701ee0fe40ad919516e0aa0844f21
Author: Richard Fitzgerald 
Date:   Mon Dec 1 16:07:29 2025 +0000

    firmware: cs_dsp: Don't use __free() in cs_dsp_load() and cs_dsp_load_coeff()
    
    Replace the __free(kfree) in cs_dsp_load() and cs_dsp_load_coeff() with
    a kfree(buf) at the end of the function.
    
    The use of __free() can create new cleanup bugs that are difficult to spot
    because the defective code is idiomatically correct regular C. In these two
    functions the __free() was mixed with gotos, and also used the suspect
    declaration __free(kfree) = NULL;.
    
    The __free() did not do anything to simplify the code. There aren't any
    early returns after the pointer is set, and the __free() can be replaced by
    a kfree() at the end of the function.
    
    Signed-off-by: Richard Fitzgerald 
    Fixes: 900baa6e7bb0 ("firmware: cs_dsp: Remove redundant download buffer allocator")
    Link: https://patch.msgid.link/20251201160729.231867-1-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit a49e098be20063c91b673a674b8f0f92135448da
Author: Thorsten Blum 
Date:   Tue Dec 9 16:18:50 2025 +0100

    ASoC: codecs: wm0010: Replace cpu_to_be64 + le64_to_cpu with swab64
    
    Replace cpu_to_be64(le64_to_cpu()) with swab64() to simplify
    byte_swap_64().  No functional changes.
    
    Signed-off-by: Thorsten Blum 
    Link: https://patch.msgid.link/20251209151853.432518-1-thorsten.blum@linux.dev
    Signed-off-by: Mark Brown 

commit dfbbd3c04f0f782e83f8677749e2f02359ffd1b5
Author: Johan Hovold 
Date:   Wed Dec 3 11:55:42 2025 +0100

    ASoc: qcom: q6afe: use guards consistently
    
    A recent change switched to using guards for the port list lock but only
    modified two out of three functions where the lock is held.
    
    Convert also the third function for consistency while switching to a
    scoped guard in q6afe_port_get_from_id() for clarity.
    
    Signed-off-by: Johan Hovold 
    Link: https://patch.msgid.link/20251203105542.24765-3-johan@kernel.org
    Signed-off-by: Mark Brown 

commit 0c1db366642172e85ee98eeed7c127b80eb609a3
Author: Bartosz Golaszewski 
Date:   Fri Dec 5 10:05:34 2025 +0100

    ASoC: davinci-mcasp: remove unneeded #ifdef
    
    The enablement of the CONFIG_OF_GPIO switch has nothing to do with the
    "gpio-controller" property which may as well come from software nodes
    and GPIOLIB can still be enabled separately.
    
    This driver does not call any symbols from gpiolib-of.h so has no need
    to check this option at all. Just use the generic device property
    accessor.
    
    Signed-off-by: Bartosz Golaszewski 
    Link: https://patch.msgid.link/20251205090534.27845-1-bartosz.golaszewski@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 180cdb96e821e30528b02708b927c93daa0ed40b
Author: HariKrishna Sagala 
Date:   Fri Dec 12 10:14:09 2025 +0530

    ASoC: mediatek: mt8195: optimize property formatting error handling by using scnprintf()
    
    Replace snprintf() with scnprintf() when constructing the property
    and remove negative return error handling as scnprintf() returns the
    actual number of bytes written to buffer.
    
    snprintf() as defined by the C99 standard,returns the number of
    characters that *would have been* written if enough space were
    available.Use scnprintf() that returns the actual number of
    characters written.
    
    Link: https://github.com/KSPP/linux/issues/105
    Signed-off-by: HariKrishna Sagala 
    Link: https://patch.msgid.link/20251212044408.1286-2-hariconscious@gmail.com
    Signed-off-by: Mark Brown 

commit 7a9fa7fda93b7b3ae515f40f67bbf8e1d16337e8
Author: Richard Fitzgerald 
Date:   Tue Dec 2 11:34:25 2025 +0000

    firmware: cs_dsp: Remove __free() from cs_dsp_debugfs_string_read()
    
    Don't use __free(kfree) in cs_dsp_debugfs_string_read. Instead use
    normal kfree() to cleanup.
    
    The use of __free() can create new cleanup bugs that are difficult to spot
    because the defective code is idiomatically correct regular C. This
    function used the suspect declaration __free(kfree) = NULL;.
    
    The __free(kfree) didn't really do anything here. The function can be
    rearranged to avoid any need to return or goto within the code.
    
    Signed-off-by: Richard Fitzgerald 
    Fixes: 3045e29d248b ("firmware: cs_dsp: Append \n to debugfs string during read")
    Link: https://patch.msgid.link/20251202113425.413700-1-rf@opensource.cirrus.com
    Signed-off-by: Mark Brown 

commit 69927c13d5c5444f5f774e891fa5970ae1bac4b5
Author: Kuninori Morimoto 
Date:   Wed Dec 3 05:27:55 2025 +0000

    ASoC: mediatek: mt8189-nau8825: don't use card->dapm directly
    
    We should get dapm via snd_soc_card_to_dapm(card), and use it.
    
    Signed-off-by: Kuninori Morimoto 
    Link: https://patch.msgid.link/87bjkgnnhg.wl-kuninori.morimoto.gx@renesas.com
    Signed-off-by: Mark Brown 

commit d00e80606e76233f4ae03486a9809c9edfe8b27e
Author: HariKrishna Sagala 
Date:   Fri Nov 21 19:39:43 2025 +0530

    ASoC: codec: rt274: Use devm_request_threaded_irq to manage IRQ lifetime and fix smatch warning
    
    Replace manual "request_threaded_irq()" with the device managed
    "devm_request_threaded_irq" to manage the IRQ lifetime and also
    it removes the smatch reported warning.
    Remove the manual "free_irq()" in the "remove" function as free_irq
    is tied to device teardown.
    
    Signed-off-by: HariKrishna Sagala 
    Link: https://patch.msgid.link/20251121140940.40678-4-hariconscious@gmail.com
    Signed-off-by: Mark Brown 

commit 774d075a80c652a0f35a5dd6f9e35cac5b7f6bdd
Author: HariKrishna Sagala 
Date:   Mon Nov 17 18:18:48 2025 +0530

    ASoC: fsl: fsl_ssi: Replace deprecated strcpy() with strscpy()
    
    strcpy() is deprecated,use strscpy() instead.
    No functional changes intended.
    Link: https://github.com/KSPP/linux/issues/88
    
    Signed-off-by: HariKrishna Sagala 
    Link: https://patch.msgid.link/29c40b5a-3e4d-e89d-ca22-a1059cca3480@gmail.com
    Signed-off-by: Mark Brown 

commit aa30193af8873b3ccfd70a4275336ab6cbd4e5e6
Author: Cezary Rojewski 
Date:   Fri Dec 12 11:38:58 2025 +0100

    ASoC: Intel: catpt: Drop superfluous space in PCM code
    
    Those spaces are redundant.
    
    Signed-off-by: Cezary Rojewski 
    Link: https://patch.msgid.link/20251212103858.110701-6-cezary.rojewski@intel.com
    Signed-off-by: Mark Brown 

commit e97e07138f956a551895a9556d1a929978a5346d
Author: Cezary Rojewski 
Date:   Fri Dec 12 11:38:57 2025 +0100

    ASoC: Intel: catpt: Specify image names in the device descriptor
    
    State files to load explicitly in the device descriptor instead of
    hiding the details within a loading function. Apart from readability,
    this also reduces the catpt module size slightly.
    
    Signed-off-by: Cezary Rojewski 
    Link: https://patch.msgid.link/20251212103858.110701-5-cezary.rojewski@intel.com
    Signed-off-by: Mark Brown 

commit d44f62b09b1e97baee3b10484a1c3c203bb83caf
Author: Cezary Rojewski 
Date:   Fri Dec 12 11:38:56 2025 +0100

    ASoC: Intel: catpt: Simplify catpt_stream_read_position()
    
    Add position to the argument list to simplify the wrapper.
    
    Signed-off-by: Cezary Rojewski 
    Link: https://patch.msgid.link/20251212103858.110701-4-cezary.rojewski@intel.com
    Signed-off-by: Mark Brown 

commit eded4483b8a21eaeb0886ef6f961ccf4e0d9c976
Author: Cezary Rojewski 
Date:   Fri Dec 12 11:38:55 2025 +0100

    ASoC: Intel: catpt: Update CATPT_IPC_ERROR macro
    
    Make it easier for functions that call IPC handlers to deal with their
    results by accounting for '0' (success) code. Rename the macro to
    reflect this behaviour change.
    
    Signed-off-by: Cezary Rojewski 
    Link: https://patch.msgid.link/20251212103858.110701-3-cezary.rojewski@intel.com
    Signed-off-by: Mark Brown 

commit 384b13038715f16713d1b2bfe5fb927c8437e48b
Author: Cezary Rojewski 
Date:   Fri Dec 12 11:38:54 2025 +0100

    ASoC: Intel: catpt: Move IPC error messages one level down
    
    Code size can be reduced if catpt_dsp_do_send_msg() takes responsibility
    for dumping logs in case of an IPC message failure.
    
    Signed-off-by: Cezary Rojewski 
    Link: https://patch.msgid.link/20251212103858.110701-2-cezary.rojewski@intel.com
    Signed-off-by: Mark Brown 

commit e39011184f23de3d04ca8e80b4df76c9047b4026
Author: Krzysztof Kozlowski 
Date:   Wed Dec 3 17:12:40 2025 +0100

    ASoC: SDCA: functions: Fix confusing cleanup.h syntax
    
    Initializing automatic __free variables to NULL without need (e.g.
    branches with different allocations), followed by actual allocation is
    in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Charles Keepax 
    Link: https://patch.msgid.link/20251203-asoc-wrong-cleanup-h-continued-v1-3-5142be4874fb@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit bafd5cf04b2822bf3c865add7262d86e22b9588e
Author: Krzysztof Kozlowski 
Date:   Wed Dec 3 17:12:39 2025 +0100

    ASoC: amd: acp-sdw-sof: Fix confusing cleanup.h syntax
    
    Initializing automatic __free variables to NULL without need (e.g.
    branches with different allocations), followed by actual allocation is
    in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251203-asoc-wrong-cleanup-h-continued-v1-2-5142be4874fb@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 5a7e236925b417332a674a8488ef19da233a5764
Author: Krzysztof Kozlowski 
Date:   Wed Dec 3 17:12:38 2025 +0100

    ASoC: amd: acp-sdw-legacy: Fix confusing cleanup.h syntax
    
    Initializing automatic __free variables to NULL without need (e.g.
    branches with different allocations), followed by actual allocation is
    in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Link: https://patch.msgid.link/20251203-asoc-wrong-cleanup-h-continued-v1-1-5142be4874fb@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 0bb160c92ad400c692984763996b758458adea17
Author: Krzysztof Kozlowski 
Date:   Sat Nov 29 14:17:58 2025 +0100

    ASoC: qcom: Minor readability improve with new lines
    
    Variables with automatic cleanup are special because they do not follow
    standard rules of declaration at top of function (see cleanup.h), but on
    the other hand we always expect line break between top-function
    declarations and first instructions.
    
    Don't pretend automatic cleanup variables are part of top-level
    declaration to improve readability when variable is followed by nun-NULL
    check.  No functional impact, only style.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251129-asoc-wrong-cleanup-h-can-people-stop-sending-this-without-reading-docs-v1-6-c38b06884e39@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 0e6071d656fb284e003a45ce158831d4d12aac5a
Author: Krzysztof Kozlowski 
Date:   Sat Nov 29 14:17:57 2025 +0100

    ASoC: qcom: audioreach: Fix confusing cleanup.h syntax
    
    Commit 88a5f8e628ef ("ASoc: qcom: audioreach: Use automatic cleanup of
    kfree()") did not make the code simpler but more complicated.  Already
    simple code of allocation and free, without any error paths, got now
    declaration with one constructor followed by another allocation, which
    is in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251129-asoc-wrong-cleanup-h-can-people-stop-sending-this-without-reading-docs-v1-5-c38b06884e39@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 3c84bfa47ff29ec0c202cb139d365421c6778d65
Author: Krzysztof Kozlowski 
Date:   Sat Nov 29 14:17:56 2025 +0100

    ASoC: qcom: q6afe: Fix confusing cleanup.h syntax
    
    Commit 55094e55ae36 ("ASoc: qcom: q6afe: Use automatic cleanup of
    kfree()") did not make the code simpler but more complicated.  Already
    simple code of allocation and free, without any error paths, got now
    declaration with one constructor followed by another allocation, which
    is in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251129-asoc-wrong-cleanup-h-can-people-stop-sending-this-without-reading-docs-v1-4-c38b06884e39@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 310e6f95eedaae04990072078adbb38beb149811
Author: Krzysztof Kozlowski 
Date:   Sat Nov 29 14:17:55 2025 +0100

    ASoC: qcom: q6apm: Fix confusing cleanup.h syntax
    
    Commit 89cf2223ee7b ("ASoc: qcom: q6apm: Use automatic cleanup of
    kfree()") did not make the code simpler but more complicated.  Already
    simple code of allocation and free, without any error paths, got now
    declaration with one constructor followed by another allocation, which
    is in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251129-asoc-wrong-cleanup-h-can-people-stop-sending-this-without-reading-docs-v1-3-c38b06884e39@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit c862dc9019f517893eb83096076d7eed4ecbb372
Author: Krzysztof Kozlowski 
Date:   Sat Nov 29 14:17:54 2025 +0100

    ASoC: qcom: q6asm: Fix confusing cleanup.h syntax
    
    Commit 6e00112d31c8 ("ASoc: qcom: q6asm: Use automatic cleanup of
    kfree()") did not make the code simpler but more complicated.  Already
    simple code of allocation and free, without any error paths, got now
    declaration with one constructor followed by another allocation, which
    is in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251129-asoc-wrong-cleanup-h-can-people-stop-sending-this-without-reading-docs-v1-2-c38b06884e39@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit bd9e7182e36169cd7e1ea3b25b5c82b1c5698e64
Author: Krzysztof Kozlowski 
Date:   Sat Nov 29 14:17:53 2025 +0100

    ASoC: qcom: q6prm: Fix confusing cleanup.h syntax
    
    Commit de8e95773c48 ("ASoc: qcom: q6prm: Use automatic cleanup of
    kfree()") did not make the code simpler but more complicated.  Already
    simple code of allocation and free, without any error paths, got now
    declaration with one constructor followed by another allocation, which
    is in contrary to explicit coding rules guiding cleanup.h:
    
    "Given that the "__free(...) = NULL" pattern for variables defined at
    the top of the function poses this potential interdependency problem the
    recommendation is to always define and assign variables in one statement
    and not group variable definitions at the top of the function when
    __free() is used."
    
    Code does not have a bug, but is less readable and uses discouraged
    coding practice, so fix that by moving declaration to the place of
    assignment.
    
    Signed-off-by: Krzysztof Kozlowski 
    Reviewed-by: Srinivas Kandagatla 
    Link: https://patch.msgid.link/20251129-asoc-wrong-cleanup-h-can-people-stop-sending-this-without-reading-docs-v1-1-c38b06884e39@oss.qualcomm.com
    Signed-off-by: Mark Brown 

commit 124f6155f3d97b0e33f178c10a5138a42c8fd207
Author: Biju Das 
Date:   Fri Nov 14 07:58:52 2025 +0000

    ASoC: renesas: rz-ssi: Add support for 32 bits sample width
    
    Add support for 32 bits sample format width for RZ/G2L SoCs.
    
    Signed-off-by: Biju Das 
    Link: https://patch.msgid.link/20251114075856.4751-6-biju.das.jz@bp.renesas.com
    Signed-off-by: Mark Brown 

commit 9e10709f831408d948be66bc8f6329fa37a3dc82
Author: Biju Das 
Date:   Fri Nov 14 07:58:51 2025 +0000

    ASoC: renesas: rz-ssi: Add support for 24 bits sample width
    
    Add support for 24 bits sample format width for RZ/G2L SoCs.
    
    Signed-off-by: Biju Das 
    Link: https://patch.msgid.link/20251114075856.4751-5-biju.das.jz@bp.renesas.com
    Signed-off-by: Mark Brown 

commit b541cb0a27dfa7504a8008320502f869c75f8bfc
Author: Biju Das 
Date:   Fri Nov 14 07:58:50 2025 +0000

    ASoC: renesas: rz-ssi: Move DMA configuration
    
    Move DMA configuration from rz_ssi_dma_request() to rz_ssi_dai_trigger()
    for supporting sample widths higher than 16.
    
    Signed-off-by: Biju Das 
    Link: https://patch.msgid.link/20251114075856.4751-4-biju.das.jz@bp.renesas.com
    Signed-off-by: Mark Brown 

commit a472f0b157832fc91c83179b1628d8f660c84c82
Author: Biju Das 
Date:   Fri Nov 14 07:58:49 2025 +0000

    ASoC: renesas: rz-ssi: Remove trailing comma in the terminator entry
    
    Remove trailing comma in the terminator entry for OF table. While at it,
    add a space between the braces and comment block.
    
    Reviewed-by: Kuninori Morimoto 
    Signed-off-by: Biju Das 
    Link: https://patch.msgid.link/20251114075856.4751-3-biju.das.jz@bp.renesas.com
    Signed-off-by: Mark Brown 

commit d6c160d5e86f4e7354dd6c3154b7cb562abc6c7d
Author: Biju Das 
Date:   Fri Nov 14 07:58:48 2025 +0000

    ASoC: renesas: rz-ssi: Use dev variable in probe()
    
    Replace '&pdev->dev' by 'dev' in probe(), this makes few error paths
    shorter.
    
    Reviewed-by: Kuninori Morimoto 
    Signed-off-by: Biju Das 
    Link: https://patch.msgid.link/20251114075856.4751-2-biju.das.jz@bp.renesas.com
    Signed-off-by: Mark Brown 

commit ae0a0c45200c80010d8e0925fe79858abbaa4f50
Merge: a7b7afcc54cd51 e64826e5e367ad
Author: Takashi Iwai 
Date:   Sun Dec 14 11:13:59 2025 +0100

    Merge branch 'for-linus' into for-next
    
    Pull 6.19-devel branch for further development
    
    Signed-off-by: Takashi Iwai 

commit a7b7afcc54cd51f60b840c173dc1223d1697750e
Author: Uwe Kleine-König 
Date:   Tue Dec 9 13:38:51 2025 +0100

    ALSA: seq: Refuse to probe seq drivers with non-bus probe or remove
    
    Now that all in-tree seq drivers are converted to bus methods, let
    old-style drivers fails to probe until driver methods are removed.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/10adbd12b75984f6fd45e281438d475735cf5fdb.1765283601.git.u.kleine-koenig@baylibre.com

commit 4b8da6d08944f78b17bd9e846c8e3e38625088a6
Author: Uwe Kleine-König 
Date:   Tue Dec 9 13:38:50 2025 +0100

    ALSA: seq: oss: Convert to snd_seq bus probe mechanism
    
    The snd_seq bus got a dedicated probe function. Make use of that. This
    fixes a runtime warning about the driver needing to be converted to the
    bus probe method.
    
    Note that the remove callback returns void now. The actual return value
    was ignored before (see device_remove() in drivers/base/dd.c), so there
    is no problem introduced by converting `return -EINVAL` to `return`.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/affb5a7107e9d678ce85dc7f0b87445928cd6b94.1765283601.git.u.kleine-koenig@baylibre.com

commit 94afb5b7a130f3842baf0aa1fd936b2c7d73cbbd
Author: Uwe Kleine-König 
Date:   Tue Dec 9 13:38:49 2025 +0100

    ALSA: emu10k1: Convert to snd_seq bus probe mechanism
    
    The snd_seq bus got a dedicated probe function. Make use of that. This
    fixes a runtime warning about the driver needing to be converted to the
    bus probe method.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/31d351fc844348eac0955db8db78c19a0c23d888.1765283601.git.u.kleine-koenig@baylibre.com

commit 4983d2f55f34748e64f22b514dd5fbfab1c6b0ad
Author: Uwe Kleine-König 
Date:   Tue Dec 9 13:38:48 2025 +0100

    ALSA: sb: Convert to snd_seq bus probe mechanism
    
    The snd_seq bus got a dedicated probe function. Make use of that. This
    fixes a runtime warning about the driver needing to be converted to the
    bus probe method.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/ccaf10073a6e8a68ea751bfc0e8aae1c66b57458.1765283601.git.u.kleine-koenig@baylibre.com

commit 505b57e52c9eeef810df23af6064aeb79b601f00
Author: Uwe Kleine-König 
Date:   Tue Dec 9 13:38:47 2025 +0100

    ALSA: opl4: Convert to snd_seq bus probe mechanism
    
    The snd_seq bus got a dedicated probe function. Make use of that. This
    fixes a runtime warning about the driver needing to be converted to the
    bus probe method.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/15cd19c9c8ec32e92b956eec112e515335bc22cf.1765283601.git.u.kleine-koenig@baylibre.com

commit 376cdcd3ff18c08540178bc95e1dba49228cd2bd
Author: Uwe Kleine-König 
Date:   Tue Dec 9 13:38:46 2025 +0100

    ALSA: opl3: Convert to snd_seq bus probe mechanism
    
    The snd_seq bus got a dedicated probe function. Make use of that. This
    fixes a runtime warning about the driver needing to be converted to the
    bus probe method.
    
    Note that the remove callback returns void now. The actual return value
    was ignored before (see device_remove() in drivers/base/dd.c), so there
    is no problem introduced by converting `return -EINVAL` to `return`.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/fb5e44d995cf93b8feae22c4558598859712bc07.1765283601.git.u.kleine-koenig@baylibre.com

commit d1c83a79e3985e7d5961dfe8adb76e1d9a624fb2
Author: Uwe Kleine-König 
Date:   Tue Dec 9 13:38:45 2025 +0100

    ALSA: seq: ump: Convert to snd_seq bus probe mechanism
    
    The snd_seq bus got a dedicated probe function. Make use of that. This
    fixes a runtime warning about the driver needing to be converted to the
    bus probe method.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/054f1a0536228ccfe5f539ce854804f789f2ee64.1765283601.git.u.kleine-koenig@baylibre.com

commit 2e514916e90fd709c07be2a9e2965aa0c66997ee
Author: Uwe Kleine-König 
Date:   Tue Dec 9 13:38:44 2025 +0100

    ALSA: seq: midi: Convert to snd_seq bus probe mechanism
    
    The snd_seq bus got a dedicated probe function. Make use of that. This
    fixes a runtime warning about the driver needing to be converted to the
    bus probe method.
    
    Note that the remove callback returns void now. The actual return value
    was ignored before (see device_remove() in drivers/base/dd.c), so there
    is no problem introduced by converting `return -ENODEV` to `return`.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/054ae56db6b55eea60c8aa8f9633e8d3d180cb09.1765283601.git.u.kleine-koenig@baylibre.com

commit a89f7f08182954f51fcec1c8c65dec0c6cfc778e
Author: Uwe Kleine-König 
Date:   Tue Dec 9 13:38:43 2025 +0100

    ALSA: seq: Use bus specific probe and remove
    
    Introduce a bus specific probe and remove function. For now this only
    allows to get rid of a cast of the generic device to an snd_seq device
    in the drivers and changes the remove prototype to return void---a
    non-zero return value is ignored anyhow.
    
    The objective is to get rid of users of struct device callbacks
    .probe(), .remove() and .shutdown() to eventually remove these. Until
    all snd_seq drivers are converted this results in a runtime warning
    about the drivers needing an update because there is a bus probe
    function and a driver probe function.
    
    Signed-off-by: Uwe Kleine-König 
    Signed-off-by: Takashi Iwai 
    Link: https://patch.msgid.link/f36b01b297fc5cbb6d0ed4959143add0c13eec99.1765283601.git.u.kleine-koenig@baylibre.com

commit c8dff80a3108a2cb85ac7ac5b1a75c247ac55fd2
Author: Uwe Kleine-König 
Date:   Tue Dec 2 15:09:20 2025 +0100

    bus: fsl-mc: Convert to bus callbacks
    
    With the eventual goal to drop .probe(), .remove() and .shutdown() from
    struct device_driver, convert the fsl bus to use bus methods.
    
    Other than a driver's shutdown callback the bus shutdown callback is
    also called for unbound drivers. So check for the device being bound
    before following the pointer to its driver.
    
    Signed-off-by: Uwe Kleine-König 
    Reviewed-by: Greg Kroah-Hartman 
    Tested-by: Ioana Ciornei 
    Reviewed-by: Ioana Ciornei 
    Link: https://lore.kernel.org/r/848fffe5c479d899c04a4c99ccb5f0128ccc942d.1764684327.git.u.kleine-koenig@baylibre.com
    Link: https://lore.kernel.org/r/20251209115950.3382308-2-u.kleine-koenig@baylibre.com
    [chleroy: squashed the two patches]
    Signed-off-by: Christophe Leroy (CS GROUP) 

commit f4aff53c90e48360c91b6d902b935ecbaccb0b62
Author: Uwe Kleine-König 
Date:   Tue Dec 2 15:09:19 2025 +0100

    bus: fsl-mc: Drop error message in probe function
    
    The driver core already emits an error message when probe fails, see
    call_driver_probe() in drivers/base/dd.c. So drop the duplicated error
    message.
    
    Signed-off-by: Uwe Kleine-König 
    Tested-by: Ioana Ciornei 
    Reviewed-by: Ioana Ciornei 
    Link: https://lore.kernel.org/r/52c89497f78839446713a9c5456defce97a74c7d.1764684327.git.u.kleine-koenig@baylibre.com
    Signed-off-by: Christophe Leroy (CS GROUP) 

commit 0bc03750deefc5fdab77b01c459bb1691c64c3c5
Author: Andrew Cooper 
Date:   Wed Nov 26 12:51:47 2025 +0000

    x86/cpu: Drop vestigial PBE logic in AMD/Hygon/Centaur/Cyrix
    
    Besides formatting changes, this logic dates back to Linux 2.4.0-test11 in
    November 2000.
    
    Prior to "Massive cleanup of CPU detection and bug handling",
    c->x86_capability was a single u32 containing cpuid(1).edx,
    cpuid(0x80000001).edx, or a synthesis thereof.  X86_FEATURE_AMD3D was
    defined as the top bit this single u32.
    
    After "Massive cleanup of CPU detection and bug handling",
    c->x86_capability became an array with AMD's extended feature leaf split
    away from Intel's basic feature leaf.
    
    AMD doc #20734-G states that 3DNow is only enumerated in the extended
    feature leaf, and that other vendors where using this bit too.  i.e. AMD
    never produced a CPU which set bit 31 in the basic leaf, meaning that
    there's nothing to clear out in the first place.
    
    This logic looks like it was relevant in the pre-"Massive cleanup" world
    but ought to have been dropped when c->x86_capability was properly split.
    
    Signed-off-by: Andrew Cooper 
    Signed-off-by: Ingo Molnar 
    Cc: H. Peter Anvin 
    Cc: Peter Zijlstra (Intel) 
    Cc: Dave Hansen 
    Cc: Pu Wen 
    Link: https://patch.msgid.link/20251126125147.880275-1-andrew.cooper3@citrix.com

commit a2aabcfc6015b6196f161b6bf4df1519ab09c3e1
Author: Andrew Cooper 
Date:   Wed Nov 26 11:34:42 2025 +0000

    x86/cpu/amd: Use ZEN_MODEL_STEP_UCODE() for erratum_1386_microcode[]
    
    ... to simplify the result.
    
    No functional change.
    
    Signed-off-by: Andrew Cooper 
    Signed-off-by: Ingo Molnar 
    Cc: Borislav Petkov 
    Cc: Mario Limonciello 
    Link: https://patch.msgid.link/20251126113442.877024-1-andrew.cooper3@citrix.com

commit fb7bfa31b8e8569f154f2fe0ea6c2f03c0f087aa
Author: Andrew Cooper 
Date:   Wed Nov 26 13:03:52 2025 +0000

    x86/cpu/amd: Correct the microcode table for Zenbleed
    
    The good revisions are tied to exact steppings, meaning it's not valid to
    match on model number alone, let alone a range.
    
    This is probably only a latent issue.  From public microcode archives, the
    following CPUs exist 17-30-00, 17-60-00, 17-70-00 and would be captured by the
    model ranges.  They're likely pre-production steppings, and likely didn't get
    Zenbleed microcode, but it's still incorrect to compare them to a different
    steppings revision.
    
    Either way, convert the logic to use x86_match_min_microcode_rev(), which is
    the preferred mechanism.
    
    Fixes: 522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix")
    Signed-off-by: Andrew Cooper 
    Signed-off-by: Ingo Molnar 
    Cc: Borislav Petkov 
    Cc: Mario Limonciello 
    Cc: x86@kernel.org
    Link: https://patch.msgid.link/20251126130352.880424-1-andrew.cooper3@citrix.com

commit e0808393bf81b437eac734edc9d812fd30f12190
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:57 2025 +0900

    ARM: dts: aspeed: g6: Drop clocks property from arm,armv7-timer
    
    The property is not specified by the binding, nor used by the driver.
    
    Signed-off-by: Andrew Jeffery 

commit 41aca6b6d4f6541dbe37b85ef0c59660e538db56
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:55 2025 +0900

    ARM: dts: aspeed: ast2600-evb: Tidy up A0 work-around for UART5
    
    Changing the compatible changes the properties allowed -
    snps,dw-apb-uart doesn't specify no-loopback-test, so remove it.
    
    Signed-off-by: Andrew Jeffery 

commit a9360cbd6189666b0b4e10ca63a4b137ed5362ba
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:54 2025 +0900

    ARM: dts: aspeed: g6: Drop unspecified aspeed,ast2600-udma node
    
    There's neither a binding defined nor a driver that matches on the
    compatible, so drop it from the devicetree until someone is motivated to
    solve the problems.
    
    Signed-off-by: Andrew Jeffery 

commit 938fb014f324b19b6e7105e1986a79d22eb0d2c3
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:53 2025 +0900

    ARM: dts: aspeed: Drop syscon compatible from EDAC in g6 dtsi
    
    Its presence is not required by the binding, its addition was not
    discussed in commit aac82707fa45 ("ARM: dts: aspeed: Add AST2600 EDAC
    into common devicetree"), and its inconsistent with the g4 and g5
    dtsis.
    
    Further, the corresponding driver instantiates its own regmap rather
    than fetching the syscon regmap, in theory breaking any users of the
    syscon, but of which there appear to be none in-tree.
    
    Drop it for now, and we can add it back with the necessary rework if
    it's ever required.
    
    Signed-off-by: Andrew Jeffery 

commit eedad0256832c5c1a851adac029d7bc97fbb2080
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:50 2025 +0900

    ARM: dts: aspeed: Use specified wp-inverted property for AST2600 EVB
    
    While sdhci-pltfm supports sdhci,wp-inverted, it also supports
    the un-prefixed and specified wp-inverted property. Switch the EVB
    devicetree to use the specified property to remove warnings when
    checking the DTB.
    
    Reviewed-by: Ulf Hansson 
    Signed-off-by: Andrew Jeffery 

commit 64a55c5ee1fb359c31b8bcfae38334ec293f19cb
Author: Andrew Jeffery 
Date:   Thu Dec 11 17:45:49 2025 +0900

    ARM: dts: aspeed: Remove sdhci-drive-type property from AST2600 EVB
    
    The property isn't specified in the bindings and is not used by the
    corresponding driver, so drop it.
    
    Reviewed-by: Ulf Hansson 
    Signed-off-by: Andrew Jeffery 

commit f28674fab34f07fff9612c3f390d3699bfe8ed90
Author: Marc Olberding 
Date:   Wed Nov 26 16:43:07 2025 -0800

    ARM: dts: aspeed: Add NVIDIA MSX4 HPM
    
    The NVIDIA MSX4 HPM (host platform module) is a reference board for
    managing up to 8 PCIe connected NVIDIA GPUs via ConnectX-8 (CX8)
    SuperNICs. The BMC manages all GPUs and CX8s for both telemetry and
    firmware update via MCTP over USB. The host CPUs are dual socket Intel
    Granite Rapids processors.
    
    For more detail on this architecture:
    
    https://developer.nvidia.com/blog/nvidia-connectx-8-supernics-advance-ai-platform-architecture-with-pcie-gen6-connectivity/
    
    Signed-off-by: Marc Olberding 
    Link: https://patch.msgid.link/20251126-msx1_devicetree-v5-2-e508d13e2dda@nvidia.com
    [arj: Reflow text to wrap at limit, whitespace, grammar]
    Signed-off-by: Andrew Jeffery 

commit 1daabbd6ff20a8b7e87e5eebe74bc7afeb855613
Author: Marc Olberding 
Date:   Wed Nov 26 16:43:06 2025 -0800

    dt-bindings: arm: aspeed: Add NVIDIA MSX4 board
    
    Adds a compatible string for NVIDIA's MSX4 BMC board.
    
    Acked-by: Conor Dooley 
    Signed-off-by: Marc Olberding 
    Link: https://patch.msgid.link/20251126-msx1_devicetree-v5-1-e508d13e2dda@nvidia.com
    [arj: Consistent capitalisation in subject, grammar]
    Signed-off-by: Andrew Jeffery 

commit b89bbf3e5154d0ad024eabb994dabde3fb9e1d6c
Author: Alex Wang 
Date:   Thu Nov 27 17:44:51 2025 +0800

    ARM: dts: aspeed: clemente: move hdd_led to its own gpio-leds group
    
    The gpio-leds driver requires all GPIOs in a group to be available;
    if any GPIO in the group is not available the whole group will not be
    created. The hdd_led GPIO is only present after standby power is
    enabled, which can prevent other LEDs in the same group from being
    created and blocks properly setting 'bmc_ready_noled'.
    
    Move the 'hdd_led' node into a separate gpio-leds group so that other
    LEDs are not blocked and the 'bmc_ready_noled' flag can be set
    correctly.
    
    Fixes: b5dd16228216 ("ARM: dts: aspeed: clemente: Add HDD LED GPIO")
    Signed-off-by: Alex Wang 
    Link: https://patch.msgid.link/20251127-leo-dts-add-shunt-resistor-v2-1-c77dfbfb826c@fii-foxconn.com
    [arj: Fix patch subject, add Fixes: tag]
    Signed-off-by: Andrew Jeffery 

commit f3eb4690e5a61c71adc57d28788c8004aa5665a3
Author: Kimi Chen 
Date:   Tue Nov 25 13:42:50 2025 +0800

    ARM: dts: aspeed: clemente: add gpio line name to io expander
    
    The chassis power cycle process requires a forced shutdown before
    cutting off the standby power. The SCM CPLD implements a hard shutdown
    host function that is controlled through the IO expander in the
    Clemente platform.
    
    This change adds a new GPIO line named "shdn_force_l_cpld" to the
    PCA9555 IO expander's gpio-line-names at index 10. When asserted,
    this GPIO signals the CPLD to pull the HPM's SHDN_FORCE_L pin low,
    which triggers a forced host shutdown.
    
    Signed-off-by: Kimi Chen 
    Signed-off-by: Andrew Jeffery 

commit 0cf964501fae7bda82c7f120f2ed8f848018b244
Author: Fred Chen 
Date:   Tue Nov 25 21:59:31 2025 +0800

    ARM: dts: aspeed: santabarbara: Enable ipmb device for OCP debug card
    
    Add an IPMB node for OCP debug card to support IPMI communication.
    
    Signed-off-by: Fred Chen 
    Signed-off-by: Andrew Jeffery 

commit 22f8985f9594f0ee4d450e90095ed9cb612488fe
Author: Fred Chen 
Date:   Tue Nov 25 21:59:30 2025 +0800

    ARM: dts: aspeed: santabarbara: Add swb IO expander and gpio line names
    
    Add IO expander emulated by the switch board CPLD to handle UART and SPI
    mux control signals. Also add SGPIO labels with FM_MODULE_PWR_EN_N_*
    signals, which control power to each ASIC module individually.
    
    Signed-off-by: Fred Chen 
    Signed-off-by: Andrew Jeffery 

commit 033089ff268b825316183aea655b0c8e99b11faf
Author: Leo Wang 
Date:   Tue Oct 21 11:15:39 2025 +0800

    ARM: dts: aspeed: clemente: Add EEPROMs for boot and data drive FRUs
    
    Add EEPROM devices on the I2C buses used for the boot and data NVMe
    drives. These EEPROMs store FRU information for each drive, allowing
    the BMC to identify.
    
    Signed-off-by: Leo Wang 
    Signed-off-by: Andrew Jeffery 

commit 124b74e42ed3c4f1a72abbf71ff0a1a8f168ad6f
Author: Daniel Hsu 
Date:   Fri Oct 17 21:44:02 2025 +0800

    ARM: dts: aspeed: harma: add fanboard presence sgpio
    
    Add the SGPIO definition for detecting fanboard presence on the Harma
    platform. This allows the BMC to determine whether the fanboard is
    attached.
    
    Signed-off-by: Daniel Hsu 
    Signed-off-by: Andrew Jeffery 

commit 5435398f67173ffb5ffdd003800976cf0975b518
Author: Cosmo Chou 
Date:   Sat Oct 18 12:33:09 2025 +0800

    ARM: dts: aspeed: bletchley: remove WDTRST1 assertion from wdt1
    
    Remove the external signal configuration from wdt1 to prevent the
    WDTRST1 pin from being asserted during watchdog resets.
    
    The WDTRST1 pin was originally configured to reset the TPM during
    watchdog events. However, the pin is incorrectly routed to SRST#
    on the hardware, causing unintended system resets. Since the TPM
    is not currently utilized on this platform, remove the external
    signal configuration to avoid the incorrect reset behavior.
    
    Signed-off-by: Cosmo Chou 
    Signed-off-by: Andrew Jeffery 

commit 6c08d768a528ad22016850a481d67bfc8cdb9d4b
Author: Ingo Molnar 
Date:   Sun Dec 14 09:22:37 2025 +0100

    x86/boot/e820: Use  symbols for literals
    
    Use the human-readable SZ_* constants.
    
    Suggested-by: Nikolay Borisov 
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/92a15c2d-055c-4f4e-b232-32030a8e5e54@suse.com

commit 0d9daff41418cbc762e4b6ec683e0a5ec4cdb5f3
Author: Ingo Molnar 
Date:   Thu May 15 14:05:44 2025 +0200

    x86/boot/e820: Make sure e820_search_gap() finds all gaps
    
    The current implementation of e820_search_gap() searches gaps
    in a reverse search from MAX_GAP_END back to 0, contrary to
    what its main comment claims:
    
        * Search for a gap in the E820 memory space from 0 to MAX_GAP_END (4GB).
    
    But gaps can not only be beyond E820 RAM ranges, they can be below
    them as well. For example this function will not find the proper
    PCI gap for simplified memory map layouts that have a single RAM
    range that crosses the 4GB boundary.
    
    Rework the function to have a proper forward search of
    E820 table entries.
    
    This makes the code somewhat bigger:
    
       text       data        bss        dec        hex    filename
       7613      44072          0      51685       c9e5    e820.o.before
       7645      44072          0      51717       ca05    e820.o.after
    
    but it now both implements what it claims to do, and is more
    straightforward to read.
    
    ( This also allows 'idx' to be the regular u32 again, not an 'int'
      underflowing to -1. )
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-29-mingo@kernel.org

commit 4ad03f133c9e509099907df56717a01468aedfbc
Author: Ingo Molnar 
Date:   Thu May 15 14:05:43 2025 +0200

    x86/boot/e820: Simplify the e820__range_remove() API
    
    Right now e820__range_remove() has two parameters to control the
    E820 type of the range removed:
    
            extern void e820__range_remove(u64 start, u64 size, enum e820_type old_type, bool check_type);
    
    Since E820 types start at 1, zero has a natural meaning of 'no type.
    
    Consolidate the (old_type,check_type) parameters into a single (filter_type)
    parameter:
    
            extern void e820__range_remove(u64 start, u64 size, enum e820_type filter_type);
    
    Note that both e820__mapped_raw_any() and e820__mapped_any()
    already have such semantics for their 'type' parameter, although
    it's currently not used with '0' by in-kernel code.
    
    Also, the __e820__mapped_all() internal helper already has such
    semantics implemented as well, and the e820__get_entry_type() API
    uses the '0' type to such effect.
    
    This simplifies not just e820__range_remove(), and synchronizes its
    use of type filters with other E820 API functions, but simplifies
    usage sites as well, such as parse_memmap_one(), beyond the reduction
    of the number of parameters:
    
      -               else if (from)
      -                       e820__range_remove(start_at, mem_size, from, 1);
                      else
      -                       e820__range_remove(start_at, mem_size, 0, 0);
      +                       e820__range_remove(start_at, mem_size, from);
    
    The generated code gets smaller as well:
    
            add/remove: 0/0 grow/shrink: 0/5 up/down: 0/-66 (-66)
    
            Function                                     old     new   delta
            parse_memopt                                 112     107      -5
            efi_init                                    1048    1039      -9
            setup_arch                                  2719    2709     -10
            e820__range_remove                           283     273     -10
            parse_memmap_opt                             559     527     -32
    
            Total: Before=22,675,600, After=22,675,534, chg -0.00%
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-28-mingo@kernel.org

commit 8b886d8a4db9a75c22cf7d0939f63ca811486efd
Author: Ingo Molnar 
Date:   Thu May 15 14:05:42 2025 +0200

    x86/boot/e820: Remove e820__range_remove()'s unused return parameter
    
    None of the usage sites make use of the 'real_removed_size'
    return parameter of e820__range_remove(), and it's hard
    to contemplate much constructive use: E820 maps can have
    holes, and removing a fixed range may result in removal
    of any number of bytes from 0 to the requested size.
    
    So remove this pointless calculation. This simplifies
    the function a bit:
    
       text       data        bss        dec        hex    filename
       7645      44072          0      51717       ca05    e820.o.before
       7597      44072          0      51669       c9d5    e820.o.after
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-27-mingo@kernel.org

commit 157266edcc56715323de1bd60e49194b3b66a174
Author: Ingo Molnar 
Date:   Thu May 15 14:05:41 2025 +0200

    x86/boot/e820: Simplify append_e820_table() and remove restriction on single-entry tables
    
    So append_e820_table() begins with this weird condition that checks 'nr_entries':
    
        static int __init append_e820_table(struct boot_e820_entry *entries, u32 nr_entries)
        {
                /* Only one memory region (or negative)? Ignore it */
                if (nr_entries < 2)
                        return -1;
    
    Firstly, 'nr_entries' has been an u32 since 2017 and cannot be negative.
    
    Secondly, there's nothing inherently wrong with single-entry E820 maps,
    especially in virtualized environments.
    
    So remove this restriction and remove the __append_e820_table()
    indirection.
    
    Also:
    
     - fix/update comments
     - remove obsolete comments
    
    This shrinks the generated code a bit as well:
    
       text       data        bss        dec        hex    filename
       7549      44072          0      51621       c9a5    e820.o.before
       7533      44072          0      51605       c995    e820.o.after
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: H . Peter Anvin 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-26-mingo@kernel.org

commit af0cf1646d9de812465c3fa134c8c5bcf85de118
Author: Ingo Molnar 
Date:   Thu May 15 14:05:40 2025 +0200

    x86/boot/e820: Standardize __init/__initdata tag placement
    
    So the e820.c file has a hodgepodge of __init and __initdata tag
    placements:
    
        static int __init e820_search_gap(unsigned long *max_gap_start, unsigned long *max_gap_size)
        __init void e820__setup_pci_gap(void)
        __init void e820__reallocate_tables(void)
        void __init e820__memory_setup_extended(u64 phys_addr, u32 data_len)
        void __init e820__register_nosave_regions(unsigned long limit_pfn)
        static int __init e820__register_nvs_regions(void)
        u64 __init e820__memblock_alloc_reserved(u64 size, u64 align)
    
    Standardize on the style used by e820__setup_pci_gap() and place
    them before the storage class.
    
    In addition to the consistency, as a bonus this makes the grep output
    rather clean looking:
    
        __init void e820__range_remove(u64 start, u64 size, enum e820_type filter_type)
        __init void e820__update_table_print(void)
        __init static void e820__update_table_kexec(void)
        __init static int e820_search_gap(unsigned long *max_gap_start, unsigned long *max_gap_size)
        __init void e820__setup_pci_gap(void)
        __init void e820__reallocate_tables(void)
        __init void e820__memory_setup_extended(u64 phys_addr, u32 data_len)
        __init void e820__register_nosave_regions(unsigned long limit_pfn)
        __init static int e820__register_nvs_regions(void)
    
    ... and if one learns to just ignore the leftmost '__init' noise then
    the rest of the line looks just like a regular C function definition.
    
    With the 'mixed' tag placement style the __init tag breaks up the function's
    prototype for no good reason.
    
    Do the same for __initdata.
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-25-mingo@kernel.org

commit 7df2f811b275e6067f7e15a966a2b6ff22a4edfc
Author: Ingo Molnar 
Date:   Thu May 15 14:05:39 2025 +0200

    x86/boot/e820: Simplify & clarify __e820__range_add() a bit
    
    Use 'entry_new' to make clear we are allocating a new entry.
    
    Change the table-full message to say that the table is full.
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-24-mingo@kernel.org

commit 95060e411ffd1be5db641d469b759912abad3332
Author: Ingo Molnar 
Date:   Thu May 15 14:05:38 2025 +0200

    x86/boot/e820: Rename gap_start/gap_size to max_gap_start/max_gap_start in e820_search_gap() et al
    
    The PCI gap searching functions pass around pointers to the
    gap_start/gap_size variables, which refer to the maximum
    size gap found so far.
    
    Rename the variables to say so, and disambiguate their namespace
    from 'current gap' variables.
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-23-mingo@kernel.org

commit f40f3f32b34562672364f02f1b7f7929b8467768
Author: Ingo Molnar 
Date:   Thu May 15 14:05:37 2025 +0200

    x86/boot/e820: Change e820_search_gap() to search for the highest-address PCI gap
    
    Right now the main x86 function that determines the position and size
    of the 'PCI gap', e820_search_gap(), has this curious property:
    
            while (--idx >= 0) {
            ...
                            if (gap >= *gap_size) {
    
    I.e. it will iterate the E820 table backwards, from its end to the beginning,
    and will search for larger and larger gaps in the memory map below 4GB,
    until it finishes with the table.
    
    This logic will, should there be two gaps with the same size, pick the
    one with the lower physical address - which is contrary to usual
    practice that the PCI gap is just below 4GB.
    
    Furthermore, the commit that introduced this weird logic 16 years ago:
    
      3381959da5a0 ("x86: cleanup e820_setup_gap(), add e820_search_gap(), v2")
    
      -                       if (gap > gapsize) {
      +                       if (gap >= *gapsize) {
    
    didn't even declare this change, the title says it's a cleanup,
    and the changelog declares it as a preparatory refactoring
    for a later bugfix:
    
      809d9a8f93bd ("x86/PCI: ACPI based PCI gap calculation")
    
    which bugfix was reverted only 1 day later without much of an
    explanation, and was never reintroduced:
    
      58b6e5538460 ("Revert "x86/PCI: ACPI based PCI gap calculation"")
    
    So based on the Git archeology and by the plain reading of the
    code I declare this '>=' change an unintended bug and side effect.
    
    Change it to '>' again.
    
    It should not make much of a difference in practice, as the
    likelihood of having *two* largest gaps with exactly the same
    size are very low outside of weird user-provided memory maps.
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-22-mingo@kernel.org

commit cff02bff04f237b361fdc7066f043d00f0e3c872
Author: Ingo Molnar 
Date:   Thu May 15 14:05:36 2025 +0200

    x86/boot/e820: Clean up e820__setup_pci_gap()/e820_search_gap() a bit
    
    Apply misc cleanups:
    
     - Use a bit more readable variable names, we haven't run out of
       underscore characters in the kernel yet.
    
     - s/0x400000/SZ_4M
    
     - s/1024*1024/SZ_1M
    
    Suggested-by: Andy Shevchenko 
    Signed-off-by: Ingo Molnar 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: H . Peter Anvin 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-21-mingo@kernel.org

commit 46f3e7d394b23e93d274590d7bede5d62d80440b
Author: Ingo Molnar 
Date:   Thu May 15 14:05:35 2025 +0200

    x86/boot/e820: Change struct e820_table::nr_entries type from __u32 to u32
    
    __u32 is for UAPI headers, and this definition is the only place
    in the kernel-internal E820 code that uses __u32. Change it to u32.
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-20-mingo@kernel.org

commit 58dcd82d2e2543e0aba4915613debec3c309849b
Author: Ingo Molnar 
Date:   Thu May 15 14:05:34 2025 +0200

    x86/boot/e820: Standardize e820 table index variable types under 'u32'
    
    So we have 'idx' types of 'int' and 'unsigned int', and sometimes
    we assign 'u32' fields such as e820_table::nr_entries to these 'int'
    values.
    
    While there's no real risk of overflow with these tables, make it
    all cleaner by standardizing on a single type: u32.
    
    This also happens to shrink the code a bit:
    
       text      data      bss        dec        hex    filename
       7745     44072        0      51817       ca69    e820.o.before
       7613     44072        0      51685       c9e5    e820.o.after
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-19-mingo@kernel.org

commit dc043d6463bf5bb732fe4e29ca5db21ba114871e
Author: Ingo Molnar 
Date:   Thu May 15 14:05:33 2025 +0200

    x86/boot/e820: Standardize e820 table index variable names under 'idx'
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: H . Peter Anvin 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-18-mingo@kernel.org

commit a515ca9664fba4733a95231e5b3e570762b39ced
Author: Ingo Molnar 
Date:   Thu May 15 14:05:32 2025 +0200

    x86/boot/e820: Remove unnecessary header inclusions
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-17-mingo@kernel.org

commit 2774ae1046fb1504908f8387351485cd0fc71108
Author: Ingo Molnar 
Date:   Thu May 15 14:05:31 2025 +0200

    x86/boot/e820: Clean up __refdata use a bit
    
    So __refdata, like __init, is more of a storage class specifier,
    so move the attribute in front of the type, not after the variable
    name. This also aligns it vertically.
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: Borislav Petkov 
    Cc: Juergen Gross 
    Cc: "H . Peter Anvin" 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Cc: Thomas Gleixner 
    Cc: David Woodhouse 
    Link: https://patch.msgid.link/20250515120549.2820541-16-mingo@kernel.org

commit a4803df3a2b145fd17bc3d4c23c4c12c74951299
Author: Ingo Molnar 
Date:   Thu May 15 14:05:30 2025 +0200

    x86/boot/e820: Clean up __e820__range_add() a bit
    
     - Use 'idx' index variable instead of a weird 'x'
     - Make the error message E820-specific
     - Group the code a bit better
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: Borislav Petkov 
    Cc: Juergen Gross 
    Cc: "H . Peter Anvin" 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Cc: Thomas Gleixner 
    Cc: David Woodhouse 
    Link: https://patch.msgid.link/20250515120549.2820541-15-mingo@kernel.org

commit 4a7a13e04c0528771e5006cd781934f7bc4f8fa0
Author: Ingo Molnar 
Date:   Thu May 15 14:05:29 2025 +0200

    x86/boot/e820: Improve e820_print_type() messages
    
    For E820_TYPE_RESERVED, print:
    
      'reserved'  -> 'device reserved'
    
    For E820_TYPE_PRAM and E820_TYPE_PMEM:
    
      'persistent' -> 'persistent RAM'
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: Borislav Petkov 
    Cc: Juergen Gross 
    Cc: "H . Peter Anvin" 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Cc: Thomas Gleixner 
    Cc: David Woodhouse 
    Link: https://patch.msgid.link/20250515120549.2820541-14-mingo@kernel.org

commit 44f732f3ec8273b99252fcd47f873206d556a69f
Author: Ingo Molnar 
Date:   Thu May 15 14:05:28 2025 +0200

    x86/boot/e820: Clean up confusing and self-contradictory verbiage around E820 related resource allocations
    
    So the E820 code has a rather confusing area of code at around
    e820__reserve_resources(), which is, by its plain reading,
    rather self-contradictory. For example, the comment explaining
    e820__reserve_resources() claims:
    
     - '* Mark E820 reserved areas as busy for the resource manager'
    
    By 'E820 reserved areas' one can naively conclude that it's
    talking about E820_TYPE_RESERVED areas - while those areas
    are treated in exactly the opposite fashion by do_mark_busy():
    
            switch (type) {
            case E820_TYPE_RESERVED:
            case E820_TYPE_SOFT_RESERVED:
            case E820_TYPE_PRAM:
            case E820_TYPE_PMEM:
                    return false;
    
    Ie. E820_TYPE_RESERVED areas are *not* marked busy for the
    resource manager, because E820_TYPE_RESERVED areas are
    device regions that might eventually be claimed by a device driver.
    
    This type of confusion permeates this whole area of code,
    making it exceedingly difficult to read (for me at least).
    
    So untangle it bit by bit:
    
     - Instead of talking about ambiguous 'reserved areas',
       talk about 'E820 device address regions' instead,
       and 'register'/'lock' them.
    
     - The do_mark_busy() function is a misnomer as well, because despite
       its name it 'does' nothing - it only determines what type
       of resource handling an E820 type should receive from the
       kernel. Rename it to e820_device_region() and negate its
       meaning, to avoid the 'busy/reserved' confusion. Because
       that's what this code is really about: filtering out
       device regions such as E820_TYPE_RESERVED, E820_TYPE_PRAM,
       E820_TYPE_PMEM, etc., and allowing them to be claimed
       by device drivers later on.
    
     - All other E820 regions (system regions) are registered and
       locked early on, before the PCI resource manager does its
       search for device BAR addresses, etc.
    
    Also fix this somewhat misleading comment:
    
            /*
             * Try to bump up RAM regions to reasonable boundaries, to
             * avoid stolen RAM:
             */
    
    and explain that here we register artificial 'gap' resources
    at the end of suspiciously sized RAM regions, as heuristics
    to try to avoid buggy firmware with undeclared 'stolen RAM' regions:
    
            /*
             * Create additional 'gaps' at the end of RAM regions,
             * rounding them up to 64k/1MB/64MB boundaries, should
             * they be weirdly sized, and register extra, locked
             * resource regions for them, to make sure drivers
             * won't claim those addresses.
             *
             * These are basically blind guesses and heuristics to
             * avoid resource conflicts with broken firmware that
             * doesn't properly list 'stolen RAM' as a system region
             * in the E820 map.
             */
    
    Also improve the printout of this extra resource a bit: make the
    message more unambiguous, and upgrade it from pr_debug() (where
    very few people will see it), to pr_info() (where it will make
    it into the syslog on default distro configs).
    
    Also fix spelling and improve comment placement.
    
    No change in functionality intended.
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: Borislav Petkov 
    Cc: Juergen Gross 
    Cc: "H . Peter Anvin" 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Cc: Thomas Gleixner 
    Cc: David Woodhouse 
    Link: https://patch.msgid.link/20250515120549.2820541-13-mingo@kernel.org

commit d214484f50f4c5dbab932b943b824a4c2920cb6e
Author: Ingo Molnar 
Date:   Thu May 15 14:05:27 2025 +0200

    x86/boot/e820: Remove pointless early_panic() indirection
    
    early_panic() is a pointless wrapper around panic():
    
            static void __init early_panic(char *msg)
            {
                    early_printk(msg);
                    panic(msg);
            }
    
    panic() will already do a printk() of 'msg', and an early_printk() if
    earlyprintk is enabled. There's no need to print it separately.
    
    Remove the function.
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: Borislav Petkov 
    Cc: Juergen Gross 
    Cc: "H . Peter Anvin" 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Cc: Thomas Gleixner 
    Cc: David Woodhouse 
    Link: https://patch.msgid.link/20250515120549.2820541-12-mingo@kernel.org

commit eea78dc546a95af343fd1463ecfbd250f0abbf22
Author: Ingo Molnar 
Date:   Thu May 15 14:05:26 2025 +0200

    x86/boot/e820: Use 'u64' consistently instead of 'unsigned long long'
    
    There's a number of structure fields and local variables related
    to E820 entry physical addresses that are defined as 'unsigned long long',
    but then are compared to u64 fields.
    
    Make the types all consistently u64.
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: Borislav Petkov 
    Cc: Juergen Gross 
    Cc: "H . Peter Anvin" 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Cc: Thomas Gleixner 
    Cc: David Woodhouse 
    Link: https://patch.msgid.link/20250515120549.2820541-11-mingo@kernel.org

commit 1d7bc219e2b6176eac361ed2eb11c7a70387644c
Author: Ingo Molnar 
Date:   Thu May 15 14:05:25 2025 +0200

    x86/boot/e820: Call the PCI gap a 'gap' in the boot log printout
    
    It is a bit weird and inconsistent that the PCI gap is
    advertised during bootup as 'mem'ory:
    
      [mem 0xc0000000-0xfed1bfff] available for PCI devices
       ^^^
    
    It's not really memory, it's a gap that PCI devices can decode
    and use and they often do not map it to any memory themselves.
    
    So advertise it for what it is, a gap:
    
      [gap 0xc0000000-0xfed1bfff] available for PCI devices
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: Borislav Petkov 
    Cc: Juergen Gross 
    Cc: "H . Peter Anvin" 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Cc: Thomas Gleixner 
    Cc: David Woodhouse 
    Link: https://patch.msgid.link/20250515120549.2820541-10-mingo@kernel.org

commit fa06d58805c88f76f4454284c1e9e8334b559e30
Author: Ingo Molnar 
Date:   Thu May 15 14:05:24 2025 +0200

    x86/boot/e820: Print E820_TYPE_RAM entries as ... RAM entries
    
    So it is a bit weird that the actual RAM entries of the E820 table
    are not actually called RAM, but 'usable':
    
            BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff]    1.9 GB usable
    
    'usable' is pretty passive-aggressive in that context and ambiguous,
    most E820 entries denote 'usable' address ranges - reserved ranges
    may be used by devices, or the platform.
    
    Clarify and disambiguate this by making the boot log entry
    explicitly say 'System RAM', like in /proc/iomem:
    
            BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff]    1.9 GB System RAM
    
    Signed-off-by: Ingo Molnar 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: Borislav Petkov 
    Cc: Juergen Gross 
    Cc: "H . Peter Anvin" 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Cc: Thomas Gleixner 
    Cc: David Woodhouse 
    Link: https://patch.msgid.link/20250515120549.2820541-9-mingo@kernel.org

commit c87f94477740f35aafc208c85da784087c94a46e
Author: Ingo Molnar 
Date:   Thu May 15 14:05:22 2025 +0200

    x86/boot/e820: Make the field separator space character part of e820_print_type()
    
    We are going to add more columns to the E820 table printout,
    so make e820_print_type()'s field separator (space character)
    part of the function itself.
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-7-mingo@kernel.org

commit 4d8e5a682be4136758a8beadd5aecc7f76276504
Author: Ingo Molnar 
Date:   Thu May 15 14:05:21 2025 +0200

    x86/boot/e820: Print gaps in the E820 table
    
    Gaps in the E820 table are not obvious at a glance and can
    easily be overlooked.
    
    Print out gaps in the E820 table:
    
    Before:
    
            BIOS-provided physical RAM map:
            BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
            BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
            BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
            BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable
            BIOS-e820: [mem 0x000000007ffdc000-0x000000007fffffff] reserved
            BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] reserved
            BIOS-e820: [mem 0x00000000fed1c000-0x00000000fed1ffff] reserved
            BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
            BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
            BIOS-e820: [mem 0x000000fd00000000-0x000000ffffffffff] reserved
    After:
    
            BIOS-provided physical RAM map:
            BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
            BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
            BIOS-e820: [gap 0x00000000000a0000-0x00000000000effff]
            BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
            BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable
            BIOS-e820: [mem 0x000000007ffdc000-0x000000007fffffff] reserved
            BIOS-e820: [gap 0x0000000080000000-0x00000000afffffff]
            BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] reserved
            BIOS-e820: [gap 0x00000000c0000000-0x00000000fed1bfff]
            BIOS-e820: [mem 0x00000000fed1c000-0x00000000fed1ffff] reserved
            BIOS-e820: [gap 0x00000000fed20000-0x00000000feffbfff]
            BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
            BIOS-e820: [gap 0x00000000ff000000-0x00000000fffbffff]
            BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
            BIOS-e820: [gap 0x0000000100000000-0x000000fcffffffff]
            BIOS-e820: [mem 0x000000fd00000000-0x000000ffffffffff] reserved
    
    Also warn about badly ordered E820 table entries:
    
            BUG: out of order E820 entry!
    
    ( this is printed before the entry is printed, so there's no need to
      print any additional data with the warning. )
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-6-mingo@kernel.org

commit 3e57abd4556b0fe727a755f6b9d573d324105ab0
Author: Ingo Molnar 
Date:   Thu May 15 14:05:20 2025 +0200

    x86/boot/e820: Mark e820__print_table() static
    
    There are no external users of this function left.
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-5-mingo@kernel.org

commit 3814bf08452ecfc6db0de53a2e4f977e9661c1f4
Author: Ingo Molnar 
Date:   Thu May 15 14:05:19 2025 +0200

    x86/boot/e820: Simplify the PPro Erratum #50 workaround
    
    No need to print out the table - users won't really be able
    to tell much from it anyway and the messages around this
    erratum are unnecessarily obtuse.
    
    Instead clearly inform the user that a 256 kB hole is being
    punched in their memory map at the 1.75 GB physical address.
    
    Not that there are many PPro users left. :-)
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-4-mingo@kernel.org

commit 0bb4a8bdbd22fda17660fdd4c086adaf4970239b
Author: Ingo Molnar 
Date:   Thu May 15 14:05:18 2025 +0200

    x86/boot/e820: Simplify e820__print_table() a bit
    
    Introduce 'entry' for the current table entry and shorten
    repetitious use of e820_table->entries[i].
    
    Signed-off-by: Ingo Molnar 
    Cc: H . Peter Anvin 
    Cc: Andy Shevchenko 
    Cc: Arnd Bergmann 
    Cc: David Woodhouse 
    Cc: Juergen Gross 
    Cc: Kees Cook 
    Cc: Linus Torvalds 
    Cc: Mike Rapoport 
    Cc: Paul Menzel 
    Cc: Peter Zijlstra 
    Link: https://patch.msgid.link/20250515120549.2820541-3-mingo@kernel.org

commit db0d69c5700ba4749217b83b475606d864d46226
Author: Ingo Molnar 
Date:   Thu May 15 14:05:17 2025 +0200

    x86/boot/e820: Remove inverted boolean logic from the e820_nomerge() function name, rename it to e820_type_mergeable()
    
    It's a bad practice to put inverted logic into function names,
    flip it back and rename it to e820_type_mergeable().
    
    Add/update a few comments about this function while at it.
    
    Signed-off-by: Ingo Molnar 
    Reviewed-by: Nikolay Borisov 
    Link: https://patch.msgid.link/20250515120549.2820541-2-mingo@kernel.org

commit adbf61cc47cb72b102682e690ad323e1eda652c2
Author: Yazen Ghannam 
Date:   Tue Nov 11 14:53:57 2025 +0000

    x86/acpi/boot: Correct acpi_is_processor_usable() check again
    
    ACPI v6.3 defined a new "Online Capable" MADT LAPIC flag. This bit is
    used in conjunction with the "Enabled" MADT LAPIC flag to determine if
    a CPU can be enabled/hotplugged by the OS after boot.
    
    Before the new bit was defined, the "Enabled" bit was explicitly
    described like this (ACPI v6.0 wording provided):
    
      "If zero, this processor is unusable, and the operating system
      support will not attempt to use it"
    
    This means that CPU hotplug (based on MADT) is not possible. Many BIOS
    implementations follow this guidance. They may include LAPIC entries in
    MADT for unavailable CPUs, but since these entries are marked with
    "Enabled=0" it is expected that the OS will completely ignore these
    entries.
    
    However, QEMU will do the same (include entries with "Enabled=0") for
    the purpose of allowing CPU hotplug within the guest.
    
    Comment from QEMU function pc_madt_cpu_entry():
    
      /* ACPI spec says that LAPIC entry for non present
       * CPU may be omitted from MADT or it must be marked
       * as disabled. However omitting non present CPU from
       * MADT breaks hotplug on linux. So possible CPUs
       * should be put in MADT but kept disabled.
       */
    
    Recent Linux topology changes broke the QEMU use case. A following fix
    for the QEMU use case broke bare metal topology enumeration.
    
    Rework the Linux MADT LAPIC flags check to allow the QEMU use case only
    for guests and to maintain the ACPI spec behavior for bare metal.
    
    Remove an unnecessary check added to fix a bare metal case introduced by
    the QEMU "fix".
    
      [ bp: Change logic as Michal suggested. ]
      [ mingo: Removed misapplied -stable tag. ]
    
    Fixes: fed8d8773b8e ("x86/acpi/boot: Correct acpi_is_processor_usable() check")
    Fixes: f0551af02130 ("x86/topology: Ignore non-present APIC IDs in a present package")
    Closes: https://lore.kernel.org/r/20251024204658.3da9bf3f.michal.pecio@gmail.com
    Reported-by: Michal Pecio 
    Signed-off-by: Yazen Ghannam 
    Signed-off-by: Borislav Petkov (AMD) 
    Signed-off-by: Ingo Molnar 
    Tested-by: Michal Pecio 
    Tested-by: Ricardo Neri 
    Link: https://lore.kernel.org/20251111145357.4031846-1-yazen.ghannam@amd.com
    Cc: stable@vger.kernel.org

commit 47efe2ddccb1f285a02bfcf1e079f49bf7a9ccb3
Author: Peter Zijlstra 
Date:   Thu Oct 30 12:56:34 2025 +0100

    sched/core: Add assertions to QUEUE_CLASS
    
    Add some checks to the sched_change pattern to validate assumptions
    around changing classes.
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/20251127154725.771691954@infradead.org

commit 95a0155224a658965f34ed4b1943b238d9be1fea
Author: Peter Zijlstra 
Date:   Mon Sep 1 22:50:56 2025 +0200

    sched/fair: Limit hrtick work
    
    The task_tick_fair() function does:
    
     - update the hierarchical runtimes
     - drive NUMA-balancing
     - update load-balance statistics
     - drive force-idle preemption
    
    All but the very first can be limited to the periodic tick. Let hrtick
    only update accounting and drive preemption, not load-balancing and
    other bits.
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/20250918080205.563385766@infradead.org

commit a03fee333a2f1e065a739bdbe5edbc5512fab9a4
Author: Peter Zijlstra 
Date:   Fri Nov 14 11:00:55 2025 +0100

    sched/fair: Remove superfluous rcu_read_lock()
    
    With fair switched to rcu_dereference_all() validation, having IRQ or
    preemption disabled is sufficient, remove the rcu_read_lock()
    clutter.
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/20251127154725.647502625@infradead.org

commit 71fedc41c23b0010c578e6e224694ca15c19cf7d
Author: Peter Zijlstra 
Date:   Fri Nov 28 13:32:21 2025 +0100

    sched/fair: Switch to rcu_dereference_all()
    
    With the {rcu,sched,bh} RCU flavours being unified, it doesn't really
    make sense to check for just the rcu one. Switch to the _all family of
    verification which includes all 3 of the listed flavours.
    
    Notably, this will enable us to remove some superfluous
    rcu_read_lock() regions when we know they are inside preempt/IRQ
    disabled regions.
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Signed-off-by: Ingo Molnar 

commit f24165bfa7ef6b37856c8f51e2001b9ad10ba688
Author: Peter Zijlstra 
Date:   Fri Nov 28 13:31:36 2025 +0100

    sched/headers: Rename rcu_dereference_check_sched_domain() => rcu_dereference_sched_domain()
    
    Remove check from the name for being surplus to requirements.
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Signed-off-by: Ingo Molnar 

commit 45e09225085f70b856b7b9f26a18ea767a7e1563
Author: Peter Zijlstra 
Date:   Wed Nov 12 16:08:23 2025 +0100

    sched/fair: Avoid rq->lock bouncing in sched_balance_newidle()
    
    While poking at this code recently I noted we do a pointless
    unlock+lock cycle in sched_balance_newidle(). We drop the rq->lock (so
    we can balance) but then instantly grab the same rq->lock again in
    sched_balance_update_blocked_averages().
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Signed-off-by: Ingo Molnar 
    Link: https://patch.msgid.link/20251127154725.532469061@infradead.org

commit 089d84203ad42bc8fd6dbf41683e162ac6e848cd
Author: Peter Zijlstra 
Date:   Thu Nov 27 16:39:44 2025 +0100

    sched/fair: Fold the sched_avg update
    
    Nine (and a half) instances of the same pattern is just silly, fold the lot.
    
    Notably, the half instance in enqueue_load_avg() is right after setting
    cfs_rq->avg.load_sum to cfs_rq->avg.load_avg * get_pelt_divider(&cfs_rq->avg).
    Since get_pelt_divisor() >= PELT_MIN_DIVIDER, this ends up being a no-op
    change.
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Signed-off-by: Ingo Molnar 
    Cc: Linus Torvalds 
    Cc: Dietmar Eggemann 
    Cc: Juri Lelli 
    Cc: Linus Torvalds 
    Cc: Mel Gorman 
    Cc: Peter Zijlstra 
    Cc: Shrikanth Hegde 
    Cc: Valentin Schneider 
    Cc: Vincent Guittot 
    Link: https://patch.msgid.link/20251127154725.413564507@infradead.org

commit 38a68b982dd0b10e3da943f100e034598326eafe
Author: Peter Zijlstra 
Date:   Thu Nov 27 16:39:44 2025 +0100

    : Add the __signed_scalar_typeof() helper
    
    Define __signed_scalar_typeof() to declare a signed scalar type, leaving
    non-scalar types unchanged.
    
    To be used to clean up the scheduler load-balancing code a bit.
    
    [ mingo: Split off this patch from the scheduler patch. ]
    
    Signed-off-by: Peter Zijlstra (Intel) 
    Signed-off-by: Ingo Molnar 
    Cc: Dietmar Eggemann 
    Cc: Juri Lelli 
    Cc: Linus Torvalds 
    Cc: Mel Gorman 
    Cc: Peter Zijlstra 
    Cc: Shrikanth Hegde 
    Cc: Valentin Schneider 
    Cc: Vincent Guittot 
    Link: https://patch.msgid.link/20251127154725.413564507@infradead.org

commit 6f0b824a61f212e9707ff68abcabfdfa4724b811
Author: T.J. Mercier 
Date:   Sun Dec 7 01:10:04 2025 -0800

    bpf: Fix bpf_seq_read docs for increased buffer size
    
    Commit af65320948b8 ("bpf: Bump iter seq size to support BTF
    representation of large data structures") increased the fixed buffer
    size from PAGE_SIZE to PAGE_SIZE << 3, but the docs for the function
    didn't get updated at the same time. Update them.
    
    Signed-off-by: T.J. Mercier 
    Acked-by: Yonghong Song 
    Link: https://lore.kernel.org/r/20251207091005.2829703-1-tjmercier@google.com
    Signed-off-by: Alexei Starovoitov 

commit 686c64557be48d28f532b26a90db600092c82418
Author: Lukas Bulwahn 
Date:   Mon Nov 10 06:47:33 2025 +0100

    MAINTAINERS: adjust file entry in HIMAX HX83112B TOUCHSCREEN SUPPORT
    
    Commit a311c777f298 ("dt-bindings: touchscreen: consolidate simple touch
    controller to trivial-touch.yaml") aggregates a few touchscreen yaml files
    into a common trivial-touch.yaml, but misses to adjust the reference in
    HIMAX HX83112B TOUCHSCREEN SUPPORT, which refers to the removed file
    himax,hx83112b.yaml.
    
    Make HIMAX HX83112B TOUCHSCREEN SUPPORT refer to trivial-touch.yaml, in
    order to inform the maintainer on changes to the device-tree binding
    relevant to that hardware driver.
    
    Signed-off-by: Lukas Bulwahn 
    Link: https://patch.msgid.link/20251110054733.441893-1-lukas.bulwahn@redhat.com
    Signed-off-by: Dmitry Torokhov 

commit a14be6cd9e7703a914ab476bf99af6577ca790d5
Author: Fabio Baltieri 
Date:   Tue Dec 9 15:47:04 2025 +0000

    Input: cros_ec_keyb - clarify key event error message
    
    Reword one of the key event error messages to clarify its meaning: it's
    not necessarily an incomplete message, more of a mismatch length.
    Clarify that and log the expected and received length too.
    
    Signed-off-by: Fabio Baltieri 
    Reviewed-by: Simon Glass 
    Link: https://patch.msgid.link/20251209154706.529784-2-fabiobaltieri@chromium.org
    Signed-off-by: Dmitry Torokhov 

commit 673b192dbe174b61bdf784d293b5a6e7f2fd20f6
Author: Vaibhav Gupta 
Date:   Wed Dec 10 21:11:41 2025 +0000

    Input: pf1550 - remove "defined but unused" warning
    
    If 'CONFIG_PM_SLEEP' is not set, compiler throws warning for *suspend() and
    *resume() function for this driver. Using new 'DEFINE_SIMPLE_DEV_PM_OPS'
    fixes it.
    
    Signed-off-by: Vaibhav Gupta 
    Link: https://patch.msgid.link/20251210211149.543928-1-vaibhavgupta40@gmail.com
    Signed-off-by: Dmitry Torokhov 

commit c5150ffcdd2c7dda0363cc6ac9da42c656dd3f73
Author: Sakari Ailus 
Date:   Mon Oct 27 13:58:23 2025 +0200

    Input: cyapa - remove redundant pm_runtime_mark_last_busy() calls
    
    pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(),
    pm_runtime_autosuspend() and pm_request_autosuspend() now include a call
    to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to
    pm_runtime_mark_last_busy().
    
    Signed-off-by: Sakari Ailus 
    Link: https://patch.msgid.link/20251027115823.391080-3-sakari.ailus@linux.intel.com
    Signed-off-by: Dmitry Torokhov 

commit 7f9d1e0c954c499fc1ecef646a89d6c6e14d162c
Author: Sakari Ailus 
Date:   Mon Oct 27 13:58:22 2025 +0200

    Input: cs40l50 - remove redundant pm_runtime_mark_last_busy() calls
    
    pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(),
    pm_runtime_autosuspend() and pm_request_autosuspend() now include a call
    to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to
    pm_runtime_mark_last_busy().
    
    Signed-off-by: Sakari Ailus 
    Link: https://patch.msgid.link/20251027115823.391080-2-sakari.ailus@linux.intel.com
    Signed-off-by: Dmitry Torokhov 

commit 99430ec0e0430cd377a8547d85121ee6e9df058b
Author: Sakari Ailus 
Date:   Mon Oct 27 13:58:21 2025 +0200

    Input: omap4-keypad - remove redundant pm_runtime_mark_last_busy() calls
    
    pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(),
    pm_runtime_autosuspend() and pm_request_autosuspend() now include a call
    to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to
    pm_runtime_mark_last_busy().
    
    Signed-off-by: Sakari Ailus 
    Link: https://patch.msgid.link/20251027115823.391080-1-sakari.ailus@linux.intel.com
    Signed-off-by: Dmitry Torokhov 

commit b2b6f3eda6b66383606b4c1edb70f03264191938
Merge: a4a508df2aa34f a7d6255a0bf302
Author: Dmitry Torokhov 
Date:   Sat Dec 13 01:20:17 2025 -0800

    Merge tag 'ib-mfd-input-power-regulator-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next
    
    Pull in pf1550-onkey driver.

commit a4a508df2aa34f8650afde54ea804321c618f45f
Merge: c4b3133c6a2fc2 7d0a66e4bb9081
Author: Dmitry Torokhov 
Date:   Sat Dec 13 01:18:20 2025 -0800

    Merge tag 'v6.18' into next
    
    Sync up with the mainline to bring in the latest APIs.

commit d8684ae1cdcf848d21e00bc0e0de821d694a207b
Author: Matthew Brost 
Date:   Tue Dec 9 12:00:39 2025 -0800

    drm/sched: Add pending job list iterator
    
    Stop open coding pending job list in drivers. Add pending job list
    iterator which safely walks DRM scheduler list asserting DRM scheduler
    is stopped.
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Niranjana Vishwanathapura 
    Link: https://patch.msgid.link/20251209200039.1366764-3-matthew.brost@intel.com

commit 38b069333b58c86b7588d59cc55a065611190926
Author: Matthew Brost 
Date:   Tue Dec 9 12:00:38 2025 -0800

    drm/sched: Add several job helpers to avoid drivers touching scheduler state
    
    In the past, drivers used to reach into scheduler internals—this must
    end because it makes it difficult to change scheduler internals, as
    driver-side code must also be updated.
    
    Add helpers to check if the scheduler is stopped and to query a job’s
    signaled state to avoid reaching into scheduler internals. These are
    expected to be used driver-side in recovery and debug flows.
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Niranjana Vishwanathapura 
    Link: https://patch.msgid.link/20251209200039.1366764-2-matthew.brost@intel.com

commit 83f4151787c5dd2f38a426cb01423149baa3bbf5
Author: Matt Roper 
Date:   Fri Dec 12 10:14:13 2025 -0800

    drm/xe/lnl: Drop pre-production workaround support
    
    LNL has been out long enough that all of our internal usage of
    pre-production hardware has been phased out and we no longer need to
    maintain workarounds that were exclusive to pre-production parts.
    
    Production LNL hardware always has B0 or later steppings for both
    graphics and media IP.  Eliminate all workarounds that were exclusive to
    A-step hardware and set the 'has_prod_wa_only' device flag for LNL to
    make sure we warn and taint if someone tries to load the driver on an
    old pre-production part.
    
    Bspec: 70821
    Reviewed-by: Dnyaneshwar Bhadane 
    Link: https://patch.msgid.link/20251212181411.294854-4-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 7ef2d25e477368bbd5c32e2265210e55644fdd48
Author: Matt Roper 
Date:   Fri Dec 12 10:14:12 2025 -0800

    drm/xe: Track pre-production workaround support
    
    When we're initially enabling driver support for a new platform/IP, we
    usually implement all workarounds documented in the WA database in the
    driver.  Many of those workarounds are restricted to early steppings
    that only showed up in pre-production hardware (i.e., internal test
    chips that are not available to the general public).  Since the
    workarounds for early, pre-production steppings tend to be some of the
    ugliest and most complicated workarounds, we generally want to eliminate
    them and simplify the code once the platform has launched and our
    internal usage of those pre-production parts have been phased out.
    
    Let's add a flag to the device info that tracks which platforms still
    have support for pre-production workarounds for so that we can print a
    warning and taint if someone tries to load the driver on a
    pre-production part for a platform without pre-production workarounds.
    This will help our internal users understand the likely problems they'll
    encounter if they try to load the driver on an old pre-production
    device.
    
    The Xe behavior here is similar to what we've done for many years on
    i915 (see intel_detect_preproduction_hw()), except that instead of
    manually coding up ranges of device steppings that we believe to be
    pre-production hardware, Xe will use the hardware's own production vs
    pre-production fusing status, which we can read from the FUSE2 register.
    This fuse didn't exist on older Intel hardware, but should be present on
    all platforms supported by the Xe driver.
    
    Going forward, let's set the expectation that we'll start looking into
    removing pre-production workarounds for a platform around the time that
    platforms of the next major IP stepping are having their force_probe
    requirement lifted.  This timing is just a rough guideline; there may be
    cases where some instances of pre-production parts are still being
    actively used in CI farms, internal device pools, etc. and we'll need to
    wait a bit longer for those to be swapped out.
    
    v2:
     - Fix inverted forcewake check
    
    v3:
     - Invert flag and add it to the platforms on which we still have
       pre-prod workarounds.  (Jani, Lucas)
    
    v4:
     - Avoid checking pre-production on VF since they don't have access to
       the FUSE2 register.
    
    Bspec: 78271, 52544
    Reviewed-by: Lucas De Marchi 
    Link: https://patch.msgid.link/20251212181411.294854-3-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 13d99b01c0c9d93afb9413cc97a05854ae40f6ab
Author: Brian Nguyen 
Date:   Sat Dec 13 05:32:36 2025 +0800

    drm/xe: Add debugfs support for page reclamation
    
    Allow for runtime modification to page reclamation feature through
    debugfs configuration. This parameter will only take effect if the
    platform supports the page reclamation feature by default.
    
    v2:
     - Minor comment tweaks. (Shuicheng)
     - Convert to kstrtobool_from_user. (Michal)
     - Only expose page reclaim file if page reclaim flag
       initially supported and with that, remove
       xe_match_desc usage. (Michal)
    
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Matthew Brost 
    Reviewed-by: Shuicheng Lin 
    Cc: Michal Wajdeczko 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-22-brian3.nguyen@intel.com

commit 7c52f13b76c531ee2c503baafe52d357cab0c54a
Author: Brian Nguyen 
Date:   Sat Dec 13 05:32:35 2025 +0800

    drm/xe: Optimize flushing of L2$ by skipping unnecessary page reclaim
    
    There are additional hardware managed L2$ flushing such as the
    transient display. In those scenarios, page reclamation is
    unnecessary resulting in redundant cacheline flushes, so skip
    over those corresponding ranges.
    
    v2:
     - Elaborated on reasoning for page reclamation skip based on
       Tejas's discussion. (Matthew A, Tejas)
    
    v3:
     - Removed MEDIA_IS_ON due to racy condition resulting in removal of
       relevant registers and values. (Matthew A)
     - Moved l3 policy access to xe_pat. (Matthew A)
    
    v4:
     - Updated comments based on previous change. (Tejas)
     - Move back PAT index macros to xe_pat.c.
    
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Tejas Upadhyay 
    Cc: Matthew Auld 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-21-brian3.nguyen@intel.com

commit 684965d96a918f78c3fbd3ef55444aa9cdd7c5f6
Author: Brian Nguyen 
Date:   Sat Dec 13 05:32:34 2025 +0800

    drm/xe: Append page reclamation action to tlb inval
    
    Add page reclamation action to tlb inval backend. The page reclamation
    action is paired with range tlb invalidations so both are issued at the
    same time.
    
    Page reclamation will issue the TLB invalidation with an invalid seqno
    and a H2G page reclamation action with the fence's corresponding seqno
    and handle the fence accordingly on page reclaim action done handler.
    
    If page reclamation fails, tlb timeout handler will be responsible for
    signalling fence and cleaning up.
    
    v2:
     - add send_page_reclaim to patch.
     - Remove flush_cache and use prl_sa pointer to determine PPC flush
       instead of explicit bool. Add NULL as fallback for others. (Matthew B)
    
    v3:
     - Add comments for flush_cache with media.
    
    Signed-off-by: Brian Nguyen 
    Suggested-by: Matthew Brost 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-20-brian3.nguyen@intel.com

commit 9945e6a52f3c66b40ae30c2f4b79312a56fc9ba7
Author: Brian Nguyen 
Date:   Sat Dec 13 05:32:33 2025 +0800

    drm/xe: Prep page reclaim in tlb inval job
    
    Use page reclaim list as indicator if page reclaim action is desired and
    pass it to tlb inval fence to handle.
    
    Job will need to maintain its own embedded copy to ensure lifetime of
    PRL exist until job has run.
    
    v2:
     - Use xe variant of WARN_ON (Michal)
    
    v3:
     - Add comments for PRL tile handling and flush behavior with media.
       (Matthew Brost)
    
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Matthew Brost 
    Cc: Michal Wajdeczko 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-19-brian3.nguyen@intel.com

commit 2b192bebaf610abd4aa4f5fdf7282f3c2a347898
Author: Brian Nguyen 
Date:   Sat Dec 13 05:32:32 2025 +0800

    drm/xe: Suballocate BO for page reclaim
    
    Page reclamation feature needs the PRL to be suballocated into a
    GGTT-mapped BO. On allocation failure, fallback to default tlb
    invalidation with full PPC flush.
    
    PRL's BO allocation is managed in separate pool to ensure 4K alignment
    for proper GGTT address.
    
    With BO, pass into TLB invalidation backend and modify fence to
    accomadate accordingly.
    
    v2:
     - Removed page reclaim related variables from TLB fence. (Matthew B)
     - Allocate PRL bo size to num_entries. (Matthew B)
     - Move PRL bo allocation to tlb_inval run_job. (Matthew B)
    
    v5:
     - Use xe_page_reclaim_list_valid. (Matthew B)
    
    Signed-off-by: Brian Nguyen 
    Suggested-by: Matthew Brost 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-18-brian3.nguyen@intel.com

commit b912138df2993b6271500e5ecbd933acff14ac43
Author: Brian Nguyen 
Date:   Sat Dec 13 05:32:31 2025 +0800

    drm/xe: Create page reclaim list on unbind
    
    Page reclaim list (PRL) is preparation work for the page reclaim feature.
    The PRL is firstly owned by pt_update_ops and all other page reclaim
    operations will point back to this PRL. PRL generates its entries during
    the unbind page walker, updating the PRL.
    
    This PRL is restricted to a 4K page, so 512 page entries at most.
    
    v2:
     - Removed unused function. (Shuicheng)
     - Compacted warning checking, update commit message,
       spelling, etc. (Shuicheng, Matthew B)
     - Fix kernel docs
     - Moved PRL max entries overflow handling out from
       generate_reclaim_entry to caller (Shuicheng)
     - Add xe_page_reclaim_list_init for clarity. (Matthew B)
     - Modify xe_guc_page_reclaim_entry to use macros
       for greater flexbility. (Matthew B)
     - Add fallback for PTE outside of page reclaim supported
       4K, 64K, 2M pages (Matthew B)
     - Invalidate PRL for early abort page walk.
     - Removed page reclaim related variables from tlb fence
       (Matthew Brost)
     - Remove error handling in *alloc_entries failure. (Matthew B)
    
    v3:
     - Fix NULL pointer dereference check.
     - Modify reclaim_entry to QW and bitfields accordingly. (Matthew B)
     - Add vm_dbg prints for PRL generation and invalidation. (Matthew B)
    
    v4:
     - s/GENMASK/GENMASK_ULL && s/BIT/BIT_ULL (CI)
    
    v5:
     - Addition of xe_page_reclaim_list_is_new() to avoid continuous
       allocation of PRL if consecutive VMAs cause a PRL invalidation.
     - Add xe_page_reclaim_list_valid() helpers for clarity. (Matthew B)
     - Move xe_page_reclaim_list_entries_put in
       xe_page_reclaim_list_invalidate.
    
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Matthew Brost 
    Cc: Shuicheng Lin 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-17-brian3.nguyen@intel.com

commit 77ebc7c10d1607533cf7cf6c7a7b77105498d8b0
Author: Brian Nguyen 
Date:   Sat Dec 13 05:32:30 2025 +0800

    drm/xe/guc: Add page reclamation interface to GuC
    
    Add page reclamation related changes to GuC interface, handlers, and
    senders to support page reclamation.
    
    Currently TLB invalidations will perform an entire PPC flush in order to
    prevent stale memory access for noncoherent system memory. Page
    reclamation is an extension of the typical TLB invalidation
    workflow, allowing disabling of full PPC flush and enable selective PPC
    flushing. Selective flushing will be decided by a list of pages whom's
    address is passed to GuC at time of action.
    
    Page reclamation interfaces require at least GuC FW ver 70.31.0.
    
    v2:
     - Moved send_page_reclaim to first patch usage.
     - Add comments explaining shared done handler. (Matthew B)
     - Add FW version fallback to disable page reclaim
       on older versions. (Matthew B, Shuicheng)
    
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Matthew Brost 
    Reviewed-by: Shuicheng Lin 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-16-brian3.nguyen@intel.com

commit 9b1a0e0a15c97987fdf56a615f3d13995bafd042
Author: Oak Zeng 
Date:   Sat Dec 13 05:32:29 2025 +0800

    drm/xe: Add page reclamation info to device info
    
    Starting from Xe3p, HW adds a feature assisting range based page
    reclamation. Introduce a bit in device info to indicate whether
    device has such capability.
    
    Signed-off-by: Oak Zeng 
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Shuicheng Lin 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-15-brian3.nguyen@intel.com

commit b4abe06d6d82df6521f449357ca6b7c6ce9c0903
Author: Brian Nguyen 
Date:   Sat Dec 13 05:32:28 2025 +0800

    drm/xe/xe_tlb_inval: Modify fence interface to support PPC flush
    
    Allow tlb_invalidation to control when driver wants to flush the
    Private Physical Cache (PPC) as a process of the tlb invalidation
    process.
    
    Default behavior is still to always flush the PPC but driver now has the
    option to disable it.
    
    v2:
     - Revise commit/kernel doc descriptions. (Shuicheng)
     - Remove unused function. (Shuicheng)
     - Remove bool flush_cache parameter from fence,
       and various function inputs. (Matthew B)
    
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Matthew Brost 
    Reviewed-by: Tejas Upadhyay 
    Cc: Shuicheng Lin 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-14-brian3.nguyen@intel.com

commit 44ece22518594ec9ffd9ab8c4c500b522278289e
Author: Matthew Brost 
Date:   Sat Dec 13 05:32:27 2025 +0800

    drm/xe: Do not forward invalid TLB invalidation seqnos to upper layers
    
    Certain TLB invalidation operations send multiple H2G messages per seqno
    with only the final H2G containing the valid seqno - the others carry an
    invalid seqno. The G2H handler drops these invalid seqno to aovid
    prematurely signaling a TLB invalidation fence.
    
    With TLB_INVALIDATION_SEQNO_INVALID used to indicate in progress
    multi-step TLB invalidations, reset tdr to ensure that timeout
    won't prematurely trigger when G2H actions are still ongoing.
    
    v2: Remove lock from xe_tlb_inval_reset_timeout. (Matthew B)
    
    v3: Squash with dependent patch from Matthew Brost' series.
    
    Signed-off-by: Brian Nguyen 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251212213225.3564537-13-brian3.nguyen@intel.com

commit 825aed0328588b2837636c1c5a0c48795d724617
Author: Jan Maslak 
Date:   Wed Dec 10 15:56:18 2025 +0100

    drm/xe: Restore engine registers before restarting schedulers after GT reset
    
    During GT reset recovery in do_gt_restart(), xe_uc_start() was called
    before xe_reg_sr_apply_mmio() restored engine-specific registers. This
    created a race window where the scheduler could run jobs before hardware
    state was fully restored.
    
    This caused failures in eudebug tests (xe_exec_sip_eudebug@breakpoint-
    waitsip-*) where TD_CTL register (containing TD_CTL_GLOBAL_DEBUG_ENABLE)
    wasn't restored before jobs started executing. Breakpoints would fail to
    trigger SIP entry because the debug enable bit wasn't set yet.
    
    Fix by moving xe_uc_start() after all MMIO register restoration,
    including engine registers and CCS mode configuration, ensuring all
    hardware state is fully restored before any jobs can be scheduled.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Signed-off-by: Jan Maslak 
    Reviewed-by: Jonathan Cavitt 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251210145618.169625-2-jan.maslak@intel.com

commit 343f5683cfa443000904c88ce2e23656375fc51c
Author: Lizhi Hou 
Date:   Wed Dec 10 20:51:25 2025 -0800

    accel/amdxdna: Fix race where send ring appears full due to delayed head update
    
    The firmware sends a response and interrupts the driver before advancing
    the mailbox send ring head pointer. As a result, the driver may observe
    the response and attempt to send a new request before the firmware has
    updated the head pointer. In this window, the send ring still appears
    full, causing the driver to incorrectly fail the send operation.
    
    This race can be triggered more easily in a multithreaded environment,
    leading to unexpected and spurious "send ring full" failures.
    
    To address this, poll the send ring head pointer for up to 100us before
    returning a full-ring condition. This allows the firmware time to update
    the head pointer.
    
    Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox")
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251211045125.1724604-1-lizhi.hou@amd.com

commit d69d3636f5f7a84bae7cd43473b3701ad9b7d544
Author: Jagmeet Randhawa 
Date:   Fri Dec 12 05:21:46 2025 +0800

    drm/xe: Increase TDF timeout
    
    There are some corner cases where flushing transient
    data may take slightly longer than the 150us timeout
    we currently allow.  Update the driver to use a 300us
    timeout instead based on the latest guidance from
    the hardware team. An update to the bspec to formally
    document this is expected to arrive soon.
    
    Fixes: c01c6066e6fa ("drm/xe/device: implement transient flush")
    Signed-off-by: Jagmeet Randhawa 
    Reviewed-by: Jonathan Cavitt 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/0201b1d6ec64d3651fcbff1ea21026efa915126a.1765487866.git.jagmeet.randhawa@intel.com
    Signed-off-by: Matt Roper 

commit bd5840819aa12d1fc2831be1ceafb42237141be7
Author: Raag Jadav 
Date:   Fri Nov 28 14:14:14 2025 +0530

    drm/xe/cri: Enable I2C controller
    
    Enable I2C controller for Crescent Island and while at it, rely on
    has_i2c flag instead of manual platform checks.
    
    Signed-off-by: Raag Jadav 
    Reviewed-by: Heikki Krogerus 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251128084414.306265-1-raag.jadav@intel.com
    Signed-off-by: Matt Roper 

commit 63c7f93b6033800e9bc4eca02949dc9d12553138
Author: Jani Nikula 
Date:   Thu Dec 11 19:37:12 2025 +0200

    drm/{i915, xe}/panic: move panic handling to parent interface
    
    Move the panic handling to the display parent interface, making display
    more independent of i915 and xe driver implementations.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/e27eca5424479e8936b786018d0af19a34f839f6.1765474612.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit d6b80e904bb00a188d9a59be6bf7e19b89e3954f
Author: Jani Nikula 
Date:   Thu Dec 11 19:37:11 2025 +0200

    drm/i915/panic: move i915 specific panic implementation to i915
    
    The intel_panic.c implementation is i915 specific, and xe has its
    own. Move it to i915 core as i915_panic.c.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/8dc7af0ae1f859d17b0be269a545146c5536d8fc.1765474612.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 6601e0714bf08e6dfce04611796167255f63f222
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:03:05 2025 -0800

    drm/xe/doc: Add documentation for Multi Queue Group GuC interface
    
    Add kernel documentation for Multi Queue group GuC interface.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-36-niranjana.vishwanathapura@intel.com

commit 9a3e975d6619c6fb8997ca59361768b4ec853565
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:03:04 2025 -0800

    drm/xe/doc: Add documentation for Multi Queue Group
    
    Add kernel documentation for Multi Queue group and update
    the corresponding rst.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-35-niranjana.vishwanathapura@intel.com

commit 3131a43ecb346ae3b5287ee195779fc38c6fcd11
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:03:03 2025 -0800

    drm/xe/multi_queue: Support active group after primary is destroyed
    
    Add support to keep the group active after the primary queue is
    destroyed. Instead of killing the primary queue during exec_queue
    destroy ioctl, kill it when all the secondary queues of the group
    are killed.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-34-niranjana.vishwanathapura@intel.com

commit 91abe57c27084819848c4dad6bfd1a2065b24521
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:03:02 2025 -0800

    drm/xe/multi_queue: Tracepoint support
    
    Add xe_exec_queue_create_multi_queue event with
    multi-queue information.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-33-niranjana.vishwanathapura@intel.com

commit 8b81c76885e8f61681cf4c7d6d0ce816809e3b2f
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:03:01 2025 -0800

    drm/xe/multi_queue: Teardown group upon job timeout
    
    Upon a job timeout, teardown the multi-queue group by
    triggering TDR on all queues of the multi-queue group
    and by skipping timeout checks in them.
    
    v5: Ban the group while triggering TDR for the guc
        reported errors
        Add FIXME in TDR to take multi-queue group off HW
        (Matt Brost)
    v6: Trigger cleanup of group only for multi-queue case
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-32-niranjana.vishwanathapura@intel.com

commit bb9343f122add786c57a6e8865209a9c6671bc9b
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:03:00 2025 -0800

    drm/xe/multi_queue: Reset GT upon CGP_SYNC failure
    
    If GuC doesn't response to CGP_SYNC message, trigger
    GT reset and cleanup of all the queues of the multi
    queue group.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-31-niranjana.vishwanathapura@intel.com

commit c85285b32cc697d7612ee28a9ea9ded5e53d2b57
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:59 2025 -0800

    drm/xe/multi_queue: Handle CGP context error
    
    Trigger multi-queue context cleanup upon CGP context error
    notification from GuC.
    
    v4: Fix error message
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-30-niranjana.vishwanathapura@intel.com

commit 1b5d39e6672fdee158c3306f5cb2df8975c77e5a
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:58 2025 -0800

    drm/xe/multi_queue: Set QUEUE_DRAIN_MODE for Multi Queue batches
    
    To properly support soft light restore between batches
    being arbitrated at the CFEG, PIPE_CONTROL instructions
    have a new bit in the first DW, QUEUE_DRAIN_MODE. When
    set, this indicates to the CFEG that it should only
    drain the current queue.
    
    Additionally we no longer want to set the CS_STALL bit
    for these multi queue queues as this causes the entire
    pipeline to stall waiting for completion of the prior
    batch, preventing this soft light restore from occurring
    between queues in a queue group.
    
    v4: Assert !multi_queue where applicable (Matt Roper)
    
    Bspec: 56551
    Signed-off-by: Stuart Summers 
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20251211010249.1647839-29-niranjana.vishwanathapura@intel.com

commit d716a5088c88391daea7a3bd2b26589060309a79
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:57 2025 -0800

    drm/xe/multi_queue: Handle tearing down of a multi queue
    
    As all queues of a multi queue group use the primary queue of the group
    to interface with GuC. Hence there is a dependency between the queues of
    the group. So, when primary queue of a multi queue group is cleaned up,
    also trigger a cleanup of the secondary queues also. During cleanup, stop
    and re-start submission for all queues of a multi queue group to avoid
    any submission happening in parallel when a queue is being cleaned up.
    
    v2: Initialize group->list_lock, add fs_reclaim dependency, remove
        unwanted secondary queues cleanup (Matt Brost)
    v3: Properly handle cleanup of multi-queue group (Matt Brost)
    v4: Fix IS_ENABLED(CONFIG_LOCKDEP) check (Matt Brost)
        Revert stopping/restarting of submissions on queues of the
        group in TDR as it is not needed.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-28-niranjana.vishwanathapura@intel.com

commit 464a0bc0235f8333f77131433bb389a24efaf287
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:56 2025 -0800

    drm/xe/multi_queue: Add multi queue information to guc_info dump
    
    Dump multi queue specific information in the guc exec queue
    dump.
    
    v2: Move multi queue related fields inside the multi_queue
        sub-structure (Matt Brost)
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-27-niranjana.vishwanathapura@intel.com

commit 71e7d7e81d6a08c2abb1bb1ff01107280db62abb
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:55 2025 -0800

    drm/xe/multi_queue: Add support for multi queue dynamic priority change
    
    Support dynamic priority change for multi queue group queues via
    exec queue set_property ioctl. Issue CGP_SYNC command to GuC through
    the drm scheduler message interface for priority to take effect.
    
    v2: Move is_multi_queue check to exec_queue layer and assert
        is_multi_queue being set in guc submission layer (Matt Brost)
    v3: Assert CGP_SYNC message length is valid (Matt Brost)
    
    Signed-off-by: Pallavi Mishra 
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-26-niranjana.vishwanathapura@intel.com

commit 2a31ea17d5c69e51ea454485edd40e4aeff467c1
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:54 2025 -0800

    drm/xe/multi_queue: Add exec_queue set_property ioctl support
    
    This patch adds support for exec_queue set_property ioctl.
    It is derived from the original work which is part of
    https://patchwork.freedesktop.org/series/112188/
    
    Currently only DRM_XE_EXEC_QUEUE_SET_PROPERTY_MULTI_QUEUE_PRIORITY
    property can be dynamically set.
    
    v2: Check for and update kernel-doc which property this ioctl
        supports (Matt Brost)
    
    Signed-off-by: Matthew Brost 
    Signed-off-by: Pallavi Mishra 
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-25-niranjana.vishwanathapura@intel.com

commit d630abd6042dc186a3c113f68709818ad8a07a79
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:53 2025 -0800

    drm/xe/multi_queue: Handle invalid exec queue property setting
    
    Only MULTI_QUEUE_PRIORITY property is valid for secondary queues of a
    multi queue group. MULTI_QUEUE_PRIORITY only applies to multi queue group
    queues. Detect invalid user queue property setting and return error.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-24-niranjana.vishwanathapura@intel.com

commit 898a00f4b43311adfd4da1711ed2b72adc8c98a5
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:52 2025 -0800

    drm/xe/multi_queue: Add multi queue priority property
    
    Add support for queues of a multi queue group to set
    their priority within the queue group by adding property
    DRM_XE_EXEC_QUEUE_SET_PROPERTY_MULTI_QUEUE_PRIORITY.
    This is the only other property supported by secondary
    queues of a multi queue group, other than
    DRM_XE_EXEC_QUEUE_SET_PROPERTY_MULTI_QUEUE.
    
    v2: Add kernel doc for enum xe_multi_queue_priority,
        Add assert for priority values, fix includes and
        declarations (Matt Brost)
    v3: update uapi kernel-doc (Matt Brost)
    v4: uapi change due to rebase
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-23-niranjana.vishwanathapura@intel.com

commit bc5775c59258e1da6fe393845ee5cdd25ca618f3
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:51 2025 -0800

    drm/xe/multi_queue: Add GuC interface for multi queue support
    
    Implement GuC commands and response along with the Context
    Group Page (CGP) interface for multi queue support.
    
    Ensure that only primary queue (q0) of a multi queue group
    communicate with GuC. The secondary queues of the group only
    need to maintain LRCA and interface with drm scheduler.
    
    Use primary queue's submit_wq for all secondary queues of a multi
    queue group. This serialization avoids any locking around CGP
    synchronization with GuC.
    
    v2: Fix G2H_LEN_DW_MULTI_QUEUE_CONTEXT value, add more comments
        (Matt Brost)
    v3: Minor code refactro, use xe_gt_assert
    v4: Use xe_guc_ct_wake_waiters(), remove vf recovery support
        (Matt Brost)
    
    Signed-off-by: Stuart Summers 
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-22-niranjana.vishwanathapura@intel.com

commit d9ec63474648a258094704ce223c9249fa7bb279
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:50 2025 -0800

    drm/xe/multi_queue: Add user interface for multi queue support
    
    Multi Queue is a new mode of execution supported by the compute and
    blitter copy command streamers (CCS and BCS, respectively). It is an
    enhancement of the existing hardware architecture and leverages the
    same submission model. It enables support for efficient, parallel
    execution of multiple queues within a single context. All the queues
    of a group must use the same address space (VM).
    
    The new DRM_XE_EXEC_QUEUE_SET_PROPERTY_MULTI_QUEUE execution queue
    property supports creating a multi queue group and adding queues to
    a queue group. All queues of a multi queue group share the same
    context.
    
    A exec queue create ioctl call with above property specified with value
    DRM_XE_SUPER_GROUP_CREATE will create a new multi queue group with the
    queue being created as the primary queue (aka q0) of the group. To add
    secondary queues to the group, they need to be created with the above
    property with id of the primary queue as the value. The properties of
    the primary queue (like priority, timeslice) applies to the whole group.
    So, these properties can't be set for secondary queues of a group.
    
    Once destroyed, the secondary queues of a multi queue group can't be
    replaced. However, they can be dynamically added to the group up to a
    total of 64 queues per group. Once the primary queue is destroyed,
    secondary queues can't be added to the queue group.
    
    v2: Remove group->lock, fix xe_exec_queue_group_add()/delete()
        function semantics, add additional comments, remove unused
        group->list_lock, add XE_BO_FLAG_GGTT_INVALIDATE for cgp bo,
        Assert LRC is valid, update uapi kernel doc.
        (Matt Brost)
    v3: Use XE_BO_FLAG_PINNED_LATE_RESTORE/USER_VRAM/GGTT_INVALIDATE
        flags for cgp bo (Matt)
    v4: Ensure queue is not a vm_bind queue
        uapi change due to rebase
    
    Signed-off-by: Stuart Summers 
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-21-niranjana.vishwanathapura@intel.com

commit ee26c3b2765a34d1055660cbfd4f00766dd25412
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 10 17:02:49 2025 -0800

    drm/xe/multi_queue: Add multi_queue_enable_mask to gt information
    
    Add multi_queue_enable_mask field to the gt information structure
    which is bitmask of all engine classes with multi queue support
    enabled.
    
    v2: Rename multi_queue_enable_mask to multi_queue_engine_class_mask
        (Matt Brost)
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251211010249.1647839-20-niranjana.vishwanathapura@intel.com

commit 470cb09a2936d3c1ff8aeff46e3c14dcc4314e9b
Author: Dan Carpenter 
Date:   Fri Dec 5 14:09:25 2025 +0300

    drm/plane: Fix IS_ERR() vs NULL bug drm_plane_create_color_pipeline_property()
    
    The drm_property_create_enum() function returns NULL on error, it never
    returns error pointers.  Fix the error checking to match.
    
    Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property")
    Signed-off-by: Dan Carpenter 
    Signed-off-by: Simon Ser 
    Link: https://patch.msgid.link/aTK9ZR0sMgqSACow@stanley.mountain

commit 1b3d18de5535f2553d237d64a20f7a1a3947df68
Author: Jani Nikula 
Date:   Tue Dec 9 16:23:15 2025 +0200

    drm/vblank: prefer drm_crtc_vblank_crtc() over drm_vblank_crtc()
    
    Use the higher level function where crtc is available.
    
    v2: Rebase
    
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/29a29e746bc90c824d4f2bd15e42817dd7d0b199.1765290097.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 976dd750a14d4d0e680aa8f83265451976cddad7
Author: Jani Nikula 
Date:   Tue Dec 9 16:23:14 2025 +0200

    drm/vblank: use the drm_vblank_crtc() and drm_crtc_vblank_crtc() helpers more
    
    We have the helpers to avoid open coding dev->vblank[pipe] access.
    
    v2: Rebase
    
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/ad41f25c625d6a263b7e2e1d227cb14c5d0ce204.1765290097.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit e547890b9ae32202f280105b8725d64fd3934d73
Author: Jani Nikula 
Date:   Tue Dec 9 16:23:13 2025 +0200

    drm/vblank: limit vblank variable scope to atomic
    
    In drm_crtc_vblank_helper_get_vblank_timestamp_internal(), we only need
    the vblank variable for atomic modesetting. Limit the scope to make
    upcoming changes easier.
    
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/b50f0bff654a6902ffd7ae52c31d46fad9ed7540.1765290097.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 65defc4a780885687b9ff669e6276f7ba7ffd8e9
Author: Jani Nikula 
Date:   Tue Dec 9 16:23:12 2025 +0200

    drm/vblank: add return value to drm_crtc_wait_one_vblank()
    
    Let drivers deal with the vblank wait failures if they so desire. If the
    current warning backtrace gets toned down to a simple warning message,
    the drivers may wish to add the backtrace themselves.
    
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/7f2de4dd170771991756073f037c7ca043c3e746.1765290097.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 04f0aa5d69b88e4b9078d2e5aa3a970c71917850
Author: Jani Nikula 
Date:   Tue Dec 9 16:23:11 2025 +0200

    drm/vblank: remove superfluous pipe check
    
    Now that the pipe is crtc->pipe, there's no need to check it's within
    range.
    
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/ced963542bfb00c2f1a653e9e5f717fccbd25132.1765290097.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 128d6e6255ea7c0f4d55d45025d1ce0343f6cd46
Author: Jani Nikula 
Date:   Tue Dec 9 16:23:10 2025 +0200

    drm/vblank: remove drm_wait_one_vblank() completely
    
    There's really no need for the extra static function at all.
    
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/fe969aad198d3f151fafd01faca5b0e73bfd9a03.1765290097.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 041baffb84a64ea792224852778a7ff7ddd3cefc
Author: Thomas Zimmermann 
Date:   Tue Dec 9 16:23:09 2025 +0200

    drm/vblank: Unexport drm_wait_one_vblank()
    
    Make drm_wait_on_vblank() static. The function is an internal interface
    and not invoked directly by drivers.
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Thomas Zimmermann 
    Link: https://patch.msgid.link/b0ab9833a85f5fb6de95ad6cb0216864bf860c9e.1765290097.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 7319c2ceb2d74d54f24b7f5409b97aed406f0189
Author: Satyanarayana K V P 
Date:   Wed Dec 10 05:25:49 2025 +0000

    drm/xe/vf: Reset recovery_queued after issuing RESFIX_START
    
    During VF_RESTORE or VF_RESUME, the GuC sends a migration interrupt and
    clears the RESFIX_START marker. If migration or resume occurs before the
    VF issues its own RESFIX_START, VF KMD may receive two back-to-back
    migration interrupts. VF then sends RESFIX_START to indicate the beginning
    of fixups and RESFIX_DONE to mark completion. However, the second
    RESFIX_START fails because the GuC is already in the RUNNING state.
    
    Clear the recovery_queued flag after sending a RESFIX_START message to
    ignore duplicated IRQs seen before we start actual recovery.
    
    This ensures the state is reset only after the fixup process begins,
    avoiding redundant work item queuing.
    
    Fixes: b5fbb94341a2 ("drm/xe/vf: Introduce RESFIX start marker support")
    Signed-off-by: Satyanarayana K V P 
    Cc: Michal Wajdeczko 
    Cc: Matthew Brost 
    Cc: Tomasz Lis 
    Reviewed-by: Matthew Brost 
    Reviewed-by: Michal Wajdeczko 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251210052546.622809-6-satyanarayana.k.v.p@intel.com

commit 8d8cf42b03f149dcb545b547906306f3b474565e
Author: Satyanarayana K V P 
Date:   Wed Dec 10 05:25:48 2025 +0000

    drm/xe/vf: Fix queuing of recovery work
    
    Ensure VF migration recovery work is only queued when no recovery is
    already queued and teardown is not in progress.
    
    Fixes: b47c0c07c350 ("drm/xe/vf: Teardown VF post migration worker on driver unload")
    Signed-off-by: Satyanarayana K V P 
    Cc: Michal Wajdeczko 
    Cc: Matthew Brost 
    Cc: Tomasz Lis 
    Reviewed-by: Michal Wajdeczko 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251210052546.622809-5-satyanarayana.k.v.p@intel.com

commit d2e8d1bc840b849fc23d8812995645cc79990e7b
Author: Luca Ceresoli 
Date:   Wed Nov 12 17:34:35 2025 +0100

    drm/bridge: ti-sn65dsi83: protect device resources on unplug
    
    To support hot-unplug of this bridge we need to protect access to device
    resources in case sn65dsi83_remove() happens concurrently to other code.
    
    Some care is needed for the case when the unplug happens before
    sn65dsi83_atomic_disable() has a chance to enter the critical section
    (i.e. a successful drm_bridge_enter() call), which occurs whenever the
    hardware is removed while the display is active. When that happens,
    sn65dsi83_atomic_disable() in unable to release the resources taken by
    sn65dsi83_atomic_pre_enable().
    
    To ensure those resources are released exactly once on device removal:
    
     * move the code to release them to a dedicated function
     * register that function when the resources are taken in
       sn65dsi83_atomic_pre_enable()
     * if sn65dsi83_atomic_disable() happens before sn65dsi83_remove()
       (typical non-hot-unplug case):
       * sn65dsi83_atomic_disable() can enter the critical section
         (drm_bridge_enter() returns 0) -> it releases and executes the
         devres action
     * if sn65dsi83_atomic_disable() happens after sn65dsi83_remove()
       (typical hot-unplug case):
       * sn65dsi83_remove() -> drm_bridge_unplug() prevents
         sn65dsi83_atomic_disable() from entering the critical section
         (drm_bridge_enter() returns nonzero), so sn65dsi83_atomic_disable()
         cannot release and execute the devres action
       * the devres action is executed at the end of sn65dsi83_remove()
    
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251112-drm-bridge-atomic-vs-remove-v3-2-85db717ce094@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit d36137085a4aa2d2f039359a0d67d9e07667f2de
Author: Luca Ceresoli 
Date:   Wed Nov 12 17:34:34 2025 +0100

    drm/bridge: add drm_bridge_unplug() and drm_bridge_enter/exit()
    
    To allow DRM bridges to be removable, add synchronization functions
    allowing to tell when a bridge hardware has been physically unplugged and
    to mark a critical section that should not be entered after that.
    
    This is inspired by the drm_dev_unplugged/enter/exit() functions for struct
    drm_device.
    
    Suggested-by: Maxime Ripard 
    Link: https://lore.kernel.org/all/20250106-vigorous-talented-viper-fa49d9@houat/
    Reviewed-by: Maxime Ripard 
    Link: https://patch.msgid.link/20251112-drm-bridge-atomic-vs-remove-v3-1-85db717ce094@bootlin.com
    Signed-off-by: Luca Ceresoli 

commit a4ebfb9d95d78a12512b435a698ee6886d712571
Author: Thomas Hellström 
Date:   Tue Dec 9 21:49:20 2025 +0100

    drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
    
    Some Xe bos are allocated with extra backing-store for the CCS
    metadata. It's never been the intention to share the CCS metadata
    when exporting such bos as dma-buf. Don't include it in the
    dma-buf sg-table.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Cc: Rodrigo Vivi 
    Cc: Matthew Brost 
    Cc: Maarten Lankhorst 
    Cc:  # v6.8+
    Signed-off-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Reviewed-by: Karol Wachowski 
    Link: https://patch.msgid.link/20251209204920.224374-1-thomas.hellstrom@linux.intel.com

commit 8e011f6d08abcd740a9c5157b2f79512a579bced
Author: Francois Dugast 
Date:   Wed Dec 10 17:50:00 2025 +0100

    drm/xe/hw_engine_group: Add stats for mode switching
    
    The GT stats interface is extended to include counters of how many
    queues are either interrupted or waited on in the hardware engine
    groups. This can help application debugging.
    
    v2: Rename to queue as those operations are queue-based (Matthew Brost)
    
    Cc: Matthew Brost 
    Cc: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://lore.kernel.org/r/20251210165000.60789-1-francois.dugast@intel.com
    Signed-off-by: Francois Dugast 

commit 3efadf028783a49ab2941294187c8b6dd86bf7da
Author: Junxiao Chang 
Date:   Fri Nov 7 11:31:52 2025 +0800

    drm/me/gsc: mei interrupt top half should be in irq disabled context
    
    MEI GSC interrupt comes from i915 or xe driver. It has top half and
    bottom half. Top half is called from i915/xe interrupt handler. It
    should be in irq disabled context.
    
    With RT kernel(PREEMPT_RT enabled), by default IRQ handler is in
    threaded IRQ. MEI GSC top half might be in threaded IRQ context.
    generic_handle_irq_safe API could be called from either IRQ or
    process context, it disables local IRQ then calls MEI GSC interrupt
    top half.
    
    This change fixes B580 GPU boot issue with RT enabled.
    
    Fixes: e02cea83d32d ("drm/xe/gsc: add Battlemage support")
    Tested-by: Baoli Zhang 
    Signed-off-by: Junxiao Chang 
    Reviewed-by: Sebastian Andrzej Siewior 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251107033152.834960-1-junxiao.chang@intel.com
    Signed-off-by: Maarten Lankhorst 

commit 6a99e91a6ca8fec5882450128fb128265f86b32a
Author: Tvrtko Ursulin 
Date:   Tue Dec 9 13:00:34 2025 +0100

    drm/i915/display: Detect AuxCCS support via display parent interface
    
    Whether AuxCCS can be properly supported depends on the support both from
    the display side and non-display side of the driver.
    
    Let us therefore allow for the non-display part to be queried via the
    display parent interface.
    
    The new interface replaces the HAS_AUX_CCS macro and we also remove the
    FIXME from skl_universal_plane_create since now the xe will not advertise
    the AuxCCS caps to start with so they do not need to be removed after
    enumeration.
    
    Also, by removing this build specific FIXME we come a step closer to fully
    de-coupling display and non-display.
    
    The existing HAS_AUX_CCS gets renamed to HAS_AUX_DIST since it is still
    required for determining the need for PLANE_AUX_DIST programming.
    
    Signed-off-by: Tvrtko Ursulin 
    References: cf48bddd31de ("drm/i915/display: Disable AuxCCS framebuffers if built for Xe")
    Cc: intel-gfx@lists.freedesktop.org
    Cc: intel-xe@lists.freedesktop.org
    Cc: Jani Nikula 
    Cc: José Roberto de Souza 
    Cc: Juha-Pekka Heikkila 
    Cc: Rodrigo Vivi 
    Cc: Ville Syrjälä 
    Acked-by: Jani Nikula  # v1
    Reviewed-by: Jani Nikula 
    Signed-off-by: Tvrtko Ursulin 
    Link: https://lore.kernel.org/r/20251209120034.9143-1-tursulin@igalia.com

commit a1542b8ca6edabbb42ec4141e55d0d0710c9b6df
Author: Eslam Khafagy 
Date:   Tue Nov 25 21:38:45 2025 +0200

    drm: pl111: replace dev_* print functions with drm_* variants
    
    Update the PL111 CLCD driver to use DRM print macros drm_*() instead of
    dev_*(). This change ensures consistency with DRM subsystem
    logging conventions [1].
    
    [1]
    Link: https://docs.kernel.org/gpu/todo.html#convert-logging-to-drm-functions-with-drm-device-parameter
    
    Signed-off-by: Eslam Khafagy 
    Signed-off-by: Linus Walleij 
    Link: https://patch.msgid.link/20251125193845.425416-1-eslam.medhat1993@gmail.com

commit f24e96d69f5b9eb0f3b9c49e53c385c50729edfd
Author: Hawking Zhang 
Date:   Mon Jun 16 16:16:18 2025 +0800

    drm/amdgpu: Set xcp id for mes ring
    
    Set xcp id for mes ring
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 9987a6f34e4ed074c4868d8cc5d075594c019736
Author: Hawking Zhang 
Date:   Sun Jun 15 14:28:20 2025 +0800

    drm/amdgpu: Init partition_mode and xcc_mask for GFX_IMU_PARTITION_SWITCH
    
    Set partition_mode and physical xcc mask fields in
    GFX_IMU_PARTITION_SWITCH register
    
    v2: cleanup (Alex)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit e2a6a4e6d408c0466136cecc2439278a6aaf604b
Author: Hawking Zhang 
Date:   Fri Jun 13 00:08:10 2025 +0800

    drm/amdgpu: Initialize vram_info for gmc v12_1
    
    Initialize vram_info for gmc v12_1
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit bb418f99e6174d10f662dae4638837933bc4752d
Author: Hawking Zhang 
Date:   Thu Jun 12 11:47:58 2025 +0800

    drm/amdgpu: Init compute partition mode for gfx v12_1
    
    Init compute partition mode for gfx v12_1
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit c58d8a6620cf2654bdd0732e85bc351660af4c0c
Author: Hawking Zhang 
Date:   Sun Jun 15 14:22:13 2025 +0800

    drm/amdgpu: Initialize memory ranges for gmc v12_1
    
    Initialize memory ranges for gmc v12_1
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 51b9bb61e5bbfb488b080d1e85ae681ee95a0731
Author: Hawking Zhang 
Date:   Sun Jun 15 14:21:10 2025 +0800

    drm/amdgpu: Initialize memory partition callbacks for gmc v12_1
    
    Initialize memory partition callbacks for gmv v12_1
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 7e40fe89dd9cb40c2a05f22dbfbbd425cd59a018
Author: Likun Gao 
Date:   Mon Jun 16 17:42:09 2025 +0800

    drm/amdgpu: support rlc autoload for muti-xcc
    
    Support rlc autload for muti-xcc on gfx v12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit ef7d4a6a497a947e863d94e729fb349afdf98b01
Author: Hawking Zhang 
Date:   Wed Jun 11 21:58:54 2025 +0800

    drm/amdgpu: Enable atomics for all the available xcc
    
    Apply TCP_UTCL0_CNTL1 settings to all the available
    xcc
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 3235a5b72317be613b69e22c3b2c9f2bec546253
Author: Mukul Joshi 
Date:   Mon Apr 28 22:08:10 2025 -0400

    drm/amdgpu: Update MES VM_CNTX_CNTL for XNACK off for GFX 12.1
    
    Currently, we do not turn off retry faults in VM_CONTEXT_CNTL value
    when passing it to MES if XNACK is off. This creates a situation where
    XNACK is disabled in SQ but enabled in UTCL2, which is not recommended.
    As a result, turn off/on retry faults in both SQ and UTCL2 when passing
    vm_context_cntl value to MES if XNACK is disabled/enabled.
    
    Suggested-by: Jay Cornwall 
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit cc52af1a961ff85ee1940d8d843dfc8f374f81b5
Author: Mukul Joshi 
Date:   Wed Mar 26 22:16:21 2025 -0400

    drm/amdkfd: Enable per-process XNACK for GFX 12.1.0
    
    GFX 12.1.0 will support enabling/disabling XNACK on a per-
    process basis. This change enables the per process XNACK feature.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit 6f894c92490be1bb27492a82544b4b1e4ad20915
Author: Mukul Joshi 
Date:   Wed Mar 26 22:06:39 2025 -0400

    drm/amdgpu: Enable retry faults for GFX 12.1
    
    Enable retry faults in both GCVM/MMVM Context1 Control
    and L2_PROTECTION_FAULT_CNTL2 registers for GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit b79040d1136aeec48459f433a7b14e192475ee88
Author: Mukul Joshi 
Date:   Fri Jun 6 15:19:26 2025 -0400

    drm/amdgpu: Add IH node-id to XCC mapping
    
    Add a generic function to map IH node-id to XCC instance.
    
    Signed-off-by: Likun Gao 
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 4c5f7d73883355990a4eb1964a02fc5664cfcf22
Author: Mukul Joshi 
Date:   Fri Feb 28 21:48:19 2025 -0500

    drm/amdgpu: Add interrupt handler for GFX 12.1.0
    
    Add a separate interrupt handler for handling interrupts,
    both retry and no-retry, for GFX 12.1.0.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Philip Yang 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 00e08fb2e7ce88e2ae366cbc79997d71d014b0ac
Author: Mukul Joshi 
Date:   Wed Apr 16 22:46:19 2025 -0400

    drm/amdgpu: Add UTCL2 Retry fault interrupt for GFX 12.1
    
    Add the UTCL2 retry fault interrupt for both GCVM and MMVM for GFX 12.1.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit c28a1142766f9d80880c556fde4b94c3ad00ac96
Author: Alex Deucher 
Date:   Fri Oct 10 15:54:49 2025 -0400

    drm/amdgpu/sdma: add query for CSA size and alignment
    
    Needed to query the CSA size and alignment for SDMA
    user queues.
    
    Reviewed-by: Prike Liang 
    Signed-off-by: Alex Deucher 

commit f9f3240018e8f5b68bb791102d4736b5883d8aab
Author: chong li 
Date:   Fri Nov 28 10:51:51 2025 +0800

    drm/amdgpu: fix mes packet params issue when flush hdp.
    
    v4:
    use func "amdgpu_gfx_get_hdp_flush_mask" to get ref_and_mask for
    gfx9 through gfx12.
    
    v3:
    Unify the get_ref_and_mask function in amdgpu_gfx_funcs,
    to support both GFX11 and earlier generations
    
    v2:
    place "get_ref_and_mask" in amdgpu_gfx_funcs instead of amdgpu_ring,
    since this function only assigns the cp entry.
    
    v1:
    both gfx ring and mes ring use cp0 to flush hdp, cause conflict.
    
    use function get_ref_and_mask to assign the cp entry.
    reassign mes to use cp8 instead.
    
    Signed-off-by: chong li 
    Acked-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit e26e4225ae57faf7cd512df645b2c866fc2dce75
Author: Alex Deucher 
Date:   Fri Oct 10 15:52:51 2025 -0400

    drm/amdgpu/gfx: add eop size and alignment to shadow info
    
    This is used by firmware for compute user queues.
    
    Reviewed-by: Prike Liang 
    Signed-off-by: Alex Deucher 

commit 90254524ee84ef812e6329a14dd76e9f53db5023
Author: Candice Li 
Date:   Fri Dec 5 09:16:26 2025 +0800

    drm/amd/ras: Add vram_type to ras_ta_init_flags
    
    Add vram_type to ras_ta_init_flags.
    
    Signed-off-by: Candice Li 
    Reviewed-by: Tao Zhou 
    Signed-off-by: Alex Deucher 

commit d6e81483282143d80c495a84b1e3fda31e77dedb
Author: Likun Gao 
Date:   Mon Jun 9 17:19:25 2025 +0800

    drm/amdgpu: update sdma configuration for soc v1_0
    
    Update SDMA instances/masks according to xcc num for
    multi-xcc models on soc v1.0.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit f9ed1d463ecdd265059ebcc8642651e59588c6fd
Author: Hawking Zhang 
Date:   Fri Jun 6 00:38:51 2025 +0800

    drm/amdgpu: Initialize xcp manager for soc v1_0
    
    Initialize xcp manager for soc v1_0
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit a936896135633d3e9d6aad12b88d8be929ea306c
Author: Hawking Zhang 
Date:   Fri Jun 6 00:27:39 2025 +0800

    drm/amdgpu: Add soc_v1_0_xcp_funcs
    
    Implement xcp mgr callbacks for soc v1_0
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit e90a43c0c24e879bf3c7d541cf813f136636b1d2
Author: Hawking Zhang 
Date:   Fri Jun 6 00:14:24 2025 +0800

    drm/amdgpu: Export sdma_v7_1_xcp_funcs
    
    To be used by soc v1_0 xcp manager
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 4fbc61018b48e5373ff3a80b730620e530f0e85c
Author: Hawking Zhang 
Date:   Fri Jun 6 00:12:54 2025 +0800

    drm/amdgpu: Export gfx_v12_1_xcp_func
    
    To be used by soc v1_0 xcp manager
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 2e133eda97c447d11997f2e2953e7d39b0096698
Author: Candice Li 
Date:   Fri Dec 5 09:10:19 2025 +0800

    drm/amdgpu: Add vram_type to ras init_flags
    
    Add vram_type to ras init_flags.
    
    Signed-off-by: Candice Li 
    Reviewed-by: Tao Zhou 
    Signed-off-by: Alex Deucher 

commit 6ef93f62533e4176f0aa94d125d742b778cee07e
Author: Srinivasan Shanmugam 
Date:   Fri Dec 5 17:45:10 2025 +0530

    drm/amd/ras: Reduce stack usage in amdgpu_virt_ras_get_cper_records()
    
    amdgpu_virt_ras_get_cper_records() was using a large stack array
    of ras_log_info pointers. This contributed to the frame size
    warning on this function.
    
    Replace the fixed-size stack array:
    
        struct ras_log_info *trace[MAX_RECORD_PER_BATCH];
    
    with a heap-allocated array using kcalloc().
    
    We free the trace buffer together with out_buf on all exit paths.
    If allocation of trace or out_buf fails, we return a generic RAS
    error code.
    
    This reduces stack usage and keeps the runtime behaviour
    unchanged.
    
    Fixes:
    stack frame size: 1112 bytes (limit: 1024)
    
    Cc: Tao Zhou 
    Cc: Hawking Zhang 
    Cc: Christian König 
    Cc: Alex Deucher 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Tao Zhou 
    Signed-off-by: Alex Deucher 

commit 5b57c3c3f22336e8fd5edb7f0fef3c7823f8eac1
Author: Philip Yang 
Date:   Wed Nov 19 16:32:45 2025 -0500

    drm/amdkfd: Handle GPU reset and drain retry fault race
    
    Only check and drain IH1 ring if CAM is not enabled.
    
    If GPU is under reset, don't access IH to drain retry fault.
    
    Signed-off-by: Philip Yang 
    Reviewed-by: Harish Kasiviswanathan 
    Signed-off-by: Alex Deucher 

commit e1c94109c76e8a77a21531bd53f6c63356c81158
Author: Mario Limonciello 
Date:   Tue Dec 9 11:14:47 2025 -0600

    Revert "drm/amd/display: Fix pbn to kbps Conversion"
    
    Deeply daisy chained DP/MST displays are no longer able to light
    up. This reverts commit e0dec00f3d05 ("drm/amd/display: Fix pbn
    to kbps Conversion")
    
    Cc: Jerry Zuo 
    Reported-by: nat@nullable.se
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4756
    Signed-off-by: Mario Limonciello 
    Acked-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 84d8beaf11571d45f1a46b7c39fc374026f3f072
Author: Hawking Zhang 
Date:   Fri Jun 6 00:11:10 2025 +0800

    drm/amdgpu: Add switch_compute_partition callback for imu v12_1
    
    To enable switching compute partition mode
    
    v2: cleanup (Alex)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 7ce7234189a84b1e0a8088b725d400c56ccdab3a
Author: Hawking Zhang 
Date:   Mon Dec 8 17:00:46 2025 -0500

    drm/amdgpu: Implement gfx_v12_1_get_xccs_per_xcp
    
    Use gfx v12_1 callback to query the numbers of xccs
    per xcp
    
    v2: add todo (Alex)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit b7cb3669b6645e36d21d005d45790ff4c5e0f4a1
Author: Hawking Zhang 
Date:   Tue May 27 23:45:46 2025 +0800

    drm/amdgpu: Remove redundant check for async_gfx_ring
    
    Remove the redundant check for async_gfx_ring,
    as it is not required for gfx v12_1
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit d0b6c5f226a0477c047c48d6914bf7dc6096acf7
Author: Likun Gao 
Date:   Thu Jun 5 10:36:07 2025 +0800

    drm/amdgpu: disable graphics doorbell range for gfx v12_1
    
    Disable doorbell range for graphics engine on gfx v12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 77385a2dc18a3fb6353df9a9c002755e41ff9b6b
Author: Likun Gao 
Date:   Thu Jun 5 10:34:32 2025 +0800

    drm/amdgpu: enable unmap doorbell handle for gfx v12_1
    
    Enable unmapped doorbell handling for gfx v12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit c90ed18114f984d069a201406a92cfa4710b5578
Author: Likun Gao 
Date:   Wed May 21 08:52:36 2025 +0800

    drm/amdgpu: revision doorbel range for gfx v12_1
    
    Revision doorbell range on muti-XCC mode for gfx v12_1.
    Clean up doorbell range set for graphics engine.
    V2: Remove doorbell range set from gfx_v12_1_xcc_kiq_init_register.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit cf356fe11dd42fb91f3a3f9b990cf237a3ce9841
Author: Jonathan Kim 
Date:   Mon May 26 15:39:45 2025 -0400

    drm/amdkfd: disable shader message vgpr deallocation on gc 12.1
    
    Shader messages to deallocate VGPRs prior to shader end can prevent
    the trap handler from saving context, making debugging and core dumps
    unreliable.
    
    VGPR deallocations for performance gain is negligible.
    GC 12.1 will NOP shader VGPR deallocation messages via HW
    settings on driver boot.
    
    Signed-off-by: Jonathan Kim 
    Acked-by: Harish Kasiviswanathan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 8e0187aec67a9f71e5b3726c1979e1d68db552ca
Author: Hawking Zhang 
Date:   Mon May 26 15:49:42 2025 +0800

    drm/amdgpu: Remove redundant pmfw backdoor loading
    
    PMFW is integrated into ifwi for gfx 12_1 adapter,
    making PMFW backdoor loading unnecessary.
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit d717e62e9b6ccff0e3cec78a58dfbd00858448b3
Author: Mario Limonciello (AMD) 
Date:   Mon Dec 8 22:46:46 2025 -0600

    drm/amd: Fix unbind/rebind for VCN 4.0.5
    
    Unbinding amdgpu has no problems, but binding it again leads to an
    error of sysfs file already existing.  This is because it wasn't
    actually cleaned up on unbind.  Add the missing cleanup step.
    
    Fixes: 547aad32edac ("drm/amdgpu: add VCN4 ip block support")
    Signed-off-by: Mario Limonciello (AMD) 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 495b190480dc78ad2dd10f8b96dfb5747fa48c4d
Author: Srinivasan Shanmugam 
Date:   Fri Dec 5 16:48:50 2025 +0530

    drm/amdgpu/acpi: Reduce amdgpu_acpi_detect stack usage
    
    amdgpu_acpi_detect() calls some helper functions it calls have large
    local structures.  When the compiler inlines these helpers, their local
    data adds to the amdgpu_acpi_detect() stack frame.
    
    Mark the helpers with noinline_for_stack:
    - amdgpu_atif_verify_interface()
    - amdgpu_atif_get_notification_params()
    - amdgpu_atif_query_backlight_caps()
    - amdgpu_atcs_verify_interface()
    - amdgpu_acpi_enumerate_xcc()
    
    This keeps the large temporary objects inside the helper’s own stack
    frame instead of being inlined into the caller, preventing the caller
    from growing beyond the stack limit.
    
    Fixes the below with gcc W=1:
    drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:1403:6: warning: stack frame size (1688) exceeds limit (1024) in 'amdgpu_acpi_detect' [-Wframe-larger-than]
    
    Cc: Alex Deucher 
    Cc: Christian König 
    Signed-off-by: Srinivasan Shanmugam 
    Acked-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 1898840d6c4405092243bb7dfcc399ccb1177498
Author: Julia Filipchuk 
Date:   Mon Nov 24 17:41:40 2025 -0800

    drm/xe/guc: Recommend GuC v70.54.0 for BMG, PTL
    
    UAPI compatibility version 1.27.0
    
    Update recommended GuC version for BMG, PTL.
    
    Signed-off-by: Julia Filipchuk 
    Reviewed-by: Daniele Ceraolo Spurio 
    Signed-off-by: Vinay Belgaumkar 
    Link: https://patch.msgid.link/20251125014134.2075988-15-julia.filipchuk@intel.com

commit 74a658229bb027964713522706254b727373aa3b
Author: Julia Filipchuk 
Date:   Mon Nov 24 17:41:39 2025 -0800

    drm/xe/guc: Recommend GuC v70.53.0 for MTL, DG2, LNL
    
    UAPI compatibility version 1.26.0
    
    Update recommended GuC version for MTL, DG2, LNL.
    
    Signed-off-by: Julia Filipchuk 
    Reviewed-by: Daniele Ceraolo Spurio 
    Signed-off-by: Vinay Belgaumkar 
    Link: https://patch.msgid.link/20251125014134.2075988-14-julia.filipchuk@intel.com

commit 3d32eb7a5ecff92d83a5fd34c45c171c17d3d5d0
Author: Lizhi Hou 
Date:   Tue Dec 9 13:16:39 2025 -0800

    accel/amdxdna: Fix cu_idx being cleared by memset() during command setup
    
    For one command type, cu_idx is assigned before calling memset() on the
    command structure. This results in cu_idx being overwritten, causing the
    firmware to receive an incomplete or invalid command and leading to
    unexpected command failures.
    
    Fix this by moving the memset() call before initializing cu_idx so that
    all fields are populated in the correct order.
    
    Fixes: 71829d7f2f70 ("accel/amdxdna: Use MSG_OP_CHAIN_EXEC_NPU when supported")
    Reviewed-by: Mario Limonciello (AMD) 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251209211639.1636888-1-lizhi.hou@amd.com

commit ff9e240212f6693c293f9e58ade05bc887297a1e
Author: Loïc Molinari 
Date:   Wed Dec 10 15:36:17 2025 +0100

    drm/i915: Fix BO alloc flags
    
    I915_BO_ALLOC_NOTHP must be added to the I915_BO_ALLOC_FLAGS mask in
    order to pass GEM_BUG_ON() valid flags checks.
    
    v2:
    - Add Tvrtko's A-b
    
    Reported-by: Chaitanya Kumar Borah 
    Closes: https://lore.kernel.org/intel-gfx/d73adfa8-d61b-46b3-9385-dde53d8db8ad@intel.com/
    Fixes: a8a9a590221c ("drm/i915: Use huge tmpfs mountpoint helpers")
    Suggested-by: Tvrtko Ursulin 
    Signed-off-by: Loïc Molinari 
    Acked-by: Tvrtko Ursulin 
    Acked-by: Tvrtko Ursulin 
    Link: https://patch.msgid.link/20251210143617.712808-1-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit c29ceb0fecda82067d424199a37474319331f265
Author: Imre Deak 
Date:   Tue Dec 9 17:34:07 2025 +0200

    drm/i915/cx0: Convert C10 PHY PLL SSC state mismatch WARN to a debug message
    
    On C10 PHY PLLs the SSC is enabled by programming the
    XELPDP_PORT_CLOCK_CTL / XELPDP_SSC_ENABLE_PLLB flag and the
    PHY_C10_VDR_PLL 4..8 registers:
    
    - If SSC is enabled XELPDP_SSC_ENABLE_PLLB is set and the
      PHY_C10_VDR_PLL registers are programmed to non-zero values.
    - If SSC is disabled XELPDP_SSC_ENABLE_PLLB is cleared and the
      PHY_C10_VDR_PLL registers are programmed to zeroed-out values.
    
    The driver's state checker verifies if the above settings are consistent,
    i.e. if XELPDP_SSC_ENABLE_PLLB being set corresponds to the
    PHY_C10_VDR_PLL registers being zeroed-out or not.
    
    On WCL the BIOS programs non-zero values to the PHY_C10_VDR_PLL 4..8
    registers, but does not set the XELPDP_SSC_ENABLE_PLLB flag. This will
    trigger the following PLL state check warning during driver loading:
    
    <4>[   44.457809] xe 0000:00:02.0: [drm] PHY B: SSC enabled state (no), doesn't match PLL configuration (SSC-enabled)
    <4>[   44.457833] WARNING: CPU: 4 PID: 298 at drivers/gpu/drm/i915/display/intel_cx0_phy.c:2281 intel_cx0pll_readout_hw_state+0x221/0x620 [xe]
    
    It's not clear whether the HW uses the PHY_C10_VDR_PLL 4..8 register
    values if the XELPDP_SSC_ENABLE_PLLB flag is cleared, or just ignores
    them in this case. Since the driver always programs the register values
    according to the above, it still makes sense to verify that the
    programming happened correctly.
    
    To avoid the state check WARN during driver loading due to the way BIOS
    programs the registers, convert the WARN to a debug message.
    
    While at it clarify the debug message.
    
    v2: Clarify the debug message. (Jani)
    
    Cc: Jani Nikula 
    Cc: Mika Kahola 
    Reviewed-by: Mika Kahola 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251209153407.1791839-1-imre.deak@intel.com

commit ad9f266be8b2db26c7cc754d401278959bb7895c
Author: Boris Brezillon 
Date:   Tue Dec 9 18:11:51 2025 +0100

    drm/gem: Fix builds with CONFIG_MMU=n
    
    drm_gem_get_unmapped_area() relies on mm_get_unmapped_area() which is
    only available if CONFIG_MMU=y.
    
    Fixes: 99bda20d6d4c ("drm/gem: Introduce drm_gem_get_unmapped_area() fop")
    Cc: Loïc Molinari 
    Reviewed-by: Loïc Molinari 
    Link: https://patch.msgid.link/20251209171151.2449120-1-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit eabccffbe0a06f8cdba5c37e295c7690f86c57a4
Author: Jouni Högander 
Date:   Thu Dec 4 09:07:18 2025 +0200

    drm/i915/psr: Allow async flip when Selective Fetch enabled
    
    Now as Selective Fetch is performing full frame update on async flip and
    vblank evasion is done as needed we can allow async flip even when
    Selective Fetch is enabled.
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251204070718.1090778-4-jouni.hogander@intel.com

commit e540c47fc08e4480118e1f1b68adaf688d172528
Author: Jouni Högander 
Date:   Thu Dec 4 09:07:17 2025 +0200

    drm/i915/psr: Perform full frame update on async flip
    
    According to bspec selective fetch is not supported with async flips and
    instructing full frame update on async flip.
    
    v4:
      - check crtc_state->async_flip_planes in
        psr2_sel_fetch_pipe_state_supported
    v3:
      - rebase
      - fix old_crtc_state->pipe_srcsz_early_tpt
      - fix using intel_atomic_get_new_crtc_state
    v2:
      - check also crtc_state->async_flip_planes in
        psr2_sel_fetch_plane_state_supported
    
    Bspec: 55229
    Signed-off-by: Jouni Högander 
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251204070718.1090778-3-jouni.hogander@intel.com

commit 1f5df537fa7910a6bdc96a7cb73c65fd30e2aab5
Author: Jouni Högander 
Date:   Thu Dec 4 09:07:16 2025 +0200

    drm/i915/psr: Set plane id bit in crtc_state->async_flip_planes for PSR
    
    Currently plane id bit is set in crtc_state->async_flip_planes only when
    async flip toggle workaround is needed. We want to utilize
    crtc_state->async_flip_planes further in Selective Fetch calculation.
    
    v2:
      - rework if-else if to if-if
      - added comment updated
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251204070718.1090778-2-jouni.hogander@intel.com

commit 0c085485a90351bb38dc97c2df99ac2038d0d87c
Author: Jani Nikula 
Date:   Fri Dec 5 12:30:30 2025 +0200

    drm/{i915, xe}/stolen: make insert_node, area_address, area_size optional
    
    Since the stolen memory hooks are function pointers, make some of them
    optional instead of having to define them for xe.
    
    insert_node, area_address, and area_size are only needed on platforms
    not supported by xe.
    
    Reviewed-by: Vinod Govindapillai 
    Link: https://patch.msgid.link/0dbb460e8bd1df29df98862d08fcdfda03912673.1764930576.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit d6c862572b69fd92f1793738e2e8d7d326ba0740
Author: Jani Nikula 
Date:   Fri Dec 5 12:30:29 2025 +0200

    drm/{i915, xe}/stolen: move stolen memory handling to display parent interface
    
    Call the stolen memory interface through the display parent interface.
    
    This makes xe compat gem/i915_gem_stolen.h redundant, and it can be
    removed.
    
    v2: Rebase, convert one more call that appeared
    
    Reviewed-by: Vinod Govindapillai 
    Link: https://patch.msgid.link/350c82c49fe40f6319d14d309180e2e2752145ac.1764930576.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 2397a4c6624a8e192de8e4443fab578b41d9deca
Author: Jani Nikula 
Date:   Fri Dec 5 12:30:28 2025 +0200

    drm/xe/stolen: unify interface with i915
    
    Have i915_gem_stolen_node_offset() return u64, and pass const pointer to
    them.
    
    Reviewed-by: Vinod Govindapillai 
    Link: https://patch.msgid.link/e1ae0c5d3cc6f59d6e4f4ce810a6e9b3870109f8.1764930576.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit e97dfc74700e68f6591e2faf895d7c987428d42f
Author: Jani Nikula 
Date:   Fri Dec 5 12:30:27 2025 +0200

    drm/i915/fbc: let to_intel_display() do its generic magic
    
    to_intel_display() generics can handle struct intel_plane_state, struct
    intel_atomic_state, and struct intel_crtc just fine. Pass them directly.
    
    Reviewed-by: Vinod Govindapillai 
    Link: https://patch.msgid.link/14d0979eea358fb3713640eae74a7a8801cd8eec.1764930576.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 22ba3bb3ff2a8e5a509bfa13f3e362d0d36083fd
Author: Jani Nikula 
Date:   Tue Nov 4 12:25:38 2025 +0200

    drm/Kconfig: sort driver Kconfig source list
    
    Sort the driver Kconfig source list, and remove the superfluous blank
    lines in between.
    
    Reviewed-by: Louis Chauvet 
    Reviewed-by: Maarten Lankhorst 
    Link: https://patch.msgid.link/4fa11ab0b938d5c726b6ad78d28c7527b830f696.1762251845.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 4cabf00fcd09fd1dfbb3f345abe3ed2330157f22
Author: Jani Nikula 
Date:   Tue Nov 4 12:25:37 2025 +0200

    drm/Kconfig: move generic Kconfig options above drivers
    
    Keep non-driver options together, above drivers.
    
    DRM_PANEL_ORIENTATION_QUIRKS remains alone at the end because it's
    outside of the whole "if DRM" block.
    
    Reviewed-by: Maarten Lankhorst 
    Link: https://patch.msgid.link/a0f9e1a31a2190f535f2c2f94af6e22030db199f.1762251845.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit f88cb2660bd09fd76b54e6bd2e62f3d7501147b6
Author: Jani Nikula 
Date:   Tue Nov 4 12:25:36 2025 +0200

    drm/vgem: move Kconfig under driver directory
    
    Almost all DRM driver Kconfig options are in dedicated Kconfig files
    under driver directories. Follow suit in vgem.
    
    Reviewed-by: Maarten Lankhorst 
    Link: https://patch.msgid.link/51935bfb299e8c64beae5a654d908231e2ec9c7f.1762251845.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 6d2b55f7d7011ebc11c933bc680ba1b050ce1e88
Author: Jani Nikula 
Date:   Tue Nov 4 12:25:35 2025 +0200

    drm/hyperv: move Kconfig under driver directory
    
    Almost all DRM driver Kconfig options are in dedicated Kconfig files
    under driver directories. Follow suit in hyperv.
    
    Cc: Deepak Rawat 
    Reviewed-by: Deepak Rawat 
    Reviewed-by: Maarten Lankhorst 
    Link: https://patch.msgid.link/4923196ab968bfdbcc2d7572d9be9886c32c06c9.1762251845.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 759377dab35e404fc4f013e3f853d6e9450b4633
Merge: c93c1246003d5f a5b4867fad18e7
Author: Alexei Starovoitov 
Date:   Wed Dec 10 00:12:10 2025 -0800

    Merge branch 'bpf-verifier-improvement-in-32bit-shift-sign-extension-pattern'
    
    Cupertino Miranda says:
    
    ====================
    bpf: verifier improvement in 32bit shift sign extension pattern
    
    Changed from v2:
     - Removed newline nit.
     - Corrected mistake in the test functions definitions.
    Changed from v1:
     - Split initial patch in 2 patches. The verifier changes and seftests.
     - Improve comment near the verifier change.
     - Improved code for the added selftests.
    
    Signed-off-by: Cupertino Miranda  
    Signed-off-by: Andrew Pinski  
    Acked-by: Eduard Zingerman 
    Cc: Alexei Starovoitov 
    Cc: David Faust  
    Cc: Jose Marchesi  
    Cc: Elena Zannoni  
    ====================
    
    Link: https://patch.msgid.link/20251202180220.11128-1-cupertino.miranda@oracle.com
    Signed-off-by: Alexei Starovoitov 

commit a5b4867fad18e72fd5fc442c16be83723776283b
Author: Cupertino Miranda 
Date:   Tue Dec 2 18:02:20 2025 +0000

    selftests/bpf: add verifier sign extension bound computation tests.
    
    This commit adds 3 tests to verify a common compiler generated
    pattern for sign extension (r1 <<= 32; r1 s>>= 32).
    The tests make sure the register bounds are correctly computed both for
    positive and negative register values.
    
    Signed-off-by: Cupertino Miranda  
    Signed-off-by: Andrew Pinski  
    Acked-by: Eduard Zingerman 
    Cc: David Faust  
    Cc: Jose Marchesi  
    Cc: Elena Zannoni  
    Link: https://lore.kernel.org/r/20251202180220.11128-3-cupertino.miranda@oracle.com
    Signed-off-by: Alexei Starovoitov 

commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422
Author: Cupertino Miranda 
Date:   Tue Dec 2 18:02:19 2025 +0000

    bpf: verifier improvement in 32bit shift sign extension pattern
    
    This patch improves the verifier to correctly compute bounds for
    sign extension compiler pattern composed of left shift by 32bits
    followed by a sign right shift by 32bits.  Pattern in the verifier was
    limitted to positive value bounds and would reset bound computation for
    negative values.  New code allows both positive and negative values for
    sign extension without compromising bound computation and verifier to
    pass.
    
    This change is required by GCC which generate such pattern, and was
    detected in the context of systemd, as described in the following GCC
    bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731
    
    Three new tests were added in verifier_subreg.c.
    
    Signed-off-by: Cupertino Miranda  
    Signed-off-by: Andrew Pinski  
    Acked-by: Eduard Zingerman 
    Cc: David Faust  
    Cc: Jose Marchesi  
    Cc: Elena Zannoni  
    Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
    Signed-off-by: Alexei Starovoitov 

commit c93c1246003d5f102b0921e1c7747e72922fb537
Merge: 5d9fb42f05e5be 18352f8fae91d2
Author: Alexei Starovoitov 
Date:   Tue Dec 9 23:53:27 2025 -0800

    Merge branch 'bpf-cpumap-improve-error-propagation-in-cpu_map_update_elem'
    
    Kohei Enju says:
    
    ====================
    bpf: cpumap: improve error propagation in cpu_map_update_elem()
    
    This series improves error propagation in cpumap and adds selftests that
    cover the failure cases.
    
    Currently, failures returned from __cpu_map_entry_alloc() are ignored
    and always converted to -ENOMEM by cpu_map_update_elem(). This series
    ensures the correct error propagation and adds selftests.
    
    Changes:
      v2:
        - send to bpf-next, not to bpf
        - drop Fixes: tag
      v1: https://lore.kernel.org/bpf/20251128160504.57844-1-enjuk@amazon.com/
    ====================
    
    Link: https://patch.msgid.link/20251208131449.73036-1-enjuk@amazon.com
    Signed-off-by: Alexei Starovoitov 

commit 18352f8fae91d23bbd7165a7b2a1f15c4f5beff8
Author: Kohei Enju 
Date:   Mon Dec 8 22:14:32 2025 +0900

    selftests/bpf: add tests for attaching invalid fd
    
    Add test cases for situations where adding the following types of file
    descriptors to a cpumap entry should fail:
    - Non-BPF file descriptor (expect -EINVAL)
    - Nonexistent file descriptor (expect -EBADF)
    
    Also tighten the assertion for the expected error when adding a
    non-BPF_XDP_CPUMAP program to a cpumap entry.
    
    Signed-off-by: Kohei Enju 
    Reviewed-by: Toke Høiland-Jørgensen 
    Link: https://lore.kernel.org/r/20251208131449.73036-3-enjuk@amazon.com
    Signed-off-by: Alexei Starovoitov 

commit 48e11bad9a1fd803a22d25c9a7d3aced1ba87817
Author: Kohei Enju 
Date:   Mon Dec 8 22:14:31 2025 +0900

    bpf: cpumap: propagate underlying error in cpu_map_update_elem()
    
    After commit 9216477449f3 ("bpf: cpumap: Add the possibility to attach
    an eBPF program to cpumap"), __cpu_map_entry_alloc() may fail with
    errors other than -ENOMEM, such as -EBADF or -EINVAL.
    
    However, __cpu_map_entry_alloc() returns NULL on all failures, and
    cpu_map_update_elem() unconditionally converts this NULL into -ENOMEM.
    As a result, user space always receives -ENOMEM regardless of the actual
    underlying error.
    
    Examples of unexpected behavior:
      - Nonexistent fd  : -ENOMEM (should be -EBADF)
      - Non-BPF fd      : -ENOMEM (should be -EINVAL)
      - Bad attach type : -ENOMEM (should be -EINVAL)
    
    Change __cpu_map_entry_alloc() to return ERR_PTR(err) instead of NULL
    and have cpu_map_update_elem() propagate this error.
    
    Signed-off-by: Kohei Enju 
    Reviewed-by: Toke Høiland-Jørgensen 
    Link: https://lore.kernel.org/r/20251208131449.73036-2-enjuk@amazon.com
    Signed-off-by: Alexei Starovoitov 

commit 1987ea95ac37ea3f9299d220974676207d5262f6
Author: Riana Tauro 
Date:   Mon Dec 8 14:15:42 2025 +0530

    drm/xe/xe_survivability: Add support for survivability mode v2
    
    v2 survivability breadcrumbs introduces a new mode called
    SPI Flash Descriptor Override mode (FDO). This is enabled by
    PCODE when MEI itself fails and firmware cannot be updated via
    MEI using igsc. This mode provides the ability to update
    the firmware directly via SPI driver.
    
    Xe KMD initializes the nvm aux driver if FDO mode is enabled.
    
    Userspace should check FDO mode entry in survivability info sysfs before
    using the SPI driver to update firmware.
    
            /sys/bus/pci/devices//survivability_info/fdo_mode
    
    v2 also supports survivability mode for critical boot errors.
    
    Signed-off-by: Riana Tauro 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251208084539.3652902-6-riana.tauro@intel.com
    Signed-off-by: Rodrigo Vivi 

commit f4e9fc967afdb53b1203f894fb4b68451a7fe202
Author: Riana Tauro 
Date:   Mon Dec 8 14:15:41 2025 +0530

    drm/xe/xe_survivability: Redesign survivability mode
    
    Redesign survivability mode to have only one value per file.
    
    1) Retain the survivability_mode sysfs to indicate the type
    
            cat /sys/bus/pci/devices/0000\:03\:00.0/survivability_mode
            (Boot / Runtime)
    
    2) Add survivability_info directory to expose boot breadcrumbs.
    Entries in survivability mode sysfs are only visible when
    boot breadcrumb registers are populated.
    
            /sys/bus/pci/devices/0000:03:00.0/survivability_info
            ├── aux_info0
            ├── aux_info1
            ├── aux_info2
            ├── aux_info3
            ├── aux_info4
            ├── capability_info
            ├── postcode_trace
            └── postcode_trace_overflow
    
    Capability Info:
    
            Provides data about boot status and has bits that
            indicate the support for the other breadcrumbs
    
    Postcode Trace / Postcode Trace Overflow :
    
            Each postcode is represented as an 8-bit value and represents
            a boot failure event. When a new failure event is logged by Pcode
            the existing postcodes are shifted left. These entries provide a
            history of 8 postcodes.
    
    Auxiliary Info:
    
            Some failures have additional debug information.
    
    Signed-off-by: Riana Tauro 
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251208084539.3652902-5-riana.tauro@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 00ffe45ece80160aef446d74ded906352f21dd72
Author: Lizhi Hou 
Date:   Mon Dec 8 08:53:56 2025 -0800

    accel/amdxdna: Fix race condition when checking rpm_on
    
    When autosuspend is triggered, driver rpm_on flag is set to indicate that
    a suspend/resume is already in progress. However, when a userspace
    application submits a command during this narrow window,
    amdxdna_pm_resume_get() may incorrectly skip the resume operation because
    the rpm_on flag is still set. This results in commands being submitted
    while the device has not actually resumed, causing unexpected behavior.
    
    The set_dpm() is called by suspend/resume, it relied on rpm_on flag to
    avoid calling into rpm suspend/resume recursivly. So to fix this, remove
    the use of the rpm_on flag entirely. Instead, introduce aie2_pm_set_dpm()
    which explicitly resumes the device before invoking set_dpm(). With this
    change, set_dpm() is called directly inside the suspend or resume execution
    path. Otherwise, aie2_pm_set_dpm() is called.
    
    Fixes: 063db451832b ("accel/amdxdna: Enhance runtime power management")
    Reviewed-by: Mario Limonciello (AMD) 
    Reviewed-by: Maciej Falkowski 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251208165356.1549237-1-lizhi.hou@amd.com

commit a00e305fba02a915cf2745bf6ef3f55537e65d57
Author: Tomasz Lis 
Date:   Thu Dec 4 21:08:20 2025 +0100

    drm/xe/vf: Stop waiting for ring space on VF post migration recovery
    
    If wait for ring space started just before migration, it can delay
    the recovery process, by waiting without bailout path for up to 2
    seconds.
    
    Two second wait for recovery is not acceptable, and if the ring was
    completely filled even without the migration temporarily stopping
    execution, then such a wait will result in up to a thousand new jobs
    (assuming constant flow) being added while the wait is happening.
    
    While this will not cause data corruption, it will lead to warning
    messages getting logged due to reset being scheduled on a GT under
    recovery. Also several seconds of unresponsiveness, as the backlog
    of jobs gets progressively executed.
    
    Add a bailout condition, to make sure the recovery starts without
    much delay. The recovery is expected to finish in about 100 ms when
    under moderate stress, so the condition verification period needs to be
    below that - settling at 64 ms.
    
    The theoretical max time which the recovery can take depends on how
    many requests can be emitted to engine rings and be pending execution.
    While stress testing, it was possible to reach 10k pending requests
    on rings when a platform with two GTs was used. This resulted in max
    recovery time of 5 seconds. But in real life situations, it is very
    unlikely that the amount of pending requests will ever exceed 100,
    and for that the recovery time will be around 50 ms - well within our
    claimed limit of 100ms.
    
    Fixes: a4dae94aad6a ("drm/xe/vf: Wakeup in GuC backend on VF post migration recovery")
    Signed-off-by: Tomasz Lis 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251204200820.2206168-1-tomasz.lis@intel.com

commit 81e77c028848b7131d7653dd443a4049334a920b
Author: Niranjana Vishwanathapura 
Date:   Wed Dec 3 22:34:52 2025 -0800

    drm/xe/xe3p_xpc: Enable Indirect Ring State for xe3p_xpc
    
    The xe3p_xpc platform supports Indirect Ring State and
    it is required for the upcoming multi-queue feature.
    
    Signed-off-by: Niranjana Vishwanathapura 
    Reviewed-by: Matthew Brost 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20251204063451.1180387-2-niranjana.vishwanathapura@intel.com

commit 5a58414fe107e4844e0b5b33e94d8f3e563cd38e
Author: Ripan Deuri 
Date:   Sun Dec 7 12:57:17 2025 +0530

    wifi: ath12k: Skip DP peer creation for scan vdev
    
    Consider a multi-link AP configuration:
    
        MLD vif (MAC addr: aa:bb)
            |-- 2.4 GHz link (BSSID: aa:bb)
            |-- 5 GHz link   (BSSID: cc:dd)
    
    For AP vdevs, ath12k creates a DP peer using the arvif's BSSID and stores
    it in dp_hw->dp_peers_list. During scan operations, the driver assigns an
    arvif to the scan vdev and uses the vif's MAC address as its BSSID. In
    the above scenario, the scan vdev MAC address (aa:bb) matches the BSSID
    of the 2.4 GHz AP link, causing a duplicate entry in dp_hw->dp_peers_list
    and leading to scan vdev creation failure.
    
    Failure in vif bringup sequence:
    1. Create AP vdev for 2.4 GHz link:
       - Assign arvif with BSSID = aa:bb and link_id = 0.
       - Create DP peer with address aa:bb and add to dp_hw->dp_peers_list.
    
    2. Create scan vdev for 5 GHz link:
       - Assign arvif with BSSID = aa:bb (same as vif MAC address) and
         link_id = 15.
       - Attempt to create another DP peer with address aa:bb.
       - Operation fails because aa:bb already exists in dp_hw->dp_peers_list,
         resulting in duplicate entry conflict.
    
    3. Delete scan vdev for 5 GHz link.
    4. Create AP vdev for 5 GHz link.
    
    Since DP peer is not needed for scan operations, identify scan vdev using
    arvif->link_id >= IEEE80211_MLD_MAX_NUM_LINKS and skip DP peer creation
    and deletion.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251207072717.95542-1-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 668e88877a9ba73182ad686e871e8678a7dbca61
Author: Jani Nikula 
Date:   Thu Dec 4 16:32:35 2025 +0200

    drm/i915/crtc: move crtc initialization loop to intel_crtc.c
    
    intel_display_driver_probe_nogem() is too high of an abstraction level
    to be looping and initializing individual CRTCs. Move this to
    intel_crtc.c and repurpose intel_crtc_init() to initialize all
    CRTCs. Make the original a static __intel_crtc_init() for initializing a
    single CRTC.
    
    Reviewed-by: Chaitanya Kumar Borah 
    Link: https://patch.msgid.link/20251204143235.3138973-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 0823bd894278e4c0f1acb8f3a8a3c67745e6d1f6
Author: Faith Ekstrand 
Date:   Mon Dec 8 11:08:40 2025 +0100

    drm/panfrost: Bump the driver version to 1.6
    
    Bump the driver version to reflect the new cached-CPU mapping
    capability.
    
    v2:
    - Quickly describe what the new version exposes in the commit message
    
    v3:
    - Add Steve's R-b
    
    v4:
    - No changes
    
    v5:
    - No changes
    
    v6:
    - No changes
    
    v7:
    - No changes
    
    v8:
    - No changes
    
    Signed-off-by: Faith Ekstrand 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-14-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 62eedf1ccba534b318ca85d3890bf0951b9e0f87
Author: Faith Ekstrand 
Date:   Mon Dec 8 11:08:39 2025 +0100

    drm/panfrost: Add flag to map GEM object Write-Back Cacheable
    
    Will be used by the UMD to optimize CPU accesses to buffers
    that are frequently read by the CPU, or on which the access
    pattern makes non-cacheable mappings inefficient.
    
    Mapping buffers CPU-cached implies taking care of the CPU
    cache maintenance in the UMD, unless the GPU is IO coherent.
    
    v2:
    - Add more to the commit message
    
    v3:
    - No changes
    
    v4:
    - Fix the map_wc test in panfrost_ioctl_query_bo_info()
    
    v5:
    - Drop Steve's R-b (enough has changed to justify a new review)
    
    v6:
    - Collect R-b
    
    v7:
    - No changes
    
    v8:
    - Fix double drm_gem_object_funcs::export assignment
    
    Signed-off-by: Faith Ekstrand 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-13-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit d17592e61fa8e3b2d58df7c4a24abc8ac58b8d3f
Author: Boris Brezillon 
Date:   Mon Dec 8 11:08:38 2025 +0100

    drm/panfrost: Add an ioctl to query BO flags
    
    This is useful when importing BOs, so we can know about cacheability
    and flush the caches when needed.
    
    v2:
    - New commit
    
    v3:
    - Add Steve's R-b
    
    v4:
    - No changes
    
    v5:
    - No changes
    
    v6:
    - No changes
    
    v7:
    - No changes
    
    v8:
    - No changes
    
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-12-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 7be45f5489769520aa9276137d0f1f543fb81286
Author: Faith Ekstrand 
Date:   Mon Dec 8 11:08:37 2025 +0100

    drm/panfrost: Add a PANFROST_SYNC_BO ioctl
    
    This will be used by the UMD to synchronize CPU-cached mappings when
    the UMD can't do it directly (no usermode cache maintenance instruction
    on Arm32).
    
    v2:
    - Add more to the commit message
    - Change the flags to better match the drm_gem_shmem_sync semantics
    
    v3:
    - Add Steve's R-b
    
    v4:
    - No changes
    
    v5:
    - Drop Steve's R-b (semantics changes requiring a new review)
    
    v6:
    - Bail out early in panfrost_ioctl_sync_bo() if op_count is zero
    
    v7:
    - Hand-roll our own bo_sync() helper
    
    v8:
    - Collect R-b
    
    Signed-off-by: Faith Ekstrand 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-11-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 2396d65d94fc75d39f096b9777f9edc9c8e677c1
Author: Boris Brezillon 
Date:   Mon Dec 8 11:08:36 2025 +0100

    drm/panfrost: Expose the selected coherency protocol to the UMD
    
    Will be needed if we want to skip CPU cache maintenance operations when
    the GPU can snoop CPU caches.
    
    v2:
    - New commit
    
    v3:
    - Fix the coherency values (enum instead of bitmask)
    
    v4:
    - Fix init/test on coherency_features
    
    v5:
    - No changes
    
    v6:
    - Collect R-b
    
    v7:
    - No changes
    
    v8:
    - No changes
    
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-10-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 3ae6637378e64e56634ce257cb354636ada96d69
Author: Boris Brezillon 
Date:   Mon Dec 8 11:08:35 2025 +0100

    drm/panfrost: Provide a custom dma_buf implementation
    
    Before we introduce cached CPU mappings, we want a dma_buf
    implementation satisfying synchronization requests around CPU
    accesses coming from a dma_buf exported by our driver. Let's
    provide our own implementation relying on the default
    gem_shmem_prime helpers designed for that purpose.
    
    v5:
    - New patch
    
    v6:
    - Collect R-b
    
    v7:
    - Hand-roll our own dma_buf boilerplate
    
    v8:
    - No changes
    
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-9-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit ae09426f47ee64bd3f34fbe815ff61eb94cc3a6b
Author: Faith Ekstrand 
Date:   Mon Dec 8 11:08:34 2025 +0100

    drm/panthor: Bump the driver version to 1.7
    
    Bump the driver version to reflect the new cached-CPU mapping
    capability.
    
    v2:
    - Quickly describe what the new version exposes in the commit message
    
    v3:
    - Add Steve's R-b
    
    v4:
    - No changes
    
    v5:
    - No changes
    
    v6:
    - No changes
    
    v7:
    - No changes
    
    v8:
    - Bump to 1.7 (1.6 was picked in the meantime)
    
    Signed-off-by: Faith Ekstrand 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-8-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit cd2c9c3015e642e28e1b528c52c06a79f350d600
Author: Loïc Molinari 
Date:   Mon Dec 8 11:08:33 2025 +0100

    drm/panthor: Add flag to map GEM object Write-Back Cacheable
    
    Will be used by the UMD to optimize CPU accesses to buffers
    that are frequently read by the CPU, or on which the access
    pattern makes non-cacheable mappings inefficient.
    
    Mapping buffers CPU-cached implies taking care of the CPU
    cache maintenance in the UMD, unless the GPU is IO coherent.
    
    v2:
    - Add more to the commit message
    - Tweak the doc
    - Make sure we sync the section of the BO pointing to the CS
      syncobj before we read its seqno
    
    v3:
    - Fix formatting/spelling issues
    
    v4:
    - Add Steve's R-b
    
    v5:
    - Drop Steve's R-b (changes in the ioctl semantics requiring
      new review)
    
    v6:
    - Fix the uAPI doc
    - Fix inverted logic in some comment
    
    v7:
    - No changes
    
    v8:
    - Collect R-b
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-7-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit c146c82f862e9c7e602a908891c3adf992ef2beb
Author: Boris Brezillon 
Date:   Mon Dec 8 11:08:32 2025 +0100

    drm/panthor: Add an ioctl to query BO flags
    
    This is useful when importing BOs, so we can know about cacheability
    and flush the caches when needed.
    
    We can also know when the buffer comes from a different subsystem and
    take proper actions (avoid CPU mappings, or do kernel-based syncs
    instead of userland cache flushes).
    
    v2:
    - New commit
    
    v3:
    - Add Steve's R-b
    
    v4:
    - No changes
    
    v5:
    - No changes
    
    v6:
    - No changes
    
    v7:
    - No changes
    
    v8:
    - No changes
    
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-6-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit e06177ec7a36391c66216b55b7c112d5ba8c4cc1
Author: Boris Brezillon 
Date:   Mon Dec 8 11:08:31 2025 +0100

    drm/panthor: Add a PANTHOR_BO_SYNC ioctl
    
    This will be used by the UMD to synchronize CPU-cached mappings when
    the UMD can't do it directly (no usermode cache maintenance instruction
    on Arm32).
    
    v2:
    - Change the flags so they better match the drm_gem_shmem_sync()
      semantics
    
    v3:
    - Add Steve's R-b
    
    v4:
    - No changes
    
    v5:
    - Drop Steve's R-b (the semantics changes call for a new review)
    
    v6:
    - Drop ret initialization in panthor_ioctl_bo_sync()
    - Bail out early in panthor_ioctl_bo_sync() if ops.count is zero
    - Drop unused PANTHOR_BO_SYNC_OP_FLAGS definition
    
    v7:
    - Hand-roll the sync logic (was previously provided by gem_shmem)
    
    v8:
    - Collect R-b
    
    Signed-off-by: Faith Ekstrand 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-5-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit ea78ec98265339997959eba3c9d764317614675a
Author: Boris Brezillon 
Date:   Mon Dec 8 11:08:30 2025 +0100

    drm/panthor: Expose the selected coherency protocol to the UMD
    
    If we want to be able to skip CPU cache maintenance operations on
    CPU-cached mappings, the UMD needs to know the kind of coherency
    in place. Add a field to drm_panthor_gpu_info to do that. We can re-use
    a padding field for that since this object is write-only from the
    KMD perspective, and the UMD should just ignore it.
    
    v2:
    - New commit
    
    v3:
    - Make coherency protocol a real enum, not a bitmask
    - Add BUILD_BUG_ON()s to make sure the values in panthor_regs.h and
      those exposed through the uAPI match
    
    v4:
    - Add Steve's R-b
    
    v5:
    - No changes
    
    v6:
    - No changes
    
    v7:
    - Fix kernel doc
    
    v8:
    - No changes
    
    Reviewed-by: Steven Price 
    Reviewed-by: Karunika Choo 
    Link: https://patch.msgid.link/20251208100841.730527-4-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 9beb8dca9e749e9983e70b22e9823e6fcd519f91
Author: Boris Brezillon 
Date:   Mon Dec 8 11:08:29 2025 +0100

    drm/panthor: Fix panthor_gpu_coherency_set()
    
    GPU_COHERENCY_PROTOCOL takes one of GPU_COHERENCY_xx
    not BIT(GPU_COHERENCY_xx).
    
    v3:
    - New commit
    
    v4:
    - Add Steve's R-b
    
    v5:
    - No changes
    
    v6:
    - No changes
    
    v7:
    - No changes
    
    v8:
    - No changes
    
    Cc: Akash Goel 
    Fixes: dd7db8d911a1 ("drm/panthor: Explicitly set the coherency mode")
    Reported-by: Steven Price 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-3-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 925ad0c26dd80d345018a3f7559799b7ad8f44e3
Author: Boris Brezillon 
Date:   Mon Dec 8 11:08:28 2025 +0100

    drm/panthor: Provide a custom dma_buf implementation
    
    Before we introduce cached CPU mappings, we want a dma_buf
    implementation satisfying synchronization requests around CPU
    accesses coming from a dma_buf exported by our driver. Let's
    provide our own implementation relying on the default
    gem_shmem_prime helpers designed for that purpose.
    
    v5:
    - New patch
    
    v6:
    - Collect R-b
    
    v7:
    - Hand-roll the dma_buf sync/import logic (was previously done by
      generic prime/shmem helpers)
    
    v8:
    - No changes
    
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251208100841.730527-2-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit c4b3133c6a2fc283cb3d34c64d40ed2fa254b608
Author: Vivek BalachandharTN 
Date:   Tue Dec 2 03:31:20 2025 +0000

    Input: byd - use %*ph for Z packet dump
    
    Replace the hand-rolled %02x formatting of the Z packet warning in the
    BYD driver with the %*ph format specifier. %*ph is the preferred helper
    for printing a buffer in hexadecimal and makes the logging clearer and
    more consistent.
    
    Signed-off-by: Vivek BalachandharTN 
    Link: https://patch.msgid.link/20251202033120.2264474-1-vivek.balachandhar@gmail.com
    Signed-off-by: Dmitry Torokhov 

commit bcd752c706c357229185a330ab450b86236d9031
Author: Val Packett 
Date:   Sat Dec 6 14:37:28 2025 -0300

    drm/panel-edp: Add AUO B140QAX01.H panel
    
    A 14-inch 2560x1600 60Hz matte touch panel, found on a Dell Latitude 7455
    laptop (second-source with BOE NE14QDM), according to online sources it's
    also found on the Latitude 7440 and some ASUS models.
    
    Raw EDID dump:
    
    00 ff ff ff ff ff ff 00 06 af a4 0b 00 00 00 00
    00 20 01 04 a5 1e 13 78 03 ad f5 a8 54 47 9c 24
    0e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
    01 01 01 01 01 01 f0 68 00 a0 a0 40 2e 60 30 20
    35 00 2d bc 10 00 00 1a f3 53 00 a0 a0 40 2e 60
    30 20 35 00 2d bc 10 00 00 1a 00 00 00 fe 00 36
    39 52 31 57 80 42 31 34 30 51 41 58 00 00 00 00
    00 02 41 21 a8 00 01 00 00 1a 41 0a 20 20 00 a1
    
    Don't have datasheet access, but the same timing as for other panels from
    the same manufacturer works fine.
    
    Signed-off-by: Val Packett 
    [dianders: Moved to the right location in the table]
    Reviewed-by: Douglas Anderson 
    Signed-off-by: Douglas Anderson 
    Link: https://patch.msgid.link/20251206173739.2222940-1-val@packett.cool

commit 35bb80e6832920b5d22554a54601d392208fe019
Author: Pierre-Eric Pelloux-Prayer 
Date:   Mon Nov 17 15:53:15 2025 +0100

    drm/amdgpu: pass the entity to use to ttm public functions
    
    This way the caller can select the one it wants to use.
    
    Signed-off-by: Pierre-Eric Pelloux-Prayer 
    Reviewed-by: Christian König 
    Acked-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit e95b41846dab4f7b4d5a761b157d3cee7de737be
Author: Pierre-Eric Pelloux-Prayer 
Date:   Mon Nov 17 15:42:31 2025 +0100

    drm/amdgpu: pass the entity to use to amdgpu_ttm_map_buffer
    
    This way the caller can select the one it wants to use.
    
    Signed-off-by: Pierre-Eric Pelloux-Prayer 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit bc0515ece3d50ea61f76795bcdb42b09640c11e1
Author: Pierre-Eric Pelloux-Prayer 
Date:   Mon Nov 24 18:25:04 2025 +0100

    drm/amdgpu: fix error handling in amdgpu_copy_buffer
    
    drm_sched_job_add_resv_dependencies can fail in amdgpu_ttm_prepare_job.
    In this case we need to use amdgpu_job_free to release memory.
    
    ---
    v4: moved job pointer clearing to a different patchset
    ---
    
    Signed-off-by: Pierre-Eric Pelloux-Prayer 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 582c65e85498976ea8ec40c23b423311ea53cd94
Author: Pierre-Eric Pelloux-Prayer 
Date:   Tue Nov 18 14:41:50 2025 +0100

    drm/amdgpu: add amdgpu_ttm_job_submit helper
    
    Deduplicate the IB padding code and will also be used
    later to check locking.
    
    Signed-off-by: Pierre-Eric Pelloux-Prayer 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit edf47fb3d12adbd1747b798a454bc36ceb5912f7
Author: Pierre-Eric Pelloux-Prayer 
Date:   Fri Sep 19 09:35:03 2025 +0200

    drm/amdgpu: introduce amdgpu_ttm_buffer_entity
    
    No functional change for now, but this struct will have more
    fields added in the next commit.
    
    This change would introduce synchronisation issue, because
    dependencies between successive jobs are not taken care of
    properly. For instance, amdgpu_ttm_clear_buffer uses
    amdgpu_ttm_map_buffer then amdgpu_ttm_fill_mem which should
    use different entities (default_entity then move/clear entity).
    To prevent failures for this commit, we limit ourselves to
    2 entities: default_entity (which replaces high_pr usages) and
    clear_entity (which replaces low_pr usages).
    
    The next commits will deal with these dependencies correctly,
    and then we'll be able to use move_entity.
    
    ---
    v2: renamed amdgpu_ttm_buffer_entity
    v4: don't use move_entity in ttm yet
    ---
    
    Signed-off-by: Pierre-Eric Pelloux-Prayer 
    Reviewed-by: Christian König  (v3)
    Acked-by: Felix Kuehling  (v3)
    Signed-off-by: Alex Deucher 

commit a0f8297068cf5be9e07e765d499a482f5e55d454
Author: Likun Gao 
Date:   Tue May 13 14:03:46 2025 +0800

    drm/amdgpu: add imu support for gc 12_1
    
    Add IMU support for gc version 12.1.0.
    Only support imu fw loading for imu 12.1.0.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit a5192fbb2ee4225122efdfcaea53d50e9f477055
Author: Likun Gao 
Date:   Fri Apr 18 11:11:24 2025 +0800

    drm/amdgpu: fix mes code error for muti-xcc
    
    Fix some code error for muti-xcc on mes v12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 1359282bd4ff16752c977d2f1a01a315c8df9f6b
Author: Likun Gao 
Date:   Tue Nov 11 11:43:05 2025 +0800

    drm/amdgpu/gmc12: set MMHUBs based on aid_mask
    
    Update number of mmhub and mid_mask via reuse aid_mask.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit 6c4c2e2c403530ea0a171b1376bfda8feb3ea4dc
Author: Likun Gao 
Date:   Fri Apr 18 11:06:51 2025 +0800

    drm/amdgpu: set gfxhub according xcc_mask for gfx 12_1
    
    Set GFXHUB accodring to xcc_mask for gfx version 12_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 9827f482895fbdbef3d6beb05dcba475e98833ee
Author: Likun Gao 
Date:   Fri Apr 18 11:04:12 2025 +0800

    drm/amdgpu: add xcc info for compute ring name
    
    Add XCC id info for compute ring name on gfx version 12.1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit b42f3bf9536c9b710fd1d4deb7d1b0dc819dc72d
Author: Jonathan Kim 
Date:   Fri Dec 5 14:41:08 2025 -0500

    drm/amdkfd: bump minimum vgpr size for gfx1151
    
    GFX1151 has 1.5x the number of available physical VGPRs per SIMD.
    Bump total memory availability for acquire checks on queue creation.
    
    Signed-off-by: Jonathan Kim 
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Alex Deucher 

commit 127770bcfccc21e7de214be9c54527a789ab790f
Author: Mukul Joshi 
Date:   Wed May 14 22:07:47 2025 -0400

    drm/amdgpu: Revert retry based thrashing prevention on GFX 12.1.0
    
    Revert the change to enable retry based thrashing prevention on GFX 12.1.0
    for now as its causing data mismatch and slowness issues with multiple HIP
    tests.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Harish Kasiviswanathan 
    Signed-off-by: Alex Deucher 

commit f364fb3cb40364e0c91ddc83bac90cfd09a5602b
Author: Hawking Zhang 
Date:   Tue May 6 14:43:36 2025 +0800

    drm/amdgpu: Init single mes instance if xcc_mask is unset
    
    Configure a single mes instance if the xcc_mask remains
    uninitialized.
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Jack Xiao 
    Signed-off-by: Alex Deucher 

commit c93f9b7db8b414a971ab076e3bb3774e53c6266d
Author: Mukul Joshi 
Date:   Fri Mar 28 22:21:28 2025 -0400

    drm/amdgpu: Setup MTYPEs for GFX 12.1.0
    
    For GFX 12.1.0, setup correct MTYPE for a BO depending on
    its current location relative to the mapping GPU.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by:  Alex Sierra 
    Reviewed-by: Harish Kasiviswanathan 
    Signed-off-by: Alex Deucher 

commit 30a4dc6476da3d056bf86d87d79f381beb8556d2
Author: Alex Sierra 
Date:   Thu Apr 3 16:49:54 2025 -0500

    drm/amdgpu: update sh mem base offsets for gfx 12.1
    
    Signed-off-by: Alex Sierra 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit 8b971ce0cbc71a10f1d19d2bb6f3dc5c6f07d9d9
Author: Srinivasan Shanmugam 
Date:   Fri Dec 5 17:37:57 2025 +0530

    drm/amd/ras: Reduce stack usage in ras_umc_handle_bad_pages()
    
    ras_umc_handle_bad_pages() function used a large local array:
      struct eeprom_umc_record records[MAX_ECC_NUM_PER_RETIREMENT];
    
    Move this array off the stack by allocating it with kcalloc()
    and freeing it before return.
    
    This reduces the stack frame size of ras_umc_handle_bad_pages()
    and avoids the frame size warning.
    
    Fixes the below:
    drivers/gpu/drm/amd/amdgpu/../ras/rascore/ras_umc.c:498:5: warning: stack frame size (1208) exceeds limit (1024) in 'ras_umc_handle_bad_pages' [-Wframe-larger-than]
    
    v2: Removed the duplicate ras_umc_get_new_records() invocation. (Lijo)
    
    Cc: Tao Zhou 
    Cc: Hawking Zhang 
    Cc: Christian König 
    Cc: Alex Deucher 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Tao Zhou 
    Signed-off-by: Alex Deucher 

commit e3b8d8cc8c60db6c2be1251664da68b3e021a672
Author: Mukul Joshi 
Date:   Thu Mar 27 17:17:06 2025 -0400

    drm/amdgpu: Fix SHMEM alignment mode for GFX 12.1.0
    
    Alignment mode in SHMEM config register is only a single bit
    value on GFX 12.1.0 instead of 2 bits in previous asics.
    Add a new enum and use the correct value of SHMEM alignment mode
    when programming the SHMEM config register.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 3849efdc7888d537f09c3dcfaea4b3cd377a102e
Author: Rosen Penev 
Date:   Sat Nov 8 09:40:47 2025 -0800

    drm/amd/display: shrink struct members
    
    On a 32-bit ARM system, the audio_decoder struct ends up being too large
    for dp_retrain_link_dp_test.
    
    link_dp_cts.c:157:1: error: the frame size of 1328 bytes is larger than
    1280 bytes [-Werror=frame-larger-than=]
    
    This is mitigated by shrinking the members of the struct and avoids
    having to deal with dynamic allocation.
    
    feed_back_divider is assigned but otherwise unused. Remove both.
    
    pixel_repetition looks like it should be a bool since it's only ever
    assigned to 1. But there are checks for 2 and 4. Reduce to uint8_t.
    
    Remove ss_percentage_divider. Unused.
    
    Shrink refresh_rate as it gets assigned to at most a 3 digit integer
    value.
    
    Signed-off-by: Rosen Penev 
    Reviewed-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit 71776e0965f9f730af19c5f548827f2a7c91f5a8
Author: Mario Limonciello 
Date:   Fri Dec 5 12:41:58 2025 -0600

    drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace
    
    This is important for userspace to avoid hardcoding VGPR size.
    
    Reviewed-by: Kent Russell 
    Signed-off-by: Mario Limonciello 
    Signed-off-by: Alex Deucher 

commit 7a5fb05b5b18e531989aa55b10dfa4be0633207e
Author: Mario Limonciello 
Date:   Fri Dec 5 08:04:41 2025 -0600

    amdkfd: Bump ABI to indicate presence of Trap handler support for expert scheduling
    
    commit 0f0c8a6983db ("drm/amdkfd: Trap handler support for expert
    scheduling mode") introduced support for a trap handler when expert
    scheduling mode. However userspace needs to know whether or not a trap
    handler support is present.
    
    Bump the KFD IOCTL API so that userspace can key off this to decide.
    
    Suggested-by: Stella Laurenzo 
    Fixes: 423888879412 ("drm/amdkfd: Trap handler support for expert scheduling mode")
    Reviewed-by: Kent Russell 
    Signed-off-by: Mario Limonciello 
    Signed-off-by: Alex Deucher 

commit 67b032daa288b70df2e6cb2c3a9cefcae0c6fa5f
Author: Taimur Hassan 
Date:   Fri Nov 28 20:15:43 2025 -0500

    drm/amd/display: Promote DC to 3.2.362
    
    This version brings along the following updates:
    
     - Defer transitions from minimal state to final state
     - Remove periodic detection callbacks from dcn35+
     - Fixes for S0i3 exit
     - Refactor dml_core_mode_support to reduce stack frame
     - Add additional info from DML for DMU
    
    Signed-off-by: Taimur Hassan 
    Signed-off-by: Chenyu Chen 
    Acked-by: Tom Chung 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 6a45e909c65a8b3c5592b88ad37e2f7341683801
Author: Nevenko Stupar 
Date:   Mon Nov 17 16:47:21 2025 -0500

    drm/amd/display: Additional info from DML for DMU
    
    [WHAT]
    Add additional info from DML for DMU when applicable
    on future platforms.
    
    Reviewed-by: Alvin Lee 
    Signed-off-by: Nevenko Stupar 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 29a4dc4b5d82e6b3da343391f9e784cf5c48732c
Author: Alex Hung 
Date:   Wed Nov 26 11:44:35 2025 -0700

    drm/amd/display: Refactor dml_core_mode_support to reduce stack frame
    
    [WHAT]
    When compiling Linux kernel with clang, the following warning / error
    messages pops up:
    
    drivers/gpu/drm/amd/amdgpu/../dal-dev/dc/dml2_0/display_mode_core.c:6853:12:
    error: stack frame size (2120) exceeds limit (2056) in
    'dml_core_mode_support' [-Werror,-Wframe-larger-than]
     6853 | dml_bool_t dml_core_mode_support(struct display_mode_lib_st
    *mode_lib)
    
    [HOW]
    Refactoring CalculateVMRowAndSwath_params assignments to a new function
    helps reduce the stack frame size in dml_core_mode_support.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4733
    Reviewed-by: Austin Zheng 
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Alex Hung 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit fdcc620b02e2e4af77d5c81f546dddea4eb7971f
Author: Ovidiu Bunea 
Date:   Thu Nov 27 18:10:02 2025 -0500

    drm/amd/display: Fixes for S0i3 exit
    
    [why & how]
    Add debug flag "ignore_pg" to dcn32 PG functions.
    Update default z10 support status.
    Temp disable RFB features for ASIC.
    Remove legacy code path.
    
    Reviewed-by: Charlene Liu 
    Signed-off-by: Ovidiu Bunea 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 3f6c060846be539fa1eab350f2e783fa724dba2f
Author: Dillon Varone 
Date:   Wed Nov 26 09:25:50 2025 -0500

    drm/amd/display: Remove periodic detection callbacks from dcn35+
    
    [WHY&HOW]
    These will not be needed going forward as DMU will communicate to the
    driver when detection may be needed after a power saving event.
    
    Reviewed-by: Nicholas Kazlauskas 
    Signed-off-by: Dillon Varone 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 6b2e9b41b785dc97ae8c9a2c93869e3a710bd6e0
Author: Joshua Aberback 
Date:   Fri Nov 21 15:46:17 2025 -0500

    drm/amd/display: Defer transitions from minimal state to final state
    
    [Why]
    In non-seamless pipe transitions, it can take several frames to process
    a single flip. One of the reasons is the 2-step transition implementation
    where first the minimal transition state is applied, then the final state
    is applied, all within the same flip. This delay is noticeable to the user
    in some video playback scenarios, which makes for a bad user experience.
    
    [How]
     - in applicable non-seamless cases, complete the flip with the minimal
       state applied, start a counter, and create all new contexts as minimal
     - if another pipe transition occurs while counting, reset the counter
     - when the counter finishes, promote the current flip to a full update
       and restore creation of optimized contexts
     - when creating minimal states from new context, apply stream updates
    
    Reviewed-by: Aric Cyr 
    Signed-off-by: Joshua Aberback 
    Signed-off-by: Chenyu Chen 
    Tested-by: Daniel Wheeler 
    Signed-off-by: Alex Deucher 

commit 820b3d376e8a102c6aeab737ec6edebbbb710e04
Author: Alex Deucher 
Date:   Tue Dec 2 14:24:03 2025 -0500

    drm/amdgpu: don't attach the tlb fence for SI
    
    SI hardware doesn't support pasids, user mode queues, or
    KIQ/MES so there is no need for this.  Doing so results in
    a segfault as these callbacks are non-existent for SI.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4744
    Fixes: f3854e04b708 ("drm/amdgpu: attach tlb fence to the PTs update")
    Reviewed-by: Timur Kristóf 
    Signed-off-by: Alex Deucher 

commit 8acdad9344cc7b4e7bc01f0dfea80093eb3768db
Author: Alex Deucher 
Date:   Tue Nov 11 11:17:22 2025 -0500

    drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
    
    This can get called from an atomic context.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4470
    Reviewed-by: Harry Wentland 
    Signed-off-by: Alex Deucher 

commit 423888879412e94725ca2bdccd89414887d98e31
Author: Jay Cornwall 
Date:   Fri Nov 14 14:32:42 2025 -0600

    drm/amdkfd: Trap handler support for expert scheduling mode
    
    The trap may be entered with dependency checking disabled.
    Wait for dependency counters and save/restore scheduling mode.
    
    v2:
    
    Use ttmp1 instead of ttmp11. ttmp11 is not zero-initialized.
    While the trap handler does zero this field before use, a user-mode
    second-level trap handler could not rely on this being zero when
    using an older kernel mode driver.
    
    v3:
    
    Use ttmp11 primarily but copy to ttmp1 before jumping to the
    second level trap handler. ttmp1 is inspectable by a debugger.
    Unexpected bits in the unused space may regress existing software.
    
    Signed-off-by: Jay Cornwall 
    Reviewed-by: Lancelot Six 
    Signed-off-by: Alex Deucher 

commit 97b2e10e9467a4086e72cf9146d4699fc9baf1c0
Author: Srinivasan Shanmugam 
Date:   Tue Dec 2 15:32:04 2025 +0530

    drm/amdgpu/sdma_v7_1: Add missing inst_mask entry in sdma_v7_1_inst_gfx_resume()
    
    The comment for sdma_v7_1_inst_gfx_resume() did not include the
    inst_mask parameter, even though the function takes it as an argument.
    
    Update the comment to document inst_mask as the mask of SDMA engine
    instances to be enabled.
    
    Fixes the below with gcc W=1:
    drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c:644 function parameter 'inst_mask' not described in 'sdma_v7_1_inst_gfx_resume'
    
    Cc: Likun Gao 
    Cc: Le Ma 
    Cc: Alex Deucher 
    Cc: Christian König 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 03d11f8564ca0e09e0e629ec75084e2265ae9207
Author: Lijo Lazar 
Date:   Thu Nov 27 16:45:52 2025 +0530

    drm/amd/pm: Use common helper for smuv14.0.2 dpm
    
    Use helper function to print smuv14.0.2 dpm tables to sysfs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit b2debbbb60f19ecec9567a518ef02ea40cdf89a4
Author: Lijo Lazar 
Date:   Thu Nov 27 16:11:46 2025 +0530

    drm/amd/pm: Use common helper for smuv13.0.7 dpm
    
    Use helper function to print smuv13.0.7 dpm tables to sysfs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 85b0b7d7a3db4f35ccf87f5da9ce26267516d642
Author: Lijo Lazar 
Date:   Thu Nov 27 16:05:42 2025 +0530

    drm/amd/pm: Use common helper for smuv13.0.6 dpm
    
    Use helper function to print navi10 dpm tables to sysfs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit a95f01edd80b61b130befac595369c9e2ced4eb2
Author: Lijo Lazar 
Date:   Thu Nov 27 15:57:22 2025 +0530

    drm/amd/pm: Use common helper for smuv13.0.0 dpm
    
    Use helper function to print smuv13.0.0 dpm tables to sysfs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 7ea1c722fe1daa7dac0c6ee90352381c54107520
Author: Lijo Lazar 
Date:   Thu Nov 27 15:30:43 2025 +0530

    drm/amd/pm: Use common helper for aldebaran dpm table
    
    Use helper function to print aldebaran dpm tables to sysfs. Remove
    unused functions.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit efb4febd527da4248b02eae495f601e2e0ba66b1
Author: Lijo Lazar 
Date:   Thu Nov 27 15:18:23 2025 +0530

    drm/amd/pm: Use common helper for sienna dpm table
    
    Use helper function to print sienna cichlid dpm tables to sysfs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 5f77e0b11dcc2ce92c0457f653732ee9756622a1
Author: Lijo Lazar 
Date:   Thu Nov 27 14:05:27 2025 +0530

    drm/amd/pm: Use common helper for navi10 dpm table
    
    Use helper function to print navi10 dpm tables to sysfs. Also, remove
    FCLK table as it is not supported in navi10.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 33becd7ccbef3b02fcfc8b6763aff826c71b78b8
Author: Lijo Lazar 
Date:   Wed Nov 26 10:47:10 2025 +0530

    drm/amd/pm: Use common helper for arcturus dpm
    
    Use the helper function to print DPM clock levels to sysfs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit a08ea4bc7711f8c4eacbf5c63c334e71a226c2f8
Author: Lijo Lazar 
Date:   Tue Nov 25 20:54:58 2025 +0530

    drm/amd/pm: Add a helper to show dpm table
    
    Add a helper function to print clock and pcie dpm levels through sysfs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit f0ba2c1f12d37d11b169578aa7e066d2b6c8ce02
Author: Lijo Lazar 
Date:   Tue Nov 25 18:03:30 2025 +0530

    drm/amd/pm: Use generic pcie dpm table for SMUv14
    
    Use smu_pcie_table for SMUv14 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit f75227fb3fdfce1ffe2a737e90976cec4cb95218
Author: Lijo Lazar 
Date:   Tue Nov 25 17:48:48 2025 +0530

    drm/amd/pm: Use generic pcie dpm table for SMUv13
    
    Use smu_pcie_table for SMUv13 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit c7d1bc0b020454364933294c40897cdea4dcd432
Author: Lijo Lazar 
Date:   Tue Nov 25 17:22:34 2025 +0530

    drm/amd/pm: Use generic pcie dpm table for SMUv11
    
    Use smu_pcie_table for SMUv11 SOCs.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 36b98a7229cd39d1e36edfbf3b2797b778e927a1
Author: Lijo Lazar 
Date:   Tue Nov 25 16:36:08 2025 +0530

    drm/amd/pm: Add generic pcie dpm table
    
    Add a generic pcie dpm table which contains the number of link clock
    levels and link clock, pcie gen speed/width corresponding to each level.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit b4742a9e7fd42c011cf805e3441dd188f22e325c
Author: Lijo Lazar 
Date:   Tue Nov 25 15:53:25 2025 +0530

    drm/amd/pm: Use generic dpm table for SMUv14 SOCs
    
    Use the generic dpm table structure instead of SMUv14 specific table.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 7380228401c4e67066b451665ed74286da0f4d1c
Author: Lijo Lazar 
Date:   Tue Nov 25 15:40:05 2025 +0530

    drm/amd/pm: Use generic dpm table for SMUv13 SOCs
    
    Use the generic dpm table structure instead of SMUv13 specific table.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit cc6b66d661fda4fb94c0099dd92b83f8de5c1bf4
Author: Zhu Lingshan 
Date:   Thu Aug 21 17:22:44 2025 +0800

    amdkfd: introduce new ioctl AMDKFD_IOC_CREATE_PROCESS
    
    This commit implemetns a new ioctl AMDKFD_IOC_CREATE_PROCESS
    that creates a new secondary kfd_progress on the FD.
    
    To keep backward compatibility, userspace programs need to invoke
    this ioctl explicitly on a FD to create a secondary
    kfd_process which replacing its primary kfd_process.
    
    This commit bumps ioctl minor version.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit e3491fa3f3c94d47e7b82604ca7b9925987f1683
Author: Zhu Lingshan 
Date:   Mon Oct 13 15:58:31 2025 +0800

    amdkfd: process debug trap ioctl only on a primary context
    
    Set_debug_trap ioctl should work on a specific kfd_process
    even when multiple contexts feature is implemented.
    
    For consistency, this commit allow set_debug_trap ioctl only work on the
    primary kfd process of a user space program
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 3ec1a42f5f4ba877374a22a8da45d219772ac968
Author: Lijo Lazar 
Date:   Tue Nov 25 12:52:10 2025 +0530

    drm/amd/pm: Use generic dpm table for SMUv11 SOCs
    
    Remove SMUv11 specific DPM table and use the generic dpm table
    structure.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 8c5c0ea2f9c01dad2f83f4c9a4a049004058ae38
Author: Lijo Lazar 
Date:   Tue Nov 25 12:13:51 2025 +0530

    drm/amd/pm: Add clock table structure
    
    Add a common clock table structure to represent dpm levels for different
    clocks.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 51cd2d2decf365a248ddc304b7aa6f0cadc748c3
Author: Lai Jiangshan 
Date:   Mon Dec 8 21:25:19 2025 +0800

    workqueue: Process extra works in rescuer on memory pressure
    
    Make the rescuer process more work on the last pwq when there are no
    more to rescue for the whole workqueue to help the regular workers in
    case it is a temporary memory pressure relief and to reduce relapse.
    
    Signed-off-by: Lai Jiangshan 
    Signed-off-by: Tejun Heo 

commit e5a30c303b07a4d6083e0f7f051b53add6d93c5d
Author: Lai Jiangshan 
Date:   Mon Dec 8 21:25:18 2025 +0800

    workqueue: Process rescuer work items one-by-one using a cursor
    
    Previously, the rescuer scanned for all matching work items at once and
    processed them within a single rescuer thread, which could cause one
    blocking work item to stall all others.
    
    Make the rescuer process work items one-by-one instead of slurping all
    matches in a single pass.
    
    Break the rescuer loop after finding and processing the first matching
    work item, then restart the search to pick up the next. This gives
    normal worker threads a chance to process other items which gives them
    the opportunity to be processed instead of waiting on the rescuer's
    queue and prevents a blocking work item from stalling the rest once
    memory pressure is relieved.
    
    Introduce a dummy cursor work item to avoid potentially O(N^2)
    rescans of the work list.  The marker records the resume position for
    the next scan, eliminating redundant traversals.
    
    Also introduce RESCUER_BATCH to control the maximum number of work items
    the rescuer processes in each turn, and move on to other PWQs when the
    limit is reached.
    
    Cc: ying chen 
    Reported-by: ying chen 
    Fixes: e22bee782b3b ("workqueue: implement concurrency managed dynamic worker pool")
    Signed-off-by: Lai Jiangshan 
    Signed-off-by: Tejun Heo 

commit fc5ff53d2aa088713870cd684b160ee95c018520
Author: Lai Jiangshan 
Date:   Mon Dec 8 21:25:17 2025 +0800

    workqueue: Make send_mayday() take a PWQ argument directly
    
    Make send_mayday() operate on a PWQ directly instead of taking a work
    item, so that rescuer_thread() now calls send_mayday(pwq) instead of
    open-coding the mayday list manipulation.
    
    Signed-off-by: Lai Jiangshan 
    Signed-off-by: Tejun Heo 

commit 448ee45353ef9fb1a34f5f26eb3f48923c6f0898
Author: Xiaogang Chen 
Date:   Mon Dec 1 14:12:29 2025 -0600

    drm/amdkfd: Use huge page size to check split svm range alignment
    
    When split svm ranges that have been mapped using huge page should use huge
    page size(2MB) to check split range alignment, not prange->granularity that
    means migration granularity.
    
    Fixes: 7ef6b2d4b7e5 ("drm/amdkfd: remap unaligned svm ranges that have split")
    Signed-off-by: Xiaogang Chen 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit d3ff65243a52afa85166abaa8d00a44c17691dbd
Author: Alex Deucher 
Date:   Mon Dec 1 14:46:53 2025 -0500

    drm/amdgpu: add a helper for processing recoverable GPUVM faults
    
    Add a common helper to remove the repeated logic from each
    gmc module.
    
    Suggested-by: Lijo Lazar 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit a50d32c41fb25d772cc1c47b6abed8fb811d58c2
Author: Lijo Lazar 
Date:   Wed Nov 26 16:08:14 2025 +0530

    drm/amd/pm: Deprecate print_clock_levels interface
    
    Use emit_clock_levels instead of print_clock_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 6186199f3218842462f4f269818a32467f4e543d
Author: Lijo Lazar 
Date:   Wed Nov 26 15:45:48 2025 +0530

    drm/amd/pm: Use emit_clock_levels in vega20
    
    Move to emit_clock_levels from print_clock_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 0229122fa169b465a3d13120f2c03259389792c5
Author: Lijo Lazar 
Date:   Wed Nov 26 15:39:58 2025 +0530

    drm/amd/pm: Use emit_clock_levels in vega12
    
    Move to emit_clock_levels from print_clock_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 2084f2746e8b5db8709e8aef22deb3107e85e771
Author: Lijo Lazar 
Date:   Wed Nov 26 14:59:14 2025 +0530

    drm/amd/pm: Use emit_clock_levels in vega10
    
    Keep only emit_clock_levels, and remove print_clock_levels.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit a8b81d3ddbbf5c86d21234135483a1fe91b33c1a
Author: Lijo Lazar 
Date:   Wed Nov 26 14:47:07 2025 +0530

    drm/amd/pm: Use emit_clock_levels in SMUv10.0
    
    Move to emit_clock_levels from print_clock_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 1803bdfb7e15706b7e2db4e55eb993bc1cc99758
Author: Lijo Lazar 
Date:   Wed Nov 26 14:45:16 2025 +0530

    drm/amd/pm: Use emit_clock_levels in SMUv8.0
    
    Move to emit_clock_levels from print_clock_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 723c504b5690ee1a75142ae4e3ed5cbaa9d90a9b
Author: Lijo Lazar 
Date:   Wed Nov 26 13:38:40 2025 +0530

    drm/amd/pm: Use emit_clock_levels in SMUv7.0
    
    Move to emit_clock_levels from print_clock_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit c5842537bd4317a1bc64670b4c7fc930cde47faa
Author: Lijo Lazar 
Date:   Wed Nov 26 13:27:44 2025 +0530

    drm/amd/pm: Use emit_clk_levels in SMUv14.0.2
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit b0e0503cb46875fd37206584453efbe0fe756bf6
Author: Lijo Lazar 
Date:   Wed Nov 26 13:24:19 2025 +0530

    drm/amd/pm: Use emit_clk_levels in SMUv14.0.0
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 5478777fd73a0f2d037e8f3f600a6c331a8e46a3
Author: Lijo Lazar 
Date:   Wed Nov 26 13:20:50 2025 +0530

    drm/amd/pm: Use emit_clk_levels in yellow carp
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 8456b756e5f861472e2adf6582b72f30a954952f
Author: Lijo Lazar 
Date:   Wed Nov 26 13:18:38 2025 +0530

    drm/amd/pm: Use emit_clk_levels in SMUv13.0.7
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 3ddd11780fa0c376895516eea62d788a0fc6749e
Author: Lijo Lazar 
Date:   Wed Nov 26 13:14:45 2025 +0530

    drm/amd/pm: Use emit_clk_levels in SMUv13.0.6
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 20e3ce630c43eabd82ca863807ce06e9cc8a08e5
Author: Lijo Lazar 
Date:   Wed Nov 26 13:03:32 2025 +0530

    drm/amd/pm: Use emit_clk_levels in SMUv13.0.5
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 0791b47395948a50545d0ce9c90a9291614954dc
Author: Lijo Lazar 
Date:   Wed Nov 26 13:00:18 2025 +0530

    drm/amd/pm: Use emit_clk_levels in SMUv13.0.4
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 9f63bcbaced1e23ad5b9108f4fc5b187bebbd74d
Author: Lijo Lazar 
Date:   Wed Nov 26 12:55:37 2025 +0530

    drm/amd/pm: Use emit_clk_levels in SMUv13.0.0
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit b824bf63894f42adbc8b29fd78e4ca1cee8c3779
Author: Lijo Lazar 
Date:   Wed Nov 26 12:47:06 2025 +0530

    drm/amd/pm: Use emit_clk_levels in renoir
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 46905fb85ec7c6c4013a0a94dabbf454a9780b5e
Author: Lijo Lazar 
Date:   Wed Nov 26 12:33:52 2025 +0530

    drm/amd/pm: Use emit_clk_levels in vangogh
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 8c293a93e81c2ab0345991e25887f86b94318787
Author: Lijo Lazar 
Date:   Wed Nov 26 12:29:41 2025 +0530

    drm/amd/pm: Use emit_clk_levels in cyan skillfish
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit fe1c48e9bda60b1b4d4f1d84980c66dde7c1954a
Author: Likun Gao 
Date:   Fri Mar 21 11:23:44 2025 +0800

    drm/amdgpu: add soc config init for GC v12_1
    
    Add function to initialize soc configuration information
    for GC 12.1.0 ASICs.
    Use it to map IPs and other SOC related information once IP
    configuration information is available through discovery.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit dc17c8af96488fc802e753c551c39acf9ea73bc3
Author: Lijo Lazar 
Date:   Wed Nov 26 12:22:15 2025 +0530

    drm/amd/pm: Use emit_clk_levels in sienna_cichild
    
    Move to emit_clk_levels from print_clk_levels
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit b34488070a80facd658b48171b0cad342018d20f
Author: Lijo Lazar 
Date:   Wed Nov 26 12:03:59 2025 +0530

    drm/amd/pm: Remove print_clk_levels from navi10
    
    Keep only emit_clk_levels as it covers print_clk_levels functionality
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 18a695030bf91604c168ad352b764f506accf219
Author: Zhu Lingshan 
Date:   Tue Aug 5 11:31:32 2025 +0800

    amdkfd: fence handler evict and restore a kfd process by its context id
    
    In fence enable signaling handler, kfd evicts
    and restores the corresponding kfd_process,
    this commit helps find the kfd_process by
    both its mm and context id.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 5701b7a93df7840ddf74399344f849d6292d8419
Author: Zhu Lingshan 
Date:   Wed Aug 6 21:37:26 2025 +0800

    amdkfd: record kfd context id in amdkfd_fence
    
    This commit records the context id of the
    cooresponding kfd process in amdkfd_fence
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 61a3ade2f68b73d903428083c42b8a6c11c54161
Author: Michael Chen 
Date:   Fri Mar 21 14:39:03 2025 -0400

    drm/amdgpu/mes12_1: set multi-xcc mes log address
    
    Set mes event log address based on xcc id and pipe.
    
    Signed-off-by: Michael Chen 
    Reviewed-by: Jack Xiao 
    Signed-off-by: Alex Deucher 

commit 75053887d6d8f527578ffcb1113bc336fae49b42
Author: Jack Xiao 
Date:   Mon Mar 10 17:02:36 2025 +0800

    drm/amdgpu/mes12_1: add cooperative dispatch support
    
    Add initial cooperative dispatch MES support.
    a. set shared cmd buffer for the group of cooperative dispatch mes.
    b. automatically dispatch add_hw_queue/remove_hw_queue to master mes.
    
    Signed-off-by: Jack Xiao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 2c0c485deaf96e403eb11d27d90de3e6099b2810
Author: Mukul Joshi 
Date:   Wed Feb 26 22:46:54 2025 -0500

    drm/amdkfd: Add interrupt handling for GFX 12.1.0
    
    Add interrupt handling for GFX 12.1.0 similar to what is done
    for GFX 9.4.3.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 01bbc4a4b94789c7c3b997ea5aacd4ec5fa97a11
Author: Mukul Joshi 
Date:   Wed Feb 26 22:22:00 2025 -0500

    drm/amdkfd: Add MQD manager for GFX 12.1.0
    
    This patch adds the following functionality for GFX 12.1.0:
    1. Add a new MQD manager for GFX v12.1.0.
    2. Add a new 12.1.0 specific device queue manager file.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 1fca2832e02e72cff4574de99a37450e6c7fce4a
Author: Mukul Joshi 
Date:   Wed Feb 26 22:09:56 2025 -0500

    drm/amdkfd: Add GFX 12.1.0 support in KFD
    
    Add support for GFX 12.1.0 in KFD.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 4da4990337b34be49b95d99524c99910f4f0577f
Author: Mukul Joshi 
Date:   Wed Feb 26 15:45:46 2025 -0500

    drm/amdgpu: Setup PCIe atomics bit in PTE on GFX 12.1.0
    
    To enable atomic access to memory, setup the new PCIe atomics bit
    in PTE on GFX 12.1.0.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit e08a675f940b2ec546236754718cd5f2a0054317
Author: Mukul Joshi 
Date:   Wed Feb 26 15:35:23 2025 -0500

    drm/amdgpu: Setup Atomics enable in TCP UTCL0 for GFX 12.1.0
    
    We need to explicitly setup atomics enable in TCP UTCL0 to enable
    PCIe atomics to host memory.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 9c34a4c19efa8686737c03f1718618da58cae546
Author: Mukul Joshi 
Date:   Wed Feb 26 15:29:09 2025 -0500

    drm/amdgpu: Fix golden register init for GFX 12.1.0
    
    TCP_UTCL0 registers are not per XCD so don't init them on a per
    XCD basis.
    
    Fixes: ad5f1ee0a9b0 ("drm/amdgpu: Add initial support for gfx v12_1")
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 1fee035bee8d99436cde73b5727c8a19ac9534b6
Author: Hawking Zhang 
Date:   Sun Mar 16 19:04:51 2025 +0800

    drm/amdgpu: Include the correct pkt header for gfx v12_1
    
    GFX v12_1 should use packets defined in gfx_v12_1_pkt
    header file.
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Acked-by: Feifei Xu 
    Signed-off-by: Alex Deucher 

commit f8692d2f9ae0a48bf378cc33717772c5f940ce0d
Author: Alex Sierra 
Date:   Fri Mar 7 12:17:34 2025 -0600

    drm/amd: include rrmt mode for mes_v12_1
    
    Implement rrmt for misc read/write regs ops in mes_v12.
    This covers LOCAL/REMOTE XCD and LOCAL/REMOTE AID.
    
    v2: fix comments (Alex)
    
    Signed-off-by: Alex Sierra 
    Reviewed-by: Mukul Joshi 
    Reviewed-by: Michael Chen 
    Signed-off-by: Alex Deucher 

commit e5fc897b076e0bd0bab9c32154fdb1bba6566127
Author: Likun Gao 
Date:   Tue Mar 11 14:53:05 2025 +0800

    drm/amdgpu: skip SDMA autoload copy if not initialized
    
    Skip SDMA firmware copy for rlc autoload if SDMA not enabled.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 6ee43047e8ada63c4dfee01e2ea7e7eadfcda2ab
Author: Chen Ridong 
Date:   Wed Nov 26 09:11:58 2025 +0000

    cpuset: Remove unnecessary checks in rebuild_sched_domains_locked
    
    Commit 406100f3da08 ("cpuset: fix race between hotplug work and later CPU
    offline") added a check for empty effective_cpus in partitions for cgroup
    v2. However, this check did not account for remote partitions, which were
    introduced later.
    
    After commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing
    synchronous"), cpuset hotplug handling is now synchronous. This eliminates
    the race condition with subsequent CPU offline operations that the original
    check aimed to fix.
    
    Instead of extending the check to support remote partitions, this patch
    removes all the redundant effective_cpus check. Additionally, it adds a
    check and warning to verify that all generated sched domains consist of
    active CPUs, preventing partition_sched_domains from being invoked with
    offline CPUs.
    
    Signed-off-by: Chen Ridong 
    Reviewed-by: Waiman Long 
    Signed-off-by: Tejun Heo 

commit 82d7e59ea707b55dc6c3ba3c56ded36742741bd4
Author: Chen Ridong 
Date:   Tue Dec 2 02:57:47 2025 +0000

    cgroup: switch to css_is_online() helper
    
    Use the new css_is_online() helper that has been introduced to check css
    online state, instead of testing the CSS_ONLINE flag directly. This
    improves readability and centralizes the state check logic.
    
    No functional changes intended.
    
    Signed-off-by: Chen Ridong 
    Acked-by: Shakeel Butt 
    Reviewed-by: Jan Kara 
    Signed-off-by: Tejun Heo 

commit 3e22786128e5c822abecdd4fc9444b6b8ca38c32
Author: Likun Gao 
Date:   Tue Mar 4 10:07:16 2025 +0800

    drm/amdgpu: only set XCC 0 related reg for rlc autoload
    
    For RLC autoload, only set XCC id 0 related register to trigger
    rlc autoload, no need to trigger muti-times for muti-xcc.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 08ba5ba01fa895c59f8462dcc4c6c4dee1760cb6
Author: Likun Gao 
Date:   Tue Feb 18 11:19:30 2025 +0800

    drm/amdgpu: update rlc autoload function
    
    Update rlc autoload function for gfx v12.1.0
    to support muti-XCC firmware autoload.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 442903eb83255da2aceec8e3184a3a8a9575b982
Author: Le Ma 
Date:   Tue Feb 25 19:24:33 2025 +0800

    drm/amdgpu: remove hdp flush/invalidation completely for gfx12.1.0/sdma7.1.0
    
    Remove the hdp operation and interfaces as the HDP hw does not exist.
    
    v2: add checks to see if hdp funcs exists before do hdp flush/invalidation
    
    Signed-off-by: Le Ma 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 25f687de6735beb5627e3f4d1445e3c4ce4b67e1
Author: Shaoyun Liu 
Date:   Wed Feb 5 12:06:50 2025 -0500

    drm/amd/include : Update MES v12 API header
    
    1. Add RRMT option support which will be used for remote die
       register access
    2. Update set_hw_resource1 for cooperative mode support
    3. Add full_sh_mem_config_data for xnack support
    
    v2: squash in compilation fix
    
    Signed-off-by: Shaoyun Liu 
    Acked-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit 6fb01a20daaaeb5521ec617f23f6b716f5b500af
Author: Likun Gao 
Date:   Thu Feb 13 10:16:04 2025 +0800

    drm/amdgpu: Add gfx v12_1_0 to discovery list
    
    Include gfx v12_1_0 in the discovery list for
    gfx IP blocks
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Reviewed-by: Mukul Joshi 
    Signed-off-by: Alex Deucher 

commit ad5f1ee0a9b03200b86db65fd946b686088b4b03
Author: Likun Gao 
Date:   Mon Feb 17 17:13:05 2025 +0800

    drm/amdgpu: Add initial support for gfx v12_1
    
    Add initial support for gfx ip block for gc v12_1.
    
    V2: Remove some not applicable bit set.
    V3: drop unused header (Alex)
    v4: Fix type on copyright
    v5: fix num_xcc handling (Alex)
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Reviewed-by: Mukul Joshi 
    Signed-off-by: Alex Deucher 

commit 78996e1e98f822d16363e2a7703ca243eda59ba8
Author: Zhu Lingshan 
Date:   Mon Mar 3 18:42:50 2025 +0800

    amdkfd: record kfd context id into kfd process_info
    
    This commit records the context id of the owner
    kfd_process into a kfd process_info when
    create it.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 07506945e138c191e913aba86030111a93a5b119
Author: Zhu Lingshan 
Date:   Thu Aug 21 14:41:31 2025 +0800

    amdkfd: introduce new helper kfd_lookup_process_by_id
    
    This commit introduces a new helper function
    kfd_lookup_process_by_id which can find a
    kfd process that identified by its context id from
    the kfd process table
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 2a667e26fa87b45fe4d89ed0c6ffd82c94c0a8a5
Author: Zhu Lingshan 
Date:   Mon Aug 4 16:18:58 2025 +0800

    amdkfd: remove test_kq
    
    This commit removes test_kq() function becuse it has been
    marked as unused since 2014 and no other functions calls it.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit b4f1e6a2718caef34bf990c705ff2bb64b730b77
Author: Randy Dunlap 
Date:   Fri Nov 28 23:37:39 2025 -0800

    drm/amd/display: correct kernel-doc in dml21_wrapper.h
    
    Fix all kernel-doc warnings in dml21_wrapper.h:
    - add missing @dml_ctx entries (2 places)
    - fix function prototype typo for dml21_create()
    - change a blank kernel-doc line to " *"
    
    Fixes these warnings:
    Warning: drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_wrapper.h:30
     function parameter 'dml_ctx' not described in 'dml21_create'
    Warning: drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_wrapper.h:30
     expecting prototype for dml2_create(). Prototype was for dml21_create()
     instead
    Warning: drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_wrapper.h:55
     bad line:
    Warning: drivers/gpu/drm/amd/display/dc/dml2_0/dml21/dml21_wrapper.h:61
     function parameter 'dml_ctx' not described in 'dml21_validate'
    
    Signed-off-by: Randy Dunlap 
    Signed-off-by: Alex Deucher 

commit e80205f3a7fff55249b430c21afc99faac93010a
Author: Asad Kamal 
Date:   Fri Nov 28 20:10:55 2025 +0800

    drm/amd/amdgpu: Move enum for VDD board
    
    Move AMDGPU_PP_SENSOR_VDDBOARD below already existing
    members to maintain backward compatibility
    
    Signed-off-by: Asad Kamal 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 6b6de6266f4c0fb07e96c14f3da0126f7d11dc37
Author: Xiaogang Chen 
Date:   Sat Nov 22 16:49:22 2025 -0600

    drm/amdgpu: Don't send warning when close drm obj if drm device has been unplug
    
    During amdgpu_gem_object_close amdgpu driver cleans vm mapping for the closing
    drm obj. If the correspondent adev has been unplug got error -ENODEV code. In
    this case do not need send warning message.
    
    Signed-off-by: Xiaogang Chen 
    Reviewed-by: Kent Russell 
    Signed-off-by: Alex Deucher 

commit d59e9d2d556ad7ce228200a2e804b57bb77b6c47
Author: Zhu Lingshan 
Date:   Mon Aug 4 15:36:31 2025 +0800

    amdkfd: process pointer of a HIQ should be NULL
    
    In kq_initialize, queue->process of a HIQ should
    be NULL as initialized, because it does not belong
    to any kfd_process.
    
    This commit decommisions the function kfd_get_process() because
    it can not locate a specific kfd_process among multiple
    contexts and not any code path calls it after this commit.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 018fd6d7d92d704709e8dfe497fe3aac1566e90f
Author: Lijo Lazar 
Date:   Fri Nov 28 12:36:46 2025 +0530

    drm/amdgpu: Make pre_asic_init optional
    
    pre_asic_init is not required for all SOCs. Make it optional and remove
    empty implementations.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Asad Kamal 
    Signed-off-by: Alex Deucher 

commit e1b73b64271d706079370b58b81292dafd373163
Author: Zhu Lingshan 
Date:   Mon Oct 13 16:41:36 2025 +0800

    amdkfd: remove DIQ support
    
    This commit remove DIQ support because it has been
    marked as DEPRECATED since 2022
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 4eb38fc0f1da9707b8866b4a91a4dd7c2becfda9
Author: Zhu Lingshan 
Date:   Mon Aug 4 15:33:51 2025 +0800

    amdkfd: find kfd_process by filep->private_data in kfd_mmap
    
    This commit finds the proper kfd_process by
    filep->private_data in kfd_mmap,
    because the function kfd_get_process()
    can not locate a specific kfd process among
    multiple contexts.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit fac682a1d1af12c6b9f97f7db91e1fbea2c40540
Author: Zhu Lingshan 
Date:   Tue Oct 14 17:16:06 2025 +0800

    amdkfd: identify a secondary kfd process by its id
    
    This commit introduces a new id field for
    struct kfd process, which helps identify
    a kfd process among multiple contexts that
    all belong to a single user space program.
    
    The sysfs entry of a secondary kfd process
    is placed under the sysfs entry folder of
    its primary kfd process.
    
    The naming format of the sysfs entry of a secondary
    kfd process is "context_%u" where %u is the context id.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 1707d5760c71b813fb5a4b6ccedcf21bc0ecb481
Author: Zhu Lingshan 
Date:   Mon Jun 30 11:00:29 2025 +0800

    amdkfd: process USERPTR allocation only on the primary kfd process
    
    The lifecycle of the primary kfd process is tied to
    the user space program, all secondary kfd process
    would be destroyed when fd close. Thus only the primary
    kfd process should process USERPTR memory allocation.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 26fc46d7942d0842ee9767a6d960ae5a9141f534
Author: Zhu Lingshan 
Date:   Fri Feb 14 14:06:19 2025 +0800

    amdkfd: process svm ioctl only on the primary kfd process
    
    svm ioctl should only be processed on the primary
    kfd process because only the lifecycle of the
    primary kfd process is tied to the  user space
    applicaiton.
    
    Another reason is in virtualization the hypervisor owns
    the primary kfd process as a privileged one.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 65cce2a172ff0f8b4a2d74a6c9a84243b94ca797
Author: Zhu Lingshan 
Date:   Mon Oct 28 15:55:01 2024 +0800

    amdkfd: destroy kfd secondary contexts through fd close
    
    Life cycle of a KFD secondary context(kfd_process) is tied
    to the opened file. Therefore this commit destroy a kfd
    secondary context when close the fd it belonging to.
    
    This commit extracts the code removing the kfd_process
    from the kfd_process_table to a separate function and
    call it in kfd_process_notifier_release_internal unconditionally.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 4cd255b9694647b784f085ae144b727b6ffdfbfc
Author: Zhu Lingshan 
Date:   Tue Apr 22 17:28:41 2025 +0800

    amdkfd: Introduce kfd_create_process_sysfs as a separate function
    
    KFD creates sysfs entries for a kfd_process in
    function kfd_create_process when creating it.
    
    This commit extracts the code creating sysfs
    entries to a separate function because it
    would be invoked in other code path like
    creating secondary kfd contexts (kfd_process).
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit f433db9c4b36c0963616def8dcc4696d1aafb95e
Author: Taimur Hassan 
Date:   Fri Nov 21 23:33:35 2025 -0500

    drm/amd/display: Promote DC to 3.2.361
    
    This version brings along the following updates:
    
     - Fix wrong x_pos and y_pos for cursor offload.
     - Fix Smart Power OLED not working after S4.
     - Fix double cursor when switching between hw and sw cursor.
     - Add configurable SPL namespace prefix.
     - Add register definitions in dcn_hubbub_registers.
     - Add additional info from DML.
     - Add dc interface for query QoS information.
     - Refactor HPD to increase flexibility.
     - Remove unused encoder types.
    
    Reviewed-by: Leo Li 
    Signed-off-by: Taimur Hassan 
    Signed-off-by: Roman Li 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 25888a46630875ea47024ee8d24614bf30f603a0
Author: Navid Assadian 
Date:   Wed Nov 12 14:35:12 2025 -0500

    drm/amd/display: Add configurable SPL namespace prefix
    
    [WHY]
    SPL is a shared library that is used both in kernel and userspace.
    When multiple libraries use SPL as statically linked, namespace
    collision occur.
    
    [HOW]
    Create a configurable namespace prefix.
    Add the prefix to all the public functions of the library to
    distinguish between the SPL functions in each library.
    
    Reviewed-by: Samson Tam 
    Signed-off-by: Navid Assadian 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 0e7f7b3a20a8531463592086579f1db31b4a3483
Author: Nicholas Kazlauskas 
Date:   Thu Nov 20 09:51:34 2025 -0500

    drm/amd/display: Reset pipe mask at beginning of cursor offload
    
    [Why]
    Double cursor when switching between hardware and software cursor when
    dragging an MPO window can occur with cursor offload enabled.
    
    The abort cursor update in the full programming path is responsible for
    this issue since it does not reset the pipe mask when attempting to
    submit an empty update.
    
    The firmware programs the payload as requested which may contain
    invalid or stale data for the previously enabled pipes, resulting in
    an offset or double cursor.
    
    [How]
    For performance we don't want to memset the entire payload structure
    due to its size, so just reset the pipe mask which will indicate the
    payload data is empty.
    
    Reviewed-by: Dillon Varone 
    Signed-off-by: Nicholas Kazlauskas 
    Signed-off-by: Roman Li 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit ae20768e30a84c80cf46aff49265e7c23ee3fe02
Author: Charlene Liu 
Date:   Tue Nov 18 16:16:13 2025 -0500

    drm/amd/display: add register definitions in dcn_hubbub_registers
    
    Reviewed-by: Roman Li 
    Signed-off-by: Charlene Liu 
    Signed-off-by: Roman Li 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 531fe6e0fee85a1bdb5b8223a706fff654ed0a61
Author: Jing Zhou 
Date:   Mon Nov 17 15:18:50 2025 +0800

    drm/amd/display: Correct FIXED_VS Link Rate Toggle Condition
    
    [WHY&HOW]
    The condition is only perform toggle if FIXED_VS LTTPR reports
    no IEEE OUI.
    The literal "\x0,\x0,\x0" contains commas changes the
    bytes being compared to {0x00,0x2C,0X00}.
    The correct literal should be "\x00\x00\x00" without commas.
    
    Reviewed-by: Charlene Liu 
    Reviewed-by: Wenjing Liu 
    Signed-off-by: Jing Zhou 
    Signed-off-by: Roman Li 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 03282bd20124125394f4540e9c6432615158b671
Author: Nevenko Stupar 
Date:   Wed Nov 19 15:13:48 2025 -0500

    drm/amd/display: Add additional info from DML
    
    for DMU when applicable on future platforms.
    
    Reviewed-by: Alvin Lee 
    Signed-off-by: Nevenko Stupar 
    Signed-off-by: Roman Li 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 7dedb906cdfec100061daf41f8e54266e975987d
Author: Dillon Varone 
Date:   Tue Nov 18 20:58:23 2025 +0000

    drm/amd/display: Guard FAMS2 configuration updates
    
    [WHY&HOW]
    If DMCUB is not initialized or FAMS2 is not supported, the
    interface should not be called.
    
    Reviewed-by: Sridevi Arvindekar 
    Signed-off-by: Dillon Varone 
    Signed-off-by: Roman Li 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit e4a3133c5b93ac27e3eaa50eab15465b31c9532d
Author: Wenjing Liu 
Date:   Mon Nov 10 14:37:26 2025 -0500

    drm/amd/display: add dc interface for query QoS information
    
    [why]
    Add support for retrieving Quality of Service (QoS) metrics from dc
    to enable performance analysis and bottleneck identification. This provides
    benchmark tools with real-time bandwidth and latency measurements from hardware
    performance counters, helping diagnose display system performance issues.
    
    [how]
    - Add dc_get_qos_info() function to DC layer for unified QoS data retrieval
    - Implement hardware sequencer interface with function pointers for QoS
    measurements
    - Integrate QoS metrics: peak/average bandwidth (Mbps) and max/average
    latency (ns)
    
    Reviewed-by: Aric Cyr 
    Signed-off-by: Wenjing Liu 
    Signed-off-by: Roman Li 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit c02288724b98cbc018231200891d66578f83f848
Author: Nicholas Kazlauskas 
Date:   Wed Nov 12 10:58:19 2025 -0500

    drm/amd/display: Fix wrong x_pos and y_pos for cursor offload
    
    [Why]
    The hubp401_cursor_set_position function programs a different value
    than it stores for use with cursor offload.
    
    This can cause a desync when switching between cursor programming paths.
    
    [How]
    We do the translation to destination space currently twice: once in the
    HWSS layer, and then again in the HUBP layer since we never store the
    translated result.
    
    HUBP expects to program the pos->x and pos->y directly for other ASIC,
    so follow that pattern here as well.
    
    Reviewed-by: Alvin Lee 
    Signed-off-by: Nicholas Kazlauskas 
    Signed-off-by: Roman Li 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit def3488eb0fdb386044aced1a8fb2592b1e68896
Author: Dmytro Laktyushkin 
Date:   Fri Nov 7 19:25:42 2025 -0500

    drm/amd/display: refactor HPD to increase flexibility
    
    Currently all dcn revisions have to follow the same codepath for
    hotplug detection. This change allows per dcn hpd handling consolidating
    hpd code in link_encoder.
    
    Reviewed-by: Dillon Varone 
    Signed-off-by: Dmytro Laktyushkin 
    Signed-off-by: Roman Li 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 6afc422e1a49d18b63f7042fb1cb6f519a972c8a
Author: Ivan Lipski 
Date:   Fri Nov 21 11:54:31 2025 -0500

    drm/amd/display: Use local variable for analog_engine initialization
    
    [Why&How]
    Use local variable for analog_engine retrieval and check if it is supported
    instead of the struct parameter.
    
    Signed-off-by: Ivan Lipski 
    Reviewed-by: Harry Wentland 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 4ab27b01df629545de5a5f9889867b0f19438cd8
Author: Ivan Lipski 
Date:   Fri Nov 21 11:48:49 2025 -0500

    drm/amd/display: Remove unused encoder types
    
    [Why&How]
    We only support ENCODER_ID_INTERNAL_UNIPHY encoders now, so NUTMEG & TRAVIS
    can be removed from translate_encoder_to_transmitter.
    
    Also refactor to use local variables of transmitter to exit early.
    
    V2: Fix construct_phy check for  TRANSMITTER_UKNOWN
    
    Signed-off-by: Ivan Lipski 
    Reviewed-by: Harry Wentland 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 3880d8e3c6ef2797900d5a437b705afe9baa815f
Author: Zhu Lingshan 
Date:   Tue Oct 29 16:46:34 2024 +0800

    amdkfd: find_process_by_mm always return the primary context
    
    Up until this commit, the kfd multiple contexts feature has
    not been fully implemented in mainline kernel yet.
    
    For backawrd compatibility, not break existing use cases,
    this commit changes function find_process_by_mm, let it
    always return the primary kfd_process.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 42cbb68ce896ea472ebcdb310ad01b6712fd4d13
Author: Pierre-Eric Pelloux-Prayer 
Date:   Mon Nov 17 10:53:14 2025 +0100

    drm/amdgpu: remove the ring param from ttm functions
    
    With the removal of the direct_submit argument, the ring param
    becomes useless: the jobs are always submitted to buffer_funcs_ring.
    
    Some functions are getting an amdgpu_device argument since they
    were getting it from the ring arg.
    
    ---
    v4: remove adev param from amdgpu_ttm_map_buffer
    ---
    
    Signed-off-by: Pierre-Eric Pelloux-Prayer 
    Acked-by: Felix Kuehling 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 3272cd887f2bc27825a6c053ca174dbb6eabc636
Author: Zhu Lingshan 
Date:   Mon Apr 21 15:47:54 2025 +0800

    amdkfd: mark the first kfd_process as the primary one
    
    The first kfd_process is created through open(),
    this commit marks it as the primary kfd_process
    by assigning a primary id for its context_id.
    
    Only the primary process should register the mmu_notifier.
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit fb61604a69fca0366efffb3abee8c0910024bdfa
Author: Likun Gao 
Date:   Wed Feb 19 12:00:23 2025 +0800

    drm/amdgpu: create pm4 header for gc v12_1
    
    Duplicated from nvd.h.
    Update Release MEM and Acquire MEM pkt header.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Reviewed-by: Mukul Joshi 
    Signed-off-by: Alex Deucher 

commit d6d64bf9754c167a777e513d52005653b1cb1e3a
Author: Jack Xiao 
Date:   Tue Feb 18 11:38:08 2025 +0800

    drm/amdgpu: Add mes v12_1_0 to discovery list
    
    Include mes v12_1_0 in the discovery list for
    mes IP blocks.
    
    Signed-off-by: Jack Xiao 
    Reviewed-by: Hawking Zhang 
    Reviewed-by: Mukul Joshi 
    Signed-off-by: Alex Deucher 

commit e220edf2d6fd6dbf08fa93790809500a80217948
Author: Jack Xiao 
Date:   Wed May 14 17:01:21 2025 +0800

    drm/amdgpu/mes_v12_1: initial support for mes_v12_1
    
    Duplicated and rename mes ip version name to v12_1_0.
    Fix to access correct ring pipe by xcc_id.
    Fix to access correct instance registers by xcc_id.
    Fix to access correct index registers by grbm/xcc_id.
    
    v2: rebase (Alex)
    v3: fix sw_fini (Alex)
    
    Signed-off-by: Jack Xiao 
    Reviewed-by: Hawking Zhang 
    Reviewed-by: Mukul Joshi 
    Signed-off-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 73aa1550dfeda9fff742dbba724c69d46e0908bf
Author: Pierre-Eric Pelloux-Prayer 
Date:   Fri Sep 19 09:13:12 2025 +0200

    drm/amdgpu: remove direct_submit arg from amdgpu_copy_buffer
    
    It was always false.
    
    Signed-off-by: Pierre-Eric Pelloux-Prayer 
    Reviewed-by: Christian König 
    Acked-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 7b0813f32a0c23a52bc174b9699ce7e0c3aa2ef6
Author: Lijo Lazar 
Date:   Mon Nov 24 14:21:43 2025 +0530

    drm/amdgpu: Rename userq_mgr_xa to userq_xa
    
    Rename since it is an xarray of userq pointers
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit dc21e39fd20c773cfa523b14030ce76190d96807
Author: Lijo Lazar 
Date:   Mon Nov 24 13:26:57 2025 +0530

    drm/amdgpu: Clean up userq helper functions
    
    Remove userq manager from function signatures. Get the associated
    manager from userq itself.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit d73e5302906a087b5aae3f09ec7936ef17213c52
Author: Likun Gao 
Date:   Mon Feb 17 11:53:16 2025 +0800

    drm/amdgpu: Set GC family for GC 12.1
    
    Set GC family for GC 12.1.0.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 7e00a84d11b0fc8a01a73383cd634353638cee5d
Author: Jack Xiao 
Date:   Tue Feb 18 11:58:53 2025 +0800

    drm/amdgpu: add new compute/mes mqd structure
    
    Add new compute_mqd and mes_mqd structure.
    V2: Rename to v12_1_compute_mqd and v12_1_mes_mqd..
    
    Signed-off-by: Jack Xiao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 5ba69099b66cc6dd63a3035c825c875871e88089
Author: Zhu Lingshan 
Date:   Thu Oct 24 10:32:38 2024 +0800

    amdkfd: enlarge the hashtable of kfd_process
    
    This commit enlarges the hashtable size of
    kfd_process to 256, because of the multiple
    contexts feature allowing each application
    create multiple kfd_processes
    
    Signed-off-by: Zhu Lingshan 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit 473f12f820956988eb735d4cfd88ce0640f5d3af
Author: Lijo Lazar 
Date:   Mon Nov 24 12:47:16 2025 +0530

    drm/amdgpu: Change user queue interface signatures
    
    A userq is associated with its queue manager. Use that and make
    the userqueue interfaces to operate on queue.
    
    Signed-off-by: Lijo Lazar 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit af441be8b75deb93ded51c54b9a2ba1e048b1c91
Author: Likun Gao 
Date:   Tue Mar 18 10:36:10 2025 +0800

    drm/amdgpu: add support for sdma v7_1
    
    Add support for SDMA v7.1.0 ip block.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 25140983ef074456d1939bd9684b8109b00d273e
Author: Mukul Joshi 
Date:   Fri Mar 28 21:20:28 2025 -0400

    drm/amdkfd: Add SDMA 7.1.0 support in KFD
    
    Add support for SDMA 7.1.0 in KFD.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 1c85f12658fb42136197ab0b580c4f4d4b707875
Author: Mukul Joshi 
Date:   Thu Oct 2 11:06:25 2025 -0400

    drm/amdgpu: Update Generate PTE/PDE SDMA packet for SDMA 7.1
    
    Update the Generate PTE/PDE packet fields for SDMA 7.1.
    
    v2: squash in mtype fix (Mukul)
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 4ed5116aacf6126ef9c7bc8cd7367ed6797e5c8f
Author: Likun Gao 
Date:   Tue Jan 7 10:15:31 2025 +0800

    drm/amdgpu: Add sdma v7_1_0 support
    
    Add SDMA ip block for SDMA v7_1_0.
    
    v2: squash in queue reset changes (Alex)
    v3: squash in version fix (Hawking)
    v4: squash in various fixes
    
    Signed-off-by: Likun Gao 
    Acked-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit 268614ae415e3e8b73e078d3a428b261eceaecd4
Author: Likun Gao 
Date:   Thu Feb 27 15:23:08 2025 +0800

    drm/amdgpu: create pkt header for sdma v7_1
    
    Duplicated from sdma_v6_0_0_pkt_open.h.
    Update some pkt for sdma v7_1.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit f9d8e880b1ac35ad8db82dbb56253634d525a584
Author: Le Ma 
Date:   Mon Feb 24 21:09:58 2025 +0800

    drm/amdgpu: add soc v1_0 common block for IP discovery
    
    add soc v1_0 common block
    
    Signed-off-by: Le Ma 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 297b0cebbcc3aad3fde692c988d5aa19f7b652b2
Author: Hawking Zhang 
Date:   Mon Feb 24 10:03:27 2025 +0800

    drm/amdgpu: Add soc v1_0 support
    
    v1_0 is a new generation ip block
    
    v2: squash in doorbell changes (Alex)
    v3: squash in xclk, reset placeholders, pcie r|wreg ext callbacks
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit c71980a3fc1dd7bf2f3c10b113d917e9f3cd10ae
Author: chong li 
Date:   Fri Nov 7 11:59:28 2025 +0800

    drm/amdgpu: reduce the full gpu access time in amdgpu_device_init.
    
    [Why]
    function "devm_memremap_pages" in function "kgd2kfd_init_zone_device",
    sometimes cost too much time.
    
    [How]
    move the function "kgd2kfd_init_zone_device"
    after release full gpu access(amdgpu_virt_release_full_gpu).
    
    v2:
    improve the coding style.
    
    Signed-off-by: chong li 
    Reviewed-by: Emily Deng 
    Signed-off-by: Alex Deucher 

commit ec62b7ded978957ec74add4c1feccc986e2baeef
Author: Andrew Martin 
Date:   Thu Nov 13 11:03:59 2025 -0500

    drm/amdkfd: Uninitialized and Unused variables
    
    This patch initialize key variables and removed unused ones.
    
    Signed-off-by: Andrew Martin 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit 46e0c86caa172b6dc711ed595a3b4655666698d7
Author: Taimur Hassan 
Date:   Fri Nov 14 18:59:49 2025 -0500

    drm/amd/display: Promote DC to 3.2.360
    
    This version brings along the following updates:
    - Add additional checks for PSP footer size
    - Correct DSC padding accounting
    - Check ATOM_DEVICE_CRT2_SUPPORT in dc_load_detection
    - Drop FPU flags from dml21_wrapper.c
    - Permit DC_FP_START/END only in non-FP compilation units
    - Add cursor offload abort to the new HWSS path
    - Move dml2_create and init to the non-FPU dml2_wrapper
    - Move dml2_validate to the non-FPU dml2_wrapper
    - Rename dml2_wrapper.c to dml2_wrapper_fpu.c
    - Increase EDID read retries
    - Correct comment style
    - Move CONNECTOR_ID_PCIE into switch/case
    - Drop needless check for link->link_id.id
    - Improve readability of link_detect_sink_signal_type
    - Don't change brightness for disabled connectors
    - Write default Vesa Aux backlight control in dmub
    - Refactor panel replay dc libs
    - Revise VSC SDP header for Panel Replay
    - Fix sending redundant enable command to dmub
    - Parse debug flag to PR FW
    - Add AS-SDP v2 support for eDP feature
    - Refactor panel replay set dmub cmd flow
    - Improve HDMI info retrieval
    - Check NULL before accessing
    
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Taimur Hassan 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit d28e92093ceffb424b9b0e36bbd391c83b1cfe78
Author: Taimur Hassan 
Date:   Fri Nov 14 18:02:57 2025 -0500

    drm/amd/display: [FW Promotion] Release 0.1.37.0
    
    Add a new disallow_time_us state and a new legacy_method_no_fams2 flag
    to fam2.
    
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Taimur Hassan 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit e1b385726f7f7fc75b6cd3c2216430de8a625a2d
Author: Ovidiu Bunea 
Date:   Tue Nov 11 15:44:08 2025 -0500

    drm/amd/display: Add additional checks for PSP footer size
    
    [WHY & HOW]
    Newer ASICs have different PSP footer sizes which lead to driver
    failing to locate the DMCUB FW meta info, which in turn causes
    improper DMCUB FW loading and causes DMCUB to crash.
    
    Add support for custom PSP footer sizes and check 512B by default
    as well.
    
    Reviewed-by: Charlene Liu 
    Signed-off-by: Ovidiu Bunea 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit c7062be3380cb20c8b1c4a935a13f1848ead0719
Author: Relja Vojvodic 
Date:   Wed Nov 12 15:21:46 2025 -0500

    drm/amd/display: Correct DSC padding accounting
    
    [WHY]
    - After the addition of all OVT patches, DSC padding was being accounted
      for multiple times, effectively doubling the padding
    - This caused compliance failures or corruption
    
    [HOW]
    - Add padding to DSC pic width when required by HW, and do not re-add
      when calculating reg values
    - Do not add padding when computing PPS values, and instead track padding
      separately to add when calculating slice width values
    
    Reviewed-by: Chris Park 
    Reviewed-by: Wenjing Liu 
    Signed-off-by: Relja Vojvodic 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit a574f53ed52e7c5c0e67e67efd76f296d42f0cdd
Author: Ard Biesheuvel 
Date:   Thu Oct 9 17:06:21 2025 +0200

    drm/amd/display: Permit DC_FP_START/END only in non-FP compilation units
    
    [WHAT]
    Test the existing CPP macro _LINUX_FPU_COMPILATION_UNIT, which is set
    when building source files that are permitted to use floating point,
    in the implementation of DC_FP_START/END so that those are only usable
    in non-FP code. This is a requirement of the generic kernel mode FPU
    API, as some architectures (i.e., arm64) cannot safely enable FP codegen
    in arbitrary code.
    
    Cc: Austin Zheng 
    Cc: Jun Lei 
    Cc: Harry Wentland 
    Cc: Leo Li 
    Cc: Rodrigo Siqueira 
    Cc: Alex Deucher 
    Cc: "Christian König" 
    Cc: amd-gfx@lists.freedesktop.org
    Cc: dri-devel@lists.freedesktop.org
    
    Suggested-by: Christian König 
    Acked-by: Christian König 
    Reviewed-by: Alex Hung 
    Signed-off-by: Ard Biesheuvel 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 03fc40766d01b05175d3b657b78686d9805bf3c5
Author: Harry Wentland 
Date:   Thu Nov 13 15:22:04 2025 -0500

    drm/amd/display: Drop FPU flags from dml21_wrapper.c
    
    [WHAT]
    The existing CFLAGS_ lines were pointing to a wrong location
    for dml21_wrapper.c and were thereby ineffective. This means
    dml21_wrapper.c is not an FPU compilation unit. Remove the
    (erroneous) CFLAGS_ entries.
    
    Reviewed-by: Aurabindo Pillai 
    Signed-off-by: Harry Wentland 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 811ffdbf2042b6373a4f60159ca1c5ac92dfda16
Author: Harry Wentland 
Date:   Thu Oct 30 15:10:02 2025 -0400

    drm/amd/display: Move dml2_create and init to the non-FPU dml2_wrapper
    
    [WHAT]
    dml2_init calls DC_FP_START/END and needs to be moved out
    of the FPU compilation unit.
    
    Reviewed-by: Austin Zheng 
    Signed-off-by: Harry Wentland 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 69249b477b95f91e56bb19ec53707253899458c4
Author: Harry Wentland 
Date:   Thu Oct 30 14:26:57 2025 -0400

    drm/amd/display: Move dml2_validate to the non-FPU dml2_wrapper
    
    [WHAT]
    It calls DC_FP_START/END and shouldn't be living inside an
    FPU compilation unit.
    
    Reviewed-by: Austin Zheng 
    Signed-off-by: Harry Wentland 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 20f311b652e7f90792759f8c91e3ce3e77fdf3b4
Author: Harry Wentland 
Date:   Thu Oct 30 14:12:30 2025 -0400

    drm/amd/display: Rename dml2_wrapper.c to dml2_wrapper_fpu.c
    
    [WHAT]
    This function is an FPU compilation unit. Therefore it's not
    allowed to call DC_FP_START/END functions. It currently does
    so and we'll need to move those functions out. Therefore
    rename the existing compilation unit so we can introduce a
    non-FPU dml2_wrapper.c.
    
    Reviewed-by: Austin Zheng 
    Signed-off-by: Harry Wentland 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit bd3c91d6ca5e17263fc56d1d6c06d0b0270a8a29
Author: Mario Limonciello (AMD) 
Date:   Fri Oct 24 10:09:28 2025 -0500

    drm/amd/display: Correct comment style
    
    [WHAT]
    Comments should have /* and */ on their own lines.
    
    Reviewed-by: Alex Hung 
    Signed-off-by: Mario Limonciello (AMD) 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit 036dd0380b709ce8f40d8e87c289b3662eabbfff
Author: Mario Limonciello (AMD) 
Date:   Fri Oct 24 10:05:31 2025 -0500

    drm/amd/display: Drop needless check for link->link_id.id
    
    [WHY]
    The switch/case in `link_detect_sink_signal_type` already detects the
    link ID of `CONNECTOR_ID_HDMI_TYPE_A`.
    
    [How]
    Drop the extra match.
    
    Reviewed-by: Alex Hung 
    Signed-off-by: Mario Limonciello (AMD) 
    Signed-off-by: Alex Hung 
    Tested-by: Dan Wheeler 
    Signed-off-by: Alex Deucher 

commit a3bba93360d7348a420180298827c8f4f9296b3e
Author: Mario Limonciello (AMD) 
Date:   Fri Oct 24 10:07:40 2025 -0500

    drm/amd/display: Move CONNECTOR_ID_PCIE into switch/case
    
    [WHY]
    There is already a switch/case looking at link->link_id.id.
    
    [How]
    Move the case of `CONNECTOR_ID_PCIE` into switch case.
    
    Reviewed-by: Alex Hung 
    Signed-off-by: Mario Limonciello (AMD) 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit 4191fa9046b85f31e6803aa4e31758414010cf7c
Author: Mario Limonciello (AMD) 
Date:   Fri Oct 24 10:03:41 2025 -0500

    drm/amd/display: Improve readability of link_detect_sink_signal_type
    
    [WHAT]
    Move the break statements indentation in for the switch/case block.
    
    Reviewed-by: Alex Hung 
    Signed-off-by: Mario Limonciello (AMD) 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit 08f133e932cccd9a039bde367fe436594220bde3
Author: Derek Lai 
Date:   Fri Oct 31 10:58:52 2025 +0800

    drm/amd/display: Write default Vesa Aux backlight control in dmub
    
    [WHY]
    Some OLED panels require driver to write Aux BL before link training or
    turning on backlight; otherwise monitor brightness will change.
    
    [HOW]
    Write the default Vesa Aux backlight control in dmub.
    
    Reviewed-by: Wenjing Liu 
    Signed-off-by: Derek Lai 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit 201648dc812bdadbecf650ea11efa1b3fcee35e2
Author: Jack Chang 
Date:   Thu Nov 6 11:54:03 2025 +0800

    drm/amd/display: Refactor panel replay dc libs
    
    [WHY]
    Add dc interface to export link service libs for setting PR dmub command.
    
    Reviewed-by: Robin Chen 
    Signed-off-by: Jack Chang 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit a6edaf570058bdee78d947294aa987cfa958b898
Author: Jack Chang 
Date:   Tue Oct 14 16:28:51 2025 +0800

    drm/amd/display: Revise VSC SDP header for Panel Replay
    
    [WAHT]
    Add vsc sdp header setting for Panel Replay.
    
    Reviewed-by: Robin Chen 
    Signed-off-by: Jack Chang 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit 6d76189a84484060a93e961c6eed5593144c253d
Author: Jack Chang 
Date:   Wed Sep 17 15:51:40 2025 +0800

    drm/amd/display: Fix sending redundant enable command to dmub
    
    [WHY & HOW]
    Fix sending repeating PR enable/disable command to dmub
    which causing performance problem
    
    Reviewed-by: Robin Chen 
    Signed-off-by: Jack Chang 
    Signed-off-by: Leon Huang 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit ca4310e86b527c61f15a9e7b8b1dc062daba8463
Author: Jack Chang 
Date:   Fri Sep 12 15:40:18 2025 +0800

    drm/amd/display: Parse debug flag to PR FW
    
    [HOW & WHY]
    Parse debug flag to PR FW.
    
    Reviewed-by: Robin Chen 
    Signed-off-by: Jack Chang 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit 5e07a945856df30618be02a14e88180f09235ca0
Author: Jack Chang 
Date:   Thu Sep 11 16:22:53 2025 +0800

    drm/amd/display: Add AS-SDP v2 support for eDP feature
    
    [WHY & HOW]
    VESA Panel Replay requires AS-SDP v2 support.
    Need to add checking flow to enable AS-SDP v2 in this case.
    
    Reviewed-by: Robin Chen 
    Signed-off-by: Jack Chang 
    Signed-off-by: Leon Huang 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit 74ce00932e7eec6a985c2b650e95fce0f334d772
Author: Jack Chang 
Date:   Wed Sep 3 15:41:15 2025 +0800

    drm/amd/display: Refactor panel replay set dmub cmd flow
    
    [WHY]
    Add link service interface for setting PR dmub command
    
    Reviewed-by: Robin Chen 
    Signed-off-by: Jack Chang 
    Signed-off-by: Leon Huang 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit c78e31bcf586f1c910a2636650840f5ce1cb1c63
Author: Ivan Lipski 
Date:   Fri Nov 7 16:50:37 2025 -0500

    drm/amd/display: Improve HDMI info retrieval
    
    [WHY & HOW]
    Make a dedicated function to read HDMI-related monitor info, including
    monitor's SCDC support.
    
    Suggested-by: Fangzhi Zuo 
    Reviewed-by: Jerry Zuo 
    Signed-off-by: Ivan Lipski 
    Signed-off-by: Alex Hung 
    Signed-off-by: Alex Deucher 

commit ecd3fdfbeefdf3ecd075349bf7535d950efd56b3
Author: Ed Maste 
Date:   Fri Nov 21 15:12:36 2025 +0000

    drm/amd/amdgpu: Add missing newline in DRM_DEBUG_DRIVER message
    
    This error message was emitted without a newline during bring-up on
    FreeBSD.  Presumably the error doesn't occur on Linux so was not noticed
    before.
    
    Signed-off-by: Ed Maste 
    Reviewed-by: Mario Limonciello 
    Signed-off-by: Alex Deucher 

commit e53833ac820645b0465b27b6beb69e0f1889d57a
Author: Likun Gao 
Date:   Thu Feb 13 10:22:34 2025 +0800

    drm/amdgpu: Add gmc v12_1_0 to discovery list
    
    Include gmc v12_1_0 in the discovery list for
    gmc IP blocks.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit 2634ef1b8c00207dde5101e926241957aa5652b8
Author: Mukul Joshi 
Date:   Tue Aug 12 22:57:38 2025 -0400

    drm/amdkfd: Fix PTE clearing during SVM unmap on GFX 12.1
    
    During migration from VRAM to RAM, when PTE is cleared, reset
    the PTE to always ensure that PTE.P=1 is set on GFX 12.1. If
    PTE.P is not set, it can lead to TF faults.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 3a338bb1144d622ca2daea67756ebc9301579785
Author: Mukul Joshi 
Date:   Fri Sep 5 22:33:15 2025 -0400

    drm/amdgpu: Enable PDE.C usage on GFX 12.1
    
    On GFX 12.1, PDE.C is ignored if (PDE|PTE)_REQUEST_PHYSICAL
    is not setup in the GCVM control register. Always set this
    field to enable PDE.C usage.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit b8c27208b28768e8a6162f69a05508ded61f03ac
Author: Mukul Joshi 
Date:   Thu Aug 21 13:51:57 2025 -0400

    drm/amdgpu: Always set snoop bit in PDE on GFX 12.1
    
    GFX 12.1 has the requirement to always set snoop bit in PDE
    to maintain coherency.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit db29ddf6505f3e831e000c95ae013b18a37f70bc
Author: Mukul Joshi 
Date:   Thu Apr 24 21:51:23 2025 -0400

    drm/amdgpu: Add per-ASIC PTE init flag
    
    On GFX12.1, default PTE setup needs an additional bit to be
    set. Add PTE initialization flags to handle setup default PTE
    on a per-ASIC basis.
    While at it, fixup the coding style too.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit 5056b75fedc01de0563267c53e1aa7e41357f37a
Author: Hawking Zhang 
Date:   Mon Feb 24 14:38:30 2025 +0800

    drm/amdgpu: Add gmc v12_1 gmc callbacks
    
    Implement gmc v12_1 gmc callbacks
    
    v2: revert temporary PDE MTYPE to UC setting
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Reviewed-by: Mukul Joshi 
    Signed-off-by: Alex Deucher 

commit 036c0e38bb3dcfe0af848aa94224e6967a4b616c
Author: Likun Gao 
Date:   Fri Feb 7 12:55:45 2025 +0800

    drm/amdgpu: Add gmc v12_1 support
    
    Add gmc support for gc version 12_1_0.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit e87bfaf55e7311b9587c0163060c6939c36f077e
Author: Hawking Zhang 
Date:   Mon Feb 24 15:26:07 2025 +0800

    drm/amdgpu: Add gfxhub v12_1 support
    
    gfxhub v12_1 is a new generation ip
    
    v2: squash in update to new IP headers
    v3: squash in cast fix
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Le Ma 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 91c93c090dfc58a3dcc97bb5e43b27892e043e9f
Author: Hawking Zhang 
Date:   Fri Aug 29 13:39:11 2025 +0800

    drm/amdgpu: Add gc v12_1_0 ip headers v4
    
    Add header files for gc v12_1_0 register offsets
    and shift masks
    v2: Update gc v12_1_0 ip headers
    v3: Update gc v12_1_0 ip headers
    v4, v5: Clean up registers (Alex)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 755b5591739cc5c66158da596cf30853b613af5b
Author: Hawking Zhang 
Date:   Fri Aug 29 13:03:34 2025 +0800

    drm/amdgpu: Add osssys v7_1_0 ip headers v3
    
    Add header files for osssys v7_1_0 register offsets
    and shift masks
    v2: Update osssys v7_1_0 ip headers to the latest version
    v3: Clean up registers (Alex)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 4af2e15c9bf240206aa14089791c28abc59eaa44
Author: Likun Gao 
Date:   Fri Aug 29 14:08:59 2025 +0800

    drm/amdgpu: Add initial support for mmhub v4_2
    
    Add initial support for mmhub v4_2_0.
    
    v2: squash in cast fix
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Le Ma 
    Signed-off-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit d09c6b98f8080c3ae55d75023ed80fdbaf3519d4
Author: Alex Deucher 
Date:   Wed Nov 19 10:14:29 2025 -0500

    drm/amdgpu: fix spelling in gmc9/10 code
    
    onyl -> only
    
    Reviewed-by: Pierre-Eric Pelloux-Prayer 
    Signed-off-by: Alex Deucher 

commit bd68a1404b6fa2e7e9957b38ba22616faba43e75
Author: Asad Kamal 
Date:   Fri Nov 21 00:46:23 2025 +0800

    drm/amdgpu/ras: Move ras data alloc before bad page check
    
    In the rare event if eeprom has only invalid address entries,
    allocation is skipped, this causes following NULL pointer issue
    [  547.103445] BUG: kernel NULL pointer dereference, address: 0000000000000010
    [  547.118897] #PF: supervisor read access in kernel mode
    [  547.130292] #PF: error_code(0x0000) - not-present page
    [  547.141689] PGD 124757067 P4D 0
    [  547.148842] Oops: 0000 [#1] PREEMPT SMP NOPTI
    [  547.158504] CPU: 49 PID: 8167 Comm: cat Tainted: G           OE      6.8.0-38-generic #38-Ubuntu
    [  547.177998] Hardware name: Supermicro AS -8126GS-TNMR/H14DSG-OD, BIOS 1.7 09/12/2025
    [  547.195178] RIP: 0010:amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu]
    [  547.210375] Code: e8 63 78 82 c0 45 31 d2 45 3b 75 08 48 8b 45 a0 73 44 44 89 f1 48 8b 7d 88 48 89 ca 48 c1 e2 05 48 29 ca 49 8b 4d 00 48 01 d1 <48> 83 79 10 00 74 17 49 63 f2 48 8b 49 08 41 83 c2 01 48 8d 34 76
    [  547.252045] RSP: 0018:ffa0000067287ac0 EFLAGS: 00010246
    [  547.263636] RAX: ff11000167c28130 RBX: ff11000127600000 RCX: 0000000000000000
    [  547.279467] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff11000125b1c800
    [  547.295298] RBP: ffa0000067287b50 R08: 0000000000000000 R09: 0000000000000000
    [  547.311129] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
    [  547.326959] R13: ff11000217b1de00 R14: 0000000000000000 R15: 0000000000000092
    [  547.342790] FS:  0000746e59d14740(0000) GS:ff11017dfda80000(0000) knlGS:0000000000000000
    [  547.360744] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [  547.373489] CR2: 0000000000000010 CR3: 000000019585e001 CR4: 0000000000f71ef0
    [  547.389321] PKRU: 55555554
    [  547.395316] Call Trace:
    [  547.400737]  
    [  547.405386]  ? show_regs+0x6d/0x80
    [  547.412929]  ? __die+0x24/0x80
    [  547.419697]  ? page_fault_oops+0x99/0x1b0
    [  547.428588]  ? do_user_addr_fault+0x2ee/0x6b0
    [  547.438249]  ? exc_page_fault+0x83/0x1b0
    [  547.446949]  ? asm_exc_page_fault+0x27/0x30
    [  547.456225]  ? amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu]
    [  547.470040]  ? mas_wr_modify+0xcd/0x140
    [  547.478548]  sysfs_kf_bin_read+0x63/0xb0
    [  547.487248]  kernfs_file_read_iter+0xa1/0x190
    [  547.496909]  kernfs_fop_read_iter+0x25/0x40
    [  547.506182]  vfs_read+0x255/0x390
    
    This also result in space left assigned to negative values.
    Moving data alloc call before bad page check resolves both the issue.
    
    Signed-off-by: Asad Kamal 
    Suggested-by: Lijo Lazar 
    Reviewed-by: Hawking Zhang 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit d8c2c6c33d494a7868584b0e741628af662bf621
Author: Srinivasan Shanmugam 
Date:   Mon Oct 6 19:46:54 2025 +0530

    drm/amdgpu: Map/Unmap MMIO_REMAP as BAR register window; add TTM sg helpers; wire dma-buf
    
    MMIO_REMAP (HDP flush page) exposes a hardware MMIO register window via
    a PCI BAR; there are no struct pages backing it (not normal RAM).  But
    when one device shares memory with another through dma-buf, the receiver
    still expects a delivery route—a list of DMA-able chunks—called an
    sg_table. For the BAR window, we can’t (no pages!), so we instead create
    a one-entry list that points directly to the BAR’s physical bus address
    and tell DMA: “use this I/O span.” - A single, contiguous byte range on
    the PCI bus (start DMA address + length)). That’s why we map it with
    dma_map_resource() and set sg_set_page(..., NULL, ...). Perform DMA
    reads/writes directly to that range so we build an sg_table from a BAR
    physical span and map it with dma_map_resource().
    
    This patch centralizes the BAR-I/O mapping in TTM and wires dma-buf to
    it:
    
    Add amdgpu_ttm_mmio_remap_alloc_sgt() /
    amdgpu_ttm_mmio_remap_free_sgt(). They walk the TTM resource via
    amdgpu_res_cursor, add the byte offset to adev->rmmio_remap.bus_addr,
    build a one-entry sg_table with sg_set_page(NULL, …), and map/unmap it
    with dma_map_resource().
    
    In dma-buf map/unmap, if the BO is in AMDGPU_PL_MMIO_REMAP, call the new
    helpers.
    
    Single place for BAR-I/O handling: amdgpu_ttm.c in
    amdgpu_ttm_mmio_remap_alloc_sgt() and ..._free_sgt().
    No struct pages: sg_set_page(sg, NULL, cur.size, 0); inside
    amdgpu_ttm_mmio_remap_alloc_sgt().
    Minimal sg_table: sg_alloc_table(*sgt, 1, GFP_KERNEL); inside
    amdgpu_ttm_mmio_remap_alloc_sgt().
    Hooked into dma-buf: amdgpu_dma_buf_map()/unmap() in amdgpu_dma_buf.c
    call these helpers for AMDGPU_PL_MMIO_REMAP.
    
    v2: squash in fix for set/get tiling
    
    Suggested-by: Christian König 
    Cc: Alex Deucher 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit de8955508b72f8a88afc3f2cbb62334d5f79ccc3
Author: Srinivasan Shanmugam 
Date:   Mon Oct 6 19:46:53 2025 +0530

    drm/amdgpu/ttm: Pin 4K MMIO_REMAP Singleton BO at Init v2
    
    MMIO_REMAP (HDP flush page) is a hardware I/O window exposed via a PCI
    BAR.  It must not migrate or be evicted.
    
    Allocate a single 4 KB GEM BO in AMDGPU_GEM_DOMAIN_MMIO_REMAP during TTM
    initialization when the hardware exposes a remap bus address and the
    host page size is <= 4 KiB. Reserve the BO and pin it at the TTM level
    so it remains fixed for its lifetime. No CPU mapping is established
    here.
    
    On teardown, reserve, unpin, and free the BO if present.
    
    This prepares the object to be shared (e.g., via dma-buf) without
    triggering placement changes or no CPU-access migration
    
    v2: Added extra NULL checks
    
    Suggested-by: Christian König 
    Suggested-by: Alex Deucher 
    Signed-off-by: Srinivasan Shanmugam 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 54c2d9739bb748d0f7d6aaa101562cfa5963551d
Author: YiPeng Chai 
Date:   Mon Nov 3 16:32:18 2025 +0800

    drm/amd/ras: Compatible with legacy sriov host
    
    If sriov host is legacy, the guest uniras will
    be disabled.
    
    Signed-off-by: YiPeng Chai 
    Reviewed-by: Tao Zhou 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 73c6c22694430089a6f39f1677fbf598785376d3
Author: YiPeng Chai 
Date:   Thu Oct 30 16:49:14 2025 +0800

    drm/amd/ras: Add sriov ras preprocessing before gpu reset
    
    Sriov host may clear all VF commands registered to auto
    update list during VF reset, set ecc.auto_uUpdate block
    to false before VF reset, and after VF reset is complete,
    RAS_CMD__GET_ALL_BLOCK_ECC_STATUS command will be re-registered
    to auto update list of sriov host.
    
    Signed-off-by: YiPeng Chai 
    Reviewed-by: Tao Zhou 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 61a9a4138b57dda023ee4f473724c48d7fd3640b
Author: Hawking Zhang 
Date:   Fri Aug 29 12:01:26 2025 +0800

    drm/amdgpu: Add mmhub v4_2_0 ip headers v5
    
    Add header files for mmhub v4_2_0 register offsets
    and shift masks
    v2: Update mmhub v4_2_0 ip headers
    v3: Update mmhub v4_2_0 ip headers
    v4: Clean up registers (Alex)
    v5: Clean up registers (Alex)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 11dcf72eb5c15c07332b3dc4ae921021f2fae426
Author: YiPeng Chai 
Date:   Thu Oct 30 16:06:25 2025 +0800

    drm/amd/ras: Support high-frequency querying sriov ras block error count
    
    Support high-frequency querying sriov ras block error count:
    1. Create shared memory and fills it with RAS_CMD__GET_LAL_LOC_STATUS
       ras command.
    2. The RAS_CMD_GET_ALL_BLOCK_ECC_STATUS command and shared
       memory are registered to sriov host ras auto-update list
       via RAS_CMD_SET_CMD_AUTO_UPDATE command.
    3. Once sriov host detects ras error, it will automatically execute
       RAS_CMD__GET_ALL_BLOCK_ECC_STATUS command and write the result to
       shared memory.
    
    Signed-off-by: YiPeng Chai 
    Reviewed-by: Tao Zhou 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit fcfa8dbb087ec05cebdf177217fd5a01383a762b
Author: YiPeng Chai 
Date:   Tue Nov 11 15:43:02 2025 +0800

    drm/amd/ras: Add ras command to retrieve cper data from sriov host
    
    In order to reduce the number of interactions with sriov
    host and the amount of data exchanged, a set of ras commands
    is first used to obtain the raw data used to generate cper
    from the host, then, guest driver generates cper based
    on the obtained raw data.
    
    Signed-off-by: YiPeng Chai 
    Reviewed-by: Tao Zhou 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 1c254be41132c6bd41524659e06f9b1898234c98
Author: Asad Kamal 
Date:   Sun Nov 9 14:12:43 2025 +0800

    drm/amd/pm: Enable system power caps for smu_v13_0_12
    
    Enable system power caps to fetch system power and threshold for
    smu_v13_0_12
    
    Signed-off-by: Asad Kamal 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit c4031deddec903fc9472ca563a2d04f9c9ac8265
Author: Asad Kamal 
Date:   Wed Oct 29 21:14:44 2025 +0800

    drm/amd/pm: Fetch ubb power for smu_v13_0_12
    
    Feth ubb power from system metrics table for smu_v13_0_12
    
    Signed-off-by: Asad Kamal 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit c174a6317be0aac7e1953eefd680af6b9be91bc2
Author: YiPeng Chai 
Date:   Wed Nov 5 15:12:11 2025 +0800

    drm/amd/ras: Support sriov uniras to obtain cper data
    
    Support sriov uniras to obtain cper data.
    
    Signed-off-by: YiPeng Chai 
    Reviewed-by: Tao Zhou 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 1855fc6b09bc8f42c29cc4b6bf576dd08d2a6564
Author: YiPeng Chai 
Date:   Thu Oct 30 15:07:11 2025 +0800

    drm/amd/ras: sriov supports handling VF ras commands.
    
    Add basic framework code to sriov to handle
    VF ras commands.
    
    Signed-off-by: YiPeng Chai 
    Reviewed-by: Tao Zhou 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 60a300780d8abb4c98f2837059db63f6211a54f0
Author: YiPeng Chai 
Date:   Tue Oct 21 10:13:29 2025 +0800

    drm/amdgpu: Add virt command to send VF ras command
    
    Add virt command and interface to send VF ras command.
    
    Signed-off-by: YiPeng Chai 
    Reviewed-by: Tao Zhou 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit f752e79d38857011f1293fcb6c810409c3b669ee
Author: Tao Zhou 
Date:   Wed Nov 19 15:21:43 2025 +0800

    drm/amdgpu: fix the calculation of RAS bad page number
    
    __amdgpu_ras_restore_bad_pages is responsible for the maintenance of bad
    page number, drop the unnecessary bad page number update in the error
    handling path of add_bad_pages.
    
    Signed-off-by: Tao Zhou 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 209529414ef0bcb46bf59f8368224e25167fc50d
Author: Asad Kamal 
Date:   Wed Oct 29 21:49:59 2025 +0800

    drm/amd/pm: Add sysfs node for ubb power
    
    Add sysfs node to expose ubb power limit for smu_v13_0_12
    
    v2: Update sysfs node name to baseboard_power & baseboard_power_limit to
    make it consistent with other node names (Lijo)
    
    Signed-off-by: Asad Kamal 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit e8f4ea34b6cfa7ac47a518e36193dcc7573f6afc
Author: Asad Kamal 
Date:   Wed Oct 29 19:41:44 2025 +0800

    drm/amd/pm: Update pmfw headers for smu_v13_0_12
    
    Update pmfw headers for smu_v13_0_12 to include ubb power
    
    Signed-off-by: Asad Kamal 
    Reviewed-by: Lijo Lazar 
    Signed-off-by: Alex Deucher 

commit 03dc0a6cb6dc8a2ca0201acf599adb26b8c9423b
Author: Rodrigo Siqueira 
Date:   Tue Nov 18 17:45:54 2025 -0700

    Documentation/gpu: Add documentation about ring buffer
    
    AMDGPU heavily relies on ring buffers to manage its components; as a
    result, it has an elaborate mechanism of operation with multiple details
    around it. This commit introduces new documentation on ring buffers,
    detailing their management and expanding the explanation of Enforce
    isolation. Finally, this commit also adds the documentation available in
    the amdgpu_ring.c file to it.
    
    Cc: Alex Deucher 
    Cc: Christian König 
    Cc: Timur Kristóf 
    Signed-off-by: Rodrigo Siqueira 
    Signed-off-by: Alex Deucher 

commit 03a48f07aa89ee72c2cfcc0be70858a745b2a573
Author: Rodrigo Siqueira 
Date:   Tue Nov 18 17:45:53 2025 -0700

    Documentation/gpu: Add more information about GC
    
    This commit introduces set of information that details the different
    sets of schedulers available in the SE.
    
    Cc: Alex Deucher 
    Cc: Christian König 
    Cc: Timur Kristóf 
    Signed-off-by: Rodrigo Siqueira 
    Reviewed-by: Alex Deucher 
    Signed-off-by: Alex Deucher 

commit d68ba530ec79ec02c5432c3ae9c852081cc5ebb1
Author: Rodrigo Siqueira 
Date:   Tue Nov 18 17:45:52 2025 -0700

    Documentation/gpu: Expand generic block information
    
    This commit expands the overall explanation about AMD GPU IPs by adding
    more details about their interconnection. Note that this commit includes
    a diagram that provides additional information.
    
    v2: fix up TMR - Trusted Memory Region
    
    Cc: Alex Deucher 
    Cc: Christian König 
    Cc: Timur Kristóf 
    Signed-off-by: Rodrigo Siqueira 
    Signed-off-by: Alex Deucher 

commit e0f90f184d18c70c1b04e8b03a5243e275ce86f4
Author: Rodrigo Siqueira 
Date:   Tue Nov 18 17:45:51 2025 -0700

    Documentation/gpu: Add new glossary entries from UMR
    
    When using UMR, a dashboard is available that displays the CPC, CPF,
    CPG, TCP, and UTCL utilization. This commit introduces the meanings of
    those acronyms (and others) to the glossary to improve the comprehension
    of the UMR dashboard.
    
    Cc: Alex Deucher 
    Cc: Christian König 
    Cc: Timur Kristóf 
    Cc: Lijo Lazar 
    Signed-off-by: Rodrigo Siqueira 
    Signed-off-by: Alex Deucher 

commit b9befc9a21bdeafb0f81b757c60df66e6e9feb17
Author: Rodrigo Siqueira 
Date:   Tue Nov 18 17:45:50 2025 -0700

    drm/amdgpu: Expand kernel-doc in amdgpu_ring
    
    Expand the kernel-doc about amdgpu_ring and add some tiny improvements.
    
    Cc: Alex Deucher 
    Cc: Christian König 
    Cc: Timur Kristóf 
    Signed-off-by: Rodrigo Siqueira 
    Reviewed-by: Alex Deucher 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit e06d194201189ab611ac83c591c16d5f288a605d
Author: Mukul Joshi 
Date:   Mon Nov 4 19:23:23 2024 -0500

    drm/amdgpu: Enable IH CAM on IH 7.1.0
    
    Enable IH CAM to handle retry faults on IH 7.1.0.
    Also increase the soft ring size.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit 692c70f4d80247c622ce864672cbd0e3d8799189
Author: Hawking Zhang 
Date:   Tue May 27 21:02:22 2025 +0800

    drm/amdgpu: Use ih v7_0 ip block for ih v7_1
    
    ih v7_1 and ih v7_0 share the same ip block implementation
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 41273a8ce332aedbb08db6d20a63b66bb7852f34
Author: Le Ma 
Date:   Sun Nov 2 18:48:00 2025 +0800

    drm/amdgpu: Set psp ip block and funcs for v15.0.8
    
    Set psp ip block and funcs for MP0 15.0.8
    
    Signed-off-by: Le Ma 
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 0c24b83d82179cb634f1c56a34b1f5690a6509d4
Author: Hawking Zhang 
Date:   Sun Nov 2 18:39:48 2025 +0800

    drm/amdgpu: Upload a single sdma fw copy when using psp v15.0.8
    
    driver only need to upload sdma firmware copy for
    all sdma instances when using PSP v15.0.8
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit b02c22359bac8bf40fa141b5e5b62776559de698
Author: Hawking Zhang 
Date:   Sun Nov 2 18:35:04 2025 +0800

    drm/amdgpu: Set skip_tmr to true for psp v15_0_8
    
    psp v15_0_8 does not require tmr created by gpu driver
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit c92bb14151a59715c674d421d647e37dc6cedd6e
Author: Le Ma 
Date:   Sun Nov 2 18:30:58 2025 +0800

    drm/amdgpu: Add psp v15.0.8 ip block v3
    
    Add psp_v15_0_8.c for MPASP 15.0.8
    
    v2: drop memory training intf as they are only
    necessary for GDDR memory
    
    v3: Implement psp_v15_0_8_get_fw_type (Feifei)
    
    Signed-off-by: Le Ma 
    Signed-off-by: Hawking Zhang 
    Signed-off-by: Feifei Xu 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 22ef3af5d42b56d760722f0c62cde362cf4747f9
Author: Hawking Zhang 
Date:   Sun Nov 2 17:51:03 2025 +0800

    drm/amdgpu: Add mp v15_0_8 ip headers v4
    
    Add header files for mp v15_0_8 register offsets
    and shift masks
    v2: Update mp v15_0_8 ip headers
    v3: Update mp v15_0_8 ip headers
    v4: Clean up registers (Alex)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 0b8c6bcd206ecd275ac6267b4feee2bcaa8f1a5f
Author: Feifei Xu 
Date:   Mon Jul 28 18:05:11 2025 +0800

    drm/amdgpu: update psp_get_fw_type() function
    
    In psp 15.0.8, mes and sdma GFX_FW_TYPE have been changed.
    
    Define a psp common function: psp_get_fw_type().
    Hide the GFX_FW_TYPE Changes in each ip's psp->funcs_get_fw_type callback.
    (like psp_v15_0_8_get_fw_type()).
    If no GFX_FW_TYPE change, reuse the amdgpu_psp_get_fw_type().
    
    Signed-off-by: Feifei Xu 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 708b8589f2605a170b572478a2fb3755bb9f272f
Author: Feifei Xu 
Date:   Mon Jul 28 18:58:08 2025 +0800

    drm/amdgpu: Add rlcv firmware for frontdoor loading.
    
    Rlcv is required to be loaded for frontdoor.
    
    1. Add 2 rlcv ucode ids:
        AMDGPU_UCODE_RLC_IRAM_1 and AMDGPU_UCODE_RLC_DRAM_1
    
    2. Add rlc_firmware_header_v2_5 for above 2 rlcv headers.
    
    3. Add 2 types in psp_fw_gfx_if interface interacting with asp:
        GFX_FW_TYPE_RLX6_UCODE_CORE1 - RLCV IRAM
        GFX_FW_TYPE_RLX6_DRAM_BOOT_CORE1 - RLCV DRAM BOOT
    
    Signed-off-by: Feifei Xu 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 4c7838b56cbfc0f96e4eac275459b91957248f01
Author: Hawking Zhang 
Date:   Sun Nov 2 18:03:05 2025 +0800

    drm/amdgpu: Initialize smuio functions for smuio v15_0_8
    
    Add initialization for smuio funcs specific to v15.0.8
    
    Signed-off-by: Hawking Zhang 
    Signed-off-by: Likun Gao 
    Reviewed-by: Yang Wang 
    Signed-off-by: Alex Deucher 

commit c0d4cc9007971f7412f7ee4cbbe98b06b7da813f
Author: Timur Kristóf 
Date:   Wed Nov 19 10:25:44 2025 +0100

    Documentation/gpu: Add PRT, PTE, PDE to amdgpu glossary (v2)
    
    PRT = Partially Resident Texture (aka. sparse residency)
    PTE = Page Table Entry
    PDE = Page Directory Entry
    
    v2:
    - Add PDE
    
    Signed-off-by: Timur Kristóf 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 591689ccbe091a43d4597cb1c4f2e4f51a589d80
Author: Hawking Zhang 
Date:   Sun Nov 2 17:59:21 2025 +0800

    drm/amdgpu: Add smuio v15_0_8 support v4
    
    v15_0_8 is a new generation smuio ip block
    v2: Add smuio callbacks for interface id
    v3: Add smuio callback to identify custom hbm
    v4: comment out unused functions (Alex)
    
    Signed-off-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit c3cd568d31b6d41fc201b1d0506e4f6cab7e488a
Author: Timur Kristóf 
Date:   Wed Nov 19 10:25:43 2025 +0100

    drm/amdgpu/uapi: Clarify comment on AMDGPU_VM_PAGE_PRT
    
    In the context of the amdgpu uAPI, the PRT flag is referring only
    to unmapped pages of a partially resident texture (aka. sparse
    resource), but not the full resource.
    
    Virtual addresses marked with this flag behave as follows:
    - Reads return zero
    - Writes are discarded
    
    Signed-off-by: Timur Kristóf 
    Reviewed-by: Christian König 
    Signed-off-by: Alex Deucher 

commit 550c6f5b90d21b84d62e658f2e986ea24bf3adb4
Author: Hawking Zhang 
Date:   Sun Nov 2 17:45:48 2025 +0800

    drm/amdgpu: Add smuio v15_0_8 ip headers v4
    
    Add header files for smuio v15_0_8 register offsets
    and shift masks
    v2: Update smuio v15_0_8 ip headers
    v3: Update smuio v15_0_8 ip headers
    v4: Clean up registers (Alex)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 5287e7ef748e4bad63c6f5f05348b022ec867407
Author: Sreekant Somasekharan 
Date:   Thu Nov 6 23:49:08 2025 -0500

    drm/amdkfd: Remove hard‑coded GC IP version checks from kfd_node_by_irq_ids
    
    Replace the GC IP version hard-coded check with multi-aid check in
    kfd_node_by_irq_ids(). If aid_mask is not set, we immediately return
    dev->nodes[0] otherwise we iterate and match using kfd_irq_is_from_node().
    
    Signed-off-by: Sreekant Somasekharan 
    Reviewed-by: Philip Yang 
    Signed-off-by: Alex Deucher 

commit cf856ca9b999bc81d27bf8c4e1d7b5c7740bcea8
Author: Philip Yang 
Date:   Tue Apr 22 16:15:58 2025 -0400

    drm/amdgpu: Update vm start, end, hole to support 57bit address
    
    Change gmc macro AMDGPU_GMC_HOLE_START/END/MASK to 57bit if vm root
    level is PDB3 for 5-level page tables.
    
    The macro access adev without passing adev as parameter is to minimize
    the code change to support 57bit, then we have to add adev variable in
    several places to use the macro.
    
    Because adev definition is not available in all amdgpu c files which
    include amdgpu_gmc.h, change inline function amdgpu_gmc_sign_extend to
    macro.
    
    Signed-off-by: Philip Yang 
    Acked-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit f6b1c1f5fd7237f77fc3880603ea54dcf0371a20
Author: Philip Yang 
Date:   Fri Apr 25 10:55:07 2025 -0400

    drm/amdgpu: GPU vm support 5-level page table
    
    If GPU supports 5-level page table, but CPU disable 5-level page table
    by using boot option no5lvl or CPU feature not available, the virtual
    address will be 48bit, not needed to enable 5-level page table on GPU
    vm.
    
    If adev->vm_manager.num_level, number of pde levels, set to 4, then
    gfxhub and mmhub register VM_CONTEXTx_CNTL/PAGE_TABLE_DEPTH will set
    to 4 to enable 5-level page table in page table walker.
    
    Set vm_manager.root_level to AMDGPU_VM_PDE3, then update GPU mapping
    will allocate and update PDE3/PDE2/PDE1/PDE0/PTB 5-level page tables.
    
    If max_level is not 4, no change for the logic to support features
    needed by old ASICs.
    
    v2: squash in CONFIG fix
    
    Signed-off-by: Philip Yang 
    Acked-by: Felix Kuehling 
    Signed-off-by: Alex Deucher 

commit bc5094e27e10259df655c45629c5e234957bbfb6
Author: Hawking Zhang 
Date:   Mon Feb 24 10:12:00 2025 +0800

    drm/amdgpu: Add soc v1_0 enum header
    
    Add soc v1_0 enum header
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit 4d65215145de002defa985136093566a20fdb435
Author: Hawking Zhang 
Date:   Fri Sep 12 13:21:09 2025 -0400

    drm/amdgpu: update VRAM types
    
    Update VRAM types.
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 7cd88efd16f46023d2359430bb49781e879229c7
Author: Hawking Zhang 
Date:   Fri Jun 6 00:26:07 2025 +0800

    drm/amdgpu: Move XCP_INST_MASK amdgpu_xcp.h
    
    Move the common macro for xcp manger to amdgpu_xcp.h
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit dcfe45bd860f0bdec82bfe3ae8632d231a6c4f28
Author: Hawking Zhang 
Date:   Tue May 27 22:40:01 2025 +0800

    drm/amdgpu: Verify dpm setting for enabling smu with direct fw loading
    
    Ensure that amdgpu_dpm kernel module parameter is set to 1
    when enabling smu with direct firmware loading
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 0bebe9b9fcb485c12d447b9352a53e761caded9d
Author: James Zhu 
Date:   Fri Oct 11 13:40:42 2024 -0400

    drm/amdkfd: refactor rlc/gfx spm
    
    for adding multiple xcc support.
    
    Signed-off-by: James Zhu 
    Reviewed-by: Bing Ma 
    Reviewed-by: Gang Ba 
    Signed-off-by: Alex Deucher 

commit 36b266bd3aad0698591c2c93a112e2dd6b6678f6
Author: Mukul Joshi 
Date:   Mon Mar 24 18:59:23 2025 -0400

    drm/amdgpu: Generalize HQD and VMID mask calculation for MES
    
    Generalize the calculation for determining the HQD mask and VMID mask
    passed to MES during initialization.
    
    v2: rebase (Alex)
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Harish Kasiviswanathan 
    Signed-off-by: Alex Deucher 

commit d09c7e266c8cd5590db59693ea3c3a66a55e63ab
Author: Jack Xiao 
Date:   Thu Nov 21 16:22:38 2024 +0800

    drm/amdgpu/mes: add multi-xcc support
    
    a. extend mes pipe instances to num_xcc * max_mes_pipe
    b. initialize mes schq/kiq pipes per xcc
    c. submit mes packet to mes ring according to xcc_id
    
    v2: rebase (Alex)
    
    Signed-off-by: Jack Xiao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 2718942f48d41c4dc1c19a7a20720633191afd2f
Author: Mukul Joshi 
Date:   Wed Sep 10 16:57:25 2025 -0400

    drm/amdgpu: add PCIe atomics bit in PTE
    
    To enable atomic access to memory, setup the new PCIe atomics bit
    in PTE.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Alex Sierra 
    Signed-off-by: Alex Deucher 

commit 13aca3c0f492e193c9d823684813633087e75752
Author: Mukul Joshi 
Date:   Wed Sep 10 14:38:43 2025 -0400

    drm/amdgpu: update soc15 IH client ids
    
    Add client id for UTCL2.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Harish Kasiviswanathan 
    Signed-off-by: Alex Deucher 

commit 27a136eaa3968fa0d4c9504891c646d3374e3372
Author: Hawking Zhang 
Date:   Wed Jul 23 16:53:30 2025 +0800

    drm/amdgpu: Add hwid for AIGC
    
    Add hwid for a new ip block named AIGC
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit 923a3c20f0e105fdfd17c3e61d383543df18d149
Author: Hawking Zhang 
Date:   Mon Feb 3 22:14:41 2025 +0800

    drm/amdgpu: Add hwid for ATU
    
    Add hwid for Address Translation Unit (ATU)
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit eaf5a2425e058ea08e7ffe5d46b1eb743c30ca92
Author: Hawking Zhang 
Date:   Mon Feb 3 10:42:10 2025 +0800

    drm/amdgpu: Increase the maximum number of IP instances
    
    SOC v1_0 supports a greater number of IP instances.
    
    Signed-off-by: Hawking Zhang 
    Reviewed-by: Likun Gao 
    Signed-off-by: Alex Deucher 

commit d514ed18f5771bd4efb981dbf8191f91be0d67e1
Author: Mukul Joshi 
Date:   Tue Dec 10 19:35:09 2024 -0500

    drm/amdkfd: Rework reserved SDMA queue handling
    
    We would need to reserve SDMA queues per KFD node.
    As a result, rework the SDMA reserved queue handling to make it per
    KFD node.
    
    Signed-off-by: Mukul Joshi 
    Reviewed-by: Harish Kasiviswanathan 
    Signed-off-by: Alex Deucher 

commit 539d821df2938368c8b175cadd6f463de61d4be3
Author: Likun Gao 
Date:   Mon Feb 24 15:22:55 2025 +0800

    drm/amdgpu: fix NULL pointer issue for supports_baco
    
    Return 0 if the realted ASIC do not have supports_baco
    function to fix the NULL pointer issue.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Le Ma 
    Signed-off-by: Alex Deucher 

commit 9877a865d62c9c3e0f4cc369dc9ca9f7f24f5ee9
Author: Likun Gao 
Date:   Fri Jul 12 11:07:40 2024 +0800

    drm/amdgpu: fix NULL pointer issue buffer funcs
    
    If SDMA block not enabled, buffer_funcs will not initialize,
    fix the null pointer issue if buffer_funcs not initialized.
    
    Signed-off-by: Likun Gao 
    Reviewed-by: Hawking Zhang 
    Signed-off-by: Alex Deucher 

commit 50133c09d189a26f4cc6e78e382864fd599a1dc4
Author: Guopeng Zhang 
Date:   Wed Dec 3 19:56:31 2025 +0800

    selftests: cgroup: Replace sleep with cg_read_key_long_poll() for waiting on nr_dying_descendants
    
    Replace the manual sleep-and-retry logic in test_kmem_dead_cgroups()
    with the new helper `cg_read_key_long_poll()`. This change improves
    the robustness of the test by polling the "nr_dying_descendants"
    counter in `cgroup.stat` until it reaches 0 or the timeout is exceeded.
    
    Additionally, increase the retry timeout to 8 seconds (from 5 seconds)
    based on testing results:
      - With 5-second timeout: 4/20 runs passed.
      - With 8-second timeout: 20/20 runs passed.
    
    The 8 second timeout is based on stress testing of test_kmem_dead_cgroups()
    under load: 5 seconds was occasionally not enough for reclaim of dying
    descendants to complete, whereas 8 seconds consistently covered the observed
    latencies. This value is intended as a generous upper bound for the
    asynchronous reclaim and is not tied to any specific kernel constant, so it
    can be adjusted in the future if reclaim behavior changes.
    
    Signed-off-by: Guopeng Zhang 
    Reviewed-by: Shakeel Butt 
    Acked-by: Michal Koutný 
    Signed-off-by: Tejun Heo 

commit 6360d444ae32871c6a048ac880ef3b871a439bad
Author: Guopeng Zhang 
Date:   Wed Dec 3 19:56:30 2025 +0800

    selftests: cgroup: make test_memcg_sock robust against delayed sock stats
    
    test_memcg_sock() currently requires that memory.stat's "sock " counter
    is exactly zero immediately after the TCP server exits. On a busy system
    this assumption is too strict:
    
      - Socket memory may be freed with a small delay (e.g. RCU callbacks).
      - memcg statistics are updated asynchronously via the rstat flushing
        worker, so the "sock " value in memory.stat can stay non-zero for a
        short period of time even after all socket memory has been uncharged.
    
    As a result, test_memcg_sock() can intermittently fail even though socket
    memory accounting is working correctly.
    
    Make the test more robust by polling memory.stat for the "sock "
    counter and allowing it some time to drop to zero instead of checking
    it only once. The timeout is set to 3 seconds to cover the periodic
    rstat flush interval (FLUSH_TIME = 2*HZ by default) plus some
    scheduling slack. If the counter does not become zero within the
    timeout, the test still fails as before.
    
    On my test system, running test_memcontrol 50 times produced:
    
      - Before this patch:  6/50 runs passed.
      - After this patch:  50/50 runs passed.
    
    Signed-off-by: Guopeng Zhang 
    Suggested-by: Lance Yang 
    Reviewed-by: Shakeel Butt 
    Acked-by: Michal Koutný 
    Signed-off-by: Tejun Heo 

commit 311ead1be05d2348e89f873337c8375e856e1abb
Author: Guopeng Zhang 
Date:   Wed Dec 3 19:56:29 2025 +0800

    selftests: cgroup: Add cg_read_key_long_poll() to poll a cgroup key with retries
    
    Introduce a new helper function `cg_read_key_long_poll()` in
    cgroup_util.h. This function polls the specified key in a cgroup file
    until it matches the expected value or the retry limit is reached,
    with configurable wait intervals between retries.
    
    This helper is particularly useful for handling asynchronously updated
    cgroup statistics (e.g., memory.stat), where immediate reads may
    observe stale values, especially on busy systems. It allows tests and
    other utilities to handle such cases more flexibly.
    
    Signed-off-by: Guopeng Zhang 
    Suggested-by: Michal Koutný 
    Reviewed-by: Shakeel Butt 
    Acked-by: Michal Koutný 
    Signed-off-by: Tejun Heo 

commit cd77d5a4aaf8c5c1d819f47cf814bf7d4920b0a2
Author: Lizhi Hou 
Date:   Thu Dec 4 10:16:03 2025 -0800

    accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg()
    
    In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll for a
    non-zero tail pointer. This assumed that a zero value indicates an error.
    However, certain corner cases legitimately produce a zero tail pointer.
    To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail
    pointer will be treated as a valid rewind event.
    
    Reviewed-by: Maciej Falkowski 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251204181603.793824-1-lizhi.hou@amd.com

commit 646013f513f38a3e75a60fde31ae0e6154ce19a7
Author: Christian König 
Date:   Thu Dec 4 15:56:03 2025 +0100

    dma-buf: enable DMABUF_DEBUG by default on DEBUG kernels
    
    The overhead of enforcing the DMA-buf rules for importers is now so low
    that it safe to enable it by default on DEBUG kernels.
    
    This will hopefully result in fixing more issues in importers.
    
    Signed-off-by: Christian König 
    Reviewed-by: Michael J. Ruhl 
    Link: https://lore.kernel.org/r/20251205130604.1582-2-christian.koenig@amd.com

commit 51db5336e16de25074ef63d29b8a762a25d193d3
Author: Christian König 
Date:   Fri Sep 19 16:40:06 2025 +0200

    dma-buf: improve sg_table debugging hack v4
    
    This debugging hack is important to enforce the rule that importers
    should *never* touch the underlying struct page of the exporter.
    
    Instead of just mangling the page link create a copy of the sg_table
    but only copy over the DMA addresses and not the pages.
    
    This will cause a NULL pointer de-reference if the importer tries to
    touch the struct page. Still quite a hack but this at least allows the
    exporter to properly keeps it's sg_table intact while allowing the
    DMA-buf maintainer to find and fix misbehaving importers and finally
    switch over to using a different data structure in the future.
    
    v2: improve the hack further by using a wrapper structure and explaining
    the background a bit more in the commit message.
    v3: fix some whitespace issues, use sg_assign_page().
    v4: give the functions a better name
    
    Signed-off-by: Christian König 
    Reviewed-by: Michael J. Ruhl 
    Link: https://lore.kernel.org/r/20251205130604.1582-1-christian.koenig@amd.com

commit 4ebaaa3b622238ea44fbaa21998ad76bd8417a8c
Author: Maxime Ripard 
Date:   Tue Oct 14 11:31:45 2025 +0200

    drm/atomic: Add dev pointer to drm_private_obj
    
    All the objects that need to implement some callbacks in KMS have a
    pointer in there structure to the main drm_device.
    
    However, it's not the case for drm_private_objs, which makes it harder
    than it needs to be to implement some of its callbacks. Let's add that
    pointer.
    
    Reviewed-by: Dmitry Baryshkov 
    Reviewed-by: Tomi Valkeinen 
    Reviewed-by: Luca Ceresoli 
    Tested-by: Luca Ceresoli 
    Link: https://patch.msgid.link/20251014-drm-private-obj-reset-v2-1-6dd60e985e9d@kernel.org
    Signed-off-by: Maxime Ripard 

commit b64a14334ef3ebbcf70d11bc67d0934bdc0e390d
Author: Raag Jadav 
Date:   Wed Dec 3 18:03:55 2025 +0530

    drm/xe/throttle: Skip reason prefix while emitting array
    
    The newly introduced "reasons" attribute already signifies possible
    reasons for throttling and makes the prefix in individual attribute
    names redundant while emitting them as an array. Skip the prefix.
    
    Fixes: 83ccde67a3f7 ("drm/xe/gt_throttle: Avoid TOCTOU when monitoring reasons")
    Signed-off-by: Raag Jadav 
    Reviewed-by: Sk Anirban 
    Link: https://patch.msgid.link/20251203123355.571606-1-raag.jadav@intel.com
    Signed-off-by: Rodrigo Vivi 

commit 70478348fc6d52d5bb7568a035d3cbe5bcc6af4c
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:31 2025 +0100

    Documentation/gpu/drm-mm: Add THP paragraph to GEM mapping section
    
    Add a paragraph to the GEM Objects Creation section about the
    drm_gem_huge_mnt_create() helper and to the GEM objects mapping
    section explaining how transparent huge pages are handled by GEM.
    
    v4:
    - fix wording after huge_pages handler removal
    
    v6:
    - fix wording after map_pages handler removal
    
    v11:
    - mention drm_gem_huge_mnt_create() helper
    - add Boris and Maíra R-bs
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Bagas Sanjaya 
    Reviewed-by: Boris Brezillon 
    Reviewed-by: Maíra Canal 
    Link: https://patch.msgid.link/20251205182231.194072-11-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit c12e9fcb5a5a9713e242e8c9c6adecdea5067241
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:30 2025 +0100

    drm/panfrost: Introduce huge tmpfs mountpoint option
    
    Introduce the 'panfrost.transparent_hugepage' boolean module parameter
    (false by default). When the parameter is set to true, a new tmpfs
    mountpoint is created and mounted using the 'huge=within_size'
    option. It's then used at GEM object creation instead of the default
    'shm_mnt' mountpoint in order to enable Transparent Hugepage (THP) for
    the object (without having to rely on a system wide parameter).
    
    v3:
    - use huge tmpfs mountpoint in drm_device
    
    v4:
    - fix builds with CONFIG_TRANSPARENT_HUGEPAGE=n
    - clean up mountpoint creation error handling
    - print negative error value
    
    v5:
    - use drm_gem_has_huge_tmp() helper
    - get rid of CONFIG_TRANSPARENT_HUGEPAGE ifdefs
    
    v9:
    - replace drm_gem_has_huge_tmp() by drm_gem_get_huge_tmp()
    
    v11:
    - enable 'panfrost.transparent_hugepage' by default
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251205182231.194072-10-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit c569b369cc2114526bec2ba0a41a49cfc27609b4
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:29 2025 +0100

    drm/panthor: Introduce huge tmpfs mountpoint option
    
    Introduce the 'panthor.transparent_hugepage' boolean module parameter
    (false by default). When the parameter is set to true, a new tmpfs
    mountpoint is created and mounted using the 'huge=within_size'
    option. It's then used at GEM object creation instead of the default
    'shm_mnt' mountpoint in order to enable Transparent Hugepage (THP) for
    the object (without having to rely on a system wide parameter).
    
    v3:
    - use huge tmpfs mountpoint in drm_device
    
    v4:
    - fix builds with CONFIG_TRANSPARENT_HUGEPAGE=n
    - clean up mountpoint creation error handling
    - print negative error value
    
    v5:
    - use drm_gem_has_huge_tmp() helper
    - get rid of CONFIG_TRANSPARENT_HUGEPAGE ifdefs
    
    v9:
    - replace drm_gem_has_huge_tmp() by drm_gem_get_huge_tmp()
    
    v11:
    - enable 'panthor.transparent_hugepage' by default
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251205182231.194072-9-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit 7cdf69d903759b81abde5973d703c93a742ddab7
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:28 2025 +0100

    drm/gem: Get rid of *_with_mnt helpers
    
    drm_gem_object_init_with_mnt() and drm_gem_shmem_create_with_mnt() can
    be removed now that the drivers use the new drm_gem_huge_mnt_create()
    and drm_gem_get_huge_mnt() helpers.
    
    v5:
    - use drm_gem_has_huge_mnt() helper
    - compile out shmem_file_setup_with_mnt() call in builds with
      CONFIG_TRANSPARENT_HUGEPAGE=n
    
    v9:
    - replace drm_gem_has_huge_mnt() with drm_gem_get_huge_mnt()
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Boris Brezillon 
    Reviewed-by: Maíra Canal 
    Link: https://patch.msgid.link/20251205182231.194072-8-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit f19f99bbaf9f91d0b0a95d760f4d6755758b913d
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:27 2025 +0100

    drm/v3d: Use huge tmpfs mountpoint helpers
    
    Make use of the new drm_gem_huge_mnt_create() and
    drm_gem_get_huge_mnt() helpers to avoid code duplication. Now that
    it's just a few lines long, the single function in v3d_gemfs.c is
    moved into v3d_gem.c.
    
    v3:
    - use huge tmpfs mountpoint in drm_device
    - move v3d_gemfs.c into v3d_gem.c
    
    v4:
    - clean up mountpoint creation error handling
    
    v5:
    - fix CONFIG_TRANSPARENT_HUGEPAGE check
    - use drm_gem_has_huge_mnt() helper
    
    v8:
    - don't access huge_mnt field with CONFIG_TRANSPARENT_HUGEPAGE=n
    
    v9:
    - replace drm_gem_has_huge_mnt() by drm_gem_get_huge_mnt()
    
    v10:
    - get rid of CONFIG_TRANSPARENT_HUGEPAGE ifdefs
    
    v11:
    - remove superfluous comment
    - add Maíra and Boris R-bs
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Maíra Canal 
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251205182231.194072-7-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit a8a9a590221c1959716277d4b13fe658816afc0e
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:26 2025 +0100

    drm/i915: Use huge tmpfs mountpoint helpers
    
    Make use of the new drm_gem_huge_mnt_create() and
    drm_gem_get_huge_mnt() helpers to avoid code duplication. Now that
    it's just a few lines long, the single function in i915_gemfs.c is
    moved into i915_gem_shmem.c.
    
    v3:
    - use huge tmpfs mountpoint in drm_device
    - move i915_gemfs.c into i915_gem_shmem.c
    
    v4:
    - clean up mountpoint creation error handling
    
    v5:
    - use drm_gem_has_huge_mnt() helper
    
    v7:
    - include  in i915_gem_shmem.c
    
    v8:
    - keep logging notice message with CONFIG_TRANSPARENT_HUGEPAGE=n
    - don't access huge_mnt field with CONFIG_TRANSPARENT_HUGEPAGE=n
    
    v9:
    - replace drm_gem_has_huge_mnt() by drm_gem_get_huge_mnt()
    - remove useless ternary op test in selftests/huge_pages.c
    
    v12:
    - fix layering violation in selftests (Tvrtko)
    - fix incorrect filename in commit message
    
    v13:
    - add Tvrtko A-b
    
    Signed-off-by: Loïc Molinari 
    Acked-by: Tvrtko Ursulin 
    Link: https://patch.msgid.link/20251205182231.194072-6-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit 6e0b1b82017b9ba16b87685e1e4902cd9dc762d2
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:25 2025 +0100

    drm/gem: Add huge tmpfs mountpoint helpers
    
    Add the drm_gem_huge_mnt_create() and drm_gem_get_huge_mnt() helpers
    to avoid code duplication in the i915, V3D, Panfrost and Panthor
    drivers. The former creates and mounts a dedicated huge tmpfs
    mountpoint, for the lifetime of a DRM device, used at GEM object
    initialization. The latter retrieves the dedicated huge tmpfs
    mountpoint used by a DRM device.
    
    The next commits will port drivers to these helpers.
    
    v3:
    - store huge tmpfs mountpoint in drm_device
    
    v4:
    - return 0 in builds with CONFIG_TRANSPARENT_HUGEPAGE=n
    - return 0 when huge_mnt already exists
    - use new vfs_parse_fs_string() helper
    
    v5:
    - remove warning on !dev->huge_mnt and reset to NULL on free
    - inline drm_gem_huge_mnt_create() to remove func from text and avoid
      calls in builds with CONFIG_TRANSPARENT_HUGEPAGE=n
    - compile out drm_device's huge_mnt field in builds with
      CONFIG_TRANSPARENT_HUGEPAGE=n
    - add drm_gem_has_huge_mnt() helper
    
    v6:
    - move huge_mnt doc into ifdef'd section
    - either inline or export drm_gem_huge_mnt_create()
    
    v7:
    - include  in drm_gem.h
    
    v9:
    - replace drm_gem_has_huge_mnt() by drm_gem_get_huge_mnt()
    
    v11:
    - doc fixes
    - add Boris and Maíra R-bs
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Boris Brezillon 
    Reviewed-by: Maíra Canal 
    Link: https://patch.msgid.link/20251205182231.194072-5-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit 99bda20d6d4cac30ed6d357658d8bc328c3b27d9
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:24 2025 +0100

    drm/gem: Introduce drm_gem_get_unmapped_area() fop
    
    mmap() calls on the DRM file pointer currently always end up using
    mm_get_unmapped_area() to get a free mapping region. On builds with
    CONFIG_TRANSPARENT_HUGEPAGE enabled, this isn't ideal for GEM objects
    backed by shmem buffers on mountpoints setting the 'huge=' option
    because it can't correctly figure out the potentially huge address
    alignment required.
    
    This commit introduces the drm_gem_get_unmapped_area() function which
    is meant to be used as a get_unmapped_area file operation on the DRM
    file pointer to lookup GEM objects based on their fake offsets and get
    a properly aligned region by calling shmem_get_unmapped_area() with
    the right file pointer. If a GEM object isn't available at the given
    offset or if the caller isn't granted access to it, the function falls
    back to mm_get_unmapped_area().
    
    This also makes drm_gem_get_unmapped_area() part of the default GEM
    file operations so that all the DRM drivers can benefit from more
    efficient mappings thanks to the huge page fault handler introduced in
    previous commit 'drm/shmem-helper: Add huge page fault handler'.
    
    The shmem_get_unmapped_area() function needs to be exported so that
    it can be used from the DRM subsystem.
    
    v3:
    - include  in drm_gem.c
    - forward to shmem layer in builds with CONFIG_TRANSPARENT_HUGEPAGE=n
    
    v6:
    - use GPL variant to export drm_gem_get_unmapped_area()
    - don't export shmem_get_unmapped_area() anymore (use f_op instead)
    
    v11:
    - rename drm_gem_object_lookup_from_offset() to
      drm_gem_object_lookup_at_offset()
    - add Boris R-b
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251205182231.194072-4-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit 211b9a39f2619b9c0d85bcd48aeb399397910b42
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:23 2025 +0100

    drm/shmem-helper: Map huge pages in fault handler
    
    Attempt a PMD sized PFN insertion into the VMA if the faulty address
    of the fault handler is part of a huge page.
    
    On builds with CONFIG_TRANSPARENT_HUGEPAGE enabled, if the mmap() user
    address is PMD size aligned, if the GEM object is backed by shmem
    buffers on mountpoints setting the 'huge=' option and if the shmem
    backing store manages to allocate a huge folio, CPU mapping would then
    benefit from significantly increased memcpy() performance. When these
    conditions are met on a system with 2 MiB huge pages, an aligned copy
    of 2 MiB would raise a single page fault instead of 4096.
    
    v4:
    - implement map_pages instead of huge_fault
    
    v6:
    - get rid of map_pages handler for now (keep it for another series
      along with arm64 contpte support)
    
    v11:
    - remove page fault validity check helper
    - rename drm_gem_shmem_map_pmd() to drm_gem_shmem_try_map_pmd()
    - add Boris R-b
    
    v12:
    - move up ret var decl in fault handler to minimize diff
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251205182231.194072-3-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit 9d2d49027c3a9628989c9ec70ebef9d241f49c1e
Author: Loïc Molinari 
Date:   Fri Dec 5 19:22:22 2025 +0100

    drm/shmem-helper: Simplify page offset calculation in fault handler
    
    For a fault at address addr, the page offset is
      page_offset = (vmf->address - vma->vm_start) >> PAGE_SHIFT
                  = ((addr & PAGE_MASK) - vma->vm_start) >> PAGE_SHIFT
                  = (addr - vma->vm_start) >> PAGE_SHIFT
    
    Since the faulty logical page offset based on VMA is
      vmf->pgoff = vma->vm_pgoff + ((addr - vma->vm_start) >> PAGE_SHIFT)
    
    We can slightly simplify the calculation using
      page_offset = vmf->pgoff - vma->vm_pgoff
    
    v11:
    - remove misleading comment
    - add Boris R-b
    
    Signed-off-by: Loïc Molinari 
    Reviewed-by: Boris Brezillon 
    Link: https://patch.msgid.link/20251205182231.194072-2-loic.molinari@collabora.com
    Signed-off-by: Boris Brezillon 

commit 18476087f1a18dc279d200d934ad94fba1fb51d5
Author: Ard Biesheuvel 
Date:   Fri Dec 5 12:35:01 2025 +0100

    drm/i915: Fix format string truncation warning
    
    GCC notices that the 16-byte uabi_name field could theoretically be too
    small for the formatted string if the instance number exceeds 100.
    
    So grow the field to 20 bytes.
    
    drivers/gpu/drm/i915/intel_memory_region.c: In function ‘intel_memory_region_create’:
    drivers/gpu/drm/i915/intel_memory_region.c:273:61: error: ‘%u’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 3 and 11 [-Werror=format-truncation=]
      273 |         snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u",
          |                                                             ^~
    drivers/gpu/drm/i915/intel_memory_region.c:273:58: note: directive argument in the range [0, 65535]
      273 |         snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u",
          |                                                          ^~~~~~
    drivers/gpu/drm/i915/intel_memory_region.c:273:9: note: ‘snprintf’ output between 7 and 19 bytes into a destination of size 16
      273 |         snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u",
          |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      274 |                  intel_memory_type_str(type), instance);
          |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    Signed-off-by: Ard Biesheuvel 
    Signed-off-by: Tvrtko Ursulin 
    Link: https://lore.kernel.org/r/20251205113500.684286-2-ardb@kernel.org

commit 11bbc345d4843e1fe98382abe9e110addc585fc8
Author: Jouni Högander 
Date:   Thu Dec 4 12:47:33 2025 +0200

    drm/i915/psr: Move sink_sync_latency to intel_connector
    
    As everything else related to PSR and Panel Replay capabilities are moved
    into intel_connector move sink_sync_latency as well.
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251204104733.1106145-9-jouni.hogander@intel.com

commit 2691ec6792d10340618a900d79417b058811507b
Author: Jouni Högander 
Date:   Thu Dec 4 12:47:32 2025 +0200

    drm/i915/psr: Move sink PSR and Panel Replay booleans to intel_connector
    
    As a preparation for MST Panel Replay we need to move Panel Replay sink
    related data into intel_connector. Move sink support booleans as well
    into intel_connector. Generally this is more correct place for this data so
    move PSR versions as well.
    
    Still sink_support and sink_panel_replay_support are kept to keep CAN_PSR
    and CAN_PANEL_REPLAY macros. Plan is to keep them that way as they are
    widely used from patch where connector is not available.
    
    Later we might want to clear intel_dp->psr.sink_panel_replay_support if any
    of the devices in branch is not supporting Panel Replay (mst).
    
    v2:
      - commit message updated
      - Extra w/s removed
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251204104733.1106145-8-jouni.hogander@intel.com

commit 93bba79e177159821c5b57f9b6632de1fd1d5e8b
Author: Jouni Högander 
Date:   Thu Dec 4 12:47:31 2025 +0200

    drm/i915/psr: Move Panel Replay DSC sink support data to intel_connector
    
    As a preparation for MST Panel Replay we need to move Panel Replay sink
    related data into intel_connector. Move Panel Replay DSC sink support data
    as well into intel_connector.
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251204104733.1106145-7-jouni.hogander@intel.com

commit a7e427ff20418bbbac367ce78a3e786360988432
Author: Jouni Högander 
Date:   Thu Dec 4 12:47:30 2025 +0200

    drm/i915/psr: Clear pr_dpcd as well on disconnect
    
    Currently we are leaving pr_dpcd containing Panel Replay capability DPCD
    registers as it is on disconnect. Clear it as well on disconnect.
    
    v2: add FIXME
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251204104733.1106145-6-jouni.hogander@intel.com

commit 8d251442f81a9c5114f2eee303e4e7305fb0f426
Author: Jouni Högander 
Date:   Thu Dec 4 12:47:29 2025 +0200

    drm/i915/psr: Move pr_dpcd and psr_dpcd to intel_connector
    
    As a preparation for MST Panel Replay we need to move Panel Replay sink
    related data into intel_connector. Move pr_dpcd as well into
    intel_connector. Generally this is more correct place for this data so move
    psr_dpcd as well.
    
    v2:
      - move pr/psr_dpcd into *_caps substruct
      - drop intel_dp from psr2_su_region_et_valid and
        _panel_replay_compute_su_granularity parameters
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251204104733.1106145-5-jouni.hogander@intel.com

commit 5a4236267d0b0e60639bb9fd33f4083a7abf32ed
Author: Jouni Högander 
Date:   Thu Dec 4 12:47:28 2025 +0200

    drm/i915/psr: Compute Panel Replay/Adaptive Sync coexistence behavior
    
    Currently we are checking Panel Replay capability DPCD register in
    intel_alpm.c and writing PR_ALPM_CTL_ALLOW_LINK_OFF_BETWEEN_AS_SDP_AND_SU
    and PR_ALPM_CTL_AS_SDP_TRANSMISSION_IN_ACTIVE_DISABLE in PR_ALPM_CTL
    register base on the informaion. Instead of directly accessing
    intel_dp->pr_dpcd compute the behavior during psr_compute_config and store
    it in intel_crtc_state.
    
    v2:
      - inline added helpers
      - use intel_dp_attached_dp instead of passing as a parameter
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251204104733.1106145-4-jouni.hogander@intel.com

commit 1cc854647450199e20cdbe0fbc3be1f5253d7693
Author: Jouni Högander 
Date:   Thu Dec 4 12:47:27 2025 +0200

    drm/i915/psr: Use SU granularity information available in intel_connector
    
    Currently we are storing only one set of granularity information for panels
    supporting both PSR and Panel Replay. As panel is informing own
    granularities for PSR and Panel Replay they could be different. Let's use
    own granularities for PSR and Panel Replay instead of having only one set
    for both. This is done by having intel_connector::psr_caps and
    panel_replay_caps both containing granularity information.
    
    Also remove complexity of sharing granularity read between PSR and Panel
    Replay.
    
    v3:
      - use cpu_to_le16 for default value
    v2:
      - use __le16 for two byte values in dpcd
      - use sizeof instead of hardcoded size in reading dpcd
      - drop unnecessarily passing intel_dp pointer
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251204104733.1106145-3-jouni.hogander@intel.com

commit f861e54fb33b587687e335ef24431fceccfe536d
Author: Jouni Högander 
Date:   Thu Dec 4 12:47:26 2025 +0200

    drm/i915/psr: Add panel granularity information into intel_connector
    
    As a preparation for MST Panel Replay implementation add psr_caps and
    panel_replay_caps structures into intel_connector. These are supposed to
    contain all sink information related to PSR and Panel Replay.
    
    As a first step in moving Panel Replay and PSR sink data add panel
    granularity information into these newly added caps structures.
    
    Signed-off-by: Jouni Högander 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251204104733.1106145-2-jouni.hogander@intel.com

commit 5d9fb42f05e5bea386e6648d5699c2beaabe1c6a
Merge: 81f88f6ab67497 0e841d19263ab6
Author: Andrii Nakryiko 
Date:   Fri Dec 5 16:17:58 2025 -0800

    Merge branch 'support-associating-bpf-programs-with-struct_ops'
    
    Amery Hung says:
    
    ====================
    Support associating BPF programs with struct_ops
    
    Hi,
    
    This patchset adds a new BPF command BPF_PROG_ASSOC_STRUCT_OPS to
    the bpf() syscall to allow associating a BPF program with a struct_ops.
    The command is introduced to address a emerging need from struct_ops
    users. As the number of subsystems adopting struct_ops grows, more
    users are building their struct_ops-based solution with some help from
    other BPF programs. For example, scx_layer uses a syscall program as
    a user space trigger to refresh layers [0]. It also uses tracing program
    to infer whether a task is using GPU and needs to be prioritized [1]. In
    these use cases, when there are multiple struct_ops instances, the
    struct_ops kfuncs called from different BPF programs, whether struct_ops
    or not needs to be able to refer to a specific one, which currently is
    not possible.
    
    The new BPF command will allow users to explicitly associate a BPF
    program with a struct_ops map. The libbpf wrapper can be called after
    loading programs and before attaching programs and struct_ops.
    
    Internally, it will set prog->aux->st_ops_assoc to the struct_ops
    map. struct_ops kfuncs can then get the associated struct_ops struct
    by calling bpf_prog_get_assoc_struct_ops() with prog->aux, which can
    be acquired from a "__prog" argument. The value of the special
    argument will be fixed up by the verifier during verification.
    
    The command conceptually associates the implementation of BPF programs
    with struct_ops map, not the attachment. A program associated with the
    map will take a refcount of it so that st_ops_assoc always points to a
    valid struct_ops struct. struct_ops implementers can use the helper,
    bpf_prog_get_assoc_struct_ops to get the pointer. The returned
    struct_ops if not NULL is guaranteed to be valid and initialized.
    However, it is not guaranteed that the struct_ops is attached. The
    struct_ops implementer still need to take steps to track and check the
    state of the struct_ops in kdata, if the use case demand the struct_ops
    to be attached.
    
    We can also consider support associating struct_ops link with BPF
    programs, which on one hand make struct_ops implementer's job easier,
    but might complicate libbpf workflow and does not apply to legacy
    struct_ops attachment.
    
    [0] https://github.com/sched-ext/scx/blob/main/scheds/rust/scx_layered/src/bpf/main.bpf.c#L557
    [1] https://github.com/sched-ext/scx/blob/main/scheds/rust/scx_layered/src/bpf/main.bpf.c#L754
    ---
    v7 -> v8
       - Fix libbpf return (Andrii)
       - Follow kfunc _impl suffic naming convention in selftest (Alexei)
       Link: https://lore.kernel.org/bpf/20251121231352.4032020-1-ameryhung@gmail.com/
    
    v6 -> v7
       - Drop the guarantee that bpf_prog_get_assoc_struct_ops() will always return
         an initialized struct_ops (Martin)
       - Minor misc. changes in selftests
       Link: https://lore.kernel.org/bpf/20251114221741.317631-1-ameryhung@gmail.com/
    
    v5 -> v6
       - Drop refcnt bumping for async callbacks and add RCU annotation (Martin)
       - Fix libbpf bug and update comments (Andrii)
       - Fix refcount bug in bpf_prog_assoc_struct_ops() (AI)
       Link: https://lore.kernel.org/bpf/20251104172652.1746988-1-ameryhung@gmail.com/
    
    v4 -> v5
       - Simplify the API for getting associated struct_ops and dont't
         expose struct_ops map lifecycle management (Andrii, Alexei)
       Link: https://lore.kernel.org/bpf/20251024212914.1474337-1-ameryhung@gmail.com/
    
    v3 -> v4
       - Fix potential dangling pointer in timer callback. Protect
         st_ops_assoc with RCU. The get helper now needs to be paired with
         bpf_struct_ops_put()
       - The command should only increase refcount once for a program
         (Andrii)
       - Test a struct_ops program reused in two struct_ops maps
       - Test getting associated struct_ops in timer callback
       Link: https://lore.kernel.org/bpf/20251017215627.722338-1-ameryhung@gmail.com/
    
    v2 -> v3
       - Change the type of st_ops_assoc from void* (i.e., kdata) to bpf_map
         (Andrii)
       - Fix a bug that clears BPF_PTR_POISON when a struct_ops map is freed
         (Andrii)
       - Return NULL if the map is not fully initialized (Martin)
       - Move struct_ops map refcount inc/dec into internal helpers (Martin)
       - Add libbpf API, bpf_program__assoc_struct_ops (Andrii)
       Link: https://lore.kernel.org/bpf/20251016204503.3203690-1-ameryhung@gmail.com/
    
    v1 -> v2
       - Poison st_ops_assoc when reusing the program in more than one
         struct_ops maps and add a helper to access the pointer (Andrii)
       - Minor style and naming changes (Andrii)
       Link: https://lore.kernel.org/bpf/20251010174953.2884682-1-ameryhung@gmail.com/
    
    ---
    ====================
    
    Link: https://patch.msgid.link/20251203233748.668365-1-ameryhung@gmail.com
    Signed-off-by: Andrii Nakryiko 

commit 0e841d19263ab6e1ca2b280109832f57624e48d1
Author: Amery Hung 
Date:   Wed Dec 3 15:37:48 2025 -0800

    selftests/bpf: Test getting associated struct_ops in timer callback
    
    Make sure 1) a timer callback can also reference the associated
    struct_ops, and then make sure 2) the timer callback cannot get a
    dangled pointer to the struct_ops when the map is freed.
    
    The test schedules a timer callback from a struct_ops program since
    struct_ops programs do not pin the map. It is possible for the timer
    callback to run after the map is freed. The timer callback calls a
    kfunc that runs .test_1() of the associated struct_ops, which should
    return MAP_MAGIC when the map is still alive or -1 when the map is
    gone.
    
    The first subtest added in this patch schedules the timer callback to
    run immediately, while the map is still alive. The second subtest added
    schedules the callback to run 500ms after syscall_prog runs and then
    frees the map right after syscall_prog runs. Both subtests then wait
    until the callback runs to check the return of the kfunc.
    
    Signed-off-by: Amery Hung 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20251203233748.668365-7-ameryhung@gmail.com

commit 04fd12df4e05dd6fd3017b637f6fbc9da10b4e65
Author: Amery Hung 
Date:   Wed Dec 3 15:37:47 2025 -0800

    selftests/bpf: Test ambiguous associated struct_ops
    
    Add a test to make sure implicit struct_ops association does not
    break backward compatibility nor return incorrect struct_ops.
    struct_ops programs should still be allowed to be reused in
    different struct_ops map. The associated struct_ops map set implicitly
    however will be poisoned. Trying to read it through the helper
    bpf_prog_get_assoc_struct_ops() should result in a NULL pointer.
    
    While recursion of test_1() cannot happen due to the associated
    struct_ops being ambiguois, explicitly check for it to prevent stack
    overflow if the test regresses.
    
    Signed-off-by: Amery Hung 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20251203233748.668365-6-ameryhung@gmail.com

commit 33a165f9c2c1b9ddceaaccc356ce841baf1a08a2
Author: Amery Hung 
Date:   Wed Dec 3 15:37:46 2025 -0800

    selftests/bpf: Test BPF_PROG_ASSOC_STRUCT_OPS command
    
    Test BPF_PROG_ASSOC_STRUCT_OPS command that associates a BPF program
    with a struct_ops. The test follows the same logic in commit
    ba7000f1c360 ("selftests/bpf: Test multi_st_ops and calling kfuncs from
    different programs"), but instead of using map id to identify a specific
    struct_ops, this test uses the new BPF command to associate a struct_ops
    with a program.
    
    The test consists of two sets of almost identical struct_ops maps and BPF
    programs associated with the map. Their only difference is the unique
    value returned by bpf_testmod_multi_st_ops::test_1().
    
    The test first loads the programs and associates them with struct_ops
    maps. Then, it exercises the BPF programs. They will in turn call kfunc
    bpf_kfunc_multi_st_ops_test_1_prog_arg() to trigger test_1() of the
    associated struct_ops map, and then check if the right unique value is
    returned.
    
    Signed-off-by: Amery Hung 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20251203233748.668365-5-ameryhung@gmail.com

commit 87cd177b149a5d86103736994307c25999e0be4b
Author: Amery Hung 
Date:   Wed Dec 3 15:37:45 2025 -0800

    libbpf: Add support for associating BPF program with struct_ops
    
    Add low-level wrapper and libbpf API for BPF_PROG_ASSOC_STRUCT_OPS
    command in the bpf() syscall.
    
    Signed-off-by: Amery Hung 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20251203233748.668365-4-ameryhung@gmail.com

commit b5709f6d26d65f6bb9711f4b5f98469fd507cb5b
Author: Amery Hung 
Date:   Wed Dec 3 15:37:44 2025 -0800

    bpf: Support associating BPF program with struct_ops
    
    Add a new BPF command BPF_PROG_ASSOC_STRUCT_OPS to allow associating
    a BPF program with a struct_ops map. This command takes a file
    descriptor of a struct_ops map and a BPF program and set
    prog->aux->st_ops_assoc to the kdata of the struct_ops map.
    
    The command does not accept a struct_ops program nor a non-struct_ops
    map. Programs of a struct_ops map is automatically associated with the
    map during map update. If a program is shared between two struct_ops
    maps, prog->aux->st_ops_assoc will be poisoned to indicate that the
    associated struct_ops is ambiguous. The pointer, once poisoned, cannot
    be reset since we have lost track of associated struct_ops. For other
    program types, the associated struct_ops map, once set, cannot be
    changed later. This restriction may be lifted in the future if there is
    a use case.
    
    A kernel helper bpf_prog_get_assoc_struct_ops() can be used to retrieve
    the associated struct_ops pointer. The returned pointer, if not NULL, is
    guaranteed to be valid and point to a fully updated struct_ops struct.
    For struct_ops program reused in multiple struct_ops map, the return
    will be NULL.
    
    prog->aux->st_ops_assoc is protected by bumping the refcount for
    non-struct_ops programs and RCU for struct_ops programs. Since it would
    be inefficient to track programs associated with a struct_ops map, every
    non-struct_ops program will bump the refcount of the map to make sure
    st_ops_assoc stays valid. For a struct_ops program, it is protected by
    RCU as map_free will wait for an RCU grace period before disassociating
    the program with the map. The helper must be called in BPF program
    context or RCU read-side critical section.
    
    struct_ops implementers should note that the struct_ops returned may not
    be initialized nor attached yet. The struct_ops implementer will be
    responsible for tracking and checking the state of the associated
    struct_ops map if the use case expects an initialized or attached
    struct_ops.
    
    Signed-off-by: Amery Hung 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Andrii Nakryiko 
    Acked-by: Martin KaFai Lau 
    Link: https://lore.kernel.org/bpf/20251203233748.668365-3-ameryhung@gmail.com

commit 1588c81b9f215170bd596984691eda2f05a84a1f
Author: Amery Hung 
Date:   Wed Dec 3 15:37:43 2025 -0800

    bpf: Allow verifier to fixup kernel module kfuncs
    
    Allow verifier to fixup kfuncs in kernel module to support kfuncs with
    __prog arguments. Currently, special kfuncs and kfuncs with __prog
    arguments are kernel kfuncs. Allowing kernel module kfuncs should not
    affect existing kfunc fixup as kernel module kfuncs have BTF IDs greater
    than kernel kfuncs' BTF IDs.
    
    Signed-off-by: Amery Hung 
    Signed-off-by: Andrii Nakryiko 
    Acked-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20251203233748.668365-2-ameryhung@gmail.com

commit 81f88f6ab674973d361b6d176aa4d3ebd32253ab
Author: Alan Maguire 
Date:   Wed Dec 3 19:15:07 2025 +0000

    libbpf: Add debug messaging in dedup equivalence/identity matching
    
    We have seen a number of issues like [1]; failures to deduplicate
    key kernel data structures like task_struct.  These are often hard
    to debug from pahole even with verbose output, especially when
    identity/equivalence checks fail deep in a nested struct comparison.
    
    Here we add debug messages of the form
    
    libbpf: STRUCT 'task_struct' size=2560 vlen=194 cand_id[54222] canon_id[102820] shallow-equal but not equiv for field#23 'sched_class': 0
    
    These will be emitted during dedup from pahole when --verbose/-V
    is specified.  This greatly helps identify exactly where dedup
    failures are experienced.
    
    [1] https://lore.kernel.org/bpf/b8e8b560-bce5-414b-846d-0da6d22a9983@oracle.com/
    
    Changes since v1:
    
    - updated debug messages to refer to shallow-equal, added ids (Andrii)
    
    Signed-off-by: Alan Maguire 
    Signed-off-by: Andrii Nakryiko 
    Link: https://lore.kernel.org/bpf/20251203191507.55565-1-alan.maguire@oracle.com

commit da33e457f6803dc48b2b74f8ade75c14624d85ca
Author: Raag Jadav 
Date:   Tue Dec 2 14:03:34 2025 +0530

    drm/xe/guc_ct: Assert on credits mismatch during runtime suspend
    
    G2H credits should be in fully idle state when runtime suspending GuC CT.
    Assert on mismatch.
    
    Suggested-by: Matthew Brost 
    Signed-off-by: Raag Jadav 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Daniele Ceraolo Spurio 
    Link: https://patch.msgid.link/20251202083334.554045-1-raag.jadav@intel.com

commit 944a8313a7ebbd4cfbb0a579d4f6283e125edc08
Author: Xin Wang 
Date:   Fri Dec 5 07:06:33 2025 +0000

    drm/xe: expose PAT software config to debugfs
    
    The existing "pat" debugfs node dumps the live PAT registers. Under
    SR-IOV the VF cannot touch those registers, so the file vanishes and
    users lose all PAT visibility. Add a VF-safe "pat_sw_config" entry to
    the VF-safe debugfs list. It prints the cached PAT table the driver
    programmed, rather than poking HW, so PF and VF instances present the
    same view.
    
    This lets IGT and other tools query the PAT configuration without
    carrying platform-specific tables or mirroring kernel logic.
    
    v2: (Jonathan)
    - Only append "(* = reserved entry)" to the PAT table header on Xe2+
      platforms where it actually applies.
    - Deduplicate the PTA/ATS mode printing by introducing the small
      drm_printf_pat_mode() helper macro.
    
    v3: (Matt)
    - Print IDX[XE_CACHE_NONE_COMPRESSION] on every Xe2+ platform so the
      dump always reflects the value the driver might use (even if it defaults
      to 0) and future IP revisions don’t need extra condition tweaks.
    
    v4:
    - Drop the drm_printf_pat_mode macro and introduce a real helper
      xe2_pat_entry_dump(). (Jani)
    - Reuse the helper across all PTA/ATS/PAT dumps for xe2+ entries to keep
      output format identical.
    
    v5: (Matt)
    - Split the original patch into two: one for refactoring helpers, one for
      the new debugfs entry.
    
    CC: Jani Nikula 
    Suggested-by: Matt Roper 
    Signed-off-by: Xin Wang 
    Reviewed-by: Jonathan Cavitt 
    Signed-off-by: Matt Roper 
    Link: https://patch.msgid.link/20251205070633.28072-1-x.wang@intel.com

commit 624f494ee6e9c6b1bd16289c0de34e399950baa8
Author: Xin Wang 
Date:   Fri Dec 5 07:02:19 2025 +0000

    drm/xe: Refactor PAT dump to use shared helpers
    
    Move the PAT entry formatting into shared helper functions to ensure
    consistency and enable code reuse.
    
    This preparation is necessary for a follow-up patch that introduces a
    software-based PAT dump, which is required for debugging on VFs where
    hardware access is limited.
    
    V2: (Matt)
    - Xe3p XPC doesn’t define COMP_EN; omit it to match bspec and avoid
    confusion.
    
    Suggested-by: Matt Roper 
    Signed-off-by: Xin Wang 
    Reviewed-by: Matt Roper 
    Signed-off-by: Matt Roper 
    Link: https://patch.msgid.link/20251205070220.27859-1-x.wang@intel.com

commit d8f94cb02af3cc64013373c94a4b7780782ea59c
Author: Ashley Smith 
Date:   Thu Nov 27 11:44:02 2025 +0000

    drm/panthor: Enable timestamp propagation
    
    Set the GLB_COUNTER_EN bit to enable coherent propagation of GPU
    timestamp values to shader cores. This is a prerequisite for exposing
    device-coherent timestamp queries.
    
    Bump the version to 1.6 so userspace can detect support.
    
    v2:
    - GLB_COUNTER_EN is not a toggle bit move to panthor_fw_update_reqs
    
    Signed-off-by: Ashley Smith 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251127115019.2113040-1-ashley.smith@collabora.com
    Signed-off-by: Boris Brezillon 

commit 6d87d7c69b5a1136d7c354911f1fe7792b6a40fd
Merge: d4ee41f9e19ea8 c7685d11108acb
Author: Jani Nikula 
Date:   Fri Dec 5 10:29:22 2025 +0200

    Merge drm/drm-next into drm-intel-next
    
    Backmerge to get the topic/drm-intel-plane-color-pipeline branch
    contents.
    
    Signed-off-by: Jani Nikula 

commit c7ea291be0866ca562bb7d32d1646c08b2c3064d
Author: Zhanjun Dong 
Date:   Thu Nov 27 12:07:59 2025 -0500

    drm/xe/guc: Add new debugfs entry for lfd format output
    
    Add new debugfs entry "guc_log_lfd", prepared for output guc log
    in LFD(Log Format Descriptors) format.
    
    Signed-off-by: Zhanjun Dong 
    Reviewed-by: Julia Filipchuk 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251127170759.2620994-7-zhanjun.dong@intel.com

commit 09fb6bccef8221544221ebeb97cffec3fb42920d
Author: Zhanjun Dong 
Date:   Thu Nov 27 12:07:58 2025 -0500

    drm/xe/guc: Only add GuC crash dump if available
    
    Add GuC crash dump data empty check. LFD will only include crash dump
    section when data is not empty.
    
    Signed-off-by: Zhanjun Dong 
    Reviewed-by: Julia Filipchuk 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251127170759.2620994-6-zhanjun.dong@intel.com

commit fc40e8f6fc2de469b40494df9c12fda2c11dea3f
Author: Zhanjun Dong 
Date:   Thu Nov 27 12:07:57 2025 -0500

    drm/xe/guc: Add GuC log event buffer output in LFD format
    
    Add GuC log event buffer output in LFD format.
    
    Signed-off-by: Zhanjun Dong 
    Reviewed-by: Julia Filipchuk 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251127170759.2620994-5-zhanjun.dong@intel.com

commit 9124732b14010f58849d6686d393246c864639ca
Author: Zhanjun Dong 
Date:   Thu Nov 27 12:07:56 2025 -0500

    drm/xe/guc: Add GuC log init config in LFD format
    
    Add support to output GuC log init config (LIC) in LFD format.
    
    Signed-off-by: Zhanjun Dong 
    Reviewed-by: Julia Filipchuk 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251127170759.2620994-4-zhanjun.dong@intel.com

commit 7eeb0e5408bda883ac01bf71c1105892c82060e4
Author: Zhanjun Dong 
Date:   Thu Nov 27 12:07:55 2025 -0500

    drm/xe/guc: Add LFD related abi definitions
    
    Add GuC LFD (Log Format Descriptors) related ABI definitions.
    
    Signed-off-by: Zhanjun Dong 
    Reviewed-by: Julia Filipchuk 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251127170759.2620994-3-zhanjun.dong@intel.com

commit c1daf37fec0d796ca01d0918ce65cc09fe4936f7
Author: Zhanjun Dong 
Date:   Thu Nov 27 12:07:54 2025 -0500

    drm/xe/guc: Add log init config abi definitions
    
    Add GuC log init config (LIC) ABI definitions.
    
    Signed-off-by: Zhanjun Dong 
    Reviewed-by: Julia Filipchuk 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251127170759.2620994-2-zhanjun.dong@intel.com

commit 8322adedc0f2ed98a1e12a8dbdfa4fbbb3f17fba
Author: Ashutosh Dixit 
Date:   Mon Dec 1 18:51:15 2025 -0800

    drm/xe/rtp: Whitelist OAM MMIO trigger registers
    
    Whitelist OAM registers to enable userspace to execute MMIO triggers on OAM
    units.
    
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Umesh Nerlige Ramappa 
    Link: https://patch.msgid.link/20251202025115.373546-6-ashutosh.dixit@intel.com

commit ed455775c5a68b75e5f6ad6c8e0e3e9c98fd3f64
Author: Ashutosh Dixit 
Date:   Mon Dec 1 18:51:14 2025 -0800

    drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
    
    Minor refactor of OAG MMIO trigger register whitelisting for code reuse
    with OAM MMIO trigger register whitelisting.
    
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Umesh Nerlige Ramappa 
    Link: https://patch.msgid.link/20251202025115.373546-5-ashutosh.dixit@intel.com

commit c7e269aa565f4f3fce652ff690db3676c50f5098
Author: Ashutosh Dixit 
Date:   Mon Dec 1 18:51:13 2025 -0800

    drm/xe/oa: Allow exec_queue's to be specified only for OAG OA unit
    
    Exec_queue's are only used for OAR/OAC functionality for OAG unit. Make
    this requirement explicit, which avoids complications in the code for
    other (non-OAG) OA units.
    
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Umesh Nerlige Ramappa 
    Link: https://patch.msgid.link/20251202025115.373546-4-ashutosh.dixit@intel.com

commit 16e076b036583702bb47554d3931b5e674dd9a8e
Author: Ashutosh Dixit 
Date:   Mon Dec 1 18:51:12 2025 -0800

    drm/xe/oa/uapi: Add gt_id to struct drm_xe_oa_unit
    
    gt_id was previously omitted from 'struct drm_xe_oa_unit' because it could
    be determine from hwe's attached to the OA unit. However, we now have OA
    units which don't have any hwe's attached to them. Hence add gt_id to
    'struct drm_xe_oa_unit' in order to provide this needed information to
    userspace.
    
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Umesh Nerlige Ramappa 
    Link: https://patch.msgid.link/20251202025115.373546-3-ashutosh.dixit@intel.com

commit 89f0b56f77c96c022cbc3b22d42664d0e93e3154
Author: Ashutosh Dixit 
Date:   Mon Dec 1 18:51:11 2025 -0800

    drm/xe/oa: Use explicit struct initialization for struct xe_oa_regs
    
    Use explicit struct initialization for struct xe_oa_regs to reduce chance
    of error. Also add .oa_mmio_trg field to struct for completeness.
    
    Signed-off-by: Ashutosh Dixit 
    Reviewed-by: Umesh Nerlige Ramappa 
    Link: https://patch.msgid.link/20251202025115.373546-2-ashutosh.dixit@intel.com

commit 29bce9c8b41d5c378263a927acb9a9074d0e7a0e
Author: Arnd Bergmann 
Date:   Thu Dec 4 10:46:58 2025 +0100

    drm/xe: fix drm_gpusvm_init() arguments
    
    The Xe driver fails to build when CONFIG_DRM_XE_GPUSVM is disabled
    but CONFIG_DRM_GPUSVM is turned on, due to the clash of two commits:
    
    In file included from drivers/gpu/drm/xe/xe_vm_madvise.c:8:
    drivers/gpu/drm/xe/xe_svm.h: In function 'xe_svm_init':
    include/linux/stddef.h:8:14: error: passing argument 5 of 'drm_gpusvm_init' makes integer from pointer without a cast [-Wint-conversion]
    drivers/gpu/drm/xe/xe_svm.h:217:38: note: in expansion of macro 'NULL'
      217 |                                NULL, NULL, 0, 0, 0, NULL, NULL, 0);
          |                                      ^~~~
    In file included from drivers/gpu/drm/xe/xe_bo_types.h:11,
                     from drivers/gpu/drm/xe/xe_bo.h:11,
                     from drivers/gpu/drm/xe/xe_vm_madvise.c:11:
    include/drm/drm_gpusvm.h:254:35: note: expected 'long unsigned int' but argument is of type 'void *'
      254 |                     unsigned long mm_start, unsigned long mm_range,
          |                     ~~~~~~~~~~~~~~^~~~~~~~
    In file included from drivers/gpu/drm/xe/xe_vm_madvise.c:14:
    drivers/gpu/drm/xe/xe_svm.h:216:16: error: too many arguments to function 'drm_gpusvm_init'; expected 10, have 11
      216 |         return drm_gpusvm_init(&vm->svm.gpusvm, "Xe SVM (simple)", &vm->xe->drm,
          |                ^~~~~~~~~~~~~~~
      217 |                                NULL, NULL, 0, 0, 0, NULL, NULL, 0);
          |                                                                 ~
    include/drm/drm_gpusvm.h:251:5: note: declared here
    
    Adapt the caller to the new argument list by removing the extraneous
    NULL argument.
    
    Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm")
    Fixes: 10aa5c806030 ("drm/gpusvm, drm/xe: Fix userptr to not allow device private pages")
    Signed-off-by: Arnd Bergmann 
    Reviewed-by: Thomas Hellström 
    Signed-off-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251204094704.1030933-1-arnd@kernel.org

commit ef7de33544a7a6783d7afe09496da362d1e90ba1
Author: Arnd Bergmann 
Date:   Thu Dec 4 10:41:36 2025 +0100

    drm/xe/pf: fix VFIO link error
    
    The Makefile logic for building xe_sriov_vfio.o was added incorrectly,
    as setting CONFIG_XE_VFIO_PCI=m means it doesn't get included into a
    built-in xe driver:
    
    ERROR: modpost: "xe_sriov_vfio_stop_copy_enter" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    ERROR: modpost: "xe_sriov_vfio_stop_copy_exit" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    ERROR: modpost: "xe_sriov_vfio_suspend_device" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    ERROR: modpost: "xe_sriov_vfio_wait_flr_done" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    ERROR: modpost: "xe_sriov_vfio_error" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    ERROR: modpost: "xe_sriov_vfio_resume_data_enter" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    ERROR: modpost: "xe_sriov_vfio_resume_device" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    ERROR: modpost: "xe_sriov_vfio_resume_data_exit" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    ERROR: modpost: "xe_sriov_vfio_data_write" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    ERROR: modpost: "xe_sriov_vfio_migration_supported" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined!
    WARNING: modpost: suppressed 3 unresolved symbol warnings because there were too many)
    
    Check for CONFIG_XE_VFIO_PCI being enabled in the Makefile to decide whether to
    include the object instead.
    
    Fixes: 17f22465c5a5 ("drm/xe/pf: Export helpers for VFIO")
    Signed-off-by: Arnd Bergmann 
    Reviewed-by: Michal Wajdeczko 
    Signed-off-by: Thomas Hellström 
    Link: https://patch.msgid.link/20251204094154.1029357-1-arnd@kernel.org

commit 88e721ab978a86426aa08da520de77430fa7bb84
Author: Philipp Stanner 
Date:   Mon Dec 1 11:50:11 2025 +0100

    dma-buf/dma-fence: Remove return code of signaling-functions
    
    All functions used for signaling a fence return an error code whose sole
    purpose is to tell whether a fence was already signaled.
    
    This is racy and has been used by almost no party in the kernel, and the
    few users have been removed in preceding cleanup commits.
    
    Turn all signaling-functions into void-functions.
    
    Suggested-by: Christian König 
    Reviewed-by: Christian König 
    Signed-off-by: Philipp Stanner 
    Link: https://patch.msgid.link/20251201105011.19386-9-phasta@kernel.org

commit c6c60a2290b335eb5b45c6c7eeb254f18027b3ec
Author: Philipp Stanner 
Date:   Mon Dec 1 11:50:10 2025 +0100

    drm/ttm: Use dma_fence_check_and_signal()
    
    The return code of dma_fence_signal() is not useful and shall be removed
    from the kernel. To do so, the few users who rely on the return code
    must be ported.
    
    Use dma_fence_check_and_signal() and mapp its boolean return code to
    dma_fence_signal()'s former value for already-signaled fences.
    
    Suggested-by: Christian König 
    Reviewed-by: Christian König 
    Signed-off-by: Philipp Stanner 
    Link: https://patch.msgid.link/20251201105011.19386-8-phasta@kernel.org

commit 583d1fa19148c261868fa5c2382fe552c06a2164
Author: Philipp Stanner 
Date:   Mon Dec 1 11:50:09 2025 +0100

    dma-buf: Don't misuse dma_fence_signal()
    
    The return code of dma_fence_signal() is not really useful as there is
    nothing reasonable to do if a fence was already signaled. That return
    code shall be removed from the kernel.
    
    Moreover, dma_fence_signal() should not be used to check whether fences
    are signaled. That's what dma_fence_is_signaled() and
    dma_fence_test_signaled_flag() exist for.
    
    Replace the non-canonical usage of dma_fence_signal().
    
    Suggested-by: Christian König 
    Reviewed-by: Christian König 
    Signed-off-by: Philipp Stanner 
    Link: https://patch.msgid.link/20251201105011.19386-7-phasta@kernel.org

commit dbcd754b845987f7157260c15e80ae19da81c9df
Author: Philipp Stanner 
Date:   Mon Dec 1 11:50:08 2025 +0100

    drm/xe: Use dma_fence_check_and_signal_locked()
    
    Xe is one of the few users utilizing the return code of
    dma_fence_signal() to check whether a fence had already been signaled by
    someone else.
    
    To clean up and simplify the dma_fence API, the few kernel users relying
    on that behavior shall be ported to an alternative function.
    
    Replace dma_fence_signal_locked() with
    dma_fence_check_and_signal_locked().
    
    Acked-by: Christian König 
    Acked-by: Rodrigo Vivi 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Philipp Stanner 
    Link: https://patch.msgid.link/20251201105011.19386-6-phasta@kernel.org

commit 06bc18e0def7d926265480faa555bf0b67a35a90
Author: Philipp Stanner 
Date:   Mon Dec 1 11:50:07 2025 +0100

    amd/amdkfd: Use dma_fence_check_and_signal()
    
    amdkfd is one of the few users which relies on the return code of
    dma_fence_signal(), which, so far, informs the caller whether the fence
    had already been signaled.
    
    As there are barely any users, dma_fence signaling functions shall get
    the return value void. To do so, the few users must be ported to a
    function which preserves the old behavior.
    
    Replace the call to dma_fence_signal() with one to
    dma_fence_check_and_signal().
    
    Suggested-by: Christian König 
    Reviewed-by: Christian König 
    Reviewed-by: Felix Kuehling 
    Signed-off-by: Philipp Stanner 
    Link: https://patch.msgid.link/20251201105011.19386-5-phasta@kernel.org

commit c891b99d25ddbb6b8167f9bdb904d4abc5a53b6b
Author: Philipp Stanner 
Date:   Mon Dec 1 11:50:06 2025 +0100

    dma-buf/dma-fence: Add dma_fence_check_and_signal()
    
    The overwhelming majority of users of dma_fence signaling functions
    don't care about whether the fence had already been signaled by someone
    else. Therefore, the return code shall be removed from those functions.
    
    For the few users who rely on the check, a new, specialized function
    shall be provided.
    
    Add dma_fence_check_and_signal(), which signals a fence if it had not
    yet been signaled, and informs the user about that.
    
    Add a counter part, dma_fence_check_and_signal_locked(), which doesn't
    take the spinlock.
    
    Reviewed-by: Christian König 
    Signed-off-by: Philipp Stanner 
    Link: https://patch.msgid.link/20251201105011.19386-4-phasta@kernel.org

commit e58b4dea9054c85688c8f639ebdfc8115261dae2
Author: Philipp Stanner 
Date:   Mon Dec 1 11:50:05 2025 +0100

    dma-buf/dma-fence: Add dma_fence_test_signaled_flag()
    
    The dma_fence framework checks at many places whether the signaled flag
    of a fence is already set. The code can be simplified and made more
    readable by providing a helper function for that.
    
    Add dma_fence_test_signaled_flag(), which only checks whether a fence is
    signaled. Use it internally.
    
    Suggested-by: Tvrtko Ursulin 
    Reviewed-by: Christian König 
    Signed-off-by: Philipp Stanner 
    Link: https://patch.msgid.link/20251201105011.19386-3-phasta@kernel.org

commit d4ee41f9e19ea89a9cdf32b14be3fe8823f64cc8
Author: Vinod Govindapillai 
Date:   Thu Nov 27 13:53:49 2025 +0200

    drm/i915/fbc: Apply Wa_14025769978
    
    Disable cache read setting in the cacheability configuration
    register as per the wa recommendation
    
    Bspec: 79482, 74722, 68881
    Signed-off-by: Vinod Govindapillai 
    Reviewed-by: Jouni Högander 
    Link: https://patch.msgid.link/20251127115349.249120-4-vinod.govindapillai@intel.com

commit 0b806d62fd5f59bcf07b971af15bab5bef191279
Author: Vinod Govindapillai 
Date:   Fri Nov 28 13:35:57 2025 +0200

    drm/i915/xe3p_lpd: Enable display use of system cache for FBC
    
    One of the FBC instances can utilize the reserved area of SoC
    level cache for the fbc transactions to benefit reduced memory
    system power especially in idle scenarios. Reserved area of the
    system cache can be assigned to an fbc instance by configuring
    the cacheability configuration register with offset of the
    compressed frame buffer in stolen memoty of that fbc. There is
    a limit to this reserved area which is programmable and for
    xe3p_lpd the limit is defined as 2MB. The first FBC instance
    enabled will utilize the system cache as of now.
    
    v2: - better to track fbc sys cache usage from intel_display level,
          sanitize the cacheability config register on probe (Matt)
        - limit this for integrated graphics solutions, confirmed that
          no default value set for cache range by hw (Gustavo)
    
    v3: - changes related to the use of fbc substruct in intel_display
        - use intel_de_write() instead of intel_rmw() by hardcoding the
          default value fields
    
    v4: - protect sys cache config accesses, sys cache usage status in
          debugfs per fbc instance (Jani)
    
    v5: - mutex_init and missing mutex_lock in sanitize call
    
    v6: - changes to commit message and some obvious comments removed
    
    Bspec: 68881, 74722
    Signed-off-by: Vinod Govindapillai 
    Reviewed-by: Jouni Högander 
    Link: https://patch.msgid.link/20251128113557.129192-1-vinod.govindapillai@intel.com
    Signed-off-by: Vinod Govindapillai 

commit 78d91ba6bd7968d4750dad57c62bf5225ddcb388
Author: Sanjay Yadav 
Date:   Thu Dec 4 09:34:03 2025 +0530

    drm/xe/uapi: Add NO_COMPRESSION BO flag and query capability
    
    Introduce DRM_XE_GEM_CREATE_FLAG_NO_COMPRESSION to let userspace
    opt out of CCS compression on a per-BO basis. When set, the driver
    maps this to XE_BO_FLAG_NO_COMPRESSION, skips CCS metadata
    allocation/clearing, and rejects compressed PAT indices at vm_bind.
    This avoids extra memory ops and manual CCS state handling for buffers.
    
    To allow userspace to detect at runtime whether the kernel supports this
    feature, add DRM_XE_QUERY_CONFIG_FLAG_HAS_NO_COMPRESSION_HINT and expose
    it via query_config() on Xe2+ platforms.
    
    Mesa PR: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/38425
    IGT PR: https://patchwork.freedesktop.org/patch/685180/
    
    v2
    - Changed error code from -EINVAL to -EOPNOTSUPP for unsupported flag
      usage on pre-Xe2 platforms
    - Fixed checkpatch warning in xe_vm.c
    - Fixed kernel-doc formatting in xe_drm.h
    
    v3
    - Rebase
    - Updated commit title and description
    - Added UAPI for DRM_XE_QUERY_CONFIG_FLAG_HAS_NO_COMPRESSION_HINT and
      exposed it via query_config()
    
    v4
    - Rebase
    
    v5
    - Included Mesa PR and IGT PR in the commit description
    - Used xe_pat_index_get_comp_en() to extract the compression
    
    v6
    - Added XE_IOCTL_DBG() checks for argument validation
    
    Suggested-by: Matthew Auld 
    Suggested-by: José Roberto de Souza 
    Acked-by: José Roberto de Souza 
    Reviewed-by: Matthew Auld 
    Signed-off-by: Sanjay Yadav 
    Signed-off-by: Matthew Auld 
    Link: https://patch.msgid.link/20251204040402.2692921-2-sanjay.kumar.yadav@intel.com

commit 6cc3776b1f41cfc10bbe3dc6c70d0bf036a868d8
Author: Vinod Govindapillai 
Date:   Thu Nov 27 13:53:47 2025 +0200

    drm/i915/display: Use a sub-struct for fbc operations in intel_display
    
    As FBC can utilize the system cache in xe3p_lpd onwards, we need
    a provision to track which fbc instance is utilizing this cache.
    A sub-struct at intel_display level to group all the fbc ops will
    make fbc handling much easier. Introduce a fbc sub-struct and move
    the fbc instance array into that.
    
    v2: changes in commit message
    
    Suggested-by: Jani Nikula 
    Signed-off-by: Vinod Govindapillai 
    Reviewed-by: Jani Nikula 
    Link: https://patch.msgid.link/20251127115349.249120-2-vinod.govindapillai@intel.com

commit 54da99e5c3a7e114df8dbbd42a0fee2b3ed8aa15
Author: Harish Chegondi 
Date:   Fri Nov 21 13:59:17 2025 -0800

    drm/xe/xe3: Remove graphics IP 30.01 from Wa_18041344222 IP list
    
    As per the updated WA database, Wa_18041344222 no longer applies to
    graphics IP version 30.01. Remove it.
    
    Cc: Matt Roper 
    Cc: Gustavo Sousa 
    Signed-off-by: Harish Chegondi 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/280ab3e8dce8d7a40540ae634a5432694ac17ab0.1763762330.git.harish.chegondi@intel.com
    Signed-off-by: Matt Roper 

commit 76ce2313709f13a6adbcaa1a43a8539c8f509f6a
Author: Matthew Brost 
Date:   Tue Dec 2 17:18:09 2025 -0800

    drm/xe: Do not reference loop variable directly
    
    Do not reference the loop variable job after the loop has exited.
    Instead, save the job from the last iteration of the loop.
    
    Fixes: 00937fe1921a ("drm/xe/vf: Start re-emission from first unsignaled job during VF migration")
    Reported-by: kernel test robot 
    Reported-by: Dan Carpenter 
    Closes: https://lore.kernel.org/r/202511291102.jnnKP6IB-lkp@intel.com/
    Signed-off-by: Matthew Brost 
    Reviewed-by: Dnyaneshwar Bhadane 
    Link: https://patch.msgid.link/20251203011809.968893-1-matthew.brost@intel.com

commit 2976aeb0de77da599ad37691963efbdcb07435ce
Author: Alexey Klimov 
Date:   Wed Dec 3 07:45:55 2025 +0000

    gpu/panel-edp: add AUO panel entry for B140HAN06.4
    
    Add an eDP panel entry for AUO B140HAN06.4 that is also used in
    some variants of Lenovo Flex 5G with Qcom SC8180 SoC.
    
    The raw edid of the panel is:
    
    00 ff ff ff ff ff ff 00 06 af 3d 64 00 00 00 00
    2b 1d 01 04 a5 1f 11 78 03 b8 1a a6 54 4a 9b 26
    0e 52 55 00 00 00 01 01 01 01 01 01 01 01 01 01
    01 01 01 01 01 01 14 37 80 b8 70 38 24 40 10 10
    3e 00 35 ae 10 00 00 18 10 2c 80 b8 70 38 24 40
    10 10 3e 00 35 ae 10 00 00 18 00 00 00 fe 00 41
    55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe
    00 42 31 34 30 48 41 4e 30 36 2e 34 20 0a 00 eb
    
    I do not have access to the datasheet and but it is tested on above
    mentioned laptop for a few weeks and seems to work just fine with
    timing info of similar panels.
    
    Cc: Bjorn Andersson 
    Cc: Vinod Koul 
    Signed-off-by: Alexey Klimov 
    Reviewed-by: Douglas Anderson 
    Signed-off-by: Douglas Anderson 
    Link: https://patch.msgid.link/20251203074555.690613-1-alexey.klimov@linaro.org

commit 688035f83ef0a3b492b9ff9748518d6d45b4f107
Author: Matt Roper 
Date:   Tue Dec 2 14:25:52 2025 -0800

    drm/xe/sync: Use for_each_tlb_inval() to calculate invalidation fences
    
    xe_sync_in_fence_get() uses the same kind of mismatched fence array
    allocation vs looping logic that was previously noted and changed by
    commit 0a4c2ddc711a ("drm/xe/vm: Use for_each_tlb_inval() to calculate
    invalidation fences").  As with that commit, the mismatch doesn't cause
    any problem at the moment since for_each_tlb_inval() loops the same
    number of times as XE_MAX_GT_PER_TILE (2).  However we don't want to
    assume that these will always be the same in the future, so switch to
    using for_each_tlb_inval() in both places to future-proof the code.
    
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251202222551.1858930-2-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit c06da4b3573a2d3c906c185450d0b1059d02820e
Author: Tvrtko Ursulin 
Date:   Fri Sep 19 14:15:30 2025 +0100

    drm/ttm: Tidy usage of local variables a little bit
    
    At the moment the TTM code has a few places which exibit sub-optimal
    patterns regarding local variable usage:
    
     * Having a local with some object cached but not always using it.
     * Having a local for a single use object member access.
     * Failed opportunities to use a local to cache a pointer.
    
    Lets tidy this a little bit and apply some more consistency.
    
    It is mostly for consistency and redability but I have also checked that
    there are not negative code generation effects. In fact there are more
    positives:
    
    add/remove: 0/0 grow/shrink: 3/9 up/down: 12/-175 (-163)
    Function                                     old     new   delta
    ttm_pool_restore_and_alloc                   415     423      +8
    ttm_bo_vunmap                                147     149      +2
    ttm_bo_evict                                 521     523      +2
    ttm_bo_vm_fault_reserved                     972     970      -2
    ttm_bo_vm_dummy_page                         155     152      -3
    ttm_bo_vm_fault                              203     196      -7
    ttm_bo_populate                              158     150      -8
    ttm_bo_move_memcpy                           600     592      -8
    ttm_bo_kmap                                  667     644     -23
    ttm_bo_shrink                                333     305     -28
    ttm_bo_release                               750     720     -30
    ttm_bo_swapout_cb                            691     625     -66
    Total: Before=42717, After=42554, chg -0.38%
    
    Signed-off-by: Tvrtko Ursulin 
    Reviewed-by: Thadeu Lima de Souza Cascardo 
    Link: https://lore.kernel.org/r/20250919131530.91247-5-tvrtko.ursulin@igalia.com
    Acked-by: Christian König 
    Signed-off-by: Tvrtko Ursulin 
    [tursulin: fixup conflict in ttm_bo_move_pipeline_evict]

commit 802620f5a9cf7231933cfce61817577b3b6543d9
Author: Tvrtko Ursulin 
Date:   Fri Sep 19 14:15:29 2025 +0100

    drm/ttm: Tidy ttm_operation_ctx initialization
    
    No need to initialize a subset of fields to zero.
    
    Signed-off-by: Tvrtko Ursulin 
    Acked-by: Thadeu Lima de Souza Cascardo 
    Link: https://lore.kernel.org/r/20250919131530.91247-4-tvrtko.ursulin@igalia.com
    Reviewed-by: Christian König 
    Signed-off-by: Tvrtko Ursulin 
    [tursulin: fixup conflict in ttm_resource_manager_evict_all]

commit feb065155bab2fabc3545bf57ae31e86d02df9a1
Author: Tvrtko Ursulin 
Date:   Fri Sep 19 14:15:28 2025 +0100

    drm/ttm: Resource cannot be NULL in ttm_resource_intersects
    
    Function has a single caller and the resource cannot be NULL therefore
    remove the early return check.
    
    Signed-off-by: Tvrtko Ursulin 
    Reviewed-by: Thadeu Lima de Souza Cascardo 
    Reviewed-by: Christian König 
    Signed-off-by: Tvrtko Ursulin 
    Link: https://lore.kernel.org/r/20250919131530.91247-3-tvrtko.ursulin@igalia.com

commit ee8721bee80150ed1e4ee5ebb6aaf070802ac81b
Author: Tvrtko Ursulin 
Date:   Fri Sep 19 14:15:27 2025 +0100

    drm/ttm: Make ttm_bo_init_validate safe against ttm_operation_ctx re-ordering
    
    Struct ttm_operation_ctx initializer in ttm_bo_init_validate assumes the
    order of the structure fields when it is configuring the interruptible
    flag.
    
    Fix it by using named initialization.
    
    Signed-off-by: Tvrtko Ursulin 
    Acked-by: Thadeu Lima de Souza Cascardo 
    Reviewed-by: Christian König 
    Signed-off-by: Tvrtko Ursulin 
    Link: https://lore.kernel.org/r/20250919131530.91247-2-tvrtko.ursulin@igalia.com

commit ac5b392a8c355001c4c3f230a0e4b1f904e359ca
Author: Chia-I Wu 
Date:   Tue Dec 2 09:40:28 2025 -0800

    drm/panthor: fix queue_reset_timeout_locked
    
    queue_check_job_completion calls queue_reset_timeout_locked to reset the
    timeout when progress is made. We want the reset to happen when the
    timeout is running, not when it is suspended.
    
    Fixes: 345c5b7cc0f85 ("drm/panthor: Make the timeout per-queue instead of per-job")
    Signed-off-by: Chia-I Wu 
    Signed-off-by: Liviu Dudau 
    Link: https://patch.msgid.link/20251202174028.1600218-1-olvaffe@gmail.com

commit cedf6765ecfd60197d90437ec648feb8b3e31cb1
Author: Akash Goel 
Date:   Wed Dec 3 09:19:11 2025 +0000

    drm/panthor: Remove redundant call to disable the MCU
    
    This commit removes the redundant call to disable the MCU firmware
    in the suspend path.
    
    Fixes: 514072549865 ("drm/panthor: Support GLB_REQ.STATE field for Mali-G1 GPUs")
    Signed-off-by: Akash Goel 
    Signed-off-by: Liviu Dudau 
    Link: https://patch.msgid.link/20251203091911.145623-1-akash.goel@arm.com

commit 276e411604b3a90ec9d243075f976e458139a006
Author: Boris Brezillon 
Date:   Wed Dec 3 13:17:50 2025 +0100

    drm/panthor: Unlock the locked region before disabling an AS
    
    An AS can be disabled in the middle of a VM operation (VM being
    evicted from an AS slot, for instance). In that case, we need the
    locked section to be unlocked before releasing the slot.
    
    v2:
    - Add an lockdep_assert_held() in panthor_mmu_as_disable()
    - Collect R-bs
    
    v3:
    - Don't reset the locked_region range in the as_disable() path
    
    Fixes: 6e2d3b3e8589 ("drm/panthor: Add support for atomic page table updates")
    Signed-off-by: Boris Brezillon 
    Reviewed-by: Liviu Dudau 
    Reviewed-by: Chia-I Wu 
    Signed-off-by: Liviu Dudau 
    Link: https://patch.msgid.link/20251203121750.404340-4-boris.brezillon@collabora.com

commit 32e593d74c39249ae14c8f0de88eec677c621aa7
Author: Boris Brezillon 
Date:   Wed Dec 3 13:17:49 2025 +0100

    drm/panthor: Make sure caches are flushed/invalidated when an AS is recycled
    
    When we re-assign a slot to a different VM, we need to make sure the
    old VM caches are flushed before doing the switch. Specialize
    panthor_mmu_as_disable() so we can skip the slot programmation while
    still getting the cache flushing, and call this helper from
    panthor_vm_active() when an idle slot is recycled.
    
    v2:
    - Collect R-bs
    
    Fixes: 6e2d3b3e8589 ("drm/panthor: Add support for atomic page table updates")
    Signed-off-by: Boris Brezillon 
    Reviewed-by: Liviu Dudau 
    Reviewed-by: Chia-I Wu 
    Signed-off-by: Liviu Dudau 
    Link: https://patch.msgid.link/20251203121750.404340-3-boris.brezillon@collabora.com

commit 657803cbcafde8caf11d207b042384577a3d5f17
Author: Boris Brezillon 
Date:   Wed Dec 3 13:17:48 2025 +0100

    drm/panthor: Drop a WARN_ON() in group_free_queue()
    
    It appears the timeout can still be enabled when we reach that point,
    because of the asynchronous progress check done on queues that resets
    the timer when jobs are still in-flight, but progress was made.
    We could add more checks to make sure the timer is not re-enabled when
    a group can't run anymore, but we don't have a group to pass to
    queue_check_job_completion() in some context.
    
    It's just as safe (we just want to be sure the timer is stopped before
    we destroy the queue) and simpler to drop the WARN_ON() in
    group_free_queue().
    
    v2:
    - Collect R-bs
    
    Signed-off-by: Boris Brezillon 
    Reviewed-by: Liviu Dudau 
    Reviewed-by: Chia-I Wu 
    Signed-off-by: Liviu Dudau 
    Link: https://patch.msgid.link/20251203121750.404340-2-boris.brezillon@collabora.com

commit 0f94e51b5320eacccc2626ab70b8d7e705332334
Merge: 43109e398d2d4a 0692602defb0c2
Author: Thomas Hellström 
Date:   Wed Dec 3 11:22:18 2025 +0100

    Merge drm/drm-next into drm-xe-next
    
    Backmerging to bring in a needed dependency for the Xe VFIO
    driver variant. This should ideally have been done before we
    commited that, so we now have a small window in drm-xe-next
    where that driver doesn't compile.
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202512030331.I8CveRre-lkp@intel.com/
    Signed-off-by: Thomas Hellström 

commit 41f231179a45068fdde2c6c9aa70cbca2eb11b49
Author: Christian König 
Date:   Thu Sep 18 13:52:54 2025 +0200

    dma-buf: replace "#if" with just "if"
    
    No need to conditional compile that code, let the compilers dead code
    elimination handle it instead.
    
    Signed-off-by: Christian König 
    Reviewed-by: Michael J. Ruhl 
    Link: https://lore.kernel.org/r/20251006134713.1846-1-christian.koenig@amd.com

commit 1552691f960a9ee182a80b754d076e055b7545c5
Author: Nemesa Garg 
Date:   Wed Nov 26 14:11:52 2025 +0530

    drm/i915/crtc: Expose sharpness only if num_scalers is >= 2
    
    CASF requires the second scaler for sharpness.
    Do not expose the SHARPNESS_STRENGTH property if
    the CRTC has fewer than two scalers.
    
    v2: Modify header and commit message. [Ankit]
    
    Signed-off-by: Nemesa Garg 
    Reviewed-by: Ankit Nautiyal 
    Signed-off-by: Animesh Manna 
    Link: https://patch.msgid.link/20251126084152.3905905-1-nemesa.garg@intel.com

commit 3d3ac202c7df0923dee7e182c95d170cf9345a9f
Author: Lizhi Hou 
Date:   Tue Dec 2 08:54:27 2025 -0800

    accel/amdxdna: Poll MPNPU_PWAITMODE after requesting firmware suspend
    
    After issuing a firmware suspend request, the driver must ensure that the
    suspend operation has completed before proceeding. Add polling of the
    MPNPU_PWAITMODE register to confirm that the firmware has fully entered
    the suspended state. This prevents race conditions where subsequent
    operations assume the firmware is idle before it has actually completed
    its suspend sequence.
    
    Reviewed-by: Mario Limonciello (AMD) 
    Reviewed-by: Maciej Falkowski 
    Signed-off-by: Lizhi Hou 
    Link: https://patch.msgid.link/20251202165427.507414-1-lizhi.hou@amd.com

commit 4d7f266e688480fdd4103c90331b012cd1e8b859
Author: Gustavo Sousa 
Date:   Mon Dec 1 17:23:06 2025 -0800

    drm/i915/display: Use HAS_LT_PHY() for LT PHY AUX power
    
    Bspec states that the new AUX power enable/disable sequences are
    associated with the LT PHY.  As such, use HAS_LT_PHY() instead of IP
    checks in those paths in the driver code.
    
    While at it, also move the comment that we can't use the power status
    flag to the "else" branch, since that comment is not applicable for the
    LT PHY.
    
    Bspec: 68967
    Cc: Matt Roper 
    Cc: Suraj Kandpal 
    Suggested-by: Matt Roper 
    Reviewed-by: Matt Roper 
    Signed-off-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251202012306.9315-9-matthew.s.atwood@intel.com
    Signed-off-by: Matt Roper 

commit 97afa2da35f3bab11d5c9885508ee1d6162b8d98
Author: Gustavo Sousa 
Date:   Mon Dec 1 17:23:05 2025 -0800

    drm/i915/display: Move HAS_LT_PHY() to intel_display_device.h
    
    We will need to HAS_LT_PHY() that macro in code outside of LT PHY
    implementation. Move its definition to intel_display_device.h.
    
    Cc: Matt Roper 
    Cc: Suraj Kandpal 
    Reviewed-by: Matt Roper 
    Signed-off-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251202012306.9315-8-matthew.s.atwood@intel.com
    Signed-off-by: Matt Roper 

commit 532f6f602e0653d037684822f8ef72e734717f35
Author: Gustavo Sousa 
Date:   Mon Dec 1 17:23:04 2025 -0800

    drm/i915/display: Use platform check in HAS_LT_PHY()
    
    NVL uses the Lake Tahoe PHY for display output and the driver recently
    added the macro HAS_LT_PHY() to allow selecting code paths specific for
    that type of PHY.
    
    While NVL uses Xe3p_LPD as display IP, the type of PHY is actually
    defined at the SoC level, so use a platform check instead of display
    version.
    
    Bspec: 74199
    Cc: Suraj Kandpal 
    Cc: Matt Roper 
    Reviewed-by: Matt Roper 
    Reviewed-by: Dnyaneshwar Bhadane 
    Signed-off-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251202012306.9315-7-matthew.s.atwood@intel.com
    Signed-off-by: Matt Roper 

commit 8fad54133b96a243af1fa593822a3f0af3b058ac
Author: Sai Teja Pottumuttu 
Date:   Mon Dec 1 17:23:03 2025 -0800

    drm/i915/nvls: Add NVL-S display support
    
    Add platform description and PCI IDs for NVL-S.
    
    BSpec: 74201
    Signed-off-by: Sai Teja Pottumuttu 
    Reviewed-by: Shekhar Chauhan 
    Signed-off-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251202012306.9315-6-matthew.s.atwood@intel.com
    Signed-off-by: Matt Roper 

commit df9670191613cdea0e223f5070368a26312b12c3
Author: Gustavo Sousa 
Date:   Mon Dec 1 17:23:02 2025 -0800

    drm/i915/xe3p_lpd: Handle underrun debug bits
    
    Xe3p_LPD added several bits containing information that can be relevant
    to debugging FIFO underruns.  Add the logic necessary to handle them
    when reporting underruns.
    
    This was adapted from the initial patch[1] from Sai Teja Pottumuttu.
    
    [1] https://lore.kernel.org/all/20251015-xe3p_lpd-basic-enabling-v1-12-d2d1e26520aa@intel.com/
    
    v2:
      - Handle FBC-related bits in intel_fbc.c. (Ville)
      - Do not use intel_fbc_id_for_pipe (promoted from
        skl_fbc_id_for_pipe), but use pipe's primary plane to get the FBC
        instance. (Ville, Matt)
      - Improve code readability by moving logic specific to logging fields
        of UNDERRUN_DBG1 to a separate function. (Jani)
    
    v3:
      - Use crtc->base.primary instead of cycling through all crtcs
    
    Bspec: 69111, 69561, 74411, 74412
    Cc: Jani Nikula 
    Cc: Matt Roper 
    Cc: Ville Syrjälä 
    Signed-off-by: Gustavo Sousa 
    Signed-off-by: Matt Atwood 
    Link: https://patch.msgid.link/20251202012306.9315-5-matthew.s.atwood@intel.com
    Signed-off-by: Matt Roper 

commit df5dd52a6de486e32576ac5851b4e9429182274b
Author: Gustavo Sousa 
Date:   Mon Dec 1 17:23:01 2025 -0800

    drm/i915/display: Handle dedicated external ports in intel_encoder_is_tc()
    
    Starting with Xe3p_LPD, the VBT has a new field, called in the driver
    "dedicated_external", which tells that a Type-C capable port is
    physically connected to a PHY outside of the Type-C subsystem.  When
    that's the case, the driver must not do the extra Type-C programming for
    that port.  Update intel_encoder_is_tc() to check for that case.
    
    While at it, add a note to intel_phy_is_tc() to remind us that it is
    about whether the respective port is a Type-C capable port rather than
    the PHY itself.
    
    (Maybe it would be a nice idea to rename intel_phy_is_tc()?)
    
    Note that this was handled with a new bool member added to struct
    intel_digital_port instead of having querying the VBT directly because
    VBT memory is freed (intel_bios_driver_remove) before encoder cleanup
    (intel_ddi_encoder_destroy), which would cause an oops to happen when
    the latter calls intel_encoder_is_tc().  This could be fixed by keeping
    VBT data around longer, but that's left for a follow-up work, if deemed
    necessary.
    
    v2:
      - Drop printing info about dedicated external, now that we are doing
        it when parsing the VBT. (Jani)
      - Add a FIXME comment on the code explaining why we need to store
        dedicated_external in struct intel_digital_port. (Jani)
    v3:
      - Simplify the code by using NULL check for dig_port to avoid using
        intel_encoder_is_dig_port(). (Imre)
    
    Cc: Imre Deak 
    Cc: Jani Nikula 
    Cc: Shekhar Chauhan 
    Signed-off-by: Gustavo Sousa 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251202012306.9315-4-matthew.s.atwood@intel.com
    Signed-off-by: Matt Roper 

commit c296e3f2cec7325dc93a19cdcf3194a63b02c389
Author: Gustavo Sousa 
Date:   Mon Dec 1 17:23:00 2025 -0800

    drm/i915/power: Use intel_encoder_is_tc()
    
    Starting with Xe3p_LPD, when intel_phy_is_tc() returns true, it does
    not necessarily mean that the port is connected to a PHY in the Type-C
    subsystem.  The reason is that there is now a VBT field called
    dedicated_external that will indicate that a Type-C capable port is
    connected to a (most likely) combo/dedicated PHY.  When that's the case,
    we must not do the extra programming required for Type-C connections.
    
    In an upcoming change, we will modify intel_encoder_is_tc() to take the
    VBT field dedicated_external into consideration.  Update
    intel_display_power_well.c to use that function instead of
    intel_phy_is_tc().
    
    Note that, even though icl_aux_power_well_{enable,disable} are not part
    of Xe3p_LPD's display paths, we modify them anyway for uniformity.
    
    v2:
      - Add and use icl_aux_pw_is_tc_phy() helper to avoid explicit encoder
        lookup. (Imre)
    
    Cc: Imre Deak 
    Cc: Shekhar Chauhan 
    Reviewed-by: Suraj Kandpal  # v1
    Signed-off-by: Gustavo Sousa 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251202012306.9315-3-matthew.s.atwood@intel.com
    Signed-off-by: Matt Roper 

commit 203c7904f2d85ac768749112ddedb522965316f9
Author: Gustavo Sousa 
Date:   Mon Dec 1 17:22:59 2025 -0800

    drm/i915/vbt: Add fields dedicated_external and dyn_port_over_tc
    
    VBT version 264 adds new fields associated to Xe3p_LPD's new ways of
    configuring SoC for TC ports and PHYs.  Update the code to match the
    updates in VBT.
    
    The new field dedicated_external is used to represent TC ports that are
    connected to PHYs outside of the Type-C subsystem, meaning that they
    behave like dedicated ports and don't require the extra Type-C
    programming.  In an upcoming change, we will update the driver to take
    this field into consideration when detecting the type of port.
    
    The new field dyn_port_over_tc is used to inform that the TC port can be
    dynamically allocated for a legacy connector in the Type-C subsystem,
    which is a new feature in Xe3p_LPD.  In upcoming changes, we will use
    that field in order to handle the IOM resource management programming
    required for that.
    
    Note that, when dedicated_external is set, the fields dp_usb_type_c and
    tbt are tagged as "don't care" in the spec, so they should be ignored in
    that case, so also add a sanitization function to take care of forcing
    them to zero when dedicated_external is true.
    
    v2:
      - Use sanitization function to force dp_usb_type_c and tbt fields to
        be zero instead of adding a
        intel_bios_encoder_is_dedicated_external() check in each of their
        respective accessor functions. (Jani)
      - Print info about dedicated external ports in print_ddi_port().
        (Jani)
    v3:
      - Also zero out field dyn_port_over_tc when dedicated_external is set.
        (Imre)
      - Use intel_bios_encoder_is_dedicated_external() directly instead of
        storing return value into variable in print_ddi_port(). (Imre)
      - Also print info for dyn_port_over_tc in print_ddi_port(). (Imre)
    
    Bspec: 20124, 68954, 74304
    Cc: Imre Deak 
    Cc: Jani Nikula 
    Cc: Shekhar Chauhan 
    Signed-off-by: Gustavo Sousa 
    Reviewed-by: Imre Deak 
    Link: https://patch.msgid.link/20251202012306.9315-2-matthew.s.atwood@intel.com
    Signed-off-by: Matt Roper 

commit eb0cfcf265714b419cc3549895a00632e76732ae
Author: Haotian Zhang 
Date:   Mon Dec 1 19:38:01 2025 +0800

    jfs: Add missing set_freezable() for freezable kthread
    
    The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(),
    causing it to remain non-freezable by default. This prevents proper
    freezing during system suspend.
    
    Add set_freezable() to make the thread freezable as intended.
    
    Signed-off-by: Haotian Zhang 
    Signed-off-by: Dave Kleikamp 

commit 9218dc26fd922b09858ecd3666ed57dfd8098da8
Author: Jori Koolstra 
Date:   Tue Oct 28 13:22:12 2025 +0100

    jfs: nlink overflow in jfs_rename
    
    If nlink is maximal for a directory (-1) and inside that directory you
    perform a rename for some child directory (not moving from the parent),
    then the nlink of the first directory is first incremented and later
    decremented. Normally this is fine, but when nlink = -1 this causes a
    wrap around to 0, and then drop_nlink issues a warning.
    
    After applying the patch syzbot no longer issues any warnings. I also
    ran some basic fs tests to look for any regressions.
    
    Signed-off-by: Jori Koolstra 
    Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
    Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f
    Signed-off-by: Dave Kleikamp 

commit 43109e398d2d4ac8a932ac46fde34e55cec53d4c
Author: Raag Jadav 
Date:   Fri Nov 28 13:52:12 2025 +0530

    drm/xe/gt: Use scope-based forcewake
    
    Switch runtime PM code to use scope-based forcewake for consistency with
    other parts of the driver.
    
    Signed-off-by: Raag Jadav 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20251128082212.294592-1-raag.jadav@intel.com
    Signed-off-by: Matt Roper 

commit 4c2768704710a5d4585941288e6a8159dd6dd33d
Author: Satyanarayana K V P 
Date:   Mon Dec 1 15:20:16 2025 +0530

    drm/xe/vf: Add debugfs entries to test VF double migration
    
    VF migration sends a marker to the GUC before resource fixups begin,
    and repeats the marker with the RESFIX_DONE notification. This prevents
    the GUC from submitting jobs during double migration events.
    
    To reliably test double migration, a second migration must be triggered
    while fixups from the first migration are still in progress. Since fixups
    complete quickly, reproducing this scenario is difficult. Introduce
    debugfs controls to add delays in the post-fixup phase, creating a
    deterministic window for subsequent migrations.
    
    New debugfs entries:
            /sys/kernel/debug/dri/BDF/
            ├── tile0
            │   ├─gt0
            │   │ ├──vf
            │   │ │  ├── resfix_stoppers
    
    resfix_stoppers: Predefined checkpoints that allow the migration process
    to pause at specific stages. The stages are given below.
    
    VF_MIGRATION_WAIT_RESFIX_START          - BIT(0)
    VF_MIGRATION_WAIT_FIXUPS                - BIT(1)
    VF_MIGRATION_WAIT_RESTART_JOBS          - BIT(2)
    VF_MIGRATION_WAIT_RESFIX_DONE           - BIT(3)
    
    Each state will pause with a 1-second delay per iteration, continuing until
    its corresponding bit is cleared.
    
    Signed-off-by: Satyanarayana K V P 
    Cc: Michal Wajdeczko 
    Cc: Matthew Brost 
    Cc: Tomasz Lis 
    Acked-by: Adam Miszczak 
    Reviewed-by: Michal Wajdeczko 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251201095011.21453-10-satyanarayana.k.v.p@intel.com

commit 75e7d26281da46bc8570c61f44fe6093f120963a
Author: Satyanarayana K V P 
Date:   Mon Dec 1 15:20:15 2025 +0530

    drm/xe/vf: Requeue recovery on GuC MIGRATION error during VF post-migration
    
    Handle GuC response `XE_GUC_RESPONSE_VF_MIGRATED` as a special case in the
    VF post-migration recovery flow. When this error occurs, it indicates that
    a new migration was detected while the resource fixup process was still in
    progress. Instead of failing immediately, requeue the VF into the recovery
    path to allow proper handling of the new migration event.
    
    This improves robustness of VF recovery in SR-IOV environments where
    migrations can overlap with resource fixup steps.
    
    Signed-off-by: Satyanarayana K V P 
    Cc: Michal Wajdeczko 
    Cc: Matthew Brost 
    Cc: Tomasz Lis 
    Reviewed-by: Michal Wajdeczko 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251201095011.21453-9-satyanarayana.k.v.p@intel.com

commit b5fbb94341a2b1d78b24713db454dcda2fc7194b
Author: Satyanarayana K V P 
Date:   Mon Dec 1 15:20:14 2025 +0530

    drm/xe/vf: Introduce RESFIX start marker support
    
    In scenarios involving double migration, the VF KMD may encounter
    situations where it is instructed to re-migrate before having the
    opportunity to send RESFIX_DONE for the initial migration. This can occur
    when the fix-up for the prior migration is still underway, but the VF KMD
    is migrated again.
    
    Consequently, this may lead to the possibility of sending two migration
    notifications (i.e., pending fix-up for the first migration and a second
    notification for the new migration). Upon receiving the first RES_FIX
    notification, the GuC will resume VF submission on the GPU, potentially
    resulting in undefined behavior, such as system hangs or crashes.
    
    To avoid this, post migration, a marker is sent to the GUC prior to the
    start of resource fixups to indicate start of resource fixups. The same
    marker is sent along with RESFIX_DONE notification so that GUC can avoid
    submitting jobs to HW in case of double migration.
    
    Signed-off-by: Satyanarayana K V P 
    Cc: Michal Wajdeczko 
    Cc: Matthew Brost 
    Cc: Tomasz Lis 
    Reviewed-by: Michal Wajdeczko 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251201095011.21453-8-satyanarayana.k.v.p@intel.com

commit 2e2dab20dd664ea1ca6ed2342f6dc509496c9290
Author: Satyanarayana K V P 
Date:   Mon Dec 1 15:20:13 2025 +0530

    drm/xe/vf: Enable VF migration only on supported GuC versions
    
    Enable VF migration starting with GuC 70.54.0 (compatibility version
    1.27.0) which supports additional VF2GUC_RESFIX_START message required
    to handle migration recovery in a more robust way.
    
    Signed-off-by: Satyanarayana K V P 
    Cc: Michal Wajdeczko 
    Cc: Matthew Brost 
    Cc: Tomasz Lis 
    Reviewed-by: Michal Wajdeczko 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251201095011.21453-7-satyanarayana.k.v.p@intel.com

commit ee30fde96bbae259fb8a744ee747b2ec733e9fc4
Author: Jani Nikula 
Date:   Mon Dec 1 19:27:30 2025 +0200

    drm/{i915, xe}/display: make pxp key check part of bo interface
    
    Add intel_bo_key_check() next to intel_bo_is_protected() where it feels
    like it belongs, and drop the extra pxp compat header.
    
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251201172730.2154668-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 439be5c580e553c8777d5533db5892e773f81d40
Author: Philipp Stanner 
Date:   Fri Nov 7 14:57:01 2025 +0100

    drm/todo: Add entry for unlocked drm/sched rq readers
    
    Runqueues are currently almost everywhere being read unlocked in
    drm/sched. At XDC 2025, the assembled developers were unsure whether
    that's legal and whether it can be fixed. Someone should find out.
    
    Add a todo entry for the unlocked runqueue reader problem.
    
    Acked-by: Dave Airlie 
    Signed-off-by: Philipp Stanner 
    Link: https://patch.msgid.link/20251107135701.244659-4-phasta@kernel.org

commit 9d56cbaf12037e8ce7ead9f8f8f9000e4784f2eb
Author: Philipp Stanner 
Date:   Fri Nov 7 14:57:00 2025 +0100

    drm/todo: Add section with task for GPU scheduler
    
    The GPU scheduler has a great many problems and deserves its own TODO
    section.
    
    Add a section and a first task describing the problem of
    drm_sched_resubmit_jobs() being deprecated without a successor.
    
    Acked-by: Dave Airlie 
    Signed-off-by: Philipp Stanner 
    Link: https://patch.msgid.link/20251107135701.244659-3-phasta@kernel.org

commit 156fd724e18dd099267b4ceab485a995b8ba54bb
Author: Jani Nikula 
Date:   Mon Dec 1 19:10:50 2025 +0200

    drm/xe/compat: remove unused i915_active.h and i915_active_types.h
    
    Commit 965930962a41 ("drm/i915/frontbuffer: Fix intel_frontbuffer
    lifetime handling") dropped the last xe display users of the
    headers. They're still used in intel_overlay.c, but it's not built as
    part of xe.
    
    Reviewed-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251201171050.2145833-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 7068d42048dab5eb71a0d65388f64f1e0ca5b9ee
Author: Thomas Zimmermann 
Date:   Tue Nov 25 13:52:17 2025 +0100

    fbcon: Remove fb_debug_enter/_leave from struct fb_ops
    
    There are no implementations of fb_debug_enter and fb_debug_leave.
    Remove the callbacks from struct fb_ops and clean up the caller.
    
    The field save_graphics in fbcon_par is also no longer required.
    Remove it as well.
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Simona Vetter 
    Acked-by: Daniel Thompson (RISCstar) 
    Link: https://patch.msgid.link/20251125130634.1080966-6-tzimmermann@suse.de

commit 6ea3aacc8e89298702812a1556eb1e378a80e02b
Author: Thomas Zimmermann 
Date:   Tue Nov 25 13:52:16 2025 +0100

    drm/fbdev-helper: Remove drm_fb_helper_debug_enter/_leave()
    
    Remove the debug_enter/debug_leave helpers, as there are no DRM
    drivers supporting debugging with kgdb. Remove code to keep track
    of existing fbdev-emulation state. None of this required any longer.
    
    Also remove mode_set_base_atomic from struct drm_crtc_helper_funcs,
    which has no callers or implementations.
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Simona Vetter 
    Acked-by: Daniel Thompson (RISCstar) 
    Link: https://patch.msgid.link/20251125130634.1080966-5-tzimmermann@suse.de

commit a22461eddaf6a0f82ca2d02de2e180dcc16b3937
Author: Thomas Zimmermann 
Date:   Tue Nov 25 13:52:15 2025 +0100

    drm/radeon: Do not implement mode_set_base_atomic callback
    
    Remove the implementation of the CRTC helper mode_set_base_atomic
    from radeon. It pretends to provide mode setting for kdb debugging,
    but has been broken for some time.
    
    Kdb output has been supported only for non-atomic mode setting since
    commit 9c79e0b1d096 ("drm/fb-helper: Give up on kgdb for atomic drivers")
    from 2017.
    
    While radeon provides non-atomic mode setting, kdb assumes that the GEM
    buffer object is at a fixed location in video memory. This assumption
    currently blocks radeon from converting to generic fbdev emulation.
    Fbdev-ttm helpers use a shadow buffer with a movable GEM buffer object.
    Triggering kdb does therefore not update the display.
    
    Another problem is that the current implementation does not handle
    USB keyboard input. Therefore a serial terminal is required. Then when
    continuing from the debugger, radeon fails with an error:
    
    [7]kdb> go
    [   40.345523][    C7] BUG: scheduling while atomic: bash/1580/0x00110003
    [...]
    [   40.345613][    C7]  schedule+0x27/0xd0
    [   40.345615][    C7]  schedule_timeout+0x7b/0x100
    [   40.345617][    C7]  ? __pfx_process_timeout+0x10/0x10
    [   40.345619][    C7]  msleep+0x31/0x50
    [   40.345621][    C7]  radeon_crtc_load_lut+0x2e4/0xcb0 [radeon 31c1ee785de120fcfd0babcc09babb3770252b4e]
    [   40.345698][    C7]  radeon_crtc_gamma_set+0xe/0x20 [radeon 31c1ee785de120fcfd0babcc09babb3770252b4e]
    [   40.345760][    C7]  drm_fb_helper_debug_leave+0xd8/0x130
    [   40.345763][    C7]  kgdboc_post_exp_handler+0x54/0x70
    [...]
    
    and the system hangs.
    
    Support for kdb feels pretty much broken. Hence remove the whole kdb
    support from radeon.
    
    Signed-off-by: Thomas Zimmermann 
    Acked-by: Christian König 
    Acked-by: Simona Vetter 
    Acked-by: Daniel Thompson (RISCstar) 
    Link: https://patch.msgid.link/20251125130634.1080966-4-tzimmermann@suse.de

commit 046a10f4d74fd3e022d9b793c5e910dd9df0b1c0
Author: Thomas Zimmermann 
Date:   Tue Nov 25 13:52:14 2025 +0100

    drm/nouveau: Do not implement mode_set_base_atomic callback
    
    Remove the implementation of the CRTC helper mode_set_base_atomic
    from nouveau. It pretends to provide mode setting for kdb debugging,
    but has been broken for some time.
    
    Kdb output has been supported only for non-atomic mode setting since
    commit 9c79e0b1d096 ("drm/fb-helper: Give up on kgdb for atomic drivers")
    from 2017.
    
    While nouveau provides non-atomic mode setting for some devices, kdb
    assumes that the GEM buffer object is at a fixed location in video
    memory. This has not been the case since
    commit 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers")
    from 2022. Fbdev-ttm helpers use a shadow buffer with a movable GEM
    buffer object. Triggering kdb does therefore not update the display.
    
    Hence remove the whole kdb support from nouveau.
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Lyude Paul 
    Acked-by: Simona Vetter 
    Acked-by: Daniel Thompson (RISCstar) 
    Link: https://patch.msgid.link/20251125130634.1080966-3-tzimmermann@suse.de

commit f80e89446a460184a5f76c70522be70351a85a11
Author: Thomas Zimmermann 
Date:   Tue Nov 25 13:52:13 2025 +0100

    drm/amdgpu: Do not implement mode_set_base_atomic callback
    
    Remove all implementations of the CRTC helper mode_set_base_atomic
    from amdgpu. It pretends to provide mode setting for kdb debugging,
    but has been broken for some time.
    
    Kdb output has been supported only for non-atomic mode setting since
    commit 9c79e0b1d096 ("drm/fb-helper: Give up on kgdb for atomic drivers")
    from 2017.
    
    While amdgpu provides non-atomic mode setting for some devices, kdb
    assumes that the GEM buffer object is at a fixed location in video
    memory. This has not been the case since commit 087451f372bf ("drm/amdgpu:
    use generic fb helpers instead of setting up AMD own's.") from 2021.
    Fbdev-ttm helpers use a shadow buffer with a movable GEM buffer object.
    Triggering kdb does not update the display.
    
    Hence remove the whole kdb support from amdgpu.
    
    Signed-off-by: Thomas Zimmermann 
    Acked-by: Christian König 
    Acked-by: Simona Vetter 
    Acked-by: Daniel Thompson (RISCstar) 
    Link: https://patch.msgid.link/20251125130634.1080966-2-tzimmermann@suse.de

commit aa8225d4ee87d35eca89877981d8038ea2c0f402
Author: Lucas De Marchi 
Date:   Wed Nov 26 14:43:58 2025 -0800

    MAINTAINERS: Remove myself from xe maintainers
    
    As I'm leaving Intel soon, drop myself from the list of Xe maintainers.
    Also update the mailmap to switch to my kernel.org address.
    
    Acked-by: Jani Nikula 
    Acked-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251126224357.2482051-2-lucas.demarchi@intel.com
    Signed-off-by: Lucas De Marchi 

commit 1026c1a73a9686ff35ac100039f94f0725622447
Author: Matthew Brost 
Date:   Wed Nov 26 10:59:52 2025 -0800

    drm/xe: Implement DRM_XE_EXEC_QUEUE_SET_HANG_REPLAY_STATE
    
    Implement DRM_XE_EXEC_QUEUE_SET_HANG_REPLAY_STATE which sets the exec
    queue default state to user data passed in. The intent is for a Mesa
    tool to use this replay GPU hangs.
    
    v2:
     - Enable the flag DRM_XE_EXEC_QUEUE_SET_HANG_REPLAY_STATE
     - Fix the page size math calculation to avoid a crash
    v4:
     - Use vmemdup_user (Maarten)
     - Copy default state first into LRC, then replay state (Testing, Carlos)
    
    Cc: José Roberto de Souza 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Maarten Lankhorst 
    Reviewed-by: Jonathan Cavitt 
    Link: https://patch.msgid.link/20251126185952.546277-10-matthew.brost@intel.com

commit 7032361d8cb13ab48b2b79167967c3a29c075ce2
Author: Matthew Brost 
Date:   Wed Nov 26 10:59:51 2025 -0800

    drm/xe: Add replay_offset and replay_length lines to LRC HWCTX snapshot
    
    Add replay_offset and replay_length lines to LRC HWCTX snapshot with the
    idea being this information can be used extract the data which needs to
    be pass to exec queue extension DRM_XE_EXEC_QUEUE_SET_HANG_REPLAY_STATE
    so GPU hang can be replayed via a Mesa tool.
    
    The additional lines look like:
    
    [HWCTX].replay_offset: 0x%x
    [HWCTX].replay_length: 0x%x
    
    Cc: José Roberto de Souza 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Jonathan Cavitt 
    Link: https://patch.msgid.link/20251126185952.546277-9-matthew.brost@intel.com

commit b80961a86b40372b7cfb3065439377f7e7550e59
Author: Matthew Brost 
Date:   Wed Nov 26 10:59:50 2025 -0800

    drm/xe/uapi: Add DRM_XE_EXEC_QUEUE_SET_HANG_REPLAY_STATE
    
    Add DRM_XE_EXEC_QUEUE_SET_HANG_REPLAY_STATE which accepts a user pointer
    to populate the exec queue state so that a GPU hang can be replayed via
    a Mesa tool.
    
    v2: Update the value for HANG_REPLAY_STATE flag
    
    Cc: José Roberto de Souza 
    Signed-off-by: Matthew Brost 
    Signed-off-by: Carlos Santa 
    Reviewed-by: Jonathan Cavitt 
    Acked-by: José Roberto de Souza 
    Acked-by: Rodrigo Vivi 
    Link: https://patch.msgid.link/20251126185952.546277-8-matthew.brost@intel.com

commit c87f586e55364d8ca8dae38d5d00f8dd267ca8bc
Author: Matthew Brost 
Date:   Wed Nov 26 10:59:49 2025 -0800

    drm/xe: Add VM.uapi_flags to VM snapshot capture
    
    Add VM.uapi_flags to VM snapshot capture VM snapshot capture. This is
    useful information for debug and will help build a robust GPU hang
    replay tool.
    
    The current format is:
    
    VM.uapi_flags: 0x%x
    
    Cc: José Roberto de Souza 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Jonathan Cavitt 
    Link: https://patch.msgid.link/20251126185952.546277-7-matthew.brost@intel.com

commit 066a1ddd8559fa494bf5137a1ef00c8761fcacf8
Author: Matthew Brost 
Date:   Wed Nov 26 10:59:48 2025 -0800

    drm/xe: Add cpu_caching to properties line in VM snapshot capture
    
    Add CPU caching to properties line in VM snapshot capture indicating
    the BO caching properites. This is useful information for debug and
    will help build a robust GPU hang replay tool.
    
    The current format is:
    
    []: ||mem_region=0x%x|pat_index=%d|cpu_caching=%d
    
    Permissions has two options, either "read_only" or "read_write".
    
    Type has three options, either "userptr", "null_sparse", or "bo".
    
    Memory region is a bit mask of where the memory is located.
    
    Pat index corresponds to the value setup upon VM bind.
    
    CPU caching corresponds to the value of BO setup upon creation.
    
    v2:
     - Save off cpu_caching value rather than looking at BO (Carlos)
    v4:
     - Fix NULL ptr dereference (Carlos)
    
    Cc: José Roberto de Souza 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Jonathan Cavitt 
    Link: https://patch.msgid.link/20251126185952.546277-6-matthew.brost@intel.com

commit 6cf5d14a0bf730d6e45c407b7e3bedb1a5d8812f
Author: Matthew Brost 
Date:   Wed Nov 26 10:59:47 2025 -0800

    drm/xe: Add pat_index to properties line in VM snapshot capture
    
    Add pat index to properties line in VM snapshot capture indicating
    the VMA caching properites. This is useful information for debug and
    will help build a robust GPU hang replay tool.
    
    The current format is:
    
    []: ||mem_region=0x%x|pat_index=%d
    
    Permissions has two options, either "read_only" or "read_write".
    
    Type has three options, either "userptr", "null_sparse", or "bo".
    
    Memory region is a bit mask of where the memory is located.
    
    Pat index corresponds to the value setup upon VM bind.
    
    Cc: José Roberto de Souza 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Jonathan Cavitt 
    Link: https://patch.msgid.link/20251126185952.546277-5-matthew.brost@intel.com

commit 81e66a55a8d7c57c664520074c770484054f43b2
Author: Matthew Brost 
Date:   Wed Nov 26 10:59:46 2025 -0800

    drm/xe: Add mem_region to properties line in VM snapshot capture
    
    Add memory region to properties line in VM snapshot capture indicating
    where the memory is located. The memory region corresponds to regions in
    the uAPI. This is useful information for debug and will help build a
    robust GPU hang replay tool.
    
    The current format is:
    
    []: ||mem_region=0x%x
    
    Permissions has two options, either "read_only" or "read_write".
    
    Type has three options, either "userptr", "null_sparse", or "bo".
    
    Memory region is a bit mask of where the memory is located.
    
    Cc: José Roberto de Souza 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Jonathan Cavitt 
    Link: https://patch.msgid.link/20251126185952.546277-4-matthew.brost@intel.com

commit 819c9ffd425971e0e913e5ee690f3485a28c1e0b
Author: Matthew Brost 
Date:   Wed Nov 26 10:59:45 2025 -0800

    drm/xe: Add "null_sparse" type to VM snap properties
    
    Add "null_sparse" type to VM snap properties indicating the VMA reads
    zero and writes are droppped. This is useful information for debug and
    will help build a robust GPU hang replay tool.
    
    The current format is:
    
    []: |
    
    Permissions has two options, either "read_only" or "read_write".
    
    Type has three options, either "userptr", "null_sparse", or "bo".
    
    Cc: José Roberto de Souza 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Jonathan Cavitt 
    Link: https://patch.msgid.link/20251126185952.546277-3-matthew.brost@intel.com

commit eafc150549ec312afd8dda86eb3e53de735049ba
Author: Matthew Brost 
Date:   Wed Nov 26 10:59:44 2025 -0800

    drm/xe: Add properties line to VM snapshot capture
    
    Add properties line to VM snapshot capture which includes additional
    information about VMA being dumped. This is helpful for debug purposes
    but also to build a robust GPU hang replay tool.
    
    The current format is:
    
    []: |
    
    Permissions has two options, either "read_only" or "read_write".
    
    Type has two options, either "userptr" or "bo".
    
    Cc: José Roberto de Souza 
    Signed-off-by: Matthew Brost 
    Reviewed-by: Jonathan Cavitt 
    Link: https://patch.msgid.link/20251126185952.546277-2-matthew.brost@intel.com

commit b1ea3babb67dcb8b0881c2ab49dfba88b1445856
Author: Langyan Ye 
Date:   Thu Nov 27 20:16:01 2025 +0800

    drm/panel-edp: Add CSW MNE007QB3-1
    
    Add support for the CSW MNE007QB3-1, pleace the EDID here for
    subsequent reference.
    
    00 ff ff ff ff ff ff 00 0e 77 7c 14 00 00 00 00
    00 23 01 04 a5 1e 13 78 07 ee 95 a3 54 4c 99 26
    0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
    01 01 01 01 01 01 35 3c 80 a0 70 b0 23 40 30 20
    36 00 2d bc 10 00 00 18 2b 30 80 a0 70 b0 23 40
    30 20 36 00 2d bc 10 00 00 18 00 00 00 fd 00 28
    3c 4a 4a 0f 01 0a 20 20 20 20 20 20 00 00 00 fc
    00 4d 4e 45 30 30 37 51 42 33 2d 31 0a 20 01 5b
    
    70 20 79 02 00 21 00 1d c8 0b 5d 07 80 07 b0 04
    00 3d 8a 54 cd a4 99 66 62 0f 02 45 54 40 5e 40
    5e 00 44 12 78 2e 00 06 00 44 40 5e 40 5e 81 00
    20 74 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c
    00 00 00 00 8d 00 e3 05 04 00 e6 06 01 00 60 60
    ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 90
    
    Signed-off-by: Langyan Ye 
    Signed-off-by: Douglas Anderson 
    Link: https://patch.msgid.link/20251127121601.1608379-1-yelangyan@huaqin.corp-partner.google.com

commit 8b5502145351bde87f522df082b9e41356898ba3
Author: Vinay Belgaumkar 
Date:   Fri Nov 28 21:25:48 2025 -0800

    drm/xe: Apply Wa_14020316580 in xe_gt_idle_enable_pg()
    
    Wa_14020316580 was getting clobbered by power gating init code
    later in the driver load sequence. Move the Wa so that
    it applies correctly.
    
    Fixes: 7cd05ef89c9d ("drm/xe/xe2hpm: Add initial set of workarounds")
    Suggested-by: Matt Roper 
    Signed-off-by: Vinay Belgaumkar 
    Reviewed-by: Riana Tauro 
    Reviewed-by: Matt Roper 
    Link: https://patch.msgid.link/20251129052548.70766-1-vinay.belgaumkar@intel.com
    Signed-off-by: Matt Roper 

commit 251be5fb4982ebb0f5a81b62d975bd770f3ad5c2
Author: Shuicheng Lin 
Date:   Fri Nov 14 20:56:39 2025 +0000

    drm/xe: Fix freq kobject leak on sysfs_create_files failure
    
    Ensure gt->freq is released when sysfs_create_files() fails
    in xe_gt_freq_init(). Without this, the kobject would leak.
    Add kobject_put() before returning the error.
    
    Fixes: fdc81c43f0c1 ("drm/xe: use devm_add_action_or_reset() helper")
    Signed-off-by: Shuicheng Lin 
    Reviewed-by: Alex Zuo 
    Reviewed-by: Xin Wang 
    Link: https://patch.msgid.link/20251114205638.2184529-2-shuicheng.lin@intel.com
    Signed-off-by: Matt Roper 

commit 9d94c1cf6ef938abd4b849b66f8eab11e3c537ef
Author: Balasubramani Vivekanandan 
Date:   Fri Nov 21 15:38:23 2025 +0530

    drm/xe/xe3_lpg: Apply Wa_16028005424
    
    Applied Wa_16028005424 to Graphics version from 30.00 to 30.05
    
    Reviewed-by: Matt Roper 
    Signed-off-by: Balasubramani Vivekanandan 
    Link: https://patch.msgid.link/20251121100822.20076-2-balasubramani.vivekanandan@intel.com
    Signed-off-by: Matt Roper 

commit 450f04569ffd21e3caef878f22676694bbeadee0
Author: Jani Nikula 
Date:   Tue Nov 25 15:24:43 2025 +0200

    drm/{i915,xe}/display: drop intel_wakeref.h usage
    
    Drop the display dependency on intel_wakeref.h header. The contract in
    the parent interface is that -ENOENT means there's no tracking. It
    doesn't actually require us to use a shared macro for it. Duplicate the
    macro in the few places that need this instead of inlining, primarily
    for documentation reasons.
    
    This allows us to remove the xe compat intel_wakeref.h header.
    
    v2: Define INTEL_WAKEREF_DEF in intel_display_power.h
    
    Reviewed-by: Luca Coelho 
    Link: https://patch.msgid.link/3599d0ec168d7ce7030582706acba66b616ab9f3.1764076995.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit e1c727e6288d50fc7b485c0a88112b0d8ec582e4
Author: Jani Nikula 
Date:   Tue Nov 25 15:24:42 2025 +0200

    drm/i915/power: convert intel_wakeref_t to struct ref_tracker *
    
    Under the hood, intel_wakeref_t is just struct ref_tracker *. Use the
    actual underlying type both for clarity (we *are* using intel_wakeref_t
    as a pointer though it doesn't look like one) and to help i915, xe and
    display coexistence without custom types.
    
    v2: Keep intel_wakeref.h includes as they are
    
    Reviewed-by: Luca Coelho 
    Link: https://patch.msgid.link/f182bd26d5f9a00e843246d4aac8b25ff7531c51.1764076995.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 118afbc58df50c13121994a06ce332864405f448
Author: Jani Nikula 
Date:   Tue Nov 25 15:24:41 2025 +0200

    drm/i915/power: drop wakeref parameter from with_intel_display_power*()
    
    Add another level of macro abstraction, and declare the wakeref within
    the for loop using __UNIQUE_ID. This allows us to drop a bunch of
    boilerplate declarations and parameter passing.
    
    Reviewed-by: Luca Coelho 
    Link: https://patch.msgid.link/d568d5a1a0dc0ad81697010a29fb4a3f552af827.1764076995.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit aa51f0309a0fc81d54e1dd0c1c8cc26bfb8babed
Author: Jani Nikula 
Date:   Tue Nov 25 15:24:40 2025 +0200

    drm/i915/pps: convert intel_wakeref_t to struct ref_tracker *
    
    Under the hood, intel_wakeref_t is just struct ref_tracker *. Use the
    actual underlying type both for clarity (we *are* using intel_wakeref_t
    as a pointer though it doesn't look like one) and to help i915, xe and
    display coexistence without custom types.
    
    Reviewed-by: Luca Coelho 
    Link: https://patch.msgid.link/e7afaea1a609485f91669a7d3c5d3fde0e0dbf8b.1764076995.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 9a8c267b878a7b163735c9371c2ccf103b685e34
Author: Jani Nikula 
Date:   Tue Nov 25 15:24:39 2025 +0200

    drm/i915/pps: drop wakeref parameter from with_intel_pps_lock()
    
    Add another level of macro abstraction, and declare the wakeref within
    the for loop using __UNIQUE_ID. This allows us to drop a bunch of
    boilerplate declarations and parameter passing.
    
    Reviewed-by: Luca Coelho 
    Link: https://patch.msgid.link/f45a77708108dc4b606d732c1b011aa08fab72b5.1764076995.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 4dfb97060f22c6c5bea995302f0f58936d8f3271
Author: Thomas Zimmermann 
Date:   Wed Nov 26 10:40:10 2025 +0100

    drm/ast: Wrap cursor framebuffer access in drm_gem_fb_begin/end_cpu_access()
    
    Call drm_gem_fb_begin_cpu_access() and drm_gem_fb_end_cpu_access()
    around cursor image updates. Imported buffers might have to be
    synchronized for CPU access before they can be used.
    
    Ignore errors from drm_gem_fb_begin_cpu_access(). These errors can
    often be transitory. The cursor image will be updated on the next
    frame. Meanwhile display a white square where the cursor would be.
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Jocelyn Falempe >
    Link: https://patch.msgid.link/20251126094626.41985-4-tzimmermann@suse.de

commit ef4ed8621a15ea4979dd6c5bde436ae228c4bdfe
Author: Thomas Zimmermann 
Date:   Wed Nov 26 10:40:09 2025 +0100

    drm/ast: Support cursor buffers objects in I/O memory
    
    Copy the ARGB4444 cursor buffer to system memory if it is located in
    I/O memory. While this cannot happen with ast's native GEM objects, an
    imported buffer object might be on the external device's I/O memory.
    
    If the cursor buffer is located in system memory continue to use it
    directly.
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Jocelyn Falempe >
    Link: https://patch.msgid.link/20251126094626.41985-3-tzimmermann@suse.de

commit 1e759ed22a62680c79aab266d73baaa2bee4de9f
Author: Thomas Zimmermann 
Date:   Wed Nov 26 10:40:08 2025 +0100

    drm/ast: Move cursor format conversion into helper function
    
    Move the format conversion of the cursor framebuffer into the new
    helper ast_cursor_plane_get_argb4444(). It returns a buffer in system
    memory, which the atomic_update handler copies to video memory.
    
    The returned buffer is either the GEM buffer itself, or a temporary
    copy within the plane in ARGB4444 format.
    
    As a small change, list supported formats explicitly in the switch
    statement. Do not assume ARGB8888 input by default. The cursor
    framebuffer knows its format, so should we.
    
    Signed-off-by: Thomas Zimmermann 
    Reviewed-by: Jocelyn Falempe 
    Link: https://patch.msgid.link/20251126094626.41985-2-tzimmermann@suse.de

commit 2e38c50ae4929f0b954fee69d428db7121452867
Author: Michał Winiarski 
Date:   Thu Nov 27 10:39:34 2025 +0100

    vfio/xe: Add device specific vfio_pci driver variant for Intel graphics
    
    In addition to generic VFIO PCI functionality, the driver implements
    VFIO migration uAPI, allowing userspace to enable migration for Intel
    Graphics SR-IOV Virtual Functions.
    The driver binds to VF device and uses API exposed by Xe driver to
    transfer the VF migration data under the control of PF device.
    
    Acked-by: Rodrigo Vivi 
    Reviewed-by: Kevin Tian 
    Reviewed-by: Alex Williamson 
    Link: https://patch.msgid.link/20251127093934.1462188-5-michal.winiarski@intel.com
    Signed-off-by: Michał Winiarski 

commit 17f22465c5a5573724c942ca7147b4024631ef87
Author: Michał Winiarski 
Date:   Thu Nov 27 10:39:33 2025 +0100

    drm/xe/pf: Export helpers for VFIO
    
    Device specific VFIO driver variant for Xe will implement VF migration.
    Export everything that's needed for migration ops.
    
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251127093934.1462188-4-michal.winiarski@intel.com
    Signed-off-by: Michał Winiarski 

commit 8b3cce3ad9c78ce3dae1c178f99352d50e12a3c0
Author: Michał Winiarski 
Date:   Thu Nov 27 10:39:32 2025 +0100

    drm/xe/pci: Introduce a helper to allow VF access to PF xe_device
    
    In certain scenarios (such as VF migration), VF driver needs to interact
    with PF driver.
    Add a helper to allow VF driver access to PF xe_device.
    
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251127093934.1462188-3-michal.winiarski@intel.com
    Signed-off-by: Michał Winiarski 

commit 01c724aa7bf84e9d081a56e0cbf1d282678ce144
Author: Michał Winiarski 
Date:   Thu Nov 27 10:39:31 2025 +0100

    drm/xe/pf: Enable SR-IOV VF migration
    
    All of the necessary building blocks are now in place to support SR-IOV
    VF migration.
    Flip the enable/disable logic to match VF code and disable the feature
    only for platforms that don't meet the necessary prerequisites.
    To allow more testing and experiments, on DEBUG builds any missing
    prerequisites will be ignored.
    
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251127093934.1462188-2-michal.winiarski@intel.com
    Signed-off-by: Michał Winiarski 

commit 357797f272c70f9b796636d2e795056f9e2e2b4f
Author: Michał Grzelak 
Date:   Mon Nov 17 09:20:46 2025 +0100

    i915/display/intel_ddi: Reduce severity of failed FEC enabling
    
    During some IGT tests (e.g. xe_pm@s2idle-exec-after, xe_pm@s2idle-mocs)
    sink disconnects across suspend/resume, reconnecting later during resume
    at some point. Hence during resume, where the driver is restoring the
    pre-suspend mode, all the AUX transfers to the sink are expected to
    fail.
    
    Switch error message to KMS debug message of failed FEC enabling.
    
    Signed-off-by: Michał Grzelak 
    Reviewed-by: Imre Deak 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251117082046.4190705-1-michal.grzelak@intel.com

commit e85e9ccf3f8404007f62dff9a02273fcdeb44206
Author: Tvrtko Ursulin 
Date:   Thu Nov 27 09:03:49 2025 +0000

    drm/panic: Report invalid or unsupported panic modes
    
    Currently the user can write anything into the drm.panic_screen modparam,
    either at runtime via sysfs, or as a kernel boot time argument. Invalid
    strings will be silently accepted and ignored at use time by defaulting to
    the 'user' panic mode.
    
    Let instead add some validation in order to have immediate feedback when
    something has been mistyped, or not compiled in.
    
    For example during kernel boot:
    
     Booting kernel: `bsod' invalid for parameter `drm.panic_screen'
    
    Or at runtime:
    
     # echo -n bsod > /sys/module/drm/parameters/panic_screen
     -bash: echo: write error: Invalid argument
    
    Change of behavior is that when invalid mode is attempted to be
    configured, currently the code will default to the 'user' mode, while with
    this change the code will ignore it, and default to the mode set at kernel
    build time via CONFIG_DRM_PANIC_SCREEN.
    
    While at it lets also fix the module parameter description to include all
    compiled in modes.
    
    Signed-off-by: Tvrtko Ursulin 
    Cc: Jocelyn Falempe 
    Cc: Javier Martinez Canillas 
    Reviewed-by: Javier Martinez Canillas 
    Reviewed-by: Jocelyn Falempe 
    Signed-off-by: Tvrtko Ursulin 
    Link: https://lore.kernel.org/r/20251127090349.92717-1-tvrtko.ursulin@igalia.com

commit 36c5dff41fd958c9e32d931eb90b5ae638a7e600
Author: Boris Brezillon 
Date:   Fri Nov 28 10:48:39 2025 +0100

    drm/panthor: Kill panthor_sched_immediate_tick()
    
    It's only used in a couple places and everyone else is just using
    sched_queue_delayed_work(sched, tick, 0) directly, so let's make
    this consistent.
    
    v2:
    - Add R-b
    
    v3:
    - Collect R-b
    
    Reviewed-by: Steven Price 
    Reviewed-by: Chia-I Wu 
    Link: https://patch.msgid.link/20251128094839.3856402-9-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 99820b4b7e50d9651f01d2d55b6b9ba92dcc5b99
Author: Boris Brezillon 
Date:   Fri Nov 28 10:48:38 2025 +0100

    drm/panthor: Make sure we resume the tick when new jobs are submitted
    
    If the group is already assigned a slot but was idle before this job
    submission, we need to make sure the priority rotation happens in the
    future. Extract the existing logic living in group_schedule_locked()
    and call this new sched_resume_tick() helper from the "group is
    assigned a slot" path.
    
    v2:
    - Add R-b
    
    v3:
    - Re-use queue_mask to clear the bit
    - Collect R-b
    
    Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
    Reviewed-by: Steven Price 
    Reviewed-by: Chia-I Wu 
    Link: https://patch.msgid.link/20251128094839.3856402-8-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 61d9a43d70dc3e1709ecd14a34f6d5f01e21dfc9
Author: Boris Brezillon 
Date:   Fri Nov 28 10:48:37 2025 +0100

    drm/panthor: Fix the logic that decides when to stop ticking
    
    When we have multiple active groups with the same priority, we need to
    keep ticking for the priority rotation to take place. If we don't do
    that, we might starve slots with lower priorities.
    
    It's annoying to deal with that in tick_ctx_update_resched_target(),
    so let's add a ::stop_tick field to the tick context which is
    initialized to true, and downgraded to false as soon as we detect
    something that requires to tick to happen. This way we can complement
    the current logic with extra conditions if needed.
    
    v2:
    - Add R-b
    
    v3:
    - Drop panthor_sched_tick_ctx::min_priority (no longer relevant)
    - Collect R-b
    
    Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
    Reviewed-by: Steven Price 
    Reviewed-by: Chia-I Wu 
    Link: https://patch.msgid.link/20251128094839.3856402-7-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 4356d21994f4ff5c87305b874939b359f16f6677
Author: Boris Brezillon 
Date:   Fri Nov 28 10:48:36 2025 +0100

    drm/panthor: Fix immediate ticking on a disabled tick
    
    We have a few paths where we schedule the tick work immediately without
    changing the resched_target. If the tick was stopped, this would lead
    to a remaining_jiffies that's always > 0, and it wouldn't force a full
    tick in that case. Add extra checks to cover that case properly.
    
    v2:
    - Fix typo
    - Simplify the code as suggested by Steve
    
    v3:
    - Collect R-b
    
    Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
    Reviewed-by: Steven Price 
    Reviewed-by: Chia-I Wu 
    Link: https://patch.msgid.link/20251128094839.3856402-6-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 55429c51d5db3db24c2ad561944c6a0ca922d476
Author: Boris Brezillon 
Date:   Fri Nov 28 10:48:35 2025 +0100

    drm/panthor: Fix the group priority rotation logic
    
    When rotating group priorities, we want the group with the
    highest priority to go back to the end of the queue, and all
    other active groups to get their priority bumped, otherwise
    some groups will never get a chance to run with the highest
    priority. This implies moving the rotation itself to
    tick_work(), and only dealing with old group ordering in
    tick_ctx_insert_old_group().
    
    v2:
    - Add R-b
    - Fix the commit message
    
    v3:
    - Drop the full_tick argument in tick_ctx_init()
    - Collect R-b
    
    Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
    Reviewed-by: Steven Price 
    Reviewed-by: Chia-I Wu 
    Link: https://patch.msgid.link/20251128094839.3856402-5-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit a3c2d0b40b108bd45d44f6c1dfa33c39d577adcd
Author: Boris Brezillon 
Date:   Fri Nov 28 10:48:34 2025 +0100

    drm/panthor: Fix the full_tick check
    
    We have a full tick when the remaining time to the next tick is zero,
    not the other way around. Declare a full_tick variable so we don't get
    that test wrong in other places.
    
    v2:
    - Add R-b
    
    v3:
    - Collect R-b
    
    Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
    Reviewed-by: Steven Price 
    Reviewed-by: Chia-I Wu 
    Link: https://patch.msgid.link/20251128094839.3856402-4-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 5232e84927197d5cb045ddea9c90fc143b64bf65
Author: Boris Brezillon 
Date:   Fri Nov 28 10:48:33 2025 +0100

    drm/panthor: Don't try to enable extract events
    
    Not only this only works once, because of how extract events work
    (event is enabled if the req and ack bit differ, and it's signalled
    by the FW by setting identical req and ack, to re-enable the event,
    we need to toggle the bit, which we never do). But more importantly,
    we never do anything with this event, so we're better off dropping it
    when programming the CS slot.
    
    v2:
    - Add R-b
    
    v3:
    - Collect R-b
    
    Reviewed-by: Steven Price 
    Reviewed-by: Chia-I Wu 
    Link: https://patch.msgid.link/20251128094839.3856402-3-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 851f58d02f0d6c9c5fa8aee32fe349aaa9796758
Author: Boris Brezillon 
Date:   Fri Nov 28 10:48:32 2025 +0100

    drm/panthor: Simplify group idleness tracking
    
    csg_slot_sync_queues_state_locked() queries the queues state which can
    then be used to determine if a group is idle or not. Let's base our
    idleness detection logic solely on the {idle,blocked}_queues masks to
    avoid inconsistencies between the group state and the state of its
    subqueues.
    
    v2:
    - Add R-b
    
    v3:
    - Collect R-b
    
    Reviewed-by: Steven Price 
    Reviewed-by: Chia-I Wu 
    Link: https://patch.msgid.link/20251128094839.3856402-2-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 2af6766f38d85af9aae9cfa009839cdb6ad80f14
Author: Jani Nikula 
Date:   Wed Nov 26 13:11:23 2025 +0200

    drm/xe/dsb: drop the unnecessary struct i915_vma
    
    Now that struct intel_dsb_buffer is opaque, it can be made unique to
    both drivers, and we can drop the unnecessary struct i915_vma part. Only
    the struct xe_bo part is needed.
    
    Reviewed-by: Animesh Manna 
    Link: https://patch.msgid.link/f0bba09d2f185fe3e7f3b803036f036d845a8cc4.1764155417.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 7e1113e1de492ac1fed7bce105b08187ba9934b9
Author: Jani Nikula 
Date:   Wed Nov 26 13:11:22 2025 +0200

    drm/{i915,xe}/dsb: make struct intel_dsb_buffer opaque
    
    Move the definitions of struct intel_dsb_buffer to the driver specific
    files, hiding the implementation details from the shared DSB code.
    
    Reviewed-by: Animesh Manna 
    Link: https://patch.msgid.link/08a8a7745042afcffa647f82ae23ebbeda0234c9.1764155417.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 685d529fe1e9f8ebc116027d35de7bf95e830308
Author: Jani Nikula 
Date:   Wed Nov 26 13:11:21 2025 +0200

    drm/{i915, xe}/dsb: allocate struct intel_dsb_buffer dynamically
    
    Prepare for hiding the struct intel_dsb_buffer implementation details
    from the generic DSB code.
    
    Reviewed-by: Animesh Manna 
    Link: https://patch.msgid.link/af94dc06c55a866efa9105ae0a8d244e4c6b17ab.1764155417.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit b6153b02220c4419b5e27ede0861e40f19fc7e7f
Author: Jani Nikula 
Date:   Wed Nov 26 13:11:20 2025 +0200

    drm/{i915, xe}/dsb: make {intel, xe}_dsb_buffer.c independent of display
    
    The DSB buffer implementation is really independent of display. Pass
    struct drm_device instead of struct intel_crtc to
    intel_dsb_buffer_create(), and drop the intel_display_types.h include.
    
    Reviewed-by: Animesh Manna 
    Link: https://patch.msgid.link/a8cee08e8c36c2cf84cb9cda1b9f318db76710af.1764155417.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit ddf2cb3c9e655dd9b7bb5172249f6c01fc251549
Author: Boris Brezillon 
Date:   Fri Nov 28 09:48:40 2025 +0100

    drm/panthor: Relax a check in panthor_sched_pre_reset()
    
    Groups are only moved out of the runnable lists when
    panthor_group_stop() is called or when they run out of jobs.
    What should not happen though is having one group added to one of
    the runnable list after reset.in_progress has been set to true, but
    that's not something we can easily check, so let's just drop the
    WARN_ON() in panthor_sched_pre_reset().
    
    v2:
    - Adjust explanation in commit message
    
    v3:
    - Collect R-b
    
    v4:
    - No changes
    
    Reviewed-by: Liviu Dudau 
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251128084841.3804658-7-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 19e8bc9456055e594d0f1c9677ea8a3a9983ec3e
Author: Boris Brezillon 
Date:   Fri Nov 28 09:48:39 2025 +0100

    drm/panthor: Make panthor_vm_[un]map_pages() more robust
    
    There's no reason for panthor_vm_[un]map_pages() to fail unless the
    drm_gpuvm state and the page table are out of sync, so let's reflect that
    by making panthor_vm_unmap_pages() a void function and adding
    WARN_ON()s in various places. We also try to recover from those
    unexpected mismatch by checking for already unmapped ranges and skipping
    them. But there's only so much we can do to try and cope with such
    SW bugs, so when we see a mismatch, we flag the VM unusable and disable
    the AS to avoid further GPU accesses to the memory.
    
    It could be that the as_disable() call fails because the MMU unit is
    stuck, in which case the whole GPU is frozen, and only a GPU reset can
    unblock things. Ater the reset, the VM will be seen as unusable and
    any attempt to re-use it will fail, so we should be covered for any
    use-after-unmap issues.
    
    v2:
    - Fix double unlock
    
    v3:
    - Collect R-b
    
    v4:
    - No changes
    
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251128084841.3804658-6-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 6e2d3b3e858942de4dbffffe3a617e80b1262f74
Author: Boris Brezillon 
Date:   Fri Nov 28 09:48:38 2025 +0100

    drm/panthor: Add support for atomic page table updates
    
    Move the lock/flush_mem operations around the gpuvm_sm_[un]map() calls
    so we can implement true atomic page updates, where any access in the
    locked range done by the GPU has to wait for the page table updates
    to land before proceeding.
    
    This is needed for vkQueueBindSparse(), so we can replace the dummy
    page mapped over the entire object by actual BO backed pages in an atomic
    way. But it's also useful to avoid "AS_ACTIVE bit stuck" failures in
    the sm_[un]map() path, leading to gpuvm state inconsistencies.
    
    v2:
    - Adjust to match the two new preliminary patches
    
    v3:
    - Collect R-b
    
    v4:
    - No changes
    
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251128084841.3804658-5-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 3c0a60195b37af83bbbaf223cd3a78945bace49e
Author: Boris Brezillon 
Date:   Fri Nov 28 09:48:37 2025 +0100

    drm/panthor: Recover from panthor_gpu_flush_caches() failures
    
    We have seen a few cases where the whole memory subsystem is blocked
    and flush operations never complete. When that happens, we want to:
    
    - schedule a reset, so we can recover from this situation
    - in the reset path, we need to reset the pending_reqs so we can send
      new commands after the reset
    - if more panthor_gpu_flush_caches() operations are queued after
      the timeout, we skip them and return -EIO directly to avoid needless
      waits (the memory block won't miraculously work again)
    
    Note that we drop the WARN_ON()s because these hangs can be triggered
    with buggy GPU jobs created by the UMD, and there's no way we can
    prevent it. We do keep the error messages though.
    
    v2:
    - New patch
    
    v3:
    - Collect R-b
    - Explicitly mention the fact we dropped the WARN_ON()s in the commit
      message
    
    v4:
    - No changes
    
    Fixes: 5cd894e258c4 ("drm/panthor: Add the GPU logical block")
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251128084841.3804658-4-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 151df689fb75e46a6cafa9a2c407d44969f4bebe
Author: Boris Brezillon 
Date:   Fri Nov 28 09:48:36 2025 +0100

    drm/panthor: Kill lock_region()
    
    The meat in lock_region() is about packing a region range into a
    single u64. The rest is just a regular reg write plus a
    as_send_cmd_and_wait() call that can easily be inlined in
    mmu_hw_do_operation_locked().
    
    v2:
    - New patch
    
    v3:
    - Don't LOCK is the region has a zero size
    
    v4:
    - Collect R-b
    
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251128084841.3804658-3-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit d2c6fde56d451ca48a5e03428535ce3dbc8fc910
Author: Boris Brezillon 
Date:   Fri Nov 28 09:48:35 2025 +0100

    drm/panthor: Always wait after sending a command to an AS
    
    There's currently no situation where we want to issue a command to an
    AS and not wait for this command to complete. The wait is either
    explicitly done (LOCK, UNLOCK) or it's missing (UPDATE). So let's
    turn write_cmd() into as_send_cmd_and_wait() that has the wait after
    a command is sent.
    
    v2:
    - New patch
    
    v3:
    - Collect R-b
    
    v4:
    - No changes
    
    Reviewed-by: Steven Price 
    Link: https://patch.msgid.link/20251128084841.3804658-2-boris.brezillon@collabora.com
    Signed-off-by: Boris Brezillon 

commit 29fdc6e98d3c3657c8b4874ab3bfc75f9df59bf4
Author: Jani Nikula 
Date:   Tue Nov 25 19:17:44 2025 +0200

    drm/{i915,xe}/hdcp: use parent interface for HDCP GSC calls
    
    The HDCP GSC implementation is different for both i915 and xe. Add it to
    the display parent interface, and call the hooks via the parent
    interface.
    
    Reviewed-by: Suraj Kandpal 
    Link: https://patch.msgid.link/e397073e91f8aa7518754b3b79f65c1936be91ad.1764090990.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 39a00914281eb33545777947cea5f7979d605115
Author: Jani Nikula 
Date:   Tue Nov 25 19:17:43 2025 +0200

    drm/i915/hdcp: move i915 specific HDCP GSC implementation to i915
    
    The HDCP GSC implementation is different for both i915 and xe. Move the
    i915 specific implementation from display to i915 core.
    
    Reviewed-by: Suraj Kandpal 
    Link: https://patch.msgid.link/d362b256934c6c739d9decda717df2dbc3752481.1764090990.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa
Author: Suraj Kandpal 
Date:   Wed Nov 19 15:16:50 2025 +0530

    drm/display/dp_mst: Add protection against 0 vcpi
    
    When releasing a timeslot there is a slight chance we may end up
    with the wrong payload mask due to overflow if the delayed_destroy_work
    ends up coming into play after a DP 2.1 monitor gets disconnected
    which causes vcpi to become 0 then we try to make the payload =
    ~BIT(vcpi - 1) which is a negative shift. VCPI id should never
    really be 0 hence skip changing the payload mask if VCPI is 0.
    
    Otherwise it leads to
    <7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc
    [drm_display_helper]] port ffff888126ce9000 (3)
    <4> [515.287267] -----------[ cut here ]-----------
    <3> [515.287268] UBSAN: shift-out-of-bounds in
    ../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36
    <3> [515.287271] shift exponent -1 is negative
    <4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G
    S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)
    <4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
    <4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P
    WIFI, BIOS 1645 03/15/2024
    <4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work
    [drm_display_helper]
    <4> [515.287303] Call Trace:
    <4> [515.287304] 
    <4> [515.287306] dump_stack_lvl+0xc1/0xf0
    <4> [515.287313] dump_stack+0x10/0x20
    <4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0
    <4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0
    <4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d
    [drm_display_helper]
    <4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]
    <4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0
    <4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60
    <4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe]
    <4> [515.287740] ? find_held_lock+0x31/0x90
    <4> [515.287747] ? lock_release+0xce/0x2a0
    <4> [515.287754] drm_atomic_check_only+0x6a2/0xb40
    <4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140
    <4> [515.287765] drm_atomic_commit+0x6e/0xf0
    <4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10
    <4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0
    <4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0
    <4> [515.287795] ? mutex_lock_nested+0x1b/0x30
    <4> [515.287801] drm_client_modeset_commit+0x26/0x50
    <4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110
    <4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140
    <4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0
    <4> [515.287819] drm_client_hotplug+0x6c/0xf0
    <4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0
    <4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30
    <4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410
    [drm_display_helper]
    <4> [515.287861] process_one_work+0x22b/0x6f0
    <4> [515.287874] worker_thread+0x1e8/0x3d0
    <4> [515.287879] ? __pfx_worker_thread+0x10/0x10
    <4> [515.287882] kthread+0x11c/0x250
    <4> [515.287886] ? __pfx_kthread+0x10/0x10
    <4> [515.287890] ret_from_fork+0x2d7/0x310
    <4> [515.287894] ? __pfx_kthread+0x10/0x10
    <4> [515.287897] ret_from_fork_asm+0x1a/0x30
    
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303
    Signed-off-by: Suraj Kandpal 
    Reviewed-by: Imre Deak 
    Reviewed-by: Lyude Paul 
    Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com

commit 40a9f77a28faa8a0803371903c15372026e2c050
Author: Ville Syrjälä 
Date:   Wed Nov 19 20:53:10 2025 +0200

    Revert "drm/i915/dp: change aux_ctl reg read to polling read"
    
    This reverts commit 5a9b0c7418448ed3766f61ba0a71d08f259c3181.
    
    The switch from AUX interrupts to pollign was very hand-wavy.
    Yes, there have been some situations in CI on a few platforms
    where the AUX hardware seemingly forgets to signal the timeout,
    but those have been happening after we switched to polling as
    well. So I don't think we have any conclusive evidence that
    polling actually helps here.
    
    Someone really should root cause the actual problem, and see
    if there is a proper workaround we could implemnt (eg. disabling
    clock gating/etc.). In the meantime just go back to using the
    interrupt for AUX completion.
    
    If the hardware fails to signal the timeout we will just hit
    the wait_event_timeout() software timeout instead. I suppose
    we could try to tune the software timeout to more closely
    match the expected hardware timeout. Might need to use
    wait_event_hrtimeout() or something to avoid jiffies
    granularity issues...
    
    The AUX polling is also a hinderance towards using poll_timeout_us()
    because we have a very long timeout, but would need a fairly short
    polling interval to keep AUX transfer reasonably fast. Someone would
    need to come up with good numbers in a somewhat scientific way.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251119185310.10428-3-ville.syrjala@linux.intel.com
    Acked-by: Jani Nikula 

commit 1513904c46b61e483e4d61519c31078581bb6cb8
Author: Ville Syrjälä 
Date:   Wed Nov 19 20:53:09 2025 +0200

    drm/i915: Enable DDI A/B AUX interrupts on LNL+
    
    Apparently the DDI A/B AUX interrupts move onto the PICA side
    on LNL. Unmask them properly so that we actually get the
    interrupts. The interrupt handler was already trying to handle
    them despite the interrupts remaining masked.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251119185310.10428-2-ville.syrjala@linux.intel.com
    Reviewed-by: Jani Nikula 

commit 0646d0dd6665afa1e2c4fa7ba296a7ff880ab232
Author: Ville Syrjälä 
Date:   Thu Nov 13 01:30:30 2025 +0200

    drm/i915: Eliminate one more frequent drm_format_info()
    
    Another (somewhat expensive) drm_format_info() call has
    appeared in intel_plane_can_async_flip(). That one may get
    called several times per commit so we need to get rid of
    it.
    
    Fortunately most callers already have the framebuffer at
    hand, so we can just grab the format info from there.
    The one exception is intel_plane_format_mod_supported_async()
    where we have to do the lookup. But that only gets called
    (a bunch of times) during driver init to build the
    IN_FORMATS_ASYNC blob, and afterwards there is no runtime
    cost.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251112233030.24117-4-ville.syrjala@linux.intel.com
    Reviewed-by: Jouni Högander 

commit 8afc0198a4bd6988bd3f575be00dfdb628f0be5f
Author: Ville Syrjälä 
Date:   Thu Nov 13 01:30:29 2025 +0200

    drm/i915: Expose the IN_FORMATS_ASYNC blob for all planes
    
    Since old kernel versions wouldn't expose the IN_FORMATS_ASYNC blob,
    userspace can't really use the absence of the blob to determine
    that async flips aren't supported. Thus it seems better to always
    expose the blob on all planes, whether they support async flips
    or not. The blob will simply not indicate any format+modifier
    combinations as supported on planes that aren't async flip capable.
    
    Currently we expose the blob for all skl+ universal planes (even
    though we implement async flips only for the first plane on each
    pipe), and i9xx primary planes (for ilk+ we have async flips support,
    for pre-ilk we do not). Complete the full set by also expsosing
    the blob on pre-skl sprite planes, and cursors.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251112233030.24117-3-ville.syrjala@linux.intel.com
    Reviewed-by: Jouni Högander 

commit ebf08b1c52faab9f0638b0fa02d0031e311fb435
Author: Ville Syrjälä 
Date:   Wed Nov 19 20:16:06 2025 +0200

    drm/i915/panic: Clean up the variables
    
    Use the standard variable names for things, and get rid of any
    annoying aliasing variables. And sprinkle the consts in while at
    it.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251119181606.17129-7-ville.syrjala@linux.intel.com
    Reviewed-by: Jani Nikula 

commit 6b515868bc93a679de1d6037319580541bda2238
Author: Ville Syrjälä 
Date:   Wed Nov 19 20:16:05 2025 +0200

    drm/i915/panic: Get the crtc from the correct place
    
    Use hw.crtc as opposed to uapi.crtc in the panic code. I suspect
    this stuff doesn't handle joiner correctly in other ways either
    but can't be bothered to dig deeper.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251119181606.17129-6-ville.syrjala@linux.intel.com
    Reviewed-by: Jani Nikula 

commit e48b99d863166c5131f6d6c0ed81107392bc421f
Author: Ville Syrjälä 
Date:   Wed Nov 19 20:16:04 2025 +0200

    drm/i915: Use hw.active instead of uapi.active in the initial plane readout
    
    We're interested in the actual hardware state rather than the uapi
    state, so grab the crtc active flag from the correct spot.
    
    In practice the two will be identical here becase
    .get_initial_plane_config() will reject the initial FB when
    joiner is active.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251119181606.17129-5-ville.syrjala@linux.intel.com
    Reviewed-by: Jani Nikula 

commit 28bf111ffee103e143038949e781a5c209070348
Author: Ville Syrjälä 
Date:   Wed Nov 19 20:16:03 2025 +0200

    drm/i915/psr: Use hw.rotation instead of uapi.rotation
    
    Presumably we're tryign to check if the hw plane is actually
    rotated or not, so grab that information from the correct
    plane (hw.rotation).
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251119181606.17129-4-ville.syrjala@linux.intel.com
    Reviewed-by: Jani Nikula 

commit f227ba9cc2a854b703dd127a575f6287a2f0d99b
Author: Ville Syrjälä 
Date:   Wed Nov 19 20:16:02 2025 +0200

    drm/i915/psr: Use hw.crtc instead of uapi.crtc
    
    uapi.crtc is not set for joiner secondary pipes, so generally
    should not be used anywhere after the initial state copy. Switch
    to hw.crtc which actually indicates that the plane is enabled.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251119181606.17129-3-ville.syrjala@linux.intel.com
    Reviewed-by: Jani Nikula 

commit 0aee7d2e32e554ca0969063694568975817494a4
Author: Ville Syrjälä 
Date:   Wed Nov 19 20:16:01 2025 +0200

    drm/i915: Use the proper (hw.crtc) for the cursor unpin vblank worker
    
    uapi.crtc is NULL for joiner secondary pipes, so using that is
    nonsense in most places. Switch to hw.crtc so that we use the
    deferred cursor unpin also on joiner secondary pipes.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251119181606.17129-2-ville.syrjala@linux.intel.com
    Reviewed-by: Jani Nikula 

commit 43fb9e113bf11d78e7c817e2696705f458753c79
Author: Raag Jadav 
Date:   Thu Oct 30 17:53:57 2025 +0530

    drm/xe/gt: Introduce runtime suspend/resume
    
    If power state is retained between suspend/resume cycle, we don't need
    to perform full GT re-initialization. Introduce runtime helpers for GT
    which greatly reduce suspend/resume delay.
    
    v2: Drop redundant xe_gt_sanitize() and xe_guc_ct_stop() (Daniele)
        Use runtime naming for guc helpers (Daniele)
    v3: Drop redundant logging, add kernel doc (Michal)
        Use runtime naming for ct helpers (Michal)
    v4: Fix tags (Rodrigo)
    v5: Include host_l2_vram workaround (Daniele)
        Reuse xe_guc_submit_enable/disable() helpers (Daniele)
    
    Co-developed-by: Riana Tauro 
    Signed-off-by: Riana Tauro 
    Signed-off-by: Raag Jadav 
    Acked-by: Matthew Brost 
    Reviewed-by: Rodrigo Vivi 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251030122357.128825-5-raag.jadav@intel.com

commit e6d2fe31a76d4960b0005e8fcb5eb66d00ed2e14
Author: Raag Jadav 
Date:   Thu Oct 30 17:53:56 2025 +0530

    drm/xe/pm: Assert on runtime suspend if VFs are enabled
    
    We hold an additional reference to the runtime PM to keep PF in D0
    during VFs lifetime, as our VFs do not implement the PM capability.
    This means we should never be runtime suspending as long as VFs are
    enabled.
    
    v8: Add !IS_SRIOV_VF() assert (Matthew Brost)
    
    Suggested-by: Daniele Ceraolo Spurio 
    Signed-off-by: Raag Jadav 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251030122357.128825-4-raag.jadav@intel.com

commit 726ceb5716da7657a65e01270c494ecd4cb0b242
Author: Raag Jadav 
Date:   Thu Oct 30 17:53:55 2025 +0530

    drm/xe/guc_submit: Introduce pause/unpause() helpers for PF
    
    Introduce pause/unpause() helpers which stop/start further runs of
    submission tasks on given GuC and can be called from PF context. This
    is in preparation of usecases where we simply need to stop/start the
    scheduler without losing GuC state and don't require dealing with VF
    migration.
    
    v7: Reword commit message (Matthew Brost)
    
    Signed-off-by: Raag Jadav 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251030122357.128825-3-raag.jadav@intel.com

commit 99234edab8e1fd3fd2309193a3b3169970a7e770
Author: Raag Jadav 
Date:   Thu Oct 30 17:53:54 2025 +0530

    drm/xe/vf: Update pause/unpause() helpers with VF naming
    
    Now that pause/unpause() helpers have been updated for VF migration
    usecase, update their naming to match the functionality and while at it,
    add IS_SRIOV_VF() assert to make sure they are not abused.
    
    v7: Add IS_SRIOV_VF() assert (Matthew Brost)
        Use "vf" suffix (Michal)
    
    Suggested-by: Matthew Brost 
    Signed-off-by: Raag Jadav 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/20251030122357.128825-2-raag.jadav@intel.com

commit 8e2610d9a5edefb99b1a708796a8f733358e5898
Author: Piotr Piórkowski 
Date:   Thu Nov 27 08:36:43 2025 +0100

    drm/xe: Move VRAM MM debugfs creation to tile level
    
    Previously, VRAM TTM resource manager debugfs entries (vram0_mm / vram1_mm)
    were created globally in the XE debugfs root directory. But technically,
    each tile has an associated VRAM TTM manager, which it can own.
    Let's create VRAM memory manager debugfs entries directly under each tile's
    debugfs directory for better alignment with the per-tile memory layout.
    
    Signed-off-by: Piotr Piórkowski 
    Reviewed-by: Stuart Summers 
    Link: https://patch.msgid.link/20251127073643.144379-1-piotr.piorkowski@intel.com
    Signed-off-by: Michał Winiarski 

commit 8b8a6456ac253093a02dfe87590c446da7aa2c46
Author: Jonathan Cavitt 
Date:   Mon Nov 17 19:01:15 2025 +0000

    drm/xe/xe_sriov_packet: Return int from pf_descriptor_init
    
    pf_descriptor_init currently returns a size_t, which is an unsigned
    integer data type.  This conflicts with it returning a negative errno
    value on failure.
    
    Make it return an int instead.  This mirrors how pf_trailer_init is used
    later.
    
    Signed-off-by: Jonathan Cavitt 
    Cc: Michał Winiarski 
    Reviewed-by: Alex Zuo 
    Link: https://patch.msgid.link/20251117190114.69953-2-jonathan.cavitt@intel.com
    Signed-off-by: Michał Winiarski 

commit 6028f59620927aee2e15a424004012ae05c50684
Author: Matthew Brost 
Date:   Fri Nov 21 17:25:02 2025 -0800

    drm/xe: Covert return of -EBUSY to -ENOMEM in VM bind IOCTL
    
    xe_vma_userptr_pin_pages can return -EBUSY but -EBUSY has special
    meaning in VM bind IOCTLs that user fence is pending that is attached to
    the VMA. Convert -EBUSY to -ENOMEM in this case as -EBUSY in practice
    means we are low or out of memory.
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Tejas Upadhyay 
    Link: https://patch.msgid.link/20251122012502.382587-2-matthew.brost@intel.com

commit 9fb1f1256e419fcd0e5000ea8aaa71a65575a90b
Author: Matthew Brost 
Date:   Fri Nov 21 17:25:01 2025 -0800

    drm/gpusvm: Limit the number of retries in drm_gpusvm_get_pages
    
    drm_gpusvm_get_pages should not be allowed to retry forever, cap the
    time spent in the function to HMM_RANGE_DEFAULT_TIMEOUT has this is
    essentially a wrapper around hmm_range_fault.
    
    Signed-off-by: Matthew Brost 
    Reviewed-by: Himal Prasad Ghimiray 
    Link: https://patch.msgid.link/20251122012502.382587-1-matthew.brost@intel.com

commit dacda0cf75d5f4aa8da5404c21dc8ab4b7667799
Author: Zbigniew Kempczyński 
Date:   Tue Nov 25 16:37:33 2025 +0100

    drm/xe: Add caching pagetable flag
    
    Introduce device xe_caching_pt flag to selectively turn it on for
    supported platforms. It allows to eliminate version check and enable
    this feature for the future platforms.
    
    Signed-off-by: Zbigniew Kempczyński 
    Cc: Matthew Auld 
    Reviewed-by: Matthew Auld 
    Signed-off-by: Matthew Auld 
    Link: https://patch.msgid.link/20251125153732.400766-2-zbigniew.kempczynski@intel.com

commit 7f08cc5b3cc3bf6416f8b55bff906f67ed75637d
Author: Himal Prasad Ghimiray 
Date:   Tue Nov 25 13:26:28 2025 +0530

    drm/xe/vm: Skip ufence association for CPU address mirror VMA during MAP
    
    The MAP operation for a CPU address mirror VMA does not require ufence
    association because such mappings are not GPU-synchronized and do not
    participate in GPU job completion signaling.
    
    Remove the unnecessary ufence addition for this case to avoid -EBUSY
    failure in check_ufence of unbind ops.
    
    Cc: Matthew Brost 
    Cc: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251125075628.1182481-6-himal.prasad.ghimiray@intel.com
    Signed-off-by: Himal Prasad Ghimiray 

commit dd62fe512d5980e86cdd5b77385012f5659775f0
Author: Himal Prasad Ghimiray 
Date:   Tue Nov 25 13:26:27 2025 +0530

    drm/xe/svm: Enable UNMAP for VMA merging operations
    
    ALLOW UNMAP of VMAs associated with SVM mappings when the MAP operation
    is intended to merge adjacent CPU_ADDR_MIRROR VMAs.
    
    v2
    - Remove mapping exist check in garbage collector
    
    Cc: Matthew Brost 
    Cc: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251125075628.1182481-5-himal.prasad.ghimiray@intel.com
    Signed-off-by: Himal Prasad Ghimiray 

commit 0ae006dc48f3748fdee675052bc0e5e87b856ac2
Author: Himal Prasad Ghimiray 
Date:   Tue Nov 25 13:26:26 2025 +0530

    drm/xe/svm: Extend MAP range to reduce vma fragmentation
    
    When DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR is set during VM_BIND_OP_MAP,
    the mapping logic now checks adjacent cpu_addr_mirror VMAs with default
    attributes and expands the mapping range accordingly. This ensures that
    bo_unmap operations ideally target the same area and helps reduce
    fragmentation by coalescing nearby compatible VMAs into a single mapping.
    
    Cc: Matthew Brost 
    Cc: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251125075628.1182481-4-himal.prasad.ghimiray@intel.com
    Signed-off-by: Himal Prasad Ghimiray 

commit 4a938d3886d6dd29a54a2e6ebc03b6c2b7509ebf
Author: Himal Prasad Ghimiray 
Date:   Tue Nov 25 13:26:25 2025 +0530

    drm/xe: Merge adjacent default-attribute VMAs during garbage collection
    
    While restoring default memory attributes for VMAs during garbage
    collection, extend the target range by checking neighboring VMAs. If
    adjacent VMAs are CPU-address-mirrored and have default attributes,
    include them in the mergeable range to reduce fragmentation and improve
    VMA reuse.
    
    v2
    -Rebase
    
    Cc: Matthew Brost 
    Cc: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251125075628.1182481-3-himal.prasad.ghimiray@intel.com
    Signed-off-by: Himal Prasad Ghimiray 

commit 5b12958b1ffa7db44c276b2d394f3ddb9e0ebaca
Author: Himal Prasad Ghimiray 
Date:   Tue Nov 25 13:26:24 2025 +0530

    drm/xe: Add helper to extend CPU-mirrored VMA range for merge
    
    Introduce xe_vm_find_cpu_addr_mirror_vma_range(), which computes an
    extended range around a given range by including adjacent VMAs that are
    CPU-address-mirrored and have default memory attributes. This helper is
    useful for determining mergeable range without performing the actual merge.
    
    v2
    - Add assert
    - Move unmap check to this patch
    
    v3
    - Decrease offset to check by SZ_4K to avoid wrong vma return in fast
      lookup path
    
    v4
    - *start should be >= SZ_4K (Matt)
    
    Cc: Matthew Brost 
    Cc: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251125075628.1182481-2-himal.prasad.ghimiray@intel.com
    Signed-off-by: Himal Prasad Ghimiray 

commit 07cf4b864f523f01d2bb522a05813df30b076ba8
Author: Tomasz Lis 
Date:   Mon Nov 24 23:28:53 2025 +0100

    drm/xe: Protect against unset LRC when pausing submissions
    
    While pausing submissions, it is possible to encouner an exec queue
    which is during creation, and therefore doesn't have a valid xe_lrc
    struct reference.
    
    Protect agains such situation, by checking for NULL before access.
    
    Reviewed-by: Matthew Brost 
    Fixes: c25c1010df88 ("drm/xe/vf: Replay GuC submission state on pause / unpause")
    Signed-off-by: Tomasz Lis 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251124222853.1900800-1-tomasz.lis@intel.com

commit 00937fe1921ab346b6f6a4beaa5c38e14733caa3
Author: Matthew Brost 
Date:   Fri Nov 21 07:27:50 2025 -0800

    drm/xe/vf: Start re-emission from first unsignaled job during VF migration
    
    The LRC software ring tail is reset to the first unsignaled pending
    job's head.
    
    Fix the re-emission logic to begin submitting from the first unsignaled
    job detected, rather than scanning all pending jobs, which can cause
    imbalance.
    
    v2:
     - Include missing local changes
    v3:
     - s/skip_replay/restore_replay (Tomasz)
    
    Fixes: c25c1010df88 ("drm/xe/vf: Replay GuC submission state on pause / unpause")
    Signed-off-by: Matthew Brost 
    Reviewed-by: Tomasz Lis 
    Link: https://patch.msgid.link/20251121152750.240557-1-matthew.brost@intel.com

commit 2e02254ef5f0c07980b39fb4c334b0e612b8581e
Author: Lukasz Laguna 
Date:   Mon Nov 24 20:02:37 2025 +0100

    drm/xe/pf: Handle MERT catastrophic errors
    
    The MERT block triggers an interrupt when a catastrophic error occurs.
    Update the interrupt handler to read the MERT catastrophic error type
    and log appropriate debug message.
    
    Signed-off-by: Lukasz Laguna 
    Reviewed-by: Piotr Piórkowski 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251124190237.20503-5-lukasz.laguna@intel.com

commit 1fc30960150672b4c8f842ea00c75be766759bd8
Author: Lukasz Laguna 
Date:   Mon Nov 24 20:02:36 2025 +0100

    drm/xe/pf: Add TLB invalidation support for MERT
    
    Add support for triggering and handling MERT TLB invalidation. After
    LMTT updates, the MERT TLB invalidation is initiated to ensure memory
    translations remain coherent.
    
    Completion of the invalidation is signaled via MERT interrupt (bit 13 in
    the GFX master interrupt register). Detect and handle this interrupt to
    properly synchronize the invalidation flow.
    
    Signed-off-by: Lukasz Laguna 
    Reviewed-by: Piotr Piórkowski 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251124190237.20503-4-lukasz.laguna@intel.com

commit 0e72241a53e9188e88bb7b258266bccd615a4d60
Author: Lukasz Laguna 
Date:   Mon Nov 24 20:02:35 2025 +0100

    drm/xe/pf: Configure LMTT in MERT
    
    On platforms with standalone MERT, the PF driver needs to program LMTT
    in MERT's LMEM_CFG register.
    
    Signed-off-by: Lukasz Laguna 
    Reviewed-by: Piotr Piórkowski 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251124190237.20503-3-lukasz.laguna@intel.com

commit 79cb005c7134340d78e2fa8e526a6104fe492695
Author: Lukasz Laguna 
Date:   Mon Nov 24 20:02:34 2025 +0100

    drm/xe: Add device flag to indicate standalone MERT
    
    The MERT subsystem manages memory accesses between host and device. On
    the Crescent Island platform, it requires direct management by the
    driver.
    
    Introduce a device flag and corresponding helpers to identify platforms
    with standalone MERT, enabling proper initialization and handling.
    
    Signed-off-by: Lukasz Laguna 
    Reviewed-by: Ashutosh Dixit 
    Signed-off-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251124190237.20503-2-lukasz.laguna@intel.com

commit 0a9231590f16f596541154f43375f3e2c419a3ef
Author: Jani Nikula 
Date:   Fri Nov 21 13:22:00 2025 +0200

    drm/i915: use struct drm_device for clock gating funcs
    
    While we want to refactor intel_clock_gating.[ch] and likely move a lot
    of display related code to display, start off with a little intermediate
    change to use struct drm_device in the interface instead of struct
    drm_i915_private, to allow us to drop another dependency on i915_drv.h
    and struct drm_i915_private.
    
    Cc: Luca Coelho 
    Reviewed-by: Mika Kahola 
    Link: https://patch.msgid.link/20251121112200.3435099-2-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit ac16a7ec0445c60962badbe34f8f33d352ceac6f
Author: Jani Nikula 
Date:   Fri Nov 21 13:21:59 2025 +0200

    drm/i915/cdclk: drop i915_drv.h include
    
    intel_cdclk.c no longer needs i915_drv.h. Drop it.
    
    Reviewed-by: Mika Kahola 
    Link: https://patch.msgid.link/20251121112200.3435099-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 7c0b8360a4e2892bc1748aca77c0825af82f3dcd
Author: Lad Prabhakar 
Date:   Tue Oct 28 16:51:26 2025 +0000

    dt-bindings: clock: renesas,r9a09g077/87: Add XSPI0/1 IDs
    
    Add clock definitions for XSPI0/1 to both R9A09G077 and R9A09G087 SoCs.
    These definitions are required for describing XSPI devices in DT
    
    Signed-off-by: Lad Prabhakar 
    Acked-by: Conor Dooley 
    Reviewed-by: Geert Uytterhoeven 
    Link: https://patch.msgid.link/20251028165127.991351-5-prabhakar.mahadev-lad.rj@bp.renesas.com
    Signed-off-by: Geert Uytterhoeven 

commit 69ef30d6c903c4b9cd75c50367acb1cd1f95d440
Author: Zhanjun Dong 
Date:   Mon Oct 27 17:42:12 2025 -0400

    drm/xe/uc: Change assertion to error on huc authentication failure
    
    The fault injection test can cause the xe_huc_auth function to fail.
    This is an intentional failure, so in this scenario we don't want to
    throw an assert and taint the kernel, because that will impact CI
    execution.
    
    Signed-off-by: Zhanjun Dong 
    Reviewed-by: Daniele Ceraolo Spurio 
    Signed-off-by: Daniele Ceraolo Spurio 
    Link: https://patch.msgid.link/20251027214212.2856903-1-zhanjun.dong@intel.com

commit f4c8298cf5f5c2458f700546456601f3ca9b282b
Author: Zhanjun Dong 
Date:   Wed Nov 5 18:31:43 2025 -0500

    drm/xe/guc: Cleanup GuC log buffer macros and helpers
    
    Cleanup GuC log buffer macros and helpers, add Xe style macro prefix.
    Update buffer type values to align with the GuC specification
    Update buffer offset calculation.
    Remove helper functions, replaced with macros.
    
    Signed-off-by: Zhanjun Dong 
    Reviewed-by: Michal Wajdeczko 
    Signed-off-by: Daniele Ceraolo Spurio 
    Link: https://patch.msgid.link/20251105233143.1168759-1-zhanjun.dong@intel.com

commit 5a062505aa0ed5f9124c22f07da6ba58950475b2
Author: Michal Wajdeczko 
Date:   Sat Nov 15 16:26:58 2025 +0100

    drm/xe/pf: Fix .bulk_profile/sched_priority description
    
    The .bulk_profile/sched_priority file is always write-only, unlike
    the profile/sched_priority files which can be either read-write or
    read-only (in case of PF or VFs respectively).
    
    Fixes: 6b514ed2d9a7 ("drm/xe/pf: Add documentation for sriov_admin attributes")
    Signed-off-by: Michal Wajdeczko 
    Reviewed-by: Piotr Piórkowski 
    Link: https://patch.msgid.link/20251115152659.10853-1-michal.wajdeczko@intel.com

commit 0f4435a1f46efc3177eb082cd3f73e29da5ab86a
Author: Michal Wajdeczko 
Date:   Sat Nov 15 16:13:22 2025 +0100

    drm/xe/pf: Use div_u64 when calculating GGTT profile
    
    This will fix the following error seen on some 32-bit config:
    
    "ERROR: modpost: "__udivdi3" [drivers/gpu/drm/xe/xe.ko] undefined!"
    
    Reported-by: kernel test robot 
    Closes: https://lore.kernel.org/oe-kbuild-all/202511150929.3vUi6PEJ-lkp@intel.com/
    Fixes: e448372e8a8e ("drm/xe/pf: Use migration-friendly GGTT auto-provisioning")
    Signed-off-by: Michal Wajdeczko 
    Reviewed-by: Piotr Piórkowski 
    Link: https://patch.msgid.link/20251115151323.10828-1-michal.wajdeczko@intel.com

commit 96b93ac214f9dd66294d975d86c5dee256faef91
Author: Harish Chegondi 
Date:   Mon Nov 17 11:48:43 2025 -0800

    drm/xe: Fix conversion from clock ticks to milliseconds
    
    When tick counts are large and multiplication by MSEC_PER_SEC is larger
    than 64 bits, the conversion from clock ticks to milliseconds can go bad.
    
    Use mul_u64_u32_div() instead.
    
    Cc: Ashutosh Dixit 
    Signed-off-by: Harish Chegondi 
    Suggested-by: Umesh Nerlige Ramappa 
    Fixes: 49cc215aad7f ("drm/xe: Add xe_gt_clock_interval_to_ms helper")
    Reviewed-by: Ashutosh Dixit 
    Signed-off-by: Ashutosh Dixit 
    Link: https://patch.msgid.link/1562f1b62d5be3fbaee100f09107f3cc49e40dd1.1763408584.git.harish.chegondi@intel.com

commit f32df9e94d9565b4ce3067cf107afd687fca0851
Author: Imre Deak 
Date:   Thu Nov 20 19:23:58 2025 +0200

    drm/i915/cx0: Read out power-down state of both PHY lanes for reversed lanes
    
    For a port used with lane reversal enabled the first two TX lanes will
    be enabled in PHY lane#1 instead of PHY lane#0. At the moment the HW
    readout will read out the power-down state for these two TX lanes from
    PHY lane#0 incorrectly. The display HW lane reversal feature (vs. the
    similar TCSS lane swap) is only used for TypeC legacy mode and for
    non-TypeC PHYs. Since in both of these cases the display owns both PHY
    lanes, both of these PHY lanes' state can be read out. Do that to fix
    cases when lane reversal is used with 1 or 2 active TX lanes.
    
    While at it add an assert to the PLL enable function about the above
    assumption on when lane reversal can be used.
    
    Cc: Mika Kahola 
    Cc: Suraj Kandpal 
    Fixes: 230d4c748113 ("drm/i915/cx0: Track the Cx0 PHY enabled lane count in the PLL state")
    Reviewed-by: Suraj Kandpal 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251120172358.1282765-5-imre.deak@intel.com

commit dc5b3ef88ba7cc9f2748b75b6b127b2b400315cc
Author: Imre Deak 
Date:   Thu Nov 20 19:23:57 2025 +0200

    drm/i915/cx0: Read out power-down state of both TXs in PHY lane 0
    
    If the number of used lanes is 1 or 2 then the power-down state of both
    TX lanes in PHY lane 0 should be read out. If 1 lane is used only 1 TX
    lane will be checked, make sure both TXs are checked in this case.
    
    Cc: Mika Kahola 
    Cc: Suraj Kandpal 
    Fixes: 230d4c748113 ("drm/i915/cx0: Track the Cx0 PHY enabled lane count in the PLL state")
    Reviewed-by: Suraj Kandpal 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251120172358.1282765-4-imre.deak@intel.com

commit 07ba4ecfd111cb56464faf6ada9937b4e18fac23
Author: Imre Deak 
Date:   Thu Nov 20 19:23:56 2025 +0200

    drm/i915/cx0: Use intel_port_to_tc() instead of open coding it
    
    Use intel_port_to_tc() in mtl_port_to_pll_id(), instead of open coding
    the same.
    
    v2: s/USe/Use in commit message.
    
    Cc: Suraj Kandpal 
    Cc: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251120172358.1282765-3-imre.deak@intel.com

commit 8aa2945f049d7cfc7b3c9195a7341e8eb0d9c961
Author: Imre Deak 
Date:   Thu Nov 20 19:23:55 2025 +0200

    drm/i915/tc: Add separate intel_tc_phy_port_to_tc() for TC DDI/PHY ports
    
    intel_port_to_tc() returns the PORT_TC1..6 -> TC_PORT_1..6 mapping only
    for DDI ports that are connected to a TypeC PHY. In some cases this
    mapping is also required for TypeC DDI ports which are not connected to
    a TypeC PHY. Such DDI ports are the PORT_TC1..4 ports on RKL/ADLS/BMG.
    
    Add a separate intel_tc_phy_to_tc() helper to return the mapping for
    ports connected to a TypeC PHY, and make all the current users - which
    expect this semantic - call this helper. A follow-up change will need to
    get the same mapping for TypeC DDI ports not connected to a TypeC PHY,
    leave intel_port_to_tc() exported for that.
    
    Cc: Suraj Kandpal 
    Cc: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251120172358.1282765-2-imre.deak@intel.com

commit 370f45b1cea859484691128ec205abc7e9402fb7
Author: Imre Deak 
Date:   Thu Nov 20 19:23:54 2025 +0200

    drm/i915/cx0: Fix port to PLL ID mapping on BMG
    
    The intel_port_to_tc() call in mtl_port_to_pll_id() assumed that all
    TypeC DDI ports are connected to a TypeC PHY. This is not true on BMG
    where all the ports - including the PORT_TC1..4 TypeC DDI ports - are
    connected to a non-TypeC PHY. For these ports intel_port_to_tc()
    returns TC_PORT_NONE, which results in an incorrect port -> PLL ID
    mapping. Fix this up by using the expected PORT_TC1..4 port ->
    TC_PORT_1..4 tc_port mapping on BMG as well.
    
    Fixes: ca1eda5cd476c ("drm/i915/cx0: Add MTL+ .get_dplls hook")
    Cc: Suraj Kandpal 
    Reviewed-by: Mika Kahola 
    Signed-off-by: Imre Deak 
    Link: https://patch.msgid.link/20251120172358.1282765-1-imre.deak@intel.com

commit ea944d57eac746f9bd9056134751708c48084207
Author: Lucas De Marchi 
Date:   Wed Nov 19 07:21:57 2025 -0800

    drm/xe/guc_ct: Cleanup ifdef'ry
    
    Better split CONFIG_DRM_XE_DEBUG and CONFIG_DRM_XE_DEBUG_GUC optional
    parts from the main code, creating smaller ct_dead_* and fast_req_*
    interfaces.
    
    Reviewed-by: Daniele Ceraolo Spurio 
    Link: https://patch.msgid.link/20251119152157.1675188-2-lucas.demarchi@intel.com
    Signed-off-by: Lucas De Marchi 

commit 64fdf496a6929a0a194387d2bb5efaf5da2b542f
Author: Lucas De Marchi 
Date:   Tue Nov 18 11:08:11 2025 -0800

    drm/xe/guc: Fix stack_depot usage
    
    Add missing stack_depot_init() call when CONFIG_DRM_XE_DEBUG_GUC is
    enabled to fix the following call stack:
    
            [] BUG: kernel NULL pointer dereference, address: 0000000000000000
            [] Workqueue:  drm_sched_run_job_work [gpu_sched]
            [] RIP: 0010:stack_depot_save_flags+0x172/0x870
            [] Call Trace:
            []  
            []  fast_req_track+0x58/0xb0 [xe]
    
    Fixes: 16b7e65d299d ("drm/xe/guc: Track FAST_REQ H2Gs to report where errors came from")
    Tested-by: Sagar Ghuge 
    Cc: stable@vger.kernel.org # v6.17+
    Reviewed-by: Stuart Summers 
    Link: https://patch.msgid.link/20251118-fix-debug-guc-v1-1-9f780c6bedf8@intel.com
    Signed-off-by: Lucas De Marchi 

commit a5f0cc8e0cd4007370af6985cb152001310cf20c
Author: Ville Syrjälä 
Date:   Wed Nov 5 19:10:15 2025 +0200

    drm/i915/psr: Reject async flips when selective fetch is enabled
    
    The selective fetch code doesn't handle asycn flips correctly.
    There is a nonsense check for async flips in
    intel_psr2_sel_fetch_config_valid() but that only gets called
    for modesets/fastsets and thus does nothing for async flips.
    
    Currently intel_async_flip_check_hw() is very unhappy as the
    selective fetch code pulls in planes that are not even async
    flips capable.
    
    Reject async flips when selective fetch is enabled, until
    someone fixes this properly (ie. disable selective fetch while
    async flips are being issued).
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251105171015.22234-1-ville.syrjala@linux.intel.com
    Reviewed-by: Jouni Högander 

commit 2e4ad5b0667244f496783c58de0995b9562d3344
Author: Shuicheng Lin 
Date:   Mon Nov 10 18:45:23 2025 +0000

    drm/xe/guc: Fix resource leak in xe_guc_ct_init_noalloc()
    
    xe_guc_ct_init_noalloc() allocates the CT workqueue and other helpers
    before it tries to initialize ct->lock. If drmm_mutex_init() fails
    we currently bail out without releasing those resources because the
    guc_ct_fini() hasn’t been registered yet.
    
    Since destroy_workqueue() in guc_ct_fini() may flush the workqueue, which
    in turn can take the ct lock, the initialization sequence is restructured
    to first initialize the ct->lock, then set up all CT state, and finally
    register guc_ct_fini().
    
    v2: guc_ct_fini() does take ct lock. (Matt)
    v3: move primelockdep() together with drmm_mutex_init(). (Lucas)
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Cc: Lucas De Marchi 
    Cc: Matthew Brost 
    Signed-off-by: Shuicheng Lin 
    Reviewed-by: Lucas De Marchi 
    Link: https://patch.msgid.link/20251110184522.1581001-2-shuicheng.lin@intel.com
    Signed-off-by: Lucas De Marchi 

commit 62519b77aecad22b525eda482660ffa127e7ad80
Author: Mika Kuoppala 
Date:   Thu Nov 20 18:14:35 2025 +0200

    drm/xe: Fix memory leak when handling pagefault vma
    
    When the pagefault handling code was moved to a new file, an extra
    drm_exec_init() was added to the VMA path. This call is unnecessary because
    xe_validation_ctx_init() already performs a drm_exec_init(), resulting in a
    memory leak reported by kmemleak.
    
    Remove the redundant drm_exec_init() from the VMA pagefault handling code.
    
    Fixes: fb544b844508 ("drm/xe: Implement xe_pagefault_queue_work")
    Cc: Matthew Brost 
    Cc: Stuart Summers 
    Cc: Lucas De Marchi 
    Cc: "Thomas Hellström" 
    Cc: Rodrigo Vivi 
    Cc: Sumit Semwal 
    Cc: "Christian König" 
    Cc: intel-xe@lists.freedesktop.org
    Cc: linux-media@vger.kernel.org
    Cc: dri-devel@lists.freedesktop.org
    Cc: linaro-mm-sig@lists.linaro.org
    Signed-off-by: Mika Kuoppala 
    Reviewed-by: Thomas Hellström 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251120161435.3674556-1-mika.kuoppala@linux.intel.com

commit a8c02fddc9cf7d778a7a838660a679d6d68b0608
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:52 2025 +0200

    drm/xe/vga: use the same intel_gmch_vga_set_decode() as i915
    
    Drop the #ifdef I915, and use the same intel_gmch_vga_set_decode() for
    both i915 and xe.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/f4121e6c70bac6c26ef3cf51aaf72822f2cb2d54.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit aa4dc3eeff6d5c47ed08905e5cf7b9b77a646fea
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:51 2025 +0200

    drm/i915: merge soc/intel_gmch.[ch] to display/intel_vga.c
    
    The sole user of the remaining functions in intel_gmch.[ch] is in
    intel_vga.c. Move everything there.
    
    Since intel_gmch.c hasn't been part of xe, use a dummy function
    relocated from xe_display_misc.c, with #ifdef. This is purely to keep
    this change non-functional.
    
    This allows us to remove soc/intel_gmch.[ch] from i915, compat
    soc/intel_gmch.h from xe, and xe_display_misc.c from xe.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/b0f853ad7eae686738defa9e8f08a8848df8f226.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit fff15f68eb06af4a77e349d419717bc9a2f4b37b
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:50 2025 +0200

    drm/i915/gmch: convert intel_gmch.c to struct intel_display
    
    Convert intel_gmch.[ch] to struct intel_display. Remove the final
    dependency on struct drm_i915_private and i915_drv.h. This is in
    preparation of moving the code under display/.
    
    intel_gmch_vga_set_state() is only used internally, make it static while
    at it.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/a4b317656eef0781d4f53ae337083fb05ce602bc.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 3018e582da321c5f6d2f03847f9adb44e44cb0ee
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:49 2025 +0200

    drm/i915/gmch: switch to use pci_bus_{read,write}_config_word()
    
    Switch to use pci_bus_{read,write}_config_word(), and stop using
    i915->gmch.pdev reference for the bridge.
    
    Suggested-by: Ville Syrjälä 
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/5c432540e254108bf73dbdec347d69ad87682fc9.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit eef67acfffd8debdd8c7a3f08ee759cd6bf58fbe
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:48 2025 +0200

    drm/i915/gmch: split out i915_gmch.[ch] from soc
    
    Most of the soc/intel_gmch.[ch] code is i915 core specific. Split it out
    to i915_gmch.[ch].
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/f4f8cc931ef2a5958cebe3ca44d40aedad01626f.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 1807d61541d003eee90f7661d6b40245f6966e3a
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:47 2025 +0200

    drm/xe: remove remaining platform checks from compat i915_drv.h
    
    With xe no longer building anything from soc/, we can remove the compat
    platform checks from i915_drv.h, reducing the file to just the to_i915()
    pointer conversion helper.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/a9947337f81e04db342bae6af727e4f75f9818ae.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit b3d3c83e00c7846bfa6c4aa12f64321849dd3819
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:46 2025 +0200

    drm/i915: move intel_rom.[ch] from soc/ to display/
    
    The sole user of intel_rom.[ch] has always been in display. Move them
    under display.
    
    This allows us to remove the compat soc/intel_rom.h from xe, as well as
    the Makefile rules to build anything from soc/.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/352ec255a6e9b81c7d1e35d8fbf7018d4049d4d3.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit de4ca6f8e9277fed49192454b7940681977ab1e5
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:45 2025 +0200

    drm/i915: move dram_info to struct intel_display
    
    With all of dram code under display, also move dram_info to struct
    intel_display.
    
    This further cleans up struct xe_device from display related members.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/cbbca93003952ea24ae60e66d79d901dba78ccd8.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit b8660fa66207ff36efcc0f1747845e423c7ad987
Author: Jani Nikula 
Date:   Thu Nov 20 18:18:46 2025 +0200

    drm/i915/dram: convert to struct intel_display
    
    Convert everything except uncore access to struct
    intel_display. Converting the graphics version checks to display version
    checks needs a tweak for display version 13, which have graphics version
    12.
    
    While at it, convert logging to drm_dbg_kms().
    
    v2: Handle display version 13
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251120161846.3128999-1-jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 1178b860605891dc728404dadff4dd6adeadb444
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:43 2025 +0200

    drm/xe: remove MISSING_CASE() from compat i915_utils.h
    
    There are no longer users for MISSING_CASE() in the compat
    i915_utils.h. Remove it to prevent new users from showing up.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/b967e605ff9d9ad459f3d12a9dfc9244458d83a1.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit ed46f724b725e7692cee18f26901c6dbde33dff1
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:42 2025 +0200

    drm/i915: move intel_dram.[ch] from soc/ to display/
    
    The remaining users of intel_dram.[ch] are all in display. Move them
    under display.
    
    This allows us to remove the compat soc/intel_dram.h from xe.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/4c0fbdab989a70d287536a7eafb002dc836ced12.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 2d74a09360a920d87a4e9538797068a0f9e5e2e1
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:41 2025 +0200

    drm/i915: split out i915_freq.[ch]
    
    The i915 core only needs three rather specific functions from
    soc/intel_dram.[ch]: i9xx_fsb_freq(), ilk_fsb_freq(), and
    ilk_mem_freq(). Add new i915_freq.[ch] and duplicate those functions for
    i915 to reduce the dependency on soc/ code.
    
    Wile duplication in general is bad, here it's a tradeoff to simplify the
    i915, xe and display interactions.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/7bac1b194afdc20cd45e625a0a32fcbcd0b1136e.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit e2b1c3a127665fbca7099c886e4f755785ea1118
Author: Jani Nikula 
Date:   Wed Nov 19 20:52:40 2025 +0200

    drm/i915/edram: extract i915_edram.[ch] for edram detection
    
    While edram detection ostensibly belongs with the rest of the dram stuff
    in soc/intel_dram.c, it's only required by i915 core, not
    display. Extract it to a separate i915_edram.[ch] file.
    
    This allows us to drop the edram_size_mb member from struct xe_device.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/612edb7b70755655fbf193ba8af1c539fb93b698.1763578288.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31
Author: Sanjay Yadav 
Date:   Tue Nov 18 17:19:00 2025 +0530

    drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
    
    In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping
    metrics_lock. Since this lock protects the lifetime of oa_config, an
    attacker could guess the id and call xe_oa_remove_config_ioctl() with
    perfect timing, freeing oa_config before we dereference it, leading to
    a potential use-after-free.
    
    Fix this by caching the id in a local variable while holding the lock.
    
    v2: (Matt A)
    - Dropped mutex_unlock(&oa->metrics_lock) ordering change from
      xe_oa_remove_config_ioctl()
    
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6614
    Fixes: cdf02fe1a94a7 ("drm/xe/oa/uapi: Add/remove OA config perf ops")
    Cc:  # v6.11+
    Suggested-by: Matthew Auld 
    Signed-off-by: Sanjay Yadav 
    Reviewed-by: Matthew Auld 
    Signed-off-by: Matthew Auld 
    Link: https://patch.msgid.link/20251118114859.3379952-2-sanjay.kumar.yadav@intel.com

commit 423fb66fac7dbb5ee2b26c40e0d21c0ffb0d7533
Author: Matt Roper 
Date:   Tue Nov 18 08:44:06 2025 -0800

    drm/xe/debugfs: Use scope-based runtime PM
    
    Switch the debugfs code to use scope-based runtime PM where possible,
    for consistency with other parts of the driver.
    
    v2:
     - Drop unnecessary 'ret' variables.  (Gustavo)
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-56-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit f50c11ba35da84450b3206b50618ecb6482968dc
Author: Matt Roper 
Date:   Tue Nov 18 08:44:05 2025 -0800

    drm/xe/sysfs: Use scope-based runtime power management
    
    Switch sysfs to use scope-based runtime power management to slightly
    simplify the code.
    
    v2:
     - Drop unnecessary local variables.  (Gustavo)
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-55-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 3a344ddce25eb8b7cf63de8b5c54de10e5bb764f
Author: Matt Roper 
Date:   Tue Nov 18 08:44:04 2025 -0800

    drm/xe/tests: Use scope-based runtime PM
    
    Use scope-based handling of runtime PM in the kunit tests for
    consistency with other parts of the driver.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-54-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit fcee6854e6fb9ddff0597296728a4f7fd67bccc9
Author: Matt Roper 
Date:   Tue Nov 18 08:44:03 2025 -0800

    drm/xe/sriov: Use scope-based runtime PM
    
    Use scope-based runtime power management in the SRIOV code for
    consistency with other parts of the driver.
    
    v2:
     - Drop unnecessary 'ret' variables.  (Gustavo)
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-53-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 008f3fcf31b7a7a6b13b774b76871679805c2661
Author: Matt Roper 
Date:   Tue Nov 18 08:44:02 2025 -0800

    drm/xe/hwmon: Use scope-based runtime PM
    
    Use scope-based runtime power management in the hwmon code for
    consistency with other parts of the driver.
    
    v2:
     - Drop unnecessary 'ret' variables.  (Gustavo)
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-52-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 8a579f4b2476fd1df07e2bca9fedc82a39a56a65
Author: Matt Roper 
Date:   Tue Nov 18 08:44:01 2025 -0800

    drm/xe/ggtt: Use scope-based runtime pm
    
    Switch the GGTT code to scope-based runtime PM for consistency with
    other parts of the driver.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-51-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit faa4b73bf75003ad89ed4d1afd3e9e59a48a63fd
Author: Matt Roper 
Date:   Tue Nov 18 08:44:00 2025 -0800

    drm/xe/bo: Use scope-based runtime PM
    
    Use scope-based runtime power management in the BO code for consistency
    with other parts of the driver.
    
    v2:
     - Drop unnecessary 'ret' variable.  (Gustavo)
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-50-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 60a4661d12ca58c794337d09d26f3f57e235cd2d
Author: Matt Roper 
Date:   Tue Nov 18 08:43:59 2025 -0800

    drm/xe/vram: Use scope-based forcewake
    
    Switch VRAM code to use scope-based forcewake for consistency with other
    parts of the driver.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-49-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit f875dead3ec75ba37edf986603a69c89e4a771e6
Author: Matt Roper 
Date:   Tue Nov 18 08:43:58 2025 -0800

    drm/xe/reg_sr: Use scope-based forcewake
    
    Use scope-based forcewake to slightly simplify the reg_sr code.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-48-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 667fc27e81bc4bd0aae008b6c3f16df9e707707e
Author: Matt Roper 
Date:   Tue Nov 18 08:43:57 2025 -0800

    drm/xe/query: Use scope-based forcewake
    
    Use scope-based forcewake handling for consistency with other parts of
    the driver.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-47-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 175b9aaba3e2b32935204b46ff1ea6356b775801
Author: Matt Roper 
Date:   Tue Nov 18 08:43:56 2025 -0800

    drm/xe/huc: Use scope-based forcewake
    
    Use scope-based forcewake in the HuC code for a small simplification and
    consistency with other parts of the driver.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-46-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit bedad003e8e76ef37d069816ae418e7917c5f4d8
Author: Matt Roper 
Date:   Tue Nov 18 08:43:55 2025 -0800

    drm/xe/gt_debugfs: Use scope-based cleanup
    
    Use scope-based cleanup for forcewake and runtime PM to simplify the
    debugfs code slightly.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-45-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 062a6b83d56066f86c1bed170265ecfa98b83175
Author: Matt Roper 
Date:   Tue Nov 18 08:43:54 2025 -0800

    drm/xe/drm_client: Use scope-based cleanup
    
    Use scope-based cleanup for forcewake and runtime PM.
    
    v2:
     - Use xe_force_wake_release_only rather than a custom one-off class for
       "any engine" forcewake.  (Gustavo)
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-44-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 1fe7ea3287ba35b92db7f8fecf773a6bc9273f51
Author: Matt Roper 
Date:   Tue Nov 18 08:43:53 2025 -0800

    drm/xe: Return forcewake reference type from force_wake_get_any_engine()
    
    Adjust the signature of force_wake_get_any_engine() such that it returns
    a 'struct xe_force_wake_ref' rather than a boolean success/failure.
    Failure cases are now recognized by inspecting the hardware engine
    returned by reference; a NULL hwe indicates that no engine's forcewake
    could be obtained.
    
    These changes will make it cleaner and easier to incorporate scope-based
    cleanup in force_wake_get_any_engine()'s caller in a future patch.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-43-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit b11f88699b13d7b6e314b9d19107aebdc79570f0
Author: Matt Roper 
Date:   Tue Nov 18 08:43:52 2025 -0800

    drm/xe/display: Use scoped-cleanup
    
    Eliminate some goto-based cleanup by utilizing scoped cleanup helpers.
    
    v2:
     - Eliminate unnecessary 'ret' variable in intel_hdcp_gsc_check_status()
       (Gustavo)
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-42-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 7fc616a309e854f75bcc46e82b948065886ebddf
Author: Matt Roper 
Date:   Tue Nov 18 08:43:51 2025 -0800

    drm/xe/devcoredump: Use scope-based cleanup
    
    Use scope-based cleanup for forcewake and runtime PM in the devcoredump
    code.  This eliminates some goto-based error handling and slightly
    simplifies other functions.
    
    v2:
     - Move the forcewake acquisition slightly higher in
       devcoredump_snapshot() so that we maintain an easy-to-understand LIFO
       cleanup order.  (Gustavo)
    
    Cc: Gustavo Sousa 
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-41-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 89bba8fe925a9dc30b8fdcdd2316eb5b322c296d
Author: Matt Roper 
Date:   Tue Nov 18 08:43:50 2025 -0800

    drm/xe/device: Use scope-based cleanup
    
    Convert device code to use scope-based forcewake and runtime PM.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-40-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit be675564cca58fd509b3666bbb1b7f61c6cc03f9
Author: Matt Roper 
Date:   Tue Nov 18 08:43:49 2025 -0800

    drm/xe/gsc: Use scope-based cleanup
    
    Use scope-based cleanup for forcewake and runtime PM to eliminate some
    goto-based error handling and simplify other functions.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-39-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 62a35753f547c7744c062750703c2ae9883b33c5
Author: Matt Roper 
Date:   Tue Nov 18 08:43:48 2025 -0800

    drm/xe/pxp: Use scope-based cleanup
    
    Use scope-based cleanup for forcewake and runtime pm.  This allows us to
    eliminate some goto-based error handling and simplify other functions.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-38-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit ba2562a391c66bff5bcc35583ce8c0beda862f03
Author: Matt Roper 
Date:   Tue Nov 18 08:43:47 2025 -0800

    drm/xe/pat: Use scope-based forcewake
    
    Use scope-based cleanup for forcewake in the PAT code to slightly
    simplify the code.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-37-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 008db7d4e1a465bf65c5cf7a4cc7ab041b2dc00e
Author: Matt Roper 
Date:   Tue Nov 18 08:43:46 2025 -0800

    drm/xe/mocs: Use scope-based cleanup
    
    Using scope-based cleanup for runtime PM and forcewake in the MOCS code
    allows us to eliminate some goto-based error handling and simplify some
    other functions.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-36-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit e9bc4162bf39154c1eb8d5edb11a00fc30771c39
Author: Matt Roper 
Date:   Tue Nov 18 08:43:45 2025 -0800

    drm/xe/guc_pc: Use scope-based cleanup
    
    Use scope-based cleanup for forcewake and runtime PM in the GuC PC code.
    This allows us to eliminate to goto-based cleanup and simplifies some
    other functions.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-35-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 3947e482b5ebb95be49803fdd584a38f005f5042
Author: Matt Roper 
Date:   Tue Nov 18 08:43:44 2025 -0800

    drm/xe/guc: Use scope-based cleanup
    
    Use scope-based cleanup for forcewake and runtime PM.
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-34-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 917714f2787db1f42cc41705e02cb381734ad663
Author: Matt Roper 
Date:   Tue Nov 18 08:43:43 2025 -0800

    drm/xe/gt_idle: Use scope-based cleanup
    
    Use scope-based cleanup for runtime PM and forcewake in the GT idle
    code.
    
    v2:
     - Use scoped_guard() over guard() in idle_status_show() and
       idle_residency_ms_show().  (Gustavo)
     - Eliminate unnecessary 'ret' local variable in name_show().
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-33-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 83d2ea17d53f538724f0222f1cb5f60061efb06a
Author: Matt Roper 
Date:   Tue Nov 18 08:43:42 2025 -0800

    drm/xe/gt: Use scope-based cleanup
    
    Using scope-based cleanup for forcewake and runtime PM allows us to
    reduce or eliminate some of the goto-based error handling and simplify
    several functions.
    
    v2:
     - Drop changes to do_gt_restart().  This function still has goto-based
       logic, making scope-based cleanup unsafe for now.  (Gustavo)
    
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-32-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 59e7528dbfd52efbed05e0f11b2143217a12bc74
Author: Matt Roper 
Date:   Tue Nov 18 08:43:41 2025 -0800

    drm/xe/pm: Add scope-based cleanup helper for runtime PM
    
    Add a scope-based helpers for runtime PM that may be used to simplify
    cleanup logic and potentially avoid goto-based cleanup.
    
    For example, using
    
            guard(xe_pm_runtime)(xe);
    
    will get runtime PM and cause a corresponding put to occur automatically
    when the current scope is exited.  'xe_pm_runtime_noresume' can be used
    as a guard replacement for the corresponding 'noresume' variant.
    There's also an xe_pm_runtime_ioctl conditional guard that can be used
    as a replacement for xe_runtime_ioctl():
    
            ACQUIRE(xe_pm_runtime_ioctl, pm)(xe);
            if ((ret = ACQUIRE_ERR(xe_pm_runtime_ioctl, &pm)) < 0)
                    /* failed */
    
    In a few rare cases (such as gt_reset_worker()) we need to ensure that
    runtime PM is dropped when the function is exited by any means
    (including error paths), but the function does not need to acquire
    runtime PM because that has already been done earlier by a different
    function.  For these special cases, an 'xe_pm_runtime_release_only'
    guard can be used to handle the release without doing an acquisition.
    
    These guards will be used in future patches to eliminate some of our
    goto-based cleanup.
    
    v2:
     - Specify success condition for xe_pm runtime_ioctl as _RET >= 0 so
       that positive values will be properly identified as success and
       trigger destructor cleanup properly.
    
    v3:
     - Add comments to the kerneldoc for the existing 'get' functions
       indicating that scope-based handling should be preferred where
       possible.  (Gustavo)
    
    Cc: Gustavo Sousa 
    Reviewed-by: Michal Wajdeczko 
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-31-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 074edfbdfba25493324807f749fbc86bf0af3a2d
Author: Matt Roper 
Date:   Tue Nov 18 08:43:40 2025 -0800

    drm/xe/forcewake: Add scope-based cleanup for forcewake
    
    Since forcewake uses a reference counting get/put model, there are many
    places where we need to be careful to drop the forcewake reference when
    bailing out of a function early on an error path.  Add scope-based
    cleanup options that can be used in place of explicit get/put to help
    prevent mistakes in this area.
    
    Examples:
    
       CLASS(xe_force_wake, fw_ref)(gt_to_fw(gt), XE_FW_GT);
    
           Obtain forcewake on the XE_FW_GT domain and hold it until the
           end of the current block.  The wakeref will be dropped
           automatically when the current scope is exited by any means
           (return, break, reaching the end of the block, etc.).
    
       xe_with_force_wake(fw_ref, gt_to_fw(ss->gt), XE_FORCEWAKE_ALL) {
            ...
       }
    
           Hold all forcewake domains for the following block.  As with the
           CLASS usage, forcewake will be dropped automatically when the
           block is exited by any means.
    
    Use of these cleanup helpers should allow us to remove some ugly
    goto-based error handling and help avoid mistakes in functions with lots
    of early error exits.
    
    An 'xe_force_wake_release_only' class is also added for cases where a
    forcewake reference is passed in from another function and the current
    function is responsible for releasing it in every flow and error path.
    
    v2:
     - Create a separate constructor that just wraps xe_force_wake_get for
       use in the class.  This eliminates the need to update the signature
       of xe_force_wake_get().  (Michal)
    
    v3:
     - Wrap xe_with_force_wake's 'done' marker in __UNIQUE_ID.  (Gustavo)
     - Add a note to xe_force_wake_get()'s kerneldoc explaining that
       scope-based cleanup is preferred when possible.  (Gustavo)
     - Add an xe_force_wake_release_only class.  (Gustavo)
    
    v4:
     - Add NULL check on fw in release_only variant.  (Gustavo)
    
    Cc: Michal Wajdeczko 
    Cc: Gustavo Sousa 
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251118164338.3572146-30-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit a1e19289932aeef26085feb97597d624da6302ab
Author: Baochen Qiang 
Date:   Wed Nov 19 10:24:47 2025 +0800

    wifi: ath12k: move firmware stats request outside of atomic context
    
    In ath12k_mac_op_link_sta_statistics(), the atomic context scope
    introduced by dp_lock also covers firmware stats request. Since that
    request could block, below issue is hit:
    
    BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575
    in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6866, name: iw
    preempt_count: 201, expected: 0
    RCU nest depth: 0, expected: 0
    3 locks held by iw/6866:
     #0:[...]
     #1:[...]
     #2: ffff9748f43230c8 (&dp->dp_lock){+.-.}-{3:3}, at:
    ath12k_mac_op_link_sta_statistics+0xc6/0x380 [ath12k]
    Preemption disabled at:
    [] ath12k_mac_op_link_sta_statistics+0xc6/0x380 [ath12k]
    Call Trace:
     
     show_stack
     dump_stack_lvl
     dump_stack
     __might_resched.cold
     __might_sleep
     __mutex_lock
     mutex_lock_nested
     ath12k_mac_get_fw_stats
     ath12k_mac_op_link_sta_statistics
     
    
    Since firmware stats request doesn't require protection from dp_lock, move
    it outside to fix this issue.
    
    While moving, also refine that code hunk to make function parameters get
    populated when really necessary.
    
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251119-ath12k-ng-sleep-in-atomic-v1-1-5d1a726597db@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit 5a384854d81f83d59d812b54bfa27fd0e56e36f0
Author: Baochen Qiang 
Date:   Wed Nov 19 10:15:57 2025 +0800

    wifi: ath12k: add the missing RCU lock in ath12k_dp_tx_free_txbuf()
    
    RCU read lock is missing in ath12k_dp_tx_free_txbuf() before calling
    ath12k_dp_to_pdev_dp(), causing below warning:
    
    WARNING: suspicious RCU usage
    -----------------------------
    drivers/net/wireless/ath/ath12k/dp.h:653 ath12k dp to dp pdev called without rcu lock!
    Call Trace:
     
     show_stack
     dump_stack_lvl
     dump_stack
     lockdep_rcu_suspicious.cold
     ath12k_dp_tx_free_txbuf
     ath12k_wifi7_dp_tx_completion_handler
     ath12k_wifi7_dp_service_srng
     ath12k_pci_ext_grp_napi_poll
     [...]
     
    
    Invoke guard(rcu) to fix it.
    
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
    
    Signed-off-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251119-ath12k-fix-missing-rcu-lock-v1-1-8155de1dc4fc@oss.qualcomm.com
    Signed-off-by: Jeff Johnson 

commit e4c8fde0bf2004fcd9c9dc8e3bc9bf6545a21a3e
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:17 2025 +0200

    drm/xe/rps: build RPS as part of xe
    
    Reduce the conditional compilation in i915 by building
    intel_display_rps.c as part of the xe module. This doesn't actually
    enable RPS on xe, because there's no parent interface implementation on
    xe side, but it's a step in the right direction.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/93df0bb727fce14aa9a542dbd2c0826a0fa0a16f.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 55fc11ce96e92dbae2aab1d692735f7a9b96fefd
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:16 2025 +0200

    drm/i915: add .fence_priority_display to parent interface
    
    Add .fence_priority_display() to display parent interface, removing a
    display dependency on gem/i915_gem_object.h.
    
    This allows us to remove the xe compat gem/i915_gem_object.h.
    
    v2: Don't mix this with the rps interface (Ville)
    
    v3: Rebase
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/c7782862956e3aa59eaeb6dcf80906c1fc063ae1.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 69c9b1861e827a45021a0a10c1d0276a896dd0c2
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:15 2025 +0200

    drm/i915/rps: postpone i915 fence check to boost
    
    Make the RPS boost code independent of i915 request code by moving the
    dma_fence_is_i915() check to the RPS boost call.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/2653395523ee04c9ca3216f197f08c25a9f7716d.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 1314027632ae2d98ec7ba250495d1a6084caafc6
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:14 2025 +0200

    drm/i915/rps: call RPS functions via the parent interface
    
    Add struct intel_display_rps_interface to the display parent interface,
    and call the RPS functions through it. The RPS interface is optional.
    
    v2: s/boost/boost_if_not_started/ and keep comment in caller (Ville)
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/6a6c4420d9f2d9a545ee6df4cad5fdc32a86636b.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 95c04f442941cb9829e791d0bef460317a17819c
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:13 2025 +0200

    drm/i915/rps: store struct dma_fence in struct wait_rps_boost
    
    Prefer the more generic pointer rather than i915 specific data
    type. Also use dma_fence_put() for symmetry with the dma_fence_get()
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/950948ae6d3d5fbc4af3401ea77e609945b73a77.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 4799ff418f9a68361331fdc7fc01f66dc314adb9
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:12 2025 +0200

    drm/i915: add .has_fenced_regions to parent interface
    
    Add .has_fenced_regions() to display parent interface, removing more
    dependencies on struct drm_i915_private, i915_drv.h, and
    gt/intel_gt_types.h.
    
    This allows us to remove the xe compat gt/intel_gt_types.h.
    
    v2: s/fence_support_legacy/has_fenced_regions/ (Ville)
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/309f61a8742c3bf731c820b2f9e1024143db8598.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit e8916738977e29a6f1e8edc593ee336f2bcf1b7d
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:11 2025 +0200

    drm/i915: add .vgpu_active to parent interface
    
    Add .vgpu_active() to display parent interface, removing more
    dependencies on struct drm_i915_private, i915_drv.h, and i915_vgpu.h.
    
    This also allows us to remove the xe compat i915_vgpu.h.
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/a2d4043ebaaf8f69bb738d5d1332afd2847550ad.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 3815e8f2ffe44396d10b100fbd38f511dfefbbc7
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:10 2025 +0200

    drm/{i915,xe}/display: move irq calls to parent interface
    
    Add an irq parent driver interface for the .enabled and .synchronize
    calls. This lets us drop the dependency on i915_drv.h and i915_irq.h in
    multiple places, and subsequently remove the compat i915_irq.h and
    i915_irq.c files along with the display/ext directory from xe
    altogether.
    
    Introduce new intel_parent.[ch] as the wrapper layer to chase the
    function pointers and convert between generic and more specific display
    types.
    
    v2: Keep static wrappers in intel_display_irq.c (Ville)
    
    v3: Full blown wrappers in intel_parent.[ch] (Ville)
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/dd62dd52ef10d9ecf77da3bdf6a70f71193d141c.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit a651be53c42ae1cd44d51a7e7913edbbee976c99
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:09 2025 +0200

    drm/i915/display: convert the display irq interfaces to struct intel_display
    
    Convert the irq/error init/reset interfaces from struct intel_uncore to
    struct intel_display, and drop the dependency on intel_uncore.h.
    
    Since the intel_de_*() calls handle the DMC wakelock internally, we can
    drop the wrappers handling wakelocks completely.
    
    v2: Drop the wakelock wrappers (Ville)
    
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/710e03906da91244208839b357fe9171e37441ba.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit b9241d0ed9cefc7f9b9bb65533494d7776964d79
Author: Jani Nikula 
Date:   Mon Nov 17 11:16:08 2025 +0200

    drm/{i915, xe}/display: duplicate gen2 irq/error init/reset in display irq
    
    Duplicate gen2_irq_reset(), gen2_assert_iir_is_zero(), gen2_irq_init(),
    gen2_error_reset(), and gen2_error_init() in intel_display_irq.c.
    
    This allows us to drop the duplicates from xe, and prepares for future
    cleanups. Although duplication is undesirable in general, in this case
    the local duplicates lead to a cleaner end result.
    
    There's a slight wrinkle in gen2_assert_iir_is_zero(). We need to use
    non-device based logging until we pass in struct intel_display in a
    separate change.
    
    v2:
    - Keep xe compat stuff due to series reorder and rebase
    - Keep the WARN as regular WARN
    - Rename the functions in the same go
    
    Suggested-by: Ville Syrjala 
    Reviewed-by: Ville Syrjälä 
    Link: https://patch.msgid.link/296d74731cce57ab7534c57969d3146294adda57.1763370931.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula 

commit 7e2d78535432e44f908c6c44f73828cfd9c12aee
Author: Ville Syrjälä 
Date:   Wed Oct 29 22:42:15 2025 +0200

    drm/i915/dram: Fix ICL DIMM_S decoding
    
    Unfortunately the MAD_DIMM DIMM_S and DIMM_L bits on ICL are
    not idential, so we are currently decoding DIMM_S incorrectly.
    
    Fix the problem by defining the DIMM_S and DIMM_L bits separately.
    And for consistency do that same for SKL, even though there the
    bits do match between the two DIMMs. The result is rather
    repetitive in places, but I didn't feel like obfuscatign things
    with cpp macros/etc.
    
    Broken decoding on Dell XPS 13 7390 2-in-1:
     CH0 DIMM L size: 32 Gb, width: X16, ranks: 2, 16Gb+ DIMMs: no
     CH0 DIMM S size: 32 Gb, width: X32, ranks: 3, 16Gb+ DIMMs: no
     CH0 ranks: 2, 16Gb+ DIMMs: no
     CH1 DIMM L size: 32 Gb, width: X16, ranks: 2, 16Gb+ DIMMs: no
     CH1 DIMM S size: 32 Gb, width: X32, ranks: 3, 16Gb+ DIMMs: no
     CH1 ranks: 2, 16Gb+ DIMMs: no
     Memory configuration is symmetric? no
    
    Fixed decoding on Dell XPS 13 7390 2-in-1:
     CH0 DIMM L size: 32 Gb, width: X16, ranks: 2, 16Gb+ DIMMs: no
     CH0 DIMM S size: 32 Gb, width: X16, ranks: 2, 16Gb+ DIMMs: no
     CH0 ranks: 2, 16Gb+ DIMMs: no
     CH1 DIMM L size: 32 Gb, width: X16, ranks: 2, 16Gb+ DIMMs: no
     CH1 DIMM S size: 32 Gb, width: X16, ranks: 2, 16Gb+ DIMMs: no
     CH1 ranks: 2, 16Gb+ DIMMs: no
     Memory configuration is symmetric? yes
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251029204215.12292-4-ville.syrjala@linux.intel.com
    Reviewed-by: Jani Nikula 

commit 8c171a9b8c4cb10b1942d3094f94e27c65232cf7
Author: Ville Syrjälä 
Date:   Wed Oct 29 22:42:14 2025 +0200

    drm/i915/dram: Sort SKL+ DIMM register bits
    
    Use the customary big endian order when defining the
    SKL/ICL DIMM registers.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251029204215.12292-3-ville.syrjala@linux.intel.com
    Reviewed-by: Lucas De Marchi 

commit 5b23aa423a637358a4b98cd18a4da020ca8398bc
Author: Ville Syrjälä 
Date:   Wed Oct 29 22:42:13 2025 +0200

    drm/i915/dram: Use REG_GENMASK() & co. for the SKL+ DIMM regs
    
    Modernize the SKL/ICL DIMM registers with REG_GENMASK() & co.
    
    Signed-off-by: Ville Syrjälä 
    Link: https://patch.msgid.link/20251029204215.12292-2-ville.syrjala@linux.intel.com
    Reviewed-by: Lucas De Marchi 

commit 0a4c2ddc711a9a0d3d9566379b217f2ae42d6152
Author: Matt Roper 
Date:   Tue Nov 18 12:26:05 2025 -0800

    drm/xe/vm: Use for_each_tlb_inval() to calculate invalidation fences
    
    ops_execute() calculates the size of a fence array based on
    XE_MAX_GT_PER_TILE, while the code that actually fills in the fence
    array uses a for_each_tlb_inval() iterator.  This works out okay today
    since both approaches come up with the same number of invalidation
    fences (2: primary GT invalidation + media GT invalidation), but could
    be problematic in the future if there isn't a 1:1 relationship between
    TLBs needing invalidation and potential GTs on the tile.
    
    Adjust the allocation code to use the same for_each_tlb_inval()
    counting logic as the code that fills the array to future-proof the
    code.
    
    Reviewed-by: Matthew Brost 
    Link: https://patch.msgid.link/20251118202604.3715782-2-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 1a7fad2aea74065dcd81821c681103813fd0772b
Author: Mika Kahola 
Date:   Tue Nov 18 15:28:59 2025 +0200

    drm/i915/cx0: Enable dpll framework for MTL+
    
    MTL+ platforms are supported by dpll framework remove a separate
    check for hw comparison and rely solely on dpll framework
    hw comparison.
    
    Finally, all required hooks are now in place so initialize
    PLL manager for MTL+ platforms and remove the redirections
    to the legacy code paths from the following interfaces:
    
    * intel_encoder::clock_enable/disable()
    * intel_encoder::get_config()
    * intel_dpll_funcs::get_hw_state()
    * intel_ddi_update_active_dpll()
    * pipe_config_pll_mismatch()
    
    v2: Rebase on !HAS_LT_PHY check in intel_ddi_update_active_dpll()
    v3: Rebase on !display->dpll.mgr check in intel_ddi_update_active_dpll()
        Add check for NVL as the platform is not part of pll framework (Suraj)
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251118132859.2584452-1-mika.kahola@intel.com

commit 2a6e417907593e908d164c743f812ad6413f3d7b
Author: Imre Deak 
Date:   Mon Nov 17 12:46:01 2025 +0200

    drm/i915/cx0: Add MTL+ Thunderbolt PLL hooks
    
    Add the PLL hooks for the TBT PLL on MTL+. These are simple stubs
    similarly to the TBT PLL on earlier platforms, since this PLL is always
    on from the display POV - so no PLL enable/disable programming is
    required as opposed to the non-TBT PLLs - and the clocks for different
    link rates are enabled/disabled at a different level, via the
    intel_encoder::enable_clock()/disable_clock() interface.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-32-mika.kahola@intel.com

commit 6b566d066c823a9ad1ec5a7043955349a71ce42b
Author: Mika Kahola 
Date:   Mon Nov 17 12:46:00 2025 +0200

    drm/i915/cx0: Get encoder configuration for C10 and C20 PHY PLLs
    
    For DDI initialization get encoder configuration for C10 and C20
    chips.
    
    v2: Get configuration either for a C10 or on the PTL port B
        eDP on TypeC PHY case for a C20 PHY PLL. Hence refer to this
        case as "non_tc_phy" instead of "c10phy".
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-31-mika.kahola@intel.com

commit e32518d012ed9abd97b33832fc82fafdab40c12d
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:59 2025 +0200

    drm/i915/cx0: Add MTL+ .enable_clock/.disable clock hooks on DDI
    
    To enable pll clock on DDI move part of the pll enabling
    sequence into a ddi clock enabling function.
    
    Simililarly, do the same for pll disabling sequence.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-30-mika.kahola@intel.com

commit b800af732c6b844c8fe6465edf39c437f4a760e3
Author: Imre Deak 
Date:   Mon Nov 17 12:45:58 2025 +0200

    drm/i915/cx0: PLL verify debug state print
    
    Print out hw and sw pll states for better debugging support.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-29-mika.kahola@intel.com

commit f3b04e27f7e5cf2af91d73112d9f81296ddad156
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:57 2025 +0200

    drm/i915/cx0: Add MTL+ .crtc_get_dpll hook
    
    Add .crtc_get_dpll function pointer to support MTL+
    platforms.
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-28-mika.kahola@intel.com

commit 57cf9d5e45a88a4d3543dfd32c78f9bedca1b110
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:56 2025 +0200

    drm/i915/cx0: Add MTL+ .get_freq hook
    
    Add .get_freq hook to support dpll framework for MTL+
    platforms.
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-27-mika.kahola@intel.com

commit 685f36534968467a37ee7319673633b82dcebe09
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:55 2025 +0200

    drm/i915/cx0: Add MTL+ .get_hw_state hook
    
    Add .get_hw_state hook to MTL+ platforms for dpll framework.
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-26-mika.kahola@intel.com

commit 9b5f839e14a52c67492830b718d4ac8dddf04688
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:54 2025 +0200

    drm/i915/cx0: Add .compare_hw_state hook
    
    Add .compare_hw_state function pointer for MTL+ platforms
    to support dpll framework.
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-25-mika.kahola@intel.com

commit 2e129889622c391d4d1204a0da16e278d585124b
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:53 2025 +0200

    drm/i915/cx0: Add MTL+ .dump_hw_state hook
    
    Add .dump_hw_state function pointer for MTL+ platforms
    to support dpll framework. While at it, switch to use
    drm_printer structure to print hw state information.
    
    v2: Keep debug messages on one line if they not
        necessarily needed to split into two or more
        lines (Suraj)
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-24-mika.kahola@intel.com

commit dc3fdd4ade8763aac3546835909b70c298b8e8f4
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:52 2025 +0200

    drm/i915/cx0: Add MTL+ .update_dpll_ref_clks hook
    
    Add .update_dpll_ref_clks function pointer to MTL+
    platforms to support dpll framework. Reuse ICL
    function pointer.
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-23-mika.kahola@intel.com

commit 4fcefdf990cb14a3586e622ded7a18c287cf51e4
Author: Mika Kahola 
Date:   Tue Nov 18 15:28:30 2025 +0200

    drm/i915/cx0: Add MTL+ .update_active_dpll hook
    
    Add .update_active_dpll function pointer to support
    dpll framework. Reuse ICL function pointer.
    
    v2: Add check for !HAS_LT_PHY (Suraj)
    v3: Remove the incorrect !HAS_LT_PHY condition and
        check for existing dpll_mgr
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal  # v1
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251118132830.2584422-1-mika.kahola@intel.com

commit 051964d94adc7b2f16921c1fc1969f7910d7129c
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:50 2025 +0200

    drm/i915/cx0: Add MTL+ .put_dplls hook
    
    Add .put_dplls function pointer to support MTL+ platforms
    on dpll framework. Reuse ICL function pointer.
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-21-mika.kahola@intel.com

commit ca1eda5cd476ca5c948e697af528694071f0f92a
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:49 2025 +0200

    drm/i915/cx0: Add MTL+ .get_dplls hook
    
    Add .get_dplls function pointer for MTL+ platforms
    to support dpll framework. Reuse the ICL function
    pointer.
    
    v2: Getting configuration either for a C10 or on the PTL port B
        eDP on TypeC PHY case for a C20 PHY PLL. Hence refer to this
        case as "non_tc_phy" instead of "c10phy".
    v3: Fix comment to "eDP over TypeC" (Suraj)
        Fix pll id as separate variable (Suraj)
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-20-mika.kahola@intel.com

commit 28d5533f2787c67fbfdb29018c8ef56ba964147f
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:48 2025 +0200

    drm/i915/cx0: Compute plls for MTL+ platform
    
    To bring MTL+ platform aligned call and calculate PLL state
    from dpll framework.
    
    v2: Rename mtl_compute_c10phy_dpll() to mtl_compute_non_tc_phy_dpll().
        The state is computed either for a C10 or on the PTL port B eDP
        over TypeC PHY case for a C20 PHY PLL. Hence refer to this case as
        "non_tc_phy" instead of "c10phy".
    
        Rename mtl_compute_c20phy_dplls() to mtl_compute_tc_phy_dplls() for
        symmetry with mtl_compute_non_tc_phy_dpll().
    v3: Reword commit message (Suraj)
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-19-mika.kahola@intel.com

commit d174cfb51dce71778822a8ab2dde772dad947409
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:47 2025 +0200

    drm/i915/cx0: Update C10/C20 state calculation
    
    Update several functions in intel_cx0_phy.c to make PLL state
    management more explicit.
    
    Changes include
     * add 'const' qualifiers to intel_crtc_state parameter for
       cx0 state calculation functions
     * refactor C10/C20 PLL state calculations helpers to take
       explicit hardware state pointers instead of directly modifying
       'crtc_state->dpll_hw_state'
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-18-mika.kahola@intel.com

commit b5c0256a587eb50920ade41dd1b086039ec6bcfd
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:46 2025 +0200

    drm/i915/cx0: Add PLL information for MTL+
    
    Start bringing MTL+ platforms as part of PLL framework.
    The work is started by adding PLL information and related
    function hooks.
    
    BSpec: 55726
    
    v2: Revise commit message and add BSpec ID (Suraj)
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-17-mika.kahola@intel.com

commit ac3423721117a6ad2e643ba74770e118124eff27
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:45 2025 +0200

    drm/i915/cx0: Remove state verification
    
    When pll's are moved to dpll framework we no longer
    need Cx0 specific state verification as we can rely
    on dpll state verification instead.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-16-mika.kahola@intel.com

commit fb1dc1eab618f24ead88e2ea7ac057679eac4faf
Author: Imre Deak 
Date:   Mon Nov 17 12:45:44 2025 +0200

    drm/i915/cx0: Print additional Cx0 PLL HW state
    
    Print all the Cx0 PLL state in the PLL state dumper.
    
    v2: Use BUILD_BUG_ON() instead of WARN_ON() (Jani)
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-15-mika.kahola@intel.com

commit 36a3efb32ed2eb3986be4bb02e2f298d0ff055e8
Author: Imre Deak 
Date:   Mon Nov 17 12:45:43 2025 +0200

    drm/i915/cx0: Zero Cx0 PLL state before compute and HW readout
    
    Ensure Cx0 pll state is initialized to zero before any computation or HW
    readouts, to prevent leaving some parameter in the state uninitialized
    in the actual compute/HW readout functions later.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-14-mika.kahola@intel.com

commit 538187f17acd4bf94dfc98cdd8630559324fad43
Author: Imre Deak 
Date:   Mon Nov 17 12:45:42 2025 +0200

    drm/i915/cx0: Determine Cx0 PLL port clock from PLL state
    
    The port clock is tracked in the PLL state, so there is no need to pass
    it separately to __intel_cx0pll_enable(). Drop the port clock function
    param accordingly.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-13-mika.kahola@intel.com

commit 90fd33c2626008b8c5e6c30c44b480c21ea41c2d
Author: Imre Deak 
Date:   Mon Nov 17 12:45:41 2025 +0200

    drm/i915/cx0: Determine Cx0 PLL DP mode from PLL state
    
    The Cx0 PLL enable programming needs to know if the PLL is in DP or HDMI
    mode. The PLL manager framework doesn't pass the CRTC state to the PLL's
    enable hook, so prepare here for the conversion to use the PLL manager
    for Cx0 PHY PLLs by determining the DP/HDMI mode from the PLL state.
    
    For C10 PHYs use the fact that the HDMI divider value in the PLL
    registers are set if and only if the PLL is in HDMI mode.
    
    For C20 PHYs use the DP mode flag programmed to the VDR SERDES register,
    which is set if and only if the PLL is in DP mode.
    
    Assert that the above PLL/VDR SERDES register values match the DP/HDMI
    mode being configured already during state computation.
    
    This also allows dropping the is_dp param from the
    __intel_cx0pll_enable() function, since it can retrieve this now from
    the PLL state.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-12-mika.kahola@intel.com

commit 8ad92b0733030841d5a728178f5c8a6f2c3e8f78
Author: Imre Deak 
Date:   Mon Nov 17 12:45:40 2025 +0200

    drm/i915/cx0: Read out the Cx0 PHY SSC enabled state
    
    Read out the C10, C20 PHY PLLs SSC enabled state, so the PLL HW/SW state
    verification can check this state as well.
    
    C10 PHY PLLs program some PLL registers zeroed out for the non-SSC case,
    while programming non-zero values to the same registers for the SSC
    case, so check that these PLL registers being zero or non-zero matches
    the PLL's overall SSC-enabled state (stored in the
    intel_c10pll_state::ssc_enabled flag).
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-11-mika.kahola@intel.com

commit 5df82b17928b8f14d7167a5e199b4cb58bfe39e1
Author: Imre Deak 
Date:   Mon Nov 17 12:45:39 2025 +0200

    drm/i915/cx0: Sanitize C10 PHY PLL SSC register setup
    
    Define the C10 PLL SSC register range via macros, so the HW/SW state of
    these register can be verified by a follow-up change, reusing these
    macros.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-10-mika.kahola@intel.com

commit 230d4c748113d83931a5b57c844fb71faf9eebe3
Author: Imre Deak 
Date:   Mon Nov 17 12:45:38 2025 +0200

    drm/i915/cx0: Track the Cx0 PHY enabled lane count in the PLL state
    
    The Cx0 PLL enable programming requires the enabled lane count. The PLL
    manager framework doesn't pass the CRTC state to the PLL's enable hook,
    so prepare here for the conversion to use the PLL manager, by tracking
    the enabled lane count in the PLL state as well. This has the advantage,
    that the enabled lane count can be verified against the PHY/PLL's
    enabled TX lanes.
    
    This also allows dropping the lane count param from the
    __intel_cx0pll_enable() function, since it can retrieve this now from
    the PLL state.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-9-mika.kahola@intel.com

commit 4f8b1e08c28945427a46b98144c20c22d0578885
Author: Imre Deak 
Date:   Mon Nov 17 12:45:37 2025 +0200

    drm/i915/cx0: Add macro to get DDI port width from a register value
    
    A follow-up change will need to retrieve the DDI port field from the
    register value, add a macro for this. Make things symmetric with setting
    the field in the register.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-8-mika.kahola@intel.com

commit 7c3342213a8b73f3100e3462074f5ded4fd9d675
Author: Imre Deak 
Date:   Mon Nov 17 12:45:36 2025 +0200

    drm/i915/cx0: Move definition of Cx0 PHY functions earlier
    
    Move the definitions of the
      intel_c10pll_calc_port_clock()
      intel_c20_get_dp_rate()
      intel_c20_get_hdmi_rate()
      is_hdmi_frl()
      is_dp2()
      intel_get_c20_custom_width()
    functions earlier to avoid the forward declarations.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-7-mika.kahola@intel.com

commit 201c902870ec7b4141e4f403612a289701fafb80
Author: Imre Deak 
Date:   Mon Nov 17 12:45:35 2025 +0200

    drm/i915/cx0: Track the C20 PHY VDR state in the PLL state
    
    The Cx0 PLL enable programming needs to know if the PLL is in DP or HDMI
    mode. The PLL manager framework doesn't pass the CRTC state to the PLL's
    enable hook, so prepare here for the conversion to use the PLL manager
    for Cx0 PHY PLLs by tracking the DP/HDMI mode in the PLL state.
    
    This change has the advantage, that the VDR HW/SW state can be verified
    now.
    
    A follow up change will convert the PLL enable function to retrieve the
    DP/HDMI mode parameter from the PLL state.
    
    This also allows dropping the is_dp and port clock params from the
    intel_c20_pll_program() function, since it can retrieve these now from
    the PLL state.
    
    v2: Fix comment to under same multicomment line (Suraj)
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-6-mika.kahola@intel.com

commit 5050d4a0af1e3b4970adf321f4a9296fe2ac532f
Author: Imre Deak 
Date:   Mon Nov 17 12:45:34 2025 +0200

    drm/i915/cx0: Sanitize calculating C20 PLL state from tables
    
    A follow up change adds a computation for the C20 PLL VDR state, which
    is common to both the HDMI algorithmic and DP/HDMI table based method.
    To prepare for that streamline the code. The C10 counterpart would
    benefit from the same change, leave that for later adding a TODO
    comment.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-5-mika.kahola@intel.com

commit 1cefc3ac7d8451cebcfce209c53933fb6309e4e5
Author: Imre Deak 
Date:   Mon Nov 17 12:45:33 2025 +0200

    drm/i915/cx0: Sanitize setting the Cx0 PLL use_c10 flag
    
    Sanitize setting the Cx0 PLL use_c10 flag during state computation and
    HW readout, making sure they happen the same way in the
    intel_c{10,20}pll_calc_state() and intel_c{10,20}pll_readout_hw_state()
    functions.
    
    Follow-up changes will add more state computation/HW readout, this
    change prepares for those as well.
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-4-mika.kahola@intel.com

commit dca0eb029f5770e18308db966cdeec4bb4b5a659
Author: Imre Deak 
Date:   Mon Nov 17 12:45:32 2025 +0200

    drm/i915/cx0: Factor out C10 msgbus access start/end helpers
    
    Factor out functions to begin and complete C10 PHY programming
    sequences to make the code more concise.
    
    v2: Rename msgbus_update_config() to more descriptive
        msg_bus_access_commit() (Jani)
    
    Signed-off-by: Imre Deak 
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-3-mika.kahola@intel.com

commit d7e7a0048f6aceaadd19bda66de496c60b741cb1
Author: Mika Kahola 
Date:   Mon Nov 17 12:45:31 2025 +0200

    drm/i915/cx0: Rename TBT functions to be ICL specific
    
    Rename pll functions to include ICL platform as these are
    used from ICL onwards.
    
    Signed-off-by: Mika Kahola 
    Reviewed-by: Suraj Kandpal 
    Link: https://lore.kernel.org/r/20251117104602.2363671-2-mika.kahola@intel.com

commit 37fc7b7b3ab0e3bb900657199cd3770a4fda03fb
Author: Dibin Moolakadan Subrahmanian 
Date:   Tue Nov 11 19:24:03 2025 +0530

    drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation
    
    During fbdev probe, the xe driver allocates and pins a framebuffer
    BO (via xe_bo_create_pin_map_novm() → xe_ggtt_insert_bo()).
    
    Without a runtime PM reference, xe_pm_runtime_get_noresume() warns about
    missing outer PM protection as below:
    
            xe 0000:03:00.0: [drm] Missing outer runtime PM protection
    
    Acquire a runtime PM reference before framebuffer allocation to ensure
    xe_ggtt_insert_bo()  executes  under active runtime PM context.
    
    Changes in v2:
     - Update commit message to add Fixes tag (Jani Nikula)
    
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6350
    Fixes: 44e694958b95 ("drm/xe/display: Implement display support")
    Cc: Jani Nikula 
    Signed-off-by: Dibin Moolakadan Subrahmanian 
    Reviewed-by: Jouni Högander 
    Signed-off-by: Ankit Nautiyal 
    Link: https://patch.msgid.link/20251111135403.3415947-1-dibin.moolakadan.subrahmanian@intel.com

commit fa18290bf0723b02bfa8d30d2e14722f0d096c2c
Author: Satyanarayana K V P 
Date:   Tue Nov 18 12:07:45 2025 +0000

    drm/xe/vf: Shadow buffer management for CCS read/write operations
    
    CCS copy command consist of 5-dword sequence. If vCPU halts during
    save/restore operations while these sequences are being programmed,
    incomplete writes can cause page faults during IGPU CCS metadata saving.
    
    Use shadow buffer management to prevent partial write issues during CCS
    operations.
    
    Signed-off-by: Satyanarayana K V P 
    Suggested-by: Matthew Brost 
    Cc: Michal Wajdeczko 
    Cc: Matthew Auld 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251118120745.3460172-3-satyanarayana.k.v.p@intel.com

commit 1f2cf5295cdba71818288c9e495b4ef5097565ed
Author: Satyanarayana K V P 
Date:   Tue Nov 18 12:07:44 2025 +0000

    drm/xe/sa: Shadow buffer support in the sub-allocator pool
    
    The existing sub-allocator is limited to managing a single buffer object.
    This enhancement introduces shadow buffer functionality to support
    scenarios requiring dual buffer management.
    
    The changes include added shadow buffer object creation capability,
    Management for both primary and shadow buffers, and appropriate locking
    mechanisms for thread-safe operations.
    
    This enables more flexible buffer allocation strategies in scenarios where
    shadow buffering is required.
    
    Signed-off-by: Satyanarayana K V P 
    Suggested-by: Matthew Brost 
    Cc: Michal Wajdeczko 
    Cc: Matthew Auld 
    Reviewed-by: Matthew Brost 
    Signed-off-by: Matthew Brost 
    Link: https://patch.msgid.link/20251118120745.3460172-2-satyanarayana.k.v.p@intel.com

commit de72d9df4f453c08da3d4a15ce75fbd5f891bd2e
Author: Vinod Govindapillai 
Date:   Tue Nov 11 14:46:06 2025 +0200

    drm/i915/fbc: Apply Wa_15018326506
    
    Disable FBC in bmg as per the wa recommendation.
    
    v2: use the bmg platform instead of a specific stepping
    
    v3: wa to Wa
    
    Bspec: 74212
    Signed-off-by: Vinod Govindapillai 
    Reviewed-by: Mika Kahola 
    Acked-by: Uma Shankar 
    Link: https://patch.msgid.link/20251111124606.402380-1-vinod.govindapillai@intel.com
    Signed-off-by: Vinod Govindapillai 

commit c34a14bce7090862ebe5a64abe8d85df75e62737
Author: Venkata Ramana Nayana 
Date:   Fri Nov 7 14:01:41 2025 +0530

    drm/xe/irq: Handle msix vector0 interrupt
    
    Current gu2host handler registered as MSI-X vector 0 and as per bspec for
    a msix vector 0 interrupt, the driver must check the legacy registers
    190008(TILE_INT_REG), 190060h (GT INTR Identity Reg 0) and other registers
    mentioned in "Interrupt Service Routine Pseudocode" otherwise it will block
    the next interrupts. To overcome this issue replacing guc2host handler
    with legacy xe_irq_handler.
    
    Fixes: da889070be7b2 ("drm/xe/irq: Separate MSI and MSI-X flows")
    Bspec: 62357
    Signed-off-by: Venkata Ramana Nayana 
    Reviewed-by: Balasubramani Vivekanandan 
    Link: https://patch.msgid.link/20251107083141.2080189-1-venkata.ramana.nayana@intel.com
    Signed-off-by: Matt Roper 

commit 78ff838a8ab78b3cd438e382ff5204b93db3237e
Author: Michał Winiarski 
Date:   Fri Nov 14 13:23:39 2025 +0100

    drm/xe/pf: Check for fence error on VRAM save/restore
    
    The code incorrectly assumes that the VRAM save/restore fence is valid.
    Fix it by checking for error.
    
    Fixes: 49cf1b9b609fe ("drm/xe/pf: Handle VRAM migration data as part of PF control")
    Suggested-by: Matthew Auld 
    Reviewed-by: Matthew Auld 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251114122339.1791026-1-michal.winiarski@intel.com
    Signed-off-by: Michał Winiarski 

commit dab751b4240f0f0eadea81f93ff0b439379bc6ae
Author: Michał Winiarski 
Date:   Fri Nov 14 11:07:13 2025 +0100

    drm/xe/pf: Drop the VF VRAM BO reference on successful restore
    
    The reference is only dropped on error. Fix it by adding the missing
    xe_bo_put().
    
    Fixes: 49cf1b9b609fe ("drm/xe/pf: Handle VRAM migration data as part of PF control")
    Reported-by: Adam Miszczak 
    Reviewed-by: Matthew Auld 
    Link: https://patch.msgid.link/20251114100713.1776073-1-michal.winiarski@intel.com
    Signed-off-by: Michał Winiarski 

commit b1aa02acd03bfef3ed39c511d33c4a4303d2f9b1
Author: Shuicheng Lin 
Date:   Mon Nov 10 23:26:58 2025 +0000

    drm/xe: Remove duplicate DRM_EXEC selection from Kconfig
    
    There are 2 identical "select DRM_EXEC" lines for DRM_XE.
    Remove one to clean up the configuration.
    
    Fixes: d490ecf57790 ("drm/xe: Rework xe_exec and the VM rebind worker to use the drm_exec helper")
    Cc: Thomas Hellström 
    Cc: Lucas De Marchi 
    Signed-off-by: Shuicheng Lin 
    Reviewed-by: Nitin Gote 
    Reviewed-by: Lucas De Marchi 
    Link: https://patch.msgid.link/20251110232657.1807998-2-shuicheng.lin@intel.com
    Signed-off-by: Lucas De Marchi 

commit 9be4f0f687048ba77428ceca11994676736507b7
Author: Matt Roper 
Date:   Thu Nov 13 15:40:39 2025 -0800

    drm/xe/kunit: Fix forcewake assertion in mocs test
    
    The MOCS kunit test calls KUNIT_ASSERT_TRUE_MSG() with a condition of
    'true;' this prevents the assertion from ever failing.  Replace
    KUNIT_ASSERT_TRUE_MSG with KUNIT_FAIL_AND_ABORT to get the intended
    failure behavior in cases where forcewake was not acquired successfully.
    
    Fixes: 51c0ee84e4dc ("drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs")
    Cc: Tejas Upadhyay 
    Cc: Gustavo Sousa 
    Reviewed-by: Lucas De Marchi 
    Reviewed-by: Gustavo Sousa 
    Link: https://patch.msgid.link/20251113234038.2256106-2-matthew.d.roper@intel.com
    Signed-off-by: Matt Roper 

commit 562b0f254d8b1515a1c8d2a650f940d4f719300e
Author: Michał Winiarski 
Date:   Fri Nov 14 14:40:30 2025 +0100

    drm/xe/pf: Fix kernel-doc warning in migration_save_consume
    
    The kernel-doc for xe_sriov_pf_migration_save_consume() contained
    multiple "Return:" sections, causing a warning.
    Fix it by removing the extra line.
    
    Fixes: 67df4a5cbc583 ("drm/xe/pf: Add data structures and handlers for migration rings")
    Signed-off-by: Michał Winiarski 
    Reviewed-by: Michal Wajdeczko 
    Link: https://patch.msgid.link/20251114134030.1795947-1-michal.winiarski@intel.com
    Signed-off-by: Lucas De Marchi 

commit 8f565bdd14eec5611cc041dba4650e42ccdf71d9
Author: Shuicheng Lin 
Date:   Wed Nov 12 18:10:06 2025 +0000

    drm/xe: Prevent BIT() overflow when handling invalid prefetch region
    
    If user provides a large value (such as 0x80) for parameter
    prefetch_mem_region_instance in vm_bind ioctl, it will cause
    BIT(prefetch_region) overflow as below:
    "
     ------------[ cut here ]------------
     UBSAN: shift-out-of-bounds in drivers/gpu/drm/xe/xe_vm.c:3414:7
     shift exponent 128 is too large for 64-bit type 'long unsigned int'
     CPU: 8 UID: 0 PID: 53120 Comm: xe_exec_system_ Tainted: G        W           6.18.0-rc1-lgci-xe-kernel+ #200 PREEMPT(voluntary)
     Tainted: [W]=WARN
     Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023
     Call Trace:
      
      dump_stack_lvl+0xa0/0xc0
      dump_stack+0x10/0x20
      ubsan_epilogue+0x9/0x40
      __ubsan_handle_shift_out_of_bounds+0x10e/0x170
      ? mutex_unlock+0x12/0x20
      xe_vm_bind_ioctl.cold+0x20/0x3c [xe]
     ...
    "
    Fix it by validating prefetch_region before the BIT() usage.
    
    v2: Add Closes and Cc stable kernels. (Matt)
    
    Reported-by: Koen Koning 
    Reported-by: Peter Senna Tschudin 
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6478
    Cc:  # v6.8+
    Reviewed-by: Matthew Auld 
    Signed-off-by: Shuicheng Lin 
    Signed-off-by: Matthew Auld 
    Link: https://patch.msgid.link/20251112181005.2120521-2-shuicheng.lin@intel.com

commit b2bce0e551e89af37cfcb1b1158d80f369eeea3f
Author: Xin Wang 
Date:   Mon Nov 10 22:14:58 2025 +0000

    drm/xe/pat: Add helper to query compression enable status
    
    Add xe_pat_index_get_comp_en() helper function to check whether
    compression is enabled for a given PAT index by extracting the
    XE2_COMP_EN bit from the PAT table entry.
    
    There are no current users, however there are multiple in-flight series
    which will all use this helper.
    
    CC: Nitin Gote 
    CC: Sanjay Yadav 
    CC: Matt Roper 
    Suggested-by: Matthew Auld 
    Signed-off-by: Xin Wang 
    Reviewed-by: Matt Roper 
    Reviewed-by: Nitin Gote 
    Reviewed-by: Matthew Auld 
    Reviewed-by: Sanjay Yadav 
    Signed-off-by: Matthew Auld 
    Link: https://patch.msgid.link/20251110221458.1864507-2-x.wang@intel.com

commit 7cd7392a07782b8ad4aa6360e4be1967af2eab04
Author: Alok Singh 
Date:   Mon Nov 10 16:07:13 2025 +0530

    wifi: ath12k: Remove Wi-Fi 7 header dependencies from common ath12k module
    
    Remove all remaining Wi-Fi 7 header dependencies from dp_mon.c to
    finalize separation of Wi-Fi 7 specific monitor mode functionality.
    
    Remove these includes from dp_mon.c:
    - wifi7/hal_desc.h
    - wifi7/hal_qcn9274.h
    - wifi7/dp_rx.h
    
    Relocate hal_mon_buf_ring from wifi7/hal_desc.h to hal.h.
    
    Relocate HAL_RX_UL_OFDMA_USER_INFO_V0_W0_VALID and HAL_RX_FCS_LEN
    macros from wifi7/hal_rx.h to hal.h or dp_rx.h as appropriate.
    
    Move the following functions to the new file wifi7/dp_mon.c
    and add the ath12k_wifi7 prefix:
    - ath12k_dp_mon_rx_merg_msdus()
    - ath12k_dp_mon_update_radiotap()
    - ath12k_dp_mon_rx_deliver_msdu()
    - ath12k_dp_mon_get_buf_len()
    - ath12k_dp_mon_rx_deliver()
    
    Export several helper functions needed by the ath12k_wifi7 module.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-13-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 965aea91545a03cc14439ebe57519497925f5ad4
Author: Alok Singh 
Date:   Mon Nov 10 16:07:12 2025 +0530

    wifi: ath12k: Move MSDU END TLV processing to Wi-Fi 7 module
    
    Separate Wi-Fi 7-specific monitor handling from ath12k common code to
    improve modularity.
    
    Move the following MSDU END TLV processing functions into wifi7/dp_mon.c
    and rename them with the ath12k_wifi7_ prefix:
    - ath12k_dp_mon_parse_rx_msdu_end_err()
    - ath12k_dp_mon_parse_status_msdu_end()
    - ath12k_dp_mon_next_link_desc_get()
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-12-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 5db19c48841397c5b5732a1aeb81fc6cdcdfc5c2
Author: Alok Singh 
Date:   Mon Nov 10 16:07:11 2025 +0530

    wifi: ath12k: Move MU user processing to Wi-Fi 7 module
    
    Move Wi-Fi 7-specific monitor functionality out of ath12k common code
    into the Wi-Fi 7 module to improve modularity.
    
    Move and rename the following MU user processing functions to
    wifi7/dp_mon.c with the ath12k_wifi7_ prefix:
    - ath12k_dp_mon_rx_handle_ofdma_info()
    - ath12k_dp_mon_rx_populate_mu_user_info()
    - ath12k_dp_mon_hal_rx_parse_user_info()
    
    Move the helper functions hal_rx_mon_hal_ru_size_to_ath12k_ru_size and
    hal_rx_ul_ofdma_ru_size_to_width to the Wi-Fi 7 module, and export the
    helpers required by the ath12k_wifi7 code. Isolate the parsing of
    MU-specific user information within the Wi-Fi 7 module to keep
    common code generic.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-11-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit e5419861e4155ae32d739308e713f7bf6663d632
Author: Alok Singh 
Date:   Mon Nov 10 16:07:10 2025 +0530

    wifi: ath12k: Move remaining SIG TLV parsing to Wi-Fi 7 module
    
    The ath12k common monitor path still contains Wi-Fi 7 specific
    SIG TLV parsing. Move these SIG TLV parsing to the Wi-Fi 7
    module to improve modularity.
    
    Relocate the following functions into wifi7/dp_mon.c and
    rename them with the ath12k_wifi7_ prefix:
    - ath12k_dp_mon_parse_l_sig_b()
    - ath12k_dp_mon_parse_l_sig_a()
    - ath12k_dp_mon_hal_rx_parse_u_sig_cmn()
    - ath12k_dp_mon_hal_rx_parse_u_sig_tb()
    - ath12k_dp_mon_hal_rx_parse_u_sig_mu()
    - ath12k_dp_mon_hal_rx_parse_u_sig_hdr()
    
    Export the helper symbols needed by the Wi-Fi 7 module.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-10-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 00b67b7c44b47b6ace2291e903d21ea7b6261179
Author: Alok Singh 
Date:   Mon Nov 10 16:07:09 2025 +0530

    wifi: ath12k: Move EHT SIG processing to Wi-Fi 7 module
    
    Split Wi-Fi 7 specific EHT SIG parsing out of ath12k common
    code into the Wi-Fi 7 module to improve modularity.
    
    Move the following EHT SIG processing functions to wifi7/dp_mon.c and
    add the ath12k_wifi7 prefix to each relocated function.
    - ath12k_dp_mon_hal_aggr_tlv()
    - ath12k_dp_mon_hal_rx_is_frame_type_ndp()
    - ath12k_dp_mon_hal_rx_is_non_ofdma()
    - ath12k_dp_mon_hal_rx_is_ofdma()
    - ath12k_dp_mon_hal_rx_parse_eht_sig_ndp()
    - ath12k_dp_mon_hal_rx_parse_usig_overflow()
    - ath12k_dp_mon_hal_rx_parse_non_ofdma_users()
    - ath12k_dp_mon_hal_rx_parse_eht_mumimo_user()
    - ath12k_dp_mon_hal_rx_parse_eht_non_mumimo_user()
    - ath12k_dp_mon_hal_rx_is_mu_mimo_user()
    - ath12k_dp_mon_hal_rx_parse_eht_sig_non_ofdma()
    - ath12k_dp_mon_hal_rx_parse_ru_allocation()
    - ath12k_dp_mon_hal_rx_parse_eht_sig_ofdma()
    - ath12k_dp_mon_parse_eht_sig_hdr()
    
    Export helper functions needed by the ath12k_wifi7 module.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-9-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit dde5748c2940b4b47bba9c42e086a90fbe43b5ea
Author: Alok Singh 
Date:   Mon Nov 10 16:07:08 2025 +0530

    wifi: ath12k: Move HE SIG processing to Wi-Fi 7 module
    
    Separate Wi-Fi 7-specific monitor code from ath12k common code to
    improve modularity.
    
    Move following HE SIG processing functions to the wifi7/dp_mon.c and
    rename the relocated functions with the ath12k_wifi7 prefix:
    - ath12k_dp_mon_parse_he_sig_b2_ofdma()
    - ath12k_dp_mon_parse_he_sig_b2_mu()
    - ath12k_dp_mon_parse_he_sig_b1_mu()
    - ath12k_dp_mon_parse_he_sig_mu()
    - ath12k_dp_mon_parse_he_sig_su()
    
    Export helper functions required by the ath12k_wifi7 module.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-8-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit f4bcbaebf4112c8f6320e208b67b2281dad5d5e1
Author: Alok Singh 
Date:   Mon Nov 10 16:07:07 2025 +0530

    wifi: ath12k: Move HT/VHT SIG processing to Wi-Fi 7 module
    
    Separate Wi-Fi 7-specific monitor parsing from ath12k common code
    to improve modularity and keep Wi-Fi 7 logic within the Wi-Fi 7 module.
    
    Move following HT/VHT SIG parsing functions to wifi7/dp_mon.c and
    rename the functions with the ath12k_wifi7 prefix:
    - ath12k_dp_mon_parse_vht_sig_a()
    - ath12k_dp_mon_parse_ht_sig()
    
    Export helper functions required by the ath12k_wifi7 module.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-7-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 52758ff7b50a7d8b06d23c7f2a42ae85b559f682
Author: Alok Singh 
Date:   Mon Nov 10 16:07:06 2025 +0530

    wifi: ath12k: Move TX monitor functionality to Wi-Fi 7 module
    
    Separate Wi-Fi 7-specific TX monitor functionality from ath12k
    common code to improve modularity and maintainability.
    
    Move following TX monitor processing functions to wifi7/dp_mon.c and
    rename the functions with the ath12k_wifi7_ prefix:
    - ath12k_dp_mon_tx_get_ppdu_info()
    - ath12k_dp_mon_hal_tx_ppdu_info()
    - ath12k_dp_mon_tx_alloc_skb()
    - ath12k_dp_mon_tx_gen_cts2self_frame()
    - ath12k_dp_mon_tx_gen_rts_frame()
    - ath12k_dp_mon_tx_gen_3addr_qos_null_frame()
    - ath12k_dp_mon_tx_gen_4addr_qos_null_frame()
    - ath12k_dp_mon_tx_gen_ack_frame()
    - ath12k_dp_mon_tx_gen_prot_frame()
    - ath12k_dp_mon_tx_parse_status_tlv()
    - ath12k_dp_mon_tx_status_get_num_user()
    - ath12k_dp_mon_tx_process_ppdu_info()
    - ath12k_dp_mon_tx_parse_mon_status()
    
    Export helper functions required by the ath12k_wifi7 module.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-6-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit e475119ba2510c66138261d72d797e63c73eea02
Author: Alok Singh 
Date:   Mon Nov 10 16:07:05 2025 +0530

    wifi: ath12k: Move RX status TLV parsing to Wi-Fi 7 module
    
    Split Wi-Fi 7-specific monitor code out of ath12k common code
    to improve modularity.
    
    Move following RX status TLV parsing functions to the new file
    wifi7/dp_mon.c and rename the helpers with the ath12k_wifi7_ prefix:
    - ath12k_dp_mon_rx_parse_status_tlv()
    - ath12k_dp_mon_parse_rx_dest_tlv()
    
    Export helper functions required by the Wi-Fi 7 module.
    
    Temporarily include wifi7/hal_rx.h from dp_mon.h to provide
    HAL structure definitions; remove this dependency in a later patch.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-5-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 906b5ac9c2b5dd2512a515b0c74a6905973fba04
Author: Alok Singh 
Date:   Mon Nov 10 16:07:04 2025 +0530

    wifi: ath12k: Move MPDU pop functionality to Wi-Fi 7 module
    
    Separate Wi-Fi 7-specific monitor code from ath12k common
    code to improve modularity.
    
    Move the following monitor MPDU pop function to the new
    file wifi7/dp_mon.c and rename them with the ath12k_wifi7_ prefix:
    - ath12k_dp_rx_mon_mpdu_pop()
    
    Export helper functions required by the ath12k_wifi7 module.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-4-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit e00164657ce8a347a24d49a4aa4dd96aaf50a580
Author: Alok Singh 
Date:   Mon Nov 10 16:07:03 2025 +0530

    wifi: ath12k: Move monitor status processing to Wi-Fi 7 module
    
    Split Wi-Fi 7-specific monitor status processing out of ath12k common
    code and into the Wi-Fi 7 module to improve modularity.
    
    Move the following functions to wifi7/dp_mon.c and rename them with the
    ath12k_wifi7_ prefix:
    - ath12k_dp_mon_rx_parse_mon_status()
    - ath12k_dp_rx_reap_mon_status_ring()
    - ath12k_dp_mon_parse_rx_dest()
    - ath12k_dp_rx_mon_buf_done()
    - ath12k_dp_rx_mon_dest_process()
    - ath12k_dp_mon_rx_memset_ppdu_info()
    
    Export helper functions required by the Wi-Fi 7 monitor path.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-3-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 24b21a9be2c999b51aaec50ede4b2ca1dffb0ebd
Author: Alok Singh 
Date:   Mon Nov 10 16:07:02 2025 +0530

    wifi: ath12k: Move monitor ring processing to Wi-Fi 7 module
    
    Separate Wi-Fi 7-specific monitor-mode processing from common
    ath12k data path code to improve modularity.
    
    Move monitor status ring processing to wifi7/dp_mon.c:
    - ath12k_dp_mon_srng_process()
    - __ath12k_dp_mon_process_ring()
    - ath12k_dp_mon_process_ring()
    
    Rename the above to use the ath12k_wifi7_ prefix and
    export helper functions required by the ath12k_wifi7 module.
    Update the Wi-Fi 7 module Makefile to build dp_mon.o.
    
    No functional changes are intended; this is preparatory refactoring
    to isolate Wi-Fi 7 monitor-mode code from shared ath12k code.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Alok Singh 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251110103713.3484779-2-quic_aloksing@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 37c3a91e9730e274fe2eca9703033ae0f154cb62
Author: Stanimir Varbanov 
Date:   Fri Oct 31 20:33:09 2025 +0200

    arm64: dts: broadcom: bcm2712: Add watchdog DT node
    
    Add watchdog device-tree node for bcm2712 SoC.
    
    Signed-off-by: Stanimir Varbanov 
    Link: https://lore.kernel.org/r/20251031183309.1163384-5-svarbanov@suse.de
    Signed-off-by: Florian Fainelli 

commit dff552ac9cdaa94b6d10d8707c8c24255a4cbdb0
Author: Peter Robinson 
Date:   Sat Sep 27 08:56:31 2025 +0100

    arm64: dts: broadcom: bcm2712: Enable RNG
    
    The RNG is the same IP as in the bcm2711 so add the
    device tree block to enable the device.
    
    Signed-off-by: Peter Robinson 
    Reviewed-by: Stefan Wahren 
    Link: https://lore.kernel.org/r/20250927075643.716179-1-pbrobinson@gmail.com
    Signed-off-by: Florian Fainelli 

commit f87034a7576f918f2e60a14f17185b492e91580d
Author: Ripan Deuri 
Date:   Mon Nov 3 16:51:11 2025 +0530

    wifi: ath12k: Replace lock/unlock with guard()
    
    Use guard(wiphy)(...) and guard(spinlock_bh)(...) in:
    
    ath12k_dbg_sta_dump_rx_stats()
    ath12k_mac_op_link_sta_statistics()
    
    The guard() API ensures locks are automatically released when the scope
    exits, reducing the risk of missing unlocks in error paths and improving
    code readability.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-13-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 96b42732bc75de66c5e10c67d6a60967004ceead
Author: Pavankumar Nandeshwar 
Date:   Mon Nov 3 16:51:10 2025 +0530

    wifi: ath12k: Use dp objects in performance critical paths
    
    Use dp objects in tx and rx data paths in place of other objects to minimize
    pointer indirections and increase the cache efficiency in the data paths.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-12-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 219dd14992fca65c33666712939f6bdf001722e2
Author: Pavankumar Nandeshwar 
Date:   Mon Nov 3 16:51:09 2025 +0530

    wifi: ath12k: Build all the files in wifi7 directory into ath12k_wifi7.ko
    
    Move files built as part of ath12k.ko from wifi7 directory to ath12k_wifi7.ko.
    Export necessary symbols from ath12k.ko and remove redundant exports from
    the wifi7 directory, as they are no longer needed.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-11-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 951cca9cc68d67ff572db9de32a810a16d9bc1ad
Author: Pavankumar Nandeshwar 
Date:   Mon Nov 3 16:51:08 2025 +0530

    wifi: ath12k: Remove arch-specific HAL dependencies from common DP
    
    Currently common DP includes arch-specific structs from wifi7/hal_desc.h
    via dp_mon.h. Store hal_wbm_release_ring_tx size in the HAL object and move
    hal_wbm_link_desc to common HAL for this separation.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-10-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 147daefc59f007966b92e510b063d407850f2278
Author: Pavankumar Nandeshwar 
Date:   Mon Nov 3 16:51:07 2025 +0530

    wifi: ath12k: Move ath12k_dp_rx_get_peer_id API to Wi-Fi 7
    
    Move ath12k_dp_rx_get_peer_id() from common to Wi-Fi 7 as it operates on
    arch specific peer metadata.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-9-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit d43133a38b0ccc5e53b9efd9aa30f29f9db0b57c
Author: Pavankumar Nandeshwar 
Date:   Mon Nov 3 16:51:06 2025 +0530

    wifi: ath12k: Move ath12k_dp_rx_frags_cleanup API to Wi-Fi 7
    
    The API ath12k_dp_rx_frags_cleanup uses rx hw structure that is specific to
    Wi-Fi 7. Hence move the API to Wi-Fi 7 and use ops infra to reach it from the
    common code.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-8-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit c870602510242527813843115edd31b20db06702
Author: Pavankumar Nandeshwar 
Date:   Mon Nov 3 16:51:05 2025 +0530

    wifi: ath12k: Remove the wifi7 header inclusions in common code
    
    As a precursor to the movement of wifi7 specific .c files to
    ath12k_wifi7.ko module, remove the wifi7 headers included
    in the common .c files except for dp_mon.c file, as the changes
    for moving the code from common to wifi7 directory for monitor
    will be coming incrementally.
    
    Since, dp_mon.c continues to be part of ath12k.ko module,
    add a few callbacks in hal_ops to facilitate calls from
    dp_mon.c to reach hal APIs present in ath12k_wifi7.ko module
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-7-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit c26f294fef2a4bf8c456e3d212bd7e1bd698efda
Author: Ripan Deuri 
Date:   Mon Nov 3 16:51:04 2025 +0530

    wifi: ath12k: Move ieee80211_ops callback to the arch specific module
    
    Move the ieee80211_ops Tx callback to the architecture-specific module
    to avoid additional indirections caused by the common Tx function calling
    the architecture-specific Tx functions via ops.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-6-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 05774dffb974cef9fa48ee23a2f604396c96df3b
Author: Pavankumar Nandeshwar 
Date:   Mon Nov 3 16:51:03 2025 +0530

    wifi: ath12k: Add helper to free DP link peer
    
    Introduce ath12k_dp_link_peer_free() to wrap cleanup steps required before
    freeing a DP link peer. This avoids code duplication and ensures consistent
    teardown across multiple call flows.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-5-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 35fcf4fa196c9e30012b32a05c65762d5552a712
Author: Harsh Kumar Bijlani 
Date:   Mon Nov 3 16:51:02 2025 +0530

    wifi: ath12k: Move DP specific link stats to DP link peer
    
    As part of peer modularization in the Driver Framework, the station view is as
    follows:
    
                Common Path                      Data Path
        -------------------------------------------------------------------
        ath12k_sta                           ath12k_dp_peer
            |                                       |
            |-> ath12k_link_sta    <---->           |-> ath12k_dp_link_peer
            |                                       |
            |-> ath12k_link_sta    <---->           |-> ath12k_dp_link_peer
            |                                       |
            |-> ath12k_link_sta    <---->           |-> ath12k_dp_link_peer
    
    Currently ath12k_link_sta has data path stats updated in tx_htt and rx monitor
    path. Move those stats from ath12_link_sta to ath12k_dp_link_peer to align with
    peer modularization model as shown above.
    
    This allows datapath to use only ath12k_dp_link_peer without having to reach out
    to other objects for updating stats, thereby improving the cache locality.
    
    Add following API to fetch rate info from DP link peer:
    
            ath12k_dp_link_peer_get_sta_rate_info_stats()
    
    This wrapper API populates link stats in 'struct ath12k_dp_link_peer_rate_info',
    which can be extended to support out-of-band retrieval of various rate stats.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-4-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 775fe5acc18df4de4bad774faa50c88ee65882eb
Author: Pavankumar Nandeshwar 
Date:   Mon Nov 3 16:51:01 2025 +0530

    wifi: ath12k: Move DP device stats to ath12k_dp
    
    As part of data path modularization of device object framework, the per packet
    tx/rx operations now use ath12k_dp. Move all the device stats 'device_stats'
    from ath12k_base to ath12k_dp, consolidating all device stats within ath12k_dp.
    This would improve the performance by allowing the datapath to reach to the
    stats counters without to having to reach out to ath12k_base object.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-3-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 73c928346d095533ac56569bdd57c55d3ca81c3f
Author: Pavankumar Nandeshwar 
Date:   Mon Nov 3 16:51:00 2025 +0530

    wifi: ath12k: Add callbacks in arch_ops for rx APIs
    
    Facilitate modular and architecture-agnostic access to Wi-Fi 7 Rx functionality
    by introducing wrapper APIs in common module for existing RX callbacks already
    defined in arch_ops.
    
    Also remove redundant ar usage in these APIs and registered callbacks
    definitions, and change the callback names of few of the APIs to remove the
    redundant usage of "dp".
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Karthikeyan Periyasamy 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251103112111.2260639-2-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 6633dca572d8f599b0a1ead0f145a52049ec7709
Author: Ripan Deuri 
Date:   Fri Oct 24 23:45:48 2025 +0530

    wifi: ath12k: Add lockdep warn for RCU
    
    Add RCU_LOCKDEP_WARN() in following functions:
    
      - ath12k_dp_link_peer_to_link_sta()
      - ath12k_wifi7_dp_rx_h_mpdu()
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251024181548.3255166-10-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 11157e0910fdc9ab8077af69fd4496b80d7c39a0
Author: Harsh Kumar Bijlani 
Date:   Fri Oct 24 23:45:47 2025 +0530

    wifi: ath12k: Use ath12k_dp_peer in per packet Tx & Rx paths
    
    Move link agnostic data path parameters (keys, rx_tid, reorder buffers, MIC
    context etc) from ath12k_sta and ath12k_dp_link_peer into ath12k_dp_peer. These
    parameters are shared across MLO links and should be managed at the peer level.
    Configure them only when the link peer is primary to avoid redundancy and ensure
    consistent setup.
    
    Switch per-packet Tx/Rx paths and monitor paths to look up ath12k_dp_peer and
    ath12k_dp_link_peer via peer_id.
    
    Helper APIs added:
     - ath12k_dp_peer_find_by_peerid()
     - ath12k_dp_link_peer_find_by_peerid()
    
    Ensure RCU read lock is held when using these helpers APIs.
    
    With the above API ath12k_dp_link_peer_find_by_peerid() being used to find
    ath12k_dp_link_peer, existing API ath12k_dp_link_peer_find_by_id() is required
    only at the time of unmap event from firmware since it fetches the
    ath12k_dp_link_peer from linked list.
    
    In order to restrict the usage of API ath12k_dp_link_peer_find_by_id(), make it
    static and also rename it to ath12k_dp_link_peer_search_by_id().
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251024181548.3255166-9-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 5525f12fa671a007c6c6044c861eee86de71b576
Author: Harsh Kumar Bijlani 
Date:   Fri Oct 24 23:45:46 2025 +0530

    wifi: ath12k: Attach and detach ath12k_dp_link_peer to ath12k_dp_peer
    
    Introduce explicit attach/detach of ath12k_dp_link_peer objects to their parent
    ath12k_dp_peer to formalize the data path station hierarchy:
    
        ath12k_dp_peer
           |
           |--> ath12k_dp_link_peer
           |
           |--> ath12k_dp_link_peer
           |
           |--> ath12k_dp_link_peer
    
    ath12k_dp_peer maintains an array of RCU-protected pointers
    "link_peers[ATH12K_NUM_MAX_LINKS]" to ath12k_dp_link_peer indexed by its
    protocol_link_id, and each ath12k_dp_link_peer holds a back pointer to its
    parent ath12k_dp_peer.
    
    Attach is performed after link peer creation, and detach occurs before link peer
    deletion. This ensures consistent lifetime management and safe concurrent
    access.
    
    ath12k_dp_peer also maintains an array "hw_links[ATH12K_GROUP_MAX_RADIO]" to
    store the mapping between hw_link_id and protocol_link_id for each of the
    ath12k_dp_link_peer.
    
    RCU locking/unlocking rules:
    - Readers must hold rcu_read_lock() and fetch the pointer with
      rcu_dereference(dp_peer->link[link_id]); drop with rcu_read_unlock() when
      done.
    - Writers publish with rcu_assign_pointer() and reclaim only after
      synchronize_rcu().
    
    Handle the case of detachment of link peer from ath12k_dp_peer in case of core
    reset.
    
    Ensure the following order of locks to be followed for attach and detach:
    - Lock dp->dp_lock
       - Lock dp_hw->peer_lock
       - Unlock dp_hw->peer_lock
    - Unlock dp->dp_lock
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251024181548.3255166-8-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit ee16dcf573d5e3283fda601dd4bca6bc52251017
Author: Harsh Kumar Bijlani 
Date:   Fri Oct 24 23:45:45 2025 +0530

    wifi: ath12k: Define ath12k_dp_peer structure & APIs for create & delete
    
    Define the structure of ath12k_dp_peer and also define APIs for creation and
    deletion of ath12k_dp_peer based on STA state, as the ath12k_dp_peer is intended
    to be used in the subsequent set of patches.
    
    Maintain ath12k_dp_peer in a linked list in ath12k_dp_hw (which is a datapath
    component of ath12k_hw) and protect this list using spinlock "peer_lock".
    
    Store peer id based table (array of RCU pointers) of ath12k_dp_peer in
    ath12k_dp_hw. Use this peer id table to refer in the per packet Tx and Rx paths
    as it provides faster access to ath12k_dp_peer in comparison to linked list
    iterative search using peer id or mac address.
    
    Add support to handle deletion of ath12k_dp_peer in case of core reset.
    
    This patch is adding and deleting ath12k_dp_peer created for MLO STA to the
    above mentioned RCU pointer table. Addition and deletion of ath12k_dp_peer for
    non-MLO STA to RCU pointer table is handled in the subsequent following patch.
    
    Structure ath12k_ml_peer is created and deleted for MLO peers at the time
    of connect and disconnect and there is no other use case of it. With the
    above design in place for ath12k_dp_peer, ath12k_ml_peer becomes redundant.
    Hence, remove the structure ath12k_ml_peer and the list "ml_peers" present
    in ath12k_hw maintaining linked list of ath12k_ml_peer.
    
    APIs removed:
     - ath12k_peer_ml_find()
     - ath12k_peer_ml_create()
     - ath12k_peer_ml_delete()
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251024181548.3255166-7-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit a88cf5f71adfc5e7412a505ee0077628231c6d80
Author: Harsh Kumar Bijlani 
Date:   Fri Oct 24 23:45:44 2025 +0530

    wifi: ath12k: Add hash table for ath12k_dp_link_peer
    
    There is a linked list of ath12k_dp_link_peer maintained in ath12k_dp. For
    link peer search based on mac address, there is iteration over the list wherein
    the mac address are compared for each entry in the list. This search operation
    is a costly operation considering the time complexity involved.
    
    In order to reduce the complexity, add hash table for ath12k_dp_link_peer in
    ath12k_dp where mac address of the link peer is used to derive the hash index.
    This hash table is lock protected by spinlock "dp_lock" present in ath12k_dp.
    
    This hash table is currently used for search of link peer using mac address for
    any interaction between control path and data path, per packet Rx monitor path
    and regular multicast Tx path.
    
    Update API ath12k_dp_link_peer_find_by_addr() to make use of the hash table for
    search operation using mac address, while other search APIs still rely on linked
    list.
    
    ath11k driver has been taken as reference for implementation of hash table.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251024181548.3255166-6-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 0cafe8cc85665f29b28891f4b921bef1854c2e99
Author: Harsh Kumar Bijlani 
Date:   Fri Oct 24 23:45:43 2025 +0530

    wifi: ath12k: Move ath12k_dp_link_peer list from ath12k_base to ath12k_dp
    
    ath12k_base maintains a linked list of ath12k_dp_link_peer. This linked list is
    used for all kind of peer search operations.
    
    With the modularization of device and peer objects for ath12k next-generation
    driver, ath12k_dp_link_peer and ath12k_dp are exclusively meant for datapath
    related operations.
    
    Hence move ath12k_dp_link_peer linked list from ath12k_base to ath12k_dp. This
    linked list is to be lock protected by newly introduced spinlock "dp_lock"
    defined in ath12k_dp as this list can be concurrently accessed in different
    contexts for insert, delete and search operations.
    
    With the above changes, update following APIs to make use of lock "dp->dp_lock"
    instead of lock "ab->base_lock" and also update API signatures to pass ath12k_dp
    pointer instead of ath12k_base pointer as the function argument.
    
      ath12k_dp_link_peer_find_by_vdev_and_addr()
      ath12k_dp_link_peer_find_by_id()
      ath12k_dp_link_peer_find_by_ast()
      ath12k_dp_link_peer_find_by_pdev__and_addr()
      ath12k_dp_link_peer_find_by_ml_id()
      ath12k_dp_link_peer_find_by_addr()
      ath12k_dp_rx_h_find_link_peer()
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251024181548.3255166-5-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 57ccca410237285f8f25a988655e6910cadc63f2
Author: Harsh Kumar Bijlani 
Date:   Fri Oct 24 23:45:42 2025 +0530

    wifi: ath12k: Add hash table for ath12k_link_sta in ath12k_base
    
    Currently ath12k_base maintains a linked list of ath12k_dp_link_peer as "peers".
    This linked list is used for all kinds of peer search operations.
    
    In the control path, if there is a requirement to search for ath12k_link_sta
    using mac address, then below sequence is to be followed:
      1. Find ath12k_dp_link_peer in the linked list using mac address
      2. Fetch ieee80211_sta from ath12k_dp_link_peer
      3. Fetch ath12k_sta from ieee80211_sta
      4. Finally fetch ath12k_link_sta from ath12k_sta using link_id
    
    In the above sequence, there are too many indirections involved.
    
    In order to simplify this, add hash table for ath12k_link_sta in ath12k_base.
    This hash table is lock protected by existing spinlock "base_lock" in
    ath12k_base as this table can be concurrently accessed in different contexts.
    
    Use this table for ath12k_link_sta search operations using mac address in the
    control path.
    Ex: For WMI interface and mac80211_ops interface in the control path, sta mac
    address is received and this hash table can be used to search for
    ath12k_link_sta directly instead of following the longer route mentioned above.
    
    Helper APIs added:
     - ath12k_link_sta_rhash_add() - To add arsta entry to hash table
     - ath12k_link_sta_rhash_delete() - To remove arsta entry from hash table
     - ath12k_link_sta_find_by_addr() - To find arsta from hash table using
                                        mac address
    
    Make changes in API ath12k_peer_sta_kickout_event() to find arsta using above
    mechanism.
    
    ath11k driver has been taken as reference for implementation of hash table.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251024181548.3255166-4-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 9e0b56a33384c670501632810634553a767912d5
Author: Harsh Kumar Bijlani 
Date:   Fri Oct 24 23:45:41 2025 +0530

    wifi: ath12k: Rename ath12k_peer to ath12k_dp_link_peer
    
    Rename ath12k_peer to ath12k_dp_link_peer for all instances and rename the
    following find APIs accordingly to reflect the API names as per the structural
    name change.
    
    APIs renamed:
      ath12k_peer_find()
      ath12k_peer_find_by_pdev_idx()
      ath12k_peer_find_by_addr()
      ath12k_peer_find_by_ml_id()
      ath12k_peer_find_by_id()
      ath12k_peer_find_by_ast()
      ath12k_peer_exist_by_vdev_id()
      ath12k_peer_get_link_sta()
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251024181548.3255166-3-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 07174dc94269758e271cba01680a8fecf35169dd
Author: Harsh Kumar Bijlani 
Date:   Fri Oct 24 23:45:40 2025 +0530

    wifi: ath12k: Move DP related functions from peer.c to dp_peer.c file
    
    Refactor the structures and APIs defined in files peer.h and peer.c in such a
    way that the APIs making use of ath12k_peer are moved to newly introduced files
    dp_peer.h and dp_peer.c.
    
    Have this new file dp_peer.c compiled as part of kernel module ath12k.ko.
    
    Move these APIs from peer.h and peer.c to dp_peer.h and dp_peer.c:
      ath12k_peer_find()
      ath12k_peer_find_by_pdev_idx()
      ath12k_peer_find_by_addr()
      ath12k_peer_find_by_ml_id()
      ath12k_peer_find_by_id()
      ath12k_peer_exist_by_vdev_id()
      ath12k_peer_find_by_ast()
      ath12k_peer_unmap_event()
      ath12k_peer_map_event()
      ath12k_peer_get_link_sta()
    
    Background:
    
    In current ath12k architecture, connected station is represented by struct
    ath12k_sta.
    
    struct ath12k_sta has an array of struct ath12k_link_sta wherein each index
    represents one link of the connected station.
    
    For each ath12k_link_sta, there is a corresponding data path peer which is
    represented by struct ath12k_peer.
    
    Diagrammatic view of the station is as below:
    
            ath12k_sta
                |
                |-> ath12k_link_sta <--> ath12k_peer
                |
                |-> ath12k_link_sta <--> ath12k_peer
                |
                |-> ath12k_link_sta <--> ath12k_peer
    
    Currently, in control path, ath12k_link_sta and ath12k_peer are used
    interchangeably, while the data path makes use of ath12k_peer only.
    
    For ath12k next-generation driver framework, in order to have a clean
    segregation between control and data path, use ath12k_link_sta only for control
    path operations.
    
    Station view for the data path is revamped as below:
    
            ath12k_dp_peer
                   |
                   |-> ath12k_dp_link_peer
                   |
                   |-> ath12k_dp_link_peer
                   |
                   |-> ath12k_dp_link_peer
    
    Introduce the structure ath12k_dp_peer to represent the data path version of
    corresponding ath12k_sta.
    
    This ath12k_dp_peer contains the fields used in the per packet Tx Rx paths
    applicable across all the links and maintains an array of ath12k_dp_link_peer.
    Per packet Tx and Rx path operates on ath12k_dp_peer. This ath12k_dp_peer is a
    standalone new object and has back pointer reference to ieee80211_sta.
    
    Rename ath12k_peer to ath12k_dp_link_peer and move the fields which are common
    across all the links to ath12k_dp_peer.
    
    Add the fields specific to a link which are mostly for statistics and monitor
    usage to ath12k_dp_link_peer.
    
    Final view of station in ath12k next-generation driver is shown as below:
    
                Control Path                            Data Path
            -------------------------------------------------------------------
            ath12k_sta                            ath12k_dp_peer
                |                                       |
                |-> ath12k_link_sta    <---->           |-> ath12k_dp_link_peer
                |                                       |
                |-> ath12k_link_sta    <---->           |-> ath12k_dp_link_peer
                |                                       |
                |-> ath12k_link_sta    <---->           |-> ath12k_dp_link_peer
    
    This patch and the subsequent patches in this series are meant to achieve the
    modularization of peer object as mentioned above.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20251024181548.3255166-2-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 25122460e7f96864a80b59ffe6c953911516d3b3
Author: Ripan Deuri 
Date:   Thu Oct 9 16:40:45 2025 +0530

    wifi: ath12k: Drop hal_ prefix from hardware register names
    
    Remove the hal_ prefix from hardware register names in ath12k_hw_regs
    as the registers have been moved from ab->regs to hal->regs.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-19-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 49ba5debad420506eef9fcef38d1fdce41010901
Author: Ripan Deuri 
Date:   Thu Oct 9 16:40:44 2025 +0530

    wifi: ath12k: Rename hal_ops to ops
    
    Rename the hal_ops member in the HAL context to ops. The prefix is
    dropped to avoid redundancy, as the structure already resides within
    the HAL context.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-18-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 6250af6073092f25bd2c104156e0808c03adb5b9
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:43 2025 +0530

    wifi: ath12k: Remove the unused ring inits in wcn
    
    Remove the initialization for the following rings in wcn as these rings
    are not used for wcn chips.
    
    HAL_RXDMA_MONITOR_BUF
    HAL_PPE2TCL
    HAL_PPE_RELEASE
    HAL_TX_MONITOR_BUF
    HAL_RXDMA_MONITOR_DST
    HAL_TX_MONITOR_DST
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-17-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 2bb41934527d3b132958e214d688cc525d0088c1
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:42 2025 +0530

    wifi: ath12k: Segregate the common and wifi7 specific structures
    
    Segregate the common and wifi7 specific structures in hal,
    and move them to corresponding header files.
    
    hal.h file in common directory is used by both common
    and wifi7 directory files, while hal.h and other hal headers
    are used only by files within the wifi7 directory since
    these headers contain hw specific hal data.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-16-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit ea23813a2e442f96a05d3d2ddf3d42c6005b1862
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:41 2025 +0530

    wifi: ath12k: Move HAL Cookie Conversion and RBM related APIs to wifi7 directory
    
    Move the hardware specific HAL APIs to hal.c file
    inside wifi7 directory. These APIs will be called
    through the hal_ops mechanism, which are registered
    separately by qcn and wcn
    
    Handling following APIs:
    ath12k_wifi7_hal_cc_config
    ath12k_wifi7_hal_get_idle_link_rbm
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-15-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 17540a7c9b363e08eb417ffcd25c74226cbb131c
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:40 2025 +0530

    wifi: ath12k: Move HAL REO and Rx buf related APIs to wifi7 directory
    
    Move the hardware specific HAL APIs to hal.c file
    inside wifi7 directory. These APIs will be called
    through the hal_ops mechanism, which are registered
    separately by qcn and wcn
    
    Handling following APIs:
    ath12k_wifi7_hal_reo_qdesc_setup
    ath12k_wifi7_hal_reo_init_cmd_ring
    ath12k_wifi7_hal_reo_hw_setup
    ath12k_wifi7_hal_rx_buf_addr_info_set
    ath12k_wifi7_hal_rx_buf_addr_info_get
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-14-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 356942d328a4d85969953353b4b9c1f0934918c5
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:39 2025 +0530

    wifi: ath12k: Move HAL Tx, REO and link idle setup related APIs to wifi7 directory
    
    Move the hardware specific HAL APIs to hal.c file
    inside wifi7 directory. These APIs will be called
    through the hal_ops mechanism, which are registered
    separately by qcn and wcn
    
    Handling following APIs:
    ath12k_wifi7_hal_tx_set_dscp_tid_map
    ath12k_wifi7_hal_tx_configure_bank_register
    ath12k_hal_reoq_lut_addr_read_enable
    ath12k_hal_reoq_lut_set_max_peerid
    ath12k_wifi7_hal_write_reoq_lut_addr
    ath12k_wifi7_hal_write_ml_reoq_lut_addr
    ath12k_wifi7_hal_setup_link_idle_list
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-13-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit eba935ec922fd77a88ea2bed12d929afe340ee19
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:38 2025 +0530

    wifi: ath12k: Move HAL CE status and set link desc addr APIs to wifi7 directory
    
    Move the hardware specific HAL APIs to hal.c file
    inside wifi7 directory. These APIs will be called
    through the hal_ops mechanism, which are registered
    separately by qcn and wcn
    
    Handling following APIs:
    ath12k_wifi7_hal_ce_dst_status_get_length
    ath12k_wifi7_hal_set_link_desc_addr
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-12-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 3d947cef0a51e19a779b201fd27885b31af19383
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:37 2025 +0530

    wifi: ath12k: Move HAL CE desc related APIs to wifi7 directory
    
    Move the hardware specific HAL APIs to hal.c file
    inside wifi7 directory. These APIs will be called
    through the hal_ops mechanism, which are registered
    separately by qcn and wcn
    
    Handling following APIs:
    ath12k_wifi7_hal_ce_get_desc_size
    ath12k_wifi7_hal_ce_src_set_desc
    ath12k_wifi7_hal_ce_dst_set_desc
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-11-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit cb419f582f36873d31368835be34ec1500792dcb
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:36 2025 +0530

    wifi: ath12k: Move HAL SRNG shadow config and get ring id APIs to wifi7 directory
    
    Move the hardware specific HAL APIs to hal.c file
    inside wifi7 directory. These APIs will be called
    through the hal_ops mechanism, which are registered
    separately by qcn and wcn
    
    Handling following APIs:
    ath12k_wifi7_hal_srng_update_shadow_config
    ath12k_wifi7_hal_srng_get_ring_id
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-10-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit e9f00e22963e809a35999465036d3f58b126c1c6
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:35 2025 +0530

    wifi: ath12k: Move HAL CE setup and SRNG related APIs to wifi7 directory
    
    Move the hardware specific HAL APIs to hal.c file
    inside wifi7 directory. These APIs will be called
    through the hal_ops mechanism, which are registered
    separately by qcn and wcn
    
    Handling following APIs:
    ath12k_wifi7_hal_ce_dst_setup
    ath12k_wifi7_hal_srng_src_hw_init
    ath12k_wifi7_hal_srng_dst_hw_init
    ath12k_wifi7_hal_set_umac_srng_ptr_addr
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-9-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit b38213660ab9ebf9d32db40ec0ec6691b6dd9d1a
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:34 2025 +0530

    wifi: ath12k: Use hal handle instead of ab handle
    
    Use hal handle instead of ab handle in hal config APIs
    and register access APIs, as this reduces the indirection.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-8-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit a337bff1db715e67135a2e5fcb6ecafdcf81f8b7
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:33 2025 +0530

    wifi: ath12k: Add direct HAL pointer in ath12k_dp
    
    Add a direct pointer to the HAL context in ath12k_dp. Since ath12k_dp
    is frequenctly used in the per-packet data path, this avoids the need
    to access the HAL handle through the ab pointer, reducing indirection
    in the per-packet data path.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-7-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 492dea1892dacf1c1ee356c60465e7fcdc18cc97
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:32 2025 +0530

    wifi: ath12k: Move hal_params and regs to hal from hw
    
    Move hal_params and regs to hal structure from
    the hw structure, since these parameters are used by hal layer
    and make corresponding initializations in hal_init.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-6-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 1c1d4b491d2085f6bdea90b0e021abf8e30f0457
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:31 2025 +0530

    wifi: ath12k: Move wbm_rbm_map to hw specific hal files
    
    Move wbm_rbm_map from common hal file to
    hw specific hal files, since these implementations are
    specific and configurable for each hardware.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-5-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 369cb192c2ecf1228df06adcf1aa5074aecd2902
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:30 2025 +0530

    wifi: ath12k: Initialize hal_ops through hal_init
    
    Modularize the HAL layer by moving hal_ops from ab->hw_params into the
    ab->hal. This reduces indirection and allows data path to access HAL ops
    directly through the HAL context.
    
    Initialize hal_ops via hal_init using a const table ath12k_hw_version_map.
    This approach will be extended to register other HAL parameters during
    init.
    
    Remove ab->hw_params->hal_ops as it is no longer needed.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-4-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 74ed243dad18366aeb836f40b921758e20d9d5b7
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:29 2025 +0530

    wifi: ath12k: Initialize desc_size through hal_init
    
    Currently desc_size uses a dedicated hal_ops API for initialization.
    Combine it with other hal_params to be initialized in a
    single API "hal_init" during probe time using a static array.
    
    hal_init will be used as the common API to initialize
    all hal parameters during the probe.
    
    Add hal.c file to add hal definitions that are wifi7 specific
    but common between qca and wcn chipsets.
    Add hal.h header to add wifi7 specific prototypes/Macros etc
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-3-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit c0600b35e08db781511c2b35af2d2ec58bbfbdfd
Author: Pavankumar Nandeshwar 
Date:   Thu Oct 9 16:40:28 2025 +0530

    wifi: ath12k: Move srng config and hal_ops to hw specific hal files
    
    Move srng config and hal_ops from common hal file to
    hw specific hal files, since these implementations are
    specific and configurable for each hardware
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Baochen Qiang 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251009111045.1763001-2-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit c57176c0dad91a00bd20feb5f6dc4e8d575f4628
Author: Ripan Deuri 
Date:   Tue Oct 7 16:32:03 2025 +0530

    wifi: ath12k: Rearrange PPDU radio stats
    
    Encapsulate PPDU stats in dp_pdev as these stats are related to data path
    out-of-band operations. This reorganization improves the structuring of
    data path stats and enhances the efficiency of data path operations by
    consolidating both in-band (per packet) fields and out-of-band data path
    stats within the same ath12k_pdev_dp object.
    
    ppdu_list_lock is used to protect HTT pdev stats update.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251007110203.1541167-3-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 9e0ee04f818f42ec879b053e4b5d0c9c230415da
Author: Ripan Deuri 
Date:   Tue Oct 7 16:32:02 2025 +0530

    wifi: ath12k: Refactor data path pdev struct
    
    Refactor struct ath12k_pdev_dp to encapsulate all DP related fields of
    radio (ar) and rely on this single pdev object in per packet DP
    operations to optimize cache usage.
    
    Introduce an array of RCU-protected ath12k_pdev_dp in DP device object
    to find DP pdev directly from the DP device object.
    
    RCU on dp_pdevs[] provides a teardown synchronization mechanism by
    ensuring all in-flight access to dp_pdev pointers complete before reclaim.
    Once a dp_pdev pointer is obtained, its internal fields can be accessed
    as follows:
    
    - Writers update internal fields using their own synchronization.
    - Readers may perform lockless reads if occasional inconsistency is
      acceptable, or use additional synchronization (e.g., spin_lock,
      atomic_t) for a coherent view between readers and writers.
    
    Please note that RCU is used for dp_pdevs[] at this stage to align
    with ab->pdevs_active[]. However, if the teardown paths ensure quiescence,
    both dp_pdevs[] and pdevs_active[] can be converted to plain pointers,
    removing RCU synchronization overhead. This will be evaluated separately.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Link: https://patch.msgid.link/20251007110203.1541167-2-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit af66c7640cf94aa77314cf8d5e95141bdecbc1ee
Author: Harsh Kumar Bijlani 
Date:   Tue Sep 30 18:40:05 2025 +0530

    wifi: ath12k: Refactor ath12k_vif structure
    
    Move the Data Path (DP)-specific fields from ath12k_vif into a new
    structure ath12k_dp_vif, embedded within ath12k_vif. This new structure
    contains an array of per-link DP fields represented by ath12k_dp_link_vif.
    
    Since dp_link_vif is small and frequently accessed from ahvif during Tx,
    it is stored as an array of structs rather than an array of pointers to
    avoid additional indirections and improve cache efficiency. However,
    this design comes with a trade-off: because the array is not pointer-based,
    it increases memory usage.
    
    Per packet data path makes use of ath12k_dp_vif and ath12k_dp_link_vif.
    Add pdev_idx and lmac_id in ath12k_dp_link_vif to avoid accessing ar in
    dp tx.
    
    Diagrammatic view of the new structure is below:
    
    +--------------------------------+
    | struct ath12k_vif              |
    |                                |
    |  +--------------------------+  |
    |  | struct ath12k_dp_vif     |  |
    |  |                          |  |
    |  |  +--------------------+  |  |
    |  |  | ath12k_dp_link_vif |  |  |
    |  |  +--------------------+  |  |
    |  |                          |  |
    |  |  +--------------------+  |  |
    |  |  | ath12k_dp_link_vif |  |  |
    |  |  +--------------------+  |  |
    |  |                          |  |
    |  |  +--------------------+  |  |
    |  |  | ath12k_dp_link_vif |  |  |
    |  |  +--------------------+  |  |
    |  |                          |  |
    |  +--------------------------+  |
    |                                |
    +--------------------------------+
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250930131005.2884253-7-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 39538dc8860aa523dde38ab68a333cac4a98d9f2
Author: Ripan Deuri 
Date:   Tue Sep 30 18:40:04 2025 +0530

    wifi: ath12k: Add framework for hardware specific DP interrupt handler
    
    Currently, the DP service SRNG handler is invoked directly from the NAPI
    poll handler, which prevents using different handlers for different
    architectures. To fix this, introduce a DP architecture-ops table to
    invoke architecture specific handler from NAPI poll handler. Future patches
    will leverage this framework to invoke architecture-specific handlers from
    common code.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250930131005.2884253-6-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 914c890d3b905165afa17356bcf4e23352411486
Author: Ripan Deuri 
Date:   Tue Sep 30 18:40:03 2025 +0530

    wifi: ath12k: Add framework for hardware specific ieee80211_ops registration
    
    Introduce a framework to register the ieee80211_ops table based on the
    underlying hardware architecture. This is necessary to support
    architecture-specific implementations of ieee80211_ops such as .tx, which
    will be introduced in upcoming patches.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250930131005.2884253-5-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 8042e30acd1f48aa7d79a9be3b64b04376b0014c
Author: Ripan Deuri 
Date:   Tue Sep 30 18:40:02 2025 +0530

    wifi: ath12k: Rearrange DP fields in ath12k_hw_group struct
    
    Introduce the ath12k_dp_hw_group struct within ath12k_hw_group to
    encapsulate all Data Path fields, providing a baseline for future
    extensions. Add this struct to the top of ath12k_hw_group to allow
    optimal usage of cache lines for data path fields, as it is accessed
    in multiple tight loops in the per-packet path.
    
    Add cmn_def.h to define common macros shared between DP and other
    modules.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250930131005.2884253-4-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 614c23e24ee84d5cc2c1648941ee7156b4fb173f
Author: Ripan Deuri 
Date:   Tue Sep 30 18:40:01 2025 +0530

    wifi: ath12k: Support arch-specific DP device allocation
    
    Add arch_init() and arch_deinit() ops to the PCI and AHB family ops to
    support allocation and cleanup of architecture-specific fields in
    ath12k_base. Define shared ath12k_wifi7_arch_init() and
    ath12k_wifi7_arch_deinit() functions to handle DP device allocation and
    cleanup for Wi-Fi 7 across both PCI and AHB. Introduce a new header file
    wifi7/core.h to declare functions defined in wifi7/core.c.
    
    Currently, DP device allocation and cleanup are handled via arch_init()
    and arch_deinit(), which can be extended to support additional
    architecture-specific initialization in the future.
    
    Define common ath12k_wifi7_arch_init() and
    ath12k_wifi7_arch_deinit() functions to handle allocation and cleanup
    for Wi-Fi 7. Add a new header file wifi7/core.h to declare common Wi-Fi 7
    functions.
    
    Add ath12k_wifi7_dp_device_alloc() and ath12k_wifi7_dp_device_free() to
    handle allocation and deallocation of the DP device object for Wi-Fi 7.
    
    Add ath12k_dp_cmn_device_init() and ath12k_dp_cmn_device_deinit() to
    initialize and deinitialize common DP device fields. Introduce a new header
    file dp_cmn.h to declare these functions, which can also be used to expose
    new common DP functions that need to be invoked from non-DP code.
    
    Rename existing DP allocation and cleanup functions to ath12k_dp_setup()
    and ath12k_dp_cleanup() to better reflect their purpose in the updated
    design.
    
    Replicate device-related fields such as device and hw_params in the DP
    device object to align with the new design, which limits per packet data
    path object usage to DP specific objects.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250930131005.2884253-3-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 3a52762b539f6eefa6f600ab58577ee09f26657a
Author: Ripan Deuri 
Date:   Tue Sep 30 18:40:00 2025 +0530

    wifi: ath12k: Convert ath12k_dp member in ath12k_base to pointer
    
    Currently, the Data Path (DP) specific device object (ath12k_dp) is
    embedded directly within the ath12k_base structure. The DP object cannot
    be extended with architecture-specific fields within a contiguous memory
    block with this design.
    
    To address this, convert ath12k_dp into a dynamically allocated object
    and store it as a pointer in ath12k_base. This change allows allocation
    and initialization of ath12k_dp based on the underlying hardware
    architecture. Architecture-specific fields can now be maintained as
    private data within a contiguous memory block of ath12k_dp.
    
    This patch (and the forthcoming patches) are intended to serve the purpose
    of refactoring different DP objects for the Next Generation ath12k
    driver.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250930131005.2884253-2-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 972f34d54015a4a16aa9e6a081bafabb6f9bf95c
Author: Pavankumar Nandeshwar 
Date:   Wed Sep 10 23:44:14 2025 +0530

    wifi: ath12k: Change the API prefixes to ath12k_wifi7 in tx/rx
    
    Change the API prefixes to ath12k_wifi7_ from ath12k_ in all the tx
    and rx related files within wifi7 directory.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250910181414.2062280-9-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 0cdb09b19760f3464b3fbed782b59758124537c3
Author: Ripan Deuri 
Date:   Wed Sep 10 23:44:13 2025 +0530

    wifi: ath12k: Remove hal_rx_ops and merge into hal_ops
    
    Move following ops from hal_rx_ops to hal_ops to simplify the HAL interface.
    
    rx_desc_get_l3_pad_bytes
    rx_desc_get_mpdu_start_tag
    rx_desc_get_mpdu_ppdu_id
    rx_desc_get_msdu_payload
    
    Remove the hal_rx_ops as they become unused with this change.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250910181414.2062280-8-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit e8a1e49c63280e6266392cb4a9f879e22bad893a
Author: Pavankumar Nandeshwar 
Date:   Wed Sep 10 23:44:12 2025 +0530

    wifi: ath12k: Add new infra for the rx path
    
    The existing usage of rx_ops to reach the hal APIs at multiple place
    uses function pointer indirections. In order to avoid multiple function
    pointer indirections, add an API to extract the required hal parameters in
    the rx path right at the beginning and store them in a structure which
    is then leveraged by rest of the rx path.
    
    rx_desc_get_first_msdu
    rx_desc_get_last_msdu
    rx_desc_encrypt_valid
    rx_desc_get_encrypt_type
    rx_desc_get_decap_type
    rx_desc_get_mesh_ctl
    rx_desc_get_mpdu_seq_ctl_vld
    rx_desc_get_mpdu_fc_valid
    rx_desc_get_mpdu_start_seq_no
    rx_desc_get_msdu_len
    rx_desc_get_msdu_sgi
    rx_desc_get_msdu_rate_mcs
    rx_desc_get_msdu_rx_bw
    rx_desc_get_msdu_freq
    rx_desc_get_msdu_pkt_type
    rx_desc_get_msdu_nss
    rx_desc_get_mpdu_tid
    rx_desc_get_mpdu_peer_id
    rx_desc_mac_addr2_valid
    rx_desc_mpdu_start_addr2
    rx_desc_is_da_mcbc
    dp_rx_h_msdu_done
    dp_rx_h_l4_cksum_fail
    dp_rx_h_ip_cksum_fail
    dp_rx_h_is_decrypted
    dp_rx_h_mpdu_err
    
    Remove following unused HAL rx ops
    rx_desc_get_hdr_status
    rx_desc_get_attention
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250910181414.2062280-7-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 92541061a6fd4e6a0acd700e8544cb26f19570e8
Author: Pavankumar Nandeshwar 
Date:   Wed Sep 10 23:44:11 2025 +0530

    wifi: ath12k: Move hal_rx_ops callbacks to hal_ops
    
    Move the following callbacks from hal_rx_ops to hal_ops for use in
    non-performance-critical paths:
    
    rx_desc_set_msdu_len
    rx_desc_get_dot11_hdr
    rx_desc_get_crypto_header
    rx_desc_copy_end_tlv
    rx_desc_get_msdu_src_link_id
    rx_desc_get_desc_size
    
    hal_rx_ops currently includes callbacks used in both critical and
    non-critical Rx paths. To reduce function pointer indirection in hot
    path, performance-critical ops will be consolidated into a single
    extraction API in a follow-up patch.
    
    Begin cleanup by migrating non-performance-critical callbacks from
    hal_rx_ops to hal_ops. Once the extraction API is in place, remove
    hal_rx_ops entirely to simplify the HAL interface.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250910181414.2062280-6-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 52537339693789f3dd4ef7931f417ad641ee864b
Author: Pavankumar Nandeshwar 
Date:   Wed Sep 10 23:44:10 2025 +0530

    wifi: ath12k: Replace ops with direct calls for rxdma ring mask
    
    Replace following ops with direct function calls
    
    rxdma_ring_wmask_rx_mpdu_start
    rxdma_ring_wmask_rx_msdu_end
    rx_desc_get_mpdu_start_offset
    rx_desc_get_msdu_end_offset
    
    Remove redundant ops entries following the switch to direct
    function calls.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250910181414.2062280-5-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit dd33e179466e4c0c5f74ebd838eedd9212cd3964
Author: Ripan Deuri 
Date:   Wed Sep 10 23:44:09 2025 +0530

    wifi: ath12k: unify HAL ops naming across chips
    
    Rename HAL ops to follow a consistent hal ops format:
    ath12k_hal_rx_xxxx_.
    
    Remove "compact" references as non-compacts variant is no longer used.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250910181414.2062280-4-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 4ae34800a70d2704ec3a55146c86c4355a4129f6
Author: Ripan Deuri 
Date:   Wed Sep 10 23:44:08 2025 +0530

    wifi: ath12k: Move the hal APIs to hardware specific files
    
    Move the hal APIs from the existing common hal files to hardware specific
    hal files.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250910181414.2062280-3-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 00139e4d7baf41e05b907846dbc53829421bb1fc
Author: Pavankumar Nandeshwar 
Date:   Wed Sep 10 23:44:07 2025 +0530

    wifi: ath12k: Remove non-compact TLV support from QCN
    
    Set compact TLV ops as the default ops by registering them in
    hal_rx_ops by default for QCN, and remove non-compact TLV ops and the
    corresponding hal APIs for QCN.
    
    Please note that compact TLVs have been supported by the firmware since
    the beginning of Wi-Fi 7, so backward compatibility has been maintained.
    
    These changes are specific to QCN as WCN only support non-compact TLVs.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250910181414.2062280-2-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit d637c58a29475d646f8decfbbc1d27fae999a449
Author: Harsh Kumar Bijlani 
Date:   Thu Aug 28 23:05:53 2025 +0530

    wifi: ath12k: Move HTT specific code from dp.c to newly introduced files
    
    WLAN Host driver interacts with the Firmware and vice versa using
    Host-To-Target (HTT) interface.
    
    Relocate HTT specific code from dp.c to newly introduced file dp_htt.c
    for HTT interface.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-21-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 611297ee9faf6a28b1d553c41c4677052629cf6c
Author: Harsh Kumar Bijlani 
Date:   Thu Aug 28 23:05:52 2025 +0530

    wifi: ath12k: Move HTT Tx specific code to newly introduced files
    
    WLAN Host driver interacts with the Firmware and vice versa using
    Host-To-Target (HTT) interface.
    
    Relocate HTT specific code from dp_tx.c to dp_htt.c introduced for
    HTT interface. These code is compiled as part of the common module
    ath12k.ko.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-20-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 71a3f92c512e1605a2ffdae94e4d4e3a6a63b90f
Author: Harsh Kumar Bijlani 
Date:   Thu Aug 28 23:05:51 2025 +0530

    wifi: ath12k: Move HTT Rx specific code to newly introduced files
    
    WLAN Host driver interacts with the Firmware and vice versa using
    Host-To-Target (HTT) interface.
    
    HTT interface code is spread across multiple files (ex dp_tx.c, dp_rx.c
    etc) and this interface is independent of the underlying architecture Tx
    and Rx. Relocate HTT specific code from dp_rx.c to newly introduced file
    dp_htt.c for HTT interface. This new file is compiled as part of the
    common module ath12k.ko.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-19-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit d3ade00eb6d27dda5ba0026f5602f03b99df5a96
Author: Harsh Kumar Bijlani 
Date:   Thu Aug 28 23:05:50 2025 +0530

    wifi: ath12k: Move HTT code in dp.h to newly introduced files
    
    WLAN Host driver interacts with the Firmware and vice versa using
    Host-To-Target (HTT) interface.
    
    HTT interface code is spread across multiple files (ex dp_tx.c,
    dp_rx.c, dp.h etc) and this interface is independent of the underlying
    architecture Tx and Rx.
    
    Relocate HTT specific code from dp.h to newly introduced file dp_htt.h
    for HTT interface.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Harsh Kumar Bijlani 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-18-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit a45d0e81b2429c26db6b1ee0d43ff62b12d41d1f
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:49 2025 +0530

    wifi: ath12k: Move ath12k_dp_tx and related APIs to wifi7 directory
    
    Move arch specific TX data path to wifi7 directory as part of Next
    Generation (NG) Driver Framework.
    
    Architecture specific APIs:
    ath12k_hal_tx_cmd_ext_desc_setup
    ath12k_dp_prepare_htt_metadata
    ath12k_dp_tx
    
    The moved APIs will be a part of dp_tx.c file inside wifi7 directory.
    wifi7/dp_tx.c file will continue to be part of ath12k.ko temporarily
    until the corresponding infra for movement to ath12k_wifi7.ko arrives
    in upcoming patches.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-17-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 8527d81ee622f509df11e4444c7d0901ac542174
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:48 2025 +0530

    wifi: ath12k: Move arch specific tx APIs to wifi7 directory
    
    Move arch specific TX data path to wifi7 directory as part of Next
    Generation (NG) Driver Framework.
    
    Architecture specific APIs:
    ath12k_dp_tx_htt_tx_complete_buf
    ath12k_dp_tx_process_htt_tx_complete
    ath12k_dp_tx_update_txcompl
    ath12k_dp_tx_complete_msdu
    ath12k_dp_tx_status_parse
    ath12k_dp_tx_completion_handler
    
    The moved APIs will be a part of dp_tx.c file inside wifi7 directory.
    wifi7/dp_tx.c file will continue to be part of ath12k.ko temporarily
    until the corresponding infra for movement to ath12k_wifi7.ko arrives
    in upcoming patches.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-16-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 52c555680bae89a5169810f1f12a06241c93ecb7
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:47 2025 +0530

    wifi: ath12k: Move arch specific rx tid and related functions to wifi7 directory
    
    Move arch specific Rx tid related functions to wifi7 directory.
    
    The moved APIs will be a part of dp_rx.c file inside wifi7 directory.
    wifi7/dp_rx.c file will continue to be part of ath12k.ko
    temporarily until the corresponding infra for movement
    to ath12k_wifi7.ko arrives in upcoming patches.
    
    Architecture specific APIs:
    ath12k_peer_rx_tid_qref_reset
    ath12k_dp_reo_cache_flush
    ath12k_dp_reo_cmd_send
    ath12k_peer_rx_tid_reo_update
    ath12k_dp_rx_link_desc_return
    ath12k_dp_rx_peer_tid_delete
    ath12k_peer_rx_tid_qref_setup
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-15-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 6c7ceff2bed9d69007d23883f12a1406e149a060
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:46 2025 +0530

    wifi: ath12k: Move arch specific REO functions to wifi7 directory
    
    Move arch specific REO functions to wifi7 directory.
    
    The moved APIs will be a part of dp_rx.c file inside wifi7 directory.
    wifi7/dp_rx.c file will continue to be part of ath12k.ko temporarily
    until the corresponding infra for movement to ath12k_wifi7.ko arrives
    in upcoming patches.
    
    Architecture specific APIs:
    ath12k_dp_setup_pn_check_reo_cmd
    ath12k_dp_rx_assign_reoq
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-14-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit eb2120ae6ab5790527f3b3066410543c1b7a5ab4
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:45 2025 +0530

    wifi: ath12k: Separate arch specific part of RX APIs
    
    Below API have architecture specific HAL macros.
      ath12k_dp_rx_peer_pn_replay_config
    
    Separate architecture specific parts from these APIs to
    later move them to wifi7 directory.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-13-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 5d2df2aa84303a187b82ca048ae28709bef85f77
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:44 2025 +0530

    wifi: ath12k: Move srng processing to wifi7 directory
    
    Move ath12k_dp_service_srng API and ath12k_dp_rx_process_reo_status
    to wifi7 directory.
    
    As srng processing is specific to architecture (wifi7 / wifi8), the
    API ath12k_dp_service_srng is being moved to wifi7 directory. The
    file wifi7/dp.c can be used to define wifi7-specifi functions that are
    common to both tx and rx.
    
    The API which is invoked as part of service srng,
    ath12k_dp_rx_process_reo_status is also moved to wifi7 directory, as
    the implementation is specific to HW due to the usage of wifi7
    specific HAL macros.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-12-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit a7cfbb18d411b186ff67f62215e53e125ccc93d6
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:43 2025 +0530

    wifi: ath12k: Move regular msdu processing functions to wifi7 directory
    
    Move arch specific RX MSDU processing related functions to wifi7 directory.
    
    The moved APIs will be a part of dp_rx.c file inside wifi7 directory.
    wifi7/dp_rx.c file will continue to be part of ath12k.ko temporarily
    until the corresponding infra for movement to ath12k_wifi7.ko arrives
    in upcoming patches.
    
    Architecture specific APIs:
    ath12k_dp_rx_msdu_coalesce
    ath12k_dp_rx_h_csum_offload
    ath12k_dp_rx_h_mpdu
    ath12k_dp_rx_process
    ath12k_dp_rx_process_received_packets
    ath12k_dp_rx_h_verify_tkip_mic
    ath12k_dp_rx_process_msdu
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-11-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 6b4954d3f0000cc687f263a151ec2c7ad38e00a8
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:42 2025 +0530

    wifi: ath12k: Move rx error and defrag functions to wifi7 directory
    
    Move arch specific RX error and defrag functions to wifi7 directory.
    
    The moved APIs will be a part of dp_rx.c file inside wifi7 directory.
    wifi7/dp_rx.c file will continue to be part of ath12k.ko
    temporarily until the corresponding infra for movement
    to ath12k_wifi7.ko arrives in upcoming patches.
    
    Architecture specific APIs:
    ath12k_dp_rx_h_defrag_validate_incr_pn
    ath12k_dp_rx_h_defrag_reo_reinject
    ath12k_dp_rx_h_defrag
    ath12k_dp_rx_frag_h_mpdu
    ath12k_dp_process_rx_err_buf
    ath12k_dp_rx_process_err
    ath12k_dp_rx_null_q_desc_sg_drop
    ath12k_dp_rx_h_null_q_desc
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-10-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 8dc72a6f603e81050ebb3d8b4b2fc5fde0d9dd93
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:41 2025 +0530

    wifi: ath12k: Move rxdma ring config functions to wifi7 directory
    
    Move architecture specific RxDMA functions to wifi7 directory.
    
    The moved APIs will be a part of dp_rx.c file inside wifi7 directory.
    wifi7/dp_rx.c file will continue to be part of ath12k.ko temporarily
    until the corresponding infra for movement to ath12k_wifi7.ko arrives
    in upcoming patches.
    
    Architecture specific APIs:
    ath12k_dp_rxdma_ring_sel_config_qcn9274
    ath12k_dp_rxdma_ring_sel_config_wcn7850
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-9-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 8658abc7139fc72d94959335becbabcd2b3c95a3
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:40 2025 +0530

    wifi: ath12k: Move rx_desc.h file to wifi7 directory
    
    Move wifi7 architecture specific file rx_desc.h to wifi7 directory
    and rename it to hal_rx_desc.h to match the naming convention used,
    and move the common part from it to hal.h file which is in the
    common directory.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-8-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 87a230ec2bfa15506b885e7ab958bf45b0036e8d
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:39 2025 +0530

    wifi: ath12k: Move hal_desc.h file to wifi7 directory
    
    Move wifi7 architecture specific file hal_desc.h to wifi7 directory,
    and move the common part from it to hal.h file which is in the
    common directory.
    
    It is as part of a broader effort to separate common and hardware-specific
    code into distinct modules. This modularization enables reuse of the common
    driver components across multiple hardware architectures.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-7-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 1a6a4b6c9f0ea0740c86dda8b981b6d818433fe0
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:38 2025 +0530

    wifi: ath12k: Move Rx error related functions to wifi7 directory
    
    Move wifi7 architecture specific Rx error functions from dp_rx.c to
    wifi7 directory.
    
    The new wifi7-specific dp_rx.c file will continue to be part of ath12k.ko
    temporarily until the corresponding infra for movement to the
    ath12k_wifi7.ko arrives in upcoming patches.
    
    Move following architecture specific APIs to wifi7 directory:
    
    ath12k_dp_rx_h_tkip_mic_err
    ath12k_dp_rx_h_rxdma_err
    ath12k_dp_rx_h_reo_err
    ath12k_dp_rx_wbm_err
    ath12k_dp_rx_process_wbm_err
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-6-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 2ec00a7747cb78b0c310ba1c8bc9893e53101569
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:37 2025 +0530

    wifi: ath12k: Move HAL Rx wrapper APIs to dp_rx.h
    
    Move HAL Rx APIs from dp_rx.c to dp_rx.h to facilitate the separation of
    common and hardware-specific code that are dependent on these HAL Rx ops
    in upcoming patches.
    
    Move the following wrapper APIs to dp_rx.h
    
    ath12k_dp_rx_h_enctype
    ath12k_dp_rx_h_mesh_ctl_present
    ath12k_dp_rx_h_seq_ctrl_valid
    ath12k_dp_rx_h_fc_valid
    ath12k_dp_rx_h_more_frags
    ath12k_dp_rx_h_frag_no
    ath12k_dp_rx_h_seq_no
    ath12k_dp_rx_h_msdu_done
    ath12k_dp_rx_h_l4_cksum_fail
    ath12k_dp_rx_h_ip_cksum_fail
    ath12k_dp_rx_h_is_decrypted
    ath12k_dp_rx_h_msdu_len
    ath12k_dp_rx_h_sgi
    ath12k_dp_rx_h_rate_mcs
    ath12k_dp_rx_h_rx_bw
    ath12k_dp_rx_h_freq
    ath12k_dp_rx_h_pkt_type
    ath12k_dp_rx_h_nss
    ath12k_dp_rx_h_tid
    ath12k_dp_rx_h_peer_id
    ath12k_dp_rx_h_first_msdu
    ath12k_dp_rx_h_last_msdu
    ath12k_dp_rx_desc_end_tlv_copy
    ath12k_dp_rxdesc_set_msdu_len
    ath12k_dp_rx_h_is_da_mcbc
    ath12k_dp_rxdesc_mac_addr2_valid
    ath12k_dp_rxdesc_get_mpdu_start_addr2
    ath12k_dp_rx_desc_get_dot11_hdr
    ath12k_dp_rx_desc_get_crypto_header
    ath12k_dp_rx_get_msdu_src_link
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-5-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 4f57d71862a7edef67de6c2072127dc1c8960a24
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:36 2025 +0530

    wifi: ath12k: Move hal_rx.h file to wifi7 directory
    
    Move wifi7 architecture specific file hal_rx.h to wifi7 directory, and move
    the common part from it to hal.h file which is in the common directory.
    
    It is as part of a broader effort to separate common and hardware-specific
    code into distinct modules. This modularization enables reuse of the common
    driver components across multiple hardware architectures.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-4-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 020225bbf4fb2fb23553ac9c65c8f50bb4d2fe74
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:35 2025 +0530

    wifi: ath12k: Move hal_tx.h file to wifi7 directory
    
    Move wifi7 architecture specific file hal_tx.h to wifi7 directory, and move
    the common part from it to hal.h file which is in the common directory.
    
    It is as part of a broader effort to separate common and hardware-specific
    code into distinct modules. This modularization enables reuse of the common
    driver components across multiple hardware architectures.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-3-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit dc722ea9ee13369b1d4687160206e6bde2e8c2e2
Author: Pavankumar Nandeshwar 
Date:   Thu Aug 28 23:05:34 2025 +0530

    wifi: ath12k: Move hal_tx and hal_rx to wifi7 directory
    
    Move architecture-specific files hal_rx.c and hal_tx.c into the wifi7
    directory as part of a broader effort to separate common and hardware
    -specific code into distinct modules. This modularization enables reuse
    of the common driver components across multiple hardware architectures.
    
    The relocated files remain part of ath12k.ko temporarily, until the
    corresponding infra for movement to the ath12k_wifi7.ko arrives in
    upcoming patches.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Pavankumar Nandeshwar 
    Signed-off-by: Ripan Deuri 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250828173553.3341351-2-quic_rdeuri@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 0e487f03c6e5d8dd5b076b8b061e50e736ab2196
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:39 2025 +0530

    wifi: ath12k: Remove HAL define dependencies from shared AHB code
    
    Eliminate HAL-specific defines from the shared AHB implementation.
    Store the WFSS register base-already available in hw_params via the
    ce_remap structure-in the AHB context and access it directly.
    Add the CMEM offset to the ce_remap structure and use it consistently in
    shared code. Improve modularity by removing hardware abstraction layer
    dependencies from common code paths and enable cleaner separation of
    target-specific logic
    
    Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.3.1-00130-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-13-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 6cbd171805be7443bbfdb8ff0a646348180eee35
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:38 2025 +0530

    wifi: ath12k: Remove HAL defines from shared PCI code
    
    Eliminate use of HAL-specific defines in the shared PCI implementation.
    Pass required register offsets during PCI registration and store them in
    the PCI context structure. Access offsets directly from the context to
    improve modularity and remove hardware-specific dependencies in the
    common code path.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-12-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit bce3b73d1ca744fc1c9cb92eec37b0dd209ae9a1
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:37 2025 +0530

    wifi: ath12k: Rename ath12k_* symbols to ath12k_wifi7_* for clarity
    
    Rename functions and global definitions from ath12k_* to ath12k_wifi7_*
    to reflect their association with the Wi-Fi 7 specific module.
    Align symbol naming with recent relocation of components into the
    ath12k/wifi7 directory.
    
    This change improves code clarity and supports the modularization effort
    that separates common and hardware-specific logic into distinct modules.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.3.1-00130-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-11-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit a72027045263f8261b47fc28e7b6da7571d8cbb5
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:36 2025 +0530

    wifi: ath12k: Modularize driver into common and Wi-Fi 7 specific components
    
    Split the ath12k driver into two kernel modules:
    
     - ath12k.ko for shared logic across multiple targets
     - ath12k_wifi7.ko for Wi-Fi 7 specific configuration and routines
    
    The common module (ath12k.ko) must be loaded prior to any device-specific
    module, as the latter depends on exported symbols from the former.
    
    As part of this restructuring, Wi-Fi 7 specific files are moved into a
    dedicated `wifi7/` directory and built as a separate module. Common
    symbols are exported accordingly, with further adjustments planned
    in upcoming patches to support architecture-dependent separation.
    
    This modularization improves maintainability and scalability by enabling
    clean separation of hardware-specific logic from the shared driver core.
    
                                              +-----------------+
                                              |                 |
                                              |   ath12k.ko     |
                                              |    (common)     |
            +---------------+                 |                 |
            |               |                 +-----------------+
            |   ath12k.ko   | ===========>
            |               |                 +------------------+
            +---------------+                 |                  |
                                              | ath12k_wifi7.ko  |
                                              | (wifi7 family)   |
                                              |                  |
                                              +------------------+
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.3.1-00130-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-10-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 83cd89a9556a48d31d706f67854873cadbf80c0e
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:35 2025 +0530

    wifi: ath12k: Move hw_init invocation to target-specific probe
    
    Relocate hw_init call from the shared probe path to target-specific
    probe implementations. Handle Wi-Fi 7 initialization entirely within
    its corresponding target-specific file.
    Improve modularity by decoupling hardware-dependent initialization from
    common probe logic. Support broader effort to separate shared and
    target-specific code paths.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.3.1-00130-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-9-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 387b587a861cf7864df93c99c123877d28100bb3
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:34 2025 +0530

    wifi: ath12k: Move Wi-Fi 7 specific init routines to dedicated file
    
    Move Wi-Fi 7 specific module initialization and exit routines from core.c
    to a new core_wifi7.c file. Decouple these routines from common module
    entry points to improve modularity.
    
    This restructuring is part of a broader effort to modularize the
    ATH12K driver by separating common logic from hardware family-specific
    implementations, improving maintainability and scalability.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.3.1-00130-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-8-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit db2929711d705ed244f0f5a41441a6103ecc785c
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:33 2025 +0530

    wifi: ath12k: Restructure ahb.c into common and Wi-Fi 7 specific modules
    
    Split ahb.c into a common module (ahb.c) and a Wi-Fi 7 specific module
    (ahb_wifi7.c). Retain shared logic-such as probe and initialization
    sequences-in ahb.c to support reuse across hardware families.
    Move Wi-Fi 7 specific initialization and configuration routines to
    ahb_wifi7.c and register them via callbacks.
    This modular approach improves code organization and prepares the
    driver for scalable support of additional hardware families.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.3.1-00130-QCAHKSWPL_SILICONZ-1
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-7-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit bca2b24d9dd98c06b61f6e15789b652b98ff7c87
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:32 2025 +0530

    wifi: ath12k: Rename ahb_hif_ops to reflect generic usage
    
    Rename ahb_hif_ops structure to remove the IPQ5322 qualifier and reflect
    its generic applicability across multiple targets. Clarify its role as a
    container for common HIF callbacks.
    
    This renaming is part of a broader effort to modularize the codebase
    by separating common logic from device-specific implementations.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-6-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 3f8d0eb8037b199e84c41c6ba687104ccbf076f3
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:31 2025 +0530

    wifi: ath12k: Rename hw.c to Wi-Fi 7 specific implementation file
    
    Rename hw.c to hw_wifi7.c to reflect its focus on Wi-Fi 7 chipset
    specific configurations. Clarify the files role in containing
    hardware dependent logic tailored to the Wi-Fi 7 family.
    
    This change is part of a broader effort to modularize the codebase
    by separating common and target specific components into distinct
    modules for improved clarity and maintainability.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-5-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 7f54938fc5253a89b962fc137ea725e3e3405757
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:30 2025 +0530

    wifi: ath12k: Move Wi-Fi 7 MHI configuration to dedicated file
    
    Relocate target-specific MHI configuration to a new mhi_wifi7.c file to
    isolate Wi-Fi 7 related logic from the common codebase.
    Improve modularity by separating hardware-dependent code from shared
    components.
    Enhance maintainability and prepare the driver for clean integration of
    additional device families.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-4-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit d650b777858f38dbbd5bd2cb43c97eb261e95f9d
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:29 2025 +0530

    wifi: ath12k: Move Wi-Fi 7 WMI configuration to dedicated file
    
    Relocate Wi-Fi 7 specific WMI configuration from shared codebase to a new
    target-specific file. Isolate WMI settings per target to improve
    modularity and maintainability.
    
    This change is part of a broader effort to separate hardware-dependent
    logic into standalone modules, paving the way for cleaner support of
    multiple hardware families
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-3-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit 5e545696a398ae39f4c0c747a8ba0c7073037d1b
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:28 2025 +0530

    wifi: ath12k: Move Copy Engine configuration to Wi-Fi 7 specific file
    
    Relocate Copy Engine (CE) assignment logic from ce.c to a new ce_wifi7.c
    file to consolidate Wi-Fi 7 specific CE configuration in one place.
    Move CE service map and target configuration from hw.c to ce_wifi7.c.
    
    This reorganization improves code clarity and modularity by isolating
    device-specific logic. It is part of a broader effort to separate
    common and hardware-specific code into distinct modules.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-2-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson 

commit f844982696f57d72e45f94608278f678a0f67b26
Author: Kiran Venkatappa 
Date:   Tue Aug 12 22:39:27 2025 +0530

    wifi: ath12k: Restructure PCI code to common and Wi-Fi 7 specific logic
    
    Refactor pci.c to split common and hardware family specific components.
    Retain shared logic such as probe and initialization sequences in common
    pci.c to support reuse across device families and move Wi-Fi 7 specific
    initialization and configuration to a new pci_wifi7.c file. Register
    device specific routines via callbacks to keep the common PCI code
    generic and extensible for future hardware families.
    This improves maintainability and prepare the codebase for additional
    device family support.
    
    Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
    Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
    
    Signed-off-by: Kiran Venkatappa 
    Reviewed-by: Vasanthakumar Thiagarajan 
    Reviewed-by: Baochen Qiang 
    Link: https://patch.msgid.link/20250812-ath12k-mod-v1-1-8c9b0eb9335d@quicinc.com
    Signed-off-by: Jeff Johnson